From 9636e992689e0760b502f5f627d695c3546ca319 Mon Sep 17 00:00:00 2001
From: Prachi Damle <prachi@rancher.com>
Date: Tue, 14 Apr 2020 01:16:22 -0700
Subject: [PATCH 001/265] Docs on how to create OPA Gatekeeper constraints
 using default templates

---
 .../tools/opa-gatekeper/_index.md             | 116 ++++++++++++++++++
 1 file changed, 116 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
index 12c951c6279..043e4bc2a4e 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
@@ -45,6 +45,8 @@ When OPA Gatekeeper is enabled, Rancher installs some templates by default.
 
 To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates.**
 
+For detailed steps on how to create constraints using these default templates, please refer [this section below](#Using-the-Default-Constraint-Templates)
+
 Rancher also provides the ability to create your own constraint templates by importing YAML definitions.
    
 # Creating and Configuring Constraints
@@ -95,3 +97,117 @@ The detail view of each constraint lists information about the resource that vio
 
 **Result:** Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted.
 
+# Using the Default Constraint Templates
+
+When OPA Gatekeeper is enabled, Rancher installs some templates by default. Currently there are following templates installed:
+
+1. **k8sallowedrepos** - Template that can be used to whitelist registries.
+1. **k8srequiredlabels** - Template that can be used to enforce desired Labels on specific Kubernetes objects.
+
+This section describes how to use these templates to create constraints for enforcing certain policies on the cluster via the **Dashboard** view.
+
+Currently it is not possible to create a constraint via "Edit as Form" by passing non-scalar parameters, but one can create it by using the **Edit As YAML** option.
+
+The constraint created can be edited using the form.
+
+## Constraint to whitelist registries
+
+Suppose you want to apply a policy that restricts creation of any Pods in your cluster to use images from a particular repository only,
+
+then you can create a constraint from the  **k8sallowedrepos** template.
+
+For example, suppose we want all "Pods" launched in the namespace "test" to use images only from "quay.io" registry.
+
+Steps to do that via Rancher's dashboard view are as follows:
+1. Enable OPA Gatekeeper using the cluster's **Dashboard** view
+1. Navigate to OPA Gatekeeper -> Constraints -> Create
+1. Use the **Edit As YAML** option on the right hand corner of the Create Form; paste the following yaml and click **Create** to add the constraint
+1. The yaml specifies the parameter "repos" as defined by the "k8sallowedrepos" template schema.
+1. This constraint specifies that the image repository "quay.io" should be used by all "Pod" objects in "test" namespace.
+1. Notice that all the system namespaces are by default added to list of "excludedNamespaces"
+
+    ```yml
+    type: constraints.gatekeeper.sh.k8sallowedrepos
+    spec:
+      match:
+        excludedNamespaces:
+          - cattle-system
+          - gatekeeper-system
+          - ingress-nginx
+          - kube-node-lease
+          - kube-public
+          - kube-system
+          - security-scan
+        kinds:
+          - apiGroups: [""]
+            kinds: ["Pod"]
+        namespaces:
+          - "test"
+        labelSelector:
+          matchExpressions: []
+        namespaceSelector:
+          matchExpressions: []
+      parameters:
+        repos:
+          - "quay.io"
+      enforcementAction: deny
+    metadata:
+      name: test-repo-is-quay-io
+      annotations:
+        cattle.io/description: whitelist repo quay.io
+    ```
+
+1. After the above constraint is created, it will be listed under "K8sAllowedRepos" on the "Constraints" page.
+1. You can edit the constraint via form to change the namespaces and other information.
+1. Now if you navigate **Back to Rancher** and create a workload under "test" namespace with any image other than the "quay.io" registry,
+you will get an error from OPA Gatekeeper.
+
+
+## Constraint to enforce Labels
+
+Suppose you want to apply a policy that requires certain set of Labels present on Kubernetes resources of specific Kind, then you can create a constraint from the  **k8srequiredlabels** template.
+
+For example, suppose we want all "Namespaces" in the cluster to have labels "test".
+
+Steps to do that via Rancher's dashboard view are as follows:
+1. Enable OPA Gatekeeper using the cluster's **Dashboard** view.
+1. Navigate to OPA Gatekeeper -> Constraints -> Create.
+1. Use the **Edit As YAML** option on the right hand corner of the Create Form; paste the following yaml and click **Create** to add the constraint.
+1. The yaml specifies the parameters "message" and "labels" as defined by the "k8srequiredlabels" template schema.
+1. This constraint defines that all "namespaces" must have a label "team" whose value should match the given "allowedRegex".
+1. Notice that all the system namespaces are by default added to list of "excludedNamespaces".
+
+    ```yml
+    type: constraints.gatekeeper.sh.k8srequiredlabels
+    spec:
+      match:
+        excludedNamespaces:
+          - cattle-system
+          - gatekeeper-system
+          - ingress-nginx
+          - kube-node-lease
+          - kube-public
+          - kube-system
+          - security-scan
+        kinds:
+          - apiGroups: [""]
+            kinds: ["Namespace"]
+        labelSelector:
+          matchExpressions: []
+        namespaceSelector:
+          matchExpressions: []
+      parameters:
+        message: "All namespaces must have an `team` label that points to your team name"
+        labels:
+          - key: team
+            allowedRegex: "^[a-zA-Z]+$"
+      enforcementAction: deny
+    metadata:
+      name: ns-must-have-label
+      annotations:
+        cattle.io/description: constraint for ns label
+    ```
+
+1. After the above constraint is created, it will be listed under "K8sRequiredLabels" on the "Constraints" page.
+1. You can edit the constraint via form to change the namespaces and other information.
+1. Now if you navigate **Back to Rancher** and create a new namespace in the cluster without having the label "team", the create request should be denied.

From cddcdfda78974d61cf7abeccd93c69dc0593fe1b Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 14 Apr 2020 12:42:51 -0700
Subject: [PATCH 002/265] Edit docs about default constraint templates

---
 .../tools/opa-gatekeper/_index.md             | 68 +++++++++----------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
index 043e4bc2a4e..01b319bf31d 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
@@ -45,7 +45,7 @@ When OPA Gatekeeper is enabled, Rancher installs some templates by default.
 
 To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates.**
 
-For detailed steps on how to create constraints using these default templates, please refer [this section below](#Using-the-Default-Constraint-Templates)
+For detailed steps on how to create constraints using these default templates, please refer [this section below](#using-the-default-constraint-templates)
 
 Rancher also provides the ability to create your own constraint templates by importing YAML definitions.
    
@@ -99,34 +99,31 @@ The detail view of each constraint lists information about the resource that vio
 
 # Using the Default Constraint Templates
 
-When OPA Gatekeeper is enabled, Rancher installs some templates by default. Currently there are following templates installed:
+When OPA Gatekeeper is enabled, Rancher installs some templates by default. Currently the following constraint templates are installed:
 
 1. **k8sallowedrepos** - Template that can be used to whitelist registries.
-1. **k8srequiredlabels** - Template that can be used to enforce desired Labels on specific Kubernetes objects.
+1. **k8srequiredlabels** - Template that can be used to enforce desired labels on specific Kubernetes objects.
 
 This section describes how to use these templates to create constraints for enforcing certain policies on the cluster via the **Dashboard** view.
 
-Currently it is not possible to create a constraint via "Edit as Form" by passing non-scalar parameters, but one can create it by using the **Edit As YAML** option.
+Currently it is not possible to create a constraint via "Edit as Form" by passing non-scalar parameters, but one can create them by using the **Edit As YAML** option.
 
 The constraint created can be edited using the form.
 
-## Constraint to whitelist registries
+### Constraint to Whitelist Registries
 
-Suppose you want to apply a policy that restricts creation of any Pods in your cluster to use images from a particular repository only,
+Suppose you want to apply a policy that restricts creation of any pods in your cluster to use images only from a whitelisted repository. In this case, you would create a constraint from the  **k8sallowedrepos** template.
 
-then you can create a constraint from the  **k8sallowedrepos** template.
-
-For example, suppose we want all "Pods" launched in the namespace "test" to use images only from "quay.io" registry.
+For example, suppose we want all pods launched in the namespace `test` to use images only from the quay.io registry.
 
 Steps to do that via Rancher's dashboard view are as follows:
-1. Enable OPA Gatekeeper using the cluster's **Dashboard** view
-1. Navigate to OPA Gatekeeper -> Constraints -> Create
-1. Use the **Edit As YAML** option on the right hand corner of the Create Form; paste the following yaml and click **Create** to add the constraint
-1. The yaml specifies the parameter "repos" as defined by the "k8sallowedrepos" template schema.
-1. This constraint specifies that the image repository "quay.io" should be used by all "Pod" objects in "test" namespace.
-1. Notice that all the system namespaces are by default added to list of "excludedNamespaces"
 
-    ```yml
+> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's **Dashboard** view.
+
+1. Navigate to **OPA Gatekeeper > Constraints > Create.**
+1. Use the **Edit As YAML** option on the right hand corner of the Create form. Paste the following YAML and click **Create** to add the constraint:
+
+    ```yaml
     type: constraints.gatekeeper.sh.k8sallowedrepos
     spec:
       match:
@@ -156,28 +153,27 @@ Steps to do that via Rancher's dashboard view are as follows:
       annotations:
         cattle.io/description: whitelist repo quay.io
     ```
+    
+    The YAML specifies the directive `repos` as defined by the `k8sallowedrepos` template schema.
 
-1. After the above constraint is created, it will be listed under "K8sAllowedRepos" on the "Constraints" page.
-1. You can edit the constraint via form to change the namespaces and other information.
-1. Now if you navigate **Back to Rancher** and create a workload under "test" namespace with any image other than the "quay.io" registry,
-you will get an error from OPA Gatekeeper.
+    This constraint specifies that the image repository "quay.io" should be used by all pod objects in the `test` namespace. Notice that all the system namespaces are by default added to the list of `excludedNamespaces`. After the above constraint is created, it will be listed under "K8sAllowedRepos" on the "Constraints" page. You can edit the constraint via the form to change the namespaces and other information.
 
+**Result:** Now if you navigate **Back to Rancher** and create a workload under the `test` namespace with any image other than the "quay.io" registry, you will get an error from OPA Gatekeeper.
 
-## Constraint to enforce Labels
+### Constraint to Enforce Labels
 
-Suppose you want to apply a policy that requires certain set of Labels present on Kubernetes resources of specific Kind, then you can create a constraint from the  **k8srequiredlabels** template.
+Suppose you want to apply a policy that requires certain set of labels present on Kubernetes resources of a specific kind, then you can create a constraint from the  **k8srequiredlabels** template.
 
-For example, suppose we want all "Namespaces" in the cluster to have labels "test".
+For example, suppose we want all namespaces in the cluster to be labeled with the name of a team.
 
 Steps to do that via Rancher's dashboard view are as follows:
-1. Enable OPA Gatekeeper using the cluster's **Dashboard** view.
-1. Navigate to OPA Gatekeeper -> Constraints -> Create.
-1. Use the **Edit As YAML** option on the right hand corner of the Create Form; paste the following yaml and click **Create** to add the constraint.
-1. The yaml specifies the parameters "message" and "labels" as defined by the "k8srequiredlabels" template schema.
-1. This constraint defines that all "namespaces" must have a label "team" whose value should match the given "allowedRegex".
-1. Notice that all the system namespaces are by default added to list of "excludedNamespaces".
 
-    ```yml
+> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's **Dashboard** view.
+
+1. Navigate to OPA Gatekeeper > Constraints > Create.
+1. Use the **Edit As YAML** option on the right hand corner of the Create form. Paste the following yaml and click **Create** to add the constraint:
+
+    ```yaml
     type: constraints.gatekeeper.sh.k8srequiredlabels
     spec:
       match:
@@ -197,7 +193,7 @@ Steps to do that via Rancher's dashboard view are as follows:
         namespaceSelector:
           matchExpressions: []
       parameters:
-        message: "All namespaces must have an `team` label that points to your team name"
+        message: "All namespaces must have a `team` label that points to your team name"
         labels:
           - key: team
             allowedRegex: "^[a-zA-Z]+$"
@@ -207,7 +203,11 @@ Steps to do that via Rancher's dashboard view are as follows:
       annotations:
         cattle.io/description: constraint for ns label
     ```
+    
+    The YAML specifies the directives `message` and `labels` as defined by the **k8srequiredlabels** template schema. This constraint defines that all"namespaces must have a label `team` whose value should match the given "allowedRegex". Notice that all the system namespaces are by default added to list of `excludedNamespaces`.
 
-1. After the above constraint is created, it will be listed under "K8sRequiredLabels" on the "Constraints" page.
-1. You can edit the constraint via form to change the namespaces and other information.
-1. Now if you navigate **Back to Rancher** and create a new namespace in the cluster without having the label "team", the create request should be denied.
+    After the above constraint is created, it will be listed under "K8sRequiredLabels" on the "Constraints" page.
+
+    You can edit the constraint via the form to change the namespaces and other information.
+
+**Result:** Now if you navigate **Back to Rancher** and create a new namespace in the cluster without having the label `team`, the create request should be denied.

From 2c3f255f67cd545818c93a1b800ca9fc38de846c Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 14 Apr 2020 12:48:41 -0700
Subject: [PATCH 003/265] Minor fixes

---
 .../tools/opa-gatekeper/_index.md             | 24 +++++++++----------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
index 01b319bf31d..8955be1bf2e 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
@@ -45,7 +45,7 @@ When OPA Gatekeeper is enabled, Rancher installs some templates by default.
 
 To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates.**
 
-For detailed steps on how to create constraints using these default templates, please refer [this section below](#using-the-default-constraint-templates)
+For detailed steps on how to create constraints using these default templates, please refer to [this section.](#using-the-default-constraint-templates)
 
 Rancher also provides the ability to create your own constraint templates by importing YAML definitions.
    
@@ -101,8 +101,8 @@ The detail view of each constraint lists information about the resource that vio
 
 When OPA Gatekeeper is enabled, Rancher installs some templates by default. Currently the following constraint templates are installed:
 
-1. **k8sallowedrepos** - Template that can be used to whitelist registries.
-1. **k8srequiredlabels** - Template that can be used to enforce desired labels on specific Kubernetes objects.
+1. `k8sallowedrepos` - Template that can be used to whitelist registries.
+1. `k8srequiredlabels` - Template that can be used to enforce desired labels on specific Kubernetes objects.
 
 This section describes how to use these templates to create constraints for enforcing certain policies on the cluster via the **Dashboard** view.
 
@@ -112,13 +112,13 @@ The constraint created can be edited using the form.
 
 ### Constraint to Whitelist Registries
 
-Suppose you want to apply a policy that restricts creation of any pods in your cluster to use images only from a whitelisted repository. In this case, you would create a constraint from the  **k8sallowedrepos** template.
+Suppose you want to apply a policy that restricts creation of any pods in your cluster to use images only from a whitelisted repository. In this case, you would create a constraint from the  `k8sallowedrepos` template.
 
 For example, suppose we want all pods launched in the namespace `test` to use images only from the quay.io registry.
 
 Steps to do that via Rancher's dashboard view are as follows:
 
-> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's **Dashboard** view.
+> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's <b>Dashboard</b> view.
 
 1. Navigate to **OPA Gatekeeper > Constraints > Create.**
 1. Use the **Edit As YAML** option on the right hand corner of the Create form. Paste the following YAML and click **Create** to add the constraint:
@@ -156,19 +156,19 @@ Steps to do that via Rancher's dashboard view are as follows:
     
     The YAML specifies the directive `repos` as defined by the `k8sallowedrepos` template schema.
 
-    This constraint specifies that the image repository "quay.io" should be used by all pod objects in the `test` namespace. Notice that all the system namespaces are by default added to the list of `excludedNamespaces`. After the above constraint is created, it will be listed under "K8sAllowedRepos" on the "Constraints" page. You can edit the constraint via the form to change the namespaces and other information.
+    This constraint specifies that the image repository "quay.io" should be used by all pod objects in the `test` namespace. Notice that all the system namespaces are by default added to the list of `excludedNamespaces`. You can edit the constraint via the form to change the namespaces and other information.
 
-**Result:** Now if you navigate **Back to Rancher** and create a workload under the `test` namespace with any image other than the "quay.io" registry, you will get an error from OPA Gatekeeper.
+**Result:** After the above constraint is created, it will be listed under `K8sAllowedRepos` on the **Constraints** page.  Now if you navigate **Back to Rancher** and create a workload under the `test` namespace with any image other than the "quay.io" registry, you will get an error from OPA Gatekeeper.
 
 ### Constraint to Enforce Labels
 
-Suppose you want to apply a policy that requires certain set of labels present on Kubernetes resources of a specific kind, then you can create a constraint from the  **k8srequiredlabels** template.
+Suppose you want to apply a policy that requires certain set of labels present on Kubernetes resources of a specific kind, then you can create a constraint from the  `k8srequiredlabels` template.
 
 For example, suppose we want all namespaces in the cluster to be labeled with the name of a team.
 
 Steps to do that via Rancher's dashboard view are as follows:
 
-> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's **Dashboard** view.
+> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's <b>Dashboard</b> view.
 
 1. Navigate to OPA Gatekeeper > Constraints > Create.
 1. Use the **Edit As YAML** option on the right hand corner of the Create form. Paste the following yaml and click **Create** to add the constraint:
@@ -204,10 +204,8 @@ Steps to do that via Rancher's dashboard view are as follows:
         cattle.io/description: constraint for ns label
     ```
     
-    The YAML specifies the directives `message` and `labels` as defined by the **k8srequiredlabels** template schema. This constraint defines that all"namespaces must have a label `team` whose value should match the given "allowedRegex". Notice that all the system namespaces are by default added to list of `excludedNamespaces`.
-
-    After the above constraint is created, it will be listed under "K8sRequiredLabels" on the "Constraints" page.
+    The YAML specifies the directives `message` and `labels` as defined by the `k8srequiredlabels` template schema. This constraint defines that all"namespaces must have a label `team` whose value should match the given "allowedRegex". Notice that all the system namespaces are by default added to list of `excludedNamespaces`.
 
     You can edit the constraint via the form to change the namespaces and other information.
 
-**Result:** Now if you navigate **Back to Rancher** and create a new namespace in the cluster without having the label `team`, the create request should be denied.
+**Result:** After the above constraint is created, it will be listed under `K8sRequiredLabels` on the **Constraints** page. Now if you navigate **Back to Rancher** and create a new namespace in the cluster without having the label `team`, the create request should be denied.

From 3d6fe8aeec43c3b44c3ed25f9f33e4810c957acb Mon Sep 17 00:00:00 2001
From: rawmind0 <rawmind@gmail.com>
Date: Thu, 16 Apr 2020 20:37:36 +0200
Subject: [PATCH 004/265] Updated installation docs: cert-manager version to
 0.14.2

---
 .../installation/k8s-install/helm-rancher/_index.md  |  4 ++--
 .../options/air-gap-helm2/install-rancher/_index.md  |  6 +++---
 .../populate-private-registry/_index.md              |  4 ++--
 .../options/helm2/helm-rancher/_index.md             |  2 +-
 .../options/upgrading-cert-manager/_index.md         | 12 ++++++------
 .../helm-2-instructions/_index.md                    |  6 +++---
 .../air-gap/install-rancher/_index.md                |  6 +++---
 .../air-gap/populate-private-registry/_index.md      |  4 ++--
 8 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
index 84b002d3f8f..21baa7961f0 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
@@ -89,7 +89,7 @@ These instructions are adapted from the [official cert-manager documentation](ht
 
 ```
 # Install the CustomResourceDefinition resources separately
-kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
 
 # **Important:**
 # If you are running Kubernetes v1.15 or below, you
@@ -114,7 +114,7 @@ helm repo update
 helm install \
   cert-manager jetstack/cert-manager \
   --namespace cert-manager \
-  --version v0.12.0
+  --version v0.14.2
 ```
 
 Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
index f5895de9604..ccce961fac3 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
@@ -87,12 +87,12 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
    ```plain
-   helm fetch jetstack/cert-manager --version v0.12.0
+   helm fetch jetstack/cert-manager --version v0.14.2
    ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
    ```plain
-   helm template ./cert-manager-v0.12.0.tgz --output-dir . \
+   helm template ./cert-manager-v0.14.2.tgz --output-dir . \
        --name cert-manager --namespace cert-manager \
        --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
        --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
@@ -101,7 +101,7 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 
 1. Download the required CRD file for cert-manager
    ```plain
-   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
    ```
 1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
 
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
index cb9f4698034..0a57f137dc8 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
@@ -56,7 +56,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS
     ```plain
     helm repo add jetstack https://charts.jetstack.io
     helm repo update
-    helm fetch jetstack/cert-manager --version v0.12.0
+    helm fetch jetstack/cert-manager --version v0.14.2
     helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
     ```
 
@@ -220,7 +220,7 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
       ```plain
       helm repo add jetstack https://charts.jetstack.io
       helm repo update
-      helm fetch jetstack/cert-manager --version v0.12.0
+      helm fetch jetstack/cert-manager --version v0.14.2
       helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
       ```
 
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
index 239ed927a3b..8b88fff925a 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
@@ -79,7 +79,7 @@ These instructions are adapted from the [official cert-manager documentation](ht
     helm install \
       --name cert-manager \
       --namespace cert-manager \
-      --version v0.12.0 \
+      --version v0.14.2 \
       jetstack/cert-manager
     ```
 
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
index 83bce83066b..b6c3963fd9c 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
@@ -62,7 +62,7 @@ In order to upgrade cert-manager, follow these instructions:
 1. Install the CustomResourceDefinition resources separately
 
     ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
     ```
 
     > **Note:**
@@ -92,7 +92,7 @@ In order to upgrade cert-manager, follow these instructions:
     helm install \
       cert-manager jetstack/cert-manager \
       --namespace cert-manager \
-      --version v0.12.0 
+      --version v0.14.2 
     ```
 
 1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources)
@@ -120,7 +120,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
     ```plain
-    helm fetch jetstack/cert-manager --version v0.12.0
+    helm fetch jetstack/cert-manager --version v0.14.2
     ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
@@ -128,7 +128,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
     The Helm 3 command is as follows:
 
     ```plain
-    helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
+    helm template cert-manager ./cert-manager-v0.14.2.tgz --output-dir . \
     --namespace cert-manager \
     --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
     --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
@@ -138,7 +138,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
     The Helm 2 command is as follows:
 
     ```plain
-    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
+    helm template ./cert-manager-v0.14.2.tgz --output-dir . \
     --name cert-manager --namespace cert-manager \
     --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
     --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
@@ -148,7 +148,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
 1. Download the required CRD file for cert-manager (old and new)
 
     ```plain
-    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
     curl -L -o cert-manager/cert-manager-crd-old.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml
     ```
 
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
index 3299f50c08d..ac18dbf95d3 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
@@ -74,7 +74,7 @@ In order to upgrade cert-manager, follow these instructions:
 1. Install the new version of cert-manager
 
     ```plain
-    helm install --version 0.12.0 --name cert-manager --namespace kube-system jetstack/cert-manager
+    helm install --version 0.14.2 --name cert-manager --namespace kube-system jetstack/cert-manager
     ```
 {{% /accordion %}}
 
@@ -95,13 +95,13 @@ Before you can perform the upgrade, you must prepare your air gapped environment
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
     ```plain
-    helm fetch jetstack/cert-manager --version v0.12.0
+    helm fetch jetstack/cert-manager --version v0.14.2
     ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
 
     ```plain
-    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
+    helm template ./cert-manager-v0.14.2.tgz --output-dir . \
     --name cert-manager --namespace kube-system \
     --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
     --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index bb1b4ae209c..eb2d3ab49ef 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -88,12 +88,12 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
    ```plain
-   helm fetch jetstack/cert-manager --version v0.12.0
+   helm fetch jetstack/cert-manager --version v0.14.2
    ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
    ```plain
-   helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
+   helm template cert-manager ./cert-manager-v0.14.2.tgz --output-dir . \
        --namespace cert-manager \
        --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller \
        --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook \
@@ -102,7 +102,7 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 
 1. Download the required CRD file for cert-manager
    ```plain
-   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
    ```
 1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
 
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
index a7b4e8be62c..1473ef1b21e 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
@@ -57,7 +57,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS
     ```plain
     helm repo add jetstack https://charts.jetstack.io
     helm repo update
-    helm fetch jetstack/cert-manager --version v0.12.0
+    helm fetch jetstack/cert-manager --version v0.14.2
     helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
     ```
 
@@ -227,7 +227,7 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
       ```plain
       helm repo add jetstack https://charts.jetstack.io
       helm repo update
-      helm fetch jetstack/cert-manager --version v0.12.0
+      helm fetch jetstack/cert-manager --version v0.14.2
       helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
       ```
 

From 9cc63b9c8420c1a9fc4001479b1290048c18d872 Mon Sep 17 00:00:00 2001
From: rawmind0 <rawmind@gmail.com>
Date: Fri, 17 Apr 2020 20:48:50 +0200
Subject: [PATCH 005/265] Updated cert-manager upgrade info

---
 .../options/upgrading-cert-manager/_index.md          | 11 +++++++++--
 .../helm-2-instructions/_index.md                     |  7 +++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
index b6c3963fd9c..b6ac9f49bed 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
@@ -8,6 +8,7 @@ Rancher uses cert-manager to automatically generate and renew TLS certificates f
 1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
 1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/). This change has no exact deadline.
 1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
+1. [Cert-manager is changing the Deployment selector](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/)
 
 To address these changes, this guide will do two things:
 
@@ -18,8 +19,8 @@ To address these changes, this guide will do two things:
 > If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them:
 
 > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server
-> 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager
-> 3. Install the newer version of Rancher and cert-manager 
+> 2. Uninstall Rancher, cert-manager and the CustomResourceDefinition for cert-manager
+> 3. Install the new CustomResourceDefinition for cert-manager, cert-manager and the newer version of Rancher 
 
 > The reason is that when Helm upgrades Rancher, it will reject the upgrade and show error messages if the running Rancher app does not match the chart template used to install it. Because cert-manager changed its API group and we cannot modify released charts for Rancher, there will always be a mismatch on the cert-manager's API version, therefore the upgrade will be rejected.
 
@@ -27,6 +28,10 @@ To address these changes, this guide will do two things:
 
 ## Upgrade Cert-Manager Only 
 
+If you are running cert-manager version 0.11.x or above, please follow official [upgrading doc](https://cert-manager.io/docs/installation/upgrading/#upgrading-with-helm) to upgrade it using helm. 
+
+Continue reading if you are comming from a cert-manager version older than 0.11
+
 > **Note:**
 > These instructions are applied if you have no plan to upgrade Rancher. 
 
@@ -233,5 +238,7 @@ We have also removed support for the old configuration format that was deprecate
 
 Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
 
+Details about the change and migration instructions can be found in the [cert-manager v0.13 to v0.14 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/).
+
 More info about [cert-manager upgrade information](https://cert-manager.io/docs/installation/upgrading/).
 
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
index ac18dbf95d3..fc999325d1b 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
@@ -8,6 +8,7 @@ Rancher uses cert-manager to automatically generate and renew TLS certificates f
 1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
 1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.7-0.8.html#upgrading-from-v0-7-to-v0-8). This change has no exact deadline.
 1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
+1. [Cert-manager is changing the Deployment selector](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/)
 
 To address these changes, this guide will do two things:
 
@@ -27,6 +28,10 @@ To address these changes, this guide will do two things:
 
 ## Upgrade Cert-Manager Only 
 
+If you are running cert-manager version 0.11.x or above, please follow official [upgrading doc](https://cert-manager.io/docs/installation/upgrading/#upgrading-with-helm) to upgrade it using helm.
+
+Continue reading if you are comming from a cert-manager version older than 0.11
+
 > **Note:**
 > These instructions are applied if you have no plan to upgrade Rancher. 
 
@@ -180,4 +185,6 @@ We have also removed support for the old configuration format that was deprecate
 
 Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
 
+Details about the change and migration instructions can be found in the [cert-manager v0.13 to v0.14 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/).
+
 For information on upgrading from all other versions of cert-manager, refer to the [official documentation](https://cert-manager.io/docs/installation/upgrading/).

From 99595b3b7527d57f21ba145d6de872023ba43805 Mon Sep 17 00:00:00 2001
From: YANO Tetsuro <tetuyano@gmail.com>
Date: Fri, 17 Jan 2020 07:40:32 +0900
Subject: [PATCH 006/265] Fix plugin config filename mismatch.

Fix because there is no match between the plugin name and the configuration file name
---
 content/k3s/latest/en/installation/network-options/_index.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/k3s/latest/en/installation/network-options/_index.md b/content/k3s/latest/en/installation/network-options/_index.md
index 97873e4151b..eaac4ea818e 100644
--- a/content/k3s/latest/en/installation/network-options/_index.md
+++ b/content/k3s/latest/en/installation/network-options/_index.md
@@ -40,7 +40,7 @@ Apply the Canal YAML.
 Ensure the settings were applied by running the following command on the host:
 
 ```
-cat /etc/cni/net.d/10-canal.conflist
+cat /etc/cni/net.d/10-calico.conflist
 ```
 
 You should see that IP forwarding is set to true.
@@ -61,7 +61,7 @@ Apply the Calico YAML.
 Ensure the settings were applied by running the following command on the host:
 
 ```
-cat /etc/cni/net.d/10-calico.conflist
+cat /etc/cni/net.d/10-canal.conflist
 ```
 
 You should see that IP forwarding is set to true.

From f3f2a66b7e8b050db52d1bb596f89afdec4752fa Mon Sep 17 00:00:00 2001
From: Sam Kleiner <sam@skleiner.com>
Date: Thu, 27 Feb 2020 19:32:57 -0500
Subject: [PATCH 007/265] update ha install docs

Updates docs to mention the --tls-san option during HA install.
---
 content/k3s/latest/en/installation/ha/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md
index 2ebc2970c9a..474a06eaf53 100644
--- a/content/k3s/latest/en/installation/ha/_index.md
+++ b/content/k3s/latest/en/installation/ha/_index.md
@@ -60,7 +60,7 @@ Agent nodes need a URL to register against. This can be the IP or hostname of an
 * Round-robin DNS
 * Virtual or elastic IP addresses
 
-This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node.
+This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node. To avoid certificate errors you should install the server with the `--tls-san YOUR_IP_OR_HOSTNAME_HERE` option. This option can be specified multiple times if you would like to access via both the ip and hostname.
 
 ### 4. Optional: Join Agent Nodes
 

From f11c3031da4d32f6428fcaccb5bd82905a0991d9 Mon Sep 17 00:00:00 2001
From: "Enrico M. Crisostomo" <enrico.m.crisostomo@gmail.com>
Date: Mon, 2 Mar 2020 13:49:35 +0100
Subject: [PATCH 008/265] Add MacPorts to the installation instructions of RKE

---
 content/rke/latest/en/installation/_index.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/content/rke/latest/en/installation/_index.md b/content/rke/latest/en/installation/_index.md
index 30d5dc73842..3f78adf4006 100644
--- a/content/rke/latest/en/installation/_index.md
+++ b/content/rke/latest/en/installation/_index.md
@@ -8,6 +8,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
 
 1. [Download the RKE Binary](#download-the-rke-binary)
     1. [Alternative RKE MacOS X Install - Homebrew](#alternative-rke-macos-x-install---homebrew)
+    1. [Alternative RKE MacOS X Install - MacPorts](#alternative-rke-macos-x-install---macports)
 1. [Prepare the Nodes for the Kubernetes Cluster](#prepare-the-nodes-for-the-kubernetes-cluster)
 1. [Creating the Cluster Configuration File](#creating-the-cluster-configuration-file)
 1. [Deploying Kubernetes with RKE](#deploying-kubernetes-with-rke)
@@ -70,6 +71,24 @@ If you have already installed RKE using `brew`, you can upgrade RKE by running:
 $ brew upgrade rke
 ```
 
+### Alternative RKE MacOS X Install - MacPorts
+
+RKE can also be installed and updated using MacPorts, a package manager for MacOS X.
+
+1. Install MacPorts. See https://www.macports.org/ for instructions.
+
+2. Using `port`, install RKE by running the following command in a Terminal window:
+
+    ```
+    $ port install rke
+    ```
+
+If you have already installed RKE using `port`, you can upgrade RKE by running:
+
+```
+$ port upgrade rke
+```
+
 ## Prepare the Nodes for the Kubernetes cluster
 
 The Kubernetes cluster components are launched using Docker on a Linux distro. You can use any Linux you want, as long as you can install Docker on it.

From 1b2ee89564bde8cda4ed54787540e2d13da448ef Mon Sep 17 00:00:00 2001
From: "Enrico M. Crisostomo" <enrico.m.crisostomo@gmail.com>
Date: Mon, 2 Mar 2020 13:52:53 +0100
Subject: [PATCH 009/265] Refactor MacOS X into macOS

---
 content/rke/latest/en/installation/_index.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/content/rke/latest/en/installation/_index.md b/content/rke/latest/en/installation/_index.md
index 3f78adf4006..865a20ae6f8 100644
--- a/content/rke/latest/en/installation/_index.md
+++ b/content/rke/latest/en/installation/_index.md
@@ -7,8 +7,8 @@ weight: 50
 RKE is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. You can get started in a couple of quick and easy steps:
 
 1. [Download the RKE Binary](#download-the-rke-binary)
-    1. [Alternative RKE MacOS X Install - Homebrew](#alternative-rke-macos-x-install---homebrew)
-    1. [Alternative RKE MacOS X Install - MacPorts](#alternative-rke-macos-x-install---macports)
+    1. [Alternative RKE macOS Install - Homebrew](#alternative-rke-macos-install---homebrew)
+    1. [Alternative RKE macOS Install - MacPorts](#alternative-rke-macos-install---macports)
 1. [Prepare the Nodes for the Kubernetes Cluster](#prepare-the-nodes-for-the-kubernetes-cluster)
 1. [Creating the Cluster Configuration File](#creating-the-cluster-configuration-file)
 1. [Deploying Kubernetes with RKE](#deploying-kubernetes-with-rke)
@@ -19,7 +19,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
 
 1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System and Architecture:
 
-    - **MacOS**: `rke_darwin-amd64`
+    - **macOS**: `rke_darwin-amd64`
     - **Linux (Intel/AMD)**: `rke_linux-amd64`
     - **Linux (ARM 32-bit)**: `rke_linux-arm`
     - **Linux (ARM 64-bit)**: `rke_linux-arm64`
@@ -29,7 +29,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
 2. Copy the RKE binary to a folder in your `$PATH` and rename it `rke` (or `rke.exe` for Windows)
 
     ```
-    # MacOS
+    # macOS
     $ mv rke_darwin-amd64 rke
     # Linux
     $ mv rke_linux-amd64 rke
@@ -53,9 +53,9 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
     ```
 
 
-### Alternative RKE MacOS X Install - Homebrew
+### Alternative RKE macOS Install - Homebrew
 
-RKE can also be installed and updated using Homebrew, a package manager for MacOS X.
+RKE can also be installed and updated using Homebrew, a package manager for macOS.
 
 1. Install Homebrew. See https://brew.sh/ for instructions.
 
@@ -71,9 +71,9 @@ If you have already installed RKE using `brew`, you can upgrade RKE by running:
 $ brew upgrade rke
 ```
 
-### Alternative RKE MacOS X Install - MacPorts
+### Alternative RKE macOS Install - MacPorts
 
-RKE can also be installed and updated using MacPorts, a package manager for MacOS X.
+RKE can also be installed and updated using MacPorts, a package manager for macOS.
 
 1. Install MacPorts. See https://www.macports.org/ for instructions.
 

From 2b5994b1750e7f1db2f13de9c32c97109c920e45 Mon Sep 17 00:00:00 2001
From: Patrik Cyvoct <patrik@ptrk.io>
Date: Sun, 29 Mar 2020 11:53:41 +0200
Subject: [PATCH 010/265] Docs for scaleway IPs in dynamic IP options

Signed-off-by: Patrik Cyvoct <patrik@ptrk.io>
---
 .../rke-clusters/custom-nodes/agent-options/_index.md           | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
index 241369bc24d..e81659c0a41 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
@@ -55,3 +55,5 @@ For automation purposes, you can't have a specific IP address in a command as it
 | `gceexternal` | `--address gceexternal` | Value retrieved from `http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip` will be used |
 | `packetlocal` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/local-ipv4` will be used |
 | `packetpublic` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/public-ipv4` will be used |
+| `scwprivate` | `--address scwprivate` | Value retrieved from `http://169.254.42.42/conf` with key `PRIVATE_IP` will be used |
+| `scwpublic` | `--address scwpublic` | Value retrieved from `http://169.254.42.42/conf` with key `PUBLIC_IP_ADDRESS` will be used |

From 9f35db53a8a33c0f633d0861622fd9b07d532e53 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 1 Apr 2020 22:49:28 -0700
Subject: [PATCH 011/265] Edit docs about cert-manager

---
 .../installation/options/upgrading-cert-manager/_index.md | 2 +-
 content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
index b6ac9f49bed..e0afe6897d1 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
@@ -30,7 +30,7 @@ To address these changes, this guide will do two things:
 
 If you are running cert-manager version 0.11.x or above, please follow official [upgrading doc](https://cert-manager.io/docs/installation/upgrading/#upgrading-with-helm) to upgrade it using helm. 
 
-Continue reading if you are comming from a cert-manager version older than 0.11
+Continue reading if you are coming from a cert-manager version older than 0.11
 
 > **Note:**
 > These instructions are applied if you have no plan to upgrade Rancher. 
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
index 7e74a35c0ed..6b57e500f0a 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
@@ -87,7 +87,7 @@ hostname: rancher.my.org
 
 > **Note:** There will be more values that are listed with this command. This is just an example of one of the values.
 
-If you are also upgrading cert-manager to the latest version from a version older than 0.11.0, follow `Option B: Reinstalling Rancher`. Otherwise, follow `Option A: Upgrading Rancher`.
+If you are also upgrading cert-manager to the latest version from a version older than 0.11.0, follow `Option B: Reinstalling Rancher and cert-manager`. Otherwise, follow `Option A: Upgrading Rancher`.
 
 {{% accordion label="Option A: Upgrading Rancher" %}}
 
@@ -105,12 +105,10 @@ helm upgrade rancher rancher-<CHART_REPO>/rancher \
 
 {{% /accordion %}}
 
-{{% accordion label="Option B: Reinstalling Rancher chart" %}}
+{{% accordion label="Option B: Reinstalling Rancher and cert-manager" %}}
 
 If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. 
 
-Please refer the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) page for more information.
-
 1. Uninstall Rancher
 
     ```
@@ -125,6 +123,8 @@ Please refer the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installa
     --set hostname=rancher.my.org
     ```
 
+3. Uninstall and reinstall `cert-manager` according to the instructions on the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) page.
+
 {{% /accordion %}}
 
 {{% /tab %}}

From 3da22fc0190dc3bb84e0c7e4ee828e281a2e749a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 2 Apr 2020 14:56:24 -0700
Subject: [PATCH 012/265] Update _index.md

---
 content/k3s/latest/en/installation/ha/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/installation/ha/_index.md b/content/k3s/latest/en/installation/ha/_index.md
index 474a06eaf53..7791527f709 100644
--- a/content/k3s/latest/en/installation/ha/_index.md
+++ b/content/k3s/latest/en/installation/ha/_index.md
@@ -60,7 +60,7 @@ Agent nodes need a URL to register against. This can be the IP or hostname of an
 * Round-robin DNS
 * Virtual or elastic IP addresses
 
-This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node. To avoid certificate errors you should install the server with the `--tls-san YOUR_IP_OR_HOSTNAME_HERE` option. This option can be specified multiple times if you would like to access via both the ip and hostname.
+This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) file to point to it instead of a specific node. To avoid certificate errors in such a configuration, you should install the server with the `--tls-san YOUR_IP_OR_HOSTNAME_HERE` option. This option adds an additional hostname or IP as a Subject Alternative Name in the TLS cert, and it can be specified multiple times if you would like to access via both the IP and the hostname.
 
 ### 4. Optional: Join Agent Nodes
 

From b572e5fd5d488974256de84bafbb09dd9f90c51b Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 2 Apr 2020 16:38:04 -0700
Subject: [PATCH 013/265] Add section on annotating imported clusters

---
 .../imported-clusters/_index.md               | 70 ++++++++++++++++---
 1 file changed, 61 insertions(+), 9 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
index a765eaa6c49..da3a97264c8 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
@@ -19,11 +19,13 @@ Rancher v2.4 added the capability to import a K3s cluster into Rancher, as well
 - [Features](#features)
 - [Prerequisites](#prerequisites)
 - [Importing a cluster](#importing-a-cluster)
-- [Additional features for imported K3s clusters](#additional-features-for-imported-k3s-clusters)
-- [Configuring a K3s Cluster to Enable Importation to Rancher](#configuring-a-k3s-cluster-to-enable-importation-to-rancher)
-- [Debug Logging and Troubleshooting for Imported K3s clusters](#debug-logging-and-troubleshooting-for-imported-k3s-clusters)
+- [Imported K3s clusters](#imported-k3s-clusters)
+  - [Additional features for imported K3s clusters](#additional-features-for-imported-k3s-clusters)
+  - [Configuring a K3s Cluster to Enable Importation to Rancher](#configuring-a-k3s-cluster-to-enable-importation-to-rancher)
+  - [Debug Logging and Troubleshooting for Imported K3s clusters](#debug-logging-and-troubleshooting-for-imported-k3s-clusters)
+- [Annotating imported clusters](#annotating-imported-clusters)
 
-### Features
+# Features
 
 After importing a cluster, the cluster owner can:
 
@@ -36,7 +38,7 @@ After importing a cluster, the cluster owner can:
 
 After importing a K3s cluster, the cluster owner can also [upgrade Kubernetes from the Rancher UI.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes/)
 
-### Prerequisites
+# Prerequisites
 
 If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to import the cluster into Rancher.
 
@@ -54,7 +56,7 @@ By default, GKE users are not given this privilege, so you will need to run the
 
 > If you are importing a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-importation-to-rancher)
 
-### Importing a Cluster
+# Importing a Cluster
 
 1. From the **Clusters** page, click **Add Cluster**.
 2. Choose **Import**.
@@ -70,12 +72,14 @@ By default, GKE users are not given this privilege, so you will need to run the
 > **Note:**
 > You can not re-import a cluster that is currently active in a Rancher setup.
 
+# Imported K3s Clusters
+
+You can now import a K3s Kubernetes cluster into Rancher. [K3s]({{<baseurl>}}/k3s/latest/en/) is lightweight, fully compliant Kubernetes distribution. You can also upgrade Kubernetes by editing the K3s cluster in the Rancher UI.
+
 ### Additional Features for Imported K3s Clusters
 
 _Available as of v2.4.0_
 
-You can now import a K3s Kubernetes cluster into Rancher. [K3s]({{<baseurl>}}/k3s/latest/en/) is lightweight, fully compliant Kubernetes distribution. You can also upgrade Kubernetes by editing the K3s cluster in the Rancher UI.
-
 When a K3s cluster is imported, Rancher will recognize it as K3s, and the Rancher UI will expose the following features in addition to the functionality for other imported clusters:
 
 - The ability to upgrade the K3s version
@@ -131,4 +135,52 @@ kubectl get plans -A -o yaml
 
 If the cluster becomes stuck in upgrading, restart the `system-upgrade-controller`.
 
-To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed.
\ No newline at end of file
+To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed.
+
+### Annotating Imported Clusters
+
+For all types of imported Kubernetes clusters except for K3s Kubernetes clusters, Rancher doesn't have any information about how the cluster is provisioned or configured.
+
+Therefore, when Rancher imports a cluster, it assumes that several capabilities are disabled by default. Rancher assumes this in order to avoid exposing UI options to the user even when the capabilities are not enabled in the imported cluster.
+
+However, if the cluster has a certain capability, such as the ability to use a pod security policy, a user of that cluster might still want to select pod security policies for the cluster in the Rancher UI. In order to do that, the user will need to manually indicate to Rancher that pod security policies are enabled for the cluster.
+
+By annotating an imported cluster, it is possible to indicate to Rancher that a cluster was given a pod security policy, or another capability, outside of Rancher.
+
+This example annotation indicates that a pod security policy is enabled:
+
+```json
+"capabilities.cattle.io/pspEnabled": "true"
+```
+
+This annotation indicates Ingress capabilities:
+
+```json
+capabilities.cattle.io/ingressCapabilities": "[
+  {
+    "customDefaultBackend":true,
+    "ingressProvider":"asdf"
+  }
+]"
+```
+
+The following capabilities can be annotated for the cluster:
+
+- `ingressCapabilities`
+- `loadBalancerCapabilities`
+- `nodePoolScalingSupported`
+- `nodePortRange`
+- `pspEnabled`
+- `taintSupport`
+
+All the capabilities and their type defintions can be viewed in the Rancher API view, at `[Rancher Server URL]/v3/schemas/capabilities`.
+
+To annotate an imported cluster,
+
+1. Go to the cluster view in Rancher and select **&#8942; > Edit.**
+1. Expand the **Labels & Annotations** section.
+1. Click **Add Annotation.**
+1. Add an annotation to the cluster with the format `capabilities/<capability>: <value>` where `value` is the cluster capability that will be overridden by the annotation. In this scenario, Rancher is not aware of any capabilities of the cluster until you add the annotation.
+1. Click **Save.**
+
+**Result:** The annotation does not give the capabilities to the cluster, but it does indicate to Rancher that the cluster has those capabilities.
\ No newline at end of file

From 89ea6bd6bb446d3267b02c82da3636fac60e96f4 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 2 Apr 2020 17:01:20 -0700
Subject: [PATCH 014/265] Edit section on annotating imported clusters

---
 .../imported-clusters/_index.md                     | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
index da3a97264c8..8f59cbb3348 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
@@ -153,18 +153,13 @@ This example annotation indicates that a pod security policy is enabled:
 "capabilities.cattle.io/pspEnabled": "true"
 ```
 
-This annotation indicates Ingress capabilities:
+The following annotation indicates Ingress capabilities. Note that that the values of non-primitive objects need to be JSON encoded, with quotations escaped.
 
 ```json
-capabilities.cattle.io/ingressCapabilities": "[
-  {
-    "customDefaultBackend":true,
-    "ingressProvider":"asdf"
-  }
-]"
+"capabilities.cattle.io/ingressCapabilities": "[{"customDefaultBackend":true,"ingressProvider":"asdf"}]"
 ```
 
-The following capabilities can be annotated for the cluster:
+These capabilities can be annotated for the cluster:
 
 - `ingressCapabilities`
 - `loadBalancerCapabilities`
@@ -173,7 +168,7 @@ The following capabilities can be annotated for the cluster:
 - `pspEnabled`
 - `taintSupport`
 
-All the capabilities and their type defintions can be viewed in the Rancher API view, at `[Rancher Server URL]/v3/schemas/capabilities`.
+All the capabilities and their type definitions can be viewed in the Rancher API view, at `[Rancher Server URL]/v3/schemas/capabilities`.
 
 To annotate an imported cluster,
 

From e609999baa1084dcfd2f40363ed100db71e5120a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 3 Apr 2020 11:53:31 -0700
Subject: [PATCH 015/265] Add alias for OPA Gatekeeper page

---
 .../rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
index 8955be1bf2e..6199ccd4bc7 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
@@ -1,6 +1,8 @@
 ---
 title: OPA Gatekeeper
 weight: 1
+aliases:
+ - /rancher/v2.x/en/cluster-admin/tools/opa-gatekeeper
 ---
 _Available as of v2.4.0_
 

From 81023afee0fafae2da4ef8ae40e54eb038e36c5a Mon Sep 17 00:00:00 2001
From: David Nuzik <david.nuzik@rancher.com>
Date: Mon, 6 Apr 2020 11:28:34 -0700
Subject: [PATCH 016/265] Add k3s-agent to Restarting K3s section - Mentions
 commands for both systemd and OpenRC for restarting the k3s-agent service -
 Closes https://github.com/rancher/k3s/issues/1557

---
 .../k3s/latest/en/upgrades/basic/_index.md    | 21 ++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/content/k3s/latest/en/upgrades/basic/_index.md b/content/k3s/latest/en/upgrades/basic/_index.md
index 6311b045764..d0f1b8654c8 100644
--- a/content/k3s/latest/en/upgrades/basic/_index.md
+++ b/content/k3s/latest/en/upgrades/basic/_index.md
@@ -32,13 +32,28 @@ Or to manually upgrade K3s:
 
 ### Restarting K3s
 
-Restarting K3s is supported by the installation script for systemd and openrc.
-To restart manually for systemd use:
+Restarting K3s is supported by the installation script for systemd and OpenRC.
+
+**systemd**
+
+To restart servers manually:
 ```sh
 sudo systemctl restart k3s
 ```
 
-To restart manually for openrc use:
+To restart agents manually:
+```sh
+sudo systemctl restart k3s-agent
+```
+
+**OpenRC**
+
+To restart servers manually:
 ```sh
 sudo service k3s restart
 ```
+
+To restart agents mantually:
+```sh
+sudo service k3s-agent restart
+```

From 4e706f4f7f98f08302a6814bac4c87c52a573711 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 6 Apr 2020 12:14:13 -0700
Subject: [PATCH 017/265] Revert "Revert "WIP: Misc changes and improvements to
 K3s docs""

This reverts commit f698b97d3e4284e494efff4a767f22a88efcea20.
---
 .../en/installation/install-options/_index.md    |  9 +++++----
 .../installation-requirements/_index.md          | 16 ++++++++++++++--
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/content/k3s/latest/en/installation/install-options/_index.md b/content/k3s/latest/en/installation/install-options/_index.md
index 68a275e2bd0..df7ae330dca 100644
--- a/content/k3s/latest/en/installation/install-options/_index.md
+++ b/content/k3s/latest/en/installation/install-options/_index.md
@@ -28,23 +28,24 @@ When using this method to install K3s, the following environment variables can b
 | Environment Variable | Description |
 |-----------------------------|---------------------------------------------|
 | `INSTALL_K3S_SKIP_DOWNLOAD` | If set to true will not download K3s hash or binary. |
-| `INSTALL_K3S_SYMLINK` | If set to 'skip' will not create symlinks, 'force' will overwrite, default will symlink if command does not exist in path. |
+| `INSTALL_K3S_SYMLINK` | By default will create symlinks for the kubectl, crictl, and ctr binaries if the commands do not already exist in path. If set to 'skip' will not create symlinks and 'force' will overwrite. |
 | `INSTALL_K3S_SKIP_START` | If set to true will not start K3s service. |
-| `INSTALL_K3S_VERSION` | Version of K3s to download from github. Will attempt to download the latest version if not specified. |
+| `INSTALL_K3S_VERSION` | Version of K3s to download from Github. Will attempt to download the latest version if not specified. |
 | `INSTALL_K3S_BIN_DIR` | Directory to install K3s binary, links, and uninstall script to, or use `/usr/local/bin` as the default. |
 | `INSTALL_K3S_BIN_DIR_READ_ONLY` | If set to true will not write files to `INSTALL_K3S_BIN_DIR`, forces setting `INSTALL_K3S_SKIP_DOWNLOAD=true`. |
 | `INSTALL_K3S_SYSTEMD_DIR` | Directory to install systemd service and environment files to, or use `/etc/systemd/system` as the default. |
 | `INSTALL_K3S_EXEC` | Command with flags to use for launching K3s in the service. If the command is not specified, and the `K3S_URL` is set, it will default to "agent." If `K3S_URL` not set, it will default to "server." For help, refer to [this example.]({{<baseurl>}}/k3s/latest/en/installation/install-options/how-to-flags/#example-b-install-k3s-exec) |
-| `INSTALL_K3S_NAME` | Name of systemd service to create, will default from the K3s exec command if not specified. If specified the name will be prefixed with 'k3s-'. |
+| `INSTALL_K3S_NAME` | Name of systemd service to create, will default to 'k3s' if running k3s as a server and 'k3s-agent' if running k3s as an agent. If specified the name will be prefixed with 'k3s-'. |
 | `INSTALL_K3S_TYPE` | Type of systemd service to create, will default from the K3s exec command if not specified.
 
+
 Environment variables which begin with `K3S_` will be preserved for the systemd and openrc services to use.
 
 Setting `K3S_URL` without explicitly setting an exec command will default the command to "agent".
 
 When running the agent `K3S_TOKEN` must also be set.
 
-### Options for Installation from Binary
+# Installing K3s from the Binary
 
 As stated, the installation script is primarily concerned with configuring K3s to run as a service. If you choose to not use the script, you can run K3s simply by downloading the binary from our [release page](https://github.com/rancher/k3s/releases/latest), placing it on your path, and executing it. The K3s binary supports the following commands:
 
diff --git a/content/k3s/latest/en/installation/installation-requirements/_index.md b/content/k3s/latest/en/installation/installation-requirements/_index.md
index 13da6c3d7ce..ee053e09e0c 100644
--- a/content/k3s/latest/en/installation/installation-requirements/_index.md
+++ b/content/k3s/latest/en/installation/installation-requirements/_index.md
@@ -37,12 +37,24 @@ K3s performance depends on the performance of the database. To ensure optimal sp
 
 ## Networking
 
-The K3s server needs port 6443 to be accessible by the nodes. The nodes need to be able to reach other nodes over UDP port 8472 (Flannel VXLAN). If you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel.
+The K3s server needs port 6443 to be accessible by the nodes.
 
-IMPORTANT: The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disabled access to port 8472.
+The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
 
 If you wish to utilize the metrics server, you will need to open port 10250 on each node.
 
+> **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
+
+<figcaption>Inbound Rules for K3s Server Nodes</figcaption>
+
+| Protocol | Port | Source | Description
+|-----|-----|----------------|---|
+| TCP | 6443 | K3s server nodes | Kubernetes API
+| UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN
+| TCP | 10250 | K3s server and agent nodes | kubelet
+
+Typically all outbound traffic is allowed.
+
 ## Large Clusters
 
 Hardware requirements are based on the size of your K3s cluster. For production and large clusters, we recommend using a high-availability setup with an external database. The following options are recommended for the external database in production:

From f8b4547deeee94e5e38b45dcc2639514145a8397 Mon Sep 17 00:00:00 2001
From: Sherzod Mutalov <shmutalov@gmail.com>
Date: Tue, 7 Apr 2020 14:53:43 +0500
Subject: [PATCH 018/265] Fix the HW Requirements link

Fixed link to the RancherOS hardware requirements in the Digital Ocean section
---
 content/os/v1.x/en/installation/cloud/do/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/os/v1.x/en/installation/cloud/do/_index.md b/content/os/v1.x/en/installation/cloud/do/_index.md
index 63761bf2c99..1d043601180 100644
--- a/content/os/v1.x/en/installation/cloud/do/_index.md
+++ b/content/os/v1.x/en/installation/cloud/do/_index.md
@@ -17,7 +17,7 @@ To start a RancherOS Droplet on Digital Ocean:
 1. Click **Create Droplet.**
 1. Click the **Container distributions** tab.
 1. Click **RancherOS.**
-1. Choose a plan. Make sure your Droplet has the [minimum hardware requirements for RancherOS]({{<baseurl>}}os/v1.x/en/overview/#hardware-requirements).
+1. Choose a plan. Make sure your Droplet has the [minimum hardware requirements for RancherOS]({{<baseurl>}}/os/v1.x/en/overview/#hardware-requirements).
 1. Choose any options for backups, block storage, and datacenter region.
 1. Optional: In the **Select additional options** section, you can check the **User data** box and enter a `cloud-config` file in the text box that appears. The `cloud-config` file is used to provide a script to be run on the first boot. An example is below.
 1. Choose an SSH key that you have access to, or generate a new SSH key.

From bb22b2fb1edae1884fb542a9fb322a2ce6cc3ed9 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Apr 2020 13:42:47 -0700
Subject: [PATCH 019/265] Fix formatting in air gap docs

---
 .../populate-private-registry/_index.md       | 40 +++++++----------
 .../populate-private-registry/_index.md       | 45 +++++++------------
 2 files changed, 32 insertions(+), 53 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
index 0a57f137dc8..db02fad070f 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
@@ -126,11 +126,11 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 
 2. From the release's "Assets" section, download the following files:
 
-   | Release File                 | Description                                                                                                                                          |
-   | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-   | `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.                                                                    |
-   | `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
-   | `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.                                 |
+| Release File         | Description      |
+|------------------------|-------------------|
+| `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.         |
+| `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
+| `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.  |
 
 ### B. Save the images to your Windows Server workstation
 
@@ -146,9 +146,9 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 
 ### C. Prepare the Docker daemon
 
-1. Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
+Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
 
-   ```json
+   ```
    {
      ...
      "allow-nondistributable-artifacts": [
@@ -164,13 +164,11 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 Move the images in the `rancher-windows-images.tar.gz` to your private registry using the scripts to load the images. The `rancher-windows-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.ps1` script.
 
 1. Using `powershell`, log into your private registry if required:
-
    ```plain
    docker login <REGISTRY.YOURDOMAIN.COM:PORT>
    ```
 
 1. Using `powershell`, use `rancher-load-images.ps1` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-
    ```plain
    ./rancher-load-images.ps1 --registry <REGISTRY.YOURDOMAIN.COM:PORT>
    ```
@@ -202,21 +200,19 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 
 2. From the release's **Assets** section, download the following files, which are required to install Rancher in an air gap environment:
 
-   | Release File                 | Description                                                                                                                          |
-   | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-   | `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.                            |
-   | `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
-   | `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-   | `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
+| Release File                 | Description |
+|----------------------------|------|
+| `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.                            |
+| `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
+| `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
+| `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
 
 ### B. Collect all the required images
 
-1. **For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
+**For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
 
    1. Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-
       > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
       ```plain
       helm repo add jetstack https://charts.jetstack.io
       helm repo update
@@ -225,7 +221,6 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
       ```
 
    2. Sort and unique the images list to remove any overlap between the sources:
-
       ```plain
       sort -u rancher-images.txt -o rancher-images.txt
       ```
@@ -233,37 +228,32 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 ### C. Save the images to your workstation
 
 1. Make `rancher-save-images.sh` an executable:
-
    ```
    chmod +x rancher-save-images.sh
    ```
 
 1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-
    ```plain
    ./rancher-save-images.sh --image-list ./rancher-images.txt
    ```
 
-   **Step Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
+   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
 
 ### D. Populate the private registry
 
 Move the images in the `rancher-images.tar.gz` to your private registry using the `rancher-load-images.sh script` to load the images. The `rancher-images.txt` / `rancher-windows-images.txt` image list is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script.
 
 1. Log into your private registry if required:
-
    ```plain
    docker login <REGISTRY.YOURDOMAIN.COM:PORT>
    ```
 
 1. Make `rancher-load-images.sh` an executable:
-
    ```
    chmod +x rancher-load-images.sh
    ```
 
 1. Use `rancher-load-images.sh` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-
    ```plain
    ./rancher-load-images.sh --image-list ./rancher-images.txt \
      --windows-image-list ./rancher-windows-images.txt \
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
index 1473ef1b21e..97c11e0281f 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
@@ -131,29 +131,28 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 
 2. From the release's "Assets" section, download the following files:
 
-   | Release File                 | Description                                                                                                                                          |
-   | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-   | `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.                                                                    |
-   | `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
-   | `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.                                 |
+| Release File                 | Description      |
+|----------------------------|------------------|
+| `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.                                                                    |
+| `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
+| `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.                                 |
 
 ### B. Save the images to your Windows Server workstation
 
 1. Using `powershell`, go to the directory that has the files that were downloaded in the previous step.
 
 1. Run `rancher-save-images.ps1` to create a tarball of all the required images:
-
    ```plain
    ./rancher-save-images.ps1
    ```
 
-   **Step Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-windows-images.tar.gz`. Check that the output is in the directory.
+   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-windows-images.tar.gz`. Check that the output is in the directory.
 
 ### C. Prepare the Docker daemon
 
-1. Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
+Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
 
-   ```json
+   ```
    {
      ...
      "allow-nondistributable-artifacts": [
@@ -171,13 +170,11 @@ Move the images in the `rancher-windows-images.tar.gz` to your private registry
 The `rancher-windows-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.ps1` script. The `rancher-windows-images.tar.gz` should also be in the same directory.
 
 1. Using `powershell`, log into your private registry if required:
-
    ```plain
    docker login <REGISTRY.YOURDOMAIN.COM:PORT>
    ```
 
 1. Using `powershell`, use `rancher-load-images.ps1` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-
    ```plain
    ./rancher-load-images.ps1 --registry <REGISTRY.YOURDOMAIN.COM:PORT>
    ```
@@ -205,25 +202,23 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 
 ### A. Find the required assets for your Rancher version
 
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments. Click **Assets*.*
+1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments. Click **Assets.**
 
 2. From the release's **Assets** section, download the following files:
 
-   | Release File                 | Description                                                                                                                          |
-   | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-   | `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.                            |
-   | `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
-   | `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-   | `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
+| Release File                 | Description    |
+|----------------------------| -------------------------- |
+| `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.           |
+| `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
+| `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
+| `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
 
 ### B. Collect all the required images
 
-1. **For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
+**For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
 
    1. Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-
       > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
       ```plain
       helm repo add jetstack https://charts.jetstack.io
       helm repo update
@@ -232,7 +227,6 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
       ```
 
    2. Sort and unique the images list to remove any overlap between the sources:
-
       ```plain
       sort -u rancher-images.txt -o rancher-images.txt
       ```
@@ -240,18 +234,16 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
 ### C. Save the images to your workstation
 
 1. Make `rancher-save-images.sh` an executable:
-
    ```
    chmod +x rancher-save-images.sh
    ```
 
 1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-
    ```plain
    ./rancher-save-images.sh --image-list ./rancher-images.txt
    ```
 
-   **Step Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
+   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
 
 ### D. Populate the private registry
 
@@ -260,19 +252,16 @@ Move the images in the `rancher-images.tar.gz` to your private registry using th
 The image list, `rancher-images.txt` or `rancher-windows-images.txt`, is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script. The `rancher-images.tar.gz` should also be in the same directory.
 
 1. Log into your private registry if required:
-
    ```plain
    docker login <REGISTRY.YOURDOMAIN.COM:PORT>
    ```
 
 1. Make `rancher-load-images.sh` an executable:
-
    ```
    chmod +x rancher-load-images.sh
    ```
 
 1. Use `rancher-load-images.sh` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-
    ```plain
    ./rancher-load-images.sh --image-list ./rancher-images.txt \
      --windows-image-list ./rancher-windows-images.txt \

From d5a7f920a71614e6c6d3d3a806349fdb18b8ba49 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Apr 2020 14:13:49 -0700
Subject: [PATCH 020/265] Say that registry must support manifests if ARM64 or
 Windows hosts are used

---
 .../options/air-gap-helm2/populate-private-registry/_index.md | 4 ++++
 .../air-gap/populate-private-registry/_index.md               | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
index db02fad070f..d5f39548c7c 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
@@ -33,6 +33,8 @@ D. Populate the private registry
 
 These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
 
+If you will use ARM64 hosts, the registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
+
 ### A. Find the required assets for your Rancher version
 
 1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments. Click **Assets*.*
@@ -120,6 +122,8 @@ These steps expect you to use a Windows Server 1809 workstation that has interne
 
 The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
 
+Your registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
+
 ### A. Find the required assets for your Rancher version
 
 1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
index 97c11e0281f..346e7bd8304 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
@@ -32,6 +32,8 @@ For Rancher servers that will only provision Linux clusters, these are the steps
 
 These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
 
+If you will use ARM64 hosts, the registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
+
 ### 1. Find the required assets for your Rancher version
 
 1. Go to our [releases page,](https://github.com/rancher/rancher/releases) find the Rancher v2.x.x release that you want to install, and click **Assets.** Note: Don't use releases marked `rc` or `Pre-release`, as they are not stable for production environments.
@@ -125,6 +127,8 @@ These steps expect you to use a Windows Server 1809 workstation that has interne
 
 The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
 
+Your registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
+
 ### A. Find the required assets for your Rancher version
 
 1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.

From 20495e91b11e2042475516b52a209c830e1c69ca Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Apr 2020 21:50:09 -0700
Subject: [PATCH 021/265] Say that we recommend MySQL as the K3s datastore for
 management server cluster

---
 .../installation/k8s-install/create-nodes-lb/_index.md | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
index 863ab0522eb..0dfb09491d2 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
@@ -18,7 +18,7 @@ For more information about each installation option, refer to [this page.]({{<ba
 To install the Rancher management server on a high-availability K3s cluster, we recommend setting up the following infrastructure:
 
 - **Two Linux nodes,** typically virtual machines, in the infrastructure provider of your choice.
-- **An external database** to store the cluster data. PostgreSQL, MySQL, and etcd are supported.
+- **An external database** to store the cluster data. We recommend MySQL.
 - **A load balancer** to direct traffic to the two nodes.
 - **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it.
 
@@ -32,15 +32,11 @@ For an example of one way to set up Linux nodes, refer to this [tutorial]({{<bas
 
 The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available options allow you to select a datastore that best fits your use case.
 
-For a high-availability K3s installation, you will need to set up one of the following external databases:
-
-* [PostgreSQL](https://www.postgresql.org/) (certified against versions 10.7 and 11.5)
-* [MySQL](https://www.mysql.com/) (certified against version 5.7)
-* [etcd](https://etcd.io/) (certified against version 3.3.15)
+For a high-availability K3s installation, you will need to set a [MySQL](https://www.mysql.com/) external database. Rancher has been tested on K3s Kubernetes clusters using MySQL version 5.7 as the datastore.
 
 When you install Kubernetes using the K3s installation script, you will pass in details for K3s to connect to the database.
 
-For an example of one way to set up the database, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/rds/) for setting up a MySQL database on Amazon's RDS service.
+For an example of one way to set up the MySQL database, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/rds/) for setting up MySQL on Amazon's RDS service.
 
 For the complete list of options that are available for configuring a K3s cluster datastore, refer to the [K3s documentation.]({{<baseurl>}}/k3s/latest/en/installation/datastore/)
 

From 5e87b6471f8532c4ee3ba320e228e2a519c49e40 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Apr 2020 21:28:14 -0700
Subject: [PATCH 022/265] Include doc on enabling GCE cloud provider for custom
 clusters

---
 .../cloud-providers/gce/_index.md             | 55 +++++++++++++++++++
 .../rke-clusters/windows-clusters/_index.md   |  2 +-
 2 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
new file mode 100644
index 00000000000..d5f13a993f8
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
@@ -0,0 +1,55 @@
+---
+title: Setting up the Google Compute Engine Cloud Provider
+weight: 3
+---
+
+In this section, you'll learn how to enable the Google Compute Engine (GCE) cloud provider for provisioning custom clusters in Rancher. A custom cluster is one in which Rancher installs Kubernetes on existing nodes.
+
+These steps are required for provisioning GCE Kubernetes clusters that include Windows nodes.
+
+The official Kubernetes documentation for the GCE cloud provider is [here.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#gce)
+
+> **Prerequisites:** The service account of `Identity and API` access on GCE needs the `Computer Admin` permission. 
+
+If you are using Calico,
+
+1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
+1. Click **Edit as YAML,** and enter the following configuration:
+    ```yaml
+    rancher_kubernetes_engine_config:
+    cloud_provider:
+        name: gce
+        customCloudProvider: |-
+        [Global]
+        project-id=<your projcet ID, optional>
+        network-name=<your network, optional if using default network>
+        subnetwork-name=<your subnetwork of the above network, optional if using default network>
+        node-instance-prefix=<your instance group name/your instance name specific prefix, required>
+        node-tags=<your network tags, must patch one or some tags, required>
+    network: 
+        options: 
+        calico_cloud_provider: "gce"
+        plugin: "calico"
+    ```
+
+If you are using Canal or Flannel,
+
+1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
+1. Click **Edit as YAML,** and enter the following configuration:
+    ```yaml
+    rancher_kubernetes_engine_config:
+    cloud_provider:
+        name: gce
+        customCloudProvider: |-
+        [Global]
+        project-id=<your project ID, optional>
+        network-name=<your network, optional if using default network>
+        subnetwork-name=<your subnetwork of the above network, optional if using default network>
+        node-instance-prefix=<your instance group name/your instance name specific prefix, required>
+        node-tags=<your network tags, must patch one or some tags, required>
+    services:
+        kube_controller:
+        extra_args:
+            configure-cloud-routes: true # we need to allow
+            # the cloud provider to configure the routes for the hosts
+    ```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md
index 837b8628ceb..17aeed8c00b 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md
@@ -94,7 +94,7 @@ If you set a Kubernetes cloud provider in your cluster, some additional steps ar
 
 If you are using the GCE (Google Compute Engine) cloud provider, you must do the following:
 
-- Specify `gce` as the cloud provider in the `cluster.yml`
+- Enable the GCE cloud provider in the `cluster.yml` by following [these steps.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce)
 - When provisioning the cluster in Rancher, choose **Custom cloud provider** as the cloud provider in the Rancher UI.
 
 # Tutorial: How to Create a Cluster with Windows Support

From 877e97f3be3a01fc05c5115e38d5041cd78376b3 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 9 Apr 2020 12:11:43 -0700
Subject: [PATCH 023/265] Fix formatting on Prometheus expressions page

---
 .../en/cluster-admin/tools/alerts/_index.md   |   7 +
 .../tools/monitoring/expression/_index.md     | 561 ++++++++++--------
 2 files changed, 315 insertions(+), 253 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/alerts/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/alerts/_index.md
index 7fdca61df02..1b0b9685295 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/alerts/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/alerts/_index.md
@@ -16,6 +16,7 @@ For details about what triggers the predefined alerts, refer to the [documentati
 This section covers the following topics:
 
 - [Alert event examples](#alert-event-examples)
+  - [Prometheus queries](#prometheus-queries)
 - [Urgency levels](#urgency-levels)
 - [Scope of alerts](#scope-of-alerts)
 - [Adding cluster alerts](#adding-cluster-alerts)
@@ -30,6 +31,12 @@ Some examples of alert events are:
 - A scheduled deployment taking place as planned.
 - A node's hardware resources becoming overstressed.
 
+### Prometheus Queries
+
+> **Prerequisite:** Monitoring must be [enabled]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) before you can trigger alerts with custom Prometheus queries or expressions.
+
+When you edit an alert rule, you will have the opportunity to configure the alert to be triggered based on a Prometheus expression. For examples of expressions, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression)
+
 # Urgency Levels
 
 You can set an urgency level for each alert. This urgency appears in the notification you receive, helping you to prioritize your response actions. For example, if you have an alert configured to inform you of a routine deployment, no action is required. These alerts can be assigned a low priority level. However, if a deployment fails, it can critically impact your organization, and you need to react quickly. Assign these alerts a high priority level.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/_index.md
index a667264c69c..9f5170c9779 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/_index.md
@@ -1,375 +1,430 @@
 ---
-title: Expression
+title: Prometheus Expressions
 weight: 4
 ---
 
-## In This Document
+The PromQL expressions in this doc can be used to configure [alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
+
+> Before expression can be used in alerts, monitoring must be enabled. For more information, refer to the documentation on enabling monitoring [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring)
+
+For more information about querying Prometheus, refer to the official [Prometheus documentation.](https://prometheus.io/docs/prometheus/latest/querying/basics/)
 
 <!-- TOC -->
 
 - [Cluster Metrics](#cluster-metrics)
-    + [Node Metrics](#node-metrics)
+  - [Cluster CPU Utilization](#cluster-cpu-utilization)
+  - [Cluster Load Average](#cluster-load-average)
+  - [Cluster Memory Utilization](#cluster-memory-utilization)
+  - [Cluster Disk Utilization](#cluster-disk-utilization)
+  - [Cluster Disk I/O](#cluster-disk-i-o)
+  - [Cluster Network Packets](#cluster-network-packets)
+  - [Cluster Network I/O](#cluster-network-i-o)
+- [Node Metrics](#node-metrics)
+  - [Node CPU Utilization](#node-cpu-utilization)
+  - [Node Load Average](#node-load-average)
+  - [Node Memory Utilization](#node-memory-utilization)
+  - [Node Disk Utilization](#node-disk-utilization)
+  - [Node Disk I/O](#node-disk-i-o)
+  - [Node Network Packets](#node-network-packets)
+  - [Node Network I/O](#node-network-i-o)
 - [Etcd Metrics](#etcd-metrics)
+  - [Etcd Has a Leader](#etcd-has-a-leader)
+  - [Number of Times the Leader Changes](#number-of-times-the-leader-changes)
+  - [Number of Failed Proposals](#number-of-failed-proposals)
+  - [GRPC Client Traffic](#grpc-client-traffic)
+  - [Peer Traffic](#peer-traffic)
+  - [DB Size](#db-size)
+  - [Active Streams](#active-streams)
+  - [Raft Proposals](#raft-proposals)
+  - [RPC Rate](#rpc-rate)
+  - [Disk Operations](#disk-operations)
+  - [Disk Sync Duration](#disk-sync-duration)
 - [Kubernetes Components Metrics](#kubernetes-components-metrics)
+  - [API Server Request Latency](#api-server-request-latency)
+  - [API Server Request Rate](#api-server-request-rate)
+  - [Scheduling Failed Pods](#scheduling-failed-pods)
+  - [Controller Manager Queue Depth](#controller-manager-queue-depth)
+  - [Scheduler E2E Scheduling Latency](#scheduler-e2e-scheduling-latency)
+  - [Scheduler Preemption Attempts](#scheduler-preemption-attempts)
+  - [Ingress Controller Connections](#ingress-controller-connections)
+  - [Ingress Controller Request Process Time](#ingress-controller-request-process-time)
 - [Rancher Logging Metrics](#rancher-logging-metrics)
+  - [Fluentd Buffer Queue Rate](#fluentd-buffer-queue-rate)
+  - [Fluentd Input Rate](#fluentd-input-rate)
+  - [Fluentd Output Errors Rate](#fluentd-output-errors-rate)
+  - [Fluentd Output Rate](#fluentd-output-rate)
 - [Workload Metrics](#workload-metrics)
-    + [Pod Metrics](#pod-metrics)
-    + [Container Metrics](#container-metrics)
+  - [Workload CPU Utilization](#workload-cpu-utilization)
+  - [Workload Memory Utilization](#workload-memory-utilization)
+  - [Workload Network Packets](#workload-network-packets)
+  - [Workload Network I/O](#workload-network-i-o)
+  - [Workload Disk I/O](#workload-disk-i-o)
+- [Pod Metrics](#pod-metrics)
+  - [Pod CPU Utilization](#pod-cpu-utilization)
+  - [Pod Memory Utilization](#pod-memory-utilization)
+  - [Pod Network Packets](#pod-network-packets)
+  - [Pod Network I/O](#pod-network-i-o)
+  - [Pod Disk I/O](#pod-disk-i-o)
+- [Container Metrics](#container-metrics)
+  - [Container CPU Utilization](#container-cpu-utilization)
+  - [Container Memory Utilization](#container-memory-utilization)
+  - [Container Disk I/O](#container-disk-i-o)
 
 <!-- /TOC -->
 
-## Cluster Metrics
+# Cluster Metrics
 
-- **CPU Utilization**
+### Cluster CPU Utilization
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])) by (instance))` |
-    | Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])))` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])) by (instance))` |
+| Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])))` |
 
-- **Load Average**
+### Cluster Load Average
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr></table> |
 
-- **Memory Utilization**
+### Cluster Memory Utilization
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `1 - sum(node_memory_MemAvailable_bytes) by (instance) / sum(node_memory_MemTotal_bytes) by (instance)` |
-    | Summary | `1 - sum(node_memory_MemAvailable_bytes) / sum(node_memory_MemTotal_bytes)` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `1 - sum(node_memory_MemAvailable_bytes) by (instance) / sum(node_memory_MemTotal_bytes) by (instance)` |
+| Summary | `1 - sum(node_memory_MemAvailable_bytes) / sum(node_memory_MemTotal_bytes)` |
 
-- **Disk Utilization**
+### Cluster Disk Utilization
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `(sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance) - sum(node_filesystem_free_bytes{device!="rootfs"}) by (instance)) / sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance)` |
-    | Summary | `(sum(node_filesystem_size_bytes{device!="rootfs"}) - sum(node_filesystem_free_bytes{device!="rootfs"})) / sum(node_filesystem_size_bytes{device!="rootfs"})` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `(sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance) - sum(node_filesystem_free_bytes{device!="rootfs"}) by (instance)) / sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance)` |
+| Summary | `(sum(node_filesystem_size_bytes{device!="rootfs"}) - sum(node_filesystem_free_bytes{device!="rootfs"})) / sum(node_filesystem_size_bytes{device!="rootfs"})` |
 
-- **Disk I/O**
+### Cluster Disk I/O
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m])) by (instance)`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m])) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m]))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m])) by (instance)`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m]))`</td></tr></table> |
 
-- **Network Packets**
+### Cluster Network Packets
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
-    | Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
+| Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
 
-- **Network I/O**
+### Cluster Network I/O
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
-    | Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
+| Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
 
-### Node Metrics
+# Node Metrics
 
-- **CPU Utilization**
+### Node CPU Utilization
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `avg(irate(node_cpu_seconds_total{mode!="idle", instance=~"$instance"}[5m])) by (mode)` |
-    | Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle", instance=~"$instance"}[5m])))` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `avg(irate(node_cpu_seconds_total{mode!="idle", instance=~"$instance"}[5m])) by (mode)` |
+| Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle", instance=~"$instance"}[5m])))` |
 
-- **Load Average**
+### Node Load Average
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
-    | Summary | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
+| Summary | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
 
-- **Memory Utilization**
+### Node Memory Utilization
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"})` |
-    | Summary | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"}) ` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"})` |
+| Summary | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"}) ` |
 
-- **Disk Utilization**
+### Node Disk Utilization
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"}) by (device)) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device)` |
-    | Summary | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"})) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"})` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"}) by (device)) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device)` |
+| Summary | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"})) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"})` |
 
-- **Disk I/O**
+### Node Disk I/O
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
-    | Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
 
-- **Network Packets**
+### Node Network Packets
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
-    | Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
+| Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
 
-- **Network I/O**
+### Node Network I/O
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
-    | Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
+| Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
 
-## Etcd Metrics
+# Etcd Metrics
 
-- **Etcd has a leader**
+### Etcd Has a Leader
 
-    `max(etcd_server_has_leader)`
+`max(etcd_server_has_leader)`
 
-- **Number of leader changes**
+### Number of Times the Leader Changes
 
-    `max(etcd_server_leader_changes_seen_total)`
+`max(etcd_server_leader_changes_seen_total)`
 
-- **Number of failed proposals**
+### Number of Failed Proposals
 
-    `sum(etcd_server_proposals_failed_total)`
+`sum(etcd_server_proposals_failed_total)`
 
-- **GRPC Client Traffic**
+### GRPC Client Traffic
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m]))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m]))`</td></tr></table> |
 
-- **Peer Traffic**
+### Peer Traffic
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m]))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m]))`</td></tr></table> |
 
-- **DB Size**
+### DB Size
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(etcd_debugging_mvcc_db_total_size_in_bytes) by (instance)` |
-    | Summary | `sum(etcd_debugging_mvcc_db_total_size_in_bytes)` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(etcd_debugging_mvcc_db_total_size_in_bytes) by (instance)` |
+| Summary | `sum(etcd_debugging_mvcc_db_total_size_in_bytes)` |
 
-- **Active Streams**
+### Active Streams
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance)`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"})`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"})`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance)`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"})`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"})`</td></tr></table> |
 
-- **Raft Proposals**
+### Raft Proposals
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m])) by (instance)`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m])) by (instance)`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m])) by (instance)`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m])) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m]))`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m]))`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m]))`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m]))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m])) by (instance)`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m])) by (instance)`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m])) by (instance)`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m]))`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m]))`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m]))`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m]))`</td></tr></table> |
 
-- **RPC Rate**
+### RPC Rate
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m])) by (instance)`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m])) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m]))`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m]))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m])) by (instance)`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m]))`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m]))`</td></tr></table> |
 
-- **Disk Operations**
+### Disk Operations
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m])) by (instance)`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m])) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m]))`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m]))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m])) by (instance)`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m]))`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m]))`</td></tr></table> |
 
-- **Disk Sync Duration**
+### Disk Sync Duration
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>wal</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le))`</td></tr><tr><td>db</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le))`</td></tr></table> |
-    | Summary | <table><tr><td>wal</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr><tr><td>db</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>wal</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le))`</td></tr><tr><td>db</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le))`</td></tr></table> |
+| Summary | <table><tr><td>wal</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr><tr><td>db</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr></table> |
 
-## Kubernetes Components Metrics
+# Kubernetes Components Metrics
 
-- **API Server Request Latency**
+### API Server Request Latency
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance, verb) /1e+06` |
-    | Summary | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance) /1e+06` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance, verb) /1e+06` |
+| Summary | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance) /1e+06` |
 
-- **API Server Request Rate**
+### API Server Request Rate
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(rate(apiserver_request_count[5m])) by (instance, code)` |
-    | Summary | `sum(rate(apiserver_request_count[5m])) by (instance)` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(apiserver_request_count[5m])) by (instance, code)` |
+| Summary | `sum(rate(apiserver_request_count[5m])) by (instance)` |
 
-- **Scheduling Failed Pods**
+### Scheduling Failed Pods
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(kube_pod_status_scheduled{condition="false"})` |
-    | Summary | `sum(kube_pod_status_scheduled{condition="false"})` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(kube_pod_status_scheduled{condition="false"})` |
+| Summary | `sum(kube_pod_status_scheduled{condition="false"})` |
 
-- **Controller Manager Queue Depth**
+### Controller Manager Queue Depth
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>volumes</td><td>`sum(volumes_depth) by instance`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth) by instance`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth) by instance`</td></tr><tr><td>service</td><td>`sum(service_depth) by instance`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth) by instance`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth) by instance`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth) by instance`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth) by instance`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth) by instance`</td></tr></table> |
-    | Summary | <table><tr><td>volumes</td><td>`sum(volumes_depth)`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth)`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth)`</td></tr><tr><td>service</td><td>`sum(service_depth)`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth)`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth)`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth)`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth)`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth)`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>volumes</td><td>`sum(volumes_depth) by instance`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth) by instance`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth) by instance`</td></tr><tr><td>service</td><td>`sum(service_depth) by instance`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth) by instance`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth) by instance`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth) by instance`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth) by instance`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth) by instance`</td></tr></table> |
+| Summary | <table><tr><td>volumes</td><td>`sum(volumes_depth)`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth)`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth)`</td></tr><tr><td>service</td><td>`sum(service_depth)`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth)`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth)`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth)`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth)`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth)`</td></tr></table> |
 
-- **Scheduler E2E Scheduling Latency**
+### Scheduler E2E Scheduling Latency
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06` |
-    | Summary | `sum(histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06)` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06` |
+| Summary | `sum(histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06)` |
 
-- **Scheduler Preemption Attempts**
+### Scheduler Preemption Attempts
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(rate(scheduler_total_preemption_attempts[5m])) by (instance)` |
-    | Summary | `sum(rate(scheduler_total_preemption_attempts[5m]))` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(scheduler_total_preemption_attempts[5m])) by (instance)` |
+| Summary | `sum(rate(scheduler_total_preemption_attempts[5m]))` |
 
-- **Ingress Controller Connections**
+### Ingress Controller Connections
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"}) by (instance)`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"}) by (instance)`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"}) by (instance)`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m]))) by (instance)`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m]))) by (instance)`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m]))) by (instance)`</td></tr></table> |
-    | Summary | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"})`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"})`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"})`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m])))`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m])))`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m])))`</td></tr></table> |
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"}) by (instance)`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"}) by (instance)`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"}) by (instance)`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m]))) by (instance)`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m]))) by (instance)`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m]))) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"})`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"})`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"})`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m])))`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m])))`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m])))`</td></tr></table> |
 
-- **Ingress Controller Request Process Time**
+### Ingress Controller Request Process Time
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `topk(10, histogram_quantile(0.95,sum by (le, host, path)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
-    | Summary | `topk(10, histogram_quantile(0.95,sum by (le, host)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
+| Catalog | Expression |
+| --- | --- |
+| Detail | `topk(10, histogram_quantile(0.95,sum by (le, host, path)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
+| Summary | `topk(10, histogram_quantile(0.95,sum by (le, host)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
 
-## Rancher Logging Metrics
+# Rancher Logging Metrics
 
-- **Fluentd Buffer Queue Rate**
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(rate(fluentd_output_status_buffer_queue_length[5m])) by (instance)` |
-    | Summary | `sum(rate(fluentd_output_status_buffer_queue_length[5m]))` |
+### Fluentd Buffer Queue Rate
 
-- **Fluentd Input Rate**
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_output_status_buffer_queue_length[5m])) by (instance)` |
+| Summary | `sum(rate(fluentd_output_status_buffer_queue_length[5m]))` |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(rate(fluentd_input_status_num_records_total[5m])) by (instance)` |
-    | Summary | `sum(rate(fluentd_input_status_num_records_total[5m]))` |
+### Fluentd Input Rate
 
-- **Fluentd Output Errors Rate**
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_input_status_num_records_total[5m])) by (instance)` |
+| Summary | `sum(rate(fluentd_input_status_num_records_total[5m]))` |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(rate(fluentd_output_status_num_errors[5m])) by (type)` |
-    | Summary | `sum(rate(fluentd_output_status_num_errors[5m]))` |
+### Fluentd Output Errors Rate
 
-- **Fluentd Output Rate**
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_output_status_num_errors[5m])) by (type)` |
+| Summary | `sum(rate(fluentd_output_status_num_errors[5m]))` |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(rate(fluentd_output_status_num_records_total[5m])) by (instance)` |
-    | Summary | `sum(rate(fluentd_output_status_num_records_total[5m]))` |
+### Fluentd Output Rate
 
-## Workload Metrics
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_output_status_num_records_total[5m])) by (instance)` |
+| Summary | `sum(rate(fluentd_output_status_num_records_total[5m]))` |
 
-- **CPU Utilization**
+# Workload Metrics
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-    | Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+### Workload CPU Utilization
 
-- **Memory Utilization**
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""}) by (pod_name)` |
-    | Summary | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""})` |
+### Workload Memory Utilization
 
-- **Network Packets**
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""}) by (pod_name)` |
+| Summary | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""})` |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-    | Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+### Workload Network Packets
 
-- **Network I/O**
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-    | Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+### Workload Network I/O
 
-- **Disk I/O**
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-    | Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+### Workload Disk I/O
 
-### Pod Metrics
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
 
-- **CPU Utilization**
+# Pod Metrics
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr></table> |
-    | Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr></table> |
+### Pod CPU Utilization
 
-- **Memory Utilization**
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr></table> |
+| Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr></table> |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""}) by (container_name)` |
-    | Summary | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""})` |
+### Pod Memory Utilization
 
-- **Network Packets**
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""}) by (container_name)` |
+| Summary | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""})` |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
-    | Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+### Pod Network Packets
 
-- **Network I/O**
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+| Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
-    | Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+### Pod Network I/O
 
-- **Disk I/O**
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+| Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
 
-    | Catalog | Expression |
-    | --- | --- |
-    | Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr></table> |
-    | Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+### Pod Disk I/O
 
-### Container Metrics
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
 
-- **CPU Utilization**
+# Container Metrics
 
-    | Catalog | Expression |
-    | --- | --- |
-    | cfs throttled seconds | `sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-    | usage seconds | `sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-    | system seconds | `sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-    | user seconds | `sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+### Container CPU Utilization
 
-- **Memory Utilization**
+| Catalog | Expression |
+| --- | --- |
+| cfs throttled seconds | `sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| usage seconds | `sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| system seconds | `sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| user seconds | `sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
 
-    `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name="$podName",container_name="$containerName"})`
+### Container Memory Utilization
 
-- **Disk IO**
+`sum(container_memory_working_set_bytes{namespace="$namespace",pod_name="$podName",container_name="$containerName"})`
 
-    | Catalog | Expression |
-    | --- | --- |
-    | read | `sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-    | write | `sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+### Container Disk I/O
+
+| Catalog | Expression |
+| --- | --- |
+| read | `sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| write | `sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |

From 2970fdb4bc292435ea7dbde31929540384be0d84 Mon Sep 17 00:00:00 2001
From: Caleb Bron <caleb@rancher.com>
Date: Fri, 10 Apr 2020 13:59:23 -0700
Subject: [PATCH 024/265] Add note about helm3 catalogs when upgrade to rancher
 2.4

---
 content/rancher/v2.x/en/catalog/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/catalog/_index.md b/content/rancher/v2.x/en/catalog/_index.md
index a827d3d9ba7..35fed1613b9 100644
--- a/content/rancher/v2.x/en/catalog/_index.md
+++ b/content/rancher/v2.x/en/catalog/_index.md
@@ -45,7 +45,7 @@ When you create a custom catalog, you will have to configure the catalog to use
 
 When you launch a new app from a catalog, the app will be managed by the catalog's Helm version. A Helm 2 catalog will use Helm 2 to manage all of the apps, and a Helm 3 catalog will use Helm 3 to manage all apps.
 
-By default, catalogs are assumed to be deployed using Helm 2. If you run an app in Rancher prior to v2.4.0, then upgrade to Rancher v2.4.0+, the app will still be managed by Helm 2.
+By default, catalogs are assumed to be deployed using Helm 2. If you run an app in Rancher prior to v2.4.0, then upgrade to Rancher v2.4.0+, the app will still be managed by Helm 2. If the app was already using a Helm 3 Chart (API version 2) it will no longer work in v2.4.0+, you must either downgrade the chart's API version or recreate the catalog to use Helm 3.
 
 Charts that are specific to Helm 2 should only be added to a Helm 2 catalog, and Helm 3 specific charts should only be added to a Helm 3 catalog.
 

From 9f0805e21d820a1014189192a6449c31cf4c9b2d Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 10 Apr 2020 14:39:17 -0700
Subject: [PATCH 025/265] Fix run-on

---
 content/rancher/v2.x/en/catalog/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/catalog/_index.md b/content/rancher/v2.x/en/catalog/_index.md
index 35fed1613b9..48ecd6612fd 100644
--- a/content/rancher/v2.x/en/catalog/_index.md
+++ b/content/rancher/v2.x/en/catalog/_index.md
@@ -45,7 +45,7 @@ When you create a custom catalog, you will have to configure the catalog to use
 
 When you launch a new app from a catalog, the app will be managed by the catalog's Helm version. A Helm 2 catalog will use Helm 2 to manage all of the apps, and a Helm 3 catalog will use Helm 3 to manage all apps.
 
-By default, catalogs are assumed to be deployed using Helm 2. If you run an app in Rancher prior to v2.4.0, then upgrade to Rancher v2.4.0+, the app will still be managed by Helm 2. If the app was already using a Helm 3 Chart (API version 2) it will no longer work in v2.4.0+, you must either downgrade the chart's API version or recreate the catalog to use Helm 3.
+By default, catalogs are assumed to be deployed using Helm 2. If you run an app in Rancher prior to v2.4.0, then upgrade to Rancher v2.4.0+, the app will still be managed by Helm 2. If the app was already using a Helm 3 Chart (API version 2) it will no longer work in v2.4.0+. You must either downgrade the chart's API version or recreate the catalog to use Helm 3.
 
 Charts that are specific to Helm 2 should only be added to a Helm 2 catalog, and Helm 3 specific charts should only be added to a Helm 3 catalog.
 

From e40a40fe886ec47018c18b453145966d1c99287e Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 10 Apr 2020 15:38:56 -0700
Subject: [PATCH 026/265] Fix errors on GCE cloud provider page

---
 .../rke-clusters/cloud-providers/_index.md    |  4 ++
 .../cloud-providers/gce/_index.md             | 49 +++++++++----------
 2 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md
index ee5c9c2af7f..70dc4464f42 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md
@@ -26,6 +26,10 @@ For details on enabling the Amazon cloud provider, refer to [this page.]({{<base
 
 For details on enabling the Azure cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/azure)
 
+### Setting up the GCE Cloud Provider
+
+For details on enabling the Google Compute Engine cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce)
+
 ### Setting up a Custom Cloud Provider
 
 The `Custom` cloud provider is available if you want to configure any [Kubernetes cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/).
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
index d5f13a993f8..32980b2e40e 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
@@ -3,9 +3,7 @@ title: Setting up the Google Compute Engine Cloud Provider
 weight: 3
 ---
 
-In this section, you'll learn how to enable the Google Compute Engine (GCE) cloud provider for provisioning custom clusters in Rancher. A custom cluster is one in which Rancher installs Kubernetes on existing nodes.
-
-These steps are required for provisioning GCE Kubernetes clusters that include Windows nodes.
+In this section, you'll learn how to enable the Google Compute Engine (GCE) cloud provider for custom clusters in Rancher. A custom cluster is one in which Rancher installs Kubernetes on existing nodes.
 
 The official Kubernetes documentation for the GCE cloud provider is [here.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#gce)
 
@@ -17,18 +15,18 @@ If you are using Calico,
 1. Click **Edit as YAML,** and enter the following configuration:
     ```yaml
     rancher_kubernetes_engine_config:
-    cloud_provider:
+      cloud_provider: // indent 2 spaces than `rancher_kubernetes_engine_config`
         name: gce
-        customCloudProvider: |-
-        [Global]
-        project-id=<your projcet ID, optional>
-        network-name=<your network, optional if using default network>
-        subnetwork-name=<your subnetwork of the above network, optional if using default network>
-        node-instance-prefix=<your instance group name/your instance name specific prefix, required>
-        node-tags=<your network tags, must patch one or some tags, required>
-    network: 
+        customCloudProvider: |- 
+          [Global]
+          project-id=<your project ID, optional>
+          network-name=<your network, optional if using default network>
+          subnetwork-name=<your subnetwork of the above network, optional if using default network>
+          node-instance-prefix=<your instance group name/your instance name specific prefix, required>
+          node-tags=<your network tags, must patch one or some tags, required>
+      network:
         options: 
-        calico_cloud_provider: "gce"
+          calico_cloud_provider: "gce"
         plugin: "calico"
     ```
 
@@ -38,18 +36,17 @@ If you are using Canal or Flannel,
 1. Click **Edit as YAML,** and enter the following configuration:
     ```yaml
     rancher_kubernetes_engine_config:
-    cloud_provider:
+      cloud_provider: 
         name: gce
-        customCloudProvider: |-
-        [Global]
-        project-id=<your project ID, optional>
-        network-name=<your network, optional if using default network>
-        subnetwork-name=<your subnetwork of the above network, optional if using default network>
-        node-instance-prefix=<your instance group name/your instance name specific prefix, required>
-        node-tags=<your network tags, must patch one or some tags, required>
-    services:
-        kube_controller:
-        extra_args:
-            configure-cloud-routes: true # we need to allow
-            # the cloud provider to configure the routes for the hosts
+        customCloudProvider: |- 
+          [Global]
+          project-id=<your project ID, optional>
+          network-name=<your network, optional if using default network>
+          subnetwork-name=<your subnetwork of the above network, optional if using default network>
+          node-instance-prefix=<your instance group name/your instance name specific prefix, required>
+          node-tags=<your network tags, must patch one or some tags, required>
+      services: 
+        kube_controller: 
+          extra_args:
+            configure-cloud-routes: true # we need to allow the cloud provider configure the routes for the hosts
     ```
\ No newline at end of file

From 7479e6f53ddc5e1ee611db9e63525ca72597e815 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 10 Apr 2020 15:40:13 -0700
Subject: [PATCH 027/265] Remove comment

---
 .../rke-clusters/cloud-providers/gce/_index.md                  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
index 32980b2e40e..2484105be02 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
@@ -15,7 +15,7 @@ If you are using Calico,
 1. Click **Edit as YAML,** and enter the following configuration:
     ```yaml
     rancher_kubernetes_engine_config:
-      cloud_provider: // indent 2 spaces than `rancher_kubernetes_engine_config`
+      cloud_provider:
         name: gce
         customCloudProvider: |- 
           [Global]

From 512f33c4307695797f179f12ad24630419ba6526 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 10 Apr 2020 15:53:46 -0700
Subject: [PATCH 028/265] Add line breaks

---
 .../rke-clusters/cloud-providers/gce/_index.md                  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
index 2484105be02..548ff88ba96 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
@@ -13,6 +13,7 @@ If you are using Calico,
 
 1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
 1. Click **Edit as YAML,** and enter the following configuration:
+
     ```yaml
     rancher_kubernetes_engine_config:
       cloud_provider:
@@ -34,6 +35,7 @@ If you are using Canal or Flannel,
 
 1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
 1. Click **Edit as YAML,** and enter the following configuration:
+
     ```yaml
     rancher_kubernetes_engine_config:
       cloud_provider: 

From 1a81b98e308ca87cf08b8b71fca7afd378b28ca0 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 10 Apr 2020 16:00:11 -0700
Subject: [PATCH 029/265] Remove syntax highlighting from page

---
 .../rke-clusters/cloud-providers/gce/_index.md                | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
index 548ff88ba96..000b537c110 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce/_index.md
@@ -14,7 +14,7 @@ If you are using Calico,
 1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
 1. Click **Edit as YAML,** and enter the following configuration:
 
-    ```yaml
+    ```
     rancher_kubernetes_engine_config:
       cloud_provider:
         name: gce
@@ -36,7 +36,7 @@ If you are using Canal or Flannel,
 1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
 1. Click **Edit as YAML,** and enter the following configuration:
 
-    ```yaml
+    ```
     rancher_kubernetes_engine_config:
       cloud_provider: 
         name: gce

From 41dd6534311bb02b136f5c45b246798591733e28 Mon Sep 17 00:00:00 2001
From: timniklas <timkoch71@yahoo.de>
Date: Sun, 12 Apr 2020 22:09:40 +0200
Subject: [PATCH 030/265] Update _index.md

---
 content/os/v1.x/en/storage/using-zfs/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/os/v1.x/en/storage/using-zfs/_index.md b/content/os/v1.x/en/storage/using-zfs/_index.md
index dd317c1b5df..1247accff85 100644
--- a/content/os/v1.x/en/storage/using-zfs/_index.md
+++ b/content/os/v1.x/en/storage/using-zfs/_index.md
@@ -21,7 +21,7 @@ $ sudo ros service logs --follow zfs
 $ lsmod | grep zfs
 ```
 
-> *Note:* if you switch consoles, you may need to re-run `ros up zfs`.
+> *Note:* if you switch consoles, you may need to re-run `sudo ros service up zfs`.
 
 #### Creating ZFS pools
 

From c31e2e161bbd4a84ce5de00582bd0615e234afd1 Mon Sep 17 00:00:00 2001
From: Brad Joniec <56899019+Rancheroo@users.noreply.github.com>
Date: Tue, 14 Apr 2020 08:52:58 +1000
Subject: [PATCH 031/265] Updated retention in snapshots

https://rancher.com/docs/rke/latest/en/etcd-snapshots/recurring-snapshots/
as in this document RKE 0.2 + uses a numbered retention not a hours

The number of snapshots to retain before rotation. This supercedes the retention option and will override it if both are specified.
---
 .../v2.x/en/installation/k8s-install/kubernetes-rke/_index.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
index 2791481d481..8f62c8450ec 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
@@ -161,7 +161,7 @@ services:
   etcd:
     snapshot: true
     creation: 6h
-    retention: 24h
+    retention: 24
 
 # Required for external TLS termination with
 # ingress-nginx v0.22+

From 091723c6bdad59eb4adf54953ccdaf4774ddbb62 Mon Sep 17 00:00:00 2001
From: dkeightley <derek@rancher.com>
Date: Tue, 14 Apr 2020 14:55:23 +1200
Subject: [PATCH 032/265] Add note/warning about NodeLocal DNS changes in a
 cluster

---
 .../rke/latest/en/config-options/add-ons/dns/_index.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/content/rke/latest/en/config-options/add-ons/dns/_index.md b/content/rke/latest/en/config-options/add-ons/dns/_index.md
index a1e268bb988..2e63a5c25be 100644
--- a/content/rke/latest/en/config-options/add-ons/dns/_index.md
+++ b/content/rke/latest/en/config-options/add-ons/dns/_index.md
@@ -129,6 +129,8 @@ _Available as of v1.1.0_
 
 NodeLocal DNS is an additional component that can be deployed on each node to improve DNS performance. It is not a replacement for the `provider` parameter, you will still need to have one of the available DNS providers configured. See [Using NodeLocal DNSCache in Kubernetes clusters](https://kubernetes.io/docs/tasks/administer-cluster/nodelocaldns/) for more information on how NodeLocal DNS works.
 
+Enable NodeLocal DNS by configuring an IP address.
+
 ## Configuring NodeLocal DNS
 
 The `ip_address` parameter is used to configure what link-local IP address will be configured one each host to listen on, make sure this IP address is not already configured on the host.
@@ -139,3 +141,11 @@ dns:
     nodelocal:
         ip_address: "169.254.20.10"
 ```
+
+> **Note:** When enabling NodeLocal DNS on an existing cluster, pods that are currently running will not be modified, the updated `/etc/resolv.conf` configuration will take effect only for pods started after enabling NodeLocal DNS.
+
+## Removing NodeLocal DNS
+
+By removing the `ip_address` value, NodeLocal DNS will be removed from the cluster.
+
+> **Warning:** When removing NodeLocal DNS, a disruption to DNS can be expected. The updated `/etc/resolv.conf` configuration will take effect only for pods that are started after removing NodeLocal DNS. In general pods using the default `dnsPolicy: ClusterFirst` will need to be re-deployed.

From 8eba252ec002591625274638ff5175f14501f4df Mon Sep 17 00:00:00 2001
From: Sebastiaan van Steenis <mail@superseb.nl>
Date: Tue, 14 Apr 2020 17:16:37 +0200
Subject: [PATCH 033/265] Update audit log defaults

---
 .../en/config-options/audit-log/_index.md     | 28 +++++++++++++++++--
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/content/rke/latest/en/config-options/audit-log/_index.md b/content/rke/latest/en/config-options/audit-log/_index.md
index f92fd76bbe2..1ddb802989b 100644
--- a/content/rke/latest/en/config-options/audit-log/_index.md
+++ b/content/rke/latest/en/config-options/audit-log/_index.md
@@ -9,6 +9,16 @@ You might want to configure the audit log as part of compliance with the CIS (Ce
 
 For configuration details, refer to the [official Kubernetes documentation.](https://kubernetes.io/docs/tasks/debug-application-cluster/audit/)
 
+### Enabled by default
+
+In RKE v1.1.0 and higher and when using specific Kubernetes versions, audit log is enabled by default. See the table below to check when audit log is enabled by default.
+
+| RKE version | Kubernetes version | audit log Enabled |
+|-------------|--------------------|----------------------|
+| v1.1.0 and higher | v1.17.4 and higher (v1.17.x) | Yes |
+| v1.1.0 and higher | v1.16.8 and higher (v1.16.x) | Yes |
+| v1.1.0 and higher | v1.15.11 and higher (v1.15.x) | Yes |
+
 ### Example Configurations
 
 The audit log can be enabled by default using the following configuration in `cluster.yml`:
@@ -20,7 +30,7 @@ services:
       enabled: true
 ```
 
-When the audit log is enabled, you should be able to see the default values at `/etc/kubernetes/audit.yaml`:
+When the audit log is enabled, you should be able to see the default values at `/etc/kubernetes/audit-policy.yaml` (This is located at `/etc/kubernetes/audit.yaml` before RKE v1.1.0):
 
 ```yaml
 # Minimum Configuration: Capture event metadata.
@@ -36,7 +46,19 @@ When the audit log is enabled, default values are also set for the audit log pat
 ps -ef | grep kube-apiserver
 ```
 
-The default values for the audit log should be displayed:
+The default values for audit log were changed in RKE v1.1.0 to the following:
+
+```yaml
+--audit-log-maxage=30 # The maximum number of days to retain old audit log files
+--audit-log-maxbackup=10 # The maximum number of audit log files to retain
+--audit-log-path=/var/log/kube-audit/audit-log.json # The log file path that log backend uses to write audit events
+--audit-log-maxsize=100 # The maximum size in megabytes of the audit log file before it gets rotated
+--audit-policy-file=/etc/kubernetes/audit-policy.yaml # The file containing your audit log rules
+--audit-log-format=json # The log file format
+
+```
+
+The default values for the audit log before RKE v1.1.0 are:
 
 ```yaml
 --audit-log-maxage=5 # The maximum number of days to retain old audit log files
@@ -131,4 +153,4 @@ services:
               # generate an audit event in RequestReceived.
               omitStages:
                 - "RequestReceived"
-```
\ No newline at end of file
+```

From 46af4d2622149899b6c1e5447b4204c58392f0de Mon Sep 17 00:00:00 2001
From: Sebastiaan van Steenis <mail@superseb.nl>
Date: Tue, 14 Apr 2020 17:25:31 +0200
Subject: [PATCH 034/265] Add audit log to directories to be cleaned

---
 .../v2.x/en/cluster-admin/cleaning-cluster-nodes/_index.md      | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/_index.md b/content/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/_index.md
index 8ce29334dda..4cd99d79872 100644
--- a/content/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/_index.md
@@ -167,6 +167,7 @@ Directories |
 `/var/lib/kubelet` |
 `/var/lib/rancher/rke/log` |
 `/var/log/containers` |
+`/var/log/kube-audit` |
 `/var/log/pods` |
 `/var/run/calico` |
 
@@ -187,6 +188,7 @@ rm -rf /etc/ceph \
        /var/lib/kubelet \
        /var/lib/rancher/rke/log \
        /var/log/containers \
+       /var/log/kube-audit \
        /var/log/pods \
        /var/run/calico
 ```

From 689694388453b14410f3ea11f0cf6cbc0937783f Mon Sep 17 00:00:00 2001
From: dkeightley <derek@rancher.com>
Date: Wed, 15 Apr 2020 11:27:34 +1200
Subject: [PATCH 035/265] Add note around tls-ca taking effect at Rancher pod
 start

---
 .../rancher/v2.x/en/installation/options/tls-secrets/_index.md  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
index 76262c0a12f..72abc4d458a 100644
--- a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
+++ b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
@@ -31,3 +31,5 @@ Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to cre
 kubectl -n cattle-system create secret generic tls-ca \
   --from-file=cacerts.pem
 ```
+
+> **Note:** The configured `tls-ca` secret is retrieved when Rancher starts, on a running Rancher installation the updated CA will take effect after new Rancher pods are started.

From 69cb4140100ec086b034fc127e3cf8e685a4e7c6 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 14 Apr 2020 16:29:53 -0700
Subject: [PATCH 036/265] Add period

---
 .../rancher/v2.x/en/installation/options/tls-secrets/_index.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
index 72abc4d458a..5dda63fe028 100644
--- a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
+++ b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
@@ -32,4 +32,4 @@ kubectl -n cattle-system create secret generic tls-ca \
   --from-file=cacerts.pem
 ```
 
-> **Note:** The configured `tls-ca` secret is retrieved when Rancher starts, on a running Rancher installation the updated CA will take effect after new Rancher pods are started.
+> **Note:** The configured `tls-ca` secret is retrieved when Rancher starts. On a running Rancher installation the updated CA will take effect after new Rancher pods are started.

From 8947fe9afbbd90131c7dd2edb402c85983a74efd Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 15 Apr 2020 00:19:59 -0700
Subject: [PATCH 037/265] Clarify snapshot retention option

---
 .../rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md b/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
index a5435ddfbe1..164a79c79d0 100644
--- a/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
+++ b/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
@@ -31,7 +31,7 @@ time="2018-05-04T18:43:16Z" level=info msg="Created backup" name="2018-05-04T18:
 |Option|Description| S3 Specific |
 |---|---| --- |
 |**interval_hours**| The duration in hours between recurring backups.  This supercedes the `creation` option (which was used in RKE prior to v0.2.0) and will override it if both are specified.| |
-|**retention**| The number of snapshots to retain before rotation. This supercedes the `retention` option and will override it if both are specified.| |
+|**retention**| The number of snapshots to retain before rotation. If the `retention` is configured in both `etcd.retention`, which was required in RKE prior to v0.2.0, and at `etcd.backup_config.retention`, the latter will be used. | |
 |**bucket_name**| S3 bucket name where backups will be stored| * |
 |**folder**| Folder inside S3 bucket where backups will be stored. This is optional. _Available as of v0.3.0_ | * |
 |**access_key**| S3 access key with permission to access the backup bucket.| * |

From e9ee99634d7f772d21fdf56247226e36b2b96bda Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 15 Apr 2020 00:26:34 -0700
Subject: [PATCH 038/265] Fix description of snapshot option

---
 .../rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md b/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
index 164a79c79d0..fe67a69dc0c 100644
--- a/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
+++ b/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
@@ -31,7 +31,7 @@ time="2018-05-04T18:43:16Z" level=info msg="Created backup" name="2018-05-04T18:
 |Option|Description| S3 Specific |
 |---|---| --- |
 |**interval_hours**| The duration in hours between recurring backups.  This supercedes the `creation` option (which was used in RKE prior to v0.2.0) and will override it if both are specified.| |
-|**retention**| The number of snapshots to retain before rotation. If the `retention` is configured in both `etcd.retention`, which was required in RKE prior to v0.2.0, and at `etcd.backup_config.retention`, the latter will be used. | |
+|**retention**| The number of snapshots to retain before rotation. If the retention is configured in both `etcd.retention` (time period to keep snapshots in hours), which was required in RKE prior to v0.2.0, and at `etcd.backup_config.retention` (number of snapshots), the latter will be used. | |
 |**bucket_name**| S3 bucket name where backups will be stored| * |
 |**folder**| Folder inside S3 bucket where backups will be stored. This is optional. _Available as of v0.3.0_ | * |
 |**access_key**| S3 access key with permission to access the backup bucket.| * |

From 378d3c927bfbf75fc85b00d8b46c66e926221969 Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Wed, 15 Apr 2020 19:14:02 +0100
Subject: [PATCH 039/265] Removed duplicate + fixed grammar and link

---
 content/rancher/v2.x/en/installation/options/nlb/_index.md | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/options/nlb/_index.md
index 35d00153769..23035d1133f 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/nlb/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Setting up an Amazon ELB Network Load Balancer
+title: Setting up\Amazon ELB Network Load Balancer
 weight: 277
 aliases:
   - /rancher/v2.x/en/installation/ha/create-nodes-lb/nlb
@@ -100,9 +100,7 @@ Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The s
 
 # 3. Create Your NLB
 
-Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
-
-Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in [Create Target Groups](#create-target-groups).
+Use Amazon's Wizard to create a Network Load Balancer. As part of this process, you'll add the target groups you created in [1. Create Target Groups](#1-create-target-groups).
 
 1.  From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
 

From 3f2686927b4a4813fb4d930b9bbedb6ece54d13e Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Thu, 16 Apr 2020 13:25:11 -0700
Subject: [PATCH 040/265] Add info about helm 3

---
 content/rancher/v2.x/en/catalog/_index.md | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/catalog/_index.md b/content/rancher/v2.x/en/catalog/_index.md
index 48ecd6612fd..bc8595425bb 100644
--- a/content/rancher/v2.x/en/catalog/_index.md
+++ b/content/rancher/v2.x/en/catalog/_index.md
@@ -19,6 +19,8 @@ This section covers the following topics:
 
 - [Catalog scopes](#catalog-scopes)
 - [Catalog Helm Deployment Versions](#catalog-helm-deployment-versions)
+- [When to use Helm 3](#when-to-use-helm-3)
+- [Helm 3 Backwards Compatibility](#helm-3-backwards-compatibility)
 - [Built-in global catalogs](#built-in-global-catalogs)
 - [Custom catalogs](#custom-catalogs)
 - [Creating and launching applications](#creating-and-launching-applications)
@@ -39,7 +41,7 @@ Project | This specific cluster can access the Helm charts in this catalog |  v2
 
 _Applicable as of v2.4.0_
 
-In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully backwards compatible with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version.
+In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully [backwards compatible]({{<baseurl>}}/rancher/v2.x/en/catalog/helm-3-backwards-compatibility) with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version. This will help reduce app deployment issues as your Rancher users will not need to know which version of your chart is compatible with which Helm version - they can just select a catalog, select an app and deploy a version that has already be vetted for compatibility.
 
 When you create a custom catalog, you will have to configure the catalog to use either Helm 2 or Helm 3. This version cannot be changed later. If the catalog is added with the wrong Helm version, it will need to be deleted and re-added.
 
@@ -49,6 +51,25 @@ By default, catalogs are assumed to be deployed using Helm 2. If you run an app
 
 Charts that are specific to Helm 2 should only be added to a Helm 2 catalog, and Helm 3 specific charts should only be added to a Helm 3 catalog.
 
+# When to use Helm 3
+
+_Applicable as of v2.4.0_
+
+- If you want to ensure that the security permissions are being pulled from the kubeconfig file
+- If you want to utilize apiVersion `v2` features such as creating a library chart to reduce code duplication or moving your requirements from the requirements.yaml into the Chart.yaml
+
+Overall Helm 3 is a movement towards a more standardized kubernetes feel. As the kubernetes community has evolved, standards and best practices have as well. Helm 3 is an attempt to adopt those practices and streamline how charts are maintained.
+
+# Helm 3 Backwards Compatibility
+
+_Applicable as of v2.4.0_
+
+With the use of the OpenAPI schema to validate your rendered templates in Helm 3, you will find charts that worked in Helm 2 may not work in Helm 3. This will require you to update your chart templates to meet the new validation requirements. This is one of the main reasons support for Helm 2 and Helm 3 was provided starting in Rancher 2.4.x as not all charts can be deployed immediately in Helm 3.
+
+Helm 3 does not create a namespace for you, you have to provide an existing one. This can cause issues if you have integrated code with Helm 2, as you will need to make code changes to ensure a namespace is being created and passed in for Helm 3. Rancher will continue to manage namespaces for Helm to ensure this does not impact your app deployment.  
+
+apiVersion `v2` is now reserved for Helm 3 charts. This apiVersion enforcement could cause issues as older versions of Helm 2 did not validate the apiVersion in the Chart.yaml file. In general your Helm 2 chart’s apiVersion should be set to `v1` and your Helm 3 chart’s apiVersion should be set to `v2`. You can install charts with apiVersion `v1` with Helm 3 but you cannot install `v2` charts into Helm 2.
+
 # Built-in Global Catalogs
 
 Within Rancher, there are default catalogs packaged as part of Rancher. These can be enabled or disabled by an administrator. For details, refer to the section on managing [built-in global catalogs.]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in)

From b8a3561b78a15717d60c1e75eaa11e858143d8bf Mon Sep 17 00:00:00 2001
From: Simone Natalini <natalinis@outlook.com>
Date: Fri, 17 Apr 2020 19:09:19 +0200
Subject: [PATCH 041/265] Update _index.md

---
 .../v2.x/en/installation/options/troubleshooting/_index.md      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
index 001b49dc0f0..9b9685fa0e8 100644
--- a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
+++ b/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
@@ -187,7 +187,7 @@ If you want to use encrypted private keys, you should use `ssh-agent` to load yo
 
 ### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
 
-The node is not reachable on the configured `address` and `port`.
+### The node is not reachable on the configured `address` and `port`.
 =======
 * The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
 

From 82b5f377278b19d9caa46a87b6cbf44276cd75da Mon Sep 17 00:00:00 2001
From: dkeightley <derek@rancher.com>
Date: Sun, 19 Apr 2020 08:34:39 +1200
Subject: [PATCH 042/265] Add bullet to supply --version flag for specific
 version during install

---
 .../v2.x/en/installation/k8s-install/helm-rancher/_index.md      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
index 21baa7961f0..c9cf20af14c 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
@@ -144,6 +144,7 @@ Because `rancher` is the default option for `ingress.tls.source`, we are not spe
 
 - Set the `hostname` to the DNS name you pointed at your load balancer.
 - If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
+- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`
 
 ```
 helm install rancher rancher-<CHART_REPO>/rancher \

From 0e2e64fbd1e4bb2929e7942165ce837277da5779 Mon Sep 17 00:00:00 2001
From: dkeightley <derek@rancher.com>
Date: Sun, 19 Apr 2020 09:14:18 +1200
Subject: [PATCH 043/265] Add note for rancherImageTag on air gap installs

---
 .../air-gap/install-rancher/_index.md                         | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index eb2d3ab49ef..436e221defd 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -124,6 +124,8 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
      --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
 ```
 
+**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.3.6`
+
 {{% /accordion %}}
 
 {{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
@@ -149,6 +151,8 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following
     --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
 ```
 
+**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.3.6`
+
 Then refer to [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
 
 {{% /accordion %}}

From b503c355c2b559f260839f9a219e7cd3441d6779 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 20 Apr 2020 08:27:14 -0700
Subject: [PATCH 044/265] Say that RKE v1.x should be used

---
 content/rke/latest/en/installation/_index.md | 2 +-
 content/rke/latest/en/upgrades/_index.md     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/rke/latest/en/installation/_index.md b/content/rke/latest/en/installation/_index.md
index 865a20ae6f8..126ab600e45 100644
--- a/content/rke/latest/en/installation/_index.md
+++ b/content/rke/latest/en/installation/_index.md
@@ -17,7 +17,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern
 
 ## Download the RKE binary
 
-1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases/latest) page. Download the latest RKE installer applicable to your Operating System and Architecture:
+1. From your workstation, open a web browser and navigate to our [RKE Releases](https://github.com/rancher/rke/releases) page. Download the latest RKE v1.x installer applicable to your operating system and architecture:
 
     - **macOS**: `rke_darwin-amd64`
     - **Linux (Intel/AMD)**: `rke_linux-amd64`
diff --git a/content/rke/latest/en/upgrades/_index.md b/content/rke/latest/en/upgrades/_index.md
index a90c542623d..5991e82ce6f 100644
--- a/content/rke/latest/en/upgrades/_index.md
+++ b/content/rke/latest/en/upgrades/_index.md
@@ -5,7 +5,7 @@ weight: 100
 
 After RKE has deployed Kubernetes, you can upgrade the versions of the components in your Kubernetes cluster, the [definition of the Kubernetes services]({{<baseurl>}}/rke/latest/en/config-options/services/) or the [add-ons]({{<baseurl>}}/rke/latest/en/config-options/add-ons/).
 
-The default Kubernetes version for each RKE version can be found in [the RKE release notes](https://github.com/rancher/rke/releases/).
+The default Kubernetes version for each RKE version can be found in [the RKE release notes](https://github.com/rancher/rke/releases/). RKE v1.x should be used.
 
 You can also select a newer version of Kubernetes to install for your cluster.
 
@@ -81,7 +81,7 @@ In [this section,]({{<baseurl>}}/rke/latest/en/upgrades/maintaining-availability
 
 ### Listing Supported Kubernetes Versions
 
-Please refer to the [release notes](https://github.com/rancher/rke/releases) of the RKE version that you are running, to find the list of supported Kubernetes versions as well as the default Kubernetes version.
+Please refer to the [release notes](https://github.com/rancher/rke/releases) of the RKE version that you are running, to find the list of supported Kubernetes versions as well as the default Kubernetes version. Note: RKE v1.x should be used.
 
 You can also list the supported versions and system images of specific version of RKE release with a quick command.
 

From 2e630807712f8c892a99857ac78eda6f4ec46e02 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 20 Apr 2020 09:00:17 -0700
Subject: [PATCH 045/265] Fix rebase errors

---
 .../options/troubleshooting/_index.md          | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
index 9b9685fa0e8..08a26d99bef 100644
--- a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
+++ b/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
@@ -174,7 +174,6 @@ SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
 
 ### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
 
-<<<<<<< HEAD
 The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
 
 ### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
@@ -187,19 +186,4 @@ If you want to use encrypted private keys, you should use `ssh-agent` to load yo
 
 ### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
 
-### The node is not reachable on the configured `address` and `port`.
-=======
-* The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
-
-* The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
-
-* If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
-
-### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
-
-* The node is not reachable on the configured `address` and `port`.
->>>>>>> Make RKE cluster troubleshooting page available for air gap install
+The node is not reachable on the configured `address` and `port`.

From 848ad4f956b56d218ca007b714f74a3a1a1c1028 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 20 Apr 2020 09:06:29 -0700
Subject: [PATCH 046/265] Minor edits

---
 content/rancher/v2.x/en/catalog/_index.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/content/rancher/v2.x/en/catalog/_index.md b/content/rancher/v2.x/en/catalog/_index.md
index bc8595425bb..97b2c2298cd 100644
--- a/content/rancher/v2.x/en/catalog/_index.md
+++ b/content/rancher/v2.x/en/catalog/_index.md
@@ -41,7 +41,7 @@ Project | This specific cluster can access the Helm charts in this catalog |  v2
 
 _Applicable as of v2.4.0_
 
-In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully [backwards compatible]({{<baseurl>}}/rancher/v2.x/en/catalog/helm-3-backwards-compatibility) with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version. This will help reduce app deployment issues as your Rancher users will not need to know which version of your chart is compatible with which Helm version - they can just select a catalog, select an app and deploy a version that has already be vetted for compatibility.
+In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully [backwards compatible]({{<baseurl>}}/rancher/v2.x/en/catalog/helm-3-backwards-compatibility) with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version. This will help reduce app deployment issues as your Rancher users will not need to know which version of your chart is compatible with which Helm version - they can just select a catalog, select an app and deploy a version that has already been vetted for compatibility.
 
 When you create a custom catalog, you will have to configure the catalog to use either Helm 2 or Helm 3. This version cannot be changed later. If the catalog is added with the wrong Helm version, it will need to be deleted and re-added.
 
@@ -56,19 +56,19 @@ Charts that are specific to Helm 2 should only be added to a Helm 2 catalog, and
 _Applicable as of v2.4.0_
 
 - If you want to ensure that the security permissions are being pulled from the kubeconfig file
-- If you want to utilize apiVersion `v2` features such as creating a library chart to reduce code duplication or moving your requirements from the requirements.yaml into the Chart.yaml
+- If you want to utilize apiVersion `v2` features such as creating a library chart to reduce code duplication, or moving your requirements from the `requirements.yaml` into the `Chart.yaml`
 
-Overall Helm 3 is a movement towards a more standardized kubernetes feel. As the kubernetes community has evolved, standards and best practices have as well. Helm 3 is an attempt to adopt those practices and streamline how charts are maintained.
+Overall Helm 3 is a movement towards a more standardized Kubernetes feel. As the Kubernetes community has evolved, standards and best practices have as well. Helm 3 is an attempt to adopt those practices and streamline how charts are maintained.
 
 # Helm 3 Backwards Compatibility
 
 _Applicable as of v2.4.0_
 
-With the use of the OpenAPI schema to validate your rendered templates in Helm 3, you will find charts that worked in Helm 2 may not work in Helm 3. This will require you to update your chart templates to meet the new validation requirements. This is one of the main reasons support for Helm 2 and Helm 3 was provided starting in Rancher 2.4.x as not all charts can be deployed immediately in Helm 3.
+With the use of the OpenAPI schema to validate your rendered templates in Helm 3, you will find charts that worked in Helm 2 may not work in Helm 3. This will require you to update your chart templates to meet the new validation requirements. This is one of the main reasons support for Helm 2 and Helm 3 was provided starting in Rancher 2.4.x, as not all charts can be deployed immediately in Helm 3.
 
-Helm 3 does not create a namespace for you, you have to provide an existing one. This can cause issues if you have integrated code with Helm 2, as you will need to make code changes to ensure a namespace is being created and passed in for Helm 3. Rancher will continue to manage namespaces for Helm to ensure this does not impact your app deployment.  
+Helm 3 does not create a namespace for you, so you will have to provide an existing one. This can cause issues if you have integrated code with Helm 2, as you will need to make code changes to ensure a namespace is being created and passed in for Helm 3. Rancher will continue to manage namespaces for Helm to ensure this does not impact your app deployment.  
 
-apiVersion `v2` is now reserved for Helm 3 charts. This apiVersion enforcement could cause issues as older versions of Helm 2 did not validate the apiVersion in the Chart.yaml file. In general your Helm 2 chart’s apiVersion should be set to `v1` and your Helm 3 chart’s apiVersion should be set to `v2`. You can install charts with apiVersion `v1` with Helm 3 but you cannot install `v2` charts into Helm 2.
+apiVersion `v2` is now reserved for Helm 3 charts. This apiVersion enforcement could cause issues as older versions of Helm 2 did not validate the apiVersion in the `Chart.yaml` file. In general, your Helm 2 chart’s apiVersion should be set to `v1` and your Helm 3 chart’s apiVersion should be set to `v2`. You can install charts with apiVersion `v1` with Helm 3, but you cannot install `v2` charts into Helm 2.
 
 # Built-in Global Catalogs
 

From c26a0e50b79f19a1d6353d626bb5a6ffb3b38356 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 20 Apr 2020 09:09:13 -0700
Subject: [PATCH 047/265] Remove slash

---
 content/rancher/v2.x/en/installation/options/nlb/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/options/nlb/_index.md
index 23035d1133f..78d170d6714 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/nlb/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Setting up\Amazon ELB Network Load Balancer
+title: Setting up Amazon ELB Network Load Balancer
 weight: 277
 aliases:
   - /rancher/v2.x/en/installation/ha/create-nodes-lb/nlb

From 36951df43e7d81d28db743e8c2f93e82bab0fbda Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 20 Apr 2020 09:41:33 -0700
Subject: [PATCH 048/265] Revert "Docs for scaleway IPs in dynamic IP options"

---
 .../rke-clusters/custom-nodes/agent-options/_index.md           | 2 --
 1 file changed, 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
index e81659c0a41..241369bc24d 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
@@ -55,5 +55,3 @@ For automation purposes, you can't have a specific IP address in a command as it
 | `gceexternal` | `--address gceexternal` | Value retrieved from `http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip` will be used |
 | `packetlocal` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/local-ipv4` will be used |
 | `packetpublic` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/public-ipv4` will be used |
-| `scwprivate` | `--address scwprivate` | Value retrieved from `http://169.254.42.42/conf` with key `PRIVATE_IP` will be used |
-| `scwpublic` | `--address scwpublic` | Value retrieved from `http://169.254.42.42/conf` with key `PUBLIC_IP_ADDRESS` will be used |

From aac06f1b9150fb19498f565c6f9ddc0160417a61 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 21 Apr 2020 13:56:23 -0700
Subject: [PATCH 049/265] Clarify AWS quickstart prerequisites

---
 .../en/quick-start-guide/deployment/amazon-aws-qs/_index.md  | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/content/rancher/v2.x/en/quick-start-guide/deployment/amazon-aws-qs/_index.md b/content/rancher/v2.x/en/quick-start-guide/deployment/amazon-aws-qs/_index.md
index 3e9ddae02c2..ee0e7e53ffd 100644
--- a/content/rancher/v2.x/en/quick-start-guide/deployment/amazon-aws-qs/_index.md
+++ b/content/rancher/v2.x/en/quick-start-guide/deployment/amazon-aws-qs/_index.md
@@ -13,7 +13,8 @@ The following steps will quickly deploy a Rancher Server on AWS with a single no
 - [Amazon AWS Account](https://aws.amazon.com/account/): An Amazon AWS Account is required to create resources for deploying Rancher and Kubernetes.
 - [Amazon AWS Access Key](https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html): Use this link to follow a tutorial to create an Amazon AWS Access Key if you don't have one yet.
 - [Amazon AWS Key Pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#having-ec2-create-your-key-pair) Use this link and follow instructions to create a Key Pair.
-- [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Amazon AWS.
+- Install [Terraform](https://www.terraform.io/downloads.html): Used to provision the server and cluster in Amazon AWS.
+- Install the [RKE terraform provider.](https://github.com/rancher/terraform-provider-rke#installing-the-provider) You will need to download the binary for the Terraform provider for RKE that corresponds to the operating system of your workstation. Then you will need to move the binary into your Terraform plugin directory. The name of the directory will depend on your operating system. For more information how to install Terraform plugins, refer to the [Terraform documentation.](https://www.terraform.io/docs/plugins/basics.html#installing-a-plugin)
 
 
 ## Getting Started
@@ -39,8 +40,6 @@ Suggestions include:
 
 1. Run `terraform init`.
 
-1. Install the [RKE terraform provider](https://github.com/rancher/terraform-provider-rke), see [installation instructions](https://github.com/rancher/terraform-provider-rke#using-the-provider).
-
 1. To initiate the creation of the environment, run `terraform apply --auto-approve`. Then wait for output similar to the following:
 
     ```

From 14bc24028b083bf4faf8f827c8b3b1ce69ca8fce Mon Sep 17 00:00:00 2001
From: Ryan Elliott-Smith <49007005+ryanelliottsmith@users.noreply.github.com>
Date: Wed, 22 Apr 2020 10:11:40 +1200
Subject: [PATCH 050/265] Update _index.md

---
 .../v2.x/en/cluster-admin/volumes-and-storage/_index.md        | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md
index c2b87d6095c..145e647c331 100644
--- a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md
@@ -53,6 +53,9 @@ In clusters that store data on GlusterFS volumes, you may experience an issue wh
 
 In [Rancher Launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) that store data on iSCSI volumes, you may experience an issue where kubelets fail to automatically connect with iSCSI volumes. For details on resolving this issue, refer to [this page.](./iscsi-volumes)
 
+### hostPath Volumes
+Before you create a hostPath volume, you need to set up an [extra_bind]({{<baseurl>}}/rke/latest/en/config-options/services/services-extras/#extra-binds/) in your cluster configuration. This will mount the path as a volume in your kubelets, which can then be used for hostPath volumes in your workloads.
+
 ### Related Links
 
 - [Kubernetes Documentation: Storage](https://kubernetes.io/docs/concepts/storage/)

From 68e97803ccdab4816226f98afc413edb6ff4e8dd Mon Sep 17 00:00:00 2001
From: Jan B <jan@rancher.com>
Date: Wed, 22 Apr 2020 17:57:43 +0200
Subject: [PATCH 051/265] Clarify configuration of the kubeconfig path

---
 content/k3s/latest/en/cluster-access/_index.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/k3s/latest/en/cluster-access/_index.md b/content/k3s/latest/en/cluster-access/_index.md
index 0b07d08b666..f24e4c3f964 100644
--- a/content/k3s/latest/en/cluster-access/_index.md
+++ b/content/k3s/latest/en/cluster-access/_index.md
@@ -3,7 +3,7 @@ title: Cluster Access
 weight: 21
 ---
 
-The kubeconfig file is used to configure access to the Kubernetes cluster. It is required to be set up properly in order to access the Kubernetes API such as with kubectl or for installing applications with Helm. You may set the kubeconfig by either exporting the KUBECONFIG environment variable or by specifying a flag for kubectl and helm. Refer to the examples below for details.
+The kubeconfig file stored at `/etc/rancher/k3s/k3s.yaml` is used to configure access to the Kubernetes cluster. If you have installed upstream Kubernetes command line tools such as kubectl or helm you will need to configure them with the correct kubeconfig path. This can be done by either exporting the `KUBECONFIG` environment variable or by invoking the `--kubeconfig` command line flag. Refer to the examples below for details.
 
 Leverage the KUBECONFIG environment variable:
 
@@ -13,7 +13,7 @@ kubectl get pods --all-namespaces
 helm ls --all-namespaces
 ```
 
-Or specify the location of the kubeconfig file per command:
+Or specify the location of the kubeconfig file in the command:
 
 ```
 kubectl --kubeconfig /etc/rancher/k3s/k3s.yaml get pods --all-namespaces
@@ -22,4 +22,4 @@ helm --kubeconfig /etc/rancher/k3s/k3s.yaml ls --all-namespaces
 
 ### Accessing the Cluster from Outside with kubectl
 
-Copy `/etc/rancher/k3s/k3s.yaml` on your machine located outside the cluster as `~/.kube/config`. Then replace "localhost" with the IP or name of your K3s server. `kubectl` can now manage your K3s cluster.
\ No newline at end of file
+Copy `/etc/rancher/k3s/k3s.yaml` on your machine located outside the cluster as `~/.kube/config`. Then replace "localhost" with the IP or name of your K3s server. `kubectl` can now manage your K3s cluster.

From 59efedd0dcd2aa2b8f2a75d7f0d7599a8cc4b614 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 22 Apr 2020 15:02:17 -0700
Subject: [PATCH 052/265] Say that RKE clusters and managed K8s clusters can be
 cloned

---
 content/rancher/v2.x/en/cluster-admin/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index ec93dd077f7..9b4371bfe7d 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -32,7 +32,7 @@ After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/e
 | [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | * | * | * |
 | [Managing Projects and Namespaces]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | * | * | * |
 | [Configuring Tools](#configuring-tools) | * | * | * |
-| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| | * | * |
+| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| * | * | |
 | [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | * |  | |
 | [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | * | | |
 | [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | * | | |

From 8972d88ab9426a8b8dff7c2f837c499df47e3aa9 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 22 Apr 2020 15:07:35 -0700
Subject: [PATCH 053/265] Say that all clusters but imported can be cloned

---
 .../rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
index 9e9335b1dd7..870abe6c403 100644
--- a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
@@ -14,8 +14,8 @@ Duplication of imported clusters, clusters in hosted Kubernetes providers, and c
 | Cluster Type                     | Cloneable?    |
 |----------------------------------|---------------|
 | [Nodes Hosted by Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) | ✓ |
-| [Hosted Kubernetes Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) |               |
-| [Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/)              |               |
+| [Hosted Kubernetes Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | ✓    |
+| [Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/)              | ✓              |
 | [Imported Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)            |               |
 
 > **Warning:** During the process of duplicating a cluster, you will edit a config file full of cluster settings. However, we recommend editing only values explicitly listed in this document, as cluster duplication is designed for simple cluster copying, _not_ wide scale configuration changes. Editing other values may invalidate the config file, which will lead to cluster deployment failure.

From a3cb1b6c9ac20a49c25e81bde8ea1faa4eb3353a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 22 Apr 2020 15:10:22 -0700
Subject: [PATCH 054/265] Edit cloning clusters page

---
 .../v2.x/en/cluster-admin/cloning-clusters/_index.md        | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
index 870abe6c403..4ac4b1989f8 100644
--- a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
@@ -5,11 +5,9 @@ aliases:
   - /rancher/v2.x/en/cluster-provisioning/cloning-clusters/
 ---
 
-If you have a cluster in Rancher that you want to use as a template for creating similar clusters, you can use Rancher CLI to clone the cluster's configuration, edit it, and then use it to quickly launch the  cloned cluster.
+If you have a cluster in Rancher that you want to use as a template for creating similar clusters, you can use Rancher CLI to clone the cluster's configuration, edit it, and then use it to quickly launch the cloned cluster.
 
-You can clone clusters only if the nodes in the cluster are hosted by an infrastructure provider, such as EC2, Azure, or DigitalOcean.
-
-Duplication of imported clusters, clusters in hosted Kubernetes providers, and custom clusters provisioned using Docker machine is not supported.
+Duplication of imported clusters is not supported.
 
 | Cluster Type                     | Cloneable?    |
 |----------------------------------|---------------|

From 0d21e3766942274ff8eee0910a06d110fc93e73a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 23 Apr 2020 05:58:23 -0700
Subject: [PATCH 055/265] Add Shibboleth to auth service table

---
 .../rancher/v2.x/en/admin-settings/authentication/_index.md   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/admin-settings/authentication/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/_index.md
index 6a786d9a78f..b6cc3cad3ae 100644
--- a/content/rancher/v2.x/en/admin-settings/authentication/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/authentication/_index.md
@@ -27,7 +27,9 @@ The Rancher authentication proxy integrates with the following external authenti
 | [PingIdentity]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ping-federate/)     | v2.0.7           |
 | [Keycloak]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/keycloak/)              | v2.1.0           |
 | [Okta]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/okta/)                      | v2.2.0           |
-| [Google OAuth]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/google/)                      | v2.3.0           |
+| [Google OAuth]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/google/)            | v2.3.0           |
+| [Shibboleth]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/shibboleth)           | v2.4.0           |
+
 <br/>
 However, Rancher also provides [local authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/local/).
 

From d74ba63da5bd5621e96332cea37f1385f34c0920 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 27 Apr 2020 14:55:34 -0700
Subject: [PATCH 056/265] Fix link

---
 .../v2.x/en/installation/k8s-install/create-nodes-lb/_index.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
index 0dfb09491d2..b1594b5a11b 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
@@ -92,7 +92,7 @@ The etcd database requires an odd number of nodes so that it can always elect a
 
 Make sure that your nodes fulfill the general installation requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
 
-For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/ec2-node) for setting up nodes as instances in Amazon EC2.
+For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node/) for setting up nodes as instances in Amazon EC2.
 
 ### 2. Set up the Load Balancer
 

From 474e1a6b426618d6f90e9373a576e64dbeaa8b76 Mon Sep 17 00:00:00 2001
From: George Wilson <georgejameswilson@googlemail.com>
Date: Tue, 28 Apr 2020 18:38:46 +0100
Subject: [PATCH 057/265] Remove sample code related to helm v2

---
 .../air-gap/install-rancher/_index.md                        | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index 436e221defd..7a3ed675f79 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -29,10 +29,7 @@ This section describes installing Rancher in five parts:
 
 From a system that has access to the internet, fetch the latest Helm chart and copy the resulting manifests to a system that has access to the Rancher server cluster.
 
-1. If you haven't already, initialize `helm` locally on a workstation that has internet access. Note: Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-    ```plain
-    helm init -c
-    ```
+1. If you haven't already, install `helm` locally on a workstation that has internet access. Note: Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
 
 2. Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
   {{< release-channel >}}

From ed3a69b2013c07e756856c5b76824a725f343719 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 28 Apr 2020 11:36:37 -0700
Subject: [PATCH 058/265] Simplify example for skipping CIS scan tests

---
 .../v2.x/en/security/security-scan/_index.md     | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/content/rancher/v2.x/en/security/security-scan/_index.md b/content/rancher/v2.x/en/security/security-scan/_index.md
index 7ff5cb3bd20..7a889e87090 100644
--- a/content/rancher/v2.x/en/security/security-scan/_index.md
+++ b/content/rancher/v2.x/en/security/security-scan/_index.md
@@ -187,17 +187,13 @@ To skip tests by editing a ConfigMap resource,
 
 1. Create a `security-scan` namespace.
 1. Create a ConfigMap named `security-scan-cfg`.
-1. Enter the skip information under the key `config.json` in the following format. The CIS benchmark version is specified alongside the tests to be skipped for that version:
+1. Enter the skip information under the key `config.json` in the following format:
 
-```json
-{
-    "config.json": {
-        "skip": {
-            "rke-cis-1.4": [ "1.1.1", "1.2.2"]
-        }
-    }
-}
-```
+    ```
+    {"skip": {"rke-cis-1.4": [ "1.1.1", "1.2.2"]}}
+    ```
+    
+    In the example above, the CIS benchmark version is specified alongside the tests to be skipped for that version.
 
 **Result:** These tests will be skipped on subsequent scans that use the defined CIS Benchmark version.
 

From 191c21de3a6bb9d51f69c81741d56708d4b823d9 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 28 Apr 2020 15:53:06 -0700
Subject: [PATCH 059/265] Fix formatting of JSON snippet

---
 .../rancher/v2.x/en/security/security-scan/_index.md  | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/security/security-scan/_index.md b/content/rancher/v2.x/en/security/security-scan/_index.md
index 7a889e87090..3782ebb6a3e 100644
--- a/content/rancher/v2.x/en/security/security-scan/_index.md
+++ b/content/rancher/v2.x/en/security/security-scan/_index.md
@@ -189,8 +189,15 @@ To skip tests by editing a ConfigMap resource,
 1. Create a ConfigMap named `security-scan-cfg`.
 1. Enter the skip information under the key `config.json` in the following format:
 
-    ```
-    {"skip": {"rke-cis-1.4": [ "1.1.1", "1.2.2"]}}
+    ```json
+    {
+      "skip": {
+        "rke-cis-1.4": [ 
+          "1.1.1", 
+          "1.2.2"
+        ]
+      }
+    }
     ```
     
     In the example above, the CIS benchmark version is specified alongside the tests to be skipped for that version.

From a32c091109cca73b29754ff456617496f073345a Mon Sep 17 00:00:00 2001
From: Caleb Bron <caleb@rancher.com>
Date: Wed, 29 Apr 2020 16:28:59 -0700
Subject: [PATCH 060/265] Change ASG min/max to just desired

---
 .../hosted-kubernetes-clusters/eks/_index.md                   | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index e93fef1472a..a1b30ba2aef 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -128,8 +128,7 @@ If you chose this option, you must also choose a **VPC & Subnet** that allow you
     -------|------------
     Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning.
     Custom AMI Override | If you want to use a custom [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html#creating-an-ami) (AMI), specify it here. By default, Rancher will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the EKS version that you chose.
-    Minimum ASG Size | The minimum number of instances that your cluster will scale to during low traffic, as controlled by [Amazon Auto Scaling](https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.html).
-    Maximum ASG Size | The maximum number of instances that your cluster will scale to during high traffic, as controlled by [Amazon Auto Scaling](https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.html).
+    Desired ASG Size | The number of instances that your cluster will provision.
     User Data | Custom commands can to be passed to perform automated configuration tasks **WARNING: Modifying this may cause your nodes to be unable to join the cluster.** _Note: Available as of v2.2.0_
 
 1. Click **Create**.

From 52070d77e8f627d9c526d58d849957770c66bcce Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 30 Apr 2020 07:28:22 +0000
Subject: [PATCH 061/265] Bump jquery from 3.4.0 to 3.5.0

Bumps [jquery](https://github.com/jquery/jquery) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/jquery/jquery/releases)
- [Commits](https://github.com/jquery/jquery/compare/3.4.0...3.5.0)

Signed-off-by: dependabot[bot] <support@github.com>
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 8ee8cc9821e..adc998cd0f0 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,7 @@
     "atomic-algolia": "^0.3.15",
     "instantsearch.js": "^2.8.0",
     "izimodal": "^1.5.1",
-    "jquery": "^3.4.0",
+    "jquery": "^3.5.0",
     "jsdom": "^11.11.0",
     "lory.js": "^2.4.1",
     "md5": "^2.2.1",
diff --git a/yarn.lock b/yarn.lock
index e0a4ab425b0..613a9b1814d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1873,10 +1873,10 @@ izimodal@^1.5.1:
   dependencies:
     jquery "~2"
 
-jquery@^3.4.0:
-  version "3.4.0"
-  resolved "https://registry.yarnpkg.com/jquery/-/jquery-3.4.0.tgz#8de513fa0fa4b2c7d2e48a530e26f0596936efdf"
-  integrity sha512-ggRCXln9zEqv6OqAGXFEcshF5dSBvCkzj6Gm2gzuR5fWawaX8t7cxKVkkygKODrDAzKdoYw3l/e3pm3vlT4IbQ==
+jquery@^3.5.0:
+  version "3.5.0"
+  resolved "https://registry.yarnpkg.com/jquery/-/jquery-3.5.0.tgz#9980b97d9e4194611c36530e7dc46a58d7340fc9"
+  integrity sha512-Xb7SVYMvygPxbFMpTFQiHh1J7HClEaThguL15N/Gg37Lri/qKyhRGZYzHRyLH8Stq3Aow0LsHO2O2ci86fCrNQ==
 
 jquery@~2:
   version "2.2.4"

From 6ec5fcec31140634da3e5ca5b95c27a413a0594e Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 30 Apr 2020 15:47:21 -0700
Subject: [PATCH 062/265] Fix link to custom cluster page

---
 .../rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md  | 2 +-
 .../rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md    | 2 +-
 .../rke-clusters/cloud-providers/amazon/_index.md             | 2 +-
 .../cluster-provisioning/rke-clusters/custom-nodes/_index.md  | 1 +
 .../rke-clusters/custom-nodes/agent-options/_index.md         | 2 +-
 .../rke-clusters/windows-clusters/_index.md                   | 4 ++--
 .../windows-clusters/docs-for-2.1-and-2.2/_index.md           | 2 +-
 .../en/k8s-in-rancher/workloads/deploy-workloads/_index.md    | 2 +-
 8 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
index 4ac4b1989f8..10962edea62 100644
--- a/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/cloning-clusters/_index.md
@@ -13,7 +13,7 @@ Duplication of imported clusters is not supported.
 |----------------------------------|---------------|
 | [Nodes Hosted by Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) | ✓ |
 | [Hosted Kubernetes Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | ✓    |
-| [Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/)              | ✓              |
+| [Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes)              | ✓              |
 | [Imported Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)            |               |
 
 > **Warning:** During the process of duplicating a cluster, you will edit a config file full of cluster settings. However, we recommend editing only values explicitly listed in this document, as cluster duplication is designed for simple cluster copying, _not_ wide scale configuration changes. Editing other values may invalidate the config file, which will lead to cluster deployment failure.
diff --git a/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md b/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md
index 44f802fffc3..da6bcacc337 100644
--- a/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md
@@ -106,7 +106,7 @@ If the group of etcd nodes loses quorum, the Kubernetes cluster will report a fa
 
 5. Run the revised command.
 
-6. After the single nodes is up and running, Rancher recommends adding additional etcd nodes to your cluster. If you have a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/) and you want to reuse an old node, you are required to [clean up the nodes]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) before attempting to add them back into a cluster.  
+6. After the single nodes is up and running, Rancher recommends adding additional etcd nodes to your cluster. If you have a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) and you want to reuse an old node, you are required to [clean up the nodes]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) before attempting to add them back into a cluster.  
 
 # Enabling Snapshot Features for Clusters Created Before Rancher v2.2.0
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md
index 169fbc92a7a..5a6fc9f45fb 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/_index.md
@@ -24,7 +24,7 @@ All nodes added to the cluster must be able to interact with EC2 so that they ca
 
 While creating an [Amazon EC2 cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/#create-the-amazon-ec2-cluster), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**.
 
-While creating a [Custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/), you must manually attach the IAM role to the instance(s).
+While creating a [Custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes), you must manually attach the IAM role to the instance(s).
 
 IAM Policy for nodes with the `controlplane` role:
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md
index c964b58e162..11916f44ce4 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md
@@ -5,6 +5,7 @@ metaDescription: "To create a cluster with custom nodes, you’ll need to access
 weight: 2225
 aliases:
   - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-custom/
+ - /rancher/v2.x/en/cluster-provisioning/custom-clusters/
 ---
 
 When you create a custom cluster, Rancher uses RKE (the Rancher Kubernetes Engine) to create a Kubernetes cluster in on-premise bare-metal servers, on-premise virtual machines, or in any node hosted by an infrastructure provider.
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
index 241369bc24d..efcae9b4997 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/_index.md
@@ -6,7 +6,7 @@ aliases:
   - /rancher/v2.x/en/cluster-provisioning/custom-clusters/agent-options
 ---
 
-Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/) and add the options to the generated `docker run` command when adding a node.
+Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) and add the options to the generated `docker run` command when adding a node.
 
 For an overview of how Rancher communicates with downstream clusters using node agents, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#3-node-agents)
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md
index 17aeed8c00b..62b280d5f4c 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/_index.md
@@ -5,7 +5,7 @@ weight: 2240
 
 _Available as of v2.3.0_
 
-When provisioning a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/) using Rancher, Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes custom cluster on your existing infrastructure.
+When provisioning a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) using Rancher, Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes custom cluster on your existing infrastructure.
 
 You can use a mix of Linux and Windows hosts as your cluster nodes. Windows nodes can only be used for deploying workloads, while Linux nodes are required for cluster management.
 
@@ -101,7 +101,7 @@ If you are using the GCE (Google Compute Engine) cloud provider, you must do the
 
 This tutorial describes how to create a Rancher-provisioned cluster with the three nodes in the [recommended architecture.](#guide-architecture)
 
-When you provision a custom cluster with Rancher, you will add nodes to the cluster by installing the [Rancher agent]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/agent-options/) on each one. When you create or edit your cluster from the Rancher UI, you will see a **Customize Node Run Command** that you can run on each server to add it to your custom cluster.
+When you provision a custom cluster with Rancher, you will add nodes to the cluster by installing the [Rancher agent]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/) on each one. When you create or edit your cluster from the Rancher UI, you will see a **Customize Node Run Command** that you can run on each server to add it to your custom cluster.
 
 To set up a custom cluster with support for Windows nodes and containers, you will need to complete the tasks below.
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
index 988427179b4..8cc045883ff 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
@@ -7,7 +7,7 @@ _Available from v2.1.0 to v2.1.9 and v2.2.0 to v2.2.3_
 
 This section describes how to provision Windows clusters in Rancher v2.1.x and v2.2.x. If you are using Rancher v2.3.0 or later, please refer to the new documentation for [v2.3.0 or later]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/).
 
-When you create a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/), Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes cluster on your existing infrastructure.
+When you create a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes), Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes cluster on your existing infrastructure.
 
 You can provision a custom Windows cluster using Rancher by using a mix of Linux and Windows hosts as your cluster nodes.
 
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/_index.md
index b899d310fe6..d6f10728fd6 100644
--- a/content/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/_index.md
+++ b/content/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/_index.md
@@ -44,7 +44,7 @@ Deploy a workload to run an application in one or more containers.
         >
         >- In [Amazon AWS](https://aws.amazon.com/), the nodes must be in the same Availability Zone and possess IAM permissions to attach/unattach volumes.
         >
-        >- The cluster must be using the [AWS cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws) option. For more information on enabling this option see [Creating an Amazon EC2 Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) or [Creating a Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/custom-clusters/).
+        >- The cluster must be using the [AWS cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws) option. For more information on enabling this option see [Creating an Amazon EC2 Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) or [Creating a Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes).
 
 
 1. Click **Show Advanced Options** and configure:

From e6a4611d3923e84b1d009020cc1ade88dd9dd81c Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 1 May 2020 11:27:25 -0700
Subject: [PATCH 063/265] Fix link to OpenLDAP config reference

---
 .../v2.x/en/admin-settings/authentication/openldap/_index.md    | 2 +-
 .../en/cluster-provisioning/rke-clusters/custom-nodes/_index.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md
index 401d0259229..4ddb01fb8fa 100644
--- a/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/authentication/openldap/_index.md
@@ -19,7 +19,7 @@ Rancher must be configured with a LDAP bind account (aka service account) to sea
 
 ## Configure OpenLDAP in Rancher
 
-Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.](../openldap-config)
+Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.](./openldap-config)
 
 > Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md
index 11916f44ce4..9d28b9b3378 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/_index.md
@@ -5,7 +5,7 @@ metaDescription: "To create a cluster with custom nodes, you’ll need to access
 weight: 2225
 aliases:
   - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-custom/
- - /rancher/v2.x/en/cluster-provisioning/custom-clusters/
+  - /rancher/v2.x/en/cluster-provisioning/custom-clusters/
 ---
 
 When you create a custom cluster, Rancher uses RKE (the Rancher Kubernetes Engine) to create a Kubernetes cluster in on-premise bare-metal servers, on-premise virtual machines, or in any node hosted by an infrastructure provider.

From d438951b297b4a80bd0a8a8839ae0ab5cac5b664 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 1 May 2020 13:31:16 -0700
Subject: [PATCH 064/265] Add separate examples for Rancher Helm install with
 privateCA

---
 .../k8s-install/helm-rancher/_index.md          | 11 ++++++++++-
 .../air-gap-helm2/install-rancher/_index.md     | 17 +++++++++++++++--
 .../options/helm2/helm-rancher/_index.md        | 12 +++++++++++-
 .../air-gap/install-rancher/_index.md           | 16 ++++++++++++++--
 .../v2.x/en/upgrades/upgrades/ha/_index.md      | 14 +++++++++++++-
 .../en/upgrades/upgrades/ha/helm2/_index.md     | 14 +++++++++++++-
 6 files changed, 76 insertions(+), 8 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
index c9cf20af14c..bf17fc84814 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
@@ -200,7 +200,6 @@ Although an entry in the `Subject Alternative Names` is technically required, ha
 
 - Set the `hostname`.
 - Set `ingress.tls.source` to `secret`.
-- If you are using a Private CA signed certificate , add `--set privateCA=true` to the command shown below.
 - If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
 
 ```
@@ -210,6 +209,16 @@ helm install rancher rancher-<CHART_REPO>/rancher \
   --set ingress.tls.source=secret
 ```
 
+If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
+
+```
+helm install rancher rancher-latest/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=secret \
+  --set privateCA=true
+```
+
 Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the Ingress controller can use them.
 {{% /tab %}}
 {{% /tabs %}}
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
index ccce961fac3..37fb1ddbc72 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
@@ -132,13 +132,12 @@ Create Kubernetes secrets from your own certificates for Rancher to use. The com
 
 Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
 
-If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`.
-
 | Placeholder                      | Description                                     |
 | -------------------------------- | ----------------------------------------------- |
 | `<VERSION>`                      | The version number of the output tarball.       |
 | `<RANCHER.YOURDOMAIN.COM>`       | The DNS name you pointed at your load balancer. |
 | `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.         |
+
 ```plain
    helm template ./rancher-<VERSION>.tgz --output-dir . \
     --name rancher \
@@ -150,6 +149,20 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following
     --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
 ```
 
+If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
+
+```plain
+   helm template ./rancher-<VERSION>.tgz --output-dir . \
+    --name rancher \
+    --namespace cattle-system \
+    --set hostname=<RANCHER.YOURDOMAIN.COM> \
+    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+    --set ingress.tls.source=secret \
+    --set privateCA=true \
+    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
 Then refer to [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
 
 {{% /accordion %}}
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
index 8b88fff925a..4f81e3e03e9 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
@@ -156,7 +156,6 @@ Create Kubernetes secrets from your own certificates for Rancher to use.
 > **Note:** The `Common Name` or a `Subject Alternative Names` entry in the server certificate must match the `hostname` option, or the ingress controller will fail to configure correctly. Although an entry in the `Subject Alternative Names` is technically required, having a matching `Common Name` maximizes compatibility with older browsers/applications. If you want to check if your certificates are correct, see [How do I check Common Name and Subject Alternative Names in my server certificate?]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-do-i-check-common-name-and-subject-alternative-names-in-my-server-certificate)
 
 - Set `hostname` and set `ingress.tls.source` to `secret`.
-- If you are using a Private CA signed certificate , add `--set privateCA=true` to the command shown below.
 - If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
 
 ```
@@ -167,6 +166,17 @@ helm install rancher-<CHART_REPO>/rancher \
   --set ingress.tls.source=secret
 ```
 
+If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
+
+```
+helm install rancher-<CHART_REPO>/rancher \
+  --name rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=secret
+  --set privateCA=true
+```
+
 Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
 
 After adding the secrets, check if Rancher was rolled out successfully:
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index 7a3ed675f79..e445d7fa9f6 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -131,13 +131,12 @@ Create Kubernetes secrets from your own certificates for Rancher to use. The com
 
 Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
 
-If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`.
-
 | Placeholder                      | Description                                     |
 | -------------------------------- | ----------------------------------------------- |
 | `<VERSION>`                      | The version number of the output tarball.       |
 | `<RANCHER.YOURDOMAIN.COM>`       | The DNS name you pointed at your load balancer. |
 | `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.         |
+
 ```plain
    helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
     --namespace cattle-system \
@@ -148,6 +147,19 @@ If you are using a Private CA signed cert, add `--set privateCA=true` following
     --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
 ```
 
+If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
+
+```plain
+   helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
+    --namespace cattle-system \
+    --set hostname=<RANCHER.YOURDOMAIN.COM> \
+    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+    --set ingress.tls.source=secret \
+    --set privateCA=true \
+    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
 **Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.3.6`
 
 Then refer to [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
index 6b57e500f0a..cd17c75caa3 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
@@ -158,7 +158,18 @@ helm template ./rancher-<VERSION>.tgz --output-dir . \
 {{% /accordion %}}
 {{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
 
->**Note:** If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`.
+```plain
+helm template ./rancher-<VERSION>.tgz --output-dir . \
+--name rancher \
+--namespace cattle-system \
+--set hostname=<RANCHER.YOURDOMAIN.COM> \
+--set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+--set ingress.tls.source=secret \
+--set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+--set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
 
 ```plain
 helm template ./rancher-<VERSION>.tgz --output-dir . \
@@ -167,6 +178,7 @@ helm template ./rancher-<VERSION>.tgz --output-dir . \
 --set hostname=<RANCHER.YOURDOMAIN.COM> \
 --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
 --set ingress.tls.source=secret \
+--set privateCA=true \
 --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
 --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
 ```
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
index da4d7ba5cd6..59bacf23036 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
@@ -160,7 +160,18 @@ helm template ./rancher-<VERSION>.tgz --output-dir . \
 {{% /accordion %}}
 {{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
 
->**Note:** If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`.
+```plain
+helm template ./rancher-<VERSION>.tgz --output-dir . \
+--name rancher \
+--namespace cattle-system \
+--set hostname=<RANCHER.YOURDOMAIN.COM> \
+--set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+--set ingress.tls.source=secret \
+--set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+--set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
 
 ```plain
 helm template ./rancher-<VERSION>.tgz --output-dir . \
@@ -169,6 +180,7 @@ helm template ./rancher-<VERSION>.tgz --output-dir . \
 --set hostname=<RANCHER.YOURDOMAIN.COM> \
 --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
 --set ingress.tls.source=secret \
+--set privateCA=true \
 --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
 --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
 ```

From 372a514fbae65205a90863b55f01a99399f03049 Mon Sep 17 00:00:00 2001
From: Ryan Elliott-Smith <49007005+ryanelliottsmith@users.noreply.github.com>
Date: Sun, 3 May 2020 11:08:53 +1200
Subject: [PATCH 065/265] Update Okta authentication docs

---
 .../en/admin-settings/authentication/okta/_index.md | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/content/rancher/v2.x/en/admin-settings/authentication/okta/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/okta/_index.md
index 517cd8f6975..7bd3c928b8a 100644
--- a/content/rancher/v2.x/en/admin-settings/authentication/okta/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/authentication/okta/_index.md
@@ -24,16 +24,16 @@ Setting | Value
 
 1.	Select **Okta**.
 
-1.	Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes to fields within Rancher.
+1.	Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes from attribute statements to fields within Rancher.
 
     | Field                     | Description                                                                   |
     | ------------------------- | ----------------------------------------------------------------------------- |
-    | Display Name Field        | The attribute that contains the display name of users.                    |
-    | User Name Field           | The attribute that contains the user name/given name.                     |
-    | UID Field                 | An attribute that is unique to every user.                 |
-    | Groups Field              | Make entries for managing group memberships.                                 |
+    | Display Name Field        | The attribute name from an attribute statement that contains the display name of users.                        |
+    | User Name Field           | The attribute name from an attribute statement that contains the user name/given name.                         |
+    | UID Field                 | The attribute name from an attribute statement that is unique to every user.                                    |
+    | Groups Field              | The attribute name in a group attribute statement that exposes your groups.        |
     | Rancher API Host          | The URL for your Rancher Server.                                              |
-    | Private Key / Certificate | A key/certificate pair to create a secure shell between Rancher and your IdP. |
+    | Private Key / Certificate | A key/certificate pair used for Assertion Encryption.                         |
     | Metadata XML              | The `Identity Provider metadata` file that you find in the application `Sign On` section.  |
 
     >**Tip:** You can generate a key/certificate pair using an openssl command. For example:
@@ -41,6 +41,7 @@ Setting | Value
     >        openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.crt
 
 
+
 1. After you complete the **Configure Okta Account** form, click **Authenticate with Okta**, which is at the bottom of the page.
 
     Rancher redirects you to the IdP login page. Enter credentials that authenticate with Okta IdP to validate your Rancher Okta configuration.

From 451522664f3d9cc55c485fb16532cd449f026aa9 Mon Sep 17 00:00:00 2001
From: Ryan Elliott-Smith <49007005+ryanelliottsmith@users.noreply.github.com>
Date: Mon, 4 May 2020 12:33:11 +1200
Subject: [PATCH 066/265] Update doc for cert-manager v0.12

---
 .../helm-2-instructions/_index.md                 | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
index fc999325d1b..bb3e77d418c 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
@@ -55,13 +55,7 @@ In order to upgrade cert-manager, follow these instructions:
 1. Install the CustomResourceDefinition resources separately
 
     ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml
-    ```
-
-1. Label the kube-system namespace to disable resource validation
-
-    ```plain
-    kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true
+    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
     ```
 
 1. Add the Jetstack Helm repository
@@ -116,7 +110,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
 1. Download the required CRD file for cert-manager
 
     ```plain
-    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml
+    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
     ```
 
 ### Install cert-manager
@@ -139,11 +133,6 @@ Before you can perform the upgrade, you must prepare your air gapped environment
     kubectl apply -f cert-manager/cert-manager-crd.yaml
     ```
 
-1. Label the kube-system namespace to disable resource validation
-
-    ```plain
-    kubectl label namespace kube-system certmanager.k8s.io/disable-validation=true
-    ```
 
 1. Install cert-manager
 

From ab5b953130f5fd00717c70cf2e8068f3592c8268 Mon Sep 17 00:00:00 2001
From: David Nuzik <david.nuzik@rancher.com>
Date: Mon, 4 May 2020 13:53:12 -0700
Subject: [PATCH 067/265] Update install-options to include channel options -
 Updates to include these channel server options - Updates to add in
 INSTALL_K3S_SKIP_ENABLE env var

---
 .../k3s/latest/en/installation/install-options/_index.md   | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/content/k3s/latest/en/installation/install-options/_index.md b/content/k3s/latest/en/installation/install-options/_index.md
index df7ae330dca..b34773c4718 100644
--- a/content/k3s/latest/en/installation/install-options/_index.md
+++ b/content/k3s/latest/en/installation/install-options/_index.md
@@ -29,14 +29,17 @@ When using this method to install K3s, the following environment variables can b
 |-----------------------------|---------------------------------------------|
 | `INSTALL_K3S_SKIP_DOWNLOAD` | If set to true will not download K3s hash or binary. |
 | `INSTALL_K3S_SYMLINK` | By default will create symlinks for the kubectl, crictl, and ctr binaries if the commands do not already exist in path. If set to 'skip' will not create symlinks and 'force' will overwrite. |
+| `INSTALL_K3S_SKIP_ENABLE` | If set to true will not enable or start K3s service. |
 | `INSTALL_K3S_SKIP_START` | If set to true will not start K3s service. |
-| `INSTALL_K3S_VERSION` | Version of K3s to download from Github. Will attempt to download the latest version if not specified. |
+| `INSTALL_K3S_VERSION` | Version of K3s to download from Github. Will attempt to download from the stable channel if not specified. |
 | `INSTALL_K3S_BIN_DIR` | Directory to install K3s binary, links, and uninstall script to, or use `/usr/local/bin` as the default. |
 | `INSTALL_K3S_BIN_DIR_READ_ONLY` | If set to true will not write files to `INSTALL_K3S_BIN_DIR`, forces setting `INSTALL_K3S_SKIP_DOWNLOAD=true`. |
 | `INSTALL_K3S_SYSTEMD_DIR` | Directory to install systemd service and environment files to, or use `/etc/systemd/system` as the default. |
 | `INSTALL_K3S_EXEC` | Command with flags to use for launching K3s in the service. If the command is not specified, and the `K3S_URL` is set, it will default to "agent." If `K3S_URL` not set, it will default to "server." For help, refer to [this example.]({{<baseurl>}}/k3s/latest/en/installation/install-options/how-to-flags/#example-b-install-k3s-exec) |
 | `INSTALL_K3S_NAME` | Name of systemd service to create, will default to 'k3s' if running k3s as a server and 'k3s-agent' if running k3s as an agent. If specified the name will be prefixed with 'k3s-'. |
 | `INSTALL_K3S_TYPE` | Type of systemd service to create, will default from the K3s exec command if not specified.
+| `INSTALL_K3S_CHANNEL_URL` | Channel URL for fetching K3s download URL. Defaults to https://update.k3s.io/v1-release/channels.
+| `INSTALL_K3S_CHANNEL` | Channel to use for fetching K3s download URL. Defaults to "stable". Options include: `stable`, `latest`, `testing`. |
 
 
 Environment variables which begin with `K3S_` will be preserved for the systemd and openrc services to use.
@@ -67,4 +70,4 @@ For details on configuring the K3s server, refer to the [server configuration re
 
 ### Registration Options for the K3s Agent
 
-For details on configuring the K3s agent, refer to the [agent configuration reference.]({{<baseurl>}}/k3s/latest/en/installation/install-options/agent-config)
\ No newline at end of file
+For details on configuring the K3s agent, refer to the [agent configuration reference.]({{<baseurl>}}/k3s/latest/en/installation/install-options/agent-config)

From 1430904d3cffb007e205ddd4ba9c0cb151474f7b Mon Sep 17 00:00:00 2001
From: David Nuzik <david.nuzik@rancher.com>
Date: Mon, 4 May 2020 16:26:18 -0700
Subject: [PATCH 068/265] Update upgrade basics to mention channel server -
 Updates /upgrades/basic so that we now briefly describe what the channel
 server is and how to upgrade with the script

---
 content/k3s/latest/en/upgrades/basic/_index.md | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/upgrades/basic/_index.md b/content/k3s/latest/en/upgrades/basic/_index.md
index d0f1b8654c8..4e621580fa3 100644
--- a/content/k3s/latest/en/upgrades/basic/_index.md
+++ b/content/k3s/latest/en/upgrades/basic/_index.md
@@ -7,6 +7,10 @@ You can upgrade K3s by using the installation script, or by manually installing
 
 >**Note:** When upgrading, upgrade server nodes first one at a time, then any worker nodes.
 
+### About the Channel Server
+
+The [channel server](https://github.com/rancher/channelserver) allows the install script to install or upgrade K3s within specific channels such as `stable` (default), `latest`, or `testing`. For additional channels, see [https://update.k3s.io/v1-release/channels](https://update.k3s.io/v1-release/channels).
+
 ### Upgrade K3s Using the Installation Script
 
 To upgrade K3s from an older version you can re-run the installation script using the same flags, for example:
@@ -14,8 +18,14 @@ To upgrade K3s from an older version you can re-run the installation script usin
 ```sh
 curl -sfL https://get.k3s.io | sh -
 ```
+This will upgrade to a newer version in the stable channel by default.
 
-If you want to upgrade to specific version you can run the following command:
+If you want to upgrade to a newer version in a specific channel (such as latest) you can specify the channel:
+```sh
+curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest sh -
+```
+
+If you want to upgrade to a specific version you can run the following command:
 
 ```sh
 curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Z-rc1 sh -

From 818737b8fccb7043f395ceb1eb41e451fea40885 Mon Sep 17 00:00:00 2001
From: David Nuzik <david.nuzik@rancher.com>
Date: Mon, 4 May 2020 16:46:43 -0700
Subject: [PATCH 069/265] Update automated upgrades to mention channel server
 stable URL - Updates upgrades/automated so that the section that mentions
 channels for the YAML now mentions the channel server stable URL.

---
 content/k3s/latest/en/upgrades/automated/_index.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/k3s/latest/en/upgrades/automated/_index.md b/content/k3s/latest/en/upgrades/automated/_index.md
index 3ac8143052e..20b0e7e054d 100644
--- a/content/k3s/latest/en/upgrades/automated/_index.md
+++ b/content/k3s/latest/en/upgrades/automated/_index.md
@@ -94,14 +94,14 @@ Third, the server-plan targets server nodes by specifying a label selector that
 
 Fourth, the `prepare` step in the agent-plan will cause upgrade jobs for that plan to wait for the server-plan to complete before they execute.
 
-Fifth, both plans have the `version` field set to v1.17.4+k3s1. Alternatively, you can omit the `version` field and set the `channel` field to a URL that resolves to a release of K3s. This will cause the controller to monitor that URL and upgrade the cluster any time it resolves to a new release. This is designed specifically to work with the [latest release functionality of GitHub](https://help.github.com/en/github/administering-a-repository/linking-to-releases). Thus, you can configure your plans with the following channel to ensure your cluster is always automatically upgraded to the latest release of K3s:
+Fifth, both plans have the `version` field set to v1.17.4+k3s1. Alternatively, you can omit the `version` field and set the `channel` field to a URL that resolves to a release of K3s. This will cause the controller to monitor that URL and upgrade the cluster any time it resolves to a new release. This works well with the [channel server](https://github.com/rancher/channelserver). Thus, you can configure your plans with the following channel to ensure your cluster is always automatically upgraded to the newest stable release of K3s:
 ```
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
 ...
 spec:
   ...
-  channel: https://github.com/rancher/k3s/releases/latest
+  channel: https://update.k3s.io/v1-release/channels/stable
 
 ```
 

From 13fab1d35055c5ee338bcc8505e61712159340bf Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Tue, 5 May 2020 12:01:40 +0100
Subject: [PATCH 070/265] Added note of port requirement 9796

---
 .../rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
index 9e9703a2d32..aca8323ea75 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
@@ -47,6 +47,8 @@ Using Prometheus, you can monitor Rancher at both the cluster level and [project
 
 As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to deploy Prometheus to monitor your Kubernetes cluster.
 
+1. Check that you are allowing traffic on Port 9796 for each of your nodes (as prometheus will scrape metrics from here)
+
 1. From the **Global** view, navigate to the cluster that you want to configure cluster monitoring.
 
 1. Select **Tools > Monitoring** in the navigation bar.
@@ -98,4 +100,4 @@ Pod | CPU (milli CPU) | Memory (MB)
 Node Exporter (Per Node) | 100 | 30
 Kube State Cluster Monitor | 100 | 130
 Grafana | 100 | 150
-Prometheus Cluster Monitoring Nginx | 50 | 50
\ No newline at end of file
+Prometheus Cluster Monitoring Nginx | 50 | 50

From 09eb38ed400db31a4865a3aa087a565f5c5a0982 Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Tue, 5 May 2020 12:10:57 +0100
Subject: [PATCH 071/265] Added note for port 9796 for metrics

---
 .../rancher/v2.x/en/installation/requirements/ports/_index.md    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/rancher/v2.x/en/installation/requirements/ports/_index.md b/content/rancher/v2.x/en/installation/requirements/ports/_index.md
index 26278915bf0..c6cb826bb90 100644
--- a/content/rancher/v2.x/en/installation/requirements/ports/_index.md
+++ b/content/rancher/v2.x/en/installation/requirements/ports/_index.md
@@ -144,6 +144,7 @@ These ports are typically opened on your Kubernetes nodes, regardless of what ty
 |    UDP   	|       8472       	| Canal/Flannel VXLAN overlay networking          	|
 |    UDP   	|       4789       	| Flannel VXLAN overlay networking on Windows cluster |
 |    TCP   	|       9099       	| Canal/Flannel livenessProbe/readinessProbe      	|
+|    TCP    |       9796        | Default port required by Monitoring to scrape metrics |
 |    TCP   	|       6783       	| Weave Port      	|
 |    UDP   	|       6783-6784   | Weave UDP Ports      	|
 |    TCP   	|       10250      	| kubelet API                                     	|

From 0221ded64b82d259c2f37bea73647d20593bda2f Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 5 May 2020 13:33:06 -0700
Subject: [PATCH 072/265] Fix outdated information about K3s

---
 content/_index.html                           |  2 +-
 content/k3s/latest/en/_index.md               | 20 +++++++++++++++----
 .../rancher/v2.x/en/installation/_index.md    |  2 +-
 .../k8s-install/kubernetes-rke/_index.md      |  2 +-
 .../air-gap/launch-kubernetes/_index.md       |  2 +-
 .../architecture-recommendations/_index.md    |  4 ++--
 6 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/content/_index.html b/content/_index.html
index ccad7160a18..209d77f70cb 100644
--- a/content/_index.html
+++ b/content/_index.html
@@ -215,7 +215,7 @@
 
                             <hr/>
 
-                            <p class="description-label">Lightweight Kubernetes.  Easy to install, half the memory, all in a binary less than 50mb.</p>
+                            <p class="description-label">Lightweight Kubernetes.  Easy to install, half the memory, all in a binary less than 100 MB.</p>
 
                             <div class="buttons-container">
                               <a href="{{<baseurl>}}/k3s/latest/en/">
diff --git a/content/k3s/latest/en/_index.md b/content/k3s/latest/en/_index.md
index 952027f0c93..a02147dc599 100644
--- a/content/k3s/latest/en/_index.md
+++ b/content/k3s/latest/en/_index.md
@@ -1,29 +1,41 @@
 ---
-title: "K3s - 5 less than K8s"
+title: "K3s - Lightweight Kubernetes"
 shortTitle: K3s
 name: "menu"
 ---
 
-Lightweight Kubernetes. Easy to install, half the memory, all in a binary of less than 50mb.
+Lightweight Kubernetes. Easy to install, half the memory, all in a binary of less than 100 MB.
 
 Great for:
 
 * Edge
 * IoT
 * CI
+* Development
 * ARM
+* Embedding K8s
 * Situations where a PhD in K8s clusterology is infeasible
 
 # What is K3s?
 
 K3s is a fully compliant Kubernetes distribution with the following enhancements:
 
-* An embedded SQLite database has replaced etcd as the default datastore. External datastores such as PostgreSQL, MySQL, and etcd are also supported.
+* Packaged as a single binary.
+* Lightweight storage backend based on sqlite3 as the default storage mechanism. etcd3, MySQL, Postgres also still available.
+* Wrapped in simple launcher that handles a lot of the complexity of TLS and options.
+* Secure by default with reasonable defaults for lightweight environments.
 * Simple but powerful "batteries-included" features have been added, such as: a local storage provider, a service load balancer, a Helm controller, and the Traefik ingress controller.
 * Operation of all Kubernetes control plane components is encapsulated in a single binary and process. This allows K3s to automate and manage complex cluster operations like distributing certificates.
-* In-tree cloud providers and storage plugins have been removed.
 * External dependencies have been minimized (just a modern kernel and cgroup mounts needed). K3s packages required dependencies, including:
     * containerd
     * Flannel
     * CoreDNS
+    * CNI
     * Host utilities (iptables, socat, etc)
+    * Ingress controller (traefik)
+    * Embedded service loadbalancer
+    * Embedded network policy controller
+
+# What's with the name?
+
+We wanted an installation of Kubernetes that was half the size in terms of memory footprint. Kubernetes is a 10-letter word stylized as K8s. So something half as big as Kubernetes would be a 5-letter word stylized as K3s. There is no long form of K3s and no official pronunciation.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md
index eb463283c70..21044984828 100644
--- a/content/rancher/v2.x/en/installation/_index.md
+++ b/content/rancher/v2.x/en/installation/_index.md
@@ -14,7 +14,7 @@ In this section,
 
 - **The Rancher server** manages and provisions Kubernetes clusters. You can interact with downstream Kubernetes clusters through the Rancher server's user interface.
 - **RKE (Rancher Kubernetes Engine)** is a certified Kubernetes distribution and CLI/library which creates and manages a Kubernetes cluster.
-- **K3s (5 less than K8s)** is also a fully compliant Kubernetes distribution. It is newer than RKE, easier to use, and more lightweight, with a binary size of less than 50 MB. As of Rancher v2.4, Rancher can be installed on a K3s cluster.
+- **K3s (Lightweight Kubernetes)** is also a fully compliant Kubernetes distribution. It is newer than RKE, easier to use, and more lightweight, with a binary size of less than 100 MB. As of Rancher v2.4, Rancher can be installed on a K3s cluster.
 
 ### Overview of Installation Options
 
diff --git a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
index 8f62c8450ec..4df06d13cbd 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
@@ -10,7 +10,7 @@ This section describes how to install a Kubernetes cluster according to our [bes
 
 For Rancher prior to v2.4, Rancher should be installed on an RKE Kubernetes cluster. RKE is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers.
 
-As of Rancher v2.4, the Rancher management server can be installed on either an RKE cluster or a K3s Kubernetes cluster. K3s is also a fully certified Kubernetes distribution released by Rancher, but is newer than RKE. We recommend installing Rancher on K3s because K3s is easier to use, and more lightweight, with a binary size of less than 50 MB. Note: After Rancher is installed on an RKE cluster, there is no migration path to a K3s setup at this time.
+As of Rancher v2.4, the Rancher management server can be installed on either an RKE cluster or a K3s Kubernetes cluster. K3s is also a fully certified Kubernetes distribution released by Rancher, but is newer than RKE. We recommend installing Rancher on K3s because K3s is easier to use, and more lightweight, with a binary size of less than 100 MB. Note: After Rancher is installed on an RKE cluster, there is no migration path to a K3s setup at this time.
 
 The Rancher management server can only be run on Kubernetes cluster in an infrastructure provider where Kubernetes is installed using RKE or K3s. Use of Rancher on hosted Kubernetes providers, such as EKS, is not supported.
 
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/_index.md
index cf96f997ea1..ad3e85da78d 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/_index.md
@@ -11,7 +11,7 @@ This section describes how to install a Kubernetes cluster according to our [bes
 
 For Rancher prior to v2.4, Rancher should be installed on an [RKE]({{<baseurl>}}/rke/latest/en/) (Rancher Kubernetes Engine) Kubernetes cluster. RKE is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers.
 
-As of Rancher v2.4, the Rancher management server can be installed on either an RKE cluster or a K3s Kubernetes cluster. K3s is also a fully certified Kubernetes distribution released by Rancher, but is newer than RKE. We recommend installing Rancher on K3s because K3s is easier to use, and more lightweight, with a binary size of less than 50 MB. Note: After Rancher is installed on an RKE cluster, there is no migration path to a K3s setup at this time.
+As of Rancher v2.4, the Rancher management server can be installed on either an RKE cluster or a K3s Kubernetes cluster. K3s is also a fully certified Kubernetes distribution released by Rancher, but is newer than RKE. We recommend installing Rancher on K3s because K3s is easier to use, and more lightweight, with a binary size of less than 100 MB. Note: After Rancher is installed on an RKE cluster, there is no migration path to a K3s setup at this time.
 
 The Rancher management server can only be run on Kubernetes cluster in an infrastructure provider where Kubernetes is installed using RKE or K3s. Use of Rancher on hosted Kubernetes providers, such as EKS, is not supported.
 
diff --git a/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md b/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md
index f7bf7597106..fd381be31e5 100644
--- a/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md
+++ b/content/rancher/v2.x/en/overview/architecture-recommendations/_index.md
@@ -30,13 +30,13 @@ We recommend installing the Rancher server on a high-availability Kubernetes clu
 
 We don't recommend installing Rancher in a single Docker container, because if the node goes down, there is no copy of the cluster data available on other nodes and you could lose the data on your Rancher server.
 
-Rancher needs to be installed on either a high-availability [RKE (Rancher Kubernetes Engine)]({{<baseurl>}}/rke/latest/en/) Kubernetes cluster, or a high-availability [K3s (5 less than K8s)]({{<baseurl>}}/k3s/latest/en/) Kubernetes cluster. Both RKE and K3s are fully certified Kubernetes distributions.
+Rancher needs to be installed on either a high-availability [RKE (Rancher Kubernetes Engine)]({{<baseurl>}}/rke/latest/en/) Kubernetes cluster, or a high-availability [K3s (Lightweight Kubernetes)]({{<baseurl>}}/k3s/latest/en/) Kubernetes cluster. Both RKE and K3s are fully certified Kubernetes distributions.
 
 ### K3s Kubernetes Cluster Installations
 
 If you are installing Rancher v2.4 for the first time, we recommend installing it on a K3s Kubernetes cluster. One main advantage of this K3s architecture is that it allows an external datastore to hold the cluster data, allowing the K3s server nodes to be treated as ephemeral.
 
-The option to install Rancher on a K3s cluster is a feature introduced in Rancher v2.4. K3s is easy to install, with half the memory of Kubernetes, all in a binary less than 50 MB.
+The option to install Rancher on a K3s cluster is a feature introduced in Rancher v2.4. K3s is easy to install, with half the memory of Kubernetes, all in a binary less than 100 MB.
 
 <figcaption>Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server</figcaption>
 ![Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server]({{<baseurl>}}/img/rancher/k3s-server-storage.svg)

From 22aa4b50ea43209cdc0f425b8fb5a66a2b8003e1 Mon Sep 17 00:00:00 2001
From: David Nuzik <david.nuzik@rancher.com>
Date: Tue, 5 May 2020 18:33:17 -0700
Subject: [PATCH 073/265] Modify About Channel Server section > Release
 Channels - Addresses Craig's comment outlined here
 https://github.com/rancher/docs/pull/2488/files#r420489320 - This tweaks the
 /upgrades/basic and /upgrades/automate pages. The basic page now goes into
 more depth about the release channels -- outlining specific examples. The
 automated page now calls out a link directly to this section on the /basic
 page instead of linking to the channelserver github project. - I called out
 in the "v1.18" example that this selects the LATEST in the specific minor
 release. This does not select stable (I don't want people to confuse that
 with a stable channel). - Minor spelling fix

---
 content/k3s/latest/en/upgrades/automated/_index.md |  2 +-
 content/k3s/latest/en/upgrades/basic/_index.md     | 14 +++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/content/k3s/latest/en/upgrades/automated/_index.md b/content/k3s/latest/en/upgrades/automated/_index.md
index 20b0e7e054d..b5951bd3684 100644
--- a/content/k3s/latest/en/upgrades/automated/_index.md
+++ b/content/k3s/latest/en/upgrades/automated/_index.md
@@ -94,7 +94,7 @@ Third, the server-plan targets server nodes by specifying a label selector that
 
 Fourth, the `prepare` step in the agent-plan will cause upgrade jobs for that plan to wait for the server-plan to complete before they execute.
 
-Fifth, both plans have the `version` field set to v1.17.4+k3s1. Alternatively, you can omit the `version` field and set the `channel` field to a URL that resolves to a release of K3s. This will cause the controller to monitor that URL and upgrade the cluster any time it resolves to a new release. This works well with the [channel server](https://github.com/rancher/channelserver). Thus, you can configure your plans with the following channel to ensure your cluster is always automatically upgraded to the newest stable release of K3s:
+Fifth, both plans have the `version` field set to v1.17.4+k3s1. Alternatively, you can omit the `version` field and set the `channel` field to a URL that resolves to a release of K3s. This will cause the controller to monitor that URL and upgrade the cluster any time it resolves to a new release. This works well with the [release channels]({{< baseurl >}}/k3s/latest/en/upgrades/basic/#release-channels). Thus, you can configure your plans with the following channel to ensure your cluster is always automatically upgraded to the newest stable release of K3s:
 ```
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
diff --git a/content/k3s/latest/en/upgrades/basic/_index.md b/content/k3s/latest/en/upgrades/basic/_index.md
index 4e621580fa3..d4f1fb8ebde 100644
--- a/content/k3s/latest/en/upgrades/basic/_index.md
+++ b/content/k3s/latest/en/upgrades/basic/_index.md
@@ -7,9 +7,17 @@ You can upgrade K3s by using the installation script, or by manually installing
 
 >**Note:** When upgrading, upgrade server nodes first one at a time, then any worker nodes.
 
-### About the Channel Server
+### Release Channels
 
-The [channel server](https://github.com/rancher/channelserver) allows the install script to install or upgrade K3s within specific channels such as `stable` (default), `latest`, or `testing`. For additional channels, see [https://update.k3s.io/v1-release/channels](https://update.k3s.io/v1-release/channels).
+Upgrades performed via the installation script or using our [automated upgrades]({{< baseurl >}}/k3s/latest/en/upgrades/automated/) feature can be tied to different release channels. The following channels are available:
+
+| Channel |   Description  |
+|---------------|---------|
+|      stable     | (Default) Stable is recommended for production environments. These releases have been through a period of community hardening. |
+|      latest      | Latest is recommended for trying out the latest features.  These releases have not yet been through a period of community hardening. |
+|      v1.18 (example)      | There is a release channel tied to each supported Kubernetes minor version. At the time of this writing, they are `v1.18`, `v1.17`, and `v1.16`. These channels will select the latest patch available, not necessarily a stable release. |
+
+For an exhaustive and up-to-date list of channels, you can visit the [k3s channel service API](https://update.k3s.io/v1-release/channels). For more technical details on how channels work, you see the [channelserver project](https://github.com/rancher/channelserver).
 
 ### Upgrade K3s Using the Installation Script
 
@@ -63,7 +71,7 @@ To restart servers manually:
 sudo service k3s restart
 ```
 
-To restart agents mantually:
+To restart agents manually:
 ```sh
 sudo service k3s-agent restart
 ```

From 299349d846cc1e6f2db067375eb83c0ca92fe806 Mon Sep 17 00:00:00 2001
From: Valentin Mihov <valentin.mihov@gmail.com>
Date: Wed, 6 May 2020 22:24:16 +0300
Subject: [PATCH 074/265] Fix a leftover from a merge conflict in the docs

Seems like there was an unresolved merge conflict, which was left in the docs.
---
 content/os/v1.x/en/storage/additional-mounts/_index.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/content/os/v1.x/en/storage/additional-mounts/_index.md b/content/os/v1.x/en/storage/additional-mounts/_index.md
index a9b39af7f33..cdbd75fa638 100644
--- a/content/os/v1.x/en/storage/additional-mounts/_index.md
+++ b/content/os/v1.x/en/storage/additional-mounts/_index.md
@@ -5,11 +5,7 @@ aliases:
   - /os/v1.x/en/installation/storage/additional-mounts
 ---
 
-<<<<<<< HEAD:content/os/v1.x/en/installation/storage/additional-mounts/_index.md
-Additional mounts can be specified as part of your [cloud-config]({{<baseurl>}}/os/v1.x/en/installation/configuration/#cloud-config). These mounts are applied within the console container. Here's a simple example that mounts `/dev/vdb` to `/mnt/s`.
-=======
 Additional mounts can be specified as part of your [cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/#cloud-config). These mounts are applied within the console container. Here's a simple example that mounts `/dev/vdb` to `/mnt/s`.
->>>>>>> Reorganize RancherOS docs:content/os/v1.x/en/storage/additional-mounts/_index.md
 
 ```yaml
 #cloud-config

From b40ca4ab45071ff908540318e0fdbf4f472689b7 Mon Sep 17 00:00:00 2001
From: David Nuzik <david.nuzik@rancher.com>
Date: Wed, 6 May 2020 18:13:01 -0700
Subject: [PATCH 075/265] Squash - Add node-name to networking docs - Explains
 need for node-name to be set when hostname is null or localhost - Explains
 the reasoning for this - This commit squashes several created in the PR

---
 content/k3s/latest/en/networking/_index.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/content/k3s/latest/en/networking/_index.md b/content/k3s/latest/en/networking/_index.md
index 7bf35ce7c12..77d0eab44fc 100644
--- a/content/k3s/latest/en/networking/_index.md
+++ b/content/k3s/latest/en/networking/_index.md
@@ -35,3 +35,9 @@ Service Load Balancer
 K3s includes a basic service load balancer that uses available host ports. If you try to create a load balancer that listens on port 80, for example, it will try to find a free host in the cluster for port 80. If no port is available, the load balancer will stay in Pending.
 
 To disable the embedded load balancer, run the server with the `--no-deploy servicelb` option. This is necessary if you wish to run a different load balancer, such as MetalLB.
+
+Nodes Without a Hostname
+------------------------
+
+Some cloud providers, such as Linode, will create machines with "localhost" as the hostname and others may not have a hostname set at all. This can cause problems with domain name resolution. You can run K3s with the `--node-name` flag or `K3S_NODE_NAME` environment variable and this will pass the node name to resolve this issue.
+

From ee6db4286c850d5561a0c3cf9694f4b3efe9b6eb Mon Sep 17 00:00:00 2001
From: Eamon Bauman <eamon@eamonbauman.com>
Date: Wed, 6 May 2020 22:22:12 -0500
Subject: [PATCH 076/265] Added minimum EKS permissions

---
 .../hosted-kubernetes-clusters/eks/_index.md  | 140 +++++++++++++++++-
 1 file changed, 139 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index a1b30ba2aef..5bb0f86029f 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -149,4 +149,142 @@ For more information on security and compliance with your Amazon EKS Kubernetes
 
 ## Tutorial
 
-This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/) on the AWS Open Source Blog will walk you through how to set up an EKS cluster with Rancher, deploy a publicly accessible app to test the cluster, and deploy a sample project to track real-time geospatial data using a combination of other open-source software such as Grafana and InfluxDB.
\ No newline at end of file
+This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/) on the AWS Open Source Blog will walk you through how to set up an EKS cluster with Rancher, deploy a publicly accessible app to test the cluster, and deploy a sample project to track real-time geospatial data using a combination of other open-source software such as Grafana and InfluxDB.
+
+## Appendix - Minimum EKS Permissions
+
+Documented here is a minimum set of permissions necessary to use all functionality of the EKS driver in Rancher.
+
+Resource targeting uses `*` as the ARN of many of the resources created cannot be known prior to creating the EKS cluster in Rancher. Some permissions (for example `ec2:CreateVpc`) are only used in situations where Rancher handles the creation of certain resources.
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "EC2Permisssions",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:AuthorizeSecurityGroupIngress",
+                "ec2:DeleteSubnet",
+                "ec2:CreateKeyPair",
+                "ec2:AttachInternetGateway",
+                "ec2:ReplaceRoute",
+                "ec2:DeleteRouteTable",
+                "ec2:AssociateRouteTable",
+                "ec2:DescribeInternetGateways",
+                "ec2:CreateRoute",
+                "ec2:CreateInternetGateway",
+                "ec2:RevokeSecurityGroupEgress",
+                "ec2:DescribeAccountAttributes",
+                "ec2:DeleteInternetGateway",
+                "ec2:DescribeKeyPairs",
+                "ec2:CreateTags",
+                "ec2:CreateRouteTable",
+                "ec2:DescribeRouteTables",
+                "ec2:DetachInternetGateway",
+                "ec2:DisassociateRouteTable",
+                "ec2:RevokeSecurityGroupIngress",
+                "ec2:DeleteVpc",
+                "ec2:CreateSubnet",
+                "ec2:DescribeSubnets",
+                "ec2:DeleteKeyPair",
+                "ec2:DeleteTags",
+                "ec2:CreateVpc",
+                "ec2:DescribeAvailabilityZones",
+                "ec2:CreateSecurityGroup",
+                "ec2:ModifyVpcAttribute",
+                "ec2:AuthorizeSecurityGroupEgress",
+                "ec2:DescribeTags",
+                "ec2:DeleteRoute",
+                "ec2:DescribeSecurityGroups",
+                "ec2:DescribeImages",
+                "ec2:DescribeVpcs",
+                "ec2:DeleteSecurityGroup"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "EKSPermissions",
+            "Effect": "Allow",
+            "Action": [
+                "eks:DeleteFargateProfile",
+                "eks:DescribeFargateProfile",
+                "eks:ListTagsForResource",
+                "eks:UpdateClusterConfig",
+                "eks:DescribeNodegroup",
+                "eks:ListNodegroups",
+                "eks:DeleteCluster",
+                "eks:CreateFargateProfile",
+                "eks:DeleteNodegroup",
+                "eks:UpdateNodegroupConfig",
+                "eks:DescribeCluster",
+                "eks:ListClusters",
+                "eks:UpdateClusterVersion",
+                "eks:UpdateNodegroupVersion",
+                "eks:ListUpdates",
+                "eks:CreateCluster",
+                "eks:UntagResource",
+                "eks:CreateNodegroup",
+                "eks:ListFargateProfiles",
+                "eks:DescribeUpdate",
+                "eks:TagResource"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "IAMPermissions",
+            "Effect": "Allow",
+            "Action": [
+                "iam:ListRoleTags",
+                "iam:RemoveRoleFromInstanceProfile",
+                "iam:CreateRole",
+                "iam:AttachRolePolicy",
+                "iam:AddRoleToInstanceProfile",
+                "iam:DetachRolePolicy",
+                "iam:GetRole",
+                "iam:DeleteRole",
+                "iam:CreateInstanceProfile",
+                "iam:ListInstanceProfilesForRole",
+                "iam:PassRole",
+                "iam:GetInstanceProfile",
+                "iam:ListRoles",
+                "iam:ListInstanceProfiles",
+                "iam:DeleteInstanceProfile"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "CloudFormationPermisssions",
+            "Effect": "Allow",
+            "Action": [
+                "cloudformation:DescribeStackResource",
+                "cloudformation:ListStackResources",
+                "cloudformation:DescribeStackResources",
+                "cloudformation:DescribeStacks",
+                "cloudformation:ListStacks",
+                "cloudformation:CreateStack"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "AutoScalingPermissions",
+            "Effect": "Allow",
+            "Action": [
+                "autoscaling:DescribeAutoScalingGroups",
+                "autoscaling:UpdateAutoScalingGroup",
+                "autoscaling:TerminateInstanceInAutoScalingGroup",
+                "autoscaling:CreateOrUpdateTags",
+                "autoscaling:DeleteAutoScalingGroup",
+                "autoscaling:CreateAutoScalingGroup",
+                "autoscaling:DescribeAutoScalingInstances",
+                "autoscaling:DescribeLaunchConfigurations",
+                "autoscaling:DescribeScalingActivities",
+                "autoscaling:CreateLaunchConfiguration",
+                "autoscaling:DeleteLaunchConfiguration"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+```

From c582c2003221214a294805fadf8ddbbc99d24a33 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 7 May 2020 09:53:30 -0700
Subject: [PATCH 077/265] Update _index.md

---
 .../rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
index aca8323ea75..891dad01baa 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
@@ -47,7 +47,7 @@ Using Prometheus, you can monitor Rancher at both the cluster level and [project
 
 As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to deploy Prometheus to monitor your Kubernetes cluster.
 
-1. Check that you are allowing traffic on Port 9796 for each of your nodes (as prometheus will scrape metrics from here)
+1. Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
 
 1. From the **Global** view, navigate to the cluster that you want to configure cluster monitoring.
 

From 96972051b4b4817e76a60726e25089def0bc23c1 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 7 May 2020 09:54:14 -0700
Subject: [PATCH 078/265] Update _index.md

---
 .../rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
index 891dad01baa..c2618dd8d03 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
@@ -47,7 +47,7 @@ Using Prometheus, you can monitor Rancher at both the cluster level and [project
 
 As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to deploy Prometheus to monitor your Kubernetes cluster.
 
-1. Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
+> **Prerequisite:** Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
 
 1. From the **Global** view, navigate to the cluster that you want to configure cluster monitoring.
 

From 2706d370c19bf4d41b6082e0d76f0e325d834d37 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 7 May 2020 10:33:20 -0700
Subject: [PATCH 079/265] Fix leftovers from merge conflicts

---
 .../en/configuration/airgap-configuration/_index.md    |  4 ----
 .../v1.x/en/configuration/switching-consoles/_index.md | 10 ----------
 .../configuration/switching-docker-versions/_index.md  |  8 --------
 content/os/v1.x/en/installation/cloud/aws/_index.md    |  4 ----
 .../custom-builds/custom-console/_index.md             | 10 ----------
 5 files changed, 36 deletions(-)

diff --git a/content/os/v1.x/en/configuration/airgap-configuration/_index.md b/content/os/v1.x/en/configuration/airgap-configuration/_index.md
index c82fdbb2a9d..8cc05fc4507 100644
--- a/content/os/v1.x/en/configuration/airgap-configuration/_index.md
+++ b/content/os/v1.x/en/configuration/airgap-configuration/_index.md
@@ -86,11 +86,7 @@ $ sudo ros config set rancher.upgrade.url https://foo.bar.com/os/releases.yml
 
 Here is a total cloud-config example for using RancherOS in an air gap environment.
 
-<<<<<<< HEAD:content/os/v1.x/en/installation/configuration/airgap-configuration/_index.md
-For `system-docker`, see [Configuring Private Docker Registry]({{<baseurl>}}/os/v1.x/en/installation/configuration/airgap-configuration/#configuring-private-docker-registry).
-=======
 For `system-docker`, see [Configuring Private Docker Registry]({{< baseurl >}}/os/v1.x/en/configuration/airgap-configuration/#configuring-private-docker-registry).
->>>>>>> Reorganize RancherOS docs:content/os/v1.x/en/configuration/airgap-configuration/_index.md
 
 ```yaml
 #cloud-config
diff --git a/content/os/v1.x/en/configuration/switching-consoles/_index.md b/content/os/v1.x/en/configuration/switching-consoles/_index.md
index e410a194a4e..4668878f6d8 100644
--- a/content/os/v1.x/en/configuration/switching-consoles/_index.md
+++ b/content/os/v1.x/en/configuration/switching-consoles/_index.md
@@ -5,15 +5,6 @@ aliases:
   - /os/v1.x/en/installation/configuration/switching-consoles
 ---
 
-<<<<<<< HEAD:content/os/v1.x/en/installation/configuration/switching-consoles/_index.md
-When [booting from the ISO]({{<baseurl>}}/os/v1.x/en/installation/running-rancheros/workstation/boot-from-iso/), RancherOS starts with the default console, which is based on busybox.
-
-You can select which console you want RancherOS to start with using the [cloud-config]({{<baseurl>}}/os/v1.x/en/installation/configuration/#cloud-config).
-
-### Enabling Consoles using Cloud-Config
-
-When launching RancherOS with a [cloud-config]({{<baseurl>}}/os/v1.x/en/installation/configuration/#cloud-config) file, you can select which console you want to use.
-=======
 When [booting from the ISO]({{< baseurl >}}/os/v1.x/en/installation/workstation//boot-from-iso/), RancherOS starts with the default console, which is based on busybox.
 
 You can select which console you want RancherOS to start with using the [cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/#cloud-config).
@@ -21,7 +12,6 @@ You can select which console you want RancherOS to start with using the [cloud-c
 ### Enabling Consoles using Cloud-Config
 
 When launching RancherOS with a [cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/#cloud-config) file, you can select which console you want to use.
->>>>>>> Reorganize RancherOS docs:content/os/v1.x/en/configuration/switching-consoles/_index.md
 
 Currently, the list of available consoles are:
 
diff --git a/content/os/v1.x/en/configuration/switching-docker-versions/_index.md b/content/os/v1.x/en/configuration/switching-docker-versions/_index.md
index 3b667af2430..d1df6deebaf 100644
--- a/content/os/v1.x/en/configuration/switching-docker-versions/_index.md
+++ b/content/os/v1.x/en/configuration/switching-docker-versions/_index.md
@@ -5,11 +5,7 @@ aliases:
   - /os/v1.x/en/installation/configuration/switching-docker-versions
 ---
 
-<<<<<<< HEAD:content/os/v1.x/en/installation/configuration/switching-docker-versions/_index.md
-The version of User Docker used in RancherOS can be configured using a [cloud-config]({{<baseurl>}}/os/v1.x/en/installation/configuration/#cloud-config) file or by using the `ros engine` command.
-=======
 The version of User Docker used in RancherOS can be configured using a [cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/#cloud-config) file or by using the `ros engine` command.
->>>>>>> Reorganize RancherOS docs:content/os/v1.x/en/configuration/switching-docker-versions/_index.md
 
 > **Note:** There are known issues in Docker when switching between versions. For production systems, we recommend setting the Docker engine only once [using a cloud-config](#setting-the-docker-engine-using-cloud-config).
 
@@ -89,11 +85,7 @@ FROM scratch
 COPY engine /engine
 ```
 
-<<<<<<< HEAD:content/os/v1.x/en/installation/configuration/switching-docker-versions/_index.md
-Once the image is built a [system service]({{<baseurl>}}/os/v1.x/en/installation/system-services/adding-system-services/) configuration file must be created. An [example file](https://github.com/rancher/os-services/blob/master/d/docker-18.06.3-ce.yml) can be found in the rancher/os-services repo. Change the `image` field to point to the Docker engine image you've built.
-=======
 Once the image is built a [system service]({{< baseurl >}}/os/v1.x/en/system-services/) configuration file must be created. An [example file](https://github.com/rancher/os-services/blob/master/d/docker-18.06.3-ce.yml) can be found in the rancher/os-services repo. Change the `image` field to point to the Docker engine image you've built.
->>>>>>> Reorganize RancherOS docs:content/os/v1.x/en/configuration/switching-docker-versions/_index.md
 
 All of the previously mentioned methods of switching Docker engines are now available. For example, if your service file is located at `https://myservicefile` then the following cloud-config file could be used to use your custom Docker engine.
 
diff --git a/content/os/v1.x/en/installation/cloud/aws/_index.md b/content/os/v1.x/en/installation/cloud/aws/_index.md
index 57a937465a8..2547ec84ba1 100644
--- a/content/os/v1.x/en/installation/cloud/aws/_index.md
+++ b/content/os/v1.x/en/installation/cloud/aws/_index.md
@@ -30,11 +30,7 @@ Let’s walk through how to import and create a RancherOS on EC2 machine using t
     {{< img "/img/os/Rancher_aws1.png" "RancherOS on AWS 1">}}
 2. Select the **Community AMIs** on the sidebar and search for **RancherOS**. Pick the latest version and click **Select**.
     {{< img "/img/os/Rancher_aws2.png" "RancherOS on AWS 2">}}
-<<<<<<< HEAD:content/os/v1.x/en/installation/running-rancheros/cloud/aws/_index.md
-3. Go through the steps of creating the instance type through the AWS console. If you want to pass in a [cloud-config]({{<baseurl>}}/os/v1.x/en/installation/configuration/#cloud-config) file during boot of RancherOS, you'd pass in the file as **User data** by expanding the **Advanced Details** in **Step 3: Configure Instance Details**. You can pass in the data as text or as a file.
-=======
 3. Go through the steps of creating the instance type through the AWS console. If you want to pass in a [cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/#cloud-config) file during boot of RancherOS, you'd pass in the file as **User data** by expanding the **Advanced Details** in **Step 3: Configure Instance Details**. You can pass in the data as text or as a file.
->>>>>>> Reorganize RancherOS docs:content/os/v1.x/en/installation/cloud/aws/_index.md
     {{< img "/img/os/Rancher_aws6.png" "RancherOS on AWS 6">}}
      After going through all the steps, you finally click on **Launch**, and either create a new key pair or choose an existing key pair to be used with the EC2 instance. If you have created a new key pair, download the key pair. If you have chosen an existing key pair, make sure you have the key pair accessible. Click on **Launch Instances**.
      {{< img "/img/os/Rancher_aws3.png" "RancherOS on AWS 3">}}
diff --git a/content/os/v1.x/en/installation/custom-builds/custom-console/_index.md b/content/os/v1.x/en/installation/custom-builds/custom-console/_index.md
index 5a4e2c225f5..a54cf2f4f6f 100644
--- a/content/os/v1.x/en/installation/custom-builds/custom-console/_index.md
+++ b/content/os/v1.x/en/installation/custom-builds/custom-console/_index.md
@@ -3,15 +3,6 @@ title: Custom Console
 weight: 180
 ---
 
-<<<<<<< HEAD
-When [booting from the ISO]({{<baseurl>}}/os/v1.x/en/installation/running-rancheros/workstation/boot-from-iso/), RancherOS starts with the default console, which is based on busybox.
-
-You can select which console you want RancherOS to start with using the [cloud-config]({{<baseurl>}}/os/v1.x/en/installation/configuration/#cloud-config).
-
-### Enabling Consoles using Cloud-Config
-
-When launching RancherOS with a [cloud-config]({{<baseurl>}}/os/v1.x/en/installation/configuration/#cloud-config) file, you can select which console you want to use.
-=======
 When [booting from the ISO]({{< baseurl >}}/os/v1.x/en/installation/workstation//boot-from-iso/), RancherOS starts with the default console, which is based on busybox.
 
 You can select which console you want RancherOS to start with using the [cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/#cloud-config).
@@ -19,7 +10,6 @@ You can select which console you want RancherOS to start with using the [cloud-c
 ### Enabling Consoles using Cloud-Config
 
 When launching RancherOS with a [cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/#cloud-config) file, you can select which console you want to use.
->>>>>>> Reorganize RancherOS docs
 
 Currently, the list of available consoles are:
 

From 63ec293514075fcdd51747f811836ced5bc4dd97 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 8 May 2020 10:47:45 -0700
Subject: [PATCH 080/265] Remove glitchy accordions

---
 .../node-requirements/_index.md               | 24 +------------------
 1 file changed, 1 insertion(+), 23 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md b/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
index 24a0777534d..e4de1d49010 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
@@ -74,8 +74,6 @@ If security isn't a large concern and you're okay with opening a few additional
 
 These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
 
-{{% accordion id="common-ports" label="Click to Expand" %}}
-
 <figcaption>Commonly Used Ports Reference</figcaption>
 
 | Protocol 	|       Port       	| Description                                     	|
@@ -93,28 +91,20 @@ These ports are typically opened on your Kubernetes nodes, regardless of what ty
 |    TCP   	|       10254      	| Ingress controller livenessProbe/readinessProbe 	|
 | TCP/UDP  	| 30000-</br>32767 	| NodePort port range                             	|
 
-{{% /accordion %}}
-
 ### Port Requirements for Custom Clusters
 
 If you are launching a Kubernetes cluster on your existing infrastructure, refer to these port requirements.
 
-{{% accordion id="port-reqs-for-custom-clusters" label="Click to Expand" %}}
-
 The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/).
 
 {{< ports-custom-nodes >}}
 
-{{% /accordion %}}
-
 ### Port Requirements for Clusters Hosted by an Infrastructure Provider
 
 If you are launching a Kubernetes cluster on nodes that are in an infrastructure provider such as Amazon EC2, Google Container Engine, DigitalOcean, Azure, or vSphere, these port requirements apply.
 
 These required ports are automatically opened by Rancher during creation of clusters using cloud providers.
 
-{{% accordion id="port-reqs-for-infrastructure-providers" label="Click to Expand" %}}
-
 The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
 
 >**Note:**
@@ -122,8 +112,6 @@ The following table depicts the port requirements for [Rancher Launched Kubernet
 
 {{< ports-iaas-nodes >}}
 
-{{% /accordion %}}
-
 #### Security Group for Nodes on AWS EC2
 
 When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
@@ -146,27 +134,17 @@ When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provi
 
 ### Port Requirements for Clusters Hosted by a Kubernetes Provider
 
-If you are launching a cluster with a hosted Kubernetes provider such as Google Kubernetes Engine, Amazon EKS, or Azure Kubernetes Service, refer to these port requirements.
-
-{{% accordion id="port-reqs-for-hosted-kubernetes" label="Click to Expand" %}}
-
-The following table depicts the port requirements for nodes in [hosted Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters).
+If you are launching a cluster with a [hosted Kubernetes provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters). such as Google Kubernetes Engine, Amazon EKS, or Azure Kubernetes Service, refer to these port requirements.
 
 {{< ports-imported-hosted >}}
 
-{{% /accordion %}}
 
 ### Port Requirements for Imported Clusters
 
-If you are importing an existing cluster, refer to these port requirements.
-
-{{% accordion id="port-reqs-for-imported-clusters" label="Click to Expand" %}}
-
 The following table depicts the port requirements for [imported clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/).
 
 {{< ports-imported-hosted >}}
 
-{{% /accordion %}}
 
 ### Port Requirements for Local Traffic
 

From 5939ad85f20caa8fa82372474e07f609c8289a41 Mon Sep 17 00:00:00 2001
From: Akshaykon <akshay.kondhekar@yahoo.com>
Date: Mon, 11 May 2020 19:45:51 +0530
Subject: [PATCH 081/265] Update _index.md

Grammatical one
---
 .../rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md b/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md
index da6bcacc337..b85e59a3ec3 100644
--- a/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/restoring-etcd/_index.md
@@ -35,7 +35,7 @@ Restorations changed in Rancher v2.4.0.
 {{% tabs %}}
 {{% tab "Rancher v2.4.0+" %}}
 
-Snapshots are composed of the cluster data in etcd, the Kubernetes version, and the cluster configuration in the `cluster.yml.` These components allow you can select from the following options when restoring a cluster from a snapshot:
+Snapshots are composed of the cluster data in etcd, the Kubernetes version, and the cluster configuration in the `cluster.yml.` These components allow you to select from the following options when restoring a cluster from a snapshot:
 
 - **Restore just the etcd contents:** This restoration is similar to restoring to snapshots in Rancher prior to v2.4.0.
 - **Restore etcd and Kubernetes version:** This option should be used if a Kubernetes upgrade is the reason that your cluster is failing, and you haven't made any cluster configuration changes.
@@ -110,4 +110,4 @@ If the group of etcd nodes loses quorum, the Kubernetes cluster will report a fa
 
 # Enabling Snapshot Features for Clusters Created Before Rancher v2.2.0
 
-If you have any Rancher launched Kubernetes clusters that were created prior to v2.2.0, after upgrading Rancher, you must [edit the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) and _save_ it, in order to enable the updated snapshot features. Even if you were already creating snapshots prior to v2.2.0, you must do this step as the older snapshots will not be available to use to [back up and restore etcd through the UI]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/).
\ No newline at end of file
+If you have any Rancher launched Kubernetes clusters that were created prior to v2.2.0, after upgrading Rancher, you must [edit the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) and _save_ it, in order to enable the updated snapshot features. Even if you were already creating snapshots prior to v2.2.0, you must do this step as the older snapshots will not be available to use to [back up and restore etcd through the UI]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/).

From 31e7980d9021da8b0cbf71adcef5d23df4f05f23 Mon Sep 17 00:00:00 2001
From: CloudYuga Technologies <neependra@cloudyuga.guru>
Date: Thu, 14 May 2020 15:26:24 +0530
Subject: [PATCH 082/265] Update _index.md

---
 .../en/quick-start-guide/deployment/digital-ocean-qs/_index.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md b/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md
index 95b4820090d..121883464a9 100644
--- a/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md
+++ b/content/rancher/v2.x/en/quick-start-guide/deployment/digital-ocean-qs/_index.md
@@ -63,6 +63,6 @@ Use Rancher to create a deployment. For more information, see [Creating Deployme
 
 ## Destroying the Environment
 
-1. From the `quickstart/aws` folder, execute `terraform destroy --auto-approve`.
+1. From the `quickstart/do` folder, execute `terraform destroy --auto-approve`.
 
 2. Wait for confirmation that all resources have been destroyed.

From bdb6a2302e006e040c8904973fc1f0128e6ff101 Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Thu, 14 May 2020 12:08:13 +0100
Subject: [PATCH 083/265] Clarified sentence

The sentence seemed to imply that the page I was on was for Helm2 until I noticed the word 'section' was a link.
---
 content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
index cd17c75caa3..d255f560934 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
@@ -15,7 +15,7 @@ If you installed Rancher using the RKE Add-on yaml, follow the directions to [mi
 >**Notes:**
 > 
 > - [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager)
-> - The upgrade instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/helm2) provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
+> - The upgrade instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) The [Helm 2 upgrade page here]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/helm2) provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
 > - If you are upgrading Rancher from v2.x to v2.3+, and you are using external TLS termination, you will need to edit the cluster.yml to [enable using forwarded host headers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#configuring-ingress-for-external-tls-when-using-nginx-v0-25)
 
 # Prerequisites

From 86aab49056bb2e12874c602cdd56bcc42187e586 Mon Sep 17 00:00:00 2001
From: rawmind0 <rawmind@gmail.com>
Date: Thu, 14 May 2020 15:43:01 +0200
Subject: [PATCH 084/265] Fix rancher upgrade instructions when cert-manager is
 updated

---
 content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md      | 6 +++---
 .../rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md    | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
index d255f560934..89d2333b42e 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
@@ -115,7 +115,9 @@ If you are currently running the cert-manger whose version is older than v0.11,
     helm delete rancher -n cattle-system
     ```
 
-2. Reinstall Rancher to the latest version with all your settings. Take all the values from the previous step and append them to the command using `--set key=value`. Note: There will be many more options from the previous step that need to be appended.
+2. Uninstall and reinstall `cert-manager` according to the instructions on the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) page.
+
+3. Reinstall Rancher to the latest version with all your settings. Take all the values from the step 1 and append them to the command using `--set key=value`. Note: There will be many more options from the step 1 that need to be appended.
 
     ```
     helm install rancher rancher-<CHART_REPO>/rancher \
@@ -123,8 +125,6 @@ If you are currently running the cert-manger whose version is older than v0.11,
     --set hostname=rancher.my.org
     ```
 
-3. Uninstall and reinstall `cert-manager` according to the instructions on the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) page.
-
 {{% /accordion %}}
 
 {{% /tab %}}
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
index 59bacf23036..d3c436b3307 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
@@ -110,15 +110,15 @@ helm upgrade rancher-<CHART_REPO>/rancher \
 
 If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. 
 
-Please refer the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) page for more information.
-
 1. Uninstall Rancher
 
     ```
     helm delete rancher -n cattle-system
     ```
 
-2. Reinstall Rancher to the latest version with all your settings. Take all the values from the previous step and append them to the command using `--set key=value`. Note: There will be many more options from the previous step that need to be appended.
+2. Uninstall and reinstall `cert-manager` according to the instructions on the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions) page.
+
+3. Reinstall Rancher to the latest version with all your settings. Take all the values from the step 1 and append them to the command using `--set key=value`. Note: There will be many more options from the step 1 that need to be appended.
 
     ```
     helm install rancher-<CHART_REPO>/rancher \

From 7cb52d34f49d1df8bfbde93b3d7d19d2cf1a5c3a Mon Sep 17 00:00:00 2001
From: Abmurksi <raffi@gmx.net>
Date: Thu, 7 May 2020 12:09:31 +0000
Subject: [PATCH 085/265] Update deprecated option --no-deploy

Replace old --no-deploy value with --disable to disable an Traefik
---
 content/k3s/latest/en/faq/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/faq/_index.md b/content/k3s/latest/en/faq/_index.md
index 9de75aa8645..d80a0394d6c 100644
--- a/content/k3s/latest/en/faq/_index.md
+++ b/content/k3s/latest/en/faq/_index.md
@@ -11,7 +11,7 @@ K3s is capable of nearly everything k8s can do. It is just a more lightweight ve
 
 **How can I use my own Ingress instead of Traefik?**
 
-Simply start K3s server with `--no-deploy=traefik` and deploy your ingress.
+Simply start K3s server with `--disable traefik` and deploy your ingress.
 
 **Does K3s support Windows?**
 

From 343079f840064b1a92d33a3de5c9e2c493da23d9 Mon Sep 17 00:00:00 2001
From: John Reese <john@reese.dev>
Date: Wed, 20 May 2020 03:08:37 -0400
Subject: [PATCH 086/265] Update user settings documentation

---
 content/rancher/v2.x/en/user-settings/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/user-settings/_index.md b/content/rancher/v2.x/en/user-settings/_index.md
index c048530c560..6f163c24753 100644
--- a/content/rancher/v2.x/en/user-settings/_index.md
+++ b/content/rancher/v2.x/en/user-settings/_index.md
@@ -11,7 +11,7 @@ Within Rancher, each user has a number of settings associated with their login:
 
 The available user settings are:
 
-- [API & Keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/): If you want to interact with Rancher programmatically, you need an API key. Follow the directions in this section to obtain a key.gferfgre
+- [API & Keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/): If you want to interact with Rancher programmatically, you need an API key. Follow the directions in this section to obtain a key.
 - [Cloud Credentials]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/): Manage cloud credentials [used by node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) to [provision nodes for clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters). Note: Available as of v2.2.0. 
 - [Node Templates]({{<baseurl>}}/rancher/v2.x/en/user-settings/node-templates): Manage templates [used by Rancher to provision nodes for clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters).
 - [Preferences]({{<baseurl>}}/rancher/v2.x/en/user-settings/preferences): Sets superficial preferences for the Rancher UI.

From de424290fedab702dba8ff446b34cabd83e86e20 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 12 May 2020 15:31:46 -0700
Subject: [PATCH 087/265] Explain killall script in K3s docs

---
 .../install-options/killall/_index.md            | 16 ++++++++++++++++
 .../latest/en/installation/uninstall/_index.md   |  2 ++
 2 files changed, 18 insertions(+)
 create mode 100644 content/k3s/latest/en/installation/install-options/killall/_index.md

diff --git a/content/k3s/latest/en/installation/install-options/killall/_index.md b/content/k3s/latest/en/installation/install-options/killall/_index.md
new file mode 100644
index 00000000000..dabe4cde270
--- /dev/null
+++ b/content/k3s/latest/en/installation/install-options/killall/_index.md
@@ -0,0 +1,16 @@
+---
+title: The k3s-killall.sh script
+weight: 4
+---
+
+To allow high availability during upgrades, the K3s containers continue running when the K3s service is stopped.
+
+To stop all of the K3s containers and reset the containerd state, the `k3s-killall.sh` script can be used.
+
+The killall script cleans up containers, K3s directories, and networking components while also removing the iptables chain with all the associated rules. The cluster data will not be deleted.
+
+To run the killall script from a server node, run:
+
+```
+/usr/local/bin/k3s-killall.sh
+```
\ No newline at end of file
diff --git a/content/k3s/latest/en/installation/uninstall/_index.md b/content/k3s/latest/en/installation/uninstall/_index.md
index 43f51fdeb9c..f30b018029f 100644
--- a/content/k3s/latest/en/installation/uninstall/_index.md
+++ b/content/k3s/latest/en/installation/uninstall/_index.md
@@ -5,6 +5,8 @@ weight: 61
 
 If you installed K3s using the installation script, a script to uninstall K3s was generated during installation.
 
+> Uninstalling K3s deletes the cluster data and all of the scripts. To restart the cluster with different installation options, re-run the installation script with different flags.
+
 To uninstall K3s from a server node, run:
 
 ```

From b6405abca434b23cfa80f4c150a8e97bd8499519 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 11 May 2020 21:09:20 -0700
Subject: [PATCH 088/265] Update NLB setup doc for K3s Rancher installs

---
 .../en/installation/options/nlb/_index.md     | 72 ++++++++++---------
 1 file changed, 40 insertions(+), 32 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/options/nlb/_index.md
index 78d170d6714..6db1ccb0044 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/nlb/_index.md
@@ -19,13 +19,17 @@ Configuring an Amazon NLB is a multistage process:
 3. [Create Your NLB](#3-create-your-nlb)
 4. [Add listener to NLB for TCP port 80](#4-add-listener-to-nlb-for-tcp-port-80)
 
-> **Prerequisite:** These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these two nodes.
+> **Prerequisite:** These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
 
 # 1. Create Target Groups
 
 Begin by creating two target groups for the **TCP** protocol, one with TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
 
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX ingress controller on the nodes will make sure that port 80 gets redirected to port 443.
+Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically.
+
+If you are installing Rancher on an RKE Kubernetes cluster, the NGINX Ingress controller on the nodes will make sure that port 80 gets redirected to port 443.
+
+If you are installing Rancher on a K3s Kubernetes cluster, the Traefik Ingress controller will be used, and traffic will not be redirected from port 80. Traffic will need to go only to port 443.
 
 1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
 1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
@@ -35,21 +39,23 @@ Your first NLB configuration step is to create two target groups. Technically, o
 
 Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
 
-| Option                              | Setting           |
-| ----------------------------------- | ----------------- |
-| Target Group Name                   | `rancher-tcp-443` |
-| Protocol                            | `TCP`             |
-| Port                                | `443`             |
-| Target type                         | `instance`        |
-| VPC                                 | Choose your VPC   |
-| Protocol<br/>(Health Check)         | `HTTP`            |
-| Path<br/>(Health Check)             | `/healthz`        |
-| Port (Advanced health check)        | `override`,`80`   |
-| Healthy threshold (Advanced health) | `3`               |
-| Unhealthy threshold (Advanced)      | `3`               |
-| Timeout (Advanced)                  | `6 seconds`       |
-| Interval (Advanced)                 | `10 second`       |
-| Success codes                       | `200-399`         |
+The health check settings differ depending on whether the Rancher server cluster uses an NGINX Ingress controller or a Traefik Ingress controller. If you are installing Rancher on an RKE Kubernetes cluster, NGINX is the default Ingress. If you are installing Rancher on a K3s Kubernetes cluster, Traefik is used to allow traffic to enter the Rancher server cluster.
+
+| Option                              | Setting           |    Applies to NGINX Ingress | Applies to Traefik Ingress |
+| ----------------------------------- | ----------------- | ----------------------------------- | ----------------- |
+| Target Group Name                   | `rancher-tcp-443` | ✓ | ✓ |
+| Protocol                            | `TCP`             | ✓ | ✓ |
+| Port                                | `443`             | ✓ | ✓ |
+| Target type                         | `instance`        | ✓ | ✓ |
+| VPC                                 | Choose your VPC   | ✓ | ✓ |
+| Protocol<br/>(Health Check)         | `HTTP`            | ✓ |  |
+| Path<br/>(Health Check)             | `/healthz`        | ✓ |  |
+| Port (Advanced health check)        | `override`,`80`   | ✓ |  |
+| Healthy threshold (Advanced health) | `3`               | ✓ |  |
+| Unhealthy threshold (Advanced)      | `3`               | ✓ |  |
+| Timeout (Advanced)                  | `6 seconds`       | ✓ | ✓ |
+| Interval (Advanced)                 | `10 second`       | ✓ | ✓ |
+| Success codes                       | `200-399`         | ✓ | ✓ |
 
 
 Click **Create target group** to create the second target group, regarding TCP port 80.
@@ -58,21 +64,23 @@ Click **Create target group** to create the second target group, regarding TCP p
 
 Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table.
 
-| Option                              | Setting          |
-| ----------------------------------- | ---------------- |
-| Target Group Name                   | `rancher-tcp-80` |
-| Protocol                            | `TCP`            |
-| Port                                | `80`             |
-| Target type                         | `instance`       |
-| VPC                                 | Choose your VPC  |
-| Protocol<br/>(Health Check)         | `HTTP`           |
-| Path<br/>(Health Check)             | `/healthz`       |
-| Port (Advanced health check)        | `traffic port`   |
-| Healthy threshold (Advanced health) | `3`              |
-| Unhealthy threshold (Advanced)      | `3`              |
-| Timeout (Advanced)                  | `6 seconds`      |
-| Interval (Advanced)                 | `10 second`      |
-| Success codes                       | `200-399`        |
+The health check settings differ depending on whether the Rancher server cluster uses an NGINX Ingress controller or a Traefik Ingress controller. If you are installing Rancher on an RKE Kubernetes cluster, NGINX is the default Ingress. If you are installing Rancher on a K3s Kubernetes cluster, Traefik is used to allow traffic to enter the Rancher server cluster.
+
+| Option                              | Setting          | Applies to NGINX Ingress | Applies to Traefik Ingress |
+| ----------------------------------- | ---------------- | ----------------------------------- | ----------------- |
+| Target Group Name                   | `rancher-tcp-80` | ✓ | ✓ |
+| Protocol                            | `TCP`            | ✓ | ✓ |
+| Port                                | `80`             | ✓ | ✓ |
+| Target type                         | `instance`       | ✓ | ✓ |
+| VPC                                 | Choose your VPC  | ✓ | ✓ |
+| Protocol<br/>(Health Check)         | `HTTP`           | ✓ |  |
+| Path<br/>(Health Check)             | `/healthz`       | ✓ |  |
+| Port (Advanced health check)        | `traffic port`   | ✓ |  |
+| Healthy threshold (Advanced health) | `3`              | ✓ |  |
+| Unhealthy threshold (Advanced)      | `3`              | ✓ |  |
+| Timeout (Advanced)                  | `6 seconds`      | ✓ | ✓ |
+| Interval (Advanced)                 | `10 second`      | ✓ | ✓ |
+| Success codes                       | `200-399`        | ✓ | ✓ |
 
 # 2. Register Targets
 

From 64203b15740d72626b27bcfcddb459385061f890 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 21 May 2020 03:06:26 -0700
Subject: [PATCH 089/265] Revert "Update NLB setup doc for K3s Rancher
 installs"

This reverts commit 5979f32b733997eb1f60a0da943ce8d342c6e002.
---
 .../en/installation/options/nlb/_index.md     | 72 +++++++++----------
 1 file changed, 32 insertions(+), 40 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/options/nlb/_index.md
index 6db1ccb0044..78d170d6714 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/nlb/_index.md
@@ -19,17 +19,13 @@ Configuring an Amazon NLB is a multistage process:
 3. [Create Your NLB](#3-create-your-nlb)
 4. [Add listener to NLB for TCP port 80](#4-add-listener-to-nlb-for-tcp-port-80)
 
-> **Prerequisite:** These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
+> **Prerequisite:** These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these two nodes.
 
 # 1. Create Target Groups
 
 Begin by creating two target groups for the **TCP** protocol, one with TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
 
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically.
-
-If you are installing Rancher on an RKE Kubernetes cluster, the NGINX Ingress controller on the nodes will make sure that port 80 gets redirected to port 443.
-
-If you are installing Rancher on a K3s Kubernetes cluster, the Traefik Ingress controller will be used, and traffic will not be redirected from port 80. Traffic will need to go only to port 443.
+Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX ingress controller on the nodes will make sure that port 80 gets redirected to port 443.
 
 1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
 1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
@@ -39,23 +35,21 @@ If you are installing Rancher on a K3s Kubernetes cluster, the Traefik Ingress c
 
 Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
 
-The health check settings differ depending on whether the Rancher server cluster uses an NGINX Ingress controller or a Traefik Ingress controller. If you are installing Rancher on an RKE Kubernetes cluster, NGINX is the default Ingress. If you are installing Rancher on a K3s Kubernetes cluster, Traefik is used to allow traffic to enter the Rancher server cluster.
-
-| Option                              | Setting           |    Applies to NGINX Ingress | Applies to Traefik Ingress |
-| ----------------------------------- | ----------------- | ----------------------------------- | ----------------- |
-| Target Group Name                   | `rancher-tcp-443` | ✓ | ✓ |
-| Protocol                            | `TCP`             | ✓ | ✓ |
-| Port                                | `443`             | ✓ | ✓ |
-| Target type                         | `instance`        | ✓ | ✓ |
-| VPC                                 | Choose your VPC   | ✓ | ✓ |
-| Protocol<br/>(Health Check)         | `HTTP`            | ✓ |  |
-| Path<br/>(Health Check)             | `/healthz`        | ✓ |  |
-| Port (Advanced health check)        | `override`,`80`   | ✓ |  |
-| Healthy threshold (Advanced health) | `3`               | ✓ |  |
-| Unhealthy threshold (Advanced)      | `3`               | ✓ |  |
-| Timeout (Advanced)                  | `6 seconds`       | ✓ | ✓ |
-| Interval (Advanced)                 | `10 second`       | ✓ | ✓ |
-| Success codes                       | `200-399`         | ✓ | ✓ |
+| Option                              | Setting           |
+| ----------------------------------- | ----------------- |
+| Target Group Name                   | `rancher-tcp-443` |
+| Protocol                            | `TCP`             |
+| Port                                | `443`             |
+| Target type                         | `instance`        |
+| VPC                                 | Choose your VPC   |
+| Protocol<br/>(Health Check)         | `HTTP`            |
+| Path<br/>(Health Check)             | `/healthz`        |
+| Port (Advanced health check)        | `override`,`80`   |
+| Healthy threshold (Advanced health) | `3`               |
+| Unhealthy threshold (Advanced)      | `3`               |
+| Timeout (Advanced)                  | `6 seconds`       |
+| Interval (Advanced)                 | `10 second`       |
+| Success codes                       | `200-399`         |
 
 
 Click **Create target group** to create the second target group, regarding TCP port 80.
@@ -64,23 +58,21 @@ Click **Create target group** to create the second target group, regarding TCP p
 
 Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table.
 
-The health check settings differ depending on whether the Rancher server cluster uses an NGINX Ingress controller or a Traefik Ingress controller. If you are installing Rancher on an RKE Kubernetes cluster, NGINX is the default Ingress. If you are installing Rancher on a K3s Kubernetes cluster, Traefik is used to allow traffic to enter the Rancher server cluster.
-
-| Option                              | Setting          | Applies to NGINX Ingress | Applies to Traefik Ingress |
-| ----------------------------------- | ---------------- | ----------------------------------- | ----------------- |
-| Target Group Name                   | `rancher-tcp-80` | ✓ | ✓ |
-| Protocol                            | `TCP`            | ✓ | ✓ |
-| Port                                | `80`             | ✓ | ✓ |
-| Target type                         | `instance`       | ✓ | ✓ |
-| VPC                                 | Choose your VPC  | ✓ | ✓ |
-| Protocol<br/>(Health Check)         | `HTTP`           | ✓ |  |
-| Path<br/>(Health Check)             | `/healthz`       | ✓ |  |
-| Port (Advanced health check)        | `traffic port`   | ✓ |  |
-| Healthy threshold (Advanced health) | `3`              | ✓ |  |
-| Unhealthy threshold (Advanced)      | `3`              | ✓ |  |
-| Timeout (Advanced)                  | `6 seconds`      | ✓ | ✓ |
-| Interval (Advanced)                 | `10 second`      | ✓ | ✓ |
-| Success codes                       | `200-399`        | ✓ | ✓ |
+| Option                              | Setting          |
+| ----------------------------------- | ---------------- |
+| Target Group Name                   | `rancher-tcp-80` |
+| Protocol                            | `TCP`            |
+| Port                                | `80`             |
+| Target type                         | `instance`       |
+| VPC                                 | Choose your VPC  |
+| Protocol<br/>(Health Check)         | `HTTP`           |
+| Path<br/>(Health Check)             | `/healthz`       |
+| Port (Advanced health check)        | `traffic port`   |
+| Healthy threshold (Advanced health) | `3`              |
+| Unhealthy threshold (Advanced)      | `3`              |
+| Timeout (Advanced)                  | `6 seconds`      |
+| Interval (Advanced)                 | `10 second`      |
+| Success codes                       | `200-399`        |
 
 # 2. Register Targets
 

From a08893df34c4b1c2dccd4870ddeb2fdebc3d3680 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 21 May 2020 03:02:31 -0700
Subject: [PATCH 090/265] Move killall script doc to upgrades section

---
 .../{installation/install-options => upgrades}/killall/_index.md  | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename content/k3s/latest/en/{installation/install-options => upgrades}/killall/_index.md (100%)

diff --git a/content/k3s/latest/en/installation/install-options/killall/_index.md b/content/k3s/latest/en/upgrades/killall/_index.md
similarity index 100%
rename from content/k3s/latest/en/installation/install-options/killall/_index.md
rename to content/k3s/latest/en/upgrades/killall/_index.md

From dfda5d476ca0c349dbf22d3f91b81e6c1d74aee2 Mon Sep 17 00:00:00 2001
From: Onkar Dhuri <onkar.dhuri@gmail.com>
Date: Fri, 22 May 2020 10:38:26 +0530
Subject: [PATCH 091/265] updated retention from 24 to 24h

etcd snapshot container keeps on restarting since "24" is not acceptable value
---
 .../v2.x/en/installation/k8s-install/kubernetes-rke/_index.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
index 4df06d13cbd..e5b82679211 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
@@ -161,7 +161,7 @@ services:
   etcd:
     snapshot: true
     creation: 6h
-    retention: 24
+    retention: 24h
 
 # Required for external TLS termination with
 # ingress-nginx v0.22+

From 56b534ce0ade27b917b009ad348e3d37d1ebc138 Mon Sep 17 00:00:00 2001
From: mutron3k <asloan7@gmail.com>
Date: Tue, 19 May 2020 21:12:27 -0400
Subject: [PATCH 092/265] jetstack cert-manager doc update

jetstack made a path change, updating doc, also to latest version
reference: https://hub.helm.sh/charts/jetstack/cert-manager
---
 .../v2.x/en/installation/k8s-install/helm-rancher/_index.md   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
index bf17fc84814..be3c42f9c0c 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
@@ -114,7 +114,11 @@ helm repo update
 helm install \
   cert-manager jetstack/cert-manager \
   --namespace cert-manager \
+<<<<<<< HEAD
   --version v0.14.2
+=======
+  --version v0.15.0
+>>>>>>> jetstack cert-manager doc update
 ```
 
 Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:

From 09659e579d361b0c789ec54bf6e4473383d900de Mon Sep 17 00:00:00 2001
From: Jim Nicholson <thejimnicholson@gmail.com>
Date: Mon, 1 Jun 2020 02:59:00 -0700
Subject: [PATCH 093/265] Recommend '--disable' over '--no-deploy'

--no-deploy is listed as deprecated in the server-config section of install-options. This updates the networking section to reflect that deprecation.
---
 content/k3s/latest/en/networking/_index.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/k3s/latest/en/networking/_index.md b/content/k3s/latest/en/networking/_index.md
index 77d0eab44fc..0dc6d89294c 100644
--- a/content/k3s/latest/en/networking/_index.md
+++ b/content/k3s/latest/en/networking/_index.md
@@ -12,7 +12,7 @@ Please reference the [Installation Requirements]({{<baseurl>}}/k3s/latest/en/ins
 CoreDNS
 -------
 
-CoreDNS is deployed on start of the agent. To disable, run each server with the `--no-deploy coredns` option.
+CoreDNS is deployed on start of the agent. To disable, run each server with the `--disable coredns` option.
 
 If you don't install CoreDNS, you will need to install a cluster DNS provider yourself.
 
@@ -27,14 +27,14 @@ The Traefik ingress controller will use ports 80, 443, and 8080 on the host (i.e
 
 You can tweak traefik to meet your needs by setting options in the traefik.yaml file. Refer to the official [Traefik for Helm Configuration Parameters](https://github.com/helm/charts/tree/master/stable/traefik#configuration) readme for more information.
 
-To disable it, start each server with the `--no-deploy traefik` option.
+To disable it, start each server with the `--disable traefik` option.
 
 Service Load Balancer
 ---------------------
 
 K3s includes a basic service load balancer that uses available host ports. If you try to create a load balancer that listens on port 80, for example, it will try to find a free host in the cluster for port 80. If no port is available, the load balancer will stay in Pending.
 
-To disable the embedded load balancer, run the server with the `--no-deploy servicelb` option. This is necessary if you wish to run a different load balancer, such as MetalLB.
+To disable the embedded load balancer, run the server with the `--disable servicelb` option. This is necessary if you wish to run a different load balancer, such as MetalLB.
 
 Nodes Without a Hostname
 ------------------------

From d3c41022e02ba12f00f0168f1818f4e881349a31 Mon Sep 17 00:00:00 2001
From: Nick Jones <nick@dischord.org>
Date: Mon, 18 May 2020 13:54:31 +0100
Subject: [PATCH 094/265] fix: Update various etcd status commands

With recent clusters deployed using RKE and using etcd 3.4.x, the
example commands where `--endpoints` is used when interacting with
etcdctl fail with the following error:

```
2020-05-18 12:53:55.856862 C | pkg/flags: conflicting environment variable "ETCDCTL_ENDPOINTS" is shadowed by corresponding command-line flag (either unset environment variable or disable flag)
```

This commit updates the example commands to pass in (and override) the
`ETCDCTL_ENDPOINTS` environment variable instead.
---
 .../troubleshooting/kubernetes-components/etcd/_index.md  | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/troubleshooting/kubernetes-components/etcd/_index.md b/content/rancher/v2.x/en/troubleshooting/kubernetes-components/etcd/_index.md
index 6cdb9fefdaa..f83d241a08a 100644
--- a/content/rancher/v2.x/en/troubleshooting/kubernetes-components/etcd/_index.md
+++ b/content/rancher/v2.x/en/troubleshooting/kubernetes-components/etcd/_index.md
@@ -83,7 +83,7 @@ The values for `RAFT TERM` should be equal and `RAFT INDEX` should be not be too
 
 Command:
 ```
-docker exec etcd etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint status --write-out table
 ```
 
 Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
@@ -106,7 +106,7 @@ Example output:
 
 Command:
 ```
-docker exec etcd etcdctl endpoint health --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','")
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint health
 ```
 
 Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
@@ -232,7 +232,7 @@ compacted revision xxx
 
 Command:
 ```
-docker exec etcd etcdctl defrag --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','")
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl defrag
 ```
 
 Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
@@ -251,7 +251,7 @@ Finished defragmenting etcd member[https://IP:2379]
 
 Command:
 ```
-docker exec etcd etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint status --write-out table
 ```
 
 Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:

From 58c9fd8a62c79dd12fc0e50698861aa2b21ad49b Mon Sep 17 00:00:00 2001
From: Aleksandar Petreski <apetreski@gmail.com>
Date: Mon, 25 May 2020 20:43:34 +0200
Subject: [PATCH 095/265] Add missing User-Base Global Permission

As rancher list the following global permissions:

 Administrator
Administrators have full control over the entire installation and all resources in all clusters.

 Standard User
Standard Users can create new clusters and manage clusters and projects they have been granted access to.

 User-Base
User-Base users have login-access only.

if i understand correctly the concept i think that this should be reflected in the Readme file as well.
---
 .../rbac/global-permissions/_index.md         | 36 ++++++++++---------
 1 file changed, 19 insertions(+), 17 deletions(-)

diff --git a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
index 123a11ea5e1..036abcc3181 100644
--- a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
@@ -5,12 +5,14 @@ weight: 1126
 
 _Permissions_ are individual access rights that you can assign when selecting a custom permission for a user.
 
-Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are two default global permissions: `Administrator` and `Standard User`.
+Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are three default global permissions: `Administrator`, `Standard User` and `User-base`.
 
 - **Administrator:** These users have full control over the entire Rancher system and all clusters within it.
 
 - <a id="user"></a>**Standard User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters.
 
+- **User-Base:** User-Base users have login-access only.
+
 You cannot update or delete the built-in Global Permissions.
 
 This section covers the following topics:
@@ -63,22 +65,22 @@ Administrators can enforce custom global permissions in multiple ways:
 
 ### Custom Global Permissions Reference
 
-The following table lists each custom global permission available and whether it is included in the default global permissions, `Administrator` and `Standard User`.
+The following table lists each custom global permission available and whether it is included in the default global permissions, `Administrator`, `Standard User` and `User-Base`.
 
-| Custom Global Permission           | Administrator | Standard User |
-| ---------------------------------- | ------------- | ------------- |
-| Create Clusters                    | ✓             | ✓             |
-| Create RKE Templates               | ✓             | ✓             |
-| Manage Authentication              | ✓             |               |
-| Manage Catalogs                    | ✓             |               |
-| Manage Cluster Drivers             | ✓             |               |
-| Manage Node Drivers                | ✓             |               |
-| Manage PodSecurityPolicy Templates | ✓             |               |
-| Manage Roles                       | ✓             |               |
-| Manage Settings                    | ✓             |               |
-| Manage Users                       | ✓             |               |
-| Use Catalog Templates              | ✓             | ✓             |
-| User Base\* (Basic log-in access)  | ✓             | ✓             |
+| Custom Global Permission           | Administrator | Standard User | User-Base |
+| ---------------------------------- | ------------- | ------------- |-----------|
+| Create Clusters                    | ✓             | ✓             |           |
+| Create RKE Templates               | ✓             | ✓             |           |
+| Manage Authentication              | ✓             |               |           |
+| Manage Catalogs                    | ✓             |               |           |
+| Manage Cluster Drivers             | ✓             |               |           |
+| Manage Node Drivers                | ✓             |               |           |
+| Manage PodSecurityPolicy Templates | ✓             |               |           |
+| Manage Roles                       | ✓             |               |           |
+| Manage Settings                    | ✓             |               |           |
+| Manage Users                       | ✓             |               |           |
+| Use Catalog Templates              | ✓             | ✓             |           |
+| User Base\* (Basic log-in access)  | ✓             | ✓             |           |
 
 > \*This role has two names:
 >
@@ -169,4 +171,4 @@ To refresh group memberships,
 1. From the **Global** view, click **Security > Users.**
 1. Click **Refresh Group Memberships.**
 
-**Result:** Any changes to the group members' permissions will take effect.
\ No newline at end of file
+**Result:** Any changes to the group members' permissions will take effect.

From d66a3de7c0b73261e709a0dd2fbe691b93d65039 Mon Sep 17 00:00:00 2001
From: dkeightley <derek@rancher.com>
Date: Sun, 24 May 2020 22:39:33 +1200
Subject: [PATCH 096/265] Updates for AWS cloudprovider with RKE

- Update IAM role example (as per Rancher doc and [official](https://github.com/kubernetes/cloud-provider-aws) doc pages)
- Update tagging wording
---
 .../cloud-providers/aws/_index.md             | 158 ++++++++++++------
 1 file changed, 105 insertions(+), 53 deletions(-)

diff --git a/content/rke/latest/en/config-options/cloud-providers/aws/_index.md b/content/rke/latest/en/config-options/cloud-providers/aws/_index.md
index c580991232f..95df8b4be46 100644
--- a/content/rke/latest/en/config-options/cloud-providers/aws/_index.md
+++ b/content/rke/latest/en/config-options/cloud-providers/aws/_index.md
@@ -3,7 +3,7 @@ title: AWS Cloud Provider
 weight: 251
 ---
 
-To enable the AWS cloud provider, there are no RKE configuration options. You only need to set the name as `aws`. In order to use the AWS cloud provider, all cluster nodes must have already been configured with an [appropriate IAM role](#iam-requirements) and your AWS resources must be [tagged with a cluster ID](#tagging-amazon-resources).
+To enable the AWS cloud provider, there are no RKE configuration options. You only need to set the name as `aws`. In order to use the AWS cloud provider, all cluster nodes must have already been configured with an [appropriate IAM role](#iam-requirements) and your AWS resources must be [tagged with a cluster ID](#tagging-aws-resources).
 
 ```yaml
 cloud_provider:
@@ -12,19 +12,11 @@ cloud_provider:
 
 ## IAM Requirements
 
-The nodes used in RKE that will be running the AWS cloud provider must have at least the following IAM policy (`rancher-role.json`).
+In a cluster with the AWS cloud provider enabled, nodes must have at least the `ec2:Describe*` action.
 
-```json
-{
-  "Effect": "Allow",
-  "Action": "ec2:Describe*",
-  "Resource": "*"
-}
-```
+In order to use Elastic Load Balancers (ELBs) and EBS volumes with Kubernetes, the node(s) will need to have the an IAM role with appropriate permissions.
 
-In order to use Elastic Load Balancers (ELBs) and EBS with Kubernetes, the node(s) will need to have the an IAM role with appropriate access (`rancher-policy.json`).
-
-## Example Policy for IAM Role:
+IAM policy for nodes with the `controlplane` role:
 
 ```json
 {
@@ -32,64 +24,124 @@ In order to use Elastic Load Balancers (ELBs) and EBS with Kubernetes, the node(
   "Statement": [
     {
       "Effect": "Allow",
-      "Action": "ec2:Describe*",
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "ec2:AttachVolume",
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": "ec2:DetachVolume",
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": ["elasticloadbalancing:*"],
-      "Resource": ["*"]
+      "Action": [
+        "autoscaling:DescribeAutoScalingGroups",
+        "autoscaling:DescribeLaunchConfigurations",
+        "autoscaling:DescribeTags",
+        "ec2:DescribeInstances",
+        "ec2:DescribeRegions",
+        "ec2:DescribeRouteTables",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeVolumes",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateTags",
+        "ec2:CreateVolume",
+        "ec2:ModifyInstanceAttribute",
+        "ec2:ModifyVolume",
+        "ec2:AttachVolume",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CreateRoute",
+        "ec2:DeleteRoute",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteVolume",
+        "ec2:DetachVolume",
+        "ec2:RevokeSecurityGroupIngress",
+        "ec2:DescribeVpcs",
+        "elasticloadbalancing:AddTags",
+        "elasticloadbalancing:AttachLoadBalancerToSubnets",
+        "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+        "elasticloadbalancing:CreateLoadBalancer",
+        "elasticloadbalancing:CreateLoadBalancerPolicy",
+        "elasticloadbalancing:CreateLoadBalancerListeners",
+        "elasticloadbalancing:ConfigureHealthCheck",
+        "elasticloadbalancing:DeleteLoadBalancer",
+        "elasticloadbalancing:DeleteLoadBalancerListeners",
+        "elasticloadbalancing:DescribeLoadBalancers",
+        "elasticloadbalancing:DescribeLoadBalancerAttributes",
+        "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+        "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+        "elasticloadbalancing:ModifyLoadBalancerAttributes",
+        "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+        "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+        "elasticloadbalancing:AddTags",
+        "elasticloadbalancing:CreateListener",
+        "elasticloadbalancing:CreateTargetGroup",
+        "elasticloadbalancing:DeleteListener",
+        "elasticloadbalancing:DeleteTargetGroup",
+        "elasticloadbalancing:DescribeListeners",
+        "elasticloadbalancing:DescribeLoadBalancerPolicies",
+        "elasticloadbalancing:DescribeTargetGroups",
+        "elasticloadbalancing:DescribeTargetHealth",
+        "elasticloadbalancing:ModifyListener",
+        "elasticloadbalancing:ModifyTargetGroup",
+        "elasticloadbalancing:RegisterTargets",
+        "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+        "iam:CreateServiceLinkedRole",
+        "kms:DescribeKey"
+      ],
+      "Resource": [
+        "*"
+      ]
     }
   ]
 }
 ```
 
-Deploy files to AWS IAM:
+IAM policy for nodes with the `etcd` or `worker` role:
 
-```bash
-$ aws iam create-instance-profile --instance-profile-name rancher-node
-$ aws iam create-role --role-name rancher-node --assume-role-policy-document file://rancher-role.json
-$ aws iam put-role-policy --role-name rancher-node --policy-name rancher-policy --policy-document file://rancher-policy.json
-$ aws iam add-role-to-instance-profile --instance-profile rancher-node --role-name rancher-node
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:DescribeInstances",
+        "ec2:DescribeRegions",
+        "ecr:GetAuthorizationToken",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:GetRepositoryPolicy",
+        "ecr:DescribeRepositories",
+        "ecr:ListImages",
+        "ecr:BatchGetImage"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
 ```
 
-Set `IAM Instance Profile Name` in node template to `rancher-node`
+## Tagging AWS Resources
 
+The AWS cloud provider uses tagging to discover and manage resources, the following resources are not automatically tagged by Kubernetes or RKE:
 
-## Tagging Amazon Resources
+- **VPC**: The VPC used by the cluster
+- **Subnet**: The subnets used by the cluster
+- **EC2 instances**: All nodes launched for the cluster 
+- **Security Groups**: The security group(s) used by nodes in the cluster
 
-Any resources used in a Kubernetes cluster with the Amazon cloud provider must be tagged with a cluster ID.
+  >**Note:** If creating a `LoadBalancer` service and there is more than one security group attached to nodes, you must tag only one of the security groups as `owned` so that Kubernetes knows which group to add and remove rules. A single untagged security group is allowed, however, sharing this between clusters is not recommended.
 
-[Amazon Documentation: Tagging Your Amazon EC2 Resources](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html)
+[AWS Documentation: Tagging Your Amazon EC2 Resources](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html)
 
-The following resources need to tagged with a `ClusterID`:
+You must tag with one of the following:
 
-- **Nodes**: All hosts added in Rancher.
-- **Subnet**: The subnet used for your cluster
-- **Security Group**: The security group used for your cluster.
+| Key | Value |
+|---|---|
+| kubernetes.io/cluster/`<CLUSTERID>` | shared |
 
-	>**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer.
+`<CLUSTERID>` can be any string you choose. However, the same string must be used on every resource you tag. Setting the tag value to `owned` informs the cluster that all resources tagged with the `<CLUSTERID>` are owned and managed by this cluster only.
 
-The tag that should be used is:
+If you do not share resources between clusters, you can change the tag to:
 
-```
-Key=kubernetes.io/cluster/<CLUSTERID>, Value=owned
-```
+| Key | Value |
+|---|---|
+| kubernetes.io/cluster/`<CLUSTERID>` | owned |
 
-`<CLUSTERID>` can be any string you choose. However, the same string must be used on every resource you tag. Setting the tag value to `owned` informs the cluster that all resources tagged with the `<CLUSTERID>` are owned and managed by this cluster.
+## Tagging for Load Balancers
 
-If you share resources between clusters, you can change the tag to:
+When provisioning a `LoadBalancer` service Kubernetes will attempt to discover the correct subnets, this is also achieved by tags and requires adding additional subnet tags to ensure internet-facing and internal ELBs are created in the correct subnets.
 
-```
-Key=kubernetes.io/cluster/CLUSTERID, Value=shared
-```
+[AWS Documentation: Subnet tagging for load balancers](https://docs.aws.amazon.com/eks/latest/userguide/load-balancing.html#subnet-tagging-for-load-balancers)

From d722edc4bc83b66d7f3499f72ccd10882a74a232 Mon Sep 17 00:00:00 2001
From: Ahmad Iqbal Ali <ahmad@stakater.com>
Date: Tue, 19 May 2020 14:23:21 +0200
Subject: [PATCH 097/265] fix custom chart dir structure link

---
 content/rancher/v2.x/en/catalog/tutorial/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/catalog/tutorial/_index.md b/content/rancher/v2.x/en/catalog/tutorial/_index.md
index b8e6295742c..141cc544680 100644
--- a/content/rancher/v2.x/en/catalog/tutorial/_index.md
+++ b/content/rancher/v2.x/en/catalog/tutorial/_index.md
@@ -9,7 +9,7 @@ You can fill your custom catalogs with either Helm Charts or Rancher Charts, alt
 
 > For a complete walkthrough of developing charts, see the upstream Helm chart [developer reference](https://helm.sh/docs/chart_template_guide/).
 
-1. Within the GitHub repo that you're using as your custom catalog, create a directory structure that mirrors the structure listed in [Chart Directory Structure](#chart-directory-structure).
+1. Within the GitHub repo that you're using as your custom catalog, create a directory structure that mirrors the structure listed in [Chart Directory Structure](../creating-apps/#chart-directory-structure).
 
     Rancher requires this directory structure, although `app-readme.md` and `questions.yml` are optional.
 

From dbfefe89e8caea98fc09149e68f0d56c332d35dc Mon Sep 17 00:00:00 2001
From: Gaurav Mehta <gaurav@rancher.com>
Date: Thu, 28 May 2020 12:42:49 +1000
Subject: [PATCH 098/265] Added information on how to setup RemoteWriteSpec and
 RemoteReadSpec

---
 .../tools/monitoring/prometheus/_index.md     | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
index c5cadbc83aa..3f10bb0efa9 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
@@ -37,3 +37,27 @@ When configuring Prometheus and enabling the node exporter, enter a host port in
 By default, when you enable Prometheus for either a cluster or project, all monitoring data that Prometheus collects is stored on its own pod. With local storage, if the Prometheus or Grafana pods fail, all the data is lost. Rancher recommends configuring an external persistent storage to the cluster. With the external persistent storage, if the Prometheus or Grafana pods fail, the new pods can recover using data from the persistent storage.
 
 When enabling persistent storage for Prometheus or Grafana, specify the size of the persistent volume and select the [storage class]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#storage-classes).
+
+## Remote Storage
+
+>**Prerequisite:** Need a remote storage endpoint to be available. The possible list of integratinos is available [here](https://prometheus.io/docs/operating/integrations/)
+
+Using advanced options the users can specify remote storage integration for the prometheus installation as follows:
+
+```
+prometheus.remoteWrite[0].url = http://remote1/push
+prometheus.remoteWrite[0].remoteTimeout = 33s
+
+prometheus.remoteWrite[1].url = http://remote2/push
+
+
+prometheus.remoteRead[0].url = http://remote1/read
+prometheus.remoteRead[0].proxyUrl = http://proxy.url
+prometheus.remoteRead[0].bearerToken = token-value
+
+prometheus.remoteRead[1].url = http://remote2/read
+prometheus.remoteRead[1].remoteTimeout = 33s
+prometheus.remoteRead[1].readRecent = true
+```
+
+Additional fields can be set up based on the [ReadSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotereadspec) and [RemoteWriteSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotewritespec)
\ No newline at end of file

From fe421e721571b25aa840cefac9951ca20843f12d Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 1 Jun 2020 15:19:03 -0700
Subject: [PATCH 099/265] Fix typo

---
 .../en/cluster-admin/tools/monitoring/prometheus/_index.md  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
index 3f10bb0efa9..319a0c6ee2f 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
@@ -40,9 +40,9 @@ When enabling persistent storage for Prometheus or Grafana, specify the size of
 
 ## Remote Storage
 
->**Prerequisite:** Need a remote storage endpoint to be available. The possible list of integratinos is available [here](https://prometheus.io/docs/operating/integrations/)
+>**Prerequisite:** Need a remote storage endpoint to be available. The possible list of integrations is available [here](https://prometheus.io/docs/operating/integrations/)
 
-Using advanced options the users can specify remote storage integration for the prometheus installation as follows:
+Using advanced options, remote storage integration for the Prometheus installation can be configured as follows:
 
 ```
 prometheus.remoteWrite[0].url = http://remote1/push
@@ -60,4 +60,4 @@ prometheus.remoteRead[1].remoteTimeout = 33s
 prometheus.remoteRead[1].readRecent = true
 ```
 
-Additional fields can be set up based on the [ReadSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotereadspec) and [RemoteWriteSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotewritespec)
\ No newline at end of file
+Additional fields can be set up based on the [ReadSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotereadspec) and [RemoteWriteSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotewritespec)

From df131dd046a6c046f9e6940ce1edf049c614309c Mon Sep 17 00:00:00 2001
From: Bastian Hofmann <bashofmann@gmail.com>
Date: Fri, 22 May 2020 10:27:15 +0200
Subject: [PATCH 100/265] Document missing Rancher Helm chart options

---
 .../v2.x/en/installation/options/chart-options/_index.md  | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/chart-options/_index.md b/content/rancher/v2.x/en/installation/options/chart-options/_index.md
index 85978052274..e03b089d8b4 100644
--- a/content/rancher/v2.x/en/installation/options/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/options/chart-options/_index.md
@@ -22,25 +22,27 @@ weight: 276
 | `additionalTrustedCAs`         | false                                                 | `bool` - See [Additional Trusted CAs](#additional-trusted-cas)                                                                                    |
 | `addLocal`                     | "auto"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster)                       |
 | `antiAffinity`                 | "preferred"                                           | `string` - AntiAffinity rule for Rancher pods - "preferred, required"                                                                             |
+| `replicas`                     | 3                                                     | `int` - Number of replicas of Rancher pods                                                                                                        |
 | `auditLog.destination`         | "sidecar"                                             | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath"                                                           |
 | `auditLog.hostPath`            | "/var/log/rancher/audit"                              | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`)                                           |
-| `auditLog.level`               | 0                                                     | `int` - set the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) level. 0 is off. [0-3]                                 |
+| `auditLog.level`               | 0                                                     | `int` - set the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) level. 0 is off. [0-3]                                   |
 | `auditLog.maxAge`              | 1                                                     | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`)                      |
 | `auditLog.maxBackups`          | 1                                                     | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`)                               |
 | `auditLog.maxSize`             | 100                                                   | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`)    |
 | `busyboxImage`                 | "busybox"                                             | `string` - Image location for busybox image used to collect audit logs _Note: Available as of v2.2.0_                                             |
 | `debug`                        | false                                                 | `bool` - set debug flag on rancher server                                                                                                         |
-| `certmanager.version` | "" | `string` - set cert-manager compatibility 
-                                                |
+| `certmanager.version`          | ""                                                    | `string` - set cert-manager compatibility                                                                                                         |
 | `extraEnv`                     | []                                                    | `list` - set additional environment variables for Rancher _Note: Available as of v2.2.0_                                                          |
 | `imagePullSecrets`             | []                                                    | `list` - list of names of Secret resource containing private registry credentials                                                                 |
 | `ingress.extraAnnotations`     | {}                                                    | `map` - additional annotations to customize the ingress                                                                                           |
 | `ingress.configurationSnippet` | ""                                                    | `string` - Add additional Nginx configuration. Can be used for proxy configuration. _Note: Available as of v2.0.15, v2.1.10 and v2.2.4_           |
+| `letsEncrypt.ingress.class`    | ""                                                    | `string` - optional ingress class for the cert-manager acmesolver ingress that responds to the Let's Encrypt ACME challenges                      |
 | `proxy`                        | ""                                                    | `string` - HTTP[S] proxy server for Rancher                                                                                                       |
 | `noProxy`                      | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" | `string` - comma separated list of hostnames or ip address not to use the proxy                                                                   |
 | `resources`                    | {}                                                    | `map` - rancher pod resource requests & limits                                                                                                    |
 | `rancherImage`                 | "rancher/rancher"                                     | `string` - rancher image source                                                                                                                   |
 | `rancherImageTag`              | same as chart version                                 | `string` - rancher/rancher image tag                                                                                                              |
+| `rancherImagePullPolicy`       | "IfNotPresent"                                        | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent"                                                 |
 | `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
 | `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/ _Available as of v2.3.0_                  |
 | `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. _Available as of v2.3.0_ |

From 74abfec983a1dc4b5d7fe758d011a7ff796d48be Mon Sep 17 00:00:00 2001
From: Ansil H <11064902+ansilh@users.noreply.github.com>
Date: Sat, 25 Apr 2020 17:24:09 +0530
Subject: [PATCH 101/265] Added acme.sh as an example.

Added acme.sh as an example to give more clarity on tls.crt file creation.
---
 .../rancher/v2.x/en/installation/options/tls-secrets/_index.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
index 5dda63fe028..933bd4d5645 100644
--- a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
+++ b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
@@ -9,6 +9,9 @@ Kubernetes will create all the objects and services for Rancher, but it will not
 
 Combine the server certificate followed by any intermediate certificate(s) needed into a file named `tls.crt`. Copy your certificate key into a file named `tls.key`.
 
+For example, [acme.sh](https://acme.sh) provides server certificate and CA chains in `fullchain.cer` file. 
+This `fullchain.cer` should be renamed to `tls.crt` & certificate key file as `tls.key`.
+
 Use `kubectl` with the `tls` secret type to create the secrets.
 
 ```

From 0478532bc715f68be2e7141cae81fa28e02d61f8 Mon Sep 17 00:00:00 2001
From: Ansil H <11064902+ansilh@users.noreply.github.com>
Date: Sat, 25 Apr 2020 17:25:53 +0530
Subject: [PATCH 102/265] Added acme.sh as an example.

Added acme.sh as an example to give more clarity on tls.crt file creation.
---
 .../options/helm2/helm-rancher/tls-secrets/_index.md           | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
index 8920125b9f8..403cb958356 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
@@ -8,6 +8,9 @@ Kubernetes will create all the objects and services for Rancher, but it will not
 
 Combine the server certificate followed by any intermediate certificate(s) needed into a file named `tls.crt`. Copy your certificate key into a file named `tls.key`.
 
+For example, [acme.sh](https://acme.sh) provides server certificate and CA chains in `fullchain.cer` file. 
+This `fullchain.cer` should be renamed to `tls.crt` & certificate key file as `tls.key`.
+
 Use `kubectl` with the `tls` secret type to create the secrets.
 
 ```

From 76ab3e00f5cd2959a44aef3c0ee2c6e241b41b6d Mon Sep 17 00:00:00 2001
From: jgallucci32 <jgallucci32@users.noreply.github.com>
Date: Sat, 9 May 2020 12:13:58 -0700
Subject: [PATCH 103/265] AD FS attribute examples do not match description

The AD attributes for the AD FS configuration do not match the description. The attributes `givenname` and `name` are reversed. Correcting to match expected output.
---
 .../microsoft-adfs/rancher-adfs-setup/_index.md               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
index d87510c66dd..67706dddcf3 100644
--- a/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
@@ -21,8 +21,8 @@ After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/ranch
 
     | Field                     | Description                                                                                                                                                                                                    |
     | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-    | Display Name Field        | The AD attribute that contains the display name of users. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`                                                                 |
-    | User Name Field           | The AD attribute that contains the user name/given name. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`                                                                       |
+    | Display Name Field        | The AD attribute that contains the display name of users. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`                                                                      |
+    | User Name Field           | The AD attribute that contains the user name/given name. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`                                                                  |
     | UID Field                 | An AD attribute that is unique to every user. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn`                                                                                   |
     | Groups Field              | Make entries for managing group memberships. <br/><br/>Example: `http://schemas.xmlsoap.org/claims/Group`                                                                                                      |
     | Rancher API Host          | The URL for your Rancher Server.                                                                                                                                                                               |

From 3a4a236d6880b6d1e42d5c0ee0c16d040b85ae04 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 1 Jun 2020 15:53:58 -0700
Subject: [PATCH 104/265] Move CVEs and resolutions to separate page

---
 content/rancher/v2.x/en/security/_index.md     | 13 +------------
 content/rancher/v2.x/en/security/cve/_index.md | 17 +++++++++++++++++
 2 files changed, 18 insertions(+), 12 deletions(-)
 create mode 100644 content/rancher/v2.x/en/security/cve/_index.md

diff --git a/content/rancher/v2.x/en/security/_index.md b/content/rancher/v2.x/en/security/_index.md
index 384657223f3..e9451267cc1 100644
--- a/content/rancher/v2.x/en/security/_index.md
+++ b/content/rancher/v2.x/en/security/_index.md
@@ -94,18 +94,7 @@ Results:
 
 ### Rancher CVEs and Resolutions
 
-Rancher is committed to informing the community of security issues in our products. Rancher will publish CVEs (Common Vulnerabilities and Exposures) for issues we have resolved.
-
-| ID | Description | Date | Resolution |
-|----|-------------|------|------------|
-| [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321) |  Any project member with access to the `default` namespace can mount the `netes-default` service account in a pod and then use that pod to execute administrative privileged commands against the Kubernetes cluster.  | 29 Jan 2019 | [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11) - Rolling back from these versions or greater have specific [instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/).  |
-| [CVE-2019-6287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6287) | Project members continue to get access to namespaces from projects that they were removed from if they were added to more than one project. | 29 Jan 2019  |  [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11)  |
-| [CVE-2019-11202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11202) | The default admin, that is shipped with Rancher, will be re-created upon restart of Rancher despite being explicitly deleted. | 16 Apr 2019  |  [Rancher v2.2.2](https://github.com/rancher/rancher/releases/tag/v2.2.2), [Rancher v2.1.9](https://github.com/rancher/rancher/releases/tag/v2.1.9) and [Rancher v2.0.14](https://github.com/rancher/rancher/releases/tag/v2.0.14)  |
-| [CVE-2019-12274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12274) | Nodes using the built-in node drivers using a file path option allows the machine to read arbitrary files including sensitive ones from inside the Rancher server container. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)  |
-| [CVE-2019-12303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12303) |  Project owners can inject extra fluentd logging configurations that makes it possible to read files or execute arbitrary commands inside the fluentd container. Reported by Tyler Welton from Untamed Theory. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)   |
-| [CVE-2019-13209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13209) |  The vulnerability is known as a [Cross-Site Websocket Hijacking attack](https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html). This attack allows an exploiter to gain access to clusters managed by Rancher with the roles/permissions of a victim. It requires that a victim to be logged into a Rancher server and then access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the Kubernetes API with the permissions and identity of the victim. Reported by Matt Belisle and Alex Stevenson from Workiva. | 15 Jul 2019  |   [Rancher v2.2.5](https://github.com/rancher/rancher/releases/tag/v2.2.5), [Rancher v2.1.11](https://github.com/rancher/rancher/releases/tag/v2.1.11) and [Rancher v2.0.16](https://github.com/rancher/rancher/releases/tag/v2.0.16) |
-| [CVE-2019-14436](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14436) |  The vulnerability allows a member of a project that has access to edit role bindings to be able to assign themselves or others a cluster level role granting them administrator access to that cluster. The issue was found and reported by Michal Lipinski at Nokia. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
-| [CVE-2019-14435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14435) |  This vulnerability allows authenticated users to potentially extract otherwise private data out of IPs reachable from system service containers used by Rancher. This can include but not only limited to services such as cloud provider metadata services. Although Rancher allow users to configure whitelisted domains for system service access, this flaw can still be exploited by a carefully crafted HTTP request. The issue was found and reported by Matt Belisle and Alex Stevenson at Workiva. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
+Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to [this page.](./cve)
 
 ### Security Tips and Best Practices
 
diff --git a/content/rancher/v2.x/en/security/cve/_index.md b/content/rancher/v2.x/en/security/cve/_index.md
new file mode 100644
index 00000000000..6d709340049
--- /dev/null
+++ b/content/rancher/v2.x/en/security/cve/_index.md
@@ -0,0 +1,17 @@
+---
+title: Rancher CVEs and Resolutions
+weight: 200
+---
+
+Rancher is committed to informing the community of security issues in our products. Rancher will publish CVEs (Common Vulnerabilities and Exposures) for issues we have resolved.
+
+| ID | Description | Date | Resolution |
+|----|-------------|------|------------|
+| [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321) |  Any project member with access to the `default` namespace can mount the `netes-default` service account in a pod and then use that pod to execute administrative privileged commands against the Kubernetes cluster.  | 29 Jan 2019 | [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11) - Rolling back from these versions or greater have specific [instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/).  |
+| [CVE-2019-6287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6287) | Project members continue to get access to namespaces from projects that they were removed from if they were added to more than one project. | 29 Jan 2019  |  [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11)  |
+| [CVE-2019-11202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11202) | The default admin, that is shipped with Rancher, will be re-created upon restart of Rancher despite being explicitly deleted. | 16 Apr 2019  |  [Rancher v2.2.2](https://github.com/rancher/rancher/releases/tag/v2.2.2), [Rancher v2.1.9](https://github.com/rancher/rancher/releases/tag/v2.1.9) and [Rancher v2.0.14](https://github.com/rancher/rancher/releases/tag/v2.0.14)  |
+| [CVE-2019-12274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12274) | Nodes using the built-in node drivers using a file path option allows the machine to read arbitrary files including sensitive ones from inside the Rancher server container. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)  |
+| [CVE-2019-12303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12303) |  Project owners can inject extra fluentd logging configurations that makes it possible to read files or execute arbitrary commands inside the fluentd container. Reported by Tyler Welton from Untamed Theory. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)   |
+| [CVE-2019-13209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13209) |  The vulnerability is known as a [Cross-Site Websocket Hijacking attack](https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html). This attack allows an exploiter to gain access to clusters managed by Rancher with the roles/permissions of a victim. It requires that a victim to be logged into a Rancher server and then access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the Kubernetes API with the permissions and identity of the victim. Reported by Matt Belisle and Alex Stevenson from Workiva. | 15 Jul 2019  |   [Rancher v2.2.5](https://github.com/rancher/rancher/releases/tag/v2.2.5), [Rancher v2.1.11](https://github.com/rancher/rancher/releases/tag/v2.1.11) and [Rancher v2.0.16](https://github.com/rancher/rancher/releases/tag/v2.0.16) |
+| [CVE-2019-14436](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14436) |  The vulnerability allows a member of a project that has access to edit role bindings to be able to assign themselves or others a cluster level role granting them administrator access to that cluster. The issue was found and reported by Michal Lipinski at Nokia. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
+| [CVE-2019-14435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14435) |  This vulnerability allows authenticated users to potentially extract otherwise private data out of IPs reachable from system service containers used by Rancher. This can include but not only limited to services such as cloud provider metadata services. Although Rancher allow users to configure whitelisted domains for system service access, this flaw can still be exploited by a carefully crafted HTTP request. The issue was found and reported by Matt Belisle and Alex Stevenson at Workiva. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
\ No newline at end of file

From 3fcebbb2d28d5e84d04a69d418dd8bf5ab475f09 Mon Sep 17 00:00:00 2001
From: Maggie Liu <maggie.liu@rancher.com>
Date: Mon, 1 Jun 2020 18:00:10 -0700
Subject: [PATCH 105/265] Remove the broken link in enable Istio page

---
 .../tools/istio/setup/enable-istio-in-cluster/_index.md         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/_index.md
index 9ea611c7c45..a98090a28ca 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/_index.md
@@ -17,7 +17,7 @@ A Rancher [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/glob
 
 **Result:** Istio is enabled at the cluster level.
 
-The Istio application, `cluster-istio`, is added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the cluster's `system` project.
+The Istio application, `cluster-istio`, is added as an application to the cluster's `system` project.
 
 When Istio is enabled in the cluster, the label for Istio sidecar auto injection,`istio-injection=enabled`, will be automatically added to each new namespace in this cluster. This automatically enables Istio sidecar injection in all new workloads that are deployed in those namespaces. You will need to manually enable Istio in preexisting namespaces and workloads.
 

From e57fb9abacab1178ff9962afbb17ceaf8dd0e49c Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 2 Jun 2020 15:47:37 -0700
Subject: [PATCH 106/265] Add Raspbian Buster to K3s supported OSs

---
 .../installation-requirements/_index.md             | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/content/k3s/latest/en/installation/installation-requirements/_index.md b/content/k3s/latest/en/installation/installation-requirements/_index.md
index ee053e09e0c..68e95302aca 100644
--- a/content/k3s/latest/en/installation/installation-requirements/_index.md
+++ b/content/k3s/latest/en/installation/installation-requirements/_index.md
@@ -11,18 +11,23 @@ Whether you're configuring a K3s cluster to run in a Docker or Kubernetes setup,
 
 ## Prerequisites
 
-*    Two nodes cannot have the same hostname. If all your nodes have the same hostname, use the `--with-node-id` option to append a random suffix for each node, or otherwise devise a unique name to pass with `--node-name` or `$K3S_NODE_NAME` for each node you add to the cluster.
+Two nodes cannot have the same hostname.
+
+If all your nodes have the same hostname, use the `--with-node-id` option to append a random suffix for each node, or otherwise devise a unique name to pass with `--node-name` or `$K3S_NODE_NAME` for each node you add to the cluster.
 
 ## Operating Systems
 
-K3s should run on just about any flavor of Linux. However, K3s is tested on the following operating systems and their subsequent non-major releases.
+K3s should run on just about any flavor of Linux.
+
+K3s is officially supported and tested on the following operating systems and their subsequent non-major releases:
 
 *    Ubuntu 16.04 (amd64)
 *    Ubuntu 18.04 (amd64)
+*    Raspbian Buster*
 
-> * If you are using **Raspbian Buster**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster) to switch to legacy iptables.
-> * If you are using **Alpine Linux**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#additional-preparation-for-alpine-linux-setup) for additional setup.
+\* If you are using **Raspbian Buster**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster) to switch to legacy iptables.
 
+If you are using **Alpine Linux**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#additional-preparation-for-alpine-linux-setup) for additional setup.
 
 ## Hardware
 

From 05f45696071bc503b529579e47100ea55090cc51 Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Mon, 1 Jun 2020 17:12:19 -0700
Subject: [PATCH 107/265] Add note for annotation of sidecar injection

---
 .../tools/istio/setup/enable-istio-in-namespace/_index.md      | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
index 9065424e534..a085bfa331e 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
@@ -42,4 +42,7 @@ To add the annotation to a workload,
 
 **Result:** The Istio sidecar will not be injected into the workload.
 
+> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. This is a temporary workaround and will disable Istio for any traffic to/from the annoted Pod. Keep in mind this may not allow you to continue to use a Job for Integration Testing as the Job will not have access to the service mesh.
+
+
 ### [Next: Set up Taints and Tolerations]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file

From 2d20c56ef880140d7958c6e4e68536c913db297a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 3 Jun 2020 00:19:28 -0700
Subject: [PATCH 108/265] Add Istio workload annotation to troubleshooting
 section

---
 .../setup/enable-istio-in-namespace/_index.md |  3 +-
 .../kubernetes-resources/_index.md            | 70 +++++++++++++------
 2 files changed, 51 insertions(+), 22 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
index a085bfa331e..13ba48cdb0f 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
@@ -42,7 +42,6 @@ To add the annotation to a workload,
 
 **Result:** The Istio sidecar will not be injected into the workload.
 
-> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. This is a temporary workaround and will disable Istio for any traffic to/from the annoted Pod. Keep in mind this may not allow you to continue to use a Job for Integration Testing as the Job will not have access to the service mesh.
-
+> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. This is a temporary workaround and will disable Istio for any traffic to/from the annotated Pod. Keep in mind this may not allow you to continue to use a Job for integration testing, as the Job will not have access to the service mesh.
 
 ### [Next: Set up Taints and Tolerations]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md b/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md
index f4a6b8aecf1..e76ad558cc3 100644
--- a/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md
+++ b/content/rancher/v2.x/en/troubleshooting/kubernetes-resources/_index.md
@@ -7,9 +7,33 @@ The commands/steps listed on this page can be used to check the most important K
 
 Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
 
-### Nodes
+- [Nodes](#nodes)
+  - [Get nodes](#get-nodes)
+  - [Get node conditions](#get-node-conditions)
+- [Kubernetes leader election](#kubernetes-leader-election)
+  - [Kubernetes controller manager leader](#kubernetes-controller-manager-leader)
+  - [Kubernetes scheduler leader](#kubernetes-scheduler-leader)
+- [Ingress controller](#ingress-controller)
+  - [Pod details](#pod-details)
+  - [Pod container logs](#pod-container-logs)
+  - [Namespace events](#namespace-events)
+  - [Debug logging](#debug-logging)
+  - [Check configuration](#check-configuration)
+- [Rancher agents](#rancher-agents)
+  - [cattle-node-agent](#cattle-node-agent)
+  - [cattle-cluster-agent](#cattle-cluster-agent)
+- [Jobs and pods](#jobs-and-pods)
+  - [Check that pods or jobs have status Running/Completed](#check-that-pods-or-jobs-have-status-running-completed)
+  - [Describe pod](#describe-pod)
+  - [Pod container logs](#pod-container-logs)
+  - [Describe job](#describe-job)
+  - [Logs from the containers of pods of the job](#logs-from-the-containers-of-pods-of-the-job)
+  - [Evicted pods](#evicted-pods)
+  - [Job does not complete](#job-does-not-complete)
 
-#### Get nodes
+# Nodes
+
+### Get nodes
 
 Run the command below and check the following:
 
@@ -32,7 +56,7 @@ etcd-0           Ready    etcd           31m   v1.13.5   138.68.180.33    <none>
 worker-0         Ready    worker         30m   v1.13.5   139.59.179.88    <none>        Ubuntu 18.04.2 LTS   4.15.0-47-generic   docker://18.9.5
 ```
 
-#### Get node conditions
+### Get node conditions
 
 Run the command below to list nodes with [Node Conditions](https://kubernetes.io/docs/concepts/architecture/nodes/#condition)
 
@@ -52,9 +76,9 @@ Example output:
 worker-0: DiskPressure:True
 ```
 
-### Kubernetes leader election
+# Kubernetes leader election
 
-#### Kubernetes Controller Manager leader
+### Kubernetes Controller Manager leader
 
 The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `kube-controller-manager` endpoint (in this example, `controlplane-0`).
 
@@ -63,7 +87,7 @@ kubectl -n kube-system get endpoints kube-controller-manager -o jsonpath='{.meta
 {"holderIdentity":"controlplane-0_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","leaseDurationSeconds":15,"acquireTime":"2018-12-27T08:59:45Z","renewTime":"2018-12-27T09:44:57Z","leaderTransitions":0}>
 ```
 
-#### Kubernetes Scheduler leader
+### Kubernetes Scheduler leader
 
 The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `kube-scheduler` endpoint (in this example, `controlplane-0`).
 
@@ -72,7 +96,7 @@ kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.anno
 {"holderIdentity":"controlplane-0_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","leaseDurationSeconds":15,"acquireTime":"2018-12-27T08:59:45Z","renewTime":"2018-12-27T09:44:57Z","leaderTransitions":0}>
 ```
 
-### Ingress Controller
+# Ingress Controller
 
 The default Ingress Controller is NGINX and is deployed as a DaemonSet in the `ingress-nginx` namespace. The pods are only scheduled to nodes with the `worker` role.
 
@@ -94,25 +118,25 @@ nginx-ingress-controller-8wxhm          1/1       Running   0          13m
 
 If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.
 
-#### Pod details
+### Pod details
 
 ```
 kubectl -n ingress-nginx describe pods -l app=ingress-nginx
 ```
 
-#### Pod container logs
+### Pod container logs
 
 ```
 kubectl -n ingress-nginx logs -l app=ingress-nginx
 ```
 
-#### Namespace events
+### Namespace events
 
 ```
 kubectl -n ingress-nginx get events
 ```
 
-#### Debug logging
+### Debug logging
 
 To enable debug logging:
 
@@ -120,7 +144,7 @@ To enable debug logging:
 kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
 ```
 
-#### Check configuration
+### Check configuration
 
 Retrieve generated configuration in each pod:
 
@@ -128,7 +152,7 @@ Retrieve generated configuration in each pod:
 kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
 ```
 
-### Rancher agents
+# Rancher agents
 
 Communication to the cluster (Kubernetes API via `cattle-cluster-agent`) and communication to the nodes (cluster provisioning via `cattle-node-agent`) is done through Rancher agents.
 
@@ -180,9 +204,9 @@ Check logging of cattle-cluster-agent pod:
 kubectl -n cattle-system logs -l app=cattle-cluster-agent
 ```
 
-### Generic
+# Jobs and Pods
 
-#### All pods/jobs should have status **Running**/**Completed**
+### Check that pods or jobs have status **Running**/**Completed**
 
 To check, run the command:
 
@@ -192,13 +216,13 @@ kubectl get pods --all-namespaces
 
 If a pod is not in **Running** state, you can dig into the root cause by running:
 
-##### Describe pod
+### Describe pod
 
 ```
 kubectl describe pod POD_NAME -n NAMESPACE
 ```
 
-##### Pod container logs
+### Pod container logs
 
 ```
 kubectl logs POD_NAME -n NAMESPACE
@@ -206,19 +230,19 @@ kubectl logs POD_NAME -n NAMESPACE
 
 If a job is not in **Completed** state, you can dig into the root cause by running:
 
-##### Describe job
+### Describe job
 
 ```
 kubectl describe job JOB_NAME -n NAMESPACE
 ```
 
-##### Logs from the containers of pods of the job
+### Logs from the containers of pods of the job
 
 ```
 kubectl logs -l job-name=JOB_NAME -n NAMESPACE
 ```
 
-#### Evicted pods
+### Evicted pods
 
 Pods can be evicted based on [eviction signals](https://kubernetes.io/docs/tasks/administer-cluster/out-of-resource/#eviction-policy).
 
@@ -239,3 +263,9 @@ Retrieve a list of evicted pods, scheduled node and the reason:
 ```
 kubectl get pods --all-namespaces -o go-template='{{range .items}}{{if eq .status.phase "Failed"}}{{if eq .status.reason "Evicted"}}{{.metadata.name}}{{" "}}{{.metadata.namespace}}{{"\n"}}{{end}}{{end}}{{end}}' | while read epod enamespace; do kubectl -n $enamespace get pod $epod -o=custom-columns=NAME:.metadata.name,NODE:.spec.nodeName,MSG:.status.message; done
 ```
+
+### Job does not complete
+
+If you have enabled Istio, and you are having issues with a Job you deployed not completing, you will need to add an annotation to your pod using [these steps.](../../cluster-admin/tools/istio/setup/enable-istio-in-namespace/#excluding-workloads-from-being-injected-with-the-istio-sidecar)
+
+Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. This is a temporary workaround and will disable Istio for any traffic to/from the annotated Pod. Keep in mind this may not allow you to continue to use a Job for integration testing, as the Job will not have access to the service mesh.
\ No newline at end of file

From 56d8944036b94afc7c44d3d81b76b82806396394 Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Wed, 3 Jun 2020 09:33:04 -0700
Subject: [PATCH 109/265] Remove unnecessary details

---
 .../tools/istio/setup/enable-istio-in-namespace/_index.md    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
index 13ba48cdb0f..2f1f6d74786 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
@@ -42,6 +42,7 @@ To add the annotation to a workload,
 
 **Result:** The Istio sidecar will not be injected into the workload.
 
-> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. This is a temporary workaround and will disable Istio for any traffic to/from the annotated Pod. Keep in mind this may not allow you to continue to use a Job for integration testing, as the Job will not have access to the service mesh.
+> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. 
 
-### [Next: Set up Taints and Tolerations]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file
+
+### [Next: Select the Nodes ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file

From 117ae2db0797874998e71931a8f2d6ef4cbb4fa0 Mon Sep 17 00:00:00 2001
From: David Noland <dnoland@rancher.com>
Date: Thu, 4 Jun 2020 11:52:09 -0700
Subject: [PATCH 110/265] Minor formatting and spacing improvements in table

---
 .../en/installation/requirements/_index.md    | 32 +++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/requirements/_index.md b/content/rancher/v2.x/en/installation/requirements/_index.md
index ec293b2fa0e..64f12941d77 100644
--- a/content/rancher/v2.x/en/installation/requirements/_index.md
+++ b/content/rancher/v2.x/en/installation/requirements/_index.md
@@ -66,30 +66,30 @@ These requirements apply to each host in an [RKE Kubernetes cluster where the Ra
 
 Performance increased in Rancher v2.4.0. For the requirements of Rancher prior to v2.4.0, refer to [this section.](#cpu-and-memory-for-rancher-prior-to-v2-4-0)
 
-| Deployment Size | Clusters  | Nodes      | vCPUs  | RAM    |
-| --------------- | --------- | ---------- | -------| ------- |
-| Small           | Up to 150  | Up to 1500   | 2      | 8 GB   |
-| Medium          | Up to 300  | Up to 3000 | 4      | 16 GB  |
-| Large           | Up to 500  | Up to 5000  | 8      | 32 GB  |
-| X-Large         | Up to 1000 | Up to 10000 | 16     | 64 GB  |
-| XX-Large        | Up to 2000 | Up to 20000  | 32     | 128GB |
+| Deployment Size | Clusters   | Nodes        | vCPUs  | RAM     |
+| --------------- | ---------- | ------------ | -------| ------- |
+| Small           | Up to 150  | Up to 1500   | 2      | 8 GB    |
+| Medium          | Up to 300  | Up to 3000   | 4      | 16 GB   |
+| Large           | Up to 500  | Up to 5000   | 8      | 32 GB   |
+| X-Large         | Up to 1000 | Up to 10,000 | 16     | 64 GB   |
+| XX-Large        | Up to 2000 | Up to 20,000 | 32     | 128 GB  |
 
-[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20000 nodes. 
+[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. 
 {{% /tab %}}
 
 {{% tab "K3s Install Requirements" %}}
 
 These requirements apply to each host in a [K3s Kubernetes cluster where the Rancher server is installed.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/)
 
-| Deployment Size | Clusters   | Nodes        | vCPUs  | RAM      | Database Size |
-| --------------- | ---------- | ------------ | -------| ---------| ------------ |
-| Small           | Up to 150  | Up to 1500     | 2      | 8 GB     | 2 cores 4GB + 1000 IOPS |
-| Medium          | Up to 300  | Up to 3000    | 4      | 16 GB    | 2 cores 4GB + 1000 IOPS |
-| Large           | Up to 500  | Up to 5000    | 8      | 32 GB    | 2 cores 4GB + 1000 IOPS |
-| X-Large         | Up to 1000 | Up to 10000   | 16     | 64 GB    | 2 cores 4GB + 1000 IOPS |
-| XX-Large        | Up to 2000 | Up to 20000  | 32     | 128GB    | 2 cores 4GB + 1000 IOPS |
+| Deployment Size | Clusters   | Nodes        | vCPUs  | RAM      | Database Size             |
+| --------------- | ---------- | ------------ | -------| ---------| ------------------------- |
+| Small           | Up to 150  | Up to 1500   | 2      | 8 GB     | 2 cores, 4 GB + 1000 IOPS |
+| Medium          | Up to 300  | Up to 3000   | 4      | 16 GB    | 2 cores, 4 GB + 1000 IOPS |
+| Large           | Up to 500  | Up to 5000   | 8      | 32 GB    | 2 cores, 4 GB + 1000 IOPS |
+| X-Large         | Up to 1000 | Up to 10,000 | 16     | 64 GB    | 2 cores, 4 GB + 1000 IOPS |
+| XX-Large        | Up to 2000 | Up to 20,000 | 32     | 128 GB   | 2 cores, 4 GB + 1000 IOPS |
 
-[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20000 nodes. 
+[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. 
 
 {{% /tab %}}
 

From ff2087f5302bead1a9afeb81dda66db72d46a9af Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Thu, 4 Jun 2020 09:58:54 -0700
Subject: [PATCH 111/265] EIO-3: clone from previous version of CIS docs

---
 .../en/security/benchmark-2.4.3/_index.md     | 2191 +++++++++++++++++
 .../en/security/hardening-2.4.3/_index.md     |  712 ++++++
 2 files changed, 2903 insertions(+)
 create mode 100644 content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
 create mode 100644 content/rancher/v2.x/en/security/hardening-2.4.3/_index.md

diff --git a/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
new file mode 100644
index 00000000000..aef7846d23d
--- /dev/null
+++ b/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
@@ -0,0 +1,2191 @@
+---
+title: CIS Benchmark Rancher Self-Assessment Guide - v2.3.5
+weight: 105
+---
+
+### CIS Kubernetes Benchmark 1.5 - Rancher 2.3.5 with Kubernetes 1.15
+
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.3.5/Rancher_Benchmark_Assessment.pdf)
+
+#### Overview
+
+This document is a companion to the Rancher v2.3.5 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
+
+This guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.3.5 | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5
+
+Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher-created clusters.
+
+This document is to be used by Rancher operators, security teams, auditors and decision makers.
+
+For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.5. You can download the benchmark after logging in to [CISecurity.org]( https://www.cisecurity.org/benchmark/kubernetes/).
+
+#### Testing controls methodology
+
+Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files.
+
+Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher Labs are provided for testing.
+When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the [jq](https://stedolan.github.io/jq/) and [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) (with valid config) tools to and are required in the testing and evaluation of test results.
+
+> NOTE: only scored tests are covered in this guide.
+
+### Controls
+
+---
+## 1 Master Node Security Configuration
+### 1.1 Master Node Configuration Files 
+
+#### 1.1.1 Ensure that the API server pod specification file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the API server. All configuration is passed in as arguments at container run time.
+
+#### 1.1.2 Ensure that the API server pod specification file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the API server. All configuration is passed in as arguments at container run time.
+
+#### 1.1.3 Ensure that the controller manager pod specification file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time.
+
+#### 1.1.4 Ensure that the controller manager pod specification file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time.
+
+#### 1.1.5 Ensure that the scheduler pod specification file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time.
+
+#### 1.1.6 Ensure that the scheduler pod specification file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time.
+
+#### 1.1.7 Ensure that the etcd pod specification file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.
+
+#### 1.1.8 Ensure that the etcd pod specification file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.
+
+#### 1.1.11 Ensure that the etcd data directory permissions are set to `700` or more restrictive (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`,
+from the below command:
+
+``` bash
+ps -ef | grep etcd
+```
+
+Run the below command (based on the etcd data directory found above). For example,
+
+``` bash
+chmod 700 /var/lib/etcd
+```
+
+**Audit Script:** 1.1.11.sh
+
+```
+#!/bin/bash -e
+
+etcd_bin=${1}
+
+test_dir=$(ps -ef | grep ${etcd_bin} | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%')
+
+docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut -d ":" -f 1 | xargs stat -c %a
+```
+
+**Audit Execution:**
+
+```
+./1.1.11.sh etcd
+```
+
+**Expected result**:
+
+```
+'700' is equal to '700'
+```
+
+#### 1.1.12 Ensure that the etcd data directory ownership is set to `etcd:etcd` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+On the etcd server node, get the etcd data directory, passed as an argument `--data-dir`,
+from the below command:
+
+``` bash
+ps -ef | grep etcd
+```
+
+Run the below command (based on the etcd data directory found above).
+For example,
+``` bash
+chown etcd:etcd /var/lib/etcd
+``` 
+
+**Audit Script:** 1.1.12.sh
+
+```
+#!/bin/bash -e
+
+etcd_bin=${1}
+
+test_dir=$(ps -ef | grep ${etcd_bin} | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%')
+
+docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut -d ":" -f 1 | xargs stat -c %U:%G
+```
+
+**Audit Execution:**
+
+```
+./1.1.12.sh etcd
+```
+
+**Expected result**:
+
+```
+'etcd:etcd' is present
+```
+
+#### 1.1.13 Ensure that the `admin.conf` file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run.
+We recommend that this `kube_config_cluster.yml` file be kept in secure store.
+
+#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored) 
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run.
+We recommend that this `kube_config_cluster.yml` file be kept in secure store.
+
+#### 1.1.15 Ensure that the `scheduler.conf` file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time.
+
+#### 1.1.16 Ensure that the `scheduler.conf` file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the scheduler. All configuration is passed in as arguments at container run time.
+
+#### 1.1.17 Ensure that the `controller-manager.conf` file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time.
+
+#### 1.1.18 Ensure that the `controller-manager.conf` file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the controller manager. All configuration is passed in as arguments at container run time.
+
+#### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to `root:root` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Run the below command (based on the file location on your system) on the master node.
+For example,
+
+``` bash
+chown -R root:root /etc/kubernetes/ssl
+```
+
+**Audit:**
+
+```
+stat -c %U:%G /etc/kubernetes/ssl
+```
+
+**Expected result**:
+
+```
+'root:root' is present
+```
+
+#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored) 
+
+**Result:** PASS
+
+**Remediation:**
+Run the below command (based on the file location on your system) on the master node.
+For example,
+
+``` bash
+chmod -R 644 /etc/kubernetes/ssl
+```
+
+**Audit Script:** check_files_permissions.sh
+
+```
+#!/usr/bin/env bash
+
+# This script is used to ensure the file permissions are set to 644 or
+# more restrictive for all files in a given directory or a wildcard
+# selection of files
+#
+# inputs:
+#   $1 = /full/path/to/directory or /path/to/fileswithpattern
+#                                   ex: !(*key).pem
+#
+#   $2 (optional) = permission (ex: 600)
+#
+# outputs:
+#   true/false
+
+# Turn on "extended glob" for use of '!' in wildcard
+shopt -s extglob
+
+# Turn off history to avoid surprises when using '!'
+set -H
+
+USER_INPUT=$1
+
+if [[ "${USER_INPUT}" == "" ]]; then
+  echo "false"
+  exit
+fi
+
+
+if [[ -d ${USER_INPUT} ]]; then
+  PATTERN="${USER_INPUT}/*"
+else
+  PATTERN="${USER_INPUT}"
+fi
+
+PERMISSION=""
+if [[ "$2" != "" ]]; then
+  PERMISSION=$2
+fi
+
+FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN})
+
+while read -r fileInfo; do
+  p=$(echo ${fileInfo} | cut -d' ' -f2)
+
+  if [[ "${PERMISSION}" != "" ]]; then
+    if [[ "$p" != "${PERMISSION}" ]]; then
+      echo "false"
+      exit
+    fi
+  else
+    if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then
+      echo "false"
+      exit
+    fi
+  fi
+done <<< "${FILES_PERMISSIONS}"
+
+
+echo "true"
+exit
+```
+
+**Audit Execution:**
+
+```
+./check_files_permissions.sh '/etc/kubernetes/ssl/*.pem'
+```
+
+**Expected result**:
+
+```
+'true' is present
+```
+
+#### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to `600` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Run the below command (based on the file location on your system) on the master node.
+For example,
+
+``` bash
+chmod -R 600 /etc/kubernetes/ssl/certs/serverca
+```
+
+**Audit Script:** 1.1.21.sh
+
+```
+#!/bin/bash -e
+check_dir=${1:-/etc/kubernetes/ssl}
+
+for file in $(find ${check_dir} -name "*key.pem"); do
+	file_permission=$(stat -c %a ${file})
+  if [[ "${file_permission}" == "600" ]]; then
+    continue
+  else
+    echo "FAIL: ${file} ${file_permission}"
+    exit 1
+  fi
+done
+
+echo "pass"
+```
+
+**Audit Execution:**
+
+```
+./1.1.21.sh /etc/kubernetes/ssl
+```
+
+**Expected result**:
+
+```
+'pass' is present
+```
+
+### 1.2 API Server
+
+#### 1.2.2 Ensure that the `--basic-auth-file` argument is not set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the documentation and configure alternate mechanisms for authentication. Then,
+edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and remove the `--basic-auth-file=<filename>` parameter.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--basic-auth-file' is not present
+```
+
+#### 1.2.3 Ensure that the `--token-auth-file` parameter is not set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the documentation and configure alternate mechanisms for authentication. Then,
+edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and remove the `--token-auth-file=<filename>` parameter.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--token-auth-file' is not present
+```
+
+#### 1.2.4 Ensure that the `--kubelet-https` argument is set to true (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
+on the master node and remove the `--kubelet-https` parameter.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--kubelet-https' is present OR '--kubelet-https' is not present
+```
+
+#### 1.2.5 Ensure that the `--kubelet-client-certificate` and `--kubelet-client-key` arguments are set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and set up the TLS connection between the
+apiserver and kubelets. Then, edit API server pod specification file
+`/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the
+kubelet client certificate and key parameters as below.
+
+``` bash
+--kubelet-client-certificate=<path/to/client-certificate-file>
+--kubelet-client-key=<path/to/client-key-file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present
+```
+
+#### 1.2.6 Ensure that the `--kubelet-certificate-authority` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and setup the TLS connection between
+the apiserver and kubelets. Then, edit the API server pod specification file
+`/etc/kubernetes/manifests/kube-apiserver.yaml` on the master node and set the
+`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority.
+`--kubelet-certificate-authority=<ca-string>`
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--kubelet-certificate-authority' is present
+```
+
+#### 1.2.7 Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--authorization-mode` parameter to values other than `AlwaysAllow`.
+One such example could be as below.
+
+``` bash
+--authorization-mode=RBAC
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'Node,RBAC' not have 'AlwaysAllow'
+```
+
+#### 1.2.8 Ensure that the `--authorization-mode` argument includes `Node` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--authorization-mode` parameter to a value that includes `Node`.
+
+``` bash
+--authorization-mode=Node,RBAC
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'Node,RBAC' has 'Node'
+```
+
+#### 1.2.9 Ensure that the `--authorization-mode` argument includes `RBAC` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--authorization-mode` parameter to a value that includes RBAC,
+for example:
+
+``` bash
+--authorization-mode=Node,RBAC
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'Node,RBAC' has 'RBAC'
+```
+
+#### 1.2.11 Ensure that the admission control plugin `AlwaysAdmit` is not set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and either remove the `--enable-admission-plugins` parameter, or set it to a
+value that does not include `AlwaysAdmit`.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present
+```
+
+#### 1.2.14 Ensure that the admission control plugin `ServiceAccount` is set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the documentation and create ServiceAccount objects as per your environment.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and ensure that the `--disable-admission-plugins` parameter is set to a
+value that does not include `ServiceAccount`.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'ServiceAccount' OR '--enable-admission-plugins' is not present
+```
+
+#### 1.2.15 Ensure that the admission control plugin `NamespaceLifecycle` is set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--disable-admission-plugins` parameter to
+ensure it does not include `NamespaceLifecycle`.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present
+```
+
+#### 1.2.16 Ensure that the admission control plugin `PodSecurityPolicy` is set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the documentation and create Pod Security Policy objects as per your environment.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--enable-admission-plugins` parameter to a
+value that includes `PodSecurityPolicy`:
+
+``` bash
+--enable-admission-plugins=...,PodSecurityPolicy,...
+```
+
+Then restart the API Server.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'PodSecurityPolicy'
+```
+
+#### 1.2.17 Ensure that the admission control plugin `NodeRestriction` is set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and configure `NodeRestriction` plug-in on kubelets.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--enable-admission-plugins` parameter to a
+value that includes `NodeRestriction`.
+
+``` bash
+--enable-admission-plugins=...,NodeRestriction,...
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit' has 'NodeRestriction'
+```
+
+#### 1.2.18 Ensure that the `--insecure-bind-address` argument is not set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and remove the `--insecure-bind-address` parameter.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--insecure-bind-address' is not present
+```
+
+#### 1.2.19 Ensure that the `--insecure-port` argument is set to `0` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the below parameter.
+
+``` bash
+--insecure-port=0
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'0' is equal to '0'
+```
+
+#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored) 
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and either remove the `--secure-port` parameter or
+set it to a different **(non-zero)** desired port.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+6443 is greater than 0 OR '--secure-port' is not present
+```
+
+#### 1.2.21 Ensure that the `--profiling` argument is set to `false` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the below parameter.
+
+``` bash
+--profiling=false
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'false' is equal to 'false'
+```
+
+#### 1.2.22 Ensure that the `--audit-log-path` argument is set (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--audit-log-path` parameter to a suitable path and
+file where you would like audit logs to be written, for example:
+
+``` bash
+--audit-log-path=/var/log/apiserver/audit.log
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--audit-log-path' is present
+```
+
+#### 1.2.23 Ensure that the `--audit-log-maxage` argument is set to `30` or as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--audit-log-maxage` parameter to `30` or as an appropriate number of days:
+
+``` bash
+--audit-log-maxage=30
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+30 is greater or equal to 30
+```
+
+#### 1.2.24 Ensure that the `--audit-log-maxbackup` argument is set to `10` or as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--audit-log-maxbackup` parameter to `10` or to an appropriate
+value.
+
+``` bash
+--audit-log-maxbackup=10
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+10 is greater or equal to 10
+```
+
+#### 1.2.25 Ensure that the `--audit-log-maxsize` argument is set to `100` or as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--audit-log-maxsize` parameter to an appropriate size in **MB**.
+For example, to set it as `100` **MB**:
+
+``` bash
+--audit-log-maxsize=100
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+100 is greater or equal to 100
+```
+
+#### 1.2.26 Ensure that the `--request-timeout` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+and set the below parameter as appropriate and if needed.
+For example,
+
+``` bash
+--request-timeout=300s
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--request-timeout' is not present OR '--request-timeout' is present
+```
+
+#### 1.2.27 Ensure that the `--service-account-lookup` argument is set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the below parameter.
+
+``` bash
+--service-account-lookup=true
+```
+
+Alternatively, you can delete the `--service-account-lookup` parameter from this file so
+that the default takes effect.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--service-account-lookup' is not present OR 'true' is equal to 'true'
+```
+
+#### 1.2.28 Ensure that the `--service-account-key-file` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--service-account-key-file` parameter
+to the public key file for service accounts:
+
+``` bash
+--service-account-key-file=<filename>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--service-account-key-file' is present
+```
+
+#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored) 
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the **etcd** certificate and **key** file parameters.
+
+``` bash
+--etcd-certfile=<path/to/client-certificate-file>
+--etcd-keyfile=<path/to/client-key-file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--etcd-certfile' is present AND '--etcd-keyfile' is present
+```
+
+#### 1.2.30 Ensure that the `--tls-cert-file` and `--tls-private-key-file` arguments are set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the TLS certificate and private key file parameters.
+
+``` bash
+--tls-cert-file=<path/to/tls-certificate-file>
+--tls-private-key-file=<path/to/tls-key-file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--tls-cert-file' is present AND '--tls-private-key-file' is present
+```
+
+#### 1.2.31 Ensure that the `--client-ca-file` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the client certificate authority file.
+
+``` bash
+--client-ca-file=<path/to/client-ca-file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--client-ca-file' is present
+```
+
+#### 1.2.32 Ensure that the `--etcd-cafile` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the etcd certificate authority file parameter.
+
+``` bash
+--etcd-cafile=<path/to/ca-file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--etcd-cafile' is present
+```
+
+#### 1.2.33 Ensure that the `--encryption-provider-config` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and configure a EncryptionConfig file.
+Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml`
+on the master node and set the `--encryption-provider-config` parameter to the path of that file:
+
+``` bash
+--encryption-provider-config=</path/to/EncryptionConfig/File>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-apiserver | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--encryption-provider-config' is present
+```
+
+#### 1.2.34 Ensure that encryption providers are appropriately configured (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the Kubernetes documentation and configure a `EncryptionConfig` file.
+In this file, choose **aescbc**, **kms** or **secretbox** as the encryption provider.
+
+**Audit Script:** 1.2.34.sh
+
+```
+#!/bin/bash -e
+
+check_file=${1}
+
+grep -q -E 'aescbc|kms|secretbox' ${check_file}
+if [ $? -eq 0 ]; then
+  echo "--pass"
+  exit 0
+else
+  echo "fail: encryption provider found in ${check_file}"
+  exit 1
+fi
+```
+
+**Audit Execution:**
+
+```
+./1.2.34.sh /etc/kubernetes/ssl/encryption.yaml
+```
+
+**Expected result**:
+
+```
+'--pass' is present
+```
+
+### 1.3 Controller Manager
+
+#### 1.3.1 Ensure that the `--terminated-pod-gc-threshold` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml`
+on the master node and set the `--terminated-pod-gc-threshold` to an appropriate threshold,
+for example:
+
+``` bash
+--terminated-pod-gc-threshold=10
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-controller-manager | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--terminated-pod-gc-threshold' is present
+```
+
+#### 1.3.2 Ensure that the `--profiling` argument is set to false (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml`
+on the master node and set the below parameter.
+
+``` bash
+--profiling=false
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-controller-manager | grep -v grep
+```
+
+**Expected result**:
+
+```
+'false' is equal to 'false'
+```
+
+#### 1.3.3 Ensure that the `--use-service-account-credentials` argument is set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml`
+on the master node to set the below parameter.
+
+``` bash
+--use-service-account-credentials=true
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-controller-manager | grep -v grep
+```
+
+**Expected result**:
+
+```
+'true' is not equal to 'false'
+```
+
+#### 1.3.4 Ensure that the `--service-account-private-key-file` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml`
+on the master node and set the `--service-account-private-key-file` parameter
+to the private key file for service accounts.
+
+``` bash
+--service-account-private-key-file=<filename>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-controller-manager | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--service-account-private-key-file' is present
+```
+
+#### 1.3.5 Ensure that the `--root-ca-file` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml`
+on the master node and set the `--root-ca-file` parameter to the certificate bundle file`.
+
+``` bash
+--root-ca-file=<path/to/file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-controller-manager | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--root-ca-file' is present
+```
+
+#### 1.3.6 Ensure that the `RotateKubeletServerCertificate` argument is set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml`
+on the master node and set the `--feature-gates` parameter to include `RotateKubeletServerCertificate=true`.
+
+``` bash
+--feature-gates=RotateKubeletServerCertificate=true
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-controller-manager | grep -v grep
+```
+
+**Expected result**:
+
+```
+'RotateKubeletServerCertificate=true' is equal to 'RotateKubeletServerCertificate=true'
+```
+
+#### 1.3.7 Ensure that the `--bind-address argument` is set to `127.0.0.1` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml`
+on the master node and ensure the correct value for the `--bind-address` parameter.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-controller-manager | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--bind-address' is present OR '--bind-address' is not present
+```
+
+### 1.4 Scheduler
+
+#### 1.4.1 Ensure that the `--profiling` argument is set to `false` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Scheduler pod specification file `/etc/kubernetes/manifests/kube-scheduler.yaml` file
+on the master node and set the below parameter.
+
+``` bash
+--profiling=false
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-scheduler | grep -v grep
+```
+
+**Expected result**:
+
+```
+'false' is equal to 'false'
+```
+
+#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored) 
+
+**Result:** PASS
+
+**Remediation:**
+Edit the Scheduler pod specification file `/etc/kubernetes/manifests/kube-scheduler.yaml`
+on the master node and ensure the correct value for the `--bind-address` parameter.
+
+**Audit:**
+
+```
+/bin/ps -ef | grep kube-scheduler | grep -v grep
+```
+
+**Expected result**:
+
+```
+'--bind-address' is present OR '--bind-address' is not present
+```
+
+## 2 Etcd Node Configuration
+### 2 Etcd Node Configuration Files
+
+#### 2.1 Ensure that the `--cert-file` and `--key-file` arguments are set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the etcd service documentation and configure TLS encryption.
+Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml`
+on the master node and set the below parameters.
+
+``` bash
+--cert-file=</path/to/ca-file>
+--key-file=</path/to/key-file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
+```
+
+**Expected result**:
+
+```
+'--cert-file' is present AND '--key-file' is present
+```
+
+#### 2.2 Ensure that the `--client-cert-auth` argument is set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master
+node and set the below parameter.
+
+``` bash
+--client-cert-auth="true"
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
+```
+
+**Expected result**:
+
+```
+'true' is equal to 'true'
+```
+
+#### 2.3 Ensure that the `--auto-tls` argument is not set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master
+node and either remove the `--auto-tls` parameter or set it to `false`.
+
+``` bash
+ --auto-tls=false
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
+```
+
+**Expected result**:
+
+```
+'--auto-tls' is not present OR '--auto-tls' is not present
+```
+
+#### 2.4 Ensure that the `--peer-cert-file` and `--peer-key-file` arguments are set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the etcd service documentation and configure peer TLS encryption as appropriate
+for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the
+master node and set the below parameters.
+
+``` bash
+--peer-client-file=</path/to/peer-cert-file>
+--peer-key-file=</path/to/peer-key-file>
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
+```
+
+**Expected result**:
+
+```
+'--peer-cert-file' is present AND '--peer-key-file' is present
+```
+
+#### 2.5 Ensure that the `--peer-client-cert-auth` argument is set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master
+node and set the below parameter.
+
+``` bash
+--peer-client-cert-auth=true
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
+```
+
+**Expected result**:
+
+```
+'true' is equal to 'true'
+```
+
+#### 2.6 Ensure that the `--peer-auto-tls` argument is not set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml` on the master
+node and either remove the `--peer-auto-tls` parameter or set it to `false`.
+
+``` bash
+--peer-auto-tls=false
+```
+
+**Audit:**
+
+```
+/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep
+```
+
+**Expected result**:
+
+```
+'--peer-auto-tls' is not present OR '--peer-auto-tls' is present
+```
+
+## 3 Control Plane Configuration
+### 3.2 Logging
+
+#### 3.2.1 Ensure that a minimal audit policy is created (Scored) 
+
+**Result:** PASS
+
+**Remediation:**
+Create an audit policy file for your cluster.
+
+**Audit Script:** 3.2.1.sh
+
+```
+#!/bin/bash -e
+
+api_server_bin=${1}
+
+/bin/ps -ef | /bin/grep ${api_server_bin} | /bin/grep -v ${0} | /bin/grep -v grep
+```
+
+**Audit Execution:**
+
+```
+./3.2.1.sh kube-apiserver
+```
+
+**Expected result**:
+
+```
+'--audit-policy-file' is present
+```
+
+## 4 Worker Node Security Configuration
+### 4.1 Worker Node Configuration Files
+
+#### 4.1.1 Ensure that the kubelet service file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+
+#### 4.1.2 Ensure that the kubelet service file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+
+#### 4.1.3 Ensure that the proxy kubeconfig file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the proxy service. All configuration is passed in as arguments at container run time.
+
+#### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the proxy service. All configuration is passed in as arguments at container run time.
+
+#### 4.1.5 Ensure that the kubelet.conf file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+
+#### 4.1.6 Ensure that the kubelet.conf file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+
+#### 4.1.7 Ensure that the certificate authorities file permissions are set to `644` or more restrictive (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Run the following command to modify the file permissions of the
+
+``` bash
+--client-ca-file chmod 644 <filename>
+```
+
+**Audit:**
+
+```
+stat -c %a /etc/kubernetes/ssl/kube-ca.pem
+```
+
+**Expected result**:
+
+```
+'644' is equal to '644' OR '640' is present OR '600' is present
+```
+
+#### 4.1.8 Ensure that the client certificate authorities file ownership is set to `root:root` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Run the following command to modify the ownership of the `--client-ca-file`.
+
+``` bash
+chown root:root <filename>
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi' 
+```
+
+**Expected result**:
+
+```
+'root:root' is equal to 'root:root'
+```
+
+#### 4.1.9 Ensure that the kubelet configuration file has permissions set to `644` or more restrictive (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+
+#### 4.1.10 Ensure that the kubelet configuration file ownership is set to `root:root` (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+
+### 4.2 Kubelet
+
+#### 4.2.1 Ensure that the `--anonymous-auth argument` is set to false (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to set authentication: `anonymous`: enabled to
+`false`.
+If using executable arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable.
+
+``` bash
+--anonymous-auth=false
+```
+ 
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'false' is equal to 'false'
+```
+
+#### 4.2.2 Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to set authorization: `mode` to `Webhook`. If
+using executable arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+set the below parameter in `KUBELET_AUTHZ_ARGS` variable.
+
+``` bash
+--authorization-mode=Webhook
+```
+
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'Webhook' not have 'AlwaysAllow'
+```
+
+#### 4.2.3 Ensure that the `--client-ca-file` argument is set as appropriate (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to set authentication: `x509`: `clientCAFile` to
+the location of the client CA file.
+If using command line arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+set the below parameter in `KUBELET_AUTHZ_ARGS` variable.
+
+``` bash
+--client-ca-file=<path/to/client-ca-file>
+```
+
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'--client-ca-file' is present
+```
+
+#### 4.2.4 Ensure that the `--read-only-port` argument is set to `0` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to set `readOnlyPort` to `0`.
+If using command line arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable.
+
+``` bash
+--read-only-port=0
+```
+
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'0' is equal to '0'
+```
+
+#### 4.2.5 Ensure that the `--streaming-connection-idle-timeout` argument is not set to `0` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
+value other than `0`.
+If using command line arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable.
+
+``` bash
+--streaming-connection-idle-timeout=5m
+```
+
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present
+```
+
+#### 4.2.6 Ensure that the ```--protect-kernel-defaults``` argument is set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to set `protectKernelDefaults`: `true`.
+If using command line arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable.
+
+``` bash
+--protect-kernel-defaults=true
+```
+
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'true' is equal to 'true'
+```
+
+#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored) 
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains`: `true`.
+If using command line arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+remove the `--make-iptables-util-chains` argument from the
+`KUBELET_SYSTEM_PODS_ARGS` variable.
+Based on your system, restart the kubelet service. For example:
+
+```bash 
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'true' is equal to 'true' OR '--make-iptables-util-chains' is not present
+```
+
+#### 4.2.10 Ensure that the `--tls-cert-file` and `--tls-private-key-file` arguments are set as appropriate (Scored)
+
+**Result:** Not Applicable
+
+**Remediation:**
+RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+
+#### 4.2.11 Ensure that the `--rotate-certificates` argument is not set to `false` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+If using a Kubelet config file, edit the file to add the line `rotateCertificates`: `true` or
+remove it altogether to use the default value.
+If using command line arguments, edit the kubelet service file
+`/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` on each worker node and
+remove `--rotate-certificates=false` argument from the `KUBELET_CERTIFICATE_ARGS`
+variable.
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'--rotate-certificates' is present OR '--rotate-certificates' is not present
+```
+
+#### 4.2.12 Ensure that the `RotateKubeletServerCertificate` argument is set to `true` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Edit the kubelet service file `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf`
+on each worker node and set the below parameter in `KUBELET_CERTIFICATE_ARGS` variable.
+
+``` bash
+--feature-gates=RotateKubeletServerCertificate=true
+```
+
+Based on your system, restart the kubelet service. For example:
+
+``` bash
+systemctl daemon-reload
+systemctl restart kubelet.service
+```
+
+**Audit:**
+
+```
+/bin/ps -fC kubelet
+```
+
+**Audit Config:**
+
+```
+/bin/cat /var/lib/kubelet/config.yaml
+```
+
+**Expected result**:
+
+```
+'true' is equal to 'true'
+```
+
+## 5 Kubernetes Policies
+### 5.1 RBAC and Service Accounts
+
+#### 5.1.5 Ensure that default service accounts are not actively used. (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Create explicit service accounts wherever a Kubernetes workload requires specific access
+to the Kubernetes API server.
+Modify the configuration of each default service account to include this value
+
+``` bash
+automountServiceAccountToken: false
+```
+
+**Audit Script:** 5.1.5.sh
+
+```
+#!/bin/bash
+
+export KUBECONFIG=${KUBECONFIG:-/root/.kube/config}
+
+kubectl version > /dev/null
+if [ $? -ne 0 ]; then
+  echo "fail: kubectl failed"
+  exit 1
+fi
+
+accounts="$(kubectl --kubeconfig=${KUBECONFIG} get serviceaccounts -A -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true)) | "fail \(.metadata.name) \(.metadata.namespace)"')"
+
+if [[ "${accounts}" == "" ]]; then
+  echo "--pass"
+  exit 0
+fi
+
+echo ${accounts}
+exit 1
+```
+
+**Audit Execution:**
+
+```
+./5.1.5.sh 
+```
+
+**Expected result**:
+
+```
+'--pass' is present
+```
+
+### 5.2 Pod Security Policies
+
+#### 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Create a PSP as described in the Kubernetes documentation, ensuring that the
+`.spec.hostPID` field is omitted or set to `false`.
+
+**Audit:**
+
+```
+kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
+```
+
+**Expected result**:
+
+```
+1 is greater than 0
+```
+
+#### 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Create a PSP as described in the Kubernetes documentation, ensuring that the
+`.spec.hostIPC` field is omitted or set to `false`.
+
+**Audit:**
+
+```
+kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
+```
+
+**Expected result**:
+
+```
+1 is greater than 0
+```
+
+#### 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Create a PSP as described in the Kubernetes documentation, ensuring that the
+`.spec.hostNetwork` field is omitted or set to `false`.
+
+**Audit:**
+
+```
+kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
+```
+
+**Expected result**:
+
+```
+1 is greater than 0
+```
+
+#### 5.2.5 Minimize the admission of containers with `allowPrivilegeEscalation` (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Create a PSP as described in the Kubernetes documentation, ensuring that the
+`.spec.allowPrivilegeEscalation` field is omitted or set to `false`.
+
+**Audit:**
+
+```
+kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
+```
+
+**Expected result**:
+
+```
+1 is greater than 0
+```
+
+### 5.3 Network Policies and CNI
+
+#### 5.3.2 Ensure that all Namespaces have Network Policies defined (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Follow the documentation and create `NetworkPolicy` objects as you need them.
+
+**Audit Script:** 5.3.2.sh
+
+```
+#!/bin/bash -e
+
+export KUBECONFIG=${KUBECONFIG:-"/root/.kube/config"}
+
+kubectl version > /dev/null
+if [ $? -ne 0 ]; then
+  echo "fail: kubectl failed"
+  exit 1
+fi
+
+for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
+  policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length')
+  if [ ${policy_count} -eq 0 ]; then
+    echo "fail: ${namespace}"
+    exit 1
+  fi
+done
+
+echo "pass"
+```
+
+**Audit Execution:**
+
+```
+./5.3.2.sh 
+```
+
+**Expected result**:
+
+```
+'pass' is present
+```
+
+### 5.6 General Policies
+
+#### 5.6.4 The default namespace should not be used (Scored)
+
+**Result:** PASS
+
+**Remediation:**
+Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
+resources and that all new resources are created in a specific namespace.
+
+**Audit Script:** 5.6.4.sh
+
+```
+#!/bin/bash -e
+
+export KUBECONFIG=${KUBECONFIG:-/root/.kube/config}
+
+kubectl version > /dev/null
+if [[ $? -gt 0 ]]; then
+  echo "fail: kubectl failed"
+  exit 1
+fi
+
+default_resources=$(kubectl get all -o json | jq --compact-output '.items[] | select((.kind == "Service") and (.metadata.name == "kubernetes") and (.metadata.namespace == "default") | not)' | wc -l)
+
+echo "--count=${default_resources}"
+```
+
+**Audit Execution:**
+
+```
+./5.6.4.sh 
+```
+
+**Expected result**:
+
+```
+'0' is equal to '0'
+```
+
diff --git a/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md b/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md
new file mode 100644
index 00000000000..75a48a7ba50
--- /dev/null
+++ b/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md
@@ -0,0 +1,712 @@
+---
+title: Hardening Guide v2.3.5
+weight: 100
+---
+
+This document provides prescriptive guidance for hardening a production installation of Rancher v2.3.5. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
+
+> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes.
+
+This hardening guide is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+Hardening Guide v2.3.5 | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes 1.15
+
+
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.3.5/Rancher_Hardening_Guide.pdf)
+
+### Overview
+
+This document provides prescriptive guidance for hardening a production installation of Rancher v2.3.5 with Kubernetes v1.15. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
+
+For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS Benchmark Rancher Self-Assessment Guide - Rancher v2.3.5]({{< baseurl >}}/rancher/v2.x/en/security/benchmark-2.3.5/).
+
+#### Known Issues
+
+Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
+
+### Configure Kernel Runtime Parameters
+
+The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`:
+
+```
+vm.overcommit_memory=1
+vm.panic_on_oom=0
+kernel.panic=10
+kernel.panic_on_oops=1
+kernel.keys.root_maxbytes=25000000
+```
+
+Run `sysctl -p /etc/sysctl.d/90-kubelet.conf` to enable the settings.
+
+### Configure `etcd` user and group
+A user account and group for the **etcd** service is required to be setup prior to installing RKE. The **uid** and **gid** for the **etcd** user will be used in the RKE **config.yml** to set the proper permissions for files and directories during installation time.
+
+#### create `etcd` user and group
+To create the **etcd** group run the following console commands.
+
+```
+groupadd --gid 52034 etcd
+useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd
+```
+
+Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user:
+
+``` yaml
+services:
+  etcd:
+    gid: 52034
+    uid: 52034
+```
+
+#### Set `automountServiceAccountToken` to `false` for `default` service accounts
+Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.  
+
+For each namespace the **default** service account must include this value:
+
+```
+automountServiceAccountToken: false
+```
+
+Save the following yaml to a file called `account_update.yaml`
+
+``` yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+automountServiceAccountToken: false
+```
+
+Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions.
+
+``` 
+#!/bin/bash -e
+
+for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
+  kubectl patch serviceaccount default -n ${namespace} -p "$(cat account_update.yaml)"
+done
+```
+
+### Ensure that all Namespaces have Network Policies defined
+
+Running different applications on the same Kubernetes cluster creates a risk of one
+compromised application attacking a neighboring application. Network segmentation is
+important to ensure that containers can communicate only with those they are supposed
+to. A network policy is a specification of how selections of pods are allowed to
+communicate with each other and other network endpoints.
+
+Network Policies are namespace scoped. When a network policy is introduced to a given
+namespace, all traffic not allowed by the policy is denied. However, if there are no network
+policies in a namespace all traffic will be allowed into and out of the pods in that
+namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled.
+This guide uses [canal](https://github.com/projectcalico/canal) to provide the policy enforcement.
+Additional information about CNI providers can be found
+[here](https://rancher.com/blog/2019/2019-03-21-comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/)
+
+Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a
+**permissive** example is provide below. If you want to allow all traffic to all pods in a namespace
+(even if policies are added that cause some pods to be treated as “isolated”),
+you can create a policy that explicitly allows all traffic in that namespace. Save the following `yaml` as
+`default-allow-all.yaml`. Additional [documentation](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
+about network policies can be found on the Kubernetes site.
+
+> This `NetworkPolicy` is not recommended for production use
+
+``` yaml
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-allow-all
+spec:
+  podSelector: {}
+  ingress:
+  - {}
+  egress:
+  - {}
+  policyTypes:
+  - Ingress
+  - Egress
+```
+
+Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to
+`chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions.
+
+```
+#!/bin/bash -e
+
+for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
+  kubectl apply -f default-allow-all.yaml -n ${namespace}
+done
+```
+Execute this script to apply the `default-allow-all.yaml` the **permissive** `NetworkPolicy` to all namespaces.
+
+### Reference Hardened RKE `cluster.yml` configuration
+The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install
+of Rancher Kubernetes Engine (RKE). Install [documentation](https://rancher.com/docs/rke/latest/en/installation/) is
+provided with additional details about the configuration items.
+
+``` yaml
+# If you intend to deploy Kubernetes in an air-gapped environment,
+# please consult the documentation on how to configure custom RKE images.
+kubernetes_version: "v1.15.9-rancher1-1"
+enable_network_policy: true
+default_pod_security_policy_template_id: "restricted"
+services:
+  etcd:
+    uid: 52034
+    gid: 52034
+  kube-api:
+    pod_security_policy: true
+    secrets_encryption_config:
+      enabled: true
+    audit_log:
+      enabled: true
+    admission_configuration:
+    event_rate_limit:
+      enabled: true
+  kube-controller:
+    extra_args:
+      feature-gates: "RotateKubeletServerCertificate=true"
+  scheduler:
+    image: ""
+    extra_args: {}
+    extra_binds: []
+    extra_env: []
+  kubelet:
+    generate_serving_certificate: true
+    extra_args:
+      feature-gates: "RotateKubeletServerCertificate=true"
+      protect-kernel-defaults: "true"
+      tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
+    extra_binds: []
+    extra_env: []
+    cluster_domain: ""
+    infra_container_image: ""
+    cluster_dns_server: ""
+    fail_swap_on: false
+  kubeproxy:
+    image: ""
+    extra_args: {}
+    extra_binds: []
+    extra_env: []
+network:
+  plugin: ""
+  options: {}
+  mtu: 0
+  node_selector: {}
+authentication:
+  strategy: ""
+  sans: []
+  webhook: null
+addons: |
+  ---
+  apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: ingress-nginx
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: Role
+  metadata:
+    name: default-psp-role
+    namespace: ingress-nginx
+  rules:
+  - apiGroups:
+    - extensions
+    resourceNames:
+    - default-psp
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: RoleBinding
+  metadata:
+    name: default-psp-rolebinding
+    namespace: ingress-nginx
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: default-psp-role
+  subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:serviceaccounts
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated
+  ---
+  apiVersion: v1
+  kind: Namespace
+  metadata:
+    name: cattle-system
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: Role
+  metadata:
+    name: default-psp-role
+    namespace: cattle-system
+  rules:
+  - apiGroups:
+    - extensions
+    resourceNames:
+    - default-psp
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: RoleBinding
+  metadata:
+    name: default-psp-rolebinding
+    namespace: cattle-system
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: default-psp-role
+  subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:serviceaccounts
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated
+  ---
+  apiVersion: policy/v1beta1
+  kind: PodSecurityPolicy
+  metadata:
+    name: restricted
+  spec:
+    requiredDropCapabilities:
+    - NET_RAW
+    privileged: false
+    allowPrivilegeEscalation: false
+    defaultAllowPrivilegeEscalation: false
+    fsGroup:
+      rule: RunAsAny
+    runAsUser:
+      rule: MustRunAsNonRoot
+    seLinux:
+      rule: RunAsAny
+    supplementalGroups:
+      rule: RunAsAny
+    volumes:
+    - emptyDir
+    - secret
+    - persistentVolumeClaim
+    - downwardAPI
+    - configMap
+    - projected
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRole
+  metadata:
+    name: psp:restricted
+  rules:
+  - apiGroups:
+    - extensions
+    resourceNames:
+    - restricted
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRoleBinding
+  metadata:
+    name: psp:restricted
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: psp:restricted
+  subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:serviceaccounts
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: system:authenticated
+  ---
+  apiVersion: v1
+  kind: ServiceAccount
+  metadata:
+    name: tiller
+    namespace: kube-system
+  ---
+  apiVersion: rbac.authorization.k8s.io/v1
+  kind: ClusterRoleBinding
+  metadata:
+    name: tiller
+  roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: ClusterRole
+    name: cluster-admin
+  subjects:
+  - kind: ServiceAccount
+    name: tiller
+    namespace: kube-system
+  
+addons_include: []
+system_images:
+  etcd: ""
+  alpine: ""
+  nginx_proxy: ""
+  cert_downloader: ""
+  kubernetes_services_sidecar: ""
+  kubedns: ""
+  dnsmasq: ""
+  kubedns_sidecar: ""
+  kubedns_autoscaler: ""
+  coredns: ""
+  coredns_autoscaler: ""
+  kubernetes: ""
+  flannel: ""
+  flannel_cni: ""
+  calico_node: ""
+  calico_cni: ""
+  calico_controllers: ""
+  calico_ctl: ""
+  calico_flexvol: ""
+  canal_node: ""
+  canal_cni: ""
+  canal_flannel: ""
+  canal_flexvol: ""
+  weave_node: ""
+  weave_cni: ""
+  pod_infra_container: ""
+  ingress: ""
+  ingress_backend: ""
+  metrics_server: ""
+  windows_pod_infra_container: ""
+ssh_key_path: ""
+ssh_cert_path: ""
+ssh_agent_auth: false
+authorization:
+  mode: ""
+  options: {}
+ignore_docker_version: false
+private_registries: []
+ingress:
+  provider: ""
+  options: {}
+  node_selector: {}
+  extra_args: {}
+  dns_policy: ""
+  extra_envs: []
+  extra_volumes: []
+  extra_volume_mounts: []
+cluster_name: ""
+prefix_path: ""
+addon_job_timeout: 0
+bastion_host:
+  address: ""
+  port: ""
+  user: ""
+  ssh_key: ""
+  ssh_key_path: ""
+  ssh_cert: ""
+  ssh_cert_path: ""
+monitoring:
+  provider: ""
+  options: {}
+  node_selector: {}
+restore:
+  restore: false
+  snapshot_name: ""
+dns: null
+```
+
+### Reference Hardened RKE Template configuration 
+
+The reference RKE Template provides the configuration needed to achieve a hardened install of Kubenetes.
+RKE Templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher
+[documentaion](https://rancher.com/docs/rancher/v2.x/en/installation) for additional installation and RKE Template details.
+
+``` yaml
+# 
+# Cluster Config
+# 
+default_pod_security_policy_template_id: restricted
+docker_root_dir: /var/lib/docker
+enable_cluster_alerting: false
+enable_cluster_monitoring: false
+enable_network_policy: true
+# 
+# Rancher Config
+# 
+rancher_kubernetes_engine_config:
+  addon_job_timeout: 30
+  addons: |-
+    ---
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+      name: ingress-nginx
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+      name: default-psp-role
+      namespace: ingress-nginx
+    rules:
+    - apiGroups:
+      - extensions
+      resourceNames:
+      - default-psp
+      resources:
+      - podsecuritypolicies
+      verbs:
+      - use
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+      name: default-psp-rolebinding
+      namespace: ingress-nginx
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: Role
+      name: default-psp-role
+    subjects:
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: system:serviceaccounts
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: system:authenticated
+    ---
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+      name: cattle-system
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+      name: default-psp-role
+      namespace: cattle-system
+    rules:
+    - apiGroups:
+      - extensions
+      resourceNames:
+      - default-psp
+      resources:
+      - podsecuritypolicies
+      verbs:
+      - use
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+      name: default-psp-rolebinding
+      namespace: cattle-system
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: Role
+      name: default-psp-role
+    subjects:
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: system:serviceaccounts
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: system:authenticated
+    ---
+    apiVersion: policy/v1beta1
+    kind: PodSecurityPolicy
+    metadata:
+      name: restricted
+    spec:
+      requiredDropCapabilities:
+      - NET_RAW
+      privileged: false
+      allowPrivilegeEscalation: false
+      defaultAllowPrivilegeEscalation: false
+      fsGroup:
+        rule: RunAsAny
+      runAsUser:
+        rule: MustRunAsNonRoot
+      seLinux:
+        rule: RunAsAny
+      supplementalGroups:
+        rule: RunAsAny
+      volumes:
+      - emptyDir
+      - secret
+      - persistentVolumeClaim
+      - downwardAPI
+      - configMap
+      - projected
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+      name: psp:restricted
+    rules:
+    - apiGroups:
+      - extensions
+      resourceNames:
+      - restricted
+      resources:
+      - podsecuritypolicies
+      verbs:
+      - use
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+      name: psp:restricted
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: ClusterRole
+      name: psp:restricted
+    subjects:
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: system:serviceaccounts
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: system:authenticated
+    ---
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: tiller
+      namespace: kube-system
+    ---
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+      name: tiller
+    roleRef:
+      apiGroup: rbac.authorization.k8s.io
+      kind: ClusterRole
+      name: cluster-admin
+    subjects:
+    - kind: ServiceAccount
+      name: tiller
+      namespace: kube-system
+  ignore_docker_version: true
+  kubernetes_version: v1.15.9-rancher1-1
+# 
+#   If you are using calico on AWS
+# 
+#    network:
+#      plugin: calico
+#      calico_network_provider:
+#        cloud_provider: aws
+# 
+# # To specify flannel interface
+# 
+#    network:
+#      plugin: flannel
+#      flannel_network_provider:
+#      iface: eth1
+# 
+# # To specify flannel interface for canal plugin
+# 
+#    network:
+#      plugin: canal
+#      canal_network_provider:
+#        iface: eth1
+# 
+  network:
+    mtu: 0
+    plugin: canal
+# 
+#    services:
+#      kube-api:
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kube-controller:
+#        cluster_cidr: 10.42.0.0/16
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kubelet:
+#        cluster_domain: cluster.local
+#        cluster_dns_server: 10.43.0.10
+# 
+  services:
+    etcd:
+      backup_config:
+        enabled: false
+        interval_hours: 12
+        retention: 6
+        safe_timestamp: false
+      creation: 12h
+      extra_args:
+        election-timeout: '5000'
+        heartbeat-interval: '500'
+      gid: 52034
+      retention: 72h
+      snapshot: false
+      uid: 52034
+    kube_api:
+      always_pull_images: false
+      audit_log:
+        enabled: true
+      event_rate_limit:
+        enabled: true
+      pod_security_policy: true
+      secrets_encryption_config:
+        enabled: true
+      service_node_port_range: 30000-32767
+    kube_controller:
+      extra_args:
+        address: 127.0.0.1
+        feature-gates: RotateKubeletServerCertificate=true
+        profiling: 'false'
+        terminated-pod-gc-threshold: '1000'
+    kubelet:
+      extra_args:
+        anonymous-auth: 'false'
+        event-qps: '0'
+        feature-gates: RotateKubeletServerCertificate=true
+        make-iptables-util-chains: 'true'
+        protect-kernel-defaults: 'true'
+        streaming-connection-idle-timeout: 1800s
+        tls-cipher-suites: >-
+          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+      fail_swap_on: false
+      generate_serving_certificate: true
+    scheduler:
+      extra_args:
+        address: 127.0.0.1
+        profiling: 'false'
+  ssh_agent_auth: false
+windows_prefered_cluster: false
+```
+
+### Hardened Reference Ubuntu 18.04 LTS **cloud-config**:
+
+The reference **cloud-config** is generally used in cloud infrastructure environments to allow for
+configuration management of compute instances. The reference config configures Ubuntu operating system level settings
+needed before installing kubernetes.
+
+``` yaml
+#cloud-config
+packages:
+  - curl
+  - jq
+runcmd:
+  - sysctl -w vm.overcommit_memory=1
+  - sysctl -w kernel.panic=10
+  - sysctl -w kernel.panic_on_oops=1
+  - curl https://releases.rancher.com/install-docker/18.09.sh | sh
+  - usermod -aG docker ubuntu
+  - return=1; while [ $return != 0 ]; do sleep 2; docker ps; return=$?; done
+  - addgroup --gid 52034 etcd
+  - useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd
+write_files:
+  - path: /etc/sysctl.d/kubelet.conf
+    owner: root:root
+    permissions: "0644"
+    content: |
+      vm.overcommit_memory=1
+      kernel.panic=10
+      kernel.panic_on_oops=1
+```

From 1e9f0b13b66626cbad1b24c0ffa61d89fed3562e Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Fri, 5 Jun 2020 09:32:38 -0700
Subject: [PATCH 112/265] EIO-3: update to conversion scripts

---
 scripts/converters/headers/header-2.4.3.md  | 37 +++++++++++++++++++++
 scripts/converters/scripts/results_to_md.sh |  2 +-
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 scripts/converters/headers/header-2.4.3.md

diff --git a/scripts/converters/headers/header-2.4.3.md b/scripts/converters/headers/header-2.4.3.md
new file mode 100644
index 00000000000..64457b3519f
--- /dev/null
+++ b/scripts/converters/headers/header-2.4.3.md
@@ -0,0 +1,37 @@
+---
+title: CIS Benchmark Rancher Self-Assessment Guide - v2.4.3
+weight: 105
+---
+
+### CIS Kubernetes Benchmark v1.5 - Rancher v2.4.3 with Kubernetes v1.15
+
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4.3/Rancher_Benchmark_Assessment.pdf)
+
+#### Overview
+
+This document is a companion to the Rancher v2.4.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
+
+This guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.4.3 | Rancher v2.4.3 | Hardening Guide v2.4.3 | Kubernetes v1.15 | Benchmark v1.5
+
+Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher-created clusters.
+
+This document is to be used by Rancher operators, security teams, auditors and decision makers.
+
+For more detail about each audit, including rationales and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.5. You can download the benchmark after logging in to [CISecurity.org]( https://www.cisecurity.org/benchmark/kubernetes/).
+
+#### Testing controls methodology
+
+Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files.
+
+Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher Labs are provided for testing.
+When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the [jq](https://stedolan.github.io/jq/) and [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) (with valid config) tools to and are required in the testing and evaluation of test results.
+
+> NOTE: only scored tests are covered in this guide.
+
+### Controls
+
+---
diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh
index 754c6755661..d1eeb1ff4d4 100755
--- a/scripts/converters/scripts/results_to_md.sh
+++ b/scripts/converters/scripts/results_to_md.sh
@@ -34,7 +34,7 @@ get_test() {
   jq -r --arg id "${id}" --arg section "${section}" --arg test_number "${test_number}" 'select(.id==$id).tests[] | select(.section==$section).results[] | select(.test_number==$test_number)' ${results_file}
 }
 
-cat headers/header-2.3.5.md
+cat headers/header-2.4.3.md
 
 for id in $(get_ids); do
   echo "## ${id} $(get_id_text ${id})"

From 59a4092c35759a5cdc4365f654b85beb1678b59f Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Fri, 5 Jun 2020 10:13:04 -0700
Subject: [PATCH 113/265] EIO-3: Rancher v2.4.3 CIS docs

---
 content/rancher/v2.x/en/security/_index.md    |  4 ++-
 .../v2.x/en/security/benchmark-2.1/_index.md  |  2 +-
 .../v2.x/en/security/benchmark-2.2/_index.md  |  2 +-
 .../en/security/benchmark-2.3.3/_index.md     |  2 +-
 .../en/security/benchmark-2.3.5/_index.md     |  2 +-
 .../v2.x/en/security/benchmark-2.3/_index.md  |  2 +-
 .../en/security/benchmark-2.4.3/_index.md     | 31 ++++++++++++-------
 .../rancher/v2.x/en/security/cve/_index.md    |  4 +--
 .../en/security/hardening-2.4.3/_index.md     | 14 ++++-----
 9 files changed, 36 insertions(+), 27 deletions(-)

diff --git a/content/rancher/v2.x/en/security/_index.md b/content/rancher/v2.x/en/security/_index.md
index e9451267cc1..6abd0aefe55 100644
--- a/content/rancher/v2.x/en/security/_index.md
+++ b/content/rancher/v2.x/en/security/_index.md
@@ -61,6 +61,7 @@ Each version of the hardening guide is intended to be used with specific version
 
 Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
 ------------------------|----------------|-----------------------|------------------
+[Hardening Guide v2.4.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.4.3/) | Rancher v2.4.3 | Benchmark v1.5 | Kubernetes v1.15
 [Hardening Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.5/) | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes v1.15
 [Hardening Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.3/) | Rancher v2.3.3 | Benchmark v1.4.1 | Kubernetes v1.14, v1.15, and v1.16
 [Hardening Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3/) | Rancher v2.3.0-v2.3.2 | Benchmark v1.4.1 | Kubernetes v1.15
@@ -77,7 +78,8 @@ Each version of Rancher's self assessment guide corresponds to specific versions
 
 Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
 ---------------------------|----------|---------|-------|-----
-[Self Assessment Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.5/#cis-kubernetes-benchmark-1-5-0-rancher-2-3-5-+-with-kubernetes-1-15) | Rancher v2.3.5 | Hardening Guide v2.3.3 | Kubernetes v1.15 | Benchmark v1.5.0
+[Self Assessment Guide v2.4.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.4.3/#cis-kubernetes-benchmark-1-5-0-rancher-2-4-3-+-with-kubernetes-1-15) | Rancher v2.4.3 | Hardening Guide v2.4.3 | Kubernetes v1.15 | Benchmark v1.5
+[Self Assessment Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.5/#cis-kubernetes-benchmark-1-5-0-rancher-2-3-5-+-with-kubernetes-1-15) | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5
 [Self Assessment Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-3-+-with-kubernetes-1-16) | Rancher v2.3.3 | Hardening Guide v2.3.3 | Kubernetes v1.16 | Benchmark v1.4.1
 [Self Assessment Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-0-2-3-2-with-kubernetes-1-15) | Rancher v2.3.0-2.3.2 | Hardening Guide v2.3 | Kubernetes v1.15 | Benchmark v1.4.1
 [Self Assessment Guide v2.2]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.2/) | Rancher v2.2.x | Hardening Guide v2.2 | Kubernetes v1.13 | Benchmark v1.4.0 and v1.4.1
diff --git a/content/rancher/v2.x/en/security/benchmark-2.1/_index.md b/content/rancher/v2.x/en/security/benchmark-2.1/_index.md
index 3808f116fd5..50b79795bf2 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.1/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.1/_index.md
@@ -1,6 +1,6 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide v2.1
-weight: 109
+weight: 209
 ---
 
 This document is a companion to the Rancher v2.1 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md b/content/rancher/v2.x/en/security/benchmark-2.2/_index.md
index 8dee3cf5a95..68bbaa1ad7b 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.2/_index.md
@@ -1,6 +1,6 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide v2.2
-weight: 108
+weight: 208
 ---
 
 This document is a companion to the Rancher v2.2 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/benchmark-2.3.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3.3/_index.md
index 488d48686eb..4f8d2d1b1f6 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3.3/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.3.3/_index.md
@@ -1,6 +1,6 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide - Rancher v2.3.3
-weight: 106
+weight: 206
 ---
 
 This document is a companion to the Rancher v2.3.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
index aef7846d23d..93ff61ceed9 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
@@ -1,6 +1,6 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide - v2.3.5
-weight: 105
+weight: 205
 ---
 
 ### CIS Kubernetes Benchmark 1.5 - Rancher 2.3.5 with Kubernetes 1.15
diff --git a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md
index f383707019f..09b6915dca7 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md
@@ -1,6 +1,6 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide v2.3
-weight: 107
+weight: 207
 ---
 
 This document is a companion to the Rancher v2.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
index aef7846d23d..4f79b7200d5 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
@@ -1,21 +1,21 @@
 ---
-title: CIS Benchmark Rancher Self-Assessment Guide - v2.3.5
-weight: 105
+title: CIS Benchmark Rancher Self-Assessment Guide - v2.4.3
+weight: 204
 ---
 
-### CIS Kubernetes Benchmark 1.5 - Rancher 2.3.5 with Kubernetes 1.15
+### CIS Kubernetes Benchmark v1.5 - Rancher v2.4.3 with Kubernetes v1.15
 
-[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.3.5/Rancher_Benchmark_Assessment.pdf)
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4.3/Rancher_Benchmark_Assessment.pdf)
 
 #### Overview
 
-This document is a companion to the Rancher v2.3.5 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
+This document is a companion to the Rancher v2.4.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
 
 This guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
 
 Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
 ---------------------------|----------|---------|-------|-----
-Self Assessment Guide v2.3.5 | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5
+Self Assessment Guide v2.4.3 | Rancher v2.4.3 | Hardening Guide v2.4.3 | Kubernetes v1.15 | Benchmark v1.5
 
 Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher-created clusters.
 
@@ -1813,7 +1813,7 @@ systemctl restart kubelet.service
 **Expected result**:
 
 ```
-'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present
+'1800s' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present
 ```
 
 #### 4.2.6 Ensure that the ```--protect-kernel-defaults``` argument is set to `true` (Scored)
@@ -2001,13 +2001,20 @@ fi
 
 accounts="$(kubectl --kubeconfig=${KUBECONFIG} get serviceaccounts -A -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true)) | "fail \(.metadata.name) \(.metadata.namespace)"')"
 
-if [[ "${accounts}" == "" ]]; then
-  echo "--pass"
-  exit 0
+if [[ "${accounts}" != "" ]]; then
+  echo "fail: automountServiceAccountToken not false for accounts: ${accounts}"
+  exit 1
 fi
 
-echo ${accounts}
-exit 1
+default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name=="default").metadata.uid' | wc -l)"
+
+if [[ "${default_binding}" -gt 0 ]]; then
+	echo "fail: default service accounts have non default bindings"
+	exit 1
+fi
+
+echo "--pass"
+exit 0
 ```
 
 **Audit Execution:**
diff --git a/content/rancher/v2.x/en/security/cve/_index.md b/content/rancher/v2.x/en/security/cve/_index.md
index 6d709340049..02c00946dc9 100644
--- a/content/rancher/v2.x/en/security/cve/_index.md
+++ b/content/rancher/v2.x/en/security/cve/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Rancher CVEs and Resolutions
-weight: 200
+weight: 300
 ---
 
 Rancher is committed to informing the community of security issues in our products. Rancher will publish CVEs (Common Vulnerabilities and Exposures) for issues we have resolved.
@@ -14,4 +14,4 @@ Rancher is committed to informing the community of security issues in our produc
 | [CVE-2019-12303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12303) |  Project owners can inject extra fluentd logging configurations that makes it possible to read files or execute arbitrary commands inside the fluentd container. Reported by Tyler Welton from Untamed Theory. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)   |
 | [CVE-2019-13209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13209) |  The vulnerability is known as a [Cross-Site Websocket Hijacking attack](https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html). This attack allows an exploiter to gain access to clusters managed by Rancher with the roles/permissions of a victim. It requires that a victim to be logged into a Rancher server and then access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the Kubernetes API with the permissions and identity of the victim. Reported by Matt Belisle and Alex Stevenson from Workiva. | 15 Jul 2019  |   [Rancher v2.2.5](https://github.com/rancher/rancher/releases/tag/v2.2.5), [Rancher v2.1.11](https://github.com/rancher/rancher/releases/tag/v2.1.11) and [Rancher v2.0.16](https://github.com/rancher/rancher/releases/tag/v2.0.16) |
 | [CVE-2019-14436](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14436) |  The vulnerability allows a member of a project that has access to edit role bindings to be able to assign themselves or others a cluster level role granting them administrator access to that cluster. The issue was found and reported by Michal Lipinski at Nokia. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
-| [CVE-2019-14435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14435) |  This vulnerability allows authenticated users to potentially extract otherwise private data out of IPs reachable from system service containers used by Rancher. This can include but not only limited to services such as cloud provider metadata services. Although Rancher allow users to configure whitelisted domains for system service access, this flaw can still be exploited by a carefully crafted HTTP request. The issue was found and reported by Matt Belisle and Alex Stevenson at Workiva. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
\ No newline at end of file
+| [CVE-2019-14435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14435) |  This vulnerability allows authenticated users to potentially extract otherwise private data out of IPs reachable from system service containers used by Rancher. This can include but not only limited to services such as cloud provider metadata services. Although Rancher allow users to configure whitelisted domains for system service access, this flaw can still be exploited by a carefully crafted HTTP request. The issue was found and reported by Matt Belisle and Alex Stevenson at Workiva. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
diff --git a/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md b/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md
index 75a48a7ba50..ad6899eb6d2 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md
@@ -1,9 +1,9 @@
 ---
-title: Hardening Guide v2.3.5
-weight: 100
+title: Hardening Guide v2.4.3
+weight: 99
 ---
 
-This document provides prescriptive guidance for hardening a production installation of Rancher v2.3.5. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
+This document provides prescriptive guidance for hardening a production installation of Rancher v2.4.3. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
 
 > This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes.
 
@@ -11,16 +11,16 @@ This hardening guide is intended to be used with specific versions of the CIS Ku
 
 Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
 ------------------------|----------------|-----------------------|------------------
-Hardening Guide v2.3.5 | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes 1.15
+Hardening Guide v2.4.3 | Rancher v2.4.3 | Benchmark v1.5 | Kubernetes 1.15
 
 
-[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.3.5/Rancher_Hardening_Guide.pdf)
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4.3/Rancher_Hardening_Guide.pdf)
 
 ### Overview
 
-This document provides prescriptive guidance for hardening a production installation of Rancher v2.3.5 with Kubernetes v1.15. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
+This document provides prescriptive guidance for hardening a production installation of Rancher v2.4.3 with Kubernetes v1.15. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
 
-For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS Benchmark Rancher Self-Assessment Guide - Rancher v2.3.5]({{< baseurl >}}/rancher/v2.x/en/security/benchmark-2.3.5/).
+For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS Benchmark Rancher Self-Assessment Guide - Rancher v2.4.3]({{< baseurl >}}/rancher/v2.x/en/security/benchmark-2.3.5/).
 
 #### Known Issues
 

From 265d2da51ca95cafd409c90b1353a707f112df66 Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Fri, 5 Jun 2020 11:20:50 -0700
Subject: [PATCH 114/265] EIO-3: change to v2.4 from v2.4.3

---
 content/rancher/v2.x/en/security/_index.md           |  4 ++--
 .../{benchmark-2.4.3 => benchmark-2.4}/_index.md     | 10 +++++-----
 .../{hardening-2.4.3 => hardening-2.4}/_index.md     | 12 ++++++------
 3 files changed, 13 insertions(+), 13 deletions(-)
 rename content/rancher/v2.x/en/security/{benchmark-2.4.3 => benchmark-2.4}/_index.md (98%)
 rename content/rancher/v2.x/en/security/{hardening-2.4.3 => hardening-2.4}/_index.md (96%)

diff --git a/content/rancher/v2.x/en/security/_index.md b/content/rancher/v2.x/en/security/_index.md
index 6abd0aefe55..d0b2dd70089 100644
--- a/content/rancher/v2.x/en/security/_index.md
+++ b/content/rancher/v2.x/en/security/_index.md
@@ -61,7 +61,7 @@ Each version of the hardening guide is intended to be used with specific version
 
 Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
 ------------------------|----------------|-----------------------|------------------
-[Hardening Guide v2.4.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.4.3/) | Rancher v2.4.3 | Benchmark v1.5 | Kubernetes v1.15
+[Hardening Guide v2.4]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.4/) | Rancher v2.4 | Benchmark v1.5 | Kubernetes v1.15
 [Hardening Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.5/) | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes v1.15
 [Hardening Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.3/) | Rancher v2.3.3 | Benchmark v1.4.1 | Kubernetes v1.14, v1.15, and v1.16
 [Hardening Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3/) | Rancher v2.3.0-v2.3.2 | Benchmark v1.4.1 | Kubernetes v1.15
@@ -78,7 +78,7 @@ Each version of Rancher's self assessment guide corresponds to specific versions
 
 Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
 ---------------------------|----------|---------|-------|-----
-[Self Assessment Guide v2.4.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.4.3/#cis-kubernetes-benchmark-1-5-0-rancher-2-4-3-+-with-kubernetes-1-15) | Rancher v2.4.3 | Hardening Guide v2.4.3 | Kubernetes v1.15 | Benchmark v1.5
+[Self Assessment Guide v2.4]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.4/#cis-kubernetes-benchmark-1-5-0-rancher-2-4-+-with-kubernetes-1-15) | Rancher v2.4 | Hardening Guide v2.4 | Kubernetes v1.15 | Benchmark v1.5
 [Self Assessment Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.5/#cis-kubernetes-benchmark-1-5-0-rancher-2-3-5-+-with-kubernetes-1-15) | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5
 [Self Assessment Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-3-+-with-kubernetes-1-16) | Rancher v2.3.3 | Hardening Guide v2.3.3 | Kubernetes v1.16 | Benchmark v1.4.1
 [Self Assessment Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-0-2-3-2-with-kubernetes-1-15) | Rancher v2.3.0-2.3.2 | Hardening Guide v2.3 | Kubernetes v1.15 | Benchmark v1.4.1
diff --git a/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
rename to content/rancher/v2.x/en/security/benchmark-2.4/_index.md
index 4f79b7200d5..30841ba2027 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.4.3/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
@@ -1,21 +1,21 @@
 ---
-title: CIS Benchmark Rancher Self-Assessment Guide - v2.4.3
+title: CIS Benchmark Rancher Self-Assessment Guide - v2.4
 weight: 204
 ---
 
-### CIS Kubernetes Benchmark v1.5 - Rancher v2.4.3 with Kubernetes v1.15
+### CIS Kubernetes Benchmark v1.5 - Rancher v2.4 with Kubernetes v1.15
 
-[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4.3/Rancher_Benchmark_Assessment.pdf)
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4/Rancher_Benchmark_Assessment.pdf)
 
 #### Overview
 
-This document is a companion to the Rancher v2.4.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
+This document is a companion to the Rancher v2.4 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
 
 This guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
 
 Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
 ---------------------------|----------|---------|-------|-----
-Self Assessment Guide v2.4.3 | Rancher v2.4.3 | Hardening Guide v2.4.3 | Kubernetes v1.15 | Benchmark v1.5
+Self Assessment Guide v2.4 | Rancher v2.4 | Hardening Guide v2.4 | Kubernetes v1.15 | Benchmark v1.5
 
 Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher-created clusters.
 
diff --git a/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
similarity index 96%
rename from content/rancher/v2.x/en/security/hardening-2.4.3/_index.md
rename to content/rancher/v2.x/en/security/hardening-2.4/_index.md
index ad6899eb6d2..494a509d7fc 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4.3/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
@@ -1,9 +1,9 @@
 ---
-title: Hardening Guide v2.4.3
+title: Hardening Guide v2.4
 weight: 99
 ---
 
-This document provides prescriptive guidance for hardening a production installation of Rancher v2.4.3. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
+This document provides prescriptive guidance for hardening a production installation of Rancher v2.4. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
 
 > This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes.
 
@@ -11,16 +11,16 @@ This hardening guide is intended to be used with specific versions of the CIS Ku
 
 Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
 ------------------------|----------------|-----------------------|------------------
-Hardening Guide v2.4.3 | Rancher v2.4.3 | Benchmark v1.5 | Kubernetes 1.15
+Hardening Guide v2.4 | Rancher v2.4 | Benchmark v1.5 | Kubernetes 1.15
 
 
-[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4.3/Rancher_Hardening_Guide.pdf)
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4/Rancher_Hardening_Guide.pdf)
 
 ### Overview
 
-This document provides prescriptive guidance for hardening a production installation of Rancher v2.4.3 with Kubernetes v1.15. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
+This document provides prescriptive guidance for hardening a production installation of Rancher v2.4 with Kubernetes v1.15. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
 
-For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS Benchmark Rancher Self-Assessment Guide - Rancher v2.4.3]({{< baseurl >}}/rancher/v2.x/en/security/benchmark-2.3.5/).
+For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS Benchmark Rancher Self-Assessment Guide - Rancher v2.4]({{< baseurl >}}/rancher/v2.x/en/security/benchmark-2.4/).
 
 #### Known Issues
 

From 32b98275b1c3fea3bee354bb0ddd2756b2f094d9 Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Fri, 5 Jun 2020 11:52:23 -0700
Subject: [PATCH 115/265] EIO-3: change conversion scripts to v2.4 from v2.4.3

---
 .../headers/{header-2.4.3.md => header-2.4.md}         | 10 +++++-----
 scripts/converters/scripts/results_to_md.sh            |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)
 rename scripts/converters/headers/{header-2.4.3.md => header-2.4.md} (74%)

diff --git a/scripts/converters/headers/header-2.4.3.md b/scripts/converters/headers/header-2.4.md
similarity index 74%
rename from scripts/converters/headers/header-2.4.3.md
rename to scripts/converters/headers/header-2.4.md
index 64457b3519f..d332a920962 100644
--- a/scripts/converters/headers/header-2.4.3.md
+++ b/scripts/converters/headers/header-2.4.md
@@ -1,21 +1,21 @@
 ---
-title: CIS Benchmark Rancher Self-Assessment Guide - v2.4.3
+title: CIS Benchmark Rancher Self-Assessment Guide - v2.4
 weight: 105
 ---
 
-### CIS Kubernetes Benchmark v1.5 - Rancher v2.4.3 with Kubernetes v1.15
+### CIS Kubernetes Benchmark v1.5 - Rancher v2.4 with Kubernetes v1.15
 
-[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4.3/Rancher_Benchmark_Assessment.pdf)
+[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.4/Rancher_Benchmark_Assessment.pdf)
 
 #### Overview
 
-This document is a companion to the Rancher v2.4.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
+This document is a companion to the Rancher v2.4 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
 
 This guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
 
 Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
 ---------------------------|----------|---------|-------|-----
-Self Assessment Guide v2.4.3 | Rancher v2.4.3 | Hardening Guide v2.4.3 | Kubernetes v1.15 | Benchmark v1.5
+Self Assessment Guide v2.4 | Rancher v2.4 | Hardening Guide v2.4 | Kubernetes v1.15 | Benchmark v1.5
 
 Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of `Not Applicable`. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher-created clusters.
 
diff --git a/scripts/converters/scripts/results_to_md.sh b/scripts/converters/scripts/results_to_md.sh
index d1eeb1ff4d4..45aea25fb3c 100755
--- a/scripts/converters/scripts/results_to_md.sh
+++ b/scripts/converters/scripts/results_to_md.sh
@@ -34,7 +34,7 @@ get_test() {
   jq -r --arg id "${id}" --arg section "${section}" --arg test_number "${test_number}" 'select(.id==$id).tests[] | select(.section==$section).results[] | select(.test_number==$test_number)' ${results_file}
 }
 
-cat headers/header-2.4.3.md
+cat headers/header-2.4.md
 
 for id in $(get_ids); do
   echo "## ${id} $(get_id_text ${id})"

From 178f2cf3afe1be0ab5486a1cc218070246278035 Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Fri, 5 Jun 2020 16:20:43 -0700
Subject: [PATCH 116/265] EIO-4: corrections needed to address issues found in
 5.1.5 tests

---
 content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md | 2 +-
 content/rancher/v2.x/en/security/benchmark-2.4/_index.md   | 4 ++--
 content/rancher/v2.x/en/security/hardening-2.3.5/_index.md | 3 ++-
 content/rancher/v2.x/en/security/hardening-2.4/_index.md   | 3 ++-
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
index 93ff61ceed9..2d836d12fc0 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
@@ -1975,7 +1975,7 @@ systemctl restart kubelet.service
 
 #### 5.1.5 Ensure that default service accounts are not actively used. (Scored)
 
-**Result:** PASS
+**Result:** FAIL
 
 **Remediation:**
 Create explicit service accounts wherever a Kubernetes workload requires specific access
diff --git a/content/rancher/v2.x/en/security/benchmark-2.4/_index.md b/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
index 30841ba2027..e5a16487085 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
@@ -1975,7 +1975,7 @@ systemctl restart kubelet.service
 
 #### 5.1.5 Ensure that default service accounts are not actively used. (Scored)
 
-**Result:** PASS
+**Result:** FAIL
 
 **Remediation:**
 Create explicit service accounts wherever a Kubernetes workload requires specific access
@@ -2006,7 +2006,7 @@ if [[ "${accounts}" != "" ]]; then
   exit 1
 fi
 
-default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name=="default").metadata.uid' | wc -l)"
+default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name!="default").metadata.uid' | wc -l)"
 
 if [[ "${default_binding}" -gt 0 ]]; then
 	echo "fail: default service accounts have non default bindings"
diff --git a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
index 75a48a7ba50..383cb7c02b9 100644
--- a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
@@ -24,7 +24,8 @@ For more detail about evaluating a hardened cluster against the official CIS ben
 
 #### Known Issues
 
-Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
+- Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
+- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
 
 ### Configure Kernel Runtime Parameters
 
diff --git a/content/rancher/v2.x/en/security/hardening-2.4/_index.md b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
index 494a509d7fc..ce11610407e 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
@@ -24,7 +24,8 @@ For more detail about evaluating a hardened cluster against the official CIS ben
 
 #### Known Issues
 
-Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
+- Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
+- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
 
 ### Configure Kernel Runtime Parameters
 

From e896f83d329661bf210f6d2a25cb15e3a7948542 Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Mon, 8 Jun 2020 08:53:10 -0700
Subject: [PATCH 117/265] EIO-4: typo fix

---
 content/rancher/v2.x/en/security/hardening-2.3.5/_index.md | 2 +-
 content/rancher/v2.x/en/security/hardening-2.4/_index.md   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
index 383cb7c02b9..13f8965da9e 100644
--- a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
@@ -24,7 +24,7 @@ For more detail about evaluating a hardened cluster against the official CIS ben
 
 #### Known Issues
 
-- Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
+- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes.
 - When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
 
 ### Configure Kernel Runtime Parameters
diff --git a/content/rancher/v2.x/en/security/hardening-2.4/_index.md b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
index ce11610407e..47923a5d429 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
@@ -24,7 +24,7 @@ For more detail about evaluating a hardened cluster against the official CIS ben
 
 #### Known Issues
 
-- Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
+- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes.
 - When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
 
 ### Configure Kernel Runtime Parameters

From dd6b9613774a680e656308b2ad0573e5272ef44e Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Mon, 8 Jun 2020 09:51:48 -0700
Subject: [PATCH 118/265] EIO-4: known issue update

---
 content/rancher/v2.x/en/security/hardening-2.3.5/_index.md | 4 ++--
 content/rancher/v2.x/en/security/hardening-2.4/_index.md   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
index 13f8965da9e..4f9aa6849e8 100644
--- a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
@@ -24,8 +24,8 @@ For more detail about evaluating a hardened cluster against the official CIS ben
 
 #### Known Issues
 
-- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes.
-- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
+- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes.
+- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.5 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
 
 ### Configure Kernel Runtime Parameters
 
diff --git a/content/rancher/v2.x/en/security/hardening-2.4/_index.md b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
index 47923a5d429..fd0614ad98a 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
@@ -24,8 +24,8 @@ For more detail about evaluating a hardened cluster against the official CIS ben
 
 #### Known Issues
 
-- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes.
-- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
+- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes.
+- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.5 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
 
 ### Configure Kernel Runtime Parameters
 

From deaf02c09c600e4ef1a134ba010062fe7a1457e2 Mon Sep 17 00:00:00 2001
From: Jacob Blain Christen <dweomer5@gmail.com>
Date: Thu, 4 Jun 2020 18:24:52 -0700
Subject: [PATCH 119/265] os: v1.5.6

---
 .../v1.x/en/installation/amazon-ecs/_index.md | 36 +++++++++----------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/content/os/v1.x/en/installation/amazon-ecs/_index.md b/content/os/v1.x/en/installation/amazon-ecs/_index.md
index 10dae1ffddb..bc642bee97d 100644
--- a/content/os/v1.x/en/installation/amazon-ecs/_index.md
+++ b/content/os/v1.x/en/installation/amazon-ecs/_index.md
@@ -58,25 +58,23 @@ rancher:
 
 ### Amazon ECS enabled AMIs
 
-Latest Release: [v1.5.4](https://github.com/rancher/os/releases/tag/v1.5.4)
+Latest Release: [v1.5.6](https://github.com/rancher/os/releases/tag/v1.5.6)
 
 Region | Type | AMI
 ---|--- | ---
-eu-north-1 | HVM - ECS enabled | [ami-0c46c1da6468aa948](https://eu-north-1.console.aws.amazon.com/ec2/home?region=eu-north-1#launchInstanceWizard:ami=ami-0c46c1da6468aa948)
-ap-south-1 | HVM - ECS enabled | [ami-097e5fa868c46e925](https://ap-south-1.console.aws.amazon.com/ec2/home?region=ap-south-1#launchInstanceWizard:ami=ami-097e5fa868c46e925)
-eu-west-3 | HVM - ECS enabled | [ami-016e7d630d7f608e4](https://eu-west-3.console.aws.amazon.com/ec2/home?region=eu-west-3#launchInstanceWizard:ami=ami-016e7d630d7f608e4)
-eu-west-2 | HVM - ECS enabled | [ami-00aacd261ab72302e](https://eu-west-2.console.aws.amazon.com/ec2/home?region=eu-west-2#launchInstanceWizard:ami=ami-00aacd261ab72302e)
-eu-west-1 | HVM - ECS enabled | [ami-0812b3f8aec8d2d81](https://eu-west-1.console.aws.amazon.com/ec2/home?region=eu-west-1#launchInstanceWizard:ami=ami-0812b3f8aec8d2d81)
-ap-northeast-2 | HVM - ECS enabled | [ami-0d9d77df6579e618a](https://ap-northeast-2.console.aws.amazon.com/ec2/home?region=ap-northeast-2#launchInstanceWizard:ami=ami-0d9d77df6579e618a)
-ap-northeast-1 | HVM - ECS enabled | [ami-09e957ac11ef430a3](https://ap-northeast-1.console.aws.amazon.com/ec2/home?region=ap-northeast-1#launchInstanceWizard:ami=ami-09e957ac11ef430a3)
-sa-east-1 | HVM - ECS enabled | [ami-09c22f3ce89280ed4](https://sa-east-1.console.aws.amazon.com/ec2/home?region=sa-east-1#launchInstanceWizard:ami=ami-09c22f3ce89280ed4)
-ca-central-1 | HVM - ECS enabled | [ami-016ac80225e649cf9](https://ca-central-1.console.aws.amazon.com/ec2/home?region=ca-central-1#launchInstanceWizard:ami=ami-016ac80225e649cf9)
-ap-southeast-1 | HVM - ECS enabled | [ami-06cdfc80bdbd6f419](https://ap-southeast-1.console.aws.amazon.com/ec2/home?region=ap-southeast-1#launchInstanceWizard:ami=ami-06cdfc80bdbd6f419)
-ap-southeast-2 | HVM - ECS enabled | [ami-0335f7bb1c51c0a74](https://ap-southeast-2.console.aws.amazon.com/ec2/home?region=ap-southeast-2#launchInstanceWizard:ami=ami-0335f7bb1c51c0a74)
-eu-central-1 | HVM - ECS enabled | [ami-0af71ec7ee8b729be](https://eu-central-1.console.aws.amazon.com/ec2/home?region=eu-central-1#launchInstanceWizard:ami=ami-0af71ec7ee8b729be)
-us-east-1 | HVM - ECS enabled | [ami-07209d7ec9e7545b4](https://us-east-1.console.aws.amazon.com/ec2/home?region=us-east-1#launchInstanceWizard:ami=ami-07209d7ec9e7545b4)
-us-east-2 | HVM - ECS enabled | [ami-046358fe356dd0e35](https://us-east-2.console.aws.amazon.com/ec2/home?region=us-east-2#launchInstanceWizard:ami=ami-046358fe356dd0e35)
-us-west-1 | HVM - ECS enabled | [ami-031bcb65b47cb0a77](https://us-west-1.console.aws.amazon.com/ec2/home?region=us-west-1#launchInstanceWizard:ami=ami-031bcb65b47cb0a77)
-us-west-2 | HVM - ECS enabled | [ami-0d92d296ecb13ea45](https://us-west-2.console.aws.amazon.com/ec2/home?region=us-west-2#launchInstanceWizard:ami=ami-0d92d296ecb13ea45)
-cn-north-1 | HVM - ECS enabled | [ami-04f1668aaf990acf6](https://cn-north-1.console.amazonaws.cn/ec2/home?region=cn-north-1#launchInstanceWizard:ami=ami-04f1668aaf990acf6)
-cn-northwest-1 | HVM - ECS enabled | [ami-0771f259ffce58280](https://cn-northwest-1.console.amazonaws.cn/ec2/home?region=cn-northwest-1#launchInstanceWizard:ami=ami-0771f259ffce58280)
+eu-north-1 | HVM - ECS enabled | [ami-0539b842146882049](https://eu-north-1.console.aws.amazon.com/ec2/home?region=eu-north-1#launchInstanceWizard:ami=ami-0539b842146882049)
+ap-south-1 | HVM - ECS enabled | [ami-0d3b8d8f26c689b4f](https://ap-south-1.console.aws.amazon.com/ec2/home?region=ap-south-1#launchInstanceWizard:ami=ami-0d3b8d8f26c689b4f)
+eu-west-3 | HVM - ECS enabled | [ami-0fea51d2e82d132a0](https://eu-west-3.console.aws.amazon.com/ec2/home?region=eu-west-3#launchInstanceWizard:ami=ami-0fea51d2e82d132a0)
+eu-west-2 | HVM - ECS enabled | [ami-00c3a19135715c851](https://eu-west-2.console.aws.amazon.com/ec2/home?region=eu-west-2#launchInstanceWizard:ami=ami-00c3a19135715c851)
+eu-west-1 | HVM - ECS enabled | [ami-012c49dfd6efe2b69](https://eu-west-1.console.aws.amazon.com/ec2/home?region=eu-west-1#launchInstanceWizard:ami=ami-012c49dfd6efe2b69)
+ap-northeast-2 | HVM - ECS enabled | [ami-02c46f0bcf41b4979](https://ap-northeast-2.console.aws.amazon.com/ec2/home?region=ap-northeast-2#launchInstanceWizard:ami=ami-02c46f0bcf41b4979)
+ap-northeast-1 | HVM - ECS enabled | [ami-0354daa9f30fe60e6](https://ap-northeast-1.console.aws.amazon.com/ec2/home?region=ap-northeast-1#launchInstanceWizard:ami=ami-0354daa9f30fe60e6)
+sa-east-1 | HVM - ECS enabled | [ami-00856c117fa05835f](https://sa-east-1.console.aws.amazon.com/ec2/home?region=sa-east-1#launchInstanceWizard:ami=ami-00856c117fa05835f)
+ca-central-1 | HVM - ECS enabled | [ami-0b0cb5188439bf169](https://ca-central-1.console.aws.amazon.com/ec2/home?region=ca-central-1#launchInstanceWizard:ami=ami-0b0cb5188439bf169)
+ap-southeast-1 | HVM - ECS enabled | [ami-0d8a0ed617d75bacc](https://ap-southeast-1.console.aws.amazon.com/ec2/home?region=ap-southeast-1#launchInstanceWizard:ami=ami-0d8a0ed617d75bacc)
+ap-southeast-2 | HVM - ECS enabled | [ami-029cebde25901dcc9](https://ap-southeast-2.console.aws.amazon.com/ec2/home?region=ap-southeast-2#launchInstanceWizard:ami=ami-029cebde25901dcc9)
+eu-central-1 | HVM - ECS enabled | [ami-0d513a54a3e67e38e](https://eu-central-1.console.aws.amazon.com/ec2/home?region=eu-central-1#launchInstanceWizard:ami=ami-0d513a54a3e67e38e)
+us-east-1 | HVM - ECS enabled | [ami-0f5cc7a532c3171c3](https://us-east-1.console.aws.amazon.com/ec2/home?region=us-east-1#launchInstanceWizard:ami=ami-0f5cc7a532c3171c3)
+us-east-2 | HVM - ECS enabled | [ami-030615e199666fd4b](https://us-east-2.console.aws.amazon.com/ec2/home?region=us-east-2#launchInstanceWizard:ami=ami-030615e199666fd4b)
+us-west-1 | HVM - ECS enabled | [ami-0b530a841750e3315](https://us-west-1.console.aws.amazon.com/ec2/home?region=us-west-1#launchInstanceWizard:ami=ami-0b530a841750e3315)
+us-west-2 | HVM - ECS enabled | [ami-0f1e06359f24f6480](https://us-west-2.console.aws.amazon.com/ec2/home?region=us-west-2#launchInstanceWizard:ami=ami-0f1e06359f24f6480)

From 18240084e0d896076f011dc698f05d37442923e1 Mon Sep 17 00:00:00 2001
From: resamaraschi <resa.maraschi@googlemail.com>
Date: Tue, 11 Feb 2020 14:24:02 +0100
Subject: [PATCH 120/265] Brings some missing information

---
 content/rke/latest/en/installation/certs/_index.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/content/rke/latest/en/installation/certs/_index.md b/content/rke/latest/en/installation/certs/_index.md
index 1907a0a68eb..13bb27681fe 100644
--- a/content/rke/latest/en/installation/certs/_index.md
+++ b/content/rke/latest/en/installation/certs/_index.md
@@ -36,11 +36,13 @@ The following certificates must exist in the certificate directory.
 |       Kube Scheduler       |          kube-scheduler.pem         |          kube-scheduler-key.pem         |
 |         Kube Proxy         |            kube-proxy.pem           |            kube-proxy-key.pem           |
 |         Kube Admin         |            kube-admin.pem           |            kube-admin-key.pem           |
+|         Kube Node          |            kube-node.pem           |            kube-node-key.pem             |
 |   Apiserver Proxy Client   |   kube-apiserver-proxy-client.pem   |   kube-apiserver-proxy-client-key.pem   |
 |         Etcd Nodes         |        kube-etcd-x-x-x-x.pem        |        kube-etcd-x-x-x-x-key.pem        |
-| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem | kube-apiserver-requestheader-ca-key.pem |
+| Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem* | kube-apiserver-requestheader-ca-key.pem** |
 |    Service Account Token   |                  -                  |    kube-service-account-token-key.pem   |
-
+* Is the same as kube-ca.pem 
+** Is the same as kube-ca-key
 ## Generating Certificate Signing Requests (CSRs) and Keys
 
 If you want to create and sign the certificates by a real Certificate Authority (CA), you can use RKE to generate a set of Certificate Signing Requests (CSRs) and keys. Using the `rke cert generate-csr` command, you can generate the CSRs and keys.

From 277ed59166787c56a42665516c28f6c43499ebc4 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 9 Jun 2020 10:29:40 -0700
Subject: [PATCH 121/265] Add escape characters to footnote asterisks

---
 content/rke/latest/en/installation/certs/_index.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/content/rke/latest/en/installation/certs/_index.md b/content/rke/latest/en/installation/certs/_index.md
index 13bb27681fe..e71e4575223 100644
--- a/content/rke/latest/en/installation/certs/_index.md
+++ b/content/rke/latest/en/installation/certs/_index.md
@@ -41,8 +41,10 @@ The following certificates must exist in the certificate directory.
 |         Etcd Nodes         |        kube-etcd-x-x-x-x.pem        |        kube-etcd-x-x-x-x-key.pem        |
 | Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem* | kube-apiserver-requestheader-ca-key.pem** |
 |    Service Account Token   |                  -                  |    kube-service-account-token-key.pem   |
-* Is the same as kube-ca.pem 
-** Is the same as kube-ca-key
+
+\* Is the same as kube-ca.pem 
+\** Is the same as kube-ca-key
+
 ## Generating Certificate Signing Requests (CSRs) and Keys
 
 If you want to create and sign the certificates by a real Certificate Authority (CA), you can use RKE to generate a set of Certificate Signing Requests (CSRs) and keys. Using the `rke cert generate-csr` command, you can generate the CSRs and keys.

From b57caabed0fb077466d7d2dc3ccff7cc15a855ab Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 9 Jun 2020 12:04:00 -0700
Subject: [PATCH 122/265] Add line break

---
 content/rke/latest/en/installation/certs/_index.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/content/rke/latest/en/installation/certs/_index.md b/content/rke/latest/en/installation/certs/_index.md
index e71e4575223..33e58e72bf3 100644
--- a/content/rke/latest/en/installation/certs/_index.md
+++ b/content/rke/latest/en/installation/certs/_index.md
@@ -42,7 +42,8 @@ The following certificates must exist in the certificate directory.
 | Kube Api Request Header CA | kube-apiserver-requestheader-ca.pem* | kube-apiserver-requestheader-ca-key.pem** |
 |    Service Account Token   |                  -                  |    kube-service-account-token-key.pem   |
 
-\* Is the same as kube-ca.pem 
+\* Is the same as kube-ca.pem
+
 \** Is the same as kube-ca-key
 
 ## Generating Certificate Signing Requests (CSRs) and Keys

From 2cbc613b66645596a26af4396f4b6342c3ee28fb Mon Sep 17 00:00:00 2001
From: orangedeng <jxfa0043379@hotmail.com>
Date: Fri, 21 Jun 2019 10:01:26 +0800
Subject: [PATCH 123/265] Create doc for prometheus metrics usage

---
 .../tools/monitoring/custom-metrics/_index.md | 489 ++++++++++++++++++
 1 file changed, 489 insertions(+)
 create mode 100644 content/rancher/v2.x/en/cluster-admin/tools/monitoring/custom-metrics/_index.md

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/custom-metrics/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/custom-metrics/_index.md
new file mode 100644
index 00000000000..a78b62ee206
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/custom-metrics/_index.md
@@ -0,0 +1,489 @@
+---
+title: Prometheus Custom Metrics Adapter
+weight: 5
+---
+
+After you've enabled [cluster level monitoring]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring), You can view the metrics data from Rancher. You can also deploy the Prometheus custom metrics adapter then you can use the HPA with metrics stored in cluster monitoring.
+
+## Deploy Prometheus Custom Metrics Adapter
+
+We are going to use the [Prometheus custom metrics adapter](https://github.com/DirectXMan12/k8s-prometheus-adapter/releases/tag/v0.5.0), version v0.5.0. This is a great example for the [custom metrics server](https://github.com/kubernetes-incubator/custom-metrics-apiserver). And you must be the *cluster owner* to execute following steps.
+
+- Get the service account of the cluster monitoring is using. It should be configured in the workload ID: `statefulset:cattle-prometheus:prometheus-cluster-monitoring`. And if you didn't customize anything, the service account name should be `cluster-monitoring`.
+
+- Grant permission to that service account. You will need two kinds of permission. 
+One role is `extension-apiserver-authentication-reader` in `kube-system`, so you will need to create a `Rolebinding` to in `kube-system`. This permission is to get api aggregation configuration from config map in `kube-system`.
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: custom-metrics-auth-reader
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- kind: ServiceAccount
+  name: cluster-monitoring
+  namespace: cattle-prometheus
+```
+
+The other one is cluster role `system:auth-delegator`, so you will need to create a `ClusterRoleBinding`. This permission is to have subject access review permission.
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: custom-metrics:system:auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: cluster-monitoring
+  namespace: cattle-prometheus
+```
+
+- Create configuration for custom metrics adapter. Following is an example configuration. There will be a configuration details in next session.
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: adapter-config
+  namespace: cattle-prometheus
+data:
+  config.yaml: |
+    rules:
+    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+      seriesFilters: []
+      resources:
+        overrides:
+          namespace:
+            resource: namespace
+          pod_name:
+            resource: pod
+      name:
+        matches: ^container_(.*)_seconds_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[1m])) by (<<.GroupBy>>)
+    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+      seriesFilters:
+      - isNot: ^container_.*_seconds_total$
+      resources:
+        overrides:
+          namespace:
+            resource: namespace
+          pod_name:
+            resource: pod
+      name:
+        matches: ^container_(.*)_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[1m])) by (<<.GroupBy>>)
+    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+      seriesFilters:
+      - isNot: ^container_.*_total$
+      resources:
+        overrides:
+          namespace:
+            resource: namespace
+          pod_name:
+            resource: pod
+      name:
+        matches: ^container_(.*)$
+        as: ""
+      metricsQuery: sum(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}) by (<<.GroupBy>>)
+    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
+      seriesFilters:
+      - isNot: .*_total$
+      resources:
+        template: <<.Resource>>
+      name:
+        matches: ""
+        as: ""
+      metricsQuery: sum(<<.Series>>{<<.LabelMatchers>>}) by (<<.GroupBy>>)
+    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
+      seriesFilters:
+      - isNot: .*_seconds_total
+      resources:
+        template: <<.Resource>>
+      name:
+        matches: ^(.*)_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
+    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
+      seriesFilters: []
+      resources:
+        template: <<.Resource>>
+      name:
+        matches: ^(.*)_seconds_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
+    resourceRules:
+      cpu:
+        containerQuery: sum(rate(container_cpu_usage_seconds_total{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
+        nodeQuery: sum(rate(container_cpu_usage_seconds_total{<<.LabelMatchers>>, id='/'}[1m])) by (<<.GroupBy>>)
+        resources:
+          overrides:
+            instance:
+              resource: node
+            namespace:
+              resource: namespace
+            pod_name:
+              resource: pod
+        containerLabel: container_name
+      memory:
+        containerQuery: sum(container_memory_working_set_bytes{<<.LabelMatchers>>}) by (<<.GroupBy>>)
+        nodeQuery: sum(container_memory_working_set_bytes{<<.LabelMatchers>>,id='/'}) by (<<.GroupBy>>)
+        resources:
+          overrides:
+            instance:
+              resource: node
+            namespace:
+              resource: namespace
+            pod_name:
+              resource: pod
+        containerLabel: container_name
+      window: 1m
+```
+
+- Create HTTPS TLS certs for your api server. You can use following command to create a self-signed cert.
+
+```bash
+openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out serving.crt -keyout serving.key -subj "/C=CN/CN=custom-metrics-apiserver.cattle-prometheus.svc.cluster.local"
+# And you will find serving.crt and serving.key in your path. And then you are going to create a secret in cattle-prometheus namespace.
+kubectl create secret generic -n cattle-prometheus cm-adapter-serving-certs --from-file=serving.key=./serving.key --from-file=serving.crt=./serving.crt 
+```
+
+- Then you can create the prometheus custom metrics adapter. And you will need a service for this deployment too. Creating it via Import YAML or Rancher would do. Please create those resources in `cattle-prometheus` namespaces.
+
+Here is the prometheus custom metrics adapter deployment.
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: custom-metrics-apiserver
+  name: custom-metrics-apiserver
+  namespace: cattle-prometheus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: custom-metrics-apiserver
+  template:
+    metadata:
+      labels:
+        app: custom-metrics-apiserver
+      name: custom-metrics-apiserver
+    spec:
+      serviceAccountName: cluster-monitoring
+      containers:
+      - name: custom-metrics-apiserver
+        image: directxman12/k8s-prometheus-adapter-amd64:v0.5.0
+        args:
+        - --secure-port=6443
+        - --tls-cert-file=/var/run/serving-cert/serving.crt
+        - --tls-private-key-file=/var/run/serving-cert/serving.key
+        - --logtostderr=true
+        - --prometheus-url=http://prometheus-operated/
+        - --metrics-relist-interval=1m
+        - --v=10
+        - --config=/etc/adapter/config.yaml
+        ports:
+        - containerPort: 6443
+        volumeMounts:
+        - mountPath: /var/run/serving-cert
+          name: volume-serving-cert
+          readOnly: true
+        - mountPath: /etc/adapter/
+          name: config
+          readOnly: true
+        - mountPath: /tmp
+          name: tmp-vol
+      volumes:
+      - name: volume-serving-cert
+        secret:
+          secretName: cm-adapter-serving-certs
+      - name: config
+        configMap:
+          name: adapter-config
+      - name: tmp-vol
+        emptyDir: {}
+
+```
+
+Here is the service of the deployment.
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: custom-metrics-apiserver
+  namespace: cattle-prometheus
+spec:
+  ports:
+  - port: 443
+    targetPort: 6443
+  selector:
+    app: custom-metrics-apiserver
+```
+
+- Create API service for your custom metric server.
+
+```yaml
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
+metadata:
+  name: v1beta1.custom.metrics.k8s.io
+spec:
+  service:
+    name: custom-metrics-apiserver
+    namespace: cattle-prometheus
+  group: custom.metrics.k8s.io
+  version: v1beta1
+  insecureSkipTLSVerify: true
+  groupPriorityMinimum: 100
+  versionPriority: 100
+
+```
+
+- Then you can verify your custom metrics server by `kubectl get --raw /apis/custom.metrics.k8s.io/v1beta1`. If you see the return datas from the api, it means that the metrics server has been successfully set up.
+
+- You create HPA with custom metrics now. Here is an example of HPA. You will need to create a nginx deployment in your namespace first.
+
+```yaml
+kind: HorizontalPodAutoscaler
+apiVersion: autoscaling/v2beta1
+metadata:
+  name: nginx
+spec:
+  scaleTargetRef:
+    # point the HPA at the nginx deployment you just created
+    apiVersion: apps/v1
+    kind: Deployment
+    name: nginx
+  # autoscale between 1 and 10 replicas
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  # use a "Pods" metric, which takes the average of the
+  # given metric across all pods controlled by the autoscaling target
+  - type: Pods
+    pods:
+      metricName: memory_usage_bytes
+      targetAverageValue: 5000000
+```
+
+And then, you should see your nginx is scaling up. HPA with custom metrics works.
+
+## Configuration of prometheus custom metrics adapter
+
+> Refer to https://github.com/DirectXMan12/k8s-prometheus-adapter/blob/master/docs/config.md
+
+The adapter determines which metrics to expose, and how to expose them,
+through a set of "discovery" rules.  Each rule is executed independently
+(so make sure that your rules are mutually exclusive), and specifies each
+of the steps the adapter needs to take to expose a metric in the API.
+
+Each rule can be broken down into roughly four parts:
+
+- *Discovery*, which specifies how the adapter should find all Prometheus
+  metrics for this rule.
+
+- *Association*, which specifies how the adapter should determine which
+  Kubernetes resources a particular metric is associated with.
+
+- *Naming*, which specifies how the adapter should expose the metric in
+  the custom metrics API.
+
+- *Querying*, which specifies how a request for a particular metric on one
+  or more Kubernetes objects should be turned into a query to Prometheus.
+
+A more comprehensive configuration file can be found in
+[sample-config.yaml](sample-config.yaml), but a basic config with one rule
+might look like:
+
+```yaml
+rules:
+# this rule matches cumulative cAdvisor metrics measured in seconds
+- seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+  resources:
+    # skip specifying generic resource<->label mappings, and just
+    # attach only pod and namespace resources by mapping label names to group-resources
+    overrides:
+      namespace: {resource: "namespace"},
+      pod_name: {resource: "pod"},
+  # specify that the `container_` and `_seconds_total` suffixes should be removed.
+  # this also introduces an implicit filter on metric family names
+  name:
+    # we use the value of the capture group implicitly as the API name
+    # we could also explicitly write `as: "$1"`
+    matches: "^container_(.*)_seconds_total$"
+  # specify how to construct a query to fetch samples for a given series
+  # This is a Go template where the `.Series` and `.LabelMatchers` string values
+  # are available, and the delimiters are `<<` and `>>` to avoid conflicts with
+  # the prometheus query language
+  metricsQuery: "sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[2m])) by (<<.GroupBy>>)"
+```
+
+### Discovery
+
+Discovery governs the process of finding the metrics that you want to
+expose in the custom metrics API.  There are two fields that factor into
+discovery: `seriesQuery` and `seriesFilters`.
+
+`seriesQuery` specifies Prometheus series query (as passed to the
+`/api/v1/series` endpoint in Prometheus) to use to find some set of
+Prometheus series.  The adapter will strip the label values from this
+series, and then use the resulting metric-name-label-names combinations
+later on.
+
+In many cases, `seriesQuery` will be sufficient to narrow down the list of
+Prometheus series.  However, sometimes (especially if two rules might
+otherwise overlap), it's useful to do additional filtering on metric
+names.  In this case, `seriesFilters` can be used.  After the list of
+series is returned from `seriesQuery`, each series has its metric name
+filtered through any specified filters.
+
+Filters may be either:
+
+- `is: <regex>`, which matches any series whose name matches the specified
+  regex.
+
+- `isNot: <regex>`, which matches any series whose name does not match the
+  specified regex.
+
+For example:
+
+```yaml
+# match all cAdvisor metrics that aren't measured in seconds
+seriesQuery: '{__name__=~"^container_.*_total",container_name!="POD",namespace!="",pod_name!=""}'
+seriesFilters:
+  isNot: "^container_.*_seconds_total"
+```
+
+### Association
+
+Association governs the process of figuring out which Kubernetes resources
+a particular metric could be attached to.  The `resources` field controls
+this process.
+
+There are two ways to associate resources with a particular metric.  In
+both cases, the value of the label becomes the name of the particular
+object.
+
+One way is to specify that any label name that matches some particular
+pattern refers to some group-resource based on the label name.  This can
+be done using the `template` field.   The pattern is specified as a Go
+template, with the `Group` and `Resource` fields representing group and
+resource. You don't necessarily have to use the `Group` field (in which
+case the group is guessed by the system). For instance:
+
+```yaml
+# any label `kube_<group>_<resource>` becomes <group>.<resource> in Kubernetes
+resources:
+  template: "kube_<<.Group>>_<<.Resource>>"
+```
+
+The other way is to specify that some particular label represents some
+particular Kubernetes resource.  This can be done using the `overrides`
+field.  Each override maps a Prometheus label to a Kubernetes
+group-resource. For instance:
+
+```yaml
+# the microservice label corresponds to the apps.deployment resource
+resource:
+  overrides:
+    microservice: {group: "apps", resource: "deployment"}
+```
+
+These two can be combined, so you can specify both a template and some
+individual overrides.
+
+The resources mentioned can be any resource available in your kubernetes
+cluster, as long as you've got a corresponding label.
+
+### Naming
+
+Naming governs the process of converting a Prometheus metric name into
+a metric in the custom metrics API, and vice versa.  It's controlled by
+the `name` field.
+
+Naming is controlled by specifying a pattern to extract an API name from
+a Prometheus name, and potentially a transformation on that extracted
+value.
+
+The pattern is specified in the `matches` field, and is just a regular
+expression.  If not specified, it defaults to `.*`.
+
+The transformation is specified by the `as` field.  You can use any
+capture groups defined in the `matches` field.  If the `matches` field
+doesn't contain capture groups, the `as` field defaults to `$0`.  If it
+contains a single capture group, the `as` field defautls to `$1`.
+Otherwise, it's an error not to specify the as field.
+
+For example:
+
+```yaml
+# match turn any name <name>_total to <name>_per_second
+# e.g. http_requests_total becomes http_requests_per_second
+name:
+  matches: "^(.*)_total$"
+  as: "${1}_per_second"
+```
+
+### Querying
+
+Querying governs the process of actually fetching values for a particular
+metric.  It's controlled by the `metricsQuery` field.
+
+The `metricsQuery` field is a Go template that gets turned into
+a Prometheus query, using input from a particular call to the custom
+metrics API. A given call to the custom metrics API is distilled down to
+a metric name, a group-resource, and one or more objects of that
+group-resource.  These get turned into the following fields in the
+template:
+
+- `Series`: the metric name
+- `LabelMatchers`: a comma-separated list of label matchers matching the
+  given objects.  Currently, this is the label for the particular
+  group-resource, plus the label for namespace, if the group-resource is
+  namespaced.
+- `GroupBy`: a comma-separated list of labels to group by.  Currently,
+  this contains the group-resource label used in `LabelMatchers`.
+
+For instance, suppose we had a series `http_requests_total` (exposed as
+`http_requests_per_second` in the API) with labels `service`, `pod`,
+`ingress`, `namespace`, and `verb`. The first four correspond to
+Kubernetes resources.  Then, if someone requested the metric
+`pods/http_request_per_second` for the pods `pod1` and `pod2` in the
+`somens` namespace, we'd have:
+
+- `Series: "http_requests_total"`
+- `LabelMatchers: "pod=~\"pod1|pod2",namespace="somens"`
+- `GroupBy`: `pod`
+
+Additionally, there are two advanced fields that are "raw" forms of other
+fields:
+
+- `LabelValuesByName`: a map mapping the labels and values from the
+  `LabelMatchers` field.  The values are pre-joined by `|`
+  (for used with the `=~` matcher in Prometheus).
+- `GroupBySlice`: the slice form of `GroupBy`.
+
+In general, you'll probably want to use the `Series`, `LabelMatchers`, and
+`GroupBy` fields.  The other two are for advanced usage.
+
+The query is expected to return one value for each object requested.  The
+adapter will use the labels on the returned series to associate a given
+series back to its corresponding object.
+
+For example:
+
+```yaml
+# convert cumulative cAdvisor metrics into rates calculated over 2 minutes
+metricsQuery: "sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[2m])) by (<<.GroupBy>>)"
+```

From fc8f2783992c68513bd7add9290748731acd7708 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 9 Jun 2020 13:02:16 -0700
Subject: [PATCH 124/265] Make installation requirements applicable to both
 Docker and containerd

---
 .../en/cluster-provisioning/node-requirements/_index.md   | 2 +-
 .../en/installation/k8s-install/create-nodes-lb/_index.md | 4 ++--
 .../air-gap/prepare-nodes/_index.md                       | 4 ++--
 .../rancher/v2.x/en/installation/requirements/_index.md   | 8 ++++++--
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md b/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
index e4de1d49010..403ecdcc208 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
@@ -11,7 +11,7 @@ In this section, "user cluster" refers to a cluster running your apps, which sho
 
 Make sure the nodes for the Rancher server fulfill the following requirements:
 
-- [Operating systems and Docker requirements](#operating-systems-and-docker-requirements)
+- [Operating systems and container runtime requirements](#operating-systems-and-container-runtime-requirements)
 - [Hardware Requirements](#hardware-requirements)
 - [Networking Requirements](#networking-requirements)
 - [Optional: Security Considerations](#optional-security-considerations)
diff --git a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
index b1594b5a11b..8add940e8ce 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
@@ -24,7 +24,7 @@ To install the Rancher management server on a high-availability K3s cluster, we
 
 ### 1. Set up Linux Nodes
 
-Make sure that your nodes fulfill the general installation requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
 
 For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2.
 
@@ -90,7 +90,7 @@ The etcd database requires an odd number of nodes so that it can always elect a
 
 ### 1. Set up Linux Nodes
 
-Make sure that your nodes fulfill the general installation requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
 
 For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node/) for setting up nodes as instances in Amazon EC2.
 
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/_index.md
index ec59eb1582a..b235b29e64b 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/_index.md
@@ -25,7 +25,7 @@ We recommend setting up the following infrastructure for a high-availability ins
 
 These hosts will be disconnected from the internet, but require being able to connect with your private registry.
 
-Make sure that your nodes fulfill the general installation requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
 
 For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2.
 
@@ -104,7 +104,7 @@ The etcd database requires an odd number of nodes so that it can always elect a
 
 These hosts will be disconnected from the internet, but require being able to connect with your private registry.
 
-Make sure that your nodes fulfill the general installation requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
 
 For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2.
 
diff --git a/content/rancher/v2.x/en/installation/requirements/_index.md b/content/rancher/v2.x/en/installation/requirements/_index.md
index 64f12941d77..eb2463fcc02 100644
--- a/content/rancher/v2.x/en/installation/requirements/_index.md
+++ b/content/rancher/v2.x/en/installation/requirements/_index.md
@@ -23,9 +23,11 @@ For a list of best practices that we recommend for running the Rancher server in
 
 The Rancher UI works best in Firefox or Chrome.
 
-# Operating Systems and Docker Requirements
+# Operating Systems and Container Runtime Requirements
 
-Rancher should work with any modern Linux distribution and any modern Docker version.
+Rancher should work with any modern Linux distribution.
+
+For the container runtime, RKE should work with any modern Docker version, while K3s should work with any modern version of Docker or containerd.
 
 Rancher and RKE have been tested and are supported on Ubuntu, CentOS, Oracle Linux, RancherOS, and RedHat Enterprise Linux.
 
@@ -35,6 +37,8 @@ K3s should run on just about any flavor of Linux. However, K3s is tested on the
 - Ubuntu 18.04 (amd64)
 - Raspbian Buster (armhf)
 
+If you are installing Rancher on a K3s cluster with **Raspbian Buster**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster) to switch to legacy iptables.
+
 If you are installing Rancher on a K3s cluster with Alpine Linux, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#additional-preparation-for-alpine-linux-setup) for additional setup.
 
 For details on which OS and Docker versions were tested with each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)

From 26c1a171ecf3931df8f17a8d121d67d03773451b Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 9 Jun 2020 13:08:27 -0700
Subject: [PATCH 125/265] Replace <CA_CERTS> with <CA_CERTS.pem>

---
 .../options/air-gap-helm2/install-rancher/_index.md           | 2 +-
 .../air-gap/install-rancher/_index.md                         | 2 +-
 .../other-installation-methods/single-node-docker/_index.md   | 2 +-
 .../rancher/v2.x/en/upgrades/upgrades/single-node/_index.md   | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
index 37fb1ddbc72..1767e4b7eb6 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
@@ -278,7 +278,7 @@ After creating your certificate, log into your Linux host, and then run the inst
 | `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
 | `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
 | `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<CA_CERTS>`                     | The path to the certificate authority's certificate.                                                                          |
+| `<CA_CERTS.pem>`                     | The path to the certificate authority's certificate.                                                                          |
 | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
 | `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
 
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index e445d7fa9f6..08505aafb3a 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -277,7 +277,7 @@ After creating your certificate, log into your Linux host, and then run the inst
 | `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
 | `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
 | `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<CA_CERTS>`                     | The path to the certificate authority's certificate.                                                                          |
+| `<CA_CERTS.pem>`                     | The path to the certificate authority's certificate.                                                                          |
 | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
 | `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
 
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
index ac06ed134eb..97e9673c322 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
@@ -64,7 +64,7 @@ After creating your certificate, run the Docker command below to install Rancher
 | `<CERT_DIRECTORY>`  | The path to the directory containing your certificate files. |
 | `<FULL_CHAIN.pem>`  | The path to your full certificate chain.                     |
 | `<PRIVATE_KEY.pem>` | The path to the private key for your certificate.            |
-| `<CA_CERTS>`        | The path to the certificate authority's certificate.         |
+| `<CA_CERTS.pem>`        | The path to the certificate authority's certificate.         |
 
 ```bash
 docker run -d --restart=unless-stopped \
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
index 3b1448cc156..d83c6a64e2e 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
@@ -151,7 +151,7 @@ Placeholder | Description
  `<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
 `<FULL_CHAIN.pem>` | The path to your full certificate chain.
 `<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
-`<CA_CERTS>` | The path to the certificate authority's certificate.
+`<CA_CERTS.pem>` | The path to the certificate authority's certificate.
 `<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
 
 ```
@@ -253,7 +253,7 @@ Placeholder | Description
 `<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
 `<FULL_CHAIN.pem>` | The path to your full certificate chain.
 `<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
-`<CA_CERTS>` | The path to the certificate authority's certificate.
+`<CA_CERTS.pem>` | The path to the certificate authority's certificate.
 `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.
 `<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
 

From 655d83feebb822e1d2875df6cc093a1ef9b49ae3 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 9 Jun 2020 20:54:13 -0700
Subject: [PATCH 126/265] Add GCE to list of supported cloud providers

---
 .../rke-clusters/cloud-providers/_index.md                     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md
index 70dc4464f42..e883a5a8916 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/_index.md
@@ -13,10 +13,11 @@ Your cluster will not provision correctly if you configure a cloud provider clus
 
 By default, the **Cloud Provider** option is set to `None`.
 
-Supported cloud providers are:
+The following cloud providers can be enabled:
 
 * Amazon
 * Azure
+* GCE (Google Compute Engine)
 
 ### Setting up the Amazon Cloud Provider
 

From 8bd84006971639eb1737a0902d4574ec437223b1 Mon Sep 17 00:00:00 2001
From: Thanh Nhan Pham <phamthanhnhan14@gmail.com>
Date: Fri, 15 May 2020 10:15:40 +0700
Subject: [PATCH 127/265] Update `/var/lib/etcd/wal` directories

---
 content/rancher/v2.x/en/installation/options/etcd/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/options/etcd/_index.md b/content/rancher/v2.x/en/installation/options/etcd/_index.md
index 2f99cd9737f..bbfefa11a28 100644
--- a/content/rancher/v2.x/en/installation/options/etcd/_index.md
+++ b/content/rancher/v2.x/en/installation/options/etcd/_index.md
@@ -25,7 +25,7 @@ You can follow the recommendations from [the etcd docs](https://etcd.io/docs/v3.
 
 Additionally, to reduce IO contention on the disks for etcd, you can use a dedicated device for the data and wal directory. Based on etcd best practices, mirroring RAID configurations are unnecessary because etcd replicates data between the nodes in the cluster. You can use stripping RAID configurations to increase available IOPS.
 
-To implement this solution in an RKE cluster, the `/var/lib/etcd/data` and `/var/lib/etc/wal` directories will need to have disks mounted and formatted on the underlying host. In the `extra_args` directive of the `etcd` service, you must include the `wal_dir` directory. Without specifying the `wal_dir`, etcd process will try to manipulate the underlying `wal` mount with insufficient permissions.
+To implement this solution in an RKE cluster, the `/var/lib/etcd/data` and `/var/lib/etcd/wal` directories will need to have disks mounted and formatted on the underlying host. In the `extra_args` directive of the `etcd` service, you must include the `wal_dir` directory. Without specifying the `wal_dir`, etcd process will try to manipulate the underlying `wal` mount with insufficient permissions.
 
 ```yaml
 # RKE cluster.yml

From f9e949425e05f3d5799bd4e9e090f2914e07acf1 Mon Sep 17 00:00:00 2001
From: Nicola Kabar <nicolaka@gmail.com>
Date: Thu, 7 May 2020 09:01:32 -0500
Subject: [PATCH 128/265] Update _index.md

---
 content/rancher/v2.x/en/faq/networking/cni-providers/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/faq/networking/cni-providers/_index.md b/content/rancher/v2.x/en/faq/networking/cni-providers/_index.md
index ec07fe5018d..223b58a02b4 100644
--- a/content/rancher/v2.x/en/faq/networking/cni-providers/_index.md
+++ b/content/rancher/v2.x/en/faq/networking/cni-providers/_index.md
@@ -114,7 +114,7 @@ The following table summarizes the different features available for each CNI net
 | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
 | Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | No | Yes |
 | Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | No | No |
-| Calico | Unencapsulated | Yes | Yes | Yes | Etcd | No | Yes |
+| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | No | Yes |
 | Weave | Encapsulated | Yes | Yes | Yes | No | Yes | Yes |
 
 - Network Model: Encapsulated or unencapsulated. For more information, see [What Network Models are Used in CNI?](#what-network-models-are-used-in-cni)

From 5153d83f909cc7484b954e8efcaf56dc5e7112c0 Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Mon, 8 Jun 2020 18:14:48 +0100
Subject: [PATCH 129/265] Made the test's need to use the admin user more
 apparent

---
 .../rancher/v2.x/en/admin-settings/authentication/ad/_index.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md
index 6b72f6752c4..222f3c4c1e2 100644
--- a/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/authentication/ad/_index.md
@@ -106,7 +106,7 @@ The table below details the parameters for the group schema configuration.
 
 ### Test Authentication
 
-Once you have completed the configuration, proceed by testing  the connection to the AD server. Authentication with the configured Active Directory will be enabled implicitly if the test is successful.
+Once you have completed the configuration, proceed by testing the connection to the AD server **using your AD admin account**. If the test is successful, authentication with the configured Active Directory will be enabled implicitly with the account you test with set as admin.
 
 > **Note:**
 >

From 1b5a6946221366933b17cc396ef446427e0d00be Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Thu, 11 Jun 2020 14:09:36 +0100
Subject: [PATCH 130/265] Added teh custom_ca option to the example

---
 .../latest/en/etcd-snapshots/recurring-snapshots/_index.md    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md b/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
index fe67a69dc0c..145f3466510 100644
--- a/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
+++ b/content/rke/latest/en/etcd-snapshots/recurring-snapshots/_index.md
@@ -89,6 +89,10 @@ services:
         region: ""
         folder: "" # Optional - Available as of v0.3.0
         endpoint: s3.amazonaws.com
+        custom_ca: |-
+          -----BEGIN CERTIFICATE-----
+          $CERTIFICATE
+          -----END CERTIFICATE-----
 ```
 
 {{% /tab %}}

From 78b9d86e3bbdfde92580c23792779a10b246db5a Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Fri, 12 Jun 2020 21:28:58 +0100
Subject: [PATCH 131/265] Rewrote some sections to clarify

---
 .../en/backups/restorations/ha-restoration/_index.md  | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
index 5b8cfd3e0b6..32052f35d7c 100644
--- a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
@@ -6,9 +6,10 @@ aliases:
   - /rancher/v2.x/en/installation/after-installation/ha-backup-and-restoration/
 ---
 
-This procedure describes how to use RKE to restore a snapshot of the Rancher Kubernetes cluster. The cluster snapshot will include Kubernetes configuration and the Rancher database and state.
+This procedure describes how to use RKE to restore a snapshot of the Rancher Kubernetes cluster. 
+This will restore the Kubernetes configuration and the Rancher database and state.
 
-Additionally, the `pki.bundle.tar.gz` file usage is no longer required as v0.2.0 has changed how the [Kubernetes cluster state is stored]({{<baseurl>}}/rke/latest/en/installation/#kubernetes-cluster-state).
+RKE v0.2.0 has changed how the [Kubernetes cluster state is stored]({{<baseurl>}}/rke/latest/en/installation/#kubernetes-cluster-state), so `pki.bundle.tar.gz` file usage is no longer required.
 
 ## Restore Outline
 
@@ -24,11 +25,11 @@ Additionally, the `pki.bundle.tar.gz` file usage is no longer required as v0.2.0
 
 ### 1. Preparation
 
-You will need [RKE]({{<baseurl>}}/rke/latest/en/installation/) and [kubectl]({{<baseurl>}}/rancher/v2.x/en/faq/kubectl/) CLI utilities installed.
+It is advised that you run the restore from your local host or a jump box/bastion where your cluster yaml, rke statefile, and kubeconfig are stored.  You will need [RKE]({{<baseurl>}}/rke/latest/en/installation/) and [kubectl]({{<baseurl>}}/rancher/v2.x/en/faq/kubectl/) CLI utilities installed locally.
 
-Prepare by creating 3 new nodes to be the target for the restored Rancher instance.  See [Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/) for node requirements.
+Prepare by creating 3 new nodes to be the target for the restored Rancher instance.  We recommend that you start with fresh nodes and a clean state. For clarification on the requirements, review the [Installation Requirements](https://rancher.com/docs/rancher/v2.x/en/installation/requirements/).  
 
-We recommend that you start with fresh nodes and a clean state. Alternatively you can clear Kubernetes and Rancher configurations from the existing nodes. This will destroy the data on these nodes. See [Node Cleanup]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) for the procedure.
+Alternatively you can re-use the existing nodes after clearing Kubernetes and Rancher configurations. This will destroy the data on these nodes. See [Node Cleanup]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) for the procedure.
 
 > **IMPORTANT:** Before starting the restore make sure all the Kubernetes services on the old cluster nodes are stopped. We recommend powering off the nodes to be sure.
 

From befe541f94331933f5aadf3e0570ad47ef41a4a2 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 11 May 2020 21:09:20 -0700
Subject: [PATCH 132/265] Update NLB setup doc for K3s Rancher installs

---
 .../en/installation/options/nlb/_index.md     | 84 ++++++++++++-------
 1 file changed, 55 insertions(+), 29 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/options/nlb/_index.md
index 78d170d6714..333e4a03a56 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/nlb/_index.md
@@ -10,7 +10,11 @@ This how-to guide describes how to set up a Network Load Balancer (NLB) in Amazo
 
 These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
 
-> **Note:** Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ALB.
+This tutorial is about one possible way to set up your load balancer, not the only way. Other types of load balancers, such as a Classic Load Balancer or Application Load Balancer, could also direct traffic to the Rancher server nodes.
+
+Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ALB.
+
+# Setting up the Load Balancer
 
 Configuring an Amazon NLB is a multistage process:
 
@@ -19,38 +23,46 @@ Configuring an Amazon NLB is a multistage process:
 3. [Create Your NLB](#3-create-your-nlb)
 4. [Add listener to NLB for TCP port 80](#4-add-listener-to-nlb-for-tcp-port-80)
 
-> **Prerequisite:** These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these two nodes.
+# Requirements
+
+These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
 
 # 1. Create Target Groups
 
 Begin by creating two target groups for the **TCP** protocol, one with TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
 
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX ingress controller on the nodes will make sure that port 80 gets redirected to port 443.
+Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but it's convenient to add a listener for port 80, because traffic to port 80 will be automatically redirected to port 443.
+
+Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, the Ingress should redirect traffic from port 80 to port 443.
 
 1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
 1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
 1. Click **Create target group** to create the first target group, regarding TCP port 443.
 
+> **Note:** Health checks are handled differently based on the Ingress. For details, refer to [this section.](#health-check-paths-for-nginx-ingress-and-traefik-ingresses)
+
 ### Target Group (TCP port 443)
 
 Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
 
-| Option                              | Setting           |
-| ----------------------------------- | ----------------- |
-| Target Group Name                   | `rancher-tcp-443` |
-| Protocol                            | `TCP`             |
-| Port                                | `443`             |
+| Option      | Setting           | 
+| --------- | ----------------- | 
+| Target Group Name       | `rancher-tcp-443` |
 | Target type                         | `instance`        |
+| Protocol                            | `TCP`             | 
+| Port                                | `443`                   | 
 | VPC                                 | Choose your VPC   |
-| Protocol<br/>(Health Check)         | `HTTP`            |
-| Path<br/>(Health Check)             | `/healthz`        |
-| Port (Advanced health check)        | `override`,`80`   |
-| Healthy threshold (Advanced health) | `3`               |
-| Unhealthy threshold (Advanced)      | `3`               |
-| Timeout (Advanced)                  | `6 seconds`       |
-| Interval (Advanced)                 | `10 second`       |
-| Success codes                       | `200-399`         |
 
+Health check settings:
+
+| Option                                |       |
+| ---------------------------|------|
+| Protocol        | TCP            |
+| Port        | `override`,`80`   |
+| Healthy threshold | `3`               |
+| Unhealthy threshold       | `3`               |
+| Timeout                   | `6 seconds`       |
+| Interval                | `10 seconds`       |
 
 Click **Create target group** to create the second target group, regarding TCP port 80.
 
@@ -58,21 +70,24 @@ Click **Create target group** to create the second target group, regarding TCP p
 
 Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table.
 
-| Option                              | Setting          |
-| ----------------------------------- | ---------------- |
-| Target Group Name                   | `rancher-tcp-80` |
+| Option    | Setting          |
+| --------- | ---------------- | 
+| Target Group Name                   | `rancher-tcp-80` | 
+| Target type                         | `instance`       | 
 | Protocol                            | `TCP`            |
 | Port                                | `80`             |
-| Target type                         | `instance`       |
-| VPC                                 | Choose your VPC  |
-| Protocol<br/>(Health Check)         | `HTTP`           |
-| Path<br/>(Health Check)             | `/healthz`       |
-| Port (Advanced health check)        | `traffic port`   |
-| Healthy threshold (Advanced health) | `3`              |
-| Unhealthy threshold (Advanced)      | `3`              |
-| Timeout (Advanced)                  | `6 seconds`      |
-| Interval (Advanced)                 | `10 second`      |
-| Success codes                       | `200-399`        |
+| VPC                                 | Choose your VPC  | 
+
+Health check settings:
+
+| Option                                |       |
+| ---------------------------|------|
+| Protocol        | TCP            |
+| Port        | `traffic port`   |
+| Healthy threshold | `3`               |
+| Unhealthy threshold       | `3`               |
+| Timeout                   | `6 seconds`       |
+| Interval                | `10 seconds`       |
 
 # 2. Register Targets
 
@@ -153,3 +168,14 @@ After AWS creates the NLB, click **Close**.
 5. From the **Forward to** drop-down, choose `rancher-tcp-80`.
 
 6. Click **Save** in the top right of the screen.
+
+# Health Check Paths for NGINX Ingress and Traefik Ingresses
+
+K3s and RKE Kubernetes clusters handle health checks differently because they use different Ingresses by default.
+
+For RKE Kubernetes clusters, NGINX Ingress is used by default, whereas for K3s Kubernetes clusters, Traefik is the default Ingress. 
+
+- **Traefik:** The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
+- **NGINX Ingress:** The default backend of the NGINX Ingress controller has a `/healthz` endpoint. By default `/healthz` is always matched (regardless of Host), and a response from [`ingress-nginx` itself](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212) is always served.
+
+To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.
\ No newline at end of file

From d0d9b7054b60124083e6792f20f5ff1afaad26fa Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 12 Jun 2020 16:01:50 -0700
Subject: [PATCH 133/265] Fic table formatting

---
 .../v2.x/en/installation/options/nlb/_index.md       | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/options/nlb/_index.md
index 333e4a03a56..431b354b915 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/nlb/_index.md
@@ -45,12 +45,12 @@ Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, th
 
 Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
 
-| Option      | Setting           | 
-| --------- | ----------------- | 
-| Target Group Name       | `rancher-tcp-443` |
+| Option                              | Setting           | 
+|-------------------------------------|-------------------| 
+| Target Group Name                   | `rancher-tcp-443` |
 | Target type                         | `instance`        |
-| Protocol                            | `TCP`             | 
-| Port                                | `443`                   | 
+| Protocol                            | `TCP`             |
+| Port                                | `443`             |
 | VPC                                 | Choose your VPC   |
 
 Health check settings:
@@ -178,4 +178,4 @@ For RKE Kubernetes clusters, NGINX Ingress is used by default, whereas for K3s K
 - **Traefik:** The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
 - **NGINX Ingress:** The default backend of the NGINX Ingress controller has a `/healthz` endpoint. By default `/healthz` is always matched (regardless of Host), and a response from [`ingress-nginx` itself](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212) is always served.
 
-To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.
\ No newline at end of file
+To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.

From 1b7de456fbf93a81d4a2fb6cca622c5a3dd065fd Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 12 Jun 2020 16:29:54 -0700
Subject: [PATCH 134/265] Clean up formatting

---
 .../en/installation/options/nlb/_index.md     | 65 ++++++++++---------
 1 file changed, 33 insertions(+), 32 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/options/nlb/_index.md
index 431b354b915..cf863775ba5 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/nlb/_index.md
@@ -43,51 +43,52 @@ Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, th
 
 ### Target Group (TCP port 443)
 
-Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
+Configure the first target group according to the table below.
 
-| Option                              | Setting           | 
-|-------------------------------------|-------------------| 
-| Target Group Name                   | `rancher-tcp-443` |
-| Target type                         | `instance`        |
-| Protocol                            | `TCP`             |
-| Port                                | `443`             |
-| VPC                                 | Choose your VPC   |
+| Option            | Setting           |
+|-------------------|-------------------|
+| Target Group Name | `rancher-tcp-443` |
+| Target type       | `instance`        |
+| Protocol          | `TCP`             |
+| Port              | `443`             |
+| VPC               | Choose your VPC   |
 
 Health check settings:
 
-| Option                                |       |
-| ---------------------------|------|
-| Protocol        | TCP            |
-| Port        | `override`,`80`   |
-| Healthy threshold | `3`               |
-| Unhealthy threshold       | `3`               |
-| Timeout                   | `6 seconds`       |
-| Interval                | `10 seconds`       |
+| Option              | Setting         |
+|---------------------|-----------------|
+| Protocol            | TCP             |
+| Port                | `override`,`80` |
+| Healthy threshold   | `3`             |
+| Unhealthy threshold | `3`             |
+| Timeout             | `6 seconds`     |
+| Interval            | `10 seconds`    |
 
 Click **Create target group** to create the second target group, regarding TCP port 80.
 
 ### Target Group (TCP port 80)
 
-Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table.
+Configure the second target group according to the table below.
+
+| Option            | Setting          |
+|-------------------|------------------|
+| Target Group Name | `rancher-tcp-80` |
+| Target type       | `instance`       |
+| Protocol          | `TCP`            |
+| Port              | `80`             |
+| VPC               | Choose your VPC  |
 
-| Option    | Setting          |
-| --------- | ---------------- | 
-| Target Group Name                   | `rancher-tcp-80` | 
-| Target type                         | `instance`       | 
-| Protocol                            | `TCP`            |
-| Port                                | `80`             |
-| VPC                                 | Choose your VPC  | 
 
 Health check settings:
 
-| Option                                |       |
-| ---------------------------|------|
-| Protocol        | TCP            |
-| Port        | `traffic port`   |
-| Healthy threshold | `3`               |
-| Unhealthy threshold       | `3`               |
-| Timeout                   | `6 seconds`       |
-| Interval                | `10 seconds`       |
+| Option              |Setting         |
+|---------------------|----------------|
+| Protocol            | TCP            |
+| Port                | `traffic port` |
+| Healthy threshold   | `3`            |
+| Unhealthy threshold | `3`            |
+| Timeout             | `6 seconds`    |
+| Interval            | `10 seconds`   |
 
 # 2. Register Targets
 

From a54bda273bb0721af134958aeca303042beb55db Mon Sep 17 00:00:00 2001
From: dkeightley <derek@rancher.com>
Date: Sun, 14 Jun 2020 12:36:21 +1200
Subject: [PATCH 135/265] Update worker troubleshooting

Correct count and role to match the doc page
---
 .../kubernetes-components/worker-and-generic/_index.md        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/troubleshooting/kubernetes-components/worker-and-generic/_index.md b/content/rancher/v2.x/en/troubleshooting/kubernetes-components/worker-and-generic/_index.md
index d102694fe45..28ee4499bb4 100644
--- a/content/rancher/v2.x/en/troubleshooting/kubernetes-components/worker-and-generic/_index.md
+++ b/content/rancher/v2.x/en/troubleshooting/kubernetes-components/worker-and-generic/_index.md
@@ -7,7 +7,7 @@ This section applies to every node as it includes components that run on nodes w
 
 # Check if the Containers are Running
 
-There are three specific containers launched on nodes with the `controlplane` role:
+There are two specific containers launched on nodes with the `worker` role:
 
 * kubelet
 * kube-proxy
@@ -32,4 +32,4 @@ The logging of the containers can contain information on what the problem could
 ```
 docker logs kubelet
 docker logs kube-proxy
-```
\ No newline at end of file
+```

From fc6e623ceb7dc233f7f41d6b139ea2ec1e1613b6 Mon Sep 17 00:00:00 2001
From: jrcreative <jeremy@jeremyrosscreative.com>
Date: Wed, 10 Jun 2020 14:40:30 -0700
Subject: [PATCH 136/265] cta block

---
 assets/js/app.js             |  28 ++--
 assets/sass/app.scss         |  57 ++++++++
 layouts/_default/list.html   | 260 +++++++++++++++++++++--------------
 layouts/_default/single.html |  41 +++---
 4 files changed, 245 insertions(+), 141 deletions(-)

diff --git a/assets/js/app.js b/assets/js/app.js
index 7dffc3d485e..ce9b1c4de7a 100644
--- a/assets/js/app.js
+++ b/assets/js/app.js
@@ -1,6 +1,6 @@
 // This is for any custom JS that may need to be added to individual apps.
 // Main JS is located in Rancher Website Theme
-const bootstrapDocsSearch = function() {
+const bootstrapDocsSearch = function () {
 
   var firstSearchRender = true;
 
@@ -78,26 +78,26 @@ const bootstrapDocsSearch = function() {
 
     // add a button
     let label = wrapper.find('.footer-button-label').data('footer-label');
-    if ( label ) {
-      modal.addFooterBtn(label, 'tingle-btn tingle-btn--primary', function() {
+    if (label) {
+      modal.addFooterBtn(label, 'tingle-btn tingle-btn--primary', function () {
         // here goes some logic
         modal.close();
       });
     }
 
     modal.open();
-    setTimeout(function() {
+    setTimeout(function () {
       $('#search-box').focus();
     }, 50);
   });
 
   //mobile nav toggle
-  $(document).ready(function() {
+  $(document).ready(function () {
     $("body").addClass("js");
     var $menu = $("#menu"),
-        $menulink = $(".menu-link");
+      $menulink = $(".menu-link");
 
-    $menulink.click(function() {
+    $menulink.click(function () {
       $menulink.toggleClass("active");
       $menu.toggleClass("active");
       return false;
@@ -105,29 +105,29 @@ const bootstrapDocsSearch = function() {
   });
 }
 
-const bootstrapIdLinks = function() {
+const bootstrapIdLinks = function () {
   const $container = $('.main-content')
   const selector = 'h2[id], h3[id], h4[id], h5[id], h6[id]';
 
-  $container.on('mouseenter', selector, function(e) {
+  $container.on('mouseenter', selector, function (e) {
     $(e.target).append($('<a />').addClass('header-anchor').attr('href', '#' + e.target.id).html('<i style="font-size: 12px" aria-hidden="true">link</i>'));
   });
 
-  $container.on('mouseleave', selector, function(e) {
+  $container.on('mouseleave', selector, function (e) {
     $container.find('.header-anchor').remove();
   });
 }
 
-const replaceReleaseChannel = function() {
+const replaceReleaseChannel = function () {
   const form = $('#release-channel')[0];
-  if ( form ) {
+  if (form) {
     const val = form.channel.value;
 
     $('CODE').each((idx, code) => {
       const $code = $(code);
       const text = $code.data('original') || code.innerHTML;
 
-      if ( text.includes('&lt;CHART_REPO&gt;') ) {
+      if (text.includes('&lt;CHART_REPO&gt;')) {
         $code.data('original', text);
         code.innerHTML = text.replace(/&lt;CHART_REPO&gt;/g, val);
       }
@@ -140,5 +140,3 @@ $(document).ready(() => {
   bootstrapIdLinks();
   replaceReleaseChannel();
 });
-
-
diff --git a/assets/sass/app.scss b/assets/sass/app.scss
index 679a9be83c8..82c102f2d36 100644
--- a/assets/sass/app.scss
+++ b/assets/sass/app.scss
@@ -16,4 +16,61 @@
 
 pre > code {
 	padding: 0;
+}
+
+.docs-cta-wrapper {
+  display: flex;
+  justify-content: flex-end;
+}
+
+.docs-cta {
+  padding: 10px;
+  background-color: #0075A8;
+  color: white;
+  border-radius: 30px;
+  display: flex;
+  align-content: center;
+  display: flex;
+  align-items: center;
+  margin-bottom: 1.5rem;
+  width: auto;
+  transition: width 200ms ease-in-out;
+
+  .content {
+    margin: 0 0.5rem;
+
+    a {
+      color: white;
+      text-decoration: underline;
+    }
+  }
+
+  .icon {
+    border: 2px solid white;
+    border-radius: 20px;
+    color: white;
+    height: 35px;
+    width: 35px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-weight: 900;
+  }
+
+  .close {
+    font-size: 20px;
+    background-color: rgba(255, 255, 255, 0.2);
+    border-radius: 20px;
+    height: 25px;
+    width: 25px;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    transition: background-color 250ms ease-in-out;
+    color: white;
+
+    &:hover {
+      background-color: rgba(255, 255, 255, 0.3);
+    }
+  }
 }
\ No newline at end of file
diff --git a/layouts/_default/list.html b/layouts/_default/list.html
index a08977e4c4e..62b5dacb579 100644
--- a/layouts/_default/list.html
+++ b/layouts/_default/list.html
@@ -1,23 +1,23 @@
 {{ define "title" }}
-  {{ .Title }} – {{ .Site.Title }}
+{{ .Title }} – {{ .Site.Title }}
 {{ end }}
 
 {{ define "hero" }}
 {{ end }}
 
 {{ define "main" }}
-  <section class="docs-container">
-    <div class="grid-container">
-      <div class="row max-sized set-lines set-ground">
-        <div class="col-4"></div>
-        <div class="col-4"></div>
-        <div class="col-4"></div>
-      </div>
+<section class="docs-container">
+  <div class="grid-container">
+    <div class="row max-sized set-lines set-ground">
+      <div class="col-4"></div>
+      <div class="col-4"></div>
+      <div class="col-4"></div>
+    </div>
 
-      <div class="head-blank"></div>
+    <div class="head-blank"></div>
 
-      <div class="row max-sized contents-container background-base-gray-side">
-        <div class="
+    <div class="row max-sized contents-container background-base-gray-side">
+      <div class="
         col-xl-3
         col-lg-4
         col-md-4
@@ -42,31 +42,80 @@
         col-12
         texts-container">
         <div class="docs-wrap">
-            {{ with .Params.Title }}
-            <h1 class="m-t-0">{{ . }}</h1>
-            <hr/>
+          <div class="docs-cta-wrapper">
+            <div class="docs-cta">
+              <a class="icon">?</a>
+              <span class="content">
+                <strong>Need Help? </strong>
+                &nbsp;<a href="https://rancher.com/training">Get free intro and advanced online training</a>
+              </span>
+              <a class="close">&times;</a>
+            </div>
+          </div>
+
+          <script>
+            function getCookie(name) {
+              var cookieArr = document.cookie.split(";");
+
+              for (var i = 0; i < cookieArr.length; i++) {
+                var cookiePair = cookieArr[i].split("=");
+
+                if (name == cookiePair[0].trim()) {
+                  return decodeURIComponent(cookiePair[1]);
+                }
+              }
+
+              return null;
+            }
+
+            console.log(getCookie('ctaClosed'))
+
+            if (getCookie('ctaClosed') == 'true') {
+              $('.docs-cta .content, .docs-cta .close').hide();
+              $('.docs-cta').addClass('closed');
+            }
+
+            $('.docs-cta .icon').click(function (e) {
+              e.preventDefault;
+              $('.docs-cta .content, .docs-cta .close').show('fast');
+              $('.docs-cta').remove('closed');
+              document.cookie = "ctaClosed=false;path=/";
+            });
+
+            $('.docs-cta .close').click(function (e) {
+              e.preventDefault;
+              $('.docs-cta .content, .docs-cta .close').hide('fast');
+              $('.docs-cta').toggleClass('closed');
+              document.cookie = "ctaClosed=true;SameSite=Lax;path=/;max-age=" + 10 * 24 * 60 * 60;
+            });
+          </script>
+          {{ with .Params.Title }}
+          <h1 class="m-t-0">{{ . }}</h1>
+          <hr />
           {{end}}
 
           {{ if .Params.ctaBanner }}
-            {{ with index .Site.Data.cta .Params.ctaBanner }}
-              <div class="docs-banner">
-                <h3 class="">{{ .header }}</h3>
+          {{ with index .Site.Data.cta .Params.ctaBanner }}
+          <div class="docs-banner">
 
-                <div class="buttons-container">
-                  <a href="{{ .link }}" target="_blank" class="btn border-btn">
-                    <button class="button has-icon-right">
-                      <span>{{ .button }}</span>
-                      <svg class="icon right" enable-background="new 0 0 34 34" viewBox="0 0 34 34" xmlns="http://www.w3.org/2000/svg">
-                        <g>
-                          <path class="svg-linear" d="m19.5 12 5 5-5 5"></path>
-                          <path class="svg-linear" d="m24.5 17h-15"></path>
-                        </g>
-                      </svg>
-                    </button>
-                  </a>
-                </div>
-              </div>
-            {{ end }}
+            <h3 class="">{{ .header }}</h3>
+
+            <div class="buttons-container">
+              <a href="{{ .link }}" target="_blank" class="btn border-btn">
+                <button class="button has-icon-right">
+                  <span>{{ .button }}</span>
+                  <svg class="icon right" enable-background="new 0 0 34 34" viewBox="0 0 34 34"
+                    xmlns="http://www.w3.org/2000/svg">
+                    <g>
+                      <path class="svg-linear" d="m19.5 12 5 5-5 5"></path>
+                      <path class="svg-linear" d="m24.5 17h-15"></path>
+                    </g>
+                  </svg>
+                </button>
+              </a>
+            </div>
+          </div>
+          {{ end }}
           {{ end }}
 
           <div class="main-content docs-body">
@@ -77,56 +126,57 @@
 
             {{ $paginator := .Scratch.Get "paginator" }}
             {{ range $paginator.Pages }}
-              <div class="box m-b-md">
-                <div class="p-a-sm">
-                  <h3><a href="{{.URL}}">{{.Title}}</a></h3>
+            <div class="box m-b-md">
+              <div class="p-a-sm">
+                <h3><a href="{{.URL}}">{{.Title}}</a></h3>
 
-                  {{ if .Params.Image }}
-                    <div class="thumbnail"><img src="{{ .Params.Image }}" alt="{{ .Params.Title }}"></div>
+                {{ if .Params.Image }}
+                <div class="thumbnail"><img src="{{ .Params.Image }}" alt="{{ .Params.Title }}"></div>
+                {{end}}
+
+                <p>{{ .Summary | safeHTML }}</p>
+                {{ if .Truncated }}
+                <div>
+                  <a href="{{ .RelPermalink }}">Read More…</a>
+                </div>
+                {{ end }}
+              </div>
+              <div class="bg-default">
+                <div class="row">
+
+                  {{ with .Params.Author }}
+                  <div class="p-h-sm p-v-xs"><i class="material-icons">person_outline</i> By: {{ . }}</div>
                   {{end}}
 
-                  <p>{{ .Summary | safeHTML }}</p>
-                  {{ if .Truncated }}
-                  <div>
-                    <a href="{{ .RelPermalink }}">Read More…</a>
+                  {{ if eq .Section "events" }}
+                  {{ with .Params.EventDate }}
+                  <div class="p-h-sm p-v-xs"><i class="material-icons">event</i> {{ . }}</div>
+                  {{end}}
+
+                  {{ else }}
+
+                  {{ with .Params.Date }}
+                  <div class="p-h-sm p-v-xs"><i class="material-icons">event</i> {{ .Format "January 2, 2006" }}</div>
+                  {{end}}
+                  {{end}}
+
+                  {{ if eq .Section "blog" }}
+                  <div class="p-h-sm p-v-xs"><i class="material-icons">timer</i> Read Time: {{.ReadingTime}} minutes
                   </div>
-                  {{ end }}
-                </div>
-                <div class="bg-default">
-                  <div class="row">
+                  {{end}}
 
-                    {{ with .Params.Author }}
-                      <div class="p-h-sm p-v-xs"><i class="material-icons">person_outline</i> By: {{ . }}</div>
-                    {{end}}
+                  {{ with .Params.Location }}
+                  <div class="p-h-sm p-v-xs"><i class="material-icons">location_on</i> {{ . }}</div>
+                  {{end}}
 
-                    {{ if eq .Section "events" }}
-                      {{ with .Params.EventDate }}
-                        <div class="p-h-sm p-v-xs"><i class="material-icons">event</i> {{ . }}</div>
-                      {{end}}
-
-                    {{ else }}
-
-                      {{ with .Params.Date }}
-                        <div class="p-h-sm p-v-xs"><i class="material-icons">event</i> {{ .Format "January 2, 2006" }}</div>
-                      {{end}}
-                    {{end}}
-
-                    {{ if eq .Section "blog" }}
-                      <div class="p-h-sm p-v-xs"><i class="material-icons">timer</i> Read Time: {{.ReadingTime}} minutes</div>
-                    {{end}}
-
-                    {{ with .Params.Location }}
-                      <div class="p-h-sm p-v-xs"><i class="material-icons">location_on</i> {{ . }}</div>
-                      {{end}}
-
-                  </div>
                 </div>
               </div>
-              {{ end }}
             </div>
-            {{ template "_internal/pagination.html" . }}
+            {{ end }}
+          </div>
+          {{ template "_internal/pagination.html" . }}
 
-            <div class="p-v-xs">{{ partial "page-edit.html" . }}</div>
+          <div class="p-v-xs">{{ partial "page-edit.html" . }}</div>
           </article>
           <!-- {{ with .TableOfContents }}
             <div class="offset-watch invisible"></div>
@@ -138,44 +188,44 @@
         </div>
       </div>
     </div>
-  </section>
+</section>
 
 
-  <script>
-    $(document).ready(function() {
-      $('.guide-menus-activator').click(function() {
-        $('.docs-container .side-menus').toggleClass('show');
-      });
+<script>
+  $(document).ready(function () {
+    $('.guide-menus-activator').click(function () {
+      $('.docs-container .side-menus').toggleClass('show');
+    });
 
-      // anchor click control.
-      $("a[href*='#']").click(function(e) {
+    // anchor click control.
+    $("a[href*='#']").click(function (e) {
       // e.preventDefault();
 
-        if ($(this).attr('data-target') === undefined && $(this).attr('href').length > 1) {
-          var hash = $(this).attr('href').substring(1),
-              objt = $('#' + hash),
-              objt_mt = Number(objt.css('margin-top').replace(/[^0-9]/g,"")),
-              depth = 80,
-              scrn = $(window).width();
-              scrn_check = 1025;
+      if ($(this).attr('data-target') === undefined && $(this).attr('href').length > 1) {
+        var hash = $(this).attr('href').substring(1),
+          objt = $('#' + hash),
+          objt_mt = Number(objt.css('margin-top').replace(/[^0-9]/g, "")),
+          depth = 80,
+          scrn = $(window).width();
+        scrn_check = 1025;
 
-          if (scrn < scrn_check) {
-            depth = 120;
-          }
-
-          if (objt_mt > 0) {
-            depth = depth + objt_mt
-          }
-
-          if ($(this).attr('href').charAt(0) === '#') {
-            var objectTop = $($(this).attr('href')).offset().top;
-
-            setTimeout(function() {
-              $('html').scrollTop(objectTop - depth);
-            }, 100);
-          }
+        if (scrn < scrn_check) {
+          depth = 120;
         }
-      });
+
+        if (objt_mt > 0) {
+          depth = depth + objt_mt
+        }
+
+        if ($(this).attr('href').charAt(0) === '#') {
+          var objectTop = $($(this).attr('href')).offset().top;
+
+          setTimeout(function () {
+            $('html').scrollTop(objectTop - depth);
+          }, 100);
+        }
+      }
     });
-  </script>
-{{ end }}
+  });
+</script>
+{{ end }}
\ No newline at end of file
diff --git a/layouts/_default/single.html b/layouts/_default/single.html
index c223f50adab..c7de0eeee7a 100644
--- a/layouts/_default/single.html
+++ b/layouts/_default/single.html
@@ -1,45 +1,44 @@
 {{ define "title" }}
-  {{ .Title }} – {{ .Site.Title }}
+{{ .Title }} – {{ .Site.Title }}
 {{ end }}
 
 {{ define "hero" }}
 <section class="hero">
-    <h5 class="text-white">Rancher 2.x Docs</h5>
-    {{ with .Params.Title }}
-      <h1 class="m-t-0">{{ . }}</h1>
-    {{end}}
+  <h5 class="text-white">Rancher 2.x Docs</h5>
+  {{ with .Params.Title }}
+  <h1 class="m-t-0">{{ . }}</h1>
+  {{end}}
 
-    {{ with .Params.Author }}
-      <span class="byline bg-link">{{ . }}</span>
-    {{end}}
+  {{ with .Params.Author }}
+  <span class="byline bg-link">{{ . }}</span>
+  {{end}}
 </section>
 {{ end }}
 
 {{ define "main" }}
 
 <div class="wrapper">
-    <div class="row m-t-sm">
+  <div class="row m-t-sm">
 
-      <aside class="col-sm-3 col-xs-12 p-l-0">
-        {{ partial "docs-side-nav.html" . }}
-      </aside>
+    <aside class="col-sm-3 col-xs-12 p-l-0">
+      {{ partial "docs-side-nav.html" . }}
+    </aside>
 
-      <article class="{{ if ($.Scratch.Get "showSidebar") }} col-sm-6 {{else}} col-md-9 p-r-lg {{end}} col-xs-12">
-
-        <div class="main-content ">
+    <article class="{{ if ($.Scratch.Get "showSidebar") }} col-sm-6 {{else}} col-md-9 p-r-lg {{end}} col-xs-12">
 
+      <div class="main-content ">
         {{ .Content }}
 
       </div>
 
-         <div class="p-v-sm">{{ partial "page-edit.html" . }}</div>
-      </article>
-     <!--  <div class="offset-watch invisible"></div>
+      <div class="p-v-sm">{{ partial "page-edit.html" . }}</div>
+    </article>
+    <!--  <div class="offset-watch invisible"></div>
       <aside class="col-sm-3 col-xs-12 unstyled toc-container">
         <h4 class="m-b-0">On this page</h4>
         {{ .TableOfContents }}
       </aside> -->
-    </div>
-
   </div>
-{{ end }}
+
+</div>
+{{ end }}
\ No newline at end of file

From b7f82211c406c4035ce8824f6bcf7881e6ee7348 Mon Sep 17 00:00:00 2001
From: jrcreative <jeremy@jeremyrosscreative.com>
Date: Thu, 11 Jun 2020 13:17:21 -0700
Subject: [PATCH 137/265] cta inline with heading

---
 assets/sass/app.scss       |  1 +
 layouts/_default/list.html | 24 ++++++++++--------------
 2 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/assets/sass/app.scss b/assets/sass/app.scss
index 82c102f2d36..5ff4ca6fdac 100644
--- a/assets/sass/app.scss
+++ b/assets/sass/app.scss
@@ -34,6 +34,7 @@ pre > code {
   align-items: center;
   margin-bottom: 1.5rem;
   width: auto;
+  float: right;
   transition: width 200ms ease-in-out;
 
   .content {
diff --git a/layouts/_default/list.html b/layouts/_default/list.html
index 62b5dacb579..7ac8d5bbb53 100644
--- a/layouts/_default/list.html
+++ b/layouts/_default/list.html
@@ -42,15 +42,13 @@
         col-12
         texts-container">
         <div class="docs-wrap">
-          <div class="docs-cta-wrapper">
-            <div class="docs-cta">
-              <a class="icon">?</a>
-              <span class="content">
-                <strong>Need Help? </strong>
-                &nbsp;<a href="https://rancher.com/training">Get free intro and advanced online training</a>
-              </span>
-              <a class="close">&times;</a>
-            </div>
+          <div class="docs-cta">
+            <a class="icon">?</a>
+            <span class="content">
+              <strong>Need Help? </strong>
+              &nbsp;<a href="https://rancher.com/training">Get free intro and advanced online training</a>
+            </span>
+            <a class="close">&times;</a>
           </div>
 
           <script>
@@ -64,12 +62,9 @@
                   return decodeURIComponent(cookiePair[1]);
                 }
               }
-
               return null;
             }
 
-            console.log(getCookie('ctaClosed'))
-
             if (getCookie('ctaClosed') == 'true') {
               $('.docs-cta .content, .docs-cta .close').hide();
               $('.docs-cta').addClass('closed');
@@ -78,17 +73,18 @@
             $('.docs-cta .icon').click(function (e) {
               e.preventDefault;
               $('.docs-cta .content, .docs-cta .close').show('fast');
-              $('.docs-cta').remove('closed');
+              $('.docs-cta').removeClass('closed');
               document.cookie = "ctaClosed=false;path=/";
             });
 
             $('.docs-cta .close').click(function (e) {
               e.preventDefault;
               $('.docs-cta .content, .docs-cta .close').hide('fast');
-              $('.docs-cta').toggleClass('closed');
+              $('.docs-cta').addClass('closed');
               document.cookie = "ctaClosed=true;SameSite=Lax;path=/;max-age=" + 10 * 24 * 60 * 60;
             });
           </script>
+
           {{ with .Params.Title }}
           <h1 class="m-t-0">{{ . }}</h1>
           <hr />

From d42ef45dcb851c9458071f2ddc98a508235482b2 Mon Sep 17 00:00:00 2001
From: Tejeev <Tejeev@users.noreply.github.com>
Date: Thu, 11 Jun 2020 15:02:36 +0100
Subject: [PATCH 138/265] Added the custom_ca option to the example

---
 content/rancher/v2.x/en/backups/backups/ha-backups/_index.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md b/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md
index 362b867745f..808e2377dd6 100644
--- a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md
@@ -71,6 +71,10 @@ To take recurring snapshots, enable the `etcd-snapshot` service, which is a serv
             folder: "folder-name" # Available as of v2.3.0
             endpoint: "s3.eu-west-1.amazonaws.com"
             region: "eu-west-1"
+            custom_ca: |-
+              -----BEGIN CERTIFICATE-----
+              $CERTIFICATE
+              -----END CERTIFICATE-----
     ```
 
     _Using RKE v0.1.x_

From 0bff2b97c1c130fbd59b8f64ed1b9ffc0ab68a3a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 17 Jun 2020 22:45:11 -0700
Subject: [PATCH 139/265] Avoid saying a secure private registry is required

---
 content/k3s/latest/en/installation/airgap/_index.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/installation/airgap/_index.md b/content/k3s/latest/en/installation/airgap/_index.md
index 7f9f4a8ec21..56d16c1b2e9 100644
--- a/content/k3s/latest/en/installation/airgap/_index.md
+++ b/content/k3s/latest/en/installation/airgap/_index.md
@@ -7,7 +7,8 @@ You can install K3s in an air-gapped environment using two different methods. Yo
 
 # Private Registry Method
 
-This document assumes you have already created your nodes in your air-gap environment and have a secure Docker private registry on your bastion host.
+This document assumes you have already created your nodes in your air-gap environment and have a Docker private registry on your bastion host.
+
 If you have not yet set up a private Docker registry, refer to the official documentation [here](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry).
 
 ### Create the Registry YAML

From ea8762e2f0fb5dee60060c93679f9cc00d763fe9 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 18 Jun 2020 14:03:51 -0700
Subject: [PATCH 140/265] Clarify that imported clusters can't be edited except
 K3s

---
 .../rancher/v2.x/en/cluster-admin/_index.md   | 26 ++++++++++---------
 .../v2.x/en/cluster-provisioning/_index.md    |  4 ++-
 2 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index 9b4371bfe7d..2665c8384cc 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -25,18 +25,20 @@ After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/e
 
 | Action | [Rancher launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) | [Hosted Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | [Imported Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters) |
 | --- | --- | ---| ---|
-| [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | * | * | * |
-| [Adding Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members/) | * | * | * |
-| [Editing Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) | * | * | * |
-| [Managing Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes) | * | * | * |
-| [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | * | * | * |
-| [Managing Projects and Namespaces]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | * | * | * |
-| [Configuring Tools](#configuring-tools) | * | * | * |
-| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| * | * | |
-| [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | * |  | |
-| [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | * | | |
-| [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | * | | |
-| [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/) | * | | |
+| [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | ✓ | ✓ | ✓ |
+| [Adding Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members/) | ✓ | ✓ | ✓ |
+| [Editing Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) | ✓ | ✓ | * |
+| [Managing Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes) | ✓ | ✓ | ✓ |
+| [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | ✓ | ✓ | ✓ |
+| [Managing Projects and Namespaces]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | ✓ | ✓ | ✓ |
+| [Configuring Tools](#configuring-tools) | ✓ | ✓ | ✓ |
+| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| ✓ | ✓ | |
+| [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | ✓ |  | |
+| [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | ✓ | | |
+| [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | ✓ | | |
+| [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/) | ✓ | | |
+
+/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
 
 ## Configuring Tools
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/_index.md b/content/rancher/v2.x/en/cluster-provisioning/_index.md
index 31c97b0aa06..e7f3cd03d3b 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/_index.md
@@ -31,9 +31,11 @@ The following table summarizes the options and settings available for each clust
 | Rancher Capability   | RKE Launched | Hosted Kubernetes Cluster | Imported Cluster |
 | -------------------- | ------------ | ------------------------- | ---------------- |
 | Manage member roles  | ✓            | ✓                         | ✓                |
-| Edit cluster options | ✓            |                           |
+| Edit cluster options | ✓            |                           |   *              |
 | Manage node pools    | ✓            |                           |
 
+/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.](#importing-and-editing-k3s-clusters)
+
 # Setting up Clusters in a Hosted Kubernetes Provider
 
 In this scenario, Rancher does not provision Kubernetes because it is installed by providers such as Google Kubernetes Engine (GKE), Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.

From 4f7658a001a8beae9f13f4b8f5faab7fbc15c7ba Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 9 Jun 2020 21:37:16 -0700
Subject: [PATCH 141/265] Add K3s FAQ about where logs can be found

---
 content/k3s/latest/en/faq/_index.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/content/k3s/latest/en/faq/_index.md b/content/k3s/latest/en/faq/_index.md
index d80a0394d6c..ed339e34059 100644
--- a/content/k3s/latest/en/faq/_index.md
+++ b/content/k3s/latest/en/faq/_index.md
@@ -20,3 +20,11 @@ At this time K3s does not natively support Windows, however we are open to the i
 **How can I build from source?**
 
 Please reference the K3s [BUILDING.md](https://github.com/rancher/k3s/blob/master/BUILDING.md) with instructions.
+
+**Where are the K3s logs?**
+
+The installation script will auto-detect if your OS is using systemd or openrc and start the service.
+
+When running with openrc, logs will be created at `/var/log/k3s.log`.
+
+When running with systemd, logs will be created in `/var/log/syslog` and viewed using `journalctl -u k3s`.
\ No newline at end of file

From 8d0dd404d216d036fe3de244de5f0da20ed82a99 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 9 Jun 2020 16:24:10 -0700
Subject: [PATCH 142/265] Link to details about auto-deployed manifests for K3s

---
 content/k3s/latest/en/architecture/_index.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/architecture/_index.md b/content/k3s/latest/en/architecture/_index.md
index 6b116eb62e2..106c2d460c8 100644
--- a/content/k3s/latest/en/architecture/_index.md
+++ b/content/k3s/latest/en/architecture/_index.md
@@ -15,6 +15,7 @@ This page covers the following topics:
 - [High-availability K3s server with an external database](#high-availability-k3s-server-with-an-external-db)
   - [Fixed registration address for agent nodes](#fixed-registration-address-for-agent-nodes)
 - [How agent node registration works](#how-agent-node-registration-works)
+- [Automatically deployed manifests](#automatically-deployed-manifests)
 
 # Single-server Setup with an Embedded DB
 
@@ -51,4 +52,8 @@ Agents will register with the server using the node cluster secret along with a
 
 If the `/etc/rancher/node` directory of an agent is removed, the password file should be recreated for the agent, or the entry removed from the server.
 
-A unique node ID can be appended to the hostname by launching K3s servers or agents using the `--with-node-id` flag.
\ No newline at end of file
+A unique node ID can be appended to the hostname by launching K3s servers or agents using the `--with-node-id` flag.
+
+# Automatically Deployed Manifests
+
+The [manifests](https://github.com/rancher/k3s/tree/master/manifests) located at the directory path `/var/lib/rancher/k3s/server/manifests` are bundled into the K3s binary at build time.
\ No newline at end of file

From c6846e7a707b6a11114285fdb5853c76c79f9dfa Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 18 Jun 2020 00:38:57 -0700
Subject: [PATCH 143/265] Document K3s cert rotation

---
 content/k3s/latest/en/advanced/_index.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md
index d7c4c271d24..d7f0e9ba389 100644
--- a/content/k3s/latest/en/advanced/_index.md
+++ b/content/k3s/latest/en/advanced/_index.md
@@ -8,6 +8,7 @@ aliases:
 
 This section contains advanced information describing the different ways you can run and manage K3s:
 
+- [Certificate rotation](#certificate-rotation)
 - [Auto-deploying manifests](#auto-deploying-manifests)
 - [Using Docker as the container runtime](#using-docker-as-the-container-runtime)
 - [Secrets Encryption Config (Experimental)](#secrets-encryption-config-experimental)
@@ -19,6 +20,12 @@ This section contains advanced information describing the different ways you can
 - [Enabling legacy iptables on Raspbian Buster](#enabling-legacy-iptables-on-raspbian-buster)
 - [Experimental SELinux Support](#experimental-selinux-support)
 
+# Certificate Rotation
+
+By default, certificates in K3s expire in 12 months.
+
+If the certificates are expired or have fewer than 90 days remaining before they expire, the certificates are rotated when K3s is restarted.
+
 # Auto-Deploying Manifests
 
 Any file found in `/var/lib/rancher/k3s/server/manifests` will automatically be deployed to Kubernetes in a manner similar to `kubectl apply`.

From 6c7a724c8df52d957ffabfac374d07643bdff49b Mon Sep 17 00:00:00 2001
From: Nicolas Stojanovic <nicosto@users.noreply.github.com>
Date: Fri, 19 Jun 2020 13:39:22 +0200
Subject: [PATCH 144/265] wrong reference in one example

us-west-1  was used in the first example instead of eu-west-1
---
 .../vsphere/config-reference/_index.md               | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/content/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/_index.md b/content/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/_index.md
index c0da0176c69..12c685f76dc 100644
--- a/content/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/_index.md
+++ b/content/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/_index.md
@@ -32,13 +32,13 @@ cloud_provider:
         user: provisioner
         password: secret
         port: 443
-        datacenters: /us-west-1
+        datacenters: /eu-west-1
     workspace:
       server: vc.example.com
-      folder: /us-west-1/folder/myvmfolder
-      default-datastore: /us-west-1/datastore/ds-1
-      datacenter: /us-west-1
-      resourcepool-path: /us-west-1/host/hn1/resources/myresourcepool
+      folder: /eu-west-1/folder/myvmfolder
+      default-datastore: /eu-west-1/datastore/ds-1
+      datacenter: /eu-west-1
+      resourcepool-path: /eu-west-1/host/hn1/resources/myresourcepool
 
 ```
 # Configuration Options
@@ -141,4 +141,4 @@ The following configuration options are available under the network directive:
 
 | network Options     |  Type    | Required  | Description |
 |:-------------------:|:--------:|:---------:|:-----------------------------------------------------------------------------|
-| public-network      | string   |           | Name of public **VM Network** to which the VMs in the cluster are connected. Used to determine public IP addresses of VMs.|
\ No newline at end of file
+| public-network      | string   |           | Name of public **VM Network** to which the VMs in the cluster are connected. Used to determine public IP addresses of VMs.|

From 75bffee52d59e6f9509f503e8c77840703845f78 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 18 Jun 2020 16:16:06 -0700
Subject: [PATCH 145/265] Fix formatting

---
 .../v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
index 319a0c6ee2f..6fd878ec3ff 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
@@ -28,7 +28,7 @@ The [node exporter](https://github.com/prometheus/node_exporter/blob/master/READ
 
 When configuring Prometheus and enabling the node exporter, enter a host port in the **Node Exporter Host Port** that will not produce port conflicts with existing applications. The host port chosen must be open to allow internal traffic between Prometheus and the Node Exporter.
 
->**Warning:** In order for Prometheus to collect the metrics of the node exporter, after enabling cluster monitoring, you must open the **Node Exporter Host Port** in the host firewall rules to allow intranet access. By default, `9796` is used as that host port.
+>**Warning:** In order for Prometheus to collect the metrics of the node exporter, after enabling cluster monitoring, you must open the <b>Node Exporter Host Port</b> in the host firewall rules to allow intranet access. By default, `9796` is used as that host port.
 
 ## Persistent Storage
 

From 19a06e7163217ccc1bf37932bf6bee79a6507e71 Mon Sep 17 00:00:00 2001
From: jrcreative <jeremy@jeremyrosscreative.com>
Date: Mon, 22 Jun 2020 17:04:10 -0700
Subject: [PATCH 146/265] remove cta

---
 content/rancher/v2.x/en/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/_index.md b/content/rancher/v2.x/en/_index.md
index 9a7712bc041..685ceec51a5 100644
--- a/content/rancher/v2.x/en/_index.md
+++ b/content/rancher/v2.x/en/_index.md
@@ -6,7 +6,7 @@ metaTitle: "Rancher 2.x Docs: What is New?"
 metaDescription: "Rancher 2 adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
 insertOneSix: true
 weight: 1
-ctaBanner: intro-k8s-rancher-online-training
+ctaBanner: 0
 ---
 Rancher was originally built to work with multiple orchestrators, and it included its own orchestrator called Cattle. With the rise of Kubernetes in the marketplace, Rancher 2.x exclusively deploys and manages Kubernetes clusters running anywhere, on any provider.
 

From 51f3241c9bcbdfc6a3a9322860811c29676e8a0a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 22 Jun 2020 19:30:55 -0700
Subject: [PATCH 147/265] Move files from rancher/rancher repo to docs repo

---
 .../3-node-certificate-recognizedca/_index.md | 160 ++++++++++++++++
 .../3-node-certificate/_index.md              | 175 ++++++++++++++++++
 .../3-node-externalssl-certificate/_index.md  | 156 ++++++++++++++++
 .../3-node-externalssl-recognizedca/_index.md | 140 ++++++++++++++
 .../options/cluster-yml-templates/_index.md   |   8 +
 .../helm2/rke-add-on/layer-4-lb/_index.md     |   4 +-
 .../helm2/rke-add-on/layer-7-lb/_index.md     |   4 +-
 .../options/rke-add-on/layer-4-lb/_index.md   |   4 +-
 .../options/rke-add-on/layer-7-lb/_index.md   |   4 +-
 9 files changed, 647 insertions(+), 8 deletions(-)
 create mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md

diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
new file mode 100644
index 00000000000..b67ccc5370e
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
@@ -0,0 +1,160 @@
+---
+title: Template for an RKE Cluster with a Certificate Signed by Recognized CA and a Layer 4 Load Balancer
+weight: 3
+---
+
+RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
+
+The following template can be used for the cluster.yml if you have a setup with:
+
+- Certificate signed by a recognized CA
+- Layer 4 load balancer
+- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/)
+
+> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
+
+```yaml
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+services:
+  etcd:
+    snapshot: true
+    creation: 6h
+    retention: 24h
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-ingress
+    namespace: cattle-system
+  type: Opaque
+  data:
+    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If self-signed, must be signed by same CA as cattle server
+    tls.key: <BASE64_KEY>  # ssl key for ingress. If self-signed, must be signed by same CA as cattle server
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 80
+    tls:
+    - secretName: cattle-keys-ingress
+      hosts:
+      - <FQDN>      # FQDN to access cattle server
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        # Rancher install via RKE addons is only supported up to v2.0.8
+        - image: rancher/rancher:v2.0.8
+          args:
+          - --no-cacerts
+          imagePullPolicy: Always
+          name: cattle-server
+  #       env:
+  #       - name: HTTP_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: HTTPS_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: NO_PROXY
+  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 60
+            periodSeconds: 60
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
+```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
new file mode 100644
index 00000000000..9b24f5b39d5
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
@@ -0,0 +1,175 @@
+---
+title: Template for an RKE Cluster with a Self-signed Certificate and Layer 4 Load Balancer
+weight: 2
+---
+RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
+
+The following template can be used for the cluster.yml if you have a setup with:
+
+- Self-signed SSL
+- Layer 4 load balancer
+- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/)
+
+> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
+
+```yaml
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+services:
+  etcd:
+    snapshot: true
+    creation: 6h
+    retention: 24h
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-ingress
+    namespace: cattle-system
+  type: Opaque
+  data:
+    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server
+    tls.key: <BASE64_KEY>  # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-server
+    namespace: cattle-system
+  type: Opaque
+  data:
+    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    - port: 443
+      targetPort: 443
+      protocol: TCP
+      name: https
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+  spec:
+    rules:
+    - host: <FQDN>  # FQDN to access cattle server
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 80
+    tls:
+    - secretName: cattle-keys-ingress
+      hosts:
+      - <FQDN>      # FQDN to access cattle server
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        # Rancher install via RKE addons is only supported up to v2.0.8
+        - image: rancher/rancher:v2.0.8
+          imagePullPolicy: Always
+          name: cattle-server
+  #       env:
+  #       - name: HTTP_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: HTTPS_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: NO_PROXY
+  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 60
+            periodSeconds: 60
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          - containerPort: 443
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/rancher/ssl
+            name: cattle-keys-volume
+            readOnly: true
+        volumes:
+        - name: cattle-keys-volume
+          secret:
+            defaultMode: 420
+            secretName: cattle-keys-server
+```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
new file mode 100644
index 00000000000..3130e66e547
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
@@ -0,0 +1,156 @@
+---
+title: Template for an RKE Cluster with a Self-signed Certificate and SSL Termination on Layer 7 Load Balancer
+weight: 3
+---
+
+RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
+
+The following template can be used for the cluster.yml if you have a setup with:
+
+- Layer 7 load balancer with self-signed SSL termination (HTTPS)
+- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) 
+
+> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
+
+```yaml
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+services:
+  etcd:
+    snapshot: true
+    creation: 6h
+    retention: 24h
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Secret
+  metadata:
+    name: cattle-keys-server
+    namespace: cattle-system
+  type: Opaque
+  data:
+    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/ssl-redirect: "false"        # Disable redirect to ssl
+  spec:
+    rules:
+    - host: <FQDN>
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 80
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        # Rancher install via RKE addons is only supported up to v2.0.8
+        - image: rancher/rancher:v2.0.8
+          imagePullPolicy: Always
+          name: cattle-server
+  #       env:
+  #       - name: HTTP_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: HTTPS_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: NO_PROXY
+  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 60
+            periodSeconds: 60
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          ports:
+          - containerPort: 80
+            protocol: TCP
+          volumeMounts:
+          - mountPath: /etc/rancher/ssl
+            name: cattle-keys-volume
+            readOnly: true
+        volumes:
+        - name: cattle-keys-volume
+          secret:
+            defaultMode: 420
+            secretName: cattle-keys-server
+```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
new file mode 100644
index 00000000000..9aeff93bcf0
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
@@ -0,0 +1,140 @@
+---
+title: Template for an RKE Cluster with a Recognized CA Certificate and SSL Termination on Layer 7 Load Balancer
+weight: 4
+---
+
+RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
+
+The following template can be used for the cluster.yml if you have a setup with:
+
+- Layer 7 load balancer with SSL termination (HTTPS)
+- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) 
+
+> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
+
+```yaml
+nodes:
+  - address: <IP> # hostname or IP to access nodes
+    user: <USER> # root user (usually 'root')
+    role: [controlplane,etcd,worker] # K8s roles for node
+    ssh_key_path: <PEM_FILE> # path to PEM file
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+  - address: <IP>
+    user: <USER>
+    role: [controlplane,etcd,worker]
+    ssh_key_path: <PEM_FILE>
+
+services:
+  etcd:
+    snapshot: true
+    creation: 6h
+    retention: 24h
+
+addons: |-
+  ---
+  kind: Namespace
+  apiVersion: v1
+  metadata:
+    name: cattle-system
+  ---
+  kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: cattle-admin
+    namespace: cattle-system
+  ---
+  kind: ClusterRoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: cattle-crb
+    namespace: cattle-system
+  subjects:
+  - kind: ServiceAccount
+    name: cattle-admin
+    namespace: cattle-system
+  roleRef:
+    kind: ClusterRole
+    name: cluster-admin
+    apiGroup: rbac.authorization.k8s.io
+  ---
+  apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: cattle-system
+    name: cattle-service
+    labels:
+      app: cattle
+  spec:
+    ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+    selector:
+      app: cattle
+  ---
+  apiVersion: extensions/v1beta1
+  kind: Ingress
+  metadata:
+    namespace: cattle-system
+    name: cattle-ingress-http
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
+      nginx.ingress.kubernetes.io/ssl-redirect: "false"        # Disable redirect to ssl
+  spec:
+    rules:
+    - host: <FQDN>
+      http:
+        paths:
+        - backend:
+            serviceName: cattle-service
+            servicePort: 80
+  ---
+  kind: Deployment
+  apiVersion: extensions/v1beta1
+  metadata:
+    namespace: cattle-system
+    name: cattle
+  spec:
+    replicas: 1
+    template:
+      metadata:
+        labels:
+          app: cattle
+      spec:
+        serviceAccountName: cattle-admin
+        containers:
+        # Rancher install via RKE addons is only supported up to v2.0.8
+        - image: rancher/rancher:v2.0.8
+          args:
+          - --no-cacerts
+          imagePullPolicy: Always
+          name: cattle-server
+  #       env:
+  #       - name: HTTP_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: HTTPS_PROXY
+  #         value: "http://your_proxy_address:port"
+  #       - name: NO_PROXY
+  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 60
+            periodSeconds: 60
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 80
+            initialDelaySeconds: 20
+            periodSeconds: 10
+          ports:
+          - containerPort: 80
+            protocol: TCP
+```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
new file mode 100644
index 00000000000..2e4c7d93f60
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
@@ -0,0 +1,8 @@
+---
+title: cluster.yml Templates
+weight: 1
+---
+
+RKE uses a cluster.yml file to install and configure your Kubernetes cluster. This section provides templates that can be used to create the cluster.yml.
+
+> For more cluster.yml options, refer to the[RKE configuration reference.]({{<baseurl>}}/rke/latest/en/config-options/).
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
index f3c16cb9404..6b88e593545 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
@@ -162,8 +162,8 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster.
 
 1. Download one of following templates, depending on the SSL certificate you're using.
 
-	- [Template for self-signed certificate<br/> `3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate.yml)
-	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate-recognizedca.yml)
+	- [Template for self-signed certificate<br/> `3-node-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate)
+	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca)
 
     >**Advanced Config Options:**
     >
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
index 379ccf801b5..f5485b14c82 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
@@ -112,8 +112,8 @@ RKE uses a YAML config file to install and configure your Kubernetes cluster. Th
 
 1. Download one of following templates, depending on the SSL certificate you're using.
 
-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-certificate.yml)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-recognizedca.yml)
+	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate)
+	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca)
 
     >**Advanced Config Options:**
     >
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
index d2aac77497f..f40f56075be 100644
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
@@ -164,8 +164,8 @@ RKE uses a `.yml` config file to install and configure your Kubernetes cluster.
 
 1. Download one of following templates, depending on the SSL certificate you're using.
 
-	- [Template for self-signed certificate<br/> `3-node-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate.yml)
-	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-certificate-recognizedca.yml)
+	- [Template for self-signed certificate<br/> `3-node-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate)
+	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca)
 
     >**Advanced Config Options:**
     >
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
index 0a99c09559c..a41889022ff 100644
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
@@ -112,8 +112,8 @@ RKE uses a YAML config file to install and configure your Kubernetes cluster. Th
 
 1. Download one of following templates, depending on the SSL certificate you're using.
 
-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-certificate.yml)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`](https://raw.githubusercontent.com/rancher/rancher/master/rke-templates/3-node-externalssl-recognizedca.yml)
+	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate)
+	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca)
 
     >**Advanced Config Options:**
     >

From 202999d09be154522f9fdcd62c0b145020a04d9f Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 21 May 2020 02:43:04 -0700
Subject: [PATCH 148/265] Improve docs for running K3s with Docker

---
 content/k3s/latest/en/advanced/_index.md | 88 +++++++++++++++++++++++-
 1 file changed, 85 insertions(+), 3 deletions(-)

diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md
index d7f0e9ba389..733346fbaed 100644
--- a/content/k3s/latest/en/advanced/_index.md
+++ b/content/k3s/latest/en/advanced/_index.md
@@ -11,6 +11,7 @@ This section contains advanced information describing the different ways you can
 - [Certificate rotation](#certificate-rotation)
 - [Auto-deploying manifests](#auto-deploying-manifests)
 - [Using Docker as the container runtime](#using-docker-as-the-container-runtime)
+- [Configuring containerd](#configuring-containerd)
 - [Secrets Encryption Config (Experimental)](#secrets-encryption-config-experimental)
 - [Running K3s with RootlessKit (Experimental)](#running-k3s-with-rootlesskit-experimental)
 - [Node labels and taints](#node-labels-and-taints)
@@ -34,11 +35,92 @@ For information about deploying Helm charts, refer to the section about [Helm.](
 
 # Using Docker as the Container Runtime
 
-K3s includes and defaults to [containerd,](https://containerd.io/) an industry-standard container runtime. If you want to use Docker instead of containerd then you simply need to run the agent with the `--docker` flag.
+K3s includes and defaults to [containerd,](https://containerd.io/) an industry-standard container runtime.
 
-K3s will generate config.toml for containerd in `/var/lib/rancher/k3s/agent/etc/containerd/config.toml`. For advanced customization for this file you can create another file called `config.toml.tmpl` in the same directory and it will be used instead.
+To use Docker instead of containerd,
 
-The `config.toml.tmpl` will be treated as a Golang template file, and the `config.Node` structure is being passed to the template, the following is an example on how to use the structure to customize the configuration file https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32
+1. Install Docker on the K3s node. One of Rancher's [Docker installation scripts](https://github.com/rancher/install-docker) can be used to install Docker:
+
+    ```
+    curl https://releases.rancher.com/install-docker/19.03.sh | sh
+    ```
+
+1. Install K3s using the `--docker` option:
+
+    ```
+    curl -sfL https://get.k3s.io | sh -s - --docker
+    ```
+
+1. Confirm that the cluster is available:
+
+    ```
+    $ sudo k3s kubectl get pods --all-namespaces
+    NAMESPACE     NAME                                     READY   STATUS      RESTARTS   AGE
+    kube-system   local-path-provisioner-6d59f47c7-lncxn   1/1     Running     0          51s
+    kube-system   metrics-server-7566d596c8-9tnck          1/1     Running     0          51s
+    kube-system   helm-install-traefik-mbkn9               0/1     Completed   1          51s
+    kube-system   coredns-8655855d6-rtbnb                  1/1     Running     0          51s
+    kube-system   svclb-traefik-jbmvl                      2/2     Running     0          43s
+    kube-system   traefik-758cd5fc85-2wz97                 1/1     Running     0          43s
+    ```
+
+1. Confirm that the Docker containers are running:
+
+    ```
+    $ sudo docker ps
+    CONTAINER ID        IMAGE                     COMMAND                  CREATED              STATUS              PORTS               NAMES
+    3e4d34729602        897ce3c5fc8f              "entry"                  About a minute ago   Up About a minute                       k8s_lb-port-443_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0
+    bffdc9d7a65f        rancher/klipper-lb        "entry"                  About a minute ago   Up About a minute                       k8s_lb-port-80_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0
+    436b85c5e38d        rancher/library-traefik   "/traefik --configfi…"   About a minute ago   Up About a minute                       k8s_traefik_traefik-758cd5fc85-2wz97_kube-system_07abe831-ffd6-4206-bfa1-7c9ca4fb39e7_0
+    de8fded06188        rancher/pause:3.1         "/pause"                 About a minute ago   Up About a minute                       k8s_POD_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0
+    7c6a30aeeb2f        rancher/pause:3.1         "/pause"                 About a minute ago   Up About a minute                       k8s_POD_traefik-758cd5fc85-2wz97_kube-system_07abe831-ffd6-4206-bfa1-7c9ca4fb39e7_0
+    ae6c58cab4a7        9d12f9848b99              "local-path-provisio…"   About a minute ago   Up About a minute                       k8s_local-path-provisioner_local-path-provisioner-6d59f47c7-lncxn_kube-system_2dbd22bf-6ad9-4bea-a73d-620c90a6c1c1_0
+    be1450e1a11e        9dd718864ce6              "/metrics-server"        About a minute ago   Up About a minute                       k8s_metrics-server_metrics-server-7566d596c8-9tnck_kube-system_031e74b5-e9ef-47ef-a88d-fbf3f726cbc6_0
+    4454d14e4d3f        c4d3d16fe508              "/coredns -conf /etc…"   About a minute ago   Up About a minute                       k8s_coredns_coredns-8655855d6-rtbnb_kube-system_d05725df-4fb1-410a-8e82-2b1c8278a6a1_0
+    c3675b87f96c        rancher/pause:3.1         "/pause"                 About a minute ago   Up About a minute                       k8s_POD_coredns-8655855d6-rtbnb_kube-system_d05725df-4fb1-410a-8e82-2b1c8278a6a1_0
+    4b1fddbe6ca6        rancher/pause:3.1         "/pause"                 About a minute ago   Up About a minute                       k8s_POD_local-path-provisioner-6d59f47c7-lncxn_kube-system_2dbd22bf-6ad9-4bea-a73d-620c90a6c1c1_0
+    64d3517d4a95        rancher/pause:3.1         "/pause"
+    ```
+
+### Optional: Use crictl with Docker
+
+crictl provides a CLI for CRI-compatible container runtimes.
+
+If you would like to use crictl after installing K3s with the `--docker` option, install crictl using the [official documentation:](https://github.com/kubernetes-sigs/cri-tools/blob/master/docs/crictl.md) 
+
+```
+$ VERSION="v1.17.0"
+$ curl -L https://github.com/kubernetes-sigs/cri-tools/releases/download/$VERSION/crictl-${VERSION}-linux-amd64.tar.gz --output crictl-${VERSION}-linux-amd64.tar.gz
+$ sudo tar zxvf crictl-$VERSION-linux-amd64.tar.gz -C /usr/local/bin
+crictl
+```
+
+Then start using crictl commands:
+
+```
+$ sudo crictl version
+Version:  0.1.0
+RuntimeName:  docker
+RuntimeVersion:  19.03.9
+RuntimeApiVersion:  1.40.0
+$ sudo crictl images
+IMAGE                            TAG                 IMAGE ID            SIZE
+rancher/coredns-coredns          1.6.3               c4d3d16fe508b       44.3MB
+rancher/klipper-helm             v0.2.5              6207e2a3f5225       136MB
+rancher/klipper-lb               v0.1.2              897ce3c5fc8ff       6.1MB
+rancher/library-traefik          1.7.19              aa764f7db3051       85.7MB
+rancher/local-path-provisioner   v0.0.11             9d12f9848b99f       36.2MB
+rancher/metrics-server           v0.3.6              9dd718864ce61       39.9MB
+rancher/pause                    3.1                 da86e6ba6ca19       742kB
+```
+
+# Configuring containerd
+
+K3s will generate config.toml for containerd in `/var/lib/rancher/k3s/agent/etc/containerd/config.toml`.
+
+For advanced customization for this file you can create another file called `config.toml.tmpl` in the same directory and it will be used instead.
+
+The `config.toml.tmpl` will be treated as a Golang template file, and the `config.Node` structure is being passed to the template. The following is an example on how to use the structure to customize the configuration file https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32
 
 # Secrets Encryption Config (Experimental)
 As of v1.17.4+k3s1, K3s added the experimental feature of enabling secrets encryption at rest by passing the flag `--secrets-encryption` on a server, this flag will do the following automatically:

From fd78b3d5df913bef7bedaa12bbdf224993cf5a7e Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 23 Jun 2020 10:56:34 -0700
Subject: [PATCH 149/265] Change Golang to Go

Co-authored-by: Brian Downs <brian.downs@gmail.com>
---
 content/k3s/latest/en/advanced/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md
index 733346fbaed..8163bae638b 100644
--- a/content/k3s/latest/en/advanced/_index.md
+++ b/content/k3s/latest/en/advanced/_index.md
@@ -120,7 +120,7 @@ K3s will generate config.toml for containerd in `/var/lib/rancher/k3s/agent/etc/
 
 For advanced customization for this file you can create another file called `config.toml.tmpl` in the same directory and it will be used instead.
 
-The `config.toml.tmpl` will be treated as a Golang template file, and the `config.Node` structure is being passed to the template. The following is an example on how to use the structure to customize the configuration file https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32
+The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. The following is an example on how to use the structure to customize the configuration file https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32
 
 # Secrets Encryption Config (Experimental)
 As of v1.17.4+k3s1, K3s added the experimental feature of enabling secrets encryption at rest by passing the flag `--secrets-encryption` on a server, this flag will do the following automatically:

From eeaf3fbb8f30d14ae2e85a1156aa0849698005aa Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 23 Jun 2020 11:14:43 -0700
Subject: [PATCH 150/265] Make clickable link

---
 content/k3s/latest/en/advanced/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/advanced/_index.md b/content/k3s/latest/en/advanced/_index.md
index 8163bae638b..3be2eaa91ce 100644
--- a/content/k3s/latest/en/advanced/_index.md
+++ b/content/k3s/latest/en/advanced/_index.md
@@ -120,7 +120,7 @@ K3s will generate config.toml for containerd in `/var/lib/rancher/k3s/agent/etc/
 
 For advanced customization for this file you can create another file called `config.toml.tmpl` in the same directory and it will be used instead.
 
-The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. The following is an example on how to use the structure to customize the configuration file https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32
+The `config.toml.tmpl` will be treated as a Go template file, and the `config.Node` structure is being passed to the template. [This template](https://github.com/rancher/k3s/blob/master/pkg/agent/templates/templates.go#L16-L32) example on how to use the structure to customize the configuration file.
 
 # Secrets Encryption Config (Experimental)
 As of v1.17.4+k3s1, K3s added the experimental feature of enabling secrets encryption at rest by passing the flag `--secrets-encryption` on a server, this flag will do the following automatically:

From 2d4bce3da5471cd1ad975ba02b8c99ca31c6b906 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 23 Jun 2020 12:31:04 -0700
Subject: [PATCH 151/265] Change cert-manager realease from 0.9 to 0.12

---
 .../v2.x/en/installation/options/helm2/helm-rancher/_index.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
index 4f81e3e03e9..3aba76da34c 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
@@ -51,7 +51,7 @@ These instructions are adapted from the [official cert-manager documentation](ht
 
 1. Install the CustomResourceDefinition resources separately
     ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.9/deploy/manifests/00-crds.yaml
+    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
     ```
 
 1. Create the namespace for cert-manager

From 041664fa624674b9858a0e369247273ff1ad9264 Mon Sep 17 00:00:00 2001
From: Bastian Hofmann <bashofmann@gmail.com>
Date: Thu, 25 Jun 2020 12:02:22 +0200
Subject: [PATCH 152/265] Update and centralize cluster capabilities table

Currently there are 4 different occurrences of the cluster capabilities table that compares which features you can use in Rancher with RKE clusters, hosted cloud provider clusters and imported clusters. One of them is very detailed but a bit outdated, the other ones only mention basic features and are not complete.

This commit centralizes the table and includes it on all 4 pages and updates it for features introduced with 2.4

Signed-off-by: Bastian Hofmann <bashofmann@gmail.com>
---
 .../rancher/v2.x/en/cluster-admin/_index.md   | 19 +++----------------
 .../cluster-capabilities-table.md             | 19 +++++++++++++++++++
 .../cluster-admin/editing-clusters/_index.md  |  6 +-----
 .../v2.x/en/cluster-provisioning/_index.md    |  8 +-------
 content/rancher/v2.x/en/overview/_index.md    |  6 +-----
 5 files changed, 25 insertions(+), 33 deletions(-)
 create mode 100644 content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md

diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index 2665c8384cc..fe49bdb7e9c 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -23,22 +23,7 @@ Alternatively, you can switch between projects and clusters directly in the navi
 
 After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/), [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) will need to manage these clusters. There are many different options of how to manage your cluster. 
 
-| Action | [Rancher launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) | [Hosted Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | [Imported Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters) |
-| --- | --- | ---| ---|
-| [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | ✓ | ✓ | ✓ |
-| [Adding Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members/) | ✓ | ✓ | ✓ |
-| [Editing Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) | ✓ | ✓ | * |
-| [Managing Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes) | ✓ | ✓ | ✓ |
-| [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | ✓ | ✓ | ✓ |
-| [Managing Projects and Namespaces]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | ✓ | ✓ | ✓ |
-| [Configuring Tools](#configuring-tools) | ✓ | ✓ | ✓ |
-| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| ✓ | ✓ | |
-| [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | ✓ |  | |
-| [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | ✓ | | |
-| [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | ✓ | | |
-| [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/) | ✓ | | |
-
-/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
 
 ## Configuring Tools
 
@@ -48,5 +33,7 @@ Rancher contains a variety of tools that aren't included in Kubernetes to assist
 - Notifiers
 - Logging
 - Monitoring
+- Istio Service Mesh
+- OPA Gatekeeper
 
 For more information, see [Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/)
diff --git a/content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md b/content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md
new file mode 100644
index 00000000000..64e59cfa75e
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md
@@ -0,0 +1,19 @@
+| Action | [Rancher launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) | [Hosted Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | [Imported Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters) |
+| --- | --- | ---| ---|
+| [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | ✓ | ✓ | ✓ |
+| [Managing Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members/) | ✓ | ✓ | ✓ |
+| [Editing and Upgrading Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) | ✓ | ✓ | * |
+| [Managing Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes) | ✓ | ✓ | ✓ |
+| [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | ✓ | ✓ | ✓ |
+| [Managing Projects, Namespaces and Workloads]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | ✓ | ✓ | ✓ |
+| [Using App Catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/) | ✓ | ✓ | ✓ |
+| [Configuring Tools (Alerts, Notifiers, Logging, Monitoring, Istio)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) | ✓ | ✓ | ✓ |
+| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| ✓ | ✓ | |
+| [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | ✓ |  | |
+| [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | ✓ | | |
+| [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | ✓ | | |
+| [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/) | ✓ | | |
+| [Configuring Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/pod-security-policy/) | ✓ |  | |
+| [Running Security Scans]({{<baseurl>}}/rancher/v2.x/en/security/security-scan/) | ✓ |  | |
+
+/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
index e237deba153..1fe6ce09d18 100644
--- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
@@ -12,11 +12,7 @@ The options and settings available for an existing cluster change based on the m
 
 The following table summarizes the options and settings available for each cluster type:
 
- Rancher Capability | RKE Launched | Hosted Kubernetes Cluster | Imported Cluster
- ---------|----------|---------|---------|
- Manage member roles | ✓ | ✓ | ✓
- Edit cluster options | ✓ | | 
- Manage node pools | ✓ | |
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
 
 ## Editing Cluster Membership
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/_index.md b/content/rancher/v2.x/en/cluster-provisioning/_index.md
index e7f3cd03d3b..652194b518b 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/_index.md
@@ -28,13 +28,7 @@ This section covers the following topics:
 
 The following table summarizes the options and settings available for each cluster type:
 
-| Rancher Capability   | RKE Launched | Hosted Kubernetes Cluster | Imported Cluster |
-| -------------------- | ------------ | ------------------------- | ---------------- |
-| Manage member roles  | ✓            | ✓                         | ✓                |
-| Edit cluster options | ✓            |                           |   *              |
-| Manage node pools    | ✓            |                           |
-
-/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.](#importing-and-editing-k3s-clusters)
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
 
 # Setting up Clusters in a Hosted Kubernetes Provider
 
diff --git a/content/rancher/v2.x/en/overview/_index.md b/content/rancher/v2.x/en/overview/_index.md
index 9a6b66224c3..b691f67864a 100644
--- a/content/rancher/v2.x/en/overview/_index.md
+++ b/content/rancher/v2.x/en/overview/_index.md
@@ -60,8 +60,4 @@ After a cluster is created with Rancher, a cluster administrator can manage clus
 
 The following table summarizes the options and settings available for each cluster type:
 
- Rancher Capability | RKE Launched | Hosted Kubernetes Cluster | Imported Cluster
- ---------|----------|---------|---------|
- Manage member roles | ✓ | ✓ | ✓
- Edit cluster options | ✓ | | 
- Manage node pools | ✓ | |
\ No newline at end of file
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}

From 8ddaf44b39a6e7ee778bb354835a7665371bd72f Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 25 Jun 2020 15:49:42 -0700
Subject: [PATCH 153/265] Fix Rancher 2 upgrade command

---
 content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
index d3c436b3307..11662d9fdd8 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
@@ -99,8 +99,7 @@ Upgrade Rancher to the latest version with all your settings.
 Take all the values from the previous step and append them to the command using `--set key=value`. Note: There will be many more options from the previous step that need to be appended.
 
 ```
-helm upgrade rancher-<CHART_REPO>/rancher \
-  --name rancher \
+helm upgrade --install rancher rancher-latest rancher-<CHART_REPO>/rancher \
   --namespace cattle-system \
   --set hostname=rancher.my.org
 ```

From a955ebe553959f46a9cb41ec817477e0f5dd21ce Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 25 Jun 2020 15:53:10 -0700
Subject: [PATCH 154/265] Fix Helm 2 upgrade command

---
 content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
index 11662d9fdd8..64cf393022d 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
+++ b/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
@@ -99,7 +99,7 @@ Upgrade Rancher to the latest version with all your settings.
 Take all the values from the previous step and append them to the command using `--set key=value`. Note: There will be many more options from the previous step that need to be appended.
 
 ```
-helm upgrade --install rancher rancher-latest rancher-<CHART_REPO>/rancher \
+helm upgrade --install rancher rancher-<CHART_REPO>/rancher \
   --namespace cattle-system \
   --set hostname=rancher.my.org
 ```

From e74c88d7c2d1886e0d08c4d2b4e242123161e105 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 26 Jun 2020 10:57:40 -0700
Subject: [PATCH 155/265] Document the default username and password

---
 content/rancher/v2.x/en/api/_index.md                     | 4 ++--
 .../en/installation/k8s-install/helm-rancher/_index.md    | 2 ++
 .../en/installation/options/helm2/helm-rancher/_index.md  | 8 ++++++--
 .../options/helm2/rke-add-on/layer-4-lb/_index.md         | 8 ++++++++
 .../options/helm2/rke-add-on/layer-7-lb/_index.md         | 8 ++++++++
 .../air-gap/install-rancher/_index.md                     | 8 ++++++++
 .../single-node-docker/_index.md                          | 8 ++++++++
 7 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/api/_index.md b/content/rancher/v2.x/en/api/_index.md
index b2f9e84816d..c76a2ef1e74 100644
--- a/content/rancher/v2.x/en/api/_index.md
+++ b/content/rancher/v2.x/en/api/_index.md
@@ -3,10 +3,10 @@ title: API
 weight: 7500
 ---
 
-## How to use the API
-
 The API has its own user interface accessible from a web browser.  This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response.  To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint as well as create [API keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/).
 
+> By default, an `admin` user is created with the password `admin` when the Rancher server is installed. This default password should always be changed, even if you aren't using the Rancher UI.
+
 ## Authentication
 
 API requests must include authentication information.  Authentication is done with HTTP basic authentication using [API Keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/). API keys can create new clusters and have access to multiple clusters via `/v3/clusters/`. [Cluster and project roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/) apply to these keys and restrict what clusters and projects the account can see and what actions they can take.
diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
index be3c42f9c0c..2f7c1a43716 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
@@ -266,4 +266,6 @@ That's it. You should have a functional Rancher server.
 
 In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
 
+By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
+
 Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) Page
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
index 3aba76da34c..47960aa8afb 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
@@ -213,6 +213,10 @@ Make sure you save the `--set` options you used. You will need to use the same o
 
 ### Finishing Up
 
-That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page.
+That's it. You should have a functional Rancher server.
 
-Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/) Page
+In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
+
+By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
+
+Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/) Page
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
index 6b88e593545..f7dd871c7f2 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
@@ -386,6 +386,14 @@ INFO[0101] Finished building Kubernetes cluster successfully
 
 During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
 
+### Finishing Up
+
+That's it. You should have a functional Rancher server.
+
+In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
+
+By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
+
 ## What's Next?
 
 You have a couple of options:
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
index f5485b14c82..5a7ba2eec5f 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
@@ -276,6 +276,14 @@ With all configuration in place, use RKE to launch Rancher. You can complete thi
 
 During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
 
+### Finishing Up
+
+That's it. You should have a functional Rancher server.
+
+In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
+
+By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
+
 ## What's Next?
 
 - **Recommended:** Review [Creating Backups—High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/) to learn how to backup your Rancher Server in case of a disaster scenario.
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index 08505aafb3a..f639d93ddd2 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -211,6 +211,14 @@ kubectl -n cattle-system apply -R -f ./rancher
 
 If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
 
+### Finishing Up
+
+That's it. You should have a functional Rancher server.
+
+In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
+
+By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
+
 ### Additional Resources
 
 These resources could be helpful when installing Rancher:
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
index 97e9673c322..c860893b0a7 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
@@ -129,6 +129,14 @@ docker run -d --restart=unless-stopped \
   --acme-domain <YOUR.DNS.NAME>
 ```
 
+### Finishing Up
+
+That's it. You should have a functional Rancher server.
+
+In a web browser, go to the DNS name of the Docker container. Then you should be greeted by the colorful login page.
+
+By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
+
 ## Advanced Options
 
 When installing Rancher on a single node with Docker, there are several advanced options that can be enabled:

From da6ae78d2d51df733bb73f899ecaa735729496ae Mon Sep 17 00:00:00 2001
From: Ryan Sanna <ryansann@umich.edu>
Date: Fri, 26 Jun 2020 14:17:22 -0700
Subject: [PATCH 156/265] updates to capture some of the nuances with resource
 quotas

---
 .../en/cluster-admin/projects-and-namespaces/_index.md |  2 +-
 .../override-namespace-default/_index.md               |  6 +++---
 .../resource-quotas/quotas-for-projects/_index.md      | 10 ++++++----
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/projects-and-namespaces/_index.md b/content/rancher/v2.x/en/cluster-admin/projects-and-namespaces/_index.md
index 4dbae5210ec..ebf5ca55eb8 100644
--- a/content/rancher/v2.x/en/cluster-admin/projects-and-namespaces/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/projects-and-namespaces/_index.md
@@ -189,7 +189,7 @@ To add a resource quota,
 | Field                   | Description                                                                                              |
 | ----------------------- | -------------------------------------------------------------------------------------------------------- |
 | Project Limit           | The overall resource limit for the project.                                                              |
-| Namespace Default Limit | The default resource limit available for each namespace. This limit is propagated to each namespace in the project. The combined limit of all project namespaces shouldn't exceed the project limit.  |
+| Namespace Default Limit | The default resource limit available for each namespace. This limit is propagated to each namespace in the project when created. The combined limit of all project namespaces shouldn't exceed the project limit.  |
 
 # Switching between Clusters and Projects
 
diff --git a/content/rancher/v2.x/en/project-admin/resource-quotas/override-namespace-default/_index.md b/content/rancher/v2.x/en/project-admin/resource-quotas/override-namespace-default/_index.md
index f87f5612e06..f09feb9e83c 100644
--- a/content/rancher/v2.x/en/project-admin/resource-quotas/override-namespace-default/_index.md
+++ b/content/rancher/v2.x/en/project-admin/resource-quotas/override-namespace-default/_index.md
@@ -3,9 +3,9 @@ title: Overriding the Default Limit for a Namespace
 weight: 2
 ---
 
-Although the **Namespace Default Limit** propagates from the project to each namespace, in some cases, you may need to increase (or decrease) the performance for a specific namespace. In this situation, you can override the default limits by editing the namespace.
+Although the **Namespace Default Limit** propagates from the project to each namespace when created, in some cases, you may need to increase (or decrease) the quotas for a specific namespace. In this situation, you can override the default limits by editing the namespace.
 
-In the diagram below, the Rancher administrator has a resource quota in effect for their project. However, the administrator wants to override the namespace limits for `Namespace 3` so that it performs better. Therefore, the administrator [raises the namespace limits]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#editing-namespace-resource-quotas) for `Namespace 3` so that the namespace can access more resources.
+In the diagram below, the Rancher administrator has a resource quota in effect for their project. However, the administrator wants to override the namespace limits for `Namespace 3` so that it has more resources available. Therefore, the administrator [raises the namespace limits]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#editing-namespace-resource-quotas) for `Namespace 3` so that the namespace can access more resources.
 
 <sup>Namespace Default Limit Override</sup>
 ![Namespace Default Limit Override]({{<baseurl>}}/img/rancher/rancher-resource-quota-override.svg)
@@ -31,4 +31,4 @@ If there is a [resource quota]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/proj
     >- If a resource quota is not configured for the project, these options will not be available.
     >- If you enter limits that exceed the configured project limits, Rancher will not let you save your edits.
 
-**Result:** The namespace's default resource quota is overwritten with your override.
\ No newline at end of file
+**Result:** Your override is applied to the namespace's resource quota.
diff --git a/content/rancher/v2.x/en/project-admin/resource-quotas/quotas-for-projects/_index.md b/content/rancher/v2.x/en/project-admin/resource-quotas/quotas-for-projects/_index.md
index 3b1691f60b0..60f8c59d91a 100644
--- a/content/rancher/v2.x/en/project-admin/resource-quotas/quotas-for-projects/_index.md
+++ b/content/rancher/v2.x/en/project-admin/resource-quotas/quotas-for-projects/_index.md
@@ -23,17 +23,19 @@ The resource quota includes two limits, which you set while creating or editing
 
 - **Namespace Default Limits:**
 
-    This value is the default resource limit available for each namespace. When the resource quota is set on the project level, this limit is automatically propagated to each namespace in the project. Each namespace is bound to this default limit unless you [override it](#namespace-default-limit-overrides).
-
-In the following diagram, a Rancher administrator wants to apply a resource quota that sets the same CPU and memory limit for every namespace in their project (`Namespace 1-4`). However, in Rancher, the administrator can set a resource quota for the project (`Project Resource Quota`) rather than individual namespaces. This quota includes resource limits for both the entire project (`Project Limit`) and individual namespaces (`Namespace Default Limit`). Rancher then propagates the `Namespace Default Limit` quotas to each namespace (`Namespace Resource Quota`).
+    This value is the default resource limit available for each namespace. When the resource quota is created at the project level, this limit is automatically propagated to each namespace in the project. Each namespace is bound to this default limit unless you [override it](#namespace-default-limit-overrides).
+    
+In the following diagram, a Rancher administrator wants to apply a resource quota that sets the same CPU and memory limit for every namespace in their project (`Namespace 1-4`). However, in Rancher, the administrator can set a resource quota for the project (`Project Resource Quota`) rather than individual namespaces. This quota includes resource limits for both the entire project (`Project Limit`) and individual namespaces (`Namespace Default Limit`). Rancher then propagates the `Namespace Default Limit` quotas to each namespace (`Namespace Resource Quota`) when created.
 
 <sup>Rancher: Resource Quotas Propagating to Each Namespace</sup>
 ![Rancher Resource Quota Implementation]({{<baseurl>}}/img/rancher/rancher-resource-quota.svg)
 
+Let's highlight some more nuanced functionality. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project.
+
 The following table explains the key differences between the two quota types.
 
 | Rancher Resource Quotas                                    | Kubernetes Resource Quotas                               |
 | ---------------------------------------------------------- | -------------------------------------------------------- |
 | Applies to projects and namespace.                         | Applies to namespaces only.                              |
 | Creates resource pool for all namespaces in project.       | Applies static resource limits to individual namespaces. |
-| Applies resource quotas to namespaces through propagation. | Applies only to the assigned namespace.
\ No newline at end of file
+| Applies resource quotas to namespaces through propagation. | Applies only to the assigned namespace.

From 40c56794f8c925c68308d08588d742bd9e660409 Mon Sep 17 00:00:00 2001
From: Alex Seymour <9771530+axeal@users.noreply.github.com>
Date: Mon, 29 Jun 2020 16:32:28 +0200
Subject: [PATCH 157/265] Clarify scope of internal_address directive

---
 content/rke/latest/en/config-options/nodes/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rke/latest/en/config-options/nodes/_index.md b/content/rke/latest/en/config-options/nodes/_index.md
index e15b7e98f21..68c315a332d 100644
--- a/content/rke/latest/en/config-options/nodes/_index.md
+++ b/content/rke/latest/en/config-options/nodes/_index.md
@@ -110,7 +110,7 @@ The `address` directive will be used to set the hostname or IP address of the no
 
 ### Internal Address
 
-The `internal_address` provides the ability to have nodes with multiple addresses set a specific address to use for inter-host communication on a private network. If the `internal_address` is not set, the `address` is used for inter-host communication.
+The `internal_address` provides the ability to have nodes with multiple addresses set a specific address to use for inter-host communication on a private network. If the `internal_address` is not set, the `address` is used for inter-host communication. The `internal_address` directive will set the address used for inter-host communication of the Kubernetes components, e.g. kube-apiserver and etcd. To change the interface used for the vxlan traffic of the Canal or Flannel network plug-ins please refer to the [Network Plug-ins Documentation]({{<baseurl>}}/rke/latest/en/config-options/add-ons/network-plugins/).
 
 ### Overriding the Hostname
 

From bfd960f19fb8e53aeb6cf0abc083cc7e2bed3a6a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 29 Jun 2020 09:40:27 -0700
Subject: [PATCH 158/265] Fix link to config upgrade strategy for addons

---
 content/rke/latest/en/upgrades/how-upgrades-work/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rke/latest/en/upgrades/how-upgrades-work/_index.md b/content/rke/latest/en/upgrades/how-upgrades-work/_index.md
index fbd7b5e729c..0b57ed9cdf3 100644
--- a/content/rke/latest/en/upgrades/how-upgrades-work/_index.md
+++ b/content/rke/latest/en/upgrades/how-upgrades-work/_index.md
@@ -60,7 +60,7 @@ The availability of your applications partly depends on the availability of [RKE
 
 Because RKE addons are necessary for allowing traffic into the cluster, they will need to be updated in batches to maintain availability. You will need to configure the maximum number of unavailable replicas for each addon in the `cluster.yml` to ensure that your cluster will retain enough available replicas during an upgrade.
 
-For more information on configuring the number of replicas for each addon, refer to [this section.](#replicas-for-rke-addons)
+For more information on configuring the number of replicas for each addon, refer to [this section.]({{<baseurl>}}/rke/latest/en/upgrades/configuring-strategy)
 
 For an example showing how to configure the addons, refer to the [example cluster.yml.]({{<baseurl>}}/rke/latest/en/upgrades/configuring-strategy/#example-cluster-yml)
 

From 54c3a69bdc4e3008202705203a6891d9ca216856 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 29 Jun 2020 09:50:43 -0700
Subject: [PATCH 159/265] Correct description of RKE upgrades prior to v1.1.0

---
 content/rke/latest/en/upgrades/how-upgrades-work/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rke/latest/en/upgrades/how-upgrades-work/_index.md b/content/rke/latest/en/upgrades/how-upgrades-work/_index.md
index 0b57ed9cdf3..77ef6cfec1f 100644
--- a/content/rke/latest/en/upgrades/how-upgrades-work/_index.md
+++ b/content/rke/latest/en/upgrades/how-upgrades-work/_index.md
@@ -70,7 +70,7 @@ For an example showing how to configure the addons, refer to the [example cluste
 When a cluster is upgraded with `rke up`, using the default options, the following process is used:
 
 - etcd nodes get updated first, one at a time.
-- Controlplane nodes get updated second, one at a time.
+- Controlplane nodes get updated second, in batches of 50 or the total number of worker nodes, whichever is lower.
 - Worker nodes and addons get updated third, in batches of 50 or the total number of worker nodes, whichever is lower.
 - Addons get upgraded one by one.
 

From ebe0acc0da0cc808c5ef999a6083094ef46b8a1f Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 29 Jun 2020 11:35:56 -0700
Subject: [PATCH 160/265] Revert "Document the default username and password"

This reverts commit 961e0f77aeb34cfe7cdb991ff9c4925663cfad1e.
---
 content/rancher/v2.x/en/api/_index.md                     | 4 ++--
 .../en/installation/k8s-install/helm-rancher/_index.md    | 2 --
 .../en/installation/options/helm2/helm-rancher/_index.md  | 8 ++------
 .../options/helm2/rke-add-on/layer-4-lb/_index.md         | 8 --------
 .../options/helm2/rke-add-on/layer-7-lb/_index.md         | 8 --------
 .../air-gap/install-rancher/_index.md                     | 8 --------
 .../single-node-docker/_index.md                          | 8 --------
 7 files changed, 4 insertions(+), 42 deletions(-)

diff --git a/content/rancher/v2.x/en/api/_index.md b/content/rancher/v2.x/en/api/_index.md
index c76a2ef1e74..b2f9e84816d 100644
--- a/content/rancher/v2.x/en/api/_index.md
+++ b/content/rancher/v2.x/en/api/_index.md
@@ -3,9 +3,9 @@ title: API
 weight: 7500
 ---
 
-The API has its own user interface accessible from a web browser.  This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response.  To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint as well as create [API keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/).
+## How to use the API
 
-> By default, an `admin` user is created with the password `admin` when the Rancher server is installed. This default password should always be changed, even if you aren't using the Rancher UI.
+The API has its own user interface accessible from a web browser.  This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response.  To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint as well as create [API keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/).
 
 ## Authentication
 
diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
index 2f7c1a43716..be3c42f9c0c 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
@@ -266,6 +266,4 @@ That's it. You should have a functional Rancher server.
 
 In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
 
-By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
-
 Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) Page
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
index 47960aa8afb..3aba76da34c 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
@@ -213,10 +213,6 @@ Make sure you save the `--set` options you used. You will need to use the same o
 
 ### Finishing Up
 
-That's it. You should have a functional Rancher server.
+That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page.
 
-In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
-
-By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
-
-Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/) Page
\ No newline at end of file
+Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/) Page
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
index f7dd871c7f2..6b88e593545 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
@@ -386,14 +386,6 @@ INFO[0101] Finished building Kubernetes cluster successfully
 
 During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
 
-### Finishing Up
-
-That's it. You should have a functional Rancher server.
-
-In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
-
-By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
-
 ## What's Next?
 
 You have a couple of options:
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
index 5a7ba2eec5f..f5485b14c82 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
@@ -276,14 +276,6 @@ With all configuration in place, use RKE to launch Rancher. You can complete thi
 
 During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
 
-### Finishing Up
-
-That's it. You should have a functional Rancher server.
-
-In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
-
-By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
-
 ## What's Next?
 
 - **Recommended:** Review [Creating Backups—High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/) to learn how to backup your Rancher Server in case of a disaster scenario.
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index f639d93ddd2..08505aafb3a 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -211,14 +211,6 @@ kubectl -n cattle-system apply -R -f ./rancher
 
 If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
 
-### Finishing Up
-
-That's it. You should have a functional Rancher server.
-
-In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
-
-By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
-
 ### Additional Resources
 
 These resources could be helpful when installing Rancher:
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
index c860893b0a7..97e9673c322 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
@@ -129,14 +129,6 @@ docker run -d --restart=unless-stopped \
   --acme-domain <YOUR.DNS.NAME>
 ```
 
-### Finishing Up
-
-That's it. You should have a functional Rancher server.
-
-In a web browser, go to the DNS name of the Docker container. Then you should be greeted by the colorful login page.
-
-By default, an `admin` user is created with the password `admin`. When you go to the Rancher UI for the first time, you will be prompted to change the `admin` user's password. We highly recommend changing the password.
-
 ## Advanced Options
 
 When installing Rancher on a single node with Docker, there are several advanced options that can be enabled:

From d9fdd01d9038cd182a4714d4b42b5a6221abe893 Mon Sep 17 00:00:00 2001
From: rawmind0 <rawmind@gmail.com>
Date: Thu, 2 Jul 2020 20:41:56 +0200
Subject: [PATCH 161/265] Add cluster-autoscaler docs under cluster-admin
 section

---
 .../cluster-autoscaler/_index.md              |  19 +
 .../cluster-autoscaler/amazon/_index.md       | 561 ++++++++++++++++++
 2 files changed, 580 insertions(+)
 create mode 100644 content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md
 create mode 100644 content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md

diff --git a/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md
new file mode 100644
index 00000000000..819d8152efd
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md
@@ -0,0 +1,19 @@
+---
+title: Cluster autoscaler
+weight: 1
+---
+
+This doc will guide you how to install and use [k8s cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
+
+Cluster Autoscaler is a tool that automatically adjusts the size of the k8s cluster when one of the following conditions is true:
+
+* there are pods that failed to run in the cluster due to insufficient resources,
+* there are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes.
+
+Cluster Autoscaler is designed to run on k8s master nodes. It's possible to run a customized deployment of Cluster Autoscaler on worker nodes, but extra care needs to be taken to ensure that Cluster Autoscaler remains up and running. Users can put it into kube-system namespace (Cluster Autoscaler doesn't scale down node with non-mirrored kube-system pods running on them) and set a priorityClassName: system-cluster-critical property on your pod spec (to prevent your pod from being evicted).
+
+Cluster Autoscaler is providing support to distinct cloud providers, more info at [cluster-autoscaler supported cloud providers](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment)
+
+### Setting up the cluster autoscaler on Amazon Cloud Provider
+
+For details on running the cluster autoscaler  on Amazon cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-autoscaler/amazon)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md
new file mode 100644
index 00000000000..b72d730b973
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md
@@ -0,0 +1,561 @@
+---
+title: AWS
+weight: 1
+---
+
+This doc will guide you how to install and use [k8s cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
+
+## Prerequisites
+
+These elements are required to follow this guide:
+* Rancher server is up and running
+* AWS EC2 user with proper permissions to create vm, asg and IAM profiles and roles
+
+## Installation
+
+We are going to install a Rancher RKE custom cluster with fixed size on k8s etcd+controlplane planes and variable size on k8s worker plane, managed by cluster-autoscaler. 
+
+### Create cluster
+
+On Rancher server, we should create a custom k8s cluster v1.18.x. Be sure that cloud_provider name is set to `amazonec2`. Once cluster is created we need to get:
+* clusterID: `c-xxxxx` will be used on EC2 `kubernetes.io/cluster/<clusterID>` instance tag
+* clusterName: will be used on EC2 `k8s.io/cluster-autoscaler/<clusterName>` instance tag
+* nodeCommand: will be added on EC2 instance user_data to include new nodes on cluster
+`sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CHECKSUM> <roles>` 
+
+### Configure cloud provider
+
+On AWS EC2, we should create few object to configure our system. We've defined 3 distinct groups to configure on AWS:
+
+* Autoscale group: Nodes that will be part of the EC2 Auto Scalation Group (ASG). ASG will be used by cluster-autoscaler to scale up and down
+  * IAM profile: Required by k8s nodes where cluster-autoscaler will be running. Recommended, k8s master nodes
+  `K8sAutoscalerProfile`
+```
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "autoscaling:DescribeAutoScalingGroups",
+                "autoscaling:DescribeAutoScalingInstances",
+                "autoscaling:DescribeLaunchConfigurations",
+                "autoscaling:SetDesiredCapacity",
+                "autoscaling:TerminateInstanceInAutoScalingGroup",
+                "autoscaling:DescribeTags",
+                "autoscaling:DescribeLaunchConfigurations",
+                "ec2:DescribeLaunchTemplateVersions"
+            ],
+            "Resource": [
+                "*"
+            ]
+        }
+    ]
+}
+```
+
+* Master group: Nodes that will be part of the k8s etcd and/or control planes. This will be out of ASG 
+  * IAM profile: Required by k8s cloud_povider integration. Optionally, AWS_ACCESS_KEY and AWS_SECRET_KEY can be used instead [using-aws-credentials](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)
+  `K8sMasterProfile`
+```
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "autoscaling:DescribeAutoScalingGroups",
+                "autoscaling:DescribeLaunchConfigurations",
+                "autoscaling:DescribeTags",
+                "ec2:DescribeInstances",
+                "ec2:DescribeRegions",
+                "ec2:DescribeRouteTables",
+                "ec2:DescribeSecurityGroups",
+                "ec2:DescribeSubnets",
+                "ec2:DescribeVolumes",
+                "ec2:CreateSecurityGroup",
+                "ec2:CreateTags",
+                "ec2:CreateVolume",
+                "ec2:ModifyInstanceAttribute",
+                "ec2:ModifyVolume",
+                "ec2:AttachVolume",
+                "ec2:AuthorizeSecurityGroupIngress",
+                "ec2:CreateRoute",
+                "ec2:DeleteRoute",
+                "ec2:DeleteSecurityGroup",
+                "ec2:DeleteVolume",
+                "ec2:DetachVolume",
+                "ec2:RevokeSecurityGroupIngress",
+                "ec2:DescribeVpcs",
+                "elasticloadbalancing:AddTags",
+                "elasticloadbalancing:AttachLoadBalancerToSubnets",
+                "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+                "elasticloadbalancing:CreateLoadBalancer",
+                "elasticloadbalancing:CreateLoadBalancerPolicy",
+                "elasticloadbalancing:CreateLoadBalancerListeners",
+                "elasticloadbalancing:ConfigureHealthCheck",
+                "elasticloadbalancing:DeleteLoadBalancer",
+                "elasticloadbalancing:DeleteLoadBalancerListeners",
+                "elasticloadbalancing:DescribeLoadBalancers",
+                "elasticloadbalancing:DescribeLoadBalancerAttributes",
+                "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+                "elasticloadbalancing:ModifyLoadBalancerAttributes",
+                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+                "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+                "elasticloadbalancing:AddTags",
+                "elasticloadbalancing:CreateListener",
+                "elasticloadbalancing:CreateTargetGroup",
+                "elasticloadbalancing:DeleteListener",
+                "elasticloadbalancing:DeleteTargetGroup",
+                "elasticloadbalancing:DescribeListeners",
+                "elasticloadbalancing:DescribeLoadBalancerPolicies",
+                "elasticloadbalancing:DescribeTargetGroups",
+                "elasticloadbalancing:DescribeTargetHealth",
+                "elasticloadbalancing:ModifyListener",
+                "elasticloadbalancing:ModifyTargetGroup",
+                "elasticloadbalancing:RegisterTargets",
+                "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+                "iam:CreateServiceLinkedRole",
+                "ecr:GetAuthorizationToken",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:GetRepositoryPolicy",
+                "ecr:DescribeRepositories",
+                "ecr:ListImages",
+                "ecr:BatchGetImage",
+                "kms:DescribeKey"
+            ],
+            "Resource": [
+                "*"
+            ]
+        }
+    ]
+}
+```
+  * IAM role: `K8sMasterRole: [K8sMasterProfile,K8sAutoscalerProfile]`
+  * Security group: `K8sMasterSg` More info at[RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
+  * Tags:
+    `kubernetes.io/cluster/<clusterID>: owned`
+  * User data: `K8sMasterUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add etcd+controlplane node to the k8s cluster
+```
+#!/bin/bash -x
+
+cat <<EOF > /etc/sysctl.d/90-kubelet.conf
+vm.overcommit_memory = 1
+vm.panic_on_oom = 0
+kernel.panic = 10
+kernel.panic_on_oops = 1
+kernel.keys.root_maxkeys = 1000000
+kernel.keys.root_maxbytes = 25000000
+EOF
+sysctl -p /etc/sysctl.d/90-kubelet.conf
+
+curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
+sudo usermod -aG docker ubuntu
+
+TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
+PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
+K8S_ROLES="--etcd --controlplane"
+
+sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKCSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
+```
+
+* Worker group: Nodes that will be part of the k8s worker plane. Worker will be scaled by cluster-autoscaler using ASG
+  * IAM profile: Provides cloud_provider worker integration.
+  `K8sWorkerProfile`
+```
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DescribeInstances",
+                "ec2:DescribeRegions",
+                "ecr:GetAuthorizationToken",
+                "ecr:BatchCheckLayerAvailability",
+                "ecr:GetDownloadUrlForLayer",
+                "ecr:GetRepositoryPolicy",
+                "ecr:DescribeRepositories",
+                "ecr:ListImages",
+                "ecr:BatchGetImage"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+```
+  * IAM role: `K8sWorkerRole: [K8sWorkerProfile]`
+  * Security group: `K8sWorkerSg` More info at [RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
+  * Tags:
+    * `kubernetes.io/cluster/<clusterID>: owned`
+    * `k8s.io/cluster-autoscaler/<clusterName>: true`
+    * `k8s.io/cluster-autoscaler/enabled: true`
+  * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster 
+```
+#!/bin/bash -x
+
+cat <<EOF > /etc/sysctl.d/90-kubelet.conf
+vm.overcommit_memory = 1
+vm.panic_on_oom = 0
+kernel.panic = 10
+kernel.panic_on_oops = 1
+kernel.keys.root_maxkeys = 1000000
+kernel.keys.root_maxbytes = 25000000
+EOF
+sysctl -p /etc/sysctl.d/90-kubelet.conf
+
+curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
+sudo usermod -aG docker ubuntu
+
+TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
+PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
+K8S_ROLES="--worker"
+
+sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKCSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
+```
+
+More info at [RKE clusters on AWS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/) and [Cluster Autoscaler on AWS](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md)
+
+### Deploy nodes
+
+Once we've configured AWS, let's cretate vm's to bootstrap our cluster:
+
+* master (etcd+controlplane): Depending your needs, deploy 3 master instances with proper size. More info at []({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/)
+  * IAM role: `K8sMasterRole`
+  * Security group: `K8sMasterSg`
+  * Tags: 
+    * `kubernetes.io/cluster/<clusterID>: owned`
+  * User data: `K8sMasterUserData`
+
+* worker: Define an ASG on EC2 with following setting:
+  * Name: `K8sWorkerAsg`
+  * IAM role: `K8sWorkerRole`
+  * Security group: `K8sWorkerSg`
+  * Tags: 
+    * `kubernetes.io/cluster/<clusterID>: owned`
+    * `k8s.io/cluster-autoscaler/<clusterName>: true`
+    * `k8s.io/cluster-autoscaler/enabled: true`
+  * User data: `K8sWorkerUserData`
+  * Instances:
+    * minimum: 2
+    * desired: 2
+    * maximum: 10
+
+Once vm's deployment is done, you should have a Rancher custom cluster up and running with 3 master and 2 worker nodes.
+
+### Cluster-scaler
+
+At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. 
+
+#### Parameters
+
+This table shows cluster-autoscaler parameters to fine tuning:
+
+|Parameter|Default|Description|
+|-|-|-|
+|cluster-name|-|Autoscaled cluster name, if available|
+|address|:8085|The address to expose prometheus metrics|
+|kubernetes|-|Kubernetes master location. Leave blank for default|
+|kubeconfig|-|Path to kubeconfig file with authorization and master location information|
+|cloud-config|-|The path to the cloud provider configuration file.  Empty string for no configuration file|
+|namespace|"kube-system"|Namespace in which cluster-autoscaler run|
+|scale-down-enabled|true|Should CA scale down the cluster|
+|scale-down-delay-after-add|"10m"|How long after scale up that scale down evaluation resumes|
+|scale-down-delay-after-delete|0|How long after node deletion that scale down evaluation resumes, defaults to scanInterval|
+|scale-down-delay-after-failure|"3m"|How long after scale down failure that scale down evaluation resumes|
+|scale-down-unneeded-time|"10m"|How long a node should be unneeded before it is eligible for scale down|
+|scale-down-unready-time|"20m"|How long an unready node should be unneeded before it is eligible for scale down|
+|scale-down-utilization-threshold|0.5|Sum of cpu or memory of all pods running on the node divided by node's corresponding allocatable resource, below which a node can be considered for scale down|
+|scale-down-gpu-utilization-threshold|0.5|Sum of gpu requests of all pods running on the node divided by node's allocatable resource, below which a node can be considered for scale down|
+|scale-down-non-empty-candidates-count|30|Maximum number of non empty nodes considered in one iteration as candidates for scale down with drain|
+|scale-down-candidates-pool-ratio|0.1|A ratio of nodes that are considered as additional non empty candidates for scale down when some candidates from previous iteration are no longer valid|
+|scale-down-candidates-pool-min-count|50|Minimum number of nodes that are considered as additional non empty candidates for scale down when some candidates from previous iteration are no longer valid|
+|node-deletion-delay-timeout|"2m"|Maximum time CA waits for removing delay-deletion.cluster-autoscaler.kubernetes.io/ annotations before deleting the node|
+|scan-interval|"10s"|How often cluster is reevaluated for scale up or down|
+|max-nodes-total|0|Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number|
+|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format <min>:<max>. Cluster autoscaler will not scale the cluster beyond these numbers|
+|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format <min>:<max>. Cluster autoscaler will not scale the cluster beyond these numbers|
+cloud-provider|-|Cloud provider type| 
+|max-bulk-soft-taint-count|10|Maximum number of nodes that can be tainted/untainted PreferNoSchedule at the same time. Set to 0 to turn off such tainting|
+|max-bulk-soft-taint-time|"3s"|Maximum duration of tainting/untainting nodes as PreferNoSchedule at the same time|
+|max-empty-bulk-delete|10|Maximum number of empty nodes that can be deleted at the same time|
+|max-graceful-termination-sec|600|Maximum number of seconds CA waits for pod termination when trying to scale down a node|
+|max-total-unready-percentage|45|Maximum percentage of unready nodes in the cluster.  After this is exceeded, CA halts operations|
+|ok-total-unready-count|3|Number of allowed unready nodes, irrespective of max-total-unready-percentage|
+|scale-up-from-zero|true|Should CA scale up when there 0 ready nodes|
+|max-node-provision-time|"15m"|Maximum time CA waits for node to be provisioned|
+|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: <min>:<max>:<other...>|
+|node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `<name of discoverer>:[<key>[=<value>]]`|
+|estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]|
+|expander|"random"|Type of node group expander to be used in scale up. Available values: ["random","most-pods","least-waste","price","priority"]|
+|ignore-daemonsets-utilization|false|Should CA ignore DaemonSet pods when calculating resource utilization for scaling down|
+|ignore-mirror-pods-utilization|false|Should CA ignore Mirror pods when calculating resource utilization for scaling down|
+|write-status-configmap|true|Should CA write status information to a configmap|
+|max-inactivity|"10m"|Maximum time from last recorded autoscaler activity before automatic restart|
+|max-failing-time|"15m"|Maximum time from last recorded successful autoscaler run before automatic restart|
+|balance-similar-node-groups|false|Detect similar node groups and balance the number of nodes between them|
+|node-autoprovisioning-enabled|false|Should CA autoprovision node groups when needed|
+|max-autoprovisioned-node-group-count|15|The maximum number of autoprovisioned groups in the cluster|
+|unremovable-node-recheck-timeout|"5m"|The timeout before we check again a node that couldn't be removed before|
+|expendable-pods-priority-cutoff|-10|Pods with priority below cutoff will be expendable. They can be killed without any consideration during scale down and they don't cause scale up. Pods with null priority (PodPriority disabled) are non expendable|
+|regional|false|Cluster is regional|
+|new-pod-scale-up-delay|"0s"|Pods less than this old will not be considered for scale-up|
+|ignore-taint|-|Specifies a taint to ignore in node templates when considering to scale a node group|
+|balancing-ignore-label|-|Specifies a label to ignore in addition to the basic and cloud-provider set of labels when comparing if two node groups are similar|
+|aws-use-static-instance-list|false|Should CA fetch instance types in runtime or use a static list. AWS only|
+|profiling|false|Is debug/pprof endpoint enabled|
+
+#### Deployment
+
+Based on [cluster-autoscaler-run-on-master.yaml](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/examples/cluster-autoscaler-run-on-master.yaml) example, we've created our own `cluster-autoscaler-deployment.yaml` to use preferred [auto-discovery setup](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#auto-discovery-setup), updating tolerations, nodeSelector, image version and command config:
+
+
+```
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+  name: cluster-autoscaler
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-autoscaler
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+rules:
+  - apiGroups: [""]
+    resources: ["events", "endpoints"]
+    verbs: ["create", "patch"]
+  - apiGroups: [""]
+    resources: ["pods/eviction"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["pods/status"]
+    verbs: ["update"]
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    resourceNames: ["cluster-autoscaler"]
+    verbs: ["get", "update"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["watch", "list", "get", "update"]
+  - apiGroups: [""]
+    resources:
+      - "pods"
+      - "services"
+      - "replicationcontrollers"
+      - "persistentvolumeclaims"
+      - "persistentvolumes"
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets", "daemonsets"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["policy"]
+    resources: ["poddisruptionbudgets"]
+    verbs: ["watch", "list"]
+  - apiGroups: ["apps"]
+    resources: ["statefulsets", "replicasets", "daemonsets"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses", "csinodes"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["batch", "extensions"]
+    resources: ["jobs"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["create"]
+  - apiGroups: ["coordination.k8s.io"]
+    resourceNames: ["cluster-autoscaler"]
+    resources: ["leases"]
+    verbs: ["get", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create","list","watch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["cluster-autoscaler-status", "cluster-autoscaler-priority-expander"]
+    verbs: ["delete", "get", "update", "watch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-autoscaler
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-autoscaler
+subjects:
+  - kind: ServiceAccount
+    name: cluster-autoscaler
+    namespace: kube-system
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cluster-autoscaler
+subjects:
+  - kind: ServiceAccount
+    name: cluster-autoscaler
+    namespace: kube-system
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    app: cluster-autoscaler
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cluster-autoscaler
+  template:
+    metadata:
+      labels:
+        app: cluster-autoscaler
+      annotations:
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: '8085'
+    spec:
+      serviceAccountName: cluster-autoscaler
+      tolerations:
+        - effect: NoSchedule
+          operator: "Equal"
+          value: "true"
+          key: node-role.kubernetes.io/controlplane
+      nodeSelector:
+        node-role.kubernetes.io/controlplane: "true"
+      containers:
+        - image: eu.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1
+          name: cluster-autoscaler
+          resources:
+            limits:
+              cpu: 100m
+              memory: 300Mi
+            requests:
+              cpu: 100m
+              memory: 300Mi
+          command:
+            - ./cluster-autoscaler
+            - --v=4
+            - --stderrthreshold=info
+            - --cloud-provider=aws
+            - --skip-nodes-with-local-storage=false
+            - --expander=least-waste
+            - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/<clusterName>
+          volumeMounts:
+            - name: ssl-certs
+              mountPath: /etc/ssl/certs/ca-certificates.crt
+              readOnly: true
+          imagePullPolicy: "Always"
+      volumes:
+        - name: ssl-certs
+          hostPath:
+            path: "/etc/ssl/certs/ca-certificates.crt"
+
+```
+
+Once manifest file is prepared, deploy it in the k8s cluster (Rancher UI can be used instead):
+
+```
+kubectl -n kube-system apply -f cluster-autoscaler-deployment.yaml
+```
+
+**Note:** Cluster-autoscaler deployment can also be setup using [manual configuration](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#manual-configuration)
+
+## Testing
+
+At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: 
+
+* there are pods that failed to run in the cluster due to insufficient resources. Scale up
+* there are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. Scale down
+
+### Generating load
+
+We've prepared a `test-deployment.yaml` just to generate load on the k8s cluster and see if cluster-scaler is working properly. Test deployment is requesting 1000m cpu and 1024Mi memory by 3 replica. Adjust requested resources and/or replica to be sure you exhaust k8s cluster resources:
+
+```
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: hello-world
+  name: hello-world
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: hello-world
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: hello-world
+    spec:
+      containers:
+      - image: rancher/hello-world
+        imagePullPolicy: Always
+        name: hello-world
+        ports:
+        - containerPort: 80
+          protocol: TCP
+        resources:
+          limits:
+            cpu: 1000m
+            memory: 1024Mi
+          requests:
+            cpu: 1000m
+            memory: 1024Mi
+```
+
+Once test deployment is prepared, deploy it in the k8s cluster default namespace (Rancher UI can be used instead):
+
+```
+kubectl -n default apply -f test-deployment.yaml
+```
+
+### Checking scale
+
+Once k8s resources got exhausted, cluster-scaler should scale up worker nodes where schedule failed pods. It should be scaling up until up until all pods became scheduled. You should see new nodes on ASG and on k8s cluster. Check logs on "kube-system" cluster-autoscaler pod.
+
+Once scale up is checked, let check for scale down. To do it, lets reduce the replica number on test deployment until you release enought k8s cluster resource to scale down. You should see disappear nodes on ASG and on k8s cluster. Check logs on "kube-system" cluster-autoscaler pod.

From f17e19fae7dc097ec477e3c6ddb1def32913617d Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 6 Jul 2020 13:36:02 -0700
Subject: [PATCH 162/265] Edit formatting on cluster autoscaler page

---
 .../cluster-autoscaler/_index.md              | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md
index 819d8152efd..4f1d2e14430 100644
--- a/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/_index.md
@@ -1,19 +1,25 @@
 ---
-title: Cluster autoscaler
+title: Cluster Autoscaler
 weight: 1
 ---
 
-This doc will guide you how to install and use [k8s cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
+In this section, you'll learn how to install and use the [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
 
-Cluster Autoscaler is a tool that automatically adjusts the size of the k8s cluster when one of the following conditions is true:
+The cluster autoscaler is a tool that automatically adjusts the size of the Kubernetes cluster when one of the following conditions is true:
 
-* there are pods that failed to run in the cluster due to insufficient resources,
-* there are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes.
+* There are pods that failed to run in the cluster due to insufficient resources.
+* There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes.
 
-Cluster Autoscaler is designed to run on k8s master nodes. It's possible to run a customized deployment of Cluster Autoscaler on worker nodes, but extra care needs to be taken to ensure that Cluster Autoscaler remains up and running. Users can put it into kube-system namespace (Cluster Autoscaler doesn't scale down node with non-mirrored kube-system pods running on them) and set a priorityClassName: system-cluster-critical property on your pod spec (to prevent your pod from being evicted).
+To prevent your pod from being evicted, set a `priorityClassName: system-cluster-critical` property on your pod spec.
 
-Cluster Autoscaler is providing support to distinct cloud providers, more info at [cluster-autoscaler supported cloud providers](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment)
+Cluster Autoscaler is designed to run on Kubernetes master nodes. It can run in the `kube-system` namespace. Cluster Autoscaler doesn't scale down nodes with non-mirrored `kube-system` pods running on them.
 
-### Setting up the cluster autoscaler on Amazon Cloud Provider
+It's possible to run a customized deployment of Cluster Autoscaler on worker nodes, but extra care needs to be taken to ensure that Cluster Autoscaler remains up and running.
 
-For details on running the cluster autoscaler  on Amazon cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-autoscaler/amazon)
\ No newline at end of file
+# Cloud Providers
+
+Cluster Autoscaler provides support to distinct cloud providers. For more information, go to [cluster-autoscaler supported cloud providers.](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment)
+
+### Setting up Cluster Autoscaler on Amazon Cloud Provider
+
+For details on running the cluster autoscaler  on Amazon cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon)

From 48d2f61b613f062aed70fb5f07b6153a59b95b9c Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 6 Jul 2020 13:36:39 -0700
Subject: [PATCH 163/265] Edit formatting on AWS cluster autoscaler tutorial

---
 .../cluster-autoscaler/amazon/_index.md       | 439 +++++++++---------
 1 file changed, 229 insertions(+), 210 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md
index b72d730b973..d173d444e27 100644
--- a/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon/_index.md
@@ -1,192 +1,210 @@
 ---
-title: AWS
+title: Cluster Autoscaler with AWS EC2 Auto Scaling Groups
 weight: 1
 ---
 
-This doc will guide you how to install and use [k8s cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
+This guide will show you how to install and use [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
 
-## Prerequisites
+We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. 
+
+- [Prerequisites](#prerequisites)
+- [1. Create a Custom Cluster](#1-create-a-custom-cluster)
+- [2. Configure the Cloud Provider](#2-configure-the-cloud-provider)
+- [3. Deploy Nodes](#3-deploy-nodes)
+- [4. Install cluster-autoscaler](#4-install-cluster-autoscaler)
+  - [Parameters](#parameters)
+  - [Deployment](#deployment)
+- [Testing](#testing)
+  - [Generating Load](#generating-load)
+  - [Checking Scale](#checking-scale)
+
+# Prerequisites
 
 These elements are required to follow this guide:
-* Rancher server is up and running
-* AWS EC2 user with proper permissions to create vm, asg and IAM profiles and roles
 
-## Installation
+* The Rancher server is up and running
+* You have an AWS EC2 user with proper permissions to create virtual machines, auto scaling groups, and IAM profiles and roles
 
-We are going to install a Rancher RKE custom cluster with fixed size on k8s etcd+controlplane planes and variable size on k8s worker plane, managed by cluster-autoscaler. 
-
-### Create cluster
+### 1. Create a Custom Cluster
 
 On Rancher server, we should create a custom k8s cluster v1.18.x. Be sure that cloud_provider name is set to `amazonec2`. Once cluster is created we need to get:
+
 * clusterID: `c-xxxxx` will be used on EC2 `kubernetes.io/cluster/<clusterID>` instance tag
 * clusterName: will be used on EC2 `k8s.io/cluster-autoscaler/<clusterName>` instance tag
 * nodeCommand: will be added on EC2 instance user_data to include new nodes on cluster
-`sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CHECKSUM> <roles>` 
 
-### Configure cloud provider
+    ```sh
+    sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CHECKSUM> <roles>
+    ```
 
-On AWS EC2, we should create few object to configure our system. We've defined 3 distinct groups to configure on AWS:
+### 2. Configure the Cloud Provider
 
-* Autoscale group: Nodes that will be part of the EC2 Auto Scalation Group (ASG). ASG will be used by cluster-autoscaler to scale up and down
-  * IAM profile: Required by k8s nodes where cluster-autoscaler will be running. Recommended, k8s master nodes
-  `K8sAutoscalerProfile`
-```
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "autoscaling:DescribeAutoScalingGroups",
-                "autoscaling:DescribeAutoScalingInstances",
-                "autoscaling:DescribeLaunchConfigurations",
-                "autoscaling:SetDesiredCapacity",
-                "autoscaling:TerminateInstanceInAutoScalingGroup",
-                "autoscaling:DescribeTags",
-                "autoscaling:DescribeLaunchConfigurations",
-                "ec2:DescribeLaunchTemplateVersions"
-            ],
-            "Resource": [
-                "*"
-            ]
-        }
-    ]
-}
-```
+On AWS EC2, we should create a few objects to configure our system. We've defined three distinct groups and IAM profiles to configure on AWS.
 
-* Master group: Nodes that will be part of the k8s etcd and/or control planes. This will be out of ASG 
-  * IAM profile: Required by k8s cloud_povider integration. Optionally, AWS_ACCESS_KEY and AWS_SECRET_KEY can be used instead [using-aws-credentials](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials)
-  `K8sMasterProfile`
-```
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "autoscaling:DescribeAutoScalingGroups",
-                "autoscaling:DescribeLaunchConfigurations",
-                "autoscaling:DescribeTags",
-                "ec2:DescribeInstances",
-                "ec2:DescribeRegions",
-                "ec2:DescribeRouteTables",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeSubnets",
-                "ec2:DescribeVolumes",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateTags",
-                "ec2:CreateVolume",
-                "ec2:ModifyInstanceAttribute",
-                "ec2:ModifyVolume",
-                "ec2:AttachVolume",
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:CreateRoute",
-                "ec2:DeleteRoute",
-                "ec2:DeleteSecurityGroup",
-                "ec2:DeleteVolume",
-                "ec2:DetachVolume",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:DescribeVpcs",
-                "elasticloadbalancing:AddTags",
-                "elasticloadbalancing:AttachLoadBalancerToSubnets",
-                "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
-                "elasticloadbalancing:CreateLoadBalancer",
-                "elasticloadbalancing:CreateLoadBalancerPolicy",
-                "elasticloadbalancing:CreateLoadBalancerListeners",
-                "elasticloadbalancing:ConfigureHealthCheck",
-                "elasticloadbalancing:DeleteLoadBalancer",
-                "elasticloadbalancing:DeleteLoadBalancerListeners",
-                "elasticloadbalancing:DescribeLoadBalancers",
-                "elasticloadbalancing:DescribeLoadBalancerAttributes",
-                "elasticloadbalancing:DetachLoadBalancerFromSubnets",
-                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
-                "elasticloadbalancing:ModifyLoadBalancerAttributes",
-                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
-                "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
-                "elasticloadbalancing:AddTags",
-                "elasticloadbalancing:CreateListener",
-                "elasticloadbalancing:CreateTargetGroup",
-                "elasticloadbalancing:DeleteListener",
-                "elasticloadbalancing:DeleteTargetGroup",
-                "elasticloadbalancing:DescribeListeners",
-                "elasticloadbalancing:DescribeLoadBalancerPolicies",
-                "elasticloadbalancing:DescribeTargetGroups",
-                "elasticloadbalancing:DescribeTargetHealth",
-                "elasticloadbalancing:ModifyListener",
-                "elasticloadbalancing:ModifyTargetGroup",
-                "elasticloadbalancing:RegisterTargets",
-                "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
-                "iam:CreateServiceLinkedRole",
-                "ecr:GetAuthorizationToken",
-                "ecr:BatchCheckLayerAvailability",
-                "ecr:GetDownloadUrlForLayer",
-                "ecr:GetRepositoryPolicy",
-                "ecr:DescribeRepositories",
-                "ecr:ListImages",
-                "ecr:BatchGetImage",
-                "kms:DescribeKey"
-            ],
-            "Resource": [
-                "*"
-            ]
-        }
-    ]
-}
-```
-  * IAM role: `K8sMasterRole: [K8sMasterProfile,K8sAutoscalerProfile]`
-  * Security group: `K8sMasterSg` More info at[RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
-  * Tags:
-    `kubernetes.io/cluster/<clusterID>: owned`
-  * User data: `K8sMasterUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add etcd+controlplane node to the k8s cluster
-```
-#!/bin/bash -x
+1. Autoscaling group: Nodes that will be part of the EC2 Auto Scaling Group (ASG). The ASG will be used by `cluster-autoscaler` to scale up and down.
+  * IAM profile: Required by k8s nodes where cluster-autoscaler will be running. It is recommended for Kubernetes master nodes. This profile is called `K8sAutoscalerProfile`.
 
-cat <<EOF > /etc/sysctl.d/90-kubelet.conf
-vm.overcommit_memory = 1
-vm.panic_on_oom = 0
-kernel.panic = 10
-kernel.panic_on_oops = 1
-kernel.keys.root_maxkeys = 1000000
-kernel.keys.root_maxbytes = 25000000
-EOF
-sysctl -p /etc/sysctl.d/90-kubelet.conf
+      ```json
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "autoscaling:DescribeAutoScalingGroups",
+                      "autoscaling:DescribeAutoScalingInstances",
+                      "autoscaling:DescribeLaunchConfigurations",
+                      "autoscaling:SetDesiredCapacity",
+                      "autoscaling:TerminateInstanceInAutoScalingGroup",
+                      "autoscaling:DescribeTags",
+                      "autoscaling:DescribeLaunchConfigurations",
+                      "ec2:DescribeLaunchTemplateVersions"
+                  ],
+                  "Resource": [
+                      "*"
+                  ]
+              }
+          ]
+      }
+      ```
 
-curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
-sudo usermod -aG docker ubuntu
+2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. 
+  * IAM profile: Required by the Kubernetes cloud_provider integration. Optionally, `AWS_ACCESS_KEY` and `AWS_SECRET_KEY` can be used instead [using-aws-credentials.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) This profile is called `K8sMasterProfile`.
 
-TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
-PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
-PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
-K8S_ROLES="--etcd --controlplane"
+      ```json
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "autoscaling:DescribeAutoScalingGroups",
+                      "autoscaling:DescribeLaunchConfigurations",
+                      "autoscaling:DescribeTags",
+                      "ec2:DescribeInstances",
+                      "ec2:DescribeRegions",
+                      "ec2:DescribeRouteTables",
+                      "ec2:DescribeSecurityGroups",
+                      "ec2:DescribeSubnets",
+                      "ec2:DescribeVolumes",
+                      "ec2:CreateSecurityGroup",
+                      "ec2:CreateTags",
+                      "ec2:CreateVolume",
+                      "ec2:ModifyInstanceAttribute",
+                      "ec2:ModifyVolume",
+                      "ec2:AttachVolume",
+                      "ec2:AuthorizeSecurityGroupIngress",
+                      "ec2:CreateRoute",
+                      "ec2:DeleteRoute",
+                      "ec2:DeleteSecurityGroup",
+                      "ec2:DeleteVolume",
+                      "ec2:DetachVolume",
+                      "ec2:RevokeSecurityGroupIngress",
+                      "ec2:DescribeVpcs",
+                      "elasticloadbalancing:AddTags",
+                      "elasticloadbalancing:AttachLoadBalancerToSubnets",
+                      "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+                      "elasticloadbalancing:CreateLoadBalancer",
+                      "elasticloadbalancing:CreateLoadBalancerPolicy",
+                      "elasticloadbalancing:CreateLoadBalancerListeners",
+                      "elasticloadbalancing:ConfigureHealthCheck",
+                      "elasticloadbalancing:DeleteLoadBalancer",
+                      "elasticloadbalancing:DeleteLoadBalancerListeners",
+                      "elasticloadbalancing:DescribeLoadBalancers",
+                      "elasticloadbalancing:DescribeLoadBalancerAttributes",
+                      "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+                      "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+                      "elasticloadbalancing:ModifyLoadBalancerAttributes",
+                      "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+                      "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+                      "elasticloadbalancing:AddTags",
+                      "elasticloadbalancing:CreateListener",
+                      "elasticloadbalancing:CreateTargetGroup",
+                      "elasticloadbalancing:DeleteListener",
+                      "elasticloadbalancing:DeleteTargetGroup",
+                      "elasticloadbalancing:DescribeListeners",
+                      "elasticloadbalancing:DescribeLoadBalancerPolicies",
+                      "elasticloadbalancing:DescribeTargetGroups",
+                      "elasticloadbalancing:DescribeTargetHealth",
+                      "elasticloadbalancing:ModifyListener",
+                      "elasticloadbalancing:ModifyTargetGroup",
+                      "elasticloadbalancing:RegisterTargets",
+                      "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+                      "iam:CreateServiceLinkedRole",
+                      "ecr:GetAuthorizationToken",
+                      "ecr:BatchCheckLayerAvailability",
+                      "ecr:GetDownloadUrlForLayer",
+                      "ecr:GetRepositoryPolicy",
+                      "ecr:DescribeRepositories",
+                      "ecr:ListImages",
+                      "ecr:BatchGetImage",
+                      "kms:DescribeKey"
+                  ],
+                  "Resource": [
+                      "*"
+                  ]
+              }
+          ]
+      }
+      ```
 
-sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKCSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
-```
+    * IAM role: `K8sMasterRole: [K8sMasterProfile,K8sAutoscalerProfile]`
+    * Security group: `K8sMasterSg` More info at[RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
+    * Tags:
+      `kubernetes.io/cluster/<clusterID>: owned`
+    * User data: `K8sMasterUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add etcd+controlplane node to the k8s cluster
 
-* Worker group: Nodes that will be part of the k8s worker plane. Worker will be scaled by cluster-autoscaler using ASG
+      ```sh
+      #!/bin/bash -x
+
+      cat <<EOF > /etc/sysctl.d/90-kubelet.conf
+      vm.overcommit_memory = 1
+      vm.panic_on_oom = 0
+      kernel.panic = 10
+      kernel.panic_on_oops = 1
+      kernel.keys.root_maxkeys = 1000000
+      kernel.keys.root_maxbytes = 25000000
+      EOF
+      sysctl -p /etc/sysctl.d/90-kubelet.conf
+
+      curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
+      sudo usermod -aG docker ubuntu
+
+      TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+      PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
+      PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
+      K8S_ROLES="--etcd --controlplane"
+
+      sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
+      ```
+
+3. Worker group: Nodes that will be part of the k8s worker plane. Worker nodes will be scaled by cluster-autoscaler using the ASG.
   * IAM profile: Provides cloud_provider worker integration.
-  `K8sWorkerProfile`
-```
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "ec2:DescribeInstances",
-                "ec2:DescribeRegions",
-                "ecr:GetAuthorizationToken",
-                "ecr:BatchCheckLayerAvailability",
-                "ecr:GetDownloadUrlForLayer",
-                "ecr:GetRepositoryPolicy",
-                "ecr:DescribeRepositories",
-                "ecr:ListImages",
-                "ecr:BatchGetImage"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-```
+  This profile is called `K8sWorkerProfile`.
+
+      ```json
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "ec2:DescribeInstances",
+                      "ec2:DescribeRegions",
+                      "ecr:GetAuthorizationToken",
+                      "ecr:BatchCheckLayerAvailability",
+                      "ecr:GetDownloadUrlForLayer",
+                      "ecr:GetRepositoryPolicy",
+                      "ecr:DescribeRepositories",
+                      "ecr:ListImages",
+                      "ecr:BatchGetImage"
+                  ],
+                  "Resource": "*"
+              }
+          ]
+      }
+      ```
+
   * IAM role: `K8sWorkerRole: [K8sWorkerProfile]`
   * Security group: `K8sWorkerSg` More info at [RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
   * Tags:
@@ -194,44 +212,45 @@ sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kube
     * `k8s.io/cluster-autoscaler/<clusterName>: true`
     * `k8s.io/cluster-autoscaler/enabled: true`
   * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster 
-```
-#!/bin/bash -x
 
-cat <<EOF > /etc/sysctl.d/90-kubelet.conf
-vm.overcommit_memory = 1
-vm.panic_on_oom = 0
-kernel.panic = 10
-kernel.panic_on_oops = 1
-kernel.keys.root_maxkeys = 1000000
-kernel.keys.root_maxbytes = 25000000
-EOF
-sysctl -p /etc/sysctl.d/90-kubelet.conf
+      ```sh
+      #!/bin/bash -x
 
-curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
-sudo usermod -aG docker ubuntu
+      cat <<EOF > /etc/sysctl.d/90-kubelet.conf
+      vm.overcommit_memory = 1
+      vm.panic_on_oom = 0
+      kernel.panic = 10
+      kernel.panic_on_oops = 1
+      kernel.keys.root_maxkeys = 1000000
+      kernel.keys.root_maxbytes = 25000000
+      EOF
+      sysctl -p /etc/sysctl.d/90-kubelet.conf
 
-TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
-PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
-PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
-K8S_ROLES="--worker"
+      curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
+      sudo usermod -aG docker ubuntu
 
-sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKCSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
-```
+      TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+      PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
+      PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
+      K8S_ROLES="--worker"
 
-More info at [RKE clusters on AWS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/) and [Cluster Autoscaler on AWS](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md)
+      sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKCSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
+      ```
 
-### Deploy nodes
+More info is at [RKE clusters on AWS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/) and [Cluster Autoscaler on AWS.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md)
 
-Once we've configured AWS, let's cretate vm's to bootstrap our cluster:
+### 3. Deploy Nodes
 
-* master (etcd+controlplane): Depending your needs, deploy 3 master instances with proper size. More info at []({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/)
+Once we've configured AWS, let's create VMs to bootstrap our cluster:
+
+* master (etcd+controlplane): Depending your needs, deploy three master instances with proper size. More info is at [the recommendations for production-ready clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/)
   * IAM role: `K8sMasterRole`
   * Security group: `K8sMasterSg`
   * Tags: 
     * `kubernetes.io/cluster/<clusterID>: owned`
   * User data: `K8sMasterUserData`
 
-* worker: Define an ASG on EC2 with following setting:
+* worker: Define an ASG on EC2 with the following settings:
   * Name: `K8sWorkerAsg`
   * IAM role: `K8sWorkerRole`
   * Security group: `K8sWorkerSg`
@@ -245,20 +264,20 @@ Once we've configured AWS, let's cretate vm's to bootstrap our cluster:
     * desired: 2
     * maximum: 10
 
-Once vm's deployment is done, you should have a Rancher custom cluster up and running with 3 master and 2 worker nodes.
+Once the VMs are deployed, you should have a Rancher custom cluster up and running with three master and two worker nodes.
 
-### Cluster-scaler
+### 4. Install Cluster-autoscaler
 
 At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. 
 
 #### Parameters
 
-This table shows cluster-autoscaler parameters to fine tuning:
+This table shows cluster-autoscaler parameters for fine tuning:
 
-|Parameter|Default|Description|
-|-|-|-|
+| Parameter | Default | Description |
+|---|---|---|
 |cluster-name|-|Autoscaled cluster name, if available|
-|address|:8085|The address to expose prometheus metrics|
+|address|:8085|The address to expose Prometheus metrics|
 |kubernetes|-|Kubernetes master location. Leave blank for default|
 |kubeconfig|-|Path to kubeconfig file with authorization and master location information|
 |cloud-config|-|The path to the cloud provider configuration file.  Empty string for no configuration file|
@@ -291,7 +310,7 @@ cloud-provider|-|Cloud provider type|
 |nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: <min>:<max>:<other...>|
 |node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `<name of discoverer>:[<key>[=<value>]]`|
 |estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]|
-|expander|"random"|Type of node group expander to be used in scale up. Available values: ["random","most-pods","least-waste","price","priority"]|
+|expander|"random"|Type of node group expander to be used in scale up. Available values: `["random","most-pods","least-waste","price","priority"]`|
 |ignore-daemonsets-utilization|false|Should CA ignore DaemonSet pods when calculating resource utilization for scaling down|
 |ignore-mirror-pods-utilization|false|Should CA ignore Mirror pods when calculating resource utilization for scaling down|
 |write-status-configmap|true|Should CA write status information to a configmap|
@@ -314,7 +333,7 @@ cloud-provider|-|Cloud provider type|
 Based on [cluster-autoscaler-run-on-master.yaml](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/examples/cluster-autoscaler-run-on-master.yaml) example, we've created our own `cluster-autoscaler-deployment.yaml` to use preferred [auto-discovery setup](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#auto-discovery-setup), updating tolerations, nodeSelector, image version and command config:
 
 
-```
+```yml
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -491,26 +510,26 @@ spec:
 
 ```
 
-Once manifest file is prepared, deploy it in the k8s cluster (Rancher UI can be used instead):
+Once the manifest file is prepared, deploy it in the Kubernetes cluster (Rancher UI can be used instead):
 
-```
+```sh
 kubectl -n kube-system apply -f cluster-autoscaler-deployment.yaml
 ```
 
-**Note:** Cluster-autoscaler deployment can also be setup using [manual configuration](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#manual-configuration)
+**Note:** Cluster-autoscaler deployment can also be set up using [manual configuration](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#manual-configuration)
 
-## Testing
+# Testing
 
 At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: 
 
-* there are pods that failed to run in the cluster due to insufficient resources. Scale up
-* there are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. Scale down
+* There are pods that failed to run in the cluster due to insufficient resources. In this case, the cluster is scaled up.
+* There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. In this case, the cluster is scaled down.
 
-### Generating load
+### Generating Load
 
-We've prepared a `test-deployment.yaml` just to generate load on the k8s cluster and see if cluster-scaler is working properly. Test deployment is requesting 1000m cpu and 1024Mi memory by 3 replica. Adjust requested resources and/or replica to be sure you exhaust k8s cluster resources:
+We've prepared a `test-deployment.yaml` just to generate load on the Kubernetes cluster and see if cluster-autoscaler is working properly. The test deployment is requesting 1000m CPU and 1024Mi memory by three replicas. Adjust the requested resources and/or replica to be sure you exhaust the Kubernetes cluster resources:
 
-```
+```yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -548,14 +567,14 @@ spec:
             memory: 1024Mi
 ```
 
-Once test deployment is prepared, deploy it in the k8s cluster default namespace (Rancher UI can be used instead):
+Once the test deployment is prepared, deploy it in the Kubernetes cluster default namespace (Rancher UI can be used instead):
 
 ```
 kubectl -n default apply -f test-deployment.yaml
 ```
 
-### Checking scale
+### Checking Scale
 
-Once k8s resources got exhausted, cluster-scaler should scale up worker nodes where schedule failed pods. It should be scaling up until up until all pods became scheduled. You should see new nodes on ASG and on k8s cluster. Check logs on "kube-system" cluster-autoscaler pod.
+Once the Kubernetes resources got exhausted, cluster-autoscaler should scale up worker nodes where pods failed to be scheduled. It should scale up until up until all pods became scheduled. You should see the new nodes on the ASG and on the Kubernetes cluster. Check the logs on the `kube-system` cluster-autoscaler pod.
 
-Once scale up is checked, let check for scale down. To do it, lets reduce the replica number on test deployment until you release enought k8s cluster resource to scale down. You should see disappear nodes on ASG and on k8s cluster. Check logs on "kube-system" cluster-autoscaler pod.
+Once scale up is checked, let check for scale down. To do it, reduce the replica number on the test deployment until you release enough Kubernetes cluster resources to scale down. You should see nodes disappear on the ASG and on the Kubernetes cluster. Check the logs on the `kube-system` cluster-autoscaler pod.

From a37a037c57277207ca6ebedc9cba3ed4892701cb Mon Sep 17 00:00:00 2001
From: David Noland <dnoland@rancher.com>
Date: Mon, 6 Jul 2020 14:45:42 -0700
Subject: [PATCH 164/265] Added note to PingIdentity auth that metadata & acs
 URLs will not work until saved

---
 .../en/admin-settings/authentication/ping-federate/_index.md     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/rancher/v2.x/en/admin-settings/authentication/ping-federate/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/ping-federate/_index.md
index 8cb2508c681..e9a43d062f2 100644
--- a/content/rancher/v2.x/en/admin-settings/authentication/ping-federate/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/authentication/ping-federate/_index.md
@@ -12,6 +12,7 @@ If your organization uses Ping Identity Provider (IdP) for user authentication,
 >- Following are the Rancher Service Provider URLs needed for configuration:
 Metadata URL: `https://<rancher-server>/v1-saml/ping/saml/metadata`
 Assertion Consumer Service (ACS) URL: `https://<rancher-server>/v1-saml/ping/saml/acs`
+Note that these URLs will not return valid data until the authentication configuration is saved in Rancher.
 >- Export a `metadata.xml` file from your IdP Server. For more information, see the [PingIdentity documentation](https://documentation.pingidentity.com/pingfederate/pf83/index.shtml#concept_exportingMetadata.html).
 
 1.	From the **Global** view, select **Security > Authentication** from the main menu.

From 93c3ea4a9fe8c73ac122aacea66d9c37d550ddaa Mon Sep 17 00:00:00 2001
From: Caleb Bron <caleb@rancher.com>
Date: Sat, 4 Jul 2020 14:58:53 -0700
Subject: [PATCH 165/265] Release notes for Istio 1.5.7

---
 .../tools/istio/release-notes/_index.md       | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md
new file mode 100644
index 00000000000..18e8f3cec92
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md
@@ -0,0 +1,19 @@
+---
+title: Release Notes
+---
+
+
+# Istio 1.5.7
+
+
+### Important note on 1.5.x versions
+
+When upgrading from any 1.4 version of Istio to any 1.5 version, the Rancher installer will delete several resources in order to complete the upgrade, at which point they will be immediately re-installed. This includes the `istio-reader-service-account`. If your Istio installation is using this service account be aware that any secrets tied to the service account will be deleted. Most notably this will **break specific [multi-cluster deployments](https://archive.istio.io/v1.4/docs/setup/install/multicluster/)**.
+
+See the official upgrade notes for additional information on the 1.5 release and upgrading from 1.4: https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/
+
+> **Note:** Rancher continues to use the Helm installation method, which produces a different architecture from an istioctl installation.
+
+### Known Issues
+
+* The Kiali traffic graph is currently not working [#24924](https://github.com/istio/istio/issues/24924)

From fcb4b36425bc65d370ed697bcdfd73aa67b241ee Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 7 Jul 2020 21:31:28 -0700
Subject: [PATCH 166/265] Document default username and password for Grafana

---
 .../rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md  | 2 ++
 .../rancher/v2.x/en/project-admin/tools/monitoring/_index.md  | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
index c2618dd8d03..7620e43b643 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
@@ -59,6 +59,8 @@ As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-p
 
 **Result:** The Prometheus server will be deployed as well as two monitoring applications. The two monitoring applications, `cluster-monitoring` and `monitoring-operator`, are added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the cluster's `system` project. After the applications are `active`, you can start viewing [cluster metrics]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/) through the [Rancher dashboard]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics/#rancher-dashboard) or directly from [Grafana]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#grafana).
 
+> The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
+
 # Resource Consumption
 
 When enabling cluster monitoring, you need to ensure your worker nodes and Prometheus pod have enough resources. The tables below provides a guide of how much resource consumption will be used. In larger deployments, it is strongly advised that the monitoring infrastructure be placed on dedicated nodes in the cluster.
diff --git a/content/rancher/v2.x/en/project-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/project-admin/tools/monitoring/_index.md
index c5372b0ba6d..80f8c7e5474 100644
--- a/content/rancher/v2.x/en/project-admin/tools/monitoring/_index.md
+++ b/content/rancher/v2.x/en/project-admin/tools/monitoring/_index.md
@@ -53,7 +53,9 @@ Prometheus|750m| 750Mi | 1000m | 1000Mi | Yes
 Grafana | 100m | 100Mi | 200m | 200Mi | No
 
 
-**Result:** A single application,`project-monitoring`, is added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the project.  After the application is `active`, you can start viewing [project metrics](#project-metrics) through the [Rancher dashboard]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#rancher-dashboard) or directly from [Grafana]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#grafana).
+**Result:** A single application,`project-monitoring`, is added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the project. After the application is `active`, you can start viewing [project metrics](#project-metrics) through the [Rancher dashboard]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#rancher-dashboard) or directly from [Grafana]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#grafana).
+
+> The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
 
 ### Project Metrics
 

From 0350b0527aa773de4af5c9f2252ebcf7cb7a5d15 Mon Sep 17 00:00:00 2001
From: Onkar Dhuri <onkar.dhuri@gmail.com>
Date: Wed, 1 Jul 2020 07:11:31 +0530
Subject: [PATCH 167/265] Fixed 404 Link

Updated to named reference within the doc
---
 content/rancher/v2.x/en/catalog/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/catalog/_index.md b/content/rancher/v2.x/en/catalog/_index.md
index 97b2c2298cd..b6e76fa7b0d 100644
--- a/content/rancher/v2.x/en/catalog/_index.md
+++ b/content/rancher/v2.x/en/catalog/_index.md
@@ -41,7 +41,7 @@ Project | This specific cluster can access the Helm charts in this catalog |  v2
 
 _Applicable as of v2.4.0_
 
-In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully [backwards compatible]({{<baseurl>}}/rancher/v2.x/en/catalog/helm-3-backwards-compatibility) with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version. This will help reduce app deployment issues as your Rancher users will not need to know which version of your chart is compatible with which Helm version - they can just select a catalog, select an app and deploy a version that has already been vetted for compatibility.
+In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully [backwards compatible]({{<baseurl>}}/rancher/v2.x/en/catalog#helm-3-backwards-compatibility) with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version. This will help reduce app deployment issues as your Rancher users will not need to know which version of your chart is compatible with which Helm version - they can just select a catalog, select an app and deploy a version that has already been vetted for compatibility.
 
 When you create a custom catalog, you will have to configure the catalog to use either Helm 2 or Helm 3. This version cannot be changed later. If the catalog is added with the wrong Helm version, it will need to be deleted and re-added.
 

From 318a87367212d3e025bdece24b6d6d02c7dcdb73 Mon Sep 17 00:00:00 2001
From: Bastian Hofmann <bashofmann@gmail.com>
Date: Fri, 3 Jul 2020 13:11:36 +0200
Subject: [PATCH 168/265] Move cluster-capabilities-table to a headless bundle
 and include it as a page instead of reading the file

This prevents the table to automatically be included on pages of other bundles.
By including the page instead of reading the file also the shortcodes in the table are expanded correctly.

This fixes broken links in the table.

Fixes https://github.com/rancher/docs/issues/2577

Signed-off-by: Bastian Hofmann <bashofmann@gmail.com>
---
 content/rancher/v2.x/en/cluster-admin/_index.md              | 2 +-
 .../rancher/v2.x/en/cluster-admin/editing-clusters/_index.md | 2 +-
 content/rancher/v2.x/en/cluster-provisioning/_index.md       | 2 +-
 .../cluster-capabilities-table.md                            | 0
 content/rancher/v2.x/en/includes/index.md                    | 3 +++
 content/rancher/v2.x/en/overview/_index.md                   | 2 +-
 layouts/shortcodes/include.html                              | 5 +++++
 7 files changed, 12 insertions(+), 4 deletions(-)
 rename content/rancher/v2.x/en/{cluster-admin => includes}/cluster-capabilities-table.md (100%)
 create mode 100644 content/rancher/v2.x/en/includes/index.md
 create mode 100644 layouts/shortcodes/include.html

diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index fe49bdb7e9c..9323075c141 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -23,7 +23,7 @@ Alternatively, you can switch between projects and clusters directly in the navi
 
 After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/), [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) will need to manage these clusters. There are many different options of how to manage your cluster. 
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
 
 ## Configuring Tools
 
diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
index 1fe6ce09d18..b69c578fbd0 100644
--- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
@@ -12,7 +12,7 @@ The options and settings available for an existing cluster change based on the m
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
 
 ## Editing Cluster Membership
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/_index.md b/content/rancher/v2.x/en/cluster-provisioning/_index.md
index 652194b518b..1c9485b0495 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/_index.md
@@ -28,7 +28,7 @@ This section covers the following topics:
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
 
 # Setting up Clusters in a Hosted Kubernetes Provider
 
diff --git a/content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md b/content/rancher/v2.x/en/includes/cluster-capabilities-table.md
similarity index 100%
rename from content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md
rename to content/rancher/v2.x/en/includes/cluster-capabilities-table.md
diff --git a/content/rancher/v2.x/en/includes/index.md b/content/rancher/v2.x/en/includes/index.md
new file mode 100644
index 00000000000..ca03031f1ee
--- /dev/null
+++ b/content/rancher/v2.x/en/includes/index.md
@@ -0,0 +1,3 @@
+---
+headless: true
+---
diff --git a/content/rancher/v2.x/en/overview/_index.md b/content/rancher/v2.x/en/overview/_index.md
index b691f67864a..2f981c7ec1c 100644
--- a/content/rancher/v2.x/en/overview/_index.md
+++ b/content/rancher/v2.x/en/overview/_index.md
@@ -60,4 +60,4 @@ After a cluster is created with Rancher, a cluster administrator can manage clus
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
diff --git a/layouts/shortcodes/include.html b/layouts/shortcodes/include.html
new file mode 100644
index 00000000000..0d98507f062
--- /dev/null
+++ b/layouts/shortcodes/include.html
@@ -0,0 +1,5 @@
+{{$file := .Get "file"}}
+
+{{- with .Site.GetPage $file -}}
+{{- .Content | markdownify -}}
+{{- end -}}

From 863f4736d15af973439f650bd7ed6b936c190dc6 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 7 Jul 2020 21:57:42 -0700
Subject: [PATCH 169/265] Revert "Move cluster-capabilities-table to a headless
 bundle and include it as a page instead of reading the file"

This reverts commit 0ebb806516b296d8fa0d74b25c928a3229c21330.
---
 content/rancher/v2.x/en/cluster-admin/_index.md              | 2 +-
 .../cluster-capabilities-table.md                            | 0
 .../rancher/v2.x/en/cluster-admin/editing-clusters/_index.md | 2 +-
 content/rancher/v2.x/en/cluster-provisioning/_index.md       | 2 +-
 content/rancher/v2.x/en/includes/index.md                    | 3 ---
 content/rancher/v2.x/en/overview/_index.md                   | 2 +-
 layouts/shortcodes/include.html                              | 5 -----
 7 files changed, 4 insertions(+), 12 deletions(-)
 rename content/rancher/v2.x/en/{includes => cluster-admin}/cluster-capabilities-table.md (100%)
 delete mode 100644 content/rancher/v2.x/en/includes/index.md
 delete mode 100644 layouts/shortcodes/include.html

diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index 9323075c141..fe49bdb7e9c 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -23,7 +23,7 @@ Alternatively, you can switch between projects and clusters directly in the navi
 
 After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/), [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) will need to manage these clusters. There are many different options of how to manage your cluster. 
 
-{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
 
 ## Configuring Tools
 
diff --git a/content/rancher/v2.x/en/includes/cluster-capabilities-table.md b/content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md
similarity index 100%
rename from content/rancher/v2.x/en/includes/cluster-capabilities-table.md
rename to content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md
diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
index b69c578fbd0..1fe6ce09d18 100644
--- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
@@ -12,7 +12,7 @@ The options and settings available for an existing cluster change based on the m
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
 
 ## Editing Cluster Membership
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/_index.md b/content/rancher/v2.x/en/cluster-provisioning/_index.md
index 1c9485b0495..652194b518b 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/_index.md
@@ -28,7 +28,7 @@ This section covers the following topics:
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
 
 # Setting up Clusters in a Hosted Kubernetes Provider
 
diff --git a/content/rancher/v2.x/en/includes/index.md b/content/rancher/v2.x/en/includes/index.md
deleted file mode 100644
index ca03031f1ee..00000000000
--- a/content/rancher/v2.x/en/includes/index.md
+++ /dev/null
@@ -1,3 +0,0 @@
----
-headless: true
----
diff --git a/content/rancher/v2.x/en/overview/_index.md b/content/rancher/v2.x/en/overview/_index.md
index 2f981c7ec1c..b691f67864a 100644
--- a/content/rancher/v2.x/en/overview/_index.md
+++ b/content/rancher/v2.x/en/overview/_index.md
@@ -60,4 +60,4 @@ After a cluster is created with Rancher, a cluster administrator can manage clus
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% include file="/rancher/v2.x/en/includes/cluster-capabilities-table.md" %}}
+{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
diff --git a/layouts/shortcodes/include.html b/layouts/shortcodes/include.html
deleted file mode 100644
index 0d98507f062..00000000000
--- a/layouts/shortcodes/include.html
+++ /dev/null
@@ -1,5 +0,0 @@
-{{$file := .Get "file"}}
-
-{{- with .Site.GetPage $file -}}
-{{- .Content | markdownify -}}
-{{- end -}}

From 6bea52ce6392e20b08327e9fadf4a6734dc4d097 Mon Sep 17 00:00:00 2001
From: Bastian Hofmann <bashofmann@gmail.com>
Date: Fri, 3 Jul 2020 13:11:36 +0200
Subject: [PATCH 170/265] Move cluster-capabilities-table to a headless bundle
 and include it as a page instead of reading the file

This prevents the table to automatically be included on pages of other bundles.
By including the page instead of reading the file also the shortcodes in the table are expanded correctly.

This fixes broken links in the table.

Fixes https://github.com/rancher/docs/issues/2577

Signed-off-by: Bastian Hofmann <bashofmann@gmail.com>
---
 content/rancher/v2.x/en/cluster-admin/_index.md              | 2 +-
 .../rancher/v2.x/en/cluster-admin/editing-clusters/_index.md | 2 +-
 content/rancher/v2.x/en/cluster-provisioning/_index.md       | 2 +-
 .../cluster-capabilities-table/index.md}                     | 3 +++
 content/rancher/v2.x/en/overview/_index.md                   | 2 +-
 layouts/shortcodes/include.html                              | 5 +++++
 6 files changed, 12 insertions(+), 4 deletions(-)
 rename content/rancher/v2.x/en/{cluster-admin/cluster-capabilities-table.md => cluster-provisioning/cluster-capabilities-table/index.md} (99%)
 create mode 100644 layouts/shortcodes/include.html

diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index fe49bdb7e9c..59615cb48a2 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -23,7 +23,7 @@ Alternatively, you can switch between projects and clusters directly in the navi
 
 After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/), [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) will need to manage these clusters. There are many different options of how to manage your cluster. 
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
 
 ## Configuring Tools
 
diff --git a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
index 1fe6ce09d18..3a1303e4db2 100644
--- a/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/editing-clusters/_index.md
@@ -12,7 +12,7 @@ The options and settings available for an existing cluster change based on the m
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
 
 ## Editing Cluster Membership
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/_index.md b/content/rancher/v2.x/en/cluster-provisioning/_index.md
index 652194b518b..eb65528492b 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/_index.md
@@ -28,7 +28,7 @@ This section covers the following topics:
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
 
 # Setting up Clusters in a Hosted Kubernetes Provider
 
diff --git a/content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md b/content/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table/index.md
similarity index 99%
rename from content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md
rename to content/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table/index.md
index 64e59cfa75e..b3560c76223 100644
--- a/content/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table/index.md
@@ -1,3 +1,6 @@
+---
+headless: true
+---
 | Action | [Rancher launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) | [Hosted Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | [Imported Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters) |
 | --- | --- | ---| ---|
 | [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | ✓ | ✓ | ✓ |
diff --git a/content/rancher/v2.x/en/overview/_index.md b/content/rancher/v2.x/en/overview/_index.md
index b691f67864a..1a97e92bffe 100644
--- a/content/rancher/v2.x/en/overview/_index.md
+++ b/content/rancher/v2.x/en/overview/_index.md
@@ -60,4 +60,4 @@ After a cluster is created with Rancher, a cluster administrator can manage clus
 
 The following table summarizes the options and settings available for each cluster type:
 
-{{% readfile file="/rancher/v2.x/en/cluster-admin/cluster-capabilities-table.md" markdown="true" %}}
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
diff --git a/layouts/shortcodes/include.html b/layouts/shortcodes/include.html
new file mode 100644
index 00000000000..0d98507f062
--- /dev/null
+++ b/layouts/shortcodes/include.html
@@ -0,0 +1,5 @@
+{{$file := .Get "file"}}
+
+{{- with .Site.GetPage $file -}}
+{{- .Content | markdownify -}}
+{{- end -}}

From ae612de0764cae6a5c795615358f3ec98f4c6b48 Mon Sep 17 00:00:00 2001
From: dkeightley <derek@rancher.com>
Date: Wed, 1 Jul 2020 11:33:28 +1200
Subject: [PATCH 171/265] Add cloudformation:DeleteStack permission

---
 .../hosted-kubernetes-clusters/eks/_index.md                   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index 5bb0f86029f..6e98f37e11d 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -263,7 +263,8 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
                 "cloudformation:DescribeStackResources",
                 "cloudformation:DescribeStacks",
                 "cloudformation:ListStacks",
-                "cloudformation:CreateStack"
+                "cloudformation:CreateStack",
+                "cloudformation:DeleteStack"
             ],
             "Resource": "*"
         },

From f80407a94a599f81531ae156ff58c128f0924b05 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Jul 2020 12:55:44 -0700
Subject: [PATCH 172/265] Say that cluster.yml examples are for RKE add-on
 installs

---
 .../3-node-externalssl-certificate/_index.md                    | 2 ++
 .../3-node-externalssl-recognizedca/_index.md                   | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
index 3130e66e547..74f1b8e2e6d 100644
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
+++ b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
@@ -5,6 +5,8 @@ weight: 3
 
 RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
 
+This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
+
 The following template can be used for the cluster.yml if you have a setup with:
 
 - Layer 7 load balancer with self-signed SSL termination (HTTPS)
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
index 9aeff93bcf0..4bb8694b284 100644
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
+++ b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
@@ -5,6 +5,8 @@ weight: 4
 
 RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
 
+This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
+
 The following template can be used for the cluster.yml if you have a setup with:
 
 - Layer 7 load balancer with SSL termination (HTTPS)

From 130c507a71f7b6283a1e31ba73b9412d94aee94e Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Jul 2020 13:05:11 -0700
Subject: [PATCH 173/265] Make EKS minimum permissions more discoverable

---
 .../hosted-kubernetes-clusters/eks/_index.md                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index 6e98f37e11d..ec106076c14 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -26,7 +26,7 @@ Rancher needs access to your AWS account in order to provision and administer yo
 
 1. Create a user with programmatic access by following the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
 
-2. Next, create an IAM policy that defines what this user has access to in your AWS account. It's important to only grant this user minimal access within your account. Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
+2. Next, create an IAM policy that defines what this user has access to in your AWS account. The required permissions are [here.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/#appendix-minimum-eks-permissions) Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
 
 3. Finally, follow the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey) to create an access key and secret key for this user.
 

From df1ef5c68a3743bd684b41a450265d873fd3f2cc Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Jul 2020 13:11:23 -0700
Subject: [PATCH 174/265] Correct the minimum RKE version for custom CA for S3

---
 .../rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md b/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md
index 400aee3b3e3..39400b87fbd 100644
--- a/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md
+++ b/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md
@@ -61,7 +61,7 @@ The `--access-key` and `--secret-key` options are not required if the `etcd` nod
 
 ##### Using a custom CA certificate for S3
 
-_Available as of v2.2.5_
+_Available as of v0.2.0_
 
 The backup snapshot can be stored on a custom `S3` backup like [minio](https://min.io/). If the S3 backend uses a self-signed or custom certificate, provide a custom certificate using the `--s3-endpoint-ca` to connect to the S3 back end.
 

From 1811d77fb9557e032c23e25c6d4e1ef6302706fb Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Jul 2020 13:12:36 -0700
Subject: [PATCH 175/265] Change back end to backend

---
 .../rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md b/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md
index 39400b87fbd..f1cfefeec90 100644
--- a/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md
+++ b/content/rke/latest/en/etcd-snapshots/one-time-snapshots/_index.md
@@ -63,7 +63,7 @@ The `--access-key` and `--secret-key` options are not required if the `etcd` nod
 
 _Available as of v0.2.0_
 
-The backup snapshot can be stored on a custom `S3` backup like [minio](https://min.io/). If the S3 backend uses a self-signed or custom certificate, provide a custom certificate using the `--s3-endpoint-ca` to connect to the S3 back end.
+The backup snapshot can be stored on a custom `S3` backup like [minio](https://min.io/). If the S3 backend uses a self-signed or custom certificate, provide a custom certificate using the `--s3-endpoint-ca` to connect to the S3 backend.
 
 ### IAM Support for Storing Snapshots in S3
 

From 088badd69db496d7a2a92052122a59b1227e7b01 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 8 Jul 2020 13:51:11 -0700
Subject: [PATCH 176/265] Fix inbound port requirements for K3s server nodes

---
 .../latest/en/installation/installation-requirements/_index.md  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/k3s/latest/en/installation/installation-requirements/_index.md b/content/k3s/latest/en/installation/installation-requirements/_index.md
index 68e95302aca..a7f51ef44c4 100644
--- a/content/k3s/latest/en/installation/installation-requirements/_index.md
+++ b/content/k3s/latest/en/installation/installation-requirements/_index.md
@@ -54,7 +54,7 @@ If you wish to utilize the metrics server, you will need to open port 10250 on e
 
 | Protocol | Port | Source | Description
 |-----|-----|----------------|---|
-| TCP | 6443 | K3s server nodes | Kubernetes API
+| TCP | 6443 | K3s agent nodes | Kubernetes API
 | UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN
 | TCP | 10250 | K3s server and agent nodes | kubelet
 

From 0c9418494043f5b29bc31d6e542908f623b68e1e Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Thu, 9 Jul 2020 13:44:02 -0700
Subject: [PATCH 177/265] DOCS-2593: add clarification around etcd gid, uid and
 nodes directive for reference config.yml

---
 content/rancher/v2.x/en/security/hardening-2.4/_index.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/security/hardening-2.4/_index.md b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
index fd0614ad98a..90eac2a0e35 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
@@ -47,6 +47,8 @@ A user account and group for the **etcd** service is required to be setup prior
 #### create `etcd` user and group
 To create the **etcd** group run the following console commands.
 
+The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`.
+
 ```
 groupadd --gid 52034 etcd
 useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd
@@ -147,7 +149,8 @@ Execute this script to apply the `default-allow-all.yaml` the **permissive** `Ne
 ### Reference Hardened RKE `cluster.yml` configuration
 The reference `cluster.yml` is used by the RKE CLI that provides the configuration needed to achieve a hardened install
 of Rancher Kubernetes Engine (RKE). Install [documentation](https://rancher.com/docs/rke/latest/en/installation/) is
-provided with additional details about the configuration items.
+provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration can be found here: https://rancher.com/docs/rke/latest/en/config-options/nodes
+
 
 ``` yaml
 # If you intend to deploy Kubernetes in an air-gapped environment,
@@ -155,6 +158,10 @@ provided with additional details about the configuration items.
 kubernetes_version: "v1.15.9-rancher1-1"
 enable_network_policy: true
 default_pod_security_policy_template_id: "restricted"
+# the nodes directive is required and will vary depending on your environment
+# documentation for node configuration can be found here:
+#  https://rancher.com/docs/rke/latest/en/config-options/nodes
+nodes:
 services:
   etcd:
     uid: 52034

From a53d71886d17e9d145b109abd5535b102d017b5c Mon Sep 17 00:00:00 2001
From: Caleb Bron <caleb@rancher.com>
Date: Thu, 9 Jul 2020 08:40:54 -0700
Subject: [PATCH 178/265] istio 1.5.8, not 1.5.7

---
 .../en/cluster-admin/tools/istio/release-notes/_index.md     | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md
index 18e8f3cec92..9b819eb4500 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md
@@ -3,12 +3,11 @@ title: Release Notes
 ---
 
 
-# Istio 1.5.7
-
+# Istio 1.5.8
 
 ### Important note on 1.5.x versions
 
-When upgrading from any 1.4 version of Istio to any 1.5 version, the Rancher installer will delete several resources in order to complete the upgrade, at which point they will be immediately re-installed. This includes the `istio-reader-service-account`. If your Istio installation is using this service account be aware that any secrets tied to the service account will be deleted. Most notably this will **break specific [multi-cluster deployments](https://archive.istio.io/v1.4/docs/setup/install/multicluster/)**.
+When upgrading from any 1.4 version of Istio to any 1.5 version, the Rancher installer will delete several resources in order to complete the upgrade, at which point they will be immediately re-installed. This includes the `istio-reader-service-account`. If your Istio installation is using this service account be aware that any secrets tied to the service account will be deleted. Most notably this will **break specific [multi-cluster deployments](https://archive.istio.io/v1.4/docs/setup/install/multicluster/)**. Downgrades back to 1.4 are not possible.
 
 See the official upgrade notes for additional information on the 1.5 release and upgrading from 1.4: https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/
 

From 74ddc4793dac7874b6e636fabe1f4818016d2296 Mon Sep 17 00:00:00 2001
From: Bastian Hofmann <bashofmann@gmail.com>
Date: Wed, 8 Jul 2020 12:06:48 +0200
Subject: [PATCH 179/265] Update Rancher HA disaster recovery documentation to
 work with rke >= 0.2.0

Signed-off-by: Bastian Hofmann <bashofmann@gmail.com>
---
 .../restorations/ha-restoration/_index.md     | 138 ++----------------
 1 file changed, 14 insertions(+), 124 deletions(-)

diff --git a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
index 32052f35d7c..e945c117ca0 100644
--- a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
@@ -9,7 +9,7 @@ aliases:
 This procedure describes how to use RKE to restore a snapshot of the Rancher Kubernetes cluster. 
 This will restore the Kubernetes configuration and the Rancher database and state.
 
-RKE v0.2.0 has changed how the [Kubernetes cluster state is stored]({{<baseurl>}}/rke/latest/en/installation/#kubernetes-cluster-state), so `pki.bundle.tar.gz` file usage is no longer required.
+> **Note:** This document covers clusters set up with RKE >= v0.2.x, for older RKE versions refer to the [RKE Documentation]({{<baseurl>}}/rke/latest/en/etcd-snapshots/restoring-from-backup).
 
 ## Restore Outline
 
@@ -18,8 +18,7 @@ RKE v0.2.0 has changed how the [Kubernetes cluster state is stored]({{<baseurl>}
 - [1. Preparation](#1-preparation)
 - [2. Place Snapshot](#2-place-snapshot)
 - [3. Configure RKE](#3-configure-rke)
-- [4. Restore Database](#4-restore-database)
-- [5. Bring Up the Cluster](#5-bring-up-the-cluster)
+- [4. Restore the Database and bring up the Cluster](#4-restore-the-database-and-bring-up-the-cluster)
 
 <!-- /TOC -->
 
@@ -34,76 +33,34 @@ Alternatively you can re-use the existing nodes after clearing Kubernetes and Ra
 > **IMPORTANT:** Before starting the restore make sure all the Kubernetes services on the old cluster nodes are stopped. We recommend powering off the nodes to be sure.
 
 ### 2. Place Snapshot
-The snapshot used to restore your etcd cluster is handled differently based on your version of RKE.
 
-#### RKE v0.2.0+
+As of RKE v0.2.0, snapshots could be saved in an S3 compatible backend. To restore your cluster from the snapshot stored in S3 compatible backend, you can skip this step and retrieve the snapshot in [4. Restore the Database and bring up the Cluster](#4-restore-the-database-and-bring-up-the-cluster). Otherwise, you will need to place the snapshot directly on one of the etcd nodes.
 
-As of RKE v0.2.0, snapshots could be saved in an S3 compatible backend. To restore your cluster from the snapshot stored in S3 compatible backend, you can skip this step and retrieve the snapshot in [Step 4: Restore Database](#4-restore-database). Otherwise, you will need to place the snapshot directly on the nodes.
-
-Pick one of the clean nodes. That node will be the "target node" for the initial restore. Place your snapshot in `/opt/rke/etcd-snapshots` on the target node.
-
-#### RKE v0.1.x
-
-When you take a snapshot, RKE saves a backup of the certificates, i.e. a file named `pki.bundle.tar.gz`, in the same location. The snapshot and PKI bundle file are required for the restore process, and they are expected to be in the same location.
-
-Pick one of the clean nodes. That node will be the "target node" for the initial restore. Place the snapshot and PKI certificate bundle files in the `/opt/rke/etcd-snapshots` directory on the target node.
-
-* Snapshot - `<snapshot>.db`
-* PKI Bundle - `pki.bundle.tar.gz`
+Pick one of the clean nodes that is supposed to become an etcd node. Place your snapshot file in `/opt/rke/etcd-snapshots` on that node.
 
 ### 3. Configure RKE
 
-Make a copy of your original `rancher-cluster.yml` file.
+Use your original `cluster.yml` and `cluster.rkestate` files and back them up before making any changes.
 
 ```
-cp rancher-cluster.yml rancher-cluster-restore.yml
+cp cluster.yml cluster.yml.bak
+cp cluster.rkestate cluster.rkestate.bak
 ```
 
-Modify the copy and make the following changes.
+Modify the `cluster.yml` file and change the IP addresses of all nodes to your new IP addresses.
 
-* Remove or comment out entire the `addons:` section. The Rancher deployment and supporting configuration is already in the `etcd` database.
-* Change your `nodes:` section to point to the restore nodes.
-* Comment out the nodes that are not your "target node". We want the cluster to only start on that one node.
+### 4. Restore the Database and bring up the Cluster
 
-*Example* `rancher-cluster-restore.yml`
+Use RKE with the modified `cluster.yml` to restore the etcd database and bring up the cluster again.
 
-```yaml
-nodes:
-- address: 52.15.238.179     # New Target Node
-  user: ubuntu
-  role: [ etcd, controlplane, worker ]
-# - address: 52.15.23.24
-#   user: ubuntu
-#   role: [ etcd, controlplane, worker ]
-# - address: 52.15.238.133
-#   user: ubuntu
-#   role: [ etcd, controlplane, worker ]
-
-# addons: |-
-#   ---
-#   kind: Namespace
-#   apiVersion: v1
-#   metadata:
-#     name: cattle-system
-#   ---
-...
-
-```
-
-### 4. Restore Database
-
-Use RKE with the new `rancher-cluster-restore.yml` configuration and restore the database to the single "target node".
-
-RKE will create an `etcd` container with the restored database on the target node. This container will not complete the `etcd` initialization and stay in a running state until the cluster brought up in the next step.
+> **Note:** Ensure your `cluster.rkestate` is present before starting the restore, as this contains your certificate data for the cluster.
 
 #### Restoring from a Local Snapshot
 
 When restoring etcd from a local snapshot, the snapshot is assumed to be located on the target node in the directory `/opt/rke/etcd-snapshots`.
 
-> **Note:** For RKE v0.1.x, the `pki.bundle.tar.gz` file is also expected to be in the same location.
-
 ```
-rke etcd snapshot-restore --name <snapshot>.db --config ./rancher-cluster-restore.yml
+rke etcd snapshot-restore --name snapshot-name --config ./cluster.yml
 ```
 
 #### Restoring from a Snapshot in S3
@@ -112,8 +69,6 @@ _Available as of RKE v0.2.0_
 
 When restoring etcd from a snapshot located in an S3 compatible backend, the command needs the S3 information in order to connect to the S3 backend and retrieve the snapshot.
 
-> **Note:** Ensure your `cluster.rkestate` is present before starting the restore, as this contains your certificate data for the cluster.
-
 ```
 $ rke etcd snapshot-restore --config cluster.yml --name snapshot-name \
 --s3 --access-key S3_ACCESS_KEY --secret-key S3_SECRET_KEY \
@@ -139,43 +94,9 @@ S3 specific options are only available for RKE v0.2.0+.
 | `--ssh-agent-auth`      |   [Use SSH Agent Auth defined by SSH_AUTH_SOCK]({{<baseurl>}}/rke/latest/en/config-options/#ssh-agent) | |
 | `--ignore-docker-version`  | [Disable Docker version check]({{<baseurl>}}/rke/latest/en/config-options/#supported-docker-versions) |
 
-### 5. Bring Up the Cluster
-
-Use RKE and bring up the cluster on the single "target node."
-
-> **Note:** For users running RKE v0.2.0+, ensure your `cluster.rkestate` is present before starting the restore, as this contains your certificate data for the cluster.
-
-```
-rke up --config ./rancher-cluster-restore.yml
-```
-
 #### Testing the Cluster
 
-Once RKE completes it will have created a credentials file in the local directory.  Configure `kubectl` to use the `kube_config_rancher-cluster-restore.yml` credentials file and check on the state of the cluster. See [Installing and Configuring kubectl]({{<baseurl>}}/rancher/v2.x/en/faq/kubectl/#configuration) for details.
-
-Your new cluster will take a few minutes to stabilize. Once you see the new "target node" transition to `Ready` and three old nodes in `NotReady` you are ready to continue.
-
-```
-kubectl get nodes
-
-NAME            STATUS    ROLES                      AGE       VERSION
-52.15.238.179   Ready     controlplane,etcd,worker    1m       v1.10.5
-18.217.82.189   NotReady  controlplane,etcd,worker   16d       v1.10.5
-18.222.22.56    NotReady  controlplane,etcd,worker   16d       v1.10.5
-18.191.222.99   NotReady  controlplane,etcd,worker   16d       v1.10.5
-```
-
-#### Cleaning up Old Nodes
-
-Use `kubectl` to delete the old nodes from the cluster.
-
-```
-kubectl delete node 18.217.82.189 18.222.22.56 18.191.222.99
-```
-
-#### Reboot the Target Node
-
-Reboot the target node to ensure the cluster networking and services are in a clean state before continuing.
+Once RKE completes it will have created a credentials file in the local directory.  Configure `kubectl` to use the `kube_config_cluster.yml` credentials file and check on the state of the cluster. See [Installing and Configuring kubectl]({{<baseurl>}}/rancher/v2.x/en/faq/kubectl/#configuration) for details.
 
 #### Check Kubernetes Pods
 
@@ -200,39 +121,8 @@ kube-system     metrics-server-97bc649d5-6w7zc          1/1       Running   1
 kube-system     tiller-deploy-56c4cf647b-j4whh          1/1       Running   1          4m
 ```
 
-#### Adding in Additional Nodes
-
-Edit the `rancher-cluster-restore.yml` RKE config file and uncomment the additional nodes.
-
-*Example* `rancher-cluster-restore.yml`
-
-```yaml
-nodes:
-- address: 52.15.238.179     # New Target Node
-  user: ubuntu
-  role: [ etcd, controlplane, worker ]
-- address: 52.15.23.24
-  user: ubuntu
-  role: [ etcd, controlplane, worker ]
-- address: 52.15.238.133
-  user: ubuntu
-  role: [ etcd, controlplane, worker ]
-
-# addons: |-
-#   ---
-#   kind: Namespace
-...
-
-```
-
-Run RKE and add the nodes to the new cluster.
-
-```
-rke up --config ./rancher-cluster-restore.yml
-```
-
 #### Finishing Up
 
 Rancher should now be running and available to manage your Kubernetes clusters. Review the [recommended architecture]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#recommended-architecture) for Kubernetes installations and update the endpoints for Rancher DNS or the Load Balancer that you built during Step 1 of the Kubernetes install ([1. Create Nodes and Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/#load-balancer)) to target the new cluster. Once the endpoints are updated, the agents on your managed clusters should automatically reconnect. This may take 10-15 minutes due to reconnect back off timeouts.
 
-> **IMPORTANT:** Remember to save your new RKE config (`rancher-cluster-restore.yml`) and `kubectl` credentials (`kube_config_rancher-cluster-restore.yml`) files in a safe place for future maintenance.
+> **IMPORTANT:** Remember to save your updated RKE config (`cluster.yml`) state file (`cluster.rkestate`) and `kubectl` credentials (`kube_config_cluster.yml`) files in a safe place for future maintenance.

From 66f181c29b6ca03045ef70dcec75506591318bb4 Mon Sep 17 00:00:00 2001
From: Bastian Hofmann <bashofmann@gmail.com>
Date: Thu, 9 Jul 2020 09:17:09 +0200
Subject: [PATCH 180/265] Update Rancher HA disaster recovery documentation to
 work with rke >= 0.2.0 - address the reviews

Signed-off-by: Bastian Hofmann <bashofmann@gmail.com>
---
 .../restorations/ha-restoration/_index.md     | 28 +++++++++++--------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
index e945c117ca0..c04aab3cf55 100644
--- a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
@@ -36,33 +36,39 @@ Alternatively you can re-use the existing nodes after clearing Kubernetes and Ra
 
 As of RKE v0.2.0, snapshots could be saved in an S3 compatible backend. To restore your cluster from the snapshot stored in S3 compatible backend, you can skip this step and retrieve the snapshot in [4. Restore the Database and bring up the Cluster](#4-restore-the-database-and-bring-up-the-cluster). Otherwise, you will need to place the snapshot directly on one of the etcd nodes.
 
-Pick one of the clean nodes that is supposed to become an etcd node. Place your snapshot file in `/opt/rke/etcd-snapshots` on that node.
+Pick one of the clean nodes that will have the etcd role assigned and place the zip-compressed snapshot file in `/opt/rke/etcd-snapshots` on that node.
+
+> **Note:** Because of a current limitation in RKE, the restore process does not work correctly if `/opt/rke/etcd-snapshots` is a NFS share that is mounted on all nodes with the etcd role. The easiest options are to either keep `/opt/rke/etcd-snapshots` as a local folder during the restore process and only mount the NFS share there after it has been completed, or to only mount the NFS share to one node with an etcd role in the beginning.
 
 ### 3. Configure RKE
 
-Use your original `cluster.yml` and `cluster.rkestate` files and back them up before making any changes.
+Use your original `rancher-cluster.yml` and `rancher-cluster.rkestate` files. If they are not stored in a version control system, it is a good idea to back them up before making any changes.
 
 ```
-cp cluster.yml cluster.yml.bak
-cp cluster.rkestate cluster.rkestate.bak
+cp rancher-cluster.yml rancher-cluster.yml.bak
+cp rancher-cluster.rkestate rancher-cluster.rkestate.bak
 ```
 
-Modify the `cluster.yml` file and change the IP addresses of all nodes to your new IP addresses.
+If the replaced or cleaned nodes have been configured with new IP addresses, modify the `rancher-cluster.yml` file to ensure the address and optional internal_address fields reflect the new addresses.
+
+> **IMPORTANT:** You should not rename the `rancher-cluster.yml` or `rancher-cluster.rkestate` files. It is important that the filenames match each other.
 
 ### 4. Restore the Database and bring up the Cluster
 
-Use RKE with the modified `cluster.yml` to restore the etcd database and bring up the cluster again.
+You will now use the RKE command-line tool with the `rancher-cluster.yml` and the `rancher-cluster.rkestate` configuration files to restore the etcd database and bring up the cluster on the new nodes.
 
-> **Note:** Ensure your `cluster.rkestate` is present before starting the restore, as this contains your certificate data for the cluster.
+> **Note:** Ensure your `rancher-cluster.rkestate` is present in the same directory as the `rancher-cluster.yml` file before starting the restore, as this file contains the certificate data for the cluster.
 
 #### Restoring from a Local Snapshot
 
 When restoring etcd from a local snapshot, the snapshot is assumed to be located on the target node in the directory `/opt/rke/etcd-snapshots`.
 
 ```
-rke etcd snapshot-restore --name snapshot-name --config ./cluster.yml
+rke etcd snapshot-restore --name snapshot-name --config ./rancher-cluster.yml
 ```
 
+> **Note:** The --name parameter expects the filename of the snapshot without the extension.
+
 #### Restoring from a Snapshot in S3
 
 _Available as of RKE v0.2.0_
@@ -70,7 +76,7 @@ _Available as of RKE v0.2.0_
 When restoring etcd from a snapshot located in an S3 compatible backend, the command needs the S3 information in order to connect to the S3 backend and retrieve the snapshot.
 
 ```
-$ rke etcd snapshot-restore --config cluster.yml --name snapshot-name \
+$ rke etcd snapshot-restore --config ./rancher-cluster.yml --name snapshot-name \
 --s3 --access-key S3_ACCESS_KEY --secret-key S3_SECRET_KEY \
 --bucket-name s3-bucket-name --s3-endpoint s3.amazonaws.com \
 --folder folder-name # Available as of v2.3.0
@@ -96,7 +102,7 @@ S3 specific options are only available for RKE v0.2.0+.
 
 #### Testing the Cluster
 
-Once RKE completes it will have created a credentials file in the local directory.  Configure `kubectl` to use the `kube_config_cluster.yml` credentials file and check on the state of the cluster. See [Installing and Configuring kubectl]({{<baseurl>}}/rancher/v2.x/en/faq/kubectl/#configuration) for details.
+Once RKE completes it will have created a credentials file in the local directory.  Configure `kubectl` to use the `kube_config_rancher-cluster.yml` credentials file and check on the state of the cluster. See [Installing and Configuring kubectl]({{<baseurl>}}/rancher/v2.x/en/faq/kubectl/#configuration) for details.
 
 #### Check Kubernetes Pods
 
@@ -125,4 +131,4 @@ kube-system     tiller-deploy-56c4cf647b-j4whh          1/1       Running   1
 
 Rancher should now be running and available to manage your Kubernetes clusters. Review the [recommended architecture]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#recommended-architecture) for Kubernetes installations and update the endpoints for Rancher DNS or the Load Balancer that you built during Step 1 of the Kubernetes install ([1. Create Nodes and Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/#load-balancer)) to target the new cluster. Once the endpoints are updated, the agents on your managed clusters should automatically reconnect. This may take 10-15 minutes due to reconnect back off timeouts.
 
-> **IMPORTANT:** Remember to save your updated RKE config (`cluster.yml`) state file (`cluster.rkestate`) and `kubectl` credentials (`kube_config_cluster.yml`) files in a safe place for future maintenance.
+> **IMPORTANT:** Remember to save your updated RKE config (`rancher-cluster.yml`) state file (`rancher-cluster.rkestate`) and `kubectl` credentials (`kube_config_rancher-cluster.yml`) files in a safe place for future maintenance for example in a version control system.

From 549bef7fecc28c3374f976e97cad2c7aaf5074a2 Mon Sep 17 00:00:00 2001
From: Nelson Roberts <nelson@rancher.com>
Date: Fri, 10 Jul 2020 10:35:11 -0700
Subject: [PATCH 181/265] EIO-135: call out specific namespaces for default
 service accounts

---
 content/rancher/v2.x/en/security/hardening-2.4/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/security/hardening-2.4/_index.md b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
index 90eac2a0e35..d4ddfccc434 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.4/_index.md
@@ -66,7 +66,7 @@ services:
 #### Set `automountServiceAccountToken` to `false` for `default` service accounts
 Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.  
 
-For each namespace the **default** service account must include this value:
+For each namespace including **default** and **kube-system** on a standard RKE install the **default** service account must include this value:
 
 ```
 automountServiceAccountToken: false

From e7528fdb45c86a9c246c25757e8849aac34784ca Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 13 Jul 2020 10:33:12 -0700
Subject: [PATCH 182/265] Create Rancher v2.5 docs

---
 .../en/installation/tutorials/_index.md       |   5 +
 .../tutorials/ha-with-external-db/_index.md   | 118 ++++
 .../infra-for-ha-with-external-db/_index.md   |  71 ++
 content/rancher/v2.5/en/_index.md             |  12 +
 content/rancher/v2.5/en/api/_index.md         |  52 ++
 .../rancher/v2.5/en/api/api-keys/_index.md    |  50 ++
 .../rancher/v2.5/en/api/api-tokens/_index.md  |  29 +
 .../rancher/v2.5/en/applications/_index.md    |  52 ++
 .../en/applications/backup-restore/_index.md  |  10 +
 .../v2.5/en/applications/ecm/_index.md        |  54 ++
 .../applications/ecm/access-control/_index.md |  36 +
 .../access-control/authentication/_index.md   |  98 +++
 .../authentication/ad/_index.md               | 197 ++++++
 .../authentication/azure-ad/_index.md         | 206 ++++++
 .../authentication/freeipa/_index.md          |  54 ++
 .../authentication/github/_index.md           |  51 ++
 .../authentication/google/_index.md           | 107 +++
 .../authentication/keycloak/_index.md         | 120 ++++
 .../authentication/local/_index.md            |  14 +
 .../authentication/microsoft-adfs/_index.md   |  36 +
 .../microsoft-adfs-setup/_index.md            |  82 +++
 .../rancher-adfs-setup/_index.md              |  45 ++
 .../authentication/okta/_index.md             |  53 ++
 .../authentication/openldap/_index.md         |  50 ++
 .../openldap/openldap-config/_index.md        |  86 +++
 .../authentication/ping-federate/_index.md    |  52 ++
 .../authentication/shibboleth/_index.md       | 109 +++
 .../authentication/shibboleth/about/_index.md |  34 +
 .../authentication/user-groups/_index.md      |  64 ++
 .../ecm/access-control/rbac/_index.md         |  28 +
 .../rbac/add-users-to-cluster/_index.md       |  55 ++
 .../rbac/default-custom-roles/_index.md       | 164 +++++
 .../rbac/locked-roles/_index.md               |  37 +
 .../ecm/access-control/rbac/mcm/_index.md     |   7 +
 .../ecm/access-control/rbac/mcm/ace/_index.md |  43 ++
 .../rbac/mcm/cluster-project-roles/_index.md  | 183 +++++
 .../rbac/mcm/custom-global-roles/_index.md    |   6 +
 .../rbac/mcm/global-permissions/_index.md     | 174 +++++
 .../access-control/rbac/mcm/kubectl/_index.md | 103 +++
 .../rbac/mcm/project-members/_index.md        |  50 ++
 .../ecm/backing-up-a-cluster/_index.md        | 141 ++++
 .../ecm/cloning-clusters/_index.md            |  99 +++
 .../ecm/cluster-configuration/_index.md       |  68 ++
 .../ecm/config-private-registry/_index.md     |  43 ++
 .../ecm/disconnecting-nodes/_index.md         | 279 ++++++++
 .../en/applications/ecm/drivers/_index.md     |  44 ++
 .../ecm/drivers/cluster-drivers/_index.md     |  44 ++
 .../ecm/drivers/node-drivers/_index.md        |  37 +
 .../applications/ecm/feature-flags/_index.md  | 156 +++++
 .../_index.md                                 |  43 ++
 .../istio-virtual-service-ui/_index.md        |  34 +
 .../en/applications/ecm/globaldns/_index.md   | 118 ++++
 .../applications/ecm/infrastructure/_index.md |   4 +
 .../cloud-credentials/_index.md               |  49 ++
 .../infrastructure/cloud-providers/_index.md  |  39 ++
 .../cloud-providers/amazon/_index.md          | 150 ++++
 .../cloud-providers/azure/_index.md           |  70 ++
 .../cloud-providers/gce/_index.md             |  54 ++
 .../infrastructure/node-templates/_index.md   |  47 ++
 .../ecm/infrastructure/nodes/_index.md        | 226 ++++++
 .../applications/ecm/k8s-metadata/_index.md   |  89 +++
 .../_index.md                                 |  31 +
 .../ecm/pod-security-policies/_index.md       |  84 +++
 .../ecm/projects-and-namespaces/_index.md     | 198 ++++++
 .../applications/ecm/requirements/_index.md   | 314 +++++++++
 .../ecm/requirements/ports/_index.md          | 186 +++++
 .../ecm/restoring-from-backup/_index.md       | 111 +++
 .../applications/ecm/rke-templates/_index.md  | 125 ++++
 .../applying-templates/_index.md              |  63 ++
 .../creating-and-revising/_index.md           | 162 +++++
 .../creator-permissions/_index.md             |  50 ++
 .../ecm/rke-templates/enforcement/_index.md   |  38 +
 .../rke-templates/example-scenarios/_index.md |  71 ++
 .../ecm/rke-templates/example-yaml/_index.md  | 112 +++
 .../ecm/rke-templates/overrides/_index.md     |  15 +
 .../rke-templates-and-hardware/_index.md      |  70 ++
 .../template-access-and-sharing/_index.md     |  61 ++
 .../applications/ecm/setting-up-k8s/_index.md |  92 +++
 .../cluster-capabilities-table/index.md       |  22 +
 .../hosted-kubernetes-clusters/_index.md      |  32 +
 .../hosted-kubernetes-clusters/ack/_index.md  |  48 ++
 .../hosted-kubernetes-clusters/aks/_index.md  | 142 ++++
 .../hosted-kubernetes-clusters/cce/_index.md  |  82 +++
 .../hosted-kubernetes-clusters/eks/_index.md  | 291 ++++++++
 .../hosted-kubernetes-clusters/gke/_index.md  |  43 ++
 .../hosted-kubernetes-clusters/tke/_index.md  |  77 ++
 .../imported-clusters/_index.md               | 179 +++++
 .../imported-clusters/eks/_index.md           |   4 +
 .../imported-clusters/k3s/_index.md           |   4 +
 .../imported-clusters/rancher-k8s/_index.md   |   4 +
 .../production-checklist/_index.md            |  50 ++
 .../nodes-and-roles/_index.md                 |  43 ++
 .../recommended-architecture/_index.md        |  74 ++
 .../ecm/setting-up-k8s/rke-clusters/_index.md |  34 +
 .../cluster-config-reference/_index.md        | 394 +++++++++++
 .../pod-security-policies/_index.md           |  19 +
 .../rke-clusters/custom-nodes/_index.md       | 113 +++
 .../custom-nodes/agent-options/_index.md      |  57 ++
 .../infrastructure-provider/_index.md         | 133 ++++
 .../infrastructure-provider/azure/_index.md   |  50 ++
 .../digital-ocean/_index.md                   |  45 ++
 .../infrastructure-provider/ec2/_index.md     | 266 +++++++
 .../infrastructure-provider/vsphere/_index.md |  47 ++
 .../provisioning-vsphere-clusters/_index.md   | 319 +++++++++
 .../creating-credentials/_index.md            |  41 ++
 .../enabling-uuids/_index.md                  |  24 +
 .../node-template-reference/_index.md         |  93 +++
 .../rke-clusters/node-requirements/_index.md  | 184 +++++
 .../rke-clusters/rancher-agents/_index.md     |  39 ++
 .../rke-clusters/windows-clusters/_index.md   | 282 ++++++++
 .../docs-for-2.1-and-2.2/_index.md            | 176 +++++
 .../host-gateway-requirements/_index.md       |  37 +
 .../ecm/upgrading-kubernetes/_index.md        | 161 +++++
 .../applications/ecm/upgrading-mcm/_index.md  |   6 +
 .../ecm/upgrading-mcm/rollbacks/_index.md     |   6 +
 .../v2.5/en/applications/istio/_index.md      |  84 +++
 .../istio/disabling-istio/_index.md           |  27 +
 .../v2.5/en/applications/istio/rbac/_index.md |  58 ++
 .../istio/release-notes/_index.md             |  19 +
 .../en/applications/istio/resources/_index.md | 152 ++++
 .../en/applications/istio/setup/_index.md     |  28 +
 .../istio/setup/deploy-workloads/_index.md    | 322 +++++++++
 .../setup/enable-istio-in-cluster/_index.md   |  24 +
 .../enable-istio-with-psp/_index.md           |  48 ++
 .../setup/enable-istio-in-namespace/_index.md |  48 ++
 .../istio/setup/gateway/_index.md             | 130 ++++
 .../istio/setup/node-selectors/_index.md      |  38 +
 .../setup/set-up-traffic-management/_index.md |  61 ++
 .../istio/setup/view-traffic/_index.md        |  26 +
 .../v2.5/en/applications/logging/_index.md    | 120 ++++
 .../logging/elasticsearch/_index.md           |  43 ++
 .../en/applications/logging/fluentd/_index.md |  34 +
 .../en/applications/logging/kafka/_index.md   |  43 ++
 .../en/applications/logging/splunk/_index.md  |  76 ++
 .../en/applications/logging/syslog/_index.md  |  43 ++
 .../applications/longhorn-storage/_index.md   |   6 +
 .../managing-applications/_index.md           | 101 +++
 .../creating-apps/_index.md                   | 125 ++++
 .../creating-custom-libraries/_index.md       | 105 +++
 .../enabling-builtin-libraries/_index.md      |  25 +
 .../launching-apps/_index.md                  | 104 +++
 .../library-config/_index.md                  |  73 ++
 .../managing-apps/_index.md                   |  82 +++
 .../multi-cluster-apps/_index.md              | 162 +++++
 .../managing-applications/tutorial/_index.md  |  72 ++
 .../v2.5/en/applications/monitoring/_index.md | 103 +++
 .../applications/monitoring/alerts/_index.md  | 243 +++++++
 .../alerts/default-alerts/_index.md           |  57 ++
 .../monitoring/cluster-metrics/_index.md      | 113 +++
 .../monitoring/custom-metrics/_index.md       | 489 +++++++++++++
 .../monitoring/expression/_index.md           | 430 ++++++++++++
 .../monitoring/prometheus/_index.md           |  63 ++
 .../monitoring/viewing-metrics/_index.md      |  60 ++
 .../v2.5/en/applications/notifiers/_index.md  | 132 ++++
 .../en/applications/opa-gatekeper/_index.md   |  96 +++
 .../v2.5/en/backup-application/_index.md      |  21 +
 .../en/backup-application/docker/_index.md    |   6 +
 .../docker/docker-backups/_index.md           |  69 ++
 .../docker/docker-restore/_index.md           |  68 ++
 .../special-scenarios/_index.md               |  74 ++
 .../rancher/v2.5/en/best-practices/_index.md  |  23 +
 .../v2.5/en/best-practices/mcm/_index.md      |   6 +
 .../architecture-recommendations/_index.md    | 119 ++++
 .../best-practices/mcm/containers/_index.md   |  49 ++
 .../mcm/deployment-strategies/_index.md       |  45 ++
 .../mcm/deployment-types/_index.md            |  38 +
 .../best-practices/mcm/management/_index.md   | 132 ++++
 .../best-practices/rancher-server/_index.md   |   6 +
 content/rancher/v2.5/en/cli/_index.md         |  80 +++
 .../v2.5/en/cli/backups-etcd/_index.md        |   8 +
 .../v2.5/en/cli/disaster-recovery/_index.md   |   8 +
 .../rancher/v2.5/en/cli/rancher-k8s/_index.md |  16 +
 .../v2.5/en/cluster-explorer/_index.md        | 113 +++
 .../certificate-rotation/_index.md            |  87 +++
 .../cluster-explorer/certificates/_index.md   |  43 ++
 .../cluster-autoscaler/_index.md              |  25 +
 .../cluster-autoscaler/amazon/_index.md       | 580 +++++++++++++++
 .../en/cluster-explorer/configmaps/_index.md  |  42 ++
 .../load-balancers-and-ingress/_index.md      |  61 ++
 .../ingress/_index.md                         |  80 +++
 .../load-balancers/_index.md                  |  74 ++
 .../en/cluster-explorer/pipelines/_index.md   | 277 ++++++++
 .../pipelines/concepts/_index.md              |  36 +
 .../pipelines/config/_index.md                | 658 ++++++++++++++++++
 .../pipelines/docs-for-v2.0.x/_index.md       | 126 ++++
 .../pipelines/example-repos/_index.md         |  76 ++
 .../pipelines/example/_index.md               |  74 ++
 .../pipelines/storage/_index.md               | 103 +++
 .../pod-security-policy/_index.md             |  30 +
 .../cluster-explorer/project-admin/_index.md  |  41 ++
 .../project-admin/namespaces/_index.md        |  68 ++
 .../project-admin/project-features/_index.md  |  43 ++
 .../project-features/alerts/_index.md         | 185 +++++
 .../project-features/istio/_index.md          |  21 +
 .../project-features/logging/_index.md        | 108 +++
 .../project-features/monitoring/_index.md     |  81 +++
 .../project-admin/resource-quotas/_index.md   |  44 ++
 .../override-container-default/_index.md      |  43 ++
 .../override-namespace-default/_index.md      |  34 +
 .../quota-type-reference/_index.md            |  24 +
 .../quotas-for-projects/_index.md             |  41 ++
 .../en/cluster-explorer/registries/_index.md  | 116 +++
 .../en/cluster-explorer/secrets/_index.md     |  44 ++
 .../service-discovery/_index.md               |  50 ++
 .../en/cluster-explorer/storage/_index.md     |  58 ++
 .../attaching-existing-storage/_index.md      | 102 +++
 .../storage/examples/_index.md                |  11 +
 .../storage/examples/ebs/_index.md            |  16 +
 .../storage/examples/nfs/_index.md            |  68 ++
 .../storage/examples/vsphere/_index.md        |  70 ++
 .../storage/glusterfs-volumes/_index.md       |  32 +
 .../storage/how-storage-works/_index.md       |  76 ++
 .../storage/iscsi-volumes/_index.md           |  30 +
 .../provisioning-new-storage/_index.md        | 109 +++
 .../en/cluster-explorer/workloads/_index.md   |  79 +++
 .../workloads/add-a-sidecar/_index.md         |  35 +
 .../workloads/deploy-workloads/_index.md      |  57 ++
 .../horitzontal-pod-autoscaler/_index.md      |  35 +
 .../hpa-background/_index.md                  |  40 ++
 .../manage-hpa-with-kubectl/_index.md         | 200 ++++++
 .../manage-hpa-with-rancher-ui/_index.md      |  55 ++
 .../testing-hpa/_index.md                     | 491 +++++++++++++
 .../workloads/rollback-workloads/_index.md    |  14 +
 .../workloads/upgrade-workloads/_index.md     |  21 +
 .../rancher/v2.5/en/contributing/_index.md    | 120 ++++
 .../v2.5/en/disaster-recovery/_index.md       |  12 +
 content/rancher/v2.5/en/faq/_index.md         |  72 ++
 content/rancher/v2.5/en/faq/kubectl/_index.md |  30 +
 .../v2.5/en/faq/mcm/networking/_index.md      |   9 +
 .../mcm/networking/cni-providers/_index.md    | 154 ++++
 .../en/faq/mcm/removing-rancher/_index.md     |  57 ++
 .../v2.5/en/faq/mcm/technical/_index.md       | 189 +++++
 .../rancher/v2.5/en/faq/security/_index.md    |  15 +
 .../rancher/v2.5/en/faq/telemetry/_index.md   |  32 +
 content/rancher/v2.5/en/overview/_index.md    |  66 ++
 .../v2.5/en/overview/architecture/_index.md   | 203 ++++++
 .../v2.5/en/overview/concepts/_index.md       |  72 ++
 .../en/rancher-cli-install-upgrade/_index.md  |  13 +
 .../installation/_index.md                    |  10 +
 .../upgrade/_index.md                         |  28 +
 .../upgrade/cluster-upgrade/_index.md         |   8 +
 .../woker-node-upgrade/_index.md              |   8 +
 .../upgrade/image-upgrade/_index.md           |   6 +
 .../en/rancher-helm-install-upgrade/_index.md |  16 +
 .../installation/_index.md                    | 274 ++++++++
 .../installation/chart-options/_index.md      | 261 +++++++
 .../installation/choosing-version/_index.md   |  91 +++
 .../installation/helm-version/_index.md       |  12 +
 .../installation/resources/_index.md          |  30 +
 .../installation/resources/advanced/_index.md |   6 +
 .../advanced/api-audit-log/_index.md          | 577 +++++++++++++++
 .../advanced/arm64-platform/_index.md         |  27 +
 .../resources/advanced/etcd/_index.md         |  40 ++
 .../resources/advanced/firewall/_index.md     | 106 +++
 .../installation/resources/air-gap/_index.md  |  24 +
 .../air-gap/install-rancher/_index.md         | 343 +++++++++
 .../air-gap/local-system-charts/_index.md     |  65 ++
 .../populate-private-registry/_index.md       | 277 ++++++++
 .../air-gap/prepare-registry/_index.md        |  25 +
 .../resources/encryption/_index.md            |   6 +
 .../custom-ca-root-certificate/_index.md      |  25 +
 .../encryption/tls-secrets/_index.md          |  36 +
 .../encryption/tls-settings/_index.md         |  34 +
 .../upgrading-cert-manager/_index.md          | 234 +++++++
 .../resources/k8s-tutorials/_index.md         |   6 +
 .../resources/k8s-tutorials/ha-RKE/_index.md  | 170 +++++
 .../resources/k8s-tutorials/ha-RKE2/_index.md |   7 +
 .../k8s-tutorials/how-ha-works/_index.md      |  25 +
 .../infrastructure-tutorials/_index.md        |  15 +
 .../ec2-node/_index.md                        |  64 ++
 .../infrastructure-tutorials/nginx/_index.md  |  84 +++
 .../infrastructure-tutorials/nlb/_index.md    | 179 +++++
 .../infrastructure-tutorials/rds/_index.md    |  34 +
 .../resources/single-node-docker/_index.md    | 150 ++++
 .../single-node-docker/advanced/_index.md     |  93 +++
 .../installing-docker/_index.md               |  18 +
 .../single-node-docker/proxy/_index.md        |  36 +
 .../single-node-install-external-lb/_index.md | 240 +++++++
 .../upgrade/_index.md                         | 222 ++++++
 .../upgrade/rollbacks/_index.md               |  12 +
 content/rancher/v2.5/en/security/_index.md    | 103 +++
 .../rancher/v2.5/en/security/cve/_index.md    |  17 +
 .../v2.5/en/security/security-scan/_index.md  | 254 +++++++
 .../rancher/v2.5/en/system-tools/_index.md    | 116 +++
 .../rancher/v2.5/en/troubleshooting/_index.md |  42 ++
 .../v2.5/en/troubleshooting/docker/_index.md  |   6 +
 .../v2.5/en/troubleshooting/mcm/_index.md     | 187 +++++
 .../v2.5/en/troubleshooting/mcm/dns/_index.md | 217 ++++++
 .../mcm/imported-clusters/_index.md           |  62 ++
 .../en/troubleshooting/mcm/logging/_index.md  |  48 ++
 .../troubleshooting/mcm/networking/_index.md  | 118 ++++
 .../v2.5/en/troubleshooting/rke/_index.md     |  18 +
 .../rke/controlplane/_index.md                |  40 ++
 .../en/troubleshooting/rke/etcd/_index.md     | 365 ++++++++++
 .../rke/kubernetes-resources/_index.md        | 271 ++++++++
 .../troubleshooting/rke/nginx-proxy/_index.md |  69 ++
 .../troubleshooting/rke/rancher_rke/_index.md |  80 +++
 .../rke/worker-and-generic/_index.md          |  35 +
 .../v2.5/en/user-preferences/_index.md        |  34 +
 content/rancher/v2.x/_index.md                |   2 +-
 content/rancher/v2.x/en/_index.md             |  11 +-
 content/rke/latest/en/tutorials/_index.md     |   4 +
 .../en/tutorials/infra-for-ha/_index.md       |  62 ++
 303 files changed, 27019 insertions(+), 5 deletions(-)
 create mode 100644 content/k3s/latest/en/installation/tutorials/_index.md
 create mode 100644 content/k3s/latest/en/installation/tutorials/ha-with-external-db/_index.md
 create mode 100644 content/k3s/latest/en/installation/tutorials/infra-for-ha-with-external-db/_index.md
 create mode 100644 content/rancher/v2.5/en/_index.md
 create mode 100644 content/rancher/v2.5/en/api/_index.md
 create mode 100644 content/rancher/v2.5/en/api/api-keys/_index.md
 create mode 100644 content/rancher/v2.5/en/api/api-tokens/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/backup-restore/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/ad/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/azure-ad/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/freeipa/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/github/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/google/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/keycloak/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/local/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/okta/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/openldap-config/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/ping-federate/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/about/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/authentication/user-groups/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/add-users-to-cluster/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/default-custom-roles/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/locked-roles/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/ace/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/global-permissions/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/kubectl/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/project-members/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/backing-up-a-cluster/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/cloning-clusters/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/cluster-configuration/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/config-private-registry/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/disconnecting-nodes/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/drivers/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/drivers/cluster-drivers/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/drivers/node-drivers/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/feature-flags/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/feature-flags/istio-virtual-service-ui/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/globaldns/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-credentials/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/amazon/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/azure/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/gce/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/node-templates/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/infrastructure/nodes/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/k8s-metadata/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/pod-security-policies-in-projects/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/pod-security-policies/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/projects-and-namespaces/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/requirements/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/requirements/ports/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/restoring-from-backup/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/applying-templates/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/creating-and-revising/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/creator-permissions/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/enforcement/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/example-scenarios/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/example-yaml/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/overrides/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/rke-templates-and-hardware/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/rke-templates/template-access-and-sharing/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/cluster-capabilities-table/index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/eks/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/upgrading-kubernetes/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/upgrading-mcm/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/ecm/upgrading-mcm/rollbacks/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/disabling-istio/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/rbac/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/release-notes/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/resources/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/deploy-workloads/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-namespace/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/gateway/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/node-selectors/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/set-up-traffic-management/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/istio/setup/view-traffic/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/logging/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/logging/elasticsearch/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/logging/fluentd/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/logging/kafka/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/logging/splunk/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/logging/syslog/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/longhorn-storage/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/creating-apps/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/creating-custom-libraries/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/enabling-builtin-libraries/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/launching-apps/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/library-config/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/managing-apps/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/multi-cluster-apps/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/managing-applications/tutorial/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/alerts/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/alerts/default-alerts/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/cluster-metrics/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/custom-metrics/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/expression/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/prometheus/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/monitoring/viewing-metrics/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/notifiers/_index.md
 create mode 100644 content/rancher/v2.5/en/applications/opa-gatekeper/_index.md
 create mode 100644 content/rancher/v2.5/en/backup-application/_index.md
 create mode 100644 content/rancher/v2.5/en/backup-application/docker/_index.md
 create mode 100644 content/rancher/v2.5/en/backup-application/docker/docker-backups/_index.md
 create mode 100644 content/rancher/v2.5/en/backup-application/docker/docker-restore/_index.md
 create mode 100644 content/rancher/v2.5/en/backup-application/special-scenarios/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/mcm/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/mcm/architecture-recommendations/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/mcm/containers/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/mcm/deployment-strategies/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/mcm/deployment-types/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/mcm/management/_index.md
 create mode 100644 content/rancher/v2.5/en/best-practices/rancher-server/_index.md
 create mode 100644 content/rancher/v2.5/en/cli/_index.md
 create mode 100644 content/rancher/v2.5/en/cli/backups-etcd/_index.md
 create mode 100644 content/rancher/v2.5/en/cli/disaster-recovery/_index.md
 create mode 100644 content/rancher/v2.5/en/cli/rancher-k8s/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/certificates/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/registries/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/secrets/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md
 create mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md
 create mode 100644 content/rancher/v2.5/en/contributing/_index.md
 create mode 100644 content/rancher/v2.5/en/disaster-recovery/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/kubectl/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/mcm/networking/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/mcm/technical/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/security/_index.md
 create mode 100644 content/rancher/v2.5/en/faq/telemetry/_index.md
 create mode 100644 content/rancher/v2.5/en/overview/_index.md
 create mode 100644 content/rancher/v2.5/en/overview/architecture/_index.md
 create mode 100644 content/rancher/v2.5/en/overview/concepts/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-cli-install-upgrade/installation/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/image-upgrade/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/chart-options/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/choosing-version/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/helm-version/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/api-audit-log/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/arm64-platform/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/etcd/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/firewall/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/install-rancher/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/local-system-charts/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/populate-private-registry/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/prepare-registry/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/custom-ca-root-certificate/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-secrets/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-settings/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/upgrading-cert-manager/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE2/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/how-ha-works/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/advanced/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/installing-docker/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/proxy/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/single-node-install-external-lb/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/_index.md
 create mode 100644 content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/rollbacks/_index.md
 create mode 100644 content/rancher/v2.5/en/security/_index.md
 create mode 100644 content/rancher/v2.5/en/security/cve/_index.md
 create mode 100644 content/rancher/v2.5/en/security/security-scan/_index.md
 create mode 100644 content/rancher/v2.5/en/system-tools/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/docker/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/rke/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md
 create mode 100644 content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md
 create mode 100644 content/rancher/v2.5/en/user-preferences/_index.md
 create mode 100644 content/rke/latest/en/tutorials/_index.md
 create mode 100644 content/rke/latest/en/tutorials/infra-for-ha/_index.md

diff --git a/content/k3s/latest/en/installation/tutorials/_index.md b/content/k3s/latest/en/installation/tutorials/_index.md
new file mode 100644
index 00000000000..40de388bc75
--- /dev/null
+++ b/content/k3s/latest/en/installation/tutorials/_index.md
@@ -0,0 +1,5 @@
+---
+title: Tutorials
+weight: 10000
+---
+
diff --git a/content/k3s/latest/en/installation/tutorials/ha-with-external-db/_index.md b/content/k3s/latest/en/installation/tutorials/ha-with-external-db/_index.md
new file mode 100644
index 00000000000..db2ce0b3c70
--- /dev/null
+++ b/content/k3s/latest/en/installation/tutorials/ha-with-external-db/_index.md
@@ -0,0 +1,118 @@
+---
+title: Setting up a High-availability K3s Kubernetes Cluster for Rancher
+shortTitle: Set up K3s for Rancher
+weight: 2
+---
+
+> This page is under construction.
+
+This section describes how to install a Kubernetes cluster according to the [best practices for the Rancher server environment.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#environment-for-kubernetes-installations)
+
+For systems without direct internet access, refer to the air gap installation instructions.
+
+> **Single-node Installation Tip:**
+> In a single-node Kubernetes cluster, the Rancher server does not have high availability, which is important for running Rancher in production. However, installing Rancher on a single-node cluster can be useful if you want to save resources by using a single node in the short term, while preserving a high-availability migration path.
+>
+> To set up a single-node K3s cluster, run the Rancher server installation command on just one node instead of two nodes.
+>
+> In both single-node setups, Rancher can be installed with Helm on the Kubernetes cluster in the same way that it would be installed on any other cluster.
+
+# Prerequisites
+
+These instructions assume you have set up two nodes, a load balancer, a DNS record, and an external MySQL database as described in [this section.](../infra-for-ha-with-external-db)
+
+# Installing Kubernetes
+
+### 1. Install Kubernetes and Set up the K3s Server
+
+When running the command to start the K3s Kubernetes API server, you will pass in an option to use the external datastore that you set up earlier.
+
+1. Connect to one of the Linux nodes that you have prepared to run the Rancher server.
+1. On the Linux node, run this command to start the K3s server and connect it to the external datastore:
+  ```
+  curl -sfL https://get.k3s.io | sh -s - server \
+    --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"
+  ```
+  Note: The datastore endpoint can also be passed in using the environment variable `$K3S_DATASTORE_ENDPOINT`.
+
+1. Repeat the same command on your second K3s server node.
+
+### 2. Confirm that K3s is Running
+
+To confirm that K3s has been set up successfully, run the following command on either of the K3s server nodes:
+```
+sudo k3s kubectl get nodes
+```
+
+Then you should see two nodes with the master role:
+```
+ubuntu@ip-172-31-60-194:~$ sudo k3s kubectl get nodes
+NAME               STATUS   ROLES    AGE    VERSION
+ip-172-31-60-194   Ready    master   44m    v1.17.2+k3s1
+ip-172-31-63-88    Ready    master   6m8s   v1.17.2+k3s1  
+```
+
+Then test the health of the cluster pods:
+```
+sudo k3s kubectl get pods --all-namespaces
+```
+
+**Result:** You have successfully set up a K3s Kubernetes cluster.
+
+### 3. Save and Start Using the kubeconfig File
+
+When you installed K3s on each Rancher server node, a `kubeconfig` file was created on the node at `/etc/rancher/k3s/k3s.yaml`. This file contains credentials for full access to the cluster, and you should save this file in a secure location.
+
+To use this `kubeconfig` file, 
+
+1. Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool.
+2. Copy the file at `/etc/rancher/k3s/k3s.yaml` and save it to the directory `~/.kube/config` on your local machine.
+3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your load balancer, referring to port 6443. (The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443.) Here is an example `k3s.yaml`:
+
+```yml
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: [CERTIFICATE-DATA]
+    server: [LOAD-BALANCER-DNS]:6443 # Edit this line
+  name: default
+contexts:
+- context:
+    cluster: default
+    user: default
+  name: default
+current-context: default
+kind: Config
+preferences: {}
+users:
+- name: default
+  user:
+    password: [PASSWORD]
+    username: admin
+```
+
+**Result:** You can now use `kubectl` to manage your K3s cluster. If you have more than one kubeconfig file, you can specify which one you want to use by passing in the path to the file when using `kubectl`:
+
+```
+kubectl --kubeconfig ~/.kube/config/k3s.yaml get pods --all-namespaces
+```
+
+For more information about the `kubeconfig` file, refer to the [K3s documentation]({{<baseurl>}}/k3s/latest/en/cluster-access/) or the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) about organizing cluster access using `kubeconfig` files.
+
+### 4. Check the Health of Your Cluster Pods
+
+Now that you have set up the `kubeconfig` file, you can use `kubectl` to access the cluster from your local machine.
+
+Check that all the required pods and containers are healthy are ready to continue:
+
+```
+ubuntu@ip-172-31-60-194:~$ sudo kubectl get pods --all-namespaces
+NAMESPACE       NAME                                      READY   STATUS    RESTARTS   AGE
+kube-system     metrics-server-6d684c7b5-bw59k            1/1     Running   0          8d
+kube-system     local-path-provisioner-58fb86bdfd-fmkvd   1/1     Running   0          8d
+kube-system     coredns-d798c9dd-ljjnf                    1/1     Running   0          8d
+```
+
+**Result:** You have confirmed that you can access the cluster with `kubectl` and the K3s cluster is running successfully. Now the Rancher management server can be installed on the cluster.
+
+### [Next: Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/)
diff --git a/content/k3s/latest/en/installation/tutorials/infra-for-ha-with-external-db/_index.md b/content/k3s/latest/en/installation/tutorials/infra-for-ha-with-external-db/_index.md
new file mode 100644
index 00000000000..c27039ad429
--- /dev/null
+++ b/content/k3s/latest/en/installation/tutorials/infra-for-ha-with-external-db/_index.md
@@ -0,0 +1,71 @@
+---
+title: 'Set up Infrastructure for a High Availability K3s Kubernetes Cluster'
+weight: 1
+---
+
+> This page is under construction.
+
+In this section, you will provision the underlying infrastructure for your Rancher management server.
+
+The recommended infrastructure for the Rancher-only Kubernetes cluster differs depending on whether Rancher will be installed on a K3s Kubernetes cluster, an RKE Kubernetes cluster, or a single Docker container.
+
+For more information about each installation option, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation)
+
+> **Note:** These nodes must be in the same region. You may place these servers in separate availability zones (datacenter).
+
+To install the Rancher management server on a high-availability K3s cluster, we recommend setting up the following infrastructure:
+
+- **Two Linux nodes,** typically virtual machines, in the infrastructure provider of your choice.
+- **An external database** to store the cluster data. We recommend MySQL.
+- **A load balancer** to direct traffic to the two nodes.
+- **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it.
+
+### 1. Set up Linux Nodes
+
+Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+
+For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2.
+
+### 2. Set up External Datastore
+
+The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available options allow you to select a datastore that best fits your use case.
+
+For a high-availability K3s installation, you will need to set a [MySQL](https://www.mysql.com/) external database. Rancher has been tested on K3s Kubernetes clusters using MySQL version 5.7 as the datastore.
+
+When you install Kubernetes using the K3s installation script, you will pass in details for K3s to connect to the database.
+
+For an example of one way to set up the MySQL database, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/rds/) for setting up MySQL on Amazon's RDS service.
+
+For the complete list of options that are available for configuring a K3s cluster datastore, refer to the [K3s documentation.]({{<baseurl>}}/k3s/latest/en/installation/datastore/)
+
+### 3. Set up the Load Balancer
+
+You will also need to set up a load balancer to direct traffic to the Rancher replica on both nodes. That will prevent an outage of any single node from taking down communications to the Rancher management server.
+
+When Kubernetes gets set up in a later step, the K3s tool will deploy a Traefik Ingress controller. This controller will listen on ports 80 and 443 of the worker nodes, answering traffic destined for specific hostnames.
+
+When Rancher is installed (also in a later step), the Rancher system creates an Ingress resource. That Ingress tells the Traefik Ingress controller to listen for traffic destined for the Rancher hostname. The Traefik Ingress controller, when receiving traffic destined for the Rancher hostname, will forward that traffic to the running Rancher pods in the cluster.
+
+For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer:
+
+- **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment.
+- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
+
+For an example showing how to set up an NGINX load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nginx/)
+
+For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nlb/)
+
+> **Important:**
+> Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications.
+
+### 4. Set up the DNS Record
+
+Once you have set up your load balancer, you will need to create a DNS record to send traffic to this load balancer.
+
+Depending on your environment, this may be an A record pointing to the load balancer IP, or it may be a CNAME pointing to the load balancer hostname. In either case, make sure this record is the hostname that you intend Rancher to respond on.
+
+You will need to specify this hostname in a later step when you install Rancher, and it is not possible to change it later. Make sure that your decision is a final one.
+
+For a how-to guide for setting up a DNS record to route domain traffic to an Amazon ELB load balancer, refer to the [official AWS documentation.](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer)
+
+### [Next: Set up a Kubernetes Cluster]({{<baseurl>}}/rancher/v2.x/en/installation/resources/k8s-tutorials/ka-k3s/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/_index.md b/content/rancher/v2.5/en/_index.md
new file mode 100644
index 00000000000..84944368e11
--- /dev/null
+++ b/content/rancher/v2.5/en/_index.md
@@ -0,0 +1,12 @@
+---
+title: "Rancher 2.5"
+shortTitle: "Rancher 2.5"
+description: "Rancher adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
+metaTitle: "Rancher 2.5 Docs: What is New?"
+metaDescription: "Rancher 2 adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
+insertOneSix: false
+weight: 1
+ctaBanner: 0
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/api/_index.md b/content/rancher/v2.5/en/api/_index.md
new file mode 100644
index 00000000000..b2f9e84816d
--- /dev/null
+++ b/content/rancher/v2.5/en/api/_index.md
@@ -0,0 +1,52 @@
+---
+title: API
+weight: 7500
+---
+
+## How to use the API
+
+The API has its own user interface accessible from a web browser.  This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response.  To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint as well as create [API keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/).
+
+## Authentication
+
+API requests must include authentication information.  Authentication is done with HTTP basic authentication using [API Keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/). API keys can create new clusters and have access to multiple clusters via `/v3/clusters/`. [Cluster and project roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/) apply to these keys and restrict what clusters and projects the account can see and what actions they can take.
+
+By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. For details on how to invalidate them, refer to the [API tokens page]({{<baseurl>}}/rancher/v2.x/en/api/api-tokens).
+
+## Making requests
+
+The API is generally RESTful but has several features to make the definition of everything discoverable by a client so that generic clients can be written instead of having to write specific code for every type of resource.  For detailed info about the generic API spec, [see here](https://github.com/rancher/api-spec/blob/master/specification.md).
+
+- Every type has a Schema which describes:
+  - The URL to get to the collection of this type of resources
+  - Every field the resource can have, along with their type, basic validation rules, whether they are required or optional, etc.
+  - Every action that is possible on this type of resource, with their inputs and outputs (also as schemas).
+  - Every field that filtering is allowed on
+  - What HTTP verb methods are available for the collection itself, or for individual resources in the collection.
+
+
+- So the theory is that you can load just the list of schemas and know everything about the API.  This is in fact how the UI for the API works, it contains no code specific to Rancher itself.  The URL to get Schemas is sent in every HTTP response as a `X-Api-Schemas` header.  From there you can follow the `collection` link on each schema to know where to list resources, and other `links` inside of the returned resources to get any other information.
+
+- In practice, you will probably just want to construct URL strings.  We highly suggest limiting this to the top-level to list a collection (`/v3/<type>`) or get a specific resource (`/v3/<type>/<id>`).  Anything deeper than that is subject to change in future releases.
+
+- Resources have relationships between each other called links.  Each resource includes a map of `links` with the name of the link and the URL to retrieve that information.  Again you should `GET` the resource and then follow the URL in the `links` map, not construct these strings yourself.
+
+- Most resources have actions, which do something or change the state of the resource.  To use these, send a HTTP `POST` to the URL in the `actions` map for the action you want.  Some actions require input or produce output, see the individual documentation for each type or the schemas for specific information.
+
+- To edit a resource, send a HTTP `PUT` to the `links.update` link on the resource with the fields that you want to change.  If the link is missing then you don't have permission to update the resource. Unknown fields and ones that are not editable are ignored.
+
+- To delete a resource, send a HTTP `DELETE` to the `links.remove` link on the resource.  If the link is missing then you don't have permission to update the resource.
+
+- To create a new resource, HTTP `POST` to the collection URL in the schema (which is `/v3/<type>`).
+
+## Filtering
+
+Most collections can be filtered on the server-side by common fields using HTTP query parameters.  The `filters` map shows you what fields can be filtered on and what the filtered values were for the request you made.  The API UI has controls to setup filtering and show you the appropriate request.  For simple "equals" matches it's just `field=value`.  Modifiers can be added to the field name, e.g. `field_gt=42` for "field is greater than 42".  See the [API spec](https://github.com/rancher/api-spec/blob/master/specification.md#filtering) for full details.
+
+## Sorting
+
+Most collections can be sorted on the server-side by common fields using HTTP query parameters.  The `sortLinks` map shows you what sorts are available, along with the URL to get the collection sorted by that.  It also includes info about what the current response was sorted by, if specified.
+
+## Pagination
+
+API responses are paginated with a limit of 100 resources per page by default.  This can be changed with the `limit` query parameter, up to a maximum of 1000, e.g. `/v3/pods?limit=1000`.  The `pagination` map in collection responses tells you whether or not you have the full result set and has a link to the next page if you do not.
diff --git a/content/rancher/v2.5/en/api/api-keys/_index.md b/content/rancher/v2.5/en/api/api-keys/_index.md
new file mode 100644
index 00000000000..1075ef67e6f
--- /dev/null
+++ b/content/rancher/v2.5/en/api/api-keys/_index.md
@@ -0,0 +1,50 @@
+---
+title: API Keys
+weight: 3
+---
+
+If you want to access your Rancher clusters, projects, or other objects using external applications, you can do so using the Rancher API. However, before your application can access the API, you must provide the app with a key used to authenticate with Rancher. You can obtain a key using the Rancher UI.
+
+An API key is also required for using Rancher CLI.
+
+API Keys are composed of four components:
+
+- **Endpoint:** This is the IP address and path that other applications use to send requests to the Rancher API.
+- **Access Key:** The token's username.
+- **Secret Key:** The token's password. For applications that prompt you for two different strings for API authentication, you usually enter the two keys together.
+- **Bearer Token:** The token username and password concatenated together. Use this string for applications that prompt you for one authentication string.
+
+## Creating an API Key
+
+1. Select **User Avatar** > **API & Keys** from the **User Settings** menu in the upper-right.
+
+2. Click **Add Key**.
+
+3. **Optional:** Enter a description for the API key and select an expiration period or a scope. We recommend setting an expiration date.
+
+    The API key won't be valid after expiration. Shorter expiration periods are more secure.
+    
+    A scope will limit the API key so that it will only work against the Kubernetes API of the specified cluster. If the cluster is configured with an Authorized Cluster Endpoint, you will be able to use a scoped token directly against the cluster's API without proxying through the Rancher server. See [Authorized Cluster Endpoints]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) for more information.
+
+4. Click **Create**.
+
+    **Step Result:** Your API Key is created. Your API **Endpoint**, **Access Key**, **Secret Key**, and **Bearer Token** are displayed.
+
+    Use the **Bearer Token** to authenticate with Rancher CLI.
+
+5. Copy the information displayed to a secure location. This information is only displayed once, so if you lose your key, you'll have to make a new one.
+
+## What's Next?
+
+- Enter your API key information into the application that will send requests to the Rancher API.
+- Learn more about the Rancher endpoints and parameters by selecting **View in API** for an object in the Rancher UI.
+- API keys are used for API calls and [Rancher CLI]({{<baseurl>}}/rancher/v2.x/en/cli).
+
+## Deleting API Keys
+
+If you need to revoke an API key, delete it. You should delete API keys:
+
+- That may have been compromised.
+- That have expired.
+
+To delete an API, select the stale key and click **Delete**.
diff --git a/content/rancher/v2.5/en/api/api-tokens/_index.md b/content/rancher/v2.5/en/api/api-tokens/_index.md
new file mode 100644
index 00000000000..eb823bb7cea
--- /dev/null
+++ b/content/rancher/v2.5/en/api/api-tokens/_index.md
@@ -0,0 +1,29 @@
+---
+title: API Tokens
+weight: 1
+---
+
+By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password.
+
+You can deactivate API tokens by deleting them or by deactivating the user account.
+
+To delete a token,
+
+1. Go to the list of all tokens in the Rancher API view at `https://<Rancher-Server-IP>/v3/tokens`.
+
+1. Access the token you want to delete by its ID. For example, `https://<Rancher-Server-IP>/v3/tokens/kubectl-shell-user-vqkqt`
+
+1. Click **Delete.**
+
+Here is the complete list of tokens that are generated with `ttl=0`:
+
+| Token | Description |
+|-------|-------------|
+| `kubeconfig-*` | Kubeconfig token |
+| `kubectl-shell-*` | Access to `kubectl` shell in the browser |
+| `agent-*` | Token for agent deployment |
+| `compose-token-*` | Token for compose |
+| `helm-token-*` | Token for Helm chart deployment |
+| `*-pipeline*` | Pipeline token for project |
+| `telemetry-*` | Telemetry token |
+| `drain-node-*` | Token for drain (we use `kubectl` for drain because there is no native Kubernetes API) |
diff --git a/content/rancher/v2.5/en/applications/_index.md b/content/rancher/v2.5/en/applications/_index.md
new file mode 100644
index 00000000000..8338db51a64
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/_index.md
@@ -0,0 +1,52 @@
+---
+title: Applications
+weight: 3000
+---
+
+Rancher contains a variety of tools that aren't included in Kubernetes to assist in your DevOps operations. Rancher can integrate with external services to help your clusters run more efficiently. Tools are divided into following categories:
+
+<!-- TOC -->
+
+- [Notifiers and Alerts](#notifiers-and-alerts)
+- [Logging](#logging)
+- [Monitoring](#monitoring)
+- [Istio](#istio)
+- [OPA Gatekeeper](#opa-gatekeeper)
+
+<!-- /TOC -->
+
+## Notifiers and Alerts
+
+Notifiers and alerts are two features that work together to inform you of events in the Rancher system.
+
+[Notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action. Notifications can be sent with Slack, email, PagerDuty, WeChat, and webhooks.
+
+[Alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts) are rules that trigger those notifications. Before you can receive alerts, you must configure one or more notifier in Rancher. The scope for alerts can be set at either the cluster or project level.
+
+## Logging
+
+Logging is helpful because it allows you to:
+
+- Capture and analyze the state of your cluster
+- Look for trends in your environment
+- Save your logs to a safe location outside of your cluster
+- Stay informed of events like a container crashing, a pod eviction, or a node dying
+- More easily debugg and troubleshoot problems
+
+Rancher can integrate with Elasticsearch, splunk, kafka, syslog, and fluentd.
+
+For details, refer to the [logging section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging)
+
+## Monitoring
+
+_Available as of v2.2.0_
+
+Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring)
+
+## Istio
+
+ [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices. For details on how to enable Istio in Rancher, refer to the [Istio section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio)
+
+## OPA Gatekeeper
+
+ [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/opa-gatekeeper)
diff --git a/content/rancher/v2.5/en/applications/backup-restore/_index.md b/content/rancher/v2.5/en/applications/backup-restore/_index.md
new file mode 100644
index 00000000000..954dfb2947e
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/backup-restore/_index.md
@@ -0,0 +1,10 @@
+---
+title: Back up and Restore Applications
+weight: 2
+---
+
+> This page is under construction.
+
+In this section, you'll learn how to create additional backup templates for the backup/restore application so that any Kubernetes application can be backed up and restored.
+
+For information about how to backup and restore Rancher, refer to [this section.](../../backup-restore)
diff --git a/content/rancher/v2.5/en/applications/ecm/_index.md b/content/rancher/v2.5/en/applications/ecm/_index.md
new file mode 100644
index 00000000000..8c8ef5c7329
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/_index.md
@@ -0,0 +1,54 @@
+---
+title: Enterprise Cluster Manager
+weight: 2
+---
+
+After installation, the [system administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) should configure Rancher to configure authentication, authorization, security, default settings, security policies, drivers and global DNS entries.
+
+## First Log In
+
+After you log into Rancher for the first time, Rancher will prompt you for a **Rancher Server URL**.You should set the URL to the main entry point to the Rancher Server. When a load balancer sits in front a Rancher Server cluster, the URL should resolve to the load balancer. The system will automatically try to infer the Rancher Server URL from the IP address or host name of the host running the Rancher Server. This is only correct if you are running a single node Rancher Server installation. In most cases, therefore, you need to set the Rancher Server URL to the correct value yourself.
+
+>**Important!** After you set the Rancher Server URL, we do not support updating it. Set the URL with extreme care.
+
+## Authentication
+
+One of the key features that Rancher adds to Kubernetes is centralized user authentication. This feature allows to set up local users and/or connect to an external authentication provider. By connecting to an external authentication provider, you can leverage that provider's user and groups.
+
+For more information how authentication works and how to configure each provider, see [Authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/).
+
+## Authorization
+
+Within Rancher, each person authenticates as a _user_, which is a login that grants you access to Rancher. Once the user logs in to Rancher, their _authorization_, or their access rights within the system, is determined by the user's role. Rancher provides built-in roles to allow you to easily configure a user's permissions to resources, but Rancher also provides the ability to customize the roles for each Kubernetes resource.
+
+For more information how authorization works and how to customize roles, see [Roles Based Access Control (RBAC)]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/).
+
+## Pod Security Policies
+
+_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification, e.g. root privileges. If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message.
+
+For more information how to create and use PSPs, see [Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
+
+## Provisioning Drivers
+
+Drivers in Rancher allow you to manage which providers can be used to provision [hosted Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) or [nodes in an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) to allow Rancher to deploy and manage Kubernetes.
+
+For more information, see [Provisioning Drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/).
+
+## Adding Kubernetes Versions into Rancher
+
+_Available as of v2.3.0_
+
+With this feature, you can upgrade to the latest version of Kubernetes as soon as it is released, without upgrading Rancher. This feature allows you to easily upgrade Kubernetes patch versions (i.e. `v1.15.X`), but not intended to upgrade Kubernetes minor versions (i.e. `v1.X.0`) as Kubernetes tends to deprecate or add APIs between minor versions.
+
+The information that Rancher uses to provision [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) is now located in the Rancher Kubernetes Metadata. For details on metadata configuration and how to change the Kubernetes version used for provisioning RKE clusters, see [Rancher Kubernetes Metadata.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/k8s-metadata/)
+
+Rancher Kubernetes Metadata contains Kubernetes version information which Rancher uses to provision [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
+
+For more information on how metadata works and how to configure metadata config, see [Rancher Kubernetes Metadata]({{<baseurl>}}/rancher/v2.x/en/admin-settings/k8s-metadata/).
+
+## Enabling Experimental Features
+
+_Available as of v2.3.0_
+
+Rancher includes some features that are experimental and disabled by default. Feature flags were introduced to allow you to try these features. For more information, refer to the section about [feature flags.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/feature-flags/)
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/_index.md
new file mode 100644
index 00000000000..748cefa2ec1
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/_index.md
@@ -0,0 +1,36 @@
+---
+title: Access Control
+weight: 300
+---
+
+> This section is under construction.
+
+There are many ways you can interact with Kubernetes clusters that are managed by Rancher:
+
+- **Rancher UI**
+
+    Rancher provides an intuitive user interface for interacting with your clusters. All options available in the UI use the Rancher API. Therefore any action possible in the UI is also possible in the Rancher CLI or Rancher API.
+
+- **kubectl**
+
+    You can use the Kubernetes command-line tool, [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/), to manage   your clusters. You have two options for using kubectl:
+
+    - **Rancher kubectl shell**
+
+        Interact with your clusters by launching a kubectl shell available in the Rancher UI. This option requires no configuration actions on your part.
+
+        For more information, see [Accessing Clusters with kubectl Shell]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/kubectl/#accessing-clusters-with-kubectl-shell).
+
+    - **Terminal remote connection**
+
+        You can also interact with your clusters by installing [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) on your local desktop and then copying the cluster's kubeconfig file to your local `~/.kube/config` directory.
+
+        For more information, see [Accessing Clusters with kubectl and a kubeconfig File]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/kubectl/#accessing-clusters-with-kubectl-and-a-kubeconfig-file).
+
+- **Rancher CLI**
+
+    You can control your clusters by downloading Rancher's own command-line interface, [Rancher CLI]({{<baseurl>}}/rancher/v2.x/en/cli/). This CLI tool can interact directly with different clusters and projects or pass them `kubectl` commands.
+
+- **Rancher API**
+
+    Finally, you can interact with your clusters over the Rancher API. Before you use the API, you must obtain an [API key]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/). To view the different resource fields and actions for an API object, open the API UI, which can be accessed by clicking on **View in API** for any Rancher UI object.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/_index.md
new file mode 100644
index 00000000000..d8765f574e4
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/_index.md
@@ -0,0 +1,98 @@
+---
+title: Authentication Providers
+weight: 1
+---
+
+> This section is under construction.
+
+One of the key features that Rancher adds to Kubernetes is centralized user authentication. This feature allows your users to use one set of credentials to authenticate with any of your Kubernetes clusters.
+
+This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account.
+
+<!-- todomark add diagram -->
+
+## External vs. Local Authentication
+
+The Rancher authentication proxy integrates with the following external authentication services. The following table lists the first version of Rancher each service debuted.
+
+| Auth Service                                                                                     | Available as of  |
+| ------------------------------------------------------------------------------------------------ | ---------------- |
+| [Microsoft Active Directory]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/)  | v2.0.0           |
+| [GitHub]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/github/)                  | v2.0.0           |
+| [Microsoft Azure AD]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/azure-ad/)    | v2.0.3           |
+| [FreeIPA]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/freeipa/)                | v2.0.5           |
+| [OpenLDAP]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/openldap/)              | v2.0.5           |
+| [Microsoft AD FS]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/) | v2.0.7           |
+| [PingIdentity]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ping-federate/)     | v2.0.7           |
+| [Keycloak]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/keycloak/)              | v2.1.0           |
+| [Okta]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/okta/)                      | v2.2.0           |
+| [Google OAuth]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/google/)            | v2.3.0           |
+| [Shibboleth]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/shibboleth)           | v2.4.0           |
+
+<br/>
+However, Rancher also provides [local authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/local/).
+
+In most cases, you should use an external authentication service over local authentication, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if your external authentication provider is unavailable or undergoing maintenance.
+
+## Users and Groups
+
+Rancher relies on users and groups to determine who is allowed to log in to Rancher and which resources they can access. When authenticating with an external provider, groups are provided from the external provider based on the user. These users and groups are given specific roles to resources like clusters, projects, multi-cluster apps, and global DNS providers and entries. When you give access to a group, all users who are a member of that group in the authentication provider will be able to access the resource with the permissions that you've specified. For more information on roles and permissions, see [Role Based Access Control]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/).
+
+> **Note:** Local authentication does not support creating or managing groups.
+
+For more information, see [Users and Groups]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/user-groups/)
+
+## Scope of Rancher Authorization
+
+After you configure Rancher to allow sign on using an external authentication service, you should configure who should be allowed to log in and use Rancher. The following options are available:
+
+| Access Level | Description |
+|----------------------------------------------|-------------|
+| Allow any valid Users                   | _Any_ user in the authorization service can access Rancher. We generally discourage use of this setting! |
+| Allow members of Clusters, Projects, plus Authorized Users and Organizations | Any user in the authorization service and any group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any user in the authentication service or group you add to the **Authorized Users and Organizations** list may log in to Rancher. |
+| Restrict access to only Authorized Users and Organizations | Only users in the authentication service or groups added to the Authorized Users and Organizations can log in to Rancher. |
+
+To set the Rancher access level for users in the authorization service, follow these steps:
+
+1. From the **Global** view, click **Security > Authentication.**
+
+1. Use the **Site Access** options to configure the scope of user authorization. The table above explains the access level for each option.
+
+1. Optional: If you choose an option other than **Allow any valid Users,** you can add users to the list of authorized users and organizations by searching for them in the text field that appears.
+
+1. Click **Save.**
+
+**Result:** The Rancher access configuration settings are applied.
+
+{{< saml_caveats >}}
+
+## External Authentication Configuration and Principal Users
+
+Configuration of external authentication requires:
+
+- A local user assigned the administrator role, called hereafter the _local principal_.
+- An external user that can authenticate with your external authentication service, called hereafter the _external principal_.
+
+Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects.
+
+1. Sign into Rancher as the local principal and complete configuration of external authentication.
+
+	![Sign In]({{<baseurl>}}/img/rancher/sign-in.png)
+
+2. Rancher associates the external principal with the local principal. These two users share the local principal's user ID.
+
+	![Principal ID Sharing]({{<baseurl>}}/img/rancher/principal-ID.png)
+
+3. After you complete configuration, Rancher automatically signs out the local principal.
+
+	![Sign Out Local Principal]({{<baseurl>}}/img/rancher/sign-out-local.png)
+
+4. Then, Rancher automatically signs you back in as the external principal.
+
+	![Sign In External Principal]({{<baseurl>}}/img/rancher/sign-in-external.png)
+
+5. Because the external principal and the local principal share an ID, no unique object for the external principal displays on the Users page.
+
+	![Sign In External Principal]({{<baseurl>}}/img/rancher/users-page.png)
+
+6. The external principal and the local principal share the same access rights.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ad/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ad/_index.md
new file mode 100644
index 00000000000..757fe51cc35
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ad/_index.md
@@ -0,0 +1,197 @@
+---
+title: Configuring Active Directory (AD)
+weight: 2
+---
+
+If your organization uses Microsoft Active Directory as central user repository, you can configure Rancher to communicate with an Active Directory server to authenticate users. This allows Rancher admins to control access to clusters and projects based on users and groups managed externally in the Active Directory, while allowing end-users to authenticate with their AD credentials when logging in to the Rancher UI.
+
+Rancher uses LDAP to communicate with the Active Directory server. The authentication flow for Active Directory is therefore the same as for the [OpenLDAP authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/openldap) integration.
+
+> **Note:**
+>
+> Before you start, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
+
+## Prerequisites
+
+You'll need to create or obtain from your AD administrator a new AD user to use as service account for Rancher. This user must have sufficient permissions to perform LDAP searches and read attributes of users and groups under your AD domain.
+
+Usually a (non-admin) **Domain User** account should be used for this purpose, as by default such user has read-only privileges for most objects in the domain partition.
+
+Note however, that in some locked-down Active Directory configurations this default behaviour may not apply. In such case you will need to ensure that the service account user has at least **Read** and **List Content** permissions granted either on the Base OU (enclosing users and groups) or globally for the domain.
+
+> **Using TLS?**
+>
+> If the certificate used by the AD server is self-signed or not from a recognised certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
+
+## Configuration Steps
+### Open Active Directory Configuration
+
+1. Log into the Rancher UI using the initial local `admin` account.
+2. From the **Global** view, navigate to **Security** > **Authentication**
+3. Select **Active Directory**. The **Configure an AD server** form will be displayed.
+
+### Configure Active Directory Server Settings
+
+In the section titled `1. Configure an Active Directory server`,   complete the fields with the information specific to your Active Directory server. Please refer to the following table for detailed information on the required values for each parameter.
+
+> **Note:**
+>
+> If you are unsure about the correct values to enter in the  user/group Search Base field, please refer to [Identify Search Base and Schema using ldapsearch](#annex-identify-search-base-and-schema-using-ldapsearch).
+
+**Table 1: AD Server parameters**
+
+| Parameter | Description |
+|:--|:--|
+| Hostname | Specify the hostname or IP address of the AD server |
+| Port | Specify the port at which the Active Directory server is listening for connections. Unencrypted LDAP normally uses the standard port of 389, while LDAPS uses port 636.|
+| TLS | Check this box to enable LDAP over SSL/TLS (commonly known as LDAPS).|
+| Server Connection Timeout | 	The duration in number of seconds that Rancher waits before considering the AD server unreachable. |
+| Service Account Username | Enter the username of an AD account with read-only access to your domain partition (see [Prerequisites](#prerequisites)). The username can be entered in NetBIOS format (e.g. "DOMAIN\serviceaccount") or UPN format (e.g. "serviceaccount@domain.com"). |
+| Service Account Password | The password for the service account.  |
+| Default Login Domain | When you configure this field with the NetBIOS name of your AD domain, usernames entered without a domain (e.g. "jdoe") will automatically be converted to a slashed,  NetBIOS logon (e.g. "LOGIN_DOMAIN\jdoe") when binding to the AD server. If your users authenticate with the UPN (e.g. "jdoe@acme.com") as username then this field **must** be left empty. |
+| User Search Base | The Distinguished Name of the node in your directory tree from which to start searching for user objects. All users must be descendents of this base DN. For example: "ou=people,dc=acme,dc=com".|
+| Group Search Base | If your groups live under a different node than the one configured under `User Search Base` you will need to provide the Distinguished Name here. Otherwise leave it empty. For example: "ou=groups,dc=acme,dc=com".|
+
+---
+
+### Configure User/Group Schema
+
+In the section titled `2. Customize Schema` you must provide Rancher with a correct mapping of user and group attributes corresponding to the schema used in your directory.
+
+Rancher uses LDAP queries to search for and retrieve information about users and groups within the Active Directory. The attribute mappings configured in this section are used to construct search filters and resolve group membership. It is therefore paramount that the provided settings reflect the reality of your AD domain.
+
+> **Note:**
+>
+> If you are unfamiliar with the schema used in your Active Directory domain, please refer to [Identify Search Base and Schema using ldapsearch](#annex-identify-search-base-and-schema-using-ldapsearch) to determine the correct configuration values.
+
+#### User Schema
+
+The table below details the parameters for the user schema section configuration.
+
+**Table 2: User schema configuration parameters**
+
+| Parameter | Description |
+|:--|:--|
+| Object Class | The name of the object class used for user objects in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx) |
+| Username Attribute | The user attribute whose value is suitable as a display name. |
+| Login Attribute | The attribute whose value matches the username part of credentials entered by your users when logging in to Rancher. If your users authenticate with their UPN (e.g. "jdoe@acme.com") as username then this field must normally be set to `userPrincipalName`. Otherwise for the old, NetBIOS-style logon names (e.g. "jdoe") it's usually `sAMAccountName`. |
+| User Member Attribute | The attribute containing the groups that a user is a member of. |
+| Search Attribute | When a user enters text to add users or groups in the UI, Rancher queries the AD server and attempts to match users by the attributes provided in this setting. Multiple attributes can be specified by separating them with the pipe ("\|") symbol. To match UPN usernames (e.g. jdoe@acme.com) you should usually set the value of this field to `userPrincipalName`. |
+| Search Filter | This filter gets applied to the list of users that is searched when Rancher attempts to add users to a site access list or tries to add members to clusters or projects. For example, a user search filter could be <code>(&#124;(memberOf=CN=group1,CN=Users,DC=testad,DC=rancher,DC=io)(memberOf=CN=group2,CN=Users,DC=testad,DC=rancher,DC=io))</code>. Note: If the search filter does not use [valid AD search syntax,](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) the list of users will be empty.  |
+| User Enabled Attribute | The attribute containing an integer value representing a bitwise enumeration of user account flags. Rancher uses this to determine if a user account is disabled. You should normally leave this set to the AD standard `userAccountControl`. |
+| Disabled Status Bitmask | This is the value of the `User Enabled Attribute` designating a disabled user account. You should normally leave this set to the default value of "2" as specified in the Microsoft Active Directory schema (see [here](https://docs.microsoft.com/en-us/windows/desktop/adschema/a-useraccountcontrol#remarks)). |
+
+---
+
+#### Group Schema
+
+The table below details the parameters for the group schema configuration.
+
+**Table 3: Group schema configuration parameters**
+
+| Parameter | Description |
+|:--|:--|
+| Object Class | The name of the object class used for group objects in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx)  |
+| Name Attribute | The group attribute whose value is suitable for a display name. |
+| Group Member User Attribute | The name of the **user attribute** whose format matches the group members in the `Group Member Mapping Attribute`. |
+| Group Member Mapping Attribute | The name of the group attribute containing the members of a group. |
+| Search Attribute | Attribute used to construct search filters when adding groups to clusters or projects. See description of user schema `Search Attribute`. |
+| Search Filter | This filter gets applied to the list of groups that is searched when Rancher attempts to add groups to a site access list or tries to add groups to clusters or projects. For example, a group search filter could be <code>(&#124;(cn=group1)(cn=group2))</code>. Note: If the search filter does not use [valid AD search syntax,](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) the list of groups will be empty. |
+| Group DN Attribute | The name of the group attribute whose format matches the values in the user attribute describing a the user's memberships. See  `User Member Attribute`. |
+| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organisation makes use of these nested memberships (ie. you have groups that contain other groups as members). |
+
+---
+
+### Test Authentication
+
+Once you have completed the configuration, proceed by testing the connection to the AD server **using your AD admin account**. If the test is successful, authentication with the configured Active Directory will be enabled implicitly with the account you test with set as admin.
+
+> **Note:**
+>
+> The AD user pertaining to the credentials entered in this step will be mapped to the local principal account and assigned administrator privileges in Rancher. You should therefore make a conscious decision on which AD account you use to perform this step.
+
+1. Enter the **username** and **password** for the AD account that should be mapped to the local principal account.
+2. Click **Authenticate with Active Directory** to finalise the setup.
+
+**Result:**
+
+- Active Directory authentication has been enabled.
+- You have been signed into Rancher as administrator using the provided AD credentials.
+
+> **Note:**
+>
+> You will still be able to login using the locally configured `admin` account and password in case of a disruption of LDAP services.
+
+## Annex: Identify Search Base and Schema using ldapsearch
+
+In order to successfully configure AD authentication it is crucial that you provide the correct configuration pertaining to the hierarchy and schema of your AD server.
+
+The [`ldapsearch`](http://manpages.ubuntu.com/manpages/artful/man1/ldapsearch.1.html) tool allows you to query your AD server to learn about the schema used for user and group objects.
+
+For the purpose of the example commands provided below we will assume:
+
+- The Active Directory server has a hostname of `ad.acme.com`
+- The server is listening for unencrypted connections on port `389`
+- The Active Directory domain is `acme`
+- You have a valid AD account with the username `jdoe` and password `secret`
+
+### Identify Search Base
+
+First we will use `ldapsearch` to identify the Distinguished Name (DN) of the parent node(s) for users and groups:
+
+```
+$ ldapsearch -x -D "acme\jdoe" -w "secret" -p 389 \
+-h ad.acme.com -b "dc=acme,dc=com" -s sub "sAMAccountName=jdoe"
+```
+
+This command performs an LDAP search with the search base set to the domain root (`-b "dc=acme,dc=com"`) and a filter targeting the user account (`sAMAccountNam=jdoe`), returning the attributes for said user:
+
+{{< img "/img/rancher/ldapsearch-user.png" "LDAP User">}}
+
+Since in this case the user's DN is `CN=John Doe,CN=Users,DC=acme,DC=com` [5], we should configure the **User Search Base** with the parent node DN `CN=Users,DC=acme,DC=com`.
+
+Similarly, based on the DN of the group referenced in the **memberOf** attribute [4], the correct value for the **Group Search Base** would be the parent node of that value, ie. `OU=Groups,DC=acme,DC=com`.
+
+### Identify User Schema
+
+The output of the above `ldapsearch` query also allows to determine the correct values to use in the user schema configuration:
+
+- `Object Class`: **person** [1]
+- `Username Attribute`: **name** [2]
+- `Login Attribute`: **sAMAccountName** [3]
+- `User Member Attribute`: **memberOf** [4]
+
+> **Note:**
+>
+> If the AD users in our organisation were to authenticate with their UPN (e.g. jdoe@acme.com) instead of the short logon name, then we would have to set the `Login Attribute` to **userPrincipalName** instead.
+
+We'll also set the `Search Attribute` parameter to **sAMAccountName|name**. That way users can be added to clusters/projects in the Rancher UI either by entering their username or full name.
+
+### Identify Group Schema
+
+Next, we'll query one of the groups associated with this user, in this case `CN=examplegroup,OU=Groups,DC=acme,DC=com`:
+
+```
+$ ldapsearch -x -D "acme\jdoe" -w "secret" -p 389 \
+-h ad.acme.com -b "ou=groups,dc=acme,dc=com" \
+-s sub "CN=examplegroup"
+```
+
+This command will inform us on the attributes used for group objects:
+
+{{< img "/img/rancher/ldapsearch-group.png" "LDAP Group">}}
+
+Again, this allows us to determine the correct values to enter in the group schema configuration:
+
+- `Object Class`: **group** [1]
+- `Name Attribute`: **name** [2]
+- `Group Member Mapping Attribute`: **member** [3]
+- `Search Attribute`: **sAMAccountName** [4]
+
+Looking  at the value of the  **member** attribute, we can see that it contains the DN of the referenced user. This  corresponds to the **distinguishedName** attribute in our user object. Accordingly will have to set the value of the `Group Member User Attribute` parameter to this attribute.
+
+In the same way, we can observe that the value in the **memberOf** attribute in the user object corresponds to the **distinguishedName** [5] of the group. We therefore need to set the value for the `Group DN Attribute` parameter to this attribute.
+
+## Annex: Troubleshooting
+
+If you are experiencing issues while testing the connection to the Active Directory server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/azure-ad/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/azure-ad/_index.md
new file mode 100644
index 00000000000..7e151f00d86
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/azure-ad/_index.md
@@ -0,0 +1,206 @@
+---
+title: Configuring Azure AD
+weight: 5
+---
+
+_Available as of v2.0.3_
+
+If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
+
+>**Note:** Azure AD integration only supports Service Provider initiated logins.
+
+>**Prerequisite:** Have an instance of Azure AD configured.
+
+>**Note:** Most of this procedure takes place from the [Microsoft Azure Portal](https://portal.azure.com/).
+
+## Azure Active Directory Configuration Outline
+
+Configuring Rancher to allow your users to authenticate with their Azure AD accounts involves multiple procedures. Review the outline below before getting started.
+
+<a id="tip"></a>
+
+>**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later.
+
+<!-- TOC -->
+
+- [1. Register Rancher with Azure](#1-register-rancher-with-azure)
+- [2. Create an Azure API Key](#2-create-an-azure-api-key)
+- [3. Set Required Permissions for Rancher](#3-set-required-permissions-for-rancher)
+- [4. Copy Azure Application Data](#4-copy-azure-application-data)
+- [5. Configure Azure AD in Rancher](#5-configure-azure-ad-in-rancher)
+
+<!-- /TOC -->
+
+### 1. Register Rancher with Azure
+
+Before enabling Azure AD within Rancher, you must register Rancher with Azure.
+
+1. Log in to [Microsoft Azure](https://portal.azure.com/) as an administrative user. Configuration in future steps requires administrative access rights.
+
+1. Use search to open the **App registrations** service.
+
+    ![Open App Registrations]({{<baseurl>}}/img/rancher/search-app-registrations.png)
+
+1. Click **New registrations** and complete the **Create** form.
+
+    ![New App Registration]({{<baseurl>}}/img/rancher/new-app-registration.png)
+
+    1. Enter a **Name** (something like `Rancher`).
+
+    1. From **Supported account types**, select "Accounts in this organizational directory only (AzureADTest only - Single tenant)" This corresponds to the legacy app registration options.
+
+    1. In the **Redirect URI** section, make sure **Web** is selected from the dropdown and enter the URL of your Rancher Server in the text box next to the dropdown. This Rancher server URL should be appended with the verification path: `<MY_RANCHER_URL>/verify-auth-azure`.
+
+       >**Tip:** You can find your personalized Azure reply URL in Rancher on the Azure AD Authentication page (Global View > Security Authentication > Azure AD).
+
+    1. Click **Register**.
+
+>**Note:** It can take up to five minutes for this change to take affect, so don't be alarmed if you can't authenticate immediately after Azure AD configuration.
+
+### 2. Create a new client secret
+
+From the Azure portal, create a client secret. Rancher will use this key to authenticate with Azure AD.
+
+1. Use search to open **App registrations** services. Then open the entry for Rancher that you created in the last procedure.
+
+     ![Open Rancher Registration]({{<baseurl>}}/img/rancher/open-rancher-app.png)
+
+1. From the navigation pane on left, click **Certificates and Secrets**.
+
+1. Click **New client secret**.
+
+     ![Create new client secret]({{< baseurl >}}/img/rancher/select-client-secret.png)
+
+    1. Enter a **Description** (something like `Rancher`).
+
+    1. Select duration for the key from the options under **Expires**. This drop-down sets the expiration date for the key. Shorter durations are more secure, but require you to create a new key after expiration.
+
+    1. Click **Add** (you don't need to enter a value—it will automatically populate after you save).
+<a id="secret"></a>
+
+1.  Copy the key value and save it to an [empty text file](#tip).
+
+    You'll enter this key into the Rancher UI later as your **Application Secret**.
+
+    You won't be able to access the key value again within the Azure UI.
+
+### 3. Set Required Permissions for Rancher
+
+Next, set API permissions for Rancher within Azure.
+
+1. From the navigation pane on left, select **API permissions**.
+
+    ![Open Required Permissions]({{<baseurl>}}/img/rancher/select-required-permissions.png)
+
+1. Click **Add a permission**.
+
+1. From the **Azure Active Directory Graph**, select the following **Delegated Permissions**:
+
+    ![Select API Permissions]({{< baseurl >}}/img/rancher/select-required-permissions-2.png)
+
+    <br/>
+    <br/>
+    - **Access the directory as the signed-in user**
+    - **Read directory data**
+    - **Read all groups**
+    - **Read all users' full profiles**
+    - **Read all users' basic profiles**
+    - **Sign in and read user profile**
+
+1. Click **Add permissions**.
+
+1. From **API permissions**, click **Grant admin consent**. Then click **Yes**.
+
+    >**Note:** You must be signed in as an Azure administrator to successfully save your permission settings.
+
+
+### 4. Add a Reply URL
+
+To use Azure AD with Rancher you must whitelist Rancher with Azure. You can complete this whitelisting by providing Azure with a reply URL for Rancher, which is your Rancher Server URL followed with a verification path.
+
+
+1. From the **Setting** blade, select **Reply URLs**.
+
+    ![Azure: Enter Reply URL]({{<baseurl>}}/img/rancher/enter-azure-reply-url.png)
+
+1. From the **Reply URLs** blade, enter the URL of your Rancher Server, appended with the verification path: `<MY_RANCHER_URL>/verify-auth-azure`.
+
+       >**Tip:** You can find your personalized Azure reply URL in Rancher on the Azure AD Authentication page (Global View > Security Authentication > Azure AD).
+
+1. Click **Save**.
+
+**Result:** Your reply URL is saved.
+
+>**Note:** It can take up to five minutes for this change to take affect, so don't be alarmed if you can't authenticate immediately after Azure AD configuration.
+
+### 5. Copy Azure Application Data
+
+As your final step in Azure, copy the data that you'll use to configure Rancher for Azure AD authentication and paste it into an empty text file.
+
+1. Obtain your Rancher **Tenant ID**.
+
+    1. Use search to open the **Azure Active Directory** service.
+
+         ![Open Azure Active Directory]({{<baseurl>}}/img/rancher/search-azure-ad.png)
+
+    1. From the left navigation pane, open **Overview**.
+
+    2. Copy the **Directory ID** and paste it into your [text file](#tip).
+
+        You'll paste this value into Rancher as your **Tenant ID**.
+
+1. Obtain your Rancher **Application ID**.
+
+    1. Use search to open **App registrations**.
+
+         ![Open App Registrations]({{<baseurl>}}/img/rancher/search-app-registrations.png)
+
+    1. Find the entry you created for Rancher.
+
+    1. Copy the **Application ID** and paste it to your [text file](#tip).
+
+1. Obtain your Rancher **Graph Endpoint**, **Token Endpoint**, and **Auth Endpoint**.
+
+    1. From **App registrations**, click **Endpoints**.
+
+        ![Click Endpoints]({{<baseurl>}}/img/rancher/click-endpoints.png)
+
+    2. Copy the following endpoints to your clipboard and paste them into your [text file](#tip) (these values will be your Rancher endpoint values).
+    
+        - **Microsoft Graph API endpoint** (Graph Endpoint)
+        - **OAuth 2.0 token endpoint (v1)** (Token Endpoint)
+        - **OAuth 2.0 authorization endpoint (v1)** (Auth Endpoint)
+        
+>**Note:** Copy the v1 version of the endpoints
+
+### 5. Configure Azure AD in Rancher
+
+From the Rancher UI, enter information about your AD instance hosted in Azure to complete configuration.
+
+Enter the values that you copied to your [text file](#tip).
+
+1. Log into Rancher. From the **Global** view, select **Security > Authentication**.
+
+1. Select **Azure AD**.
+
+1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#5-copy-azure-application-data).
+
+    >**Important:** When entering your Graph Endpoint, remove the tenant ID from the URL, like below.
+    >
+    ><code>http<span>s://g</span>raph.windows.net/<del>abb5adde-bee8-4821-8b03-e63efdc7701c</del></code>
+
+    The following table maps the values you copied in the Azure portal to the fields in Rancher.
+
+    | Rancher Field      | Azure Value                           |
+    | ------------------ | ------------------------------------- |
+    | Tenant ID          | Directory ID                          |
+    | Application ID     | Application ID                        |
+    | Application Secret | Key Value                             |
+    | Endpoint           | https://login.microsoftonline.com/    |
+    | Graph Endpoint     | Microsoft Azure AD Graph API Endpoint |
+    | Token Endpoint     | OAuth 2.0 Token Endpoint              |
+    | Auth Endpoint      | OAuth 2.0 Authorization Endpoint      |
+
+1. Click **Authenticate with Azure**.
+
+**Result:** Azure Active Directory authentication is configured.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/freeipa/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/freeipa/_index.md
new file mode 100644
index 00000000000..652c33f86c5
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/freeipa/_index.md
@@ -0,0 +1,54 @@
+---
+title: Configuring FreeIPA
+weight: 4
+---
+
+_Available as of v2.0.5_
+
+If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials.
+
+>**Prerequisites:**
+>
+>- You must have a [FreeIPA Server](https://www.freeipa.org/) configured.
+>- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
+>- Read [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
+
+1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+
+2.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+3.	Select **FreeIPA**.
+
+4.	Complete the **Configure an FreeIPA server** form.
+
+	You may need to log in to your domain controller to find the information requested in the form.
+
+	>**Using TLS?**
+ 	>If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
+	<br/>
+	<br/>
+	>**User Search Base vs. Group Search Base**
+	>
+	>Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
+	>
+	>* If your users and groups are in the same search base, complete only the User Search Base.
+	>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
+
+5.	If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
+
+	>**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
+	>
+	>The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
+	>
+	> * `uid`: User ID
+	> * `sn`: Last Name
+	> * `givenName`: First Name
+	>
+	> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
+
+6.	Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.
+
+**Result:**
+
+- FreeIPA authentication is configured.
+- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_).
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/github/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/github/_index.md
new file mode 100644
index 00000000000..fbd5a0cd90a
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/github/_index.md
@@ -0,0 +1,51 @@
+---
+title: Configuring GitHub
+weight: 6
+---
+
+In environments using GitHub, you can configure Rancher to allow sign on using GitHub credentials.
+
+>**Prerequisites:** Read [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
+
+1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
+
+2.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+3.	Select **GitHub**.
+
+4.	Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration.
+
+	>**What's an Authorization Callback URL?**
+	>
+	>The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).
+
+	>When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.
+
+5. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.
+
+	>**Where do I find the Client ID and Client Secret?**
+	>
+	>From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.
+
+6.	Click **Authenticate with GitHub**.
+
+7.	Use the **Site Access** options to configure the scope of user authorization.
+
+	-	**Allow any valid Users**
+
+		_Any_ GitHub user can access Rancher. We generally discourage use of this setting!
+
+	-	**Allow members of Clusters, Projects, plus Authorized Users and Organizations**
+
+		Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.
+
+	-	**Restrict access to only Authorized Users and Organizations**
+
+		Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
+		<br/>
+8.	Click **Save**.
+
+**Result:**
+
+- GitHub authentication is configured.
+- You are signed into Rancher with your GitHub account (i.e., the _external principal_).
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/google/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/google/_index.md
new file mode 100644
index 00000000000..5af5724229b
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/google/_index.md
@@ -0,0 +1,107 @@
+---
+title: Configuring Google OAuth
+weight: 12
+---
+_Available as of v2.3.0_
+
+If your organization uses G Suite for user authentication, you can configure Rancher to allow your users to log in using their G Suite credentials.
+
+Only admins of the G Suite domain have access to the Admin SDK. Therefore, only G Suite admins can configure Google OAuth for Rancher.
+
+Within Rancher, only administrators or users with the **Manage Authentication** [global role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) can configure authentication.
+
+# Prerequisites
+- You must have a [G Suite admin account](https://admin.google.com) configured.
+- G Suite requires a [top private domain FQDN](https://github.com/google/guava/wiki/InternetDomainNameExplained#public-suffixes-and-private-domains) as an authorized domain. One way to get an FQDN is by creating an A-record in Route53 for your Rancher server. You do not need to update your Rancher Server URL setting with that record, because there could be clusters using that URL.
+- You must have the Admin SDK API enabled for your G Suite domain. You can enable it using the steps on [this page.](https://support.google.com/a/answer/60757?hl=en)
+
+After the Admin SDK API is enabled, your G Suite domain's API screen should look like this:
+![Enable Admin APIs]({{<baseurl>}}/img/rancher/Google-Enable-APIs-Screen.png)
+
+# Setting up G Suite for OAuth with Rancher
+Before you can set up Google OAuth in Rancher, you need to log in to your G Suite account and do the following:
+
+1. [Add Rancher as an authorized domain in G Suite](#1-adding-rancher-as-an-authorized-domain)
+1. [Generate OAuth2 credentials for the Rancher server](#2-creating-oauth2-credentials-for-the-rancher-server)
+1. [Create service account credentials for the Rancher server](#3-creating-service-account-credentials)
+1. [Register the service account key as an OAuth Client](#4-register-the-service-account-key-as-an-oauth-client)
+
+### 1. Adding Rancher as an Authorized Domain
+1. Click [here](https://console.developers.google.com/apis/credentials) to go to credentials page of your Google domain.
+1. Select your project and click **OAuth consent screen.**
+![OAuth Consent Screen]({{<baseurl>}}/img/rancher/Google-OAuth-consent-screen-tab.png)
+1. Go to **Authorized Domains** and enter the top private domain of your Rancher server URL in the list. The top private domain is the rightmost superdomain. So for example, www.foo.co.uk a top private domain of foo.co.uk. For more information on top-level domains, refer to [this article.](https://github.com/google/guava/wiki/InternetDomainNameExplained#public-suffixes-and-private-domains)
+1. Go to **Scopes for Google APIs** and make sure **email,** **profile** and **openid** are enabled.
+
+**Result:** Rancher has been added as an authorized domain for the Admin SDK API.
+
+### 2. Creating OAuth2 Credentials for the Rancher Server
+1. Go to the Google API console, select your project, and go to the [credentials page.](https://console.developers.google.com/apis/credentials)
+![Credentials]({{<baseurl>}}/img/rancher/Google-Credentials-tab.png)
+1. On the **Create Credentials** dropdown, select **OAuth client ID.**
+1. Click **Web application.**
+1. Provide a name.
+1. Fill out the **Authorized JavaScript origins** and **Authorized redirect URIs.** Note: The Rancher UI page for setting up Google OAuth (available from the Global view under **Security > Authentication > Google**) provides you the exact links to enter for this step.
+ - Under **Authorized JavaScript origins,** enter your Rancher server URL.
+ - Under **Authorized redirect URIs,** enter your Rancher server URL appended with the path `verify-auth`. For example, if your URI is `https://rancherServer`, you will enter `https://rancherServer/verify-auth`.
+1. Click on **Create.**
+1. After the credential is created, you will see a screen with a list of your credentials. Choose the credential you just created, and in that row on rightmost side, click **Download JSON.** Save the file so that you can provide these credentials to Rancher.
+
+**Result:** Your OAuth credentials have been successfully created.
+
+### 3. Creating Service Account Credentials
+Since the Google Admin SDK is available only to admins, regular users cannot use it to retrieve profiles of other users or their groups. Regular users cannot even retrieve their own groups.
+
+Since Rancher provides group-based membership access, we require the users to be able to get their own groups, and look up other users and groups when needed.
+
+As a workaround to get this capability, G Suite recommends creating a service account and delegating authority of your G Suite domain to that service account.
+
+This section describes how to:
+
+- Create a service account
+- Create a key for the service account and download the credentials as JSON
+
+1. Click [here](https://console.developers.google.com/iam-admin/serviceaccounts) and select your project for which you generated OAuth credentials.
+1. Click on **Create Service Account.**
+1. Enter a name and click **Create.**
+![Service account creation Step 1]({{<baseurl>}}/img/rancher/Google-svc-acc-step1.png)
+1. Don't provide any roles on the **Service account permissions** page and click **Continue**
+![Service account creation Step 2]({{<baseurl>}}/img/rancher/Google-svc-acc-step2.png)
+1. Click on **Create Key** and select the JSON option. Download the JSON file and save it so that you can provide it as the service account credentials to Rancher.
+![Service account creation Step 3]({{<baseurl>}}/img/rancher/Google-svc-acc-step3-key-creation.png)
+
+**Result:** Your service account is created.
+
+### 4. Register the Service Account Key as an OAuth Client
+
+You will need to grant some permissions to the service account you created in the last step. Rancher requires you to grant only read-only permissions for users and groups.
+
+Using the Unique ID of the service account key, register it as an Oauth Client using the following steps:
+
+1. Get the Unique ID of the key you just created. If it's not displayed in the list of keys right next to the one you created, you will have to enable it. To enable it, click **Unique ID** and click **OK.** This will add a **Unique ID** column to the list of service account keys. Save the one listed for the service account you created. NOTE: This is a numeric key, not to be confused with the alphanumeric field **Key ID.**
+
+	![Service account Unique ID]({{<baseurl>}}/img/rancher/Google-Select-UniqueID-column.png)
+1. Go to the [**Manage OAuth Client Access** page.](https://admin.google.com/AdminHome?chromeless=1#OGX:ManageOauthClients)
+1. Add the Unique ID obtained in the previous step in the **Client Name** field.
+1. In the **One or More API Scopes** field, add the following scopes:
+	```
+	openid,profile,email,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly
+	```
+1. Click **Authorize.**
+
+**Result:** The service account is registered as an OAuth client in your G Suite account.
+
+# Configuring Google OAuth in Rancher
+1. Sign into Rancher using a local user assigned the [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions) role. This user is also called the local principal.
+1.	From the **Global** view, click **Security > Authentication** from the main menu.
+1. Click **Google.** The instructions in the UI cover the steps to set up authentication with Google OAuth.
+	1. Admin Email: Provide the email of an administrator account from your GSuite setup. In order to perform user and group lookups, google apis require an administrator's email in conjunction with the service account key.
+	1. Domain: Provide the domain on which you have configured GSuite. Provide the exact domain and not any aliases.
+	1. Nested Group Membership: Check this box to enable nested group memberships. Rancher admins can disable this at any time after configuring auth.
+   - **Step One** is about adding Rancher as an authorized domain, which we already covered in [this section.](#1-adding-rancher-as-an-authorized-domain)
+   - For **Step Two,** provide the OAuth credentials JSON that you downloaded after completing [this section.](#2-creating-oauth2-credentials-for-the-rancher-server) You can upload the file or paste the contents into the **OAuth Credentials** field.
+   - For **Step Three,** provide the service account credentials JSON that downloaded at the end of [this section.](#3-creating-service-account-credentials) The credentials will only work if you successfully [registered the service account key](#4-register-the-service-account-key-as-an-oauth-client) as an OAuth client in your G Suite account.
+1.	Click **Authenticate with Google**.
+1.	Click **Save**.
+
+**Result:** Google authentication is successfully configured.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/keycloak/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/keycloak/_index.md
new file mode 100644
index 00000000000..cdc10e67f14
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/keycloak/_index.md
@@ -0,0 +1,120 @@
+---
+title: Configuring Keycloak (SAML)
+description: Create a Keycloak SAML client and configure Rancher to work with Keycloak. By the end your users will be able to sign into Rancher using their Keycloak logins
+weight: 7
+---
+_Available as of v2.1.0_
+
+If your organization uses Keycloak Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
+
+## Prerequisites
+
+- You must have a [Keycloak IdP Server](https://www.keycloak.org/docs/latest/server_installation/) configured.
+- In Keycloak, create a [new SAML client](https://www.keycloak.org/docs/latest/server_admin/#saml-clients), with the settings below. See the [Keycloak documentation](https://www.keycloak.org/docs/latest/server_admin/#saml-clients) for help.
+
+     Setting | Value
+     ------------|------------
+      `Sign Documents` | `ON` <sup>1</sup>
+      `Sign Assertions` | `ON` <sup>1</sup>
+      All other `ON/OFF` Settings | `OFF`
+      `Client ID` | `https://yourRancherHostURL/v1-saml/keycloak/saml/metadata`<sup>2</sup>
+      `Client Name` | <CLIENT_NAME> (e.g. `rancher`)
+      `Client Protocol` | `SAML`
+      `Valid Redirect URI` | `https://yourRancherHostURL/v1-saml/keycloak/saml/acs`
+
+      ><sup>1</sup>: Optionally, you can enable either one or both of these settings.
+      ><sup>2</sup>: Rancher SAML metadata won't be generated until a SAML provider is configured and saved.
+- Export a `metadata.xml` file from your Keycloak client:
+  From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file.
+
+
+## Configuring Keycloak in Rancher
+
+
+1.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+1.	Select **Keycloak**.
+
+1.	Complete the **Configure Keycloak Account** form. Keycloak IdP lets you specify what data store you want to use. You can either add a database or use an existing LDAP server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher.
+
+
+    | Field                     | Description                                                                   |
+    | ------------------------- | ----------------------------------------------------------------------------- |
+    | Display Name Field        | The AD attribute that contains the display name of users.                     |
+    | User Name Field           | The AD attribute that contains the user name/given name.                      |
+    | UID Field                 | An AD attribute that is unique to every user.                                 |
+    | Groups Field              | Make entries for managing group memberships.                                  |
+    | Rancher API Host          | The URL for your Rancher Server.                                              |
+    | Private Key / Certificate | A key/certificate pair to create a secure shell between Rancher and your IdP. |
+    | IDP-metadata              | The `metadata.xml` file that you exported from your IdP server.               |
+
+    >**Tip:** You can generate a key/certificate pair using an openssl command. For example:
+    >
+    >        openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.cert
+
+
+1. After you complete the **Configure Keycloak Account** form, click **Authenticate with Keycloak**, which is at the bottom of the page.
+
+    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Keycloak IdP to validate your Rancher Keycloak configuration.
+
+    >**Note:** You may have to disable your popup blocker to see the IdP login page.
+
+**Result:** Rancher is configured to work with Keycloak. Your users can now sign into Rancher using their Keycloak logins.
+
+{{< saml_caveats >}}
+
+## Annex: Troubleshooting
+
+If you are experiencing issues while testing the connection to the Keycloak server, first double-check the configuration option of your SAML client. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
+
+### You are not redirected to Keycloak
+
+When you click on **Authenticate with Keycloak**, your are not redirected to your IdP.
+
+  * Verify your Keycloak client configuration.
+  * Make sure `Force Post Binding` set to `OFF`.
+
+
+### Forbidden message displayed after IdP login
+
+You are correctly redirected to your IdP login page and you are able to enter your credentials, however you get a `Forbidden` message afterwards.
+
+  * Check the Rancher debug log.
+  * If the log displays `ERROR: either the Response or Assertion must be signed`, make sure either `Sign Documents` or `Sign assertions` is set to `ON` in your Keycloak client.
+
+### HTTP 502 when trying to access /v1-saml/keycloak/saml/metadata
+
+This is usually due to the metadata not being created until a SAML provider is configured.
+Try configuring and saving keycloak as your SAML provider and then accessing the metadata.
+
+### Keycloak Error: "We're sorry, failed to process response"
+
+  * Check your Keycloak log.
+  * If the log displays `failed: org.keycloak.common.VerificationException: Client does not have a public key`, set `Encrypt Assertions` to `OFF` in your Keycloak client.
+
+### Keycloak Error: "We're sorry, invalid requester"
+
+  * Check your Keycloak log.
+  * If the log displays `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`, set `Client Signature Required` to `OFF` in your Keycloak client.
+
+### Keycloak 6.0.0+: IDPSSODescriptor missing from options
+
+Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab.
+You can still get the XML from the following url:
+
+`https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor`
+
+The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
+
+  * Copy all the tags from `EntitiesDescriptor` to the `EntityDescriptor`.
+  * Remove the `<EntitiesDescriptor>` tag from the beginning.
+  * Remove the `</EntitiesDescriptor>` from the end of the xml.
+
+You are left with something similar as the example below:
+
+```
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
+  ....
+
+</EntityDescriptor>
+```
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/local/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/local/_index.md
new file mode 100644
index 00000000000..8f973b8e26f
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/local/_index.md
@@ -0,0 +1,14 @@
+---
+title: Local Authentication
+weight: 1
+---
+
+Local authentication is the default until you configure an external authentication provider. Local authentication is where Rancher stores the user information, i.e. names and passwords, of who can log in to Rancher. By default, the `admin` user that logs in to Rancher for the first time is a local user.
+
+## Adding Local Users
+
+Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if your external authentication service encounters issues.
+
+1.	From the **Global** view, select **Users** from the navigation bar.
+
+2.	Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/_index.md
new file mode 100644
index 00000000000..480f3110b9d
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/_index.md
@@ -0,0 +1,36 @@
+---
+title: Configuring Microsoft Active Directory Federation Service (SAML)
+weight: 9
+---
+_Available as of v2.0.7_
+
+If your organization uses Microsoft Active Directory Federation Services (AD FS) for user authentication, you can configure Rancher to allow your users to log in using their AD FS credentials.
+
+## Prerequisites
+
+
+- You must have Rancher installed.
+
+  - Obtain your Rancher Server URL. During AD FS configuration, substitute this URL for the `<RANCHER_SERVER>` placeholder.
+
+  - You must have a global administrator account on your Rancher installation.
+
+- You must have a [Microsoft AD FS Server](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) configured.
+
+	- Obtain your AD FS Server IP/DNS name. During AD FS configuration, substitute this IP/DNS name for the `<AD_SERVER>` placeholder.
+
+	- You must have access to add [Relying Party Trusts](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust) on your AD FS Server.
+
+
+
+## Setup Outline
+
+Setting up Microsoft AD FS with Rancher Server requires configuring AD FS on your Active Directory server, and configuring Rancher to utilize your AD FS server. The following pages serve as guides for setting up Microsoft AD FS authentication on your Rancher installation.
+
+- [1 — Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup)
+- [2 — Configuring Rancher for Microsoft AD FS]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup)
+
+{{< saml_caveats >}}
+
+
+### [Next: Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup)
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
new file mode 100644
index 00000000000..152834ec60c
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
@@ -0,0 +1,82 @@
+---
+title: 1 — Configuring Microsoft AD FS for Rancher
+weight: 1205
+---
+
+Before configuring Rancher to support AD FS users, you must add Rancher as a [relying party trust](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/understanding-key-ad-fs-concepts) in AD FS. 
+
+1. Log into your AD server as an administrative user.
+
+1. Open the **AD FS Management** console. Select **Add Relying Party Trust...** from the **Actions** menu and click **Start**.
+  
+    {{< img "/img/rancher/adfs/adfs-overview.png" "">}}
+
+1. Select **Enter data about the relying party manually** as the option for obtaining data about the relying party.
+
+    {{< img "/img/rancher/adfs/adfs-add-rpt-2.png" "">}}
+    
+1. Enter your desired **Display name** for your Relying Party Trust. For example, `Rancher`.
+
+    {{< img "/img/rancher/adfs/adfs-add-rpt-3.png" "">}}
+  
+1. Select **AD FS profile** as the configuration profile for your relying party trust.
+  
+    {{< img "/img/rancher/adfs/adfs-add-rpt-4.png" "">}}
+  
+1. Leave the **optional token encryption certificate** empty, as Rancher AD FS will not be using one.
+  
+  {{< img "/img/rancher/adfs/adfs-add-rpt-5.png" "">}}
+  
+1. Select **Enable support for the SAML 2.0 WebSSO protocol**
+  and enter `https://<rancher-server>/v1-saml/adfs/saml/acs` for the service URL.
+  
+  {{< img "/img/rancher/adfs/adfs-add-rpt-6.png" "">}}
+  
+1. Add `https://<rancher-server>/v1-saml/adfs/saml/metadata` as the **Relying party trust identifier**.
+  
+    {{< img "/img/rancher/adfs/adfs-add-rpt-7.png" "">}}
+  
+1. This tutorial will not cover multi-factor authentication; please refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs) if you would like to configure multi-factor authentication.
+  
+    {{< img "/img/rancher/adfs/adfs-add-rpt-8.png" "">}}
+  
+1. From **Choose Issuance Authorization RUles**, you may select either of the options available according to use case. However, for the purposes of this guide, select **Permit all users to access this relying party**.
+  
+    {{< img "/img/rancher/adfs/adfs-add-rpt-9.png" "">}}
+
+1. After reviewing your settings, select **Next** to add the relying party trust.
+  
+    {{< img "/img/rancher/adfs/adfs-add-rpt-10.png" "">}}
+
+  
+1. Select **Open the Edit Claim Rules...** and click **Close**.
+  
+    {{< img "/img/rancher/adfs/adfs-add-rpt-11.png" "">}}
+  
+1. On the **Issuance Transform Rules** tab, click **Add Rule...**.
+  
+    {{< img "/img/rancher/adfs/adfs-edit-cr.png" "">}}
+  
+1. Select **Send LDAP Attributes as Claims** as the **Claim rule template**.
+
+    {{< img "/img/rancher/adfs/adfs-add-tcr-1.png" "">}}
+  
+1. Set the **Claim rule name** to your desired name (for example, `Rancher Attributes`) and select **Active Directory** as the **Attribute store**. Create the following mapping to reflect the table below:
+
+    | LDAP Attribute                               | Outgoing Claim Type |
+    | -------------------------------------------- | ------------------- |
+    | Given-Name                                   | Given Name          |
+    | User-Principal-Name                          | UPN                 |
+    | Token-Groups - Qualified by Long Domain Name | Group               |
+    | SAM-Account-Name                             | Name                |
+    <br/>
+    {{< img "/img/rancher/adfs/adfs-add-tcr-2.png" "">}}
+
+1. Download the `federationmetadata.xml` from your AD server at: 
+```
+https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml
+```
+
+**Result:** You've added Rancher as a relying trust party. Now you can configure Rancher to leverage AD.
+
+### [Next: Configuring Rancher for Microsoft AD FS]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/)
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
new file mode 100644
index 00000000000..67706dddcf3
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
@@ -0,0 +1,45 @@
+---
+title: 2 — Configuring Rancher for Microsoft AD FS
+weight: 1205
+---
+_Available as of v2.0.7_
+
+After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup/), enter your AD FS information into Rancher to allow AD FS users to authenticate with Rancher.
+
+>**Important Notes For Configuring Your AD FS Server:**
+> 
+>- The SAML 2.0 WebSSO Protocol Service URL is: `https://<RANCHER_SERVER>/v1-saml/adfs/saml/acs`
+>- The Relying Party Trust identifier URL is: `https://<RANCHER_SERVER>/v1-saml/adfs/saml/metadata`
+>- You must export the `federationmetadata.xml` file from your AD FS server. This can be found at: `https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml`
+
+
+1.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+1.	Select **Microsoft Active Directory Federation Services**.
+
+1.	Complete the **Configure AD FS Account** form. Microsoft AD FS lets you specify an existing Active Directory (AD) server. The examples below describe how you can map AD attributes to fields within Rancher.
+
+    | Field                     | Description                                                                                                                                                                                                    |
+    | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+    | Display Name Field        | The AD attribute that contains the display name of users. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`                                                                      |
+    | User Name Field           | The AD attribute that contains the user name/given name. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`                                                                  |
+    | UID Field                 | An AD attribute that is unique to every user. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn`                                                                                   |
+    | Groups Field              | Make entries for managing group memberships. <br/><br/>Example: `http://schemas.xmlsoap.org/claims/Group`                                                                                                      |
+    | Rancher API Host          | The URL for your Rancher Server.                                                                                                                                                                               |
+    | Private Key / Certificate | This is a key-certificate pair to create a secure shell between Rancher and your AD FS. Ensure you set the Common Name (CN) to your Rancher Server URL.<br/><br/>[Certificate creation command](#cert-command) |
+    | Metadata XML              | The `federationmetadata.xml` file exported from your AD FS server. <br/><br/>You can find this file at `https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml`.                                |
+    <a id="cert-command"></a>    
+
+    >**Tip:** You can generate a certificate using an openssl command. For example:
+    >
+    >        openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+
+
+ 
+1. After you complete the **Configure AD FS Account** form, click **Authenticate with AD FS**, which is at the bottom of the page.
+
+    Rancher redirects you to the AD FS login page. Enter credentials that authenticate with Microsoft AD FS to validate your Rancher AD FS configuration.
+
+    >**Note:** You may have to disable your popup blocker to see the AD FS login page.
+
+**Result:** Rancher is configured to work with MS FS. Your users can now sign into Rancher using their MS FS logins.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/okta/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/okta/_index.md
new file mode 100644
index 00000000000..40563ce58ef
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/okta/_index.md
@@ -0,0 +1,53 @@
+---
+title: Configuring Okta (SAML)
+weight: 10
+---
+
+_Available as of v2.2.0_
+
+If your organization uses Okta Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
+
+>**Note:** Okta integration only supports Service Provider initiated logins.
+
+## Prerequisites
+
+In Okta, create a SAML Application with the settings below. See the [Okta documentation](https://developer.okta.com/standards/SAML/setting_up_a_saml_application_in_okta) for help.
+
+Setting | Value    
+------------|------------
+`Single Sign on URL` | `https://yourRancherHostURL/v1-saml/okta/saml/acs`
+`Audience URI (SP Entity ID)` | `https://yourRancherHostURL/v1-saml/okta/saml/metadata`
+
+## Configuring Okta in Rancher
+
+1.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+1.	Select **Okta**.
+
+1.	Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes from attribute statements to fields within Rancher.
+
+    | Field                     | Description                                                                   |
+    | ------------------------- | ----------------------------------------------------------------------------- |
+    | Display Name Field        | The attribute name from an attribute statement that contains the display name of users.                        |
+    | User Name Field           | The attribute name from an attribute statement that contains the user name/given name.                         |
+    | UID Field                 | The attribute name from an attribute statement that is unique to every user.                                    |
+    | Groups Field              | The attribute name in a group attribute statement that exposes your groups.        |
+    | Rancher API Host          | The URL for your Rancher Server.                                              |
+    | Private Key / Certificate | A key/certificate pair used for Assertion Encryption.                         |
+    | Metadata XML              | The `Identity Provider metadata` file that you find in the application `Sign On` section.  |
+
+    >**Tip:** You can generate a key/certificate pair using an openssl command. For example:
+    >    
+    >        openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.crt
+
+
+
+1. After you complete the **Configure Okta Account** form, click **Authenticate with Okta**, which is at the bottom of the page.
+
+    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Okta IdP to validate your Rancher Okta configuration.
+
+    >**Note:** If nothing seems to happen, it's likely because your browser blocked the pop-up. Make sure you disable the pop-up blocker for your rancher domain and whitelist it in any other extensions you might utilize.
+
+**Result:** Rancher is configured to work with Okta. Your users can now sign into Rancher using their Okta logins.
+
+{{< saml_caveats >}}
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/_index.md
new file mode 100644
index 00000000000..cab417e2616
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/_index.md
@@ -0,0 +1,50 @@
+---
+title: Configuring OpenLDAP
+weight: 3
+---
+
+_Available as of v2.0.5_
+
+If your organization uses LDAP for user authentication, you can configure Rancher to communicate with an OpenLDAP server to authenticate users. This allows Rancher admins to control access to clusters and projects based on users and groups managed externally in the organisation's central user repository, while allowing end-users to authenticate with their LDAP credentials when logging in to the Rancher UI. 
+
+## Prerequisites
+
+Rancher must be configured with a LDAP bind account (aka service account) to search and retrieve LDAP entries pertaining to users and groups that should have access. It is recommended to not use an administrator account or personal account for this purpose and instead create a dedicated account in OpenLDAP with read-only access to users and groups under the configured search base (see below).
+
+> **Using TLS?**
+>
+> If the certificate used by the OpenLDAP server is self-signed or not from a recognised certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
+
+## Configure OpenLDAP in Rancher
+
+Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.](./openldap-config)
+
+> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
+
+1. Log into the Rancher UI using the initial local `admin` account.
+2. From the **Global** view, navigate to **Security** > **Authentication**
+3. Select **OpenLDAP**. The **Configure an OpenLDAP server** form will be displayed.
+
+### Test Authentication
+
+Once you have completed the configuration, proceed by testing  the connection to the OpenLDAP server. Authentication with OpenLDAP will be enabled implicitly if the test is successful.
+
+> **Note:**
+>
+> The OpenLDAP user pertaining to the credentials entered in this step will be mapped to the local principal account and assigned administrator privileges in Rancher. You should therefore make a conscious decision on which LDAP account you use to perform this step.
+
+1. Enter the **username** and **password** for the OpenLDAP account that should be mapped to the local principal account.
+2. Click **Authenticate With OpenLDAP** to test the OpenLDAP connection and finalise the setup.
+
+**Result:**
+
+- OpenLDAP authentication is configured.
+- The LDAP user pertaining to the entered credentials is mapped to the local principal (administrative) account.
+
+> **Note:**
+>
+> You will still be able to login using the locally configured `admin` account and password in case of a disruption of LDAP services.
+
+## Annex: Troubleshooting
+
+If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/openldap-config/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/openldap-config/_index.md
new file mode 100644
index 00000000000..addd6773a60
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/openldap-config/_index.md
@@ -0,0 +1,86 @@
+---
+title: OpenLDAP Configuration Reference
+weight: 2
+---
+
+This section is intended to be used as a reference when setting up an OpenLDAP authentication provider in Rancher.
+
+For further details on configuring OpenLDAP, refer to the [official documentation.](https://www.openldap.org/doc/)
+
+> Before you proceed with the configuration, please familiarize yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
+
+- [Background: OpenLDAP Authentication Flow](#background-openldap-authentication-flow)
+- [OpenLDAP server configuration](#openldap-server-configuration)
+- [User/group schema configuration](#user-group-schema-configuration)
+  - [User schema configuration](#user-schema-configuration)
+  - [Group schema configuration](#group-schema-configuration)
+
+## Background: OpenLDAP Authentication Flow 
+ 
+1. When a user attempts to login with his LDAP credentials, Rancher creates an initial bind to the LDAP server using a service account with permissions to search the directory and read user/group attributes. 
+2. Rancher then searches the directory for the user by using a search filter based on the provided username and configured attribute mappings. 
+3. Once the user has been found, he is authenticated with another LDAP bind request using the user's DN and provided password. 
+4. Once authentication succeeded, Rancher then resolves the group memberships both from the membership attribute in the user's object and by performing a group search based on the configured user mapping attribute.
+
+# OpenLDAP Server Configuration
+
+You will need to enter the address, port, and protocol to connect to your OpenLDAP server. `389` is the standard port for insecure traffic, `636` for TLS traffic.
+
+> **Using TLS?**
+>
+> If the certificate used by the OpenLDAP server is self-signed or not from a recognized certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
+
+If you are in doubt about the correct values to enter in the user/group Search Base configuration fields, consult your LDAP administrator or refer to the section [Identify Search Base and Schema using ldapsearch]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/#annex-identify-search-base-and-schema-using-ldapsearch) in the Active Directory authentication documentation.
+
+<figcaption>OpenLDAP Server Parameters</figcaption>
+
+| Parameter | Description |
+|:--|:--|
+| Hostname | Specify the hostname or IP address of the OpenLDAP server |
+| Port | Specify the port at which the OpenLDAP server is listening for connections. Unencrypted LDAP normally uses the standard port of 389, while LDAPS uses port 636.|
+| TLS | Check this box to enable LDAP over SSL/TLS (commonly known as LDAPS). You will also need to paste in the CA certificate if the server uses a self-signed/enterprise-signed certificate. |
+| Server Connection Timeout | 	The duration in number of seconds that Rancher waits before considering the server unreachable. |
+| Service Account Distinguished Name | Enter the Distinguished Name (DN) of the user that should be used to bind, search and retrieve LDAP entries. (see [Prerequisites](#prerequisites)). |
+| Service Account Password | The password for the service account.  |
+| User Search Base | Enter the Distinguished Name of the node in your directory tree from which to start searching for user objects. All users must be descendents of this base DN. For example: "ou=people,dc=acme,dc=com".|
+| Group Search Base | If your groups live under a different node than the one configured under `User Search Base` you will need to provide the Distinguished Name here. Otherwise leave this field empty. For example: "ou=groups,dc=acme,dc=com".|
+
+# User/Group Schema Configuration
+
+If your OpenLDAP directory deviates from the standard OpenLDAP schema, you must complete the **Customize Schema** section to match it.
+
+Note that the attribute mappings configured in this section are used by Rancher to construct search filters and resolve group membership. It is therefore always recommended to verify that the configuration here matches the schema used in your OpenLDAP.
+
+If you are unfamiliar with the user/group schema used in the OpenLDAP server, consult your LDAP administrator or refer to the section [Identify Search Base and Schema using ldapsearch]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/#annex-identify-search-base-and-schema-using-ldapsearch) in the Active Directory authentication documentation.
+
+### User Schema Configuration
+
+The table below details the parameters for the user schema configuration.
+
+<figcaption>User Schema Configuration Parameters</figcaption>
+
+| Parameter | Description |
+|:--|:--|
+| Object Class | The name of the object class used for user objects in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx) |
+| Username Attribute | The user attribute whose value is suitable as a display name. |
+| Login Attribute | The attribute whose value matches the username part of credentials entered by your users when logging in to Rancher. This is typically `uid`. |
+| User Member Attribute | The user attribute containing the Distinguished Name of groups a user is member of. Usually this is one of `memberOf` or `isMemberOf`. |
+| Search Attribute | When a user enters text to add users or groups in the UI, Rancher queries the LDAP server and attempts to match users by the attributes provided in this setting. Multiple attributes can be specified by separating them with the pipe ("\|") symbol. |
+| User Enabled Attribute | If the schema of your OpenLDAP server supports a user attribute whose value can be evaluated to determine if the account is disabled or locked, enter the name of that attribute. The default OpenLDAP schema does not support this and the field should usually be left empty. |
+| Disabled Status Bitmask | This is the value for a disabled/locked user account. The parameter is ignored if `User Enabled Attribute` is empty. |
+
+### Group Schema Configuration
+
+The table below details the parameters for the group schema configuration.
+
+<figcaption>Group Schema Configuration Parameters<figcaption>
+
+| Parameter | Description |
+|:--|:--|
+| Object Class | The name of the object class used for group entries in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx) |
+| Name Attribute | The group attribute whose value is suitable for a display name. |
+| Group Member User Attribute | The name of the **user attribute** whose format matches the group members in the `Group Member Mapping Attribute`. |
+| Group Member Mapping Attribute | The name of the group attribute containing the members of a group. |
+| Search Attribute | Attribute used to construct search filters when adding groups to clusters or projects in the UI. See description of user schema `Search Attribute`. |
+| Group DN Attribute | The name of the group attribute whose format matches the values in the user's group membership attribute. See  `User Member Attribute`. |
+| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organization makes use of these nested memberships (ie. you have groups that contain other groups as members). This option is disabled if you are using Shibboleth. |
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ping-federate/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ping-federate/_index.md
new file mode 100644
index 00000000000..a561c859539
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ping-federate/_index.md
@@ -0,0 +1,52 @@
+---
+title: Configuring PingIdentity (SAML)
+weight: 8
+---
+_Available as of v2.0.7_
+
+If your organization uses Ping Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
+
+>**Prerequisites:**
+>
+>- You must have a [Ping IdP Server](https://www.pingidentity.com/) configured.
+>- Following are the Rancher Service Provider URLs needed for configuration:
+Metadata URL: `https://<rancher-server>/v1-saml/ping/saml/metadata`
+Assertion Consumer Service (ACS) URL: `https://<rancher-server>/v1-saml/ping/saml/acs`
+Note that these URLs will not return valid data until the authentication configuration is saved in Rancher.
+>- Export a `metadata.xml` file from your IdP Server. For more information, see the [PingIdentity documentation](https://documentation.pingidentity.com/pingfederate/pf83/index.shtml#concept_exportingMetadata.html).
+
+1.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+1.	Select **PingIdentity**.
+
+1.	Complete the **Configure Ping Account** form. Ping IdP lets you specify what data store you want to use. You can either add a database or use an existing ldap server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher.
+
+    1. **Display Name Field**: Enter the AD attribute that contains the display name of users (example: `displayName`).
+
+	1. **User Name Field**: Enter the AD attribute that contains the user name/given name (example: `givenName`).
+
+    1. **UID Field**: Enter an AD attribute that is unique to every user (example: `sAMAccountName`, `distinguishedName`).
+
+    1. **Groups Field**: Make entries for managing group memberships (example: `memberOf`).
+
+    1. **Rancher API Host**: Enter the URL for your Rancher Server.
+
+	1. **Private Key** and **Certificate**: This is a key-certificate pair to create a secure shell between Rancher and your IdP.
+
+        You can generate one using an openssl command. For example:
+
+        ```
+        openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+        ```
+    1. **IDP-metadata**: The `metadata.xml` file that you [exported from your IdP server](https://documentation.pingidentity.com/pingfederate/pf83/index.shtml#concept_exportingMetadata.html).
+
+
+1. After you complete the **Configure Ping Account** form, click **Authenticate with Ping**, which is at the bottom of the page.
+
+    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Ping IdP to validate your Rancher PingIdentity configuration.
+
+    >**Note:** You may have to disable your popup blocker to see the IdP login page.
+
+**Result:** Rancher is configured to work with PingIdentity. Your users can now sign into Rancher using their PingIdentity logins.
+
+{{< saml_caveats >}}
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/_index.md
new file mode 100644
index 00000000000..cc4f7dc17ed
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/_index.md
@@ -0,0 +1,109 @@
+---
+title: Configuring Shibboleth (SAML)
+weight: 11
+---
+
+_Available as of v2.4.0_
+
+If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials.
+
+In this configuration, when Rancher users log in, they will be redirected to the Shibboleth IdP to enter their credentials. After authentication, they will be redirected back to the Rancher UI.
+
+If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then the authenticated user will be able to access resources in Rancher that their groups have permissions for.
+
+> The instructions in this section assume that you understand how Rancher, Shibboleth, and OpenLDAP work together. For a more detailed explanation of how it works, refer to [this page.](./about)
+
+This section covers the following topics:
+
+- [Setting up Shibboleth in Rancher](#setting-up-shibboleth-in-rancher)
+  - [Shibboleth Prerequisites](#shibboleth-prerequisites)
+  - [Configure Shibboleth in Rancher](#configure-shibboleth-in-rancher)
+  - [SAML Provider Caveats](#saml-provider-caveats)
+- [Setting up OpenLDAP in Rancher](#setting-up-openldap-in-rancher)
+  - [OpenLDAP Prerequisites](#openldap-prerequisites)
+  - [Configure OpenLDAP in Rancher](#configure-openldap-in-rancher)
+  - [Troubleshooting](#troubleshooting)
+
+# Setting up Shibboleth in Rancher
+
+### Shibboleth Prerequisites
+>
+>- You must have a Shibboleth IdP Server configured.
+>- Following are the Rancher Service Provider URLs needed for configuration:
+Metadata URL: `https://<rancher-server>/v1-saml/shibboleth/saml/metadata`
+Assertion Consumer Service (ACS) URL: `https://<rancher-server>/v1-saml/shibboleth/saml/acs`
+>- Export a `metadata.xml` file from your IdP Server. For more information, see the [Shibboleth documentation.](https://wiki.shibboleth.net/confluence/display/SP3/Home)
+
+### Configure Shibboleth in Rancher
+If your organization uses Shibboleth for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
+
+1.	From the **Global** view, select **Security > Authentication** from the main menu.
+
+1.	Select **Shibboleth**.
+
+1.	Complete the **Configure Shibboleth Account** form. Shibboleth IdP lets you specify what data store you want to use. You can either add a database or use an existing ldap server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher.
+
+    1. **Display Name Field**: Enter the AD attribute that contains the display name of users (example: `displayName`).
+
+	1. **User Name Field**: Enter the AD attribute that contains the user name/given name (example: `givenName`).
+
+    1. **UID Field**: Enter an AD attribute that is unique to every user (example: `sAMAccountName`, `distinguishedName`).
+
+    1. **Groups Field**: Make entries for managing group memberships (example: `memberOf`).
+
+    1. **Rancher API Host**: Enter the URL for your Rancher Server.
+
+	1. **Private Key** and **Certificate**: This is a key-certificate pair to create a secure shell between Rancher and your IdP.
+
+        You can generate one using an openssl command. For example:
+
+        ```
+        openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+        ```
+    1. **IDP-metadata**: The `metadata.xml` file that you exported from your IdP server.
+
+
+1. After you complete the **Configure Shibboleth Account** form, click **Authenticate with Shibboleth**, which is at the bottom of the page.
+
+    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Shibboleth IdP to validate your Rancher Shibboleth configuration.
+
+    >**Note:** You may have to disable your popup blocker to see the IdP login page.
+
+**Result:** Rancher is configured to work with Shibboleth. Your users can now sign into Rancher using their Shibboleth logins.
+
+### SAML Provider Caveats
+
+If you configure Shibboleth without OpenLDAP, the following caveats apply due to the fact that SAML Protocol does not support search or lookup for users or groups.
+
+- There is no validation on users or groups when assigning permissions to them in Rancher.
+- When adding users, the exact user IDs (i.e. UID Field) must be entered correctly. As you type the user ID, there will be no search for other user IDs that may match.
+- When adding groups, you must select the group from the drop-down that is next to the text box. Rancher assumes that any input from the text box is a user.
+- The group drop-down shows only the groups that you are a member of. You will not be able to add groups that you are not a member of.
+
+To enable searching for groups when assigning permissions in Rancher, you will need to configure a back end for the SAML provider that supports groups, such as OpenLDAP.
+
+# Setting up OpenLDAP in Rancher
+
+If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then authenticated users will be able to access resources in Rancher that their groups have permissions for.
+
+### OpenLDAP Prerequisites
+
+Rancher must be configured with a LDAP bind account (aka service account) to search and retrieve LDAP entries pertaining to users and groups that should have access. It is recommended to not use an administrator account or personal account for this purpose and instead create a dedicated account in OpenLDAP with read-only access to users and groups under the configured search base (see below).
+
+> **Using TLS?**
+>
+> If the certificate used by the OpenLDAP server is self-signed or not from a recognized certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
+
+### Configure OpenLDAP in Rancher
+
+Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/openldap/openldap-config) Note that nested group membership is not available for Shibboleth.
+
+> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
+
+1. Log into the Rancher UI using the initial local `admin` account.
+2. From the **Global** view, navigate to **Security** > **Authentication**
+3. Select **OpenLDAP**. The **Configure an OpenLDAP server** form will be displayed.
+
+# Troubleshooting
+
+If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/about/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/about/_index.md
new file mode 100644
index 00000000000..6a057b2104a
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/about/_index.md
@@ -0,0 +1,34 @@
+---
+title: Group Permissions with Shibboleth and OpenLDAP
+weight: 1
+---
+
+_Available as of Rancher v2.4_
+
+This page provides background information and context for Rancher users who intend to set up the Shibboleth authentication provider in Rancher. 
+
+Because Shibboleth is a SAML provider, it does not support searching for groups. While a Shibboleth integration can validate user credentials, it can't be used to assign permissions to groups in Rancher without additional configuration.
+
+One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI.
+
+### Terminology
+
+- **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships.
+- **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider.
+- **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider.
+- **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider.
+
+### Adding OpenLDAP Group Permissions to Rancher Resources
+
+The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for.
+
+For example, a cluster owner could add an OpenLDAP group to a cluster so that they have permissions view most cluster level resources and create new projects. Then the OpenLDAP group members will have access to the cluster as soon as they log in to Rancher.
+
+In this scenario, OpenLDAP allows the cluster owner to search for groups when assigning persmissions. Without OpenLDAP, the functionality to search for groups would not be supported.
+
+When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shibboleth and enters her username and password.
+
+Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for.
+
+![Adding OpenLDAP Group Permissions to Rancher Resources]({{<baseurl>}}/img/rancher/shibboleth-with-openldap-groups.svg)
+ 
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/user-groups/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/user-groups/_index.md
new file mode 100644
index 00000000000..d88eb423f82
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/authentication/user-groups/_index.md
@@ -0,0 +1,64 @@
+---
+title: Users and Groups
+weight: 1
+---
+
+Rancher relies on users and groups to determine who is allowed to log in to Rancher and which resources they can access. When you configure an external authentication provider, users from that provider will be able to log in to your Rancher server. When a user logs in, the authentication provider will supply your Rancher server with a list of groups to which the user belongs.
+
+Access to clusters, projects, multi-cluster apps, and global DNS providers and entries can be controlled by adding either individual users or groups to these resources. When you add a group to a resource, all users who are members of that group in the authentication provider, will be able to access the resource with the permissions that you've specified for the group. For more information on roles and permissions, see [Role Based Access Control]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/).
+
+## Managing Members
+
+When adding a user or group to a resource, you can search for users or groups by beginning to type their name. The Rancher server will query the authentication provider to find users and groups that match what you've entered. Searching is limited to the authentication provider that you are currently logged in with. For example, if you've enabled GitHub authentication but are logged in using a [local]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/local/) user account, you will not be able to search for GitHub users or groups.
+
+All users, whether they are local users or from an authentication provider, can be viewed and managed. From the **Global** view, click on **Users**.
+
+{{< saml_caveats >}}
+
+## User Information
+
+Rancher maintains information about each user that logs in through an authentication provider. This information includes whether the user is allowed to access your Rancher server and the list of groups that the user belongs to. Rancher keeps this user information so that the CLI, API, and kubectl can accurately reflect the access that the user has based on their group membership in the authentication provider.
+
+Whenever a user logs in to the UI using an authentication provider, Rancher automatically updates this user information.
+
+### Automatically Refreshing User Information
+
+_Available as of v2.2.0_
+
+Rancher will periodically refresh the user information even before a user logs in through the UI. You can control how often Rancher performs this refresh.  From the **Global** view, click on **Settings**. Two settings control this behavior:
+
+- **`auth-user-info-max-age-seconds`**
+
+    This setting controls how old a user's information can be before Rancher refreshes it. If a user makes an API call (either directly or by using the Rancher CLI or kubectl) and the time since the user's last refresh is greater than this setting, then Rancher will trigger a refresh. This setting defaults to `3600` seconds, i.e. 1 hour.
+
+- **`auth-user-info-resync-cron`**
+
+    This setting controls a recurring schedule for resyncing authentication provider information for all users. Regardless of whether a user has logged in or used the API recently, this will cause the user to be refreshed at the specified interval. This setting defaults to `0 0 * * *`, i.e. once a day at midnight. See the [Cron documentation](https://en.wikipedia.org/wiki/Cron) for more information on valid values for this setting.
+
+
+> **Note:** Since SAML does not support user lookup, SAML-based authentication providers do not support periodically refreshing user information. User information will only be refreshed when the user logs into the Rancher UI.
+
+### Manually Refreshing User Information
+
+If you are not sure the last time Rancher performed an automatic refresh of user information, you can perform a manual refresh of all users.
+
+1. From the **Global** view, click on **Users** in the navigation bar.
+
+1. Click on **Refresh Group Memberships**.
+
+**Results:** Rancher refreshes the user information for all users. Requesting this refresh will update which users can access Rancher as well as all the groups that each user belongs to.
+
+>**Note:** Since SAML does not support user lookup, SAML-based authentication providers do not support the ability to manually refresh user information. User information will only be refreshed when the user logs into the Rancher UI.
+
+
+## Session Length
+
+_Available as of v2.3.0_
+
+The default length (TTL) of each user session is adjustable. The default session length is 16 hours.
+
+1. From the **Global** view, click on **Settings**.
+1. In the **Settings** page, find **`auth-user-session-ttl-minutes`** and click **Edit.**
+1. Enter the amount of time in minutes a session length should last and click **Save.**
+
+**Result:** Users are automatically logged out of Rancher after the set number of minutes.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/_index.md
new file mode 100644
index 00000000000..610aed2ab4a
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/_index.md
@@ -0,0 +1,28 @@
+---
+title: Role-Based Access Control (RBAC)
+weight: 2
+---
+
+> This section is under construction.
+
+Within Rancher, each person authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned in [Authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/), users can either be local or external.
+
+After you configure external authentication, the users that display on the **Users** page changes.
+
+- If you are logged in as a local user, only local users display.
+
+- If you are logged in as an external user, both external and local users display.
+
+## Users and Roles
+
+Once the user logs in to Rancher, their _authorization_, or their access rights within the system, is determined by _global permissions_, and _cluster and project roles_.  
+
+- [Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/):
+
+    Define user authorization outside the scope of any particular cluster.
+
+- [Cluster and Project Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/):
+
+    Define user authorization inside the specific cluster or project where they are assigned the role.
+
+Both global permissions and cluster and project roles are implemented on top of [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/). Therefore, enforcement of permissions and roles is performed by Kubernetes.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/add-users-to-cluster/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/add-users-to-cluster/_index.md
new file mode 100644
index 00000000000..60ca968ebdd
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/add-users-to-cluster/_index.md
@@ -0,0 +1,55 @@
+---
+title: Adding Users to a Cluster
+weight: 1
+---
+
+> This section is under construction.
+
+If you want to provide a user with access and permissions to _all_ projects, nodes, and resources within a cluster, assign the user a cluster membership.
+
+>**Tip:** Want to provide a user with access to a _specific_ project within a cluster? See [Adding Project Members]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/project-members/) instead.
+
+There are two contexts where you can add cluster members:
+
+- Adding Members to a New Cluster
+
+    You can add members to a cluster as you create it (recommended if possible).
+
+- [Adding Members to an Existing Cluster](#editing-cluster-membership)
+
+    You can always add members to a cluster after a cluster is provisioned.
+
+## Editing Cluster Membership
+
+Cluster administrators can edit the membership for a cluster, controlling which Rancher users can access the cluster and what features they can use.
+
+1. From the **Global** view, open the cluster that you want to add members to.
+
+2. From the main menu, select **Members**. Then click **Add Member**.
+
+3. Search for the user or group that you want to add to the cluster.
+
+ 	If external authentication is configured:
+
+	-  Rancher returns users from your [external authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) source as you type.
+
+		>**Using AD but can't find your users?**
+		>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/).
+
+	- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
+
+		>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
+
+4. Assign the user or group **Cluster** roles.  
+
+	[What are Cluster Roles?]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
+
+	>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
+	>
+	> - To add roles to the list, [Add a Custom Role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/).
+	> - To remove roles from the list, [Lock/Unlock Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles).
+
+**Result:** The chosen users are added to the cluster.
+
+- To revoke cluster membership, select the user and click **Delete**. This action deletes membership, not the user.
+- To modify a user's roles in the cluster, delete them from the cluster, and then re-add them with modified roles.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/default-custom-roles/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/default-custom-roles/_index.md
new file mode 100644
index 00000000000..21a8af43d57
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/default-custom-roles/_index.md
@@ -0,0 +1,164 @@
+---
+title: Custom Roles
+weight: 2
+---
+
+Within Rancher, _roles_ determine what actions a user can make within a cluster or project.
+
+Note that _roles_ are different from _permissions_, which determine what clusters and projects you can access.
+
+This section covers the following topics:
+
+- [Prerequisites](#prerequisites)
+- [Creating a custom role for a cluster or project](#creating-a-custom-role-for-a-cluster-or-project)
+- [Creating a custom global role](#creating-a-custom-global-role)
+- [Deleting a custom global role](#deleting-a-custom-global-role)
+- [Assigning a custom global role to a group](#assigning-a-custom-global-role-to-a-group)
+
+## Prerequisites
+
+To complete the tasks on this page, one of the following permissions are required:
+
+ - [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/).
+ - [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
+
+## Creating A Custom Role for a Cluster or Project
+
+While Rancher comes out-of-the-box with a set of default user roles, you can also create default custom roles to provide users with very specific permissions within Rancher.
+
+The steps to add custom roles differ depending on the version of Rancher.
+
+{{% tabs %}}
+{{% tab "Rancher v2.0.7+" %}}
+
+1.  From the **Global** view, select **Security > Roles** from the main menu.
+
+1.  Select a tab to determine the scope of the roles you're adding. The tabs are:
+
+  - **Cluster:** The role is valid for assignment when adding/managing members to _only_ clusters.
+  - **Project:** The role is valid for assignment when adding/managing members to _only_ projects.
+
+1.  Click **Add Cluster/Project Role.**
+
+1.  **Name** the role.
+
+1.  Optional: Choose the **Cluster/Project Creator Default** option to assign this role to a user when they create a new cluster or project. Using this feature, you can expand or restrict the default roles for cluster/project creators.
+
+    > Out of the box, the Cluster Creator Default and the Project Creator Default roles are `Cluster Owner` and `Project Owner` respectively.
+
+1.  Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role.
+
+    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+
+    You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign.
+
+1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. Note: When a custom role inherits from a parent role, the parent role cannot be deleted until the child role is deleted.
+
+1.  Click **Create**.
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.0.7" %}}
+
+1.  From the **Global** view, select **Security > Roles** from the main menu.
+
+1.  Click **Add Role**.
+
+1.  **Name** the role.
+
+1.  Choose whether to set the role to a status of [locked]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/).
+
+    > **Note:** Locked roles cannot be assigned to users.
+
+1.  In the **Context** dropdown menu, choose the scope of the role assigned to the user. The contexts are:
+
+    - **All:** The user can use their assigned role regardless of context. This role is valid for assignment when adding/managing members to clusters or projects.
+
+    - **Cluster:** This role is valid for assignment when adding/managing members to _only_ clusters.
+
+    - **Project:** This role is valid for assignment when adding/managing members to _only_ projects.
+
+1.  Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role.
+
+    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+
+    You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign.
+
+1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. Note: When a custom role inherits from a parent role, the parent role cannot be deleted until the child role is deleted.
+
+1.  Click **Create**.
+
+{{% /tab %}}
+{{% /tabs %}}
+
+## Creating a Custom Global Role
+
+_Available as of v2.4.0_
+
+### Creating a Custom Global Role that Copies Rules from an Existing Role
+
+If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role in which all of the rules from another role, such as the administrator role, are copied into a new role. This allows you to only configure the variations between the existing role and the new role.
+
+The custom global role can then be assigned to a user or group so that the custom global role takes effect the first time the user or users sign into Rancher.
+
+To create a custom global role based on an existing role,
+
+1. Go to the **Global** view and click **Security > Roles.**
+1. On the **Global** tab, go to the role that the custom global role will be based on. Click **&#8942; (…) > Clone.**
+1. Enter a name for the role.
+1. Optional: To assign the custom role default for new users, go to the **New User Default** section and click **Yes: Default role for new users.**
+1. In the **Grant Resources** section, select the Kubernetes resource operations that will be enabled for users with the custom role.
+1. Click **Save.**
+
+### Creating a Custom Global Role that Does Not Copy Rules from Another Role
+
+Custom global roles don't have to be based on existing roles. To create a custom global role by choosing the specific Kubernetes resource operations that should be allowed for the role, follow these steps:
+
+1. Go to the **Global** view and click **Security > Roles.**
+1. On the **Global** tab, click **Add Global Role.**
+1. Enter a name for the role.
+1. Optional: To assign the custom role default for new users, go to the **New User Default** section and click **Yes: Default role for new users.**
+1. In the **Grant Resources** section, select the Kubernetes resource operations that will be enabled for users with the custom role.
+1. Click **Save.**
+
+## Deleting a Custom Global Role
+
+_Available as of v2.4.0_
+
+When deleting a custom global role, all global role bindings with this custom role are deleted.
+
+If a user is only assigned one custom global role, and the role is deleted, the user would lose access to Rancher. For the user to regain access, an administrator would need to edit the user and apply new global permissions.
+
+Custom global roles can be deleted, but built-in roles cannot be deleted.
+
+To delete a custom global role,
+
+1. Go to the **Global** view and click **Security > Roles.**
+2. On the **Global** tab, go to the custom global role that should be deleted and click **&#8942; (…) > Delete.**
+3. Click **Delete.**
+
+## Assigning a Custom Global Role to a Group
+
+_Available as of v2.4.0_
+
+If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role. When the role is assigned to a group, the users in the group have the appropriate level of access the first time they sign into Rancher.
+
+When a user in the group logs in, they get the built-in Standard User global role by default. They will also get the permissions assigned to their groups.
+
+If a user is removed from the external authentication provider group, they would lose their permissions from the custom global role that was assigned to the group. They would continue to have their individual Standard User role.
+
+> **Prerequisites:** You can only assign a global role to a group if:
+>
+> * You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-vs-local-authentication)
+> * The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/user-groups/)
+> * You have already set up at least one user group with the authentication provider
+
+To assign a custom global role to a group, follow these steps:
+
+1. From the **Global** view, go to **Security > Groups.**
+1. Click **Assign Global Role.**
+1. In the **Select Group To Add** field, choose the existing group that will be assigned the custom global role.
+1. In the **Custom** section, choose any custom global role that will be assigned to the group.
+1. Optional: In the **Global Permissions** or **Built-in** sections, select any additional permissions that the group should have.
+1. Click **Create.**
+
+**Result:** The custom global role will take effect when the users in the group log into Rancher.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/locked-roles/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/locked-roles/_index.md
new file mode 100644
index 00000000000..616982432a5
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/locked-roles/_index.md
@@ -0,0 +1,37 @@
+---
+title: Locked Roles
+weight: 3
+---
+
+You can set roles to a status of `locked`. Locking roles prevent them from being assigned users in the future.
+
+Locked roles:
+
+- Cannot be assigned to users that don't already have it assigned.
+- Are not listed in the **Member Roles** drop-down when you are adding a user to a cluster or project.
+- Do not affect users assigned the role before you lock the role. These users retain access that the role provides.
+
+    **Example:** let's say your organization creates an internal policy that users assigned to a cluster are prohibited from creating new projects. It's your job to enforce this policy.
+
+    To enforce it, before you add new users to the cluster, you should lock the following roles: `Cluster Owner`, `Cluster Member`, and `Create Projects`. Then you could create a new custom role that includes the same permissions as a __Cluster Member__, except the ability to create projects. Then, you use this new custom role when adding users to a cluster.
+
+Roles can be locked by the following users:
+
+- Any user assigned the `Administrator` global permission.
+- Any user assigned the `Custom Users` permission, along with the `Manage Roles` role.
+
+
+## Locking/Unlocking Roles
+
+If you want to prevent a role from being assigned to users, you can set it to a status of `locked`.
+
+You can lock roles in two contexts:
+
+- When you're [adding a custom role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/).
+- When you editing an existing role (see below).
+
+1. From the **Global** view, select **Security** > **Roles**.
+
+2. From the role that you want to lock (or unlock), select **&#8942;** > **Edit**.
+
+3. From the **Locked** option, choose the **Yes** or **No** radio button. Then click **Save**.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/_index.md
new file mode 100644
index 00000000000..bcbb52e72eb
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/_index.md
@@ -0,0 +1,7 @@
+---
+title: Access Control for the Enterprise Cluster Manager and Projects
+shortTitle: Enterprise Cluster Manager
+weight: 4
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/ace/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/ace/_index.md
new file mode 100644
index 00000000000..3a1c87250e4
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/ace/_index.md
@@ -0,0 +1,43 @@
+---
+title: How the Authorized Cluster Endpoint Works
+weight: 7
+---
+
+This section describes how the kubectl CLI, the kubeconfig file, and the authorized cluster endpoint work together to allow you to access a downstream Kubernetes cluster directly, without authenticating through the Rancher server. It is intended to provide background information and context to the instructions for [how to set up kubectl to directly access a cluster.](../kubectl/#authenticating-directly-with-a-downstream-cluster)
+
+### About the kubeconfig File
+
+The _kubeconfig file_ is a file used to configure access to Kubernetes when used in conjunction with the kubectl command line tool (or other clients).
+
+This kubeconfig file and its contents are specific to the cluster you are viewing. It can be downloaded from the cluster view in Rancher. You will need a separate kubeconfig file for each cluster that you have access to in Rancher.
+
+After you download the kubeconfig file, you will be able to use the kubeconfig file and its Kubernetes [contexts](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#kubectl-context-and-configuration) to access your downstream cluster.
+
+### Two Authentication Methods for RKE Clusters
+
+If the cluster is not an [RKE cluster,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) the kubeconfig file allows you to access the cluster in only one way: it lets you be authenticated with the Rancher server, then Rancher allows you to run kubectl commands on the cluster.
+
+For RKE clusters, the kubeconfig file allows you to be authenticated in two ways:
+
+- **Through the Rancher server authentication proxy:** Rancher's authentication proxy validates your identity, then connects you to the downstream cluster that you want to access.
+- **Directly with the downstream cluster's API server:** RKE clusters have an authorized cluster endpoint enabled by default. This endpoint allows you to access your downstream Kubernetes cluster with the kubectl CLI and a kubeconfig file, and it is enabled by default for RKE clusters. In this scenario, the downstream cluster's Kubernetes API server authenticates you by calling a webhook (the `kube-api-auth` microservice) that Rancher set up.
+
+This second method, the capability to connect directly to the cluster's Kubernetes API server, is important because it lets you access your downstream cluster if you can't connect to Rancher.
+
+To use the authorized cluster endpoint, you will need to configure kubectl to use the extra kubectl context in the kubeconfig file that Rancher generates for you when the RKE cluster is created. This file can be downloaded from the cluster view in the Rancher UI, and the instructions for configuring kubectl are on [this page.](../kubectl/#authenticating-directly-with-a-downstream-cluster)
+
+These methods of communicating with downstream Kubernetes clusters are also explained in the [architecture page]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#communicating-with-downstream-user-clusters) in the larger context of explaining how Rancher works and how Rancher communicates with downstream clusters.
+
+### About the kube-api-auth Authentication Webhook
+
+The `kube-api-auth` microservice is deployed to provide the user authentication functionality for the [authorized cluster endpoint,]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) which is only available for [RKE clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) When you access the user cluster using `kubectl`, the cluster's Kubernetes API server authenticates you by using the `kube-api-auth` service as a webhook.
+
+During cluster provisioning, the file `/etc/kubernetes/kube-api-authn-webhook.yaml` is deployed and `kube-apiserver` is configured with `--authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml`. This configures the `kube-apiserver` to query `http://127.0.0.1:6440/v1/authenticate` to determine authentication for bearer tokens.
+
+The scheduling rules for `kube-api-auth` are listed below:
+
+_Applies to v2.3.0 and higher_
+
+| Component            | nodeAffinity nodeSelectorTerms             | nodeSelector | Tolerations                                                                    |
+| -------------------- | ------------------------------------------ | ------------ | ------------------------------------------------------------------------------ |
+| kube-api-auth        | `beta.kubernetes.io/os:NotIn:windows`<br/>`node-role.kubernetes.io/controlplane:In:"true"` | none         | `operator:Exists`              |
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
new file mode 100644
index 00000000000..4260529341f
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
@@ -0,0 +1,183 @@
+---
+title: Cluster and Project Roles
+weight: 5
+---
+
+Cluster and project roles define user authorization inside a cluster or project. You can manage these roles from the **Global > Security > Roles** page.
+
+### Membership and Role Assignment
+
+The projects and clusters accessible to non-administrative users is determined by _membership_. Membership is a list of users who have access to a specific cluster or project based on the roles they were assigned in that cluster or project. Each cluster and project includes a tab that a user with the appropriate permissions can use to manage membership.
+
+When you create a cluster or project, Rancher automatically assigns you as the `Owner` for it. Users assigned the `Owner` role can assign other users roles in the cluster or project.
+
+> **Note:** Non-administrative users cannot access any existing projects/clusters by default. A user with appropriate permissions (typically the owner) must explicitly assign the project and cluster membership.
+
+### Cluster Roles
+
+_Cluster roles_ are roles that you can assign to users, granting them access to a cluster. There are two primary cluster roles: `Owner` and `Member`.
+
+- **Cluster Owner:**
+
+    These users have full control over the cluster and all resources in it.
+
+- **Cluster Member:**
+
+    These users can view most cluster level resources and create new projects.
+
+#### Custom Cluster Roles
+
+Rancher lets you assign _custom cluster roles_ to a standard user instead of the typical `Owner` or `Member` roles. These roles can be either a built-in custom cluster role or one defined by a Rancher administrator. They are convenient for defining narrow or specialized access for a standard user within a cluster. See the table below for a list of built-in custom cluster roles.
+
+#### Cluster Role Reference
+
+The following table lists each built-in custom cluster role available and whether that level of access is included in the default cluster-level permissions, `Cluster Owner` and `Cluster Member`.
+
+| Built-in Cluster Role                | Owner         | Member <a id="clus-roles"></a> |
+| ---------------------------------- | ------------- | --------------------------------- |
+| Create Projects                    | ✓             | ✓                                  |
+| Manage Cluster Backups             | ✓             |                                   |
+| Manage Cluster Catalogs            | ✓             |                                   |
+| Manage Cluster Members             | ✓             |                                   |
+| Manage Nodes                       | ✓             |                                   |
+| Manage Storage                     | ✓             |                                   |
+| View All Projects                  | ✓             |                                  |
+| View Cluster Catalogs              | ✓             | ✓                                 |
+| View Cluster Members               | ✓             | ✓                                 |
+| View Nodes                         | ✓             | ✓                                 |
+
+For details on how each cluster role can access Kubernetes resources, you can go to the **Global** view in the Rancher UI. Then click **Security > Roles** and go to the **Clusters** tab. If you click an individual role, you can refer to the **Grant Resources** table to see all of the operations and resources that are permitted by the role.
+
+> **Note:**
+>When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+
+### Giving a Custom Cluster Role to a Cluster Member
+
+After an administrator [sets up a custom cluster role,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/#adding-a-custom-role) cluster owners and admins can then assign those roles to cluster members.
+
+To assign a custom role to a new cluster member, you can use the Rancher UI. To modify the permissions of an existing member, you will need to use the Rancher API view.
+
+To assign the role to a new cluster member,
+
+1. Go to the **Cluster** view, then go to the **Members** tab.
+1. Click **Add Member.** Then in the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member.
+1. Click **Create.**
+
+**Result:** The member has the assigned role.
+
+To assign any custom role to an existing cluster member,
+
+1. Go to the member you want to give the role to. Click the **&#8942; > View in API.**
+1. In the **roleTemplateId** field, go to the drop-down menu and choose the role you want to assign to the member. Click **Show Request** and **Send Request.**
+
+**Result:** The member has the assigned role.
+
+### Project Roles
+
+_Project roles_ are roles that can be used to grant users access to a project. There are three primary project roles: `Owner`, `Member`, and `Read Only`.
+
+- **Project Owner:**
+
+    These users have full control over the project and all resources in it.
+
+- **Project Member:**
+
+    These users can manage project-scoped resources like namespaces and workloads, but cannot manage other project members.
+
+- **Read Only:**
+
+    These users can view everything in the project but cannot create, update, or delete anything.
+
+    >**Caveat:**
+    >
+    >Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `owner` or `member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned.
+
+
+#### Custom Project Roles
+
+Rancher lets you assign _custom project roles_ to a standard user instead of the typical `Owner`, `Member`, or `Read Only` roles. These roles can be either a built-in custom project role or one defined by a Rancher administrator. They are convenient for defining narrow or specialized access for a standard user within a project. See the table below for a list of built-in custom project roles.
+
+#### Project Role Reference
+
+The following table lists each built-in custom project role available in Rancher and whether it is also granted by the `Owner`, `Member`, or `Read Only` role.
+
+| Built-in Project Role                | Owner         | Member<a id="proj-roles"><a/> | Read Only     |
+| ---------------------------------- | ------------- | ----------------------------- | ------------- |
+| Manage Project Members             | ✓             |                               |               |
+| Create Namespaces                  | ✓             | ✓                             |               |
+| Manage Config Maps                 | ✓             | ✓                             |               |
+| Manage Ingress                     | ✓             | ✓                             |               |
+| Manage Project Catalogs            | ✓             |                               |               |
+| Manage Secrets                     | ✓             | ✓                             |               |
+| Manage Service Accounts            | ✓             | ✓                             |               |
+| Manage Services                    | ✓             | ✓                             |               |
+| Manage Volumes                     | ✓             | ✓                             |               |
+| Manage Workloads                   | ✓             | ✓                             |               |
+| View Config Maps                   | ✓             | ✓                             | ✓             |
+| View Ingress                       | ✓             | ✓                             | ✓             |
+| View Project Members               | ✓             | ✓                             | ✓             |
+| View Project Catalogs              | ✓             | ✓                             | ✓             |
+| View Secrets                       | ✓             | ✓                             | ✓             |
+| View Service Accounts              | ✓             | ✓                             | ✓             |
+| View Services                      | ✓             | ✓                             | ✓             |
+| View Volumes                       | ✓             | ✓                             | ✓             |
+| View Workloads                     | ✓             | ✓                             | ✓             |
+
+> **Notes:**
+>
+>- Each project role listed above, including `Owner`, `Member`, and `Read Only`, is comprised of multiple rules granting access to various resources. You can view the roles and their rules on the Global > Security > Roles page.
+>- When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+>- The `Manage Project Members` role allows the project owner to manage any members of the project **and** grant them any project scoped role regardless of their access to the project resources. Be cautious when assigning this role out individually.
+
+### Defining Custom Roles
+As previously mentioned, custom roles can be defined for use at the cluster or project level. The context field defines whether the role will appear on the cluster member page, project member page, or both.
+
+When defining a custom role, you can grant access to specific resources or specify roles from which the custom role should inherit. A custom role can be made up of a combination of specific grants and inherited roles. All grants are additive. This means that defining a narrower grant for a specific resource **will not** override a broader grant defined in a role that the custom role is inheriting from.
+
+### Default Cluster and Project Roles
+
+By default, when a standard user creates a new cluster or project, they are automatically assigned an ownership role: either [cluster owner](#cluster-roles) or [project owner](#project-roles). However, in some organizations, these roles may overextend administrative access. In this use case, you can change the default role to something more restrictive, such as a set of individual roles or a custom role.
+
+There are two methods for changing default cluster/project roles:
+
+- **Assign Custom Roles**: Create a [custom role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles) for either your [cluster](#custom-cluster-roles) or [project](#custom-project-roles), and then set the custom role as default.
+
+- **Assign Individual Roles**: Configure multiple [cluster](#cluster-role-reference)/[project](#project-role-reference) roles as default for assignment to the creating user.
+
+    For example, instead of assigning a role that inherits other roles (such as `cluster owner`), you can choose a mix of individual roles (such as `manage nodes` and `manage storage`).
+
+>**Note:**
+>
+>- Although you can [lock]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/) a default role, the system still assigns the role to users who create a cluster/project.
+>- Only users that create clusters/projects inherit their roles. Users added to the cluster/project membership afterward must be explicitly assigned their roles.
+
+### Configuring Default Roles for Cluster and Project Creators
+
+You can change the cluster or project role(s) that are automatically assigned to the creating user.
+
+1. From the **Global** view, select **Security > Roles** from the main menu. Select either the **Cluster** or **Project** tab.
+
+1. Find the custom or individual role that you want to use as default. Then edit the role by selecting **&#8942; > Edit**.
+
+1. Enable the role as default.
+{{% accordion id="cluster" label="For Clusters" %}}
+1. From **Cluster Creator Default**, choose **Yes: Default role for new cluster creation**.
+1. Click **Save**.
+{{% /accordion %}}
+{{% accordion id="project" label="For Projects" %}}
+1. From **Project Creator Default**, choose **Yes: Default role for new project creation**.
+1. Click **Save**.
+{{% /accordion %}}
+
+1. If you want to remove a default role, edit the permission and select **No** from the default roles option.
+
+**Result:** The default roles are configured based on your changes. Roles assigned to cluster/project creators display a check in the **Cluster/Project Creator Default** column.
+
+### Cluster Membership Revocation Behavior
+
+When you revoke the cluster membership for a standard user that's explicitly assigned membership to both the cluster _and_ a project within the cluster, that standard user [loses their cluster roles](#clus-roles) but [retains their project roles](#proj-roles). In other words, although you have revoked the user's permissions to access the cluster and its nodes, the standard user can still:
+
+- Access the projects they hold membership in.
+- Exercise any [individual project roles](#project-role-reference) they are assigned.
+
+If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/custom-global-roles/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
new file mode 100644
index 00000000000..150011ee05e
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
@@ -0,0 +1,6 @@
+---
+title: Custom Global Roles
+weight: 3
+---
+
+This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/global-permissions/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/global-permissions/_index.md
new file mode 100644
index 00000000000..7948e1648dd
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/global-permissions/_index.md
@@ -0,0 +1,174 @@
+---
+title: Global Permissions
+weight: 4
+---
+
+_Permissions_ are individual access rights that you can assign when selecting a custom permission for a user.
+
+Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are three default global permissions: `Administrator`, `Standard User` and `User-base`.
+
+- **Administrator:** These users have full control over the entire Rancher system and all clusters within it.
+
+- <a id="user"></a>**Standard User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters.
+
+- **User-Base:** User-Base users have login-access only.
+
+You cannot update or delete the built-in Global Permissions.
+
+This section covers the following topics:
+
+- [Global permission assignment](#global-permission-assignment)
+  - [Global permissions for new local users](#global-permissions-for-new-local-users)
+  - [Global permissions for users with external authentication](#global-permissions-for-users-with-external-authentication)
+- [Custom global permissions](#custom-global-permissions)
+  - [Custom global permissions reference](#custom-global-permissions-reference)
+  - [Configuring default global permissions for new users](#configuring-default-global-permissions)
+  - [Configuring global permissions for existing individual users](#configuring-global-permissions-for-existing-individual-users)
+  - [Configuring global permissions for groups](#configuring-global-permissions-for-groups)
+  - [Refreshing group memberships](#refreshing-group-memberships)
+
+# Global Permission Assignment
+
+Global permissions for local users are assigned differently than users who log in to Rancher using external authentication.
+
+### Global Permissions for New Local Users
+
+When you create a new local user, you assign them a global permission as you complete the **Add User** form.
+
+To see the default permissions for new users, go to the **Global** view and click **Security > Roles.** On the **Global** tab, there is a column named **New User Default.** When adding a new local user, the user receives all  default global permissions that are marked as checked in this column. You can [change the default global permissions to meet your needs.](#configuring-default-global-permissions)
+
+### Global Permissions for Users with External Authentication
+
+When a user logs into Rancher using an external authentication provider for the first time, they are automatically assigned the  **New User Default** global permissions. By default, Rancher assigns the **Standard User** permission for new users.
+
+To see the default permissions for new users, go to the **Global** view and click **Security > Roles.** On the **Global** tab, there is a column named **New User Default.** When adding a new local user, the user receives all default global permissions that are marked as checked in this column, and you can [change them to meet your needs.](#configuring-default-global-permissions)
+
+Permissions can be assigned to an individual user with [these steps.](#configuring-global-permissions-for-existing-individual-users)
+
+As of Rancher v2.4.0, you can [assign a role to everyone in the group at the same time](#configuring-global-permissions-for-groups) if the external authentication provider supports groups.
+
+# Custom Global Permissions
+
+Using custom permissions is convenient for providing users with narrow or specialized access to Rancher.
+
+When a user from an [external authentication source]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) signs into Rancher for the first time, they're automatically assigned a set of global permissions (hereafter, permissions). By default, after a user logs in for the first time, they are created as a user and assigned the default `user` permission. The standard `user` permission allows users to login and create clusters.
+
+However, in some organizations, these permissions may extend too much access. Rather than assigning users the default global permissions of `Administrator` or `Standard User`, you can assign them a more restrictive set of custom global permissions.
+
+The default roles, Administrator and Standard User, each come with multiple global permissions built into them. The Administrator role includes all global permissions, while the default user role includes three global permissions: Create Clusters, Use Catalog Templates, and User Base, which is equivalent to the minimum permission to log in to Rancher. In other words, the custom global permissions are modularized so that if you want to change the default user role permissions, you can choose which subset of global permissions are included in the new default user role.
+
+Administrators can enforce custom global permissions in multiple ways:
+
+- [Changing the default permissions for new users](#configuring-default-global-permissions)
+- [Editing the permissions of an existing user](#configuring-global-permissions-for-individual-users)
+- [Assigning a custom global permission to a group](#assigning-a-custom-global-permission-to-a-group)
+
+### Custom Global Permissions Reference
+
+The following table lists each custom global permission available and whether it is included in the default global permissions, `Administrator`, `Standard User` and `User-Base`.
+
+| Custom Global Permission           | Administrator | Standard User | User-Base |
+| ---------------------------------- | ------------- | ------------- |-----------|
+| Create Clusters                    | ✓             | ✓             |           |
+| Create RKE Templates               | ✓             | ✓             |           |
+| Manage Authentication              | ✓             |               |           |
+| Manage Catalogs                    | ✓             |               |           |
+| Manage Cluster Drivers             | ✓             |               |           |
+| Manage Node Drivers                | ✓             |               |           |
+| Manage PodSecurityPolicy Templates | ✓             |               |           |
+| Manage Roles                       | ✓             |               |           |
+| Manage Settings                    | ✓             |               |           |
+| Manage Users                       | ✓             |               |           |
+| Use Catalog Templates              | ✓             | ✓             |           |
+| User Base\* (Basic log-in access)  | ✓             | ✓             |           |
+
+> \*This role has two names:
+>
+> - When you go to the <b>Users</b> tab and edit a user's global role, this role is called <b>Login Access</b> in the custom global permissions list.
+> - When you go to the <b>Security</b> tab and edit the roles from the roles page, this role is called <b>User Base.</b>
+
+For details on which Kubernetes resources correspond to each global permission, you can go to the **Global** view in the Rancher UI. Then click **Security > Roles** and go to the **Global** tab. If you click an individual role, you can refer to the **Grant Resources** table to see all of the operations and resources that are permitted by the role.
+
+> **Notes:**
+>
+> - Each permission listed above is comprised of multiple individual permissions not listed in the Rancher UI. For a full list of these permissions and the rules they are comprised of, access through the API at `/v3/globalRoles`.
+> - When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
+
+### Configuring Default Global Permissions
+
+If you want to restrict the default permissions for new users, you can remove the `user` permission as default role and then assign multiple individual permissions as default instead. Conversely, you can also add administrative permissions on top of a set of other standard permissions.
+
+> **Note:** Default roles are only assigned to users added from an external authentication provider. For local users, you must explicitly assign global permissions when adding a user to Rancher. You can customize these global permissions when adding the user.
+
+To change the default global permissions that are assigned to external users upon their first log in, follow these steps:
+
+1. From the **Global** view, select **Security > Roles** from the main menu. Make sure the **Global** tab is selected.
+
+1. Find the permissions set that you want to add or remove as a default. Then edit the permission by selecting **&#8942; > Edit**.
+
+1. If you want to add the permission as a default, Select **Yes: Default role for new users** and then click **Save**.
+
+1. If you want to remove a default permission, edit the permission and select **No** from **New User Default**.
+
+**Result:** The default global permissions are configured based on your changes. Permissions assigned to new users display a check in the **New User Default** column.
+
+### Configuring Global Permissions for Existing Individual Users
+
+To configure permission for a user,
+
+1. Go to the **Users** tab.
+
+1. On this page, go to the user whose access level you want to change and click **&#8942; > Edit.**
+
+1. In the **Global Permissions** section, click **Custom.**
+
+1. Check the boxes for each subset of permissions you want the user to have access to.
+
+1. Click **Save.**
+
+> **Result:** The user's global permissions have been updated.
+
+### Configuring Global Permissions for Groups
+
+_Available as of v2.4.0_
+
+If you have a group of individuals that need the same level of access in Rancher, it can save time to assign permissions to the entire group at once, so that the users in the group have the appropriate level of access the first time they sign into Rancher.
+
+After you assign a custom global role to a group, the custom global role will be assigned to a user in the group when they log in to Rancher.
+
+For existing users, the new permissions will take effect when the users log out of Rancher and back in again, or when an administrator [refreshes the group memberships.](#refreshing-group-memberships)
+
+For new users, the new permissions take effect when the users log in to Rancher for the first time. New users from this group will receive the permissions from the custom global role in addition to the **New User Default** global permissions. By default, the **New User Default** permissions are equivalent to the **Standard User** global role, but the default permissions can be [configured.](#configuring-default-global-permissions)
+
+If a user is removed from the external authentication provider group, they would lose their permissions from the custom global role that was assigned to the group. They would continue to have any remaining roles that were assigned to them, which would typically include the roles marked as **New User Default.** Rancher will remove the permissions that are associated with the group when the user logs out, or when an administrator [refreshes group memberships,]((#refreshing-group-memberships)) whichever comes first.
+
+> **Prerequisites:** You can only assign a global role to a group if:
+>
+> * You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-vs-local-authentication)
+> * The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/user-groups/)
+> * You have already set up at least one user group with the authentication provider
+
+To assign a custom global role to a group, follow these steps:
+
+1. From the **Global** view, go to **Security > Groups.**
+1. Click **Assign Global Role.**
+1. In the **Select Group To Add** field, choose the existing group that will be assigned the custom global role.
+1. In the **Global Permissions,** **Custom,** and/or **Built-in** sections, select the permissions that the group should have.
+1. Click **Create.**
+
+**Result:** The custom global role will take effect when the users in the group log into Rancher.
+
+### Refreshing Group Memberships
+
+When an administrator updates the global permissions for a group, the changes take effect for individual group members after they log out of Rancher and log in again.
+
+To make the changes take effect immediately, an administrator or cluster owner can refresh group memberships.
+
+An administrator might also want to refresh group memberships if a user is removed from a group in the external authentication service. In that case, the refresh makes Rancher aware that the user was removed from the group.
+
+To refresh group memberships,
+
+1. From the **Global** view, click **Security > Users.**
+1. Click **Refresh Group Memberships.**
+
+**Result:** Any changes to the group members' permissions will take effect.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/kubectl/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/kubectl/_index.md
new file mode 100644
index 00000000000..d47673f71f4
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/kubectl/_index.md
@@ -0,0 +1,103 @@
+---
+title: "Access a Cluster with Kubectl and kubeconfig"
+description: "Learn how you can access and manage your Kubernetes clusters using kubectl with kubectl Shell or with kubectl CLI and kubeconfig file. A kubeconfig file is used to configure access to Kubernetes. When you create a cluster with Rancher, it automatically creates a kubeconfig for your cluster."
+weight: 6
+---
+
+This section describes how to manipulate your downstream Kubernetes cluster with kubectl from the Rancher UI or from your workstation.
+
+For more information on using kubectl, see [Kubernetes Documentation: Overview of kubectl](https://kubernetes.io/docs/reference/kubectl/overview/).
+
+- [Accessing clusters with kubectl shell in the Rancher UI](#accessing-clusters-with-kubectl-shell-in-the-rancher-ui)
+- [Accessing clusters with kubectl from your workstation](#accessing-clusters-with-kubectl-from-your-workstation)
+- [Note on Resources created using kubectl](#note-on-resources-created-using-kubectl)
+- [Authenticating Directly with a Downstream Cluster](#authenticating-directly-with-a-downstream-cluster)
+  - [Connecting Directly to Clusters with FQDN Defined](#connecting-directly-to-clusters-with-fqdn-defined)
+  - [Connecting Directly to Clusters without FQDN Defined](#connecting-directly-to-clusters-without-fqdn-defined)
+
+
+### Accessing Clusters with kubectl Shell in the Rancher UI
+
+You can access and manage your clusters by logging into Rancher and opening the kubectl shell in the UI. No further configuration necessary.
+
+1. From the **Global** view, open the cluster that you want to access with kubectl.
+
+2. Click **Launch kubectl**. Use the window that opens to interact with your Kubernetes cluster.
+
+### Accessing Clusters with kubectl from Your Workstation
+
+This section describes how to download your cluster's kubeconfig file, launch kubectl from your workstation, and access your downstream cluster.
+
+This alternative method of accessing the cluster allows you to authenticate with Rancher and manage your cluster without using the Rancher UI.
+
+> **Prerequisites:** These instructions assume that you have already created a Kubernetes cluster, and that kubectl is installed on your workstation. For help installing kubectl, refer to the official [Kubernetes documentation.](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
+
+1. Log into Rancher. From the **Global** view, open the cluster that you want to access with kubectl.
+1. Click **Kubeconfig File**.
+1. Copy the contents displayed to your clipboard.
+1. Paste the contents into a new file on your local computer. Move the file to `~/.kube/config`. Note: The default location that kubectl uses for the kubeconfig file is `~/.kube/config`, but you can use any directory and specify it using the `--kubeconfig` flag, as in this command:
+  ```
+  kubectl --kubeconfig /custom/path/kube.config get pods
+  ```
+1. From your workstation, launch kubectl. Use it to interact with your kubernetes cluster.
+
+
+### Note on Resources Created Using kubectl
+
+Rancher will discover and show resources created by `kubectl`. However, these resources might not have all the necessary annotations on discovery. If an operation (for instance, scaling the workload) is done to the resource using the Rancher UI/API, this may trigger recreation of the resources due to the missing annotations. This should only happen the first time an operation is done to the discovered resource.
+
+# Authenticating Directly with a Downstream Cluster
+
+This section intended to help you set up an alternative method to access an [RKE cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters)
+
+This method is only available for RKE clusters that have the [authorized cluster endpoint]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) enabled. When Rancher creates this RKE cluster, it generates a kubeconfig file that includes additional kubectl context(s) for accessing your cluster. This additional context allows you to use kubectl to authenticate with the downstream cluster without authenticating through Rancher. For a longer explanation of how the authorized cluster endpoint works, refer to [this page.](../ace)
+
+We recommend that as a best practice, you should set up this method to access your RKE cluster, so that just in case you can’t connect to Rancher, you can still access the cluster.
+
+> **Prerequisites:** The following steps assume that you have created a Kubernetes cluster and followed the steps to [connect to your cluster with kubectl from your workstation.](#accessing-clusters-with-kubectl-from-your-workstation)
+
+To find the name of the context(s) in your downloaded kubeconfig file, run:
+
+```
+kubectl config get-contexts --kubeconfig /custom/path/kube.config
+CURRENT   NAME                        CLUSTER                     AUTHINFO     NAMESPACE
+*         my-cluster                  my-cluster                  user-46tmn
+          my-cluster-controlplane-1   my-cluster-controlplane-1   user-46tmn
+```
+
+In this example, when you use `kubectl` with the first context, `my-cluster`, you will be authenticated through the Rancher server.
+
+With the second context, `my-cluster-controlplane-1`, you would authenticate with the authorized cluster endpoint, communicating with an downstream RKE cluster directly.
+
+We recommend using a load balancer with the authorized cluster endpoint. For details, refer to the [recommended architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#architecture-for-an-authorized-cluster-endpoint)
+
+Now that you have the name of the context needed to authenticate directly with the cluster, you can pass the name of the context in as an option when running kubectl commands. The commands will differ depending on whether your cluster has an FQDN defined. Examples are provided in the sections below.
+
+When `kubectl` works normally, it confirms that you can access your cluster while bypassing Rancher's authentication proxy.
+
+### Connecting Directly to Clusters with FQDN Defined
+
+If an FQDN is defined for the cluster, a single context referencing the FQDN will be created. The context will be named `<CLUSTER_NAME>-fqdn`. When you want to use `kubectl` to access this cluster without Rancher, you will need to use this context.
+
+Assuming the kubeconfig file is located at `~/.kube/config`:
+
+```
+kubectl --context <CLUSTER_NAME>-fqdn get nodes
+```
+Directly referencing the location of the kubeconfig file:
+```
+kubectl --kubeconfig /custom/path/kube.config --context <CLUSTER_NAME>-fqdn get pods
+```
+
+### Connecting Directly to Clusters without FQDN Defined
+
+If there is no FQDN defined for the cluster, extra contexts will be created referencing the IP address of each node in the control plane. Each context will be named `<CLUSTER_NAME>-<NODE_NAME>`. When you want to use `kubectl` to access this cluster without Rancher, you will need to use this context.
+
+Assuming the kubeconfig file is located at `~/.kube/config`:
+```
+kubectl --context <CLUSTER_NAME>-<NODE_NAME> get nodes
+```
+Directly referencing the location of the kubeconfig file:
+```
+kubectl --kubeconfig /custom/path/kube.config --context <CLUSTER_NAME>-<NODE_NAME> get pods
+```
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/project-members/_index.md b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/project-members/_index.md
new file mode 100644
index 00000000000..c58f5848c34
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/project-members/_index.md
@@ -0,0 +1,50 @@
+---
+title: Adding Users to Projects
+weight: 2
+---
+
+If you want to provide a user with access and permissions to _specific_ projects and resources within a cluster, assign the user a project membership.
+
+You can add members to a project as it is created, or add them to an existing project.
+
+>**Tip:** Want to provide a user with access to _all_ projects within a cluster? See [Adding Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/cluster-members/) instead.
+
+### Adding Members to a New Project
+
+You can add members to a project as you create it (recommended if possible). For details on creating a new project, refer to the [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/)
+
+### Adding Members to an Existing Project
+
+Following project creation, you can add users as project members so that they can access its resources.
+
+1. From the **Global** view, open the project that you want to add members to.
+
+2. From the main menu, select **Members**. Then click **Add Member**.
+
+3. Search for the user or group that you want to add to the project.
+
+ 	If external authentication is configured:
+
+	-  Rancher returns users from your external authentication source as you type.  
+
+	- A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.
+
+	>**Note:** If you are logged in as a local user, external users do not display in your search results.
+
+1. Assign the user or group **Project** roles.  
+
+	[What are Project Roles?]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
+
+    >**Notes:**
+    >
+    >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned.
+    >
+    >- For `Custom` roles, you can modify the list of individual roles available for assignment.
+    >
+    >    - To add roles to the list, [Add a Custom Role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles).
+    >    - To remove roles from the list, [Lock/Unlock Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/).
+
+**Result:** The chosen users are added to the project.
+
+- To revoke project membership, select the user and click **Delete**. This action deletes membership, not the user.
+- To modify a user's roles in the project, delete them from the project, and then re-add them with modified roles.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/backing-up-a-cluster/_index.md b/content/rancher/v2.5/en/applications/ecm/backing-up-a-cluster/_index.md
new file mode 100644
index 00000000000..fdff6a58d3f
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/backing-up-a-cluster/_index.md
@@ -0,0 +1,141 @@
+---
+title: Backing up a Cluster
+weight: 7
+---
+
+In the Rancher UI, etcd backup and recovery for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) can be easily performed.
+
+Rancher recommends configuring recurrent `etcd` snapshots for all production clusters. Additionally, one-time snapshots can easily be taken as well.
+
+Snapshots of the etcd database are taken and saved either [locally onto the etcd nodes](#local-backup-target) or to a [S3 compatible target](#s3-backup-target). The advantages of configuring S3 is that if all etcd nodes are lost, your snapshot is saved remotely and can be used to restore the cluster.
+
+This section covers the following topics:
+
+- [How snapshots work](#how-snapshots-work)
+- [Configuring recurring snapshots](#configuring-recurring-snapshots)
+- [One-time snapshots](#one-time-snapshots)
+- [Snapshot backup targets](#snapshot-backup-targets)
+  - [Local backup target](#local-backup-target)
+  - [S3 backup target](#s3-backup-target)
+  - [Using a custom CA certificate for S3](#using-a-custom-ca-certificate-for-s3)
+  - [IAM Support for storing snapshots in S3](#iam-support-for-storing-snapshots-in-s3)
+- [Viewing available snapshots](#viewing-available-snapshots)
+- [Safe timestamps](#safe-timestamps)
+- [Enabling snapshot features for clusters created before Rancher v2.2.0](#enabling-snapshot-features-for-clusters-created-before-rancher-v2-2-0)
+
+# How Snapshots Work
+
+{{% tabs %}}
+{{% tab "Rancher v2.4.0+" %}}
+When Rancher creates a snapshot, it includes three components: 
+
+- The cluster data in etcd
+- The Kubernetes version
+- The cluster configuration in the form of the `cluster.yml`
+
+Because the Kubernetes version is now included in the snapshot, it is possible to restore a cluster to a prior Kubernetes version.
+
+The multiple components of the snapshot allow you to select from the following options if you need to a cluster from a snapshot:
+
+- **Restore just the etcd contents:** This restoration is similar to restoring to snapshots in Rancher prior to v2.4.0.
+- **Restore etcd and Kubernetes version:** This option should be used if a Kubernetes upgrade is the reason that your cluster is failing, and you haven't made any cluster configuration changes.
+- **Restore etcd, Kubernetes versions and cluster configuration:** This option should be used if you changed both the Kubernetes version and cluster configuration when upgrading.
+
+It's always recommended to take a new snapshot before any upgrades.
+{{% /tab %}}
+{{% tab "Rancher prior to v2.4.0" %}}
+When Rancher creates a snapshot, only the etcd data is included in the snapshot.
+
+Because the Kubernetes version is not included in the snapshot, there is no option to restore a cluster to a different Kubernetes version.
+
+It's always recommended to take a new snapshot before any upgrades.
+{{% /tab %}}
+{{% /tabs %}}
+
+# Configuring Recurring Snapshots
+
+Select how often you want recurring snapshots to be taken as well as how many snapshots to keep. The amount of time is measured in hours. With timestamped snapshots, the user has the ability to do a point-in-time recovery.
+
+By default, [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) are configured to take recurring snapshots (saved to local disk). To protect against local disk failure, using the [S3 Target](#s3-backup-target) or replicating the path on disk is advised.
+
+During cluster provisioning or editing the cluster, the configuration for snapshots can be found in the advanced section for **Cluster Options**. Click on **Show advanced options**.
+
+In the **Advanced Cluster Options** section, there are several options available to configure:
+
+| Option | Description | Default Value|
+| --- | ---| --- |
+|[etcd Snapshot Backup Target](#snapshot-backup-targets)| Select where you want the snapshots to be saved. Options are either local or in S3 | local|
+|Recurring etcd Snapshot Enabled| Enable/Disable recurring snapshots | Yes|
+|[Recurring etcd Snapshot Creation Period](#snapshot-creation-period-and-retention-count) | Time in hours between recurring snapshots| 12 hours |
+|[Recurring etcd Snapshot Retention Count](#snapshot-creation-period-and-retention-count)| Number of snapshots to retain| 6 |
+
+# One-Time Snapshots
+
+In addition to recurring snapshots, you may want to take a "one-time" snapshot. For example, before upgrading the Kubernetes version of a cluster it's best to backup the state of the cluster to protect against upgrade failure.
+
+1. In the **Global** view, navigate to the cluster that you want to take a one-time snapshot.
+
+2. Click the **&#8942; > Snapshot Now**.
+
+**Result:** Based on your [snapshot backup target](#snapshot-backup-targets), a one-time snapshot will be taken and saved in the selected backup target.
+
+# Snapshot Backup Targets
+
+Rancher supports two different backup targets:
+
+* [Local Target](#local-backup-target)
+* [S3 Target](#s3-backup-target)
+
+### Local Backup Target
+
+By default, the `local` backup target is selected. The benefits of this option is that there is no external configuration. Snapshots are automatically saved locally to the etcd nodes in the [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) in `/opt/rke/etcd-snapshots`. All recurring snapshots are taken at configured intervals. The downside of using the `local` backup target is that if there is a total disaster and _all_ etcd nodes are lost, there is no ability to restore the cluster.
+
+### S3 Backup Target
+
+The `S3` backup target allows users to configure a S3 compatible backend to store the snapshots. The primary benefit of this option is that if the cluster loses all the etcd nodes, the cluster can still be restored as the snapshots are stored externally. Rancher recommends external targets like `S3` backup, however its configuration requirements do require additional effort that should be considered.
+
+| Option | Description | Required|
+|---|---|---|
+|S3 Bucket Name| S3 bucket name where backups will be stored| *|
+|S3 Region|S3 region for the backup bucket| |
+|S3 Region Endpoint|S3 regions endpoint for the backup bucket|* |
+|S3 Access Key|S3 access key with permission to access the backup bucket|*|
+|S3 Secret Key|S3 secret key with permission to access the backup bucket|*|
+| Custom CA Certificate | A custom certificate used to access private S3 backends _Available as of v2.2.5_ ||
+
+### Using a custom CA certificate for S3
+
+_Available as of v2.2.5_
+
+The backup snapshot can be stored on a custom `S3` backup like [minio](https://min.io/). If the S3 back end uses a self-signed or custom certificate, provide a custom certificate using the `Custom CA Certificate` option to connect to the S3 backend.
+
+### IAM Support for Storing Snapshots in S3
+
+The `S3` backup target supports using IAM authentication to AWS API in addition to using API credentials. An IAM role gives temporary permissions that an application can use when making API calls to S3 storage. To use IAM authentication, the following requirements must be met:
+
+ - The cluster etcd nodes must have an instance role that has read/write access to the designated backup bucket.
+ - The cluster etcd nodes must have network access to the specified S3 endpoint.
+ - The Rancher Server worker node(s) must have an instance role that has read/write to the designated backup bucket.
+ - The Rancher Server worker node(s) must have network access to the specified S3 endpoint.
+
+ To give an application access to S3, refer to the AWS documentation on [Using an IAM Role to Grant Permissions to Applications Running on Amazon EC2 Instances.](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html)
+
+# Viewing Available Snapshots
+
+The list of all available snapshots for the cluster is available in the Rancher UI.
+
+1. In the **Global** view, navigate to the cluster that you want to view snapshots.
+
+2. Click **Tools > Snapshots** from the navigation bar to view the list of saved snapshots. These snapshots include a timestamp of when they were created.
+
+# Safe Timestamps
+
+_Available as of v2.3.0_
+
+As of v2.2.6, snapshot files are timestamped to simplify processing the files using external tools and scripts, but in some S3 compatible backends, these timestamps were unusable. As of Rancher v2.3.0, the option `safe_timestamp` is added to support compatible file names. When this flag is set to `true`, all special characters in the snapshot filename timestamp are replaced.
+
+This option is not available directly in the UI, and is only available through the `Edit as Yaml` interface.
+
+# Enabling Snapshot Features for Clusters Created Before Rancher v2.2.0
+
+If you have any Rancher launched Kubernetes clusters that were created prior to v2.2.0, after upgrading Rancher, you must [edit the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) and _save_ it, in order to enable the updated snapshot features. Even if you were already creating snapshots prior to v2.2.0, you must do this step as the older snapshots will not be available to use to [back up and restore etcd through the UI]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/).
diff --git a/content/rancher/v2.5/en/applications/ecm/cloning-clusters/_index.md b/content/rancher/v2.5/en/applications/ecm/cloning-clusters/_index.md
new file mode 100644
index 00000000000..c5315fa3f37
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/cloning-clusters/_index.md
@@ -0,0 +1,99 @@
+---
+title: Cloning Clusters
+weight: 18
+---
+
+If you have a cluster in Rancher that you want to use as a template for creating similar clusters, you can use Rancher CLI to clone the cluster's configuration, edit it, and then use it to quickly launch the cloned cluster.
+
+Duplication of imported clusters is not supported.
+
+| Cluster Type                     | Cloneable?    |
+|----------------------------------|---------------|
+| [Nodes Hosted by Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) | ✓ |
+| [Hosted Kubernetes Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | ✓    |
+| [Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes)              | ✓              |
+| [Imported Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)            |               |
+
+> **Warning:** During the process of duplicating a cluster, you will edit a config file full of cluster settings. However, we recommend editing only values explicitly listed in this document, as cluster duplication is designed for simple cluster copying, _not_ wide scale configuration changes. Editing other values may invalidate the config file, which will lead to cluster deployment failure.
+
+## Prerequisites
+
+Download and install [Rancher CLI]({{<baseurl>}}/rancher/v2.x/en/cli). Remember to [create an API bearer token]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys) if necessary.
+
+
+## 1. Export Cluster Config
+
+Begin by using Rancher CLI to export the configuration for the cluster that you want to clone.
+
+1. Open Terminal and change your directory to the location of the Rancher CLI binary, `rancher`.
+
+1. Enter the following command to list the clusters managed by Rancher.
+
+
+        ./rancher cluster ls
+
+
+1. Find the cluster that you want to clone, and copy either its resource `ID` or `NAME` to your clipboard. From this point on, we'll refer to the resource `ID` or `NAME` as `<RESOURCE_ID>`, which is used as a placeholder in the next step.
+
+1. Enter the following command to export the configuration for your cluster.
+
+
+        ./rancher clusters export <RESOURCE_ID>
+
+
+    **Step Result:** The YAML for a cloned cluster prints to Terminal.
+
+1. Copy the YAML to your clipboard and paste it in a new file. Save the file as `cluster-template.yml` (or any other name, as long as it has a `.yml` extension).
+
+## 2. Modify Cluster Config
+
+Use your favorite text editor to modify the cluster configuration in `cluster-template.yml` for your cloned cluster.
+
+> **Note:** As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0)
+
+1. Open `cluster-template.yml` (or whatever you named your config) in your favorite text editor.
+
+    >**Warning:** Only edit the cluster config values explicitly called out below. Many of the values listed in this file are used to provision your cloned cluster, and editing their values may break the provisioning process.
+
+
+1. As depicted in the example below, at the `<CLUSTER_NAME>` placeholder, replace your original cluster's name with a unique name (`<CLUSTER_NAME>`). If your cloned cluster has a duplicate name, the cluster will not provision successfully.
+
+    ```yml
+    Version: v3
+    clusters:
+        <CLUSTER_NAME>: # ENTER UNIQUE NAME
+        dockerRootDir: /var/lib/docker
+        enableNetworkPolicy: false
+        rancherKubernetesEngineConfig:
+        addonJobTimeout: 30
+        authentication:
+            strategy: x509
+        authorization: {}
+        bastionHost: {}
+        cloudProvider: {}
+        ignoreDockerVersion: true
+    ```
+
+1. For each `nodePools` section, replace the original nodepool name with a unique name at the `<NODEPOOL_NAME>` placeholder.  If your cloned cluster has a duplicate nodepool name, the cluster will not provision successfully.
+
+    ```yml
+    nodePools:
+        <NODEPOOL_NAME>:
+        clusterId: do
+        controlPlane: true
+        etcd: true
+        hostnamePrefix: mark-do
+        nodeTemplateId: do
+        quantity: 1
+        worker: true
+    ```
+
+1. When you're done, save and close the configuration.
+
+## 3. Launch Cloned Cluster
+
+Move `cluster-template.yml` into the same directory as the Rancher CLI binary. Then run this command:
+
+    ./rancher up --file cluster-template.yml
+
+**Result:** Your cloned cluster begins provisioning. Enter `./rancher cluster ls` to confirm. You can also log into the Rancher UI and open the **Global** view to watch your provisioning cluster's progress.
diff --git a/content/rancher/v2.5/en/applications/ecm/cluster-configuration/_index.md b/content/rancher/v2.5/en/applications/ecm/cluster-configuration/_index.md
new file mode 100644
index 00000000000..526e9de80b7
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/cluster-configuration/_index.md
@@ -0,0 +1,68 @@
+---
+title: RKE Cluster Configuration
+weight: 6
+---
+
+After you provision a Kubernetes cluster using Rancher, you can still edit options and settings for the cluster. To edit your cluster, open the **Global** view, make sure the **Clusters** tab is selected, and then select **&#8942; > Edit** for the cluster that you want to edit.
+
+<sup>To Edit an Existing Cluster</sup>
+![Edit Cluster]({{<baseurl>}}/img/rancher/edit-cluster.png)
+
+The options and settings available for an existing cluster change based on the method that you used to provision it. For example, only clusters [provisioned by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) have **Cluster Options** available for editing.
+
+The following table summarizes the options and settings available for each cluster type:
+
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
+
+## Editing Cluster Membership
+
+Cluster administrators can [edit the membership for a cluster,]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members) controlling which Rancher users can access the cluster and what features they can use.
+
+## Cluster Options
+
+When editing clusters, clusters that are [launched using RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) feature more options than clusters that are imported or hosted by a Kubernetes provider. The headings that follow document options available only for RKE clusters.
+
+### Updating ingress-nginx
+
+Clusters that were created before Kubernetes 1.16 will have an `ingress-nginx` `updateStrategy` of `OnDelete`. Clusters that were created with Kubernetes 1.16 or newer will have `RollingUpdate`.
+
+If the `updateStrategy` of `ingress-nginx` is `OnDelete`, you will need to delete these pods to get the correct version for your deployment.
+
+# Editing Other Cluster Options
+
+In [clusters launched by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), you can edit any of the remaining options that follow.
+
+>**Note:** These options are not available for imported clusters or hosted Kubernetes clusters.
+
+<sup>Options for RKE Clusters</sup>
+![Cluster Options]({{<baseurl>}}/img/rancher/cluster-options.png)
+
+
+Option | Description |
+---------|----------|
+ Kubernetes Version | The version of Kubernetes installed on each cluster node. For more detail, see [Upgrading Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes). |
+ Network Provider | The [container networking interface]({{<baseurl>}}/rancher/v2.x/en/faq/networking/#cni-providers) that powers networking for your cluster.<br/><br/>**Note:** You can only choose this option while provisioning your cluster. It cannot be edited later. |
+ Project Network Isolation | As of Rancher v2.0.7, if you're using the Canal network provider, you can choose whether to enable or disable inter-project communication. |
+ Nginx Ingress | If you want to publish your applications in a high-availability configuration, and you're hosting your nodes with a cloud-provider that doesn't have a native load-balancing feature, enable this option to use Nginx ingress within the cluster. |
+ Metrics Server Monitoring | Each cloud provider capable of launching a cluster using RKE can collect metrics and monitor for your cluster nodes. Enable this option to view your node metrics from your cloud provider's portal. |
+ Pod Security Policy Support | Enables [pod security policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/) for the cluster. After enabling this option, choose a policy using the **Default Pod Security Policy** drop-down. |
+ Docker version on nodes | Configures whether nodes are allowed to run versions of Docker that Rancher doesn't officially support. If you choose to require a [supported Docker version]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/), Rancher will stop pods from running on nodes that don't have a supported Docker version installed. |
+ Docker Root Directory | The directory on your cluster nodes where you've installed Docker. If you install Docker on your nodes to a non-default directory, update this path. |
+ Default Pod Security Policy | If you enable **Pod Security Policy Support**, use this drop-down to choose the pod security policy that's applied to the cluster. |
+ Cloud Provider | If you're using a cloud provider to host cluster nodes launched by RKE, enable [this option]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) so that you can use the cloud provider's native features. If you want to store persistent data for your cloud-hosted cluster, this option is required.  |
+<br/>
+
+# Editing Cluster as YAML
+
+>**Note:** In Rancher v2.0.5 and v2.0.6, the names of services in the Config File (YAML) should contain underscores only: `kube_api` and `kube_controller`.
+
+Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the options available in an RKE installation, except for system_images configuration, by specifying them in YAML.
+
+- To edit an RKE config file directly from the Rancher UI, click **Edit as YAML**.
+- To read from an existing RKE file, click **Read from File**.
+
+In Rancher v2.0.0-v2.2.x, the config file is identical to the  [cluster config file for the Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/config-options/), which is the tool Rancher uses to provision clusters. In Rancher v2.3.0, the RKE information is still included in the config file, but it is separated from other options, so that the RKE cluster config options are nested under the `rancher_kubernetes_engine_config` directive. For more information, see the [cluster configuration reference.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options)
+
+![image]({{<baseurl>}}/img/rancher/cluster-options-yaml.png)
+
+For an example of RKE config file syntax, see the [RKE documentation]({{<baseurl>}}/rke/latest/en/example-yamls/).  
diff --git a/content/rancher/v2.5/en/applications/ecm/config-private-registry/_index.md b/content/rancher/v2.5/en/applications/ecm/config-private-registry/_index.md
new file mode 100644
index 00000000000..1ba3e37b8f8
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/config-private-registry/_index.md
@@ -0,0 +1,43 @@
+---
+title: Configuring a Global Default Private Registry
+weight: 10
+---
+
+You might want to use a private Docker registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the Docker images that are used in your clusters.
+
+There are two main ways to set up private registries in Rancher: by setting up the global default registry through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials.
+
+This section is about configuring the global default private registry, and focuses on how to configure the registry from the Rancher UI after Rancher is installed.
+
+For instructions on setting up a private registry with command line options during the installation of Rancher, refer to the [air gapped Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node) or [air gapped Kubernetes installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability) instructions.
+
+If your private registry requires credentials, it cannot be used as the default registry. There is no global way to set up a private registry with authorization for every Rancher-provisioned cluster. Therefore, if you want a Rancher-provisioned cluster to pull images from a private registry with credentials, you will have to [pass in the registry credentials through the advanced cluster options](#provisioning-clusters-with-private-registries-that-require-credentials) every time you create a new cluster.
+
+# Setting a Private Registry with No Credentials as the Default Registry
+
+1. Log into Rancher and configure the default administrator password.
+
+1. Go into the **Settings** view.
+
+    {{< img "/img/rancher/airgap/settings.png" "Settings" >}}
+
+1. Look for the setting called `system-default-registry` and choose **Edit**.
+
+    {{< img "/img/rancher/airgap/edit-system-default-registry.png" "Edit" >}}
+
+1. Change the value to your registry (e.g. `registry.yourdomain.com:port`). Do not prefix the registry with `http://` or `https://`.
+
+    {{< img "/img/rancher/airgap/enter-system-default-registry.png" "Save" >}}
+
+**Result:** Rancher will use your private registry to pull system images.
+
+# Setting a Private Registry with Credentials when Deploying a Cluster
+
+You can follow these steps to configure a private registry when you provision a cluster with Rancher:
+
+1. When you create a cluster through the Rancher UI, go to the **Cluster Options** section and click **Show Advanced Options.**
+1. In the <b>Enable Private Registries</b> section, click **Enabled.**
+1. Enter the registry URL and credentials.
+1. Click **Save.**
+
+**Result:** The new cluster will be able to pull images from the private registry.
diff --git a/content/rancher/v2.5/en/applications/ecm/disconnecting-nodes/_index.md b/content/rancher/v2.5/en/applications/ecm/disconnecting-nodes/_index.md
new file mode 100644
index 00000000000..893e537ffb1
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/disconnecting-nodes/_index.md
@@ -0,0 +1,279 @@
+---
+title: Disconnecting Nodes from RKE Kubernetes Clusters
+description: Learn about cluster cleanup when removing nodes from your Rancher-launched Kubernetes cluster. What is removed, how to do it manually
+weight: 11
+---
+
+This section describes how to disconnect a node from a Rancher-launched Kubernetes cluster and remove all of the Kubernetes components from the node. This process allows you to use the node for other purposes.
+
+When you use Rancher to [launch nodes for a cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher), resources (containers/virtual network interfaces) and configuration items (certificates/configuration files) are created.
+
+When removing nodes from your Rancher launched Kubernetes cluster (provided that they are in `Active` state), those resources are automatically cleaned, and the only action needed is to restart the node. When a node has become unreachable and the automatic cleanup process cannot be used, we describe the steps that need to be executed before the node can be added to a cluster again.
+
+## What Gets Removed?
+
+When cleaning nodes provisioned using Rancher, the following components are deleted based on the type of cluster node you're removing.
+
+| Removed Component                                                              | [Nodes Hosted by Infrastructure Provider][1] | [Custom Nodes][2] | [Hosted Cluster][3] | [Imported Nodes][4] |
+| ------------------------------------------------------------------------------ | --------------- | ----------------- | ------------------- | ------------------- |
+| The Rancher deployment namespace (`cattle-system` by default)                  | ✓               | ✓                 | ✓                   | ✓                   |
+| `serviceAccount`, `clusterRoles`, and `clusterRoleBindings` labeled by Rancher | ✓               | ✓                 | ✓                   | ✓                   |
+| Labels, Annotations, and Finalizers                                            | ✓               | ✓                 | ✓                   | ✓                   |
+| Rancher Deployment                                                             | ✓               | ✓                 | ✓                   |                     |
+| Machines, clusters, projects, and user custom resource definitions (CRDs)      | ✓               | ✓                 | ✓                   |                     |
+| All resources create under the `management.cattle.io` API Group                | ✓               | ✓                 | ✓                   |                     |
+| All CRDs created by Rancher v2.x                                               | ✓               | ✓                 | ✓                   |                     |
+
+[1]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/
+[2]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/
+[3]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/
+[4]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/
+
+## Removing a Node from a Cluster by Rancher UI
+
+When the node is in `Active` state, removing the node from a cluster will trigger a process to clean up the node. Please restart the node after the automatic cleanup process is done to make sure any non-persistent data is properly removed.
+
+**To restart a node:**
+
+```
+# using reboot
+$ sudo reboot
+
+# using shutdown
+$ sudo shutdown -r now
+```
+
+## Removing Rancher Components from a Cluster Manually
+
+When a node is unreachable and removed from the cluster, the automatic cleaning process can't be triggered because the node is unreachable. Please follow the steps below to manually remove the Rancher components.
+
+>**Warning:** The commands listed below will remove data from the node. Make sure you have created a backup of files you want to keep before executing any of the commands as data will be lost.
+
+### Removing Rancher Components from Imported Clusters
+
+For imported clusters, the process for removing Rancher is a little different. You have the option of simply deleting the cluster in the Rancher UI, or your can run a script that removes Rancher components from the nodes. Both options make the same deletions.
+
+After the imported cluster is detached from Rancher, the cluster's workloads will be unaffected and you can access the cluster using the same methods that you did before the cluster was imported into Rancher.
+
+{{% tabs %}}
+{{% tab "By UI / API" %}}
+>**Warning:** This process will remove data from your cluster. Make sure you have created a backup of files you want to keep before executing the command, as data will be lost.
+
+After you initiate the removal of an [imported cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#import-existing-cluster) using the Rancher UI (or API), the following events occur.
+
+1. Rancher creates a `serviceAccount` that it uses to remove the Rancher components from the cluster. This account is assigned the [clusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) and [clusterRoleBinding](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) permissions, which are required to remove the Rancher components.
+
+1. Using the `serviceAccount`, Rancher schedules and runs a [job](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/) that cleans the Rancher components off of the cluster. This job also references the `serviceAccount` and its roles as dependencies, so the job deletes them before its completion.
+
+1. Rancher is removed from the cluster. However, the cluster persists, running the native version of Kubernetes.
+
+**Result:** All components listed for imported clusters in [What Gets Removed?](#what-gets-removed) are deleted.
+
+{{% /tab %}}
+{{% tab "By Script" %}}
+Rather than cleaning imported cluster nodes using the Rancher UI, you can run a script instead. This functionality is available since `v2.1.0`.
+
+>**Prerequisite:**
+>
+>Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
+
+1. Open a web browser, navigate to [GitHub](https://github.com/rancher/rancher/blob/master/cleanup/user-cluster.sh), and download `user-cluster.sh`.
+
+1. Make the script executable by running the following command from the same directory as `user-cluster.sh`:
+
+    ```
+    chmod +x user-cluster.sh
+    ```
+
+1. **Air Gap Environments Only:** Open `user-cluster.sh` and replace `yaml_url` with the URL in `user-cluster.yml`.
+
+    If you don't have an air gap environment, skip this step.
+
+1. From the same directory, run the script and provide the `rancher/rancher-agent` image version which should be equal to the version of Rancher used to manage the cluster. (`<RANCHER_VERSION>`):
+
+    >**Tip:**
+    >
+    >Add the `-dry-run` flag to preview the script's outcome without making changes.
+    ```
+    ./user-cluster.sh rancher/rancher-agent:<RANCHER_VERSION>
+    ```
+
+**Result:** The script runs. All components listed for imported clusters in [What Gets Removed?](#what-gets-removed) are deleted.
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### Windows Nodes
+
+To clean up a Windows node, you can run a cleanup script located in `c:\etc\rancher`. The script deletes Kubernetes generated resources and the execution binary. It also drops the firewall rules and network settings.
+
+To run the script, you can use this command in the PowerShell:
+
+```
+pushd c:\etc\rancher
+.\cleanup.ps1
+popd
+```
+
+**Result:** The node is reset and can be re-added to a Kubernetes cluster.
+
+### Docker Containers, Images, and Volumes
+
+Based on what role you assigned to the node, there are Kubernetes components in containers, containers belonging to overlay networking, DNS, ingress controller and Rancher agent. (and pods you created that have been scheduled to this node)
+
+**To clean all Docker containers, images and volumes:**
+
+```
+docker rm -f $(docker ps -qa)
+docker rmi -f $(docker images -q)
+docker volume rm $(docker volume ls -q)
+```
+
+### Mounts
+
+Kubernetes components and secrets leave behind mounts on the system that need to be unmounted.
+
+Mounts |
+--------|
+`/var/lib/kubelet/pods/XXX` (miscellaneous mounts)  |
+`/var/lib/kubelet` |
+`/var/lib/rancher` |
+
+**To unmount all mounts:**
+
+```
+for mount in $(mount | grep tmpfs | grep '/var/lib/kubelet' | awk '{ print $3 }') /var/lib/kubelet /var/lib/rancher; do umount $mount; done
+```
+
+### Directories and Files
+
+The following directories are used when adding a node to a cluster, and should be removed. You can remove a directory using `rm -rf /directory_name`.
+
+>**Note:** Depending on the role you assigned to the node, some of the directories will or won't be present on the node.
+
+Directories |
+--------|
+`/etc/ceph` |
+`/etc/cni` |
+`/etc/kubernetes` |
+`/opt/cni` |
+`/opt/rke` |
+`/run/secrets/kubernetes.io` |
+`/run/calico` |
+`/run/flannel` |
+`/var/lib/calico` |
+`/var/lib/etcd` |
+`/var/lib/cni` |
+`/var/lib/kubelet` |
+`/var/lib/rancher/rke/log` |
+`/var/log/containers` |
+`/var/log/kube-audit` |
+`/var/log/pods` |
+`/var/run/calico` |
+
+**To clean the directories:**
+
+```
+rm -rf /etc/ceph \
+       /etc/cni \
+       /etc/kubernetes \
+       /opt/cni \
+       /opt/rke \
+       /run/secrets/kubernetes.io \
+       /run/calico \
+       /run/flannel \
+       /var/lib/calico \
+       /var/lib/etcd \
+       /var/lib/cni \
+       /var/lib/kubelet \
+       /var/lib/rancher/rke/log \
+       /var/log/containers \
+       /var/log/kube-audit \
+       /var/log/pods \
+       /var/run/calico
+```
+
+### Network Interfaces and Iptables
+
+The remaining two components that are changed/configured are (virtual) network interfaces and iptables rules. Both are non-persistent to the node, meaning that they will be cleared after a restart of the node. To remove these components, a restart is recommended.
+
+**To restart a node:**
+
+```
+# using reboot
+$ sudo reboot
+
+# using shutdown
+$ sudo shutdown -r now
+```
+
+If you want to know more on (virtual) network interfaces or iptables rules, please see the specific subjects below.
+
+### Network Interfaces
+
+>**Note:** Depending on the network provider configured for the cluster the node was part of, some of the interfaces will or won't be present on the node.
+
+Interfaces |
+--------|
+`flannel.1` |
+`cni0` |
+`tunl0` |
+`caliXXXXXXXXXXX` (random interface names)  |
+`vethXXXXXXXX` (random interface names)  |
+
+**To list all interfaces:**
+
+```
+# Using ip
+ip address show
+
+# Using ifconfig
+ifconfig -a
+```
+
+**To remove an interface:**
+
+```
+ip link delete interface_name
+```
+
+### Iptables
+
+>**Note:** Depending on the network provider configured for the cluster the node was part of, some of the chains will or won't be present on the node.
+
+Iptables rules are used to route traffic from and to containers. The created rules are not persistent, so restarting the node will restore iptables to its original state.
+
+Chains |
+--------|
+`cali-failsafe-in` |
+`cali-failsafe-out` |
+`cali-fip-dnat` |
+`cali-fip-snat` |
+`cali-from-hep-forward` |
+`cali-from-host-endpoint` |
+`cali-from-wl-dispatch` |
+`cali-fw-caliXXXXXXXXXXX` (random chain names) |
+`cali-nat-outgoing` |
+`cali-pri-kns.NAMESPACE` (chain per namespace) |
+`cali-pro-kns.NAMESPACE` (chain per namespace) |
+`cali-to-hep-forward` |
+`cali-to-host-endpoint` |
+`cali-to-wl-dispatch` |
+`cali-tw-caliXXXXXXXXXXX` (random chain names) |
+`cali-wl-to-host` |
+`KUBE-EXTERNAL-SERVICES` |
+`KUBE-FIREWALL` |
+`KUBE-MARK-DROP` |
+`KUBE-MARK-MASQ` |
+`KUBE-NODEPORTS` |
+`KUBE-SEP-XXXXXXXXXXXXXXXX` (random chain names) |
+`KUBE-SERVICES` |
+`KUBE-SVC-XXXXXXXXXXXXXXXX` (random chain names) |
+
+**To list all iptables rules:**
+
+```
+iptables -L -t nat
+iptables -L -t mangle
+iptables -L
+```
diff --git a/content/rancher/v2.5/en/applications/ecm/drivers/_index.md b/content/rancher/v2.5/en/applications/ecm/drivers/_index.md
new file mode 100644
index 00000000000..1ca1981a571
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/drivers/_index.md
@@ -0,0 +1,44 @@
+---
+title: Provisioning Drivers
+weight: 12
+---
+
+Drivers in Rancher allow you to manage which providers can be used to deploy [hosted Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) or [nodes in an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) to allow Rancher to deploy and manage Kubernetes.
+
+###  Rancher Drivers
+
+With Rancher drivers, you can enable/disable existing built-in drivers that are packaged in Rancher. Alternatively, you can add your own driver if Rancher has not yet implemented it.
+
+There are two types of drivers within Rancher:
+
+* [Cluster Drivers](#cluster-drivers)
+* [Node Drivers](#node-drivers)
+
+## Cluster Drivers  
+
+Cluster drivers are used to provision [hosted Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/), such as GKE, EKS, AKS, etc.. The availability of which cluster driver to display when creating a cluster is defined based on the cluster driver's status. Only `active` cluster drivers will be displayed as an option for creating clusters for hosted Kubernetes clusters. By default, Rancher is packaged with several existing cluster drivers, but you can also create custom cluster drivers to add to Rancher.
+
+By default, Rancher has activated several hosted Kubernetes cloud providers including:
+
+*  [Amazon EKS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/)
+*  [Google GKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/gke/)
+*  [Azure AKS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/aks/)
+
+There are several other hosted Kubernetes cloud providers that are disabled by default, but are packaged in Rancher:
+
+* [Alibaba ACK]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/ack/)
+* [Huawei CCE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce/)
+* [Tencent]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke/)
+
+## Node Drivers
+
+Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. A node driver is the same as a [Docker Machine driver](https://docs.docker.com/machine/drivers/). The availability of which node driver to display when creating node templates is defined based on the node driver's status. Only `active` node drivers will be displayed as an option for creating node templates. By default, Rancher is packaged with many existing Docker Machine drivers, but you can also create custom node drivers to add to Rancher.
+
+If there are specific node drivers that you don't want to show to your users, you would need to de-activate these node drivers.
+
+Rancher supports several major cloud providers, but by default, these node drivers are active and available for deployment:
+
+*   [Amazon EC2]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/)
+*   [Azure]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/)
+*   [Digital Ocean]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/)
+*   [vSphere]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/)
diff --git a/content/rancher/v2.5/en/applications/ecm/drivers/cluster-drivers/_index.md b/content/rancher/v2.5/en/applications/ecm/drivers/cluster-drivers/_index.md
new file mode 100644
index 00000000000..ef92a737bd6
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/drivers/cluster-drivers/_index.md
@@ -0,0 +1,44 @@
+---
+title: Cluster Drivers
+weight: 1
+---
+
+_Available as of v2.2.0_
+
+Cluster drivers are used to create clusters in a [hosted Kubernetes provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/), such as Google GKE. The availability of which cluster driver to display when creating clusters is defined by the cluster driver's status. Only `active` cluster drivers will be displayed as an option for creating clusters. By default, Rancher is packaged with several existing cloud provider cluster drivers, but you can also add custom cluster drivers to Rancher.
+
+If there are specific cluster drivers that you do not want to show your users, you may deactivate those cluster drivers within Rancher and they will not appear as an option for cluster creation.
+
+### Managing Cluster Drivers
+
+>**Prerequisites:** To create, edit, or delete cluster drivers, you need _one_ of the following permissions:
+>
+>- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
+>- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Cluster Drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
+
+## Activating/Deactivating Cluster Drivers
+
+By default, Rancher only activates drivers for the most popular cloud providers, Google GKE, Amazon EKS and Azure AKS. If you want to show or hide any node driver, you can change its status.
+
+1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar.
+
+2.  From the **Drivers** page, select the **Cluster Drivers** tab.
+
+3.  Select the driver that you wish to **Activate** or **Deactivate** and select the appropriate icon.
+
+## Adding Custom Cluster Drivers
+
+If you want to use a cluster driver that Rancher doesn't support out-of-the-box, you can add the provider's driver in order to start using them to create _hosted_ kubernetes clusters.
+
+1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar.
+
+2.  From the **Drivers** page select the **Cluster Drivers** tab.
+
+3.  Click **Add Cluster Driver**.
+
+4.  Complete the **Add Cluster Driver** form. Then click **Create**.
+
+
+### Developing your own Cluster Driver
+
+In order to develop cluster driver to add to Rancher, please refer to our [example](https://github.com/rancher-plugins/kontainer-engine-driver-example).
diff --git a/content/rancher/v2.5/en/applications/ecm/drivers/node-drivers/_index.md b/content/rancher/v2.5/en/applications/ecm/drivers/node-drivers/_index.md
new file mode 100644
index 00000000000..69975a929ff
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/drivers/node-drivers/_index.md
@@ -0,0 +1,37 @@
+---
+title: Node Drivers
+weight: 2
+---
+
+Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. A node driver is the same as a [Docker Machine driver](https://docs.docker.com/machine/drivers/). The availability of which node driver to display when creating node templates is defined based on the node driver's status. Only `active` node drivers will be displayed as an option for creating node templates. By default, Rancher is packaged with many existing Docker Machine drivers, but you can also create custom node drivers to add to Rancher.
+
+If there are specific node drivers that you don't want to show to your users, you would need to de-activate these node drivers.
+
+#### Managing Node Drivers
+
+>**Prerequisites:** To create, edit, or delete drivers, you need _one_ of the following permissions:
+>
+>- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
+>- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Node Drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
+
+## Activating/Deactivating Node Drivers
+
+By default, Rancher only activates drivers for the most popular cloud providers, Amazon EC2, Azure, DigitalOcean and vSphere. If you want to show or hide any node driver, you can change its status.
+
+1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar. From the **Drivers** page, select the **Node Drivers** tab. In version prior to v2.2.0, you can select **Node Drivers** directly in the navigation bar.
+
+2.	Select the driver that you wish to **Activate** or **Deactivate** and select the appropriate icon.
+
+## Adding Custom Node Drivers
+
+If you want to use a node driver that Rancher doesn't support out-of-the-box, you can add that provider's driver in order to start using them to create node templates and eventually node pools for your Kubernetes cluster.
+
+1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar. From the **Drivers** page, select the **Node Drivers** tab. In version prior to v2.2.0, you can select **Node Drivers** directly in the navigation bar.  
+
+2.	Click **Add Node Driver**.
+
+3.	Complete the **Add Node Driver** form. Then click **Create**.
+
+### Developing your own node driver
+
+Node drivers are implemented with [Docker Machine](https://docs.docker.com/machine/).
diff --git a/content/rancher/v2.5/en/applications/ecm/feature-flags/_index.md b/content/rancher/v2.5/en/applications/ecm/feature-flags/_index.md
new file mode 100644
index 00000000000..6dc6e316475
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/feature-flags/_index.md
@@ -0,0 +1,156 @@
+---
+title: Enabling Experimental Features
+weight: 17
+---
+
+> This page is under construction.
+
+Rancher includes some features that are experimental and disabled by default. You might want to enable these features, for example, if you decide that the benefits of using an [unsupported storage type]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers) outweighs the risk of using an untested feature. Feature flags were introduced to allow you to try these features that are not enabled by default.
+
+The features can be enabled in three ways:
+
+- [Enable features when starting Rancher.](#enabling-features-when-starting-rancher) When installing Rancher with a CLI, you can use a feature flag to enable a feature by default.
+- [Enable features from the Rancher UI](#enabling-features-with-the-rancher-ui) in Rancher v2.3.3+ by going to the **Settings** page.
+- [Enable features with the Rancher API](#enabling-features-with-the-rancher-api) after installing Rancher.
+
+Each feature has two values:
+
+- A default value, which can be configured with a flag or environment variable from the command line
+- A set value, which can be configured with the Rancher API or UI
+
+If no value has been set, Rancher uses the default value.
+
+Because the API sets the actual value and the command line sets the default value, that means that if you enable or disable a feature with the API or UI, it will override any value set with the command line.
+
+For example, if you install Rancher, then set a feature flag to true with the Rancher API, then upgrade Rancher with a command that sets the feature flag to false, the default value will still be false, but the feature will still be enabled because it was set with the Rancher API. If you then deleted the set value (true) with the Rancher API, setting it to NULL, the default value (false) would take effect.
+
+> **Note:** As of v2.4.0, there are some feature flags that may require a restart of the Rancher server container. These features that require a restart are marked in the table of these docs and in the UI.
+
+The following is a list of the feature flags available in Rancher:
+
+- `dashboard`: This feature enables the new experimental UI that has a new look and feel. The dashboard also leverages a new API in Rancher which allows the UI to access the default Kubernetes resources without any intervention from Rancher.
+- `istio-virtual-service-ui`: This feature enables a [UI to create, read, update, and delete Istio virtual services and destination rules]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/istio-virtual-service-ui), which are traffic management features of Istio.
+- `proxy`: This feature enables Rancher to use a new simplified code base for the proxy, which can help enhance performance and security. The proxy feature is known to have issues with Helm deployments, which prevents any catalog applications to be deployed which includes Rancher's tools like monitoring, logging, Istio, etc.
+- `unsupported-storage-drivers`: This feature [allows unsupported storage drivers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers) In other words, it enables types for storage providers and provisioners that are not enabled by default.
+
+The below table shows the availability and default value for feature flags in Rancher:
+
+| Feature Flag Name             | Default Value | Status       | Available as of | Rancher Restart Required? |
+| ----------------------------- | ------------- | ------------ | --------------- |---|
+| `dashboard` | `true` | Experimental | v2.4.0 | x |
+| `istio-virtual-service-ui`    | `false`       | Experimental | v2.3.0          | |
+| `istio-virtual-service-ui`    | `true`        | GA           | v2.3.2          | |
+| `proxy` | `false` | Experimental | v2.4.0 | |
+| `unsupported-storage-drivers` | `false`       | Experimental | v2.3.0          | |
+
+# Enabling Features when Starting Rancher
+
+When you install Rancher, enable the feature you want with a feature flag. The command is different depending on whether you are installing Rancher on a single node or if you are doing a Kubernetes Installation of Rancher.
+
+> **Note:** Values set from the Rancher API will override the value passed in through the command line.
+
+{{% tabs %}}
+{{% tab "Kubernetes Install" %}}
+When installing Rancher with a Helm chart, use the `--features` option. In the below example, two features are enabled by passing the feature flag names names in a comma separated list:
+
+```
+helm install rancher-latest/rancher \
+  --name rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
+  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
+```
+
+Note: If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
+
+### Rendering the Helm Chart for Air Gap Installations
+
+For an air gap installation of Rancher, you need to add a Helm chart repository and render a Helm template before installing Rancher with Helm. For details, refer to the [air gap installation documentation.]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher)
+
+Here is an example of a command for passing in the feature flag names when rendering the Helm template. In the below example, two features are enabled by passing the feature flag names in a comma separated list.
+
+The Helm 3 command is as follows:
+
+```
+helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
+  --namespace cattle-system \
+  --set hostname=<RANCHER.YOURDOMAIN.COM> \
+  --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+  --set ingress.tls.source=secret \
+  --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+  --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
+  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
+```
+
+The Helm 2 command is as follows:
+
+```
+helm template ./rancher-<VERSION>.tgz --output-dir . \
+  --name rancher \
+  --namespace cattle-system \
+  --set hostname=<RANCHER.YOURDOMAIN.COM> \
+  --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+  --set ingress.tls.source=secret \
+  --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+  --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
+  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
+```
+
+{{% /tab %}}
+{{% tab "Docker Install" %}}
+When installing Rancher with Docker, use the `--features` option. In the below example, two features are enabled by passing the feature flag names in a comma separated list:
+
+```
+docker run -d -p 80:80 -p 443:443 \
+  --restart=unless-stopped \
+  rancher/rancher:rancher-latest \
+  --features=<FEATURE-FLAG-NAME-1>=true,<FEATURE-NAME-2>=true # Available as of v2.3.0
+```
+
+{{% /tab %}}
+{{% /tabs %}}
+
+# Enabling Features with the Rancher UI
+
+_Available as of Rancher v2.3.3_
+
+1. Go to the **Global** view and click **Settings.**
+1. Click the **Feature Flags** tab. You will see a list of experimental features.
+1. To enable a feature, go to the disabled feature you want to enable and click **&#8942; > Activate.**
+
+**Result:** The feature is enabled.
+
+### Disabling Features with the Rancher UI
+
+1. Go to the **Global** view and click **Settings.**
+1. Click the **Feature Flags** tab. You will see a list of experimental features.
+1. To disable a feature, go to the enabled feature you want to disable and click **&#8942; > Deactivate.**
+
+**Result:** The feature is disabled.
+
+# Enabling Features with the Rancher API
+
+1. Go to `<RANCHER-SERVER-URL>/v3/features`.
+1. In the `data` section, you will see an array containing all of the features that can be turned on with feature flags. The name of the feature is in the `id` field. Click the name of the feature you want to enable.
+1. In the upper left corner of the screen, under **Operations,** click **Edit.**
+1. In the **Value** drop-down menu, click **True.**
+1. Click **Show Request.**
+1. Click **Send Request.**
+1. Click **Close.**
+
+**Result:** The feature is enabled.
+
+### Disabling Features with the Rancher API
+
+1. Go to `<RANCHER-SERVER-URL>/v3/features`.
+1. In the `data` section, you will see an array containing all of the features that can be turned on with feature flags. The name of the feature is in the `id` field. Click the name of the feature you want to enable.
+1. In the upper left corner of the screen, under **Operations,** click **Edit.**
+1. In the **Value** drop-down menu, click **False.**
+1. Click **Show Request.**
+1. Click **Send Request.**
+1. Click **Close.**
+
+**Result:** The feature is disabled.
diff --git a/content/rancher/v2.5/en/applications/ecm/feature-flags/enable-not-default-storage-drivers/_index.md b/content/rancher/v2.5/en/applications/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
new file mode 100644
index 00000000000..8d254d8bd6d
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
@@ -0,0 +1,43 @@
+---
+title: Allow Unsupported Storage Drivers
+weight: 1
+aliases:
+  - /rancher/v2.x/en/admin-settings/feature-flags/enable-not-default-storage-drivers
+---
+_Available as of v2.3.0_
+
+This feature allows you to use types for storage providers and provisioners that are not enabled by default.
+
+To enable or disable this feature, refer to the instructions on [the main page about enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
+
+Environment Variable Key | Default Value | Description
+---|---|---
+ `unsupported-storage-drivers` | `false` | This feature enables types for storage providers and provisioners that are not enabled by default.
+
+### Types for Persistent Volume Plugins that are Enabled by Default
+Below is a list of storage types for persistent volume plugins that are enabled by default. When enabling this feature flag, any persistent volume plugins that are not on this list are considered experimental and unsupported:
+
+Name | Plugin
+--------|----------
+Amazon EBS Disk |  `aws-ebs`
+AzureFile | `azure-file`
+AzureDisk | `azure-disk`
+Google Persistent Disk | `gce-pd`
+Longhorn | `flex-volume-longhorn`
+VMware vSphere Volume |  `vsphere-volume`
+Local | `local`
+Network File System | `nfs`
+hostPath | `host-path`
+
+### Types for StorageClass that are Enabled by Default
+Below is a list of storage types for a StorageClass that are enabled by default. When enabling this feature flag, any persistent volume plugins that are not on this list are considered experimental and unsupported:
+
+Name | Plugin
+--------|--------
+Amazon EBS Disk |  `aws-ebs`
+AzureFile | `azure-file`
+AzureDisk | `azure-disk`
+Google Persistent Disk | `gce-pd`
+Longhorn | `flex-volume-longhorn`
+VMware vSphere Volume | `vsphere-volume`
+Local | `local`
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/feature-flags/istio-virtual-service-ui/_index.md b/content/rancher/v2.5/en/applications/ecm/feature-flags/istio-virtual-service-ui/_index.md
new file mode 100644
index 00000000000..f631b54d2ee
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/feature-flags/istio-virtual-service-ui/_index.md
@@ -0,0 +1,34 @@
+---
+title: UI for Istio Virtual Services and Destination Rules
+weight: 2
+aliases:
+  - /rancher/v2.x/en/admin-settings/feature-flags/istio-virtual-service-ui
+---
+_Available as of v2.3.0_
+
+This feature enables a UI that lets you create, read, update and delete virtual services and destination rules, which are traffic management features of Istio.
+
+> **Prerequisite:** Turning on this feature does not enable Istio. A cluster administrator needs to [enable Istio for the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) in order to use the feature.
+
+To enable or disable this feature, refer to the instructions on [the main page about enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
+
+Environment Variable Key | Default Value | Status | Available as of
+---|---|---|---
+`istio-virtual-service-ui` |`false` |  Experimental | v2.3.0
+`istio-virtual-service-ui` | `true` | GA                    | v2.3.2
+
+# About this Feature
+
+A central advantage of Istio's traffic management features is that they allow dynamic request routing, which is useful for canary deployments, blue/green deployments, or A/B testing.
+
+When enabled, this feature turns on a page that lets you configure some traffic management features of Istio using the Rancher UI. Without this feature, you need to use `kubectl` to manage traffic with Istio.
+
+The feature enables two UI tabs: one tab for **Virtual Services** and another for **Destination Rules.** 
+
+- **Virtual services** intercept and direct traffic to your Kubernetes services, allowing you to direct percentages of traffic from a request to different services. You can use them to define a set of routing rules to apply when a host is addressed. For details, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/)
+- **Destination rules** serve as the single source of truth about which service versions are available to receive traffic from virtual services. You can use these resources to define policies that apply to traffic that is intended for a service after routing has occurred. For details, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule)
+
+To see these tabs,
+
+1. Go to the project view in Rancher and click **Resources > Istio.**
+1. You will see tabs for **Traffic Graph,** which has the Kiali network visualization integrated into the UI, and **Traffic Metrics,** which shows metrics for the success rate and request volume of traffic to your services, among other metrics. Next to these tabs, you should see the tabs for **Virtual Services** and **Destination Rules.**
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/globaldns/_index.md b/content/rancher/v2.5/en/applications/ecm/globaldns/_index.md
new file mode 100644
index 00000000000..5feadfde201
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/globaldns/_index.md
@@ -0,0 +1,118 @@
+---
+title: Global DNS
+weight: 1
+---
+
+ > This page is under construction.
+
+Rancher's Global DNS feature provides a way to program an external DNS provider to route traffic to your Kubernetes applications. Since the DNS programming supports spanning applications across different Kubernetes clusters, Global DNS is configured at a global level. An application can become highly available as it allows you to have one application run on different Kubernetes clusters. If one of your Kubernetes clusters goes down, the application would still be accessible.
+
+> **Note:** Global DNS is only available in [Kubernetes installations]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/) with the [`local` cluster enabled]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#import-local-cluster).
+
+## Global DNS Providers
+
+Prior to adding in Global DNS entries, you will need to configure access to an external provider.
+
+The following table lists the first version of Rancher each provider debuted.
+
+| DNS Provider | Available as of  |
+| --- | --- |
+| [AWS Route53](https://aws.amazon.com/route53/)  | v2.2.0 |
+| [CloudFlare](https://www.cloudflare.com/dns/) | v2.2.0 |
+| [AliDNS](https://www.alibabacloud.com/product/dns) | v2.2.0 |
+
+## Global DNS Entries
+
+For each application that you want to route traffic to, you will need to create a Global DNS Entry. This entry will use a fully qualified domain name (a.k.a FQDN) from a global DNS provider to target applications. The applications can either resolve to a single [multi-cluster application]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or to specific projects. You must [add specific annotation labels](#adding-annotations-to-ingresses-to-program-the-external-dns) to the ingresses in order for traffic to be routed correctly to the applications. Without this annotation, the programming for the DNS entry will not work.
+
+## Permissions for Global DNS Providers/Entries
+
+By default, only [global administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) and the creator of the Global DNS provider or Global DNS entry have access to use, edit and delete them. When creating the provider or entry, the creator can add additional users in order for those users to access and manage them. By default, these members will get `Owner` role to manage them.
+
+## Setting up Global DNS for Applications
+
+### Add a Global DNS Provider
+
+1. From the **Global View**, select **Tools > Global DNS Providers**.
+1. To add a provider, choose from the available provider options and configure the Global DNS Provider with necessary credentials and an optional domain.
+1. (Optional) Add additional users so they could  use the provider when creating Global DNS entries as well as manage the Global DNS provider.
+
+{{% accordion id="route53" label="Route53" %}}
+1. Enter a **Name** for the provider.
+1. (Optional) Enter the **Root Domain** of the hosted zone on AWS Route53. If this is not provided, Rancher's Global DNS Provider will work with all hosted zones that the AWS keys can access.
+1. Enter the AWS **Access Key**.
+1. Enter the AWS **Secret Key**.
+1. Under **Member Access**, search for any users that you want to have the ability to use this provider. By adding this user, they will also be able to manage the Global DNS Provider entry.
+1. Click **Create**.
+{{% /accordion %}}
+{{% accordion id="cloudflare" label="CloudFlare" %}}
+1. Enter a **Name** for the provider.
+1. Enter the **Root Domain**, this field is optional, in case this is not provided, Rancher's Global DNS Provider will work with all domains that the keys can access.
+1. Enter the CloudFlare **API Email**.
+1. Enter the CloudFlare **API Key**.
+1. Under **Member Access**, search for any users that you want to have the ability to use this provider. By adding this user, they will also be able to manage the Global DNS Provider entry.
+1. Click **Create**.
+{{% /accordion %}}
+{{% accordion id="alidns" label="AliDNS" %}}
+1. Enter a **Name** for the provider.
+1. Enter the **Root Domain**, this field is optional, in case this is not provided, Rancher's Global DNS Provider will work with all domains that the keys can access.
+1. Enter the **Access Key**.
+1. Enter the **Secret Key**.
+1. Under **Member Access**, search for any users that you want to have the ability to use this provider. By adding this user, they will also be able to manage the Global DNS Provider entry.
+1. Click **Create**.
+
+>**Notes:**
+>
+>- Alibaba Cloud SDK uses TZ data. It needs to be present on `/usr/share/zoneinfo` path of the nodes running [`local` cluster]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#import-local-cluster), and it is mounted to the external DNS pods. If it is not available on the nodes, please follow the [instruction](https://www.ietf.org/timezones/tzdb-2018f/tz-link.html) to prepare it.
+>- Different versions of AliDNS have different allowable TTL range, where the default TTL for a global DNS entry may not be valid. Please see the [reference](https://www.alibabacloud.com/help/doc-detail/34338.htm) before adding an AliDNS entry.
+{{% /accordion %}}
+
+### Add a Global DNS Entry
+
+1. From the **Global View**, select **Tools > Global DNS Entries**.
+1. Click on **Add DNS Entry**.
+1. Enter the **FQDN** you wish to program on the external DNS.
+1. Select a Global DNS **Provider** from the list.
+1. Select if this DNS entry will be for a [multi-cluster application]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or for workloads in different [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).  You will need to ensure that [annotations are added to any ingresses](#adding-annotations-to-ingresses-to-program-the-external-dns) for the applications that you want to target.
+1. Configure the **DNS TTL** value in seconds. By default, it will be 300 seconds.
+1. Under **Member Access**, search for any users that you want to have the ability to manage this Global DNS entry.
+
+## Adding Annotations to Ingresses to program the External DNS
+
+In order for Global DNS entries to be programmed, you will need to add a specific annotation on an ingress in your application or target project and this ingress needs to use a specific `hostname` and an annotation that should match the FQDN of the Global DNS entry.
+
+1. For any application that you want targeted for your Global DNS entry, find an ingress associated with the application.
+1. In order for the DNS to be programmed, the following requirements must be met:
+   * The ingress routing rule must be set to use a `hostname` that matches the FQDN of the Global DNS entry.
+   * The ingress must have an annotation (`rancher.io/globalDNS.hostname`) and the value of this annotation should match the FQDN of the Global DNS entry.
+1. Once the ingress in your [multi-cluster application]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or in your target projects are in `active` state, the FQDN will be programmed on the external DNS against the Ingress IP addresses.
+
+## Editing a Global DNS Provider
+
+The [global administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), creator of the Global DNS provider and any users added as `members` to a Global DNS provider, have _owner_ access to that provider. Any members can edit the following fields:
+
+- Root Domain
+- Access Key & Secret Key
+- Members
+
+1. From the **Global View**, select **Tools > Global DNS Providers**.
+
+1. For the Global DNS provider that you want to edit, click the **&#8942; > Edit**.
+
+## Editing a Global DNS Entry
+
+The [global administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), creator of the Global DNS entry and any users added as `members` to a Global DNS entry, have _owner_ access to that DNS entry. Any members can edit the following fields:
+
+- FQDN
+- Global DNS Provider
+- Target Projects or Multi-Cluster App
+- DNS TTL
+- Members
+
+Any users who can access the Global DNS entry can **only** add target projects that they have access to. However, users can remove **any** target project as there is no check to confirm if that user has access to the target project.
+
+Permission checks are relaxed for removing target projects in order to support situations where the user's permissions might have changed before they were able to delete the target project. Another use case could be that the target project was removed from the cluster before being removed from a target project of the Global DNS entry.
+
+1. From the **Global View**, select **Tools > Global DNS Entries**.
+
+1. For the Global DNS entry that you want to edit, click the **&#8942; > Edit**.
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/_index.md
new file mode 100644
index 00000000000..2512a53d2a1
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/_index.md
@@ -0,0 +1,4 @@
+---
+title: Infrastructure Management
+weight: 14
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-credentials/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-credentials/_index.md
new file mode 100644
index 00000000000..a85ca3d3e06
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-credentials/_index.md
@@ -0,0 +1,49 @@
+---
+title: Managing Cloud Credentials
+weight: 3
+---
+
+When you create a cluster [hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools), [node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) are used to provision the cluster nodes. These templates use Docker Machine configuration options to define an operating system image and settings/parameters for the node.
+
+Node templates can use cloud credentials to access the credential information required to provision nodes in the infrastructure providers. The same cloud credential can be used by multiple node templates. By using a cloud credential, you do not have to re-enter access keys for the same cloud provider. Cloud credentials are stored as Kubernetes secrets.
+
+Cloud credentials are only used by node templates if there are fields marked as `password`. The default `active` node drivers have their account access fields marked as `password`, but there may be some `inactive` node drivers, which are not using them yet. These node drivers will not use cloud credentials.
+
+You can create cloud credentials in two contexts:
+
+- [During creation of a node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) for a cluster.
+- In the **User Settings**
+
+All cloud credentials are bound to the user profile of who created it. They **cannot** be shared across users.
+
+## Creating a Cloud Credential from User Settings
+
+1. From your user settings, select **User Avatar > Cloud Credentials**.
+1. Click **Add Cloud Credential**.
+1. Enter a name for the cloud credential.
+1. Select a **Cloud Credential Type** from the drop down. The values of this dropdown is based on the `active` [node drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) in Rancher.
+1. Based on the selected cloud credential type, enter the required values to authenticate with the infrastructure provider.
+1. Click **Create**.
+
+**Result:** The cloud credential is created and can immediately be used to [create node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates).
+
+## Updating a Cloud Credential
+
+When access credentials are changed or compromised, updating a cloud credential allows you to rotate those credentials while keeping the same node template.  
+
+1. From your user settings, select **User Avatar > Cloud Credentials**.
+1. Choose the cloud credential you want to edit and click the **&#8942; > Edit**.
+1. Update the credential information and click **Save**.
+
+**Result:** The cloud credential is updated with the new access credentials. All existing node templates using this cloud credential will automatically use the updated information whenever [new nodes are added]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
+
+## Deleting a Cloud Credential
+
+In order to delete cloud credentials, there must not be any node template associated with it. If you are unable to delete the cloud credential, [delete any node templates]({{<baseurl>}}/rancher/v2.x/en/user-settings/node-templates/#deleting-a-node-template) that are still associated to that cloud credential.
+
+1. From your user settings, select **User Avatar > Cloud Credentials**.
+1. You can either individually delete a cloud credential or bulk delete.
+
+	- To individually delete one, choose the cloud credential you want to edit and click the **&#8942; > Delete**.
+	- To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
+1. Confirm that you want to delete these cloud credentials.
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/_index.md
new file mode 100644
index 00000000000..4eb2f7ac57b
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/_index.md
@@ -0,0 +1,39 @@
+---
+title: Setting up Cloud Providers
+weight: 4
+---
+
+A _cloud provider_ is a module in Kubernetes that provides an interface for managing nodes, load balancers, and networking routes. For more information, refer to the [official Kubernetes documentation on cloud providers.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/)
+
+When a cloud provider is set up in Rancher, the Rancher server can automatically provision new nodes, load balancers or persistent storage devices when launching Kubernetes definitions, if the cloud provider you're using supports such automation.
+
+Your cluster will not provision correctly if you configure a cloud provider cluster of nodes that do not meet the prerequisites.
+
+By default, the **Cloud Provider** option is set to `None`.
+
+The following cloud providers can be enabled:
+
+* Amazon
+* Azure
+* GCE (Google Compute Engine)
+
+### Setting up the Amazon Cloud Provider
+
+For details on enabling the Amazon cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon)
+
+### Setting up the Azure Cloud Provider
+
+For details on enabling the Azure cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/azure)
+
+### Setting up the GCE Cloud Provider
+
+For details on enabling the Google Compute Engine cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce)
+
+### Setting up a Custom Cloud Provider
+
+The `Custom` cloud provider is available if you want to configure any [Kubernetes cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/).
+
+For the custom cloud provider option, you can refer to the [RKE docs]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/) on how to edit the yaml file for your specific cloud provider. There are specific cloud providers that have more detailed configuration :
+
+* [vSphere]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere/)
+* [Openstack]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/openstack/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/amazon/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/amazon/_index.md
new file mode 100644
index 00000000000..5a6fc9f45fb
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/amazon/_index.md
@@ -0,0 +1,150 @@
+---
+title: Setting up the Amazon Cloud Provider
+weight: 1
+---
+
+When using the `Amazon` cloud provider, you can leverage the following capabilities:
+
+- **Load Balancers:** Launches an AWS Elastic Load Balancer (ELB) when choosing `Layer-4 Load Balancer` in **Port Mapping** or when launching a `Service` with `type: LoadBalancer`.
+- **Persistent Volumes**: Allows you to use AWS Elastic Block Stores (EBS) for persistent volumes.
+
+See [cloud-provider-aws README](https://github.com/kubernetes/cloud-provider-aws/blob/master/README.md) for all information regarding the Amazon cloud provider.
+
+To set up the Amazon cloud provider,
+
+1. [Create an IAM role and attach to the instances](#1-create-an-iam-role-and-attach-to-the-instances)
+2. [Configure the ClusterID](#2-configure-the-clusterid)
+
+### 1. Create an IAM Role and attach to the instances
+
+All nodes added to the cluster must be able to interact with EC2 so that they can create and remove resources. You can enable this interaction by using an IAM role attached to the instance. See [Amazon documentation: Creating an IAM Role](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#create-iam-role) how to create an IAM role. There are two example policies:
+
+* The first policy is for the nodes with the `controlplane` role. These nodes have to be able to create/remove EC2 resources. The following IAM policy is an example, please remove any unneeded permissions for your use case.
+* The second policy is for the nodes with the `etcd` or `worker` role. These nodes only have to be able to retrieve information from EC2.
+
+While creating an [Amazon EC2 cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/#create-the-amazon-ec2-cluster), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**.
+
+While creating a [Custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes), you must manually attach the IAM role to the instance(s).
+
+IAM Policy for nodes with the `controlplane` role:
+
+```json
+{
+"Version": "2012-10-17",
+"Statement": [
+  {
+    "Effect": "Allow",
+    "Action": [
+      "autoscaling:DescribeAutoScalingGroups",
+      "autoscaling:DescribeLaunchConfigurations",
+      "autoscaling:DescribeTags",
+      "ec2:DescribeInstances",
+      "ec2:DescribeRegions",
+      "ec2:DescribeRouteTables",
+      "ec2:DescribeSecurityGroups",
+      "ec2:DescribeSubnets",
+      "ec2:DescribeVolumes",
+      "ec2:CreateSecurityGroup",
+      "ec2:CreateTags",
+      "ec2:CreateVolume",
+      "ec2:ModifyInstanceAttribute",
+      "ec2:ModifyVolume",
+      "ec2:AttachVolume",
+      "ec2:AuthorizeSecurityGroupIngress",
+      "ec2:CreateRoute",
+      "ec2:DeleteRoute",
+      "ec2:DeleteSecurityGroup",
+      "ec2:DeleteVolume",
+      "ec2:DetachVolume",
+      "ec2:RevokeSecurityGroupIngress",
+      "ec2:DescribeVpcs",
+      "elasticloadbalancing:AddTags",
+      "elasticloadbalancing:AttachLoadBalancerToSubnets",
+      "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+      "elasticloadbalancing:CreateLoadBalancer",
+      "elasticloadbalancing:CreateLoadBalancerPolicy",
+      "elasticloadbalancing:CreateLoadBalancerListeners",
+      "elasticloadbalancing:ConfigureHealthCheck",
+      "elasticloadbalancing:DeleteLoadBalancer",
+      "elasticloadbalancing:DeleteLoadBalancerListeners",
+      "elasticloadbalancing:DescribeLoadBalancers",
+      "elasticloadbalancing:DescribeLoadBalancerAttributes",
+      "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+      "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+      "elasticloadbalancing:ModifyLoadBalancerAttributes",
+      "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+      "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+      "elasticloadbalancing:AddTags",
+      "elasticloadbalancing:CreateListener",
+      "elasticloadbalancing:CreateTargetGroup",
+      "elasticloadbalancing:DeleteListener",
+      "elasticloadbalancing:DeleteTargetGroup",
+      "elasticloadbalancing:DescribeListeners",
+      "elasticloadbalancing:DescribeLoadBalancerPolicies",
+      "elasticloadbalancing:DescribeTargetGroups",
+      "elasticloadbalancing:DescribeTargetHealth",
+      "elasticloadbalancing:ModifyListener",
+      "elasticloadbalancing:ModifyTargetGroup",
+      "elasticloadbalancing:RegisterTargets",
+      "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+      "iam:CreateServiceLinkedRole",
+      "kms:DescribeKey"
+    ],
+    "Resource": [
+      "*"
+    ]
+  }
+]
+}
+```
+
+IAM policy for nodes with the `etcd` or `worker` role:
+
+```json
+{
+"Version": "2012-10-17",
+"Statement": [
+    {
+        "Effect": "Allow",
+        "Action": [
+            "ec2:DescribeInstances",
+            "ec2:DescribeRegions",
+            "ecr:GetAuthorizationToken",
+            "ecr:BatchCheckLayerAvailability",
+            "ecr:GetDownloadUrlForLayer",
+            "ecr:GetRepositoryPolicy",
+            "ecr:DescribeRepositories",
+            "ecr:ListImages",
+            "ecr:BatchGetImage"
+        ],
+        "Resource": "*"
+    }
+]
+}
+```
+
+### 2. Configure the ClusterID
+
+The following resources need to tagged with a `ClusterID`:
+
+- **Nodes**: All hosts added in Rancher.
+- **Subnet**: The subnet used for your cluster.
+- **Security Group**: The security group used for your cluster.
+
+>**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating an Elastic Load Balancer (ELB).
+
+When you create an [Amazon EC2 Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/#create-the-amazon-ec2-cluster), the `ClusterID` is automatically configured for the created nodes. Other resources still need to be tagged manually.
+
+Use the following tag:
+
+**Key** = `kubernetes.io/cluster/CLUSTERID` **Value** = `owned`
+
+`CLUSTERID` can be any string you like, as long as it is equal across all tags set.
+
+Setting the value of the tag to `owned` tells the cluster that all resources with this tag are owned and managed by this cluster. If you share resources between clusters, you can change the tag to:
+
+**Key** = `kubernetes.io/cluster/CLUSTERID` **Value** = `shared`.
+
+### Using Amazon Elastic Container Registry (ECR)
+
+The kubelet component has the ability to automatically obtain ECR credentials, when the IAM profile mentioned in [Create an IAM Role and attach to the instances](#1-create-an-iam-role-and-attach-to-the-instances) is attached to the instance(s). When using a Kubernetes version older than v1.15.0, the Amazon cloud provider needs be configured in the cluster. Starting with Kubernetes version v1.15.0, the kubelet can obtain ECR credentials without having the Amazon cloud provider configured in the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/azure/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/azure/_index.md
new file mode 100644
index 00000000000..25884572579
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/azure/_index.md
@@ -0,0 +1,70 @@
+---
+title: Setting up the Azure Cloud Provider
+weight: 2
+---
+
+When using the `Azure` cloud provider, you can leverage the following capabilities:
+
+- **Load Balancers:** Launches an Azure Load Balancer within a specific Network Security Group.
+
+- **Persistent Volumes:** Supports using Azure Blob disks and Azure Managed Disks with standard and premium storage accounts.
+
+- **Network Storage:** Support Azure Files via CIFS mounts.
+
+The following account types are not supported for Azure Subscriptions:
+
+- Single tenant accounts (i.e. accounts with no subscriptions).
+- Multi-subscription accounts.
+
+To set up the Azure cloud provider following credentials need to be configured:
+
+1. [Set up the Azure Tenant ID](#1-set-up-the-azure-tenant-id)
+2. [Set up the Azure Client ID and Azure Client Secret](#2-set-up-the-azure-client-id-and-azure-client-secret)
+3. [Configure App Registration Permissions](#3-configure-app-registration-permissions)
+4. [Set up Azure Network Security Group Name](#4-set-up-azure-network-security-group-name)
+
+### 1. Set up the Azure Tenant ID
+
+Visit [Azure portal](https://portal.azure.com), login and go to **Azure Active Directory** and select **Properties**. Your **Directory ID** is your **Tenant ID** (tenantID).
+
+If you want to use the Azure CLI, you can run the command `az account show` to get the information.
+
+### 2. Set up the Azure Client ID and Azure Client Secret 
+
+Visit [Azure portal](https://portal.azure.com), login and follow the steps below to create an **App Registration** and the corresponding **Azure Client ID** (aadClientId) and **Azure Client Secret** (aadClientSecret).
+
+1. Select **Azure Active Directory**.
+1. Select **App registrations**.
+1. Select **New application registration**.
+1. Choose a **Name**, select `Web app / API` as **Application Type** and a **Sign-on URL** which can be anything in this case.
+1. Select **Create**.
+
+In the **App registrations** view, you should see your created App registration. The value shown in the column **APPLICATION ID** is what you need to use as **Azure Client ID**.
+
+The next step is to generate the **Azure Client Secret**:
+
+1. Open your created App registration.
+1. In the **Settings** view, open **Keys**.
+1. Enter a **Key description**, select an expiration time and select **Save**.
+1. The generated value shown in the column **Value** is what you need to use as **Azure Client Secret**. This value will only be shown once.
+
+### 3. Configure App Registration Permissions
+
+The last thing you will need to do, is assign the appropriate permissions to your App registration.
+
+1. Go to **More services**, search for **Subscriptions** and open it.
+1. Open **Access control (IAM)**.
+1. Select **Add**.
+1. For **Role**, select `Contributor`.
+1. For **Select**, select your created App registration name.
+1. Select **Save**.
+
+### 4. Set up Azure Network Security Group Name
+
+A custom Azure Network Security Group (securityGroupName) is needed to allow Azure Load Balancers to work.
+
+If you provision hosts using Rancher Machine Azure driver, you will need to edit them manually to assign them to this Network Security Group.
+
+You should already assign custom hosts to this Network Security Group during provisioning.
+
+Only hosts expected to be load balancer back ends need to be in this group.
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/gce/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/gce/_index.md
new file mode 100644
index 00000000000..000b537c110
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/gce/_index.md
@@ -0,0 +1,54 @@
+---
+title: Setting up the Google Compute Engine Cloud Provider
+weight: 3
+---
+
+In this section, you'll learn how to enable the Google Compute Engine (GCE) cloud provider for custom clusters in Rancher. A custom cluster is one in which Rancher installs Kubernetes on existing nodes.
+
+The official Kubernetes documentation for the GCE cloud provider is [here.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#gce)
+
+> **Prerequisites:** The service account of `Identity and API` access on GCE needs the `Computer Admin` permission. 
+
+If you are using Calico,
+
+1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
+1. Click **Edit as YAML,** and enter the following configuration:
+
+    ```
+    rancher_kubernetes_engine_config:
+      cloud_provider:
+        name: gce
+        customCloudProvider: |- 
+          [Global]
+          project-id=<your project ID, optional>
+          network-name=<your network, optional if using default network>
+          subnetwork-name=<your subnetwork of the above network, optional if using default network>
+          node-instance-prefix=<your instance group name/your instance name specific prefix, required>
+          node-tags=<your network tags, must patch one or some tags, required>
+      network:
+        options: 
+          calico_cloud_provider: "gce"
+        plugin: "calico"
+    ```
+
+If you are using Canal or Flannel,
+
+1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
+1. Click **Edit as YAML,** and enter the following configuration:
+
+    ```
+    rancher_kubernetes_engine_config:
+      cloud_provider: 
+        name: gce
+        customCloudProvider: |- 
+          [Global]
+          project-id=<your project ID, optional>
+          network-name=<your network, optional if using default network>
+          subnetwork-name=<your subnetwork of the above network, optional if using default network>
+          node-instance-prefix=<your instance group name/your instance name specific prefix, required>
+          node-tags=<your network tags, must patch one or some tags, required>
+      services: 
+        kube_controller: 
+          extra_args:
+            configure-cloud-routes: true # we need to allow the cloud provider configure the routes for the hosts
+    ```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/node-templates/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/node-templates/_index.md
new file mode 100644
index 00000000000..2ffe51ba190
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/node-templates/_index.md
@@ -0,0 +1,47 @@
+---
+title: Managing Node Templates
+weight: 2
+---
+
+When you provision a cluster [hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools), [node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) are used to provision the cluster nodes. These templates use Docker Machine configuration options to define an operating system image and settings/parameters for the node. You can create node templates in two contexts:
+
+- While [provisioning a node pool cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools).
+- At any time, from your [user settings](#creating-a-node-template-from-user-settings).
+
+When you create a node template, it is bound to your user profile. Node templates cannot be shared among users. You can delete stale node templates that you no longer user from your user settings.
+
+## Creating a Node Template from User Settings
+
+1. From your user settings, select **User Avatar > Node Templates**.
+1. Click **Add Template**.
+1. Select one of the cloud providers available. Then follow the instructions on screen to configure the template.
+
+**Result:** The template is configured. You can use the template later when you [provision a node pool cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools).
+
+## Updating a Node Template
+
+1. From your user settings, select **User Avatar > Node Templates**.
+1. Choose the node template that you want to edit and click the **&#8942; > Edit**.
+
+	   > **Note:** As of v2.2.0, the default `active` [node drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) and any node driver, that has fields marked as `password`, are required to use [cloud credentials]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#cloud-credentials). If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
+
+1. Edit the required information and click **Save**.
+
+**Result:** The node template is updated. All node pools using this node template will automatically use the updated information when new nodes are added.
+
+## Cloning Node Templates
+
+When creating new node templates from your user settings, you can clone an existing template and quickly update its settings rather than creating a new one from scratch. Cloning templates saves you the hassle of re-entering access keys for the cloud provider.
+
+1. From your user settings, select **User Avatar > Node Templates**.
+1. Find the template you want to clone. Then select **&#8942; > Clone**.
+1. Complete the rest of the form.
+
+**Result:** The template is cloned and configured. You can use the template later when you [provision a node pool cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools).
+
+## Deleting a Node Template
+
+When you no longer use a node template, you can delete it from your user settings.
+
+1. From your user settings, select **User Avatar > Node Templates**.
+1. Select one or more template from the list. Then click **Delete**. Confirm the delete when prompted.
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/nodes/_index.md b/content/rancher/v2.5/en/applications/ecm/infrastructure/nodes/_index.md
new file mode 100644
index 00000000000..5819eecfcc0
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/infrastructure/nodes/_index.md
@@ -0,0 +1,226 @@
+---
+title: Nodes and Node Pools
+weight: 1
+---
+
+After you launch a Kubernetes cluster in Rancher, you can manage individual nodes from the cluster's **Node** tab. Depending on the [option used]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) to provision the cluster, there are different node options available.
+
+> If you want to manage the _cluster_ and not individual nodes, see [Editing Clusters]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters).
+
+This section covers the following topics:
+
+- [Node options available for each cluster creation option](#node-options-available-for-each-cluster-creation-option)
+  - [Nodes hosted by an infrastructure provider](#nodes-hosted-by-an-infrastructure-provider)
+  - [Nodes provisioned by hosted Kubernetes providers](#nodes-provisioned-by-hosted-kubernetes-providers)
+  - [Imported nodes](#imported-nodes)
+- [Managing and editing individual nodes](#managing-and-editing-individual-nodes)
+- [Viewing a node in the Rancher API](#viewing-a-node-in-the-rancher-api)
+- [Deleting a node](#deleting-a-node)
+- [Scaling nodes](#scaling-nodes)
+- [SSH into a node hosted by an infrastructure provider](#ssh-into-a-node-hosted-by-an-infrastructure-provider)
+- [Cordoning a node](#cordoning-a-node)
+- [Draining a node](#draining-a-node)
+  - [Aggressive and safe draining options](#aggressive-and-safe-draining-options)
+  - [Grace period](#grace-period)
+  - [Timeout](#timeout)
+  - [Drained and cordoned state](#drained-and-cordoned-state)
+- [Labeling a node to be ignored by Rancher](#labeling-a-node-to-be-ignored-by-rancher)
+
+# Node Options Available for Each Cluster Creation Option
+
+The following table lists which node options are available for each [type of cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options) in Rancher. Click the links in the **Option** column for more detailed information about each feature.
+
+| Option                                           | [Nodes Hosted by an Infrastructure Provider][1]                                   | [Custom Node][2] | [Hosted Cluster][3] | [Imported Nodes][4] | Description                                                        |
+| ------------------------------------------------ | ------------------------------------------------ | ---------------- | ------------------- | ------------------- | ------------------------------------------------------------------ |
+| [Cordon](#cordoning-a-node)                      | ✓                                                | ✓                | ✓                   |                     | Marks the node as unschedulable.                                   |
+| [Drain](#draining-a-node)                        | ✓                                                | ✓                | ✓                   |                     | Marks the node as unschedulable _and_ evicts all pods.             |
+| [Edit](#managing-and-editing-individual-nodes)                          | ✓                                                | ✓                | ✓                   |                     | Enter a custom name, description, label, or taints for a node. |
+| [View API](#viewing-a-node-in-the-rancher-api)                  | ✓                                                | ✓                | ✓                   |                     | View API data.                                                     |
+| [Delete](#deleting-a-node)                       | ✓                                                | ✓                |                     |                     | Deletes defective nodes from the cluster.                          |
+| [Download Keys](#ssh-into-a-node-hosted-by-an-infrastructure-provider) | ✓                                                |                  |                     |                     | Download SSH key for in order to SSH into the node.                     |
+| [Node Scaling](#scaling-nodes)                   | ✓                                                |                  |                     |                     | Scale the number of nodes in the node pool up or down.               |
+
+[1]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/
+[2]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/
+[3]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/
+[4]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/
+
+### Nodes Hosted by an Infrastructure Provider
+
+Node pools are available when you provision Rancher-launched Kubernetes clusters on nodes that are [hosted in an infrastructure provider.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/)
+
+Clusters provisioned using [one of the node pool options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-pools) can be scaled up or down if the node pool is edited.
+
+A node pool can also automatically maintain the node scale that's set during the initial cluster provisioning if [node auto-replace is enabled.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-auto-replace) This scale determines the number of active nodes that Rancher maintains for the cluster.
+
+Rancher uses [node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) to replace nodes in the node pool. Each node template uses cloud provider credentials to allow Rancher to set up the node in the infrastructure provider.
+
+### Nodes Provisioned by Hosted Kubernetes Providers
+
+Options for managing nodes [hosted by a Kubernetes provider]({{<baseurl >}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) are somewhat limited in Rancher. Rather than using the Rancher UI to make edits such as scaling the number of nodes up or down, edit the cluster directly.
+
+### Imported Nodes
+
+Although you can deploy workloads to an [imported cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/) using Rancher, you cannot manage individual cluster nodes. All management of imported cluster nodes must take place outside of Rancher.
+
+# Managing and Editing Individual Nodes
+
+Editing a node lets you:
+
+* Change its name
+* Change its description
+* Add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+* Add/Remove [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+
+To manage individual nodes, browse to the cluster that you want to manage and then select **Nodes** from the main menu. You can open the options menu for a node by clicking its **&#8942;** icon (**...**).
+
+# Viewing a Node in the Rancher API
+
+Select this option to view the node's [API endpoints]({{< baseurl >}}/rancher/v2.x/en/api/).
+
+# Deleting a Node
+
+Use **Delete** to remove defective nodes from the cloud provider.
+
+When you the delete a defective node, Rancher can automatically replace it with an identically provisioned node if the node is in a node pool and [node auto-replace is enabled.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-auto-replace)
+
+>**Tip:** If your cluster is hosted by an infrastructure provider, and you want to scale your cluster down instead of deleting a defective node, [scale down](#scaling-nodes) rather than delete.
+
+# Scaling Nodes
+
+For nodes hosted by an infrastructure provider, you can scale the number of nodes in each [node pool]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-pools) by using the scale controls. This option isn't available for other cluster types.
+
+# SSH into a Node Hosted by an Infrastructure Provider
+
+For [nodes hosted by an infrastructure provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/), you have the option of downloading its SSH key so that you can connect to it remotely from your desktop.
+
+1. From the cluster hosted by an infrastructure provider, select **Nodes** from the main menu.
+
+1. Find the node that you want to remote into. Select **&#8942; > Download Keys**.
+
+    **Step Result:** A ZIP file containing files used for SSH is downloaded.
+
+1. Extract the ZIP file to any location.
+
+1. Open Terminal. Change your location to the extracted ZIP file.
+
+1. Enter the following command:
+
+    ```
+    ssh -i id_rsa root@<IP_OF_HOST>
+    ```
+
+# Cordoning a Node
+
+_Cordoning_ a node marks it as unschedulable. This feature is useful for performing short tasks on the node during small maintenance windows, like reboots, upgrades, or decommissions.  When you're done, power back on and make the node schedulable again by uncordoning it.
+
+# Draining a Node
+
+_Draining_ is the process of first cordoning the node, and then evicting all its pods. This feature is useful for performing node maintenance (like kernel upgrades or hardware maintenance). It prevents new pods from deploying to the node while redistributing existing pods so that users don't experience service interruption.
+
+- For pods with a replica set, the pod is replaced by a new pod that will be scheduled to a new node. Additionally, if the pod is part of a service, then clients will automatically be redirected to the new pod.
+
+- For pods with no replica set, you need to bring up a new copy of the pod, and assuming it is not part of a service, redirect clients to it.
+
+You can drain nodes that are in either a `cordoned` or `active` state. When you drain a node, the node is cordoned, the nodes are evaluated for conditions they must meet to be drained, and then (if it meets the conditions) the node evicts its pods.
+
+However, you can override the conditions draining when you initiate the drain. You're also given an opportunity to set a grace period and timeout value.
+
+### Aggressive and Safe Draining Options
+
+The node draining options are different based on your version of Rancher.
+
+{{% tabs %}}
+{{% tab "Rancher v2.2.x+" %}}
+There are two drain modes: aggressive and safe.
+
+- **Aggressive Mode**
+
+    In this mode, pods won't get rescheduled to a new node, even if they do not have a controller. Kubernetes expects you to have your own logic that handles the deletion of these pods.
+
+    Kubernetes also expects the implementation to decide what to do with pods using emptyDir. If a pod uses emptyDir to store local data, you might not be able to safely delete it, since the data in the emptyDir will be deleted once the pod is removed from the node. Choosing aggressive mode will delete these pods.
+
+- **Safe Mode**
+
+    If a node has standalone pods or ephemeral data it will be cordoned but not drained.
+{{% /tab %}}
+{{% tab "Rancher prior to v2.2.x" %}}
+
+The following list describes each drain option:
+
+- **Even if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet**
+
+    These types of pods won't get rescheduled to a new node, since they do not have a controller. Kubernetes expects you to have your own logic that handles the deletion of these pods. Kubernetes forces you to choose this option (which will delete/evict these pods) or drain won't proceed.
+
+- **Even if there are DaemonSet-managed pods**
+
+    Similar to above, if you have any daemonsets, drain would proceed only if this option is selected. Even when this option is on, pods won't be deleted since they'll immediately be replaced. On startup, Rancher currently has a few daemonsets running by default in the system, so this option is turned on by default.
+
+- **Even if there are pods using emptyDir**
+
+    If a pod uses emptyDir to store local data, you might not be able to safely delete it, since the data in the emptyDir will be deleted once the pod is removed from the node. Similar to the first option, Kubernetes expects the implementation to decide what to do with these pods. Choosing this option will delete these pods.
+{{% /tab %}}
+{{% /tabs %}}
+
+### Grace Period
+
+The timeout given to each pod for cleaning things up, so they will have chance to exit gracefully. For example, when pods might need to finish any outstanding requests, roll back transactions or save state to some external storage. If negative, the default value specified in the pod will be used.
+
+### Timeout
+
+The amount of time drain should continue to wait before giving up.
+
+>**Kubernetes Known Issue:** The [timeout setting](https://github.com/kubernetes/kubernetes/pull/64378) was not enforced while draining a node prior to Kubernetes 1.12.
+
+### Drained and Cordoned State
+
+If there's any error related to user input, the node enters a `cordoned` state because the drain failed. You can either correct the input and attempt to drain the node again, or you can abort by uncordoning the node.
+
+If the drain continues without error, the node enters a `draining` state. You'll have the option to stop the drain when the node is in this state, which will stop the drain process and change the node's state to `cordoned`.
+
+Once drain successfully completes, the node will be in a state of `drained`. You can then power off or delete the node.
+
+>**Want to know more about cordon and drain?** See the [Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#maintenance-on-a-node).
+
+# Labeling a Node to be Ignored by Rancher
+
+_Available as of 2.3.3_
+
+Some solutions, such as F5's BIG-IP integration, may require creating a node that is never registered to a cluster.
+
+Since the node will never finish registering, it will always be shown as unhealthy in the Rancher UI.
+
+In that case, you may want to label the node to be ignored by Rancher so that Rancher only shows nodes as unhealthy when they are actually failing.
+
+You can label nodes to be ignored by using a setting in the Rancher UI, or by using `kubectl`.
+
+> **Note:** There is an [open issue](https://github.com/rancher/rancher/issues/24172) in which nodes labeled to be ignored can get stuck in an updating state.
+
+### Labeling Nodes to be Ignored with the Rancher UI
+
+To add a node that is ignored by Rancher,
+
+1. From the **Global** view, click the **Settings** tab.
+1. Go to the `ignore-node-name` setting and click **&#8942; > Edit.**
+1. Enter a name that Rancher will use to ignore nodes. All nodes with this name will be ignored.
+1. Click **Save.**
+
+**Result:** Rancher will not wait to register nodes with this name. In the UI, the node will displayed with a grayed-out status. The node is still part of the cluster and can be listed with `kubectl`.
+
+If the setting is changed afterward, the ignored nodes will continue to be hidden.
+
+### Labeling Nodes to be Ignored with kubectl
+
+To add a node that will be ignored by Rancher, use `kubectl` to create a node that has the following label:
+
+```
+cattle.rancher.io/node-status: ignore
+```
+
+**Result:** If you add the node to a cluster, Rancher will not attempt to sync with this node. The node can still be part of the cluster and can be listed with `kubectl`.
+
+If the label is added before the node is added to the cluster, the node will not be shown in the Rancher UI. 
+
+If the label is added after the node is added to a Rancher cluster, the node will not be removed from the UI.
+
+If you delete the node from the Rancher server using the Rancher UI or API, the node will not be removed from the cluster if the `nodeName` is listed in the Rancher settings under `ignore-node-name`.
diff --git a/content/rancher/v2.5/en/applications/ecm/k8s-metadata/_index.md b/content/rancher/v2.5/en/applications/ecm/k8s-metadata/_index.md
new file mode 100644
index 00000000000..990ed730a2a
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/k8s-metadata/_index.md
@@ -0,0 +1,89 @@
+---
+title: Upgrading Kubernetes without Upgrading Rancher
+weight: 13
+---
+
+The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6.
+
+> **Note:** The Kubernetes API can change between minor versions. Therefore, we don't support introducing minor Kubernetes versions, such as introducing v1.15 when Rancher currently supports v1.14. You would need to upgrade Rancher to add support for minor Kubernetes versions.
+
+Rancher's Kubernetes metadata contains information specific to the Kubernetes version that Rancher uses to provision [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/). Rancher syncs the data periodically and creates custom resource definitions (CRDs) for **system images,** **service options** and **addon templates.** Consequently, when a new Kubernetes version is compatible with the Rancher server version, the Kubernetes metadata makes the new version available to Rancher for provisioning clusters. The metadata gives you an overview of the information that the [Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/) (RKE) uses for deploying various Kubernetes versions.
+
+This table below describes the CRDs that are affected by the periodic data sync. 
+
+> **Note:** Only administrators can edit metadata CRDs. It is recommended not to update existing objects unless explicitly advised.
+
+| Resource | Description | Rancher API URL |
+|----------|-------------|-----------------|
+| System Images | List of system images used to deploy Kubernetes through RKE. | `<RANCHER_SERVER_URL>/v3/rkek8ssystemimages` |
+| Service Options | Default options passed to Kubernetes components like `kube-api`, `scheduler`, `kubelet`, `kube-proxy`, and `kube-controller-manager` | `<RANCHER_SERVER_URL>/v3/rkek8sserviceoptions` |
+| Addon Templates | YAML definitions used to deploy addon components like Canal, Calico, Flannel, Weave, Kube-dns, CoreDNS, `metrics-server`, `nginx-ingress` | `<RANCHER_SERVER_URL>/v3/rkeaddons` |
+
+Administrators might configure the RKE metadata settings to do the following:
+
+- Refresh the Kubernetes metadata, if a new patch version of Kubernetes comes out and they want Rancher to provision clusters with the latest version of Kubernetes without having to upgrade Rancher
+- Change the metadata URL that Rancher uses to sync the metadata, which is useful for air gap setups if you need to sync Rancher locally instead of with GitHub
+- Prevent Rancher from auto-syncing the metadata, which is one way to prevent new and unsupported Kubernetes versions from being available in Rancher
+
+### Refresh Kubernetes Metadata
+
+The option to refresh the Kubernetes metadata is available for administrators by default, or for any user who has the **Manage Cluster Drivers** [global role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
+
+To force Rancher to refresh the Kubernetes metadata, a manual refresh action is available under **Tools > Drivers > Refresh Kubernetes Metadata** on the right side corner. 
+
+### Configuring the Metadata Synchronization
+
+> Only administrators can change these settings.
+
+The RKE metadata config controls how often Rancher syncs metadata and where it downloads data from. You can configure the metadata from the settings in the Rancher UI, or through the Rancher API at the endpoint `v3/settings/rke-metadata-config`.
+
+The way that the metadata is configured depends on the Rancher version.
+
+{{% tabs %}}
+{{% tab "Rancher v2.4+" %}}
+To edit the metadata config in Rancher,
+
+1. Go to the **Global** view and click the **Settings** tab.
+1. Go to the **rke-metadata-config** section. Click the **&#8942;** and click **Edit.**
+1. You can optionally fill in the following parameters:
+
+ - `refresh-interval-minutes`: This is the amount of time that Rancher waits to sync the metadata. To disable the periodic refresh, set `refresh-interval-minutes` to 0.
+ - `url`: This is the HTTP path that Rancher fetches data from. The path must be a direct path to a JSON file. For example, the default URL for Rancher v2.4 is `https://releases.rancher.com/kontainer-driver-metadata/release-v2.4/data.json`.
+
+If you don't have an air gap setup, you don't need to specify the URL where Rancher gets the metadata, because the default setting is to pull from [Rancher's metadata Git repository.](https://github.com/rancher/kontainer-driver-metadata/blob/dev-v2.5/data/data.json)
+
+However, if you have an [air gap setup,](#air-gap-setups) you will need to mirror the Kubernetes metadata repository in a location available to Rancher. Then you need to change the URL to point to the new location of the JSON file. 
+{{% /tab %}}
+{{% tab "Rancher v2.3" %}}
+To edit the metadata config in Rancher,
+
+1. Go to the **Global** view and click the **Settings** tab.
+1. Go to the **rke-metadata-config** section. Click the **&#8942;** and click **Edit.**
+1. You can optionally fill in the following parameters:
+
+ - `refresh-interval-minutes`: This is the amount of time that Rancher waits to sync the metadata. To disable the periodic refresh, set `refresh-interval-minutes` to 0.
+ - `url`: This is the HTTP path that Rancher fetches data from.
+ - `branch`: This refers to the Git branch name if the URL is a Git URL. 
+
+If you don't have an air gap setup, you don't need to specify the URL or Git branch where Rancher gets the metadata, because the default setting is to pull from [Rancher's metadata Git repository.](https://github.com/rancher/kontainer-driver-metadata.git)
+
+However, if you have an [air gap setup,](#air-gap-setups) you will need to mirror the Kubernetes metadata repository in a location available to Rancher. Then you need to change the URL and Git branch in the `rke-metadata-config` settings to point to the new location of the repository.
+{{% /tab %}}
+{{% /tabs %}}
+
+### Air Gap Setups
+
+Rancher relies on a periodic refresh of the `rke-metadata-config` to download new Kubernetes version metadata if it is supported with the current version of the Rancher server. For a table of compatible Kubernetes and Rancher versions, refer to the [service terms section.](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.2.8/)
+
+If you have an air gap setup, you might not be able to get the automatic periodic refresh of the Kubernetes metadata from Rancher's Git repository. In that case, you should disable the periodic refresh to prevent your logs from showing errors. Optionally, you can configure your metadata settings so that Rancher can sync with a local copy of the RKE metadata.
+
+To sync Rancher with a local mirror of the RKE metadata, an administrator would configure the `rke-metadata-config` settings to point to the mirror. For details, refer to [Configuring the Metadata Synchronization.](#configuring-the-metadata-synchronization)
+
+After new Kubernetes versions are loaded into the Rancher setup, additional steps would be required in order to use them for launching clusters. Rancher needs access to updated system images. While the metadata settings can only be changed by administrators, any user can download the Rancher system images and prepare a private Docker registry for them.
+
+1. To download the system images for the private registry, click the Rancher server version at the bottom left corner of the Rancher UI.
+1. Download the OS specific image lists for Linux or Windows.
+1. Download `rancher-images.txt`.
+1. Prepare the private registry using the same steps during the [air gap install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry), but instead of using the `rancher-images.txt` from the releases page, use the one obtained from the previous steps.
+
+**Result:** The air gap installation of Rancher can now sync the Kubernetes metadata. If you update your private registry when new versions of Kubernetes are released, you can provision clusters with the new version without having to upgrade Rancher.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/pod-security-policies-in-projects/_index.md b/content/rancher/v2.5/en/applications/ecm/pod-security-policies-in-projects/_index.md
new file mode 100644
index 00000000000..af8ff997503
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/pod-security-policies-in-projects/_index.md
@@ -0,0 +1,31 @@
+---
+title: Pod Security Policies in Projects
+weight: 5600
+--- 
+
+> These cluster options are only available for [clusters in which Rancher has launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).  
+
+You can always assign a pod security policy (PSP) to an existing project if you didn't assign one during creation.
+
+### Prerequisites
+
+- Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
+- Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/#adding-changing-a-pod-security-policy).
+
+### Applying a Pod Security Policy
+
+1. From the **Global** view, find the cluster containing the project you want to apply a PSP to.
+1. From the main menu, select **Projects/Namespaces**.
+1. Find the project that you want to add a PSP to. From that project, select **&#8942; > Edit**.
+1. From the **Pod Security Policy** drop-down, select the PSP you want to apply to the project.
+  Assigning a PSP to a project will:
+
+  - Override the cluster's default PSP.
+  - Apply the PSP to the project.
+  - Apply the PSP to any namespaces you add to the project later.
+
+1. Click **Save**.
+
+**Result:** The PSP is applied to the project and any namespaces added to the project.
+
+>**Note:** Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked to determine if they comply with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/pod-security-policies/_index.md b/content/rancher/v2.5/en/applications/ecm/pod-security-policies/_index.md
new file mode 100644
index 00000000000..8c0b6964b9f
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/pod-security-policies/_index.md
@@ -0,0 +1,84 @@
+---
+title: Adding a Pod Security Policy
+weight: 5
+---
+
+_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges). If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of `Pod <NAME> is forbidden: unable to validate...`.
+
+> **Note:** Assigning Pod Security Policies are only available for clusters that are [launched using RKE.]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/)
+
+- You can assign PSPs at the cluster or project level.
+- PSPs work through inheritance.
+
+    - By default, PSPs assigned to a cluster are inherited by its projects, as well as any namespaces added to those projects.
+    - **Exception:** Namespaces that are not assigned to projects do not inherit PSPs, regardless of whether the PSP is assigned to a cluster or project. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior.
+    - You can override the default PSP by assigning a different PSP directly to the project.
+- Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
+
+>**Note:** You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/)
+
+Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
+
+>**Best Practice:** Set pod security at the cluster level.
+
+Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file.
+
+## Default Pod Security Policies
+
+_Available as of v2.0.7_
+
+Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies.
+
+- `restricted`
+
+	 This policy is based on the Kubernetes [example restricted policy](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml). It significantly restricts what types of pods can be deployed to a cluster or project. This policy:
+	
+	- Prevents pods from running as a privileged user and prevents escalation of privileges.
+	- Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added). 
+
+- `unrestricted`
+
+	This policy is equivalent to running Kubernetes with the PSP controller disabled. It has no restrictions on what pods can be deployed into a cluster or project.
+
+## Creating Pod Security Policies
+
+1.	From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**.
+
+	**Step Result:** The **Add Policy** form opens.
+
+2. Name the policy.
+
+3. Complete each section of the form. Refer to the Kubernetes documentation linked below for more information on what each policy does.
+
+	- Basic Policies:
+
+		- [Privilege Escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)
+		- [Host Namespaces][2]
+		- [Read Only Root Filesystems][1]
+
+	- [Capability Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities)
+	- [Volume Policy][1]
+	- [Allowed Host Paths Policy][1]
+	- [FS Group Policy][1]
+	- [Host Ports Policy][2]
+	- [Run As User Policy][3]
+	- [SELinux Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux)
+	- [Supplemental Groups Policy][3]
+
+### What's Next?
+
+You can add a Pod Security Policy (PSPs hereafter) in the following contexts:
+
+- [When creating a cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/pod-security-policies/)
+- [When editing an existing cluster]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/)
+- [When creating a project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#creating-a-project/)
+- [When editing an existing project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/)
+
+> **Note:** We recommend adding PSPs during cluster and project creation instead of adding it to an existing one.
+
+
+<!-- links -->
+
+[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
+[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
+[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups
diff --git a/content/rancher/v2.5/en/applications/ecm/projects-and-namespaces/_index.md b/content/rancher/v2.5/en/applications/ecm/projects-and-namespaces/_index.md
new file mode 100644
index 00000000000..24186743d10
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/projects-and-namespaces/_index.md
@@ -0,0 +1,198 @@
+---
+title: Projects and Kubernetes Namespaces with Rancher
+description: Rancher Projects ease the administrative burden of your cluster and support multi-tenancy. Learn to create projects and divide projects into Kubernetes namespaces
+weight: 2
+---
+
+A namespace is a Kubernetes concept that allows a virtual cluster within a cluster, which is useful for dividing the cluster into separate "virtual clusters" that each have their own access control and resource quotas.
+
+A project is a group of namespaces, and it is a concept introduced by Rancher. Projects allow you to manage multiple namespaces as a group and perform Kubernetes operations in them. You can use projects to support multi-tenancy, so that a team can access a project within a cluster without having access to other projects in the same cluster.
+
+This section describes how projects and namespaces work with Rancher. It covers the following topics:
+
+- [About namespaces](#about-namespaces)
+- [About projects](#about-projects)
+  - [The cluster's default project](#the-cluster-s-default-project)
+  - [The system project](#the-system-project)
+- [Project authorization](#project-authorization)
+- [Pod security policies](#pod-security-policies)
+- [Creating projects](#creating-projects)
+- [Switching between clusters and projects](#switching-between-clusters-and-projects)
+
+# About Namespaces
+
+A namespace is a concept introduced by Kubernetes. According to the [official Kubernetes documentation on namespaces,](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/)
+
+> Kubernetes supports multiple virtual clusters backed by the same physical cluster. These virtual clusters are called namespaces. [...] Namespaces are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all.
+
+Namespaces provide the following functionality:
+
+- **Providing a scope for names:** Names of resources need to be unique within a namespace, but not across namespaces. Namespaces can not be nested inside one another and each Kubernetes resource can only be in one namespace.
+- **Resource quotas:** Namespaces provide a way to divide cluster resources between multiple users.
+
+You can assign resources at the project level so that each namespace in the project can use them. You can also bypass this inheritance by assigning resources explicitly to a namespace.
+
+You can assign the following resources directly to namespaces:
+
+- [Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)
+- [Load Balancers/Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/)
+- [Service Discovery Records]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/service-discovery/)
+- [Persistent Volume Claims]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/persistent-volume-claims/)
+- [Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/)
+- [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/)
+- [Registries]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries/)
+- [Secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/)
+
+To manage permissions in a vanilla Kubernetes cluster, cluster admins configure role-based access policies for each namespace. With Rancher, user permissions are assigned on the project level instead, and permissions are automatically inherited by any namespace owned by the particular project.
+
+For more information on creating and moving namespaces, see [Namespaces]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/).
+
+### Role-based access control issues with namespaces and kubectl
+
+Because projects are a concept introduced by Rancher, kubectl does not have the capability to restrict the creation of namespaces to a project the creator has access to.
+
+This means that when standard users with project-scoped permissions create a namespaces with `kubectl`, it may be unusable because `kubectl` doesn't require the new namespace to be scoped within a certain project.
+
+If your permissions are restricted to the project level, it is better to [create a namespace through Rancher]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/#creating-namespaces) to ensure that you will have permission to access the namespace.
+
+If a standard user is a project owner, the user will be able to create namespaces within that project. The Rancher UI will prevent that user from creating namespaces outside the scope of the projects they have access to. 
+
+# About Projects
+
+In terms of hierarchy:
+
+- Clusters contain projects
+- Projects contain namespaces
+
+You can use projects to support multi-tenancy, so that a team can access a project within a cluster without having access to other projects in the same cluster.
+
+In the base version of Kubernetes, features like role-based access rights or cluster resources are assigned to individual namespaces. A project allows you to save time by giving an individual or a team access to multiple namespaces simultaneously.
+
+You can use projects to perform actions such as:
+
+- Assign users to a group of namespaces (i.e., [project membership]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/project-members)).
+- Assign users specific roles in a project. A role can be owner, member, read-only, or [custom]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/).
+- Assign resources to the project.
+- Assign Pod Security Policies.
+
+When you create a cluster, two projects are automatically created within it:
+
+- [Default Project](#the-cluster-s-default-project)
+- [System Project](#the-system-project)
+
+### The Cluster's Default Project
+
+When you provision a cluster with Rancher, it automatically creates a `default` project for the cluster. This is a project you can use to get started with your cluster, but you can always delete it and replace it with projects that have more descriptive names.
+
+If you don't have a need for more than the default namespace, you also do not need more than the **Default** project in Rancher.
+
+If you require another level of organization beyond the **Default** project, you can create more projects in Rancher to isolate namespaces, applications and resources.
+
+### The System Project
+
+_Available as of v2.0.7_
+
+When troubleshooting, you can view the `system` project to check if important namespaces in the Kubernetes system are working properly. This easily accessible project saves you from troubleshooting individual system namespace containers.
+
+To open it, open the **Global** menu, and then select the `system` project for your cluster.
+
+The `system` project:
+
+- Is automatically created when you provision a cluster.
+- Lists all namespaces that exist in `v3/settings/system-namespaces`, if they exist.
+- Allows you to add more namespaces or move its namespaces to other projects.
+- Cannot be deleted because it's required for cluster operations.
+
+>**Note:** In clusters where both:
+>
+> - The [Canal network plug-in]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use.
+> - The Project Network Isolation option is enabled.
+>
+>The `system` project overrides the Project Network Isolation option so that it can communicate with other projects, collect logs, and check health.
+
+# Project Authorization
+
+Standard users are only authorized for project access in two situations:
+
+- An administrator, cluster owner or cluster member explicitly adds the standard user to the project's **Members** tab.
+- Standard users can access projects that they create themselves.
+
+# Pod Security Policies
+
+Rancher extends Kubernetes to allow the application of [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) at the [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/pod-security-policies) in addition to the [cluster level.](../pod-security-policy) However, as a best practice, we recommend applying Pod Security Policies at the cluster level.
+
+# Creating Projects
+
+This section describes how to create a new project with a name and with optional pod security policy, members, and resource quotas.
+
+1. [Name a new project.](#1-name-a-new-project)
+2. [Optional: Select a pod security policy.](#2-optional-select-a-pod-security-policy)
+3. [Recommended: Add project members.](#3-recommended-add-project-members)
+4. [Optional: Add resource quotas.](#4-optional-add-resource-quotas)
+
+### 1. Name a New Project
+
+1. From the **Global** view, choose **Clusters** from the main menu. From the **Clusters** page, open the cluster from which you want to create a project.
+
+1. From the main menu, choose **Projects/Namespaces**. Then click **Add Project**.
+
+1. Enter a **Project Name**.
+
+### 2. Optional: Select a Pod Security Policy
+
+This option is only available if you've already created a Pod Security Policy. For instruction, see [Creating Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
+
+Assigning a PSP to a project will:
+
+- Override the cluster's default PSP.
+- Apply the PSP to the project.
+- Apply the PSP to any namespaces you add to the project later.
+
+### 3. Recommended: Add Project Members
+
+Use the **Members** section to provide other users with project access and roles.
+
+By default, your user is added as the project `Owner`.
+
+>**Notes on Permissions:**
+>
+>- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned.
+>- Choose `Custom` to create a custom role on the fly: [Custom Project Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles).
+
+To add members:
+
+1. Click **Add Member**.
+1. From the **Name** combo box, search for a user or group that you want to assign project access. Note: You can only search for groups if external authentication is enabled.
+1. From the **Role** drop-down, choose a role. For more information, refer to the [documentation on project roles.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
+
+### 4. Optional: Add Resource Quotas
+
+_Available as of v2.1.0_
+
+Resource quotas limit the resources that a project (and its namespaces) can consume. For more information, see [Resource Quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas).
+
+To add a resource quota,
+
+1. Click **Add Quota**.
+1. Select a [Resource Type]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/#resource-quota-types).
+1. Enter values for the **Project Limit** and the **Namespace Default Limit**.
+1. **Optional:** Specify **Container Default Resource Limit**, which will be applied to every container started in the project. The parameter is recommended if you have CPU or Memory limits set by the Resource Quota. It can be overridden on per an individual namespace or a container level. For more information, see [Container Default Resource Limit]({{<baseurl>}}/rancher/v2.x/en/project-admin/resource-quotas/#setting-container-default-resource-limit) Note: This option is available as of v2.2.0.
+1. Click **Create**.
+
+**Result:** Your project is created. You can view it from the cluster's **Projects/Namespaces** view.
+
+| Field                   | Description                                                                                              |
+| ----------------------- | -------------------------------------------------------------------------------------------------------- |
+| Project Limit           | The overall resource limit for the project.                                                              |
+| Namespace Default Limit | The default resource limit available for each namespace. This limit is propagated to each namespace in the project when created. The combined limit of all project namespaces shouldn't exceed the project limit.  |
+
+# Switching between Clusters and Projects
+
+To switch between clusters and projects, use the **Global** drop-down available in the main menu.
+
+![Global Menu]({{<baseurl>}}/img/rancher/global-menu.png)
+
+Alternatively, you can switch between projects and clusters using the main menu.
+
+- To switch between clusters, open the **Global** view and select **Clusters** from the main menu. Then open a cluster.
+- To switch between projects, open a cluster, and then select **Projects/Namespaces** from the main menu. Select the link for the project that you want to open.
diff --git a/content/rancher/v2.5/en/applications/ecm/requirements/_index.md b/content/rancher/v2.5/en/applications/ecm/requirements/_index.md
new file mode 100644
index 00000000000..dda6af13e32
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/requirements/_index.md
@@ -0,0 +1,314 @@
+---
+title: Installation Requirements
+description: Learn the node requirements for each node running Rancher server when you’re configuring  Rancher to run either in a Docker or Kubernetes setup
+weight: 1
+---
+
+> This section is under construction.
+
+This page describes the software, hardware, and networking requirements for the nodes where the Rancher server will be installed. The Rancher server can be installed on a single node or a high-availability Kubernetes cluster.
+
+> It is important to note that if you install Rancher on a Kubernetes cluster, requirements are different from the [node requirements for downstream user clusters,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/) which will run your apps and services.
+
+Make sure the node(s) for the Rancher server fulfill the following requirements:
+
+- [Operating Systems and Docker Requirements](#operating-systems-and-docker-requirements)
+- [Hardware Requirements](#hardware-requirements)
+  - [CPU and Memory](#cpu-and-memory)
+  - [CPU and Memory for Rancher prior to v2.4.0](#cpu-and-memory-for-rancher-prior-to-v2-4-0)
+  - [Disks](#disks)
+- [Networking Requirements](#networking-requirements)
+  - [Node IP Addresses](#node-ip-addresses)
+  - [Port Requirements](#port-requirements)
+
+For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section.]({{<baseurl>}}/rancher/v2.x/en/best-practices/deployment-types/)
+
+The Rancher UI works best in Firefox or Chrome.
+
+# Operating Systems and Container Runtime Requirements
+
+Rancher should work with any modern Linux distribution.
+
+For the container runtime, RKE should work with any modern Docker version, while K3s should work with any modern version of Docker or containerd.
+
+Rancher and RKE have been tested and are supported on Ubuntu, CentOS, Oracle Linux, RancherOS, and RedHat Enterprise Linux.
+
+K3s should run on just about any flavor of Linux. However, K3s is tested on the following operating systems and their subsequent non-major releases:
+
+- Ubuntu 16.04 (amd64)
+- Ubuntu 18.04 (amd64)
+- Raspbian Buster (armhf)
+
+If you are installing Rancher on a K3s cluster with **Raspbian Buster**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster) to switch to legacy iptables.
+
+If you are installing Rancher on a K3s cluster with Alpine Linux, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#additional-preparation-for-alpine-linux-setup) for additional setup.
+
+For details on which OS and Docker versions were tested with each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
+
+All supported operating systems are 64-bit x86.
+
+The `ntp` (Network Time Protocol) package should be installed. This prevents errors with certificate validation that can occur when the time is not synchronized between the client and server.
+
+Some distributions of Linux may have default firewall rules that block communication with Helm. This [how-to guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/firewall) shows how to check the default firewall rules for Oracle Linux and how to open the ports with `firewalld` if necessary.
+
+If you plan to run Rancher on ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/rancher/v2.x/en/installation/options/arm64-platform/)
+
+### Installing Docker
+
+Docker can be installed by following the steps in the official [Docker documentation.](https://docs.docker.com/) Rancher also provides [scripts]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/installing-docker) to install Docker with one command.
+
+# Hardware Requirements
+
+This section describes the CPU, memory, and disk requirements for the nodes where the Rancher server is installed.
+
+### CPU and Memory
+
+Hardware requirements scale based on the size of your Rancher deployment. Provision each individual node according to the requirements. The requirements are different depending on if you are installing Rancher in a single container with Docker, or if you are installing Rancher on a Kubernetes cluster.
+
+{{% tabs %}}
+{{% tab "RKE Install Requirements" %}}
+
+These requirements apply to each host in an [RKE Kubernetes cluster where the Rancher server is installed.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/)
+
+Performance increased in Rancher v2.4.0. For the requirements of Rancher prior to v2.4.0, refer to [this section.](#cpu-and-memory-for-rancher-prior-to-v2-4-0)
+
+| Deployment Size | Clusters   | Nodes        | vCPUs  | RAM     |
+| --------------- | ---------- | ------------ | -------| ------- |
+| Small           | Up to 150  | Up to 1500   | 2      | 8 GB    |
+| Medium          | Up to 300  | Up to 3000   | 4      | 16 GB   |
+| Large           | Up to 500  | Up to 5000   | 8      | 32 GB   |
+| X-Large         | Up to 1000 | Up to 10,000 | 16     | 64 GB   |
+| XX-Large        | Up to 2000 | Up to 20,000 | 32     | 128 GB  |
+
+[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. 
+{{% /tab %}}
+
+{{% tab "K3s Install Requirements" %}}
+
+These requirements apply to each host in a [K3s Kubernetes cluster where the Rancher server is installed.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/)
+
+| Deployment Size | Clusters   | Nodes        | vCPUs  | RAM      | Database Size             |
+| --------------- | ---------- | ------------ | -------| ---------| ------------------------- |
+| Small           | Up to 150  | Up to 1500   | 2      | 8 GB     | 2 cores, 4 GB + 1000 IOPS |
+| Medium          | Up to 300  | Up to 3000   | 4      | 16 GB    | 2 cores, 4 GB + 1000 IOPS |
+| Large           | Up to 500  | Up to 5000   | 8      | 32 GB    | 2 cores, 4 GB + 1000 IOPS |
+| X-Large         | Up to 1000 | Up to 10,000 | 16     | 64 GB    | 2 cores, 4 GB + 1000 IOPS |
+| XX-Large        | Up to 2000 | Up to 20,000 | 32     | 128 GB   | 2 cores, 4 GB + 1000 IOPS |
+
+[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. 
+
+{{% /tab %}}
+
+{{% tab "Docker Install Requirements" %}}
+
+These requirements apply to a host with a [single-node]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) installation of Rancher.
+
+| Deployment Size | Clusters | Nodes     | vCPUs | RAM  |
+| --------------- | -------- | --------- | ----- | ---- |
+| Small           | Up to 5  | Up to 50  | 1     | 4 GB |
+| Medium          | Up to 15 | Up to 200 | 2     | 8 GB |
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### CPU and Memory for Rancher prior to v2.4.0
+
+{{% accordion label="Click to expand" %}}
+These requirements apply to installing Rancher on an RKE Kubernetes cluster prior to Rancher v2.4.0:
+
+| Deployment Size | Clusters  | Nodes      | vCPUs                                           | RAM                                             |
+| --------------- | --------- | ---------- | ----------------------------------------------- | ----------------------------------------------- |
+| Small           | Up to 5   | Up to 50   | 2                                               | 8 GB                                            |
+| Medium          | Up to 15  | Up to 200  | 4                                               | 16 GB                                           |
+| Large           | Up to 50  | Up to 500  | 8                                               | 32 GB                                           |
+| X-Large         | Up to 100 | Up to 1000 | 32                                              | 128 GB                                          |
+| XX-Large        | 100+      | 1000+      | [Contact Rancher](https://rancher.com/contact/) | [Contact Rancher](https://rancher.com/contact/) |
+{{% /accordion %}}
+
+### Disks
+
+Rancher performance depends on etcd in the cluster performance. To ensure optimal speed, we recommend always using SSD disks to back your Rancher management Kubernetes cluster. On cloud providers, you will also want to use the minimum size that allows the maximum IOPS. In larger clusters, consider using dedicated storage devices for etcd data and wal directories.
+
+# Networking Requirements
+
+This section describes the networking requirements for the node(s) where the Rancher server is installed.
+
+### Node IP Addresses
+
+Each node used should have a static IP configured, regardless of whether you are installing Rancher on a single node or on an HA cluster. In case of DHCP, each node should have a DHCP reservation to make sure the node gets the same IP allocated.
+
+### Port Requirements
+
+This section describes the port requirements for nodes running the `rancher/rancher` container.
+
+The port requirements are different depending on whether you are installing Rancher on a K3s cluster, on an RKE cluster, or in a single Docker container.
+
+{{% tabs %}}
+{{% tab "K3s" %}}
+### Ports for Communication with Downstream Clusters
+
+To communicate with downstream clusters, Rancher requires different ports to be open depending on the infrastructure you are using.
+
+For example, if you are deploying Rancher on nodes hosted by an infrastructure provider, port `22` must be open for SSH.
+
+The following diagram depicts the ports that are opened for each [cluster type]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning).
+
+<figcaption>Port Requirements for the Rancher Management Plane</figcaption>
+
+![Basic Port Requirements]({{<baseurl>}}/img/rancher/port-communications.svg)
+
+The following tables break down the port requirements for inbound and outbound traffic:
+
+<figcaption>Inbound Rules for Rancher Nodes</figcaption>
+
+| Protocol | Port | Source                                                                                                                                                                                | Description                                          |
+| -------- | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| TCP      | 80   | Load balancer/proxy that does external SSL termination                                                                                                                                | Rancher UI/API when external SSL termination is used |
+| TCP      | 443  | <ul><li>server nodes</li><li>agent nodes</li><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl               |
+
+<figcaption>Outbound Rules for Rancher Nodes</figcaption>
+
+| Protocol | Port | Destination                                              | Description                                   |
+| -------- | ---- | -------------------------------------------------------- | --------------------------------------------- |
+| TCP      | 22   | Any node IP from a node created using Node Driver        | SSH provisioning of nodes using Node Driver   |
+| TCP      | 443  | `35.160.43.145/32`, `35.167.242.46/32`, `52.33.59.17/32` | git.rancher.io (catalogs)                     |
+| TCP      | 2376 | Any node IP from a node created using Node driver        | Docker daemon TLS port used by Docker Machine |
+| TCP      | 6443 | Hosted/Imported Kubernetes API                           | Kubernetes API server                         |
+
+**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
+
+### Additional Port Requirements for Nodes in a K3s Kubernetes Cluster
+
+You will need to open additional ports to launch the Kubernetes cluster that is required for a high-availability installation of Rancher.
+
+The K3s server needs port 6443 to be accessible by the nodes.
+
+The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
+
+If you wish to utilize the metrics server, you will need to open port 10250 on each node.
+
+> **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
+
+<figcaption>Inbound Rules for Rancher Server Nodes</figcaption>
+
+| Protocol | Port | Source | Description
+|-----|-----|----------------|---|
+| TCP | 6443 | K3s server nodes | Kubernetes API
+| UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN
+| TCP | 10250 | K3s server and agent nodes | kubelet
+
+Typically all outbound traffic is allowed.
+{{% /tab %}}
+{{% tab "RKE" %}}
+### Ports for Communication with Downstream Clusters
+
+To communicate with downstream clusters, Rancher requires different ports to be open depending on the infrastructure you are using.
+
+For example, if you are deploying Rancher on nodes hosted by an infrastructure provider, port `22` must be open for SSH.
+
+The following diagram depicts the ports that are opened for each [cluster type]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning).
+
+<figcaption>Port Requirements for the Rancher Management Plane</figcaption>
+
+![Basic Port Requirements]({{<baseurl>}}/img/rancher/port-communications.svg)
+
+The following tables break down the port requirements for inbound and outbound traffic:
+
+<figcaption>Inbound Rules for Rancher Nodes</figcaption>
+
+| Protocol | Port | Source                                                                                                                                                                                | Description                                          |
+| -------- | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| TCP      | 80   | Load balancer/proxy that does external SSL termination                                                                                                                                | Rancher UI/API when external SSL termination is used |
+| TCP      | 443  | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl               |
+
+<figcaption>Outbound Rules for Rancher Nodes</figcaption>
+
+| Protocol | Port | Destination                                              | Description                                   |
+| -------- | ---- | -------------------------------------------------------- | --------------------------------------------- |
+| TCP      | 22   | Any node IP from a node created using Node Driver        | SSH provisioning of nodes using Node Driver   |
+| TCP      | 443  | `35.160.43.145/32`, `35.167.242.46/32`, `52.33.59.17/32` | git.rancher.io (catalogs)                     |
+| TCP      | 2376 | Any node IP from a node created using Node driver        | Docker daemon TLS port used by Docker Machine |
+| TCP      | 6443 | Hosted/Imported Kubernetes API                           | Kubernetes API server                         |
+
+**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
+
+### Additional Port Requirements for Nodes in an RKE Kubernetes Cluster
+
+You will need to open additional ports to launch the Kubernetes cluster that is required for a high-availability installation of Rancher.
+
+If you follow the Rancher installation documentation for setting up a Kubernetes cluster using RKE, you will set up a cluster in which all three nodes have all three roles: etcd, controlplane, and worker. In that case, you can refer to this list of requirements for each node with all three roles.
+
+If you installed Rancher on a Kubernetes cluster that doesn't have all three roles on each node, refer to the [port requirements for the Rancher Kubernetes Engine (RKE).]({{<baseurl>}}/rke/latest/en/os/#ports) The RKE docs show a breakdown of the port requirements for each role.
+
+<figcaption>Inbound Rules for Nodes with All Three Roles: etcd, Controlplane, and Worker</figcaption>
+
+Protocol | Port | Source | Description
+-----------|------|----------|--------------
+TCP | 22 | Linux worker nodes only, and any network that you want to be able to remotely access this node from. | Remote access over SSH
+TCP | 80 | Any source that consumes Ingress services | Ingress controller (HTTP)
+TCP | 443 | Any source that consumes Ingress services | Ingress controller (HTTPS)
+TCP | 2376 | Rancher nodes | Docker daemon TLS port used by Docker Machine (only needed when using Node Driver/Templates)
+TCP | 2379 | etcd nodes and controlplane nodes | etcd client requests
+TCP | 2380 | etcd nodes and controlplane nodes | etcd peer communication
+TCP | 3389 | Windows worker nodes only, and any network that you want to be able to remotely access this node from. | Remote access over RDP
+TCP | 6443 | etcd nodes, controlplane nodes, and worker nodes | Kubernetes apiserver
+UDP | 8472 | etcd nodes, controlplane nodes, and worker nodes | Canal/Flannel VXLAN overlay networking
+TCP | 9099 | the node itself (local traffic, not across nodes) | Canal/Flannel livenessProbe/readinessProbe
+TCP | 10250 | controlplane nodes | kubelet
+TCP | 10254 | the node itself (local traffic, not across nodes) | Ingress controller livenessProbe/readinessProbe
+TCP/UDP | 30000-32767 | Any source that consumes NodePort services | NodePort port range
+
+<figcaption>Outbound Rules for Nodes with All Three Roles: etcd, Controlplane, and Worker</figcaption>
+
+Protocol | Port | Source | Destination | Description
+-----------|------|----------|---------------|--------------
+TCP | 22 | RKE node | Any node configured in Cluster Configuration File | SSH provisioning of node by RKE
+TCP | 443 | Rancher nodes | Rancher agent |
+TCP | 2379 | etcd nodes | etcd client requests |
+TCP | 2380 | etcd nodes | etcd peer communication |
+TCP | 6443 | RKE node | controlplane nodes | Kubernetes API server
+TCP | 6443 | controlplane nodes | Kubernetes API server |
+UDP | 8472 | etcd nodes, controlplane nodes, and worker nodes | Canal/Flannel VXLAN overlay networking |
+TCP | 9099 | the node itself (local traffic, not across nodes) | Canal/Flannel livenessProbe/readinessProbe |
+TCP | 10250 | etcd nodes, controlplane nodes, and worker nodes | kubelet |
+TCP | 10254 | the node itself (local traffic, not across nodes) | Ingress controller livenessProbe/readinessProbe
+
+{{% /tab %}}
+{{% tab "Docker" %}}
+### Ports for Communication with Downstream Clusters
+
+For a Docker installation, you only need to open the ports required to enable Rancher to communicate with downstream user clusters.
+
+The port requirements depend on the infrastructure you are using. For example, if you are deploying Rancher on nodes hosted by an infrastructure provider, port `22` must be open for SSH.
+
+The following diagram depicts the ports that are opened for each [cluster type]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning).
+
+<figcaption>Port Requirements for the Rancher Management Plane</figcaption>
+
+![Basic Port Requirements]({{<baseurl>}}/img/rancher/port-communications.svg)
+
+The following tables break down the port requirements for Rancher nodes, for inbound and outbound traffic:
+
+**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
+
+
+<figcaption>Inbound Rules</figcaption>
+
+| Protocol | Port | Source                                                                                                                                                                                | Description                                          |
+| -------- | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
+| TCP      | 80   | Load balancer/proxy that does external SSL termination                                                                                                                                | Rancher UI/API when external SSL termination is used |
+| TCP      | 443  | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl               |
+
+
+<figcaption>Outbound Rules</figcaption>
+
+| Protocol | Port | Source                                                   | Description                                   |
+| -------- | ---- | -------------------------------------------------------- | --------------------------------------------- |
+| TCP      | 22   | Any node IP from a node created using Node Driver        | SSH provisioning of nodes using Node Driver   |
+| TCP      | 443  | `35.160.43.145/32`, `35.167.242.46/32`, `52.33.59.17/32` | git.rancher.io (catalogs)                     |
+| TCP      | 2376 | Any node IP from a node created using Node driver        | Docker daemon TLS port used by Docker Machine |
+| TCP      | 6443 | Hosted/Imported Kubernetes API                           | Kubernetes API server                         |
+
+**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
+{{% /tab %}}
+{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/applications/ecm/requirements/ports/_index.md b/content/rancher/v2.5/en/applications/ecm/requirements/ports/_index.md
new file mode 100644
index 00000000000..c6cb826bb90
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/requirements/ports/_index.md
@@ -0,0 +1,186 @@
+---
+title: Port Requirements
+description: Read about port requirements needed in order for Rancher to operate properly, both for Rancher nodes and downstream Kubernetes cluster nodes
+weight: 300
+---
+
+To operate properly, Rancher requires a number of ports to be open on Rancher nodes and on downstream Kubernetes cluster nodes.
+
+## Rancher Nodes
+
+The following table lists the ports that need to be open to and from nodes that are running the Rancher server.
+
+The port requirements differ based on whether Rancher is installed in a K3s Kubernetes cluster, an RKE Kubernetes cluster, or a single Docker container.
+
+{{% tabs %}}
+{{% tab "K3s" %}}
+
+The K3s server needs port 6443 to be accessible by the nodes.
+
+The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
+
+If you wish to utilize the metrics server, you will need to open port 10250 on each node.
+
+> **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
+
+<figcaption>Inbound Rules for Rancher Server Nodes</figcaption>
+
+| Protocol | Port | Source | Description
+|-----|-----|----------------|---|
+| TCP | 6443 | K3s server nodes | Kubernetes API
+| UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN.
+| TCP | 10250 | K3s server and agent nodes | kubelet
+
+Typically all outbound traffic is allowed.
+
+{{% /tab %}}
+{{% tab "RKE" %}}
+<figcaption>Inbound Rules for Rancher Nodes</figcaption>
+
+| Protocol | Port | Source | Description |
+|-----|-----|----------------|---|
+| TCP | 80 | Load Balancer/Reverse Proxy | HTTP traffic to Rancher UI/API |
+| TCP | 443 | <ul><li>Load Balancer/Reverse Proxy</li><li>IPs of all cluster nodes and other API/UI clients</li></ul> | HTTPS traffic to Rancher UI/API |
+
+<figcaption>Outbound Rules for Rancher Nodes</figcaption>
+
+| Protocol | Port | Destination | Description |
+|-----|-----|----------------|---|
+| TCP | 443 | `35.160.43.145`,`35.167.242.46`,`52.33.59.17` | Rancher catalog (git.rancher.io) |
+| TCP | 22 | Any node created using a node driver | SSH provisioning of node by node driver |
+| TCP | 2376 | Any node created using a node driver | Docker daemon TLS port used by node driver |
+| TCP | Provider dependent | Port of the Kubernetes API endpoint in hosted cluster | Kubernetes API |
+
+{{% /tab %}}
+{{% tab "Docker" %}}
+
+<figcaption>Inbound Rules for Rancher Node</figcaption>
+
+| Protocol | Port | Source | Description
+|-----|-----|----------------|---|
+| TCP | 80 | Load balancer/proxy that does external SSL termination | Rancher UI/API when external SSL termination is used
+| TCP | 443 | <ul><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl
+
+<figcaption>Outbound Rules for Rancher Node</figcaption>
+
+| Protocol | Port | Source | Description |
+|-----|-----|----------------|---|
+| TCP | 22 | Any node IP from a node created using Node Driver | SSH provisioning of nodes using Node Driver |
+| TCP | 443 | `35.160.43.145/32`,`35.167.242.46/32`,`52.33.59.17/32` | git.rancher.io (catalogs) |
+| TCP | 2376 | Any node IP from a node created using a node driver | Docker daemon TLS port used by Docker Machine |
+| TCP | 6443 | Hosted/Imported Kubernetes API | Kubernetes API server |
+
+{{% /tab %}}
+{{% /tabs %}}
+
+> **Notes:**
+>
+> - Rancher nodes may also require additional outbound access for any external authentication provider which is configured (LDAP for example).
+> - Kubernetes recommends TCP 30000-32767 for node port services.
+> - For firewalls, traffic may need to be enabled within the cluster and pod CIDR.
+
+## Downstream Kubernetes Cluster Nodes
+
+Downstream Kubernetes clusters run your apps and services. This section describes what ports need to be opened on the nodes in downstream clusters so that Rancher can communicate with them.
+
+The port requirements differ depending on how the downstream cluster was launched. Each of the tabs below list the ports that need to be opened for different [cluster types]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options).
+
+>**Tip:**
+>
+>If security isn't a large concern and you're okay with opening a few additional ports, you can use the table in [Commonly Used Ports](#commonly-used-ports) as your port reference instead of the comprehensive tables below.
+
+{{% tabs %}}
+
+{{% tab "Node Pools" %}}
+
+The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
+
+>**Note:**
+>The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean.
+
+{{< ports-iaas-nodes >}}
+
+{{% /tab %}}
+
+{{% tab "Custom Nodes" %}}
+
+The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/).
+
+{{< ports-custom-nodes >}}
+
+{{% /tab %}}
+
+{{% tab "Hosted Clusters" %}}
+
+The following table depicts the port requirements for [hosted clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters).
+
+{{< ports-imported-hosted >}}
+
+{{% /tab %}}
+
+{{% tab "Imported Clusters" %}}
+
+The following table depicts the port requirements for [imported clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/).
+
+{{< ports-imported-hosted >}}
+
+{{% /tab %}}
+
+{{% /tabs %}}
+
+
+## Other Port Considerations
+
+### Commonly Used Ports
+
+These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
+
+| Protocol 	|       Port       	| Description                                     	|
+|:--------:	|:----------------:	|-------------------------------------------------	|
+|    TCP   	|        22        	| Node driver SSH provisioning                    	|
+|    TCP   	|       2376       	| Node driver Docker daemon TLS port              	|
+|    TCP   	|       2379       	| etcd client requests                           	|
+|    TCP   	|       2380       	| etcd peer communication                         	|
+|    UDP   	|       8472       	| Canal/Flannel VXLAN overlay networking          	|
+|    UDP   	|       4789       	| Flannel VXLAN overlay networking on Windows cluster |
+|    TCP   	|       9099       	| Canal/Flannel livenessProbe/readinessProbe      	|
+|    TCP    |       9796        | Default port required by Monitoring to scrape metrics |
+|    TCP   	|       6783       	| Weave Port      	|
+|    UDP   	|       6783-6784   | Weave UDP Ports      	|
+|    TCP   	|       10250      	| kubelet API                                     	|
+|    TCP   	|       10254      	| Ingress controller livenessProbe/readinessProbe 	|
+| TCP/UDP  	| 30000-</br>32767 	| NodePort port range                             	|
+
+----
+
+### Local Node Traffic
+
+Ports marked as `local traffic` (i.e., `9099 TCP`) in the above requirements are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`).
+These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
+
+However, this traffic may be blocked when:
+
+- You have applied strict host firewall policies on the node.
+- You are using nodes that have multiple interfaces (multihomed).
+
+In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes / instances.
+
+### Rancher AWS EC2 security group
+
+When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
+
+|       Type      | Protocol |  Port Range | Source/Destination     | Rule Type |
+|-----------------|:--------:|:-----------:|------------------------|:---------:|
+|       SSH       |    TCP   | 22          | 0.0.0.0/0              | Inbound   |
+|       HTTP      |    TCP   | 80          | 0.0.0.0/0              | Inbound   |
+| Custom TCP Rule |    TCP   | 443         | 0.0.0.0/0              | Inbound   |
+| Custom TCP Rule |    TCP   | 2376        | 0.0.0.0/0              | Inbound   |
+| Custom TCP Rule |    TCP   | 2379-2380   | sg-xxx (rancher-nodes) | Inbound   |
+| Custom UDP Rule |    UDP   | 4789        | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 6443        | 0.0.0.0/0              | Inbound   |
+| Custom UDP Rule |    UDP   | 8472        | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 10250-10252 | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 10256       | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
+| Custom UDP Rule |    UDP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
+| All traffic     |    All   | All         | 0.0.0.0/0              | Outbound  |
diff --git a/content/rancher/v2.5/en/applications/ecm/restoring-from-backup/_index.md b/content/rancher/v2.5/en/applications/ecm/restoring-from-backup/_index.md
new file mode 100644
index 00000000000..7dd374e363b
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/restoring-from-backup/_index.md
@@ -0,0 +1,111 @@
+---
+title: Restoring an RKE Kubernetes Cluster from Backup 
+weight: 8
+---
+
+etcd backup and recovery for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) can be easily performed. Snapshots of the etcd database are taken and saved either locally onto the etcd nodes or to a S3 compatible target. The advantages of configuring S3 is that if all etcd nodes are lost, your snapshot is saved remotely and can be used to restore the cluster.
+
+Rancher recommends enabling the [ability to set up recurring snapshots of etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#configuring-recurring-snapshots), but [one-time snapshots]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#one-time-snapshots) can easily be taken as well. Rancher allows restore from [saved snapshots](#restoring-a-cluster-from-a-snapshot) or if you don't have any snapshots, you can still [restore etcd](#recovering-etcd-without-a-snapshot).
+
+As of Rancher v2.4.0, clusters can also be restored to a prior Kubernetes version and cluster configuration.
+
+This section covers the following topics:
+
+- [Viewing Available Snapshots](#viewing-available-snapshots)
+- [Restoring a Cluster from a Snapshot](#restoring-a-cluster-from-a-snapshot)
+- [Recovering etcd without a Snapshot](#recovering-etcd-without-a-snapshot)
+- [Enabling snapshot features for clusters created before Rancher v2.2.0](#enabling-snapshot-features-for-clusters-created-before-rancher-v2-2-0)
+
+## Viewing Available Snapshots
+
+The list of all available snapshots for the cluster is available.
+
+1. In the **Global** view, navigate to the cluster that you want to view snapshots.
+
+2. Click **Tools > Snapshots** from the navigation bar to view the list of saved snapshots. These snapshots include a timestamp of when they were created.
+
+## Restoring a Cluster from a Snapshot
+
+If your Kubernetes cluster is broken, you can restore the cluster from a snapshot.
+
+Restorations changed in Rancher v2.4.0.
+
+{{% tabs %}}
+{{% tab "Rancher v2.4.0+" %}}
+
+Snapshots are composed of the cluster data in etcd, the Kubernetes version, and the cluster configuration in the `cluster.yml.` These components allow you to select from the following options when restoring a cluster from a snapshot:
+
+- **Restore just the etcd contents:** This restoration is similar to restoring to snapshots in Rancher prior to v2.4.0.
+- **Restore etcd and Kubernetes version:** This option should be used if a Kubernetes upgrade is the reason that your cluster is failing, and you haven't made any cluster configuration changes.
+- **Restore etcd, Kubernetes versions and cluster configuration:** This option should be used if you changed both the Kubernetes version and cluster configuration when upgrading.
+
+When rolling back to a prior Kubernetes version, the [upgrade strategy options]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes/#configuring-the-upgrade-strategy) are ignored. Worker nodes are not cordoned or drained before being reverted to the older Kubernetes version, so that an unhealthy cluster can be more quickly restored to a healthy state.
+
+> **Prerequisite:** To restore snapshots from S3, the cluster needs to be configured to [take recurring snapshots on S3.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#configuring-recurring-snapshots)
+
+1. In the **Global** view, navigate to the cluster that you want to restore from a snapshots.
+
+2. Click the **&#8942; > Restore Snapshot**.
+
+3. Select the snapshot that you want to use for restoring your cluster from the dropdown of available snapshots.
+
+4. In the **Restoration Type** field, choose one of the restoration options described above.
+
+5. Click **Save**.
+
+**Result:** The cluster will go into `updating` state and the process of restoring the `etcd` nodes from the snapshot will start. The cluster is restored when it returns to an `active` state.
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.4.0" %}}
+
+> **Prerequisites:** 
+>
+> - Make sure your etcd nodes are healthy. If you are restoring a cluster with unavailable etcd nodes, it's recommended that all etcd nodes are removed from Rancher before attempting to restore. For clusters in which Rancher used node pools to provision [nodes in an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/), new etcd nodes will automatically be created. For [custom clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/), please ensure that you add new etcd nodes to the cluster.
+> - To restore snapshots from S3, the cluster needs to be configured to [take recurring snapshots on S3.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#configuring-recurring-snapshots)
+
+1. In the **Global** view, navigate to the cluster that you want to restore from a snapshot.
+
+2. Click the **&#8942; > Restore Snapshot**.
+
+3. Select the snapshot that you want to use for restoring your cluster from the dropdown of available snapshots.
+
+4. Click **Save**. 
+
+**Result:** The cluster will go into `updating` state and the process of restoring the `etcd` nodes from the snapshot will start. The cluster is restored when it returns to an `active` state.
+
+{{% /tab %}}
+{{% /tabs %}}
+
+## Recovering etcd without a Snapshot
+
+If the group of etcd nodes loses quorum, the Kubernetes cluster will report a failure because no operations, e.g. deploying workloads, can be executed in the Kubernetes cluster. Please review the best practices for the what the [number of etcd nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/#count-of-etcd-nodes) should be in a Kubernetes cluster. If you want to recover your set of etcd nodes, follow these instructions:
+
+1. Keep only one etcd node in the cluster by removing all other etcd nodes.
+
+2. On the single remaining etcd node, run the following command:
+
+    ```
+    $ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock assaflavie/runlike etcd
+    ```
+
+    This command outputs the running command for etcd, save this command to use later.
+
+3. Stop the etcd container that you launched in the previous step and rename it to `etcd-old`.
+
+    ```
+    $ docker stop etcd
+    $ docker rename etcd etcd-old
+    ```
+
+4. Take the saved command from Step 2 and revise it:
+
+    - If you originally had more than 1 etcd node, then you need to change `--initial-cluster` to only contain the node that remains.
+    - Add `--force-new-cluster` to the end of the command.
+
+5. Run the revised command.
+
+6. After the single nodes is up and running, Rancher recommends adding additional etcd nodes to your cluster. If you have a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) and you want to reuse an old node, you are required to [clean up the nodes]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) before attempting to add them back into a cluster.  
+
+# Enabling Snapshot Features for Clusters Created Before Rancher v2.2.0
+
+If you have any Rancher launched Kubernetes clusters that were created prior to v2.2.0, after upgrading Rancher, you must [edit the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) and _save_ it, in order to enable the updated snapshot features. Even if you were already creating snapshots prior to v2.2.0, you must do this step as the older snapshots will not be available to use to [back up and restore etcd through the UI]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/).
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/_index.md
new file mode 100644
index 00000000000..5779b8eb458
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/_index.md
@@ -0,0 +1,125 @@
+---
+title: Managing RKE Cluster Templates
+weight: 9
+---
+
+RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters.
+
+RKE is the [Rancher Kubernetes Engine,]({{<baseurl>}}/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters.
+
+With Kubernetes increasing in popularity, there is a trend toward managing a larger number of smaller clusters. When you want to create many clusters, it’s more important to manage them consistently. Multi-cluster management comes with challenges to enforcing security and add-on configurations that need to be standardized before turning clusters over to end users.
+
+RKE templates help standardize these configurations. Regardless of whether clusters are created with the Rancher UI, the Rancher API, or an automated process, Rancher will guarantee that every cluster it provisions from an RKE template is uniform and consistent in the way it is produced.
+
+Admins control which cluster options can be changed by end users. RKE templates can also be shared with specific users and groups, so that admins can create different RKE templates for different sets of users.
+
+If a cluster was created with an RKE template, you can't change it to a different RKE template. You can only update the cluster to a new revision of the same template.
+
+As of Rancher v2.3.3, you can [save the configuration of an existing cluster as an RKE template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#converting-an-existing-cluster-to-use-an-rke-template) Then the cluster's settings can only be changed if the template is updated. The new template can also be used to launch new clusters.
+
+The core features of RKE templates allow DevOps and security teams to:
+
+- Standardize cluster configuration and ensure that Rancher-provisioned clusters are created following best practices
+- Prevent less technical users from making uninformed choices when provisioning clusters
+- Share different templates with different sets of users and groups
+- Delegate ownership of templates to users who are trusted to make changes to them
+- Control which users can create templates
+- Require users to create clusters from a template
+
+# Configurable Settings
+
+RKE templates can be created in the Rancher UI or defined in YAML format. They can define all the same parameters that can be specified when you use Rancher to provision custom nodes or nodes from an infrastructure provider:
+
+- Cloud provider options
+- Pod security options
+- Network providers
+- Ingress controllers
+- Network security configuration
+- Network plugins
+- Private registry URL and credentials
+- Add-ons
+- Kubernetes options, including configurations for Kubernetes components such as kube-api, kube-controller, kubelet, and services
+
+The [add-on section](#add-ons) of an RKE template is especially powerful because it allows a wide range of customization options.
+
+# Scope of RKE Templates
+
+RKE templates are supported for Rancher-provisioned clusters. The templates can be used to provision custom clusters or clusters that are launched by an infrastructure provider.
+
+RKE templates are for defining Kubernetes and Rancher settings. Node templates are responsible for configuring nodes. For tips on how to use RKE templates in conjunction with hardware, refer to [RKE Templates and Hardware]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/rke-templates-and-hardware).
+
+RKE templates can be created from scratch to pre-define cluster configuration. They can be applied to launch new clusters, or templates can also be exported from existing running clusters.
+
+As of v2.3.3, the settings of an existing cluster can be [saved as an RKE template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#converting-an-existing-cluster-to-use-an-rke-template) This creates a new template and binds the cluster settings to the template, so that the cluster can only be upgraded if the [template is updated]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template), and the cluster is upgraded to [use a newer version of the template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#upgrading-a-cluster-to-use-a-new-template-revision) The new template can also be used to create new clusters.
+
+
+# Example Scenarios
+When an organization has both basic and advanced Rancher users, administrators might want to give the advanced users more options for cluster creation, while restricting the options for basic users.
+
+These [example scenarios]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios) describe how an organization could use templates to standardize cluster creation.
+
+Some of the example scenarios include the following:
+
+- **Enforcing templates:** Administrators might want to [enforce one or more template settings for everyone]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#enforcing-a-template-setting-for-everyone) if they want all new Rancher-provisioned clusters to have those settings.
+- **Sharing different templates with different users:** Administrators might give [different templates to basic and advanced users,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#templates-for-basic-and-advanced-users) so that basic users can have more restricted options and advanced users can use more discretion when creating clusters.
+- **Updating template settings:** If an organization's security and DevOps teams decide to embed best practices into the required settings for new clusters, those best practices could change over time. If the best practices change, [a template can be updated to a new revision]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#updating-templates-and-clusters-created-with-them) and clusters created from the template can [upgrade to the new version]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#upgrading-a-cluster-to-use-a-new-template-revision) of the template.
+- **Sharing ownership of a template:** When a template owner no longer wants to maintain a template, or wants to share ownership of the template, this scenario describes how [template ownership can be shared.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#allowing-other-users-to-control-and-share-a-template)
+
+# Template Management
+
+When you create an RKE template, it is available in the Rancher UI from the **Global** view under **Tools > RKE Templates.** When you create a template, you become the template owner, which gives you permission to revise and share the template. You can share the RKE templates with specific users or groups, and you can also make it public.
+
+Administrators can turn on template enforcement to require users to always use RKE templates when creating a cluster. This allows administrators to guarantee that Rancher always provisions clusters with specific settings.
+
+RKE template updates are handled through a revision system. If you want to change or update a template, you create a new revision of the template. Then a cluster that was created with the older version of the template can be upgraded to the new template revision.
+
+In an RKE template, settings can be restricted to what the template owner chooses, or they can be open for the end user to select the value. The difference is indicated by the **Allow User Override** toggle over each setting in the Rancher UI when the template is created.
+
+For the settings that cannot be overridden, the end user will not be able to directly edit them. In order for a user to get different options of these settings, an RKE template owner would need to create a new revision of the RKE template, which would allow the user to upgrade and change that option.
+
+The documents in this section explain the details of RKE template management:
+
+- [Getting permission to create templates]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creator-permissions/)
+- [Creating and revising templates]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/)
+- [Enforcing template settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/enforcement/#requiring-new-clusters-to-use-a-cluster-template)
+- [Overriding template settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/overrides/)
+- [Sharing templates with cluster creators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-templates-with-specific-users)
+- [Sharing ownership of a template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-ownership-of-templates)
+
+An [example YAML configuration file for a template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-yaml) is provided for reference.
+
+# Applying Templates
+
+You can [create a cluster from a template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#creating-a-cluster-from-a-cluster-template) that you created, or from a template that has been [shared with you.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing)
+
+If the RKE template owner creates a new revision of the template, you can [upgrade your cluster to that revision.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#updating-a-cluster-created-with-an-rke-template)
+
+RKE templates can be created from scratch to pre-define cluster configuration. They can be applied to launch new clusters, or templates can also be exported from existing running clusters.
+
+As of Rancher v2.3.3, you can [save the configuration of an existing cluster as an RKE template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#converting-an-existing-cluster-to-use-an-rke-template) Then the cluster's settings can only be changed if the template is updated.
+
+# Standardizing Hardware
+
+RKE templates are designed to standardize Kubernetes and Rancher settings. If you want to standardize your infrastructure as well, you use RKE templates [in conjunction with other tools]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/rke-templates-and-hardware).
+
+# YAML Customization
+
+If you define an RKE template as a YAML file, you can modify this [example RKE template YAML]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-yaml). The YAML in the RKE template uses the same customization that Rancher uses when creating an RKE cluster, but since the YAML is located within the context of a Rancher provisioned cluster, you will need to nest the RKE template customization under the `rancher_kubernetes_engine_config` directive in the YAML.
+
+The RKE documentation also has [annotated]({{<baseurl>}}/rke/latest/en/example-yamls/) `cluster.yml` files that you can use for reference.
+
+For guidance on available options, refer to the RKE documentation on [cluster configuration.]({{<baseurl>}}/rke/latest/en/config-options/)
+
+### Add-ons
+
+The add-on section of the RKE template configuration file works the same way as the [add-on section of a cluster configuration file]({{<baseurl>}}/rke/latest/en/config-options/add-ons/).
+
+The user-defined add-ons directive allows you to either call out and pull down Kubernetes manifests or put them inline directly. If you include these manifests as part of your RKE template, Rancher will provision those in the cluster.
+
+Some things you could do with add-ons include:
+
+- Install applications on the Kubernetes cluster after it starts
+- Install plugins on nodes that are deployed with a Kubernetes daemonset
+- Automatically set up namespaces, service accounts, or role binding
+
+The RKE template configuration must be nested within the `rancher_kubernetes_engine_config` directive. To set add-ons, when creating the template, you will click **Edit as YAML.** Then use the `addons` directive to add a manifest, or the `addons_include` directive to set which YAML files are used for the add-ons. For more information on custom add-ons, refer to the [user-defined add-ons documentation.]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/)
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/applying-templates/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/applying-templates/_index.md
new file mode 100644
index 00000000000..06a62b8e02a
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/applying-templates/_index.md
@@ -0,0 +1,63 @@
+---
+title: Applying Templates
+weight: 50
+---
+
+You can create a cluster from an RKE template that you created, or from a template that has been [shared with you.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing)
+
+RKE templates can be applied to new clusters.
+
+As of Rancher v2.3.3, you can [save the configuration of an existing cluster as an RKE template.](#converting-an-existing-cluster-to-use-an-rke-template) Then the cluster's settings can only be changed if the template is updated.
+
+You can't change a cluster to use a different RKE template. You can only update the cluster to a new revision of the same template.
+
+This section covers the following topics:
+
+- [Creating a cluster from an RKE template](#creating-a-cluster-from-an-rke-template)
+- [Updating a cluster created with an RKE template](#updating-a-cluster-created-with-an-rke-template)
+- [Converting an existing cluster to use an RKE template](#converting-an-existing-cluster-to-use-an-rke-template)
+
+### Creating a Cluster from an RKE Template
+
+To add a cluster [hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters) using an RKE template, use these steps:
+
+1. From the **Global** view, go to the **Clusters** tab.
+1. Click **Add Cluster** and choose the infrastructure provider.
+1. Provide the cluster name and node template details as usual.
+1. To use an RKE template, under the **Cluster Options**, check the box for **Use an existing RKE template and revision.**
+1. Choose an existing template and revision from the dropdown menu.
+1. Optional: You can edit any settings that the RKE template owner marked as **Allow User Override** when the template was created. If there are settings that you want to change, but don't have the option to, you will need to contact the template owner to get a new revision of the template. Then you will need to edit the cluster to upgrade it to the new revision.
+1. Click **Save** to launch the cluster.
+
+### Updating a Cluster Created with an RKE Template
+
+When the template owner creates a template, each setting has a switch in the Rancher UI that indicates if users can override the setting.
+
+- If the setting allows a user override, you can update these settings in the cluster by [editing the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/)
+- If the switch is turned off, you cannot change these settings unless the cluster owner creates a template revision that lets you override them. If there are settings that you want to change, but don't have the option to, you will need to contact the template owner to get a new revision of the template.
+
+If a cluster was created from an RKE template, you can edit the cluster to update the cluster to a new revision of the template.
+
+As of Rancher v2.3.3, an existing cluster's settings can be [saved as an RKE template.](#converting-an-existing-cluster-to-use-an-rke-template) In that situation, you can also edit the cluster to update the cluster to a new revision of the template.
+
+> **Note:** You can't change the cluster to use a different RKE template. You can only update the cluster to a new revision of the same template.
+
+### Converting an Existing Cluster to Use an RKE Template
+
+_Available as of v2.3.3_
+
+This section describes how to create an RKE template from an existing cluster.
+
+RKE templates cannot be applied to existing clusters, except if you save an existing cluster's settings as an RKE template. This exports the cluster's settings as a new RKE template, and also binds the cluster to that template. The result is that the cluster can only be changed if the [template is updated,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template) and the cluster is upgraded to [use a newer version of the template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#upgrading-a-cluster-to-use-a-new-template-revision)
+
+To convert an existing cluster to use an RKE template,
+
+1. From the **Global** view in Rancher, click the **Clusters** tab.
+1. Go to the cluster that will be converted to use an RKE template. Click **&#8942;** > **Save as RKE Template.**
+1. Enter a name for the template in the form that appears, and click **Create.**
+
+**Results:**
+
+- A new RKE template is created.
+- The cluster is converted to use the new template.
+- New clusters can be [created from the new template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#creating-a-cluster-from-an-rke-template)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/creating-and-revising/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/creating-and-revising/_index.md
new file mode 100644
index 00000000000..10935277fa9
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/creating-and-revising/_index.md
@@ -0,0 +1,162 @@
+---
+title: Creating and Revising Templates
+weight: 32
+---
+
+This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Global** view under **Tools > RKE Templates.**
+
+Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it.
+
+Template revisions can be used in two ways: to create a new cluster, or to upgrade a cluster that was created with an earlier version of the template. The template creator can choose a default revision, but when end users create a cluster, they can choose any template and any template revision that is available to them. After the cluster is created from a specific revision, it cannot change to another template, but the cluster can be upgraded to a newer available revision of the same template.
+
+The template owner has full control over template revisions, and can create new revisions to update the template, delete or disable revisions that should not be used to create clusters, and choose which template revision is the default.
+
+This section covers the following topics:
+
+- [Prerequisites](#prerequisites)
+- [Creating a template](#creating-a-template)
+- [Updating a template](#updating-a-template)
+- [Deleting a template](#deleting-a-template)
+- [Creating a revision based on the default revision](#creating-a-revision-based-on-the-default-revision)
+- [Creating a revision based on a cloned revision](#creating-a-revision-based-on-a-cloned-revision)
+- [Disabling a template revision](#disabling-a-template-revision)
+- [Re-enabling a disabled template revision](#re-enabling-a-disabled-template-revision)
+- [Setting a template revision as default](#setting-a-template-revision-as-default)
+- [Deleting a template revision](#deleting-a-template-revision)
+- [Upgrading a cluster to use a new template revision](#upgrading-a-cluster-to-use-a-new-template-revision)
+- [Exporting a running cluster to a new RKE template and revision](#exporting-a-running-cluster-to-a-new-rke-template-and-revision)
+
+### Prerequisites
+
+You can create RKE templates if you have the **Create RKE Templates** permission, which can be [given by an administrator.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creator-permissions)
+
+You can revise, share, and delete a template if you are an owner of the template. For details on how to become an owner of a template, refer to [the documentation on sharing template ownership.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-ownership-of-templates)
+
+### Creating a Template
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Click **Add Template.**
+1. Provide a name for the template. An auto-generated name is already provided for the template' first version, which is created along with this template.
+1. Optional: Share the template with other users or groups by [adding them as members.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-templates-with-specific-users) You can also make the template public to share with everyone in the Rancher setup.
+1. Then follow the form on screen to save the cluster configuration parameters as part of the template's revision. The revision can be marked as default for this template.
+
+**Result:** An RKE template with one revision is configured. You can use this RKE template revision later when you [provision a Rancher-launched cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters). After a cluster is managed by an RKE template, it cannot be disconnected and the option to uncheck **Use an existing RKE Template and Revision** will be unavailable.
+
+### Updating a Template
+
+When you update an RKE template, you are creating a revision of the existing template. Clusters that were created with an older version of the template can be updated to match the new revision.
+
+You can't edit individual revisions. Since you can't edit individual revisions of a template, in order to prevent a revision from being used, you can [disable it.](#disabling-a-template-revision)
+
+When new template revisions are created, clusters using an older revision of the template are unaffected.
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the template that you want to edit and click the **&#8942; > Edit.**
+1. Edit the required information and click **Save.**
+1. Optional: You can change the default revision of this template and also change who it is shared with.
+
+**Result:** The template is updated. To apply it to a cluster using an older version of the template, refer to the section on [upgrading a cluster to use a new revision of a template.](#upgrading-a-cluster-to-use-a-new-template-revision)
+
+### Deleting a Template
+
+When you no longer use an RKE template for any of your clusters, you can delete it.
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the RKE template that you want to delete and click the **&#8942; > Delete.**
+1. Confirm the deletion when prompted.
+
+**Result:** The template is deleted.
+
+### Creating a Revision Based on the Default Revision
+
+You can clone the default template revision and quickly update its settings rather than creating a new revision from scratch. Cloning templates saves you the hassle of re-entering the access keys and other parameters needed for cluster creation.
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the RKE template that you want to clone and click the **&#8942; > New Revision From Default.**
+1. Complete the rest of the form to create a new revision.
+
+**Result:** The RKE template revision is cloned and configured.
+
+### Creating a Revision Based on a Cloned Revision
+
+When creating new RKE template revisions from your user settings, you can clone an existing revision and quickly update its settings rather than creating a new one from scratch. Cloning template revisions saves you the hassle of re-entering the cluster parameters.
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the template revision you want to clone. Then select **&#8942; > Clone Revision.**
+1. Complete the rest of the form.
+
+**Result:** The RKE template revision is cloned and configured. You can use the RKE template revision later when you provision a cluster. Any existing cluster using this RKE template can be upgraded to this new revision.
+
+### Disabling a Template Revision
+
+When you no longer want an RKE template revision to be used for creating new clusters, you can disable it. A disabled revision can be re-enabled.
+
+You can disable the revision if it is not being used by any cluster.
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the template revision you want to disable. Then select **&#8942; > Disable.**
+
+**Result:** The RKE template revision cannot be used to create a new cluster.
+
+### Re-enabling a Disabled Template Revision
+
+If you decide that a disabled RKE template revision should be used to create new clusters, you can re-enable it.
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the template revision you want to re-enable. Then select **&#8942; > Enable.**
+
+**Result:** The RKE template revision can be used to create a new cluster.
+
+### Setting a Template Revision as Default
+
+When end users create a cluster using an RKE template, they can choose which revision to create the cluster with. You can configure which revision is used by default.
+
+To set an RKE template revision as default,
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the RKE template revision that should be default and click the **&#8942; > Set as Default.**
+
+**Result:** The RKE template revision will be used as the default option when clusters are created with the template.
+
+### Deleting a Template Revision
+
+You can delete all revisions of a template except for the default revision.
+
+To permanently delete a revision,
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the RKE template revision that should be deleted and click the **&#8942; > Delete.**
+
+**Result:** The RKE template revision is deleted.
+
+### Upgrading a Cluster to Use a New Template Revision
+
+> This section assumes that you already have a cluster that [has an RKE template applied.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates)
+> This section also assumes that you have [updated the template that the cluster is using](#updating-a-template) so that a new template revision is available.
+
+To upgrade a cluster to use a new template revision,
+
+1. From the **Global** view in Rancher, click the **Clusters** tab.
+1. Go to the cluster that you want to upgrade and click **&#8942; > Edit.**
+1. In the **Cluster Options** section, click the dropdown menu for the template revision, then select the new template revision.
+1. Click **Save.**
+
+**Result:** The cluster is upgraded to use the settings defined in the new template revision.
+
+### Exporting a Running Cluster to a New RKE Template and Revision
+
+You can save an existing cluster's settings as an RKE template.
+
+This exports the cluster's settings as a new RKE template, and also binds the cluster to that template. The result is that the cluster can only be changed if the [template is updated,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template) and the cluster is upgraded to [use a newer version of the template.]
+
+To convert an existing cluster to use an RKE template,
+
+1. From the **Global** view in Rancher, click the **Clusters** tab.
+1. Go to the cluster that will be converted to use an RKE template. Click **&#8942;** > **Save as RKE Template.**
+1. Enter a name for the template in the form that appears, and click **Create.**
+
+**Results:**
+
+- A new RKE template is created.
+- The cluster is converted to use the new template.
+- New clusters can be [created from the new template and revision.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#creating-a-cluster-from-an-rke-template)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/creator-permissions/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/creator-permissions/_index.md
new file mode 100644
index 00000000000..0773da504e3
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/creator-permissions/_index.md
@@ -0,0 +1,50 @@
+---
+title: Template Creator Permissions
+weight: 10
+---
+
+Administrators have the permission to create RKE templates, and only administrators can give that permission to other users.
+
+For more information on administrator permissions, refer to the [documentation on global permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/).
+
+# Giving Users Permission to Create Templates
+
+Templates can only be created by users who have the global permission **Create RKE Templates.**
+
+Administrators have the global permission to create templates, and only administrators can give that permission to other users.
+
+For information on allowing users to modify existing templates, refer to [Sharing Templates.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing)
+
+Administrators can give users permission to create RKE templates in two ways:
+
+- By editing the permissions of an [individual user](#allowing-a-user-to-create-templates)
+- By changing the [default permissions of new users](#allowing-new-users-to-create-templates-by-default)
+
+### Allowing a User to Create Templates
+
+An administrator can individually grant the role **Create RKE Templates** to any existing user by following these steps:
+
+1. From the global view, click the **Users** tab. Choose the user you want to edit and click the **&#8942; > Edit.**
+1. In the **Global Permissions** section, choose **Custom** and select the **Create RKE Templates** role along with any other roles the user should have. Click **Save.**
+
+**Result:** The user has permission to create RKE templates.
+
+### Allowing New Users to Create Templates by Default
+
+Alternatively, the administrator can give all new users the default permission to create RKE templates by following the following steps. This will not affect the permissions of existing users.
+
+1. From the **Global** view, click **Security > Roles.**
+1. Under the **Global** roles tab, go to the role **Create RKE Templates** and click the **&#8942; > Edit**.
+1. Select the option **Yes: Default role for new users** and click **Save.**
+
+**Result:** Any new user created in this Rancher installation will be able to create RKE templates. Existing users will not get this permission.
+
+### Revoking Permission to Create Templates
+
+Administrators can remove a user's permission to create templates with the following steps:
+
+1. From the global view, click the **Users** tab. Choose the user you want to edit and click the **&#8942; > Edit.**
+1. In the **Global Permissions** section, un-check the box for **Create RKE Templates**. In this section, you can change the user back to a standard user, or give the user a different set of custom permissions.
+1. Click **Save.**
+
+**Result:** The user cannot create RKE templates.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/enforcement/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/enforcement/_index.md
new file mode 100644
index 00000000000..a1fa1e79ddb
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/enforcement/_index.md
@@ -0,0 +1,38 @@
+---
+title: Template Enforcement
+weight: 32
+---
+
+This section describes how template administrators can enforce templates in Rancher, restricting the ability of users to create clusters without a template.
+
+By default, any standard user in Rancher can create clusters. But when RKE template enforcement is turned on,
+
+- Only an administrator has the ability to create clusters without a template.
+- All standard users must use an RKE template to create a new cluster.
+- Standard users cannot create a cluster without using a template.
+
+Users can only create new templates if the administrator [gives them permission.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creator-permissions/#allowing-a-user-to-create-templates)
+
+After a cluster is created with an RKE template, the cluster creator cannot edit settings that are defined in the template. The only way to change those settings after the cluster is created is to [upgrade the cluster to a new revision]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#updating-a-cluster-created-with-an-rke-template) of the same template. If cluster creators want to change template-defined settings, they would need to contact the template owner to get a new revision of the template. For details on how template revisions work, refer to the [documentation on revising templates.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template)
+
+# Requiring New Clusters to Use an RKE Template
+
+You might want to require new clusters to use a template to ensure that any cluster launched by a [standard user]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) will use the Kubernetes and/or Rancher settings that are vetted by administrators.
+
+To require new clusters to use an RKE template, administrators can turn on RKE template enforcement with the following steps:
+
+1. From the **Global** view, click the **Settings** tab.
+1. Go to the `cluster-template-enforcement` setting. Click the vertical **&#8942;** and click **Edit.**
+1. Set the value to **True** and click **Save.**
+
+**Result:** All clusters provisioned by Rancher must use a template, unless the creator is an administrator.
+
+# Disabling RKE Template Enforcement
+
+To allow new clusters to be created without an RKE template, administrators can turn off RKE template enforcement with the following steps:
+
+1. From the **Global** view, click the **Settings** tab.
+1. Go to the `cluster-template-enforcement` setting. Click the vertical **&#8942;** and click **Edit.**
+1. Set the value to **False** and click **Save.**
+
+**Result:** When clusters are provisioned by Rancher, they don't need to use a template.
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/example-scenarios/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/example-scenarios/_index.md
new file mode 100644
index 00000000000..4e93e102c62
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/example-scenarios/_index.md
@@ -0,0 +1,71 @@
+---
+title: Example Scenarios
+weight: 5
+---
+
+These example scenarios describe how an organization could use templates to standardize cluster creation.
+
+- **Enforcing templates:** Administrators might want to [enforce one or more template settings for everyone](#enforcing-a-template-setting-for-everyone) if they want all new Rancher-provisioned clusters to have those settings.
+- **Sharing different templates with different users:** Administrators might give [different templates to basic and advanced users,](#templates-for-basic-and-advanced-users) so that basic users have more restricted options and advanced users have more discretion when creating clusters.
+- **Updating template settings:** If an organization's security and DevOps teams decide to embed best practices into the required settings for new clusters, those best practices could change over time. If the best practices change, [a template can be updated to a new revision](#updating-templates-and-clusters-created-with-them) and clusters created from the template can upgrade to the new version of the template.
+- **Sharing ownership of a template:** When a template owner no longer wants to maintain a template, or wants to delegate ownership of the template, this scenario describes how [template ownership can be shared.](#allowing-other-users-to-control-and-share-a-template)
+
+
+# Enforcing a Template Setting for Everyone
+
+Let's say there is an organization in which the administrators decide that all new clusters should be created with Kubernetes version 1.14.
+
+1. First, an administrator creates a template which specifies the Kubernetes version as 1.14 and marks all other settings as **Allow User Override**.
+1. The administrator makes the template public.
+1. The administrator turns on template enforcement.
+
+**Results:**
+
+- All Rancher users in the organization have access to the template.
+- All new clusters created by [standard users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) with this template will use Kubernetes 1.14 and they are unable to use a different Kubernetes version. By default, standard users don't have permission to create templates, so this template will be the only template they can use unless more templates are shared with them.
+- All standard users must use a cluster template to create a new cluster. They cannot create a cluster without using a template.
+
+In this way, the administrators enforce the Kubernetes version across the organization, while still allowing end users to configure everything else.
+
+# Templates for Basic and Advanced Users
+
+Let's say an organization has both basic and advanced users. Administrators want the basic users to be required to use a template, while the advanced users and administrators create their clusters however they want.
+
+1. First, an administrator turns on [RKE template enforcement.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/enforcement/#requiring-new-clusters-to-use-a-cluster-template) This means that every [standard user]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) in Rancher will need to use an RKE template when they create a cluster.
+1. The administrator then creates two templates:
+
+  - One template for basic users, with almost every option specified except for access keys
+  - One template for advanced users, which has most or all options has **Allow User Override** turned on
+
+1. The administrator shares the advanced template with only the advanced users.
+1. The administrator makes the template for basic users public, so the more restrictive template is an option for everyone who creates a Rancher-provisioned cluster.
+
+**Result:** All Rancher users, except for administrators, are required to use a template when creating a cluster. Everyone has access to the restrictive template, but only advanced users have permission to use the more permissive template. The basic users are more restricted, while advanced users have more freedom when configuring their Kubernetes clusters.
+
+# Updating Templates and Clusters Created with Them
+
+Let's say an organization has a template that requires clusters to use Kubernetes v1.14. However, as time goes on, the administrators change their minds. They decide they want users to be able to upgrade their clusters to use newer versions of Kubernetes.
+
+In this organization, many clusters were created with a template that requires Kubernetes v1.14. Because the template does not allow that setting to be overridden, the users who created the cluster cannot directly edit that setting.
+
+The template owner has several options for allowing the cluster creators to upgrade Kubernetes on their clusters:
+
+- **Specify Kubernetes v1.15 on the template:** The template owner can create a new template revision that specifies Kubernetes v1.15. Then the owner of each cluster that uses that template can upgrade their cluster to a new revision of the template. This template upgrade allows the cluster creator to upgrade Kubernetes to v1.15 on their cluster.
+- **Allow any Kubernetes version on the template:** When creating a template revision, the template owner can also mark the the Kubernetes version as **Allow User Override** using the switch near that setting on the Rancher UI. This will allow clusters that upgrade to this template revision to use any version of Kubernetes.
+- **Allow the latest minor Kubernetes version on the template:** The template owner can also create a template revision in which the Kubernetes version is defined as **Latest v1.14 (Allows patch version upgrades).** This means clusters that use that revision will be able to get patch version upgrades, but major version upgrades will not be allowed.
+
+# Allowing Other Users to Control and Share a Template
+
+Let's say Alice is a Rancher administrator. She owns an RKE template that reflects her organization's agreed-upon best practices for creating a cluster.
+
+Bob is an advanced user who can make informed decisions about cluster configuration. Alice trusts Bob to create new revisions of her template as the best practices get updated over time. Therefore, she decides to make Bob an owner of the template.
+
+To share ownership of the template with Bob, Alice [adds Bob as an owner of her template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-ownership-of-templates)
+
+The result is that as a template owner, Bob is in charge of version control for that template. Bob can now do all of the following:
+
+- [Revise the template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template) when the best practices change
+- [Disable outdated revisions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#disabling-a-template-revision) of the template so that no new clusters can be created with it
+- [Delete the whole template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#deleting-a-template) if the organization wants to go in a different direction
+- [Set a certain revision as default]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#setting-a-template-revision-as-default) when users create a cluster with it. End users of the template will still be able to choose which revision they want to create the cluster with.
+- [Share the template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing) with specific users, make the template available to all Rancher users, or share ownership of the template with another user.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/example-yaml/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/example-yaml/_index.md
new file mode 100644
index 00000000000..3c85e86d616
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/example-yaml/_index.md
@@ -0,0 +1,112 @@
+---
+title: Example YAML
+weight: 60
+---
+
+Below is an example RKE template configuration file for reference.
+
+The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive.
+
+```yaml
+# 
+# Cluster Config
+# 
+docker_root_dir: /var/lib/docker
+
+enable_cluster_alerting: false
+# This setting is not enforced. Clusters
+# created with this sample template
+# would have alerting turned off by default,
+# but end users could still turn alerting
+# on or off.
+
+enable_cluster_monitoring: true 
+# This setting is not enforced. Clusters
+# created with this sample template
+# would have monitoring turned on
+# by default, but end users could still
+# turn monitoring on or off.
+
+enable_network_policy: false
+local_cluster_auth_endpoint:
+  enabled: true
+# 
+# Rancher Config
+# 
+rancher_kubernetes_engine_config: # Your RKE template config goes here.
+  addon_job_timeout: 30
+  authentication:
+    strategy: x509
+  ignore_docker_version: true
+# 
+# # Currently only nginx ingress provider is supported.
+# # To disable ingress controller, set `provider: none`
+# # To enable ingress on specific nodes, use the node_selector, eg:
+#    provider: nginx
+#    node_selector:
+#      app: ingress
+# 
+  ingress:
+    provider: nginx
+  kubernetes_version: v1.15.3-rancher3-1
+  monitoring:
+    provider: metrics-server
+# 
+#   If you are using calico on AWS
+# 
+#    network:
+#      plugin: calico
+#      calico_network_provider:
+#        cloud_provider: aws
+# 
+# # To specify flannel interface
+# 
+#    network:
+#      plugin: flannel
+#      flannel_network_provider:
+#      iface: eth1
+# 
+# # To specify flannel interface for canal plugin
+# 
+#    network:
+#      plugin: canal
+#      canal_network_provider:
+#        iface: eth1
+# 
+  network:
+    options:
+      flannel_backend_type: vxlan
+    plugin: canal
+# 
+#    services:
+#      kube-api:
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kube-controller:
+#        cluster_cidr: 10.42.0.0/16
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kubelet:
+#        cluster_domain: cluster.local
+#        cluster_dns_server: 10.43.0.10
+# 
+  services:
+    etcd:
+      backup_config:
+        enabled: true
+        interval_hours: 12
+        retention: 6
+        safe_timestamp: false
+      creation: 12h
+      extra_args:
+        election-timeout: 5000
+        heartbeat-interval: 500
+      gid: 0
+      retention: 72h
+      snapshot: false
+      uid: 0
+    kube_api:
+      always_pull_images: false
+      pod_security_policy: false
+      service_node_port_range: 30000-32767
+  ssh_agent_auth: false
+windows_prefered_cluster: false
+```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/overrides/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/overrides/_index.md
new file mode 100644
index 00000000000..bb5f00d4b9e
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/overrides/_index.md
@@ -0,0 +1,15 @@
+---
+title: Overriding Template Settings
+weight: 33
+---
+
+When a user creates an RKE template, each setting in the template has a switch in the Rancher UI that indicates if users can override the setting. This switch marks those settings as **Allow User Override.**
+
+After a cluster is created with a template, end users can't update any of the settings defined in the template unless the template owner marked them as **Allow User Override.** However, if the template is [updated to a new revision]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising) that changes the settings or allows end users to change them, the cluster can be upgraded to a new revision of the template and the changes in the new revision will be applied to the cluster.
+
+When any parameter is set as **Allow User Override** on the RKE template, it means that end users have to fill out those fields during cluster creation and they can edit those settings afterward at any time.
+
+The **Allow User Override** model of the RKE template is useful for situations such as:
+
+- Administrators know that some settings will need the flexibility to be frequently updated over time
+- End users will need to enter their own access keys or secret keys, for example, cloud credentials or credentials for backup snapshots
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/rke-templates-and-hardware/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/rke-templates-and-hardware/_index.md
new file mode 100644
index 00000000000..67ca181a964
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/rke-templates-and-hardware/_index.md
@@ -0,0 +1,70 @@
+---
+title: RKE Templates and Infrastructure
+weight: 90
+---
+
+In Rancher, RKE templates are used to provision Kubernetes and define Rancher settings, while node templates are used to provision nodes.
+
+Therefore, even if RKE template enforcement is turned on, the end user still has flexibility when picking the underlying hardware when creating a Rancher cluster. The end users of an RKE template can still choose an infrastructure provider and the nodes they want to use.
+
+If you want to standardize the hardware in your clusters, use RKE templates conjunction with node templates or with a server provisioning tool such as Terraform.
+
+### Node Templates
+
+[Node templates]({{<baseurl>}}/rancher/v2.x/en/user-settings/node-templates) are responsible for node configuration and node provisioning in Rancher. From your user profile, you can set up node templates to define which templates are used in each of your node pools. With node pools enabled, you can make sure you have the required number of nodes in each node pool, and ensure that all nodes in the pool are the same.
+
+### Terraform
+
+Terraform is a server provisioning tool. It uses infrastructure-as-code that lets you create almost every aspect of your infrastructure with Terraform configuration files. It can automate the process of server provisioning in a way that is self-documenting and easy to track in version control.
+
+This section focuses on how to use Terraform with the [Rancher 2 Terraform provider](https://www.terraform.io/docs/providers/rancher2/), which is a recommended option to standardize the hardware for your Kubernetes clusters. If you use the Rancher Terraform provider to provision hardware, and then use an RKE template to provision a Kubernetes cluster on that hardware, you can quickly create a comprehensive, production-ready cluster.
+
+Terraform allows you to:
+
+- Define almost any kind of infrastructure-as-code, including servers, databases, load balancers, monitoring, firewall settings, and SSL certificates
+- Leverage catalog apps and multi-cluster apps
+- Codify infrastructure across many platforms, including Rancher and major cloud providers
+- Commit infrastructure-as-code to version control
+- Easily repeat configuration and setup of infrastructure
+- Incorporate infrastructure changes into standard development practices
+- Prevent configuration drift, in which some servers become configured differently than others
+
+# How Does Terraform Work?
+
+Terraform is written in files with the extension `.tf`. It is written in HashiCorp Configuration Language, which is a declarative language that lets you define the infrastructure you want in your cluster, the cloud provider you are using, and your credentials for the provider. Then Terraform makes API calls to the provider in order to efficiently create that infrastructure.
+
+To create a Rancher-provisioned cluster with Terraform, go to your Terraform configuration file and define the provider as Rancher 2. You can set up your Rancher 2 provider with a Rancher API key. Note: The API key has the same permissions and access level as the user it is associated with.
+
+Then Terraform calls the Rancher API to provision your infrastructure, and Rancher calls the infrastructure provider. As an example, if you wanted to use Rancher to provision infrastructure on AWS, you would provide both your Rancher API key and your AWS credentials in the Terraform configuration file or in environment variables so that they could be used to provision the infrastructure.
+
+When you need to make changes to your infrastructure, instead of manually updating the servers, you can make changes in the Terraform configuration files. Then those files can be committed to version control, validated, and reviewed as necessary. Then when you run `terraform apply`, the changes would be deployed.
+
+# Tips for Working with Terraform
+
+- There are examples of how to provide most aspects of a cluster in the [documentation for the Rancher 2 provider.](https://www.terraform.io/docs/providers/rancher2/)
+
+- In the Terraform settings, you can install Docker Machine by using the Docker Machine node driver.
+
+- You can also modify auth in the Terraform provider.
+
+- You can reverse engineer how to do define a setting in Terraform by changing the setting in Rancher, then going back and checking your Terraform state file to see how it maps to the current state of your infrastructure.
+
+- If you want to manage Kubernetes cluster settings, Rancher settings, and hardware settings all in one place, use [Terraform modules](https://github.com/rancher/terraform-modules). You can pass a cluster configuration YAML file or an RKE template configuration file to a Terraform module so that the Terraform module will create it. In that case, you could use your infrastructure-as-code to manage the version control and revision history of both your Kubernetes cluster and its underlying hardware.
+
+# Tip for Creating CIS Benchmark Compliant Clusters
+
+This section describes one way that you can make security and compliance-related config files standard in your clusters.
+
+When you create a [CIS benchmark compliant cluster,]({{<baseurl>}}/rancher/v2.x/en/security/) you have an encryption config file and an audit log config file.
+
+Your infrastructure provisioning system can write those files to disk. Then in your RKE template, you would specify where those files will be, then add your encryption config file and audit log config file as extra mounts to the `kube-api-server`.
+
+Then you would make sure that the `kube-api-server` flag in your RKE template uses your CIS-compliant config files.
+
+In this way, you can create flags that comply with the CIS benchmark.
+
+# Resources
+
+- [Terraform documentation](https://www.terraform.io/docs/)
+- [Rancher2 Terraform provider documentation](https://www.terraform.io/docs/providers/rancher2/)
+- [The RanchCast - Episode 1: Rancher 2 Terraform Provider](https://youtu.be/YNCq-prI8-8): In this demo, Director of Community Jason van Brackel walks through using the Rancher 2 Terraform Provider to provision nodes and create a custom cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/template-access-and-sharing/_index.md b/content/rancher/v2.5/en/applications/ecm/rke-templates/template-access-and-sharing/_index.md
new file mode 100644
index 00000000000..863faa1bc8b
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/rke-templates/template-access-and-sharing/_index.md
@@ -0,0 +1,61 @@
+---
+title: Access and Sharing
+weight: 31
+---
+
+If you are an RKE template owner, you can share it with users or groups of users, who can then use the template to create clusters.
+
+Since RKE templates are specifically shared with users and groups, owners can share different RKE templates with different sets of users.
+
+When you share a template, each user can have one of two access levels:
+
+- **Owner:** This user can update, delete, and share the templates that they own. The owner can also share the template with other users.
+- **User:** These users can create clusters using the template. They can also upgrade those clusters to new revisions of the same template. When you share a template as **Make Public (read-only),** all users in your Rancher setup have the User access level for the template.
+
+If you create a template, you automatically become an owner of that template. 
+
+If you want to delegate responsibility for updating the template, you can share ownership of the template. For details on how owners can modify templates, refer to the [documentation about revising templates.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising)
+
+There are several ways to share templates:
+
+- Add users to a new RKE template during template creation
+- Add users to an existing RKE template
+- Make the RKE template public, sharing it with all users in the Rancher setup
+- Share template ownership with users who are trusted to modify the template
+
+### Sharing Templates with Specific Users or Groups
+
+To allow users or groups to create clusters using your template, you can give them the basic **User** access level for the template.
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the template that you want to share and click the **&#8942; > Edit.**
+1. In the **Share Template** section, click on **Add Member**.
+1. Search in the **Name** field for the user or group you want to share the template with.
+1. Choose the **User** access type.
+1. Click **Save.**
+
+**Result:** The user or group can create clusters using the template.
+
+### Sharing Templates with All Users
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the template that you want to share and click the **&#8942; > Edit.**
+1. Under **Share Template,** click **Make Public (read-only).** Then click **Save.**
+
+**Result:** All users in the Rancher setup can create clusters using the template.
+
+### Sharing Ownership of Templates
+
+If you are the creator of a template, you might want to delegate responsibility for maintaining and updating a template to another user or group.
+
+In that case, you can give users the Owner access type, which allows another user to update your template, delete it, or share access to it with other users.
+
+To give Owner access to a user or group,
+
+1. From the **Global** view, click **Tools > RKE Templates.**
+1. Go to the RKE template that you want to share and click the **&#8942; > Edit.**
+1. Under **Share Template**, click on **Add Member** and search in the **Name** field for the user or group you want to share the template with.
+1. In the **Access Type** field, click **Owner.**
+1. Click **Save.**
+
+**Result:** The user or group has the Owner access type, and can modify, share, or delete the template.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/_index.md
new file mode 100644
index 00000000000..a8778f3056e
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/_index.md
@@ -0,0 +1,92 @@
+---
+title: Setting up Kubernetes Clusters in Rancher
+description: Provisioning Kubernetes Clusters
+weight: 2
+---
+
+Rancher simplifies the creation of clusters by allowing you to create them through the Rancher UI rather than more complex alternatives. Rancher provides multiple options for launching a cluster. Use the option that best fits your use case.
+
+This section assumes a basic familiarity with Docker and Kubernetes. For a brief explanation of how Kubernetes components work together, refer to the [concepts]({{<baseurl>}}/rancher/v2.x/en/overview/concepts) page.
+
+For a conceptual overview of how the Rancher server provisions clusters and what tools it uses to provision them, refer to the [architecture]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/) page.
+
+This section covers the following topics:
+
+<!-- TOC -->
+
+- [Setting up clusters in a hosted Kubernetes provider](#setting-up-clusters-in-a-hosted-kubernetes-cluster)
+- [Launching Kubernetes with Rancher](#launching-kubernetes-with-rancher)
+  - [Launching Kubernetes and Provisioning Nodes in an Infrastructure Provider](#launching-kubernetes-and-provisioning-nodes-in-an-infrastructure-provider)
+  - [Launching Kubernetes on Existing Custom Nodes](#launching-kubernetes-on-existing-custom-nodes)
+- [Importing Existing Clusters](#importing-existing-clusters)
+  - [Importing and Editing K3s Clusters](#importing-and-editing-k3s-clusters)
+  <!-- /TOC -->
+
+The following table summarizes the options and settings available for each cluster type:
+
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
+
+# Setting up Clusters in a Hosted Kubernetes Provider
+
+In this scenario, Rancher does not provision Kubernetes because it is installed by providers such as Google Kubernetes Engine (GKE), Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.
+
+If you use a Kubernetes provider such as Google GKE, Rancher integrates with its cloud APIs, allowing you to create and manage role-based access control for the hosted cluster from the Rancher UI.
+
+For more information, refer to the section on [hosted Kubernetes clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters)
+
+# Launching Kubernetes with Rancher
+
+Rancher uses the [Rancher Kubernetes Engine (RKE)]({{<baseurl>}}/rke/latest/en/)as a library when provisioning Kubernetes on your own nodes. RKE is Rancher’s own lightweight Kubernetes installer.
+
+In RKE clusters, Rancher manages the deployment of Kubernetes. These clusters can be deployed on any bare metal server, cloud provider, or virtualization platform.
+
+These nodes can be dynamically provisioned through Rancher's UI, which calls [Docker Machine](https://docs.docker.com/machine/) to launch nodes on various cloud providers.
+
+If you already have a node that you want to add to an RKE cluster, you can add it to the cluster by running a Rancher agent container on it.
+
+For more information, refer to the section on [RKE clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/)
+
+### Launching Kubernetes and Provisioning Nodes in an Infrastructure Provider
+
+Rancher can dynamically provision nodes in infrastructure providers such as Amazon EC2, DigitalOcean, Azure, or vSphere, then install Kubernetes on them.
+
+Using Rancher, you can create pools of nodes based on a [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates). This template defines the parameters used to launch nodes in your cloud providers.
+
+One benefit of using nodes hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically replace it, thus maintaining the expected cluster configuration.
+
+The cloud providers available for creating a node template are decided based on the [node drivers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-drivers) active in the Rancher UI.
+
+For more information, refer to the section on [nodes hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/)
+
+### Launching Kubernetes on Existing Custom Nodes
+
+When setting up this type of cluster, Rancher installs Kubernetes on existing [custom nodes,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/) which creates a custom cluster.
+
+You can bring any nodes you want to Rancher and use them to create a cluster.
+
+These nodes include on-premise bare metal servers, cloud-hosted virtual machines, or on-premise virtual machines.
+
+# Importing Existing Clusters
+
+In this type of cluster, Rancher connects to a Kubernetes cluster that has already been set up. Therefore, Rancher does not provision Kubernetes, but only sets up the Rancher agents to communicate with the cluster.
+
+Note that Rancher does not automate the provisioning, scaling, or upgrade of imported clusters. Other Rancher features, including management of cluster, role-based access control, policy, and workloads, are available for imported clusters.
+
+For all imported Kubernetes clusters except for K3s clusters, the configuration of an imported cluster still has to be edited outside of Rancher. Some examples of editing the cluster include adding and removing nodes, upgrading the Kubernetes version, and changing Kubernetes component parameters.
+
+In Rancher v2.4, it became possible to import a K3s cluster and upgrade Kubernetes by editing the cluster in the Rancher UI.
+
+For more information, refer to the section on [importing existing clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)
+
+### Importing and Editing K3s Clusters
+
+_Available as of Rancher v2.4.0_
+
+[K3s]({{<baseurl>}}/k3s/latest/en/) is lightweight, fully compliant Kubernetes distribution. K3s Kubernetes clusters can now be imported into Rancher.
+
+When a K3s cluster is imported, Rancher will recognize it as K3s, and the Rancher UI will expose the following features in addition to the functionality for other imported clusters:
+
+- The ability to upgrade the K3s version
+- The ability to see a read-only version of the K3s cluster's configuration arguments and environment variables used to launch each node in the cluster.
+
+For more information, refer to the section on [imported K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-of-imported-k3s-clusters)
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/cluster-capabilities-table/index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/cluster-capabilities-table/index.md
new file mode 100644
index 00000000000..b3560c76223
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/cluster-capabilities-table/index.md
@@ -0,0 +1,22 @@
+---
+headless: true
+---
+| Action | [Rancher launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) | [Hosted Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | [Imported Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters) |
+| --- | --- | ---| ---|
+| [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | ✓ | ✓ | ✓ |
+| [Managing Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members/) | ✓ | ✓ | ✓ |
+| [Editing and Upgrading Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) | ✓ | ✓ | * |
+| [Managing Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes) | ✓ | ✓ | ✓ |
+| [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | ✓ | ✓ | ✓ |
+| [Managing Projects, Namespaces and Workloads]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | ✓ | ✓ | ✓ |
+| [Using App Catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/) | ✓ | ✓ | ✓ |
+| [Configuring Tools (Alerts, Notifiers, Logging, Monitoring, Istio)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) | ✓ | ✓ | ✓ |
+| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| ✓ | ✓ | |
+| [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | ✓ |  | |
+| [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | ✓ | | |
+| [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | ✓ | | |
+| [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/) | ✓ | | |
+| [Configuring Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/pod-security-policy/) | ✓ |  | |
+| [Running Security Scans]({{<baseurl>}}/rancher/v2.x/en/security/security-scan/) | ✓ |  | |
+
+/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
new file mode 100644
index 00000000000..dffe1dfa5c6
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
@@ -0,0 +1,32 @@
+---
+title: Setting up Clusters from Hosted Kubernetes Providers
+weight: 2
+---
+
+In this scenario, Rancher does not provision Kubernetes because it is installed by providers such as Google Kubernetes Engine (GKE), Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.
+
+If you use a Kubernetes provider such as Google GKE, Rancher integrates with its cloud APIs, allowing you to create and manage role-based access control for the hosted cluster from the Rancher UI.
+
+In this use case, Rancher sends a request to a hosted provider using the provider's API. The provider then provisions and hosts the cluster for you. When the cluster finishes building, you can manage it from the Rancher UI along with clusters you've provisioned that are hosted on-premise or in an infrastructure provider.
+
+Rancher supports the following Kubernetes providers:
+
+Kubernetes Providers | Available as of  |
+ --- | --- |
+[Google GKE (Google Kubernetes Engine)](https://cloud.google.com/kubernetes-engine/) | v2.0.0 |
+[Amazon EKS (Amazon Elastic Container Service for Kubernetes)](https://aws.amazon.com/eks/) | v2.0.0 |
+[Microsoft AKS (Azure Kubernetes Service)](https://azure.microsoft.com/en-us/services/kubernetes-service/) | v2.0.0 |
+[Alibaba ACK (Alibaba Cloud Container Service for Kubernetes)](https://www.alibabacloud.com/product/kubernetes) | v2.2.0 |
+[Tencent TKE (Tencent Kubernetes Engine)](https://intl.cloud.tencent.com/product/tke) | v2.2.0 |
+[Huawei CCE (Huawei Cloud Container Engine)](https://www.huaweicloud.com/en-us/product/cce.html) | v2.2.0 |
+
+## Hosted Kubernetes Provider Authentication
+
+When using Rancher to create a cluster hosted by a provider, you are prompted for authentication information. This information is required to access the provider's API. For more information on how to obtain this information, see the following procedures:
+
+- [Creating a GKE Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/gke)
+- [Creating an EKS Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks)
+- [Creating an AKS Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/aks)
+- [Creating an ACK Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/ack)
+- [Creating a TKE Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke)
+- [Creating a CCE Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce)
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
new file mode 100644
index 00000000000..32d75c76a00
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
@@ -0,0 +1,48 @@
+---
+title: Creating an Aliyun ACK Cluster
+shortTitle: Alibaba Cloud Container Service for Kubernetes
+weight: 2120
+---
+
+_Available as of v2.2.0_
+
+You can use Rancher to create a cluster hosted in Alibaba Cloud Kubernetes (ACK). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for ACK, but by default, this cluster driver is `inactive`. In order to launch ACK clusters, you will need to [enable the ACK cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning ACK clusters.
+
+## Prerequisites
+
+>**Note**
+>Deploying to ACK will incur charges.
+
+1. In Aliyun, activate the following services in their respective consoles.
+
+    - [Container Service](https://cs.console.aliyun.com)
+    - [Resource Orchestration Service](https://ros.console.aliyun.com)
+    - [RAM](https://ram.console.aliyun.com)
+
+2. Make sure that the account you will be using to create the ACK cluster has the appropriate permissions. Referring to the official Alibaba Cloud documentation about [Role authorization](https://www.alibabacloud.com/help/doc-detail/86483.htm) and [Use the Container Service console as a RAM user](https://www.alibabacloud.com/help/doc-detail/86484.htm) for details.
+
+3. In Alibaba Cloud, create an [access key](https://www.alibabacloud.com/help/doc-detail/53045.html).
+
+4. In Alibaba Cloud, create an [SSH key pair](https://www.alibabacloud.com/help/doc-detail/51793.html). This key is used to access nodes in the Kubernetes cluster.
+
+## Create an ACK Cluster
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+1. Choose **Alibaba ACK**.
+
+1. Enter a **Cluster Name**.
+
+1. {{< step_create-cluster_member-roles >}}
+
+1. Configure **Account Access** for the ACK cluster. Choose the geographical region in which to build your cluster, and input the access key that was created as part of the prerequisite steps.
+
+1. Click **Next: Configure Cluster**, then choose cluster type, the version of Kubernetes and the availability zone.
+
+1. If you choose **Kubernetes** as the cluster type, Click **Next: Configure Master Nodes**, then complete the **Master Nodes** form.
+
+1. Click **Next: Configure Worker Nodes**, then complete the **Worker Nodes** form.
+
+1. Review your options to confirm they're correct. Then click **Create**.
+
+{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
new file mode 100644
index 00000000000..fa5d692d15e
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
@@ -0,0 +1,142 @@
+---
+title: Creating an AKS Cluster
+shortTitle: Azure Kubernetes Service
+weight: 2115
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure-container-service/
+---
+
+You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Service (AKS).
+
+## Prerequisites in Microsoft Azure
+
+>**Note**
+>Deploying to AKS will incur charges.
+
+To interact with Azure APIs, an AKS cluster requires an Azure Active Directory (AD) service principal. The service principal is needed to dynamically create and manage other Azure resources, and it provides credentials for your cluster to communicate with AKS. For more information about the service principal, refer to the [AKS documentation](https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal).
+
+Before creating the service principal, you need to obtain the following information from the [Microsoft Azure Portal](https://portal.azure.com):
+
+- Your subscription ID
+- Your tenant ID
+- An app ID (also called a client ID)
+- Client secret
+- A resource group
+
+The below sections describe how to set up these prerequisites using either the Azure command line tool or the Azure portal.
+
+### Setting Up the Service Principal with the Azure Command Line Tool
+
+You can create the service principal by running this command:
+
+```
+az ad sp create-for-rbac --skip-assignment
+```
+
+The result should show information about the new service principal:
+```
+{
+  "appId": "xxxx--xxx",
+  "displayName": "<SERVICE-PRINCIPAL-NAME>",
+  "name": "http://<SERVICE-PRINCIPAL-NAME>",
+  "password": "<SECRET>",
+  "tenant": "<TENANT NAME>"
+}
+```
+
+You also need to add roles to the service principal so that it has privileges for communication with the AKS API. It also needs access to create and list virtual networks.
+
+Below is an example command for assigning the Contributor role to a service principal. Contributors can manage anything on AKS but cannot give access to others:
+
+```
+az role assignment create \
+  --assignee $appId \
+  --scope /subscriptions/$<SUBSCRIPTION-ID>/resourceGroups/$<GROUP> \
+  --role Contributor
+```
+
+You can also create the service principal and give it Contributor privileges by combining the two commands into one. In this command, the scope needs to provide a full path to an Azure resource:
+
+```
+az ad sp create-for-rbac \
+  --scope /subscriptions/$<SUBSCRIPTION-ID>/resourceGroups/$<GROUP> \
+  --role Contributor
+```
+
+### Setting Up the Service Principal from the Azure Portal
+
+You can also follow these instructions to set up a service principal and give it role-based access from the Azure Portal.
+
+1. Go to the Microsoft Azure Portal [home page](https://portal.azure.com).
+
+1. Click **Azure Active Directory.**
+
+1. Click **App registrations.**
+
+1. Click **New registration.**
+
+1. Enter a name. This will be the name of your service principal.
+
+1. Optional: Choose which accounts can use the service principal.
+
+1. Click **Register.**
+
+1. You should now see the name of your service principal under **Azure Active Directory > App registrations.** 
+
+1. Click the name of your service principal. Take note of the tenant ID and application ID (also called app ID or client ID) so that you can use it when provisioning your AKS cluster. Then click **Certificates & secrets.**
+
+1. Click **New client secret.**
+
+1. Enter a short description, pick an expiration time, and click **Add.** Take note of the client secret so that you can use it when provisioning the AKS cluster.
+
+**Result:** You have created a service principal and you should be able to see it listed in the **Azure Active Directory** section under **App registrations.** You still need to give the service principal access to AKS. 
+
+To give role-based access to your service principal,
+
+1. Click **All Services** in the left navigation bar. Then click **Subscriptions.**
+
+1. Click the name of the subscription that you want to associate with your Kubernetes cluster. Take note of the subscription ID so that you can use it when provisioning your AKS cluster.
+
+1. Click **Access Control (IAM).**
+
+1. In the **Add role assignment** section, click **Add.**
+
+1. In the **Role** field, select a role that will have access to AKS. For example, you can use the **Contributor** role, which has permission to manage everything except for giving access to other users.
+
+1. In the **Assign access to** field, select **Azure AD user, group, or service principal.**
+
+1. In the **Select** field, select the name of your service principal and click **Save.**
+
+**Result:** Your service principal now has access to AKS.
+
+
+## Create the AKS Cluster
+
+Use Rancher to set up and configure your Kubernetes cluster.
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+1. Choose **Azure Kubernetes Service**.
+
+1. Enter a **Cluster Name**.
+
+1. {{< step_create-cluster_member-roles >}} 
+
+1. Use your subscription ID, tenant ID, app ID, and client secret to give your cluster access to AKS. If you don't have all of that information, you can retrieve it using these instructions:
+  - **App ID and tenant ID:** To get the app ID and tenant ID, you can go to the Azure Portal, then click **Azure Active Directory**, then click **App registrations,** then click the name of the service principal. The app ID and tenant ID are both on the app registration detail page. 
+  - **Client secret:** If you didn't copy the client secret when creating the service principal, you can get a new one if you go to the app registration detail page, then click **Certificates & secrets**, then click **New client secret.** 
+  - **Subscription ID:** You can get the subscription ID is available in the portal from **All services > Subscriptions.**
+
+1. {{< step_create-cluster_cluster-options >}}
+
+1. Complete the **Account Access** form using the output from your Service Principal. This information is used to authenticate with Azure.
+
+1. Use **Nodes** to provision each node in your cluster and choose a geographical region.
+
+	[Microsoft Documentation: How to create and use an SSH public and private key pair](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys)
+<br/>
+1. Click **Create**.
+<br/>
+1. Review your options to confirm they're correct. Then click **Create**.
+
+{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
new file mode 100644
index 00000000000..f01af1c27b3
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
@@ -0,0 +1,82 @@
+---
+title: Creating a Huawei CCE Cluster
+shortTitle: Huawei Cloud Kubernetes Service
+weight: 2130
+---
+
+_Available as of v2.2.0_
+
+You can use Rancher to create a cluster hosted in Huawei Cloud Container Engine (CCE). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for CCE, but by default, this cluster driver is `inactive`. In order to launch CCE clusters, you will need to [enable the CCE cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning CCE clusters.
+
+## Prerequisites in Huawei
+
+>**Note**
+>Deploying to CCE will incur charges.
+
+1. Find your project ID in Huawei CCE portal. See the CCE documentation on how to [manage your projects](https://support.huaweicloud.com/en-us/usermanual-iam/en-us_topic_0066738518.html).
+
+2. Create an [Access Key ID and Secret Access Key](https://support.huaweicloud.com/en-us/usermanual-iam/en-us_topic_0079477318.html).
+
+## Limitations
+
+Huawei CCE service doesn't support the ability to create clusters with public access through their API. You are required to run Rancher in the same VPC as the CCE clusters that you want to provision.
+
+## Create the CCE Cluster
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+2. Choose **Huawei CCE**.
+
+3. Enter a **Cluster Name**.
+
+4. {{< step_create-cluster_member-roles >}}
+
+5. Enter **Project Id**, Access Key ID as **Access Key** and Secret Access Key **Secret Key**. Then Click **Next: Configure cluster**.
+
+6. Fill the following cluster configuration:
+
+    |Settings|Description|
+    |---|---|
+    | Cluster Type | Which type or node you want to include into the cluster, `VirtualMachine` or `BareMetal`. |
+	| Description | The description of the cluster. |
+	| Master Version | The Kubernetes version. |
+	| Management Scale Count | The max node count of the cluster. The options are 50, 200 and 1000. The larger of the scale count, the more the cost. |
+	| High Availability | Enable master node high availability. The cluster with high availability enabled will have more cost. |
+	| Container Network Mode | The network mode used in the cluster. `overlay_l2` and `vpc-router` is supported in `VirtualMachine` type and `underlay_ipvlan` is supported in `BareMetal` type |
+	| Container Network CIDR | Network CIDR for the cluster. |
+	| VPC Name | The VPC name which the cluster is going to deploy into. Rancher will create one if it is blank. |
+	| Subnet Name | The Subnet name which the cluster is going to deploy into. Rancher will create one if it is blank. |
+	| External Server | This option is reserved for the future we can enable CCE cluster public access via API. For now, it is always disabled. |
+	| Cluster Label | The labels for the cluster. |
+	| Highway Subnet | This option is only supported in `BareMetal` type. It requires you to select a VPC with high network speed for the bare metal machines. |
+
+	**Note:** If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0)
+
+7. Fill the following node configuration of the cluster:
+
+    |Settings|Description|
+	|---|---|
+	| Zone | The available zone at where the node(s) of the cluster is deployed. |
+	| Billing Mode | The bill mode for the cluster node(s). In `VirtualMachine` type, only `Pay-per-use` is supported. in `BareMetal`, you can choose `Pay-per-use` or `Yearly/Monthly`. |
+	| Validity Period | This option only shows in `Yearly/Monthly` bill mode. It means how long you want to pay for the cluster node(s). |
+	| Auto Renew | This option only shows in `Yearly/Monthly` bill mode. It means that the cluster node(s) will renew the `Yearly/Monthly` payment automatically or not. |
+	| Data Volume Type | Data volume type for the cluster node(s). `SATA`, `SSD` or `SAS` for this option. |
+	| Data Volume Size | Data volume size for the cluster node(s) |
+	| Root Volume Type | Root volume type for the cluster node(s). `SATA`, `SSD` or `SAS` for this option. |
+	| Root Volume Size | Root volume size for the cluster node(s) |
+	| Node Flavor | The node flavor of the cluster node(s). The flavor list in Rancher UI is fetched from Huawei Cloud. It includes all the supported node flavors. |
+	| Node Count | The node count of the cluster |
+	| Node Operating System | The operating system for the cluster node(s). Only `EulerOS 2.2` and `CentOS 7.4` are supported right now. |
+	| SSH Key Name | The ssh key for the cluster node(s) |
+	| EIP | The public IP options for the cluster node(s). `Disabled` means that the cluster node(s) are not going to bind a public IP. `Create EIP` means that the cluster node(s) will bind one or many newly created Eips after provisioned and more options will be shown in the UI to set the to-create EIP parameters. And `Select Existed EIP` means that the node(s) will bind to the EIPs you select.  |
+	| EIP Count | This option will only be shown when `Create EIP` is selected. It means how many EIPs you want to create for the node(s). |
+	| EIP Type | This option will only be shown when `Create EIP` is selected. The options are `5_bgp` and `5_sbgp`. |
+	| EIP Share Type | This option will only be shown when `Create EIP` is selected. The only option is `PER`. |
+	| EIP Charge Mode | This option will only be shown when `Create EIP` is selected. The options are pay by `BandWidth` and pay by `Traffic`. |
+	| EIP Bandwidth Size | This option will only be shown when `Create EIP` is selected. The BandWidth of the EIPs. |
+	| Authentication Mode | It means enabling `RBAC` or also enabling `Authenticating Proxy`. If you select `Authenticating Proxy`, the certificate which is used for authenticating proxy will be also required. |
+	| Node Label | The labels for the cluster node(s). |
+
+8. Click **Create** to create the CCE cluster.
+
+{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
new file mode 100644
index 00000000000..ec106076c14
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
@@ -0,0 +1,291 @@
+---
+title: Creating an EKS Cluster
+shortTitle: Amazon EKS
+weight: 2110
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-eks/
+---
+
+Amazon EKS provides a managed control plane for your Kubernetes cluster. Amazon EKS runs the Kubernetes control plane instances across multiple Availability Zones to ensure high availability. Rancher provides an intuitive user interface for managing and deploying the Kubernetes clusters you run in Amazon EKS. With this guide, you will use Rancher to quickly and easily launch an Amazon EKS Kubernetes cluster in your AWS account. For more information on Amazon EKS, see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html).
+
+
+## Prerequisites in Amazon Web Services
+
+>**Note**
+>Deploying to Amazon AWS will incur charges. For more information, refer to the [EKS pricing page](https://aws.amazon.com/eks/pricing/).
+
+To set up a cluster on EKS, you will need to set up an Amazon VPC (Virtual Private Cloud). You will also need to make sure that the account you will be using to create the EKS cluster has the appropriate permissions. For details, refer to the official guide on [Amazon EKS Prerequisites](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html#eks-prereqs).
+
+### Amazon VPC
+
+You need to set up an Amazon VPC to launch the EKS cluster. The VPC enables you to launch AWS resources into a virtual network that you've defined. For more information, refer to the [Tutorial: Creating a VPC with Public and Private Subnets for Your Amazon EKS Cluster](https://docs.aws.amazon.com/eks/latest/userguide/create-public-private-vpc.html).
+
+### IAM Policies
+
+Rancher needs access to your AWS account in order to provision and administer your Kubernetes clusters in Amazon EKS. You'll need to create a user for Rancher in your AWS account and define what that user can access.
+
+1. Create a user with programmatic access by following the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
+
+2. Next, create an IAM policy that defines what this user has access to in your AWS account. The required permissions are [here.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/#appendix-minimum-eks-permissions) Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
+
+3. Finally, follow the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey) to create an access key and secret key for this user.
+
+> **Note:** It's important to regularly rotate your access and secret keys. See this [documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#rotating_access_keys_console) for more information.
+
+For more detailed information on IAM policies for EKS, refer to the official [documentation on Amazon EKS IAM Policies, Roles, and Permissions](https://docs.aws.amazon.com/eks/latest/userguide/IAM_policies.html).
+
+## Architecture
+
+The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two Kubernetes clusters: one created by RKE and another created by EKS.
+
+![Rancher architecture with EKS hosted cluster]({{<baseurl>}}/img/rancher/rancher-architecture.svg)
+
+## Create the EKS Cluster
+
+Use Rancher to set up and configure your Kubernetes cluster.
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+1. Choose **Amazon EKS**.
+
+1. Enter a **Cluster Name**.
+
+1. {{< step_create-cluster_member-roles >}}
+
+1. Configure **Account Access** for the EKS cluster. Complete each drop-down and field using the information obtained in [2. Create Access Key and Secret Key](#prerequisites-in-amazon-web-services).
+
+    | Setting    | Description                                                                                                          |
+    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
+    | Region     | From the drop-down choose the geographical region in which to build your cluster.                                    |
+    | Access Key | Enter the access key that you created in [2. Create Access Key and Secret Key](#2-create-access-key-and-secret-key). |
+    | Secret Key | Enter the secret key that you created in [2. Create Access Key and Secret Key](#2-create-access-key-and-secret-key). |
+
+1. Click **Next: Select Service Role**. Then choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
+
+    Service Role | Description
+    -------------|---------------------------
+    Standard: Rancher generated service role | If you choose this role, Rancher automatically adds a service role for use with the cluster.
+    Custom: Choose from your existing service roles | If you choose this role, Rancher lets you choose from service roles that you're already created within AWS. For more information on creating a custom service role in AWS, see the [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role).
+
+1. Click **Next: Select VPC and Subnet**.
+
+1. Choose an option for **Public IP for Worker Nodes**. Your selection for this option determines what options are available for **VPC & Subnet**.
+
+    Option | Description
+    -------|------------
+    Yes | When your cluster nodes are provisioned, they're assigned a both a private and public IP address.
+    No: Private IPs only | When your cluster nodes are provisioned, they're assigned only a private IP address.<br/><br/>If you choose this option, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane.
+
+1. Now choose a **VPC & Subnet**. For more information, refer to the AWS documentation for [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html). Follow one of the sets of instructions below based on your selection from the previous step.
+
+	- [What Is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
+	- [VPCs and Subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)
+
+    {{% accordion id="yes" label="Public IP for Worker Nodes—Yes" %}}
+If you choose to assign a public IP address to your cluster's worker nodes, you have the option of choosing between a VPC that's automatically generated by Rancher (i.e., **Standard: Rancher generated VPC and Subnet**), or a VPC that you're already created with AWS (i.e., **Custom: Choose from your existing VPC and Subnets**). Choose the option that best fits your use case.
+
+1. Choose a **VPC and Subnet** option.
+
+    Option | Description
+    -------|------------
+    Standard: Rancher generated VPC and Subnet | While provisioning your cluster, Rancher generates a new VPC and Subnet.
+    Custom: Choose from your exiting VPC and Subnets | While provisioning your cluster, Rancher configures your nodes to use a VPC and Subnet that you've already [created in AWS](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html). If you choose this option, complete the remaining steps below.
+
+1.  If you're using **Custom: Choose from your existing VPC and Subnets**:
+
+    (If you're using **Standard**, skip to [step 11](#select-instance-options))
+
+	1. Make sure **Custom: Choose from your existing VPC and Subnets** is selected.
+
+	1. From the drop-down that displays, choose a VPC.
+
+	1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
+
+    1. Click **Next: Select Security Group**.
+    {{% /accordion %}}
+    {{% accordion id="no" label="Public IP for Worker Nodes—No: Private IPs only" %}}
+If you chose this option, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane. Follow the steps below.
+
+>**Tip:** When using only private IP addresses, you can provide your nodes internet access by creating a VPC constructed with two subnets, a private set and a public set.  The private set should have its route tables configured to point toward a NAT in the public set.  For more information on routing traffic from private subnets, please see the [official AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html).
+
+    1. From the drop-down that displays, choose a VPC.
+
+	1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
+
+    1. Click **Next: Select Security Group**.
+    {{% /accordion %}}
+
+1. <a id="security-group"></a>Choose a **Security Group**. See the documentation below on how to create one.
+
+    Amazon Documentation:
+    - [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html)
+    - [Security Groups for Your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
+    - [Create a Security Group](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html#getting-started-create-security-group)
+
+1. <a id="select-instance-options"></a>Click **Select Instance Options**, and then edit the node options available. Instance type and size of your worker nodes affects how many IP addresses each worker node will have available. See this [documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI) for more information.
+
+    Option | Description
+    -------|------------
+    Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning.
+    Custom AMI Override | If you want to use a custom [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html#creating-an-ami) (AMI), specify it here. By default, Rancher will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the EKS version that you chose.
+    Desired ASG Size | The number of instances that your cluster will provision.
+    User Data | Custom commands can to be passed to perform automated configuration tasks **WARNING: Modifying this may cause your nodes to be unable to join the cluster.** _Note: Available as of v2.2.0_
+
+1. Click **Create**.
+
+{{< result_create-cluster >}}
+
+## Troubleshooting
+
+For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html).
+
+## AWS Service Events
+
+To find information on any AWS Service events, please see [this page](https://status.aws.amazon.com/).
+
+## Security and Compliance
+
+For more information on security and compliance with your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/shared-responsibilty.html).
+
+## Tutorial
+
+This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/) on the AWS Open Source Blog will walk you through how to set up an EKS cluster with Rancher, deploy a publicly accessible app to test the cluster, and deploy a sample project to track real-time geospatial data using a combination of other open-source software such as Grafana and InfluxDB.
+
+## Appendix - Minimum EKS Permissions
+
+Documented here is a minimum set of permissions necessary to use all functionality of the EKS driver in Rancher.
+
+Resource targeting uses `*` as the ARN of many of the resources created cannot be known prior to creating the EKS cluster in Rancher. Some permissions (for example `ec2:CreateVpc`) are only used in situations where Rancher handles the creation of certain resources.
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "EC2Permisssions",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:AuthorizeSecurityGroupIngress",
+                "ec2:DeleteSubnet",
+                "ec2:CreateKeyPair",
+                "ec2:AttachInternetGateway",
+                "ec2:ReplaceRoute",
+                "ec2:DeleteRouteTable",
+                "ec2:AssociateRouteTable",
+                "ec2:DescribeInternetGateways",
+                "ec2:CreateRoute",
+                "ec2:CreateInternetGateway",
+                "ec2:RevokeSecurityGroupEgress",
+                "ec2:DescribeAccountAttributes",
+                "ec2:DeleteInternetGateway",
+                "ec2:DescribeKeyPairs",
+                "ec2:CreateTags",
+                "ec2:CreateRouteTable",
+                "ec2:DescribeRouteTables",
+                "ec2:DetachInternetGateway",
+                "ec2:DisassociateRouteTable",
+                "ec2:RevokeSecurityGroupIngress",
+                "ec2:DeleteVpc",
+                "ec2:CreateSubnet",
+                "ec2:DescribeSubnets",
+                "ec2:DeleteKeyPair",
+                "ec2:DeleteTags",
+                "ec2:CreateVpc",
+                "ec2:DescribeAvailabilityZones",
+                "ec2:CreateSecurityGroup",
+                "ec2:ModifyVpcAttribute",
+                "ec2:AuthorizeSecurityGroupEgress",
+                "ec2:DescribeTags",
+                "ec2:DeleteRoute",
+                "ec2:DescribeSecurityGroups",
+                "ec2:DescribeImages",
+                "ec2:DescribeVpcs",
+                "ec2:DeleteSecurityGroup"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "EKSPermissions",
+            "Effect": "Allow",
+            "Action": [
+                "eks:DeleteFargateProfile",
+                "eks:DescribeFargateProfile",
+                "eks:ListTagsForResource",
+                "eks:UpdateClusterConfig",
+                "eks:DescribeNodegroup",
+                "eks:ListNodegroups",
+                "eks:DeleteCluster",
+                "eks:CreateFargateProfile",
+                "eks:DeleteNodegroup",
+                "eks:UpdateNodegroupConfig",
+                "eks:DescribeCluster",
+                "eks:ListClusters",
+                "eks:UpdateClusterVersion",
+                "eks:UpdateNodegroupVersion",
+                "eks:ListUpdates",
+                "eks:CreateCluster",
+                "eks:UntagResource",
+                "eks:CreateNodegroup",
+                "eks:ListFargateProfiles",
+                "eks:DescribeUpdate",
+                "eks:TagResource"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "IAMPermissions",
+            "Effect": "Allow",
+            "Action": [
+                "iam:ListRoleTags",
+                "iam:RemoveRoleFromInstanceProfile",
+                "iam:CreateRole",
+                "iam:AttachRolePolicy",
+                "iam:AddRoleToInstanceProfile",
+                "iam:DetachRolePolicy",
+                "iam:GetRole",
+                "iam:DeleteRole",
+                "iam:CreateInstanceProfile",
+                "iam:ListInstanceProfilesForRole",
+                "iam:PassRole",
+                "iam:GetInstanceProfile",
+                "iam:ListRoles",
+                "iam:ListInstanceProfiles",
+                "iam:DeleteInstanceProfile"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "CloudFormationPermisssions",
+            "Effect": "Allow",
+            "Action": [
+                "cloudformation:DescribeStackResource",
+                "cloudformation:ListStackResources",
+                "cloudformation:DescribeStackResources",
+                "cloudformation:DescribeStacks",
+                "cloudformation:ListStacks",
+                "cloudformation:CreateStack",
+                "cloudformation:DeleteStack"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "AutoScalingPermissions",
+            "Effect": "Allow",
+            "Action": [
+                "autoscaling:DescribeAutoScalingGroups",
+                "autoscaling:UpdateAutoScalingGroup",
+                "autoscaling:TerminateInstanceInAutoScalingGroup",
+                "autoscaling:CreateOrUpdateTags",
+                "autoscaling:DeleteAutoScalingGroup",
+                "autoscaling:CreateAutoScalingGroup",
+                "autoscaling:DescribeAutoScalingInstances",
+                "autoscaling:DescribeLaunchConfigurations",
+                "autoscaling:DescribeScalingActivities",
+                "autoscaling:CreateLaunchConfiguration",
+                "autoscaling:DeleteLaunchConfiguration"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+```
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
new file mode 100644
index 00000000000..f08a196861b
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
@@ -0,0 +1,43 @@
+---
+title: Creating a GKE Cluster
+shortTitle: Google Kubernetes Engine
+weight: 2105
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-gke/
+---
+
+## Prerequisites in Google Kubernetes Engine
+
+>**Note**
+>Deploying to GKE will incur charges.
+
+Create a service account using [Google Kubernetes Engine](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts). GKE uses this account to operate your cluster. Creating this account also generates a private key used for authentication.
+
+The service account requires the following roles:
+
+- **Compute Viewer:** `roles/compute.viewer`
+- **Project Viewer:** `roles/viewer`
+- **Kubernetes Engine Admin:** `roles/container.admin` 
+- **Service Account User:** `roles/iam.serviceAccountUser`
+
+[Google Documentation: Creating and Enabling Service Accounts](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances)
+
+## Create the GKE Cluster
+
+Use {{< product >}} to set up and configure your Kubernetes cluster.
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+2. Choose **Google Kubernetes Engine**.
+
+3. Enter a **Cluster Name**.
+
+4. {{< step_create-cluster_member-roles >}}
+
+5. Either paste your service account private key in the **Service Account** text box or **Read from a file**. Then click **Next: Configure Nodes**.
+
+	>**Note:** After submitting your private key, you may have to enable the Google Kubernetes Engine API. If prompted, browse to the URL displayed in the Rancher UI to enable the API.
+
+6. Select your **Cluster Options**, customize your **Nodes** and customize the **Security** for the GKE cluster. Review your options to confirm they're correct. Then click **Create**.
+
+{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
new file mode 100644
index 00000000000..dc6c66b9efb
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
@@ -0,0 +1,77 @@
+---
+title: Creating a Tencent TKE Cluster
+shortTitle: Tencent Kubernetes Engine
+weight: 2125
+---
+
+_Available as of v2.2.0_
+
+You can use Rancher to create a cluster hosted in Tencent Kubernetes Engine (TKE). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for TKE, but by default, this cluster driver is `inactive`. In order to launch TKE clusters, you will need to [enable the TKE cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning TKE clusters.
+
+## Prerequisites in Tencent
+
+>**Note**
+>Deploying to TKE will incur charges.
+
+1. Make sure that the account you will be using to create the TKE cluster has the appropriate permissions by referring to the  [Cloud Access Management](https://intl.cloud.tencent.com/document/product/598/10600) documentation for details.
+
+2. Create a [Cloud API Secret ID and Secret Key](https://console.cloud.tencent.com/capi).
+
+3. Create a [Private Network and Subnet](https://intl.cloud.tencent.com/document/product/215/4927) in the region that you want to deploy your Kubernetes cluster.
+
+4. Create a [SSH key pair](https://intl.cloud.tencent.com/document/product/213/6092). This key is used to access the nodes in the Kubernetes cluster.
+
+## Create a TKE Cluster
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+2. Choose **Tencent TKE**.
+
+3. Enter a **Cluster Name**.
+
+4. {{< step_create-cluster_member-roles >}}
+
+5. Configure **Account Access** for the TKE cluster. Complete each drop-down and field using the information obtained in [Prerequisites](#prerequisites).
+
+    | Option    | Description                                                                                                          |
+    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
+    | Region     | From the drop-down chooses the geographical region in which to build your cluster.                                    |
+    | Secret ID  | Enter the Secret ID that you obtained from the Tencent Cloud Console. |
+    | Secret Key | Enter the Secret key that you obtained from Tencent Cloud Console. |
+
+6. Click `Next: Configure Cluster` to set your TKE cluster configurations.
+
+    | Option | Description                                                                                                          |
+    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
+    | Kubernetes Version | The TKE only supports Kubernetes version 1.10.5 now.  |
+    | Node Count  | Enter the amount of worker node you want to purchase for your Kubernetes cluster, up to 100. |
+    | VPC | Select the VPC name that you have created in the Tencent Cloud Console. |
+    | Container Network CIDR | Enter the CIDR range of your Kubernetes cluster, you may check the available range of the CIDR in the VPC service of the Tencent Cloud Console. Default to 172.16.0.0/16. |
+
+    **Note:** If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0)
+
+7. Click `Next: Select Instance Type` to choose the instance type that will use for your TKE cluster.
+
+    | Option | Description                                                                                                          |
+    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
+    | Availability Zone | Choose the availability zone of the VPC region.  |
+    | Subnet  | Select the Subnet that you have created within the VPC, and add a new one if you don't have it in the chosen availability zone. |
+    | Instance Type | From the drop-down chooses the VM instance type that you want to use for the TKE cluster, default to S2.MEDIUM4 (CPU 2 Memory 4 GiB). |
+
+8. Click `Next: Configure Instance` to configure the VM instance that will use for your TKE cluster.
+
+    Option | Description
+    -------|------------
+    Operating System | The name of the operating system, currently supports Centos7.2x86_64 or ubuntu16.04.1 LTSx86_64
+    Security Group | Security group ID, default does not bind any security groups.
+    Root Disk Type | System disk type. System disk type restrictions are detailed in the [CVM instance configuration](https://cloud.tencent.com/document/product/213/11518).
+    Root Disk Size | System disk size. Linux system adjustment range is 20 - 50G, step size is 1.
+    Data Disk Type | Data disk type, default value to the SSD cloud drive
+    Data Disk Size | Data disk size (GB), the step size is 10
+    Band Width Type | Type of bandwidth, PayByTraffic or PayByHour
+    Band Width | Public network bandwidth (Mbps)
+    Key Pair | Key id, after associating the key can be used to logging to the VM node
+
+9. Click **Create**.
+
+{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/_index.md
new file mode 100644
index 00000000000..0ef2fcec085
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/_index.md
@@ -0,0 +1,179 @@
+---
+title: Importing Existing Clusters into Rancher
+description: Learn how you can create a cluster in Rancher by importing an existing Kubernetes cluster. Then, you can manage it using Rancher
+metaTitle: 'Kubernetes Cluster Management'
+metaDescription: 'Learn how you can import an existing Kubernetes cluster and then manage it using Rancher'
+weight: 5
+---
+
+When managing an imported cluster, Rancher connects to a Kubernetes cluster that has already been set up. Therefore, Rancher does not provision Kubernetes, but only sets up the Rancher agents to communicate with the cluster.
+
+Rancher features, including management of cluster, role-based access control, policy, and workloads, are available for imported clusters. Note that Rancher does not automate the provisioning or scaling of imported clusters.
+
+For all imported Kubernetes clusters except for K3s clusters, the configuration of an imported cluster still has to be edited outside of Rancher. Some examples of editing the cluster include adding and removing nodes, upgrading the Kubernetes version, and changing Kubernetes component parameters.
+
+Rancher v2.4 added the capability to import a K3s cluster into Rancher, as well as the ability to upgrade Kubernetes by editing the cluster in the Rancher UI.
+
+- [Features](#features)
+- [Prerequisites](#prerequisites)
+- [Importing a cluster](#importing-a-cluster)
+- [Imported K3s clusters](#imported-k3s-clusters)
+  - [Additional features for imported K3s clusters](#additional-features-for-imported-k3s-clusters)
+  - [Configuring a K3s Cluster to Enable Importation to Rancher](#configuring-a-k3s-cluster-to-enable-importation-to-rancher)
+  - [Debug Logging and Troubleshooting for Imported K3s clusters](#debug-logging-and-troubleshooting-for-imported-k3s-clusters)
+- [Annotating imported clusters](#annotating-imported-clusters)
+
+# Features
+
+After importing a cluster, the cluster owner can:
+
+- [Manage cluster access]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/) through role-based access control
+- Enable [monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and [logging]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/)
+- Enable [Istio]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
+- Use [pipelines]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines/)
+- Configure [alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) and [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/)
+- Manage [projects]({{<baseurl>}}/rancher/v2.x/en/project-admin/) and [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)
+
+After importing a K3s cluster, the cluster owner can also [upgrade Kubernetes from the Rancher UI.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes/)
+
+# Prerequisites
+
+If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to import the cluster into Rancher.
+
+In order to apply the privilege, you need to run:
+
+```plain
+kubectl create clusterrolebinding cluster-admin-binding \
+  --clusterrole cluster-admin \
+  --user [USER_ACCOUNT]
+```
+
+before running the `kubectl` command to import the cluster.
+
+By default, GKE users are not given this privilege, so you will need to run the command before importing GKE clusters. To learn more about role-based access control for GKE, please click [here](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).
+
+> If you are importing a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-importation-to-rancher)
+
+# Importing a Cluster
+
+1. From the **Clusters** page, click **Add Cluster**.
+2. Choose **Import**.
+3. Enter a **Cluster Name**.
+4. {{< step_create-cluster_member-roles >}}
+5. Click **Create**.
+6. The prerequisite for `cluster-admin` privileges is shown (see **Prerequisites** above), including an example command to fulfil the prerequisite.
+7. Copy the `kubectl` command to your clipboard and run it on a node where kubeconfig is configured to point to the cluster you want to import. If you are unsure it is configured correctly, run `kubectl get nodes` to verify before running the command shown in {{< product >}}.
+8. If you are using self signed certificates, you will receive the message `certificate signed by unknown authority`. To work around this validation, copy the command starting with `curl` displayed in {{< product >}} to your clipboard. Then run the command on a node where kubeconfig is configured to point to the cluster you want to import.
+9. When you finish running the command(s) on your node, click **Done**.
+   {{< result_import-cluster >}}
+
+> **Note:**
+> You can not re-import a cluster that is currently active in a Rancher setup.
+
+# Imported K3s Clusters
+
+You can now import a K3s Kubernetes cluster into Rancher. [K3s]({{<baseurl>}}/k3s/latest/en/) is lightweight, fully compliant Kubernetes distribution. You can also upgrade Kubernetes by editing the K3s cluster in the Rancher UI.
+
+### Additional Features for Imported K3s Clusters
+
+_Available as of v2.4.0_
+
+When a K3s cluster is imported, Rancher will recognize it as K3s, and the Rancher UI will expose the following features in addition to the functionality for other imported clusters:
+
+- The ability to upgrade the K3s version
+- The ability to configure the maximum number of nodes that will be upgraded concurrently
+- The ability to see a read-only version of the K3s cluster's configuration arguments and environment variables used to launch each node in the cluster.
+
+### Configuring K3s Cluster Upgrades
+
+> It is a Kubernetes best practice to back up the cluster before upgrading. When upgrading a high-availability K3s cluster with an external database, back up the database in whichever way is recommended by the relational database provider.
+
+The **concurrency** is the maximum number of nodes that are permitted to be unavailable during an upgrade. If number of unavailable nodes is larger than the **concurrency,** the upgrade will fail. If an upgrade fails, you may need to repair or remove failed nodes before the upgrade can succeed.
+
+- **Controlplane concurrency:** The maximum number of server nodes to upgrade at a single time; also the maximum unavailable server nodes
+- **Worker concurrency:** The maximum number worker nodes to upgrade at the same time; also the maximum unavailable worker nodes
+
+In the K3s documentation, controlplane nodes are called server nodes. These nodes run the Kubernetes master, which maintains the desired state of the cluster. In K3s, these controlplane nodes have the capability to have workloads scheduled to them by default.
+
+Also in the K3s documentation, nodes with the worker role are called agent nodes. Any workloads or pods that are deployed in the cluster can be scheduled to these nodes by default.
+
+### Configuring a K3s Cluster to Enable Importation to Rancher
+
+The K3s server needs to be configured to allow writing to the kubeconfig file.
+
+This can be accomplished by passing `--write-kubeconfig-mode 644` as a flag during installation:
+
+```
+$ curl -sfL https://get.k3s.io | sh -s - --write-kubeconfig-mode 644
+```
+
+The option can also be specified using the environment variable `K3S_KUBECONFIG_MODE`:
+
+```
+$ curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" sh -s -
+```
+
+### Debug Logging and Troubleshooting for Imported K3s Clusters
+
+Nodes are upgraded by the system upgrade controller running in the downstream cluster. Based on the cluster configuration, Rancher deploys two [plans](https://github.com/rancher/system-upgrade-controller#example-upgrade-plan) to upgrade K3s nodes: one for controlplane nodes and one for workers. The system upgrade controller follows the plans and upgrades the nodes. 
+
+To enable debug logging on the system upgrade controller deployment, edit the [configmap](https://github.com/rancher/system-upgrade-controller/blob/50a4c8975543d75f1d76a8290001d87dc298bdb4/manifests/system-upgrade-controller.yaml#L32) to set the debug environment variable to true. Then restart the `system-upgrade-controller` pod.
+
+Logs created by the `system-upgrade-controller` can be viewed by running this command:
+
+```
+kubectl logs -n cattle-system system-upgrade-controller
+```
+
+The current status of the plans can be viewed with this command:
+
+```
+kubectl get plans -A -o yaml
+```
+
+If the cluster becomes stuck in upgrading, restart the `system-upgrade-controller`.
+
+To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed.
+
+### Annotating Imported Clusters
+
+For all types of imported Kubernetes clusters except for K3s Kubernetes clusters, Rancher doesn't have any information about how the cluster is provisioned or configured.
+
+Therefore, when Rancher imports a cluster, it assumes that several capabilities are disabled by default. Rancher assumes this in order to avoid exposing UI options to the user even when the capabilities are not enabled in the imported cluster.
+
+However, if the cluster has a certain capability, such as the ability to use a pod security policy, a user of that cluster might still want to select pod security policies for the cluster in the Rancher UI. In order to do that, the user will need to manually indicate to Rancher that pod security policies are enabled for the cluster.
+
+By annotating an imported cluster, it is possible to indicate to Rancher that a cluster was given a pod security policy, or another capability, outside of Rancher.
+
+This example annotation indicates that a pod security policy is enabled:
+
+```json
+"capabilities.cattle.io/pspEnabled": "true"
+```
+
+The following annotation indicates Ingress capabilities. Note that that the values of non-primitive objects need to be JSON encoded, with quotations escaped.
+
+```json
+"capabilities.cattle.io/ingressCapabilities": "[{"customDefaultBackend":true,"ingressProvider":"asdf"}]"
+```
+
+These capabilities can be annotated for the cluster:
+
+- `ingressCapabilities`
+- `loadBalancerCapabilities`
+- `nodePoolScalingSupported`
+- `nodePortRange`
+- `pspEnabled`
+- `taintSupport`
+
+All the capabilities and their type definitions can be viewed in the Rancher API view, at `[Rancher Server URL]/v3/schemas/capabilities`.
+
+To annotate an imported cluster,
+
+1. Go to the cluster view in Rancher and select **&#8942; > Edit.**
+1. Expand the **Labels & Annotations** section.
+1. Click **Add Annotation.**
+1. Add an annotation to the cluster with the format `capabilities/<capability>: <value>` where `value` is the cluster capability that will be overridden by the annotation. In this scenario, Rancher is not aware of any capabilities of the cluster until you add the annotation.
+1. Click **Save.**
+
+**Result:** The annotation does not give the capabilities to the cluster, but it does indicate to Rancher that the cluster has those capabilities.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/eks/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/eks/_index.md
new file mode 100644
index 00000000000..f587a973aad
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/eks/_index.md
@@ -0,0 +1,4 @@
+---
+title: Importing EKS Clusters
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/k3s/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
new file mode 100644
index 00000000000..de4669c4407
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
@@ -0,0 +1,4 @@
+---
+title: Importing K3s Kubernetes Clusters
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
new file mode 100644
index 00000000000..73dfb08b048
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
@@ -0,0 +1,4 @@
+---
+title: Importing Rancher Kubernetes Clusters
+weight: 3
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/_index.md
new file mode 100644
index 00000000000..a6c2c6e516f
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/_index.md
@@ -0,0 +1,50 @@
+---
+title: Checklist for Production-Ready Clusters
+weight: 1
+---
+
+In this section, we recommend best practices for creating the production-ready Kubernetes clusters that will run your apps and services.
+
+For a list of requirements for your cluster, including the requirements for OS/Docker, hardware, and networking, refer to the section on [node requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements)
+
+This is a shortlist of best practices that we strongly recommend for all production clusters.
+
+For a full list of all the best practices that we recommend, refer to the [best practices section.]({{<baseurl>}}/rancher/v2.x/en/best-practices)
+
+### Node Requirements
+
+* Make sure your nodes fulfill all of the [node requirements,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/) including the port requirements.
+
+### Back up etcd
+
+* Enable etcd snapshots. Verify that snapshots are being created, and run a disaster recovery scenario to verify the snapshots are valid. etcd is the location where the state of your cluster is stored, and losing etcd data means losing your cluster. Make sure you configure [etcd Recurring Snapshots]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/#option-a-recurring-snapshots) for your cluster(s), and make sure the snapshots are stored externally (off the node) as well.
+
+### Cluster Architecture
+
+* Nodes should have one of the following role configurations:
+  * `etcd`
+  * `controlplane`
+  * `etcd` and `controlplane`
+  * `worker` (the `worker` role should not be used or added on nodes with the `etcd` or `controlplane` role)
+* Have at least three nodes with the role `etcd` to survive losing one node. Increase this count for higher node fault toleration, and spread them across (availability) zones to provide even better fault tolerance.
+* Assign two or more nodes the `controlplane` role for master component high availability.
+* Assign two or more nodes the `worker` role for workload rescheduling upon node failure.
+
+For more information on what each role is used for, refer to the [section on roles for nodes in Kubernetes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/nodes-and-roles)
+
+For more information about the 
+number of nodes for each Kubernetes role, refer to the section on [recommended architecture.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/)
+
+### Logging and Monitoring
+
+* Configure alerts/notifiers for Kubernetes components (System Service).
+* Configure logging for cluster analysis and post-mortems.
+
+### Reliability
+
+* Perform load tests on your cluster to verify that its hardware can support your workloads.
+
+### Networking
+
+* Minimize network latency. Rancher recommends minimizing latency between the etcd nodes. The default setting for `heartbeat-interval` is `500`, and the default setting for `election-timeout` is `5000`. These [settings for etcd tuning](https://coreos.com/etcd/docs/latest/tuning.html) allow etcd to run in most networks (except really high latency networks).
+* Cluster nodes should be located within a single region. Most cloud providers provide multiple availability zones within a region, which can be used to create higher availability for your cluster. Using multiple availability zones is fine for nodes with any role. If you are using [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) resources, consult the documentation for any restrictions (i.e. zone storage restrictions).
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
new file mode 100644
index 00000000000..3722a97e451
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
@@ -0,0 +1,43 @@
+---
+title: Roles for Nodes in Kubernetes
+weight: 1
+---
+
+This section describes the roles for etcd nodes, controlplane nodes, and worker nodes in Kubernetes, and how the roles work together in a cluster.
+
+This diagram is applicable to Kubernetes clusters [launched with Rancher using RKE.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
+
+![Cluster diagram]({{<baseurl>}}/img/rancher/clusterdiagram.svg)<br/>
+<sup>Lines show the traffic flow between components. Colors are used purely for visual aid</sup>
+
+# etcd
+
+Nodes with the `etcd` role run etcd, which is a consistent and highly available key value store used as Kubernetes’ backing store for all cluster data. etcd replicates the data to each node.
+
+>**Note:** Nodes with the `etcd` role are shown as `Unschedulable` in the UI, meaning no pods will be scheduled to these nodes by default.
+
+# controlplane
+
+Nodes with the `controlplane` role run the Kubernetes master components (excluding `etcd`, as it's a separate role). See [Kubernetes: Master Components](https://kubernetes.io/docs/concepts/overview/components/#master-components) for a detailed list of components.
+
+>**Note:** Nodes with the `controlplane` role are shown as `Unschedulable` in the UI, meaning no pods will be scheduled to these nodes by default.
+
+### kube-apiserver
+
+The Kubernetes API server (`kube-apiserver`) scales horizontally. Each node with the role `controlplane` will be added to the NGINX proxy on the nodes with components that need to access the Kubernetes API server. This means that if a node becomes unreachable, the local NGINX proxy on the node will forward the request to another Kubernetes API server in the list.
+
+### kube-controller-manager
+
+The Kubernetes controller manager uses leader election using an endpoint in Kubernetes. One instance of the `kube-controller-manager` will create an entry in the Kubernetes endpoints and updates that entry in a configured interval. Other instances will see an active leader and wait for that entry to expire (for example, when a node is unresponsive).
+
+### kube-scheduler
+
+The Kubernetes scheduler uses leader election using an endpoint in Kubernetes. One instance of the `kube-scheduler` will create an entry in the Kubernetes endpoints and updates that entry in a configured interval. Other instances will see an active leader and wait for that entry to expire (for example, when a node is unresponsive).
+
+# worker
+
+Nodes with the `worker` role run the Kubernetes node components. See [Kubernetes: Node Components](https://kubernetes.io/docs/concepts/overview/components/#node-components) for a detailed list of components.
+
+# References
+
+* [Kubernetes: Node Components](https://kubernetes.io/docs/concepts/overview/components/#node-components)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
new file mode 100644
index 00000000000..8dd5a53dfde
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
@@ -0,0 +1,74 @@
+---
+title: Recommended Cluster Architecture
+weight: 1
+---
+
+There are three roles that can be assigned to nodes: `etcd`, `controlplane` and `worker`. 
+
+# Separating Worker Nodes from Nodes with Other Roles
+
+When designing your cluster(s), you have two options:
+
+* Use dedicated nodes for each role. This ensures resource availability for the components needed for the specified role. It also strictly isolates network traffic between each of the roles according to the [port requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/).
+* Assign the `etcd` and `controlplane` roles to the same nodes. These nodes must meet the hardware requirements for both roles.
+
+In either case, the `worker` role should not be used or added to nodes with the `etcd` or `controlplane` role.
+
+Therefore, each node should have one of the following role configurations:
+
+  * `etcd`
+  * `controlplane`
+  * Both `etcd` and `controlplane`
+  * `worker`
+
+# Recommended Number of Nodes with Each Role
+
+The cluster should have:
+
+- At least three nodes with the role `etcd` to survive losing one node. Increase this count for higher node fault toleration, and spread them across (availability) zones to provide even better fault tolerance.
+- At least two nodes with the role `controlplane` for master component high availability.
+- At least two nodes with the role `worker` for workload rescheduling upon node failure.
+
+For more information on what each role is used for, refer to the [section on roles for nodes in Kubernetes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/nodes-and-roles)
+
+
+### Number of Controlplane Nodes
+
+Adding more than one node with the `controlplane` role makes every master component highly available.
+
+### Number of etcd Nodes
+
+The number of nodes that you can lose at once while maintaining cluster availability is determined by the number of nodes assigned the `etcd` role. For a cluster with n members, the minimum is (n/2)+1. Therefore, we recommend creating an  `etcd` node in 3 different availability zones within a region to survive the loss of one availability zone. If you use only two zones, you can only survive the loss of the zone where you don't lose the majority of nodes.
+
+| Nodes with `etcd` role | Majority   | Failure Tolerance |
+|--------------|------------|-------------------|
+| 1 | 1 | 0 |
+| 2 | 2 | 0 |
+| 3 | 2 | **1** |
+| 4 | 3 | 1 |
+| 5 | 3 | **2** |
+| 6 | 4 | 2 |
+| 7 | 4 | **3** |
+| 8 | 5 | 3 |
+| 9 | 5 | **4** |
+
+References:
+
+* [Official etcd documentation on optimal etcd cluster size](https://etcd.io/docs/v3.4.0/faq/#what-is-failure-tolerance)
+* [Official Kubernetes documentation on operating etcd clusters for Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/)
+
+### Number of Worker Nodes
+
+Adding more than one node with the `worker` role will make sure your workloads can be rescheduled if a node fails.
+
+### Why Production Requirements are Different for the Rancher Cluster and the Clusters Running Your Applications
+
+You may have noticed that our [Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/) instructions do not meet our definition of a production-ready cluster, as there are no dedicated nodes for the `worker` role. However, for your Rancher installation, this three node cluster is valid, because:
+
+* It allows one `etcd` node failure.
+* It maintains multiple instances of the master components by having multiple `controlplane` nodes.
+* No other workloads than Rancher itself should be created on this cluster.
+
+# References
+
+* [Kubernetes: Master Components](https://kubernetes.io/docs/concepts/overview/components/#master-components)
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/_index.md
new file mode 100644
index 00000000000..5f581d02208
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/_index.md
@@ -0,0 +1,34 @@
+---
+title: Launching Kubernetes with Rancher
+weight: 3
+---
+
+You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, it uses [Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/) (RKE), which is Rancher's own lightweight Kubernetes installer. It can launch Kubernetes on any computers, including:
+
+- Bare-metal servers
+- On-premise virtual machines
+- Virtual machines hosted by an infrastructure provider
+
+Rancher can install Kubernetes on existing nodes, or it can dynamically provision nodes in an infrastructure provider and install Kubernetes on them.
+
+RKE clusters include clusters that Rancher launched on Windows nodes or other existing custom nodes, as well as clusters that Rancher launched with new nodes on Azure, Digital Ocean, EC2, or vSphere.
+
+### Requirements
+
+If you use RKE to set up a cluster, your nodes must meet the [requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements) for nodes in downstream user clusters.
+
+### Launching Kubernetes on New Nodes in an Infrastructure Provider
+
+Using Rancher, you can create pools of nodes based on a [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates). This node template defines the parameters you want to use to launch nodes in your cloud providers.
+
+One benefit of installing Kubernetes on node pools hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically create another node to join the cluster to ensure that the count of the node pool is as expected.
+
+For more information, refer to the section on [launching Kubernetes on new nodes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/)
+
+### Launching Kubernetes on Existing Custom Nodes
+
+In this scenario, you want to install Kubernetes on bare-metal servers, on-premise virtual machines, or virtual machines that already exist in a cloud provider. With this option, you will run a Rancher agent Docker container on the machine.
+
+If you want to reuse a node from a previous custom cluster, [clean the node]({{<baseurl>}}/rancher/v2.x/en/admin-settings/removing-rancher/rancher-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail.
+
+For more information, refer to the section on [custom nodes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/)
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
new file mode 100644
index 00000000000..3c02886fbc6
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
@@ -0,0 +1,394 @@
+---
+title: Cluster Configuration Reference
+weight: 5
+---
+
+As you configure a new cluster that's [provisioned using RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), you can choose custom Kubernetes options.
+
+You can configure Kubernetes options one of two ways:
+
+- [Rancher UI](#rancher-ui): Use the Rancher UI to select options that are commonly customized when setting up a Kubernetes cluster.
+- [Cluster Config File](#cluster-config-file): Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the options available in an RKE installation, except for system_images configuration, by specifying them in YAML.
+
+In Rancher v2.0.0-v2.2.x, the config file is identical to the  [cluster config file for the Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/config-options/), which is the tool Rancher uses to provision clusters. In Rancher v2.3.0, the RKE information is still included in the config file, but it is separated from other options, so that the RKE cluster config options are nested under the `rancher_kubernetes_engine_config` directive. For more information, see the section about the [cluster config file.](#cluster-config-file)
+
+This section is a cluster configuration reference, covering the following topics:
+
+- [Rancher UI Options](#rancher-ui-options)
+  - [Kubernetes version](#kubernetes-version)
+  - [Network provider](#network-provider)
+  - [Kubernetes cloud providers](#kubernetes-cloud-providers)
+  - [Private registries](#private-registries)
+  - [Authorized cluster endpoint](#authorized-cluster-endpoint)
+- [Advanced Options](#advanced-options)
+  - [NGINX Ingress](#nginx-ingress)
+  - [Node port range](#node-port-range)
+  - [Metrics server monitoring](#metrics-server-monitoring)
+  - [Pod security policy support](#pod-security-policy-support)
+  - [Docker version on nodes](#docker-version-on-nodes)
+  - [Docker root directory](#docker-root-directory)
+  - [Recurring etcd snapshots](#recurring-etcd-snapshots)
+- [Cluster config file](#cluster-config-file)
+  - [Config file structure in Rancher v2.3.0+](#config-file-structure-in-rancher-v2-3-0+)
+  - [Config file structure in Rancher v2.0.0-v2.2.x](#config-file-structure-in-rancher-v2-0-0-v2-2-x)
+  - [Default DNS provider](#default-dns-provider)
+- [Rancher specific parameters](#rancher-specific-parameters)
+
+# Rancher UI Options
+
+When creating a cluster using one of the options described in [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), you can configure basic Kubernetes options using the **Cluster Options** section.
+
+### Kubernetes Version
+
+The version of Kubernetes installed on your cluster nodes. Rancher packages its own version of Kubernetes based on [hyperkube](https://github.com/rancher/hyperkube).
+
+### Network Provider
+
+The [Network Provider](https://kubernetes.io/docs/concepts/cluster-administration/networking/) that the cluster uses. For more details on the different networking providers, please view our [Networking FAQ]({{<baseurl>}}/rancher/v2.x/en/faq/networking/cni-providers/).
+
+>**Note:** After you launch the cluster, you cannot change your network provider. Therefore, choose which network provider you want to use carefully, as Kubernetes doesn't allow switching between network providers. Once a cluster is created with a network provider, changing network providers would require you  tear down the entire cluster and all its applications.
+
+Out of the box, Rancher is compatible with the following network providers:
+
+- [Canal](https://github.com/projectcalico/canal)
+- [Flannel](https://github.com/coreos/flannel#flannel)
+- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
+- [Weave](https://github.com/weaveworks/weave) (Available as of v2.2.0)
+
+**Notes on Canal:**
+  
+In v2.0.0 - v2.0.4 and v2.0.6, this was the default option for these clusters was Canal with network isolation. With the network isolation automatically enabled, it prevented any pod communication between [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).
+
+As of v2.0.7, if you use Canal, you also have the option of using **Project Network Isolation**, which will enable or disable communication between pods in different [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).
+
+>**Attention Rancher v2.0.0 - v2.0.6 Users**
+>
+>- In previous Rancher releases, Canal isolates project network communications with no option to disable it. If you are using any of these Rancher releases, be aware that using Canal prevents all communication between pods in different projects.
+>- If you have clusters using Canal and are upgrading to v2.0.7, those clusters enable Project Network Isolation by default. If you want to disable Project Network Isolation, edit the cluster and disable the option.
+
+**Notes on Flannel:**
+
+In v2.0.5, this was the default option, which did not prevent any network isolation between projects.
+
+**Notes on Weave:**
+
+When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file) and the [Weave Network Plug-in Options]({{<baseurl>}}/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options).
+
+### Kubernetes Cloud Providers
+
+You can configure a [Kubernetes cloud provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers). If you want to use [volumes and storage]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/) in Kubernetes, typically you must select the specific cloud provider in order to use it. For example, if you want to use Amazon EBS, you would need to select the `aws` cloud provider.
+
+>**Note:** If the cloud provider you want to use is not listed as an option, you will need to use the [config file option](#config-file) to configure the cloud provider. Please reference the [RKE cloud provider documentation]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/) on how to configure the cloud provider.
+
+If you want to see all the configuration options for a cluster, please click **Show advanced options** on the bottom right. The advanced options are described below:
+
+### Private registries
+
+_Available as of v2.2.0_
+
+The cluster-level private registry configuration is only used for provisioning clusters.
+
+There are two main ways to set up private registries in Rancher: by setting up the [global default registry]({{<baseurl>}}/rancher/v2.x/en/admin-settings/config-private-registry) through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials.
+
+If your private registry requires credentials, you need to pass the credentials to Rancher by editing the cluster options for each cluster that needs to pull images from the registry.
+
+The private registry configuration option tells Rancher where to pull the [system images]({{<baseurl>}}/rke/latest/en/config-options/system-images/) or [addon images]({{<baseurl>}}/rke/latest/en/config-options/add-ons/) that will be used in your cluster.
+
+- **System images** are components needed to maintain the Kubernetes cluster.
+- **Add-ons** are used to deploy several cluster components, including network plug-ins, the ingress controller, the DNS provider, or the metrics server.
+
+See the [RKE documentation on private registries]({{<baseurl>}}/rke/latest/en/config-options/private-registries/) for more information on the private registry for components applied during the provisioning of the cluster.
+
+### Authorized Cluster Endpoint
+
+_Available as of v2.2.0_
+
+Authorized Cluster Endpoint can be used to directly access the Kubernetes API server, without requiring communication through Rancher.
+
+> The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#tools-for-provisioning-kubernetes-clusters) to provision the cluster. It is not available for clusters in a hosted Kubernetes provider, such as Amazon's EKS.
+
+This is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self signed certificates.
+
+For more detail on how an authorized cluster endpoint works and why it is used, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint)
+
+We recommend using a load balancer with the authorized cluster endpoint. For details, refer to the [recommended architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#architecture-for-an-authorized-cluster-endpoint)
+
+# Advanced Options
+
+The following options are available when you create clusters in the Rancher UI. They are located under **Advanced Options.**
+
+### NGINX Ingress
+
+Option to enable or disable the [NGINX ingress controller]({{<baseurl>}}/rke/latest/en/config-options/add-ons/ingress-controllers/).
+
+### Node Port Range
+
+Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). Default is `30000-32767`.
+
+### Metrics Server Monitoring
+
+Option to enable or disable [Metrics Server]({{<baseurl>}}/rke/latest/en/config-options/add-ons/metrics-server/).
+
+### Pod Security Policy Support
+
+Option to enable and select a default [Pod Security Policy]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies). You must have an existing Pod Security Policy configured before you can use this option.
+
+### Docker Version on Nodes
+
+Option to require [a supported Docker version]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/) installed on the cluster nodes that are added to the cluster, or to allow unsupported Docker versions installed on the cluster nodes.
+
+### Docker Root Directory
+
+If the nodes you are adding to the cluster have Docker configured with a non-default Docker Root Directory (default is `/var/lib/docker`), please specify the correct Docker Root Directory in this option.
+
+### Recurring etcd Snapshots
+
+Option to enable or disable [recurring etcd snapshots]({{<baseurl>}}/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots).
+
+# Cluster Config File
+
+Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the [options available]({{<baseurl>}}/rke/latest/en/config-options/) in an RKE installation, except for `system_images` configuration. The `system_images` option is not supported when creating a cluster with the Rancher UI or API.
+
+>**Note:** In Rancher v2.0.5 and v2.0.6, the names of services in the Config File (YAML) should contain underscores only: `kube_api` and `kube_controller`.
+
+- To edit an RKE config file directly from the Rancher UI, click **Edit as YAML**.
+- To read from an existing RKE file, click **Read from a file**.
+
+![image]({{<baseurl>}}/img/rancher/cluster-options-yaml.png)
+
+The structure of the config file is different depending on your version of Rancher. Below are example config files for Rancher v2.0.0-v2.2.x and for Rancher v2.3.0+.
+
+### Config File Structure in Rancher v2.3.0+
+
+RKE (Rancher Kubernetes Engine) is the tool that Rancher uses to provision Kubernetes clusters. Rancher's cluster config files used to have the same structure as [RKE config files,]({{<baseurl>}}/rke/latest/en/example-yamls/) but the structure changed so that in Rancher, RKE cluster config items are separated from non-RKE config items. Therefore, configuration for your cluster needs to be nested under the `rancher_kubernetes_engine_config` directive in the cluster config file. Cluster config files created with earlier versions of Rancher will need to be updated for this format. An example cluster config file is included below.
+
+{{% accordion id="v2.3.0-cluster-config-file" label="Example Cluster Config File for Rancher v2.3.0+" %}}
+
+```yaml
+#
+# Cluster Config
+#
+docker_root_dir: /var/lib/docker
+enable_cluster_alerting: false
+enable_cluster_monitoring: false
+enable_network_policy: false
+local_cluster_auth_endpoint:
+  enabled: true
+#
+# Rancher Config
+#
+rancher_kubernetes_engine_config: # Your RKE template config goes here.
+  addon_job_timeout: 30
+  authentication:
+    strategy: x509
+  ignore_docker_version: true
+#
+# # Currently only nginx ingress provider is supported.
+# # To disable ingress controller, set `provider: none`
+# # To enable ingress on specific nodes, use the node_selector, eg:
+#    provider: nginx
+#    node_selector:
+#      app: ingress
+#
+  ingress:
+    provider: nginx
+  kubernetes_version: v1.15.3-rancher3-1
+  monitoring:
+    provider: metrics-server
+#
+#   If you are using calico on AWS
+#
+#    network:
+#      plugin: calico
+#      calico_network_provider:
+#        cloud_provider: aws
+#
+# # To specify flannel interface
+#
+#    network:
+#      plugin: flannel
+#      flannel_network_provider:
+#      iface: eth1
+#
+# # To specify flannel interface for canal plugin
+#
+#    network:
+#      plugin: canal
+#      canal_network_provider:
+#        iface: eth1
+#
+  network:
+    options:
+      flannel_backend_type: vxlan
+    plugin: canal
+#
+#    services:
+#      kube-api:
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kube-controller:
+#        cluster_cidr: 10.42.0.0/16
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kubelet:
+#        cluster_domain: cluster.local
+#        cluster_dns_server: 10.43.0.10
+#
+  services:
+    etcd:
+      backup_config:
+        enabled: true
+        interval_hours: 12
+        retention: 6
+        safe_timestamp: false
+      creation: 12h
+      extra_args:
+        election-timeout: 5000
+        heartbeat-interval: 500
+      gid: 0
+      retention: 72h
+      snapshot: false
+      uid: 0
+    kube_api:
+      always_pull_images: false
+      pod_security_policy: false
+      service_node_port_range: 30000-32767
+  ssh_agent_auth: false
+windows_prefered_cluster: false
+```
+{{% /accordion %}}
+
+### Config File Structure in Rancher v2.0.0-v2.2.x
+
+An example cluster config file is included below.
+
+{{% accordion id="prior-to-v2.3.0-cluster-config-file" label="Example Cluster Config File for Rancher v2.0.0-v2.2.x" %}}
+```yaml
+addon_job_timeout: 30
+authentication:
+  strategy: x509
+ignore_docker_version: true
+#
+# # Currently only nginx ingress provider is supported.
+# # To disable ingress controller, set `provider: none`
+# # To enable ingress on specific nodes, use the node_selector, eg:
+#    provider: nginx
+#    node_selector:
+#      app: ingress
+#
+ingress:
+  provider: nginx
+kubernetes_version: v1.15.3-rancher3-1
+monitoring:
+  provider: metrics-server
+#
+#   If you are using calico on AWS
+#
+#    network:
+#      plugin: calico
+#      calico_network_provider:
+#        cloud_provider: aws
+#
+# # To specify flannel interface
+#
+#    network:
+#      plugin: flannel
+#      flannel_network_provider:
+#      iface: eth1
+#
+# # To specify flannel interface for canal plugin
+#
+#    network:
+#      plugin: canal
+#      canal_network_provider:
+#        iface: eth1
+#
+network:
+  options:
+    flannel_backend_type: vxlan
+  plugin: canal
+#
+#    services:
+#      kube-api:
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kube-controller:
+#        cluster_cidr: 10.42.0.0/16
+#        service_cluster_ip_range: 10.43.0.0/16
+#      kubelet:
+#        cluster_domain: cluster.local
+#        cluster_dns_server: 10.43.0.10
+#
+services:
+  etcd:
+    backup_config:
+      enabled: true
+      interval_hours: 12
+      retention: 6
+      safe_timestamp: false
+    creation: 12h
+    extra_args:
+      election-timeout: 5000
+      heartbeat-interval: 500
+    gid: 0
+    retention: 72h
+    snapshot: false
+    uid: 0
+  kube_api:
+    always_pull_images: false
+    pod_security_policy: false
+    service_node_port_range: 30000-32767
+ssh_agent_auth: false
+```
+{{% /accordion %}}
+
+### Default DNS provider
+
+The table below indicates what DNS provider is deployed by default. See [RKE documentation on DNS provider]({{<baseurl>}}/rke/latest/en/config-options/add-ons/dns/) for more information how to configure a different DNS provider. CoreDNS can only be used on Kubernetes v1.12.0 and higher.
+
+| Rancher version | Kubernetes version | Default DNS provider |
+|-------------|--------------------|----------------------|
+| v2.2.5 and higher | v1.14.0 and higher | CoreDNS |
+| v2.2.5 and higher | v1.13.x and lower | kube-dns |
+| v2.2.4 and lower | any | kube-dns |
+
+# Rancher specific parameters
+
+_Available as of v2.2.0_
+
+Besides the RKE config file options, there are also Rancher specific settings that can be configured in the Config File (YAML):
+
+### docker_root_dir
+
+See [Docker Root Directory](#docker-root-directory).
+
+### enable_cluster_monitoring
+
+Option to enable or disable [Cluster Monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/).
+
+### enable_network_policy
+
+Option to enable or disable Project Network Isolation.
+
+### local_cluster_auth_endpoint
+
+See [Authorized Cluster Endpoint](#authorized-cluster-endpoint).
+
+Example:
+
+```yaml
+local_cluster_auth_endpoint:
+  enabled: true
+  fqdn: "FQDN"
+  ca_certs: "BASE64_CACERT"
+```
+
+### Custom Network Plug-in
+
+_Available as of v2.2.4_
+
+You can add a custom network plug-in by using the [user-defined add-on functionality]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/) of RKE. You define any add-on that you want deployed after the Kubernetes cluster is deployed.
+
+There are two ways that you can specify an add-on:
+
+- [In-line Add-ons]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
+- [Referencing YAML Files for Add-ons]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
+
+For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.]({{<baseurl>}}/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
new file mode 100644
index 00000000000..52f54070a84
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
@@ -0,0 +1,19 @@
+---
+title: Assigning Pod Security Policies
+weight: 1
+---
+
+_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification (like root privileges).
+
+## Adding a Default Pod Security Policy
+
+When you create a new cluster with RKE, you can configure it to apply a PSP immediately. As you create the cluster, use the **Cluster Options** to enable a PSP. The PSP assigned to the cluster will be the default PSP for projects within the cluster.
+
+>**Prerequisite:**
+>Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
+>**Note:**
+>For security purposes, we recommend assigning a PSP as you create your clusters.
+
+To enable a default Pod Security Policy, set the **Pod Security Policy Support** option to  **Enabled**, and then make a selection from the **Default Pod Security Policy** drop-down.
+
+When the cluster finishes provisioning, the PSP you selected is applied to all projects within the cluster.
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
new file mode 100644
index 00000000000..59ccd70fa8d
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
@@ -0,0 +1,113 @@
+---
+title: Launching Kubernetes on Existing Custom Nodes
+description: To create a cluster with custom nodes, you’ll need to access servers in your cluster and provision them according to Rancher requirements 
+metaDescription: "To create a cluster with custom nodes, you’ll need to access servers in your cluster and provision them according to Rancher requirements"
+weight: 3
+---
+
+When you create a custom cluster, Rancher uses RKE (the Rancher Kubernetes Engine) to create a Kubernetes cluster in on-premise bare-metal servers, on-premise virtual machines, or in any node hosted by an infrastructure provider.
+
+To use this option you'll need access to servers you intend to use in your Kubernetes cluster. Provision each server according to the [requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements), which includes some hardware specifications and Docker. After you install Docker on each server, run the command provided in the Rancher UI to turn each server into a Kubernetes node.
+
+This section describes how to set up a custom cluster.
+
+# Creating a Cluster with Custom Nodes
+
+>**Want to use Windows hosts as Kubernetes workers?**
+>
+>See [Configuring Custom Clusters for Windows]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/) before you start.
+
+<!-- TOC -->
+
+- [1. Provision a Linux Host](#1-provision-a-linux-host)
+- [2. Create the Custom Cluster](#2-create-the-custom-cluster)
+- [3. Amazon Only: Tag Resources](#3-amazon-only-tag-resources)
+
+<!-- /TOC -->
+
+### 1. Provision a Linux Host
+
+Begin creation of a custom cluster by provisioning a Linux host. Your host can be:
+
+- A cloud-host virtual machine (VM)
+- An on-premise VM
+- A bare-metal server
+
+If you want to reuse a node from a previous custom cluster, [clean the node]({{<baseurl>}}/rancher/v2.x/en/admin-settings/removing-rancher/rancher-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail.
+
+Provision the host according to the [installation requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements) and the [checklist for production-ready clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production)
+
+### 2. Create the Custom Cluster
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+2. Choose **Custom**.
+
+3. Enter a **Cluster Name**.
+
+4. {{< step_create-cluster_member-roles >}}
+
+5. {{< step_create-cluster_cluster-options >}}
+
+    >**Using Windows nodes as Kubernetes workers?**
+    >
+    >- See [Enable the Windows Support Option]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/#enable-the-windows-support-option).
+    >- The only Network Provider available for clusters with Windows support is Flannel. See [Networking Option]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/#networking-option).
+6.	<a id="step-6"></a>Click **Next**.
+
+7.	From **Node Role**, choose the roles that you want filled by a cluster node.
+
+	>**Notes:**
+	>
+    >- Using Windows nodes as Kubernetes workers? See [Node Configuration]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/#node-configuration).
+	>- Bare-Metal Server Reminder: If you plan on dedicating bare-metal servers to each role, you must provision a bare-metal server for each role (i.e. provision multiple bare-metal servers).
+
+8.	<a id="step-8"></a>**Optional**: Click **[Show advanced options]({{<baseurl>}}/rancher/v2.x/en/admin-settings/agent-options/)** to specify IP address(es) to use when registering the node, override the hostname of the node, or to add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) or [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) to the node.
+
+9. Copy the command displayed on screen to your clipboard.
+
+10. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard.
+
+	>**Note:** Repeat steps 7-10 if you want to dedicate specific hosts to specific node roles. Repeat the steps as many times as needed.
+
+11. When you finish running the command(s) on your Linux host(s), click **Done**.
+
+{{< result_create-cluster >}}
+
+### 3. Amazon Only: Tag Resources
+
+If you have configured your cluster to use Amazon as **Cloud Provider**, tag your AWS resources with a cluster ID.
+
+[Amazon Documentation: Tagging Your Amazon EC2 Resources](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html)
+
+>**Note:** You can use Amazon EC2 instances without configuring a cloud provider in Kubernetes. You only have to configure the cloud provider if you want to use specific Kubernetes cloud provider functionality. For more information, see [Kubernetes Cloud Providers](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/)
+
+
+The following resources need to tagged with a `ClusterID`:
+
+- **Nodes**: All hosts added in Rancher.
+- **Subnet**: The subnet used for your cluster
+- **Security Group**: The security group used for your cluster.
+
+	>**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer.
+
+The tag that should be used is:
+
+```
+Key=kubernetes.io/cluster/<CLUSTERID>, Value=owned
+```
+
+`<CLUSTERID>` can be any string you choose. However, the same string must be used on every resource you tag. Setting the tag value to `owned` informs the cluster that all resources tagged with the `<CLUSTERID>` are owned and managed by this cluster.
+
+If you share resources between clusters, you can change the tag to:
+
+```
+Key=kubernetes.io/cluster/CLUSTERID, Value=shared
+```
+
+# Optional Next Steps
+
+After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
+
+- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
+- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
new file mode 100644
index 00000000000..efcae9b4997
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
@@ -0,0 +1,57 @@
+---
+title: Rancher Agent Options
+weight: 2500
+aliases:
+  - /rancher/v2.x/en/admin-settings/agent-options/
+  - /rancher/v2.x/en/cluster-provisioning/custom-clusters/agent-options
+---
+
+Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) and add the options to the generated `docker run` command when adding a node.
+
+For an overview of how Rancher communicates with downstream clusters using node agents, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#3-node-agents)
+
+## General options
+
+| Parameter  | Environment variable | Description |
+| ---------- | -------------------- | ----------- |
+| `--server` | `CATTLE_SERVER` | The configured Rancher `server-url` setting which the agent connects to |
+| `--token`  | `CATTLE_TOKEN` | Token that is needed to register the node in Rancher |
+| `--ca-checksum`  | `CATTLE_CA_CHECKSUM` | The SHA256 checksum of the configured Rancher `cacerts` setting to validate |
+| `--node-name` | `CATTLE_NODE_NAME` | Override the hostname that is used to register the node (defaults to `hostname -s`) |
+| `--label` | `CATTLE_NODE_LABEL` | Add node labels to the node. For multiple labels, pass additional `--label` options. (`--label key=value`) |
+| `--taints` | `CATTLE_NODE_TAINTS` | Add node taints to the node. For multiple taints, pass additional `--taints` options.  (`--taints key=value:effect`) |
+
+## Role options
+
+| Parameter  | Environment variable | Description |
+| ---------- | -------------------- | ----------- |
+| `--all-roles` | `ALL=true` | Apply all roles (`etcd`,`controlplane`,`worker`) to the node |
+| `--etcd`  | `ETCD=true` | Apply the role `etcd` to the node |
+| `--controlplane`  | `CONTROL=true` | Apply the role `controlplane` to the node |
+| `--worker`  | `WORKER=true` | Apply the role `worker` to the node |
+
+## IP address options
+
+| Parameter  | Environment variable | Description |
+| ---------- | -------------------- | ----------- |
+| `--address` | `CATTLE_ADDRESS` | The IP address the node will be registered with (defaults to the IP used to reach `8.8.8.8`) |
+| `--internal-address` | `CATTLE_INTERNAL_ADDRESS` | The IP address used for inter-host communication on a private network |
+
+### Dynamic IP address options
+
+For automation purposes, you can't have a specific IP address in a command as it has to be generic to be used for every node. For this, we have dynamic IP address options. They are used as a value to the existing IP address options. This is supported for `--address` and `--internal-address`.
+
+| Value  | Example | Description |
+| ---------- | -------------------- | ----------- |
+| Interface name | `--address eth0` | The first configured IP address will be retrieved from the given interface |
+| `ipify` | `--address ipify` | Value retrieved from `https://api.ipify.org` will be used |
+| `awslocal` | `--address awslocal` | Value retrieved from `http://169.254.169.254/latest/meta-data/local-ipv4` will be used |
+| `awspublic` | `--address awspublic` | Value retrieved from `http://169.254.169.254/latest/meta-data/public-ipv4` will be used |
+| `doprivate` | `--address doprivate` | Value retrieved from `http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address` will be used |
+| `dopublic` | `--address dopublic` | Value retrieved from `http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address` will be used |
+| `azprivate` | `--address azprivate` | Value retrieved from `http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/privateIpAddress?api-version=2017-08-01&format=text` will be used |
+| `azpublic` | `--address azpublic` | Value retrieved from `http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-08-01&format=text` will be used |
+| `gceinternal` | `--address gceinternal` | Value retrieved from `http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip` will be used |
+| `gceexternal` | `--address gceexternal` | Value retrieved from `http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip` will be used |
+| `packetlocal` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/local-ipv4` will be used |
+| `packetpublic` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/public-ipv4` will be used |
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
new file mode 100644
index 00000000000..cb2da593f90
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
@@ -0,0 +1,133 @@
+---
+title: Launching Kubernetes on New Nodes in an Infrastructure Provider
+weight: 2
+---
+
+Using Rancher, you can create pools of nodes based on a [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates). This node template defines the parameters you want to use to launch nodes in your infrastructure providers or cloud providers.
+
+One benefit of installing Kubernetes on node pools hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically create another node to join the cluster to ensure that the count of the node pool is as expected.
+
+The available cloud providers to create a node template are decided based on active [node drivers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-drivers).
+
+This section covers the following topics:
+
+- [Node templates](#node-templates)
+  - [Node labels](#node-labels)
+  - [Node taints](#node-taints)
+  - [Administrator control of node templates](#administrator-control-of-node-templates)
+- [Node pools](#node-pools)
+  - [Node pool taints](#node-pool-taints)
+  - [About node auto-replace](#about-node-auto-replace)
+  - [Enabling node auto-replace](#enabling-node-auto-replace)
+  - [Disabling node auto-replace](#disabling-node-auto-replace)
+- [Cloud credentials](#cloud-credentials)
+- [Node drivers](#node-drivers)
+
+# Node Templates
+
+A node template is the saved configuration for the parameters to use when provisioning nodes in a specific cloud provider. These nodes can be launched from the UI. Rancher uses [Docker Machine](https://docs.docker.com/machine/) to provision these nodes. The available cloud providers to create node templates are based on the active node drivers in Rancher.
+
+After you create a node template in Rancher, it's saved so that you can use this template again to create node pools. Node templates are bound to your login. After you add a template, you can remove them from your user profile.
+
+### Node Labels
+
+You can add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) on each node template, so that any nodes created from the node template will automatically have these labels on them.
+
+### Node Taints
+
+_Available as of Rancher v2.3.0_
+
+You can add [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on each node template, so that any nodes created from the node template will automatically have these taints on them.
+
+Since taints can be added at a node template and node pool, if there is no conflict with the same key and effect of the taints, all taints will be added to the nodes. If there are taints with the same key and different effect, the taints from the node pool will override the taints from the node template.
+
+### Administrator Control of Node Templates
+
+_Available as of v2.3.3_
+
+Administrators can control all node templates. Admins can now maintain all the node templates within Rancher. When a node template owner is no longer using Rancher, the node templates created by them can be managed by administrators so the cluster can continue to be updated and maintained.
+
+To access all node templates, an administrator will need to do the following:
+
+1. In the Rancher UI, click the user profile icon in the upper right corner.
+1. Click **Node Templates.**
+
+**Result:** All node templates are listed and grouped by owner. The templates can be edited or cloned by clicking the **&#8942;.**
+
+# Node Pools
+
+Using Rancher, you can create pools of nodes based on a [node template](#node-templates). The benefit of using a node pool is that if a node is destroyed or deleted, you can increase the number of live nodes to compensate for the node that was lost. The node pool helps you ensure that the count of the node pool is as expected.
+
+Each node pool is assigned with a [node component]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) to specify how these nodes should be configured for the Kubernetes cluster.
+
+### Node Pool Taints
+
+_Available as of Rancher v2.3.0_
+
+If you haven't defined [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on your node template, you can add taints for each node pool. The benefit of adding taints at a node pool is beneficial over adding it at a node template is that you can swap out the node templates without worrying if the taint is on the node template.
+
+For each taint, they will automatically be added to any created node in the node pool. Therefore, if you add taints to a node pool that have existing nodes, the taints won't apply to existing nodes in the node pool, but any new node added into the node pool will get the taint.
+
+When there are taints on the node pool and node template, if there is no conflict with the same key and effect of the taints, all taints will be added to the nodes. If there are taints with the same key and different effect, the taints from the node pool will override the taints from the node template.
+
+### About Node Auto-replace
+
+_Available as of Rancher v2.3.0_
+
+If a node is in a node pool, Rancher can automatically replace unreachable nodes. Rancher will use the existing node template for the given node pool to recreate the node if it becomes inactive for a specified number of minutes.
+
+> **Important:** Self-healing node pools are designed to help you replace worker nodes for **stateless** applications. It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
+
+{{% accordion id="how-does-node-auto-replace-work" label="How does Node Auto-replace Work?" %}}
+   Node auto-replace works on top of the Kubernetes node controller. The node controller periodically checks the status of all the nodes (configurable via the `--node-monitor-period` flag of the `kube-controller`). When a node is unreachable, the node controller will taint that node. When this occurs, Rancher will begin its deletion countdown. You can configure the amount of time Rancher waits to delete the node. If the taint is not removed before the deletion countdown ends, Rancher will proceed to delete the node object. Rancher will then provision a node in accordance with the set quantity of the node pool.
+{{% /accordion %}}
+
+### Enabling Node Auto-replace
+
+When you create the node pool, you can specify the amount of time in minutes that Rancher will wait to replace an unresponsive node.
+
+1. In the form for creating a cluster, go to the **Node Pools** section.
+1. Go to the node pool where you want to enable node auto-replace. In the **Recreate Unreachable After** field, enter the number of minutes that Rancher should wait for a node to respond before replacing the node.
+1. Fill out the rest of the form for creating a cluster.
+
+**Result:** Node auto-replace is enabled for the node pool.
+
+You can also enable node auto-replace after the cluster is created with the following steps:
+
+1. From the Global view, click the Clusters tab.
+1. Go to the cluster where you want to enable node auto-replace, click the vertical &#8942; **(…)**, and click **Edit.**
+1. In the **Node Pools** section, go to the node pool where you want to enable node auto-replace. In the **Recreate Unreachable After** field, enter the number of minutes that Rancher should wait for a node to respond before replacing the node.
+1. Click **Save.**
+
+**Result:** Node auto-replace is enabled for the node pool.
+
+### Disabling Node Auto-replace
+
+You can disable node auto-replace from the Rancher UI with the following steps:
+
+1. From the Global view, click the Clusters tab.
+1. Go to the cluster where you want to enable node auto-replace, click the vertical &#8942; **(…)**, and click **Edit.**
+1. In the **Node Pools** section, go to the node pool where you want to enable node auto-replace. In the **Recreate Unreachable After** field, enter 0.
+1. Click **Save.**
+
+**Result:** Node auto-replace is disabled for the node pool.
+
+# Cloud Credentials
+
+_Available as of v2.2.0_
+
+Node templates can use cloud credentials to store credentials for launching nodes in your cloud provider, which has some benefits:
+
+- Credentials are stored as a Kubernetes secret, which is not only more secure, but it also allows you to edit a node template without having to enter your credentials every time.
+
+- After the cloud credential is created, it can be re-used to create additional node templates.
+
+- Multiple node templates can share the same cloud credential to create node pools. If your key is compromised or expired, the cloud credential can be updated in a single place, which allows all node templates that are using it to be updated at once.
+
+> **Note:** As of v2.2.0, the default `active` [node drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) and any node driver, that has fields marked as `password`, are required to use cloud credentials. If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
+
+After cloud credentials are created, the user can start [managing the cloud credentials that they created]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/).
+
+# Node Drivers
+
+If you don't find the node driver that you want to use, you can see if it is available in Rancher's built-in [node drivers and activate it]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/#activating-deactivating-node-drivers), or you can [add your own custom node driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/#adding-custom-node-drivers).
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
new file mode 100644
index 00000000000..73dbf40a0bb
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
@@ -0,0 +1,50 @@
+---
+title: Creating an Azure Cluster
+shortTitle: Azure
+weight: 2220
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure/
+---
+
+Use {{< product >}} to create a Kubernetes cluster in Azure.
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+2. Choose **Azure**.
+
+3. Enter a **Cluster Name**.
+
+4. {{< step_create-cluster_member-roles >}}
+
+5. {{< step_create-cluster_cluster-options >}}
+
+6. {{< step_create-cluster_node-pools >}}
+
+	1.	Click **Add Node Template**.
+
+	2.	Complete the **Azure Options** form.
+
+		- **Account Access** stores your account information for authenticating with Azure. Note: As of v2.2.0, account access information is stored as a cloud credentials. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. To create a new cloud credential, enter **Name** and **Account Access** data, then click **Create.**
+
+		- **Placement** sets the geographical region where your cluster is hosted and other location metadata.
+
+		- **Network** configures the networking used in your cluster.
+
+		- **Instance** customizes your VM configuration.
+
+	3. {{< step_rancher-template >}}
+
+	4. Click **Create**.
+
+	5. **Optional:** Add additional node pools.
+<br>
+7. Review your options to confirm they're correct. Then click **Create**.
+
+{{< result_create-cluster >}}
+
+# Optional Next Steps
+
+After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
+
+- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
+- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
new file mode 100644
index 00000000000..21f6438048c
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
@@ -0,0 +1,45 @@
+---
+title: Creating a DigitalOcean Cluster
+shortTitle: DigitalOcean
+weight: 2215
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-digital-ocean/
+---
+Use {{< product >}} to create a Kubernetes cluster using DigitalOcean.
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+2. Choose **DigitalOcean**.
+
+3. Enter a **Cluster Name**.
+
+4. {{< step_create-cluster_member-roles >}}
+
+5. {{< step_create-cluster_cluster-options >}}
+
+6. {{< step_create-cluster_node-pools >}}
+
+	1.	Click **Add Node Template**. Note: As of v2.2.0, account access information is stored as a cloud credentials. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. To create a new cloud credential, enter **Name** and **Account Access** data, then click **Create.**
+
+	2.  Complete the **Digital Ocean Options** form.
+
+		- **Access Token** stores your DigitalOcean Personal Access Token. Refer to [DigitalOcean Instructions: How To Generate a Personal Access Token](https://www.digitalocean.com/community/tutorials/how-to-use-the-digitalocean-api-v2#how-to-generate-a-personal-access-token).
+
+		- **Droplet Options** provision your cluster's geographical region and specifications.
+
+	4. {{< step_rancher-template >}}
+
+	5. Click **Create**.
+
+	6. **Optional:** Add additional node pools.
+<br/>
+7. Review your options to confirm they're correct. Then click **Create**.
+
+{{< result_create-cluster >}}
+
+# Optional Next Steps
+
+After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
+
+- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
+- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
new file mode 100644
index 00000000000..4754951afde
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
@@ -0,0 +1,266 @@
+---
+title: Creating an Amazon EC2 Cluster
+shortTitle: Amazon EC2
+description: Learn the prerequisites and steps required in order for you to create an Amazon EC2 cluster using Rancher
+weight: 2210
+---
+Use Rancher to create a Kubernetes cluster in Amazon EC2.
+
+### Prerequisites
+
+- **AWS EC2 Access Key and Secret Key** that will be used to create the instances. See [Amazon Documentation: Creating Access Keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey) how to create an Access Key and Secret Key.
+- **IAM Policy created** to add to the user of the Access Key And Secret Key. See [Amazon Documentation: Creating IAM Policies (Console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html#access_policies_create-start) how to create an IAM policy. See our three example JSON policies below:
+  - [Example IAM Policy](#example-iam-policy)
+  - [Example IAM Policy with PassRole](#example-iam-policy-with-passrole) (needed if you want to use [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers) or want to pass an IAM Profile to an instance)
+  - [Example IAM Policy to allow encrypted EBS volumes](#example-iam-policy-to-allow-encrypted-ebs-volumes)
+- **IAM Policy added as Permission** to the user. See [Amazon Documentation: Adding Permissions to a User (Console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) how to attach it to an user.
+
+# Creating an EC2 Cluster
+
+The steps to create a cluster differ based on your Rancher version.
+
+{{% tabs %}}
+{{% tab "Rancher v2.2.0+" %}}
+
+1. [Create your cloud credentials](#1-create-your-cloud-credentials)
+2. [Create a node template with your cloud credentials and information from EC2](#2-create-a-node-template-with-your-cloud-credentials-and-information-from-ec2)
+3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template)
+
+### 1. Create your cloud credentials
+
+1. In the Rancher UI, click the user profile button in the upper right corner, and click **Cloud Credentials.**
+1. Click **Add Cloud Credential.**
+1. Enter a name for the cloud credential.
+1. In the **Cloud Credential Type** field, select **Amazon.**
+1. In the **Region** field, select the AWS region where your cluster nodes will be located.
+1. Enter your AWS EC2 **Access Key** and **Secret Key.**
+1. Click **Create.**
+
+**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. 
+
+### 2. Create a node template with your cloud credentials and information from EC2
+Complete each of the following forms using information available from the [EC2 Management Console](https://aws.amazon.com/ec2).
+
+1. In the Rancher UI, click the user profile button in the upper right corner, and click **Node Templates.**
+1. Click **Add Template.**
+1. In the **Region** field, select the same region that you used when creating your cloud credentials.
+1. In the **Cloud Credentials** field, select your newly created cloud credentials.
+1. Click **Next: Authenticate & configure nodes.**
+1. Choose an availability zone and network settings for your cluster. Click **Next: Select a Security Group.**
+1. Choose the default security group or configure a security group. Please refer to [Amazon EC2 security group when using Node Driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#security-group-for-nodes-on-aws-ec2) to see what rules are created in the `rancher-nodes` Security Group. Then click **Next: Set Instance options.**
+1. Configure the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI.
+
+> If you need to pass an <b>IAM Instance Profile Name</b> (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example IAM policy with PassRole](#example-iam-policy-with-passrole) for an example policy.
+
+Optional: In the **Engine Options** section of the node template, you can configure the Docker daemon. You may want to specify the docker version or a Docker registry mirror.
+
+### 3. Create a cluster with node pools using the node template
+
+{{< step_create-cluster_node-pools >}}
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+1. Choose **Amazon EC2**.
+
+1. Enter a **Cluster Name**.
+
+1. Create a node pool for each Kubernetes role. For each node pool, choose a node template that you created.
+
+1. Click **Add Member** to add users that can access the cluster.
+
+1. Use the **Role** drop-down to set permissions for each user.
+
+1. Use **Cluster Options** to choose the version of Kubernetes, what network provider will be used and if you want to enable project network isolation. Refer to [Selecting Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) to configure the Kubernetes Cloud Provider.
+
+1. Click **Create**.
+
+{{< result_create-cluster >}}
+{{% /tab %}}
+{{% tab "Rancher prior to v2.2.0+" %}}
+
+1. From the **Clusters** page, click **Add Cluster**.
+
+1. Choose **Amazon EC2**.
+
+1. Enter a **Cluster Name**.
+
+1. {{< step_create-cluster_member-roles >}}
+
+1. {{< step_create-cluster_cluster-options >}}Refer to [Selecting Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) to configure the Kubernetes Cloud Provider.
+
+1. {{< step_create-cluster_node-pools >}}
+
+  1. Click **Add Node Template**.
+
+  1. Complete each of the following forms using information available from the [EC2 Management Console](https://aws.amazon.com/ec2).
+
+	- **Account Access** is where you configure the region of the nodes, and the credentials (Access Key and Secret Key) used to create the machine. See [Prerequisites](#prerequisites) how to create the Access Key and Secret Key and the needed permissions.
+	- **Zone and Network** configures the availability zone and network settings for your cluster.
+	- **Security Groups** creates or configures the Security Groups applied to your nodes. Please refer to [Amazon EC2 security group when using Node Driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#security-group-for-nodes-on-aws-ec2) to see what rules are created in the `rancher-nodes` Security Group.
+	- **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI.
+<br><br>
+	If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example IAM policy with PassRole](#example-iam-policy-with-passrole) for an example policy.
+
+1. {{< step_rancher-template >}}
+1. Click **Create**.
+1. **Optional:** Add additional node pools.
+1. Review your cluster settings to confirm they are correct. Then click **Create**.
+
+{{< result_create-cluster >}}
+{{% /tab %}}
+{{% /tabs %}}
+
+### Optional Next Steps
+
+After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
+
+- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
+- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
+
+### Example IAM Policy
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "VisualEditor0",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:AuthorizeSecurityGroupIngress",
+                "ec2:Describe*",
+                "ec2:ImportKeyPair",
+                "ec2:CreateKeyPair",
+                "ec2:CreateSecurityGroup",
+                "ec2:CreateTags",
+                "ec2:DeleteKeyPair"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "VisualEditor1",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:RunInstances"
+            ],
+            "Resource": [
+                "arn:aws:ec2:REGION::image/ami-*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:placement-group/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:subnet/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:key-pair/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:network-interface/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:security-group/*"
+            ]
+        },
+        {
+            "Sid": "VisualEditor2",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:RebootInstances",
+                "ec2:TerminateInstances",
+                "ec2:StartInstances",
+                "ec2:StopInstances"
+            ],
+            "Resource": "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*"
+        }
+    ]
+}
+```
+
+### Example IAM Policy with PassRole
+
+```json
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Sid": "VisualEditor0",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:AuthorizeSecurityGroupIngress",
+                "ec2:Describe*",
+                "ec2:ImportKeyPair",
+                "ec2:CreateKeyPair",
+                "ec2:CreateSecurityGroup",
+                "ec2:CreateTags",
+                "ec2:DeleteKeyPair"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "VisualEditor1",
+            "Effect": "Allow",
+            "Action": [
+                "iam:PassRole",
+                "ec2:RunInstances"
+            ],
+            "Resource": [
+                "arn:aws:ec2:REGION::image/ami-*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:placement-group/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:subnet/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:key-pair/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:network-interface/*",
+                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:security-group/*",
+                "arn:aws:iam::AWS_ACCOUNT_ID:role/YOUR_ROLE_NAME"
+            ]
+        },
+        {
+            "Sid": "VisualEditor2",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:RebootInstances",
+                "ec2:TerminateInstances",
+                "ec2:StartInstances",
+                "ec2:StopInstances"
+            ],
+            "Resource": "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*"
+        }
+    ]
+}
+```
+### Example IAM Policy to allow encrypted EBS volumes
+``` json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "kms:Decrypt",
+        "kms:GenerateDataKeyWithoutPlaintext",
+        "kms:Encrypt",
+        "kms:DescribeKey",
+        "kms:CreateGrant",
+        "ec2:DetachVolume",
+        "ec2:AttachVolume",
+        "ec2:DeleteSnapshot",
+        "ec2:DeleteTags",
+        "ec2:CreateTags",
+        "ec2:CreateVolume",
+        "ec2:DeleteVolume",
+        "ec2:CreateSnapshot"
+      ],
+      "Resource": [
+        "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
+        "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
+        "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:snapshot/*",
+        "arn:aws:kms:REGION:AWS_ACCOUNT_ID:key/KMS_KEY_ID"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:DescribeInstances",
+        "ec2:DescribeTags",
+        "ec2:DescribeVolumes",
+        "ec2:DescribeSnapshots"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
new file mode 100644
index 00000000000..e512460253d
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
@@ -0,0 +1,47 @@
+---
+title: Creating a vSphere Cluster
+shortTitle: vSphere
+description: Use Rancher to create a vSphere cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. 
+metaDescription: Use Rancher to create a vSphere cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. 
+weight: 2225
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-vsphere/
+---
+
+By using Rancher with vSphere, you can bring cloud operations on-premises.
+
+Rancher can provision nodes in vSphere and install Kubernetes on them. When creating a Kubernetes cluster in vSphere, Rancher first provisions the specified number of virtual machines by communicating with the vCenter API. Then it installs Kubernetes on top of them.
+
+A vSphere cluster may consist of multiple groups of VMs with distinct properties, such as the amount of memory or the number of vCPUs. This grouping allows for fine-grained control over the sizing of nodes for each Kubernetes role.
+
+# vSphere Enhancements  
+
+The vSphere node templates have been updated, allowing you to bring cloud operations on-premises with the following enhancements:
+
+### Self-healing Node Pools
+
+_Available as of v2.3.0_
+
+One of the biggest advantages of provisioning vSphere nodes with Rancher is that it allows you to take advantage of Rancher's self-healing node pools, also called the [node auto-replace feature,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-auto-replace) in your on-premises clusters. Self-healing node pools are designed to help you replace worker nodes for stateless applications. When Rancher provisions nodes from a node template, Rancher can automatically replace unreachable nodes.
+
+> **Important:** It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
+
+### Dynamically Populated Options for Instances and Scheduling
+
+_Available as of v2.3.3_
+
+Node templates for vSphere have been updated so that when you create a node template with your vSphere credentials, the template is automatically populated with the same options for provisioning VMs that you have access to in the vSphere console.
+
+For the fields to be populated, your setup needs to fulfill the [prerequisites.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/#prerequisites)
+
+### More Supported Operating Systems
+
+In Rancher v2.3.3+, you can provision VMs with any operating system that supports `cloud-init`. Only YAML format is supported for the [cloud config.](https://cloudinit.readthedocs.io/en/latest/topics/examples.html)
+
+In Rancher prior to v2.3.3, the vSphere node driver included in Rancher only supported the provisioning of VMs with [RancherOS]({{<baseurl>}}/os/v1.x/en/) as the guest operating system.
+
+# Video Walkthrough of v2.3.3 Node Template Features
+
+In this YouTube video, we demonstrate how to set up a node template with the new features designed to help you bring cloud operations to on-premises clusters.
+
+{{< youtube id="dPIwg6x1AlU">}}
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
new file mode 100644
index 00000000000..f59e5e35b86
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
@@ -0,0 +1,319 @@
+---
+title: Provisioning Kubernetes Clusters in vSphere
+weight: 1
+---
+
+This section explains how to configure Rancher with vSphere credentials, provision nodes in vSphere, and set up Kubernetes clusters on those nodes.
+
+# Prerequisites
+
+This section describes the requirements for setting up vSphere so that Rancher can provision VMs and clusters.
+
+The node templates are documented and tested with the vSphere Web Services API version 6.5.
+
+- [Create credentials in vSphere](#create-credentials-in-vsphere)
+- [Network permissions](#network-permissions)
+- [Valid ESXi License for vSphere API Access](#valid-esxi-license-for-vsphere-api-access)
+
+### Create Credentials in vSphere
+
+Before proceeding to create a cluster, you must ensure that you have a vSphere user with sufficient permissions. When you set up a node template, the template will need to use these vSphere credentials.
+
+Refer to this [how-to guide]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/creating-credentials) for instructions on how to create a user in vSphere with the required permissions. These steps result in a username and password that you will need to provide to Rancher, which allows Rancher to provision resources in vSphere.
+
+### Network Permissions
+
+It must be ensured that the hosts running the Rancher server are able to establish the following network connections:
+
+- To the vSphere API on the vCenter server (usually port 443/TCP).
+- To the Host API (port 443/TCP) on all ESXi hosts used to instantiate virtual machines for the clusters (*only required with Rancher prior to v2.3.3 or when using the ISO creation method in later versions*).
+- To port 22/TCP and 2376/TCP on the created VMs
+
+See [Node Networking Requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements) for a detailed list of port requirements applicable for creating nodes on an infrastructure provider.
+
+### Valid ESXi License for vSphere API Access
+
+The free ESXi license does not support API access. The vSphere servers must have a valid or evaluation ESXi license.
+
+# Creating Clusters in vSphere with Rancher
+
+This section describes how to set up vSphere credentials, node templates, and vSphere clusters using the Rancher UI.
+
+You will need to do the following:
+
+1. [Create a node template using vSphere credentials](#1-create-a-node-template-using-vsphere-credentials)
+2. [Create a Kubernetes cluster using the node template](#2-create-a-kubernetes-cluster-using-the-node-template)
+3. [Optional: Provision storage](#3-optional-provision-storage)
+  - [Enable the vSphere cloud provider for the cluster](#enable-the-vsphere-cloud-provider-for-the-cluster)
+
+### Configuration References
+
+For details on configuring the node template, refer to the [node template configuration reference.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/node-template-reference/)
+
+Rancher uses the RKE library to provision Kubernetes clusters. For details on configuring clusters in vSphere, refer to the [cluster configuration reference in the RKE documentation.]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/)
+
+Note that the vSphere cloud provider must be [enabled](#enable-the-vsphere-cloud-provider-for-the-cluster) to allow dynamic provisioning of volumes.
+
+# 1. Create a Node Template Using vSphere Credentials
+
+To create a cluster, you need to create at least one vSphere [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) that specifies how VMs are created in vSphere.
+
+After you create a node template, it is saved, and you can re-use it whenever you create additional vSphere clusters.
+
+To create a node template,
+
+1. Log in with an administrator account to the Rancher UI.
+
+1. From the user settings menu, select **Node Templates.**
+
+1. Click **Add Template** and then click on the **vSphere** icon.
+
+Then, configure your template:
+
+- [A. Configure the vSphere credential](#a-configure-the-vsphere-credential)
+- [B. Configure node scheduling](#b-configure-node-scheduling)
+- [C. Configure instances and operating systems](#c-configure-instances-and-operating-systems)
+- [D. Add networks](#d-add-networks)
+- [E. If not already enabled, enable disk UUIDs](#e-if-not-already-enabled-enable-disk-uuids)
+- [F. Optional: Configure node tags and custom attributes](#f-optional-configure-node-tags-and-custom-attributes)
+- [G. Optional: Configure cloud-init](#g-optional-configure-cloud-init)
+- [H. Saving the node template](#h-saving-the-node-template)
+
+### A. Configure the vSphere Credential
+
+The steps for configuring your vSphere credentials for the cluster are different depending on your version of Rancher.
+
+{{% tabs %}}
+{{% tab "Rancher v2.2.0+" %}}
+
+Your account access information is in a [cloud credential.]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/) Cloud credentials are stored as Kubernetes secrets. 
+
+You can use an existing cloud credential or create a new one. To create a new cloud credential, 
+
+1. Click **Add New.**
+1. In the **Name** field, enter a name for your vSphere credentials.
+1. In the **vCenter or ESXi Server** field, enter the vCenter or ESXi hostname/IP. ESXi is the virtualization platform where you create and run virtual machines and virtual appliances. vCenter Server is the service through which you manage multiple hosts connected in a network and pool host resources.
+1. Optional: In the **Port** field, configure the port of the vCenter or ESXi server.
+1. In the **Username** and **Password** fields, enter your vSphere login username and password.
+1. Click **Create.**
+
+**Result:** The node template has the credentials required to provision nodes in vSphere.
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.2.0" %}}
+In the **Account Access** section, enter the vCenter FQDN or IP address and the credentials for the vSphere user account.
+{{% /tab %}}
+{{% /tabs %}}
+
+### B. Configure Node Scheduling
+
+Choose what hypervisor the virtual machine will be scheduled to. The configuration options depend on your version of Rancher.
+
+{{% tabs %}}
+{{% tab "Rancher v2.3.3+" %}}
+
+The fields in the **Scheduling** section should auto-populate with the data center and other scheduling options that are available to you in vSphere.
+
+1. In the **Data Center** field, choose the data center where the VM will be scheduled.
+1. Optional: Select a **Resource Pool.** Resource pools can be used to partition available CPU and memory resources of a standalone host or cluster, and they can also be nested.
+1. If you have a data store cluster, you can toggle the **Data Store** field. This lets you select a data store cluster where your VM will be scheduled to. If the field is not toggled, you can select an individual disk.
+1. Optional: Select a folder where the VM will be placed. The VM folders in this dropdown menu directly correspond to your VM folders in vSphere. Note: The folder name should be prefaced with `vm/` in your vSphere config file.
+1. Optional: Choose a specific host to create the VM on. Leave this field blank for a standalone ESXi or for a cluster with DRS (Distributed Resource Scheduler). If specified, the host system's pool will be used and the **Resource Pool** parameter will be ignored.
+{{% /tab %}}
+{{% tab "Rancher prior to v2.3.3" %}}
+
+In the **Scheduling** section, enter: 
+
+- The name/path of the **Data Center** to create the VMs in
+- The name of the **VM Network** to attach to
+- The name/path of the **Datastore** to store the disks in
+
+    {{< img "/img/rancher/vsphere-node-template-2.png" "image" >}}
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### C. Configure Instances and Operating Systems
+
+Depending on the Rancher version there are different options available to configure instances.
+
+{{% tabs %}}
+{{% tab "Rancher v2.3.3+" %}}
+
+In the **Instance Options** section, configure the number of vCPUs, memory, and disk size for the VMs created by this template.
+
+In the **Creation method** field, configure the method used to provision VMs in vSphere. Available options include creating VMs that boot from a RancherOS ISO or creating VMs by cloning from an existing virtual machine or [VM template](https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.vm_admin.doc/GUID-F7BF0E6B-7C4F-4E46-8BBF-76229AEA7220.html).
+
+The existing VM or template may use any modern Linux operating system that is configured with support for [cloud-init](https://cloudinit.readthedocs.io/en/latest/) using the [NoCloud datasource](https://cloudinit.readthedocs.io/en/latest/topics/datasources/nocloud.html).
+
+Choose the way that the VM will be created:
+
+- **Deploy from template: Data Center:** Choose a VM template that exists in the data center that you selected.
+- **Deploy from template: Content Library:** First, select the [Content Library](https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.vm_admin.doc/GUID-254B2CE8-20A8-43F0-90E8-3F6776C2C896.html) that contains your template, then select the template from the populated list `Library templates`.
+- **Clone an existing virtual machine:** In the **Virtual machine** field, choose an existing VM that the new VM will be cloned from.
+- **Install from boot2docker ISO:** Ensure that the `OS ISO URL` field contains the URL of a VMware ISO release for RancherOS (rancheros-vmware.iso). Note that this URL must be accessible from the nodes running your Rancher server installation.
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.3.3" %}}
+
+In the **Instance Options** section, configure the number of vCPUs, memory, and disk size for the VMs created by this template.
+
+Only VMs booting from RancherOS ISO are supported.
+
+Ensure that the [OS ISO URL](#instance-options) contains the URL of the VMware ISO release for RancherOS: `rancheros-vmware.iso`.
+
+    ![image]({{<baseurl>}}/img/rancher/vsphere-node-template-1.png)
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### D. Add Networks
+
+_Available as of v2.3.3_
+
+The node template now allows a VM to be provisioned with multiple networks. In the **Networks** field, you can now click **Add Network** to add any networks available to you in vSphere.
+
+### E. If Not Already Enabled, Enable Disk UUIDs
+
+In order to provision nodes with RKE, all nodes must be configured with disk UUIDs.
+
+As of Rancher v2.0.4, disk UUIDs are enabled in vSphere node templates by default.
+
+If you are using Rancher prior to v2.0.4, refer to these [instructions]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/#enabling-disk-uuids-with-a-node-template) for details on how to enable a UUID with a Rancher node template.
+
+### F. Optional: Configure Node Tags and Custom Attributes
+
+The way to attach metadata to the VM is different depending on your Rancher version.
+
+{{% tabs %}}
+{{% tab "Rancher v2.3.3+" %}}
+
+**Optional:** Add vSphere tags and custom attributes. Tags allow you to attach metadata to objects in the vSphere inventory to make it easier to sort and search for these objects.
+
+For tags, all your vSphere tags will show up as options to select from in your node template.
+
+In the custom attributes, Rancher will let you select all the custom attributes you have already set up in vSphere. The custom attributes are keys and you can enter values for each one.
+
+ > **Note:** Custom attributes are a legacy feature that will eventually be removed from vSphere. These attributes allow you to attach metadata to objects in the vSphere inventory to make it easier to sort and search for these objects.
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.3.3" %}}
+
+**Optional:**
+
+  - Provide a set of configuration parameters (instance-options) for the VMs.
+  - Assign labels to the VMs that can be used as a base for scheduling rules in the cluster.
+  - Customize the configuration of the Docker daemon on the VMs that will be created.
+
+> **Note:** Custom attributes are a legacy feature that will eventually be removed from vSphere. These attributes allow you to attach metadata to objects in the vSphere inventory to make it easier to sort and search for these objects.
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### G. Optional: Configure cloud-init
+
+[Cloud-init](https://cloudinit.readthedocs.io/en/latest/) allows you to initialize your nodes by applying configuration on the first boot. This may involve things such as creating users, authorizing SSH keys or setting up the network.
+
+The scope of cloud-init support for the VMs differs depending on the Rancher version.
+
+{{% tabs %}}
+{{% tab "Rancher v2.3.3+" %}}
+
+To make use of cloud-init initialization, create a cloud config file using valid YAML syntax and paste the file content in the the **Cloud Init** field. Refer to the [cloud-init documentation.](https://cloudinit.readthedocs.io/en/latest/topics/examples.html) for a commented set of examples of supported cloud config directives.
+
+*Note that cloud-init is not supported when using the ISO creation method.*
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.3.3" %}}
+
+You may specify the URL of a RancherOS cloud-config.yaml file in the the **Cloud Init** field. Refer to the [RancherOS Documentation]https://rancher.com/docs/os/v1.x/en/configuration/#cloud-config) for details on the supported configuration directives. Note that the URL must be network accessible from the VMs created by the template.
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### H. Saving the Node Template
+
+Assign a descriptive **Name** for this template and click **Create.**
+
+### Node Template Configuration Reference
+
+Refer to [this section]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/node-template-reference/) for a reference on the configuration options available for vSphere node templates.
+
+# 2. Create a Kubernetes Cluster Using the Node Template
+
+After you've created a template, you can use it to stand up the vSphere cluster itself.
+
+To install Kubernetes on vSphere nodes, you will need to enable the vSphere cloud provider by modifying the cluster YAML file. This requirement applies to both pre-created [custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/) and for nodes created in Rancher using the vSphere node driver.
+
+To create the cluster and enable the vSphere provider for cluster, follow these steps:
+
+- [A. Set up the cluster name and member roles](#a-set-up-the-cluster-name-and-member-roles)
+- [B. Configure Kubernetes options](#b-configure-kubernetes-options)
+- [C. Add node pools to the cluster](#c-add-node-pools-to-the-cluster)
+- [D. Optional: Add a self-healing node pool](#d-optional-add-a-self-healing-node-pool)
+- [E. Create the cluster](#e-create-the-cluster)
+
+### A. Set up the Cluster Name and Member Roles
+
+1. Log in to the Rancher UI as an administrator.
+2. Navigate to **Clusters** in the **Global** view.
+3. Click **Add Cluster** and select the **vSphere** infrastructure provider.
+4. Assign a **Cluster Name.**
+5. Assign **Member Roles** as required. {{< step_create-cluster_member-roles >}}
+
+> **Note:**
+> 
+> If you have a cluster with DRS enabled, setting up [VM-VM Affinity Rules](https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.resmgmt.doc/GUID-7297C302-378F-4AF2-9BD6-6EDB1E0A850A.html) is recommended. These rules allow VMs assigned the etcd and control-plane roles to operate on separate ESXi hosts when they are assigned to different node pools. This practice ensures that the failure of a single physical machine does not affect the availability of those planes.
+
+
+### B. Configure Kubernetes Options
+{{<step_create-cluster_cluster-options>}}
+
+### C. Add Node Pools to the Cluster
+{{<step_create-cluster_node-pools>}}
+
+### D. Optional: Add a Self-Healing Node Pool
+
+To make a node pool self-healing, enter a number greater than zero in the **Auto Replace** column. Rancher will use the node template for the given node pool to recreate the node if it becomes inactive for that number of minutes.
+
+> **Note:** Self-healing node pools are designed to help you replace worker nodes for stateless applications. It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
+
+### E. Create the Cluster
+
+Click **Create** to start provisioning the VMs and Kubernetes services.
+
+{{< result_create-cluster >}}
+
+# 3. Optional: Provision Storage
+
+For an example of how to provision storage in vSphere using Rancher, refer to the 
+ [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/examples/vsphere)
+
+ In order to provision storage in vSphere, the vSphere provider must be enabled.
+
+### Enable the vSphere Cloud Provider for the Cluster
+
+1. Set **Cloud Provider** option to `Custom`.
+
+    {{< img "/img/rancher/vsphere-node-driver-cloudprovider.png" "vsphere-node-driver-cloudprovider">}}
+
+1. Click on **Edit as YAML**
+1. Insert the following structure to the pre-populated cluster YAML. As of Rancher v2.3+, this structure must be placed under `rancher_kubernetes_engine_config`. In versions prior to v2.3, it has to be defined as a top-level field. Note that the `name` *must* be set to `vsphere`. 
+
+    ```yaml
+    rancher_kubernetes_engine_config: # Required as of Rancher v2.3+
+      cloud_provider:
+          name: vsphere
+          vsphereCloudProvider:
+              [Insert provider configuration]
+    ```
+
+    Rancher uses RKE (the Rancher Kubernetes Engine) to provision Kubernetes clusters. Refer to the [vSphere configuration reference in the RKE documentation]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/) for details about the properties of the `vsphereCloudProvider` directive.
+
+
+# Optional Next Steps
+
+After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
+
+- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
+- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
new file mode 100644
index 00000000000..9c5bc71a0e2
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
@@ -0,0 +1,41 @@
+---
+title: Creating Credentials in the vSphere Console
+weight: 1
+---
+
+This section describes how to create a vSphere username and password. You will need to provide these vSphere credentials to Rancher, which allows Rancher to provision resources in vSphere.
+
+The following table lists the permissions required for the vSphere user account:
+
+| Privilege Group       | Operations  |
+|:----------------------|:-----------------------------------------------------------------------|
+| Datastore             | AllocateSpace </br> Browse </br> FileManagement (Low level file operations) </br> UpdateVirtualMachineFiles </br> UpdateVirtualMachineMetadata |
+| Network               | Assign |
+| Resource              | AssignVMToPool |
+| Virtual Machine       | Config (All) </br> GuestOperations (All) </br> Interact (All) </br> Inventory (All) </br> Provisioning (All) |
+
+The following steps create a role with the required privileges and then assign it to a new user in the vSphere console:
+
+1. From the **vSphere** console, go to the **Administration** page.
+
+2. Go to the **Roles** tab.
+
+3. Create a new role.  Give it a name and select the privileges listed in the permissions table above.
+
+    {{< img "/img/rancher/rancherroles1.png" "image" >}}
+
+4. Go to the **Users and Groups** tab.
+
+5. Create a new user. Fill out the form and then click **OK**. Make sure to note the username and password, because you will need it when configuring node templates in Rancher.
+
+    {{< img "/img/rancher/rancheruser.png" "image" >}}
+
+6. Go to the **Global Permissions** tab.
+
+7. Create a new Global Permission. Add the user you created earlier and assign it the role you created earlier. Click **OK**.
+
+    {{< img "/img/rancher/globalpermissionuser.png" "image" >}}
+    
+    {{< img "/img/rancher/globalpermissionrole.png" "image" >}}
+
+**Result:** You now have credentials that Rancher can use to manipulate vSphere resources.
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
new file mode 100644
index 00000000000..2388ad4e8ad
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
@@ -0,0 +1,24 @@
+---
+title: Enabling Disk UUIDs in Node Templates
+weight: 3
+---
+
+As of Rancher v2.0.4, disk UUIDs are enabled in vSphere node templates by default.
+
+For Rancher prior to v2.0.4, we recommend configuring a vSphere node template to automatically enable disk UUIDs because they are required for Rancher to manipulate vSphere resources.
+
+To enable disk UUIDs for all VMs created for a cluster,
+
+1. Navigate to the **Node Templates** in the Rancher UI while logged in as an administrator.
+
+2. Add or edit an existing vSphere node template.
+
+3. Under **Instance Options** click on **Add Parameter**.
+
+4. Enter `disk.enableUUID` as key with a value of **TRUE**.
+
+    {{< img "/img/rke/vsphere-nodedriver-enable-uuid.png" "vsphere-nodedriver-enable-uuid" >}}
+
+5. Click **Create** or **Save**.
+
+**Result:** The disk UUID is enabled in the vSphere node template.
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
new file mode 100644
index 00000000000..adf7cdbe8d4
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
@@ -0,0 +1,93 @@
+---
+title: vSphere Node Template Configuration Reference
+weight: 4
+---
+
+The tables below describe the configuration options available in the vSphere node template:
+
+- [Account access](#account-access)
+- [Instance options](#instance-options)
+- [Scheduling options](#scheduling-options)
+
+# Account Access
+
+The account access parameters are different based on the Rancher version.
+
+{{% tabs %}}
+{{% tab "Rancher v2.2.0+" %}}
+
+| Parameter                | Required | Description |
+|:----------------------|:--------:|:-----|
+| Cloud Credentials   |   *      | Your vSphere account access information, stored in a [cloud credential.]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/)  |
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.2.0" %}}
+
+| Parameter                | Required | Description |
+|:------------------------|:--------:|:------------------------------------------------------------|
+| vCenter or ESXi Server   |   *      | IP or FQDN of the vCenter or ESXi server used for managing VMs. |
+| Port                     |   *      | Port to use when connecting to the server. Defaults to `443`.  |
+| Username                 |   *      | vCenter/ESXi user to authenticate with the server. |
+| Password                 |   *      | User's password. |
+
+{{% /tab %}}
+{{% /tabs %}}
+
+# Instance Options
+
+The options for creating and configuring an instance are different depending on your Rancher version.
+
+{{% tabs %}}
+{{% tab "Rancher v2.3.3+" %}}
+
+| Parameter                | Required | Description |
+|:----------------|:--------:|:-----------|
+| CPUs                     |   *      | Number of vCPUS to assign to VMs. |
+| Memory                   |   *      | Amount of memory to assign to VMs.  |
+| Disk                     |   *      | Size of the disk (in MB) to attach to the VMs. |
+| Creation method | * | The method for setting up an operating system on the node. The operating system can be installed from an ISO or from a VM template. Depending on the creation method, you will also have to specify a VM template, content library, existing VM, or ISO. For more information on creation methods, refer to the section on [configuring instances.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/#c-configure-instances-and-operating-systems) |
+| Cloud Init               |          | URL of a `cloud-config.yml` file or URL to provision VMs with. This file allows further customization of the operating system, such as network configuration, DNS servers, or system daemons. The operating system must support `cloud-init`. |
+| Networks | | Name(s) of the network to attach the VM to. |
+| Configuration Parameters used for guestinfo |          | Additional configuration parameters for the VMs. These correspond to the [Advanced Settings](https://kb.vmware.com/s/article/1016098) in the vSphere console. Example use cases include providing RancherOS [guestinfo]({{< baseurl >}}/os/v1.x/en/installation/cloud/vmware-esxi/#vmware-guestinfo) parameters or enabling disk UUIDs for the VMs (`disk.EnableUUID=TRUE`). |
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.3.3" %}}
+
+| Parameter                | Required | Description |
+|:------------------------|:--------:|:------------------------------------------------------------|
+| CPUs                     |   *      | Number of vCPUS to assign to VMs. |
+| Memory                   |   *      | Amount of memory to assign to VMs.  |
+| Disk                     |   *      | Size of the disk (in MB) to attach to the VMs. |
+| Cloud Init               |          | URL of a [RancherOS cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/) file to provision VMs with. This file allows further customization of the RancherOS operating system, such as network configuration, DNS servers, or system daemons.|
+| OS ISO URL               |   *      | URL of a RancherOS vSphere ISO file to boot the VMs from. You can find URLs for specific versions in the [Rancher OS GitHub Repo](https://github.com/rancher/os). |
+| Configuration Parameters |          | Additional configuration parameters for the VMs. These correspond to the [Advanced Settings](https://kb.vmware.com/s/article/1016098) in the vSphere console. Example use cases include providing RancherOS [guestinfo]({{< baseurl >}}/os/v1.x/en/installation/cloud/vmware-esxi/#vmware-guestinfo) parameters or enabling disk UUIDs for the VMs (`disk.EnableUUID=TRUE`). |
+
+{{% /tab %}}
+{{% /tabs %}}
+
+# Scheduling Options
+The options for scheduling VMs to a hypervisor are different depending on your Rancher version.
+{{% tabs %}}
+{{% tab "Rancher v2.3.3+" %}}
+
+| Parameter                | Required | Description |
+|:------------------------|:--------:|:-------|
+| Data Center              |   *      | Name/path of the datacenter to create VMs in.          |
+| Resource Pool                     |          | Name of the resource pool to schedule the VMs in. Leave blank for standalone ESXi. If not specified, the default resource pool is used.  |
+| Data Store               |   *      | If you have a data store cluster, you can toggle the **Data Store** field. This lets you select a data store cluster where your VM will be scheduled to. If the field is not toggled, you can select an individual disk. |
+| Folder                   |          | Name of a folder in the datacenter to create the VMs in. Must already exist. The folder name should be prefaced with `vm/` in your vSphere config file. |
+| Host                     |          | The IP of the host system to schedule VMs in. If specified, the host system's pool will be used and the *Pool* parameter will be ignored. |
+
+{{% /tab %}}
+{{% tab "Rancher prior to v2.3.3" %}}
+
+| Parameter                | Required | Description |
+|:------------------------|:--------:|:------------------------------------------------------------|
+| Data Center              |   *      | Name/path of the datacenter to create VMs in.          |
+| Pool                     |          | Name/path of the resource pool to schedule the VMs in. If not specified, the default resource pool is used.  |
+| Host                     |          | Name/path of the host system to schedule VMs in. If specified, the host system's pool will be used and the *Pool* parameter will be ignored. |
+| Network                  |   *      | Name of the VM network to attach VMs to. |
+| Data Store               |   *      | Datastore to store the VM disks. |
+| Folder                   |          | Name of a folder in the datacenter to create the VMs in. Must already exist. The folder name should be prefaced with `vm/` in your vSphere config file. |
+{{% /tab %}}
+{{% /tabs %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
new file mode 100644
index 00000000000..36fca204d9f
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
@@ -0,0 +1,184 @@
+---
+title: Node Requirements for Rancher Managed Clusters
+weight: 1
+---
+
+This page describes the requirements for the nodes where your apps and services will be installed.
+
+In this section, "user cluster" refers to a cluster running your apps, which should be separate from the cluster (or single node) running Rancher.
+
+> If Rancher is installed on a high-availability Kubernetes cluster, the Rancher server cluster and user clusters have different requirements. For Rancher installation requirements, refer to the node requirements in the [installation section.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+
+Make sure the nodes for the Rancher server fulfill the following requirements:
+
+- [Operating systems and container runtime requirements](#operating-systems-and-container-runtime-requirements)
+- [Hardware Requirements](#hardware-requirements)
+- [Networking Requirements](#networking-requirements)
+- [Optional: Security Considerations](#optional-security-considerations)
+
+# Operating Systems and Docker Requirements
+
+Rancher should work with any modern Linux distribution and any modern Docker version. Linux is required for the etcd and controlplane nodes of all downstream clusters. Worker nodes may run Linux or [Windows Server.](#requirements-for-windows-nodes) The capability to use Windows worker nodes in downstream clusters was added in Rancher v2.3.0.
+
+Rancher works has been tested and is supported with downstream clusters running Ubuntu, CentOS, Oracle Linux, RancherOS, and RedHat Enterprise Linux. For details on which OS and Docker versions were tested with each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
+
+All supported operating systems are 64-bit x86.
+
+If you plan to use ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/rancher/v2.x/en/installation/options/arm64-platform/)
+
+For information on how to install Docker, refer to the official [Docker documentation.](https://docs.docker.com/)
+
+Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm. This [how-to guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/firewall) shows how to check the default firewall rules and how to open the ports with `firewalld` if necessary.
+
+SUSE Linux may have a firewall that blocks all ports by default. In that situation, follow [these steps](#opening-suse-linux-ports) to open the ports needed for adding a host to a custom cluster.
+
+### Requirements for Windows Nodes
+
+_Windows worker nodes can be used as of Rancher v2.3.0_
+
+Nodes with Windows Server must run Docker Enterprise Edition.
+
+Windows nodes can be used for worker nodes only. See [Configuring Custom Clusters for Windows]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/)
+
+# Hardware Requirements
+
+The hardware requirements for nodes with the `worker` role mostly depend on your workloads. The minimum to run the Kubernetes node components is 1 CPU (core) and 1GB of memory.
+
+Regarding CPU and memory, it is recommended that the different planes of Kubernetes clusters (etcd, controlplane, and workers) should be hosted on different nodes so that they can scale separately from each other.
+
+For hardware recommendations for large Kubernetes clusters, refer to the official Kubernetes documentation on [building large clusters.](https://kubernetes.io/docs/setup/best-practices/cluster-large/)
+
+For hardware recommendations for etcd clusters in production, refer to the official [etcd documentation.](https://etcd.io/docs/v3.4.0/op-guide/hardware/)
+
+# Networking Requirements
+
+For a production cluster, we recommend that you restrict traffic by opening only the ports defined in the port requirements below.
+
+The ports required to be open are different depending on how the user cluster is launched. Each of the sections below list the ports that need to be opened for different [cluster creation options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options).
+
+For a breakdown of the port requirements for etcd nodes, controlplane nodes, and worker nodes in a Kubernetes cluster, refer to the [port requirements for the Rancher Kubernetes Engine.]({{<baseurl>}}/rke/latest/en/os/#ports)
+
+Details on which ports are used in each situation are found in the following sections:
+
+- [Commonly used ports](#commonly-used-ports)
+- [Port requirements for custom clusters](#port-requirements-for-custom-clusters)
+- [Port requirements for clusters hosted by an infrastructure provider](#port-requirements-for-clusters-hosted-by-an-infrastructure-provider)
+  - [Security group for nodes on AWS EC2](#security-group-for-nodes-on-aws-ec2)
+- [Port requirements for clusters hosted by a Kubernetes provider](#port-requirements-for-clusters-hosted-by-a-kubernetes-provider)
+- [Port requirements for imported clusters](#port-requirements-for-imported-clusters)
+- [Port requirements for local traffic](#port-requirements-for-local-traffic)
+
+### Commonly Used Ports
+
+If security isn't a large concern and you're okay with opening a few additional ports, you can use this table as your port reference instead of the comprehensive tables in the following sections.
+
+These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
+
+<figcaption>Commonly Used Ports Reference</figcaption>
+
+| Protocol 	|       Port       	| Description                                     	|
+|:--------:	|:----------------:	|-------------------------------------------------	|
+|    TCP   	|        22        	| Node driver SSH provisioning                    	|
+|    TCP   	|       2376       	| Node driver Docker daemon TLS port              	|
+|    TCP   	|       2379       	| etcd client requests                           	|
+|    TCP   	|       2380       	| etcd peer communication                         	|
+|    UDP   	|       8472       	| Canal/Flannel VXLAN overlay networking          	|
+|    UDP   	|       4789       	| Flannel VXLAN overlay networking on Windows cluster |
+|    TCP   	|       9099       	| Canal/Flannel livenessProbe/readinessProbe      	|
+|    TCP   	|       6783       	| Weave Port      	|
+|    UDP   	|       6783-6784   | Weave UDP Ports      	|
+|    TCP   	|       10250      	| kubelet API                                     	|
+|    TCP   	|       10254      	| Ingress controller livenessProbe/readinessProbe 	|
+| TCP/UDP  	| 30000-</br>32767 	| NodePort port range                             	|
+
+### Port Requirements for Custom Clusters
+
+If you are launching a Kubernetes cluster on your existing infrastructure, refer to these port requirements.
+
+The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/).
+
+{{< ports-custom-nodes >}}
+
+### Port Requirements for Clusters Hosted by an Infrastructure Provider
+
+If you are launching a Kubernetes cluster on nodes that are in an infrastructure provider such as Amazon EC2, Google Container Engine, DigitalOcean, Azure, or vSphere, these port requirements apply.
+
+These required ports are automatically opened by Rancher during creation of clusters using cloud providers.
+
+The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
+
+>**Note:**
+>The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean.
+
+{{< ports-iaas-nodes >}}
+
+#### Security Group for Nodes on AWS EC2
+
+When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
+
+|       Type      | Protocol |  Port Range | Source/Destination     | Rule Type |
+|-----------------|:--------:|:-----------:|------------------------|:---------:|
+|       SSH       |    TCP   | 22          | 0.0.0.0/0              | Inbound   |
+|       HTTP      |    TCP   | 80          | 0.0.0.0/0              | Inbound   |
+| Custom TCP Rule |    TCP   | 443         | 0.0.0.0/0              | Inbound   |
+| Custom TCP Rule |    TCP   | 2376        | 0.0.0.0/0              | Inbound   |
+| Custom TCP Rule |    TCP   | 2379-2380   | sg-xxx (rancher-nodes) | Inbound   |
+| Custom UDP Rule |    UDP   | 4789        | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 6443        | 0.0.0.0/0              | Inbound   |
+| Custom UDP Rule |    UDP   | 8472        | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 10250-10252 | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 10256       | sg-xxx (rancher-nodes) | Inbound   |
+| Custom TCP Rule |    TCP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
+| Custom UDP Rule |    UDP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
+| All traffic     |    All   | All         | 0.0.0.0/0              | Outbound  |
+
+### Port Requirements for Clusters Hosted by a Kubernetes Provider
+
+If you are launching a cluster with a [hosted Kubernetes provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters). such as Google Kubernetes Engine, Amazon EKS, or Azure Kubernetes Service, refer to these port requirements.
+
+{{< ports-imported-hosted >}}
+
+
+### Port Requirements for Imported Clusters
+
+The following table depicts the port requirements for [imported clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/).
+
+{{< ports-imported-hosted >}}
+
+
+### Port Requirements for Local Traffic
+
+Ports marked as `local traffic` (i.e., `9099 TCP`) in the port requirements are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`).
+These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
+
+However, this traffic may be blocked when:
+
+- You have applied strict host firewall policies on the node.
+- You are using nodes that have multiple interfaces (multihomed).
+
+In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes/instances.
+
+# Optional: Security Considerations
+
+If you want to provision a Kubernetes cluster that is compliant with the CIS (Center for Internet Security) Kubernetes Benchmark, we recommend to following our hardening guide to configure your nodes before installing Kubernetes.
+
+For more information on the hardening guide and details on which version of the guide corresponds to your Rancher and Kubernetes versions, refer to the [security section.]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide)
+
+# Opening SUSE Linux Ports
+
+SUSE Linux may have a firewall that blocks all ports by default. To open the ports needed for adding the host to a custom cluster,
+
+1. SSH into the instance.
+1. Edit /`etc/sysconfig/SuSEfirewall2` and open the required ports. In this example, ports 9796 and 10250 are also opened for monitoring:
+  ```
+  FW_SERVICES_EXT_TCP="22 80 443 2376 2379 2380 6443 9099 9796 10250 10254 30000:32767"
+  FW_SERVICES_EXT_UDP="8472 30000:32767"
+  FW_ROUTE=yes
+  ```
+1. Restart the firewall with the new ports:
+  ```
+  SuSEfirewall2
+  ```
+
+**Result:** The node has the open ports required to be added to a custom cluster.
+
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
new file mode 100644
index 00000000000..9fdc10e9ff6
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
@@ -0,0 +1,39 @@
+---
+title: Rancher Agents
+weight: 6
+---
+
+There are two different agent resources deployed on Rancher managed clusters:
+
+- [cattle-cluster-agent](#cattle-cluster-agent)
+- [cattle-node-agent](#cattle-node-agent)
+
+For a conceptual overview of how the Rancher server provisions clusters and communicates with them, refer to the [architecture]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/)
+
+### cattle-cluster-agent
+
+The `cattle-cluster-agent` is used to connect to the Kubernetes API of [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters. The `cattle-cluster-agent` is deployed using a Deployment resource.
+
+### cattle-node-agent
+
+The `cattle-node-agent` is used to interact with nodes in a [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) cluster when performing cluster operations. Examples of cluster operations are upgrading Kubernetes version and creating/restoring etcd snapshots. The `cattle-node-agent` is deployed using a DaemonSet resource to make sure it runs on every node. The `cattle-node-agent` is used as fallback option to connect to the Kubernetes API of [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters when `cattle-cluster-agent` is unavailable.
+
+> **Note:** In Rancher v2.2.4 and lower, the `cattle-node-agent` pods did not tolerate all taints, causing Kubernetes upgrades to fail on these nodes. The fix for this has been included in Rancher v2.2.5 and higher.
+
+### Scheduling rules
+
+_Applies to v2.3.0 and higher_
+
+| Component              | nodeAffinity nodeSelectorTerms             | nodeSelector | Tolerations                                                                    |
+| ---------------------- | ------------------------------------------ | ------------ | ------------------------------------------------------------------------------ |
+| `cattle-cluster-agent` | `beta.kubernetes.io/os:NotIn:windows`      | none         | `operator:Exists`                                                              |
+| `cattle-node-agent`    | `beta.kubernetes.io/os:NotIn:windows`      | none         | `operator:Exists`                                                              |
+
+The `cattle-cluster-agent` Deployment has preferred scheduling rules using `requiredDuringSchedulingIgnoredDuringExecution`, favoring to be scheduled on nodes with the `controlplane` node. See [Kubernetes: Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) to find more information about scheduling rules.
+
+The `requiredDuringSchedulingIgnoredDuringExecution` configuration is shown in the table below:
+
+| Weight | Expression                                       |
+| ------ | ------------------------------------------------ |
+| 100    | `node-role.kubernetes.io/controlplane:In:"true"` |
+| 1      | `node-role.kubernetes.io/etcd:In:"true"`         |
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
new file mode 100644
index 00000000000..434407c8b9b
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
@@ -0,0 +1,282 @@
+---
+title: Launching Kubernetes on Windows Clusters
+weight: 4
+---
+
+When provisioning a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) using Rancher, Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes custom cluster on your existing infrastructure.
+
+You can use a mix of Linux and Windows hosts as your cluster nodes. Windows nodes can only be used for deploying workloads, while Linux nodes are required for cluster management.
+
+You can only add Windows nodes to a cluster if Windows support is enabled. Windows support can be enabled for new custom clusters that use Kubernetes 1.15+ and the Flannel network provider. Windows support cannot be enabled for existing clusters.
+
+> Windows clusters have more requirements than Linux clusters. For example, Windows nodes must have 50 GB of disk space. Make sure your Windows cluster fulfills all of the [requirements.](#requirements-for-windows-clusters)
+
+For a summary of Kubernetes features supported in Windows, see the Kubernetes documentation on [supported functionality and limitations for using Kubernetes with Windows](https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#supported-functionality-and-limitations) or the [guide for scheduling Windows containers in Kubernetes](https://kubernetes.io/docs/setup/production-environment/windows/user-guide-windows-containers/).
+
+This guide covers the following topics:
+
+<!-- TOC -->
+
+- [Requirements](#requirements-for-windows-clusters)
+  - [OS and Docker](#os-and-docker-requirements)
+  - [Nodes](#node-requirements)
+  - [Networking](#networking-requirements)
+  - [Architecture](#architecture-requirements)
+  - [Containers](#container-requirements)
+  - [Cloud Providers](#cloud-providers)
+- [Tutorial: How to Create a Cluster with Windows Support](#tutorial-how-to-create-a-cluster-with-windows-support)
+- [Configuration for Storage Classes in Azure](#configuration-for-storage-classes-in-azure)
+  <!-- /TOC -->
+
+# Requirements for Windows Clusters
+
+For a custom cluster, the general node requirements for networking, operating systems, and Docker are the same as the node requirements for a [Rancher installation]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/).
+
+### OS and Docker Requirements
+
+In order to add Windows worker nodes to a cluster, the node must be running one of the following Windows Server versions and the corresponding version of Docker Engine - Enterprise Edition (EE):
+
+- Nodes with Windows Server core version 1809 should use Docker EE-basic 18.09 or Docker EE-basic 19.03.
+- Nodes with Windows Server core version 1903 should use Docker EE-basic 19.03.
+
+> **Notes:**
+>
+> - If you are using AWS, Rancher recommends _Microsoft Windows Server 2019 Base with Containers_ as the Amazon Machine Image (AMI).
+> - If you are using GCE, Rancher recommends _Windows Server 2019 Datacenter for Containers_ as the OS image.
+
+### Node Requirements
+
+The hosts in the cluster need to have at least:
+
+- 2 core CPUs
+- 5 GB memory
+- 50 GB disk space
+
+Rancher will not provision the node if the node does not meet these requirements.
+
+### Networking Requirements
+
+Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation]({{<baseurl>}}/rancher/v2.x/en/installation/) before proceeding with this guide.
+
+Rancher only supports Windows using Flannel as the network provider.
+
+There are two network options: [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) and [**VXLAN (Overlay)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). The default option is **VXLAN (Overlay)** mode.
+
+For **Host Gateway (L2bridge)** networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. For details, refer to the [documentation on configuring cloud-hosted VM routes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#cloud-hosted-vm-routes-configuration) You will also need to [disable private IP address checks]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#disabling-private-ip-address-checks) if you are using Amazon EC2, Google GCE, or Azure VM.
+
+For **VXLAN (Overlay)** networking, the [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix must be installed. Most cloud-hosted VMs already have this hotfix.
+
+### Architecture Requirements
+
+The Kubernetes cluster management nodes (`etcd` and `controlplane`) must be run on Linux nodes.
+
+The `worker` nodes, which is where your workloads will be deployed on, will typically be Windows nodes, but there must be at least one `worker` node that is run on Linux in order to run the Rancher cluster agent, DNS, metrics server, and Ingress related containers.
+
+We recommend the minimum three-node architecture listed in the table below, but you can always add additional Linux and Windows workers to scale up your cluster for redundancy:
+
+<a id="guide-architecture"></a>
+
+| Node   | Operating System                                    | Kubernetes Cluster Role(s)                                                                                                                                                                                                                         | Purpose                                                                             |
+| ------ | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| Node 1 | Linux (Ubuntu Server 18.04 recommended)             | [Control Plane]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#control-plane-nodes), [etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#etcd-nodes), [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) | Manage the Kubernetes cluster                                                       |
+| Node 2 | Linux (Ubuntu Server 18.04 recommended)             | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)                                                                                                                                                                       | Support the Rancher Cluster agent, Metrics server, DNS, and Ingress for the cluster |
+| Node 3 | Windows (Windows Server core version 1809 or above) | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)                                                                                                                                                                       | Run your Windows containers                                                         |
+
+### Container Requirements
+
+Windows requires that containers must be built on the same Windows Server version that they are being deployed on. Therefore, containers must be built on Windows Server core version 1809 or above. If you have existing containers built for an earlier Windows Server core version, they must be re-built on Windows Server core version 1809 or above.
+
+### Cloud Providers
+
+If you set a Kubernetes cloud provider in your cluster, some additional steps are required. You might want to set a cloud provider if you want to want to leverage a cloud provider's capabilities, for example, to automatically provision storage, load balancers, or other infrastructure for your cluster. Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) for details on how to configure a cloud provider cluster of nodes that meet the prerequisites.
+
+If you are using the GCE (Google Compute Engine) cloud provider, you must do the following:
+
+- Enable the GCE cloud provider in the `cluster.yml` by following [these steps.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce)
+- When provisioning the cluster in Rancher, choose **Custom cloud provider** as the cloud provider in the Rancher UI.
+
+# Tutorial: How to Create a Cluster with Windows Support
+
+This tutorial describes how to create a Rancher-provisioned cluster with the three nodes in the [recommended architecture.](#guide-architecture)
+
+When you provision a custom cluster with Rancher, you will add nodes to the cluster by installing the [Rancher agent]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/) on each one. When you create or edit your cluster from the Rancher UI, you will see a **Customize Node Run Command** that you can run on each server to add it to your custom cluster.
+
+To set up a custom cluster with support for Windows nodes and containers, you will need to complete the tasks below.
+
+<!-- TOC -->
+
+1. [Provision Hosts](#1-provision-hosts)
+1. [Create the Custom Cluster](#2-create-the-custom-cluster)
+1. [Add Nodes to the Cluster](#3-add-nodes-to-the-cluster)
+1. [Optional: Configuration for Azure Files](#5-optional-configuration-for-azure-files)
+   <!-- /TOC -->
+
+# 1. Provision Hosts
+
+To begin provisioning a custom cluster with Windows support, prepare your hosts.
+
+Your hosts can be:
+
+- Cloud-hosted VMs
+- VMs from virtualization clusters
+- Bare-metal servers
+
+You will provision three nodes:
+
+- One Linux node, which manages the Kubernetes control plane and stores your `etcd`
+- A second Linux node, which will be another worker node
+- The Windows node, which will run your Windows containers as a worker node
+
+| Node   | Operating System                                             |
+| ------ | ------------------------------------------------------------ |
+| Node 1 | Linux (Ubuntu Server 18.04 recommended)                      |
+| Node 2 | Linux (Ubuntu Server 18.04 recommended)                      |
+| Node 3 | Windows (Windows Server core version 1809 or above required) |
+
+If your nodes are hosted by a **Cloud Provider** and you want automation support such as loadbalancers or persistent storage devices, your nodes have additional configuration requirements. For details, see [Selecting Cloud Providers.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers)
+
+# 2. Create the Custom Cluster
+
+The instructions for creating a custom cluster that supports Windows nodes are very similar to the general [instructions for creating a custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster) with some Windows-specific requirements.
+
+Windows support only be enabled if the cluster uses Kubernetes v1.15+ and the Flannel network provider.
+
+1. From the **Global** view, click on the **Clusters** tab and click **Add Cluster**.
+
+1. Click **From existing nodes (Custom)**.
+
+1. Enter a name for your cluster in the **Cluster Name** text box.
+
+1. In the **Kubernetes Version** dropdown menu, select v1.15 or above.
+
+1. In the **Network Provider** field, select **Flannel.**
+
+1. In the **Windows Support** section, click **Enable.**
+
+1. Optional: After you enable Windows support, you will be able to choose the Flannel backend. There are two network options: [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) and [**VXLAN (Overlay)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). The default option is **VXLAN (Overlay)** mode.
+
+1. Click **Next**.
+
+> **Important:** For <b>Host Gateway (L2bridge)</b> networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. For details, refer to the [documentation on configuring cloud-hosted VM routes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#cloud-hosted-vm-routes-configuration) You will also need to [disable private IP address checks]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#disabling-private-ip-address-checks) if you are using Amazon EC2, Google GCE, or Azure VM.
+
+# 3. Add Nodes to the Cluster
+
+This section describes how to register your Linux and Worker nodes to your custom cluster.
+
+### Add Linux Master Node
+
+The first node in your cluster should be a Linux host has both the **Control Plane** and **etcd** roles. At a minimum, both of these roles must be enabled for this node, and this node must be added to your cluster before you can add Windows hosts.
+
+In this section, we fill out a form on the Rancher UI to get a custom command to install the Rancher agent on the Linux master node. Then we will copy the command and run it on our Linux master node to register the node in the cluster.
+
+1. In the **Node Operating System** section, click **Linux**.
+
+1. In the **Node Role** section, choose at least **etcd** and **Control Plane**. We recommend selecting all three.
+
+1. Optional: If you click **Show advanced options,** you can customize the settings for the [Rancher agent]({{<baseurl>}}/rancher/v2.x/en/admin-settings/agent-options/) and [node labels.](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
+
+1. Copy the command displayed on the screen to your clipboard.
+
+1. SSH into your Linux host and run the command that you copied to your clipboard.
+
+1. When you are finished provisioning your Linux node(s), select **Done**.
+
+{{< result_create-cluster >}}
+
+It may take a few minutes for the node to be registered in your cluster.
+
+### Add Linux Worker Node
+
+After the initial provisioning of your custom cluster, your cluster only has a single Linux host. Next, we add another Linux `worker` host, which will be used to support _Rancher cluster agent_, _Metrics server_, _DNS_ and _Ingress_ for your cluster.
+
+1. From the **Global** view, click **Clusters.**
+
+1. Go to the custom cluster that you created and click **&#8942; > Edit.**
+
+1. Scroll down to **Node Operating System**. Choose **Linux**.
+
+1. In the **Customize Node Run Command** section, go to the **Node Options** and select the **Worker** role.
+
+1. Copy the command displayed on screen to your clipboard.
+
+1. Log in to your Linux host using a remote Terminal connection. Run the command copied to your clipboard.
+
+1. From **Rancher**, click **Save**.
+
+**Result:** The **Worker** role is installed on your Linux host, and the node registers with Rancher. It may take a few minutes for the node to be registered in your cluster.
+
+> **Note:** Taints on Linux Worker Nodes
+>
+> For each Linux worker node added into the cluster, the following taints will be added to Linux worker node. By adding this taint to the Linux worker node, any workloads added to the windows cluster will be automatically scheduled to the Windows worker node. If you want to schedule workloads specifically onto the Linux worker node, you will need to add tolerations to those workloads.
+
+> | Taint Key      | Taint Value | Taint Effect |
+> | -------------- | ----------- | ------------ |
+> | `cattle.io/os` | `linux`     | `NoSchedule` |
+
+### Add a Windows Worker Node
+
+You can add Windows hosts to a custom cluster by editing the cluster and choosing the **Windows** option.
+
+1. From the **Global** view, click **Clusters.**
+
+1. Go to the custom cluster that you created and click **&#8942; > Edit.**
+
+1. Scroll down to **Node Operating System**. Choose **Windows**. Note: You will see that the **worker** role is the only available role.
+
+1. Copy the command displayed on screen to your clipboard.
+
+1. Log in to your Windows host using your preferred tool, such as [Microsoft Remote Desktop](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). Run the command copied to your clipboard in the **Command Prompt (CMD)**.
+
+1. From Rancher, click **Save**.
+
+1. Optional: Repeat these instructions if you want to add more Windows nodes to your cluster.
+
+**Result:** The **Worker** role is installed on your Windows host, and the node registers with Rancher. It may take a few minutes for the node to be registered in your cluster. You now have a Windows Kubernetes cluster.
+
+### Optional Next Steps
+
+After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
+
+- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
+- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through the Rancher server. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
+
+# Configuration for Storage Classes in Azure
+
+If you are using Azure VMs for your nodes, you can use [Azure files](https://docs.microsoft.com/en-us/azure/aks/azure-files-dynamic-pv) as a [storage class]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) for the cluster.
+
+In order to have the Azure platform create the required storage resources, follow these steps:
+
+1.  [Configure the Azure cloud provider.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/#azure)
+
+1.  Configure `kubectl` to connect to your cluster.
+
+1.  Copy the `ClusterRole` and `ClusterRoleBinding` manifest for the service account:
+
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRole
+        metadata:
+          name: system:azure-cloud-provider
+        rules:
+        - apiGroups: ['']
+          resources: ['secrets']
+          verbs:     ['get','create']
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRoleBinding
+        metadata:
+          name: system:azure-cloud-provider
+        roleRef:
+          kind: ClusterRole
+          apiGroup: rbac.authorization.k8s.io
+          name: system:azure-cloud-provider
+        subjects:
+        - kind: ServiceAccount
+          name: persistent-volume-binder
+          namespace: kube-system
+
+1.  Create these in your cluster using one of the follow command.
+
+    ```
+    # kubectl create -f <MANIFEST>
+    ```
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
new file mode 100644
index 00000000000..8cc045883ff
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
@@ -0,0 +1,176 @@
+---
+title: v2.1.x and v2.2.x Windows Documentation (Experimental)
+weight: 9100
+---
+
+_Available from v2.1.0 to v2.1.9 and v2.2.0 to v2.2.3_
+
+This section describes how to provision Windows clusters in Rancher v2.1.x and v2.2.x. If you are using Rancher v2.3.0 or later, please refer to the new documentation for [v2.3.0 or later]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/).
+
+When you create a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes), Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes cluster on your existing infrastructure.
+
+You can provision a custom Windows cluster using Rancher by using a mix of Linux and Windows hosts as your cluster nodes.
+
+>**Important:** In versions of Rancher prior to v2.3, support for Windows nodes is experimental. Therefore, it is not recommended to use Windows nodes for production environments if you are using Rancher prior to v2.3.
+
+This guide walks you through create of a custom cluster that includes three nodes:
+
+- A Linux node, which serves as a Kubernetes control plane node
+- Another Linux node, which serves as a Kubernetes worker used to support Ingress for the cluster
+- A Windows node, which is assigned the Kubernetes worker role and runs your Windows containers
+
+For a summary of Kubernetes features supported in Windows, see [Using Windows in Kubernetes](https://kubernetes.io/docs/setup/windows/intro-windows-in-kubernetes/).
+
+## OS and Container Requirements
+
+- For clusters provisioned with Rancher v2.1.x and v2.2.x, containers must run on Windows Server 1809 or above.
+- You must build containers on a Windows Server core version 1809 or above to run these containers on the same server version.
+
+## Objectives for Creating Cluster with Windows Support
+
+When setting up a custom cluster with support for Windows nodes and containers, complete the series of tasks below.
+
+<!-- TOC -->
+
+- [1. Provision Hosts](#1-provision-hosts)
+- [2. Cloud-host VM Networking Configuration](#2-cloud-hosted-vm-networking-configuration)
+- [3. Create the Custom Cluster](#3-create-the-custom-cluster)
+- [4. Add Linux Host for Ingress Support](#4-add-linux-host-for-ingress-support)
+- [5. Adding Windows Workers](#5-adding-windows-workers)
+- [6. Cloud-host VM Routes Configuration](#6-cloud-hosted-vm-routes-configuration)
+
+<!-- /TOC -->
+
+## 1. Provision Hosts
+
+To begin provisioning a custom cluster with Windows support, prepare your host servers. Provision three nodes according to our [requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)—two Linux, one Windows. Your hosts can be:
+
+- Cloud-hosted VMs
+- VMs from virtualization clusters
+- Bare-metal servers
+
+The table below lists the [Kubernetes roles]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) you'll assign to each host, although you won't enable these roles until further along in the configuration process—we're just informing you of each node's purpose. The first node, a Linux host, is primarily responsible for managing the Kubernetes control plane, although, in this use case, we're installing all three roles on this node. Node 2 is also a Linux worker, which is responsible for Ingress support. Finally, the third node is your Windows worker, which will run your Windows applications.
+
+Node    | Operating System | Future Cluster Role(s)
+--------|------------------|------
+Node 1  | Linux (Ubuntu Server 16.04 recommended)           | [Control Plane]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#control-plane-nodes), [etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#etcd), [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)
+Node 2  | Linux (Ubuntu Server 16.04 recommended)           | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) (This node is used for Ingress support)
+Node 3  | Windows (Windows Server core version 1809 or above)          | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)
+
+### Requirements
+
+- You can view node requirements for Linux and Windows nodes in the [installation section]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/).
+- All nodes in a virtualization cluster or a bare metal cluster must be connected using a layer 2 network.
+- To support [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/), your cluster must include at least one Linux node dedicated to the worker role.
+- Although we recommend the three node architecture listed in the table above, you can add additional Linux and Windows workers to scale up your cluster for redundancy.
+
+
+## 2. Cloud-hosted VM Networking Configuration
+
+>**Note:** This step only applies to nodes hosted on cloud-hosted virtual machines. If you're using virtualization clusters or bare-metal servers, skip ahead to [Create the Custom Cluster](#3-create-the-custom-cluster).
+
+If you're hosting your nodes on any of the cloud services listed below, you must disable the private IP address checks for both your Linux or Windows hosts on startup. To disable this check for each node, follow the directions provided by each service below.
+
+Service | Directions to disable private IP address checks
+--------|------------------------------------------------
+Amazon EC2 | [Disabling Source/Destination Checks](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck)
+Google GCE | [Enabling IP Forwarding for Instances](https://cloud.google.com/vpc/docs/using-routes#canipforward)
+Azure VM | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding)
+
+## 3. Create the Custom Cluster
+
+To create a custom cluster that supports Windows nodes, follow the instructions in [Creating a Cluster with Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster), starting from [2. Create the Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster). While completing the linked instructions, look for steps that requires special actions for Windows nodes, which are flagged with a note. These notes will link back here, to the special Windows instructions listed in the subheadings below.
+
+
+### Enable the Windows Support Option
+
+While choosing **Cluster Options**, set **Windows Support (Experimental)** to **Enabled**.
+
+After you select this option, resume [Creating a Cluster with Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 6]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-6).
+
+### Networking Option
+
+When choosing a network provider for a cluster that supports Windows, the only option available is Flannel, as [host-gw](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) is needed for IP routing.
+
+If your nodes are hosted by a cloud provider and you want automation support such as load balancers or persistent storage devices, see [Selecting Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers) for configuration info.
+
+### Node Configuration
+
+The first node in your cluster should be a Linux host that fills the Control Plane role. This role must be fulfilled before you can add Windows hosts to your cluster. At minimum, the node must have this role enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later).
+
+Option | Setting
+-------|--------
+Node Operating System | Linux
+Node Roles | etcd <br/> Control Plane <br/> Worker
+
+When you're done with these configurations, resume [Creating a Cluster with Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 8]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-8).
+
+
+
+## 4. Add Linux Host for Ingress Support
+
+After the initial provisioning of your custom cluster, your cluster only has a single Linux host. Add another Linux host, which will be used to support Ingress for your cluster.
+
+1. Using the content menu, open the custom cluster your created in [2. Create the Custom Cluster](#2-create-the-custom-cluster).
+
+1. From the main menu, select **Nodes**.
+
+1. Click **Edit Cluster**.
+
+1. Scroll down to **Node Operating System**. Choose **Linux**.
+
+1. Select the **Worker** role.
+
+1. Copy the command displayed on screen to your clipboard.
+
+1. Log in to your Linux host using a remote Terminal connection. Run the command copied to your clipboard.
+
+1. From **Rancher**, click **Save**.
+
+**Result:** The worker role is installed on your Linux host, and the node registers with Rancher.
+
+## 5. Adding Windows Workers
+
+You can add Windows hosts to a custom cluster by editing the cluster and choosing the **Windows** option.
+
+1. From the main menu, select **Nodes**.
+
+1. Click **Edit Cluster**.
+
+1. Scroll down to **Node Operating System**. Choose **Windows**.
+
+1. Select the **Worker** role.
+
+1. Copy the command displayed on screen to your clipboard.
+
+1. Log in to your Windows host using your preferred tool, such as [Microsoft Remote Desktop](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). Run the command copied to your clipboard in the **Command Prompt (CMD)**.
+
+1. From Rancher, click **Save**.
+
+1. **Optional:** Repeat these instruction if you want to add more Windows nodes to your cluster.
+
+**Result:** The worker role is installed on your Windows host, and the node registers with Rancher.
+
+## 6. Cloud-hosted VM Routes Configuration
+
+In Windows clusters, containers communicate with each other using the `host-gw` mode of Flannel. In `host-gw` mode, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network.
+
+- When worker nodes are provisioned on AWS, virtualization clusters, or bare metal servers, make sure they belong to the same layer 2 subnet. If the nodes don't belong to the same layer 2 subnet, `host-gw` networking will not work.
+
+- When worker nodes are provisioned on GCE or Azure, they are not on the same layer 2 subnet. Nodes on GCE and Azure belong to a routable layer 3 network. Follow the instructions below to configure GCE and Azure so that the cloud network knows how to route the host subnets on each node.
+
+To configure host subnet routing on GCE or Azure, first run the following command to find out the host subnets on each worker node:
+
+```bash
+kubectl get nodes -o custom-columns=nodeName:.metadata.name,nodeIP:status.addresses[0].address,routeDestination:.spec.podCIDR
+```
+
+Then follow the instructions for each cloud provider to configure routing rules for each node:
+
+Service | Instructions
+--------|-------------
+Google GCE | For GCE, add a static route for each node: [Adding a Static Route](https://cloud.google.com/vpc/docs/using-routes#addingroute).
+Azure VM | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined).
+
+
+` `
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
new file mode 100644
index 00000000000..ee075c394de
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
@@ -0,0 +1,37 @@
+---
+title: Networking Requirements for Host Gateway (L2bridge)
+weight: 1000
+---
+
+This section describes how to configure custom Windows clusters that are using *Host Gateway (L2bridge)* mode.
+
+### Disabling Private IP Address Checks
+
+If you are using *Host Gateway (L2bridge)* mode and hosting your nodes on any of the cloud services listed below, you must disable the private IP address checks for both your Linux or Windows hosts on startup. To disable this check for each node, follow the directions provided by each service below.
+
+Service | Directions to disable private IP address checks
+--------|------------------------------------------------
+Amazon EC2 | [Disabling Source/Destination Checks](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck)
+Google GCE | [Enabling IP Forwarding for Instances](https://cloud.google.com/vpc/docs/using-routes#canipforward) (By default, a VM cannot forward a packet originated by another VM)
+Azure VM   | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding)
+
+### Cloud-hosted VM Routes Configuration
+
+If you are using the [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) backend of Flannel, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network.
+
+- When worker nodes are provisioned on AWS, virtualization clusters, or bare metal servers, make sure they belong to the same layer 2 subnet. If the nodes don't belong to the same layer 2 subnet, `host-gw` networking will not work.
+
+- When worker nodes are provisioned on GCE or Azure, they are not on the same layer 2 subnet. Nodes on GCE and Azure belong to a routable layer 3 network. Follow the instructions below to configure GCE and Azure so that the cloud network knows how to route the host subnets on each node.
+
+To configure host subnet routing on GCE or Azure, first run the following command to find out the host subnets on each worker node:
+
+```bash
+kubectl get nodes -o custom-columns=nodeName:.metadata.name,nodeIP:status.addresses[0].address,routeDestination:.spec.podCIDR
+```
+
+Then follow the instructions for each cloud provider to configure routing rules for each node:
+
+Service | Instructions
+--------|-------------
+Google GCE | For GCE, add a static route for each node: [Adding a Static Route](https://cloud.google.com/vpc/docs/using-routes#addingroute).
+Azure VM   | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined).
diff --git a/content/rancher/v2.5/en/applications/ecm/upgrading-kubernetes/_index.md b/content/rancher/v2.5/en/applications/ecm/upgrading-kubernetes/_index.md
new file mode 100644
index 00000000000..f47a5fcd279
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/upgrading-kubernetes/_index.md
@@ -0,0 +1,161 @@
+---
+title: Upgrading and Rolling Back RKE Kubernetes Clusters
+weight: 3
+---
+
+Following an upgrade to the latest version of Rancher, downstream Kubernetes clusters can be upgraded to use the latest supported version of Kubernetes.
+
+Rancher calls RKE (Rancher Kubernetes Engine) as a library when provisioning and editing RKE clusters. For more information on configuring the upgrade strategy for RKE clusters, refer to the [RKE documentation]({{<baseurl>}}/rke/latest/en/).
+
+This section covers the following topics:
+
+- [New Features](#new-features)
+- [Tested Kubernetes Versions](#tested-kubernetes-versions)
+- [How Upgrades Work](#how-upgrades-work)
+- [Recommended Best Practice for Upgrades](#recommended-best-practice-for-upgrades)
+- [Upgrading the Kubernetes Version](#upgrading-the-kubernetes-version)
+- [Rolling Back](#rolling-back)
+- [Configuring the Upgrade Strategy](#configuring-the-upgrade-strategy)
+  - [Configuring the Maximum Unavailable Worker Nodes in the Rancher UI](#configuring-the-maximum-unavailable-worker-nodes-in-the-rancher-ui)
+  - [Enabling Draining Nodes During Upgrades from the Rancher UI](#enabling-draining-nodes-during-upgrades-from-the-rancher-ui)
+  - [Maintaining Availability for Applications During Upgrades](#maintaining-availability-for-applications-during-upgrades)
+  - [Configuring the Upgrade Strategy in the cluster.yml](#configuring-the-upgrade-strategy-in-the-cluster-yml)
+- [Troubleshooting](#troubleshooting)
+
+# New Features
+
+As of Rancher v2.3.0, the Kubernetes metadata feature was added, which allows Rancher to ship Kubernetes patch versions without upgrading Rancher. For details, refer to the [section on Kubernetes metadata.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/k8s-metadata)
+
+As of Rancher v2.4.0,
+
+- The ability to import K3s Kubernetes clusters into Rancher was added, along with the ability to upgrade Kubernetes when editing those clusters. For details, refer to the [section on imported clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters)
+- New advanced options are exposed in the Rancher UI for configuring the upgrade strategy of an RKE cluster: **Maximum Worker Nodes Unavailable** and **Drain nodes.** These options leverage the new cluster upgrade process of RKE v1.1.0, in which worker nodes are upgraded in batches, so that applications can remain available during cluster upgrades, under [certain conditions.](#maintaining-availability-for-applications-during-upgrades)
+
+# Tested Kubernetes Versions
+
+Before a new version of Rancher is released, it's tested with the latest minor versions of Kubernetes to ensure compatibility. For example, Rancher v2.3.0 is was tested with Kubernetes v1.15.4, v1.14.7, and v1.13.11. For details on which versions of Kubernetes were tested on each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.3.0/)
+
+# How Upgrades Work
+
+RKE v1.1.0 changed the way that clusters are upgraded.
+
+In this section of the [RKE documentation,]({{<baseurl>}}/rke/latest/en/upgrades/how-upgrades-work) you'll learn what happens when you edit or upgrade your RKE Kubernetes cluster.
+
+
+# Recommended Best Practice for Upgrades
+
+{{% tabs %}}
+{{% tab "Rancher v2.4+" %}}
+When upgrading the Kubernetes version of a cluster, we recommend that you:
+
+1. Take a snapshot.
+1. Initiate a Kubernetes upgrade.
+1. If the upgrade fails, revert the cluster to the pre-upgrade Kubernetes version. Before restoring the cluster from the snapshot in the etcd datastore, the cluster should be running the pre-upgrade Kubernetes version.
+1. Restore the cluster from the etcd snapshot.
+
+The restore operation will work on a cluster that is not in a healthy or active state.
+{{% /tab %}}
+{{% tab "Rancher prior to v2.4" %}}
+When upgrading the Kubernetes version of a cluster, we recommend that you:
+
+1. Take a snapshot.
+1. Initiate a Kubernetes upgrade.
+1. If the upgrade fails, restore the cluster from the etcd snapshot.
+
+The cluster cannot be downgraded to a previous Kubernetes version.
+{{% /tab %}}
+{{% /tabs %}}
+
+# Upgrading the Kubernetes Version
+
+> **Prerequisites:**
+>
+> - The options below are available only for [Rancher-launched RKE Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) and [imported K3s Kubernetes clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
+> - Before upgrading Kubernetes, [back up your cluster.]({{<baseurl>}}/rancher/v2.x/en/backups)
+
+1. From the **Global** view, find the cluster for which you want to upgrade Kubernetes. Select **&#8942; > Edit**.
+
+1. Expand **Cluster Options**.
+
+1. From the **Kubernetes Version** drop-down, choose the version of Kubernetes that you want to use for the cluster.
+
+1. Click **Save**.
+
+**Result:** Kubernetes begins upgrading for the cluster.
+
+# Rolling Back
+
+_Available as of v2.4_
+
+A cluster can be restored to a backup in which the previous Kubernetes version was used. For more information, refer to the following sections:
+
+- [Backing up a cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#how-snapshots-work)
+- [Restoring a cluster from backup]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/#restoring-a-cluster-from-a-snapshot)
+
+# Configuring the Upgrade Strategy
+
+As of RKE v1.1.0, additional upgrade options became available to give you more granular control over the upgrade process. These options can be used to maintain availability of your applications during a cluster upgrade if certain [conditions and requirements]({{<baseurl>}}/rke/latest/en/upgrades/maintaining-availability) are met.
+
+The upgrade strategy can be configured in the Rancher UI, or by editing the `cluster.yml`. More advanced options are available by editing the `cluster.yml`.
+
+### Configuring the Maximum Unavailable Worker Nodes in the Rancher UI
+
+From the Rancher UI, the maximum number of unavailable worker nodes can be configured. During a cluster upgrade, worker nodes will be upgraded in batches of this size.
+
+By default, the maximum number of unavailable worker is defined as 10 percent of all worker nodes. This number can be configured as a percentage or as an integer. When defined as a percentage, the batch size is rounded down to the nearest node, with a minimum of one node.
+
+To change the default number or percentage of worker nodes,
+
+1. Go to the cluster view in the Rancher UI.
+1. Click **&#8942; > Edit.**
+1. In the **Advanced Options** section, go to the **Maxiumum Worker Nodes Unavailable** field. Enter the percentage of worker nodes that can be upgraded in a batch. Optionally, select **Count** from the drop-down menu and enter the maximum unavailable worker nodes as an integer.
+1. Click **Save.**
+
+**Result:** The cluster is updated to use the new upgrade strategy.
+
+### Enabling Draining Nodes During Upgrades from the Rancher UI
+
+By default, RKE [cordons](https://kubernetes.io/docs/concepts/architecture/nodes/#manual-node-administration) each node before upgrading it. [Draining](https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/) is disabled during upgrades by default. If draining is enabled in the cluster configuration, RKE will both cordon and drain the node before it is upgraded.
+
+To enable draining each node during a cluster upgrade,
+
+1. Go to the cluster view in the Rancher UI.
+1. Click **&#8942; > Edit.**
+1. In the **Advanced Options** section, go to the **Drain nodes** field and click **Yes.**
+1. Choose a safe or aggressive drain option. For more information about each option, refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes/#aggressive-and-safe-draining-options)
+1. Optionally, configure a grace period. The grace period is the timeout given to each pod for cleaning things up, so they will have chance to exit gracefully. Pods might need to finish any outstanding requests, roll back transactions or save state to some external storage. If this value is negative, the default value specified in the pod will be used.
+1. Optionally, configure a timeout, which is the amount of time the drain should continue to wait before giving up.
+1. Click **Save.**
+
+**Result:** The cluster is updated to use the new upgrade strategy.
+
+> **Note:** As of Rancher v2.4.0, there is a [known issue](https://github.com/rancher/rancher/issues/25478) in which the Rancher UI doesn't show state of etcd and controlplane as drained, even though they are being drained.
+
+### Maintaining Availability for Applications During Upgrades
+
+_Available as of RKE v1.1.0_
+
+In [this section of the RKE documentation,]({{<baseurl>}}/rke/latest/en/upgrades/maintaining-availability/) you'll learn the requirements to prevent downtime for your applications when upgrading the cluster.
+
+### Configuring the Upgrade Strategy in the cluster.yml
+
+More advanced upgrade strategy configuration options are available by editing the `cluster.yml`.
+
+For details, refer to [Configuring the Upgrade Strategy]({{<baseurl>}}/rke/latest/en/upgrades/configuring-strategy) in the RKE documentation. The section also includes an example `cluster.yml` for configuring the upgrade strategy.
+
+# Troubleshooting
+
+If a node doesn't come up after an upgrade, the `rke up` command errors out.
+
+No upgrade will proceed if the number of unavailable nodes exceeds the configured maximum.
+
+If an upgrade stops, you may need to fix an unavailable node or remove it from the cluster before the upgrade can continue.
+
+A failed node could be in many different states:
+
+- Powered off
+- Unavailable
+- User drains a node while upgrade is in process, so there are no kubelets on the node
+- The upgrade itself failed
+
+If the max unavailable number of nodes is reached during an upgrade, Rancher user clusters will be stuck in updating state and not move forward with upgrading any other control plane nodes. It will continue to evaluate the set of unavailable nodes in case one of the nodes becomes available. If the node cannot be fixed, you must remove the node in order to continue the upgrade.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/_index.md b/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/_index.md
new file mode 100644
index 00000000000..e8978ea379b
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/_index.md
@@ -0,0 +1,6 @@
+---
+title: Upgrading the Enterprise Cluster Manager
+weight: 2
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/rollbacks/_index.md b/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/rollbacks/_index.md
new file mode 100644
index 00000000000..7ebe57e5c73
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/rollbacks/_index.md
@@ -0,0 +1,6 @@
+---
+title: Rolling Back the Enterprise Cluster Manager
+weight: 1
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/istio/_index.md b/content/rancher/v2.5/en/applications/istio/_index.md
new file mode 100644
index 00000000000..a919ab17a40
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/_index.md
@@ -0,0 +1,84 @@
+---
+title: Istio
+weight: 5
+---
+
+> This section is under construction.
+
+ [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
+
+ As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
+
+Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+
+This service mesh provides features that include but are not limited to the following:
+
+- Traffic management features
+- Enhanced monitoring and tracing
+- Service discovery and routing
+- Secure connections and service-to-service authentication with mutual TLS
+- Load balancing
+- Automatic retries, backoff, and circuit breaking
+
+After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
+
+Rancher's Istio integration comes with comprehensive visualization aids:
+
+- **Trace the root cause of errors with Jaeger.** [Jaeger](https://www.jaegertracing.io/) is an open-source tool that provides a UI for a distributed tracing system, which is useful for root cause analysis and for determining what causes poor performance. Distributed tracing allows you to view an entire chain of calls, which might originate with a user request and traverse dozens of microservices.
+- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
+- **Gain insights from time series analytics with Grafana dashboards.** [Grafana](https://grafana.com/) is an analytics platform that allows you to query, visualize, alert on and understand the data gathered by Prometheus.
+- **Write custom queries for time series data with the Prometheus UI.** [Prometheus](https://prometheus.io/) is a systems monitoring and alerting toolkit. Prometheus scrapes data from your cluster, which is then used by Grafana. A Prometheus UI is also integrated into Rancher, and lets you write custom queries for time series data and see the results in the UI.
+
+# Prerequisites
+
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
+
+# Setup Guide
+
+Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
+
+# Disabling Istio
+
+To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+
+# Accessing Visualizations
+
+> By default, only cluster owners have access to Jaeger and Kiali. For instructions on how to allow project members to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
+
+After Istio is set up in a cluster, Grafana, Prometheus, Jaeger, and Kiali are available in the Rancher UI.
+
+Your access to the visualizations depend on your role. Grafana and Prometheus are only available for cluster owners. The Kiali and Jaeger UIs are available only to cluster owners by default, but cluster owners can allow project members to access them by editing the Istio settings. When you go to your project and click **Resources > Istio,** you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
+
+To see the visualizations, go to the cluster where Istio is set up and click **Tools > Istio.** You should see links to each UI at the top of the page.
+
+You can also get to the visualization tools from the project view.
+
+# Viewing the Kiali Traffic Graph
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. If you are a cluster owner, you can go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
+
+# Viewing Traffic Metrics
+
+Istio’s monitoring features provide visibility into the performance of all your services.
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.** Cluster owners can see all of the metrics, while project members can see a subset of the metrics.
+
+# Architecture
+
+Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
+
+Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
+
+Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
+
+When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
+
+For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
+
+### Two Ingresses
+
+By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
+
+![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/istio/disabling-istio/_index.md b/content/rancher/v2.5/en/applications/istio/disabling-istio/_index.md
new file mode 100644
index 00000000000..d2035689626
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/disabling-istio/_index.md
@@ -0,0 +1,27 @@
+---
+title: Disabling Istio
+weight: 4
+---
+
+This section describes how to disable Istio in a cluster, namespace, or workload.
+
+# Disable Istio in a Cluster
+
+To disable Istio,
+
+1. From the **Global** view, navigate to the cluster that you want to disable Istio for.
+1. Click **Tools > Istio.**
+1. Click **Disable,** then click the red button again to confirm the disable action.
+
+**Result:** The `cluster-istio` application in the cluster's `system` project gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster.
+
+# Disable Istio in a Namespace
+
+1. In the Rancher UI, go to the project that has the namespace where you want to disable Istio.
+1. On the **Workloads** tab, you will see a list of namespaces and the workloads deployed in them. Go to the namespace where you want to disable and click the **&#8942; > Disable Istio Auto Injection.**
+
+**Result:** When workloads are deployed in this namespace, they will not have the Istio sidecar.
+
+# Remove the Istio Sidecar from a Workload
+
+Disable Istio in the namespace, then redeploy the workloads with in it. They will be deployed without the Istio sidecar.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/istio/rbac/_index.md b/content/rancher/v2.5/en/applications/istio/rbac/_index.md
new file mode 100644
index 00000000000..eb6f3c20fa7
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/rbac/_index.md
@@ -0,0 +1,58 @@
+---
+title: Role-based Access Control
+weight: 3
+---
+
+This section describes the permissions required to access Istio features and how to configure access to the Kiali and Jaeger visualizations.
+
+# Cluster-level Access
+
+By default, only cluster administrators can:
+
+- Enable Istio for the cluster
+- Configure resource allocations for Istio
+- View each UI for Prometheus, Grafana, Kiali, and Jaeger
+
+# Project-level Access
+
+After Istio is enabled in a cluster, project owners and members have permission to:
+
+- Enable and disable Istio sidecar auto-injection for namespaces
+- Add the Istio sidecar to workloads
+- View the traffic metrics and traffic graph for the cluster
+- View the Kiali and Jaeger visualizations if cluster administrators give access to project members
+- Configure Istio's resources (such as the gateway, destination rules, or virtual services) with `kubectl` (This does not apply to read-only project members)
+
+# Access to Visualizations
+
+By default,  the Kiali and Jaeger visualizations are restricted to the cluster owner because the information in them could be sensitive.
+
+**Jaeger** provides a UI for a distributed tracing system, which is useful for root cause analysis and for determining what causes poor performance.
+
+**Kiali** provides a diagram that shows the services within a service mesh and how they are connected.
+
+Rancher supports giving groups permission to access Kiali and Jaeger, but not individuals.
+
+To configure who has permission to access the Kiali and Jaeger UI,
+
+1. Go to the cluster view and click **Tools > Istio.**
+1. Then go to the **Member Access** section. If you want to restrict access to certain groups, choose **Allow cluster owner and specified members to access Kiali and Jaeger UI.** Search for the groups that you want to have access to Kiali and Jaeger. If you want all members to have access to the tools, click **Allow all members to access Kiali and Jaeger UI.**
+1. Click **Save.**
+
+**Result:** The access levels for Kiali and Jaeger have been updated.
+
+# Summary of Default Permissions for Istio Users
+
+| Permission                         | Cluster Administrators | Project Owners | Project Members | Read-only Project Members |
+|------------------------------------------|----------------|----------------|-----------------|---------------------------|
+| Enable and disable Istio for the cluster | ✓              |                |                 |                           |
+| Configure Istio resource limits          | ✓              |                |                 |                           |
+| Control who has access to Kiali and the Jaeger UI | ✓     |                |                 |                           |
+| Enable and disable Istio for a namespace | ✓              | ✓              | ✓              |                           |
+| Enable and disable Istio on workloads    | ✓              | ✓              | ✓              |                           |
+| Configure Istio with `kubectl`           | ✓              | ✓              | ✓              |                          |
+| View Prometheus UI and Grafana UI           | ✓              |               |               |                          |
+| View Kiali UI and Jaeger UI ([Configurable](#access-to-visualizations)) | ✓              |                |                |                           |
+| View Istio project dashboard, including traffic metrics* | ✓          | ✓              | ✓            | ✓        |
+
+* By default, only the cluster owner will see the traffic graph. Project members will see only a subset of traffic metrics. Project members cannot see the traffic graph because it comes from Kiali, and access to Kiali is restricted to cluster owners by default.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/istio/release-notes/_index.md b/content/rancher/v2.5/en/applications/istio/release-notes/_index.md
new file mode 100644
index 00000000000..79cadd9be69
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/release-notes/_index.md
@@ -0,0 +1,19 @@
+---
+title: Release Notes
+weight: 5
+---
+
+
+# Istio 1.5.8
+
+### Important note on 1.5.x versions
+
+When upgrading from any 1.4 version of Istio to any 1.5 version, the Rancher installer will delete several resources in order to complete the upgrade, at which point they will be immediately re-installed. This includes the `istio-reader-service-account`. If your Istio installation is using this service account be aware that any secrets tied to the service account will be deleted. Most notably this will **break specific [multi-cluster deployments](https://archive.istio.io/v1.4/docs/setup/install/multicluster/)**. Downgrades back to 1.4 are not possible.
+
+See the official upgrade notes for additional information on the 1.5 release and upgrading from 1.4: https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/
+
+> **Note:** Rancher continues to use the Helm installation method, which produces a different architecture from an istioctl installation.
+
+### Known Issues
+
+* The Kiali traffic graph is currently not working [#24924](https://github.com/istio/istio/issues/24924)
diff --git a/content/rancher/v2.5/en/applications/istio/resources/_index.md b/content/rancher/v2.5/en/applications/istio/resources/_index.md
new file mode 100644
index 00000000000..9b0dea50923
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/resources/_index.md
@@ -0,0 +1,152 @@
+---
+title: CPU and Memory Allocations
+weight: 1
+aliases:
+    - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/_index.md
+    - /rancher/v2.x/en/project-admin/istio/config/_index.md
+---
+_Available as of v2.3.0_
+
+This section describes the minimum recommended computing resources for the Istio components in a cluster.
+
+The CPU and memory allocations for each component are [configurable.](#configuring-resource-allocations)
+
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough CPU and memory to run all of the components of Istio.
+
+> **Tip:** In larger deployments, it is strongly advised that the infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
+
+The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each central Istio component.
+
+In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
+
+Workload | Container | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable
+---------|-----------|---------------|---------------|-------------|-------------|-------------
+istio-pilot |discovery| 500m | 2048Mi | 1000m | 4096Mi | Y
+ istio-telemetry |mixer| 1000m         | 1024Mi        | 4800m       | 4096Mi      | Y            
+ istio-policy | mixer      | 1000m         | 1024Mi        | 4800m       | 4096Mi      | Y            
+ istio-tracing   | jaeger     | 100m          | 100Mi         | 500m        | 1024Mi      | Y            
+ prometheus      | prometheus | 750m          | 750Mi         | 1000m       | 1024Mi      | Y            
+ grafana         | grafana    | 100m          | 100Mi         | 200m        | 512Mi       | Y            
+ Others          | -        | 500m          | 500Mi         | -         | -         | N            
+ **Total**           | **-**        | **3950m**         | **5546Mi**        | **>12300m**         | **>14848Mi**         | **-**   
+
+
+# Configuring Resource Allocations
+
+You can individually configure the resource allocation for each type of Istio component. This section includes the default resource allocations for each component.
+
+To make it easier to schedule the workloads to a node, a cluster administrator can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
+
+You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/docs/concepts/what-is-istio).
+
+To configure the resources allocated to an Istio component, 
+
+1. In Rancher, go to the cluster where you have Istio installed.
+1. Click **Tools > Istio.** This opens the Istio configuration page.
+1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
+1. Click **Save.**
+
+**Result:** The resource allocations for the Istio components are updated.
+
+## Pilot
+
+[Pilot](https://istio.io/docs/ops/deployment/architecture/#pilot)  provides the following:
+
+- Authentication configuration
+- Service discovery for the Envoy sidecars
+- Traffic management capabilities for intelligent routing (A/B tests and canary rollouts)
+- Configuration for resiliency (timeouts, retries, circuit breakers, etc)
+
+For more information on Pilot, refer to the [documentation](https://istio.io/docs/concepts/traffic-management/#pilot-and-envoy).
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Pilot CPU Limit | CPU resource limit for the istio-pilot pod.| Yes      | 1000
+Pilot CPU Reservation | CPU reservation for the istio-pilot pod. | Yes      | 500
+Pilot Memory Limit | Memory resource limit for the istio-pilot pod. | Yes      | 4096
+Pilot Memory Reservation | Memory resource requests for the istio-pilot pod. | Yes      | 2048
+Trace sampling Percentage | [Trace sampling percentage](https://istio.io/docs/tasks/telemetry/distributed-tracing/overview/#trace-sampling) | Yes      | 1
+Pilot Selector | Ability to select the nodes in which istio-pilot pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
+
+## Mixer
+
+[Mixer](https://istio.io/docs/ops/deployment/architecture/#mixer)  enforces access control and usage policies across the service mesh. It also integrates with plugins for monitoring tools such as Prometheus. The Envoy sidecar proxy passes telemetry data and monitoring data to Mixer, and Mixer passes the monitoring data to Prometheus.
+
+For more information on Mixer, policies and telemetry, refer to the [documentation](https://istio.io/docs/concepts/policies-and-telemetry/).
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Mixer Telemetry CPU Limit | CPU resource limit for the istio-telemetry pod.| Yes                      | 4800
+Mixer Telemetry CPU Reservation | CPU reservation for the istio-telemetry pod.| Yes                      | 1000
+Mixer Telemetry Memory Limit | Memory resource limit for the istio-telemetry pod.| Yes                      | 4096
+Mixer Telemetry Memory Reservation | Memory resource requests for the istio-telemetry pod.| Yes                      | 1024
+Enable Mixer Policy | Whether or not to deploy the istio-policy. | Yes                      | False
+Mixer Policy CPU Limit | CPU resource limit for the istio-policy pod. | Yes, when policy enabled | 4800
+Mixer Policy CPU Reservation | CPU reservation for the istio-policy pod. | Yes, when policy enabled | 1000
+Mixer Policy Memory Limit | Memory resource limit for the istio-policy pod. | Yes, when policy enabled | 4096
+Mixer Policy Memory Reservation | Memory resource requests for the istio-policy pod. | Yes, when policy enabled | 1024
+Mixer Selector | Ability to select the nodes in which istio-policy and istio-telemetry pods are deployed to. To use this option, the nodes must have labels. | No                       | n/a
+
+## Tracing
+
+[Distributed tracing](https://istio.io/docs/tasks/telemetry/distributed-tracing/overview/) enables users to track a request through a service mesh. This makes it easier to troubleshoot problems with latency, parallelism and serialization.
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Enable Tracing | Whether or not to deploy the istio-tracing. | Yes | True
+Tracing CPU Limit | CPU resource limit for the istio-tracing pod.  | Yes      | 500
+Tracing CPU Reservation | CPU reservation for the istio-tracing pod. | Yes      | 100
+Tracing Memory Limit | Memory resource limit for the istio-tracing pod. | Yes      | 1024
+Tracing Memory Reservation | Memory resource requests for the istio-tracing pod.  | Yes      | 100
+Tracing Selector | Ability to select the nodes in which tracing pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
+
+## Ingress Gateway
+
+The Istio gateway allows Istio features such as monitoring and route rules to be applied to traffic entering the cluster. This gateway is a prerequisite for outside traffic to make requests to Istio.
+
+For more information, refer to the [documentation](https://istio.io/docs/tasks/traffic-management/ingress/).
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Enable Ingress Gateway | Whether or not to deploy the istio-ingressgateway. | Yes      | False
+Service Type of Istio Ingress Gateway | How to expose the gateway. You can choose NodePort or Loadbalancer | Yes      | NodePort
+Http2 Port | The NodePort for http2 requests  | Yes      | 31380
+Https Port | The NodePort for https requests  | Yes      | 31390
+Load Balancer IP | Ingress Gateway Load Balancer IP | No       | n/a
+Load Balancer Source Ranges | Ingress Gateway Load Balancer Source Ranges | No       | n/a
+Ingress Gateway CPU Limit | CPU resource limit for the istio-ingressgateway pod. | Yes      | 2000
+Ingress Gateway CPU Reservation | CPU reservation for the istio-ingressgateway pod. | Yes      | 100
+Ingress Gateway Memory Limit | Memory resource limit for the istio-ingressgateway pod. | Yes      | 1024
+Ingress Gateway Memory Reservation | Memory resource requests for the istio-ingressgateway pod. | Yes      | 128
+Ingress Gateway Selector | Ability to select the nodes in which istio-ingressgateway pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
+
+## Prometheus
+
+You can query for Istio metrics using Prometheus. Prometheus is an open-source systems monitoring and alerting toolkit.
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Prometheus CPU Limit | CPU resource limit for the Prometheus pod.| Yes      | 1000
+Prometheus CPU Reservation | CPU reservation for the Prometheus pod.| Yes      | 750
+Prometheus Memory Limit | Memory resource limit for the Prometheus pod.| Yes      | 1024
+Prometheus Memory Reservation | Memory resource requests for the Prometheus pod.| Yes      | 750
+Retention for Prometheus | How long your Prometheus instance retains data | Yes      | 6
+Prometheus Selector | Ability to select the nodes in which Prometheus pod is deployed to. To use this option, the nodes must have labels.| No       | n/a
+
+## Grafana
+
+You can visualize metrics with Grafana. Grafana lets you visualize Istio traffic data scraped by Prometheus.
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Enable Grafana | Whether or not to deploy the Grafana.| Yes                                                         | True
+Grafana CPU Limit | CPU resource limit for the Grafana pod.| Yes, when Grafana enabled                                   | 200
+Grafana CPU Reservation | CPU reservation for the Grafana pod.| Yes, when Grafana enabled                                   | 100
+Grafana Memory Limit | Memory resource limit for the Grafana pod.| Yes, when Grafana enabled                                   | 512
+Grafana Memory Reservation | Memory resource requests for the Grafana pod.| Yes, when Grafana enabled                                   | 100
+Grafana Selector | Ability to select the nodes in which Grafana pod is deployed to. To use this option, the nodes must have labels. | No                                                          | n/a
+Enable Persistent Storage for Grafana | Enable Persistent Storage for Grafana | Yes, when Grafana enabled                                   | False
+Source | Use a Storage Class to provision a new persistent volume or Use an existing persistent volume claim | Yes, when Grafana enabled and enabled PV                    | Use SC
+Storage Class | Storage Class for provisioning PV for Grafana | Yes, when Grafana enabled, enabled PV and use storage class | Use the default class
+Persistent Volume Size | The size for the PV you would like to provision for Grafana | Yes, when Grafana enabled, enabled PV and use storage class | 5Gi
+Existing Claim | Use existing PVC for Grafana | Yes, when Grafana enabled, enabled PV and use existing PVC  | n/a
diff --git a/content/rancher/v2.5/en/applications/istio/setup/_index.md b/content/rancher/v2.5/en/applications/istio/setup/_index.md
new file mode 100644
index 00000000000..da1fbcacc7a
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/_index.md
@@ -0,0 +1,28 @@
+---
+title: Setup Guide
+weight: 2
+---
+
+This section describes how to enable Istio and start using it in your projects.
+
+This section assumes that you have Rancher installed, and you have a Rancher-provisioned Kubernetes cluster where you would like to set up Istio.
+
+If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below.
+
+> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
+
+1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster)
+1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
+1. [Select the nodes where the main Istio components will be deployed.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
+1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
+1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
+1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
+1. [Generate traffic and see Istio in action.](#generate-traffic-and-see-istio-in-action)
+
+# Prerequisites
+
+This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v2.x/en/installation) and you have already [provisioned a separate Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning) on which you will install Istio.
+
+The nodes in your cluster must meet the [CPU and memory requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/)
+
+The workloads and services that you want to be controlled by Istio must meet [Istio's requirements.](https://istio.io/docs/setup/additional-setup/requirements/)
diff --git a/content/rancher/v2.5/en/applications/istio/setup/deploy-workloads/_index.md b/content/rancher/v2.5/en/applications/istio/setup/deploy-workloads/_index.md
new file mode 100644
index 00000000000..8e52d678bbf
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/deploy-workloads/_index.md
@@ -0,0 +1,322 @@
+---
+title: 4. Add Deployments and Services with the Istio Sidecar
+weight: 4
+---
+
+> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have Istio enabled.  
+
+Enabling Istio in a namespace only enables automatic sidecar injection for new workloads. To enable the Envoy sidecar for existing workloads, you need to enable it manually for each workload.
+
+To inject the Istio sidecar on an existing workload in the namespace, go to the workload, click the **&#8942;,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
+
+Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see istio-init and istio-proxy alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
+
+### 3. Add Deployments and Services
+
+Next we add the Kubernetes resources for the sample deployments and services for the BookInfo app in Istio's documentation.
+
+1. Go to the project inside the cluster you want to deploy the workload on.
+1. In Workloads, click **Import YAML.**
+1. Copy the below resources into the form.
+1. Click **Import.**
+
+This will set up the following sample resources from Istio's example BookInfo app:
+
+Details service and deployment:
+
+- A `details` Service
+- A ServiceAccount for `bookinfo-details`
+- A `details-v1` Deployment
+
+Ratings service and deployment:
+
+- A `ratings` Service
+- A ServiceAccount for `bookinfo-ratings`
+- A `ratings-v1` Deployment
+
+Reviews service and deployments (three versions):
+
+- A `reviews` Service
+- A ServiceAccount for `bookinfo-reviews`
+- A `reviews-v1` Deployment
+- A `reviews-v2` Deployment
+- A `reviews-v3` Deployment
+
+Productpage service and deployment:
+
+This is the main page of the app, which will be visible from a web browser. The other services will be called from this page.
+
+- A `productpage` service
+- A ServiceAccount for `bookinfo-productpage`
+- A `productpage-v1` Deployment
+
+### Resource YAML
+
+```yaml
+# Copyright 2017 Istio Authors
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+##################################################################################################
+# Details service
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: details
+  labels:
+    app: details
+    service: details
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: details
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-details
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: details-v1
+  labels:
+    app: details
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: details
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: details
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-details
+      containers:
+      - name: details
+        image: docker.io/istio/examples-bookinfo-details-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+##################################################################################################
+# Ratings service
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: ratings
+  labels:
+    app: ratings
+    service: ratings
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: ratings
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-ratings
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ratings-v1
+  labels:
+    app: ratings
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ratings
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: ratings
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-ratings
+      containers:
+      - name: ratings
+        image: docker.io/istio/examples-bookinfo-ratings-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+##################################################################################################
+# Reviews service
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: reviews
+  labels:
+    app: reviews
+    service: reviews
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: reviews
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-reviews
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: reviews-v1
+  labels:
+    app: reviews
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: reviews
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: reviews
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-reviews
+      containers:
+      - name: reviews
+        image: docker.io/istio/examples-bookinfo-reviews-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: reviews-v2
+  labels:
+    app: reviews
+    version: v2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: reviews
+      version: v2
+  template:
+    metadata:
+      labels:
+        app: reviews
+        version: v2
+    spec:
+      serviceAccountName: bookinfo-reviews
+      containers:
+      - name: reviews
+        image: docker.io/istio/examples-bookinfo-reviews-v2:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: reviews-v3
+  labels:
+    app: reviews
+    version: v3
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: reviews
+      version: v3
+  template:
+    metadata:
+      labels:
+        app: reviews
+        version: v3
+    spec:
+      serviceAccountName: bookinfo-reviews
+      containers:
+      - name: reviews
+        image: docker.io/istio/examples-bookinfo-reviews-v3:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+##################################################################################################
+# Productpage services
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: productpage
+  labels:
+    app: productpage
+    service: productpage
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: productpage
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-productpage
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: productpage-v1
+  labels:
+    app: productpage
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: productpage
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: productpage
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-productpage
+      containers:
+      - name: productpage
+        image: docker.io/istio/examples-bookinfo-productpage-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+```
+
+### [Next: Set up the Istio Gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
diff --git a/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/_index.md
new file mode 100644
index 00000000000..a98090a28ca
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/_index.md
@@ -0,0 +1,24 @@
+---
+title: 1. Enable Istio in the Cluster
+weight: 1
+---
+
+This cluster uses the default Nginx controller to allow traffic into the cluster.
+
+A Rancher [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) can configure Rancher to deploy Istio in a Kubernetes cluster.
+
+> If the cluster has a Pod Security Policy enabled there are [prerequisites steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
+
+1. From the **Global** view, navigate to the **cluster** where you want to enable Istio.
+1. Click **Tools > Istio.**
+1. Optional: Configure member access and [resource limits]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/) for the Istio components. Ensure you have enough resources on your worker nodes to enable Istio.
+1. Click **Enable**.
+1. Click **Save**.
+
+**Result:** Istio is enabled at the cluster level.
+
+The Istio application, `cluster-istio`, is added as an application to the cluster's `system` project.
+
+When Istio is enabled in the cluster, the label for Istio sidecar auto injection,`istio-injection=enabled`, will be automatically added to each new namespace in this cluster. This automatically enables Istio sidecar injection in all new workloads that are deployed in those namespaces. You will need to manually enable Istio in preexisting namespaces and workloads.
+
+### [Next: Enable Istio in a Namespace]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
diff --git a/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md b/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
new file mode 100644
index 00000000000..f31369cfc61
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
@@ -0,0 +1,48 @@
+---
+title: Enable Istio with Pod Security Policies
+---
+
+ >**Note:** The following guide is only for RKE provisioned clusters.
+
+If you have restrictive Pod Security Policies enabled, then Istio may not be able to function correctly, because it needs certain permissions in order to install itself and manage pod infrastructure. In this section, we will configure a cluster with PSPs enabled for an Istio install, and also set up the Istio CNI plugin. 
+
+The Istio CNI plugin removes the need for each application pod to have a privileged `NET_ADMIN` container. For further information, see the [Istio CNI Plugin docs](https://istio.io/docs/setup/additional-setup/cni). Please note that the [Istio CNI Plugin is in alpha](https://istio.io/about/feature-stages/).
+
+- 1. [Configure the System Project Policy to allow Istio install.](#2-configure-the-system-project-policy-to-allow-istio-install)
+- 2. [Install the CNI plugin in the System project.](#3-install-the-cni-plugin-in-the-system-project)
+- 3. [Install Istio.](#4-install-istio)
+
+### 1. Configure the System Project Policy to allow Istio install
+
+1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
+1. Find the **Project: System** project and select the **&#8942; > Edit**.
+1. Change the Pod Security Policy option to be unrestricted, then click Save.
+
+
+### 2. Install the CNI Plugin in the System Project
+
+1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
+1. Select the **Project: System** project.
+1. Choose **Tools > Catalogs** in the navigation bar.
+1. Add a catalog with the following:
+	1. Name: istio-cni
+	1. Catalog URL: https://github.com/istio/cni
+	1. Branch: The branch that matches your current release, for example: `release-1.4`.
+1. From the main menu select **Apps**
+1. Click Launch and select istio-cni
+1. Update the namespace to be "kube-system"
+1. In the answers section, click "Edit as YAML" and paste in the following, then click launch:
+
+```
+---
+  logLevel: "info"
+  excludeNamespaces:
+    - "istio-system"
+    - "kube-system"
+```
+
+### 3. Install Istio
+
+Follow the [primary instructions]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/), adding a custom answer: `istio_cni.enabled: true`.
+
+After Istio has finished installing, the Apps page in System Projects should show both istio and `istio-cni` applications deployed successfully. Sidecar injection will now be functional.
diff --git a/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-namespace/_index.md
new file mode 100644
index 00000000000..2f1f6d74786
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-namespace/_index.md
@@ -0,0 +1,48 @@
+---
+title: 2. Enable Istio in a Namespace
+weight: 2
+---
+
+You will need to manually enable Istio in each namespace that you want to be tracked or controlled by Istio. When Istio is enabled in a namespace, the Envoy sidecar proxy will be automatically injected into all new workloads that are deployed in the namespace.
+
+This namespace setting will only affect new workloads in the namespace. Any preexisting workloads will need to be re-deployed to leverage the sidecar auto injection.
+
+> **Prerequisite:** To enable Istio in a namespace, the cluster must have Istio enabled.  
+
+1. In the Rancher UI, go to the cluster view. Click the **Projects/Namespaces** tab.
+1. Go to the namespace where you want to enable the Istio sidecar auto injection and click the **&#8942;.**
+1. Click **Edit.**
+1. In the **Istio sidecar auto injection** section, click **Enable.**
+1. Click **Save.**
+
+**Result:** The namespace now has the label `istio-injection=enabled`. All new workloads deployed in this namespace will have the Istio sidecar injected by default.
+
+### Verifying that Automatic Istio Sidecar Injection is Enabled
+
+To verify that Istio is enabled, deploy a hello-world workload in the namespace. Go to the workload and click the pod name. In the **Containers** section, you should see the `istio-proxy` container.
+
+### Excluding Workloads from Being Injected with the Istio Sidecar
+
+If you need to exclude a workload from getting injected with the Istio sidecar, use the following annotation on the workload:
+
+```
+sidecar.istio.io/inject: “false”
+```
+
+To add the annotation to a workload,
+
+1. From the **Global** view, open the project that has the workload that should not have the sidecar.
+1. Click **Resources > Workloads.**
+1. Go to the workload that should not have the sidecar and click **&#8942; > Edit.**
+1. Click **Show Advanced Options.** Then expand the **Labels & Annotations** section.
+1. Click **Add Annotation.**
+1. In the **Key** field, enter `sidecar.istio.io/inject`.
+1. In the **Value** field, enter `false`.
+1. Click **Save.**
+
+**Result:** The Istio sidecar will not be injected into the workload.
+
+> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. 
+
+
+### [Next: Select the Nodes ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/istio/setup/gateway/_index.md b/content/rancher/v2.5/en/applications/istio/setup/gateway/_index.md
new file mode 100644
index 00000000000..47c9ff33812
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/gateway/_index.md
@@ -0,0 +1,130 @@
+---
+title: 5. Set up the Istio Gateway
+weight: 5
+---
+
+The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. 
+
+You can use the NGINX ingress controller with or without Istio installed. If this is the only gateway to your cluster, Istio will be able to route traffic from service to service, but Istio will not be able to receive traffic from outside the cluster.
+
+To allow Istio to receive external traffic, you need to enable Istio's gateway, which works as a north-south proxy for external traffic. When you enable the Istio gateway, the result is that your cluster will have two ingresses.
+
+You will also need to set up a Kubernetes gateway for your services. This Kubernetes resource points to Istio's implementation of the ingress gateway to the cluster.
+
+You can route traffic into the service mesh with a load balancer or just Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
+
+For more information on the Istio gateway, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/gateway/) 
+
+![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
+
+# Enable the Istio Gateway
+
+The ingress gateway is a Kubernetes service that will be deployed in your cluster. There is only one Istio gateway per cluster.
+
+1. Go to the cluster where you want to allow outside traffic into Istio.
+1. Click **Tools > Istio.**
+1. Expand the **Ingress Gateway** section.
+1. Under **Enable Ingress Gateway,** click **True.** The default type of service for the Istio gateway is NodePort. You can also configure it as a [load balancer.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/)
+1. Optionally, configure the ports, service types, node selectors and tolerations, and resource requests and limits for this service. The default resource requests for CPU and memory are the minimum recommended resources.
+1. Click **Save.**
+
+**Result:** The gateway is deployed, which allows Istio to receive traffic from outside the cluster.
+
+# Add a Kubernetes Gateway that Points to the Istio Gateway
+
+To allow traffic to reach Ingress, you will also need to provide a Kubernetes gateway resource in your YAML that points to Istio's implementation of the ingress gateway to the cluster.
+
+1. Go to the namespace where you want to deploy the Kubernetes gateway and click **Import YAML.**
+1. Upload the gateway YAML as a file or paste it into the form. An example gateway YAML is provided below.
+1.  Click **Import.**
+
+```yaml
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: bookinfo-gateway
+spec:
+  selector:
+    istio: ingressgateway # use istio default controller
+  servers:
+    - port:
+        number: 80
+        name: http
+        protocol: HTTP
+      hosts:
+        - "*"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: bookinfo
+spec:
+  hosts:
+  - "*"
+  gateways:
+  - bookinfo-gateway
+  http:
+  - match:
+    - uri:
+        exact: /productpage
+    - uri:
+        prefix: /static
+    - uri:
+        exact: /login
+    - uri:
+        exact: /logout
+    - uri:
+        prefix: /api/v1/products
+    route:
+    - destination:
+        host: productpage
+        port:
+          number: 9080
+```
+
+**Result:** You have configured your gateway resource so that Istio can receive traffic from outside the cluster.
+
+Confirm that the resource exists by running:
+```
+kubectl get gateway -A
+```
+
+The result should be something like this:
+```
+NAME               AGE
+bookinfo-gateway   64m
+```
+
+### Access the ProductPage Service from a Web Browser
+
+To test and see if the BookInfo app deployed correctly, the app can be viewed a web browser using the Istio controller IP and port, combined with the request name specified in your Kubernetes gateway resource:
+
+`http://<IP of Istio controller>:<Port of istio controller>/productpage`
+
+To get the ingress gateway URL and port,
+
+1. Go to the `System` project in your cluster.
+1. Within the `System` project, go to `Resources` > `Workloads` then scroll down to the `istio-system` namespace. 
+1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Under the name of this workload, you should see links, such as `80/tcp`.
+1. Click one of those links. This should show you the URL of the ingress gateway in your web browser. Append `/productpage` to the URL.
+
+**Result:** You should see the BookInfo app in the web browser.
+
+For help inspecting the Istio controller URL and ports, try the commands the [Istio documentation.](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#determining-the-ingress-ip-and-ports)
+
+# Troubleshooting
+
+The [official Istio documentation](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#troubleshooting) suggests `kubectl` commands to inspect the correct ingress host and ingress port for external requests.
+
+### Confirming that the Kubernetes Gateway Matches Istio's Ingress Controller
+
+You can try the steps in this section to make sure the Kubernetes gateway is configured properly.
+
+In the gateway resource, the selector refers to Istio's default ingress controller by its label, in which the key of the label is `istio` and the value is `ingressgateway`.  To make sure the label is appropriate for the gateway, do the following:
+
+1. Go to the `System` project in your cluster.
+1. Within the `System` project, go to the namespace `istio-system`. 
+1. Within `istio-system`, there is a workload named `istio-ingressgateway`.
+1. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
+
+### [Next: Set up Istio's Components for Traffic Management]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
diff --git a/content/rancher/v2.5/en/applications/istio/setup/node-selectors/_index.md b/content/rancher/v2.5/en/applications/istio/setup/node-selectors/_index.md
new file mode 100644
index 00000000000..994656361e3
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/node-selectors/_index.md
@@ -0,0 +1,38 @@
+---
+title: 3. Select the Nodes Where Istio Components Will be Deployed
+weight: 3
+---
+
+> **Prerequisite:** Your cluster needs a worker node that can designated for Istio. The worker node should meet the [resource requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources)
+
+This section describes how use node selectors to configure Istio components to be deployed on a designated node.
+
+In larger deployments, it is strongly advised that Istio's infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
+
+# Adding a Label to the Istio Node
+
+First, add a label to the node where Istio components should be deployed. This label can have any key-value pair. For this example, we will use the key `istio` and the value `enabled`.
+
+1. From the cluster view, go to the **Nodes** tab.
+1. Go to a worker node that will host the Istio components and click **&#8942; > Edit.**
+1. Expand the **Labels & Annotations** section.
+1. Click **Add Label.**
+1. In the fields that appear, enter `istio` for the key and `enabled` for the value.
+1. Click **Save.**
+
+**Result:** A worker node has the label that will allow you to designate it for Istio components.
+
+# Configuring Istio Components to Use the Labeled Node
+
+Configure each Istio component to be deployed to the node with the Istio label. Each Istio component can be configured individually, but in this tutorial, we will configure all of the components to be scheduled on the same node for the sake of simplicity.
+
+For larger deployments, it is recommended to schedule each component of Istio onto separate nodes.
+
+1. From the cluster view, click **Tools > Istio.**
+1. Expand the **Pilot** section and click **Add Selector** in the form that appears. Enter the node selector label that you added to the Istio node. In our case, we are using the key `istio` and the value `enabled.`
+1. Repeat the previous step for the **Mixer** and **Tracing** sections.
+1. Click **Save.**
+
+**Result:** The Istio components will be deployed on the Istio node.
+
+### [Next: Add Deployments and Services]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/istio/setup/set-up-traffic-management/_index.md b/content/rancher/v2.5/en/applications/istio/setup/set-up-traffic-management/_index.md
new file mode 100644
index 00000000000..2048e779265
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/set-up-traffic-management/_index.md
@@ -0,0 +1,61 @@
+---
+title: 6. Set up Istio's Components for Traffic Management
+weight: 6
+---
+
+A central advantage of traffic management in Istio is that it allows dynamic request routing. Some common applications for dynamic request routing include canary deployments and blue/green deployments. The two key resources in Istio traffic management are *virtual services* and *destination rules*.
+
+- [Virtual services](https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/) intercept and direct traffic to your Kubernetes services, allowing you to divide percentages of traffic from a request to different services. You can use them to define a set of routing rules to apply when a host is addressed.
+- [Destination rules](https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/) serve as the single source of truth about which service versions are available to receive traffic from virtual services. You can use these resources to define policies that apply to traffic that is intended for a service after routing has occurred.
+
+This section describes how to add an example virtual service that corresponds to the `reviews` microservice in the sample BookInfo app. The purpose of this service is to divide traffic between two versions of the `reviews` service.
+
+In this example, we take the traffic to the `reviews` service and intercept it so that 50 percent of it goes to `v1` of the service and 50 percent goes to `v2`.
+
+After this virtual service is deployed, we will generate traffic and see from the Kiali visualization that traffic is being routed evenly between the two versions of the service.
+
+To deploy the virtual service and destination rules for the `reviews` service,
+
+1. Go to the project view and click **Import YAML.**
+1. Copy resources below into the form.
+1.  Click **Import.**
+
+```
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: reviews
+spec:
+  hosts:
+  - reviews
+  http:
+  - route:
+    - destination:
+        host: reviews
+        subset: v1
+      weight: 50
+    - destination:
+        host: reviews
+        subset: v3
+      weight: 50
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: reviews
+spec:
+  host: reviews
+  subsets:
+  - name: v1
+    labels:
+      version: v1
+  - name: v2
+    labels:
+      version: v2
+  - name: v3
+    labels:
+      version: v3
+```
+**Result:** When you generate traffic to this service (for example, by refreshing the ingress gateway URL), the Kiali traffic graph will reflect that traffic to the `reviews` service is divided evenly between `v1` and `v3`.
+
+### [Next: Generate and View Traffic]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic)
diff --git a/content/rancher/v2.5/en/applications/istio/setup/view-traffic/_index.md b/content/rancher/v2.5/en/applications/istio/setup/view-traffic/_index.md
new file mode 100644
index 00000000000..bb6c979e28d
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/istio/setup/view-traffic/_index.md
@@ -0,0 +1,26 @@
+---
+title: 7. Generate and View Traffic
+weight: 7
+---
+
+This section describes how to view the traffic that is being managed by Istio.
+
+# The Kiali Traffic Graph
+
+Rancher integrates a Kiali graph into the Rancher UI. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
+
+To see the traffic graph,
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. Go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
+
+If you refresh the URL to the BookInfo app several times, you should be able to see green arrows on the Kiali graph showing traffic to `v1` and `v3` of the `reviews` service. The control panel on the right side of the graph lets you configure details including how many minutes of the most recent traffic should be shown on the graph.
+
+For additional tools and visualizations, you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
+
+# Viewing Traffic Metrics
+
+Istio’s monitoring features provide visibility into the performance of all your services.
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.**
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/logging/_index.md b/content/rancher/v2.5/en/applications/logging/_index.md
new file mode 100644
index 00000000000..2fd4fd88181
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/logging/_index.md
@@ -0,0 +1,120 @@
+---
+title: Rancher Integration with Logging Services
+description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster.
+metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
+weight: 3
+---
+
+Logging is helpful because it allows you to:
+
+- Capture and analyze the state of your cluster
+- Look for trends in your environment
+- Save your logs to a safe location outside of your cluster
+- Stay informed of events like a container crashing, a pod eviction, or a node dying
+- More easily debug and troubleshoot problems
+
+Rancher supports integration with the following services:
+
+- Elasticsearch
+- Splunk
+- Kafka
+- Syslog
+- Fluentd
+
+This section covers the following topics:
+
+- [How logging integrations work](#how-logging-integrations-work)
+- [Requirements](#requirements)
+- [Logging scope](#logging-scope)
+- [Enabling cluster logging](#enabling-cluster-logging)
+
+# How Logging Integrations Work
+
+Rancher can integrate with popular external services used for event streams, telemetry, or search. These services can log errors and warnings in your Kubernetes infrastructure to a stream.
+
+These services collect container log events, which are saved to the `/var/log/containers` directory on each of your nodes. The service collects both standard and error events. You can then log into your services to review the events collected, leveraging each service's unique features.
+
+When configuring Rancher to integrate with these services, you'll have to point Rancher toward the service's endpoint and provide authentication information.
+
+Additionally, you'll have the opportunity to enter key-value pairs to filter the log events collected. The service will only collect events for containers marked with your configured key-value pairs.
+
+>**Note:** You can only configure one logging service per cluster or per project.
+
+# Requirements
+
+The Docker daemon on each node in the cluster should be [configured](https://docs.docker.com/config/containers/logging/configure/) with the (default) log-driver: `json-file`. You can check the log-driver by running the following command:
+
+```
+$ docker info | grep 'Logging Driver'
+Logging Driver: json-file
+```
+
+# Logging Scope
+
+You can configure logging at either cluster level or project level.
+
+- Cluster logging writes logs for every pod in the cluster, i.e. in all the projects. For [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), it also writes logs for all the Kubernetes system components.
+- [Project logging]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/logging/) writes logs for every pod in that particular project.
+
+Logs that are sent to your logging service are from the following locations:
+
+  - Pod logs stored at `/var/log/containers`.
+  - Kubernetes system components logs stored at `/var/lib/rancher/rke/log/`.
+
+# Enabling Cluster Logging
+
+As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to send Kubernetes logs to a logging service.
+
+1. From the **Global** view, navigate to the cluster that you want to configure cluster logging.
+
+1. Select **Tools > Logging** in the navigation bar.
+
+1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports integration with the following services:
+
+   - [Elasticsearch]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/)
+   - [Splunk]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/splunk/)
+   - [Kafka]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/kafka/)
+   - [Syslog]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/syslog/)
+   - [Fluentd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/)
+
+1. (Optional) Instead of using the UI to configure the logging services, you can enter custom advanced configurations by clicking on **Edit as File**, which is located above the logging targets. This link is only visible after you select a logging service.
+
+    - With the file editor, enter raw fluentd configuration for any logging service. Refer to the documentation for each logging service on how to setup the output configuration.
+
+       - [Elasticsearch Documentation](https://github.com/uken/fluent-plugin-elasticsearch)
+       - [Splunk Documentation](https://github.com/fluent/fluent-plugin-splunk)
+       - [Kafka Documentation](https://github.com/fluent/fluent-plugin-kafka)
+       - [Syslog Documentation](https://github.com/dlackty/fluent-plugin-remote_syslog)
+       - [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/out_forward)
+
+   - If the logging service is using TLS, you also need to complete the **SSL Configuration** form.
+       1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
+
+           - You can use either a self-signed certificate or one provided by a certificate authority.
+
+           - You can generate a self-signed certificate using an openssl command. For example:
+
+                ```
+                openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+                ```
+       2. If you are using a self-signed certificate, provide the **CA Certificate PEM**.
+
+1. (Optional) Complete the **Additional Logging Configuration** form.
+
+    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
+
+    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes data to the logging server. Intervals are measured in seconds.
+
+    1. **Include System Log**. The logs from pods in system project and RKE components will be sent to the target. Uncheck it to exclude the system logs.
+
+1. Click **Test**. Rancher sends a test log to the service.
+
+    > **Note:** This button is replaced with _Dry Run_ if you are using the custom configuration editor. In this case, Rancher calls the fluentd dry run command to validate the configuration.
+
+1. Click **Save**.
+
+**Result:** Rancher is now configured to send logs to the selected service. Log into the logging service so that you can start viewing the logs.
+
+## Related Links
+
+[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
diff --git a/content/rancher/v2.5/en/applications/logging/elasticsearch/_index.md b/content/rancher/v2.5/en/applications/logging/elasticsearch/_index.md
new file mode 100644
index 00000000000..1b50e42bad0
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/logging/elasticsearch/_index.md
@@ -0,0 +1,43 @@
+---
+title: Elasticsearch
+weight: 200
+aliases:
+  - /rancher/v2.x/en/tools/logging/elasticsearch/
+---
+
+If your organization uses [Elasticsearch](https://www.elastic.co/), either on premise or in the cloud, you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Elasticsearch deployment to view logs.
+
+>**Prerequisites:** Configure an [Elasticsearch deployment](https://www.elastic.co/guide/en/cloud/saas-release/ec-create-deployment.html).
+
+## Elasticsearch Deployment Configuration
+
+1. In the **Endpoint** field, enter the IP address and port of your Elasticsearch instance. You can find this information from the dashboard of your Elasticsearch deployment.
+
+    * Elasticsearch usually uses port `9200` for HTTP and `9243` for HTTPS.
+
+1. If you are using [X-Pack Security](https://www.elastic.co/guide/en/x-pack/current/xpack-introduction.html), enter your Elasticsearch **Username** and **Password** for authentication.
+
+1. Enter an [Index Pattern](https://www.elastic.co/guide/en/kibana/current/index-patterns.html).
+
+## SSL Configuration
+
+If your instance of Elasticsearch uses SSL, your **Endpoint** will need to begin with `https://`. With the correct endpoint, the **SSL Configuration** form is enabled and ready to be completed.
+
+1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
+
+    - You can use either a self-signed certificate or one provided by a certificate authority.
+
+    - You can generate a self-signed certificate using an openssl command. For example:
+
+         ```
+         openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+         ```
+
+1. Enter your **Client Key Password**.
+
+1. Enter your **SSL Version**. The default version is `TLSv1_2`.
+
+1. Select whether or not you want to verify your SSL.
+
+    * If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.  
+    * If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
diff --git a/content/rancher/v2.5/en/applications/logging/fluentd/_index.md b/content/rancher/v2.5/en/applications/logging/fluentd/_index.md
new file mode 100644
index 00000000000..42f54794862
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/logging/fluentd/_index.md
@@ -0,0 +1,34 @@
+---
+title: Fluentd
+weight: 600
+---
+
+If your organization uses [Fluentd](https://www.fluentd.org/), you can configure Rancher to send it Kubernetes logs.  Afterwards, you can log into your Fluentd server to view logs.
+
+>**Prerequisites:** Configure Fluentd input forward to receive the event stream.
+>
+>See [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/in_forward) for details.
+
+## Fluentd Configuration
+
+You can add multiple Fluentd Servers. If you want to add additional Fluentd servers, click **Add Fluentd Server**. For each Fluentd server, complete the configuration information:
+
+1. In the **Endpoint** field, enter the address and port of your Fluentd instance, e.g. `http://Fluentd-server:24224`.
+
+1. Enter the **Shared Key** if your Fluentd Server is using a shared key for authentication.
+
+1. Enter the **Username** and **Password** if your Fluentd Server is using username and password for authentication.
+
+1. **Optional:** Enter the **Hostname** of the Fluentd server.
+
+1. Enter the load balancing **Weight** of the Fluentd server. If the weight of one server is 20 and the other server is 30, events will be sent in a 2:3 ratio. If you do not enter a weight, the default weight is 60.
+
+1. If this server is a standby server, check **Use as Standby Only**. Standby servers are used when all other servers are not available.
+
+After adding all the Fluentd servers, you have the option to select **Enable Gzip Compression**. By default, this is enabled because the transferred payload size will be reduced.
+
+## SSL Configuration
+
+If your Fluentd servers are using TLS, you need to select **Use TLS**. If you are using a self-signed certificate, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.
+
+>**Note:** Fluentd does not support self-signed certificates when client authentication is enabled. 
diff --git a/content/rancher/v2.5/en/applications/logging/kafka/_index.md b/content/rancher/v2.5/en/applications/logging/kafka/_index.md
new file mode 100644
index 00000000000..bb2b5ac2344
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/logging/kafka/_index.md
@@ -0,0 +1,43 @@
+---
+title: Kafka
+weight: 400
+aliases:
+  - /rancher/v2.x/en/tools/logging/kafka/
+---
+
+If your organization uses [Kafka](https://kafka.apache.org/), you can configure Rancher to send it Kubernetes logs.  Afterwards, you can log into your Kafka server to view logs.
+
+>**Prerequisite:** You must have a Kafka server configured.
+
+## Kafka Server Configuration
+
+1. Select the type of **Endpoint** your Kafka server is using:
+
+  * **Zookeeper**: Enter the IP address and port. By default, Zookeeper uses port `2181`. Please note that a Zookeeper endpoint cannot enable TLS.
+  * **Broker**: Click on **Add Endpoint**. For each Kafka broker, enter the IP address and port. By default, Kafka brokers use port `9092`.
+
+1. In the **Topic** field, enter the name of a Kafka [topic](https://kafka.apache.org/documentation/#basic_ops_add_topic) that your Kubernetes cluster submits logs to.
+
+## **Broker** Endpoint Type
+
+### SSL Configuration
+
+If your Kafka cluster is using SSL for the **Broker**, you need to complete the **SSL Configuration** form.
+
+1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
+
+1. Provide the **CA Certificate PEM**. You can either copy and paste the certificate or upload it using the **Read from a file** button.
+
+>**Note:** Kafka does not support self-signed certificates when client authentication is enabled. 
+
+### SASL configuration
+
+If your Kafka cluster is using [SASL authentication](https://kafka.apache.org/documentation/#security_sasl) for the Broker, you need to complete the **SASL Configuration** form.
+
+1. Enter the SASL **Username** and **Password**.
+
+1. Select the **SASL Type** that your Kafka cluster is using.
+
+    * If your Kafka is using **Plain**, please ensure your Kafka cluster is using SSL.
+
+    * If your Kafka is using **Scram**, you need to select which **Scram Mechanism** Kafka is using.
diff --git a/content/rancher/v2.5/en/applications/logging/splunk/_index.md b/content/rancher/v2.5/en/applications/logging/splunk/_index.md
new file mode 100644
index 00000000000..0d4edcf49ba
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/logging/splunk/_index.md
@@ -0,0 +1,76 @@
+---
+title: Splunk
+weight: 300
+aliases:
+  - /rancher/v2.x/en/tasks/logging/splunk/
+  - /rancher/v2.x/en/tools/logging/splunk/
+---
+
+If your organization uses [Splunk](https://www.splunk.com/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Splunk server to view logs.
+
+>**Prerequisites:**
+>
+>- Configure HTTP event collection for your Splunk Server (Splunk Enterprise or Splunk Cloud).
+>- Either create a new token or copy an existing token.
+>
+>For more information, see [Splunk Documentation](http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector#About_Event_Collector_tokens).
+
+## Splunk Configuration
+
+1. In the **Endpoint** field, enter the IP address and port for you Splunk instance (i.e. `http://splunk-server:8088`)
+
+    * Splunk usually uses port `8088`. If you're using Splunk Cloud, you'll need to work with [Splunk support](https://www.splunk.com/en_us/support-and-services.html) to get an endpoint URL.
+
+1. Enter the **Token** you obtained while completing the prerequisites (i.e., when you created a token in Splunk).
+
+1. In the **Source** field, enter the name of the token as entered in Splunk.
+
+1. **Optional:** Provide one or more [index](http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Aboutindexesandindexers) that's allowed for your token.
+
+## SSL Configuration
+
+If your instance of Splunk uses SSL, your **Endpoint** will need to begin with `https://`. With the correct endpoint, the **SSL Configuration** form is enabled and ready to be completed.
+
+1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
+
+    - You can use either a self-signed certificate or one provided by a certificate authority.
+
+    - You can generate a self-signed certificate using an openssl command. For example:
+
+         ```
+         openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+         ```
+
+1. Enter your **Client Key Password**.
+
+1. Select whether or not you want to verify your SSL.
+
+    * If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.  
+    * If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
+
+## Viewing Logs
+
+1. Log into your Splunk server.
+
+1. Click on **Search & Reporting**. The number of **Indexed Events** listed should be increasing.
+
+1. Click on Data Summary and select the Sources tab.
+  ![View Logs]({{<baseurl>}}/img/rancher/splunk/splunk4.jpg)
+
+1. To view the actual logs, click on the source that you declared earlier.
+  ![View Logs]({{<baseurl>}}/img/rancher/splunk/splunk5.jpg)
+
+## Troubleshooting
+
+You can use curl to see if **HEC** is listening for HTTP event data.
+
+```
+$ curl http://splunk-server:8088/services/collector/event \
+    -H 'Authorization: Splunk 8da70994-b1b0-4a79-b154-bfaae8f93432' \
+    -d '{"event": "hello world"}'
+```
+
+If Splunk is configured correctly, you should receive **json** data returning `success code 0`. You should be able
+to send logging data to HEC.
+
+If you received an error, check your configuration in Splunk and Rancher.
diff --git a/content/rancher/v2.5/en/applications/logging/syslog/_index.md b/content/rancher/v2.5/en/applications/logging/syslog/_index.md
new file mode 100644
index 00000000000..e5aa8f8482f
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/logging/syslog/_index.md
@@ -0,0 +1,43 @@
+---
+title: Syslog
+weight: 500
+aliases:
+  - /rancher/v2.x/en/tools/logging/syslog/
+---
+
+If your organization uses [Syslog](https://tools.ietf.org/html/rfc5424), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Syslog server to view logs.
+
+>**Prerequisite:** You must have a Syslog server configured.
+
+If you are using rsyslog, please make sure your rsyslog authentication mode is `x509/name`.
+
+## Syslog Server Configuration
+
+1. In the **Endpoint** field, enter the IP address and port for your Syslog server. Additionally, in the dropdown, select the protocol that your Syslog server uses.
+
+1. In the **Program** field, enter the name of the application sending logs to your Syslog server, e.g. `Rancher`.
+
+1. If you are using a cloud logging service, e.g. [Sumologic](https://www.sumologic.com/), enter a **Token** that authenticates with your Syslog server. You will need to create this token in the cloud logging service.
+
+1. Select a **Log Severity** for events that are logged to the Syslog server. For more information on each severity level, see the [Syslog protocol documentation](https://tools.ietf.org/html/rfc5424#page-11).
+
+    - By specifying a **Log Severity** does not mean that will act as a filtering mechanism for logs. To do that you should use a parser on the Syslog server.
+
+## Encryption Configuration
+
+If your Syslog server is using **TCP** protocol and uses TLS, you need to select **Use TLS** and complete the **Encryption Configuration** form.
+
+1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
+
+    - You can use either a self-signed certificate or one provided by a certificate authority.
+
+    - You can generate a self-signed certificate using an openssl command. For example:
+
+         ```
+         openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+         ```
+
+1. Select whether or not you want to verify your SSL.
+
+    * If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.  
+    * If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
diff --git a/content/rancher/v2.5/en/applications/longhorn-storage/_index.md b/content/rancher/v2.5/en/applications/longhorn-storage/_index.md
new file mode 100644
index 00000000000..31899c90ba1
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/longhorn-storage/_index.md
@@ -0,0 +1,6 @@
+---
+title: Longhorn Storage
+weight: 10
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/managing-applications/_index.md b/content/rancher/v2.5/en/applications/managing-applications/_index.md
new file mode 100644
index 00000000000..70120ac4e64
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/_index.md
@@ -0,0 +1,101 @@
+---
+title: Managing Applications
+description: Rancher enables the use of catalogs to repeatedly deploy applications easily. Catalogs are GitHub or Helm Chart repositories filled with deployment-ready apps.
+weight: 1
+---
+
+> This section is under construction.
+
+Rancher provides the ability to use a catalog of Helm charts that make it easy to repeatedly deploy applications.
+
+- **Catalogs** are GitHub repositories or Helm Chart repositories filled with applications that are ready-made for deployment. Applications are bundled in objects called _Helm charts_.
+- **Helm charts** are a collection of files that describe a related set of Kubernetes resources. A single chart might be used to deploy something simple, like a memcached pod, or something complex, like a full web app stack with HTTP servers, databases, caches, and so on.
+
+Rancher improves on Helm catalogs and charts. All native Helm charts can work within Rancher, but Rancher adds several enhancements to improve their user experience.
+
+This section covers the following topics:
+
+- [Catalog scopes](#catalog-scopes)
+- [Catalog Helm Deployment Versions](#catalog-helm-deployment-versions)
+- [When to use Helm 3](#when-to-use-helm-3)
+- [Helm 3 Backwards Compatibility](#helm-3-backwards-compatibility)
+- [Built-in global catalogs](#built-in-global-catalogs)
+- [Custom catalogs](#custom-catalogs)
+- [Creating and launching applications](#creating-and-launching-applications)
+- [Chart compatibility with Rancher](#chart-compatibility-with-rancher)
+- [Global DNS](#global-dns)
+
+# Catalog Scopes
+
+Within Rancher, you can manage catalogs at three different scopes. Global catalogs are shared across all clusters and project. There are some use cases where you might not want to share catalogs between different clusters or even projects in the same cluster. By leveraging cluster and project scoped catalogs, you will be able to provide applications for specific teams without needing to share them with all clusters and/or projects.
+
+Scope |  Description | Available As of |
+--- |  --- | --- |
+Global | All clusters and all projects can access the Helm charts in this catalog | v2.0.0 |
+Cluster | All projects in the specific cluster can access the Helm charts in this catalog | v2.2.0 |
+Project | This specific cluster can access the Helm charts in this catalog |  v2.2.0 |
+
+# Catalog Helm Deployment Versions
+
+_Applicable as of v2.4.0_
+
+In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully [backwards compatible]({{<baseurl>}}/rancher/v2.x/en/catalog#helm-3-backwards-compatibility) with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version. This will help reduce app deployment issues as your Rancher users will not need to know which version of your chart is compatible with which Helm version - they can just select a catalog, select an app and deploy a version that has already been vetted for compatibility.
+
+When you create a custom catalog, you will have to configure the catalog to use either Helm 2 or Helm 3. This version cannot be changed later. If the catalog is added with the wrong Helm version, it will need to be deleted and re-added.
+
+When you launch a new app from a catalog, the app will be managed by the catalog's Helm version. A Helm 2 catalog will use Helm 2 to manage all of the apps, and a Helm 3 catalog will use Helm 3 to manage all apps.
+
+By default, catalogs are assumed to be deployed using Helm 2. If you run an app in Rancher prior to v2.4.0, then upgrade to Rancher v2.4.0+, the app will still be managed by Helm 2. If the app was already using a Helm 3 Chart (API version 2) it will no longer work in v2.4.0+. You must either downgrade the chart's API version or recreate the catalog to use Helm 3.
+
+Charts that are specific to Helm 2 should only be added to a Helm 2 catalog, and Helm 3 specific charts should only be added to a Helm 3 catalog.
+
+# When to use Helm 3
+
+_Applicable as of v2.4.0_
+
+- If you want to ensure that the security permissions are being pulled from the kubeconfig file
+- If you want to utilize apiVersion `v2` features such as creating a library chart to reduce code duplication, or moving your requirements from the `requirements.yaml` into the `Chart.yaml`
+
+Overall Helm 3 is a movement towards a more standardized Kubernetes feel. As the Kubernetes community has evolved, standards and best practices have as well. Helm 3 is an attempt to adopt those practices and streamline how charts are maintained.
+
+# Helm 3 Backwards Compatibility
+
+_Applicable as of v2.4.0_
+
+With the use of the OpenAPI schema to validate your rendered templates in Helm 3, you will find charts that worked in Helm 2 may not work in Helm 3. This will require you to update your chart templates to meet the new validation requirements. This is one of the main reasons support for Helm 2 and Helm 3 was provided starting in Rancher 2.4.x, as not all charts can be deployed immediately in Helm 3.
+
+Helm 3 does not create a namespace for you, so you will have to provide an existing one. This can cause issues if you have integrated code with Helm 2, as you will need to make code changes to ensure a namespace is being created and passed in for Helm 3. Rancher will continue to manage namespaces for Helm to ensure this does not impact your app deployment.  
+
+apiVersion `v2` is now reserved for Helm 3 charts. This apiVersion enforcement could cause issues as older versions of Helm 2 did not validate the apiVersion in the `Chart.yaml` file. In general, your Helm 2 chart’s apiVersion should be set to `v1` and your Helm 3 chart’s apiVersion should be set to `v2`. You can install charts with apiVersion `v1` with Helm 3, but you cannot install `v2` charts into Helm 2.
+
+# Built-in Global Catalogs
+
+Within Rancher, there are default catalogs packaged as part of Rancher. These can be enabled or disabled by an administrator. For details, refer to the section on managing [built-in global catalogs.]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in)
+
+# Custom Catalogs
+
+There are two types of catalogs in Rancher: [Built-in global catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in/) and [custom catalogs.]({{<baseurl>}}/rancher/v2.x/en/catalog/adding-catalogs/)
+
+Any user can create custom catalogs to add into Rancher.  Custom catalogs can be added into Rancher at the global level, cluster level, or project level. For details, refer to the [section on adding custom catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/adding-catalogs) and the [catalog configuration reference.]({{<baseurl>}}/rancher/v2.x/en/catalog/catalog-config)
+
+# Creating and Launching Applications
+
+In Rancher, applications are deployed from the templates in a catalog. This section covers the following topics:
+
+* [Multi-cluster applications]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/)
+* [Creating catalog apps]({{<baseurl>}}/rancher/v2.x/en/catalog/creating-apps)
+* [Launching catalog apps within a project]({{<baseurl>}}/rancher/v2.x/en/catalog/launching-apps)
+* [Managing catalog apps]({{<baseurl>}}/rancher/v2.x/en/catalog/managing-apps)
+* [Tutorial: Example custom chart creation]({{<baseurl>}}/rancher/v2.x/en/catalog/tutorial)
+
+# Chart Compatibility with Rancher
+
+Charts now support the fields `rancher_min_version` and `rancher_max_version` in the [`questions.yml` file](https://github.com/rancher/integration-test-charts/blob/master/charts/chartmuseum/v1.6.0/questions.yml) to specify the versions of Rancher that the chart is compatible with. When using the UI, only app versions that are valid for the version of Rancher running will be shown. API validation is done to ensure apps that don't meet the Rancher requirements cannot be launched. An app that is already running will not be affected on a Rancher upgrade if the newer Rancher version does not meet the app's requirements.
+
+# Global DNS
+
+_Available as v2.2.0_
+
+When creating applications that span multiple Kubernetes clusters, a Global DNS entry can be created to route traffic to the endpoints in all of the different clusters. An external DNS server will need be programmed to assign a fully qualified domain name (a.k.a FQDN) to your application. Rancher will use the FQDN you provide and the IP addresses where your application is running to program the DNS. Rancher will gather endpoints from all the Kubernetes clusters running your application and program the DNS.
+
+For more information on how to use this feature, see [Global DNS]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
diff --git a/content/rancher/v2.5/en/applications/managing-applications/creating-apps/_index.md b/content/rancher/v2.5/en/applications/managing-applications/creating-apps/_index.md
new file mode 100644
index 00000000000..0fe7367613c
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/creating-apps/_index.md
@@ -0,0 +1,125 @@
+---
+title: Creating Library Apps
+weight: 4
+---
+
+> This page is under construction.
+
+Rancher's catalog service requires any custom catalogs to be structured in a specific format for the catalog service to be able to leverage it in Rancher.
+
+> For a complete walkthrough of developing charts, see the [Chart Template Developer's Guide](https://helm.sh/docs/chart_template_guide/) in the official Helm documentation.
+
+- [Chart types](#chart-types)
+  - [Helm charts](#helm-charts)
+  - [Rancher charts](#rancher-charts)
+- [Chart directory structure](#chart-directory-structure)
+- [Additional Files for Rancher Charts](#additional-files-for-rancher-charts)
+  - [questions.yml](#questions-yml)
+  - [Min/Max Rancher versions](#min-max-rancher-versions)
+  - [Question variable reference](#question-variable-reference)
+- [Tutorial: Example Custom Chart Creation](#tutorial-example-custom-chart-creation)
+
+# Chart Types
+
+Rancher supports two different types of charts: Helm charts and Rancher charts.
+
+### Helm Charts
+
+Native Helm charts include an application along with other software required to run it. When deploying native Helm charts, you'll learn the chart's parameters and then configure them using **Answers**, which are sets of key value pairs.
+
+The Helm Stable and Helm Incubators are populated with native Helm charts. However, you can also use native Helm charts in Custom catalogs (although we recommend Rancher Charts).
+
+### Rancher Charts
+
+Rancher charts mirror native helm charts, although they add two files that enhance user experience: `app-readme.md` and `questions.yaml`. Read more about them in [Additional Files for Rancher Charts.](#additional-files-for-rancher-charts)
+
+Advantages of Rancher charts include:
+
+- **Enhanced revision tracking:** While Helm supports versioned deployments, Rancher adds tracking and revision history to display changes between different versions of the chart.
+- **Streamlined application launch:** Rancher charts add simplified chart descriptions and configuration forms to make catalog application deployment easy. Rancher users need not read through the entire list of Helm variables to understand how to launch an application.
+- **Application resource management:** Rancher tracks all the resources created by a specific application. Users can easily navigate to and troubleshoot on a page listing all the workload objects used to power an application.
+
+# Chart Directory Structure
+
+The following table demonstrates the directory structure for a chart, which can be found in a chart directory: `charts/<APPLICATION>/<APP_VERSION>/`. This information is helpful when customizing charts for a custom catalog. Files denoted with **Rancher Specific** are specific to Rancher charts, but are optional for chart customization.
+
+```
+charts/<APPLICATION>/<APP_VERSION>/
+|--charts/           # Directory containing dependency charts.
+|--templates/        # Directory containing templates that, when combined with values.yml, generates Kubernetes YAML.
+|--app-readme.md     # Text displayed in the charts header within the Rancher UI.*
+|--Chart.yml         # Required Helm chart information file.
+|--questions.yml     # Form questions displayed within the Rancher UI. Questions display in Configuration Options.*
+|--README.md         # Optional: Helm Readme file displayed within Rancher UI. This text displays in Detailed Descriptions.
+|--requirements.yml  # Optional: YAML file listing dependencies for the chart.
+|--values.yml        # Default configuration values for the chart.
+```
+
+# Additional Files for Rancher Charts
+
+Before you create your own custom catalog, you should have a basic understanding about how a Rancher chart differs from a native Helm chart. Rancher charts differ slightly from Helm charts in their directory structures. Rancher charts include two files that Helm charts do not.
+
+- `app-readme.md`
+
+    A file that provides descriptive text in the chart's UI header. The following image displays the difference between a Rancher chart (which includes `app-readme.md`) and a native Helm chart (which does not).
+
+	<figcaption>Rancher Chart with <code>app-readme.md</code> (left) vs. Helm Chart without (right)</figcaption>
+
+	![app-readme.md]({{<baseurl>}}/img/rancher/app-readme.png)
+
+- `questions.yml`
+
+    A file that contains questions for a form. These form questions simplify deployment of a chart. Without it, you must configure the deployment using key value pairs, which is more difficult. The following image displays the difference between a Rancher chart (which includes `questions.yml`) and a native Helm chart (which does not).
+
+
+	<figcaption>Rancher Chart with <code>questions.yml</code> (left) vs. Helm Chart without (right)</figcaption>
+
+	![questions.yml]({{<baseurl>}}/img/rancher/questions.png)
+
+
+### questions.yml
+
+Inside the `questions.yml`, most of the content will be around the questions to ask the end user, but there are some additional fields that can be set in this file.
+
+### Min/Max Rancher versions
+
+_Available as of v2.3.0_
+
+For each chart, you can add the minimum and/or maximum Rancher version, which determines whether or not this chart is available to be deployed from Rancher.
+
+> **Note:** Even though Rancher release versions are prefixed with a `v`, there is *no* prefix for the release version when using this option.
+
+```
+rancher_min_version: 2.3.0
+rancher_max_version: 2.3.99
+```
+
+### Question Variable Reference
+
+This reference contains variables that you can use in `questions.yml` nested under `questions:`.
+
+| Variable  | Type | Required | Description |
+| ------------- | ------------- | --- |------------- |
+| 	variable          | string  | true    |  Define the variable name specified in the `values.yml` file, using `foo.bar` for nested objects. |
+| 	label             | string  | true      |  Define the UI label. |
+| 	description       | string  | false      |  Specify the description of the variable.|
+| 	type              | string  | false      |  Default to `string` if not specified (current supported types are string, multiline, boolean, int, enum, password, storageclass, hostname, pvc, and secret).|
+| 	required          | bool    | false      |  Define if the variable is required or not (true \| false)|
+| 	default           | string  | false      |  Specify the default value. |
+| 	group             | string  | false      |  Group questions by input value. |
+| 	min_length        | int     | false      | Min character length.|
+| 	max_length        | int     | false      | Max character length.|
+| 	min               | int     | false      |  Min integer length. |
+| 	max               | int     | false      |  Max integer length. |
+| 	options           | []string | false     |  Specify the options when the variable type is `enum`, for example: options:<br> - "ClusterIP" <br> - "NodePort" <br> - "LoadBalancer"|
+| 	valid_chars       | string   | false     |  Regular expression for input chars validation. |
+| 	invalid_chars     | string   | false     |  Regular expression for invalid input chars validation.|
+| 	subquestions      | []subquestion | false|  Add an array of subquestions.|
+| 	show_if           | string      | false  | Show current variable if conditional variable is true. For example `show_if: "serviceType=Nodeport"` |
+| 	show\_subquestion_if |  string  | false     | Show subquestions if is true or equal to one of the options. for example `show_subquestion_if: "true"`|
+
+>**Note:** `subquestions[]` cannot contain `subquestions` or `show_subquestions_if` keys, but all other keys in the above table are supported.
+
+# Tutorial: Example Custom Chart Creation
+
+For a tutorial on adding a custom Helm chart to a custom catalog, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/catalog/tutorial)
diff --git a/content/rancher/v2.5/en/applications/managing-applications/creating-custom-libraries/_index.md b/content/rancher/v2.5/en/applications/managing-applications/creating-custom-libraries/_index.md
new file mode 100644
index 00000000000..35035c0fdb6
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/creating-custom-libraries/_index.md
@@ -0,0 +1,105 @@
+---
+title: Creating Custom Libraries
+weight: 2
+---
+
+> This page is under construction.
+
+Custom catalogs can be added into Rancher at a global scope, cluster scope, or project scope.
+
+- [Adding catalog repositories](#adding-catalog-repositories)
+  - [Add custom Git repositories](#add-custom-git-repositories)
+  - [Add custom Helm chart repositories](#add-custom-helm-chart-repositories)
+  - [Add private Git/Helm chart repositories](#add-private-git-helm-chart-repositories)
+- [Adding global catalogs](#adding-global-catalogs)
+- [Adding cluster level catalogs](#adding-cluster-level-catalogs)
+- [Adding project level catalogs](#adding-project-level-catalogs)
+- [Custom catalog configuration reference](#custom-catalog-configuration-reference)
+
+# Adding Catalog Repositories
+
+Adding a catalog is as simple as adding a catalog name, a URL and a branch name.
+
+**Prerequisite:** An [admin]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) of Rancher has the ability to add or remove catalogs globally in Rancher.
+
+### Add Custom Git Repositories
+The Git URL needs to be one that `git clone` [can handle](https://git-scm.com/docs/git-clone#_git_urls_a_id_urls_a) and must end in `.git`. The branch name must be a branch that is in your catalog URL. If no branch name is provided, it will use the `master` branch by default. Whenever you add a catalog to Rancher, it will be available immediately.
+
+### Add Custom Helm Chart Repositories
+
+A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server.
+
+Helm comes with built-in package server for developer testing (helm serve). The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum).
+
+In Rancher, you can add the custom Helm chart repository with only a catalog name and the URL address of the chart repository.
+
+### Add Private Git/Helm Chart Repositories
+_Available as of v2.2.0_
+
+Private catalog repositories can be added using credentials like Username and Password. You may also want to use the OAuth token if your Git or Helm repository server supports that.
+
+For more information on private Git/Helm catalogs, refer to the [custom catalog configuration reference.]({{<baseurl>}}/rancher/v2.x/en/catalog/catalog-config)
+
+ 1. From the **Global** view, choose **Tools > Catalogs** in the navigation bar. In versions prior to v2.2.0, you can select **Catalogs** directly in the navigation bar.
+ 2. Click **Add Catalog**.
+ 3. Complete the form and click **Create**.
+
+ **Result:** Your catalog is added to Rancher.
+
+# Adding Global Catalogs
+
+>**Prerequisites:** In order to manage the [built-in catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in/) or manage global catalogs, you need _one_ of the following permissions:
+>
+>- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
+>- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
+
+ 1. From the **Global** view, choose **Tools > Catalogs** in the navigation bar. In versions prior to v2.2.0, you can select **Catalogs** directly in the navigation bar.
+ 2. Click **Add Catalog**.
+ 3. Complete the form. Select the Helm version that will be used to launch all of the apps in the catalog. For more information about the Helm version, refer to [this section.](
+{{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions)
+4. Click **Create**.
+
+ **Result**: Your custom global catalog is added to Rancher. Once it is in `Active` state, it has completed synchronization and you will be able to start deploying [multi-cluster apps]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or [applications in any project]({{<baseurl>}}/rancher/v2.x/en/catalog/launching-apps/) from this catalog.
+
+# Adding Cluster Level Catalogs
+
+_Available as of v2.2.0_
+
+>**Prerequisites:** In order to manage cluster scoped catalogs, you need _one_ of the following permissions:
+>
+>- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
+>- [Cluster Owner Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles)
+>- [Custom Cluster Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) with the [Manage Cluster Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-role-reference) role assigned.
+
+1. From the **Global** view, navigate to your cluster that you want to start adding custom catalogs.
+2. Choose the **Tools > Catalogs** in the navigation bar.
+2. Click **Add Catalog**.
+3. Complete the form. By default, the form will provide the ability to select `Scope` of the catalog. When you have added a catalog from the **Cluster** scope, it is defaulted to `Cluster`. Select the Helm version that will be used to launch all of the apps in the catalog. For more information about the Helm version, refer to [this section.](
+{{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions)
+5. Click **Create**.
+
+**Result**: Your custom cluster catalog is added to Rancher. Once it is in `Active` state, it has completed synchronization and you will be able to start deploying  [applications in any project in that cluster]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) from this catalog.
+
+# Adding Project Level Catalogs
+
+_Available as of v2.2.0_
+
+>**Prerequisites:** In order to manage project scoped catalogs, you need _one_ of the following permissions:
+>
+>- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
+>- [Cluster Owner Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles)
+>- [Project Owner Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles)
+>- [Custom Project Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) with the [Manage Project Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference) role assigned.
+
+1. From the **Global** view, navigate to your project that you want to start adding custom catalogs.
+2. Choose the **Tools > Catalogs** in the navigation bar.
+2. Click **Add Catalog**.
+3. Complete the form. By default, the form will provide the ability to select `Scope` of the catalog. When you have added a catalog from the **Project** scope, it is defaulted to `Cluster`. Select the Helm version that will be used to launch all of the apps in the catalog. For more information about the Helm version, refer to [this section.](
+{{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions)
+5. Click **Create**.
+
+**Result**: Your custom project catalog is added to Rancher. Once it is in `Active` state, it has completed synchronization and you will be able to start deploying  [applications in that project]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) from this catalog.
+
+# Custom Catalog Configuration Reference
+
+Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/catalog/catalog-config) more information on configuring custom catalogs.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/managing-applications/enabling-builtin-libraries/_index.md b/content/rancher/v2.5/en/applications/managing-applications/enabling-builtin-libraries/_index.md
new file mode 100644
index 00000000000..a162db9daff
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/enabling-builtin-libraries/_index.md
@@ -0,0 +1,25 @@
+---
+title: Enabling and Disabling Built-in Global Libraries
+weight: 100
+---
+
+> This page is under construction.
+
+There are default global catalogs packaged as part of Rancher.
+
+Within Rancher, there are default catalogs packaged as part of Rancher. These can be enabled or disabled by an administrator. 
+
+>**Prerequisites:** In order to manage the built-in catalogs or manage global catalogs, you need _one_ of the following permissions:
+>
+>- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
+>- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions-reference) role assigned.
+
+1. From the **Global** view, choose **Tools > Catalogs** in the navigation bar. In versions prior to v2.2.0, you can select **Catalogs** directly in the navigation bar.
+
+2. Toggle the default catalogs that you want to be enabled or disabled:
+
+    - **Library:**	The Library Catalog includes charts curated by Rancher. Rancher stores charts in a Git repository to expedite the fetch and update of charts. This catalog features Rancher Charts, which include some [notable advantages]({{<baseurl>}}/rancher/v2.x/en/catalog/creating-apps/#rancher-charts) over native Helm charts.
+    - **Helm Stable:** This catalog, which is maintained by the Kubernetes community, includes native [Helm charts](https://helm.sh/docs/chart_template_guide/). This catalog features the largest pool of apps.
+    - **Helm Incubator:** Similar in user experience to Helm Stable, but this catalog is filled with applications in **beta**.
+
+ **Result**: The chosen catalogs are enabled. Wait a few minutes for Rancher to replicate the catalog charts. When replication completes, you'll be able to see them in any of your projects by selecting **Apps** from the main navigation bar. In versions prior to v2.2.0, within a project, you can select **Catalog Apps** from the main navigation bar.
diff --git a/content/rancher/v2.5/en/applications/managing-applications/launching-apps/_index.md b/content/rancher/v2.5/en/applications/managing-applications/launching-apps/_index.md
new file mode 100644
index 00000000000..5c4a9effdc8
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/launching-apps/_index.md
@@ -0,0 +1,104 @@
+---
+title: Launching Library Apps
+weight: 7
+---
+
+> This page is under construction.
+
+Within a project, when you want to deploy applications from catalogs, the applications available in your project will be based on the [scope of the catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-scope).
+
+If your application is using ingresses, you can program the ingress hostname to an external DNS by setting up a [Global DNS entry]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
+
+- [Prerequisites](#prerequisites)
+- [Launching a catalog app](#launching-a-catalog-app)
+- [Configuration options](#configuration-options)
+
+# Prerequisites
+
+When Rancher deploys a catalog app, it launches an ephemeral instance of a Helm service account that has the permissions of the user deploying the catalog app. Therefore, a user cannot gain more access to the cluster through Helm or a catalog application than they otherwise would have.
+
+To launch an app from a catalog in Rancher, you must have at least one of the following permissions:
+
+- A [project-member role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) in the target cluster, which gives you the ability to create, read, update, and delete the workloads
+- A [cluster owner role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) for the cluster that include the target project
+
+Before launching an app, you'll need to either [enable a built-in global catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in) or [add your own custom catalog.]({{<baseurl>}}/rancher/v2.x/en/catalog/adding-catalogs)
+
+# Launching a Catalog App
+
+1. From the **Global** view, open the project that you want to deploy an app to.
+
+2. From the main navigation bar, choose **Apps**. In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar. Click **Launch**.
+
+3. Find the app that you want to launch, and then click **View Now**.
+
+4. Under **Configuration Options** enter a **Name**. By default, this name is also used to create a Kubernetes namespace for the application.
+
+    * If you would like to change the **Namespace**, click **Customize** and enter a new name.
+    * If you want to use a different namespace that already exists, click **Customize**, and then click **Use an existing namespace**. Choose a namespace from the list.
+
+5. Select a **Template Version**.
+
+6. Complete the rest of the **Configuration Options**.
+
+    * For native Helm charts (i.e., charts from the **Helm Stable** or **Helm Incubator** catalogs), answers are provided as key value pairs in the **Answers** section.
+    * Keys and values are available within **Detailed Descriptions**.
+    * When entering answers, you must format them using the syntax rules found in [Using Helm: The format and limitations of --set](https://helm.sh/docs/intro/using_helm/#the-format-and-limitations-of---set), as Rancher passes them as `--set` flags to Helm. For example, when entering an answer that includes two values separated by a comma (i.e., `abc, bcd`), wrap the values with double quotes (i.e., `"abc, bcd"`).
+
+7. Review the files in **Preview**. When you're satisfied, click **Launch**.
+
+**Result**: Your application is deployed to your chosen namespace. You can view the application status from the project's **Workloads** view or **Apps** view. In versions prior to v2.2.0, this is the **Catalog Apps** view.
+
+# Configuration Options
+
+For each Helm chart, there are a list of desired answers that must be entered in order to successfully deploy the chart. When entering answers, you must format them using the syntax rules found in [Using Helm: The format and limitations of –set](https://helm.sh/docs/intro/using_helm/#the-format-and-limitations-of---set), as Rancher passes them as `--set` flags to Helm.
+
+> For example, when entering an answer that includes two values separated by a comma (i.e. `abc, bcd`), it is required to wrap the values with double quotes (i.e., ``"abc, bcd"``).
+
+{{% tabs %}}
+{{% tab "UI" %}}
+
+### Using a questions.yml file
+
+If the Helm chart that you are deploying contains a `questions.yml` file, Rancher's UI will translate this file to display an easy to use UI to collect the answers for the questions.
+
+### Key Value Pairs for Native Helm Charts
+
+For native Helm charts (i.e., charts from the **Helm Stable** or **Helm Incubator** catalogs or a [custom Helm chart repository]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/#custom-helm-chart-repository)), answers are provided as key value pairs in the **Answers** section. These answers are used to override the default values.
+
+{{% /tab %}}
+{{% tab "Editing YAML Files" %}}
+
+_Available as of v2.1.0_
+
+If you do not want to input answers using the UI, you can choose the **Edit as YAML** option.
+
+With this example YAML:
+
+```YAML
+outer:
+  inner: value
+servers:
+- port: 80
+  host: example
+```
+
+### Key Value Pairs
+
+You can have a YAML file that translates these fields to match how to [format custom values so that it can be used with `--set`](https://github.com/helm/helm/blob/master/docs/using_helm.md#the-format-and-limitations-of---set).
+
+These values would be translated to:
+
+```
+outer.inner=value
+servers[0].port=80
+servers[0].host=example
+```
+
+### YAML files
+
+_Available as of v2.2.0_
+
+You can directly paste that YAML formatted structure into the YAML editor. By allowing custom values to be set using a YAML formatted structure, Rancher has the ability to easily customize for more complicated input values (e.g. multi-lines, array and JSON objects).
+{{% /tab %}}
+{{% /tabs %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/managing-applications/library-config/_index.md b/content/rancher/v2.5/en/applications/managing-applications/library-config/_index.md
new file mode 100644
index 00000000000..a82f70731f1
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/library-config/_index.md
@@ -0,0 +1,73 @@
+---
+title: Custom Library Configuration Reference
+weight: 3
+---
+
+> This page is under construction.
+
+Any user can create custom catalogs to add into Rancher. Besides the content of the catalog, users must ensure their catalogs are able to be added into Rancher.
+
+- [Types of Repositories](#types-of-repositories)
+- [Custom Git Repository](#custom-git-repository)
+- [Custom Helm Chart Repository](#custom-helm-chart-repository)
+- [Catalog Fields](#catalog-fields)
+- [Private Repositories](#private-repositories)
+  - [Using Username and Password](#using-username-and-password)
+  - [Using an OAuth token](#using-an-oauth-token)
+
+# Types of Repositories
+
+Rancher supports adding in different types of repositories as a catalog:
+
+* Custom Git Repository
+* Custom Helm Chart Repository
+
+# Custom Git Repository
+
+The Git URL needs to be one that `git clone` [can handle](https://git-scm.com/docs/git-clone#_git_urls_a_id_urls_a) and must end in `.git`. The branch name must be a branch that is in your catalog URL. If no branch name is provided, it will default to use the `master` branch. Whenever you add a catalog to Rancher, it will be available almost immediately.
+
+# Custom Helm Chart Repository
+
+A Helm chart repository is an HTTP server that contains one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server.
+
+Helm comes with a built-in package server for developer testing (`helm serve`). The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum).
+
+In Rancher, you can add the custom Helm chart repository with only a catalog name and the URL address of the chart repository.
+
+# Catalog Fields
+
+When [adding your catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/adding/) to Rancher, you'll provide the following information:
+
+
+| Variable              |  Description  |
+| --------------------  | ------------- |
+| 	Name                | Name for your custom catalog to distinguish the repositories in Rancher  |
+| 	Catalog URL         | URL of your custom chart repository|
+| 	Use Private Catalog | Selected if you are using a private repository that requires authentication |
+| Username (Optional) | Username or OAuth Token |
+| Password (Optional) | If you are authenticating using a username, enter the associated password. If you are using an OAuth token, use `x-oauth-basic`. |
+| 	Branch              | For a Git repository, the branch name. Default: `master`. For a Helm Chart repository, this field is ignored.  |
+| Helm version | The Helm version that will be used to deploy all of the charts in the catalog. This field cannot be changed later. For more information, refer to the [section on Helm versions.]({{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions) |
+
+# Private Repositories
+
+_Available as of v2.2.0_
+
+Private Git or Helm chart repositories can be added into Rancher using either credentials, i.e. `Username` and `Password`. Private Git repositories also support authentication using OAuth tokens.
+
+### Using Username and Password
+
+1. When [adding the catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/adding/), select the **Use private catalog** checkbox.
+
+2. Provide the `Username` and `Password` for your Git or Helm repository.
+
+### Using an OAuth token
+
+Read [using Git over HTTPS and OAuth](https://github.blog/2012-09-21-easier-builds-and-deployments-using-git-over-https-and-oauth/) for more details on how OAuth authentication works.
+
+1. Create an [OAuth token](https://github.com/settings/tokens)
+with `repo` permission selected, and click **Generate token**.
+
+2. When [adding the catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/adding/), select the **Use private catalog** checkbox.
+
+3. For `Username`, provide the Git generated OAuth token. For `Password`, enter `x-oauth-basic`.  
diff --git a/content/rancher/v2.5/en/applications/managing-applications/managing-apps/_index.md b/content/rancher/v2.5/en/applications/managing-applications/managing-apps/_index.md
new file mode 100644
index 00000000000..32e05ca6ad4
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/managing-apps/_index.md
@@ -0,0 +1,82 @@
+---
+title: Managing Library Apps
+weight: 5
+---
+
+> This page is under construction.
+
+After deploying an application, one of the benefits of using an application versus individual workloads/resources is the ease of being able to manage many workloads/resources applications. Apps can be cloned, upgraded or rolled back.
+
+- [Cloning catalog applications](#cloning-catalog-applications)
+- [Upgrading catalog applications](#upgrading-catalog-applications)
+- [Rolling back catalog applications](#rolling-back-catalog-applications)
+- [Deleting catalog application deployments](#deleting-catalog-application-deployments)
+
+### Cloning Catalog Applications
+
+After an application is deployed, you can easily clone it to use create another application with almost the same configuration. It saves you the work of manually filling in duplicate information.
+
+### Upgrading Catalog Applications
+
+After an application is deployed, you can easily upgrade to a different template version.
+
+1. From the **Global** view, navigate to the project that contains the catalog application that you want to upgrade.
+
+1. From the main navigation bar, choose **Apps**. In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar. Click **Launch**.
+
+3. Find the application that you want to upgrade, and then click the &#8942; to find **Upgrade**.
+
+4. Select the **Template Version** that you want to deploy.
+
+5. (Optional) Update your **Configuration Options**.
+
+6. (Optional) Select whether or not you want to force the catalog application to be upgraded by checking the box for **Delete and recreate resources if needed during the upgrade**.
+
+    > In Kubernetes, some fields are designed to be immutable or cannot be updated directly. As of v2.2.0, you can now force your catalog application to be updated regardless of these fields. This will cause the catalog apps to be deleted and resources to be re-created if needed during the upgrade.
+
+7. Review the files in the **Preview** section. When you're satisfied, click **Launch**.
+
+**Result**: Your application is updated. You can view the application status from the project's:
+
+- **Workloads** view
+- **Apps** view. In versions prior to v2.2.0, this is the **Catalog Apps** view.
+
+
+### Rolling Back Catalog Applications
+
+After an application has been upgraded, you can easily rollback to a different template version.
+
+1. From the **Global** view, navigate to the project that contains the catalog application that you want to upgrade.
+
+1. From the main navigation bar, choose **Apps**. In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar. Click **Launch**.
+
+3. Find the application that you want to rollback, and then click the &#8942; to find **Rollback**.
+
+4. Select the **Revision** that you want to roll back to. By default, Rancher saves up to the last 10 revisions.
+
+5. (Optional) Select whether or not you want to force the catalog application to be upgraded by checking the box for **Delete and recreate resources if needed during the upgrade**.
+
+    > In Kubernetes, some fields are designed to be immutable or cannot be updated directly. As of v2.2.0, you can now force your catalog application to be updated regardless of these fields. This will cause the catalog apps to be deleted and resources to be re-created if needed during the rollback.
+
+7. Click **Rollback**.
+
+**Result**: Your application is updated. You can view the application status from the project's:
+
+- **Workloads** view
+- **Apps** view. In versions prior to v2.2.0, this is the **Catalog Apps** view.
+
+### Deleting Catalog Application Deployments
+
+As a safeguard to prevent you from unintentionally deleting other catalog applications that share a namespace, deleting catalog applications themselves does not delete the namespace they're assigned to.
+
+Therefore, if you want to delete both an app and the namespace that contains the app, you should remove the app and the namespace separately:
+
+1. Uninstall the app using the app's `uninstall` function.
+
+1. From the **Global** view, navigate to the project that contains the catalog application that you want to delete.
+
+1. From the main menu, choose **Namespaces**.
+
+1. Find the namespace running your catalog app. Select it and click **Delete**.
+
+**Result:** The catalog application deployment and its namespace are deleted.
diff --git a/content/rancher/v2.5/en/applications/managing-applications/multi-cluster-apps/_index.md b/content/rancher/v2.5/en/applications/managing-applications/multi-cluster-apps/_index.md
new file mode 100644
index 00000000000..c925c687233
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/multi-cluster-apps/_index.md
@@ -0,0 +1,162 @@
+---
+title: Multi-Cluster Apps
+weight: 6
+---
+
+> This page is under construction.
+
+Typically, most applications are deployed on a single Kubernetes cluster, but there will be times you might want to deploy multiple copies of the same application across different clusters and/or projects. In Rancher, a _multi-cluster application_,  is an application deployed using a Helm chart across multiple clusters. With the ability to deploy the same application across multiple clusters, it avoids the repetition of the same action on each cluster, which could introduce user error during application configuration. With multi-cluster applications, you can customize to have the same configuration across all projects/clusters as well as have the ability to change the configuration based on your target project. Since multi-cluster application is considered a single application, it's easy to manage and maintain this application.
+
+Any Helm charts from a global catalog can be used to deploy and manage multi-cluster applications.
+
+After creating a multi-cluster application, you can program a [Global DNS entry]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/) to make it easier to access the application.
+
+- [Prerequisites](#prerequisites)
+- [Launching a multi-cluster app](#launching-a-multi-cluster-app)
+- [Multi-cluster app configuration options](#multi-cluster-app-configuration-options)
+  - [Targets](#targets)
+  - [Upgrades](#upgrades)
+  - [Roles](#roles)
+- [Application configuration options](#application-configuration-options)
+  - [Using a questions.yml file](#using-a-questions-yml-file)
+  - [Key value pairs for native Helm charts](key-value-pairs-for-native-helm-charts)
+  - [Members](#members)
+  - [Overriding application configuration options for specific projects](#overriding-application-configuration-options-for-specific-projects)
+- [Upgrading multi-cluster app roles and projects](#upgrading-multi-cluster-app-roles-and-projects)
+- [Multi-cluster application management](#multi-cluster-application-managements)
+- [Deleting a multi-cluster application](#deleting-a-multi-cluster-application)
+
+# Prerequisites
+
+To create a multi-cluster app in Rancher, you must have at least one of the following permissions:
+
+- A [project-member role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) in the target cluster(s), which gives you the ability to create, read, update, and delete the workloads
+- A [cluster owner role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) for the clusters(s) that include the target project(s)
+
+# Launching a Multi-Cluster App
+
+1. From the **Global** view, choose **Apps** in the navigation bar. Click **Launch**.
+
+2. Find the application that you want to launch, and then click **View Details**.
+
+3.  (Optional) Review the detailed descriptions, which are derived from the Helm chart's `README`.
+
+4. Under **Configuration Options** enter a **Name** for the multi-cluster application. By default, this name is also used to create a Kubernetes namespace in each [target project](#targets) for the multi-cluster application. The namespace is named as `<MULTI-CLUSTER_APPLICATION_NAME>-<PROJECT_ID>`.
+
+5. Select a **Template Version**.
+
+6. Complete the [multi-cluster applications specific configuration options](#multi-cluster-app-configuration-options) as well as the [application configuration options](#application-configuration-options).
+
+7. Select the **Members** who can [interact with the multi-cluster application](#members).
+
+8. Add any [custom application configuration answers](#overriding-application-configuration-options-for-specific-projects) that would change the configuration for specific project(s) from the default application configuration answers.
+
+7. Review the files in the **Preview** section. When you're satisfied, click **Launch**.
+
+**Result**: Your application is deployed to your chosen namespace. You can view the application status from the project's:
+
+# Multi-cluster App Configuration Options
+
+Rancher has divided the configuration option for the multi-cluster application into several sections.
+
+### Targets
+
+In the **Targets** section, select the projects that you want the application to be deployed in. The list of projects is based on what projects you have access to. For each project that you select, it will be added to the list, which shows the cluster name and project name that were selected. To remove a target project, click on **-**.
+
+### Upgrades
+
+In the **Upgrades** section, select the upgrade strategy to use, when you decide to upgrade your application.
+
+* **Rolling Update (batched):** When selecting this upgrade strategy, the number of applications upgraded at a time is based on the selected **Batch size** and the **Interval** specifies how many seconds to wait before starting the next batch of updates.
+
+* **Upgrade all apps simultaneously:** When selecting this upgrade strategy, all applications across all projects will be upgraded at the same time.
+
+### Roles
+
+In the **Roles** section, you define the role of the multi-cluster application. Typically, when a user [launches catalog applications]({{<baseurl>}}/rancher/v2.x/en/catalog/launching-apps), that specific user's permissions are used for creation of all workloads/resources that is required by the app.
+
+For multi-cluster applications, the application is deployed by a _system user_ and is assigned as the creator of all underlying resources. A _system user_ is used instead of the actual user due to the fact that the actual user could be removed from one of the target projects. If the actual user was removed from one of the projects, then that user would no longer be able to manage the application for the other projects.
+
+Rancher will let you select from two options for Roles, **Project** and **Cluster**. Rancher will allow creation using any of these roles based on the user's permissions.
+
+- **Project** - This is the equivalent of a [project member]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles). If you select this role, Rancher will check that in all the target projects, the user has minimally the [project member]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) role. While the user might not be explicitly granted the _project member_ role, if the user is an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), a [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or a [project owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles), then the user is considered to have the appropriate level of permissions.
+
+- **Cluster** - This is the equivalent of a [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles). If you select this role, Rancher will check that in all the target projects, the user has minimally the [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) role. While the user might not be explicitly granted the _cluster owner_ role, if the user is an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), then the user is considered to have the appropriate level of permissions.
+
+When launching the application, Rancher will confirm if you have these permissions in the target projects before launching the application.
+
+> **Note:** There are some applications like _Grafana_ or _Datadog_ that require access to specific cluster-scoped resources. These applications will require the _Cluster_ role. If you find out later that the application requires cluster roles, the multi-cluster application can be upgraded to update the roles.
+
+# Application Configuration Options
+
+For each Helm chart, there are a list of desired answers that must be entered in order to successfully deploy the chart. When entering answers, you must format them using the syntax rules found in [Using Helm: The format and limitations of –set](https://helm.sh/docs/intro/using_helm/#the-format-and-limitations-of---set), as Rancher passes them as `--set` flags to Helm.
+
+> For example, when entering an answer that includes two values separated by a comma (i.e. `abc, bcd`), it is required to wrap the values with double quotes (i.e., ``"abc, bcd"``).
+
+### Using a questions.yml file
+
+If the Helm chart that you are deploying contains a `questions.yml` file, Rancher's UI will translate this file to display an easy to use UI to collect the answers for the questions.
+
+### Key Value Pairs for Native Helm Charts
+
+For native Helm charts (i.e., charts from the **Helm Stable** or **Helm Incubator** catalogs or a [custom Helm chart repository]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/#custom-helm-chart-repository)), answers are provided as key value pairs in the **Answers** section. These answers are used to override the default values.
+
+### Members
+
+By default, multi-cluster applications can only be managed by the user who created it. In the **Members** section, other users can be added so that they can also help manage or view the multi-cluster application.
+
+1. Find the user that you want to add by typing in the member's name in the **Member** search box.
+
+2. Select the **Access Type** for that member. There are three access types for a multi-cluster project, but due to how the permissions of a multi-cluster application are launched, please read carefully to understand what these access types mean.
+
+    - **Owner**: This access type can manage any configuration part of the multi-cluster application including the template version, the [multi-cluster applications specific configuration options](#Multi-cluster App Configuration Options), the [application specific configuration options](#application-configuration-options), the members who can interact with the multi-cluster application and the [custom application configuration answers](#overriding-application-configuration-options-for-specific-projects). Since a multi-cluster application is created with a different set of permissions from the user, any _owner_ of the multi-cluster application can manage/remove applications in [target projects](#targets) without explicitly having access to these project(s). Only trusted users should be provided with this access type.
+
+    - **Member**: This access type can only modify the template version, the [application specific configuration options](#application-configuration-options) and the [custom application configuration answers](#overriding-application-configuration-options-for-specific-projects). Since a multi-cluster application is created with a different set of permissions from the user, any _member_ of the multi-cluster application can modify the application without explicitly having access to these project(s). Only trusted users should be provided with this access type.
+
+    - **Read-only**: This access type cannot modify any configuration option for the multi-cluster application. Users can only view these applications.
+
+    > **Note:**  Please ensure only trusted users are given _Owner_ or _Member_ access as they will automatically be able to manage applications created for this multi-cluster application in target projects they might not have direct access to.
+
+### Overriding Application Configuration Options for Specific Projects
+
+The ability to use the same configuration to deploy the same application across multiple clusters/projects is one of the main benefits of multi-cluster applications. There might be a specific project that requires a slightly different configuration option, but you want to manage that application with all the other matching applications. Instead of creating a brand new application, you can override specific [application specific configuration options](#application-configuration-options) for specific projects.
+
+1. In the **Answer Overrides** section, click **Add Override**.
+
+2. For each override, you can select the following:
+
+	- **Scope**: Select which target projects you want to override the answer in the configuration option.
+
+	- **Question**: Select which question you want to override.
+
+	- **Answer**: Enter the answer that you want to be used instead.
+
+# Upgrading Multi-Cluster App Roles and Projects
+
+- **Changing Roles on an existing Multi-Cluster app**
+The creator and any users added with the access-type "owner" to a multi-cluster app, can upgrade its Roles. When adding a new Role, we check if the user has that exact role in all current target projects. These checks allow the same relaxations for global admins, cluster owners and project-owners as described in the installation section for the field `Roles`.
+
+- **Adding/Removing target projects**
+1. The creator and any users added with access-type "owner" to a multi-cluster app, can add or remove its target projects. When adding a new project, we check if the caller of this request has all Roles defined on multi-cluster app, in the new projects they want to add. The roles checks are again relaxed for global admins, cluster-owners and project-owners.
+2. We do not do these membership checks when removing target projects. This is because the caller's permissions could have with respect to the target project, or the project could have been deleted and hence the caller wants to remove it from targets list.
+
+
+# Multi-Cluster Application Management
+
+One of the benefits of using a multi-cluster application as opposed to multiple individual applications of the same type, is the ease of management. Multi-cluster applications can be cloned, upgraded or rolled back.
+
+1. From the **Global** view, choose **Apps** in the navigation bar.
+
+2. Choose the multi-cluster application you want to take one of these actions on and click the **&#8942;**. Select one of the following options:
+
+   * **Clone**: Creates another multi-cluster application with the same configuration. By using this option, you can easily duplicate a multi-cluster application.
+   * **Upgrade**: Upgrade your multi-cluster application to change some part of the configuration. When performing an upgrade for multi-cluster application, the [upgrade strategy](#upgrades) can be modified if you have the correct [access type](#members).
+   * **Rollback**: Rollback your application to a specific version. If after an upgrade, there are issues for your multi-cluster application for one or more of your [targets](#targets), Rancher has stored up to 10 versions of the multi-cluster application. Rolling back a multi-cluster application reverts the application for **all** target clusters and projects, not just the targets(s) affected by the upgrade issue.
+
+# Deleting a Multi-Cluster Application
+
+1. From the **Global** view, choose **Apps** in the navigation bar.
+
+2. Choose the multi-cluster application you want to delete and click the **&#8942; > Delete**. When deleting the multi-cluster application, all applications and namespaces are deleted in all of the target projects.
+
+   > **Note:** The applications in the target projects, that are created for a multi-cluster application, cannot be deleted individually. The applications can only be deleted when the multi-cluster application is deleted.
diff --git a/content/rancher/v2.5/en/applications/managing-applications/tutorial/_index.md b/content/rancher/v2.5/en/applications/managing-applications/tutorial/_index.md
new file mode 100644
index 00000000000..2ed509e1a6a
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/managing-applications/tutorial/_index.md
@@ -0,0 +1,72 @@
+---
+title: "Tutorial: Example Custom Chart Creation"
+weight: 8
+---
+
+In this tutorial, you'll learn how to create a Helm chart and deploy it to a  repository. The repository can then be used as a source for a custom catalog in Rancher.
+
+You can fill your custom catalogs with either Helm Charts or Rancher Charts, although we recommend Rancher Charts due to their enhanced user experience.
+
+> For a complete walkthrough of developing charts, see the upstream Helm chart [developer reference](https://helm.sh/docs/chart_template_guide/).
+
+1. Within the GitHub repo that you're using as your custom catalog, create a directory structure that mirrors the structure listed in [Chart Directory Structure](../creating-apps/#chart-directory-structure).
+
+    Rancher requires this directory structure, although `app-readme.md` and `questions.yml` are optional.
+
+    >**Tip:**
+    >
+    >- To begin customizing a chart, copy one from either the [Rancher Library](https://github.com/rancher/charts) or the [Helm Stable](https://github.com/kubernetes/charts/tree/master/stable).
+    >- For a complete walk through of developing charts, see the upstream Helm chart [developer reference](https://docs.helm.sh/developing_charts/).
+
+2. **Recommended:** Create an `app-readme.md` file.
+
+    Use this file to create custom text for your chart's header in the Rancher UI. You can use this text to notify users that the chart is customized for your environment or provide special instruction on how to use it.
+    <br/>
+    <br/>
+    **Example**:
+
+    ```
+    $ cat ./app-readme.md
+
+    # Wordpress ROCKS!
+    ```
+
+3. **Recommended:** Create a `questions.yml` file.
+
+    This file creates a form for users to specify deployment parameters when they deploy the custom chart. Without this file, users **must** specify the parameters manually using key value pairs, which isn't user-friendly.
+    <br/>
+    <br/>
+    The example below creates a form that prompts users for persistent volume size and a storage class.
+    <br/>
+    <br/>
+    For a list of variables you can use when creating a `questions.yml` file, see [Question Variable Reference]({{<baseurl>}}/rancher/v2.x/en/catalog/creating-apps/#question-variable-reference).
+
+    ```yaml
+        categories:
+        - Blog
+        - CMS
+        questions:
+        - variable: persistence.enabled
+        default: "false"
+        description: "Enable persistent volume for WordPress"
+        type: boolean
+        required: true
+        label: WordPress Persistent Volume Enabled
+        show_subquestion_if: true
+        group: "WordPress Settings"
+        subquestions:
+        - variable: persistence.size
+            default: "10Gi"
+            description: "WordPress Persistent Volume Size"
+            type: string
+            label: WordPress Volume Size
+        - variable: persistence.storageClass
+            default: ""
+            description: "If undefined or null, uses the default StorageClass. Default to null"
+            type: storageclass
+            label: Default StorageClass for WordPress
+    ```
+
+4. Check the customized chart into your GitHub repo.
+
+**Result:** Your custom chart is added to the repo. Your Rancher Server will replicate the chart within a few minutes.
diff --git a/content/rancher/v2.5/en/applications/monitoring/_index.md b/content/rancher/v2.5/en/applications/monitoring/_index.md
new file mode 100644
index 00000000000..2891e6322ee
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/_index.md
@@ -0,0 +1,103 @@
+---
+title: Integrating Rancher and Prometheus for Cluster Monitoring
+description: Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Learn about the scope of monitoring and how to enable cluster monitoring
+weight: 4
+---
+
+Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
+
+This section covers the following topics:
+
+- [About Prometheus](#about-prometheus)
+- [Monitoring scope](#monitoring-scope)
+- [Enabling cluster monitoring](#enabling-cluster-monitoring)
+- [Resource consumption](#resource-consumption)
+  - [Resource consumption of Prometheus pods](#resource-consumption-of-prometheus-pods)
+  - [Resource consumption of other pods](#resources-consumption-of-other-pods)
+
+# About Prometheus
+
+Prometheus provides a _time series_ of your data, which is, according to [Prometheus documentation](https://prometheus.io/docs/concepts/data_model/):
+
+You can configure these services to collect logs at either the cluster level or the project level. This page describes how to enable monitoring for a cluster. For details on enabling monitoring for a project, refer to the [project administration section]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/).
+
+>A stream of timestamped values belonging to the same metric and the same set of labeled dimensions, along with comprehensive statistics and metrics of the monitored cluster.
+
+In other words, Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Using timestamps, Prometheus lets you query and view these metrics in easy-to-read graphs and visuals, either through the Rancher UI or [Grafana](https://grafana.com/), which is an analytics viewing platform deployed along with Prometheus.
+
+By viewing data that Prometheus scrapes from your cluster control plane, nodes, and deployments, you can stay on top of everything happening in your cluster. You can then use these analytics to better run your organization: stop system emergencies before they start, develop maintenance strategies, restore crashed servers, etc.
+
+Multi-tenancy support in terms of cluster-only and project-only Prometheus instances are also supported.
+
+# Monitoring Scope
+
+Using Prometheus, you can monitor Rancher at both the cluster level and [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/). For each cluster and project that is enabled for monitoring, Rancher deploys a Prometheus server.
+
+- Cluster monitoring allows you to view the health of your Kubernetes cluster. Prometheus collects metrics from the cluster components below, which you can view in graphs and charts.
+
+    - [Kubernetes control plane]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#kubernetes-components-metrics)
+    - [etcd database]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#etcd-metrics)
+    - [All nodes (including workers)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#cluster-metrics)
+
+- [Project monitoring]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/) allows you to view the state of pods running in a given project. Prometheus collects metrics from the project's deployed HTTP and TCP/UDP workloads.
+
+# Enabling Cluster Monitoring
+
+As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to deploy Prometheus to monitor your Kubernetes cluster.
+
+> **Prerequisite:** Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
+
+1. From the **Global** view, navigate to the cluster that you want to configure cluster monitoring.
+
+1. Select **Tools > Monitoring** in the navigation bar.
+
+1. Select **Enable** to show the [Prometheus configuration options]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/). Review the [resource consumption recommendations](#resource-consumption) to ensure you have enough resources for Prometheus and on your worker nodes to enable monitoring. Enter in your desired configuration options.
+
+1. Click **Save**.
+
+**Result:** The Prometheus server will be deployed as well as two monitoring applications. The two monitoring applications, `cluster-monitoring` and `monitoring-operator`, are added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the cluster's `system` project. After the applications are `active`, you can start viewing [cluster metrics]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/) through the [Rancher dashboard]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics/#rancher-dashboard) or directly from [Grafana]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#grafana).
+
+> The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
+
+# Resource Consumption
+
+When enabling cluster monitoring, you need to ensure your worker nodes and Prometheus pod have enough resources. The tables below provides a guide of how much resource consumption will be used. In larger deployments, it is strongly advised that the monitoring infrastructure be placed on dedicated nodes in the cluster.
+
+### Resource Consumption of Prometheus Pods
+
+This table is the resource consumption of the Prometheus pod, which is based on the number of all the nodes in the cluster. The count of nodes includes the worker, control plane and etcd nodes. Total disk space allocation should be approximated by the `rate * retention` period set at the cluster level. When enabling cluster level monitoring, you should adjust the CPU and Memory limits and reservation.
+
+Number of Cluster Nodes | CPU (milli CPU) | Memory | Disk
+------------------------|-----|--------|------
+5 | 500 | 650 MB | ~1 GB/Day
+50| 2000 | 2 GB | ~5 GB/Day
+256| 4000 | 6 GB | ~18 GB/Day
+
+Additional pod resource requirements for cluster level monitoring.
+
+| Workload            |      Container                  | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable |
+|---------------------|---------------------------------|---------------|---------------|-------------|-------------|--------------|
+| Prometheus          | prometheus                      |     750m      |     750Mi     |    1000m    |    1000Mi   |       Y      |
+|                     | prometheus-proxy                |      50m      |      50Mi     |     100m    |     100Mi   |       Y      |
+|                     | prometheus-auth                 |     100m      |     100Mi     |     500m    |     200Mi   |       Y      |
+|                     | prometheus-config-reloader      |       -       |       -       |      50m    |      50Mi   |       N      |
+|                     | rules-configmap-reloader        |       -       |       -       |     100m    |      25Mi   |       N      |
+| Grafana             | grafana-init-plugin-json-copy   |      50m      |      50Mi     |      50m    |      50Mi   |       Y      |
+|                     | grafana-init-plugin-json-modify |      50m      |      50Mi     |      50m    |      50Mi   |       Y      |
+|                     | grafana                         |     100m      |     100Mi     |     200m    |     200Mi   |       Y      |
+|                     | grafana-proxy                   |      50m      |      50Mi     |     100m    |     100Mi   |       Y      |
+| Kube-State Exporter | kube-state                      |     100m      |     130Mi     |     100m    |     200Mi   |       Y      |
+| Node Exporter       | exporter-node                   |     200m      |     200Mi     |     200m    |     200Mi   |       Y      |
+| Operator            | prometheus-operator             |     100m      |      50Mi     |     200m    |     100Mi   |       Y      |
+
+
+### Resource Consumption of Other Pods
+
+Besides the Prometheus pod, there are components that are deployed that require additional resources on the worker nodes.
+
+Pod | CPU (milli CPU) | Memory (MB)
+----|-----------------|------------
+Node Exporter (Per Node) | 100 | 30
+Kube State Cluster Monitor | 100 | 130
+Grafana | 100 | 150
+Prometheus Cluster Monitoring Nginx | 50 | 50
diff --git a/content/rancher/v2.5/en/applications/monitoring/alerts/_index.md b/content/rancher/v2.5/en/applications/monitoring/alerts/_index.md
new file mode 100644
index 00000000000..1b0b9685295
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/alerts/_index.md
@@ -0,0 +1,243 @@
+---
+title: Alerts
+weight: 2
+---
+
+To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. When an event occurs, your alert is triggered, and you are sent a notification. You can then, if necessary, follow up with corrective actions.
+
+Notifiers and alerts are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher can notify [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) and [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) of events they need to address.
+
+Before you can receive alerts, you must configure one or more notifier in Rancher.
+
+When you create a cluster, some alert rules are predefined. You can receive these alerts if you configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them.
+
+For details about what triggers the predefined alerts, refer to the [documentation on default alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts)
+
+This section covers the following topics:
+
+- [Alert event examples](#alert-event-examples)
+  - [Prometheus queries](#prometheus-queries)
+- [Urgency levels](#urgency-levels)
+- [Scope of alerts](#scope-of-alerts)
+- [Adding cluster alerts](#adding-cluster-alerts)
+- [Managing cluster alerts](#managing-cluster-alerts)
+
+# Alert Event Examples
+
+Some examples of alert events are:
+
+- A Kubernetes [master component]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) entering an unhealthy state.
+- A node or [workload]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/) error occurring.
+- A scheduled deployment taking place as planned.
+- A node's hardware resources becoming overstressed.
+
+### Prometheus Queries
+
+> **Prerequisite:** Monitoring must be [enabled]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) before you can trigger alerts with custom Prometheus queries or expressions.
+
+When you edit an alert rule, you will have the opportunity to configure the alert to be triggered based on a Prometheus expression. For examples of expressions, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression)
+
+# Urgency Levels
+
+You can set an urgency level for each alert. This urgency appears in the notification you receive, helping you to prioritize your response actions. For example, if you have an alert configured to inform you of a routine deployment, no action is required. These alerts can be assigned a low priority level. However, if a deployment fails, it can critically impact your organization, and you need to react quickly. Assign these alerts a high priority level.
+
+# Scope of Alerts
+
+The scope for alerts can be set at either the cluster level or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/).
+
+At the cluster level, Rancher monitors components in your Kubernetes cluster, and sends you alerts related to:
+
+- The state of your nodes.
+- The system services that manage your Kubernetes cluster.
+- The resource events from specific system services.
+- The Prometheus expression cross the thresholds
+
+# Adding Cluster Alerts
+
+As a [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to send you alerts for cluster events.
+
+>**Prerequisite:** Before you can receive cluster alerts, you must [add a notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/#adding-notifiers).
+
+1. From the **Global** view, navigate to the cluster that you want to configure cluster alerts for. Select **Tools > Alerts**. Then click **Add Alert Group**.
+
+1. Enter a **Name** for the alert that describes its purpose, you could group alert rules for the different purpose.
+
+1. Based on the type of alert you want to create, complete one of the instruction subsets below.
+{{% accordion id="system-service" label="System Service Alerts" %}}
+This alert type monitor for events that affect one of the Kubernetes master components, regardless of the node it occurs on.
+
+1. Select the **System Services** option, and then select an option from the drop-down.
+
+  - [controller-manager](https://kubernetes.io/docs/concepts/overview/components/#kube-controller-manager)
+  - [etcd](https://kubernetes.io/docs/concepts/overview/components/#etcd)
+  - [scheduler](https://kubernetes.io/docs/concepts/overview/components/#kube-scheduler)
+
+1. Select the urgency level of the alert. The options are:
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+    <br/>
+    <br/>
+    Select the urgency level based on the importance of the service and how many nodes fill the role within your cluster. For example, if you're making an alert for the `etcd` service, select **Critical**. If you're making an alert for redundant schedulers, **Warning** is more appropriate.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+{{% accordion id="resource-event" label="Resource Event Alerts" %}}
+This alert type monitors for specific events that are thrown from a resource type.
+
+1. Choose the type of resource event that triggers an alert. The options are:
+
+  - **Normal**: triggers an alert when any standard resource event occurs.
+  - **Warning**: triggers an alert when unexpected resource events occur.
+
+1. Select a resource type from the **Choose a Resource** drop-down that you want to trigger an alert.
+
+  - [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/)
+  - [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
+  - [Node](https://kubernetes.io/docs/concepts/architecture/nodes/)
+  - [Pod](https://kubernetes.io/docs/concepts/workloads/pods/pod/)
+  - [StatefulSet](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/)
+
+1. Select the urgency level of the alert.
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+    <br/>
+    <br/>
+    Select the urgency level of the alert by considering factors such as how often the event occurs or its importance. For example:
+
+    - If you set a normal alert for pods, you're likely to receive alerts often, and individual pods usually self-heal, so select an urgency of **Info**.
+    - If you set a warning alert for StatefulSets, it's very likely to impact operations, so select an urgency of **Critical**.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+{{% accordion id="node" label="Node Alerts" %}}
+This alert type monitors for events that occur on a specific node.
+
+1. Select the **Node** option, and then make a selection from the **Choose a Node** drop-down.
+
+1. Choose an event to trigger the alert.
+
+  - **Not Ready**: Sends you an alert when the node is unresponsive.
+  - **CPU usage over**: Sends you an alert when the node raises above an entered percentage of its processing allocation.
+  - **Mem usage over**: Sends you an alert when the node raises above an entered percentage of its memory allocation.
+
+1. Select the urgency level of the alert.
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+    <br/>
+    <br/>
+    Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a node's CPU raises above 60% deems an urgency of **Info**, but a node that is **Not Ready** deems an urgency of **Critical**.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+{{% accordion id="node-selector" label="Node Selector Alerts" %}}
+This alert type monitors for events that occur on any node on marked with a label. For more information, see the Kubernetes documentation for [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/).
+
+1. Select the **Node Selector** option, and then click **Add Selector** to enter a key value pair for a label. This label should be applied to one or more of your nodes. Add as many selectors as you'd like.
+
+1. Choose an event to trigger the alert.
+
+  - **Not Ready**: Sends you an alert when selected nodes are unresponsive.
+  - **CPU usage over**: Sends you an alert when selected nodes raise above an entered percentage of processing allocation.
+  - **Mem usage over**: Sends you an alert when selected nodes raise above an entered percentage of memory allocation.
+
+1. Select the urgency level of the alert.
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+    <br/>
+    <br/>
+      Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a node's CPU raises above 60% deems an urgency of **Info**, but a node that is **Not Ready** deems an urgency of **Critical**.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+{{% accordion id="cluster-expression" label="Metric Expression Alerts" %}}
+This alert type monitors for the overload from Prometheus expression querying, it would be available after you enable monitoring.
+
+1. Input or select an **Expression**, the drop down shows the original metrics from Prometheus, including:
+
+  - [**Node**](https://github.com/prometheus/node_exporter)
+  - [**Container**](https://github.com/google/cadvisor)
+  - [**ETCD**](https://etcd.io/docs/v3.4.0/op-guide/monitoring/)
+  - [**Kubernetes Components**](https://github.com/kubernetes/metrics)
+  - [**Kubernetes Resources**](https://github.com/kubernetes/kube-state-metrics)
+  - [**Fluentd**](https://docs.fluentd.org/v1.0/articles/monitoring-prometheus) (supported by [Logging]({{<baseurl>}}/rancher/v2.x//en/cluster-admin/tools/logging))
+  - [**Cluster Level Grafana**](http://docs.grafana.org/administration/metrics/)
+  - **Cluster Level Prometheus**
+
+1. Choose a **Comparison**.
+
+  - **Equal**: Trigger alert when expression value equal to the threshold.
+  - **Not Equal**: Trigger alert when expression value not equal to the threshold.
+  - **Greater Than**: Trigger alert when expression value greater than to threshold.
+  - **Less Than**: Trigger alert when expression value equal or less than the threshold.
+  - **Greater or Equal**: Trigger alert when expression value greater to equal to the threshold.
+  - **Less or Equal**: Trigger alert when expression value less or equal to the threshold.
+
+1. Input a **Threshold**, for trigger alert when the value of expression cross the threshold.
+
+1. Choose a **Comparison**.
+
+1. Select a duration, for trigger alert when expression value crosses the threshold longer than the configured duration.
+
+1. Select the urgency level of the alert.
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+    <br/>
+    <br/>
+    Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a node's load expression ```sum(node_load5)  / count(node_cpu_seconds_total{mode="system"})``` raises above 0.6 deems an urgency of **Info**, but 1 deems an urgency of **Critical**.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+
+1. Continue adding more **Alert Rule** to the group.
+
+1. Finally, choose the [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) to send the alerts to.
+
+    - You can set up multiple notifiers.
+    - You can change notifier recipients on the fly.
+
+**Result:** Your alert is configured. A notification is sent when the alert is triggered.
+
+# Managing Cluster Alerts
+
+After you set up cluster alerts, you can manage each alert object. To manage alerts, browse to the cluster containing the alerts, and then select **Tools > Alerts** that you want to manage. You can:
+
+- Deactivate/Reactive alerts
+- Edit alert settings
+- Delete unnecessary alerts
+- Mute firing alerts
+- Unmute muted alerts
diff --git a/content/rancher/v2.5/en/applications/monitoring/alerts/default-alerts/_index.md b/content/rancher/v2.5/en/applications/monitoring/alerts/default-alerts/_index.md
new file mode 100644
index 00000000000..ea7f91ff0e0
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/alerts/default-alerts/_index.md
@@ -0,0 +1,57 @@
+---
+title: Default Alerts for Cluster Monitoring
+weight: 1
+---
+
+When you create a cluster, some alert rules are predefined. These alerts notify you about signs that the cluster could be unhealthy. You can receive these alerts if you configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them.
+
+Several of the alerts use Prometheus expressions as the metric that triggers the alert. For more information on how expressions work, you can refer to the Rancher [documentation about Prometheus expressions]({{<baseurl>}}
+/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/) or the Prometheus [documentation about querying metrics](https://prometheus.io/docs/prometheus/latest/querying/basics/).
+
+# Alerts for etcd
+Etcd is the key-value store that contains the state of the Kubernetes cluster. Rancher provides default alerts if the built-in monitoring detects a potential problem with etcd. You don't have to enable monitoring to receive these alerts.
+
+A leader is the node that handles all client requests that need cluster consensus. For more information, you can refer to this [explanation of how etcd works.](https://rancher.com/blog/2019/2019-01-29-what-is-etcd/#how-does-etcd-work)
+
+The leader of the cluster can change in response to certain events. It is normal for the leader to change, but too many changes can indicate a problem with the network or a high CPU load. With longer latencies, the default etcd configuration may cause frequent heartbeat timeouts, which trigger a new leader election.
+
+| Alert | Explanation |
+|-------|-------------|
+| A high number of leader changes within the etcd cluster are happening | A warning alert is triggered when the leader changes more than three times in one hour. |
+| Database usage close to the quota 500M | A warning alert is triggered when the size of etcd exceeds 500M.|
+| Etcd is unavailable | A critical alert is triggered when etcd becomes unavailable. |
+| Etcd member has no leader | A critical alert is triggered when the etcd cluster does not have a leader for at least three minutes. |
+
+
+# Alerts for Kubernetes Components
+Rancher provides alerts when core Kubernetes system components become unhealthy.
+
+Controllers update Kubernetes resources based on changes in etcd. The [controller manager](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/) monitors the cluster desired state through the Kubernetes API server and makes the necessary changes to the current state to reach the desired state.
+
+The [scheduler](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/) service is a core component of Kubernetes. It is responsible for scheduling cluster workloads to nodes, based on various configurations, metrics, resource requirements and workload-specific requirements.
+
+| Alert | Explanation |
+|-------|-------------|
+| Controller Manager is unavailable |  A critical warning is triggered when the cluster’s controller-manager becomes unavailable. |
+| Scheduler is unavailable | A critical warning is triggered when the cluster’s scheduler becomes unavailable. |
+
+
+# Alerts for Events
+Kubernetes events are objects that provide insight into what is happening inside a cluster, such as what decisions were made by the scheduler or why some pods were evicted from the node. In the Rancher UI, from the project view, you can see events for each workload.
+
+| Alert | Explanation |
+|-------|-------------|
+| Get warning deployment event | A warning alert is triggered when a warning event happens on a deployment. |
+
+
+# Alerts for Nodes
+Alerts can be triggered based on node metrics. Each computing resource in a Kubernetes cluster is called a node. [Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/#kubernetes-cluster-node-components) can be either bare-metal servers or virtual machines.
+
+| Alert | Explanation |
+|-------|-------------|
+| High CPU load | A warning alert is triggered if the node uses more than 100 percent of the node’s available CPU seconds for at least three minutes. |
+| High node memory utilization | A warning alert is triggered if the node uses more than 80 percent of its available memory for at least three minutes. |
+| Node disk is running full within 24 hours | A critical alert is triggered if the disk space on the node is expected to run out in the next 24 hours based on the disk growth over the last 6 hours. |
+
+# Project-level Alerts
+When you enable monitoring for the project, some project-level alerts are provided. For details, refer to the [section on project-level alerts.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/#default-project-level-alerts)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/monitoring/cluster-metrics/_index.md b/content/rancher/v2.5/en/applications/monitoring/cluster-metrics/_index.md
new file mode 100644
index 00000000000..61c20f040c0
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/cluster-metrics/_index.md
@@ -0,0 +1,113 @@
+---
+title: Cluster Metrics
+weight: 3
+---
+
+_Available as of v2.2.0_
+
+Cluster metrics display the hardware utilization for all nodes in your cluster, regardless of its role. They give you a global monitoring insight into the cluster.
+
+Some of the biggest metrics to look out for:
+
+- **CPU Utilization**
+
+    High load either indicates that your cluster is running efficiently or that you're running out of CPU resources.
+
+- **Disk Utilization**
+
+    Be on the lookout for increased read and write rates on nodes nearing their disk capacity. This advice is especially true for etcd nodes, as running out of storage on an etcd node leads to cluster failure.
+
+- **Memory Utilization**
+
+    Deltas in memory utilization usually indicate a memory leak.
+
+- **Load Average**
+
+     Generally, you want your load average to match your number of logical CPUs for the cluster. For example, if your cluster has 8 logical CPUs, the ideal load average would be 8 as well. If you load average is well under the number of logical CPUs for the cluster, you may want to reduce cluster resources. On the other hand, if your average is over 8, your cluster may need more resources.
+
+## Finding Node Metrics
+
+1. From the **Global** view, navigate to the cluster that you want to view metrics.
+
+1. Select **Nodes** in the navigation bar.
+
+1. Select a specific node and click on its name.
+
+1. Click on **Node Metrics**.
+
+[_Get expressions for Cluster Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#cluster-metrics)
+
+### Etcd Metrics
+
+>**Note:** Only supported for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
+
+Etcd metrics display the operations of the etcd database on each of your cluster nodes. After establishing a baseline of normal etcd operational metrics, observe them for abnormal deltas between metric refreshes, which indicate potential issues with etcd. Always address etcd issues immediately!
+
+You should also pay attention to the text at the top of the etcd metrics, which displays leader election statistics. This text indicates if etcd currently has a leader, which is the etcd instance that coordinates the other etcd instances in your cluster. A large increase in leader changes implies etcd is unstable. If you notice a change in leader election statistics, you should investigate them for issues.
+
+Some of the biggest metrics to look out for:
+
+- **Etcd has a leader**
+
+    etcd is usually deployed on multiple nodes and elects a leader to coordinate its operations. If etcd does not have a leader, its operations are not being coordinated.
+
+- **Number of leader changes**
+
+    If this statistic suddenly grows, it usually indicates network communication issues that constantly force the cluster to elect a new leader.
+
+[_Get expressions for Etcd Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#etcd-metrics)
+
+### Kubernetes Components Metrics
+
+Kubernetes components metrics display data about the cluster's individual Kubernetes components. Primarily, it displays information about connections and latency for each component: the API server, controller manager, scheduler, and ingress controller.
+
+>**Note:** The metrics for the controller manager, scheduler and ingress controller are only supported for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
+
+When analyzing Kubernetes component metrics, don't be concerned about any single standalone metric in the charts and graphs that display. Rather, you should establish a baseline for metrics considered normal following a period of observation, e.g. the range of values that your components usually operate within and are considered normal. After you establish this baseline, be on the lookout for large deltas in the charts and graphs, as these big changes usually indicate a problem that you need to investigate.
+
+Some of the more important component metrics to monitor are:
+
+- **API Server Request Latency**
+
+    Increasing API response times indicate there's a generalized problem that requires investigation.
+
+- **API Server Request Rate**
+
+    Rising API request rates usually coincide with increased API response times. Increased request rates also indicate a generalized problem requiring investigation.
+
+- **Scheduler Preemption Attempts**
+
+    If you see a spike in scheduler preemptions, it's an indication that you're running out of hardware resources, as Kubernetes is recognizing it doesn't have enough resources to run all your pods and is prioritizing the more important ones.
+
+- **Scheduling Failed Pods**
+
+    Failed pods can have a variety of causes, such as unbound persistent volume claims, exhausted hardware resources, non-responsive nodes, etc.
+
+- **Ingress Controller Request Process Time**
+
+    How fast ingress is routing connections to your cluster services.
+
+[_Get expressions for Kubernetes Component Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#kubernetes-components-metrics)
+
+## Rancher Logging Metrics
+
+Although the Dashboard for a cluster primarily displays data sourced from Prometheus, it also displays information for cluster logging, provided that you have [configured Rancher to use a logging service]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/).
+
+[_Get expressions for Rancher Logging Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#rancher-logging-metrics)
+
+## Finding Workload Metrics
+
+Workload metrics display the hardware utilization for a Kubernetes workload. You can also view metrics for [deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/), [stateful sets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) and so on.
+
+1. From the **Global** view, navigate to the project that you want to view workload metrics.
+
+1. From the main navigation bar, choose **Resources > Workloads.** In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.
+
+1. Select a specific workload and click on its name.
+
+1. In the **Pods** section, select a specific pod and click on its name.
+
+    - **View the Pod Metrics:** Click on **Pod Metrics**.
+    - **View the Container Metrics:** In the **Containers** section, select a specific container and click on its name. Click on **Container Metrics**.
+
+[_Get expressions for Workload Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#workload-metrics)
diff --git a/content/rancher/v2.5/en/applications/monitoring/custom-metrics/_index.md b/content/rancher/v2.5/en/applications/monitoring/custom-metrics/_index.md
new file mode 100644
index 00000000000..a78b62ee206
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/custom-metrics/_index.md
@@ -0,0 +1,489 @@
+---
+title: Prometheus Custom Metrics Adapter
+weight: 5
+---
+
+After you've enabled [cluster level monitoring]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring), You can view the metrics data from Rancher. You can also deploy the Prometheus custom metrics adapter then you can use the HPA with metrics stored in cluster monitoring.
+
+## Deploy Prometheus Custom Metrics Adapter
+
+We are going to use the [Prometheus custom metrics adapter](https://github.com/DirectXMan12/k8s-prometheus-adapter/releases/tag/v0.5.0), version v0.5.0. This is a great example for the [custom metrics server](https://github.com/kubernetes-incubator/custom-metrics-apiserver). And you must be the *cluster owner* to execute following steps.
+
+- Get the service account of the cluster monitoring is using. It should be configured in the workload ID: `statefulset:cattle-prometheus:prometheus-cluster-monitoring`. And if you didn't customize anything, the service account name should be `cluster-monitoring`.
+
+- Grant permission to that service account. You will need two kinds of permission. 
+One role is `extension-apiserver-authentication-reader` in `kube-system`, so you will need to create a `Rolebinding` to in `kube-system`. This permission is to get api aggregation configuration from config map in `kube-system`.
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: custom-metrics-auth-reader
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- kind: ServiceAccount
+  name: cluster-monitoring
+  namespace: cattle-prometheus
+```
+
+The other one is cluster role `system:auth-delegator`, so you will need to create a `ClusterRoleBinding`. This permission is to have subject access review permission.
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: custom-metrics:system:auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: cluster-monitoring
+  namespace: cattle-prometheus
+```
+
+- Create configuration for custom metrics adapter. Following is an example configuration. There will be a configuration details in next session.
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: adapter-config
+  namespace: cattle-prometheus
+data:
+  config.yaml: |
+    rules:
+    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+      seriesFilters: []
+      resources:
+        overrides:
+          namespace:
+            resource: namespace
+          pod_name:
+            resource: pod
+      name:
+        matches: ^container_(.*)_seconds_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[1m])) by (<<.GroupBy>>)
+    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+      seriesFilters:
+      - isNot: ^container_.*_seconds_total$
+      resources:
+        overrides:
+          namespace:
+            resource: namespace
+          pod_name:
+            resource: pod
+      name:
+        matches: ^container_(.*)_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[1m])) by (<<.GroupBy>>)
+    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+      seriesFilters:
+      - isNot: ^container_.*_total$
+      resources:
+        overrides:
+          namespace:
+            resource: namespace
+          pod_name:
+            resource: pod
+      name:
+        matches: ^container_(.*)$
+        as: ""
+      metricsQuery: sum(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}) by (<<.GroupBy>>)
+    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
+      seriesFilters:
+      - isNot: .*_total$
+      resources:
+        template: <<.Resource>>
+      name:
+        matches: ""
+        as: ""
+      metricsQuery: sum(<<.Series>>{<<.LabelMatchers>>}) by (<<.GroupBy>>)
+    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
+      seriesFilters:
+      - isNot: .*_seconds_total
+      resources:
+        template: <<.Resource>>
+      name:
+        matches: ^(.*)_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
+    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
+      seriesFilters: []
+      resources:
+        template: <<.Resource>>
+      name:
+        matches: ^(.*)_seconds_total$
+        as: ""
+      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
+    resourceRules:
+      cpu:
+        containerQuery: sum(rate(container_cpu_usage_seconds_total{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
+        nodeQuery: sum(rate(container_cpu_usage_seconds_total{<<.LabelMatchers>>, id='/'}[1m])) by (<<.GroupBy>>)
+        resources:
+          overrides:
+            instance:
+              resource: node
+            namespace:
+              resource: namespace
+            pod_name:
+              resource: pod
+        containerLabel: container_name
+      memory:
+        containerQuery: sum(container_memory_working_set_bytes{<<.LabelMatchers>>}) by (<<.GroupBy>>)
+        nodeQuery: sum(container_memory_working_set_bytes{<<.LabelMatchers>>,id='/'}) by (<<.GroupBy>>)
+        resources:
+          overrides:
+            instance:
+              resource: node
+            namespace:
+              resource: namespace
+            pod_name:
+              resource: pod
+        containerLabel: container_name
+      window: 1m
+```
+
+- Create HTTPS TLS certs for your api server. You can use following command to create a self-signed cert.
+
+```bash
+openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out serving.crt -keyout serving.key -subj "/C=CN/CN=custom-metrics-apiserver.cattle-prometheus.svc.cluster.local"
+# And you will find serving.crt and serving.key in your path. And then you are going to create a secret in cattle-prometheus namespace.
+kubectl create secret generic -n cattle-prometheus cm-adapter-serving-certs --from-file=serving.key=./serving.key --from-file=serving.crt=./serving.crt 
+```
+
+- Then you can create the prometheus custom metrics adapter. And you will need a service for this deployment too. Creating it via Import YAML or Rancher would do. Please create those resources in `cattle-prometheus` namespaces.
+
+Here is the prometheus custom metrics adapter deployment.
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: custom-metrics-apiserver
+  name: custom-metrics-apiserver
+  namespace: cattle-prometheus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: custom-metrics-apiserver
+  template:
+    metadata:
+      labels:
+        app: custom-metrics-apiserver
+      name: custom-metrics-apiserver
+    spec:
+      serviceAccountName: cluster-monitoring
+      containers:
+      - name: custom-metrics-apiserver
+        image: directxman12/k8s-prometheus-adapter-amd64:v0.5.0
+        args:
+        - --secure-port=6443
+        - --tls-cert-file=/var/run/serving-cert/serving.crt
+        - --tls-private-key-file=/var/run/serving-cert/serving.key
+        - --logtostderr=true
+        - --prometheus-url=http://prometheus-operated/
+        - --metrics-relist-interval=1m
+        - --v=10
+        - --config=/etc/adapter/config.yaml
+        ports:
+        - containerPort: 6443
+        volumeMounts:
+        - mountPath: /var/run/serving-cert
+          name: volume-serving-cert
+          readOnly: true
+        - mountPath: /etc/adapter/
+          name: config
+          readOnly: true
+        - mountPath: /tmp
+          name: tmp-vol
+      volumes:
+      - name: volume-serving-cert
+        secret:
+          secretName: cm-adapter-serving-certs
+      - name: config
+        configMap:
+          name: adapter-config
+      - name: tmp-vol
+        emptyDir: {}
+
+```
+
+Here is the service of the deployment.
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: custom-metrics-apiserver
+  namespace: cattle-prometheus
+spec:
+  ports:
+  - port: 443
+    targetPort: 6443
+  selector:
+    app: custom-metrics-apiserver
+```
+
+- Create API service for your custom metric server.
+
+```yaml
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
+metadata:
+  name: v1beta1.custom.metrics.k8s.io
+spec:
+  service:
+    name: custom-metrics-apiserver
+    namespace: cattle-prometheus
+  group: custom.metrics.k8s.io
+  version: v1beta1
+  insecureSkipTLSVerify: true
+  groupPriorityMinimum: 100
+  versionPriority: 100
+
+```
+
+- Then you can verify your custom metrics server by `kubectl get --raw /apis/custom.metrics.k8s.io/v1beta1`. If you see the return datas from the api, it means that the metrics server has been successfully set up.
+
+- You create HPA with custom metrics now. Here is an example of HPA. You will need to create a nginx deployment in your namespace first.
+
+```yaml
+kind: HorizontalPodAutoscaler
+apiVersion: autoscaling/v2beta1
+metadata:
+  name: nginx
+spec:
+  scaleTargetRef:
+    # point the HPA at the nginx deployment you just created
+    apiVersion: apps/v1
+    kind: Deployment
+    name: nginx
+  # autoscale between 1 and 10 replicas
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  # use a "Pods" metric, which takes the average of the
+  # given metric across all pods controlled by the autoscaling target
+  - type: Pods
+    pods:
+      metricName: memory_usage_bytes
+      targetAverageValue: 5000000
+```
+
+And then, you should see your nginx is scaling up. HPA with custom metrics works.
+
+## Configuration of prometheus custom metrics adapter
+
+> Refer to https://github.com/DirectXMan12/k8s-prometheus-adapter/blob/master/docs/config.md
+
+The adapter determines which metrics to expose, and how to expose them,
+through a set of "discovery" rules.  Each rule is executed independently
+(so make sure that your rules are mutually exclusive), and specifies each
+of the steps the adapter needs to take to expose a metric in the API.
+
+Each rule can be broken down into roughly four parts:
+
+- *Discovery*, which specifies how the adapter should find all Prometheus
+  metrics for this rule.
+
+- *Association*, which specifies how the adapter should determine which
+  Kubernetes resources a particular metric is associated with.
+
+- *Naming*, which specifies how the adapter should expose the metric in
+  the custom metrics API.
+
+- *Querying*, which specifies how a request for a particular metric on one
+  or more Kubernetes objects should be turned into a query to Prometheus.
+
+A more comprehensive configuration file can be found in
+[sample-config.yaml](sample-config.yaml), but a basic config with one rule
+might look like:
+
+```yaml
+rules:
+# this rule matches cumulative cAdvisor metrics measured in seconds
+- seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
+  resources:
+    # skip specifying generic resource<->label mappings, and just
+    # attach only pod and namespace resources by mapping label names to group-resources
+    overrides:
+      namespace: {resource: "namespace"},
+      pod_name: {resource: "pod"},
+  # specify that the `container_` and `_seconds_total` suffixes should be removed.
+  # this also introduces an implicit filter on metric family names
+  name:
+    # we use the value of the capture group implicitly as the API name
+    # we could also explicitly write `as: "$1"`
+    matches: "^container_(.*)_seconds_total$"
+  # specify how to construct a query to fetch samples for a given series
+  # This is a Go template where the `.Series` and `.LabelMatchers` string values
+  # are available, and the delimiters are `<<` and `>>` to avoid conflicts with
+  # the prometheus query language
+  metricsQuery: "sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[2m])) by (<<.GroupBy>>)"
+```
+
+### Discovery
+
+Discovery governs the process of finding the metrics that you want to
+expose in the custom metrics API.  There are two fields that factor into
+discovery: `seriesQuery` and `seriesFilters`.
+
+`seriesQuery` specifies Prometheus series query (as passed to the
+`/api/v1/series` endpoint in Prometheus) to use to find some set of
+Prometheus series.  The adapter will strip the label values from this
+series, and then use the resulting metric-name-label-names combinations
+later on.
+
+In many cases, `seriesQuery` will be sufficient to narrow down the list of
+Prometheus series.  However, sometimes (especially if two rules might
+otherwise overlap), it's useful to do additional filtering on metric
+names.  In this case, `seriesFilters` can be used.  After the list of
+series is returned from `seriesQuery`, each series has its metric name
+filtered through any specified filters.
+
+Filters may be either:
+
+- `is: <regex>`, which matches any series whose name matches the specified
+  regex.
+
+- `isNot: <regex>`, which matches any series whose name does not match the
+  specified regex.
+
+For example:
+
+```yaml
+# match all cAdvisor metrics that aren't measured in seconds
+seriesQuery: '{__name__=~"^container_.*_total",container_name!="POD",namespace!="",pod_name!=""}'
+seriesFilters:
+  isNot: "^container_.*_seconds_total"
+```
+
+### Association
+
+Association governs the process of figuring out which Kubernetes resources
+a particular metric could be attached to.  The `resources` field controls
+this process.
+
+There are two ways to associate resources with a particular metric.  In
+both cases, the value of the label becomes the name of the particular
+object.
+
+One way is to specify that any label name that matches some particular
+pattern refers to some group-resource based on the label name.  This can
+be done using the `template` field.   The pattern is specified as a Go
+template, with the `Group` and `Resource` fields representing group and
+resource. You don't necessarily have to use the `Group` field (in which
+case the group is guessed by the system). For instance:
+
+```yaml
+# any label `kube_<group>_<resource>` becomes <group>.<resource> in Kubernetes
+resources:
+  template: "kube_<<.Group>>_<<.Resource>>"
+```
+
+The other way is to specify that some particular label represents some
+particular Kubernetes resource.  This can be done using the `overrides`
+field.  Each override maps a Prometheus label to a Kubernetes
+group-resource. For instance:
+
+```yaml
+# the microservice label corresponds to the apps.deployment resource
+resource:
+  overrides:
+    microservice: {group: "apps", resource: "deployment"}
+```
+
+These two can be combined, so you can specify both a template and some
+individual overrides.
+
+The resources mentioned can be any resource available in your kubernetes
+cluster, as long as you've got a corresponding label.
+
+### Naming
+
+Naming governs the process of converting a Prometheus metric name into
+a metric in the custom metrics API, and vice versa.  It's controlled by
+the `name` field.
+
+Naming is controlled by specifying a pattern to extract an API name from
+a Prometheus name, and potentially a transformation on that extracted
+value.
+
+The pattern is specified in the `matches` field, and is just a regular
+expression.  If not specified, it defaults to `.*`.
+
+The transformation is specified by the `as` field.  You can use any
+capture groups defined in the `matches` field.  If the `matches` field
+doesn't contain capture groups, the `as` field defaults to `$0`.  If it
+contains a single capture group, the `as` field defautls to `$1`.
+Otherwise, it's an error not to specify the as field.
+
+For example:
+
+```yaml
+# match turn any name <name>_total to <name>_per_second
+# e.g. http_requests_total becomes http_requests_per_second
+name:
+  matches: "^(.*)_total$"
+  as: "${1}_per_second"
+```
+
+### Querying
+
+Querying governs the process of actually fetching values for a particular
+metric.  It's controlled by the `metricsQuery` field.
+
+The `metricsQuery` field is a Go template that gets turned into
+a Prometheus query, using input from a particular call to the custom
+metrics API. A given call to the custom metrics API is distilled down to
+a metric name, a group-resource, and one or more objects of that
+group-resource.  These get turned into the following fields in the
+template:
+
+- `Series`: the metric name
+- `LabelMatchers`: a comma-separated list of label matchers matching the
+  given objects.  Currently, this is the label for the particular
+  group-resource, plus the label for namespace, if the group-resource is
+  namespaced.
+- `GroupBy`: a comma-separated list of labels to group by.  Currently,
+  this contains the group-resource label used in `LabelMatchers`.
+
+For instance, suppose we had a series `http_requests_total` (exposed as
+`http_requests_per_second` in the API) with labels `service`, `pod`,
+`ingress`, `namespace`, and `verb`. The first four correspond to
+Kubernetes resources.  Then, if someone requested the metric
+`pods/http_request_per_second` for the pods `pod1` and `pod2` in the
+`somens` namespace, we'd have:
+
+- `Series: "http_requests_total"`
+- `LabelMatchers: "pod=~\"pod1|pod2",namespace="somens"`
+- `GroupBy`: `pod`
+
+Additionally, there are two advanced fields that are "raw" forms of other
+fields:
+
+- `LabelValuesByName`: a map mapping the labels and values from the
+  `LabelMatchers` field.  The values are pre-joined by `|`
+  (for used with the `=~` matcher in Prometheus).
+- `GroupBySlice`: the slice form of `GroupBy`.
+
+In general, you'll probably want to use the `Series`, `LabelMatchers`, and
+`GroupBy` fields.  The other two are for advanced usage.
+
+The query is expected to return one value for each object requested.  The
+adapter will use the labels on the returned series to associate a given
+series back to its corresponding object.
+
+For example:
+
+```yaml
+# convert cumulative cAdvisor metrics into rates calculated over 2 minutes
+metricsQuery: "sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[2m])) by (<<.GroupBy>>)"
+```
diff --git a/content/rancher/v2.5/en/applications/monitoring/expression/_index.md b/content/rancher/v2.5/en/applications/monitoring/expression/_index.md
new file mode 100644
index 00000000000..9f5170c9779
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/expression/_index.md
@@ -0,0 +1,430 @@
+---
+title: Prometheus Expressions
+weight: 4
+---
+
+The PromQL expressions in this doc can be used to configure [alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
+
+> Before expression can be used in alerts, monitoring must be enabled. For more information, refer to the documentation on enabling monitoring [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring)
+
+For more information about querying Prometheus, refer to the official [Prometheus documentation.](https://prometheus.io/docs/prometheus/latest/querying/basics/)
+
+<!-- TOC -->
+
+- [Cluster Metrics](#cluster-metrics)
+  - [Cluster CPU Utilization](#cluster-cpu-utilization)
+  - [Cluster Load Average](#cluster-load-average)
+  - [Cluster Memory Utilization](#cluster-memory-utilization)
+  - [Cluster Disk Utilization](#cluster-disk-utilization)
+  - [Cluster Disk I/O](#cluster-disk-i-o)
+  - [Cluster Network Packets](#cluster-network-packets)
+  - [Cluster Network I/O](#cluster-network-i-o)
+- [Node Metrics](#node-metrics)
+  - [Node CPU Utilization](#node-cpu-utilization)
+  - [Node Load Average](#node-load-average)
+  - [Node Memory Utilization](#node-memory-utilization)
+  - [Node Disk Utilization](#node-disk-utilization)
+  - [Node Disk I/O](#node-disk-i-o)
+  - [Node Network Packets](#node-network-packets)
+  - [Node Network I/O](#node-network-i-o)
+- [Etcd Metrics](#etcd-metrics)
+  - [Etcd Has a Leader](#etcd-has-a-leader)
+  - [Number of Times the Leader Changes](#number-of-times-the-leader-changes)
+  - [Number of Failed Proposals](#number-of-failed-proposals)
+  - [GRPC Client Traffic](#grpc-client-traffic)
+  - [Peer Traffic](#peer-traffic)
+  - [DB Size](#db-size)
+  - [Active Streams](#active-streams)
+  - [Raft Proposals](#raft-proposals)
+  - [RPC Rate](#rpc-rate)
+  - [Disk Operations](#disk-operations)
+  - [Disk Sync Duration](#disk-sync-duration)
+- [Kubernetes Components Metrics](#kubernetes-components-metrics)
+  - [API Server Request Latency](#api-server-request-latency)
+  - [API Server Request Rate](#api-server-request-rate)
+  - [Scheduling Failed Pods](#scheduling-failed-pods)
+  - [Controller Manager Queue Depth](#controller-manager-queue-depth)
+  - [Scheduler E2E Scheduling Latency](#scheduler-e2e-scheduling-latency)
+  - [Scheduler Preemption Attempts](#scheduler-preemption-attempts)
+  - [Ingress Controller Connections](#ingress-controller-connections)
+  - [Ingress Controller Request Process Time](#ingress-controller-request-process-time)
+- [Rancher Logging Metrics](#rancher-logging-metrics)
+  - [Fluentd Buffer Queue Rate](#fluentd-buffer-queue-rate)
+  - [Fluentd Input Rate](#fluentd-input-rate)
+  - [Fluentd Output Errors Rate](#fluentd-output-errors-rate)
+  - [Fluentd Output Rate](#fluentd-output-rate)
+- [Workload Metrics](#workload-metrics)
+  - [Workload CPU Utilization](#workload-cpu-utilization)
+  - [Workload Memory Utilization](#workload-memory-utilization)
+  - [Workload Network Packets](#workload-network-packets)
+  - [Workload Network I/O](#workload-network-i-o)
+  - [Workload Disk I/O](#workload-disk-i-o)
+- [Pod Metrics](#pod-metrics)
+  - [Pod CPU Utilization](#pod-cpu-utilization)
+  - [Pod Memory Utilization](#pod-memory-utilization)
+  - [Pod Network Packets](#pod-network-packets)
+  - [Pod Network I/O](#pod-network-i-o)
+  - [Pod Disk I/O](#pod-disk-i-o)
+- [Container Metrics](#container-metrics)
+  - [Container CPU Utilization](#container-cpu-utilization)
+  - [Container Memory Utilization](#container-memory-utilization)
+  - [Container Disk I/O](#container-disk-i-o)
+
+<!-- /TOC -->
+
+# Cluster Metrics
+
+### Cluster CPU Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])) by (instance))` |
+| Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])))` |
+
+### Cluster Load Average
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr></table> |
+
+### Cluster Memory Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `1 - sum(node_memory_MemAvailable_bytes) by (instance) / sum(node_memory_MemTotal_bytes) by (instance)` |
+| Summary | `1 - sum(node_memory_MemAvailable_bytes) / sum(node_memory_MemTotal_bytes)` |
+
+### Cluster Disk Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `(sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance) - sum(node_filesystem_free_bytes{device!="rootfs"}) by (instance)) / sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance)` |
+| Summary | `(sum(node_filesystem_size_bytes{device!="rootfs"}) - sum(node_filesystem_free_bytes{device!="rootfs"})) / sum(node_filesystem_size_bytes{device!="rootfs"})` |
+
+### Cluster Disk I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m])) by (instance)`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m]))`</td></tr></table> |
+
+### Cluster Network Packets
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
+| Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
+
+### Cluster Network I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
+| Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
+
+# Node Metrics
+
+### Node CPU Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `avg(irate(node_cpu_seconds_total{mode!="idle", instance=~"$instance"}[5m])) by (mode)` |
+| Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle", instance=~"$instance"}[5m])))` |
+
+### Node Load Average
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
+| Summary | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
+
+### Node Memory Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"})` |
+| Summary | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"}) ` |
+
+### Node Disk Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"}) by (device)) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device)` |
+| Summary | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"})) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"})` |
+
+### Node Disk I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
+
+### Node Network Packets
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
+| Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
+
+### Node Network I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
+| Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
+
+# Etcd Metrics
+
+### Etcd Has a Leader
+
+`max(etcd_server_has_leader)`
+
+### Number of Times the Leader Changes
+
+`max(etcd_server_leader_changes_seen_total)`
+
+### Number of Failed Proposals
+
+`sum(etcd_server_proposals_failed_total)`
+
+### GRPC Client Traffic
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m]))`</td></tr></table> |
+
+### Peer Traffic
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m]))`</td></tr></table> |
+
+### DB Size
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(etcd_debugging_mvcc_db_total_size_in_bytes) by (instance)` |
+| Summary | `sum(etcd_debugging_mvcc_db_total_size_in_bytes)` |
+
+### Active Streams
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance)`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"})`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"})`</td></tr></table> |
+
+### Raft Proposals
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m])) by (instance)`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m])) by (instance)`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m])) by (instance)`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m]))`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m]))`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m]))`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m]))`</td></tr></table> |
+
+### RPC Rate
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m])) by (instance)`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m]))`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m]))`</td></tr></table> |
+
+### Disk Operations
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m])) by (instance)`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m])) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m]))`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m]))`</td></tr></table> |
+
+### Disk Sync Duration
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>wal</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le))`</td></tr><tr><td>db</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le))`</td></tr></table> |
+| Summary | <table><tr><td>wal</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr><tr><td>db</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr></table> |
+
+# Kubernetes Components Metrics
+
+### API Server Request Latency
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance, verb) /1e+06` |
+| Summary | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance) /1e+06` |
+
+### API Server Request Rate
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(apiserver_request_count[5m])) by (instance, code)` |
+| Summary | `sum(rate(apiserver_request_count[5m])) by (instance)` |
+
+### Scheduling Failed Pods
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(kube_pod_status_scheduled{condition="false"})` |
+| Summary | `sum(kube_pod_status_scheduled{condition="false"})` |
+
+### Controller Manager Queue Depth
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>volumes</td><td>`sum(volumes_depth) by instance`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth) by instance`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth) by instance`</td></tr><tr><td>service</td><td>`sum(service_depth) by instance`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth) by instance`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth) by instance`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth) by instance`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth) by instance`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth) by instance`</td></tr></table> |
+| Summary | <table><tr><td>volumes</td><td>`sum(volumes_depth)`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth)`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth)`</td></tr><tr><td>service</td><td>`sum(service_depth)`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth)`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth)`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth)`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth)`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth)`</td></tr></table> |
+
+### Scheduler E2E Scheduling Latency
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06` |
+| Summary | `sum(histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06)` |
+
+### Scheduler Preemption Attempts
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(scheduler_total_preemption_attempts[5m])) by (instance)` |
+| Summary | `sum(rate(scheduler_total_preemption_attempts[5m]))` |
+
+### Ingress Controller Connections
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"}) by (instance)`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"}) by (instance)`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"}) by (instance)`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m]))) by (instance)`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m]))) by (instance)`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m]))) by (instance)`</td></tr></table> |
+| Summary | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"})`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"})`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"})`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m])))`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m])))`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m])))`</td></tr></table> |
+
+### Ingress Controller Request Process Time
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `topk(10, histogram_quantile(0.95,sum by (le, host, path)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
+| Summary | `topk(10, histogram_quantile(0.95,sum by (le, host)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
+
+# Rancher Logging Metrics
+
+
+### Fluentd Buffer Queue Rate
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_output_status_buffer_queue_length[5m])) by (instance)` |
+| Summary | `sum(rate(fluentd_output_status_buffer_queue_length[5m]))` |
+
+### Fluentd Input Rate
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_input_status_num_records_total[5m])) by (instance)` |
+| Summary | `sum(rate(fluentd_input_status_num_records_total[5m]))` |
+
+### Fluentd Output Errors Rate
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_output_status_num_errors[5m])) by (type)` |
+| Summary | `sum(rate(fluentd_output_status_num_errors[5m]))` |
+
+### Fluentd Output Rate
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(rate(fluentd_output_status_num_records_total[5m])) by (instance)` |
+| Summary | `sum(rate(fluentd_output_status_num_records_total[5m]))` |
+
+# Workload Metrics
+
+### Workload CPU Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+
+### Workload Memory Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""}) by (pod_name)` |
+| Summary | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""})` |
+
+### Workload Network Packets
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+
+### Workload Network I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+
+### Workload Disk I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
+
+# Pod Metrics
+
+### Pod CPU Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr></table> |
+| Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr></table> |
+
+### Pod Memory Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""}) by (container_name)` |
+| Summary | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""})` |
+
+### Pod Network Packets
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+| Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+
+### Pod Network I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+| Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+
+### Pod Disk I/O
+
+| Catalog | Expression |
+| --- | --- |
+| Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr></table> |
+| Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
+
+# Container Metrics
+
+### Container CPU Utilization
+
+| Catalog | Expression |
+| --- | --- |
+| cfs throttled seconds | `sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| usage seconds | `sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| system seconds | `sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| user seconds | `sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+
+### Container Memory Utilization
+
+`sum(container_memory_working_set_bytes{namespace="$namespace",pod_name="$podName",container_name="$containerName"})`
+
+### Container Disk I/O
+
+| Catalog | Expression |
+| --- | --- |
+| read | `sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
+| write | `sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
diff --git a/content/rancher/v2.5/en/applications/monitoring/prometheus/_index.md b/content/rancher/v2.5/en/applications/monitoring/prometheus/_index.md
new file mode 100644
index 00000000000..6fd878ec3ff
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/prometheus/_index.md
@@ -0,0 +1,63 @@
+---
+title: Prometheus Configuration
+weight: 1
+---
+
+_Available as of v2.2.0_
+
+
+While configuring monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), there are multiple options that can be configured.
+
+Option | Description
+-------|-------------
+Data Retention | How long your Prometheus instance retains monitoring data scraped from Rancher objects before it's purged.
+[Enable Node Exporter](#node-exporter) | Whether or not to deploy the node exporter.
+Node Exporter Host Port | The host port on which data is exposed, i.e. data that Prometheus collects from your node hardware. Required if you have enabled the node exporter.
+[Enable Persistent Storage](#persistent-storage) for Prometheus | Whether or not to configure storage for Prometheus so that metrics can be retained even if the Prometheus pod fails.
+[Enable Persistent Storage](#persistent-storage) for Grafana | Whether or not to configure storage for Grafana so that the Grafana dashboards and configuration  can be retained even if the Grafana pod fails.
+Prometheus [CPU Limit](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu) |  CPU resource limit for the Prometheus pod.
+Prometheus [CPU Reservation](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu) | CPU reservation for the Prometheus pod.
+Prometheus [Memory Limit](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory) | Memory resource limit for the Prometheus pod.
+Prometheus [Memory Reservation](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory) | Memory resource requests for the Prometheus pod.
+Selector | Ability to select the nodes in which Prometheus and Grafana pods are deployed to. To use this option, the nodes must have labels.
+Advanced Options | Since monitoring is an [application](https://github.com/rancher/system-charts/tree/dev/charts/rancher-monitoring) from the [Rancher catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/), it can be [configured like other catalog application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/#configuration-options). _Warning: Any modification to the application without understanding the entire application can lead to catastrophic errors._
+
+## Node Exporter
+
+The [node exporter](https://github.com/prometheus/node_exporter/blob/master/README.md) is a popular open source exporter, which exposes the metrics for hardware and \*NIX kernels OS. It is designed to monitor the host system. However, there are still issues with namespaces when running it in a container, mostly around filesystem mount spaces. In order to monitor actual network metrics for the container network, the node exporter must be deployed with the `hostNetwork` mode.
+
+When configuring Prometheus and enabling the node exporter, enter a host port in the **Node Exporter Host Port** that will not produce port conflicts with existing applications. The host port chosen must be open to allow internal traffic between Prometheus and the Node Exporter.
+
+>**Warning:** In order for Prometheus to collect the metrics of the node exporter, after enabling cluster monitoring, you must open the <b>Node Exporter Host Port</b> in the host firewall rules to allow intranet access. By default, `9796` is used as that host port.
+
+## Persistent Storage
+
+>**Prerequisite:** Configure one or more [storage class]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) to use as [persistent storage]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) for your Prometheus or Grafana pod.
+
+By default, when you enable Prometheus for either a cluster or project, all monitoring data that Prometheus collects is stored on its own pod. With local storage, if the Prometheus or Grafana pods fail, all the data is lost. Rancher recommends configuring an external persistent storage to the cluster. With the external persistent storage, if the Prometheus or Grafana pods fail, the new pods can recover using data from the persistent storage.
+
+When enabling persistent storage for Prometheus or Grafana, specify the size of the persistent volume and select the [storage class]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#storage-classes).
+
+## Remote Storage
+
+>**Prerequisite:** Need a remote storage endpoint to be available. The possible list of integrations is available [here](https://prometheus.io/docs/operating/integrations/)
+
+Using advanced options, remote storage integration for the Prometheus installation can be configured as follows:
+
+```
+prometheus.remoteWrite[0].url = http://remote1/push
+prometheus.remoteWrite[0].remoteTimeout = 33s
+
+prometheus.remoteWrite[1].url = http://remote2/push
+
+
+prometheus.remoteRead[0].url = http://remote1/read
+prometheus.remoteRead[0].proxyUrl = http://proxy.url
+prometheus.remoteRead[0].bearerToken = token-value
+
+prometheus.remoteRead[1].url = http://remote2/read
+prometheus.remoteRead[1].remoteTimeout = 33s
+prometheus.remoteRead[1].readRecent = true
+```
+
+Additional fields can be set up based on the [ReadSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotereadspec) and [RemoteWriteSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotewritespec)
diff --git a/content/rancher/v2.5/en/applications/monitoring/viewing-metrics/_index.md b/content/rancher/v2.5/en/applications/monitoring/viewing-metrics/_index.md
new file mode 100644
index 00000000000..a1dd3946219
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/monitoring/viewing-metrics/_index.md
@@ -0,0 +1,60 @@
+---
+title: Viewing Metrics
+weight: 2
+---
+
+_Available as of v2.2.0_
+
+After you've enabled monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), you will want to be start viewing the data being collected. There are multiple ways to view this data.
+
+## Rancher Dashboard
+
+>**Note:** This is only available if you've enabled monitoring at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring). Project specific analytics must be viewed using the project's Grafana instance.
+
+Rancher's dashboards are available at multiple locations:
+
+- **Cluster Dashboard**: From the **Global** view, navigate to the cluster.
+- **Node Metrics**: From the **Global** view, navigate to the cluster. Select **Nodes**. Find the individual node and click on its name. Click **Node Metrics.**
+- **Workload Metrics**: From the **Global** view, navigate to the project. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Find the individual workload and click on its name. Click **Workload Metrics.**
+- **Pod Metrics**: From the **Global** view, navigate to the project. Select **Workloads > Workloads**. Find the individual workload and click on its name. Find the individual pod and click on its name. Click **Pod Metrics.**
+- **Container Metrics**: From the **Global** view, navigate to the project. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Find the individual workload and click on its name. Find the individual pod and click on its name. Find the individual container and click on its name. Click **Container Metrics.**
+
+Prometheus metrics are displayed and are denoted with the Grafana icon. If you click on the icon, the metrics will open a new tab in Grafana.
+
+Within each Prometheus metrics widget, there are several ways to customize your view.
+
+- Toggle between two views:
+  - **Detail**: Displays graphs and charts that let you view each event in a Prometheus time series
+  - **Summary** Displays events in a Prometheus time series that are outside the norm.
+- Change the range of the time series that you're viewing to see a more refined or expansive data sample.
+- Customize the data sample to display data between specific dates and times.
+
+When analyzing these metrics, don't be concerned about any single standalone metric in the charts and graphs. Rather, you should establish a baseline for your metrics over the course of time, e.g. the range of values that your components usually operate within and are considered normal. After you establish the baseline, be on the lookout for any large deltas in the charts and graphs, as these big changes usually indicate a problem that you need to investigate.
+
+## Grafana
+
+If you've enabled monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), Rancher automatically creates a link to Grafana instance. Use this link to view monitoring data.
+
+Grafana allows you to query, visualize, alert, and ultimately, understand your cluster and workload data. For more information on Grafana and its capabilities, visit the [Grafana website](https://grafana.com/grafana).
+
+### Authentication
+
+Rancher determines which users can access the new Grafana instance, as well as the objects they can view within it, by validating them against the user's [cluster or project roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/). In other words, a user's access in Grafana mirrors their access in Rancher.
+
+When you go to the Grafana instance, you will be logged in with the username `admin` and the password `admin`. If you log out and log in again, you will be prompted to change your password. You will only have access to the URL of the Grafana instance if you have access to view the corresponding metrics in Rancher. So for example, if your Rancher permissions are scoped to the project level, you won't be able to see the Grafana instance for cluster-level metrics.
+
+### Accessing the Cluster-level Grafana Instance
+
+1. From the **Global** view, navigate to a cluster that has monitoring enabled.
+
+1. Go to the **System** project view. This project is where the cluster-level Grafana instance runs.
+
+1. Click **Apps.** In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar.
+
+1. Go to the `cluster-monitoring` application.
+
+1. In the `cluster-monitoring` application, there are two `/index.html` links: one that leads to a Grafana instance and one that leads to a Prometheus instance. When you click the Grafana link, it will redirect you to a new webpage for Grafana, which shows metrics for the cluster.
+
+1. You will be signed in to the Grafana instance automatically. The default username is `admin` and the default password is `admin`. For security, we recommend that you log out of Grafana, log back in with the `admin` password, and change your password.
+
+**Results:** You are logged into Grafana from the Grafana instance. After logging in, you can view the preset Grafana dashboards, which are imported via the [Grafana provisioning mechanism](http://docs.grafana.org/administration/provisioning/#dashboards), so you cannot modify them directly. For now, if you want to configure your own dashboards, clone the original and modify the new copy.
diff --git a/content/rancher/v2.5/en/applications/notifiers/_index.md b/content/rancher/v2.5/en/applications/notifiers/_index.md
new file mode 100644
index 00000000000..c5860f0c33e
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/notifiers/_index.md
@@ -0,0 +1,132 @@
+---
+title: Notifiers
+weight: 1
+---
+
+Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action.
+
+Rancher integrates with a variety of popular IT services, including:
+
+- **Slack**: Send alert notifications to your Slack channels.
+- **Email**: Choose email recipients for alert notifications.
+- **PagerDuty**: Route notifications to staff by phone, SMS, or personal email.
+- **WebHooks**: Update a webpage with alert notifications.
+- **WeChat**: Send alert notifications to your Enterprise WeChat contacts.
+
+This section covers the following topics:
+
+- [Roles-based access control for notifiers](#roles-based-access-control-for-notifiers)
+- [Adding notifiers](#adding-notifiers)
+- [Managing notifiers](#managing-notifiers)
+- [Example payload for a webhook alert notifier](#example-payload-for-a-webhook-alert-notifier)
+
+### Roles-based Access Control for Notifiers
+
+Notifiers are configured at the cluster level. This model ensures that only cluster owners need to configure notifiers, leaving project owners to simply configure alerts in the scope of their projects. You don't need to dispense privileges like SMTP server access or cloud account access.
+
+### Adding Notifiers
+
+Set up a notifier so that you can begin configuring and sending alerts.
+
+1. From the **Global View**, open the cluster that you want to add a notifier.
+
+1. From the main menu, select **Tools > Notifiers**. Then click **Add Notifier**.
+
+1. Select the service you want to use as your notifier, and then fill out the form.
+{{% accordion id="slack" label="Slack" %}}
+1. Enter a **Name** for the notifier.
+1. From Slack, create a webhook. For instructions, see the [Slack Documentation](https://get.slack.help/hc/en-us/articles/115005265063-Incoming-WebHooks-for-Slack).
+1. From Rancher, enter your Slack webhook **URL**.
+1. Enter the name of the channel that you want to send alert notifications in the following format: `#<channelname>`.
+
+    Both public and private channels are supported.
+1. Click **Test**. If the test is successful, the Slack channel you're configuring for the notifier outputs `Slack setting validated`.
+{{% /accordion %}}
+{{% accordion id="email" label="Email" %}}
+1. Enter a **Name** for the notifier.
+1. In the **Sender** field, enter an email address available on your mail server that you want to send the notification.
+1. In the **Host** field, enter the IP address or hostname for your SMTP server. Example: `smtp.email.com`
+1. In the **Port** field, enter the port used for email. Typically, TLS uses `587` and SSL uses `465`. If you're using TLS, make sure **Use TLS** is selected.
+1. Enter a **Username** and **Password** that authenticate with the SMTP server.
+1. In the **Default Recipient** field, enter the email address that you want to receive the notification.
+1. Click **Test**. If the test is successful, Rancher prints `settings validated` and you receive a test notification email.
+{{% /accordion %}}
+{{% accordion id="pagerduty" label="PagerDuty" %}}
+1. Enter a **Name** for the notifier.
+1. From PagerDuty, create a Prometheus integration. For instructions, see the [PagerDuty Documentation](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/).
+1. From PagerDuty, copy the integration's **Integration Key**.
+1. From Rancher, enter the key in the **Service Key** field.
+1. Click **Test**. If the test is successful, your PagerDuty endpoint outputs `PagerDuty setting validated`.
+{{% /accordion %}}
+{{% accordion id="webhook" label="WebHook" %}}
+1. Enter a **Name** for the notifier.
+1. Using the app of your choice, create a webhook URL.
+1. Enter your webhook **URL**.
+1. Click **Test**. If the test is successful, the URL you're configuring as a notifier outputs `Webhook setting validated`.
+{{% /accordion %}}
+{{% accordion id="WeChat" label="WeChat" %}}
+
+_Available as of v2.2.0_
+
+1. Enter a **Name** for the notifier.
+1. In the **Corporation ID** field, enter the "EnterpriseID" of your corporation, you could get it from [Profile page](https://work.weixin.qq.com/wework_admin/frame#profile).
+1. From Enterprise WeChat, create an application in the [Application page](https://work.weixin.qq.com/wework_admin/frame#apps), and then enter the "AgentId" and "Secret" of this application to the **Application Agent ID** and **Application Secret** fields.
+1. Select the **Recipient Type** and then enter a corresponding id to **Default Recipient** field, for example, the party id, tag id or user account that you want to receive the notification. You could get contact information from [Contacts page](https://work.weixin.qq.com/wework_admin/frame#contacts).
+{{% /accordion %}}
+
+1. _Available as of v2.3.0_ - Select **Enable** for **Send Resolved Alerts** if you wish to notify about resolved alerts.
+1. Click **Add** to complete adding the notifier.
+
+**Result:** Your notifier is added to Rancher.
+
+
+### Managing Notifiers
+
+After you set up notifiers, you can manage them. From the **Global** view, open the cluster that you want to manage your notifiers. Select **Tools > Notifiers**. You can:
+
+- **Edit** their settings that you configured during their initial setup.
+- **Clone** them, to quickly setup slightly different notifiers.
+- **Delete** them when they're no longer necessary.
+
+### Example Payload for a Webhook Alert Notifier
+
+```json
+{
+  "receiver": "c-2a3bc:kube-components-alert",
+  "status": "firing",
+  "alerts": [
+    {
+      "status": "firing",
+      "labels": {
+        "alert_name": "Scheduler is unavailable",
+        "alert_type": "systemService",
+        "cluster_name": "mycluster (ID: c-2a3bc)",
+        "component_name": "scheduler",
+        "group_id": "c-2a3bc:kube-components-alert",
+        "logs": "Get http://127.0.0.1:10251/healthz: dial tcp 127.0.0.1:10251: connect: connection refused",
+        "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service",
+        "severity": "critical"
+      },
+      "annotations": {},
+      "startsAt": "2020-01-30T19:18:13.321684733Z",
+      "endsAt": "0001-01-01T00:00:00Z",
+      "generatorURL": ""
+    }
+  ],
+  "groupLabels": {
+    "component_name": "scheduler",
+    "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service"
+  },
+  "commonLabels": {
+    "alert_name": "Scheduler is unavailable",
+    "alert_type": "systemService",
+    "cluster_name": "mycluster (ID: c-2a3bc)"
+  }
+}
+```
+### What's Next?
+
+After creating a notifier, set up alerts to receive notifications of Rancher system events.
+
+- [Cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) can set up alerts at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/).
+- [Project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can set up alerts at the [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/).
diff --git a/content/rancher/v2.5/en/applications/opa-gatekeper/_index.md b/content/rancher/v2.5/en/applications/opa-gatekeper/_index.md
new file mode 100644
index 00000000000..d4c206f510d
--- /dev/null
+++ b/content/rancher/v2.5/en/applications/opa-gatekeper/_index.md
@@ -0,0 +1,96 @@
+---
+title: OPA Gatekeeper
+weight: 1
+---
+
+> This page is under construction.
+
+To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. 
+
+OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making.
+
+[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is a project that provides integration between OPA and Kubernetes. OPA Gatekeeper provides:
+
+- An extensible, parameterized policy library.
+- Native Kubernetes CRDs for instantiating the policy library, also called “constraints."
+- Native Kubernetes CRDs for extending the policy library, also called "constraint templates."
+- Audit functionality.
+
+To read more about OPA, please refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/)
+
+# How the OPA Gatekeeper Integration Works
+
+Kubernetes provides the ability to extend API server functionality via admission controller webhooks, which are invoked whenever a resource is created, updated or deleted. Gatekeeper is installed as a validating webhook and enforces policies defined by Kubernetes custom resource definitions. In addition to the admission control usage, Gatekeeper provides the capability to audit existing resources in Kubernetes clusters and mark current violations of enabled policies.
+
+OPA Gatekeeper is made availale via Rancher's Helm system chart, and it is installed in a namespace named `gatekeeper-system.`
+
+# Enabling OPA Gatekeeper in a Cluster
+
+> **Prerequisites:** 
+> 
+> - Only administrators and cluster owners can enable OPA Gatekeeper.
+> - The dashboard needs to be enabled using the `dashboard` feature flag. For more information, refer to the [section on enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
+
+1. Navigate to the cluster's **Dashboard** view.
+1. On the left side menu, expand the cluster menu and click on **OPA Gatekeeper.**
+1. To install Gatekeeper with the default configuration, click on **Enable Gatekeeper (v0.1.0) with defaults.**
+1. To change any default configuration, click on **Customize Gatekeeper yaml configuration.**
+      
+# Constraint Templates
+
+[Constraint templates](https://github.com/open-policy-agent/gatekeeper#constraint-templates) are Kubernetes custom resources that define the schema and Rego logic of the OPA policy to be applied by Gatekeeper. For more information on the Rego policy language, refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/policy-language/)
+
+When OPA Gatekeeper is enabled, Rancher installs some templates by default.
+
+To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates.**
+
+Rancher also provides the ability to create your own constraint templates by importing YAML definitions.
+   
+# Creating and Configuring Constraints
+
+[Constraints](https://github.com/open-policy-agent/gatekeeper#constraints) are Kubernetes custom resources that define the scope of objects to which a specific constraint template applies to. The complete policy is defined by constraint templates and constraints together.
+
+> **Prerequisites:** OPA Gatekeeper must be enabled in the cluster.
+
+To list the constraints installed, go to the left side menu under OPA Gatekeeper, and click on **Constraints.**
+
+New constraints can be created from a constraint template.
+
+Rancher provides the ability to create a constraint by using a convenient form that lets you input the various constraint fields.
+
+The **Edit as yaml** option is also availble to configure the the constraint's yaml definition.
+
+### Exempting Rancher's System Namespaces from Constraints
+
+When a constraint is created, ensure that it does not apply to any Rancher or Kubernetes system namespaces. If the system namespaces are not excluded, then it is possible to see many resources under them marked as violations of the constraint.
+
+To limit the scope of the constraint only to user namespaces, always specify these namespaces under the **Match** field of the constraint.
+
+Also, the constraint may interfere with other Rancher functionality and deny system workloads from being deployed. To avoid this, exclude all Rancher-specific namespaces from your constraints.
+   
+# Enforcing Constraints in your Cluster
+
+When the **Enforcement Action** is **Deny,** the constraint is immediately enabled and will deny any requests that violate the policy defined. By default, the enforcement value is **Deny.**
+
+When the **Enforcement Action** is **Dryrun,** then any resources that violate the policy are only recorded under the constraint's status field.
+
+To enforce constraints, create a constraint using the form. In the **Enforcement Action** field, choose **Deny.** 
+
+# Audit and Violations in your Cluster
+
+OPA Gatekeeper runs a periodic audit to check if any existing resource violates any enforced constraint. The audit-interval (default 300s) can be configured while installing Gatekeeper.
+
+On the Gatekeeper page, any violations of the defined constraints are listed.
+
+Also under **Constraints,** the number of violations of the constraint can be found.
+
+The detail view of each constraint lists information about the resource that violated the constraint.
+
+# Disabling Gatekeeper
+
+1. Navigate to the cluster's Dashboard view
+1. On the left side menu, expand the cluster menu and click on **OPA Gatekeeper.**
+1. Click the **&#8942; > Disable**.
+
+**Result:** Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted.
+
diff --git a/content/rancher/v2.5/en/backup-application/_index.md b/content/rancher/v2.5/en/backup-application/_index.md
new file mode 100644
index 00000000000..51b16aa65fb
--- /dev/null
+++ b/content/rancher/v2.5/en/backup-application/_index.md
@@ -0,0 +1,21 @@
+---
+title: Backups and Disaster Recovery
+weight: 200
+---
+
+> This section is under construction.
+
+This section is devoted to protecting your data in a disaster scenario.
+
+To protect yourself from a disaster scenario, you should create backups on a regular basis.
+
+We recommend using the backup/restore application to back up Rancher and to restore it from backup.
+
+The Helm chart for the application is available as in Rancher. After you have enabled the application, you will be able to use backup templates for Rancher, Fleet, and the Enterprise Cluster Manager.
+
+### Special Scenarios for Rollbacks
+
+Because of the changes necessary to address [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321), special steps are necessary if the user wants to roll back to a previous version of Rancher where this vulnerability exists, so they are needed for these situations:
+
+- Rolling back from v2.1.6+ to any version between v2.1.0 - v2.1.5 or v2.0.0 - v2.0.10.
+- Rolling back from v2.0.11+ to any version between v2.0.0 - v2.0.10.  
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/backup-application/docker/_index.md b/content/rancher/v2.5/en/backup-application/docker/_index.md
new file mode 100644
index 00000000000..3306f194e62
--- /dev/null
+++ b/content/rancher/v2.5/en/backup-application/docker/_index.md
@@ -0,0 +1,6 @@
+---
+title: Rancher Installed with Docker
+weight: 4
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/backup-application/docker/docker-backups/_index.md b/content/rancher/v2.5/en/backup-application/docker/docker-backups/_index.md
new file mode 100644
index 00000000000..97825f9069a
--- /dev/null
+++ b/content/rancher/v2.5/en/backup-application/docker/docker-backups/_index.md
@@ -0,0 +1,69 @@
+---
+title: Backing up Rancher Installed with Docker
+weight: 4
+---
+
+After completing your Docker installation of Rancher, we recommend creating backups of it on a regular basis. Having a recent backup will let you recover quickly from an unexpected disaster.
+
+## Before You Start
+
+During the creation of your backup, you'll enter a series of commands, replacing placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`). Here's an example of a command with a placeholder:
+
+```
+docker run  --volumes-from rancher-data-<DATE> -v $PWD:/backup busybox tar pzcvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz /var/lib/rancher
+```
+
+In this command, `<DATE>` is a placeholder for the date that the data container and backup were created. `9-27-18` for example.
+
+Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the [procedure below](#creating-a-backup).
+
+<sup>Terminal `docker ps` Command, Displaying Where to Find `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>`</sup>
+![Placeholder Reference]({{<baseurl>}}/img/rancher/placeholder-ref.png)
+
+| Placeholder                | Example                    | Description                                               |
+| -------------------------- | -------------------------- | --------------------------------------------------------- |
+| `<RANCHER_CONTAINER_TAG>`  | `v2.0.5`                   | The rancher/rancher image you pulled for initial install. |
+| `<RANCHER_CONTAINER_NAME>` | `festive_mestorf`          | The name of your Rancher container.                       |
+| `<RANCHER_VERSION>`        | `v2.0.5`                   | The version of Rancher that you're creating a backup for. |
+| `<DATE>`                   | `9-27-18`                  | The date that the data container or backup was created.   |
+<br/>
+
+You can obtain `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>` by logging into your Rancher Server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped with `docker ps -a`. Use these commands for help anytime while creating backups.
+
+## Creating a Backup
+
+This procedure creates a backup that you can restore if Rancher encounters a disaster scenario.
+
+
+1. Using a remote Terminal connection, log into the node running your Rancher Server.
+
+1. Stop the container currently running Rancher Server. Replace `<RANCHER_CONTAINER_NAME>` with the [name of your Rancher container](#before-you-start).
+
+    ```
+    docker stop <RANCHER_CONTAINER_NAME>
+    ```
+1. <a id="backup"></a>Use the command below, replacing each [placeholder](#before-you-start), to create a data container from the Rancher container that you just stopped.
+
+    ```
+    docker create --volumes-from <RANCHER_CONTAINER_NAME> --name rancher-data-<DATE> rancher/rancher:<RANCHER_CONTAINER_TAG>
+    ```
+
+1. <a id="tarball"></a>From the data container that you just created (`rancher-data-<DATE>`), create a backup tarball (`rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`). Use the following command, replacing each [placeholder](#before-you-start).
+
+    ```
+    docker run  --volumes-from rancher-data-<DATE> -v $PWD:/backup:z busybox tar pzcvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz /var/lib/rancher
+    ```
+
+    **Step Result:** A stream of commands runs on the screen.
+
+1. Enter the `ls` command to confirm that the backup tarball was created. It will have a name similar to `rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`.
+
+1. Move your backup tarball to a safe location external to your Rancher Server. Then delete the `rancher-data-<DATE>` container from your Rancher Server.
+
+1. Restart Rancher Server. Replace `<RANCHER_CONTAINER_NAME>` with the name of your [Rancher container](#before-you-start).
+
+    ```
+    docker start <RANCHER_CONTAINER_NAME>
+    ```
+
+**Result:** A backup tarball of your Rancher Server data is created. See [Restoring Backups: Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/single-node-restoration) if you need to restore backup data.
diff --git a/content/rancher/v2.5/en/backup-application/docker/docker-restore/_index.md b/content/rancher/v2.5/en/backup-application/docker/docker-restore/_index.md
new file mode 100644
index 00000000000..18941da7d84
--- /dev/null
+++ b/content/rancher/v2.5/en/backup-application/docker/docker-restore/_index.md
@@ -0,0 +1,68 @@
+---
+title: Restoring Rancher Installed with Docker
+weight: 3
+---
+
+If you encounter a disaster scenario, you can restore your Rancher Server to your most recent backup.
+
+## Before You Start
+
+When restoring your backup, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`). Here's an example of a command with a placeholder:
+
+```
+docker run  --volumes-from <RANCHER_CONTAINER_NAME> -v $PWD:/backup \
+busybox sh -c "rm /var/lib/rancher/* -rf  && \
+tar pzxvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>"
+```
+
+In this command, `<RANCHER_CONTAINER_NAME>` and `<RANCHER_VERSION>-<DATE>` are environment variables for your Rancher deployment.
+
+Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the [procedure below](#creating-a-backup).
+
+<sup>Terminal `docker ps` Command, Displaying Where to Find `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>`</sup>
+![Placeholder Reference]({{<baseurl>}}/img/rancher/placeholder-ref.png)
+
+| Placeholder                | Example                    | Description                                               |
+| -------------------------- | -------------------------- | --------------------------------------------------------- |
+| `<RANCHER_CONTAINER_TAG>`  | `v2.0.5`                   | The rancher/rancher image you pulled for initial install. |
+| `<RANCHER_CONTAINER_NAME>` | `festive_mestorf`          | The name of your Rancher container.                       |
+| `<RANCHER_VERSION>`        | `v2.0.5`                   | The version number for your Rancher backup.               |
+| `<DATE>`                   | `9-27-18`                  | The date that the data container or backup was created.   |
+<br/>
+
+You can obtain `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>` by logging into your Rancher Server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped using a different command: `docker ps -a`. Use these commands for help anytime during while creating backups.
+
+## Restoring Backups
+
+Using a [backup]({{<baseurl>}}/rancher/v2.x/en/backups/backups/single-node-backups/) that you created earlier, restore Rancher to its last known healthy state.
+
+1. Using a remote Terminal connection, log into the node running your Rancher Server.
+
+1. Stop the container currently running Rancher Server. Replace `<RANCHER_CONTAINER_NAME>` with the [name of your Rancher container](#before-you-start).
+
+    ```
+    docker stop <RANCHER_CONTAINER_NAME>
+    ```
+1. Move the backup tarball that you created during completion of [Creating Backups—Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/backups/single-node-backups/) onto your Rancher Server. Change to the directory that you moved it to. Enter `dir` to confirm that it's there.
+
+    If you followed the naming convention we suggested in [Creating Backups—Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/backups/single-node-backups/), it will have a name similar to  `rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`.
+
+1. Enter the following command to delete your current state data and replace it with your backup data, replacing the [placeholders](#before-you-start). Don't forget to close the quotes.
+
+    >**Warning!** This command deletes all current state data from your Rancher Server container. Any changes saved after your backup tarball was created will be lost.
+
+    ```
+    docker run  --volumes-from <RANCHER_CONTAINER_NAME> -v $PWD:/backup \
+    busybox sh -c "rm /var/lib/rancher/* -rf  && \
+    tar pzxvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz"
+    ```
+
+    **Step Result:** A series of commands should run.
+
+1. Restart your Rancher Server container, replacing the [placeholder](#before-you-start). It will restart using your backup data.
+
+    ```
+    docker start <RANCHER_CONTAINER_NAME>
+    ```
+
+1.  Wait a few moments and then open Rancher in a web browser. Confirm that the restoration succeeded and that your data is restored.
diff --git a/content/rancher/v2.5/en/backup-application/special-scenarios/_index.md b/content/rancher/v2.5/en/backup-application/special-scenarios/_index.md
new file mode 100644
index 00000000000..889376b492a
--- /dev/null
+++ b/content/rancher/v2.5/en/backup-application/special-scenarios/_index.md
@@ -0,0 +1,74 @@
+---
+title: Special Scenarios for Rollbacks
+weight: 40
+---
+
+If you are rolling back to versions in either of these scenarios, you must follow some extra instructions in order to get your clusters working.
+
+- Rolling back from v2.1.6+ to any version between v2.1.0 - v2.1.5 or v2.0.0 - v2.0.10.
+- Rolling back from v2.0.11+ to any version between v2.0.0 - v2.0.10.  
+
+Because of the changes necessary to address [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321), special steps are necessary if the user wants to roll back to a previous version of Rancher where this vulnerability exists. The steps are as follows:
+
+1. Record the `serviceAccountToken` for each cluster.  To do this, save the following script on a machine with `kubectl` access to the Rancher management plane and execute it.  You will need to run these commands on the machine where the rancher container is running. Ensure JQ is installed before running the command. The commands will vary depending on how you installed Rancher.
+
+
+    **Rancher Installed with Docker**
+    ```
+    docker exec <NAME OF RANCHER CONTAINER> kubectl get clusters -o json | jq '[.items[] | select(any(.status.conditions[]; .type == "ServiceAccountMigrated")) | {name: .metadata.name, token: .status.serviceAccountToken}]' > tokens.json
+    ```
+
+    **Rancher Installed on a Kubernetes Cluster**
+    ```
+    kubectl get clusters -o json | jq '[.items[] | select(any(.status.conditions[]; .type == "ServiceAccountMigrated")) | {name: .metadata.name, token: .status.serviceAccountToken}]' > tokens.json
+    ```
+
+2. After executing the command a `tokens.json` file will be created.  Important! Back up this file in a safe place.** You will need it to restore functionality to your clusters after rolling back Rancher.  **If you lose this file, you may lose access to your clusters.**
+
+3. Rollback Rancher following the [normal instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/).
+
+4. Once Rancher comes back up, every cluster managed by Rancher (except for Imported clusters) will be in an `Unavailable` state.
+
+5. Apply the backed up tokens based on how you installed Rancher.
+
+    **Rancher Installed with Docker**
+
+    Save the following script as `apply_tokens.sh` to the machine where the Rancher docker container is running. Also copy the `tokens.json` file created previously to the same directory as the script.
+    ```
+    set -e
+
+    tokens=$(jq .[] -c tokens.json)
+    for token in $tokens; do
+        name=$(echo $token | jq -r .name)
+        value=$(echo $token | jq -r .token)
+
+        docker exec $1 kubectl patch --type=merge clusters $name -p "{\"status\": {\"serviceAccountToken\": \"$value\"}}"
+    done
+    ```
+     the script to allow execution (`chmod +x apply_tokens.sh`) and execute the script as follows:
+    ```
+    ./apply_tokens.sh <DOCKER CONTAINER NAME>
+    ```
+    After a few moments the clusters will go from Unavailable back to Available.
+
+    **Rancher Installed on a Kubernetes Cluster**
+
+    Save the following script as `apply_tokens.sh` to a machine with kubectl access to the Rancher management plane. Also copy the `tokens.json` file created previously to the same directory as the script.
+    ```
+    set -e
+
+    tokens=$(jq .[] -c tokens.json)
+    for token in $tokens; do
+        name=$(echo $token | jq -r .name)
+        value=$(echo $token | jq -r .token)
+
+       kubectl patch --type=merge clusters $name -p "{\"status\": {\"serviceAccountToken\": \"$value\"}}"
+    done
+    ```
+    Set the script to allow execution (`chmod +x apply_tokens.sh`) and execute the script as follows:
+    ```
+    ./apply_tokens.sh
+    ```
+    After a few moments the clusters will go from `Unavailable` back to `Available`.
+
+6. Continue using Rancher as normal.
diff --git a/content/rancher/v2.5/en/best-practices/_index.md b/content/rancher/v2.5/en/best-practices/_index.md
new file mode 100644
index 00000000000..41bbb4cc9c4
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/_index.md
@@ -0,0 +1,23 @@
+---
+title: Best Practices Guide
+weight: 1000
+---
+
+The purpose of this section is to consolidate best practices for Rancher implementations. This also includes recommendations for related technologies, such as Kubernetes, Docker, containers, and more. The objective is to improve the outcome of a Rancher implementation using the operational experience of Rancher and its customers.
+
+If you have any questions about how these might apply to your use case, please contact your Customer Success Manager or Support.
+
+Use the navigation bar on the left to find the current best practices for managing and deploying the Rancher Server.
+
+For more guidance on best practices, you can consult these resources:
+
+- [Rancher Docs]({{<baseurl>}})
+    - [Monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/)
+    - [Backups and Disaster Recovery]({{<baseurl>}}/rancher/v2.x/en/backups/)
+    - [Security]({{<baseurl>}}/rancher/v2.x/en/security/)
+- [Rancher Blog](https://rancher.com/blog/)
+    - [Articles about best practices on the Rancher blog](https://rancher.com/tags/best-practices/)
+    - [101 More Security Best Practices for Kubernetes](https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/)
+- [Rancher Forum](https://forums.rancher.com/)
+- [Rancher Users Slack](https://slack.rancher.io/)
+- [Rancher Labs YouTube Channel - Online Meetups, Demos, Training, and Webinars](https://www.youtube.com/channel/UCh5Xtp82q8wjijP8npkVTBA/featured)
diff --git a/content/rancher/v2.5/en/best-practices/mcm/_index.md b/content/rancher/v2.5/en/best-practices/mcm/_index.md
new file mode 100644
index 00000000000..569f3ed7602
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/mcm/_index.md
@@ -0,0 +1,6 @@
+---
+title: Recommendations for the Enterprise Cluster Manager
+weight: 2
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/best-practices/mcm/architecture-recommendations/_index.md b/content/rancher/v2.5/en/best-practices/mcm/architecture-recommendations/_index.md
new file mode 100644
index 00000000000..fd381be31e5
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/mcm/architecture-recommendations/_index.md
@@ -0,0 +1,119 @@
+---
+title: Architecture Recommendations
+weight: 3
+---
+
+Kubernetes cluster. If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters)
+
+This section covers the following topics:
+
+- [Separation of Rancher and User Clusters](#separation-of-rancher-and-user-clusters)
+- [Why HA is Better for Rancher in Production](#why-ha-is-better-for-rancher-in-production)
+- [Recommended Load Balancer Configuration for Kubernetes Installations](#recommended-load-balancer-configuration-for-ha-installations)
+- [Environment for Kubernetes Installations](#environment-for-ha-installations)
+- [Recommended Node Roles for Kubernetes Installations](#recommended-node-roles-for-ha-installations)
+- [Architecture for an Authorized Cluster Endpoint](#architecture-for-an-authorized-cluster-endpoint)
+
+# Separation of Rancher and User Clusters
+
+A user cluster is a downstream Kubernetes cluster that runs your apps and services.
+
+If you have a Docker installation of Rancher, the node running the Rancher server should be separate from your downstream clusters.
+
+In Kubernetes installations of Rancher, the Rancher server cluster should also be separate from the user clusters.
+
+![Separation of Rancher Server from User Clusters]({{<baseurl>}}/img/rancher/rancher-architecture-separation-of-rancher-server.svg)
+
+# Why HA is Better for Rancher in Production
+
+We recommend installing the Rancher server on a high-availability Kubernetes cluster, primarily because it protects the Rancher server data. In a high-availability installation, a load balancer serves as the single point of contact for clients, distributing network traffic across multiple servers in the cluster and helping to prevent any one server from becoming a point of failure.
+
+We don't recommend installing Rancher in a single Docker container, because if the node goes down, there is no copy of the cluster data available on other nodes and you could lose the data on your Rancher server.
+
+Rancher needs to be installed on either a high-availability [RKE (Rancher Kubernetes Engine)]({{<baseurl>}}/rke/latest/en/) Kubernetes cluster, or a high-availability [K3s (Lightweight Kubernetes)]({{<baseurl>}}/k3s/latest/en/) Kubernetes cluster. Both RKE and K3s are fully certified Kubernetes distributions.
+
+### K3s Kubernetes Cluster Installations
+
+If you are installing Rancher v2.4 for the first time, we recommend installing it on a K3s Kubernetes cluster. One main advantage of this K3s architecture is that it allows an external datastore to hold the cluster data, allowing the K3s server nodes to be treated as ephemeral.
+
+The option to install Rancher on a K3s cluster is a feature introduced in Rancher v2.4. K3s is easy to install, with half the memory of Kubernetes, all in a binary less than 100 MB.
+
+<figcaption>Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server</figcaption>
+![Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server]({{<baseurl>}}/img/rancher/k3s-server-storage.svg)
+
+### RKE Kubernetes Cluster Installations
+
+If you are installing Rancher prior to v2.4, you will need to install Rancher on an RKE cluster, in which the cluster data is stored on each node with the etcd role. As of Rancher v2.4, there is no migration path to transition the Rancher server from an RKE cluster to a K3s cluster. All versions of the Rancher server, including v2.4+, can be installed on an RKE cluster.
+
+In an RKE installation, the cluster data is replicated on each of three etcd nodes in the cluster, providing redundancy and data duplication in case one of the nodes fails.
+
+<figcaption>Architecture of an RKE Kubernetes Cluster Running the Rancher Management Server</figcaption>
+![Architecture of an RKE Kubernetes cluster running the Rancher management server]({{<baseurl>}}/img/rancher/rke-server-storage.svg)
+
+# Recommended Load Balancer Configuration for Kubernetes Installations
+
+We recommend the following configurations for the load balancer and Ingress controllers:
+
+* The DNS for Rancher should resolve to a Layer 4 load balancer (TCP)
+* The Load Balancer should forward port TCP/80 and TCP/443 to all 3 nodes in the Kubernetes cluster.
+* The Ingress controller will redirect HTTP to HTTPS and terminate SSL/TLS on port TCP/443.
+* The Ingress controller will forward traffic to port TCP/80 on the pod in the Rancher deployment.
+
+<figcaption>Rancher installed on a Kubernetes cluster with layer 4 load balancer, depicting SSL termination at Ingress controllers</figcaption>
+![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
+
+# Environment for Kubernetes Installations
+
+It is strongly recommended to install Rancher on a Kubernetes cluster on hosted infrastructure such as Amazon's EC2 or Google Compute Engine.
+
+For the best performance and greater security, we recommend a dedicated Kubernetes cluster for the Rancher management server. Running user workloads on this cluster is not advised. After deploying Rancher, you can [create or import clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) for running your workloads.
+
+It is not recommended to install Rancher on top of a managed Kubernetes service such as Amazon’s EKS or Google Kubernetes Engine. These hosted Kubernetes solutions do not expose etcd to a degree that is manageable for Rancher, and their customizations can interfere with Rancher operations.
+
+# Recommended Node Roles for Kubernetes Installations
+
+Our recommendations for the roles of each node differ depending on whether Rancher is installed on a K3s Kubernetes cluster or an RKE Kubernetes cluster.
+
+### K3s Cluster Roles
+
+In K3s clusters, there are two types of nodes: server nodes and agent nodes. Both servers and agents can have workloads scheduled on them. Server nodes run the Kubernetes master.
+
+For the cluster running the Rancher management server, we recommend using two server nodes. Agent nodes are not required.
+
+### RKE Cluster Roles
+
+If Rancher is installed on an RKE Kubernetes cluster, the cluster should have three nodes, and each node should have all three Kubernetes roles: etcd, controlplane, and worker.
+
+### Contrasting RKE Cluster Architecture for Rancher Server and for Downstream Kubernetes Clusters
+
+Our recommendation for RKE node roles on the Rancher server cluster contrasts with our recommendations for the downstream user clusters that run your apps and services.
+
+Rancher uses RKE as a library when provisioning downstream Kubernetes clusters. Note: The capability to provision downstream K3s clusters will be added in a future version of Rancher.
+
+For downstream Kubernetes clusters, we recommend that each node in a user cluster should have a single role for stability and scalability.
+
+![Kubernetes Roles for Nodes in Rancher Server Cluster vs. User Clusters]({{<baseurl>}}/img/rancher/rancher-architecture-node-roles.svg)
+
+RKE only requires at least one node with each role and does not require nodes to be restricted to one role. However, for the clusters that run your apps, we recommend separate roles for each node so that workloads on worker nodes don't interfere with the Kubernetes master or cluster data as your services scale.
+
+We recommend that downstream user clusters should have at least:
+
+- **Three nodes with only the etcd role** to maintain a quorum if one node is lost, making the state of your cluster highly available
+- **Two nodes with only the controlplane role** to make the master component highly available
+- **One or more nodes with only the worker role** to run the Kubernetes node components, as well as the workloads for your apps and services
+
+With that said, it is safe to use all three roles on three nodes when setting up the Rancher server because:
+
+* It allows one `etcd` node failure.
+* It maintains multiple instances of the master components by having multiple `controlplane` nodes.
+* No other workloads than Rancher itself should be created on this cluster.
+
+Because no additional workloads will be deployed on the Rancher server cluster, in most cases it is not necessary to use the same architecture that we recommend for the scalability and reliability of downstream clusters.
+
+For more best practices for downstream clusters, refer to the [production checklist]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production) or our [best practices guide.]({{<baseurl>}}/rancher/v2.x/en/best-practices/management/#tips-for-scaling-and-reliability)
+
+# Architecture for an Authorized Cluster Endpoint
+
+If you are using an [authorized cluster endpoint,]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role.
+
+If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/kubeconfig/) and [API keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/#creating-an-api-key) for more information.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/best-practices/mcm/containers/_index.md b/content/rancher/v2.5/en/best-practices/mcm/containers/_index.md
new file mode 100644
index 00000000000..83f1cc182ec
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/mcm/containers/_index.md
@@ -0,0 +1,49 @@
+---
+title: Tips for Setting Up Containers
+weight: 100
+---
+
+Running well built containers can greatly impact the overall performance and security of your environment.
+
+Below are a few tips for setting up your containers.
+
+For a more detailed discussion of security for containers, you can also refer to Rancher's [Guide to Container Security.](https://rancher.com/complete-guide-container-security)
+
+### Use a Common Container OS
+
+When possible, you should try to standardize on a common container base OS. 
+
+Smaller distributions such as Alpine and BusyBox reduce container image size and generally have a smaller attack/vulnerability surface.
+
+Popular distributions such as Ubuntu, Fedora, and CentOS are more field-tested and offer more functionality.
+
+### Start with a FROM scratch container
+If your microservice is a standalone static binary, you should use a FROM scratch container. 
+
+The FROM scratch container is an [official Docker image](https://hub.docker.com/_/scratch) that is empty so that you can use it to design minimal images.
+
+This will have the smallest attack surface and smallest image size.
+
+### Run Container Processes as Unprivileged
+When possible, use a non-privileged user when running processes within your container. While container runtimes provide isolation, vulnerabilities and attacks are still possible. Inadvertent or accidental host mounts can also be impacted if the container is running as root. For details on configuring a security context for a pod or container, refer to the [Kubernetes docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
+
+### Define Resource Limits
+Apply CPU and memory limits to your pods. This can help manage the resources on your worker nodes and avoid a malfunctioning microservice from impacting other microservices.
+
+In standard Kubernetes, you can set resource limits on the namespace level. In Rancher, you can set resource limits on the project level and they will propagate to all the namespaces within the project. For details, refer to the Rancher docs.
+
+When setting resource quotas, if you set anything related to CPU or Memory (i.e. limits or reservations) on a project or namespace, all containers will require a respective CPU or Memory field set during creation. To avoid setting these limits on each and every container during workload creation, a default container resource limit can be specified on the namespace.
+
+The Kubernetes docs have more information on how resource limits can be set at the [container level](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container) and the namespace level.
+
+### Define Resource Requirements
+You should apply CPU and memory requirements to your pods. This is crucial for informing the scheduler which type of compute node your pod needs to be placed on, and ensuring it does not over-provision that node. In Kubernetes, you can set a resource requirement by defining `resources.requests` in the resource requests field in a pod's container spec. For details, refer to the [Kubernetes docs](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container).
+
+> **Note:** If you set a resource limit for the namespace that the pod is deployed in, and the container doesn't have a specific resource request, the pod will not be allowed to start. To avoid setting these fields on each and every container during workload creation, a default container resource limit can be specified on the namespace.
+
+It is recommended to define resource requirements on the container level because otherwise, the scheduler makes assumptions that will likely not be helpful to your application when the cluster experiences load.
+
+### Liveness and Readiness Probes
+Set up liveness and readiness probes for your container. Unless your container completely crashes, Kubernetes will not know it's unhealthy unless you create an endpoint or mechanism that can report container status. Alternatively, make sure your container halts and crashes if unhealthy.
+
+The Kubernetes docs show how to [configure liveness and readiness probes for containers.](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
diff --git a/content/rancher/v2.5/en/best-practices/mcm/deployment-strategies/_index.md b/content/rancher/v2.5/en/best-practices/mcm/deployment-strategies/_index.md
new file mode 100644
index 00000000000..cd6d01bb1c4
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/mcm/deployment-strategies/_index.md
@@ -0,0 +1,45 @@
+---
+title: Rancher Deployment Strategies
+weight: 100
+---
+
+There are two recommended deployment strategies. Each one has its own pros and cons. Read more about which one would fit best for your use case:
+
+* [Hub and Spoke](#hub-and-spoke)
+* [Regional](#regional)
+
+# Hub & Spoke Strategy
+---
+
+In this deployment scenario, there is a single Rancher control plane managing Kubernetes clusters across the globe. The control plane would be run on a high-availability Kubernetes cluster, and there would be impact due to latencies.
+
+{{< img "/img/rancher/bpg/hub-and-spoke.png" "Hub and Spoke Deployment">}}
+
+### Pros
+
+* Environments could have nodes and network connectivity across regions.
+* Single control plane interface to view/see all regions and environments.
+* Kubernetes does not require Rancher to operate and can tolerate losing connectivity to the Rancher control plane.
+
+### Cons
+
+* Subject to network latencies.
+* If the control plane goes out, global provisioning of new services is unavailable until it is restored. However, each Kubernetes cluster can continue to be managed individually.
+
+# Regional Strategy
+---
+In the regional deployment model a control plane is deployed in close proximity to the compute nodes.
+
+{{< img "/img/rancher/bpg/regional.png" "Regional Deployment">}}
+
+### Pros
+
+* Rancher functionality in regions stay operational if a control plane in another region goes down.
+* Network latency is greatly reduced, improving the performance of functionality in Rancher.
+* Upgrades of the Rancher control plane can be done independently per region.
+
+### Cons
+
+* Overhead of managing multiple Rancher installations.
+* Visibility across global Kubernetes clusters requires multiple interfaces/panes of glass.
+* Deploying multi-cluster apps in Rancher requires repeating the process for each Rancher server.
diff --git a/content/rancher/v2.5/en/best-practices/mcm/deployment-types/_index.md b/content/rancher/v2.5/en/best-practices/mcm/deployment-types/_index.md
new file mode 100644
index 00000000000..ff493e7fbf2
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/mcm/deployment-types/_index.md
@@ -0,0 +1,38 @@
+---
+title: Tips for Running Rancher
+weight: 100
+---
+
+A high-availability Kubernetes installation, defined as an installation of Rancher on a Kubernetes cluster with at least three nodes, should be used in any production installation of Rancher, as well as any installation deemed "important." Multiple Rancher instances running on multiple nodes ensure high availability that cannot be accomplished with a single node environment.
+
+When you set up your high-availability Rancher installation, consider the following:
+
+### Run Rancher on a Separate Cluster
+Don't run other workloads or microservices in the Kubernetes cluster that Rancher is installed on.
+
+### Don't Run Rancher on a Hosted Kubernetes Environment
+When the Rancher server is installed on a Kubernetes cluster, it should not be run in a hosted Kubernetes environment such as Google's GKE, Amazon's EKS, or Microsoft's AKS. These hosted Kubernetes solutions do not expose etcd to a degree that is manageable for Rancher, and their customizations can interfere with Rancher operations.
+
+It is strongly recommended to use hosted infrastructure such as Amazon's EC2 or Google's GCE instead. When you create a cluster using RKE on an infrastructure provider, you can configure the cluster to create etcd snapshots as a backup. You can then [use RKE]({{<baseurl>}}/rke/latest/en/etcd-snapshots/) or [Rancher]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/) to restore your cluster from one of these snapshots. In a hosted Kubernetes environment, this backup and restore functionality is not supported.
+
+### Make sure nodes are configured correctly for Kubernetes ###
+It's important to follow K8s and etcd best practices when deploying your nodes, including disabling swap, double checking you have full network connectivity between all machines in the cluster, using unique hostnames, MAC addresses, and product_uuids for every node, checking that all correct ports are opened, and deploying with ssd backed etcd.  More details can be found in the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#before-you-begin) and [etcd's performance op guide](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/performance.md)
+
+### When using RKE: Backup the Statefile
+RKE keeps record of the cluster state in a file called `cluster.rkestate`. This file is important for the recovery of a cluster and/or the continued maintenance of the cluster through RKE. Because this file contains certificate material, we strongly recommend encrypting this file before backing up. After each run of `rke up` you should backup the state file. 
+
+### Run All Nodes in the Cluster in the Same Datacenter
+For best performance, run all three of your nodes in the same geographic datacenter. If you are running nodes in the cloud, such as AWS, run each node in a separate Availability Zone. For example, launch node 1 in us-west-2a, node 2 in us-west-2b, and node 3 in us-west-2c.
+
+### Development and Production Environments Should be Similar
+It's strongly recommended to have a "staging" or "pre-production" environment of the Kubernetes cluster that Rancher runs on. This environment should mirror your production environment as closely as possible in terms of software and hardware configuration.
+
+### Monitor Your Clusters to Plan Capacity
+The Rancher server's Kubernetes cluster should run within the [system and hardware requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/) as closely as possible. The more you deviate from the system and hardware requirements, the more risk you take.
+
+However, metrics-driven capacity planning analysis should be the ultimate guidance for scaling Rancher, because the published requirements take into account a variety of workload types.
+
+Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with Prometheus, a leading open-source monitoring solution, and Grafana, which lets you visualize the metrics from Prometheus. 
+
+After you [enable monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) in the cluster, you can set up [a notification channel]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) and [cluster alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) to let you know if your cluster is approaching its capacity. You can also use the Prometheus and Grafana monitoring framework to establish a baseline for key metrics as you scale.
+
diff --git a/content/rancher/v2.5/en/best-practices/mcm/management/_index.md b/content/rancher/v2.5/en/best-practices/mcm/management/_index.md
new file mode 100644
index 00000000000..4fd202dc1ec
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/mcm/management/_index.md
@@ -0,0 +1,132 @@
+---
+title: Tips for Scaling, Security and Reliability
+weight: 101
+---
+
+Rancher allows you to set up numerous combinations of configurations. Some configurations are more appropriate for development and testing, while there are other best practices for production environments for maximum availability and fault tolerance. The following best practices should be followed for production.
+
+# Tips for Preventing and Handling Problems
+
+These tips can help you solve problems before they happen.
+
+### Run Rancher on a Supported OS and Supported Docker Version
+Rancher is container-based and can potentially run on any Linux-based operating system. However, only operating systems listed in the [requirements documentation]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/) should be used for running Rancher, along with a supported version of Docker. These versions have been most thoroughly tested and can be properly supported by the Rancher Support team.
+
+### Upgrade Your Kubernetes Version
+Keep your Kubernetes cluster up to date with a recent and supported version. Typically the Kubernetes community will support the current version and previous three minor releases (for example, 1.14.x, 1.13.x, 1.12.x, and 1.11.x). After a new version is released, the third-oldest supported version reaches EOL (End of Life) status. Running on an EOL release can be a risk if a security issues are found and patches are not available. The community typically makes minor releases every quarter (every three months).
+
+Rancher’s SLAs are not community dependent, but as Kubernetes is a community-driven software, the quality of experience will degrade as you get farther away from the community's supported target.
+
+### Kill Pods Randomly During Testing
+Run chaoskube or a similar mechanism to randomly kill pods in your test environment. This will test the resiliency of your infrastructure and the ability of Kubernetes to self-heal. It's not recommended to run this in your production environment.
+
+### Deploy Complicated Clusters with Terraform
+Rancher's "Add Cluster" UI is preferable for getting started with Kubernetes cluster orchestration or for simple use cases. However, for more complex or demanding use cases, it is recommended to use a CLI/API driven approach. [Terraform](https://www.terraform.io/) is recommended as the tooling to implement this. When you use Terraform with version control and a CI/CD environment, you can have high assurances of consistency and reliability when deploying Kubernetes clusters. This approach also gives you the most customization options.
+
+Rancher [maintains a Terraform provider](https://rancher.com/blog/2019/rancher-2-terraform-provider/) for working with Rancher 2.0 Kubernetes. It is called the [Rancher2 Provider.](https://www.terraform.io/docs/providers/rancher2/index.html)
+
+### Upgrade Rancher in a Staging Environment
+All upgrades, both patch and feature upgrades, should be first tested on a staging environment before production is upgraded. The more closely the staging environment mirrors production, the higher chance your production upgrade will be successful.
+
+### Renew Certificates Before they Expire
+Multiple people in your organization should set up calendar reminders for certificate renewal. Consider renewing the certificate two weeks to one month in advance. If you have multiple certificates to track, consider using [monitoring and alerting mechanisms]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) to track certificate expiration.
+
+Rancher-provisioned Kubernetes clusters will use certificates that expire in one year. Clusters provisioned by other means may have a longer or shorter expiration.
+
+Certificates can be renewed for Rancher-provisioned clusters [through the Rancher user interface]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/).
+
+### Enable Recurring Snapshots for Backing up and Restoring the Cluster
+Make sure etcd recurring snapshots are enabled. Extend the snapshot retention to a period of time that meets your business needs. In the event of a catastrophic failure or deletion of data, this may be your only recourse for recovery. For details about configuring snapshots, refer to the [RKE documentation]({{<baseurl>}}/rke/latest/en/etcd-snapshots/) or the [Rancher documentation on backups]({{<baseurl>}}/rancher/v2.x/en/backups/).
+
+### Provision Clusters with Rancher
+When possible, use Rancher to provision your Kubernetes cluster rather than importing a cluster. This will ensure the best compatibility and supportability.
+
+### Use Stable and Supported Rancher Versions for Production
+Do not upgrade production environments to alpha, beta, release candidate (rc), or "latest" versions. These early releases are often not stable and may not have a future upgrade path.
+
+When installing or upgrading a non-production environment to an early release, anticipate problems such as features not working, data loss, outages, and inability to upgrade without a reinstall.
+
+Make sure the feature version you are upgrading to is considered "stable" as determined by Rancher. Use the beta, release candidate, and "latest" versions in a testing, development, or demo environment to try out new features. Feature version upgrades, for example 2.1.x to 2.2.x, should be considered as and when they are released. Some bug fixes and most features are not back ported into older versions.
+
+Keep in mind that Rancher does End of Life support for old versions, so you will eventually want to upgrade if you want to continue to receive patches.
+
+For more detail on what happens during the Rancher product lifecycle, refer to the [Support Maintenance Terms](https://rancher.com/support-maintenance-terms/).
+
+# Network Topology
+These tips can help Rancher work more smoothly with your network.
+
+### Use Low-latency Networks for Communication Within Clusters
+Kubernetes clusters are best served by low-latency networks. This is especially true for the control plane components and etcd, where lots of coordination and leader election traffic occurs. Networking between Rancher server and the Kubernetes clusters it manages are more tolerant of latency.
+
+### Allow Rancher to Communicate Directly with Clusters
+Limit the use of proxies or load balancers between Rancher server and Kubernetes clusters. As Rancher is maintaining a long-lived web sockets connection, these intermediaries can interfere with the connection lifecycle as they often weren't configured with this use case in mind.
+
+
+# Tips for Scaling and Reliability
+These tips can help you scale your cluster more easily.
+
+### Use One Kubernetes Role Per Host
+Separate the etcd, control plane, and worker roles onto different hosts. Don't assign multiple roles to the same host, such as a worker and control plane. This will give you maximum scalability.
+
+### Run the Control Plane and etcd on Virtual Machines
+Run your etcd and control plane nodes on virtual machines where you can scale vCPU and memory easily if needed in the future.
+
+### Use at Least Three etcd Nodes
+Provision 3 or 5 etcd nodes. Etcd requires a quorum to determine a leader by the majority of nodes, therefore it is not recommended to have clusters of even numbers. Three etcd nodes is generally sufficient for smaller clusters and five etcd nodes for large clusters.
+
+### Use at Least Two Control Plane Nodes
+Provision two or more control plane nodes. Some control plane components, such as the `kube-apiserver`, run in [active-active](https://www.jscape.com/blog/active-active-vs-active-passive-high-availability-cluster) mode and will give you more scalability. Other components such as kube-scheduler and kube-controller run in active-passive mode (leader elect) and give you more fault tolerance.
+
+### Monitor Your Cluster
+Closely monitor and scale your nodes as needed. You should [enable cluster monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and use the Prometheus metrics and Grafana visualization options as a starting point.
+
+
+# Tips for Security
+Below are some basic tips for increasing security in Rancher. For more detailed information about securing your cluster, you can refer to these resources:
+
+- Rancher's [security documentation and Kubernetes cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/)
+- [101 More Security Best Practices for Kubernetes](https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/)
+
+### Update Rancher with Security Patches
+Keep your Rancher installation up to date with the latest patches. Patch updates have important software fixes and sometimes have security fixes. When patches with security fixes are released, customers with Rancher licenses are notified by e-mail. These updates are also posted on Rancher's [forum](https://forums.rancher.com/).
+
+### Report Security Issues Directly to Rancher
+If you believe you have uncovered a security-related problem in Rancher, please communicate this immediately and discretely to the Rancher team (security@rancher.com). Posting security issues on public forums such as Twitter, Rancher Slack, GitHub, etc. can potentially compromise security for all Rancher customers. Reporting security issues discretely allows Rancher to assess and mitigate the problem. Security patches are typically given high priority and released as quickly as possible.
+
+### Only Upgrade One Component at a Time
+In addition to Rancher software updates, closely monitor security fixes for related software, such as Docker, Linux, and any libraries used by your workloads. For production environments, try to avoid upgrading too many entities during a single maintenance window. Upgrading multiple components can make it difficult to root cause an issue in the event of a failure. As business requirements allow, upgrade one component at a time.
+
+# Tips for Multi-Tenant Clusters
+
+### Namespaces
+Each tenant should have their own unique namespaces within the cluster. This avoids naming conflicts and allows resources to be only visible to their owner through use of RBAC policy
+
+### Project Isolation
+Use Rancher's Project Isolation to automatically generate Network Policy between Projects (sets of Namespaces). This further protects workloads from interference
+
+### Resource Limits
+Enforce use of sane resource limit definitions for every deployment in your cluster. This not only protects the owners of the deployment, but the neighboring resources from other tenants as well. Remember, namespaces do not isolate at the node level, so over-consumption of resources on a node affects other namespace deployments. Admission controllers can be written to require resource limit definitions
+
+### Resource Requirements
+Enforce use of resource requirement definitions for each deployment in your cluster. This enables the scheduler to appropriately schedule workloads. Otherwise you will eventually end up with over-provisioned nodes.
+
+# Class of Service and Kubernetes Clusters
+A class of service describes the expectations around cluster uptime, durability, and duration of maintenance windows. Typically organizations group these characteristics into labels such as "dev" or "prod"
+
+### Consider fault domains
+Kubernetes clusters can span multiple classes of service, however it is important to consider the ability for one workload to affect another. Without proper deployment practices such as resource limits, requirements, etc, a deployment that is not behaving well has the potential to impact the health of the cluster. In a "dev" environment it is common for end-users to exercise less caution with deployments, thus increasing the chance of such behavior. Sharing this behavior with your production workload increases risk.
+
+### Upgrade risks
+Upgrades of Kubernetes are not without risk, the best way to predict the outcome of an upgrade is try it on a cluster of similar load and use case as your production cluster. This is where having non-prod class of service clusters can be advantageous.
+
+### Resource Efficiency
+Clusters can be built with varying degrees of redundancy. In a class of service with low expectations for uptime, resources and cost can be conserved by building clusters without redundant Kubernetes control components. This approach may also free up more budget/resources to increase the redundancy at the production level
+
+# Network Security
+In general, you can use network security best practices in your Rancher and Kubernetes clusters. Consider the following:
+
+### Use a Firewall Between your Hosts and the Internet
+Firewalls should be used between your hosts and the Internet (or corporate Intranet). This could be enterprise firewall appliances in a datacenter or SDN constructs in the cloud, such as VPCs, security groups, ingress, and egress rules. Try to limit inbound access only to ports and IP addresses that require it. Outbound access can be shut off (air gap) if environment sensitive information that requires this restriction. If available, use firewalls with intrusion detection and DDoS prevention.
+
+### Run Periodic Security Scans
+Run security and penetration scans on your environment periodically. Even with well design infrastructure, a poorly designed microservice could compromise the entire environment.
diff --git a/content/rancher/v2.5/en/best-practices/rancher-server/_index.md b/content/rancher/v2.5/en/best-practices/rancher-server/_index.md
new file mode 100644
index 00000000000..1bd764c11f0
--- /dev/null
+++ b/content/rancher/v2.5/en/best-practices/rancher-server/_index.md
@@ -0,0 +1,6 @@
+---
+title: Best Practices for the Rancher Server
+weight: 1
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cli/_index.md b/content/rancher/v2.5/en/cli/_index.md
new file mode 100644
index 00000000000..1263c61b2fb
--- /dev/null
+++ b/content/rancher/v2.5/en/cli/_index.md
@@ -0,0 +1,80 @@
+---
+title: The Rancher Command Line Interface 
+description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI
+metaTitle: "Using the Rancher Command Line Interface "
+metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI"
+weight: 6000
+---
+
+The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI.
+
+### Download Rancher CLI
+
+The binary can be downloaded directly from the UI. The link can be found in the right hand side of the footer in the UI. We have binaries for Windows, Mac, and Linux. You can also check the [releases page for our CLI](https://github.com/rancher/cli/releases) for direct downloads of the binary.
+
+### Requirements
+
+After you download the Rancher CLI, you need to make a few configurations. Rancher CLI requires:
+
+- Your [Rancher Server URL]({{<baseurl>}}/rancher/v2.x/en/admin-settings/server-url), which is used to connect to Rancher Server.
+- An API Bearer Token, which is used to authenticate with Rancher. For more information about obtaining a Bearer Token, see [Creating an API Key]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/).
+
+### CLI Authentication
+
+Before you can use Rancher CLI to control your Rancher Server, you must authenticate using an API Bearer Token. Log in using the following command (replace `<BEARER_TOKEN>` and `<SERVER_URL>` with your information):
+
+```bash
+$ ./rancher login https://<SERVER_URL> --token <BEARER_TOKEN>
+```
+
+If Rancher Server uses a self-signed certificate, Rancher CLI prompts you to continue with the connection.
+
+### Project Selection
+
+Before you can perform any commands, you must select a Rancher project to perform those commands against. To select a [project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/) to work on, use the command `./rancher context switch`. When you enter this command, a list of available projects displays. Enter a number to choose your project.
+
+**Example: `./rancher context switch` Output**
+```
+User:rancher-cli-directory user$ ./rancher context switch
+NUMBER    CLUSTER NAME   PROJECT ID              PROJECT NAME   
+1         cluster-2      c-7q96s:p-h4tmb         project-2      
+2         cluster-2      c-7q96s:project-j6z6d   Default        
+3         cluster-1      c-lchzv:p-xbpdt         project-1      
+4         cluster-1      c-lchzv:project-s2mch   Default       
+Select a Project:
+```
+
+After you enter a number, the console displays a message that you've changed projects.
+
+```
+INFO[0005] Setting new context to project project-1
+INFO[0005] Saving config to /Users/markbishop/.rancher/cli2.json
+```
+
+### Commands
+
+The following commands are available for use in Rancher CLI.
+
+| Command  | Result  |
+|---|---|
+| `apps, [app]`  | Performs operations on catalog applications (i.e. individual [Helm charts](https://docs.helm.sh/developing_charts/) or [Rancher charts]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/#chart-directory-structure)).  |
+| `catalog`  | Performs operations on [catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/).  |
+| `clusters, [cluster]`  | Performs operations on your [clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).  |
+| `context`  | Switches between Rancher [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/). For an example, see [Project Selection](#project-selection).  |
+| `inspect [OPTIONS] [RESOURCEID RESOURCENAME]`  | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/) and [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)). Specify resources by name or ID.  |
+| `kubectl`  |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations).   |
+| `login, [l]`  | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication).  |
+| `namespaces, [namespace]`  |Performs operations on [namespaces]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces).   |
+| `nodes, [node]`  |Performs operations on [nodes]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#kubernetes).   |
+| `projects, [project]`  | Performs operations on [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).  |
+| `ps`  | Displays [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads) in a project.  |
+| `settings, [setting]`  | Shows the current settings for your Rancher Server.  |
+| `ssh`  | Connects to one of your cluster nodes using the SSH protocol.  |
+| `help, [h]`  | Shows a list of commands or help for one command.  |
+
+
+### Rancher CLI Help
+
+Once logged into Rancher Server using the CLI, enter `./rancher --help` for a list of commands.
+
+All commands accept the `--help` flag, which documents each command's usage.
diff --git a/content/rancher/v2.5/en/cli/backups-etcd/_index.md b/content/rancher/v2.5/en/cli/backups-etcd/_index.md
new file mode 100644
index 00000000000..2c191c772ab
--- /dev/null
+++ b/content/rancher/v2.5/en/cli/backups-etcd/_index.md
@@ -0,0 +1,8 @@
+---
+title: Backups - Etcd snapshot
+weight: 1
+---
+
+The Rancher Kubernetes cluster can be restored from an etcd snapshot.
+
+If Rancher was installed on another type of Kubernetes, refer to the official documentation of the Kubernetes distribution for more information about backing up the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cli/disaster-recovery/_index.md b/content/rancher/v2.5/en/cli/disaster-recovery/_index.md
new file mode 100644
index 00000000000..6662f7bda76
--- /dev/null
+++ b/content/rancher/v2.5/en/cli/disaster-recovery/_index.md
@@ -0,0 +1,8 @@
+---
+title: Disaster Recovery - Etcd Restore Snapshot
+weight: 1
+---
+
+The Rancher Kubernetes cluster can be restored from an etcd snapshot.
+
+If Rancher was installed on another type of Kubernetes, refer to the official documentation of the Kubernetes distribution for more information about backing up the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cli/rancher-k8s/_index.md b/content/rancher/v2.5/en/cli/rancher-k8s/_index.md
new file mode 100644
index 00000000000..acc0615f314
--- /dev/null
+++ b/content/rancher/v2.5/en/cli/rancher-k8s/_index.md
@@ -0,0 +1,16 @@
+---
+title: Rancher Kubernetes
+weight: 1
+---
+
+> This page is under construction.
+
+The Rancher CLI comes with a Kubernetes distribution called Rancher Kubernetes, which allows you to set up a Kubernetes cluster more easily as a prerequisite to installing Rancher.
+
+Rancher Kubernetes is based on K3s, and has more secure default settings. It is a new feature in Rancher 2.5.
+
+Rancher Kubernetes clusters can also be imported into Rancher.
+
+Rancher Kubernetes is not to be confused with RKE Kubernetes or K3s Kubernetes, which are separate Kubernetes distributions provided by Rancher. RKE is the oldest of the three distributions. When the Enterprise Cluster Manager is enabled, Rancher can provision RKE Kubernetes clusters, but Rancher Kubernetes clusters and K3s Kubernetes clusters have to be installed separately and imported into Rancher.
+
+In other words, Rancher can only install Rancher Kubernetes when you are using the Rancher CLI  to set up a local Kubernetes cluster for the Rancher server.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/_index.md b/content/rancher/v2.5/en/cluster-explorer/_index.md
new file mode 100644
index 00000000000..12bd4726e82
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/_index.md
@@ -0,0 +1,113 @@
+---
+title: Cluster Explorer
+weight: 2005
+---
+
+> This section is under construction.
+
+After you provision a cluster in Rancher, you can begin using powerful Kubernetes features to deploy and scale your containerized applications in development, testing, or production environments.
+
+This page covers the following topics:
+
+- [Switching between clusters](#switching-between-clusters)
+- [Managing clusters in Rancher](#managing-clusters-in-rancher)
+- [Configuring tools](#configuring-tools)
+
+> This section assumes a basic familiarity with Docker and Kubernetes. For a brief explanation of how Kubernetes components work together, refer to the [concepts]({{<baseurl>}}/rancher/v2.x/en/overview/concepts) page.
+
+## Switching between Clusters
+
+To switch between clusters, use the drop-down available in the navigation bar.
+
+Alternatively, you can switch between projects and clusters directly in the navigation bar. Open the **Global** view and select **Clusters** from the main menu. Then select the name of the cluster you want to open.
+
+## Managing Clusters in Rancher
+
+After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/), [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) will need to manage these clusters. There are many different options of how to manage your cluster. 
+
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
+
+## Configuring Tools
+
+Rancher contains a variety of tools that aren't included in Kubernetes to assist in your DevOps operations. Rancher can integrate with external services to help your clusters run more efficiently. Tools are divided into following categories:
+
+- Alerts
+- Notifiers
+- Logging
+- Monitoring
+- Istio Service Mesh
+- OPA Gatekeeper
+
+For more information, see [Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/)
+
+
+
+When your project is set up, [project members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can start managing their applications and all the components that comprise it.
+
+## Workloads
+
+Deploy applications to your cluster nodes using [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/), which are objects that contain pods that run your apps, along with metadata that set rules for the deployment's behavior. Workloads can be deployed within the scope of the entire clusters or within a namespace.
+
+When deploying a workload, you can deploy from any image. There are a variety of [workload types]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/#workload-types) to choose from which determine how your application should run.
+
+Following a workload deployment, you can continue working with it. You can:
+
+- [Upgrade]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/upgrade-workloads) the workload to a newer version of the application it's running.
+- [Roll back]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/rollback-workloads) a workload to a previous version, if an issue occurs during upgrade.
+- [Add a sidecar]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/add-a-sidecar), which is a workload that supports a primary workload.
+
+## Load Balancing and Ingress
+
+### Load Balancers
+
+After you launch an application, it's only available within the cluster. It can't be reached externally.
+
+If you want your applications to be externally accessible, you must add a load balancer to your cluster. Load balancers create a gateway for external connections to access your cluster, provided that the user knows the load balancer's IP address and the application's port number.
+
+Rancher supports two types of load balancers:
+
+- [Layer-4 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-4-load-balancer)
+- [Layer-7 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-7-load-balancer)
+
+For more information, see [load balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers).
+
+#### Ingress
+
+Load Balancers can only handle one IP address per service, which means if you run multiple services in your cluster, you must have a load balancer for each service. Running multiples load balancers can be expensive. You can get around this issue by using an ingress.
+
+Ingress is a set or rules that act as a load balancer. Ingress works in conjunction with one or more ingress controllers to dynamically route service requests. When the ingress receives a request, the ingress controller(s) in your cluster program the load balancer to direct the request to the correct service based on service subdomains or path rules that you've configured.
+
+For more information, see [Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress).
+
+When using ingresses in a project, you can program the ingress hostname to an external DNS by setting up a Global DNS entry.
+
+For more information, see [Global DNS]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
+
+## Service Discovery
+
+After you expose your cluster to external requests using a load balancer and/or ingress, it's only available by IP address. To create a resolveable hostname, you must create a service record, which is a record that maps an IP address, external hostname, DNS record alias, workload(s), or labelled pods to a specific hostname.
+
+For more information, see [Service Discovery]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/service-discovery).
+
+## Pipelines
+
+After your project has been [configured to a version control provider]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines/#version-control-providers), you can add the repositories and start configuring a pipeline for each repository.
+
+For more information, see [Pipelines]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/).
+
+## Applications
+
+Besides launching individual components of an application, you can use the Rancher catalog to start launching applications, which are Helm charts.
+
+For more information, see [Applications in a Project]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/).
+
+## Kubernetes Resources
+
+Within the context of a Rancher project or namespace, _resources_ are files and data that support operation of your pods. Within Rancher, certificates, registries, and secrets are all considered resources. However, Kubernetes classifies resources as different types of [secrets](https://kubernetes.io/docs/concepts/configuration/secret/). Therefore, within a single project or namespace, individual resources must have unique names to avoid conflicts. Although resources are primarily used to carry sensitive information, they have other uses as well.
+
+Resources include:
+
+- [Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/): Files used to encrypt/decrypt data entering or leaving the cluster.
+- [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/): Files that store general configuration information, such as a group of config files.
+- [Secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/): Files that store sensitive data like passwords, tokens, or keys.
+- [Registries]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries/): Files that carry credentials used to authenticate with private registries.
diff --git a/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
new file mode 100644
index 00000000000..0dff9482b15
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
@@ -0,0 +1,87 @@
+---
+title: Certificate Rotation
+weight: 2
+---
+
+> **Warning:** Rotating Kubernetes certificates may result in your cluster being temporarily unavailable as components are restarted. For production environments, it's recommended to perform this action during a maintenance window.
+
+By default, Kubernetes clusters require certificates and Rancher launched Kubernetes clusters automatically generate  certificates for the Kubernetes components. Rotating these certificates is important before the certificates expire as well as if a certificate is compromised. After the certificates are rotated, the Kubernetes components are automatically restarted.
+
+Certificates can be rotated for the following services:
+
+- etcd
+- kubelet
+- kube-apiserver
+- kube-proxy
+- kube-scheduler
+- kube-controller-manager
+
+
+### Certificate Rotation in Rancher v2.2.x
+
+_Available as of v2.2.0_
+
+Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI.
+
+1. In the **Global** view, navigate to the cluster that you want to rotate certificates.
+
+2. Select the **&#8942; > Rotate Certificates**.
+
+3. Select which certificates that you want to rotate.
+
+   * Rotate all Service certificates (keep the same CA)
+   * Rotate an individual service and choose one of the services from the drop down menu
+
+4. Click **Save**.
+
+**Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate.
+
+> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters.
+
+
+### Certificate Rotation in Rancher v2.1.x and v2.0.x
+
+_Available as of v2.0.14 and v2.1.9_
+
+Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API.
+
+1. In the **Global** view, navigate to the cluster that you want to rotate certificates.
+
+2. Select the **&#8942; > View in API**.
+
+3. Click on **RotateCertificates**.
+
+4. Click on **Show Request**.
+
+5. Click on **Send Request**.
+
+**Results:** All Kubernetes certificates will be rotated.
+
+### Rotating Expired Certificates After Upgrading Older Rancher Versions
+
+If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation.
+
+1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory:
+
+    ```
+    cd /etc/kubernetes/.tmp
+    ```
+
+    If the certificate is not in the directory, perform the following commands:
+
+    ```
+    cp kube-ca.pem kube-apiserver-requestheader-ca.pem
+    cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem
+    cp kube-apiserver.pem kube-apiserver-proxy-client.pem
+    cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem
+    ```
+
+    If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`:
+
+    ```
+    cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp
+    ```
+
+1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x)
+
+1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/certificates/_index.md b/content/rancher/v2.5/en/cluster-explorer/certificates/_index.md
new file mode 100644
index 00000000000..56a660ad63d
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/certificates/_index.md
@@ -0,0 +1,43 @@
+---
+title: Encrypting HTTP Communication
+description: Learn how to add an SSL (Secure Sockets Layer) certificate or TLS (Transport Layer Security) certificate to either a project, a namespace, or both, so that you can add it to deployments
+weight: 1
+---
+
+When you create an ingress within Rancher/Kubernetes, you must provide it with a secret that includes a TLS private key and certificate, which are used to encrypt and decrypt communications that come through the ingress. You can make certificates available for ingress use by navigating to its project or namespace, and then uploading the certificate. You can then add the certificate to the ingress deployment.
+
+Add SSL certificates to either projects, namespaces, or both. A project scoped certificate will be available in all its namespaces.
+
+>**Prerequisites:** You must have a TLS private key and certificate available to upload.
+
+1. From the **Global** view, select the project where you want to deploy your ingress.
+
+1. From the main menu, select **Resources > Secrets > Certificates**. Click **Add Certificate**. (For Rancher prior to v2.3, click **Resources > Certificates.**)
+
+1. Enter a **Name** for the certificate.
+
+    >**Note:** Kubernetes classifies SSL certificates as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your SSL certificate must have a unique name among the other certificates, registries, and secrets within your project/workspace.
+
+1. Select the **Scope** of the certificate.
+
+    - **Available to all namespaces in this project:** The certificate is available for any deployment in any namespaces in the project.
+
+    - **Available to a single namespace:** The certificate is only available for the deployments in one [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces). If you choose this option, select a **Namespace** from the drop-down list or click **Add to a new namespace** to add the certificate to a namespace you create on the fly.
+
+1. From **Private Key**, either copy and paste your certificate's private key into the text box (include the header and footer), or click **Read from a file** to browse to the private key on your file system. If possible, we recommend using **Read from a file** to reduce likelihood of error.
+
+    Private key files end with an extension of `.key`.
+
+1. From **Certificate**, either copy and paste your certificate into the text box (include the header and footer), or click **Read from a file** to browse to the certificate on your file system. If possible, we recommend using **Read from a file** to reduce likelihood of error.
+
+    Certificate files end with an extension of `.crt`.
+
+**Result:** Your certificate is added to the project or namespace. You can now add it to deployments.
+
+- If you added an SSL certificate to the project, the certificate is available for deployments created in any project namespace.
+- If you added an SSL certificate to a namespace, the certificate is available only for deployments in that namespace.
+- Your certificate is added to the **Resources > Secrets > Certificates** view. (For Rancher prior to v2.3, it is added to **Resources > Certificates.**)
+
+## What's Next?
+
+Now you can add the certificate when launching an ingress within the current project or namespace. For more information, see [Adding Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md b/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md
new file mode 100644
index 00000000000..4f1d2e14430
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md
@@ -0,0 +1,25 @@
+---
+title: Cluster Autoscaler
+weight: 1
+---
+
+In this section, you'll learn how to install and use the [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
+
+The cluster autoscaler is a tool that automatically adjusts the size of the Kubernetes cluster when one of the following conditions is true:
+
+* There are pods that failed to run in the cluster due to insufficient resources.
+* There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes.
+
+To prevent your pod from being evicted, set a `priorityClassName: system-cluster-critical` property on your pod spec.
+
+Cluster Autoscaler is designed to run on Kubernetes master nodes. It can run in the `kube-system` namespace. Cluster Autoscaler doesn't scale down nodes with non-mirrored `kube-system` pods running on them.
+
+It's possible to run a customized deployment of Cluster Autoscaler on worker nodes, but extra care needs to be taken to ensure that Cluster Autoscaler remains up and running.
+
+# Cloud Providers
+
+Cluster Autoscaler provides support to distinct cloud providers. For more information, go to [cluster-autoscaler supported cloud providers.](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment)
+
+### Setting up Cluster Autoscaler on Amazon Cloud Provider
+
+For details on running the cluster autoscaler  on Amazon cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon)
diff --git a/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md b/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md
new file mode 100644
index 00000000000..d173d444e27
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md
@@ -0,0 +1,580 @@
+---
+title: Cluster Autoscaler with AWS EC2 Auto Scaling Groups
+weight: 1
+---
+
+This guide will show you how to install and use [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
+
+We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. 
+
+- [Prerequisites](#prerequisites)
+- [1. Create a Custom Cluster](#1-create-a-custom-cluster)
+- [2. Configure the Cloud Provider](#2-configure-the-cloud-provider)
+- [3. Deploy Nodes](#3-deploy-nodes)
+- [4. Install cluster-autoscaler](#4-install-cluster-autoscaler)
+  - [Parameters](#parameters)
+  - [Deployment](#deployment)
+- [Testing](#testing)
+  - [Generating Load](#generating-load)
+  - [Checking Scale](#checking-scale)
+
+# Prerequisites
+
+These elements are required to follow this guide:
+
+* The Rancher server is up and running
+* You have an AWS EC2 user with proper permissions to create virtual machines, auto scaling groups, and IAM profiles and roles
+
+### 1. Create a Custom Cluster
+
+On Rancher server, we should create a custom k8s cluster v1.18.x. Be sure that cloud_provider name is set to `amazonec2`. Once cluster is created we need to get:
+
+* clusterID: `c-xxxxx` will be used on EC2 `kubernetes.io/cluster/<clusterID>` instance tag
+* clusterName: will be used on EC2 `k8s.io/cluster-autoscaler/<clusterName>` instance tag
+* nodeCommand: will be added on EC2 instance user_data to include new nodes on cluster
+
+    ```sh
+    sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CHECKSUM> <roles>
+    ```
+
+### 2. Configure the Cloud Provider
+
+On AWS EC2, we should create a few objects to configure our system. We've defined three distinct groups and IAM profiles to configure on AWS.
+
+1. Autoscaling group: Nodes that will be part of the EC2 Auto Scaling Group (ASG). The ASG will be used by `cluster-autoscaler` to scale up and down.
+  * IAM profile: Required by k8s nodes where cluster-autoscaler will be running. It is recommended for Kubernetes master nodes. This profile is called `K8sAutoscalerProfile`.
+
+      ```json
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "autoscaling:DescribeAutoScalingGroups",
+                      "autoscaling:DescribeAutoScalingInstances",
+                      "autoscaling:DescribeLaunchConfigurations",
+                      "autoscaling:SetDesiredCapacity",
+                      "autoscaling:TerminateInstanceInAutoScalingGroup",
+                      "autoscaling:DescribeTags",
+                      "autoscaling:DescribeLaunchConfigurations",
+                      "ec2:DescribeLaunchTemplateVersions"
+                  ],
+                  "Resource": [
+                      "*"
+                  ]
+              }
+          ]
+      }
+      ```
+
+2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. 
+  * IAM profile: Required by the Kubernetes cloud_provider integration. Optionally, `AWS_ACCESS_KEY` and `AWS_SECRET_KEY` can be used instead [using-aws-credentials.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) This profile is called `K8sMasterProfile`.
+
+      ```json
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "autoscaling:DescribeAutoScalingGroups",
+                      "autoscaling:DescribeLaunchConfigurations",
+                      "autoscaling:DescribeTags",
+                      "ec2:DescribeInstances",
+                      "ec2:DescribeRegions",
+                      "ec2:DescribeRouteTables",
+                      "ec2:DescribeSecurityGroups",
+                      "ec2:DescribeSubnets",
+                      "ec2:DescribeVolumes",
+                      "ec2:CreateSecurityGroup",
+                      "ec2:CreateTags",
+                      "ec2:CreateVolume",
+                      "ec2:ModifyInstanceAttribute",
+                      "ec2:ModifyVolume",
+                      "ec2:AttachVolume",
+                      "ec2:AuthorizeSecurityGroupIngress",
+                      "ec2:CreateRoute",
+                      "ec2:DeleteRoute",
+                      "ec2:DeleteSecurityGroup",
+                      "ec2:DeleteVolume",
+                      "ec2:DetachVolume",
+                      "ec2:RevokeSecurityGroupIngress",
+                      "ec2:DescribeVpcs",
+                      "elasticloadbalancing:AddTags",
+                      "elasticloadbalancing:AttachLoadBalancerToSubnets",
+                      "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
+                      "elasticloadbalancing:CreateLoadBalancer",
+                      "elasticloadbalancing:CreateLoadBalancerPolicy",
+                      "elasticloadbalancing:CreateLoadBalancerListeners",
+                      "elasticloadbalancing:ConfigureHealthCheck",
+                      "elasticloadbalancing:DeleteLoadBalancer",
+                      "elasticloadbalancing:DeleteLoadBalancerListeners",
+                      "elasticloadbalancing:DescribeLoadBalancers",
+                      "elasticloadbalancing:DescribeLoadBalancerAttributes",
+                      "elasticloadbalancing:DetachLoadBalancerFromSubnets",
+                      "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
+                      "elasticloadbalancing:ModifyLoadBalancerAttributes",
+                      "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
+                      "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
+                      "elasticloadbalancing:AddTags",
+                      "elasticloadbalancing:CreateListener",
+                      "elasticloadbalancing:CreateTargetGroup",
+                      "elasticloadbalancing:DeleteListener",
+                      "elasticloadbalancing:DeleteTargetGroup",
+                      "elasticloadbalancing:DescribeListeners",
+                      "elasticloadbalancing:DescribeLoadBalancerPolicies",
+                      "elasticloadbalancing:DescribeTargetGroups",
+                      "elasticloadbalancing:DescribeTargetHealth",
+                      "elasticloadbalancing:ModifyListener",
+                      "elasticloadbalancing:ModifyTargetGroup",
+                      "elasticloadbalancing:RegisterTargets",
+                      "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
+                      "iam:CreateServiceLinkedRole",
+                      "ecr:GetAuthorizationToken",
+                      "ecr:BatchCheckLayerAvailability",
+                      "ecr:GetDownloadUrlForLayer",
+                      "ecr:GetRepositoryPolicy",
+                      "ecr:DescribeRepositories",
+                      "ecr:ListImages",
+                      "ecr:BatchGetImage",
+                      "kms:DescribeKey"
+                  ],
+                  "Resource": [
+                      "*"
+                  ]
+              }
+          ]
+      }
+      ```
+
+    * IAM role: `K8sMasterRole: [K8sMasterProfile,K8sAutoscalerProfile]`
+    * Security group: `K8sMasterSg` More info at[RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
+    * Tags:
+      `kubernetes.io/cluster/<clusterID>: owned`
+    * User data: `K8sMasterUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add etcd+controlplane node to the k8s cluster
+
+      ```sh
+      #!/bin/bash -x
+
+      cat <<EOF > /etc/sysctl.d/90-kubelet.conf
+      vm.overcommit_memory = 1
+      vm.panic_on_oom = 0
+      kernel.panic = 10
+      kernel.panic_on_oops = 1
+      kernel.keys.root_maxkeys = 1000000
+      kernel.keys.root_maxbytes = 25000000
+      EOF
+      sysctl -p /etc/sysctl.d/90-kubelet.conf
+
+      curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
+      sudo usermod -aG docker ubuntu
+
+      TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+      PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
+      PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
+      K8S_ROLES="--etcd --controlplane"
+
+      sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
+      ```
+
+3. Worker group: Nodes that will be part of the k8s worker plane. Worker nodes will be scaled by cluster-autoscaler using the ASG.
+  * IAM profile: Provides cloud_provider worker integration.
+  This profile is called `K8sWorkerProfile`.
+
+      ```json
+      {
+          "Version": "2012-10-17",
+          "Statement": [
+              {
+                  "Effect": "Allow",
+                  "Action": [
+                      "ec2:DescribeInstances",
+                      "ec2:DescribeRegions",
+                      "ecr:GetAuthorizationToken",
+                      "ecr:BatchCheckLayerAvailability",
+                      "ecr:GetDownloadUrlForLayer",
+                      "ecr:GetRepositoryPolicy",
+                      "ecr:DescribeRepositories",
+                      "ecr:ListImages",
+                      "ecr:BatchGetImage"
+                  ],
+                  "Resource": "*"
+              }
+          ]
+      }
+      ```
+
+  * IAM role: `K8sWorkerRole: [K8sWorkerProfile]`
+  * Security group: `K8sWorkerSg` More info at [RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
+  * Tags:
+    * `kubernetes.io/cluster/<clusterID>: owned`
+    * `k8s.io/cluster-autoscaler/<clusterName>: true`
+    * `k8s.io/cluster-autoscaler/enabled: true`
+  * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster 
+
+      ```sh
+      #!/bin/bash -x
+
+      cat <<EOF > /etc/sysctl.d/90-kubelet.conf
+      vm.overcommit_memory = 1
+      vm.panic_on_oom = 0
+      kernel.panic = 10
+      kernel.panic_on_oops = 1
+      kernel.keys.root_maxkeys = 1000000
+      kernel.keys.root_maxbytes = 25000000
+      EOF
+      sysctl -p /etc/sysctl.d/90-kubelet.conf
+
+      curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
+      sudo usermod -aG docker ubuntu
+
+      TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+      PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
+      PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
+      K8S_ROLES="--worker"
+
+      sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKCSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
+      ```
+
+More info is at [RKE clusters on AWS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/) and [Cluster Autoscaler on AWS.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md)
+
+### 3. Deploy Nodes
+
+Once we've configured AWS, let's create VMs to bootstrap our cluster:
+
+* master (etcd+controlplane): Depending your needs, deploy three master instances with proper size. More info is at [the recommendations for production-ready clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/)
+  * IAM role: `K8sMasterRole`
+  * Security group: `K8sMasterSg`
+  * Tags: 
+    * `kubernetes.io/cluster/<clusterID>: owned`
+  * User data: `K8sMasterUserData`
+
+* worker: Define an ASG on EC2 with the following settings:
+  * Name: `K8sWorkerAsg`
+  * IAM role: `K8sWorkerRole`
+  * Security group: `K8sWorkerSg`
+  * Tags: 
+    * `kubernetes.io/cluster/<clusterID>: owned`
+    * `k8s.io/cluster-autoscaler/<clusterName>: true`
+    * `k8s.io/cluster-autoscaler/enabled: true`
+  * User data: `K8sWorkerUserData`
+  * Instances:
+    * minimum: 2
+    * desired: 2
+    * maximum: 10
+
+Once the VMs are deployed, you should have a Rancher custom cluster up and running with three master and two worker nodes.
+
+### 4. Install Cluster-autoscaler
+
+At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. 
+
+#### Parameters
+
+This table shows cluster-autoscaler parameters for fine tuning:
+
+| Parameter | Default | Description |
+|---|---|---|
+|cluster-name|-|Autoscaled cluster name, if available|
+|address|:8085|The address to expose Prometheus metrics|
+|kubernetes|-|Kubernetes master location. Leave blank for default|
+|kubeconfig|-|Path to kubeconfig file with authorization and master location information|
+|cloud-config|-|The path to the cloud provider configuration file.  Empty string for no configuration file|
+|namespace|"kube-system"|Namespace in which cluster-autoscaler run|
+|scale-down-enabled|true|Should CA scale down the cluster|
+|scale-down-delay-after-add|"10m"|How long after scale up that scale down evaluation resumes|
+|scale-down-delay-after-delete|0|How long after node deletion that scale down evaluation resumes, defaults to scanInterval|
+|scale-down-delay-after-failure|"3m"|How long after scale down failure that scale down evaluation resumes|
+|scale-down-unneeded-time|"10m"|How long a node should be unneeded before it is eligible for scale down|
+|scale-down-unready-time|"20m"|How long an unready node should be unneeded before it is eligible for scale down|
+|scale-down-utilization-threshold|0.5|Sum of cpu or memory of all pods running on the node divided by node's corresponding allocatable resource, below which a node can be considered for scale down|
+|scale-down-gpu-utilization-threshold|0.5|Sum of gpu requests of all pods running on the node divided by node's allocatable resource, below which a node can be considered for scale down|
+|scale-down-non-empty-candidates-count|30|Maximum number of non empty nodes considered in one iteration as candidates for scale down with drain|
+|scale-down-candidates-pool-ratio|0.1|A ratio of nodes that are considered as additional non empty candidates for scale down when some candidates from previous iteration are no longer valid|
+|scale-down-candidates-pool-min-count|50|Minimum number of nodes that are considered as additional non empty candidates for scale down when some candidates from previous iteration are no longer valid|
+|node-deletion-delay-timeout|"2m"|Maximum time CA waits for removing delay-deletion.cluster-autoscaler.kubernetes.io/ annotations before deleting the node|
+|scan-interval|"10s"|How often cluster is reevaluated for scale up or down|
+|max-nodes-total|0|Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number|
+|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format <min>:<max>. Cluster autoscaler will not scale the cluster beyond these numbers|
+|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format <min>:<max>. Cluster autoscaler will not scale the cluster beyond these numbers|
+cloud-provider|-|Cloud provider type| 
+|max-bulk-soft-taint-count|10|Maximum number of nodes that can be tainted/untainted PreferNoSchedule at the same time. Set to 0 to turn off such tainting|
+|max-bulk-soft-taint-time|"3s"|Maximum duration of tainting/untainting nodes as PreferNoSchedule at the same time|
+|max-empty-bulk-delete|10|Maximum number of empty nodes that can be deleted at the same time|
+|max-graceful-termination-sec|600|Maximum number of seconds CA waits for pod termination when trying to scale down a node|
+|max-total-unready-percentage|45|Maximum percentage of unready nodes in the cluster.  After this is exceeded, CA halts operations|
+|ok-total-unready-count|3|Number of allowed unready nodes, irrespective of max-total-unready-percentage|
+|scale-up-from-zero|true|Should CA scale up when there 0 ready nodes|
+|max-node-provision-time|"15m"|Maximum time CA waits for node to be provisioned|
+|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: <min>:<max>:<other...>|
+|node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `<name of discoverer>:[<key>[=<value>]]`|
+|estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]|
+|expander|"random"|Type of node group expander to be used in scale up. Available values: `["random","most-pods","least-waste","price","priority"]`|
+|ignore-daemonsets-utilization|false|Should CA ignore DaemonSet pods when calculating resource utilization for scaling down|
+|ignore-mirror-pods-utilization|false|Should CA ignore Mirror pods when calculating resource utilization for scaling down|
+|write-status-configmap|true|Should CA write status information to a configmap|
+|max-inactivity|"10m"|Maximum time from last recorded autoscaler activity before automatic restart|
+|max-failing-time|"15m"|Maximum time from last recorded successful autoscaler run before automatic restart|
+|balance-similar-node-groups|false|Detect similar node groups and balance the number of nodes between them|
+|node-autoprovisioning-enabled|false|Should CA autoprovision node groups when needed|
+|max-autoprovisioned-node-group-count|15|The maximum number of autoprovisioned groups in the cluster|
+|unremovable-node-recheck-timeout|"5m"|The timeout before we check again a node that couldn't be removed before|
+|expendable-pods-priority-cutoff|-10|Pods with priority below cutoff will be expendable. They can be killed without any consideration during scale down and they don't cause scale up. Pods with null priority (PodPriority disabled) are non expendable|
+|regional|false|Cluster is regional|
+|new-pod-scale-up-delay|"0s"|Pods less than this old will not be considered for scale-up|
+|ignore-taint|-|Specifies a taint to ignore in node templates when considering to scale a node group|
+|balancing-ignore-label|-|Specifies a label to ignore in addition to the basic and cloud-provider set of labels when comparing if two node groups are similar|
+|aws-use-static-instance-list|false|Should CA fetch instance types in runtime or use a static list. AWS only|
+|profiling|false|Is debug/pprof endpoint enabled|
+
+#### Deployment
+
+Based on [cluster-autoscaler-run-on-master.yaml](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/examples/cluster-autoscaler-run-on-master.yaml) example, we've created our own `cluster-autoscaler-deployment.yaml` to use preferred [auto-discovery setup](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#auto-discovery-setup), updating tolerations, nodeSelector, image version and command config:
+
+
+```yml
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+  name: cluster-autoscaler
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-autoscaler
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+rules:
+  - apiGroups: [""]
+    resources: ["events", "endpoints"]
+    verbs: ["create", "patch"]
+  - apiGroups: [""]
+    resources: ["pods/eviction"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["pods/status"]
+    verbs: ["update"]
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    resourceNames: ["cluster-autoscaler"]
+    verbs: ["get", "update"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["watch", "list", "get", "update"]
+  - apiGroups: [""]
+    resources:
+      - "pods"
+      - "services"
+      - "replicationcontrollers"
+      - "persistentvolumeclaims"
+      - "persistentvolumes"
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets", "daemonsets"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["policy"]
+    resources: ["poddisruptionbudgets"]
+    verbs: ["watch", "list"]
+  - apiGroups: ["apps"]
+    resources: ["statefulsets", "replicasets", "daemonsets"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses", "csinodes"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["batch", "extensions"]
+    resources: ["jobs"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["create"]
+  - apiGroups: ["coordination.k8s.io"]
+    resourceNames: ["cluster-autoscaler"]
+    resources: ["leases"]
+    verbs: ["get", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create","list","watch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["cluster-autoscaler-status", "cluster-autoscaler-priority-expander"]
+    verbs: ["delete", "get", "update", "watch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-autoscaler
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-autoscaler
+subjects:
+  - kind: ServiceAccount
+    name: cluster-autoscaler
+    namespace: kube-system
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    k8s-addon: cluster-autoscaler.addons.k8s.io
+    k8s-app: cluster-autoscaler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cluster-autoscaler
+subjects:
+  - kind: ServiceAccount
+    name: cluster-autoscaler
+    namespace: kube-system
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    app: cluster-autoscaler
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cluster-autoscaler
+  template:
+    metadata:
+      labels:
+        app: cluster-autoscaler
+      annotations:
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: '8085'
+    spec:
+      serviceAccountName: cluster-autoscaler
+      tolerations:
+        - effect: NoSchedule
+          operator: "Equal"
+          value: "true"
+          key: node-role.kubernetes.io/controlplane
+      nodeSelector:
+        node-role.kubernetes.io/controlplane: "true"
+      containers:
+        - image: eu.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1
+          name: cluster-autoscaler
+          resources:
+            limits:
+              cpu: 100m
+              memory: 300Mi
+            requests:
+              cpu: 100m
+              memory: 300Mi
+          command:
+            - ./cluster-autoscaler
+            - --v=4
+            - --stderrthreshold=info
+            - --cloud-provider=aws
+            - --skip-nodes-with-local-storage=false
+            - --expander=least-waste
+            - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/<clusterName>
+          volumeMounts:
+            - name: ssl-certs
+              mountPath: /etc/ssl/certs/ca-certificates.crt
+              readOnly: true
+          imagePullPolicy: "Always"
+      volumes:
+        - name: ssl-certs
+          hostPath:
+            path: "/etc/ssl/certs/ca-certificates.crt"
+
+```
+
+Once the manifest file is prepared, deploy it in the Kubernetes cluster (Rancher UI can be used instead):
+
+```sh
+kubectl -n kube-system apply -f cluster-autoscaler-deployment.yaml
+```
+
+**Note:** Cluster-autoscaler deployment can also be set up using [manual configuration](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#manual-configuration)
+
+# Testing
+
+At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: 
+
+* There are pods that failed to run in the cluster due to insufficient resources. In this case, the cluster is scaled up.
+* There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. In this case, the cluster is scaled down.
+
+### Generating Load
+
+We've prepared a `test-deployment.yaml` just to generate load on the Kubernetes cluster and see if cluster-autoscaler is working properly. The test deployment is requesting 1000m CPU and 1024Mi memory by three replicas. Adjust the requested resources and/or replica to be sure you exhaust the Kubernetes cluster resources:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: hello-world
+  name: hello-world
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: hello-world
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: hello-world
+    spec:
+      containers:
+      - image: rancher/hello-world
+        imagePullPolicy: Always
+        name: hello-world
+        ports:
+        - containerPort: 80
+          protocol: TCP
+        resources:
+          limits:
+            cpu: 1000m
+            memory: 1024Mi
+          requests:
+            cpu: 1000m
+            memory: 1024Mi
+```
+
+Once the test deployment is prepared, deploy it in the Kubernetes cluster default namespace (Rancher UI can be used instead):
+
+```
+kubectl -n default apply -f test-deployment.yaml
+```
+
+### Checking Scale
+
+Once the Kubernetes resources got exhausted, cluster-autoscaler should scale up worker nodes where pods failed to be scheduled. It should scale up until up until all pods became scheduled. You should see the new nodes on the ASG and on the Kubernetes cluster. Check the logs on the `kube-system` cluster-autoscaler pod.
+
+Once scale up is checked, let check for scale down. To do it, reduce the replica number on the test deployment until you release enough Kubernetes cluster resources to scale down. You should see nodes disappear on the ASG and on the Kubernetes cluster. Check the logs on the `kube-system` cluster-autoscaler pod.
diff --git a/content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md b/content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md
new file mode 100644
index 00000000000..f84deb4cceb
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md
@@ -0,0 +1,42 @@
+---
+title: ConfigMaps
+weight: 3
+---
+
+
+While most types of Kubernetes secrets store sensitive information, [ConfigMaps](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) store general configuration information, such as a group of config files. Because ConfigMaps don't store sensitive information, they can be updated automatically, and therefore don't require their containers to be restarted following update (unlike most secret types, which require manual updates and a container restart to take effect).
+
+ConfigMaps accept key value pairs in common string formats, like config files or JSON blobs. After you upload a config map, any workload can reference it as either an environment variable or a volume mount.
+
+>**Note:** ConfigMaps can only be applied to namespaces and not projects.
+
+1. From the **Global** view, select the project containing the namespace that you want to add a ConfigMap to.
+
+1. From the main menu, select **Resources > Config Maps**. Click **Add Config Map**.
+
+1. Enter a **Name** for the Config Map.
+
+    >**Note:** Kubernetes classifies ConfigMaps as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your ConfigMaps must have a unique name among the other certificates, registries, and secrets within your workspace.
+
+1. Select the **Namespace** you want to add Config Map to. You can also add a new namespace on the fly by clicking **Add to a new namespace**.
+
+1. From **Config Map Values**, click **Add Config Map Value** to add a key value pair to your ConfigMap. Add as many values as you need.
+
+1. Click **Save**.
+
+	>**Note:** Don't use ConfigMaps to store sensitive data [use a secret]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/).
+	>
+	>**Tip:** You can add multiple key value pairs to the ConfigMap by copying and pasting.
+	>
+    > {{< img "/img/rancher/bulk-key-values.gif" "Bulk Key Value Pair Copy/Paste">}}
+
+**Result:** Your ConfigMap is added to the namespace. You can view it in the Rancher UI from the **Resources > Config Maps** view.
+
+## What's Next?
+
+Now that you have a ConfigMap added to a namespace, you can add it to a workload that you deploy from the namespace of origin. You can use the ConfigMap to specify information for you application to consume, such as:
+
+- Application environment variables.
+- Specifying parameters for a Volume mounted to the workload.
+
+For more information on adding ConfigMaps to a workload, see [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md
new file mode 100644
index 00000000000..85fece31e33
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md
@@ -0,0 +1,61 @@
+---
+title: Set Up Load Balancer and Ingress Controller within Rancher
+description: Learn how you can set up load balancers and ingress controllers to redirect service requests within Rancher, and learn about the limitations of load balancers
+weight: 1
+---
+
+Within Rancher, you can set up load balancers and ingress controllers to redirect service requests.
+
+## Load Balancers
+
+After you launch an application, the app is only available within the cluster. It can't be reached from outside the cluster.
+
+If you want your applications to be externally accessible, you must add a load balancer or ingress to your cluster. Load balancers create a gateway for external connections to access your cluster, provided that the user knows the load balancer's IP address and the application's port number.
+
+Rancher supports two types of load balancers:
+
+- [Layer-4 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-4-load-balancer)
+- [Layer-7 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-7-load-balancer)
+
+For more information, see [load balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers).
+
+### Load Balancer Limitations
+
+Load Balancers have a couple of limitations you should be aware of:
+
+- Load Balancers can only handle one IP address per service, which means if you run multiple services in your cluster, you must have a load balancer for each service. Running multiples load balancers can be expensive.
+
+- If you want to use a load balancer with a Hosted Kubernetes cluster (i.e., clusters hosted in GKE, EKS, or AKS), the load balancer must be running within that cloud provider's infrastructure. Please review the compatibility tables regarding support for load balancers based on how you've provisioned your clusters:
+
+
+    - [Support for Layer-4 Load Balancing]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#support-for-layer-4-load-balancing)
+
+    - [Support for Layer-7 Load Balancing]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#support-for-layer-7-load-balancing)
+
+## Ingress
+
+As mentioned in the limitations above, the disadvantages of using a load balancer are:
+
+- Load Balancers can only handle one IP address per service.
+- If you run multiple services in your cluster, you must have a load balancer for each service.
+- It can be expensive to have a load balancer for every service.
+
+In contrast, when an ingress is used as the entrypoint into a cluster, the ingress can route traffic to multiple services with greater flexibility. It can map multiple HTTP requests to services without individual IP addresses for each service. 
+
+Therefore, it is useful to have an ingress if you want multiple services to be exposed with the same IP address, the same Layer 7 protocol, or the same privileged node-ports: 80 and 443.
+
+Ingress works in conjunction with one or more ingress controllers to dynamically route service requests. When the ingress receives a request, the ingress controller(s) in your cluster direct the request to the correct service based on service subdomains or path rules that you've configured.
+
+Each Kubernetes Ingress resource corresponds roughly to a file in `/etc/nginx/sites-available/` containing a `server{}` configuration block, where requests for specific files and folders are configured.
+
+Your ingress, which creates a port of entry to your cluster similar to a load balancer, can reside within your cluster or externally. Ingress and ingress controllers residing in RKE-launched clusters are powered by [Nginx](https://www.nginx.com/).
+
+Ingress can provide other functionality as well, such as SSL termination, name-based virtual hosting, and more.
+
+>**Using Rancher in a High Availability Configuration?**
+>
+>Refrain from adding an Ingress to the `local` cluster. The Nginx Ingress Controller that Rancher uses acts as a global entry point for _all_ clusters managed by Rancher, including the `local` cluster.  Therefore, when users try to access an application, your Rancher connection may drop due to the Nginx configuration being reloaded. We recommend working around this issue by deploying applications only in clusters that you launch using Rancher.
+
+- For more information on how to set up ingress in Rancher, see [Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress).
+- For complete information about ingress and ingress controllers, see the [Kubernetes Ingress Documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/)
+- When using ingresses in a project, you can program the ingress hostname to an external DNS by setting up a Global DNS entry, see [Global DNS]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md
new file mode 100644
index 00000000000..f10a8928d22
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md
@@ -0,0 +1,80 @@
+---
+title: Adding Ingresses to Your Project
+description: Ingresses can be added for workloads to provide load balancing, SSL termination and host/path-based routing. Learn how to add Rancher ingress to your project
+weight: 3042
+---
+
+Ingress can be added for workloads to provide load balancing, SSL termination and host/path based routing. When using ingresses in a project, you can program the ingress hostname to an external DNS by setting up a [Global DNS entry]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
+
+1. From the **Global** view, open the project that you want to add ingress to.
+
+1. Click **Resources** in the main navigation bar. Click the **Load Balancing** tab. (In versions prior to v2.3.0, just click the **Load Balancing** tab.) Then click **Add Ingress**.
+
+1. Enter a **Name** for the ingress.
+
+1. Select an existing **Namespace** from the drop-down list. Alternatively, you can create a new [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) on the fly by clicking **Add to a new namespace**.
+
+1. Create ingress forwarding **Rules**.
+
+    - **Automatically generate a xip.io hostname**
+
+        If you choose this option, ingress routes requests to hostname to a DNS name that's automatically generated. Rancher uses [xip.io](http://xip.io/) to automatically generates the DNS name. This option is best used for testing, _not_ production environments.
+
+        >**Note:** To use this option, you must be able to resolve to `xip.io` addresses.
+
+        1. Add a **Target Backend**. By default, a workload is added to the ingress, but you can add more targets by clicking either **Service** or **Workload**.
+
+        1. **Optional:** If you want specify a workload or service when a request is sent to a particular hostname path, add a **Path** for the target. For example, if you want requests for `www.mysite.com/contact-us` to be sent to a different service than `www.mysite.com`, enter `/contact-us` in the **Path** field.
+
+            Typically, the first rule that you create does not include a path.
+
+        1. Select a workload or service from the **Target** drop-down list for each target you've added.
+
+        1. Enter the **Port** number that each target operates on.
+
+    - **Specify a hostname to use**
+
+        If you use this option, ingress routes requests for a hostname to the service or workload that you specify.
+
+        1. Enter the hostname that your ingress will handle request forwarding for. For example, `www.mysite.com`.
+
+        1. Add a **Target Backend**. By default, a workload is added to the ingress, but you can add more targets by clicking either **Service** or **Workload**.
+
+        1. **Optional:** If you want specify a workload or service when a request is sent to a particular hostname path, add a **Path** for the target. For example, if you want requests for `www.mysite.com/contact-us` to be sent to a different service than `www.mysite.com`, enter `/contact-us` in the **Path** field.
+
+            Typically, the first rule that you create does not include a path.
+
+        1. Select a workload or service from the **Target** drop-down list for each target you've added.
+
+        1. Enter the **Port** number that each target operates on.
+
+
+    - **Use as the default backend**
+
+        Use this option to set an ingress rule for handling requests that don't match any other ingress rules. For example, use this option to route requests that can't be found to a `404` page.
+
+        >**Note:** If you deployed Rancher using RKE, a default backend for 404s and 202s is already configured.
+
+        1. Add a **Target Backend**. Click either **Service** or **Workload** to add the target.
+
+        1. Select a service or workload from the **Target** drop-down list.
+
+1. **Optional:** click **Add Rule** to create additional ingress rules. For example, after you create ingress rules to direct requests for your hostname, you'll likely want to create a default backend to handle 404s.
+
+1. If any of your ingress rules handle requests for encrypted ports, add a certificate to encrypt/decrypt communications.
+
+    >**Note:** You must have an SSL certificate that the ingress can use to encrypt/decrypt communications. For more information see [Adding SSL Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/).
+
+    1. Click **Add Certificate**.
+
+    1. Select a **Certificate** from the drop-down list.
+
+    1. Enter the **Host** using encrypted communication.
+
+    1. To add additional hosts that use the certificate, click **Add Hosts**.
+
+1. **Optional:** Add [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) and/or [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to provide metadata for your ingress.
+
+    For a list of annotations available for use, see the [Nginx Ingress Controller Documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/).
+
+**Result:** Your ingress is added to the project. The ingress begins enforcing your ingress rules.
diff --git a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
new file mode 100644
index 00000000000..7ae7742018d
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
@@ -0,0 +1,74 @@
+---
+title: "Layer 4 and Layer 7 Load Balancing"
+description: "Kubernetes supports load balancing in two ways: Layer-4 Load Balancing and Layer-7 Load Balancing. Learn about the support for each way in different deployments"
+weight: 3041
+aliases:
+  - /rancher/v2.x/en/concepts/load-balancing/
+---
+Kubernetes supports load balancing in two ways: Layer-4 Load Balancing and Layer-7 Load Balancing.
+
+## Layer-4 Load Balancer
+
+Layer-4 load balancer (or the external load balancer) forwards traffic to Nodeports. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
+
+Often, the Layer-4 load balancer is supported by the underlying cloud provider, so when you deploy RKE clusters on bare-metal servers and vSphere clusters, Layer-4 load balancer is not supported. However, a single [globally managed config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) can be used to expose services on NGINX or third-party ingress.
+
+> **Note:** It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher or RKE.
+
+### Support for Layer-4 Load Balancing
+
+Support for layer-4 load balancer varies based on the underlying cloud provider.
+
+Cluster Deployment                            | Layer-4 Load Balancer Support
+----------------------------------------------|--------------------------------
+Amazon EKS                | Supported by AWS cloud provider
+Google GKE                   | Supported by GCE cloud provider
+Azure AKS                       | Supported by Azure cloud provider
+RKE on EC2                 | Supported by AWS cloud provider
+RKE on DigitalOcean         | Limited NGINX or third-party Ingress*
+RKE on vSphere           | Limited NGINX or third party-Ingress*
+RKE on Custom Hosts<br/>(e.g. bare-metal servers) | Limited NGINX or third-party Ingress*
+Third-party MetalLB | Limited NGINX or third-party Ingress*
+
+\* Services can be exposed through a single [globally managed config-map.](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/)
+
+## Layer-7 Load Balancer
+
+Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer. In addition, RKE clusters deploys the Nginx Ingress Controller.
+
+### Support for Layer-7 Load Balancing
+
+Support for layer-7 load balancer varies based on the underlying cloud provider.
+
+Cluster Deployment                            | Layer-7 Load Balancer Support
+----------------------------------------------|--------------------------------
+Amazon EKS                                    | Supported by AWS cloud provider
+Google GKE                                    | Supported by GKE cloud provider
+Azure AKS                                     | Not Supported
+RKE on EC2                                    | Nginx Ingress Controller
+RKE on DigitalOcean                           | Nginx Ingress Controller
+RKE on vSphere                                | Nginx Ingress Controller
+RKE on Custom Hosts<br/>(e.g. bare-metal servers) | Nginx Ingress Controller
+
+### Host Names in Layer-7 Load Balancer
+
+Some cloud-managed layer-7 load balancers (such as the ALB ingress controller on AWS) expose DNS addresses for ingress rules. You need to map (via CNAME) your domain name to the DNS address generated by the layer-7 load balancer.
+
+Other layer-7 load balancers, such as the Google Load Balancer or Nginx Ingress Controller, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. Nginx Ingress Controller exposes the external IP of all nodes that run the Nginx Ingress Controller. You can do either of the following:
+
+1.	Configure your own DNS to map (via A records) your domain name to the IP addresses exposes by the Layer-7 load balancer.
+2.	Ask Rancher to generate an xip.io host name for your ingress rule. Rancher will take one of your exposed IPs, say a.b.c.d, and generate a host name <ingressname>.<namespace>.a.b.c.d.xip.io.
+
+The benefit of using xip.io is that you obtain a working entrypoint URL immediately after you create the ingress rule. Setting up your own domain name, on the other hand, requires you to configure DNS servers and wait for DNS to propagate.
+
+## Related Links
+
+- [Create an External Load Balancer](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/)
+
+#### Tutorials
+
+- [Kubernetes installation with External Load Balancer (HTTPS/Layer 7)]({{<baseurl>}}/rancher/v2.x/en/installation/ha-server-install-external-lb)
+- [Kubernetes installation with External Load Balancer (TCP/Layer 4)]({{<baseurl>}}/rancher/v2.x/en/installation/ha-server-install)
+- [Docker Installation with External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/single-node-install-external-lb)
+
+
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
new file mode 100644
index 00000000000..e20e1794245
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
@@ -0,0 +1,277 @@
+---
+title: Pipelines
+weight: 3047
+aliases:
+  - /rancher/v2.x/en/tools/pipelines/concepts/
+
+---
+
+Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users.
+
+Setting up a pipeline can help developers deliver new software as quickly and efficiently as possible. Using Rancher, you can integrate with a GitHub repository to setup a continuous integration (CI) pipeline.
+
+After configuring Rancher and GitHub, you can deploy containers running Jenkins to automate a pipeline execution:
+
+- Build your application from code to image.
+- Validate your builds.
+- Deploy your build images to your cluster.
+- Run unit tests.  
+- Run regression tests.
+
+>**Notes:**
+>
+>- Pipelines improved in Rancher v2.1. Therefore, if you configured pipelines while using v2.0.x, you'll have to reconfigure them after upgrading to v2.1.
+>- Still using v2.0.x? See the pipeline documentation for [previous versions]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/docs-for-v2.0.x).
+>- Rancher's pipeline provides a simple CI/CD experience, but it does not offer the full power and flexibility of and is not a replacement of enterprise-grade Jenkins or other CI tools your team uses.
+
+This section covers the following topics:
+
+- [Concepts](#concepts)
+- [How Pipelines Work](#how-pipelines-work)
+- [Roles-based Access Control for Pipelines](#roles-based-access-control-for-pipelines)
+- [Setting up Pipelines](#setting-up-pipelines)
+  - [Configure version control providers](#1-configure-version-control-providers)
+  - [Configure repositories](#2-configure-repositories)
+  - [Configure the pipeline](#3-configure-the-pipeline)
+- [Pipeline Configuration Reference](#pipeline-configuration-reference)
+- [Running your Pipelines](#running-your-pipelines)
+- [Triggering a Pipeline](#triggering-a-pipeline)
+  - [Modifying the Event Triggers for the Repository](#modifying-the-event-triggers-for-the-repository)
+
+# Concepts
+
+For an explanation of concepts and terminology used in this section, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/concepts)
+
+# How Pipelines Work
+
+After enabling the ability to use pipelines in a project, you can configure multiple pipelines in each project. Each pipeline is unique and can be configured independently.
+
+A pipeline is configured off of a group of files that are checked into source code repositories. Users can configure their pipelines either through the Rancher UI or by adding a `.rancher-pipeline.yml` into the repository.
+
+Before pipelines can be configured, you will need to configure authentication to your version control provider, e.g. GitHub, GitLab, Bitbucket. If you haven't configured a version control provider, you can always use [Rancher's example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/) to view some common pipeline deployments.
+
+When you configure a pipeline in one of your projects, a namespace specifically for the pipeline is automatically created. The following components are deployed to it:
+
+  - **Jenkins:**
+
+    The pipeline's build engine. Because project users do not directly interact with Jenkins, it's managed and locked.
+
+    >**Note:**  There is no option to use existing Jenkins deployments as the pipeline engine.
+
+  - **Docker Registry:**
+
+    Out-of-the-box, the default target for your build-publish step is an internal Docker Registry. However, you can make configurations to push to a remote registry instead. The internal Docker Registry is only accessible from cluster nodes and cannot be directly accessed by users. Images are not persisted beyond the lifetime of the pipeline and should only be used in pipeline runs. If you need to access your images outside of pipeline runs, please push to an external registry.
+
+  - **Minio:**
+
+    Minio storage is used to store the logs for pipeline executions.
+
+  >**Note:** The managed Jenkins instance works statelessly, so don't worry about its data persistency. The Docker Registry and Minio instances use ephemeral volumes by default, which is fine for most use cases. If you want to make sure pipeline logs can survive node failures, you can configure persistent volumes for them, as described in [data persistency for pipeline components]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/storage).
+
+# Roles-based Access Control for Pipelines
+
+If you can access a project, you can enable repositories to start building pipelines.
+
+Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure version control providers and manage global pipeline execution settings.
+
+Project members can only configure repositories and pipelines.
+
+# Setting up Pipelines
+
+To set up pipelines, you will need to do the following:
+
+1. [Configure version control providers](#1-configure-version-control-providers)
+2. [Configure repositories](#2-configure-repositories)
+3. [Configure the pipeline](#3-configure-the-pipeline)
+
+### 1. Configure Version Control Providers
+
+Before you can start configuring a pipeline for your repository, you must configure and authorize a version control provider.
+
+| Provider  | Available as of  |
+| --- | --- |
+| GitHub  | v2.0.0           |
+| GitLab | v2.1.0 |
+| Bitbucket | v2.2.0 |
+
+Select your provider's tab below and follow the directions.
+
+{{% tabs %}}
+{{% tab "GitHub" %}}
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
+
+1. Follow the directions displayed to **Setup a Github application**. Rancher redirects you to Github to setup an OAuth App in Github.
+
+1. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.
+
+1. If you're using GitHub for enterprise, select **Use a private github enterprise installation**. Enter the host address of your GitHub installation.
+
+1. Click **Authenticate**.
+
+{{% /tab %}}
+{{% tab "GitLab" %}}
+
+_Available as of v2.1.0_
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
+
+1. Follow the directions displayed to **Setup a GitLab application**. Rancher redirects you to GitLab.
+
+1. From GitLab, copy the **Application ID** and **Secret**. Paste them into Rancher.
+
+1. If you're using GitLab for enterprise setup, select **Use a private gitlab enterprise installation**. Enter the host address of your GitLab installation.
+
+1. Click **Authenticate**.
+
+>**Note:**
+> 1. Pipeline uses Gitlab [v4 API](https://docs.gitlab.com/ee/api/v3_to_v4.html) and the supported Gitlab version is 9.0+.  
+> 2. If you use GitLab 10.7+ and your Rancher setup is in a local network, enable the **Allow requests to the local network from hooks and services** option in GitLab admin settings.
+{{% /tab %}}
+{{% tab "Bitbucket Cloud" %}}
+
+_Available as of v2.2.0_
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar.
+
+1. Choose the **Use public Bitbucket Cloud** option.
+
+1. Follow the directions displayed to **Setup a Bitbucket Cloud application**. Rancher redirects you to Bitbucket to setup an OAuth consumer in Bitbucket.
+
+1. From Bitbucket, copy the consumer **Key** and **Secret**. Paste them into Rancher.
+
+1. Click **Authenticate**.
+
+{{% /tab %}}
+{{% tab "Bitbucket Server" %}}
+
+_Available as of v2.2.0_
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar.
+
+1. Choose the **Use private Bitbucket Server setup** option.
+
+1. Follow the directions displayed to **Setup a Bitbucket Server application**.
+
+1. Enter the host address of your Bitbucket server installation.
+
+1. Click **Authenticate**.
+
+>**Note:**
+> Bitbucket server needs to do SSL verification when sending webhooks to Rancher. Please ensure that Rancher server's certificate is trusted by the Bitbucket server. There are two options:
+>
+> 1. Setup Rancher server with a certificate from a trusted CA.
+> 1. If you're using self-signed certificates, import Rancher server's certificate to the Bitbucket server. For instructions, see the Bitbucket server documentation for [configuring self-signed certificates](https://confluence.atlassian.com/bitbucketserver/if-you-use-self-signed-certificates-938028692.html).
+>
+{{% /tab %}}
+{{% /tabs %}}
+
+**Result:** After the version control provider is authenticated, you will be automatically re-directed to start configuring which repositories you want start using with a pipeline.
+
+### 2. Configure Repositories
+
+After the version control provider is authorized, you are automatically re-directed to start configuring which repositories that you want start using pipelines with. Even if someone else has set up the version control provider, you will see their repositories and can build a pipeline.
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Click on **Configure Repositories**.
+
+1. A list of repositories are displayed. If you are configuring repositories the first time, click on **Authorize & Fetch Your Own Repositories** to fetch your repository list.
+
+1. For each repository that you want to set up a pipeline, click on **Enable**.
+
+1. When you're done enabling all your repositories, click on **Done**.
+
+**Results:** You have a list of repositories that you can start configuring pipelines for.
+
+### 3. Configure the Pipeline
+
+Now that repositories are added to your project, you can start configuring the pipeline by adding automated stages and steps. For your convenience, there are multiple built-in step types for dedicated tasks.
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Find the repository that you want to set up a pipeline for.
+
+1. Configure the pipeline through the UI or using a yaml file in the repository, i.e. `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`. Pipeline configuration is split into stages and steps. Stages must fully complete before moving onto the next stage, but steps in a stage run concurrently. For each stage, you can add different step types. Note: As you build out each step, there are different advanced options based on the step type. Advanced options include trigger rules, environment variables, and secrets. For more information on configuring the pipeline through the UI or the YAML file, refer to the [pipeline configuration reference.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config)
+
+   * If you are going to use the UI, select the vertical **&#8942; > Edit Config** to configure the pipeline using the UI. After the pipeline is configured, you must view the YAML file and push it to the repository.
+   * If you are going to use the YAML file, select the vertical **&#8942; > View/Edit YAML** to configure the pipeline. If you choose to use a YAML file, you need to push it to the repository after any changes in order for it to be updated in the repository. When editing the pipeline configuration, it takes a few moments for Rancher to check for an existing pipeline configuration.
+
+1. Select which `branch` to use from the list of branches.
+
+1. _Available as of v2.2.0_ Optional: Set up notifications.
+
+1. Set up the trigger rules for the pipeline.
+
+1. Enter a **Timeout** for the pipeline. 
+
+1. When all the stages and steps are configured, click **Done**.
+
+**Results:** Your pipeline is now configured and ready to be run.
+
+
+# Pipeline Configuration Reference
+
+Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config) for details on how to configure a pipeline to:
+
+- Run a script
+- Build and publish images
+- Publish catalog templates
+- Deploy YAML
+- Deploy a catalog app
+
+The configuration reference also covers how to configure:
+
+- Notifications
+- Timeouts
+- The rules that trigger a pipeline
+- Environment variables
+- Secrets
+
+
+# Running your Pipelines
+
+Run your pipeline for the first time. From the project view in Rancher, go to **Resources > Pipelines.** (In versions prior to v2.3.0, go to the **Pipelines** tab.) Find your pipeline and select the vertical **&#8942; > Run**.
+
+During this initial run, your pipeline is tested, and the following pipeline components are deployed to your project as workloads in a new namespace dedicated to the pipeline:
+
+- `docker-registry`
+- `jenkins`
+- `minio`
+
+This process takes several minutes. When it completes, you can view each pipeline component from the project **Workloads** tab.
+
+# Triggering a Pipeline
+
+When a repository is enabled, a webhook is automatically set in the version control provider. By default, the pipeline is triggered by a **push** event to a repository, but you can modify the event(s) that trigger running the pipeline.
+
+Available Events:
+
+* **Push**: Whenever a commit is pushed to the branch in the repository, the pipeline is triggered.
+* **Pull Request**: Whenever a pull request is made to the repository, the pipeline is triggered.
+* **Tag**: When a tag is created in the repository, the pipeline is triggered.
+
+> **Note:** This option doesn't exist for Rancher's [example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/).
+
+### Modifying the Event Triggers for the Repository
+
+1. From the **Global** view, navigate to the project that you want to modify the event trigger for the pipeline.
+
+1. 1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Find the repository that you want to modify the event triggers. Select the vertical **&#8942; > Setting**.
+
+1. Select which event triggers (**Push**, **Pull Request** or **Tag**) you want for the repository.
+
+1. Click **Save**.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md
new file mode 100644
index 00000000000..db8e3a24a58
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md
@@ -0,0 +1,36 @@
+---
+title: Concepts
+weight: 1
+---
+
+The purpose of this page is to explain common concepts and terminology related to pipelines.
+
+- **Pipeline:**
+
+    A _pipeline_ is a software delivery process that is broken into different stages and steps. Setting up a pipeline can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects. A pipeline is based on a specific repository. It defines the process to build, test, and deploy your code. Rancher uses the [pipeline as code](https://jenkins.io/doc/book/pipeline-as-code/) model. Pipeline configuration is represented as a pipeline file in the source code repository, using the file name `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`.
+
+- **Stages:**
+
+    A pipeline stage consists of multiple steps. Stages are executed in the order defined in the pipeline file. The steps in a stage are executed concurrently. A stage starts when all steps in the former stage finish without failure.
+
+- **Steps:**
+
+    A pipeline step is executed inside a specified stage. A step fails if it exits with a code other than `0`. If a step exits with this failure code, the entire pipeline fails and terminates.
+
+- **Workspace:**
+
+    The workspace is the working directory shared by all pipeline steps. In the beginning of a pipeline, source code is checked out to the workspace. The command for every step bootstraps in the workspace. During a pipeline execution, the artifacts from a previous step will be available in future steps. The working directory is an ephemeral volume and will be cleaned out with the executor pod when a pipeline execution is finished.
+
+Typically, pipeline stages include:
+
+- **Build:**
+
+    Each time code is checked into your repository, the pipeline automatically clones the repo and builds a new iteration of your software. Throughout this process, the software is typically reviewed by automated tests.
+
+- **Publish:**
+
+    After the build is completed, either a Docker image is built and published to a Docker registry or a catalog template is published.
+
+- **Deploy:**
+
+    After the artifacts are published, you would release your application so users could start using the updated product.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
new file mode 100644
index 00000000000..7443af2daad
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
@@ -0,0 +1,658 @@
+---
+title: Pipeline Configuration Reference
+weight: 1
+---
+
+In this section, you'll learn how to configure pipelines.
+
+- [Step Types](#step-types)
+- [Step Type: Run Script](#step-type-run-script)
+- [Step Type: Build and Publish Images](#step-type-build-and-publish-images)
+- [Step Type: Publish Catalog Template](#step-type-publish-catalog-template)
+- [Step Type: Deploy YAML](#step-type-deploy-yaml)
+- [Step Type: Deploy Catalog App](#step-type-deploy-catalog-app)
+- [Notifications](#notifications)
+- [Timeouts](#timeouts)
+- [Triggers and Trigger Rules](#triggers-and-trigger-rules)
+- [Environment Variables](#environment-variables)
+- [Secrets](#secrets)
+- [Pipeline Variable Substitution Reference](#pipeline-variable-substitution-reference)
+- [Global Pipeline Execution Settings](#global-pipeline-execution-settings)
+  - [Executor Quota](#executor-quota)
+  - [Resource Quota for Executors](#resource-quota-for-executors)
+  - [Custom CA](#custom-ca)
+- [Persistent Data for Pipeline Components](#persistent-data-for-pipeline-components)
+- [Example rancher-pipeline.yml](#example-rancher-pipeline-yml)
+
+# Step Types
+
+Within each stage, you can add as many steps as you'd like. When there are multiple steps in one stage, they run concurrently.
+
+Step types include:
+
+- [Run Script](#step-type-run-script)
+- [Build and Publish Images](#step-type-build-and-publish-images)
+- [Publish Catalog Template](#step-type-publish-catalog-template)
+- [Deploy YAML](#step-type-deploy-yaml)
+- [Deploy Catalog App](#step-type-deploy-catalog-app)
+
+<!--
+### Clone
+
+The first stage is preserved to be a cloning step that checks out source code from your repo. Rancher handles the cloning of the git repository. This action is equivalent to `git clone <repository_link> <workspace_dir>`.
+-->
+
+### Configuring Steps By UI
+
+If you haven't added any stages, click **Configure pipeline for this branch** to configure the pipeline through the UI.
+
+1. Add stages to your pipeline execution by clicking **Add Stage**.
+
+   1. Enter a **Name** for each stage of your pipeline.
+   1. For each stage, you can configure [trigger rules](#triggers-and-trigger-rules) by clicking on **Show Advanced Options**. Note: this can always be updated at a later time.
+
+1. After you've created a stage, start [adding steps](#step-types) by clicking **Add a Step**. You can add multiple steps to each stage.
+
+### Configuring Steps by YAML
+
+For each stage, you can add multiple steps. Read more about each [step type](#step-types) and the advanced options to get all the details on how to configure the YAML. This is only a small example of how to have multiple stages with a singular step in each stage.
+
+```yaml
+# example
+stages:
+  - name: Build something
+    # Conditions for stages
+    when:
+      branch: master
+      event: [ push, pull_request ]
+    # Multiple steps run concurrently
+    steps:
+      - runScriptConfig:
+          image: busybox
+          shellScript: date -R
+  - name: Publish my image
+    steps:
+    - publishImageConfig:
+        dockerfilePath: ./Dockerfile
+        buildContext: .
+        tag: rancher/rancher:v2.0.0
+        # Optionally push to remote registry
+        pushRemote: true
+        registry: reg.example.com
+```
+# Step Type: Run Script
+
+The **Run Script** step executes arbitrary commands in the workspace inside a specified container. You can use it to build, test and do more, given whatever utilities the base image provides. For your convenience, you can use variables to refer to metadata of a pipeline execution. Please refer to the [pipeline variable substitution reference](#pipeline-variable-substitution-reference) for the list of available variables.
+
+### Configuring Script by UI
+
+1. From the **Step Type** drop-down, choose **Run Script** and fill in the form.
+
+1. Click **Add**.
+
+### Configuring Script by YAML
+```yaml
+# example
+stages:
+- name: Build something
+  steps:
+  - runScriptConfig:
+      image: golang
+      shellScript: go build
+```
+# Step Type: Build and Publish Images
+
+_Available as of Rancher v2.1.0_
+
+The **Build and Publish Image** step builds and publishes a Docker image. This process requires a Dockerfile in your source code's repository to complete successfully.
+
+The option to publish an image to an insecure registry is not exposed in the UI, but you can specify an environment variable in the YAML that allows you to publish an image insecurely.
+
+### Configuring Building and Publishing Images by UI
+1. From the **Step Type** drop-down, choose **Build and Publish**.
+
+1. Fill in the rest of the form. Descriptions for each field are listed below. When you're done, click **Add**.
+
+    Field | Description |
+    ---------|----------|
+     Dockerfile Path | The relative path to the Dockerfile in the source code repo. By default, this path is `./Dockerfile`, which assumes the Dockerfile is in the root directory. You can set it to other paths in different use cases (`./path/to/myDockerfile` for example). |
+     Image Name | The image name in `name:tag` format. The registry address is not required. For example, to build  `example.com/repo/my-image:dev`, enter `repo/my-image:dev`. |
+     Push image to remote repository | An option to set the registry that publishes the image that's built.  To use this option, enable it and choose a registry from the drop-down. If this option is disabled, the image is pushed to the internal registry. |
+     Build Context <br/><br/> (**Show advanced options**)| By default, the root directory of the source code (`.`). For more details, see the Docker [build command documentation](https://docs.docker.com/engine/reference/commandline/build/).
+
+### Configuring Building and Publishing Images by YAML
+
+You can use specific arguments for Docker daemon and the build. They are not exposed in the UI, but they are available in pipeline YAML format, as indicated in the example below. Available environment variables include:
+
+Variable Name           | Description
+------------------------|------------------------------------------------------------
+PLUGIN_DRY_RUN          | Disable docker push
+PLUGIN_DEBUG            | Docker daemon executes in debug mode
+PLUGIN_MIRROR           | Docker daemon registry mirror
+PLUGIN_INSECURE         | Docker daemon allows insecure registries
+PLUGIN_BUILD_ARGS       | Docker build args, a comma separated list
+
+<br>
+
+```yaml
+# This example shows an environment variable being used
+# in the Publish Image step. This variable allows you to
+# publish an image to an insecure registry:
+
+stages:
+- name: Publish Image
+  steps:
+  - publishImageConfig:
+      dockerfilePath: ./Dockerfile
+      buildContext: .
+      tag: repo/app:v1
+      pushRemote: true
+      registry: example.com
+    env:
+      PLUGIN_INSECURE: "true"
+```
+
+# Step Type: Publish Catalog Template
+
+_Available as of v2.2.0_
+
+The **Publish Catalog Template** step publishes a version of a catalog app template (i.e. Helm chart) to a [git hosted chart repository]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/). It generates a git commit and pushes it to your chart repository. This process requires a chart folder in your source code's repository and a pre-configured secret in the dedicated pipeline namespace to complete successfully. Any variables in the [pipeline variable substitution reference](#pipeline-variable-substitution-reference) is supported for any file in the chart folder.
+
+### Configuring Publishing a Catalog Template by UI
+
+1. From the **Step Type** drop-down, choose **Publish Catalog Template**.
+
+1. Fill in the rest of the form. Descriptions for each field are listed below. When you're done, click **Add**.
+
+    Field | Description |
+    ---------|----------|
+     Chart Folder | The relative path to the chart folder in the source code repo, where the `Chart.yaml` file is located. |
+     Catalog Template Name | The name of the template. For example, wordpress. |
+     Catalog Template Version | The version of the template you want to publish, it should be consistent with the version defined in the `Chart.yaml` file. |
+     Protocol | You can choose to publish via HTTP(S) or SSH protocol. |
+     Secret   | The secret that stores your Git credentials. You need to create a secret in dedicated pipeline namespace in the project before adding this step. If you use HTTP(S) protocol, store Git username and password in `USERNAME` and `PASSWORD` key of the secret. If you use SSH protocol, store Git deploy key in `DEPLOY_KEY` key of the secret. After the secret is created, select it in this option. |
+     Git URL  | The Git URL of the chart repository that the template will be published to. |
+     Git Branch | The Git branch of the chart repository that the template will be published to. |
+     Author Name | The author name used in the commit message. |
+     Author Email | The author email used in the commit message. |
+
+
+### Configuring Publishing a Catalog Template by YAML
+
+You can add **Publish Catalog Template** steps directly in the `.rancher-pipeline.yml` file.
+
+Under the `steps` section, add a step with `publishCatalogConfig`. You will provide the following information:
+
+* Path: The relative path to the chart folder in the source code repo, where the `Chart.yaml` file is located.
+* CatalogTemplate: The name of the template.
+* Version: The version of the template you want to publish, it should be consistent with the version defined in the `Chart.yaml` file.
+* GitUrl: The git URL of the chart repository that the template will be published to.
+* GitBranch: The git branch of the chart repository that the template will be published to.
+* GitAuthor: The author name used in the commit message.
+* GitEmail: The author email used in the commit message.
+* Credentials: You should provide Git credentials by referencing secrets in dedicated pipeline namespace. If you publish via SSH protocol, inject your deploy key to the `DEPLOY_KEY` environment variable. If you publish via HTTP(S) protocol, inject your username and password to `USERNAME` and `PASSWORD` environment variables.
+
+```yaml
+# example
+stages:
+- name: Publish Wordpress Template
+  steps:
+  - publishCatalogConfig:
+      path: ./charts/wordpress/latest
+      catalogTemplate: wordpress
+      version: ${CICD_GIT_TAG}
+      gitUrl: git@github.com:myrepo/charts.git
+      gitBranch: master
+      gitAuthor: example-user
+      gitEmail: user@example.com
+    envFrom:
+    - sourceName: publish-keys
+      sourceKey: DEPLOY_KEY
+```
+
+# Step Type: Deploy YAML
+
+This step deploys arbitrary Kubernetes resources to the project. This deployment requires a Kubernetes manifest file to be present in the source code repository. Pipeline variable substitution is supported in the manifest file. You can view an example file at [GitHub](https://github.com/rancher/pipeline-example-go/blob/master/deployment.yaml). Please refer to the [pipeline variable substitution reference](#pipeline-variable-substitution-reference) for the list of available variables.
+
+### Configure Deploying YAML by UI
+
+1. From the **Step Type** drop-down, choose **Deploy YAML** and fill in the form.
+
+1. Enter the **YAML Path**, which is the path to the manifest file in the source code.
+
+1. Click **Add**.
+
+### Configure Deploying YAML by YAML
+
+```yaml
+# example
+stages:
+- name: Deploy
+  steps:
+  - applyYamlConfig:
+      path: ./deployment.yaml
+```
+
+# Step Type :Deploy Catalog App
+
+_Available as of v2.2.0_
+
+The **Deploy Catalog App** step deploys a catalog app in the project. It will install a new app if it is not present, or upgrade an existing one.
+
+### Configure Deploying Catalog App by UI
+
+1. From the **Step Type** drop-down, choose **Deploy Catalog App**.
+
+1. Fill in the rest of the form. Descriptions for each field are listed below. When you're done, click **Add**.
+
+    Field | Description |
+    ---------|----------|
+     Catalog | The catalog from which the app template will be used. |
+     Template Name | The name of the app template. For example, wordpress. |
+     Template Version | The version of the app template you want to deploy. |
+     Namespace | The target namespace where you want to deploy the app. |
+     App Name  | The name of the app you want to deploy. |
+     Answers   | Key-value pairs of answers used to deploy the app. |
+
+
+### Configure Deploying Catalog App by YAML
+
+You can add **Deploy Catalog App** steps directly in the `.rancher-pipeline.yml` file.
+
+Under the `steps` section, add a step with `applyAppConfig`. You will provide the following information:
+
+* CatalogTemplate: The ID of the template. This can be found by clicking `Launch app` and selecting `View details` for the app. It is the last part of the URL.
+* Version: The version of the template you want to deploy.
+* Answers: Key-value pairs of answers used to deploy the app.
+* Name: The name of the app you want to deploy.
+* TargetNamespace: The target namespace where you want to deploy the app.
+
+```yaml
+# example
+stages:
+- name: Deploy App
+  steps:
+  - applyAppConfig:
+      catalogTemplate: cattle-global-data:library-mysql
+      version: 0.3.8
+      answers:
+        persistence.enabled: "false"
+      name: testmysql
+      targetNamespace: test
+```
+
+# Timeouts
+
+By default, each pipeline execution has a timeout of 60 minutes. If the pipeline execution cannot complete within its timeout period, the pipeline is aborted.
+
+### Configuring Timeouts by UI
+
+Enter a new value in the **Timeout** field.
+
+### Configuring Timeouts by YAML
+
+In the `timeout` section, enter the timeout value in minutes.
+
+```yaml
+# example
+stages:
+  - name: Build something
+    steps:
+    - runScriptConfig:
+        image: busybox
+        shellScript: ls
+# timeout in minutes
+timeout: 30
+```
+
+# Notifications
+
+You can enable notifications to any [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) based on the build status of a pipeline. Before enabling notifications, Rancher recommends [setting up notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/#adding-notifiers) so it will be easy to add recipients immediately.
+
+### Configuring Notifications by UI
+
+_Available as of v2.2.0_
+
+1. Within the **Notification** section, turn on notifications by clicking **Enable**.
+
+1. Select the conditions for the notification. You can select to get a notification for the following statuses: `Failed`, `Success`, `Changed`. For example, if you want to receive notifications when an execution fails, select **Failed**.
+
+1. If you don't have any existing [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers), Rancher will provide a warning that no notifiers are set up and provide a link to be able to go to the notifiers page. Follow the [instructions]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/#adding-notifiers) to add a notifier. If you  already have notifiers, you can add them to the notification by clicking the **Add Recipient** button.
+
+    > **Note:** Notifiers are configured at a cluster level and require a different level of permissions.
+
+1. For each recipient, select which notifier type from the dropdown. Based on the type of notifier, you can use the default recipient or override the recipient with a different one. For example, if you have a notifier for _Slack_, you can update which channel to send the notification to. You can add additional notifiers by clicking **Add Recipient**.
+
+### Configuring Notifications by YAML
+_Available as of v2.2.0_
+
+In the `notification` section, you will provide the following information:
+
+* **Recipients:** This will be the list of notifiers/recipients that will receive the notification.
+  * **Notifier:** The ID of the notifier. This can be found by finding the notifier and selecting **View in API** to get the ID.
+  * **Recipient:** Depending on the type of the notifier, the "default recipient" can be used or you can override this with a different recipient. For example, when configuring a slack notifier, you select a channel as your default recipient, but if you wanted to send notifications to a different channel, you can select a different recipient.
+* **Condition:** Select which conditions of when you want the notification to be sent.
+* **Message (Optional):** If you want to change the default notification message, you can edit this in the yaml. Note: This option is not available in the UI.
+
+```yaml
+# Example
+stages:
+  - name: Build something
+    steps:
+    - runScriptConfig:
+        image: busybox
+        shellScript: ls
+notification:
+  recipients:
+  - # Recipient
+    recipient: "#mychannel"
+    # ID of Notifier
+    notifier: "c-wdcsr:n-c9pg7"
+  - recipient: "test@example.com"
+    notifier: "c-wdcsr:n-lkrhd"
+  # Select which statuses you want the notification to be sent
+  condition: ["Failed", "Success", "Changed"]
+  # Ability to override the default message (Optional)
+  message: "my-message"
+```
+
+# Triggers and Trigger Rules
+
+After you configure a pipeline, you can trigger it using different methods:
+
+- **Manually:**
+
+    After you configure a pipeline, you can trigger a build using the latest CI definition from Rancher UI. When a pipeline execution is triggered, Rancher dynamically provisions a Kubernetes pod to run your CI tasks and then remove it upon completion.
+
+- **Automatically:**
+
+    When you enable a repository for a pipeline, webhooks are automatically added to the version control system. When project users interact with the repo by pushing code, opening pull requests, or creating a tag, the version control system sends a webhook to Rancher Server, triggering a pipeline execution.
+
+    To use this automation, webhook management permission is required for the repository. Therefore, when users authenticate and fetch their repositories, only those on which they have webhook management permission will be shown.
+
+Trigger rules can be created to have fine-grained control of pipeline executions in your pipeline configuration. Trigger rules come in two types:
+
+- **Run this when:** This type of rule starts the pipeline, stage, or step when a trigger explicitly occurs.
+
+- **Do Not Run this when:** This type of rule skips the pipeline, stage, or step when a trigger explicitly occurs.
+
+If all conditions evaluate to `true`, then the pipeline/stage/step is executed. Otherwise it is skipped. When a pipeline is skipped, none of the pipeline is executed. When a stage/step is skipped, it is considered successful and follow-up stages/steps continue to run.
+
+Wildcard character (`*`) expansion is supported in `branch` conditions.
+
+This section covers the following topics:
+
+- [Configuring pipeline triggers](#configuring-pipeline-triggers)
+- [Configuring stage triggers](#configuring-stage-triggers)
+- [Configuring step triggers](#configuring-step-triggers)
+- [Configuring triggers by YAML](#configuring-triggers-by-yaml)
+
+### Configuring Pipeline Triggers
+
+1. From the **Global** view, navigate to the project that you want to configure a pipeline trigger rule.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. From the repository for which you want to manage trigger rules, select the vertical **&#8942; > Edit Config**.
+
+1. Click on **Show Advanced Options**.
+
+1. In the **Trigger Rules** section, configure rules to run or skip the pipeline.
+
+    1.  Click **Add Rule**. In the **Value** field, enter the name of the branch that triggers the pipeline.
+
+    1. **Optional:** Add more branches that trigger a build.
+
+1. Click **Done.**
+
+### Configuring Stage Triggers
+
+1. From the **Global** view, navigate to the project that you want to configure a stage trigger rule.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. From the repository for which you want to manage trigger rules, select the vertical **&#8942; > Edit Config**.
+
+1. Find the **stage** that you want to manage trigger rules, click the **Edit** icon for that stage.
+
+1. Click **Show advanced options**.
+
+1. In the **Trigger Rules** section, configure rules to run or skip the stage.
+
+    1.  Click **Add Rule**.
+
+    1.  Choose the **Type** that triggers the stage and enter a value.
+
+        | Type   | Value                                                                |
+        | ------ | -------------------------------------------------------------------- |
+        | Branch | The name of the branch that triggers the stage.                      |
+        | Event  | The type of event that triggers the stage. Values are: `Push`, `Pull Request`, `Tag` |
+
+1. Click **Save**.
+
+### Configuring Step Triggers
+
+1. From the **Global** view, navigate to the project that you want to configure a stage trigger rule.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. From the repository for which you want to manage trigger rules, select the vertical **&#8942; > Edit Config**.
+
+1. Find the **step** that you want to manage trigger rules, click the **Edit** icon for that step.
+
+1. Click **Show advanced options**.
+
+1. In the **Trigger Rules** section, configure rules to run or skip the step.
+
+    1.  Click **Add Rule**.
+
+    1.  Choose the **Type** that triggers the step and enter a value.
+
+        | Type   | Value                                                                |
+        | ------ | -------------------------------------------------------------------- |
+        | Branch | The name of the branch that triggers the step.                      |
+        | Event  | The type of event that triggers the step. Values are: `Push`, `Pull Request`, `Tag` |
+
+1. Click **Save**.
+
+
+### Configuring Triggers by YAML
+
+```yaml
+# example
+stages:
+  - name: Build something
+    # Conditions for stages
+    when:
+      branch: master
+      event: [ push, pull_request ]
+    # Multiple steps run concurrently
+    steps:
+    - runScriptConfig:
+        image: busybox
+        shellScript: date -R
+      # Conditions for steps
+      when:
+        branch: [ master, dev ]
+        event: push
+# branch conditions for the pipeline
+branch:
+  include: [ master, feature/*]
+  exclude: [ dev ]
+```
+
+# Environment Variables
+
+When configuring a pipeline, certain [step types](#step-types) allow you to use environment variables to configure the step's script.
+
+### Configuring Environment Variables by UI
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. From the pipeline for which you want to edit build triggers, select **&#8942; > Edit Config**.
+
+1. Within one of the stages, find the **step** that you want to add an environment variable for, click the **Edit** icon.
+
+1. Click **Show advanced options**.
+
+1. Click **Add Variable**, and then enter a key and value in the fields that appear. Add more variables if needed.
+
+1. Add your environment variable(s) into either the script or file.
+
+1. Click **Save**.
+
+### Configuring Environment Variables by YAML
+
+```yaml
+# example
+stages:
+  - name: Build something
+    steps:
+    - runScriptConfig:
+        image: busybox
+        shellScript: echo ${FIRST_KEY} && echo ${SECOND_KEY}
+      env:
+        FIRST_KEY: VALUE
+        SECOND_KEY: VALUE2
+```
+
+# Secrets
+
+If you need to use security-sensitive information in your pipeline scripts (like a password), you can pass them in using Kubernetes [secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/).
+
+### Prerequisite
+Create a secret in the same project as your pipeline, or explicitly in the namespace where pipeline build pods run.
+<br>
+
+>**Note:** Secret injection is disabled on [pull request events](#triggers-and-trigger-rules).
+
+### Configuring Secrets by UI
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. From the pipeline for which you want to edit build triggers, select **&#8942; > Edit Config**.
+
+1. Within one of the stages, find the **step** that you want to use a secret for, click the **Edit** icon.
+
+1. Click **Show advanced options**.
+
+1. Click **Add From Secret**. Select the secret file that you want to use. Then choose a key. Optionally, you can enter an alias for the key.
+
+1. Click **Save**.
+
+### Configuring Secrets by YAML
+
+```yaml
+# example
+stages:
+  - name: Build something
+    steps:
+    - runScriptConfig:
+        image: busybox
+        shellScript: echo ${ALIAS_ENV}
+      # environment variables from project secrets
+      envFrom:
+      - sourceName: my-secret
+        sourceKey: secret-key
+        targetKey: ALIAS_ENV
+```
+
+# Pipeline Variable Substitution Reference
+
+For your convenience, the following variables are available for your pipeline configuration scripts. During pipeline executions, these variables are replaced by metadata. You can reference them in the form of `${VAR_NAME}`.
+
+Variable Name           | Description
+------------------------|------------------------------------------------------------
+`CICD_GIT_REPO_NAME`      | Repository name (Github organization omitted).
+`CICD_GIT_URL`            | URL of the Git repository.
+`CICD_GIT_COMMIT`         | Git commit ID being executed.
+`CICD_GIT_BRANCH`         | Git branch of this event.
+`CICD_GIT_REF`            | Git reference specification of this event.
+`CICD_GIT_TAG`            | Git tag name, set on tag event.
+`CICD_EVENT`              | Event that triggered the build (`push`, `pull_request` or `tag`).
+`CICD_PIPELINE_ID`        | Rancher ID for the pipeline.
+`CICD_EXECUTION_SEQUENCE` | Build number of the pipeline.
+`CICD_EXECUTION_ID`       | Combination of `{CICD_PIPELINE_ID}-{CICD_EXECUTION_SEQUENCE}`.
+`CICD_REGISTRY`           | Address for the Docker registry for the previous publish image step, available in the Kubernetes manifest file of a `Deploy YAML` step.
+`CICD_IMAGE`              | Name of the image built from the previous publish image step, available in the Kubernetes manifest file of a `Deploy YAML` step. It does not contain the image tag.<br/><br/> [Example](https://github.com/rancher/pipeline-example-go/blob/master/deployment.yaml)
+
+# Global Pipeline Execution Settings
+
+After configuring a version control provider, there are several options that can be configured globally on how pipelines are executed in Rancher. These settings can be edited by selecting **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
+
+- [Executor Quota](#executor-quota)
+- [Resource Quota for Executors](#resource-quota-for-executors)
+- [Custom CA](#custom-ca)
+
+### Executor Quota
+
+Select the maximum number of pipeline executors. The _executor quota_ decides how many builds can run simultaneously in the project. If the number of triggered builds exceeds the quota, subsequent builds will queue until a vacancy opens. By default, the quota is `2`. A value of `0` or less removes the quota limit.
+
+### Resource Quota for Executors
+
+_Available as of v2.2.0_
+
+Configure compute resources for Jenkins agent containers. When a pipeline execution is triggered, a build pod is dynamically provisioned to run your CI tasks. Under the hood, A build pod consists of one Jenkins agent container and one container for each pipeline step. You can [manage compute resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) for every containers in the pod.
+
+Edit the **Memory Reservation**, **Memory Limit**, **CPU Reservation** or **CPU Limit**, then click **Update Limit and Reservation**.
+
+To configure compute resources for pipeline-step containers:
+
+You can configure compute resources for pipeline-step containers in the `.rancher-pipeline.yml` file.
+
+In a [step type]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/#step-types), you will provide the following information:
+
+* **CPU Reservation (`CpuRequest`)**: CPU request for the container of a pipeline step.
+* **CPU Limit (`CpuLimit`)**: CPU limit for the container of a pipeline step.
+* **Memory Reservation (`MemoryRequest`)**: Memory request for the container of a pipeline step.
+* **Memory Limit (`MemoryLimit`)**: Memory limit for the container of a pipeline step.
+
+```yaml
+# example
+stages:
+  - name: Build something
+    steps:
+    - runScriptConfig:
+        image: busybox
+        shellScript: ls
+      cpuRequest: 100m
+      cpuLimit: 1
+      memoryRequest:100Mi
+      memoryLimit: 1Gi
+    - publishImageConfig:
+        dockerfilePath: ./Dockerfile
+        buildContext: .
+        tag: repo/app:v1
+      cpuRequest: 100m
+      cpuLimit: 1
+      memoryRequest:100Mi
+      memoryLimit: 1Gi
+```
+
+>**Note:** Rancher sets default compute resources for pipeline steps except for `Build and Publish Images` and `Run Script` steps. You can override the default value by specifying compute resources in the same way.
+
+### Custom CA  
+
+_Available as of v2.2.0_
+
+If you want to use a version control provider with a certificate from a custom/internal CA root, the CA root certificates need to be added as part of the version control provider configuration in order for the pipeline build pods to succeed.
+
+1. Click **Edit cacerts**.
+
+1. Paste in the CA root certificates and click **Save cacerts**.
+
+**Result:** Pipelines can be used and new pods will be able to work with the self-signed-certificate.
+
+# Persistent Data for Pipeline Components
+
+The internal Docker registry and the Minio workloads use ephemeral volumes by default. This default storage works out-of-the-box and makes testing easy, but you lose the build images and build logs if the node running the Docker Registry or Minio fails. In most cases this is fine. If you want build images and logs to survive node failures, you can configure the Docker Registry and Minio to use persistent volumes.
+
+For details on setting up persistent storage for pipelines, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/storage)
+
+# Example rancher-pipeline.yml
+
+An example pipeline configuration file is on [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
new file mode 100644
index 00000000000..412822f0f96
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
@@ -0,0 +1,126 @@
+---
+title: v2.0.x Pipeline Documentation
+weight: 9000
+aliases:
+  - /rancher/v2.x/en/project-admin/tools/pipelines/docs-for-v2.0.x
+  - /rancher/v2.x/en/project-admin/pipelines/docs-for-v2.0.x
+---
+
+>**Note:** This section describes the pipeline feature as implemented in Rancher v2.0.x. If you are using Rancher v2.1 or later, where pipelines have been significantly improved, please refer to the new documentation for [v2.1 or later]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/).
+
+
+
+Pipelines help you automate the software delivery process. You can integrate Rancher with GitHub to create a pipeline.
+
+You can set up your pipeline to run a series of stages and steps to test your code and deploy it.
+
+<dl>
+	<dt>Pipelines</dt>
+	<dd>Contain a series of stages and steps. Out-of-the-box, the pipelines feature supports fan out and in capabilities.</dd>
+	<dt>Stages</dt>
+	<dd>Executed sequentially. The next stage will not execute until all of the steps within the stage execute.</dd>
+	<dt>Steps</dt>
+	<dd>Are executed in parallel within a stage. </dd>
+</dl>
+
+## Enabling CI Pipelines
+
+1. Select cluster from drop down.
+
+2. Under tools menu select pipelines.
+
+3. Follow instructions for setting up github auth on page.
+
+
+## Creating CI Pipelines
+
+1. Go to the project you want this pipeline to run in.
+
+2. Click **Resources > Pipelines.** In versions prior to v2.3.0,click **Workloads > Pipelines.**
+
+4. Click Add pipeline button.
+
+5. Enter in your repository name (Autocomplete should help zero in on it quickly).
+
+6. Select Branch options.
+
+	-	Only the branch {BRANCH NAME}: Only events triggered by changes to this branch will be built.
+
+	-	Everything but {BRANCH NAME}: Build any branch that triggered an event EXCEPT events from this branch.
+
+	-	All branches: Regardless of the branch that triggered the event always build.
+
+	>**Note:** If you want one path for master, but another for PRs or development/test/feature branches, create two separate pipelines.
+
+7. Select the build trigger events. By default, builds will only happen by manually clicking build now in Rancher UI.
+
+	- Automatically build this pipeline whenever there is a git commit. (This respects the branch selection above)
+
+	- Automatically build this pipeline whenever there is a new PR.
+
+	- Automatically build the pipeline. (Allows you to configure scheduled builds similar to Cron)
+
+8. Click Add button.
+
+	By default, Rancher provides a three stage pipeline for you. It consists of a build stage where you would compile, unit test, and scan code. The publish stage has a single step to publish a docker image.
+
+
+8. Add a name to the pipeline in order to complete adding a pipeline.
+
+9. Click on the ‘run a script’ box under the ‘Build’ stage.
+
+	Here you can set the image, or select from pre-packaged envs.
+
+10. Configure a shell script to run inside the container when building.
+
+11. Click Save to persist the changes.
+
+12. Click the “publish an image’ box under the “Publish” stage.
+
+13. Set the location of the Dockerfile. By default it looks in the root of the workspace. Instead, set the build context for building the image relative to the root of the workspace.
+
+14. Set the image information.
+
+	The registry is the remote registry URL. It is defaulted to Docker hub.
+	Repository is the `<org>/<repo>` in the repository.
+
+15. Select the Tag. You can hard code a tag like ‘latest’ or select from a list of available variables.
+
+16. If this is the first time using this registry, you can add the username/password for pushing the image. You must click save for the registry credentials AND also save for the modal.
+
+
+
+
+## Creating a New Stage
+
+1. To add a new stage the user must click the ‘add a new stage’ link in either create or edit mode of the pipeline view.
+
+2. Provide a name for the stage.
+
+3. Click save.
+
+
+## Creating a New Step
+
+1. Go to create / edit mode of the pipeline.
+
+2. Click “Add Step” button in the stage that you would like to add a step in.
+
+3. Fill out the form as detailed above
+
+
+## Environment Variables
+
+For your convenience the following environment variables are available in your build steps:
+
+Variable Name           | Description
+------------------------|------------------------------------------------------------
+CICD_GIT_REPO_NAME      | Repository Name (Stripped of Github Organization)
+CICD_PIPELINE_NAME      | Name of the pipeline
+CICD_GIT_BRANCH         | Git branch of this event
+CICD_TRIGGER_TYPE       | Event that triggered the build
+CICD_PIPELINE_ID        | Rancher ID for the pipeline
+CICD_GIT_URL            | URL of the Git repository
+CICD_EXECUTION_SEQUENCE | Build number of the pipeline
+CICD_EXECUTION_ID       | Combination of {CICD_PIPELINE_ID}-{CICD_EXECUTION_SEQUENCE}
+CICD_GIT_COMMIT         | Git commit ID being executed.
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
new file mode 100644
index 00000000000..4b7fddc4b85
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
@@ -0,0 +1,76 @@
+---
+title: Example Repositories
+weight: 500
+aliases:
+  - /rancher/v2.x/en/tools/pipelines/quick-start-guide/
+---
+
+Rancher ships with several example repositories that you can use to familiarize yourself with pipelines. We recommend configuring and testing the example repository that most resembles your environment before using pipelines with your own repositories in a production environment. Use this example repository as a sandbox for repo configuration, build demonstration, etc. Rancher includes example repositories for:
+
+- Go
+- Maven
+- php
+
+> **Note:** The example repositories are only available if you have not [configured a version control provider]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines).
+
+To start using these example repositories,
+
+1. [Enable the example repositories](#1-enable-the-example-repositories)
+2. [View the example pipeline](#2-view-the-example-pipeline)
+3. [Run the example pipeline](#3-run-the-example-pipeline)
+
+### 1. Enable the Example Repositories
+
+By default, the example pipeline repositories are disabled. Enable one (or more) to test out the pipeline feature and see how it works.
+
+1. From the **Global** view, navigate to the project that you want to test out pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Click **Configure Repositories**.
+
+    **Step Result:** A list of example repositories displays.
+
+    >**Note:** Example repositories only display if you haven't fetched your own repos.
+
+1. Click **Enable** for one of the example repos (e.g., `https://github.com/rancher/pipeline-example-go.git`). Then click **Done**.
+
+**Results:**
+
+- The example repository is enabled to work with a pipeline is available in the **Pipeline** tab.
+
+- The following workloads are deployed to a new namespace:
+
+    - `docker-registry`
+    - `jenkins`
+    - `minio`
+
+### 2. View the Example Pipeline
+
+After enabling an example repository, review the pipeline to see how it is set up.
+
+1. From the **Global** view, navigate to the project that you want to test out pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Find the example repository, select the vertical **&#8942;**. There are two ways to view the pipeline:
+  * **Rancher UI**: Click on **Edit Config** to view the stages and steps of the pipeline.
+  * **YAML**: Click on View/Edit YAML to view the `./rancher-pipeline.yml` file.
+
+### 3. Run the Example Pipeline
+
+After enabling an example repository, run the pipeline to see how it works.
+
+1. From the **Global** view, navigate to the project that you want to test out pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Find the example repository, select the vertical **&#8942; > Run**.
+
+    >**Note:** When you run a pipeline the first time, it takes a few minutes to pull relevant images and provision necessary pipeline components.
+
+**Result:** The pipeline runs. You can see the results in the logs.
+
+### What's Next?
+
+For detailed information about setting up your own pipeline for your repository, [configure a version control provider]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines), [enable a repository](#configure-repositories) and finally [configure your pipeline]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/#pipeline-configuration).
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
new file mode 100644
index 00000000000..512c87af456
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
@@ -0,0 +1,74 @@
+---
+title: Example YAML File
+weight: 501
+aliases:
+  - /rancher/v2.x/en/tools/pipelines/reference/
+---
+
+Pipelines can be configured either through the UI or using a yaml file in the repository, i.e. `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`.
+
+In the [pipeline configuration reference]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config), we provide examples of how to configure each feature using the Rancher UI or using YAML configuration.
+
+Below is a full example `rancher-pipeline.yml` for those who want to jump right in.
+
+```yaml
+# example
+stages:
+  - name: Build something
+    # Conditions for stages
+    when:
+      branch: master
+      event: [ push, pull_request ]
+    # Multiple steps run concurrently
+    steps:
+    - runScriptConfig:
+        image: busybox
+        shellScript: echo ${FIRST_KEY} && echo ${ALIAS_ENV}
+      # Set environment variables in container for the step
+      env:
+        FIRST_KEY: VALUE
+        SECOND_KEY: VALUE2
+      # Set environment variables from project secrets
+      envFrom:
+      - sourceName: my-secret
+        sourceKey: secret-key
+        targetKey: ALIAS_ENV
+    - runScriptConfig:
+        image: busybox
+        shellScript: date -R
+      # Conditions for steps
+      when:
+        branch: [ master, dev ]
+        event: push
+  - name: Publish my image
+    steps:
+    - publishImageConfig:
+        dockerfilePath: ./Dockerfile
+        buildContext: .
+        tag: rancher/rancher:v2.0.0
+        # Optionally push to remote registry
+        pushRemote: true
+        registry: reg.example.com
+  - name: Deploy some workloads
+    steps:
+    - applyYamlConfig:
+        path: ./deployment.yaml
+# branch conditions for the pipeline
+branch:
+  include: [ master, feature/*]
+  exclude: [ dev ]
+# timeout in minutes
+timeout: 30
+notification:
+  recipients:
+  - # Recipient
+    recipient: "#mychannel"
+    # ID of Notifier
+    notifier: "c-wdcsr:n-c9pg7"
+  - recipient: "test@example.com"
+    notifier: "c-wdcsr:n-lkrhd"
+  # Select which statuses you want the notification to be sent  
+  condition: ["Failed", "Success", "Changed"]
+  # Ability to override the default message (Optional)
+  message: "my-message"
+```
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md
new file mode 100644
index 00000000000..6fec0fa6ccb
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md
@@ -0,0 +1,103 @@
+---
+title: Configuring Persistent Data for Pipeline Components
+weight: 600
+---
+
+The internal [Docker registry](#how-pipelines-work) and the [Minio](#how-pipelines-work) workloads use ephemeral volumes by default. This default storage works out-of-the-box and makes testing easy, but you lose the build images and build logs if the node running the Docker Registry or Minio fails. In most cases this is fine. If you want build images and logs to survive node failures, you can configure the Docker Registry and Minio to use persistent volumes.
+
+This section assumes that you understand how persistent storage works in Kubernetes. For more information, refer to the section on [how storage works.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/how-storage-works/)
+
+>**Prerequisites (for both parts A and B):**
+>
+>[Persistent volumes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) must be available for the cluster.
+
+### A. Configuring Persistent Data for Docker Registry
+
+1. From the project that you're configuring a pipeline for, and click **Resources > Workloads.** In versions prior to v2.3.0, select the **Workloads** tab.
+
+1. Find the `docker-registry` workload and select **&#8942; > Edit**.
+
+1. Scroll to the **Volumes** section and expand it. Make one of the following selections from the **Add Volume** menu, which is near the bottom of the section:
+
+    - **Add Volume > Add a new persistent volume (claim)**
+    - **Add Volume > Use an existing persistent volume (claim)**
+
+1.  Complete the form that displays to choose a persistent volume for the internal Docker registry.
+{{% tabs %}}
+{{% tab "Add a new persistent volume" %}}
+<br/>
+1. Enter a **Name** for the volume claim.
+
+1. Select a volume claim **Source**:
+
+    - If you select **Use a Storage Class to provision a new persistent volume**, select a storage class and enter a **Capacity**.
+
+    - If you select **Use an existing persistent volume**, choose a **Persistent Volume** from the drop-down.
+1. From the **Customize** section, choose the read/write access for the volume.
+
+1. Click **Define**.
+
+{{% /tab %}}
+
+{{% tab "Use an existing persistent volume" %}}
+<br/>
+1. Enter a **Name** for the volume claim.
+
+1. Choose a **Persistent Volume Claim** from the drop-down.
+
+1. From the **Customize** section, choose the read/write access for the volume.
+
+1. Click **Define**.
+
+{{% /tab %}}
+
+{{% /tabs %}}
+
+1. From the **Mount Point** field, enter `/var/lib/registry`, which is the data storage path inside the Docker registry container.
+
+1. Click **Upgrade**.
+
+### B. Configuring Persistent Data for Minio
+
+1. From the project view, click **Resources > Workloads.** (In versions prior to v2.3.0, click the **Workloads** tab.) Find the `minio` workload and select **&#8942; > Edit**.
+
+1. Scroll to the **Volumes** section and expand it. Make one of the following selections from the **Add Volume** menu, which is near the bottom of the section:
+
+    - **Add Volume > Add a new persistent volume (claim)**
+    - **Add Volume > Use an existing persistent volume (claim)**
+
+1.  Complete the form that displays to choose a persistent volume for the internal Docker registry.
+{{% tabs %}}
+
+{{% tab "Add a new persistent volume" %}}
+<br/>
+1. Enter a **Name** for the volume claim.
+
+1. Select a volume claim **Source**:
+
+    - If you select **Use a Storage Class to provision a new persistent volume**, select a storage class and enter a **Capacity**.
+
+    - If you select **Use an existing persistent volume**, choose a **Persistent Volume** from the drop-down.
+1. From the **Customize** section, choose the read/write access for the volume.
+
+1. Click **Define**.
+
+{{% /tab %}}
+{{% tab "Use an existing persistent volume" %}}
+<br/>
+1. Enter a **Name** for the volume claim.
+
+1. Choose a **Persistent Volume Claim** from the drop-down.
+
+1. From the **Customize** section, choose the read/write access for the volume.
+
+1. Click **Define**.
+
+{{% /tab %}}
+{{% /tabs %}}
+
+1. From the **Mount Point** field, enter `/data`, which is the data storage path inside the Minio container.
+
+1. Click **Upgrade**.
+
+**Result:** Persistent storage is configured for your pipeline components.
diff --git a/content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md b/content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md
new file mode 100644
index 00000000000..261e1e11782
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md
@@ -0,0 +1,30 @@
+---
+title: Adding a Pod Security Policy
+weight: 80
+---
+
+> **Prerequisite:** The options below are available only for clusters that are [launched using RKE.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) 
+
+When your cluster is running pods with security-sensitive configurations, assign it a [pod security policy]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/), which is a set of rules that monitors the conditions and settings in your pods. If a pod doesn't meet the rules specified in your policy, the policy stops it from running.
+
+You can assign a pod security policy when you provision a cluster. However, if you need to relax or restrict security for your pods later, you can update the policy while editing your cluster.
+
+1. From the **Global** view, find the cluster to which you want to apply a pod security policy. Select **&#8942; > Edit**.
+
+2. Expand **Cluster Options**.
+
+3. From **Pod Security Policy Support**, select **Enabled**.
+
+    >**Note:** This option is only available for clusters [provisioned by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
+
+4. From the **Default Pod Security Policy** drop-down, select the policy you want to apply to the cluster.
+
+	Rancher ships with [policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/#default-pod-security-policies) as well.
+
+5. Click **Save**.
+
+**Result:** The pod security policy is applied to the cluster and any projects within the cluster.
+
+>**Note:** Workloads already running before assignment of a pod security policy are grandfathered in. Even if they don't meet your pod security policy, workloads running before assignment of the policy continue to run.
+>
+>To check if a running workload passes your pod security policy, clone or upgrade it.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md
new file mode 100644
index 00000000000..8b66f65ae47
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md
@@ -0,0 +1,41 @@
+---
+title: Projects
+weight: 2500
+---
+
+_Projects_ are objects introduced in Rancher that help organize namespaces in your Kubernetes cluster. You can use projects to create multi-tenant clusters, which allows a group of users to share the same underlying resources without interacting with each other's applications.
+
+In terms of hierarchy:
+
+- Clusters contain projects
+- Projects contain namespaces
+
+Within Rancher, projects allow you to manage multiple namespaces as a single entity. In native Kubernetes, which does not include projects, features like role-based access rights or cluster resources are assigned to individual namespaces. In clusters where multiple namespaces require the same set of access rights, assigning these rights to each individual namespace can become tedious. Even though all namespaces require the same rights, there's no way to apply those rights to all of your namespaces in a single action. You'd have to repetitively assign these rights to each namespace!
+
+Rancher projects resolve this issue by allowing you to apply resources and access rights at the project level. Each namespace in the project then inherits these resources and policies, so you only have to assign them to the project once, rather than assigning them to each individual namespace.
+
+You can use projects to perform actions like:
+
+- [Assign users access to a group of namespaces]({{<baseurl>}}/rancher/v2.x/en/project-admin/project-members)
+- Assign users [specific roles in a project]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles). A role can be owner, member, read-only, or [custom]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/)
+- [Set resource quotas]({{<baseurl>}}/rancher/v2.x/en/project-admin/resource-quotas/)
+- [Manage namespaces]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/)
+- [Configure tools]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/)
+- [Set up pipelines for continuous integration and deployment]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines)
+- [Configure pod security policies]({{<baseurl>}}/rancher/v2.x/en/project-admin/pod-security-policies)
+
+### Authorization
+
+Non-administrative users are only authorized for project access after an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owner or member]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) adds them to the project's **Members** tab.
+
+Whoever creates the project automatically becomes a [project owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles).
+
+## Switching between Projects
+
+To switch between projects, use the drop-down available in the navigation bar. Alternatively, you can switch between projects directly in the navigation bar.
+
+1. From the **Global** view, navigate to the project that you want to configure.
+
+1. Select **Projects/Namespaces** from the navigation bar.
+
+1. Select the link for the project that you want to open.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md
new file mode 100644
index 00000000000..82b308daf17
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md
@@ -0,0 +1,68 @@
+---
+title: Namespaces
+weight: 2520
+---
+
+Within Rancher, you can further divide projects into different [namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/), which are virtual clusters within a project backed by a physical cluster. Should you require another level of organization beyond projects and the `default` namespace, you can use multiple namespaces to isolate applications and resources.
+
+Although you assign resources at the project level so that each namespace in the project can use them, you can override this inheritance by assigning resources explicitly to a namespace.
+
+Resources that you can assign directly to namespaces include:
+
+- [Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)
+- [Load Balancers/Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/)
+- [Service Discovery Records]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/service-discovery/)
+- [Persistent Volume Claims]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/persistent-volume-claims/)
+- [Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/)
+- [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/)
+- [Registries]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries/)
+- [Secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/)
+
+To manage permissions in a vanilla Kubernetes cluster, cluster admins configure role-based access policies for each namespace. With Rancher, user permissions are assigned on the project level instead, and permissions are automatically inherited by any namespace owned by the particular project.
+
+> **Note:** If you create a namespace with `kubectl`, it may be unusable because `kubectl` doesn't require your new namespace to be scoped within a project that you have access to. If your permissions are restricted to the project level, it is better to [create a namespace through Rancher]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/#creating-namespaces) to ensure that you will have permission to access the namespace.
+
+
+### Creating Namespaces
+
+Create a new namespace to isolate apps and resources in a project.
+
+>**Tip:** When working with project resources that you can assign to a namespace (i.e., [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/), [certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/), [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps), etc.) you can create a namespace on the fly.
+
+1. From the **Global** view, open the project where you want to create a namespace.
+
+    >**Tip:** As a best practice, we recommend creating namespaces from the project level. However, cluster owners and members can create them from the cluster level as well.
+
+1. From the main menu, select **Namespace**. The click **Add Namespace**.
+
+1. **Optional:** If your project has [Resource Quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) in effect, you can override the default resource **Limits** (which places a cap on the resources that the namespace can consume).  
+
+1. Enter a **Name** and then click **Create**.
+
+**Result:** Your namespace is added to the project. You can begin assigning cluster resources to the namespace.
+
+### Moving Namespaces to Another Project
+
+Cluster admins and members may occasionally need to move a namespace to another project, such as when you want a different team to start using the application.
+
+1. From the **Global** view, open the cluster that contains the namespace you want to move.
+
+1. From the main menu, select **Projects/Namespaces**.
+
+1. Select the namespace(s) that you want to move to a different project. Then click **Move**. You can move multiple namespaces at one.
+
+    >**Notes:**
+    >
+    >- Don't move the namespaces in the `System` project. Moving these namespaces can adversely affect cluster networking.
+    >- You cannot move a namespace into a project that already has a [resource quota]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/) configured.
+    >- If you move a namespace from a project that has a quota set to a project with no quota set, the quota is removed from the namespace.
+
+1. Choose a new project for the new namespace and then click **Move**. Alternatively, you can remove the namespace from all projects by selecting **None**.
+
+**Result:** Your namespace is moved to a different project (or is unattached from all projects). If any project resources are attached to the namespace, the namespace releases them and then attached resources from the new project.
+
+### Editing Namespace Resource Quotas
+
+You can always override the namespace default limit to provide a specific namespace with access to more (or less) project resources.
+
+For more information, see how to [edit namespace resource quotas]({{<baseurl>}}/rancher/v2.x/en/project-admin//resource-quotas/override-namespace-default/#editing-namespace-resource-quotas).
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
new file mode 100644
index 00000000000..f4ad3fa8294
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
@@ -0,0 +1,43 @@
+---
+title: Project Applications
+weight: 2525
+---
+
+> This section is under construction.
+
+Rancher contains a variety of tools that aren't included in Kubernetes to assist in your DevOps operations. Rancher can integrate with external services to help your clusters run more efficiently. Tools are divided into following categories:
+<!-- TOC -->
+
+- [Notifiers and Alerts](#notifiers-and-alerts)
+- [Logging](#logging)
+- [Monitoring](#monitoring)
+
+<!-- /TOC -->
+
+## Notifiers and Alerts
+
+Notifiers and alerts are two features that work together to inform you of events in the Rancher system.
+
+[Notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action. Notifications can be sent with Slack, email, PagerDuty, WeChat, and webhooks.
+
+[Alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts) are rules that trigger those notifications. Before you can receive alerts, you must configure one or more notifier in Rancher. The scope for alerts can be set at either the cluster or project level.
+
+## Logging
+
+Logging is helpful because it allows you to:
+
+- Capture and analyze the state of your cluster
+- Look for trends in your environment
+- Save your logs to a safe location outside of your cluster
+- Stay informed of events like a container crashing, a pod eviction, or a node dying
+- More easily debugg and troubleshoot problems
+
+Rancher can integrate with Elasticsearch, splunk, kafka, syslog, and fluentd.
+
+For details, refer to the [logging section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging)
+
+## Monitoring
+
+_Available as of v2.2.0_
+
+Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring)
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
new file mode 100644
index 00000000000..5d5f0c867ac
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
@@ -0,0 +1,185 @@
+---
+title:  Project Alerts
+weight: 2
+---
+
+To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. When an event occurs, your alert is triggered, and you are sent a notification. You can then, if necessary, follow up with corrective actions.
+
+Notifiers and alerts are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher can notify [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) and [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) of events they need to address.
+
+Before you can receive alerts, one or more [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) must be configured at the cluster level.
+
+Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can manage project alerts.
+
+This section covers the following topics:
+
+- [Alerts scope](#alerts-scope)
+- [Default project-level alerts](#default-project-level-alerts)
+- [Adding project alerts](#adding-project-alerts)
+- [Managing project alerts](#managing-project-alerts)
+
+## Alerts Scope
+
+The scope for alerts can be set at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) or project level.
+
+At the project level, Rancher monitors specific deployments and sends alerts for:
+
+* Deployment availability
+* Workloads status
+* Pod status
+* The Prometheus expression cross the thresholds
+
+## Default Project-level Alerts
+
+When you enable monitoring for the project, some project-level alerts are provided. You can receive these alerts if a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them is configured at the cluster level.
+
+| Alert | Explanation |
+|-------|-------------|
+| Less than half workload available | A critical alert is triggered if less than half of a workload is available, based on workloads where the key is `app` and the value is `workload`. |
+| Memory usage close to the quota | A warning alert is triggered if the workload's memory usage exceeds the memory resource quota that is set for the workload. You can see the memory limit in the Rancher UI if you go to the workload under the **Security & Host Config** tab. |
+
+For information on other default alerts, refer to the section on [cluster-level alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts)
+
+## Adding Project Alerts
+
+>**Prerequisite:** Before you can receive project alerts, you must add a notifier.
+
+1. From the **Global** view, navigate to the project that you want to configure project alerts for. Select **Tools > Alerts**. In versions prior to v2.2.0, you can choose **Resources > Alerts**.
+
+1. Click **Add Alert Group**.
+
+1. Enter a **Name** for the alert that describes its purpose, you could group alert rules for the different purpose.
+
+1. Based on the type of alert you want to create, complete one of the instruction subsets below.
+
+{{% accordion id="pod" label="Pod Alerts" %}}
+This alert type monitors for the status of a specific pod.
+
+1. Select the **Pod** option, and then select a pod from the drop-down.
+1. Select a pod status that triggers an alert:
+
+    - **Not Running**
+    - **Not Scheduled**
+    - **Restarted `<x>` times with the last `<x>` Minutes**
+
+1. Select the urgency level of the alert. The options are:
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+
+    Select the urgency level of the alert based on pod state. For example, select **Info** for Job pod which stop running after job finished. However, if an important pod isn't scheduled, it may affect operations, so choose **Critical**.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+{{% accordion id="workload" label="Workload Alerts" %}}
+This alert type monitors for the availability of a workload.
+
+1. Choose the **Workload** option. Then choose a workload from the drop-down.
+
+1. Choose an availability percentage using the slider. The alert is triggered when the workload's availability on your cluster nodes drops below the set percentage.
+
+1. Select the urgency level of the alert.
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+
+    Select the urgency level of the alert based on the percentage you choose and the importance of the workload.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+{{% accordion id="workload-selector" label="Workload Selector Alerts" %}}
+This alert type monitors for the availability of all workloads marked with tags that you've specified.
+
+1. Select the **Workload Selector** option, and then click **Add Selector** to enter the key value pair for a label. If one of the workloads drops below your specifications, an alert is triggered. This label should be applied to one or more of your workloads.
+
+1. Select the urgency level of the alert.
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+
+    Select the urgency level of the alert based on the percentage you choose and the importance of the workload.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+
+{{% /accordion %}}
+{{% accordion id="project-expression" label="Metric Expression Alerts" %}}
+<br>
+_Available as of v2.2.4_
+
+If you enable [project monitoring]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/#monitoring), this alert type monitors for the overload from Prometheus expression querying.
+
+1. Input or select an **Expression**, the drop down shows the original metrics from Prometheus, including:
+
+  - [**Container**](https://github.com/google/cadvisor)
+  - [**Kubernetes Resources**](https://github.com/kubernetes/kube-state-metrics)
+  - [**Customize**]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#project-metrics)
+  - [**Project Level Grafana**](http://docs.grafana.org/administration/metrics/)
+  - **Project Level Prometheus**
+
+1. Choose a comparison.
+
+  - **Equal**: Trigger alert when expression value equal to the threshold.
+  - **Not Equal**: Trigger alert when expression value not equal to the threshold.
+  - **Greater Than**: Trigger alert when expression value greater than to threshold.
+  - **Less Than**: Trigger alert when expression value equal or less than the threshold.
+  - **Greater or Equal**: Trigger alert when expression value greater to equal to the threshold.
+  - **Less or Equal**: Trigger alert when expression value less or equal to the threshold.
+
+1. Input a **Threshold**, for trigger alert when the value of expression cross the threshold.
+
+1. Choose a **Comparison**.
+
+1. Select a **Duration**, for trigger alert when expression value crosses the threshold longer than the configured duration.
+
+1. Select the urgency level of the alert.
+
+    - **Critical**: Most urgent
+    - **Warning**: Normal urgency
+    - **Info**: Least urgent
+    <br/>
+    <br/>
+    Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a expression for container memory close to the limit raises above 60% deems an urgency of **Info**, but raised about 95% deems an urgency of **Critical**.
+
+1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
+
+    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
+    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
+    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
+<br>
+{{% /accordion %}}
+
+1. Continue adding more **Alert Rule** to the group.
+
+1. Finally, choose the [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) that send you alerts.
+
+    - You can set up multiple notifiers.
+    - You can change notifier recipients on the fly.
+
+**Result:** Your alert is configured. A notification is sent when the alert is triggered.
+
+## Managing Project Alerts
+
+To manage project alerts, browse to the project that alerts you want to manage. Then select **Tools > Alerts**. In versions prior to v2.2.0, you can choose **Resources > Alerts**. You can:
+
+- Deactivate/Reactive alerts
+- Edit alert settings
+- Delete unnecessary alerts
+- Mute firing alerts
+- Unmute muted alerts
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
new file mode 100644
index 00000000000..596bbe9e716
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
@@ -0,0 +1,21 @@
+---
+title: Istio in Projects
+weight: 1
+---
+
+_Available as of v2.3.0_
+
+Using Rancher, you can connect, secure, control, and observe services through integration with [Istio](https://istio.io/), a leading open-source service mesh solution. Istio provides behavioral insights and operational control over the service mesh as a whole, offering a complete solution to satisfy the diverse requirements of microservice applications.
+
+This service mesh provides features that include but are not limited to the following:
+
+- Traffic management features
+- Enhanced monitoring and tracing
+- Service discovery and routing
+- Secure connections and service-to-service authentication with mutual TLS
+- Load balancing
+- Automatic retries, backoff, and circuit breaking
+
+Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project for [comprehensive data visualizations,]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/#accessing-visualizations) traffic management, or any of its other features.
+
+For information on how Istio is integrated with Rancher and how to set it up, refer to the [section about Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md
new file mode 100644
index 00000000000..9488490ab40
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md
@@ -0,0 +1,108 @@
+---
+title: Project Logging
+weight: 3
+---
+
+Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters.
+
+For background information about how logging integrations work, refer to the [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/#how-logging-integrations-work)
+
+Rancher supports the following services:
+
+- Elasticsearch
+- Splunk
+- Kafka
+- Syslog
+- Fluentd
+
+>**Note:** You can only configure one logging service per cluster or per project.
+
+Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure Rancher to send Kubernetes logs to a logging service.
+
+## Requirements
+
+The Docker daemon on each node in the cluster should be [configured](https://docs.docker.com/config/containers/logging/configure/) with the (default) log-driver: `json-file`. You can check the log-driver by running the following command:
+
+```
+$ docker info | grep 'Logging Driver'
+Logging Driver: json-file
+```
+
+## Advantages
+
+Setting up a logging service to collect logs from your cluster/project has several advantages:
+
+- Logs errors and warnings in your Kubernetes infrastructure to a stream. The stream informs you of events like a container crashing, a pod eviction, or a node dying.
+- Allows you to capture and analyze the state of your cluster and look for trends in your environment using the log stream.
+- Helps you when troubleshooting or debugging.
+- Saves your logs to a safe location outside of your cluster, so that you can still access them even if your cluster encounters issues.
+
+## Logging Scope
+
+You can configure logging at either cluster level or project level.
+
+- [Cluster logging]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) writes logs for every pod in the cluster, i.e. in all the projects. For [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), it also writes logs for all the Kubernetes system components.
+
+- Project logging writes logs for every pod in that particular project.
+
+Logs that are sent to your logging service are from the following locations:
+
+  - Pod logs stored at `/var/log/containers`.
+
+  - Kubernetes system components logs stored at `/var/lib/rancher/rke/logs/`.
+
+## Enabling Project Logging
+
+1. From the **Global** view, navigate to the project that you want to configure project logging.
+
+1. Select **Tools > Logging** in the navigation bar. In versions prior to v2.2.0, you can choose **Resources > Logging**.
+
+1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports the following services:
+
+   - [Elasticsearch]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/)
+   - [Splunk]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/splunk/)
+   - [Kafka]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/kafka/)
+   - [Syslog]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/syslog/)
+   - [Fluentd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/)
+
+1. (Optional) Instead of using the UI to configure the logging services, you can enter custom advanced configurations by clicking on **Edit as File**, which is located above the logging targets. This link is only visible after you select a logging service.
+
+    - With the file editor, enter raw fluentd configuration for any logging service. Refer to the documentation for each logging service on how to setup the output configuration.
+
+       - [Elasticsearch Documentation](https://github.com/uken/fluent-plugin-elasticsearch)
+       - [Splunk Documentation](https://github.com/fluent/fluent-plugin-splunk)
+       - [Kafka Documentation](https://github.com/fluent/fluent-plugin-kafka)
+       - [Syslog Documentation](https://github.com/dlackty/fluent-plugin-remote_syslog)
+       - [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/out_forward)
+
+   - If the logging service is using TLS, you also need to complete the **SSL Configuration** form.
+       1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
+
+           - You can use either a self-signed certificate or one provided by a certificate authority.
+
+           - You can generate a self-signed certificate using an openssl command. For example:
+
+                ```
+                openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+                ```
+       2. If you are using a self-signed certificate, provide the **CA Certificate PEM**.  
+
+1. (Optional) Complete the **Additional Logging Configuration** form.
+
+    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
+
+    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes data to the logging server. Intervals are measured in seconds.
+
+    1. **Include System Log**. The logs from pods in system project and RKE components will be sent to the target. Uncheck it to exclude the system logs.
+
+1. Click **Test**. Rancher sends a test log to the service.
+
+    > **Note:** This button is replaced with _Dry Run_ if you are using the custom configuration editor. In this case, Rancher calls the fluentd dry run command to validate the configuration.
+
+1. Click **Save**.
+
+**Result:** Rancher is now configured to send logs to the selected service. Log into the logging service so that you can start viewing the logs.
+
+## Related Links
+
+[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md
new file mode 100644
index 00000000000..d87d48f296c
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md
@@ -0,0 +1,81 @@
+---
+title: Project Monitoring
+weight: 4
+---
+
+Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
+
+> For more information about how Prometheus works, refer to the [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#about-prometheus)
+
+This section covers the following topics:
+
+- [Monitoring scope](#monitoring-scope)
+- [Permissions to configure project monitoring](#permissions-to-configure-project-monitoring)
+- [Enabling project monitoring](#enabling-project-monitoring)
+- [Project-level monitoring resource requirements](#project-level-monitoring-resource-requirements)
+- [Project metrics](#project-metrics)
+
+### Monitoring Scope
+
+Using Prometheus, you can monitor Rancher at both the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and project level. For each cluster and project that is enabled for monitoring, Rancher deploys a Prometheus server.
+
+- [Cluster monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) allows you to view the health of your Kubernetes cluster. Prometheus collects metrics from the cluster components below, which you can view in graphs and charts.
+
+    - [Kubernetes control plane]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#kubernetes-components-metrics)
+    - [etcd database]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#etcd-metrics)
+    - [All nodes (including workers)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#cluster-metrics)
+
+- Project monitoring allows you to view the state of pods running in a given project. Prometheus collects metrics from the project's deployed HTTP and TCP/UDP workloads.
+
+### Permissions to Configure Project Monitoring
+
+Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure project level monitoring. Project members can only view monitoring metrics.
+
+### Enabling Project Monitoring
+
+> **Prerequisite:** Cluster monitoring must be [enabled.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/)
+
+1. Go to the project where monitoring should be enabled. Note: When cluster monitoring is enabled, monitoring is also enabled by default in the **System** project.
+
+1. Select **Tools > Monitoring** in the navigation bar.
+
+1. Select **Enable** to show the [Prometheus configuration options]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/). Enter in your desired configuration options.
+
+1. Click **Save**.
+
+### Project-Level Monitoring Resource Requirements
+
+Container| CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable
+---------|---------------|---------------|-------------|-------------|-------------
+Prometheus|750m| 750Mi | 1000m | 1000Mi | Yes
+Grafana | 100m | 100Mi | 200m | 200Mi | No
+
+
+**Result:** A single application,`project-monitoring`, is added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the project. After the application is `active`, you can start viewing [project metrics](#project-metrics) through the [Rancher dashboard]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#rancher-dashboard) or directly from [Grafana]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#grafana).
+
+> The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
+
+### Project Metrics
+
+[Workload metrics]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#workload-metrics) are available for the project if monitoring is enabled at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and at the [project level.](#enabling-project-monitoring)
+
+You can monitor custom metrics from any [exporters.](https://prometheus.io/docs/instrumenting/exporters/) You can also expose some custom endpoints on deployments without needing to configure Prometheus for your project.
+
+> **Example:**
+> A [Redis](https://redis.io/) application is deployed in the namespace `redis-app` in the project `Datacenter`. It is monitored via [Redis exporter](https://github.com/oliver006/redis_exporter). After enabling project monitoring, you can edit the application to configure the <b>Advanced Options -> Custom Metrics</b> section. Enter the `Container Port` and `Path` and select the `Protocol`.
+
+To access a project-level Grafana instance,
+
+1. From the **Global** view, navigate to a cluster that has monitoring enabled.
+
+1. Go to a project that has monitoring enabled.
+
+1. From the project view, click **Apps.** In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar.
+
+1. Go to the `project-monitoring` application.
+
+1. In the `project-monitoring` application, there are two `/index.html` links: one that leads to a Grafana instance and one that leads to a Prometheus instance. When you click the Grafana link, it will redirect you to a new webpage for Grafana, which shows metrics for the cluster.
+
+1. You will be signed in to the Grafana instance automatically. The default username is `admin` and the default password is `admin`. For security, we recommend that you log out of Grafana, log back in with the `admin` password, and change your password.
+
+**Results:** You will be logged into Grafana from the Grafana instance. After logging in, you can view the preset Grafana dashboards, which are imported via the [Grafana provisioning mechanism](http://docs.grafana.org/administration/provisioning/#dashboards), so you cannot modify them directly. For now, if you want to configure your own dashboards, clone the original and modify the new copy.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
new file mode 100644
index 00000000000..c3de12fd652
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
@@ -0,0 +1,44 @@
+---
+title: Project Resource Quotas
+weight: 3
+---
+
+In situations where several teams share a cluster, one team may overconsume the resources available: CPU, memory, storage, services, Kubernetes objects like pods or secrets, and so on.  To prevent this overconsumption, you can apply a _resource quota_, which is a Rancher feature that limits the resources available to a project or namespace.
+
+This page is a how-to guide for creating resource quotas in existing projects.
+
+Resource quotas can also be set when a new project is created. For details, refer to the section on [creating new projects.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/#creating-projects)
+
+> Resource quotas in Rancher include the same functionality as the [native version of Kubernetes](https://kubernetes.io/docs/concepts/policy/resource-quotas/). However, in Rancher, resource quotas have been extended so that you can apply them to [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#projects). For details on how resource quotas work with projects in Rancher, refer to [this page.](./quotas-for-projects)
+
+### Applying Resource Quotas to Existing Projects
+
+_Available as of v2.0.1_
+
+Edit [resource quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) when:
+
+- You want to limit the resources that a project and its namespaces can use.
+- You want to scale the resources available to a project up or down when a research quota is already in effect.
+
+1. From the **Global** view, open the cluster containing the project to which you want to apply a resource quota.
+
+1. From the main menu, select **Projects/Namespaces**.
+
+1. Find the project that you want to add a resource quota to. From that project, select **&#8942; > Edit**.
+
+1. Expand **Resource Quotas** and click **Add Quota**. Alternatively, you can edit existing quotas.
+
+1. Select a [Resource Type]({{<baseurl>}}/rancher/v2.x/en/project-admin/resource-quotas/#resource-quota-types).
+
+1. Enter values for the **Project Limit** and the **Namespace Default Limit**.
+
+    | Field                   | Description                                                                                              |
+    | ----------------------- | -------------------------------------------------------------------------------------------------------- |
+    | Project Limit           | The overall resource limit for the project.                                                              |
+    | Namespace Default Limit | The default resource limit available for each namespace. This limit is propagated to each namespace in the project. The combined limit of all project namespaces shouldn't exceed the project limit. |
+
+1. **Optional:** Add more quotas.
+
+1. Click **Create**.
+
+**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, Rancher won't let you save your changes.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
new file mode 100644
index 00000000000..5d3bf362301
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
@@ -0,0 +1,43 @@
+---
+title: Setting Container Default Resource Limits
+weight: 3
+---
+
+_Available as of v2.2.0_
+
+When setting resource quotas, if you set anything related to CPU or Memory (i.e. limits or reservations) on a project / namespace, all containers will require a respective CPU or Memory field set during creation. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/#requests-vs-limits) for more details on why this is required.
+
+To avoid setting these limits on each and every container during workload creation, a default container resource limit can be specified on the namespace.
+
+### Editing the Container Default Resource Limit
+
+_Available as of v2.2.0_
+
+Edit [container default resource limit]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/#setting-container-default-resource-limit) when:
+
+- You have a CPU or Memory resource quota set on a project, and want to supply the corresponding default values for a container.
+- You want to edit the default container resource limit.
+
+1. From the **Global** view, open the cluster containing the project to which you want to edit the container default resource limit.
+1. From the main menu, select **Projects/Namespaces**.
+1. Find the project that you want to edit the container default resource limit. From that project, select **&#8942; > Edit**.
+1. Expand **Container Default Resource Limit** and edit the values.
+
+### Resource Limit Propagation
+
+When the default container resource limit is set at a project level, the parameter will be propagated to any namespace created in the project after the limit has been set. For any existing namespace in a project, this limit will not be automatically propagated. You will need to manually set the default container resource limit for any existing namespaces in the project in order for it to be used when creating any containers.
+
+> **Note:** Prior to v2.2.0, you could not launch catalog applications that did not have any limits set. With v2.2.0, you can set a default container resource limit on a project and launch any catalog applications.  
+
+Once a container default resource limit is configured on a namespace, the default will be pre-populated for any containers created in that namespace. These limits/reservations can always be overridden during workload creation.
+
+### Container Resource Quota Types
+
+The following resource limits can be configured:
+
+| Resource Type            | Description                                                                                                                                                                                       |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| CPU Limit                | The maximum amount of CPU (in [millicores](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu)) allocated to the container.|
+| CPU Reservation          | The minimum amount of CPU (in millicores) guaranteed to the container.                                                                                                       |
+| Memory Limit             | The maximum amount of memory (in bytes) allocated to the container.                                                                                                          |
+| Memory Reservation       | The minimum amount of memory (in bytes) guaranteed to the container.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md
new file mode 100644
index 00000000000..f09feb9e83c
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md
@@ -0,0 +1,34 @@
+---
+title: Overriding the Default Limit for a Namespace
+weight: 2
+---
+
+Although the **Namespace Default Limit** propagates from the project to each namespace when created, in some cases, you may need to increase (or decrease) the quotas for a specific namespace. In this situation, you can override the default limits by editing the namespace.
+
+In the diagram below, the Rancher administrator has a resource quota in effect for their project. However, the administrator wants to override the namespace limits for `Namespace 3` so that it has more resources available. Therefore, the administrator [raises the namespace limits]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#editing-namespace-resource-quotas) for `Namespace 3` so that the namespace can access more resources.
+
+<sup>Namespace Default Limit Override</sup>
+![Namespace Default Limit Override]({{<baseurl>}}/img/rancher/rancher-resource-quota-override.svg)
+
+How to: [Editing Namespace Resource Quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#editing-namespace-resource-quotas)
+
+### Editing Namespace Resource Quotas
+
+If there is a [resource quota]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) configured for a project, you can override the namespace default limit to provide a specific namespace with access to more (or less) project resources.
+
+1. From the **Global** view, open the cluster that contains the namespace for which you want to edit the resource quota.
+
+1. From the main menu, select **Projects/Namespaces**.
+
+1. Find the namespace for which you want to edit the resource quota. Select **&#8942; > Edit**.
+
+1. Edit the Resource Quota **Limits**.  These limits determine the resources available to the namespace. The limits must be set within the configured project limits.
+
+    For more information about each **Resource Type**, see [Resource Quota Types]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/#resource-quota-types).
+
+    >**Note:**
+    >
+    >- If a resource quota is not configured for the project, these options will not be available.
+    >- If you enter limits that exceed the configured project limits, Rancher will not let you save your edits.
+
+**Result:** Your override is applied to the namespace's resource quota.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md
new file mode 100644
index 00000000000..e671a9afdb1
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md
@@ -0,0 +1,24 @@
+---
+title: Resource Quota Type Reference
+weight: 4
+---
+
+When you create a resource quota, you are configuring the pool of resources available to the project. You can set the following resource limits for the following resource types.
+
+| Resource Type            | Description                                                                                                                                                                                       |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| CPU Limit*                | The maximum amount of CPU (in [millicores](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu)) allocated to the project/namespace.<sup>1</sup> |
+| CPU Reservation*         | The minimum amount of CPU (in millicores) guaranteed to the project/namespace.<sup>1</sup>                                                                                                        |
+| Memory Limit*           | The maximum amount of memory (in bytes) allocated to the project/namespace.<sup>1</sup>                                                                                                           |
+| Memory Reservation*       | The minimum amount of memory (in bytes) guaranteed to the project/namespace.<sup>1</sup>                                                                                                          |
+| Storage Reservation      | The minimum amount of storage (in gigabytes) guaranteed to the project/namespace.                                                                                                                 |
+| Services Load Balancers  | The maximum number of load balancers services that can exist in the project/namespace.                                                                                                            |
+| Services Node Ports      | The maximum number of node port services that can exist in the project/namespace.                                                                                                                 |
+| Pods                     | The maximum number of pods that can exist in the project/namespace in a non-terminal state (i.e., pods with a state of `.status.phase in (Failed, Succeeded)` equal to true).                     |
+| Services                 | The maximum number of services that can exist in the project/namespace.                                                                                                                           |
+| ConfigMaps               | The maximum number of ConfigMaps that can exist in the project/namespace.                                                                                                                         |
+| Persistent Volume Claims | The maximum number of persistent volume claims that can exist in the project/namespace.                                                                                                           |
+| Replications Controllers | The maximum number of replication controllers that can exist in the project/namespace.                                                                                                            |
+| Secrets                  | The maximum number of secrets that can exist in the project/namespace.                                                                                                                            |
+
+>**<sup>*</sup>** When setting resource quotas, if you set anything related to CPU or Memory (i.e. limits or reservations) on a project / namespace, all containers will require a respective CPU or Memory field set during creation. As of v2.2.0, a [container default resource limit](#setting-container-default-resource-limit) can be set at the same time to avoid the need to explicitly set these limits for every workload. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/#requests-vs-limits) for more details on why this is required.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md
new file mode 100644
index 00000000000..60f8c59d91a
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md
@@ -0,0 +1,41 @@
+---
+title: How Resource Quotas Work in Rancher Projects
+weight: 1
+---
+
+Resource quotas in Rancher include the same functionality as the [native version of Kubernetes](https://kubernetes.io/docs/concepts/policy/resource-quotas/). However, in Rancher, resource quotas have been extended so that you can apply them to [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#projects).
+
+In a standard Kubernetes deployment, resource quotas are applied to individual namespaces. However, you cannot apply the quota to your namespaces simultaneously with a single action. Instead, the resource quota must be applied multiple times.
+
+In the following diagram, a Kubernetes administrator is trying to enforce a resource quota without Rancher. The administrator wants to apply a resource quota that sets the same CPU and memory limit to every namespace in his cluster (`Namespace 1-4`) . However, in the base version of Kubernetes, each namespace requires a unique resource quota. The administrator has to create four different resource quotas that have the same specs configured (`Resource Quota 1-4`) and apply them individually.
+
+<sup>Base Kubernetes: Unique Resource Quotas Being Applied to Each Namespace</sup>
+![Native Kubernetes Resource Quota Implementation]({{<baseurl>}}/img/rancher/kubernetes-resource-quota.svg)
+
+Resource quotas are a little different in Rancher. In Rancher, you apply a resource quota to the [project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#projects), and then the quota propagates to each namespace, whereafter Kubernetes enforces your limits using the native version of resource quotas. If you want to change the quota for a specific namespace, you can [override it](#overriding-the-default-limit-for-a-namespace).
+
+The resource quota includes two limits, which you set while creating or editing a project:
+<a id="project-limits"></a>
+
+- **Project Limits:**
+
+    This set of values configures an overall resource limit for the project. If you try to add a new namespace to the project, Rancher uses the limits you've set to validate that the project has enough resources to accommodate the namespace.  In other words, if you try to move a namespace into a project near its resource quota, Rancher blocks you from moving the namespace.
+
+- **Namespace Default Limits:**
+
+    This value is the default resource limit available for each namespace. When the resource quota is created at the project level, this limit is automatically propagated to each namespace in the project. Each namespace is bound to this default limit unless you [override it](#namespace-default-limit-overrides).
+    
+In the following diagram, a Rancher administrator wants to apply a resource quota that sets the same CPU and memory limit for every namespace in their project (`Namespace 1-4`). However, in Rancher, the administrator can set a resource quota for the project (`Project Resource Quota`) rather than individual namespaces. This quota includes resource limits for both the entire project (`Project Limit`) and individual namespaces (`Namespace Default Limit`). Rancher then propagates the `Namespace Default Limit` quotas to each namespace (`Namespace Resource Quota`) when created.
+
+<sup>Rancher: Resource Quotas Propagating to Each Namespace</sup>
+![Rancher Resource Quota Implementation]({{<baseurl>}}/img/rancher/rancher-resource-quota.svg)
+
+Let's highlight some more nuanced functionality. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project.
+
+The following table explains the key differences between the two quota types.
+
+| Rancher Resource Quotas                                    | Kubernetes Resource Quotas                               |
+| ---------------------------------------------------------- | -------------------------------------------------------- |
+| Applies to projects and namespace.                         | Applies to namespaces only.                              |
+| Creates resource pool for all namespaces in project.       | Applies static resource limits to individual namespaces. |
+| Applies resource quotas to namespaces through propagation. | Applies only to the assigned namespace.
diff --git a/content/rancher/v2.5/en/cluster-explorer/registries/_index.md b/content/rancher/v2.5/en/cluster-explorer/registries/_index.md
new file mode 100644
index 00000000000..16429e23910
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/registries/_index.md
@@ -0,0 +1,116 @@
+---
+title: Kubernetes Registry and Docker Registry
+description: Learn about the Docker registry and Kubernetes registry, their use cases and how to use a private registry with the Rancher UI
+weight: 6
+---
+Registries are Kubernetes secrets containing credentials used to authenticate with [private Docker registries](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). 
+
+The word "registry" can mean two things, depending on whether it is used to refer to a Docker or Kubernetes registry:
+
+- A **Docker registry** contains Docker images that you can pull in order to use them in your deployment. The registry is a stateless, scalable server side application that stores and lets you distribute Docker images.
+- The **Kubernetes registry** is an image pull secret that your deployment uses to authenticate with a Docker registry.
+
+Deployments use the Kubernetes registry secret to authenticate with a private Docker registry and then pull a Docker image hosted on it.
+
+Currently, deployments pull the private registry credentials automatically only if the workload is created in the Rancher UI and not when it is created via kubectl.
+
+# Creating a Registry
+
+>**Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/) available to use.
+
+1. From the **Global** view, select the project containing the namespace(s) where you want to add a registry.
+
+1. From the main menu, click **Resources > Secrets > Registry Credentials.** (For Rancher prior to v2.3, click **Resources > Registries.)**
+
+1. Click **Add Registry.**
+
+1. Enter a **Name** for the registry.
+
+    >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your registry must have a unique name among all secrets within your workspace.
+
+1. Select a **Scope** for the registry. You can either make the registry available for the entire project or a single [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces).
+
+1. Select the website that hosts your private registry. Then enter credentials that authenticate with the registry. For example, if you use DockerHub, provide your DockerHub username and password.
+
+1. Click **Save**.
+
+**Result:** 
+
+- Your secret is added to the project or namespace, depending on the scope you chose.
+- You can view the secret in the Rancher UI from the **Resources > Registries** view.
+- Any workload that you create in the Rancher UI will have the credentials to access the registry if the workload is within the registry's scope.
+
+# Using a Private Registry
+
+You can deploy a workload with an image from a private registry through the Rancher UI, or with `kubectl`.
+
+### Using the Private Registry with the Rancher UI
+
+To deploy a workload with an image from your private registry,
+
+1. Go to the project view,
+1. Click **Resources > Workloads.** In versions prior to v2.3.0, go to the **Workloads** tab.
+1. Click **Deploy.**
+1. Enter a unique name for the workload and choose a namespace.
+1. In the **Docker Image** field, enter the URL of the path to the Docker image in your private registry. For example, if your private registry is on Quay.io, you could use `quay.io/<Quay profile name>/<Image name>`.
+1. Click **Launch.**
+
+**Result:** Your deployment should launch, authenticate using the private registry credentials you added in the Rancher UI, and pull the Docker image that you specified.
+
+### Using the Private Registry with kubectl
+
+When you create the workload using `kubectl`, you need to configure the pod so that its YAML has the path to the image in the private registry. You also have to create and reference the registry secret because the pod only automatically gets access to the private registry credentials if it is created in the Rancher UI.
+
+The secret has to be created in the same namespace where the workload gets deployed.
+
+Below is an example `pod.yml` for a workload that uses an image from a private registry. In this example, the pod uses an image from Quay.io, and the .yml specifies the path to the image. The pod authenticates with the registry using credentials stored in a Kubernetes secret called `testquay`, which is specified in `spec.imagePullSecrets` in the `name` field:
+
+```
+apiVersion: v1
+kind: Pod
+metadata:
+  name: private-reg
+spec:
+  containers:
+  - name: private-reg-container
+    image: quay.io/<Quay profile name>/<image name>
+  imagePullSecrets:
+  - name: testquay
+```
+
+In this example, the secret named `testquay` is in the default namespace.
+
+You can use `kubectl` to create the secret with the private registry credentials. This command creates the secret named `testquay`:
+
+```
+kubectl create secret docker-registry testquay \
+    --docker-server=quay.io \
+    --docker-username=<Profile name> \
+    --docker-password=<password>
+```
+
+To see how the secret is stored in Kubernetes, you can use this command:
+
+```
+kubectl get secret testquay --output="jsonpath={.data.\.dockerconfigjson}" | base64 --decode
+```
+
+The result looks like this:
+
+```
+{"auths":{"quay.io":{"username":"<Profile name>","password":"<password>","auth":"c291bXlhbGo6dGVzdGFiYzEyMw=="}}}
+```
+
+After the workload is deployed, you can check if the image was pulled successfully:
+
+```
+kubectl get events
+```
+The result should look like this:
+```
+14s         Normal    Scheduled          Pod    Successfully assigned default/private-reg2 to minikube
+11s         Normal    Pulling            Pod    pulling image "quay.io/<Profile name>/<image name>"
+10s         Normal    Pulled             Pod    Successfully pulled image "quay.io/<Profile name>/<image name>"
+```
+
+For more information, refer to the Kubernetes documentation on [creating a pod that uses your secret.](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret)
diff --git a/content/rancher/v2.5/en/cluster-explorer/secrets/_index.md b/content/rancher/v2.5/en/cluster-explorer/secrets/_index.md
new file mode 100644
index 00000000000..30ea15c7c49
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/secrets/_index.md
@@ -0,0 +1,44 @@
+---
+title: Secrets
+weight: 4
+---
+
+[Secrets](https://kubernetes.io/docs/concepts/configuration/secret/#overview-of-secrets) store sensitive data like passwords, tokens, or keys. They may contain one or more key value pairs.
+
+> This page is about secrets in general. For details on setting up a private registry, refer to the section on [registries.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries)
+
+When configuring a workload, you'll be able to choose which secrets to include. Like config maps, secrets can be referenced by workloads as either an environment variable or a volume mount.
+
+Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)
+
+# Creating Secrets
+
+When creating a secret, you can make it available for any deployment within a project, or you can limit it to a single namespace.
+
+1. From the **Global** view, select the project containing the namespace(s) where you want to add a secret.
+
+2. From the main menu, select **Resources > Secrets**. Click **Add Secret**.
+
+3. Enter a **Name** for the secret.
+
+    >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your secret must have a unique name among all secrets within your workspace.
+
+4. Select a **Scope** for the secret. You can either make the registry available for the entire project or a single [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces).
+
+5. From **Secret Values**, click **Add Secret Value** to add a key value pair. Add as many values as you need.
+
+    >**Tip:** You can add multiple key value pairs to the secret by copying and pasting.
+    >
+    > {{< img "/img/rancher/bulk-key-values.gif" "Bulk Key Value Pair Copy/Paste">}}
+
+1. Click **Save**.
+
+**Result:** Your secret is added to the project or namespace, depending on the scope you chose. You can view the secret in the Rancher UI from the **Resources > Secrets** view.
+
+Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)
+
+# What's Next?
+
+Now that you have a secret added to the project or namespace, you can add it to a workload that you deploy.
+
+For more information on adding secret to a workload, see [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md b/content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md
new file mode 100644
index 00000000000..721ce42d9be
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md
@@ -0,0 +1,50 @@
+---
+title: Service Discovery
+weight: 2
+---
+
+For every workload created, a complementing Service Discovery entry is created. This Service Discovery entry enables DNS resolution for the workload's pods using the following naming convention:
+`<workload>.<namespace>.svc.cluster.local`.
+
+However, you also have the option of creating additional Service Discovery records. You can use these additional records so that a given [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) resolves with one or more external IP addresses, an external hostname, an alias to another DNS record, other workloads, or a set of pods that match a selector that you create.
+
+1. From the **Global** view, open the project that you want to add a DNS record to.
+
+1. Click **Resources** in the main navigation bar. Click the **Service Discovery** tab. (In versions prior to v2.3.0, just click the **Service Discovery** tab.) Then click **Add Record**.
+
+1. Enter a **Name** for the DNS record. This name is used for DNS resolution.
+
+1. Select a **Namespace** from the drop-down list. Alternatively, you can create a new namespace on the fly by clicking **Add to a new namespace**.
+
+1. Select one of the **Resolves To** options to route requests to the DNS record.
+
+    1. **One or more external IP addresses**
+
+        Enter an IP address in the **Target IP Addresses** field. Add more IP addresses by clicking **Add Target IP**.
+
+    1. **An external hostname**
+
+        Enter a **Target Hostname**.
+
+    1. **Alias of another DNS record's value**
+
+        Click **Add Target Record** and select another DNS record from the **Value** drop-down.
+
+    1. **One or more workloads**
+
+        Click **Add Target Workload** and select another workload from the **Value** drop-down.
+
+    1. **The set of pods which match a selector**
+
+        Enter key value pairs of [label selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) to create a record for all pods that match your parameters.
+
+1. Click **Create**
+
+**Result:** A new DNS record is created.
+
+- You can view the record by from the project's **Service Discovery** tab.
+- When you visit the new DNS name for the new record that you created (`<recordname>.<namespace>.svc.cluster.local`), it resolves the chosen namespace.
+
+## Related Links
+
+- [Adding entries to Pod /etc/hosts with HostAliases](https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/_index.md
new file mode 100644
index 00000000000..5df888b5f05
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/_index.md
@@ -0,0 +1,58 @@
+---
+title: "Storage"
+description: "Learn about the two ways with which you can create persistent storage in Kubernetes: persistent volumes and storage classes"
+weight: 17
+---
+When deploying an application that needs to retain data, you'll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to maintain application data, even if the application's pod fails.
+
+The documents in this section assume that you understand the Kubernetes concepts of persistent volumes, persistent volume claims, and storage classes. For more information, refer to the section on [how storage works.](./how-storage-works)
+
+### Prerequisites
+
+To set up persistent storage, the `Manage Volumes` [role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference) is required.
+
+If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
+
+For provisioning new storage with Rancher, the cloud provider must be enabled. For details on enabling cloud providers, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/)
+
+For attaching existing persistent storage to a cluster, the cloud provider does not need to be enabled.
+
+### Setting up Existing Storage
+
+The overall workflow for setting up existing storage is as follows:
+
+1. Set up persistent storage in an infrastructure provider.
+2. Add a persistent volume (PV) that refers to the persistent storage.
+3. Add a persistent volume claim (PVC) that refers to the PV.
+4. Mount the PVC as a volume in your workload.
+
+For details and prerequisites, refer to [this page.](./attaching-existing-storage)
+
+### Dynamically Provisioning New Storage in Rancher
+
+The overall workflow for provisioning new storage is as follows:
+
+1. Add a storage class and configure it to use your storage provider.
+2. Add a persistent volume claim (PVC) that refers to the storage class.
+3. Mount the PVC as a volume for your workload.
+
+For details and prerequisites, refer to [this page.](./provisioning-new-storage)
+
+### Provisioning Storage Examples
+
+We provide examples of how to provision storage with [NFS,](./examples/nfs) [vSphere,](./examples/vsphere) and [Amazon's EBS.](./examples/ebs)
+
+### GlusterFS Volumes
+
+In clusters that store data on GlusterFS volumes, you may experience an issue where pods fail to mount volumes after restarting the `kubelet`. For details on preventing this from happening, refer to [this page.](./glusterfs-volumes)
+
+### iSCSI Volumes
+
+In [Rancher Launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) that store data on iSCSI volumes, you may experience an issue where kubelets fail to automatically connect with iSCSI volumes. For details on resolving this issue, refer to [this page.](./iscsi-volumes)
+
+### hostPath Volumes
+Before you create a hostPath volume, you need to set up an [extra_bind]({{<baseurl>}}/rke/latest/en/config-options/services/services-extras/#extra-binds/) in your cluster configuration. This will mount the path as a volume in your kubelets, which can then be used for hostPath volumes in your workloads.
+
+### Related Links
+
+- [Kubernetes Documentation: Storage](https://kubernetes.io/docs/concepts/storage/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md
new file mode 100644
index 00000000000..c020ad8712a
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md
@@ -0,0 +1,102 @@
+---
+title: Setting up Existing Storage
+weight: 3
+---
+
+This section describes how to set up existing persistent storage for workloads in Rancher.
+
+> This section assumes that you understand the Kubernetes concepts of persistent volumes and persistent volume claims. For more information, refer to the section on [how storage works.](../how-storage-works)
+
+To set up storage, follow these steps:
+
+1. [Set up persistent storage in an infrastructure provider.](#1-set-up-persistent-storage-in-an-infrastructure-provider)
+2. [Add a persistent volume that refers to the persistent storage.](#2-add-a-persistent-volume-that-refers-to-the-persistent-storage)
+3. [Add a persistent volume claim that refers to the persistent volume.](#3-add-a-persistent-volume-claim-that-refers-to-the-persistent-volume)
+4. [Mount the persistent volume claim as a volume in your workload.](#4-mount-the-persistent-storage-claim-as-a-volume-in-your-workload)
+
+### Prerequisites
+
+- To create a persistent volume as a Kubernetes resource, you must have the `Manage Volumes` [role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference)
+- If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
+
+### 1. Set up persistent storage in an infrastructure provider
+
+Creating a persistent volume in Rancher will not create a storage volume. It only creates a Kubernetes resource that maps to an existing volume. Therefore, before you can create a persistent volume as a Kubernetes resource, you must have storage provisioned.
+
+The steps to set up a persistent storage device will differ based on your infrastructure. We provide examples of how to set up storage using [vSphere,](../examples/vsphere) [NFS,](../examples/nfs) or Amazon's [EBS.](../examples/ebs)
+
+### 2. Add a persistent volume that refers to the persistent storage
+
+These steps describe how to set up a persistent volume at the cluster level in Kubernetes.
+
+1. From the cluster view, select **Storage > Persistent Volumes**.
+
+1. Click **Add Volume**.
+
+1. Enter a **Name** for the persistent volume.
+
+1. Select the **Volume Plugin** for the disk type or service that you're using. When adding storage to a cluster that's hosted by a cloud provider, use the cloud provider's plug-in for cloud storage. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it, you must use the `Amazon EBS Disk` volume plugin.
+
+1. Enter the **Capacity** of your volume in gigabytes.
+
+1. Complete the **Plugin Configuration** form. Each plugin type requires information specific to the vendor of disk type. For help regarding each plugin's form and the information that's required, refer to the plug-in's vendor documentation.
+
+1. Optional: In the **Customize** form, configure the [access modes.](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) This options sets how many nodes can access the volume, along with the node read/write permissions. The [Kubernetes Documentation](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) includes a table that lists which access modes are supported by the plugins available.
+
+1. Optional: In the **Customize** form, configure the [mount options.](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#mount-options) Each volume plugin allows you to specify additional command line options during the mounting process. Consult each plugin's vendor documentation for the mount options available.
+
+1. Click **Save**.
+
+**Result:** Your new persistent volume is created.
+
+### 3. Add a persistent volume claim that refers to the persistent volume
+
+These steps describe how to set up a PVC in the namespace where your stateful workload will be deployed.
+
+1. Go to the project containing a workload that you want to add a persistent volume claim to.
+
+1. Then click the **Volumes** tab and click **Add Volume**. (In versions prior to v2.3.0, click **Workloads** on the main navigation bar, then **Volumes.**) 
+
+1. Enter a **Name** for the volume claim.
+
+1. Select the [Namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) of the workload that you want to add the persistent storage to.
+
+1. In the section called **Use an existing persistent volume,** go to the **Persistent Volume** drop-down and choose the persistent volume that you created.
+
+1. **Optional:** From **Customize**, select the [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) that you want to use.
+
+1. Click **Create.**
+
+**Result:** Your PVC is created. You can now attach it to any workload in the project.
+
+### 4. Mount the persistent volume claim as a volume in your workload
+
+Mount PVCs to stateful workloads so that your applications can store their data.
+
+You can mount PVCs during the deployment of a workload, or following workload creation.
+
+The following steps describe how to assign existing storage to a new workload that is a stateful set:
+
+1. From the **Project** view, go to the **Workloads** tab.
+1. Click **Deploy.**
+1. Enter a name for the workload.
+1. Next to the **Workload Type** field, click **More Options.**
+1. Click **Stateful set of 1 pod.** Optionally, configure the number of pods.
+1. Choose the namespace where the workload will be deployed.
+1. Expand the **Volumes** section and click **Add Volume > Use an existing persistent volume (claim).**.
+1. In the **Persistent Volume Claim** field, select the PVC that you created.
+1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
+1. Click **Launch.**
+
+**Result:** When the workload is deployed, it will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
+
+The following steps describe how to assign persistent storage to an existing workload:
+
+1. From the **Project** view, go to the **Workloads** tab.
+1. Go to the workload that you want to add the persistent storage to. The workload type should be a stateful set. Click **&#8942; > Edit.**
+1. Expand the **Volumes** section and click **Add Volume > Use an existing persistent volume (claim).**.
+1. In the **Persistent Volume Claim** field, select the PVC that you created.
+1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
+1. Click **Save.**
+
+**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md
new file mode 100644
index 00000000000..28f5a3dcebd
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md
@@ -0,0 +1,11 @@
+---
+title: Provisioning Storage Examples
+weight: 4
+---
+
+Rancher supports persistent storage with a variety of volume plugins. However, before you use any of these plugins to bind persistent storage to your workloads, you have to configure the storage itself, whether its a cloud-based solution from a service-provider or an on-prem solution that you manage yourself.
+
+For your convenience, Rancher offers documentation on how to configure some of the popular storage methods:
+
+- [NFS]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/examples/nfs/)
+- [vSphere]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/examples/vsphere/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md
new file mode 100644
index 00000000000..b854daf0ef4
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md
@@ -0,0 +1,16 @@
+---
+title: Creating Persistent Storage in Amazon's EBS
+weight: 3053
+---
+
+This section describes how to set up Amazon's Elastic Block Store in EC2.
+
+1. From the EC2 console, go to the **ELASTIC BLOCK STORE** section in the left panel and click **Volumes.**
+1. Click **Create Volume.**
+1. Optional: Configure the size of the volume or other options. The volume should be created in the same availability zone as the instance it will be attached to.
+1. Click **Create Volume.**
+1. Click **Close.**
+
+**Result:** Persistent storage has been created.
+
+For details on how to set up the newly created storage in Rancher, refer to the section on [setting up existing storage.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
new file mode 100644
index 00000000000..a9be8884a31
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
@@ -0,0 +1,68 @@
+---
+title: NFS Storage
+weight: 3054
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/adding-storage/provisioning-storage/nfs/
+---
+
+Before you can use the NFS storage volume plug-in with Rancher deployments, you need to provision an NFS server.
+
+>**Note:**
+>
+>- If you already have an NFS share, you don't need to provision a new NFS server to use the NFS volume plugin within Rancher. Instead, skip the rest of this procedure and complete [adding storage]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/).
+>
+>- This procedure demonstrates how to set up an NFS server using Ubuntu, although you should be able to use these instructions for other Linux distros (e.g. Debian, RHEL, Arch Linux, etc.). For official instruction on how to create an NFS server using another Linux distro, consult the distro's documentation.
+
+>**Recommended:** To simplify the process of managing firewall rules, use NFSv4.
+
+1. Using a remote Terminal connection, log into the Ubuntu server that you intend to use for NFS storage.
+
+1. Enter the following command:
+
+    ```
+    sudo apt-get install nfs-kernel-server
+    ```
+
+1. Enter the command below, which sets the directory used for storage, along with user access rights. Modify the command if you'd like to keep storage at a different directory.
+
+    ```
+    mkdir -p /nfs && chown nobody:nogroup /nfs
+    ```
+    - The `-p /nfs` parameter creates a directory named `nfs` at root.
+    - The `chown nobody:nogroup /nfs` parameter allows all access to the storage directory.
+
+1. Create an NFS exports table. This table sets the directory paths on your NFS server that are exposed to the nodes that will use the server for storage.
+
+    1. Open `/etc/exports` using your text editor of choice.
+    1. Add the path of the `/nfs` folder that you created in step 3, along with the IP addresses of your cluster nodes. Add an entry for each IP address in your cluster. Follow each address and its accompanying parameters with a single space that is a delimiter.
+
+        ```
+        /nfs <IP_ADDRESS1>(rw,sync,no_subtree_check) <IP_ADDRESS2>(rw,sync,no_subtree_check) <IP_ADDRESS3>(rw,sync,no_subtree_check)
+        ```
+
+        **Tip:**  You can replace the IP addresses with a subnet. For example: `10.212.50.12&#47;24`
+
+    1. Update the NFS table by entering the following command:
+
+        ```
+        exportfs -ra
+        ```
+
+1. Open the ports used by NFS.
+
+    1. To find out what ports NFS is using, enter the following command:
+
+        ```
+        rpcinfo -p | grep nfs
+        ```
+    2. [Open the ports](https://help.ubuntu.com/lts/serverguide/firewall.html.en) that the previous command outputs. For example, the following command opens port 2049:
+
+        ```
+        sudo ufw allow 2049
+        ```
+
+**Result:** Your NFS server is configured to be used for storage with your Rancher nodes.
+
+## What's Next?
+
+Within Rancher, add the NFS server as a [storage volume]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/#adding-a-persistent-volume) and/or [storage class]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/#adding-storage-classes). After adding the server, you can use it for storage for your deployments.
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
new file mode 100644
index 00000000000..0750143fe22
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
@@ -0,0 +1,70 @@
+---
+title: vSphere Storage
+weight: 3055
+aliases:
+  - /rancher/v2.x/en/tasks/clusters/adding-storage/provisioning-storage/vsphere/
+---
+
+To provide stateful workloads with vSphere storage, we recommend creating a vSphereVolume [storage class]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/#storage-classes). This practice dynamically provisions vSphere storage when workloads request volumes through a [persistent volume claim]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/persistent-volume-claims/).
+
+### Prerequisites
+
+In order to provision vSphere volumes in a cluster created with the [Rancher Kubernetes Engine (RKE)]({{< baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), the [vSphere cloud provider]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere) must be explicitly enabled in the [cluster options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/).
+
+### Creating A Storage Class
+
+> **Note:**
+>
+> The following steps can also be performed using the `kubectl` command line tool. See [Kubernetes documentation on persistent volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) for details.
+
+1. From the Global view, open the cluster where you want to provide vSphere storage.
+2. From the main menu, select **Storage > Storage Classes**. Then click **Add Class**.
+3. Enter a **Name** for the class.
+4. Under **Provisioner**, select **VMWare vSphere Volume**.
+
+    {{< img "/img/rancher/vsphere-storage-class.png" "vsphere-storage-class">}}
+
+5. Optionally, specify additional properties for this storage class under **Parameters**. Refer to the [vSphere storage documentation](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/storageclass.html) for details.
+5. Click **Save**.
+
+### Creating a Workload with a vSphere Volume
+
+1. From the cluster where you configured vSphere storage, begin creating a workload as you would in [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
+2. For **Workload Type**, select **Stateful set of 1 pod**.
+3. Expand the **Volumes** section and click **Add Volume**.
+4. Choose **Add a new persistent volume (claim)**. This option will implicitly create the claim once you deploy the workload.
+5. Assign a **Name** for the claim, ie. `test-volume` and select the vSphere storage class created in the previous step.
+6. Enter the required **Capacity** for the volume. Then click **Define**.
+
+    {{< img "/img/rancher/workload-add-volume.png" "workload-add-volume">}}
+
+7. Assign a path in the **Mount Point** field. This is the full path where the volume will be mounted in the container file system, e.g. `/persistent`.
+8. Click **Launch** to create the workload.
+
+### Verifying Persistence of the Volume
+
+1. From the context menu of the workload you just created, click **Execute Shell**.
+2. Note the directory at root where the volume has been mounted to (in this case `/persistent`).
+3. Create a file in the volume by executing the command `touch /<volumeMountPoint>/data.txt`.
+4. **Close** the shell window.
+5. Click on the name of the workload to reveal detail information.
+6. Open the context menu next to the Pod in the *Running* state.
+7. Delete the Pod by selecting **Delete**.
+8. Observe that the pod is deleted. Then a new pod is scheduled to replace it so that the workload maintains its configured scale of a single stateful pod.
+9. Once the replacement pod is running, click **Execute Shell**.
+10. Inspect the contents of the directory where the volume is mounted by entering `ls -l /<volumeMountPoint>`. Note that the file you created earlier is still present.
+
+    ![workload-persistent-data]({{<baseurl>}}/img/rancher/workload-persistent-data.png)
+
+## Why to Use StatefulSets Instead of Deployments
+
+You should always use [StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) for workloads consuming vSphere storage, as this resource type is designed to address a VMDK block storage caveat.
+
+Since vSphere volumes are backed by VMDK block storage, they only support an [access mode](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) of `ReadWriteOnce`. This setting restricts the volume so that it can only be mounted to a single pod at a time, unless all pods consuming that volume are co-located on the same node. This behavior makes a deployment resource unusable for scaling beyond a single replica if it consumes vSphere volumes.
+
+Even using a deployment resource with just a single replica may result in a deadlock situation while updating the deployment. If the updated pod is scheduled to a node different from where the existing pod lives, it will fail to start because the VMDK is still attached to the other node.
+
+## Related Links
+
+- [vSphere Storage for Kubernetes](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/)
+- [Kubernetes Persistent Volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md
new file mode 100644
index 00000000000..99e06766cf8
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md
@@ -0,0 +1,32 @@
+---
+title: GlusterFS Volumes
+weight: 5
+---
+
+> This section only applies to [RKE clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/)
+
+In clusters that store data on GlusterFS volumes, you may experience an issue where pods fail to mount volumes after restarting the `kubelet`. The logging of the `kubelet` will show: `transport endpoint is not connected`. To prevent this from happening, you can configure your cluster to mount the `systemd-run` binary in the `kubelet` container. There are two requirements before you can change the cluster configuration:
+
+- The node needs to have the `systemd-run` binary installed (this can be checked by using the command `which systemd-run` on each cluster node)
+- The `systemd-run` binary needs to be compatible with Debian OS on which the hyperkube image is based (this can be checked using the following command on each cluster node, replacing the image tag with the Kubernetes version you want to use)
+
+```
+docker run -v /usr/bin/systemd-run:/usr/bin/systemd-run --entrypoint /usr/bin/systemd-run rancher/hyperkube:v1.16.2-rancher1 --version
+```
+
+>**Note:**
+>
+>Before updating your Kubernetes YAML to mount the `systemd-run` binary, make sure the `systemd` package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
+
+```
+services:
+  kubelet:
+    extra_binds:
+      - "/usr/bin/systemd-run:/usr/bin/systemd-run"
+```
+
+After the cluster has finished provisioning, you can check the `kubelet` container logging to see if the functionality is activated by looking for the following logline:
+
+```
+Detected OS with systemd
+```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md
new file mode 100644
index 00000000000..6e257fa85c3
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md
@@ -0,0 +1,76 @@
+---
+title: How Persistent Storage Works
+weight: 1
+---
+
+A persistent volume (PV) is a piece of storage in the Kubernetes cluster, while a persistent volume claim (PVC) is a request for storage.
+
+There are two ways to use persistent storage in Kubernetes:
+
+- Use an existing persistent volume
+- Dynamically provision new persistent volumes
+
+To use an existing PV, your application will need to use a PVC that is bound to a PV, and the PV should include the minimum resources that the PVC requires.
+
+For dynamic storage provisioning, your application will need to use a PVC that is bound to a storage class. The storage class contains the authorization to provision new persistent volumes.
+
+![Setting Up New and Existing Persistent Storage]({{<baseurl>}}/img/rancher/rancher-storage.svg)
+
+For more information, refer to the [official Kubernetes documentation on storage](https://kubernetes.io/docs/concepts/storage/volumes/)
+
+This section covers the following topics:
+
+- [About persistent volume claims](#about-persistent-volume-claims)
+  - [PVCs are required for both new and existing persistent storage](#pvcs-are-required-for-both-new-and-existing-persistent-storage)
+- [Setting up existing storage with a PVC and PV](#setting-up-existing-storage-with-a-pvc-and-pv)
+ - [Binding PVs to PVCs](#binding-pvs-to-pvcs)
+- [Provisioning new storage with a PVC and storage class](#provisioning-new-storage-with-a-pvc-and-storage-class)
+
+# About Persistent Volume Claims
+
+Persistent volume claims (PVCs) are objects that request storage resources from your cluster. They're similar to a voucher that your deployment can redeem for storage access. A PVC is mounted into a workloads as a volume so that the workload can claim its specified share of the persistent storage.
+
+To access persistent storage, a pod must have a PVC mounted as a volume. This PVC lets your deployment application store its data in an external location, so that if a pod fails, it can be replaced with a new pod and continue accessing its data stored externally, as though an outage never occurred.
+
+Each Rancher project contains a list of PVCs that you've created, available from **Resources > Workloads > Volumes.** (In versions prior to v2.3.0, the PVCs are in the **Volumes** tab.) You can reuse these PVCs when creating deployments in the future.
+
+### PVCs are Required for Both New and Existing Persistent Storage
+
+A PVC is required for pods to use any persistent storage, regardless of whether the workload is intended to use storage that already exists, or the workload will need to dynamically provision new storage on demand.
+
+If you are setting up existing storage for a workload, the workload mounts a PVC, which refers to a PV, which corresponds to existing storage infrastructure.
+
+If a workload should request new storage, the workload mounts PVC, which refers to a storage class, which has the capability to create a new PV along with its underlying storage infrastructure.
+
+Rancher lets you create as many PVCs within a project as you'd like.
+
+You can mount PVCs to a deployment as you create it, or later, after the deployment is running.
+
+# Setting up Existing Storage with a PVC and PV
+
+Your pods can store data in [volumes,](https://kubernetes.io/docs/concepts/storage/volumes/) but if the pod fails, that data is lost. To solve this issue, Kubernetes offers persistent volumes (PVs), which are Kubernetes resources that correspond to external storage disks or file systems that your pods can access. If a pod crashes, its replacement pod can access the data in persistent storage without any data loss.
+
+PVs can represent a physical disk or file system that you host on premise, or a vendor-hosted storage resource, such as Amazon EBS or Azure Disk.
+
+Creating a persistent volume in Rancher will not create a storage volume. It only creates a Kubernetes resource that maps to an existing volume. Therefore, before you can create a persistent volume as a Kubernetes resource, you must have storage provisioned.
+
+> **Important:** PVs are created at the cluster level, which means that in a multi-tenant cluster, teams with access to separate namespaces could have access to the same PV.
+
+### Binding PVs to PVCs
+
+When pods are set up to use persistent storage, they mount a persistent volume claim (PVC) that is mounted the same way as any other Kubernetes volume. When each PVC is created, the Kubernetes master considers it to be a request for storage and binds it to a PV that matches the minimum resource requirements of the PVC. Not every PVC is guaranteed to be bound to a PV. According to the Kubernetes [documentation,](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
+
+> Claims will remain unbound indefinitely if a matching volume does not exist. Claims will be bound as matching volumes become available. For example, a cluster provisioned with many 50Gi PVs would not match a PVC requesting 100Gi. The PVC can be bound when a 100Gi PV is added to the cluster.
+
+In other words, you can create unlimited PVCs, but they will only be bound to PVs if the Kubernetes master can find a sufficient PVs that has at least the amount of disk space required by the PVC.
+
+To dynamically provision new storage, the PVC mounted in the pod would have to correspond to a storage class instead of a persistent volume.
+
+# Provisioning New Storage with a PVC and Storage Class
+
+Storage Classes allow you to create PVs dynamically without having to create persistent storage in an infrastructure provider first.
+
+For example, if a workload is bound to a PVC and the PVC refers to an Amazon EBS Storage Class, the storage class can dynamically create an EBS volume and a corresponding PV.
+
+The Kubernetes master will then bind the newly created PV to your workload's PVC, allowing your workload to use the persistent storage.
+
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md
new file mode 100644
index 00000000000..993e54c5c4a
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md
@@ -0,0 +1,30 @@
+---
+title:  iSCSI Volumes
+weight: 6
+---
+
+In [Rancher Launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) that store data on iSCSI volumes, you may experience an issue where kubelets fail to automatically connect with iSCSI volumes. This failure is likely due to an incompatibility issue involving the iSCSI initiator tool. You can resolve this issue by installing the iSCSI initiator tool on each of your cluster nodes.
+
+Rancher Launched Kubernetes clusters storing data on iSCSI volumes leverage the [iSCSI initiator tool](http://www.open-iscsi.com/), which is embedded in the kubelet's `rancher/hyperkube` Docker image. From each kubelet (i.e., the _initiator_), the tool discovers and launches sessions with an iSCSI volume (i.e., the _target_). However, in some instances, the versions of the iSCSI initiator tool installed on the initiator and the target may not match, resulting in a connection failure.
+
+If you encounter this issue, you can work around it by installing the initiator tool on each node in your cluster. You can install the iSCSI initiator tool by logging into your cluster nodes and entering one of the following commands:
+
+| Platform      | Package Name            | Install Command                        |
+| ------------- | ----------------------- | -------------------------------------- |
+| Ubuntu/Debian | `open-iscsi`            | `sudo apt install open-iscsi`          |
+| RHEL          | `iscsi-initiator-utils` | `yum install iscsi-initiator-utils -y` |
+
+
+After installing the initiator tool on your nodes, edit the YAML for your cluster, editing the kubelet configuration to mount the iSCSI binary and configuration, as shown in the sample below.
+
+>**Note:**
+>
+>Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
+
+```
+services:
+  kubelet:
+    extra_binds:
+      - "/etc/iscsi:/etc/iscsi"
+      - "/sbin/iscsiadm:/sbin/iscsiadm"
+```
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md
new file mode 100644
index 00000000000..50f33cce160
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md
@@ -0,0 +1,109 @@
+---
+title: Dynamically Provisioning New Storage in Rancher
+weight: 2
+---
+
+This section describes how to provision new persistent storage for workloads in Rancher.
+
+> This section assumes that you understand the Kubernetes concepts of storage classes and persistent volume claims. For more information, refer to the section on [how storage works.](../how-storage-works)
+
+To provision new storage for your workloads, follow these steps:
+
+1. [Add a storage class and configure it to use your storage provider.](#1-add-a-storage-class-and-configure-it-to-use-your-storage-provider)
+2. [Add a persistent volume claim that refers to the storage class.](#2-add-a-persistent-volume-claim-that-refers-to-the-storage-class)
+3. [Mount the persistent volume claim as a volume for your workload.](#3-mount-the-persistent-volume-claim-as-a-volume-for-your-workload)
+
+### Prerequisites
+
+- To set up persistent storage, the `Manage Volumes` [role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference) is required.
+- If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
+- The cloud provider must be enabled. For details on enabling cloud providers, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/)
+- Make sure your storage provisioner is available to be enabled.
+
+The following storage provisioners are enabled by default:
+
+Name | Plugin
+--------|----------
+Amazon EBS Disk | `aws-ebs`
+AzureFile | `azure-file`
+AzureDisk | `azure-disk`
+Google Persistent Disk | `gce-pd`
+Longhorn | `flex-volume-longhorn`
+VMware vSphere Volume |  `vsphere-volume`
+Local | `local`
+Network File System | `nfs`
+hostPath | `host-path`
+
+To use a storage provisioner that is not on the above list, you will need to use a [feature flag to enable unsupported storage drivers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers/)
+
+### 1. Add a storage class and configure it to use your storage provider
+
+These steps describe how to set up a storage class at the cluster level.
+
+1. Go to the cluster for which you want to dynamically provision persistent storage volumes.
+
+1. From the cluster view, select `Storage > Storage Classes`. Click `Add Class`.
+
+1. Enter a `Name` for your storage class.
+
+1. From the `Provisioner` drop-down, select the service that you want to use to dynamically provision storage volumes. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it, use the `Amazon EBS Disk` provisioner.
+
+1. From the `Parameters` section, fill out the information required for the service to dynamically provision storage volumes. Each provisioner requires different information to dynamically provision storage volumes. Consult the service's documentation for help on how to obtain this information.
+
+1. Click `Save`.
+
+**Result:** The storage class is available to be consumed by a PVC.
+
+For full information about the storage class parameters, refer to the official [Kubernetes documentation.](https://kubernetes.io/docs/concepts/storage/storage-classes/#parameters).
+
+### 2. Add a persistent volume claim that refers to the storage class
+
+These steps describe how to set up a PVC in the namespace where your stateful workload will be deployed.
+
+1. Go to the project containing a workload that you want to add a PVC to.
+
+1. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Then select the **Volumes** tab. Click **Add Volume**.
+
+1. Enter a **Name** for the volume claim.
+
+1. Select the [Namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) of the volume claim.
+
+1. In the **Source** field, click **Use a Storage Class to provision a new persistent volume.**
+
+1. Go to the **Storage Class** drop-down and select the storage class that you created.
+
+1. Enter a volume **Capacity**.
+
+1. Optional: Expand the **Customize** section and select the [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) that you want to use.
+
+1. Click **Create.**
+
+**Result:** Your PVC is created. You can now attach it to any workload in the project.
+
+### 3. Mount the persistent volume claim as a volume for your workload
+
+Mount PVCs to workloads so that your applications can store their data.
+
+You can mount PVCs during the deployment of a workload, or following workload creation.
+
+To attach the PVC to a new workload,
+
+1. Create a workload as you would in [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
+1. For **Workload Type**, select **Stateful set of 1 pod**.
+1. Expand the **Volumes** section and click **Add Volume > Add a New Persistent Volume (Claim).**
+1. In the **Persistent Volume Claim** section, select the newly created persistent volume claim that is attached to the storage class.
+1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
+1. Click **Launch.**
+
+**Result:** When the workload is deployed, it will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
+
+To attach the PVC to an existing workload,
+
+1. Go to the project that has the workload that will have the PVC attached.
+1. Go to the workload that will have persistent storage and click **&#8942; > Edit.**
+1. Expand the **Volumes** section and click **Add Volume > Add a New Persistent Volume (Claim).**
+1. In the **Persistent Volume Claim** section, select the newly created persistent volume claim that is attached to the storage class.
+1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
+1. Click **Save.**
+
+**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC. If not, Rancher will provision new persistent storage.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/_index.md
new file mode 100644
index 00000000000..648c628f352
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/_index.md
@@ -0,0 +1,79 @@
+---
+title: "Kubernetes Workloads and Pods"
+description: "Learn about the two constructs with which you can build any complex containerized application in Kubernetes: Kubernetes workloads and pods"
+weight: 7
+---
+
+You can build any complex containerized application in Kubernetes using two basic constructs: pods and workloads. Once you build an application, you can expose it for access either within the same cluster or on the Internet using a third construct: services.
+
+### Pods
+
+[_Pods_](https://kubernetes.io/docs/concepts/workloads/pods/pod-overview/) are one or more containers that share network namespaces and storage volumes. Most pods have only one container. Therefore when we discuss _pods_, the term is often synonymous with _containers_. You scale pods the same way you scale containers—by having multiple instances of the same pod that implement a service. Usually pods get scaled and managed by the workload.
+
+### Workloads
+
+_Workloads_ are objects that set deployment rules for pods. Based on these rules, Kubernetes performs the deployment and updates the workload with the current state of the application.
+Workloads let you define the rules for application scheduling, scaling, and upgrade.
+
+#### Workload Types
+
+Kubernetes divides workloads into different types. The most popular types supported by Kubernetes are:
+
+- [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
+
+    _Deployments_ are best used for stateless applications (i.e., when you don't have to maintain the workload's state). Pods managed by deployment workloads are treated as independent and disposable. If a pod encounters disruption, Kubernetes removes it and then recreates it. An example application would be an Nginx web server.
+
+- [StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/)
+
+    _StatefulSets_, in contrast to deployments, are best used when your application needs to maintain its identity and store data. An application would be something like Zookeeper—an application that requires a database for storage.
+
+- [DaemonSets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/)
+
+    _Daemonsets_ ensures that every node in the cluster runs a copy of pod. For use cases where you're collecting logs or monitoring node performance, this daemon-like workload works best.
+
+- [Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/)
+
+    _Jobs_ launch one or more pods and ensure that a specified number of them successfully terminate. Jobs are best used to run a finite task to completion as opposed to managing an ongoing desired application state.
+
+- [CronJobs](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/)
+
+    _CronJobs_ are similar to jobs. CronJobs, however, runs to completion on a cron-based schedule.
+
+### Services
+
+In many use cases, a workload has to be either:
+
+- Accessed by other workloads in the cluster.
+- Exposed to the outside world.
+
+You can achieve these goals by creating a _Service_. Services are mapped to the underlying workload's pods using a [selector/label approach (view the code samples)](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#service-and-replicationcontroller). Rancher UI simplifies this mapping process by automatically creating a service along with the workload, using the service port and type that you select.
+
+#### Service Types
+
+There are several types of services available in Rancher. The descriptions below are sourced from the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types).
+
+- **ClusterIP**
+
+    >Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. This is the default `ServiceType`.
+
+- **NodePort**
+
+    >Exposes the service on each Node’s IP at a static port (the `NodePort`). A `ClusterIP` service, to which the `NodePort` service will route, is automatically created. You’ll be able to contact the `NodePort` service, from outside the cluster, by requesting `<NodeIP>:<NodePort>`.
+
+- **LoadBalancer**
+
+    >Exposes the service externally using a cloud provider’s load balancer. `NodePort` and `ClusterIP` services, to which the external load balancer will route, are automatically created.
+
+## Workload Options
+
+This section of the documentation contains instructions for deploying workloads and using workload options.
+
+- [Deploy Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/)
+- [Upgrade Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/upgrade-workloads/)
+- [Rollback Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/rollback-workloads/)
+
+## Related Links
+
+### External Links
+
+- [Services](https://kubernetes.io/docs/concepts/services-networking/service/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md
new file mode 100644
index 00000000000..2b111ad691c
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md
@@ -0,0 +1,35 @@
+---
+title: Adding a Sidecar
+weight: 4
+---
+A _sidecar_ is a container that extends or enhances the main container in a pod. The main container and the sidecar share a pod, and therefore share the same network space and storage. You can add sidecars to existing workloads by using the **Add a Sidecar** option.
+
+1. From the **Global** view, open the project running the workload you want to add a sidecar to.
+
+1. Click **Resources > Workloads.** In versions prior to v2.3.0, select the **Workloads** tab.
+
+1. Find the workload that you want to extend. Select **&#8942; icon (...) > Add a Sidecar**.
+
+1. Enter a **Name** for the sidecar.
+
+1. Select a **Sidecar Type**. This option determines if the sidecar container is deployed before or after the main container is deployed.
+
+    - **Standard Container:**
+
+        The sidecar container is deployed after the main container.
+
+    - **Init Container:**
+
+        The sidecar container is deployed before the main container.
+
+1. From the **Docker Image** field, enter the name of the Docker image that you want to deploy in support of the main container. During deployment, Rancher pulls this image from [Docker Hub](https://hub.docker.com/explore/). Enter the name exactly as it appears on Docker Hub.
+
+1. Set the remaining options. You can read about them in [Deploying Workloads](../deploy-workloads).
+
+1. Click **Launch**.
+
+**Result:** The sidecar is deployed according to your parameters. Following its deployment, you can view the sidecar by selecting **&#8942; icon (...) > Edit** for the main deployment.
+
+## Related Links
+
+- [The Distributed System ToolKit: Patterns for Composite Containers](https://kubernetes.io/blog/2015/06/the-distributed-system-toolkit-patterns/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md
new file mode 100644
index 00000000000..5c0ff40810b
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md
@@ -0,0 +1,57 @@
+---
+title: Deploying Workloads
+description: Read this step by step guide for deploying workloads. Deploy a workload to run an application in one or more containers.
+weight: 1
+---
+
+Deploy a workload to run an application in one or more containers.
+
+1. From the **Global** view, open the project that you want to deploy a workload to.
+
+1. 1. Click **Resources > Workloads.** (In versions prior to v2.3.0, click the **Workloads** tab.) From the **Workloads** view, click **Deploy**.
+
+1. Enter a **Name** for the workload.
+
+1. Select a [workload type]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, by can change the workload type by clicking **More options.**
+
+1. From the **Docker Image** field, enter the name of the Docker image that you want to deploy to the project, optionally prefacing it with the registry host (e.g. `quay.io`, `registry.gitlab.com`, etc.). During deployment, Rancher pulls this image from the specified public or private registry. If no registry host is provided, Rancher will pull the image from [Docker Hub](https://hub.docker.com/explore/). Enter the name exactly as it appears in the registry server, including any required path, and optionally including the desired tag (e.g. `registry.gitlab.com/user/path/image:tag`). If no tag is provided, the `latest` tag will be automatically used.
+
+1. Either select an existing [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces), or click **Add to a new namespace** and enter a new namespace.
+
+1. Click **Add Port** to enter a port mapping, which enables access to the application inside and outside of the cluster . For more information, see [Services]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/#services).
+
+1. Configure the remaining options:
+
+    - **Environment Variables**
+
+        Use this section to either specify environment variables for your workload to consume on the fly, or to pull them from another source, such as a secret or [ConfigMap]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/).
+
+    - **Node Scheduling**
+    - **Health Check**
+    - **Volumes**
+
+        Use this section to add storage for your workload. You can manually specify the volume that you want to add, use a persistent volume claim to dynamically create a volume for the workload, or read data for a volume to use from a file such as a [ConfigMap]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/).
+
+        When you are deploying a Stateful Set, you should use a Volume Claim Template when using Persistent Volumes. This will ensure that Persistent Volumes are created dynamically when you scale your Stateful Set. This option is available in the UI as of Rancher v2.2.0.
+
+    - **Scaling/Upgrade Policy**
+
+        >**Amazon Note for Volumes:**
+        >
+        > To mount an Amazon EBS volume:
+        >
+        >- In [Amazon AWS](https://aws.amazon.com/), the nodes must be in the same Availability Zone and possess IAM permissions to attach/unattach volumes.
+        >
+        >- The cluster must be using the [AWS cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws) option. For more information on enabling this option see [Creating an Amazon EC2 Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) or [Creating a Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes).
+
+
+1. Click **Show Advanced Options** and configure:
+
+    - **Command**
+    - **Networking**
+    - **Labels & Annotations**
+    - **Security and Host Config**
+
+1. Click **Launch**.
+
+**Result:** The workload is deployed to the chosen namespace. You can view the workload's status from the project's **Workloads** view.
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md
new file mode 100644
index 00000000000..4a1ecdd03e4
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md
@@ -0,0 +1,35 @@
+---
+title: The Horizontal Pod Autoscaler
+description: Learn about the horizontal pod autoscaler (HPA). How to manage HPAs and how to test them with a service deployment
+weight: 5
+---
+
+The [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) (HPA) is a Kubernetes feature that allows you to configure your cluster to automatically scale the services it's running up or down.
+
+Rancher provides some additional features to help manage HPAs, depending on the version of Rancher. 
+
+You can create, manage, and delete HPAs using the Rancher UI in Rancher v2.3.0-alpha4 and higher versions. It only supports HPA in the `autoscaling/v2beta2` API.
+
+## Managing HPAs
+
+The way that you manage HPAs is different based on your version of the Kubernetes API:
+
+- **For Kubernetes API version autoscaling/V2beta1:** This version of the Kubernetes API lets you autoscale your pods based on the CPU and memory utilization of your application.
+- **For Kubernetes API Version autoscaling/V2beta2:** This version of the Kubernetes API lets you autoscale your pods based on CPU and memory utilization, in addition to custom metrics.
+
+HPAs are also managed differently based on your version of Rancher:
+
+- **For Rancher v2.3.0+**: You can create, manage, and delete HPAs using the Rancher UI. From the Rancher UI you can configure the HPA to scale based on CPU and memory utilization. For more information, refer to [Managing HPAs with the Rancher UI]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui). To scale the HPA based on custom metrics, you still need to use `kubectl`. For more information, refer to [Configuring HPA to Scale Using Custom Metrics with Prometheus]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/#configuring-hpa-to-scale-using-custom-metrics-with-prometheus).
+- **For Rancher Prior to v2.3.0:** To manage and configure HPAs, you need to use `kubectl`. For instructions on how to create, manage, and scale HPAs, refer to [Managing HPAs with kubectl]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl).
+
+You might have additional HPA installation steps if you are using an older version of Rancher:
+
+- **For Rancher v2.0.7+:** Clusters created in Rancher v2.0.7 and higher automatically have all the requirements needed (metrics-server and Kubernetes cluster configuration) to use HPA.
+- **For Rancher Prior to v2.0.7:** Clusters created in Rancher prior to v2.0.7 don't automatically have the requirements needed to use HPA. For instructions on installing HPA for these clusters, refer to [Manual HPA Installation for Clusters Created Before Rancher v2.0.7]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7).
+
+## Testing HPAs with a Service Deployment
+
+In Rancher v2.3.x+, you can see your HPA's current number of replicas by going to your project and clicking **Resources > HPA.** For more information, refer to [Get HPA Metrics and Status]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/).
+
+You can also use `kubectl` to get the status of HPAs that you test with your load testing tool. For more information, refer to [Testing HPAs with kubectl]
+({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/testing-hpa/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md
new file mode 100644
index 00000000000..d1789809370
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md
@@ -0,0 +1,40 @@
+---
+title: Background Information on HPAs
+weight: 1
+---
+
+The [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) (HPA) is a Kubernetes feature that allows you to configure your cluster to automatically scale the services it's running up or down. This section provides explanation on how HPA works with Kubernetes.
+
+## Why Use Horizontal Pod Autoscaler?
+
+Using HPA, you can automatically scale the number of pods within a replication controller, deployment, or replica set up or down. HPA automatically scales the number of pods that are running for maximum efficiency. Factors that affect the number of pods include:
+
+- A minimum and maximum number of pods allowed to run, as defined by the user.
+- Observed CPU/memory use, as reported in resource metrics.
+- Custom metrics provided by third-party metrics application like Prometheus, Datadog, etc.
+
+HPA improves your services by:
+
+- Releasing hardware resources that would otherwise be wasted by an excessive number of pods.
+- Increase/decrease performance as needed to accomplish service level agreements.
+
+## How HPA Works
+
+![HPA Schema]({{<baseurl>}}/img/rancher/horizontal-pod-autoscaler.jpg)
+
+HPA is implemented as a control loop, with a period controlled by the `kube-controller-manager` flags below:
+
+Flag | Default | Description |
+---------|----------|----------|
+ `--horizontal-pod-autoscaler-sync-period` | `30s` | How often HPA audits resource/custom metrics in a deployment.
+ `--horizontal-pod-autoscaler-downscale-delay` | `5m0s` | Following completion of a downscale operation, how long HPA must wait before launching another downscale operations.
+ `--horizontal-pod-autoscaler-upscale-delay` | `3m0s` | Following completion of an upscale operation, how long HPA must wait before launching another upscale operation.
+
+
+For full documentation on HPA, refer to the [Kubernetes Documentation](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/).
+
+## Horizontal Pod Autoscaler API Objects
+
+HPA is an API resource in the Kubernetes `autoscaling` API group. The current stable version is `autoscaling/v1`, which only includes support for CPU autoscaling. To get additional support for scaling based on memory and custom metrics, use the beta version instead: `autoscaling/v2beta1`.
+
+For more information about the HPA API object, see the [HPA GitHub Readme](https://git.k8s.io/community/contributors/design-proposals/autoscaling/horizontal-pod-autoscaler.md#horizontalpodautoscaler-object).
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
new file mode 100644
index 00000000000..f0df125ee88
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
@@ -0,0 +1,200 @@
+---
+title: Managing HPAs with kubectl
+weight: 3
+---
+
+This section describes HPA management with `kubectl`. This document has instructions for how to:
+
+- Create an HPA
+- Get information on HPAs
+- Delete an HPA
+- Configure your HPAs to scale with CPU or memory utilization
+- Configure your HPAs to scale using custom metrics, if you use a third-party tool such as Prometheus for metrics
+
+### Note For Rancher v2.3.x
+
+In Rancher v2.3.x, you can create, view, and delete HPAs from the Rancher UI. You can also configure them to scale based on CPU or memory usage from the Rancher UI. For more information, refer to [Managing HPAs with the Rancher UI]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui). For scaling HPAs based on other metrics than CPU or memory, you still need `kubectl`.
+
+### Note For Rancher Prior to v2.0.7
+
+Clusters created with older versions of Rancher don't automatically have all the requirements to create an HPA. To install an HPA on these clusters, refer to [Manual HPA Installation for Clusters Created Before Rancher v2.0.7]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7).
+
+##### Basic kubectl Command for Managing HPAs
+
+If you have an HPA manifest file, you can create, manage, and delete HPAs using `kubectl`:
+
+- Creating HPA
+
+  - With manifest: `kubectl create -f <HPA_MANIFEST>`
+
+  - Without manifest (Just support CPU): `kubectl autoscale deployment hello-world --min=2 --max=5 --cpu-percent=50`
+
+- Getting HPA info
+
+  - Basic: `kubectl get hpa hello-world`
+
+  - Detailed description: `kubectl describe hpa hello-world`
+
+- Deleting HPA
+
+  - `kubectl delete hpa hello-world`
+
+##### HPA Manifest Definition Example
+
+The HPA manifest is the config file used for managing an HPA with `kubectl`.
+
+The following snippet demonstrates use of different directives in an HPA manifest. See the list below the sample to understand the purpose of each directive.
+
+```yml
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: hello-world
+spec:
+  scaleTargetRef:
+    apiVersion: extensions/v1beta1
+    kind: Deployment
+    name: hello-world
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      targetAverageUtilization: 50
+  - type: Resource
+    resource:
+      name: memory
+      targetAverageValue: 100Mi
+```
+
+
+Directive | Description  
+---------|----------|
+ `apiVersion: autoscaling/v2beta1` | The version of the Kubernetes `autoscaling` API group in use. This example manifest uses the beta version, so scaling by CPU and memory is enabled. |
+ `name: hello-world` | Indicates that HPA is performing autoscaling for the `hello-word` deployment. |
+ `minReplicas: 1` | Indicates that the minimum number of replicas running can't go below 1. |
+ `maxReplicas: 10`  | Indicates the maximum number of replicas in the deployment can't go above 10.
+ `targetAverageUtilization: 50` |  Indicates the deployment will scale pods up when the average running pod uses more than 50% of its requested CPU.
+ `targetAverageValue: 100Mi`  |  Indicates the deployment will scale pods up when the average running pod uses more that 100Mi of memory.
+<br/>
+
+##### Configuring HPA to Scale Using Resource Metrics (CPU and Memory)
+
+Clusters created in Rancher v2.0.7 and higher have all the requirements needed (metrics-server and Kubernetes cluster configuration) to use Horizontal Pod Autoscaler. Run the following commands to check if metrics are available in your installation:
+
+```
+$ kubectl top nodes
+NAME                              CPU(cores)   CPU%      MEMORY(bytes)   MEMORY%
+node-controlplane   196m         9%        1623Mi          42%
+node-etcd           80m          4%        1090Mi          28%
+node-worker         64m          3%        1146Mi          29%
+$ kubectl -n kube-system top pods
+NAME                                   CPU(cores)   MEMORY(bytes)
+canal-pgldr                            18m          46Mi
+canal-vhkgr                            20m          45Mi
+canal-x5q5v                            17m          37Mi
+canal-xknnz                            20m          37Mi
+kube-dns-7588d5b5f5-298j2              0m           22Mi
+kube-dns-autoscaler-5db9bbb766-t24hw   0m           5Mi
+metrics-server-97bc649d5-jxrlt         0m           12Mi
+$ kubectl -n kube-system logs -l k8s-app=metrics-server
+I1002 12:55:32.172841       1 heapster.go:71] /metrics-server --source=kubernetes.summary_api:https://kubernetes.default.svc?kubeletHttps=true&kubeletPort=10250&useServiceAccount=true&insecure=true
+I1002 12:55:32.172994       1 heapster.go:72] Metrics Server version v0.2.1
+I1002 12:55:32.173378       1 configs.go:61] Using Kubernetes client with master "https://kubernetes.default.svc" and version
+I1002 12:55:32.173401       1 configs.go:62] Using kubelet port 10250
+I1002 12:55:32.173946       1 heapster.go:128] Starting with Metric Sink
+I1002 12:55:32.592703       1 serving.go:308] Generated self-signed cert (apiserver.local.config/certificates/apiserver.crt, apiserver.local.config/certificates/apiserver.key)
+I1002 12:55:32.925630       1 heapster.go:101] Starting Heapster API server...
+[restful] 2018/10/02 12:55:32 log.go:33: [restful/swagger] listing is available at https:///swaggerapi
+[restful] 2018/10/02 12:55:32 log.go:33: [restful/swagger] https:///swaggerui/ is mapped to folder /swagger-ui/
+I1002 12:55:32.928597       1 serve.go:85] Serving securely on 0.0.0.0:443
+```
+
+If you have created your cluster in Rancher v2.0.6 or before, please refer to [Manual installation](#manual-installation)
+
+##### Configuring HPA to Scale Using Custom Metrics with Prometheus
+
+You can configure HPA to autoscale based on custom metrics provided by third-party software. The most common use case for autoscaling using third-party software is based on application-level metrics (i.e., HTTP requests per second). HPA uses the `custom.metrics.k8s.io` API to consume these metrics. This API is enabled by deploying a custom metrics adapter for the metrics collection solution.
+
+For this example, we are going to use [Prometheus](https://prometheus.io/). We are beginning with the following assumptions:
+
+- Prometheus is deployed in the cluster.
+- Prometheus is configured correctly and collecting proper metrics from pods, nodes, namespaces, etc.
+- Prometheus is exposed at the following URL and port: `http://prometheus.mycompany.io:80`
+
+Prometheus is available for deployment in the Rancher v2.0 catalog. Deploy it from Rancher catalog if it isn't already running in your cluster.
+
+For HPA to use custom metrics from Prometheus, package [k8s-prometheus-adapter](https://github.com/DirectXMan12/k8s-prometheus-adapter) is required in the `kube-system` namespace of your cluster. To install `k8s-prometheus-adapter`, we are using the Helm chart available at [banzai-charts](https://github.com/banzaicloud/banzai-charts).
+
+1. Initialize Helm in your cluster.
+  ```
+  # kubectl -n kube-system create serviceaccount tiller
+  kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller
+  helm init --service-account tiller
+  ```
+
+1. Clone the `banzai-charts` repo from GitHub:
+  ```
+  # git clone https://github.com/banzaicloud/banzai-charts
+  ```
+
+1. Install the `prometheus-adapter` chart, specifying the Prometheus URL and port number.
+  ```
+  # helm install --name prometheus-adapter banzai-charts/prometheus-adapter --set prometheus.url="http://prometheus.mycompany.io",prometheus.port="80" --namespace kube-system
+  ```
+
+1. Check that `prometheus-adapter` is running properly. Check the service pod and logs in the `kube-system` namespace.
+
+  1. Check that the service pod is `Running`. Enter the following command.
+    ```
+    # kubectl get pods -n kube-system
+    ```
+    From the resulting output, look for a status of `Running`.
+    ```
+    NAME                                  READY     STATUS    RESTARTS   AGE
+    ...
+    prometheus-adapter-prometheus-adapter-568674d97f-hbzfx   1/1       Running   0          7h
+    ...
+    ```
+  1. Check the service logs to make sure the service is running correctly by entering the command that follows.
+    ```
+    # kubectl logs prometheus-adapter-prometheus-adapter-568674d97f-hbzfx -n kube-system
+    ```
+    Then review the log output to confirm the service is running.
+    {{% accordion id="prometheus-logs" label="Prometheus Adaptor Logs" %}}
+    ...
+    I0724 10:18:45.696679       1 round_trippers.go:436] GET https://10.43.0.1:443/api/v1/namespaces/default/pods?labelSelector=app%3Dhello-world 200 OK in 2 milliseconds
+    I0724 10:18:45.696695       1 round_trippers.go:442] Response Headers:
+    I0724 10:18:45.696699       1 round_trippers.go:445]     Date: Tue, 24 Jul 2018 10:18:45 GMT
+    I0724 10:18:45.696703       1 round_trippers.go:445]     Content-Type: application/json
+    I0724 10:18:45.696706       1 round_trippers.go:445]     Content-Length: 2581
+    I0724 10:18:45.696766       1 request.go:836] Response Body: {"kind":"PodList","apiVersion":"v1","metadata":{"selfLink":"/api/v1/namespaces/default/pods","resourceVersion":"6237"},"items":[{"metadata":{"name":"hello-world-54764dfbf8-q6l82","generateName":"hello-world-54764dfbf8-","namespace":"default","selfLink":"/api/v1/namespaces/default/pods/hello-world-54764dfbf8-q6l82","uid":"484cb929-8f29-11e8-99d2-067cac34e79c","resourceVersion":"4066","creationTimestamp":"2018-07-24T10:06:50Z","labels":{"app":"hello-world","pod-template-hash":"1032089694"},"annotations":{"cni.projectcalico.org/podIP":"10.42.0.7/32"},"ownerReferences":[{"apiVersion":"extensions/v1beta1","kind":"ReplicaSet","name":"hello-world-54764dfbf8","uid":"4849b9b1-8f29-11e8-99d2-067cac34e79c","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"default-token-ncvts","secret":{"secretName":"default-token-ncvts","defaultMode":420}}],"containers":[{"name":"hello-world","image":"rancher/hello-world","ports":[{"containerPort":80,"protocol":"TCP"}],"resources":{"requests":{"cpu":"500m","memory":"64Mi"}},"volumeMounts":[{"name":"default-token-ncvts","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"Always"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"default","serviceAccount":"default","nodeName":"34.220.18.140","securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute","tolerationSeconds":300},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute","tolerationSeconds":300}]},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2018-07-24T10:06:50Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2018-07-24T10:06:54Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2018-07-24T10:06:50Z"}],"hostIP":"34.220.18.140","podIP":"10.42.0.7","startTime":"2018-07-24T10:06:50Z","containerStatuses":[{"name":"hello-world","state":{"running":{"startedAt":"2018-07-24T10:06:54Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"rancher/hello-world:latest","imageID":"docker-pullable://rancher/hello-world@sha256:4b1559cb4b57ca36fa2b313a3c7dde774801aa3a2047930d94e11a45168bc053","containerID":"docker://cce4df5fc0408f03d4adf82c90de222f64c302bf7a04be1c82d584ec31530773"}],"qosClass":"Burstable"}}]}
+    I0724 10:18:45.699525       1 api.go:74] GET http://prometheus-server.prometheus.34.220.18.140.xip.io/api/v1/query?query=sum%28rate%28container_fs_read_seconds_total%7Bpod_name%3D%22hello-world-54764dfbf8-q6l82%22%2Ccontainer_name%21%3D%22POD%22%2Cnamespace%3D%22default%22%7D%5B5m%5D%29%29+by+%28pod_name%29&time=1532427525.697 200 OK
+    I0724 10:18:45.699620       1 api.go:93] Response Body: {"status":"success","data":{"resultType":"vector","result":[{"metric":{"pod_name":"hello-world-54764dfbf8-q6l82"},"value":[1532427525.697,"0"]}]}}
+    I0724 10:18:45.699939       1 wrap.go:42] GET /apis/custom.metrics.k8s.io/v1beta1/namespaces/default/pods/%2A/fs_read?labelSelector=app%3Dhello-world: (12.431262ms) 200 [[kube-controller-manager/v1.10.1 (linux/amd64) kubernetes/d4ab475/system:serviceaccount:kube-system:horizontal-pod-autoscaler] 10.42.0.0:24268]
+    I0724 10:18:51.727845       1 request.go:836] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/","verb":"get"},"user":"system:anonymous","group":["system:unauthenticated"]},"status":{"allowed":false}}
+    ...
+    {{% /accordion %}}
+
+
+
+1. Check that the metrics API is accessible from kubectl.
+
+  - If you are accessing the cluster directly, enter your Server URL in the kubectl config in the following format: `https://<Kubernetes_URL>:6443`.
+    ```
+    # kubectl get --raw /apis/custom.metrics.k8s.io/v1beta1
+    ```
+    If the API is accessible, you should receive output that's similar to what follows.
+    {{% accordion id="custom-metrics-api-response" label="API Response" %}}
+    {"kind":"APIResourceList","apiVersion":"v1","groupVersion":"custom.metrics.k8s.io/v1beta1","resources":[{"name":"pods/fs_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_rss","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_period","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_read","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_user","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/last_seen","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/tasks_state","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_quota","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/start_time_seconds","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_write","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_cache","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_working_set_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_udp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes_free","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time_weighted","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failures","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_swap","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_shares","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_swap_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_current","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failcnt","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_tcp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_max_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_reservation_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_load_average_10s","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_system","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]}]}
+    {{% /accordion %}}
+
+  - If you are accessing the cluster through Rancher, enter your Server URL in the kubectl config in the following format: `https://<RANCHER_URL>/k8s/clusters/<CLUSTER_ID>`. Add the suffix `/k8s/clusters/<CLUSTER_ID>` to API path.
+    ```
+    # kubectl get --raw /k8s/clusters/<CLUSTER_ID>/apis/custom.metrics.k8s.io/v1beta1
+    ```
+    If the API is accessible, you should receive output that's similar to what follows.
+    {{% accordion id="custom-metrics-api-response-rancher" label="API Response" %}}
+    {"kind":"APIResourceList","apiVersion":"v1","groupVersion":"custom.metrics.k8s.io/v1beta1","resources":[{"name":"pods/fs_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_rss","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_period","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_read","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_user","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/last_seen","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/tasks_state","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_quota","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/start_time_seconds","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_write","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_cache","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_working_set_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_udp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes_free","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time_weighted","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failures","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_swap","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_shares","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_swap_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_current","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failcnt","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_tcp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_max_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_reservation_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_load_average_10s","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_system","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]}]}
+    {{% /accordion %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
new file mode 100644
index 00000000000..19350a61f37
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
@@ -0,0 +1,55 @@
+---
+title: Managing HPAs with the Rancher UI
+weight: 2
+---
+
+_Available as of v2.3.0_
+
+The Rancher UI supports creating, managing, and deleting HPAs. You can configure CPU or memory usage as the metric that the HPA uses to scale.
+
+If you want to create HPAs that scale based on other metrics than CPU and memory, refer to [Configuring HPA to Scale Using Custom Metrics with Prometheus]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/#configuring-hpa-to-scale-using-custom-metrics-with-prometheus).
+
+## Creating an HPA
+
+1. From the **Global** view, open the project that you want to deploy a HPA to.
+
+1. Click **Resources > HPA.**
+
+1. Click **Add HPA.**
+
+1. Enter a **Name** for the HPA.
+
+1. Select a **Namespace** for the HPA.
+
+1. Select a **Deployment** as scale target for the HPA.
+
+1. Specify the **Minimum Scale** and **Maximum Scale** for the HPA.
+
+1. Configure the metrics for the HPA. You can choose memory or CPU usage as the metric that will cause the HPA to scale the service up or down. In the **Quantity** field, enter the percentage of the workload's memory or CPU usage that will cause the HPA to scale the service. To configure other HPA metrics, including metrics available from Prometheus, you need to [manage HPAs using kubectl]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/#configuring-hpa-to-scale-using-custom-metrics-with-prometheus).
+
+1. Click **Create** to create the HPA.
+
+> **Result:** The HPA is deployed to the chosen namespace. You can view the HPA's status from the project's Resources > HPA view.
+
+## Get HPA Metrics and Status
+
+1. From the **Global** view, open the project with the HPAs you want to look at.
+
+1. Click **Resources > HPA.** The **HPA** tab shows the number of current replicas.
+
+1. For more detailed metrics and status of a specific HPA, click the name of the HPA. This leads to the HPA detail page.
+
+
+## Deleting an HPA
+
+1. From the **Global** view, open the project that you want to delete an HPA from.
+
+1. Click **Resources > HPA.**
+
+1. Find the HPA which you would like to delete.
+
+1. Click **&#8942; > Delete**.
+
+1. Click **Delete** to confirm.
+
+> **Result:** The HPA is deleted from the current cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md
new file mode 100644
index 00000000000..09e689fcfa1
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md
@@ -0,0 +1,491 @@
+---
+title: Testing HPAs with kubectl
+weight: 4
+---
+
+This document describes how to check the status of your HPAs after scaling them up or down with your load testing tool. For information on how to check the status from the Rancher UI (at least version 2.3.x), refer to [Managing HPAs with the Rancher UI]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/).
+
+For HPA to work correctly, service deployments should have resources request definitions for containers. Follow this hello-world example to test if HPA is working correctly.
+
+1. Configure `kubectl` to connect to your Kubernetes cluster.
+
+2. Copy the `hello-world` deployment manifest below.
+{{% accordion id="hello-world" label="Hello World Manifest" %}}
+```
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  labels:
+    app: hello-world
+  name: hello-world
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hello-world
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: hello-world
+    spec:
+      containers:
+      - image: rancher/hello-world
+        imagePullPolicy: Always
+        name: hello-world
+        resources:
+          requests:
+            cpu: 500m
+            memory: 64Mi
+        ports:
+        - containerPort: 80
+          protocol: TCP
+      restartPolicy: Always
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hello-world
+  namespace: default
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 80
+  selector:
+    app: hello-world
+```
+{{% /accordion %}}
+
+1. Deploy it to your cluster.
+
+    ```
+    # kubectl create -f <HELLO_WORLD_MANIFEST>
+    ```
+
+1. Copy one of the HPAs below based on the metric type you're using:
+{{% accordion id="service-deployment-resource-metrics" label="Hello World HPA: Resource Metrics" %}}
+```
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: hello-world
+  namespace: default
+spec:
+  scaleTargetRef:
+    apiVersion: extensions/v1beta1
+    kind: Deployment
+    name: hello-world
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      targetAverageUtilization: 50
+  - type: Resource
+    resource:
+      name: memory
+      targetAverageValue: 1000Mi
+```
+{{% /accordion %}}
+{{% accordion id="service-deployment-custom-metrics" label="Hello World HPA: Custom Metrics" %}}
+```
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: hello-world
+  namespace: default
+spec:
+  scaleTargetRef:
+    apiVersion: extensions/v1beta1
+    kind: Deployment
+    name: hello-world
+  minReplicas: 1
+  maxReplicas: 10
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      targetAverageUtilization: 50
+  - type: Resource
+    resource:
+      name: memory
+      targetAverageValue: 100Mi
+  - type: Pods
+    pods:
+      metricName: cpu_system
+      targetAverageValue: 20m
+```
+{{% /accordion %}}
+
+1. View the HPA info and description. Confirm that metric data is shown.
+    {{% accordion id="hpa-info-resource-metrics" label="Resource Metrics" %}}
+1. Enter the following commands.
+    ```
+    # kubectl get hpa
+    NAME          REFERENCE                TARGETS                     MINPODS   MAXPODS   REPLICAS   AGE
+    hello-world   Deployment/hello-world   1253376 / 100Mi, 0% / 50%   1         10        1          6m
+    # kubectl describe hpa
+    Name:                                                  hello-world
+    Namespace:                                             default
+    Labels:                                                <none>
+    Annotations:                                           <none>
+    CreationTimestamp:                                     Mon, 23 Jul 2018 20:21:16 +0200
+    Reference:                                             Deployment/hello-world
+    Metrics:                                               ( current / target )
+      resource memory on pods:                             1253376 / 100Mi
+      resource cpu on pods  (as a percentage of request):  0% (0) / 50%
+    Min replicas:                                          1
+    Max replicas:                                          10
+    Conditions:
+      Type            Status  Reason              Message
+      ----            ------  ------              -------
+      AbleToScale     True    ReadyForNewScale    the last scale time was sufficiently old as to warrant a new scale
+      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
+      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+    Events:           <none>
+    ```
+    {{% /accordion %}}
+    {{% accordion id="hpa-info-custom-metrics" label="Custom Metrics" %}}
+1. Enter the following command.
+    ```
+    # kubectl describe hpa
+    ```
+    You should receive the output that follows.
+    ```
+    Name:                                                  hello-world
+    Namespace:                                             default
+    Labels:                                                <none>
+    Annotations:                                           <none>
+    CreationTimestamp:                                     Tue, 24 Jul 2018 18:36:28 +0200
+    Reference:                                             Deployment/hello-world
+    Metrics:                                               ( current / target )
+      resource memory on pods:                             3514368 / 100Mi
+      "cpu_system" on pods:                                0 / 20m
+      resource cpu on pods  (as a percentage of request):  0% (0) / 50%
+    Min replicas:                                          1
+    Max replicas:                                          10
+    Conditions:
+      Type            Status  Reason              Message
+      ----            ------  ------              -------
+      AbleToScale     True    ReadyForNewScale    the last scale time was sufficiently old as to warrant a new scale
+      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
+      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+    Events:           <none>
+    ```
+    {{% /accordion %}}
+
+
+1. Generate a load for the service to test that your pods autoscale as intended. You can use any load-testing tool (Hey, Gatling, etc.), but we're using [Hey](https://github.com/rakyll/hey).
+
+1. Test that pod autoscaling works as intended.<br/></br>
+  **To Test Autoscaling Using Resource Metrics:**
+  {{% accordion id="observe-upscale-2-pods-cpu" label="Upscale to 2 Pods: CPU Usage Up to Target" %}}
+Use your load testing tool to scale up to two pods based on CPU Usage.
+
+1. View your HPA.
+    ```
+    # kubectl describe hpa
+    ```
+    You should receive output similar to what follows.
+    ```
+    Name:                                                  hello-world
+    Namespace:                                             default
+    Labels:                                                <none>
+    Annotations:                                           <none>
+    CreationTimestamp:                                     Mon, 23 Jul 2018 22:22:04 +0200
+    Reference:                                             Deployment/hello-world
+    Metrics:                                               ( current / target )
+      resource memory on pods:                             10928128 / 100Mi
+      resource cpu on pods  (as a percentage of request):  56% (280m) / 50%
+    Min replicas:                                          1
+    Max replicas:                                          10
+    Conditions:
+      Type            Status  Reason              Message
+      ----            ------  ------              -------
+      AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 2
+      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
+      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+    Events:
+      Type    Reason             Age   From                       Message
+      ----    ------             ----  ----                       -------
+      Normal  SuccessfulRescale  13s   horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
+      ```
+1. Enter the following command to confirm you've scaled to two pods.
+   ```
+      # kubectl get pods
+   ```
+   You should receive output similar to what follows:
+   ```
+      NAME                                                     READY     STATUS    RESTARTS   AGE
+      hello-world-54764dfbf8-k8ph2                             1/1       Running   0          1m
+      hello-world-54764dfbf8-q6l4v                             1/1       Running   0          3h
+   ```
+  {{% /accordion %}}
+  {{% accordion id="observe-upscale-3-pods-cpu-cooldown" label="Upscale to 3 pods: CPU Usage Up to Target" %}}
+Use your load testing tool to upscale to 3 pods based on CPU usage with `horizontal-pod-autoscaler-upscale-delay` set to 3 minutes.
+
+1. Enter the following command.
+   ```
+   # kubectl describe hpa
+   ```
+   You should receive output similar to what follows
+   ```
+      Name:                                                  hello-world
+      Namespace:                                             default
+      Labels:                                                <none>
+      Annotations:                                           <none>
+      CreationTimestamp:                                     Mon, 23 Jul 2018 22:22:04 +0200
+      Reference:                                             Deployment/hello-world
+      Metrics:                                               ( current / target )
+        resource memory on pods:                             9424896 / 100Mi
+        resource cpu on pods  (as a percentage of request):  66% (333m) / 50%
+      Min replicas:                                          1
+      Max replicas:                                          10
+      Conditions:
+        Type            Status  Reason              Message
+        ----            ------  ------              -------
+        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 3
+        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
+        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+      Events:
+        Type    Reason             Age   From                       Message
+        ----    ------             ----  ----                       -------
+        Normal  SuccessfulRescale  4m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
+        Normal  SuccessfulRescale  16s   horizontal-pod-autoscaler  New size: 3; reason: cpu resource utilization (percentage of request) above target
+    ```
+2. Enter the following command to confirm three pods are running.
+   ```
+   # kubectl get pods
+   ```
+    You should receive output similar to what follows.
+     ```
+      NAME                                                     READY     STATUS    RESTARTS   AGE
+      hello-world-54764dfbf8-f46kh                             0/1       Running   0          1m
+      hello-world-54764dfbf8-k8ph2                             1/1       Running   0          5m
+      hello-world-54764dfbf8-q6l4v                             1/1       Running   0          3h
+      ```
+  {{% /accordion %}}
+  {{% accordion id="observe-downscale-1-pod" label="Downscale to 1 Pod: All Metrics Below Target" %}}
+Use your load testing to scale down to 1 pod when all metrics are below target for `horizontal-pod-autoscaler-downscale-delay` (5 minutes by default).
+
+1. Enter the following command.
+  ```
+  # kubectl describe hpa
+  ```
+  You should receive output similar to what follows.
+  ```
+      Name:                                                  hello-world
+      Namespace:                                             default
+      Labels:                                                <none>
+      Annotations:                                           <none>
+      CreationTimestamp:                                     Mon, 23 Jul 2018 22:22:04 +0200
+      Reference:                                             Deployment/hello-world
+      Metrics:                                               ( current / target )
+        resource memory on pods:                             10070016 / 100Mi
+        resource cpu on pods  (as a percentage of request):  0% (0) / 50%
+      Min replicas:                                          1
+      Max replicas:                                          10
+      Conditions:
+        Type            Status  Reason              Message
+        ----            ------  ------              -------
+        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 1
+        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
+        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+      Events:
+        Type    Reason             Age   From                       Message
+        ----    ------             ----  ----                       -------
+        Normal  SuccessfulRescale  10m   horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
+        Normal  SuccessfulRescale  6m    horizontal-pod-autoscaler  New size: 3; reason: cpu resource utilization (percentage of request) above target
+        Normal  SuccessfulRescale  1s    horizontal-pod-autoscaler  New size: 1; reason: All metrics below target
+  ```
+  {{% /accordion %}}
+<br/>
+**To Test Autoscaling Using Custom Metrics:**
+  {{% accordion id="custom-observe-upscale-2-pods-cpu" label="Upscale to 2 Pods: CPU Usage Up to Target" %}}
+Use your load testing tool to upscale two pods based on CPU usage.
+
+1. Enter the following command.
+  ```
+    # kubectl describe hpa
+  ```
+  You should receive output similar to what follows.
+  ```
+    Name:                                                  hello-world
+    Namespace:                                             default
+    Labels:                                                <none>
+    Annotations:                                           <none>
+    CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
+    Reference:                                             Deployment/hello-world
+    Metrics:                                               ( current / target )
+      resource memory on pods:                             8159232 / 100Mi
+      "cpu_system" on pods:                                7m / 20m
+      resource cpu on pods  (as a percentage of request):  64% (321m) / 50%
+    Min replicas:                                          1
+    Max replicas:                                          10
+    Conditions:
+      Type            Status  Reason              Message
+      ----            ------  ------              -------
+      AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 2
+      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
+      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+    Events:
+      Type    Reason             Age   From                       Message
+      ----    ------             ----  ----                       -------
+      Normal  SuccessfulRescale  16s   horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
+  ```
+1. Enter the following command to confirm two pods are running.
+  ```
+    # kubectl get pods
+  ```
+  You should receive output similar to what follows.
+  ```
+        NAME                           READY     STATUS    RESTARTS   AGE
+        hello-world-54764dfbf8-5pfdr   1/1       Running   0          3s
+        hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
+  ```
+  {{% /accordion %}}
+{{% accordion id="observe-upscale-3-pods-cpu-cooldown-2" label="Upscale to 3 Pods: CPU Usage Up to Target" %}}
+Use your load testing tool to scale up to three pods when the cpu_system usage limit is up to target.
+
+1. Enter the following command.
+   ```
+   # kubectl describe hpa
+   ```
+   You should receive output similar to what follows:
+   ```
+      Name:                                                  hello-world
+      Namespace:                                             default
+      Labels:                                                <none>
+      Annotations:                                           <none>
+      CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
+      Reference:                                             Deployment/hello-world
+      Metrics:                                               ( current / target )
+        resource memory on pods:                             8374272 / 100Mi
+        "cpu_system" on pods:                                27m / 20m
+        resource cpu on pods  (as a percentage of request):  71% (357m) / 50%
+      Min replicas:                                          1
+      Max replicas:                                          10
+      Conditions:
+        Type            Status  Reason              Message
+        ----            ------  ------              -------
+        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 3
+        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
+        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+      Events:
+        Type    Reason             Age   From                       Message
+        ----    ------             ----  ----                       -------
+        Normal  SuccessfulRescale  3m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
+        Normal  SuccessfulRescale  3s    horizontal-pod-autoscaler  New size: 3; reason: pods metric cpu_system above target
+    ```
+1. Enter the following command to confirm three pods are running.
+   ```
+   # kubectl get pods
+   ```
+   You should receive output similar to what follows:
+   ```
+      # kubectl get pods
+      NAME                           READY     STATUS    RESTARTS   AGE
+      hello-world-54764dfbf8-5pfdr   1/1       Running   0          3m
+      hello-world-54764dfbf8-m2hrl   1/1       Running   0          1s
+      hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
+   ```
+{{% /accordion %}}
+{{% accordion id="observe-upscale-4-pods" label="Upscale to 4 Pods: CPU Usage Up to Target" %}}
+Use your load testing tool to upscale to four pods based on CPU usage. `horizontal-pod-autoscaler-upscale-delay` is set to three minutes by default.
+
+1. Enter the following command.
+  ```
+  # kubectl describe hpa
+  ```
+  You should receive output similar to what follows.
+  ```
+      Name:                                                  hello-world
+      Namespace:                                             default
+      Labels:                                                <none>
+      Annotations:                                           <none>
+      CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
+      Reference:                                             Deployment/hello-world
+      Metrics:                                               ( current / target )
+        resource memory on pods:                             8374272 / 100Mi
+        "cpu_system" on pods:                                27m / 20m
+        resource cpu on pods  (as a percentage of request):  71% (357m) / 50%
+      Min replicas:                                          1
+      Max replicas:                                          10
+      Conditions:
+        Type            Status  Reason              Message
+        ----            ------  ------              -------
+        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 3
+        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
+        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+      Events:
+        Type    Reason             Age   From                       Message
+        ----    ------             ----  ----                       -------
+        Normal  SuccessfulRescale  5m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
+        Normal  SuccessfulRescale  3m    horizontal-pod-autoscaler  New size: 3; reason: pods metric cpu_system above target
+        Normal  SuccessfulRescale  4s    horizontal-pod-autoscaler  New size: 4; reason: cpu resource utilization (percentage of request) above target
+    ```
+1.  Enter the following command to confirm four pods are running.
+    ```
+    # kubectl get pods
+    ```
+    You should receive output similar to what follows.
+    ```
+      NAME                           READY     STATUS    RESTARTS   AGE
+      hello-world-54764dfbf8-2p9xb   1/1       Running   0          5m
+      hello-world-54764dfbf8-5pfdr   1/1       Running   0          2m
+      hello-world-54764dfbf8-m2hrl   1/1       Running   0          1s
+      hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
+    ```
+{{% /accordion %}}
+{{% accordion id="custom-metrics-observe-downscale-1-pod" label="Downscale to 1 Pod: All Metrics Below Target" %}}
+Use your load testing tool to scale down to one pod when all metrics below target for `horizontal-pod-autoscaler-downscale-delay`.
+
+1. Enter the following command.
+    ```
+    # kubectl describe hpa
+    ```
+    You should receive similar output to what follows.
+    ```
+        Name:                                                  hello-world
+        Namespace:                                             default
+        Labels:                                                <none>
+        Annotations:                                           <none>
+        CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
+        Reference:                                             Deployment/hello-world
+        Metrics:                                               ( current / target )
+          resource memory on pods:                             8101888 / 100Mi
+          "cpu_system" on pods:                                8m / 20m
+          resource cpu on pods  (as a percentage of request):  0% (0) / 50%
+        Min replicas:                                          1
+        Max replicas:                                          10
+        Conditions:
+          Type            Status  Reason              Message
+          ----            ------  ------              -------
+          AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 1
+          ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
+          ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
+        Events:
+          Type    Reason             Age   From                       Message
+          ----    ------             ----  ----                       -------
+          Normal  SuccessfulRescale  10m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
+          Normal  SuccessfulRescale  8m    horizontal-pod-autoscaler  New size: 3; reason: pods metric cpu_system above target
+          Normal  SuccessfulRescale  5m    horizontal-pod-autoscaler  New size: 4; reason: cpu resource utilization (percentage of request) above target
+          Normal   SuccessfulRescale             13s               horizontal-pod-autoscaler  New size: 1; reason: All metrics below target
+    ```
+1. Enter the following command to confirm a single pods is running.
+    ```
+        # kubectl get pods
+    ```
+    You should receive output similar to what follows.
+    ```
+        NAME                           READY     STATUS    RESTARTS   AGE
+        hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
+    ```
+{{% /accordion %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md
new file mode 100644
index 00000000000..a6701d94bd1
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md
@@ -0,0 +1,14 @@
+---
+title: Rolling Back Workloads
+weight: 3
+---
+
+Sometimes there is a need to rollback to the previous version of the application, either for debugging purposes or because an upgrade did not go as planned.
+
+1. From the **Global** view, open the project running the workload you want to rollback.
+
+1. Find the workload that you want to rollback and select **Vertical &#8942; (... ) > Rollback**.
+
+1. Choose the revision that you want to roll back to. Click **Rollback**.
+
+**Result:** Your workload reverts to the previous version that you chose. Wait a few minutes for the action to complete.
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md
new file mode 100644
index 00000000000..521e8d2901b
--- /dev/null
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md
@@ -0,0 +1,21 @@
+---
+title: Upgrading Workloads
+weight: 2
+---
+When a new version of an application image is released on Docker Hub, you can upgrade any workloads running a previous version of the application to the new one.
+
+1. From the **Global** view, open the project running the workload you want to upgrade.
+
+1. Find the workload that you want to upgrade and select **Vertical &#8942; (... ) > Edit**.
+
+1. Update the **Docker Image** to the updated version of the application image on Docker Hub.
+
+1. Update any other options that you want to change.
+
+1. Review and edit the workload's **Scaling/Upgrade** policy.
+
+    These options control how the upgrade rolls out to containers that are currently running. For example, for scalable deployments, you can chose whether you want to stop old pods before deploying new ones, or vice versa, as well as the upgrade batch size.
+
+1. Click **Upgrade**.
+
+**Result:** The workload begins upgrading its containers, per your specifications. Note that scaling up the deployment or updating the upgrade/scaling policy won't result in the pods recreation.
diff --git a/content/rancher/v2.5/en/contributing/_index.md b/content/rancher/v2.5/en/contributing/_index.md
new file mode 100644
index 00000000000..fd43236721f
--- /dev/null
+++ b/content/rancher/v2.5/en/contributing/_index.md
@@ -0,0 +1,120 @@
+---
+title: Contributing to Rancher
+weight: 18000
+---
+
+This section explains the repositories used for Rancher, how to build the repositories, and what information to include when you file an issue.
+
+For more detailed information on how to contribute to the development of Rancher projects, refer to the [Rancher Developer Wiki](https://github.com/rancher/rancher/wiki). The wiki has resources on many topics, including the following:
+
+- How to set up the Rancher development environment and run tests
+- The typical flow of an issue through the development lifecycle
+- Coding guidelines and development best practices
+- Debugging and troubleshooting
+- Developing the Rancher API
+
+On the Rancher Users Slack, the channel for developers is **#developer**.
+
+# Repositories
+
+All of repositories are located within our main GitHub organization. There are many repositories used for Rancher, but we'll provide descriptions of some of the main ones used in Rancher.
+
+Repository | URL | Description
+-----------|-----|-------------
+Rancher | https://github.com/rancher/rancher | This repository is the main source code for Rancher 2.x.
+Types | https://github.com/rancher/types | This repository is the repository that has all the API types for Rancher 2.x.
+API Framework | https://github.com/rancher/norman | This repository is an API framework for building Rancher style APIs backed by Kubernetes Custom Resources.
+User Interface | https://github.com/rancher/ui | This repository is the source of the UI.
+(Rancher) Docker Machine | https://github.com/rancher/machine | This repository is the source of the Docker Machine binary used when using Node Drivers. This is a fork of the `docker/machine` repository.
+machine-package | https://github.com/rancher/machine-package | This repository is used to build the Rancher Docker Machine binary.
+kontainer-engine | https://github.com/rancher/kontainer-engine | This repository is the source of kontainer-engine, the tool to provision hosted Kubernetes clusters.
+RKE repository | https://github.com/rancher/rke | This repository is the source of Rancher Kubernetes Engine, the tool to provision Kubernetes clusters on any machine.
+CLI | https://github.com/rancher/cli | This repository is the source code for the Rancher CLI used in Rancher 2.x.
+(Rancher) Helm repository | https://github.com/rancher/helm | This repository is the source of the packaged Helm binary. This is a fork of the `helm/helm` repository.
+Telemetry repository | https://github.com/rancher/telemetry | This repository is the source for the Telemetry binary.
+loglevel repository | https://github.com/rancher/loglevel | This repository is the source of the loglevel binary, used to dynamically change log levels.
+
+To see all libraries/projects used in Rancher, see the [`go.mod` file](https://github.com/rancher/rancher/blob/master/go.mod) in the `rancher/rancher` repository.
+
+![Rancher diagram]({{<baseurl>}}/img/rancher/ranchercomponentsdiagram.svg)<br/>
+<sup>Rancher components used for provisioning/managing Kubernetes clusters.</sup>
+
+# Building
+
+Every repository should have a Makefile and can be built using the `make` command. The `make` targets are based on the scripts in the `/scripts` directory in the repository, and each target will use [Dapper](https://github.com/rancher/dapper) to run the target in an isolated environment. The `Dockerfile.dapper` will be used for this process, and includes all the necessary build tooling needed.
+
+The default target is `ci`, and will run `./scripts/validate`, `./scripts/build`, `./scripts/test` and `./scripts/package`. The resulting binaries of the build will be in `./build/bin` and are usually also packaged in a Docker image.
+
+# Bugs, Issues or Questions
+
+If you find any bugs or are having any trouble, please search the [reported issue](https://github.com/rancher/rancher/issues) as someone may have experienced the same issue or we are actively working on a solution.
+
+If you can't find anything related to your issue, contact us by [filing an issue](https://github.com/rancher/rancher/issues/new). Though we have many repositories related to Rancher, we want the bugs filed in the Rancher repository so we won't miss them! If you want to ask a question or ask fellow users about an use case, we suggest creating a post on the [Rancher Forums](https://forums.rancher.com).
+
+### Checklist for Filing Issues
+
+Please follow this checklist when filing an issue which will helps us investigate and fix the issue. More info means more data we can use to determine what is causing the issue or what might be related to the issue.
+
+>**Note:** For large amounts of data, please use [GitHub Gist](https://gist.github.com/) or similar and link the created resource in the issue.
+>**Important:** Please remove any sensitive data as it will be publicly viewable.
+
+- **Resources:** Provide as much as detail as possible on the used resources. As the source of the issue can be many things, including as much of detail as possible helps to determine the root cause. See some examples below:
+  - **Hosts:** What specifications does the host have, like CPU/memory/disk, what cloud does it happen on, what Amazon Machine Image are you using, what DigitalOcean droplet are you using, what image are you provisioning that we can rebuild or use when we try to reproduce
+  - **Operating System:** What operating system are you using? Providing specifics helps here like the output of `cat /etc/os-release` for exact OS release and `uname -r` for exact kernel used
+  - **Docker:** What Docker version are you using, how did you install it? Most of the details of Docker can be found by supplying output of `docker version` and `docker info`
+  - **Environment:** Are you in a proxy environment, are you using recognized CA/self signed certificates, are you using an external loadbalancer
+  - **Rancher:** What version of Rancher are you using, this can be found on the bottom left of the UI or be retrieved from the image tag you are running on the host
+  - **Clusters:** What kind of cluster did you create, how did you create it, what did you specify when you were creating it
+- **Steps to reproduce the issue:** Provide as much detail on how you got into the reported situation. This helps the person to reproduce the situation you are in.
+  - Provide manual steps or automation scripts used to get from a newly created setup to the situation you reported.
+- **Logs:** Provide data/logs from the used resources.
+  - Rancher
+      - Docker install
+
+        ```
+        docker logs \
+        --timestamps \
+        $(docker ps | grep -E "rancher/rancher:|rancher/rancher " | awk '{ print $1 }')
+        ```
+      - Kubernetes install using `kubectl`
+
+        > **Note:** Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` if Rancher is installed on a Kubernetes cluster) or are using the embedded kubectl via the UI.
+
+        ```
+        kubectl -n cattle-system \
+        logs \
+        -l app=rancher \
+        --timestamps=true
+        ```
+      - Docker install using `docker` on each of the nodes in the RKE cluster
+
+        ```
+        docker logs \
+        --timestamps \
+        $(docker ps | grep -E "rancher/rancher@|rancher_rancher" | awk '{ print $1 }')
+        ```
+      - Kubernetes Install with RKE Add-On
+
+        > **Note:** Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` if the Rancher server is installed on a Kubernetes cluster) or are using the embedded kubectl via the UI.
+
+        ```
+        kubectl -n cattle-system \
+        logs \
+        --timestamps=true \
+        -f $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name="cattle-server") | .metadata.name')
+        ```
+  - System logging (these might not all exist, depending on operating system)
+      - `/var/log/messages`
+      - `/var/log/syslog`
+      - `/var/log/kern.log`
+  - Docker daemon logging (these might not all exist, depending on operating system)
+      - `/var/log/docker.log`
+- **Metrics:** If you are experiencing performance issues, please provide as much of data (files or screenshots) of metrics which can help determining what is going on. If you have an issue related to a machine, it helps to supply output of `top`, `free -m`, `df` which shows processes/memory/disk usage.
+
+# Docs
+
+If you have any updates to our documentation, please make any pull request to our docs repo.
+
+- [Rancher 2.x Docs repository](https://github.com/rancher/docs): This repo is where all the docs for Rancher 2.x are located. They are located in the `content` folder in the repo.
+
+- [Rancher 1.x Docs repository](https://github.com/rancher/rancher.github.io): This repo is where all the docs for Rancher 1.x are located. They are located in the `rancher` folder in the repo.
diff --git a/content/rancher/v2.5/en/disaster-recovery/_index.md b/content/rancher/v2.5/en/disaster-recovery/_index.md
new file mode 100644
index 00000000000..359b1e7010e
--- /dev/null
+++ b/content/rancher/v2.5/en/disaster-recovery/_index.md
@@ -0,0 +1,12 @@
+---
+title: Disaster Recovery
+weight: 3
+---
+
+> This page is under construction.
+
+This section applies to Rancher installations in which the underlying Kubernetes cluster was created with the Rancher CLI.
+
+We recommend using the backup/restore application to back up Rancher and to restore it from backup.
+
+The Helm chart for the application is available as in Rancher. After you have enabled the application, you will be able to use backup templates for apps such as Rancher, Fleet, and the Enterprise Cluster Manager. Then apps can be restored from Kubernetes custom resources.
diff --git a/content/rancher/v2.5/en/faq/_index.md b/content/rancher/v2.5/en/faq/_index.md
new file mode 100644
index 00000000000..60f260984b5
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/_index.md
@@ -0,0 +1,72 @@
+---
+title: FAQ
+weight: 8000
+aliases:
+  - /rancher/v2.x/en/about/
+---
+
+This FAQ is a work in progress designed to answers the questions our users most frequently ask about Rancher v2.x.
+
+See [Technical FAQ]({{<baseurl>}}/rancher/v2.x/en/faq/technical/), for frequently asked technical questions.
+
+<br>
+
+**Does Rancher v2.x support Docker Swarm and Mesos as environment types?**
+
+When creating an environment in Rancher v2.x, Swarm and Mesos will no longer be standard options you can select. However, both Swarm and Mesos will continue to be available as Catalog applications you can deploy. It was a tough decision to make but, in the end, it came down to adoption. For example, out of more than 15,000 clusters, only about 200 or so are running Swarm.
+
+<br>
+
+**Is it possible to manage Azure Kubernetes Services with Rancher v2.x?**
+
+Yes.
+
+<br>
+
+**Does Rancher support Windows?**
+
+As of Rancher 2.3.0, we support Windows Server 1809 containers. For details on how to set up a cluster with Windows worker nodes, refer to the section on [configuring custom clusters for Windows.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/)
+
+<br>
+
+**Does Rancher support Istio?**
+
+As of Rancher 2.3.0, we support [Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
+
+Furthermore, Istio is implemented in our micro-PaaS "Rio", which works on Rancher 2.x along with any CNCF compliant Kubernetes cluster. You can read more about it [here](https://rio.io/)
+
+<br>
+
+**Will Rancher v2.x support Hashicorp's Vault for storing secrets?**
+
+Secrets management is on our roadmap but we haven't assigned it to a specific release yet. 
+
+<br>
+
+**Does Rancher v2.x support RKT containers as well?**
+
+At this time, we only support Docker.
+
+<br>
+
+**Does Rancher v2.x support Calico, Contiv, Contrail, Flannel, Weave net, etc., for embedded and imported Kubernetes?**
+
+Out-of-the-box, Rancher provides the following CNI network providers for Kubernetes clusters: Canal, Flannel, Calico and Weave (Weave is available as of v2.2.0).  Always refer to the [Rancher Support Matrix](https://rancher.com/support-maintenance-terms/) for details about what is officially supported.
+
+<br>
+
+**Are you planning on supporting Traefik for existing setups?**
+
+We don't currently plan on providing embedded Traefik support, but we're still exploring load-balancing approaches.
+
+<br>
+
+**Can I import OpenShift Kubernetes clusters into v2.x?**
+
+Our goal is to run any upstream Kubernetes clusters. Therefore, Rancher v2.x should work with OpenShift, but we haven't tested it yet.
+
+<br>
+
+**Are you going to integrate Longhorn?**
+
+Yes. Longhorn was on a bit of a hiatus while we were working on v2.0. We plan to re-engage on the project.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/faq/kubectl/_index.md b/content/rancher/v2.5/en/faq/kubectl/_index.md
new file mode 100644
index 00000000000..b4172ab0a40
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/kubectl/_index.md
@@ -0,0 +1,30 @@
+---
+title: Installing and Configuring kubectl
+weight: 100
+---
+
+`kubectl` is a CLI utility for running commands against Kubernetes clusters. It's required for many maintenance and administrative tasks in Rancher 2.x.
+
+### Installation
+
+See [kubectl Installation](https://kubernetes.io/docs/tasks/tools/install-kubectl/) for installation on your operating system.
+
+### Configuration
+
+When you create a Kubernetes cluster with RKE, RKE creates a `kube_config_rancher-cluster.yml` in the local directory that contains credentials to connect to your new cluster with tools like `kubectl` or `helm`.
+
+You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set the `KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`.
+
+```
+export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml
+```
+
+Test your connectivity with `kubectl` and see if you can get the list of nodes back.
+
+```
+kubectl get nodes
+ NAME                          STATUS    ROLES                      AGE       VERSION
+165.227.114.63                Ready     controlplane,etcd,worker   11m       v1.10.1
+165.227.116.167               Ready     controlplane,etcd,worker   11m       v1.10.1
+165.227.127.226               Ready     controlplane,etcd,worker   11m       v1.10.1
+```
diff --git a/content/rancher/v2.5/en/faq/mcm/networking/_index.md b/content/rancher/v2.5/en/faq/mcm/networking/_index.md
new file mode 100644
index 00000000000..863ad97169d
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/mcm/networking/_index.md
@@ -0,0 +1,9 @@
+---
+title: Networking
+weight: 8005
+---
+
+Networking FAQ's
+
+- [CNI Providers]({{<baseurl>}}/rancher/v2.x/en/faq/networking/cni-providers/)
+
diff --git a/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md b/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
new file mode 100644
index 00000000000..223b58a02b4
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
@@ -0,0 +1,154 @@
+---
+title: Container Network Interface (CNI) Providers
+description: Learn about Container Network Interface (CNI), the CNI providers Rancher provides, the features they offer, and how to choose a provider for you
+weight: 2300
+---
+
+## What is CNI?
+
+CNI (Container Network Interface), a [Cloud Native Computing Foundation project](https://cncf.io/), consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of  plugins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
+
+Kubernetes uses CNI as an interface between network providers and Kubernetes pod networking.
+
+![CNI Logo]({{<baseurl>}}/img/rancher/cni-logo.png)
+
+For more information visit [CNI GitHub project](https://github.com/containernetworking/cni).
+
+### What Network Models are Used in CNI?
+
+CNI network providers implement their network fabric using either an encapsulated network model such as Virtual Extensible Lan ([VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan)) or an unencapsulated network model such as Border Gateway Protocol ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)).
+
+#### What is an Encapsulated Network?
+
+This network model provides a logical Layer 2 (L2) network encapsulated over the existing Layer 3 (L3) network topology that spans the Kubernetes cluster nodes. With this model you have an isolated L2 network for containers without needing routing distribution, all at the cost of minimal overhead in terms of processing and increased IP package size, which comes from an IP header generated by overlay encapsulation. Encapsulation information is distributed by UDP ports between Kubernetes workers, interchanging network control plane information about how MAC addresses can be reached. Common encapsulation used in this kind of network model is VXLAN, Internet Protocol Security (IPSec), and IP-in-IP.
+
+In simple terms, this network model generates a kind of network bridge extended between Kubernetes workers, where pods are connected.
+
+This network model is used when an extended L2 bridge is preferred. This network model is sensitive to L3 network latencies of the Kubernetes workers. If datacenters are in distinct geolocations, be sure to have low latencies between them to avoid eventual network segmentation.
+
+CNI network providers using this network model include Flannel, Canal, and Weave.
+
+![Encapsulated Network]({{<baseurl>}}/img/rancher/encapsulated-network.png)
+
+#### What is an Unencapsulated Network?
+
+This network model provides an L3 network to route packets between containers. This model doesn't generate an isolated l2 network, nor generates overhead. These benefits come at the cost of Kubernetes workers having to manage any route distribution that's needed. Instead of using IP headers for encapsulation, this network model uses a network protocol between Kubernetes workers to distribute routing information to reach pods, such as [BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol).
+
+In simple terms, this network model generates a kind of network router extended between Kubernetes workers, which provides information about how to reach pods.
+
+This network model is used when a routed L3 network is preferred. This mode dynamically updates routes at the OS level for Kubernetes workers. It's less sensitive to latency.
+
+CNI network providers using this network model include Calico and Romana.
+
+![Unencapsulated Network]({{<baseurl>}}/img/rancher/unencapsulated-network.png)
+
+### What CNI Providers are Provided by Rancher?
+
+Out-of-the-box, Rancher provides the following CNI network providers for Kubernetes clusters: Canal, Flannel, Calico and Weave (Weave is available as of v2.2.0). You can choose your CNI network provider when you create new Kubernetes clusters from Rancher.
+
+#### Canal
+
+![Canal Logo]({{<baseurl>}}/img/rancher/canal-logo.png)
+
+Canal is a CNI network provider that gives you the best of Flannel and Calico. It allows users to easily deploy Calico and Flannel networking together as a unified networking solution, combining Calico’s network policy enforcement with the rich superset of Calico (unencapsulated) and/or Flannel (encapsulated) network connectivity options.
+
+In Rancher, Canal is the default CNI network provider combined with Flannel and VXLAN encapsulation.
+
+Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). For details, refer to [the port requirements for user clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/)
+
+{{< img "/img/rancher/canal-diagram.png" "Canal Diagram">}}
+
+For more information, see the [Canal GitHub Page.](https://github.com/projectcalico/canal)
+
+#### Flannel
+
+![Flannel Logo]({{<baseurl>}}/img/rancher/flannel-logo.png)
+
+Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan).
+
+Encapsulated traffic is unencrypted by default. Therefore, flannel provides an experimental backend for encryption, [IPSec](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers.
+
+Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). See [the port requirements for user clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for more details.
+
+![Flannel Diagram]({{<baseurl>}}/img/rancher/flannel-diagram.png)
+
+For more information, see the [Flannel GitHub Page](https://github.com/coreos/flannel).
+
+#### Calico
+
+![Calico Logo]({{<baseurl>}}/img/rancher/calico-logo.png)
+
+Calico enables networking and network policy in Kubernetes clusters across the cloud. Calico uses a pure, unencapsulated IP network fabric and policy engine to provide networking for your Kubernetes workloads. Workloads are able to communicate over both cloud infrastructure and on-premise using BGP.
+
+Calico also provides a stateless IP-in-IP encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies.
+
+Kubernetes workers should open TCP port `179` (BGP). See [the port requirements for user clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for more details.
+
+![Calico Diagram]({{<baseurl>}}/img/rancher/calico-diagram.svg)
+
+For more information, see the following pages:
+
+- [Project Calico Official Site](https://www.projectcalico.org/)
+- [Project Calico GitHub Page](https://github.com/projectcalico/calico)
+
+
+#### Weave
+
+![Weave Logo]({{<baseurl>}}/img/rancher/weave-logo.png)
+
+_Available as of v2.2.0_
+
+Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers.
+
+Kubernetes workers should open TCP port `6783` (control port), UDP port `6783` and UDP port `6784` (data ports). See the [port requirements for user clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for more details.
+
+For more information, see the following pages:
+
+- [Weave Net Official Site](https://www.weave.works/)
+
+### CNI Features by Provider
+
+The following table summarizes the different features available for each CNI network provider provided by Rancher.
+
+| Provider | Network Model | Route Distribution | Network Policies | Mesh | External Datastore | Encryption | Ingress/Egress Policies |
+| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
+| Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | No | Yes |
+| Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | No | No |
+| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | No | Yes |
+| Weave | Encapsulated | Yes | Yes | Yes | No | Yes | Yes |
+
+- Network Model: Encapsulated or unencapsulated. For more information, see [What Network Models are Used in CNI?](#what-network-models-are-used-in-cni)
+
+- Route Distribution: An exterior gateway protocol designed to exchange routing and reachability information on the Internet. BGP can assist with pod-to-pod networking between clusters. This feature is a must on unencapsulated CNI network providers, and it is typically done by BGP. If you plan to build clusters split across network segments, route distribution is a feature that's nice-to-have.
+
+- Network Policies: Kubernetes offers functionality to enforce rules about which services can communicate with each other using network policies. This feature is stable as of Kubernetes v1.7 and is ready to use with certain networking plugins.
+
+- Mesh: This feature allows service-to-service networking communication between distinct Kubernetes clusters.
+
+- External Datastore: CNI network providers with this feature need an external datastore for its data.
+
+- Encryption: This feature allows cyphered and secure network control and data planes.
+
+- Ingress/Egress Policies: This feature allows you to manage routing control for both Kubernetes and non-Kubernetes communications.
+
+#### CNI Community Popularity
+
+The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity. This data was collected in January 2020.
+
+| Provider | Project | Stars | Forks | Contributors |
+| ---- | ---- | ---- | ---- | ---- |
+| Canal | https://github.com/projectcalico/canal | 614 | 89 | 19 |
+| flannel | https://github.com/coreos/flannel | 4977 | 1.4k | 140 |
+| Calico | https://github.com/projectcalico/calico | 1534 | 429 | 135 |
+| Weave | https://github.com/weaveworks/weave/ | 5737 | 559 | 73 |
+
+<br/>
+### Which CNI Provider Should I Use?
+
+It depends on your project needs. There are many different providers, which each have various features and options. There isn't one provider that meets everyone's needs.
+
+As of Rancher v2.0.7, Canal is the default CNI network provider. We recommend it for most use cases. It provides encapsulated networking for containers with Flannel, while adding Calico network policies that can provide project/namespace isolation in terms of networking.
+
+### How can I configure a CNI network provider?
+
+Please see [Cluster Options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/) on how to configure a network provider for your cluster. For more advanced configuration options, please see how to configure your cluster using a [Config File]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file) and the options for [Network Plug-ins]({{<baseurl>}}/rke/latest/en/config-options/add-ons/network-plugins/).
diff --git a/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md b/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
new file mode 100644
index 00000000000..897fdcfce49
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
@@ -0,0 +1,57 @@
+---
+title: Rancher is No Longer Needed
+weight: 8010
+aliases:
+  - /rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/
+  - /rancher/v2.x/en/installation/removing-rancher/
+  - /rancher/v2.x/en/admin-settings/removing-rancher/
+  - /rancher/v2.x/en/admin-settings/removing-rancher/rancher-cluster-nodes/
+---
+
+This page is intended to answer questions about what happens if you don't want Rancher anymore, if you don't want a cluster to be managed by Rancher anymore, or if the Rancher server is deleted.
+
+- [If the Rancher server is deleted, what happens to the workloads in my downstream clusters?](#if-the-rancher-server-is-deleted-what-happens-to-the-workloads-in-my-downstream-clusters)
+- [If the Rancher server is deleted, how do I access my downstream clusters?](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
+- [What if I don't want Rancher anymore?](#what-if-i-don-t-want-rancher-anymore)
+- [What if I don't want my imported cluster managed by Rancher?](#what-if-i-don-t-want-my-imported-cluster-managed-by-rancher)
+- [What if I don't want my RKE cluster or hosted Kubernetes cluster managed by Rancher?](#what-if-i-don-t-want-my-rke-cluster-or-hosted-kubernetes-cluster-managed-by-rancher)
+
+### If the Rancher server is deleted, what happens to the workloads in my downstream clusters?
+
+If Rancher is ever deleted or unrecoverable, all workloads in the downstream Kubernetes clusters managed by Rancher will continue to function as normal.
+
+### If the Rancher server is deleted, how do I access my downstream clusters?
+
+The capability to access a downstream cluster without Rancher depends on the type of cluster and the way that the cluster was created. To summarize:
+
+- **Imported clusters:** The cluster will be unaffected and you can access the cluster using the same methods that you did before the cluster was imported into Rancher.
+- **Hosted Kubernetes clusters:** If you created the cluster in a cloud-hosted Kubernetes provider such as EKS, GKE, or AKS, you can continue to manage the cluster using your provider's cloud credentials.
+- **RKE clusters:** To access an [RKE cluster,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) the cluster must have the [authorized cluster endpoint]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. (The authorized cluster endpoint is enabled by default for RKE clusters.) With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed.
+
+### What if I don't want Rancher anymore?
+
+If you [installed Rancher on a Kubernetes cluster,]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/) remove Rancher by using the [System Tools]({{<baseurl>}}/rancher/v2.x/en/system-tools/) with the `remove` subcommand.
+
+If you installed Rancher with Docker, you can uninstall Rancher by removing the single Docker container that it runs in.
+
+Imported clusters will not be affected by Rancher being removed. For other types of clusters, refer to the section on [accessing downstream clusters when Rancher is removed.](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
+
+### What if I don't want my imported cluster managed by Rancher?
+
+If an imported cluster is deleted from the Rancher UI, the cluster is detached from Rancher, leaving it intact and accessible by the same methods that were used to access it before it was imported into Rancher.
+
+To detach the cluster,
+
+1. From the **Global** view in Rancher, go to the **Clusters** tab.
+2. Go to the imported cluster that should be detached from Rancher and click **&#8942; > Delete.**
+3. Click **Delete.**
+
+**Result:** The imported cluster is detached from Rancher and functions normally outside of Rancher.
+
+### What if I don't want my RKE cluster or hosted Kubernetes cluster managed by Rancher?
+
+At this time, there is no functionality to detach these clusters from Rancher. In this context, "detach" is defined as the ability to remove Rancher components from the cluster and manage access to the cluster independently of Rancher.
+
+The capability to manage these clusters without Rancher is being tracked in this [issue.](https://github.com/rancher/rancher/issues/25234)
+
+For information about how to access clusters if the Rancher server is deleted, refer to [this section.](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
diff --git a/content/rancher/v2.5/en/faq/mcm/technical/_index.md b/content/rancher/v2.5/en/faq/mcm/technical/_index.md
new file mode 100644
index 00000000000..1151e35489c
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/mcm/technical/_index.md
@@ -0,0 +1,189 @@
+---
+title: Technical
+weight: 8006
+---
+
+### How can I reset the administrator password?
+
+Docker Install:
+```
+$ docker exec -ti <container_id> reset-password
+New password for default administrator (user-xxxxx):
+<new_password>
+```
+
+Kubernetes install (Helm):
+```
+$ KUBECONFIG=./kube_config_rancher-cluster.yml
+$ kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $(kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | head -1 | awk '{ print $1 }') -- reset-password
+New password for default administrator (user-xxxxx):
+<new_password>
+```
+
+Kubernetes install (RKE add-on):
+```
+$ KUBECONFIG=./kube_config_rancher-cluster.yml
+$ kubectl --kubeconfig $KUBECONFIG exec -n cattle-system $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name=="cattle-server") | .metadata.name') -- reset-password
+New password for default administrator (user-xxxxx):
+<new_password>
+```
+
+
+### I deleted/deactivated the last admin, how can I fix it?
+Docker Install:
+```
+$ docker exec -ti <container_id> ensure-default-admin
+New default administrator (user-xxxxx)
+New password for default administrator (user-xxxxx):
+<new_password>
+```
+
+Kubernetes install (Helm):
+```
+$ KUBECONFIG=./kube_config_rancher-cluster.yml
+$ kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $(kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | head -1 | awk '{ print $1 }') -- ensure-default-admin
+New password for default administrator (user-xxxxx):
+<new_password>
+```
+
+Kubernetes install (RKE add-on):
+```
+$ KUBECONFIG=./kube_config_rancher-cluster.yml
+$ kubectl --kubeconfig $KUBECONFIG exec -n cattle-system $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name=="cattle-server") | .metadata.name') -- ensure-default-admin
+New password for default admin user (user-xxxxx):
+<new_password>
+```
+
+### How can I enable debug logging?
+
+See [Troubleshooting: Logging]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/logging/)
+
+### My ClusterIP does not respond to ping
+
+ClusterIP is a virtual IP, which will not respond to ping. Best way to test if the ClusterIP is configured correctly, is by using `curl` to access the IP and port to see if it responds.
+
+### Where can I manage Node Templates?
+
+Node Templates can be accessed by opening your account menu (top right) and selecting `Node Templates`.
+
+### Why is my Layer-4 Load Balancer in `Pending` state?
+
+The Layer-4 Load Balancer is created as `type: LoadBalancer`. In Kubernetes, this needs a cloud provider or controller that can satisfy these requests, otherwise these will be in `Pending` state forever. More information can be found on [Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) or [Create External Load Balancer](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/)
+
+### Where is the state of Rancher stored?
+
+- Docker Install: in the embedded etcd of the `rancher/rancher` container, located at `/var/lib/rancher`.
+- Kubernetes install: in the etcd of the RKE cluster created to run Rancher.
+
+### How are the supported Docker versions determined?
+
+We follow the validated Docker versions for upstream Kubernetes releases. The validated versions can be found under [External Dependencies](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#external-dependencies) in the Kubernetes release CHANGELOG.md.
+
+### How can I access nodes created by Rancher?
+
+SSH keys to access the nodes created by Rancher can be downloaded via the **Nodes** view. Choose the node which you want to access and click on the vertical &#8942; button at the end of the row, and choose **Download Keys** as shown in the picture below.
+
+![Download Keys]({{<baseurl>}}/img/rancher/downloadsshkeys.png)
+
+Unzip the downloaded zip file, and use the file `id_rsa` to connect to you host. Be sure to use the correct username (`rancher` or `docker` for RancherOS, `ubuntu` for Ubuntu, `ec2-user` for Amazon Linux)
+
+```
+$ ssh -i id_rsa user@ip_of_node
+```
+
+### How can I automate task X in Rancher?
+
+The UI consists of static files, and works based on responses of the API. That means every action/task that you can execute in the UI, can be automated via the API. There are 2 ways to do this:
+
+* Visit `https://your_rancher_ip/v3` and browse the API options.
+* Capture the API calls when using the UI (Most commonly used for this is [Chrome Developer Tools](https://developers.google.com/web/tools/chrome-devtools/#network) but you can use anything you like)
+
+### The IP address of a node changed, how can I recover?
+
+A node is required to have a static IP configured (or a reserved IP via DHCP). If the IP of a node has changed, you will have to remove it from the cluster and readd it. After it is removed, Rancher will update the cluster to the correct state. If the cluster is no longer in `Provisioning` state, the node is removed from the cluster.
+
+When the IP address of the node changed, Rancher lost connection to the node, so it will be unable to clean the node properly. See [Cleaning cluster nodes]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) to clean the node.
+
+When the node is removed from the cluster, and the node is cleaned, you can readd the node to the cluster.
+
+### How can I add additional arguments/binds/environment variables to Kubernetes components in a Rancher Launched Kubernetes cluster?
+
+You can add additional arguments/binds/environment variables via the [Config File]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file) option in Cluster Options. For more information, see the [Extra Args, Extra Binds, and Extra Environment Variables]({{<baseurl>}}/rke/latest/en/config-options/services/services-extras/) in the RKE documentation or browse the [Example Cluster.ymls]({{<baseurl>}}/rke/latest/en/example-yamls/).
+
+### How do I check if my certificate chain is valid?
+
+Use the `openssl verify` command to validate your certificate chain:
+
+>**Note:** Configure `SSL_CERT_DIR` and `SSL_CERT_FILE` to a dummy location to make sure the OS installed certificates are not used when verifying manually.
+
+```
+SSL_CERT_DIR=/dummy SSL_CERT_FILE=/dummy openssl verify -CAfile ca.pem rancher.yourdomain.com.pem
+rancher.yourdomain.com.pem: OK
+```
+
+If you receive the error `unable to get local issuer certificate`, the chain is incomplete. This usually means that there is an intermediate CA certificate that issued your server certificate. If you already have this certificate, you can use it in the verification of the certificate like shown below:
+
+```
+SSL_CERT_DIR=/dummy SSL_CERT_FILE=/dummy openssl verify -CAfile ca.pem -untrusted intermediate.pem rancher.yourdomain.com.pem
+rancher.yourdomain.com.pem: OK
+```
+
+If you have successfully verified your certificate chain, you should include needed intermediate CA certificates in the server certificate to complete the certificate chain for any connection made to Rancher (for example, by the Rancher agent). The order of the certificates in the server certificate file should be first the server certificate itself (contents of `rancher.yourdomain.com.pem`), followed by intermediate CA certificate(s) (contents of `intermediate.pem`).
+
+```
+-----BEGIN CERTIFICATE-----
+%YOUR_CERTIFICATE%
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+%YOUR_INTERMEDIATE_CERTIFICATE%
+-----END CERTIFICATE-----
+```
+
+If you still get errors during verification, you can retrieve the subject and the issuer of the server certificate using the following command:
+
+```
+openssl x509 -noout -subject -issuer -in rancher.yourdomain.com.pem
+subject= /C=GB/ST=England/O=Alice Ltd/CN=rancher.yourdomain.com
+issuer= /C=GB/ST=England/O=Alice Ltd/CN=Alice Intermediate CA
+```
+
+### How do I check `Common Name` and `Subject Alternative Names` in my server certificate?
+
+Although technically an entry in `Subject Alternative Names` is required, having the hostname in both `Common Name` and as entry in `Subject Alternative Names` gives you maximum compatibility with older browser/applications.
+
+Check `Common Name`:
+
+```
+openssl x509 -noout -subject -in cert.pem
+subject= /CN=rancher.my.org
+```
+
+Check `Subject Alternative Names`:
+
+```
+openssl x509 -noout -in cert.pem -text | grep DNS
+                DNS:rancher.my.org
+```
+
+### Why does it take 5+ minutes for a pod to be rescheduled when a node has failed?
+
+This is due to a combination of the following default Kubernetes settings:
+
+* kubelet
+  * `node-status-update-frequency`: Specifies how often kubelet posts node status to master (default 10s)
+* kube-controller-manager
+  * `node-monitor-period`: The period for syncing NodeStatus in NodeController (default 5s)
+  * `node-monitor-grace-period`: Amount of time which we allow running Node to be unresponsive before marking it unhealthy (default 40s)
+  * `pod-eviction-timeout`: The grace period for deleting pods on failed nodes (default 5m0s)
+
+See [Kubernetes: kubelet](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/) and [Kubernetes: kube-controller-manager](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/) for more information on these settings.
+
+In Kubernetes v1.13, the `TaintBasedEvictions` feature is enabled by default. See [Kubernetes: Taint based Evictions](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/#taint-based-evictions) for more information.
+
+* kube-apiserver (Kubernetes v1.13 and up)
+  * `default-not-ready-toleration-seconds`: Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.
+  * `default-unreachable-toleration-seconds`: Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.
+
+### Can I use keyboard shortcuts in the UI?
+
+Yes, most parts of the UI can be reached using keyboard shortcuts. For an overview of the available shortcuts, press `?` anywhere in the UI.
diff --git a/content/rancher/v2.5/en/faq/security/_index.md b/content/rancher/v2.5/en/faq/security/_index.md
new file mode 100644
index 00000000000..f9d6ec86452
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/security/_index.md
@@ -0,0 +1,15 @@
+---
+title: Security
+weight: 8007
+
+---
+
+**Is there a Hardening Guide?**
+
+The Hardening Guide is now located in the main [Security]({{<baseurl>}}/rancher/v2.x/en/security/) section.
+
+<br>
+
+**What are the results of Rancher's Kubernetes cluster when it is CIS benchmarked?**
+
+We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main [Security]({{<baseurl>}}/rancher/v2.x/en/security/) section.
diff --git a/content/rancher/v2.5/en/faq/telemetry/_index.md b/content/rancher/v2.5/en/faq/telemetry/_index.md
new file mode 100644
index 00000000000..6ab582667e1
--- /dev/null
+++ b/content/rancher/v2.5/en/faq/telemetry/_index.md
@@ -0,0 +1,32 @@
+---
+title: Telemetry
+weight: 8008
+---
+
+### What is Telemetry?
+
+Telemetry collects aggregate information about the size of Rancher installations, versions of components used, and which features are used.  This information is used by Rancher Labs to help make the product better and is not shared with third-parties.
+
+### What information is collected?
+
+No specific identifying information like usernames, passwords, or the names or addresses of user resources will ever be collected.
+
+The primary things collected include:
+
+  - Aggregate counts (smallest, average, largest, total) of nodes per-cluster and their size (e.g. CPU cores & RAM).
+  - Aggregate counts of logical resources like Clusters, Projects, Namespaces, and Pods.
+  - Counts of what driver was used to deploy clusters and nodes (e.g. GKE vs EC2 vs Imported vs Custom).
+  - Versions of Kubernetes components, Operating Systems and Docker that are deployed on nodes.
+  - Whether some optional components are enabled or not (e.g. which auth providers are used).
+  - The image name & version of Rancher that is running.
+  - A unique randomly-generated identifier for this installation.
+
+### Can I see the information that is being sent?
+
+If Telemetry is enabled, you can go to `https://<your rancher server>/v1-telemetry` in your installation to see the current data.
+
+If Telemetry is not enabled, the process that collects the data is not running, so there is nothing being collected to look at.
+
+### How do I turn it on or off?
+
+After initial setup, an administrator can go to the `Settings` page in the `Global` section of the UI and click Edit to change the `telemetry-opt` setting to either `in` or `out`.
diff --git a/content/rancher/v2.5/en/overview/_index.md b/content/rancher/v2.5/en/overview/_index.md
new file mode 100644
index 00000000000..5a40167303b
--- /dev/null
+++ b/content/rancher/v2.5/en/overview/_index.md
@@ -0,0 +1,66 @@
+---
+title: Overview
+weight: 1
+---
+
+> This page is under construction.
+
+Rancher is a container management platform built for organizations that deploy containers in production. Rancher makes it easy to run Kubernetes everywhere, meet IT requirements, and empower DevOps teams.
+
+# Run Kubernetes Everywhere
+
+Kubernetes has become the container orchestration standard. Most cloud and virtualization vendors now offer it as standard infrastructure. Rancher users have the choice of creating Kubernetes clusters with Rancher Kubernetes Engine (RKE) or cloud Kubernetes services, such as GKE, AKS, and EKS. Rancher users can also import and manage their existing Kubernetes clusters created using any Kubernetes distribution or installer.
+
+# Meet IT requirements
+
+Rancher supports centralized authentication, access control, and monitoring for all Kubernetes clusters under its control. For example, you can:
+
+- Use your Active Directory credentials to access Kubernetes clusters hosted by cloud vendors, such as GKE.
+- Setup and enforce access control and security policies across all users, groups, projects, clusters, and clouds.
+- View the health and capacity of your Kubernetes clusters from a single-pane-of-glass.
+
+# Empower DevOps Teams
+
+Rancher provides an intuitive user interface for DevOps engineers to manage their application workload. The user does not need to have in-depth knowledge of Kubernetes concepts to start using Rancher. Rancher catalog contains a set of useful DevOps tools. Rancher is certified with a wide selection of cloud native ecosystem products, including, for example, security tools, monitoring systems, container registries, and storage and networking drivers.
+
+The following figure illustrates the role Rancher plays in IT and DevOps organizations. Each team deploys their applications on the public or private clouds they choose. IT administrators gain visibility and enforce policies across all users, clusters, and clouds.
+
+![Platform]({{<baseurl>}}/img/rancher/platform.png)
+
+# Features of the Rancher API Server
+
+The Rancher API server is built on top of an embedded Kubernetes API server and an etcd database. It implements the following functionalities:
+
+### Authorization and Role-Based Access Control
+
+-  **User management:** The Rancher API server [manages user identities]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
+-	**Authorization:** The Rancher API server manages [access control]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/) and [security]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/) policies.
+
+### Working with Kubernetes
+
+- **Provisioning Kubernetes clusters:** The Rancher API server can [provision Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/) on existing nodes, or perform [Kubernetes upgrades.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes)
+- **Catalog management:** Rancher provides the ability to use a [catalog of Helm charts]({{<baseurl>}}/rancher/v2.x/en/catalog/) that make it easy to repeatedly deploy applications.
+- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{<baseurl>}}/rancher/v2.x/en/project-admin/) and for [managing applications within projects.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/)
+- **Pipelines:** Setting up a [pipeline]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines/) can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects.
+- **Istio:** Our [integration with Istio]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/) is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+
+### Working with Cloud Infrastructure
+
+-  **Tracking nodes:** The Rancher API server tracks identities of all the [nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes/) in all clusters.
+- **Setting up infrastructure:**  When configured to use a cloud provider, Rancher can dynamically provision [new nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) and [persistent storage]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) in the cloud.
+
+### Cluster Visibility
+
+- **Logging:** Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters. Logging can be set up [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/logging/)
+- **Monitoring:** Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with Prometheus, a leading open-source monitoring solution. Monitoring can be configured [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/)
+- **Alerting:** To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. To help you stay informed of these events, you can configure alerts [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/)
+
+# Editing Downstream Clusters with Rancher
+
+The options and settings available for an existing cluster change based on the method that you used to provision it. For example, only clusters [provisioned by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) have **Cluster Options** available for editing.
+
+After a cluster is created with Rancher, a cluster administrator can manage cluster membership, enable pod security policies, and manage node pools, among [other options.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/)
+
+The following table summarizes the options and settings available for each cluster type:
+
+{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
diff --git a/content/rancher/v2.5/en/overview/architecture/_index.md b/content/rancher/v2.5/en/overview/architecture/_index.md
new file mode 100644
index 00000000000..8087bcc74a4
--- /dev/null
+++ b/content/rancher/v2.5/en/overview/architecture/_index.md
@@ -0,0 +1,203 @@
+---
+title: Architecture
+weight: 1
+---
+
+> This page is under construction.
+
+This section focuses on the Rancher server, its components, and how Rancher communicates with downstream Kubernetes clusters.
+
+> This section assumes a basic familiarity with Docker and Kubernetes. For a brief explanation of how Kubernetes components work together, refer to the [concepts]({{<baseurl>}}/rancher/v2.x/en/overview/concepts) page.
+
+This section covers the following topics:
+
+- [Components](#components)
+- [Installation](#installation)
+- [Features](#features)
+- [Infrastructure](#infrastructure)
+- [Architecture of the Enterprise Cluster Manager](#architecture-of-the-enterprise-cluster-manager)
+- [Communicating with downstream user clusters](#communicating-with-downstream-user-clusters)
+  - [The authentication proxy](#1-the-authentication-proxy)
+  - [Cluster controllers and cluster agents](#2-cluster-controllers-and-cluster-agents)
+  - [Node agents](#3-node-agents)
+  - [Authorized cluster endpoint](#4-authorized-cluster-endpoint)
+- [Important files](#important-files)
+- [Tools for provisioning Kubernetes clusters](#tools-for-provisioning-kubernetes-clusters)
+- [Rancher server components and source code](#rancher-server-components-and-source-code)
+
+# Components
+
+Rancher comes with to main components: the Rancher Helm chart, which is used for installing Rancher on a Kubernetes cluster, and the Rancher CLI. The CLI allows you to easily provision a Kubernetes cluster if you don't already have a cluster to install Rancher.
+
+
+# Installation
+
+There are two main ways that Rancher can be installed:
+
+1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
+2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
+
+The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
+
+# Features
+
+Rancher 2.5 allows many optional features to be enabled, including logging, monitoring, Istio, and the Enterprise Cluster Manager.
+
+For a list of main features of the Rancher API server, refer to the [overview section.]({{<baseurl>}}/rancher/v2.x/en/overview/#features-of-the-rancher-api-server)
+
+# Infrastructure
+
+For guidance about setting up the underlying infrastructure for the Rancher server, refer to the [architecture recommendations.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations)
+
+# Architecture of the Enterprise Cluster Manager
+
+The Enterprise Cluster Manager is an optional feature in Rancher. When enabled, it allows Rancher to centralize the authentication and management of multiple Kubernetes clusters.
+
+The majority of Rancher 2.x software runs on the Rancher Server. Rancher Server includes all the software components used to manage the entire Rancher deployment.
+
+The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two downstream Kubernetes clusters: one created by RKE and another created by Amazon EKS (Elastic Kubernetes Service).
+
+For the best performance and security, we recommend a dedicated Kubernetes cluster for the Rancher management server. Running user workloads on this cluster is not advised. After deploying Rancher, you can [create or import clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) for running your workloads.
+
+The diagram below shows how users can manipulate both [Rancher-launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters and [hosted Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) clusters through Rancher's authentication proxy:
+
+<figcaption>Managing Kubernetes Clusters through Rancher's Authentication Proxy</figcaption>
+
+![Architecture]({{<baseurl>}}/img/rancher/rancher-architecture-rancher-api-server.svg)
+
+You can install Rancher on a single node, or on a high-availability Kubernetes cluster.
+
+A high-availability Kubernetes installation is recommended for production. A Docker installation may be used for development and testing purposes, but there is no migration path from a single-node to a high-availability installation. Therefore, you may want to use a Kubernetes installation from the start.
+
+The Rancher server, regardless of the installation method, should always run on nodes that are separate from the downstream user clusters that it manages. If Rancher is installed on a high-availability Kubernetes cluster, it should run on a separate cluster from the cluster(s) it manages.
+
+# Communicating with Downstream User Clusters
+
+This section describes how Rancher provisions and manages the downstream user clusters that run your apps and services.
+
+The below diagram shows how the cluster controllers, cluster agents, and node agents allow Rancher to control downstream clusters.
+
+<figcaption>Communicating with Downstream Clusters</figcaption>
+
+![Rancher Components]({{<baseurl>}}/img/rancher/rancher-architecture-cluster-controller.svg)
+
+The following descriptions correspond to the numbers in the diagram above:
+
+1. [The Authentication Proxy](#1-the-authentication-proxy)
+2. [Cluster Controllers and Cluster Agents](#2-cluster-controllers-and-cluster-agents)
+3. [Node Agents](#3-node-agents)
+4. [Authorized Cluster Endpoint](#4-authorized-cluster-endpoint)
+
+### 1. The Authentication Proxy
+
+In this diagram, a user named Bob wants to see all pods running on a downstream user cluster called User Cluster 1. From within Rancher, he can run a `kubectl` command to see
+the pods. Bob is authenticated through Rancher's authentication proxy.
+
+The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters.
+
+Rancher communicates with Kubernetes clusters using a [service account,](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) which provides an identity for processes that run in a pod.
+
+By default, Rancher generates a [kubeconfig file]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`kube_config_rancher-cluster.yml`) contains full access to the cluster.
+
+### 2. Cluster Controllers and Cluster Agents
+
+Each downstream user cluster has a cluster agent, which opens a tunnel to the corresponding cluster controller within the Rancher server.
+
+There is one cluster controller and one cluster agent for each downstream cluster. Each cluster controller:
+
+- Watches for resource changes in the downstream cluster
+- Brings the current state of the downstream cluster to the desired state
+-  Configures access control policies to clusters and projects
+-  Provisions clusters by calling the required Docker machine drivers and Kubernetes engines, such as RKE and GKE
+
+By default, to enable Rancher to communicate with a downstream cluster, the cluster controller connects to the cluster agent. If the cluster agent is not available, the cluster controller can connect to a [node agent](#3-node-agents) instead.
+
+The cluster agent, also called `cattle-cluster-agent`, is a component that runs in a downstream user cluster. It performs the following tasks:
+
+-  Connects to the Kubernetes API of Rancher-launched Kubernetes clusters
+- Manages workloads, pod creation and deployment within each cluster
+-  Applies the roles and bindings defined in each cluster's global policies
+- Communicates between the cluster and Rancher server (through a tunnel to the cluster controller) about events, stats, node info, and health
+
+### 3. Node Agents
+
+If the cluster agent (also called `cattle-cluster-agent`) is not available, one of the node agents creates a tunnel to the cluster controller to communicate with Rancher.
+
+The `cattle-node-agent` is deployed using a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) resource to make sure it runs on every node in a Rancher-launched Kubernetes cluster. It is used to interact with the nodes when performing cluster operations. Examples of cluster operations include upgrading the Kubernetes version and creating or restoring etcd snapshots.
+
+### 4. Authorized Cluster Endpoint
+
+An authorized cluster endpoint allows users to connect to the Kubernetes API server of a downstream cluster without having to route their requests through the Rancher authentication proxy.
+
+> The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters) to provision the cluster. It is not available for imported clusters, or for clusters in a hosted Kubernetes provider, such as Amazon's EKS.
+
+There are two main reasons why a user might need the authorized cluster endpoint:
+
+- To access a downstream user cluster while Rancher is down
+- To reduce latency in situations where the Rancher server and downstream cluster are separated by a long distance
+
+The `kube-api-auth` microservice is deployed to provide the user authentication functionality for the authorized cluster endpoint. When you access the user cluster using `kubectl`, the cluster's Kubernetes API server authenticates you by using the `kube-api-auth` service as a webhook.
+
+Like the authorized cluster endpoint, the `kube-api-auth` authentication service is also only available for Rancher-launched Kubernetes clusters.
+
+> **Example scenario:** Let's say that the Rancher server is located in the United States, and User Cluster 1 is located in Australia. A user, Alice, also lives in Australia. Alice can manipulate resources in User Cluster 1 by using the Rancher UI, but her requests will have to be sent from Australia to the Rancher server in the United States, then be proxied back to Australia, where the downstream user cluster is. The geographical distance may cause significant latency, which Alice can reduce by using the authorized cluster endpoint.
+
+With this endpoint enabled for the downstream cluster, Rancher generates an extra Kubernetes context in the kubeconfig file in order to connect directly to the cluster. This file has the credentials for `kubectl` and `helm`. 
+
+You will need to use a context defined in this kubeconfig file to access the cluster if Rancher goes down. Therefore, we recommend exporting the kubeconfig file so that if Rancher goes down, you can still use the credentials in the file to access your cluster. For more information, refer to the section on accessing your cluster with [kubectl and the kubeconfig file.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl)
+
+# Important Files
+
+The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster:
+
+- `rancher-cluster.yml`: The RKE cluster configuration file.
+- `kube_config_rancher-cluster.yml`: The Kubeconfig file for the cluster, this file contains credentials for full access to the cluster. You can use this file to authenticate with a Rancher-launched Kubernetes cluster if Rancher goes down.
+- `rancher-cluster.rkestate`: The Kubernetes cluster state file. This file contains credentials for full access to the cluster. Note: This state file is only created when using RKE v0.2.0 or higher.
+
+> **Note:** The "rancher-cluster" parts of the two latter file names are dependent on how you name the RKE cluster configuration file.
+
+For more information on connecting to a cluster without the Rancher authentication proxy and other configuration options, refer to the [kubeconfig file]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) documentation.
+
+# Tools for Provisioning Kubernetes Clusters
+
+The tools that Rancher uses to provision downstream user clusters depends on the type of cluster that is being provisioned.
+
+### Rancher Launched Kubernetes for Nodes Hosted in an Infrastructure Provider
+
+Rancher can dynamically provision nodes in a provider such as Amazon EC2, DigitalOcean, Azure, or vSphere, then install Kubernetes on them.
+
+Rancher provisions this type of cluster using [RKE](https://github.com/rancher/rke) and [docker-machine.](https://github.com/rancher/machine)
+
+### Rancher Launched Kubernetes for Custom Nodes
+
+When setting up this type of cluster, Rancher installs Kubernetes on existing nodes, which creates a custom cluster.
+
+Rancher provisions this type of cluster using [RKE.](https://github.com/rancher/rke)
+
+### Hosted Kubernetes Providers
+
+When setting up this type of cluster, Kubernetes is installed by providers such as Google Kubernetes Engine, Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.
+
+Rancher provisions this type of cluster using [kontainer-engine.](https://github.com/rancher/kontainer-engine)
+
+### Imported Kubernetes Clusters
+
+In this type of cluster, Rancher connects to a Kubernetes cluster that has already been set up. Therefore, Rancher does not provision Kubernetes, but only sets up the Rancher agents to communicate with the cluster.
+
+# Rancher Server Components and Source Code
+
+This diagram shows each component that the Rancher server is composed of:
+
+![Rancher Components]({{<baseurl>}}/img/rancher/rancher-architecture-rancher-components.svg)
+
+The GitHub repositories for Rancher can be found at the following links:
+
+- [Main Rancher server repository](https://github.com/rancher/rancher)
+- [Rancher UI](https://github.com/rancher/ui)
+- [Rancher API UI](https://github.com/rancher/api-ui)
+- [Norman,](https://github.com/rancher/norman) Rancher's API framework
+- [Types](https://github.com/rancher/types)
+- [Rancher CLI](https://github.com/rancher/cli)
+- [Catalog applications](https://github.com/rancher/helm)
+
+This is a partial list of the most important Rancher repositories. For more details about Rancher source code, refer to the section on [contributing to Rancher.]({{<baseurl>}}/rancher/v2.x/en/contributing/#repositories) To see all libraries and projects used in Rancher, see the [`go.mod` file](https://github.com/rancher/rancher/blob/master/go.mod) in the `rancher/rancher` repository.
diff --git a/content/rancher/v2.5/en/overview/concepts/_index.md b/content/rancher/v2.5/en/overview/concepts/_index.md
new file mode 100644
index 00000000000..f4fe9fc26f0
--- /dev/null
+++ b/content/rancher/v2.5/en/overview/concepts/_index.md
@@ -0,0 +1,72 @@
+---
+title: Kubernetes Concepts
+weight: 4
+---
+
+This page explains concepts related to Kubernetes that are important for understanding how Rancher works. The descriptions below provide a simplified interview of Kubernetes components. For more details, refer to the [official documentation on Kubernetes components.](https://kubernetes.io/docs/concepts/overview/components/)
+
+This section covers the following topics:
+
+- [About Docker](#about-docker)
+- [About Kubernetes](#about-kubernetes)
+- [What is a Kubernetes Cluster?](#what-is-a-kubernetes-cluster)
+- [Roles for Nodes in Kubernetes Clusters](#roles-for-nodes-in-kubernetes-clusters)
+  - [etcd Nodes](#etcd-nodes)
+  - [Controlplane Nodes](#controlplane-nodes)
+  - [Worker Nodes](#worker-nodes)
+- [About Helm](#about-helm)
+
+# About Docker
+
+Docker is the container packaging and runtime standard. Developers build container images from Dockerfiles and distribute container images from Docker registries. [Docker Hub](https://hub.docker.com) is the most popular public registry. Many organizations also set up private Docker registries. Docker is primarily used to manage containers on individual nodes.
+
+>**Note:** Although Rancher 1.6 supported Docker Swarm clustering technology, it is no longer supported in Rancher 2.x due to the success of Kubernetes.
+
+# About Kubernetes
+
+Kubernetes is the container cluster management standard. YAML files specify containers and other resources that form an application. Kubernetes performs functions such as scheduling, scaling, service discovery, health check, secret management, and configuration management.
+
+# What is a Kubernetes Cluster?
+
+A cluster is a group of computers that work together as a single system.
+
+A _Kubernetes Cluster_ is a cluster that uses the [Kubernetes container-orchestration system](https://kubernetes.io/) to deploy, maintain, and scale Docker containers, allowing your organization to automate application operations.
+
+# Roles for Nodes in Kubernetes Clusters
+
+Each computing resource in a Kubernetes cluster is called a _node_. Nodes can be either bare-metal servers or virtual machines. Kubernetes classifies nodes into three types: _etcd_ nodes, _control plane_ nodes, and _worker_ nodes.
+
+A Kubernetes cluster consists of at least one etcd, controlplane, and worker node.
+
+### etcd Nodes
+
+Rancher uses etcd as a data store in both single node and high-availability installations. In Kubernetes, etcd is also a role for nodes that store the cluster state.
+
+The state of a Kubernetes cluster is maintained in [etcd.](https://kubernetes.io/docs/concepts/overview/components/#etcd)  The etcd nodes run the etcd database.
+
+The etcd database component is a distributed key-value store used as Kubernetes storage for all cluster data, such as cluster coordination and state management. It is recommended to run etcd on multiple nodes so that there's always a backup available for failover. 
+
+Although you can run etcd on just one node, etcd requires a majority of nodes, a quorum, to agree on updates to the cluster state. The cluster should always contain enough healthy etcd nodes to form a quorum. For a cluster with n members, a quorum is (n/2)+1. For any odd-sized cluster, adding one node will always increase the number of nodes necessary for a quorum.
+
+Three etcd nodes is generally sufficient for smaller clusters and five etcd nodes for large clusters.
+
+### Controlplane Nodes
+
+Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although two or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles.
+
+### Worker Nodes
+    
+Each [worker node](https://kubernetes.io/docs/concepts/architecture/nodes/) runs the following:
+
+- **Kubelets:** An agent that monitors the state of the node, ensuring your containers are healthy.
+- **Workloads:** The containers and pods that hold your apps, as well as other types of deployments.
+
+Worker nodes also run storage and networking drivers, and ingress controllers when required. You create as many worker nodes as necessary to run your  [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/).
+
+# About Helm
+
+For high-availability installations of Rancher, Helm is the tool used to install Rancher on a Kubernetes cluster.
+
+Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh).
+
+For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md b/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
new file mode 100644
index 00000000000..d9856c645d2
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
@@ -0,0 +1,13 @@
+---
+title: Rancher Kubernetes Cluster
+weight: 50
+---
+
+There are two main ways that Rancher can be installed:
+
+1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
+2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
+
+The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
+
+This section focuses on the installation path in which the Rancher CLI is used to provision a new Kubernetes cluster with the Rancher Helm chart built in.
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/installation/_index.md b/content/rancher/v2.5/en/rancher-cli-install-upgrade/installation/_index.md
new file mode 100644
index 00000000000..78532d14a1b
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-cli-install-upgrade/installation/_index.md
@@ -0,0 +1,10 @@
+---
+title: Installing the Rancher Kubernetes Cluster and Helm Chart
+weight: 1
+---
+
+> This page is under construction.
+
+In this section, you'll learn how to create a Rancher Kubernetes cluster that comes with the Rancher Helm chart built in.
+
+> To install Rancher on an existing Kubernetes cluster, refer to the instructions on [installing the Rancher Helm chart.](../../rancher-helm-install-upgrade/installation)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/_index.md b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/_index.md
new file mode 100644
index 00000000000..f797f83a0db
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/_index.md
@@ -0,0 +1,28 @@
+---
+title: Upgrading the Rancher Kubernetes Cluster and Helm Chart
+weight: 2
+---
+
+> This page is under construction.
+
+This page is about how to upgrade the local Kubernetes cluster that Rancher is installed on, as well as the Rancher Helm chart.
+
+This information applies if you set up the local Rancher server cluster using the Rancher CLI.
+
+To upgrade the Rancher server's local Kubernetes cluster using the Rancher CLI, you will first upgrade the master nodes of the cluster, and then the worker nodes.
+
+### About Rancher Kubernetes
+
+Rancher is intended to be installed on any Kubernetes cluster.
+
+The Rancher CLI comes with a Kubernetes distribution called Rancher Kubernetes, which allows you to install Kubernetes more easily as a prerequisite to installing Rancher.
+
+Rancher Kubernetes clusters can also be imported into Rancher.
+
+
+### Known Upgrade Issues
+
+A list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
+
+### Caveats
+Upgrades _to_ or _from_ any chart in the [rancher-alpha repository]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories/) aren't supported.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/_index.md b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/_index.md
new file mode 100644
index 00000000000..f33386702a1
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/_index.md
@@ -0,0 +1,8 @@
+---
+title: Cluster Upgrade
+weight: 2
+---
+
+> This section is under construction.
+
+In this section, you'll learn how to upgrade the Rancher Helm chart and the master nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/woker-node-upgrade/_index.md b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
new file mode 100644
index 00000000000..76f04a09ac2
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
@@ -0,0 +1,8 @@
+---
+title: Worker Node Upgrade
+weight: 1
+---
+
+> This page is under construction.
+
+In this section, you'll learn how to upgrade the worker nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/image-upgrade/_index.md b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/image-upgrade/_index.md
new file mode 100644
index 00000000000..c68c3d159e7
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/image-upgrade/_index.md
@@ -0,0 +1,6 @@
+---
+title: Upgrade the Rancher Image
+weight: 1
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
new file mode 100644
index 00000000000..1547b7a49d4
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
@@ -0,0 +1,16 @@
+---
+title: Rancher - Helm Chart Only
+description: Learn how to install Rancher in development and production environments. Read about single node and high availability installation
+weight: 51
+---
+
+> This section is under construction.
+
+There are two main ways that Rancher can be installed:
+
+1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
+2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
+
+The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
+
+This section focuses on the installation path in which the Rancher Helm chart is installed on an existing Kubernetes cluster.
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/_index.md
new file mode 100644
index 00000000000..2060efc8703
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/_index.md
@@ -0,0 +1,274 @@
+---
+title: Installing the Rancher Helm Chart
+weight: 1
+---
+
+> **Prerequisite:**
+> Set up the Rancher Kubernetes cluster. Rancher can be installed on any Kubernetes cluster.
+>
+> This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
+
+# Install the Rancher Helm Chart
+
+Rancher is installed using the Helm package manager for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents.
+
+With Helm, we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at https://helm.sh/.
+
+For systems without direct internet access, see [Air Gap: Kubernetes install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/).
+
+To choose a Rancher version to install, refer to [Choosing a Rancher Version.]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags)
+
+To choose a version of Helm to install Rancher with, refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version)
+
+> **Note:** The installation instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older installation instructions for Rancher installed on an RKE Kubernetes cluster with Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
+
+To set up Rancher,
+
+1. [Install the required CLI tools](#1-install-the-required-cli-tools)
+2. [Add the Helm chart repository](#2-add-the-helm-chart-repository)
+3. [Create a namespace for Rancher](#3-create-a-namespace-for-rancher)
+4. [Choose your SSL configuration](#4-choose-your-ssl-configuration)
+5. [Install cert-manager](#5-install-cert-manager) (unless you are bringing your own certificates, or TLS will be terminated on a load balancer)
+6. [Install Rancher with Helm and your chosen certificate option](#6-install-rancher-with-helm-and-your-chosen-certificate-option)
+7. [Verify that the Rancher server is successfully deployed](#7-verify-that-the-rancher-server-is-successfully-deployed)
+8. [Save your options](#8-save-your-options)
+
+### 1. Install the Required CLI Tools
+
+The following CLI tools are required for setting up the Kubernetes cluster. Please make sure these tools are installed and available in your `$PATH`.
+
+Refer to the [instructions provided by the Helm project](https://helm.sh/docs/intro/install/) for your specific platform.
+
+- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool.
+- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
+
+### 2. Add the Helm Chart Repository
+
+Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
+
+{{< release-channel >}}
+
+```
+helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
+```
+
+### 3. Create a Namespace for Rancher
+
+We'll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be `cattle-system`:
+
+```
+kubectl create namespace cattle-system
+```
+
+### 4. Choose your SSL Configuration
+
+The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
+
+> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
+
+There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
+
+- **Rancher-generated TLS certificate:** In this case, you will need to install `cert-manager` into the cluster. Rancher utilizes `cert-manager` to issue and maintain its certificates. Rancher will generate a CA certificate of its own, and sign a cert using that CA. `cert-manager` is then responsible for managing that certificate.
+- **Let's Encrypt:** The Let's Encrypt option also uses `cert-manager`. However, in this case, cert-manager is combined with a special Issuer for Let's Encrypt that performs all actions (including request and validation) necessary for getting a Let's Encrypt issued cert. This configuration uses HTTP validation (`HTTP-01`), so the load balancer must have a public DNS record and be accessible from the internet.
+- **Bring your own certificate:** This option allows you to bring your own public- or private-CA signed certificate. Rancher will use that certificate to secure websocket and HTTPS traffic. In this case, you must upload this certificate (and associated key) as PEM-encoded files with the name `tls.crt` and `tls.key`. If you are using a private CA, you must also upload that certificate. This is due to the fact that this private CA may not be trusted by your nodes. Rancher will take that CA certificate, and generate a checksum from it, which the various Rancher components will use to validate their connection to Rancher.
+
+
+| Configuration                  | Helm Chart Option           | Requires cert-manager                 |
+| ------------------------------ | ----------------------- | ------------------------------------- |
+| Rancher Generated Certificates (Default) | `ingress.tls.source=rancher`  | [yes](#5-install-cert-manager) |
+| Let’s Encrypt                  | `ingress.tls.source=letsEncrypt`  | [yes](#5-install-cert-manager) |
+| Certificates from Files        | `ingress.tls.source=secret`        | no               |
+
+### 5. Install cert-manager
+
+> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination). 
+
+This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`).
+
+{{% accordion id="cert-manager" label="Click to Expand" %}}
+
+> **Important:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
+
+These instructions are adapted from the [official cert-manager documentation](https://cert-manager.io/docs/installation/kubernetes/#installing-with-helm).
+
+```
+# Install the CustomResourceDefinition resources separately
+kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.0/cert-manager.crds.yaml
+
+# **Important:**
+# If you are running Kubernetes v1.15 or below, you
+# will need to add the `--validate=false` flag to your
+# kubectl apply command, or else you will receive a
+# validation error relating to the
+# x-kubernetes-preserve-unknown-fields field in
+# cert-manager’s CustomResourceDefinition resources.
+# This is a benign error and occurs due to the way kubectl
+# performs resource validation.
+
+# Create the namespace for cert-manager
+kubectl create namespace cert-manager
+
+# Add the Jetstack Helm repository
+helm repo add jetstack https://charts.jetstack.io
+
+# Update your local Helm chart repository cache
+helm repo update
+
+# Install the cert-manager Helm chart
+helm install \
+  cert-manager jetstack/cert-manager \
+  --namespace cert-manager \
+  --version v0.15.0
+```
+
+Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
+
+```
+kubectl get pods --namespace cert-manager
+
+NAME                                       READY   STATUS    RESTARTS   AGE
+cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
+cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
+cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m
+```
+
+{{% /accordion %}}
+
+### 6. Install Rancher with Helm and Your Chosen Certificate Option
+
+The exact command to install Rancher differs depending on the certificate configuration.
+
+{{% tabs %}}
+{{% tab "Rancher-generated Certificates" %}}
+
+
+The default is for Rancher to generate a CA and uses `cert-manager` to issue the certificate for access to the Rancher server interface.
+
+Because `rancher` is the default option for `ingress.tls.source`, we are not specifying `ingress.tls.source` when running the `helm install` command.
+
+- Set the `hostname` to the DNS name you pointed at your load balancer.
+- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
+- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`
+
+```
+helm install rancher rancher-<CHART_REPO>/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org
+```
+
+Wait for Rancher to be rolled out:
+
+```
+kubectl -n cattle-system rollout status deploy/rancher
+Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
+deployment "rancher" successfully rolled out
+```
+
+{{% /tab %}}
+{{% tab "Let's Encrypt" %}}
+
+This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA.
+
+In the following command,
+
+- `hostname` is set to the public DNS record,
+- `ingress.tls.source` is set to `letsEncrypt`
+- `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices)
+- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
+
+```
+helm install rancher rancher-<CHART_REPO>/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=letsEncrypt \
+  --set letsEncrypt.email=me@example.org
+```
+
+Wait for Rancher to be rolled out:
+
+```
+kubectl -n cattle-system rollout status deploy/rancher
+Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
+deployment "rancher" successfully rolled out
+```
+
+{{% /tab %}}
+{{% tab "Certificates from Files" %}}
+In this option, Kubernetes secrets are created from your own certificates for Rancher to use.
+
+When you run this command, the `hostname` option must match the `Common Name` or a `Subject Alternative Names` entry in the server certificate or the Ingress controller will fail to configure correctly.
+
+Although an entry in the `Subject Alternative Names` is technically required, having a matching `Common Name` maximizes compatibility with older browsers and applications.
+
+> If you want to check if your certificates are correct, see [How do I check Common Name and Subject Alternative Names in my server certificate?]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-do-i-check-common-name-and-subject-alternative-names-in-my-server-certificate)
+
+- Set the `hostname`.
+- Set `ingress.tls.source` to `secret`.
+- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
+
+```
+helm install rancher rancher-<CHART_REPO>/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=secret
+```
+
+If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
+
+```
+helm install rancher rancher-latest/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=secret \
+  --set privateCA=true
+```
+
+Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the Ingress controller can use them.
+{{% /tab %}}
+{{% /tabs %}}
+
+The Rancher chart configuration has many options for customizing the installation to suit your specific environment. Here are some common advanced scenarios.
+
+- [HTTP Proxy]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#http-proxy)
+- [Private Docker Image Registry]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#private-registry-and-air-gap-installs)
+- [TLS Termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
+
+See the [Chart Options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/) for the full list of options.
+
+
+### 7. Verify that the Rancher Server is Successfully Deployed
+
+After adding the secrets, check if Rancher was rolled out successfully:
+
+```
+kubectl -n cattle-system rollout status deploy/rancher
+Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
+deployment "rancher" successfully rolled out
+```
+
+If you see the following error: `error: deployment "rancher" exceeded its progress deadline`, you can check the status of the deployment by running the following command:
+
+```
+kubectl -n cattle-system get deploy rancher
+NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
+rancher   3         3         3            3           3m
+```
+
+It should show the same count for `DESIRED` and `AVAILABLE`.
+
+### 8. Save Your Options
+
+Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
+
+### Finishing Up
+
+That's it. You should have a functional Rancher server.
+
+In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
+
+Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) Page
+
+
+### Optional Next Steps
+
+Enable the Enterprise Cluster Manager.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/chart-options/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/chart-options/_index.md
new file mode 100644
index 00000000000..136c827cf4a
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/chart-options/_index.md
@@ -0,0 +1,261 @@
+---
+title: Helm Chart Options
+weight: 2
+---
+
+> This page is under construction.
+
+- [Common Options](#common-options)
+- [Advanced Options](#advanced-options)
+- [API Audit Log](#api-audit-log)
+- [Setting Extra Environment Variables](#setting-extra-environment-variables)
+- [TLS Settings](#tls-settings)
+- [Import local Cluster](#import-local-cluster)
+- [Customizing your Ingress](#customizing-your-ingress)
+- [HTTP Proxy](#http-proxy)
+- [Additional Trusted CAs](#additional-trusted-cas)
+- [Private Registry and Air Gap Installs](#private-registry-and-air-gap-installs)
+- [External TLS Termination](#external-tls-termination)
+
+### Common Options
+
+| Option                    | Default Value | Description                                                                        |
+| ------------------------- | ------------- | ---------------------------------------------------------------------------------- |
+| `hostname`                | " "           | `string` - the Fully Qualified Domain Name for your Rancher Server                 |
+| `ingress.tls.source`      | "rancher"     | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
+| `letsEncrypt.email`       | " "           | `string` - Your email address                                                      |
+| `letsEncrypt.environment` | "production"  | `string` - Valid options: "staging, production"                                    |
+| `privateCA`               | false         | `bool` - Set to true if your cert is signed by a private CA                        |
+
+<br/>
+
+### Advanced Options
+
+| Option                         | Default Value                                         | Description                                                                                                                                       |
+| ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `additionalTrustedCAs`         | false                                                 | `bool` - See [Additional Trusted CAs](#additional-trusted-cas)                                                                                    |
+| `addLocal`                     | "auto"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster)                       |
+| `antiAffinity`                 | "preferred"                                           | `string` - AntiAffinity rule for Rancher pods - "preferred, required"                                                                             |
+| `replicas`                     | 3                                                     | `int` - Number of replicas of Rancher pods                                                                                                        |
+| `auditLog.destination`         | "sidecar"                                             | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath"                                                           |
+| `auditLog.hostPath`            | "/var/log/rancher/audit"                              | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`)                                           |
+| `auditLog.level`               | 0                                                     | `int` - set the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) level. 0 is off. [0-3]                                   |
+| `auditLog.maxAge`              | 1                                                     | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`)                      |
+| `auditLog.maxBackups`          | 1                                                     | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`)                               |
+| `auditLog.maxSize`             | 100                                                   | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`)    |
+| `busyboxImage`                 | "busybox"                                             | `string` - Image location for busybox image used to collect audit logs _Note: Available as of v2.2.0_                                             |
+| `debug`                        | false                                                 | `bool` - set debug flag on rancher server                                                                                                         |
+| `certmanager.version`          | ""                                                    | `string` - set cert-manager compatibility                                                                                                         |
+| `extraEnv`                     | []                                                    | `list` - set additional environment variables for Rancher _Note: Available as of v2.2.0_                                                          |
+| `imagePullSecrets`             | []                                                    | `list` - list of names of Secret resource containing private registry credentials                                                                 |
+| `ingress.extraAnnotations`     | {}                                                    | `map` - additional annotations to customize the ingress                                                                                           |
+| `ingress.configurationSnippet` | ""                                                    | `string` - Add additional Nginx configuration. Can be used for proxy configuration. _Note: Available as of v2.0.15, v2.1.10 and v2.2.4_           |
+| `letsEncrypt.ingress.class`    | ""                                                    | `string` - optional ingress class for the cert-manager acmesolver ingress that responds to the Let's Encrypt ACME challenges                      |
+| `proxy`                        | ""                                                    | `string` - HTTP[S] proxy server for Rancher                                                                                                       |
+| `noProxy`                      | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" | `string` - comma separated list of hostnames or ip address not to use the proxy                                                                   |
+| `resources`                    | {}                                                    | `map` - rancher pod resource requests & limits                                                                                                    |
+| `rancherImage`                 | "rancher/rancher"                                     | `string` - rancher image source                                                                                                                   |
+| `rancherImageTag`              | same as chart version                                 | `string` - rancher/rancher image tag                                                                                                              |
+| `rancherImagePullPolicy`       | "IfNotPresent"                                        | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent"                                                 |
+| `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
+| `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/ _Available as of v2.3.0_                  |
+| `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. _Available as of v2.3.0_ |
+
+<br/>
+
+### API Audit Log
+
+Enabling the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing/).
+
+You can collect this log as you would any container log. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the `System` Project on the Rancher server cluster.
+
+```plain
+--set auditLog.level=1
+```
+
+By default enabling Audit Logging will create a sidecar container in the Rancher pod. This container (`rancher-audit-log`) will stream the log to `stdout`. You can collect this log as you would any container log. When using the sidecar as the audit log destination, the `hostPath`, `maxAge`, `maxBackups`, and `maxSize` options do not apply. It's advised to use your OS or Docker daemon's log rotation features to control disk space use. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the Rancher server cluster or System Project.
+
+Set the `auditLog.destination` to `hostPath` to forward logs to volume shared with the host system instead of streaming to a sidecar container. When setting the destination to `hostPath` you may want to adjust the other auditLog parameters for log rotation.
+
+### Setting Extra Environment Variables
+
+_Available as of v2.2.0_
+
+You can set extra environment variables for Rancher server using `extraEnv`. This list uses the same `name` and `value` keys as the container manifest definitions. Remember to quote the values.
+
+```plain
+--set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
+--set 'extraEnv[0].value=1.0'
+```
+
+### TLS Settings
+
+_Available as of v2.2.0_
+
+To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
+
+```plain
+--set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
+--set 'extraEnv[0].value=1.0'
+```
+
+See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options.
+
+### Import `local` Cluster
+
+By default Rancher server will detect and import the `local` cluster it's running on. User with access to the `local` cluster will essentially have "root" access to all the clusters managed by Rancher server.
+
+If this is a concern in your environment you can set this option to "false" on your initial install.
+
+> Note: This option is only effective on the initial Rancher install. See [Issue 16522](https://github.com/rancher/rancher/issues/16522) for more information.
+
+```plain
+--set addLocal="false"
+```
+
+### Customizing your Ingress
+
+To customize or use a different ingress with Rancher server you can set your own Ingress annotations.
+
+Example on setting a custom certificate issuer:
+
+```plain
+--set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair
+```
+
+_Available as of v2.0.15, v2.1.10 and v2.2.4_
+
+Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used.
+
+```plain
+--set ingress.configurationSnippet='more_set_input_headers X-Forwarded-Host {{ .Values.hostname }};'
+```
+
+### HTTP Proxy
+
+Rancher requires internet access for some functionality (helm charts). Use `proxy` to set your proxy server.
+
+Add your IP exceptions to the `noProxy` list. Make sure you add the Service cluster IP range (default: 10.43.0.1/16) and any worker cluster `controlplane` nodes. Rancher supports CIDR notation ranges in this list.
+
+```plain
+--set proxy="http://<username>:<password>@<proxy_url>:<proxy_port>/"
+--set noProxy="127.0.0.0/8\,10.0.0.0/8\,172.16.0.0/12\,192.168.0.0/16"
+```
+
+### Additional Trusted CAs
+
+If you have private registries, catalogs or a proxy that intercepts certificates, you may need to add additional trusted CAs to Rancher.
+
+```plain
+--set additionalTrustedCAs=true
+```
+
+Once the Rancher deployment is created, copy your CA certs in pem format into a file named `ca-additional.pem` and use `kubectl` to create the `tls-ca-additional` secret in the `cattle-system` namespace.
+
+```plain
+kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem
+```
+
+### Private Registry and Air Gap Installs
+
+For details on installing Rancher with a private registry, see:
+
+- [Air Gap: Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/)
+- [Air Gap: Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/)
+
+### External TLS Termination
+
+We recommend configuring your load balancer as a Layer 4 balancer, forwarding plain 80/tcp and 443/tcp to the Rancher Management cluster nodes. The Ingress Controller on the cluster will redirect http traffic on port 80 to https on port 443.
+
+You may terminate the SSL/TLS on a L7 load balancer external to the Rancher cluster (ingress). Use the `--set tls=external` option and point your load balancer at port http 80 on all of the Rancher cluster nodes. This will expose the Rancher interface on http port 80. Be aware that clients that are allowed to connect directly to the Rancher cluster will not be encrypted. If you choose to do this we recommend that you restrict direct access at the network level to just your load balancer.
+
+> **Note:** If you are using a Private CA signed certificate, add `--set privateCA=true` and see [Adding TLS Secrets - Using a Private CA Signed Certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/#using-a-private-ca-signed-certificate) to add the CA cert for Rancher.
+
+Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly.
+
+#### Configuring Ingress for External TLS when Using NGINX v0.25
+
+In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress:
+
+```yaml
+ingress:
+  provider: nginx
+  options:
+    use-forwarded-headers: 'true'
+```
+
+#### Required Headers
+
+- `Host`
+- `X-Forwarded-Proto`
+- `X-Forwarded-Port`
+- `X-Forwarded-For`
+
+#### Recommended Timeouts
+
+- Read Timeout: `1800 seconds`
+- Write Timeout: `1800 seconds`
+- Connect Timeout: `30 seconds`
+
+#### Health Checks
+
+Rancher will respond `200` to health checks on the `/healthz` endpoint.
+
+#### Example NGINX config
+
+This NGINX configuration is tested on NGINX 1.14.
+
+> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/).
+
+- Replace `IP_NODE1`, `IP_NODE2` and `IP_NODE3` with the IP addresses of the nodes in your cluster.
+- Replace both occurrences of `FQDN` to the DNS name for Rancher.
+- Replace `/certs/fullchain.pem` and `/certs/privkey.pem` to the location of the server certificate and the server certificate key respectively.
+
+```
+worker_processes 4;
+worker_rlimit_nofile 40000;
+
+events {
+    worker_connections 8192;
+}
+
+http {
+    upstream rancher {
+        server IP_NODE_1:80;
+        server IP_NODE_2:80;
+        server IP_NODE_3:80;
+    }
+
+    map $http_upgrade $connection_upgrade {
+        default Upgrade;
+        ''      close;
+    }
+
+    server {
+        listen 443 ssl http2;
+        server_name FQDN;
+        ssl_certificate /certs/fullchain.pem;
+        ssl_certificate_key /certs/privkey.pem;
+
+        location / {
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_pass http://rancher;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
+            proxy_read_timeout 900s;
+            proxy_buffering off;
+        }
+    }
+
+    server {
+        listen 80;
+        server_name FQDN;
+        return 301 https://$server_name$request_uri;
+    }
+}
+```
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/choosing-version/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/choosing-version/_index.md
new file mode 100644
index 00000000000..36edeae1f5a
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/choosing-version/_index.md
@@ -0,0 +1,91 @@
+---
+title: Choosing a Rancher Version
+weight: 1
+---
+
+This section describes how to choose a Rancher version.
+
+For a high-availability installation of Rancher, which is recommended for production, the Rancher server is installed using a **Helm chart** on a Kubernetes cluster. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
+
+For Docker installations of Rancher, which is used for development and testing, you will install Rancher as a **Docker image.**
+
+{{% tabs %}}
+{{% tab "Helm Charts" %}}
+
+When installing, upgrading, or rolling back Rancher Server when it is [installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/), Rancher server is installed using a Helm chart on a Kubernetes cluster. Therefore, as you prepare to install or upgrade a high availability Rancher configuration, you must add a Helm chart repository that contains the charts for installing Rancher.
+
+Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
+
+### Helm Chart Repositories
+
+Rancher provides several different Helm chart repositories to choose from. We align our latest and stable Helm chart repositories with the Docker tags that are used for a Docker installation. Therefore, the `rancher-latest` repository will contain charts for all the Rancher versions that have been tagged as `rancher/rancher:latest`. When a Rancher version has been promoted to the `rancher/rancher:stable`, it will get added to the `rancher-stable` repository.
+
+| Type           | Command to Add the Repo                                                          | Description of the Repo            |
+| -------------- | ------------ | ----------------- |
+| rancher-latest | `helm repo add rancher-latest https://releases.rancher.com/server-charts/latest` | Adds a repository of Helm charts for the latest versions of Rancher. We recommend using this repo for testing out new Rancher builds.                                                                                                                                                      |
+| rancher-stable | `helm repo add rancher-stable https://releases.rancher.com/server-charts/stable` | Adds a repository of Helm charts for older, stable versions of Rancher. We recommend using this repo for production environments.                                                                                                                                                          |
+| rancher-alpha  | `helm repo add rancher-alpha https://releases.rancher.com/server-charts/alpha`   | Adds a repository of Helm charts for alpha versions of Rancher for previewing upcoming releases. These releases are discouraged in production environments. Upgrades _to_ or _from_ charts in the rancher-alpha repository to any other chart, regardless or repository, aren't supported. |
+
+<br/>
+Instructions on when to select these repos are available below in [Switching to a Different Helm Chart Repository](#switching-to-a-different-helm-chart-repository).
+
+> **Note:** The introduction of the `rancher-latest` and `rancher-stable` Helm Chart repositories was introduced after Rancher v2.1.0, so the `rancher-stable` repository contains some Rancher versions that were never marked as `rancher/rancher:stable`. The versions of Rancher that were tagged as `rancher/rancher:stable` prior to v2.1.0 are v2.0.4, v2.0.6, v2.0.8. Post v2.1.0, all charts in the `rancher-stable` repository will correspond with any Rancher version tagged as `stable`.
+
+### Helm Chart Versions
+
+Rancher Helm chart versions match the Rancher version (i.e `appVersion`).
+
+For the Rancher v2.1.x versions, there were some Helm charts, that were using a version that was a build number, i.e. `yyyy.mm.<build-number>`. These charts have been replaced with the equivalent Rancher version and are no longer available.
+
+### Switching to a Different Helm Chart Repository
+
+After installing Rancher, if you want to change which Helm chart repository to install Rancher from, you will need to follow these steps.
+
+> **Note:** Because the rancher-alpha repository contains only alpha charts, switching between the rancher-alpha repository and the rancher-stable or rancher-latest repository for upgrades is not supported.
+
+{{< release-channel >}}
+
+1. List the current Helm chart repositories.
+
+    ```plain
+    helm repo list
+
+    NAME          	      URL
+    stable        	      https://kubernetes-charts.storage.googleapis.com
+    rancher-<CHART_REPO>		https://releases.rancher.com/server-charts/<CHART_REPO>
+    ```
+
+2. Remove the existing Helm Chart repository that contains your charts to install Rancher, which will either be `rancher-stable` or `rancher-latest` depending on what you had initially added.
+
+    ```plain
+    helm repo remove rancher-<CHART_REPO>
+    ```
+
+3. Add the Helm chart repository that you want to start installing Rancher from.
+
+    ```plain
+    helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
+    ```
+
+4. Continue to follow the steps to [upgrade Rancher]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/) from the new Helm chart repository.
+{{% /tab %}}
+{{% tab "Docker Images" %}}
+When performing [Docker installs]({{<baseurl>}}/rancher/v2.x/en/installation/single-node), upgrades, or rollbacks, you can use _tags_ to install a specific version of Rancher.
+
+### Server Tags
+
+Rancher Server is distributed as a Docker image, which have tags attached to them. You can specify this tag when entering the command to deploy Rancher. Remember that if you use a tag without an explicit version (like `latest` or `stable`), you must explicitly pull a new version of that image tag. Otherwise, any image cached on the host will be used.
+
+| Tag                        | Description   |
+| -------------------------- | ------ |
+| `rancher/rancher:latest`   | Our latest development release. These builds are validated through our CI automation framework. These releases are not recommended for production environments. |
+| `rancher/rancher:stable`   | Our newest stable release. This tag is recommended for production.                                                                                              |
+| `rancher/rancher:<v2.X.X>` | You can install specific versions of Rancher by using the tag from a previous release. See what's available at DockerHub.                                       |
+
+> **Notes:**
+>
+> - The `master` tag or any tag with `-rc` or another suffix is meant for the Rancher testing team to validate. You should not use these tags, as these builds are not officially supported.
+> - Want to install an alpha review for preview? Install using one of the alpha tags listed on our [announcements page](https://forums.rancher.com/c/announcements) (e.g., `v2.2.0-alpha1`). Caveat: Alpha releases cannot be upgraded to or from any other release.
+
+{{% /tab %}} 
+{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/helm-version/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/helm-version/_index.md
new file mode 100644
index 00000000000..3a91781871a
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/helm-version/_index.md
@@ -0,0 +1,12 @@
+---
+title: Helm Version Requirements
+weight: 3
+---
+
+This section contains the requirements for Helm, which is the tool used to install Rancher on a high-availability Kubernetes cluster.
+
+> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
+
+- Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using.
+- Helm v2.15.0 should not be used, because of an issue with converting/comparing numbers.
+- Helm v2.12.0 should not be used, because of an issue with `cert-manager`.
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/_index.md
new file mode 100644
index 00000000000..5743469d2de
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/_index.md
@@ -0,0 +1,30 @@
+---
+title: Resources and Other Installation Methods
+weight: 3
+---
+
+> This section is under construction.
+
+### Docker Installations
+
+The [single-node Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster using Helm, you install the Rancher server component on a single node using a `docker run` command.
+
+Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server.
+
+### Air Gapped Installations
+
+Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) to install the Rancher server in an air gapped environment.
+
+An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
+
+### Advanced Options
+
+When installing Rancher, there are several advanced options that can be enabled during installation. Within each install guide, these options are presented. Learn more about these options:
+
+| Advanced Option                                                                                                         | Available as of |
+| ----------------------------------------------------------------------------------------------------------------------- | --------------- |
+| [Custom CA Certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/custom-ca-root-certificate/)                 | v2.0.0          |
+| [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/options/api-audit-log/)                                      | v2.0.0          |
+| [TLS Settings]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-settings/)                                        | v2.1.7          |
+| [etcd configuration]({{<baseurl>}}/rancher/v2.x/en/installation/options/etcd/)                                          | v2.2.0          |
+| [Local System Charts for Air Gap Installations]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts) | v2.3.0          |
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/_index.md
new file mode 100644
index 00000000000..6087cf17317
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/_index.md
@@ -0,0 +1,6 @@
+---
+title: Advanced
+weight: 5
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/api-audit-log/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/api-audit-log/_index.md
new file mode 100644
index 00000000000..d68051fc7bb
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/api-audit-log/_index.md
@@ -0,0 +1,577 @@
+---
+title: Enabling the API Audit Log to Record System Events
+weight: 4
+---
+
+You can enable the API audit log to record the sequence of system events initiated by individual users. You can know what happened, when it happened, who initiated it, and what cluster it affected. When you enable this feature, all requests to the Rancher API and all responses from it are written to a log.
+
+You can enable API Auditing during Rancher installation or upgrade.
+
+## Enabling API Audit Log
+
+The Audit Log is enabled and configured by passing environment variables to the Rancher server container. See the following to enable on your installation.
+
+- [Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#api-audit-log)
+
+- [Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#api-audit-log)
+
+## API Audit Log Options
+
+The usage below defines rules about what the audit log should record and what data it should include:
+
+| Parameter                             | Description                                                                                                                                                                                                                                                                                                                                                                    |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| <a id="audit-level"></a>`AUDIT_LEVEL` | `0` - Disable audit log (default setting).<br/>`1` - Log event metadata.<br/>`2` - Log event metadata and request body.</br>`3` - Log event metadata, request body, and response body. Each log transaction for a request/response pair uses the same `auditID` value.<br/><br/>See [Audit Level Logging](#audit-log-levels) for a table that displays what each setting logs. |
+| `AUDIT_LOG_PATH`                      | Log path for Rancher Server API. Default path is `/var/log/auditlog/rancher-api-audit.log`. You can mount the log directory to host. <br/><br/>Usage Example: `AUDIT_LOG_PATH=/my/custom/path/`<br/>                                                                                                                                                                           |
+| `AUDIT_LOG_MAXAGE`                    | Defined the maximum number of days to retain old audit log files. Default is 10 days.                                                                                                                                                                                                                                                                                          |
+| `AUDIT_LOG_MAXBACKUP`                 | Defines the maximum number of audit log files to retain. Default is 10.                                                                                                                                                                                                                                                                                                        |
+| `AUDIT_LOG_MAXSIZE`                   | Defines the maximum size in megabytes of the audit log file before it gets rotated. Default size is 100M.                                                                                                                                                                                                                                                                      |
+
+<br/>
+
+### Audit Log Levels
+
+The following table displays what parts of API transactions are logged for each [`AUDIT_LEVEL`](#audit-level) setting.
+
+| `AUDIT_LEVEL` Setting | Request Metadata | Request Body | Response Metadata | Response Body |
+| --------------------- | ---------------- | ------------ | ----------------- | ------------- |
+| `0`                   |                  |              |                   |               |
+| `1`                   | ✓                |              |                   |               |
+| `2`                   | ✓                | ✓            |                   |               |
+| `3`                   | ✓                | ✓            | ✓                 | ✓             |
+
+## Viewing API Audit Logs
+
+### Docker Install
+
+Share the `AUDIT_LOG_PATH` directory (Default: `/var/log/auditlog`) with the host system. The log can be parsed by standard CLI tools or forwarded on to a log collection tool like Fluentd, Filebeat, Logstash, etc.
+
+### Kubernetes Install
+
+Enabling the API Audit Log with the Helm chart install will create a `rancher-audit-log` sidecar container in the Rancher pod. This container will stream the log to standard output (stdout). You can view the log as you would any container log.
+
+The `rancher-audit-log` container is part of the `rancher` pod in the `cattle-system` namespace.
+
+#### CLI
+
+```bash
+kubectl -n cattle-system logs -f rancher-84d886bdbb-s4s69 rancher-audit-log
+```
+
+#### Rancher Web GUI
+
+1. From the context menu, select **Cluster: local > System**.
+
+   ![Local Cluster: System Project]({{<baseurl>}}/img/rancher/audit_logs_gui/context_local_system.png)
+
+1. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Find the `cattle-system` namespace. Open the `rancher` workload by clicking its link.
+
+   ![Rancher Workload]({{<baseurl>}}/img/rancher/audit_logs_gui/rancher_workload.png)
+
+1. Pick one of the `rancher` pods and select **&#8942; > View Logs**.
+
+   ![View Logs]({{<baseurl>}}/img/rancher/audit_logs_gui/view_logs.png)
+
+1. From the **Logs** drop-down, select `rancher-audit-log`.
+
+   ![Select Audit Log]({{<baseurl>}}/img/rancher/audit_logs_gui/rancher_audit_log_container.png)
+
+#### Shipping the Audit Log
+
+You can enable Rancher's built in log collection and shipping for the cluster to ship the audit and other services logs to a supported collection endpoint. See [Rancher Tools - Logging]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging) for details.
+
+## Audit Log Samples
+
+After you enable auditing, each API request or response is logged by Rancher in the form of JSON. Each of the following code samples provide examples of how to identify each API transaction.
+
+### Metadata Level
+
+If you set your `AUDIT_LEVEL` to `1`, Rancher logs the metadata header for every API request, but not the body. The header provides basic information about the API transaction, such as the transaction's ID, who initiated the transaction, the time it occurred, etc.
+
+```json
+{
+  "auditID": "30022177-9e2e-43d1-b0d0-06ef9d3db183",
+  "requestURI": "/v3/schemas",
+  "sourceIPs": ["::1"],
+  "user": {
+    "name": "user-f4tt2",
+    "group": ["system:authenticated"]
+  },
+  "verb": "GET",
+  "stage": "RequestReceived",
+  "stageTimestamp": "2018-07-20 10:22:43 +0800"
+}
+```
+
+### Metadata and Request Body Level
+
+If you set your `AUDIT_LEVEL` to `2`, Rancher logs the metadata header and body for every API request.
+
+The code sample below depicts an API request, with both its metadata header and body.
+
+```json
+{
+  "auditID": "ef1d249e-bfac-4fd0-a61f-cbdcad53b9bb",
+  "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
+  "sourceIPs": ["::1"],
+  "user": {
+    "name": "user-f4tt2",
+    "group": ["system:authenticated"]
+  },
+  "verb": "PUT",
+  "stage": "RequestReceived",
+  "stageTimestamp": "2018-07-20 10:28:08 +0800",
+  "requestBody": {
+    "hostIPC": false,
+    "hostNetwork": false,
+    "hostPID": false,
+    "paused": false,
+    "annotations": {},
+    "baseType": "workload",
+    "containers": [
+      {
+        "allowPrivilegeEscalation": false,
+        "image": "nginx",
+        "imagePullPolicy": "Always",
+        "initContainer": false,
+        "name": "nginx",
+        "ports": [
+          {
+            "containerPort": 80,
+            "dnsName": "nginx-nodeport",
+            "kind": "NodePort",
+            "name": "80tcp01",
+            "protocol": "TCP",
+            "sourcePort": 0,
+            "type": "/v3/project/schemas/containerPort"
+          }
+        ],
+        "privileged": false,
+        "readOnly": false,
+        "resources": {
+          "type": "/v3/project/schemas/resourceRequirements",
+          "requests": {},
+          "limits": {}
+        },
+        "restartCount": 0,
+        "runAsNonRoot": false,
+        "stdin": true,
+        "stdinOnce": false,
+        "terminationMessagePath": "/dev/termination-log",
+        "terminationMessagePolicy": "File",
+        "tty": true,
+        "type": "/v3/project/schemas/container",
+        "environmentFrom": [],
+        "capAdd": [],
+        "capDrop": [],
+        "livenessProbe": null,
+        "volumeMounts": []
+      }
+    ],
+    "created": "2018-07-18T07:34:16Z",
+    "createdTS": 1531899256000,
+    "creatorId": null,
+    "deploymentConfig": {
+      "maxSurge": 1,
+      "maxUnavailable": 0,
+      "minReadySeconds": 0,
+      "progressDeadlineSeconds": 600,
+      "revisionHistoryLimit": 10,
+      "strategy": "RollingUpdate"
+    },
+    "deploymentStatus": {
+      "availableReplicas": 1,
+      "conditions": [
+        {
+          "lastTransitionTime": "2018-07-18T07:34:38Z",
+          "lastTransitionTimeTS": 1531899278000,
+          "lastUpdateTime": "2018-07-18T07:34:38Z",
+          "lastUpdateTimeTS": 1531899278000,
+          "message": "Deployment has minimum availability.",
+          "reason": "MinimumReplicasAvailable",
+          "status": "True",
+          "type": "Available"
+        },
+        {
+          "lastTransitionTime": "2018-07-18T07:34:16Z",
+          "lastTransitionTimeTS": 1531899256000,
+          "lastUpdateTime": "2018-07-18T07:34:38Z",
+          "lastUpdateTimeTS": 1531899278000,
+          "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
+          "reason": "NewReplicaSetAvailable",
+          "status": "True",
+          "type": "Progressing"
+        }
+      ],
+      "observedGeneration": 2,
+      "readyReplicas": 1,
+      "replicas": 1,
+      "type": "/v3/project/schemas/deploymentStatus",
+      "unavailableReplicas": 0,
+      "updatedReplicas": 1
+    },
+    "dnsPolicy": "ClusterFirst",
+    "id": "deployment:default:nginx",
+    "labels": {
+      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+    },
+    "name": "nginx",
+    "namespaceId": "default",
+    "projectId": "c-bcz5t:p-fdr4s",
+    "publicEndpoints": [
+      {
+        "addresses": ["10.64.3.58"],
+        "allNodes": true,
+        "ingressId": null,
+        "nodeId": null,
+        "podId": null,
+        "port": 30917,
+        "protocol": "TCP",
+        "serviceId": "default:nginx-nodeport",
+        "type": "publicEndpoint"
+      }
+    ],
+    "restartPolicy": "Always",
+    "scale": 1,
+    "schedulerName": "default-scheduler",
+    "selector": {
+      "matchLabels": {
+        "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+      },
+      "type": "/v3/project/schemas/labelSelector"
+    },
+    "state": "active",
+    "terminationGracePeriodSeconds": 30,
+    "transitioning": "no",
+    "transitioningMessage": "",
+    "type": "deployment",
+    "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
+    "workloadAnnotations": {
+      "deployment.kubernetes.io/revision": "1",
+      "field.cattle.io/creatorId": "user-f4tt2"
+    },
+    "workloadLabels": {
+      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+    },
+    "scheduling": {
+      "node": {}
+    },
+    "description": "my description",
+    "volumes": []
+  }
+}
+```
+
+### Metadata, Request Body, and Response Body Level
+
+If you set your `AUDIT_LEVEL` to `3`, Rancher logs:
+
+- The metadata header and body for every API request.
+- The metadata header and body for every API response.
+
+#### Request
+
+The code sample below depicts an API request, with both its metadata header and body.
+
+```json
+{
+  "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af",
+  "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
+  "sourceIPs": ["::1"],
+  "user": {
+    "name": "user-f4tt2",
+    "group": ["system:authenticated"]
+  },
+  "verb": "PUT",
+  "stage": "RequestReceived",
+  "stageTimestamp": "2018-07-20 10:33:06 +0800",
+  "requestBody": {
+    "hostIPC": false,
+    "hostNetwork": false,
+    "hostPID": false,
+    "paused": false,
+    "annotations": {},
+    "baseType": "workload",
+    "containers": [
+      {
+        "allowPrivilegeEscalation": false,
+        "image": "nginx",
+        "imagePullPolicy": "Always",
+        "initContainer": false,
+        "name": "nginx",
+        "ports": [
+          {
+            "containerPort": 80,
+            "dnsName": "nginx-nodeport",
+            "kind": "NodePort",
+            "name": "80tcp01",
+            "protocol": "TCP",
+            "sourcePort": 0,
+            "type": "/v3/project/schemas/containerPort"
+          }
+        ],
+        "privileged": false,
+        "readOnly": false,
+        "resources": {
+          "type": "/v3/project/schemas/resourceRequirements",
+          "requests": {},
+          "limits": {}
+        },
+        "restartCount": 0,
+        "runAsNonRoot": false,
+        "stdin": true,
+        "stdinOnce": false,
+        "terminationMessagePath": "/dev/termination-log",
+        "terminationMessagePolicy": "File",
+        "tty": true,
+        "type": "/v3/project/schemas/container",
+        "environmentFrom": [],
+        "capAdd": [],
+        "capDrop": [],
+        "livenessProbe": null,
+        "volumeMounts": []
+      }
+    ],
+    "created": "2018-07-18T07:34:16Z",
+    "createdTS": 1531899256000,
+    "creatorId": null,
+    "deploymentConfig": {
+      "maxSurge": 1,
+      "maxUnavailable": 0,
+      "minReadySeconds": 0,
+      "progressDeadlineSeconds": 600,
+      "revisionHistoryLimit": 10,
+      "strategy": "RollingUpdate"
+    },
+    "deploymentStatus": {
+      "availableReplicas": 1,
+      "conditions": [
+        {
+          "lastTransitionTime": "2018-07-18T07:34:38Z",
+          "lastTransitionTimeTS": 1531899278000,
+          "lastUpdateTime": "2018-07-18T07:34:38Z",
+          "lastUpdateTimeTS": 1531899278000,
+          "message": "Deployment has minimum availability.",
+          "reason": "MinimumReplicasAvailable",
+          "status": "True",
+          "type": "Available"
+        },
+        {
+          "lastTransitionTime": "2018-07-18T07:34:16Z",
+          "lastTransitionTimeTS": 1531899256000,
+          "lastUpdateTime": "2018-07-18T07:34:38Z",
+          "lastUpdateTimeTS": 1531899278000,
+          "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
+          "reason": "NewReplicaSetAvailable",
+          "status": "True",
+          "type": "Progressing"
+        }
+      ],
+      "observedGeneration": 2,
+      "readyReplicas": 1,
+      "replicas": 1,
+      "type": "/v3/project/schemas/deploymentStatus",
+      "unavailableReplicas": 0,
+      "updatedReplicas": 1
+    },
+    "dnsPolicy": "ClusterFirst",
+    "id": "deployment:default:nginx",
+    "labels": {
+      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+    },
+    "name": "nginx",
+    "namespaceId": "default",
+    "projectId": "c-bcz5t:p-fdr4s",
+    "publicEndpoints": [
+      {
+        "addresses": ["10.64.3.58"],
+        "allNodes": true,
+        "ingressId": null,
+        "nodeId": null,
+        "podId": null,
+        "port": 30917,
+        "protocol": "TCP",
+        "serviceId": "default:nginx-nodeport",
+        "type": "publicEndpoint"
+      }
+    ],
+    "restartPolicy": "Always",
+    "scale": 1,
+    "schedulerName": "default-scheduler",
+    "selector": {
+      "matchLabels": {
+        "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+      },
+      "type": "/v3/project/schemas/labelSelector"
+    },
+    "state": "active",
+    "terminationGracePeriodSeconds": 30,
+    "transitioning": "no",
+    "transitioningMessage": "",
+    "type": "deployment",
+    "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
+    "workloadAnnotations": {
+      "deployment.kubernetes.io/revision": "1",
+      "field.cattle.io/creatorId": "user-f4tt2"
+    },
+    "workloadLabels": {
+      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+    },
+    "scheduling": {
+      "node": {}
+    },
+    "description": "my decript",
+    "volumes": []
+  }
+}
+```
+
+#### Response
+
+The code sample below depicts an API response, with both its metadata header and body.
+
+```json
+{
+  "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af",
+  "responseStatus": "200",
+  "stage": "ResponseComplete",
+  "stageTimestamp": "2018-07-20 10:33:06 +0800",
+  "responseBody": {
+    "actionLinks": {
+      "pause": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=pause",
+      "resume": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=resume",
+      "rollback": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=rollback"
+    },
+    "annotations": {},
+    "baseType": "workload",
+    "containers": [
+      {
+        "allowPrivilegeEscalation": false,
+        "image": "nginx",
+        "imagePullPolicy": "Always",
+        "initContainer": false,
+        "name": "nginx",
+        "ports": [
+          {
+            "containerPort": 80,
+            "dnsName": "nginx-nodeport",
+            "kind": "NodePort",
+            "name": "80tcp01",
+            "protocol": "TCP",
+            "sourcePort": 0,
+            "type": "/v3/project/schemas/containerPort"
+          }
+        ],
+        "privileged": false,
+        "readOnly": false,
+        "resources": {
+          "type": "/v3/project/schemas/resourceRequirements"
+        },
+        "restartCount": 0,
+        "runAsNonRoot": false,
+        "stdin": true,
+        "stdinOnce": false,
+        "terminationMessagePath": "/dev/termination-log",
+        "terminationMessagePolicy": "File",
+        "tty": true,
+        "type": "/v3/project/schemas/container"
+      }
+    ],
+    "created": "2018-07-18T07:34:16Z",
+    "createdTS": 1531899256000,
+    "creatorId": null,
+    "deploymentConfig": {
+      "maxSurge": 1,
+      "maxUnavailable": 0,
+      "minReadySeconds": 0,
+      "progressDeadlineSeconds": 600,
+      "revisionHistoryLimit": 10,
+      "strategy": "RollingUpdate"
+    },
+    "deploymentStatus": {
+      "availableReplicas": 1,
+      "conditions": [
+        {
+          "lastTransitionTime": "2018-07-18T07:34:38Z",
+          "lastTransitionTimeTS": 1531899278000,
+          "lastUpdateTime": "2018-07-18T07:34:38Z",
+          "lastUpdateTimeTS": 1531899278000,
+          "message": "Deployment has minimum availability.",
+          "reason": "MinimumReplicasAvailable",
+          "status": "True",
+          "type": "Available"
+        },
+        {
+          "lastTransitionTime": "2018-07-18T07:34:16Z",
+          "lastTransitionTimeTS": 1531899256000,
+          "lastUpdateTime": "2018-07-18T07:34:38Z",
+          "lastUpdateTimeTS": 1531899278000,
+          "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
+          "reason": "NewReplicaSetAvailable",
+          "status": "True",
+          "type": "Progressing"
+        }
+      ],
+      "observedGeneration": 2,
+      "readyReplicas": 1,
+      "replicas": 1,
+      "type": "/v3/project/schemas/deploymentStatus",
+      "unavailableReplicas": 0,
+      "updatedReplicas": 1
+    },
+    "dnsPolicy": "ClusterFirst",
+    "hostIPC": false,
+    "hostNetwork": false,
+    "hostPID": false,
+    "id": "deployment:default:nginx",
+    "labels": {
+      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+    },
+    "links": {
+      "remove": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
+      "revisions": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/revisions",
+      "self": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
+      "update": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
+      "yaml": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/yaml"
+    },
+    "name": "nginx",
+    "namespaceId": "default",
+    "paused": false,
+    "projectId": "c-bcz5t:p-fdr4s",
+    "publicEndpoints": [
+      {
+        "addresses": ["10.64.3.58"],
+        "allNodes": true,
+        "ingressId": null,
+        "nodeId": null,
+        "podId": null,
+        "port": 30917,
+        "protocol": "TCP",
+        "serviceId": "default:nginx-nodeport"
+      }
+    ],
+    "restartPolicy": "Always",
+    "scale": 1,
+    "schedulerName": "default-scheduler",
+    "selector": {
+      "matchLabels": {
+        "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+      },
+      "type": "/v3/project/schemas/labelSelector"
+    },
+    "state": "active",
+    "terminationGracePeriodSeconds": 30,
+    "transitioning": "no",
+    "transitioningMessage": "",
+    "type": "deployment",
+    "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
+    "workloadAnnotations": {
+      "deployment.kubernetes.io/revision": "1",
+      "field.cattle.io/creatorId": "user-f4tt2"
+    },
+    "workloadLabels": {
+      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
+    }
+  }
+}
+```
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/arm64-platform/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/arm64-platform/_index.md
new file mode 100644
index 00000000000..f87f5a254f9
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/arm64-platform/_index.md
@@ -0,0 +1,27 @@
+---
+title: Running on ARM64 (Experimental)
+weight: 3
+---
+
+_Available as of v2.2.0_
+
+> **Important:**
+>
+> Running on an ARM64 platform is currently an experimental feature and is not yet officially supported in Rancher. Therefore, we do not recommend using ARM64 based nodes in a production environment.
+
+The following options are available when using an ARM64 platform:
+
+- Running Rancher on ARM64 based node(s)
+  - Only [Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker)
+- Create custom cluster and adding ARM64 based node(s)
+  - Kubernetes cluster version must be 1.12 or higher
+  - CNI Network Provider must be [Flannel]({{<baseurl>}}/rancher/v2.x/en/faq/networking/cni-providers/#flannel)
+- Importing clusters that contain ARM64 based nodes
+  - Kubernetes cluster version must be 1.12 or higher
+
+Please see [Cluster Options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/) how to configure the cluster options.
+
+The following features are not tested:
+
+- Monitoring, alerts, notifiers, pipelines and logging
+- Launching apps from the catalog
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/etcd/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/etcd/_index.md
new file mode 100644
index 00000000000..a605c7343aa
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/etcd/_index.md
@@ -0,0 +1,40 @@
+---
+title: Tuning etcd for Large Installations
+weight: 2
+---
+
+When running larger Rancher installations with 15 or more clusters it is recommended to increase the default keyspace for etcd from the default 2GB. The maximum setting is 8GB and the host should have enough RAM to keep the entire dataset in memory. When increasing this value you should also increase the size of the host. The keyspace size can also be adjusted in smaller installations if you anticipate a high rate of change of pods during the garbage collection interval.
+
+The etcd data set is automatically cleaned up on a five minute interval by Kubernetes. There are situations, e.g. deployment thrashing, where enough events could be written to etcd and deleted before garbage collection occurs and cleans things up causing the keyspace to fill up. If you see `mvcc: database space exceeded` errors, in the etcd logs or Kubernetes API server logs, you should consider increasing the keyspace size. This can be accomplished by setting the [quota-backend-bytes](https://etcd.io/docs/v3.4.0/op-guide/maintenance/#space-quota) setting on the etcd servers.
+
+### Example: This snippet of the RKE cluster.yml file increases the keyspace size to 5GB
+
+```yaml
+# RKE cluster.yml
+---
+services:
+  etcd:
+    extra_args:
+      quota-backend-bytes: 5368709120
+```
+
+## Scaling etcd disk performance
+
+You can follow the recommendations from [the etcd docs](https://etcd.io/docs/v3.4.0/tuning/#disk) on how to tune the disk priority on the host.
+
+Additionally, to reduce IO contention on the disks for etcd, you can use a dedicated device for the data and wal directory. Based on etcd best practices, mirroring RAID configurations are unnecessary because etcd replicates data between the nodes in the cluster. You can use stripping RAID configurations to increase available IOPS.
+
+To implement this solution in an RKE cluster, the `/var/lib/etcd/data` and `/var/lib/etcd/wal` directories will need to have disks mounted and formatted on the underlying host. In the `extra_args` directive of the `etcd` service, you must include the `wal_dir` directory. Without specifying the `wal_dir`, etcd process will try to manipulate the underlying `wal` mount with insufficient permissions.
+
+```yaml
+# RKE cluster.yml
+---
+services:
+  etcd:
+    extra_args:
+      data-dir: '/var/lib/rancher/etcd/data/'
+      wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
+    extra_binds:
+      - '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
+      - '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
+```
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/firewall/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/firewall/_index.md
new file mode 100644
index 00000000000..7386ba0880e
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/firewall/_index.md
@@ -0,0 +1,106 @@
+---
+title: Opening Ports with firewalld
+weight: 1
+---
+
+Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm.
+
+For example, one Oracle Linux image in AWS has REJECT rules that stop Helm from communicating with Tiller:
+
+```
+Chain INPUT (policy ACCEPT)
+target     prot opt source               destination
+ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
+ACCEPT     icmp --  anywhere             anywhere
+ACCEPT     all  --  anywhere             anywhere
+ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
+REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
+
+Chain FORWARD (policy ACCEPT)
+target     prot opt source               destination
+REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
+
+Chain OUTPUT (policy ACCEPT)
+target     prot opt source               destination
+```
+
+You can check the default firewall rules with this command:
+
+```
+sudo iptables --list
+```
+
+This section describes how to use `firewalld` to apply the [firewall port rules]({{<baseurl>}}/rancher/v2.x/en/installation/references) for nodes in a high-availability Rancher server cluster.
+
+# Prerequisite
+
+Install v7.x or later ofv`firewalld`:
+
+```
+yum install firewalld
+systemctl start firewalld
+systemctl enable firewalld
+```
+
+# Applying Firewall Port Rules
+
+In the Rancher high-availability installation instructions, the Rancher server is set up on three nodes that have all three Kubernetes roles: etcd, controlplane, and worker. If your Rancher server nodes have all three roles, run the following commands on each node:
+
+```
+firewall-cmd --permanent --add-port=22/tcp
+firewall-cmd --permanent --add-port=80/tcp
+firewall-cmd --permanent --add-port=443/tcp
+firewall-cmd --permanent --add-port=2376/tcp
+firewall-cmd --permanent --add-port=2379/tcp
+firewall-cmd --permanent --add-port=2380/tcp
+firewall-cmd --permanent --add-port=6443/tcp
+firewall-cmd --permanent --add-port=8472/udp
+firewall-cmd --permanent --add-port=9099/tcp
+firewall-cmd --permanent --add-port=10250/tcp
+firewall-cmd --permanent --add-port=10254/tcp
+firewall-cmd --permanent --add-port=30000-32767/tcp
+firewall-cmd --permanent --add-port=30000-32767/udp
+```
+If your Rancher server nodes have separate roles, use the following commands based on the role of the node:
+
+```
+# For etcd nodes, run the following commands:
+firewall-cmd --permanent --add-port=2376/tcp
+firewall-cmd --permanent --add-port=2379/tcp
+firewall-cmd --permanent --add-port=2380/tcp
+firewall-cmd --permanent --add-port=8472/udp
+firewall-cmd --permanent --add-port=9099/tcp
+firewall-cmd --permanent --add-port=10250/tcp
+
+# For control plane nodes, run the following commands:
+firewall-cmd --permanent --add-port=80/tcp
+firewall-cmd --permanent --add-port=443/tcp
+firewall-cmd --permanent --add-port=2376/tcp
+firewall-cmd --permanent --add-port=6443/tcp
+firewall-cmd --permanent --add-port=8472/udp
+firewall-cmd --permanent --add-port=9099/tcp
+firewall-cmd --permanent --add-port=10250/tcp
+firewall-cmd --permanent --add-port=10254/tcp
+firewall-cmd --permanent --add-port=30000-32767/tcp
+firewall-cmd --permanent --add-port=30000-32767/udp
+
+# For worker nodes, run the following commands:
+firewall-cmd --permanent --add-port=22/tcp
+firewall-cmd --permanent --add-port=80/tcp
+firewall-cmd --permanent --add-port=443/tcp
+firewall-cmd --permanent --add-port=2376/tcp
+firewall-cmd --permanent --add-port=8472/udp
+firewall-cmd --permanent --add-port=9099/tcp
+firewall-cmd --permanent --add-port=10250/tcp
+firewall-cmd --permanent --add-port=10254/tcp
+firewall-cmd --permanent --add-port=30000-32767/tcp
+firewall-cmd --permanent --add-port=30000-32767/udp
+```
+
+After the `firewall-cmd` commands have been run on a node, use the following command to enable the firewall rules:
+
+```
+firewall-cmd --reload
+```
+
+**Result:** The firewall is updated so that Helm can communicate with the Rancher server nodes.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/_index.md
new file mode 100644
index 00000000000..9287b5f398a
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/_index.md
@@ -0,0 +1,24 @@
+---
+title: Installing Rancher in an Air Gapped Environment
+weight: 2
+---
+
+> This section is under construction.
+
+This section is about installations of Rancher server in an air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
+
+The installation steps differ depending on whether Rancher is installed on an RKE Kubernetes cluster, a K3s Kubernetes cluster, or a single Docker container.
+
+For more information on each installation option, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/)
+
+Throughout the installation instructions, there will be _tabs_ for each installation option.
+
+> **Important:** If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker Installation to a Kubernetes Installation.
+
+# Installation Outline
+
+1. [Set up private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/)
+2. [Collect and publish images to your private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/)
+3. [Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/)
+
+### [Next: Prepare your Node(s)]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/)
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/install-rancher/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/install-rancher/_index.md
new file mode 100644
index 00000000000..30ccb0d9fcd
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/install-rancher/_index.md
@@ -0,0 +1,343 @@
+---
+title: 3. Install Rancher
+weight: 400
+---
+
+This section is about how to deploy Rancher for your air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy. There are _tabs_ for either a high availability (recommended) or a Docker installation.
+
+> **Note:** These installation instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/installation/options/air-gap-helm2) provides a copy of the older air gap installation instructions for Rancher installed on Kubernetes with Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
+
+
+{{% tabs %}}
+{{% tab "Kubernetes Install (Recommended)" %}}
+
+Rancher recommends installing Rancher on a Kubernetes cluster. A highly available Kubernetes install is comprised of three nodes running the Rancher server components on a Kubernetes cluster. The persistence layer (etcd) is also replicated on these three nodes, providing redundancy and data duplication in case one of the nodes fails.
+
+This section describes installing Rancher in five parts:
+
+- [A. Add the Helm Chart Repository](#a-add-the-helm-chart-repository)
+- [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration)
+- [C. Render the Rancher Helm Template](#c-render-the-rancher-helm-template)
+- [D. Install Rancher](#d-install-rancher)
+- [E. For Rancher versions prior to v2.3.0, Configure System Charts](#e-for-rancher-versions-prior-to-v2-3-0-configure-system-charts)
+
+
+### Prerequisite
+
+Start with any Kubernetes cluster.
+
+This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
+
+> **Need help installing Kubernetes?**
+> 
+> Our documentation contains instructions for installing Kubernetes with one of Rancher's distributions:
+>
+> - [Install Kubernetes with the Rancher CLI (recommended for ease of use)]({{<baseurl>}}/rancher/v2.5/en/cli)
+> - Install a K3s Kubernetes cluster
+> - Install an RKE Kubernetes cluster
+
+### A. Add the Helm Chart Repository
+
+From a system that has access to the internet, fetch the latest Helm chart and copy the resulting manifests to a system that has access to the Rancher server cluster.
+
+1. If you haven't already, install `helm` locally on a workstation that has internet access. Note: Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
+
+2. Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
+  {{< release-channel >}}
+    ```
+    helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
+    ```
+
+3. Fetch the latest Rancher chart. This will pull down the chart and save it in the current directory as a `.tgz` file.
+```plain
+helm fetch rancher-<CHART_REPO>/rancher
+```
+
+> Want additional options? Need help troubleshooting? See [Kubernetes Install: Advanced Options]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#advanced-configurations).
+
+### B. Choose your SSL Configuration
+
+Rancher Server is designed to be secure by default and requires SSL/TLS configuration.
+
+When Rancher is installed on an air gapped Kubernetes cluster, there are two recommended options for the source of the certificate.
+
+> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
+
+| Configuration                              | Chart option                 | Description                                                                                                                                                 | Requires cert-manager |
+| ------------------------------------------ | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| Rancher Generated Self-Signed Certificates | `ingress.tls.source=rancher` | Use certificates issued by Rancher's generated CA (self signed)<br> This is the **default** and does not need to be added when rendering the Helm template. | yes                   |
+| Certificates from Files                    | `ingress.tls.source=secret`  | Use your own certificate files by creating Kubernetes Secret(s). <br> This option must be passed when rendering the Rancher Helm template.                  | no                    |
+
+### C. Render the Rancher Helm Template
+
+When setting up the Rancher Helm template, there are several options in the Helm chart that are designed specifically for air gap installations.
+
+| Chart Option            | Chart Value                      | Description   |
+| ----------------------- | -------------------------------- | ---- |
+| `certmanager.version` | "<version>" | Configure proper Rancher TLS issuer depending of running cert-manager version. |
+| `systemDefaultRegistry` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
+| `useBundledSystemChart` | `true`                           | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
+
+Based on the choice your made in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), complete one of the procedures below.
+
+{{% accordion id="self-signed" label="Option A-Default Self-Signed Certificate" %}}
+
+By default, Rancher generates a CA and uses cert-manager to issue the certificate for access to the Rancher server interface.
+
+> **Note:**
+> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade cert-manager documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
+
+1. From a system connected to the internet, add the cert-manager repo to Helm.
+    ```plain
+    helm repo add jetstack https://charts.jetstack.io
+    helm repo update
+    ```
+
+1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
+
+   ```plain
+   helm fetch jetstack/cert-manager --version v0.12.0
+   ```
+
+1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
+   ```plain
+   helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
+       --namespace cert-manager \
+       --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller \
+       --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook \
+       --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
+   ```
+
+1. Download the required CRD file for cert-manager
+   ```plain
+   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+   ```
+1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
+
+
+    Placeholder | Description
+    ------------|-------------
+    `<VERSION>` | The version number of the output tarball.
+    `<RANCHER.YOURDOMAIN.COM>` | The DNS name you pointed at your load balancer.
+    `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.
+    `<CERTMANAGER_VERSION>` | Cert-manager version running on k8s cluster.
+
+     ```plain
+    helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
+     --namespace cattle-system \
+     --set hostname=<RANCHER.YOURDOMAIN.COM> \
+     --set certmanager.version=<CERTMANAGER_VERSION> \
+     --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+     --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+     --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.3.6`
+
+{{% /accordion %}}
+
+{{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
+
+Create Kubernetes secrets from your own certificates for Rancher to use. The common name for the cert will need to match the `hostname` option in the command below, or the ingress controller will fail to provision the site for Rancher.
+
+Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
+
+| Placeholder                      | Description                                     |
+| -------------------------------- | ----------------------------------------------- |
+| `<VERSION>`                      | The version number of the output tarball.       |
+| `<RANCHER.YOURDOMAIN.COM>`       | The DNS name you pointed at your load balancer. |
+| `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.         |
+
+```plain
+   helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
+    --namespace cattle-system \
+    --set hostname=<RANCHER.YOURDOMAIN.COM> \
+    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+    --set ingress.tls.source=secret \
+    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
+
+```plain
+   helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
+    --namespace cattle-system \
+    --set hostname=<RANCHER.YOURDOMAIN.COM> \
+    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+    --set ingress.tls.source=secret \
+    --set privateCA=true \
+    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.3.6`
+
+Then refer to [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
+
+{{% /accordion %}}
+
+### D. Install Rancher
+
+Copy the rendered manifest directories to a system that has access to the Rancher server cluster to complete installation.
+
+Use `kubectl` to create namespaces and apply the rendered manifests.
+
+If you chose to use self-signed certificates in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), install cert-manager.
+
+{{% accordion id="install-cert-manager" label="Self-Signed Certificate Installs - Install Cert-manager" %}}
+
+If you are using self-signed certificates, install cert-manager:
+
+1. Create the namespace for cert-manager.
+```plain
+kubectl create namespace cert-manager
+```
+
+1. Create the cert-manager CustomResourceDefinitions (CRDs).
+```plain
+kubectl apply -f cert-manager/cert-manager-crd.yaml
+```
+
+    > **Note:**
+    > If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false` flag to your `kubectl apply` command above, or else you will receive a validation error relating to the `x-kubernetes-preserve-unknown-fields` field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
+
+1. Launch cert-manager.
+```plain
+kubectl apply -R -f ./cert-manager
+```
+
+{{% /accordion %}}
+
+Install Rancher:
+
+```plain
+kubectl create namespace cattle-system
+kubectl -n cattle-system apply -R -f ./rancher
+```
+
+**Step Result:** If you are installing Rancher v2.3.0+, the installation is complete.
+
+### E. For Rancher versions prior to v2.3.0, Configure System Charts
+
+If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
+
+### Additional Resources
+
+These resources could be helpful when installing Rancher:
+
+- [Rancher Helm chart options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/)
+- [Adding TLS secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/)
+- [Troubleshooting Rancher Kubernetes Installations]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/)
+
+{{% /tab %}}
+{{% tab "Docker Install" %}}
+
+The Docker installation is for Rancher users that are wanting to **test** out Rancher. Instead of running on a Kubernetes cluster, you install the Rancher server component on a single node using a `docker run` command. Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server. **Important: If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker installation to a Kubernetes Installation.** Instead of running the single node installation, you have the option to follow the Kubernetes Install guide, but only use one node to install Rancher. Afterwards, you can scale up the etcd nodes in your Kubernetes cluster to make it a Kubernetes Installation.
+
+For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
+
+| Environment Variable Key         | Environment Variable Value       | Description     |
+| -------------------------------- | -------------------------------- | ---- |
+| `CATTLE_SYSTEM_DEFAULT_REGISTRY` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
+| `CATTLE_SYSTEM_CATALOG`          | `bundled`                        | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
+
+> **Do you want to...**
+>
+> - Configure custom CA root certificate to access your services? See [Custom CA root certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/custom-ca-root-certificate/).
+> - Record all transactions with the Rancher API? See [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#api-audit-log).
+
+- For Rancher prior to v2.3.0, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach. Then, after Rancher is installed, you will need to configure Rancher to use that repository. For details, refer to the documentation on [setting up the system charts for Rancher prior to v2.3.0.]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0)
+
+Choose from the following options:
+
+{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
+
+If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself.
+
+Log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder.
+
+| Placeholder                      | Description                                                                                                                   |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
+| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
+
+```
+docker run -d --restart=unless-stopped \
+    -p 80:80 -p 443:443 \
+    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
+    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
+```
+
+{{% /accordion %}}
+{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
+
+In development or testing environments where your team will access your Rancher server, create a self-signed certificate for use with your install so that your team can verify they're connecting to your instance of Rancher.
+
+> **Prerequisites:**
+> From a computer with an internet connection, create a self-signed certificate using [OpenSSL](https://www.openssl.org/) or another method of your choice.
+>
+> - The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
+> - In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#cert-order).
+
+After creating your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Use the `-v` flag and provide the path to your certificates to mount them in your container.
+
+| Placeholder                      | Description                                                                                                                   |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
+| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
+| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
+| `<CA_CERTS.pem>`                     | The path to the certificate authority's certificate.                                                                          |
+| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
+| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
+
+```
+docker run -d --restart=unless-stopped \
+    -p 80:80 -p 443:443 \
+    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+    -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
+    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
+    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
+```
+
+{{% /accordion %}}
+{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
+
+In development or testing environments where you're exposing an app publicly, use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings.
+
+> **Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
+
+After obtaining your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary.
+
+| Placeholder                      | Description                                                                                                                   |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
+| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
+| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
+| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
+| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
+| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
+
+> **Note:** Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
+
+```
+docker run -d --restart=unless-stopped \
+    -p 80:80 -p 443:443 \
+    --no-cacerts \
+    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
+    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
+```
+
+{{% /accordion %}}
+
+If you are installing Rancher v2.3.0+, the installation is complete.
+
+If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
+
+{{% /tab %}}
+{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/local-system-charts/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/local-system-charts/_index.md
new file mode 100644
index 00000000000..36df2bf2e54
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/local-system-charts/_index.md
@@ -0,0 +1,65 @@
+---
+title: Setting up Local System Charts for Air Gapped Installations
+weight: 1120
+---
+
+The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS.
+
+In an air gapped installation of Rancher, you will need to configure Rancher to use a local copy of the system charts. This section describes how to use local system charts using a CLI flag in Rancher v2.3.0, and using a Git mirror for Rancher versions prior to v2.3.0.
+
+# Using Local System Charts in Rancher v2.3.0
+
+In Rancher v2.3.0, a local copy of `system-charts` has been packaged into the `rancher/rancher` container. To be able to use these features in an air gap install, you will need to run the Rancher install command with an extra environment variable, `CATTLE_SYSTEM_CATALOG=bundled`, which tells Rancher to use the local copy of the charts instead of attempting to fetch them from GitHub.
+
+Example commands for a Rancher installation with a bundled `system-charts` are included in the [air gap Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/install-rancher) instructions and the [air gap Kubernetes installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/#c-install-rancher) instructions.
+
+# Setting Up System Charts for Rancher Prior to v2.3.0
+
+### A. Prepare System Charts
+
+The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. To be able to use these features in an air gap install, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach and configure Rancher to use that repository.
+
+Refer to the release notes in the `system-charts` repository to see which branch corresponds to your version of Rancher.
+
+### B. Configure System Charts
+
+Rancher needs to be configured to use your Git mirror of the `system-charts` repository. You can configure the system charts repository either from the Rancher UI or from Rancher's API view.
+
+{{% tabs %}}
+{{% tab "Rancher UI" %}}
+
+In the catalog management page in the Rancher UI, follow these steps:
+
+1. Go to the **Global** view.
+
+1. Click **Tools > Catalogs.**
+
+1. The system chart is displayed under the name `system-library`. To edit the configuration of the system chart, click **&#8942; > Edit.**
+
+1. In the **Catalog URL** field, enter the location of the Git mirror of the `system-charts` repository.
+
+1. Click **Save.**
+
+**Result:** Rancher is configured to download all the required catalog items from your `system-charts` repository.
+
+{{% /tab %}}
+{{% tab "Rancher API" %}}
+
+1. Log into Rancher.
+
+1. Open `https://<your-rancher-server>/v3/catalogs/system-library` in your browser.
+
+   {{< img "/img/rancher/airgap/system-charts-setting.png" "Open">}}
+
+1. Click **Edit** on the upper right corner and update the value for **url** to the location of the Git mirror of the `system-charts` repository.
+
+   {{< img "/img/rancher/airgap/system-charts-update.png" "Update">}}
+
+1. Click **Show Request**
+
+1. Click **Send Request**
+
+**Result:** Rancher is configured to download all the required catalog items from your `system-charts` repository.
+
+{{% /tab %}}
+{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/populate-private-registry/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/populate-private-registry/_index.md
new file mode 100644
index 00000000000..096176a0c0f
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/populate-private-registry/_index.md
@@ -0,0 +1,277 @@
+---
+title: '2. Collect and Publish Images to your Private Registry'
+weight: 200
+---
+
+This section describes how to set up your private registry so that when you install Rancher, Rancher will pull all the required images from this registry.
+
+By default, all images used to [provision Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/) or launch any [tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) in Rancher, e.g. monitoring, pipelines, alerts, are pulled from Docker Hub. In an air gapped installation of Rancher, you will need a private registry that is located somewhere accessible by your Rancher server. Then, you will load the registry with all the images.
+
+Populating the private registry with images is the same process for installing Rancher with Docker and for installing Rancher on a Kubernetes cluster.
+
+The steps in this section differ depending on whether or not you are planning to use Rancher to provision a downstream cluster with Windows nodes or not. By default, we provide the steps of how to populate your private registry assuming that Rancher will provision downstream Kubernetes clusters with only Linux nodes. But if you plan on provisioning any [downstream Kubernetes clusters using Windows nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/), there are separate instructions to support the images needed.
+
+> **Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry) available to use.
+
+{{% tabs %}}
+{{% tab "Linux Only Clusters" %}}
+
+For Rancher servers that will only provision Linux clusters, these are the steps to populate your private registry.
+
+1. [Find the required assets for your Rancher version](#1-find-the-required-assets-for-your-rancher-version)
+2. [Collect the cert-manager image](#2-collect-the-cert-manager-image) (unless you are bringing your own certificates or terminating TLS on a load balancer)
+3. [Save the images to your workstation](#3-save-the-images-to-your-workstation)
+4. [Populate the private registry](#4-populate-the-private-registry)
+
+### Prerequisites
+
+These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
+
+If you will use ARM64 hosts, the registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
+
+### 1. Find the required assets for your Rancher version
+
+1. Go to our [releases page,](https://github.com/rancher/rancher/releases) find the Rancher v2.x.x release that you want to install, and click **Assets.** Note: Don't use releases marked `rc` or `Pre-release`, as they are not stable for production environments.
+
+2. From the release's **Assets** section, download the following files, which are required to install Rancher in an air gap environment:
+
+| Release File   | Description  |
+| ---------------- | -------------- |
+| `rancher-images.txt`     | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools. |
+| `rancher-save-images.sh` | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
+| `rancher-load-images.sh` | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.   |
+
+### 2. Collect the cert-manager image
+
+> Skip this step if you are using your own certificates, or if you are terminating TLS on an external load balancer.
+
+In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. 
+
+1.  Fetch the latest `cert-manager` Helm chart and parse the template for image details:
+
+    > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
+
+    ```plain
+    helm repo add jetstack https://charts.jetstack.io
+    helm repo update
+    helm fetch jetstack/cert-manager --version v0.12.0
+    helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
+    ```
+
+2.  Sort and unique the images list to remove any overlap between the sources:
+
+    ```plain
+    sort -u rancher-images.txt -o rancher-images.txt
+    ```
+
+### 3. Save the images to your workstation
+
+1. Make `rancher-save-images.sh` an executable:
+   ```
+   chmod +x rancher-save-images.sh
+   ```
+
+1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
+   ```plain
+   ./rancher-save-images.sh --image-list ./rancher-images.txt
+   ```
+   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
+
+### 4. Populate the private registry
+
+Next, you will move the images in the `rancher-images.tar.gz` to your private registry using the scripts to load the images.
+
+Move the images in the `rancher-images.tar.gz` to your private registry using the scripts to load the images.
+
+The `rancher-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script. The `rancher-images.tar.gz` should also be in the same directory.
+
+1.  Log into your private registry if required:
+   ```plain
+   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
+   ```
+1.  Make `rancher-load-images.sh` an executable:
+   ```
+   chmod +x rancher-load-images.sh
+   ```
+
+1.  Use `rancher-load-images.sh` to extract, tag and push `rancher-images.txt` and `rancher-images.tar.gz` to your private registry:
+   ```plain
+   ./rancher-load-images.sh --image-list ./rancher-images.txt --registry <REGISTRY.YOURDOMAIN.COM:PORT>
+   ```
+{{% /tab %}}
+{{% tab "Linux and Windows Clusters" %}}
+
+_Available as of v2.3.0_
+
+For Rancher servers that will provision Linux and Windows clusters, there are distinctive steps to populate your private registry for the Windows images and the Linux images. Since a Windows cluster is a mix of Linux and Windows nodes, the Linux images pushed into the private registry are manifests.
+
+### Windows Steps
+
+The Windows images need to be collected and pushed from a Windows server workstation.
+
+A. Find the required assets for your Rancher version <br>
+B. Save the images to your Windows Server workstation <br>
+C. Prepare the Docker daemon <br>
+D. Populate the private registry
+
+{{% accordion label="Collecting and Populating Windows Images into the Private Registry"%}}
+
+### Prerequisites
+
+These steps expect you to use a Windows Server 1809 workstation that has internet access, access to your private registry, and at least 50 GB of disk space.
+
+The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
+
+Your registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
+
+### A. Find the required assets for your Rancher version
+
+1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.
+
+2. From the release's "Assets" section, download the following files:
+
+| Release File                 | Description      |
+|----------------------------|------------------|
+| `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.                                                                    |
+| `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
+| `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.                                 |
+
+### B. Save the images to your Windows Server workstation
+
+1. Using `powershell`, go to the directory that has the files that were downloaded in the previous step.
+
+1. Run `rancher-save-images.ps1` to create a tarball of all the required images:
+   ```plain
+   ./rancher-save-images.ps1
+   ```
+
+   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-windows-images.tar.gz`. Check that the output is in the directory.
+
+### C. Prepare the Docker daemon
+
+Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
+
+   ```
+   {
+     ...
+     "allow-nondistributable-artifacts": [
+       ...
+       "<REGISTRY.YOURDOMAIN.COM:PORT>"
+     ]
+     ...
+   }
+   ```
+
+### D. Populate the private registry
+
+Move the images in the `rancher-windows-images.tar.gz` to your private registry using the scripts to load the images.
+
+The `rancher-windows-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.ps1` script. The `rancher-windows-images.tar.gz` should also be in the same directory.
+
+1. Using `powershell`, log into your private registry if required:
+   ```plain
+   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
+   ```
+
+1. Using `powershell`, use `rancher-load-images.ps1` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
+   ```plain
+   ./rancher-load-images.ps1 --registry <REGISTRY.YOURDOMAIN.COM:PORT>
+   ```
+
+{{% /accordion %}}
+
+### Linux Steps
+
+The Linux images needs to be collected and pushed from a Linux host, but _must be done after_ populating the Windows images into the private registry. These step are different from the Linux only steps as the Linux images that are pushed will actually manifests that support Windows and Linux images.
+
+A. Find the required assets for your Rancher version <br>
+B. Collect all the required images <br>
+C. Save the images to your Linux workstation <br>
+D. Populate the private registry
+
+{{% accordion label="Collecting and Populating Linux Images into the Private Registry" %}}
+
+### Prerequisites
+
+You must populate the private registry with the Windows images before populating the private registry with Linux images. If you have already populated the registry with Linux images, you will need to follow these instructions again as they will publish manifests that support Windows and Linux images.
+
+These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
+
+The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
+
+### A. Find the required assets for your Rancher version
+
+1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments. Click **Assets.**
+
+2. From the release's **Assets** section, download the following files:
+
+| Release File                 | Description    |
+|----------------------------| -------------------------- |
+| `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.           |
+| `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
+| `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
+| `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
+
+### B. Collect all the required images
+
+**For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
+
+   1. Fetch the latest `cert-manager` Helm chart and parse the template for image details:
+      > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
+      ```plain
+      helm repo add jetstack https://charts.jetstack.io
+      helm repo update
+      helm fetch jetstack/cert-manager --version v0.12.0
+      helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
+      ```
+
+   2. Sort and unique the images list to remove any overlap between the sources:
+      ```plain
+      sort -u rancher-images.txt -o rancher-images.txt
+      ```
+
+### C. Save the images to your workstation
+
+1. Make `rancher-save-images.sh` an executable:
+   ```
+   chmod +x rancher-save-images.sh
+   ```
+
+1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
+   ```plain
+   ./rancher-save-images.sh --image-list ./rancher-images.txt
+   ```
+
+   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
+
+### D. Populate the private registry
+
+Move the images in the `rancher-images.tar.gz` to your private registry using the `rancher-load-images.sh script` to load the images.
+
+The image list, `rancher-images.txt` or `rancher-windows-images.txt`, is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script. The `rancher-images.tar.gz` should also be in the same directory.
+
+1. Log into your private registry if required:
+   ```plain
+   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
+   ```
+
+1. Make `rancher-load-images.sh` an executable:
+   ```
+   chmod +x rancher-load-images.sh
+   ```
+
+1. Use `rancher-load-images.sh` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
+   ```plain
+   ./rancher-load-images.sh --image-list ./rancher-images.txt \
+     --windows-image-list ./rancher-windows-images.txt \
+     --registry <REGISTRY.YOURDOMAIN.COM:PORT>
+   ```
+
+{{% /accordion %}}
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### [Next step for Kubernetes Installs - Launch a Kubernetes Cluster]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/)
+
+### [Next step for Docker Installs - Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/)
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/prepare-registry/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/prepare-registry/_index.md
new file mode 100644
index 00000000000..a860bf48a9b
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/prepare-registry/_index.md
@@ -0,0 +1,25 @@
+---
+title: '1. Set up Private Registry'
+weight: 100
+---
+
+> This page is under construction.
+
+In this section, you will provision the underlying infrastructure for your Rancher management server in an air gapped environment. You will also set up the private Docker registry that must be available to your Rancher node(s).
+
+An air gapped environment is an environment where the Rancher server is installed offline or behind a firewall.
+
+The infrastructure depends on whether you are installing Rancher on a K3s Kubernetes cluster, an RKE Kubernetes cluster, or a single Docker container. For more information on each installation option, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/)
+
+
+
+### Set up a Private Docker Registry
+
+Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing Docker images to your machines.
+
+In a later step, when you set up your K3s Kubernetes cluster, you will create a [private registries configuration file]({{<baseurl>}}/k3s/latest/en/installation/private-registry/) with details from this registry.
+
+If you need help with creating a private registry, please refer to the [official Docker documentation.](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry)
+
+
+### [Next: Collect and Publish Images to your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/)
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/_index.md
new file mode 100644
index 00000000000..c49e516a62b
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/_index.md
@@ -0,0 +1,6 @@
+---
+title: Encryption
+weight: 3
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/custom-ca-root-certificate/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/custom-ca-root-certificate/_index.md
new file mode 100644
index 00000000000..924bb8a8203
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/custom-ca-root-certificate/_index.md
@@ -0,0 +1,25 @@
+---
+title: About Custom CA Root Certificates
+weight: 1
+---
+
+If you're using Rancher in an internal production environment where you aren't exposing apps publicly, use a certificate from a private certificate authority (CA).
+
+Services that Rancher needs to access are sometimes configured with a certificate from a custom/internal CA root, also known as self signed certificate. If the presented certificate from the service cannot be validated by Rancher, the following error displays: `x509: certificate signed by unknown authority`.
+
+To validate the certificate, the CA root certificates need to be added to Rancher. As Rancher is written in Go, we can use the environment variable `SSL_CERT_DIR` to point to the directory where the CA root certificates are located in the container. The CA root certificates directory can be mounted using the Docker volume option (`-v host-source-directory:container-destination-directory`) when starting the Rancher container.
+
+Examples of services that Rancher can access:
+
+- Catalogs
+- Authentication providers
+- Accessing hosting/cloud API when using Node Drivers
+
+## Installing with the custom CA Certificate
+
+For details on starting a Rancher container with your private CA certificates mounted, refer to the installation docs:
+
+- [Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#custom-ca-certificate)
+
+- [Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#additional-trusted-cas)
+
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-secrets/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-secrets/_index.md
new file mode 100644
index 00000000000..2bc835cf922
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-secrets/_index.md
@@ -0,0 +1,36 @@
+---
+title: Adding TLS Secrets
+weight: 2
+---
+
+Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key.
+
+Combine the server certificate followed by any intermediate certificate(s) needed into a file named `tls.crt`. Copy your certificate key into a file named `tls.key`.
+
+For example, [acme.sh](https://acme.sh) provides server certificate and CA chains in `fullchain.cer` file. 
+This `fullchain.cer` should be renamed to `tls.crt` & certificate key file as `tls.key`.
+
+Use `kubectl` with the `tls` secret type to create the secrets.
+
+```
+kubectl -n cattle-system create secret tls tls-rancher-ingress \
+  --cert=tls.crt \
+  --key=tls.key
+```
+
+> **Note:** If you want to replace the certificate, you can delete the `tls-rancher-ingress` secret using `kubectl -n cattle-system delete secret tls-rancher-ingress` and add a new one using the command shown above. If you are using a private CA signed certificate, replacing the certificate is only possible if the new certificate is signed by the same CA as the certificate currently in use.
+
+### Using a Private CA Signed Certificate
+
+If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server.
+
+Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
+
+>**Important:** Make sure the file is called `cacerts.pem` as Rancher uses that filename to configure the CA certificate.
+
+```
+kubectl -n cattle-system create secret generic tls-ca \
+  --from-file=cacerts.pem
+```
+
+> **Note:** The configured `tls-ca` secret is retrieved when Rancher starts. On a running Rancher installation the updated CA will take effect after new Rancher pods are started.
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-settings/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-settings/_index.md
new file mode 100644
index 00000000000..bade7211c43
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-settings/_index.md
@@ -0,0 +1,34 @@
+---
+title: TLS Settings
+weight: 3
+---
+
+_Available as of v2.1.7_
+
+In Rancher v2.1.7, the default TLS configuration changed to only accept TLS 1.2 and secure TLS cipher suites. TLS 1.3 and TLS 1.3 exclusive cipher suites are not supported.
+
+## Configuring TLS settings
+
+The Audit Log is enabled and configured by passing environment variables to the Rancher server container. See the following to enable on your installation.
+
+- [Installing Rancher on a single node with Docker]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#tls-settings)
+
+- [Installing Rancher on Kubernetes]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#tls-settings)
+
+## TLS settings
+
+| Parameter | Description | Default | Available options |
+|-----|-----|-----|-----|
+| `CATTLE_TLS_MIN_VERSION` | Minimum TLS version | `1.2` | `1.0`, `1.1`, `1.2` |
+| `CATTLE_TLS_CIPHERS` | Allowed TLS cipher suites | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`<br/>`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` | See [Golang tls constants](https://golang.org/pkg/crypto/tls/#pkg-constants) |
+
+
+## Legacy configuration
+
+If you need to configure TLS the same way as it was before Rancher v2.1.7, please use the following settings:
+
+
+| Parameter | Legacy value |
+|-----|-----|
+| `CATTLE_TLS_MIN_VERSION` | `1.0` |
+| `CATTLE_TLS_CIPHERS` | `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,`<br/>`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`<br/>`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,`<br/>`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,`<br/>`TLS_RSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_RSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_RSA_WITH_AES_128_CBC_SHA,`<br/>`TLS_RSA_WITH_AES_256_CBC_SHA,`<br/>`TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,`<br/>`TLS_RSA_WITH_3DES_EDE_CBC_SHA`
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/upgrading-cert-manager/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/upgrading-cert-manager/_index.md
new file mode 100644
index 00000000000..19ee7d06ee9
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/upgrading-cert-manager/_index.md
@@ -0,0 +1,234 @@
+---
+title: Upgrading Cert-Manager
+weight: 4
+---
+
+Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, three important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher:
+
+1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
+1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/). This change has no exact deadline.
+1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
+
+To address these changes, this guide will do two things:
+
+1. Document the procedure for upgrading cert-manager
+1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data
+
+> **Important:**
+> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them:
+
+> 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server
+> 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager
+> 3. Install the newer version of Rancher and cert-manager 
+
+> The reason is that when Helm upgrades Rancher, it will reject the upgrade and show error messages if the running Rancher app does not match the chart template used to install it. Because cert-manager changed its API group and we cannot modify released charts for Rancher, there will always be a mismatch on the cert-manager's API version, therefore the upgrade will be rejected.
+
+> For reinstalling Rancher with Helm, please check [Option B: Reinstalling Rancher Chart]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/#c-upgrade-rancher) under the upgrade Rancher section. 
+
+## Upgrade Cert-Manager
+
+The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-\* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues.
+
+> These instructions have been updated for Helm 3. If you are still using Helm 2, refer to [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions)
+
+In order to upgrade cert-manager, follow these instructions:
+
+{{% accordion id="normal" label="Upgrading cert-manager with Internet access" %}}
+1. [Back up existing resources](https://cert-manager.io/docs/tutorials/backup/) as a precaution
+
+    ```plain
+    kubectl get -o yaml --all-namespaces \
+    issuer,clusterissuer,certificates,certificaterequests > cert-manager-backup.yaml
+    ```
+
+    > **Important:**
+    > If you are upgrading from a version older than 0.11.0, Update the apiVersion on all your backed up resources from `certmanager.k8s.io/v1alpha1` to `cert-manager.io/v1alpha2`. If you use any cert-manager annotations on any of your other resources, you will need to update them to reflect the new API group. For details, refer to the documentation on [additional annotation changes.](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/#additional-annotation-changes)
+
+1. [Uninstall existing deployment](https://cert-manager.io/docs/installation/uninstall/kubernetes/#uninstalling-with-helm)
+
+    ```plain
+    helm uninstall cert-manager
+    ```
+
+    Delete the CustomResourceDefinition using the link to the version vX.Y you installed
+
+    ```plain
+    kubectl delete -f https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml
+    ```
+
+1. Install the CustomResourceDefinition resources separately
+
+    ```plain
+    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+    ```
+
+    > **Note:**
+    > If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false` flag to your `kubectl apply` command above. Otherwise, you will receive a validation error relating to the `x-kubernetes-preserve-unknown-fields` field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
+
+1. Create the namespace for cert-manager if needed
+
+    ```plain
+    kubectl create namespace cert-manager
+    ```
+
+1. Add the Jetstack Helm repository
+
+    ```plain
+    helm repo add jetstack https://charts.jetstack.io
+    ```
+
+1. Update your local Helm chart repository cache
+
+    ```plain
+    helm repo update
+    ```
+
+1. Install the new version of cert-manager
+
+    ```plain
+    helm install \
+      cert-manager jetstack/cert-manager \
+      --namespace cert-manager \
+      --version v0.12.0 
+    ```
+
+1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources)
+
+    ```plain
+    kubectl apply -f cert-manager-backup.yaml
+    ```
+
+{{% /accordion %}}
+
+{{% accordion id="airgap" label="Upgrading cert-manager in an airgapped environment" %}}
+### Prerequisites
+
+Before you can perform the upgrade, you must prepare your air gapped environment by adding the necessary container images to your private registry and downloading or rendering the required Kubernetes manifest files.
+
+1. Follow the guide to [Prepare your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images needed for the upgrade.
+
+1. From a system connected to the internet, add the cert-manager repo to Helm
+
+    ```plain
+    helm repo add jetstack https://charts.jetstack.io
+    helm repo update
+    ```
+
+1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
+
+    ```plain
+    helm fetch jetstack/cert-manager --version v0.12.0
+    ```
+
+1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
+
+    The Helm 3 command is as follows:
+
+    ```plain
+    helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
+    --namespace cert-manager \
+    --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
+    --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
+    --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
+    ```
+
+    The Helm 2 command is as follows:
+
+    ```plain
+    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
+    --name cert-manager --namespace cert-manager \
+    --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
+    --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
+    --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
+    ```
+
+1. Download the required CRD file for cert-manager (old and new)
+
+    ```plain
+    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
+    curl -L -o cert-manager/cert-manager-crd-old.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml
+    ```
+
+### Install cert-manager
+
+1. Back up existing resources as a precaution
+
+    ```plain
+    kubectl get -o yaml --all-namespaces \
+    issuer,clusterissuer,certificates,certificaterequests > cert-manager-backup.yaml
+    ```
+
+    > **Important:**
+    > If you are upgrading from a version older than 0.11.0, Update the apiVersion on all your backed up resources from `certmanager.k8s.io/v1alpha1` to `cert-manager.io/v1alpha2`. If you use any cert-manager annotations on any of your other resources, you will need to update them to reflect the new API group. For details, refer to the documentation on [additional annotation changes.](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/#additional-annotation-changes)
+
+1. Delete the existing cert-manager installation
+
+    ```plain
+    kubectl -n cert-manager \
+    delete deployment,sa,clusterrole,clusterrolebinding \
+    -l 'app=cert-manager' -l 'chart=cert-manager-v0.5.2'
+    ```
+
+    Delete the CustomResourceDefinition using the link to the version vX.Y you installed
+
+    ```plain
+    kubectl delete -f cert-manager/cert-manager-crd-old.yaml
+    ```
+
+1. Install the CustomResourceDefinition resources separately
+
+    ```plain
+    kubectl apply -f cert-manager/cert-manager-crd.yaml
+    ```
+
+    > **Note:**
+    > If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false` flag to your `kubectl apply` command above. Otherwise, you will receive a validation error relating to the `x-kubernetes-preserve-unknown-fields` field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
+
+1. Create the namespace for cert-manager
+
+    ```plain
+    kubectl create namespace cert-manager
+    ```
+
+1. Install cert-manager
+
+    ```plain
+    kubectl -n cert-manager apply -R -f ./cert-manager
+    ```
+
+1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources)
+
+    ```plain
+    kubectl apply -f cert-manager-backup.yaml
+    ```
+
+{{% /accordion %}}
+
+
+Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods:
+
+```
+kubectl get pods --namespace cert-manager
+
+NAME                                       READY   STATUS    RESTARTS   AGE
+cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
+cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
+cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m
+```
+
+## Cert-Manager API change and data migration
+
+Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release.
+
+Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format.
+
+Details about the change and migration instructions can be found in the [cert-manager v0.7 to v0.8 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
+
+The v0.11 release marks the removal of the v1alpha1 API that was used in previous versions of cert-manager, as well as our API group changing to be cert-manager.io instead of certmanager.k8s.io.
+
+We have also removed support for the old configuration format that was deprecated in the v0.8 release. This means you must transition to using the new solvers style configuration format for your ACME issuers before upgrading to v0.11. For more information, see the [upgrading to v0.8 guide](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
+
+Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
+
+More info about [cert-manager upgrade information](https://cert-manager.io/docs/installation/upgrading/).
+
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/_index.md
new file mode 100644
index 00000000000..a85228adea1
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/_index.md
@@ -0,0 +1,6 @@
+---
+title: "Don't have a Kubernetes cluster? Try one of these tutorials."
+weight: 4
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE/_index.md
new file mode 100644
index 00000000000..c644050196b
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE/_index.md
@@ -0,0 +1,170 @@
+---
+title: Setting up a High-availability RKE Kubernetes Cluster
+shortTitle: Set up RKE Kubernetes
+weight: 3
+---
+
+> This page is under construction.
+
+This section describes how to install a Kubernetes cluster according to our [best practices for the Rancher server environment.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) This cluster should be dedicated to run only the Rancher server.
+
+For Rancher prior to v2.4, Rancher should be installed on an RKE Kubernetes cluster. RKE is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers.
+
+As of Rancher v2.4, the Rancher management server can be installed on either an RKE cluster or a K3s Kubernetes cluster. K3s is also a fully certified Kubernetes distribution released by Rancher, but is newer than RKE. We recommend installing Rancher on K3s because K3s is easier to use, and more lightweight, with a binary size of less than 100 MB. Note: After Rancher is installed on an RKE cluster, there is no migration path to a K3s setup at this time.
+
+The Rancher management server can only be run on Kubernetes cluster in an infrastructure provider where Kubernetes is installed using RKE or K3s. Use of Rancher on hosted Kubernetes providers, such as EKS, is not supported.
+
+For systems without direct internet access, refer to [Air Gap: Kubernetes install.]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/)
+
+> **Single-node Installation Tip:**
+> In a single-node Kubernetes cluster, the Rancher server does not have high availability, which is important for running Rancher in production. However, installing Rancher on a single-node cluster can be useful if you want to save resources by using a single node in the short term, while preserving a high-availability migration path.
+>
+> To set up a single-node RKE cluster, configure only one node in the `cluster.yml` . The single node should have all three roles: `etcd`, `controlplane`, and `worker`.
+>
+> In both single-node setups, Rancher can be installed with Helm on the Kubernetes cluster in the same way that it would be installed on any other cluster.
+
+# Installing Kubernetes
+
+### Required CLI Tools
+
+Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool.
+
+Also install [RKE,]({{<baseurl>}}/rke/latest/en/installation/) the Rancher Kubernetes Engine, a Kubernetes distribution and command-line tool.
+
+### 1. Create the cluster configuration file
+
+In this section, you will create a Kubernetes cluster configuration file called `rancher-cluster.yml`. In a later step, when you set up the cluster with an RKE command, it will use this file to install Kubernetes on your nodes.
+
+Using the sample below as a guide, create the `rancher-cluster.yml` file. Replace the IP addresses in the `nodes` list with the IP address or DNS names of the 3 nodes you created.
+
+If your node has public and internal addresses, it is recommended to set the `internal_address:` so Kubernetes will use it for intra-cluster communication. Some services like AWS EC2 require setting the `internal_address:` if you want to use self-referencing security groups or firewalls.
+
+RKE will need to connect to each node over SSH, and it will look for a private key in the default location of `~/.ssh/id_rsa`. If your private key for a certain node is in a different location than the default, you will also need to configure the `ssh_key_path` option for that node.
+
+```yaml
+nodes:
+  - address: 165.227.114.63
+    internal_address: 172.16.22.12
+    user: ubuntu
+    role: [controlplane, worker, etcd]
+  - address: 165.227.116.167
+    internal_address: 172.16.32.37
+    user: ubuntu
+    role: [controlplane, worker, etcd]
+  - address: 165.227.127.226
+    internal_address: 172.16.42.73
+    user: ubuntu
+    role: [controlplane, worker, etcd]
+
+services:
+  etcd:
+    snapshot: true
+    creation: 6h
+    retention: 24h
+
+# Required for external TLS termination with
+# ingress-nginx v0.22+
+ingress:
+  provider: nginx
+  options:
+    use-forwarded-headers: "true"
+```
+
+<figcaption>Common RKE Nodes Options</figcaption>
+
+| Option             | Required | Description                                                                            |
+| ------------------ | -------- | -------------------------------------------------------------------------------------- |
+| `address`          | yes      | The public DNS or IP address                                                           |
+| `user`             | yes      | A user that can run docker commands                                                    |
+| `role`             | yes      | List of Kubernetes roles assigned to the node                                          |
+| `internal_address` | no       | The private DNS or IP address for internal cluster traffic                             |
+| `ssh_key_path`     | no       | Path to SSH private key used to authenticate to the node (defaults to `~/.ssh/id_rsa`) |
+
+> **Advanced Configurations:** RKE has many configuration options for customizing the install to suit your specific environment.
+>
+> Please see the [RKE Documentation]({{<baseurl>}}/rke/latest/en/config-options/) for the full list of options and capabilities.
+> 
+> For tuning your etcd cluster for larger Rancher installations, see the [etcd settings guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/etcd/).
+
+### 2. Run RKE
+
+```
+rke up --config ./rancher-cluster.yml
+```
+
+When finished, it should end with the line: `Finished building Kubernetes cluster successfully`.
+
+### 3. Test Your Cluster
+
+This section describes how to set up your workspace so that you can interact with this cluster using the `kubectl` command-line tool.
+
+Assuming you have installed `kubectl`, you need to place the `kubeconfig` file in a location where `kubectl` can reach it. The `kubeconfig` file contains the credentials necessary to access your cluster with `kubectl`.
+
+When you ran `rke up`, RKE should have created a `kubeconfig` file named `kube_config_rancher-cluster.yml`. This file has the credentials for `kubectl` and `helm`.
+
+> **Note:** If you have used a different file name from `rancher-cluster.yml`, then the kube config file will be named `kube_config_<FILE_NAME>.yml`.
+
+Move this file to `$HOME/.kube/config`, or if you are working with multiple Kubernetes clusters, set the `KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`:
+
+```
+export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml
+```
+
+Test your connectivity with `kubectl` and see if all your nodes are in `Ready` state:
+
+```
+kubectl get nodes
+
+NAME                          STATUS    ROLES                      AGE       VERSION
+165.227.114.63                Ready     controlplane,etcd,worker   11m       v1.13.5
+165.227.116.167               Ready     controlplane,etcd,worker   11m       v1.13.5
+165.227.127.226               Ready     controlplane,etcd,worker   11m       v1.13.5
+```
+
+### 4. Check the Health of Your Cluster Pods
+
+Check that all the required pods and containers are healthy are ready to continue.
+
+- Pods are in `Running` or `Completed` state.
+- `READY` column shows all the containers are running (i.e. `3/3`) for pods with `STATUS` `Running`
+- Pods with `STATUS` `Completed` are run-once Jobs. For these pods `READY` should be `0/1`.
+
+```
+kubectl get pods --all-namespaces
+
+NAMESPACE       NAME                                      READY     STATUS      RESTARTS   AGE
+ingress-nginx   nginx-ingress-controller-tnsn4            1/1       Running     0          30s
+ingress-nginx   nginx-ingress-controller-tw2ht            1/1       Running     0          30s
+ingress-nginx   nginx-ingress-controller-v874b            1/1       Running     0          30s
+kube-system     canal-jp4hz                               3/3       Running     0          30s
+kube-system     canal-z2hg8                               3/3       Running     0          30s
+kube-system     canal-z6kpw                               3/3       Running     0          30s
+kube-system     kube-dns-7588d5b5f5-sf4vh                 3/3       Running     0          30s
+kube-system     kube-dns-autoscaler-5db9bbb766-jz2k6      1/1       Running     0          30s
+kube-system     metrics-server-97bc649d5-4rl2q            1/1       Running     0          30s
+kube-system     rke-ingress-controller-deploy-job-bhzgm   0/1       Completed   0          30s
+kube-system     rke-kubedns-addon-deploy-job-gl7t4        0/1       Completed   0          30s
+kube-system     rke-metrics-addon-deploy-job-7ljkc        0/1       Completed   0          30s
+kube-system     rke-network-plugin-deploy-job-6pbgj       0/1       Completed   0          30s
+```
+
+This confirms that you have successfully installed a Kubernetes cluster that the Rancher server will run on.
+
+### 5. Save Your Files
+
+> **Important**
+> The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster.
+
+Save a copy of the following files in a secure location:
+
+- `rancher-cluster.yml`: The RKE cluster configuration file.
+- `kube_config_rancher-cluster.yml`: The [Kubeconfig file]({{<baseurl>}}/rke/latest/en/kubeconfig/) for the cluster, this file contains credentials for full access to the cluster.
+- `rancher-cluster.rkestate`: The [Kubernetes Cluster State file]({{<baseurl>}}/rke/latest/en/installation/#kubernetes-cluster-state), this file contains credentials for full access to the cluster.<br/><br/>_The Kubernetes Cluster State file is only created when using RKE v0.2.0 or higher._
+
+> **Note:** The "rancher-cluster" parts of the two latter file names are dependent on how you name the RKE cluster configuration file.
+
+### Issues or errors?
+
+See the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) page.
+
+### [Next: Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE2/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE2/_index.md
new file mode 100644
index 00000000000..761f01d1c76
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE2/_index.md
@@ -0,0 +1,7 @@
+---
+title: Setting up a High-availability RKE2 Kubernetes Cluster
+shortTitle: Set up RKE2 Kubernetes
+weight: 4
+---
+
+> This page is under construction
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/how-ha-works/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/how-ha-works/_index.md
new file mode 100644
index 00000000000..9aaf3bb236d
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/how-ha-works/_index.md
@@ -0,0 +1,25 @@
+---
+title: About High-availability Installations
+weight: 1
+---
+
+We recommend using [Helm,]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/concepts/#about-helm) a Kubernetes package manager, to install Rancher on a dedicated Kubernetes cluster. This is called a high-availability Kubernetes installation because increased availability is achieved by running Rancher on multiple nodes.
+
+In a standard installation, Kubernetes is first installed on three nodes that are hosted in an infrastructure provider such as Amazon's EC2 or Google Compute Engine.
+
+Then Helm is used to install Rancher on top of the Kubernetes cluster. Helm uses Rancher's Helm chart to install a replica of Rancher on each of the three nodes in the Kubernetes cluster. We recommend using a load balancer to direct traffic to each replica of Rancher in the cluster, in order to increase Rancher's availability.
+
+The Rancher server data is stored on etcd. This etcd database also runs on all three nodes, and requires an odd number of nodes so that it can always elect a leader with a majority of the etcd cluster. If the etcd database cannot elect a leader, etcd can fail, requiring the cluster to be restored from backup.
+
+For information on how Rancher works, regardless of the installation method, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture)
+
+### Recommended Architecture
+
+- DNS for Rancher should resolve to a layer 4 load balancer
+- The Load Balancer should forward port TCP/80 and TCP/443 to all 3 nodes in the Kubernetes cluster.
+- The Ingress controller will redirect HTTP to HTTPS and terminate SSL/TLS on port TCP/443.
+- The Ingress controller will forward traffic to port TCP/80 on the pod in the Rancher deployment.
+
+<figcaption>Kubernetes Rancher install with layer 4 load balancer, depicting SSL termination at ingress controllers</figcaption>
+![High-availability Kubernetes Installation of Rancher]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
+<sup>Kubernetes Rancher install with Layer 4 load balancer (TCP), depicting SSL termination at ingress controllers</sup>
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
new file mode 100644
index 00000000000..c24bffb45ad
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
@@ -0,0 +1,15 @@
+---
+title: Don't have infrastructure for your Kubernetes cluster? Try one of these tutorials.
+shortTitle: Infrastructure Tutorials
+weight: 5
+---
+
+The K3s documentation has:
+
+- Instructions for [setting up infrastructure for a high-availability K3s Kubernetes cluster with an external DB]({{<baseurl>}}/k3s/latest/en/installation/tutorials/ha-with-external-db)
+- Instructions for [setting up a high-availability K3s Kubernetes cluster with an external DB for a Rancher server]({{<baseurl>}}/k3s/latest/en/installation/tutorials/ha-with-external-db)
+
+The RKE documentation has:
+
+- Instructions for [setting up infrastructure for a high-availability RKE Kubernetes cluster]({{<baseurl>}}/)
+- Instructions for [setting up a high-availability RKE cluster]()
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
new file mode 100644
index 00000000000..ecf063ca94e
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
@@ -0,0 +1,64 @@
+---
+title: Setting up Nodes in Amazon EC2
+weight: 3
+---
+
+In this tutorial, you will learn one way to set up Linux nodes for the Rancher management server. These nodes will fulfill the node requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+
+If the Rancher server will be installed on an RKE Kubernetes cluster, you should provision three instances.
+
+If the Rancher server will be installed on a K3s Kubernetes cluster, you only need to provision two instances.
+
+If the Rancher server is installed in a single Docker container, you only need one instance.
+
+### 1. Optional Preparation
+
+- **Create IAM role:** To allow Rancher to manipulate AWS resources, such as provisioning new storage or new nodes, you will need to configure Amazon as a cloud provider. There are several things you'll need to do to set up the cloud provider on EC2, but part of this process is setting up an IAM role for the Rancher server nodes. For the full details on setting up the cloud provider, refer to this [page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/)
+- **Create security group:** We also recommend setting up a security group for the Rancher nodes that complies with the [port requirements for Rancher nodes.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/#port-requirements)
+
+### 2. Provision Instances
+
+1. Log into the [Amazon AWS EC2 Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to take note of the **Region** where your EC2 instances (Linux nodes) are created, because all of the infrastructure for the Rancher management server should be in the same region.
+1. In the left panel, click **Instances.**
+1. Click **Launch Instance.**
+1. In the section called **Step 1: Choose an Amazon Machine Image (AMI),** we will use Ubuntu 18.04 as the Linux OS, using `ami-0d1cd67c26f5fca19 (64-bit x86)`. Go to the Ubuntu AMI and click **Select.**
+1. In the **Step 2: Choose an Instance Type** section, select the `t2.medium` type.
+1. Click **Next: Configure Instance Details.**
+1. In the **Number of instances** field, enter the number of instances. A high-availability K3s cluster requires only two instances, while a high-availability RKE cluster requires three instances.
+1. Optional: If you created an IAM role for Rancher to manipulate AWS resources, select the new IAM role in the **IAM role** field.
+1. Click **Next: Add Storage,** **Next: Add Tags,** and **Next: Configure Security Group.**
+1. In **Step 6: Configure Security Group,** select a security group that complies with the [port requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/#port-requirements) for Rancher nodes.
+1. Click **Review and Launch.**
+1. Click **Launch.**
+1. Choose a new or existing key pair that you will use to connect to your instance later. If you are using an existing key pair, make sure you already have access to the private key.
+1. Click **Launch Instances.**
+
+**Result:** You have created Rancher nodes that satisfy the requirements for OS, hardware, and networking. Next, you will install Docker on each node.
+
+### 3. Install Docker and Create User
+
+1. From the [AWS EC2 console,](https://console.aws.amazon.com/ec2/) click **Instances** in the left panel.
+1. Go to the instance that you want to install Docker on. Select the instance and click **Actions > Connect.**
+1. Connect to the instance by following the instructions on the screen that appears. Copy the Public DNS of the instance. An example command to SSH into the instance is as follows:
+```
+sudo ssh -i [path-to-private-key] ubuntu@[public-DNS-of-instance]
+```
+1. When you are connected to the instance, run the following command on the instance to create a user:
+```
+sudo usermod -aG docker ubuntu
+```
+1. Run the following command on the instance to install Docker with one of Rancher's installation scripts:
+```
+curl https://releases.rancher.com/install-docker/18.09.sh | sh
+```
+1. Repeat these steps so that Docker is installed on each node that will eventually run the Rancher management server.
+
+> To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher’s Docker installation scripts.
+
+**Result:** You have set up Rancher server nodes that fulfill all the node requirements for OS, Docker, hardware and networking.
+
+### Next Steps for RKE Kubernetes Cluster Nodes
+
+If you are going to install an RKE cluster on the new nodes, take note of the **IPv4 Public IP** and **Private IP** of each node. This information can be found on the **Description** tab for each node after it is created. The public and private IP will be used to populate the `address` and `internal_address` of each node in the RKE cluster configuration file, `rancher-cluster.yml`.
+
+RKE will also need access to the private key to connect to each node. Therefore, you might want to take note of the path to your private keys to connect to the nodes, which can also be included in the `rancher-cluster.yml` under the `ssh_key_path` directive for each node.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
new file mode 100644
index 00000000000..b3f3a4b8dcf
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
@@ -0,0 +1,84 @@
+---
+title: Setting up an NGINX Load Balancer
+weight: 4
+aliases:
+---
+
+NGINX will be configured as Layer 4 load balancer (TCP) that forwards connections to one of your Rancher nodes.
+
+In this configuration, the load balancer is positioned in front of your nodes. The load balancer can be any host capable of running NGINX.
+
+One caveat: do not use one of your Rancher nodes as the load balancer.
+
+> These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
+
+## Install NGINX
+
+Start by installing NGINX on the node you want to use as a load balancer. NGINX has packages available for all known operating systems. The versions tested are `1.14` and `1.15`. For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
+
+The `stream` module is required, which is present when using the official NGINX packages. Please refer to your OS documentation on how to install and enable the NGINX `stream` module on your operating system.
+
+## Create NGINX Configuration
+
+After installing NGINX, you need to update the NGINX configuration file, `nginx.conf`, with the IP addresses for your nodes.
+
+1.  Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`.
+
+2.  From `nginx.conf`, replace both occurrences (port 80 and port 443) of `<IP_NODE_1>`, `<IP_NODE_2>`, and `<IP_NODE_3>` with the IPs of your [nodes]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/).
+
+    > **Note:** See [NGINX Documentation: TCP and UDP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/) for all configuration options.
+
+    <figcaption>Example NGINX config</figcaption>
+    ```
+    worker_processes 4;
+    worker_rlimit_nofile 40000;
+
+    events {
+        worker_connections 8192;
+    }
+
+    stream {
+        upstream rancher_servers_http {
+            least_conn;
+            server <IP_NODE_1>:80 max_fails=3 fail_timeout=5s;
+            server <IP_NODE_2>:80 max_fails=3 fail_timeout=5s;
+            server <IP_NODE_3>:80 max_fails=3 fail_timeout=5s;
+        }
+        server {
+            listen 80;
+            proxy_pass rancher_servers_http;
+        }
+
+        upstream rancher_servers_https {
+            least_conn;
+            server <IP_NODE_1>:443 max_fails=3 fail_timeout=5s;
+            server <IP_NODE_2>:443 max_fails=3 fail_timeout=5s;
+            server <IP_NODE_3>:443 max_fails=3 fail_timeout=5s;
+        }
+        server {
+            listen     443;
+            proxy_pass rancher_servers_https;
+        }
+
+    }
+    ```
+
+
+3.  Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`.
+
+4.  Load the updates to your NGINX configuration by running the following command:
+
+    ```
+    # nginx -s reload
+    ```
+
+## Option - Run NGINX as Docker container
+
+Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container:
+
+```
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -v /etc/nginx.conf:/etc/nginx/nginx.conf \
+  nginx:1.14
+```
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
new file mode 100644
index 00000000000..93dabfc5113
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
@@ -0,0 +1,179 @@
+---
+title: Setting up Amazon ELB Network Load Balancer
+weight: 5
+---
+
+This how-to guide describes how to set up a Network Load Balancer (NLB) in Amazon's EC2 service that will direct traffic to multiple instances on EC2.
+
+These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
+
+This tutorial is about one possible way to set up your load balancer, not the only way. Other types of load balancers, such as a Classic Load Balancer or Application Load Balancer, could also direct traffic to the Rancher server nodes.
+
+Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ALB.
+
+# Setting up the Load Balancer
+
+Configuring an Amazon NLB is a multistage process:
+
+1. [Create Target Groups](#1-create-target-groups)
+2. [Register Targets](#2-register-targets)
+3. [Create Your NLB](#3-create-your-nlb)
+4. [Add listener to NLB for TCP port 80](#4-add-listener-to-nlb-for-tcp-port-80)
+
+# Requirements
+
+These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
+
+# 1. Create Target Groups
+
+Begin by creating two target groups for the **TCP** protocol, one with TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
+
+Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but it's convenient to add a listener for port 80, because traffic to port 80 will be automatically redirected to port 443.
+
+Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, the Ingress should redirect traffic from port 80 to port 443.
+
+1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
+1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
+1. Click **Create target group** to create the first target group, regarding TCP port 443.
+
+> **Note:** Health checks are handled differently based on the Ingress. For details, refer to [this section.](#health-check-paths-for-nginx-ingress-and-traefik-ingresses)
+
+### Target Group (TCP port 443)
+
+Configure the first target group according to the table below.
+
+| Option            | Setting           |
+|-------------------|-------------------|
+| Target Group Name | `rancher-tcp-443` |
+| Target type       | `instance`        |
+| Protocol          | `TCP`             |
+| Port              | `443`             |
+| VPC               | Choose your VPC   |
+
+Health check settings:
+
+| Option              | Setting         |
+|---------------------|-----------------|
+| Protocol            | TCP             |
+| Port                | `override`,`80` |
+| Healthy threshold   | `3`             |
+| Unhealthy threshold | `3`             |
+| Timeout             | `6 seconds`     |
+| Interval            | `10 seconds`    |
+
+Click **Create target group** to create the second target group, regarding TCP port 80.
+
+### Target Group (TCP port 80)
+
+Configure the second target group according to the table below.
+
+| Option            | Setting          |
+|-------------------|------------------|
+| Target Group Name | `rancher-tcp-80` |
+| Target type       | `instance`       |
+| Protocol          | `TCP`            |
+| Port              | `80`             |
+| VPC               | Choose your VPC  |
+
+
+Health check settings:
+
+| Option              |Setting         |
+|---------------------|----------------|
+| Protocol            | TCP            |
+| Port                | `traffic port` |
+| Healthy threshold   | `3`            |
+| Unhealthy threshold | `3`            |
+| Timeout             | `6 seconds`    |
+| Interval            | `10 seconds`   |
+
+# 2. Register Targets
+
+Next, add your Linux nodes to both target groups.
+
+Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**.
+
+{{< img "/img/rancher/ha/nlb/edit-targetgroup-443.png" "Edit target group 443">}}
+
+Select the instances (Linux nodes) you want to add, and click **Add to registered**.
+
+<hr>
+**Screenshot Add targets to target group TCP port 443**<br/>
+
+{{< img "/img/rancher/ha/nlb/add-targets-targetgroup-443.png" "Add targets to target group 443">}}
+
+<hr>
+**Screenshot Added targets to target group TCP port 443**<br/>
+
+{{< img "/img/rancher/ha/nlb/added-targets-targetgroup-443.png" "Added targets to target group 443">}}
+
+When the instances are added, click **Save** on the bottom right of the screen.
+
+Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group.
+
+# 3. Create Your NLB
+
+Use Amazon's Wizard to create a Network Load Balancer. As part of this process, you'll add the target groups you created in [1. Create Target Groups](#1-create-target-groups).
+
+1.  From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
+
+2.  From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**.
+
+3.  Click **Create Load Balancer**.
+
+4.  Choose **Network Load Balancer** and click **Create**. Then complete each form.
+
+- [Step 1: Configure Load Balancer](#step-1-configure-load-balancer)
+- [Step 2: Configure Routing](#step-2-configure-routing)
+- [Step 3: Register Targets](#step-3-register-targets)
+- [Step 4: Review](#step-4-review)
+
+### Step 1: Configure Load Balancer
+
+Set the following fields in the form:
+
+- **Name:** `rancher`
+- **Scheme:** `internal` or `internet-facing`. The scheme that you choose for your NLB is dependent on the configuration of your instances and VPC. If your instances do not have public IPs associated with them, or you will only be accessing Rancher internally, you should set your NLB Scheme to `internal` rather than `internet-facing`.
+- **Listeners:** The Load Balancer Protocol should be `TCP` and the corresponding Load Balancer Port should be set to `443`.
+- **Availability Zones:** Select Your **VPC** and **Availability Zones**.
+
+### Step 2: Configure Routing
+
+1. From the **Target Group** drop-down, choose **Existing target group**.
+1. From the **Name** drop-down, choose `rancher-tcp-443`.
+1. Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.
+
+### Step 3: Register Targets
+
+Since you registered your targets earlier, all you have to do is click **Next: Review**.
+
+### Step 4: Review
+
+Look over the load balancer details and click **Create** when you're satisfied.
+
+After AWS creates the NLB, click **Close**.
+
+# 4. Add listener to NLB for TCP port 80
+
+1. Select your newly created NLB and select the **Listeners** tab.
+
+2. Click **Add listener**.
+
+3. Use `TCP`:`80` as **Protocol** : **Port**
+
+4. Click **Add action** and choose **Forward to...**
+
+5. From the **Forward to** drop-down, choose `rancher-tcp-80`.
+
+6. Click **Save** in the top right of the screen.
+
+# Health Check Paths for NGINX Ingress and Traefik Ingresses
+
+K3s and RKE Kubernetes clusters handle health checks differently because they use different Ingresses by default.
+
+For RKE Kubernetes clusters, NGINX Ingress is used by default, whereas for K3s Kubernetes clusters, Traefik is the default Ingress. 
+
+- **Traefik:** The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
+- **NGINX Ingress:** The default backend of the NGINX Ingress controller has a `/healthz` endpoint. By default `/healthz` is always matched (regardless of Host), and a response from [`ingress-nginx` itself](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212) is always served.
+
+To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
new file mode 100644
index 00000000000..f40b9f96b59
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
@@ -0,0 +1,34 @@
+---
+title: Setting up a MySQL Database in Amazon RDS
+weight: 4
+---
+This tutorial describes how to set up a MySQL database in Amazon's RDS.
+
+This database can later be used as an external datastore for a high-availability K3s Kubernetes cluster.
+
+1. Log into the [Amazon AWS RDS Console](https://console.aws.amazon.com/rds/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
+1. In the left panel, click **Databases.**
+1. Click **Create database.**
+1. In the **Engine type** section, click **MySQL.**
+1. In the **Version** section, choose **MySQL 5.7.22.**
+1. In **Settings** section, under **Credentials Settings,** enter a master password for the **admin** master username. Confirm the password.
+1. Expand the **Additional configuration** section. In the **Initial database name** field, enter a name. The name can have only letters, numbers, and underscores. This name will be used to connect to the database.
+1. Click **Create database.**
+
+You'll need to capture the following information about the new database so that the K3s Kubernetes cluster can connect to it.
+
+To see this information in the Amazon RDS console, click **Databases,** and click the name of the database that you created.
+
+- **Username:** Use the admin username.
+- **Password:** Use the admin password.
+- **Hostname:** Use the **Endpoint** as the hostname. The endpoint is available in the **Connectivity & security** section.
+- **Port:** The port should be 3306 by default. You can confirm it in the **Connectivity & security** section.
+- **Database name:** Confirm the name by going to the **Configuration** tab. The name is listed under **DB name.**
+
+This information will be used to connect to the database in the following format:
+
+```
+mysql://username:password@tcp(hostname:3306)/database-name
+```
+
+For more information on configuring the datastore for K3s, refer to the [K3s documentation.]({{<baseurl>}}/k3s/latest/en/installation/datastore/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/_index.md
new file mode 100644
index 00000000000..09b8bca60bd
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/_index.md
@@ -0,0 +1,150 @@
+---
+title: Installing Rancher on a Single Node Using Docker
+description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container.
+weight: 1
+---
+
+> This section is under construction.
+
+For development and testing environments only, Rancher can be installed by running a single Docker container.
+
+In this installation scenario, you'll install Docker on a single Linux host, and then deploy Rancher on your host using a single Docker container.
+
+> **Want to use an external load balancer?**
+> See [Docker Install with an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/single-node-install-external-lb) instead.
+
+# Requirements for OS, Docker, Hardware, and Networking
+
+Make sure that your node fulfills the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+
+# 1. Provision Linux Host
+
+Provision a single Linux host according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements) to launch your Rancher server.
+
+# 2. Choose an SSL Option and Install Rancher
+
+For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
+
+> **Do you want to...**
+>
+> - Use a proxy? See [HTTP Proxy Configuration]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/)
+> - Configure custom CA root certificate to access your services? See [Custom CA root certificate]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/#custom-ca-certificate/)
+> - Complete an Air Gap Installation? See [Air Gap: Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/)
+> - Record all transactions with the Rancher API? See [API Auditing](#api-audit-log)
+
+Choose from the following options:
+
+### Option A: Default Rancher-generated Self-signed Certificate
+
+If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself.
+
+Log into your Linux host, and then run the minimum installation command below.
+
+```bash
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  rancher/rancher:latest
+```
+
+### Option B: Bring Your Own Certificate, Self-signed
+In development or testing environments where your team will access your Rancher server, create a self-signed certificate for use with your install so that your team can verify they're connecting to your instance of Rancher.
+
+> **Prerequisites:**
+> Create a self-signed certificate using [OpenSSL](https://www.openssl.org/) or another method of your choice.
+>
+> - The certificate files must be in [PEM format](#pem).
+> - In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
+
+After creating your certificate, run the Docker command below to install Rancher. Use the `-v` flag and provide the path to your certificates to mount them in your container.
+
+| Placeholder         | Description     |
+| ------------------- | --------------------- |
+| `<CERT_DIRECTORY>`  | The path to the directory containing your certificate files. |
+| `<FULL_CHAIN.pem>`  | The path to your full certificate chain.                     |
+| `<PRIVATE_KEY.pem>` | The path to the private key for your certificate.            |
+| `<CA_CERTS.pem>`        | The path to the certificate authority's certificate.         |
+
+```bash
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+  -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
+  rancher/rancher:latest
+```
+
+### Option C: Bring Your Own Certificate, Signed by a Recognized CA
+
+In production environments where you're exposing an app publicly, use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings.
+
+> **Prerequisites:**
+>
+> - The certificate files must be in [PEM format](#pem).
+> - In your certificate file, include all intermediate certificates provided by the recognized CA. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
+
+After obtaining your certificate, run the Docker command below.
+
+- Use the `-v` flag and provide the path to your certificates to mount them in your container. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary.
+- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
+
+| Placeholder         | Description    |
+| ------------------- | ----------------------------- |
+| `<CERT_DIRECTORY>`  | The path to the directory containing your certificate files. |
+| `<FULL_CHAIN.pem>`  | The path to your full certificate chain.                     |
+| `<PRIVATE_KEY.pem>` | The path to the private key for your certificate. |
+
+```bash
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+  rancher/rancher:latest \
+  --no-cacerts
+```
+
+### Option D: Let's Encrypt Certificate
+
+> **Remember:** Let's Encrypt provides rate limits for requesting new certificates. Therefore, limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/).
+
+For production environments, you also have the option of using [Let's Encrypt](https://letsencrypt.org/) certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS.
+
+> **Prerequisites:**
+>
+> - Let's Encrypt is an Internet service. Therefore, this option cannot be used in an internal/air gapped network.
+> - Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example).
+> - Open port `TCP/80` on your Linux host. The Let's Encrypt http-01 challenge can come from any source IP address, so port `TCP/80` must be open to all IP addresses.
+
+After you fulfill the prerequisites, you can install Rancher using a Let's Encrypt certificate by running the following command.
+
+| Placeholder       | Description         |
+| ----------------- | ------------------- |
+| `<YOUR.DNS.NAME>` | Your domain address |
+
+```
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  rancher/rancher:latest \
+  --acme-domain <YOUR.DNS.NAME>
+```
+
+## Advanced Options
+
+When installing Rancher on a single node with Docker, there are several advanced options that can be enabled:
+
+- Custom CA Certificate
+- API Audit Log
+- TLS Settings
+- Air Gap
+- Persistent Data
+- Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node
+
+Refer to [this page](./advanced) for details.
+
+## Troubleshooting
+
+Refer to [this page](./troubleshooting) for frequently asked questions and troubleshooting tips.
+
+## What's Next?
+
+- **Recommended:** Review [Single Node Backup and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). Although you don't have any data you need to back up right now, we recommend creating backups after regular Rancher use.
+- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/advanced/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/advanced/_index.md
new file mode 100644
index 00000000000..c6c3ccf2123
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/advanced/_index.md
@@ -0,0 +1,93 @@
+---
+title: Advanced Options for Docker Installs
+weight: 2
+---
+
+When installing Rancher, there are several [advanced options]({{<baseurl>}}/rancher/v2.x/en/installation/options/) that can be enabled:
+
+- [Custom CA Certificate](#custom-ca-certificate)
+- [API Audit Log](#api-audit-log)
+- [TLS Settings](#tls-settings)
+- [Air Gap](#air-gap)
+- [Persistent Data](#persistent-data)
+- [Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node](#running-rancher-rancher-and-rancher-rancher-agent-on-the-same-node)
+
+### Custom CA Certificate
+
+If you want to configure Rancher to use a CA root certificate to be used when validating services, you would start the Rancher container sharing the directory that contains the CA root certificate.
+
+Use the command example to start a Rancher container with your private CA certificates mounted.
+
+- The volume flag (`-v`) should specify the host directory containing the CA root certificates.
+- The environment variable flag (`-e`) in combination with `SSL_CERT_DIR` and directory declares an environment variable that specifies the mounted CA root certificates directory location inside the container.
+- Passing environment variables to the Rancher container can be done using `-e KEY=VALUE` or `--env KEY=VALUE`.
+- Mounting a host directory inside the container can be done using `-v host-source-directory:container-destination-directory` or `--volume host-source-directory:container-destination-directory`.
+
+The example below is based on having the CA root certificates in the `/host/certs` directory on the host and mounting this directory on `/container/certs` inside the Rancher container.
+
+```
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -v /host/certs:/container/certs \
+  -e SSL_CERT_DIR="/container/certs" \
+  rancher/rancher:latest
+```
+
+### API Audit Log
+
+The API Audit Log records all the user and system transactions made through Rancher server.
+
+The API Audit Log writes to `/var/log/auditlog` inside the rancher container by default. Share that directory as a volume and set your `AUDIT_LEVEL` to enable the log.
+
+See [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) for more information and options.
+
+```
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -v /var/log/rancher/auditlog:/var/log/auditlog \
+  -e AUDIT_LEVEL=1 \
+  rancher/rancher:latest
+```
+
+### TLS settings
+
+_Available as of v2.1.7_
+
+To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
+
+```
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -e CATTLE_TLS_MIN_VERSION="1.0" \
+  rancher/rancher:latest
+```
+
+See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options.
+
+### Air Gap
+
+If you are visiting this page to complete an air gap installation, you must prepend your private registry URL to the server tag when running the installation command in the option that you choose. Add `<REGISTRY.DOMAIN.COM:PORT>` with your private registry URL in front of `rancher/rancher:latest`.
+
+**Example:**
+
+     <REGISTRY.DOMAIN.COM:PORT>/rancher/rancher:latest
+
+### Persistent Data
+
+{{< persistentdata >}}
+
+### Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node
+
+In the situation where you want to use a single node to run Rancher and to be able to add the same node to a cluster, you have to adjust the host ports mapped for the `rancher/rancher` container.
+
+If a node is added to a cluster, it deploys the nginx ingress controller which will use port 80 and 443. This will conflict with the default ports we advise to expose for the `rancher/rancher` container.
+
+Please note that this setup is not recommended for production use, but can be convenient for development/demo purposes.
+
+To change the host ports mapping, replace the following part `-p 80:80 -p 443:443` with `-p 8080:80 -p 8443:443`:
+
+```
+docker run -d --restart=unless-stopped \
+  -p 8080:80 -p 8443:443 \
+  rancher/rancher:latest
+```
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/installing-docker/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/installing-docker/_index.md
new file mode 100644
index 00000000000..ac20da0afe8
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/installing-docker/_index.md
@@ -0,0 +1,18 @@
+---
+title: Installing Docker
+weight: 1
+---
+
+Docker is required to be installed on any node that runs the Rancher server.
+
+There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution.
+
+Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker.
+
+For example, this command could be used to install Docker 18.09 on Ubuntu:
+
+```
+curl https://releases.rancher.com/install-docker/18.09.sh | sh
+```
+
+To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/proxy/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/proxy/_index.md
new file mode 100644
index 00000000000..62445cbc6e1
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/proxy/_index.md
@@ -0,0 +1,36 @@
+---
+title: HTTP Proxy Configuration for Docker Installs
+weight: 3
+---
+
+If you operate Rancher behind a proxy and you want to access services through the proxy (such as retrieving catalogs), you must provide Rancher information about your proxy. As Rancher is written in Go, it uses the common proxy environment variables as shown below.
+
+Make sure `NO_PROXY` contains the network addresses, network address ranges and domains that should be excluded from using the proxy.
+
+| Environment variable | Purpose                                                                                                                 |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| HTTP_PROXY           | Proxy address to use when initiating HTTP connection(s)                                                                 |
+| HTTPS_PROXY          | Proxy address to use when initiating HTTPS connection(s)                                                                |
+| NO_PROXY             | Network address(es), network address range(s) and domains to exclude from using the proxy when initiating connection(s) |
+
+> **Note** NO_PROXY must be in uppercase to use network range (CIDR) notation.
+
+## Docker Installation
+
+Passing environment variables to the Rancher container can be done using `-e KEY=VALUE` or `--env KEY=VALUE`. Required values for `NO_PROXY` in a [Docker Installation]({{<baseurl>}}/rancher/v2.x/en/installation/single-node-install/) are:
+
+- `localhost`
+- `127.0.0.1`
+- `0.0.0.0`
+- `10.0.0.0/8`
+
+The example below is based on a proxy server accessible at `http://192.168.0.1:3128`, and excluding usage the proxy when accessing network range `192.168.10.0/24` and every hostname under the domain `example.com`.
+
+```
+docker run -d --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -e HTTP_PROXY="http://192.168.10.1:3128" \
+  -e HTTPS_PROXY="http://192.168.10.1:3128" \
+  -e NO_PROXY="localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,192.168.10.0/24,example.com" \
+  rancher/rancher:latest
+```
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/single-node-install-external-lb/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/single-node-install-external-lb/_index.md
new file mode 100644
index 00000000000..d02f30e551e
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/single-node-install-external-lb/_index.md
@@ -0,0 +1,240 @@
+---
+title: Docker Install with TLS Termination at Layer-7 NGINX Load Balancer
+weight: 4
+---
+
+For development and testing environments that have a special requirement to terminate TLS/SSL at a load balancer instead of your Rancher Server container, deploy Rancher and configure a load balancer to work with it conjunction.
+
+A layer-7 load balancer can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with.
+
+This install procedure walks you through deployment of Rancher using a single container, and then provides a sample configuration for a layer-7 NGINX load balancer.
+
+> **Want to skip the external load balancer?**
+> See [Docker Installation]({{<baseurl>}}/rancher/v2.x/en/installation/single-node) instead.
+
+## Requirements for OS, Docker, Hardware, and Networking
+
+Make sure that your node fulfills the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+
+## Installation Outline
+
+<!-- TOC -->
+
+- [1. Provision Linux Host](#1-provision-linux-host)
+- [2. Choose an SSL Option and Install Rancher](#2-choose-an-ssl-option-and-install-rancher)
+- [3. Configure Load Balancer](#3-configure-load-balancer)
+
+<!-- /TOC -->
+
+## 1. Provision Linux Host
+
+Provision a single Linux host according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements) to launch your {{< product >}} Server.
+
+## 2. Choose an SSL Option and Install Rancher
+
+For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
+
+> **Do you want to...**
+>
+> - Complete an Air Gap Installation?
+> - Record all transactions with the Rancher API?
+>
+> See [Advanced Options](#advanced-options) below before continuing.
+
+Choose from the following options:
+
+{{% accordion id="option-a" label="Option A-Bring Your Own Certificate: Self-Signed" %}}
+If you elect to use a self-signed certificate to encrypt communication, you must install the certificate on your load balancer (which you'll do later) and your Rancher container. Run the Docker command to deploy Rancher, pointing it toward your certificate.
+
+> **Prerequisites:**
+> Create a self-signed certificate.
+>
+> - The certificate files must be in [PEM format](#pem).
+
+**To Install Rancher Using a Self-Signed Cert:**
+
+1. While running the Docker command to deploy Rancher, point Docker toward your CA certificate file.
+
+   ```
+   docker run -d --restart=unless-stopped \
+     -p 80:80 -p 443:443 \
+     -v /etc/your_certificate_directory/cacerts.pem:/etc/rancher/ssl/cacerts.pem \
+     rancher/rancher:latest
+   ```
+
+{{% /accordion %}}
+{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Signed by Recognized CA" %}}
+If your cluster is public facing, it's best to use a certificate signed by a recognized CA.
+
+> **Prerequisites:**
+>
+> - The certificate files must be in [PEM format](#pem).
+
+**To Install Rancher Using a Cert Signed by a Recognized CA:**
+
+If you use a certificate signed by a recognized CA, installing your certificate in the Rancher container isn't necessary. We do have to make sure there is no default CA certificate generated and stored, you can do this by passing the `--no-cacerts` parameter to the container.
+
+1.  Enter the following command.
+
+        ```
+        docker run -d --restart=unless-stopped \
+        -p 80:80 -p 443:443 \
+        rancher/rancher:latest --no-cacerts
+        ```
+
+    {{% /accordion %}}
+
+## 3. Configure Load Balancer
+
+When using a load balancer in front of your Rancher container, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https` header, this redirect is disabled.
+
+The load balancer or proxy has to be configured to support the following:
+
+- **WebSocket** connections
+- **SPDY** / **HTTP/2** protocols
+- Passing / setting the following headers:
+
+    | Header | Value | Description |
+    |--------|-------|-------------|
+    | `Host`                | Hostname used to reach Rancher.          | To identify the server requested by the client.
+    | `X-Forwarded-Proto`   | `https`                                  | To identify the protocol that a client used to connect to the load balancer or proxy.<br /><br/>**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS.
+    | `X-Forwarded-Port`    | Port used to reach Rancher.              | To identify the protocol that client used to connect to the load balancer or proxy.
+    | `X-Forwarded-For`     | IP of the client connection.             | To identify the originating IP address of a client.
+### Example NGINX configuration
+
+This NGINX configuration is tested on NGINX 1.14.
+
+> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/).
+
+- Replace `rancher-server` with the IP address or hostname of the node running the Rancher container.
+- Replace both occurrences of `FQDN` to the DNS name for Rancher.
+- Replace `/certs/fullchain.pem` and `/certs/privkey.pem` to the location of the server certificate and the server certificate key respectively.
+
+```
+worker_processes 4;
+worker_rlimit_nofile 40000;
+
+events {
+    worker_connections 8192;
+}
+
+http {
+    upstream rancher {
+        server rancher-server:80;
+    }
+
+    map $http_upgrade $connection_upgrade {
+        default Upgrade;
+        ''      close;
+    }
+
+    server {
+        listen 443 ssl http2;
+        server_name FQDN;
+        ssl_certificate /certs/fullchain.pem;
+        ssl_certificate_key /certs/privkey.pem;
+
+        location / {
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Port $server_port;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_pass http://rancher;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
+            proxy_read_timeout 900s;
+            proxy_buffering off;
+        }
+    }
+
+    server {
+        listen 80;
+        server_name FQDN;
+        return 301 https://$server_name$request_uri;
+    }
+}
+```
+
+<br/>
+
+## What's Next?
+
+- **Recommended:** Review [Single Node Backup and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). Although you don't have any data you need to back up right now, we recommend creating backups after regular Rancher use.
+- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
+
+<br/>
+
+## FAQ and Troubleshooting
+
+{{< ssl_faq_single >}}
+
+## Advanced Options
+
+### API Auditing
+
+If you want to record all transactions with the Rancher API, enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by adding the flags below into your install command.
+
+    -e AUDIT_LEVEL=1 \
+    -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
+    -e AUDIT_LOG_MAXAGE=20 \
+    -e AUDIT_LOG_MAXBACKUP=20 \
+    -e AUDIT_LOG_MAXSIZE=100 \
+
+### Air Gap
+
+If you are visiting this page to complete an [Air Gap Installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/), you must pre-pend your private registry URL to the server tag when running the installation command in the option that you choose. Add `<REGISTRY.DOMAIN.COM:PORT>` with your private registry URL in front of `rancher/rancher:latest`.
+
+**Example:**
+
+     <REGISTRY.DOMAIN.COM:PORT>/rancher/rancher:latest
+
+### Persistent Data
+
+{{< persistentdata >}}
+
+This layer 7 NGINX configuration is tested on NGINX version 1.13 (mainline) and 1.14 (stable).
+
+> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
+
+```
+upstream rancher {
+    server rancher-server:80;
+}
+
+map $http_upgrade $connection_upgrade {
+    default Upgrade;
+    ''      close;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name rancher.yourdomain.com;
+    ssl_certificate /etc/your_certificate_directory/fullchain.pem;
+    ssl_certificate_key /etc/your_certificate_directory/privkey.pem;
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_pass http://rancher;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
+        proxy_read_timeout 900s;
+        proxy_buffering off;
+    }
+}
+
+server {
+    listen 80;
+    server_name rancher.yourdomain.com;
+    return 301 https://$server_name$request_uri;
+}
+```
+
+<br/>
+
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/_index.md
new file mode 100644
index 00000000000..c88c0824afb
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/_index.md
@@ -0,0 +1,222 @@
+---
+title: Upgrading the Rancher Helm Chart
+weight: 2
+---
+
+> This page is under construction.
+
+The following instructions will guide you through using Helm to upgrade a Rancher server that was installed on a Kubernetes cluster.
+
+### Note on Upgrading the Rancher Server Kubernetes Cluster
+
+If Rancher is installed on an RKE Kubernetes cluster, refer to the [RKE documentation on upgrading the cluster.](https://rancher.com/docs/rke/latest/en/upgrades/)
+
+If Rancher is installed on a K3s Kubernetes cluster, refer to the [K3s documentation on upgrading the cluster.](https://rancher.com/docs/k3s/latest/en/upgrades/basic/)
+
+If Rancher is installed on another type of Kubernetes cluster, refer to the official documentation about upgrades for that Kubernetes distribution.
+
+
+### Known Upgrade Issues
+
+A list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
+
+### Caveats
+Upgrades _to_ or _from_ any chart in the [rancher-alpha repository]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories/) aren't supported.
+
+### Recovering from Unsuccessful Upgrades
+
+If you upgrade Rancher and the upgrade does not complete successfully, you may need to roll back your Rancher Server to its last healthy state.
+
+Restoring a snapshot of the Rancher Server cluster will revert Rancher to the version and state at the time of the snapshot.
+
+>**Note:** Managed cluster are authoritative for their state. This means restoring the Rancher server will not revert workload deployments or changes made on managed clusters after the snapshot was taken.
+
+# Prerequisites
+
+- **Review the [known upgrade issues]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#known-upgrade-issues) and [caveats]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#caveats)** in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
+- **For [air gap installs only,]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) collect and populate images for the new Rancher server version.** Follow the guide to [populate your private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/) with the images for the Rancher version that you want to upgrade to.
+
+# Upgrade Outline
+
+Follow the steps to upgrade Rancher server:
+
+- [A. Back up your Kubernetes cluster that is running Rancher server](#a-backup-your-kubernetes-cluster-that-is-running-rancher-server)
+- [B. Update the Helm chart repository](#b-update-the-helm-chart-repository)
+- [C. Upgrade Rancher](#c-upgrade-rancher)
+- [D. Verify the Upgrade](#d-verify-the-upgrade)
+
+### A. Back up Your Kubernetes Cluster that is Running Rancher Server
+
+[Take a one-time snapshot]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/#option-b-one-time-snapshots)
+of your Kubernetes cluster running Rancher server. You'll use the snapshot as a restoration point if something goes wrong during upgrade.
+
+### B. Update the Helm chart repository
+
+1. Update your local helm repo cache.
+
+    ```
+    helm repo update
+    ```
+
+1. Get the repository name that you used to install Rancher.
+
+    For information about the repos and their differences, see [Helm Chart Repositories]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
+
+    {{< release-channel >}}
+
+    ```
+    helm repo list
+
+    NAME          	       URL
+    stable        	       https://kubernetes-charts.storage.googleapis.com
+    rancher-<CHART_REPO>	 https://releases.rancher.com/server-charts/<CHART_REPO>
+    ```
+
+    > **Note:** If you want to switch to a different Helm chart repository, please follow the [steps on how to switch repositories]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#switching-to-a-different-helm-chart-repository). If you switch repositories, make sure to list the repositories again before continuing onto Step 3 to ensure you have the correct one added.
+
+
+1. Fetch the latest chart to install Rancher from the Helm chart repository.
+
+    This command will pull down the latest charts and save it in the current directory as a `.tgz` file.
+
+    ```plain
+    helm fetch rancher-<CHART_REPO>/rancher
+    ```
+
+### C. Upgrade Rancher
+
+This section describes how to upgrade normal (Internet-connected) or air gap installations of Rancher with Helm.
+
+{{% tabs %}}
+{{% tab "Kubernetes Upgrade" %}}
+
+Get the values, which were passed with `--set`, from the current Rancher Helm chart that is installed.
+
+```
+helm get values rancher -n cattle-system
+
+hostname: rancher.my.org
+```
+
+> **Note:** There will be more values that are listed with this command. This is just an example of one of the values.
+
+If you are also upgrading cert-manager to the latest version from a version older than 0.11.0, follow `Option B: Reinstalling Rancher and cert-manager`. Otherwise, follow `Option A: Upgrading Rancher`.
+
+{{% accordion label="Option A: Upgrading Rancher" %}}
+
+Upgrade Rancher to the latest version with all your settings.
+
+Take all the values from the previous step and append them to the command using `--set key=value`:
+
+```
+helm upgrade rancher rancher-<CHART_REPO>/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org
+```
+
+> **Note:** There will be many more options from the previous step that need to be appended.
+
+{{% /accordion %}}
+
+{{% accordion label="Option B: Reinstalling Rancher and cert-manager" %}}
+
+If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. 
+
+1. Uninstall Rancher
+
+    ```
+    helm delete rancher -n cattle-system
+    ```
+
+2. Uninstall and reinstall `cert-manager` according to the instructions on the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) page.
+
+3. Reinstall Rancher to the latest version with all your settings. Take all the values from the step 1 and append them to the command using `--set key=value`. Note: There will be many more options from the step 1 that need to be appended.
+
+    ```
+    helm install rancher rancher-<CHART_REPO>/rancher \
+    --namespace cattle-system \
+    --set hostname=rancher.my.org
+    ```
+
+{{% /accordion %}}
+
+{{% /tab %}}
+
+{{% tab "Kubernetes Air Gap Upgrade" %}}
+
+1. Render the Rancher template using the same chosen options that were used when installing Rancher. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
+
+    Based on the choice you made during installation, complete one of the procedures below.
+
+    Placeholder | Description
+    ------------|-------------
+    `<VERSION>` | The version number of the output tarball.
+    `<RANCHER.YOURDOMAIN.COM>` | The DNS name you pointed at your load balancer.
+    `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.
+    `<CERTMANAGER_VERSION>` | Cert-manager version running on k8s cluster.
+
+{{% accordion id="self-signed" label="Option A-Default Self-Signed Certificate" %}}
+
+ ```plain
+helm template ./rancher-<VERSION>.tgz --output-dir . \
+ --name rancher \
+ --namespace cattle-system \
+ --set hostname=<RANCHER.YOURDOMAIN.COM> \
+ --set certmanager.version=<CERTMANAGER_VERSION> \
+ --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+ --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+ --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+{{% /accordion %}}
+{{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
+
+```plain
+helm template ./rancher-<VERSION>.tgz --output-dir . \
+--name rancher \
+--namespace cattle-system \
+--set hostname=<RANCHER.YOURDOMAIN.COM> \
+--set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+--set ingress.tls.source=secret \
+--set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+--set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
+
+```plain
+helm template ./rancher-<VERSION>.tgz --output-dir . \
+--name rancher \
+--namespace cattle-system \
+--set hostname=<RANCHER.YOURDOMAIN.COM> \
+--set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
+--set ingress.tls.source=secret \
+--set privateCA=true \
+--set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
+--set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
+```
+
+{{% /accordion %}}
+
+2. Copy the rendered manifest directories to a system with access to the Rancher server cluster and apply the rendered templates.
+
+    Use `kubectl` to apply the rendered manifests.
+
+    ```plain
+    kubectl -n cattle-system apply -R -f ./rancher
+    ```
+
+{{% /tab %}}
+{{% /tabs %}}
+
+### D. Verify the Upgrade
+
+Log into Rancher to confirm that the upgrade succeeded.
+
+>**Having network issues following upgrade?**
+>
+> See [Restoring Cluster Networking]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking).
+
+## Rolling Back
+
+Should something go wrong, follow the [roll back]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/) instructions to restore the snapshot you took before you preformed the upgrade.
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/rollbacks/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/rollbacks/_index.md
new file mode 100644
index 00000000000..940b6fd4f89
--- /dev/null
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/rollbacks/_index.md
@@ -0,0 +1,12 @@
+---
+title: Rolling Back the Rancher Helm Chart
+weight: 1
+---
+
+> This page is under construction.
+
+If you upgrade Rancher and the upgrade does not complete successfully, you may need to [restore Rancher from backup.](../../backups/restores)
+
+Restoring a snapshot of the Rancher Server cluster will revert Rancher to the version and state at the time of the snapshot.
+
+>**Note:** Managed clusters are authoritative for their state. This means restoring the rancher server will not revert workload deployments or changes made on managed clusters after the snapshot was taken.
diff --git a/content/rancher/v2.5/en/security/_index.md b/content/rancher/v2.5/en/security/_index.md
new file mode 100644
index 00000000000..d0b2dd70089
--- /dev/null
+++ b/content/rancher/v2.5/en/security/_index.md
@@ -0,0 +1,103 @@
+---
+title: Security
+weight: 7505
+---
+
+<table width="100%">
+<tr style="vertical-align: top;">
+<td width="30%" style="border: none;">
+<h4>Security policy</h4>
+<p style="padding: 8px">Rancher Labs supports responsible disclosure, and endeavours to resolve all issues in a reasonable time frame. </p>
+</td>
+<td width="30%" style="border: none;">
+<h4>Reporting process</h4>
+<p style="padding: 8px">Please submit possible security issues by emailing <a href="mailto:security@rancher.com">security@rancher.com</a></p>
+</td>
+<td width="30%" style="border: none;">
+<h4>Announcements</h4>
+<p style="padding: 8px">Subscribe to the <a href="https://forums.rancher.com/c/announcements">Rancher announcements forum</a> for release updates.</p>
+</td>
+</tr>
+</table>
+
+Security is at the heart of all Rancher features. From integrating with all the popular authentication tools and services, to an enterprise grade [RBAC capability,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac) Rancher makes your Kubernetes clusters even more secure.
+
+On this page, we provide security-related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters:
+
+- [Running a CIS security scan on a Kubernetes cluster](#running-a-cis-security-scan-on-a-kubernetes-cluster)
+- [Guide to hardening Rancher installations](#rancher-hardening-guide)
+- [The CIS Benchmark and self-assessment](#the-cis-benchmark-and-self-assessment)
+- [Third-party penetration test reports](#third-party-penetration-test-reports)
+- [Rancher CVEs and resolutions](#rancher-cves-and-resolutions)
+- [Security Tips and Best Practices](#security-tips-and-best-practices)
+
+### Running a CIS Security Scan on a Kubernetes Cluster
+
+_Available as of v2.4.0_ 
+
+Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS (Center for Internet Security) Kubernetes Benchmark.
+
+The CIS Kubernetes Benchmark is a reference document that can be used to establish a secure configuration baseline for Kubernetes.
+
+The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace."
+
+CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
+
+The Benchmark provides recommendations of two types: Scored and Not Scored. We run tests related to only Scored recommendations.
+
+When Rancher runs a CIS security scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests.
+
+For details, refer to the section on [security scans.]({{<baseurl>}}/rancher/v2.x/en/security/security-scan)
+
+### Rancher Hardening Guide
+
+The Rancher Hardening Guide is based off of controls and best practices found in the <a href="https://www.cisecurity.org/benchmark/kubernetes/" target="_blank">CIS Kubernetes Benchmark</a> from the Center for Internet Security.
+
+The hardening guide provides prescriptive guidance for hardening a production installation of Rancher v2.1.x, v2.2.x and v.2.3.x. See Rancher's [Self Assessment of the CIS Kubernetes Benchmark](#cis-benchmark-rancher-self-assessment) for the full list of security controls.
+
+> The hardening guides describe how to secure the nodes in your cluster, and it is recommended to follow a hardening guide before installing Kubernetes.
+
+Each version of the hardening guide is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+[Hardening Guide v2.4]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.4/) | Rancher v2.4 | Benchmark v1.5 | Kubernetes v1.15
+[Hardening Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.5/) | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes v1.15
+[Hardening Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.3/) | Rancher v2.3.3 | Benchmark v1.4.1 | Kubernetes v1.14, v1.15, and v1.16
+[Hardening Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3/) | Rancher v2.3.0-v2.3.2 | Benchmark v1.4.1 | Kubernetes v1.15
+[Hardening Guide v2.2]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.2/) | Rancher v2.2.x | Benchmark v1.4.1 and 1.4.0 | Kubernetes v1.13
+[Hardening Guide v2.1]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.1/) | Rancher v2.1.x | Benchmark v1.3.0 | Kubernetes v1.11
+
+### The CIS Benchmark and Self-Assessment
+
+The benchmark self-assessment is a companion to the Rancher security hardening guide. While the hardening guide shows you how to harden the cluster, the benchmark guide is meant to help you evaluate the level of security of the hardened cluster.
+
+Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. The original benchmark documents can be downloaded from the [CIS website](https://www.cisecurity.org/benchmark/kubernetes/).
+
+Each version of Rancher's self assessment guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+[Self Assessment Guide v2.4]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.4/#cis-kubernetes-benchmark-1-5-0-rancher-2-4-+-with-kubernetes-1-15) | Rancher v2.4 | Hardening Guide v2.4 | Kubernetes v1.15 | Benchmark v1.5
+[Self Assessment Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.5/#cis-kubernetes-benchmark-1-5-0-rancher-2-3-5-+-with-kubernetes-1-15) | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5
+[Self Assessment Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-3-+-with-kubernetes-1-16) | Rancher v2.3.3 | Hardening Guide v2.3.3 | Kubernetes v1.16 | Benchmark v1.4.1
+[Self Assessment Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-0-2-3-2-with-kubernetes-1-15) | Rancher v2.3.0-2.3.2 | Hardening Guide v2.3 | Kubernetes v1.15 | Benchmark v1.4.1
+[Self Assessment Guide v2.2]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.2/) | Rancher v2.2.x | Hardening Guide v2.2 | Kubernetes v1.13 | Benchmark v1.4.0 and v1.4.1
+[Self Assessment Guide v2.1]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.1/) | Rancher v2.1.x | Hardening Guide v2.1 | Kubernetes v1.11 | Benchmark 1.3.0
+
+### Third-party Penetration Test Reports
+
+Rancher periodically hires third parties to perform security audits and penetration tests of the Rancher 2.x software stack. The environments under test follow the Rancher provided hardening guides at the time of the testing. Results are posted when the third party has also verified fixes classified MEDIUM or above.
+
+Results:
+
+- [Cure53 Pen Test - 7/2019](https://releases.rancher.com/documents/security/pen-tests/2019/RAN-01-cure53-report.final.pdf)
+- [Untamed Theory Pen Test- 3/2019](https://releases.rancher.com/documents/security/pen-tests/2019/UntamedTheory-Rancher_SecurityAssessment-20190712_v5.pdf)
+
+### Rancher CVEs and Resolutions
+
+Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to [this page.](./cve)
+
+### Security Tips and Best Practices
+
+Our [best practices guide]({{<baseurl>}}/rancher/v2.x/en/best-practices/management/#tips-for-security) includes basic tips for increasing security in Rancher.
diff --git a/content/rancher/v2.5/en/security/cve/_index.md b/content/rancher/v2.5/en/security/cve/_index.md
new file mode 100644
index 00000000000..02c00946dc9
--- /dev/null
+++ b/content/rancher/v2.5/en/security/cve/_index.md
@@ -0,0 +1,17 @@
+---
+title: Rancher CVEs and Resolutions
+weight: 300
+---
+
+Rancher is committed to informing the community of security issues in our products. Rancher will publish CVEs (Common Vulnerabilities and Exposures) for issues we have resolved.
+
+| ID | Description | Date | Resolution |
+|----|-------------|------|------------|
+| [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321) |  Any project member with access to the `default` namespace can mount the `netes-default` service account in a pod and then use that pod to execute administrative privileged commands against the Kubernetes cluster.  | 29 Jan 2019 | [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11) - Rolling back from these versions or greater have specific [instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/).  |
+| [CVE-2019-6287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6287) | Project members continue to get access to namespaces from projects that they were removed from if they were added to more than one project. | 29 Jan 2019  |  [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11)  |
+| [CVE-2019-11202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11202) | The default admin, that is shipped with Rancher, will be re-created upon restart of Rancher despite being explicitly deleted. | 16 Apr 2019  |  [Rancher v2.2.2](https://github.com/rancher/rancher/releases/tag/v2.2.2), [Rancher v2.1.9](https://github.com/rancher/rancher/releases/tag/v2.1.9) and [Rancher v2.0.14](https://github.com/rancher/rancher/releases/tag/v2.0.14)  |
+| [CVE-2019-12274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12274) | Nodes using the built-in node drivers using a file path option allows the machine to read arbitrary files including sensitive ones from inside the Rancher server container. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)  |
+| [CVE-2019-12303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12303) |  Project owners can inject extra fluentd logging configurations that makes it possible to read files or execute arbitrary commands inside the fluentd container. Reported by Tyler Welton from Untamed Theory. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)   |
+| [CVE-2019-13209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13209) |  The vulnerability is known as a [Cross-Site Websocket Hijacking attack](https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html). This attack allows an exploiter to gain access to clusters managed by Rancher with the roles/permissions of a victim. It requires that a victim to be logged into a Rancher server and then access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the Kubernetes API with the permissions and identity of the victim. Reported by Matt Belisle and Alex Stevenson from Workiva. | 15 Jul 2019  |   [Rancher v2.2.5](https://github.com/rancher/rancher/releases/tag/v2.2.5), [Rancher v2.1.11](https://github.com/rancher/rancher/releases/tag/v2.1.11) and [Rancher v2.0.16](https://github.com/rancher/rancher/releases/tag/v2.0.16) |
+| [CVE-2019-14436](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14436) |  The vulnerability allows a member of a project that has access to edit role bindings to be able to assign themselves or others a cluster level role granting them administrator access to that cluster. The issue was found and reported by Michal Lipinski at Nokia. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
+| [CVE-2019-14435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14435) |  This vulnerability allows authenticated users to potentially extract otherwise private data out of IPs reachable from system service containers used by Rancher. This can include but not only limited to services such as cloud provider metadata services. Although Rancher allow users to configure whitelisted domains for system service access, this flaw can still be exploited by a carefully crafted HTTP request. The issue was found and reported by Matt Belisle and Alex Stevenson at Workiva. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
diff --git a/content/rancher/v2.5/en/security/security-scan/_index.md b/content/rancher/v2.5/en/security/security-scan/_index.md
new file mode 100644
index 00000000000..4d9dc4f8831
--- /dev/null
+++ b/content/rancher/v2.5/en/security/security-scan/_index.md
@@ -0,0 +1,254 @@
+---
+title: Security Scans
+weight: 1
+---
+
+Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
+
+The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
+
+CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
+
+The Benchmark provides recommendations of two types: Scored and Not Scored. We run tests related to only Scored recommendations.
+
+- [About the CIS Benchmark](#about-the-cis-benchmark)
+- [About the generated report](#about-the-generated-report)
+- [Test profiles](#test-profiles)
+- [Skipped and not applicable tests](#skipped-and-not-applicable-tests)
+  - [CIS Benchmark v1.4 skipped tests](#cis-benchmark-v1-4-skipped-tests)
+  - [CIS Benchmark v1.4 not applicable tests](#cis-benchmark-v1-4-not-applicable-tests)
+- [Prerequisites](#prerequisites)
+- [Running a scan](#running-a-scan)
+- [Scheduling recurring scans](#scheduling-recurring-scans)
+- [Skipping tests](#skipping-tests)
+- [Setting alerts](#setting-alerts)
+- [Deleting a report](#deleting-a-report)
+- [Downloading a report](#downloading-a-report)
+
+# About the CIS Benchmark
+
+The Center for Internet Security is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
+
+CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
+
+The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is [here.](https://learn.cisecurity.org/benchmarks)
+
+To check clusters for CIS Kubernetes Benchmark compliance, the security scan leverages [kube-bench,](https://github.com/aquasecurity/kube-bench) an open-source tool from Aqua Security.
+
+# About the Generated Report
+
+Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format.
+
+As of Rancher v2.4, the scan will use the CIS Benchmark v1.4. The Benchmark version is included in the generated report.
+
+The Benchmark provides recommendations of two types: Scored and Not Scored. Recommendations marked as Not Scored in the Benchmark are not included in the generated report.
+
+Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's [self-assessment guide for the corresponding Kubernetes version.]({{<baseurl>}}/rancher/v2.x/en/security/#the-cis-benchmark-and-self-assessment)
+
+The report contains the following information:
+
+| Column in Report | Description |
+|------------------|-------------|
+| ID               | The ID number of the CIS Benchmark. |
+| Description      | The description of the CIS Benchmark test. |
+| Remediation      | What needs to be fixed in order to pass the test. |
+| State of Test    | Indicates if the test passed, failed, was skipped, or was not applicable. |
+| Node type        | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. |
+| Nodes            | The name(s) of the node that the test was run on. |
+| Passed_Nodes | The name(s) of the nodes that the test passed on. |
+| Failed_Nodes | The name(s) of the nodes that the test failed on. |
+
+Refer to [the table in the cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
+
+# Test Profiles
+
+For every CIS benchmark version, Rancher ships with two types of profiles. These profiles are named based on the type of cluster (e.g. `RKE`), the CIS benchmark version (e.g. CIS 1.4) and the profile type (e.g. `Permissive` or `Hardened`). For example, a full profile name would be `RKE-CIS-1.4-Permissive`
+
+All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes.
+
+There are 2 types of profiles:
+
+- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests.
+- **Hardened:** This profile will not skip any tests, except for the non-applicable tests.
+
+In order to pass the "Hardened" profile, you will need to follow the steps on the [hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
+
+# Skipped and Not Applicable Tests
+
+### CIS Benchmark v1.4 Skipped Tests
+
+Number | Description | Reason for Skipping
+---|---|---
+1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
+1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
+1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
+1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
+1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
+1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
+2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+
+### CIS Benchmark v1.4 Not Applicable Tests
+
+Number | Description | Reason for being not applicable
+---|---|---
+1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
+1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
+2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+
+
+# Prerequisites
+
+To run security scans on a cluster and access the generated reports, you must be an [Administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [Cluster Owner.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
+
+Rancher can only run security scans on clusters that were created with RKE, which includes custom clusters and clusters that Rancher created in an infrastructure provider such as Amazon EC2 or GCE. Imported clusters and clusters in hosted Kubernetes providers can't be scanned by Rancher.
+
+The security scan cannot run in a cluster that has Windows nodes.
+
+You will only be able to see the CIS scan reports for clusters that you have access to.
+
+# Running a Scan
+
+1. From the cluster view in Rancher, click **Tools > CIS Scans.**
+1. Click **Run Scan.**
+1. Choose a CIS scan profile.
+
+**Result:** A report is generated and displayed in the **CIS Scans** page. To see details of the report, click the report's name.
+
+# Scheduling Recurring Scans
+
+Recurring scans can be scheduled to run on any RKE Kubernetes cluster.
+
+To enable recurring scans, edit the advanced options in the cluster configuration during cluster creation or after the cluster has been created.
+
+To schedule scans for an existing cluster:
+
+1. Go to the cluster view in Rancher.
+1. Click **Tools > CIS Scans.**
+1. Click **Add Schedule.** This takes you to the section of the cluster editing page that is applicable to configuring a schedule for CIS scans. (This section can also be reached by going to the cluster view, clicking **&#8942; > Edit,** and going to the **Advanced Options.**)
+1. In the **CIS Scan Enabled** field, click **Yes.**
+1. In the **CIS Scan Profile** field, choose a **Permissive** or **Hardened** profile. The corresponding CIS Benchmark version is included in the profile name. Note: Any skipped tests [defined in a separate ConfigMap](#skipping-tests) will be skipped regardless of whether a **Permissive** or **Hardened** profile is selected. When selecting the the permissive profile, you should see which tests were skipped by Rancher (tests that are skipped by default for RKE clusters) and which tests were skipped by a Rancher user. In the hardened test profile, the only skipped tests will be skipped by users.
+1. In the **CIS Scan Interval (cron)** job, enter a [cron expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) to define how often the cluster will be scanned.
+1. In the **CIS Scan Report Retention** field, enter the number of past reports that should be kept.
+
+**Result:** The security scan will run and generate reports at the scheduled intervals.
+
+The test schedule can be configured in the `cluster.yml`:
+
+```yaml
+scheduled_cluster_scan:
+    enabled: true
+    scan_config:
+        cis_scan_config:
+            override_benchmark_version: rke-cis-1.4
+            profile: permissive
+    schedule_config:
+        cron_schedule: 0 0 * * *
+        retention: 24
+```
+
+
+# Skipping Tests
+
+You can define a set of tests that will be skipped by the CIS scan when the next report is generated.
+
+These tests will be skipped for subsequent CIS scans, including both manually triggered and scheduled scans, and the tests will be skipped with any profile.
+
+The skipped tests will be listed alongside the test profile name in the cluster configuration options when a test profile is selected for a recurring cluster scan. The skipped tests will also be shown every time a scan is triggered manually from the Rancher UI by clicking **Run Scan.** The display of skipped tests allows you to know ahead of time which tests will be run in each scan.
+
+To skip tests, you will need to define them in a Kubernetes ConfigMap resource. Each skipped CIS scan test is listed in the ConfigMap alongside the version of the CIS benchmark that the test belongs to.
+
+To skip tests by editing a ConfigMap resource,
+
+1. Create a `security-scan` namespace.
+1. Create a ConfigMap named `security-scan-cfg`.
+1. Enter the skip information under the key `config.json` in the following format:
+
+    ```json
+    {
+      "skip": {
+        "rke-cis-1.4": [ 
+          "1.1.1", 
+          "1.2.2"
+        ]
+      }
+    }
+    ```
+    
+    In the example above, the CIS benchmark version is specified alongside the tests to be skipped for that version.
+
+**Result:** These tests will be skipped on subsequent scans that use the defined CIS Benchmark version.
+
+# Setting Alerts
+
+Rancher provides a set of alerts for cluster scans. which are not configured to have notifiers by default:
+
+- A manual cluster scan was completed
+- A manual cluster scan has failures
+- A scheduled cluster scan was completed
+- A scheduled cluster scan has failures
+
+> **Prerequisite:** You need to configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) before configuring, sending, or receiving alerts.
+
+To activate an existing alert for a CIS scan result,
+
+1. From the cluster view in Rancher, click **Tools > Alerts.**
+1. Go to the section called **A set of alerts for cluster scans.**
+1. Go to the alert you want to activate and click **&#8942; > Activate.**
+1. Go to the alert rule group **A set of alerts for cluster scans** and click **&#8942; > Edit.**
+1. Scroll down to the **Alert** section. In the **To** field, select the notifier that you would like to use for sending alert notifications.
+1. Optional: To limit the frequency of the notifications, click on **Show advanced options** and configure the time interval of the alerts.
+1. Click **Save.**
+
+**Result:** The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
+
+To create a new alert,
+
+1. Go to the cluster view and click **Tools > CIS Scans.**
+1. Click **Add Alert.**
+1. Fill out the form. 
+1. Enter a name for the alert.
+1. In the **Is** field, set the alert to be triggered when a scan is completed or when a scan has a failure.
+1. In the **Send a** field, set the alert as a **Critical,** **Warning,** or **Info** alert level.
+1. Choose a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) for the alert.
+
+**Result:** The alert is created and activated. The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
+
+For more information about alerts, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
+
+# Deleting a Report
+
+1. From the cluster view in Rancher, click **Tools > CIS Scans.**
+1. Go to the report that should be deleted.
+1. Click the **&#8942; > Delete.**
+1. Click **Delete.**
+
+# Downloading a Report
+
+1. From the cluster view in Rancher, click **Tools > CIS Scans.**
+1. Go to the report that you want to download. Click **&#8942; > Download.**
+
+**Result:** The report is downloaded in CSV format. For more information on each columns, refer to the [section about the generated report.](#about-the-generated-report)
diff --git a/content/rancher/v2.5/en/system-tools/_index.md b/content/rancher/v2.5/en/system-tools/_index.md
new file mode 100644
index 00000000000..54bf292d186
--- /dev/null
+++ b/content/rancher/v2.5/en/system-tools/_index.md
@@ -0,0 +1,116 @@
+---
+title: System Tools
+weight: 6001
+---
+
+System Tools is a tool to perform operational tasks on [Rancher launched RKE Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters or [installations of Rancher on an RKE cluster.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/) The tasks include:
+
+* Collect logging and system metrics from nodes.
+* Remove Kubernetes resources created by Rancher.
+
+The following commands are available:
+
+| Command | Description
+|---|---
+| [logs](#logs) | Collect Kubernetes cluster component logs from nodes.
+| [stats](#stats) | Stream system metrics from nodes.
+| [remove](#remove) | Remove Kubernetes resources created by Rancher.
+
+# Download System Tools
+
+You can download the latest version of System Tools from the [GitHub releases page](https://github.com/rancher/system-tools/releases/latest). Download the version of `system-tools` for the OS that you are using to interact with the cluster.
+
+Operating System | Filename
+-----------------|-----
+MacOS            | `system-tools_darwin-amd64`
+Linux            | `system-tools_linux-amd64`
+Windows          | `system-tools_windows-amd64.exe`
+
+After you download the tools, complete the following actions:
+
+1. Rename the file to `system-tools`.
+
+1. Give the file executable permissions by running the following command:
+
+    > **Using Windows?**
+    The file is already an executable, you can skip this step.
+
+    ```
+    chmod +x system-tools
+    ```
+
+# Logs
+
+The logs subcommand will collect log files of core Kubernetes cluster components from nodes in [Rancher-launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) or nodes on an [RKE Kubernetes cluster that Rancher is installed on.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/). See [Troubleshooting]({{<baseurl>}}//rancher/v2.x/en/troubleshooting/) for a list of core Kubernetes cluster components.
+
+System Tools will use the provided kubeconfig file to deploy a DaemonSet, that will copy all the logfiles from the core Kubernetes cluster components and add them to a single tar file (`cluster-logs.tar` by default). If you only want to collect logging from a single node, you can specify the node by using `--node NODENAME` or `-n NODENAME`.
+
+### Usage
+
+```
+./system-tools_darwin-amd64 logs --kubeconfig <KUBECONFIG>
+```
+
+The following are the options for the logs command:
+
+| Option                                                 | Description
+| ------------------------------------------------------ | ------------------------------------------------------
+| `--kubeconfig <KUBECONFIG_PATH>, -c <KUBECONFIG_PATH>` | The cluster's kubeconfig file.
+| `--output <FILENAME>, -o cluster-logs.tar`             | Name of the created tarball containing the logs. If no output filename is defined, the options defaults to `cluster-logs.tar`.
+| `--node <NODENAME>, -n node1`                         | Specify the nodes to collect the logs from. If no node is specified, logs from all nodes in the cluster will be collected.
+
+# Stats
+
+The stats subcommand will display system metrics from nodes in [Rancher-launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) or nodes in an [RKE Kubernetes cluster that Rancher is installed on.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/).
+
+System Tools will deploy a DaemonSet, and run a predefined command based on `sar` (System Activity Report) to show system metrics.
+
+### Usage
+
+```
+./system-tools_darwin-amd64 stats --kubeconfig <KUBECONFIG>
+```
+
+The following are the options for the stats command:
+
+| Option                                                 | Description
+| ------------------------------------------------------ | ------------------------------
+| `--kubeconfig <KUBECONFIG_PATH>, -c <KUBECONFIG_PATH>` | The cluster's kubeconfig file.
+| `--node <NODENAME>, -n node1`                          | Specify the nodes to display the system metrics from. If no node is specified, logs from all nodes in the cluster will be displayed.
+| `--stats-command value, -s value`                      | The command to run to display the system metrics. If no command is defined, the options defaults to `/usr/bin/sar -u -r -F 1 1`.
+
+# Remove
+
+>**Warning:** This command will remove data from your etcd nodes. Make sure you have created a [backup of etcd]({{<baseurl>}}/rancher/v2.x/en/backups/backups) before executing the command.
+
+When you install Rancher on a Kubernetes cluster, it will create Kubernetes resources to run and to store configuration data. If you want to remove Rancher from your cluster, you can use the `remove` subcommand to remove the Kubernetes resources. When you use the `remove` subcommand, the following resources will be removed:
+
+- The Rancher deployment namespace (`cattle-system` by default).
+- Any `serviceAccount`, `clusterRoles`, and `clusterRoleBindings` that Rancher applied the `cattle.io/creator:norman` label to. Rancher applies this label to any resource that it creates as of v2.1.0.
+- Labels, annotations, and finalizers.
+- Rancher Deployment.
+- Machines, clusters, projects, and user custom resource deployments (CRDs).
+- All resources create under the `management.cattle.io` API Group.
+- All CRDs created by Rancher v2.x.
+
+>**Using 2.0.8 or Earlier?**
+>
+>These versions of Rancher do not automatically delete the `serviceAccount`, `clusterRole`, and `clusterRoleBindings` resources after the job runs. You'll have to delete them yourself.
+
+### Usage
+
+When you run the command below, all the resources listed [above](#remove) will be removed from the cluster.
+
+>**Warning:** This command will remove data from your etcd nodes. Make sure you have created a [backup of etcd]({{<baseurl>}}/rancher/v2.x/en/backups/backups) before executing the command.
+
+```
+./system-tools remove --kubeconfig <KUBECONFIG> --namespace <NAMESPACE>
+```
+
+The following are the options for the `remove` command:
+
+| Option                                         | Description
+| ---------------------------------------------- | ------------
+| `--kubeconfig <KUBECONFIG_PATH>, -c <KUBECONFIG_PATH>` | The cluster's kubeconfig file
+| `--namespace <NAMESPACE>, -n cattle-system`    | Rancher 2.x deployment namespace (`<NAMESPACE>`). If no namespace is defined, the options defaults to `cattle-system`.
+| `--force`                                      | Skips the interactive removal confirmation and removes the Rancher deployment without prompt.
diff --git a/content/rancher/v2.5/en/troubleshooting/_index.md b/content/rancher/v2.5/en/troubleshooting/_index.md
new file mode 100644
index 00000000000..edb5fb4f061
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/_index.md
@@ -0,0 +1,42 @@
+---
+title: Troubleshooting
+weight: 8100
+---
+
+This section contains information to help you troubleshoot issues when using Rancher.
+
+- [Kubernetes components]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/)
+
+    If you need help troubleshooting core Kubernetes cluster components like:
+    * `etcd`
+    * `kube-apiserver`
+    * `kube-controller-manager`
+    * `kube-scheduler`
+    * `kubelet`
+    * `kube-proxy`
+    * `nginx-proxy`
+
+- [Kubernetes resources]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-resources/)
+
+    Options for troubleshooting Kubernetes resources like Nodes, Ingress Controller and Rancher Agents are described in this section.
+
+- [Networking]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/networking/)
+
+    Steps to troubleshoot networking issues can be found here.
+
+- [DNS]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/dns/)
+
+    When you experience name resolution issues in your cluster.
+
+- [Troubleshooting Rancher installed on Kubernetes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/rancherha/)
+
+    If you experience issues with your [Rancher server installed on Kubernetes]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/)
+
+- [Imported clusters]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/imported-clusters/)
+
+    If you experience issues when [Importing Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)
+
+- [Logging]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/logging/)
+
+    Read more about what log levels can be configured and how to configure a log level.
+
diff --git a/content/rancher/v2.5/en/troubleshooting/docker/_index.md b/content/rancher/v2.5/en/troubleshooting/docker/_index.md
new file mode 100644
index 00000000000..ef7f0daf144
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/docker/_index.md
@@ -0,0 +1,6 @@
+---
+title: Troubleshooting Rancher Installed on a Single Node with Docker
+weight: 3
+---
+
+{{< ssl_faq_single >}}
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/_index.md
new file mode 100644
index 00000000000..317c7a34f40
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/mcm/_index.md
@@ -0,0 +1,187 @@
+---
+title: Troubleshooting the Enterprise Cluster Manager
+weight: 2
+---
+
+> This page is under construction.
+
+This section describes how to troubleshoot an installation of Rancher on a Kubernetes cluster.
+
+### Relevant Namespaces
+
+Most of the troubleshooting will be done on objects in these 3 namespaces.
+
+- `cattle-system` - `rancher` deployment and pods.
+- `ingress-nginx` - Ingress controller pods and services.
+- `kube-system` - `tiller` and `cert-manager` pods.
+
+### "default backend - 404"
+
+A number of things can cause the ingress-controller not to forward traffic to your rancher instance. Most of the time it's due to a bad SSL configuration.
+
+Things to check
+
+- [Is Rancher Running](#is-rancher-running)
+- [Cert CN is "Kubernetes Ingress Controller Fake Certificate"](#cert-cn-is-kubernetes-ingress-controller-fake-certificate)
+
+### Check if Rancher is Running
+
+Use `kubectl` to check the `cattle-system` system namespace and see if the Rancher pods are in a Running state.
+
+```
+kubectl -n cattle-system get pods
+
+NAME                           READY     STATUS    RESTARTS   AGE
+pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
+```
+
+If the state is not `Running`, run a `describe` on the pod and check the Events.
+
+```
+kubectl -n cattle-system describe pod
+
+...
+Events:
+  Type     Reason                 Age   From                Message
+  ----     ------                 ----  ----                -------
+  Normal   Scheduled              11m   default-scheduler   Successfully assigned rancher-784d94f59b-vgqzh to localhost
+  Normal   SuccessfulMountVolume  11m   kubelet, localhost  MountVolume.SetUp succeeded for volume "rancher-token-dj4mt"
+  Normal   Pulling                11m   kubelet, localhost  pulling image "rancher/rancher:v2.0.4"
+  Normal   Pulled                 11m   kubelet, localhost  Successfully pulled image "rancher/rancher:v2.0.4"
+  Normal   Created                11m   kubelet, localhost  Created container
+  Normal   Started                11m   kubelet, localhost  Started container
+```
+
+### Check the Rancher Logs
+
+Use `kubectl` to list the pods.
+
+```
+kubectl -n cattle-system get pods
+
+NAME                           READY     STATUS    RESTARTS   AGE
+pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
+```
+
+Use `kubectl` and the pod name to list the logs from the pod.
+
+```
+kubectl -n cattle-system logs -f rancher-784d94f59b-vgqzh
+```
+
+### Cert CN is "Kubernetes Ingress Controller Fake Certificate"
+
+Use your browser to check the certificate details. If it says the Common Name is "Kubernetes Ingress Controller Fake Certificate", something may have gone wrong with reading or issuing your SSL cert.
+
+> **Note:** if you are using LetsEncrypt to issue certs it can sometimes take a few minuets to issue the cert.
+
+### Checking for issues with cert-manager issued certs (Rancher Generated or LetsEncrypt)
+
+`cert-manager` has 3 parts.
+
+- `cert-manager` pod in the `kube-system` namespace.
+- `Issuer` object in the `cattle-system` namespace.
+- `Certificate` object in the `cattle-system` namespace.
+
+Work backwards and do a `kubectl describe` on each object and check the events. You can track down what might be missing.
+
+For example there is a problem with the Issuer:
+
+```
+kubectl -n cattle-system describe certificate
+...
+Events:
+  Type     Reason          Age                 From          Message
+  ----     ------          ----                ----          -------
+  Warning  IssuerNotReady  18s (x23 over 19m)  cert-manager  Issuer rancher not ready
+```
+
+```
+kubectl -n cattle-system describe issuer
+...
+Events:
+  Type     Reason         Age                 From          Message
+  ----     ------         ----                ----          -------
+  Warning  ErrInitIssuer  19m (x12 over 19m)  cert-manager  Error initializing issuer: secret "tls-rancher" not found
+  Warning  ErrGetKeyPair  9m (x16 over 19m)   cert-manager  Error getting keypair for CA issuer: secret "tls-rancher" not found
+```
+
+### Checking for Issues with Your Own SSL Certs
+
+Your certs get applied directly to the Ingress object in the `cattle-system` namespace.
+
+Check the status of the Ingress object and see if its ready.
+
+```
+kubectl -n cattle-system describe ingress
+```
+
+If its ready and the SSL is still not working you may have a malformed cert or secret.
+
+Check the nginx-ingress-controller logs. Because the nginx-ingress-controller has multiple containers in its pod you will need to specify the name of the container.
+
+```
+kubectl -n ingress-nginx logs -f nginx-ingress-controller-rfjrq nginx-ingress-controller
+...
+W0705 23:04:58.240571       7 backend_ssl.go:49] error obtaining PEM from secret cattle-system/tls-rancher-ingress: error retrieving secret cattle-system/tls-rancher-ingress: secret cattle-system/tls-rancher-ingress was not found
+```
+
+### No matches for kind "Issuer"
+
+The [SSL configuration]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#choose-your-ssl-configuration) option you have chosen requires [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) to be installed before installing Rancher or else the following error is shown:
+
+```
+Error: validation failed: unable to recognize "": no matches for kind "Issuer" in version "certmanager.k8s.io/v1alpha1"
+```
+
+Install [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) and try installing Rancher again.
+
+
+### Canal Pods show READY 2/3
+
+The most common cause of this issue is port 8472/UDP is not open between the nodes. Check your local firewall, network routing or security groups.
+
+Once the network issue is resolved, the `canal` pods should timeout and restart to establish their connections.
+
+### nginx-ingress-controller Pods show RESTARTS
+
+The most common cause of this issue is the `canal` pods have failed to establish the overlay network. See [canal Pods show READY `2/3`](#canal-pods-show-ready-2-3) for troubleshooting.
+
+
+### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed)
+
+Some causes of this error include:
+
+* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`:
+
+```
+$ ssh user@server
+user@server$ docker ps
+CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
+```
+
+See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
+
+* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
+
+* SSH server version is not version 6.7 or higher. This is needed for socket forwarding to work, which is used to connect to the Docker socket over SSH. This can be checked using `sshd -V` on the host you are connecting to, or using netcat:
+```
+$ nc xxx.xxx.xxx.xxx 22
+SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
+```
+
+### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
+
+The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
+
+### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
+
+The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with.
+
+### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
+
+If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
+
+### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
+
+The node is not reachable on the configured `address` and `port`.
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md
new file mode 100644
index 00000000000..ecbe88a7588
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md
@@ -0,0 +1,217 @@
+---
+title: DNS
+weight: 103
+---
+
+The commands/steps listed on this page can be used to check name resolution issues in your cluster.
+
+Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
+
+Before running the DNS checks, check the [default DNS provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#default-dns-provider) for your cluster and make sure that [the overlay network is functioning correctly]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/networking/#check-if-overlay-network-is-functioning-correctly) as this can also be the reason why DNS resolution (partly) fails.
+
+### Check if DNS pods are running
+
+```
+kubectl -n kube-system get pods -l k8s-app=kube-dns
+```
+
+Example output when using CoreDNS:
+```
+NAME                       READY   STATUS    RESTARTS   AGE
+coredns-799dffd9c4-6jhlz   1/1     Running   0          76m
+```
+
+Example output when using kube-dns:
+```
+NAME                        READY   STATUS    RESTARTS   AGE
+kube-dns-5fd74c7488-h6f7n   3/3     Running   0          4m13s
+```
+
+### Check if the DNS service is present with the correct cluster-ip
+
+```
+kubectl -n kube-system get svc -l k8s-app=kube-dns
+```
+
+```
+NAME               TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
+service/kube-dns   ClusterIP   10.43.0.10   <none>        53/UDP,53/TCP   4m13s
+```
+
+### Check if domain names are resolving
+
+Check if internal cluster names are resolving (in this example, `kubernetes.default`), the IP shown after `Server:` should be the same as the `CLUSTER-IP` from the `kube-dns` service.
+
+```
+kubectl run -it --rm --restart=Never busybox --image=busybox:1.28 -- nslookup kubernetes.default
+```
+
+Example output:
+```
+Server:    10.43.0.10
+Address 1: 10.43.0.10 kube-dns.kube-system.svc.cluster.local
+
+Name:      kubernetes.default
+Address 1: 10.43.0.1 kubernetes.default.svc.cluster.local
+pod "busybox" deleted
+```
+
+Check if external names are resolving (in this example, `www.google.com`)
+
+```
+kubectl run -it --rm --restart=Never busybox --image=busybox:1.28 -- nslookup www.google.com
+```
+
+Example output:
+```
+Server:    10.43.0.10
+Address 1: 10.43.0.10 kube-dns.kube-system.svc.cluster.local
+
+Name:      www.google.com
+Address 1: 2a00:1450:4009:80b::2004 lhr35s04-in-x04.1e100.net
+Address 2: 216.58.211.100 ams15s32-in-f4.1e100.net
+pod "busybox" deleted
+```
+
+If you want to check resolving of domain names on all of the hosts, execute the following steps:
+
+1. Save the following file as `ds-dnstest.yml`
+
+    ```
+    apiVersion: apps/v1
+    kind: DaemonSet
+    metadata:
+      name: dnstest
+    spec:
+      selector:
+          matchLabels:
+            name: dnstest
+      template:
+        metadata:
+          labels:
+            name: dnstest
+        spec:
+          tolerations:
+          - operator: Exists
+          containers:
+          - image: busybox:1.28
+            imagePullPolicy: Always
+            name: alpine
+            command: ["sh", "-c", "tail -f /dev/null"]
+            terminationMessagePath: /dev/termination-log
+    ```
+
+2. Launch it using `kubectl create -f ds-dnstest.yml`
+3. Wait until `kubectl rollout status ds/dnstest -w` returns: `daemon set "dnstest" successfully rolled out`.
+4. Configure the environment variable `DOMAIN` to a fully qualified domain name (FQDN) that the host should be able to resolve (`www.google.com` is used as an example) and run the following command to let each container on every host resolve the configured domain name (it's a single line command).
+
+    ```
+    export DOMAIN=www.google.com; echo "=> Start DNS resolve test"; kubectl get pods -l name=dnstest --no-headers -o custom-columns=NAME:.metadata.name,HOSTIP:.status.hostIP | while read pod host; do kubectl exec $pod -- /bin/sh -c "nslookup $DOMAIN > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $host cannot resolve $DOMAIN; fi; done; echo "=> End DNS resolve test"
+    ```
+
+5. When this command has finished running, the output indicating everything is correct is:
+
+    ```
+    => Start DNS resolve test
+    => End DNS resolve test
+    ```
+
+If you see error in the output, that means that the mentioned host(s) is/are not able to resolve the given FQDN.
+
+Example error output of a situation where host with IP 209.97.182.150 had the UDP ports blocked.
+
+```
+=> Start DNS resolve test
+command terminated with exit code 1
+209.97.182.150 cannot resolve www.google.com
+=> End DNS resolve test
+```
+
+Cleanup the alpine DaemonSet by running `kubectl delete ds/dnstest`.
+
+### CoreDNS specific
+
+#### Check CoreDNS logging
+
+```
+kubectl -n kube-system logs -l k8s-app=kube-dns
+```
+
+#### Check configuration
+
+CoreDNS configuration is stored in the configmap `coredns` in the `kube-system` namespace.
+
+```
+kubectl -n kube-system get configmap coredns -o go-template={{.data.Corefile}}
+```
+
+#### Check upstream nameservers in resolv.conf
+
+By default, the configured nameservers on the host (in `/etc/resolv.conf`) will be used as upstream nameservers for CoreDNS. You can check this file on the host or run the following Pod with `dnsPolicy` set to `Default`, which will inherit the `/etc/resolv.conf` from the host it is running on.
+
+```
+kubectl run -i --restart=Never --rm test-${RANDOM} --image=ubuntu --overrides='{"kind":"Pod", "apiVersion":"v1", "spec": {"dnsPolicy":"Default"}}' -- sh -c 'cat /etc/resolv.conf'
+```
+
+#### Enable query logging
+
+Enabling query logging can be done by enabling the [log plugin](https://coredns.io/plugins/log/) in the Corefile configuration in the configmap `coredns`. You can do so by using `kubectl -n kube-system edit configmap coredns` or use the command below to replace the configuration in place:
+
+```
+kubectl get configmap -n kube-system coredns -o json |  kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n    loadbalance_g' | kubectl apply -f -
+```
+
+All queries will now be logged and can be checked using the command in [Check CoreDNS logging](#check-coredns-logging).
+
+### kube-dns specific
+
+#### Check upstream nameservers in kubedns container
+
+By default, the configured nameservers on the host (in `/etc/resolv.conf`) will be used as upstream nameservers for kube-dns. Sometimes the host will run a local caching DNS nameserver, which means the address in `/etc/resolv.conf` will point to an address in the loopback range (`127.0.0.0/8`) which will be unreachable by the container. In case of Ubuntu 18.04, this is done by `systemd-resolved`. Since Rancher v2.0.7, we detect if `systemd-resolved` is running, and will automatically use the `/etc/resolv.conf` file with the correct upstream nameservers (which is located at `/run/systemd/resolve/resolv.conf`).
+
+Use the following command to check the upstream nameservers used by the kubedns container:
+
+```
+kubectl -n kube-system get pods -l k8s-app=kube-dns --no-headers -o custom-columns=NAME:.metadata.name,HOSTIP:.status.hostIP | while read pod host; do echo "Pod ${pod} on host ${host}"; kubectl -n kube-system exec $pod -c kubedns cat /etc/resolv.conf; done
+```
+
+Example output:
+```
+Pod kube-dns-667c7cb9dd-z4dsf on host x.x.x.x
+nameserver 1.1.1.1
+nameserver 8.8.4.4
+```
+
+If the output shows an address in the loopback range (`127.0.0.0/8`), you can correct this in two ways:
+
+* Make sure the correct nameservers are listed in `/etc/resolv.conf` on your nodes in the cluster, please consult your operating system documentation on how to do this. Make sure you execute this before provisioning a cluster, or reboot the nodes after making the modification.
+* Configure the `kubelet` to use a different file for resolving names, by using `extra_args` as shown below (where `/run/resolvconf/resolv.conf` is the file with the correct nameservers):
+
+```
+services:
+  kubelet:
+    extra_args:
+      resolv-conf: "/run/resolvconf/resolv.conf"
+```
+
+> **Note:** As the `kubelet` is running inside a container, the path for files located in `/etc` and `/usr` are in `/host/etc` and `/host/usr` inside the `kubelet` container.
+
+See [Editing Cluster as YAML]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/#editing-cluster-as-yaml) how to apply this change. When the provisioning of the cluster has finished, you have to remove the kube-dns pod to activate the new setting in the pod:
+
+```
+kubectl delete pods -n kube-system -l k8s-app=kube-dns
+pod "kube-dns-5fd74c7488-6pwsf" deleted
+```
+
+Try to resolve name again using [Check if domain names are resolving](#check-if-domain-names-are-resolving).
+
+If you want to check the kube-dns configuration in your cluster (for example, to check if there are different upstream nameservers configured), you can run the following command to list the kube-dns configuration:
+
+```
+kubectl -n kube-system get configmap kube-dns -o go-template='{{range $key, $value := .data}}{{ $key }}{{":"}}{{ $value }}{{"\n"}}{{end}}'
+```
+
+Example output:
+```
+upstreamNameservers:["1.1.1.1"]
+```
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md
new file mode 100644
index 00000000000..b7a6e6b28eb
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md
@@ -0,0 +1,62 @@
+---
+title: Imported clusters
+weight: 105
+---
+
+The commands/steps listed on this page can be used to check clusters that you are importing or that are imported in Rancher.
+
+Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kubeconfig_from_imported_cluster.yml`)
+
+### Rancher agents
+
+Communication to the cluster (Kubernetes API via cattle-cluster-agent) and communication to the nodes is done through Rancher agents.
+
+If the cattle-cluster-agent cannot connect to the configured `server-url`, the cluster will remain in **Pending** state, showing `Waiting for full cluster configuration`. 
+
+#### cattle-node-agent
+
+Check if the cattle-node-agent pods are present on each node, have status **Running** and don't have a high count of Restarts:
+
+```
+kubectl -n cattle-system get pods -l app=cattle-agent -o wide
+```
+
+Example output:
+
+```
+NAME                      READY     STATUS    RESTARTS   AGE       IP                NODE
+cattle-node-agent-4gc2p   1/1       Running   0          2h        x.x.x.x           worker-1
+cattle-node-agent-8cxkk   1/1       Running   0          2h        x.x.x.x           etcd-1
+cattle-node-agent-kzrlg   1/1       Running   0          2h        x.x.x.x           etcd-0
+cattle-node-agent-nclz9   1/1       Running   0          2h        x.x.x.x           controlplane-0
+cattle-node-agent-pwxp7   1/1       Running   0          2h        x.x.x.x           worker-0
+cattle-node-agent-t5484   1/1       Running   0          2h        x.x.x.x           controlplane-1
+cattle-node-agent-t8mtz   1/1       Running   0          2h        x.x.x.x           etcd-2
+```
+
+Check logging of a specific cattle-node-agent pod or all cattle-node-agent pods:
+
+```
+kubectl -n cattle-system logs -l app=cattle-agent
+```
+
+#### cattle-cluster-agent
+
+Check if the cattle-cluster-agent pod is present in the cluster, has status **Running** and doesn't have a high count of Restarts:
+
+```
+kubectl -n cattle-system get pods -l app=cattle-cluster-agent -o wide
+```
+
+Example output:
+
+```
+NAME                                    READY     STATUS    RESTARTS   AGE       IP           NODE
+cattle-cluster-agent-54d7c6c54d-ht9h4   1/1       Running   0          2h        x.x.x.x      worker-1
+```
+
+Check logging of cattle-cluster-agent pod:
+
+```
+kubectl -n cattle-system logs -l app=cattle-cluster-agent
+```
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md
new file mode 100644
index 00000000000..50024334901
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md
@@ -0,0 +1,48 @@
+---
+title: Logging
+weight: 110
+---
+
+The following log levels are used in Rancher:
+
+| Name    | Description |
+|---------|-------------|
+| `info`  | Logs informational messages. This is the default log level. |
+| `debug` | Logs more detailed messages that can be used to debug. |
+| `trace` | Logs very detailed messages on internal functions. This is very verbose and can contain sensitive information. |
+
+### How to configure a log level
+
+* Kubernetes install
+ * Configure debug log level
+```
+$ KUBECONFIG=./kube_config_rancher-cluster.yml
+$ kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | awk '{ print $1 }' | while read rancherpod; do kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $rancherpod -- loglevel --set debug; done
+OK
+OK
+OK
+$ kubectl --kubeconfig $KUBECONFIG -n cattle-system logs -l app=rancher
+```
+
+ * Configure info log level
+```
+$ KUBECONFIG=./kube_config_rancher-cluster.yml
+$ kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | awk '{ print $1 }' | while read rancherpod; do kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $rancherpod -- loglevel --set info; done
+OK
+OK
+OK
+```
+
+* Docker Install
+ * Configure debug log level
+```
+$ docker exec -ti <container_id> loglevel --set debug
+OK
+$ docker logs -f <container_id>
+```
+
+ * Configure info log level
+```
+$ docker exec -ti <container_id> loglevel --set info
+OK
+```
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md
new file mode 100644
index 00000000000..7259b61a3e0
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md
@@ -0,0 +1,118 @@
+---
+title: Networking
+weight: 102
+---
+
+The commands/steps listed on this page can be used to check networking related issues in your cluster.
+
+Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
+
+### Double check if all the required ports are opened in your (host) firewall
+
+Double check if all the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) are opened in your (host) firewall. The overlay network uses UDP in comparison to all other required ports which are TCP.
+
+### Check if overlay network is functioning correctly
+
+The pod can be scheduled to any of the hosts you used for your cluster, but that means that the NGINX ingress controller needs to be able to route the request from `NODE_1` to `NODE_2`. This happens over the overlay network. If the overlay network is not functioning, you will experience intermittent TCP/HTTP connection failures due to the NGINX ingress controller not being able to route to the pod.
+
+To test the overlay network, you can launch the following `DaemonSet` definition. This will run a `busybox` container on every host, which we will use to run a `ping` test between containers on all hosts.
+
+1. Save the following file as `ds-overlaytest.yml`
+
+    ```
+    apiVersion: apps/v1
+    kind: DaemonSet
+    metadata:
+      name: overlaytest
+    spec:
+      selector:
+          matchLabels:
+            name: overlaytest
+      template:
+        metadata:
+          labels:
+            name: overlaytest
+        spec:
+          tolerations:
+          - operator: Exists
+          containers:
+          - image: busybox:1.28
+            imagePullPolicy: Always
+            name: busybox
+            command: ["sh", "-c", "tail -f /dev/null"]
+            terminationMessagePath: /dev/termination-log
+    ```
+
+2. Launch it using `kubectl create -f ds-overlaytest.yml`
+3. Wait until `kubectl rollout status ds/overlaytest -w` returns: `daemon set "overlaytest" successfully rolled out`.
+4. Run the following command, from the same location, to let each container on every host ping each other (it's a single line bash command).
+
+    ```
+    echo "=> Start network overlay test"; kubectl get pods -l name=overlaytest -o jsonpath='{range .items[*]}{@.metadata.name}{" "}{@.spec.nodeName}{"\n"}{end}' | while read spod shost; do kubectl get pods -l name=overlaytest -o jsonpath='{range .items[*]}{@.status.podIP}{" "}{@.spec.nodeName}{"\n"}{end}' | while read tip thost; do kubectl --request-timeout='10s' exec $spod -- /bin/sh -c "ping -c2 $tip > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $shost cannot reach $thost; fi; done; done; echo "=> End network overlay test"
+    ```
+
+5. When this command has finished running, the output indicating everything is correct is:
+
+    ```
+    => Start network overlay test
+    => End network overlay test
+    ```
+
+If you see error in the output, that means that the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for overlay networking are not opened between the hosts indicated.
+
+Example error output of a situation where NODE1 had the UDP ports blocked.
+
+```
+=> Start network overlay test
+command terminated with exit code 1
+NODE2 cannot reach NODE1
+command terminated with exit code 1
+NODE3 cannot reach NODE1
+command terminated with exit code 1
+NODE1 cannot reach NODE2
+command terminated with exit code 1
+NODE1 cannot reach NODE3
+=> End network overlay test
+```
+
+Cleanup the busybox DaemonSet by running `kubectl delete ds/overlaytest`.
+
+### Check if MTU is correctly configured on hosts and on peering/tunnel appliances/devices
+
+When the MTU is incorrectly configured (either on hosts running Rancher, nodes in created/imported clusters or on appliances/devices in between), error messages will be logged in Rancher and in the agents, similar to:
+
+* `websocket: bad handshake`
+* `Failed to connect to proxy`
+* `read tcp: i/o timeout`
+
+See [Google Cloud VPN: MTU Considerations](https://cloud.google.com/vpn/docs/concepts/mtu-considerations#gateway_mtu_vs_system_mtu) for an example how to configure MTU correctly when using Google Cloud VPN between Rancher and cluster nodes.
+
+### Resolved issues
+
+#### Overlay network broken when using Canal/Flannel due to missing node annotations
+
+| | |
+|------------|------------|
+| GitHub issue | [#13644](https://github.com/rancher/rancher/issues/13644) |
+| Resolved in |  v2.1.2 |
+
+To check if your cluster is affected, the following command will list nodes that are broken (this command requires `jq` to be installed):
+
+```
+kubectl get nodes -o json | jq '.items[].metadata | select(.annotations["flannel.alpha.coreos.com/public-ip"] == null or .annotations["flannel.alpha.coreos.com/kube-subnet-manager"] == null or .annotations["flannel.alpha.coreos.com/backend-type"] == null or .annotations["flannel.alpha.coreos.com/backend-data"] == null) | .name'
+```
+
+If there is no output, the cluster is not affected.
+
+#### System namespace pods network connectivity broken
+
+> **Note:** This applies only to Rancher upgrades from v2.0.6 or earlier to v2.0.7 or later. Upgrades from v2.0.7 to later version are unaffected.
+
+| | |
+|------------|------------|
+| GitHub issue | [#15146](https://github.com/rancher/rancher/issues/15146) |
+
+If pods in system namespaces cannot communicate with pods in other system namespaces, you will need to follow the instructions in [Upgrading to v2.0.7+ — Namespace Migration]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/) to restore connectivity. Symptoms include:
+
+- NGINX ingress controller showing `504 Gateway Time-out` when accessed.
+- NGINX ingress controller logging `upstream timed out (110: Connection timed out) while connecting to upstream` when accessed.
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/_index.md
new file mode 100644
index 00000000000..c048db2fcf2
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/rke/_index.md
@@ -0,0 +1,18 @@
+---
+title: Troubleshooting an RKE Cluster
+weight: 1
+---
+
+The commands and steps listed in this section apply to the core Kubernetes components on [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters.
+
+This section includes troubleshooting tips in the following categories:
+
+- [Troubleshooting etcd Nodes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/etcd)
+- [Troubleshooting Controlplane Nodes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/controlplane)
+- [Troubleshooting nginx-proxy Nodes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/nginx-proxy)
+- [Troubleshooting Worker Nodes and Generic Components]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/worker-and-generic)
+
+# Kubernetes Component Diagram
+
+![Cluster diagram]({{<baseurl>}}/img/rancher/clusterdiagram.svg)<br/>
+<sup>Lines show the traffic flow between components. Colors are used purely for visual aid</sup>
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md
new file mode 100644
index 00000000000..1ca42591cf2
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md
@@ -0,0 +1,40 @@
+---
+title: Troubleshooting Controlplane Nodes
+weight: 2
+---
+
+This section applies to nodes with the `controlplane` role.
+
+# Check if the Controlplane Containers are Running
+
+There are three specific containers launched on nodes with the `controlplane` role:
+
+* `kube-apiserver`
+* `kube-controller-manager`
+* `kube-scheduler`
+
+The containers should have status **Up**. The duration shown after **Up** is the time the container has been running.
+
+```
+docker ps -a -f=name='kube-apiserver|kube-controller-manager|kube-scheduler'
+```
+
+Example output:
+```
+CONTAINER ID        IMAGE                                COMMAND                  CREATED             STATUS              PORTS               NAMES
+26c7159abbcc        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-apiserver
+f3d287ca4549        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-scheduler
+bdf3898b8063        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-controller-manager
+```
+
+# Controlplane Container Logging
+
+> **Note:** If you added multiple nodes with the `controlplane` role, both `kube-controller-manager` and `kube-scheduler` use a leader election process to determine the leader. Only the current leader will log the performed actions. See [Kubernetes leader election]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-resources/#kubernetes-leader-election) how to retrieve the current leader.
+
+The logging of the containers can contain information on what the problem could be.
+
+```
+docker logs kube-apiserver
+docker logs kube-controller-manager
+docker logs kube-scheduler
+```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md
new file mode 100644
index 00000000000..f83d241a08a
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md
@@ -0,0 +1,365 @@
+---
+title: Troubleshooting etcd Nodes
+weight: 1
+---
+
+This section contains commands and tips for troubleshooting nodes with the `etcd` role.
+
+This page covers the following topics:
+
+- [Checking if the etcd Container is Running](#checking-if-the-etcd-container-is-running)
+- [etcd Container Logging](#etcd-container-logging)
+- [etcd Cluster and Connectivity Checks](#etcd-cluster-and-connectivity-checks)
+  - [Check etcd Members on all Nodes](#check-etcd-members-on-all-nodes)
+  - [Check Endpoint Status](#check-endpoint-status)
+  - [Check Endpoint Health](#check-endpoint-health)
+  - [Check Connectivity on Port TCP/2379](#check-connectivity-on-port-tcp-2379)
+  - [Check Connectivity on Port TCP/2380](#check-connectivity-on-port-tcp-2380)
+- [etcd Alarms](#etcd-alarms)
+- [etcd Space Errors](#etcd-space-errors)
+- [Log Level](#log-level)
+- [etcd Content](#etcd-content)
+  - [Watch Streaming Events](#watch-streaming-events)
+  - [Query etcd Directly](#query-etcd-directly)
+- [Replacing Unhealthy etcd Nodes](#replacing-unhealthy-etcd-nodes)
+
+# Checking if the etcd Container is Running
+
+The container for etcd should have status **Up**. The duration shown after **Up** is the time the container has been running.
+
+```
+docker ps -a -f=name=etcd$
+```
+
+Example output:
+```
+CONTAINER ID        IMAGE                         COMMAND                  CREATED             STATUS              PORTS               NAMES
+605a124503b9        rancher/coreos-etcd:v3.2.18   "/usr/local/bin/et..."   2 hours ago         Up 2 hours                              etcd
+```
+
+# etcd Container Logging
+
+The logging of the container can contain information on what the problem could be.
+
+```
+docker logs etcd
+```
+| Log | Explanation |
+|-----|------------------|
+| `health check for peer xxx could not connect: dial tcp IP:2380: getsockopt: connection refused` | A connection to the address shown on port 2380 cannot be established. Check if the etcd container is running on the host with the address shown. |
+| `xxx is starting a new election at term x` | The etcd cluster has lost its quorum and is trying to establish a new leader. This can happen when the majority of the nodes running etcd go down/unreachable. |
+| `connection error: desc = "transport: Error while dialing dial tcp 0.0.0.0:2379: i/o timeout"; Reconnecting to {0.0.0.0:2379 0  <nil>}` | The host firewall is preventing network communication. |
+| `rafthttp: request cluster ID mismatch` | The node with the etcd instance logging `rafthttp: request cluster ID mismatch` is trying to join a cluster that has already been formed with another peer. The node should be removed from the cluster, and re-added. |
+| `rafthttp: failed to find member` | The cluster state (`/var/lib/etcd`) contains wrong information to join the cluster. The node should be removed from the cluster, the state directory should be cleaned and the node should be re-added.
+
+# etcd Cluster and Connectivity Checks
+
+The address where etcd is listening depends on the address configuration of the host etcd is running on. If an internal address is configured for the host etcd is running on, the endpoint for `etcdctl` needs to be specified explicitly. If any of the commands respond with `Error:  context deadline exceeded`, the etcd instance is unhealthy (either quorum is lost or the instance is not correctly joined in the cluster)
+
+### Check etcd Members on all Nodes
+
+Output should contain all the nodes with the `etcd` role and the output should be identical on all nodes.
+
+Command:
+```
+docker exec etcd etcdctl member list
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list"
+```
+
+Example output:
+```
+xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001
+xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001
+xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001
+```
+
+### Check Endpoint Status
+
+The values for `RAFT TERM` should be equal and `RAFT INDEX` should be not be too far apart from each other.
+
+Command:
+```
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint status --write-out table
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table
+```
+
+Example output:
+```
++-----------------+------------------+---------+---------+-----------+-----------+------------+
+| ENDPOINT        |        ID        | VERSION | DB SIZE | IS LEADER | RAFT TERM | RAFT INDEX |
++-----------------+------------------+---------+---------+-----------+-----------+------------+
+| https://IP:2379 | 333ef673fc4add56 |  3.2.18 |   24 MB |     false |        72 |      66887 |
+| https://IP:2379 | 5feed52d940ce4cf |  3.2.18 |   24 MB |      true |        72 |      66887 |
+| https://IP:2379 | db6b3bdb559a848d |  3.2.18 |   25 MB |     false |        72 |      66887 |
++-----------------+------------------+---------+---------+-----------+-----------+------------+
+```
+
+### Check Endpoint Health
+
+Command:
+```
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint health
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd etcdctl endpoint health --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','")
+```
+
+Example output:
+```
+https://IP:2379 is healthy: successfully committed proposal: took = 2.113189ms
+https://IP:2379 is healthy: successfully committed proposal: took = 2.649963ms
+https://IP:2379 is healthy: successfully committed proposal: took = 2.451201ms
+```
+
+### Check Connectivity on Port TCP/2379
+
+Command:
+```
+for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5"); do
+   echo "Validating connection to ${endpoint}/health"
+   docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/health"
+done
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5"); do
+  echo "Validating connection to ${endpoint}/health";
+  docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/health"
+done
+```
+
+Example output:
+```
+Validating connection to https://IP:2379/health
+{"health": "true"}
+Validating connection to https://IP:2379/health
+{"health": "true"}
+Validating connection to https://IP:2379/health
+{"health": "true"}
+```
+
+### Check Connectivity on Port TCP/2380
+
+Command:
+```
+for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f4"); do
+  echo "Validating connection to ${endpoint}/version";
+  docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl --http1.1 -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/version"
+done
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f4"); do
+  echo "Validating connection to ${endpoint}/version";
+  docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl --http1.1 -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/version"
+done
+```
+
+Example output:
+```
+Validating connection to https://IP:2380/version
+{"etcdserver":"3.2.18","etcdcluster":"3.2.0"}
+Validating connection to https://IP:2380/version
+{"etcdserver":"3.2.18","etcdcluster":"3.2.0"}
+Validating connection to https://IP:2380/version
+{"etcdserver":"3.2.18","etcdcluster":"3.2.0"}
+```
+
+# etcd Alarms
+
+etcd will trigger alarms, for instance when it runs out of space.
+
+Command:
+```
+docker exec etcd etcdctl alarm list
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm list"
+```
+
+Example output when NOSPACE alarm is triggered:
+```
+memberID:x alarm:NOSPACE
+memberID:x alarm:NOSPACE
+memberID:x alarm:NOSPACE
+```
+
+# etcd Space Errors
+
+Related error messages are `etcdserver: mvcc: database space exceeded` or `applying raft message exceeded backend quota`. Alarm `NOSPACE` will be triggered.
+
+Resolutions:
+
+- [Compact the Keyspace](#compact-the-keyspace)
+- [Defrag All etcd Members](#defrag-all-etcd-members)
+- [Check Endpoint Status](#check-endpoint-status)
+- [Disarm Alarm](#disarm-alarm)
+
+### Compact the Keyspace
+
+Command:
+```
+rev=$(docker exec etcd etcdctl endpoint status --write-out json | egrep -o '"revision":[0-9]*' | egrep -o '[0-9]*')
+docker exec etcd etcdctl compact "$rev"
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+rev=$(docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT endpoint status --write-out json | egrep -o '\"revision\":[0-9]*' | egrep -o '[0-9]*'")
+docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT compact \"$rev\""
+```
+
+Example output:
+```
+compacted revision xxx
+```
+
+### Defrag All etcd Members
+
+Command:
+```
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl defrag
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd sh -c "etcdctl defrag --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','")"
+```
+
+Example output:
+```
+Finished defragmenting etcd member[https://IP:2379]
+Finished defragmenting etcd member[https://IP:2379]
+Finished defragmenting etcd member[https://IP:2379]
+```
+
+### Check Endpoint Status
+
+Command:
+```
+docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint status --write-out table
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd sh -c "etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table"
+```
+
+Example output:
+```
++-----------------+------------------+---------+---------+-----------+-----------+------------+
+| ENDPOINT        |        ID        | VERSION | DB SIZE | IS LEADER | RAFT TERM | RAFT INDEX |
++-----------------+------------------+---------+---------+-----------+-----------+------------+
+| https://IP:2379 |  e973e4419737125 |  3.2.18 |  553 kB |     false |        32 |    2449410 |
+| https://IP:2379 | 4a509c997b26c206 |  3.2.18 |  553 kB |     false |        32 |    2449410 |
+| https://IP:2379 | b217e736575e9dd3 |  3.2.18 |  553 kB |      true |        32 |    2449410 |
++-----------------+------------------+---------+---------+-----------+-----------+------------+
+```
+
+### Disarm Alarm
+
+After verifying that the DB size went down after compaction and defragmenting, the alarm needs to be disarmed for etcd to allow writes again.
+
+Command:
+```
+docker exec etcd etcdctl alarm list
+docker exec etcd etcdctl alarm disarm
+docker exec etcd etcdctl alarm list
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm list"
+docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm disarm"
+docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm list"
+```
+
+Example output:
+```
+docker exec etcd etcdctl alarm list
+memberID:x alarm:NOSPACE
+memberID:x alarm:NOSPACE
+memberID:x alarm:NOSPACE
+docker exec etcd etcdctl alarm disarm
+docker exec etcd etcdctl alarm list
+```
+
+# Log Level
+
+The log level of etcd can be changed dynamically via the API. You can configure debug logging using the commands below.
+
+Command:
+```
+docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"DEBUG"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINTS)/config/local/log
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"DEBUG"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINT)/config/local/log
+```
+
+To reset the log level back to the default (`INFO`), you can use the following command.
+
+Command:
+```
+docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"INFO"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINTS)/config/local/log
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"INFO"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINT)/config/local/log
+```
+
+# etcd Content
+
+If you want to investigate the contents of your etcd, you can either watch streaming events or you can query etcd directly, see below for examples.
+
+### Watch Streaming Events
+
+Command:
+```
+docker exec etcd etcdctl watch --prefix /registry
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd etcdctl --endpoints=\$ETCDCTL_ENDPOINT watch --prefix /registry
+```
+
+If you only want to see the affected keys (and not the binary data), you can append `| grep -a ^/registry` to the command to filter for keys only.
+
+### Query etcd Directly
+
+Command:
+```
+docker exec etcd etcdctl get /registry --prefix=true --keys-only
+```
+
+Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
+```
+docker exec etcd etcdctl --endpoints=\$ETCDCTL_ENDPOINT get /registry --prefix=true --keys-only
+```
+
+You can process the data to get a summary of count per key, using the command below:
+
+```
+docker exec etcd etcdctl get /registry --prefix=true --keys-only | grep -v ^$ | awk -F'/' '{ if ($3 ~ /cattle.io/) {h[$3"/"$4]++} else { h[$3]++ }} END { for(k in h) print h[k], k }' | sort -nr
+```
+
+# Replacing Unhealthy etcd Nodes
+
+When a node in your etcd cluster becomes unhealthy, the recommended approach is to fix or remove the failed or unhealthy node before adding a new etcd node to the cluster.
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md
new file mode 100644
index 00000000000..507573b7b69
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md
@@ -0,0 +1,271 @@
+---
+title: Kubernetes resources
+weight: 5
+---
+
+The commands/steps listed on this page can be used to check the most important Kubernetes resources and apply to [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters.
+
+Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
+
+- [Nodes](#nodes)
+  - [Get nodes](#get-nodes)
+  - [Get node conditions](#get-node-conditions)
+- [Kubernetes leader election](#kubernetes-leader-election)
+  - [Kubernetes controller manager leader](#kubernetes-controller-manager-leader)
+  - [Kubernetes scheduler leader](#kubernetes-scheduler-leader)
+- [Ingress controller](#ingress-controller)
+  - [Pod details](#pod-details)
+  - [Pod container logs](#pod-container-logs)
+  - [Namespace events](#namespace-events)
+  - [Debug logging](#debug-logging)
+  - [Check configuration](#check-configuration)
+- [Rancher agents](#rancher-agents)
+  - [cattle-node-agent](#cattle-node-agent)
+  - [cattle-cluster-agent](#cattle-cluster-agent)
+- [Jobs and pods](#jobs-and-pods)
+  - [Check that pods or jobs have status Running/Completed](#check-that-pods-or-jobs-have-status-running-completed)
+  - [Describe pod](#describe-pod)
+  - [Pod container logs](#pod-container-logs)
+  - [Describe job](#describe-job)
+  - [Logs from the containers of pods of the job](#logs-from-the-containers-of-pods-of-the-job)
+  - [Evicted pods](#evicted-pods)
+  - [Job does not complete](#job-does-not-complete)
+
+# Nodes
+
+### Get nodes
+
+Run the command below and check the following:
+
+- All nodes in your cluster should be listed, make sure there is not one missing.
+- All nodes should have the **Ready** status (if not in **Ready** state, check the `kubelet` container logs on that node using `docker logs kubelet`)
+- Check if all nodes report the correct version.
+- Check if OS/Kernel/Docker values are shown as expected (possibly you can relate issues due to upgraded OS/Kernel/Docker)
+
+
+```
+kubectl get nodes -o wide
+``` 
+
+Example output:
+
+```
+NAME             STATUS   ROLES          AGE   VERSION   INTERNAL-IP      EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
+controlplane-0   Ready    controlplane   31m   v1.13.5   138.68.188.91    <none>        Ubuntu 18.04.2 LTS   4.15.0-47-generic   docker://18.9.5
+etcd-0           Ready    etcd           31m   v1.13.5   138.68.180.33    <none>        Ubuntu 18.04.2 LTS   4.15.0-47-generic   docker://18.9.5
+worker-0         Ready    worker         30m   v1.13.5   139.59.179.88    <none>        Ubuntu 18.04.2 LTS   4.15.0-47-generic   docker://18.9.5
+```
+
+### Get node conditions
+
+Run the command below to list nodes with [Node Conditions](https://kubernetes.io/docs/concepts/architecture/nodes/#condition)
+
+```
+kubectl get nodes -o go-template='{{range .items}}{{$node := .}}{{range .status.conditions}}{{$node.metadata.name}}{{": "}}{{.type}}{{":"}}{{.status}}{{"\n"}}{{end}}{{end}}'
+```
+
+Run the command below to list nodes with [Node Conditions](https://kubernetes.io/docs/concepts/architecture/nodes/#condition) that are active that could prevent normal operation.
+
+```
+kubectl get nodes -o go-template='{{range .items}}{{$node := .}}{{range .status.conditions}}{{if ne .type "Ready"}}{{if eq .status "True"}}{{$node.metadata.name}}{{": "}}{{.type}}{{":"}}{{.status}}{{"\n"}}{{end}}{{else}}{{if ne .status "True"}}{{$node.metadata.name}}{{": "}}{{.type}}{{": "}}{{.status}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}'
+```
+
+Example output:
+
+```
+worker-0: DiskPressure:True
+```
+
+# Kubernetes leader election
+
+### Kubernetes Controller Manager leader
+
+The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `kube-controller-manager` endpoint (in this example, `controlplane-0`).
+
+```
+kubectl -n kube-system get endpoints kube-controller-manager -o jsonpath='{.metadata.annotations.control-plane\.alpha\.kubernetes\.io/leader}'
+{"holderIdentity":"controlplane-0_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","leaseDurationSeconds":15,"acquireTime":"2018-12-27T08:59:45Z","renewTime":"2018-12-27T09:44:57Z","leaderTransitions":0}>
+```
+
+### Kubernetes Scheduler leader
+
+The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `kube-scheduler` endpoint (in this example, `controlplane-0`).
+
+```
+kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.annotations.control-plane\.alpha\.kubernetes\.io/leader}'
+{"holderIdentity":"controlplane-0_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","leaseDurationSeconds":15,"acquireTime":"2018-12-27T08:59:45Z","renewTime":"2018-12-27T09:44:57Z","leaderTransitions":0}>
+```
+
+# Ingress Controller
+
+The default Ingress Controller is NGINX and is deployed as a DaemonSet in the `ingress-nginx` namespace. The pods are only scheduled to nodes with the `worker` role.
+
+Check if the pods are running on all nodes:
+
+```
+kubectl -n ingress-nginx get pods -o wide
+```
+
+Example output:
+
+```
+kubectl -n ingress-nginx get pods -o wide
+NAME                                    READY     STATUS    RESTARTS   AGE       IP               NODE
+default-http-backend-797c5bc547-kwwlq   1/1       Running   0          17m       x.x.x.x          worker-1
+nginx-ingress-controller-4qd64          1/1       Running   0          14m       x.x.x.x          worker-1
+nginx-ingress-controller-8wxhm          1/1       Running   0          13m       x.x.x.x          worker-0
+```
+
+If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.
+
+### Pod details
+
+```
+kubectl -n ingress-nginx describe pods -l app=ingress-nginx
+```
+
+### Pod container logs
+
+```
+kubectl -n ingress-nginx logs -l app=ingress-nginx
+```
+
+### Namespace events
+
+```
+kubectl -n ingress-nginx get events
+```
+
+### Debug logging
+
+To enable debug logging:
+
+```
+kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
+```
+
+### Check configuration
+
+Retrieve generated configuration in each pod:
+
+```
+kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
+```
+
+# Rancher agents
+
+Communication to the cluster (Kubernetes API via `cattle-cluster-agent`) and communication to the nodes (cluster provisioning via `cattle-node-agent`) is done through Rancher agents.
+
+#### cattle-node-agent
+
+Check if the cattle-node-agent pods are present on each node, have status **Running** and don't have a high count of Restarts:
+
+```
+kubectl -n cattle-system get pods -l app=cattle-agent -o wide
+```
+
+Example output:
+
+```
+NAME                      READY     STATUS    RESTARTS   AGE       IP                NODE
+cattle-node-agent-4gc2p   1/1       Running   0          2h        x.x.x.x           worker-1
+cattle-node-agent-8cxkk   1/1       Running   0          2h        x.x.x.x           etcd-1
+cattle-node-agent-kzrlg   1/1       Running   0          2h        x.x.x.x           etcd-0
+cattle-node-agent-nclz9   1/1       Running   0          2h        x.x.x.x           controlplane-0
+cattle-node-agent-pwxp7   1/1       Running   0          2h        x.x.x.x           worker-0
+cattle-node-agent-t5484   1/1       Running   0          2h        x.x.x.x           controlplane-1
+cattle-node-agent-t8mtz   1/1       Running   0          2h        x.x.x.x           etcd-2
+```
+
+Check logging of a specific cattle-node-agent pod or all cattle-node-agent pods:
+
+```
+kubectl -n cattle-system logs -l app=cattle-agent
+```
+
+#### cattle-cluster-agent
+
+Check if the cattle-cluster-agent pod is present in the cluster, has status **Running** and doesn't have a high count of Restarts:
+
+```
+kubectl -n cattle-system get pods -l app=cattle-cluster-agent -o wide
+```
+
+Example output:
+
+```
+NAME                                    READY     STATUS    RESTARTS   AGE       IP           NODE
+cattle-cluster-agent-54d7c6c54d-ht9h4   1/1       Running   0          2h        x.x.x.x      worker-1
+```
+
+Check logging of cattle-cluster-agent pod:
+
+```
+kubectl -n cattle-system logs -l app=cattle-cluster-agent
+```
+
+# Jobs and Pods
+
+### Check that pods or jobs have status **Running**/**Completed**
+
+To check, run the command:
+
+```
+kubectl get pods --all-namespaces
+```
+
+If a pod is not in **Running** state, you can dig into the root cause by running:
+
+### Describe pod
+
+```
+kubectl describe pod POD_NAME -n NAMESPACE
+```
+
+### Pod container logs
+
+```
+kubectl logs POD_NAME -n NAMESPACE
+```
+
+If a job is not in **Completed** state, you can dig into the root cause by running:
+
+### Describe job
+
+```
+kubectl describe job JOB_NAME -n NAMESPACE
+```
+
+### Logs from the containers of pods of the job
+
+```
+kubectl logs -l job-name=JOB_NAME -n NAMESPACE
+```
+
+### Evicted pods
+
+Pods can be evicted based on [eviction signals](https://kubernetes.io/docs/tasks/administer-cluster/out-of-resource/#eviction-policy).
+
+Retrieve a list of evicted pods (podname and namespace):
+
+```
+kubectl get pods --all-namespaces -o go-template='{{range .items}}{{if eq .status.phase "Failed"}}{{if eq .status.reason "Evicted"}}{{.metadata.name}}{{" "}}{{.metadata.namespace}}{{"\n"}}{{end}}{{end}}{{end}}'
+```
+
+To delete all evicted pods:
+
+```
+kubectl get pods --all-namespaces -o go-template='{{range .items}}{{if eq .status.phase "Failed"}}{{if eq .status.reason "Evicted"}}{{.metadata.name}}{{" "}}{{.metadata.namespace}}{{"\n"}}{{end}}{{end}}{{end}}' | while read epod enamespace; do kubectl -n $enamespace delete pod $epod; done
+```
+
+Retrieve a list of evicted pods, scheduled node and the reason:
+
+```
+kubectl get pods --all-namespaces -o go-template='{{range .items}}{{if eq .status.phase "Failed"}}{{if eq .status.reason "Evicted"}}{{.metadata.name}}{{" "}}{{.metadata.namespace}}{{"\n"}}{{end}}{{end}}{{end}}' | while read epod enamespace; do kubectl -n $enamespace get pod $epod -o=custom-columns=NAME:.metadata.name,NODE:.spec.nodeName,MSG:.status.message; done
+```
+
+### Job does not complete
+
+If you have enabled Istio, and you are having issues with a Job you deployed not completing, you will need to add an annotation to your pod using [these steps.](../../cluster-admin/tools/istio/setup/enable-istio-in-namespace/#excluding-workloads-from-being-injected-with-the-istio-sidecar)
+
+Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. This is a temporary workaround and will disable Istio for any traffic to/from the annotated Pod. Keep in mind this may not allow you to continue to use a Job for integration testing, as the Job will not have access to the service mesh.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md
new file mode 100644
index 00000000000..70505e96280
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md
@@ -0,0 +1,69 @@
+---
+title: Troubleshooting nginx-proxy
+weight: 3
+---
+
+The `nginx-proxy` container is deployed on every node that does not have the `controlplane` role. It provides access to all the nodes with the `controlplane` role by dynamically generating the NGINX configuration based on available nodes with the `controlplane` role.
+
+# Check if the Container is Running
+
+The container is called `nginx-proxy` and should have status `Up`. The duration shown after `Up` is the time the container has been running.
+
+```
+docker ps -a -f=name=nginx-proxy
+```
+
+Example output:
+
+```
+docker ps -a -f=name=nginx-proxy
+CONTAINER ID        IMAGE                       COMMAND                  CREATED             STATUS              PORTS               NAMES
+c3e933687c0e        rancher/rke-tools:v0.1.15   "nginx-proxy CP_HO..."   3 hours ago         Up 3 hours                              nginx-proxy
+```
+
+# Check Generated NGINX Configuration
+
+The generated configuration should include the IP addresses of the nodes with the `controlplane` role. The configuration can be checked using the following command:
+
+```
+docker exec nginx-proxy cat /etc/nginx/nginx.conf
+```
+
+Example output:
+```
+error_log stderr notice;
+
+worker_processes auto;
+events {
+  multi_accept on;
+  use epoll;
+  worker_connections 1024;
+}
+
+stream {
+        upstream kube_apiserver {
+            
+            server ip_of_controlplane_node1:6443;
+            
+            server ip_of_controlplane_node2:6443;
+            
+        }
+
+        server {
+            listen        6443;
+            proxy_pass    kube_apiserver;
+            proxy_timeout 30;
+            proxy_connect_timeout 2s;
+
+        }
+
+}
+```
+
+# nginx-proxy Container Logging
+
+The logging of the containers can contain information on what the problem could be.
+
+```
+docker logs nginx-proxy
+```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md
new file mode 100644
index 00000000000..5a96d695015
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md
@@ -0,0 +1,80 @@
+---
+title: Troubleshooting Rancher Installed on a Local RKE Cluster
+weight: 104
+---
+
+The commands/steps listed on this page are intended to be used to troubleshoot an RKE Kubernetes cluster that Rancher is installed on.
+
+Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml`).
+
+### Check Rancher pods
+
+Rancher pods are deployed as a Deployment in the `cattle-system` namespace.
+
+Check if the pods are running on all nodes:
+
+```
+kubectl -n cattle-system get pods -l app=rancher -o wide
+```
+
+Example output:
+
+```
+NAME                       READY   STATUS    RESTARTS   AGE   IP          NODE
+rancher-7dbd7875f7-n6t5t   1/1     Running   0          8m    x.x.x.x     x.x.x.x
+rancher-7dbd7875f7-qbj5k   1/1     Running   0          8m    x.x.x.x     x.x.x.x
+rancher-7dbd7875f7-qw7wb   1/1     Running   0          8m    x.x.x.x     x.x.x.x
+```
+
+If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.                                                                                                       
+
+#### Pod details
+
+```
+kubectl -n cattle-system describe pods -l app=rancher
+```
+
+#### Pod container logs
+
+```
+kubectl -n cattle-system logs -l app=rancher
+```
+
+#### Namespace events
+
+```
+kubectl -n cattle-system get events
+```
+
+### Check ingress
+
+Ingress should have the correct `HOSTS` (showing the configured FQDN) and `ADDRESS` (host address(es) it will be routed to).
+
+```
+kubectl -n cattle-system get ingress
+```
+
+Example output:
+
+```
+NAME      HOSTS                    ADDRESS                   PORTS     AGE
+rancher   rancher.yourdomain.com   x.x.x.x,x.x.x.x,x.x.x.x   80, 443   2m
+```
+
+### Check ingress controller logs
+
+When accessing your configured Rancher FQDN does not show you the UI, check the ingress controller logging to see what happens when you try to access Rancher:
+
+```
+kubectl -n ingress-nginx logs -l app=ingress-nginx
+```
+
+### Leader election
+
+The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `cattle-controllers` ConfigMap (in this example, `rancher-7dbd7875f7-qbj5k`).
+
+```
+kubectl -n kube-system get configmap cattle-controllers -o jsonpath='{.metadata.annotations.control-plane\.alpha\.kubernetes\.io/leader}'
+{"holderIdentity":"rancher-7dbd7875f7-qbj5k","leaseDurationSeconds":45,"acquireTime":"2019-04-04T11:53:12Z","renewTime":"2019-04-04T12:24:08Z","leaderTransitions":0}
+```
+
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md
new file mode 100644
index 00000000000..28ee4499bb4
--- /dev/null
+++ b/content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md
@@ -0,0 +1,35 @@
+---
+title: Troubleshooting Worker Nodes and Generic Components
+weight: 4
+---
+
+This section applies to every node as it includes components that run on nodes with any role.
+
+# Check if the Containers are Running
+
+There are two specific containers launched on nodes with the `worker` role:
+
+* kubelet
+* kube-proxy
+
+The containers should have status `Up`. The duration shown after `Up` is the time the container has been running.
+
+```
+docker ps -a -f=name='kubelet|kube-proxy'
+```
+
+Example output:
+```
+CONTAINER ID        IMAGE                                COMMAND                  CREATED             STATUS              PORTS               NAMES
+158d0dcc33a5        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-proxy
+a30717ecfb55        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kubelet
+```
+
+# Container Logging
+
+The logging of the containers can contain information on what the problem could be.
+
+```
+docker logs kubelet
+docker logs kube-proxy
+```
diff --git a/content/rancher/v2.5/en/user-preferences/_index.md b/content/rancher/v2.5/en/user-preferences/_index.md
new file mode 100644
index 00000000000..4768b7d25b0
--- /dev/null
+++ b/content/rancher/v2.5/en/user-preferences/_index.md
@@ -0,0 +1,34 @@
+---
+title: User Preferences
+weight: 7000
+---
+
+> This page is under construction.
+
+Within Rancher, each user has a number of settings associated with their login: personal preferences, API keys, etc. You can configure these settings by choosing from the **User Settings** menu. You can open this menu by clicking your avatar, located within the main menu.
+
+![User Settings Menu]({{<baseurl>}}/img/rancher/user-settings.png)
+
+The available user settings are:
+
+- [API & Keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/): If you want to interact with Rancher programmatically, you need an API key. Follow the directions in this section to obtain a key.
+- [Cloud Credentials]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/): Manage cloud credentials [used by node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) to [provision nodes for clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters). Note: Available as of v2.2.0. 
+- [Node Templates]({{<baseurl>}}/rancher/v2.x/en/user-settings/node-templates): Manage templates [used by Rancher to provision nodes for clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters).
+- [Preferences]({{<baseurl>}}/rancher/v2.x/en/user-settings/preferences): Sets superficial preferences for the Rancher UI.
+- Log Out: Ends your user session.
+
+# Preferences
+
+Each user can choose preferences to personalize their Rancher experience. To change preference settings, open the **User Settings** menu and then select **Preferences**.
+
+## Theme
+
+Choose your background color for the Rancher UI. If you choose **Auto**, the background color changes from light to dark at 6 PM, and then changes back at 6 AM.
+
+## My Account
+
+This section displays the **Name** (your display name) and **Username** (your login) used for your session. To change your login's current password, click the **Change Password** button.
+
+## Table Row per Page
+
+On pages that display system objects like clusters or deployments in a table, you can set the number of objects that display on the page before you must paginate. The default setting is `50`.
diff --git a/content/rancher/v2.x/_index.md b/content/rancher/v2.x/_index.md
index fde0e8a648a..f0bb89915cf 100644
--- a/content/rancher/v2.x/_index.md
+++ b/content/rancher/v2.x/_index.md
@@ -1,4 +1,4 @@
 ---
-title: v2.x
+title: v2.0-v2.4
 showBreadcrumb: false
 ---
diff --git a/content/rancher/v2.x/en/_index.md b/content/rancher/v2.x/en/_index.md
index 685ceec51a5..850af59c5f6 100644
--- a/content/rancher/v2.x/en/_index.md
+++ b/content/rancher/v2.x/en/_index.md
@@ -1,14 +1,17 @@
 ---
-title: "Rancher 2.x"
-shortTitle: "Rancher 2.x"
+title: "Rancher v2.0-v2.4 Documentation"
+shortTitle: "Rancher 2.0-2.4"
 description: "Rancher adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
-metaTitle: "Rancher 2.x Docs: What is New?"
+metaTitle: "Rancher 2.0-2.4 Docs"
 metaDescription: "Rancher 2 adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
 insertOneSix: true
 weight: 1
 ctaBanner: 0
 ---
-Rancher was originally built to work with multiple orchestrators, and it included its own orchestrator called Cattle. With the rise of Kubernetes in the marketplace, Rancher 2.x exclusively deploys and manages Kubernetes clusters running anywhere, on any provider.
+
+> The Rancher v2.5 docs are [here.]({{<baseurl>}}/rancher/v2.5/en)
+
+Rancher was originally built to work with multiple orchestrators, and it included its own orchestrator called Cattle. With the rise of Kubernetes in the marketplace, Rancher 2 exclusively deploys and manages Kubernetes clusters running anywhere, on any provider.
 
 Rancher can provision Kubernetes from a hosted provider, provision compute nodes and then install Kubernetes onto them, or import existing Kubernetes clusters running anywhere.
 
diff --git a/content/rke/latest/en/tutorials/_index.md b/content/rke/latest/en/tutorials/_index.md
new file mode 100644
index 00000000000..fa01f89e4ff
--- /dev/null
+++ b/content/rke/latest/en/tutorials/_index.md
@@ -0,0 +1,4 @@
+---
+title: Tutorials
+weight: 10000
+---
\ No newline at end of file
diff --git a/content/rke/latest/en/tutorials/infra-for-ha/_index.md b/content/rke/latest/en/tutorials/infra-for-ha/_index.md
new file mode 100644
index 00000000000..3ebc52eacdd
--- /dev/null
+++ b/content/rke/latest/en/tutorials/infra-for-ha/_index.md
@@ -0,0 +1,62 @@
+---
+title: 'Set up Infrastructure for a High Availability RKE Kubernetes Cluster'
+weight: 2
+---
+
+> This page is under construction.
+
+In this section, you will create a high-availability RKE cluster that can be used to install a Rancher server.
+
+> **Note:** These nodes must be in the same region. You may place these servers in separate availability zones (datacenter).
+
+To install the Rancher management server on a high-availability RKE cluster, we recommend setting up the following infrastructure:
+
+- **Three Linux nodes,** typically virtual machines, in an infrastructure provider such as Amazon's EC2, Google Compute Engine, or vSphere.
+- **A load balancer** to direct front-end traffic to the three nodes.
+- **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it.
+
+These nodes must be in the same region/data center. You may place these servers in separate availability zones.
+
+### Why three nodes?
+
+In an RKE cluster, Rancher server data is stored on etcd. This etcd database runs on all three nodes.
+
+The etcd database requires an odd number of nodes so that it can always elect a leader with a majority of the etcd cluster. If the etcd database cannot elect a leader, etcd can suffer from [split brain](https://www.quora.com/What-is-split-brain-in-distributed-systems), requiring the cluster to be restored from backup. If one of the three etcd nodes fails, the two remaining nodes can elect a leader because they have the majority of the total number of etcd nodes.
+
+### 1. Set up Linux Nodes
+
+Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
+
+For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node/) for setting up nodes as instances in Amazon EC2.
+
+### 2. Set up the Load Balancer
+
+You will also need to set up a load balancer to direct traffic to the Rancher replica on both nodes. That will prevent an outage of any single node from taking down communications to the Rancher management server.
+
+When Kubernetes gets set up in a later step, the RKE tool will deploy an NGINX Ingress controller. This controller will listen on ports 80 and 443 of the worker nodes, answering traffic destined for specific hostnames.
+
+When Rancher is installed (also in a later step), the Rancher system creates an Ingress resource. That Ingress tells the NGINX Ingress controller to listen for traffic destined for the Rancher hostname. The NGINX Ingress controller, when receiving traffic destined for the Rancher hostname, will forward that traffic to the running Rancher pods in the cluster.
+
+For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer:
+
+- **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment.
+- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
+
+For an example showing how to set up an NGINX load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nginx/)
+
+For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nlb/)
+
+> **Important:**
+> Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications.
+
+### 3. Set up the DNS Record
+
+Once you have set up your load balancer, you will need to create a DNS record to send traffic to this load balancer.
+
+Depending on your environment, this may be an A record pointing to the LB IP, or it may be a CNAME pointing to the load balancer hostname. In either case, make sure this record is the hostname that you intend Rancher to respond on.
+
+You will need to specify this hostname in a later step when you install Rancher, and it is not possible to change it later. Make sure that your decision is a final one.
+
+For a how-to guide for setting up a DNS record to route domain traffic to an Amazon ELB load balancer, refer to the [official AWS documentation.](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer)
+
+### [Next: Set up a Kubernetes Cluster]({{<baseurl>}}/rancher/v2.x/en/installation/resources/k8s-tutorials/ka-rke/)
\ No newline at end of file

From 9d5743bbc58a4c814db2af99b625dc2373148091 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 27 Jul 2020 17:12:43 -0700
Subject: [PATCH 183/265] Change Rancher 2.5 docs section titles

---
 content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md  | 2 +-
 content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md b/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
index d9856c645d2..3925d78c71c 100644
--- a/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
+++ b/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Rancher Kubernetes Cluster
+title: Installing/Upgrading Rancher
 weight: 50
 ---
 
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md b/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
index 1547b7a49d4..ff27df91088 100644
--- a/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
+++ b/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Rancher - Helm Chart Only
+title: Installing/Upgrading Rancher as a Helm Chart
 description: Learn how to install Rancher in development and production environments. Read about single node and high availability installation
 weight: 51
 ---

From 58b99f76b0cf9404523bfc64a01bdf3b70b462bc Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 29 Jul 2020 12:20:12 -0700
Subject: [PATCH 184/265] Reorganize Rancher v2.5 docs

---
 content/rancher/v2.5/en/api/_index.md         |  2 +-
 .../rancher/v2.5/en/applications/_index.md    | 52 -------------------
 .../en/applications/backup-restore/_index.md  | 10 ----
 .../{backup-application => backups}/_index.md |  9 +---
 .../rancher/v2.5/en/backups/classic/_index.md |  6 +++
 .../classic}/docker/_index.md                 |  0
 .../classic}/docker/docker-backups/_index.md  |  0
 .../classic}/docker/docker-restore/_index.md  |  0
 .../classic}/special-scenarios/_index.md      |  0
 .../rancher/v2.5/en/backups/normal/_index.md  |  6 +++
 content/rancher/v2.5/en/cli/_index.md         |  2 +-
 .../v2.5/en/cluster-explorer/_index.md        |  2 +-
 .../rancher/v2.5/en/contributing/_index.md    |  2 +-
 .../v2.5/en/disaster-recovery/_index.md       | 12 -----
 .../v2.5/en/{applications => }/ecm/_index.md  |  2 +-
 .../ecm/access-control/_index.md              |  2 +-
 .../access-control/authentication/_index.md   |  0
 .../authentication/ad/_index.md               |  0
 .../authentication/azure-ad/_index.md         |  0
 .../authentication/freeipa/_index.md          |  0
 .../authentication/github/_index.md           |  0
 .../authentication/google/_index.md           |  0
 .../authentication/keycloak/_index.md         |  0
 .../authentication/local/_index.md            |  0
 .../authentication/microsoft-adfs/_index.md   |  0
 .../microsoft-adfs-setup/_index.md            |  0
 .../rancher-adfs-setup/_index.md              |  0
 .../authentication/okta/_index.md             |  0
 .../authentication/openldap/_index.md         |  0
 .../openldap/openldap-config/_index.md        |  0
 .../authentication/ping-federate/_index.md    |  0
 .../authentication/shibboleth/_index.md       |  0
 .../authentication/shibboleth/about/_index.md |  0
 .../authentication/user-groups/_index.md      |  0
 .../ecm/access-control/rbac/_index.md         |  0
 .../rbac/add-users-to-cluster/_index.md       |  0
 .../rbac/default-custom-roles/_index.md       |  0
 .../rbac/locked-roles/_index.md               |  0
 .../ecm/access-control/rbac/mcm/_index.md     |  0
 .../ecm/access-control/rbac/mcm/ace/_index.md |  0
 .../rbac/mcm/cluster-project-roles/_index.md  |  0
 .../rbac/mcm/custom-global-roles/_index.md    |  0
 .../rbac/mcm/global-permissions/_index.md     |  0
 .../access-control/rbac/mcm/kubectl/_index.md |  0
 .../rbac/mcm/project-members/_index.md        |  0
 .../ecm/backing-up-a-cluster/_index.md        |  0
 .../en/{ => ecm}/best-practices/_index.md     |  2 +-
 .../en/{ => ecm}/best-practices/mcm/_index.md |  0
 .../architecture-recommendations/_index.md    |  0
 .../best-practices/mcm/containers/_index.md   |  0
 .../mcm/deployment-strategies/_index.md       |  0
 .../mcm/deployment-types/_index.md            |  0
 .../best-practices/mcm/management/_index.md   |  0
 .../best-practices/rancher-server/_index.md   |  0
 .../ecm/cloning-clusters/_index.md            |  0
 .../ecm/cluster-configuration/_index.md       |  0
 .../ecm/config-private-registry/_index.md     |  0
 .../ecm/disconnecting-nodes/_index.md         |  0
 .../{applications => }/ecm/drivers/_index.md  |  0
 .../ecm/drivers/cluster-drivers/_index.md     |  0
 .../ecm/drivers/node-drivers/_index.md        |  0
 .../ecm/feature-flags/_index.md               |  0
 .../_index.md                                 |  0
 .../istio-virtual-service-ui/_index.md        |  0
 .../ecm/globaldns/_index.md                   |  2 +-
 .../ecm/infrastructure/_index.md              |  0
 .../cloud-credentials/_index.md               |  0
 .../infrastructure/cloud-providers/_index.md  |  0
 .../cloud-providers/amazon/_index.md          |  0
 .../cloud-providers/azure/_index.md           |  0
 .../cloud-providers/gce/_index.md             |  0
 .../infrastructure/node-templates/_index.md   |  0
 .../ecm/infrastructure/nodes/_index.md        |  0
 .../ecm/k8s-metadata/_index.md                |  0
 .../_index.md                                 |  0
 .../ecm/pod-security-policies/_index.md       |  0
 .../ecm/projects-and-namespaces/_index.md     |  2 +-
 .../ecm/requirements/_index.md                |  2 +-
 .../ecm/requirements/ports/_index.md          |  0
 .../ecm/restoring-from-backup/_index.md       |  0
 .../ecm/rke-templates/_index.md               |  0
 .../applying-templates/_index.md              |  0
 .../creating-and-revising/_index.md           |  0
 .../creator-permissions/_index.md             |  0
 .../ecm/rke-templates/enforcement/_index.md   |  0
 .../rke-templates/example-scenarios/_index.md |  0
 .../ecm/rke-templates/example-yaml/_index.md  |  0
 .../ecm/rke-templates/overrides/_index.md     |  0
 .../rke-templates-and-hardware/_index.md      |  0
 .../template-access-and-sharing/_index.md     |  0
 .../ecm/setting-up-k8s/_index.md              |  0
 .../cluster-capabilities-table/index.md       |  0
 .../hosted-kubernetes-clusters/_index.md      |  0
 .../hosted-kubernetes-clusters/ack/_index.md  |  0
 .../hosted-kubernetes-clusters/aks/_index.md  |  0
 .../hosted-kubernetes-clusters/cce/_index.md  |  0
 .../hosted-kubernetes-clusters/eks/_index.md  |  0
 .../hosted-kubernetes-clusters/gke/_index.md  |  0
 .../hosted-kubernetes-clusters/tke/_index.md  |  0
 .../imported-clusters/_index.md               |  0
 .../imported-clusters/eks/_index.md           |  0
 .../imported-clusters/k3s/_index.md           |  0
 .../imported-clusters/rancher-k8s/_index.md   |  0
 .../production-checklist/_index.md            |  0
 .../nodes-and-roles/_index.md                 |  0
 .../recommended-architecture/_index.md        |  0
 .../ecm/setting-up-k8s/rke-clusters/_index.md |  0
 .../cluster-config-reference/_index.md        |  0
 .../pod-security-policies/_index.md           |  0
 .../rke-clusters/custom-nodes/_index.md       |  0
 .../custom-nodes/agent-options/_index.md      |  0
 .../infrastructure-provider/_index.md         |  0
 .../infrastructure-provider/azure/_index.md   |  0
 .../digital-ocean/_index.md                   |  0
 .../infrastructure-provider/ec2/_index.md     |  0
 .../infrastructure-provider/vsphere/_index.md |  0
 .../provisioning-vsphere-clusters/_index.md   |  0
 .../creating-credentials/_index.md            |  0
 .../enabling-uuids/_index.md                  |  0
 .../node-template-reference/_index.md         |  0
 .../rke-clusters/node-requirements/_index.md  |  0
 .../rke-clusters/rancher-agents/_index.md     |  0
 .../rke-clusters/windows-clusters/_index.md   |  0
 .../docs-for-2.1-and-2.2/_index.md            |  0
 .../host-gateway-requirements/_index.md       |  0
 .../ecm/upgrading-kubernetes/_index.md        |  0
 .../ecm/upgrading-mcm/_index.md               |  0
 .../ecm/upgrading-mcm/rollbacks/_index.md     |  0
 content/rancher/v2.5/en/faq/_index.md         |  4 +-
 .../_index.md                                 |  6 ++-
 .../installation/_index.md                    |  0
 .../installation/chart-options/_index.md      |  0
 .../installation/choosing-version/_index.md   |  0
 .../installation/helm-version/_index.md       |  0
 .../installation/resources/_index.md          |  0
 .../installation/resources/advanced/_index.md |  0
 .../advanced/api-audit-log/_index.md          |  0
 .../advanced/arm64-platform/_index.md         |  0
 .../resources/advanced/etcd/_index.md         |  0
 .../resources/advanced/firewall/_index.md     |  0
 .../installation/resources/air-gap/_index.md  |  0
 .../air-gap/install-rancher/_index.md         |  0
 .../air-gap/local-system-charts/_index.md     |  0
 .../populate-private-registry/_index.md       |  0
 .../air-gap/prepare-registry/_index.md        |  0
 .../resources/encryption/_index.md            |  0
 .../custom-ca-root-certificate/_index.md      |  0
 .../encryption/tls-secrets/_index.md          |  0
 .../encryption/tls-settings/_index.md         |  0
 .../upgrading-cert-manager/_index.md          |  0
 .../resources/k8s-tutorials/_index.md         |  0
 .../resources/k8s-tutorials/ha-RKE/_index.md  |  0
 .../resources/k8s-tutorials/ha-RKE2/_index.md |  0
 .../k8s-tutorials/how-ha-works/_index.md      |  0
 .../infrastructure-tutorials/_index.md        |  0
 .../ec2-node/_index.md                        |  0
 .../infrastructure-tutorials/nginx/_index.md  |  0
 .../infrastructure-tutorials/nlb/_index.md    |  0
 .../infrastructure-tutorials/rds/_index.md    |  0
 .../resources/single-node-docker/_index.md    |  0
 .../single-node-docker/advanced/_index.md     |  0
 .../installing-docker/_index.md               |  0
 .../single-node-docker/proxy/_index.md        |  0
 .../single-node-install-external-lb/_index.md |  0
 .../upgrade/_index.md                         |  0
 .../upgrade/rollbacks/_index.md               |  0
 .../_index.md                                 |  6 ++-
 .../installation/_index.md                    |  0
 .../upgrade/_index.md                         |  0
 .../upgrade/cluster-upgrade/_index.md         |  0
 .../woker-node-upgrade/_index.md              |  0
 .../upgrade/image-upgrade/_index.md           |  0
 .../en/{applications => }/istio/_index.md     |  2 +-
 .../rancher/v2.5/en/istio/classic/_index.md   |  6 +++
 .../classic}/disabling-istio/_index.md        |  0
 .../istio => istio/classic}/rbac/_index.md    |  0
 .../classic}/release-notes/_index.md          |  0
 .../classic}/resources/_index.md              |  0
 .../istio => istio/classic}/setup/_index.md   |  0
 .../classic}/setup/deploy-workloads/_index.md |  0
 .../setup/enable-istio-in-cluster/_index.md   |  0
 .../enable-istio-with-psp/_index.md           |  0
 .../setup/enable-istio-in-namespace/_index.md |  0
 .../classic}/setup/gateway/_index.md          |  0
 .../classic}/setup/node-selectors/_index.md   |  0
 .../setup/set-up-traffic-management/_index.md |  0
 .../classic}/setup/view-traffic/_index.md     |  0
 .../rancher/v2.5/en/istio/normal/_index.md    |  6 +++
 .../en/{applications => }/logging/_index.md   |  3 +-
 .../rancher/v2.5/en/logging/classic/_index.md |  4 ++
 .../classic}/elasticsearch/_index.md          |  0
 .../classic}/fluentd/_index.md                |  0
 .../classic}/kafka/_index.md                  |  0
 .../classic}/splunk/_index.md                 |  0
 .../classic}/syslog/_index.md                 |  0
 .../rancher/v2.5/en/logging/normal/_index.md  |  6 +++
 .../longhorn-storage/_index.md                |  2 +-
 .../en/longhorn-storage/classic/_index.md     |  4 ++
 .../v2.5/en/longhorn-storage/normal/_index.md |  4 ++
 .../managing-applications/_index.md           |  2 +-
 .../creating-apps/_index.md                   |  0
 .../creating-custom-libraries/_index.md       |  0
 .../enabling-builtin-libraries/_index.md      |  0
 .../launching-apps/_index.md                  |  0
 .../library-config/_index.md                  |  0
 .../managing-apps/_index.md                   |  0
 .../multi-cluster-apps/_index.md              |  0
 .../managing-applications/tutorial/_index.md  |  0
 .../{applications => }/monitoring/_index.md   |  3 +-
 .../v2.5/en/monitoring/classic/_index.md      |  6 +++
 .../classic}/alerts/_index.md                 |  0
 .../classic}/alerts/default-alerts/_index.md  |  0
 .../classic}/cluster-metrics/_index.md        |  0
 .../classic}/custom-metrics/_index.md         |  0
 .../classic}/expression/_index.md             |  0
 .../classic}/prometheus/_index.md             |  0
 .../classic}/viewing-metrics/_index.md        |  0
 .../v2.5/en/monitoring/normal/_index.md       |  6 +++
 content/rancher/v2.5/en/notifiers/_index.md   |  8 +++
 .../notifiers => notifiers/classic}/_index.md |  4 +-
 .../v2.5/en/notifiers/normal/_index.md        |  4 ++
 .../rancher/v2.5/en/opa-gatekeper/_index.md   |  6 +++
 .../classic}/_index.md                        |  5 +-
 .../v2.5/en/opa-gatekeper/normal/_index.md    |  4 ++
 content/rancher/v2.5/en/security/_index.md    |  2 +-
 .../rancher/v2.5/en/system-tools/_index.md    |  2 +-
 .../rancher/v2.5/en/troubleshooting/_index.md |  2 +-
 .../v2.5/en/user-preferences/_index.md        |  2 +-
 228 files changed, 111 insertions(+), 113 deletions(-)
 delete mode 100644 content/rancher/v2.5/en/applications/_index.md
 delete mode 100644 content/rancher/v2.5/en/applications/backup-restore/_index.md
 rename content/rancher/v2.5/en/{backup-application => backups}/_index.md (52%)
 create mode 100644 content/rancher/v2.5/en/backups/classic/_index.md
 rename content/rancher/v2.5/en/{backup-application => backups/classic}/docker/_index.md (100%)
 rename content/rancher/v2.5/en/{backup-application => backups/classic}/docker/docker-backups/_index.md (100%)
 rename content/rancher/v2.5/en/{backup-application => backups/classic}/docker/docker-restore/_index.md (100%)
 rename content/rancher/v2.5/en/{backup-application => backups/classic}/special-scenarios/_index.md (100%)
 create mode 100644 content/rancher/v2.5/en/backups/normal/_index.md
 delete mode 100644 content/rancher/v2.5/en/disaster-recovery/_index.md
 rename content/rancher/v2.5/en/{applications => }/ecm/_index.md (99%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/_index.md (99%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/ad/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/azure-ad/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/freeipa/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/github/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/google/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/keycloak/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/local/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/microsoft-adfs/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/okta/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/openldap/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/openldap/openldap-config/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/ping-federate/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/shibboleth/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/shibboleth/about/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/authentication/user-groups/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/add-users-to-cluster/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/default-custom-roles/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/locked-roles/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/mcm/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/mcm/ace/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/mcm/custom-global-roles/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/mcm/global-permissions/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/mcm/kubectl/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/access-control/rbac/mcm/project-members/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/backing-up-a-cluster/_index.md (100%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/_index.md (99%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/mcm/_index.md (100%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/mcm/architecture-recommendations/_index.md (100%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/mcm/containers/_index.md (100%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/mcm/deployment-strategies/_index.md (100%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/mcm/deployment-types/_index.md (100%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/mcm/management/_index.md (100%)
 rename content/rancher/v2.5/en/{ => ecm}/best-practices/rancher-server/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/cloning-clusters/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/cluster-configuration/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/config-private-registry/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/disconnecting-nodes/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/drivers/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/drivers/cluster-drivers/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/drivers/node-drivers/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/feature-flags/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/feature-flags/enable-not-default-storage-drivers/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/feature-flags/istio-virtual-service-ui/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/globaldns/_index.md (99%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/cloud-credentials/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/cloud-providers/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/cloud-providers/amazon/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/cloud-providers/azure/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/cloud-providers/gce/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/node-templates/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/infrastructure/nodes/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/k8s-metadata/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/pod-security-policies-in-projects/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/pod-security-policies/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/projects-and-namespaces/_index.md (99%)
 rename content/rancher/v2.5/en/{applications => }/ecm/requirements/_index.md (99%)
 rename content/rancher/v2.5/en/{applications => }/ecm/requirements/ports/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/restoring-from-backup/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/applying-templates/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/creating-and-revising/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/creator-permissions/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/enforcement/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/example-scenarios/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/example-yaml/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/overrides/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/rke-templates-and-hardware/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/rke-templates/template-access-and-sharing/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/cluster-capabilities-table/index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/imported-clusters/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/imported-clusters/eks/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/imported-clusters/k3s/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/production-checklist/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/upgrading-kubernetes/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/upgrading-mcm/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/ecm/upgrading-mcm/rollbacks/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/_index.md (75%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/chart-options/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/choosing-version/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/helm-version/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/advanced/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/advanced/api-audit-log/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/advanced/arm64-platform/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/advanced/etcd/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/advanced/firewall/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/air-gap/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/air-gap/install-rancher/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/air-gap/local-system-charts/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/air-gap/populate-private-registry/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/air-gap/prepare-registry/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/encryption/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/encryption/custom-ca-root-certificate/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/encryption/tls-secrets/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/encryption/tls-settings/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/encryption/upgrading-cert-manager/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/ha-RKE/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/ha-RKE2/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/how-ha-works/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/single-node-docker/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/single-node-docker/advanced/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/single-node-docker/installing-docker/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/single-node-docker/proxy/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/installation/resources/single-node-docker/single-node-install-external-lb/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/upgrade/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-helm-install-upgrade => install-rancher-on-k8s}/upgrade/rollbacks/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-cli-install-upgrade => install-rancher-on-linux}/_index.md (68%)
 rename content/rancher/v2.5/en/{rancher-cli-install-upgrade => install-rancher-on-linux}/installation/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-cli-install-upgrade => install-rancher-on-linux}/upgrade/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-cli-install-upgrade => install-rancher-on-linux}/upgrade/cluster-upgrade/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-cli-install-upgrade => install-rancher-on-linux}/upgrade/cluster-upgrade/woker-node-upgrade/_index.md (100%)
 rename content/rancher/v2.5/en/{rancher-cli-install-upgrade => install-rancher-on-linux}/upgrade/image-upgrade/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/istio/_index.md (99%)
 create mode 100644 content/rancher/v2.5/en/istio/classic/_index.md
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/disabling-istio/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/rbac/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/release-notes/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/resources/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/deploy-workloads/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/enable-istio-in-cluster/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/enable-istio-in-namespace/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/gateway/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/node-selectors/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/set-up-traffic-management/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/istio => istio/classic}/setup/view-traffic/_index.md (100%)
 create mode 100644 content/rancher/v2.5/en/istio/normal/_index.md
 rename content/rancher/v2.5/en/{applications => }/logging/_index.md (99%)
 create mode 100644 content/rancher/v2.5/en/logging/classic/_index.md
 rename content/rancher/v2.5/en/{applications/logging => logging/classic}/elasticsearch/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/logging => logging/classic}/fluentd/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/logging => logging/classic}/kafka/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/logging => logging/classic}/splunk/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/logging => logging/classic}/syslog/_index.md (100%)
 create mode 100644 content/rancher/v2.5/en/logging/normal/_index.md
 rename content/rancher/v2.5/en/{applications => }/longhorn-storage/_index.md (85%)
 create mode 100644 content/rancher/v2.5/en/longhorn-storage/classic/_index.md
 create mode 100644 content/rancher/v2.5/en/longhorn-storage/normal/_index.md
 rename content/rancher/v2.5/en/{applications => }/managing-applications/_index.md (99%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/creating-apps/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/creating-custom-libraries/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/enabling-builtin-libraries/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/launching-apps/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/library-config/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/managing-apps/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/multi-cluster-apps/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/managing-applications/tutorial/_index.md (100%)
 rename content/rancher/v2.5/en/{applications => }/monitoring/_index.md (99%)
 create mode 100644 content/rancher/v2.5/en/monitoring/classic/_index.md
 rename content/rancher/v2.5/en/{applications/monitoring => monitoring/classic}/alerts/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/monitoring => monitoring/classic}/alerts/default-alerts/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/monitoring => monitoring/classic}/cluster-metrics/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/monitoring => monitoring/classic}/custom-metrics/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/monitoring => monitoring/classic}/expression/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/monitoring => monitoring/classic}/prometheus/_index.md (100%)
 rename content/rancher/v2.5/en/{applications/monitoring => monitoring/classic}/viewing-metrics/_index.md (100%)
 create mode 100644 content/rancher/v2.5/en/monitoring/normal/_index.md
 create mode 100644 content/rancher/v2.5/en/notifiers/_index.md
 rename content/rancher/v2.5/en/{applications/notifiers => notifiers/classic}/_index.md (99%)
 create mode 100644 content/rancher/v2.5/en/notifiers/normal/_index.md
 create mode 100644 content/rancher/v2.5/en/opa-gatekeper/_index.md
 rename content/rancher/v2.5/en/{applications/opa-gatekeper => opa-gatekeper/classic}/_index.md (98%)
 create mode 100644 content/rancher/v2.5/en/opa-gatekeper/normal/_index.md

diff --git a/content/rancher/v2.5/en/api/_index.md b/content/rancher/v2.5/en/api/_index.md
index b2f9e84816d..f873346680c 100644
--- a/content/rancher/v2.5/en/api/_index.md
+++ b/content/rancher/v2.5/en/api/_index.md
@@ -1,6 +1,6 @@
 ---
 title: API
-weight: 7500
+weight: 19
 ---
 
 ## How to use the API
diff --git a/content/rancher/v2.5/en/applications/_index.md b/content/rancher/v2.5/en/applications/_index.md
deleted file mode 100644
index 8338db51a64..00000000000
--- a/content/rancher/v2.5/en/applications/_index.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: Applications
-weight: 3000
----
-
-Rancher contains a variety of tools that aren't included in Kubernetes to assist in your DevOps operations. Rancher can integrate with external services to help your clusters run more efficiently. Tools are divided into following categories:
-
-<!-- TOC -->
-
-- [Notifiers and Alerts](#notifiers-and-alerts)
-- [Logging](#logging)
-- [Monitoring](#monitoring)
-- [Istio](#istio)
-- [OPA Gatekeeper](#opa-gatekeeper)
-
-<!-- /TOC -->
-
-## Notifiers and Alerts
-
-Notifiers and alerts are two features that work together to inform you of events in the Rancher system.
-
-[Notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action. Notifications can be sent with Slack, email, PagerDuty, WeChat, and webhooks.
-
-[Alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts) are rules that trigger those notifications. Before you can receive alerts, you must configure one or more notifier in Rancher. The scope for alerts can be set at either the cluster or project level.
-
-## Logging
-
-Logging is helpful because it allows you to:
-
-- Capture and analyze the state of your cluster
-- Look for trends in your environment
-- Save your logs to a safe location outside of your cluster
-- Stay informed of events like a container crashing, a pod eviction, or a node dying
-- More easily debugg and troubleshoot problems
-
-Rancher can integrate with Elasticsearch, splunk, kafka, syslog, and fluentd.
-
-For details, refer to the [logging section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging)
-
-## Monitoring
-
-_Available as of v2.2.0_
-
-Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring)
-
-## Istio
-
- [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices. For details on how to enable Istio in Rancher, refer to the [Istio section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio)
-
-## OPA Gatekeeper
-
- [OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is an open-source project that provides integration between OPA and Kubernetes to provide policy control via admission controller webhooks. For details on how to enable Gatekeeper in Rancher, refer to the [OPA Gatekeeper section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/opa-gatekeeper)
diff --git a/content/rancher/v2.5/en/applications/backup-restore/_index.md b/content/rancher/v2.5/en/applications/backup-restore/_index.md
deleted file mode 100644
index 954dfb2947e..00000000000
--- a/content/rancher/v2.5/en/applications/backup-restore/_index.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: Back up and Restore Applications
-weight: 2
----
-
-> This page is under construction.
-
-In this section, you'll learn how to create additional backup templates for the backup/restore application so that any Kubernetes application can be backed up and restored.
-
-For information about how to backup and restore Rancher, refer to [this section.](../../backup-restore)
diff --git a/content/rancher/v2.5/en/backup-application/_index.md b/content/rancher/v2.5/en/backups/_index.md
similarity index 52%
rename from content/rancher/v2.5/en/backup-application/_index.md
rename to content/rancher/v2.5/en/backups/_index.md
index 51b16aa65fb..595fdeb458f 100644
--- a/content/rancher/v2.5/en/backup-application/_index.md
+++ b/content/rancher/v2.5/en/backups/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Backups and Disaster Recovery
-weight: 200
+weight: 8
 ---
 
 > This section is under construction.
@@ -12,10 +12,3 @@ To protect yourself from a disaster scenario, you should create backups on a reg
 We recommend using the backup/restore application to back up Rancher and to restore it from backup.
 
 The Helm chart for the application is available as in Rancher. After you have enabled the application, you will be able to use backup templates for Rancher, Fleet, and the Enterprise Cluster Manager.
-
-### Special Scenarios for Rollbacks
-
-Because of the changes necessary to address [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321), special steps are necessary if the user wants to roll back to a previous version of Rancher where this vulnerability exists, so they are needed for these situations:
-
-- Rolling back from v2.1.6+ to any version between v2.1.0 - v2.1.5 or v2.0.0 - v2.0.10.
-- Rolling back from v2.0.11+ to any version between v2.0.0 - v2.0.10.  
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/backups/classic/_index.md b/content/rancher/v2.5/en/backups/classic/_index.md
new file mode 100644
index 00000000000..a254667133c
--- /dev/null
+++ b/content/rancher/v2.5/en/backups/classic/_index.md
@@ -0,0 +1,6 @@
+---
+title: Classic
+weight: 2
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/backup-application/docker/_index.md b/content/rancher/v2.5/en/backups/classic/docker/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backup-application/docker/_index.md
rename to content/rancher/v2.5/en/backups/classic/docker/_index.md
diff --git a/content/rancher/v2.5/en/backup-application/docker/docker-backups/_index.md b/content/rancher/v2.5/en/backups/classic/docker/docker-backups/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backup-application/docker/docker-backups/_index.md
rename to content/rancher/v2.5/en/backups/classic/docker/docker-backups/_index.md
diff --git a/content/rancher/v2.5/en/backup-application/docker/docker-restore/_index.md b/content/rancher/v2.5/en/backups/classic/docker/docker-restore/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backup-application/docker/docker-restore/_index.md
rename to content/rancher/v2.5/en/backups/classic/docker/docker-restore/_index.md
diff --git a/content/rancher/v2.5/en/backup-application/special-scenarios/_index.md b/content/rancher/v2.5/en/backups/classic/special-scenarios/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backup-application/special-scenarios/_index.md
rename to content/rancher/v2.5/en/backups/classic/special-scenarios/_index.md
diff --git a/content/rancher/v2.5/en/backups/normal/_index.md b/content/rancher/v2.5/en/backups/normal/_index.md
new file mode 100644
index 00000000000..5f771ff0de7
--- /dev/null
+++ b/content/rancher/v2.5/en/backups/normal/_index.md
@@ -0,0 +1,6 @@
+---
+title: Normal
+weight: 1
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cli/_index.md b/content/rancher/v2.5/en/cli/_index.md
index 1263c61b2fb..6dafdd1aedd 100644
--- a/content/rancher/v2.5/en/cli/_index.md
+++ b/content/rancher/v2.5/en/cli/_index.md
@@ -3,7 +3,7 @@ title: The Rancher Command Line Interface
 description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI
 metaTitle: "Using the Rancher Command Line Interface "
 metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI"
-weight: 6000
+weight: 16
 ---
 
 The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI.
diff --git a/content/rancher/v2.5/en/cluster-explorer/_index.md b/content/rancher/v2.5/en/cluster-explorer/_index.md
index 12bd4726e82..dc57d68980d 100644
--- a/content/rancher/v2.5/en/cluster-explorer/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Cluster Explorer
-weight: 2005
+weight: 5
 ---
 
 > This section is under construction.
diff --git a/content/rancher/v2.5/en/contributing/_index.md b/content/rancher/v2.5/en/contributing/_index.md
index fd43236721f..69c09d3974a 100644
--- a/content/rancher/v2.5/en/contributing/_index.md
+++ b/content/rancher/v2.5/en/contributing/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Contributing to Rancher
-weight: 18000
+weight: 22
 ---
 
 This section explains the repositories used for Rancher, how to build the repositories, and what information to include when you file an issue.
diff --git a/content/rancher/v2.5/en/disaster-recovery/_index.md b/content/rancher/v2.5/en/disaster-recovery/_index.md
deleted file mode 100644
index 359b1e7010e..00000000000
--- a/content/rancher/v2.5/en/disaster-recovery/_index.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Disaster Recovery
-weight: 3
----
-
-> This page is under construction.
-
-This section applies to Rancher installations in which the underlying Kubernetes cluster was created with the Rancher CLI.
-
-We recommend using the backup/restore application to back up Rancher and to restore it from backup.
-
-The Helm chart for the application is available as in Rancher. After you have enabled the application, you will be able to use backup templates for apps such as Rancher, Fleet, and the Enterprise Cluster Manager. Then apps can be restored from Kubernetes custom resources.
diff --git a/content/rancher/v2.5/en/applications/ecm/_index.md b/content/rancher/v2.5/en/ecm/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/ecm/_index.md
rename to content/rancher/v2.5/en/ecm/_index.md
index 8c8ef5c7329..b4e79cca68c 100644
--- a/content/rancher/v2.5/en/applications/ecm/_index.md
+++ b/content/rancher/v2.5/en/ecm/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Enterprise Cluster Manager
-weight: 2
+weight: 6
 ---
 
 After installation, the [system administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) should configure Rancher to configure authentication, authorization, security, default settings, security policies, drivers and global DNS entries.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/_index.md b/content/rancher/v2.5/en/ecm/access-control/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/ecm/access-control/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/_index.md
index 748cefa2ec1..199a0368e3f 100644
--- a/content/rancher/v2.5/en/applications/ecm/access-control/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Access Control
-weight: 300
+weight: 1
 ---
 
 > This section is under construction.
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ad/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/ad/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/ad/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/ad/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/azure-ad/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/azure-ad/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/freeipa/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/freeipa/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/github/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/github/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/github/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/github/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/google/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/google/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/keycloak/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/keycloak/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/local/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/local/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/local/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/local/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/okta/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/okta/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/openldap-config/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/openldap-config/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/openldap/openldap-config/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/openldap/openldap-config/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/ping-federate/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/ping-federate/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/about/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/shibboleth/about/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/authentication/user-groups/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/authentication/user-groups/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/add-users-to-cluster/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/add-users-to-cluster/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/add-users-to-cluster/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/add-users-to-cluster/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/default-custom-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/default-custom-roles/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/locked-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/locked-roles/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/locked-roles/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/locked-roles/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/mcm/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/ace/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/ace/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/ace/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/mcm/ace/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/custom-global-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/global-permissions/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/global-permissions/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/kubectl/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/kubectl/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/kubectl/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/mcm/kubectl/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/project-members/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/project-members/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/access-control/rbac/mcm/project-members/_index.md
rename to content/rancher/v2.5/en/ecm/access-control/rbac/mcm/project-members/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/backing-up-a-cluster/_index.md b/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/backing-up-a-cluster/_index.md
rename to content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
diff --git a/content/rancher/v2.5/en/best-practices/_index.md b/content/rancher/v2.5/en/ecm/best-practices/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/best-practices/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/_index.md
index 41bbb4cc9c4..3c88c0ac9c6 100644
--- a/content/rancher/v2.5/en/best-practices/_index.md
+++ b/content/rancher/v2.5/en/ecm/best-practices/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Best Practices Guide
-weight: 1000
+weight: 3
 ---
 
 The purpose of this section is to consolidate best practices for Rancher implementations. This also includes recommendations for related technologies, such as Kubernetes, Docker, containers, and more. The objective is to improve the outcome of a Rancher implementation using the operational experience of Rancher and its customers.
diff --git a/content/rancher/v2.5/en/best-practices/mcm/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/best-practices/mcm/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/mcm/_index.md
diff --git a/content/rancher/v2.5/en/best-practices/mcm/architecture-recommendations/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/architecture-recommendations/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/best-practices/mcm/architecture-recommendations/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/mcm/architecture-recommendations/_index.md
diff --git a/content/rancher/v2.5/en/best-practices/mcm/containers/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/containers/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/best-practices/mcm/containers/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/mcm/containers/_index.md
diff --git a/content/rancher/v2.5/en/best-practices/mcm/deployment-strategies/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-strategies/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/best-practices/mcm/deployment-strategies/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-strategies/_index.md
diff --git a/content/rancher/v2.5/en/best-practices/mcm/deployment-types/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-types/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/best-practices/mcm/deployment-types/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-types/_index.md
diff --git a/content/rancher/v2.5/en/best-practices/mcm/management/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/management/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/best-practices/mcm/management/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/mcm/management/_index.md
diff --git a/content/rancher/v2.5/en/best-practices/rancher-server/_index.md b/content/rancher/v2.5/en/ecm/best-practices/rancher-server/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/best-practices/rancher-server/_index.md
rename to content/rancher/v2.5/en/ecm/best-practices/rancher-server/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/cloning-clusters/_index.md b/content/rancher/v2.5/en/ecm/cloning-clusters/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/cloning-clusters/_index.md
rename to content/rancher/v2.5/en/ecm/cloning-clusters/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/cluster-configuration/_index.md b/content/rancher/v2.5/en/ecm/cluster-configuration/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/cluster-configuration/_index.md
rename to content/rancher/v2.5/en/ecm/cluster-configuration/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/config-private-registry/_index.md b/content/rancher/v2.5/en/ecm/config-private-registry/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/config-private-registry/_index.md
rename to content/rancher/v2.5/en/ecm/config-private-registry/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/disconnecting-nodes/_index.md b/content/rancher/v2.5/en/ecm/disconnecting-nodes/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/disconnecting-nodes/_index.md
rename to content/rancher/v2.5/en/ecm/disconnecting-nodes/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/drivers/_index.md b/content/rancher/v2.5/en/ecm/drivers/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/drivers/_index.md
rename to content/rancher/v2.5/en/ecm/drivers/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/drivers/cluster-drivers/_index.md b/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/drivers/cluster-drivers/_index.md
rename to content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/drivers/node-drivers/_index.md b/content/rancher/v2.5/en/ecm/drivers/node-drivers/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/drivers/node-drivers/_index.md
rename to content/rancher/v2.5/en/ecm/drivers/node-drivers/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/feature-flags/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/feature-flags/_index.md
rename to content/rancher/v2.5/en/ecm/feature-flags/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/feature-flags/enable-not-default-storage-drivers/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
rename to content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/feature-flags/istio-virtual-service-ui/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/feature-flags/istio-virtual-service-ui/_index.md
rename to content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/globaldns/_index.md b/content/rancher/v2.5/en/ecm/globaldns/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/ecm/globaldns/_index.md
rename to content/rancher/v2.5/en/ecm/globaldns/_index.md
index 5feadfde201..fe1a88a175c 100644
--- a/content/rancher/v2.5/en/applications/ecm/globaldns/_index.md
+++ b/content/rancher/v2.5/en/ecm/globaldns/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Global DNS
-weight: 1
+weight: 100
 ---
 
  > This page is under construction.
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-credentials/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-credentials/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-credentials/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/cloud-credentials/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/amazon/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/amazon/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/amazon/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/amazon/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/azure/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/azure/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/azure/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/azure/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/gce/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/gce/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/cloud-providers/gce/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/gce/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/node-templates/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/node-templates/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/node-templates/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/node-templates/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/infrastructure/nodes/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/infrastructure/nodes/_index.md
rename to content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/k8s-metadata/_index.md b/content/rancher/v2.5/en/ecm/k8s-metadata/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/k8s-metadata/_index.md
rename to content/rancher/v2.5/en/ecm/k8s-metadata/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/pod-security-policies-in-projects/_index.md b/content/rancher/v2.5/en/ecm/pod-security-policies-in-projects/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/pod-security-policies-in-projects/_index.md
rename to content/rancher/v2.5/en/ecm/pod-security-policies-in-projects/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/pod-security-policies/_index.md b/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/pod-security-policies/_index.md
rename to content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/projects-and-namespaces/_index.md b/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/ecm/projects-and-namespaces/_index.md
rename to content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
index 24186743d10..1f42f67b98f 100644
--- a/content/rancher/v2.5/en/applications/ecm/projects-and-namespaces/_index.md
+++ b/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
@@ -1,7 +1,7 @@
 ---
 title: Projects and Kubernetes Namespaces with Rancher
 description: Rancher Projects ease the administrative burden of your cluster and support multi-tenancy. Learn to create projects and divide projects into Kubernetes namespaces
-weight: 2
+weight: 200
 ---
 
 A namespace is a Kubernetes concept that allows a virtual cluster within a cluster, which is useful for dividing the cluster into separate "virtual clusters" that each have their own access control and resource quotas.
diff --git a/content/rancher/v2.5/en/applications/ecm/requirements/_index.md b/content/rancher/v2.5/en/ecm/requirements/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/ecm/requirements/_index.md
rename to content/rancher/v2.5/en/ecm/requirements/_index.md
index dda6af13e32..ab08b4e87b5 100644
--- a/content/rancher/v2.5/en/applications/ecm/requirements/_index.md
+++ b/content/rancher/v2.5/en/ecm/requirements/_index.md
@@ -1,7 +1,7 @@
 ---
 title: Installation Requirements
 description: Learn the node requirements for each node running Rancher server when you’re configuring  Rancher to run either in a Docker or Kubernetes setup
-weight: 1
+weight: 2
 ---
 
 > This section is under construction.
diff --git a/content/rancher/v2.5/en/applications/ecm/requirements/ports/_index.md b/content/rancher/v2.5/en/ecm/requirements/ports/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/requirements/ports/_index.md
rename to content/rancher/v2.5/en/ecm/requirements/ports/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/restoring-from-backup/_index.md b/content/rancher/v2.5/en/ecm/restoring-from-backup/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/restoring-from-backup/_index.md
rename to content/rancher/v2.5/en/ecm/restoring-from-backup/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/applying-templates/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/applying-templates/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/creating-and-revising/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/creating-and-revising/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/creating-and-revising/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/creating-and-revising/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/creator-permissions/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/creator-permissions/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/creator-permissions/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/creator-permissions/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/enforcement/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/enforcement/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/enforcement/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/enforcement/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/example-scenarios/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/example-scenarios/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/example-scenarios/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/example-scenarios/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/example-yaml/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/example-yaml/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/example-yaml/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/example-yaml/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/overrides/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/overrides/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/overrides/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/overrides/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/rke-templates-and-hardware/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/rke-templates-and-hardware/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/rke-templates-and-hardware/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/rke-templates-and-hardware/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/rke-templates/template-access-and-sharing/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/template-access-and-sharing/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/rke-templates/template-access-and-sharing/_index.md
rename to content/rancher/v2.5/en/ecm/rke-templates/template-access-and-sharing/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/cluster-capabilities-table/index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/cluster-capabilities-table/index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/cluster-capabilities-table/index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/cluster-capabilities-table/index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/eks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/eks/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/eks/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/eks/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/k3s/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
rename to content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/upgrading-kubernetes/_index.md b/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/upgrading-kubernetes/_index.md
rename to content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/_index.md b/content/rancher/v2.5/en/ecm/upgrading-mcm/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/upgrading-mcm/_index.md
rename to content/rancher/v2.5/en/ecm/upgrading-mcm/_index.md
diff --git a/content/rancher/v2.5/en/applications/ecm/upgrading-mcm/rollbacks/_index.md b/content/rancher/v2.5/en/ecm/upgrading-mcm/rollbacks/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/ecm/upgrading-mcm/rollbacks/_index.md
rename to content/rancher/v2.5/en/ecm/upgrading-mcm/rollbacks/_index.md
diff --git a/content/rancher/v2.5/en/faq/_index.md b/content/rancher/v2.5/en/faq/_index.md
index 60f260984b5..26fd9dbbeb7 100644
--- a/content/rancher/v2.5/en/faq/_index.md
+++ b/content/rancher/v2.5/en/faq/_index.md
@@ -1,8 +1,6 @@
 ---
 title: FAQ
-weight: 8000
-aliases:
-  - /rancher/v2.x/en/about/
+weight: 20
 ---
 
 This FAQ is a work in progress designed to answers the questions our users most frequently ask about Rancher v2.x.
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
similarity index 75%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
index ff27df91088..c0064e605a9 100644
--- a/content/rancher/v2.5/en/rancher-helm-install-upgrade/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
@@ -1,11 +1,13 @@
 ---
-title: Installing/Upgrading Rancher as a Helm Chart
+title: Installing on a Kubernetes Cluster
 description: Learn how to install Rancher in development and production environments. Read about single node and high availability installation
-weight: 51
+weight: 3
 ---
 
 > This section is under construction.
 
+Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to set up a Rancher Kubernetes cluster that has the Rancher server Helm chart installed.
+
 There are two main ways that Rancher can be installed:
 
 1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/chart-options/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/chart-options/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/chart-options/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/chart-options/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/choosing-version/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/choosing-version/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/choosing-version/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/choosing-version/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/helm-version/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/helm-version/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/helm-version/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/helm-version/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/api-audit-log/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/api-audit-log/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/api-audit-log/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/api-audit-log/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/arm64-platform/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/arm64-platform/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/arm64-platform/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/arm64-platform/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/etcd/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/etcd/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/etcd/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/etcd/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/firewall/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/firewall/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/advanced/firewall/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/firewall/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/install-rancher/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/install-rancher/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/install-rancher/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/install-rancher/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/local-system-charts/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/local-system-charts/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/local-system-charts/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/local-system-charts/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/populate-private-registry/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/populate-private-registry/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/populate-private-registry/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/populate-private-registry/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/prepare-registry/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/prepare-registry/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/air-gap/prepare-registry/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/prepare-registry/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/custom-ca-root-certificate/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/custom-ca-root-certificate/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/custom-ca-root-certificate/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/custom-ca-root-certificate/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-secrets/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-secrets/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-secrets/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-secrets/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-settings/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-settings/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/tls-settings/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-settings/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/upgrading-cert-manager/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/upgrading-cert-manager/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/encryption/upgrading-cert-manager/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/upgrading-cert-manager/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE2/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE2/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/ha-RKE2/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE2/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/how-ha-works/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/how-ha-works/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/how-ha-works/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/how-ha-works/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/advanced/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/advanced/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/advanced/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/advanced/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/installing-docker/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/installing-docker/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/installing-docker/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/installing-docker/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/proxy/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/proxy/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/proxy/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/proxy/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/single-node-install-external-lb/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/single-node-install-external-lb/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/installation/resources/single-node-docker/single-node-install-external-lb/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/single-node-install-external-lb/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
diff --git a/content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/rollbacks/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/rollbacks/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-helm-install-upgrade/upgrade/rollbacks/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/rollbacks/_index.md
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/_index.md
similarity index 68%
rename from content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-linux/_index.md
index 3925d78c71c..ccccc331f0b 100644
--- a/content/rancher/v2.5/en/rancher-cli-install-upgrade/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-linux/_index.md
@@ -1,8 +1,10 @@
 ---
-title: Installing/Upgrading Rancher
-weight: 50
+title: Installing on a Linux OS
+weight: 2
 ---
 
+Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to install Rancher as a Helm chart on an existing Kubernetes cluster, without installing the Rancher Kubernetes distribution.
+
 There are two main ways that Rancher can be installed:
 
 1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/installation/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/installation/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-cli-install-upgrade/installation/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-linux/installation/_index.md
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/_index.md
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/woker-node-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
diff --git a/content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/image-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/image-upgrade/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/rancher-cli-install-upgrade/upgrade/image-upgrade/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-linux/upgrade/image-upgrade/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/_index.md b/content/rancher/v2.5/en/istio/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/istio/_index.md
rename to content/rancher/v2.5/en/istio/_index.md
index a919ab17a40..6bb8cb5b3cb 100644
--- a/content/rancher/v2.5/en/applications/istio/_index.md
+++ b/content/rancher/v2.5/en/istio/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Istio
-weight: 5
+weight: 13
 ---
 
 > This section is under construction.
diff --git a/content/rancher/v2.5/en/istio/classic/_index.md b/content/rancher/v2.5/en/istio/classic/_index.md
new file mode 100644
index 00000000000..a254667133c
--- /dev/null
+++ b/content/rancher/v2.5/en/istio/classic/_index.md
@@ -0,0 +1,6 @@
+---
+title: Classic
+weight: 2
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/istio/disabling-istio/_index.md b/content/rancher/v2.5/en/istio/classic/disabling-istio/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/disabling-istio/_index.md
rename to content/rancher/v2.5/en/istio/classic/disabling-istio/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/rbac/_index.md b/content/rancher/v2.5/en/istio/classic/rbac/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/rbac/_index.md
rename to content/rancher/v2.5/en/istio/classic/rbac/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/release-notes/_index.md b/content/rancher/v2.5/en/istio/classic/release-notes/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/release-notes/_index.md
rename to content/rancher/v2.5/en/istio/classic/release-notes/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/resources/_index.md b/content/rancher/v2.5/en/istio/classic/resources/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/resources/_index.md
rename to content/rancher/v2.5/en/istio/classic/resources/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/_index.md b/content/rancher/v2.5/en/istio/classic/setup/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/deploy-workloads/_index.md b/content/rancher/v2.5/en/istio/classic/setup/deploy-workloads/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/deploy-workloads/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/deploy-workloads/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md b/content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-namespace/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/enable-istio-in-namespace/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-namespace/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/gateway/_index.md b/content/rancher/v2.5/en/istio/classic/setup/gateway/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/gateway/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/gateway/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/node-selectors/_index.md b/content/rancher/v2.5/en/istio/classic/setup/node-selectors/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/node-selectors/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/node-selectors/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/set-up-traffic-management/_index.md b/content/rancher/v2.5/en/istio/classic/setup/set-up-traffic-management/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/set-up-traffic-management/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/set-up-traffic-management/_index.md
diff --git a/content/rancher/v2.5/en/applications/istio/setup/view-traffic/_index.md b/content/rancher/v2.5/en/istio/classic/setup/view-traffic/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/istio/setup/view-traffic/_index.md
rename to content/rancher/v2.5/en/istio/classic/setup/view-traffic/_index.md
diff --git a/content/rancher/v2.5/en/istio/normal/_index.md b/content/rancher/v2.5/en/istio/normal/_index.md
new file mode 100644
index 00000000000..5f771ff0de7
--- /dev/null
+++ b/content/rancher/v2.5/en/istio/normal/_index.md
@@ -0,0 +1,6 @@
+---
+title: Normal
+weight: 1
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/logging/_index.md b/content/rancher/v2.5/en/logging/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/logging/_index.md
rename to content/rancher/v2.5/en/logging/_index.md
index 2fd4fd88181..fe445dc9709 100644
--- a/content/rancher/v2.5/en/applications/logging/_index.md
+++ b/content/rancher/v2.5/en/logging/_index.md
@@ -1,8 +1,9 @@
 ---
 title: Rancher Integration with Logging Services
+shortTitle: Logging
 description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster.
 metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
-weight: 3
+weight: 9
 ---
 
 Logging is helpful because it allows you to:
diff --git a/content/rancher/v2.5/en/logging/classic/_index.md b/content/rancher/v2.5/en/logging/classic/_index.md
new file mode 100644
index 00000000000..6583bfcdc70
--- /dev/null
+++ b/content/rancher/v2.5/en/logging/classic/_index.md
@@ -0,0 +1,4 @@
+---
+title: Classic
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/logging/elasticsearch/_index.md b/content/rancher/v2.5/en/logging/classic/elasticsearch/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/logging/elasticsearch/_index.md
rename to content/rancher/v2.5/en/logging/classic/elasticsearch/_index.md
diff --git a/content/rancher/v2.5/en/applications/logging/fluentd/_index.md b/content/rancher/v2.5/en/logging/classic/fluentd/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/logging/fluentd/_index.md
rename to content/rancher/v2.5/en/logging/classic/fluentd/_index.md
diff --git a/content/rancher/v2.5/en/applications/logging/kafka/_index.md b/content/rancher/v2.5/en/logging/classic/kafka/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/logging/kafka/_index.md
rename to content/rancher/v2.5/en/logging/classic/kafka/_index.md
diff --git a/content/rancher/v2.5/en/applications/logging/splunk/_index.md b/content/rancher/v2.5/en/logging/classic/splunk/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/logging/splunk/_index.md
rename to content/rancher/v2.5/en/logging/classic/splunk/_index.md
diff --git a/content/rancher/v2.5/en/applications/logging/syslog/_index.md b/content/rancher/v2.5/en/logging/classic/syslog/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/logging/syslog/_index.md
rename to content/rancher/v2.5/en/logging/classic/syslog/_index.md
diff --git a/content/rancher/v2.5/en/logging/normal/_index.md b/content/rancher/v2.5/en/logging/normal/_index.md
new file mode 100644
index 00000000000..5f771ff0de7
--- /dev/null
+++ b/content/rancher/v2.5/en/logging/normal/_index.md
@@ -0,0 +1,6 @@
+---
+title: Normal
+weight: 1
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/longhorn-storage/_index.md b/content/rancher/v2.5/en/longhorn-storage/_index.md
similarity index 85%
rename from content/rancher/v2.5/en/applications/longhorn-storage/_index.md
rename to content/rancher/v2.5/en/longhorn-storage/_index.md
index 31899c90ba1..6fa8ec6a750 100644
--- a/content/rancher/v2.5/en/applications/longhorn-storage/_index.md
+++ b/content/rancher/v2.5/en/longhorn-storage/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Longhorn Storage
-weight: 10
+weight: 14
 ---
 
 > This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/longhorn-storage/classic/_index.md b/content/rancher/v2.5/en/longhorn-storage/classic/_index.md
new file mode 100644
index 00000000000..6583bfcdc70
--- /dev/null
+++ b/content/rancher/v2.5/en/longhorn-storage/classic/_index.md
@@ -0,0 +1,4 @@
+---
+title: Classic
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/longhorn-storage/normal/_index.md b/content/rancher/v2.5/en/longhorn-storage/normal/_index.md
new file mode 100644
index 00000000000..e49a484e8b1
--- /dev/null
+++ b/content/rancher/v2.5/en/longhorn-storage/normal/_index.md
@@ -0,0 +1,4 @@
+---
+title: Normal
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/managing-applications/_index.md b/content/rancher/v2.5/en/managing-applications/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/managing-applications/_index.md
rename to content/rancher/v2.5/en/managing-applications/_index.md
index 70120ac4e64..808c3bf7ea6 100644
--- a/content/rancher/v2.5/en/applications/managing-applications/_index.md
+++ b/content/rancher/v2.5/en/managing-applications/_index.md
@@ -1,7 +1,7 @@
 ---
 title: Managing Applications
 description: Rancher enables the use of catalogs to repeatedly deploy applications easily. Catalogs are GitHub or Helm Chart repositories filled with deployment-ready apps.
-weight: 1
+weight: 7
 ---
 
 > This section is under construction.
diff --git a/content/rancher/v2.5/en/applications/managing-applications/creating-apps/_index.md b/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/creating-apps/_index.md
rename to content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
diff --git a/content/rancher/v2.5/en/applications/managing-applications/creating-custom-libraries/_index.md b/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/creating-custom-libraries/_index.md
rename to content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
diff --git a/content/rancher/v2.5/en/applications/managing-applications/enabling-builtin-libraries/_index.md b/content/rancher/v2.5/en/managing-applications/enabling-builtin-libraries/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/enabling-builtin-libraries/_index.md
rename to content/rancher/v2.5/en/managing-applications/enabling-builtin-libraries/_index.md
diff --git a/content/rancher/v2.5/en/applications/managing-applications/launching-apps/_index.md b/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/launching-apps/_index.md
rename to content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
diff --git a/content/rancher/v2.5/en/applications/managing-applications/library-config/_index.md b/content/rancher/v2.5/en/managing-applications/library-config/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/library-config/_index.md
rename to content/rancher/v2.5/en/managing-applications/library-config/_index.md
diff --git a/content/rancher/v2.5/en/applications/managing-applications/managing-apps/_index.md b/content/rancher/v2.5/en/managing-applications/managing-apps/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/managing-apps/_index.md
rename to content/rancher/v2.5/en/managing-applications/managing-apps/_index.md
diff --git a/content/rancher/v2.5/en/applications/managing-applications/multi-cluster-apps/_index.md b/content/rancher/v2.5/en/managing-applications/multi-cluster-apps/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/multi-cluster-apps/_index.md
rename to content/rancher/v2.5/en/managing-applications/multi-cluster-apps/_index.md
diff --git a/content/rancher/v2.5/en/applications/managing-applications/tutorial/_index.md b/content/rancher/v2.5/en/managing-applications/tutorial/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/managing-applications/tutorial/_index.md
rename to content/rancher/v2.5/en/managing-applications/tutorial/_index.md
diff --git a/content/rancher/v2.5/en/applications/monitoring/_index.md b/content/rancher/v2.5/en/monitoring/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/monitoring/_index.md
rename to content/rancher/v2.5/en/monitoring/_index.md
index 2891e6322ee..0c5e3944cab 100644
--- a/content/rancher/v2.5/en/applications/monitoring/_index.md
+++ b/content/rancher/v2.5/en/monitoring/_index.md
@@ -1,7 +1,8 @@
 ---
 title: Integrating Rancher and Prometheus for Cluster Monitoring
+shortTitle: Monitoring
 description: Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Learn about the scope of monitoring and how to enable cluster monitoring
-weight: 4
+weight: 10
 ---
 
 Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
diff --git a/content/rancher/v2.5/en/monitoring/classic/_index.md b/content/rancher/v2.5/en/monitoring/classic/_index.md
new file mode 100644
index 00000000000..a254667133c
--- /dev/null
+++ b/content/rancher/v2.5/en/monitoring/classic/_index.md
@@ -0,0 +1,6 @@
+---
+title: Classic
+weight: 2
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/monitoring/alerts/_index.md b/content/rancher/v2.5/en/monitoring/classic/alerts/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/monitoring/alerts/_index.md
rename to content/rancher/v2.5/en/monitoring/classic/alerts/_index.md
diff --git a/content/rancher/v2.5/en/applications/monitoring/alerts/default-alerts/_index.md b/content/rancher/v2.5/en/monitoring/classic/alerts/default-alerts/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/monitoring/alerts/default-alerts/_index.md
rename to content/rancher/v2.5/en/monitoring/classic/alerts/default-alerts/_index.md
diff --git a/content/rancher/v2.5/en/applications/monitoring/cluster-metrics/_index.md b/content/rancher/v2.5/en/monitoring/classic/cluster-metrics/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/monitoring/cluster-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/classic/cluster-metrics/_index.md
diff --git a/content/rancher/v2.5/en/applications/monitoring/custom-metrics/_index.md b/content/rancher/v2.5/en/monitoring/classic/custom-metrics/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/monitoring/custom-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/classic/custom-metrics/_index.md
diff --git a/content/rancher/v2.5/en/applications/monitoring/expression/_index.md b/content/rancher/v2.5/en/monitoring/classic/expression/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/monitoring/expression/_index.md
rename to content/rancher/v2.5/en/monitoring/classic/expression/_index.md
diff --git a/content/rancher/v2.5/en/applications/monitoring/prometheus/_index.md b/content/rancher/v2.5/en/monitoring/classic/prometheus/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/monitoring/prometheus/_index.md
rename to content/rancher/v2.5/en/monitoring/classic/prometheus/_index.md
diff --git a/content/rancher/v2.5/en/applications/monitoring/viewing-metrics/_index.md b/content/rancher/v2.5/en/monitoring/classic/viewing-metrics/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/applications/monitoring/viewing-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/classic/viewing-metrics/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/normal/_index.md b/content/rancher/v2.5/en/monitoring/normal/_index.md
new file mode 100644
index 00000000000..5f771ff0de7
--- /dev/null
+++ b/content/rancher/v2.5/en/monitoring/normal/_index.md
@@ -0,0 +1,6 @@
+---
+title: Normal
+weight: 1
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/notifiers/_index.md b/content/rancher/v2.5/en/notifiers/_index.md
new file mode 100644
index 00000000000..23534527758
--- /dev/null
+++ b/content/rancher/v2.5/en/notifiers/_index.md
@@ -0,0 +1,8 @@
+---
+title: Notifiers
+weight: 11
+---
+
+Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action.
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/applications/notifiers/_index.md b/content/rancher/v2.5/en/notifiers/classic/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/applications/notifiers/_index.md
rename to content/rancher/v2.5/en/notifiers/classic/_index.md
index c5860f0c33e..2f7aba44fad 100644
--- a/content/rancher/v2.5/en/applications/notifiers/_index.md
+++ b/content/rancher/v2.5/en/notifiers/classic/_index.md
@@ -1,6 +1,6 @@
 ---
-title: Notifiers
-weight: 1
+title: Classic
+weight: 2
 ---
 
 Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action.
diff --git a/content/rancher/v2.5/en/notifiers/normal/_index.md b/content/rancher/v2.5/en/notifiers/normal/_index.md
new file mode 100644
index 00000000000..e49a484e8b1
--- /dev/null
+++ b/content/rancher/v2.5/en/notifiers/normal/_index.md
@@ -0,0 +1,4 @@
+---
+title: Normal
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/opa-gatekeper/_index.md b/content/rancher/v2.5/en/opa-gatekeper/_index.md
new file mode 100644
index 00000000000..cd78f7c4a1d
--- /dev/null
+++ b/content/rancher/v2.5/en/opa-gatekeper/_index.md
@@ -0,0 +1,6 @@
+---
+title: OPA Gatekeeper
+weight: 12
+---
+
+> This page is under construction.
diff --git a/content/rancher/v2.5/en/applications/opa-gatekeper/_index.md b/content/rancher/v2.5/en/opa-gatekeper/classic/_index.md
similarity index 98%
rename from content/rancher/v2.5/en/applications/opa-gatekeper/_index.md
rename to content/rancher/v2.5/en/opa-gatekeper/classic/_index.md
index d4c206f510d..d66ba643887 100644
--- a/content/rancher/v2.5/en/applications/opa-gatekeper/_index.md
+++ b/content/rancher/v2.5/en/opa-gatekeper/classic/_index.md
@@ -1,9 +1,8 @@
 ---
-title: OPA Gatekeeper
-weight: 1
+title: Classic
+weight: 2
 ---
 
-> This page is under construction.
 
 To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. 
 
diff --git a/content/rancher/v2.5/en/opa-gatekeper/normal/_index.md b/content/rancher/v2.5/en/opa-gatekeper/normal/_index.md
new file mode 100644
index 00000000000..e49a484e8b1
--- /dev/null
+++ b/content/rancher/v2.5/en/opa-gatekeper/normal/_index.md
@@ -0,0 +1,4 @@
+---
+title: Normal
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/security/_index.md b/content/rancher/v2.5/en/security/_index.md
index d0b2dd70089..f6dab0d5c3b 100644
--- a/content/rancher/v2.5/en/security/_index.md
+++ b/content/rancher/v2.5/en/security/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Security
-weight: 7505
+weight: 15
 ---
 
 <table width="100%">
diff --git a/content/rancher/v2.5/en/system-tools/_index.md b/content/rancher/v2.5/en/system-tools/_index.md
index 54bf292d186..9707d6521e2 100644
--- a/content/rancher/v2.5/en/system-tools/_index.md
+++ b/content/rancher/v2.5/en/system-tools/_index.md
@@ -1,6 +1,6 @@
 ---
 title: System Tools
-weight: 6001
+weight: 17
 ---
 
 System Tools is a tool to perform operational tasks on [Rancher launched RKE Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters or [installations of Rancher on an RKE cluster.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/) The tasks include:
diff --git a/content/rancher/v2.5/en/troubleshooting/_index.md b/content/rancher/v2.5/en/troubleshooting/_index.md
index edb5fb4f061..2e21c579727 100644
--- a/content/rancher/v2.5/en/troubleshooting/_index.md
+++ b/content/rancher/v2.5/en/troubleshooting/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Troubleshooting
-weight: 8100
+weight: 21
 ---
 
 This section contains information to help you troubleshoot issues when using Rancher.
diff --git a/content/rancher/v2.5/en/user-preferences/_index.md b/content/rancher/v2.5/en/user-preferences/_index.md
index 4768b7d25b0..2695a5a3129 100644
--- a/content/rancher/v2.5/en/user-preferences/_index.md
+++ b/content/rancher/v2.5/en/user-preferences/_index.md
@@ -1,6 +1,6 @@
 ---
 title: User Preferences
-weight: 7000
+weight: 18
 ---
 
 > This page is under construction.

From 22c0fb0bf5aad1f09262ac74c2d52dd7274f6974 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 31 Jul 2020 16:00:45 -0700
Subject: [PATCH 185/265] Update Rancher v2.5 docs from feedback

---
 .../v2.5/en/{istio/classic => backups/legacy}/_index.md     | 2 +-
 .../v2.5/en/backups/{classic => legacy}/docker/_index.md    | 0
 .../{classic => legacy}/docker/docker-backups/_index.md     | 0
 .../{classic => legacy}/docker/docker-restore/_index.md     | 0
 .../backups/{classic => legacy}/special-scenarios/_index.md | 0
 content/rancher/v2.5/en/backups/normal/_index.md            | 6 ------
 content/rancher/v2.5/en/install-rancher-on-k8s/_index.md    | 2 +-
 .../{installation => install}/_index.md                     | 2 +-
 .../{installation => install}/chart-options/_index.md       | 0
 .../{installation => install}/choosing-version/_index.md    | 0
 .../{installation => install}/helm-version/_index.md        | 0
 .../{installation => install}/resources/_index.md           | 0
 .../{installation => install}/resources/advanced/_index.md  | 0
 .../resources/advanced/api-audit-log/_index.md              | 0
 .../resources/advanced/arm64-platform/_index.md             | 0
 .../resources/advanced/etcd/_index.md                       | 0
 .../resources/advanced/firewall/_index.md                   | 0
 .../{installation => install}/resources/air-gap/_index.md   | 0
 .../resources/air-gap/install-rancher/_index.md             | 0
 .../resources/air-gap/local-system-charts/_index.md         | 0
 .../resources/air-gap/populate-private-registry/_index.md   | 0
 .../resources/air-gap/prepare-registry/_index.md            | 0
 .../resources/encryption/_index.md                          | 0
 .../encryption/custom-ca-root-certificate/_index.md         | 0
 .../resources/encryption/tls-secrets/_index.md              | 0
 .../resources/encryption/tls-settings/_index.md             | 0
 .../resources/encryption/upgrading-cert-manager/_index.md   | 0
 .../resources/k8s-tutorials/_index.md                       | 0
 .../resources/k8s-tutorials/ha-RKE/_index.md                | 0
 .../resources/k8s-tutorials/ha-RKE2/_index.md               | 0
 .../resources/k8s-tutorials/how-ha-works/_index.md          | 0
 .../k8s-tutorials/infrastructure-tutorials/_index.md        | 0
 .../infrastructure-tutorials/ec2-node/_index.md             | 0
 .../k8s-tutorials/infrastructure-tutorials/nginx/_index.md  | 0
 .../k8s-tutorials/infrastructure-tutorials/nlb/_index.md    | 0
 .../k8s-tutorials/infrastructure-tutorials/rds/_index.md    | 0
 .../resources/single-node-docker/_index.md                  | 0
 .../resources/single-node-docker/advanced/_index.md         | 0
 .../single-node-docker/installing-docker/_index.md          | 0
 .../resources/single-node-docker/proxy/_index.md            | 0
 .../single-node-install-external-lb/_index.md               | 0
 .../v2.5/en/install-rancher-on-k8s/upgrade/_index.md        | 2 +-
 content/rancher/v2.5/en/install-rancher-on-linux/_index.md  | 2 +-
 .../{installation => install}/_index.md                     | 2 +-
 .../v2.5/en/install-rancher-on-linux/upgrade/_index.md      | 2 +-
 .../v2.5/en/{backups/classic => istio/legacy}/_index.md     | 2 +-
 .../en/istio/{classic => legacy}/disabling-istio/_index.md  | 0
 .../v2.5/en/istio/{classic => legacy}/rbac/_index.md        | 0
 .../en/istio/{classic => legacy}/release-notes/_index.md    | 0
 .../v2.5/en/istio/{classic => legacy}/resources/_index.md   | 0
 .../v2.5/en/istio/{classic => legacy}/setup/_index.md       | 0
 .../{classic => legacy}/setup/deploy-workloads/_index.md    | 0
 .../setup/enable-istio-in-cluster/_index.md                 | 0
 .../enable-istio-in-cluster/enable-istio-with-psp/_index.md | 0
 .../setup/enable-istio-in-namespace/_index.md               | 0
 .../en/istio/{classic => legacy}/setup/gateway/_index.md    | 0
 .../{classic => legacy}/setup/node-selectors/_index.md      | 0
 .../setup/set-up-traffic-management/_index.md               | 0
 .../istio/{classic => legacy}/setup/view-traffic/_index.md  | 0
 content/rancher/v2.5/en/istio/normal/_index.md              | 6 ------
 content/rancher/v2.5/en/logging/classic/_index.md           | 2 +-
 content/rancher/v2.5/en/logging/normal/_index.md            | 6 ------
 content/rancher/v2.5/en/longhorn-storage/classic/_index.md  | 4 ----
 content/rancher/v2.5/en/longhorn-storage/legacy/_index.md   | 4 ++++
 content/rancher/v2.5/en/longhorn-storage/normal/_index.md   | 4 ----
 .../v2.5/en/monitoring/{classic => legacy}/_index.md        | 2 +-
 .../v2.5/en/monitoring/{classic => legacy}/alerts/_index.md | 0
 .../{classic => legacy}/alerts/default-alerts/_index.md     | 0
 .../{classic => legacy}/cluster-metrics/_index.md           | 0
 .../monitoring/{classic => legacy}/custom-metrics/_index.md | 0
 .../en/monitoring/{classic => legacy}/expression/_index.md  | 0
 .../v2.5/en/{ => monitoring/legacy}/notifiers/_index.md     | 0
 .../legacy/notifiers/legacy}/_index.md                      | 2 +-
 .../en/monitoring/{classic => legacy}/prometheus/_index.md  | 0
 .../{classic => legacy}/viewing-metrics/_index.md           | 0
 content/rancher/v2.5/en/monitoring/normal/_index.md         | 6 ------
 content/rancher/v2.5/en/notifiers/normal/_index.md          | 4 ----
 .../v2.5/en/opa-gatekeper/{classic => legacy}/_index.md     | 3 +--
 content/rancher/v2.5/en/opa-gatekeper/normal/_index.md      | 4 ----
 79 files changed, 16 insertions(+), 53 deletions(-)
 rename content/rancher/v2.5/en/{istio/classic => backups/legacy}/_index.md (59%)
 rename content/rancher/v2.5/en/backups/{classic => legacy}/docker/_index.md (100%)
 rename content/rancher/v2.5/en/backups/{classic => legacy}/docker/docker-backups/_index.md (100%)
 rename content/rancher/v2.5/en/backups/{classic => legacy}/docker/docker-restore/_index.md (100%)
 rename content/rancher/v2.5/en/backups/{classic => legacy}/special-scenarios/_index.md (100%)
 delete mode 100644 content/rancher/v2.5/en/backups/normal/_index.md
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/_index.md (99%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/chart-options/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/choosing-version/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/helm-version/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/advanced/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/advanced/api-audit-log/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/advanced/arm64-platform/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/advanced/etcd/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/advanced/firewall/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/air-gap/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/air-gap/install-rancher/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/air-gap/local-system-charts/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/air-gap/populate-private-registry/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/air-gap/prepare-registry/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/encryption/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/encryption/custom-ca-root-certificate/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/encryption/tls-secrets/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/encryption/tls-settings/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/encryption/upgrading-cert-manager/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/ha-RKE/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/ha-RKE2/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/how-ha-works/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/infrastructure-tutorials/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/single-node-docker/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/single-node-docker/advanced/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/single-node-docker/installing-docker/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/single-node-docker/proxy/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-k8s/{installation => install}/resources/single-node-docker/single-node-install-external-lb/_index.md (100%)
 rename content/rancher/v2.5/en/install-rancher-on-linux/{installation => install}/_index.md (84%)
 rename content/rancher/v2.5/en/{backups/classic => istio/legacy}/_index.md (71%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/disabling-istio/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/rbac/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/release-notes/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/resources/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/deploy-workloads/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/enable-istio-in-cluster/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/enable-istio-in-namespace/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/gateway/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/node-selectors/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/set-up-traffic-management/_index.md (100%)
 rename content/rancher/v2.5/en/istio/{classic => legacy}/setup/view-traffic/_index.md (100%)
 delete mode 100644 content/rancher/v2.5/en/istio/normal/_index.md
 delete mode 100644 content/rancher/v2.5/en/logging/normal/_index.md
 delete mode 100644 content/rancher/v2.5/en/longhorn-storage/classic/_index.md
 create mode 100644 content/rancher/v2.5/en/longhorn-storage/legacy/_index.md
 delete mode 100644 content/rancher/v2.5/en/longhorn-storage/normal/_index.md
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/_index.md (71%)
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/alerts/_index.md (100%)
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/alerts/default-alerts/_index.md (100%)
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/cluster-metrics/_index.md (100%)
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/custom-metrics/_index.md (100%)
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/expression/_index.md (100%)
 rename content/rancher/v2.5/en/{ => monitoring/legacy}/notifiers/_index.md (100%)
 rename content/rancher/v2.5/en/{notifiers/classic => monitoring/legacy/notifiers/legacy}/_index.md (99%)
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/prometheus/_index.md (100%)
 rename content/rancher/v2.5/en/monitoring/{classic => legacy}/viewing-metrics/_index.md (100%)
 delete mode 100644 content/rancher/v2.5/en/monitoring/normal/_index.md
 delete mode 100644 content/rancher/v2.5/en/notifiers/normal/_index.md
 rename content/rancher/v2.5/en/opa-gatekeper/{classic => legacy}/_index.md (99%)
 delete mode 100644 content/rancher/v2.5/en/opa-gatekeper/normal/_index.md

diff --git a/content/rancher/v2.5/en/istio/classic/_index.md b/content/rancher/v2.5/en/backups/legacy/_index.md
similarity index 59%
rename from content/rancher/v2.5/en/istio/classic/_index.md
rename to content/rancher/v2.5/en/backups/legacy/_index.md
index a254667133c..3845dfe3d96 100644
--- a/content/rancher/v2.5/en/istio/classic/_index.md
+++ b/content/rancher/v2.5/en/backups/legacy/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Classic
+title: Legacy Backup and Restore Docs
 weight: 2
 ---
 
diff --git a/content/rancher/v2.5/en/backups/classic/docker/_index.md b/content/rancher/v2.5/en/backups/legacy/docker/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backups/classic/docker/_index.md
rename to content/rancher/v2.5/en/backups/legacy/docker/_index.md
diff --git a/content/rancher/v2.5/en/backups/classic/docker/docker-backups/_index.md b/content/rancher/v2.5/en/backups/legacy/docker/docker-backups/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backups/classic/docker/docker-backups/_index.md
rename to content/rancher/v2.5/en/backups/legacy/docker/docker-backups/_index.md
diff --git a/content/rancher/v2.5/en/backups/classic/docker/docker-restore/_index.md b/content/rancher/v2.5/en/backups/legacy/docker/docker-restore/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backups/classic/docker/docker-restore/_index.md
rename to content/rancher/v2.5/en/backups/legacy/docker/docker-restore/_index.md
diff --git a/content/rancher/v2.5/en/backups/classic/special-scenarios/_index.md b/content/rancher/v2.5/en/backups/legacy/special-scenarios/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/backups/classic/special-scenarios/_index.md
rename to content/rancher/v2.5/en/backups/legacy/special-scenarios/_index.md
diff --git a/content/rancher/v2.5/en/backups/normal/_index.md b/content/rancher/v2.5/en/backups/normal/_index.md
deleted file mode 100644
index 5f771ff0de7..00000000000
--- a/content/rancher/v2.5/en/backups/normal/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Normal
-weight: 1
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
index c0064e605a9..03c104d537c 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Installing on a Kubernetes Cluster
+title: Install on a Kubernetes Cluster
 description: Learn how to install Rancher in development and production environments. Read about single node and high availability installation
 weight: 3
 ---
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/_index.md
index 2060efc8703..df088c803ec 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Installing the Rancher Helm Chart
+title: Install
 weight: 1
 ---
 
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/chart-options/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/chart-options/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/choosing-version/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/choosing-version/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/choosing-version/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/choosing-version/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/helm-version/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/helm-version/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/helm-version/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/helm-version/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/api-audit-log/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/api-audit-log/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/api-audit-log/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/api-audit-log/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/arm64-platform/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/arm64-platform/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/etcd/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/etcd/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/etcd/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/etcd/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/firewall/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/firewall/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/advanced/firewall/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/firewall/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/install-rancher/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/install-rancher/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/local-system-charts/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/local-system-charts/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/local-system-charts/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/local-system-charts/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/populate-private-registry/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/populate-private-registry/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/prepare-registry/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/prepare-registry/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/air-gap/prepare-registry/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/prepare-registry/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/custom-ca-root-certificate/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/custom-ca-root-certificate/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/custom-ca-root-certificate/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/custom-ca-root-certificate/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-secrets/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-secrets/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-secrets/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-secrets/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-settings/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/tls-settings/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/upgrading-cert-manager/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/upgrading-cert-manager/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/encryption/upgrading-cert-manager/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/upgrading-cert-manager/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE2/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE2/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/ha-RKE2/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE2/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/how-ha-works/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/how-ha-works/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/how-ha-works/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/how-ha-works/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/advanced/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/advanced/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/installing-docker/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/installing-docker/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/installing-docker/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/installing-docker/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/proxy/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/proxy/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/proxy/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/proxy/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/single-node-install-external-lb/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/single-node-install-external-lb/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/install-rancher-on-k8s/installation/resources/single-node-docker/single-node-install-external-lb/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/single-node-install-external-lb/_index.md
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
index c88c0824afb..37c71224458 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Upgrading the Rancher Helm Chart
+title: Upgrade
 weight: 2
 ---
 
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/_index.md
index ccccc331f0b..a39d752685c 100644
--- a/content/rancher/v2.5/en/install-rancher-on-linux/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-linux/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Installing on a Linux OS
+title: Install on a Linux OS
 weight: 2
 ---
 
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/installation/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/install/_index.md
similarity index 84%
rename from content/rancher/v2.5/en/install-rancher-on-linux/installation/_index.md
rename to content/rancher/v2.5/en/install-rancher-on-linux/install/_index.md
index 78532d14a1b..1bb080bd47f 100644
--- a/content/rancher/v2.5/en/install-rancher-on-linux/installation/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-linux/install/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Installing the Rancher Kubernetes Cluster and Helm Chart
+title: Install
 weight: 1
 ---
 
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
index f797f83a0db..ba7375d5f63 100644
--- a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Upgrading the Rancher Kubernetes Cluster and Helm Chart
+title: Upgrade
 weight: 2
 ---
 
diff --git a/content/rancher/v2.5/en/backups/classic/_index.md b/content/rancher/v2.5/en/istio/legacy/_index.md
similarity index 71%
rename from content/rancher/v2.5/en/backups/classic/_index.md
rename to content/rancher/v2.5/en/istio/legacy/_index.md
index a254667133c..9240f82fa7f 100644
--- a/content/rancher/v2.5/en/backups/classic/_index.md
+++ b/content/rancher/v2.5/en/istio/legacy/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Classic
+title: Legacy UI Docs
 weight: 2
 ---
 
diff --git a/content/rancher/v2.5/en/istio/classic/disabling-istio/_index.md b/content/rancher/v2.5/en/istio/legacy/disabling-istio/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/disabling-istio/_index.md
rename to content/rancher/v2.5/en/istio/legacy/disabling-istio/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/rbac/_index.md b/content/rancher/v2.5/en/istio/legacy/rbac/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/rbac/_index.md
rename to content/rancher/v2.5/en/istio/legacy/rbac/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/release-notes/_index.md b/content/rancher/v2.5/en/istio/legacy/release-notes/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/release-notes/_index.md
rename to content/rancher/v2.5/en/istio/legacy/release-notes/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/resources/_index.md b/content/rancher/v2.5/en/istio/legacy/resources/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/resources/_index.md
rename to content/rancher/v2.5/en/istio/legacy/resources/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/deploy-workloads/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/deploy-workloads/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/deploy-workloads/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/deploy-workloads/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/enable-istio-in-namespace/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/gateway/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/gateway/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/gateway/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/gateway/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/node-selectors/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/node-selectors/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/node-selectors/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/node-selectors/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/set-up-traffic-management/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/set-up-traffic-management/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/set-up-traffic-management/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/set-up-traffic-management/_index.md
diff --git a/content/rancher/v2.5/en/istio/classic/setup/view-traffic/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/view-traffic/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/istio/classic/setup/view-traffic/_index.md
rename to content/rancher/v2.5/en/istio/legacy/setup/view-traffic/_index.md
diff --git a/content/rancher/v2.5/en/istio/normal/_index.md b/content/rancher/v2.5/en/istio/normal/_index.md
deleted file mode 100644
index 5f771ff0de7..00000000000
--- a/content/rancher/v2.5/en/istio/normal/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Normal
-weight: 1
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/logging/classic/_index.md b/content/rancher/v2.5/en/logging/classic/_index.md
index 6583bfcdc70..1629da37c2d 100644
--- a/content/rancher/v2.5/en/logging/classic/_index.md
+++ b/content/rancher/v2.5/en/logging/classic/_index.md
@@ -1,4 +1,4 @@
 ---
-title: Classic
+title: Legacy UI Docs
 weight: 2
 ---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/logging/normal/_index.md b/content/rancher/v2.5/en/logging/normal/_index.md
deleted file mode 100644
index 5f771ff0de7..00000000000
--- a/content/rancher/v2.5/en/logging/normal/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Normal
-weight: 1
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/longhorn-storage/classic/_index.md b/content/rancher/v2.5/en/longhorn-storage/classic/_index.md
deleted file mode 100644
index 6583bfcdc70..00000000000
--- a/content/rancher/v2.5/en/longhorn-storage/classic/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Classic
-weight: 2
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/longhorn-storage/legacy/_index.md b/content/rancher/v2.5/en/longhorn-storage/legacy/_index.md
new file mode 100644
index 00000000000..1629da37c2d
--- /dev/null
+++ b/content/rancher/v2.5/en/longhorn-storage/legacy/_index.md
@@ -0,0 +1,4 @@
+---
+title: Legacy UI Docs
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/longhorn-storage/normal/_index.md b/content/rancher/v2.5/en/longhorn-storage/normal/_index.md
deleted file mode 100644
index e49a484e8b1..00000000000
--- a/content/rancher/v2.5/en/longhorn-storage/normal/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Normal
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/monitoring/classic/_index.md b/content/rancher/v2.5/en/monitoring/legacy/_index.md
similarity index 71%
rename from content/rancher/v2.5/en/monitoring/classic/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/_index.md
index a254667133c..9240f82fa7f 100644
--- a/content/rancher/v2.5/en/monitoring/classic/_index.md
+++ b/content/rancher/v2.5/en/monitoring/legacy/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Classic
+title: Legacy UI Docs
 weight: 2
 ---
 
diff --git a/content/rancher/v2.5/en/monitoring/classic/alerts/_index.md b/content/rancher/v2.5/en/monitoring/legacy/alerts/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/classic/alerts/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/alerts/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/classic/alerts/default-alerts/_index.md b/content/rancher/v2.5/en/monitoring/legacy/alerts/default-alerts/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/classic/alerts/default-alerts/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/alerts/default-alerts/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/classic/cluster-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/cluster-metrics/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/classic/cluster-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/cluster-metrics/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/classic/custom-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/custom-metrics/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/classic/custom-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/custom-metrics/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/classic/expression/_index.md b/content/rancher/v2.5/en/monitoring/legacy/expression/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/classic/expression/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/expression/_index.md
diff --git a/content/rancher/v2.5/en/notifiers/_index.md b/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/notifiers/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
diff --git a/content/rancher/v2.5/en/notifiers/classic/_index.md b/content/rancher/v2.5/en/monitoring/legacy/notifiers/legacy/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/notifiers/classic/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/notifiers/legacy/_index.md
index 2f7aba44fad..4ef7026a9ac 100644
--- a/content/rancher/v2.5/en/notifiers/classic/_index.md
+++ b/content/rancher/v2.5/en/monitoring/legacy/notifiers/legacy/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Classic
+title: Legacy UI Docs
 weight: 2
 ---
 
diff --git a/content/rancher/v2.5/en/monitoring/classic/prometheus/_index.md b/content/rancher/v2.5/en/monitoring/legacy/prometheus/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/classic/prometheus/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/prometheus/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/classic/viewing-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/viewing-metrics/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/classic/viewing-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/viewing-metrics/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/normal/_index.md b/content/rancher/v2.5/en/monitoring/normal/_index.md
deleted file mode 100644
index 5f771ff0de7..00000000000
--- a/content/rancher/v2.5/en/monitoring/normal/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Normal
-weight: 1
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/notifiers/normal/_index.md b/content/rancher/v2.5/en/notifiers/normal/_index.md
deleted file mode 100644
index e49a484e8b1..00000000000
--- a/content/rancher/v2.5/en/notifiers/normal/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Normal
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/opa-gatekeper/classic/_index.md b/content/rancher/v2.5/en/opa-gatekeper/legacy/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/opa-gatekeper/classic/_index.md
rename to content/rancher/v2.5/en/opa-gatekeper/legacy/_index.md
index d66ba643887..55103e52eb9 100644
--- a/content/rancher/v2.5/en/opa-gatekeper/classic/_index.md
+++ b/content/rancher/v2.5/en/opa-gatekeper/legacy/_index.md
@@ -1,9 +1,8 @@
 ---
-title: Classic
+title: Legacy UI Docs
 weight: 2
 ---
 
-
 To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. 
 
 OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making.
diff --git a/content/rancher/v2.5/en/opa-gatekeper/normal/_index.md b/content/rancher/v2.5/en/opa-gatekeper/normal/_index.md
deleted file mode 100644
index e49a484e8b1..00000000000
--- a/content/rancher/v2.5/en/opa-gatekeper/normal/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Normal
-weight: 1
----
\ No newline at end of file

From 36fa59cd29cdbe8ad5ad2550caa9506827cdb41c Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 4 Aug 2020 16:14:14 -0700
Subject: [PATCH 186/265] Clean up monitoring docs for Rancher 2.5

---
 .../certificate-rotation/_index.md            |  54 +------
 .../load-balancers/_index.md                  |   2 -
 .../en/cluster-explorer/pipelines/_index.md   |  11 +-
 .../pipelines/config/_index.md                |  15 +-
 .../pipelines/docs-for-v2.0.x/_index.md       |   3 -
 .../pipelines/example-repos/_index.md         |   2 -
 .../pipelines/example/_index.md               |   2 -
 .../project-admin/project-features/_index.md  |   2 -
 .../project-features/alerts/_index.md         |   1 -
 .../project-features/istio/_index.md          |   2 -
 .../project-admin/resource-quotas/_index.md   |   2 -
 .../override-container-default/_index.md      |   4 -
 .../storage/examples/nfs/_index.md            |   2 -
 .../storage/examples/vsphere/_index.md        |   2 -
 .../manage-hpa-with-rancher-ui/_index.md      |   2 -
 content/rancher/v2.5/en/ecm/_index.md         |   4 -
 .../authentication/azure-ad/_index.md         |   2 -
 .../authentication/freeipa/_index.md          |   2 -
 .../authentication/google/_index.md           |   1 -
 .../authentication/keycloak/_index.md         |   1 -
 .../authentication/microsoft-adfs/_index.md   |   1 -
 .../rancher-adfs-setup/_index.md              |   1 -
 .../authentication/okta/_index.md             |   2 -
 .../authentication/openldap/_index.md         |   2 -
 .../authentication/ping-federate/_index.md    |   1 -
 .../authentication/shibboleth/_index.md       |   2 -
 .../authentication/shibboleth/about/_index.md |   2 -
 .../authentication/user-groups/_index.md      |   4 -
 .../rbac/default-custom-roles/_index.md       |   6 -
 .../rbac/mcm/global-permissions/_index.md     |   2 -
 .../en/ecm/backing-up-a-cluster/_index.md     |   6 +-
 .../en/ecm/drivers/cluster-drivers/_index.md  |   2 -
 .../v2.5/en/ecm/feature-flags/_index.md       |   2 -
 .../_index.md                                 |   3 -
 .../istio-virtual-service-ui/_index.md        |   3 -
 .../en/ecm/infrastructure/nodes/_index.md     |   2 -
 .../en/ecm/pod-security-policies/_index.md    |   2 -
 .../en/ecm/projects-and-namespaces/_index.md  |   4 -
 .../applying-templates/_index.md              |   2 -
 .../v2.5/en/ecm/setting-up-k8s/_index.md      |   2 -
 .../hosted-kubernetes-clusters/ack/_index.md  |   2 -
 .../hosted-kubernetes-clusters/aks/_index.md  |   2 -
 .../hosted-kubernetes-clusters/cce/_index.md  |   2 -
 .../hosted-kubernetes-clusters/eks/_index.md  |   2 -
 .../hosted-kubernetes-clusters/gke/_index.md  |   2 -
 .../hosted-kubernetes-clusters/tke/_index.md  |   2 -
 .../imported-clusters/_index.md               |   2 -
 .../cluster-config-reference/_index.md        |   8 --
 .../custom-nodes/agent-options/_index.md      |   3 -
 .../infrastructure-provider/_index.md         |  10 --
 .../infrastructure-provider/azure/_index.md   |   2 -
 .../digital-ocean/_index.md                   |   2 -
 .../infrastructure-provider/vsphere/_index.md |   6 -
 .../provisioning-vsphere-clusters/_index.md   |   2 -
 .../en/ecm/upgrading-kubernetes/_index.md     |   2 -
 .../mcm/networking/cni-providers/_index.md    |   2 -
 .../en/faq/mcm/removing-rancher/_index.md     |   5 -
 .../install/chart-options/_index.md           |  10 +-
 .../advanced/arm64-platform/_index.md         |   2 -
 .../air-gap/install-rancher/_index.md         |   4 +-
 .../populate-private-registry/_index.md       |   2 -
 .../encryption/tls-settings/_index.md         |   2 -
 .../infrastructure-tutorials/nginx/_index.md  |   1 -
 .../single-node-docker/advanced/_index.md     |   2 -
 .../v2.5/en/istio/legacy/resources/_index.md  |   4 -
 content/rancher/v2.5/en/logging/_index.md     | 114 ---------------
 .../rancher/v2.5/en/logging/classic/_index.md |   4 -
 .../rancher/v2.5/en/logging/legacy/_index.md  | 118 ++++++++++++++++
 .../elasticsearch/_index.md                   |   2 -
 .../{classic => legacy}/fluentd/_index.md     |   0
 .../{classic => legacy}/kafka/_index.md       |   2 -
 .../{classic => legacy}/splunk/_index.md      |   3 -
 .../{classic => legacy}/syslog/_index.md      |   2 -
 .../creating-apps/_index.md                   |   2 -
 .../creating-custom-libraries/_index.md       |   5 -
 .../launching-apps/_index.md                  |   4 -
 .../library-config/_index.md                  |   2 -
 .../legacy/{ => alerts}/expression/_index.md  |   0
 .../en/monitoring/legacy/monitoring/_index.md |   4 +
 .../cluster-metrics/_index.md                 |   3 -
 .../{ => monitoring}/custom-metrics/_index.md |   0
 .../{ => monitoring}/prometheus/_index.md     |   3 -
 .../viewing-metrics/_index.md                 |   2 -
 .../en/monitoring/legacy/notifiers/_index.md  | 124 +++++++++++++++-
 .../legacy/notifiers/legacy/_index.md         | 132 ------------------
 content/rancher/v2.5/en/security/_index.md    |   2 -
 86 files changed, 254 insertions(+), 524 deletions(-)
 delete mode 100644 content/rancher/v2.5/en/logging/classic/_index.md
 create mode 100644 content/rancher/v2.5/en/logging/legacy/_index.md
 rename content/rancher/v2.5/en/logging/{classic => legacy}/elasticsearch/_index.md (97%)
 rename content/rancher/v2.5/en/logging/{classic => legacy}/fluentd/_index.md (100%)
 rename content/rancher/v2.5/en/logging/{classic => legacy}/kafka/_index.md (97%)
 rename content/rancher/v2.5/en/logging/{classic => legacy}/splunk/_index.md (97%)
 rename content/rancher/v2.5/en/logging/{classic => legacy}/syslog/_index.md (97%)
 rename content/rancher/v2.5/en/monitoring/legacy/{ => alerts}/expression/_index.md (100%)
 create mode 100644 content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md
 rename content/rancher/v2.5/en/monitoring/legacy/{ => monitoring}/cluster-metrics/_index.md (99%)
 rename content/rancher/v2.5/en/monitoring/legacy/{ => monitoring}/custom-metrics/_index.md (100%)
 rename content/rancher/v2.5/en/monitoring/legacy/{ => monitoring}/prometheus/_index.md (99%)
 rename content/rancher/v2.5/en/monitoring/legacy/{ => monitoring}/viewing-metrics/_index.md (99%)
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/notifiers/legacy/_index.md

diff --git a/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
index 0dff9482b15..8b2d81f49e9 100644
--- a/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
@@ -17,9 +17,7 @@ Certificates can be rotated for the following services:
 - kube-controller-manager
 
 
-### Certificate Rotation in Rancher v2.2.x
-
-_Available as of v2.2.0_
+### Certificate Rotation
 
 Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI.
 
@@ -36,52 +34,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
 
 **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate.
 
-> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters.
-
-
-### Certificate Rotation in Rancher v2.1.x and v2.0.x
-
-_Available as of v2.0.14 and v2.1.9_
-
-Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API.
-
-1. In the **Global** view, navigate to the cluster that you want to rotate certificates.
-
-2. Select the **&#8942; > View in API**.
-
-3. Click on **RotateCertificates**.
-
-4. Click on **Show Request**.
-
-5. Click on **Send Request**.
-
-**Results:** All Kubernetes certificates will be rotated.
-
-### Rotating Expired Certificates After Upgrading Older Rancher Versions
-
-If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation.
-
-1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory:
-
-    ```
-    cd /etc/kubernetes/.tmp
-    ```
-
-    If the certificate is not in the directory, perform the following commands:
-
-    ```
-    cp kube-ca.pem kube-apiserver-requestheader-ca.pem
-    cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem
-    cp kube-apiserver.pem kube-apiserver-proxy-client.pem
-    cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem
-    ```
-
-    If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`:
-
-    ```
-    cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp
-    ```
-
-1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x)
-
-1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy.
\ No newline at end of file
+> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
index 7ae7742018d..1c634dc2342 100644
--- a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
@@ -2,8 +2,6 @@
 title: "Layer 4 and Layer 7 Load Balancing"
 description: "Kubernetes supports load balancing in two ways: Layer-4 Load Balancing and Layer-7 Load Balancing. Learn about the support for each way in different deployments"
 weight: 3041
-aliases:
-  - /rancher/v2.x/en/concepts/load-balancing/
 ---
 Kubernetes supports load balancing in two ways: Layer-4 Load Balancing and Layer-7 Load Balancing.
 
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
index e20e1794245..3d80f3c57ca 100644
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
@@ -1,9 +1,6 @@
 ---
 title: Pipelines
 weight: 3047
-aliases:
-  - /rancher/v2.x/en/tools/pipelines/concepts/
-
 ---
 
 Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users.
@@ -113,8 +110,6 @@ Select your provider's tab below and follow the directions.
 {{% /tab %}}
 {{% tab "GitLab" %}}
 
-_Available as of v2.1.0_
-
 1. From the **Global** view, navigate to the project that you want to configure pipelines.
 
 1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
@@ -133,8 +128,6 @@ _Available as of v2.1.0_
 {{% /tab %}}
 {{% tab "Bitbucket Cloud" %}}
 
-_Available as of v2.2.0_
-
 1. From the **Global** view, navigate to the project that you want to configure pipelines.
 
 1. Select **Tools > Pipelines** in the navigation bar.
@@ -150,8 +143,6 @@ _Available as of v2.2.0_
 {{% /tab %}}
 {{% tab "Bitbucket Server" %}}
 
-_Available as of v2.2.0_
-
 1. From the **Global** view, navigate to the project that you want to configure pipelines.
 
 1. Select **Tools > Pipelines** in the navigation bar.
@@ -210,7 +201,7 @@ Now that repositories are added to your project, you can start configuring the p
 
 1. Select which `branch` to use from the list of branches.
 
-1. _Available as of v2.2.0_ Optional: Set up notifications.
+1. Optional: Set up notifications.
 
 1. Set up the trigger rules for the pipeline.
 
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
index 7443af2daad..3b9547fab67 100644
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
@@ -102,8 +102,6 @@ stages:
 ```
 # Step Type: Build and Publish Images
 
-_Available as of Rancher v2.1.0_
-
 The **Build and Publish Image** step builds and publishes a Docker image. This process requires a Dockerfile in your source code's repository to complete successfully.
 
 The option to publish an image to an insecure registry is not exposed in the UI, but you can specify an environment variable in the YAML that allows you to publish an image insecurely.
@@ -154,8 +152,6 @@ stages:
 
 # Step Type: Publish Catalog Template
 
-_Available as of v2.2.0_
-
 The **Publish Catalog Template** step publishes a version of a catalog app template (i.e. Helm chart) to a [git hosted chart repository]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/). It generates a git commit and pushes it to your chart repository. This process requires a chart folder in your source code's repository and a pre-configured secret in the dedicated pipeline namespace to complete successfully. Any variables in the [pipeline variable substitution reference](#pipeline-variable-substitution-reference) is supported for any file in the chart folder.
 
 ### Configuring Publishing a Catalog Template by UI
@@ -235,8 +231,6 @@ stages:
 
 # Step Type :Deploy Catalog App
 
-_Available as of v2.2.0_
-
 The **Deploy Catalog App** step deploys a catalog app in the project. It will install a new app if it is not present, or upgrade an existing one.
 
 ### Configure Deploying Catalog App by UI
@@ -311,8 +305,6 @@ You can enable notifications to any [notifiers]({{<baseurl>}}/rancher/v2.x/en/cl
 
 ### Configuring Notifications by UI
 
-_Available as of v2.2.0_
-
 1. Within the **Notification** section, turn on notifications by clicking **Enable**.
 
 1. Select the conditions for the notification. You can select to get a notification for the following statuses: `Failed`, `Success`, `Changed`. For example, if you want to receive notifications when an execution fails, select **Failed**.
@@ -324,7 +316,6 @@ _Available as of v2.2.0_
 1. For each recipient, select which notifier type from the dropdown. Based on the type of notifier, you can use the default recipient or override the recipient with a different one. For example, if you have a notifier for _Slack_, you can update which channel to send the notification to. You can add additional notifiers by clicking **Add Recipient**.
 
 ### Configuring Notifications by YAML
-_Available as of v2.2.0_
 
 In the `notification` section, you will provide the following information:
 
@@ -594,8 +585,6 @@ Select the maximum number of pipeline executors. The _executor quota_ decides ho
 
 ### Resource Quota for Executors
 
-_Available as of v2.2.0_
-
 Configure compute resources for Jenkins agent containers. When a pipeline execution is triggered, a build pod is dynamically provisioned to run your CI tasks. Under the hood, A build pod consists of one Jenkins agent container and one container for each pipeline step. You can [manage compute resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) for every containers in the pod.
 
 Edit the **Memory Reservation**, **Memory Limit**, **CPU Reservation** or **CPU Limit**, then click **Update Limit and Reservation**.
@@ -635,9 +624,7 @@ stages:
 
 >**Note:** Rancher sets default compute resources for pipeline steps except for `Build and Publish Images` and `Run Script` steps. You can override the default value by specifying compute resources in the same way.
 
-### Custom CA  
-
-_Available as of v2.2.0_
+### Custom CA
 
 If you want to use a version control provider with a certificate from a custom/internal CA root, the CA root certificates need to be added as part of the version control provider configuration in order for the pipeline build pods to succeed.
 
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
index 412822f0f96..cd6f3c0da1d 100644
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
@@ -1,9 +1,6 @@
 ---
 title: v2.0.x Pipeline Documentation
 weight: 9000
-aliases:
-  - /rancher/v2.x/en/project-admin/tools/pipelines/docs-for-v2.0.x
-  - /rancher/v2.x/en/project-admin/pipelines/docs-for-v2.0.x
 ---
 
 >**Note:** This section describes the pipeline feature as implemented in Rancher v2.0.x. If you are using Rancher v2.1 or later, where pipelines have been significantly improved, please refer to the new documentation for [v2.1 or later]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
index 4b7fddc4b85..2e24fbfeeb1 100644
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Example Repositories
 weight: 500
-aliases:
-  - /rancher/v2.x/en/tools/pipelines/quick-start-guide/
 ---
 
 Rancher ships with several example repositories that you can use to familiarize yourself with pipelines. We recommend configuring and testing the example repository that most resembles your environment before using pipelines with your own repositories in a production environment. Use this example repository as a sandbox for repo configuration, build demonstration, etc. Rancher includes example repositories for:
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
index 512c87af456..28cad6e2b8f 100644
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Example YAML File
 weight: 501
-aliases:
-  - /rancher/v2.x/en/tools/pipelines/reference/
 ---
 
 Pipelines can be configured either through the UI or using a yaml file in the repository, i.e. `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
index f4ad3fa8294..4f1497b3a1b 100644
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
@@ -38,6 +38,4 @@ For details, refer to the [logging section.]({{<baseurl>}}/rancher/v2.x/en/clust
 
 ## Monitoring
 
-_Available as of v2.2.0_
-
 Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring)
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
index 5d5f0c867ac..0baf954ee0a 100644
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
@@ -121,7 +121,6 @@ This alert type monitors for the availability of all workloads marked with tags
 {{% /accordion %}}
 {{% accordion id="project-expression" label="Metric Expression Alerts" %}}
 <br>
-_Available as of v2.2.4_
 
 If you enable [project monitoring]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/#monitoring), this alert type monitors for the overload from Prometheus expression querying.
 
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
index 596bbe9e716..b64b9a7ae1d 100644
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
@@ -3,8 +3,6 @@ title: Istio in Projects
 weight: 1
 ---
 
-_Available as of v2.3.0_
-
 Using Rancher, you can connect, secure, control, and observe services through integration with [Istio](https://istio.io/), a leading open-source service mesh solution. Istio provides behavioral insights and operational control over the service mesh as a whole, offering a complete solution to satisfy the diverse requirements of microservice applications.
 
 This service mesh provides features that include but are not limited to the following:
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
index c3de12fd652..0001609eeb5 100644
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
@@ -13,8 +13,6 @@ Resource quotas can also be set when a new project is created. For details, refe
 
 ### Applying Resource Quotas to Existing Projects
 
-_Available as of v2.0.1_
-
 Edit [resource quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) when:
 
 - You want to limit the resources that a project and its namespaces can use.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
index 5d3bf362301..dde40c80fab 100644
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
@@ -3,16 +3,12 @@ title: Setting Container Default Resource Limits
 weight: 3
 ---
 
-_Available as of v2.2.0_
-
 When setting resource quotas, if you set anything related to CPU or Memory (i.e. limits or reservations) on a project / namespace, all containers will require a respective CPU or Memory field set during creation. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/#requests-vs-limits) for more details on why this is required.
 
 To avoid setting these limits on each and every container during workload creation, a default container resource limit can be specified on the namespace.
 
 ### Editing the Container Default Resource Limit
 
-_Available as of v2.2.0_
-
 Edit [container default resource limit]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/#setting-container-default-resource-limit) when:
 
 - You have a CPU or Memory resource quota set on a project, and want to supply the corresponding default values for a container.
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
index a9be8884a31..df801948faa 100644
--- a/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
@@ -1,8 +1,6 @@
 ---
 title: NFS Storage
 weight: 3054
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/adding-storage/provisioning-storage/nfs/
 ---
 
 Before you can use the NFS storage volume plug-in with Rancher deployments, you need to provision an NFS server.
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
index 0750143fe22..8a1e5b2a524 100644
--- a/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
@@ -1,8 +1,6 @@
 ---
 title: vSphere Storage
 weight: 3055
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/adding-storage/provisioning-storage/vsphere/
 ---
 
 To provide stateful workloads with vSphere storage, we recommend creating a vSphereVolume [storage class]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/#storage-classes). This practice dynamically provisions vSphere storage when workloads request volumes through a [persistent volume claim]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/persistent-volume-claims/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
index 19350a61f37..1c7d8ed3aad 100644
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
+++ b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
@@ -3,8 +3,6 @@ title: Managing HPAs with the Rancher UI
 weight: 2
 ---
 
-_Available as of v2.3.0_
-
 The Rancher UI supports creating, managing, and deleting HPAs. You can configure CPU or memory usage as the metric that the HPA uses to scale.
 
 If you want to create HPAs that scale based on other metrics than CPU and memory, refer to [Configuring HPA to Scale Using Custom Metrics with Prometheus]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/#configuring-hpa-to-scale-using-custom-metrics-with-prometheus).
diff --git a/content/rancher/v2.5/en/ecm/_index.md b/content/rancher/v2.5/en/ecm/_index.md
index b4e79cca68c..0e359ce5891 100644
--- a/content/rancher/v2.5/en/ecm/_index.md
+++ b/content/rancher/v2.5/en/ecm/_index.md
@@ -37,8 +37,6 @@ For more information, see [Provisioning Drivers]({{<baseurl>}}/rancher/v2.x/en/a
 
 ## Adding Kubernetes Versions into Rancher
 
-_Available as of v2.3.0_
-
 With this feature, you can upgrade to the latest version of Kubernetes as soon as it is released, without upgrading Rancher. This feature allows you to easily upgrade Kubernetes patch versions (i.e. `v1.15.X`), but not intended to upgrade Kubernetes minor versions (i.e. `v1.X.0`) as Kubernetes tends to deprecate or add APIs between minor versions.
 
 The information that Rancher uses to provision [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) is now located in the Rancher Kubernetes Metadata. For details on metadata configuration and how to change the Kubernetes version used for provisioning RKE clusters, see [Rancher Kubernetes Metadata.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/k8s-metadata/)
@@ -49,6 +47,4 @@ For more information on how metadata works and how to configure metadata config,
 
 ## Enabling Experimental Features
 
-_Available as of v2.3.0_
-
 Rancher includes some features that are experimental and disabled by default. Feature flags were introduced to allow you to try these features. For more information, refer to the section about [feature flags.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/feature-flags/)
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
index 7e151f00d86..7353942296a 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
@@ -3,8 +3,6 @@ title: Configuring Azure AD
 weight: 5
 ---
 
-_Available as of v2.0.3_
-
 If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
 
 >**Note:** Azure AD integration only supports Service Provider initiated logins.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
index 652c33f86c5..8090d483fa6 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
@@ -3,8 +3,6 @@ title: Configuring FreeIPA
 weight: 4
 ---
 
-_Available as of v2.0.5_
-
 If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials.
 
 >**Prerequisites:**
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
index 5af5724229b..1c77c5354b2 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
@@ -2,7 +2,6 @@
 title: Configuring Google OAuth
 weight: 12
 ---
-_Available as of v2.3.0_
 
 If your organization uses G Suite for user authentication, you can configure Rancher to allow your users to log in using their G Suite credentials.
 
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
index cdc10e67f14..f73660636f0 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
@@ -3,7 +3,6 @@ title: Configuring Keycloak (SAML)
 description: Create a Keycloak SAML client and configure Rancher to work with Keycloak. By the end your users will be able to sign into Rancher using their Keycloak logins
 weight: 7
 ---
-_Available as of v2.1.0_
 
 If your organization uses Keycloak Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
 
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
index 480f3110b9d..8ddd77b8d85 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
@@ -2,7 +2,6 @@
 title: Configuring Microsoft Active Directory Federation Service (SAML)
 weight: 9
 ---
-_Available as of v2.0.7_
 
 If your organization uses Microsoft Active Directory Federation Services (AD FS) for user authentication, you can configure Rancher to allow your users to log in using their AD FS credentials.
 
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
index 67706dddcf3..3feb62b8581 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
@@ -2,7 +2,6 @@
 title: 2 — Configuring Rancher for Microsoft AD FS
 weight: 1205
 ---
-_Available as of v2.0.7_
 
 After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup/), enter your AD FS information into Rancher to allow AD FS users to authenticate with Rancher.
 
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
index 40563ce58ef..53f37810ab4 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
@@ -3,8 +3,6 @@ title: Configuring Okta (SAML)
 weight: 10
 ---
 
-_Available as of v2.2.0_
-
 If your organization uses Okta Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
 
 >**Note:** Okta integration only supports Service Provider initiated logins.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
index cab417e2616..3ee68476cab 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
@@ -3,8 +3,6 @@ title: Configuring OpenLDAP
 weight: 3
 ---
 
-_Available as of v2.0.5_
-
 If your organization uses LDAP for user authentication, you can configure Rancher to communicate with an OpenLDAP server to authenticate users. This allows Rancher admins to control access to clusters and projects based on users and groups managed externally in the organisation's central user repository, while allowing end-users to authenticate with their LDAP credentials when logging in to the Rancher UI. 
 
 ## Prerequisites
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
index a561c859539..1deef3746a5 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
@@ -2,7 +2,6 @@
 title: Configuring PingIdentity (SAML)
 weight: 8
 ---
-_Available as of v2.0.7_
 
 If your organization uses Ping Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
 
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
index cc4f7dc17ed..f31a13226fc 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
@@ -3,8 +3,6 @@ title: Configuring Shibboleth (SAML)
 weight: 11
 ---
 
-_Available as of v2.4.0_
-
 If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials.
 
 In this configuration, when Rancher users log in, they will be redirected to the Shibboleth IdP to enter their credentials. After authentication, they will be redirected back to the Rancher UI.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
index 6a057b2104a..fc8797e82ef 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
@@ -3,8 +3,6 @@ title: Group Permissions with Shibboleth and OpenLDAP
 weight: 1
 ---
 
-_Available as of Rancher v2.4_
-
 This page provides background information and context for Rancher users who intend to set up the Shibboleth authentication provider in Rancher. 
 
 Because Shibboleth is a SAML provider, it does not support searching for groups. While a Shibboleth integration can validate user credentials, it can't be used to assign permissions to groups in Rancher without additional configuration.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
index d88eb423f82..8b3fd232551 100644
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
@@ -23,8 +23,6 @@ Whenever a user logs in to the UI using an authentication provider, Rancher auto
 
 ### Automatically Refreshing User Information
 
-_Available as of v2.2.0_
-
 Rancher will periodically refresh the user information even before a user logs in through the UI. You can control how often Rancher performs this refresh.  From the **Global** view, click on **Settings**. Two settings control this behavior:
 
 - **`auth-user-info-max-age-seconds`**
@@ -53,8 +51,6 @@ If you are not sure the last time Rancher performed an automatic refresh of user
 
 ## Session Length
 
-_Available as of v2.3.0_
-
 The default length (TTL) of each user session is adjustable. The default session length is 16 hours.
 
 1. From the **Global** view, click on **Settings**.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
index 21a8af43d57..73d87c95a55 100644
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
@@ -92,8 +92,6 @@ The steps to add custom roles differ depending on the version of Rancher.
 
 ## Creating a Custom Global Role
 
-_Available as of v2.4.0_
-
 ### Creating a Custom Global Role that Copies Rules from an Existing Role
 
 If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role in which all of the rules from another role, such as the administrator role, are copied into a new role. This allows you to only configure the variations between the existing role and the new role.
@@ -122,8 +120,6 @@ Custom global roles don't have to be based on existing roles. To create a custom
 
 ## Deleting a Custom Global Role
 
-_Available as of v2.4.0_
-
 When deleting a custom global role, all global role bindings with this custom role are deleted.
 
 If a user is only assigned one custom global role, and the role is deleted, the user would lose access to Rancher. For the user to regain access, an administrator would need to edit the user and apply new global permissions.
@@ -138,8 +134,6 @@ To delete a custom global role,
 
 ## Assigning a Custom Global Role to a Group
 
-_Available as of v2.4.0_
-
 If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role. When the role is assigned to a group, the users in the group have the appropriate level of access the first time they sign into Rancher.
 
 When a user in the group logs in, they get the built-in Standard User global role by default. They will also get the permissions assigned to their groups.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
index 7948e1648dd..0486688a0af 100644
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
+++ b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
@@ -130,8 +130,6 @@ To configure permission for a user,
 
 ### Configuring Global Permissions for Groups
 
-_Available as of v2.4.0_
-
 If you have a group of individuals that need the same level of access in Rancher, it can save time to assign permissions to the entire group at once, so that the users in the group have the appropriate level of access the first time they sign into Rancher.
 
 After you assign a custom global role to a group, the custom global role will be assigned to a user in the group when they log in to Rancher.
diff --git a/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md b/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
index fdff6a58d3f..343f8f6f841 100644
--- a/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
+++ b/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
@@ -101,12 +101,10 @@ The `S3` backup target allows users to configure a S3 compatible backend to stor
 |S3 Region Endpoint|S3 regions endpoint for the backup bucket|* |
 |S3 Access Key|S3 access key with permission to access the backup bucket|*|
 |S3 Secret Key|S3 secret key with permission to access the backup bucket|*|
-| Custom CA Certificate | A custom certificate used to access private S3 backends _Available as of v2.2.5_ ||
+| Custom CA Certificate | A custom certificate used to access private S3 backends ||
 
 ### Using a custom CA certificate for S3
 
-_Available as of v2.2.5_
-
 The backup snapshot can be stored on a custom `S3` backup like [minio](https://min.io/). If the S3 back end uses a self-signed or custom certificate, provide a custom certificate using the `Custom CA Certificate` option to connect to the S3 backend.
 
 ### IAM Support for Storing Snapshots in S3
@@ -130,8 +128,6 @@ The list of all available snapshots for the cluster is available in the Rancher
 
 # Safe Timestamps
 
-_Available as of v2.3.0_
-
 As of v2.2.6, snapshot files are timestamped to simplify processing the files using external tools and scripts, but in some S3 compatible backends, these timestamps were unusable. As of Rancher v2.3.0, the option `safe_timestamp` is added to support compatible file names. When this flag is set to `true`, all special characters in the snapshot filename timestamp are replaced.
 
 This option is not available directly in the UI, and is only available through the `Edit as Yaml` interface.
diff --git a/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md b/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
index ef92a737bd6..03a67524ef3 100644
--- a/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
+++ b/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
@@ -3,8 +3,6 @@ title: Cluster Drivers
 weight: 1
 ---
 
-_Available as of v2.2.0_
-
 Cluster drivers are used to create clusters in a [hosted Kubernetes provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/), such as Google GKE. The availability of which cluster driver to display when creating clusters is defined by the cluster driver's status. Only `active` cluster drivers will be displayed as an option for creating clusters. By default, Rancher is packaged with several existing cloud provider cluster drivers, but you can also add custom cluster drivers to Rancher.
 
 If there are specific cluster drivers that you do not want to show your users, you may deactivate those cluster drivers within Rancher and they will not appear as an option for cluster creation.
diff --git a/content/rancher/v2.5/en/ecm/feature-flags/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/_index.md
index 6dc6e316475..4d766396545 100644
--- a/content/rancher/v2.5/en/ecm/feature-flags/_index.md
+++ b/content/rancher/v2.5/en/ecm/feature-flags/_index.md
@@ -115,8 +115,6 @@ docker run -d -p 80:80 -p 443:443 \
 
 # Enabling Features with the Rancher UI
 
-_Available as of Rancher v2.3.3_
-
 1. Go to the **Global** view and click **Settings.**
 1. Click the **Feature Flags** tab. You will see a list of experimental features.
 1. To enable a feature, go to the disabled feature you want to enable and click **&#8942; > Activate.**
diff --git a/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
index 8d254d8bd6d..6fcea1be92f 100644
--- a/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
+++ b/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
@@ -1,10 +1,7 @@
 ---
 title: Allow Unsupported Storage Drivers
 weight: 1
-aliases:
-  - /rancher/v2.x/en/admin-settings/feature-flags/enable-not-default-storage-drivers
 ---
-_Available as of v2.3.0_
 
 This feature allows you to use types for storage providers and provisioners that are not enabled by default.
 
diff --git a/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
index f631b54d2ee..5bf7ca6a58e 100644
--- a/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
+++ b/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
@@ -1,10 +1,7 @@
 ---
 title: UI for Istio Virtual Services and Destination Rules
 weight: 2
-aliases:
-  - /rancher/v2.x/en/admin-settings/feature-flags/istio-virtual-service-ui
 ---
-_Available as of v2.3.0_
 
 This feature enables a UI that lets you create, read, update and delete virtual services and destination rules, which are traffic management features of Istio.
 
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
index 5819eecfcc0..21b7b49284d 100644
--- a/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
+++ b/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
@@ -184,8 +184,6 @@ Once drain successfully completes, the node will be in a state of `drained`. You
 
 # Labeling a Node to be Ignored by Rancher
 
-_Available as of 2.3.3_
-
 Some solutions, such as F5's BIG-IP integration, may require creating a node that is never registered to a cluster.
 
 Since the node will never finish registering, it will always be shown as unhealthy in the Rancher UI.
diff --git a/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md b/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
index 8c0b6964b9f..9b064ecf94f 100644
--- a/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
+++ b/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
@@ -25,8 +25,6 @@ Using Rancher, you can create a Pod Security Policy using our GUI rather than cr
 
 ## Default Pod Security Policies
 
-_Available as of v2.0.7_
-
 Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies.
 
 - `restricted`
diff --git a/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md b/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
index 1f42f67b98f..e7125947fca 100644
--- a/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
+++ b/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
@@ -90,8 +90,6 @@ If you require another level of organization beyond the **Default** project, you
 
 ### The System Project
 
-_Available as of v2.0.7_
-
 When troubleshooting, you can view the `system` project to check if important namespaces in the Kubernetes system are working properly. This easily accessible project saves you from troubleshooting individual system namespace containers.
 
 To open it, open the **Global** menu, and then select the `system` project for your cluster.
@@ -167,8 +165,6 @@ To add members:
 
 ### 4. Optional: Add Resource Quotas
 
-_Available as of v2.1.0_
-
 Resource quotas limit the resources that a project (and its namespaces) can consume. For more information, see [Resource Quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas).
 
 To add a resource quota,
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
index 06a62b8e02a..3dc23ad4a35 100644
--- a/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
+++ b/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
@@ -44,8 +44,6 @@ As of Rancher v2.3.3, an existing cluster's settings can be [saved as an RKE tem
 
 ### Converting an Existing Cluster to Use an RKE Template
 
-_Available as of v2.3.3_
-
 This section describes how to create an RKE template from an existing cluster.
 
 RKE templates cannot be applied to existing clusters, except if you save an existing cluster's settings as an RKE template. This exports the cluster's settings as a new RKE template, and also binds the cluster to that template. The result is that the cluster can only be changed if the [template is updated,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template) and the cluster is upgraded to [use a newer version of the template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#upgrading-a-cluster-to-use-a-new-template-revision)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
index a8778f3056e..80456c25494 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
@@ -80,8 +80,6 @@ For more information, refer to the section on [importing existing clusters.]({{<
 
 ### Importing and Editing K3s Clusters
 
-_Available as of Rancher v2.4.0_
-
 [K3s]({{<baseurl>}}/k3s/latest/en/) is lightweight, fully compliant Kubernetes distribution. K3s Kubernetes clusters can now be imported into Rancher.
 
 When a K3s cluster is imported, Rancher will recognize it as K3s, and the Rancher UI will expose the following features in addition to the functionality for other imported clusters:
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
index 32d75c76a00..23da1eadf53 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
@@ -4,8 +4,6 @@ shortTitle: Alibaba Cloud Container Service for Kubernetes
 weight: 2120
 ---
 
-_Available as of v2.2.0_
-
 You can use Rancher to create a cluster hosted in Alibaba Cloud Kubernetes (ACK). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for ACK, but by default, this cluster driver is `inactive`. In order to launch ACK clusters, you will need to [enable the ACK cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning ACK clusters.
 
 ## Prerequisites
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
index fa5d692d15e..9a942184721 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
@@ -2,8 +2,6 @@
 title: Creating an AKS Cluster
 shortTitle: Azure Kubernetes Service
 weight: 2115
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure-container-service/
 ---
 
 You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Service (AKS).
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
index f01af1c27b3..452a69d543b 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
@@ -4,8 +4,6 @@ shortTitle: Huawei Cloud Kubernetes Service
 weight: 2130
 ---
 
-_Available as of v2.2.0_
-
 You can use Rancher to create a cluster hosted in Huawei Cloud Container Engine (CCE). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for CCE, but by default, this cluster driver is `inactive`. In order to launch CCE clusters, you will need to [enable the CCE cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning CCE clusters.
 
 ## Prerequisites in Huawei
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
index ec106076c14..1e87eee4c83 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
@@ -2,8 +2,6 @@
 title: Creating an EKS Cluster
 shortTitle: Amazon EKS
 weight: 2110
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-eks/
 ---
 
 Amazon EKS provides a managed control plane for your Kubernetes cluster. Amazon EKS runs the Kubernetes control plane instances across multiple Availability Zones to ensure high availability. Rancher provides an intuitive user interface for managing and deploying the Kubernetes clusters you run in Amazon EKS. With this guide, you will use Rancher to quickly and easily launch an Amazon EKS Kubernetes cluster in your AWS account. For more information on Amazon EKS, see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html).
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
index f08a196861b..25a1a88f2bd 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
@@ -2,8 +2,6 @@
 title: Creating a GKE Cluster
 shortTitle: Google Kubernetes Engine
 weight: 2105
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-gke/
 ---
 
 ## Prerequisites in Google Kubernetes Engine
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
index dc6c66b9efb..f0046b905c2 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
@@ -4,8 +4,6 @@ shortTitle: Tencent Kubernetes Engine
 weight: 2125
 ---
 
-_Available as of v2.2.0_
-
 You can use Rancher to create a cluster hosted in Tencent Kubernetes Engine (TKE). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for TKE, but by default, this cluster driver is `inactive`. In order to launch TKE clusters, you will need to [enable the TKE cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning TKE clusters.
 
 ## Prerequisites in Tencent
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
index 0ef2fcec085..70b3cef45e8 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
@@ -76,8 +76,6 @@ You can now import a K3s Kubernetes cluster into Rancher. [K3s]({{<baseurl>}}/k3
 
 ### Additional Features for Imported K3s Clusters
 
-_Available as of v2.4.0_
-
 When a K3s cluster is imported, Rancher will recognize it as K3s, and the Rancher UI will expose the following features in addition to the functionality for other imported clusters:
 
 - The ability to upgrade the K3s version
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
index 3c02886fbc6..e899bcb10db 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
@@ -84,8 +84,6 @@ If you want to see all the configuration options for a cluster, please click **S
 
 ### Private registries
 
-_Available as of v2.2.0_
-
 The cluster-level private registry configuration is only used for provisioning clusters.
 
 There are two main ways to set up private registries in Rancher: by setting up the [global default registry]({{<baseurl>}}/rancher/v2.x/en/admin-settings/config-private-registry) through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials.
@@ -101,8 +99,6 @@ See the [RKE documentation on private registries]({{<baseurl>}}/rke/latest/en/co
 
 ### Authorized Cluster Endpoint
 
-_Available as of v2.2.0_
-
 Authorized Cluster Endpoint can be used to directly access the Kubernetes API server, without requiring communication through Rancher.
 
 > The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#tools-for-provisioning-kubernetes-clusters) to provision the cluster. It is not available for clusters in a hosted Kubernetes provider, such as Amazon's EKS.
@@ -351,8 +347,6 @@ The table below indicates what DNS provider is deployed by default. See [RKE doc
 
 # Rancher specific parameters
 
-_Available as of v2.2.0_
-
 Besides the RKE config file options, there are also Rancher specific settings that can be configured in the Config File (YAML):
 
 ### docker_root_dir
@@ -382,8 +376,6 @@ local_cluster_auth_endpoint:
 
 ### Custom Network Plug-in
 
-_Available as of v2.2.4_
-
 You can add a custom network plug-in by using the [user-defined add-on functionality]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/) of RKE. You define any add-on that you want deployed after the Kubernetes cluster is deployed.
 
 There are two ways that you can specify an add-on:
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
index efcae9b4997..769bd5e0d01 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
@@ -1,9 +1,6 @@
 ---
 title: Rancher Agent Options
 weight: 2500
-aliases:
-  - /rancher/v2.x/en/admin-settings/agent-options/
-  - /rancher/v2.x/en/cluster-provisioning/custom-clusters/agent-options
 ---
 
 Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) and add the options to the generated `docker run` command when adding a node.
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
index cb2da593f90..e832003971f 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
@@ -35,16 +35,12 @@ You can add [labels](https://kubernetes.io/docs/concepts/overview/working-with-o
 
 ### Node Taints
 
-_Available as of Rancher v2.3.0_
-
 You can add [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on each node template, so that any nodes created from the node template will automatically have these taints on them.
 
 Since taints can be added at a node template and node pool, if there is no conflict with the same key and effect of the taints, all taints will be added to the nodes. If there are taints with the same key and different effect, the taints from the node pool will override the taints from the node template.
 
 ### Administrator Control of Node Templates
 
-_Available as of v2.3.3_
-
 Administrators can control all node templates. Admins can now maintain all the node templates within Rancher. When a node template owner is no longer using Rancher, the node templates created by them can be managed by administrators so the cluster can continue to be updated and maintained.
 
 To access all node templates, an administrator will need to do the following:
@@ -62,8 +58,6 @@ Each node pool is assigned with a [node component]({{<baseurl>}}/rancher/v2.x/en
 
 ### Node Pool Taints
 
-_Available as of Rancher v2.3.0_
-
 If you haven't defined [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on your node template, you can add taints for each node pool. The benefit of adding taints at a node pool is beneficial over adding it at a node template is that you can swap out the node templates without worrying if the taint is on the node template.
 
 For each taint, they will automatically be added to any created node in the node pool. Therefore, if you add taints to a node pool that have existing nodes, the taints won't apply to existing nodes in the node pool, but any new node added into the node pool will get the taint.
@@ -72,8 +66,6 @@ When there are taints on the node pool and node template, if there is no conflic
 
 ### About Node Auto-replace
 
-_Available as of Rancher v2.3.0_
-
 If a node is in a node pool, Rancher can automatically replace unreachable nodes. Rancher will use the existing node template for the given node pool to recreate the node if it becomes inactive for a specified number of minutes.
 
 > **Important:** Self-healing node pools are designed to help you replace worker nodes for **stateless** applications. It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
@@ -114,8 +106,6 @@ You can disable node auto-replace from the Rancher UI with the following steps:
 
 # Cloud Credentials
 
-_Available as of v2.2.0_
-
 Node templates can use cloud credentials to store credentials for launching nodes in your cloud provider, which has some benefits:
 
 - Credentials are stored as a Kubernetes secret, which is not only more secure, but it also allows you to edit a node template without having to enter your credentials every time.
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
index 73dbf40a0bb..a74cbf61504 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
@@ -2,8 +2,6 @@
 title: Creating an Azure Cluster
 shortTitle: Azure
 weight: 2220
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-azure/
 ---
 
 Use {{< product >}} to create a Kubernetes cluster in Azure.
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
index 21f6438048c..36c912de8ce 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
@@ -2,8 +2,6 @@
 title: Creating a DigitalOcean Cluster
 shortTitle: DigitalOcean
 weight: 2215
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-digital-ocean/
 ---
 Use {{< product >}} to create a Kubernetes cluster using DigitalOcean.
 
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
index e512460253d..dbc0be0f28e 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
@@ -4,8 +4,6 @@ shortTitle: vSphere
 description: Use Rancher to create a vSphere cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. 
 metaDescription: Use Rancher to create a vSphere cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. 
 weight: 2225
-aliases:
-  - /rancher/v2.x/en/tasks/clusters/creating-a-cluster/create-cluster-vsphere/
 ---
 
 By using Rancher with vSphere, you can bring cloud operations on-premises.
@@ -20,16 +18,12 @@ The vSphere node templates have been updated, allowing you to bring cloud operat
 
 ### Self-healing Node Pools
 
-_Available as of v2.3.0_
-
 One of the biggest advantages of provisioning vSphere nodes with Rancher is that it allows you to take advantage of Rancher's self-healing node pools, also called the [node auto-replace feature,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-auto-replace) in your on-premises clusters. Self-healing node pools are designed to help you replace worker nodes for stateless applications. When Rancher provisions nodes from a node template, Rancher can automatically replace unreachable nodes.
 
 > **Important:** It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
 
 ### Dynamically Populated Options for Instances and Scheduling
 
-_Available as of v2.3.3_
-
 Node templates for vSphere have been updated so that when you create a node template with your vSphere credentials, the template is automatically populated with the same options for provisioning VMs that you have access to in the vSphere console.
 
 For the fields to be populated, your setup needs to fulfill the [prerequisites.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/#prerequisites)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
index f59e5e35b86..ca0b30b396b 100644
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
+++ b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
@@ -169,8 +169,6 @@ Ensure that the [OS ISO URL](#instance-options) contains the URL of the VMware I
 
 ### D. Add Networks
 
-_Available as of v2.3.3_
-
 The node template now allows a VM to be provisioned with multiple networks. In the **Networks** field, you can now click **Add Network** to add any networks available to you in vSphere.
 
 ### E. If Not Already Enabled, Enable Disk UUIDs
diff --git a/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md b/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
index f47a5fcd279..f75848a71b3 100644
--- a/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
+++ b/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
@@ -85,8 +85,6 @@ The cluster cannot be downgraded to a previous Kubernetes version.
 
 # Rolling Back
 
-_Available as of v2.4_
-
 A cluster can be restored to a backup in which the previous Kubernetes version was used. For more information, refer to the following sections:
 
 - [Backing up a cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#how-snapshots-work)
diff --git a/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md b/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
index 223b58a02b4..3a0352a90eb 100644
--- a/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
+++ b/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
@@ -96,8 +96,6 @@ For more information, see the following pages:
 
 ![Weave Logo]({{<baseurl>}}/img/rancher/weave-logo.png)
 
-_Available as of v2.2.0_
-
 Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers.
 
 Kubernetes workers should open TCP port `6783` (control port), UDP port `6783` and UDP port `6784` (data ports). See the [port requirements for user clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for more details.
diff --git a/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md b/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
index 897fdcfce49..8ea06632696 100644
--- a/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
+++ b/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
@@ -1,11 +1,6 @@
 ---
 title: Rancher is No Longer Needed
 weight: 8010
-aliases:
-  - /rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/
-  - /rancher/v2.x/en/installation/removing-rancher/
-  - /rancher/v2.x/en/admin-settings/removing-rancher/
-  - /rancher/v2.x/en/admin-settings/removing-rancher/rancher-cluster-nodes/
 ---
 
 This page is intended to answer questions about what happens if you don't want Rancher anymore, if you don't want a cluster to be managed by Rancher anymore, or if the Rancher server is deleted.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
index 136c827cf4a..0cb9130abd5 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
@@ -58,8 +58,8 @@ weight: 2
 | `rancherImageTag`              | same as chart version                                 | `string` - rancher/rancher image tag                                                                                                              |
 | `rancherImagePullPolicy`       | "IfNotPresent"                                        | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent"                                                 |
 | `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
-| `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/ _Available as of v2.3.0_                  |
-| `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. _Available as of v2.3.0_ |
+| `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/                   |
+| `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations.  |
 
 <br/>
 
@@ -79,8 +79,6 @@ Set the `auditLog.destination` to `hostPath` to forward logs to volume shared wi
 
 ### Setting Extra Environment Variables
 
-_Available as of v2.2.0_
-
 You can set extra environment variables for Rancher server using `extraEnv`. This list uses the same `name` and `value` keys as the container manifest definitions. Remember to quote the values.
 
 ```plain
@@ -90,8 +88,6 @@ You can set extra environment variables for Rancher server using `extraEnv`. Thi
 
 ### TLS Settings
 
-_Available as of v2.2.0_
-
 To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
 
 ```plain
@@ -123,8 +119,6 @@ Example on setting a custom certificate issuer:
 --set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair
 ```
 
-_Available as of v2.0.15, v2.1.10 and v2.2.4_
-
 Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used.
 
 ```plain
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
index f87f5a254f9..b0a7f913c38 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
@@ -3,8 +3,6 @@ title: Running on ARM64 (Experimental)
 weight: 3
 ---
 
-_Available as of v2.2.0_
-
 > **Important:**
 >
 > Running on an ARM64 platform is currently an experimental feature and is not yet officially supported in Rancher. Therefore, we do not recommend using ARM64 based nodes in a production environment.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
index 30ccb0d9fcd..d631b42f51d 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
@@ -76,7 +76,7 @@ When setting up the Rancher Helm template, there are several options in the Helm
 | ----------------------- | -------------------------------- | ---- |
 | `certmanager.version` | "<version>" | Configure proper Rancher TLS issuer depending of running cert-manager version. |
 | `systemDefaultRegistry` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `useBundledSystemChart` | `true`                           | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
+| `useBundledSystemChart` | `true`                           | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. |
 
 Based on the choice your made in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), complete one of the procedures below.
 
@@ -240,7 +240,7 @@ For security purposes, SSL (Secure Sockets Layer) is required when using Rancher
 | Environment Variable Key         | Environment Variable Value       | Description     |
 | -------------------------------- | -------------------------------- | ---- |
 | `CATTLE_SYSTEM_DEFAULT_REGISTRY` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `CATTLE_SYSTEM_CATALOG`          | `bundled`                        | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
+| `CATTLE_SYSTEM_CATALOG`          | `bundled`                        | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. |
 
 > **Do you want to...**
 >
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
index 096176a0c0f..1d063572262 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
@@ -101,8 +101,6 @@ The `rancher-images.txt` is expected to be on the workstation in the same direct
 {{% /tab %}}
 {{% tab "Linux and Windows Clusters" %}}
 
-_Available as of v2.3.0_
-
 For Rancher servers that will provision Linux and Windows clusters, there are distinctive steps to populate your private registry for the Windows images and the Linux images. Since a Windows cluster is a mix of Linux and Windows nodes, the Linux images pushed into the private registry are manifests.
 
 ### Windows Steps
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
index bade7211c43..fc57ede4a78 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
@@ -3,8 +3,6 @@ title: TLS Settings
 weight: 3
 ---
 
-_Available as of v2.1.7_
-
 In Rancher v2.1.7, the default TLS configuration changed to only accept TLS 1.2 and secure TLS cipher suites. TLS 1.3 and TLS 1.3 exclusive cipher suites are not supported.
 
 ## Configuring TLS settings
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
index b3f3a4b8dcf..fde4297dfae 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
@@ -1,7 +1,6 @@
 ---
 title: Setting up an NGINX Load Balancer
 weight: 4
-aliases:
 ---
 
 NGINX will be configured as Layer 4 load balancer (TCP) that forwards connections to one of your Rancher nodes.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
index c6c3ccf2123..4330a41fe01 100644
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
+++ b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
@@ -51,8 +51,6 @@ docker run -d --restart=unless-stopped \
 
 ### TLS settings
 
-_Available as of v2.1.7_
-
 To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
 
 ```
diff --git a/content/rancher/v2.5/en/istio/legacy/resources/_index.md b/content/rancher/v2.5/en/istio/legacy/resources/_index.md
index 9b0dea50923..6d9c4e70d24 100644
--- a/content/rancher/v2.5/en/istio/legacy/resources/_index.md
+++ b/content/rancher/v2.5/en/istio/legacy/resources/_index.md
@@ -1,11 +1,7 @@
 ---
 title: CPU and Memory Allocations
 weight: 1
-aliases:
-    - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/_index.md
-    - /rancher/v2.x/en/project-admin/istio/config/_index.md
 ---
-_Available as of v2.3.0_
 
 This section describes the minimum recommended computing resources for the Istio components in a cluster.
 
diff --git a/content/rancher/v2.5/en/logging/_index.md b/content/rancher/v2.5/en/logging/_index.md
index fe445dc9709..e67fa1ca652 100644
--- a/content/rancher/v2.5/en/logging/_index.md
+++ b/content/rancher/v2.5/en/logging/_index.md
@@ -5,117 +5,3 @@ description: Rancher integrates with popular logging services. Learn the require
 metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
 weight: 9
 ---
-
-Logging is helpful because it allows you to:
-
-- Capture and analyze the state of your cluster
-- Look for trends in your environment
-- Save your logs to a safe location outside of your cluster
-- Stay informed of events like a container crashing, a pod eviction, or a node dying
-- More easily debug and troubleshoot problems
-
-Rancher supports integration with the following services:
-
-- Elasticsearch
-- Splunk
-- Kafka
-- Syslog
-- Fluentd
-
-This section covers the following topics:
-
-- [How logging integrations work](#how-logging-integrations-work)
-- [Requirements](#requirements)
-- [Logging scope](#logging-scope)
-- [Enabling cluster logging](#enabling-cluster-logging)
-
-# How Logging Integrations Work
-
-Rancher can integrate with popular external services used for event streams, telemetry, or search. These services can log errors and warnings in your Kubernetes infrastructure to a stream.
-
-These services collect container log events, which are saved to the `/var/log/containers` directory on each of your nodes. The service collects both standard and error events. You can then log into your services to review the events collected, leveraging each service's unique features.
-
-When configuring Rancher to integrate with these services, you'll have to point Rancher toward the service's endpoint and provide authentication information.
-
-Additionally, you'll have the opportunity to enter key-value pairs to filter the log events collected. The service will only collect events for containers marked with your configured key-value pairs.
-
->**Note:** You can only configure one logging service per cluster or per project.
-
-# Requirements
-
-The Docker daemon on each node in the cluster should be [configured](https://docs.docker.com/config/containers/logging/configure/) with the (default) log-driver: `json-file`. You can check the log-driver by running the following command:
-
-```
-$ docker info | grep 'Logging Driver'
-Logging Driver: json-file
-```
-
-# Logging Scope
-
-You can configure logging at either cluster level or project level.
-
-- Cluster logging writes logs for every pod in the cluster, i.e. in all the projects. For [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), it also writes logs for all the Kubernetes system components.
-- [Project logging]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/logging/) writes logs for every pod in that particular project.
-
-Logs that are sent to your logging service are from the following locations:
-
-  - Pod logs stored at `/var/log/containers`.
-  - Kubernetes system components logs stored at `/var/lib/rancher/rke/log/`.
-
-# Enabling Cluster Logging
-
-As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to send Kubernetes logs to a logging service.
-
-1. From the **Global** view, navigate to the cluster that you want to configure cluster logging.
-
-1. Select **Tools > Logging** in the navigation bar.
-
-1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports integration with the following services:
-
-   - [Elasticsearch]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/)
-   - [Splunk]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/splunk/)
-   - [Kafka]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/kafka/)
-   - [Syslog]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/syslog/)
-   - [Fluentd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/)
-
-1. (Optional) Instead of using the UI to configure the logging services, you can enter custom advanced configurations by clicking on **Edit as File**, which is located above the logging targets. This link is only visible after you select a logging service.
-
-    - With the file editor, enter raw fluentd configuration for any logging service. Refer to the documentation for each logging service on how to setup the output configuration.
-
-       - [Elasticsearch Documentation](https://github.com/uken/fluent-plugin-elasticsearch)
-       - [Splunk Documentation](https://github.com/fluent/fluent-plugin-splunk)
-       - [Kafka Documentation](https://github.com/fluent/fluent-plugin-kafka)
-       - [Syslog Documentation](https://github.com/dlackty/fluent-plugin-remote_syslog)
-       - [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/out_forward)
-
-   - If the logging service is using TLS, you also need to complete the **SSL Configuration** form.
-       1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
-
-           - You can use either a self-signed certificate or one provided by a certificate authority.
-
-           - You can generate a self-signed certificate using an openssl command. For example:
-
-                ```
-                openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-                ```
-       2. If you are using a self-signed certificate, provide the **CA Certificate PEM**.
-
-1. (Optional) Complete the **Additional Logging Configuration** form.
-
-    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
-
-    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes data to the logging server. Intervals are measured in seconds.
-
-    1. **Include System Log**. The logs from pods in system project and RKE components will be sent to the target. Uncheck it to exclude the system logs.
-
-1. Click **Test**. Rancher sends a test log to the service.
-
-    > **Note:** This button is replaced with _Dry Run_ if you are using the custom configuration editor. In this case, Rancher calls the fluentd dry run command to validate the configuration.
-
-1. Click **Save**.
-
-**Result:** Rancher is now configured to send logs to the selected service. Log into the logging service so that you can start viewing the logs.
-
-## Related Links
-
-[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
diff --git a/content/rancher/v2.5/en/logging/classic/_index.md b/content/rancher/v2.5/en/logging/classic/_index.md
deleted file mode 100644
index 1629da37c2d..00000000000
--- a/content/rancher/v2.5/en/logging/classic/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Legacy UI Docs
-weight: 2
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/logging/legacy/_index.md b/content/rancher/v2.5/en/logging/legacy/_index.md
new file mode 100644
index 00000000000..5f8404cf23d
--- /dev/null
+++ b/content/rancher/v2.5/en/logging/legacy/_index.md
@@ -0,0 +1,118 @@
+---
+title: Legacy UI Docs
+weight: 2
+---
+
+Logging is helpful because it allows you to:
+
+- Capture and analyze the state of your cluster
+- Look for trends in your environment
+- Save your logs to a safe location outside of your cluster
+- Stay informed of events like a container crashing, a pod eviction, or a node dying
+- More easily debug and troubleshoot problems
+
+Rancher supports integration with the following services:
+
+- Elasticsearch
+- Splunk
+- Kafka
+- Syslog
+- Fluentd
+
+This section covers the following topics:
+
+- [How logging integrations work](#how-logging-integrations-work)
+- [Requirements](#requirements)
+- [Logging scope](#logging-scope)
+- [Enabling cluster logging](#enabling-cluster-logging)
+
+# How Logging Integrations Work
+
+Rancher can integrate with popular external services used for event streams, telemetry, or search. These services can log errors and warnings in your Kubernetes infrastructure to a stream.
+
+These services collect container log events, which are saved to the `/var/log/containers` directory on each of your nodes. The service collects both standard and error events. You can then log into your services to review the events collected, leveraging each service's unique features.
+
+When configuring Rancher to integrate with these services, you'll have to point Rancher toward the service's endpoint and provide authentication information.
+
+Additionally, you'll have the opportunity to enter key-value pairs to filter the log events collected. The service will only collect events for containers marked with your configured key-value pairs.
+
+>**Note:** You can only configure one logging service per cluster or per project.
+
+# Requirements
+
+The Docker daemon on each node in the cluster should be [configured](https://docs.docker.com/config/containers/logging/configure/) with the (default) log-driver: `json-file`. You can check the log-driver by running the following command:
+
+```
+$ docker info | grep 'Logging Driver'
+Logging Driver: json-file
+```
+
+# Logging Scope
+
+You can configure logging at either cluster level or project level.
+
+- Cluster logging writes logs for every pod in the cluster, i.e. in all the projects. For [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), it also writes logs for all the Kubernetes system components.
+- [Project logging]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/logging/) writes logs for every pod in that particular project.
+
+Logs that are sent to your logging service are from the following locations:
+
+  - Pod logs stored at `/var/log/containers`.
+  - Kubernetes system components logs stored at `/var/lib/rancher/rke/log/`.
+
+# Enabling Cluster Logging
+
+As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to send Kubernetes logs to a logging service.
+
+1. From the **Global** view, navigate to the cluster that you want to configure cluster logging.
+
+1. Select **Tools > Logging** in the navigation bar.
+
+1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports integration with the following services:
+
+   - [Elasticsearch]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/)
+   - [Splunk]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/splunk/)
+   - [Kafka]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/kafka/)
+   - [Syslog]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/syslog/)
+   - [Fluentd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/)
+
+1. (Optional) Instead of using the UI to configure the logging services, you can enter custom advanced configurations by clicking on **Edit as File**, which is located above the logging targets. This link is only visible after you select a logging service.
+
+    - With the file editor, enter raw fluentd configuration for any logging service. Refer to the documentation for each logging service on how to setup the output configuration.
+
+       - [Elasticsearch Documentation](https://github.com/uken/fluent-plugin-elasticsearch)
+       - [Splunk Documentation](https://github.com/fluent/fluent-plugin-splunk)
+       - [Kafka Documentation](https://github.com/fluent/fluent-plugin-kafka)
+       - [Syslog Documentation](https://github.com/dlackty/fluent-plugin-remote_syslog)
+       - [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/out_forward)
+
+   - If the logging service is using TLS, you also need to complete the **SSL Configuration** form.
+       1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
+
+           - You can use either a self-signed certificate or one provided by a certificate authority.
+
+           - You can generate a self-signed certificate using an openssl command. For example:
+
+                ```
+                openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
+                ```
+       2. If you are using a self-signed certificate, provide the **CA Certificate PEM**.
+
+1. (Optional) Complete the **Additional Logging Configuration** form.
+
+    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
+
+    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes data to the logging server. Intervals are measured in seconds.
+
+    1. **Include System Log**. The logs from pods in system project and RKE components will be sent to the target. Uncheck it to exclude the system logs.
+
+1. Click **Test**. Rancher sends a test log to the service.
+
+    > **Note:** This button is replaced with _Dry Run_ if you are using the custom configuration editor. In this case, Rancher calls the fluentd dry run command to validate the configuration.
+
+1. Click **Save**.
+
+**Result:** Rancher is now configured to send logs to the selected service. Log into the logging service so that you can start viewing the logs.
+
+## Related Links
+
+[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
diff --git a/content/rancher/v2.5/en/logging/classic/elasticsearch/_index.md b/content/rancher/v2.5/en/logging/legacy/elasticsearch/_index.md
similarity index 97%
rename from content/rancher/v2.5/en/logging/classic/elasticsearch/_index.md
rename to content/rancher/v2.5/en/logging/legacy/elasticsearch/_index.md
index 1b50e42bad0..5f9a2a7b724 100644
--- a/content/rancher/v2.5/en/logging/classic/elasticsearch/_index.md
+++ b/content/rancher/v2.5/en/logging/legacy/elasticsearch/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Elasticsearch
 weight: 200
-aliases:
-  - /rancher/v2.x/en/tools/logging/elasticsearch/
 ---
 
 If your organization uses [Elasticsearch](https://www.elastic.co/), either on premise or in the cloud, you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Elasticsearch deployment to view logs.
diff --git a/content/rancher/v2.5/en/logging/classic/fluentd/_index.md b/content/rancher/v2.5/en/logging/legacy/fluentd/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/logging/classic/fluentd/_index.md
rename to content/rancher/v2.5/en/logging/legacy/fluentd/_index.md
diff --git a/content/rancher/v2.5/en/logging/classic/kafka/_index.md b/content/rancher/v2.5/en/logging/legacy/kafka/_index.md
similarity index 97%
rename from content/rancher/v2.5/en/logging/classic/kafka/_index.md
rename to content/rancher/v2.5/en/logging/legacy/kafka/_index.md
index bb2b5ac2344..6c0b69bc508 100644
--- a/content/rancher/v2.5/en/logging/classic/kafka/_index.md
+++ b/content/rancher/v2.5/en/logging/legacy/kafka/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Kafka
 weight: 400
-aliases:
-  - /rancher/v2.x/en/tools/logging/kafka/
 ---
 
 If your organization uses [Kafka](https://kafka.apache.org/), you can configure Rancher to send it Kubernetes logs.  Afterwards, you can log into your Kafka server to view logs.
diff --git a/content/rancher/v2.5/en/logging/classic/splunk/_index.md b/content/rancher/v2.5/en/logging/legacy/splunk/_index.md
similarity index 97%
rename from content/rancher/v2.5/en/logging/classic/splunk/_index.md
rename to content/rancher/v2.5/en/logging/legacy/splunk/_index.md
index 0d4edcf49ba..67482f0aa3f 100644
--- a/content/rancher/v2.5/en/logging/classic/splunk/_index.md
+++ b/content/rancher/v2.5/en/logging/legacy/splunk/_index.md
@@ -1,9 +1,6 @@
 ---
 title: Splunk
 weight: 300
-aliases:
-  - /rancher/v2.x/en/tasks/logging/splunk/
-  - /rancher/v2.x/en/tools/logging/splunk/
 ---
 
 If your organization uses [Splunk](https://www.splunk.com/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Splunk server to view logs.
diff --git a/content/rancher/v2.5/en/logging/classic/syslog/_index.md b/content/rancher/v2.5/en/logging/legacy/syslog/_index.md
similarity index 97%
rename from content/rancher/v2.5/en/logging/classic/syslog/_index.md
rename to content/rancher/v2.5/en/logging/legacy/syslog/_index.md
index e5aa8f8482f..aa997ca949a 100644
--- a/content/rancher/v2.5/en/logging/classic/syslog/_index.md
+++ b/content/rancher/v2.5/en/logging/legacy/syslog/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Syslog
 weight: 500
-aliases:
-  - /rancher/v2.x/en/tools/logging/syslog/
 ---
 
 If your organization uses [Syslog](https://tools.ietf.org/html/rfc5424), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Syslog server to view logs.
diff --git a/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md b/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
index 0fe7367613c..6c6876d4f96 100644
--- a/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
+++ b/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
@@ -83,8 +83,6 @@ Inside the `questions.yml`, most of the content will be around the questions to
 
 ### Min/Max Rancher versions
 
-_Available as of v2.3.0_
-
 For each chart, you can add the minimum and/or maximum Rancher version, which determines whether or not this chart is available to be deployed from Rancher.
 
 > **Note:** Even though Rancher release versions are prefixed with a `v`, there is *no* prefix for the release version when using this option.
diff --git a/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md b/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
index 35035c0fdb6..32533d3a1fa 100644
--- a/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
+++ b/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
@@ -34,7 +34,6 @@ Helm comes with built-in package server for developer testing (helm serve). The
 In Rancher, you can add the custom Helm chart repository with only a catalog name and the URL address of the chart repository.
 
 ### Add Private Git/Helm Chart Repositories
-_Available as of v2.2.0_
 
 Private catalog repositories can be added using credentials like Username and Password. You may also want to use the OAuth token if your Git or Helm repository server supports that.
 
@@ -63,8 +62,6 @@ For more information on private Git/Helm catalogs, refer to the [custom catalog
 
 # Adding Cluster Level Catalogs
 
-_Available as of v2.2.0_
-
 >**Prerequisites:** In order to manage cluster scoped catalogs, you need _one_ of the following permissions:
 >
 >- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
@@ -82,8 +79,6 @@ _Available as of v2.2.0_
 
 # Adding Project Level Catalogs
 
-_Available as of v2.2.0_
-
 >**Prerequisites:** In order to manage project scoped catalogs, you need _one_ of the following permissions:
 >
 >- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
diff --git a/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md b/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
index 5c4a9effdc8..7b411b55145 100644
--- a/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
+++ b/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
@@ -69,8 +69,6 @@ For native Helm charts (i.e., charts from the **Helm Stable** or **Helm Incubato
 {{% /tab %}}
 {{% tab "Editing YAML Files" %}}
 
-_Available as of v2.1.0_
-
 If you do not want to input answers using the UI, you can choose the **Edit as YAML** option.
 
 With this example YAML:
@@ -97,8 +95,6 @@ servers[0].host=example
 
 ### YAML files
 
-_Available as of v2.2.0_
-
 You can directly paste that YAML formatted structure into the YAML editor. By allowing custom values to be set using a YAML formatted structure, Rancher has the ability to easily customize for more complicated input values (e.g. multi-lines, array and JSON objects).
 {{% /tab %}}
 {{% /tabs %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/managing-applications/library-config/_index.md b/content/rancher/v2.5/en/managing-applications/library-config/_index.md
index a82f70731f1..cf91b118956 100644
--- a/content/rancher/v2.5/en/managing-applications/library-config/_index.md
+++ b/content/rancher/v2.5/en/managing-applications/library-config/_index.md
@@ -51,8 +51,6 @@ When [adding your catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/adding/)
 
 # Private Repositories
 
-_Available as of v2.2.0_
-
 Private Git or Helm chart repositories can be added into Rancher using either credentials, i.e. `Username` and `Password`. Private Git repositories also support authentication using OAuth tokens.
 
 ### Using Username and Password
diff --git a/content/rancher/v2.5/en/monitoring/legacy/expression/_index.md b/content/rancher/v2.5/en/monitoring/legacy/alerts/expression/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/legacy/expression/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/alerts/expression/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md
new file mode 100644
index 00000000000..1cb62c544bf
--- /dev/null
+++ b/content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md
@@ -0,0 +1,4 @@
+---
+title: Monitoring
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/monitoring/legacy/cluster-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/cluster-metrics/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/monitoring/legacy/cluster-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/monitoring/cluster-metrics/_index.md
index 61c20f040c0..0d7175aaeb8 100644
--- a/content/rancher/v2.5/en/monitoring/legacy/cluster-metrics/_index.md
+++ b/content/rancher/v2.5/en/monitoring/legacy/monitoring/cluster-metrics/_index.md
@@ -2,9 +2,6 @@
 title: Cluster Metrics
 weight: 3
 ---
-
-_Available as of v2.2.0_
-
 Cluster metrics display the hardware utilization for all nodes in your cluster, regardless of its role. They give you a global monitoring insight into the cluster.
 
 Some of the biggest metrics to look out for:
diff --git a/content/rancher/v2.5/en/monitoring/legacy/custom-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/custom-metrics/_index.md
similarity index 100%
rename from content/rancher/v2.5/en/monitoring/legacy/custom-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/monitoring/custom-metrics/_index.md
diff --git a/content/rancher/v2.5/en/monitoring/legacy/prometheus/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/prometheus/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/monitoring/legacy/prometheus/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/monitoring/prometheus/_index.md
index 6fd878ec3ff..9325c12a9eb 100644
--- a/content/rancher/v2.5/en/monitoring/legacy/prometheus/_index.md
+++ b/content/rancher/v2.5/en/monitoring/legacy/monitoring/prometheus/_index.md
@@ -3,9 +3,6 @@ title: Prometheus Configuration
 weight: 1
 ---
 
-_Available as of v2.2.0_
-
-
 While configuring monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), there are multiple options that can be configured.
 
 Option | Description
diff --git a/content/rancher/v2.5/en/monitoring/legacy/viewing-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/viewing-metrics/_index.md
similarity index 99%
rename from content/rancher/v2.5/en/monitoring/legacy/viewing-metrics/_index.md
rename to content/rancher/v2.5/en/monitoring/legacy/monitoring/viewing-metrics/_index.md
index a1dd3946219..412ead2d7b5 100644
--- a/content/rancher/v2.5/en/monitoring/legacy/viewing-metrics/_index.md
+++ b/content/rancher/v2.5/en/monitoring/legacy/monitoring/viewing-metrics/_index.md
@@ -3,8 +3,6 @@ title: Viewing Metrics
 weight: 2
 ---
 
-_Available as of v2.2.0_
-
 After you've enabled monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), you will want to be start viewing the data being collected. There are multiple ways to view this data.
 
 ## Rancher Dashboard
diff --git a/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md b/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
index 23534527758..e4f4ea96403 100644
--- a/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
+++ b/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
@@ -5,4 +5,126 @@ weight: 11
 
 Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action.
 
-> This section is under construction.
\ No newline at end of file
+Rancher integrates with a variety of popular IT services, including:
+
+- **Slack**: Send alert notifications to your Slack channels.
+- **Email**: Choose email recipients for alert notifications.
+- **PagerDuty**: Route notifications to staff by phone, SMS, or personal email.
+- **WebHooks**: Update a webpage with alert notifications.
+- **WeChat**: Send alert notifications to your Enterprise WeChat contacts.
+
+This section covers the following topics:
+
+- [Roles-based access control for notifiers](#roles-based-access-control-for-notifiers)
+- [Adding notifiers](#adding-notifiers)
+- [Managing notifiers](#managing-notifiers)
+- [Example payload for a webhook alert notifier](#example-payload-for-a-webhook-alert-notifier)
+
+### Roles-based Access Control for Notifiers
+
+Notifiers are configured at the cluster level. This model ensures that only cluster owners need to configure notifiers, leaving project owners to simply configure alerts in the scope of their projects. You don't need to dispense privileges like SMTP server access or cloud account access.
+
+### Adding Notifiers
+
+Set up a notifier so that you can begin configuring and sending alerts.
+
+1. From the **Global View**, open the cluster that you want to add a notifier.
+
+1. From the main menu, select **Tools > Notifiers**. Then click **Add Notifier**.
+
+1. Select the service you want to use as your notifier, and then fill out the form.
+{{% accordion id="slack" label="Slack" %}}
+1. Enter a **Name** for the notifier.
+1. From Slack, create a webhook. For instructions, see the [Slack Documentation](https://get.slack.help/hc/en-us/articles/115005265063-Incoming-WebHooks-for-Slack).
+1. From Rancher, enter your Slack webhook **URL**.
+1. Enter the name of the channel that you want to send alert notifications in the following format: `#<channelname>`.
+
+    Both public and private channels are supported.
+1. Click **Test**. If the test is successful, the Slack channel you're configuring for the notifier outputs `Slack setting validated`.
+{{% /accordion %}}
+{{% accordion id="email" label="Email" %}}
+1. Enter a **Name** for the notifier.
+1. In the **Sender** field, enter an email address available on your mail server that you want to send the notification.
+1. In the **Host** field, enter the IP address or hostname for your SMTP server. Example: `smtp.email.com`
+1. In the **Port** field, enter the port used for email. Typically, TLS uses `587` and SSL uses `465`. If you're using TLS, make sure **Use TLS** is selected.
+1. Enter a **Username** and **Password** that authenticate with the SMTP server.
+1. In the **Default Recipient** field, enter the email address that you want to receive the notification.
+1. Click **Test**. If the test is successful, Rancher prints `settings validated` and you receive a test notification email.
+{{% /accordion %}}
+{{% accordion id="pagerduty" label="PagerDuty" %}}
+1. Enter a **Name** for the notifier.
+1. From PagerDuty, create a Prometheus integration. For instructions, see the [PagerDuty Documentation](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/).
+1. From PagerDuty, copy the integration's **Integration Key**.
+1. From Rancher, enter the key in the **Service Key** field.
+1. Click **Test**. If the test is successful, your PagerDuty endpoint outputs `PagerDuty setting validated`.
+{{% /accordion %}}
+{{% accordion id="webhook" label="WebHook" %}}
+1. Enter a **Name** for the notifier.
+1. Using the app of your choice, create a webhook URL.
+1. Enter your webhook **URL**.
+1. Click **Test**. If the test is successful, the URL you're configuring as a notifier outputs `Webhook setting validated`.
+{{% /accordion %}}
+{{% accordion id="WeChat" label="WeChat" %}}
+
+1. Enter a **Name** for the notifier.
+1. In the **Corporation ID** field, enter the "EnterpriseID" of your corporation, you could get it from [Profile page](https://work.weixin.qq.com/wework_admin/frame#profile).
+1. From Enterprise WeChat, create an application in the [Application page](https://work.weixin.qq.com/wework_admin/frame#apps), and then enter the "AgentId" and "Secret" of this application to the **Application Agent ID** and **Application Secret** fields.
+1. Select the **Recipient Type** and then enter a corresponding id to **Default Recipient** field, for example, the party id, tag id or user account that you want to receive the notification. You could get contact information from [Contacts page](https://work.weixin.qq.com/wework_admin/frame#contacts).
+{{% /accordion %}}
+
+1. Select **Enable** for **Send Resolved Alerts** if you wish to notify about resolved alerts.
+1. Click **Add** to complete adding the notifier.
+
+**Result:** Your notifier is added to Rancher.
+
+
+### Managing Notifiers
+
+After you set up notifiers, you can manage them. From the **Global** view, open the cluster that you want to manage your notifiers. Select **Tools > Notifiers**. You can:
+
+- **Edit** their settings that you configured during their initial setup.
+- **Clone** them, to quickly setup slightly different notifiers.
+- **Delete** them when they're no longer necessary.
+
+### Example Payload for a Webhook Alert Notifier
+
+```json
+{
+  "receiver": "c-2a3bc:kube-components-alert",
+  "status": "firing",
+  "alerts": [
+    {
+      "status": "firing",
+      "labels": {
+        "alert_name": "Scheduler is unavailable",
+        "alert_type": "systemService",
+        "cluster_name": "mycluster (ID: c-2a3bc)",
+        "component_name": "scheduler",
+        "group_id": "c-2a3bc:kube-components-alert",
+        "logs": "Get http://127.0.0.1:10251/healthz: dial tcp 127.0.0.1:10251: connect: connection refused",
+        "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service",
+        "severity": "critical"
+      },
+      "annotations": {},
+      "startsAt": "2020-01-30T19:18:13.321684733Z",
+      "endsAt": "0001-01-01T00:00:00Z",
+      "generatorURL": ""
+    }
+  ],
+  "groupLabels": {
+    "component_name": "scheduler",
+    "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service"
+  },
+  "commonLabels": {
+    "alert_name": "Scheduler is unavailable",
+    "alert_type": "systemService",
+    "cluster_name": "mycluster (ID: c-2a3bc)"
+  }
+}
+```
+### What's Next?
+
+After creating a notifier, set up alerts to receive notifications of Rancher system events.
+
+- [Cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) can set up alerts at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/).
+- [Project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can set up alerts at the [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/).
diff --git a/content/rancher/v2.5/en/monitoring/legacy/notifiers/legacy/_index.md b/content/rancher/v2.5/en/monitoring/legacy/notifiers/legacy/_index.md
deleted file mode 100644
index 4ef7026a9ac..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/notifiers/legacy/_index.md
+++ /dev/null
@@ -1,132 +0,0 @@
----
-title: Legacy UI Docs
-weight: 2
----
-
-Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action.
-
-Rancher integrates with a variety of popular IT services, including:
-
-- **Slack**: Send alert notifications to your Slack channels.
-- **Email**: Choose email recipients for alert notifications.
-- **PagerDuty**: Route notifications to staff by phone, SMS, or personal email.
-- **WebHooks**: Update a webpage with alert notifications.
-- **WeChat**: Send alert notifications to your Enterprise WeChat contacts.
-
-This section covers the following topics:
-
-- [Roles-based access control for notifiers](#roles-based-access-control-for-notifiers)
-- [Adding notifiers](#adding-notifiers)
-- [Managing notifiers](#managing-notifiers)
-- [Example payload for a webhook alert notifier](#example-payload-for-a-webhook-alert-notifier)
-
-### Roles-based Access Control for Notifiers
-
-Notifiers are configured at the cluster level. This model ensures that only cluster owners need to configure notifiers, leaving project owners to simply configure alerts in the scope of their projects. You don't need to dispense privileges like SMTP server access or cloud account access.
-
-### Adding Notifiers
-
-Set up a notifier so that you can begin configuring and sending alerts.
-
-1. From the **Global View**, open the cluster that you want to add a notifier.
-
-1. From the main menu, select **Tools > Notifiers**. Then click **Add Notifier**.
-
-1. Select the service you want to use as your notifier, and then fill out the form.
-{{% accordion id="slack" label="Slack" %}}
-1. Enter a **Name** for the notifier.
-1. From Slack, create a webhook. For instructions, see the [Slack Documentation](https://get.slack.help/hc/en-us/articles/115005265063-Incoming-WebHooks-for-Slack).
-1. From Rancher, enter your Slack webhook **URL**.
-1. Enter the name of the channel that you want to send alert notifications in the following format: `#<channelname>`.
-
-    Both public and private channels are supported.
-1. Click **Test**. If the test is successful, the Slack channel you're configuring for the notifier outputs `Slack setting validated`.
-{{% /accordion %}}
-{{% accordion id="email" label="Email" %}}
-1. Enter a **Name** for the notifier.
-1. In the **Sender** field, enter an email address available on your mail server that you want to send the notification.
-1. In the **Host** field, enter the IP address or hostname for your SMTP server. Example: `smtp.email.com`
-1. In the **Port** field, enter the port used for email. Typically, TLS uses `587` and SSL uses `465`. If you're using TLS, make sure **Use TLS** is selected.
-1. Enter a **Username** and **Password** that authenticate with the SMTP server.
-1. In the **Default Recipient** field, enter the email address that you want to receive the notification.
-1. Click **Test**. If the test is successful, Rancher prints `settings validated` and you receive a test notification email.
-{{% /accordion %}}
-{{% accordion id="pagerduty" label="PagerDuty" %}}
-1. Enter a **Name** for the notifier.
-1. From PagerDuty, create a Prometheus integration. For instructions, see the [PagerDuty Documentation](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/).
-1. From PagerDuty, copy the integration's **Integration Key**.
-1. From Rancher, enter the key in the **Service Key** field.
-1. Click **Test**. If the test is successful, your PagerDuty endpoint outputs `PagerDuty setting validated`.
-{{% /accordion %}}
-{{% accordion id="webhook" label="WebHook" %}}
-1. Enter a **Name** for the notifier.
-1. Using the app of your choice, create a webhook URL.
-1. Enter your webhook **URL**.
-1. Click **Test**. If the test is successful, the URL you're configuring as a notifier outputs `Webhook setting validated`.
-{{% /accordion %}}
-{{% accordion id="WeChat" label="WeChat" %}}
-
-_Available as of v2.2.0_
-
-1. Enter a **Name** for the notifier.
-1. In the **Corporation ID** field, enter the "EnterpriseID" of your corporation, you could get it from [Profile page](https://work.weixin.qq.com/wework_admin/frame#profile).
-1. From Enterprise WeChat, create an application in the [Application page](https://work.weixin.qq.com/wework_admin/frame#apps), and then enter the "AgentId" and "Secret" of this application to the **Application Agent ID** and **Application Secret** fields.
-1. Select the **Recipient Type** and then enter a corresponding id to **Default Recipient** field, for example, the party id, tag id or user account that you want to receive the notification. You could get contact information from [Contacts page](https://work.weixin.qq.com/wework_admin/frame#contacts).
-{{% /accordion %}}
-
-1. _Available as of v2.3.0_ - Select **Enable** for **Send Resolved Alerts** if you wish to notify about resolved alerts.
-1. Click **Add** to complete adding the notifier.
-
-**Result:** Your notifier is added to Rancher.
-
-
-### Managing Notifiers
-
-After you set up notifiers, you can manage them. From the **Global** view, open the cluster that you want to manage your notifiers. Select **Tools > Notifiers**. You can:
-
-- **Edit** their settings that you configured during their initial setup.
-- **Clone** them, to quickly setup slightly different notifiers.
-- **Delete** them when they're no longer necessary.
-
-### Example Payload for a Webhook Alert Notifier
-
-```json
-{
-  "receiver": "c-2a3bc:kube-components-alert",
-  "status": "firing",
-  "alerts": [
-    {
-      "status": "firing",
-      "labels": {
-        "alert_name": "Scheduler is unavailable",
-        "alert_type": "systemService",
-        "cluster_name": "mycluster (ID: c-2a3bc)",
-        "component_name": "scheduler",
-        "group_id": "c-2a3bc:kube-components-alert",
-        "logs": "Get http://127.0.0.1:10251/healthz: dial tcp 127.0.0.1:10251: connect: connection refused",
-        "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service",
-        "severity": "critical"
-      },
-      "annotations": {},
-      "startsAt": "2020-01-30T19:18:13.321684733Z",
-      "endsAt": "0001-01-01T00:00:00Z",
-      "generatorURL": ""
-    }
-  ],
-  "groupLabels": {
-    "component_name": "scheduler",
-    "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service"
-  },
-  "commonLabels": {
-    "alert_name": "Scheduler is unavailable",
-    "alert_type": "systemService",
-    "cluster_name": "mycluster (ID: c-2a3bc)"
-  }
-}
-```
-### What's Next?
-
-After creating a notifier, set up alerts to receive notifications of Rancher system events.
-
-- [Cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) can set up alerts at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/).
-- [Project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can set up alerts at the [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/).
diff --git a/content/rancher/v2.5/en/security/_index.md b/content/rancher/v2.5/en/security/_index.md
index f6dab0d5c3b..d93f5e2d328 100644
--- a/content/rancher/v2.5/en/security/_index.md
+++ b/content/rancher/v2.5/en/security/_index.md
@@ -33,8 +33,6 @@ On this page, we provide security-related documentation along with resources to
 
 ### Running a CIS Security Scan on a Kubernetes Cluster
 
-_Available as of v2.4.0_ 
-
 Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS (Center for Internet Security) Kubernetes Benchmark.
 
 The CIS Kubernetes Benchmark is a reference document that can be used to establish a secure configuration baseline for Kubernetes.

From 896424f6da509b5d6a44977b33c1f87bb49dcde4 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 7 Aug 2020 17:13:51 -0700
Subject: [PATCH 187/265] Add preliminary draft of Rancher 2.5 logging docs

---
 content/rancher/v2.5/en/logging/_index.md     |  41 ++++++++++++++++++
 .../rancher/banzai-cloud-logging-operator.png | Bin 0 -> 413279 bytes
 2 files changed, 41 insertions(+)
 create mode 100644 static/img/rancher/banzai-cloud-logging-operator.png

diff --git a/content/rancher/v2.5/en/logging/_index.md b/content/rancher/v2.5/en/logging/_index.md
index e67fa1ca652..ae8054f50bf 100644
--- a/content/rancher/v2.5/en/logging/_index.md
+++ b/content/rancher/v2.5/en/logging/_index.md
@@ -5,3 +5,44 @@ description: Rancher integrates with popular logging services. Learn the require
 metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
 weight: 9
 ---
+
+- [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
+- [Configuring the Logging Output for the Rancher Kubernetes Cluster](#configuring-the-logging-output-for-the-rancher-kubernetes-cluster)
+- [Enabling Logging for Rancher Managed Clusters with ECM](#enabling-logging-for-rancher-managed-clusters-with-ecm)
+- [Configuring the Logging Application](#configuring-the-logging-application)
+
+
+### Changes in Rancher v2.5
+
+The following changes were introduced to logging in Rancher v2.5:
+
+- Rancher's logging feature is now powered the [Banzai Cloud Logging operator](https://banzaicloud.com/docs/one-eye/logging-operator/) instead of Rancher's in-house logging solution.
+- [Fluent Bit](https://fluentbit.io/) is now used to aggregate the logs. [Fluentd](https://www.fluentd.org/) is used for filtering the messages and routing them to the outputs. Previously, only Fluentd  was used.
+- Logging can be configured with a Kubernetes manifest, because now the logging uses a Kubernetes operator with Custom Resource Definitions.
+- We now support filtering logs.
+- We now support writing logs to multiple outputs.
+
+<figcaption>How the Banzai Cloud Logging Operator Works with Fluentd</figcaption>
+
+![How the Banzai Cloud Logging Operator Works with Fluentd]({{<baseurl>}}/img/rancher/banzai-cloud-logging-operator.png)
+
+### Configuring the Logging Output for the Rancher Kubernetes Cluster
+
+If you install Rancher as a Helm chart, you'll configure the Helm chart options to select a logging output for all the logs in the local Kubernetes cluster.
+
+If you install Rancher using the Rancher CLI on an Linux OS,  the Rancher Helm chart will be installed on a Kubernetes cluster with default options. Then when the Rancher UI is available, you'll enable the logging app from the Apps section of the UI. Then during the process of installing the logging application, you will configure the logging output.
+
+### Enabling Logging for Rancher Managed Clusters with ECM
+
+If you have Enterprise Cluster Manager enabled, you can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app.
+
+### Configuring the Logging Application
+
+The following Custom Resource Definitions are used to configure logging:
+
+- [Flow and ClusterFlow](https://banzaicloud.com/docs/one-eye/logging-operator/crds/#flows-clusterflows)
+- [Output and ClusterOutput](https://banzaicloud.com/docs/one-eye/logging-operator/crds/#outputs-clusteroutputs)
+
+According to the [Banzai Cloud documentation,](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture)
+
+> You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify.
\ No newline at end of file
diff --git a/static/img/rancher/banzai-cloud-logging-operator.png b/static/img/rancher/banzai-cloud-logging-operator.png
new file mode 100644
index 0000000000000000000000000000000000000000..816d2406aef4fd7325ed19d2da1c680174e960e6
GIT binary patch
literal 413279
zcmeFadpOi<+Xh^sELMxLEkum$H>oi8l28dNg=||?l<j0U3?`yx$WX1MvTZ|U*Cb4K
zBh8q0NJ93EYO)=Z&0sL!{nPur-yiSy9LLQ6-ydtOj`bXinft!3^E$8dI<Nb|IXT#F
z7m^X$v}x1!BX-s&Hf<6X-?T}nRB$W!H}biT=QnNIz3GVc!IP-XQv*H$C%3J0I7c*2
zIz4*1diEazDOguXSaXU|E?o9j#bN$@NkB-}N{K|@cBGAVWP{UW+wJEP74K`(5_Bdq
z)})U0q_ls&*hc<W?Q{O|<rQs#=&CA=)P*vE!FAs&(%$o{D1~sE@?G+iBRL;U`L5i<
zg#XZ^=advzSiRo1nU7ykbhqW@P5=KNEH7Ig5`HNul+qh_U_LD}jJJbvKU|<9=Fl&c
zvTb>Xv{p?jspkk!hkC}F-{#He(<`ICj*&4)bmS?2_1>?i9K5GB_Jm3tdsj%0a^X~8
zXn)t)>&F_Q9IxA^8}d~@%uJqg=~sUFrJF4e-5f$%NMmzMvtGY>dMzhnLV*(8MQUMq
zcHXaF{3sl+OAVJi)}>mMk$t#j?ot#=jF+2FEP`bl$l)&=CXHfaE1gi_BXo!^{rC~D
zYP%@6qGlHM?bdu5OXrcT#gY<wUc~FDqsW?x8G5~LQUQ~ozcxQvGXD6(oz99zwqApQ
zY0f$Z4j-@Sv3b#+%lUDQz(~u-<+ozmP1byhFw1O<&b4dpLs)w1EW+xWmgP|RuLwEk
zs34OSj9KJaQ>h(>t+GE-cneyhYohwtD5r!y$a(1J@xnkV(eE_k!Kh%gPakIGsC5Hu
z*+x!IF^vE9{+Msf+1y4}NTV+88y3%*BynzsScLs3Hr<Dh9CJH>Zz7IS5>+R+wa{p2
zGvulqFL~3{ED=y5-5nLQ3pI6Ddc_;R$<S)RZLRgqsM{a-J)<Uvo6>(RU~f3)vdum0
z@KxUgucv+gW&t})4V?NKJM}bnYf2Ik^-tbs{5@XM^^9@iyUobQpS=gXy{d`~W3)Y(
z+Ny?ry)1BHXVc!Ki*0RhL0Wspt>0I8q5s`fr;Tsy#3i+?v^0~FV=7ciGi}^K%?Hj4
zL<9sS9@)&Cct7$0AN;P*O#z>6AioVCcXJU02Ar6i9u{4=iqEhh-P4w)u3RGI3}|KD
zd<c`O&{XhI(F&Oo@9%)|0!d$_vn52OHEu5oV)Oe?uXzx1R{iH1Z^1W0$&u99cY-+^
zabpgOw=SC7`56t>3xt1jQlBHHiUiXpC)rxO+~KCg7^whF3867K?dao%uO40maHM4h
zyYc!%;}6_@WRK{2HRd#Sa?ZI|y2U*qmaUY$`v;lrpAnN#XSR#CUxeF?R18iV(U*$!
zJ8dWx#exzoat6Jb`Sz{Z&K!_9^G!D#KX0$wS{~YGhGIeyr885ib5}_#%0Y~m0~E~;
zPduVYo_tTe6M6fVD?E0vp7G62YtsAG#T1mmoh<e>oyYwmIm_x<d38tM$x`wrF8$5S
z$)C*Q4dG6nIbprppT|nbODX&Q?Z+{;qYrLmp>KB9tZcUJJgWaANwYhZrC^SRu*|%s
za;2timuiB#MpQaa-{#|O%RwyB?dV^JKh@Gd*^X25Jrwg8mzPTz3HF>{EKE_%NzVb7
zwcAfn<vN>5cX&vpPqBQrlxPq@H(JZVn8iM6Sh|T)TfVN(<@LqBx5OtK*l?Iq7EOqy
z@K8Pyd&RQlV2o0o(*UcbG>IE$twb|D-#X@k!9NoDy!!!di>>*)tkksrXBe+R^pyVt
zT5qlLsyq)EZaF7xpNbVuc{vRQ%Fy$`krfEO&DRISm{<P1T8y4Comro#Q}_+Ovvnmo
z_3lp}O+TRhAfXzpc=$z4Yk~uR;WR-yI+=V>%>(I{f7m)M_UEujL}YX=w!3FSS1BJv
z?*W%bV`fudvq~i;hugo8`v1WLq_?W?)ltF=^e>ofRZ!2md5B;WH-AOfnham?8%z<?
zqu!f`q6_>l4@=M)YeAPzdIkixIro<+@d9JnHoJF8i`kx)5w3=+EQe{q>3Lf<`i~-$
zPXrfug)aC8E{ge)(s&0Ps&+GTs(lH)C@Sd~PFND-A<+vi@T=I8J+{efhLo)9`*s4r
z(ohO{fF&BJ;Vt7L9xt6F)YLW~MRt02dJFRKbI+*oEelPTo$JFMF*)|GB`%$4V7kD%
zQI!4+q;q<iM07NXoq3yf*VCl&8V@<}JWN2P3>MvR)AV9GG3Lss31!5!-1|5LPTE;F
zouT9Yc$C@PK-^`-%ZD{iJfeuCR-X+ng)uDR7F()DM~l2h8l0W_Cwwwk>p!>ooYkZd
zoEmEP5udajWk%4mDtM|92c9%N!V>G)gV$;Sg2_g0_q2f6Ntt|S>{?CMUDC=7b^h^M
zafK-aJG8b5F-^+$*uy4Tyu|&V0xBtFuL|W1sblY+Vr@tbQJPAUotK`NZCj^uR(;_2
zqeQ${gWJ&-(h}{nN9TfhL5LPHJ8BA<U;`o7DOaQAAkJu|;l;7PG1B6WrrYodvxj9q
zbme{*cci|$b(oTJFZ>z7A<Fg;F95w)1Ij7E1HPZ2s_kpEyuruB-~7#y67MnDX1=~U
zQC2|wH^|e~eEs=tU)ByD&c@PD_{(-&-TQYXluMW9zPw_jkm1dvv7@sm^VtyQw6Y!W
z5w~v|wn(J{;AsAO6j@kC(EY>KmWMA8usso}h)m9BssTXQxM5DKh?TD*(=2yO&(&+4
zcNX&-e+{%v45tEOL#x*iO!XKmr=8-Vwg_9DIbl~{9v62S;t!{KHC-!)oUM(!+{@Z)
ze$+D8-}r|{+`iRrT>Y1+iki15OJExhJ-`8yrLnrQ&f>{Cw)3w*-MUcvJ{9A!e?2#i
zwFXgZD0;LOU0ki5JOM0=yQJRd+?*5Q1vJwY_sWR5YD~i-Z3cGU@J}Walr)v4VC{#U
zAn@EE6460si~kl7^=A0-N!)`%fKj5cBJ$~qHDF$<R<u`GyEO;orG&pgBk(?nwo$~@
zLSEg^khbUkI!)aY-vLBO+u~?r7dP@&^@4odiu0<;9lE8wL`820C-5NiN&_4f#eEPK
zoZ~P03kNX(A)GBgIee$6<LY2>TYSE@gmld*jQ(M#f$n{GilmQn{~<-Q4<%Mx{d38#
zzLxd1-C#<F7;?kS+Ei~oHv{7%EAK!}qMca438s$y{p4gHwXMhMpp)q}!>uG9_<O(~
z8|ToSNHv(2uP1`Qkiuz;S$qmF!2CQ>?X<zC8UZTWISq&z?$N!;{jFsyKtCDjA9)1A
z6L#W$3ySenT<NFSzb2`jxm%!CE}hsgdHY+3x>PEieu=5Y3t;_#Wy^_Ce+7a}5fe*8
z7pI{W$UW;&J0(C_Hb&;A(0;r+(7;O*+B6{aMFa;i{C<eIlzTQ@yn(WITHXC%bUZH{
z!b5{;qZnfmfFLg$oSwdv7J5jZ8}L4mV8TNoD%i<Cag7`pd#fjpJ%*bHoKZqd7$>_Z
zhwYm3RX0*r3%QEE(Zd6a_*i4<(MXdiDIXkUn7=HKTODmX@q$p2^C&+d_y(%>oTm?Z
zHn0`KCk~p!xgQ1iH&uXA(}U~(!G7>7j+Y}(*}Yd?8NZ_vYH+P+orgF;A#jH=u4JHO
z$IY+{Q&6WseWj`9Em$K@wc|d@O#>2Z6_J32JaBVZpX)|TCzIhxgEm4}84+592e|?i
z-M>uL)e=6{NVhw3|5FbTEn_uR%1`#y)eXn1(LQu}Y?Y1%=n3=$J3B39?@W4Ahe)HH
zA&7dnfzw_$w^33+!{xNYY*;v@dMjz~E_oiV^-Q_IL^ApI>%){2mja;PaM-)@ExK6J
z(<gKwT-kSN#v*scR_d+mR_Vi97K&<llfoYvsyy8Cfzqb0O324ItLd-L{T6OM10Gkq
zTlxZ}AzhZ$#zKb&qY&w8>k#*DYiA&OLbp-6L0rvzYvNviOEi+)AuUGr4J2n#0Iv8N
zy@~<A4Q}JXz%m{~r!6-E8WZuRJaKXtxRRZ8RL*1)&8VSf={xsfWO+q+KnN#%!NdA?
zj9r|jii5+n(fo}}H@kt8bW6^s#}S<~uhT%Ms30#bA^o`{@U<24%5bF|50|kwjnA)y
zT&0L~HHukSj#upjWz^u5ow0OaO#;2yBX|h2G?lL3@GcN0PCtk&JaIvH;ICAFrr2Bw
z_b0WPFI|1Flo(Y5DeqDas>LKYt7RtL%C~T~SvbZ2SDqI@XG4aGkr+KTVaV1VW1?2=
zFpyoNWqX+W2>zJWM9f6^?C}PKC=6ie6ltC9BZafQxBpS@k)VE|;kof1*G@>PYca~N
z5Vt+4tCm;haebHvR(9aIrLmMaT@lHD8^R=Cf_|2VhoahojE70~`iEi8-4-KK?1vGW
zsaoSMajHJ;3it58`%@fW<e`n~d|C_WL4;Fh`}=MLm(+7$t+u8<5YL>pVonzjcdLao
zvh!W7xjq<o_cL0`<tINcy7{HsCjaa8{aYpIUSVPxf;f*oD)=675x<Y+haS>X1Q`s7
z*oyf$MVwp7BJsSWU1c`H_ub4)w8DEon!oo?bPN>rgfD$Z6`%HK<lw{4K=q&&@Xh4~
z(H<Kq3F#0o-PTyc*;?*nD6v~?hsU0_L$sh9OP~k>LhQ)-v`3L}ik4-%t+B!2rj7mZ
z!qHy=jZShs*hpG;?ZMb8uJf$moq$S(n7<xUJ;o0zy{E^kKKH+;H$f68z$mp0oZsWG
z#>iX4VhyHTQ=Cu6d^J`yH}_Uo96W1k07<(8vF*-^it2Al(^pdc+r1F^jl(^6%+^;|
zCdX$Q(493Iay!`rSB%SD5{3fbycvfIt8ukFTBAH2b=^l5ANZD+3Bj4sKY)IIp`V<I
zTF81$0pBA6x(0V6rQD33_0dmGE7$V!BEG-BeWB1PyTk9@=f~rWe2jVg+{o+s&)+}z
zGH$%`!Otkv{u|N<G~ZHjx-ezz3N5JsH9E+V)8iWM10oYWO31g58do2cD?AHn>7`;A
zbnpzkby+Y<cG}1{9^pHJP4br!b!5f2m%HCClQ!&|45}XMO&Iy;2sKeXEo9{M*@Fqz
z%jVq2%Vs`dyEC6PkWxoNc6tt+axiCu1iiqF%90NCJB)C_77Jft&;wzTq~RWV{Qd7N
z?TiN&>#G-QF90#!ZKiyCs$VbL#VIHkwHbU{4er0~g+vcUNGLql)ddP16KnaR^53Ai
znGDs>09aE``0E`VY=~x*YQu)r5%?#F?u<FX?)=J{=es7!yZUcd#n{XBv?fRT3RAS>
z0~csqHxy0HqS-Hx<_J(8mXJdmq7Pz?k0~NcVYUP4;!UV(Qsde26PlFDdHL>^ulWh_
z=v+j`EL7>=8Z(=TOrxV*2esvHal3w{gq(}Fm-=R(XQQO7zKC4A`uVn|>(D8?dK!~j
zxrE^RW-&kih!C(^w=mgRjG4QSPQ5v7iu!~$5@wtWcB+TkDJ_(vyDFd?!YN<&5$br*
zd_R5S>(xMlZt024<g?QfMzu#*9XNMrou{#m!;Hyee!EaAX>Tay<@4<oq`bVkuyy<*
zA!2p$27Dv9(`QjCB#XuxgR4M%VgGvKrP_9dM$Dq!lS#)3P`1YlM{qxADtIgqQYHqf
z0hwG<^QX=X(9X28Zrum^OGCw{6Hkn9+Sr+PzKvGd%#0`^n3~=SIPDaN*~}!f&Oi_&
zS>x(Tsk-HL2t*0;IE7XdNy}<{9n0h%vkC=@Joo4Tl?RCVO3IDxr)c0NW_Ga5>n?U(
zcfqP|Ep=Wq=}wJi45F#@^o6mf3D??(y@DX^Z@kD%)zQ}8v(CX&T--x7<fljB74ByW
z+Uk1~ZX?omLtk1eA5{zJvrjzh;n#U{Um7;nwcOKaS_5fK3YVN|Q$Cx(etW|Rz5XiJ
zD}4nG)%ee^#>l$Gf24Z+(iuC<b(MiAL}r;7_0q*?R-H&$`JXzV)X=IYe1OztcQ#f5
z)Z_{R!c$FR!aPgM>t18b>`0F6uzCP~4EvM#_m;tw2v4YmiVyK$2<;@30oj}L{`rJ!
zII+|e8gSnORZ$>nghn1N70WkfH8errSTLnn2sbu2w{vz#T@C*;M)7c6dR!@_c<4g%
zzlvH2<$ih(554w*?52N9Hkuv-=(yg#KL1d`gIuR6kBNJqjWU<Qsmf6FC_>DWiF5t7
zc)?T#T)w?QL~dDmT0^zMVdFlZ-!FWl$TeZsR@+O_V75)%EWh-t*Ms3Dnl)tWR*Pl~
zsXrV9nQXeZ-|bMIh8lj!NW^!|=u*2BKoI@Gm*`pFMhCf)VJ22!)=IHKl36pdi+W6j
z>tD++V|(WPDH<eifsv{AtJsA+zxOU8e;0dfN{H%uwrysG-s6+MFCsxS?OiLXvHm4z
z{&w3hTydGWVcYTc8$9UKetb3EfBUKH`y5aIsh4#!?eVvtd509tW=A3ww-t3#Y8k8r
z{p8?MQE4H*@e$mAyZ|XjL?+3sMmtY*8#F507-o4oLu9+HV*e!B&rlJ={TcJiXEr@L
zMbnBH*hfS~G6?zL#Gi%_8(Po0%lhj)B2{?4x^&`^>}UwQRE&-fRWLfi+A)T(kdyhf
zo-u$qS^rN@(*hO;|I+S9gLsz4NsZ|gEB>_<)DpKm4Ju(Di<_oT(FA4Tm#%;Rf|bvY
zDP(-7ucNH&Kmv`w5~delj~EM#`PeUraga2lzPJRJ8@95z3eA6iYVDB??7@xQt7~x3
zQpsyK$*1$6-tS9%sh#!r97NCYBLugjc$-bHKEd0z#jJ+Po4OgQcr%yAwoCuCIUsk8
zEUp0CX<_%~e9X*x;js&>e1|nSpgsW><u!jyl4p)_jgObXY)~A`23x4)(<8)lVa$mk
zKMPF&&_HC;Rc^>QM;k8lu~2VIcVmf|nQf=907f+Emp;}Iv3%*xE{0Xw^@{Bx#ZVsm
zxSBTxK@`fFOb(ulT0kptUoH!}1U_qlz8cVPyVgTAH-~s=L;;WU3;=1pE3|aQ!E+@Y
zLyG@qcc|qRA={II0#z*V?O5<j7TbX;er!1R@mW7lKZq81dtN#HRRKv7;r_Q@Zdw(*
z4$l0Eo|H2@0-EbWwPJTe1_**<lPRy5uS^aXi%d*9YpWYxTwN{5nOTT|#*2d(<An@j
z3(fsQ`71Ct{-20@c#yg3xt5p0eOD6@oCpZI;Lf>ov<}LbbAbQuZ>FNtRn`XV&eweM
zr46E4-P;Ss=7u^w7~^XQPtXSXG0|SjOE0jvxk%a{dIZ4a8x7G5T;KW`bAIT&x8vr1
zBMZoxxcdCC7hRaeH-&|@|IEC<tts1m%07<sdN#L>J-w}M^(1Jny2z2VqkDFFso(=U
zdE(d(0-vj`z%*Z1Wd>M7tY=ZhYM*<GMIbIxA}elDck$Gl7BUp%tZWQtb#6QQqwut8
zTruZE#PQHy?(*V}1P9Y%SCWqd*ZrK}%W6wNrH?(S(nFHdnLnX{-YoHxQmc)Lw;pqz
z5c#mdXD-t8H%8OHjYobT`#_5=Nymj&h)b7>*DRX#m2fYngsW%bDdZB(D`_vXk)XBJ
zQkf|$2fy<If5x1otHI=49OA&q=<m^>jo2Po2WmzwRW3iYn>Bv0z8q4x=z7cv?JH?>
z1xryNgrD#fyE%f7f>Vy38_+=Vr^Cdfvu>uhuQ8LuBF;v+L<*-^4I)?v`Ahf5IOs8_
z>KV~5Hk1n5;>0uJkBfdZH=&HcN+(hA_IG9Nx_h`UN<u&lf$9ACK<@or5>NbU0kr~$
z^EjZgKDe?FIYtLv8q(q8XCqi46OzPw=2a>v#>@jCR(%bFxX;Zq)dIfE1HmN#8cdbj
zK#v#%^3$0yk5QM)eH<1+8O!KN4~M|OZY(9LKH7a#$d?Mt%0gE}XWp&i%D|9_Ttqol
zaCNLt&Pzo~ynS)HoxweY<KKwdyb3Yfrfll(DcOg2t-u7*msuG2@M>Y_uAY;}NSL4F
z7Z78BRZd)OPXQ(VH!?=d2#*HdXXVPBCi%_Ya1+P~+*>DQ3uv^B?G@h|o@R7GLf12J
zJ-0I~<P`n19z_Km>$b6v3r4vijE{ZT$Qr{>=>j7*!rmOvB1dLKLQxi7ntnc7ms$yR
z5zs&agy+M9$mDfjT5mml*^6tWxNNEONh+`yYE13rKq_5_iC2st_eNjfjBB#QY*y~x
zsC_*RYU1S9TEe2NPoQ!Q_Uaf>#awA$$fL2KEWen^2H^`pUEI+#^izK+tW?|<1o+RN
z`;Z<9%#~Z*W905I5}%(Q(mHJ!$YbJQ_Q9#;%=XH*iUk_HpUl?y91pnARb0fd`K7Zb
ztaEHB3V&_a|A;hrk2aR2A_14bFy898o^PsxPnjj^j47%#4twP0bD!Y+6aR0PU5~Mc
zI%SiU*V4@$H&!&?uw*h@UWCg3a9EvNYizta3)Sh!3_Wv9MMZ!6ag2QY!eGWmFHte9
zw`Ave1wc}%IJL^S*1?nRzNpT9GF)!*68-{ImYw>-GQR`yp0}*LRA!s6Q{4Ek?-4+p
zi1Zt@aZ^nI>O?J7YBW6VxP)oEM4W}W?zBbxV*{18?q&c|WO8(T_}mumgP>^_f1mI7
zmnV);wZ-WrWJqp^zAdiE)UqL0-GD@y;y<G}pE~E7k_JH@6#bc7Cf4p{os%yM6PHFm
z`vCu`&>*GYt*z4drtIS#uDkV3iD=l4G#uRJqdd^r0Y>iEop0FSc&3-;=~Gu95gg=@
zA*E~GXj3eRf72ot6UHKB#UVD-YGmMCLw9=S_~gUZshCY_5<<+`gWOjSQKCX3R;;u7
zw^~OLl!mK#LwO8Iyo8&57xn0IjYEQ0CsWAFbl*LwMm!iHg6`fS#uR8X`k~Z)J{7NE
z`Sjd%-A=*fF`4Uuf7{1dun-o<xc><D@XTsSU=TA^+0bf(?V&MxVCf?R->_bLs>F>D
zc@f9ea7d4e(~=klLzJ=X_UEte4h`4EYp)%;^SS)QFPmWd9IyLO>s;2NZ&K@E+FCWu
z6E!puvd826{?PYPfjVfQn7o#me)~2@W<dR0dJ~E@)DRx^C+rVfEmOU-<!da^XMOCQ
z8x9WYpBm;sGV;cRg1q6;Iy|DQ(m2-o(U6CRBwGDbR@r?AHx+y)g0H3A^`<Qt#`_a)
z#sciKGo~J7+9wSGcA5|Li-hi>G;B8fM5D9aD%1~E(SsI6Q3l?_w@dyb+cJOZFV9ZA
z`#=tkj%j7{FoV6^lx-;`?y7MCZJpZtYaB3KkiftIXbOC7isN$E$T62!5`2bVPBtx{
zm<8J4dgDWyp@_V_tLggEu6*4*O$&2O+q6|=83R%(m40SCw<v$-ri!0DAdhT4&w&+y
z`kOJ>w#oxzBpyqQ@U+iKN!8aw((&S?DGk-}<<JDtTW!t&rN_ZV3?S7J8L56x5iVCa
ztm6E(pJu7UyO6W?N;K48ip*8Y8!*dQU4z^s*7kCf<QV%L0gf-NuD*Slhm$!Yl=!j?
zOf4Z>&L{FYn${U$*Ob&_0wc`MlxO08cAQ3*=mKDrJGYTy-0ClVe?Q-Qs^l{yc13{T
z>4p1_EqR*$V%#6khpD4Q7;9$rK6O}}3GgBqtnEXtUfZO=Jw^ev5PPB^Zd<=Y4+#p6
z8<-C;3{&UlSW=I?YvYX4Em1{GMo|3l&Bw<&S?rZ$@*L5|iy^b2pYHO=Fgq1`7qPy@
za@F>-)j|6>#~O1B?xzQW$xYv~iNwlUWqH_M^Es>G4^T%`A#J=e&>+yvqDg7Kfi1PU
zXqgT&Z~|lD(rv;xg)log`nwJLMV6!Kt{z|hbx0rE$n{ce8gB444>-w|47jhMf)67=
zlW(9;OhAz~v*+@{{z_R{>QSabZ0rv$H9YpK40Ec{pM~Bohxm1*kDz_}K9vkxc7%!7
z3^H1q+Ii5K%2YEcK(6kS*DNMP$$Th&_?q?tU$!Nq?0?CD?BSK=-n5f``b(^K3yZ*G
z6c~&YGh48Sw$)8350zUF?52IEj~du~RY>HJvk~QkQx^OZLcX-_It-e7BjQM-KnqZp
zaFvwKd)WvN6`ehyL6G$scjF<Z-CHisA`38qbAc31*YX^uFB4pT<qji0nwv>uKAlw=
zj+TeQe+0Hj*F*AikPR)EO`_t%EVEC#+zSR}TABDXT;LsC4`WB1vX9D8_)qxj3tP&&
zyM<%mItio-UG&sYonbl^q~-Pa@}c&nfq|{BSz~C(zyhK4^gbYto?i0V>8Y#|@||7N
z!+o1G<FPwf6Q~?8<@1Wjb76lcr&4me_W06Tw%apQ9TqBuC*!BVYyz0O3b8<zxE|<i
zA2)1hPU5}{i4ymOX{yZ3B(T6wsI2NV*4yw5VV$I1k|);Oml!=D+Yk8CHn6@l8S+DC
zQOPl@81!9)OG`WtaL+$;)Y4w7)@!LFct7bHOgt1CsA!4zq~XRa_#}j2Vre+WL^u6D
z4|yS)ZLR{jlfaDLRa;y*<i63@;BP%qfDfLwm-|4TjQ-R7rmncZCJofc)ApWEUxK{r
z;Nj<^MFHYa`7S1>!S<%&Qpo9Y{RV8p_YY)W8k*R!4C9{KjX3b#0_~W2x~;sp1q2}I
zzvBNjK))Pcz!k|d<+68(+x~>6roJD@(X}<p#$1nDcJJMi_|%UERnIiDuJ69SH-h0d
z)n%9LA)$AAz4IxCT(u(+BhOC5`G=wBw7Cb|rd<9aJgzc~P+VINrZ)r7AgW9(G&Ywu
zZezSnNhJYNk%1)hfee!XR~HdF7s>s3oY~6fOeHVxBV@aI_S+$YOLl$mY9R;jC;p5V
z=Ki}|?v~CrRw?&VNr3v5GAU$igVKZzV%tzG!^&N2&o$q>2tJO9mUtR&&f~rX4;Oz|
z(0-RV{R5dY-E|6T@-8Gl|Ewn%=P@m}1WmZh0SeyN*$}j>6w@=^>`ia==P`KDK`%jf
z7IzobieL8$1v@hhT}loWuEYUBdei?n_FO6CWwQ_YJY1I+MCKq;><O$X`>O3dpP6@@
za`<c`sJZJ(Q%zS}A|&(7Lt8h|VA(^f{N08ovI1ErXQ90ahzq~4H%+UtCZ%%SxV_A>
zT+2ozQ2>d%jD!?jNzk~2R{U|=L;LJPtiq}h=kt1}tMRdSHXq1kk^YMpxxR!Z(?32U
zRMy)8?|JTE`fFtDL}F-Q!#3zP)I%!D#l+h?wL3bw#vd>_2e~XA?Q-Xf4uBr8n*bc2
z6tb@`y~#9x3qfdTV<3};6TW>ET?m-D5U-;0$$|uX$cNcW%tnEgD3E?ucE)cq=Lb^e
z#`AqJW@~G6?Zwb!*9;oXNC~B6#gqcMd#Z{7ibp)DqJ4S)n>kgV{0+Z57U#;6XWz|6
z6|oKs^I$j~NCDS@qU}Svs>h50hbH!5G43GH&yRxc?Us#o|Iv=w!TN5&XYl7x3keOl
z+lnu=6$_?9Q(u{q5s=P_nB;Y2e7U9q1{Db^4m4;wt<sq0kr&E?esoa)2+lB7n<of8
z6>qRWPz^Qn%f8PnY+J0pVzK$_t)cwn=vTEHv(hJDUq!Gz?*(*NM5sf4ZPIiMgHC|t
zh=h0tn0Sx(z&iI8Q&5z6%d*c!?NKlxL`D(0_!UeVB9<dgQ-NDi>Fg8`@S*jp_vEjH
z+no5B=H;MstdOjj_|Sh&MC|&T$&QcrLq=)lJB$0EOA{d(!WemX!#LneGa2lU%jG&T
zM6(l{aslF7YlC3zgEkw$uRO(B`|<k9tp{#}v)`PSLhKW265?aWf1UfA`F8p-&23A@
zsaYV^P61UO%1ttPKe1|AiU&|t;j8fl3T|*d(Oz!Ummd;yrj6#(puv)?e8}?GIiT@d
z(VEv%-Z&p_0hGz!kNN5pd;wR1hWuv)A#Yi6>O~O0Dl7wD96=wg3(B1A`hR7kfN1>&
zreX7Zhwu}~bZ%q++Y1WW2_RYRMWKJ`kCxb(lZsR1cH14YqtJo(KJ0Rd1~K~HJGvAx
zoZb%+_@!RlKf#*obztdc!zvZ4hm_|)ZHN=_US&+8RHW;9fm^{ZLf6x9m6ikt5LJG_
z{%H)v9qpYlHiB}<S@IbajRa2yhJ=d9!5cSf>F)rMdjv8y(v}*QF8E4v3vE?@V>tv6
z(PjA0jN7w<t3b;KViQL&47ioWdxpNQ@)8+$o80W>go|NnEyl=(b2LbF027JNHxudh
zRx~VjZebMoUbM&mz4knMWxv&^WQK)#@X3J*VG7juA4fan=>X65H$CRct}7W>oPU(x
z91ntD(?|Xn*+kIQ0peAO0>#}l3%4->gS_aMik)8eHm<Yj`S}L1>7SMWc+p1HyRpS4
z3hSRb_m>6pQ(_9t1{oJxDjF7sQeJ|MCcuWEt9BsSdj{O^-NUHkdYlY$X$(lP;BK`F
zx?9MBQS+QyaN!1iM5C_2mAT0ZN7=gdkhK-9s48pIOYM4*r4rIYDe4Naz#8A*{t5oo
z1z(z*NQNYHNn{h~R=m|7K{S#&*t5!m>nytvbaxv`4wOGaBpA)9;GZBN^A=bXUC4XW
z@$|u<&FU%$Rp+hcFj9*z0lPE=r}eQ`LF;<}m}pW{{azCn*&d?|AkAC%oi=Aic%s2Z
z+Al#ih?Bl-#5(+PHtK4P@vsf|#QckRc8tBJ)*jp8an6f9&29d!W%u@lq-PQ(le(AV
z(!p?a-{WZO7P?MO=+3#h;nhqVqR&)W`IB@Ud^UqBp@(cp>!<T_7tvyN{l2{~p?wq=
zU^+dQ@y7=;;kwL+jUha6z&;s&*f!qW4P>yQJ32lgu~(M=#Ldw+?rEol?LaQZr;-DC
zKQ|&2AE*OvW*a~<L7bnyr+r*8`d$SO{bw}%fBH{Fq?87}<@X*SSn#<=-7pA2=iF(V
z3)}$pAzx~Ntw#|oAm%i32rFQAx*!im*{$Q@hDRUOLv;r>19_*kfwND34QPc}khPOY
z!#nj19txV^fE17_sol6@EH15~OY(nAYzDz!mI0zi9_q$=j0L8P<rqvN$rIt${U9z~
zPOA<<JB!I|n7Hj*3*=oy2IzD)VR50uZ&%Z~FC;|&-zp4fVS%hHbg{Is9MYNj)1kd4
ztu!21?1^3>1@%2KNa~7J3@nv23~cHTs0aiKOyuwtluw%%V)zT=jqC7Qw$z7rnAFD;
z;-Jh=jx1#1LaF4GYINiL+V20#xtGEX-2dYR_`kus+ruzdRJ=moOBJ7u0JH6EB3RL@
zU2D3VFQaXln?8m+H4v+ajGLK;+uk$w&D~DwUD?Gnx32eMG%SGxH(X$c{cpsCS=9ZA
zefD8Y=A$1?aLw;7qL~A-x+V)pA<xiw;KA{KT=!AIyXj>?!_&TOVr3j{99V6QJVpcH
zYk5GqE0uljzDNEp>vHt7NSYfy<Wczf>Wp*kg&ChA*QOD;rM?f~Bdmg}W=u}7-f;iB
zHziiPA<Dok3kVjrt^1HYn(rP$I550e&zkdnx<W1*ydn)&sT;>1v<+Ku;s&!3<`(@O
zPlgTS3s#}YJ4>lM)$bMY^cv*!e+g~s61zbY<4cRX?Pfn^bNv6_z<>KUA8&&qGcdR|
za|o!J$=AnxX+smKU|V4R4vAAap47JI*q!d}ZeX7BXxw|!3X3d`wHN|pw)d>DvG$50
z*aWaCOU<xO-T_SzK};T`4%>D~fwQ^5Nsau5m)Y=0!tdE|9u>-A1^i__d8jQH13&g(
znL<CH<Pl?r-`z+NeKgdn*D?{@KpkBDYuIFsHaoavUnQ{y)ZWnd*-Ow?F;pj^FSA+&
zHQ?-q_T?BJxRFreJ5Xo}0Sah6va!$6F3Ni57zA3cHQ+@xIQ}ID3|PQMLFw4g@lBIx
ze_fTKhUm~ima_Tq^)}@3NJzue`+Xv|Z}S1ST>^uy*O+9^!w+O<&vtVjZbp=-naI>b
zR$n%j5x4ya)XY+Ge?7=fh4fgcfcC@ht4zd^Dk?&VD^t%-9iNktcE8+zR1Y%B6mKkC
zfe%jBmjXWJ@Lr82U|14lQ^?Vghvr(j57Z_vp_i1;7r=6W|AwyA2(fJ_TEY23)4XHP
zgteV=Cr}h}WsREYZRTJ?<L#kakOjsKuz4T=A<GWi=TwMMtFnFWWZ@XU+J5wN-PvtQ
z-1)~@J;+6$;ilJ2akJ6}7BQS{b!MNlmweh&&`au^%Ex9Sq)ssm#Dd9;(8pm_u(iou
z&YBIX|8Ify=v|2hThAL5KyV$ts>|yLC|f)6Ww0;!7SPP{*i)FeKfw>$7yDPvIP9Ca
z9@B2DY^6IbT)L0$zDMP^1K13umo|?s(WJ?w1!@Z~+4`*uvf;D&&yNB#P?<+QFPu5K
zX(<~)qX2S{bpjG@fM7LA?k_1x1zYGqaT8FGs5wfk%}k=X#5h(fAm*IGW`cfq<5=Il
z9l%tNIBY*v&BI!NX!fbZYC&iV$xO-#u7bxBfS7$2vX}&^R{;v>OAR_)buwN_>QqL;
zY)bZ5V`gdomNHRs3^dxj>b0fE1TtV-(X_rWp6X<TS(LvbE-I<CHLnBRfM`(p)1n!}
zlazm2>a8!$>hV4u6?re4R$m$<ErWnMoB@hcd;KTYFG%2)`b-OM@C!}}s~VaN`PN?5
zjQ-`rS*w6xvBzx>-qJ#N0UACI05@3QDO$fC@}Rxx2SW=Ip8MMR7VuAS1s>Le`-ljs
z6Y#L>*~G6P3iX(MdHYG&!(DDJ&_f}WjrJz_g@KyMC3E9Ovh7_$j3b^VkT%r&nH2yA
z-fq===CwyXLHAS@6L|OQH23<6=<dCSe7(ki0sj_wwSEWV@8&5-`w1ZW5%q}Kv;P~F
zZ{H>vWT$UJ8DMNHsbpwXaKo71cr>Rh9>6tK-$hoO-t!OCwhs#7oJ+{z;fy&C9&*#F
z5HPQ*NpkPL2`~x+`!3M*NKWyr|1!A~Vm<wV!iGh`i(!!l@ZseZuh#Xv4M84kkm+?d
zfT~?rv{A%Cg7B>iF3)8H1+L?iuO7ie|G#pK|5L;E-r>980fw8D>kl`6JNPs=FP4gj
znk{|_Hz~oOf$2av>TXT%o33S{%l>mQ_m<6!z+&x2q*i7UK_L6mh(*xOt4rO{oRn1{
z{{p-8<C|1+cnp(0$URPOO7xf{6O!*$JZQ1HsP*{ABpGJjT`nFCc{Jo=f>Ef0TPdw_
z<!$FjO!7%3cZWA15*ULj%Avj+uz<ZJpq@fgo7fVdHASD}p<tN{^a-Uf!B@AMNRFfd
zabEBRl%Xz$V56`W^Ydml>g?HrG9UfbOmERIc4sg32f~4C2i#T9iD?aH0Fe_$UWJL-
ze$Dr~l_I#tlT!b~^GqBlkrF**GNC|bl6=~Jz{BfrtyB4s0TQw=@4MynvZJy1^qVf5
z@W%UN7rI&BbTJ(NzEeks-X5Y6ud1|=3H*5is}CWVf9FRtBK<Pk%>Dga?&g01sF`*8
zxi3Hu36b-%_o_~yj=%wt=07c$j;oBM0U{+$Ge%ZkEr}Lq81%6W#?Ut_#G+>q%nyRI
zV}0++3!(mN9@uJh(*jF@Gr|Spk?*;``X*ChP^7dTfX)<V^y45B5|A$T;7q*bQ2V-Z
zhG4HY0j$pjzeGgVj$LR8i>&Rb6K(9i&Ulvy&%X{l+WU|Vr)V9MlcR!5V|^v3_k`T1
zqc0cpU`}!ev!Ap~J;16rdPrdZ+<l2=47shqJo&no+7%n&>-V))HuOTl=|ERpWngie
z2GTP$5)9cIcg1jT7rfk5FKl1u04PAIc*Ts_VkK6|??P2nF0q65WgK7J+uQ|l#AWx&
z23595e#6G=GJcbUVyKm<D%oiNTa=K%?oKAden|_BmraHZ>0%stSm%6M+w=&)uswib
z)PY#ftize0BrbI0hGQAcNvD4VSBFIw^1tca<-fl{6?popX29~p66_l^jgsm)sf7W5
zz!1Tg_b3^@UZ22yl8qz^4!9pqPx%6g->Gl)e5rAVBSBbcl>=!8JpC{Y)jm>#!HeBV
zwDUr)#ljKNpL_0&n{7;$p+a@ZQ=#`^O|6pE#uF@_hZcN&OUNSMuF{Y20J(qg-Rj0w
ze*e-DNfT6@EEgvMz=z1-#$k){b%Wn5oy4-o6HX7^0(RgHuMxBre^OqYdNY~~_JYXz
zCqr)obD`(+qo$)p-*_1t)C&!GtK!em#=AEfTTqLVZ}mSTrAE?#sPJialH4j*-lqK7
zOKrIGPsTeyO(Gzz5GsDauhk0OIS7H}h1)4$T#POh?aAZG-FQWkNROmJBkjd4{s|Z7
zFIVks?y@m#>>mrf%K8TRYutVUA1fmS^gpX-LgVvz(AjoK+Vu;852aP~WAZ69e1~2l
z!kz1a9%vc=YCQWD@<OM%?ekDgK#sh_szGbLDA10|#O4ygr>IMhlwD&>ub{=!1_&R`
zq{Qw3-hC<BQ-NS-+NFVnDlDby{Ozx;JUrJEpqz;IR)v;i(x3bSfW2K-LU%r_s^iTF
z+Nd#QJ&&vu4S5?t2?zemA=_jHJ+SY!(Kp#);_QNM6K{lE#`9n#Q5$eq#gFJUQw4XA
z>D>Yc{oBZ?4K!XL4*(x7OYEo4qx|Kt05xq1p<D7K4^rdk@GUpm&`V&N6~v7Zs_7qf
zeQzVO>L8Npf*W+;A+A%@!a^s>z<bdJ4OjefiQsvFLstucdgO3N%gb2ZGd*%3MPkID
zpHPlkWgcO?yT47uU>^OeE83z6Sso2~F0<;Rpz_?P5Oe$!2M`Y0q8IH*SaieI2vT`j
zCVADg1nP;Jcf+|bNJQ~l!@mYQg@2h!375hgTVw(^-gG$G3;YV^EUNega#s3|1{;K2
zNev{D=X+IY1kVRl!M6Levw@nDFI89jS(Vf7bC&VW$}M#W8jM1luq{^5%L=B-_*1|I
z+6@(+$vx${Q!>x~)Jdf<0Na%jH(U-Tf8e18NR?Vv-;)u32D7jcysKS;-%5cUY58^0
z`W8$AEG~h93}`fXkLom-bt+ZoO#l4CkiGEMvaW0B4v>WGA*NuQMWp)DI>1L#q4j~L
zN(47qAtv1?H8uD;kq14lY<E~-F3Q)*6q$>ly^G5QF9AW1C;<^zfH{fXM7--e2A0e3
zLGS;?Lqko_Qqfm8ICOz|^9l&0zw01=+*1nVS&vbJ34N}gI7t-H$}AJNUCpi#r&=*5
z?nTmq;v)~Jv?bAi4-(|9)(c=tItAQ7V1)Ioz|Cnug5LBWl!Dd<w8VPK#r%Z_quusM
ziRq5i6&~W=7FwpBdHx{OpKmnD)i2z|C7{`9=@0<PEU-h|h1DfBoX@Sf+a2SvP&EY}
z39<o1J=LwzKpCHD?z5+jj}7b^gppib&?$=_Y|JL=Gah(zPlVmxLX|-kFc3!@Cpo=y
z*0%%EZL1G<2va~(Np^gP$Z-G0TwbOicCZz8lLTBhwa|-<WB-Z80`u||Xqcp=j2B>-
zHc5-=e)A~s<NgS=b;H1(<b$_@%Bou_zuS_X2cd@-0LAVrKtY@LoP}Y|(UhuISa)?F
zdkI>khCJ`kgD8{84PgURs2QrhldKp(HDoLKMGaV2Cf(rU-hw0Sa^|x!QeJ|}7s&tb
zvN6*7_G!;v53dd;t?3ppiDp24cdQ-|*1VlemDIfL^nO8VXUc|D><peL`e=r{O*Bve
z_x}~0zlHlR&mZy!1fXjB0QoA|m=K6x0bvLJ9Nd1_=gU?K6kz-mI%)Z!la`wIUV0Ps
z#Me0B|9D}XUrZf1B@bHOI}PMN^D9Ub9{d4<TApB82%6>X5>BmL=;|myWSy?_J|dqU
zNz-}(WPUXu0$DrBDV_&B!4(1@XiM%AXh>d@9|>PL+(T%anV5sD1kgL32ux)-LW$Oq
ziSQW76BWz2x*+0T7!QWKo|-N=>6u;aH+VpTF@BW|#Uuj<njr~)!uR9?)B%n4NvM8{
zHMWH;y$_Ev12c<#gHQ><j*Qh$Lk~rQF#xg-q{Za~NOd4?^?hn0g7bULj<S>M!Sh5J
zlBBccB>b7*enN3TaQZ#5Q3X#wK<#0G{b~tNITwJ+*=fvtJGJ$B60MgBteotPM<O<6
zOx|`m+M$j>K>+750d^=;!9VxtT=&)$Uaw{G@iH>0;qMcI*|`9J*0CR&rKhb=i%U@5
z0|8!ioNF~kme$$i^g_cR@B~pYXxJcda-ugC`}iD(+6U<EOG!YTl#r!j(m+(2NFhJ`
zFd#zjd9!qimUPND+L3!6Tkw>>C5eVrnY+9%>ookC+;+`7U>k#6fJpj?-CqfaY*_&+
zDl0-;tQ|iF3>9`z5BC{VyKWt5byq7Gz%?OGD~wJ@=dhO}_nIr?&-wBs=oE=#?S6Gz
zAsY&y8So3N_FMr%>7!d@8EDqr!olM&E@!~=t96Cl7bveP#pycARPgR9QcGE0c&G*_
zOKrVXX8s8`a^C=w0TZLb+nAv5Q*O(81>Ed3cPwRQst-HKlkQw_1Tqd{Rl(;-)3B9J
z4FriBp1T8-&75uE(Kao$kcP`OfBTNbrhzE#xk^U<Mg6>Z5}XAD_E4#oCX<iH&dt5x
zJ{}T1_{P8`sE_ICfi=;6N*}dau1C`Dr2w4#YDLIiI!LC7OXDh=;z8?V47HIy%6S?P
zTUf2nC}`ZR92Kg}{f3VFvE2X~z%n9SZG+ZQp<%GSQ0lQRRo?~uZXfuN7I?ew*~Y`N
zsn9l?h?2%aPMP$6M^9z&egwj>(l#`bLe4};)r{5W?GW=XA*Xaq7FLDud24gusDEmP
z90yi?QhMj)CHw=+fREocVkh$)KV=tqJy5pB$@KWfLtgw8c$qY-&Hq#GH8PBlp?x+3
z3Or^gdWap9Qwe)RHS&}NMS1}8vbQ-3;`-f}5=I{LfJ$I{x7xu|_BS3O9(;6*ZB=Ro
z6OXvf20m(SE~#M8JQ#2jFDIbXmJm_zGg06Yeq|!sI#FaJ*^CQ^pqEp@YBhLANE@|f
z{^tK-xf~00w1iAgJY6{M(GD@e<mY=HJMon%2uXK8f|I@}@)w`@=C=Qn7JjJuzG#3T
zUIKljR%Cl?ZgKthry}~(Z*=Ah(+pFF?(YngsC%pU{DN?r`pd!T>VEH!S=E^l_p5q^
zzlZ$zB|E9Buxr;5c;NYn^KI0<AMNfL(K(z|j?kNTuEYPme0))|?!EuC%Dob%He)DW
zV}O?wNPSp{P*B6~MVdRs#a6NBNbzi+0}_F1@)Pn)9i)U$=pQArB&-eXC4Gg>ST3PD
zXCj(s*aA4e3|md))N=npTHbB~M~rKhwwdpg6n5|TX-j0XR<y80aZyhk0G}N7fmchv
zR`M-kMswS33zpJJ>|)N!?8A(!GHSa{jg^gM)g52XRT%oY4JX}RVIhy!y7!!YkY*1@
z3W?eNY<O~msE{eGT>cC5^CJ&^-`B$<QP~J-HT>+k#zKVEJ+{7t?bk|-$9QApdMnF9
zN=+x)sb=cnL})z2zro+TZqYmW3*5S1Qn~Gbm~Ng224OXmrdy8LxA?PD+CbhjE^=+1
z_*fKqQ5nB=#vV>^p?R%89O>s?NwTcsujZq`sy`Y^6rVYtd;ng$v#>P*H8-&G2KLQ<
zn%sMpCMc2bJ)W?3tiq>mp=5aIi&NaOCrbsdzX#NK$HlDms~0p%D(eI&I~=6#FS(;&
z$6ojnF3WmcH2t+RiQKi4aj%z$i`phm+@%&$b$%|9CU~ys^7&-_%0!xO{nBEwa{<DN
z^3=>gz|yfI%4a!^^lBxavHp$4N8zJvnNAeU$1JC_5?J3}&Gh&xJT{a3XMspDpJcr9
zgd_jXMBKyGB$3Oy&ub!&!<nzw`$u|tIHJS+QT(a!>%F1TgQ`xeU(y(uB86X`r#V3v
z)$pPL$p`5^Gv-yqzO^?sjjYPV=11FtpD(PAUogXeib-ylcB%Du-fgBYR=g&8kS0j5
zHHqTyAIlOED~_+*Z#N*WT>cjG(VmBGG%%qP^jJK9@mheI!}b?X|E^XLG9#@ojd#to
zx09CFsU-HumO@``ipgS=VI#Y9Xur?k5{0(BK%F~C3xa}Iw~@I1PEgDu{-3ee5-ND9
zX$fV#Xxz&ns`m_I{A<rTPw#|IsXpKDR4@5yptum>?&o|3I+HU2DsHRO0eR_L-P4;p
zJJsT{t5&;0Ll+xYThJsA&+*3F+hL3@yPPC4Ole5lPOglcL}ss*vw3*{wZQ3&e*xm2
zH@n8Z0O9`6!(FdVK7Q~YFMvTvaa*LhWEo-E5@~R9^;=4`Ip=F-pssbnQY*ug5x>-7
zYekU^QBRm;lcp%%h=#uSJ&QI5sKzdv`WNfHU!9k2Xc9`^P;vz*5B24jrTYmS^erQ&
zkm!v(yih5sCYAlPYX-zl&dz^Y8)Q=9PIBo4wm>R-x{}_b-~&#A{kW%Ma0P(gZYNKI
zCGsVVwAiXJpSL{GqATU6TVKCUSGSW>qzxvK)rs<oi-Is=F=@`P6&>!Ypyinzd?tJp
z^^-ZFYWS?L67%-kDKL$M2@1=ik_f)6gs2xW>^tVsNWg$aOgXzMplGcn8l&OldBc)v
zVo~3bCK^*3KXvV;D$RWQ*4O=O{paDx<S%re+7;Yazr*Qd*rkkyr#DbLNQ-!$cHH34
zwVehoE}VxyH?li~6p}2q1b_42@(8Auhk3>RH;d-stWY#mmQEyXGw8?G$l%(`Eb37q
zYolKe!2s4QJlKuo@Aq?T87c*}#Us71s_$cN@Dz-PgSp(K$RAsCh*H)aBqU*rtyIuR
z2pMa1ZVw))S(;c`gOD$=$P&qa$hkj=-v%I(s&4(<a%ah)>x0Mt8%NFx<!gS2?_vG&
zdJSkn`y&nPau#hd6@Ttfc1Q<deQl|0@dWo&`Et`4zAM{O^BbQt&%As$BdO+4NR!Y>
zw`4;3n;$dXhXz*%f>uH;Z?=h<vA%F+XxVU>gXlicZBQ0DU|V3i*yJM1e81ukw_8n-
z9$t^AzJXXg0jk5NSbnVY{zaX1@|9r!b{-yv5EMl`X_`r-eL0aMlj?j7)a(reRB;cW
z=aXVh1ybQ|_mYZW8s2W>dEkTI@g_xSx(Anhp_yzCUt?BS{A_?C+IPDGI%+z_tuw)G
z_4|T_g?%O>1@}<WBXg;MRF}uYD~O^yQZ11M2);bn;&l)HROcrMnbb;cN{4wr>9BZk
za;jnf1yCtuP0boUudUE7vK%`?WVLHLMPKIrFj}3cF+_(Z&|@vE2Yl*UXTyY2rK@1J
zL{soLICAQCkSucQ;me8@w0$N@jYRp&>i^9C{yPOmBsZNeAa-vsoer`4NqOo^uUrcd
z%?}TQqdS??T)ZaL-=&$M!)cG^^o)0fkfvRpEV+zZb*Wp+y=J(TQ068x==ZT{No2yd
z6PXB^Qs-Gy_p;7)+}fAW2K@8d-Au&<|Av3LpC0et>zR1hJsBs=M_HToFM5n<F6=P4
z9}Ftig@Ffm4L0sF*#TUrkfiP2$o20t&S{#1HA>G{`V29j*vtxjNrlJ{%uw_CE;hh}
zJ~qv@d|t^~F7V&rteI=C4SV({(FiSsp{MCY1q}>x?UuTo=NG#i5iwg-eBf}`#r<yv
zKjV3D6pHQ+6HPSR0&q%ByHedrF0o_zPI-b7-y;agyF~tlsE<Huw6J7x=0x*RR#0*(
z_<&xAkOyG4SVYpG55Q`LMPXR+ZX_n16#xgx_cYxtb7?mzHIIkAS5bsaVsIkOrNpqV
zK5jhE82~@>!`9TwLfV5Y8X%2UPY!ESmWyb*4GGiT5IUMn6b)Ulz`Q(2Vn%c3eR@Ti
z%@en6{mf3JMO=jAt3F)CRtAGA=NL>Th@8M87H!S#<k0Gi|Ju+VE`N`5;RP9X^KAji
zrgl$6f_{jSb~lSAVK=CGvL2PN#_ZG_tl&_FJ=fZaYilN)Zg%T6+nzp?bU>mm=40m8
zGTs=LzA;tU-F6LId64GT8BpM$NDC;!M`mPA02~#1AS@>GtAuXEJtx|f_*rniIwiGo
zJEg8l!uH9_y-slen*%D-t7!+VD6o+DU!JVMV%Iv0j2{C%jmuYt>MWKUs%ak4(xvNk
z3@2mg{_v}zv`tKiogDsZa|Tr-iacOf9GR*=SuuDXTq(K3IwuqkNaYus94j(X0qu_l
z>8Z`(zU2j_;JwcOR2guCfSfXpZ>KzcjIer)P60Lf-gZgbF#Ql%$nlzl?4@Rte1_q-
z@`!ew#`^VXO4p2n(x2>f#`;Uvm=DJ3-WlZe?_~_m3u*25=Y&i-07=+>E1xHOLQ*_-
zw2=nlpQ%|6M7Qx{E02?VcOx&t9VYul@TA%VOlkZ;DoASo>TS5dB=R{<nV~rkw{B^3
zrrnYmqD^u1`HI@xe?soymxPjFkj=6h_)UR-KS3mwt9wFC)O*@d)?k39`TH|Se(Xc-
z<@t*>vx}~wt7A9#)0{6aeF&{*)#)aDKgvj}DCZo?-b0d5Hh=ZS=tfe%I;fjUZ8flB
zQDkE}LP2Tf+6NC=>IqrGZsd=ew}*K6uuaLrLBf)@hnU{l6xe}uOXS~AP)yKBASY{v
ze%ynwT0sjGw1|8WDbjN8WJ7cU>LF{?Rw4am6+#AEsYnz2i~8!J-ty{w1}10ibR5S}
zVMt~il`vnSFyFY)kiSqZgLSQCTy2GN%o&RixYijjBuZTiQKY%$3qrXMa_+}C@!S=1
zhn?JJT0~krp&^}EoQ`V7EN{=}0Xs$c`uQjwruVl?FnUhp1Zy~GQ|dslC-z7r9cT4s
z1|^^0C})&AJ)~X1ln!^f!Xc=MjfK5j8!H=4iGh+{ew~C_VPv2MI72Jzy6BES<z9n#
zokaFK$(6lDuI@PYvBrW9{r6i>-#L4`q5a;EL*xz{xj@*YSWO%jVKur85&{+oUsTx2
z!xeyb4)D#uhPwd;gJq8qGJ(!lg8Bb;KE_-<=4wG$qOGXHpWkaP0bgcYum*m2Fuy<4
zyevRnlN2~wo$@G-XyTAAi8;hjT4fK3a2y$~q=p#R&0}8x4;>YppJD0pk)J;O-7VMN
zcM5;0MPlC?W-0C1MLjw?y3w(IWZtl0<0PaU<{Vk$Y-GL_`S501g2}u*xZ%t6Lu5kv
zvM5t0m@I=USs310$%E5bLpe<K<iN$&A0DYS?t$Tnw4f&leM#Hrs2V5afgeSpQ{Jy>
z5_!j`>&MNTDFA&cw8|rfV>jf4FeHBx{LJc)=yH}v!o%07icIi-Pr=3n>2DVi1AKB!
zP@?!M4Me10k7#%@ct(Vo1GV5DuSWw;<MlAit_94`_R-aqF}?O%$8yDy`AKia%>}OA
zI-HEHj9Ob94cP5a(<+Kgu8j^<YTJgZ>8`3mYTbJR2NhGH@Rxh?2X;-s^TiAvV$kwT
zp8&W^LyuGuF%2M=)E+KC^t;F%r>uDhHOlV=oT3_#`UW4sy9WQ<f!Xh#@Q`VkREK0k
zsB~C3?7&W2c-R3kPM0j_Ynte#I7Y!nAhIjcosgz@Kbtd4RiWzz3ITWqHOB8xy)3AR
zP`|Eh{~$fI9A}`G^CPpld71siGG{w16nxRKqQK;uG%GSezGHW;6}iJI=N>k#59`;!
z{>S$q?E=Tk(1M3JZ7S!BwxWO{7EqSH*cWlEtQz3baDE8P{dgjc=$J?othE`@Pf5*>
zWv;b<yF%#g9+Y_0x-F>Er}#{W(Dxq<c$4hGG1c}+QZ@1O+W7-~y5OSIcOwVZQIn3_
zTE$rToI4dhlca=_bEy4$SE1%lE6)dGYEix;T*f0dC)ainc`w?)QcfqP<QvfyU<tOf
zZ%SIJ+opb!aYcda%{@?KG*rV>opJ)z+peYp=9%<N{iO^Gu$VF;xE&EGThS<z6O#Wz
z<>vmNSpyD2fp&cJ&{RDCb-0~e;z-?^v^M#E;y2e9)HZWG;c>;>*vEw2Tn_{LToDmg
zZqx<Ezj`D_9JHaD@;4U2H%h=i#kt8MzbBB6XY&wCdowNnd4i}CFJ?DbQPkaX_$qpx
zm<MIkoJR~&!YW@6JfOmUrZbA!P;;XsxbeYQHKCki7WQ(%)LuX7TnkRaff=G>_`4yH
zza5rxg_9A&6|*0<VIdf<g<ID9U{PpsWN48~38j^nKmcFDgkR_or8kQvDCH0SSq=0i
zs`f@wuRkuyf4eo!`HaB~+`10#RtMTuaENS#?B~{Ps7fD^{q}LOkJ$@TgwC-kx6k0O
z&au_i>b`5P-4^$&-fqRd(Fz%r&Z<kn0tGRpVa!|~kVQ9fCVp*NmItb{nQx2WpK=-w
z(?kH9&d(77XDeUR;{1@wY4D(ak%973jDY|Wo-Lc<Y+3U&!J~i$xO9j8Du}<jeqUNb
z2~rN8^ltp?c;nC2UcDk@XkEt0{10s_vK}kwGQx9FNYqvq*=@`>2tH?E6~Gb0<K!(<
z(T@LJQvLskPBqcD$tTeJpH3U}g;oYro<1cigvEny_6mPm<tQ!4IaFw9amy?8fgKE~
zecqna>x#`ynEHj{I?(uv8hMi-5*a)?O0SS-VAfW<#`>F^)mL*`?)~vsam@EE<fpHU
z^hJx$(}@|gVFs4<twexrRigg)u?&7J+)m5d^Lc)J8V})UIikbA74#iV`YGPdX(2+C
zBKH47+IPoO+5i6+CrJt&D}++WmYJ*wjbmk%Y&TKXNhBjq1IKL1UMX8hRv9M_r(q;B
zGe<@V9eew|FFHrv>GQoke*bh|_i?WG^?JX?^EKbsp?s%$0eMLPxTMYlklmyV;OVQ?
zxAxs|CRhg|VeS*^)rHDsUDvp%7eP=qi804t^B!LSrC<=KjiY+Aocon3MGM61iZm_j
z3u#j3lD8nGpU@(Y@KMnXUhu!;KW4$?v13!kfkc?=?SP~#=^ovfo7o=QKoli8s*@wh
z`XU&2*eqt(-jurzl0`u1AEdkLK>)~CfklF}Nr72fi%q@Sbn#u-@-RD;^Gcgg2@jH2
z+ER-qUwt2PR3V=JvBp-sots<v7Gwchx@Mu!P@Fa;nj5b?Vkf+bcXLwGGN0pwTa45`
zak`w*JiI+nCqlX_MGM)fW{IS#v#xw`*eHgqaE{aA_SG3G<`fY}$<H2;wNS!W`iEQH
z%jZXGy~wM|=YHsqK>-(A_IXf`iryuZ(wDMeXCuvCUw(B8{`FBcyE7VR>wt`pb#`at
z?g%nu#oafiqVu!AQU>P?;moBaU|zMr|7c14FZ=T4%h_wKK2p?itBTI2*4LsBsi4JX
z{%KHh^nLf)9LcVW<VAqP6~%`$qepcj3VA=XCVp<xTAUeMyfC)1G=sa7h%YQ#d7q_<
z2Y3}<U*0rlbo*8w4q@JVHNGx>pQ&tJh+HktsLoxPJL!c2S9*KD6lnTLe_z_fYzxRT
zw5U)c_Eq^EAZo)}SLV(+ApsYCMs95FqwG)4agfJGmuc+pp<Jq-ISbXV)E0iMmRq43
z@C`VDsr<^*R!1(Ak>$e`xQTjGxwsIznXg4lmiCgnaDCz-SL1i>PQiVeo8-7i-W*9w
z7$1M?fqzsoFNifS8cDuWM1QP{b5p5~D?{5S{gS-`AwG6gjA~A<*=7Ksw(nq0`QQL^
z&pX~n|0DQ=<H}J`cdRb}rGDhV^59PXt~{0fy#PMv#%Ja}II(!Y6pp%lgqE}0MR;yA
z6R|!R*iJS+;8uzb-;Exfc-=)gT|G0twP&%Fj_StuPx(v(QL)`g!YgAYojAcVCWQ_v
zb|^Jk&i~3b=ZtH$HA2QmJ!))g^t!~}-5?L*I|oOO5J~(Ea%AViCJvYbTr|4`vv#Gp
z=poi{F2*o0>8TWJiMn~`q8HU@^-P|5_hb?8Bx}zZb37<{FW4L$<rpgtUKr0lgL~gS
zh&wy!;<~#d%5P_7<%O;IwDUIbO+hecPPiiSGIB(t$gR)^33CY~D^ckg_PY&|sd<GC
zE<}viNI~n9*3m2RyMPAld)-@FS=sJ4)4u=4rphE*dr@7LRj*({6N1&B%p4`zV!Vu+
z5Q`_1maq<6@!v)BLUnAUM|JY9tjJdzx@FkcWgi)~ef+=7@lQ1yHRQbGcx}g^gRg7S
zoYb}V6kd6uT)IZ|+)$CPwt(uQX&#qAOr0Jxv&M0Y*S)VyT!c5#9R|<K@xz$y?=!9_
zQ!&TeaD(6$ndC%8$<*a|$JY|ExdsF%9AU{KbC6UE$(&C1)`cR3X-=ejSHS{T+@r=#
zG-)9YIq{;pDzGU4;&!{3Z4Qe$6%(4sJjCJQ?wu5yQ&}I3`8IJlhyI7*O@SyS0<_2Q
zZ;hmqHsv!oo!qw8V*RA9!Zs1D1K0k5HzCq(k3nt3=7^+LRum(M(C^#CiDxi*h553>
zhC8lALd;@wL{`#$K*+MGscp_~MQq8U&^-24L7SMBg^0|7iNk5md_?|fKmY3!#3M*-
zhQdjkNPEG0BC<eim3dbWZjK`l4g#^=*MEO*lVa0>#3r$CQ$ZaN8zm51O#YG0bUc7=
zRWbmv8EL9*&OeJBhQwy|G-wmO(^atnYooc)MEGAq`ZK~t_(Ebk$CI=<pcC<g#3to(
zVv}Oygse^fE%WBY7Ni8k#;dz;a~x5e0~`tW4i37znGoIwV*~U*w7OY)b2L6QRun^i
zGI%q)IsONo23t%0XW!;*RIwP^nuk}=CXU@fIx+-pt*+(XCbxDTY%S6N*S5*6orR?4
zvM+j5>{q-FZS9(UP|&7s!`Oh^LR(rl@uo2-YkH^$wszj2x@ePIGlZmeXWwROui$6p
zk3w5>HV)d%QAJ2<(AK)!_EKJOJpF(;3-G5Y|Bp`|YJ+X=HK>Z%<TfEMC;c#Xb6!qy
z4rp1pqk544<|OC_DJSmJ`OVSzP#v;6eXQH&ZVNgCwpR2cb~8VD3nW+!ZSAsLkniTU
zHVbX7zCChtG(J29*`0pnxy{`c1UWhB{MgMoImPSH)-DPL-QL{R+_nWop`l?Q+%c+)
zoAY#vW}U#*;RHuF^XrCC_v?UG8=}O$zrip|Qs<E<%Vu7U0JXlkXd^DW8amf%2zwj@
zy&}<@I!6y~ri22Pu-d~*1y}fJqoAEE%Cec4=dC?IRZ4~_FAGa>Gk@yg3QM_ia&vAJ
z_U@n-J@;w`dMUph5m{}!nV;l@wn}~8>{)}!dntIm#IdaX@zuSXQ!!fJXvNY`-EaKR
zNm)g9ed3$>{c%XWd<C>jzjdzO?)D}HDZT0KJ6TVSlOMZ@t<}ix{%*wIC>^|s16sfn
zZb9`@)d*x>t!MN_hs#L$dhl&BN>fbGC7V(mw9t-_E@R57ddiad`hVc>Mt>4Hh|<4Y
zP}WqOdm&;r_hPFF^T$ZG&Ed)x)R7%AM&DxEz_3|QXbb*GaO)<qf|mI{#wf3`T?|pu
zR4n>L=P3224Ix$PSnD(u99Pe%pDk;cEXulBbMT{=23DABde?1YFiSb^-TTc&C$zi|
zFh)tGk|!gIfGP+#7HwJ;lqm%=O|D<P3-W6Xuep!Pe$uhwo0#o{GHfkIlntxK@!q0r
zsdlNEdG}|ZY{RU+S8rx=42sW;sUV%SzExRRiH!~XG{$fzSaZc?rhat%p~<GIDPXOJ
zos-tz&cw2I+^huuhRVH~t|%CjDDVT#k=Y@fBW!b}6UxpoMR{@1DxEc1UVs$8vtWBr
zhgA6wd`Em)2Hay)18M*Q)Oa8hE<I+5j*cA`ef(I2usC55da)AQjt+GgiHU?z;y+^&
zCJ{EkGLr8pJ^SVC;E62#=)*uC-;R%93G;K|GV#Zn6iYVKRf6Dwu%iYbqvu`en-#XO
zS9idube4jV;|oUz5BsFjM<#=Dn<8)vYR}Fuw<_qUp8;bD4;Su&XJI`g;J6n7H{V1D
zS09SYPu$dWDs5^JhAVg)-eGu$>tv@*PmFikL~$)A(v+7&x~_mR{*pag;1A@q^wiV3
z;1ppy*>gyf#!Z~Sf)rW<WkVD4*+~+{77BTHXRf$U{0O7V`PNLp%%c=EN<S4d9`EbS
z_1w(hD5T@sR53EGbGk3K50Ybm56-YL^6*7FmYZ?62V7&zZZP4Oi5uG-GdM+Vpdukb
z^MeU?<|6%!TD$J&Tph0>r6+3K^PJ^ac|!*JYWu9?`uA@}tAK<pncSW<fN8C=PZ-A)
zWKyXsq_g>k!WGzK%ey`xI=$7)2}Pf03G;>-60iC&Wt+A4p>3do+!8{I%xesk>;+vP
zW1NVM7*fH%BnN~yk1^w5B<%aMi$BOWVGNLB`U*Rx=OgWai|41BZHbP(42{`1mFMkl
zN5q7{U-v%#e5E{5TJEjfCi#&BPZc(G=OwFDdEHIP9PbV~aa-%;ZNvx#%KhYTM13j6
zTUlcRv-BNZJ05s#mKi@_8bU4_O~4(4!6LdLxjgr|?&I~3Xee;Q+pmuRFU2S04U4SL
zG`V4R*V1kGCP^n>Q@h(<JC#dnHO3|{&4l&$pP8X{D{^a3sKtsAI=>6n<y`=s?mDQg
zal;4c_TPVd6N)IdlBtkQ^`D_p@h|GO=@9^`=qA-3a5<~xyY=V7A(1;huR5&pSK}6k
z8)q#tL&e)Q>EoKDHtFixE|@{hWB=)%E+s5oXBI${19qNL$MKY~!AcCBVYi2F$BlMJ
zeyE<Uz90YHE9h8A`3OVV8h!s6P!rC5{<@QuW}3VV3^By*#~(Z1MLF3$Rj%xdF05m%
zebaC^W*0mKH)ZX?)fiJU#X|F+k$M$1b&V3F;I$REVE%;_#ldw|H&_Y1{kuC5Y+OTy
zaA9H7mps+<>Thjhj*YU8<lji0{n6*T*{Uvo4m46-Y@Nc8ReDUR5QK?8Jh&+Pc4tJ+
zPM@B%Hq7d_tI2R$v^4=6gdC3}#XX*DbipyJ^lcQaktSrd&Y~ir^B~eL&nD7rZd^E5
zIz9wJu><w@tsWTmob9XsVIE^|qyAR#4eYL1)kDzGW4N|%%00=;xjx69s>`7pH!KBw
z{Eda9LDu-ih{tI~jAO?wpLx_e=T#L+JTC6X^<VzKO&)V~$BA>&WPBYJhk=Lp*e1DX
z7yhW+$jlGU^9v;d?9w)F(sjn=OJ&cdR%fTPnxnex2*C*s)2>5OMV0p4b-PlUqe_=<
zxUBq`wEj`V;7uKVEI|0b=;nRJ7duoz%lA>CxvwePnTU5p1^_;w2;WhZv^bAaQHo1y
z4TzZTm)*PN3JvohBdG<>^|*5L;gkDDs=u0z{)b0}G5Cv|Qc%ovDdKq}9>)p4SU2q>
zXGYUTK8<mkR#Y$oZ(mgLa6IlK-JuxcE&F1onhWeJ_zD<sT3ATLlb2<W_+^4n!#Q}`
za7E{6RIGlG2S~mom)q)sQETh0E!WpYPUv=l#`_3rmc@mhWq&P<`tp8oL?5#wM^c$I
z0f_yV0`#!^f4)prp1j2lX3MpOHTV@>St=MG&Id8SH!Gg?Ejinzhqc%_^AnseSH^0-
z^?Ptp8#xw8!CG-}qrsX_>wHu#-i{CbGT$mH=Dn!*19#=?NP@@Tbi+&mbtA_DQ&2Fe
z-A0HiQrUT?{H=8UO*VUJtMasY(m50i-A=5>8@rr?H|zV@KBhUxYEE?ofGvDNx(WRF
z2jVG_wO__i-}B!?X9rqWEMFqaK3x_1%d<hZ;g+v|lC}sLQ@b3u{heT9MN>-#g_MA+
z@e>>h1s_6|GgQvwa8*e4#|a;saq<%_A6VK+&r@tCZ!lqt@1%=wLP8E~SUq9;-%v|2
zi;=^*YlRtOO;|B{V`7t?Qf>arPw4t`IyKc|BM*1(U<EoyCxV_SBW%A)_{tjHXQ$$P
zrSpLQo<jG$QaW$D!D^D(LRu?2ih8wJnZ4{%XPr`bz2{1n*n~sdU&cjKlQB?(d;Yk8
zsS?OVhaowNsXH`dkC4n4rA-+GQ0EzreJrwXfGc+_>cdW=x+~KU)ixPseY%R7{Rce<
zrc^=|mIJDLvlO<xT6%k_wCQw7tJg|s6+Q34vojmBLF*6-3Vb?V1s6GMi>ZaV-YzC)
zE+MK3Cu*?^TRUxqo;3%6*R#4SkU~J_Qq0JVEjS=z)bYK%HAwS;%?n3xDx-Vx{4fOk
zAvgT%NPzdRi_@I6ObypceY$P3tJIE$n??ANz96zh_SBI(ZuyW1kzJS*JL#A18F)H&
zl+Qjv+X#;q(h9pcd}kDR2L6N1Z#2v*>|^fOJ+$+0N>xl&8d+p!ay3`hFre?|{Fl1g
zH$>*axV6o0f=<c3*7e>UmAsw>WYsq-Ra#H=c}!Ukw&RPZ{CfWqPomQHNJCKufat6t
zvg@#*3t8RYb=BMcA^9`z<DiyyF!R1Bk*mpCoX^5Xr*=3H-a639#8sq4@7XvI(bfJu
zX?kr%Aj&WBCbm$aAUl9>fb{khEeg;+u{yWSlIWOq_00x=@@xm;pngMs<Bc=OBxfXq
zUHtt2;5Qb%$lPkU!Ql0esrY4CP>K?r6B8#VG7`0e5j3A(2VNZdc{l1XEjYBb3P7&Q
z;P7c5yfZ+lO1p`+^?Zt1Su#n8zhCIV{q=(%tKw%(jM%cH{N{*kpnRwaYLjy<Sbrj`
z80d%m0yOg_Lj*wvt4gOVugi94*MzW(yuoo+osC<$s8bB9><2NrJx*l|L=#HYOVz=r
zVq=h`1~(!Q^rvjkpPC?YiVdjlqh1>p_U{G5{+b|Q{61~#NXRob9r_zmBp}Ej)CVUN
zdiWcef2j`mSX+3Ij>06IAiHq<%l!CLzkqiv_^4sXr-Mj8ZkS_Z`O@+xDrQI=YyJLW
z{5T%$ptR*u?IS0wFX;!4w2Xm_n~gohh*lSL+KivJ1dNey862$@C<B8cr47Xq<t;3x
z!ch6a=aw7QUmnF=uK2>@i?9PuZ9Ep_PEG7g_4zhI-f1!Si1A8-eugb~!7idOVDI=p
zL?3N#m)1Ym{o!YNI3CjVhV=K}E)wpO1rD}wJOibRJahc)JV>Ik)_05U3vrX)u&QMU
zHuKb&g`8O7)ip7@u(c98u`>PgvTVp6KM20EOX#-{74Y}1@cJo={{y__@Z8S!23<A<
zejIP`O(O9=7+0`*hny$r<(gWjQIw4J^pf--zy$$+S>eMZN#2cDPJN`<aOeAMH-y9K
zhs+B|#sY_0#5Wn=YY_p1fdL$OZsaMim1w^_r{w3J<ed9hGMTi+-xc4A?woAlvQue8
zS@FmL*Q8SYM})oWb!Jo-D3*_L_brf~W<~GMh<~i<e*ucTQGG{3I{wmYF?+Xd+@6_E
zKz^#T+Dk{?zLCgL+6btp`k>s`nn+1%42H?XbD<H+;_Zr+jULE>I+^xSYWQEwDQPWR
z^=Ob`k2e`9dw%r!B%P<4f)*Fic0gJW8n8uMstQT+e<vi82j!ZJE}v`!gcdNte;MTl
zxVLi8y}^IgEmNgjI!)SnBM;#7d`nXham_HgbI>@=_JF?7em-)u$E0umcHuNhrjmsf
z(&t!u$xNEb!h8k|f$fFk2%@Y}XLn30FgQT9YKnm2;OW}cYDW4!mcP^~5!p~(y3IAQ
z9XF&tW)Z#jry82cfF7FW;L9k6pC2R~S=ISElcZoARL-*6g80iJv=EKYP*rL9fQvW-
zR9MMqzO<wtRJ)MG`b3NbQ?zYrz){F6-dKltYt*t!8zs$Pc5|JA_mo@Yb_cuP7(kRV
zr^q(4xt&eGR~dr9oPjg$W|hRYpZiyI0eWU|F{_qHo5)k(5FwEI26$nYaPAo4p-`di
zhVCsvfUH42rd+x-=cC-Kz1%|YMS|D+c$hN4=$S*~q`V5XW3?&LQHdRiraKbnlgN7D
zcMB%!5aO{S%rB2AxsQ+r1{)hs%c3)EYkqDFb$X`__p{0IXjvlL-C=bgU*|O4LbtW=
zYh+^N#;KKJ+G_pI4peaM93Nitp-?8lvY8?<3Ua0EEJSJ)zi!h22jxGxcDbfGCr#dx
zR3z#O@f&Nf5^)06jVS9qK*sz)8g5ClnA8&BPu@9h-9jWejV=PM8T#HA-A8~RUq?*&
zFXM5jE0j>J{f+5ec_{URdQTyAEZay=MZE?pM&r;QNs@9ulfUM@_a^08pxg6a;S$%z
znFI>Gr;VU}9ps1TD4*9P2TNPTl@K`_az~A{+ykKxmug2BEsLjXp#yvm<R$uuuH|>O
zqV|B|W&7n%)`1`a&W8^C?b+3!MKn*){1M0zvr8<tH<Q&Qk;EH~L3jojjn3PTL5EzP
z?`rx>L)Gl&HmIunDX?K@h5>u*=daA9-_26Y2OKc)SgIu!M@7QOfLgmxvpCQzA^K0K
z|E2F;E&Kr-n097L^oZuTCndJrAkDST)k>gJ@+FB}q%A%?!&y=JX}AbfACio?#996#
z{&OhkJWGd=67Xs~u16@=f6XRAzY$@_L|P94?L5k8S!NV+A<6cS2iCQZq=wLi8fOk<
zN+SoZ<~c7>`u08~Ne1T24KUE=;qG<ke*iUqc2ITN(1Bj%p^cmGUyj^9;LDllBgnLJ
zy9iaUJEDZ-$Tn`Gz0pRTMs?SK2FIgaa5ZhLu152dRY@|KOmY!t0Z5LNcwttu+MJpu
zyJ~coeT*_@{g)3gPLP(iHa3vd;obh6K0^mkUBkTzT6f9Bl~y^xZOG}pRi-R%Xvbcn
zW&0>LZ?nFQ&M4bfLmYw-@gjTwK78~O;jr_wevKZb=#6^<AxfMa+#x$Zs)_C%B&i>#
zh`?5Jy!j~^Qdv(i5(e4%+Z*qUK&e?jnXvaSeI-OH)c$!?x@F(%z#Xvx=IfYD37}(o
z-M8pceV<J#2EH^cCiT>Ykm-YQ+cs{FS7RCBIp8DOtu4*Eu7|xlzEhr`ogM7$l_5p^
zn0q_0`5ktmCyXOz-?UVqiIK*-VgN3S=m8_};PTk&E{2fRa~9uAR9Mt$Fb(*u=}NS~
z&!;5Fknx1e@H}t50(rV`HQk5}7gRL+hpfsRA7_ofhdw4kq!5z|1RHADMj+i2qLfhP
z`8CllLYkeUN;>8*!&AxNJrf97s|VuyNObW*bbY)O%}=Duf~*3|aKWi@!_hvBG%TPJ
z3;OuxV{D|2CqWa7ECy<%JEYxFp!_Aq$}0~NE>sdn7#+y~f4hJ(Mn5!<`)LZ&;dw24
zAjf7C?>r*fA@Y4h2)e@AZ#NX;XPY&8LailY!iZ`NUKSCB_DdXMCQ)cbPs=UTm(C0)
zGLZPyHH|ldxYGOJi03+2Am29rE&ABc8$cj;8=c~bQr|dYQroY^#@&MOq`%x7Lwe{R
zgPgqaJ|e%RQKYXz7a{~m(CGL_B$-m`8i2gZrM0_;_>qn<Cqj1WjNQ%O?j!~mAag)Q
zoD(C=8dU5h-U0JH1kmc-{SXq)X-NX(d!FS__)Qc<hL}-74Al`4)gfV0YC7<u>CZ~8
z6OE0JlM`WtQjt_4vg<dl27$6VA~VvhbNKW6s7ECnsEF(tHPSm9c*6lNid!meNYM1_
zg$M)0i?oQSQzRmF!JrFLqO~iNxU(=?TJC4qBhedAb5!%MN<_9>&q<O<Cd!=3hMPS(
z*^;D6VCW{I2$5mF@kB+$9u!`L@DNcaPNFRxOb{0ZWH{9Q6aXrKk`iw4Ponz92G>W=
zyBmI)n|+W)nu*Ay4M3R-@G~x7WDk*0;#XINf&gcbBit?}Upzn(dNbgrQK^KK<<A=w
ztzfs&{CQ2>r+@QdL>dV@fR#zWLmjupph<FWgKR|bn;U6SD>`5!?@u$YCqBQDk$e)e
z5f!*N1CdBnI)ohU0nx%gzn7o{A%~%z4haWHDg-VtML&_Fe@vG2%t|Jp7M?n4B-g;}
z2h`$d%WGZ|$A7&5=nAPt)Z@47Y5_*Okohegb|kgf1JvRdoc*06)!^+lz))q`y)KgG
ztC{Zr{nk#E;U?}^aW7!!`y8rjqGA2Ik1eRfa3EC8PY2aW<75e^0W&jRv=0#ZpBe$S
zQN`GKl}Ht7$IykyZlG7W)_7#wF%q-?97GK<QH+=!YQ<3g$^jBZA}*_}h)&)?Qf6I{
zl^|VO+DVQi3=UY)c|V%uHi*Js<%z2B8Y|qdUnK31ISgXOTN%=;c`({LDd8MbRMHAW
z=KQusvKFKjci<9-*0lnRPd|HiI+};56*nQRFuJ;NSqM0?Rez#3GCE7*Q4$0eG8fcH
zalEu4fUKmcYa9QvHsUE{Abcs8&XQJWrUeEP>>_!FXds6GeDfE7U$1eH7zr*=4OD9e
zqW{Zp*Qy={xcTs92q{u?dI&b6mNwQ&ddjaC5ocGiLZjscNnGhr`c0K#7xMFar~oQ}
z6<2%JH=dDA`iT`!i!F&jOBtjO5=|SgeWZ7@eI5d;8CusJxv^s9uPR0CGc-vl5amFk
zUrjB=h$g114<PUP8AtrD)UPW*?3xQ1!tNtYWtcSq?N$@~zAhlOL!1at-SN5&UrK^H
z%m~>B;kG&{5Cw<8K|;Pj6-_L!B~(C4VdAMn^ztNohAuFvYfz!qKT<@ZG6{kTcguBM
zm1cpI0(ouY_m3d*A*D!9vAaTAp-~V>^kr-7ccO&C7=eBKlED5B6{<g>g2jG4uwnKC
z+(h#JVz$}<|2giwbY4&8NW26Gx!ytAts`&yOWnsB#5av4F9(PdKB+|zR7m-JB?<jk
zUYOAXiCWZRlX6_w%OnI~V(g)Ld897}nJPxOEe_Oe_<I1TG$u$MOE1((qw!|$kUYlP
zqlguggmEB`upY84MAnd)23?4FuHjYhnPa3n0f2K5fu3o<PP(I75X2@9$U#zx>la4&
zC~kv9$`Da>n8YYV2H>Tw@%af-Opv+*-tm`7C6TLZBqS;y<0K*xrVSz?xE;Mtf&d`F
z+9_pY5*Q#7^dgFnu9J`kNH}bKu5q0NP*~kTTJN_Dv)MIKREE2f4nm-izz4F2znEAT
z#RXuoMOCpI$B7KIKokaM_+*l#M6!T!rMOttk_LDc#d76-MJM8R0q|Brk_6#I*$Xbx
z9{!kZ{@-)9sXo9iipbznq~Hx@3!Pla;=gP{5_%MR<d>(CJ_Z-eWo!8G<LN$9Ioiw!
zYyo#@WZkXzLG6hDFID(}u%jXI^tTJlk2R0sCp_X$qO5NZc%YE&;JQyQgbX$C7!h!O
zH*G#n;QF3nu<Gl3FoY~(_+1n!O#7{0@cZq)KRu_X?RwzC91cD3)G-<&<1j@~iguxM
z?l&bOE~K>;=reK~w?hDF4~={Po(v6IN=P?|!#l`HfBx;_zgi?%u@hgn;ZZ&m6(w+b
z{31vlqGzCu(1)<;<?{hjX+9ycjr~_MUU&YeUMO{wfYX?^(~*2pHI!=@eXJwp8X^v0
z#XiPs8^0|Gk%NK8F`%jBB?qYP4JugS4xm7bzmbiOhX$@iU(5QEYB?gMkf~g=uO%K9
z(Yg*iz%S)JBJ0<vl#Wo8=Zzt&^eYYB*#eD3{V+=+*b(Ct@XM%B*2;eImpHH-WSX<J
zu_UD+3TxFG;exayujc~aS5od#6C<3cWF{3yFybItj2mc{kRnDKRoli}J)qg81pL8d
zQfm9VQ7`O(<_P?D(Oxv=u*a>|QpQSdkT$Dm)<y=6Cb4_B6^vyym~>3D7knx%8@mj8
zhKr)zIk@lZkvq)yFu*;8I*tTmzsgKe0%m={>0UV|W|uzO7bM$7&@(MyxoS-s<<n9^
zMb7pW+$!<gH(5+DnSq+ZkDTg!N%bv7vooCDSq5SR#^ArS-N32g)%MmKS)0@Y3nidK
z=9N7$OY|-v!qVP(!sCZXcZY*Ve1}a>&;TCH&>j0mI3`b$8LE=<OV7@oa1PbR%Or&&
znF6@b+K;k1_ullMI$s_NFV8D!&X1Msl8FH~C)flu;RW&ZR+-<vFV`DfjVjVuNY$Gy
zsC{H}!zEyr&);*sGQO_QfDTvq>N_;O6R+PjQ<3E{VH&Bvs4omAxd>jws@G~7GXP#0
zxaiQ+G0;PfLo$MK$;;rijYZYJq&2Wnea;p6a}l!+he|g-w53OHlW(1b6y%6w{xV#o
zD7W&lSyT63Z47DW?+(*?e}6=CmU_HfawP_8ImU>I^AWWd#YctZsDtKex*WERp?1bE
zfTPnV7?x^CLECS-3!7$)K<|9BjVan=PElogxOTAc5*StM_M6cmt_bV_?lxaheQUdy
zW3*R%G<!TKe>3-_#*#8dAIvh@wF^}Dy8EgZzPOc_tVGKGg^_$bIZz!M5G`n|%l<`P
z$jD&#yW6C#aVvd>2J&9*qQ?zC?s7Z8ed#U<+`{%0MW6M*nsser37K)$jC;cfb1T_)
zxPRzdR&gh~dZ-1L1v=f^j|E;_kD!=CF$rV#Iz<P%aKqo;hqGVGcb7+5%AV<8PxQCb
zLbL3R9<8@JaSNTRLtdCPSyBz@cmAdG((bambz2C3(}lrnoylfbV57<T_7kN!1qE-<
zTXPW;U)|L%685+fmeA=IzW}|sM|b!8bq@Th){37$ldTSH-W5R_<;c%Al&;rhL51>L
zZC(B?m>^VzhcIIA7;h{otoFgYhEWLKIXQMGOqs2wHIKyMU)R^Vj)Go@<GPa`H`Ax&
z(tmFY$(<r@Vrn1&9-Ho#+{V8Q-oMQu_V#@D+;ZgJGoNV_De37y-86f`nT7S2I7oF8
zrfw%jVfUJ|u1`Uqu^`8%!L9oB^HOgC>6HBTSzaYZ^oQ4R(iMbW<_BBV%tu~}-Dvn6
zOda$PjoaFH+p1Nq#rM$tPsWnGY5{f0q0gp`8YQ~)mL@$~-w)n1)H60VcIoMP`OSTF
zzBxPloo(i|=3Y35y%O#P-BuW_;uh$igjX>4(&f?jg`rF10)3rsm(;GIzaAx{<n-CH
z!9N%ySo-aubL>hklr7HoZQ(x`fmS*vhO*5lNNXt=Ah*1>e)~>3H(Wl>Lr=zG*~~$t
zbf5vp*nUr#Ys1yS6R$o{)J<n*cwApP=JLSbWc_>MVHlKV{QT2~+>vbq0hdE(`j(C<
zxOqD2ETnd=Kdp;Pq*hw0`ZeK2$Y?`@C2^ChJN@M!)KgmjcXlcds`@!(mp@KV=gOV=
zR22NnmUC3e3^<M=FN7sZKT?~*)3D7AWVEy$e5JI$h?zOrSaENzrUuKP>Xb#)Xhnqm
z`X7J48WKXKp1Y@X6_G9DiBIZ!nmD*laWMCX;gJvy9D}z&_yqVR!tntf)1IMaTUiqK
z6))}xV!R_#H)6*-Bu)DCcj@G?kZC6hVh3rT802lgptAmWGeMYZ=~9%M_c3n)1Mzbw
z@(Z#|9A^v-&3V>IpcIHyY?hXatIPdj{E6)^Pw-J>+QBwEnPy5=S+&Y|riJYK^)*Hg
zh#2MzrZW^~__^OA(e^=wY^(@~e0;m}Ej(?j>^zO}mxN#LTEBnwivNI9-N};6D$#}K
zf00~^>gRW%3UiM#HP{+6cE`^SwX{6S9c>Ts*|(phMVU7-L()>|4A~Y61!&UaNq_!D
zvZT+%<1qcLY~|OqvPRnb>Lts>WJrJF^ue^Wv_NVxRy6HaFKr;b(E=NMc8pf~$5)+l
zdOdW#9Lmx!-z#XH7DX{iqw5n7vZd<mt8+h|{$+!|7}1(dlEl|0vQ-toi(|_xHPT1t
zc5LnI3^U8u{!a`1YrX&Qzcwr=;|muq+%fQOZF$5*VWCLvzg3iz0*kSsrpN8PHJ2QG
z{RI;VJxFA2yfR7yE`5=iU4lZLP}bT}+J6VdOiK<eiE^mI)F=qaI7*IA`kWc0+xYfB
zACtNh^>(0lkMg<f)*j>O_HOwC+)i?cJRh)dR{-j{=y3to1(f#FuMx#XLbsGg{_Da+
zyHS_O2}dWKSZ;Cet(czDF#bX!cB`mX5Gp-aIYdxMWN+x+puK^w#Mqj3{-Xd;>a=b7
z5|`Q|&De#&;<etN-$<G2d8!+>UZlQAWN#D)dDY5-sKSV-AWJZ=rYgzuVHPUa4c>QX
z;l%&uaY8OEou4|S>+WzUD?0NQnpyhV?qc(<Hi6V$N=^|pW_G36#PM2`+s8H?YuM>q
zA5v{?au%y~vbzf_FRzU7nCckeJY=zzKT44D(i|}~b$&sp<o;WBGea+~mV7woq8-Ac
zieouS@mBQhTzVCgQT$8QXz@1_d&wxpqqfM+-1OAUV_zT$%l8>pGs86{Y_2jkxoyB0
z0JzNX=<JfYx2>kv-=k;B2Yqq!b7jgrqmvbi)CeYW2yHv`{4_l$18#*HxhL9a2AP~L
zcuohSZ99nC=~%*$PMdQ5Vp9`*EKoH;`@sjj_#1fB&Z{$~4&L8r;^eM&EY+{X{i3dl
z)rvth7BNoE_jtM)SX7W~$k(%vrA%Uv;<(KPtogdX{AehnQ#88+8!8sR9JO@c!YA%k
z1;VQFUx>8&zrp*R5)a#Cl=I)tTT;_lEDT*7=2;o!8J!P|@0=M_80wk$F=4{&k2-Am
zd0A~anPX5RMj0t&>@|yJ5)x-nv!ZX#VR>*!f_^LPKIV?4uXC7xW2)Gt0~)t9qi*20
zGn!MroC+<U`4Bs!Fq7oAG`#)BhtSq?x#`N+;yux272CG6t!g(=m7q|#1vOnCn%Mv#
z388S{99OaxL!fhJg>H<p4A4iLt*D*ZwO~i@4@;b3@t%?kc^t<YB_vn4E%GeWMktfa
z?PT5`035<{C6Dl{`8VkDU{>dqx$<S@74OBxL1<IkEI;!Imv^qr>nMElOLJQpive$o
zJkT<S8%)!cb*X-SfQ-@(Y)dMgAAz-HXOD1mke&MGR^qO^C+OWxl|B(2ddrxfM!!`w
zCy4nC2UnFeS2e5X=$mg<OhISr^aR<(7~;!?CM@gKcZ-j(ZUuRjV!g3eO47B)g%mU@
z{KjJ64)<rsO2qm1?=})oK97j_wpb6@xiAjzaX~`hf|&4P>&nsK1nYej8O#xa6iT<3
zdzNd{R^0jpdAb#r{f+ekF2_qq(4t27Ftdt1q2uAFOF6HhZK6w@1>ngby8&6L$533}
zwIj4*0fLph)~xuGYfzXRj1p(^%axAv*J6$?x%9&_<tw79Yu^+UH8sUz+Vc0xU6ZsA
zd4z7w6jiLx@-S?Y-^e0Vb{KKW;w<I+xG(6c$Lb;S<hSZm*RYev7Yz&F*yD?z2yH9P
zVQG0hSU3hnLGKTUunC`t<J0BRfFlukRLBUI$9s^n4l(G6ua^xQ!>6zTYi!OuLV?Gr
z8}zv2T^=B+7+S5g=NdVHQ`h1ls~paAZnd85{3LNyhTD3gdW&44##gNi8)?QPmCt0o
zNBMV-DtO{;8PMpoiGZ{+sSDp1zx0PMEQH3)rpT^P=mpfX2I%pc=s(Zf2LeEUj8h44
z;4w!tz%PDSYDD<=<>C=oYV!>7+n)+%_pAZ`bqmgF9)e|x+ZClC<2nUx^CzcsQ*Z*}
zu9H?^2|-lv)cNefV~`f-eML^5DPcr!bsxR-ASP=)6kK<_nemv2A8ft}8KE&nf)39F
z4<yeCi2^P%lAC&eQ(Ic{(_GY!xrK!LC%P@|Xke#POt_EP)^{hhh3Pt<I(BfE^dKJ{
z2Ncw-S)l9ydyhF4e3ekh>9sJBCwfq)yLI0fmzcYi%GUG6<&#^Og~D_uo9H}%<rbCC
zH;3~|B$Ec~k}Deo35KfFLEnmRA#ah<4ZpiHy&eaxM;19oWJ?CvL1zYm@#Ig<08K`m
zh08ikeG{x%Z=V+x@uEKAf*0xU55DY+@3)q{pu7cDOljnl<PKi3J9p`BVclNz42R5|
zYO{YNrp1aZk0Y0R&G!WYyt~jn^A)#ZC98)@bbFTjSa`n=rhUf;XWQV$%faWe;+j+A
z-fNXiKe6%K$ch5tyi9R@6o!;$x2v0X1~XgAvaG4%6$nDZs+aFmRRzY+7eHG<Xqr8~
zC#{Y(FF_NOnUT!s$d`-~E^}qfKV__r#i(Cf>7Q1lIeL+=j^p|Ojhr5D+>I@^>OjPY
zfIL$l4aj-9Gy?N5wyMjs-^e^%Xr)c>6`eB|ad<Sc68m6m*H*j612IeRo3EJ3%_}_W
zcZGUgnXI15QOZ^O_KfRz`*t!)YD$FFL5)UrW+zGW#avBaF=Aj~VRl~hN1B4$v{r~c
z9(OjW)rz`G^(`f5jyc&=cZbCxRNNW0k;fs1;qr~nQZai+*#8VX6wS2B`t$_w+~-Rw
z-pqP0_ju1uy!1!5AEzEWOYOOo#xd1%Z3r7%#oC$<7mgb9<k$)u;1Xfur}uWFmrCDW
z9p&8YU+LrwxvB2w2-$*4+Mj|0ux@vRVz)Qp)Ana&Q`ljPAe|B+okX`Xx~GmnfJb&v
zXE!ME2b4T)y*Oz!ZyP?@_;M;gb#UPN-oc^IY9}uY)^%7VlXd)(n5@SOX2r1iSC2n_
zP5r?p^-jsNY*@2y(X#8r(UJWD*Y;B=c`pAL;VIX5Z8UTN%61%5wo@=)skCcH_GFx_
z`H_FBGTbXrVU3CBRH(5uPpvbxWNpp*#el%fPQlWrIw8XgjyrQ~<ff}3PM&e9^TX9Z
zUkmrq`yb<L*UfbODl-T(r-pwT2?Tq07UA|RiMJz6^69Ls;Wqv{J^aMGE01?^`C#tA
zO!o4en2HJDU{?v5$J}!)b6pYS=_#Nh54Atyi(ZXKp@1(s1U37*Y0?*;Wz4iYr9>I*
z{E>zkqJAGUV`Y(BUz$Oq^VeeI294pi`md9nvke6b8)({A*f%vZPI<MbuNT8SBhZb^
zCp@|3TeTmKoQ@8_PZT?k>yhVqk2R@Os`V9X8<)RGSD}32i)m8D^Y50w@^#f|tFwB2
zkN<@D87ccPpVOl*8EXt(dH<Rw)j?q{>UjzdNRfhKKX+maHQEJ+GTf8e<gBdlc<`h1
ztH-e|x$#!+4&B%G?&WVfQfx!NK?bInvcu?{tw>Nn4Hh;iLzQc6rxQ?ry;7#Wo;E>`
zXY?w*<vOh81ZR*)b`V_E`zk#}RAyb_%ICLIo%6UJ4;#JeeH~W60NXcOazbU=>{dOK
z_^`bJewug9c}*I9njL6|cu`0>sqBUWYNGH)*H@`YEl=x{+#O<~ZMl;NUB#`2CI2Mu
z11;I0y3+oC?xaejy1UnL0{+Ris@xvAbnL9B{AxOsT#B##wzKMDX!Yfjb<GG^)QQiF
z%=?3|M>Uu`x9~HgxfJ#-<MU`1J1iBxx4!<8w5!IN7#L$Qe3qOy6kVpWcuWk$>6vyZ
z-3qu>+CBQ3=6QjvO7f{&ruHfc$6<A*8T~GX+V#Pg#jP!(91QZCWF}uB>eZD+<qD5S
z>g)WOV4z0nnDyBN0_x2TgIF!G7b~3i!P<lh_g4)<rI0J#nL_$J>}l@JrS!?*M~HKj
z$oedAi|@HumBB2$8g^!X%(3jCHYd@k*k$qggWScj8V=7#OGD0I=muWtOPl4{!f1yM
zq6nAsKLi}$s0xfbQ$O<jk)dB%N*wFp0lC5lrwmgzpe=cin~G<hT6oGS(c6QxFDo#q
z_qT0*x%+^fLC0OZb4=iM9o`H$j%JIh!&xZ_I$J3ac!Xl+P8%Fm<@Ins-pL$@^J=aA
zoFs=JB^axGtX5dqy>BH<oU&iSFjpy;<3@|4PX<tDKg=C>hvgx$sm|0mjrym9u6k#(
zl*@JM_j%oaop93)DF0;V^gotz$Je2Scx9-XP|ok*bjOFG`h>NG5@4c%J#)2rK>hhh
zX$Sqm>nu`%6!?iBbT0+pYrX^yF`7%H<Y=s>5OeAAeX16E=)L*+woT9N35V9)m`eyM
zQ^UxbSAM0kzBfPW8#bD?tzC>v@SsSO^Mo4p++@U?Q#Dv+<KSxlDsBtTsZM^!8{<<|
zNTs;!$xg;(E8`7tu>JUF2Ex%`rCX-B9=C7J=ie$>S==1vh8ZldRT~G?BZYjC!gaM4
z%^A|y{1~zeIujh!ELwKLBoStd_ll8~8Pcl$p7c_wdWWpX)AQb*>A<Ft0xb)+$>m!;
z*PWwobDL&V&Ax-;tQ-L{rf<c_QpTgaCde#C3e_;QUpq@IU7!n25qvJR3X*-EPX~qg
znc8>%X-+<v`#Y$s25ECEcy;OHBhl!rVa5w1V-*o+2uJIx+^T{vS>q3-9FGQQO$S^O
zI#3n=Mj0uF(6gY((qnmHcfoTFAQj;jp9>b^S4z{>BK*$VJQ?RyCcH^)ya1z(2*+sE
z3oi8Xh!O6zvt-eQu2N>pE!60|-ST$U>(JmJngR7YWq#|$3({4N9a%r#ndMHzzv#;R
zht79JWV-6ip+Kv_6CKJ46EIi%s@hDDdwvNo5{;Egsqc?N-II3kPdi=nr5W}hTrxoC
zr)zPc{;qI!JQy%b=5$bay7yw5402GdeG6xfI2n^k9)tJd-Z}rsSta}67JuAJOCa^7
z?V4r#Z(My?b%A2=Tk$(=4ff0#f63b<Du0Q$WXY5XM{Ci84xYPelxncp7MH-R>1*aS
zPiJGS@%UZeL}o?7d1==6J!F(HRBXl`TyRc?{1UeOT)rr7I<lOYdikTcv6z(Q&!3b<
z<==65heV<EcqHGcZb9|KnZFfRad`Wh-vcBX2iN)IRuvPx2<mHb4fcI~P=WtObcvv@
z5YAg!C=GMp)?Z)?eMKK%iD1i?mg*b0+MQs{Z6dv+9o$B}17RFC3*n00&0;my$PerE
z=;1I~-ixJv0imMtMzL=1lWP1dHJw4uFNL}yCpBK5Ky^u1S?&tH;MMY%8ikMT)%lVL
zk@GIpPvYJqWUt+yP}#s2qH1YV8RHvEPI_|ZJTo-QU;4%jw5}fa{50bQ0J;Y0=$E3U
zk+PSvDPP>d@av(uQm`}(&nxs6-S#`2R$E51Hm(AUNNr|&gylkw={h<BWvp9>U(k-a
z!>!LFKLhhG2x6Ne-wKmFm0(!E@5_E`ynI%!;bpA#l-=3-TEg+jxQrtNZs%05jlzCi
z@Jmni9Ma>p235mGRgJB_vuqTq*7)X~K_`rYGAuZ&2F2liiDNNoj!tFi2%~%L0zgnl
zDN8K4Ls$*X53)<Z2m7wfaL8Xj4-b-Sf8(<rie>UsIJ{gCF6>h?5H(?upstE|=hDHZ
ztYdn73u*_<*WJOS@Ttj@Bcj2%r!8N2dgb187ZM}f79Zf+h?z2bR+;$*Q6issFEwz=
zhWg2D%wXS8u&vb7;Ru8L9Vpd3Z4#+Y@`-#%{i69M4p|Qy<7&1AbF%dmB#M^2uxn*;
zOmDAm1e*1zWQz^#k_KQ|?XaY~P%u*0a`J|k=skCb<~GhrqcHU4IBN--Kcm+nZdBrI
z<`Kd?Oa(94(paq+P;bj!cUtUvnZuO(tL@pZxtt4KUBp7aN{~?spfD%I2y^LJU}L>4
z3d`Nf>LOD%ToaLNs0XTnInS7jCYA?pycqjHFfE1()(RryT_8syG^M;AHnPGe+VaLx
z^g?u;yA7a5FEXN9I;+~IbgJs~H((QiUyk<tQlcih656&cs7t_B1NqKpYT6w9W+BHy
zepr5RF7*h3;^PzJ10QyfnP2)kM)lx~?wiBicSA}ZSmQ<B-ac>r2haA9k15Q?O8MFH
zR;yPH7tHRrIpu=a2oiDGvlXVV0x8^LLN5r8KyDP2#F8{K9Efgmjzk-Tk=t)n+B8#v
zy#p$>`wr^f?60D<#y7mfn$PP*x~Y6^u%;WLM-d2$x*r2$;FdQt9OVcvi*~qHy;c*l
z4@guy7FoY;x-QiiJ+(MDgD~4vEFx0|nNr;@6Nq`fBgnM;sma4uhe;!rzSQcWrFn}3
zQ=RF^<3q)jJdAE1JD-a^8CkD+uSeB2>Snz1YWXq8t74o762*o0#JBQ@?{Udx4@S|)
zPk0LG7hO?yAH@y^QgS-&M;+J0&zdXc@*$(pd3?xDScmuQ7pr0M{x&9f1WCpp9x@kw
z9WCz+Ns(TyT65@9lrDX_Y$2<s9T^chTR}(#JsuG_DlzVYXF7s8K#x0FFyvBTceVoe
z*?KGPxWl>U_x`Deie?jll^4U%t-?q4xQYq~0{R*eF=5sp7Zp-ZcMgwqw|~Rc+DJW-
zir3BGg5uu89Dz>at2-!$jIex+H_@S%Yk%wci?xbT$WLvrXJ=WQ{RYJOByzS>huwt1
zy4-D72JP-=JyFsQP1Z2l)NK$VUI}@Jovb?I)$n|(S_M+W{F4zZs12Z5MDC{=!m|zR
z4vylDgI2ky3r^^Lw+0z(#3RLs^YgDNI`6B7&%Rb#cH7T?;ZCG9-)L6jLrYVH**fUy
ztc8Rn_|IJ7kM{aKmmy#fvWucaFK$T;LvrMTQmB#}NrNAm0_PvkO;sy@E4H${`N0_P
z*ICKIe0aC${m&&ES_&Jm=a?{!dO6>T{QdHNkYbwT-YW{cCQ5PEQ$q|HwJ`3vi*Q{l
z_M8>I_NlgqY61b|R6CzUx|z8a6PhyW^*(yo>laWtBXm12Z=jy`GYTsn3pBBwmMnm5
zq>aGbEx}gDU=HcwEo2h=K`_Quj+HR_rgD8rwf?Cv<CMz8aIjyKvok_VpY3L35%*VJ
zv5l%q0kCvnNRWQ=OYXTw5Q2c{y8I(_eGRrM#u}vE)(1sWPqSS=SR;6yO9mlqWsOfQ
zD%8*k@e)O?r+w;Z)P<E<51OjbY`pDmgYLyI!;J_wOFnD-UbR$xH87JvsXJWE2XABu
zeEE2;77MsqgFW`-2**agq$wDq<ym(+g%9qi`VWw{2_pcVlt^j*+Ani5B70~!9=ytM
z*sJORI;GPvSKwFnaw9~|L(I9Yhb{#qo;g;P{xcdpMp1!a3qz~bVh6<^8Qe*1v#h<W
zAlae_V^J~#`8th~j_}#Yh_Z9Z!iELiMJMILBa8MQ))V_P`UhoV#r)Zr0To~-zp^PE
z5mWpg6p<gDFnb&+oo@IvQo2U81{-vKSkn4ae8ig1KqX@p8xU**iOgzMQy20hi^gyX
zXIMV8Q<HUZX=M$jBM=4x-vS1t;52E2N8s0lj}43d8G?Rrf`YuxA5?^+)Il}aXu5sq
z(jqm;ds*W%#UF&Blb$yx$PijStG<YC*j4`~DilLONnL|2HSxao<w52phUD-!QZ-m=
zBXv<H+mv$*Yn4BB90r^c16V^4_X8WK)<rH!ngB3yBeyhtbt2&q?A=u78z~?*xb3^>
zP!xp77w%ti0YSpQRS7g}fcg($#c7{jzZdB?L3WU?=oJpQeOV4Y?okcb79CiNGABY{
z$vDXx@0=X|nkEoG(2Ai?I)e0W<UX`;@gdQ{YV|NviV+rQZVcAeV2AfsweKYB;)ZgK
z?TN@;Ou}L4R~h?1h7LP_*8!k5>YCi*@dq)A38*zp8|ISVbMuv#z^Vauvz?w;N#H|*
zT4s$8=%?|)r9^gKK0+3KNXwpEsM~+H4kE&GcbD_D26ys&R0JC<PL<eb8?Z2ILa;R-
zpTH%6Bq{^W6epDTDKVjx%STap$HU=b<gSz>$U>JBGFRk6ydl-zrJfrV{3noI4JWG6
z@P4H|w_aUmJL_3DA?m2AwvBL~wV?*vr9R*uf{B6oTI1gwPSVR7R}~i{3<RA*n70M~
ztg+arQX`JQ2d6H)mFSGIlr{xPhXXvd#Tl?U`Nm19XRSz0NRc}t4afdeWE9075T~90
zD(-M44Phj_^*(23SKmFnGZ=g3hdVlQbm*jBszP*P1Tx=J+C9QJvE5b0GjBif44n&9
zxMbzW+xNQM4!)7-uQkZE!XgMgmVvyGLE(6{b9w_HXsiwK9NCAOre!V<IaA7;-AnH`
z^z6||wQf-UlPkO=OY82C-8%E6c>18#M#*ctQi7qU#>4@__1{&<;ml|=4eXnenI{_t
zQF3E~u99hhi0YtISA%ug+jD6<nK5{2+P-jWi+^c}l6;HW23n#A^Tp@A!%oq$q02*5
zeuiMt%Gb+wr|+3@=R5y`Pk5M`Z1|uE+xG9ek+VzN%O|YE(9w=pE%cqKtDtfhAR&{R
zBETB&<rlK@E=)>cZXT63HvJ$Q&2hQv+!-spONjHxPLw2kl^Z9mETSwf1tdoY-hoW1
zBgSuP*Po_jbBO5d95vhy&RfLeo#R6J;Dtx%hUv*z4~od|){1nKpx~+&G$PXQ0zx{^
zeq6lg`(<UG9uVHX?#(jh0^wO-E7F!*KQiLcNzHE0)kLEceLM5PpXFx7Xv&9y_2%cO
ze*z2>CmPcwN3jaLj=Qa_@FOFZ9u&>!!ueMP1qJwiD3pvqVP>U$B8$3Ic~m8F21IMQ
zWZ@I(=DR;t4|Ma6LlmSjr6D?vcip>T6mJ<1h37ZZ>RSI)PEfsvqNbFiqUtAXP5$A2
z7D{`HezZIHB*=Hv0P@CijnJS9;LIW9_}mUr#y3dCFVQ7*UQj&O1qDogqene>$Uk19
zK3Rn4TPt2zBzzLZAUda!dCU7jx8)}{iagr)mloZ?$xazr<7N8Q?Kh~R&_>);ECvBO
za_Pj$3MZ-1Q>*cLw6g6ohwh=#DOblda7d^ukBW>k2+qv0T?8)G@doQZFiZ4_Z3t=+
zcxb4&AV^d6=+=zEn>Jng1bDmrJW?*i1A>W+cc_BEKVgD1=KxtVFiIwL{S@tf^y@C!
z-9Mx5fU}9U2R@u9>+9PBERFdtbGZ}KDwJ;({qUXHjC=IEk0Fi@MD2v(B5`;IqEmh8
zu7go_UmV1BijPUg2iEg&(v^S`;QGa<jUsga!i0$dt+?!t4%{?#I#{dZ<bg?Jm<+;9
zdUsnZXhVNtw8mSrMlv_B{VYg>>Mwe$HGVfun#(>^K2hcIqnG?A`{vmeAeC>8V;iCU
zQ{@%SMAtT~_iv#yy>}}EK$--r#%%>|Pn1*iMz7GXvXzyon*>pczM9#hj8H9>4}MMa
z*b}DKv4|9qRF}LIuzCNdu5TgZ-!DQRpZ75h7(bj7UC|}S{ZrBV=VaER-m{TzhxUF{
zrL$2$^-3#Rft^M$fB0pm!C<G;p)pgmsQERhJ8AXXPKO^z<ij@FDc@gqnsVAsUug>}
zZAVZjxh{8iCLNlN+MC!esSN^;OWU5He_{*j4oFIHPa{DXIcn=SiJ#v$0dbZ|!&Q<b
z(e*rpGsgr99GDrEJ$I9Hi6NI@rw$;mg%Gv*e59MlLR;K%7l4?p(J~{uP%X4;+T4i2
zx(yVOwAl`5bD_0QCKsi+4`$W{#F>E8YGO}lT4&BdobL3wnvULx(<*Dl9@_(_Ck}`q
zz3!ZPj9ds+hhj`n2B<L|02qNJt3+bTy3+zJ1n&0vypg)jH4jZ3yoB7%sy|kJTFVml
z184dZU=-yn0l*OMr3r$mpck;}?7oi(V5kfEO72cep-9NE8VAHz!})(x)O7o&QLCJ)
zKuU#Z|7p}l4`R~yQi=z!AzK{9p=wc_3h}|E;K4<<eP$yn32&k2o)vz_ahq><!>+Eo
z@<#Q2F~G`@4<<4THi&9t4{8a@r(C}`Yow`t|6FHq-~BaMzjj1>Se%R>f^{?QXNB76
zdo={QpC+wU4@}ym_il4C;L>e~?V!fRJ?d+6lIhtDQUkbow}UR%Hv$l?YY^M{V|~#;
zE!}tChxLuJ#jhrIQhwu}U0_J(;%XxDlIOyRazZl9x6j9`REJ5$!JPY9%5gNZ21%k}
z4AAiGtCK+<EpSW#R+<8Jxkp2+PjWmP%Y{fN3fplm<=^3;;uhfZR!c3ZNB$-B&H>L%
zM@qY!YYgsIJ*0XBr$%J(s$}7o=NC>SWc()B5wy}h;w%7B$i}q|^BV+N;*W^wL#yfC
zgDlqunO6&oB}X3)4zGrP9>6bGTbu7vGs^=T-x7u%wnbPlI~x(J0peT~5ooDn>G{`S
zFI6B|nK}UCiKM+B{f0d<SEEjS>lRS7{r4bK!nU<s3MjUz`F)$tWy=RYT{q{*H!`yP
z1FNpPXs_>~>La*Q#4VQsZ&{>&%P9DGLjP}DCT>$uv+Csrb>A1EK$Y2it7zjZF>eq?
z-l+Tjo!yoXp;!*!wmx?^NyyVrFUl!_sl!zWojSrT8gP`I6g$y@*y-}#lJ*@?vlapt
zP)kF4NGQ!aI)~UprgV0L{*sSkB_$|`i}NI-d20h}u(fo2=yxN>^w+!;vhr-^zyU3f
z|I4g>ldYMf*my{+z_>%^HBD~1>qLUeIxAircXyl!v4v<6JpJnB%|HF+)mv*;J#pf6
z#g${B=l`_o&ftex;gkZgt4ilqTFs>@TtW(-AaRGwYvmsYb%}#e{OGQ|%&Cj?cl~yI
zvd5aO6@pj(2N5)X2pp8jzJX%tYP?#!_rM|1;#l0_wUp=CMeb%kSk#%-c(rr4GTbt%
zkN2nFGAo5*l1{qZM_eCdNij+6JZD$od7K0klMGlH2&$5ba3npG(O7rXodT%)37y@2
zVLt`_i=*x&7(H8{tU2?mqn=_3WiI`}NZv2%G~sn|VeTb?zkWu|w6)7SIX-(hG>*Ln
z_hL3+3=D|xZt2fNzE+_Y-~ntI+!s2}PDWXyK{SJo47!ir(av^|8N|uGnxptLRrSHB
z?$8aaw>8m?EIO)mNW0hz$G66mZkvi1&M?E1Ye77lGMy!3h=th|YI^l@TdLiaKN4{(
zFTLM4Dtzym?h4nRmRW4txuogY_lhavUZvCb2z7bu+0R@Q+_)`b$en)gUfx!;C%M9D
z+gp>}1N#~wSzV4kAwj)?>rIFu0)v!h!a=^mnTQR5VVwTrVKU0^ihy|_%zl2{A4SC>
zDq>1aold?oS~&0cYN>a*JDQ!1*^P!>K}>|IXTBzoUyQo`vg&Rz=ZL7v&oO$z`xfRx
z<Q$4z1OW%HF}uz)g9^dPjW}px(VlnsPaxTXa#<_-1Mqadefsg0g%B{;19{AnkP;gX
z%Bx_85X2-F1KH0a%O|fDi*gL~&Ug)IZm;e&oqaP1q&ti0x;1xQy)1gsggL0uNWkO~
ztFRmXQ!*4Heq=T@rE3!>g^2R@ce^`EETf<hG1>X)(gx0pvgTxhk>~D83;%j^vwyf9
z;>=F{<4`XO8WFYF>(0DusiRn`2B>ET71w{G<orQ}A|SVjiCP*&2N};lk8>+qzE&<F
zLSuTRvUISv()Iv*tiwn8l1wiqex|_ODJ*lHwA6mUt>A3n>Acol>)FU6xhPJr!eZPJ
z$R?(&R6I6lCDNXw`dN9PgDMY2#TADdisx`bYZ_;A8lMLS7Ns?bwh*-K3LEVlx8n&@
z<d1u2poYVzM31`ePcX4i$s@67RCBeWJ_ox5&Bdu+ZE_@G={a?&%cnX)&6OOE0X(pi
z(d|sRh3##XOg%C{4GD8wllOv>`cV=yJq7Q^bu3y&K+JsiAaUO>kr*jD6A1qaS1M;J
zoR5Wo&Mc_>|CU*lbT-*sro8IA3Re-@8Fi|H_8mr^zS`6Fg$kWC<OK2L-p8mSX;UWn
zkMwrrkJ-p&mzj8Tfg5JdxqO;t<!O+dYql7w(WP!(^V#Fu69bfAC^J17lbn!F1_7JV
zt*dD}{v94c)aDWUO%BO6r|cYXNT}Te(yxne9a~hkpkkr;Gy)x&BWYFfyl1|ud#rOQ
z)_XTOG6Gep=t=OCFT8tCx*!kK?)DYFKW9`P@#rGk1HEd%t2!>t%OGHTzUpP5@YQt)
zb+yZy0|(h`c-Vy9_6=;-OdaIt&iXRD;P>8PYZ(Q0)QudyL5kI1mU`LMC&=W!!(M(D
z>3U1CgOVDzb-_JFD4??fQDc*TIw{OvimOcC69>OVg{=yxcpsIW^z~Y^{mZFHrUj`R
z{d3DxYML{#<h9b<fg`ew1AKGnkUsBCn<_?(bsR#uPxjc4<|3e2r|!CL$3|}8G$j%7
ze%C*tQ<jWiWQc6d_fqRlFsFK^%psj24EAtzchb7!cD}mz`ABAa(S@0jp7BYV1qhNk
zN@AsI6&%@=aXHMuKkuYI<;AdCiTzpJh|b>j(K*_idKHC5^Uv?wh;xl=oYRXen!5>X
zLJlVaHQ@$p6J<@e>!CeLyFdlZQ6{oofo#_yP~k{L)X?gQpNJgOkiDHYb)R+AxEL)R
zT;(FQ@GQeiJ1Zis=-6OnOnb0pEu!;7Z;mzBhm)k-o?ZQJSx2X3BozO0!827ifDmKu
z)%aK23O_&<eqwNd<NxvXoncL7ZP)gS1tUees6hegO{z*$Cx8ruUIe5QFe1GTDqyJN
zAiXIlAXNlH4+;sW5D+50M1yoGkzVud1L8Q3yx%{5%;n_la+h_lwKf>9&Uk|q(XeDd
zrq|mG;>BMd@O?tE!q`hqoE76e_Tu!Su<B3wBD|suGMs~7UGd-y@z!NQVuF7QrJ3T(
zo{lpSW>9r7c&hQw?Sg6diStY;wXc{#8^j!kNf5ks;#q<hofZVj_p^QYfdARy8ujpJ
zn;rO+uvwb22g2*b>I-=HNmz1Q!Sf_w8Si6Xc6u1P^c(btc7mdKAyaq!xDC_KgOa!J
zS~aS<;1B4a7{}>4{eDpVk3wToTXh6XGoA?mKxb~Bc#+`7uLVFrurNoTTN*3f%H1l)
z33^=hJ0ClJSD9tl&slbl_9Zfgy?ppv5}g`RNbHh&ILU_2p<AgDQCS!V{Vo~Leot~v
zENB?Ux!RkKk4XKDNwO0WCOtTdXlQrpwTdUV*&X7Un*#CxE|8~>6zXfVi2qSk#M6GB
z6iLA~JK<f$TpN9gV>BAm(n#&Tu+I@U<v;_6Wg;WajYJY_jGuH6(0SRpR7F~vnDHb4
zWbop?5*Gi<s++at6NLjvw$wOjt~D%s{Y5COhd;mFw+)}ZTXCzdV&{enm&er$Zw7Qn
zjrlg%p0O(%C4`Zn#fh}o0bwV)hZy%MwPWpdN{MhQI3-C9udGrcKVz<dAk5VHPrW~F
ze#-~cTt*QsxjI}QkNm8;;+8r4u*RD|#PRm+s%?IVfzmHEm%z?QuD;%ZxNT~#)XE&b
z138fZGJTcrHkSJCA^@*N*@fNBs<N2f$=2&du5fcJN*4mJtcY&p^c@R;B9AD80+&+`
zuT$qFrGS8_Y!c4#IsMV)=e06A^0#kKvPBHEaUIUZ>)UKx*qN<sHGd#ZX>^Fa;m5T?
zU)Om+p9vBZNW)Z$6?Y&%og~9<=wcN^7fa9zuI@~IJ7B%6>Efv+Y*qa|fjKiAfDG}+
zyu^?B>uexaq9CvmN$VrU6EarNY@&phI!5<<!S`|RX0w?E&d<)s^L@QP&rfpxgDgB?
zDO?2o)8DV===~Xv1N2TCT&DfP>SkIC%m<uDK{1t6^;n9IU>hu+L^kps7Zse(ub|N>
z7Vr|xpIU)!tGxd#ON|>iD{OnyxC8Wmk@Wm*4sPmh;Vh03e_wy%*k6Fy%wyy6e-t0~
zPd@=*4iNIB4BZBD=8c)tIB^3QmDoqM*Sy~!SrCEwxq(-qGk30h9PsO_ULUayY>hv4
zV=(iuvv!O-!1`QdbNUX5J>F``9h2u(^HF5sjjNAYLMHqUZUWuSuTiLn$L7S#1ZTuH
zQK)wmkvDUoQDd`pFotQz(3zq}?6uDvb#{!sm+;*jZj$`C)P`T@g<ij-qPo2zC#cgo
zA1}i}oql7h%1lUGYO(I|%GsFwikIjE^6PKm=vFP1A>v^qr6)tm0L?m-pftYB*|T|o
z+-on8Ch2Y10s3{z6wuB754_cywNZZgjeEx|^J1ql*)i0=)aD+b%7n#9g%UJhNYM?c
zMW7~PQWDre8p~xpKYo0dID8ADAJ3m_vFPy&g??imnx#$b_n!!!f&%ar!00EK#1D25
zrRsj9{ufJrH={~{e(8k>TK|3_sP<hq5frPhcCR02A4ZYANDtORj`b1|t9@;!oI{X)
z31WWG(L!E`uC4fc|9H2m6@`6&vJOBhUi=Erir!OLc94nCf)dIfe|T=sVB*+<XD3dI
zW7>#Pc|YJ;Pm#1Lu8-^+@T|E?QF(k(d4C>MHL6;Y&0mnyi9z(`*N1x3v2%6#viUct
zyYG5*I1j;>n-RT9^hL?suRMN+rc<7r#@N343s8(CTK{qJXA}6#HpXH$8yYiiP%HP{
zhrcbqR4@56$(NKwOq|l@(TQ_UZ?pzX{%c$PICqH<O!O(L<}b^X$brda@>=^FrQT1$
zcw0~3o{3|ku>6;)-@jy-+&XV{ezGAq(s}&#k`Qcou@wwDbu_j+U?x5iMf<ngyce5v
z8_>ph1*oOEtVN)Hv@xId*jOCkI<BBJGUr-<3>J&&u$MBx`oEv=_FAp^E5WK4u2Fjc
z>|Lt?@zX{i=QU_JHbFcVj;ad3C|d9gkYaKowr*cub-QW=iY9ym0>pguTatfSqMyqa
zy$Nz_MPYgbZBFDSIEQXsy&0FSqeT5vBsGldqa0W$&|+56U8ge-SH-_MC)wL`=nOjk
zDZsDo;kXGShOgt33bi+LZWJ)<DFR^B&FO4z{Q-yYEnrkqbtbJDyP)?1f}qRzZMT(I
zI@53AWB*+nS>4o`a~nv6{Lx3841}<eZ4gnoE?igm)iU!VyVtgFP^4K&g%!L3-%NU3
z`|OMLFjEhlAE+=--RQV=KI)8a%9-&Gv2mq$-;C}Cy^8c!U0~#w8^O`DZt(=_Razrc
zj%+s@$cctfrhTcKC{wSmf8--$vPI&L1o$h;)Run3Q1xl?W~JLFex<D~v8~wE=Ubjr
zN$WMX^bzu6?UWEKC7ZGG;DZ^^>Bm2djf;Ke9ROh=-8&1zPv2DBOnigKu8x+?wJndl
znoy8{(oTnvj~(Cw{?<ypIr|H?Of6g6#Y10#tC!j=6q27bdk2DU1{xPZ+QE|+{u?!}
zcCR>SO_o=_$Rv-LdVij5kH;vi7t=tNxgv^Yj&<@_4qD6fHV$&{*hjPOW&~lYFha=(
zOuUEA{ft}L)E3hUXTXXB7>H#35&%ek|80TLI1R$cd(YnPSkcRX2K4}f9HIfP4^VeS
zf55YTc;*^%ne?Nds_3?ww7cQg@48Z(D^9P9q`0&Dj_tLg97(_wa*HSy7?Gd!c0P9%
zfl2xp<*XeL0}#L_3g2NkoL1{Pun3U|d!JWk<^KL-cI-0Tz1uv$#0$dubFRgL-D84q
zWI)`_8%C>d=EZZ4;BW}|QxiS{nt+v>h-2}KTw|dVL2*)HIq8CJ_xCCmc$1^q3}SqR
zV1jN>?CdwSjNnHAUPp%(IjzEVymW)fcp+kGTlgjLmsTztCgrzWm@-#QlN6*g5nNlW
z_c8xIrdQ$*BE&{F?18I0wiC=7!9>W+x9#kncnFbs$H^cJ6OCyjJZXz^{Z=*lcAc<)
z($NPADl1RsN2+1HbcDOUx_2j}m)|3L9~R_GaDQans-`MglBhs7=WWs)wj^N_zWgd)
z?_l0WRda553`kY}cMCtB+A1JS5PIH2v!m<POW&+lraTuaR;pJ6C1=yv?osFBO;-u)
z`BihdYqcf4t+YZX?=()Ufh2ry=TLu@SBB?WyBE2K>^Il8=I63Dx8}DpwQfvnsplAP
zKI7>}9cg(vuj`=uZAEea(OCtT>07j8)zbm%rg96t;XXYtr;Jx*H&62<;%>VpkP~dw
z1dV#wqqR{!l_#vt&K`|K>6)ae=uC~930a+wUKsp32=z(vf%&e0+6_w)%MhWOOFNE)
zKO+YEvKXL75})-k7Wc*;3tLF4ULW60l)Tq%JNv=5xUJK1tnB5><mC{WP@B9;4?S7X
zu9(!A5ze;e_qoAzk~TtM8tz`OF)W{z2RX_7AW#MV7H6ND0ngynoO@X!R7$Gzqck(R
zqyDbi4*jERtmN5rf2!+0FQxW;O~Q(f&K!TMh)5>%vZ{Q&-jg_AD5M@#W`G<TrSL=f
z%lbv!FHNc>|AL*sE|=3AO=>0E8G1#=a6p)h;XM(gzYO&rqQ^RFWsO|f@+xQuzwXZB
zWLchlA0RAQV8C$V^3%gxc#^wxRc>P^i@~=kze(p81TNQBx!N6U26wt#ox4)I#|(Yv
zh@$pcW_0~8CrI8L$|5y%a@X^leB(i38^E6v@!Jvk>+&C4NT<65{ql<6OwChIyx7%m
z&s}Qn86sWGHAT^rk_dv?w<MLX#@f?OK0{&)avD)zZM%D-T~wfHWr-NWIO8tXGn=D<
zUM{>;K!b?IQ+ozX9A?~}TYx15c|LkLI&QeU^r96d?1;?-v;WZ(&^Q??&I?CNUvjFP
zqX><sJ6@U+Ypg&<dB?oSRY88u_nolU8ZB!Of$>D#x<`(|iM8P(QA`;x0pF<i?QG6A
zQ_;(X2SLc%WB?Gr2rc9zPm1T=yfKCg@50q<?-;^A3N#=RS3<H_We!#}oTzk8xfC`=
zG<(x;OEX>r=TvL~U<)~j%Ac4FQJr8A@uu#;CSdfw+-8TNbqd*~p?V4myuQp16|<h8
z;K&9gnrA|=lg|)AUa^3-bG$JK)zeW<#OwO5zArKIB~ra4B|?jUb3`ZCRtJ!5Qm>Xv
zg)U2g8vdnoomjH8t`3)ZSGQf4{A-O%#@INim8JZ=YFz$hC6}CyJp5M7w&V95+_7us
zKP`E7z}u5n7Az6356?ISXUV9g1>@Dn@xvv3==#_e><0wfN<@9rARk8o)2?~3m9Fc5
z<(;UsNNI`jCamA}jbE#iF7Rb82$3aLpK$w86UurtxgEC=^l!+QThDd#onGu;@{$6C
zlJTVS^L4u}9ev~-DVdrtwfOGE%CVHnZyUt&1gfeZ^KkpA-Nxc4f^6gCO8ZsJ8G;9E
zT!w0}llI0|l*KO#GI?_S6|3>8v@h%(91-I_eh0WdUfL=j-KE(jUFzM<dy1AV?Vgfy
zIHl2(XEKo8b~Z0x4%Ugy_I|wK)~%s^(08<6ful!bQZOB9Mfv1tVesj0Mwb(ouUj7(
zP}UhJ(6lkzE&G~N`}@*?)U}b~n&GmlmVMX3YbxKg_8*&1YbA(gXe>a{J&DP4pu$wv
zvxsIm<ues~jV;vy-FMP7yAgl-_^>p=*5S-NEAq^r)9guscVu6tDn)%}PxV5Z5|)k^
z)t+UGim)I@G6(48UZn=07kWbk7Zhex$rGkNU-4uUNU<LDOsa_}v`pYb`2B1%6Ou!V
zIe|d)q5s*?vzk$p9}-f$*S@iyf*2a2Pm0^V7LWR_4Oyp*+*YRK;8t1P<Z?yOL_V14
z$p%_NQ=}T1Cf$hNFcC3Xe>))f;xQn@&9~$`aeX`rtu0e5#&7tm7r>3FbL6rW8QSXX
z0uA?P37?(2aiZV!vmjoV){kn6*`eIWj(IONtW|qXmd&tfSs%$2qpM0|vA20+DVtr?
zre}in9Vs%qar6OoME?6)&{4MYYmScj9}u!HGZmR1T2!~>b^1<bJFuV<p7U7CluKB`
z9aYoY4sR22A3!t5oQELd2JCCrq>An#Re3Gw9LlbqZ!ZZy^+>hk@f4@ew*ucBPKpDw
zQ^-}9JQzuzh$l>`pZLIo<N?Q*Ck_*`61Fs=!Th`dKdi^dRv~bii4JeZjr&|odx!D6
zVL^R!vscEY1#;imttc#t-ak_!aOPDp!@hr>J#)XAlqbm=vw`-D>XV2@E)KN0>XlsI
zc)JRzDlmswgKA|&FPA74LeZhRbj3wBrRY8FWqI8jULxM9dZ>jQ&hzI<HT<QciKuVZ
zKznMlAG+w-;j+{`q2m#D*O%5U+<YpU^<+P}E2brC&vGG3N!oo!EYK$--l5c5CBTyM
zilQ}j<-8j%zVNjBR+4jE+1HIjlsYnxTQ1I5%Xz}K_v~H2^n5(CC|X7&*W`bbJ;1%$
z&jLzF+6P<teuyq#S{ZqO<vu#<k_7&fKCz&{_fZj2g<{jp4ep+=_Pg`;&a*GFs*(2>
z_^l|Nt_NB*+tM6p1rF^K$l?-AL-q2aU-=tZHc8J(-;u6$xnm0C2s;sv-8MpU-ju^;
zi`MYTTixxJdk*bsRr-f?C5m#4!*4XJmPg(|4^{K+2ZY47UkRDbeAvim9MeItxb)u;
zk(2GOS`phY#<H7AlLecVIRWIqE8dGQ!3kx(4G-rfpc|Qk2iwbs+NH7f3|16Ah4rt7
zl!GTN;S@HS8uQ4~ft`B{{`g!oUV46y=BH5j==Eo!Yke9S9dZeo`D&!0>kMuK2kl7?
zX{GAS5ov!Z%D%`gt&}o-k*jV2KPp$86-zjK#DhZ=T|m6Vxt86nGg79>b*4jn%_AkQ
zwD`Sl{cp9w4nW;1z3F`vrYX;;VM$2}m^*%#yqGQ-#bS}RYbpy*QYPZ5ndKs)PHh&8
zshnVGD~HHJ1~J8_dF>EdOBP56$>P4|)fTtrHlv4{TU-EEOs(uHZJk709`=1tz8nfr
z9HRxN+7ZCV?3pP7q%SotwX<m?|CfuvQ3f~jpngHePevYu0|@)kQGKAJ)pJs%QH<p3
z!!o3uKO`*Wz8X4)Kekx?@e^C+q^lqa;r*GE;X4Xq?39`a{qUmGcfIBe5Ng$dbidSG
zoMJooT!_`J>*i|XDCtG~Z6hw#y`Pb`50KqsVpbFzEhIW{KW=sKgM{v>zcl3MZV$R;
zEptk{%WFDmlYBZV$Z|9DS@Wd8!AAT<W2I-nPx$KRu;|`jpvMP2y!Fg<X6zCnO_h%@
zjMTZU2l%K~eVQ$j{XuVJyX(D8&$&0-!^0)Mp4p+=bAsYNS#p?^b8QvsaugOQ4d)ms
zhnWaRQgXB_Y0;6UR`AKoS?$Vucn>_sJa>p6ip;cf8zgGraNe+52!?MoAD1w8G4nH)
zJkGSze63gZ44R{GeA4>-<W*d2J)wRls4F)7LOhoCM^rztD0_`ILF+FuHv|0LM$%t5
zZ{RgIRo1iB*zYa?`k$6X%@t(5c`I1`<p_-La16>m+7hf!kribHH~ZpGIk(n@7+ZKa
zu8uUT;?nEQN#L{k(lX=%@bM)7xud_AnKr`yXlNWnN(j#8z%VuFUU(#62hYoTQ_%DQ
z|CT58-32M845y_w$^0i|-Uwn&kMEc2)dk<)SxmjAy2V*_Lo{>njF&FEJhkPDOG|F9
z@kMo=a?mTD+Y_wvPu3E+j`kdDL79${ILyXSA|wIB{8}iKx%6wG7xLWtyW#zG_mx?+
z)DmoYLCM{*>eO>-AEP*|8uD~n`EDPfAd`!cs`nijkof~p)YpLEdmfrIuAkvq@8R}r
z9mp^p3tf-)G}i7oLb{_F)VM^Z^$zQNumII!kzkKOqWt1V#i$7rP{T;AgZ9C&J6y<?
zXE;v-EJzBtHQOx61+XBRu^5FrUla1f>g`N$KHp-}J}AdzBegLpr{#5#?MDio+7_Y<
zyutqic`oF7sz=mkIVVfX=jq58)4bb@y3KMWe+D*49c}2WvtA#m*nI{q8+^CD`gr<4
zx@NDeIo#1UxE=Ubas3Vd$2NVp78Pv!?1y8=@78WG5tE2l>5$A5CwFg*$3ahK1(&ym
zALT&ciDL9j5k1h5%`Mm`r6IyN+~4CzWmh>6ugb}{x+6z{*eTHQUNZ^I-S1&8gLiAZ
z<;0#T&puy#yev|b3rD5h&^i((S=5i5e{sVwNn5|PGx_{3O)>gm?~`HY^K=tUfz%_p
zE@nkQ9f~JNY+7f!K%*$k?E>dG-!^?6?=D4H%l>fh86@=vOcOXIV6wAMrg)FN|MQEO
z(kG$!d4DqJp1>(`_1jjT4y_*Vn-V~+oTZlCm^Q&9*id~HZces_@KXtHW8kft=CK;u
zz%WfLJI4LhI+XTw=?Fm@CRhMVX1^|M;u1RIFZQ@mgq<0gC%66$GU=N79CQF6;t-n_
zf+e)s_T!I*Y}gFUbIL9SLJD?UZJhMI<}R5EhZC)C@G@I-uJsaH%_Ugw=<xpZG4kp+
zSR<Z{!o@8{XZUqiFX0O52*=(9kiOOk<cVg-N%_8E*9ed8P)Z!Awyg_o2mDi4`bXm>
zIX5aZlTT_i+WixbwK2?|CAzII=jSIXw&5~_VNiGX$6*nrsKM*-5o9dJbeS6QM{(~*
zJdbTd2uB6n2Sjz_OWTjM=$Yd&BqhKaD)uiuZy-NCC>V1nV?49w)gz#Ws3v65U!pzR
zy&oPt1VVZ$$d*pnXHsEytjhhU#0XXiO=URU+nIGs%Yn>mFv-*^q2s%gLj2=+J6?>Q
zO*b>b@Vc9^Si!C6##2Y_8GOP&<kI0&I4$n<tywPvV31o8eHg4b2hBdv+{!%gdoXh>
z0kN9Q%CYh_6(qV2W8aCij7sot8i)7~kPV`fXBS6f4DzcP#0gnrINI3qxNg(48-{)F
z5p2qQS%|kX3>KNoCMVyYzZ>Twk7!h8mmKEw9(fjkm9du@E0-5V2RY`C@@{je1a=Jq
z>D$R{glv~Kn>p&x3&N;V)j|~?liIK_Ea;jM^08ERwbtMx-nU+wqEwVyujU6dkF&Ee
zfui5dAn8CE(qO(nytXnnK(l=nR{7Y$)7#PFoNK3x@V-OvXp{BK^C>r<iU>cT@-|{o
zWcV3s>0_x_HUJQ*P#BppPBI-qtkvITMQsD(iY6|p)8G+D(uIEwNQ;^s#dTz3Hox)0
zQd1o|{w$t8+B-7c?DLiN)%|=O!qzPxbgCSYnh%uch_>CvFLHI_Ftti-1pd@J%9>tH
zOL{mGiK+u&`qo(5^kLHxZCNC{n-#^i?+S@^o1#<^5-_+IdC2$6(kW5j5rs}dRXfUU
z?R}hI&WZZ+^2)55DQVs@@PA3;ReD5OI`nq2qkp-*wf^&qX*Lp+7T5#&p|vVl3sH@T
zK13N8vUHMmjWGj635BWhL9%E|`6)qQfz~T5B*fr1z4!+d&NZzl?^RB#@Oo#N-vZ;n
zaO77@0bhbqB3zpkV_=aL&fAL|zCZZ=wywo3J5eZv;Sr5D%lQ>wPTZ4>hDZX3*QDg;
zp6A736rK3(QZI3)_aVn0f>Z^doM!v7XQL{t<nP%|0w`;&q}b=ALyAg%U`@hrG<8K&
z?rA2ux7FV=?g6#k#|d%cZ8T!t%C~IbO~DT}qX7BgJrbkno|BbXaUB${l}T3X;?;{G
zYa4AlW)Qk5+~`MhmZ*vQaf<=8@8tc+TY0oTC!%4j`<;RFSuLghoqep2!mBK*fq&B>
z0`(or${YxU<KHljF4RvhOPryqe#kx%^ei4zDhH>?MwiI0)vgm4k}S{bJkz5)X?}}E
zlnT}J&n^&R`RYv@m>aqR?RN=(tYSWJ(dLxrpQ|5zjQ2H2f6K^9oqTXiuITPj&^*Qo
zNZaabpIy%$PEN?G$`*kItsA%3DZ5al@$W>s0gjs|WAlsE;J-D@qc<M`LzmjLkCGaz
zcWy_}HA5pOh8biOra`IqwWS&N(H1v@FPD~Ywvm;UL4B>yns%a|x3dkEpm`ncxMM9M
zg+?+8q?DphlB-wa2NrMx-2-xhbok4|=C{6Z!V<GXJ3=z(AHEHMq)YT#DBbGpUFhP+
zivSz4gs(fUG~&&8aa6u$(SI02pBoeXmgU$a5f<=pPIQXs$*JIsD@m*sf?~;DE8-FB
zSm0Rp)Jymk)cF_$CZANem!F`6{V=Z`XRo+mH0W#5v#}5cSpF>fdI=K{Co>%Fk$#}I
z`}(Qp{J@{cFH68QtSkU)h|Px!Sp5GF1E}jHM5#;>92dpks<=Eth9ri>Vrs9+5-p}x
zR&Jhi7X)RECx5>*uWZCT8a4&>zwEL8Qyz;;aYVd^A8l$sxzFz_-p^jwq!rx5*yuOh
z4Da^ALH*+MZNs2Z3=6VLEG8(OYu^R_bc}zMq+BL1^<fqsBx*A&N_0G?_NMn*3yF?E
zM=<|vMAvv54zvx{Q55EoDkwe6EbPvY3nP%iS#tpe6~+CLTuhtB<OhLemb>8l8F%oa
zL*z<M>uHOntRCcxT%f2_jaln9BuhtPq*h*oo@|7ih6-Jv?kVqei^*ujqdt@@Z%5z^
zzFZc!xLXys)SdYc40$MDeoG|ps=tGOd?m$afb~VH?STvhkEOw=Lm2?90Hw!6)_i~>
z+6cg0)BYhW(1rryy7e~J%y&4S=4s1n;b+;~gZ);<WXi#Oe_-FuMvWDwsL;YJDr9PR
z&px}_-rk<iWF6FKihG8HVaGUL`b<!*(>(Q4S+vhi0(d6n&sQ`^%Tw^Ctt8pKZ~Xxe
z`ObgTCc|PwH^zm&xSrcbIk=OFvorxb%^9~SIq3-?8-f+ZFnQgKHnh?t5-D;r#2=W*
zrL-ZuCzmHyU5rAB0<_Q67%OpxVfQ95SSwe0T0QQQ;=5`Z7+v&eBTY#^t70g|_e_?i
zX$R5yye{qM9Rhu>Th&V6@LaF^pN1n?U{RAJnLSi_2o#Rba(oK-#m14Z?7Jo6FcnWC
z<^W^pf15BH2LESqQb&~Z9}9&7hlaMc;DN_?6HcgaATmsZw&QNu95N+tQ~m22e)ENg
z+Xa2y?%_5IpOuIk?=9IX&dQU4zaDe%>OsX;zx90DtF)BGDc|Lp^$i+WIID^##wxp`
z2XKV4@HwIf5Nfv=MX7I;yoqVF>5a6!cPPp^idu6sM?@HQM;Gy?VZ@sGyr0>9OuKao
z=kyX@5(mZ@=AvkAp3NI80t@k9BH}FuaLn0*rKtFV{?2{;U}$^v_z1YU4V6<LF*1s*
z@v0iZJeFa0e#Y*mNH*@-_sE6n8;0x`Gmr1(%HpLpEuSp`Rm}j#&C<Y8C{fwoM0`rk
z5!5uhZS|P8nbo_V05y%`L(r@0oB<T2?rVwWw~@#`qymeR0a)u9RY9DdZD*JrTUSg{
zItbPP6%gc*GvJk1-5Z|NO~N*l*w`ffaR3DvqxsRsQ~ppR>=s@Q=Xo7ZC94o_g2ZWM
zU3K*q%PtZ#!aT{DVbYUY?Q^@Lf;$MbrAn1_&ZrJ-!9x0e<hkS;1iO`1{=8@@AR$=&
z8AxfWfAcL0vtJ|T)T#KY?-IV9YvI6oH~rLjl;fMLp!>SyuM5yU$V!2F&*pmJ$aORM
zaL%j}HN%8-g~(vVhw7Jz5<|urU~$A@_4C<?W;04yb2_S)w-Nu$D+c7_tnWn=b}OEM
zY_0KjTi!WfFUA471}|)iKP%`l79ksEnVpj(6A~wd@8Ts*@=xTPs2moD1-YBfb>ff-
z1>?MW)&Z2tgD3Y5cyajRI2$b1YZYPCr`*7$taiscL~lP`uJwU$O1F3(yx%w}5yneY
z9`fBQ;*{K6@8|O#5YkOYFc#e{*h-G*n?tEk*hBH)wpI8+RE-mEc!Uo`8dfcyRBqxU
z&-rDJ3JYb#xl6(M!kf(@lT+Hq_mU=1CD^nklw&F}-(y=j;tba64A9E62AqC<l`7`>
zr}o)!p13w7tD$N|Rx*WA+Hxc++fFeGYhVT1YVA1JG&^e1gb_Bb^hV^-uqB+JkFDi5
z9T$X7F@R&iiu!EBO_jd#`6~4ir_;Ls8M1fo2fR!IW}v_s1g}hkO5Q84Z<HSKFSScS
zQmD`XNvlsOb7SFDkzaXT{pNa|qt-IVObw%<{(bkro&FuXaqAOM=n`vc$-E38HH=bj
z<N@sy=S833U%yQ&0QmB^o_vql629uy5BrCS_@#&UDO!g%dJ9U>VO=)wudTp-&%_n7
zP?YE!Nn2~QYk1^u+WGd{_)PP{gDcujI#H!-NX!f~c`<4@4%n$o-lJ=@h4-6f&VM-e
z#vI`Wb^F@Ds?&D2JkWGYoB%#6X!epR;9ZIvdk351)w#gY7MaRIg<9O4ew|N8I2XUi
z@QJ?%v$5AADj;!2#krpfV9uKT9H}99Nmqe9H|ZAh`moPZhQdl0VBc{hU_s+nB0Mz)
z+or}oxQhu42f2VU%lZsDI01>|t~t*d*yZu?lPafI4rh()q{Thy2*5mP&R-&!@-uj6
z(0|C@Gv(2UZz;*b-Ye#%jtGY@KxuPDQ+R0X49~uOluUjWI1Om^!6yJvMCqUQ>wAF3
z0eI~Jfrq@2H|?ZXDbuwxkf=1yA;#?WM2!SArQMyzUpvhg_=WeV=2pl*6NMpdq|+pc
zNY~T*$1LXD&6KSuUouf3(bT!81yT;{Oz+#dNBZhhqh=!IIQ7gd*br~I<aGM(R`S|C
z&!j>`ie1m^k9M`I2FS0UvrShFUce0r+}KkZfeE);b6a&lq%O$c&*^FN%oR*y*wzxX
znXe)#hns~VCY|}VOgdFSU<-N-O3uRp)x7?trLtKgI;SiYpM<Lp2RtrWOv+k1ZdKcv
zU_PI5l!Je*Ulz1z!<@cf4iA?kt-KpOTOflo1mF@dY6)hEZ0w*)z2&T0G`CI3jxF}_
z2yTvX;#?WruzW&WoNrwB0PZfmxSSl-1C3Xof+tR``A3y;vA(Re=*v3r@GPC-?~V3g
zq$@!utmP6(1O+KO2m<E~EmMoVZA8{V^f$B@rRFwQO4*Q8Nn)+>xK9f1t8}6TWB8;n
ze{n#kN1;#?!3F)$^rHd&d3HeF9x%haAa)@^+^F(9%Ou!W$BGSGy&jiBj}@k&j!#Mr
z>CfJ;1Dni@*7J%DbZe3&T1c)`fF%H+blqp<jsHwflMntL3%koHE6PXQz(H?<57Thk
z)HB;=FaGYus!z@X*EP`U>B+2~e=r7(%q>@xV3!}zCMMpid2Un9Z~?JCkZ<-r4Q8Tx
zSU*5(C!Y__Oq(&2SYK=Q$>W577D0<6ux7Itvx7CQ+LJmEY!nC0UIFaP#p>lD3^#yg
zjN5Uk2iSZLr`?^Ug*kbWl+<NT#fS7veDMBZ&R|%@K`r|dr#C|%8*@4K+GfeepA}R6
z&oQg6?hR3H0$hJ+WHfvQ@at}KufO}qUm1xmcO2^0Bu$HSOO_M8t3y$eF05HFjTnuu
zee-C82XUoB@5ZNs3&=8g9<v2CR|^5md1`Z_6wYIC1o9n_i8th7kUc;YyVotm9u$W~
z1cg%QpM?azEXgdWTZPIr3-ZfW9XHS#=$AQgK9dY;Da}EZIhcr|zlkm%2gg<EOp!^z
z>AETQ4ZcF$^PIG8CQF78d16Tq97VLS5TUbWRDIXI;18$YOak<UYd)}`r15g%c%4`~
zXRbr#qd50J&kbhXc-PXw`&Oo#v*unGAKeE64iUc~Rry`-heiR&;ILnBtwBQ57*nrR
z!;Pr}N7oG<Y@C?fLKHN<K(92a(b+d#N;mu4!Bd%HLwju^a|$C^_N6}zc}`t%YUJLh
zM49EK$|=<n)~ReP66@F#4LBMBO*-jOPBD>A2_Mi^;PKLyloGIR!dtWhqrCjEu~Mo$
z@39~ind|wD%~w;7uuIN1Lv@@CBjV9S_+;TG0MUc7tM7_#u|=Nyx@Zy=C$)SteNct7
zA+#ZFC3K;n9}LwZ=A4Vj#@>*G8eRWq;p8@i9U>2yVvrJJ;i+PRSqRyr1MCbzwV{Ua
zyrv5Nhhrd4Iv}1H0~~9YqxQi(J1zae&_#7{-iniKV}hoQ+Uo@l5iNawFhUYiT;_K8
zd(s024Mj8I{~`ct9g*+uLp|sa3HOV&a1;61J~v}|>QMt$t9@8cFiR@G;jD~ZZ*KS0
z^EpbPttnw5!cmmW)N!F{c=*yq-}dOGkse68aNhTFzp=_Bs#PKuGcNw2jb%@_8bmdN
zX5<<f1L^yikS?`)GP&WGh@P76W<^5yvnUr9QM9*0*72ALg`&2su{R*GzMg1&&EME+
z>4V5KPJv_&y_1NXU!FeLI%}5?|D0Vi?QInr3q0t~xD)Hp=Z@%opOMTadZHc&5Zxev
z`kjwh!_5wGMohRdfTpA9U~{C!#UB(qF&gBUP}sKNkz>8Lm2v0-FuU__qu)@_iu#Ga
zFD=f)`T_=&WZg9*t3~65*Fwy+I%AFeUWAe5JK`Y0wsC6qkf;+?206vl)s$%_wIEqu
zIXVTAkQzaKo)iKIxou&3DB#<pvLSUc*&tAxzXrMWZrW99kwzjP=}t()Ri|8$c^%tq
zQar|@0vYej92Vm9VaYN9V?onIoQWNjN7P$vu&rBq2jzaxtbbi5Zt@t;%10c&AE^W_
z$Q4%;dTFID(0*8?p0CJ^lj^1ckXZM^Wz`<l70_le?VYh5R(uyOA39mPLWQmwBoeVt
z{u8i=>wc^NEWhDt&+|307rfMRwOZuLVNr;29PJ2KA3&*-?j%e(8yF=wq{r1slPb+u
zBC)!?D%f)wX=J`0oxGl}wzFC;<}{7?C&Mu<I#!grBM-%y{r7Fi%AtyIpu4-s)8eE{
zCNJ()<j|=$|7!PH8-;scveuA47NQ^`3){Q!LNIK?OW%qjM$dOh*w`E50`z_s%O2f2
z3jdB=E=xi#e>wM9;6U%00o#|2|Dwl1K{LD3h}H@fX~)^`J3OlJTMQ6HAYZzHOkpzs
z1-vzPe&e_UYi;>H6T5bn-<TFyaTGXwT8?9a>8dyL69_$Q&8m--a$PI@slNr1jD$GD
ze0n{OEq3i=Lm;WCjyB7*BT1z4qGPRUxeV)dqn^1%HayT`F(b()Oby5Bpe*irRC4+d
z)>UG1mwhHhGYD&8^9u5;#_iDynn{bG({#;~MkRbt!8J<2fe@hoKwC7hh28KyfIJu~
zOVd|IEF$KPk?%HKCLzKK9aze(N0OjPwbp17z`4LM^W$}kwUX7bgnH0L#HbQ+Gr;c2
z^cfQk3?gLCyVJ{Rb0=TSgP3pq7h;y!es3`^KegIY!OAA+=~?>vKoo=65HOC2wX4lx
zP5*q{<KXKCGa~}-eZvpoL;Q=I#4ErKX+xk|cq)iFx4SvJ35k)kWlk=dx)rU`EmoIq
zE0IxFDMf5n$tY`jK1l5v8BS~Xz9yZ~GH+fHyplJji(WIzc&XI}h9qa!IN3NXz>zr?
z>axRs-%l=kLmRW-EG1;kT0Lbl=$QnfRx|c=fBpCC$VUk|%62OhVTcNee$bkgzD;BW
zUW6M4Pe{0lk<i(4^U@q<U`(;0e{1f5Uhw$LF#Nq;r*ajtkrLhHxpTz(GpD_J$6N}j
z-++r!U6(Xy>280`t+j?GB{TcFQ{%8UkJ!Z<hgK-kmrUpN`T1~n6$q9tiOsG<V%@Q8
z4g+FYu;HcKyd_vUppUa=zHb2fdd5weDwu(Zy|=Xe2P^8wzrk_2l{Mq?ThkAkWtS~2
zHg&b;bPGd;vc(T)9uv3lB85HO>VQ`U;N?Qy9->L%Y`!BBGk)u2a{3X?FxOAa3F%#l
z;l3PGGlea-zKjhsQ4M$F8;0Wozlh@`r|u>D)VaZn<rMf5>R!XEw0Y+JETb!XzCzPG
zdB=8zJ!48+VVuOx)W+@OM`eb1x~1wKTHCsur*i=%N|2c_eppCI1STlJb;3+IQF7Bl
z>!(^L6L@cALEanMn{EZ7KH^>PiW{+hAl7E90CLexR9uEI{jjuc-bEHORbsxf=!E)s
z6iP6LD4i=p*Ib@NSx)QW_mv=e7tjjU&u6DsD*&-+7EIx@UxUbuvvCOlVI<sJ1caM9
zm$w+twtvsq{f#TB?7R-~jQ5T<!+%E(z<+-ol-oZoOiYshzV?K0w;ehvP<+&lJBDKQ
z7dY`NDOCygp0(w_-C29vn>6E4yM}Q8a_w{K4;;19-{yX}Y$!(5Id!`Mmq6xQacF(5
z89DWQf!bA>Z&UjmrC~Q9mSRb3NJp}bV^^2cGEN1b3O0m{ag5pi7#H1@z`ey@wT&pW
zi)c6XZG;N2%9m`m)xSr=9lM+%%@jE5xJTDw3HOqJ9(5vZlWLQjyPlVuo9n&=IXqi!
zs)DRO7-KJ#V0tRRNUHedjmke^Kn~bZ?cUw-1Q|?*S|(9yCe?+7<d9eR&dq|=_8W16
zA!g88dEidla0tKPWJPIG%V64+>IyFMf)uWrB<-@e3JEYg&)CA8lOzNe{NzQcbc#2#
zx&L}|f0NV~ZEC}_#Rb^#Vz?5Ns2VhzG>BJ&82pFRrA_~RsO2Xa{J5UvrpFF`c<|99
zydK*yX3J2n?^5gfaT}RU-OSxE<xm6S*D?UbNIJqz$}#Q+q-p-~DCSV0P-z4$mB<5!
z_*)I>Y5RJT`k9W@lsU%fmzFy8&9vmbcD3@dj$`xyFFeblShaZ^t>kC@9F_;_esiOV
zU6+bjACYMYOMrxs<4+`u_ihtbZyox@(P8k=qdoev!;qIC@ap@orNf2qNk|a%6Mt1A
zkrD!#bGjSGnB>1Ng~elHtj;DAm@7kFj`hkxf1Z_TC{L^FrL43pxmQo>&c5gjr>s!C
z^F&`xDbL)=(G{B-T1jM7$nIGM)N&IS%Kq*I$u*7DD=BgA-p_4;b3jh;78{wwHQdJK
z<K$5g39-tv?mnH^E|lgx+Va7Q;W>N4vLI0$T<{GI9K(yN3Cd3kH&a2ViLvBEpT%$<
z3A?jL&&<?VQ7oAs40qN6LVksWD7wWvA+VPsHpJuumEpdXAFx`*l@5JbmR&)MvcuMK
z?L_`cEw5B3NwQn?v)E^)#SqoJYiDuznOEQuxF5zy^HSOKHfw|R2<W)5UW;(u?yaI%
z2Y$wW++W~A-|PQ*A(}gW61qdqUL`9(1)>_rQzGtBg(G*<deCW!#>#{&^~%2=yC2;>
zP55KAsmIaJT|n!b*uHMDUd9Y0yw5h8DXiv_sYDoRqR2abZBV+UBevNVEgz#sp%3g^
z^lrV!qcsIrsGeLG%@zO0>ZtI<Bu(o#pB;0Suazv%r!ES*LfP5G>u!<acBz1{rBrqI
zxXP``*r5M274Q!%0jr15O<`28G3?~--eb!hoN~l#vJqtvkxS@YkmkLA=v|YWTOC-*
z#HCoq;h91s6Nw{=clb3d?tmW*qHDK`K*Xq6zJuR)%+%LaF;eO!sdhn@u#l8CvvqKn
ziI7u^J>=hVFL4x<qB$F)3CPwYU9Krh&cJU;c;n=Zy?%Oe8@bzo9LT`sr|U(f_m#)j
zLPm>(fd%((wii*iudylv`o%_70pg$p!xUhQhat~~-+1Q?(s2E1Mer0`X~n0{GGV8%
zrRprU&MYZ|-UyK3X4XKnCo3DGDMgoG<_kWIP-N$UPO{Oe<U|>^t$fq^{%G#5?>z%C
zx_WEEf{V}*4Lily`HDpA*{Uj<HAsC5ciR>Bj4A$19pNOq@ODGv94O`*rR2Okw_VKD
zqW@JKs>{QF0#(p=Ve4kRJdqFu?zP>Pis%0_%YkRk$3JE3;dE%cCL4oUG!p-ud7$#+
zcsFezYHCWX&rBhv_s-Ot#rS=liGeNR!x>5GXe<Diy(<O1UU-z)jIk#jJ98)A-`Tg{
z)<LF3ygcRgf+Z@?Aezl8i7|{o?Ymyrujb9jkTb|i`=c9DCu<$MoD2Mv5C5#pi|Ue!
zR8sQgRW=TyR9Dx(CHB96z46@a!17JB&-R+js%=^s{#PL}u9h?(c-elFKny%eY^LMW
zH6RHiQ3N)1Ycf}iIVLX9Lcfh~UUWH$^4fV~k=QJc?(b#Y*DmyqF@wZn9#Yr6>Wl6g
z@s2YqanO$s7${6MC5V-nwg>7lPBf3&m{NS^%Nz^{uWUH_A6{~A_fer`T;j<cplOmI
zTNd%%x7n{e-MN`+Hq(n+qKaEllO5$OB+T0PTuW^m&FJy-o4TiK-X>w0*K!Ch@mu*n
zWT`<G`1wNh)*D1)Wt-Sc`|IuskX{lj;K}vZjKuaZh1Dv9yOd;PVpJlf&>AQ-q%Kk)
z?W2R`KT>F!5+?A6mLr;FhS0%FS4(mf?WP}R?1`LdiHYT$AdRf(BM9#W(v=^eaVc%H
z6(8pE6+GjgE$*Z_MMqVSzh<|h5LDB#pgbl0WRTC++0Lqr=SZkSdzCDap}&n)@#UxR
zUzHmSCl6v5)mb+^Ih~FUF8!;*7k~dU-v2V`KPvoQB$HNqc@On4=hCW5;|6Z8K(fc<
z4fO#Q*`Il^)P_aCS4TXhj`DgGDi;9BN>GT9zEdKsKsnN$Kie~9d`e7BadJc~tb!Ep
z<6QNizL^eD4SHwYs)(sU>$0%xBpYjQ`R;yqP9Nf^O?9LNT3XulcHBOS9`?qWX%Vas
zAd7(Z3S-CwPOBR0etW@PY8xU%PpE*dw-r|%&lS*t7Qpdta+~Y#QS)i!R!dVUZT8qE
zWI`PZIFKpdf83jZ?y&?@a&%<{QbMLYcK;-lsPdV&b~>lwaE})tx|`mDbBGhvSLDN9
zN49GyI_5;q2&)xNp4D=q7V;L}Y5TtD=&O^+7{gRjP4X_75KdWpIp+0Pt>v<;w5iz1
zdg~>elyTrG_ZE~=%J`j0`v)|S2FMnS;ix`}1powFz6$0B1L_88&AOatAazT`a{;IA
z>eR7KFBzbR(-k~_0wtU*@w3MMR}hEpi_D!reNzj>9KZ^sLpF$Mi=zyIaltDv^hgyh
zy|r9bTI!9NF-y!9dCM4+aatmSs*lE%PL8Z*E=ly)`#MX%uQU{+<=M&4r}QL$igs`U
zhnE^GKYXu<MwQn)m!Fs)-%gY@vXaL^B3tt|j3EQqBysjhJH}nP|8_b5*(A$d?c129
zJSF~Ln^ba%bDVWo0#u~l1XB4@Tb0k2MGJr&kXs!m1vo!dHC%~9UlIjc#AK~h);|vK
z>usfzd4IsrDm=+b-?6YXA~vP&TH;WDEF%#|7(~vbEY`X0ANrhS+qUo_T0?}%S|NDt
zut3+8riwBEqyQsCKtPZs#KI%4zzx;_X;QL7pEtZy#<qN;y#*e2%njW<yNrLT$!x=9
zY{TSDeL^<?(KfbR^6$Cfvc<pB41mIBGcjXInRN-9p5Y0Kzq+`wCIpDH`4gcm{=<_{
zVucD-<d7P+$`#<S&SM?wa0+EOTkKej!wN7I@$O%gwgXLQjrxqdS`on(U15vM6&Z<+
z^Js`>P^%GEnBv1G_3-v+p!M|=(ww?7%oRe`1P64)7(lQhETv-HVOC#~=1)0%&FOMx
zw3@T5LsWKY=2o5gcyS8_MOfstGG8<`b=dgG+{PS$k^ZEI{P^qg;s1C_jl)<l<$4jD
ze#Bs?aK9+~@PSXkTV*Zt;jdC$-_`mb;UFt#@Fv#x*NO{?RgsvNI5@oC3TH8cYhE4g
z4#QVZKW-N6xMq}d&B%O_J^Q@u>!xfnt$M*33_e!9?=4gF*Mj`x-2b5m0mn9&-G{Tm
zSsxtIr5m-VxYLp`FVK?x!`|woX_<Um_tph-PC_#fzObV-uq6)hYeZWS)+9ziT-I+<
zGLkSAW2_&RIpxzq^(a#8j~8_MqNCvmT&-EY+R^R0$n&!U3rXuvT^Ntpa5y(i4tCil
z=Gt&>JVrp73kiK_+}N;bpbzvlVzgtBH)%x)@L@IeY(KN7ebW-vNaMkYfzGk;22dOK
zc!TjdT>Sx5kujv(GIAu<Eo2z$^y<c&)G{Z`5JodKrQ{nd%lb!FjFL&cu5n8eM=Fpc
zeFWYtR9)*%o42otc$n)~>#lV7lo^7pzF%r{7x|kX;z7#@Ut?)Oj#SuER);iQP2uFg
zMx)88XY4yuZBgX_^syrD#jricnSZ#yLWY-nk_r&kMGkUk$e6$2$u@><TpxwD^wi_@
zr!ZwwG0@3|?2dY0oy;yf@G1FU+pc`#OgQh`abIK5<PU1Yk48=(9r_}+o~|iHW+K)i
zXVS>;7cTVy@%Qcl`?#fIn}@_Du_H_wmr??|j3i6+txCfz%|5UvrE5wOD{RMd<I~Ng
z(j$jd75H!wsNt2Ywc8ac8HD+WdC^NJGu~#6AuYMW2hFB)<D2Z(jpvtvH%lPk7?p}c
zW)ds@`TMv(a{ufk{^KL9Y^$sLzw8SD#5h7?BVfOaP~rtv=C{s{P>dP2OQe0*x;!y&
zS`X6wYiCpG;mr4dx*UE*TiLkevDCa|F_?7L$W*-^n?9LN5!*RjWW(KLS%}D|RjVgT
z!ZJ=tH0BGNioI<TP3hrFU<|{j?dubot$WRD;l$z>LISN`O1{|Psag4s>~1H1PLw@P
zaNOcly~r7K>_ZC=a08I}mI?k$eI~QUO@^jTwVuT}z^3OvHfd1$tm6%90nfdtK<!i1
z^~U|b-|HQ_<~F?#fyK$(!7wG`9M!F!<3BEGl?G|_XLPF;apTc`)vlt{8=-jH^8#_<
z@efpw;HgVu`IH57c@s-`r;(0TVA5^g@ToyJm0{-uVYS_k=y(;NK<XFU-7K<J<&-o!
zY#%)}SdN^yfc3eD>+DG69F&N7DTS!E6>3@nR6VU}Zt^B^HVan54REyt8SeJGd*XkZ
zh>{ppi<PH3IAKr<l@zQ1)+fJx*hlo1?M0=pKX^>S1NpOt{l#c7eE4pk>MfJa3_2%L
zCc>US>}~{Xu!!QY47B@IWs2B|j3vqR1%>aDYt>R~wAqyPb#k+;5AY1RcS|;W0+PAj
z0QT|s8`5n<kEDGY8MaNnm=GTC7&6s>s4yD|8?^m)F`;hQ)N{ydO_esLFmJjjNUNf`
zDXe+;#aHVIwnt167Mv9#)2aGYq=R2m%v{C0^IcJKm_li)7(+0V@OmDlLi4mylc7da
ztw(WU-2b?~rP5NWR*n=;R8H;oJ9ChwOz?Xu;($cpJHbPH6HZy(`G@I+%{PM!qIHkW
z@}52|P)3B5{`o1ebH<!4O7UeB)0Nnp!MVXIHa2)YEmB-}dinYT{@|o{v+=C;S<-jw
zQtRFdzl*%hFLdA!>qS)G)TL%)uL+m+Zwl7A#R~he$;Ivc)>Fmu&4umy!<S6g@;=~)
zn01N5-MET^$4f?LltR-!@BQFO`(Gad2XEI09Lh=dR(A&{u1`%Y{*z@N`|ddJCg|OY
z023h}DgRT4_{l&5QrY+PF;_>aH~ITpjc`$f(atZ(h(q+p_B?{IIX=Ma=V7nD8eS{^
z-YoB?O(?A?Q#{@I?3ROEN8s(AIowos^UH~)$|96hi805a6S^<H9Qw0Et^;1pd&}qx
z#gpcEr)>V>%BM-|i^F>5s1(H-ylv1`0;;ss@NsE7-^pH73H?cVqF4V6Ufc{&3#^6r
zJ;YeMXMg+qK&Z~GrG?UmpeL3n=}a;#!mS8zd~1t|(ggEw-+H<FGVQDLUPk-xWxGOa
z@D(X{#NIc^T5v@+AA}7@D858^FMTJK2tW?Ly?&U&s2%>WJ<(IUA7bhmTp8s1P5fl1
z7w3}pWB4k)SNbB7SM?aqHqFDbPVmSYy`}K$R=gBK2gJdA)!vl|uEwJd9?dssp2y}c
z<j;Al_qgsZ)1L}-FEnY^-TS55d#<=P1-D)Y7sX3f=~lVPjmhW93#O!Sp}W61b<cNp
z4>-!1$8w>Ieat9_4lL}&*n6!=sl9X4&3|d(n%mP~96mAW5P;DrotPEdxr_Cr-nyK?
z4Dgvv&}vLfou|}Y9dZu9NV<2;=={%i@7TGk;<yypa4F%_sSlX~FoKShmgj;i2>D^)
zFy+qFp`3E%R?436soj&Z?(^7krguJ<jh(&+jV$!i%1Zj?KDWu_d5<mEUcFv%_*_AM
z-dw)Vw?AZ#!BTjy8JP_{46Hz9o#>d~6Rca*cN~46kdTR3ZHn;4N`6h4c4ECRH+7da
z3ss9{c#}J~2c4~UtprtQ)OO$Rdp9EtFG;{SnY?VyZElutmmh4I^o#BpXr#KWbqi6m
zE~CMjs5ni@(bX%B?s3)KNtt)H<20JWdQ}Znu$r1te9D7dbM^=r{5%dZHu6i9`peKd
z2re6p&K&&t!u{4CP3J!<ECH%5K|?xzv2DNjK9QwFA@sV`lWAHiFZJ!)i!s`8`GMl*
zhJ(l5wQeoRUygN`^gr`9FT^eHvO|DZw!w5BhkX#H`8c<_yA%V4<j9RM^6zw<79Stq
z6AXJw^m6HW=vaZ;RgN-@@-NX3SRCq{o;E-#Ir1@dtaspCBhtJosW!U_3|x70doZN*
z8|b~x;1ef3S>cX~RZL|@Q8mU)g6rj($J)nto0%_k>^bmF9s0gTra?d84OLT_S~eKM
zx;w6!0p8z-Y~i8jy8IW|-(PmzLFv}qSLd1#c*=jb`3#f1)78J;Jbv@t=Px0u=N0ZN
zIirhJbG0e``j4c{2DJh(6>X0Sle6#{nM#RV=#t#a)N(V5bo8OOIv>SRl6!jg1+VNX
zKuJk7co;8Kz3xBK4-f6x_sG7?q`FD?X#M>TulWjvMXDMycs%wl+XQtmwnswUmQSfy
z{sepyd+=xpDj={hc@SIm=q9x)LQW8|`t@F3if{YeLX;4-<w*M8U3;(suU5T`YQRi8
z;SaGCZ>j~?Oj!-yu$p;!$FE<wv6=qFLu?xI8LhSfkF?>q#p|lD>gA_(m*FWecoS#P
zU7QJSbv8F-4E$S8^Q|L&2fl^9q58Z@+TYx-)4^y)S^w+r&!1L}PE7Y9y|TEdeGwe}
z$<udC6S&ZFF@wnx$VV&PF88sz>s`Y~$qUqGw!Ii#ut29f4f2mWnD*eXPGv{Bunpk6
z=SI9_p=NbbHB7wL!XmRyy0M?&a_k}P!{{Q<Io9Ht=s6~RhvYPjU~oow@+$Ljcz*(`
z&Hfv=_Uvk?uD8Si&-)q7&=Wyly4&))vF>|f{;2rh4L#0vhta<c#4Es9@TS84hWjs+
z90TVT@<b~%B3DN5@Q>WP5weDv;u#*AOp^9<RLkdP;Zd(jd1MoBp#y?8cJ>yP6ENSh
z62~z;wDkd+tEPU*kvaIyL@et=qGt`hIC;=9p(B05SG`?}SaRf~!omb+aw*Ni<E@6N
z-@x<?d9?|QUc*n<w`0-QdIB-_Wk*hS+%4fn-^bg+xbm>MO1;KY`+VFAe92mZ2>EMc
z1{L19eUdOUO5~Jm)%_j*Y6tmg95F&*HoYPfWV7xr>yrYdC^h4m%47dI!O;G`3EvaW
zlcF`MZAqabWaIa=GsStU$4dFJeOM~byy1Q4PQ$q<jN3iptni*8_#JP~ry>Q%KgkE+
z<Y(V?WSoMV(4U<=OwS|Ri|TlZSf%<csfO%uV09<n-IWi%6DP5gf*XE)ajFXitDL}+
z-AAKp4~?jgX3v+*%hdl_Z_sdQ=ym2`tai^4nA>gwDz<c24eC*;ao%uuy+BP3kB<s_
zgS_zrwsBd%p+m6d3HdJSapuA|->1-V;Kh_qqtvCZA)Fg`lw-!_6YlprI(uL%|AwUe
zC3di~+UM{0!-)VeSum<|;J$q8i2vXU0Lh0>-8o@YQDzFAKm;Gc=rjc&<=lwGvD!W?
z>)E_Hml}M^;#hIQuKa^IEQ-|^gxae`6Dx3=glSawp|9#o*+)(eGxrQkihc_W?m0w2
zJuNkMtgY40`^zaho49=aEg2<inldHrGUF0lKP&qX(@}bEE_cs?M9r;`+E2cuG*dq?
zy3#m&2$n)^9UA;4()<XjOcy~+HS#CKd*|&)6Qa7qxz!F$nVR1Ie#wloiasBO5j6E(
zZdZmp)CHH#$7T*9v^OKG=a+N-g@p@UG78IGwgDihf;~H4($jtrMqBS#zpZ&u@>xd_
zYO(mpu7$m3E7)Q($tT}H<4$RhJUE)_msGurrch6%>RE%nXARo%DJ4oEF(mlS-hGd>
z!lY2FY>qJ{^hf2Jz2v7CUHmCL&AxIoqPJwNYVfcsc5Kfc_ys7~3<10D{^~Nt8N$H$
z4D^v2-*?$({FXRY`0vOrCEhW=s&r8B5G=y!YU^3*`s{UhiZkRo+uUJauYQYlSN+0H
zHx5}Z!@k2`<)7wBE-B7>P11UMCOxOe*mdPy*36#0pgxSAB`mE_ayi#$@73U0b8Z+t
zqbT?;ftOtQ5WV|6VeZCl*ejg|90sOy90&PJQVbhXXhUw{HKopa%&)_YyRjnZfJYjv
z=Q$2B=q@g#X2ZxUoijD~8hj+j?izegsqS3zo&&Roe_l0FYa3tpN}nX?s;%?Ig5BN9
zg<F55F^r@@657hh$ME2VY^QBfBF6->J)EAoWHWax?ar#HA{Ar{Q77CK%1M{eKK+=8
ztjm>S1>D-8M(iQeWP(t0U!D!BAwgEd^>N*~T3amFz*F3}FcKKlGpFG_*Zl<q6$@&o
z%HO4vB@Hh*7!2}0yd^KsOtG(bMVR!})nDwN;mNOBS7Gnq?Es0=bvFS#zA&Mk4Lc0e
z7-kt8Huf_;2#Z+B>*xm*zs;NXfd<-Xyf2Y6UXVlA&l(D+Cb}l7ivN=zk9Y3gjHdD4
z938ixzyGo}7V)DJIwsI?^zj?@&0xB+`|5qInY$hh`xVMaT;Lna9^m<|;u*M_(vF-=
zImzFD+mf=!o9{s4aR<qhz59Y^jP4Wkoq8%YdWM`^*GKZ#?FOFpA3BsFJx%soC3CoP
zF04B>^J9^Q`G)oAwx$jr-*Dl2a`)M5iCFOOX(vg6)2qWk!Ja_7Rq--REu))Z9dP5Q
z_GXO7TB4MO-yzu4EWAC4zSG%%kUVe#yjtR3J#>T!izuuXP2odS4#(I9Y5ecE#wNd^
zes$(e(s=|JerR>2c&`3x-}j(Az%LElZ0cx;Nx`{jLQigu0x6)dzvclp^8Q|r>2D|(
z6g`|VP+H?JJ3F!{sBw|Jj`wRP?q0?JKhEAg9_sY{A1_f+B9e9~I$>34%P9;|>EKiu
zlbo|9G>$P&V^V}p+O?$|W;%}sqZZ>Z3^{Hoqr}t<hOtbV#>6m#F*D!$rMCUNvyb2V
z?f2Nn9{$+1?)$#(>v}$)*Ymnxx^iiZgH0Saosb5ie04O#WC6oKDJ6|Ti?Y7&RebPS
z&WwHrVQIC#Wp__6k(P+u<?7jzHLxx7_%%n{#!j~wGj8C8M)~E!GV+QQLNwOsDbD(+
z$o)+Zz;lPYyTLo_@f-g2Uh<xAe($I9J=z)C_#|%3ydQjcs>O7D;BPUQ=}nnbbMQ?i
zEVYyNtMZ!E*@%5=gfP`KE}wwvB8AY1vW|<1Pq|3WfMC2sHwhV55gMEKIapt)^NCK2
zUi3u19{cE(Xwd2pEQu8Qkuw{JK4}$-%L2^d=_S2L4*H|mq%2fTB_yM=jI;O>^?2Uo
zgBOizJBfEf>6CUJiPRb1#*G_@5pV(sMx$mUAzZm6u`&eMAub~fXltMO93$EVp&L>7
z-ss=Izm!Qo$j^cs@Bxm2ytJJMsxj!y=j`Nke#_n5;>+MehfB&mfzNv%?PRL0Zx)ny
zz_<aTFA%pVL<keifW#uNu9OV$T7w;fq^1+Hs7}7ttza^t=5H^6wn=LNz4{SS^?{>@
zU+-~A^P%E1n~FsN)^Smzi9If#1G^A%mxJSLcsi7iW|5z~%1s=)-GF|-YjiI-f8Q~*
zbB(sc%mdusqmrpj4%Myk$8dXnnQ}KV8LbIG_7It(PE%qM&{!zzpljVM62Hf9b$@}!
z@?g5vfO1aiY;siLIpaXVVBdeym`VPV?kBTR{TM~b<@T}b!7p|bJ3fh0*G)}>Wi49I
znoTciKaP;lyIDRn51GfSN!a*N5hi@3I#^#-w>zgUnBg{Q%t0!XNGGjY(MXCZ5>`M#
zsrsl*dZ{f1m<%85D4IS_<hi$$TTw{6!gE<PaE9QGK!PITBr7C}MaSCL*Qf*E`m^F{
zJ%_Chmc!e%9W2Kf-eh}UHwd?FhQ{?IFMr6^S{Ldwn`zwCy_d|*G)s~s&)EuFy8r=Q
zlak(Iu|4ojjO5!<0^FJ~HSD1dz2eoIx{Tz%>4_Xv`29}!u{vZU@H5#yqIX%%>N-wx
zETGlcHlf$EC`drBa?gdz)S{7cJ|$M`-<hn+8LU2)Uqof>fwOScf@ux5ygbUT!HzQ_
ziOQgi&?1?V{@;8w8AhY-1XW#!+`h2#nm<88BhB7D$@?QB1BdDq4|wQ-b9D+(Zu!~g
z!Ox>JY=u`~oFQX2x3E-B?U)PEj>!Rtrt0L7rq{pMk2UJ-lD!8Ts&(?qG5Xisq#Mc{
zRWqX~Rq*@XGd_B23l~P!JlDF%jFhr_qiGiqyo#~M93^L~5B}1W&fc#WXEzILFPGwc
z^hSk-o;N-s1g_(By@EkhSfuL;km`nzauoBv_=<u|u||6l^+yGn(2teVxlzJ$N-gIw
zFUMY{spmywnfKjp%OmL^)c~e7Qbg17tuE*?rW?n-@CSsBAZ!ri)UASo_0TPl`li}e
zW=r#&n5UqMafyZyIeec*-vxtn3;?Fb9p-@>VtdgyzTU-TsX9DeX+=mS*e`FN=W8vK
z_{)HBvQ%|hgroVNQQ2q=+uquu24v5z-YfM&?3#M|!iuCULvfd1S?%YfjIDG>Hyx*U
z<r;C^#TP|b>tW+qUeK1t>Jb{db}BDVHeGc;k?J8VxMmS8zY+ns3EjjcS2?^)Ub!4u
z{$n^we9yK~ev35_C>lC)Tf7GXI@h!SZa2l-kJeo%6QK4*A(+y#RZG1kOt?GM7cLBi
z$T2kz$&dT~MlMKNw)&XWRPN_{&)MP5PT7`Nl=SPBR8M$5J}P@k_ep{l_(t6w<K}Z+
zI>Nx;{8(zcS+Z9|wv7cO<h`H6HO7mc1b3+>aD%tVdN4W!H9Cy3#6X-#phSBy=yrn{
zS1gN0z3yTc9nG7>7uSYQUd{40S5R#+xXS`1UdILCTUTA8a=1@^Me(k1+eV}@E85(T
zi7c;gOk9i{i>u`bRdldDSN~YF!RW-dBG}7M9!kQ$u7xP^y3vzwiT?t(zhu){s)%iF
zd?5eVl<?@kFh!wP-<gdzeS4AyMCUA&ur)=*ZS{@kJ;^J4xYPXJiC?X6d7We_tUx@8
zfuEaX_l`cj&+aM$w~<FMN$TU5#!{zyw<0`*)tm%)3e!tAjf{H=vdOLyGo9ofaEq^-
zab2QV6zy<i>qfu+%S%;g0T6i8SG68yw-Yf2XFl?i)19kF$7N(>O?3XQf>^01IJr?_
z_^iAW{hGh;`)UE?ot0ls4wMVrot^2HOxTORBHMtW4i$NF{3ls~{Vd=<mKJ>UF5xMK
z`is6Q!kDErGqPb*u0kU+XThjTnpr=~XR^-T<VPLA4%Q(*my>g~Ke^LKL~b$BdBubk
z-HKBqK{eM-_7oE=HESX5LLUU83f}Qf1wmD4rLxY+V|Q<~IY(ZdM^Mud>^NO$ZQ)en
z0}5Q^67GI^&uR#y$pe+ml4)+suk9FSKxo@%rt{6Z?*S<wAP4$l#>{UxfjZvS_}~CI
zF8H_OG9ajEX?8~(ILX@KHC26UK@x;n@*TF;MP=W4tLeQX>qVoys;*HtO#)rC!)azz
z9^vP3xj@zPYlHYz6cPyz?~kHjK~x$(&<~es<;2j!X`?NM>sh4*pl*T{-KwasFY6|O
zTgKfhm(BqfM!Yq9jQWEgtJ^0?Uils6Z>AR`iA))~(86q)m188G?YeW9a>n(G9HXzA
zfjR$X(^!H??+Zfd{UFz#vr^kdy0IS8oeZtf1x8O7(0*U!8Sq|M3DVyF$x`mF{w@WQ
zTU|NYwcVK0GnnivqEBPbP$L*aR@Ty2yu!@Q-pS#rpK8*gdyLMm#pDtkuUF9Tf`p?-
zGy=rDhoq<!P^qzj$R!i@=Ta-#>A|T1=D3<JDslVOg?=Z>yZ+XfAUPGw)4V&y93DqP
zk%mIS#}CYnG>w&jED-BXIKmL;4&RE|rFui>2AhWXO3n|0>#<-~ORfHO%RSTePcSmA
z!i5uttKOD98j(BF`O!*<89}0~VkWL_!Bt5<-?Ft3>`nV*>F>MZM*0@B1d#|6FlzSG
zo|$D@lYjP8YX<!7)h<cL2eYVa+qlbAb;mt+(~^@IgJ%vg7W*@hK!Nu1)}8TOa-0{n
zay={I)LPyyABfH0Hwu?a<A_zjV>WkL3QFY}AYMs+tmM?A56w7%WRPz_B2rK#6LIV+
z*iGI_KmjcR?H&49va<;0aAN8XoJB2&Q%c8h$84N-!{6wtevdwv<{pCLw7)SqO~rfX
zlx1G}!ORzYPQe#CG3lwki@E1q-9eB}0GXGoXjW;a3ld*~$4^qyRrO&%xpc#7oy>$g
z{a7YTy8%HTtbRn^#wd6-(8QBA?Q-v4rl_LpQr))j?P%7~brA0;0u1re7Mt7`jX)yq
zxR?gl5k&eiXakiswML^aG@P83wV#B4ON@z;7lz{TH2iFEPBu|B=Ah@LXApNVW9|U`
zJ08hCh7G`h+C9tJ`=xu~tP2-B41g)V=g>oxu8{`-Cg*0Hf!w_8*H_#Ax-l?yBURGV
z4+vn~<V~f-h=7dg>SrxW5`~`yaKHsUsXh675^gGo>#HE5ShAPO)pSM{Cy{seXLga9
zwdqEqD9q;pcd!i`oPd<X0HUM3O0mK!U7Or!_0BW~wL<umtrSTN5^HADfo6u~DwZtT
zXk_~homjG$yb?JT_(15yvc47XwPB8GwnpXeoY;|FxU<r-Sn@R|rV<0NAj^M(LK6^Y
zkE6>%^P(`2#`0<Fp4_@I-|H3Un*q4Qf=YA;q{ZYE=OCJ*Dx$1M7L6#=l}ja4ixq(2
z9R=QX6+YVac`r#V2*yK{{~Z2)A|;&x($8wVemGr0nSI!=f8@Sx4I~|fEUIOAQo#MI
zZ*-nEKikEbKIU!ckRY%)%-nshF7_K3iG8&!o1J$G1A&prYML3-{(CT@9kyGhC6oI2
z?D6%`9ESPf!1J+*;+x;-0hCEN_n?n{sGn7wcq;qI0LWuu>}MtAon?D(ff}&&ZXuG}
zVki}4Jwn{Bczm#1aaA$6Bb{jlw&7i1p~VWy0rBVSkv3+GHzaCQ79SQU{bXN^HBBWi
z-Qe>}ni;MpM7yecZ2xsLBmk5)xg?p!*iAOML5+c1wssrndUh+Sh3>HIMu*-=7cZxG
zm0{F*;FKmrCq&M^2mh8mSyQhRvw3;mxLMeBkOmhWoV(KDBXY_BUp=+~!V5?-P{V52
z@mTgRSZ63yA+})9ExYs#Xb1tN9&iQqq=L&cSI`9x043SBa4x2A(e~KQER`2yA35GK
zL!zC@-NJR8#o?+Sib&HGFJ|Z1tZd8Ixd)C-P1~S2<a!Jo&Z1mulvlz#o~xjTq?s|Q
zl9)*1GF8zJXMeTU>Jp#vW4-Eq7-uRYd+|%Q08KakZPlH%7Cn@g2}GmO_NbSUa}(#r
zRZs`!Autr-Ee;3%7MqC9`gUYr7~NJ$%eg~YiKmj)e;|XjkuL`tGGo?i@&HX1X*~K-
zB$U!yC}(GH8$N@<OFVm6G4`Y=iD^}h?z|5oPVNFYK$&_p6238{JV5O1lQ>mf+10?5
z(s8-^`*Y8Qm2)qq@)LZ(l7Pg9NJAl#`tMTBO(*;N?^Q*Z5B>^TPmd2;uF_eju&R7F
zE4orczxPy3g{T*TUsuHef3{12<TCw;*0%E2?QbRU|7IEN`-imtIVEt&@NbTeH}wN6
zhoM2RLSiRXO8B%?{?oV9)6+9fWkUik>c>sQzOfhJ4553du#zUgLe(sg(H_Q(@W_kl
z0L5ZYP9M)DKD#fBV$E~s?gA~d(G@8PsEKY;eWP6x_>b6!;b{zexm37LbP=v$BH>Jn
zwnH_8d<?hGxAxn0n|djq&CCn&nGM3);<wkZ|Jh7Y);8Mx9~=&E5gzy^cKX}l{lno5
z*Sf(0xz~+RBelvJd|g!CnKS)`jyz{LtSF3UP@oFZRqnZP=llwp27olU%U04zuAAEU
zIV)5V3(WeN$w|&Z4Bv1NrD#a?>w3;I(4QXB-`OoRhlJiTLG88LqJy5G?=b3el4Y_d
zcaWqo8fe?p^YIzO6LI?;^^T(tA2pR&->4ps;B?4;`YMe9tzbGbX($rUOr5O;#al}5
zZ~i`GzO?zLn61*mN@O1$_%JN+`=W7LUT7uSX&dQ(gT^Cr5n3*^oSF60-_>*jJ9F5f
z{4*N<eMv3Fyq)_K4ud!4gBn5GbXo`CD<!-Y^3LRgzAz1)w)k0{munQ_1G=1yE=4=q
zDB!2spgi*PwMSiU#lWLj9m#21&Q`zb3uDI9rYf)Ud*i2L|F{hCaYBx#g`MxvH$Hxr
zz2FtI4bS@-stNo<Pa8JQS)ucnayRARot=h__Bl1T+*#JPmTcVcMD+^~Pb%<|B^pfc
zh<3j*+3m+ldeI2KI{DyI<6|H;t6ef(2}H04d9lvYZZE2!gES>6<+usNBT9+Y`MI9F
ztQHYWa{K<^8HStae(iKYS$%udjQmPGcX2w|k0qN{;AqS$MZ#I|R<*I3G(gBl_WEcf
zP;g0{D+~QtdEM31$}+O6zvN3jsa-xxxdW@T6KBDdw1PDA^pMG1M&9^ER5?8sOV7;G
z!Qp!_U)%bP22Z22>OOo?Hsv07$schXjMrVML#zvvyA&#$N=Bw6muySw56M{&PEeuo
zbC#->KV#hW9SvO6$c-;$W>Vd^T#b*3xh15ExP+q5yec41$8MU{+`(eD_{?<myWEL^
zKdI2z&>MB90v4)IQx**eoMeLPy-s|!7(5@k@f$Ls^Un>1vtMJNSj4_QNxM5IX9(=R
z5P&V<;j~dp9Ro)j=US~DUwgIuiLpU^sMqYb8>|i9U;C}D8OoJkn%5-2zV}baJs2V(
zRc232UIo?AfOnU6Wck2QlnG(2K-XRkt=f)cj6@XS1`n@ij>Nwusn<%?*}d%PW;R9K
za9`XDzg_{u!%%s}3W>V=J&{1VB<*H}+=|iLUrqQioLr-!Pn__w)R(m?5579^z8Loy
zX!*5=Coak^E&SG)cg7gBCyb1Xj3AwFi{T0E9Q>%f24D9PlmYPE{P*{*ZOh}D4MtwG
zamW%Yz_`KfT&QW#Z?LGToGJd$-?#BuKdA?NdRIXmuRm%ic@w&}YkJqS?&NgUN$y2V
z36{+u-9%W?d9A@g9wZu@$e-w-G0kQg5yjk{E}s3&s9G4H5Sl6JTWl;>=@GR<MEmcU
zft*P?-%!>IHFh;Nw2{1I(>Xgv;y=pyv2?}D0Snsf#~SWk$%vHcQ2kra#9J&mEs2Jq
zvmmu^*vpH%{rkxDr9x8CY&UPp!81D<oA~YSu{qxw@4fus$_Cvq@4xZ#Bh9{D9Evk&
zc=?Xn<WKIrk%k#rtL2fL#;5ZneJ$*^3LOB5(d1V2LRRwm4(yO|EV3+T=};nvT3g-$
zNRXPhut0wW?J4^yV1Pitt#3r0Gixn44|PUCaf9EQ#Oe}3eN}aiTfS5kCro@RT&W!v
z{S9S~vt?efoobaJl$jtX$l=XBzzUbYTeFs8d56sQ4sOF&^lxi;3zl2A9J+F@I;-_z
z!A7V{#gHIGHoXCGFHs;6O56Hz;t!pXCp`<QLQTP15*dS}s<4}>^n_6F%n6bg{$9k2
z3VrZMeu(HW?x;7=71o%qX9Y2|!?z*Y%`!|JJX@iPtq0OjS+}}&TeRN^YxPGld9`V1
z&~5H7`onI6(eZEBt}61}P$;_t1zo#!+`VtF{fknvY}^@!@O`R-+ft|JV2Mk2$b8em
zX?1{syllPV;m@Okt<KCU=u3v-(#>sdGO|v}K&MsKS^Xn9Z9x~&nvd3!zMO1m)CC4h
zGa#6wvM~LNv??F#ho_vTYUmJs&-mP`P@HjFGg-~y3Q4W8wbP#*6N+|SoX&N$gpGCv
zU)F|P2Xtz3`W8z-cA$OQ3Ph%~f`j2V$w;647=#}yUMoKF4LlHqUdxXi5XEkDNT^5R
zLC@~poo}clE)p{o%%%m*R=d8FRFAn!{bc(e<&K&B=)lL}@xZSwy~~_?RP86u|GlNx
z|8O)VYyA0p(O-5M3FzZ~EO4s#2x0KmZ37Uo^PK5Y!c0H0tzs*x0ujUML%CxADUY(A
z!84p-)gMD@bs1xlC?#?mLWZI?`6@o-k0PNLN{ci3(F%}P2GnI~41n;tiZCS&<#qem
zt;tWcpJ~$Y+w!Ws4y#iC&0(+qDS$&WFR5+i#ZUoEcuhNqo6`=`4%_!d$z)sH4!jq4
z9G&woO6Cv6Xm6);bva-7(SU-E{3RsbdR@%SbZLDf{9%Q>O2E_uo6%Wz4kG!WRp_k>
zTOtz9OipCfg_6pU<b<0v0on(hDD#Yye2EheDHUgSy5yo6jgqJW6@V>|gJmI4vX<12
zvHaEnEgyCyB?b<-R)6WNPVt!k#uz->Xh|f8tLa2z9M9E_d?n_RRF|gpkBp@OlxT19
z4JhCAc&VXPzRx${8>`<cp?BtO9X!4h_q7u4Gf3!7UXTQe5fIv0J+jwi$p*bs+q7o>
zYLoerSkp5UmKVp3%cgH}NjP%L>_$374Yv|x5qBo5{a6(66+Qw5y|6FjT!nWBg&1nZ
z?4TInqI$)=iy534?-_}YCihUU6mYBoNO^CzZ7Xw@PsAg^im%5Ug{P~ob7CMKngLQ#
zrWO|MRXxeM2Rl}*l$@RsVzdnq_^5C9^*BFqD3JZ$XEunZo7$JmDU*Qu{NFmM`?I5q
zbFt6A)ya~qeY}0Xq5qh?K%FdB-=xx*eU0g1Ju|$w4yAsVrFx-J&BR-6lM|d(YI?p2
zdEM+85KR~)n8n?<3KXJhGZ(nz6lX}BGT`b_abgJRmRTfGwnA6PbU}UHNmpDf-JXkp
zn@XMs7uP<0E}jC#X6*z56p{#Fa4JxtMG#aF48#q{It5yR3t1y$B-@69ULghVt*nz6
zv5V$x&6yS*ycH7~a%Zhx(#oY!AA1Voxu!yJ=85Q=(3!9FGysnYd@o?vxqoXZ&FJiO
zJmQRZ20Jm=CG(}R8yQQpm-qrvf6J4E6L%^M9Xy})JEc{eZ|JetST|yT_+aeE3ZluY
zVg?=}RxhM0ybj?UP8y`MEvIdpCf+k9r}+qP^FnH|O(;4MX0dR9?oE}Bwicfm7*KzN
z^nstN=n|c8w1cOUce4tC8c9+cc{NSA!!sZ;XB~}xtmhd3<;}6iblm3eu(n`QUO-Ip
z5izzm^?O2M<7@wg|ARN}6TpcdaV`%1cH&WoZ%p>}-8=-^fgiGm{g=LU?3;uEj4+jQ
zQtnQwXgmueI%H7*UfDAWmua@T%TiFpZwRM{T%UyUw&QMAR72y9JK|wZ=yKRt_5&nm
zB4BD7;91Kxo1E%Uc`oAzL>(iM9<dcxg3R85LTc@#xVGYPaTU1H)`#Fw>r7!eYKw~Q
z9#5o9gS%4>ml484f0}x}<bYRXYH_8gZ=-`{x#*V`JKvYzbb#Sk;@ib}KDd)m`{gC=
zuxQ^L9iaVNmzQmNH}JQ(UFht8v&*F16|DaZZ<(wcptZnnPmb6#3vF{300|23b@*4a
z-K<jiRkS#n$H+1U@?seE$2;73w1$ooP~=J19xF}@YG|&YZ(EAKF&M=E05CcT4a;16
z{gwD4-_Hkjv%FGM$^C!r(h?5R2h7-_NVi)tS3Qm}51y<0;TxSCemQj;mlx^-t!45`
zmWiS6_Y_3A;`D#;Nw&q)z&CL--xBdZd=joh`EdC$Ro4iF9h9o3F6PR<yD1U~$XY$_
z0AX_)?KL)y7zkZ;oz9sd&x79j0@J&1AE%}ty;{LYWEId>NXI&9kAC}Mq=yRRDzGru
zR?tOafR(ME1?-2@Dm<=&zz1>-BEMWwCBPhMI!?YiLD!|>2RW*l!?%~JI*&)c3sJrG
z;9Fsxi9`?ivzhj@(ETsDE~h!7sKEU{>Z(*0f8f)oAbh@7nf^z^DLLcsKf>ZUsn%8!
zqtQ#sK-1;te-6{oO9Ut?{^*)AMM4`8Q{^sm4)5-M?4~!eOr?DNY%2-aP*|4wHn}$8
zDG{kMO=`*^TA*q%OwQNiW2qu+-0oYG&pT;9(LN8qTdEp5;N2OoqTOx?bzC6xVFv0N
zb%rAucZ76sQL!&+u5fzA?F*9>-|pV|tJMgl?W?7tUiwdWz7*kZvCp^rOBwBu-zI;n
zh>74$|EYDw+96k=X$zq3+M`^p$)3HN879B)Y5{=Nn`ke0iE|9U8d?juNGQ8THsJey
z{ULi<@P#aTV)la1IzExW8Iqiy^2HO~f~E!Yps$(#V-h{l&4&)D$9ndVXg6rD=M;|q
z?meA<djSMCe;Y>GR+WKcaou8o3Lt%k_w3~R^(yZke{uaxFNCjW4zG~_5o+g`;{e`2
z&`7Ey+2Vmi?xw097Rdi}rtC$a&j&MH_11}=uI-&9hznr{ajrSAgS8Kp3SMml>MjY~
zsULwrx`O=_auD~KxFi7eUiLRARk+I@@Dkx8xlA|U@0nwG>E<U4`3di1AcXTj7+%D;
zz<0c@B#D2Y&VM(&(B1wFy22Ad8AMCR=_D%%A$$2~UWNX)^7U_JkE*&BwSRoK2+*%*
z8S!?F@~fb#?oMP&CI=C}y<dA$G~3WzL6Z!<7Qk-;>`GEprUB1Ppz691M#%LF>>+Sd
zWoiNqH@I3h2VX#sm3+2@I?}65%cIZNVZRl-7He7nELwv89V&KKm76Ra=G3}`e`=ks
znd6C!@{F&wZpstARz4|w>6bpVOP;Qc@gQ&3#FS|R`L*I=SoalIl(zya(_<%KJ;Ld@
z=K2QFe*&~|jW_V;RERufnmT9m2e4>!La+Sf=qcihd_<Y|!PVP992|Ep>q#v9{MqGB
zg>5|=o-V3y00KAkBjs1~?iCGWk4-dCM7Q5x1LZBeyNA9^MzsE4Z<cW2(kHz+PP-i{
zf9s^efD;{?1e2m&U#<G)KL2#vuMk^Tq|_Nev>%YGw4g<YMWvpd3A!uw*5x~ZO;dOf
zZI_R<F;41ynwlOgodyj(>HA)T01w8gsmf4k*s53-6~niv=}ha;MOwqPfWIs!{~%C}
z8E(fWp{}|<lb>uf3iAqOCl-RKf$G!=cUghgmrM58!BSEQ<3Hu|?nAvHo~VpIIwuY4
z=>DyGvaO#5s>D~LbHCgw=aCJ;sq$AmA<g>aiMy=I)S9Xm6wi9<BjBg-XB9;UyS<3|
zO?k8GQG-d?u2uT$;%`lU@m8m931a{Y-C**?RJy{D_n!O;{gq!33QrSQeHH@MmVrXn
zc16Ioojh6#^i|5?>5M@Wo9@NnZ&1^#_wR<Yld#INGs=(kD^ozXk||O7o6NUZv;;_^
zFw;7aXi-x2dDogbu?JiFe@SAswQ8PDSqqK!PY>`PTN%2-*J7WH$5)d0F*_(NI8VF|
zeiF!f=|>*|^bk1-@gqIo<Lf&V?mu$8!7wS@B`^x-`e;-+x&ZB+gJ$rvN!u<Els$!H
z#tcDROnsgh#h_=<y95We0pnQ*K0tA0IXsQrigcO0cfL_A!kb+^QIqI>6$v;!7%}Yh
zP|<#3`|ac?l~(*B5lt7$jo#t%CAa6|t3n80$?NLu`Tg@fqfv=tO!i;voN)p3^tEJc
ztMJDpKR4OFSpT{O7-pC?Z0rLWk}c~{fYj;<3p(HAucQjT#A2FE4zfz>AK~|K-HQdP
zJ~gDJGZe5l@AeZbdhs%iC%bzxqS1Q$6OP<56N5GjI97y_*^RUgAW4Bo!Wm(s#G5=w
zqB#Li4=@IEGWa;_Gqv&#-(0-wsJYmwPBHf~6t2#r(?Pg7*DfA1@dAsNgrOx7N<aI|
zaHNw2`F3&Mf=;12O=vtdQ=kOnQ-KK?3@t{MoKKv{Z)g6a+;Fy3UeFCo{GyuncRMCW
z;sxt!$J%Riez{d~o*<tEe%0e67t>YUinNhdiPB)qAE!%Tk4TDrL^8N_A{dvHe7W_$
z%rnf)*p^ha6>azHY3@XUhGESgF<vutA=kq|c-OuhS0%nRF&;@*P@vscR0Bj3L^f!x
zHT4X7L5=zmsDQ{Fz(@C#)aFQIL4QqRafAtMP3~V1nwiw@v|6eWE<T(eJ9I?IfI%@H
zP(zBfnoB0+mO&Qn&2NRU@s~^yPWl}9|9yIR2V64y)H|d~)}t+$<Cq06pqVK-pP$i|
zN$=%nQ*J2CbJG*!#90qMfbh^@L2uE%ZepzzwSp=BGtwTY84jwJNJhvpV~*WI8pY)d
z%ER<J1D)6zhYrEEMvx6BJV_{@tO-7e3&RPmoJ45zizH;m4skoFGqkK%;Ij=OeZ*ay
zrmF9h1N=k*l}N_tFeLLNNZsyHy_K+Q(&_vRC#F5PzU0HvHnRJ+eo4O**7s_KNruv^
z*;Mh8jG0txQygkLKek)Qu!8nsBjpO+`1`xQAPJT<@SIJE$j0<m7dg!I`bfttMy9U@
zc<+#}VrJf%mY$fdJwG$C<jz-f;y>L-w7MB%sj}H&KtTH1E(C<Of}x^d-~xje_5P;;
zY?)df%(XG-xLfE{pDs#8k5U7{w9@|mwy{}e3a85+Vmt}d*n_-4a3|UXZ!3S+CF||1
z@B+K4*=l%7Am-l=<a>4%yt)r|j}D+mb<5uJvW)k|pF$bU*680zT=G_3J*>%Hpl;WF
zJ^(y)3&NSCkk6<Nj?il2y!L2jN7cUR+tCpic~xA@z_1+XC^~$FQ>Y3u(GyLc>b`ut
zbw}!p*^Sa5e~8^UccXf~c>15p?5UmBpw2KSoF&=IjeiJQ{waF-Tku75B^$_>+WYFp
zYrOJ1E$F7)NOxYbOy2cX#|Ol^X_N)%$(@ePGYUszO!sHs0bL#WdnBYx0rGm8Vg;#H
zzCL8v?;g0<6co8PQ9>9@2o+9^2%@c8J3~0(^nuf&J6<88$KcPhn+42{=oTBf^9Z?g
z)tw_3FOoSqE0!zOFlVQ3fSZvFx+m4vsP=2W*EM}Hiid+YXBXU`>h5V{-ZmWUxt28R
zdHDbK=4{#Hn$#5MdTz9Bi_c_=5Bl?MjKokffk`OKTUB!Ax3_EFjjWku@tGFYoM!<N
z$Gi(s23=aoAFB%^$D3oPX{*0E=WY`dydBQjK+=S(4mQBX?eo;Qcp8FWYC6P^O?j7q
zpYK_x$$q+GuG^Y2QW=mUh+T0SzD0v^#ia!@Kv^3Q$erPP_fYB0aUyqa1lgy|ih42@
z&Ja^RMN%-Gamb8#vL}NM3(D%imu+iB;>ug`fC>T915k?{P-3hQI3IQnr(?L-x$u$S
zX7CxuL)#Y0Fw|#@B8vdx9(<+BG{|5WjljmfOBjh}kG#A(#=VvVu2NZsx7d2Mw7x@(
zz);$rQ&`GNmZT0vmSdid%g=2C2dDy9g6Fd)SGyt-LDeUIbcxglb^c}5fusJueE&Xs
z%mgC!@rhrJ!t+u=JWSS}$IRZS4K7<95=e(|2vzMcyIJJG3Y5Jm+e+$i4i$gKx2Wkk
zfjrv;xiLoUvE-ljcV9fHx(jrg7}tYri+W6Uzq?D)$S$It@}LVu3?w%~lwD##OT<mY
zyVX#7@Zg{0Nz9JKedLUABD=&BIdP!e(fXm3P$c1!z;^9s(SeyeLbT@Sok>Wl+2nR3
z<|aU{?-W53imZA}9Pjyx4G8hdU#cS}xI>Yq)&T+Qejg@mZ_lGTf)0fUZ?xx&si^7S
zOhx$BYp@B#&nM)5;8lVD9wokCfMFAvF+)->WA{_!bXR}hNdG=9%P}p<OekiODQ%b@
zaISB>j3JEOM@ZuwZScQU7>zzQjP~At&ZfBTqv+f;PMvVxNs``8URNF0a>LmRb1W^&
zV!a!2AWS^Sl)TwcDuP@q9H4+K!F>$h=mJeF3iLGTiw~A`UvyI4?`TtoWVi&AbL)aN
zu5dk^(oB#*kuQCpm`xJg_s$XrW|b6)vMF3{z~BUz<h8Y2)aeys*NDXZVlH+=t{Y~C
zSgg_ndJ-T2B-bB9vPzIyTyX!aTeTl^Ce4Tg>hG268*5B+OaM4hOOh}LKB6kJEeOnk
zAcMz4ze`3!6NVA6$=U?>@HB*}X+VG^b8vPyi>7|xr7OB*2cXR$>x1K*IxgF#3h*=0
zg>{cUjHXJ?IEHnCXSa{OV%18ttffqvY^g$%jw8Y`n@;I{HwkH2GdKw?p!Vo)*4{Mf
zi_UVkWg)5Pm&5ErFe8YtVFK-S6m0`<d5*5TDh=Fy>)7C*HOptX8}@tR!U@{pa@VXs
zlT+c_E9)O1&y{KzfDum@hRN<u3P~dxX;+=IqL<X)yHyFDD6A|YvX8wP+F=^&8B6W>
z<S|9#Oi$k>m7(2QhndmljH-b<U7%ZKGitD?p#WBJt$#xU7Ut21%7MZx&ln1`3P5qE
zy$q!F4yFz>!VzhMPod1pp-5Uz@ebzm(9_G$vLlab-XkRA&GwZ4{1g)yf<idp_RLX}
z!h(`ab#cLC`s?p0sBGTzyRv_MBTqbGSbJZlX~Ow0tC>bEX`tipijEIr+x8S}53Abl
zB3<4ql{87&PY4*q^@_H#xVM#A{3kM!9;49{tSLxv%UXdMdW)}72U0=b{=Ok=+hwZD
z+>tweF}@)r_Kn<<X(}^RtNXO<x{fCu$?y$2Pv}t&K3{~Fuh+TGSRBp~O?Q>lAjz#|
z6psD1yP`_2K+{=ZN{wPv+mixn7&l{)9C|qi>2tD@f#b$mtZ<V{3y!yKbZ?6T*65j#
zNYU(sp}?B(G8&*>tsdXw+BUu%nNZ0(#0^Jv;AH|MmbFGlrSxuKyN==6QD;CY!{^-J
zk@bAI)c=kJ&VzkiZjxaXZh_0;0}&DAxUS;gVRQD*rthVUnoUBa%&tuL$G^OG(;;Gh
zEG9fKkh!Lm&>z}6(cX!Ye7r!N;VZ!0PF|kYtzIX!mUi^3;zZPS%daHuxRSIB^-;5m
zV~UOC5|`knvZAhuQPKwWUN|x@5}4W)MB8LAU`8`~#+e1G@zfYwW2th*@A2md5m@Qt
z{2HZv%sSzRjCLjOnt>O1qP67>n|$%AD=^-g3L!2b3Upk+sQKg{hCAtt9T<bIe>fU}
zYpfj1j4)l!Afhgm*l~KmSDMWOD+LAK9i*PY=o&N<HT8f>@8WYMonr)hhUswm$JXdd
zF5|}~WxX`u$xrI1-}DV5=OWc#gGsW9_lplu<6n)U`BSl*9X<_ZFG%W<uQtc!fPrP{
zPdoXQmyJdj`Ap_ugj$&4(A!jF6jG8X-u`4KPE@BZ8H(qG>VV&UBfru(>qw+N`bPRI
z_Q*)kaOU5`SpQUvwoPH0Iz;W)hxd<C0x-bU0&Ej{4hb7S9ZPD7bA8AnJea0zp;~(S
z?N?gdTsPcYhY?8(HD^ACTJk;MYjxO1!GvHWQSuo$j)Ga{H?~G#yUgRiZ0qnFc9ZPV
zZe=iEkroVFPjnOv9@AH?6$vGuA1Rce*S|42LpMNOAgG-#LZY8_nIwBqL$~~rBSc!?
z55-(0o%BJ}JQ5{zf&Q}T=%3+*^ehUuC-HgQgx9um^gDxcv`?$9mC7n2?PMi=Bu>;#
z%4$u>WIq;0h}SWI9U%I`Y(pmmOMN9>b6lDYw+dP@TmxR&4Sk#YhUJq}aLymDOIfK$
z+^}-C60{_Y3=i>MMn(j+*oYN3@hjEZi|z9~Ch`f5x2Z)&;mm}PyyBrq6sqjsYD<8s
z8JN%`==;h2z<GKr0m!`&ggvsmOmX+|#2vn`k{SY=>qL@Kb!pBBXLV<7Xs!?NWH`VO
zP3^9mSL?tSO>G78${$pLjlo0tx#Y@5O(9e&>I+n9uuU_S`ew)dI^u|mc>tl|b)ICC
zY>A)~8~uuu92#uZidXCtpq+cm(FUN+SI||0?lHk-n((qFI!F`fSftSEk6zN#YZ!(b
z04a>np26|(=G|5}Fo(Mx3eMxTY4-5<(N{HEjGe5{;I)#|MI*+@jW)iAWG;XJN<G_A
z`*Y;rM~147x2toJ(Wo7Q>CQg_-825xq+O|Wqi~?m$xU-S3(wU~b#L>MuK}Rup8%T;
zxjGZsix>6)sNo?EK<lqUEFCLMVi8VsD>`>oaa-Wnsh23r@d+fd!1^!OoXCQ<0>ZjX
zLSxhj=;I;OF6T5f0>hdHVhInBtZuoByoDjti^l(+>{zCa)IHZ2<w;bsOhgCxu?Xj(
zClq?eV<1I$&8Cos2ks+_T^JK4)pP?yUs)HUk3$#?i6NoAM4mT0NW~hAF%#i-B9cKz
zNZ-aWoO=dM_IOgGE;MlCG}aKg^2^Fw-$$=Ra%(x=6~xGCf4+FVgQZY(s>R;-jEt$&
z0Kwm*cC4`P#H;m#s7hB|Z&!z!!+8}$clBi}^IZ})9y>Gj>YVYC75KG_4((<U79@hL
zRF`ufsh#FWtvCfMZ+q2b9t1<3Q9mM@GuflvzA?=8)rQRD@Tr~Bo!*Xdn_Y50HX=Vf
z)w!d3(Npbasn<hq|2vrFe{~0LQ3+s~v%Lt%x+gER`?SW!L3dC^=t%>EzJ0FX_golv
zc&eJM)P5N!1=9v$&LOZE;~^sk88)`WV%aKP(3oPyxqkjbV+HcU{hmQt#{#S2*Ncyr
zc&=w2hdI70SL`FT;-`8$s&z!$-wL=W;RJrF5Lx}GC*xB9!%g~j`heJ#im=9W1+iT_
zoPw-ckshu7G5H6peQ4C}K8*6p(E3Jv)ztU~Fm#~%<QCP+%&dAde^1X;w~32qq~qlm
zkMnH8Wq!pgy2Rx@;leVKat%9&LN}O$Hgh};!n{DR%A*!V3f??yFqN(=spKS~=DKmU
zpKMP8u59?OBKZ&532m}xf$ikwEnk0`CV6YO{otLI4x+*}9kci7UV-U_N18+2>*2WP
zL%D`Xv)Z;|(uVLnl)QkAYb=O73TIvQl2)%wvQh`L^r!OwjCZ!MMDhHoKKsF#c9lFv
zAh)k%+xiY*^pDa)o-0!<7i>fP3Fi1Vo?%c>%z$F@HXcs+JdV*drn7GQi-4k_4)uwI
zn~1VuW)R2NJv6Ii8?wHk4Er<_$(`Q2jg|;63#By%`lwDYpNn;Y>RjHr0#`R8cXKEb
zG)&v1n#Yr%sg)^wNDAxa;j;AyT79NHmajS6Vw1O}Y#aOK;k3zpds(}vAA!Bn<3`0$
z1ZSo?7FI6PM46lNmtHy2XXfCVc^o`Vf@>)-0>Gq`l-Yjy#cBkRV%5)jNYYoAPG>QH
z?fZp6mz+}0X?VFdJMs>L=I%UkNkO%oeOw32&|e*Ot=AHI<U-G|Ao^0>CfREk2^*vH
zf-0$!JoxR#i$>igX~~5{f#X1Vi^GH4-kV()pt0QX^!QGsExw?h(8Dc|c_Pp3;-g#N
zcaZ>BK)<JaEO9ES5yWQ}Ys3LwUA}f2I}-VxN#fE`v;s^CcPBcpF0966K!-t}xa<ws
z0hVTOExaj$--=N&t&RSz?xk#q1Z_~;F^D-x<(=j7qJC2ORr{|K-uiquQ^`bS^5(Ko
zNpOOuS*gD^+o?>gtvHgfPF{sJMf&J-8+h?c4n1jD|9vm*C8Dp{x+p3v?9lm3m!<xc
z$EOYhTUQFOn+N|<2zKHlL4JQUqgn@vrN$j+gsuo^*}M%GIQ@W0D5AW)pLce)(R~8G
zbtqmf`WIP)eE_z>P#8fu<}A_rcdx0p6R9bwHyi96hJwfL+EXYcV5q=g3!tGFbo6$u
zGAQB&<EU}xAES{eU=FXf$L7;6jywx1unO||L#yB>gY6vW=p9d|G8;KnB3BMR_5tr>
z8JJig_rkKmk1+n|p3U(2sf0#;&A#a=R3sCO!@TS%bl&`gDPu}ycjdljh5N(GZJUg<
zJZfo!C~`E+lz&8iFA2mLg6CUz$71p78#SS>lOgO#UX}DC6)_uUp?VYfd{7S~y}Ov6
zD^{!stvoy297|@Z8`{tHgBV35-N*dMdvnz$-0|#Y*SBszooTrC_(-?Yo`4P9)3#Oe
zj;B0K9Rfw+PfE8=Ru6ASq<$R8)ip=a`2<OOhm)liT%mT<em#8azC`1)cv+pzU_NYV
zRHX8ymOolZU^YEbct4dVsj>D<-cMfG4&VLS#FcJP-rq3-tan4dDu>iW!|O;It44@y
zkz0*DNvUkY695Y`gDyt;WDdfq0pKgJTajd?SX_cP9nRn<lns;Nt+6nq1&ofAm#2}o
zW;}%7h?&Y}?XvIzPfZ-?k!85cM6NW;rWRd4@k)K$P(-jKAM|}Sk80=<`}~LQ|7;CM
z4h58%Qai@_e%;=VHH=!(S?QVqs{URU$!L!_uPI@~(|~;K!uPuH6H^&+=T;TH5NUdK
zc5+BVhCA^<sl&eV)}D0IaVlrbv#WzHN%2YB&1qsgW<554D~Z-J52ce7SJKQ)H31gu
zQU}$yYb7vCeasHc4?c?a=uF@8d6tK6$v|0;d4?`1)mZ*2&h`O5Q1u9saeO5HY(p{L
zE7T`zFoYqDWxTsd<;L?Yv!Xv3_pmQg@MvzJH$v>j?4V&EIdhDWE?~BW!8VAi6dZt`
zpuKbSx{Ut}t8e6VXHI*|$hH}VO;2?z?CQF&pRXf(+czB5MzG*@wH-b#>1M2X$-KkM
z{gaey4SG34XZga+e(k4I-FzQj0+=NH9y45%Tb=1{-QlJ?QUL1cUlo(O<RFzQMZ4pP
z)3qn+`U?HE*R!Ho=DS(0H!3U7H(ia4YC$a3vIh`B7KqczPJd*mYc(_W0k?pjbSxAz
z{K)roJx=~2_E8b-td@L1mw+;8vLOCVgsC>etC+`Q+!Vfw3?ws35)UI$wL#W@Y(tVm
zxuobyv?DWOIv>js9Kvb@1)q7#w?j5lj~$1n8%pSd?3NG_=&gkapI=L@`(5@TP>J=M
zjD@ZMKPDIYhKu&^KO#ES<i0}l=fx4&(uKg2#Et;y91Wm=X5#RhtNigdn}OHpY;0Na
zck5pOYEKLwB<SZw7cMkeX8=o@>?Jb%62m3D{`%vH!+tMhua<=_CYp!k^EY5hpPOeA
z)NY5hJ&4rUuzFK3e@jV&?i1sr987PyHJkGz9J8jtIv3vg@E@tdD6st5rrv?i6fgy2
z>V0D}PfL6z^m>fmQu@UM<W{@gZ)J~hjC%$teVkp4HkBt{?8s(G&2R>tN{q*9(6O}f
zlvD=NZeVZ&u0V{q5u-^nw6>3?0l~q8>^IR2#_P5|iGZQD7soS8tiiKBjH&LI13}C}
z`pcw-_BH!sVmfm}h9daF-?OP|n_yEiLu%h|0C*pKb-vU>@~Q<&90?~?3U!)PObF>8
zMt(V~^MG;gmz%-&wzZ;*`IflKYZ=jJ%3IBQa}Sx<5?;mX?zbFS_NZo~5faRwtuN?F
zDSQ-C^Y~*U{MSif^iw!VRLF>4gm?Gp)OmNDs<h2#kBjgDItZsl7iz{cgGu3@0X@Zn
ziT5-LiOY|JJ?jJ6AaN^r?1or$v~~y=AWccfqY-C#@-J<Ce{#u<eHij<8l|%PrSnM&
zX^3dKX3e6|Ye~84+}I<n0O8Dt9~|db?x-N_lKno&A&Z!XYJ1jdwMz{BrrT*DcHq-#
z!Md-fb!blXuDq8d$tNo5l;tDNuap83x|Dr*Tfm#jwvzh?*kEp|clo52I5NgwmjGTh
zT3V>9?T~<da-H{{dfgN5UZnlm12*}*Y#rnU(3G>Is?IpvDn&8|<EY2A;tCb$UBXi8
zNpzlaNbh|lVjH`JjI5!E{tRxL_SQu+3Bp#k5RGAyMnvO9Y%2zdf%#$ML^fscjK)!q
zbp#b2J1T;SfhnjKqYxj-z!aHQ=Ll+iT6S#rOVe$15mx-ZNz*mp8X@mOX~IPD4&UpC
zAD!Iuw-;c0d)weC^T;aGJP%Xb#>+vCmqBa{x^XUlpAEqaJ*9HjWSTC!3_Lt!oq5jR
z@wd*1`i$F_9TfMn+lx|50Mo~PoB*b~Shw|(rhy|mSar1qJR1H~D7*BE1Gt#X3(nW1
zXOe2cD7Pxmd7F`X<69TD3q<t6xQs$Xe6PKawh7}+S3C}7&dd^&@@@<~7e0I?xJyC<
zgCU(7Qp+xEwG(xsiHy{q@WaJa5)hG^y9fspNSsTY&k5DZ>Gsh%!KkI5ilGh2MjThu
zZ}WWXKJ=uzE0;~lNE)#WLBUYw`_F)yZ`g7z_xlwZStm``4rOS`o37K`s_(IB{2l4G
zO>6QvL7oJsG9;gnUORL;Ob=+ed9V*ngfoUTcPS`q!8a25p@(a1<t|To`K(<D3~a!T
z9{x(Vv8;e%34D_08*`SUbzFD7?TWO^FwxGTO&|-{bZ*b!NSv^S&Q9&!!UTpo^n2L&
zIy+`0ofpg;*xAZW1aE7IJjvbzcfE=sZw08H857}Bb>iBQkDlY^M5ez6c>85zMOoQ0
z*`<5>%m8jbXgU<Bs^6yRIuuqG+GY{a7j|>|b$&km{({jHFw?#3U$TeJKbSKDqI?Ty
zqj5T6hiA9!<=`V#c{U~B5v}EG-mWnl?*3Ej?CQJX9GOPjMn3t<t_?E&tN!N1)|x^}
z24?7GXL`ZC(MKSa=L+N;_?|u<j5hx1hSDA$4@UE{9-io7mscjfp(vsSyO<10=yV||
zDofOCFRG%jTPnD{Em(En0i2<2w+<$CfcBMtHLc89R^Z(?<PxrXtXok%r*&sm;PTv%
z<!>uXcG+y*Q!PYzFZez;C0VJM5s!4cZ6yvmRZQw>#%|QU?K}9IL+3qBXsu6an9+>z
zE=A`cP1~;K5HMPZ^=|1g83u(bZqzl&gTrz~>be-CXoQ~==n74|nGXT#>wA%M)*=}^
zRB;4%yZ9f70U|;)JfB3aAyYnz1%dIwdB8HJcR4z~i$Al99*=do5i>%AwV2NAIC^W6
zHF6sL^FkS2h3;Ea<d#Rh$3ocoTWie?pC>gO@b}%0VOZg=NupX*o%b8gwU=ufA(A@#
zSqjc^Mn;R<eqKBjmlx&<E|41-cQXnyThoMR;t9oA9fxYJcDT$V<mXba5L_`gmWV7t
zUqN!E2fzh!M2R2pn9cn6sUaRXIAiS3X@W^{j;%+_XV7DTZw6q!7<x6}bZ89pd}6DN
z=@6mHZ$Bq1&hDOP#rV~v`?ct;I6u-H4-w!mVVhi3-%NBOOSoJ64;HI6=QXVP^PNxb
z8VMlGNuyBgw+d2ER_1;hBWBDz^Sv_(`48>;d%RM1JF6ZnqWyJP)S2i^@;RF$4iau-
zoOll_4>D(#w2kHptj4NJ-{T7r41;niyYi=UwI`?^v#F|Qr+fF+Hx5)bl<9&tou}`L
z$jEEYH2Ln$b<NHjLif)VEYH<Fv2pC{%(~f-+wv@@hEogTWzEBLMo)cd)fc=NBTUN2
z#@TravR3R!{`9B4a(ft0f^K%4!u{cmBzsboir5p#9A02;F`CkYr4fTf-i#2BvTk&(
zAgYJ$L{7XZ%%=@aOh~u^XR{a+3C{Eco-0VRal5Y{+k3*l@456WFw(!s@v_+aFTdQJ
zq_Y*Y=D1HD3vsApQ;?zj@vhM|=NskklKS6nEe=AYcra)Hanj1EW#F$TYed;+ib-B=
z96GY#CZAr~LyMwuqGGx3S!5oZ6I;rAkM<H)CQw}&yRhK#8-xA&4rhQq3_frbck}!I
z_4n)woVRbG3>c85@K=aN?qQhV{R1<FRZ?+_lzaHjS%?01*<&TnJrnfao-QKPgdR-5
zkc&dii#d#pYKkbEUriFNi{+ITV0j_b093iK#+mexo9N7p6G@JGL8Gv?56(9>*InIy
z=jYL5JQNp#$N$2K|0C||&VfiZsDA|Wmn03ACw$IKRU@3a@W6k0DoK<zSc-fXb=rd&
z$$d(UlT<UPV?bl03vT_9QGn$zu*g6%4|S8v4K6V}8VdO()*sn@!vD?>AayP(&&B?W
zW-(_=))auixx<^eKp}q^02`V(*@y7fJPBvrtqYPN1|m{UGT8h?E@>;?YXZhO!)%Oa
zTfM=a!Z^io3G9KLG{IfA_pZY5+ROabfC?w)li(~eCK73hbEgyjW7V@qwH#b0=goJ1
zv2M|NL<Ydn-skq@17D7dkqPx7@<IigL1$A-65dd-!l_Te^t<TRfWkPWFrGh+J{??5
zHn=LSdXN##0BLo8i|q`#;1($$>K6$u!;ul4=~UGO#|jgqsVgJInko`uc~|2!JI!$X
z%1`fRJk5B}xEDuE6#q}VsjRF63-$d|D4#QNHA!I=Q<@@Px@y_XHH**WBFW>?9#a7_
z(sAcvNylBI(YkGT{C|rMXrG$(0R^4ew4i)=dl*oKv|!`ihwc-%l8f#<7UrSqDw?C@
zhD_0IG1j#HN@&jRX)h1FQ}bT~Z$Z*R@Gn=&-qLKTsE<+8TV0rkdJ?TADsL_eepNv<
zp7!^I)W@*a;h+AOANEuM<i-<Mx1<?oN%B7y$u!kBMk;7R*6`gdT`xm+#MR!e@OcJD
z=oXj1&?zJOE}jctn#&zr+nTue0TkxDPk=D*TLl>n`)+m|{qIX%DC4gNSn9OebkES5
ze4A0RkFwrsTWrYE%4VJkbtRAcqa_|1!0ZxviT<agrVajOymF@h4*_~SQ01)?K5sE3
zxXjphD83yDUQ^YKlw)~$G{+)e8xC;P!O)(Elk@*_Bd)+f6<iaX;8$oaI3RZk!w)uG
zwrbfb=Tplq!J(gTbgqK6jmA~K@>iK(OwOu`%UEUpeNYDedG{N1Q6r}!qre`qfU>ss
zrWf@}QYKU}=M|EgQ4waBUZ1)G&C%RdXln6;KkFGizEmZ2C>O=;wzi*NB%bgq7B7qU
zI*VJjD#LWomcE&qy?x?))Rj0MaP>iFGoL_oHh%I;Enb6kDCNX6_+8f1s|(fA@$p`x
zJNz`!y7N2ct>=udE$E_5T(Ehn4gLtGQoMwM{+N{XB_ZZk|5L2Efoq0dYHHpbesQ(j
zCAmv2Dtd0e#^lnL(nf|SKyz(AmE!4>uJQWgk(?5R2q+Dt`pe&>XNcv^r9(7t*s4v@
zin$Eqi47U{^Sc<7Kihw$u4WZ%zpl_E(<D-5t+n&@xc+XUg?i@|G}AGkjB>({@GAB3
zEiAQEzY#WhLmjRs*?5<QOuf3Lg1BLHs_iJvG{kPcH+P+aT&&aSGc^A@GFSv<a$C}g
zBv#SYq#u3Yit#jm2D=hF(lFmV-J2Sg>7VPCRxHy5OjGq;^$!@tIF7i*!+lC(=&8CX
zG2%FF5seo(ku}eIk#Agdr;9R<fM2TtkU*wMe^uz2<*qhppEj+Q;i|;L(Bcb)WWm2M
z&^ZXk*T&}7<UJXC7~&oG!FCrwdymZI_{7KhCmn%bXz?(P$w41|HlEp>!}iL&k~A^z
zJ8W5&7;~v#uv}HI_f-4ac&e$d=k9TZ2Nw3_sB3?mWI&GR`5ZpWMD`bVy)%X2obC!S
z{n-jln4Qc%-XpsnrNqI#P$B4Oj&sc6B+9EQbw|WqnzP=yfN~bGMJnzzCr+g-1@miE
zRhg!o6+LaEVrYi9Gfgi2YSOYb0P*<OFw1=Ymr}3@KtS7a{<5C78fVDAn5twY{7t`!
zu*&di5_5*$dbw_@o4T-tU1ilZ-@KDyeEpZ&<iU&0Ht?T_A4?(&37lIL6fv<zx{S6$
zD`uuDs8rqMYV-%siS9(NR`7maTy1de|AGM)1DR2-MzH0BF<wIK`#{F<l#~j7ELt!!
zB~uX@PKKZ-V6n}0OPlAJ#Vzq+kNw|MeaFFbgjM=Ym{Q!A*>^wq<LD6{yRw+sLgUSI
zbL)={Eb|}EED;_ctg;4Kim-~e`$+}iF!)fXfZte_@}4x`IIZUT{wh@WW(=;$*Dq81
zSzKhb^z8^|d#~{AvQ)Ko%)yE=ccMRJ833!FS2{iSc39>}?xVqR&<;tA8NAF?(Z?Rn
zp9Zfa#vJntXR}J%_KM4V#GB_=ewM{?5$(aaY4UmeM9hcEtmI3&n)*aZK~RTiXY|?v
z&X_B-0rUAqM_m^k5_r5D0nQdM{IgG7B)=p`7{x4Lg5p~R{GM&X4lK_b_0)gw{4)RQ
z>Z*5rYSNx5gdRM9GXB029I7PV<C)5%BW;Sb^<6nX&i88NC@9Bj`ISDtlH{sSZ2w4c
zn^`*$zHBA=qQl^iC#(?}@Oi=^y`U()ORuVtM;;%`pFB~Z21S(qN^5go<g2o?m}xL#
zH=ksB?9X6~t@m_QZLz98(S@^Si=ZtEM@$&?NQG~vSA5dS@~m(OhY00-($mr9Tiyq(
zCnEvmFL(Phiny?MyCw~KP;^hB%2VYjhk2hi$@X?Hq7U`L|Bh{wTHIQ@$><d#7dVa=
z%cA?ildxkIPk6-O=DN>N&8rw3U-iH6%wuvOh1|b*;c$Y0fv+!C+e*~_q-k42hAoDt
z2}LvE;_h0B`ut$!Y5~3WNfyl72ZzWvQ@cD1SJkDjg*TVKcqr3IP{xH`F*mJrM9+Ia
zl?>iv`pK8qEJ8k+1O)TALgz@8%;&v{-fJ-_sjUz6&3*P@CLL%C{e3m(TTPEG2-aM<
zRcypf%-2TB1!>K^xLl&N8WD4BqCYSLLDLYI7tJ^8f1xRzg4pGo&cs6+rUcv}?3ua>
zf%t`b?ZdIpnQd$|47XM^+yY)To6og>dj0LN-I2m$d8p;kM?3Z!GZlV7)Wuv;yTZ8C
z01vEO$F}ljvOTvi7DUc>k7ayBKTN*i4SWzP{6HH3uSRTJC+(9?-{1QoM#FC)j;io8
zE#NP{zELjPNT+$b&iIAITVwNuSlEcu&ne4#xD9Le!v|cK5lQuRfs8?caoJYAPnz#j
zBOAA03&>qIzq@98Y(U;`cp2Jn`I<$|=e8RS&YQOlw*Q7!uiCNr%0mCTHAah@cYyhl
z`GENo>kCJdpNywajK2Jc|KI!a1GE5Nu#SOwD>lkqF}BC1ZGC3<z<0Sr?7Vds^U`0K
zDI;I^;7Zacq#VqPrY;S(T)!24*YN9)cw`B-ab9=^uX+3ro-OL@9yHg*%on?CO*Y0V
z-=wswfBg|hq4(nF1p|++*!CWE*J3sfz&d<qXBX!sDb)Yyy!4RIhh<-WMAA?5rAw@z
zQg41Dx982q0Tj>J`DUMGephvq9~zFQeEAV|zt6kc{BCzh;Ps&m+=bb*Ttl62SxI@)
ztor}hd(XJ0&#!;nfg>tniCYw@6|`(H?4eNWfPfWc2w{kT5W+BQ2#6vS2iS@b5{6U(
z5eTwJSOO9i0>}y^Kp2w92ob_efc&o5yVc&>`zsIrum6+pGhV14uj^cApZ7VZrgay$
z=Fd;qejG}?607X@Cgm_s&dcdfnYP_>*J-8d?7wP3kjVY7S`g$)|Em@Rx!C`z1wou|
zo_wo!{a;vs|9TGpRS|!dQ~s+WK2s4dV@TCi+^G=tMX)qOOt7v-d$GaH#!{=2cT-$^
znK!1ZwU};P<)t=kpU-ZB+xL5|IOsY)>b3f)QNrEOWyKGH$^41$j|X)vaKTg_nW87z
z=M-y$_2sM>N-K24KNhbdfXDQlr+BX8*XF5<4{y)3P4FVsIS4Qdd}WzS#Jan)lj!A<
zHZb)R*6Ch8{U-iEGlmxtv7@!;lrl*xyJg6xl1sJ7tGh#ac1|l>$H!<iCx4}0^Sq3N
zM2@!Q({cLZK(cJj16|D0J>|lg%R8)^9Z{|meVKY}<^oqRYwDL1ftVtmj(t-QZKc%q
zqrLb86U=`G=7Qzu^4@0F#2Rl}zPGTbZhUbtL1agPI48GTm6@dIQMqDY(=bt9!Fw;*
zMQn6^N+$bF9c?VGZ90*%g=gk4zzM#XIspiGTOs#(xuQa?;NvSPsL32t7sFYR(rfB=
zBxp5*q4(h9-rV-N%5M3wu*k6>Kd=%-;<QHX!3<8Vx4{bYT+3AJ`7s;JLREs)sq*;)
z4<m~y^7V_{A}~?;qNH_|$X)wzd$E;<5B6IQksXr3)GGffFtcO37|;JhTu!A=-vGv(
zS>F}iysW<AUTD4`Bv?^oWj;D?m(hmHh6*+!1uk8qE_2ETbo?f0x>~;2k{|bR_RkL2
zI^A9|Timuw%^2r=lyu*&^A49!)Z|8UHVN^kXH=WC>Z>MOr9p*pFWp|8KFbcWzwi$V
zhYEJWZY~`zW8Vyka`h7qw-vp-<;DH^nsZk@Q~RdB7g9eT1vNN#Gn3f5dzWa6Zlqyv
z=HQgAU!c>kM{YNah1vGqx$e=wF8NTRNv7Bxy`{^WVt+jk`#wSc#@+8;Jv_1I=Kbjy
z_91zHEu40sW9N8<)9msVt?>|LWG6R^KJFwFlI;C|<;i6Pg;QIXOSUe*;=zsxC(Sy#
z4slN0a!A*I2reiW!#wI>0Ep7gLwr*q|GfazT+)N+S31#fRJzzP!%P~=cC&6@EHBa@
zTkMRs)@^pFUu4cOU!%`}@AjY@M!syI|1v8VnhMme{LwHkSIh#(X<4VV|BU60I1<B7
zi?lDm@brB5E^GDXH?`zd80+*{sG16&q{(M=_QdYpCTTsoMEE9D#WX-w#I3qdTBx;!
zoHOdpGSuP+J@rg;IWGJ(w72uRf@iaAdi4KA%fEmcu>xP(ypU*n5svM8Q%A(_f;F28
zKV1!bj$i3{HeX;#p4&mu4Pmg;<qU(|z?NR}9h_6<`u6L4yWqkbp>sXgxW9f&H7El(
zb!#pXAs1eDfFtE!EOza<zW3bPhD;!2seSCxZ-Lw#j|QQVLgz${IRsiYGpqT)R7$7r
zO`WlpH*ax-X<fSUL>%evz+`4|6Xl!~dD-dW`y8Ex)*rbQuT_?s)s!~GN89giOUpgL
zT{^GXT>0V6!X5c4pXH@EYYh9+ue=l<MJr?kIr_aWGKa(H(xUgWA7i>Vt?Y`tO}i5Z
z{YCW>%6hqP$22!9NCsg&T$(1^R7t6cAyf7EU3Lxn5xb#JgO+DAZ*r55`_`8o-Hyw>
zVwJm_^T7VvxK&}|a%!^vn)f44^;JjTC!QN8kYcJ?G3XzTRAtan4Y<<C6U2%s4a#vv
z7wgCPaZWI|f?XEfmfPVUzczYIWUDV3Kvd4NeP_O<O!?^4acqh7mUk8Yde)EwM!gK{
z_!6*Fc{!_BG)qSJux)8H?&#_kcxbc4(3@Pyc~u^s(p_If>oCplm1tH@3p<G{61qc6
zVTApj?rL8jQ<_|Mc#BS*(`e5V8^x>1heBDn;Pl?zhks2dMHcIl#!5%E?AVUt>6fB1
zBGv12?)eAv#oqjaEn&vCo%)svpaB4b=v?T3zrD#4Dmk%9&qxt}C`;o91?rBgiLG=v
zsZNQxyERUN_rnE*>5p;}4HBfnx!1XPZaHg74F8B>WvQ3v@RFWkH#qI^9_yl4YF}Gt
zau-Kw>7krp$j+FT7n5gNnhg@0FYYpU%1N;=rkCm0IV^`o#sySmep8838*usIRqs5P
z51Q3HGbt8=A(>CYE;2VsZrx+BCid_XOB!D+dE0xycPj7NAIzTdQ#LXwPI*B~J6V4L
zTG!i2xqAjX&jc!~Rg+>`j^}93_?wD072N?X6>MTtx`vwDGW{g)7+7IZIz0W|mwM`p
z-&CIm)q}Y`N*aae!&lV2k%VU&ov65h*C|8(v$sa1XJaQPkYX^q;at1HtSk7A%f6+D
z?_NSjrPx1%{KQ5&4EnLZPoO1L;f_x#cKVlwYZEkgYps|fCN+9ddv<O!sP=HV?>P!~
zvTZUhs*OS9Kz}tlckOJ&xU_9|2V0RXEZkRr5dGjGo>ZXgP0s-99)$O|?X9VUVZ`i{
z{mF|_*)#T8oZR)Z;<LOfvPLy^+QkVv--7Nke+H^{m)4v`jx&>WIdk??zg9hG$AIm3
zdrX&ZHO-cv#-h(YDse3APnu|4e%sQI8uhh#(MdhAb-xMOZ#GwHvhoJ)rRD+qs`N^J
zYv%BWle$~8BXfs}`JU?{m6L1g3@Ydy-vrz`02&SK2)(yT^OPprQLYM}ktYU~W^?V&
zc;q@d^j_=3Xl)g?(Baic^WHbfFn4RDrA9<Lz1ZD-ny`>U&w$ZI4iPU_@LF)YHGFui
ziMgf})UC)sH+9UHlLfxO3m$xa0ccwN4bf2xi!i$viqcT0VR~};q@%a3N1X7Lb)6FE
z#N6?~lifH^5r{=+);UC5aRzDY9uvlS?EF$q=~m;yrii;V9n!w<<<MZ{-AW9y-0FkT
zoQQH4y(jjj9QZk3VN0!|j_ynK=gT96+@V`++ElI>#sk>VgvI_m4bQuj0^#gP6abbo
z`P%u%OzZ}eERDp!1%)MWCj6XFJh2~b)&cVXATn&tM(jn){HYIV>P=2)SNDpgrjso*
z0%L8wQHgW^{*;`ld*9By1Z1#MTG;Omep7x=6(24D)k5fOG*BE3NI=i98efQxmLn7T
zG?)85C}NwT@-x9^-&Fb!0HuFo&GA0Glu+z8q~0Twq7-RpbKxk8yRgVIYsP18kebFS
zHhM>?P2Y0oSg>Lhr`N?QSE}p3#0<UmK1Mp*0J-C~ug#dAV19LfKdt^kC1|_W{Ls`a
zKbpDQTf5$ObWTrws7NDZaWwnc!^aK&Z-!cM@Au}+F%~d+I{`UYL^j#gsj%66M=;^Y
zulQbR+LEYfqy3s3j9tg{p=3(fsfGp7fZk&S>V5Yc&3LL?mF}rms`k{Kc``#uQ@b<6
z^k^7%fHq}u%N`T;5V*G1WIOA`&~0{)B_Ug=0KHTv>;1sP4OLy--CQ}AQ7_9hznmC{
z``~x!#Q<Sp=gM3p-&>*Os>TOpQmQg6*F?}5125xj@YKaX(mjY|nl3ubgV+@R!GT;P
z+fH*(C*5wqFtddNne&8T_W=3u!qD-?6Lc(&Nr1dO0H(PwOl)3Y<cHm6cBznifriVM
z)JkUhl5qQ1C|9tE*x0@~oWf)g7;&H<X|MMf#iVX?(`#X=AhXJ-$YT0T03{rjIqEpv
zL(p*#%u%V<N|Wo{E@`we7!P)bIrg31=5K;6aSSfPNX0A{i<>YlhRdc=;7PCh^Lnh4
ztxL?Yei?H_?zbS<S`GmRaJ-QC+zjsF0oKXDP*R3!Ff2A8{!l^}fr#4?EnXFX^f>3$
z#Hr7fzhVI`i}EDq=-W^dd}&x5#vH_GXS3OF6eK1yXld84p^a3ubJW>bT$ficn>{ht
z*y_4M@}#c&Eh<A7mdSG4e7rM!E%HWW{NvJQU08XktXD;LlITx_Zf;GT32lG=Z8yri
z%cz^7hnK9~;L#W3)aT1-W!Oth5Dt)E4@|Y6-r`aO9~yb4%T6@%C_xf#t;{wf><+TY
z(DlH&XBX4sV+LqDe^1<d*3hY_Q2WX<bE}l3jJgB<(7X9IRVky^STO7Pt`w<#eFZZK
z51)A+uHXq*2;AkZI8z4q3u)8Zf(aRg#o`i%H1<)Ad1MZcc`j;&Mk!^@sdSG%Tn8Mg
zF|Lf;dm&MIw>i|vH9{*rDqY2I-%!TtW}ODyarY<|o+pvq(MWFTe-A98g@3@WW)vOb
z(>ocfht)^5C_U|{t8g#%0QcU3{#*{|4PS|RKCo|l9{+=_xv6AQ8Ol=I&xNS&7G-;R
z^pRvj*H#1L{l;+fg7#~sn8Y&FCW}s?*9KKC2YkN^L(Mq}+YS08lgj%}A`G+h)d}70
zqwOe@#OTQa_6PcYWRd8~+!Tt~rAq;Hu$GGT9EHw;o#+UIFwGZKmNFnxMI=?&yDqPI
zZn>ivUN07gKISb(9tw+WmN!js!`;PH-VrbfI*j3~n3S6~tGj$WcV$knc?r^YfPg#h
zOb6n^l5A9?Bv8Vjv?2W7yaan0*wCw71m<b{W5R5Gr4(4h+Czv(wEOeKtbsVZzO+(t
zC=`n6>}pOW7;420LydcraI1CrBY5|!wsBH>xF{7>q&&QkFJG=SGrcQQ**8%+Q`fk+
zjJl5pM&~Hi)@AUHdMlnv1XF#uQA-En^8hqqCGNi8S@TzlwR+AVgo4Rx`t@0t7CT$#
zkD_keB^S9QflEVuP)WS|5)FuT?&)DaqYZDog5!@i3t|@&<0{32y%VQgyhdXW1`sO<
z6m+M#84ttmNYEtt6lxcCGB!f1=BJP*=|~T_*S+q*+F%>8I}cVCx(3OtPCFd+SaO=S
zm8L>614nBOi?*rg*yH7zWdDkTd+rbzWTGF7*Td^`ZD!*Wo@?o{g)NLwsuI(!#YdwH
zXB68(3WT%8T`A!b(?UD&tn9Jq_`O}tM^x{ncULmgckJyuMqioJHV6+r$fj(l72T9r
zHUrjdmS%J_%!iL*o?46?BdH)=T`Xw{IOh8RYv_EF*z_%#^l(%a@D!_T+d9~lb3mT~
zwaQG?s7x5TU?$nrW7M73>eUuJ&RJZ2g4}7wwC7#sbLp}MD%)2kFmYmMF9p(F^b%PQ
z18F-UyFmN~PPG(|PHhX@k?sZ?c%L!Q)Jmzm?~su0W`QWtW&$1G{xg@Rn&t?63DxEa
z$yyvcEcK(^)17$q;r;@cM7olEg$QIrx6`HLS&khvl=OrV;<f4|iF(n<L<DAUATIjM
zweuqRO$O}-h0HmYOi9SEJFR-_XXL#!f{~S`{2nu4h{1lS)J=W-lGh)NO%Xec(Q^zS
z$D8oXsURx*w*58WjIAWpi9T9aP>|c6rB^0<5dZu#xpONgsxTArwir3wt8S*zr;?OV
z<+F}H@4o3CV-fb^ZGpB=)V0dJwdaj7_AX_cpu2MCbZ7T;w)b}3_jmcjG3m`KZhc!8
zr1=&Ya=oG`u*QbCIppvbZYPZ$qt*A6gvz|%Nl?KZx4#i?!l?3@p~0mOQP#&qgu630
znLFwg-;#lD%IOY|Iy$3J*hyWYsid7(hDmftC6#GEoo$WFpcNet-a|?w;m~t?K!h-@
z`111AM}EoPm9JZPMBY-~1<MsWd>Nrn?BAQg-}{{2mM7V$E*aC6a7So6($tjfuewgQ
z&4;z~K|$L%n&V$niq7h@<d!<i3@51Duwp;FFH$6f#SAvZ_cHEgr!5<)8)}(>;m+2K
zKbElUB<fg!MX^5ek6w|STaj%4`FNX!9(z^YYr_qyIze;0+=Aav<m1H~o7akHErc34
zIr&<Zc?J7t`2PA$u8oHhh_Gv{iJJpEgw8<QdsI{*^Br#bX6kSo(HmKi`>~a?>+F$c
zQ?ks{_mxl%JG$;FE+r}dWYwhn!xeS2r^>8ypq_RO`7h5B?QzOKX*n8ZMBpx|4J&w#
zpMQXMO>JuHOBoBI%{^@Pog+G)DKeGRiQjj1?U(JTUo=RHJpe)G?|P?6opHbqybsoq
zyvY`RC3zQj{IaPMi<68zNf$c6Yck2lal{51b5UC$P)hrYuI0vD{(VJ<t+ygok?zWk
z&uWm=qI>CV+-$dV*sl#*o1x-u+IhKurS|@h^q<ksAeAF@U8_kPOv|m8e5!uMNOTHs
zFP$<NhG}zL^W4AjY)N70up^&qdRT4<F5a0ZEDWr<`y47aS}~FPrY>V93s(^f{D>H2
z*U(~>ap&b94TF?aTh@QM4e^WUQcV&Bmw%cy+z#i6EJG{9yu1&4i^8M~l6eQ9YSs<d
z@NgNX`N;qqw3e44Y_+r9Am2X;_f)aRO#7V{U>9~7xUtaPTanQt2fEGwk9+?0M^XYO
zx4)2h-3<6clfG|Myc`A_ZOEHmnQ&Exv0*nOvd&tKPJ(1$T7n~+bQfYluuEE_2LA68
z=5~X=Rlet$Xu@Je=4M-P;W5h4L~xEwuPJu^irXXMnE#y6^e_Z`Xdoh)T^a%#cnhLw
z(h<9=R5yr$<S}(0Ib=<jy-eErN_14NL<6qlS)7U_Sk<VklqNT&og008QfDk^ywHt5
z1QB1^`+^y1z7hmn|9kAi$Of@seyW*j`aY5QGh%1ONjeh&!<}Jj$e#MJpBuW6qnBSD
zOY;%^Ik`-D{{w|d$AOgaRLQ8^riL!9i3#6EQII(>W~`?k|8i{OUj+U;AxHWFB;e~5
zT63o}B#&wMI1FAkh2HHIyO*$h2JHB~d-OyD$RjYOja=1~P-!e7-E=p5{l^Z57WaI1
z*`MtVnt2@u9JOZoEw|@lz>0vAE?_cMMMk)Y1=FNwfBwV=;HfG09@@A0i`><xSI98a
zx%n3s;D7#F{}lnUzSw71&skfqQ56S=L8UmD#H)-Ylz7~Z5NMPP1~;Vm;#~nvhY~|+
zrU%b_?}ZQU@Pi9OndOirL5_v#PF8qQ@OJ#p!$`_5Njb`^1n(s7*~I;MO${Xi8j*ho
ze%*>_^kiFW?#%EuY3Qz6M0Swo4<(kSBw0*6NAbn0Fvs+)QG7KEWd3HYOY)}2&e;uK
zTLz$Yka)<<-|G#z8>@0Fk^(jniZ%VhWGV1d#>(5%NJCq9tdK*VBYj^Gz-SYKhGo8z
zXMCIJ`9x}j#ESuj4y4Gjad?p!+&F)&QYZ{sM_%AOn2crm>t=3~vZ~0?HP~bkt4=$X
zc30}efY7frySI#a7qB8$%RBJ#MUGg;+YDL@y1fy;1-G=HSI+2B_ZeSMVbQZV*f^@3
zcM|Ru5BZD(x1U*_2o`5GtWc8vCv9$<Sk|##0^fJ|5pLUH`||YuIE5h{{W@|kd9qy6
zPt)nDS5$6{ipz~k%!{$s-~-4e3Bz)J%hfgSO^O9h%mHnB2;4h<Wfc3L^tT11%cxhh
zz2~LY4@YnxTv5-}Ru7^whbI2u6R+miU%vXmXV+3+yJO7|%rc7J?!#FE1JiW@7d_Y$
zx4V)I)AY9Fh;KfI?Bw_d7terI^2v?D1)*PV>-a*EN1Xv`TYmey{IdRwdhrmv<gala
zcERB~f~?Mo&?cPvk4pwe)K(9L2}83`{2z{S2ODw_VG(h=ld=_`LV~2QrP2O-H7naK
z$STu876`Rq1gv+?+U4q1TXh~>{Zv#&BK{iYSPrey^WjonbIYV~A)!~E0i)$2<_eRd
z=!?W(u=Ci7-|pS|ByImDh#zgQ-Y<ClUtG7kKRD+Iah|xW<6?@0zYjQ@EZS(;@3m_+
z*{>t3AmQ9XjG}tl#HDWUL`v58+J#LWKOx{*9mXqDuSj8;kvV6fjy#uZMa6x=Os&vY
z>T63<SsBtrjQOM9*lM?KrL<DhT(~AI<?Zy*7p$Z9*9?1ScF*M<?yr2J(fsTkqu4Fj
z_%--%S8~Jj?bnn#z1IzjMzN@(_1O^1v|gbfki|zauM`oMT+V!l<pX^@8m#foDHzh|
zW_ycrW?fp*VNB*TPSzjUlCzdj<SdxhxDvMkr*FUw?pa-olHMS7ePMia&X%nMl2-9M
zY-umZ1P^x6TwcI<3>Qf_+v6Qopy^}S9TFvr!7E9U+7S`@qguQz!uVzjW~phTd+%Zr
zF8Mzz)X$ZuvF!UR<zpM`4{uX<Y&c7R3`%apUkrvmC*OVsv154aH0YpFCZ<U8vpRcj
zi&z_{*rsBm9<$s($+PLZ+in4d7S7!>7kstvWpf%SEgIq`NV3LN9pm{vF$#GyV*!j#
zU4bObx8E?TCq~)!6m?v}hmxkW241VLiAk-1M?=s?8IQ%6=kLMcZb2d9L$6<FpAEu}
zT|S%WE)yHCd)i#vj(N0j0$bbOCfc(yFQPo`!*4nXZXdFc6X{u<8tACJ;?kqi^NuG6
zQr+|(N0crDvq>a4vG=D{ZXE_y(3SW^`s<<+<_gw0+B0|{Pig5gF)OH4#uuDNnkrk5
z#y;X;7joHJl!@QX4ja)MIa-_`7m!0Dc}2U*{B3{#^@q?0pxUid_~^l;oaVu}iy?7k
zaA9*f|BHhe16L`(^m-S(13TUrs#V^cz&9Y!l0vUVJ^I&={VnyO_M+gc!z~YT<>eK8
z$4=$QD;a3PPABZO9DP=Iqb?$o&vdT}@bU&ze>`Rieh9Q1v@biQvhzRpnpeLD6>d;O
ze<ELV)gpH$LO0m{mlF-t7L=)_(W7~gkh7>OX^qZ`9S_j#nJKE%2${WQ)?TM7Vg@B$
z(_WcIoi|@&Snp{iQ4)p-;WF&niXp3{HfounWE~7aDgj2rGV;_re3JY|XJ42Rn!Ht<
z5|c-*_RbNjZi3}^D{(+qd0R>J*yEdpJmxB%xtmUqf6TVf_Suybv2ll#0**6rS&N#*
z-+Bh?OP9U|!rG3L7(~|Fb1T$?Tck%gBe&Y~a1%iIdPiJdLV9$TdM5PhSY`0*(}1ru
zjh~{;EN^t_)s2-}i`w#+4Tw1$MEEexdtxSF)IF+HR8l7`@QVExa|^#PM;jCFf-pvG
zKmwIuYChh=Nwfun#L!vh2`Zv}hWH3Evl}l*PH|0$srNA9e~66uG%|JSHFOyZN=3dQ
zA}f0%^HpcJ`LSU4TO1%mj;UbvU%(RB1Q9%RdB;$eN`eQfuff<<)u?5*Wncis7_l+k
zZd6?|jcLQ?8P6iP*rI#g%q99s{HWGUMW==;a|vDfv-rwbF-I}$Ni%8JapiQzg^%!v
zWdM&@iQdlr(8;Z}WVDDqTMc`(zP(!11vLGx#MBsU6d$>{Edk&lKB7EkD1i2_dyelr
z^0zSl>ks`{;Q!t#?iBA+ieQ`*9RJb!*mD2~wG!Q7tv7#KJggspIX<2ss|o=5R^su>
zlou|4h*dupAviw3mxKujxDrMatvSU#D3mUMlYkT0E&)i+O4RG+f$W)x;>Hy93x5*u
za62I2e+ni(w|#NjbXqq^s0m(AaDuTM5XL?z4OKb!4cbgmFr&#mTesX{D>>y)0?MQS
z0<J`Vd^9~9Uu1mbpX+<gLja^^CHB(X54kiTi@v(`Bbdg;79t>^;oPfwy)PTG|Mzdy
z_JGSC4vU^XvC-&H{%Nn~A^``lBm}Op920Sm*GE77lYj<K!8ccA4kUt}i0F9${%LQo
z2Dxw@e&<}U-|{p%r+ls}$XW+kHOFjTT=FOT@6UAWsFnvfs1-@bx|CqWjW2IT>@~L$
zUYsTu)79Nw-IoR%>ZRBr+zu%l(Id+YE~Cf0tWh1hBG%14-l??Kg7LEaY3Kl~Wh=Bw
zSE+m<k(ARXD!EhAbggp7N)Ng-V#7|0-1BQ2vO;kRxep`b)YA!t-c4Z6#7Y=?T~X(r
zE+uycTzIh@@M4Htik!Jv-U`J!2#l3LZ>|7bsc=fTJuDJb3&(<@bgt^lW`^?pfd{k#
z4!b-cwOSxwoz`n%c7p(q^}E8PDq=0NYJF^L$jXFG{_yoD;x$2lR}8ZOkfKnz&__(w
zoduQ*tRO{Ze&40<;11&?7h68;98@xRaa2|sY8h`X+;{;f&y~1HJA-;cKK!PRhAFrU
zh*ZUWXK>?*^13q}Gv(eDKO3)14uCBxh|!S>n-_5VLR)jiwPgWFz<ufcjLp3N<S?Zv
z88h&Z<BnlRFiCk_=lZv>KBZ1S8N~#3FG4JpuL$GUnH0;9%Au!f#j89gIRMp`cvu0y
zV62^9;aI_ccTcsM^MLbk4h_FT$F$c{YwPq!l^LXI#P3L1dNf&sJf>LaMjyTvx3Zjv
z%w3q)-G|jSHwqwzl>m~*G$|62gKp}%SfaMNBEwSe5n|@P3ddp(+J9WrxISKCgiznz
z(aZ>p&lHkxV;?=yc2|*;u#lv=1;3CC%8Qn1(ayeYJy&Gl$r8;56(j|Yx`Xu6Yq2LH
z@ed@J2Z+rv>T*NsKi%6&!y2-9gq&QfDwAR>RRp@^js{C3dM=!Aji;SmnGr^Bh>Xgu
z5IUG1ew0|_N51Y*lLF}?534v~)lhI@4HZ(NiqDSkQN)*dVF!n-vhYjsQ(B=^zk+7f
zVQ)CLWPfX;p9xramtr^AYMtN5RFc6M1}b9nCy=9FO~J025mp=G@01o}o0brH?=*TD
z<7ffb--CUFiCGn@E->;0l?a09B3|=!>CvCm%(i(%DR|aAl&@T*f;vioZWQEc(~egt
z3QLaLbKq+I{exFoXNzDG<n}Xrc-ZH@Hdr+u^acja2X7rM9PjSpWW$zvYQ0F(a!i1Q
zG8Km!3N=q1FAJL@B@oAHTPm6_rrVdZhzoO60tz5dNfj9?U*rS75<<)hhQ*E9zTHbR
zHb3@)f>{@7uu9&pmin9pbh;e*UU1_maSxB67d_c%tbA4N6y}GgrR;3SE$FaFWrpHR
z_YO(9)#Hk+@fvk+)nkigcR10`XjiNnrA^NC`@T+Q<4D&dAKs+|u(NlTYA9R48<-im
z@xo;MR^(jJzA>+_9O#QfqXjd|Ae;Ad6b~=@yt?k77o=bNkX3qmxBqBt%Mjs49ZTo%
zIobrTi*k4i%`MO-C%wr8g;hgq73t9I2E$U~3Q|M#U6xxg2cVJ%_RaUb?5Y<kq)}|(
ziD{K@d`GaJg<}Q1QaN$rGGN{PP~U}p-*TwHodB)e#PwIpl+;p{R8YM_PZ@YKyVwC5
za@Svoxck^W8F$?CM!KTLw94T{a}y_%Xw;l?umO#Vaiz?Pa<z^bE{<<*fFPY7&Sc&1
zneCa?uum+5Yx`IVyN=~Ihb;5P&+V+K3#`27t?{27nm@TsWQW=%s(*U;vGj0OxLBNR
z?|l%7#{$(Yfx!hP9}OK$6^gv`vP-eOo!b8JF;Nc(81d4cn#%|B|3Kv@(V9hi-%8jG
z;ud;e&QG0MV^V40Qm^QgScI$|tKAUJV*r3wRG<m!%edpq-;7&)%#3;cm@MnO<E;<&
zxwH^fRUYIciM@4$Hd3p4RnumjkXv4;kig`}1dVuvcR^jhzur^KYHr3*@>mH<@N9Dx
zHFGVw_k_0_BM^R9L&|1}Gmj~!FuRWBNH@oQr?gYDkAuo;`xbCnqXclRMptJYUjHLa
zf*6(<(bTrLzU=_LXq7X19D<bd9@`9#@;pYtlRN!Dwa-e-DF|mxW=2f7+F<>JDb~rT
zHuYwa?*MGIqL?>4qoh}hXPj6WHT+BtzTe(wJg<DBQ-8zuhy>jeFD1}<;m7SMei30}
z$~I`%cuv-J99r^e;=?HB#*VFsi!f&IT+z`d3)$=?4?3bdpt8}}EV~)Tx72LOuT2AI
zjoo_*g!N<z;UzhX^NBtkH|Jva{J2uGya~-Jt-S^jmE0JgT&jNy^5fR{OvJ57<usx5
z&~o@y6<z<FJ?FD9Nyi=OyU|TJS@iE8#?#R677LlXMcWgI6X96bO;FP1S6Z<P#&qR+
zhSjitpFxYyX-j=B@wMlxTw;%t3D$37M?Ri@7#+Veu7HwI1*hBuPST#v-eWcf{(!_Q
zVJp9*tDj)z4%wBJ774iuyc>)}N5Y|j1~4HUbE0c-4wzEr-p-Sn5JmS*K8%C~nG+rA
zMdlAZ3&e*k^HZbs*Tks1!xakLw>TJfJJBt{|K8>Y)qp=L$Si6wFFT-GsOs2gp;(s5
zYPTfZOgN-F><{l(VY(Duq`Fp`CHY!BA-FWrz0P1O#sV7DTboNO4V04P=#0RKjZmjW
zvW{P6<?(!l$s~9C#HjzAmOXB}6*%1{!btLW?+sguq^-JC;M){Jhp4Dmqjiw)n+k;?
z^|85<3FgF^Z0sdv8_#`ve~=r>P^TB6I|_Q862N}HT1cYgHq9q0%6-$trKzUGHQ6s6
zU)eX=<lhs1*cs+uOr{h~HeKZDH?~pK^(rT+Dg;c2b2h)ob3Ujl^ore}`UJf2#Q%;j
zzNnCHJNVq`<4G@dgo!|Z7t3!&DJC6CD3(2_VTM)1$Sxh=n(sS!4{7!&Z@<s}edk#&
zXd3ofQwB^lqH>n`^k&+NqK?Nr?s*-9Wa#Zg<*xYSAKFoHyTN&iYXn!W+XvD3-6glO
zD+#nFi_y13!E3A00h^)h1(nW`FRZ~=lrsa2fCQD|g4iM#{Tz$cJ}&Q-Ld$TnnN73m
zQdwq1I7Bs8r-M-4v*R)$K4&_88Z|!DzQd_F5#0n(fBjQkip`}VDA}lyhW376!b8;R
zrOM!UT~yTQ0<wlWf~FL9ij5_Jc#GnUZcL&?U~fe-OH@17|7(2ziJH|(0K#posC984
z!|;{YGfULGLgu5{L|$aN8^v*7rm09a;$#Uj2*$aXFX}?Jnj!x}_IvYAvc+1tsB)RS
zU@^juAt^3Bg+Ps$YOhbbyY!d)wFkvLp~HrnaxwMk7t%3Xb@m-l2%g{9oXBqo;rH@q
zHAN8oHx<!V{KZ}o1g}e5M3*C-95~K6MF?7`2U`?s$RfQMAI{AM|Nc-ZU5}CR@hF41
zCVBQkee*ZbdSk)ID;;@QJ=&fvJ+9ID+-Ih*@`F9g<+;T}zi~e*j}pEOfUh)c(2X7K
z8Y7mdqE0EyrG~RPCQH|>hy<=RCCr7#c*agx$a3`VpDsm=(V8gB<wddFdL7c6I%Gy$
zQ6^<*O&xz!H)w8AIoi5veqk4XLX)k{?+y$JY!*lG5q5*KOX-xaaKabdvRRN21xuLV
z)sx-3(sIsPWg*vAVWe9-ixBzeM+x<+-j$+MISh`g275x?^+%TQ^(I9^$^i)8QD)&x
z6?#JGYQ(Z(A`ue~rpi^ohVC$1{JRQlxYqeI9nL5$0CAMPCh=<ZUzlWprIm~9s%>IT
zV>wI1B287xW+CWhk`1p<^RR8u<ov4{e$2z$*@oqhENv0rkj&e51XQU_*8GIjNmFs9
z?RvL=NC~!T9zaqO=GFxxNtELABRciF;vB1U9kp`L?k-_Sp$xmZjHfDwS`;yFvJ=(l
zSFcf*7LzQM{cRmpa5h{R!|XAstt&jy2XvN8ePyRc?}ZJ0bd+Do2+iuA+Q0yuzK71u
z3GwYS&z^VB(efL54B4*xq56S%iI<NLDb;`(*RVhS)HgUItJiD*RCf!%X*A#uSA)H%
zExntUH`bmlziJ+6=X8}o&z{zLGfkU|yLW7u%hmw>AV#+C1a+692djMHM+$Ga45g5l
zQGwQNa~T8URBFQB%Wjre*7avt(nnvwq@nx|B=_+rMl}1mfRKTKG;fRF)FcKZynhck
zLb6(TypNxwFd6FRpZHCqi2?A#Q~99Rre-KEq3rN;wYXp4SV2cv_wM#gVKq6sAo6ps
zq#VzNMYp^x2vn-1IHUI{JKfslMhP(iuQ-&kr?&kZ`#hl#hkTM_6cP55Dw*Hot&z5K
zoJhMqSxfhu_>+P6m>hy^kK1vZjd{mq0v;HtZ0CIo_ihl(wk_=MAl&e^-|yQIjk|7d
z^W0;6UeqtC>}6U)PQCN!0#l99oF{46v+D<WM}2W<R>&C3m$7@oh`L)NYTWl%fG{*&
zom2X=&&6~y(yvjA>RWuGUp<K55i&n<^8Wl-$c*aa9G?3UrHZIF`{pr)U#u{>8j$bz
zZ?Rqi+>F@3AF#sQ%>G{Un~0gml7<Nn50Rqm+m;1U&ih9e>Idy;t#0>BoY~u=$EChM
z_7@g_xXHN*Y-Y7c3A9N{T_3L1`Dd=8B4FP&LY^_XFm^fC$3+}T_^nc7fBvW|QL;6i
z>Zu+a|6(xj$4TQpzkF@hP3t&?DQ%k|1~jgzX`;kyWN|7@^BDV!CF)-&1wi^P!O=6;
z6}jleK#a-57okP0%`tKgh3#S6)7{7iFT>AW`$$^(Cl;U<-{$BdD=9>Lw<GcnA3F(r
zd_l(G0bvZM;90Nc7=+<<S{=f8|7cj=sNilRJI>9IsG96~`KAUUWZb*F#OLsB3Ow0|
zD7sZg4Hq+bgkUa#my<ZNbR`+3dYd}3Yp~X-4aVS3E#;4leyGSj!|0t`_%K<)UEb?~
zD5pPJXllg-bLNtlZ}t?YC-cYiDa)_jb>~?&$XPo2U*yr_3Q!-!t>UuTOQ}Mun44%t
z7$gAVns-l}GF4A1gRRXk9Ezt#P=~mBI1nLJ9`p~~s!~CS$6tz5B)N}<P<ZKJZ(v6H
z;xGDfPJNlq#s0$XE_B}5W@-K;rE<>5RMO}mD8cNaFWZ1wyLA8eTr&WI2-#VuUNyFi
z#OONF+)fv^$=5{~H-EfYn}6th-}@{6Y`6~l7cZTGw%1dA_@KVW?}KX69}HKh&W)g%
zOO#4pU!?ZGDMu1m3l!uMN}zg-4w<>5w$Sh8W<hjk*Uh+);)Y0fA0z2Pzav3;*`@wL
zhwo51J2}g?cNaGs;yhbOgY9C?xtKDV5*%GeLa48`9+DUwMj*_)Wg?J1h8uGpg&{1N
zXe*@R>jcAI9OV*?@}_QVGp~s0F+l<N6tLLZH@SDQU!Vj5z^t}*8(X)iJJx4@I>KS$
zgLANbIj?6fe5}TMpzLZ#wFRZ(tjX)SaP~b@@-hDIi6djoCLUpl$$<5%|BKV0_C4^f
zN^5^cUUhf*AUDun`JuNZSE}4Rf9BRUWKHpi3CbL{zA&@{+-?mXg58?<05f3*7G7jm
zW&Nb-V8GG^T^nytaE>y6B;AdF0N9f3(vzBFasbIx(t%M<aTAc<5As0+rYBJaq*!d0
zBG^Vp7w*`L{?s&Dzrg%G+pwo}DsP8f_D0%5RepFxhlWT98_p^}^>!i5SgIk=eab)j
z4-O>RD0Z&z9p}JFCR8U;hF$TRseQXi%79bK36%<&F_}Xwc{w>%ocZMc{6mMtN`t1|
zt(y~T#sszC*C(EeSt4Vq-N>E0f(`rg9r1^*2ZD+v#cQCv;=C*TT)`egLSk`gR1N^!
zg;%6sn!RPjvvS##lG8iuWI}qlJcBT1aS8w^Ho$bdTe0e__nOx*OWq}9QdOD}bK_Z6
z-r&Nu8)V2Drqk%{F39)H`M}EgMk&CgP_223gM+SZ_Ot4mnpKb4%jY$N+M9Vf+bFmG
ze8JA^^mK|!AF?h|BzZ0bylqp)q7M1TI^SO3nGsEP)oib(ZXip1qMSWCrcb!jtQD|C
zcYMhZdw?84NB1tik~H`?9Td6_6dsZ<pUzZiw1l36d*n*am&i6+5tTeyqYZ^jV}(4#
z0~510xFuRhg|?J|K|ou9*`YL&+Z8E72vR~m12?+4-EB-Ch4pngO`Jx$JW}R}=C>MA
z9)o}i+Rwrz>sOf7RNL?~tM*|0nLOzegVNE~e7cC%hj$ym-FJCCcq;wL@)())kIRIV
z_%5`javIn=l?@)A;#DW#HSuzm4%!VejBmWQ$n|ST(UJTDHTY+Q5CN8V=v+8Ba-W$E
zxhSdq@Ho4@!w`AniTYfTf-|e@>?@Bq^VbY(?m>Pq?iCetqx_7rMH4Qbx5qzBrY-H`
zm8GqBsaNvu7|jSBZ`UWQ)E7z`S}CVPzNfg3%*7yORSHA4{|34%c7nY8#ItCDQayQ4
zEu~)(_B;ExkV$qW+H+js>Xs`^O0Y4B_`lh$+D&M}f1WCZml$MlvRo4$-VR~EO%HZf
zb)x+EFB13^xGWQ!0Cxt$25Q4L6t9~s+mgS@87!{e(V<>bH!{>!?X~7NnDoY7afIit
zs3S0R1vwj8iDScV;!PNp-KKD?pCuMRD`q(vh2K^ASn69-!mA?^9*>*k>#-%wHW>B#
zu6y55qN3e2iTFLBt39|cC!>upR>HQ@u{85ou;G*V!QX9a`tfCP@N~cew{IRxmkL=d
zWLKbbf1Er-sq&udCWA7qS#P-p_R~ebUpKKZsGM9fR+(w6s$a)q`UcNZb+1&N+<N?9
z2Hp3^2po7=UB{LPH^bwog@c(&Alcv*^}$BZlEy%ej^-ou;m6UZH>$3O+#%<pro=?e
z$29rv$0yTrJHS#rJsb#iN#1ScuFpvAaFlI`2@S!fghdu3%=QG*=aKqtlW=iv(_1l)
z82#|1OHubsP~)?F7Sb5&hZyK5EYN4IEgaNV4^++1@?GMp19PfoZ1@uuJ0f*C?`Nti
zcqvG6P|g|Vx!Fto#dT`yLZwA|=jRjW5WHqx%X{<XdyZ6cmXY*|`Joz<>k2=A-3Xcs
zY<y95OKxydf1jA8o<Bw!?>N(3dZP%#JjyxdJ<~0B=OZ{t*FwEe`a;5-%bExldN#X7
zgHj?|zh9Kvs6#WobO5?amh*rFbSnIGe!WMdzrE@yvMRYqJ4YB_tWSjuJ0+bxSSBBY
zpNw6i!n7IQghHz!{HQX8CPo-(yU+d|hYU2VaK&3D%d29oOph2nQq#4-e002+^m+a=
z^CiczfBp@4;Tf7pFpnbo1L&%2!{k+dLZD&gJeX^Zmq!tEHk!!r+W?tOl}ayufBNg!
zKKNW&5UOu=A?Ip%LN-fo#8%ts-CH>G-aYENowF`WI6f0seN~;3M!KtL|He3}xgwQ~
zvCk5|8@rswca{!)Bl^3M-?7!N+J9nrzK`|q-oD&(EEZf}bGmFq48eBFg3<1;a+!_K
zR4J=}K2m{t!A=>P7z@mJNYHuW!|3r@K>S`5(e4UQ+ys?ZUDb233dYu6yvM{zi`azS
zHYk~QiVg`BI79q+c?5r$SmnXduc^}{rgSL$Et;W+H(53PST`3m8E<?gbx`PzJfh6Y
zKXQME)Yq@9<_~U++xC_korpa7R`mPv&ELmj(sbN5Q)5fJ9I$>a^a!yy5BEK_X{6LB
zl<T7s$tM<2$tWbMTAR~Ocp2tO3V$BaUYDlvJ|JX5!QG5swC)Nitc6IWQvz8FV^fWR
z08E~E{6pH_-Mru%FZomSkhv-h<F_&X(ba>2;=Cr^G6CNbnFCJ2!*Al;gUqq>@7&8)
zf0-Hm;x~ec4_YcRUamZO*dyweoo<^IRhU0Wj}t(y$HVZdcO(r9mZM?)3}ugv{h^hk
zK3CamkQ|}aNhs60;!0b?=Dn}IA3V!?upmAdj{y~j$cWCf=qmZ8ZX3RX>3-r=%f0Bh
zgOi~CvhbZ?TEm91Z<*FmooWDpzj%p9CYZ|Ti*VkWU`#S<vqBNmRe0e2tRIO`gzuja
zEuPNQ7DwcOz}P;U%Cs@T6!0opGdia0`#K{8)h+`W@*SOfkaDL4nD?c90d&SVXLx<$
zt;k-h&s_9#5*`bxA^Z{DSK?Bp1q1(9T2VL&hK(E<>pf=*_i!^Cd67F%)i{i+`2$d?
z8r3;smK-!PSb``uMyZ}?b<|bW&dDgGf)r`Yb?)9Gcrd<?P7+_Y#o|O@WTunxf*j}z
zzqXc$Cxjj@mp9ZJwr*GaWD__3bnwI=aiYp6nCX<WRGSET9WpO`Erb9ju=)Vdr2vR<
z>8!YmUJ^P&IX#R&Xbwt~f*9<;&+dUHB&?@S@J#3BH7^CZJ0m)B)HP~{4btU_ub$Jg
z$D6qtf|=BTy^Ow7&;5_gwT~HML9gf=*b&2WlBIe2rv`bCpVrLjTwCHmMB|bL9>~pR
zZ6D5|Q^$VN|GKvv>ah8*nhE6AfdGRpuV<5jcD0_Ru&n@96)gJFWNj2YF6&&-`-?tM
zYxwih?i^Gz=-<<?&7yIi=R8NkwNd-@DNN$lv*~WcCfba3rNQj}7I&LPL0sogct8LV
zdXB);s&F4mZjRgI1GLsGBB$?DKHmIUHDV5dDHDop01JA3Lk1WTu~esj83hyi7}(#P
zuL432N)NOkay+P8mxjG>L_qXA8_&S8N-uhZM4;H7VN<BbcwV=eLJ>*{)@2E52LVlT
z#kk-C*)r?&B$t{#1m?h0A7RYSP|a7IViJb|nU1v;rjo&YcDTfh?<fxxoIBuoFFr|O
z7ydX%p^C&E^gO^8_;Zjw>};sfzcl5igHl=0=!^8qNhgQ5xQ7>sdcg?x;rY1x@3Hp>
z(}F4Ck!^0=U!XsX@3rr1P_r+~V8hty&9E08aLh!2uHF0G%<oi5rqID`;a^pFzcGoM
z`eIwq<b(pA24jX$|1bb6I!~wgp5exEaYMu>3{Be!js41Vv)Zm3FJb3n*ctZ{|2F)`
z6RX+U+;;iGwJ#w%_zbr0(gtr?P2Asq{?8v=1)EsPsRzo>Zu8hBy+i70LQAjMiz=mP
zP{cE^6yU^TJ)8H$%3)~J<~Lf@nF*FuJo4l)Q2LM&x4rzBIq2OaBy6;xZ42$dkA`9q
zrDnUE&9A`?73D~Ej&fs;7$)%wVVma&QlRwR`4#6AqFKLS{l@O4@Bd74x@0^S-sr39
zd=xDGz*~cX2P$V@lOq<w{(0KJU*`f~VsXp+&T&I$&cP%~!&avQG~00(z1NVDjx1N2
zYJJ%LbkMiqQ<%8w%8dg1HD!}$0?D?{W;9}uJkv-#t?}X(v{k+K+-?^=91%?DQ9sS9
zLpExWGK8{;39WtY+0&V`o}(qLY^xk}_TE0RQ<Vl&r#3Cf?HNO8`7R+YI}El73#lT#
z1$E!ieI~+xA8ebNf2c8t2HMC9o=J3ndLch(N@3M!SN$x3ZW{+8ar>KkvwZ(*nb2yX
zBTxmS4{|SF1Mm7N<a^0uSj?PV+_GVB>l_LrBk@Y;GTxrd!9;so+R&1vF5pT>M*|r@
zvYiM%JEq;{oL=YH-(R?Ez)*S75ta!JCXbbiHxyc=Ryiyyr!kD{O$psrU=yCB$p$j}
z_tq-L%tdahPRQ~S@!c3Rh6fhBH3XWXK51XI??UtQHUG>l`0Cf0*)($m$>8Ky?}Z<H
z{Y|!l)}5d?De3lNJVI?9>8hjQ8r(+!oWB4-r{J64^r_{j|CNxOjfN(1NRaL5<$NeK
z*7-A?I0AqqzrphcKGE}Ydf5Sbt+~JvdKx=;#4yN;QyNp&D&n0AKzjE9M$NhlMVR>N
zKm1=|=N164Js`R@uQ@>PieSu8(5MdxFO%_OGmV9%N@n2DGT8uJ6VVe$jrjUq|M8x-
zf@2wM{(i(5q1N=K&O3NCI{72;Edb!Y<i}OaeE;#+|JPyuI&e5BWp9SVMc}e;jj;12
z40I$c&Dg~djERB+_?OnZzBZlDEYV;8>WeRLhJvl-+c!=vYt&u_t9cVtDR_UAwJ!a;
z!6W$D6_=KMxoZ9|U-}cJ6@CIQw!6ll{sU)Qp8&s={BiIRQzpdi^^IE}?`8$=CQ>?A
zAo90owt5YEW6whMgDQ<vn$%C<`sdf<<PZQ#6|;9&%%!rphmp}poj7ZEZh9X8>RkmW
zuv|RyGdIrX=>1ib0?(Gn0g0^v0*|0m(SUaT6wLkOag5G_%JQByQ$b593U-4t%_(Ca
zA)L=U1@OfT{MDPE+WnrJg%ZWfW^)C$yl*jAW70Yuz?i>AQ;$aQwt|)gU*9exYzggT
zg~u-fRN{E0028>7)ZO*zpNU!b3&P_^dnA_|LAI1N5SY5*>rdt(1io5xktkxuYMTcY
zpJd}+H-HJ^NMJCaL4+enf^d>67iKkC$>n@Okr%0%dT*Q$kZq$qe4czofM=2fOL)Y0
z_KYP0!+*WcJxS1?&79mvHAPpYCkGB|q3S%^{BS(g<T#yF8&Bt8)1>s?%I1dP)a=>v
zV>ao@U{KasrvF(@76~_bxId|qRNOm}Mp2Yu8q&f3yu>>J2AcY#5`_;uV?9N(S%l?x
zLFzgz2Lqd_#RXc9TSAVH=A_$fx_aF3r6ZVLmHOG`;Sw!|*vQzn$3Ef}It2Q<2pqsl
z9V&sTe75*@^UirPJ%lTQ12z0RyLu3aL;qxs{~=cB3=jqJA3ffc6Cnhay~CiRt@?|X
zQxCRX>7ME<Qg70M9QV0p2o0B6-I_blQ^}Ehbg3pTmF_Qd;_b99Z@Td9vdogSC09%3
zRXpdRY&c>_Hrai%rqeR?2`VaE%e|=?tKb<JWRDsA<pu#oBv2gq=5AEb#h2b{jm}EF
zSGm;SNhXaab6jcR=01fcj68qshv=C-zAT$4P;yCAz14;vnhsK>zf2zmdEF#UTkX#{
zOE0wHV@(a*QLBo1r#a~IE&I0)pE30(e%WRoE66mjPm1#H;cbN$@5eLgJFmEgUqD+q
zOS7edG!A1esa@09`;HbBg%!p+(yJM>PM93D6{I1SRJlY;emDdbA}>JKyRl95{y2P{
zx*YUsOz2Wul@Kao+-COZQbR5%O9eWk+wAj$-(Xd>XK(p2H$r_26;tK+j7fmZ1(Jbu
z{WYMi$Is@y-)Vue8j~|~|8zjH$JL2*HWl4lwmTIL+KZ(te)8Zxm+xw8;Oa(%-5k$P
z+Sc82(SWG;8$@es{1`)>%2Qoiqkkg@5*B;i1)?o!h(E`=|G}BJNVAsOO+0GYqe_6Y
zV*Anc_lp`-9K8oy)2B0CSwjsxeM2IbdQ7$n!Sk+&%YA6;J93H`f*?Jddvmr{pONo;
zuIb@iD}VYiSm28DR<}7oyisjmpQz)DQg=6_br;KP(FNEeu4C^*bebe?$XSO?)n&yY
zGYWn=K&%-d&uZB;&++y$&SL#?RCA4f{#zyY|FCYNj8C;tHVmR*%#wA^Y`ppP1Xrj!
zxHDy&Q7dV{u2^U<)W`6{wMOGLc#L#~3iHt(N7u?^CgenH2PPs+)nK<O>D?l^h*RDh
z%o-EzL2XEHixxU*-?^N{PGCK9y@AgaYx_Ch`0zA7_*iYm;oTZ9f56C~TV3<rt%ma%
zx&Ap}0Vehi$*AbmdnMB>d}U#=n91moXhHwuV0w9RMg^goU1X0#dGAm5jKK`H^l=Hv
z?fQYz=<ckAyyh+i&u(3NSNDw6R`=-IDgz66zNlmp=fFkF&y<rFWHG<lnkPk8m;|X5
zOa)Sx{q@IQ75W{}U29C*)|jM^cW%*DS=#`~Vo056R7~jzJJt~U;VN}Ew0^(xE(jtv
z*k?xDu0t`UZCaHTqu`{x&9deX8aK|q&8R*BP0CS=t=yiRf{I0}FrQ_GS?cVY>N;Sf
zoTX79A5Y(%nq7%j8GCfMSpE@>VrsU##C&$YnGR_0)QN4L>hhB1O?Qk}0v5JpbpdJY
zVMpW&tmNR%cEV@3GTeFkdWq0&_TqS9NQofcHFj$Z{p`;_*ZBRdhrx{66B4}5aj=^)
zkTbE#qBmsi`V|MrKC7-Z=Gwa`z33JFUT&$${sv*hw<u+Gr{jEKH@(%`G-rQnu_IQE
zCv`tTCrvl?o~Zf$z5S?SlbR-duF0%(6FM+x#HQY2mK7+&pw-lM=TrzM-kDvX&BXZN
z?XR-w!C?4?wd$NRH3q}enz9hQTZbt<2t}*%87F%NOz?tTfou|sKjTDO@jrvU<TCbX
zIy<QUwM~WBNb4{rp-ugh`2OQ|PXWJ@*54YJx9Z%YTr?&TN)~ODJ<&C*gUG?7X4f4h
zM(yWVQ;qm#H<HO0Z$Y>Bb-GbcKUEnZkJ|(*P2>qfKrugK&jmM~=(eKZVNQbT(pi3e
zqkcYXcD}WF+F=|dbGf;)hCNxKgK<N+aA#><a<Gp!dsDj)t9Ybhy08Lf=414#v|?sm
zGTw2xq}AGrX4yw;FP2NcHep^^yxYyCfmhkgB!Fzq<4R{0wNDz;;Jed)C5tkt#@v4a
zql^K(U6SVMClx~?>9E?n2u|+~(Bzl1WDPm7Rk*PzT6`+Nk}moPe!oDzF`jcw_-qyN
zfWfQ$9Cti-TF`fy6`P=N)j9AfTzO;9mZ901#|sw9=7^@=8MPmtCVX%=wdmU^*|b2^
zEBBY*>3Jmcl)I)oK(;iE82FFpH|nrtnN2}H>u%<|H{!y{Om+9b25`GQCLE6FF}I>$
zl6*U?gRVu%RiR8%5z!=mZ$-2^h==D8xqY9U?a#I8KYf}Dz-tp9_#RYp?_W}G>`I~u
znL)1_9#>jTnq^{g46u3f@49^#?>DQg^F_O&FH(e*c~pbr%0q@%i;-1g;x}jClp%O-
zqb6<F?!vh$(>;i#*Ma)=X50eVEU`Okb;!1bH$2GOt-XV$QAk~%Tah$YnlWqW&DdS%
z)B94%sL<YmIL^Z*-hpCuSWZ=?&y>ZeEp0JIF;I)Z9?>VKD@;cA8SPW~%m@4z>9Xww
zS|ehUm^wS)CX%dRUsFI%7Lqi$U+A9NNm!77@d^<U*+yDC#!F;682nlwe?7kWO;JY9
zVXeJ)DqE0ZpgzH|2)xw~XG$kQCSqlWu14pUPmGzMgD}$XVoN8GnRn%RZku1nDn6+w
znL+J2MHdr>tVuT>PC!KG8YdUeI9$D|gD%d_o_3~rKkx~69pM!fmDRH<W`b4a?IwUK
z$Czb-#qpnu%-=@gvmZjCAYA^~U(>n6+TggN9a%`6rVCM!wCdh9-E)i%`8BN<vHl>m
z2rf=rY8or&gRW0kRv`7XZt<<t4Z$?iY;y3Pz@}aY6RuXBBr0a|a0ykliGUui5c)OZ
zu6znzf|pux*Bx(`uL}wv^sRJ8(B#z#+Dv&?Ru61hiK5RlS){G*yX$OOLhLQJ+67F2
z@9=xaKz*b<3q@RR&5`(-Rq0<rU=O4=fklZcc^m`bA4cMA@qf0wJPq|0v^tcrZ_gzC
zgCW04A&)=6<KDP5w#g-4o&%yWLDP)^0P_z*D-u;)KS}bx(YLxxkSp7Jx>epz9W)gT
zSB|{@3k&dP1J5(?EpPgcG421%X#GEdZ>=lr+|jON!!Y=>119#8pa~#A6V>(U1X~Y!
z2rPUhC`mJinSui4^y;#Km`{J<^P75zfeU^l(DT3Bx;_%fvuFRlb$=f!6t>apR;0LJ
z|7($~6gKy3%fbOM?|=wxXZt0ya}7c9Ah9bTm${3;`I`9IEaKDuDwciR3_E{y1Jd^E
zXL^nVL`hx$`?P`i-;F+Hf*_AFmreb<K63E*Bf*)n4XwPiK2;4q*EiLtLD$8JZ0~i2
zjd2U-|LnL*6*T0$qMajtrlJ%q9!VQ&l`3xdm(OH?jEp?&{u7&;Yl5g>(EHSR5zsw7
z*ao%u=?b$_EjuJDdE<-?bCk7CpVFA0M*^XT1R1}tkVyQkY+lMI88t5fB=Q?TbZUQ{
z$IJ=f8t2!Z;U1RxyBQ4u+=TKTO>6B>v4@B28id_tX{b0&X5Z)G>}Q9T1XD?#77`xC
zE-2ajdAsNBAgt`831>k+`AH!4Lja9Tk5_$8-%sKbDwvl1H7;uB{X+Wmm4oM`Jc1X-
z#}}g(+Y5)Te*J1{zx>Oqtytv$7f1j9Bl7>BiTNja`ouPZ*9rCh7j_-1l<o}tI?X?S
z)#^yW#s-&c>8B2rjd6b}O_@SLN7l3t_4zl9UlBMh)-DInfc>N&FAumXD--<tl^CM0
ziAeH$R)O6ou~obNG1LALRTKx(3?MPN;eEKtzsRtspq2Y8GEDOHb>03+96ApI84ebJ
zM4yLOjve}2|NY|!86!}ZIrsmld+VquyY7Ej2}KYAL0UjmLXi*&$+18M0gFzNkRDpn
zu}DF0B$QNCKw6ZL8l*&8kj_B_=^lpsoeP{0#QT2Mdfz|3%e7pym}}12XUAvnv(G;J
zGS@kEY}%+`eTn)Bknv@+=<LVaz0G@Ie5ly{NeBW9AOHho%5S~_uP8d*S!U4$#>I)n
zmC6COE%=Wl+rntPwN!EmSfX+mjFn<mSA<_Op&r?M*}{%_yRWiH;+TL~CSOC|yzY}W
zqJPvV)+Zq271Q+buI7(QxAohi$ScrYO>e6wl=#*i$WNpnKb267zZ=_vMYdb8sK0A+
zhzU=RA?+YJxD+?vV%+LXxE>t0)5NymPnVT`B)%U!vVsCEOqq=o&wbn^&<8~*M*4$l
z$8`lt5LCV+BoNb;CME+;-{VsD%i~q{|Du@@()=4&nvMaDZ-o8hv8xhy9as%G`_#o0
z_3<s#lyCrUsO$e9JdaF$`>kSv4Ix2{`kO40v_M3VfH<_gHw0vX*Y9(uK)Le&VFU6f
zD|UOC)$s7rR<q)<Ry_-uEjY=(QbEP0X?91x@O~v0?cxz<nve%Q7w%c>-X1I~pSDAv
zX_j%UEv{Yq0v$;|IjUDM*}GN(0M*y&d$2)al{R!{097On7X&u`2bkW5I7rRNz_lW#
zx5!S#di+&i$LSl`=%f+YTF;AAS#<DP`4>p%_RzOd;|+sPy9dfRyEiX4*HqTVjpZ)<
zeBh*k#y@~xB?nADhp4!?q;RnZ?XmoYy?Z|S^$zD5g=~<%hXNt6X7QVp-}P*=r#?UG
zo*&&=xNNS*mN$9%D6If`k9sYB%p@HUWw}kJ#w5AxFDU<+zh2Oi3ef4}OR;Aj+DB-e
z$Ik)+Nid7)Lr^jEdbn`OHBe?&L9M{8uXyc@bxbA~Q?#VL#J=>aK_7<N$+L!_C=a;+
zA<Zy*Fb(0_@KhiXBoDoOXajNvdd;J?{~*u&K#zfF(5Y!Kr0Eu3yCcFtoF?v>=X_)L
zLk0Y3gnB+rcJo}`IvhOxHst|IvQ|=)VnU<W4zn>PAICig+sZxAMdQm0Yh}H97{7tl
zvB#(O575(L6&tilP$$MPu-X>Rtd+~yuHH04-5yi@KyYmyxd^Rryt`8J&)5#re~hdx
zF2QhT(ehY5^r5|bf$;|?T~M%3A*c{6m@)BO4prDaF&L!(?AJzVyNFFZ^JjLgewkZW
z!^F{Q{Zv`DwGPnTiKSD`G3_FfgqR%zIhM@haEc0rKRN_z#v^Gb71zZEYD>W_ad0LY
z^|)%yek87`l;3_(g14W;zwD<AIzQ9B{k_Z@bicP_4_-`IGN(GM7{LKwIp^(kuLK<3
zkE@T$;~9?>fIO2YoGKNsc)tl8X@jU_FbDw$fX|Q8b}v5&XTLac_&}H|o5v5eF-Q_A
zhZL8<q$@RstNqdZLM5@vpN#N!^}?*D+ilcS>apxcP*RF2_*ullzK@H|<BXXy!LrMC
zt+_|3n!2t(%VNR~aoGSxa&zy~3fX@5__Tm&a$hWnf(_<dL<d9XVvEyC{kgFD7cA`7
zUOv<EnyOqYnCdtaf)N`bZ#As-jp#RE#H}~tEpid`8Z6>W+`Bpw{e9&%=;B{0+Zri2
zS==mxscVj2{PNFfsRhn!Zy+;X>!`u{cE`FZsI3f^$=0yz^y}H42f|m@cqWd%Ix0B%
z8gPz(#mHMBls|fiG9FIg+yvv0nEs56X~`*Jlf*WB9E5YiP;lBn<E$4pf1^K7pkqm8
z7p><Hg=SC8mwRF|ZM$jpFnuhA4)I994bUfg9bDG9A-fdBF7;G4^UIf#96d8H9|59L
z6EWE^*%lWlQUhnR5@Ky~_#;@nIuP0+;G4P+pzyxtJKJ-o`Q1SQxBG-^VN{yp3h($*
zP?rMv)Sw@s@_RF9qwB|)raRdCWqzUpQvs^gF9|iRRUiZdbqqYLnD>vCVdo*j1#TgU
zC?uwIsN}GsHc{!W!tVp9=s}N(GWm=zx+_1&l0Jqa6;*pB&+3<-BrU~CA|CO&5m~tG
zSBNQ`mRD6{%b8>W6=MvmBNMHy`$PHrS1R$j{Vf*^(3^>99Auc3twGMDQ!g9yVlP(#
zRIv5>z7K5(cz4Ga_RjfoRc`tpnis<qWE)@pQiGQ}JO<KNr<7^AY5)KPrtpu2t}kCz
z<Jmk)&wal2O9?1}_u~M~5RY5ko4vb%(|?K@IEcV6pa!Zl4}8{c+F;^xGlq0`(XNK4
zE(h-1L(>6QLI`2SZq`#LGO?zk=N^lD-kb&Ag~tH3M5DTE??7P2MWB-!Io%7bZ%b6U
z9NCrr!U618X@@{i7XGPZSMg1U{JmUCDqM-<hoyqP&95uG*PdzdLKq(V(rTGM7uMK}
z$97`|K*7Vx;1RS!H0JB99>C7&RGIJcVa^xO1q%cKyd?|j_I{TA;O=p9b;i-o0k!7+
z_j1)7ab;MwM?)z14GrER@u>tzp{vcrxiY8mSE>qhX93qff@MEW1`2#Cfv$WQT}Ryq
zP@oPV@Vbv!l48e4hUx!uXXOskfRz7JNw_Mv5)bI?34kYr*8ufSVsb4?;Xlw4OGRXi
zN4XSpj@2V)n%|aSViP+Abe8<~;3Af40KKM1J@aPAY7MNHBJj02Tdp2<2c{Jxrl<|(
z4$Dqba;s&C#+(JP6fAI*j$1urcp_kqlmPlc=%luS!W8CCm5X^K<{z0{yYx}%{?(+w
zemS)AZOJa$?zO9Y6@^QWW!n}s9?#n@%2g2_u9NxGtd$0LJFI?~o|=a4p14#^&f$+T
ze>Yebk}e%yfy5udJ(Z<qE|86^iD+)<SI`sXmFoU3Nhw1A5|OCa?s@U7I|N!%$(%h9
zn6hfM;(Y`yn?v=bu<5bqhZi|V;Jau;uY<xwu?`m(f>V7&1+*vhlf4nq@sb!HM&KYD
z`ha|ZtX*jx1wcE+9!2YR3;1gP3Nu#?hw&S;`Ce9TQi-&BB)2>=CE!G&xw|J!wP5%t
zN&Ffmc;DYr&kGWt@I+uJiO-?`Q>WzBHG;G6``GCP%Qm?<T}O3Tw-P!?6)1I;VqRZQ
z;9Ll4>d^sS^FXK^XxQsZ>w6(AJ6{5>+IKXOmK&5CU%D&mMUD|q1#A(IWOiP=mN~pS
z-!0%V)zJ}M(-CfN=kCqy{9V~|qPk;Xw@z^Oey#$0$2o9g_^`nZCqfr_4RUDH-L{D=
zO~_S)agQ^7Uus<ufj5i!N$y_we1(jnqJWIV%uU`Sh(RIUyjj<rWYQ?s=|!%EL9TOh
zi9yif%L6}eHxy{`&{-*Jk+}!o*lSwhf2?$mEt$Qm0IAsfpU1LpQB)p#{dn%-a31++
zO+V95Zub3=PvpKXo%EEUFp+1jj+mB=p01j&uXpm;szT-!)AWtGJa`6epmB$*`S646
z2q*0(Nm5@BC0QM`$?%Q|v?LEpKo~c}?mv`Woh>gOW(j{?X;L_4!=v6Y!aTw3<i>EB
zSZ^V=a7C4TuY5Eu`zzl>;j`=~CX+x!!)!?qNxb1v0qq%3L&?5>wl7V7o57KiTMto3
ztz{PmKV)U<dT+a=-6csRqBbtIWKT{P{zARQoW?+)-NLc6l&=IsJ;~7RK7P-saQ5c>
zqwytYM!f+~`oMihtQ@7C^Cb(W-y)m}Fn!%QbEV08IUgq{gzE>+77CN^?e1E*Idf{V
z_wAq`s#q1i&ucKatoEYRiKFmJ7Ry|GIIpisWMptdm{wV#*@aNU@Fo{?H6n7ptZaDz
zb=IE5@Jg6CkuXh!&$en)xq^1BXn&1`DFlkFbEz!XGiT+4^~xakH2G3XfXy>zQ)9~S
zCI<s1CTcxa{CYi?26h&sJiAv`lphL7!b$x4RHaX3u(7I@JLrl`gcqW}tIh~d9!SXN
zm~6kNTzZ}9hAOK5I&)W>OYcIcsO%N`LjfziDRXr~N7MHZ8YnNt(+56rdAkzvSyVjj
zAb<&>@Q;iXC-pt3$XfI)EYg|oRStNqCW-l#7;znPDI#&Tf;5aTEWM{W@2*~EL!PFB
z@LqZGdHL0uh8rI9Nc8HGwQP5Ig81prW-o7x^oB{i$w)yAYQ6Nla0*4o6(GY+>Lbto
z#sz5Ayv=p;z2U*x{rf?m4jc)B@`!hW>Cb!yoVQv0StmxRy(?{~LT`xX&(6A<$O+R1
zK8qA5DvgC*;#XnKK<jAlkEr$XwO&PYdrA#Y1kO@Gs`?Gt?m4d(tMSnAP49)fCA=D}
z2-Jx)Yq~=0P@nYCMrwbpMibHi+^n&da`_pY)wOt5<~%EV+C^}kz3%$QmuF^_jSpMN
zH(LncQH}3(44-12H@t=G&r#6{Eq!Z86dg~1O%)Hv^upY<(6lZINSxCOPxTX*(!6J?
z?m$0C)~oUIF?1}<*3Q=OeSkD(BFY#u{-##N$9f87?KV)(%PloInpL<Ol+W?*qp7Nn
zcvQdupBcwOkXHA6Vrsw1K_%h6dim264fWk6NhLIg0uqm(T@~gBw14sygmYJh^c8DJ
zDrB(8yAp0AI7uD39x%Gcz@HSS5!xexN}Ik!TFoD>oU2xn0*ozsUa#n$l_m3xsFbGQ
z0s@u&=#CN}O%u%#`W@lt7^@`0ud9K%`%Pq5OG^%*mWZ!1o-`I$WvPBkS>7-ip-OpH
zcCVUp_SA!FwJXv8xP)eZJ+1LrT;{C9vO+k!k09I)d8GQho4zW_<P_>Pm!t2T&!6#t
zfIe_Of+5;z%pLG-4j9>8VVW2pj!PtFoa(d)lsNzje}y{(fXihSUOoqt>|Qh%vi9zO
zaRZTdi}X`coW=*b?LB0B<vHeGt-8-rt=xFO#{gyg?P2rBzLUw!pS`@VM*nlSB$gVo
zt=CLGv4u>tCv#7svQM9xImN5UDt+bo6Xz2wEnP_^`%j^MpsVH{|2w^PHxVWowDN*n
z{H>8xbaB*|gjBRe&%nv)28tzUjs!g0X7~mruw1X_X|CDJF-&vfD)DS8LIB*J+)2X~
z0Gqh5y7<Fs)ryX5Wwv|SPMCHTzHI(!xJ@WRj`D0Fjk~-D7iv)cinn;R9IF9fK$Z-X
z!i-2M2b`QXPQz!~09B*=SbTwJm2gvw4IOdThy4(rg{&DVfj=ALYp0-P09=gsIV^i-
zl1IhOe7N)-lkZgk21-&^sqXM$HPoD#=Xk|2VR{PxO9usw_s^!po)89?67vINn_u*)
zJzze+9hH6L^nLHEwNDlv-*`O#1@QEow|L5Xm53+eGB5}A$Ibv|XD-E-CY8)u-Fx&O
zjxAvvyA*+4Y4|Fb@DxDsWLx&Y*RKdgHvh`#gn7?swc0^_)(o<;sTwiQB}p35OhFam
z>QqG7v-xQ~Pq(i=KJppN<q|UJZ{@Pr1gcXR%3Fj2WDdAIRQKrXEYw!cpo%NteBjk5
zO6uJwD$4=~PRu*oLJnnr{oy+%ANf<Ld<`E`pQ{Id{+H|MF-$~~2o#@IKup!bLcZ`%
z+b%KDF<A!0bGj5C7@SY7%VVbA+}bk#u`!QQD0$#xC2a{ed(4D@#j>qTRS*^Cy9uSD
zUb+8WUh4028iUVC{mPn<Wj_k#8RsEm^8xmFHef(6KObXe_{f$WnHJbZ(WXgUFZ;^9
z7EO*R;3V~KupE-T0)!tl-_sDU*Gjopo}E@f`?kSLCLi?O5+ULA)!)o&E3G)8q>uim
zla|D{Z>k#un|!TxPw$JDuU`h8{A2D1E+|n_ci#gX-Lgx&iFaH|MUat{$pqX*WQloF
z8}vXxR=$UJwa0qJf$mU2W;$m4R^+9u49_n1M%Zo2@2>vy5(@#vr%URy&U%Z>Fb2yU
z+LwRH&1Ps2V)qRLRM~8iBR-A2wXJcGI2v=0?GBYFC!;I3@VI4MNJbY(u`lkK?^R?R
z<I;r#hNlvyV(1w7A0;8$!&BwL#6#GZ8<e^C(3LBeMK6CTuAfe^wkT*gA5JMUp8Xc#
zM)^wSMUtoY;uX&)DFKg-IRmJ~^QW3zqq8$5S>QtFBTj=3yw42?BATsPDM>_2>TB3k
zK-T$+$+x`b3S>*!5zfyO#P3S;eh)e=3lBdH`zhKPS`es3K`c^N#hmTvI!(o?xP(cS
zWn1Yhl#)KKvQ)b|H{H7y<2cuRXb+cFVW>``DE|h3#QYgeoWS+f9UdOisO3*oVofEp
z&s~0oz3+6%<f-^U0}`JPg#_X6wd?w?n?2Lsi88+FKb`8C^VU#=|If=XeS>^~Kq<7&
zwUW`s!Qe92SbHO~Z#q|9V-;TAXL6*Ag1&Ha@O3^?nO{HR6O5M?sHuuCsb6_b3LUl<
zK&}}%TFnlYz53mCRd6YAbt&e=wWZPV)tlCGD07zZRkn-}(YC`3A@8HRh}*P@6J&Y1
z#%A}{tBvs2o4?ZVj-{%oJ<IBT(QVsXMozX_k^1ft{^4PC&COPulPQgLK1W6UL$dGQ
z`%RAp*+C=$UrIS1o!n0TX9rE)Lc>EzSH5eQtgWLZdsUkcqXK{4D{xw(R0S@i&MHhA
zU`*kURQC9RI{n#M;1FHLZcWB`gj^Ghe5Y<<K4y_ug*8iPaYC$My04dg<!5(5!ODml
z+n$En2LF;ShCH#i2>K?N%!#~q`BzNdf#fuyq&{dD=2JJM@t5MZ6Ybl}LqV%%>ilqv
zt@g3K&h$J1Oqh2T;KnMiN`&!v<xXG25R^J+($(Gj;#z&Di%?-gf_G(O59<WDi7}pd
zu2I(<n<nBHS$ERwhom;<(~qMxbV@IJQI=J5OH<}lU5evOW-l=!y^NA&7%KMB2M=Rq
zTSnQxUZ;Lpcs_$#zLrMq;(1{jWoAyc>ZuRbqNuRo7XOlCL++#aYqp3lWFU;}bF(no
zVah?ERRo)=x+92A>gut>1sN76`4@F|(=nLv2EgDz-K{F`mSSw+Li!PRPgxZ%!guU$
zyF$#%7-p55cn_`Cv?I0^!0z3$uA_NuZBs63(O%6i<a-8+i{(kZW5q78-+68!dgByI
z)gjLjkH4@|k}u$W=PWP(eE;AMjDj?(`U<P?TyWKuJcg><?u!_*;a3{I>!eh%GAi7^
z!?(K;mTS&IN)o&0%K0?saF38NHQ~_|rt-r4a@kobp+y^y9VirEiTnfaKH@8rrxFG&
zCE$l2=D&W>8KpyTq7!p`eUG5_V}g<FkD8}>>@h{l?odwqAY<N|+G`P~OZ$wE)_D0H
zoVcoeg(u!Q{PY<sr%%nS;wSQVprm7dE}E|91$+ZYN#}ZJ#y#ESvmWVz)dO$b?ug6u
zJaq}0FLvdt&tl!n34*`*Ktgn+*awtLz#b;LRR)Qii1vZ+Ref%qD^i{G#WK9w5mwVh
zF-y&*+n$V5?MQznc<VG}$*|0*{K~L>w3b84j^}#B7|&Hdy*Q5-Nzv!?<;bbWXE_1J
z>@+z@e~ABtdjUZjLSG0l0yV$iL?|}>`k%ptLxtalLq*E!4a)7YiM27ZIV-w$rw3~I
zoyz0IOqr59h+oNi#IlIW$bq>}#r1kO+fC%v<Xb4I%h5ZHIq5n1$HzJd&L&_+kR}8(
zMIZ>25gXV*c{{{i<cbR1B>UR#ee!p>*?DR_BR`d5+TY!IytwCK>NCN$TLSTj%x|y)
zz4LmZ54@(gqXy5sv&d#$t}yk{HM0I0=9695g25}_HpCI~-JvM-^ZIeo>#R{*6kBgY
z=peKOO~hVhu(bIEb=;Ce+J{ro1ujZFxc_xDyFABpkq>yzw+QFz@)bJk@b`gprRJ)X
zth&TMyI1Tb6V!%;_fS#GM{}M{BDfDhxUdbXCU_Llc}K~ksW7tDx559;E&4}pJ>09a
zuMh_UC8fMey#m)+dm??ul=PVeiCOwsjgJ>iIF#Ids3(({VZ#K1+$toX=1}2MVdD!>
z@QaI49us9J`QjOQ_q5e`qyaLfLgex3!1TaLhn38VMa%BIlyAshk;mh^zBU`VpXFZg
zBd+9;VqNzB4YRjiP5d3?yv-zHLYbfXDFtijL$4*bX9{J=;k9$ox<+R4Bzf_PjQokT
zZE#X%*)xC2&u&_TpbydtDgMCI_5g}_`vF-=@jgykuIgmOSX)oUmp1*d5WmEG(*aI)
zfmw#bElRq?2_`MMk*~TZ7`IU6KTsc|MAUD9k{Cs#6BH@@;kiw;*+9KRXwz@+-5}Jz
z{}!<TYGayL8QX~eJBiTL+@NYph9;bQ<K}>pTK(rNdr}hR!&^CZ!+KWW4IiX`8#xF}
zuWZ%-WP?Y5Wk4ngIqVal+L7`vOG2Ch4OXd&CJ%0yC8i!i61nlT$Umno)`wI9oh$f#
z=QnO3O#NUQVe?lq-7}9ZTFc`1@0;)eWSb28R_sazC%;Kj$#&Y(6C{4tCG`F**z$M$
zqmvcBVTpvGOX5h<)I1*f^JeRDstxP718av^Va#QvwXa2Q<Cnh;vLTQ}sFDMZtF_A@
z?k@}2@EeFL?=Jz0EsRl_*AdJA$)d3uX8Ia%EjyUnajW~Mo7lHDJ1m#<p@N2}cEIb-
zJ#!l+@t@2ROThnyhhyf5IzJQz1%D_KJjS55bHKdts^cbG{`-Ouv814YL3E1jf6<2R
zM2~>3TYWe9aP@DBxLF?pK=GPP+vkIuzxmr=PFw*O^qzQqQ`!g+v}8#$3skC2JBr_H
z56%iGPn@9o^WF7z1Fd5PsP=<Z!F6M-%c=~e(h5Art0tRJTV?6j7;6TuYisx2Ga1~l
zZe#*vSaF&!xCxGIH*r2b9Q20k3<#Ut2*(Xj6t4FrvsTG`x#@2gEn~hCLHl<#aGVQe
z-GbTP7j0w;$(ut^R{QJQ<cEK;XqYq>C2XbT%r})UBYy4z_Fk<hC9P-v=d<RmU{pl|
z+V~i4S$@2UDOf{OgoFT~;wMIvcB{ev_+!Ku2%C;dsuTYWo&WGteO033*L*De<;N3`
zsSEs1bN*j^7?DF}-@HS4-CRJPI=b?q<yP0^|BSBN5T&4cRiLT6>3{PAe2UN=;u%rJ
z{|TJ*(?PkU-)xq{{{~IaMP^;be9Dc6NJ0NwG@(23*y3*v0_jHjF@L3DW@korenC2>
z#!X(|e1p*gc0l{kX5ei#s!T0{|6*=PB9f_7sLs?3(%r>eo0w<E0L;JEomzB@%Kx=_
z^`8*EHUODC-S1%*1V<|CnkYyGtZwqP#o~xmrX|ZpItjJ)$N?2*u9T9`yEhdT2x>uN
zSY(-w{`L1<b)&P<KZr}4#YDRkTBs>Eo#P48f^onhipgoq*MAx5`aYhAK48DCalPD3
zd*gG6TaZo1<#-JL4SiH@BW{Gv_cycUX<$yVa1bsN@+bP_zfQ}xHy!zle;GQcvYR&i
zS+-1h&G`+YK{P-xsGKENOR&M-q{J%1fDC6RW7O;CqYryGVmpZvub}pqcfGcJaoSJf
zHfkl|!s7#x-#}Wh%%X&bGoT$h3QCZP6}$4ksXvMF0ewf5M!Y8XMs{qX`wx)#|K~FZ
z428Yxy<8Bn^u5>4{V<DKk~i=pTtC(mYym#dda86{az&lrt>q0-Lp@6!I}PsruS4ho
zFk1PM`8QkJ%!Zh~0E~jgckkHZF5wnL=&yjEO^aon+aSakW}>6{EBDqTH<#tgZ;a0_
z|7F?KVL`C0X3ys<`t(_l-92k~W4Xz@r>Q{p3uXB!_CI~}H$@AJgUOuFTXYbu9c`!I
zs3!WCq0P>@N2QJ%jN!Kj`Oe0iP>e9Dq+s%Yv`OQCK<DZOPc5S(`>3}#M_uO^@&@U}
z;u638|0HiB_Xj5w#r%tlf?X$pK>Boyc;c59|9cw&SWw{?67gDfZXqB@(!sO<iS#^1
zi^79hUTxnLPZ@JSloS~!{jC-V=0NIefC~PAc;=Jnn(gnuft0Y9U^~-NRdSUi^T-BO
zAka0$5CvT^*q)`V2nnCw@R+^?B$l5^t(t#<GP1_A`ih`#o2yt%al`NLAfJ+~Z;gyD
z9(~We@moTAgBjF6W=n{(XV9c3QNFXXwn6`h9JLE(|FC_Nr2j?>H3#qnAbVR?BK+dR
z|A=DWXwDb)E?GLrnH>6y;Ql}P3i%W``l3#dcA2dC+Fbw^F57=eegALT{x{QHN3H90
zgDI3zYq<)a@kDVY!@v2hKLD@(7b5U3;GSx_LjmnpsjDZ9k48-yClTCw_%HMz&XH?_
zz-~NcPgh|3k~pVS1Qp%5M`S;H-){w6|GpX$vm=7!d(jKZS53u@4=Lr^{+t~hICwL{
zBgCp&CE|X^Mm@Mh2gO#era9oQ;HbN!Wcj`FUu1KPfoF$L1AE1kFrD7*zIugD?G|xq
zV>*eNcl{x>ZSEUXGX?=EK2&YNoSo?Smy`LJWFj?d>jF*sy}BAKH_rv3*y}h|I&@g1
zD!c;xY9}|{0gXu^Dz!TRtZn$o39Aj05*p<d1ljI5rias6on1X+*&2?%o@Xni$6@o?
z_OWA|s#6=!#yGPb`cxA7ZZt!LslZ?(rwG}?C}8ss2V7HYlIj*X%gI=0#!tA_Cfs$P
z=ZPW~5{5?xzDeH%lz0;yq0I)`8+{u2a}J7$au#D=yHoMI*@3K*m*E_0CeOZIXMdia
zbG-GY89qRndJqF;dNm+7eTk>pmMAuDV)jwB6DL^*hyvxZ#nIC~1^%thoUn*bC8e#m
zKMtd1MC*N}Hl3ELoB~h`C-u5@9zPnMa;!!w@ly-$)?1uv@{)*DBJpoHK1puf)hff_
zsXm-Co8_lG1Z=G2%5EkG_JK{8IAHro*K%7as3*s{{vysVyYiOW?uj+{m&UdRHZQcR
ziLrTbt&lOu=1!Hxh8__!CEjGZ-=WQY4*TL?9l$IJ=d0XzqMvWb^_+W@lIt;U*r~gE
zOGZ(9Zr1b%s;kGUN}IJ-qtV$iln`qnZrHp>+VECBtW0NJRuBAJ5G1IK;M0N-s(X}j
z?8lj0A>s)suk_sH*K1o8B`1do4-YAM_x-&n=Psf$i=e-;dNcEf4nHO;={ubZU*$v(
zwuNTNoOpg1<NN|O5-(IfQYjQZSuNQ<5a5y&{TCI)3X))S(}=aGmhEJNHNZ8Za=$JN
z*}ihVioVmem}T$BHq7JS9(hG;0Q@-1aWbT3AUhRAcoCjTE5l=&o{}LK<|K`6l>*tF
zwEAc5o5$Vx@_ZG-O8IJQL-q$P$*A5g{5mPn)wJxq56$gvUHH#g%&}<OP<w&sLzg`&
z<2nv^R&rl>+C9bVbOAkeVQ+ty+ZUa$`RAhDWTO`sK2tG`C2=ownJil^bRKZ|e!->d
z1XtF-F)hZCNa(2b7}aR;QZr54qlvLcj~3ZeJ_j6gkch0`>)9A6IKji{<~se2Zrl03
z+FDW8#m8f^W0n@&ql>1F-!CKeC&V-Jvt|~Q12wHZq=kOu4@BLNZfHw|Bc{fL&__@1
zvo_QV?7QmbvC!r6-<IPB9<yB9V{<K<N!ksQ5#1^2Gks|IcBY)(rdVcOE{KN|BM(*O
zG8SGlNqik$vu7UK(A~1W2aIRD%h@u&pMmu?nMn8DbQ~KfHt8_08m?Td%~tb5KY|~h
zb=JGI$|W2A!hGW9Kh3U_fdi9E&a2|uhA(7wK7x?1laijD@jQHl_Tlb1(uAu#2MSYe
zC7YndgRKNCojNQ%q#Ab7g8I40zD%daWz1yBq_@89<Q=-<M2pA=vvg`gVAU5j=ElBf
z$X{L{jlL3+FNqns{M4f;?y1qZl8h_eYrP3xqt@J@TDEgP8Qh>pBhpf%E`s9c+D;a4
z0RqLtS<=frQE#!e0N{_XPEt<&6XY*J>X557G`mAjW7{j6?rTb4DS~(Jp=6ru6&@2A
z4t%t}`nU<}rY={@@NTs};!{w_KDbLRgW9Ck_WAZ~8&~J;)dO(=m{$t(TYc>et5@@c
z4OZW&QDB%WnoHk*DrwlY-ASTBQ+dSDBRX)}p^H12+xWzu#Ce<3tYqW4i(e*@Vs3jL
zkL2E~l?fp3o;V46H@-(^QGAbE@xZo<0?GN2KJf|4XyQYQV?7yxeMqr}sb?l(&RJQ<
zR`_l8yF0epi<li2{21Yoy2`;$U*UDCY_#eS_hR4KmF$7IMQ)AS_hp9Cr?V2qe6xnq
zc;2nL$}CFzc2Dy9j;u!2dIX}Jre}O&Y~YKQi!v^V&K^rqauW0c)kpJt+%zti@>R$S
zxWb*4_-+{wu&|(`!w)I4241MG?tU{{vcOF)4R|_LtE@NBEPNqMd`?(e%rji8_A6xI
zKF>P}XR_qwdQZHQX!R(yGxVHp=U<c%i?Syp&nkZXvns+$nzZFpmK!<818WQ&j2sy4
z9lC=4tJ`?pD&w|YnGaFk{%Yb_G|~Cq_BRXm5^#t2jau}J7@|*4z~rym2MuDg*k?b3
zGyFj9Q*jL^M;W<VAC~_Ck07-`B#@O{m<zitNNO^b6?Fd**Dl#zv=rk3N1HATaj%#P
zk70g#4CCMevadB%vEJ{_g>gDLsz+hvWGn>26(}l^kQ5diADf%_tWn0bD?|6A$o%VA
z)?DBRLr#<TS;d-2nn_<@ybWP<K~|OL{ud}RSvAY5GJKX-pP6W~H{1R}z*?2@iKbio
zw}2r1AtF!{Xe#%}M0lc~m~GObDihxLup!BVM)3&0WQM~`7WXdSk?Ik+K7F1^2I|uB
zaIaZbkCOQbpB}?j)a>=Kf0E`Wn9yUFXVKqgtnJ)jJP)pwk1AA-%N`e(Ium^%GoRKa
zs+Yq!eJH-L^O?6-sf;js`H5OuSZPZVzIP*%k8~<X?5wieOt6^oN#<cLSd1?b2JJJy
z|Mou@MBZkzmu+r!s$z#I=D!!oFT0#*?T+q?REi7f4SvqfR*WsZJ#kK-SLU%0c^7)l
z)BBh)zo>%N)jb)@I1@fkWHg{d>KhcGMMUxs*h)Fue|t5v?N3<!<FHEJjJ;EGp-#Di
zX>DbtBMuP)j-@qLyz6&Xbz1H!=e!nSd^qa+(7y7n=iGQLQBOlcaL%85T7Kpe1>5s#
zS`L*1P~`I9p$X4su~_bH$)CZbwGYegr~M&#6dq3g3D;x$2Zv4nXi?lts>tFu7WiZv
zl9MFF3dA&O^gN<ZiaGaqS?-O0gFPX99xJkWdx(&uDB)v*QbKa$@%R(S_`9%$7|oST
z^1kCc@ZnAaJ*X)Pk92OUYLbsBfFkFGu}4q-2ammzgnwos6y)WKmu%q<HY-Tt&Qo__
z!@tfAb(mTV@RMz32;pB$Kf;_WC&VB4<bo|aDAFH4;T}E8zMV)OssRu52$9FL9Vch;
zH*3Md^L|vADcc{bMi9K@B_kyu6bH=&BT;6cbRY2?8n9YXd-|T)JRt#Vmi~5EM_z_I
zzj2N?lYlO?$G^@JJ&B*0k(>H}ADNc_V$LEy?rl`mPY5!qj8rm7Fzyr8CL%FjyC~56
zBWd$#WXvNXnu7D8HGb`pf@O6TL!$Ke+_A~R#<LtQO*4q>K?A3hcQ3q>D|&^0-<FG~
z|BCz~ocBfjAtA*fKpk3Lxzop~ux2W7QUtdLM7-TaXJYgb<fWCqm6=LyTr}=E+y}%L
z3VXGk;{(Md(1GC>s<v&o)oKb%KxJ7~=yV!>D{1m=|1Mr6oMaD);2b}dd&CE4KKvXx
z6nyLT?>>EJZ0*<|Q2uT6^GoDId^Vu&8f>gU?%E;}UD1N0tL-2*(Oi%>`(kb+pP*af
zA2!hIJGO|^F&3)pRrGX;GuQBIvD*jj&%YO!Fo0~E-Tpg|wg`=Is{tQ|j@0Q4TMyi0
zfHr<mUd^GCy$>r}YSU=gOd2LiR7S8_hSc>x9BqidfK_#5ejS$e-u6(#N7;Mu7EW#y
zdl~tYL9WFuO#D+R1+#xOo^xSuVKbRR2hM8pr|hXwb|6;W>SE#)k=VFJbfxDw!Cv2i
z+MB9;v_>fc6gLymJBXW=;gn3!XU#fSi*g3txo<~p<tYjI(RT2$QRQ0sumY&;myE2r
z;_BEHg(LL@^oGs~`Q`!|@dDV#FE<w+Bd8czyX%B;2>fp!V3wf%!rU%?_fw=c1UOL5
zMwL;Y=*II}y!qmQ1N)&$4P<u<x-#Wrh9K~J8`wJkZ?odJV+dMsycJDd(?E9O8aRw}
z<87B|uj~9k*zfQ!Q-iN!pl)TOGAnaYu*+ZoZ8!h_(yQT@8X%xfzGB~DZInb;q4VJI
zXU-S1Rq=7cubhNw_!>m&LYWiGcI!og;xmGkNPxG(H2*YZI*Mq8(9xvux)zp2_$8RW
zLV`*oMg=H1iEuXiuGGehw-}sql8`lO_dv<^2fC}anrpsmTIaYM5sA_PkQfyep5%o|
zZ#w&`Q$>hlKu&;Hr9+is5!dhm9Kj#(+k6Dy56Nmu{^O>tF}SaHU_CMB2BlBE^f5G8
zjReY~y^<s9^#z853`o-YN3e&w!QV7?VIRhE2Ifiv4nSKA1Si`#%xk;auVNRBcmrfF
zHv73v0Q;9szr_xs{}xF3YXAG=*e4ObKyqr|VT}L&0!I}~M6mAaDGy^*VwRX*@|^c0
ze2x!U55|>exlOX=%(%2v%)y&4$Z(4NoF}H%5_S2*-;!?Y;zTx*-sgLxWcC0j-F?(`
z1FAh7j9c7t$14kmiaU_q5c|P{xTKeO!5ta&ym8c4`w$#~zkP^-8i76%_jkkvMKK(8
zAfe$1k}<b(Kz2jV*?V(_3P&*h!<sukYJQLJShJO7{&{@k8?eK3Gff$jubcl(HE`V9
z>O+JI=%I7pCQ2^m#qY;6l%3ae&u#T90v7%9OJuZ(K!j7+yyb7M`(I^SM-8e}9<rX#
zJ*9sU8i6;t&FnY+{gn<7830ur^=703XZ67F1&rEF7$lEqVFT^W#BTbFF(+t<N~?PG
zunKe_47YSD`&&wI18In2P)|gKp1ewANxPm>w7jnG`Cr8lBLY+-`DCNxQ{-7_?LJY1
zr||N|O*KWNBr_o5hC>y?Z~!s1mIE&Y1%pbJP{!)5q~^hcF#RSl9=JJKtJ%4*i5g0%
znyKg12L;?*k)e976F<JRaVS)N(9#mPv7xN!5`@oUw?LQ1P2xmG03S9$VkwLp%WhxY
zKuvIa8IFADgMRNXn0hzyf)NWWc*(-@N$&FvIpq1{%6#>YZ+9QNsl@j0YWQ9o_W5N$
zsXiLJPD((4=nS&$7#6QK5sf84|0B_9`i9x}xVBRWGqORuL^!KI&Q|d>Vt@4OFY(!T
z9-k|vdfbbPtRl|CqFp&fl{e*6H>q437st)|%!5`qMHvOCl-VcVzD2te0$0}a6p$Q8
zGGmWj9O5GRpxx2i>bw7ZffFZ|4IhvrKygj1Ehun*pJo`G+u@XJzC8LKI#r2Y<*|6O
zVa)_|VELi~N0=P&E9xVor_i{zbccxz%WR<0GAG1nf_CEgvxyDAX~?euO`|}~*mOXG
zG^Y(S<T{GhYJ(~ASNa>0YVEKh#u2^c2Lw5&j#ZoQVPr;-;;L4VDi(jsX>V9<*ay%S
zG3h~aG|)~Eoz1op$NmpBom^12-LNmjyWT?=SJz@I-^i^0o}-Sj1lV9HiJA*V_CnZD
z9NinY<!Z4^$E^Tn3B+seI=DLmskpwEjoS4g7#F+#n<x;aP}{#1M#k-kBTz|5;t3hU
z4VVCEiTAk^R4Z~)<sm_9Bs>Mfq)-U22MQJA`k@2WWclr|n9_Av%F5;#k=RId&nvKE
z?%-)DoN6DTAk(;p8DwPn?NP-ufT2>4W;J*I_Gf5Kuu6bNT8_w3{$F3k941=m2w^qN
z{hh?zUubmq4+UY!bbv(xrTzG>b|N%&15MvyOk3PMCSYcoI*1uc7us=aLt2o`<Yd4<
zsAAW&iDWFpVhn&`Q%c4-;tGuP55?48C;NAqBX$9TxnNV&*f|hwy9Vvdoj&izzvT`)
z3)XD0E=2wQoyVn|jh4847jPU49U2r`vRe|09iom5tW}OxP7)UmsQ?tChq?VRLf>+@
zm}8KhpZq$9C83TV0nXsFa+|u9Doei=VH|h0fGpUbu!0bdkR(L4r|IvN)9}&13)@zG
z2KW3Cfu1vV!Lny};I@L;wG;k)6MytY0a<H;bJ+J=AzjLF0i)QKtHCk{H;2uA03tLn
z55*WG$cmv1s%DwK(|-msm?Y5Xc6h|-VZ;UKz%NLqxevFtfBk@X4(*FZ?lAEqn4o<T
z6dsx6X(av+;Sv1-(3y|Sq5Y7G4ip|a$eZ8%S7G3|3F?GFtIyJb3KC}SwapW}Z%+n6
zS4$k5w)h|kgm4704Uq>jhT^MsdVfglg`G!M4ETg?K7w5vl7ay`BlZNR^bsN9PMNjG
z+*EdeP1dJ%Ow?`ZO*7c2TQGM3ox`pp{t>ukZ1`ZB3dqUMXP(>qL{ABXVQ;3-Vn+pj
z2)JiAo86Co8^oC7SCO2sdd~IDunckwpI@%!7Jeyd+flIP8Bfm|_*dS;;u><GlU-=r
zcNyC1uB>@bsH`P^prlp+WIIpc*%+2}N5-iOl}XU9;5Rz)8rFDSKY@`>3DMio<><N`
z2PIz;kNV?Vb~S3kqP2#LO(y=8LSzTYjkzAOl_*iE2+x(Vg?CCJ$7(I*E%1lvFeO-Y
zc=5#He>XGz2qcuLf{N_i80X*Xm0OheWe#{?xxbxg8eme*nO0H!LI~iRQ0owKWZF=U
zq2YO?c$3}i+>b;kA4(%mux-l((AdT%L5#B=9vbfzM<dI})n=dy>ZwJO&Y#y_M-L&I
z6Egw@s%|c5RgK_k6=AcaGdbU6<>YYSB$$r8qP=hIy;{goSC0smg4-sG9VG`RVfYmh
z&S4q_i{Ocp1I^=xdfcY%NATGK9Wbziv~3w~)1bmdov~B7Ps&P0B`>!i3FLc?+U-Gl
zns7KQBECQ0vrzU!l3SW)f32TJw`Pfv8V<0`IAdy)D-g$VnO(#|(zOdXDU@sj#mKm2
z31dka+hR80j4er3U6yx3XC*49|GcgGanR;1sNu^GG-|CI**AUiS|%>{WwRS>0EE({
zo?`V8+yzkUa-R8mVX@sUMzA1YRvWs8AJ?Gqc1DSX6<n*L2b+}gowQ1Mr<HMAcI=9%
zO$(40_=B=sQ4;0_0n)hd;}h@5WTnX0WaHNNg#>j3-atm@1Zu~>G>yv;kvu;Lpv$VJ
ztCe;Wvk=dAv7(RPhBHY;--vGQO}l}80>KMha2&}k5gdB~5<#*&0otyCt1Aoz!VnHA
zLXZyC&IotL2ji_0OLe2J{!j7Hib|awsdJK6J8?S9d<>w$Oz#J~U!x=Dc4>FFxDC8Q
zpqzE9tU6>wToq&7A%8Q++hT~N2`6g=?Jh-^XHua>k~FFKTWEY>`;yDy9FB`|!+ekl
zASnq>_Kb@ApY5)?xQja8A0Qt{Oa-5m+JTc4){5dYk*`84?3nV**yUq!cN1C!Vro0b
zdnK_{AY3S*%PZ_+DtU|ZNnNg1GoTah5vb&FCWq}0Fcf3gVl?&DXu`^(!*kC*{2C+x
zgNN<k`{Pn^Jv`7|!byO3;y=HF!k<Fug3IOMS@3@M=j)j}xNtynK9;vQ7^srx0DW6Z
zY+El3lF{njUaXfN0B>NyN4tXOfFjZf;hQGu7ZE9}Y2vF4+VZ}Xt}Zu+BE!tvL?ml<
zpizB4EH`h(Vzv`07=>1}OAAFhytByJzG%vTlV%$?kY=|~RykIha%+XdK_tGp;1v4N
z!!#gf)&sx%g}hW<AWm0tLy(Oyc+*y4T73*NQOki7_-ej}*i+=#S^&fX#4@KUe_U7?
zqum2V=0W#;1VE@Bnp%{PQ`g@=^iU&~jHYZui?k%Z^LpS9JY%K+Bz|G%B*qz(_(LRA
zU{OZu+qV*yzt);5ApIg0PN_Dqzm^1b)~-rv<hXOKq8o0nuj0Ag-D)}Tg*5KzmVKY!
z^=H4;UO8g-bNH8-G`84TB4{aIResOe-Q}}O8n=UuxeF*IXQMlV+ntLiAiqK>UbrKw
zb36n1plJKjs6Qy+T1Y2Hbhm^YfrBC+Fc=rx^+hZvKt!Oe!(V+~>SJ5SP|xz5SqsoQ
zymWB7w&jOod$S>@{T1|qamD(cb0m&9<=zxmVvP>RA@Bj_x>nj*pHu?$X7qa6hF~G)
zHqqp*-j3tiL-yeE{jVOK@d$|~SV5f7!Hd&vO@^bFQwkqx#v4krWc1<tc)nt;8(>SM
zwOF|~`*Fdwuy3tbFTEx)6a)Batm)49(j%c+KC9W(@?;>oX)QHZoJRw61(OCi-8}%#
zQ0RBy`U1lCnfIuBinmD$>GaD~w<z()lqaLi8^e~`U;Jty+H+GRrdIm4T1%D55O}>+
z#7O>q7BSG#(fArMbW-Afw?tU8uuwsC-a2EUqs$=@Dpv_hkU9n(c|B^sAc++YIHxcm
z>gSH2DEw~HYLk;)vTHl&__5Y)7_=#k@dbC?wNQ)1o)$dPr=-d0#gaPB`^N_1vqK(g
z>$lUli`0DvEXaJ9b!_atZu6qn!S3$2&Q?WX5z|+Qxf2mkw+{9B$g0$2tA&mmm1?Ww
zm7hv3ch7bUyW+(JxW7|bVtj{pU+9N-de<5RR;`?r?%MR==#UXnX=)##U}OiWlzq+b
zm%sImtrXQPUUlz^W<6SdalJ#b(pBPxj^~ca+$@>8YN?Xs1Cc+Zi|v-fW7m1+kN~i%
zg1PL7bRsy8c|FNQn6Qf^E887?%#f(WYnk&lboCa~pH{x`ENCxICP*oBj_%l!W-m)g
z&(kh$Y3lLWT$D2zE21ts(kYJ-F+SM-01v+bx5=gR)8b)5vt`RLCawGGa@9$?b*7qX
zQ4ZRfG{961l7R<`A3x$>%}8JiJfP>M$pQYw{u!izO{%r5=dCK+(Mm1$FRN8(sm9`r
zX20fpYyZx?-9ElE!(H}#4W^xVS+Ros<<+!oscU>H+LLk%u<RSprL7wOX&$xE%W}i~
z=+5|d&qal5;m0-NE~>dg_Cujd$ue0eogw>&Vhy^@!xpQ<{yPJgT$8{<L#Onfn;{pA
zEV`-wv0G7%mW-6MtvBZdy&GH<Gx6Q$?jQq@8ML(;nQrPx&gHvv=1v7@JuCOV)PlL3
zRGF0*53ubLfPUO(&h~JfMtedXjRGfZhHg)>$4gKjsnM%HrKWLiyL5_f=lBskpVin`
zRid>@Rc9LwzYe>2POo5%EoK(dc?ad3w0&T^R;`$qR%}p=N0NV#X)`5uGU7p>PBcT!
z=j;kUETf@LI=ujN>uoI!ry0^;jdzY^6X=z$2=%h!jCew-PZYO|RPaJf_NC>^_kGdE
zy!1RumyAlSX0yBQ4b8HBcRs1RPN85T(00|NOOan}W<F-P<g2HmZ(!|Z7Sgb5%#{z4
zUx7QMX+<rB-Bk`EeD0ROe};v<79h2_^0`c)aTfESE!{Q=i#Du<J6@tOAGE^t{B(I9
z_)df7eEXb$Kg?j@8RPpYbo4+>dFOIZbo2709=a-Qy=^ay#SH8$e4=Jw-K!fOazJw}
zm=-SvyU&cjTh~U`xE(V&+?GNEt9k3q>^xa5aIk*|wpV<nWZHBtKeDIFtM6TZIp$oo
z;qr~tUl;?UJn?!5ip0L^%F-9Darc*uM*;-XVQ{l!N9_{J_oYy$tTi%T13a#HfNVw!
z&3(Jirb?c&6zg}oyx5!Pi#3TLU=nEY(S8)07I<$}hpELgthWH=B&3c4UZF;npvM>4
zr&pkb+T(es;FL~y@1oJ{&B7#G9N5O360re#6f5>zP^Du*$qv5FMSEP5(xsawgl5OJ
z^|#L4ZUlQac=B+1R#Njfz>#k_DEBc38R!u!JGe3<|2f?QA*GLsLh!-Ddo_I%dcT8r
zOCZ%bAd`P`Qov|>p4iJ$oDHv;L}nZ=FB4g)WQF-vq$KK}fwGXAG4}cPb`yTv+SzOh
zXUln=BKAqFKpS%b^ZhLJ0zX*hr|354Y{Tjac#|rm$*QS8@p&|GKVGe;m5;v9_z>vN
zHBhiH@3q2lZCsY@q({Kon_xkI3B=EDNY7>Kz!klj^B5TX<GV96*Y+ErNVA$<v{TVP
z^Sd<O{bGYCV7OC}<;dCa=HbkrBDeIGSzi5;s=fr6J2Jk0hJ(NhYw`&?()(pwIFWyb
zN@QvT-Zo&)1s{~hQe2&YII7p;)(^T#QbAqVxVmH|;U)>C%Re|Bbpl=epK0WAiwsCt
zq}%hYb6j5&%%XFaLUK}c_M?lA@a4DLv14&30V^qyjw5^tP~B-neo$?n@!^0wirQta
znx6h?Y@RLaZxVuj`1}fSp`-b<`Q(elne9nXwV~f(V;)h-$<vbN(qp?;W4=CZezQC=
z?vK^D28aPK@<%SSGy^Rl{fw1KJc70f=wiHTLoHtT)TW8Z8lQn08(!m@O7IS`weE#?
z6qj!F2MWe59^5VKfz^TMYQ)2Z%lBmcbbr>h`bg%6a*Tn_luDPf*wFVq6(`xg<)L}X
z8-=c~D`OCt%1J45cv37DC?k0wzSVXdu$Qq(7L{6p5G7_m(d!KLvyVZQ)InCewRVJh
zNlFXlJ8P%Cj$)Z-7Ly<{k<;C_vItcOnhL3~3e&PjM1t44D;>*ZL(_Sx+!`|f=7DiK
z|Ld&*$Vq?@l5sV&^WpUyIB^x&3VNP0-h?3Xs@sD|=Z@~X(s@f2MfMrILUo*qe+5?h
z>m^u?FiA5GB^f=a7c01J3H25Q9S>8s)iYHqfwXfRy;h*BuWY>YxLLVtXy1r<;+oKr
zmm!V2I^eQYJ?Jp|k?1Ctn~g|bK%DE+jz+?|5Yq?9n!{NKd)|RPiXw@wTu~@!#RFah
z3z{Ut<ic9mp9L%&42n*qS!ao<A?2%}+FOpO!51iUs-2+SaR^aq^5AiX+#r_@(E|F>
z49|O5;VWiA203b4Zmp9#{6VI(SwcB#otC;xfa(F`Czc6v-iSH!k?I>X1}J;pF|vYJ
z9Pp|%hN3WqtR01i6i05JZdc-J(G&TFl|hZL2)6)TUKzLbK9WZzU%}u*si-qrktW~`
zTXUJwcCB{OW4y-3&tCnIE_02=>Zv1ySN!?IaIu#_MV|Xy`6V{+vIip&DFn9Ptr?j7
z?RwyJ>$_wEfl(8=az~d}Ut~puk(DhCX>~7W3&JH=RK8Q)4amUG()VqRyjxR(@Tx;U
z3Yo|U;mVku`^LAIyHfRFh5K9+gilP4N!)rLK=^bNhIP9z%7}N67qONz!Bl};g{J=m
zXjnCVBru=zM3SK;ei~C{4}1(&Zy4P0q%$94FC7VOQ(d=%Ta7RY3@hk3IsP>InRv=P
zHTamiPwnoYz2jnPV?a(M;trb=vxDXSE_NJV1N+#m`R!`zmDJ(<3fG`tD*<mxXakap
z`p6quK@QRb!mW=94{lVr((I;A-aY2^z(+oG6!c?!`OIh8)}u|YMp}>Zm&c?vhcp=6
zIlVzn+YOZi5|xJPc6;c8s_~tXv+gb(Tm>~FL7uW$rKu_ei_aL-Qhw)=pMt)NDP#~d
zNm<9zONoHW3k!9vvT=Nhth5eQ9+jE+p!N=oyV_rjUy=1xSeTA-Sj&aGZz2z+$(m`d
zi};NO@z3wmsRgs0f#v)5r+D6)J_xj!7+mXakBn3omXJgg6Vn4+U%geZlB^*8i~1no
z#UyhBX1|*^4U1w#OuCoCU#=5lrY{3ImD^$xl_nve$|pw}l;h&IM*7i68>o&Ebd>oZ
zVC~LBBuMk#8&<``XlRUjq1Q7oO(A7cvu+D2S<H-)ZUy<X6?9xm!nEUa*J?{gcBPjD
zbG$^iVPMS#Z>q$u?yKu-8Wp*j*M-JP>{<rk(^bnWaqo`<KKYpy=!x?O_^r#WF#-C{
z>{49b^R+M}&fmfTAGnoKi~!@&S0K+R8M#g4=5v^x%cDOTEt9^|E<2wgvCL_jq@;~~
z2Z{>ubUY|0V$HvD->1)akC8Af1#RH?`M6bD=`pFHF44R~tfw*c00tD-oe<^m$VF#d
zy4rIb?!Vt~9W}xnz<0{s!8JE1K^U%KQ7%EC&OG~CJg08kGmSyGBTOq#ZES6f0v(g-
zxaKMslRR%{d5HY74F~Y1Qbl?UxNQ$T%HDQd7=G)F#68K`YzMdfOc`iTENp*+GzF*6
zFI~p>1^5{L5}X6{T|)TRXG!4b4m7=ZrlQ4*Pvson&K*5GSD8F1ap2cJ#w^A~r02Vx
zMs&{S#hL6b?zd=}-Y{{lU&1Q~=E46iZhw|#zSVv`g|d-uT-fpLEtn`<*Df6$`oM=l
zl9Qki1hmMjP?jlwoeN55llAN)oo%GB`hP8U#}s$8KqvFk*WfI6_ZcWD0{^g6m{#Cr
zPE((Yb$prYy}lmtb@{+Lfqv$C>(0en4mk|3d_3;4DvFhyx*G&&Lnjj_rhBi1P=*>N
zd@}XNr42w|JQ6NhjN9m36E~o4wKAD@cK~)1ff#}StN_Xaq;$5qTn@`7KlYxjdGYLQ
z7dI<y`Pp@g8d3)Uc4Q{ARA|s)cwY0k@#+rj-0`YlZa?Wazm?$C!KYdU#=kA}cTQrL
z8xsJr_FJ2oG+>^5*~qfqFFc0LLV@-N8L_h1=2_j#`DpU;5}{xH**-!WK413~!ftD6
z`di3t`mR<Rad>l|OLTnK;(bF@*e}NIhr-jC`XuCjmrjX-5dYS~?N~SY_BvP>`TGwK
z@#cI7_KoDZ=M=_oyZ~J!R=DU?{N|Y6^1VVviAj}YTB-oAzO_VwsWqiICaGMfWLPh{
zy$c<2t})#5EtDnzjvUOlww{KO>6}ZW@V<`s(>bGV?6c!>eQWR*Zwy$L*fPLO*nx$D
z-gK^FV4ifj(^{HIbh2=KIS>t6@4vlG^vUNy`8kMLbp^~eQ@4wbjUuYW3d_F@WRAO+
z6&?%7Sw{lCmjDTNGFOv#)Q{+9B@Ed1ErEHv${8kQtip%ZUP7s&`{(7lPo4BQWi_<R
zlp9pGVrrx5Fi?w2sO@{~Vb8+Uz)ZuEwV=l)4-lXcnCso_FN1bYZ8*mot6_OHTC32I
zy)d){9)A6jy7jWzCn3A4p(|jfx3f7yQO41=mS%zA-IT419z%Asmx6A8>+jy%XD<cN
zE&j&VjOah%NwmPe+W&Jxxd2V&TDiK^ExZ4crqtNVe6N8li}da7tBat=sJ@l3#{KTq
z1=&@n@6`0N^WmP67sbVzXovj{C$GK_UGS^q@K{`wWlElgI_U~VpbE1e^+&Ic4it<3
zpeYF`kNWYwG<9_>nw`<pL+`6h|M+6P?6UoLhW6EB+2!`Dfd|U;L<8PgD!b^hhOX9j
zEtggWb($d9SD%~?VL8N4f1t?h$=sfsw_cfshJRDP{HatO5$wo$fX|Rr<8;8Tvn2eY
zx%J9CRiu~i%ki+h<6`{h(s?dN<nXhWXDyPBFP)|8_mu1^D=J|-?q_(9i&G<zzCv><
zrC@xipfEu%Kkj2<?n<P@?5%|Ep{%zbhav`~1{$v_%euRe^Iz>^vE1u?PO{&wa!N75
z4}Dx7-s8-wFJsMjYdoUB{Six_;!sDnhogv9-W$8xz%wsct{yBsexj|h?sQ&Z;_B2q
z&7nwJOYxUAlpZ@nbfj`qY1`9>QE{bl?~7iKKbjhluJv447#8D#EAK_~*2~`We9<o;
zow8huwqz_K+xeq^TcoSJscPCw%j9roF{%9Q8Yc%Uvku;NtLjgbEBE)Po7;Nl4|dem
z^zPir-%I+&_{$HU)qBMCV@3B8o=apqBs}!D^Lj&}=sABTI$Zl<w%q82fgQR&8hphK
zQ7(~>M90nMovVqX&~4Hm9_8t|vOXZTw<3L~O2e^jI~i;n5%ryIBplliZPcdiZUHP^
zDcd{6EbQ9r76kc~Efoyy{EP~<6*@b-PPKU6&yf@{r70()&0qAM%YM&xIY7|1?+hkA
zP|BJyc(TiUXfGmQ1v8c1IlJsI>FK2NRI+VKQ#kKhfRra%%CPxdu6ElFyAgISTQ^vp
zfL&Ol9c#A`V~qG6Vg<W97{xyR>h!OZUhgeNB;Oxv_7WW&t{BT~+@r;}*ni}kdw@fy
z;Ke4pp`0_Ig;cX?e(Z2Z9@WpG;<4e9+an(nEG0wiUYMV`8hHC`>%lPF>gCTZQ!Rlz
zK5b_W`?6gkOEi+D|5khLsM*(*S=Rtd!<2f3(T3F8#+8#ZD{T%|rhRp=!~31~EXHdM
zCcpR?tr@*=yymim(=D9@sTZ>-KeJ}DY(9CkTW9m_n)Kn2@7HB}_8U>iF4NTvWS)~9
zYqmV9yr8XN85e64W4Wg;M`TFb=q|)m9DhaSVl1amTFvBgP4Cp3pE@I_W;M)Wl_OJ?
z{sR3fA*=LwRi?+Y(BmRsJ4TxAhAg(frfMNZD-6LacFrzOIjsi5tnb?joJ1#3TccYB
zbmQR9EnRNa-Au8)c`{4T%1fNyXfKylds6PJ+ExYzvw>~Xw+%124$O?2cMQ@dXefNN
zG1W>593H86u;RT*ldXucaZ3>tid;-@*QmV`Ta(T=8<dlJ3?5+42A8${>5l9$a+1=d
z*lDBhO>955|Aj`8Z{~+F^?a9$l~HYu)gN2}(67*9jm<x_^)hN6QCsoGxbT+sGU>jJ
zR=WK-G)i_Z&_$c}NK`JX!cfN*t<sMQ`7`{5x$aW%?oUBuAr<BlWIF>YfKZ4uw0J(n
z2Fgy?%Xd$XT$1UYn-{hg7%|>Q$T^O*-9(n*wFcYls}l;+L)w*?s?LmGh&4}y)biQ>
zxT<Pi*?m$XimU@si!=`V{rWl%bR|{3F8YyEnVtz}k*a|?+^Ewbr)6&_VQHrt^<o!+
z-@)YhU&&vI2khzbG;95bzsk~nY(kw$FW{*3>2U4E-g#Do8xrVQQAr2(D`r`C!xxut
z)(n4cbc}WNS{#ZP{jP3PhNwIV8_-QXAL?q-t|{hVq20dNJbp4WvSGJ^)p)Z>f>457
zBumEpp5S54s$%*4n<1#2S)-7}ulmy+{p$ayy%vNwE;@OPqxtvPad*eEqnCR=NdM&X
z>+k=#%~;Uf2k_n2%;C!u1p^d!l=H%|s{udr*X{I|N+C^2+C-!K-iTiMAsGLu#gFQC
zahjhIb6C1evqN*Vi}LdaT70qE3eWHB2=_eAVd~E=NgHL$V&@7lJg4P=W^&o@z`jUU
zZ1;JFZ@(d5%9#UQ;%bbomkZS$_2l=LOWi0;7e+-Ml}9fb>Uz%gtI2;TQfc?sVQ1$k
z;o}_;q<O2a6wv>4*~Z9xk6^UCUv03Xg<ju|fvW>=LXQ1x?Vx84t#NlwVtt-|Y({hN
zje?1UpXf7Yt~Ykwrm-&;ADf1|g`7Y?{;`}eP>>x~^T_q(i}KKdsSoYZlK~4QwYTM?
z`J_)X2xycgrv}xm?#MFO?w1e0Q=@aCK-d0x<_7?c*`j3*!Y3?-I%aHBJ5@jKNd3V7
zMXJduLPDwWja~81-Iq?x(YWwWFi(3gmo3B(%ottJ3gA66LTkjf_@KnDpYdzPnc>jJ
z$7c#$dOVT?Bi!@+EcIoB(Ot@hz1#L^1HeFYZvWU;^ICAyjQjsl_9pO9Z~y;zrJ`&V
zSqGJyR@wKhn_DWRQjuMgbsF2)!jKBNLbqbbmV{JD_Fa~l%D!Y|XJTTq8{1(1=RJe?
zUibU`{~nLe<34(PaNg&<&TDzTp0C$A2V5Mm<|KjeX?6^&(7H2`5k9Yc+fF3O{FVtv
z7Sn?dR2~kI5cWNnRQmJGUt$>-#ylpQ*|k0&g~Qaked>xr6yu}>{Ld7bx5jzc7m0n{
zYjM*2i3_v3tJY;oyHoUWLQ}^p(YowE`}YX(i5d&ytR(xlu+@CpI*3BPEdVj7NEFQ!
zg>O(1!#Cw8pW*WDkr4{f*~QVE&u$v(KdQbhSphqu5W08vuO*G`V*aD{x6sE9aF7n&
zk+S*@Bbl3gVi1&fP+<Jo+3sxjJQ<nV@fO2x(Dz2s?eQpEFt>>{-s+N&Ov#h$O@=9@
zXVj}oh}b#Aw1su1yz97RyZuokehXgGGgI9Vl#8J)C1v4UOak(hirWQda0#F{x`fk>
zQo+MG>U6Iz^$JmS^87Ka#kOK%kAam<*zT18LsQ(^gAF<JFgcv4|H<+L#?@Yel5)-O
zgDtkJiY+x13cU_iWJR~difHhB&FE<muBnz7c!a*y6OZFz@Ceys|6I7;@#kJkq}-ku
zd1nmjd4gwAqN&DRok%MB<io%*J|oTCe+U&Y#x%l~seIXgI!my@CGEEwZfVCvNp+CP
z8naYQHCU;vmKL#Fz%yV}-IkeyeP{w@$^t783MAxn^$aj*ncZjT0J@f{O+0tEy|qBp
zBR^g&^eqa0#xEY1B4$d)Ej4^kKJ%qdCT_})*nsK#=5MMn{b(0w>roA%xWr{OZV@(E
z-B7pp_lszw2=_vgS1EciT{NT;xVv*PhHM=8n^zOphlbP7n6i+nIBk0`9{wZ?M7^eV
z0fP13!Drd_5hi?gqXB^gcVc;E;%p`5P_zfDVDkM`BFoSChO+#~K+TaoWWn8Su~B>N
z>ztl{l_eIuAwJnEaL#jx0laNHI1mkUKIvufl%a;${?LiSCpV`>yu^>c*q)H?h_h}P
zZF53KMAQ{`gsaaU%=Qb^+!~4EQ<ayh44Zp;8l!8{Gq4j91_|2I6=9^>b~do!=P>xk
zce4Q;QBvnne@Jw*+vj(+OZ^0^fK<szeGi?qC|%QVX|rz4${b}Y8wD$ci?}#c*Aq;X
zOR&W+)CEI-jZXWDJfRnvogvw2H}1(5%|h{+CL3^>M_ta<<G;<#S7a~1B;6#|JK6(4
zQwsgfOH{dcj<&uNieO@xXraJ68sLBL6&e%ph(2Bq{62yt=cZ7AlqQnIpHoB}`vrv@
zSZbS2YSlc7eijhor=#g~Z{8^Ca*`wFhvx~LApgg_9~Bev_pILwm5&$*$U7GqmAb_!
zISXAijL35~<=|84=xh1NS(i7h`64;Qo`2*4gS<H7iU|d@#ysc{6-wZWQJN0A6YqOz
zh=4+(j(_$%-lCXWa`KzlV*Q(*l<$GWQ#gg9q&s3m-=>`lt0kl)fkbB2$}6QcCoA@G
zxBl1?W0+7U8W2c2nR4~dRWJtmnG4$^>Ji-$qZ3AlQK+Mwd?cK=LwEPPuY#++0MrJR
z8k}xlSJU!DtT-;YUvZiPpM3wl=0kUaS0XMYvNrrE?wWEyx9P$$;;2plhGk9{Def#t
z;tc_a%g|v(6uCbcJ(a93Ft81EHoQvSw)N&LqP)`CZoc4p0sF30Bf|*!cIEpWdu;<h
z8c&|ZHKjje;=s&5LD%e4mH(i+CJPy^XhCM%hWz+{{Ikf{RJaR@UMHM65&L4lyB(U>
z1-82*?Pkbfih7E-`iO^}<<FB=UOOAq&UJDOxK=kW@vDx1@|~AIO>BLGs)kNH;J@Fv
zxML;I0T|Wr$F>?Px$b29B25tl&ja;O_>4b;ysZzhRK^3M@TkPJyi7-BTaJnhVzglb
z!!*GrAT=yF=$xXeJ{Bo_+gP#Zxr_Pq5&Kug6tzCk#$6zG=~K6-Ik-<7piY`PkSSA3
zCDL$1ub*n1T0B#I?$$X?@blG;`4x(}&O-azF0sb7G|8Re#|T~-Gx+)jM#Syq`Sg<s
z_7a6?&c7mPFw2CtzbJrc$nT?s3BrpBD6&|s9Y2v-RBgKZFmR&HO@wRmu7OT0-|h}C
zT#aylQ|DX3BWh?{sOzqs`e3#h0X9S(8m%RNK-@9r@bz^zu$4(V@HAx*^-#2;*LLLY
zm&bbQa$n)Cn3`Jg*TQ=wIJ0;-ZjS^6R@{N@=3wW24&NpKALgMvzyJP9(r8V77hH6I
zfAGymnxO~pgdf+)O+%H0H2md|%lYOQbnh208Z}v;F>Z4KgmDDNR|pVE#V8?-m}}eP
z_MXVHw+>rgXt9dd)CoR}@eds8?DM?Wgg&2DkuNL%O;rZT92+Kx=puf5==V{Jzq*&P
zG!cNJ)+AJdG7`~sL&nZJB0FtL=4a<o^`XW%BeSnOHzqNJXmxq9c(Dr7$sKkHu)|cT
z;ljTZl6u{TixUgZ3I&UqhYLCi?eEYLkn$Q`UJ4hNP(l4ImD7j2N|(=)WLMEpcX5;)
zF0-_Xx)Bl`qPbF5%b}>z!wCp`QtQHe$J2aXUwoPD<L@OC82Q+RW4Z43J->npEITX%
zYKRICwkLX=Gw$y^oN!31@jb##A<JioC(&iE$te~8`^}nR3D<HG@w+&rc3=i02!yt$
zASV<%bnOT%3&dluBvf)R;&5;zpX<>d{EEn<(R+|iHW7K({N)*A3e%rd$>1>!vr8He
zWez=Ys+}mZYIonFHrH1s4vc2kQ|FA_oKzRXZ+VVgrq%VLHZ|D*n?K~^iDrIbA}NR&
z<|Q)4<vK?nq`JMGS#HuRX~nqYQrUMTV~%U2)al~G+9f(1n5Yr=ZXZ1_FmR0QXx`sP
z8gG%E_HOH^eW9xIEra?xcd}(0<t%_McRxoTFYr_{%nzS8l9ZFug3X2J9C@C6pKD3n
zvB>JEmQnj`%Q8Mf_)2S&a7}O1MELFrwx#X8i35+85-!1GZMI;B^9L2p`^|L`wXP1Q
zM(#1-0h~69;<Ga)oHGRo#jr`r(=a!@PSj69>h|6_lc~PBL<md|TAnAeby;m!!&-N?
z5sh`c3*HRmmbC8BxoG+ows8G<YBgyQZ^MxHDRn<cpt6TLkLq+7<X#Wvf3bK}(d|43
z<IdzWNtlo*^=FbSHg6B26=bxG3eq1Hm>7ic0m*5>6qVYKmu#1FRznTr2VaHGW;?)$
zO*6S_seZs|hk=YYSWz!>T}B2n-e4%Ygz$e!+bSS*P2==|INm)x20}?aDaZ_TkVXU&
z5m|ruSvJ22+v5P1W^w)imj04PcU#N;r#8HK^}KA4;9-J}qfZZJT#JyeX<HWl5XdWV
z>X=5)lM$gzijSxz(xHGVZ=sAC{}AH)h(Z3te#VG;e$95JWP5;>@w&trvaPkT;_RY(
z1dj_@L+-r8XvIVm%SZK3fd{p<h-{=zU~0Lk*dh~B>`)Uzr&EV4lsp=9N~Hu42R;yS
zfJNP_D;AbMq2HL(svXRa|5{QvGMtOZC8vKvER`n3byOWA<tEh$Olk)#)*^5};xF))
zzdI#>I&bQlajbZ(vmlRpT*W`@=VcJ1c?{&7f1xajojr%V6O|;+7M+@JNS^B+A>1rA
zSRB%v$e_BbY(1g>?K3TJd&jiF@=haZmRD<oj~<S?laI7UN8C)#N&KE&_0cpf(XLW+
z&{7T57ycF>*9_G+-EA;kQ903V9qO&pU#uS5<VYDS{Xu;?!Am?9WA&MnJ#+afYGzho
z_shS&FHo>l^#Pvp_gN)enX>X-K1>`^yqZP1Y+|-QwoFB0yY6Gu4P?Jc0=@tzlbe2|
zuww!LLxwtrK^(iIo=Ya1Zr@r!3=)eb&t5oraRAojlnAB0ici%czy7o>)HuBTO-G4g
zQOJjjLlV<cZHCVq6>LOdWxl7@fU;Wdy9*Tjq(V+uS_LANgir3k4|)}6*NJL}@8PK*
znPQ!P)u(|Ohc#hzD=LjmT=S)WaIl9ZP`Xj+`2MTMw4$Xrj$qZv>@h+ePNhcJf@PH(
zqRY<VjZeACec=u?ynLKvW5O!|CA^LmJu;c9bLAKz$#f^f9<OS$c{^({F*-i?$BcN#
zf`!S~&ZCi0z-*(H?sFYRNjMx0%N7z5l;jRL!<9kpbQz6``0k%Lj(c)b<@UZ%QPSlt
z7H>+_2R?rcy%{Tos5lT3H=s0I!&{1L%`P<^e@%^`sQWJ~EcvkLURFX7W#r4ey7im7
z70>`Uy2rf8ex2=~Gq8|1C}>Rdw<D=7nD?KmTS614WtmD?7MuL1v9D348qVj5;iKvo
zkq)-TDfZ4CC$<$4rS0ypn@o2Uct&TWtLtG#75pvh`8|y&jfxQM1Hk2~0t>v;)3N!k
z+i}Sz;Bc<rPWfc*!QpB{QYQ%UUvy)y5)YbYg^N#IM$f)RX?pwgcH8GZP3K=a*4@)n
z+JVcgkC{rQ5U14EAlmNRsfX65ZCkcw(^HRU#;CXUZG$<wJEs~vn|`+2eiy^T<mwXP
z&ueNA3QvFWnQo#gJ=E|?O7)JA@8%x4a$J3gVYW?eTTS9p`b{~`#Ya=mL*#DX&|&3Z
z7jXM&wIyIi$Tpy90cAPT@XIC<&Kj2a(A>xPi!+yq<?flg{XWre!We3-_}rN7pyar`
z^Bj>aG-_|}FE#K|qICz;^Kij<-9n)dcAKxDMjfI_?CxY4!U5AyVZD@kf*fpTD!K#d
zAL2Hu-$e*FVc!uL;Qb}hnT6y}k-B5{fT4OVS(!oU;;=ILK1(qG7H4}0lb04w%D5s^
zQ2~oz4|chUvKgy7ci4X}6a<=TB_cR^DWF7L_F9OYKwUAYsN_3CPP8DW#j=kOF4(8y
z<})wWp6VmyTo-pLroLbxZRvyG$Q3$93){6mrQ6fS<C{}U%<Bu@gHSC$&w>(TDb!EO
z;5(<6MoMGXJ&_aE{S4Q6i+4cLil@#c(^OI}faSY9@p8i<hvA)~K#|_)@&qP21vDCY
zu<&9M;n9Y2(s1mPFDkeHhGZPst1e~B5+>}<@AB2^7k4`9J6eErsgGk(XzGzHten&`
zfieV+_L0XAS4|NSw%*gV>xtW?gD&cN)k#T-fVPbUq*_3E<wT#Gb?>q;S;t%6+Xl*j
z@_C!`6Dd#1)TH5h)vl(=t+fOBVnX5a4fcdZpQ9|2gYBFH$972c$66n?RvpZnQRt~R
z-!2S`r~@=XNW*)xvmFL*k1_mwcRpvTWQ(SgAmRlvpMN+w6ZqbyN?*_6K?N-FjqZ@d
z>kj{E3->tPuey`c2}XU-Fd<6Upzw8}g6-~?#!>ZIIpcceF?b>Jh?eq_hjIT47l$g}
zW&nInJjn+A$iEY#txPTcr#l8wokuY>DQQ=-@pvd!p{7725*OPcx{WB#F;y`M6gWr2
zFsvpxo^ba2MT%)=8s*Qk7!LJ5e{t<X$^a=%!b4lZUu!&`aO!%9-FKXSAOooDHV<Co
z)=M|{V?ct)u0^nGOb(dV9DZ7S3h)l`>4#bx(JX!^U!iec@~WKC=UF?6yJ9?1Qot%_
z4>sP=tq|;zeS``{8&y}wA8?%Qeq$(--qFO^uIrgo213UQ4~zU(&06c28k^^Q^1A`?
zoLOFarY?$g#}%<u_^&wAmo;$WWYeCpYiQn2GfnW%h275po(LpVd#R7?@9=L|9m@s*
zes-@&Ql!7Ug^Jxth)g^e^G<6+P%6XHGiytp=jPY4XOu14Ywx0rCFSb<0xQG?U-%v9
z;Xl|lDojfvvW$l$lD7(}Z8h;=iLBT3a}UrOKR9(a#mQNL)88YjK7z<ekZaGRic3jk
zeyBd1J`ryT5VKr(mfNKsz%neK2AMUt=ATWA_dKnOcGXaXypp|lb@3?XP4nyq42@iF
z=^owkLV7CU>0BT7XOx8E><iD(Ud?0o_Rd};T56AmH<N780^Z{lzBXXP$Czq&-^ii?
z#CS^UBnspf>ZULFCw<a+-%*yGhQ|*^W12APs_qW?*U}TeHmcx_6mwr&1Pq4}*^5=D
zALRsEQ6;K$>!u7Y6?Rv!duu>>rtf=E&b~%m-2BgkG4~mfID5~<$XssM%nc099{rt=
zISY3$))^C@=12PW>JoSBPF!nvB@M555(&c%^FN;OiHKDH^jOz|WFOR^@r5TC1*E2K
zu{$BhXEB4S@zRVbGycP;eFHp(-TAW|B9{7fwa0K3DKZLWUMA;KOnk2KxoIztk&P0?
z9AlU{G>kPD<g;yU!c*I1U*8PKg2gC3o{Bc_Kb+5xG%Ub9`f%Zn;bdosHUr@1YQR>{
zdYmojRI=$(Q0VT@06C|+Z&SVq+tD3Y)!hPe`AqCnj02n(InlferPEBcddJn@8@__6
z6JHdRytcwwf8WQ*kX)8H&8$>jnN@u)%|ngNxMHiKn?knYz-Pesap)*7g&)IBo2)ms
z(`M4!YKRCs@zCkmr}+vZS}>ll$DgG2C{nTy8<oH-y>RkuJ;6vyUB7hc;=xvV?})@D
z^b|F|7x!Fz;>j0}uUf{hU^j8um_*kI5`%v>so$$c6DBVR0AWHE@uE^w9yWf8&>$m~
zb2v@CKvWtrRBf(q-Y+j0V`%pdgaYg7W9FfEN)s{hjhdf=tVt4mL5bDGIg7eaJ5I@8
z9^4XB_|&WTr*u}@vcYJ2peC!LoX9yIkLbyJnQX*x^~`;7la|C*OtN>(*mEltH-$QL
z84J$~&1~8wjVd~39I>uLR|=>K13qq{B=S%RyU<*3nFY{6v3)P!jTr6bNOyHQvYxWq
z0*DE_G@TwJkb`EJ_m|~x?h%cAlrj4JAEV<Mf>vJ{CzCB1RAr>P03#FsUAnGM(oG@f
z7yIEfa8b=@oM8?Ih2V#|M?k#PHJRXdp{ku4n(lu!ycAkgNu+}PX2%6=V@bJESgi{Z
zhuqE^>Uk}KB5Y`r-Nuy#$7V&1m+u-6vKaN=XQ+nY6U0qf8!s(6`=p;GhM%d8|3_F$
zQQC7n0`LL8RVgn?oePqq0t>SofZTQqUQWM440j&U*XA$r99rt4y!H|Wgn&-y5ciDl
zK{g}c(t#tPd=>_p0H2NZLBu5fk6b)p%hY$)nIZmPPrrCvh;YBta7e3F7i`rfo7Vf{
zFyYU82Y)0Yd6PyjGyU<nPB&>L`e64_N`n^bl@eX@i%eK@T_#o*_*k@Ku&e_c5~NQw
z4&r>0Bbhk0l+S6$1JVsIb<L0^hsA3V_v%D*uMesIk>wM7FzA<ke642mBNw<j_uZ4#
zl48BvxMBKnAhAIz%6(NQ@iAWt-2rI1gFTX7y>p47y4|G9{2Kc1pM_P4H|tZxK(5`z
z?LlsNUwI{6p<3c$vk^(tMR|YQXq?>QvIILcr-IOT)IL9kDLN_*uc&khzm~E-WdcOZ
z2q?uEU>WODRm3Dll6aUw(217lP&0ja#9ymBEz<qC77V9sq3WN(n|XD*US-+`_U^X7
z<=t1^>SMuVbxZdMa&kAmhl_Zu)@<*<BQml5Zkp3{b#@gM+&Rx<W|$R&vQ>i3wXp&M
zHy$Ezy)}Sq^${*>@G;sa5+ci#Dm&;1eIp(<mSX`#^C1nCewH$vefE-WMIi>dWc_z(
zIhYASWC5UNVnMaw9iN<ZjY6D#nq!7YjNv5Zs+z_<=l7TX?wx4RDswCvzfv!NU_<i`
z$X`z$FRQnqDtwjT)~gdper;dh*Qqwhs5TMx{l^1Ph(TN5_wHCQEgXrVWs|uuaFLK>
z3^MWBy0D{th{kV!OjeB$a!z;s(AUYri0Y~YmZDivc_ke6XOOs8LTX(Y<@rs1+#_*&
zShBRPBTs%t>g_jfQOY@SCp03Gx@LcnB+UDd8a@|xP$o0|!konA!_$k4TXN#4Zq$jB
zI}w=X`H0s5KOg>0+nE0h<Pt&*b*4z=4CwEP_eX`IeDBNOxWGK%82Sc^&AuAJ=KXnc
zM|X(cGM1C(?0cqL|Ks`LR9^=9%N%RT4yX!XSp`sk#qhUV{lxTLC3%ngiS>Bk(6z8J
z)|ma#@@|hMo@p7q6U&4-hQym<f(jn*lE%$>BNcM;WS>jh>Ggz&HY*4jMMTW-Rv)JH
zeT{}T;=foe2*6x(W&J5GK&V*uvb<*o^2U20Z|uvjauS`&zinp%3Mx5|*q3!wUZvLY
zZZ+>dS2o=u{J6utQgSBPDou%8(#AC+K$O=DfrvoWy+wbYc5>rQC$zz<C34X9VZwEu
zUr@j9*7u=oJ$ns3!q0Sn7ff8ziK&oHI>gpn)((&&UgUWPKJU{+OFp`o&p<AXnu5Ga
zamB}VxKaj#m*2;0Y%48$lU}<m0f7yz^kn+zE&j?mq(RAflpmiCJaaGqpAR&rk)ui?
zW>;-7D3bsE$}6pT_J2=>&WDA!sg?6dpgQtV?aMoL%(gPa^kY}dwV9r<V?n}hn}*1(
za?JIBT_^f;mHfr-=l}Q22!b5%${$2JhQ2xJ^uRt|1@~NdhL?cExsa|YTrD*DXmpWy
z?j}&lhEj})PrW0!KWv^fpNO>dK{{=x)t@_^pd)@RIbrKLWk4iCBL9`NRlwh*N52NC
zPSPp1`dnlLN2h=ie;d$J1kh4!+E7o`@V*L}`&@~=HnZ;dqL7bO88|Zq&VB(!`xg5e
z;hDn9EhSkn;@1yZj{I|V6M3>frIL^%6-TSK!t(sr3J&gyuPt<t)w9p1Z`(x?4A3JI
z7Y7QGbVBaxT)>#TljyIQXt<&t3aPqO3<WFm##u=6;aCKD$+JWPrjV<Xg>N&fiI5yr
zh0i;sdF7OTI-*~;jWLY~kW5rv@FYM-y3fL$`&y89Q@d{6d|Q7Nt{bc<H?6(>A<^6D
zRS#~s+WMXQk4d9Qb#{||9|R0TP{i61&7Yk=ERSh<)z(xx7L{2uH7BYJy$>BAdu(z2
zfcR(Cu+uVMuP30l&<hbEQ618e6-Fd}1fV#UQf6P@%>DM!bTHBGhvwkmbMPj6uPSF2
zXpDF*DA7FeWb54vg_RPgVz%BH1*I!F7P97JVwvrz(@A9KZVo8{u_3}t6-I@|o?V96
zGb&Hh$K;#=&oiFW<lAl?hYf5;(UbuL+mlDp3L{U&&y*S^tHMg9VHb&P^=+=AJ>k9A
zy>>YS;u2@Kqfafw`9rM^&wlIIYO8~$Q6Ww+(=<+jVmqs!J>02KD$l*OyH`E8n`naZ
z8qGk;Wtp0xQ(EIdxqk93r%3Fp>jBeKO|jDoc5RoG`pP6AO7{(lVo`9nx!6<AKE%o=
zh<b2+GU9s{>KtKXc!`ko0q#QWw)kL9Nnbdr;t!Zd{S)6j>;hBiOm)%o?^h({k{<>p
zM4QXc1b=?hoVe2gcA}=etpCMj$D$)FJ#H%VLjmp*JFDMR7$F4?_8*f{thpW{U)O|9
z6`zpM&X+)cRn5zA13r&??^_PGb`Tv@p8;lqIRIiNMum)t;g)xT_KZEBcoSr=mtf2%
z{zwuA{?AeMf(Vm^f)<^mESDm=k|%kU@QbJ6wlPI<A{AR<KLLprbKnBECj#(|?~*SK
zeM97mI*tgUYGjr=q1KR?aZLK%hsiL$lgij-cb8FW{<KAwg_&2XWz;)ZV9!29xr|?)
zbB=Wg^e<)0=ebn<_Gfh{!zKmbpN)Yn1_fSc^xx16G805ILr&oNXblYjI*$$Un;@t?
zVtTVX-Rtn6-eVgf|CQSkK}{ZcrIIG<`B3!Ld-ET$ySZ>VM}2;IYCn>%<{l``s;%&1
zg-=gWN7cF)n}Vn_;ZgYQnjcvL35f&p+0-U1vc)X~_xvV9;oRL?<w~F*L6B{>H~>y3
zFUlb2H8YAoMoGD@Rt0VtazvuzhV|P~_}_y{Z|g+60-Pm^r(IIwZbumxK3>kQgxj7b
zv@f{#jJt2;Z-Yht)-!DZeta9Psb*Ev60zZ+TWMUcg20>(+_mzzH@aC=PGfX%$z$Fp
z>Ky@bun}&>krxM0xvA;LaL2qrI}I>M<Re81ro~q^zDU*Znb%XD;nD&ina9v9a&zJ~
zsyyur40}7mMS`HO+^jEPAY|E^g0yi>EjB`l1dRrhO-up~@?xEMqRhv!QYN^96w5Ia
z@ynNzc-VTku)VL|Iyi-WI#V|U{C^`3v@Vz=qVOZLhL1Cy?I_5i9qG{==?+^MF9CvO
zm7@w4v#b(ctOs?TzN9*BF}a-NouiZ@VosN!*8{c1&Sp6BXJ^D*{10L*U&0-w;1gcG
zpkjEBp#lWK|IFb3NZwlPt5Njx7$(~BUcUI9Q)N44!QZSzcbm?AV&NtlM842)r~*No
zdGD$N93c*J4|2)ekOS|3;3I|${)YZa{xUlV=X@?{lIyF9Tek5F(~!x4MAV;)Mg|Db
z_+}W|SGL&5MgLe0G5GLEOml9!<B$;{1i=o82$IsL-y}!wbuqaj8}Bqn&tS(6g>e=}
zARR13Kb>v`Hvq54iI@2y2GcGA*Ck%D>k|C~^5Ve|4W=jbqBWqGQ4LnM75d+sRgYCs
zFJsc8U}DWZa-X(}4@dr^j|w#JB=Z|uSX9y{*n2u=mG6ng%G_vCxbb@kIWUCVL(3f}
zth<WI!UHlh1lpQ<Pow{1Lm+JLg_av{|0{|<`Y+m?-Rz^Un-ET}h@`iS2aF3<DA?89
zSlmY7kAWAVuSUM=KZpqNIGwKZ?O1F2uYv#aRIF;BO{YXrcIX5vBu(gly)dwSN@p_f
z@6Q@l=x(>W^Lun082$fu&r}T&CHE{x3br!r7RI`@z9;EXg}Qb-qqTv-WY&^uiO%d$
z3AVM#aDvGUv<yEN#*|m;C{IiqCc&CLH+ug@rp;GpJ(1rOB0b8}-Hw~{r|l_FPKOZC
z*>rJ|{HnR3fas1W%-Fc@pzS|xmB6Ro#dHR)SEwyOTKQ2II(XSul<6J=5irzg+Si-&
zi1LU+$F*V1SXRJnK&wE7F@=Y)wtmQv|F7nhGA~sZVH^I0t*Zh6!$s6*2j1p$W3eBB
zd##B~9@-0t%!+rZpJ;W3^RFp~0!?oL{>rO+dVE7C+l#;M&3lbnHo5vUtov<R;dQee
zSs5PZfLF!JuP9iVukI?K&WPl^h|pT?1qdYFIkCR4#Cji)SPK7z4j$GuiNR?SJKCHF
zcSi^jHqMx)&Z(XuxjFnDYZ3z*14(T2L~v96qE*xD9a~)qd}~WwvzAmP|H2swEMRfy
z#ueSa+WP>y`K=6(trHgLirG}DP{=cpSb+*d3Qy0*S<+a5E>ux=SK9_%164ner)>h~
z%v9qFBeP=qXr2}l5ztJiQARS@GbA&IAHOy{c8z4{+Qc>hd0VO_XJ6npHds6H%YH&_
zgCG3B1ZX2&xu-c2eCx-XFM4!2#^Lg2I^}l%5942{n_0e_M8<I0x=eG=y)y5;|FMb|
z@&DIV{5x7~ZVI&eWwIk~yj2w|x2BXRpp-Pma#N$;tP}%AcaySFs#r5L;PxWwff<Cf
z*}*=o`qMVyRb!4T#Ff0RN!z-j%$K>r4>pT&WnQjRCivRInFc}nuX=(yA-x$^dQ_0|
zk0d|Uk?v<-s;)%`WB6G#+)uVqWaUo?G_Lge_6-!^OIbjBc^2khH}Pj#QQ#Kb)<LP@
zcc!g)vFt$Em09}^K^6+Ng?Oixs1(~*?D3}$s{ti033b;+HVkV92g7QV-n`-CzjtL=
zt+oDL=`?SZV$-z|<i|7k=_Q99sqgIh;#O9&g)s?g(%LKv*AP?WqPpupti>HO)#g0x
z)|EI24Doc(+HCED(AqIZ>MM$B24UCD`k3#{{~Gk_ibA<p@Y9^+%d@LYxDFwwt-j?8
znPJ6wwt@xI`r7Ze%5c3`<0^v<(j}2f2Mt_*kN+gpdrddGDSJMv&sABj>0mCrxvuXA
zBpD|kfL6ZjC{wce&y{#zwg5F@BwR~ZJ06UH>HEO$Db&yfVE{O8&*DSIqcK^Vtfe~T
z+cAw(et~iB{X@B03Q4nPHgrcM09z_lFr6KQb&q3d`e*$Qa0re4s6+vqPA*EMV!rq9
z8N5X4Jx%A1@!w=&#pmy(<)Dsf6}5kfVcJk9GgHlVoqDIrBCujNfV`tqp#NS5Ex~Ol
z5S@{6abjInEEjqvCUo~Tr-=8j?kW4!%&d)B>foMD7t#KgWN^nVHQgh4_TQiW%^S7~
zF`KcWXg~37UG2i^SJZsFp4i%Bz0bG0hB&*FPVE;eC4JH9aWAJE679d;y=Bz7;<&{`
zdvs4d72mVa9Y=+S7SDcHo2>1bpHN#QF1Jtl{4^{j5~;oLG4Eye%3r%Cy!r!^dnP{@
zd)k+<ZjnwAMWk>Bzw;?+R5J%;30-INAj(8^A;*x-KrgPOM5ltym99kc<BGrsq?NoU
zW=95+Y?u%G{!X&w|JX*TCE72Cgi-@%m&enW#eAlOsPFi7cviL$Xnq+#Y;M$NoJ9R2
z>#4Y-==~SiZ)!b1<38Nmv0{cs^&rG^p*utwQ{U;B_9UA#Dy_`P9U=hrOk1Z4I7QNu
zoiA=%SDEu2+{<IHio4@kUa7TH<aeMqrcrgZz@j~J<I1<MxSHP`xdE-;Fk)lX;tzON
zKCfIu!;&;E+HtYpbW<j}cB(?Ie*7Ne>XhrCZs9|b*l(d?W4PaAb%GNnD=M`x+*Puh
zBVtvRA)f!g_&I=vYsnUJ`0@MPE8~N4AYN9BFr4g0IR>?d()R)ba_AKz9z8!<!Xg#1
z66DLE)CY|Jzjtkk$8{;Ic}=mfyRS}b0J3qY(dzkTOHums>8Y6;270E&9eU>5I94^~
zF@To0ZhiCJ2v3&|ftY|of3KA(>IJPpw0Q3Z3Q=j=tj&1~LtWnMq%pAS48hnXMPd~!
zmaDo3HEsP@yjdKtl~V2nL@I4;AdC5;jMv2|4?aD$k|LqsgE)X>mUfzA_hwVy^h6FY
z=lqgigM23AfZc%%!nY7e2F$yv%X{nZU0hymyIVAZS1;qZkZ)M&E-?qxhW;bw81}qZ
zRIAv&;;U!s*YXh~!q;Wo{<R@&LAtr(#Z%+$k3Nv#Tm6$-S~~LYRv@sQzs4w*rW6}`
zmgma{fM=2;qBmZWhkY$(4MJ0cc)W2GaWJ32tF-bHaPW$zGGDi^v#PC3cOHX&pFbUx
zADoUttoW*Yu#2=F6_sEmIh;U!Uf{|W;GjSN9jF3<M^FHz+%(!QK%2DLB@op1e>MP@
zRISHpw(9rhm5IU0a0$tk=+_%T7xS_NrNk9KO5fSkRV|;(Pn}gFqmZkPd4TSi|J4?;
zbug2Ea=`wxISZV=d9A-^+~E<YtA^jdqPzM5zg2^3noO<Wt)qWa6#C}r*8kt3a)965
z1wOrMMvA{f<-4);=Gi_LtJR6D99}t++Tl?OCc?Ek5#VnB?~^B>{`VPEdN4rZ@k-={
z5KGpak&OmlE?G6%JMF}Z-F#pJb`$o4bT&EOg-mr>P>b$+OxvUeN$`XJCEG()%aspf
zf38Z{Wi{DbSXM*})j6z0Xvh!Kt6w?YV=eXBJ62RPoDQ|nKmNHIF_+<4Uz%Ol^gnVj
zu;st}z2^Cyc)+;@XxCr5&^+`PX*&}7(vp$hDh?6=DnrkX-ci$=scRw(r*C?-`6iJP
zc;U_F4^prHr}=}f@Xa%$t|wwX>TGZxI*!Ytd3}%=A&cu%;z+w!ob`K<)vx4`{}w&S
zTNFUjbz$S_3~k^m?dH$vck!tF-awH5?y}(1>oH9pTT{z5Q?Tx8rNk`c=d5bn<Z3(t
zkEw5xl5S!TY1%+6sj~`Xl=1J~Ug;tR1?|#H)BvgI6*Z%Kv;S(A7wuts$DhEsq64jc
ztFekgnnuf4@UHIi>UREH@u6hVG$~51tI%y~(0wL%PG|#u)8D?SL7V*b=92u;;7tsA
z`-OrwLmT5IpO|HKEBTep0%83>Qn_3&;rDir1y?OGfX3B|2mjl0X&u&CcBCbsr-rL~
zdiTHa`oHy@*0}=kdN;A9-euKlfW%ha<~J&Si0a@kMN_5I)nHRM<1c}L|Lt#pj<+kK
zSyyee%$EjRp`P$XBSKjLVM|e8Fx>?l`p=kZH?dPchDT{t2T!dw&L%qsZzY9n9ru@`
zPwX9-*h=1+IwMDR5?$3GGJvr+4j{l)lj}3)H>}VGPLb_u%vlk1M|cBx<RnMKfgBIs
z+|>Zo2I(+8fpZ*cBRrkKFVkm&`mc6P&`EA5FYv%|6$9V~*OJaOiJ><5x*<U7Lt~Tw
zB-K^f<0Ni?GhUGGlsN)-viXdq5_<E_`R3qfRwhB~%Brh6jFULEMy0es=ZhdZs*l*(
zqVc>cf-d5F3>5nLlFgD%yUE$R&(gcH=tR(IZ4fJH=bdA*sVP23gC^GEeDw+iydxE%
z^?fYj)kqd#=AqnCl&%+khm;rQq`;L60`=WLrjXz~=S;cXjg9Pc^#Opm29mBT@El#;
zRa4+^F<0K=g~G5hvA^7u8(rJ!yyHs|pvw3YO#|H*NdI0<VYESv(+}X+1CPXdS3ie)
zh^-Ih2gLcn9!D*ryMG|$M(9)!sBf?J*~pODEhJ1<^4~IVAoR39OvMygH(T2O*8h^-
znRT3zVbyYGKrI2B(tEMlLg=x>P*>;*7hIMmw=HbHAl5rrarPe#&;yDaRiU;jYQEc;
zZLw{>42X)%O<ImWiKQ#>R#=-DFeB(pUqGu&(l0ly-(uvVd4&IBB8{rG-#Lk2UUeU(
zVEaKW+{TFT#T&<gOdg^Cz!u`@Ae7cnAVc13Az`^HI@Q(i_g}|#<|##A@OJHVVis&E
zo#(XEUQ)mL82?)bR=x2is`cM_Nq%_LjRCWlt3k(`2IoN-!9H6GInsWqgKigVMiK9V
z7#99|tA>sm%6!ofT|(nE!Ashisn6H-ztK)zZDJXaXgXgk1bpO4UvU#=rK@hj03Y$O
zN8)UU4Lv{fHTYk0XrL#ea;aZGonG}+ORGoHf{#!Hbh2V{=oIrCZ~}M*+WgxD0HPnk
z3=L|}j&>C(#4d?02W)_|Tz>*=BjOV$H{Y&ZxF(9hsY7R6%KzMK6-UlDRdrt^@#)Se
zC0Q#W18DB~GBePt%}$Yk;~tx+PLlustLkh9mp3uo6~+<V)b#aM(drHYsja%vO=i70
z;kb$Wu`yb5D_zoC-8oQ}`JI%IzxSy!^S7<)nEZc-*CdZlZJFp^=WA@r<Qj~fDp`!W
zRGaSA_bsZv<kv0+nEri+#?n~NiLj_r@-(;IjAH9b>!^=%FeO2Vn%Y77wh!GR5xfL(
z8fQ45o|~~5gKwqS<%as=JDo4bx(Fw0d>is5>_9!M^2PpVd*s7ggH<{4W*!eks(c6J
z8(!48_!PnPrq$a-7_Sm%#-wJa)zsXc9w1w8ARAw5Zx69h9UBt4ansMu(ae*rlJQ0<
zr5zC~UgjGnKc1NGH6pTY(Gx}mnD5vC+@^DG3y%Di%*WVDIPK+LKr}NmvLa|I%V!E&
znX!@@@;wFQ=)Q*tj*l#88KHvXv6o@`p$v}p`5HP&hJ#G!2sIwjzB2FCsAJ2*AQd&b
zwvqnavJHRGfn_QmAyP#WPf%NUXUSJ<zsGPvc77j>X-Z+?W+`=KfEw}XKJQnSDqpg~
z_(0EHBxYyUlPZ^s&iQTv8U$>1tA6&f{ti?`fOmIL+6bnZdvF}jlf%k*=yK;+sOMZ<
zo$;j%6Q3V&Yh%-h4$JpW!S_5LI?g(vkB2obNi6eK<n*21{<kLj<BW^*DA~3}X(NAN
zxmVtQzO&do_+IbWV)xiC<M-0le@t2OPbG<TCX|jiCN(liw?0hxXdNo-XclVv7vx66
zL*pF@%uX77{4L+IKghCG7F*1kpv2O<*h!k%<V4}HBjt;pyeB?J(`~%Dq;)Ai&NH%Z
zpsT;kAJ&$DAuUH>Rh}lj&q(tuQcHpulz*ke(3wE*xxJeH`_xm;JsV)M_`B@Pbg7-s
z`}ypQa(%~#-ZxPKv+_|pR@iS`L!M=$Tk+ewC)Lh;pW)g4*zEJ(_HzQkq1jGmp=v@p
z#O}Q>_P@6_CA~P?BX2^I_kQj)a)r3C@4h49=u&2@#|zl2ZGmm)_X?sHBSTdeLagj3
z=W}pzcRhu#>$0v_vR_+$XKIOdW{p}2EQtoe;lj@mI(?@HGc)>`&>sgCvE%~JrS1yE
z!Ju~MF$w9kI0u*Clj5wCw1dUlw;JKZ&;tk{oR5x}0UJ{iRwie#<o%tr<Wy9zE_JeJ
zY}Df{aTt?2Tis5Y{f;s1>dO06pQ_8WTBIC4nYzC3>GVs5?d@`Lg<D^@+vkLZ_I;CN
zyye<Y6BTdAbX7Q|UvOANt24T{^W_;JC)JZK#qAXl-A=r-JRijq@*NWfRPzH0Mus$V
z?$)2Wo#Fdj#q;Y-cA8jizR8HWmVN$X&uH_OrHs|zo2brl9=+L^|Ah^7k&5hayt-aI
zFb+sOi{lkq2{o@(z!RDn2?~5f)BG0UED4=4v#^UpNH?s`kOa3j5(+Oc`KB71Yocm?
z3;n?*<Xz7qj9VmDZ$e<!dIZsxhvj=PDD=Q=cXI~JeY8r?RqEJZ3pJym6P_naM{-&8
z9tMWK(;}wbT{()cIC~eyz5xy&J=9P#A8q;6p;vO}R>F=njKcwFDuf*-rsW7qT|KvX
z|10av$wS*i;vLcYiqtu{R>06<*d7rqMsx0#sn;$xaEbRHKYuAdI!!Ua*HmJ)@U=(<
zGs}MD1kPt}>>q~m$_M4O{>*!if=5e~A9iiDE7D%;9<REFR}KdlEJJr{AuQ^a^(js6
z=0(=2V<V}m<(2poO5k2a@NK_9<MbKXlH406kQ`(#y{n&$<`TJ-YN^2L3$`IL5F-@&
zcwSt!3Y>ahl&@m%7*D7K@6p)|*A@1he#r?v_sBozzP_&D>$mpt2MM<w^m9*%eN<~L
zkv4f>&Ahay8x0mFc9P2GI0tqC?2MJq;xx4&dXI<+xBa5O8#54r>cc(8@lQt(#!?*o
zQ-(ZKvqp?yat`&2*JqG(C$x(0Z&&_&41l`_*NkP>ulq6s)IrN@z{%E$J#E%mR$T4-
zD>PdynA^Q$AQexV`ZFSLXK>!EBut$E8n4w<^F_*vs=>OveolTuc!5H_d4DmY#^7sD
zNvn)hhJ;H^gl*h_`ys6&SdKe$#|?!8T1G*aI(-x_LdU4bN{zp*D{`30F=g4ST3KI_
ze{!Mu?S;%_4-237XqzH&lV2&O+4?uk`@5LF{LSpa5`04Im&dn$88aQ1eIl)lvz2-l
zsSnc2EB9C9jQ6LaQxTT^irAC*5JJua@d?KclT!Q)-U;*|>fQP{TpnItd7WFoZ+-Q?
zfopZqx9=Mv?z{JRb$+33wuEUEN$o?CKhP9pN-feB1%3L?<6_Il<k)$4VJ&5$aQ9u+
z2@YUvev7v5n;rN9OA%LN`L8bVtsc8MNDs1|bn}M?lEfW7|IQ5ITRRyXGI?~z`mErE
z#!K{+f_hN7FZl%v%S%F*_6)8agAF1$G|lN+8G?85#7^tI=>_fxoW6!fAgUeP&qmD2
zBU4Qgq<nescFuhk<;r92(AQ;0>tse1>s&xLatWK9*Mp9KfXuy^_P%|(KGVE+nzAPA
ze^9rDlfw(FR%G4MWEEn-23~d8|8r7C*&n-K#I;y)*yUBY2Q#!Fhbsy*6=%)+2d?)@
z)HOi6JmHO%!M~L4xEPUF>-x<!oAeaYKmXm=HP`tS(^j^(tGxi=?tr_Hzmv*33j2KY
zX46r}Uyh4k=>ktvnGn3B2^vQ8?rtqOvjfB_zrf%M&ESd<r4YmNN`gcA5&1q)8Uecg
z=T5<XPMU_7O4#wJn`i7`d>A-k$K0(zEV+B+e_gXf&$;cwDZw+<w2wCK?0L*jL29gD
zbN84$k?-5Nj$ItNjUfvOu13#*4phG@gGa|h`gIFF^#Y!W>Kcd=pD@-M2jvon7vL9g
zm*Z`BZJ>pvL!mh6&*jIU)ALj6OmF5+M!F^cWJgRh5_twA!Ao@8oc(qSLI%YiDvZ@{
z13gXVx0DSZSk*Oh)jtf>d*T})f0pLKkiqCQ3km{U;<}U_>77)YGYB4jI{4R{iyLc&
zBf^m5j6d6V+VX3w<=<1KuFsY-W)dgL-Q!E`fVHmM+iutQPO0}w#U<DP%h-DraxCfF
zLLL2Sek(W~6Ouj?hmiuk@BM*s<I3BBghS)ceA~CdPg@H@A%jJ9H>2d85VN)x6CB-T
zV1wEzS4jgLB6cSC(k_3Z`6~Ro)^x^fyiSC^(EFH#uX;ine(M)V4mM3YhO^}`?}umS
zE~gd~d;gCG`hSM`KZ0u!uFws}X5@Wbnf-Av%?`bn)%bB9KD~%GcO{o1^0EzVpGd5~
z(DJ9TN09cI><}cd(6p!U9BhK`if)WwAo<gaxi=>%y$PV5^V%DOjY6$m6>1rphwX8E
zPRB7?Fgn|zEM3>qQ&L`8%iOU4xI5$_jHvE|FPdHXf%0^fETqpE-v_#J;&YjL^eejZ
zjPHYgfQJyn#3$U}kMF(#!D{fr=fN|2DL?+_byKDTm6z7n@3t~+UvpN&;x0MF)AW^(
z<i9EvEM$Ecn9?%DMDxx<p6{JgJ4=@Q0(0#dmQM47Ua|7Z=IgP-U;tWN=$ZXj&`P>W
zJOd(<H&pkO#7_t?ZrEsf+C>kLGGpYJc_hVEaVx<g&nu)lN343UdH=KiTI?12_r;XB
zcu9SpA>ga>P9efMg!6IWp9v46W9mR)hr+`|rkeMHkMSiYj`Sco?~1}5K>gzOJGk-$
zo<63fJelhHU_;)Rw7LVQ{k53=Yr08KR<t@}wj^hEl9@wC&piY@f(1o~?AZzLu>o!<
zI@FmDn8sC<S6&-dX39!;0r%Z6&;59@W$F~<F5;^h(<jVXz(0vs?uJaR9jrNVXMKR!
z;(LA1DjKMOKkhS+v$*?|_VHUc1%FzNtKfi9UH{9Ba6|!en6k04{5nX}aADvw`h!Zx
zkr31f)@=Cp7EfC@;&c%Hp31iizz8}yOvAF-K*cj%WP6m_m1A0+UWwQDtd~0Zz=|=K
zDYERq)@5`Yr0HE%#$DU!c4&7=SN^7met}}c#0((}fz9XuFYdODq*D=81QZ)gU2f`q
zp+zQHtceuXqu#4%uShJrX3@ieE8yow7=uof4Lu&`pA8fE{cSU=wHRT8;%rVD^srow
z5uKqSm%%Zim@i+B2YJ#Z?(z_Erq+cMNE|Vk{PEit;G~ZG5!jf&K}+5|YN=niX#?FL
zb}{I!{`%--y?4!_oE?-r3nO}*q9cL4l3+4>TP^U9{aiA{b{9pOv<K@XAl$ADBA%d9
z(SxolAmSC}h}<E2(e3*ZjI4M?vly~(gS<B|O5ZDS$9Dy&C6BQ3N=p%wQi15bzZc#6
zVRg|CYDo+a-gM>ABU9rk#$YjuwIO&Ub9XcE32$i8MWGV4*~wk5;BLEIB-s#I$O-hw
z>bYlt>NPsx>`TO&;{<S`=KYTHeH_say{tgPg$$zW4CcWtE3F*zJnK=w0f*hI>n?HB
zt?#{8bp!U97NO!p?|jpUo^=`B#SzzJmlLcGo*V^^jr`RGZU{!S4^msM@CgNOO)&Y#
zFBdjC>I|Ongb@snXNqU2w(X1iW+9-;%n{dYpJN(ORvR_iRd^SrobFlbwvh+rreSUn
zI?7yF7_cnSI*u!tTQIIa16e(#9x-=D!D@EfHjsw^?GDwzdhx{d-xHVcj_waY&Rqfj
zbo?{trpt~MAET}bf8#=$I1}Nn@_vG^H5EXmx!o6tqU*OC6g!92R{@Y#<PEJz6}&J_
z$^9m7)i1sG`^XF~4&s^Bd$kfmxUh>V_&*`*k@5*c^Dpn_7}L4ldb6Jvv~qb9jQD$F
zfiSRsKkgqs^>_eGDdz2!4F|<Q=Z+D`3h0qJQV_1qP7%e0(Zg1?<7w*s5gs5{)1$;+
zCa3ALj!?AJ%C2`(-Ya6lW?1Bhd<Q;o>a*;-w9_wXJ{|9SBb~uB1p}m=$DMZEO2ufu
zNXeO|yUZJQc#H4Csv|K|N!s>+n1}p_=12PTU^1%T8fU;0u*a}VVLze$%?pvJ&L-rI
z0Q}aOgCEOY$_C%;j(ht)vy$$>t<nXoitPnQnK<en2&<M)oCiNo)0Np+Nd)(ZFt243
zgu(Mz?NpaqnpT+?y~$=5NHhYkg?&{h<lZB{0`~rmUf1m?UMVCW3rj!(AkbL1km(u=
z0VBQhiuUW;TcGOoWudh&^|;37v3#qG7u}E?jVZ(24pBki&wekpEl&xbN0P@oUWk}e
z>>Ovc(}0l8@->T?!*(F$k8I2C|BU~eZ}^nfd-m2cb&ED`cHsD~1#f6C0>G>H%qp<V
z6C?OuX|eRAI}Yn-KG?9OtasuQeol3xJLp;4tW;Y5&g}0u0JzV2xBS)^^W%RgZx99+
zBtTIveHd5|f2bi|?i&DMX}{M~T<ef6^iT4^RUaK-|BF{(yzM^2cOir+pV)M$=t2Oh
z<dc$l{{kmr`JyxAHWsmY<}7|yT#$+uin<e{DT6WV7wg^wk3oD}?$C*Fry}17*;ZtO
z&l)A$UfXc%68P+zv7R3M(mohC)iq#52Lpx3fO_$p(9W#eSy|b11z9D$amg-@o~rFS
zpgATP8utnEhOsX_K~Bc)gNu5F1JO%_h}KHr>_g%7y*+m5U!8D4N(LK|?ny8R-JUw6
zj__QfAe!msL?MJvyiAql5HUG3B`^{}^BbGu*hcB0t7If?x7~}$?&#?$DB;i;V;J_i
zD+CbR#aV%|ywwxXgoE+e^**F+`>N|S@t&#|_x;|v;yQgPC{)kHDFQg?Eb{6@#xoku
zHkHlc3F?!P1Mb?<*6xym2_+i%a4jdh8!<E=(jmldJT+_wH}5a#(4aP|%0StplzCfc
zAc$6j$5YO%|MVN~)lW<6+e+()+(=r5zX{~p_F(`A)15kXzN`=hw)~}`Hv~a0K5iYY
z*E1B&Ez%wO0$hwrvuGV5`^VqKqst+pAhKL&Ohv>8JQI2&)bqIU3QJOuta$XqdY9t*
zcvbA7HfG{!!?v^Zue(f~Q&TnZWa1dpH@KlY4SCLfLU3qWpi6eXxTEn%ypMIL3h>5x
zd>MID_i4E3j#dwiRe}O#_<X8e^|)b#J8|;ktA4;+?cc9+Wj!QnP+YZdBkTdQqB8P6
zw%asx;65@4-5YAxO<5AkN0&@?l%i1=l)xDlaLEyPh@Mn0GwcRg!JVQQ#cmI(G}|r?
zoeKLC%PuaXdZy^GIy5qFByYb@QmkHtJF9^ELlk{(cVajEHX2;|X<yuVByQnHYHs0m
zg=n|9#mIKM@=A?{m!y^q8mXe#rnJHP3f}$k&q|^q*jyH2d(WL(R0JjZlRpV(cb;4>
z99vMco17Qzp)|{x|3%`Mn%U(ZKEWv>ay40)1}lvO)gPxi+=N^gg<$ZrQ;m%A?)Sx_
z7gf|eITU9DmS?G?>}+>}GKEkZjTF&RHXcwo1K=B!Bxm5hD&UN91tFS%IqJ(f+|#e=
zl!8L>D$e56ruV7gF~l2v!0y5nxwiowH^RBXHu#v{lXP(_d&oOz3RmaPTB)A;W(heN
zL3Gih$Vb!~)A=^!=R@1L%unMaA5=-eGrs>#CM9A6<pD0dxz#Ella9*y*E_Xq{GrPO
z_Fl`rSXN}zpFu4J&ZEoiS+XH9Cqls=?X?QHLPyMZlvU+o+e=PrJPgECx$RnBh7NNb
zjEP#1m9{Tpiy`SL%;3{B9V}AdyE#JlIlA)s0ss%L;NM&JeaCNTwPo8B9m`fF1TbJE
znP8Z$F1u*yu=0ZYUa6eoDT?a+0p;j}{nGJL&J$KttXOA+=w}{>FFfL|rsn;3uXSgH
zI?;58MNlcN-JUlMq^l1|PrYg*19j_@O0<iks+kO#K8~cLF+b{za9kp)IcH+h!Ese%
zlLr#+X^wcuG{RHy370(Nm)y~s%6J=;)1#JR;}{CyXpJqB+C?WEM#&1`1(vubrG<Y0
zJ(d7}wY=We^;eLopbAVLb9bMRS5<Cj+&qz*^!<nwQXzq!5>_GPbX3V65$>PeFEJ?Q
z;B*G(U)tw;OX25=lL;W#Il3cC<r@vJ7s2g+c81H?wFKA2(6j9P@Ef~E_zYz4SMsL0
zLj~*kL&m>2Oh0fO@3vA(uS(Xe7uM>0KWCJG3oHsg1_rP$3wIesiIq5U5J-vek4ph}
zf#N;Zt}Pk@x6j(?&bm@V@e>32Og^nfLKYoR+|&zy5TMYtiUHYmE%y7Z%d^UI)&TH}
zi9JcEh%3}8>bP5!w>Ke<@+r!Fxv_L^)_%E9jH)O#l5JBo#P3aybtZ*@H#-)jvMoNp
zDqOB#3=8erDYpD$*6V!Rt-<A{F*S_^(+GD%mp1Ho8mmKWJht~n;ORa&?+*6P;j#{k
zBD;yZrbO>?j?xR@3860VSZ6YOTB_q2;!Fi6@5j#$j&7dsDN|$A<Z>>l>B#Jk0_+q>
zu;Zn3(;;$%JDix0J$Fw&4K7N_9~!_)4)cBL=fhEp!@w;Fv8s8lg{9N;>5FRd@aBq<
zl2b#ShHA4KCew+!if-YKx)JW4es8v~-)VqhECIBmvvSQWAH>5CU2gn1Z}c|Go~T36
z?h&VBs0oik9Ls**_dj<Yzf^pQ!=NWJcWfH49#m$I`U4YeK96XQcL<JrxSOE<&5r4y
zwE1FOb*qU6x<3eIc`UY0$h?1u$1c%EkjktEu4%#YG%S7WJeEosja%%jg)SYwsd}g9
z?Py)0sJ&kxyVzB$Z8W^uKLo#SlzwJvfP3&_i4}r$mFP{ro|$^7xErLwV-IvYdSA>E
zmyiqjiCY{mko@ELz0pO~7gHYfs`HX=g}XTF|Coa9TyL7-xW?MXk9(*KYu#(D8IU0F
zVp#B`=GKchST0(6)4>HE7i8)&(bK*2eUtm>GN<zw_c|Bq2z8NJ&io8DHM!J*BfcR&
z_yP_g1n!+celzE{QiFhHtg0aP4l;h8ja;Ngm}Fmm=F`Wga)r1Xny%r`0;UUp^{|h$
z$7G9U-|^vXmu(%8bhhghYsjbEp^D1mRg%RW`7fd<2DE6PjDC!!s!{X;rco7B<P)&w
zdBDXARE&~+YVm5z@ff>ogl+p`lhG*@+AY$=?xfE&p>#miu^-+4V#K&P|6yRR-lL1_
zj|c<kXtr||I=UBc<=S~?`$_C}2g44cVaaTAq?ObQE4r3<^N2aQ_KQd8_=!pyH5#95
z=#PqBYzh9*!SCLBd%V?%%e<fWkM2HpN0wlOSBz@OxtBAS|Lniyun?m*BcbT_st!n^
zn=!XVSV3t*AqF^ICB@kkZo7wFGqt{=bAYyV|3{Hy%L*DWh2MXeu#jIOEf)iBWNnt{
zJY!X<0Jj`n90-m+aEN@z=KHt2jHTB4L{!%aQ^$1RxSrLZcs2x%E!#TQQaTdr2cNm>
zQt!_P9JeR<1*Q|VzpPW^_s9v0`_eBp{ZTf?_=h3*iNzWAq94STba8XdrJqbBAhqiO
z$mk^~HE}PvqyUZpJKK4g|75~HKTJBRrCiK@>boj2WT`@Ep)<8kTgB5hC#Nkr-BH+j
zFR6R!SzKY@y`TA0-%IREYQA{`%zd<W1kqU1O120df?GZeG>n=y*FqmUJ%Slbn$n1H
zR|NA2K!k9hU-JJU_yVjJIovm=7ANs%B}H{&K8jX=JEh|WrQHA5Zi;Amskq`J(4wVB
z=-f#~bm(O?UxWI=AnCZmYWJ9fLDAp(#}>c(<OM!)s#ey^4VXu<3W8^m&KFe(_0tx-
z;Erk$cYJtqd67a*Ax%`W`}qYX&wfHUmq(B7LPjadsdFw_==HGq{arc)_S0wIi@Gkg
zBZEKmhV;uT1GrP9w$gFH^n|pPh-&|@O0b`Ft$hmKPcWXdg&zrEN(B}9R&6!R><4?*
z_f;Tih`b$JvGJC;J#Ad8aMQ%zeX#{)s{BKX%TlByR!V*6b-INHbf{V#8D%_ik%}qj
z$~a}2nJ4oyZn34-XNr9}?B?G`{4xFu`X@+$7+l#<JfjD@X?hwjLnt3qjdC8{-UA4+
zPZKXnl<=OnSme1yMgxvdQdx|DNN%h0SrA%6WO6p=A1QrvP^;6wsS~^o1`&!ng;*@c
z@X%!?OOYNfaQjs(Hm>0&q_)wT=_a1hr3(+l7MG93L<!n06wdqDc8pGjQj6mXmt@#7
zImhC-@sl<+l>c)x8~1{T+8nu<&HG8<0?$=msAI-w#(wdPg!P2g@>iVT!WSZo-j9z6
zWg>}bzsAeCLRIpPOipG)&I+#en>q)|>E|D?q^j9Mmr*q5bAT)$mJt`foZq_8keL|S
zQJ^T7jXb4`pTX?SVu~T*<=cC)`(T_Rszv8xcHN_;3dx}fxl$ZH9qcg4%fSBVc4~A+
z!^oosRa(B+K$eU=MOl!gh6WxwL-c3wgT}xmdMW0Xice@s)|;=#)W9R%30j5o>2mUi
zv^x7w?uQRgLy)xUWrqTxaz?U;UO(tWmPW+PMQ@EsLY->9GkU7Ry^dOOFT~30Wm<h_
z)#B#}KnuNN>yW3=fW~yj)EjUc$EUHS<<Pw4ON&<lzMEFnf6zVO$BrJA{Y%1fFsC6S
z#RV1FE{mD3%8y8tm)2%=x#sWD4k~`EiTP+zT6HN_)=uEAW&d1LwD^Sd@<Y2lBC#Rn
ztP3X=&RG9{jJ<bM6WH?yYC%B-X)9f@qDUuFrKpIy62%G#p$mvKW9TL5svy#=^kM^K
zX(CcW6$nHrp%Y2~NhA>hfzSd3$h%1v%lDo4JMSF+;H<03y?5sGnfc7zJ3Up{DCL&=
z<sdMHgz0??Z%z^=SFLVVZbu1E9d!MM!8-!+!g_D<<$un|gpl6GR1y1<f~qEI&O<}z
z2D>)@&PB(55-(2DR%Y>wCwNse%xOtLm!r7*SNM_X!86fI$$K9on(}B;`H-v0_XzQo
z?jD;vX^oSm+^`4XzI*m&D-$@2hg09P%8e%E3ow(1z^)6nx~t8}OTD&a=#=EUmNPRO
zqP(*ZTL}FlU!{O-lV^R3`tI(35PYnK#VpzltCiA*@uj=hzUSY*aa$`c4qWYNm>h>W
zcpuYEaL5so9SV=cpHKzqA$uIcvBPEielH)q+VYEB3hbN+l!BzX2QFh`98PIW=D)AS
zOI~vmanX<Avv{{LrHRJ^-R$n<DNh{g5K}2uszoc_Y|f>yvk={2yzaWe;*Nr___kCw
ze=L3qC2Au#j<2ekWXkB2GN8edO@2<Vw7l}t?t6qOUnxBdttdL}Ho5}VWrL2_aFPb+
z*oJaqd1)yY<Y1WFkFDcpD^)K+zqU?N`q!9NQAzn%h(6xbz%+)s@TvGmq*zu0_oI1|
za%sD;r_GUrzu!{$Y_~3KeVgCfYobT5Pl~TpXzqQhS3MdSk|?h6Ry>xYnEO?TE&Erf
zyzKO%R$r*oj<wT>iyeGr#3v)s!0j2rc&<EH!MeV+#v9b!DAl^iOfi@twD_(xD-R(*
zsCDCG_I&dV9^auEGULFcx3IVXgpNvj%w=b5)Y2fX3i(JCh)60Yy=oqFYHBw54biP<
z_=J-Z{B(T(0gA@#H?87oC6vw0YBnSx4Q{q~7g^;FbeAlZy+f3rh~W9_%oDG#0g>81
zX5<WT%6NLvBBbyKesT0^fe!s_^<_}cezkI}>orSNFHc5Bf&9*k7Xvf196S?Ws<`%`
z=U6)8O6yKV47ilDeDVjrdS$}61ibHtaIoaE&WxSEoWe+}T1yKF8P}#yBkc%=;q6B9
zmfM95e5RI4lmaeu|Jg7n^b7ItCL}BdOf1;W<XmsyB>Hv9A)_TBj2`g7Ng0E;P<yio
zN=oe&B3P`QUoS0SMB|iX4Iy{a7TO5%!9(Jq4Kg9EtwTygZ{4@nOJ$Z}y#`JrixW+C
zPF_Jg!geEmr=J`c7rQqCi><A@ccMZ$viGnVmm6*(-!j!WUduaibe@w%n#hQ*Qw7=^
zNZHa-C0$a3h_G1W;DObH(RtX(>I>)No4|8YZ9$e%gVhV&W**gIq7s^Ew9&q<l7h&9
zmA-1)vRl)oxGpd(qU}<eWeQ_NS^piva5na+M-GL8e;Z_{v<R5HvTPQs1k~g~iK-j;
z%F`2*-dyARph2Jh-utGCmaYxl8h4XLGC3}I9#2((ww=}IR|CVblgp?v_l7&!1;@rk
zM@G6z$Ho>a@l{wpJ_cwbb8qwHYq97+T_->5iK3tK?`X{p=QfTzI1Xcw^;c(t=?07Q
zA>d{pjb=d0omyQoSm+H*Tirjrk|M*b3!&!gF~h3n1Hmmp{RJwSd7R6fxP%rqsUCeA
zNFQ4HvR~74{D@k9+zC)hvnD~KxBpQR{)_D>NroezDSRq`#tJO^U-b=uS{SRrBbgM`
zY?|7DP$+joNVJQ;|DjYq@_3E1$YfDv;PjO?yM`*pA%l`zcQqQy^2U<$!&n*ra2Do@
zGCqjGZCw_8`tH8e;km9I{NuZv5P2rVrI2NGoXmqz8_f^ZNMVR+g}$p%^C^6Asz*{~
z)HcJ>U9w7NHL{gX0h!x3`*{Dw;X&f^+fZ<^L$`JQD(hrjC63ucdGr{Es>z1@bJQa6
z5VJj9ykB|VCP>h|Mfq{Pvd6pP7DqGU=@bY|aQ=MCfMUqaeq(Qs2XX|9T{ZvUD2(|e
z=9B>wd4f`mN#ARY-nk=ly%zvX=Qunzp%3~ISRFc@7$b0=nA<lM3~B>FnR@Ygb*(CJ
zNol|+IA)|fzYF@1!Te`BuYo2q!M;Ub$iZrS02Ydk!Yw(XVAlU4>gvw(4bu_jHqkp$
zB=tSU@nMyChm}UyCzJ~9u3O=<Jr}#sWyAYc^Y^goo5e49-Y8O2vmbjy&^tOIvFB*D
zg@G9-sOlsdHQyHAcpusJM)Cl)O5gFgZ_AIPZ#v(#^zFXTvUtoaE&SUTV#o+)D!$cD
z_l%XAo1pjKn{^rk58b47?I;-;;j#P<i6Wa<P1V^{q=ZjK9XGNa<l8}}z=o|-J>pOw
z-j8SjX=q$$Dsb~XPS!{yT&hFAMhpWb?KQ$CsbMc@8d~grrM>LP!zV<)`<h8euz9tE
zPwVt>1M*<7BxTtqc}H&Gt%hM_U*0P7#OF6}y$xHPKJQ}<>*C!t++Maj*s=pPyxOEJ
z>g93!0PvOPnzWEAeJto!=PM$0|HTDJ-m=A`ud&qYdqOyPlQO|?+4~wR7B7lAl<7s)
z&J8?A%)s)wOAe7WSI}`D&a-;z#3@+sspC4E(Swe-CcSj{@cj2o8~)R2?ck|jNWN|x
zia$<|{ZW`MR4w|-rxdymtK+JCpz_aWheV9l(`}a<u&T&D9fyUF`?o#@y;<a@y3qc*
zsaAH?f_A(7W&crqu9yUc+T<ula1i>w_jkFR#FTYFoZXv7pUE81kAGS!{Ne28GReG0
zINH6g;eh2G{7xQ$?<c^)1XCs3>|S9g$^KeUhEQzJV7*bi-zA#wllwBP7L4KD21>iH
ztb-dDjvWVgAj{|0S}PYDHwO>kP!2^@Ly3ZH-zlcOQK+K5xJ;SywafwWa6_VqmxtyJ
z!THBD6>2A8-q2zdWC9-dMN*y^{lNQmpyKGDaC!f1dwq5vTN4~58Z#|~*6LXjh*U=_
z$P77hzyjk2A2S39A^w-i89OJG3~?D6&7)6x&dX>X_0Ww2so(NaZi6BSLDD2`UPyMK
zcFUAd$iNL+xd|38kW@<b9-OQ)iIAZ}BW#*hIRtjQ1sW7jGQ0FEHM}>uUKIK^fBFp9
zWVG0UXdU2<tx3<ez2p!zteiO=rcVbWTOcJy-`==t(QRT>Upe#?tK4R6^;!vng_~XJ
zdHB^|QtARxJ8o*JZ(x4#iBUXw@YtKS2>L~rG_=6u;&kVaJe}GLf7fX{ZArY0eOn2#
z$H0fBOd)oYLQJ`Jii9E9?wu*1Yin!;WDU_HS!<}#;<n&H<(8BVRF)?M)^0Pj&GIiV
zst_=6Bp`_?%0NdP$zGxPOb}eDF<FOxV(FMoJfl5^+0$ZXW2MAZ={TSq>;c+jvYT~o
zfyB$o9tJB5!FjFhZ-q+PBnr!>=CwZv&vY>FjBisk_KQE50=!4xV=XN})7x%*aE0l!
z1bns{Ex4DEmsyUEGfV{{A1O+?X}$vARwgKW!9)}34UrxhLy{RG^Y5^$AXWAf);C^8
zS>Y@6hYtbO{$jY|i#LDCdc3wC|6OUgm-4foKdT9zH2=b_KO<R-=3ZIq-m4G2p2pdF
zyq}=V1*32J&TbSXu-7;*B?;`H_<&B~$vM6ssLl0YW}r!QV*S3xWD-KGjrO`RB>>NF
z&Q*<Dl&h8tE?A(0lIW?^rdG{tAc5nuuQ&_=ECJCTHsu>=JJHoj9e-=-zC%$HFz)7s
zG^<?3#rJRC!9kYj{`rmMN1m2rCE!wp!BI=gLpPs}Jm$4PyEQL8dNut78}+K-cKuNx
zGnpyw@x5BQP(&3PDa_52vrN(4R0KXi!^yMTM?D#oFRiE#M7AmR&ckQt<)Q-5$SinM
zSD9CcBsDK;vW>vDlvJDOV|0q-Yj0w}vzWGzg8^P4!Ta_3{jA8y!3P3nND*0R#eO+d
z_M4&qCTbwe>P^jmneaxQiJzqxYfnyObW0_~^@t${v1!Ttn>G2!Ycnr4>dD>^WOzl9
zRnmw{R%y$%3K`VNR(%YwyLiqQN9UemkG6f|!WlPLPT9n_r1$k(lXrIdkC*NT%@dB-
zO}?`AN{mf@XhS-O8B>nc$gu<O@ifc)n1xBoz@mYZoPIi@eB;9tEdvQDrP;o$fHc8~
zyf*4=BhghV`0o#FuSlXsDrmeGcf61?usR=w%h&dzUbWsXjC(6Ww|WM4GP$NOYt<)a
z%3ubF(+EJpR&QC6`3F+Le*G!AF}%5N5jN^?5vqwmdw0ng89QH(np#Y-ky@#RnUNbr
zDFkL);cIwZCkR=&bpZHK!&1PDo5{Omhf2z>2K>Hrfc@yd0AQ<mbAxzc+(Ys5dWe3`
zAfW<|RY}Q6JUqnQO6R1T741$Ai;^dD_HNec3DZtG?Nvopl8G-F6j!9S&M+{{q1M5z
zkBnvKUR-aNZnhWPNI3aOtC`eMXc-gMxC&g!;6A-PUo{nTn}i3gvk%6-I3-x+a_g53
zsfu;zkU8bG)g-@A5^rwh!fb0bGpz$<hAn*o0~z@cw{Vk1oZ#uQQ)K;j{N?=%$PWY`
z#%kK#wTw*b(r%RahcAu*2Tt1J?1k*QxtDz&^qdct+(__CIYHp|9^+ETctPo3{<NSE
zq}C&?f}22lga^#QlEQSwIX5MQm+ScMFkwkrrvWTPkMswxb<D1I%LI+kojXxma+CTO
zB#{JT{-d5jaF55SL8LThQq3MX))YUFFdS%LT2(TR6Ni)$T((Q7*=eiz_;bIj=|EU-
z``NHnF(l9n#&hsoMRVs&EloQ=2tTxSx01SWT)zQFml`D+J=l3}>s-iENyxHKaD1^{
z4{2sE(dY0@cu26^+2l~K2mj=cP>xkkJ?9ToD1-b}O?LJSp(;avBm*oM<Tv-aFH(~r
z=d`HqeRD~#7JdFvbCf(#BITh$OY{F4_;`rRMypJfgnUcyHbgHStf3>BXY$HI7gTj;
z!27nH4BN?-ZRdporiD@h!-w?J5&265*pK!_$EX1nIMPljF2!c}(M2P=sMfMhNp`oD
zD`^zORSiM~3E*8e&{(DGJ`qki!F8*IXQn~hkl28Tm<{UztOj%-XLg7VJbS*|%ya(R
z4KVRch`y=bP>0^HjMY1;dTP1U*~<fDp5rhZSV9~aDb~Vse%GHp1<_Hzw2`gF+l4U-
zB6dpkkjOMe-kT6MbJ-=b;geA2GX<KM4@A!|>F^EIJTa1JqdUt+EB}QKRMUll*MVma
zR`KNqP9drnPJgzyEiPUeBPX})YaB@Vx{o5*w0O6fR|E%ldLIRv9C9y^vsQtOa2GdM
z;GC@j|A8-+u7~73A6|4f_z>`(r5kZ%yuFGSJC}Ksyu3Ze`|}#2a8|*+A-k)K;pIx|
z)YT95SvDg)gMluu7HeAd)3%wv18L<z7kN;*xe|o)zE81vS%bF}BLFg=YrO=buuayT
z`306OP$?XGYHc*ma}~d`E4oO}3YajPBkgi6-dW~}xn=@SmnadHm0sQzJ?8_&7TT6@
z-?c9h{0vlza^q+YdQiD3eTXj##C=nYY0)u!!l4h~UHXf^_k06-I{LGCpRf5DIgV1!
zll~rc{lLCgadreA3pcyt?8qQbH6fpqroeDiJ2CJ+q+g0%1XYa>|9o!*qflr#G<=Hr
zmses-Ism=sw0FmBsEgBUJ+{~c`Q;|YX)g(^%Sk#YR)i`j@j+tb$n8KR^f-CL0~XGv
zsafJ0isr@MV_xAii^`isUWecU8kU;ZWi?&g8P~owd_+FJ9Tl7_8Q^=CoVxuwZ%cn{
zqVI$<9KSY!&^!eLL%!gKJAkG$(@<8`(=rpS=c_pRDeMjq#1sURz`zi8rjb`*iG@l@
zXo7hQk;>^gyAMQzYLW@jgryK=I+Su-2{{-+4|LKIU{CpjU6eN0(<|`^9Zjsk*384i
zNoCJ>JuQyogY=b&+ziF@J1=#iOpuMr%~8|sm`~?@K~=};LB`|XbBqm}FsIi8Tp(-N
z^_==(cYaorH=7<znB}iU3m%ESIMP2V0F+!!tNn5|oPO-ms=?~n)#?DuUFz2G&d6x*
zRTbKOrg5RL!F=u4zVQ8Sa1YWOp7;8TU&$&-owu=$htA^F)4*h-CXYv2jqKZ7moj`8
zHa5ZWLZBL|lajf>?!X{6ytv{p1&S4=B2G`V;^0x&<<BOQRe_GN#se5<`YJQWeSnQK
zULL?ui&4$<{9f+J6H0NxDS-yJpVo}L216+F>$&OtULK+HWlcaz%ZAT3Ayn61c;)RG
zR$Bq}yE9|j=NJ}r{A#c}?vX@OVLf=$c6A58Ch$c^*nZsH3n0d!kf0cK-yzDuFbmr5
z`!+u#W3qZ@RNzzW<b%gybMAS{FEh)j8fTNsG*<DcV2FjLw+G!AA%0*d&}+z5DkZ$t
z55wiI{tvaC{~2RZ`2JCG>(K}vo*ik`{p$c${4p*y#XNp7V94uybx;ZiE|z_&SNl*h
zjNZeu+EG8aojf#Q@L{j2ltIE;>xs0amVHn#(a<m+UD9wTv1QP)iuypI!!P=YQK&qX
zOEERz#1p@J*A?t51b#PWO1@dv`JSD^VHrD9lJ*i{tT>=-byqa+vQlN_op_){f!2;p
zhxlN)aucs9z->@NRGRvM=e;@?2O9lY*%cNESJF>b9{EeR;w{2(m{j-{4h~jAbIxO{
z!psf?ig(aTC(gT5TNzqWaLSDYrs)p84h$r=mBMdEB!t%$PI8Cuhe|y+${CXniw3g3
zR%-IN2@8jHA9}hER4tF!Rcqk7i-HHsA7FQHrw=WSM)B_QjoY1@WE0!u7*IB%mx*2N
zWd5+}MD17tsoVdJ$e;D6pAMUM&+$D!R9Cm^xN^WNzScFN4WzWQ88;qtI!EJssDfNk
zNW5kegPFOM++_cL5&3zaldKGQNBcN!c<Ci``ia~MD8>ixw*@A4@3xVqZM$YF1e!eh
z7a^(Pd573jP=@-6$?%)YTAzI4wek*%@1ZI?WPD3EL=O^KIv;0mach+dhHoEav^dM%
zY`3BxCzIkx+il{@Pl1xMx9=tqp!sbx#fL^sF;`}@lv~olE+|c<r`%G?{E5RLphZSm
z1v(L?-8wN*0&rg+LTOdb=xBpKI6Y38N}clba$l{%`KST<?OA3Owlall-`wP9QIb+S
z3clunqBfsR-bm;w*JJH#gd^UU97me*j#ZrtqU&0>hJ~r9KKxT4I{s?gFF8W)Lr*hW
z(Bsi{g?;8vNeCBlQn$s{Pb#$e3OR8&M?TId3T(cMXuM06Xtjdq)QQ-gGKhbw)$#)b
zM^<qL_k2CX?-34TSPE+DP9f2g^;WYe&*NkT5%`)ACO4@e1#J>vy6q_nevsXwlo_M#
z8VYj%243{40G!V3&6HfU8uz~G!V=Iy*}#i;w!b>l@l)V<U)RS~$MOEPkMH37ZwR&`
zmNiN;vBBh+ip4T)i>;9o#J0T?_1d-ECb`Mh$X9%CgxK?iF6lsd(1o`iGcasYdo68-
z%PL%3p~;0pVKD>zLeB5C7Opq3vSCh+RywbByJd+OaVyv=iJ7?ug6$RNi4TiaVM!9c
z6W;}1d*Am}HJ&L?U75Rv^!PDIg?LllpDcbg8AOu2_>_hqc?LYfn){Dx=70I$-umH+
zi`)Om&4@p71FpGp(BXS#DuZyVaAVlltJ?*9aYj52inG^Q*zuzD1t(8S_2J)K=6aN6
z%SV$;6lJ!H*a&>|>pT-OLaJW=+?uMH8dzxVwOK^`0M=2g%}yUvz$kQlvFI_#>Q>f|
z7P89AV8byk2BLjBA4F#fcgt%=Iw*kb(@z3h1_I1aobYT~taZQD4+99vOrtQG@__6m
zE}~x&^a=q{z*{YBuGh;Q;4|}5_b?;xTy35k>VMxevt3v@b1mBYJEvA<<A6&}SR6E1
zLUHdU@bc5+vJkjwFF<%4OD?+g6fwFykQOu+jRo7h#zc(c+v;O7t0r#^n8z_i!K|zZ
zn{Pi_&*HmL<Z%xMD+`n{j#9clu>Rb^GqRW4A6Wct<9eG|#So7<Nb%!e6N1wgSNc@o
zToH9#7Ii@)EW$fDtH_CfgC?c7dWki<sFBsqlh&9h<W2FBa4Mu$WRS_o_vHI=G_f2^
zX?{_~ENm5*#ioUT2Aeqe%Hr`Hv?ql`j8dU(eod<HUKgo-d$tQRv#RHW>-WGzG6;(X
zc~OIHQ$qQMXMTc2sq^YwDt`zmx?$24tk@6?V{o;>G%zziQ4PUdzo~_PM6%#Sqz;&!
z2Igf;Pod5)T=cOcWY?!?>Oc5TwahDU1+fIK40&5?t<@Q8D%I5M>tdk!sgPA9L$g#=
zozTFxgXwCahv-;9GrLnHb$oJ)CvOdbJETz3^qz}&I^qg_!OMebjL3o`?0Il6N3|89
zD^JX4Te*N_N!S)PYx?KDs{Mk9>mN+xwVdAnz#b18_ip|kYp}WU-8L{bM9=e_(+y54
zyfmP9{(IgSJ~(BdRnd5Fgepb48P=};Y6l51?1z12B+&}bQ|UHdDfZ9@wKL@_hy^8Z
z?HS|^pxAUBbgb?+n2o4cfxGw+dNt=Jh4vDtsvz9|uPLD%nFzW0G?ASq)!V{7rj%rs
z4@P$tXZf~rDV!vq{_-XpK_8M1JY1~;|GVV6uQsPQ+@!i858MoZ^0xB{``S1^(Zbb>
z!ei&)v%P?$I5D-}k7rjLd85Si-Iq&Hy5zyw;!I@aIr4(K#|hBWV!7M_TiNcE%&2A>
zF#B4jsusMFRM(~%i}=MmM&#X&tc_zoUNJM&^LsIF!zRf3O_I-)sDIJ|s1Xqom4df;
zAmdm4N<S$!zd9NoXR)1~QHUpS9DT@#U+GlazLxKDBt)~5>e07G5}k%kVNRYqh$vfq
zvI)WQz1B&Q!P#xpme!~a^Sw~rLj1AsBLGpO{_e!QQ?EtC2jw4zn&d`MOf(mP?9qm0
zi81W%pIEQYsXY&!!fn@Jz~V5emNIrR+%~BcZl!?g&p`er)-m<$s&OB|jQGp(N*Bj~
zFN+_@v~s{DCTQgui2oJs$n+j#wlx?pmHLA&PnVT&*Blm3)BnBp5w9A3<CRvChm!KV
zPx;Wew$;F}G`)de7r)U!6Ns{J@wD`E-5zI~3`C(-9GIn}yk}`=z!%`ouP(mV_`T1x
z`1hKuDg@3Y*73y3Uff^|ww*W4Qq(}a@<!hSc1ub8e^>cD%eh5s?;=@zu;->AX*Rt9
zQE}+}H@PO24|T9AKA4x2n=vT=0g_40N4ru;WRU%cBz`DDu*-HPG9j@bdh&=C?_I7L
zX{%cG9%MQMu5HKQPY`rd6V@S1@yGi%MVb+g*9`VAVt8(?I*>8cl{EOxFi)~PNZ<(d
zCcdlUHQb@0_!(B+av%UEBI|J;;c+ePzuLXAG0+1o)Pn{tKhnaHKS~~nPKb<~jxEQ4
zIRl)-DSm~hULMcp-&BuVEX|6+-0Hi+co@p3m;?&tS@6!*N!KwkgvHGWy{;4Se)3km
zL;m2dG(@-rhrRXN192A>f5G5}2o*T)NeaVT>;(B_o#DW&^DDB_6=@STvGC?`s(Q1<
zfp<oXZI=2CAtmXrgFF&8M)WE}N978y&z&FBGS!7#70hR3AgT`iv+ufSlVbsB{5RF2
zzPDwwNhjuwQ5|}CVRMO0g^yuvI?k|$z{7Bw_N6-BWc6uqXxy^>YW~WCrvZ;ea%ZvO
z0J*C)D}fj<s1iMzMXVm$iCp&Q(+4u**$bvtU7YQ*a)?V!(E2n61cdqUy=5mx)+lRC
zaV6^+FwoQuIPIb^4orm_6U%!o-=l@e51xN%Ieb)oqW2=LAL+4Nvg#Na=KAfsRQ@0j
z5D%q&ua$zzq1mpBe@c3izZE-!zwNIsFbCjP@aSUwMRULAWt9(VE63=-J^=~ye)_pr
zao`d+m3eB&To?d#@D;x(W=l`8)S<GKFF4SvYZ~YMVvW<q)BEWLsAGD_9oO}-lG;Bv
zi3g*Rep!?Mq^F&~%d1k!551Sk4SK#i7N^p8)}p-+*RRI0ukI1XaJ>heWp~OP(i`C6
z1+!2b(q2zyA;=4Nh<-m&tMcY^)zQe~@E}#i&Gm6gxM>e#^5U`T8JQn=To3UhX!YOa
zq^Qmo<zdE@!`#2z?DNK7Mf8lC%Mjr+kM=sfIXk=5@7PQ#en67~cFAJP{c0Sxte6}k
zpKRu7=l?54{k3t!v;+l7FN)7<adTfShK+~V5jLM~tIuZNNd)uyif+U&f-baz0p%9&
z`*nte0>1RIs%Y`ylh3ic!HBS*u}0~O*xvC{!NXM=Hw!{D6jL1JbD{&R?FjWo-%ecM
zbTNH$o#=oFSCi|~Q1ghelW2#YOsrLHCtK?&Jq=nAF&`9jXXlfKgO*0E#_-Iv$`bxQ
z#bZsnCc$?#G@?FvJ$V}B_3GiqgN8+Q@7Bb!%-xN$YQM?^OGwpvJ>s>xst;{jaq#kc
z+I!yQY`}rYgm)7+?4#c0d@3-!kbcMB@xr6tf_K7KR1+gf_mw_G8g3z&s|aKShf?%V
zt$ohb^ng@=+WoGB6nbqP_?;S4l;@orXvG-96{b>l7`DY6^na94DlBgCDj_wY^s^(1
zi|6i!-+n%Oa}f@uwS0P{ecPY#z1<{e9{>5tF;w=h!?6;NFqp6Lho2i!b?jxWv69M{
z9Ek-B&-|X24C^WVsOgb=Tkls?Jo4BbgUslI{GHR+a71Ka)~;Ew8U3Sco@eegTva$f
z#>6rqJY>-sIUD-a@85g9111BXW-L7*1z1cYnzD31!A~#Lflpv$7Q~O#ci7z_PpS1&
z%;^&WMeiEA=i5-D+K~x<m5oH+lY6Rq932VsG?(m`;pykyi|piIW?Ib*d3jKSl$;3j
zD>cvx={lY=AN<y_c)2C~h<@N0tm?(()VlcaOIZVZZkJ9@Ox!NF9!O3r{O9)_*uWDh
z@F*=vqjMkW^XS+6xu&wn$uRwt7U;^d33BX1eJjxptUd|;@lu+*ZjZH)^2|axX3IcE
z_g9S5;}J5#u)dB-3QFrBZHMf!w32J0ZGzCw=F#9AHwE8>HKQrS4pS%l+)o-XJFWR4
zh(HXzyU|n4{QJ?rC_y>Uid2L6aGZnKHJkHG1pJUrTzCJ%h_Vx5%g1O#DK3Jm71Wku
z-xVt_EYE!m=I@vF)Etw5ZE=x}b!vcCL>qKCbN)8@!YUzIQK;aIz8U<;ku~*_9gu?k
zeZ5?p_H6j$XL7HA!IE2sQS-efVOz`i@S+*CpZ7>nn$2oz=EwXCV5_w~E6}k~n0{k|
z(GZees)El5J7c&RK3<s+XdD~RYmg&9)pUC^1l;ofSS3N{9P!`aUrI+{LT#sJDF!p$
ze>28<nIzE=&FqBum*F_XnZykcxU|%MO12rZ0b`ZoO4{C8d2l}0isBlw1YWHnHzC9z
z@Zf(7S|sXmWnfSA_1z293XtMh(>>A>kK-yzX5+z{4}%r|w_DeV|GH<2JnFqdK9VoC
zn<+66mQZ^B+TXb+HgFyP{m1sf@s;m|2_mZ8N+z##m&5Z@^Fw1HS=rZmNr_>Ks=*Vb
z_-tVZwr#)u&9);;#*BBw-nj5mP5%X~<)7~U#@Ww)_Y(XL0AAd1PyZ;(+~7yD6BaXv
zkZZ=`S4<^iPiPgTl~@hDLm+Z5Gy}s%z17~qTD1FG%ylF~<r+Eh>wfySqwBo@C8x3i
z$K(BQt$#P8cih+=rp1G1uUsjWwenBzM{g*eaSgR~x0$iVxYJw_;FM`+BsM~50la~2
z7S%IZtrr@}v27(jQOqTNrl%Kmr%k-@u&VH}XHn<>=g9Z8NpGS(Z*{UjOO@(w%m_<U
zQ~ItZ>{`FgSf8w9!+34toSoSp!9Ms0S-%ecn|tSd?}UdS^o13)2-O~JqGX!~C2`H|
z+;+1WJt^0?d<!4eP!Fv@RyE#|MRp(CX_4Dv`LGwl6Uf*-u+YiR#G<e*j)!}eDwg8i
zJN+Mm?9Q}uc6`UMA1Sm!J=ZmTY~Yzq;`6ULbp5{U)%bAAl_>X~!yFe!xKUq*Gy50@
z<zG~E>-}<eT|kgh0hW;Y!N!YG)78(}n9=&Za?gz-6suiz%pB!%Ez4G6QzY{mC_dxg
zcRl~R1u7@^AZPlZ5%HTnhq_wN-~IwkZaSNDP2t8fEysPur)INOE0~nbbVRo(gm!1h
zPq&a}9{6{~mw_p1(aQrjKDEVd3jO=X>?yCBcZEXu9Qy(pZZuyrdOxZGvt=FTu4%WR
zJ5ZU>x-4d9aZF3S!3v~0!O`2^Wi)JP;ZpMh`Dzt_b*o}fm)b`I)eCVU2tOLbU}7Bq
zy4{{aZ{E$A5rNP)UB~R*xrtV!BoD5MU(+^|js0qd0?(@{+LYheMHngY$s5sd8IxLq
zvA(Fz+SxFGOfhz+^pb9McG`sGZBNM#csKrKVNyFPq4%kq+op{I8-D+}x9}U#{X-9#
zYr6gnb&jWcS<fWps8Hb65$%B+4PTxH^=PXIE0d$*Uj4QY7u-AJ#44^S6l<9MSTR@*
zS!2|dq&gcBt^|J?WvU97WFDqu!(}8y4SScDj$|e*c30DAmZk?&ZwW|ChQ<W<JiZMa
zyJ{HGVh7H8ECLp6LD20$E!1mw7N?uu>J0V{*SHfk*ZUa?OS|P(c$&QjnZz$$Vo3-`
z0+Y5s<hH{#!t0HGUjug&cOObgl1~FRs~4gooR7IZZXWe%I6r8-uzU=k#<=g?hLW#V
zD36VZ4<EStvP<GmOxVD6ng?y7pX4Hl_%_33p7%1msP+L=<lIh5diR-<!`@ifIwUOJ
z_(gZnzKrgHxzFchBQ9^<VP(v}nAsH*Tuj{NM0g4#5;t)zx0M1P#k__&*^j|ibql@T
zj}6{fO3n1>J7ZH^NSs(TF<3dKS=`6W=_=}xc<k6^3#g1kS^D!`CHxDnQU}%Zyz=I}
z)8cV;*Zv0;JVwnEdgn6k<aE4V=s%K{Jxj7k5o23`ye-QD@)M0iFDrIkv>+d$&Oi27
zoNRzjoYl~{_b1KWJs$Ym%6s3YEsmq?_Tt6`Vk3($lZ)tA8b{VJL*(~>enu;3&&)NX
zU6sQ{{TYMA+86G_epFPQWq#%C^vB`F60*TdXZaHM>-NprZ>N5peq4N!zSF3h@NnA)
z{*~;y;iasSOq(obOiA_l?lo=e`DjV`;=$641*_?2cK(e)&H65>cCr^7HhV@p>`!5|
z>d(m=dFM$}JC!kvbT0irL4kGz1Pl&QC=J}dv$<djAMqz3#J25Hw<abyr|IDtAuCC5
zbmAWF9sefpM9{c)uxRV=4gh|?C-@5uUq5kmB*=Xo>R$k{L$ao|T4#g9<U!g#&+0%}
z{KrYqg*K<Vl*9F@@`l1tEp&xI4_TZBF~PR`^;m;2=Zeoz-Dj>ru)D{B*+Xc+?8_6h
z9LHbQ_^lXt4)~=-=^G;o)o1~0tRs5evKstySf5#&JeSK`pMgj}Q__ag$wb~MQ;wvJ
z%Kk?9rr>EK%$*!4%re^NR`5F%SSB&%=w=r3E&N;gNd<k8c#h(cj_|gg**AZC7n|ol
z@!Tt?R?ncV_;ryVa82OX$3}+;d;Z7!5B@s+cbmW&_s%CCg%%C4*K8kxwOPWa4WHGG
z5pFwok_^i=Hz@a|GuJ|PFKSn;G6wCrod^dLqa8eqUhzjY85YjNvw^a||H|~1`!kW0
z55KKb@8!ZnZ4)A?3#DdumOSn}7Fb)dP;4(-b*+HrBKIG<r8yvSpt{|kEeDXmZ)Uk!
z%;t(aVA<8`m3K5Z(;J~Av^RzEjhLo)IIPsjQi~h}Qx#V3_LkB-{TUQMt5$k<6IT~`
z{|IjOeAu>rwpvWmu#jvFl8|kL{3ov%T{vFXh;H(CSP_q1x9Z?8_vEIkr=y&)!q{^<
zf#J>v-%X|;_*6;Cx$`=>#rE}OT=Hej1-Uu^^huAZuowE-bf+&ne@iwN%L+s}-aGWE
zTeNy59Sj4B|9X-MMv&Zz!q(ef5;aj3_Lcox)72v=w+X}p_GYc}!p39}M`L8hARsDK
zoj6avWyjN5k`<KaHK~&6y3}{28f#}^o(@F^tm3Md#qXeAuGA*OcSC4SwfW`3K$xc<
ze^v7bwSACTUoeZ>0g{bhk8&E$r95EKxkC6+h4p}y@nm!6PzVu4_7GE0pt+?VOlpCt
zDuspa2+TiFD6XO~0{&B4e!kzFyHMM%gRfMDr!skoFcg0j0NK@`?(78f{!|dkan8xa
zrS2><gw*GJXbdkW;rre*-TnNqg<MKDT`dnu@%QpLuUiY1I^#|qc(!N}2mV@X0l<Fg
zx<pb;hj$H>H-vN>YbjRSL{7vORk;6qH29bT`1{(K$O+5P*7$JxwXmmo)P(RU?Q$RI
zcN!fcf0*%mv3rYOogs?$J7K9RPZIoGJ3VsA7`FR9!~SyL>Ee|9WW;33b%5*|fwDW?
zOWqX@IiLqJ^DEb6JnEpZ0x!3WTOdHU?_Cz_VXZIe=la5CL%!2HP-<5rZPc#%DUbEO
z=(B&1zy$cdN2n6OYah+%mPcP3<t1z=AJu4OVm-5s=;aP6K-s`g#aVuOx~I6VI7&2B
zrSe!$X@=){qD9tZ9quA!ypkTUOld7Re99=|q?n9~u$hvK<iDxTvL5f3ukQMTrYz2^
zM=WuNJ`XY5l^taBRJ0xbPK-S#8B-L8ju@rc%gN~NFUYmE8`avDa!$u`)AH4sB{Ti`
z>!!D|j~3g>dRW=?Tx4>h)!A$LPWAv<T6eohH>3S;!~T`A)W&wAItnu2xkqzdPe<6f
zEccviy=pgb<FFI*eOyv}xNBRu;JAPdW#-|dd3Yq)9f#h>J-u&I<HJW<|FYf<5sFdI
z%k(}!V3E)`+Am7FI^*~}02Q8~^-n|2TfS6Q=ui0}d28cuF50%`m$`oZ3>>l`>6sVB
zMTWDYkI8X01QzDjo^wB^lPT2dbU<46jUp|l!&u*vaGhCq7FHZXZqRN<TRm!vlI#Qi
zs8FmQ3;fXucq6_YADW=WAC2%nY0L;bZQogX#fy4zxS#PFt3DWbiQJ)CG{Xe})tC=S
zofuqMe0@(nZFY%V8PYaM5CG;GZIEaPpceDNRPkB1wVF`%eE%{2eC7{j*q5;*Hc1_2
z9r>|1bzrJt7G_gn`SNKDgz14iFFPLEb_iVaq}Oa{fD@rbxpB)M3CIR6-e2arA#hIE
zM(^glTEfnNz|}>|kO;184O}nTF?aopU%`RBx#&WnX4LamwQKP;_VIqmAHp`^nNKO4
z@$yQSYJB+l%u7mV0Q{~yB`3Q=0Gk6%ZXH{4*FqjY)pGo(a{u8=!}|}1lCZlIAEo=w
z8-4TCW4eFxsJCE+x89hihOERASc3ru7;pfuW%nNK@u&o`H7R1dM2fs(Qb%b=p<J%<
z+FRrWds*pQ>O=V_0O$fPlQ^X<@`sr^{mLhw^MPHIDtGw1M4IW$4xBDU&ldml(D^_t
zs+L#8^hlp>(D}cQ^GBg^W(SmTRni#$XblJ1)PtnnJ~pS+eVV6Lm_by5Bax#?$5>|C
z{CfATW0*GEy(ttIE0=zC2{RqP_lSJS@UiFpr7C&+PWEP{1#pe^h?%UH56w|-DNqBk
z@l9$i3v&v#KAO2MFT_8en~At0fxA<Nm__BB#c!2S6>b&rl6rC+EbNevBjh(l1O!dT
zk-tQdT99?!nRs(x8=|O=LzRKpq#DB28UL)WwWh9hwgtg9q{sYqv$nF>{Ke&C4xDH}
z47Z;B&Wf<kXQ%q{2lTqMpbH7|H$JF5fA}&Lb#mZFu~>D3Ja{4NW*7)o8CTK=K521M
zAb1qZ;lxhFDY$QTvR@>^$*lOMw^pFzgIsP>BUu_ENC~mlk6U`RTghH_==40ir_SBk
zIc#8l(~dvza>KoSztMgjE9g6s9XG$YOe<LvF%V3m9kS<;L@Z{9a=Y%3hK4yWU%gY#
z2ep?$8ifzV6>_8`6eluiSD*O}6`Np!D;6M5gnj!|7LEQ3d5f)E(BR}#k0nx6gvmAV
zT#xr-e&Pzyft|*!Zg41hXOxIxitE-LofRD@o5cnQzR;<{c`(r=KK#CMn|(_}zW4P6
zzd@-1fTA5Jjw9}1IpS^C^Ou%aY*uFClzzZWh!?(&?JUY0vycy4f_ZsZ>Y|}AD9@d}
zf39_-K(Ej*fAec=L|atyg5%>gK19D&nac4rAD9_o$wq%E)bd$t9lEgO%|qu;TCrZm
z-wV$jd^P{Msz>!iWl)}-?9gS#{2eL_KkW@do5OP}6T`tb)$>II`u4w_3~_QDq9efU
z&WHweE7x>!`OtLGKce3CiAe7#&0mX(d5e%#6O{B-6{f#2D)Ddzae(MQ|52e~#Gqa*
z3rC;OamcAoQ7@`olza<i3^r!rE<+g@A>)ugI=M%;hIxMrUiGt;9kO7;k^j5Y!~gse
zH#ELL@o%4+y8|Qyp}SDfdXO_%Iz7~?7f^FH2VGbh+ORz^|NEUIOK#i7t_oR%JLmr6
zhReif*pz(U1%V3+immMXPqDH9Y%zvsC9b3|FHfHW;R@!Ph>m>>;vD&0XLL2V*11Fe
zJTbAVs5Qg2#oR9KiVod*t!~QxgSj@6{w+KYus|u7VowE!{#y!u_sc4_UsirPO{HXb
z<#|mMB<GD;brxOmrm`})?+D3mRD5{Ewi8PKFY(H9-*4j86!S-%s<39_=dUTcut5EF
zQmiFDLQ?%7KkbEFHz)L+Q{JctL)8vZj0LQ%dSgpGOKOE7wAlXqIK+R_mCO369_6-|
z#oi~H2E0N0rz3^~CR50=_N`}iaki>P6l)L~gX63+z(Da4B7<cqoD@CHfn^Y(2S1(4
z#eD{GP1VeN{%~6<h=hW2>CZCe@1Qcg6+@0GE$#bzprQ_3N?RkY{1Lwaaqc45FN1vq
zlETs6?nHs1Y-`R5E@|bb1)A3Suc$dZe0feKvl)$f)_U%wJP6@T_am1nIj1XdVy)g*
z&1j=jw$l+D$u%uMK%Irw0o0q=I%qOC2Dbcq&L7Fl%JgV2?fB^Mw*De98a&pjaM{B5
zJ$&9eTQFo&nYnd8yzaC;{4WUn_BM+gf3U*PkKPD3cGwDN0w5~q<U0C~lIQbQhcZ1`
zZh0%IGBm(!YSPidY;;k*2W1gu4wrY9)H3tm=^(2l%Y_p76InO#xP|{RTj?M|mUEd^
zLVQ{XOJBC*@J2z^a9Flr($n5&%~^o^P0s5w=jy5vZAaV>q~ho)nm)#!U^CMfD5H3e
zy*i{;9nHKJ5Ex|l(Y#fL6<jOis@{Q_fLHxnD;7d)YI)J70TwvuF5(@xoDZ#l8^`cc
z-ef5TLIeU=w(z3(G;nlB>%KVBjl9Xp`RQur6==A8br4&#al7OjWwu|M?1c%yHH{_?
zsaqXW!syT=Y}Pvb_2ZH~7|H)X4mWbK0nxg9Eh1#C+B?qA^v&vE_3EJmX=bu%Vc}QS
z&G%%uO>PH(VDp*2XIRt3K0q_qnKFmcCJRmTFD6UeiJ~_#K5U&(5f&A^SEJm)NlAKK
z)EUxI=v#%6UFztSSjt_N&g7QGOh<%ef8v|Zb+H7_YT*y1NOz(lJN=~Upi;1ZL|m;o
znF%qi>h@q#xcTHuY<*-EM_}zu#0F21rM+iS9fb(>ygS7mETdL#dW|5$c_DDsy<Z;w
zPndJu*7zr7THSer=~h7gAcsiaH#)t)K<GWkn41U>O`kmp*K$0d9~;!eRQNja(n(4>
zR!y+vMSNx+TO%}{#5JK9EG;Dy^U^`pTz+mXg?sIqSq4ESgyN|h=F|qjVK%bHfmj&I
z{CcY5H2K^B>tsa?gR|-J^7gYJ7+XKk_!G0}lP*<5y!GH#lr$C4^L+<Civ{!D?+^y`
zxz01QD5nF(m&<yr!O|ujq9VYZ61iryCB*>C|69z;*3XT8>Sps_x98q`{UArE{i#iW
zpZx4x!6`|mWy2xP0s61H8qDh+6>3%g%W`JvMLQuEH{^d&!JZdOdD}Bx3x%EH+FE^<
z6Cjws56gV~)M8hbXiAf^XAU{4B^xZw&LzI*>Jj}PnW=1iy&U>@#8{^Xay`DP=yDm(
z8U%)YCw0u6cG}q%WXbBjH<qq)klm?tB0^o69XIHzo+&671u<Ofxy&WM`w3byvFf)D
zyR?kNjb2{v`IP&zqp&V+6mfnaAbl>+iz-@0<6Xk@+T6^2YGQh*8D0Otc5%m`H}mBo
zYQQ(z{Yq;e=1a2&o=5q(epgZM1^nEOm2E14pT%=Oedl&WVtf5^Di2sEQv;(I1t<c5
zUtq#Jg<BVfjI{<dR=b99YcrlIW?UvZmiT%oEatLXi7eZHGs*H1@`!USa6y~e&t42E
z-CoTWz_BiF7NnLXt)*pWrT9nb4p#!q0yNSQ>CW>ZokhgU4Vj+0bUX_Ca_cSeW8=s&
zriyS$wi4xEf3{U;62Cr+cePNlKymGe*2by=+@!g@G$1E-wxdAC^CE9|)diQq7eg<x
zyD>?o1#gEkF<efBvM&3kB3d&#PT9ccOq2T?>K|a;Ca|8p_$@o7J>U^@Z`sH>_BnGc
zlMT$w;i`Jr>r;gXlO`*JrDanmSF^Z2B`Dt5)AKK8IACpH*gu_8r0%O7a(x02*MWoC
zxwlxB0PpKX!!`^#?6j4Qt`A2bj82j-0GKXAc;$&d!c-6t3f55!VF<j4P*CugT_2G;
zCIa-bGz!JD89hJ$H4%OX&@v|D4(iH$uK44ytps&%QtyHmDEp~uUx$0^LE!b>>9_t^
zivZs`>$oW|9j`rXoz}-bJT1Iru7&E+tGvTWcD?c@2h$v-drT$<kMcL2n&^7yJ_4_S
zN}czlwx_bgA`%bjYp^ze8=I9vT1dvdUWf&>9kqN7^vMcfb4q1^surdc>DR&z1H$9_
zNK3m^%gH*nvOCqb9s<gD)$Xd26{>1(AVQVL?zB<~x%6Iw)*BK&^L%Q;VrrqQFZGIK
z-u6G7aqwrtaYD%Uz}+Mb!G87^e@A?n3th<#|9aC{hu`>MLI_|xtl93KMzIBiuiha`
z7e+1sX?)6_!B;hGqbq6HX)ovZg0#VjV4hsKYv95d{xz_Q5K57+bcc?pgV7l6I%Qr(
z*mDn~OxKZZR0X773kS9NbF%;fC6Z$O-X>H0hvxIE?mTH&4XK)rep{`f*;QOeH%yUl
z34)|G<$o<ghviZpCzKjrD*OAb9)u<<N_h9jIc(VUvp6HRe`B$C?fqHLCSi_Mx#%v2
zRIjEnO&w1EJ?5Mmys$F=&{G%jcBRKAcr?^*5uXgN(%Eu)JE7SHX(zjIRC0i{w~fUJ
zK{}}dh?<+mEQ`YAONK^F1%-Dv3xO0C)lp*F&&;FX{mk98eFF3~oe2Jqqbsj)s!z=o
z9kZ}Yh6Ad?7^(Y>CF0fZ?9$;Ne(6H>=P~)|CB(y?_B<jb_TZ4x2YU5IH?~4SsS9!G
zM#vwbsd?l&!4CyEn7rAnyYTHUJM!K_bcmtVsC&-rgwX8mF!wYCei#ygE-0?~=(TMD
zH@Av#UAdkgMty*^+le4)AElWs@Q9TilunvsVBJV2kTk0K#lz<8T)@h#4^p-K?%s8l
zm0n3I`JX)<_!%f3FgbU~q;$v#%Q0`*#IZ$Q*@G;TwVcOc`q)ep-g3|Zf-C!?*^Cxd
zy?4lV6L&NM6f9-Vc`;1caY2x7tbl8cvn%-2PzOsy<Sd3L=0up>Wvgs9-3)Rcyzx}$
zh2OT|-u9pP==XJ-(1pqQ|LSUi_<hpoaR6<*&Z0@#?6Z=RUr>!J!li*y1qIR|9$c&m
zwn0-_P2S}=+vd=eN}~4^4g+l#n+WD@TU&AfU+tip>Tz{l2>h;7JJ)ZY3py&cth;q`
z$gD{%SMwdjXLioIiApBvlanxj;BtR_Nu;pE6R56ou|PzPJnIwdvhc}-Ae#2Wgi@!~
z-phk*eIQzfKVf#9>d=h#rt=fS*0P>%jt{r&c&6Are|w;>Z^Wn4;$L;|Eq_o$sNjF4
z^y5Mb>aykm+0QvgPkU2RaNRNx0H1<lc2)oj_*7@Fxzox^mThI7co!P{`^!^j<HNHB
zBcjX>{8#A@jpqw>)w&CmiJTFB%)(a?+C?=P|NH-<XWaUSe%2QjJCHX%?#uC@GQT=4
zYQBMr@Y^f6{p{_=+XUUXkdxi2DvaxviR52?yM<*+`7>JgIi?mLKXeir13S}<j;#5z
zlHoouEeTNtkBt6Lv~zOLdL}Y(fah$*U5eCB4*7kiXjeE5uLJ>@Jb8nPf5cYbR%l`I
zJ2Mchg;X_<>|oT2!Z$!@SRvKsQ6fu+k#$n@q&97AMl%Tf%$jN=@RfG%KkCBsXXJc*
zcs-Bbvn^gkSfzd3jjghrsCcBYVBrc%qgCB5sXgqx24YhrGW-@42~{0bBr;uE7m^#G
z$!Eskv1}wRi8+G~QqgY!pEykvGgy>anPz>rhkqh1@TtA)c6?k&%KD%C?vDO;9API`
zG}3Tdn&l-tPf>{dY$YH(jR<aLd`t!vJQ2@Dz9B*IZ~8fhi;-s7$&&Eweh`}u+)apA
z?NtlOV(72bL#0mN>=5|FfH&N$`gxYYLOcgNJ_mo{kn9e>W8W30nr1gb;KSobO(<;F
zZNeNPajD4M*#J=u5}Ub4pSIf$jG25XAo(E6gzW9dU&J@+572<{=hItj`5~$itoiWO
zKR<G#0MEU3#CrBFJn@}NmK7&pMMuOoTtk=H%kJE(=Ie3lKchu!ze?Az14dhnHXFC#
zwgF<ff?yp?pKY`{_9BQg)vI?CN{6eQ@tt&IfHhi?ZSVH}2~k#&hRW-`0GopMuUpfB
z6S1-<w3K9g-8hXV^V&pig}B>bpMR}6yujFA0rQ>6=R^oHuQmQK@ep|B>|s5u5KE6%
zojs{Mdop(t4FDtOWl~qRwTHdz>DT|$@N)M!&w8}}Vd%i-ZLg5a4Q!lvBXdD0WPHN4
z8NK%u2^+=6=R8QLYRO!uG7zZ7TpQGbQzF0z`o=!8Q<7nSB3#o9KdReQ3W^Tm9@BjI
z02ZgJoJ7z=@&6M^PFTww`LiEo^`|2pxD#;Udsl}K+jDmij1(O*Z~?Zm)HC58xDHOV
zk!?*5x9E=o7G%CdH0#VU7#doUvP_{gvkk077#Dxveqk5ryIyVdOSdWc4!%ZJ*N@oT
zc}_%!iN$@#|9K3XG=Ew6K}*?lTJ)nx4pTrWCVu=EELo1q_qrjeo>S%*4l8+Fm+UK1
zq5>ZB+@^m|SgQ0Zu&9Xo-P}X}Z~$AAxK;Hpg@tb$ob3HdxTi{;SebuNggLQpJC`nm
z_P7&%_)ow7to!pQCQosNzY|;KWWj>>J<(A<3_%D@R~<7X&1oi@Y|tjX7Yhzc&^m3P
zCOw9ECiNLQF{V-6a)#X<Wp9u8+S^>DG{Xm>89~2oi~oF&2>uUUn|Anv7{HZP<ca>2
zwIR1ZFngoGm!FI+UEO|2aFhN)EnBvu*Z3V)l`cJ<2)c|QO_fR}I2LUrNAE|Qe~_zT
z!AA~PYw2kPP{gHPj`wK$!G;%ydVSKzg=G-31_n21y=`4!*#qAJo6O9)W^~HQ6NP_t
z>DcnGFaODn#-Xo&<uO-k*rxc8Uya{j956L{+k^HzHepqG=Gf<L2x&&&zN@u?n*`h*
zezXN;7RY8RS@0-R{sfrd0K9>)&7h``8{p`Wv1mhio-?aL;I|5m_#MXoHCnH*{M|eE
z<U>|v)VkC6V=m7v+p)S#HLe!?XL>(oPfSkMv79R9ZCAd2w7skct6Q|2y<$p)O|x9^
zJZJ`}T27*!4<UooC;VIQaOLG}Gy1&x-NrxM@A$wkAb%>gO%PiUeTMVVl;s5YCZsEX
zj8b>+>t`l8;Yo=rQ4y0*6mTMVFV+}LQ&=oax%hYzw~vi+q({=^M~VHBEVmGr$ugD<
zLPPOYwK?fq*fki}vEAc;)L=HQXED8}Yww{iP9Q(Bn_V8Y7!shXs}TvMo41wu3$s6(
z664&gUBKXhz$exmS30V}fKv#KwC}_79qeu;DDTj|tqAN`MJ;$YO5Sga>FsYi0DgV<
z8SXgR2@w`8Rfzke{bZv+Y4lH^?b@4FXu!?ExdrleV$qcTXK3UFs~C1Q9X?#}40VUO
z1`2y2GAcWN-0xwr$*(p*dqSWqP0u1&RT#4MEj)3-t<|L&{l3dxKnw5V<5Oyt?~ZM~
z{)e6Y-uAKZb(4^qZP4S*oNd3o^jF*xvskL;k9vM_!6S42s!SF$Mkf<^m|^=_DVp^j
ziWd3=$Jq#EE#wSJ;gE`OT)ianzAqQ}bDsl}Nxxee>-SfBKTZ4r^uYrt#r*@=a&b9p
zJiXCO8aaL~Ux&BpjKSP%LkjFx<r<Sv!|gdHJl|T4WDFG2n^=vJ)7eu2xD&X}r8NJA
zz6o6K8)cC0uD9GkRF{1s#45fgC)!jkjw<i2TEc}4qIC=3MGb+X5nb|rHM8qV$xXS=
za>8qznVUS$EZr+_c{y%)p%{_Em<Fw)P*BVMt?wo-Vxak{?Ia8QkQK+t)UZlT5w|3&
zf7p_DIkR*IE!;O{V8N1U|F8BM)o0pmLSk1MhgZIF^Bb(x83c{Y&y-Jjkn9Ft`1Dl8
zMD7ZBzZ`>{=H^!prWt#@uso1-tDzRSzGIf(>+c^l_2WFQoJ8Q6%d4F<*BzbXi)BIj
zsf(sEF^tjbkoj!oxnT*Zm)}jB#jVLQ72mdmwd$>U^-yxM9LCLmYt0JO6n=|{X;se>
zOL8bD3Aqd~7tVytP1lN6{%C;B>V?p!Qe7qW%)8^Rze$Qv70%RNbe-}yF->9Ys9uaH
z`5`)ZhEF}ZGOh|+1IIq44qWMd0p_6s$)0=6g5vwK5&k2>D|5Vr4mzNepLk1wmJ1uo
zLa|ywq(c@=05LG5?IJac@z-kEEwlFJjA`rc4mskQq-z}9>J~FHL96AMmxn}Bzkg*0
zvaxVyQD&v6Oi!|JkXw_E=>OTiS$~=InbyJ_N}InsEF?*s*&L($OufCp*V47JD%dqR
zvRa>Bd@=_F-c6TjC%>ME5j8IP`d(j}dkCc>Je4-5WcTsO*Ct9xtCv2hWhm`e`%Z~3
zL{+C`C1~Mge#k2R)I^K&kVcE|(`sG7H!UY}#VBz5v0_?Wo{Dg0!LTLfWgBWp9i1x@
z3EDr`+xI5j9qsG$yQH!L8I=x!FDQZjTEXHM25_G)={Vv;940@Kz)Zu41g+enHk6Co
z!na#luCZ#uB{>N2EwYYessG81KU;I{<q)=6-|JscZq|Q*??Wu2wixySE2@aeRZv3*
zFG@pbY0_?yJy&BNiw+q^?lmA)VW2Smgj`i6M6vYBn7Vhjjk0Po<HU1cKKMEQ#tXTB
z$$5;AJSw7et)Yl2zcq2`C55-6M#;J@e2Ipnap6hkvSt<h<%#`t-RG2``0!3$^o^$t
zvZBml{npERKU~_9bu=BnU(9KbgI*Z<_{l00du*N=A1?YuXD6JMQ3P5fn9~R9Yy!kw
z702>LOs&%-xaoKk#Ah*^U{n3`Hi?!NAno-2?rS_K^A^GALdo$Zf_}Fy^^9@YYQXbR
z1fs|FmK*y2>gGC8@Iw3cc$9beDw3+`2^W4>_bw~)_QCNEqWX(h(#*MWfxt?z8D~EB
z5gxouCm4<IZHPZ~#Q>=DY0W)xYN4wTZ>XpH$BWJ9b9=K&y%c0ACrDa8atXl`@pvYX
zOj6(E<TnK0#9!t&M#Rvh$cE(Dl-V13Vy%32OP-C4EX0kS$QL@GJLo9C>h*U8a`mn1
zxa)7ZOL|ahUFr5%lgjaHXVfW)KDjjrKLsbk@>Pc<^~da;S*(*;I;)m<y&`Zic<PwM
za40;KKBm2BE`4EXcZ;y`^ej^R2wBu6w##KwH3ynZ64cR*YOxr4sfEmvhKdIx5`Az#
z@bDl8#$aZD1feex5Xk>`_b2L;_U)DyAFM;=yGI9Kg{7OOH2Yg&z4a0n?wyhTe<*wJ
zu%?sseb|n!3JR-$AXosU#!#de7X>MT0s_*Dfb<f2RZ)<x^iWlrp^DP0NQu<YK?pTM
zAoLnK?<9bV=j`{qzkl}f+FkRRnWsPV-1oq9Y}9WnRzrzZ9J*IF{h`t0?iQJ}Hd(iA
z;IqnZ#Cc=-`b`=8^f#-vldn}HYf=&V&ZZ$R*Y4MvO)Tg-nb>_B@W3HXB6XQWHmkjP
zx7X-BX8XHDR$JHUiq^im&^d3c&$#u44B%6F!EFAz`xXw5UWhUsa6^616<jKEUCkEc
zh>h)YA8#GXdvhJ5uS}RI1b0&{g>6^_Ev$&{3GUVpD~@b@D;wv`cj;x$dx^@B&X_{O
z>U>)BS~pVAF6Bs;JuhRIStfR4vYb_3XvjuEz_5URrp?XvR5XwC#}`dY%1@Ov1d^(|
zawe#>U|Ybb(*`G29?#`k$b;D=8F-#_m?F?n3P0yQ2eUjHjBqE7qV@bJV?$NS!u7(1
z%B1O_mcshQk@mTqC3l%6ofBNyJ=4`8%mON_Te`B9vO?^~-k_#b<=Slb7g*2!CZrtU
zp)3ZZXo2t0rHwVI1l@VDnNpH<P8JSLJ6#h^=UzzIeOkP?NW615^=Uyu5kOQ`i6-yc
zbTgo&lX5mSz(dOvk+vs7UJiRVXjTfC<i;q92Bn@0@<NUY8xFUfcoK|a&M53!7U8x)
zcqiqKpS87!b22k2-@+C5+v#dGqu+M))|A`4U;oRzjWVVN<|7in_D_AgK*uL~puLoe
z_}hhL4Zd)`0Jp%oYzeaP=EBxw@r78Mi@pz2ddiZ4aSIcS8{g{Hl1T&n{3p)rvL_?P
zOqRXaIQO;3G0_*m$w9)rX@-S)vbd_6xj@HCBv!IEmY&1T!@sFd*_#yEd447WSD|1y
zoFw2t>kY~Xzgs_G3C53m4)1GoUV43y(8-aJ4&x-Tcr&PKBPWceXZmMJi)=<%d@h(_
zJXqk4sKls`b*mwo1cNHowFLS4C#90R!d1WsBox#z4&#x)&wq?eW5_AEX~%Q7@f^l}
zoYuaKd_>!IVO4y}T2DhX7)AZqxKk0_8p;T>u|ub^8i!-m?c)|_J3VXlwdLNt>n@)8
zhOi#BGE4)RR!ZTk+A9H#%B~Gg{Xm}*o5IS%nuN~>c@?A^cg+f!_Ukh>v8)J)JaWzG
z1tV|$t_X;M6j#7Z{kh7{D*8aTE!QS0jKCJ#Y4HBZ)QBgPLY`|r0LE%65>X_&T$ABg
z6*1b=Tn_Y#nJc>*S191HVfqia2dcg_Uuai1{^xw7fT?uGzC`O115wMK0xipl-V~Ox
z%#~%#$#HJ8TB4H)H|dRA3a~O~3{hbHc)|!Gl{5u@nbFRSHiAW_`eZ|uIRjh~YEpum
ziGgaiK7NzxVN#55Cg++PSG_Y|c=H_?b!T7t$bAm7+#T4&F6fX<7wNuom7d>edl1g@
zxT)KdS6vg-J5fQAY^~j9)yNpEW&%k|A#$CL%i26DyJHRH%cbeE8-#QR66qCYO0}&~
zI)8e5@F--kYa~vTPG7$9B|<1>_F@@##J$b;zL^N^XBX(Q@R2_9*atRPCt`T$3aC`X
z*iLLiItmdk7;P7ni+wq=;|ebZvY^Klci!_GwiEFZbeTu$gZdsAnIq2a3#Ko`3H45}
zLQ=ys^=pF3F#}u$kG_6ir@qF>my)T<KeARj1v9&&$7n4w`|T=L6fY#lG66<CjHNEp
zAd~78=B_NA5tnMzz<k5R(n*g9c%ZOzWie1Y*)FqB&92Z<(2i)!_Wc1fzXGNP)p5GU
z_p<3?)t4(W9A@5z`KDN1S$gd@Ep4foncD>hd)r)Pm&$9b0=HTz4Uo=v;tB2gPcfpB
z7u7|O7ldCm-3vNtedyQO38%}tnsLauJ(J_F3CBj1PQ=w!Iz{OLz~nl4UknCcQ(atE
zqk|AK%bW-;5|zNxbqUbLoAl%<VLQ#3I)$700tuE_|8Vkhyn4#{We{;YL)G?8M~mGh
z<ml|w59??P9Q1D2bW)a$-JuL7QM-K0t}XR1j3qN`%Ug!-m?Be;SVc%ik)ZpNv>$a@
zWfPiM(RzF<W%-YdC~2K19*kuv>C<mvJv>Tv2N27rC!Cf-<l|-%NW!I$j5B)1<9IXM
zW(&|WrSUe(qSvJ|Ol!HJa${o)N*LYgwP`!z7{gACrZdzF$QW|`jK83tvcl<4Vjt5W
znG*PUn^o(HhwzgJG0ojAIH3#moH4Qi)B*tGDe!?d2&yT=D)H@jQo%dZ6PDG`i-Lhr
zWuz`*E`1?cFQZA+omt`(%DV3HP=})3`A+9SzNEOd;BRM6y3ABdR6jOXDJ@k^aul%$
z5s~*9skE1O+ol|FEi3d^W{5YXsN2Z^QUd!j@QRZ%)moaxjIk~zWeVyZ3!d~s@h5q%
zNtdU!Yak*uaDGptf)bA=0`gFHOa6H8WUXHH2lB86M>%v9uX-FkmvztGOO3<EzQPSv
z7vz&Yy%+`Xom=%uBr;<f^@mTbE6xa;N2O^N>VbN?hg&~w$p>T$VE&!!EsK|0$(%AO
zW-W<BQ1V3McZIE+VcrYeetGvcIm@~tdJH$4^?cwf%CX#&l~K0SjvMfs0(K}Sx5w+G
z^~`JCAHTs-7e~WOjqVkBw~P4t6+t=|nCfX*<xT9Q!}u59_Dod&H6l4xgmLZ>F46Oe
z2+GBHjnKxX2{30mmHQ&lJ`wc~<8&QMV*ox46?ZkhH#H|cy?^(rN?G|{>V6;oV5gHw
zNL`zvXBe@q@}w?Or@3-*F<Q?ReFFHqXhbh59YO}G973*p;Xi6Y%Gakun2s~v1o5nt
z(J1u5d=C_@oqV!)0GDTgI8v&q?e$H!72KUH9ofz8fl2C<ab?$p&N-;oeY7<}`(vI3
z#;-Ns#?-7oulz{roJGYoa;+om06o1a>!nooluX7+MW$<v?(!E!%ktcm1-<#`DrKeg
zQEWz71q8_}X(}=lzk9r|ASN+8|Lgp$8nT}ZgI-xP713u3Ocj*LOCt;DjfV3DHwoX=
zHl~{&_0bjT6oR(nP4%Xgk<RArLPZ@*%X|Poa8vgD7<xjq&s`Qf+U}{f@yW$gLqMg-
zor+>=Q<WZTrjkkJ2`@;b^LNcy0ne4!Rr#uDx!*G6_v5WIR&%8ZN5s6m$jc@yY{(z1
z5%oD~BO}6Fk+iq6_C~y3=AupeP5kNgge2e{dz%Z@CchL2u$jlC@TE|3qX+us-NJ(f
z;{`i|meZw{7X3ddYqRorC9Re&kG6WI+>jYpOiPe<yVaG3u~Nqg6>V9SD;8pg?7U}Q
zF3k$@4}guP3)km0a#2KN98@{H?`|XW4}s1HU)4{r!Wk_lyZZIwxaDTAUw+46YjX6H
z?$@vVtjxBPG~cy2)qGSnB@HzNQ3xC9;F_M?JS7D+3Caxjq=;CE0gfgs%4A)VoiKq%
zEL~2`6_RjelfUh+3|GWFLi&fKRL%_xA5b9g^b0_kj^7HVjLr$x!bK|frbPKDrbRnq
zRm?<}tuCE&s4>)=YZTlLHIMYM+<HvMO3}si0W@(+;Xb9R{i#h$qpZROvGYknekjhj
z{`zZHa_IHaGNC7Sxi<AA5iU949-4;9uhnq)yq$%d@Yu*-i9>)91Ht4MGgWs^{{}@@
zGPQb!ylV!Ho58TsmaSt@#%dK8E$Y!o`HN9AW{-)Hp%>XU1#$LaUJnDGbVK@G2Zz!N
zQN8(LU_C%c2nd?4p3>LT7h)fDlT9A(liykx=N|fIpjRY)X0~*B=~Q*$qRwAj)eHRm
z79%{inM!PtsW5Nz_ysM#q|8!#LBnBXI|H{R;JN`aLR<8~)!$OgXCHSOYJ@^)>NGwI
z6V|;*PEz@heR89pHv-GRUwS(*zcCGE6@BWGcw0t?d{TtJ@*$P1A^zkN4^VpavPp5K
z!*FhO?cVT}<g=(6lhdFFF(h1dCO+(kthMp9y`}5*T7D6EsgRd?VU(UFMb5p8uMIUk
z)+dF(%+ZxOVJ})NxC?MEeYAAcz-@vFDqOdIZ%}o!5}KL@B?RlwHYMG5z&(pvsz(Qh
z`BeUedVYFB9JBnGDKHsUx@zJRt}H9E^w!bhR8w|&StwTwWYVn`vO4kviGb-aSyVoL
z)>K-?nH?Z5PcSAKeRv0|PG7(wwf2fpv0Sw$VjGlq_es6Vl!)TdgD5-CedqeX93Nbl
z6sZ4T&recV6b;-Ri3v*)^eXI<hs{r7+|!0YfWHa2=)!#R8?eq$YblW~7t(MUvgC%U
zWKC=+a=20{HriJu1$Q|;-xu_f#Qjk313*vn4(pfdeaY8bOJa*FQWb>Hj)0ZWg=FQm
zIrl9&vU#M>QN|~MZmiC#B#;U&p?Kws$_lp!3{^@)&(Lpqthk$f`aI!SJ2qsUniX8A
z_C~y`MP4iElrQGt#N>sfx=;ie7u0b0a>|sOEmt=F^&N8+8<jM<>-_9(-u*6QWjR@N
z2b?gxx#ha1*-}1_N)_x{wlEz%=jaWtD>q1KN@Cl#ky&%n$P~Q~df}Pxx|3l(6rEny
z@U>63S*HCPt9nqlXy1+~F0**u@r;!rARwTx>&hukY6IRiQ?+2&0h>H})^E=F#s{Yd
z3xSO)2ycWy7n-klX{&!Db<H$zV6BG{6$CFh9dbvCD;wz+FwsLWAXPBL!Sm<`@N?bI
z;e0`@7&cI4{Rs0>^irPb7s<ta$dmVxVdOTFS?&FM*(+)Oelil7G~bjrP_Q`aVNNsC
z)oKKi(lK<fp<WQS5R8Xze%NM>W0qs#eO(vgjLNqeuV4nCVyjHrR2(Am-NrOuc(>6E
zJXWttDK@PncjSriMyTS)ZFNMElb`<&-+KT8{h{y-@wPhVq-N9pKy{7a*QRS_CmF8^
zDZW=$xKCb9PFZPV!dW46zuQS+R42A~nL1n`BH|-oxW6)Z`NAky=GaT6zM5kKGg0d1
zGDBc?oNLaCt=om`Os(xD81^G=S^hS&Pt<T`EKJoIQxaNxWl3kW8#U&XErvm>pBwG=
z`~;P=FVX8fL+|1-S%E@8&9QklXi)@TQlbNkSF*pY?`FT9f}PO$lO1H8Te`+`otgS0
z1)7B*5Q#7kb`LRt>kxEYLsg6IboQ$B_QEh?w7DH8&I7kqOpZ`0F3HRL1g=0_LtfT=
zT1-zdE;VQV97-2Qmg`$e@9|7V;~#8)5oh*Cfn-=0u7aFkN_tc>oq48?nLGf^7XP>P
z<c$;0Kwz4$tBSiUUwB}qzNiSlycj>)z?}Wz#pt5V&6|*}@N!`Trt`^&johBlx-LgI
zXS2-MRtJ|E5ZF$~s@KVu*op8a(VyE^z#m4eFvUh*5H(#KgmPt{FOcf<zOJP%OB;?@
z$1n<X`Q6%Hk#zq->zx5B5Kjkn5xMmw_dzgSAvAQu{^0K+2wc^8f(|+iMA-I9CC0m6
zyo;51>FcK`sGPH^8m;2nT_6<+RSqnL`dBGO`4Wsm?UUF_nUB3Z3ZiN0mR`LgN%gxH
zHAkf}zuGO%Fyrb1_X#Um)I)}nuxU-sDqmYBul2nr?MzRD@Ao|)Zo3qyE|@G#tAv^}
z`Gzrd;rkF&sv4Y%xxh77AfoO@xK<unatj9~H(1jvfv)JRzfnkSS8C+<(861+rvmVO
zn9s6}aYJ{=RHpoxUD{34OhK(;`Dr$1JlmX^ON@mhk#5+f>u#*eH%j@>PCYyzw=nob
zHH<06->A=kMMSc7=GB`{1QX5j!>Ss%a+J`7t2*C>S_?s(V1Ct985aEg+VLr_@N{A%
z60DYGLksK2-B1~DQmd?7RgG60=+pq$HR4zt+?SF*ltQQ`D-_!460Y<Q)_LtguR<C=
z)!f9>VaCbq+#HYdjhFB;HmCHsuaG6vC@os;_ps7PJGLx0e;QLl$0WWLBP)J{G(R@>
zqD7Z!K^Xpz3&m){d=lCZ-Yr9Qy#m1?$#U>D=T*mJrE~lxM^K>*#<+J`Mlp986M`6x
z(&OTw_Z_>py_3jg6}3}N`BW~D4y4Gs#T~SA)X2dT?j}5z>bf*Ce@q9pi=Tp=a5Ym0
zpvHE-S-L8Jz{7yidfw~ubb(NNJodn0`)jCD^t^E4CiU&mQf{wg<wFlPk&#KbS8&H@
z2()CiYkS2LU$$Hu(T{KLpzL30#teAOOvG)Jsg#cQ;QR3lD&^R?E{%1I&A+3y2orF~
zq|cvwA({f{Ja`GF>Oxcg38Nu)w8#8u`gM*a&o#`of!XYGd>yaH#>@bIu!C}=+mn9t
z*}9g;61~XcG-_L63KpVLt_3LF?50~+rF*m%+8mo&v(7m#d{GKW+bki0V_<aa>5z3N
zZDl356tp(2phE_s<LFiUzN)T@xv%4WlcxTsW>xlgJ9@yXLi<(L|9+z<xM`)a19`}X
zz;d-7nBJL6L1}T=(WXg1X$qguM+l**c#SPAMJT2@Ndp(A`Zw!Bg;rOJc!0K|y_z1<
zwfd2@CL>oENL`Rlg`MOAT{M=8HLvlf##G~61L$Hrzf-wDX4p1Boq%xCqjm7=n$-iB
zZ^o<I^My{K%tn7$<nfn;J1uI6H2knP?_5&<L`As~3tyO3i?vqkSi7}JSL>0Wz$IMj
zk7cSXp4umj?WK86OeZYM+ix<$YL;T=`RQ9t@9fP2gxN-$2*ub0oL|lcS459kv=Zs`
z5?3O6+}WgX7e99apc(%+Yqy-|Rew+8WR76;4O}nK7cbuWUOD43@N!|oS*xL$rz>zA
z4Q==9MF7^0xNzAxnv}aDT}-b*GAJDBlYm1fErg9;qV`6@-piiG@I#jv%jU9|A1&0Z
z&?<_W<}zk!3E&krg_e3;rU9!0h-)XftQlg9YaYLw15u3w`Y7F8B~ukRxtopMCT_!~
zeIHmUT(nDCeZx}p{3+FiH+e<m_i_#zOfssq2D~D?W*_6d;P0vxS5qvP(F^Xb-oa!d
zeL%qnskuij-rwC;sDLpEpwrN2l5=Cey*g&C88N0oMgkaT=gWV<)H}Ym)9jzY(E%7H
zKwEN3sg9PfY!x!cpZoQr^1P6p+swOi@+4&0csh*Z-t3qvV{v1SPEvkUPt;@EI;yb@
zUqib{1r8qZL|M1rIzWEy;{MDUId0rqNHVAwrhl0x9Js~Ohg3=)!hF&57xHe+lon(!
z-hxL^b@3>$zRSAUR;d3$d6;UsxIcwxVFlvzPU3|{W9=X=0fgNHqRP+px!nJ-YAZw*
z%1KdwmyMk>E@kPvI=_boDjf9RL1Om+;3TE6nb1d1gd&;?Wn|Br_J*-415iK1B;VK}
z0Bf?S0y%@>r+Alob&jzD>jo+IC@Zr&`mqT_Ul(0h88DZJVopf5owhP~A|G!W9h*{3
z4pMmm-s%S<M}p=o0-<>?nlw}COQ{?t{mz2`MB7l)opOF@ZW_GnqX9Xl3shvAG2Z3Y
z<4*_opYQ?V0lR{Xj!*9I(3MF>^_-p*x+vVxR<=r=m_r@+geJ@+xP5(<Io8s@gK)e;
z@0J6zFx2!4y>dgGBKdA|@HNojl)-iLaXbXo4Z@r1!qp4q&dd*tXOQvU+gzCeGC}p=
zoE0UmW(6wdIo0Yyd^QN~>}vr%Ce-&OPn1t76)qQg&H;>JQaAuDPEOs?V&O*WTUd_R
zEN%}cG8m6#ph}zk_)t5o3+~y1<8(V#UqWw&@<<6Rr(`DySTXIf|6qU==o0bMr;}9J
z2!CK&Qr<K&=U!JD3)1=Z{<{JW0k!{h%U7GB<=2EB?r3?0$^au!)t{A*wSk`ewy}FF
z+K$a3ZJU|*9V93K%VjBdp@wNDN^48U(Z4i4m0!JXAbH-Z(=aRayNiFZTi#0{p&0q4
z0Edhy0whx$>+4yA)OEu3|B_5LcEr!zEThE}cH{HJ>3ZGmZWo9gTT7upP;8s@|Fi(2
zfMm~vI(mRklh)n8Rln-ob7J}ak-Gv=x*rLZy{uo-$&jF!=H|#$r^~t3zRpY*gPdx{
z67qn#oW#HYi~=Zj-Z;N{=RHOj6mGUK{FIkeI+9Jx9pCo|6XqQfaXW7QZ8{^@Tsu{i
zuVAE4zK<Y7Ja1^4pIo1JO@IZcmthf2Dy@eQ9Z^W8y36h<+?k7C5hP9e7i}8urY{HJ
zgI1`y<~T#{kaDyeG6g2Wx+2-y^BHZ9?x?$GKH=`@&euRs4#MTBggRW6KjIzTf(?&M
z-gpdWL6V-*o;Q&hN||ac>4&T%%0p4%ExncBxlYg(%b62nMiYBBr}c^0VkJ>${VZj!
zY+jP<NI|-F8CyWsGE%5DUr2eIiDqBT0&eCB9nl7F&=JK%Z)b?Q_&jH<HJXXczO36F
zo^*l^q)uYvu9XWDn?Sp9>Z?duTg(J@BZhMcSZLf>c6RBV9S`lu^gYRSv1VDzP;X|)
zucj<G5vEO6KI1lhm<!@V+Xyg;F8=Eet?e4#D53e!lbAvuZB+Bdi<&|6@`bL|VtbVA
z=r8aV!TCNlX$ojFccv&y3K}v{qt2R&(sPmLTf{_qg6=A4sW6stQv!F<;c04f6yT-E
zL#li18+}eAm%%uFw4qt92yhrVVLoA%R0Bxt+T@5M8);Z`4Eu<sq7z>w>q8u+nAXaB
z%0jmfg)-&epwp;M9#C6>`VV;cos)xRN`T_k{Wg9XQ}FpV*10f5(eG$LRy1aTe(O67
zIO4GIKOOObBNoJI+nRUaQks^xPZ4#w@+m%G)Oy}#+=x+M!R}GiV9RRBk2E~{Bv0*F
zyXRN^W8+HdFf)0AchF~At}#;L%8uw33Ln(uTrOd-;pWPw6fgBwLKFb(O*Ht&N^(&;
zMiZRSCpcdb;e?DW7Dp9lR7AoX5)=a~?z*<AK83F^o!6h<nD6bkuTZ+$mliKeKT`~v
z(I7NoK0S<$E{cd-d-)Pwcu0Q7w!6sVoRK<Anc~cO+I}F>@2RV*TX0;Br|tdQq0}+K
ze5W)^GSt&W=qoxoS{CzqB&{K8rijf9a3RKMJFT!eR$ZWf0b~rJ=a=>Jnw(5drP$>3
zXUo`Tc1eQRGU8E-&CBvNKDe(7|5VJL;8(9k`zZPxg&?vYN6Vf7z>J7fgkvf!DRLb6
zsukkjDQ+?&fLL}kZzyCBy8*^)*b(}e0;NZ|dJ^D8A2e1mE7mIMe+`9>GrqYB_c0ip
z*NZl4kgC4eP}N&?F&Opz4z7-3`JFZROu_^);Qxd2AI`WhYS15397GMu&=Z>;)BNiF
zpcxC=KJC&vzFa9Qyh~-g!Gx6SOq?Q=MqgAC)V{Cu@#jo?c`|2O0Wx1jT8MO;z)xe5
z2*MJ6w7+z-)w~YkWR2JhM^4>Ny$Ud&E=%AiYD;PBPlLN1xp5H)FLrLMJ&#{IN@i0a
zVYn%Kq5)cy+~XqaaIrWKU!Jtq;%5!Ky`o#{l)g~-7+}q+$DCf(sQQm_01cwalFROx
zEW4<S=)u$<BOUT0PR)Onz_hf6?_gU|vrgu!QG-&91tpfcSyB=%-A{Prv)CE)lIUo`
z0MGA+JE_am$v5kNOObp?5pyfGl-}{j8#DbjKZ7?7RfuzvC91JMJs#v$LoDy^P1(D!
zny%R#4UiStmbJ>Wxh&Y7`23vONBHv#cY{RUtJ!>Dit02NrNE!X*FPa3ST#<^aZ2Cg
z@s};-r9y7<3pn`H>X{eUENQL**SI?f+;^9iqI@gB(iZbk?|Te7W4WWWJf&Je?c?s*
z$~5|n#~EA7#Wxgo#;t$i1VLWKx&jk#q;PTGI1tXqV_`E2i@-@jYC4`U$u%C1qa)NV
z1t60q=1>!VBOUrYMtq9t95-~bBETQd{mUgt;}b&6m#s5f6$!guG!vF(OMg5rRi@51
zoRbISRF13&=AjWcb$4S<HA54KPq=h?{8uLAw&DsQ-E7ac)<|VL2T`c)ZZA;(ddHG&
zV<Nx2FMuM>T4waEV%Ni9d)L@@$B=A?lB~QDH6FCgl?ZMMdM+HPbpy4y0n0)#3Q+({
z56q2Z+Zv8W(Mt#5HM%aZYDC|k7RN~NP~hJZq76cOV74rhH^!l}3>>%7<LQpOY_ed2
zMEBEu?RPMUX7ga2``^l@;EFo7xax6so~9}0!$r`g*-KfkgZpmr@rZ#Mr`P)B$BgE_
zvf7EThu;v1=Z?ZB1(6dv&gLv+Sl!s3<c+Wt)*83qI=`eQ^<H~oQzn#IRc)LqWs$K1
zYP7^}r(I|#;(%~p)YC9G)LVMvK%a5b#VrSTPf)9^mYR<CEPHz_)2^bGlMD<94NM}s
z$e<%pU|;EY<{WW!{{*=39W9y@v7>`Lc>e+wW%(k7{9Rm2m(1*Sct)aG>NHFR1<J>c
z<@P!w>88Y<H_ob2sg_Ms%!>4edJR=t!}bv1O&yg!wfP;qKrbycaq^TFjRM&{1=c|0
zZACA=3~)tetUYrXj{8wv!w$4Ou~<1Ol3dWH=6>$?Vndc`S}qDx(z&(Iw&@@@edrKw
zrUE=~D!kioq{Y@EHK1R5;XKCR({jUg@Zr`P`^hK;>@xTBwc87yG}U1Xh^{E-cEXqk
zh*raaNL|~^a?Uw5LOX1?aG-ketL<M`SB2;fDGG`wHzkg)%=8K`=<Ec0Z@8*kBJJmt
zdhgZ0jf0psA5DNu!`_xcI?ABFt0uILqdIfE22A||@e|`nX8mt|)=03GNFl}<giGHL
zRX)BB!zw=+V9>|vV%MIX>gUiv4q|`=i^sGkFY;zX)tg+S?|I-+$WJ_j`*BgtJcLW+
zvyD}pXr}?g&OAlK5`C$I8OkP7uXPa&ODlY!zoM^15^EGG_TV{B*jVQlbBHAib;iVX
zsf4PCT$LpEGS;x;ivJj(z1T(4=%iaeY#Jsvuebl@!s+jihs6H)e#pC>pV;nSo4*A{
zakLDFl|Ct8q$RZG)TQossAJGF%IcGR;j<lodF2g!RML1bZ%-@AEk{Vl@@cuaA*WYI
z8RfzJ@kEr?dhWeio!nbVxN&&4OjR=@_^EXAEwv@hxt-ZQ@xbbV%UgxuUVd6F#?ZtS
z2=YB#H9LtUcA`<`<~5v0WubV_eKI>?4O>~<<;Q`Mt{`Dsds5a_*`w5#eoxtCD<tsS
zgZv9k&)@|YLyihKfO{IEO-18S`uJ8ttuhKwl?+QoqW3^W4(9Dgj>wXnmg&=m1h66;
zldI3wVA<a7X2kmFWLM=lv+fiO9yzb4*i??+k?3$wq{mwN#;4(z1&Qls!h%x53E3D$
zL%mr2de_Vp`V{}mkeZ8J6e+{l(2^9}<RNa3+;4$4J;`_M=mCk`=z&~bo*M8%X**0<
z_XGO5)>r9r+t4D5KoF^mDL;Ha09u~-7|mj?-lKeH_XpxHP-20T1DstXCV9P`e>8K}
z1?Rf#0UxOGIpY@2FL&ZhFSsfgq^3{92z~Ce5@m#XVK0`6hWpdSiJy2sgq?GN(<pe2
z3@zD|;K@}nYqG0CHG-0TCVbvIqj!YsIbe;Byaqz|hGw&0WYu7p+urCQ5pE?%@_CQt
zb5f+mC+iF?VMD1>Z!bns6;;Wmd!JP7Np#DT6$6dV<i3>wZo(W8(8tm-4a>3%NbN>X
z1f=eJ8Itaw(PnqwCHoAG5oo~cgeFGRo{);*ju~`pKU*edV5;?AZFUzk;QZ)24tON-
zL*ps>68VU1rlmA9L)x5$(4Q%ysRaU}?&6kio?!~wHdAA0r7cu}6HB?tI%3f#<0eNQ
zxFlG!uA`dQLuXSJOOVlVQIJ8~g*TWR&heh^vM#)ht-CIgUYU*Wad2(a0E30`t(F@e
zEQjLYj=1belKm4dA1~}+mBM!%o_$>CGxNsO^Y*3fybZ_`q>u_2o7B*z{E5qqR+Bv#
z(2ed9%r_4?YgvD!wxCJtP(6+_rAl@qg@mTqC6st&?qwu$5oV4v3UW}(xMWwN%)1yU
zW!^^Brb@THt@Krewcs0@Ab2OyD0YD6T0a%KPS(}rT$HZ*<3Jj{>FWEIy|c6!e2U%^
zobFe?II@W(e2Ox2w)1sprm24rY7WF{lV`{i97`anit=%3DeQMOn6oosrl{@Ijuc!v
zV{4-6y*|>;&p#T&g9Rfvfwli^`Ztw!+;?SjPjB&zOJ2%5jrqE=$xH}Hmr23IOq42A
z=sXvclZT9uP`v;Nm3Cd-Ts69#CA2lNG7`+b=7pBu8yWJ7Y;=pSONy`aYb=!;-vm)E
z35E@{>yvR#8wCRJ^Hd*!31{#boN}5HF=PT%l(>pecz4>mYA>lMeSLkJyNuoRipr)}
z7i}4(h?bnNq<;mWX=@!W6Cp$(Td6$t+f~}ZGuOR{?X0sh@WU{)Exn**9j!f!l+9#J
z<@Pu>(yR6;ppa;_5`{>;cPn8Cjn!9;la3lwLp;t2o>uffor=jONvvG{;XK3m(Q7Jh
z%{}dfT&6vTaL`YSxSCR1gFz$aQmW=cp~=oBcVG~Xdr~VbCqPF~AUUtL#5H}3D4lfc
z8%bMVZ8knO`@K`U^)0R3`=xR@KM!fCdrP4l+-HfAtdY6j&bzmrGKx#CL%$Y`;8IdN
ze+Fp>RjDD9Ty+NMM*HE{f*U6WR%$}#RI&lVd^Ti+-KP|zuTZYW8FMnc1ciXr*l}!9
zb6Kl1ot!%y>(X}LbyCYIfM`EaY@Io*Dg-E(s{46!H89l#{9oNfQkj?=+m>7aPph$3
zzXX0<JV13%RLR5BQz_{12yu8Y<wBE6J%}{s;~D`jmL)ED(;oSC7iU~3Ty+C|WjAb@
zE+954z!)jq=Nv3oI9F}sjK>r!*D?Y+z2w)FFhMJ*>||i6Mb&w0=4Gx81lg3k=mDrP
zd@GtM!5!Q?8d=P~diE{HPlr~pDB*&$j;j!>{fkjNB@WZ>zGj~nOoO>ydE>hqTSdYP
z?}*zStB-HS6)9MO=;b_?6h>d-%<?Gf=BW^DN>9whw$>q2e@rOI`5(dgD6a{ZUF5>_
z*o8d}{f?CR$HaAlwni}w6Q-KX;5wz|dqSY!k2SR%_qJ#(Dy1fu_gGh?&(hN-9GoTW
z3106FF2nw`eoCx9x^sx~=HKfIQe*s3Zi6~O119B*FF*4Rd=PC{uI^TpG6QXX(7Vz!
z$!_cciFN{Lz!gwD#L`7)aYIZVUbZAXPuJQbqc?#D*U>4bk9dK2$1Q<~-=y=XsQVbB
zZW06DJl<HC?ssY_>^fZyp72y4<{dnbUXjW4j#wMl62!q$zh-h#dm<0qr{=4A&W9=b
zJ1gq@DWmc8S(VxnEW~JKq06M~!92s&^scei@7~lx@H*(+C}K^7KvrsOXl+|?{b|mi
z;{ZRD#Yn_KgRH}e=n=uxT1^YNFyBpz3HQEf^H7?u%^*A@`BX}tEYECaOQG)_M78@1
zzqPLURrM+gfZS%TQ8oonj{<yaM}K1f@5$h4LPZVw1|`+^wt``DQnS~g?-(+Il~}MB
zP=SmI-ge5tw+C>_hfGZr3>}4L+G<<S-30uh|NMxj#%79j(wwTEKQo-w(|gz}GX<~C
z#1GR=6d=`q)1M`r-*ov@cujL|SJ#|L#L_k>o%jU<AsK*Q@ED_k-9ti_%|!tTpe_tz
zeFrP`j>AC8RZn#ay`_rLx2O$xID-Y;Y11NlteNnpTiE3FR=qdVB;YnO&JOfhaJTgn
z&Vkupb#1s~nv?0Ylgtyj`TTKyTMLhl98tsJy!D4`_fYz><*{qz-_@pbV^F#4&u9g@
zY(K|698W6A`}oLj292@1H?bXT2Yl#<^z@HCfVBFni2~z3AN9(24@NS2@9910qlSAn
z{`mMPe>!?3w!|%#LY@dB^K<484GD@#>vymDnaKhItee*9FPdWYCUxR^l09I<0G+)h
zQuloz#&4^M0BK@e()nQuVD=eVvN2b+e(-@gBdM*MqZ_Z_e1_$tuUKOaTO<NZ2;Zk=
z^k;ML-litf{E1v6_JW)HvJ2av#KWWaY(j55dhOrTYlL8subtX~oXi!d1Y<Q!3H+rF
z40m`<iA(@<YmS)eNpgYw7ul7jG`;gS$GEJugods;E`I?Fi}opRlA|Rc?yTeZ-@O=R
z@Q6;yGKoG6(Atw-J&qD?dUF7mZe$ZWx({u1;P~yIK&J&JCeYctD}kN*d?6V2b0vqj
z5tX)Dx<5yJ0KJ&A2AslEW(-YU6Uc9FIAEXwNPAB4t{k%vCV)PrgsE25h@d+xoK>12
zW2d#$yu!0w)(!3%0Y>fD&ZBNnNOs2MoZjD3etUJtL%rg^VX622MeXy)w*4Y$m-%-A
zZ$U0Rv+)A5SODP*OdK=3H$^~)$I+>bRt*vlMPDxZy90Fu;HIrSUG_{J1(0ne@Rf<l
zs{geV2PR2lj(zfZDyH=RcPSr=K0hudB3uC_2|u*pMH9R3WMrG+vStlv1l3!4S`Kz{
z0oYSSyXTv%b35`WeE(BEH2dZAcuJ~wpVvNcMBpbm@&Ay|^j%+z&UPZCc--1R?i2^O
zM4=KK&4If`Sf2nbR`eiE!BWE?s`Bqk`CqC+x7qAXTD}~IN6#0n)m|gxrw}9bGA#JZ
zHD>@BS)+4ojNPaP(#enr6|^p)AL3szYXqNvU}sco4-zFP=-LMXB{D6?kDnC41C+}1
z8aMZ7kv^0Dud--m5A*87O()4l3Gmk6G|DG~k^9<euaFy$5eIWNxK)naRC_L{k)S;d
z=nT?@jcNW6q~so&PN!Vz6uIisVkyWq0DHM`jPAzrcgjc~!Ql7NJh=qcyaE(eEm~E+
z9B?V7K&U7e@38JyA&M?_pNR((J^)Hb71o<$Drf;pC)vPOjeXwdz_Sl~pB%K8Iz)a$
zM=)#;N#@Lw^4*dq6RdQ1Tn^Y$G}Uc0k}d@J)G3u@o0pq|z5rPD+m0!C*)0^ND~|&F
z_aNy&MX3RRk^P?=z2p-aP62&@vmhQkz<+a&s+of(`Y)p~EHmM0l0@(t>ecA{&CwQU
zqXD?nf0;^zpG?C+BEAb+GV54z)6v==U<w685@>GXGuN|(th){e(N8XYTF)xctE{&+
z`D6R)J9BVXM#ac4BFQgqWStV-!SU72KC>oiVg~Ckdzdk2d}0T)TGgUNYv4j{p~J-C
z$>n+sdzWzNx4Wzx?(EPIGA&E`ZnEbc1z`1$cls5uZccvimG^r3^_&F2EMb^Ad(w>d
z=>F>A2E`uJ0h;%X*cFnE>Rp)ligZH{0X1q=$8YbjLom_Ls|;0nDr%_5Cr119Fbu#e
zyWg0bsXg5R>{fLZ&V_9*?02>&87_Jk9CtL-bCA6GhdVX<1s4A}epy%1g=U98?-gZk
zP}0~EV1jx%Ix!XFM&SN$P-($>_5gNzfXx(?L}<IwR?DKJnfg*oi7u;)vOH384F{3|
zw<TUo^iBX$A1~W#n%Jd3^|;%tx9{}3e=<BUTn@f^`73|t+&3azR!>uuOYVy$JMcs^
zSN`(U%poXzq+{{Tewz&eQgC76O}}xtoQ?oTkNkno;3qDCOLCD<vc27qKz9(ea#yow
z@T%c(-wWM>lYnj3Dj@OJ?^(&E`w&8Ngg_+!Z_rV#k#4z0qObgK&{1nalTXu8L`sc+
zfsS@%(5a`!65+bx&aaDpKY8x|0Ubpbl%&63Bc8e&QhKy*bDf@RZp-Zp-&-;@41nXZ
zywH0py#rfywPY`oOoI@NgIlgGj=+}A_p~ZK@dU^<f>R%y-gn?*L?8x%Zx$``NbH|u
z{_@tllo}lI!<^d#;a4MlT$<mi=VucR+_6{nb~?#`BEi@t<*Z+9SH6J)iCAVFbm8~d
zA@o35g8`mLa=;q=csGvC90&g^+K;raES3P*J!nwyU~d+{Cm$Khy8o>XhhK1Y&a>p4
z8Torq>6SHB)6%U-pR=hGXNjPF-~ojD^R)n0+P|WcUv`u5#KN3&7?S$Mj@FN0C}4*o
z$$&agiJV&f;<9psKqK$~K^zhT%>7P(1Sz>+lqy2W3_{&T>Tx@a7iRT`Yp7S^hQSes
z916TBcZJBaAuA+&PJRbdTf$y8OX+$QfVJnO&LT-ec8NClFAdW+D@5M_0ABTBR=W((
ztVo}0K79630bhplK7X#9a&8m}J^aTi!hg~Q*fIQlcXF|hY$u6vTL|UL_1Fe4IlLd|
z8zo|=08S@JrGeTFe-NOu*W>5pw;@Adjq2xU;=`|ii$*||0JWF$ABl7=0rfDMjN^&$
zQUbhLK@(}cPwNRBedqQR|88q?MB=^1sT?9^`jS?=P@wY%8UXgL(n|;%C*&)JWjI~A
z4}}4dKGdE(3n4{BzTg1qdR!_fJ3#Ih3-vEdigyPO707FIWsXm10Qqag>LmX2=SM&O
zBnD()4rXQk>J$#E-LZ5hdM=SK90a}`NQ*5kjCI$|qG_QKFgEO20<(98;KzwDAW+MP
zX0B?!J0fqOC~cz1%>jfa`XA48C<NITfYBgCCWddHz5~SehrjlGtJ$@2vFFz<w0AfW
zszxr&B?Xj$%f>KOvm8#Mt(jMGkH!^jzJT*t3~*YE_hx|HxZr{DBhB0$Y7<h+bKd+j
z+@Pe2^P+G)bdAp{1S~6!!e8n5{@n1ukzc~)wZutTJ+0QFCE%o`N_6}uc_a#^?WTbj
z`%S*^tVrJF5g=2yIq&Vkfh*uV22#6Ma{dOBdw_M?XO6vQ<*r=~!0h{18TBX-sHG!t
z0)hKxy1{VWv(!DK`oekQFge$ttN(5^pIxB}S{+#400R28;a=obJrOE;;8OHfto`XX
z$lM(X7W^S6J+p`CQz^ttsp|4<O2FSDHFZ4Q`G9aD0u^`vlQHinTlrlDCTWG_5&IpB
zIs;LoGdhb4ggg2qV<Oe}?AiCsg1QCZg00c1-$<GU4;*vNW%vfj%bX>0Bss=YRih6~
z6F6P0Dhk9-P$m-$?tdw>zDcX+W*)|um@!q`)9ScBoBA7s?@Vd7n`&?(^}&CoQ2C|L
z&;_w}r?+ADL_U<S4{?vkRG<_p*QgNx!TZQ|YmaYXLW<?};CMb{Cuvw4xju&o1bE$&
z+ilhj89PK9U1vW>3a(9o0iexgVN6_^Hi5V$pXH_q`<-3v{bVa&y|oj#9tNDxvu9~t
z2o5NzC=gR~{7=>qfBeuN^uAvV_Y$~EKGAXHyt#QDyOa|TCa7>pT9H1y6z&&e3y2|f
zH8sNNU8g;;>{Fd}_izs(ynxxAL6X<pgy_$gYM`T$B5R;jqu*?BOpb>U&OLcJD=h?s
z(E14a;sn++PuTY5tdrh*<!dliEu3mdqkd)QrHSlx4{FN6a00&yUeU`slla1lEV}WW
z13!wB18Bb&jqBn3I6@2$>_O)<?!<7FMIn{;W_yCCzu<WHV$bkpU=kg=iD_T~cc&8A
z_c@mP{ClpfTY31|?FS88yYvsWqQlaHo1hxDS?#{PM2z9RKBf(~pzDBAvBBM-q%}*O
zK)6Bi&!=b7J29NCpYuFyx^3gDtm}oVjz=V{29<&CScv^|Q{fIu)|G&4r9p^v?B@>b
z+)Ez6s9R1-**-<m?OD0&Bvhne^j`ly=JIH3PpZGpy8zD&E$Q`i(D-Z){(I)FYZ4#C
ziN|k_6c|liUMJ(SUU&P(mk2P*V2wut9!b&weyoc;3Fr6i{ucrH-T6e@`4<zKKVo)t
zzq-s5rK1oGPQLieI~v|kMA3I^aNdMv__+cCm$MX(hnTDe`3S+B?O-v#8}aK%{S(>e
zUGo6Ji5_1b50cMAC=gJgNW8M>zfa^wi>_?i&j<eHr?2@JX0YV8>k&ItRsWS445H#d
z%YS><1eW^eitrQq1o|wIV^6j>pnxLdLx*GeF)%t@GU`fu@{g4H<eppqcXF`LRkVV|
zJ0^(oW3SSits@k4RxG?JeA=#Zx=i*jX=seD62qtUhU2#w6$g4yOci@ji7v_q06!?C
z-fS&)Xonc?#K-Ra?=!6KiT>ZX!LTZ>o3X?^DsnY7Z>3M&jgTI=V1%YLQBJ@WAX?4U
zh#e5nDG_ftR>=dtc*>)5)?0u52btlpxsrB}5g_{!9u|w<$NiymZLiq>h&po2C#`6$
zk7)1jIr?t|u1}CPR0-C8y&pmBH%voBIInefU;(88j;w}cv*i#Fxi@)?;7z6-N-5`)
zP+^;k1mcma3(<Mzm4Jj%P`a`?LS&bDq`5J1e*$qIH28PlU%L1FY1PSsrlDOvypp&|
z)8$4KC1?g-ueLWO(z(WnZk=hXuq6dwt&HGz)zx0PLNF>7&CZ7lJ8=!(5WP-tGG!~3
z9<!E2HW&rJ_G5pB)APSFHXSwDFSpY^6E*$l+?Aeg(+n^QN?9jBN^^;rt~I!JsJR9y
zYZH9PlbB@TUKp6~7R#Ko2Za5E$A~QHgI=xbfWQbitC3LmS<#gt0y)TE#>jX3?2C{q
z{oL){=an*6A2Zl?{e0d0bL-<on#)W{<~;QfVs!a$6e_>(b@i;Cd%gJ=5W~&j<?U|t
zTY5~HGVBU8f2J&|ul8K(bcom`>%-IHdxUJgmo1&N<H+`HS3^VudhO}zYr=LaUz3%1
zlPQ8A?RcrnvG~w#@_<m(V_7#tg3_#4_oQXTO%@=Jtk?Fm|G|;A^fM)8Fn-TutY#9i
zd(7{Xtj}d<0yTQzJJp%E6G~YAGw1Dn7-82T^sn4u1su6|&Hu=P#dI$3Y1Ccv$HwF@
zF!R<(qC#KMj^}d!Vsip477}VldsB?~SU@CIF++`wtVln&to3FrIa06n$8O=2&TvW-
z^J|3UA_JYMwPXWWvj1=4s#*p=J91ytO`q6<Xd%1iBWkzIV>s*_s#nZIOoaa{ZP>5f
z>J3|D7Sub1@9$jMA?}#$2d4o2I{C|Q@C#qFF)=RQJK}I?o2l^ry{@KqIlT|JCwRrq
zuXk`Qq?Aw!vL6>LRS46CApaJ$4&c9Ts13TE-?RKx*6au@nOc{p`2POWesDkY6{%1&
z`1K)l+se)panKCWAz?oAYTy`unXN2sKMN_W-xv*swN77KIU;8@$ONRYM@b7h8iwdg
zUeBxP2rg@8dGKPFS+oOC4h28<uF*ewF7HQ{?>p?%@FzcCkuVcHd+Q3b#P)Ybvv)6G
zP(De~yzfB_@iZYJ50&%D0@f|#H{?l%HKMHp-ThiDIT!QantI!9j3BrC3+7x;ZJm|u
znM9s1e=$3%y^SI3U+=l5?K~i^qV0$h5AxV9&2pJv*IG(89dH>yfhPf7v|v-kglAY%
z_5%WxlY~w^M69S$#`YTe>s$D?S#D1t%lc!QMpor%x6aD+OxB;D0bCJwe?10yfP2;h
zBfCGq=(mYrbh?;eSre{<w}!7PmlHM=3O~D5Jxss(UCsknVSUnCPgOD)m23P%ggaCA
znf7{pxo+84s^cW~!%u4ltvH^HlqyTyq0CM28%tAl>v+$9GFCmh=^+?N*KEul*qA6c
zEbEcN+`v~wxr{ESxU;7|jIH0a9ze&|+byH&DTO`FN8-A1K1~@9uv$gnB4#3;Id|WS
zY0q90(!}0-@1%ndJB1t`JP`-ud+RM$Ij6erLZ?wN!@prT;OgoGUUcC($I2G|#x?Wa
zb$o*Lqg;0FjmzPlBebMB1-RhGN6z2;Zk;Sc4GFG~4$1hXk+WL7g_*V$rpnW+sleFh
zuE}p4l(dSee0IKk&|Dy5UB5uYdtx#=2qN#gl?5>U*QseTLX4O?A@8_*Xj4z`3+fq{
zn<W9LUusQR_{5<bPY<tKiLt)@u4<MP`cAb*g6}h#(U($DbeN-s-4c!L`CQ|{GVV;e
z$WMn9J)j{@Ht`}|!Upx=t&}0ozd!#oCqk<?x$IrsupaM-gO5&ovuo|HQ&bI4co<Yn
zB)`0%R-+KinWyKPG2}V<tz+C)DhsA49LCY%1cCG5G?bY#KdXHBoq9k_^7vwit1_pQ
z=rt*Y1XSX&%`%Vje3LUullS`!3htj8I(p3Nk|>GV2DOmOT?0li5BmeAeWA<o!>TV;
zn5e`v=Ew^qYMr0YU#nphpme7xXU-owB#?hIfGSC3(^%7X`X<!3n=G^D*$08H9?273
zLt^fvw_nlxfK9a50IaA{`F+;kZ0VWBnK8&}153hsv@~>ixr-!YD`ukGtO6@)ZqLKM
z7FgCBb(ny6M{OE|CRx*}PlD9}(k}-A-Q3!b1K_K%X=`uod?ej!uCB$pdmkqJ$7eCL
zV%W|PFmRFAr1ehu_keiua<kF=qk+f{dBpZmys*RT!bnQ0FV8k;n^!>j0!I&NFq|AZ
zK>Hz#@XZjEn+aMCNwRdszLN04!2`5UA`XwCdu%gto}G-zIW&r6f@`EZt1%e@tC5JE
zh~9Z7DK<B0--j=qAw3982c4rpMt*&72R$PPz~SEJyb$5oY9aJ)W=wGBD<6D*ekH@$
z|30POP0%JK?(8Q2Q-XP{84mw9x($Z-!dlA(rg-;+0kBr^SKcy_z9tw!g0<-d`u3NO
zrwMx?{CiE(9Ze!ri->Hskp1n`FTtlT*i9G6?OvtvY>~z9%iRtfxq0j94;VXdM!V;c
zzxEbp&o4IbMDea@IPr<buvGEfi?W27pKEvvQ@PvPNP1_YlUw4$Nhr<Ei4BTH136hR
zDf2`3Rbx-ZijTi`9c3zSjCNfMaQEEVc@&=*ApYR-ugNfWy-zvJ^XtRlMDAfzMV@Ht
zNf$$3{`&5D!XDcT+fVEdBsxY%0C2&kO<MTwTcRHAh?ODUAv}kYBdCTkE{8_`H@OZU
z5WqigPS-iCmY)p$NAuP9pVA}f-=Rk`=l;kBOvIo5;No31@Bh(exk$6K&h{!G{U>Nb
zOZQdK-VY3laqNj<6|J!`DpV!CBmbv|H*F5YswXrh$^EXp;Ln0r#pdC+Z<YHTT8k^&
z)piZqORFWH6HBd}xGgv=V06O_duLMyw59YCH*5FPPDYNUixFcUYxFy3Z({|1|5<v{
zUw{05?q#uge&p$E*h|(2_jJV)=#T`4{P0@f!9~$cvYmhZfS`zkV+Uk8fxJD{8i)4&
zcUqEWg4@CU@mk17u0udQp%4ds(oUUSJ$yh=8Y3x}q4_815BdT2(4akmT(3W9JAL%s
zql#lW9M*5mXb)J<dhO`JE1)yVmrN0d{?Hk7pfiDvhh?MhPX6{I;LtT{G`>Sg`UijN
z{wc7)+;NQ#Z&waXdBX~ck=5=`f7@{z2#Wnb{iTWU)2>%#d+#p({OL*{PeGZUlM#{_
z&gFW4H>+btJF<J#^mFAFi`J6sk?K2UaDdbdb<o!0=%-G^S53UO({LsUooM%j0r=y~
z&;LPDm<LRZi}y$Gz-vz^)sFKKvjuYKmq2icvR>d_i%f89VBJ%sIv~wrjW-q!3~CW`
z+J+mRTztEK=P^*Qe8n`=rb)ODMB9BbkO%ui^*8TJXt&k=%l1O5jow{sDe&Lq)TfWB
zpx#lO_b{M1cgvcJP63vP0<Z}7y+!0<4+uDfA7Ib>Y{bN2Z~f<MF+gu==BF&bRZ#f@
z2Mc`AB>@s5fT*RQ1xY)lul0;5--CSjy?#1BgN+F4?ZHz`JD)fM-*HVzGP?{PosZN_
z_TNGcow>A1yDAZx_h#(3pCg2iTA&B+@NBZC!Babm+Ons>Px{6%fy>bRJ<)c@5kHe@
z3F2mQ`(OK<$3Iv8WgASP|F7EszYjQ21=fA{(cZkc4P5IF8r>d=_au8>l6udFQ?DD;
zi12xG?U?s%aNfJ&FCj><2Z`RZKpmGI$5#fzUzEb{u@(?3`y8k>viO!?ewjr7#;)3r
z0sjHUxg{_X^st;Dr=!2V`!h!Tr&0mOT1I?PZjyDM49<`P!+2x)!kET~ZqJz+5MB2>
z{~CkI2<r7;@{Ii{=m3%FC-ktBdwy%`e?_^=16y9S{uNYvItdQV{2%H78n=cPk<oL%
zzWXyY)Of(>e#!pL&hH0K*zP_-j@h22-X~}=9SRU7B+Jewn=?4?8F1(j2-o*s;Cw^g
zTmPpl99}Z?P2SJ>FGfFYs24`zx&P_c9KU}P#D)K7LHySU_utkY%Q*G2KH<NteK)}U
z7mNP)0QaBH2`n7TH+3~|FIgH3*%h$3NQ7g%k<j~rafcn*e5(bnFhC$eU?1hvf#Z|@
z;Dlp%<6``7AKOy~kzYYVL+?R+_AB?4fn5*63p_dH3&W!{%|(SyO{=eB_k7VB=Kl!I
zC!TMSA6evgBi(TXh2Zz81EQl9V}kgO?gp^~r0rk83e5#nmH<IjW%passwaC|Wlr#b
z{}!5~H}fo)$3@r3b~Mvu5bS67)J>@<+n=rMdLOH|Zoo((#~c5;39?uADdhRJ*CH==
zB3vm!JH<K`j{f1Ndw_E*!8fvWUDMq&b?_^M*vuK&OOIT<>~?&2`GZ$}g*g4CVb!A)
zH}>4&jUb|T<FMOTSb=BSsDa(0HBiNc#~`!McU`g78;}O?rbPxZTC^!Tpyj%oeUE};
zaJltF`QyQideu15@QPCndv=1Z`+p5|sQi8*PZGyH7aWNKi|M`IF=BKF><t^Ff8#LM
z-tkj{)6vYln=eQXzFW$tTyaEp@4F2^>JEarMWYQMK+KOIr&VEcfqyV-M*<BqvdF~t
zX?RjPR_tc=1>eB;_QGA8ALeh_FGqI0;1^dQr<1i^k0NeOaE4=p41QZmK1k98WuBhz
z{SLU5i}@)3IMPe24UG#Kyr{v0biWRb;HgqC1l04zi3a|5WE#I}8R|4jBunJe6MOpa
zw3C%UH0O6F=RY^~{OQ!azbyV(kQZ8kM+gyc{^Yy~3l<U;CrkDYrV9Hs7=<t0!ijEV
zlZdVz#tS<x9mSVT*Uq?fL}$9qxQTi!xlB7X=FTX8Rm@t5e=I0iyoo+=Moy)({Sr5a
z^)+|&yP$FX9T8lw0Mfm8p$qrClfA+%^Opb1U2QoNeRxcxE!-{)+}dYe_@gCwJOHfm
z^C?czg}`k`cr><~7qtl4JV`PrR!{5LR~aw5LAE_F8dJVlHj;NApI7s~%!-GbqI|xQ
zetTVX)hlQdaFe;5Fy`ifCT39m<I$oGjx+|O=9GX6`kV5$Bz8K<C`gksqxjqaKP3A+
zL3;NIfqXs^z(peg<M4Rn<`$MP-04`pHCXq1+S_;ehVW{7n9qz0rh|T%DTKylXQQAB
zljbX5^H^&i3bR}(SYMOxOW@v{1(@ldFDCJ?wz4;E!kttBZ?lrOJ^}S9YSkx=Ana#^
z5Y|Vh@926#fA6#mCgbReb-=9*@GcDpZ8<j5pT+;52bNK5<o0=n!0Is5%Hr%CyDfzG
zRMCDLKN${RAyS!YJ8!pXBZioQ1YVo%6o>~i{t@CnyFDo=vXDQsGDv^1f3w%arg?p6
zI|q`i$M^Xmx|uRFF)R^2?J|oy=><?%>QegScB}LH4jKYL=&ebW=I<Csrvt<>7S(o5
zGPFeDg1{$`f2wJAmAh#S-S;v>@n8;zK7O(L=+zs*RlHROCNgBmj=qf*;Qag?JQW0<
zL1i7IO8xz1f##Ekx<XKd_b?4CsH1$A+R)-$b8cjsZbP8QwL!A<8Ip@0dq5UUN<2Mx
z{u>$rs-r{TnbfJuZG8Op@{O%^hxm=UTWJ*as_EoSi}mn~wXMeTEhK$AWhP-C;!-l>
z^^fo+qdg9QNjD>-r9gcyc7a@+7%F;!vnm#@nRUESGlp)xV2@jBF7h8T)~Aa3asmje
zhwo|A%aB|v@>oFtuo^%CuCc76D*La=EY3EkI(qj4Rxh}gnZdA&HvR{`kHFah041`V
z+duA=uWNr2fbwqSqGuJ!3XX&J#M2C&%dputZ4Zk{`m)(oNZIN}K$ve>ju)@nyrG|a
z1XIzBQP$Q6Wkx!Hv;<p#5dhOe0X2QkXJSISPY|3rF&UkLdLi3xNMOU8(`B-rbsEsh
z(;x>yLlfvx70@Hs^p`<n=%fp_L6}SzswNoDMI+Ai_eq_nVjjn7<wZ>IlxD+K!2xnB
z*59LFx^$3O;f?tn&T?5<z^0utO&VgB(1V??zi-C+_l^q9CPVtoItI3fJysLE!E_$A
z&r&t3+d-M0T4knA${cqh^+<+ny7sezxRsL3^0l^DMs@$1KHr6yh}{hY0wbLI_%eSX
z`wlj|JrkDoveQ5oMc<}#%n)o~5+ni~8@(YO7}Eq8)<k}pWIwyk*zspGk&l|1EFvoI
zNJPLY>m8Jt!r`i{6Mer3PGAZC4V;!GYvNhkxuR=dR*w0j7>?|?J{?oiZq!iedj58m
z>(`Ka4}5JF`o<MYP5CBz54JJvtoz2j_?4`t@+Tu;K%N!cN#KJ!zzfv(H>hsYw;`=A
z(SbNRx0cgk?c3BRQz=)<p_bo~eW%oC0W5tHL^%$0*30!VG{QM#^N%Kg^PRywnF!MS
zactf-xDS2N+CS9322m|6u0#j;NR$M~;L_5i%S0KxLLJPwo8FZlx4rzBV$MoZM$7ch
zsTJ~gi272t^2gV2RGr7rvKxRTCeC9HSCIy3rp#V^$;L%7QLhH5&AGb@mxH&4EoF{0
z7trgtTJmi1L(sr3byx{@*{O_<f@#@Khm-U47Pb^U(VV9ynpiT>`8(LAmIU=Fzoy3I
zJN$p3vBY$aSTMvdeeN~1Z^2b@e))DhA%46QWjA3|ytL3K&Xuivee0U#N?*ihX{gWB
z42$XAkA6G2E+s_$JYuVKsno;DLSpN?gX^fJH+EE5Bl_#XjQ@|ZFOP?6|Np;<lCmX~
zJrzZ^vSn{o*>725Y^m%t_I;WtA=H(~9$7NhY-3khDp|_DXC`}SY=go4-Ul;O_kKUW
zf9gEOoY#51U+?E@f4$Eb!3Ua*R<$g7%4<>kCptJ%Kwb)d*;U6R3GSZL-Rj$R0_X1?
znfgu11~6}ix8I9pjV;ZTZt!x+7uILZ1P%if;XsB6bDHYcKNuT*BfvrCw>W8(8b-8~
z1BVsb0vc3LI(}XX^xUvB-ZRPi0U9EipHd?pOX$B|eCdi<i?}5`49cDBLCursoy57!
z_+|ObTZhm8{91`e%+-(F!626RcC5*{u1XuLHmdYk3<Y`)EaKvuBhnh3Ln}0swF8U^
z-&GKpw@qc=SN7`C8+juu?n!_F731bN+5yQ0c3G+%;D^7PL3>T?#2wW{<1t<7pTs;@
z#7hU5d)&9#PY+K;iq+Oc-XFhTz)h2WB1d@^v)k<ZKhKID@0+Y0eZAYJ>=~m&idV2)
zDA$bX!KjBu2USmZ64D;tC`-Tj@~Gff2S<Y+=TECiy?@szEZ|`sl^hXen_i&(EIP4O
zxNb(}HY}DsF#6NyXauHd<lH~*r;i+IT&gY}iw~)EPmDEFitTBf)yG%rI@@ttwcqYZ
zXwM`JL@X@9q;@^tVfL;6pytT3L1*p2eHqs-wiW_41CP?Zzjjbif{W&$aNJBRb<qJ+
z%tx9U`zb}80vX&<O}T@L*C+$cv@3WuId(+P*uL>F&iFP`TXj%$onoZfw;we>e6=40
z5PW}_5p8D%Mv`ikisMdL#hyQlam_-=W_2>0#e8Ju5PlpVB4V0siovAQYndH8dlR+a
zK7~RT%Qbr%pH@lVMED^NQ8bwcizxNDhRyH39$Wh2oYPKat%-E!2C+jsYww9QKN3r5
z%*^`OnvQbS8nH{DaHd{oeq$9fhc(YE$=$eO&vrb-L>2Z%R);^%@3wGACG+45biQlG
zCtcXMEQKU4v;b4FLN8URc(Cx!yJ~19NUGW@9#8pq)x`0Em8Ca(nKX1HLcD*_<<<XS
z&B<PTr>VOVLbJb)6~%j5ZYi<NNgI>)0#mOCmz^J8GkaHUkeS?u=3FbC{4^5gvpgLs
z)|?3V^!`>qR*PS*E0S?V6^z5_v)Z*MmV4J%nQ#c&s>idfZz}nnr{F4T)BNO(P)fj3
z&>OK$r?mwf(UjZMZ~%!ZQb0(atFcUwUR91FF6FHem)=L_ika+lvfMZ4-xW)}lZXi_
zRiO$z@`z(v@$?6y>3^atgcr^{Z9j!Wr#WI&u4~~rn2)OK9*gr5v(6`4WL%YF8{+5F
zz5fVxRyB*}3+}6<S)VR;xySg2eLSm(S=GVLVE`32MD#(#cyBOsBD?exeOD&L>5##^
zu621~Lw7h&;b?>3`?IGzN@@DYP;Q`TeHF2cZlhK#j3EJS3+k1#OC6y!2b8N)%KnD?
z*#|PHFL68g5P!Ju+6Q*K>Y$#@zPa69nP3V2+-ngJ-d7i`;fb#MkB02AnF=a)tr5&L
z`1%*_B?Hc6MKzZf_dSr7wN|5!nIlj;!0aN1dVi`Zrr+Y(!vNW9ChZAHR=x6w3B#q8
zuNr232QAjX8YGDv?Mu^|u?D`MoaWUuAt(v4lcA(Nl9i{fGm=&Dp?8=|Bd*j1`yJIW
zi&^L`widC^lMhiNX@^n*ieh(IQ?7$iMuINvxh#cP%}~jaqu1yTXy}{>(QE+RWqg&o
zkvSbZF(7=u#uAOD9zt^?B6jQqYZTq}oPB3*;$6Q0>_X*gM|>0K@sRMxh-u@2m@<3U
zNW<aE7z8VbWKz<s`6L<*;uQ(2dl9$+=ChbZ2kl<o%N)ifQN;qdvyo_4K_)_1%sn>z
zKb7;sUUp+iaJzl^X8Y0{d*ECXEBLg=J{V)k%OkIy+e(HbgCY4^R0AQTJ9ZczK{-lY
z_qO{cs%?t-AY}8cneHrkardfBk)9E?LE*DsMRB*Z%MT$jdQa{5AFq&J)A6&WJ6FSa
zQvF@cZqpdFIGTN9MURnYkCA<67fk&Eh;5Zivn#2JgtqfLYluyXUQa6tbqJhx8NbfE
zp96=9LO!DhBiqHaIu7i>@LqsrT;kBRKCW{#3sR^&KBm~+XEA97D>g<-!Gva<&*LUD
z!UA~P$HASoRaSNPWLyj4YRw;{%DB!Bjp~P{wa>d6;asySq(<(5uSjt09EZhsSQG6F
zWn440M^apjnECo!b2<Gtts1~1@;wD!CvS8}cBn0&9*Lp;TuoEMm~cX8Nbp?EkO|!H
zF5P|Umbx0psp+n}-%Qq@d&-QbR69d+MbUc!F=V{9fcm6~Yf~gd`!WX*-v4O4RkOmp
zf**}vJE7=IutzK@R!`a^7EqOorIo}w?pmzz!0JpU+9uku<nx)#FP<sJPXs8cwFV9x
z#-w@kUWUPPO?93~Tcs~1>SRmp*}s>GJ4;?_KAO#yD&Ae8#cFQpyO;W!x1}mu*d*7^
zo=nI3!tws+tL3j9rL=wR#-*(c3!Zj=Sl7Z`!N{oA;)vRT;4{6E^}%QQB71~}-9e7E
zhMEm~K=l~4D;Q;2p4HfQeYLn9d;LLx*_V(4uGYpqTXtXi>bEs3mf2l_M=moVqtMB3
zG2$?e9UM}-fVG8$fnwWvu_{mROCmLM-S~Urpg-{#k((GnG<&ljH@!L$y>v?gW9m|*
z_jFO(_7S%B!Ypygm1xX`;;frwHSU#n5{wH97(M+yT7+Z7t-rLd@<rP1uYbYWctiez
zGxAPVD*CLnMiWA7BC`36tD>?l+h}8w#v5$qvTNtv-}E&xt*rnQoAit2WXcrvDmdGh
z)@8`Jvd@poguZSULOfh5?~6BW%$~L0C+@hf^<`slad%{%(6D2WdoKp>i8uZ(hGz%A
z(WpOL8zti!D=`9&6#;yFe#-e^8$JY(zHKLOGM6V&)G$T{d{gZW)D8>^53GNS;Whc;
zvm(B8LlzmP`^sc}PTYTYF#(NPTL`l6b(3BFT7PO}P^$7HLQ3bgv|O>5;$@ipl9yDd
zw$Sr4arg|=449r*{6#}1U9(5}sR9>ZlmTWB{LmL4p?RUDrhjsDY<dlkI7n3RXCZzz
zsr?MLRYzu*<n@u~Jsg6JA_jP_qG92pn&}Bb^xq?PSqyzuPg_f@3}+kHw@2K1pAA^_
zneL=vXH*=~-+1j*Xq2=ScIM_ztJe9pG*pf@aFWX~?BVox)jE7eN6>~$WRD+t-ej24
z>A;ULZTvq<aP1s4dd}6){!<Z#+hJ-tbM!OPcO3xrp~#!}#r6SZiNG!`PB*`)C1O_i
ziE@0w^`?XIYd>_C!nxO+eQ*P7(u(-qx-*W7i&|^bYpd}i#0kW5&v`-Sx?4^eZn-~j
z<@QUtxsMEsbxw>&Vk$Uzv%s&JKXD5Ya4d~ZgQw~;-S}?*zA$=eALcXUW72Dt^hc)X
z@_NQ1h8y?2>A=ooTZ@OxYS%D(oyPlJf|Z@8T=q88av5f#+GAm7a#p&g@Gjmdvhj`P
z2GFewz%k}GPAWIMJ#e;bJvU}meetgJ@Le-usbMEGJE>tevn;7$uOM5Df)zHB-7d&G
zdiiBzpGk7@+w&lrk#ckM=iTO#^-Vn7%Zw_n6`X@J9v41WGj_GcG6zlF|7<$QB!sZa
ze@JvA9$GZxS(9Z7Sv~6_5$hGg91uj@B{Tt}6!7uJ7a7+G@jWq1Tyl*gzF&!#mrXCL
zp`0@(juGQj<?1{GmEd0*Z}(ul>$nBAAJ!Z^F~BOJ=D{tYk-Hz>dNxe|_>HI1S>p@^
z*F>z+d<~onhPrI2kB%f`1URgE=U0NYSNq&U3f6aQHW-=ca}r@WHJAK@fRcP%BBf&@
z*io+BR)+J^?u#B-QodNK+jof&ZQpx9eQ3FGQ9jc?sBXO1wlxK%kfL97kTAtc$oN)M
z4|btYY*(O1?n-iTo@czgaam!YOHE*P&5BL0@*`=h&KnYTpI2FobAs^I*tBrnFI)t@
zh5-Yuj_1=s-IC?HBUvTGu<12`Ju&mr{-kc%Z85?ubuazfqozS<8`lGqW0O3pr)fK@
z6+eGPq`Axa#B91vNzq*b@2cyZn`XTfX|J!;J0j+)Zp~`F#ppF8y4m+4mTs>R>TE;t
z_9h(V2;#w-TeB|-e{&uv(CVcO7&#$gog2(1bqK3)ZHic)XJQJhSpnBh-yb^5$;H%6
z*>B2mii6xb_!J5IW$F6|hk%&u4Q>;DSkEKk{l|N5Drm$S1l^pE3|<c!&Tj+_X=0jm
zOz~Z%OR?H*K3ZWZj(J*njWmp@*)<$@{T>D3l{3rIUAmgat$SLp$9jIYa;Ue@reU%#
zzCx$5<!zOC?;<El@~^_R)1(a>G6hUvOY~?ALJu9E;q+m&KQNR-8uEUp%o55@!C`Ce
zFIEpsFU|Lf3<&T&##V3~4Pm$lqY%+SJu+CDcgVq@<cL>t?eX(m*o&OkdQ*)P1-KL$
zcop(_;r9HmQ{^(^@3HAlW-drV;dO!*iD>xzt=4kLx5?S%%D`I-EKS_vO7P?Hs|{y6
zdB^(~xtCEkN#2<$KEmTYn2I#p7Efop)xZuagIDeI1L#YuQjH@7D}{kG4mRTl(`cBo
z(?ztxSR6~WP${N^ZXALKSZ7Pb>Z02#YbJogjDJsiq1z@&xUo85qcy;SxAZoU(-{%g
z)3)=T_2Osw8F><uJ6~wAWt4YNJgC~q)C^ymI^G+EaH{df(dVWUFx+-E-ffa`vSr<;
z>ABWT;7NsD0AIL)xZ5YO-eQ9=RhGJH2bn<*rq5%y6M`l&f4h%WJIaMj26pg=H6}Ax
zKDUg=pHxr?IVCtAhFMFS#4P16oY4zd)O;i@EOhcR?7&lrN)QR3lyNEuzkwha8T6S8
zt30o*axhCcrCRo`3Fq8e4%em|@hqM#7br@s5SlWd)QvTm{p5@re(kKgc<9W8eVujB
zY7Dk%0E$45`v+)LI<EGhq_eexSY~s@z;85U19wf$Rwr5GP3dpeC>6Ui<jmkrMXl4>
ziM9*y6}UlbQO)W}@CG`}gIBIwo|;F=gbVpTthpsT5Ou$%M)C8VRcwQG9kK4z`G@PG
z;NaQ`V!Mw5^eQVF)dMSh#J-z}i>$_8aEo_Kz4Sg#q5&|Quzuo@hL4X0A<|FSC{zV=
z#@@flz)(KWgRfli01pdqT&j=FJ4vhFV+uzmmR(VX4U1mRaWVX6COEO2Mp1ZcxqF<(
zcw3rh%g+n?bu9BX9^B6MCEjd>A7)pMjCkN2%lG8vR|s*T9HTW0h1)I_Wa)RXj;;s#
zY4Zp5bR(s$z9iZSiR@>Tu)*oKd7sf-X^CGQHzB0O9;qq`h-wgH$xhy|9m3k@J(#u`
z49Z~^x4Zjg_OK{}*!p0dV)Ivn<xr_mMR&hVW1%ApA)%ga#JxgSl`lfXHzG@%L-6nK
z?h04=)3DxSN1b7OC7rsxB0YT529s_lJX0i8Kzd|NH<dK({!Q{mfV9rhg%%rRpkwqj
zM~tULR`>jhhobMN_$xjmw!n6bK`>9v79mJe&}h}O6pRDEH-A<d?e!oyy+rEV2g^?0
zOi!~1MYnr~yiuIQi?-4I5!Nxgt$Te1?a~~h4Y4elx)bR`t+VT!)#|WMj)Bi-V%A(&
zYcC6mRymek!U{))o~w7zs;`Z)YkfZ!F7rw7ka94rwLW)Jpxc}q_1d*%xzH`6QRtH*
z9!l9s{;4ygYVK6O_RFXvanTP&xfcCnM)-Hw2;=XMZWxj`W(fkS96JJTFGM^P_-gXA
zSP|_Y>dq1Nxpexr1~clys~z9<auXw8g%I?HG9#UQZ0(63BYR;fhW&Z9m7%-Oy;E*I
z9X3h%NXo#)ZqC9AR#4nzzMj@tNkJk<rSEMKsY!nOP27Ufd3wxMf#{*##~$%WeWE{c
zIGA9Rjjv*L)M>LL+(;1C8L`Wc%vgHcTC&EjTS}~5k~97`+q)>?V<5dwY7utX`fI*U
zaCd>5(6B?$vgEK^s&QO&na_1Yj)FY4qD%1x<GoQ4aZ$?K%xMQz3e(q%Rd;l#>#W;Q
z6?X@3u1E3f%Pw22;3Lvb47pb*8piS};(fU}DUb5%#jJQ;&u|mnvl~AX`@O&yU+w3t
zdYx5~IH$4nx~Atg%%(ph&75wk)M&)Hm}u4eU~S}a6RH7WBxVj0F7JKU9|q{oboI)@
z@M~|wec1}H<3j>Hq^7X-@Qb$WcuS=t!t91C)wdIReC(pSDt(s=)8HkrkugudHTu34
zspJ=kj>hO&D1m9<*con$NuKEah-mT9@@1K~aDVHMSwf4jcpV>hHG>DZDZHy4syP-o
zV%FHHhnm$B?2x!Bzpds$hJnlpO=i9jm0F?uVzieY2dWI#T!3d>f>9p5`ZCaM=|en5
zen=FqDnneJim(^@nk8e;euwdiy1lbqb|K>?lA`!DIr$WfL{bh1UFkD8kUx>;S-EnG
zxQZ>vSD4npw~xRq_G}i5=#UPPXvKqyjxljHE4MzEU*eJW`K0^h_;|m6pYDSIth|^x
z$4jiIag?mO%EWB{sESNBd*uLu*VMZ^?bvqgl0mF@IRRnmb=x&^sAlprkEi!j&I?tp
zGKak^6x?ZF2HqqR7%yM$k&gW-Y&5Xw-TnMVsPQ46<qI&H9Q2B@_W9K80xJja=K&og
zc}(orbB@#l(avm~p!0Ou--SmuwdJI6PP!=03HiuZuz}ez97V^(N(eslJ-vqaE2@vV
z$L^<(`1GO3#<Pg)60BU4u?hp}RAR#gxt!Zg5$Pd93~Bl=&{Ax%k*U_XH@mf%O0D-X
zjWD8v@16Tn%jXvmN)yj9B;~!9<Z!oSG|!W?ZOASP)IKI<A=m4Dg;OO`lgTAgZ9gMP
zbvQL7h(AO1f0`JYViMzocLz>z@hJ#68P4&Si|Dx0^++1pzKTXzdTiAu$f}TFMgh=t
zW*_h8=&W}?fn^nd06#>W=>`A%==yTip0Rl`OmP(@@-?6fEpGJXbBVvej2tnob>U;S
zm{@#&dSO7oh@>G!j<op{DM_4Q(bEQ!^sKxZ>)eQW(>UIL<D3ymni-c&m`yQ}2Ia;>
zLt(`ob1Dv~sDa>OOyud1Vl0M#_*o0pfpHGL5cjV1X6HHn*bX&<?wq3s@rzYsNjZbG
z{<rVN)>7&f9`Yh~O|hj5GhYlmx20wznO8BcuS<tdUDupY!|FOa;J!w$%f^!xl~b{3
zkMI&@We;n-81YpU?mqN5ef9G!Of`;GQJZkmD2R~Asf~A!n@;Yjt#+8h9?y=1g<_Kx
zzvv3yxIX3)vMKbt`BlJ>S<15(^lCZx%1I2D^{kX4h$Fj)O#D~_joQnm<maeLZaCW?
z<kH43^BTen`$&mYI+YG1pZd->TAqytslug(t%&5RNuw{N;;LooN{%v>`u*nm)~S1S
z4oseyI`T6{<|5K($RFYT{U#e@Oo(?K%zb&*6+sMDRDIu4v)0F?7p|loxwx{V!F8i;
zZE{-~V^bChN7hBL9H%~Gck^9wWSTm^*%4JnwM^?Y-unz=)o@kGCU%8@yBE7VIzvrr
zICi%1ZK@mcbrsF~YQjY|R%05$@vqJUtaYjrRVD4^mZgd1b+0{JL}=MQlU0+RhC@mf
z7MBNeH8l94Xn34=_<2xV^6clKZ}zzUi_@Xpe2uPOQFhgGlV!F+O9N^CDvCPCh1Jo7
z@V%hUpzFgRdz9p!$SQ78sdPKiEhIdkL+qn$)2q8Oj4-??-0Hw&Tq<HrGWp7g@1BK)
z(5v#KJ2{L^I88C`J1H&Iihf{I+RJr`KkQkuJX<O*Szs5<2e?RjILRz+7b(5U+j+|I
zd3}44mI}Y(ZpYX$j`8&I$^43w(~fcBp!72_qri2C0d*i%(NqDHKf7fG=53-WK*)40
zX;rzXi?5FFPmUATIrhmg`v-3tmV@&EECVZBKUCv)w=Gj{%mC(*Wz{48!9e15ocb<Z
zc=@T7xd5kVX`SxMMfng$LWqH!dXKKeVDH4dOM1xA8L|b~P1Vf>&f4@D(CJ@qD`yl{
zNS_L3lU{{OgzT<+V@_JvYo+M-)ndx}61wb7$&M(Tw2q8|RZm)YP`p#4L_h2F6`xD5
zZE@0u;nLtG$3GG)f(aHX9v4g8G-ezbVuTl_<EjLxAP3!B=}ofnB+``BP8UE#+xsm%
zAnZ!_Zm#G2vGs2s?Cux!=H>INXQ~}5)IL8{FETqIQn*wfzp~OyIAX#WQHxp*FpDL;
z4V?kcFnd=_)8$A)*C7g9dM5q?%uaf#8~8QI%P`X(&%V0ST!N?1dNyH%+TV1r#fX$s
z`#~$aXn4cfI4(Zez17|4`97v;RzgT|_gp7pCKWM%5vT9LJzK8jubd;jdV-}|)MHPE
z3J7CBx7OLRM}%Y<NEt&y&4yYSbc6@A1a!|})gA)F#?4$O!Y$<!j~}TY@Ci4FwGG)}
z$+Wo#N>`L3-JBRa^hP2^%M{!=NV5Ps+7S2lm4D-(@5(hM89`=>ch&guUJ3sI`V{*X
z9=M#*&$@^qf!dr@9YNrCjV2j?1e18#GRI61Qx7v$<;wFNK7ZHgqtkhM+~1=`vqsl_
zE$k~nQGoAZ1ejsaNlPq~xd@L*C+Ll3GVRpjCp}e=#lkESZRtGCYn*rupS4I|HMOyS
z$ab21Awc%)#kR7km*4Hqv>MPb)xoCTDuACn3L9%brpu=gnJ&bQPZMn9EHho^>HhiY
zXAA$Oq?HTSyOToN&TU9iKZY%stevC_aTS0IIc3(6Jdk`&NmCTS1JIDYrPomv)cCBk
z8mGR$$uR(Z<7L0ND#vQ^z@!)df}!eP+)}C>5fv(g{oZQ;FJ+ypT6pe;mP&%{!XuJk
zc$m}9N20Br?U(93XWPqlj;bqX)sgViMbQI%qBpB!iC7VPft}3AQcj(6Qw>+&fD<Oa
zjCf<VI&U~j#n_Eqn^Qh3N{gdZ4zZf^fH&praCyhVLVQMd(Fk>hK3G@TxLGIn@A$Z<
zw3|}keYG|01zP+@G;z+nQr`mO-hLF`Hl{DE+B?B1r5aPAc>n#-$Eirakbsd<M4N`H
zo<VHp_+zq@5RI=Yd|!=w@Fu^}+PaT06tOhTx+(`07qRnmx~CcUY^=5cS<P$&RXGL+
z9n^G<F1(c69ktf~N)-1}bcWt%uBz8g54JRD%zFE7+iHbqZe`mf^>^7^wnFCIqNM3G
zvIQmy=F(meZH|n7dAX-e5j|7oXC<QrlM_}u$gTQD=K)<H{@HZ&em=T)zI4OxT;3x1
z<VAVDcr#47+#yA8qOxNQT{JmSct%-xh%cnAJKZNe%T24*Z-|i6TF&^-WkQKf-$am8
z@{S+6o5}$kZVyOy=Eq(xXY<+^WZ7czUwiL5grkqh=tmg~O`o>aSfa6qHYCXKdX{R;
z$db{Qx*HN+xhB<6o&4skFG26*J7(z+g(9QFe^^x>rGz_>W=LeJ!lKgp;+>1pGvDvx
z2pLx}0^PQms^BMgXIGMLE<nkvSO?8#M!6+>MWQ>d@MF2j#kLpo9GkmqQdlMVz8dsw
z@s(wW@b5<|O>|mIYrL;b^e^6rE&bhmG5#wd9p$9=(rqDfL16PH9?C*yJ_T{p7bAq4
z>Desx-dCb<zk4mk6M7G%GjF4~SodB!APgsJ#}Qu<*B0SNB1q^Zt2J~{z?!y?sp-r3
z4V3J4wUk;%%SdUyzgq&@lKQXtRGfGjh<>c6dLT8dk@&OTc$hKjIR5pDr=Q5z`tLOg
zFc$levs-3}H>W`q9x>j}BjPW_0=)3D!dh^`l-jObe-Z#_kTQM&EyaCl-u1K5+Lcl#
zR5^Z(@iL2ra-!&!P0;D~V~$^%K$<TVyPO4EMPph$0{@lg9wxwZw&iV1q>Y;HZNWR&
z&3Gka@5atc)3QGkG1g6vR9}A1UudpoQdbeQP$O1vD*(c$bSz6#xG(b;qF$zu&W}gf
z2)w}x7ZTGcywoMQFcwF8(6_;L_3bm5Kiw2~=c0UPeu-3OeA2XKpRAyhR+gt>ICjvi
zhh<|)N<~y)57b!|FI)HBC@|9Msa?$|?o4X5@Q86T#<}T~%UK_OJQsuzbM<P?#V*Z#
za=aMK?$`yum4Sj+Pt<6fJRk;sW0@3#lJN~)C<#G&?wD`W?q}nEQ)+b;s(e`7ei%6y
zD}jru0A9RWyP@ADQo0-TRh<e#Zeq?*u;gC7s9LS7RsuF`(6CLhiLAxf_u8CR<#4uc
zbr=i0#V9j+v(LcqI3~yevBFKvD=G3odpzHifM`)w;k#<B`b%mCD;F}^CG6eT7SaZy
z5AubC{Y`fu)v*+@6c*2I`9%1DSX1IbNBY0m_md3ncK%H`Hx(mB{b=2Hxb{8CzLarX
z1~Y%U*Ej>v-L^!|T$+nwU2*-aC<*0enMudR1B#57vc}^_$eul&s*saUc)WzJy__2a
zzn5&;UxqpKm8#~vTF&q!@!RZ!w0#f&CD<pEd<21u^m!4L9myU{n1SDEU~1B*HhUT#
zVD|J;WXI}yS1ZN#3U^(vonK)6q>8SC%Y5(x(Qy3mA7=J1WbKBzYRlNuHB&t%fQXm4
z0&DwW`!Ik2f<}?-%N$G%Eh7u{*)>+ow^2?vOVSZ><c&;YNmGeL!v-1%o?+wt>4NZA
z&h}?uFgk;30oR()dL`XZ^CptmXppx40VA2_^*s{66B_a)9>2zqZ@GAQp`{pi(|1Oo
zA;|A}kmCdyp}(lF0i+7{Cbuy&w`R&JJH)Pw#mWiuJ*A%lJ&l_;&rGEv1GQvu9H{(c
zI?FWPg@S^!m@1Mw?xLY)3Z=8EzwtI0{oO$;^-^YRdlC*k=cqZ6B60W3$(RareJ1X7
z&wAs;=(dVobn<GXxH3aqDRR*$R@ORBI@U2*|8yq2<;iruPG$zYB}&pehBA=e@M#hU
z-`aYH_78qC(^<3g%%36#pM(f%9^#8LOU>iE)$*}RTQP23$ZFtc+*N6~mqhtOTMBh;
z-R7IthMTKhU~6ZVy0U*oh+ja*em?b2ExWmEBe1+NFQ+oO!s3o?TI!5*AT)9|#q1XB
z-W?x+vbqoq9P;vMT4rv!d6A~oFE5Mx+>CKd#@`HTii_wev?=(T3`^lNZ4>Tr&#B&m
z2vp%L$wY6HI`Rd8_Dw-1JPYh)W+ZD?S?I@M-s_w@28j!^1g4KQ>^GeYXZ&WNZW7L+
z7a=}-!Q&~}yga!liW`1kJ!WNtLvx@XCAx%^xH^qqSSBZn-`2kYG_a|*4SUm0YD#6c
zV7Ft@*ouAb<l7+kxXQvJ;`f(fqpTEy2S6P!UXl3mh@hOGAz9VQTIh6kJ^rbq&s1Fj
z)gr&!LCrr(rdqTchi`l_H56p38^Uq92)^5|&B7=Ua%C7@gPoBC{c(iPZ1jrjh_sL-
z+2KXfh|8;%jb6ReljWIIJ`^SCql;e-BV{)kIwrseCRw4=OQz6GH8880(;eEK|4eeH
zNtib<aYvP|`3m~?v(IMHM|TLFdp{O26u4GLz%E60041eh%r(TVSrSIZC#;kM%AK!(
zz^6BPZ9?!5xKsr~25}ZFMoa7kfgiD~YkVN=^+W}+hSm6hf5Q<IS&$3e(aI3KE~cTF
z^zuu8`ktX1)1lhJUw>X!^-;`-&)ZjaX>%J#6RTw2RSz-O-Dz{Ga~B$aJ7*pz^1J{w
z)!<qpeP{j!$rgrI!QWTsUbWM=W)Ym`O7)2yDQ7HG^BJb;<m=(4p{&C_r)6qtX-^|y
z`Om$bwTZX8Hg2xabpPONjB5{r^i{AHFROgws8)~Xzo@TLGRVo$4)t>%y++m(6h23+
zgMHAhJ1u+K-MLc*WxT>i6vyVdxK4Gtq$P?5?iqFG8-AaA;Aos*$~Es$Qfy7hwO$Cy
zp7vSN(Q2{Hp7M4>L>q0y{!#qmt9SPpkRZ`5bhlR&K3d&trG*t{ii~wtDC!g*mTS4l
zn^+q+a+2BhG2y0h%_`r!YItuXDmeUc5Vo--lm{14xoY+G$Ji?D<(T_PoAcj}BSGa!
ztH<MC7FG2WvioOr_(C{S!WtPf9x(@Uy9A(b8--r!jN}mJyO|pH!E-jFJ^G=*&6{%a
zK9=E+&NG$f-mIRJ-VKs9&k=W+l|9#`Fv*o~%Kq;<#9nYkAVNAmO&3e$a=je$-<=vN
z_tA*taGW$vv`sO(591Yb8%kV}2{mbH#uG67C0edYL1OQ8YDtkVBCAAoW7ALa<OG7k
zzmcUpi(|G{YQyP~;!#P+|2eMFSFQ}b9ZW0?X?r>{HuE-mW(8T8y!X^IU1G3cIrFq(
zim~>*6-RcbF57XsP`5QOA)*cc@X>p27Hau7v}l064guAU&QH~KjPpjM+?a%5C1one
zlj~i0BBetY#9U3+@XzqlS)M}b+FEaTkZn-iY?+ab0f*Ug-1)ZyHyYGHB<Ovhk_GR-
z@Zw=W5N&$5L4LNEahZ7+;chv1T4dY#Y_hIj-;)6f;zTA%;ABd&VBEEmmWJrj=^D>4
zGw<tdMd>3^Fnq1HM*8yi?HN0$^Mn-l$u%hoj5j9IWtJG{r(||lNUQfo_*T*{{9HRd
zMo6^9feu`DI3BRjGMT=tI}clqJH|bYAK+H>spRKk)QblTcJo%wGyi?Le}SA13iM$w
zq&0c<o@TWce*ZqsYacDE$vBCk(dK~X_&*E?bsK<bh*;!L?{CUn4QmnGAYyW!0!725
z>=-2SRY<R;L7Ts^Gi|T)wDNdA?dn<SeH#L8W<zTG1?)`XI3A}Jk@Y<}EtxfQby)sq
z8K|(}BkYPkRPIRGYyVjPbf?oRMo<+2mRbtaYI&5j9VAnnU<4tRD(YZZBRr_BIt6v3
z`q=k&IJ=Nc7e`;D(Hr}?1r9%nz?=^Pgr^x6tP%13B785+hJwbh7TCYNVc(p(o^6t9
zK7`cv4@im&l7Z_R*9zFpwno<5<aMN!NR|I{<!`)jTV3NmBTkZ2`pf{zkZ9=(t#P25
zmzi6!dfaOCCRefalpKDx@HI>^+aXS-d#$^FEi4(aTXm+kMPJHl?Fx71CAp>>1r6!z
zbr6Mzt7Ht2l$+W~3F_=seX6F?5<A3!FE_F`U-s%1aSSSAB^;;AeMj(Wui(#SUOi){
zn8Fnnt`O+Wf@kLJE-qUAyr5myaBVX#*g<g{sSS4B8`KcXOKfL8otn2>j_drGu`DjX
zazE6(J>2@Wr)RmBev5GD^=MM{koxnnoN-aOLv!M#;MBmnx{~a)*s%9PtD=@I<=u|8
zG2`m3sVzs2O?z4p`DTm#4fI-zcN1jY&MXzZee1}@&>5n%ER`F}B2CI}w*0Nqc}RWc
zCsf1+OS7J5dJ-qBidIR%6E(--oGeisqrdg1mht|Sm=lvEuLS;33;v*N)7oNbg4Uw#
z(E9_Z5F%`}A)$d^zcHBf^Cd5a;rJeLY1NorJb`t|{SpfuiHgd7QiW!0>YHqJJ_Bw%
z<<<7-tZne(+z*1Xj%*^M<j?cub(q*8cY!!>Dv6eCxJ&qR5=G%l^@e@Et!Dqq9Rpef
z#7BjvaNazj<gl3SMDtHkINOxPE8^ozsopBwO>RLE<iFA&nL#+*SG;WwlgtBjQEmjB
zj*lqgsb6_}2=SJ>jkjYws=b-BnMGt&Y`^Gy1Y8#|ckH>Y3?#;p^LxNBLX!)Xr@HRZ
zg_^g__qwSzHI{RSDP}6hTAri=WXM7nRke^`XO}J6xdmyxP#|9q*km|KSxrho-KuBa
z)rs`9ZQ`b+&i@;1A}FZo#97CZ3Uf}NEQVGwHy~HO`WPAbrW%Xeul*|t8&wDgxk<7N
zWXi~SYOtWXHY4(e6$<jGmKh?H`8B1GVIx_6(o5s>WoUWVsqT7b>!gKWmbK2gIHZz*
zv0X7|)JVW&hy<dQQ>n8i3sjAHls-?k^!-T@yMfZ5SbNC=k#4nnRX9l1N16~bA8>dZ
zdh)l)7qJk`T(2sbllkjD4mPbeFI|KD9WbDUMu0Zx6#-Bu)rDd!Lt6Pip`oY0!Dq63
zIXP5K;G!6+SByW@@AZ;PsD)-rYV~`n1*##!)AKX2Lkq)(U<1x>hB_AP%PIfDD*FK_
zP5HS<cae-mkRU?jp$QacjyeVM8mMiqe*4jH-o$zsgPx|(D~*;Z#4_+`YJiXfE^m;o
zO<o%LqJRYuH+X?=A5q1U)qqR*$-|R;XM=*U_VO!+g`|i9P%=igM7)_!b++?DW>sXi
zouZ(WJPazIK*{*NbNZ41N8+>j6!McOynZ=Nmi)ZF{iDVQ6=MPU(1H56@#pvZ$<`=e
z?OTnMU72CJqkU0k=<@k{RX3r!e9eN1^_Kj|gvyPwA#~g{BR@6aEhH4>Z<z4GRAcMA
z5#q6Aew3!6`E*dJbS%}QW*9Bph&TGUm^`)(<ZOIf?<$1l*0{2Ot-IwZVQa-)BWDH4
z64DXOk^P{c3JQS)t56erN@{U62p{<h7Jn3_?<vtjItt#|^7h3SO43S@x2d3cww5Os
z5l{NY0TyoKN4&|4qa5eajH~y?1+&|Cyfo|v1r0;Wnb<GK6&Z_4@-NGh*&tuA@oL81
z3;A~Od{owpEh=0LkBF8fvY&;yX_$=JjNMJnYiy~RMP${KXlZPFu{mDBv%=J{8Ajrb
zti<aVX-OOA%2`gk`vPfaMN^fQW}3`J?r?uz(uv-(J!#2G#IK8`mQT=%pQlQeF9~Uc
zU)uWX7Lb$@+@Szs*!g_W7I-<Rp&@W_3;6Qi3#-1Y@>^eTRziYeo<8<cLr;~R#i?Hz
zBz>(_YeNrZ;sk6-hKwQd{5JpxjaP?*+<Fm+l|>Hwg3azVNOO_hG|wtUN5<I;<h9vI
z=?#h8x}=c9dq6lA-9alvO5dR~67_QNhi+v@ysIwyvQ3_Es$K_mRBENeXV*%x5mCMT
zwtw0Rh&YlBq6w;=NvB_(Aa7O>^|OhdH6DW7Q+yApJOlQ<kJ88sTias^`s|;lV%R1X
z^^07r=>J^+;@1;63Lk~{vUM{zkl7tYD^Ut8zyD#!majSB;-xvNuz7O=6$Kbj6wHKs
zn`Tk*YqOHEwEaSpA82rHc))~HU_Lp^Hc{WO0zjrKP^eXIRB?Jl*k((B2|5(1{k@2c
zl?TO;D6HBp2b0s`U&VU|suM-`9m^z(YBWtLqxt#6fTZ@x;}7h}K}G%r6EGvMa2-pR
zCo41-WyipiL-D&C5$wz~+}aP)gPhbhV39?;bCu*n^Uoy!alSemblUgFJW#7IfsJG2
zvkOWilo$c_AvURZHL<?Url8J3t`#U(yxmLQv8{`ANWrz)$vpzFZ^2Z&(lNUNjyT~!
z%O$%F{V{4wJSHhsQ#^zm7&gwsk(m3!euj4k1@K2SOs+KB{1JH@bdGF<F;;gcx3=I2
zMd~F&C^Q*s+01*NmHiCbcWdc-zExx3v`8UXV~WI7S5Vh(utj+f-*+9`K|#w59#mKP
zl)amC3nV02F?2qMTAc>L@NLFGg}OR94j3vwVRgf@wcukeLqc0iw>qpDR}{>KFDPH-
zxBemx8c7L~kk#%MS3gf)0r?{8h-TcgkoxoZ4AtHkrnKZuI>?Z{7ZMTyw;VJ~^lw6C
z8xslSC(yD;pDtTEr$11O^+fHLLSKtgzgMMC3A{TPW!_s5OLiZm<#!7KaoM>>%#+&s
zN(mP!N_~I42jMjWzLLq}tffn4NQN&*_Oo4tRd3HbBquv%i3-3rNY7*J3l9CMV@SeA
z?P_5647r<?P)LzFu)NZR?sa6#A2kR^7mldBCzIzAW)Ngh)WlZE`n>L#n3P-T1I{$T
z8cM8;6-K*{Hyi(MbE{||ED3gIZ$q+Pky7#VNf6~^PfjWpPhq<i$-E(*sbeahc`L3a
z!sJ4tTsiCBXi!jgLoV4)xoPe`*@clVOp+*u{;GX(cEO_w1fcS}>By+eK`XUp4kgq;
z6YZWjdH3C0&zRghClXvqs0ysEI9asHlte|zcI?UY<4a2cXo>VLHWiXnAh&pOyn)rg
zEkq|%k+%^j5wwr*cAgD7>oV~{$_+_k3DOl85DNsNY@St~WOcR=j?T2)x{oYNaM8@N
zVU2nmJmyJmzgY%3ZMcY&sy`b<%@Pld(ixg2Ij0)<lWxppb-TSd*0Bsme$QO?TDZAz
zc0xAW_un6&Ne=}q@=+<wTYsn9GY9ha3J4~?EatnqCj2Gm_HGI1A@#En^Q89RyYTZ-
z+1q?C>G2Su=3U5{Tk}UBncl`o#^`&Kv@KtiXCOfHV#c``P#5?8fqm|L-IaWs3@;R6
zoa`vV4HZL0nlFqLedH*ZL}4BCNEvEiL?@a>ZMQytLVcl`mzGh3dq6>=8zJ8H`TQ2p
z3N{3C)2LA3ve$BKQ>77s&Vq-$qF*lZp*Apx!Chi+m6J@kIBX+MV?Mgp|9~5jH)z=6
zMWT)j*)t~s&iJ+Y*Pq3#iI%o-KaL-J5k1-YsM(P8onIc%3I+KvUl&UX^2bPEkhKbU
z;gmw^(9EnKStQirSJtCjjdSmTKU=<C>^AkezhPSZwMh5XKQOosMj;SwvKe3D&oXN(
zVsX~k(t9?6^;S3pilIPTaCXMlqDVZN1j&RXYaflnq*(w8Xw$WNo=^1XC3iAQ$;cdc
zB7gIj$2v0}&z^IE5N6n&!bwI@-+@Q<vdU?^t6vS|;xalVfi;uTo{J(s>?uXkmw-q|
zA^%6Il>`0WBA)3_SHD_NP+A?nJJVah&Tm{E$67SfXy{qYLff+aq~nHQkazY}UvOdj
z`Y1dwx@~7B$;B~PgeejGa4L*!>ej8kJaE{uySU7kl(lg(c9lFq2x?!!pxbl2qcCjQ
z<%yv@z)F63dB^F^uwDVN7N#r-x2f9#7D>k~o>uKN#hi6PUF>UNChaV8*B<D!<PdXD
z%G;oxRggYNqzOim_omqtxt5G`1yHxT{m3n{Z#}+sja2T~!=U#Ps)#)(EfOTr+JZwC
zbqo}3@fFy+CQmP4A&DI5Ds&t{(X6J>U=?2%iuWjw^~l%RiqWaB@2zJ2hWTWlywqN{
zD4$iucou6UqT8dx1p0MIDkwqJkvC@eGECkn@<n<7i}L7!6MT7C1)clYbEHRtR|rw8
zzFmBA1Dse0tmW$-JV?HSGUUiQqFi=&`76V2V~rxEjVkfSim@D@JVAte_cD~@S?sJN
zd8sW>Gem0e44lw#h%a$lWuGnY(AlEN!YaMmIAR>nT=<B&N8R{SMde~#Imz&W<o^z3
zh3jD5fESb};CFYmMH&k=<?`*7?hO%y&s|Dline@_1gy_7;L<=0S1L|1N3IEwmXvb}
z>6PkrWef_0!YBJfw)j$|QZFwi>SaiBm<}F=!S8mBd<;LetE-Kg{XDr<#{=R+D11V=
zuKeAaSNi_Pg4VnZZbcmCwFC{Xy}qUhqDG|49xx2n({`S0LAHd@8Cm5-vBFc$IEV@6
z>_w8Ft}oPFDe5DmV?!v%*AZtk7~qtrGA{Lwzf2&H8g<iDNA#~-2u7BW2P`iBT|*zk
z#c#F^f}qx_?T{cn_h*!P1&7q<Db-;E;9t^h{UsiQ`YJVGCR4RHss(jqOVXRF)Ibvh
zrR;iQN$AjzvkisszK}WUKKx|5`gRPzAOrmygIPaezMcw2pEAx>dtH(Bu!!1SIpK~&
zoN#dVg#^AmZN2W7FRy5#Qx@?L36JZaAS+1+CS8J&X`wJ&reQ%&KZC`60DJVF$@WWs
z!aj;dj^VF^x47H$Uq_KM|D0n;;0$~w=b-bURe`oG_r?+h3)OTyOGSN_`;+5mV}+dS
zO_`8-Zv`5sosL!LJ<u2pN3I_TS|2z+xKsHta*Q=YxUNn5pMS0zMw_@@zE{OZwV7P1
zakb@=S4_UpKPp;0XLRZW*C2*EC_gQzgrpFlk_BaZ{=&gAl(wm+J$fJK?R3vaF{0fd
zM4}|5PH~LLTwVzsre*-}tfTk(D7qwdPPZ<@XYaH1lQioGEtSM}CF+dRzd>m=Er^6v
zI!~*>9m8Rg<P`2V<1^3N3E4;vEBK9y<#;KfO{Z8WvaWxLc7Z&1{2qiQyzR@ckQs;P
zde=|CA9A1+_K+83ut&7^Tfc>}G)6&&RBYi8wmCiU-QcEVz<+nYAB^;QEim5R1BURa
zX*H~q>%%-CD~eA)K5t_<eq-`CW;PLol%Q7SucPN{O+_&&<~}?R1={O>O87zn*(Qyh
z)w(TDa(ITzwI|-)+Fx<-PJ~9~{8C=9LYI)u3SM|+F}md^;p`;wNiI7w3WbXsV^*W1
zkjUNdI`*bt=s?S{O=?FdWXp|2>{{ZfX-8ypmvfjO?PdDq5Wp6D%^pa-7bj`otDfVD
zsMXaUfOC?fhtDVOx=iPd5WvSNsOJsr)i!M|+Jc45hg;qY7B&P}<puA#FzVXR0MDpp
zMO}&a8Cfn;1|wsPiN&n1idi$pf-mt)w!7{Aul?ClD#;_FhL%4xza2YwIQmQputXcq
zWBkP3J8rWN#;%t7kH1RNaTF2`g8A7PLuu~CX32LipeXl7Q(R+9x+f~Hujkajm7U3W
z-;~)Ob&}Eh*JC-}gK~nD+}Sk;L*d;&aK$II>qxN)=^13~k}iapBX`l-rM``%W~oko
zV$glNkHkO6iRMc2wJEv7;Qa)gkbR>COP<ZHyPAbRU%1rx9e*SgLq##c^yu!-DN)($
z0}<A%)NJuk=4Me-p35dkPxzk?r<4&CrRCtzcNWp<n3(sYk&!*_6tnLCom6=!-sYy?
zWh=>W^YV0k;_U|2KA=%l*-NiVC0M~jGkCnbOhvP<eg)+Vw}#S0_bmaF7WdmHRgxe*
zI=!lb73{GHG9x8OlE)Zce$z{qxc{7aa1c|kQ-rP8&CO)?mvX+tVa|wLGg<kpg<`A|
z=w`e>02J)gqTz+M!rv&9ViuD3P)hKn(B9!kePA!A(_PWgjl#_6y{dIYYtL)!7pPdp
zuuJu?2NE(>FN0{AABDd`z5B_?8zQo=R@&a8V=L-fCwlewF#?t7#Xp=DaD6z+W$+3B
z-Cc~ky0i~RVY@t}HZ)FC1ert;$#^ub{d@#;HlV<xK;N30gXK|<=YAg%ov(3^2iMOb
z_jiM$-8Qr|J3&s8h-jJ1OJDuvF95ViHX0}c^1PlPEj(%Xp3i#!rh1#~KzfZprA6>e
zToeP2B1W?BpQ<ldX`P-Bkv(>=P3eA3j;x_dLN@NM%b#QW&9{+yH79{8&~-soFvzRk
zX7}DKi$n=B2+o6#+Z=*VudXgsN)taS+S^U%m#M60w(0QRO7V)X$98*@qd%Z)N*z#^
z%yNJ1U-QgeRLj#L#sa$!@S1QSZwkiR{=6W4U}IT1`;phct3O<>Kaq~ZEB5QWv*EX9
zjV$KH4Ha<r@7OLiB@+~s>}N`Tc)L}`BT2PeMAY!*qWZ<O#YQOM%$Vx%p(0InM+rAW
zaP~T!4r@_GuvXbD@0rphtlNMgcrW)IS4_~o@-H8lFUW|qIBna1q#X@#-`;0SqRq}`
z|M5t6=11C(T>ZNy9V`y}glaaf!;szfi7%-H$-?kRL{Xb6fSw|9?~nQv%EA*2#>0Xg
z-^D`KkLUH+M3|8)PS7%{h9MC~%a$A=QP^6&6F3cg<7a67;Daj(Aeaqi{whQJYIXxU
zN@~EPuJM%WYrXGPSZyC^TJTs>S7Xn*K}okKrjPJr38Y5RAw!Gh2+Nhe^Xyv#EbBU;
zFSK4#hodx#8~=FjIR9P9MBG3f!0*PIk9SxJZ5px?foASo^j?PqbWT7g>dR1k%YAal
zgW0(haJHi%b-91TXFZZ?eu4H~4yf1xUl=L><>L)A{e0clGHJh!p%z!wRWAJsg1oPP
z%i{SqLlrPm0>xZ2SF^%IE|y2g7bKqVq(uf(t5W;~!<bD*pA~Z6EL>XT^xJMUBv?MU
zLi5MHR=t<iw!%nqR*_frVz7ZV1eUyL)H%3*y1wTV!j_9_d81ANTnFU3KyInmH9sfY
zQEAx3V$F=SLQ>O4=pLN{F+`gIdAN;4bjv4_Kgls&52I{>!PTRic!l);c<coT+~3Kv
zE1aR*I8-JhkV7z9xZcV=v|Js|BqPJa);kGhFD)e=%Zo0p-*k@I{S0XP_m&z-0{~c>
zFRfcv@#|ixyg#4tH}y?{gfxIT$gHMnc0|$rRWR4`W>MWnBSG<l-LV2?Eq_?QQ4q(A
zs#6q8>h32s&dmTzCz2;M{lEPTwata~a`y#IH`mC%ENa{V(>O4MD<*nwKYVEzit!=i
zS4~s9x)+<O0mA#vOKg)oo0zqxOmY5jHj{DwGUADMZxr45Wpm2(T8Gy9*d5JUf5fMo
z7I4cG6jLN=`S9AMirgL$$xe~fs6v;iWmHMh@(+Zp7K=fz*U=9~0-uz7iU9f!9B;F!
zJ>~~ED-ReyUXSOB<A?RtL02GkU}<HdrDTvtl_Q=t%dff2v1^_Mn%lb7rZ-g*wDyaB
zZif~b!nDkh8RBvu6hgEg)t?=7N5p4<Usb_3d2;mJ-aRPDa`G{<%j{cPQ}T>?-}is!
zT9`YrDl8PWw5y>n?ns?W;2vBXT&?U|^jujlZZHOST&4(6^170|G7tvkoAEZ7e;IiE
zLmKWBxdPuHEZ>}OwCo&lVOzv4`YZ-e?KMl7H{;RKC%V1)2M3B5bHFgnDzp_uDwR{F
zNYuU*sfj6%^w!MQv7$x#@8!r9z_s~Twrq~f{_Ao#*NxmoQwE(o`FJ&!QIzYJZheF!
zOPY;$!i?r<{gO+CtlTb4J#$2+es2}=iKT-rq`Q+&$2!tZBsPwMh|a3zGVNhee<i<f
zEkv$b^b~z<(`TH{*3|emNRzc_<048>lx>J{?u_1x)9(}^Tpf{y-<ckE1&73PF(y#(
zYzMvMCqdYZr(z%c&XaO3!F|dH-S+<#q|yR(;f2@Pn@{@m=T!FR-h_KiN#L0b>-X3g
z@hC8T{W&y;8)_)3X57P}@eP_5lK(jne0E_Fw=mvE-fifjneX>jfbDpE#ecAjd`R<M
z7MJ{JjP(fJ{9vmE@yp_=3x2_@H<0B(|1Rnkchu8YSimjnd=4vpQ{q`Ox@wB)!4<jY
zAa_%;@rtfGe0m$s&i59Bf0N4g)vJLNRj)q{Neg9{P4UF<PiZ;24{te(UwJ{A?Rk8O
zpD%0~6n>6^$yOyU$`64ixBQM~UiUibZf{qt1S?Ni^gJ<TR`c_@s{vkLK$EVv&T3w0
zGTrVMhfwto<bIF24%z-9k8L}o#7ViHp60RU(Q~0QRz+p0!EjVppI#T*Y6vSccb1*n
z<{Hnt=NBKjc_2KaC*d{}^&r@J93SV?&+WBVM>DTLh+v*q*slNi*FZ7j2aVdKT!#la
zGu`$~0Ml5;53an&+aVvHk)m%Dev0-=t##@^@!Di#^XPG;KXo<nxZrMF=G7Gjagh!k
zo(ge?(bI^?zIjDoYtIt#$J>z(#&p5U6Eel<HfPa(l_jKk89Lvfazntk&aU#NxX?D8
zdco_LK4j=6OBWhWewhqbnxzEYn1>=*oZx$n_)*Yp9iG1wR4S~wcIpb^iQ!~Pz^`Vd
z3PiP_LVwA-`Qz#T5NrZ7MVLxIC<P4Vd_Q{KCLE&^V-_nNr{pKpQW;8Z#$_McuV$hG
zRrY3BFK4_dPj(#4*-k307|Q&I)!OB@OLqIxzM&~VLB)YBQkA=Mu{O9Uv=lMT->eGC
zH5?U>E5q+BTtt-$uV+$odGcHaw@W9I&JnkVM4FpnL_zr0ki)NtR6<d%7f^D?t<Km;
zE_pxk?wlBs%^c5ZWN>?=q`mkCob8=`Qsn+ZNr>u`F<b5@7a@(XU;4QTED!+o#Z`~|
zN_lJlkn?*XyJXEMjnWI2m<BEyN{F*7nM0JIA&H+uz!?~ZKDVSo)=&vloV*!6S#xMx
zjSCRsJg^xv$aK0JlKYy!d38?agTd;g(CV5|vh+KP^%i8(sggc1Bz1EtVkgwCc6zMj
zYH(C@O?A2wv}Cr|E`PV+WXHC7p;xfcQ{zwwG8qDI#Op>lwbkV*Qq1rF;Q9$m{QPrx
z@4Qt~JE-QFl#F}DJ;Y*9`&790{QDt{?MT>Mh>T!!rSw`m)RN!ToPxxlpy8Fv=B7?%
z^S~zp#hF3dd#5_*6i}Ei*!iT&#d$w0T5y^;_`mqxB(DR=gA&mrC0rd!{-1Kjw9u+C
zl`eeC&)XS)!{Xa5_aJL1ACJ_O+5DNA{Hobx){i0kfC+>u=xkY!>!2EWvfAoZpcf()
zaO|X0S>2-j#X6_NFp41@hcUz0Q9t$n?YcLJSIulh0l6|0FYgVBmU=?&<oN)~b$?pw
zdgl~$3R$qgT4ybQBImqKrVeAI5a{CxvzncmdVn?ebl;XS{NM5kVHgEK7}MmLH0qpL
zuz0rj2AApZ*c}>>Yt{MJF7pu3FXX>iQIz*XO;rEd*<>8EFj)fs>%!y&QZHA6Hd&3^
z*vQJf|3X3v1$d2*OyiNqT|mtwY_sk#MxM|#vXu3SU)m)?%G3W#k;n@{-hd2)3tRpV
z&=Q0ku6a3_hl)B1!vCVLVrx*oZTB~!AY4g66L*Zk_^&HSxnHyfdH(kto8I;t>wlS{
zdrCyiqQR=EixjPa{@7PEXe*pi^#X3ZKV@x9rHB#$06RCUFI{0UVr;+N{N$to3%7BG
z*-5dG+~5CAZz=VK8BFuVV^{_;&;dRh_af))BNRhzMNObJ(fl-P;?7<wzW@Wbzn!<{
zaez(uKN9IpxQgFM;6TfHiV+e%u6}W$c%bBNvpz3{k-$?%@qtmV{L?AFq&=Nk5Wi47
zFj@HN%l4IQR{*3w4b<XDZVQ->foeedk~&G$CwahV+h5PstVMWKVT5b1klT@w2A$<b
z>(I6y{4WtFC~V*z93SI?21`0pALySmIRobYhI-3TabS3FUQR@RyQf8#Kxr@-A?e6V
zHr)QOZPGRAfxHh$LZfyCLbblazLRzQcVU1kmc|1SOX&xOIwZG-Iv_JQ&k8(kM`fG-
z<=?FziLQ+rj}EWG0Y0ufu7&Lfck|`&0(#76yVZmMJ!?3d_%AKzU`9X>43~+eYMlQM
zfmRJuVGu{5_g9K*dO^9J)WCk_qd78wY}<|QmIbi+MF_h5U-(gjW+kLvul`rp4-BTB
z1-VpKiYbP50F7H<i5h%DsRQ=B?9^4+bmTozIIa49zU{s?A(vvQ(c)SBBLlP2gu(w1
z=)J0CDyY2!w#mnssKtq_S_X^mFt=`sW@X^(FDpLs|Ea<W*ET#mA4pgYVkw%t+QIN=
z(bO}SlJoDXV-;3q{uoLliGMrKpe!}N7wU|GmtRuf%p#_RD4BQztW4w;j5O?}X0q?^
zW&97JZ+Yhpqtbi=3FU>aOxIhsC;p1HjRiuQP`6B#J*wI}){?zh*7*It?TWEZNw0E!
z2I}d<04#1fbex*9ogYYD!N9Y>3_7~gz)2pE{AEM`6nHEX^vWct|1`qjgq8ry$~+S;
z^A!|N188^tmmd92Q?FDBgp^ly)~wG>EcnX&g_MBCZ1=R=74ZVTm|b>nub2HFt5Yfh
zJ6-Br(bI2WiYbgAw42w6L>r74{9^F_kjB=o<uC(0XXeO`MnQ<7v@S9L^R)dmrM}w{
z13>uO5i0hcL$v>CI3*#`p0QTeuLPo94(2p<1X7C5b2++QJR7s6Yb*Sr`7iC4|C7TE
zEpXN=80}IH2Yd#H$$n!4de`yDx?}s!SU^2m^n<?E&2Gf+;s&p#Y6C2wSPCj_!Ra{r
zYXiBuLV!mrEyDInk5Vbrd4;Bz3QIdYw!OjUSNU@ofMar<elD6v084DK`_#@9f_3KZ
znf&Fk|Hs(Wh95-^0f|RA&SrT4mO5t3EZQ6ZkM+gwtYm)*E=mM8DsH;UzCM3MDd*$4
zuaaf~Hi=RJqO4VKEGL1OtPz3YcXt3Lsd8+{t?qS6m#2%0v25RsU(~niJh++r>Mh@0
z0FzRqw=BmuKll~jmp4Y8)bGjtl4)+|J{=H38Orsj0w(UnNo8iSFz{u$;7)G;4rqo0
zkAW(h`}Nc99Pt25s*B3m09A!!HD1yk1%lf1kaPffgIG?2QpIU-R18!2jop?s(7%QA
zO@KM6f$?!`^Rm8GFo%R+n$({L+T&6?|L>=$w_|LBlmP?K4vLcVS%8k4ZN5tx6<C>2
zg6tp1P=3L}7M&8vzZabDpIW0~Dk7}7WV*hqHk8FK|5}XS`u=Yr7g7k!uG{bEJKO>J
z3`u?2{`&xWEX|z%{0h<S!uy32LnbgS-+jp56#@F*-ae)6vZk1<SU7q7@IP<dV5y1)
zz^mxq)Dvq!$A~?X)BY@w!`@Lk^6bNZD)KsIWEMb_>*V92(#m($lM0oF6S1Q3jz;v_
zc5Cws!@r8cWG~ox10~lF1(3B2ZVxGf;u|U_|NlhbuL1;(hxPsL=`%LPxWo@+&8tIj
zfFZWKqq}my*KF!~l3f2#J`&|v0Eww;%PCd<2LZB<>9Sw6Ofl*)cVf4*RP_ncmGz<j
zPjn{#kGl7cYBKBE#%*I60mUf2sAxdx2}tOUQU(d2qN37!FOe>7umF)Zh!R3o5fDL;
z-a#b<>Ai-cK?n#0L+^Yi1fFr8@5%Gd`>o$UzqMG-nx)+LIlEkY?`!XKZq>hU>aYD?
zlm-4m@H8mx69j5WSaw^`jV_8O-OSo~7xfq4i%_ZYk}&g1x{nD4yVP}oxhC@??T+SA
zPfTc7Y8(FTA->dyq_u7&O(^E@(bak=@K=Yq@%E*s!1E5_vUdL8<7e!!(*vYS8ASzg
z@^5ba(?eV2fR~KM!-W;@0_e2j%#zRoYw{!^e;Tm{8`GdRx}Kv8Jyp2=^B5BtW>*5g
zc#8iDoOJ9cG$FWFg%Lo5!)J6G^5+$GD1jB}MW$Hqr?;Z3mS9CPiQM+OH-G_O6DM@v
z0S|7nR3-c@rK^gx6-~G&<o#=|@-KC5`JA273+g>%V7BU`Tp?(ll*%^D5HECl4RTlJ
zMT8*^f@_V+OiQ@JhPcgmIoboR4eT4`X$GY!rI%|FOgVRYWD<Hic>cC}RqE=gl`p;3
zzeo8Wxb$4j2*H>tyn^^tvz0|qn52zJzl4l89r3@lo2~hsOuWor$CS1@h2LbicyLL(
zIOyNFx}UKlcB|}6EBpTA)yJ<h3)z*oPdG!S+!^+m?=~$FA}&G?vo&idc=gdm*q_u6
zu)sfHYjXbP{wJnq8v|VQ;kxIIkcD$Nw>(|Ev#M6vUt`pN|Gj_TxsmqPcoVpJjPG}9
ziC2+UAj{-`9<1p~wX?<vv4q(Bqj~g<=HDO9c&rB~BNKcvK+r0IdeEBjdr3;cjStZd
z<LD`?!Vpqeg2%w$3e$gI&R;h0A!VNdf#5e&WK8tfq;h;iH)6R1KM3tMy&o0U9RoFz
zlbQ;#{=bi2{4Ddo{Fp<4N*0K63WP1ri-u;+fx)r;Zu*h`uR@F51FB<7aAjTa;Ate6
zpru33yD()V9<Vl^vjhp{4;~J6*f!0dZSUVj_1Dr4f*Jlz@=~(04u9AbwTDLK<~jQ8
z8y&L$5Fa2$5<X_KH*?F4@0`p1FHhR~EC0}60n-d>^sdw3HurPRN%k&cdx8(LwFg`E
z7LfPgod=r#T=>~cUo8B45^6hS#rQMI{!OMA1Y5v_Cl=iL^Ba-cUTQ38X+0<eHA0Gx
znoryZRy?nuc=zWV&%cD4hiozAC55`HKjXm9LCv4>@FY{t5z?XKHRti14lz~Cx37GN
zHh9t)YjfU6u6qt=#qzVYaGa!0JYUR}q+4I~<bAO9TGdhzLULs#Qai8)qC>qdt6bq9
zUhTopy)r4t%Kd|)N6Jn58<YN~aEBAPUwC(d?qc5^q;dkPzdRXU1}(zp?<5+2J0x@t
z2;mUPKL5B_g01IWiN6tn;NloiXjimy&@Z$>H?V;W9$V%eEQZPmDK3wahJj=@WSqtc
z;GN~0gKzy!b4^szS`gB`9AeG+vv7V|c2CaMOz87;FlK+GuwNpO|NXOzA>(hI)~NiJ
z`czBoLAz@&zQbh{azjbN3C9C}_Rour)WluVF=zDW*Z$?Cz%U3bW1yt9UV=TaAvi=1
zLl9xqGe-Ix?e1Z@iqmI7>{$xYtej&`Kk@hPDo`IX&q5;$21!VIlKv1yZL5Q?EHK{)
z{<9AZ6|6*Yj{MjccGd{V8{8agd-e;w<W}ls)1P*HvSk;DE~vdR@6bPa+27peL%~*A
z&nysjLTt-0?F(xthq!b;L@Q*zSnO8&;E~zh+w!+WUPA5U5PRqh1Z8_YJ)bVw*z@4S
z);*{hSGJgqLMM;FGw<&KTo`%nR;0Xp*fV&E=^xUq{+S1r{_J^+)0ZX;jHQYXgwFOq
zH{fX2mu~-SAogefp`-u*D^vfQApYjrKg;m{*H5N?n5QuNss4QYG-3a_Vw2;c7D_60
zNa#N6ne!~x5dM?m2Te-3$5?7lv`1LH-(#}R6zdRqFfPL5_pm?5Wiia6LeKVn;^x6e
z?h0*Wd`TFXI?(IGY~9E4P=kSqsV8IvkFcqs6iJG<l=tdv=5$M^FWyPF(TRU6<E7(s
z_x!u{qJ_Spd4lbxR+i!V;obX=UflKn)gN7dei&H|k1tyLK!N%gWN-FNbRT`FtMb2p
zzR~)@XAQUmM|gZ%S0bEh4xapD*Pj2~9~tcaPq7}2M~n3TA2!$(d9fC`RubxEP?jLk
zFG=s!7ZVTa<ybZ+s4q-fdyBo;%|ZLQ{TriF9DHT&+(ui}2=mbij_zAddb5SGm4?=T
z?6>-3|E0ae{*lMeW=pTvBIPRkIv>&9+eLS9ebot_iiu3W`y-6}e(REs@|33ZEXC#D
zcp1QxSknA$nG(I5PfzGbt+(xBe6-&r1HEK1G@t6bV3K>NU3u|6>QB`tuGO;}2`_2O
z^MBs;2g3bN@$VK%>fkeTXer8Vy86Gp$KRg4*ks0d=xe0kV&&$b{^l&VYQ;*D*2c1X
z%+eagerVz2i*AnJ@7`3{Y+wqlO0AsfPRh2hn(7)f{%+5|KI(&*^!PIC?p=vqf)e9`
z+%u(JW=vUQpGf5v3!h?eMxQ-;bmEDj7k8!RtY&X*X?<}iZ&r}2d*u<i0|P5YF{s+?
z^(VpA#p*#qtR85fPk)RyU2W{z6T45Osi`0vHC}N!)psMNiobI8qn6@QId8n;(AxUr
z!wPIIyBKLd85#Re4;IgprzMTg4=$3mvj%d(?^WZ8*9wS@Uur+SI2hy_sxK((wk+E?
zlqPX;FZhX+IN8K~qhH3xt`;c-r~FvC7R>ygW#|8rxu>p$B?TKAs-ES&sxKPO;IpW>
z_H8px;*@cvn&7sfyzsx-b}?Fbqj8nI94qLESf1d!Oi@lT2_U}wrNnDNDN#9KeDrBY
zqKUp~*ZI&p<i`m#11hn(7$+O|dx060M{^?oI6dz*3fd<E)3LLYz-;un8ZMI}BC;lw
z9t|V!w*E^Bul5h3zNIVvdKraNeJoUcIb^jfyU|3S9c_LlWyhSYtijvz-WL_0*?_XI
z>%;O=Y(?pL#D|jy^~^F69zVu{iKLkYZW+(JDkdrKZ%RBa<}aZ=F<NDBM6o@vD8(?g
za|*1SPs{~)F6Ie#*|P_xv{ssiVrasacwfSCl*DxMX{Qo>2aZyDVU<}l`lEKy`$zi`
z-{wcH-!<9Bb$!&S>H<Fll1>u?L$+WY%lwqb>0-wf6B#o+PlcHX7+mj{sW-=!gy3?n
z0>_~lMMx`fji{sT()6JwgUg>4DaOf(NeRIjKP?8Yo>o}u@r)EUh3c}sFX4Ru{?ikx
zk6Rg?kZ@}J8rjInG_(O>sJ{GbP<2WAkICW#(?@q;B4a<U`0^9S{1fyPxXZs7A`mOM
zP`=oqPE0M+=n!&ywcpU2W&~D7w>g%irb|hVnKIs_^iRk*hH9@17eoefE#a3b{YjE1
z$dCTG-OUEi5LfXV7u|ZP|3DkqA-{O4GabVPD`C6fPx71bG#zeR!jhjoN90URc`c@O
zR}6pF@ypYNuw~lLglz2)Z1P1o$I_Qn-nBv7!TZGcbFvh-%ajE50B)Yl8xz$fzQ$Eq
z8UOM)mk#jiWTKJOL%MMHL1JGWw$EU(z{?kgg!wHEZLB_4i1Eln7ys*xMuievD$T6e
z_;!HLpe`2zKGtN$p8#dj$7h=i4BXe$>t@r~R)1AHcqKa}&6a-nXi?wOc$Sjee~ypx
z`6vV*&DwxdRdC+ige}9%YI%K9nyI>^suRU=FtXaQY_Wq?)q)uH5<z@RVyw=AEb`5r
znBX|fBE@19EWBk#AKn6gA%q{iB}hN8-oD`9nCRmWi(aIvHdESr27GxIioa!V(y-nl
zL3@m*<ex|uX3@tlmly*bH_=O%ZsD|bEr_3kz?ZxrM<?9Y)Mn!qAWc%4+vfYh#_D2R
zX?<&YJs;g*`CfgW%KqRbHS!!}z&PNLDFd8hgWQ8{Xb<0ZIx#=SZ_wZ%>{Bd)m==_t
z(2Q(AmZ?+heeYz8z)_|Qahq&G=TfNuc*{LUUz$}$i4OTq;zkaHNsZ4wS+6k|%3`r$
zq>B%K9MW6MZRX=^Adr`9S&`z3XW^9ZnoQWG_QIVdl<t38OQh~OEhzT1ENaE1tGXAx
z_*t_oJtF6Jx3j{ka~QW9?H^CP*^MG+?$0t6HGo0FHx}5uqT=cME)x2F$}-UzPI265
zlHZKR_TYMDG~<dbOH#L>F8Z~<Sx%70IV@V+jTqdB%YkSysj<2}x~+4|<PLh<>HgTC
zLbYS#?C~%`5iHtWFYQ<QYVKKEo&ph|YVKI?+^2nzfaoPL2>iMR?0T;j-}VOH`uCef
z<Umxpo^N|^NdBYvQl*n2{RB89*fmslLdK!kv5&UGu~%TbB9Ak<MRZ}1noW`$qVp8}
z?S}CEDEnw)np7;YF66$Z<jyAa>9}*_bix`x3=(Vg9oG7dO@@{f+?HZI6RC_-uSIg9
zZonX_-qlDs5#Ue?+2j&=47s~BXxri4GQk31#E#y~YcNRjt;k&ZdoK$5FpKSrM!PGt
zn&kX?c?a`E!JDd|PnS$2j#?1set8#x^?=J#ly^rzPo`!{m@ZqrwxN|+n$Pio2p}SS
zJAUQTS$K8>PTSOF4_(7@+rzp!Is18S=8^?*Xf57r0~Kv*2ED*68IBfkZDHPV&684h
zl=_cXPX1{LRiH+x1v~I<&|aRv-W-oTCIdIYJ%Qowhql9kkO4^4s#Vi+4PKf-6Y@n!
zr|3G?pUg!)M&c`X94v@<TnCXqMGPNJ+rt=#Rjd#&V**mHPO~ia5T7_4#o{mGcr8PA
zj)Yt-7u*4uW$I={@5V1&+1hOTbr(5$o4x42>)~Uyv=OZ<#$nR5ot?Kji4|JVcmJN6
zwLB2H`T7|)8e4SKSHv~)w)=?$$;B`6zioqJeJ8NrwA~XoSOu}@)VCi#(zl>zhwP+o
zKVpU|P@D&7NhpYD)6z58)lCdKc0{xPOQ_Vgtmbt0+D9szK{W%2pPAf#d}(DBhhX?x
zM(hDPs;<a~jq$Eu-daG5Dr1l{hV>nJ@(KXnMf|Lv^JE6pk}hUt$ouDfJl!B>4COKJ
zGle>=AhMG*pj<mK&|UI_nfRlNcQb6`dInH?{MKlH5kLioqeMM>CAzhTQRcq7{lTB#
zO05)=mwFv6Oe~0pp_>7S<<v%(t^6Ulb5~@w-ov(EZbG{xnS|W9KCl|nqUcR31pM|g
z&4zvy9TW90`FP2~1Y(koI5nCu7DKZJ0}i8{F~>)xov>_j*<2=%DgU<oGQvSJpxgTT
zEd6As>(Rvlqf>Co3i25CXh-)BT$b;T7792j66`8ZXjdde8>?)I`8}DMJ)LUmRH6UC
z(JL<;-v5d1`PN&al~C;0OiP14AQ;8&G)M~QUo|%wKyef_v#D-dj>J`J_V5q)eI@zO
zS;E+ZZQw}g-W93r$JhTZ3hgSNg}2*=gBSkRk|&!6o<N1^yViT?zVG`FW6>HHG-P|f
zdBki(7C%@e!zn$MiOhERxIy{D9XC?=$NTnBfQUhJoL+C&MV%c#se2=1bScSjUXbQo
zr@<oiuUfsmOJ9~N>NHv6I!^PabZ8jTv~&5VZ3k||Sy#IMvaN3+Lx3&sta2RHG1H1}
z#F@P{v2&i)8>U&)x}5n3=p}?kf6`=uQM_aNfWdiNifmz9Cb0IzHS}B+yY}4kidS2E
z8Vd$CwI1rMZb5u_AiUyDrEnLF-VXfzkG|m)0)UC`#Ha~Py-=oEx`NFgwI&C@X5KCg
zZw|Y_-oEX2FNT1W7o?hmvFKI8UE$00oQ&=0mKP9xwI-uI+7-7=_I)Yv0=7$^1-m3Q
zC&>tZ#f@!g0k<lwL^*7i-u*)?w(RsE@WaJ}9gHj>kp18wKEhmR-_E^qB&cxUq?1va
zLHg(#Qoi#>ng88-JF)v<FH=Q#KxSiSz4MdJo4qy1wYOoQduP2uaFpMwdOe+J=)aqp
zCR^!(?~$hDa6Ij~Zm)JjgHJswGZ~1t>MzFszOBvMS^ywdIZ06sxOMw?QFI-HA!rK@
z%&##D@5};F?rXAP1v;j;cip0~7s+z@pl5YS0?DBnu8G*L`#wbN*afKnR|$r91L$Pr
z+pnN>oq2NTtkAZH{jtAqM;!JOT_xFnrRGm}9!uOPxJ6GGyZ7x^+J>FB*R^L?tsl{l
zF@6ik{{)(AYJTIj7)CSU7yiA}qWe-Dr@fs>Z;zEoX!F&(8T50!^0QZ^ZhuC~5grAj
z&-d?Of;_N_R>CeR+vwZf9(g>&5x!l`G#SkTlao5kFMOJAWPi`I4L?ea&Zn>F&neO1
z)n-cuc|u+K`J|?G56pI%^MMGU0xUN@lzvogcuvD{BEKc_4`bvuxK{lfZSV~4A+7E!
zVKmVc0ulT}_<7ywpmDcYWQwL~hTnhztcN-k-i3B?f69Fwiuc|&vN6m*4L7Jt=sje{
z_>sSUaXZ|Ea;|eo%>{1II4`yb;DMKeob#FKVHYT7kI~%VqvWGQBKEJhy=b8AFWen?
zN2+oSZQQnBF+Jc3tjA;Cve19#2JM+V<k#VcWPNrbRq#)^8~RHy@8N%?W1T>j|1jPJ
zyz4WIUVUjzb9PS}66V}?Pl(aMh(Fs7Y+aWDj-SF6_XW}Mp_6}n&^xpRRarIrBG4Dt
zcNCs$4WKpixA6z(Artp2EWIjFRiQhsu%&OAK%0LntrP=oZu--G&z4nXqjOyo5YE$c
zT3dD{rbdN;px4zUkuG+X*))Tq7VhtMqa6H(`=4T$zI;p){q7i?&p=PeMklvD0GiJq
znbE#)JA&C!*G~-%-SE=+1{43C$mRlyZW@aB4|Unl2k<{=0PY@ZB+mR8vXcg-ZiTWL
z5X!VBq!q^9*EMPW2Kg5#W)X@=)$8`z{{<OoiBdK?H6AG^jq#<yz%BhPG;{|v%m!D9
z;xxy$MMqcuuVBk#BT^h%B$m9BHM9cjJ$lI?J5$`!70>09wjDI0l6M4r+X8%*7ejZo
zdrxm6mfcgEJCQdsFWb^=|1vchp+1&;G*Q@oL35j1_8$Pr`~O0?(_~yI8or$qTY;#(
z6L-VrytrBwR|2;T4zM^o(cBzLcJ#BRr!=vXdt4tr224fX3gTt5hKt&kZdzEkQn7C*
zCKg6KTbWFEN&*H|;2InF;<F$)>ZY611;lL$$i=DgK<=&3*t0+OM`dkCM}5<(nVS6#
z;<OT&t%Qa%NuiBrIXN4XDePB*^C9$1_eJ5h>H0GI%&4zgZ`WiIKn`Q}f5b{6GfF>O
zUL3&R-nNC?8o<nQo!U;*OFMS$nfPrhdU;6lKSIup>+Bd&_?F!YgDiY{)^iYri`aH$
zTJ-t{;UF8G;~FF2oHa)?c(HfjfukJHMBac(A+N-(Ec?%G#G$f0FIsNo)0OAJISdU7
zYWW~R+faIOuPac}oYbcQ8!T{GJ->kLj{(~ctOMG2P>zhElf3}h-iFZhK62;;M5E|m
zjNYTIJ%h?4R0sbTrA^J~|5*ggu1&G#kLA*W(-t}L8fd(DfAZnCKrNchuf67(c9MYQ
zf4pgmH)!>nef@nqs-~xbXKttz=?X(8IQ(uoueD~aJg2E9;va7tn!+M2p6swfTMe+l
z?FjfEGWvfO2}J#J@cY<DcfuUkUj>)GX`K`PxKDBx4YR;2QRD}g+NE!JEpM3eizqsk
zsU_-6DlV)@-$?(JUM|0T+vrUiy^c+cTPE6*y}o%nPhg!JRmrOa`@|mKm6xe8s)^p2
z*v0%#)tywRiwZfXtwCYxnx$ZRZU>PoXz;kmgK*P=9aCK{!xk04{wJk`!FugWbIn}}
zYdCl#`anXT#YrY@$|~7+P%o~ohXqd*;|bjDiJfv0-sa!N-fnq(smVa*eYd#m@Ev<U
zN##?A5bo3d!$S>?I34ba*_;0)GtO3fErHH!hrt*zFlPQ)Cj<PwmDkSEPpna?94-os
zAVm_ow38qQw^Yc4Znt?P-uKb)&^{JzxQrjh%opa<O_5LTU}CzwcwPp&(pk$;z~W33
zBkr6m3dW47Lj<HnLovy^-7h6MUigdb0Pxf+^BT6<e`VD7Xwi-AGfb(OZNTYNtY=~t
z|H)gSPiN4t?_hYnC%wf5QLv-kbx&U+3I^_v>dpRuG)rhHuG+zEW8+i_G+Uc(*$FFh
zd6`V6&>bC9vq4ZOE|L`&^c<kR15|SMpXBf!<<KWAaPg&KlUqb<Mx4DVD$bASpBnS|
zep$3zIx7tw{cCr2Jujr?8zuf}hfNd#oyfvO6nXHWs$mQ#nok|22yO(Xi)(w&Y(+|M
ziqaEwa<9iDO5yq;XQ#fXkWbkOQG}6~qJDmPqIGj<(~Wxl%_MX~P0sP=E-8snPU<cv
zkz1<v0kzO<ygX^?D=k%gA4XL*ys7;AkNB*T&q(htOH!-7*WX>DThX4}=5;J)qs7!y
zzPhnnd@(!efU$?8GWai}`dBBV;(X1_U{T4@w@5E<ZZVG^^0ovpCfF5!t2<1J<zM|K
zQ0K9eDoi%ByHzg`%>)KZH<xPu(c2?cXQMCL#RkpJ_g{@eej2Wm6GYwBgqq%YGVaQA
z|K<U1VBE;0EqAIg8L*a^x@~%LTh}cY0hSUr5$;<};yQQk&Bt5hz~;NoOY{K6fA=;y
z;4cxbhU=G$vpm^^an?rlCB#07G)5F8kCcUs<ZYpfv(`kZ=UlwZ*p`y<wjf8`^^(k!
zok{Xoa}GJ8u#I`|^+9f6fG@^O_U5LpkDFhX{FPn|-{Cw8wNj#uViME{$ha<k_8@0C
z*m1yDGagNI7<=k^MDkKAf1>SN_uTqpb_?oTT4?#6FVOfnxmn`Y?Vaj(7O4CmGGk}@
zn)q9N`_Ih&D1u=h4@c+4VQSCBA*-ff*eA2F@ArRX&o;I<E7afc_K$MUG-nV8WKvJ&
zUtw&bcVJ`E<iQT190CY~f5x8?DG)(uLJ6gKzM<GYfGD<?g#YR-EyY}jiA+O?I`2hQ
zta&A_H+_!wrb4;1mb-1bLN%He*f{=*^zIxQvR!OD!BFBT*!e$;^w2-u6wph<qqx0V
z_Ham`C&K5RDdmhdfHc3cF+PpEVX${33!=9)Lu0tYGH5))j<;{IhYdHk+zeA)A{$P^
z;n;S1Qzg_M@*{)}Cw;~=T9D>hk><0}LR4y6{Af*fEg~+;5wTu|MMyCeVulvL$2H?I
z1)E=|!X=L=xK((r^jeZ^&cq(zbM@$=qN!0daJ6XLt0gb$a3y$*ahT|eMkP)0lPLh?
z4*#lgGnjq_<wvX3VvG8gah>6@fr%a#@WZG&mAJa6X&!oRM6>fE&ub;NM4y62us_je
z@0ML}(QYhGou6u2Wx33-#q89+s$?eLss{@=Z+c?K?Enb;W8uf9#M_<c=EV<eSvNEP
zu+w={ukpx+s%%kVeyT092Uj8E6u{N7mQA4y)j7x8J=AgwT0sSNQD-X`2ehbLXYO!_
z&$hc=+^a^-#c{>dl-cVD*XAhb*E#AfFO(V#CPrBwqL=P|c(To0p`Sq`+-_|YNmD*(
z6Bw#%FUHlGiGluCdqMy2a<#YPa+tg86wB7LM?cmyNikHrRKR_P19=%Ua<_6NmSETJ
zWp>x;!E4*=5sRe;9JF(mjLS?Th8Hnt=exiw+e)2%rn{71X-i44|5UBi>E>YE$Jp+)
z@(uqL^c>7#OeAv{vli?qCg(V&0cTAJ3{z-}^BqgO7G<(tP(CE~af@Zzf}?|{vOyP7
zZbKS>fOk842QCY$VPZdP&N0UrG>C#56nW6%UjU~bAJ8+F_or!D77dmj*M_TF449p9
zz!YaAq>f^usBT(ywEqJ0=AdOIye|q_bq!x2KuDYj8yf1ThUc-!X2})zs0~-90T7-t
zvbF@p1aj$X6S6AfUOwCPdpcE6LC%KMSt=>`vC2Q=m$oq5H&2s(fB9AjtpHF<y~7`W
zg`~Xyi`iC6!iOpa2~@2d7yfHcLPOQ^y}m9H=gX+c`fg`aN@ER={pp7@+i<p^&QTC5
z0$hql_T3ih`cGtEkTXaNeW#Tzi0d_)b4liR>9P~=A8aS3A{sGz-zzq2k{T*&k#RfX
zs$z&^z@^#627-u&hzr3L`xljS^#+Ig3_Ge|pOp@A#v3V9Q~C*7j)*rIaP?6bD0JW9
z4H~G8NpelG4w&>94GzJ9ZgfPN$D(e^FLcuhL0b32V?m7-a*NQbj30s=d6o+a6i1jt
zMX*7Us3QH*QDVOmSIU<>h0vEvg$h2K0?w4wiUpm<DlIv_%h?RoG;=oHqAq{j&JYwC
z;KBSG+`A9=hlY-}l{?C9csM}AgsQiO+Q<bBophn_Ry2(uTtc6KXtmEQQ$D|lwLGi2
zpXet2?j?dfkYMg`hUp=yPAN{broi22#=p_0+m~nuNkoj!UDlE`e$dt3zK}m`4GKIX
zD)lM;=;)mcTe-X8l;0I6EVpdl-xG`wmD-}nXT26Ci(fx`zVzHt&bK!+zwR;JWp(*)
zGfZzhHI<b0NeLD2vGE9os`i*5bu3!ZWiFyo2nTeE#DRQl78a$R_za7vGdmCV41$DS
zmPWO)$42Y&Y?4-<WEA#=eC4dKZ>OrZ1jq%b9My9Ws0XH+MWE3;T&f4iirpof%FUYb
z_~b0l3AB64B+hG*cXKJT;B)o=v`)&F_;P;~BV<ty0uG`z_g5jKUwVKi0=tjGMCc>l
zfubNIb>uF)1xUUsh@<ev)y;1c<+azjpkD#>r!4pN<~9l!4h-q}wd-6^bS$BySZwM#
zSieFNhNH6*)<1qWLgwaLbxFH`*5*|}IaVJvG0)DlEZSf&eaN^C{Ler+Jf#{}y7;9P
zW8nK`2|qFD)~vOVr2Joe<rB?U>LKT$F>d&?&6;xI4LD;a2as){5e=Ve<>KlJ{Fn3-
zy^YL7m}Z@XRM~6Jz){pad>$Vi@}1dq*!ZzfqoOisZn++ctXh=6=i4p^(w40L&4`qG
z{xHRRv*pNYR<{)WW(8kh!}eQ2Ly2Xgz}0r(Hm!jOGAKYE68m|oLD0aEdvi%odGdeP
zrb`msirgk0lGP&BbEmQ_`87w0ZYo4GmdxkI$3=YZ!BG`@a29?D>U<T*S*wi&DpuAF
ztv=~_gTnN1^PDayUP7uIR~m=7uulvZ1gDEX>%|qM&VIVV1$l67(awj2{jkN4-rHKN
z49mo5OuijM5{-x3&9OBb@jrHaX`MtdSFBOYd^F^UT<0TCk2wD#`}0f?C)janZlk;x
z1v>!@1IDCUK<w!nfdqW*zY1FS-m}<I9YrV7805|qzF<nW<C+E)!y6l;IoZSc_EM;$
zkB#$EKFPhCQMxf=yZGTw1_hy?mMaR<5JQWyo0KCe0Yr04orIhGrKrIQ+f3^Rjt0IP
z!G>|Viqm-cce9d}b0eaL9hfvn?Dz8FQHtJQU06>meQrE*hoce&Zt>4paf2-MD|0P|
z1h17(0HV##YnnIy9@l^a*=rEN9Cm_a4k9;aP-FyfVox_B0?JTbxim;n837lrlLWN4
zppFmX)ZZ?_Rn@|2@lEXPCYbni7+i0KZyxOpuTqNR{9|_H={3X<3n_qkd2_9K(=#{B
z+ppuqD(}ifV5-f8#A5zu(@M7mJLg_=Oyd-grJL8{WN&+(;>TQ{xcTw93f(e?jh>o<
zdCNIbI7Mv5vCyS`zT{s`i>bGyn{p!fl^{=IZU#z`SUN4gaC<iN0I!|5r!8VSrp9ln
z>RO`m(0Jk3Il|je-C`!4sloo{9|?je@+}E)kcw_aBYBF}C@QN>c&X8%%rZz#wFpXa
zS%KFOKsqU3^LSLg-qsxbYR08WF!9<rROM8`Gy3(m7L@4bSsl^N%KoHkjdTC7t>5P0
zXy4}joaHf6g>;<|*Z!~VN8}}8?21c0%TR@E9)hA@&7x{eb^dVK8$Jch`l{l9#4Zd2
zZj;<+E7~`7;gBlJu(tb<B&_~X_Hq<~oW&7oI+TNyob4EqH(d97f^R8UE}U4Y_amDV
zke`yBvFJcq9vI|E;q<7qo6uVkY74R6WI%bm(s4du_goJe()g0ofz4-p?Cj<kuYEAP
z!AiU0K-mn&uh?_wfI<t7_1P%u$hGD`hmthU&UC{8rS&NU(Q<R7l4~j$LC!7g&oNE1
z$y4;nJ|8vQCtDuA^h>}E%k%1nMRi%TyqTpA1nKeqJ9TYY7uQ<(6|R-3lo4hNkfmHI
z(?L^29(5lUpXj_}_kY#bfJmv9pWSbKJig!^YAw;1>|DKquTGV8n{s;`urY6ID7$hq
zY^>dgld>Q*73ZQEy+Y{Ln$S<I@o;OG4nD80H%k)HmnzUGA)!_;9}$P*dVXa2er1hW
zh(0lqEk8Gx!0E_^9jNJ)vNqI(TyvB=9N83`SNVFeZB{OgXLXe|H`o~iAsM(XHR+U(
zzT+P(j!Q58m0ohWYmX@{^Ivp?S$0BuKK-~4P$@Qm*pKKpV1hfrj*&({N(qA<;fJG2
z8BCoV&VT|K0xHnnpvaeqcY$dLFpx!h65Fh2CZLH0bpgoGU4ShNDa>G4pJ$6U)MSf>
z@mij4VyxDW3h(!JghaM&PH!$A(O3)4s1av3kdexP3~m01+;p~zF@f@I6dhN2+F~9J
z&M+N;R3W(GkRyih;T8A7Me#c!j4-bp?Tk`FbM31vUMSHcs{{Gc-r2E&$Kr#i&vHE+
zJO1<|JS(gIULHKepP~@=ScBli)-8nPO-);kOkC->0C5>Vtm7GPd~)($rG7a2!ngUF
zdu++-B-OPRg@XF~Fb&N2xIEz%;Y>pHQLg<h*M0Pxga=fGqYiOD4-2=KbW3)7UZA|`
zUOse}vyYHe(Uxzb%Z4S?V7i8j?sCue84&N@Cll`{U(oDh>CGBeuyGA54fh~htY5#R
z26@?e#}!M?r79{eOoxg80xL;G;h7J0^kJxUv&WfQ4d}U!eT!xFQ`Y&<)74b3HWH#u
z7JNm{FnC@ff8|eL$D(V@p-g+7V63Sl0yREQ(TFg$`dTr)^O4qwh0uD<GHU?`a{(q(
zCm19ZhODxd7BzIOG7KqDy;HBUmNK-~Xb=4&2SHVES$w^H1dc*#0$n2+0<95PG{IHH
zjTo=VBdY7wfUDxg^o=GdTZ*K!JEhc$71_m?4m!CsnTcQcJXx!mO+FufE<*eQGJLqf
zU4Nmv^qk2Xk&M$1ZOl%QuTQ@=wGiKpVF=0=_Kkm~zN%i6QG!LR2!#xTo7d_$#7=0z
zu0%CFzqXixau<#|hc(dNj0#E8CujK}`={kh^2OFwqsVUS*76elXD@K(U=eJOUY5);
z@H6Sxx6I}ll5b)bc4h&7e`9@mLnWl(>=aTrYEEIC9lO90HWc4;JFc|n>IE>oe7Z?7
z+df<8rtJUd6w^(Q8f7$}#e;gPaT2GGtS)|uFhAE6T3xx=J8j1i>dc2?HAMlJV8k1r
z4)Ym@Oc=9dvIkVj#VLSVW5Qax&TNKTr$D1>%GCMckB!3qwnx7qU<x(-&<#`F)wsNk
z6i!DQlLznXaXyAFci@nk*WS_GM2O1c%zESfHbc7B$NX4wwMq>pn#0ptrKE>F*>2#o
z-?2Ldyk12uS`Lvb(lORKJ?>*2&C{h{JA_TEWMmKT!<D4VXm;Qi*SO)0_i#s;EklM+
zOlNqq?Vfd07Lp3B&2w9~^3%EOvdW{=i{!eaXWKC28|@~Ie3yUwm04!UO6oYNEZpX<
zVE`6^!p_-!n-UgQ-T&i;&bvvIi`;L4(kj*;mv97T68KUQpt<)OkzCz}Bc0QRO6&y3
z%he6t(g@<|+#~~PiCy8oNeO3tQ22bvW!Zn2vlxvK&JqlNKJ6q$uW8H>NUH$In*AB=
zxI1iyj`Ge9@KvX}OL3S;23#?=$ex4A8Fh{mWp}vBsSm@6Hr3s#fls6|R0Arq?jkVa
zJU|xkp@cb6ux0XVhKEjUL9-#a;qU7EzujqMtnadJM6P8SuJ&R1KM)qL#(c1ZCNz7n
zv3K-&W6`9lf_J79^<PUE;3)6niSH9yzE0FLAnsuPkHWAlbz(O#^RNTP-nNxmHWTBA
zRrA-E7f|@Jn3r%xMMDQaPv}s$LB(WFy$q*+4ZA5HPt4h>F}X&Zer3yvni0cYtL@D`
z4!S}*a78ysg{~&YS*?lI6qI*6>Y56{mf~Ei$4=@9OPmYo%99GlBKo)uQ`8ebI}w!A
zBX)atE!3<(wpJkN+$A4t-Ym7viodOuMz$_^Uex6xo;Gdb=M-#NX3J^Q{WgARe)^eO
zb5#+=vEL_Zt_fKdhj7uWY%m>qMeGl<uR@l(Z)TG|DaqcvE%oD}VIitHxJoRpp~{n;
zur-&>#3Q%z%6}+jl<sgM1Fh2rhNyQnnjW)eca;Opj@VwbGlT-dMUFL0g#8JqjUuxV
z3?HXPdM-5Sajj~r5XG2lX0m*iJ}DFWMu}z|nkqy&!01hXU-Wy4H9NzDK_i+k$u*sn
zo2n2y8MwR@mK&}E&k(-6S3mP3Qf?A;E~LtyZy%iUel@S&xwNiEsLo9MiJ;U4k@D{?
zwNinAm_lRGmgpjWT*<V;e4kIC=HLoBJYhL-Df!XOu8Ft(y3v}1>8IZEArZ#=LqhU~
zJbrv^RA7vp>TUw;%2ihU=e4-oVIirKDm9vMJ#OB<zR{b+HN_Pize;Z?pQ*i`DD0OS
zFOf{?bAr~BS^A1Y3bj@qV*#8posr$rT5w8Q>2%D>il^?(NX&9}Ft+Hp^EV%sdSfIb
zpT(S`!?Vzh!|!kvVgm)u!Sg7JI#t=<x<5}lx6J?x`IzTYUPKa$>>^9`@%jZnYl_bk
zPI!2%s;yuRE8NLB6{7VXX)aXQt?pXW^Jkcbd0JRcSB2YDu`O@6K{(2&EtePiy~X86
zxagoVcWXe4QOG$8QVZto?n$<3);2lO{d>3LP)*VN(?Kj+hp)m=DQ-2UFu{W~D8=I^
z$Byo<MV3(uHL|?ZT5PdDLO3u25rWTEDrx$SUPIubQ5daS(=pv+)sHhAS{PXTysR<o
z<RAd(X*X;LVCTgS@N1*)0_yN0*Xk#sxVnA>SAC_=H&H1#OU=v)sYG^r&`EgaQ&i4F
z;AcmtO73o6T{>lU&H~D_P;{g2jC4~7JY4*(#fNk3%A+WGR|egr_JyI-;B>&ZDX+mV
z_hqD*10$lb9#Ka<yfVBxzsee(*iXde>El=9vx^d&@3Ar3rc{XG9$Sls1nVb^cqqOu
zIc;k-Rep4|1f^0Tw#QBK%VTjdeK`BlOpe7|!?b1pa$2U?brK1A*FX|ZITQbAS=^*f
zO|NZ3%w`ly5IdFXlbi!Evf|KQ+wmnef=xE^+(U=A=@wj5ud>Cmpu!{OR*q2(-N^;}
znmycRR!luv;NB&qGP`ch2?`gf2AQkpMTT}V``oZmw+og@a^&x1UNzO@w7kNDIVam`
z_&v~#a9Z2dUI;m#S5MW{>N1o4;=t>9PkeD!kKg3H@oPpt6s#rXUeuUF5NV6XOo)9m
zykRQO&?U--7G)>;Si|XswGUUAdmP>eC3XgbqB>oCw}kbBH(INv_g1>#q_+V?GqEtc
zYU7ijc+CUdjVcB%_Mr9xvy)--d3u6X5^=G?S?jo7jlC#>9@j+n<`cfuSn!vi9l*zl
zGCNN$jX<zRR$X1|%vBtdNGs>;17piThbw4X3!?GjxI@TZpOR5I4HjktvaHK@(&B*A
z_b8C4up8){XV9-}1kW^ZUi#*BtX`lBvDVt`le;`js2EUkBYGR!DK6$&=4mzSjmtl6
zaEefN>njNOO%%o*4)+W|N$4l(2S_{Kbv9?ycQ&;#u#7&;kJYnH!Mn*vbmj?$--JWL
z+ttkeOz0BAf|g`a@U>E)zzz1)T$j-6#ddI%l?=l|aZ20F>xPfX3m6X^YXcFhF`ois
zsBBlzPPR>1nYq_%K{R@9sA$O4PR<j0sE)q#*8TeEn1}`OjqTGr6^*4Gl|Y`%vJHGq
zK7$v%)`smN_Ml%}{LJb70aj`1to<iM99cf3Gs}CJQomqlr&nUx%%ei&nTvqZJ)bjK
z++#!us4Co4f<fw$WgL);Q?(TpS&A#)Xw7VmTqhVqDol!*Kgp>y4iCt>uVN<x&jIQV
z5W^xH`9}=duz~FrW)e*B>(SIyodIWE?5IK<S`PPXq0%}rd{RTQFr~Gxeyh{04#iU&
zt<93E%kOyQ6)<XR%2w|jEr`+2j%Z)mKxaIR1glqHmd@@U;V;!LH--i!UJ9H2^yl%&
zrHBY2Sd_9#q1EMXA++&@I>IsN<9-}-z3~#G>2GYjM44-NX=8_RlaNEXN*&B3Xw~KO
zNeNbttMIgS&r;$>mELnUC6*#H{9AS>3&~^23Rmx|2J9a-&IvM-sQBPIKhLko1||9g
zYHc8-@(M7&WVIjbdEz>2hco8cSUs%haAi|v{r+%#60(KjD`hY@>>0jz^S*mty{9?c
zK74Ap;Sbqji|A<ElrL%lANoA)p%jP7nXoV~190{R5sx$>kT>sitB=-=C1$R-RyYVp
z-ML{wEb<jja$tqK4uZJ@&EtuLvDBdXzLL;+>#PVvQDMw?{Q_*!g7PDe0RHOYafK`9
z?;ME<HSEtyW5AcQTlB{JlI_oy!y${q<#)bkSr<&5X$tLG08`FVpOoa9elOFsAhI%4
zVI~324wfGX8<?f)_(tCadzT3hdNup*eJn~w^+wE!>6lowIn*HZ&<ks5@XEbOz{a+7
zm8^b!^%8-7LNF&><(e>N(j>Isqjvm3(<+06Cz_oW!3LTV1OzFKmMSDY)GQVXh5{fc
zGk)^Jh$RiFK?xWWDE*<Cpq0KhmU^$M<tRIA5<}7rwqjFhsizCdkTh-|&<RT`u)j6-
zv{8`Z_o>-W2V=?3dhDaYZLfVwE5y#{g?>!FU)9sEAjSTwY8Pz$ZY%k7ht6Bs%%RS?
z4u>iPpW2v9zm|Mz$tSyO^<VH@W86AzlX(O;lboOrBCu!r)T+l&jCoU^fY7^Zc=ck@
zr%nal32@M`5(SjIXjH2d=NRm6%!W=na{4kQug__1ttL7~T$JGf#o+e7S!IJ<i^<@{
z(V|uCXn9|!T<H~{MbhyD-^`r|Xn$u8pH7oh)VfUO#()?EBf%_pxp26zZ&2rc!08E;
z4B4=9A)l}!Xi}Ev*9Dti%_~E~QH=uJ_Sn(GkCIo9a95YVUahM~8QyynD!sgHEuDaw
zt1i3FIkTna=1uNsxM9~!2Fk%~C^Vxq5{Wx^dHUA_FROKfH*JN<@BhnG=m7Zq^0sf+
z$5_RXTt9tq22D*7*j{(>BcSyKxNc`Bz+I($MFE0_>rPN4y69Fws{r<iDxL`7SBx1P
z$Q!tDOm*QaKw>r0mp;oRCsszrkI4S&A~;ANR~!Ir!1f|n*hj#zwh&%Ph{M}L{V3#K
z<0vcMZr5@PXjq7?=w>m-HM7v7#00t!HUS$&%2?b2N22^z2YtThuQJ8U$)AIu2v^Hi
zvxi&mw&>+dx1=Q=sd9TCBHH1y&T3e6XciUcUejCSZs!pDntyd-_<Gr1+tFeVL*WMl
zud>*uU-qrq^~*mWv>hHS)Ne>UJ8YF_&(+<Bxo=}A#-XEQZzxPo!-^+0U-3S@@Frfn
zbV0KK)9}1C;1m{IVrhg6)$hfvM-eOZA}PNVw28|~`eMH8rC^Kjq7{#%!rAih!esG;
zhu3+ZC!{WwCeMw0{=#Y>D)c?MgsLCRhREmUY(2lBd30kQiY&Om>$N_(x2CeUQ>pB{
z1+g5Q4UnkFV_Dp&lj5ngvx>-Bpg#`%C-WPs^YP&KX(d8qM|-29_mzVlb)(QnP<D99
zOC7^R0bUS^A8w#liB0HvIWPxvgnut3U2%3m1CZ2Erpu^0<XYW2ueIB7WNZ*g{EmFH
z?|`-bWidz~vwNFQlL<5v>vqKgy-*-_s3YVTFh01tCNg1cU=?d-qw+*#{&@o~;(4*f
zvG3O{eH-4&b4E&7Zkh~^x5o&b-o?qT>xgiz&w~QCv*`gMIR4-x?9#V)AE(0|SKV}Y
zDWj;?8k9ry6M5BO&#)4wcjcSI@mIYnUDMqA#q({$;1i+gS$SDes0)LH<Y80Yad|fT
zP`kBdFA>8qLyk9{tOT8EB$vwQT1ERkG2KzGN)SW~@`hide4b9HkDpnQQxq{2VOLFJ
zERK*;tSDatd|Bpam`V0RcK-Zbu4v9157pG#WhMPmE1K)gV}NG8#L_4+7G5D<#tV(p
zqQZWF4;C^=dX2WSWGj5AA)_eD=REgXyx_GvFmW$K&7>r?8n;mAts~`tEm^8bm1I5w
z%GZ>ypFen0C&b!(l-Rjs9;Y(V9bmcmB5~h$>cM|%zS_3$TH>Or%7^g&#X=3(Bs3B*
zU8(bB3`tHfMi5nx6#~S&hOk$!uf58J|8iTz2e9!|S4N39pm2&qbkJ~&szXH~y5U{D
z1X4)*vZSdN(xo|_dwJjeyO|nm7?`K<C!`*1S&2YgF=jgmxrm$#{K(gL7iQkkz!wQR
z8X`d%<|tpY-wyM+q-|Jf5tf+uM_6guWnr&B(3y1fyJGRYPYa{US#=d6bcxTn1btt7
z^LgD(AC=L0t~aT=3@x2z*_K+)YTjyF6{;BQTa(QhCT&~A;aY{lx5a17&r+k~pu{1q
zT&JmN5ay37g7VDStJ?!#B5#V;uHA<jd^jHMiJ=&rFIOC8ckUp@cr<sBQ|FkNa-DFy
zTMMqo4$Di6wA-F*Vgtv+?k1Lh@65^sC^uNU@U$4VVlH4o6kCmQVUdY36KX8hck4AL
z%(0Dju0`J#skSqI7C(A-O2)SNx7DJ|iL*SY(6(h})2^^Yvq{lT@X<fGP`AlO8zKgu
zYo&v}W5;QEH@x6Es8ZzyWHY;JO3Qt&$8oZIiYhvJo8E$;U|$!cpEM9IlnjAZ>m+qh
zOq-x?j$2#yjH25KJ4!u&g9QV~ozc7crVhP{H`vrwyk92mvRK78>=5l9DUJyFWPE<3
zrBzjB6tp?wqGnCOJdYGxs{J+SUeq&BD9Ah69{WvIv0iAbuC?Pb&l9c_42yHf^xb5Q
zsoz*nyr4MS6)q|ar^Gsxr4^49tg1pE$0N(8^D0?<d>dUN8M2Hogreum8Zhk@eP_J#
zDkUNmLa~TUDRh+t7G33WY_Z!xhfUPRhdW?qLE6|xfE|s;qK7%o4y$(<!qjk*wu?NZ
zyy;V2+6#FuqG@*B+7qi{Z=aC`o5CmY$!>U8EV_KSk0aLH2b>wEPO?9FAqK-tbtuV+
zz$pUoK0vn^kG=63bXr<Sj5+=y(?q_~cL0ki{~l0j_35bGMCIaUZ8wM?vP}vG+`|^F
z;m#%Dmxn9<%n=AX`_QyZ@s;pwiA9;I`ZT^L%F?khOXq&p*@q@^+V!_M0{Z$&9d9<^
z@)d%oq^p!gsc@Z|9Q{^ZHwueINL+`fbrHX|$#)P7p4QH(8*bdANC!<Nmz3HG%Igdh
zJJejG5=x6y#>;}#)w{#(^GPK)nqS-Jqp~lkgaQgI|H^8+4{qpi{=&04gYTri<pOs<
zR*~47!c9I^UkQGvP4HsO(;dHaS@feQ;{wAJ|KUY4_bj^M^YHf|pV>DgSI1HkzxwFc
zg@SaZc<<TQ3q9fVCK>*?sCB5L5eI`Tx?i{Kjr_gTr+k%1S`o$^Xe^~*yrdEE^)A*@
zAZ$eJmu}FQPeVu@sd0U3j4*5}Ob)?aGXSYnMDG~uke4n5pZqKyA$5XOZ@sBmhgq-l
ziV-_jqh!c-+(xBgfL!INUul8-9WtO_j|v#N&Mi5MgTWw}kUiqohVXr7yIMyV%AX-S
zB;ly31nu?wNk7S?2GG`gTX?H0N4P5lmzHoW@CyuWC}TLTkI>vJ8L1r2Xh0=x7Ry&V
zY!|^@6EZO7=`(=uI@S#+UIy#hmR6CfZ$E6ieMS<sepS)QP7rg!tp}d+=<-Y4s51;7
zoK9Suoxag{W7x%HsHrBx!?AG4I-6(ul`<th@MVrVq0ewbZINAEYkci#nm91aB}A4B
zvO^cn-qa2-cchKA*oJ@ySDlaI?^brNWE|go*3)FG3kZ!hTk*En6CzdMJoPp2L+KVO
z;ZyB6&9kQNV>vfe*VeD!XTn!cL`El*1Vl0B(9HGnV~dJu1MQPp<EKFsmro|0Gly!{
zbmRN1yl^w)MP)+c@mLSiba@=bK^Q~q-<kjhX|o@^I>w%FN@!x3*k082T4rlnH8h=X
zq48b9m0LtH+3*|*Ub&SvHT!H{`mHb?$W}<F=F<Z)9v}fTeXtB_VHGG5L}Y8JI<upI
z#hUd2e7ULgrqTuC?IZ1A9!b~ibQAnU&BoFh2ueuR>yy!1I&V>~nhH^XPnL291Q6C#
zSlDz97nHa(=~pkz$A_{u@lEh)!IaoU&K6&LQ9pxlzBIlTlMN;)iBF4PbtRM~UV=<{
zoiiUz2TVTJizt&yuCUczN0n#A%j-&TOyZDw^*=6T@<M`RT21s5u(;ofquuY<nq^Oy
zry4v3Q?r9kGu>I>E``#F=Lo5N(`LoTZ$KeG5V_S77Q~xx1F;_BeTECs*H<s8Mf0+D
zMzzT*3_71n+9=E993?EQ%5>RcFRH72?MHG=y)9pTHAp4A3dCbmu|+PT!v&oTPf)yP
zXH7dmDJ`1b44wA@dY&Rb#3FoKPZ3k+(3TS;ii<g~_G?!v3*8N#z9K|aP?r&|emTC@
zmgR<<w`}|t+n0c;2Yn*82tz61K!x`8rlb&(LT5atwI+E*y;+-p<nqyJckIw@a~k&m
zpzX0(Fx<bS_$dOr6k5Y;r~{`^FINgec)DzY|FW&Gd<OUY6oA@{-uXRn_GlN)wX^X1
zu3Dc)1reI$eO@mAC|?Xm;*1A10Np|6wiIa60NoICLCuM4T3*s%J?8{b(b)ETY{6B(
zbM;auEeTik;D@xpw=-A40D}3Mjqkm@$Kl?L+2N&mo(C<6BKy0a8lQ$$<g-8WKP`3O
z^#}?dTNYLz{n|_<x)Z4fU+N0cmlcO}HyqRV-6*kmL(Q@46QAF~5TL<QTovo7_u!O|
zU<mklVnnNvW-nU(BNUE8*Ub{Z#Vzx*#w$e&i_`Iv;uL{&6x)Ys#OhK3>i(@Mgky=g
z)!nKoxh1?Tyxe^@r@quOW}-W!O%iTU`?~i6q-I_nYdow#TnkE_xsdq;>%rs0vd$S&
z;(ew6p)Jtfq`FE&8Lv%!{_RnDsX>oxilZb<NK$cFsfem~pClRCot0mR7i>D5doN7`
z#hW&0U3Xm{=&##kf~_W{I8d#otD=W>MKE5sO$n%uq-^*Mk2SixBAfbpv2W?74aUB`
z{0OEtorP5K^~aPVbGAL34axX?rYg$0K|n5*p~g6+f;x6w*XLcEAn#?9I4KrPcUtKn
z!-I<h;MO6OAHQpqw0}pctvq$E-nAxC>Nu72H$}nr@jIh33Nh{C$*_<rP_0ZJsd73G
zhN>NefJn0t_wL6=ECGty7)<5lKuEx)N6e0iU_)l@QF;!i4RrWWRwy38c5sPmJmP<c
zX*iIN{E*DxF`Sc`Z0jNk=|<)mPmax452^QinXPC}1?5<HL_fn8S-50k54cft_Uq7m
zadMWM2t3<eZ-c9$L=S%FHAwQ#3{sD6{wYR$OTD-1qmQh_3CySZr8^^PiDELCrp7{z
zw|omnvJyt08u3_ssjU1ljAf`cRtlTtW5V7PY$EhV=T67ij@n2}w(&|vItoL_u3L^r
zdn6VPb!QvE4Wf{~$)>~dI#0A;k(Y9=IoRo+fTJ|{+vn~Gr`x54+u&zFrq<Mq#pGQj
z+zK{lv4%1Y+ed3zT05(`zntw`Po6pp_h@8`ZAyEdym2=QY-nbnc3ypv{SIDz@eW+r
zT@nOiV!eNI3FuXMo*yq?SiCr{U`Oa(MMbRHfLa2*)i_uLy@IwNMt2*5Cezl1du;Ai
zA7sf8l>2Jg!b;h9>uy_a`T%@_Z>s|CA5x1~)?}M6CX4-+;PE9b;-wUb0u~_I&UJ+S
z3Yh390ye09L!e5I%RG)CqU~dRUNaFSWMJwLOovUJopp+Ss7@dd`t}p^DmH}+Ly-Ak
z?y4WBwydy760!%VTJ-~xf?awveoDBod)6m^0t0O#M2?R4KfPm;0Js8&G<n(Hu8rcc
zQ_*Pk(FvoY>#-}ZZgnvr^qbywT9+=Gwq0yA%N{`X%Oz&pf%}0zKP#PXscm0nN?a=y
zd!xCU_RA~d?+2Y#S0RMq*-Kq{edDnN9jaof9SDxN&7}fIEqkZ}7?@2`SPA8vjzbKd
z(H9^os&wQ`x_OeC`grqgHv%UzV`Eu}`Zv5%Roz;y69AzEK(I}NjZMA#;IRG5gH~{D
zj<#&yqApAkUtTu7mscPMtC}bdnPxY?l~Aq3wXRbyCfBqSw^H6UbT-#pCiPa7L?s07
zI9?oV`z+INb&o!mqF{HM>jUd?1zW=yA&M}Na`)TnAyi|TRy3Nl*`)6Co?tHAq>*jm
zZ7mW-E4IA8^vLJNJdt{M^)P)OJ^7xnU0b<dw<_dMcDuJOrtkf&qSF4l1<?(QtWHDj
zr%tQ`Zh26oosx#cqD{-!(G9rD6@S@SL+@$(SkP;(_XGpq%!P0!(nPJ0T&8z>sFY-3
zzndRFWJD9OINy)5AbRE(OPo^-#TH%gPb|!mkT$IAxdlJ;tgi=<UvS8Q_Jws<$wy)k
zFU&~uU>U|18VnkihgTP<dD2#ZJZI~mqm8=txLR{xjC$rqysYmziVqlOk7ulos6`-g
zC=eBRMPu-z@6OFXugU0J6|3mT6|l&+4LIa((4E09IvlS9=Z->#7H4M-6nst~_y(rT
zo7Kgqg4CXsa(|<?vf%__c0MKoK~6IB4Jk-<E1b^nvK(fJoRYD*V-CqJi@N|vVGM5o
zDRtQziln20oNXpg+uE}char@kjdnaW%7)MT;10SSvG6PPFXzW5`uM*yD2y+a#f_-%
z1^iR7?d0u}$~I@#`KT~Phw+#x*hbX3czAumb#Jcjbf2#;U!zgYDswj{9fvMw9H^iB
z1q?vVc-clNOcA8@iT(0k21}p%0qUOi`a$jec;D4Vr8+hJ_TO~Nu*a2p3r)K0xsF1$
zx7GxR$_p^fTWKwziT^4PS&SHpigJcKIh=N|goe$p_1tFCMj5DpX5X<?23$U@p?WH$
zit4c_{MUsF1b+xl(z!N|E6`)@Xai24;fQ`CE?I3;4F2dhw<xV>iN2KhQ)W;Ra}EY3
zeTfF-q<)t&e=bjZwOMv{t6mJJa9``d)}31s$wldDMLretYWotxU9+gSVpSdY2G#D9
zgRL?<vj7Aoi%qpnYUuY|RBc|n95=h6xO_jAVsVRG+HnSP6OME9VQu(S<kpDU?5`h9
z32Yv`r{4O;9Sm*V%(@1X3<Cv8dEj`S*})L|2y|gb7|4oKzF&_w#)sM#42RxXd2#$e
zwWKYy@5@!2_B?3Y7v}EY6JykhEufj~V*K;kq1PH;=&t7Ic4(Wj5@siq?AQ#g1X1bO
z>$9`7BVw&lb9df)#n@jX<@s$s`<{5~z;byfSx^yb$OLywWAvLtYw6(>6)pQlo}#6|
zWy3CMnNOjhN=yn9W9Xh^USw<b4AGhL3KbQ2)@MZcwy2-T)=BJ_gQEnSxYv)V;tGrf
z$TsH_j@S0mFM)RLQKx~hTn0KpK|@BkL|EL~6U+edIRoqshcl;|s*FUmYgF*`J|6BD
zAnYfKo!IOP6qT@dM%De!wVzmkMub#R`+FwxQjpDWS)0GLUpVBhPo1<(IyB%J4QClp
z4Swr400JVyN~@{ne%-zcN16cV)s2+XhmDE@Uu_(gPV2k|zvBXCXany%BD`0%^qt4P
z)s(P3nVl7KKlT2^1ZWz~xYS);Tb8XboQH(3%s&pn87nZEqBQmvhz4q~9a5jJ>baoh
z45s>rLn0{ThVXdTVhcpbqQSeSr)k;2YWWr$p(|IW>*4|VG?i%KRlCOKV*rP!hUgI?
zqz;BC{XPgvN6in^V8W($PUL&#3*wT__o5RBH7WBPr3F|-SQa~JIKg%?Ix`ZJ%+P(-
zAr}xA|A(~qfNC=9+J?u5I-)31iXf<9u%Ps!l;Ef!(ne9~9fEWt(o1A)MA`t-n~I7`
zmEKV)F@z>aZyHLZ6Cjin@}HaXJoA0;<o)6Q*Lv2hXN}{XbN1Q$+WYKso%n|Cza!P!
zb>D(}ufFXiE+-<Xpr=qVl{-@{HX3C75(lzfp8hPA3>Jfl5PPHN%HL&s#g|xv8$@z8
zlzp6o3Iot^W6T_`F(;7eMfJC>CD%X&fCLe9@^UM$^5O|V9A>|rwKcaX7z;}K>*=Jg
zyFHxHBk3IqYH`ohtnAg2;u`JGrZ}i*hWJj(b3X~!bHBl@_qZhXi5k`jlz@~G^pfr#
zH!20nK>As-r(}Sf>p}_al6r{)_*YTtnr2OlH4oV|Esf*~0uB__*A_3B8*J;<;4naJ
zQ8+i=?M8o}w6}6hR-05fJ8|Yfp=_H5_cJg6kj;jkX{>00XfpY%jxPssf~>dziVH(D
zquJVFDRTp=^?!1+e2(>SOo_L9+a%gGIj11r;2x7rjqEZJ$GeKbb|&k?TW%y=l7#Kd
z)K9wN+Nwvj*9Up|t6f9wXS#g&2DI*!TB;x6+!+y=d|d_5ceM-Cf4|Jj-&3q;l4qU!
zecq-Z2;bI=<QRKHiL!w&gNEj6>B}XqlpX#}mnZasMfN^-ugVXD7e@mpE9x8-U6bFu
z2zm_YAOq!8QsnbQRwm|Ik_gmVFf-v+<~`+Su@H#AVfd`io+;;x(r<o7$L@aoe0)8t
zUvhpa_m^D~h-l1R37UG(K)Vp~V4oyA|M_0p=*~&r7|g7AqqIDjDVbu#6!>~0SF=e=
z;F2LKVN}@ky)Ms4=u63+Y{~1!_$Rl;)9%}-=}4fWcU*(bwJeX%6;k>BiYbirNe{U0
z7t>K<AHVEY?8FjYU3f<%kTZETgWt}pxYQf=UiL`x_%+irZ9%d!*~%tRZ{U#LGtiw8
z5gN48WwBRJt~F@ZnkVY`9=nkvN4g1R#k(>F#P7AK#~5`Tc-tmw6FDiA?H!z&e30|L
z7)&L>?5=Qvi7oce`l<o-_yKXn5DUfhm_m+B7AlJ6#|<7^ctexc$YO4~C2x>##)vd)
zrBus3PT2h(9aWXt9uC76y2fd>b|YXnT{?IczKLJ9P3L;8HDIX5fttU-vCw+My8e`i
zkJ5F+eA6zg?d-$ge@HjVE*zqUl=)8agdmK?54i>X;(hwRn9LrbEGxkBR9F!%i;q5e
zm>_jrjzo6zPBm}^AlcIZ8XOzzs%J&ng|tb+otS}m(d<PGnV8fVd)^`zGp(vGqT%0O
zS9L=BF4uOr)kju|yVMI(+E*P2ign`QlW*|Lz0xqZrT2@m7p-nos34xR_J8(m8-HXJ
zeF5pymoh7<XTN6&uu}Te8)%hEuvQnnckf0?s~;6rY+LD8nF5H`26ai+k33Bjmp1%0
zH7j?H$2wZl8rQ||q8!<Tig{r7<WnKiyVI&m459ug&&{hesU~L2fc^=I>DSIP(!qHD
zcr5%92-C~j`sgV10ObPlxrmk>e4kNk9pPJk=_CsOGU5gr>!VIF*TcykCbrg9eGArC
z=OSu&mR}P?#dDgBK8tpV)zU~dQm@BY8<x=ZpyH;RTJD+qq5&^u6Ul`k^JUeP*CNNC
zONyO})Ra#S>^LueIVz*KuSUJ6-_52kB|MVz08!b#Tl%2ZuEFvDh4I*LXmySWO1G%O
zE??^7hmi{s&&$+m_JDRS@x2B3I{A2U7${AqVeff|opO)82WAdB<)_ec(`faG1lho<
zRbot04L0yXap!#3YnmkNXLwgjB5Mda78n9KU)ql^Ha+I7Es`Lb^*m58lQv}HXx?8)
z-3@c(68W<0mIQx$pa2`4Txl_u!EI-|U@TW|Cyo0xaHIcw-B&YrE^9b+L+4o-zu#N1
zEBuNaOV2`|wn))%6E5V$C6reM2sWyUjmYwk25jM#bH2MCTD6lD`qY+6PKfhIaaB=s
z=J*naVh>;+smdgDpBwNovb|KE{yoyBuIjqZh?>SkJ}anMh^b?=i?Lt-?71cMIhCU_
zP$K;4lC)8#k+Qus?&@JN!z#}SXNxj5WOo=!vf&7bsl3vwHBt3H{<af4tKw}SURaZF
zBTEF;ppI`T;e~H5*!DCp+u&mpYg%E3H9n}LlOM-&czEs5mtK1%SUwlAG4HB)`A3u#
z$NMAK+m`vbu=w)j>fwNAV1fzU-0*C?{VS~1is8r4Q<*2!l}v3ww@-kb@4_IW)2;V?
zQaMCE%ez!ZXW$1l8F05b+~buQI45e3lZ?)zi;Ke&133p%#;cChf!yihEg4$%+hguw
zp&*M|5RxD*L4rmGc1v7VzdSZZOsXgcu7}&%B1|E$1~<JQdu6yX_LLyJ7j%#OqINZM
zr;J^us|uj%MGJE4k6uUPwr7KkKyD^da`!eJa1#{0F|-gqd1msI%&9^A6!p_iW#ovc
z{-e<2Z9-O>an(IxU9aX8)eq}F$GtkpGFh_xy-}H^cku+K*|*ykoTzGM>WyFtVs*(+
z6Z#jCz(D&qZmOdG9jE(XZ`^Lw^B$g>rj@lA2iw(nA^I+k^d`Au$zOCY;C68h_s$o+
z4=xqvUMfD!uB~vuK$)Xu-e+*^63D^$1PAaC6q6hO>V7RNXWke)Z0o5S-~CY+5SQ|c
z>HZQp!tbzq)-zgBjUL~S$=$E5a2<5KqLxA8x60y;wLrt(eM?f!_i}~u&WZ?GX=xIp
zYDK+?E^mh18?Ips3f>INichBc7`Bu3(drivi6g3FHg|39j*SNCO3iUD$iENn;^d#5
zkB}5gkC7eav3{;q3N?P+Hog;I0{EUIoGQkKAOf~m9G^Rb{}&Kd14U}UD+M*6ENv&8
zK8JlxeObcK=XBin^PPBBtN_S&9u#_rIw6O$6kM)e=xgg#?~&e59D~XuZVl=*(BXPG
zW;dLh_x49EY_E1dK%lnR&w?6n+v|4Ppig6CFqd`?1b)4)Vrbo*cMbkGC=SlD{ykEz
zW>w!Iio1IKLu!6dOoyCfk8X=g{~sD06VZ3U1$<?2yR4HU2&gMFJo#!-V!m!Z{8e6J
zeWyrQB2L=DadR2|o_4&&ma`h<N7p4YWJb#3gF^;vD~>ifYQ1mJs{?K;`CG=zILt$X
z3A`@G>-lF1ih}uTQ3KGgVi`pKg{6V64R97*kJad{8AA8D+eh!&M~%0lra%ST&<)hn
z8`5JQ4$#6v&v$(<Pti?!eySjS!doHn>5YT~Y(#8pq#AMZ32<+mCic;i^RMThuzdN2
zQ1u#FJgG+V!KkUi@}f)b`<9<A|2wqcWf>rwJ&c-<ALvnoU$LKO+I9)@ni;SaE-45_
zy_=nGMS%v{jHPs~{)(6c_ZHBm<?q}A)iSe91@~2gkjq(OIt}lUPk@RN@Wamp9+JRZ
z7ot|VTHTxE+@T_Y(n-Fmh%>Iumu^t!ZFJ;100;RoyWFUOo?cLpJEdmYHypP6nEENB
zK<W31riWusB~*gHnUnWn>gkpK_IM4B623zj$Zb`{0lxcOlb79-G-}i0`gR!MMW=@J
z%+(g8a7sW$mr!P16SjiE(h+?&EwPxEvT83WC$;j@-$C-FQM4j5dT8Oo*gek4@N9i8
z=Lyl*n$34cA^6K^1yyI4@7bqScxK$iyR?g+x+mT+K%TWjIYklQe1F>ulFD=yUPREv
z!tcw?`HOL{#`*(JXw=yP(EJedH96sptnck3vQ7);uBb^{<(f&R!}h=ViLG`sx;Zu1
zJnFnZKIJt?139DCq@_uBF#f&203Z3%-B_8>^8mzcl_%wKe|irNdx^xpPI-D(VeXqc
zFCB)A7tM%-FU>mOdJYqFC7x@5)txuv@DKE8i8d#6e0{4c(RfZm0@ZWLQVSpRJTkf7
ztmD~0cao^ZqtEZ}8<(H0JAfO%As*lAo||dy<Hc{9UHu4WuI}F%X9O5peUKKsQ!|>l
z{=Ioa?pm+iY6Oi*efAZVc4W;iK4fV|yT-)n>femi(?@8odicJQ(?GWU3BJctdqci4
zWYFUl-R94wyL0(ScJ20E6LxRNO_Tuy&5URVVCT9Hh%0|(zs`Fn5Lh$PXUjs>=Z$I@
zyU~`*jhc8p3o9t?0WA!<GL%eYGe}HYou?r6D;-r~Ah(UBe>b18>6U(vnCO3|5QY0A
zzB|tJ_9dp{a{F~TRtFe*W3u#y2b(?^j)55ln?5k%o)~~}=i|oAs)Ign*+|e3iY6kK
zFU~?Oh4E&#w<uX-K69<0ND;D|Eb953Rr%xDK(?aYuN{7$G>2=(e>n&vU#ZED{U$Jf
zB|lpg{>CZ}Gr)IT%><*}qZTa;x9Sb>dPWtoau0C$EZx|ATih4iJ+W_yHbN)DtFsBM
z35F_ZC9oj2pFN9zXpN`|7_oYg&OLK$&RyW1niW-R>-!v@ab)V(*EYn2%fMo@l$$v`
z_<|Y>_7*s01!cqiB&D<66R#Bm=%1IH_R6RSreC8UZqMX)!WzjDDjU(H0ByTBAQ~P6
zDP^oeApQd{@>^lb9h3L;aPuPe<oW#Am**3^RZ)f@<!($pY}BsSXk?f?wzPzj<IV|V
znXNcAQ;a<uCHWC1fig^;-*Xh|IkXONc4J3h;AEa+y|_vf2f+mj_AE7f3L=Zhs2DH+
zx5p09PvRph&R&oMdLKYT(bucAfT^-{o45yV*@<xhV5lV6N6aiL?x@b2khTfMFSPye
zmy1<eVj{1!W-nA4@+yblFVkaX!A~aNL33%msyF*9w(Wk{B;w;fi<(>)VQQk06S*%H
zVqyeb6l3D^RV9LfiEl(=2W!5F4pc{>zvvdXELg?!zbz6SXsdfN()BH4F|1KDsN&7o
zcy5CzvL@>OOtDVAdOTw10f|Q+3j%g4$X;eV`RE$vCsm>BaGvm`i}O|3?N_Yf*3k&-
z);l1?C2Lv$)At`xd-AjC8mQZ28_b(BNtE%k1qYKxRFSRmR{E2mGpg6F`RD7j*3TCt
zxjM51CN+p!29c5<wSkHsn@m=i)ErH+>7HEd#k{QEAhlm#!fqazRf{v5_D?{^Qo(H}
z2qvj34dZ>jTrGvQ+>LT(REyA4z%@{my|ME9ABdJQ>+5x4oi5kOsRan1bdk0Kk^iz@
zT?oEzR=B4H8Esz~7+r1;>*gf;273;uokjH)8XJP}!DKO}b$@ZNPr<m?zK3_`3@mkn
zM35)SswkR)aYmB@qakC1p1bLFmAO4bl;9C98oR~iz(Y&Xhq`t-oU^TKX3$3%<@1j>
z$jD(HuI7{Q{dC?~<w9RYgbNtMp1t?SZGwk2)SiYjG{mcW(=|+N0M!z$F6Qkub^BRX
zh!W$IIT#NA*1yXw)ymvx;FCFai#KVNJ5KisnBy#XrK-j}=a{y8jcmsJQq2AUdyT0Q
zY7Zc{6ay_)hpdN6gQ`xzP+hmhVHG1aand=OIQgL>o?7RWgxqV}I1jH51{yVfAgyu_
zL+lv(;3uE%C)x@yYmWYHtMe*@rhT?e7w&EE1x4TA7n^$78lT6wCn^)@PDNG*(uDc^
zmEt}PHcW_qEw><9HWBG-7&Q;r0+9b;u}rwt-yk8q&HzGz2F^FcTSlU29^UKlWg0Tk
zeLhRnf%+<$BoAN4IV(X;kRDeiKqyiVfwqL?aF?C;3O62T66fh31}tBmw}aNHk(IW!
z*glAn4G}uaJd()bSoL=+?83PQSZHi>*a1C1p&_x-vQ|HI2J~l(gv2`z$AEm&V{Am|
z%SG!x3JGc-y+jI)n{s$HQBqy+qA&oF0c1(6OegDdjCnS=fj|auU_jICpDsWzc5ICQ
z1ctm6BPs`YHtL;xD9acYLg+_#&cG_1Wjqfivtr~-y$qjs*3vf*B;n;Rb-5tS+Whu9
zV{^V^Iu9P4#OnXxfOlnMQvZm92Dg1W8SgXcx5Bdzq+~~iF0OQSB#AEO<1Hx(D%@Z&
zmJEWyaVj(z4~QbpoFVOK)H6vGfcS!=jlmfI8rdk>UW;LG@q~MI^Tl>x5r;JNnfIib
zYOJyO%JX~~>`c~DZ0DuSEMToqlrO0}gK1lV*}EY02rAFXczUsLtcXE~TGpOjnHsyH
zschcZzCTd};uGas<qX7|8#R&^iCp~NYjQ9x0W2CDBPZ=sj4}V~Jz8B8F?Vy;AgLT}
z3C}>DaO8&G1h5p=w9?U@E*!8OCUgJ~?Nl`3t8CusZ}l3yY@&Mroc!7$7?JE41RbAO
zTC2ZLfygQT`a`>wd0S<Z$r`g_0Y$OMWpZQ>coIgjzy@A^9PC>WDh~nj4<Q&yR$}_q
z{0RXP(EekvpU<LqQJ1~%B#Fhda6nsMC%W6if#5I=6kC-(^c=+orO!G>wbZS>M$25z
zoH{50BZA_^Zcw}cJwFZx&oQ#2^+8pDQA}7uOk(BRY5wa>cvQYdo1}{KYvO)^-Y~;b
zAv*j#yd$47xMJ+R^t<QJkV0F!vmq`Qk=mQ3j3XwtisZZs+v5Ua0;JoFZ{i$4-&0@w
zmtv{p_r_SS>4tTJ%%P3L%snAn^*|Tmk+(gJd+m%4N%j=bL(=2@w&;~P1T^6`g+>i$
zK*#DaO&25jvWTSE7EWbzdUqN6BlN_J=}Evev`*#zXQI%A<oqfHQj-!IkUnmVW0op`
zvG~IwRpiT6hy|g(dwIOO{tBEB*BF?6fRV$7ei<84=x|hX3`dh|oT0>(H}|0CNy93{
zMhSM4j!}eu4d7QdjacQp)=Mk7))?<a+PD7D(-0u~+8E{#hSZy)cf|$I0-8SCKGIO8
zOy+W(TikUxL70b>>HDJrq|zhII2sUU9AGW7rMoVXN)VpI{9KrnF`dRO#^6X+2us(<
z@{bU5-qiQ)hVT%A#1fzl=T1uAI?LSY&{v&KX$edQ-jF}bCV-L?AXU&hCgNBKs(KiR
ziv?~$(!|rJ7H_Q7u4bD|5IvV!tia3^n;1myvm%8xKihlDbGRqKZPywDhcLuLntrF5
zo%!$E{jo~wc^)PS{{na3XE6yeC4yaB3G9P`Y0CIo(cMJ+$3#WY8DpFu1!CS6@`@GB
z<ntwP!wGxBsm~|HUI84~vEl(BV)`#R!+fO@>ljqDVWV&_f=R(^YD*zjzuEGVMyU$&
z2sKWW{V8S<%o~Z+D)X`szFso~fN%+QnrL&p4=_$BcluX&&hM-bX-J9+jRw<T@jxa)
zkY=>MxPLJM<5C?x#0BFtTsP5;LlRl_5KJ?`+8F{Rz&9n;-cL#og=P$$L2v%ihM=mY
zdtCl2lhpNp@?z`4z>7f#R_Y#)exA=3YN;l;_=(j3MeqSU&+AVBQ0MCI1OU`pUCoo1
z03SC-*ATcn@m8Gw9vBJI)P245>61Kw2Zz@x`q4l*G}bM1C}kY5vsnp%n(WO6b0C^v
z5h;Fpk4zkBX%yih9kx1ZlxJN}=NhmvC9bgY6$-bJ)23*8*!`<-l=!(oj|S~RWk@qe
zYf+sww8lrC*P91Ki}v`-VBi*1x?rg2CtwtpEk)ewxaOFH0IEDuz530)u#d9hycG<s
z@;+W_O}}IaWBO_K0SR`zGI*&dYxp0OW%xj%A-<n&-E<Cb+;l)@$|v!w*Bp+htmlvL
zo}#a!2{c{k6XpjLS<|Zaa?iPvXn$=$VR0TRRmS)$?D6pp&J9wuF<pQt($~UNi>k?>
z105D?3{*Ea9HxdF&&JPr0!p?xQMM#7EIzDlLQNfh0v;EF6j&um^gswi@&v*-B;lKw
z9ujmCI^V5T?>VQ&4T!`nk846RcTqYOj6L-#h=uy$RBQB67%A48KY^I@;+(~qy=kit
z9YBn;=Tjwyf2sMbG7x78Z#=FIv*ioFX~q{^SGl6dC@8hz2uljc-VaR!!5cuNB@g(2
zEKly6b*fbd)4;f!@z4w>;IWDE7ud53d|#%$`vr(G{xSY>9`ZX!MH8Dp*+Tr_YjocK
z!Zf=v0JJx^<%4MhW~C;1C=P|XFgyMG0U(E{S0ffiL;%^FKqcTWuvUiV8-l8EhO|aS
z+T+ldfM@9>Afdd3iU!k)x$(8KGTi=^G#bPKinxH*kN7QOy%!)6^E`Bo200D5Zwk*(
z$2|2kxe#~FBg^O3y(k%a=;KUmF7uZOKgF(6LP8WXS2S4_>Ek&X(a$Ph@F@2>(SMO3
z;y|fT`hr`<ylyyaO=!9-_mf%ix^j{#=rfm%&wqSfHWGB29|>>M=8k!a9;lIvvqPZr
zArh5N$V39g_p8Lc^7+=bC>-{*7_@&vj^yyV!AkX|)wn0~lLb~I9Py1a4r4xC(YSe{
z(vd5W-)E*M^z&l5N`q5uARzR4I#q_YoYznuuw#tjLbu3@b37e!zgaT_g3n}BIp4~>
zt_rqdESyb}{{rReEDphF_$tdA^Hf0lUag|=Hn9YeYsAqvXAkT8{38&w_%<4Hg`&&9
z#*SzJJkgHFZ$DgNI!*kdV(mVnT<;}rd&383$;;9Y#usy-kniVL8V~%(*Q4=@HVP4D
z`<MGHLL88YV6v=CE2m5C1@-pu`*#pQ;KFeqT*KC}wq&#uRin5@9`wTR^+vJQp8b@@
z@l!T_YapEuQF-qA30~mJDWP{(Z-=dY5yadZcxh*acL}SN7VZ9Jm2><7OPc|>FF5bL
z#(5JkQp@J`4Lo0NXRHEW&W7opKkiP^gU82Tl3D$WW6+ZtYf*3pe)gAQnb*4e^#xG6
zG49LRxJP0yAD>u@9?}xmgWMp6RGIl-+CJA-!<suA$DDh%-@>&=Q^Z!O*N#DwTtkX|
zOWZB4Q@hq=*>MDXb7Ry_tC^O<wUG0Z=s)0l04G`lqrXmC-8p6B2Yx(N3#QlgN64xy
zeOe$wvoBU39s3h`Cd4Awqg%#?tqsKxa#Q~_BCx(Yg?}2x|L`#z+qd+H)OS^piMK|p
zvb4JM;6H4ecy|uN%INi{A5#GV|HgufQhnG(`1~A^(b(7f`0Bl0%wL(ddxZB31hRfP
zx+jBdnnikOYCLCpIoZ)l^_Q9a9kOJO-LWhi{fKmq^v<VccfLNo7`+9-WyUh1Soa4H
zayq|m$FcJ_&T8ATxK6T4Km6H{;E-9v7wJVZZ2HwThJ38g|B;q6dNbkKv$Wa|wIPd(
zhYlWCI)rMNqDc@e6VZwLx0x%k`fm{v?dSU2^4pWi?DC8Sx_AGAyvMUGVn<o3l=#h+
z5CwbbhE~iTL3chBooH%?G~Z_F!*x_!1$B<4>H*jOZ9+j?R5_d{o}as8K`9mra>{hJ
zKe+Z=P5oR=jYfaAe@E{A_Xn7joOiqx(gkmdRXkK?Va+Q8pMzHEmu#UFcE#DN(Cb7?
zJK0!~QdZ|5y8dT$u@^}t?Qyxv5B~ifXV2rJ3ZK8!RZ(}|U==2<Z~G|A%=*3^`EuHh
zRIaRj<;V0kym9p$R#A^&*#oPKEU$SW7*OPTjWbuwr?<Qu(b`?43P~6U^ApZO3E_6p
zNIUKXlQ*U7SA|IkXDjB)G8bAErTGi0*iqc8B88r^u#vF~94-vq*Fkw7S9e|~$1>-<
z;2GY=<i%<wt?eta>@fXax-;2cOC7U%u2JSdmORCHO0kh=<NE+-|8+qQRXy-^<e?PR
zGJBkT`1GnI@!T)O_SfjG?M+Dz98R^N+?zdJ(d8KfYH}eWT^c2;KlbVL2KQ~gO(&JN
zFx!c=wsVaTphWc(KPMy9O$tV)1csc`IM<b^6ev;en1;Rp6HzK0SkX(u@ZMoA(-!!u
znjd9}g>4HH?rJh>Yj>%;(;#-q;LaZCXdZCgQDgl@%zv4b8p!0ObkmHjEimCab^E_l
z&ptG)J$1Vp(sOguL*Q`CGZLD2IH;Sr9h%xpy|2!(zR1aqYI^TB1j}S@()uA(LrOF}
ze|O>9+srZ9td4=-Ov+bx&{Vy#eVcDHH{#u|ErdF|szkHTfG8b)of{i#IMe5V{iwZu
zZs-l_IboTVoqPZHwsk=U^8-N+cbzh7s+n^sD+poqA#2oEKT6@-Mk(4e8rvnjW$V8R
z^G?R6x$S!-U_A0;)E_YvFSa%NF#Cs|^Kn%2IS0blBzcr&6s*%NQ^qFf-|c(X++|bG
zzaGb6_MU9rd$LH&aP^Z9xH^K@H||++0U5BO{m{W-gSOCnr01L?LYaK9?$+7|rH{B}
z;byA?R}W|I6pNr<U7mLFi=dIQ`4NTp84VZLWikxg;Km!Rf2&dAP+8Ty{o8s2|EuTi
zq?9-;|HKEQHT4SJAh5B3ha*I-x(RBlXVAsBuICO^s`^sGnRR3nMgYL*Zfd-x{O@OT
zR8+@rWH$#AZoF(7v_*V)eQ#Zm;jEwc5$!H#^>4SkuC4x9Ec*uc%~NGtdo=Q%|CKeH
zGiSY;eaDf_Ez^=xtl>R%GTfqg-2{->2fmZWPR)mz=+H0Bst(C`nPNZ1&99>G7O||Z
zbwJM;sIm=#(Uw+^T!{x@(8e5@u><e)4J7K!s^Q=v!&!G^cuzz}h(+f58Ycl(PX1N=
zR$7gT*NHu|ij}?G+r?j`oLxOqCDu9w&>_i!rzJY#K1NgYrHX|Z@k1+`?w7H_ZS(Ms
zQGP^IFsM~Y%4$H8yyT{5vLGoonHL<oeryzOa5N6Th^GaZ$T2!~RgMeJpS~)+bX~_+
zQ3LS7XuFjA7kPlQ^-Y|h*I~lf_g%I@SaWyUU;Ti64PXIQzBmkYD7L$@_e@N=qm*N>
ztMGsAJNOx}$FjcHQcTpc3AU=1(uMcG{|LiYuQ{x_^FWljFH6!gyNL_$ise*RUCsk8
zS-lP7xp(#!&TY4P*6m|X;2-vVfsZ`k{yHHqXLaXw62Nvizf0xmF<YeJ+9LN$HTs?G
zX4hIhhNe77DSP-Pjd61>CG+Ll{6zM3+YboY*uITvKLWRi)~ugv7tgwVy9C-yi79v6
z$gO@+_tpmYZQo>j>*4MBGxMuEf3f!;eym{c)CsHmb?eH|l(xYGFVx$1o~14K>AIpI
ztN-E03csZdJehCeTa(F?jXE+z2d*DClu@Tw?J@N~jx1x8ZdMUo{|||5Ow$Y8ny?QN
z^4C=_YY`ldSi9!PU(&$Y>SirkY_V7qGdQ=6MXDX9y6r5L-&NFC!RC|vKO)rx>$>hp
zi+AfH@r5vB1Gu(e@!+e{3)l5f;%@eTaBX1$*Vo@uxE9DIZ5Y?AefVUx-AE#<a#Vqi
zW<5?#CUgu0yR1vHN=a&?dLDiAi26MP_5V2AfPXkLFV`sr{9ljPH{Q8H2X4({Dz?9R
zJ!V!yK%!g;RD-qX@`^TY6Kgk&6wF2)xO@Wg2hOfKWOXI?75-u1u5_Pwz710AJ0IrX
zpd)KUi`M+csl9H*y_kROTP#Hm%j@ud4ed?!HtN9NM@n6_LYQl;IdHCZ19uqkQj1A|
ztpik=^hO={#HS!XiRJaZ#UA;m16PUl;r*uArLyM0xi+|Oo+ewugGh0V+Um~lT>Ga3
z_oz7e)S_VhyaBFkNYM+d|HeLu&u3rpf53s${-fyNF}9GsbunuWynCaH{?NpMpLWAn
zOn6n%1EAn)-GK*qvvuTKq^+;fv1TI<{5W8*Bs(oHcK0(rYdLWr9UcBH)U`EZU9g%Q
z+d{#plwPTPp=h~`?<4Z!bbZNAk-(`7)Va0<YZU`GdGdEQgv8+p>$bL9a$a8E;zGgw
zEx_|ng_l(np;m#&PZ9F`&2s6k%r0KH&w^kAti^ls2C1XKm=cGcm_7QenCJ4rZT0?s
zNsQ4laTX~CB^`aviAH1?+eRUC16-T-`2_iKGG>TVj;sNoy+EfoNx_~$DfaO}e<*PN
zk4F!Oe%y?%7INU|zuu?(G=Epu%DM`ufzJg`@v{bWvzTcr?y3w<;F9%Vy}XrFfhHp&
zcq(7bGteF*jOV)EV}s@9;VXYiYeZ8T(igu)SQ6lFVPuywtkyE0HCA&~^C*Xb=4nj!
zpXOl_pXmC7_#{A5g47w{<ZWi5+e1rXP!M%nPn&6hl)#%Br8=c}p#v&}X*b3we{F^P
z1V5fwPAy0p4ymRyCi+=j7hJLo%Bq)7n;-SHms<MP`j}Mq&B@byak%#(XN_BekLOrJ
zPI9_jqUY$-B<`SE2|K$XN>`UYjcQQ*pnURlAJ6<q^qMM}zvzXGc}_F+2s;xw-P-eA
zNcXb1dL1~X&H@C#s(6U8urY0!&DRre`e(_`hq+1fcG|3iIR{i`rgs(~mU7dUO6J4e
z@QB6mvGCUeSEVEW6mIA~NUZJZbN3mWT27i_Gv;FOlakL!z%q*wULDJ1mm}6)Uh&^t
zyVhiQ`v8#PQ}S5_X338WXYPuAK8|b&&?6s@kwtcT4SpG0xbg?8PLq~{rjQvW&-_@a
zk`Lf4ltbHWlnGbamzOg8QdN)jp>+iJrvQq4N<Vs@fr;|14w!H2!w37JsS{54==8Ic
zs~+O0*oZ~a&$uKo$EAItky4EJMRz1wWUrgpJTNgwZAw<{MJ6$F<T+?@>}CW6J7xeK
zCg_avW-R?AKV6<i`xuCm(&zX6&fV1F>frB(rercK+}{4wW5;OgqXZA8a6hwvzmfia
zi@Qvy8YCco7>Lm8D}3p3h-Ft=$LSL=Y)BTNb{{EO7+0k>)x?*5$;SvA<H~298|S)a
zbhjXoI@WuQjhWs%?itt0^4FW2iNQ1~Q0IvPs&HhV*Z7zI<&w|N15X8BcCc2n<lPo~
zXO%?vFF`X#(WhmeTv_7Gq+8U&5<NU7gr+o&c~q+jZ}>^C67punEq<8vdu7s+mJ8Au
zawphRz-(c~L0pv!INc!S{}Uj3t;$u#@nZi>u^`+=5^l;d%f)HHIyAGmfDVUWCIIe5
zWP3miW+!LOf^xQcUAasLFM6cs4dG*u8EUq=g0@s527BjsoCUxbh-;h2zf=^tcnu2@
zXc#mtWlEj>nZ=U<k4SueRT0-OC)TQ=!~yK@56w_sVOLAfFW;bjwQWWe1H22vB=<i@
z!Zm$9{4%k^RcVZEpMNb+DGoNGE4bQtIs7-;@O9KGuKJ+LL<@pB{9|Tn$;n|Dp{Qw1
zTvcN^X~-G+M^HUs=yR4k0(m+Ze{}gNW6`9x!kf-G-I86*S3u|QKPpd`_@&0`y^y(V
z7PgCb_h%uxngkD4{K!)ZAtf>RkWq-A)q=n)G>jhqYl>AmK&Me*c77YF^21_dIA#E=
z0|c)Hel&+&3kg>&HW=pKv%jg`Xr2nF?Zzl5Fewlh!n2K%X+B&iHn7x-i5W<|q&4eJ
z@7Zx*&LNCR>LAy^R1Vl%z1Qe_eqT7U*$beJ^?-OUi60{-)@>{Z(?a%ltG+moUZUs_
z(06TUdC~7>kt1Gn<|KmPXZIX;DRxJi1h_E$kQK{vrWJk^6Ry3wU2&w}q=MWS{%G(s
z5;Y)8T`(kpm{^H#Texq1Rv|mIzsnUuzUqe<;g1Lb15_bIK6F47HSk*BT*52<LyT`J
zU2ze*;-pau$oqL18o0&7w$+DhNqQgGuiU57^=<+}x8lV23NR+<2H&F&=4|1xBnUMV
z9z~Z3#JJxz^PUonDHNAOT|4bNH)Fsy%m}?7-k)FI|8yst*q{8{cq$3CHsKfx*S8(Y
ztkZBJE!xtjyS(A$WVz^l#{Ha1?;A9|wu=640y`;*BIj|O^xEXUnYYti_$cy3Fu#o|
z-0?D}u1P_&mJ{Af>%5lR`29)6&Y}`P6CV|MAg+x_#5+%wgiF^%Sdd48TT|x)qFWjr
zE~9T9W0n%t-d;<V2j<a?561}Y76%6M77U|h_lXIZ#3qQa@R|R1oT0VtFB?%|h2dof
zp?!F_cQxkER6$2b?=7z?))%3>XjtIWRE6M)b+)|S{#AoF`KO9H`<&yE&d&-z<Xl^L
zV@398?QTgVE?0IRE6a?^lmFZFfR4>q<cU7_@<O5dYrOOnRfKJ>3wGI(kVk$yN1^Bi
zR|DT@!iKJx(F@ih({7ZdAJJ^zhZ8xw<S3-={43>>C;#g=ve9VXM<dzGWM^up#BDn!
z*U-DspDb(gzrB+WXE!Cx^oU8ITwDpbp;9-bPzL;9%0+*xy`CM7Gc3`%ImWiEtN{xG
z+>0^=j!7q9%Cd(JkVB(Ozuyx<HR+U<3RQnHw>V0+F^}<;cbSYS;P)@r5@c_$zgF5}
zO|c(UyHa86klvGcXd%lu8XI}+Mdlc9UT&2zmRQY~v^2Al(}+I@;?<~c<Xko;t8Fs&
z+ZKh+h)a+?H=qDQD7P>r-~-UHFJ-k(2S18??jFwer*6gaAr{uEPxfM>9m0;6#ivb5
z=R>fX@N!ZTgDM#6E-KtdREU!i(lq~J$~q3;kD%5>xrO`Za03&+^-bhis?1;xJ2vFw
zE4DoJZNk-)^9ANxe0uRa2YS4cFzc>rxf(cwXI^hywU~fZtjOKz8DN0XDFu`2IWUzk
z>WP2GhdmR@nY;2={qUli*vZgHD$B{^+*rgm5FjJ{{bu8;!$Z}183;zJmxRzkta=T4
zTBuzplS+|6(<ZpM+<H*sKuSM4#HQ=I+0>20k;fa50-6$Ft*O$9B9oZ%>#irB_Ud64
zgkYJFC8+3{EObmg=5FZBAK_X{QJKHE0t~m?-}wC>|6Wk}&F{&cal<EGk{4jRMMv0s
zt=+;f0@vZ}$m1yZvH%8-9O~9MnNfE$UWm(}Uo&_3(?!-gzHK~l)%Z|#NYyo$@FtAO
zua5|fd8dNfmGG*@&KzmcmSd1(eu8Dx!t~ybCjfDhGhvKxQ<!BfTGnaGA7TPt)%T^=
zdjU|2XHcVZR}i+6ryJAKC+5-*_iY>3B5Ag_Ymk1>Z!mm+ez~$55>_dBnI9$F%{fzB
zV7IlID9v47zg|2-WoupTBf`~K9PHWbYl7si1NhI?Bsz834M~n;Jy&hvh_)d(t3Q?e
z5l-t_?nXz+-Bt+GcJcV((dzEv#h|*~;)|;elDtHMaCHcq<gFif(;Il~Nx&K_ChVx_
zxs<+h;RyQnt!3$ng=p-nQLoww(qOdjj}GzbJc@h)8zNE%(EKbnP$fR{saC0+VAskR
z7VRn)V1HJB%{zXQcq2)!pxn`cRnwzFPSKH{-`eF}d4I1WZBaHgm3TyCUy5hmd#98%
zuOw^UB(1sL%I^!GgHr}(e`1L(l<)IW!_(z$jYhWpEe*_|EN;iBwSAo6S4)Y5Du19{
zA_>oL#<M$`$FSd>u{vCMHKe3WrrRuA7NfJ=RouQXLAu#*8~=uSwqPJ*?>?I+;J@b0
zVPjO=F?3fvD_r6L<8zXsNQ(t%fLy}2S2REIlqw7ClglYnd3*lWRAygd9zDd<sGmQn
zmGqAI*rFFb=g^Ff4U(lGY@`W=wwDY)n|U5b&85<$)P7j{^wK`?w(4RQuT53w)=jCA
zq7cI*g&aMf=Go@#(U?gsd<H_%PN8L1*jg^rdGu+^b?i>mU3cF2wyAgR3v`kP*2KMy
zo}%a|Om>cIHMn({i7qr9^{WgQK5hdKvnC+IY-VDf&2k55H(y~@S2qaR5+HdultsMR
zXNm5z;6f%{NG+zmS{_**71z5xrBzU}?Eb-8|1Cv-@<erB_3=Jx_yPlp>#ob5*xN4b
zv>HrOLN6JNwm-S|b|KUXrIoAGYS!h`G6@JU-gUclt7c-re7*aJDe=gW4j6tq*g{PT
z<F0=kW!P)x;E*Dcmk*CAya<YSuXr;v;~LH$*t3LwR&6tdbN9Zt4<EVYv*hV%>}yiq
z_Xg{nnVT4Somfo1Z=zo_J41X+ZOI-BN%4F;B+P-U%J!j~Iph~gt4$rlQ+y{Sqbh^X
zw-|>{YLVg{b)tNH<XgSC@xQcRGp5@?W$YN!%GmaOzuTK^y})j!oGgKQKUrw$M#*fr
z5ii6697C@9HrU7b{6uz1N_qUSbF`6XT5%n{#R4be=td{qB<8A<^LjL&*d<@ewPJNw
z?%Y{Pa7|R_Rjqli>EWG16(+V!;-t$mdlcP`)uc}iH&5gSQd>NQL%ihB4xV(g?ssQY
zmT7Rs#8KU|2E}F1tSCQkj!u0)aX^Lt6h)04!{&OL$FuPxwfNM&=8#`EgonlA`l4DU
z1KI~0N4h6UCtJy*6PB=rcDfFI%-Ez?*|%gOGc)#e@f#~o`PP<uiay7JdtK7_F7+su
zCh5DSsbUk7$D65lx@M^q_YVu%QSZ^oN!?9+spibW{U^J4uV#M@e<twKUH=B^@FV|=
z7+r*Y3?ec!rG02&Xw1k*epI%RG59>P$gI4t8mpbqd@nI0U#eeLA;a28oP;X)xs>W~
zX?d2cg)Pcu?Jp)5Q)h_MLnNCaUFDwFKG<vuzYfx$(X069{H4@i0@Z9;bys`-HXgUH
zjxNfKGl>ug2`FCB;=ANg*Vdafi7$}IBq!&WeZV@0d!(g!z8;dSI0vNnJQ63-tBJo~
zG34D?25R+wE!9dFl;2pnx23oDMj;9&LPR8j!)^(uGAKnkE_@0BOaj$8JyVmgD|Pu%
zLI;Twhf=Bt&+S85j(^y8(2<`vSMRy1ZGbm*ML{(o1&zdNpFbPLX?^CSqO1fdFXDMJ
za{uk~7x=vP+RsY!rOt{I$4JZX`;4o-PS^fP@1G!A?yjOD1^S|{8fGjM&30rLkBv!B
z7fO#&%O~AK`=c^b9EKs8ddRm{-aual*LgTri8G|aBVmU8Ht*8&bV_DYcXnSYf!SsI
z(C_1F+5UP9`_xVcSH<>nQ?om%%|4Oc5*M6*9A(ku+op{KAzEYuc`#$V1LOBl>~D(H
z$j+NK+=z^>gdlg5<D}TjghQ_ST7_e<1(!1GedX5CqU)8UreKi#RWNJ(hGz!8jXUPU
zgh56JXH}Z>n(+M3aCUp)g2_7{F0zhF<=NM^_7vLacMsyKJ}QEkMKV3GRv=M_ds{Gh
zHl*TvJI0Fk?lk#v+bfe?sz_*IHGL@U2-!u)gLYw}{0L(hO_Otob1#zyt1*q_x=S-Q
ziU;NC!kwwV{<WfdRLS)5Rx0f5X-u_E4Z-{97s`CyV-4qb`-ZP9eOMSOh@-i;*hg5C
z#FB(yPOJg<vh)lG%H7>+CL|g{20rpR=$468l#ODw^<p{fzE#8|D)Hi~!u)kQWD*uK
z$S!WkUdJx#bm5RHHaypmOq!6SCJp6b$t2o*LQ7tZ^q3m!>j77N<+2vf-fUb*!OQwN
zXJT(et^zZ_M))OE#du4XCy)!j7oedlsIVxDZ5YN$c2ag8be?2oadjkk$WAS&v->9_
z1~cQfQi}J;hlq@qeW;@(ttZ}sIYHi|cO3WO5VPFT%TIHU0=oP#^4wTT-_SR`to_?^
zs+2UuNqKt4#Pd+C)DL9727ex!mx#-<^D*+FJj}T*VRn2qbC}={GR*M%(h+{l%;%P=
z&@l_QPhTb`)L!!sH?`|tciOshJG2pA_b|C#`+sGBG9%&#6x*zXTnrLEp$3{}b=q&w
ztFOeDv2f8$--|7yZ{(RA=~@&TowTyzC5PTfCYs1(dHe6Afxr1N2E)^>|2wnX(7%7u
zG<d5Nt_oOBa;63otYjkdJ82Ir2{qC|e{Jrs>85?E$vQd909SqVU627XU$7nf-^KDj
zuBd5-N3{es$A}^(jM~!Qr9rw?k(NcX)r*Y6XY;;cgdol_rg@?Y6lF5$9s8K9{(pRQ
zEuh98yt*4SpY!3WLQnEyDw86IL~1J;`HGZx@?Lf3UKcj`xs*d+!~I(*;8u(%q?080
zdzJ@VDxLk=<cqD|5?b=#wlleaGx-_WCra1AE9oh!@N@W?2;10c5j4GIX4DRG#)Q%*
zSHeIu0v0}Kow48;U_%I3cm@)@PBZxuv;7OLE?6}jgU>FFx89|~PJ;DQt}l791=@no
zV-QJ#+{8@GBXfy^Nx4#G!OS%BU%&rJZ2OI^sB(E#agqvug!Sy}A9e_j0vh3A|9g$&
z8E{S$T24E@zo$5%!h4MC*7Qv#sPeCgYp_qv<9`bsNFj#{!mxo~PVp={El-;46Fi_|
zPJ*HDyUg%Qu<O8{S+ESyM8d+gZt!OwWA-5?rlRckTq#~8Bu<_7c_Ji974u1~@~)x)
zDh<upi71QU)54o9Q{1ei-WSfu=fD~}o+NJ06n|Xa>cNiEM>vY3^dd7~3;v8MUuY=T
zdukC$s9c@_w;%Zi2BhetnA1a7Hfb`vXa8pRpB+N2=pioU)NWa=edUYRnJFbgcrE-4
zr<I=LP-6)9GxU_-w@F4`QfXYp@XR-<Y1Yjif#Av!48UQ;&I%9n>3#;GjP~;SY12B{
zc%g#`l8TNSNDv_h#+??VM)D#zxr;j0qbK$Qm=%Pf=dOE5pI|K4_tWu?H|`1^BBJ{X
zOUXs0U#;}Y!}vnB6P`aZjHzFYfN~=h4VyJvXZ97d1?l9_K^_TKqUz_TCty)lMG*|N
zeq_ZvHF&VzvlbJ1;=^u!gha{*X`}=$Lu|*5{hN`NpYQLlw-dZQZi=Jo#6e{vWw2i$
z4AauGPk0uPS6LF~s;+`yXDBc4o`Tbxgu%hNTq_Y3550W`{i?-$R}>Thl5895QBC7>
zXeVWz^$6UYCGzf=5hUdL-V`V03ie$&0aKZuSSeD(+RLT$?#y=KbjF6_szTWMOXb2c
zw6~)4ZwJ5@QW)>F^AerGYZS*fWja|xE81s<tFqDyp0VtJtiBXzUzAw#^b~?b9GX%P
z?V^WJkxPvx3)MR-a;ULWj2|flzRqLwlauBw{obwwxDX6GUN0xHZz>XDvP3m0jq2|y
z;KQ^4NL`F6yPdr`TQl9VYHJ{QuJyOih}YCOd>>J@YSu91@_;<ZM`hQCV+3qG_^3gh
z5iKSzao79Dokr`b!~{^22Qx7fillV@h*05#DCaPFI{3djCRDxrk=|Avj;29rW|?m$
zsA909(>Ay&eqUW*sW(N+e>o){Ecr@~eknUqAdK(b-u)I1Q{mS3s62&qOsp1SPq9M^
zC&uOqKVi~U%R~|4uN~C_<3nUz)er?jU+pmax?DN6zsBVgVG`S|(FX6oXsE**U>V7E
zIdFENl&dEj7+>UD+nMFQ|2+fs$#4e*@o8FcV*|T;;-uDg-`nMLWp1_%?N^Ta%70De
z5|?M%E4u54f&_=>Vs&fmvMai{AI|DwGU<c8KA9m7RprTPp@B#6LgnOSpGFKdyP~&h
zq)56rXmfGKE<bsUY<huMjI7!xg{)Yi?O0F2nT8p+FiQdicsAXwmw&D(8DvOv(~~n$
zwI<N#$}7~e^=<R1>zgv=$1A3MD#l&z&4M7V%0v9F6y`kI{)tNtyNKkBLp+ls`BxFX
zXqAAW?@|Y>YqNPZmip`4)8XXXNVx9_G`&3LG2@qQOvU`0sj{4sdUp+@#X+sFCOl&~
z%U8HrKq2}=cRBUn)r?7^b61_l(WFq>bP-!5p&w0X#79po1hDy9n}j(^jpTdE8HdyB
zB`uuhY1^o^z;}Qss3iY(hEP+sa6z*jQ9**VfSztKu<3TeCtM!ZffAWG{PSAmCQTq?
z>nT4#{Vx|I8}@W|d*4dYF#tVJ@e}N~Wk(g4Em{&3np*$@k3Fro=Otr288n@#)*<#3
zs&VI;AZCqZOdx8{!4+&T4adx0COjA8!Gn^_30D4mdo6KNmp<fqFBtnwSZj}Qx-ce9
z=$D|B=s5)+H}2gy2oAmc>K$7)=eOG0Ad`r96DK)F+UrFw)s>0(OeMU><$K&i#f7a%
zHLl$)k~=!tS88{=0U>-d>hj>zA1hF<*l0-*QCv)rFUX(8RejT48n5C<&)9IQw*35C
z=xTeq3IVme0L3kOcLus;Hxm^qRjinFytOz=u)eLXSPmBx#O*N_W}CW@X9I@r-pS8G
zjS#b7{n?<jm`Yob8dZz7^wK4`YG97D`<L7O4+@+4$@M)=SrV?kpburDqwZM>;iDfH
z#7fFfxB{7JTY##zUZer_beZ!2sAxn%2&@;Senf%`J1{a;$%fB->!8mhoxo%z(WxuJ
z^{gg5Sn%i7u%N-ttH%{>UHfcrpbUWSFBj4(M_H>+smh+MU_4Cf`_Lwngj-4usm*bA
zxXZ(=JN@4^<?ro~_bvCgB-nl#M>!Upjah_3iCL0R(p&GJ-bLik6A#&LhNlXAmi78J
z^!@fG1Et~9kiUInNtn3Vch$ThJQ2Db=mk3!-HIG~H_V8jsV-48kE7)IGP~&kow2iY
zLn^MMB&2%0=Kt$f&H?C)S^)d$ebk?OBOz!ps$$v5gPfQ2=BW^V)S1u#oF{ZSaW$F!
zrZUv||6@mneIU4;LjD$IwG?MifQM8b7g!l8Oq(^CII)Y^7+^WzeVgE}vAht3H%N-J
zd)Upz<h=j&it?M^N(AeItLh#pZM7s6(wi6h&d)KRy98VW3Yn+W*n=PaguD~Z4)R&J
z>|(lm!wL@SiIZ;I3aM?zb!^${%n98%vw;Lb!NhyfY^nA6FACV&K0*Aj#CU_V0=s)o
zg%0xK*F^M-_)|Y+5?3VX?FB;iH|=dFsC>6FZ?+X%5|WL1sCdQ)D?HvNVRHcTeg!~`
zqtr{wlJC(Ub|-nqvKwoKiF)1q!+}hKBrMJz)zS~*LtkX%wG<*YySUy8#NaesidCHw
z4YG7UK#&eAsGRBdrFNHgAWtN|d8zPpGpqP9xZ(pep}64;{@!!zQV4{HRFTu^YVYc&
z0t9=mW<fwuP*QTWiC#05-dKO5yO%TlWQ=S-qw1Fd;<SL+g-nZ{;0wz4oWGx?`+zt-
zIxjIt*L`yt06+bexPd<s<hnCL$79(|ILqq7?N_Y7>)Q98^L9m0E+DR=R2ZMGXX4dG
zywcl@?z-LK3!Pl4dfVoLGU3ZB(O)HKuGkNCDV>!VnTHO*GyXE+q{X!c1>2&pmV}cF
z*Qr_|Q}S*H^Y_@?;bAsZ^zT^n=jx6AI<CrwC)D2{a_CIJRpGuEx-4>cx%d1?x?GE*
zwb5I_-sH#tb&yuLcQA*Q-%Rp-a;LwwgI?pNa4kA+1wnJ*un^^;m^nnj*3SK#GQKTa
z@dsACa~iG+f66R#9wddkJ}{du`Bww}WV_<6cnuGu9rE7jhu<tAuw;2{#w7jtb`7dl
z+0bdzluHWlicfFOi~P#`1U0Z7gD$GhQO~fH)K|m*elSeplkJ{I_p4T}WCAMm<cmPK
zweUdc(B{-?PW#8Vfa(A!s#+~<A+CIn-HbVc=bN^(MAhib0yo8{T7!g7s_uUW-^^Jm
zA$G8Unk$qs*%?=z=lkrP)MozrZ+?lp>{$ciAUS|G#09TEUc_!rjFeNNTpR`3TS<OH
zv(*apo7b5&Q7}1&1kRJ~Y=ZmQ0>pb|+#P9miMwz9y*Ux`?`Ux1(0W_-vv??(Gk}x&
z>s7<%ws1it3sk4~J*l23zD!7<I=b>*+_6bTxc(#SGGVR*QpuMg(xa;h>5X0yUgT^I
zG4>t%d<iLduEoNHF&t9StGE5o|BeYB#|#qIdjbA$c{Qo{ftDtL6RcVWHRDyJQUIkA
zo70Mh-!H$K&J`q#(jV>_@RHl}(tL9wr3l{jb*I0y{W5J<z+a|Y+9Aa6vN=3$(({8F
z>#_!aj#@l4BP|b9${@P+_W!>~<$p+Gr(dxiMnJDHR>`o8zS4B;GkslUGdQ(nYr-M_
zs-K^;3d=<FKrh+(3ZEY&v+FhXH3?U)i*4>pMx3&4@7;y94hNI3o(tA{dS;<NttZ%$
zAa306B0&D%5Bz^@P1WxzZw7p~%3srdmITn%XOja<I^xj#O_eudb9tktTYf4c93r=2
z7=a?$Q3DM)pFKyWqdkX+P7;5Cg`APp4Ux@lGXchB$klHU#pS&`L(aTxH5P^$ST2qU
zw5TEEaP}|$LHzrs|Np%mCh)MTc1oN(q@PsR+lrG+a|%O8FMvQE>bx8sBh3G3UbOX0
zKd~wG-m-P?A$QOmXfAckUA$!a&RFoxL68|DxeFfAG2t(0gy5vzU~>-XXp^WP)WK@4
zx?NE?#(iLkka$%w!%=8bZUJ;6Nv734yTmLx@UQua2cHBujVm%^f8#B%c>D811IX%;
zdLU0Xnx6-ul`&WUt=`1$&6(w{w5vbH!FEsO?5;4;c@4Tl2c#aV4Wzp4u6|fg(C?M*
zRoUbsf8WkhNuYOGLJg8*&m`2uQKjdQ$1~JU_Hl9OjOLFiZccNyM+)wjU|0F#WOSUg
zR8PR!R7Xq2ERI*pl<&vXf>l0sKzI4}GV3Q}0=S=ew?kQ*SZM*2;2tPsvMGs?ijg%&
z6v~!YoYV6V`V5+mTmIhUXH5@m4KZ}5mtUPuhc9V5I&p~bM_%O}I<F~?l4pFwJ1OY)
z>IlM8=x1LA=Wi}i^FZm!4=5^f!IXs$_JQMxNNMkr2lWd3K}hQpI{opZpyJ%)4mI89
z$vF#cQu$L3oottp4v0#{l#a|pF4MZVQZ)=?(cOYP87$8Fq?-DWSi{z+&$79&6x7UF
z{G1z0>7eph7{mTF6@PV~qFh(8g@fb;iOS(N%~*Bb?%-_oIPUYchg9psv+Hi`Z`@>Y
z=!Nl*_bI-MF_lPx;K5#~8!-9$d2M!77v2VJfQOjqL!A|ap`_lQFY%d$WN3rl<fVQW
z@1>*czHDk8L7je}L%k*{<Rh*(B~dy?R{A~^#)Bv;NZ7A1Edx6MEGKhfvg7wnil4l7
zrG^4QE??wj-rXgkuX%Df+MR}ec@aa^OF<+G!8qtq&bS%wKieHT$2+6|bv6f|i?RN9
zs9=Vrzd}C&w>hN<0^IW*!Wl!Vg)MCY2cQe^W$`K1nBj2s_<7?Dl~>bdyPHD)<Ry2;
z;1+9F!s@cF&E=z&GPm=U(b^t{HkE`M8fdEVX7r$)p}MpDi{Uu+QlnQ_@A4TQHc5Y8
zl<z2qtCq3g7>2Oy_)AYda`xWMVMGwSJ2Y>xH<1Scx(YL@#w(Xt%WZ1<D%tN2EQQ{c
zYrJ+AOl3rfuqVm@pHVq_Fr@W6eYgfmy7znnQVI6J@OPW?7fJ%#S9(V+J7=RZ(I?oA
z1ymPlNRlN@CHrn&F3;|dpj^Tq^QV{YmkG^gQbaV#tuMmFQXF;KZm}-xW<2W$Ts2CL
z_4pP!^-7s|i`&G{U}VMy!CWu>jCWV5ONVa>Pw@M|wTQX+!T!Z)YhnDLWn^6R2r{Se
zXObV(V*A2GEK5R{Uv*D71NXy=^%K>4g?M5Aw%H)RiS3yamos%28X=yKhU!nxJDu^*
zX~mz0>OC4S8`8HraD#hlQg}>^z%h5-_}YwEd&AyD=TK*e1w$ctOOnelRqv^g7BrRi
zX}9^&Ak{&&0d4x>q~^XZ1J?VBEEyAn0%aGLzAXT$4xZM?5Y5w*=kB-Cn2CYrnMy^=
z&-jQ~uAyH14b!ai%gvT=Bfwp$6>oBT=d~WiUZsNwU(k3mcZ?<Y@cpTWeiuA5|4SwS
z{y_3P3p{5(Kvnd>OdC;iDX&>w!~_X)$9L`zuRuVwnTK^nO6<oX+{8QkU<s(_MS=xT
zd-X+fJI$Zy1LJ+s9NStNR9YsJ@{cS8h(UW%a<+Ie8Ex!lVq58MPqfvRIsQ|2Ch0hv
z?OTy_dCZC#&FTFZZ!vJw^nIC=AnR=*?tZ^EM!$J?S9VdtS%+kY^{K)22~BVgU=xZg
zj{CqUgpOEr_IFFdDHEDTMy`~wBcJr*ph7cs;p=;34hMp;HXQhWe&Um@xv9|0Mc2tB
zAucwc((*%R1l(5I75tWWRo!0>mFI0)##-^sz*5Mq_st8P*N2GL4jcUZ%33(UsF8GJ
zVULqH=Rr&<Nkg};tz<T+gOUxHoc|C<856mbz=KMffv)G?m%f|NGMaK(9XVXt!2huu
zNdXo@N%rDrkHPCh{fG2~Rw6SH19Kxm3>G1~I}w>5k)RhKv`s7A!GR-F`Nm9x`Z*o*
zqbHXK*teiw1u<}@>a1TESGDnu5$o%iVkBL(#5owF#**S(orini?V8~~8@ke`1b+E%
ztkSi<3k^$fA8A~}c^Pn>o%9e=Oj-GWQk;cpGiU#ZO3IYcjD>ZtCk6DVKRmxM&ST;@
z!)c_U23M@Jg>VL%a3XkRB;1>#s)u)ds3*N04+fkptaa?$x^p@?+u`)d3Cy+piftE$
zLquJX+e)OzmeMEViHb?5R#^m&Rx8D8Wjo*WMjQ;csXlbIFNs|8*4;S1-#oB8Iv?e;
zqCT_cN6SHB{XUI|W#G<3q31I9P$8B<GZb68xQs-dEoYqfA_a-?&ijO7SE3Q6)a~X?
zcV>3{$nqDNtF?e1P+{*F#Fxr)BcNtz?V%h!yJn-Ek;&IRkPhjFlr-s`zZ3RBcqkkC
zsbS|w+>!v}w_62##DGO5^4G`hQvnGRi9(>!w43<w=62#^L9-Pj>)uM*VahuBJ;CI|
z!mUObxhIOwyWm^57oQS6oS<i5Fg7Qa@flb3w20r`o?)Hn_#{~$RQXH|j{0P3XH0o7
zIRA*|(zy~i^_+nHD~I*RlsxfTX|VW;Ta(2o&0*cJg09m03ub*i1$Ru+9$4j1y@0FQ
z42UGWmN#CBYG*l4wzs?1#0z1m6H|4rZrMJi{mX$jeB@{1L2T5GxbXk5_vX=5w%`9a
z$DElmo=|j@d7k4)G?~g6LS#t7Atm#n44Fd8OcO<+fymIIL*^lgLdHUd%=7TQuKVa&
z@8|RRuHX8t-+#Zg-fOj<^_+9=`?~hE_iOL{+WWfhTbaV7`EhlHct`R3<`rk$ZbMi5
zF640?Jh3s_^nTjLs`VbWVxcLu;q8`m(`i@xcdd^*T4{<FwTET|O`#&QLs4@NUB=8d
z9JV!&*u>#8SCfL$-CNZwy`B6|p5gzZa`Mq>$c2l@@FSV-2g?MiXw&_<$4^AjJF}*N
z=er2=R6Oar75)r<-~(2es&R?SJ^9d0(W)zV{-l&_Y-A7(k3hAXKPSvEU;OG=nd%;$
z^+|aOJc)Os@a_0@eaMS*_eNOdR{H0D3U?1w*s8zeDZhLXr^-*0Rg&o_7TcZq8f%SQ
zN68_{^1w3se1y|xaZoygyME5bjYpRLBRv#g*%ksUA9DK2h?`%8hLvs*3HtPTk0YSy
z?S^=m8Qx^MFINp-arWMeoHErvAds@U*T?#FFd6<Ut!vvsj@lUFaOwB@x7BN<8q^CT
zH(x%_41u)@HlNDQ>XMWHR?+d-X>;EW863aj{d8X@RP{35aZj9;Chk7Jrel_aU5=lb
z`8VMSYG`4(V*-Ik%e)$jdgsn0PmLB!a*MU7qxrAfk$qsjZAJ@q;(QD1k5w7|bU0CH
zIQh1cgka}VleprevwK6p*!%Y;|MX|iGP5h$Xy`g8@<4P_AW{UNE4v$&5b4*yDPjPc
zTvT?yhBBTE^LEzBU{*j(|Km^7Wptzq140YlVUL>U(9%ZiX^~j|igdr_={CtXR?FH@
z-%ad2ReSz?ui~D{4RAbFc3!$lJ%u=Td+tJ$=<}n<J~f^PpB$+qA+0eznlzKOnGiH4
zvnZd2<Af_)G#3cG%x!b`sh3WR=X})0$#Kt=20ofQc_6wD-b3N|QkML^8ZX>bh8Mp*
ziIu@c@tipe8b1I-j}z|Ly9y?ha}-^H=mE0Gqkj7G1R0#NTT5=ZG+c0Tu8Mo{%6K1;
z6Cb<BALb}K>fusf_dxyn?#{IXncZipyI>iP$IufWIK>~gS~-BpD8jrs<HjMG<+mIo
z`KizeLuc!_<l^}Td06+p1dGj`TAHjQV~MBOaO+gRKGQpeBe>wkXJ{s0eiN(LsyH`t
zztz}W8+wGTBY6W+*68LzAij#Yhxs{Nv^Q~|z6xWuCvuk(vIvewaI&QmM`b1eEoq)i
z7%ZFn2x`6W_g*bEB#n$Lobex!FPk5(Ic@h5-iEckdiAPIT6a;Y=a<MMfzvWlx2uvN
zNylrE7~b5)oSAf)Qn@OT=aVdI$a9{AW)!5tdV%9gVi=nzPx&?KWU8*I!l$*VtsQ?Y
z9tTrj(+Bz;OEta?=I}U%pT6`$N%Bj8*}g3P;aBW#eWWwNgh;B-=BKwaOfBO6lvs7l
z5#L&ahqv*|bh;Q1v2NxxGMNoEFWH2+Ub9n&5bT)J5+xUy(-eZnUWq1ru;@tN1HvIb
zX^*a>A2-LJT*->hGU|O?$>%S3_CPDE9P;Q{tNU4{()C3I#4S8K{Yi|vbOtBz9?*je
zKXmnK8|vG)ynJLUOU~F97V*`NXZ^ZfHZUY%)?A#Mj&OisI7B^`hk0#!dc>?-*&-$}
zCO73<1*60xU&6GFb*HSt-JJ9SItDvTCU4TMIC={C{Mgw<pa&b#5giUps<#tg#K$js
z=f(I*L-4WmuzFOn?t%K3iUP+y&)-vnyE<F!N@ABqsV6stAJxI%ihS{&M_V=J?U!&%
zFL{w&@+Ajj6k^!h*wZ2fswap6iMUlzH=EpRQHL$eY%NrHi%x~t^FdMg;QX~`jd{l)
zn(6l@r}h+|?^9Zt>dmqlEVzoat$l@99?axz4K;%1VU_VD>+L)kR|u@YljF$drGTiu
zVl3>>bkBTGFzg#47<z-LUziU<F5JIjjoWw8jKvx^(gXLPO~qzmy5a?-KO@z+;=C0C
z2T_Tfend&Vlsb>+b*%~}@3J@NCscj^n%4;4`GfD;GiBwny^Qy2a-4fDS!&v=unYn!
zUV=_nb%5Aqn(qGo%je%<0r)lAlbFo7$1mX$n^2tzC3Xx?o0d!!p)SDNu;8;cYz-gR
ze9j1QePXCB!1VQ9H<AHAik%U_SUt}ae(hD)QvGzU`@RXs27>PU^hDhYbDDyx@%Jtt
zow-4`eqXU@7>H_1g_^7V+8VuFK6X#(9nm(Ld&aC?;5vj^?4BnJdfwOXpWHj?oMb`@
z)<;0Fz84I$0BEd#Idrx5hNb$IMIka{c-Vk(?<(9;>x!9RR*1U7C{}O~#xRhXzJfv}
z>Amzim)5s!F{1*>59Z6rOAB7IM%ZNOs>Txwrw;iS=N#F04~!DSnrx--U|x|Gn4EAw
z{^S(re9UDG6<7pzk_w}7=Y{eBSD$-8XCAnel0!rw#phv#0+eTlHd@E26;`y9bq1{$
zMEEB4wYzS?tG;6lRToA9lkffgumS-Z7rw!K>n+_O$(X{rq)E;<PL{BFi#Mewa#|-g
zWidqkJ~Zy08dKV(mp=<`Fi*j5(jKa+&ue8Vd$pl`-$u3I1#T)CjJ=;tY2Cl`VPhUr
zBsZI2W#+7uufjug8JrPKRAwK>?)1hx_pLSN3jjfA<<8lH$6ww1<1TCxs^VLo8p6RN
zvC$8SlnIwV7y5I*=|disP1@V6kH9+xHFxpRI+c04+OW)FxU(n!=F4d$cj$3OJQ>>j
zSl?RqQ>U}(r9WI(y98coz*wV=$Y~pRcA((8u>}P1F(8!4muYCBX^x09RAU1-ru{j}
z*1&0twvuwk(@3}J>b{<`_1P-AkHedLSKbxtH|jw*TG$JC4`5@e8nJyhw1*aN{_1<<
z9u%1A_f{N1;!|vywc>2mf_6`msp+YQh{&uc>5%~SqStQ%J0*E}JJj}o2l?@>v;g61
z>i!Eet;Xj_;r$};I!>J{Fe;C~CD^|4DPFHM>+7C4osULTWifd7PyJ@k(+=@m52&UB
zY_l`J8Am~2X5@wy&Y|q;MR)MEb2<Ui)Fn#R4=Rz&yfLCLP!M$3E2JpZ)#Oq;T@4<!
zeEIwqiA0Q04U34hD#o~Ds322%OeMsw`2OZzcmg?QUqln-r!GUL=t4Ecz|vQ@O{L%}
zfpkU&TeGrVXL<}A)B41$XRg(nASae%#ih6{pKqwKkF0TiTH*H#wMJ6uH0QIx<Os=1
zJArN3C+pe%{+t{x>BYHh71cBT7ro)ufyw=bDnws?C|pvK|EzkeA}*z1rpq`67!qrH
z7Ha3vm2x<L6?QYZ%2B5<4TMBFic2eLHjLoTc5}E1@^U>OB?ZIVYXuMN<CExg0|m~@
zlK&i)Z3VkkqN2(BVK@RVm`8C)mH)8Y`t64K-Woo5yF7mN?CEXou1o!r1La?vf5U{4
zM6WdPqJnNOw0#E4v%nL-*p@P!O_Sgl3E(N{)j9tqzoO)Nhf`EVyihj+9@s%hA^A%a
zy1_%{1onR9wGEY=$tw9<MWx(tI9K>+!C;i@0v_-+B%=wKkB^$GM&GZ&=sBsi)rGuH
zk3(1r9KX+#eNB8|s_rV*+IJsHXhuGkR#j5r3&T_u(8t*1<ttDhkFos>cSBp|9;`b*
zM7F}(8Q@;Zp(cvtQA(mymg7DBBT$LiXHkzkQof7!8U#k1D^SdPv4=$F_eDq+<wb%s
zxyTdB$$v6kk(UInA2!?{F|hXf_i29dFDX!H4q=bLH$Jab1lU4_qIw^TBca`lDlh9|
zvu<D4eN(t?Af_)Mu|LSR&*4pJN$Jt=yH&;MY^%bJ1A$hbx1X8$BIowjj~K29HZYp;
z&p1iJJ<KhZh>3|2Ev@aRrY}A@l&&AhMj9qX=J-$>{o0$tj-u96fme|u80#3r{S1-4
z)LQEtRKH;w`Ooa|2PIu^y;W^5#J$q5y#*0v>y7f(s8dv(`~Cf6Ce-6KJeNJUD~IBI
zo4jXZ>JOJj&;$qE;NGOPctGY!v@jVzmp;Sq+t8ebtj{*=L}v2UTJ%Wf6#+Idn!Aal
zabrp$b~9`r<coNAI#)HDK6W#FpW<xbW&fq)ybA}BJEVm1F6YcQ1vD@MX`R2WhCw~5
zU}oXbuKcVk!+oqPH(uoBL9hkV!`9XV^H+REUsf!&rxDpRQC;T`j-1H@tS%sPqX-Ez
z0xV-`n<o-*RnqiTr2vX#_{2Sc*gQ|~MqJ&**52Hz;nT%ouO?fs&8NQ?`XF}#?3&F7
zdA-0`j=AEup4W@hkaJA$<$}KLJHxg5@RBO8(Q`1Xp`>BZx3y~ek@DYJf2>LCR>Qw%
z-ZyusYp!JY8&nK-&;$RT|CGuA+U*x|s8h)bgw-K+J|uCR2lZBi177qE`=@<^PW>Tc
zB=Sy0`{D%3Jacc!QPyVE@})#LP&+pszM^8Yk9AU7y)$J`9xe0^F%MhAOXhtFgFnV1
z3~vAtnr&>0&R3)cWzS9$*LZs&38sDV(&Pidvv}WG#K&^?Da}@XbDaBq`Q5}4GO`Ww
z`1sn5OE`z5;*N3MAnh**^i0JOuF_OEzi;e0(!kDZa@av`amFvL=d&rkZ{CA!jGUk&
zN)F}Ita1fw{PyM}bw=Lo`O@-!_(9~G-#7W76wM;gSE-ZESJ^pkp11jP6H!k#<i8nr
zkYl6Z353KaL!SL(_t__Ivch}B3<U!3X6^LUHm}hWOD=<Nt{u;wIUPSHu`ka1iEkcE
z5rKQaM!o17O=!ad^ES?vMI)`32qIWfUEF5FR&OG<dXSR?i<SaaPxAar%J$RMZJC}$
z&SWUP1gx@ik1ujM(3r|aLfHN5hDZXkdsJkM|2@VhJ0_Vl03VBPx4{37JBt~M`}$R<
z8kykbI=#;anZ0}AI;7n36cj?>#KKr5b1!MX5)$2j24Y&Rya=+=!MCU`%_XIQ^y_KX
zNb20$7a{7iHWU!lYtsS-Y&Qm*1XWvWn|{US{NVV=%jZ8$B*2PUoWlrZP6Mm+_=Rv$
z9filZd$7Fxv@as19BeUNS1AGyn80qfb()pSWU1wXKfDKEljQ?ecMP0x4nD<@{zap=
zk|e|>RM&!@P*8^J8Eb?NP%Z=K{BzzM$_(Q}Pb!H$1{3_LhRci9ZU_{3s0|$LL0*q}
z?d%|dXcrhUQ0r(a3}dt5(QJ3HAG-4J$8Us~HL-KK#(uab%=XEbAz7@Da``xPr~nqY
z?K$b+8GhdsZZV7502i2VnT8=egOe+!6}&EmH>pjEtwd#DRs>cyj`YNR(F<NiR`096
z9Wqrxv=Bmoy{zR7jS}J4o38AQISg<`QjZCPpzuwy;kb{S72vj+xs0sT7K2ZH&?dk0
z_bdQ@h1Zdg71^2yZo&?7p}IiI))o2WQ<jVDXX2lu<g+eYXRKdh2EPLlxT%C(TWEhG
zgB8i)-(M<%q2)4Fksu<?OYBl(ytHHI_r}BUG%L&jw9-94J{>l6f-AJnR-q4MxF;4^
zxQxV<0Ctb63CpN_NpS6bVZ$w^tApoanm)b*TBN;Zj;%2b=QZmBlC|66;Y(<;E_}Xp
zN!(3W8@Likpr9s*=077r*Xsr@DLRZV6>F$sMu93^`zn&?iwSs}15AY)U#_quLFdEY
zrZsL;gqu~8mrf{v`idM?$$nS2uN-4`5lW|*omzzCF!S%N)1)2eFSN!%Mf_ReE}6d&
z&<PY72&gxWDm#N$@$^nDZ$$I~tzh3!<%LcMn)FO9pMyquYa*b2c$6RA8e1~seC5Ku
zG%yims;J>n5@q{!-?Ra0J6jJV;odJ6jj+<YP6w^Mw&DnVxHzBsH1bZ<em1c62FU(q
z->6Gszstp9z}pE2sYV})pX)9G&QXNLbD6hkP!b8{qXkqUy>eh8UlAlc<)^#<_;cj8
z3qn{>RMg-#E2gcA?>I|U(~w#?lkOyD=6q<r1XTTD!^)5+-}oOyxSJtfB5Js>HfAx+
z-cRbui=fm8jFC)*wWJ(Q_^?6Us~E+5^+>rV(n#{7%o|HvmACUdUHAmv-p+wv_&CWt
zz2Pq_w(0X!JSI0CeC>?Kw%D%ciytmIh}=a_sQ@+=7usZS<y5t%u;^zQFCxHQ+|9nd
zZ^mzwzRyFR9`V{6@oj3sE22%&i&zYsZer&M0`&*IuOezqz)nBV2ef3dl(a{a9FAS`
zANeG@U|5Xo6P-j=ojAjWZ~+jEe%o#Udi%R#<)R-H6g#Md3Va)c7H>n+j@2OCFNLqB
z5ozUrhqUGx_dN^L1RLlDa&MpAK_Y`V$20D0EA-18?{Xgj-DW>Wt*tpqiMgdoKYcF#
z)Cw*%7Yj%=d3?3wMaSXm3Qy0$%Wx=Z1^c2(T+1UYTxc;Vc2#*LiUu#K@EOCl+b32f
z4<_mIE!?Ww1Mo4Q{h76jD7Ch!8IK=gv4TBlE*9zX(`IQFl@Rdf0GCLb??pNlk^(8E
z3wkd?z}TR=S`rZr<SKieQ)Cad+QZrd-+E(!iS<?j9|5D`Kstv>UiB^TIb8T%ksZF&
z*ffwVPV$ARl~6h2ElhjR$#g+)e9A(*j1R$q%wGjBwA|q(%)qdW1MQ^!?zUYZLK5<T
zE6PH@8nc%N@3`yYT1L=Yh7EMPvjn=IKQc7jNT*-F0GhO>e989uhA(CXz##iF3Z5hg
zB+~!~U0z&vFy@03Ie)-<V>XkOUvCwkqd>k$#iqN%u)ZG6-cYM2`gk5jBdi~&Hr~CP
zz6aB?9w!&b4&ni^-_EC&<xj-qz!Gj8j};2~IhK1uq9V|SIq&5ixK=3|y#EVK>mm52
zIkdtRcKBV<N&Kp}-!{2G;8s=r);9&<6ts&**<cGgbav~WA#zB~{0RwKQC~`~!k-O5
zir)Ed6$AZH3=iLYvS!{=S9DjmLd>7kC3ud)sW-M6fNkcHCZnt=I4Fz2T{`2SyRYZ`
zaR$ppCdlF*fozK@xg!HuPPQMaYqWst7C(54SbzR=9!Pu$B2;-}ybZ*BSH=wh1nde(
zO*ablx?qITV~t4RTeu|tfZXkL(_tDg!@9Vk9!4E*0I!QbT1M8JkCi9AC+bDvk{X=R
zJRZ!ruew(pT<?o9)SHo!#kHZZ-f$&C_}^<fGII%o(~xT(Wd-puG0YUw*B4ljpZ2s*
zBU`<(d++M{3&jgVI}r8)EEw7Lff^UIFHd6JJSPvs_X)liBn^GzyQv;ncsprmT%yH^
z^YCLJxNF*7OCDO%2-c0o4)<VNWQzmL`DfV-Qjv5WFz4mPiu>SuQ8u93gFfZJSFvrB
zc?}o9`N#8Q&yWBn1cK{Hj5S+DKM*Ke7z9?o&+YJSXZU@f^<z!`{sN3Sgm~~noX|Wa
zR6_DW(CpX~T@Jx~35cTSw%-AO8GB=QX#L(iI<SaT($H?_CJ)ntkKduEZC!mv4MuRz
z18U4EiS~qs8vsLZ^l!TW4ukImbE?N=c7r)>wZZphl<x1q_2Vg6`Ld>F;!%3CF0crY
z!4SKi33&&Lzs2JKPX;^|^3Vz>Ado2b9dc-0=^W5O{P9dAV;TYD8{lz@P%<$fO2f;?
zu5jpB($M{vE#+ZvCy_L?p38m*_;CX|$_K_SnDX@Y0rh^le-`GmMN2T}hh7_4EO_vM
zIdeM}kR}IcZ_nKsoQ7&Y%Ki*<BPFHOi9Gu~n8`c=cma6t*s0m;u<FPJOPx8Tl@Gb3
zsQ}O@)i~^Sk)uw)nj)c|9atJ`dj}}$h|~;3Zz8mGnfE<dBlfeBhE~0rkAeCm4PAQb
z<zq4U@dLPP`Q1YvXwv6EjcMOy8es!H5MXTP#zsD*r}~1Rg(l}~4ePjlAf;KeR`kQT
z;spFiLY93+jLaAY(=%+(GTnvPCFy=ZuF%d7mU{HEa~G(+2z!7=3(5K=fC{jKC&3RV
z*lwc0$h5iu`)X8m{ZN$GKorco*w@g~s-&TB<X%PkVS1#Y6`y<GgZos|oIt(X3dS&Q
z$$<tI&d5@y49@8ehTd`uDu&$UGMF<<r|k+f^+E8xXvjNDXb#=%)IJBt;Y_OF-w->e
z04t5TG<>MKmk|i$3jkXx%=i+XxHZQEf%awhB1sPo+lVI*8UTco;g0}C<q}F^a@2#4
zH2U?d0vP(*3DVFrZ(pWDeeMp8DUN*&KW>4$dI!Q>;0QUua&9h7hvBZsx;U6~V7d?n
z5~Ub0XXp4$7&T0VfT^`-uS2zG(ita~g9`o)nc)R6lh~<j-zso0MaZWdLeBs!b>+!J
z6WA{kWdR<Hx>k;qyn+A-{HI3gz{mnp+5m5Rx!^{2b_29@pGqTaz|7E+hR!H4VTbx8
z4c+(T>sb!)@hu?CxQ$*zMyOt6phmr`+&{r43V1XM%vrwG1+!`{u%bWD(L(5Occ7_h
zf4Bj)x69&PJRhV)`f-ru!9^UR1Jp1f@&Tp0A`oai5-c@S?yU>70u>O*EZFS<6x8Dh
z_(3pI4S6L+4(uwUM%<ue=Yc4RmM6YJQTCIDF7GUHfz4+OY3Q^sDvj{tGK`Qxym_#P
zl?ocJrO(A5L)tL@4h$Xm?!$MWgh4qlr@`Z~V(|U{?}Ie~{Iwn4PbWP=iQ9Eu!~5lT
zk(eC$KyjVr*qA<^GgmK*aa=YRH;oK&J^i}qe9q3rX1C{N<!&b43OY02G@><^J~0?X
zS6f_O<Vw*l7jFr^c~rrI*UbCSy`-Z0-<Pl4jJg>tZP{+G(P#MV=-XZgjptcEesxCX
zS?=TJj_2m)Ry;UU`61!l*`y>^+(_R-fbdMEa1{ds{z+L>BN5LU+(bprLWaM?a`HE$
z<M5r}F*yM;lmH7YDmjv3!dZfy5=%zuf+ds1F=l(6W+8*u#?#tj_~=;q;RkY-diW!?
zR0Sgn+^DAmJ|y~um*B~0gM&3_g<38cW0rH>%h=$h&TObtmDRd^PkuZUhqDZ-gIW6j
zXcdsbSyJziIS%J6Gfbo4Bt@(QUG()GuO)b)6dkxwSTim_6I_{%p_F3prc}#C1ShbZ
zOf7$=i{>IPwSsdzqs2e@VT&oC_0gw*65$2FpGCeK`%4D7l^WhkrjkpEh|U!WW{hW<
zLq3q<8NiQDWFLFsjO~}e2gR}*&b+k2WVEZH*w2014t7E7_eIH}beIEozwkB_^?vXF
zj)Jqy2nMJ0Y^jg#0qX#<8YsxkrLA283Pj6G-b}o>qG84iFH8jD_^>VZa3Xp=2DGI|
z@UlRz`>#oWw*G69|9Z)Pz2v`v3xvx5=92&KxnvLihkEk`O>ZSmdWfas1HnJOP#+bh
zhPg|C1!UIaieB;H2LVHR6iybGUwQok{hwmFTZthcZ-akW29UI*rB?UBG=;Sl1IaLs
zijyC?-w~v+QtmCRDEx_FLTQn!@-Dy`H!b_vI@ROzvHDlb76yf1pBLxqOh4Xv2VRx@
z$;8!Jku>ZQ$czPiUahoHssjf=YJT$Lmj#lVEhvW_hcnjRnB`q1ccR!$$(mqdX1f|y
zC@L9h4M?8OEUZoiKg7V~`S^Wk9h5gXkyeNXRVRfWsEZ-at%PqC1k40I+fdaHIrbQi
zPDXiJTj0+}QHl{>KI<dJ{7PI%TE9c!QduzeXAtZkI&jM7e6=^EEm&pR(XQmt(D+nN
zE&Ij^idZDW3mBq-N@`!(8z9MgKmJL0w)bl<ukmD$Eht^P4<$86?{l(mtLl&O$QN>y
z#z#vd&MQ^XW^MM1CF_by4z$0We0miANQPPxxSQ^C+T}#Yhnqf6Gq*=y?B3I!lCwlR
z4M_%h5DV6RbK*<^C6wP^6UZ+?!E@bZy3nVmmXpI{KfJ@16aOU47E=<Xc!CBR_Z(1>
z)t+cHa!-wp?aejniBl<Ic8n4=)Jgg95^|Q42W^*zl13X=c@gUhC{ebj48BjNN37cj
zCKU-yWrvy|qm9O6KaZL$YHp1Ns+DT!2+y8{1I%*apS0RymP_B1$suwQbf*k#JP$#E
z424m?cPhnXUr}@Ls}(Q5QYj4g3Pr|}V<+dczU=s+T?83}iu_vLgUnGCh@$M9wAs=v
zlk66hP&E$)ZI>=`R(Z=@^Ti>$mAak6#fHE#l%;;7OX$=0D}}@?4%ZBe4H+A~&)Kn0
zj=-r0Sx}$!Uv8OjhuMi2C|&y|M?!D*F-jkwr^kwv_rVoWMv$qn+va*TAi}buoOQLa
zUOZ4DGW;g(?90TpSHp?$H!>6}>Sm?$d`4{mMaQ4quiGy7`1P3IlgT4U4n9PgU~rSD
z_c3v^KqzQOtAF6t7gr|4*#rg;qdteNW@kryb>3k<y7*EfHTCzj*Iw#Wgdz*ra^q$A
zt(5~e`(o~=H4TyAiPj>^z`gkBECEMXx<$q_V(8Ri48@|QB<H(M_vCSzF8p+umAu0F
zP)Nf=L~W-jUj)jZO5&_3gCEH#(=`Xp{icT=h1pGatMsq&I!W9QBYE_f5NsK9;TKQ3
z^u37Dv#V*dWf^DCsnl?#v4X*MN<Z*&{O~t5?d<083u?C`njjG;XNfov%qdPy{Q(XX
ze1&#Ae>f`j{b!NWzv<Y!rLrqYy6QS;xOn;aL=uNd-c|8k_w``KC-7N6+*1{mVUULS
zI0_(b5BAqycn`~Ap!@9oZ4M9}*ihEPE70bzt1swvB5RYQoPCr;eTW9B23%MN^H1f~
zroAD-Qde)^O`fwl!_49Z0o0qMwPOV&QEC+loJZ7Y;F1IkDao(p(7H?^Re-=<8ge-d
z^J#x-(&|rBp7!l|+KBN&C^{LQhm{azD!7`?1AoQ<1r%Zs10|M(Z;=eNdBV0Ym$f)z
zSVP3>00IGQ3a#$qY~%bqqeIDUdy-(Q;bbZ!Hd&t9P=fZol<mnmi<Hw4TtJV4gpU$9
zxz+uM2)27sJ{>v-h&za49@5?exMr+8nTo_Vf%e0cbzp_;#)uE;Tp)`<A_9xEI;yEj
zad!6fLU|+yVvsk$j;+`CGa}w!2ka<U73C}d1-unOIL=&ti<YaK0V)J92+Zh#@>m1^
z?<Q#Y*(`C&i<im*sY(P4520>m>D*(DZd@^0W*9>ZAH*^^v@d8qVYlKr7~CrN%FLM^
z4!w#806n4MxeqRLkQb#^`o}WP6NzlLoB*KL=YEdEpKSM$SEUj~D$r<T%>sCAW-hDc
zbnzs=@3>{qy`Cful5(*Eil`A_yp3#s7UW7Y%Ihpxr)(6W=wNZmb}q|$Po%yh!#|>(
zEjn{{w1*j9S))xRX;B)`mIP3w6iYa6qxZVPKXl}Q!2)Sy7p!ehXM_yfJN+BmjxH{D
z8du~O8A;`z4GY(wp(MW4ku#sXkXUNSiW>hX8ql%;z!3Du65u!la$t_0+wK|Hvb8QB
zghH9?kV&RG1S_i{AGBbc1uNxwkLDt+lmh=Em(>CD_0g$1H&ST~^ijrIzczb%W@Jti
z;sJp~a4WH6@CNb`FT;wpZ#<s33#EH_f)8`~J)BM~If7@<67lIspHb%l7GqID`OBXg
zq#T?_&_hl6IaB9e{Hj*em8_IU^8t)UYmOjd8-U1H+ZOmU5AmoY04jPDbl;Kjwhsi?
zt#;>HvBCwE#$sE;FRW5ab*rW>BmQ`bc2HZC?j#f9J>CLRt!9Z|I@DX~NTP6})>HHC
zr;E*Ei@SY)J=IQlex%CfM`7kK7i1!9$}shcbMBo=swDf-fQk989ee-~L55<~CX2c3
z{Ha|GE}9k%gIhY8l{&mKI+D!#tu*<_2*eKXp1KVewrFd;2}P2~5`rv2z$Xl$Pe?x~
z3@`bcSMY#s{K;Dn*!d{h;wt)*6t+B=@n6D))=KuRs3dS8YocJa73(DEKRgA82P)L!
zzkU(DS4p+hABw_toJ{h&0Hy+2ajU@Hh5S?LWqdq)kQKN4Q#N--SfDQlUb#&2{$M}a
z#pSu#JARcqQHZV&QMPkG@Qo@#yz&gK)P3CZcg~`4S+_!htGpA!FC3e=T7dLZ8Z`lE
zm6bgA!g-%j0Uvq7(W86>UP~E8Xzh&HS$!B@wR9r&)*cR836k#+L{M|#X6?NBhF%_s
z=Ge%uVd~w+9w7)|1Ci#m?Jps?GBT9C0D&UOKDhP-{EdwAAc&-zl<+2xz4(VVdc))L
z9j@>r8J=3O2)Ii$(a6YXgQxE_DH{lYT|uuili_mbiyte;+Ay||XoE8kaF0&kTgyO9
z*xSjL-d;RphL9um11v#3wYihS7SR4=lv4u1oGnZRXe0rPXa*Nzo>MyNlXw&&A(Yeb
z0Lr+!ki}IW33=oozEJi|Sjj*w7=r|8#M+)tiq;@F_)lJPd$x*%wO|4ha0F6l08d-E
z^MeIl`qbf!EC}%`xU&Dpe??Jb11gs}ZDN^F0w4MnUi>`^K!*AOa$QTg#Lp10h?-*p
z+kk7tWtB_6$RBed>5{a*|M&lG!~#=uANGuHXYEmxmoHxUJ)M?1Ohw)0Ve58z%P_xk
zIc|MjOsbID%R@maE&W|N;{_U58x5Y&63-xVnnA+MR>|}|-o?2NUQfm{Y9<2tV%>d~
zN7AF5^YrLo3g>9?m=0VAw<m)#_zmB0<t*FpIklhi`n415_Fr3iLa4w+>RyCC_djl|
zw_I4T?(N?!X5?odt);i61zs&zv7fh*|5kGA4Fl!mD}$F?Zj;x>4ogZsOQk@3EG05u
zU2-gRa+q*kd#bc&3bV|1?rM8DmpNGnV{hL?G4oDTP{8&8LjEfVWIzH#C65=C%SH1x
zS6+FY*|{W?Y7}zrk)pH6%3cpLrYR4y$|IU4>&*DNyEgTb;G1metwzHcn{fu^Ff;|t
zAeo9$!D|MM@4<@M-g#bWU!CRMxd(pVu(l<m84PAdpKNmXp$Lo8rrX)y&RgNU>iK)#
z@krc|c4(0IT-&}%Zr$(G#o;@nodau`A|C@62MTRAh)y5g)Y3BylA&pDQ|v5z4Qwod
z^5l;J-^6y@M(ee0eMR=<3Jl-DCoVA^+!wd`cbW`*gSHmqZsN&-<}^L9%6~M17IKgN
z)aZ8?<^P@Uy}qQwTztH4I5N=#OM`W<KcG3vG6VL8nw!WMbBw8u+qZMcK~r$iv?rgF
z*P+pJvfFI*EBrWCDj7zx?Maq#<bu;M%~W^#&!4;&xnDCsqkjejEl+1!Gy5;A3ffr6
zMhC@ysHRY#s%4yOpYn<DGWifRAH}(yTS49!>dRQrWk`mRIB385qfpVPGC;&Pn3Hkf
z?BOcG0`>x7<-rinml`-p$${DG<##*gI@H{}RX67NeI<A1-&N*YT9RxepgjBesc5D9
z1^<^TDLb2=!!YM^?muuJSG;*~wo%%AyfBAN@3gm@>Q`$&?b7Y_#w3BV+a;dv0FBrL
zipFq*qaQjtD}5#tGyK}q(R(^~SQo=KOlFP%9oJU_CD^EWZr`pO9W<T)5%!^M;5Nk&
zjx46(xkxC#mQy?TjQtRD-8Dx;?4F9wF-AiZxd8ho4A<tVosUj&e(=p-sY`ROX+Wos
z1}au;Tv+ehQGcL_os`Q`-PpSE)->_#(bw2@Mz;s*l^wpE)^a-|;pkKRAMu-L=RD4<
zk~hKPiz@ocHAAUPhWw}J9jIv;Sb$`~6m(3^gV}WZ0xH?53;QTC)nBr@c?o}Y?`F>!
z2wF4iE={Qqk|j5_rJ|`B3g*zcW>8T0?apG(A59KEy9PsnMGS7>SSzitQ+xNK_gSWF
zMeaK?s|q}!by6BA;HAlEtUYz@rFzxz=HyKg-#;G%`xHNt2Pp-&GMr5s+WFpvP8nHr
z$(Y%U5%Jt(WJk>6dMG(@M#+$gW-(ZMlyUXa7@uzKM=H$Rz=g^V9!~4Go~tLVLIu&Y
z4=5Pt9!*Rp+^|+{@S7_Pn&mc$xaGf{5LfloeF&?JHvG2sb)xlb|LStu9ciB!p2Plw
zql!T`2DqA9&r;ghL0X#4U%`tyVZ)l09RX?@(v;M73ga;YuQX>K2MuA%&{%gnun<w6
z&}w=k7%SL4$YQwn-Y0^EP;L%q7WMfZo24}1R1R(xGIkix^7}z%FZ9){IcU8psI8L8
zf)e;FnyZ@p=(Rcbs?~wmw9T@~;?x>msl!M8eC?x&J{_fP*XGm{6+ZT=C}q#-U9f&T
zO_#TyeXi9g{DjG&*GvLR!sN8TxzC{6%~YTFZN6ImE?Q1OEuzB|%l@dk^M{sbjm!12
z@(<oF)8)oOm|qv}-2A@BW^y!GB;@V)E8QJwaw*>e3f<@SR~~Sjj6UDWxMTH`%=b<H
zkp`RgWY(z51)iDL6AOp1-oQW!pFgiCs)V-M_Tec!Y>zQz%LcrcnTk8<)r@}p)kWRM
zW!ipa>)X4b!CUCjs@Lx~P8U&6swfM%2Y+?Br?GTSz1A>YM77r*UEw?~y1oZky$AiQ
zBdWw{>fCMFH$4(Y>6AtK<iGm*$ZE)y2H9w~S3YdHTk>02Z8XmWlWXDpiFe;~d4lLD
zwQn}k>%nk(NliD#18Z~Tvr6%@!(+v>Np=g2f@({#Kcu*v80dkwodV_={+Kd;LoP?i
zO@1iwj)I2`GtKXxWIVFj(!LZKnogy0w<$cbg}_pttFZfd_42YPvbDW4W3JyDu9*G9
zPiW?BH9u2nE&fB``X`J0wF1v)=L@S1(TTio-1f<`(F<2NyUnFn91p6-uPYlCb6)ie
z5xHM+=$h|5i<jBfB>{m63Z+3ln(fi}nVn=y3yrs`wgkfpS-T!Tk6N|2HMZ490}~U+
zWtG~|Oz10xOT+BOTz6V1_xWn2D+udP(686f08i1ed8=*jKPcCYbqk|t86x9h@8-G|
z*5j)0`k8a_wj>(sl%Vov<Hjf>mlRu;#m0Q@hs_nP?`LG*Zm^xOqDdvA(ec9W17|-?
zV~O2Yu8-ZVk=PF5WYim~LV+;Lrfm3-Q{4W*=$G#{4PDJG)#GUtQYb+sGMZtuA<8}A
zwO3s9Ywob&e(p4nz*F6+UsGB&k52G?iW`U&1{V!t)tOGZtM_a#^FLO^$!ohuWcklg
z=nqoT%zKelN~?s{u_&&MP`@DTVHzDF<FS|1vAh;m+Q6weNU853ph44~Qrb!k8u*Gf
zT0A84LHt^-$)S0T?FU)5tA{&gH7kC_nH8Z#A1KcfoIZ4RD$cb^T+5YZsGSo+xBr>2
zPq+8!Xt#LF0hVzL-M*TGlC<!hzfX9+cW1?ByG#Coc3O#7CmoP+Kibgb1|!#S=<R0~
zqi(nD0vs+HYET&LZ(QZL+#;;Hvf0}f@Tc2*k$p@^g8;CnLi0p%XV@ld=Z20uHNUN<
zdpqxN-;z@9mPaWafYhT`y!Jd8A9}r6g#%%iDJ(u;0(rQ6A#|JpI0v}j7EdwWT+m7k
zJcWSC$zr-VXmch`VdxQ+gu+^2bcwWeFh!!*pqJB!9sS8K-;G2b9nyMrKEFeYx0jib
z`kiUwT9J_T+lDor=8ywu+6NRo1IB~elhbJy)>WFAccY!*p0XddbxQYRXFFB^3E2CS
zVASTmxOhB+TP&G8bbi_`DZb}R%+7}#jnaeumqH%zQGaDB_qB(4=2k2DL`yhFw|e52
zv~h9{qprrF_{a+feA#_<J+{VC=%SD0i#q3k(QK{{(_2-`UjqwsR0?gq#Yb<Y;Y&sX
z2uOys3j4tFas#`qKY6Ozy?FD&jqR!4qZQ=WOHW3JilS%JC<flIri!qC@PtjB_=i1v
zgTKkLPX=nd<*#riRu13{c0Pab_P~zt_FBK~&+WfK!_d^f#Upoe5Y$3G^LK@rL4pgW
zpi;^v|Cr^!t~$`0a!Xl2b}sv&(i35pcQo{;Ub3pouuooYQMq;B%QKV)M88RNd+<<|
zY{my8^%(1My~S)HUoF>izTUU|Oo}lS<1rk5T%B?;58j4b(a~%U0vs|>jWbA3pU~}$
zTeR;4S%xd)Tffc^GT9p(CgEzG%7+(v`#!H9s30eLblN2^6Hb{a3AhtZ>};*e|1>(9
z&bmT-c#PUSgG<taJT6kyKR094QOS^>Mr8KURgLLP(<ClgT)=*VcKlJaM-~MJ|LH@c
zkge?8v+A0UV7qoq?PiqvEs7-%f>;Ds<%Hk&qZKZz<BW+$YLsv-hk(obvdHz17Rv_J
zCD*a7lzw_K#>d`QU3nT<BfgA2L-Pa@wg_y%eJ+4hAlVDD3g(A&c}xAKLV2ktm#p*(
z-sA_3r^M<ncADsvQqX37(@b=1aqQ-22^cZ4y<L~%yD|HSbxgfhxf_+0M!@f>aQ;Sr
zfK7>-f$|tT3a>!W;#9U}^YJXoCf5qKIm#~{G5+3r%Qq#r|GbZI)rDyH?+or~MEq(<
zglC>K`(wp%y+ohWmi1{Kga9CZucKX^+>BR>|8f2r{4c;>0017#wu}fXhpOW#X1vHU
zxaHV+1z(-djr{sb|GHb9?v(mK!}-Mn=x1>hb-FLC@=pJ0e3_#%XYF8jw4Jq)*;;P+
zRh18=U(remMM<S|`LBZ2Y|W4o`{M*%*NG$MS*Mzc<L?a-6llT@%{mi`EX8GRk!$VP
z9*}vzbcNBRqMcX79r&f;T?$7{q3NNdTR$kJPTl_D!CzOY1fW);6#OGwx}>xg*I<co
z>Qvt2PW4oyC=lRWaby`2mZ5hl$m=+5^Vs+|zI^}FxcSv$s_)oCX}b<nF;A<~pQ=E~
zs}#Z?);8vT6LZLP-&()9kWnfr?YB;2{Wj!EVAUtO?r;tQzCqdcTU5!GJZ3Jpe?-SF
zAcKw~tU)y%OQxm7f}znxnMugo*t7AA9bVC)r`l%bc~o8V1$4(8Lqyy#KRS4ti42FO
z5<qe!E#!>*y`YY?R?S6B^M>@y$B7$ChI}-rZr(aMsy{{%)$?{NV%49Wm?#UR=RtlO
zXYe`*7H2*Ry0`D1U-hGSRGfNy<}GkyStBaFlt>N#`5OK~#=)x2u?_tK#=zduU}^Su
z`rd9v`X+($U6D(A34V^lEP3oB+HV@<WA!9LDK2^uUUP~o*!HY_ziE$&<>=KYUM^?g
zs=)}*MQn#t)GD(W49>a4*BPQ?Q+zD1Bskh}zgVj2GfB563ini#D+w?WIgdyGIC&-d
z$1Qt|j(a`bC?!<6r+{mvroF3Ylzn13EIcgjFU=lvs;3wwM}9@n)AS{$OzUOGGm*Le
zPi<S7d2CH&;fldNZ@J^pyn$=Y<o1}aq1+%!XfnPG73~%o3v<RO+^&0~>eCSslr@rd
zC3L{VlaRxCb+mJaO_7>`rRsEz7ve6usP5y@(l;hB-;&E~xTRbrBQBX#bE<=mxiO~1
z{AP7->99pRosv{N`5S?Rr-~1cR)qXu@Vr$@&JKiY9K`nceoW3`V8StYvI1zGhte-M
z6Qdm>;$LtL1(cH0U`EJP-dw@NR*+ky-TC^Q<9%m<<FHXiFF4d4JII(E?M@V3t;TyO
z+cpz@rA81``5Fq&u-<)meMPgT|I5@*NuLh$l`%_2pqrw4@-*wWhw)cJ8r2x>GO_ov
zC+N7Fi9<ieJrd6he1wQ&EA_nWpWW_+`LXr;W<bWnLXFCRygLmc^`q$rC8}9K@|0sr
zriy>^<G6vZ<c$^4of#A1Ws@t{E{yB(X!yicz_JA{!@WKEwGR<je+r=J2~NN@=Au|)
z9o-K>Gw4|u5Q_TO2p42u{bIZ!;?VjGix+Wj+zd-e?h%z;R^ssA6GL)r7vR`)jl_9c
z;#U{7W$OBs_TF&L7&MCo)1dE=zX`f%T)Q_vFTnxhmNC`W+!=niQslK4U+FJinqj&=
zhP~7x>@=4!3Kof*Jc$`JX3un8=Ng0t?4l+$B?qw@G{f`<$6MxSLKDXIGz=nmXM+Jx
zJ;!wGB`G2iJD%W(+a9z`PrQKmNKBg86mTO@0UewI44q4Mu0#>*%U-DaqA^9LB4Bm&
zwgy30w?dD{eTq5!*e`5W%BnH=TVQ4jF$n>+b;eu{jSI)@1)Bj&uitlIY)`@dZG%Sg
zDC@UJWnVqFz>r62+&+m4CnT~ZZw(pNqowGq%DyC*U-z6M|9L^L=XlpaEiNgsKPlzI
ziN-ZlveGvXj;d7`f83E#x@*O9R(^Bzqv$xJuMu^(616ft)2$YK(NfNUZgVnb%3Of+
z^NvThKUkS`sH5Gr9RFC>ceZ<IYJQQaBwodQReRLz#;>&2GLWVEDsY2_e|<S)FAu${
zb^U`y4fNqwd})d~v-7wnBUp!Hi_UiNxFrXLG;nOuR$)8VDFCbb;b3ja@7XElsIU|+
z8OQkel_6?0R~*G0WkD`elFf*tUB8<BOiiD*RSc)uAeFU;EfQLNSv*d-Hxu_V7rMr|
z`}jEARV1<{19(VD(A0bdr+r4|Z?`4d!-^-I;^Gws$6;J)jZ=d-q%cE3ayN`ZCP-v%
z8Nd4gaJWR-?58N)2SHRHcC`CxoD!+$VE4w6JuihzlILcK8pP#Ih?kGL3}>4JMa)AE
zp}9t}GWbb4cfHne$8T!4IrCC_xbmfMFwTdWqo9A*{lt1|3O!dmU{-U&Jt7x364~~V
zTj?%Ttz)}xbloMd+e#>2(uF-dKp-8bh{w2*2+~!cU)ZaQ4#@x2(Ar{*Y5m3gib?^<
zKKc_x%E@X56HKh<Bw!6cEr1G2nwtdGPqe~9X)leKZ%0^Kq=}nGp4(UJ$ru-*o$z{a
zBLT0;WUf2t`0G>r)%BY4W;e%2zv1pvTgKM5>a6qK6SgP}xGZ{@jQ*ewQ%BlatD&7y
zxD3n?2s5E|x;6Wk53NA`-T~^2u9F>aJ{&t6G*1fxPa<Gyku4c|OUut^3I2Xd!F*Pc
zci7UW`uafXl6m*m^NII+uSKpOWEHHIqv@wSnKr_jvH&iUA{{WMOE-+jbjlty67yw!
zI%;BA=LG|pX&Q$BCU_j}PFgUXs%AwGVO40vFdniCBlQXan#b8q)?FR|kCbAURsKl1
z9}+laLP$is)?%37>qS2q4{}aetpgayg(-;$#}Y^*)O_WN0Zk1%!J`TUDyu<IkYk<f
zyqxG{amM0axSt-EFzT-YRUL;tl}=2B2%>2dDK0zOy$o&A)pZ!IY$PT}evD?GKe)w2
z(>OwsF2aKEY&DzM5JBJ{>HIWrH4;NB4%{bD0+r)-#d5TonY}sB2m~GRK=Mu9(4MSA
z@BX3{ij{&>{y5ek3r+A5*k0kreJS=86HJ}1?yIPfT8X;I6Y6KSms6lfBJ4L-+9YnQ
zH0fRy8Men@m{-$jN)=WwP(j;Ev72?^(?gGw)71P7uBCKy3`Bo(l#DP;QR-V2Q2e~&
zk*&s5Bw#nnQhA`DF-o+E@(f5X0Fu-(2Qbw3C|w};y-)Zed7TmNYhgYjl9>e30^3u1
z`p(zr_L-&lT>eR$6iKtDrHiKnE4rzC*AZjtFnqWh)JtQ%`82Wo8aM2(?P$msw_S4D
zDe>u;_Y7-`w*j7bxCR6)IX0hori=V2ZlIqEbWt*4Kd;dxC}6TrBd>u!Qvm_*3MIV6
zT6sYK^$4XaftpFTl_X&pChmX~r555uBnemRW0{M{d6lG;K~ew`-bpbxk+qD<u>AE5
zm<_1vBS0)G&F5xf<E!Mz=eo^XeWNR0wzOd$ws903mCnhL2fp)l5Kv-+*fl6jOLLrH
z?-UiQ2>XLJRXc9oA*>JDR+CtNz*lQCoO5SUIl%f50<4_V1vm*$UNmjot~)T`_^tao
z#};oU{e{(>zn{0`bp%*BGIPf<H6qF_W%Um|vQy9}W!dv(UU^=f)EyH@iWFpU{B{2;
zGu;FGY592x>OkOigIIDV^TkIOF~2bRDT?P8>9>aI{|z!?x#V1{H{qwsF2-{7`8?g`
z1<<ou6c;BMd9<Q8_(v9{1FVFBxCp>h);^Ur1bGmG06}|I_U0l4lD*>*TgL<8>seY8
zBbx!~j+h)7+>M<nnWV_b$D24x*kRN0B0S<`l$EAL>tSKBZkSHN!CsoOhP#wjDR9hT
zczE-mLNycUb$=x1I3A6Dq!`BT+Q1BO+ynVZXkE|X-cLeifPvX6v6R#~tA)05NfaHD
z1lYF?r5M+Boe{f;F|Fq0?gs{&`WA6Cmag#F2sSmP#~71&VO)RGdvmpn_wmNg^XCB=
z)s1(xQ5-xgW!CdY(a-Kf0}6T6TZyMs^Hyk$0JzWeBp*avaP)TjJgS?1?5amF6{}#>
zcno78PIsOI;57_UkG&7!emZPaGs3*a)0Qo(;8QEzU<TyoBI)N=iceLgiYzE`lw{bA
zQj!~q#+Wb=VGlArNdZ6t;PTR_x$kELjMWG;7?0!dYn8|mmRT^w6CA+~r6{Wr>-vWC
zI9%70TBbkM^h#2EH0CVQo)JG-R7Yx=eDItw&mq>Th~|_;a+}&;d5FzE(iGN%R5W#f
z!?CBSo=J{0nRV#at=J8x=6+WX%I@Dp$7R9$2>ehiJ%?e?GpSx%{!K2zUf9|!{*s?f
zVmwBpPdKjQfk(Cl2~uIrT?yP3)v9v;B!uM<;L#2A4}Ve>aJKdil2QOK@8)pws5n?3
z1A_Rv*<f*Ha$slxdP{q`Oid@(**o?Lg}||;NRU6`XlK&$L`HhfZuqviRWKmsAT;F2
zNCPxIAC{)NZc9V+S=qKD3gr3EPZOD}02#XXkvxj7uX$7Hb&EC2Lm8a1m7rraD<B}d
zU>Xf6@*>|d*y;U60@E+fPr~8V_#)+9EZwE3X(eCO*m6(%i=|BW!d4JWxZds$Mf1nr
zuEEOzf~2cf-k$Ll9HBPGFdgD6)%Vmu7kz@ksF}#p&4;Vza2+C;w*AXy1p<(4g1EA4
zF@wZU>|CHlQcseEh4<Slas^uo8q65Bhv)GegNhbfkM9JGECM81T$58)iR;rZJ2M{p
zPx~u8h>$IU8JY_QqdeUgG>R5ZDl{-)O0nBx`05U9pNIv&3ow(S_}B!Qx>h!<zwZ6Z
z-|U9-o&8_&gRZFG-@s%wRZC?aOocwY>-oA#{6@BWa$tlbWom}GB2H#oat_Gi5Z}L*
zVoqgq>Dm?X>uxEQ7Rn(hrT*KjosiTG0nY<@Iq8ZC>?>S)mI;2>5VG>|Ih5Wb!2G$}
zBim{hL@$0O>{F{|XIk|77uNgQxb0}wNWq>I542Z5s*mmmFq$XTTJ!U_+Tx9nD|Yit
z4y}7nxIfrZ!dm|$Uzdy%ry0`;7^GI_J@2%|2Z1|I!oXn8>}rddnR$@no2w%0I4nLa
zEFS2?Y)t^W3M7KYy1>o~n}E@6|H9VXYQ;g0Y6g&Ygm!HzR8~DON)H`)6hYU$hC{L1
zZXv)34ZD(I8tAq$1^@?0(Sc+@G<RP#j0VY((xo7(k&;Uuf%j<XtM-ih50_WxycBg-
zcEA>`?)7E&D9)G78(guq0n#A!oPw&0CnVY~D8fEEHsxRGFIiOf7c5?qC_t;`{BieV
zG2{hlo6IzMBm&0b)J5c03iW#S*ZYqBRPWaN5l+!XVqb@vi87@P<2nw*E~O`%LuFxe
z43Gs#6sLD%LNhVn7*qFFBmQ!h+V2~DPlFbg3Q068Iqnv0l4f)LJIB<PYU_sZ0?Bc^
zoFQ@{WS{|TJ22gYG?qH%NSXmU4owBtlD>;IaO7`OKM>SH*{*+W36w>&{5DrNH)vcB
zGv6dW1|bX5>?gupnxP_*EPa3k{BVE4kHubs%rsN~29|49I8lY`Bl*r>s^_z!@ngb%
zy;L7WOhsqijJ}b+QFWz3jop05J>0jWlp8lOq5`Td;;+_o!0S>^IoR2~ZRPseH`~Su
z17?!FG(x7X<y!W3rAV_II3HX*WL?Sx;=|$A-T3fENxGV8YLMXk?{IlyA;O#j_O5ks
zFvWzAw;V12d>B%qL=wrv3^8pa_yO2*)$YQ{aqo#$jhm1eo&tS9AQYS9FbLMoQ^Soz
z_5TssV_a}tmEcC$nMBx?-Oum)1*h>NpW6Dl`gaWUre(i<`yg)p_SB4J&w~wXL<*3m
zV<^@4_-`8ogRmh*2Tl2@ZtpkxgT@$49VSwG`L>3KZQ3rnBIxE1g7FnVAO-y>g|gaL
z4Htl2caz~L`8=Fmfuy>ylt_aY1F<Q|=5M*9V9TQw1XU2#%Qu`JJlCC4T`5zaSKZCW
zfKYiAU!r!OWs3QC+?qe;d=o!;dqF{oMAhr4KPX{t(nI2aKuKE7_KZHj4T1Wv0eLGx
z{t*RhV<2(68r>Hmk}~hl0;VWESHtnJ%qIEoSpW$Fei%Y4t&#YKzW;LNGu;Xm*>`UP
zPnH_eeNgI-Fe*YiNC=Us-gn)jV`uTh)qmSFQmYqNKR0AfyBk*7Q3GW<^D3}Qh-B!g
zE>1sN=H&yxwlN(()ERX6F)P6}G}D()f9X2d%W-o2Cuo7c*gCv-s`>}bKYW3|v_<~z
z<00%DB~lK2tr#`6NV7G>`){WsR=VTbmIxCnyNb$T+Q#Y6^Py=$9Se!wi*WYIMfrdW
zH2)AgpHIpSH#`K;e;p14_v<ahGomLfa#c?}-^;D<dY5M6ijtuOOg(_%0oFMP$~3Yh
z$Yc7FcyA2SWghTEXdW)&)^O^nCmz`<|JF|ah~O*cuO0-Ozr{oAR*cvB{i>@dgd610
zp`S309#a~W{A;}7-htH|_laImRKnWuDPS-1i69WTu-hepj&Jur)ZoIH{Isy*N6@+@
z@yuK9d_xoL>qOyy3lMoT%P#W@zRi2r+w?A=M=M4(lvp5KV4cS-*gD~~UMBGu!rr*J
zg@lzsEZ2Y1@vuhXMI!lHY+xA0GL%3eDbk7aeWx$L6p-!FmN})p)N%%?FbEK4?miI$
zdgq@1N^n+^CmL7>nPF=msg!x`zQ-l!@K1coA*Hv}#xviwTW?VW{sqc``&$tX>+ylE
zA_$DXNy*MdF7;Xh)5L-ESbEdo@=TEUvm17+0=_=yj0tqQdm$e|7xdE`&^cE}&6NhJ
zN#T*5(v6aQ>$pZ4X#V^Magv^!cJc3YEA189HPB@?$;<RN*_c*AF$asgoUN$K>-W^J
zvi(I3W-h+uF8@$)&|m$$+EZ0O4x7!eVyBdS6|^aw+mQ>A00N~+ig}r-35e7u!hWZe
zJzdhOxgBnnH-foI_F^d5hLm`9i&poEEedaa`ya$IvNxwzd>Wr9;YkXVF;SaOTShM^
z4eplc=H9}l6Qb*l+J8+aF@Ikn(S0ab^&ipl99ks`(6P;czvUcUxUY)SW6CK^t%ux>
zuZN)9*Doo%r0?z6OdPdXgj;lUB$`<osmS#<lGjEF*z0fq04Wc)XEXY=ZEEoAyFM1C
z^g@!Unr}*rRI}V7;0ofcm}q{F{N;9=U7SIP_akTqxi-GK1=f?%uN;oqpP^m5b>+BX
zI8LAm^1AEMZ~u1@95#1rC;kM8>B)f4fwE=xlxp}Eod<|+VX#=Z;i?-C%PBiMXLE)*
zja71*c?9TD<BZaYl8ywr^g*mNlIR$4Mq+LR#y+?kx*M&Dr>o4#g*`$jYX8Y9^@G=6
zd&wq6M&Y88DHXvi!|3|mG6t79t9p|H<{*-id_K2c3__v77Z?9s0kdm;w2RoOW>&fz
z2a|^KarcN6e`#dH^$zICg0^`?njMb94M1}q_Gn>LJYYIsyGIGnjy_!XH!K>Zlyc=p
zXnTYLUKIl<$?#Xu((?7Nzy475C1+BknbSYDuSks%D<4P*N`}EC7wn|WTq&IcH)f0d
zk7)4j^>EAx;pyF7GJqLX8vNb?O3J^*@3%N<De95Cf6Ihh%|QhjfJ;q*?I2P#`lB8=
zvjSSW|F8;}XJelt#Y)i5NS1m|T>dDjtP@d9@QPO&1f76?H3-5vIY*DJqnYlt?ba$p
zv$Z*@9KfQNL8S|lDzU~|ESSoifS>;>28-FxPy3QXj-Y$~sp%fOq(q5^3(C%YZj6VA
zLqxP^aN$ZQ$V%%V83$#s+ip0>hQfUs+M9KV1`yA?btHarIe38&5834Te~ZWN?oiA7
z34i8*7s>1N>T!hP#~{C|lL98!8-9CRhPnf=J&okElpQP8HGZa^F{Iq&btHAe>^A&`
zepPcZtv3B<&e!eR;9Xf153r;mMWybJhv|vOK`t2jch4!^M_{F++k@~=-RrbG%-~wh
z!Q{GxL~SksX24Z!6L-mDv|b?2b)FM2kN?paNWUuzHfod8A)_@)@!5qA$X+k>_^yDO
z>mjL0fg2wkUO!djL6G>jyI)rZ+r^S-+R(o^UX!xR49v-z97cHmms-`<Gp&Fj{1dXj
zevI&5PYEoD`YQ;mDx3d?pqZ}Pv#n<Wkr>|sJYM1670dsq<-q1g#0?PeUnG)HJUM0F
zs%M9%*#0-6oeDzVogBA^nBDa*#f>@YI$N|1Vj#?=8L#QlKm^iAzm);!sL@K`iq-;+
z_y21@fYE50Ls@V%9rpDfk&+4S-W8DEk|PDRmYU%v^H9hSmMhx!F<XQB<D{UCRw*kD
zWD`RdHT^4}yt=@|HZn+0Q}a)jQ;$y0&6*f{Pr|nMT<k)^0?e+vy?}@%DZ30rrHFKC
z;N;{5P^3M)ntS?JGy{097^6OU$Doyd#ebMoV*VxGF*CLp%uK)?zXB@t?rIXIy{{b}
z6N)F`J(O&v@o6diCrS_&%OuQKAFwD7OLtOfNld9!qOdHwO<`GyBsuE(P{3h(KsAR{
z<o1a+=(J5xoggATmXS7j@ccakX!^**l(s~u0}VPIM~lk;)v+wy8Qo?FfhY~?ND$vU
zr4*}Y2f68g1nS{iV1Iv*FpAK{gT7j7dVB`E)jvYhTrYj1?g?gupxv#)adJ1&_yb%u
zpudS!;s1xX?+j})f4W{p!GfS7(jqLyphyiu=<JGu1w^GPO%jSo4M-<MMS2sF5~_-V
z^rm!(NFdThq)H9FhR_0p^4=-#>i)0i>-&ALH5ukNbLN~glT*@#Syp$@a*3+g)4f2|
zdmcwg?+HV6uzS`r(EO_u)PQ~<;;2cKFWdkBfjNoDvZQ4=9XSH<Bu8)I!(b06)d%p+
z{gq4yC?U3)A^^9^E{))kMkIqK2F9<-jnE4Ln~?8;!#h`1Wn+Fv|M=2O;*H9Y^c!?^
zJ$BO3=7Q&GmNGg#u^J4$yA`J568y6g-0*pqJ8nQRG*Nh6I%tw&tHe1vpF}b;CDc)R
zKR{sq!vw?xmnPKRU1mb=V;Z0pZrIb$t*>4UPeToUPa}X=47Tn+Y>?POPb00#^Y(&~
zpZAey!w|NBETzf!El>+!dZ>BSY2o`#c3GI>ub|hZ*jg=hs0dqSyNfeB@(|PP6fLLq
z4*KG*-k{LVIy-#QGC&<;qqC<_-L>Ic9ZaiF+JCRo(F{Iq`;2+E^FruFAPWzg;>XlJ
zk)(eXWIRF}(@D_#*<dq6Y?A`30MJX()~T$ZrBkAbu{?-EN-7l=`hnQ2B3=*AxKjf3
z&x~d#_c_*wB4TmTUcIq86M}jF8KCF?x3Q+?Y*3ZsWqR8<hKN>m_;e&^<kJRKm*oWR
z{>AT;mh@xT{HLo)Y>pkI6E1Y+B73Ack0KOY1uV+bh3nku_e3Uvp7jUQ5vM;}HSI*$
z+5xd(O@Xpi)v>ep{kuwZ^3D(Zl`&uYZL*9cgS6c9R4Phx3W`q+x_?mL>AnvI07QhJ
zFQO2tN-Ft5SAdTI5H*xPq39dvHHRhWCdFe0p~cP8IT#+5NTG}XR8H-0*PNeXXw*d`
z4Vl2e`dykLY-}!;4Itc8?bpu0C!<ORf!wUd(0hOZi9V5F#p22wt2V*f@7X;r9pjB{
zt^<$S{92dR<My;duJrG3_nD&41jFTRYf<f^e^t|BhR+|`U_dRAl7D750W`JsWz6Z-
zKYSO3YgV(wdu?9x{R2gTtN)$U=rD;xWRzToT;@a`X3CnNsZd{(_MxFrNftOL0N^8j
zE0`&NvPO>ZaWj=rhC{mQvsf4Gy_Hat2edn2n$%&Mk`pdxVR;4&;dIT1Rd{H|cB_Jg
zR;0|W@N9FXz(P(0Y!Ue7_aL3N!vvoZAl<2i`1+F{#tib@EEhv*t&X3}X)!!7UA@`T
z<K4rHDRs|9T7Ni*ky@%-<#<c%{f%Jd{rd(54k!KWei@BphnWG7fCYd^DA+Q5zV{Cv
zfHIB#iBR|>z>$J9`R6CL%pM61bI7f46LSG-7H|(@C5V%OBB`n)eo3=86x^gi4BCsf
z1^z+KdRmW3`!uyz_(%1|d`YmOIzE|W1G`i!3VM6jLznrdPD-Q21=H|Bdvzz|Bolsq
z(zp)de)anYm_q2EG#OvWKq0r)|M{dh)p3V8pPZnONc0!+8#z$i-RK3SR0qn({2%-<
znUc4me5Uuw8Bp&e?N5AFR{c%iK(EXRfGB2wI+O`ljJheSi_sNPn&81^fZq;>4$sd_
zT=%xIHY}{C38KBM7uIJSw<;e}hX>6rpD~|tIl1Gf>0=-lOeH5i12aR&qES63tzhgv
zeKHimV-wZ=kpjAcC|!w4BVKan{)H0;9CYB%m9yl-Z8&97;LB*yG+TW7qavP#GL;A5
znn(K(Qvuv8%)f)ec%Hm;+mVKMH>w>~wwws_^WI)Osb%@@o1Ls{c@7TG$pPav>7>la
z1vpiA8xzEogBRIH{&JzCYM2Wws^*o1&(AJDCYWCiUX}qpVEIWCf%KY{`pVHw*w)bt
z<$g7f85SvTJBPyA0+ba1h!iPYUvWc|f+FRQKx00nps=yQAQMIRH|@84CgwQ~Egfb6
zu|(kh?pZ4ORTm_mVaThutExt@5jhrp-L>;k8*wfjH`4J}8PWnD=B4>RFkkpdA+^J|
zBN_mJdrOuI>C){~5K7LcfPWM5b96(fEGcdRqRNw^f8r06Bu7ge56({qz~;@GAmuUy
zIIGEf<iEtS*uOImRR=qy#PTFxqao9FL6OW{e_xIzz(@9C%`a6`)AYeT)91k(ijg~>
z7QC`xSh0*1enS?*u9I2jCT-v8q3h}mh#f^iL%OZXZGjO$NuY<^+mLt@)j6#9Gruzv
zT#_P{00Ih6YeG_N*$=@n!F3^ro&Vf91~@l?&rL0*Y%Xpv7Qox7OA`%PVs!oU$@pTV
zI*cpSJ@R9DhxZCPpQKxD_+yZisekD7zTY8o%P~`()z7*DvJImj><2C<ZJVUS&ZM31
zQB(XJB1VURzJ`U`^v?!VjjTzYDM1_{5CNZ@DmETpF|SwJ(Lx!t{(Onq_a^^`Z}nV!
z+#{PEq1_e;-oOHl6ESBoHAy9@De0mMHch7KAb>Y_IAde#-iS*Ky^&gKcp>sy!*!(#
znRSuup?sLQzrlW*as?l|ihs=-7ahG)l^VBAXF_76O47YxIh%7gxq~`)Yqn<sy$mvS
z!x(ja_-Mo^@Cy`8n;oulBT(9)wvh*|NmWGE#QAgxudN^6hzmv01t-lI9vy(Xb9zO?
zC3L|lKA2ptCi;X4NV73Yx6PR)0IUgwD5r!krs^>2w7y0>x3sx;|8dP)pX$6ci$*}E
zMLi5)<KK(O-j<Qk|E;+Ad6s1QtQVSiYGE66ldO1edOMD>k=86ke8*a$9Sp0lPSU#z
zQOdwYYv97CCzCV^JgEL5oT#CSEGKQ^c;^OPdrXwenTt*N%J+7sUA(ToP{}HZ{8VXN
zRY$jGWDUgc*Is(Yu=5Y|!|Xs|e9Ka$vBy0q%)m3+2w3Kt?&4Ha?e&-<>4|?9Tjv)B
z@Wt^d+QcsRbvs3PDUXzwtk_`<*4KlX_ZXndkiv{2EjpsG+vwhwo5xHja%0Lsvvt$=
zX@tlL9=5{1bgsa_YHQ7UOpUXDQjqw)2}(D2F5(#J;Q8=YQ*6|5>AWtjjJ~hR->Q%?
z^&IcekZ!HJn~wK`4xU;F%;XHuN+`BWmaq%wasXS2su{<zTZ5Ry{abz}-*0WeD7o&K
zJY%`r#dD`<B=NwYY9(McxdnSXCj=Pk9?CsNbFN%VV-$B(Sy@vVD-dD7z{RX9TC-u7
z*01$B3vB+xMYZi8HGb))CEmB~xZ3(sZ`q?vsKZ$pT%dcMQeW%B>e6;IuGim|K`q*r
zsTO>q1K;T&<um(!ouB5XYNy&#35}<cEIHd&cEw7E`n^Z-R~E~~23*(}+~7Z1o`(4b
z&W)#z)BpULc<%vCLn0Ssle`F0?lv9seL=nk^kIsP0T{IaUAhnOf0|PA5HU@%G**SP
zQKVJCukv1#`EQ)ygH_jsIPq10XN)o=n0apx)sVF6VUoP8@TKLW62B0g6(MFxjxd(Q
z@0UT)Q;`tnsZG?|$V48^&!^&_*$7|~zJY0FL2FcK;jiJ*$EkDx*6(19nh6#LLr&nr
z8z4e+9;@g<6^3DF;xU?(9hB(|KSGl;sSFXt%XDcRAj$s%$nsYrY|Rv5jS}1u3W`2K
z`BHjlxu%al<Vk;60ng@2S-r}*5b%xh^s$;LVc3OnXi`1Z#t`V9_g>0h#}I1TlJ9ry
zPt#rceFm6nsUDBMv^ieyg8C7f_(XU|Ir6R?!P;Y*aWT%5&`9m$>6)ep(Pc{OxJJvs
z7p&VRrV-~luY#cLsI^Anqv2`OKbE&ni>|=A=#}q3uw2~|witES5s)`OaZ})>*L}gP
z{TM(N_XANRI2Q@%ZZ#<W2^VOZ_KIL%y0uH*FE7<wle3sJ%vZau_ng`<ib@mT9j(sp
zmv8|4ZkyUd&28-Q)w?wZBCSTuf5pTOj0VV7u3?|m(T0Rz3Dg$<qZfy>zx~vHdVJbk
z5tu)i5`aogVW(LZu%kygBx3cW<Q#;$30b#t#yZ{Iwpfgt>t*P~VtP~fd0@Lq?rS^k
zEz#jS$t8euKPwRU5NfRhg`&$UQ2;*#Sfknj`@@UIEko~c`J>&}=|+F5^iuZa*yA3u
zam821LqnMgNmY}!Q#V(UH@ny^FE2{7*$(f2X3gi&g2ewuX2r*sa;;b<1h==<WW<%u
zI;FImg9FHx&Z$)OPYYdzH=LNroPMpP{CIP=v)Wd58%9{*P^}_+Wq2ED=VuSPUy<11
z-P`NFvG9OzA=~lUYqO>~jsg&0Gc^QO4Uy>E@zs<T5o_f5(Fz=^NX)BTyrdYP`sgWr
zZfJR*)VSB&^Ey~+@H}K?Qre7wj_VFtg`lzzg`4uki7$j%=P5=-gButZY>ZXYC^nzp
zY%KH#T0hYBDd~pkd9nPeM>E%LaF-;4VuUCu0clk)2Vy6tCPtBllE#mrqA3`iGmeJt
zaSP1Ds;LhTbw2|t)SKW}Dq~AG+3~iK!#_yAx`lFuj?0ENsO&SCn$O`r+_F_uu|dBf
z=|TL58}e80-APAp9CgP4+`&FA_h4!9(imz0!<&`X-z_xAiFOu*eS$FZq&eL+I-`SY
zxZi@*?Lx3o2vxlmv1cpF%hPG)VOR(VwOfeuYEM?hkiC}18wb?KC6tNSPXnfhHk`v9
zW-RDEvPD+T3JMi)DbW1vC1=Xov1hed?QaGEP6>sGZnVe!qS~FsKBYe?v-CfdC;pqY
z)^0Ngs<X3s%67beHhh%IH8g8h>BP{UJJzNeab$Odz(Auv$$vdB$~XUXJVzK89nE;2
zJ<M`fYcad=-4kRqu7A@gHGF+oN=QRH$J$4hAhih+xCQ;4pTuUi%GGN!W9*i*ui>ny
zu(wmll(8qaHT=s6Pd>yr*3;uV;?YfXoS>jI{QUs@>xkUF{ZJ}}8h@TNbWbmsb?8y&
zRp~-aY+XS+{Aw(hXRp+TSvm4(O8pWuy~HKM3gO2}L)+Ea1B7K*rlig^8-sGsUa`Hc
zD_+u_aW;&}*n#ICX7LJz-++p;GVvD6F1HG{V}=s9wza+TF@Kx=_!I|sSP`Kj>ZXrb
z*Oi7%>oo@er()IfK+3>C6*zzkfD0f#Qlw_}f+9(TIaRTvbmX|$Ek}p>-M!rQUGvq-
zlt1};-7{ds2T9aMUFfZ;rwmMZoaffeRk<}zI&@0@hP&BHOYpHxSf}RGr3oI!^eR7|
zF>GJKtH%_Pb-;aC&+8!mHW>e5Ps6@%;6A9<@Ec%g0kpvef{*D=b#d0gW@Wkgwa@jT
z<uLj7Lfx)-m7JQ?S|!!VpDvjfs-|}LEo;oL%t1VvKb5Emt`ueQ>DZ;4s`QQ+4&pA;
z+@giQh*6U%eVv;x{quL^ASYA3CZ|>lGmyrmZSgA^6n>G>3cu)!&UDX`Zl_qWXtgL_
z2>fd)>J3u((Tlx&y=zoRCBYB^fbwdunM)UI1qGKDFO;G^Y>SXb59lu^Y$!JDTN2gE
z`Ax>crnGJYbkl}qw3(KIEX}wJCVnHARBb(?)SiJu42bkhL-@tTh1yq_sf~kq^X-85
zT;u?1@0MVp2uq~jrk}7ji*m}YY8!FGu6*ZM3gBg;Croq)0(LYFn!4$w-Sxzt>sctT
zK?DB%G&AdsH=}36Z0MFysv(BX^_-i`+j1_-HRhW|==pCTt<8eNuvyo)mnBd)Zi?||
z1T<wR^&|tO%|@TqVV={5YNJ~|?s*6pfP!gilw9Npc^7SFR{l*|ePr5(VAy32KcWvr
zhlP0kGvrj_wKK($C0?rK!|TI6-W^iz%wIY-b=tn--^Kj&0`Pnc7kcr8pP}!OgUnHm
zU$6rNQ7kui$#}wEFeZ3Z-!yMyNuHKQDof=vJx&XOW_BL{U@jWL+@7z}8vhhwd7g?M
z;?t+Bd-~m%(i0)An9>2Sxn3!9|3oty7kz`cLmH4?molk)xn7~n_%m*!58;Nk60QdP
zyf_Px-i4cYGoC`bmK!XqI{vY!0^eMz95iNQk0M$dc)9yb2v@4ZvQE|!FQ&ZQF{QFA
zgFD5|0JcrE1w|$Sd>@Spz<>3-p`C<l#ZcH4;T64M?*+xu)`rIV9^hSDnR5lC&0-bx
zf?UHkcB5{~6#}Om@Tnat301S+5_46-aQ~q|V^s0M&%Y8e19mKxDe$HoO&_;)Wo5m~
z=jYhPp1!i-<i1Y#g7fsOxas`hQy%YKx{kfZhFB(i(QUyiR!F~Iq&jbOTs~wkyl|16
zTO%^@o_m?EuBYh6exd(NL)G8(BAjEuHkXGEiVlG1irE}HTBBRXk?N%W?{m6?j<14@
z`uyFwT(84nIxKS{TcFSsv(aU=T5P>DaB(P8`Cr|qhd4In5Vp9Nk-m<epC3LgagS~D
zT4Grsu(0n$wZQQDyfXGF8UB=Lc?bZ?_{l9V3(43`DC8u;PEgRfMKfowu^<U6--^v?
zXO0hMYMax(FDy0cs7mhsh1~}d>{$|kn98~i@alIl0(k<EjCu(1_bZgAHGwIY_Bwm4
zLVUM+?M`C7`{|pE4bz@*1qyFPvA2cSu%brs^_qf(Apca<eBmX;)|a$M7G-gybcN%m
z_bOp@D>}a2ciYAUY}4jSbX1<^LpFm+YyOKIm%?QztdVSsrVngq9Z&^30AujRl?X&E
zL!^@G10i0$n2iau-R{1*V>0>BwTe!vE)Lvo-n?EpA6W}%ME0~1uQ2zf%S;&q<4|ty
z^jz-Nkg7XuiP6g?Egw=CR+n`tN4PG$R!*TI;_q_S=o=i2;dKx;piq-)BDzZX7@$i|
zVZW334zKJcHz60;P@{|Par!Zap}c@4_E!XSWY;i}rxFYU7NWYZFd&Lr36C7-Opt3f
zn)MOkVhP8iDU@U90hX<A0l=8S_i$@xHd_01!d|Ur3uoN~=V4miF`jfB`{4@|LDq>k
z2oJ+VnbOn9P-aSGc(~htydbkvBwRp(7ugU<GXhRmG!J}hI?;k1(5Xn^GeyC(Nj1g!
z%(_DQdiXeTlg5@9iQW0@goylYp_RQn{NI&x!4p6`&(s`H=#-ZmHdX%165sWYrD1mT
z{N}!a(Z^&OjMsc@x0Y8ga=3Y$N4X<elB}*iiv485&KGXeYX{s5+Es|~)W&JomAB{Q
ztju0;mlipjvC!_lC|r7c>+7#?OjGnn(?K9uMkQrk*s&t2|K3JGHQ7!lhZ`|))y`Kt
z!Np|9NG~J}VF=5avPeZ7%N$!QB10${)ikN|1xN1CHsgH=jy+#?NQE^;Nq)8LN<^bd
zSaud5VNyj39rm8j3his}H<~5Y^5*u^u1hJzK+~xe=d&izqLa}-RRZH_6(tGQ&7|t2
zwNSI_7#pG3S`W_ktb3w$MBw%DZIzqjMo{Zp-7<Fc#45B^O0OQjDEAd0;VGVU@E?q=
z*xNEAt>HCCY9YJn%A;aw1)6n}@A4bJ!5$3&FYMiD(nTp-GcL>vFuXdhM3o?;>e-=T
zr2K0&mMXN9Hn@f6^z9orh>mEbjXBq<9(@#p^m2DD6)gN1E~`rwsrM>ilNRS3r#Um8
z3pZ7l#!_lc6qz9LGJ3IMF0TbXYrJY+jy#kyf&V%C=u9-c?6%P@?{O`58d_fwi#xj_
zjO+dMG5!j@>Kv(=PXI7(i*m6a(NW}R^YNs0g+0I4p|0FHG%`C2Yo)3ObrZvM3|Xz+
z{nv~RTonfBxzg4Uqb<K(rzjdMHW9j9Za?G;sc!#7-l)z@A9_FQ<opMM*k>Y$&<)-g
z2%cvA!Ra5~D3{wG19pEg)%9_$IwPb$%PmPs0_7Jh`1>>%=<ZU2n7N}3HWPbrnQez7
z_2V6Osoo}RB2V=qY1fuOVebgpsI3nBu#P(f*JvtuK1OPdo|*mVBJ9i+9NyU56@txN
z@LjVZxSS<Q-Ss(yp-vdU_QY$sfV417mMLg&`#rF*h4OtLRrdaG&+nd_sPd{qT<tUs
z0Bo@v=e^LA=J>e9_Ve0|3xJl}n?UgL9Y2Tf{=z>YBHEAw5!q5*>!*aKVs7_xKItrh
z9AQ=Tb>7oR$xt9lR&5MVD@D<lLsI^=G{qZopSf}WfV$ItIU0OctI2%;JMS<e6Z1^a
z#fjWz;zH0vSHECvYYkVCE?f`JI-06@V!=A%gr4Zl`E1g164ZY9iJMSF>t3KR`%)$g
z->+$faP`SiT(=a6tz84A3`H-Sr)FkX9+++^Hf?gGE&%h@@~g>HU)C)3!77U6l);h&
zS?!`2wAVM4sL3Nedn@na+*<1x&FshQWrvmisz<59Bd8H>ed~F)cLxe>fSllw2B@M0
zmr8<jzOz&SKKNrFiSr1svdB5SX|lGa?6Ew4YlT22lncAx{I+59QhswKQaP6Fp$D(s
z+y<qE{m7@`&6cvH(UqBUH5XeI09qM0uiw*mJ9xb;y6wy`;%{1(0=h+A*kL}{u7ufk
zD}dKp>a|Tc9au~^`XiYlh`{5m@6G(=mBgAPGR94t=$k$Q_D8^-^xDe`xLEYuNxs`u
za43jk0QzU6M0_mZ(;9pmI2EI!lh0gJ0oIZ4<$S95?t*77L}+G@7$<Vrc6h@(OE+o2
zAT=~GxYbij55AKNzdV_-|B1AdN`zD|(|y<(wqJu@xW}e<ulJ_(8n_i}(=c$AL08Y+
zMbOL8GHF0O{JNs!fSuwZ!Ny*6%k%`GARHJP2x_UTkVX3kny3wE+VyjpH}&)xweO8N
zeGF@-Rmbyw+O=okmjnx$>xTf^o-k`d9_6TRj;clU<K-l%0?|8XoI@H=o9}J_xPucN
zEi-hd%N*(3Yddfqx9a{sP!_^0*ve%t<m(tYi;X5e;KUj4@lkV`&Rz%e#o@QVORMrp
z?i0Si774)CEgqvx-1FMrv!V}di(yb;;Q5DM80^n$3q$wfx5eaN-<5x|`%2aB-<G>j
zhG1~Cn2kYPuvyoVKHzA-h7PdY4Nuvs*_i)Cj@l=}A978)Fs!v7L)ZyhsR)o-IHn`?
z8?g7qH5lxzrlGBRl&oOz$1*>@JoYB`4K%>aTCjtJot_~{(PHL$z)K|;YttWQTFw<s
zw~&lV!OIQ^7P@y)LS|q6y)E~nlY?g4*#>OhC<kSR&LejDuV-y7Nir1dW`xv1cr#2Q
zhcFY}MjE_=k>}+XHX2D5#=GCxv@e6LKblA+n;CH>=<OK7<Hmir&&2AVS|HGBMEW`R
zUPndT^e9n4&j;CW-F{V54~B=`^8VkB6Q>{X0niWcoOgb%hSignyxlcIN=BaTI*@dc
zE!&w`;LD@mx3SGC8@Q-AU$&jkWt^GKR|G6<eN<HMXP{p6s@O|S=(jE^Mj2H-a78>{
z2}t&v-gDX-rZ}E&{%OzjB8vrgtSX(mz*8G+zQc<~vW2EX1aR5M6GH-tq*d}O^BFJ4
zPgoyf-!y2ls{f(c*7>AoQ$}V+|4Pd9W<D2&F&>MK8v3nbFtDt;;X-y?OMO<wi*)TK
zVey3EkAF#QTk!JgdCE0kwj1IDyrYKPtt7F%05@g2Uw>@(a*xrQs9pm#;^hr+LpZ28
z(z}LQc_W%5$MRJ+$FB+&Nb&G=E&?N$`s5(M8Nc)%7L|4$Qt8_D3~MKrG(AcpZTRH*
zIFtw3(7O7VfMen}t1zstki!v<!~vFnaiJT4coJn~Vlm{jR%0*>9Ri%_>6T%UK0DQi
z$&~BJ^McF$6k!tA8o(QV7)KhWndiA1Vj2lf#50<reOyK1hlXU<Onuz$^Z#Y$XRDHt
z8`elfw(hO6uQjeusN{>BE#^GN$nv`fc77_{h?k8Z1mxzkaL4d+IS9_d;WBICxJ{tc
z&}3gjJ9LHsxzy~Do6ob`21oIt14DKBc)J&stnlyqi~TlZ$WM0%YUu*ybY!@uk|<{|
z^5QAmoH$?~?}U&n)j^~3B~uDMsiC(j12*O{LPv(KC-Xi^dW(eorTx%Cyx(oTxXvK4
zEP%egwK=g;xc0nSyURb+ICSzrX;13=tMk%5!qu{L1-5y_jYM?8XjsBXi>cu7qjBqe
z`d8%cMj4`1m$&ECaDPjfR6xGPD`gcG-q`5qp2aJ+0vNHcT%O93Qg+b*=b0<5tiC?!
z>pCFB`d9|EL|48KpFY^UHq;f`zK#yI{NuE2l)OiVLV<4&R`;Z|p5Mg)^WrXR3lUkA
zhWf+@|7on}TKR)v93i|vZ6}R%N3*5TZK>2OxIJ$7!>_6lnXA%Mv&u3tIC|3b4C-4`
z&9yX#Wl;3CeHyZH9R^;PuK9NH1&w|L*5@51IXK7ia~HZ6E4^x}Bu}v}3y;TB8dLo9
za>tc^%iij_yviKT5Z8e>_LT8tNUkd~kn45kov_&PQFB_pMF$G|q^qXh2g;<ji;IoF
z-N<!SgHQ16K>D`Amyr_sLR{I>jx@qbg7Aei$%>PAeQ3^+*-<+Mo~1w>fl9EdiYxt*
z3czgMUaD)ck#(F2=s`_%M<qnDX$EfZ@HQbhoF6ba%IXD1_dL|Bv&wGd(F?eU(nudk
zeuzVoO)I`yb9Z|_(#czyPbo%PKgy}uX~<drTq875@w?GsU0NmaKDZlp32lW}Y8XJY
z)JwGOt(bn>Hd-I{><6SsRoHV{oJ>ec;>iZ^V@6<@i?LZ4wz8)dT3--fCe6r7Y2k6s
z)wcFsr7<rp2V~Msxq>Zq#h=z2r1}&+a#_LgdAz!16!IYzIRF~_X}w*HFZ3qf6*;LB
z#c6*Ao_m}=n^5h+{}#TMBqc_Uj>_%crsLbdbP{Gync)nPk}W}?J+l;eN5&@k;(;8X
zh5yH$54t4k6h5vlcc0F{@)LMH^Ob!G4rlT2xtAu@bqhV-@*C;}xv$Hl>b-+kw+ve)
z`gln|SV{?irkDM#Fy%dz{2+U*)4&^f@bu#S-za*w!1l3mUcOc=WGe!Gns@DP3)a^e
zl_Yn5rI^-Dn#N-saUl)7s@rc|1q&ks@TF$kl4DY*83n0SQkY`}a3cHm*^wfVQ<%LJ
z?;||H%{f=?!dk6v_`@3hs>6%ZsC%vk*4?--e2F|Apf1PBA)cJqhAR%bLN}M5N;Q8)
zT%h#ef9-;}URl939?HfbcxIs)vu)2WSQz$+!Ud?U)Nb<GP0F&(c|5!kUGQ40HKL1d
zaeAjn+4@LRq};)LtE^P@%}yoSahgx=>(6Di4R0*8>#^3A`+BFlpH@n(C6J;6?wg-0
zCUm3Zib#Df!d?avCcQg9K!WzpIL@e6qM+dNWWz{}<}=A#i08je!T4&W`Dm~?IEBYX
z3AiOAOqvUU(`Y1D#Mj^z(~4W@s9r@i0J?F7E`-%n3CLh$!bsKMAOpRVz5rDnoV8yS
zAhG>jV%t#7xurKB`NBbM{VMLeKBMdPg?RV92A!Xd!DQ7us0zYNPzwv$nB^(>u42Dd
zWbQE}ebP)r2ZSMILKZ3QmJ3+kJaer53^3?68Cnf{oE_C^-}bTC6Zcub!Oxg=MP;`b
zBwg53zRgy6ow_3f>71obGSH~X4~+{0YJ2`YDC#ow;r9!VU;J&@_1JQnlKzkVBc=8y
z=4yUM3~2gGtf1^IH6wVUTK9lNg@`5YX-vhPkYA|EdO5IEdu-vT#NUy#F2A9|RK!>!
zdV``sZrvNo-<{F$hU|;XQb?NGix1uz-#uqiu!f?=u0(FK4iR2k+C-W9(%e6i#jVW%
z@*tG=<l5`K@&M;YP%7k0bH<-zjZod1Y3|q%Y<`}&Uej=)U!t8@tO8Iw{e_)F(KCkZ
z&)2v!-V~`My7~^~N5HkP3bZt|5s*mi1?Oh;N=`?(XriBeOgWXyZc=eP_u#Smhc1F!
zRsAZNwI1zPL2hlJ5a`^4OcFQM?N_gvlZ6KStN9oCOO;$l*9yaG5Q2ylk<a;<LcQsY
zEUSS7J`dDZ#x7Fup&~G7_hmMD{~;}91%s7u7HaZ!XlT)8>2!DBcMFvp^Ld#)@!o=I
zOJk(<>iom0Pu$Lm9M0}9P!ZHAl#eax@!hDeMY^Ow6Ov#jEsm>7+FS(xqw!K!1XLZd
zK9X#x*)L+s)w^A)%1K+__G+9+mEI8UDJfQARX=pE_9E+mpx)a~+B=@b-|uYCMqG;l
z<2TBUW!N;-VZ76JtA=S2Wk)IPK|zjVOJ48%#tm(ysJmi@>ZUtpsfnj9a7EEYg|<zA
zG-sIV-1Thz@^Iztf+gzL6cx;qP%%o3G6auI8=WmJ$=+wXF#T}VduaAkk6<U_!*E2o
zhcTR(5+z5Fce#JBqw3gp9!7%B9gF(?_|1#)GCw&#wU~c0Tq7m5<!Vky-H-m4gDBJ{
z-th=Jn6S~L%~|&fT~6PLWAC}62dvMDSm9-XV?i!TJxRG*_Zeib(AKNUt_FHkYPTG>
z%VN{8!oTJB$Z&Q#8JN50Bm`ke%*{I9tTbQ^=IteUt*&})OK&OnL#I5W7e*XU+DHGl
zw^*56WQ&BbTBAc+$p{xj%4|I)eSJ;1u{6>`oJDr4DqqDUF{(E{#6<d(WA%4l6O*um
z&y0^A3XcfikL08v?;2v?ySb<*&|HOrmP$(#0B<i%@p;=#Z(fW%mqt9N1L+FpI{J<%
zOSdbI9V9GF90lCKHn_|`jT@}f@Q@C*0LW5;0jjcrkYO+FWFcDfh~MBNURjVhRE|@X
zAP0nTQHtq5I+pX5uJTJ>e+oJkH7%8)FdM}e)NmIn@&NGtZpqW)avnEN+mxwNIz`F`
zmVMnZE#CoS6m=b=(W15P!Xg5=Hkexb#EQbJ0v7;;2*RETnFiX4xM3*Jv3qBbz<Eho
zuj@PC{A-Y|Ne`Z$D|xUvcfr6-6|UI=Vaq;=NLc~@s2$!x9^qZX|JHi);?hc-pB=Tr
zUu&&vxSaIyjHNiWmfF{Ue@~~!xawn$?>RD8yE>Riv0--bfu)!%Ia$-AQPRdPCF+5|
z$|rMS)ES<V!pzT_qJEAE=6zMr2*lk0Sg~2ReoUDCSOalx%<jZI&02yMs5)%JhxTfg
zWSUY|#{~Dfsg(1w$2Vr_R#^+B3m~p0Ns#Z+M;B4Q#4rco08{duobNs3J-mUVmc^1x
z037|SGlCDLJq1aXDAIGq_YA+{8;f5i|H(%whpp;*BY;&1@|{=Jcd=o57xnOAYGd23
zJ@L&6K0o3<@csStvmu8;Z`RrL%=T=Vt0BuxUoWgU4t!6vI&?asAL;<^9)=tgCUtpV
z8?d|_ff9!Z2(O1TH;F!Ey&s1Ke#lnd1j-AP0ysQ`dZGdvT5MUb$<~6s2a*T4j3J62
zZMDdrw++IM8#XZd4(0-MeRAVY5$wUh811A6SDa!E%5?bUos3{P-$gJ_h^4@3{YEBL
z<P=j6wB|H5tWwgxEie7i_P~f*eK*~#n$n~ql=;?18l%-B<+GX)cY6^@TONwy>;DiL
zhi6yf#C5HNhBmOs4u*gqaKAbB$P;-QR~~+6gnI$~sxrF$DL!4z){SnUj$n46uDt+l
z5?4bwI~h7P1(3BfjjxQby@>-;z%;0_o-A@yn8ZUOXr!Q!<DMgz5jQs;n^5<^&-E<o
zPACJv%@xyxWf@f4JRWDP*6Z2Vvs+5J&@+F*CdAZ0UuI-qG2z`&258egpIH80&Jasr
zs<T)zwK#OM&p^8z*NTlg;c1&qP~I`q3kx;nA@d)1r8xZmz1uKvZ6{l+nN!bL9rn8H
zuobM6QRibXXR^J$>jGn7PHtAs_b5Jj>+-^O`Xn<OnOlY~T^vrd0{a4*zvJ9Hx0Z8X
zBhMJ`kGx28ZEy>F<R=)L|IpkX*j#zXgVNx7X(=0^+O>pZPojIE49f0lC>D#XbJyA5
zHA<e^E8pGQX;;WYkdv~Ms_gIU8(oZx(N9XRS&u3;Y2f{b3WwOX{M`5iE~McH-Kv_m
z74xE?b1M*`DI3ST4HI#w%^${7&7EMCF|(X^bpOiH!5Ml5g~5g~y&2jwomuqVx!E?m
z?M-nLPRXUF;~*$o^KlTeUT@h3eS<?luy8j&ZoOmeVKyfGu3`GvKG2;u+jSYT4G+N3
zrNm*FhzFt@?!$idgRHMKWL>kuUu4V8+Rqb>sB(5fV|d02#L}En#;B7F<6>G#i5IP5
zecL#J_ugvyo6B-e_PB7nS=?*Gn83A@;0}-Zt_&U*3`juLq-K&bS|iYvd8LCTz}1(h
zfqLNBzOq9BSr3w2jZJi-;6;%bcoN;!ywMg!2+2B`{WUDCN^2(Y%lD*Zu{bRozJ)I%
zwthY7|K5%P_L+I}O<J#5>K=;V2~Dk#thiUe{E3JJZz4x+RUN`iE1LGD{s1&g{Rlwx
z2K-uIlZP_f0Mi!Zu=FM<)tHB*ph9PYv@f5ZxF-vB)50`hvxPBw=X<wvb2C9nN*Pio
z=YWm_5y;RLy}9Tv)2gY|;K>vbxB&^WIrO_Tz<20_%%EnHrDSZQA=rfL2~O&?fu4<A
z<P*7F;PjergF!!%m8Sb%^nJEHv~IAnII(|)RA9f2+EQ-6!I{{O9!`8#S)RTtD}y`t
zbvUnj7r!%UeuBE6W`UHl0a6i=rmPZtC!9q4Np}~zrKH$;a2aoQY`ihF*fq%FjFoG6
zk9@d`mdo1ZK_*)0;Fz@RIXnkG#$TfGl$1+1z-le_k)9NC7M&VrH5<b(=ctDVUT*dG
zm8>FXy?6v~DPEdx8BkQe2W&{7<F`AG13E-k?)G)m8Yzx?i2(2%$&Q|Y9-DLLLh7B6
z+pPiYIoNhxe%W;V`xj1cV1>IqnBlc)K=!~vr}VmVHpq9U7F35uWQZuqOkfoM<uVOS
zb*%G>G*Qy8FcW4643|96MOmUdHE0Rxg;WXV+87fdJn`s@(5^|s?H`Etx~b80Z~B@;
zNlkn!WTNSSu{tIU!iE8SIj>hNJ_4>4q_K#fL`lR6n#-yeAKQr=9GKq0%<bJ+{nq~l
zm~f1?Zq!?R<5LkbkZ(Q1%*{X&r&PUP?tuUY{unq<vW?eYlY8ZO!h5*S;JVCelV*+x
z&a?k)CsC*?D4IMeBQ<5ilS;f$0<;%hV9h1f1URKqxM+~mnYwB{NaJ#h-KS)U+YEX^
zsEvA+VnW_+IZMbT^6Vbu4_h8R$)SO1Zwbhe3?Jnfa2>wE9DZ4ra7@vW4e?ehDDb}^
zN8d+^P54-Y)<tGkTQ(~oco!CU{r=$=B$AB(GVAOqp>0=`Y}ONtT?}K-mjZS$3W#}N
zi3j*Ci@bwd7JN--&}&;?c1RowR?DF6<W`=Zf}g_Pm>v7VpjT$KEjTuFW1-l6^`e1Z
zY^K~jzdi`7)>gE3)-+GsD6bhE98$OaKb}@B1<VtmTHsw`5>uj0cPAXvj(onRw)hs+
z{55gv38&tPlvQIJ@{|k&T8(;OR&L*?{_Lk0Kq~d$9q%*$)0mAW8cusW6{Z{B4ugu;
zqQxpkZ|d`_xC<l<K*8ql#c+|+IOh6(gP3RGGd=OaYrfmcJ1GOC+3vM39(EDAxnW<3
z$hDO9@P1B331shZ;7Et4(l2)x98Oy|H}S^@4-fKKE$7an0Nfas|3S_Yu=oggMK`bx
z9TnyPj+B42rw!EhzKHEz5SW1g5QOU#X-iWrZy*rD-K<OL7yhl~{m|ysY?A8kCk8m5
z(E^`aOHtU@rSw#&_!vDM%UaBM?0Xb~GOvS%YdWiQONqf`u<R)eWg+8UT%Ye|^bNb!
zgSb^cK6)emZLyJ;ToVV9QqrgbprU?Q6@)Y?vyuYXTDtpRg)}?;!A!leK)r>8h*(mT
zrz{ae=x95PWqFYkuyE=fiVZekGf0OOGFM0S8L)>&rw>u3Wg{bHy)&`_cysbBYLXot
z0VgMrN>gKn%bD+|&L7?79k)If|C?QGr^Q+Ypj~h2#2hZmSpj~)3Shey_tCELye0aP
zJ~ti&&LG$)QukQkiDn>FHVLq0L`iJ`{<$*`v8|AqhZw*UcKP+@^Bi~r3ANf8hf`QQ
z$M&e>A#Mq4mV1<Lb0J*z!E8OEobL<$IC<y8CE|p(>a*aofRFp-Qbs)Lk@QO)KNllB
za=cCPULMAnM~x{_h5+BBZi)owW;xv@G`?qM4Osc}q7U$5e<N~!*>Q%w$9uo|3VShk
zR)b8r-w0eFs(E4cX09Jt?^s>r_5i$U(uGndZL=G*#y#;s+Ih;+`-HcQo2d(LH3w8m
zV`?z-rBZ>afZ|ua`??s(d-S`0)P0q?smyTW(KNK7nc&^n#?q`YTI67{|L0p~-y*8+
z^}?$GK3ez7Wjkh!)dd}dX>lHN3&p1$H5DUonA+N@on>Ly|DvSJbyA)s_3(|JpV#zi
zR40dhiFIlKjl^!dU}3CQ$Q#>}aLj`=c8qs-><NuG1olT_Ujyftc5#1ql`jImphBy0
z<oITfiw!!9BhC`krVydosRwV~OyJ1}tRB?v5O43$@(sEgo=vB%Mb6um7_nVzxSW&A
zTm{fI)0qMVQk&}OL#Lz*``Pm^RaH8w*W))_DazJ#710ITo=pl&hWd*73Xekl|Jxea
zrHPe1<`f3U+UK1O=w}aIGL<WTT$7$}Ph0J=Te<Lktoapr*L#ucVU3pb_@t+H`j9!}
z2*o8Gu5<7%kk9NPu6eiBVIPfB4}ZjzFWTj@(DN$N(8tap?BdD9BlV7`v4|Ar&z@TK
z9SP0duFI13Hc$Uq0ngL~HDksDzB$(c@_Xq+e5+23A?dX2vDOCT92X}(H4xW-J=BGx
zM~$2*2LCH`to9&dqb4=w0TkeDLh^T(LY4In%LbShYt_}x+p45tIz>*;c{J{{%D3t>
zT4_0;;b?nj)m?Dyf44MM$2b7q0-ru<Y4(G*Kh$6l5m}MPfpUB2zRQ$Yy|?;#uZtW?
z@WGJQFyzW1j?`_!ZM_C_RAT!~@g%9JG>bV?_CfZ_`|yX^o=B3$4@_e25EPTR@SgN&
zCruK+=R4%0H<(Y|Jd+u|BsWYo{f5gm8;ce@CA{9KjTS!26K}~Fo7WhYWBXMf*KBmx
zGoD}mneP;Lr;I$^3M{)0Q=5}&5KVH=7LZ6|t~Y4&eS%<6uf0#(p}9l5^aBueVPLHQ
zf1iC6dsTM})-(GgWth8b>nC+GF}J02$qF*G@ze~MDCA|c_M>PE1yth3Y@^NfIdD4!
zNlQKE!p`8_MiHGD;1V35L=XPKBb~o#mcVaFPH4ADv;h{K%tz)vgq`REsk)efeK?=X
z0f!EMInIIb;&n4g^#Rnbre=;shk$Exj*9Q8i8sMSqrYsnmv)r(1mu^x%r57Xwu@1x
z^$cGkvN9#~TrVz&d3!%v*jq%-`rlA)sUIER%NkRpuwhw~iG-=_&sXi38@}<v&vkpQ
zm2R4K8KEPP1f#tCc$Pq#GJ<V0ov#AsXPhis^CP8}TidLA&UqP*fd{6PlWGM-MgI>f
zW)<*F`;2~3uwZjRx70LP*upPFJEhE(3`T5xY*Z3sb4_t0a$(klshI9I`-cDGMJxQ5
zTgtSvJFlR=IEKxLU4Mpk`n4N8%SmWO#~`5mVj*kX@caUZl^Ock8ekkQbCh(gc3<nt
zAh%#0Q>z6l5Z#ycQyUGtBFO85-0v^tAm6O00Gzktqp*d1JhvVB6Y&LZitu+!Emq_|
z%$N&$&I->lwddJhW${HOf5Urguqw4@z-Vnsl8ww|W<yf^Ibe*Ey|emlHOnE#hj+F2
z?vKPwA(4|2f*NjGUo5v%x=&YI_uIN$fEN}JtM|%l9)1+3@{gs<c&!-E6@8*u^ZW${
z3iQcYUTOHj2bHPISl$>v8cUmq!z7Hw#}t<J1#glED14^ym{ZYpDZSvvN=v8C2{`@!
zB4x1>INxced2$Y5%_#QK@~H|teT@j7;8ud?1+ey039_uJ3Sh#?q8x&u+S+NlGiT(@
zMdO=8w!TAYk+U;`)GqQ|!SA~wAjs{;AOJx?X4GP+vpXI+CO12?zG1yuxtpqAC|8rZ
ziM&4yxGLCO9t|a5Z?xho;oAA4b#(#C{~zRB+6erw4#^t94|Th}>@x_Jsx!60wYUu2
zo)X(a{de%#*d3}v?cK9z+cDe2?*)Z@y305OuFfy%zjzWCDdq!g#r7B^5BXCm8-3H9
zYCtP^n9U4=lG1nb0&VSd#bZ71fggJ4@<#g9L1=HB7~bihKlRQ3l3wsw1Kz!&^qB7X
z^m_uErINzRcdhATM<H!FC|>EddWs?7iOAJI>$@3;X_ZO;TI$9X?HKc;N-w(kQv&>=
zv{f+>#r+ugTV<#J-jh@hla*GV;n=F@pq*z!@?Yx%EcR#NvxB*sJ~NjHv-Q^Q!_Yl#
zMfaj32;FNN6uPT3?2AIId|sbAc~Z&oo{<Nu)O+CC!@txFnJZ08iY?AW*&{wmZUL3G
zpA9t}AFfpylJIP0F%aF`zHz-%hUO}yz5S6G&-EpZ-PXUZ;K5u$WA>ZEq+Q1tbg+N8
zq}NWklk*!wQvS*oMNLS*xw!dgQG*xxp#UIVEmp2e@7LZM(pbb`DDbCaZj4pwR#|eR
z+n1}`6tDB?9ptQSo@JGHBz+W)?~CAKw+!a-6W%njl}t#i09Mex)TVI4f}@Ea&PH(1
z{XM^|m21`{{b}Y)(n!=lRs|8kjd}GFvhEwd3+_#_O=@ba>u=u+nIcydHq#HxxVl8I
zR3;isD{hGcH^3-2Ry+Tgs$Td@ll!R*5Y~LD%>;XH)1J2E>1yP9M0I=3_Xvl@Ru!x4
zhd7`|?X}3xRb@R+8i>POd!t1;>iO>t+ursv`w(>5eAXufeCaKw`BqZTDdSZaDyqJi
zOWPL(P<85X^xxgOqdQ}y>ULlY6rz&oX7EvYO{wcoWQ2cKo*1=w;?eC>w=IX>cDQ{X
z1`Ks*8!U2hd()IF-3*PyY>h{EC>d2bziU&@LZ<EJi{K#V$OHMtM)G5M^e`IsN4x{{
zFed=6a77L8Hk`Q~6`yU?(^$_2c-5@s%WH0e=zQX@25HJNyu4qMlq}OCz-H%gd$jM}
zFOD;44=XQ?$juVyK@;TMs}o|Zs3*yR)lcB2;P1-w-;T2r7dH2Ak3O!XH7Cvc7EA$}
zRgl#L;F})8T{z8COn8+^@@k*A1qPQRwkxH5q}gn3VTbg5(j#6#!&xiU!~v!V?}QWR
z-Ihh|f=ni!-<p;3z=vcuNw)SiJ)xV@ym0V(G`R$RVQzy~Ig8}*bL501sMUaC1PB43
z+%s0N(bc74Oe`lVDij%h%&3Q*LN1heuzy3~q;|9R7q;L$mpY~_`p;O-YmxWfue^U#
zpb}j|C?GkMuXPW_rFaM!kXMWaQ;BB9bPf#fqu4e)Go+t|HpFFf|6tv&*Ke=yL3xet
zSrc~P;}uO8&As8{yz<Mc-36ypVT^)C+>PDmj$Dn7DY!SLZGVs3pV>!!3zCu?+i|FQ
zVZGq<JYR%Ni2kz^&zLV=oj(wdRXmQDk*fsHxOq+curvBch}HY?ANQ5xv<|)|D9FtD
zyhUhjrhKuK{5{jfVbI96t$GT#qA{aCSV0<a8Ct0#xcDlqb(iv#>UAQcS604AH}&@=
zEcO%03UgrV$!={BdiakgJO@l#G?R8cnyr~PddpKi*-s98Zj)o+7cb-NgMuc|uCuen
z+J<h5z)dc;;TqC7A4FP8nypj#2k}~evYR$L1MkNNr`R%%a0@R$4twOA5!lG4isYEx
z+RE5kP661VsHg=)_EQ{p1J}&l9+L39A2ixuhKV-b?9Wt9O|>xy<XqzXWH}-HA`Pkb
z3?1AF`gB`UQ%Xv{;_mQdK+sqIO)zx0Zt`(ZaB0nE<eL+0X?b@D>5(lF-|T#DwhFII
z@;GZg^l+$9b}c%o_Q<%@_sg!4Mh^1?UIS3UmtCHhb500`BG5q_d6fk5%h(om&6>>6
z(JFby6|QAXla{w$%0-7OefT>Ooh2c+uZAh?wa!d&{}L}Q;H&nWS@aXg8%eG6u|B)I
zjK2^=Uidl_caNP-O_v$r+9m~^DoMm*U!XlUnLu-BbUZrPW&H#|%U{7h=3(~u{s#C$
z&tv_*zdUAG#M113W%54qTcPOX)1w7J!TDzK=ON6^o@3QL`6NqzfJv7aHrg_-=G|@y
zzTW(MXqv~Ia+Iz}N!4QuVbE?b7q!dN&wbb~1OR0C=}G>Eok-GN`}=2D`;cIFr8ShC
z#skj?Nzoy-G6}~Te%!OiwefR*j5?qX8Pxc3y2rc07MS-BWpRaQG;)X8)oZ87>jVWv
z@+#_A;jB*_PZO{E@PzcXT;<kBvz1BC7V9t4dWA1mU2kwC9|`8aE(?A{RN{@$)7&1?
zND)SPHmE1=-blIK-Np=qS+rVM;j3`4w2i5b3^St0kpHdnn>#{kPKg@dxdi4E)+RsN
z^fn8Dt*r2E3Km$t)Y-6W>f3{zM-%@n8j@Z)wIei2<QTihjR@c2v{Ln=M(=B!pXswo
zXVIeLW-6Aa$g?G<Y70R5VkYwfi3KnHS6;aGx&bxMf?tIk6XT8GCCvc_8c)<WmDV3P
z_#bgGsaGS`kDUN&6>pptc7I6ld9cHNYoCUP+avS@!)!>jn~Gquj$3o6u$!7y6FM#}
zH(UI_O;3LCTsbBW1_YZy)1YTpB<&Oh=JF3Y2O@pDn7`CnsPdNFta5Z6xM|dD9|gtT
zS5ZrOjWQ;fR{AuR$CrhpJi_!eTQKiRanq-^qm|Nfl5Jr4Ms#`j7?U-W1BRdJTVM;E
za=$eYQ=(e7I>UilKAL|CUvbwrs<uq)MB$cQP>xA|f@S?^99XK*0vr&3TEYs58*Ix3
zwA<nfQ}qwq7kTeuNU+-C#`>IFnnu;peU8Kn>k~P30;~0f$B&Tg4h&BV%t;==2!LbF
zK4niW4ZX}gAOQckjUTe)FM1hBFst^8@mu1pl#VYYK&z1>QjeRPw1qUt0f(g7NH8$K
zu^I7E;>CMfvC6S5{?oA&uho{d98{i(R({b0rNwjhy}V75HRbbJv}{Y0i{w7S@Nc{l
z9~&x1ieki5j=nCqmp8LxZ&V`Z85_D)6gE2fM`oXxV??b_fKoJfdf>xICaFT3J<InM
zU7V^o5wLnS@<+f#sWp5#tjJ9t3?9N1#K7?DPTcUYPpne9`*I^muJe$!dV)v3cCzdx
zJClsvDp}t>>EPffG^gr-VOvvW3Jew!JTnJWI`VU5uPmd|!;W)che{VUl*;8Q<u^mo
z<j{TjUMvK1J+|lQXyGB$mA}H)*OM!KvK)^icRp+Gxv-xoerfLIFfD7jvn;?KxzAYN
zS3tfWdO02~r<M9DJ{|^JHYu)YrAMSj7=~BfSiwY!OCu6tuwF4}PC>PU$9c-r`x+TQ
zN)v8R;ySnJ|HA2e4)&Wydy2BrjOQ1aC}~N~XYZSvgIydweIy14bT)TB^CVdc@7hm^
z<zhGE>#@ULF{)LXT^x--0Y`(u>Yq6d4aTE;TjRlce2|ZGEzr2CqwaGSB;>?YPjyd5
z#B<J`O9OUAXWHM*IfA96AZ&u&0vCwmEuea=^eHxJ#<x5Sy`}R%(j`Z3hpI~<bdot2
zTw;s&g?eyu`E{IbR0vx+zD}*-PnO=*$FyJtzzz8$i2Q-TGz-zi!j8WDoS<NY#9}S!
zPQ<`)gW03C@5K%IL{GDnx1+yiP{s_;DK;HV%^}<F(sF)*M^|eaTS=ESt2XmUw>6EW
zn-LC%=H7!#cZPh_B3|<yBWUPhv5M}C^JYdo=7WdPfm&R_T`uoA$gUfJA7P+hoR%?a
zsc+)t4xCu-F*Ou`Mo8`+>Wlmtmy#BuUvc75DWE?|GwO!z>s=XMFDH0$5H9^`EK}k$
zKhR#)laUwC*%NJ)MKbTIVcArOj^|YEeHC9;%mSO8m~Y{6*Ost*`o*igMJEQSH12CX
zxV-GL4kardpcQh^C8j`ArbF&s97X$nKu(iBSkB->HViI*Dl-6TyZnhG*(BJ0fv4v3
zc<(jSB<PW-3pbs=PZ5><swJ2`m`941*%~`)_&>K`ZMOL8v8UL`A=#omAn7uCbTo9O
zh$Ra@(oUW#MWa1-(p2#RVpHL2=6_Q1XuLs6{0F%M@DQJyueKhpdA<EjzukSlUuFq?
ziY*b>Et|MpW#&E6Diz=U+<F?mSdYcXlWt}V-1!)J>G(lbqd?*Iy@Jr4%q;r}SKsp5
zcSw5J#1A+KfKyTiRS+J&O!X$j`#;{Lem|dmc+?>|2m79!jKlD~jptm;f*YCgl<uLi
z*yF9IRR`i{!~VWi=}u@g3L)+#$k?7$$Z&sqI=lu{Dp9=Gi+T<Jly*9NpVDd@>ucZR
zJ0bC$giujzGgs(@B1r3~=q#ze`UXd3k9g`VJC|xrtK4IKLj4NxU$7I7)jH%bG#;e%
zKEXttUfPQ@drf_D_h~Qg3Q&V;m~M-jN&yOHr`aC-w!4j5r^YtBrGtmLx5iX@)n))l
zjgNaMFoIW6_EvAGt#N-@Nc=`8tMd3NT70g(C;(@aQ_`FWmrUhv$A*~1t*I}+9G0l6
z?F)tB=LRd@-~&^4WXq*G_)K3|zx*ie7teWD8jY625PJ$h0d}=@7Sp-j?UBA)b4^m4
z^{Lx$q7=I9{ft?OYX$3*NW^CPHO(;2qf$g?{h_r}Z0%Cgh&N+m4cTRQcJhVA-R1XJ
z(&FRWq<ZC_%Nt^`7y2H{NFn&w{cjlxDi0jJT~JlP$=Ffo(}48I9}aAH&NtSv;MXrY
z)4XYrZz?n7C=xxzNP^mrcdPR<l;vz+cK+ZPBq?2J)Z&k?qr5lJk<%`jOwh~ESQ??_
z_f7jVt-wQDld3Q)yd}bw-P}1D6MV{hC4RCj_a<ht6*?ZTU^x1*n)n6?&<+!eoXK#O
z0Hr$*`3gAv_^2@i^4nzg3{aU?ktRASIwG3H^vLh?9z);G5m1wx`gZzVB~=a{c>?X{
zY^@XG%f7@mwqRG0_K_ITA&|n(3-?j+l-v4DJBk)kr$-&$;}q}@s*&4DKHHA{Zq(Am
zad#v`0Uj;w0>tT-=D<bq%_<MrA#w;(kB%%27M>aB`z>(@n4Va~ABxI9^mM|9|4_|`
zUe)(Kki%o9z01(Z{3BuZBvXuJv4BE@Ono(wZBurn$$m3CcMmN7*OC+%Xv9(YjM5xT
zMuIGLBUuNIpHL7Q9-oAsVjFI0F}|XdV;0S$-#av$bjK>2l14fK$9xSI;gKrqy`O+9
z{CgE2#@dn<nN*@-_+?+0K0Z;~f?PU8T4e)z@o{!(Y2t{-ne2Q@<`e_JGO+8POKJ1-
zXwRmZ-i!JJ1w%VhqXVpYvI6~A(nl56DK$#=PX6s@O*&@VH*;mXY*h0Xa1V`Sr6>(8
z9)@qLAZE7pI=fj}f%AwA5hVpJQvqxSy&UsL*=UVTmMdxMqK0wXr2#>ZK7>i_t5HxG
zX6^po9~<9bk$-aboZfG#)__;3Ox?NOUVY(`#o0~-Ke)yxYp-0$tY7H(@0ICZ%drEM
zNU3tG>T}@qc;L(wao4Nx36H>~!12TZ9}O%PwKRnq9xOpBO0yZXXfjt$1hAKs^5*x>
z$3Tal!|lpOHfwhec8I@xYMFnmbZAyo7PC~%aU=EYn#cP5UF&us7RIs1vLdCoe`c0*
zwfDku<|2V(Xk@;=1=~~Uday}5WskqSa8kiZw1x^SFG@)ra5!F}1xmu$lUC>5LV}xd
zqJ{T|43r5<yGX*D!NfN|cs}BZaU6B+n#}ymXh-p`hjID77UjF!143YRE11O-v(w+G
zql+|)kiw9K-5Q6H%@5xnG=%wSjiJqgEy(T4#VUbAyWM{3g^ukz>6)K!aD>|7?tmi%
zPVsu=gJI%}GQsiJR6vgpJl*#zBq+NFS`3bSGE$jylkx(M16X~hh6q1<9_F&<b~<Jk
z2Y_><;cbn<J&(P;`Psgwz@~cbl<A}o|5KuF&~6eXdY7;kqOM+>O)=N;rWTTJ9qHPt
zt6x7&m7kKRd@tSXq^c3rn(pbsJSjbn?v<Q-R})c>Jr4HHoO)dN$Yh`6)gB$qByqkd
zO3BjFWPb8vqqeWrKOPuJjDi#Gv9snWeJ}5mY$ce5%apesZ9Iip+~RFmuM+0<g#-tq
z(PhOB+bX~>VetJwzTP|@>g|souN2Bowun#&VJJ(s5b9=W6S8H93JF;<Gh{bRBo$KJ
za;1>n*a>3^S(1GjODOwTW`;3*&&+UdeZJq{?_ZC(-I?<~=XIXj>-BD&Xq=PAn=<n)
zQ7V-R{hpA^2Bt(%or$5FXLNh)u32}(a6*K!t>l#$H$~Rhu<X1c=fk3G=B*0danlzV
zHRb<6lIg!-lvSA%d!KIztJnqITB@t7QK84;q2t2coZ^a1ks8TUQ@UP*NtAV%84v9x
zG`xDF=EHiJID)<%<&MaTJ|$umcG*0iZ7|wr7(r-i&$uRMGZ@7%kct(etqK1|D9~m@
z6MTO`Cvcj_-5(5>y(ZOkH_YqJ5j=y~lAh8Q1{ESF4TS<I&73=zH<1z^Ytc(!N{lf;
z?lp2S7V4&F*NFM1KQhSd#_a4Amtd~I6=UMnuryFk_;IS981VH~5$BsOwX0D|GGV^9
zeVT1scH1FfJKQ`?zjXPm>Z;$lTqX_(rc!0=Q2*mofcBzCZA=flRQAfNe)N+Qm*4PQ
zPt;Zic!GH}_Up+x0a3ud-{)Kfq}QDhqLP00f$sS`vG6#qh0YreeR@i^4(oboY=Vu^
zZIPaoV3)Siv5<K$<&oATw<gGHS||J$sM*Yii8@9^3Nkopj4g1pO`ARjgODB;YNnBg
z2IO{OQ`wc{(7-)?lbIKo?fYQ3yNhM}MxJH|;3TS#X(^$2Q_Qcoh|{V#Um{ZEp}ixt
z*j|7;;ADlH)ND?a@Mkg7;)ftxEMfa+dbK$Ac(XF7-vDSSx*t;itn}dZIp&a18Xq}`
zzjrHqPl*9L+#`U{ooNPZ8zYI%<|-{I4l|W+PvKlO2uTZ-{&w%Dk3>XeYQ`fhKe^qN
zsP<m|T?imUb59AUgIj+bof|*vxqFrvG`$y`z!PpspL)m1sk@pL1y9<TgI*I?ew|mD
zInhnM`EAYDLhW2|bNvM`&R1PN%qqQFk0_~bo;_Ob?G;;JVr<z#AMwsT=ha>Q#Ha48
zI#UKfAHR|4mE7)ZP<QJmeg_wXM0dWQnZ9}fl^^*-b|Cr5B0A(aYqljX7Hzja@6P{7
z-$JbmgK0G!5|Xt?9wfdEb#p(}9M0GmYIN*7i}hvr&(%xD12bT_a-A!)JQ8_A5r>Ig
zX8|`I&<K3*Pb~ZjHOg&CPE7yF#L~B_5xAQLi0S^davzb5|3_o6_OZdKBlQ?puX|SQ
zm7VoDy`~UI$mct{DaVM*AN}){9pv?a`QKyrMzY<%esgHz6?^}xRi%vo!lJ+crrb!K
z{(;3h^2Z%4JD84mn!%h34tmWc{I!1UDl5VAH_n$pZl4I-b7^MyN2~>MB8K2f@}(g1
zy8;0x)rErwrF3kqt|{xfceggqtcdK(7TpTHu#P@uDb;&)Qb@x)3vI3%s_7^YHa$R7
zRhY@s@3%M6D?DJfM1beQn~~nnYgL)jqb!pfYB2%T?v}sM6Vqdl9G=co^r%E_LsV8`
ztKl45K=2a(27z(~ib2Qa<f_JHSOexm)AVQ5BbzqBb$Qm=?I&OJNB`YjXRP@d?V+yC
zd^&h%*Nxvh7Dg;KFht2<dUJTI@0qoW#XU$dG6gV93F;uyqsSw`Tl5_!a?FMY!V50J
z0(XJx>_umZ&{8tOB<Z2X@2hpsT?L(>OVwKJl<*rKG_6JL<!p~|qW*alQ{a7>pz*Ih
zm2PPxR|BvHj7Zz{N3SNL%Sy)9>L#dYy~8Jra5Qf?&Z+G>&kr37MjT`zmSogerekYr
zD6=SXUg`Epeev<L`|g}HiDu_!OS;|v{YJ9D(O{85dD?;H0(x+k0REztlSIRoahxlo
zo}g8+&?2y-_2<7kq%2wVmjB?tJ#WaxWzyE_DyXGWUdqm8(tbZhMZG#WQM5}4G}j$8
zLVCnr>^ozt{aQV;ua{7{$#LnGzauBtCC71qDfnz!4O?3=UgPpPMv6CbZToXlp%mB-
z9lxR`kxn83z2)YdO+f_0wEVD+gC3Cy2T?eh<Dm9(@nvZ3Or<ZDFq9URNswhiiOBXW
zPB_tH+5fllXHqwv4s+W_)*Yx70=p}HKA(MD=Wl_i1R~qk=Ar;MSDk*V_p_;lOPhax
zw5M*qLrx#Hrh#UceL^y<mi^rj3_mZOPZph!vyo(&)+<q);YbV@5#k}~?w`wmN4!Y0
z68d7G#QcLseq8#R=G8gTC5O2J{M`eJSJnbtWmxUCK4eEIKc9_#q^Mjm`Q7GsaRD0L
z`@L^ZY>wNNQ_b5H5foWtkiu$tc}_u~V89KIO%?_MUy~t9_`V^~OyyM-i)jKw>ioK-
ztI1$GwfsjSukF3aH7}XJSGS^kQ%7l3M>6ZRbVw~b=^p=Gob$$b)$Oqdu@}v`MJFos
z42R-Ei8xn1{RyGK<>gA1bglT5i~C*eKmRUR8F!hS1Q@Jjo|rVavQq(BNOu<BrrXMd
zlv33yeM3~)M%#IrN!<%5<~CJmu&cLL8|`v9sjL~w{5ku4S?Zw(BZBS+W|6#K<yYFY
znT?oBYc6Max6<g(KaukT^JVbn!~~)klj5+NaYZ`pCo=V7!>xz_>qD^s<v*IXfH)JX
z(Zvm<VRwn0x_5!N@2!9$S9zVKR25U88<!4Ly)OOhXI`VC)CEttg9HBVrI#8i#tGDQ
zGmpvwWS2K+=1F-vuTqU{Yls%#wN<r&2)<+VhBTDX=Kx$=pYx1fB71m5@)(1k04Y&s
z!D6YT6DGI6rX?{XDy!~UA|HPgi_VYnQjaI|HjJ^P<Uwroh#w9%P^U%zd$ogZtGLwl
zQrC`UXmZo=egxyuXKo&=bS^IERLX(8*BODlV#Yz*Q1@RdjV~&-0B2Xw9eX2*swZ2P
zT*8$CMRdX{OYOo>roAfw@CyWF-;{Hd6laTH_oM;W_sqf;h~kIt4iH>XTT+>u8ZKGq
z0y6|+Lxfzq=Z(SEl^^EPdbAb(rC+j0Q#egy=dg-dPW_9@_!(Xjh_>tNYYqELnuOFN
z1LCo;)F||0#hF8hq_Pn=k}AW=#&8%3EF!Unz8>?&i~X9MlM~nx1}2k2;YJh5?e@Z)
zbYH1l8w%Z5M*p{5$_y7*oqy;t^L#EjC)R}m>3nuMC-#?O*)_J_NO}J0C{+Df_hwIS
zZCtbG3kA0kSlxs}YS^b$r6o@^`46s?&TmO!03~iR=VVu#LwAnvPuR5o124UVa#s?5
z^g#WGRFl0B1rFWws3*^`!@l!tf{+>|l7KCRSn_SWw8SpQlFhgmW)_7JV7|x&dhMJo
z>$sFFY|t;KUS7>}qAjI3w@mq+M!+ulZ(iP9uP28-<%2>^FK;HUNIZ+IwuRY!`S_IY
zodYkTQK7a-Y-a<8em25jx(Ws*SlbtGy>EJuH+22A>cfq+228Pe-SV)kI-SMiBu>U&
z1nahGs}?=n-mtkCiNw`Cxh*okQ3*2{xr*BE&9ad0RIL;%x)XFzs0-(YKS5GBPEmRw
zkHf!r*7P0-y2ZgFCwygENP7wATJKbON{`;2V+&w&PMb1cMf*HaPT96uXzHaXeUW9i
zwn|Uarp=P|Qa=r1Vol}UKOvqi72<W_lnB%AG>DfecT5ekzi@leY1@pD&4y6<$vY#t
zruSx&{Gm}1Yc*3vjI;H{!oP6ayAZxYoM|#yNlN*d6Os*{-?wxf9UP>D^v-WaTbGxy
ziwlFhIErA}QtsOFGP&%-+Bl5B7xiVAEhH?>lxO#OQl!Ou)tdS8U1G;?)MI?NXSy@L
zU`DG|$*-?La4_LVn*4*r2B)maI0|_^Gh8%5@ai#YYyA|@981i6<S5<-lX<_P<X>WI
z#;i8CX5=_oU)G<ywu-=h=dIQi`gTS%)*nsb5`c4btF#b)SV152@$E4Am;u$&VOs}o
z8y-4cbNKu>C~k&>UsuwFZ-|=^`8Qv$m8NOM>I%EiEFs6LVAI7a*bpN<ePyB42S1!1
zU)RpuWc0t~QI2}VfB7bnR(2$`VP5E+?HM@3c82J7*7yuiIYh(!zotb~b!pz$%EQJE
zGoPd|pQN`!AMn=NT}xW>Apkbv<EjnWk16TBE`GknbYK}kX?d#9vOI?0MK#tqLQDF+
zgUB4Ok?#_sFIzD)xRExk<6HqapS33OxtRm*3Xl)CI&vF%%Mlc0LvfC<3`7-ZmK!eX
zIrgExjRQK~Dct+~yT^U@r)C2xojJKC7zCQYl<;o;x~N3tw9-PdP2c`<c`pBf3Au*-
zcsa-@8_iwgDp`9>%8VnK73>wp-eB~zs}s7i=+R?0jFwIei9b-!PA3N5YP>izwQ+BF
z6((}NA?N2BY|UwTC4=Q|l()+ts%&wv5f&0ikw6gks7XQtE3G*G6sWAyhII&G9$SKI
zlyZ3EECa62t7hdE8(P8Js}MIjbJPW#AF$(ZaO|0|VApJ^L{AhrwR`(43|UBBZ6KgY
zk4A*sbc$Vf&h$f+lBpKPu_6O#bhwoOtBV(8-i^CeZg{Lhh+9s{KH{Q0kmb5|e>K1I
z)1jT_DY`TRX?&27yr~N|nvdZ74X-%ppl-VDy%YFxY>f^VXR79)CSe%L{5PHf+c*tu
z5eQU<LO~#8Rm}j$l)QGG1{!1*@qtHpN$2mC225s3PlM@7jz?9Kc@{b2O8aqC^~}vu
zvoGc@8=0rbHeYmxB*gXKJIt4Ew(h}-|8b3spGG{VEYu*XQdKjFCV>dz+Lh8(U*4(?
z>(8NVsxbdwy>cRgx;$e*iZzwOoZ@1iP;(GK-xfo!iR}Lz-25rdh;NdGQ<9>Bl!i5)
zX%+exra+{6SNiDqk4tVf)fy6_xfV~_i1G+MRA0q(3Spx<t3>yBKSFh~W_ecT?a~cB
zbSqWj#;wlbk##F-2`BS~s;=S;S}z{E<NDVf(zuC#=Mf3*rlIR<v+4{w)7O`tJF6K&
zp<fKu-5vbvezXqxQ9Pt^D{}CBn<u=+pU|~PHE_8K&uGKeuM?Cb@01uAW-$hV`*tI!
zM1%=4$95%8>QK*OJ?21SM7Q&j(DWLrexq^@`-+@N;Ma;#w_Ew0xOJ^|UB+Ov2Fdt^
z(l6WJH8lMVa2v#VxB2Mh4O}@xR7gv<wzXA{(`Cz!h5U`ta%qD9tsmwFRj$|=8pL_4
zg<g!Aqr+=A^EFXe?n!&KLbNvX<`x}8S+Q%s!sQ=K2SgRfLTBM6u&vtAw+(o9{7WQK
z<UzJ`YHDNji<cG#udN9E6`IDfZ8V6};d2IC32&AXuj+YpjrZMXnGUpcOL5xdd-SZx
zDjPlo?r_3?QLNqIZVdaz@%LvbGQo~;cbLl=r;=LvO<WOgjKHaVY8(L^M(ct$PFky-
zHyDD8{FF`QBR)M(u#K%4rPd{Ndm+d<X67AI68`IH)*^>?E@Nc8A{US@<J&KRQ+uQA
z7;)fRefFu@2kn*dJS2dTZe>LwUEAkRN*7+lrq$Qd>kY@tqBY$Q4cvIUW*xfmr+2^_
zt;4~^#`&#>n@}d}_LR@}`{GG)<F0B$E1Dnm<e;#6yot;$+kzZ~J(Z0R8+cok8|4`h
zB0Ne+#A1JO4r%#?v{=pw#Kzlj)MSey4l%sNfBbTodD;EMiV;-o^|@y>N9y8%7TH1E
zV4LN}{(3q8t(fvAO_|zTf(*CCda4^W>bCaO-zLqx^jcsrE0-<cxMabmMRN7H8d@1$
zM&=$^+XX#iOd<Dy&Ve^~erh6m>A@T3vQ(R>1poPsCpRYK&X*fGLbLBFIv5Fkx82mV
z3OGY$%f#zW%sYnXgA&cwDmyG@2WQ*w)xNNH`d|=AfguH!?*4SpXL0h{urvMJ2eD7g
zEh;4Q*`*U>t{4N4^Qv)@x6Hu9_3x1n_;l{b&}Yc?<$XQ7+`oYA{2gd}$CR_fRe2!p
zi7MtH4fn+DR3#Fl-33jTW>@?pkzK2DaWOQz-M*HgeUgi*uXoNFOWU1QxccRJ2y<ef
zUSFnAEV(yynEp10KYp(NZL&R=b}CDqgPM2ejhA+f7K7+7wCz~<q=r2uX8-YOTi?3o
z*_9{~>^!E95ov0NE4D#A`am3c`DtY9i=G^iJ_hQhm0B+T-#ibfF4x^VZwm%KF3RZh
z`ab)Vqwn^x!O6_K9A2h_)+PJ%yb9c(wR_sTQT?rRS#MMns_i@+?`u#@r!MReQDFXp
z+SHDJ>`C8~>)N=l$L)D5rbz~s|M0E60>f;(yd&pJm&QnQKAkab0#B`FSEUGZ)|G%0
z6S)^vm|-7vpcOF+1s;re))Lm=jR^Nw!4-!w81c7xCSy4<`P7ZM3gOiJ|6jl?R|qZ_
zVV|j7kHJ?7_4J$^+HpiL?rm%v%zc>0&S^Va@sYwz5IW;mfb7ZBC@Pt}G44~rh{Teb
zRuHf&Z6wGjIqLPmUzD2!D8`&sz^6=iDmD>J#^yOqo!rpZuZohXG1beK%~o6an)dfn
z_d`-<pZxI}FJr5*cb~vXR^Z~z^UhENrl`n=krJ4n9oL*r)!4>krfPeB%$4XJLDb;f
zlL5zwa9BuPi$w&iO~ez}q{+xV3M;P`if$k6nf-{BuC?U&5vkI9{CrP~$HpTI6=ru&
zkwPU0LH(m?{#R|gINsT(d$rtoCy+7xJ8uChjn84O>N63jdJw7kWh>q`K~-uRLSldd
zv?yRZzx73H`x@>hsox~4qOnv-E7iuRdI1<QvRh@mauElfdYv${${kL1r?Tj`+o&n6
z)V_A{W>+ai91|AiE;*9hodmq}+|!3x5!fW!5yw5rGjC~3raNEF&YCHArf%uOV!LgL
z{Povv&F>T1H~Y!Gl@(QZ9rGacdzV)ep1;dBuNV1PYP+TOneq0zkcNEde!LbK2HMTH
z1eS~e$mve6=pl$<k`WY&F^@#5%{Bn1r=>p;fVOCfbFxi7g7Su06B_dq^%Ttkx)09y
z80Zb$Tv}D1EE$8^D+{J8D1LL^iMZV4ygpxW#-)R-IAl{@N_nI1g?{dP+Fg>)n#x`v
zE~s=Uh=o7gsJFjOHFH*S{zqjSz1;76636bYvQIdT>LFU}y7nvxw{F6*SD|-Q{^`x$
zUJUTjeWcxiGFmrRh~*f}?7QE^L%HAI8_i8_xg<&UzDOW;g5mHwU+%!hNM(p6P(OQ?
zmtF&5BGcM&`0Ub#d`ap(tsMm-1A3x(R^Em;FINr%Y2I#K=NhK6qmDV)t)7&pd=|*O
zV(yzs7Q$MadbHgN?D-*mM{#^`Io~FKP<O`o4c=buLKvu!$Ltq7)9W}7>-ricN46`2
z)pQs=1)T@gF=*ib;xUj1duI7;QFZ_e?WbTz=257Fkh99`i|iE-agH}e8jC+MMl#vu
zXfKKD+)@<<E9=#l@Yd%Sly~3Ic$Md(OtO#Xo+k$zSqQ;*8N+cm+f-b*w#ziJzK*wb
zg*%1s5$pDl9{s0W&#}6Rtjki0N_a@4;7l!uLjZG@)i<Y0pV0^8Mr3Y<<r2TFXfb<;
zr5gvV+}xgMrg^g~i}p$aBp$$!r%;|_i|N9C9|{f4bnYa5^{vvVV09+ZV0UY7-$k<K
zT;R~)diaYujHnFW9pkB!KV22x=J!Qk#v&TmeoCY$-V4`aO(~LDV7PC9-7IEo{pjZ4
zqiSE~FIW+CFA>h{tNIBRNEoT?i_BM37kr+lmY5k!UliMyl*_!JLIRK|ZbMCtjH^0|
zM>F@nUFV<eYOyXfNXAnwkObp1udgB5&7(!jUbKr6&-9xq9E_6ZgAO~l^hZw$E+`Mf
zR))UXN|$Y(5Nh^Yo9VtfCO`Afq44hZ8Q9v9yD|RRbDnl=tU`Zn1gNwQ;C>XV|Lz|3
z$<YtiYEl-lIJD9#rG=I$$=1B(tlU6+8-d*Zk+OX<Aq#_^YdXxGt}0uw-Y7p!Q7T&H
z6UH>|k4L&eARBk<J{7-=3`o&{p_gy6<a1(yX;QEpA*QTyXgGSuGU|W~IFi55VKmQU
z?j?pNtK8g#AzR4tW#~G#qastBojEaL%{i8GHp0rg9ulxh{&3wU8vNdvA9#C@TRSt;
z8OqTRCNAkeIlX=>pVeQtvWIH4VQxB{NPeA|n&2A-9lwlg@q>(T(&27Vbw%h|9fZMW
zQO<l;-E-1%4m@F}CJO|O@Z69*;Bm{_w0Sefx?bT?*atgIxv;%Xa^c6-zI%3@k*zMi
z{Sbeb?WHxAEn}ed_p2Kp4*Koa+>cVz6rZ_U3LBYr2#o|8jQCS*XAqG@AN18#XS?DK
zaavZ95W7LjI}&WPOi2zh^BEOI8$}=~fav-rle_%+T2mMG4>FALna}H-$A3iHk#=%Q
ziZb3FrHcSF9_~k)j^)e}d|vyS@X9@plBqXpKX~lbOPN-;?WW#}NMzy*6}f2b*T;6O
zlzxRqwzm7S6r<qvSCusbEwWdt4wUiP;O5)E-r#DZwAS^Czo5PbV+O*FtDm#T&aPhj
z(EI97!3Si%vda~-Ip{E-BX+K!@7nr5*MdgPFrVvjLuyP0y`i;DDp|$1Cr3OND^3d9
zR5cLx?`!YYtIoLGhqtM2Bsle5F6P&2EYF?%-4Ab!TFmcz{w{$yZd;j2!VT83A2j>a
zh{LIsY55ZtzV*I<X`LJ4ch9w%VlqNB(l+L`gs6Gdrb9!HVdH%HoU`v786)!&g)MCh
zs{9*YQYq2aWN&rz++auo@r$C<U-g*FXLa_YW?j4xV=y^ySFd{Va!_C24f^)t@B*}J
z3hffQD-aA(->$SR3(%XJy?H@q5}9DGsf(GjypEb9uybTW9o2<bB!w-gmwhMW0QB>1
z8L#6zsRQ;BB*o<{;7`~2`|JhG%rYs}q?+@EYdd-LUMim7!TGzyOW!1z2Bmh2H?S$c
z3@xN8->cL6@wYu=yj%iEvpzH$G^)FA^BXiL0f@8p<55!LVL#DL3RxW5B1iBq9sy%9
z=G>#A0Jp=_2&TaBQ`<h%SS!Xi?jZ6g0{J-RQnWaDs{Qxfd7n463Vwnc*fwZiYmF`3
z3tr7sM9kKt?L(2CPf~NP6K84g5=(O!DDcu+?tC7|aC*JHZ<tbzujS-brhDUDI5tSV
zj96MHw+tD5*p6yiMfmDP0K|EU654nuQtM%tDW!8uJz%=+&2Wt7(m4?s{i9ms4&CAM
zg({eyOjgg805)xpZstbW0gS?UBG+zCC}(mj67gb%SJt=PSVk188u^(QYHJ1$uF|(W
z&XlLF%d2qds1;M>$tJ1Bn;BIXXqT0{$OAR`ZE#(+H7XCVH&-pM^v%IiNt5+vK^%uE
z@nPdB_{Rp~(}CNZ6ob%dn22aK6y!9v?mmz>RPB#%v|fr_{1KZyV^#E;DL&hKtX<_s
zr9{|lhsjU5LYD2T?7D9(3|9D>skk7hjkzq)+oH@o0x6RG0#()fQkF-@9Nc0YxXEkQ
zuLaC|as>+Fd7`Gz!K0iqbZk<O`TQDhK6BM+O(<niPX^`GMB*Nkp9`65)pR|R_2dz@
ziMaMVVGT#s1(KXxz}7f=Bebqs9r4a`?Z8`{A{*RS?-p~cyFjg7mm-Z{*-O)Eiy?8e
zG%0Ts$QW)X)Z7hg?JTWR)VJ$m8|yK4M_xatIM_cMzpg_trR;}hb%yfW+4sfYX372*
zP*Od|FI%PNH^--XVrd=Dokc7Wr`bIdbY>@CA`NRqtGM$%EvBlQV5->nrV0@y;<UFN
zgM^<R^VG<0M1Z1Qb~WIni5&KOa&dr1=f#)fK)VxsBza9}CxHWwL6X39c<m+j_pHq!
zv&%3CZPv7Tuh~FUv#cxRFAH|%-cMRNZX?xiS%^{FWlNdcBsyF21X6d!ZM}fbWYZSp
znBf_UVZ9@j5^g6Oww-&jUi^GL5__}oI+<;J0H(EK<%7j)bPX%6TyLM%3iu%~%(czw
z)*3Fq;U;VaCtC||+%qX(;-AJLvdEGC+S@-7Vd%G7BFr&GuBAPL)KHk&<<dLKA$b`O
zh*P%K!#{1xv#W<#zAZ@~v{teDK7n(U*0K8-|M3Yi`wQ>>y56&HQZvkfo?@c2hP*+B
z<fFB!F?-eXRYR$H@!|R=c6m83MpHxP&Ri+MY$-mWsk0pXm*^*y^7%j-;(Y)z<)Z<3
zYNwvLUAJ071Ta4~NB?53R|>rEGCk39tP8unitKcKMtx+usicl$0y-|CS=Ff#-mxOS
z&s(dTRMeYSS{6b_A3bFuRtCHdy*ELFCWasSm_OO{i3J|(Jzlcro*mg?hFE}AKivL{
zyb9}X_stne54cesM+jJM-#-29?*xmZE0cUg2t~bCj6lYoiAzMTEX6A2&o{hTU()xP
ziNYS#xm+>ti8Yd4ak?`h!@CCZKU5*r`j&Kvg3zOJn6>qt%&2QP{@TF=%*Q^G?^0gC
zEZ4xRfv{QVfOH^HfNXa!%3sz|#Fufa^Wjli=Cw?*%P%=1Y}hFKkhVhps*R?pgQ`+m
ztsEC!CP2(+rGv38&6&$@Uft#Eo#4M+J4S)2Ue|_w+m1%-<fk?6k(Jhp6`ZH06vXkm
zoLpiP@*$OVj6sN@;IfF%eb0^hCRM35jH?~U+8~imsbQZQ_O;68?j3&qw~A6t?x!k>
zC=gjqO#Ql#8W0YH=Qm4ex&&57V;{_ZG7hO|x~JZ3+X<ozDRF)uYN6ln9*!+wODZs|
zPRMq~?ku-;>kqg_{@$q1=#Tc?c{v|tMUTB){81n{3Gbd*kb^_-XyZU6bi6`*;t|V^
zMF6~Zft}lT$0&GQa(r4P$zxFD!qF3I_lIHjZGXwAJie3l%cV_8P3&6!_o&9)DaCKX
z)WCJ}E@@WeYIhydsLVa+ErJa}+Se5LWl5pA1EtP4vgc>q4j~G`^xw<0d}Hn6=uIkg
zd0WJW&k^0aF&N>``srv^jH)rM2cRQSyEnr6rL1?($y&R(j$)#X<<L2AtdywjwWYA8
z;^xZW>?;Q_k_h#J*4-=smmK5YId6?_BGyawPzO4Af9EvruQWL$6U@KTqfj98ABl5e
zObXas7_Ofk`VlZwc9=D(8RTS*wiTY7qDkYBvEXSx`@KpdN$gy@g)Usv4G*^vSfbRl
z%HCFK9oz&3mvbFry_OYz3HWcmB8IGbmr*V)O=Yj4*gT`kiL5JgI~jNW16ryhQ6)D`
z9}9f*s*8+BV<{0{#BP15zxi&Ql=4V3l4V;ExG_nTe5plZg70?ijY#D16Sr5jKHbyj
zBJOd0+&C+I&9PZQO|;yjOUK1B1@q>Ys`WPKCNR3F_i|8-d5o<VY2q&nnCTU%5izms
zi^bf}j&6}YE;4s34e?%8GxYlS3cQ0!83VcYNS&7_{1LTLAh&owz9n4>>Bkh9UF8nD
z>rRA8Yw`jwNgmbCt~PN1vU0ET=^G1|4^{D=YtaW{Bb)rvhWu`4^@I~bZ!!Ij$yJPO
zS*{pnMY@XQ>v`Ww8HYY+*;`O?Of>8<NTi&GV3nppP6zDvE+w7`->oMLank`mtuG74
z-Riqxb_n^!qReEPBBCE<+nf{EKgT>JC6>pCoQ&`=_(H!)3F@foLh=P;t}=|bva~^S
z?RPYD`qyDM8rxrMaisli9#WGklzAwUqHQ#58f&_rIbDIa7N)q???Enb>41*1qqwn}
z<}tOmMz3dPH^1|W6dplrSIiSd+O-J5Q?7Srk`Cu<L>XOE2WWDqsPj_uI);4)-uSXa
zn5p}Wm<b#xVk+ZhH+#z#b+@MDxVD$Sb-3yVRQsLT%=!jdkBup#CgkQ)>pbK<_1J+#
z9Gh3%G?2+;A1{04Kuz@{xMlmgPKhPXMk6T~S4uCE9}(uY7YE>bf85&Hl2^oYDyZK4
zPnUTgt!XLFUv$Zs|KsxQTAlBx$CTxoW9pj(H(R<S!u-Z;Dvk;9)I8{q1?@l>e@l1+
z4R>1dp>U;?O5zp-O;S-tue3hY$^M2=qhzCh`i?p&L&ibC=ZQ=oH!k;=Z||^=Ku=Ld
z?@_1|W02A9_&2&r<CGBouYQdAn*U!lH+DGD;Rizx1-8gVz2&7$kv;)qTxtA~xZ>3z
z#`Y)^7yli+Lm}r4|7Oc2)cp0-PanL7NDjWxG8LDXtOdlRhWR@)Vi9%rMRqf5O2B6f
zX2A>~#a09;jaDE74{<m2-(%Rz-Jj8`n{ebFOc*|g)xRgOz*gkCy)K63`{>H27CxZV
zGds1}MngTVouak*d^dPk|I)XOdn3|w#yTgt?#xCdyL4vn^UB`EdMB%#LlHRs_LG=K
zc6=G<A;Q6@IoM5sPc7+@)5tr0-d11z=RU+RuR;35r-udxe}|>sQKgsRDxk<o$-E>q
z-DJM91kg^OluWj?P){gDdP0)X@TWAx11--t>xnZfcGe;tOwZ}tUx(iCpEccjVVYHf
zw^*c9jR`Kx(wF34;X)ZQ-$EscKlALRbC4P^DeSDycM=F;)fb3xqLC49gZXJBiii)g
zwB}epn`}g@w^<5d7l_Jrll6+Z_t#U1)k}-W&ijm!Mi!AGukF1z$K2B<Wbp0(ipedJ
z3BG>bBnr)E-&;R2owc2@9q<VEqTxVpM9oKhO=BB5%N;foH2!>EK<z$oKODqmDS`<K
zI<9lM(w(qcE8Z6hFF2B^TfgPBP4F?`OnVojOLoU%HA{$PQt)h&P|z?tiRD#UnQLbb
zn}y`jcV7oT#L>c75AXcde*Hkry&HCG8kn;8N|}V02ZN#v8(*=b=ltLjP`j?mCT}YT
zbzl%*8!Eqwo~X6}*j1fjzVKjJOPheAbk6rPo7$lt+db8%f2U&UzuNPnkb2i;3?iaL
zWUBl&C-m@k9Q0;ib!2)o4Zsx(j)K(=1p`N6y;N55@HRya>=kc&GPy~r!gVhgiR4YJ
zb4)8VJaTubilbl}Xq_|jS}3tcy!FKjJBKdg31=&h^Q1Q0l8$<U$EW#-xklN!x0(Xu
z(1_=glkea!V+n#MX@InjPae*E4&DaQg@j<1{RWYQRmMn>d_RyEd{7&JnOf>&{^Ct}
zBrZli^F##5CKR4>`ZC0*4T?;9px5x?XAX*4*HE9+G@99a;zfJzueV)tXYOCKzPwq)
z`>n{m)%=fubHWm9JqGuntup1&eFwXHA8<1OO3pO7Uh8evL0S`?_E-yA5fnpu-WG<h
z$u}}lJD(1oRs5MTaNymLcC8KE?a<%sEjLOD18MbDU&4ObaIjxWB)a(B??!i*Eqoh~
zd{C0@%eQt08F|I{)7b}}nipU|$oj7%Bej0)^2GUjP$&ntF7sx=u-jtByHPtVz>wnj
z!R3oI;6G4%Yp&f(MDqR91a}Q@tq)hXDF@)%0kMkrell6lUhwr^&-<l8!m}Jcth;HM
zCS!B0lI^Z^F}iujh)UOAIXM^lLsBv<!W>~|gLfj>F4|N)L{>CvqzW-p^Qn&F3pM&P
zn_c=m))Dd7if5&@sz>VC%pL~1#ie-WdZJYFkw^)rDJ5B^yS<CUu;rJ~&1%Q5H<4|>
zj(*gO;;4RqHs)0&ujma_o#E}`N31L9W&13<)<m`*<7S-#)IA3A<YC2{HH#$QgSdXG
zKq%r3-l%%B%-o0_zJ5L6?^5_ZB24ZS4<Yg~U!x8@YI?Lg-pjWzv?N*6f`?VN!^%u0
ztEcz)v7Yud^>`*NGGF9paUnWi2hT&)wlOu7$=>zz&CqeX`nnASt(25dywj*3Noe_m
zTF=-gKJ!jmkX7lIt#xQWQ89>;&efln&^5MN|7J#x9N*JG@N&_V)Wvn$H{N?;Hr-#*
zb4tmhXg4onHdpRKSiE0>_ge@W*EJDj!Mi=T#-C})Xs@K~$kt=x`aOmqEgzHFfdKFI
zBzs9idx0$dtbT|N?<zK1AZ4z(@lXiOI^6qxqkji;NEt)@wny!^mGb4+YSS{cm-p>2
z5D$FN?b+la2(=AL$w1e5A62*--lx=a*Q;WN(m4eQL?0@&a|yI{z92rDp9*QYuP35#
zzWjZeh_pv+k?%$S`f<FQZ&X%8ya_jWXD2u7?D%L|iqZU3X{Y>PA^8vGzeL`;J6uwH
zL_;11Iy~<}t21Iss-meSSfIDB`I9<hWbBuW=npEPC=5Ys1@5^$!`Ts&;!#%|g{LkY
zFCUaY(|&Xi?ULunH3D$;aD0vxBs;v{g;-0lDSXNBVqDF8KEpJ5URAw%AiOZt(sD<v
z{(0>_{7?|oA=Rv4ZEAT7q#B;is$lb>k7+H7P=}U3(}i@koDH{?-Aj$s#@!~hh(j&b
zjK)duqW&rIlqbTI#j)!a+*}hH=k1NqN$pZGEaDIxCU9MuhhnTKfvkhQ<9O*#4(vyg
zhkEF!o5a>+T5QNi_932u%sq`C*;@xNg{Ey{&Yp}2hYY$on=}@*Gll>Bc)16Xi7%qo
z;f%NIRhm~!K@;vBmwY))kvK>G>&85G7MS-p_K-U9x9%b@@k8F%s+X(~wz>U(NQU0w
z$^xu|Dp)j4_JXYu8_TJhjFvyi@=fLHTx}{`|7gmi(YoP@2_Kcrl#v_HH9ka}Es!6_
zrVf5)Nl}HX(^BkV{--O1KcaQ<BN;(Z%lBCGHcH~_$KJM5DVp#4!Ts5y!L)!RgKJKi
z1u{*`dtvDADX#Wsv%Z3r+jn#cN;@IEj+~(lkd)5xj!jeM6@e%yaOvKMJb$I}2Za80
z>En8J6n@lgt{v|Ak)2KWEcq&-Z363dVzxl`c!SgTMm+(GFafMGz=z~FiGVz++z{5i
zVV5*o*u4JqKym7!G+mydXsPE7Y|o(eF0yNQYP_G9ecdJfBD2d`r;Vb63R~khIlhg1
z#v(z)c%kS8s_s7heGR2^{a_2X>-0E0^1stq%QMs${pz3Jw=a|pBKx?cvoL`#$UGuE
z=MDL<8sS=1)0wwS4_Y+YIH!8nZMbou(0zn0{NO$0o_A^QX|TyR%-Rzi`>{0JpTbYV
zq7DFnH-A;zeU2ZAB|ORT&g0O5Gl$1m&A+7FW*+sGG2UYK{}^3Btr)}{6_C=LsLJ<1
z6o%e@W?%)n<ftvB6NfIzq$|s6JHQ%|gyW~A^u7J@Ft_S1Au@hfl-;LHX`n0-R$fh0
zcip#_TY*(qo<hA@^iR8Ra<-IuYL)yY%Y4i2Fr@CdIEeai8B8e~f)tdKBWN3leqt*G
z&|4VKVO^BqJ=j}`K7vm>g_eXfuf0XHcnd43K|-3|qNCPs*1x9i)%^of9brWW6c~~)
zbsMUwDtzz8TGGpiFE(@A<tp8Ny@TA=JYV+qV7TkrNmtur!O)&gFgN4(-mars5E2g$
zjsXdcO)QQk-pH;;IO3L`Olp&!a2q4_4B-ViR~9GB<gDkstG05)qM{g(NG9!-w0dq>
zJ*sqQwvC3M7pg|f$O-9v`G*^yJ?gt|!k9K0uAJ@Ku>4JM@FKMrjIU;IOe$#|q?VsY
z`s2v*-k<|$wTi!Cp`!80@NS#a3FWGP2013SC}AEC0MVZ6Pu+HdT^fS%-;;SaA@|QN
zQ2Q;H3`9VWKDIAxx*1ISZ#}z9{MnUrxOVJmK1<Yvk{J#!wl7txz4gZ_!4%N!L;^jw
zj@86YlK_q9Kb3y8R(=yELiArSw``n&Y(~)GduKI%dj1r>`%78KZOeCZyOfZaGr=Hz
zVKf4w;a{i#N{lpg0RR%ha4(sy-meREC*D@NJaz#B**kSB@E*``6Zqble^Ek-DQu5>
zeN8q0*vDvqwgbj?gy)m?O1RVoNM7HeeXgm*S4`%eMj?{oJW~189=l)_!3Qqq8crpB
zD9K1L=Vikl)<Q1fr#i(WJb>ACyp=o8vpe-wVu_3Ta=AcGW%Qz5i<1!Xft|_sG@0Oh
zxKpMlZmz)gWQc>(;EQe~Hgvjph+PERAxGYr1O&2APkg*6g?wH_R_WkFdleswc|mr5
zG~Oo{ZQZBrRyFpz;Xs&qgOOHaj9iNXBUn=+?y0#q)?l~$<pr#oGYLA+Am?z>-%=D{
z=$9{qCmAY~q!6D|wcut&r~b|E=Kt6686s}#+A=%Ps7(61g6-)Wj>Is%(}I`KV;LYM
z!|HmRr#Y`91VK#@Sus|;KWk4V=tj3X*A$-?RT}fyIw*QuGuTdYPhi*(MbDOa`u*K2
zbIM9&i;ZvGU6tGD_d05xEPS8V^Z2(H-A&VT%-S*v+eh>&vU$B^Q>2nl0DU#@L)6yL
zr6}zPq@A?2%I0EDW!q>L!3>k~dnzBQ?5^UVS?5^4&cwTMzFrC99^=cW#c2_}S6MHo
zB@qT|OLUExwT?uJbbOLJob6$43dt)JZcI`tc~s&1>)Sc^JX!HD*P8Z9^jy)$4fQHz
zd+GD#G#bw(s(CGgOJSo5c<fJ%FQd+i30VAvs6iLjU7<P}{?k2+%@_<}ZczDp>qx1m
z)5i;mh@WV-yC%i>-4dQYwDJ5)GO^}tPsqajrf%Uo==V4M5oG)Nkd(f5YERZq8)-rn
zcX>+cR@32wol77#*=1yUT4vmi9D#q|5uR6E16(xJ3sfwnQG^n2RJrk5ER%H1{a#kk
zcQ7I#YJoyh{4Azy;4!n%8Ligs491$yoYzkEXLwer^;}$ntt=Y>&2fC)dR$29&1}K&
zxB7;9jGp%tV1}r=XSbi#jyXQ~*1OFT8Tb40j<1r>!P$dN8E>7)%#J|nsZ;2<A11$K
z@%>LPUx74naURQ8(Yf8Fakf7>T%!_7*g1Hutdqa=UzcrXiK!NM-61D&B`xa~P1gm3
zKky|+h={&iH)umNpv%V!sLrpJ$Akg25i|zg<K7xC2N30Bkt#%T5J$r%-{TC5$;PmO
z`NW-m_<%lgUAU{fNyNqLsIp~-XJ4ThhJ^u{ooNbC#-W77gstxP0jwk!#_(=bU0I1z
zV>|m*HfNKOX>nF+`rOJP5Db~PVyIrdx1xX=>8Ld%-ha?rxGg%N)^KB+{N3l!-UUEA
zvSH)4HZ%U@xfp|yLASC~8!Mkr-4VbPv9nD?pvN{plpP>j82N`?=6eSw#u9CK$)V`C
z+Z{c9`@b0tociHJm7oMY8l5baBi?|<W`LdJBZ7_am#gDv4Gpec&hg9nSfM?AS!v(_
zi|dt;p7%;iR<G&)$skYtK?CRM#BH?=8}tc9pi)4O)90u-MRva@WhU!BQbi&`Cq}iP
zRaqYbB#a!lPX1jZeD}lr4^lU=hFaoT$k1-NSGfn23Um*1M@5tz6j<W_3e9$fQPije
zG%kK%B^FU4qlP1~34SO#2nQ-j{7awJzPy{0X^w7a33$~mQ!yFDb#>^~r>F)5i30ag
zmA~${SR8F^MYpk`IPa@@n}{ABP}Aysgtq;?`NL-;-+>X9wra>EOe%j&@EjCq#)<&a
zzVVv4_9hQ0c9@H;mc3fIjbPPpw0g+np{Z=k-D2Boh1Jxn^5j18G9_!!by5u?%7RKr
zFQa!>L+Lgo5J2<OZ1FK&c;P%NbR}Fz1%B6EPo))AcYGgC_YdLDDWEj*gxO|&V`o}|
zdH&`Wak#u()`kM!rVkwLGh0dn+Mjy%fP}v#?dZpGX4~Ik+Uj9i!-$eW9<|)m4s!l$
zQ$nj=HqqX%sjr=qK@_o9Y$(&%=(A57x0M8>r$e_nVMGW^e=zRK4V-S>i}k?DEI!vS
zXVW`Vc8jrxS`})Y&W31rHl)014;)~ThuEI+*$ys)@;5o#&L>!p-yf(kLU~K<7{wG!
zBF@@|MZ^5O)#@>;nP|A+tg};9>Gg;(wm1IBcVjXB#g=9lP_uUB=#8iCl_MY~7aLgI
zv`?#>KlpF&#gVw;!xP(QoO}LyXuNpg)DdzZ{4Zv9I!y?e^3bqnp<u!s&BJ#%&o#zX
z_SBIBpUXZF%&>mB0i!_DOM@|ihS#t!PjvQVY1wx;#XTrVKc&&$G0?uaL6W0O`n^}t
zCu`}XuTDP*eF#^RKN+9Lh@QvGiMI(@mf{pa(>V`lI=9m*#Oqk0T5Z_ZbcSXXogvNo
z^icJv0K%m<=Vo52^L|aG<(Dco&3PHcTrX!^3bndcqgBP+e1SQ19Q0c}Axt|sqtC#z
zcdM%jc<Uo$6i)0gV-%K@Myfm%C1TaUv=17Q7!@$sd<*;7*G*_~M<L?fSG+q1!gFZo
z9CO14|Ca2Q{j~oLM%zSJUzN@Wi5-0S6TPR~&*YYZR()ZYV?DA?lh!5>+)x8;6pf?!
zruTzp;<<7zI^0fs#n}iL!^sf4c%E|h?HT@XCP=pCL7?nhWLIyl1o8jJ)7gySaw+4t
zEEg61vrz|s-;{j_LGj{G1J9x3rk3oycL#%Lyl%tKw<<bI3N$!;Y_ej;xmgG1MLaVd
z%XK*K7!clz{Ybb-$^2hDighhyOALQ|OmKAo@Vd}D6p4*$^71wUosE7(Vp8+bl;NZo
zN@?!1)3f%+fi%m6*<L##Zx2a>h<oR7D(t7v_pEwJI-T3kk@;qEEK4axKN+?*cRAj1
zI6p6?ozrt@&X<h{_%AiaMIQB(^Er9MTkZ(@V5FV1N2HeV$%0Q8f!F53;rv_MzEzlr
ze{b~Sw}nEO%T7Q+Nj}8NmeHHi0Z12G<0p`N`Lv{%e3e1}MkP^wu5!jxL{N5rBVZLw
zX4U1mf!X&?IKhMe$o`SPhHjWzS7-QXjH}mUFlMF|82_WRu?Bhes_`2wa5}3Ka*QE3
zn`mFR{P6jTUpJG**vcBtQ5MbpiNs4EMST(H+z5Y!AU4lAKGx(;fXDeeAhk)I`VbO!
zu_s;GxLJ_ipyH{v`PPdA7AO&BrOKsYfG+&DjP$0?<wB;FE4{@RHv5BjhWChCP5~yX
zpqQt%IXN{bxAlW}n9`^rgxGj7en2FzBFAGBOcI(Yty&<PCdY1^$>k3jDz%df!2=1t
zi6R06C;YmTi>jKUBA43Mm_B2l(@~Y^WAv};X|eVF1#0qU9GtpDnCmYn_H)s4CH>V;
zemSmJ{^F^jXw;+`J$Ol-K{k5zcLV#EljZ~+SfO|mc<6N{+6sw`J@c|-7N`GKM_rD$
zCM4Y5h^(iN`of<QLGxxAIB~UWvUPr<xH*RQ)V?z`>ZEwc-`7n|^V4E!lMT~`?)k>K
zB=3zd@5N%Z9pnhQU1NARo-!qU=%4B)m^Np_5HA!wE5f{8>f(*4I;(#P$eGhAa`7sG
zAvv>$tujUFBLX=nH3)<%1?VEKryyIaO!N1HhPu?DsI1!e(>e~Qcn3k_?gbaKzBsMl
zkBy28bEBYr?ptjL1jnryHv9bz_1q+#Eg369#bWkAF7s0T#P_l`zKAuxl^=<UZ6Fyc
zsr#YT|HBAdp=tTQ!W+Zjn)W~n-sC9V?*fsd-~|oVTm;6Kiw|_@{@Ve6e_sHcenJrP
zl#MoD;k}sZ!+$`J&y^h6Rq$rc>)ZMbk_6zSs{81vRJ;a(L6(+S#C&d!!Di@rW5gfb
z7G27ShW((&9S8{zDfV0&<t93(C9F{OO<WiHm{tc;ATMsm6(ILQsab7#dg7D4?1#&n
zF9T=qFehnVZX*~*n%bG`0{-(zr8FaCpeao*G%`fFB>p*23QU@aoGsMN?)tWPgB*?i
z`;-Uf@kK+KL}Vj4vcB{Gs~NU%Y`Z8<XhJ#!DZiHQ^FfE=b3LJT@7tS>4>=LiqF#hF
zHNfH}JP)&!&$m=*j{j3CT+HnPTEz^M(sL=a2!iM}tFUu~LR)yzIx_L#Hvz4W9rxud
zM2L&-*DYE*Y&@Byu>Ug{?<08f5(VtdRKX{kFFW(i*>58Z1qNMT{|ESj(QjQN0y`n+
zC}9(Tx=Fm~tA^@lM}8I*ia?&q(E~C<orBd70=M5sN=7U)(Yj<vGlf<yz^#jWY_63)
z$Pgq)KC+Hdh;nIY;SXPfttZwfJN!B7V%081b521K*XS0IS&)TkdH|YXF;$o5Xi?<}
zPBWP(_ejv9_>k5SLoxH@^x+^eU)Chc>}A)@n{D82kB_SMf9pyfP@)|nUE!5k`$D<-
zBsF?!Q1;((O$qLz1eF?m7lYNU&;KJT{HuqxhL}`)j`_$0t2A@ae$zCgWQuFHjJOhG
zu)AB#gT4n(+RF-DI8ki>^Gh^@tHKpPTA*(^^b>o_B(1;uJUrhR)rdKFmKIfCot#3f
zQ!=bo+n@Jl=JM@>!edYkb174#a3vq-m7Pli(frAzGr3R#(h;?H$8Ds@&C$ZIhpi$g
zfrN>fL)*>G#BTz&ci0AW>%rCn%Ld+84h>o4SB%&T{d|CSYP>tOW$e2<1J*t<eBuu~
z(Ip?<3xJ1&J+<5yPG@M`jUu}KaabB-R-W2(D{^t!icECf9;W%$?nvpE^?Vd0bC#Y0
z9Z=B>{`WQYE8vrd3fQg<-Lkr7R3p42O`IG}aJ>WGc;-1!A@$$#$8$seYnOReW!hcr
zdo)jnc@;`~4gi)yDgcd0ME+8)^w*{IK%GPE%<VhZ!|=~n$53|S^2yW$;znrVLQzZl
z{i+0am43Yd0VNO3#ow`ec~qS$>D9;iRzpLV#0Rl6sx;H!YQ4%}eS$G_NMIn10x{RI
z^|Q@|Uxz%UZTgGcgD$)iN)UE>>X-g+Mx)mD+Lhfb0Bv65V=#lJ49pYaGr!$>ON*V(
z-5&f1eaCUpo)J_jl`kgv3l*nOMlgxcGMD4*XI0Y9o+~*pCa-XqciirjWm9!E{%mOB
zE2FD30qC@p(|?da|Dlffq5dC3U*sNA<<N@g7;GmQSMH+*BQLKW^bl3;<fo@S8Ikak
z33f1R{W$#w_$8Fg6Bk)iJE=n)^H^=S$LXiZ!X^^^&naY}|E|5^jTXOTJ4-k-5Tf+u
zC>;ph`{!PvQnayfK}xsy>++Ob@{dE%TMu_0!sBSx%W*6xkKpai;yyi+b+Lr~?%UYe
ztKj*9v(|HLDhEP8@Ignfgx04<BIUNaL02S4s&Q{NcJ$qedQ6-A&iJ}H_oTJylE-|E
z0<<v77C$;5KcG)54@kCD0g+2B%p#z{4tmUm_LX<1Ke;d~Hsl6G1ggm20-UDds^O4@
zG7y{MP((^sv$jJe=rM32IjqL2z(dFwe^L6Ooz!d4ca{rx4F+QQ<o|47RI(4(oE(t_
zcd<hL2VZlDdrm|jVlaYt;5qGHXrODL1O1arNb0@;HmgihUKFTD%e0Y<C^{4!xCBSJ
zsCU}`dl105>_)0dfI~mVteGztiR5sOr$iss>sm1<NqYtx_)LDApWt}TP_3)26#7RG
zx+DCKg68ICeDz$ks8qJJI1dLTIm#@~b+TZ2`4nw`|0F$H*CZv8hfh-vs9~4y#0uX;
zL|}#d&i;PeK0UcI=Z5#`;-f0Cx1r-?CQBf01Srj?z=a_3ob(`mN9{{{{-6ylf1itP
zez&K&0`a(jt&id4pDX9cd`FBvB9}nfrZJQa3L4Blt!7AxzmG^LxqqaW)~tN`iH2qj
zE}E~2Y3E6Ucm5Pq_hXHApLEyhDWZCVD)gA#?qv#w=FG!PwnP-UrYE^jfpc!q&urkr
z8AsBsxXI*y27_QIO$;zXazz^7c8*2Cjdz}Y2KPFD+WW&%-f7mzz$6O(wcjJr#CL~M
z3nc)cU22*-OdUY^o^4~bCO`j#rF^uhUVShIBPuEjldTq;LfoPtfv6t>!bE5y$`U-(
zW3-YTL?^`0MfrCab|1RtgL(!29Pp=e^3?nBG-y?Mphg}30Qw-et(VSDgke~OkfC;z
zT?!gZsd`=AD3T!03IfEBS!nmlAgXQU;RUd{9t8d|$ta;}s<v1Elx|2pJ9qr;lc1MZ
z4-6L=Rk`=ZR|}EKx^wbB1`F7<sOW;4>_t2IlzBah4eWH7b4Pbi{>*4-uR;~&Pu9DO
zYsENp-cVhm95KGM8Lgpc;*LmqcN2VvWAtI4X$VCky45Y=b)sc^E5?&Hi_f}AS+J}7
zXcx{88pc<G+?n;EK!1dKF#i1Rnm@Z3!cST%a3`Iw2d<NxNy^VEzcndd(=hYv{O<#N
zV^ke!oL^TMLSmfPDQBm<5B4afav9v;jPU;FC~~jj?n1A!6u5QB7BWFb>Holt-oa-!
zWack0|9G-DjuJWsZ7qvnR!&1$g*_c9g}iu#w!q~JGA|qVoC8ZF^*@{jHKQm}8Gep0
zF%s<Dyl0=xK|BYUAPOB<KHR!9XylN%1zUpw^q3J1cx-sR^8f08yE-grhuIlQnmcIl
z@gf6H(?HT`2sNSN4vtVhyEu~weZ*b~3ZexwXa4J=i&pLubjt@rK8$vTe2A+(Yln`4
za#HvBkDOnMEry55w#p-oom*=oKA<x#BEgr1yP9^ULL#s9MB(E2F3{1=l>h56;R50Q
zn707D(yFJFl7(D@5%d@f^|Ajp0d2``y6dyX1TQI;?~V|q@GEdlgbVC?E0kG3&<)3x
zs*6coQy=YUb4b2_uEopm;iR*(`=cnaG8Ldi@LRWdpyjR+NqE<~9q}s<5#S)4%XXE<
z0Wb0ox(L`SLpn77eWrDI@>9fT%?tdyB~y&jnaIU3?KY^PQT_%BZ3ud9zjsg{PHF%f
z64i={C~Eo(@V0-u!D@wbIwTOJ<1G>mS9eI;$Dpuz=(*$cwV(f3MnU=;{EB^Sm~%sX
zJ7(d3vk|F~I3(JnCkFDIF9O^{)RA8N8xMvwTes}DL!)<*SL`Xz&C$6j9SX!6?#OH1
zpfpq1QSST(HYG{%g{<HNKforz6w|r}$OJPfoR3kMw*R{J*81$hbC4t*{|71J5)iMw
zB>Z)2_RyH(+gs1pZo!Y!f5Xt2qHX%G-Z?Y8v*f=_IY_T3*gcl-!oT+n?>=P?O4l{$
zxhSDDC0wBFH6TS1#~S|MT}gu1-mAWMsLr?5t)UQII$y~*t$y;O>~wc2mraa|u^nwj
zQC@pOgZ~LYhbi9;C`qf8j))li`$|t5i~Yi~=ptvY4(X8j_kor=BBH4u*t5e>*-Ny4
zHnd_;Or`Y)(D4a`KyXU=5|L5nu$}hjNaQpCd+*4x=SiCI_}kC8pmj9zofjCmc6*N)
z{dn!4&yn{%e{i2I=3K(=bJRTYJ|^F`Pwpd)+WZq_j}C?;@-cG#`y3q;s=oN!RsR#T
z`y2sm_D_yXDL9JpV5BS-F8GOPkFi&Sq`2(<ZVKoDBd<Z*Fe-vp-*ovd=dud+ank+z
z^D;K(-A1|2SwjC-W!@=d)y{2;cbo^#8c-`mf*_<_NwJ5E?(41@svF?khNXRgnl9P3
zAo4^S`#vji5wanFV40+n#5al1aSpwZZ1<LBJ|<)!kv1e2a#U0^{1)gcgZ{ZXhAGis
z(k;x!&s^X6MqE<*;P{(Rjz4XTfcp{uR(}Vru*luo^`Xz9l1~}buH6glw{+buPRF;Z
z*SokM_5-_X4@7=Hh4MLw>t|W>e9OlE?;N%Uh{F;43wSXS<oeF&j)7lUymXw9r}V#H
zzQ%O3D2q7*=-<|qZwf}N>Ds#V^4<*?(DI_K-FMtqJR}T2kKIb9E9}zCK>NUN+BX=W
zEA)>LTc0L$NP<R17qSGZV-k^w@#x!>CY^O!?Sh`Y?$27U>6D@jF0J3j2PbIu|6{Uj
zfw9ck*-zr8r~+#g7IThoho;rZZ$2e|_P@Zrv!4>L=Y92t08nIi>p!_Ju;WQ0vhK5#
zJv}LqQbMSSWg%d6jDZ=7yLV^8L9P20iZ*%M5rO!f=NLFFlzSI8pvmxOSwJ07#q2}J
zst}&+rGYxQ{gX+>WDdGVv>-#r_6j}#uSLQt?;gD>NW(IJBS3k7TtWYaBz^d$m!rAo
z0`S`(Xxa+6Dh=wn7oA*yAhh==tw_x_OgWuB1~z^P=8rRHnBw`%Qzpu{nVW8B?92?E
zi}HjPq=Om!?*%-V$yxkbsc-I1TkTS)FWe;X0U%;9|9|kle15BM+jpIy$26FMD+Kbe
z<4v1kU>Nrrtr3X43Qs{aYr5{--pa#?a3MNI$Wz`wF7NRQco5_%*@&6ATRm4HTAKRh
z-?A~Eckk-G_9Ea15kWPjPEKu*s4`cY;01r8?xCHLD%u@r8J9su$^@k@6FzAm{Q$PJ
zn|@yX)QN~v`iBJ>XtTqBa@T^M;Q!W$*jxPPNcdrBw5B19lkU;3lGN~6-F^@04SD1+
zb)5{asZ4nCbwvcK@2=C^#pz$9IUhXi8V!mALC^J&51iE=s9nO8?F<G*08T@hM*?bA
zo=A1yXRw9KcgAXDt3^#h_5e)xIP!n?bm|5(mWvJZf5`gsKq&j~?MfwO31!JviIjD+
z?-i1egzSTv3Na-6GE@{}o64S@?8_MYI>?}GlPqJGbubv)7{>Mv)$@Ix-}_Jh#qD#S
z`+TnJI_F%c;pIO`QX+w&+o6;L@QCgYP<Y&_V{?57#>PhfPoC_0iBhTQc0k{j{0$NR
zWT(nY(R0qF%#<^Wv^u1>p@|7`!<7kizDMKhF;+q2fFrDV@%QnVWl(w0aYY@%$mais
z(ZQwudJi6?3T^)110px)TKr%sJq7s1{rj;f1T4!&Zzz(@sQJ$ud%s__z)*S$a)-9E
z^?$cY*l+#gU*qJ@33bcdfg2FY|Gm%i8_w`nu@o~=+8!vyMv8eH_zoHQ8rq?>8TLD?
zL*2RCtzT2{R?B~$GNA%4cCYvVc3k?OvzuwjviZ#ye~V|L9lm#Jeuy0I6ZqS+rRm@U
z`vX`HbtdD#efFJfX^!0@huY|=-_N8+p{djW;w!h=qo%7nPdh0P29djU5pm^V5QUZh
z9!{VbpoUAOY6l&6|348n5r)z<Wun^tdw?x(e5Q_3M7Qyizaxy9ZAzT2J?M?kKM{6-
z!yhbqZ$g=WN7(0Bw%_eGv8aIn(KU9o@xmb!{dmgP_<sALaMZDQ(6O&W0m{6;Ip1V2
zwV*u@^)&i+&3~U|xLE*va!H5w%bPzrYOcq2OJe8a9^1{|&yrn9xmm;yZ<fErQ#5O$
zeNlZAoc+INsrV;F!G#vj^idm$wpfEw*l7p;^Z{-(KKJ?HmYL{$1XY^RRj-4Vo;F-N
zJ=FN0w>CmA#m;Qw4!SJ-_bMKL*j_Q1yomYnn^N3u;>9<yY0!Ro_qQAal@m^W?pLg=
z()2g1{_SD)YrLx`P-We!KQK1*@YVfpnmaPu4x`Y{&1FSTO~AfI$@2nL+(vkBTJu}u
z{)p8mwjk!iTuS@PC0Hi$?Ouy-$SJCSwPW@qgIBHlBaG<S4>PIBwef&Zz5XyK3hLzf
z6aSp`3?&SMfmi-=Vv6sevGm~u{ztI!kKNj=yMFK?4mQ;)3%<DXfz9S9+W$K5lt2%T
zF!vv`${WYuL9Bl9p8on@Qo+gXz^*xP9evy9Z;<bEBp(!G2CM<U-ObSf2K`Y;%AdpV
zPj-O#__iy7lbZwnqNosiic{oB7!4+0a7q+#UgS@{`k%2)((rH321<c{0u<-;9;!kc
z@aN;B*)M9uP^?<f;s4ECzT7p*CHv@?XZ}1F|4D^n`p^*c?dm_b@sbNP9@>tgJO1}J
zKL7HYoEY~ZHaohFqhK(SsD0w0>*8dg3-pasI8>8%>yIo-DSDFt6oDLrAatWj9UcA@
z$E3xOb+jqy+a>=E@c8Cy;A2bLv|nI<1ANMsEVC1}cj@f!02h#<&_3ov+V?lW9kb?#
zf1~xky=^oWmtEpzWc-GgDf=ZTW*?3!tET<_Mxl)Vg$R^+Ox|*1>z1dW%R+x|nZQ$S
zo76kJlK+JU8#}$bNlRBUha3Jd2FNcs=IIFU>9xk+i~)h0!Y|rwx^nzw45e@6l_Cyx
z7wW$>>%XmFF-}*KD;rSHEp`rR|55q%;lF(qp_cGxw=yZ%<1doZ19qYJpZiHu-sQiM
zl<#1v#hNGDEcoxcQ}Zd&4jo3{mihDUnqT^Sgf^n?Q-0KM)8q?Iol*cGGu6bukd*Ns
zE`x1aHEnscsTO*~X5uP?$|%BcFr|-<cvKU%jG-tNfaP1uOn)%x(R^LF)3L8|&cC#1
z(G<s@e?6NFw}SX)5hCc#OTcg0k#0}IO!?V(k>lfrqf^s3-egY&1{_B5A31LW^Kvf&
z+Jw?L{`b^aDf?zS>M3I|^Y|NEa>KVdD-JaW3Y)n>VSXGGtS5YE2Iz5S!g6?EcAeb<
z_NM3$%4_6i85rbQg!lf}kF$rMx9(jY80$dw2UnH8QC5m@f*-!Aqdq585*$&27{o#-
z)aHoI_ncnd(rS?hUFP{K;!v3A_SSJQ_s(aw75L%fuzRdF(FNJA{(lC^_x#ogj->!d
zg81*klJjYn;jV@Uv|Fu|Ov*i&@bzdD!oJgei>xr%n~kG`Qd^_jQ-u0i^OV3T@A1eA
zl-b)y3d{re@IMy6zOk1;xmPKO_}|66OnCWxx{uUq%-O@dfF8JdZugJh?hXDVib6wa
ztk0ZWx2N9D6aF3W_6xm~{-gP%`j@HRt3NZAF@D?aLjG(+`;<E3=%FX@;qc0+Ap+R>
zlb+vaW#lG%?LotvWpt9_;ZSvr%;X+r$xy?MCvp}C*kx+vjnv6gS}o80{v8G$eOaI;
zX?#1X2k_b{f&jRXv`T5lUIf)<Dl6kKzp-uaDpe@57s=V;LTPDDcQmgDcK9i6=jgZs
z#+tXH0f7lwJ1i@yI~dAX0Uts6@HO2d`Ex4q?t{a${OE?=@)7gT$~plaO8uq*BznqZ
zcx|g!Xesj)fzo6(MEd$U)vSrP>XrU)<bcMA$0B%JzE?M7$Nt*ebDAk(P)-<OyTC~`
z@{%F9zJ8v{0dn`xkoQO7^&{=!--=y=dg>vTJx`@_Sj9RlJe=G8GgzYySUo>5Iq+j?
z-~+|H7~J}sRT~X_ofVThey|eexCrWd=r^&;<>+mC<+;!9#{5%O$s!x7<8M0YjefvJ
z<L>4w7nM2Vx{_GC-WeIzJ<P6H78Q~Hf&7>e1J@R=<G$jz`R}s#5|!j`iVB=zYd6b%
zEN%&Ies`0^iGPo5^4nPn3|aMuF_%+TMxDLFU8Il?Es6_3UTP5-E_W0?N&A(K(s}YY
zbfSSSyS)f=e?sYy@?<tipGSU{u^e!|j@rmj;_+-PG>3wPw@l6|0UmH%&b?dv(a4{7
z_I|8<_+t@58Qc?8O6Q~Bd}hp_1hUsml%sT5&A-%2RKo0;<YVSg;TYGY6Ws;2wV}oP
ztvF?in%ZiNv^hgJPs`eQn)sohvd2{nU`UT7WkRAE@^c)*byUKdoMcCT*v?`N=Hb2i
zWN7okOYU`gGzU@rEM!7x6F1qK?4@vz6P{siG}ZW7dGq{hjzs_0tQ{Iobj{7vY}m>p
z|L(u)dRP0w2m6N7u^?9ltnatAwXaVK_b5BO{@sife`LlJ8_Rhp<?<fNg2EO6fK(48
zWQz<6-Df{{$*9y;-Z`lKIGd^*`D@sigUHwx`>*&#?)DQY-viAku4_Q)!PAxKyJecY
zJ3{UMo-r$LWr_Hv334{&=u+By_iPw>{xhV=*67*dWshdYt6Op)DupS^LJs{iCB3ig
z361P*$un}m2}<G8O3sJsIGm2ql%RfEP%-+*M+DytzpN$oM9rXDcw3g6-nq|^vM!>Y
zamr&m<evTM&~dDBV7+ZE0k!NWa8md8$a)KaE8J;@S~ha(F6D|zALy4ZavFcnb%nm)
zPbS?tS&ly?Rz^9=jw&Xh2i+(h>kL+;%(3)?Vf*YzYG>w-?coOFMNFu%R;a4tmTqM@
z&9JqZd>gz6Ot9-8S0sJ1e)_~skK=U}M=|(r@2NK&hyG@Z-0rD6w@T^DtIke}Gl$It
z!hQfaRQ8U<i)cxSqXGxp%MQ6)`;;5#5bO#o0|2T*<zdH$)7~v9uykm}uOVeG2FR65
z<>J70hC)P1?Vm42-jjDOFoRPcH7Ap~Loxva)UN+&|LCM*w3o@N#E$Fzcv@~MguF8A
zbs|1JG~<Js#}9_$q8uA0*#%!qa%lbs|2FvGetGp_d0UJNl^Q#sozNP~Wc)+S7hT&r
ztFqwP!^XOL8tf9xJ+cw<f?z}$e$oOU?Q7d-<)z+JBpG5OoYQZ=0y+7axD0nHcXBi^
zwK97#b@3(CwD$3{{DS9K(_<@nI1B&{_}t-e=g%v+TU%D%T!3ubE)m@2o6j>R7xu3p
zuTchPPR?z;3EqH?@@^F`T7X{j#;rFhL7eh77~w>x(a6p}{+Wg*JTK11LzJvP+&i{f
z)=6F+qzH_gVRep_6QyMHd=;h>&-u%z-YcmM|E@DoxXcV6e+wu^qte)Y^=>_P2p;*o
zQLuggtf^HKRfyy_sYk4pwJ4J!aVsVqs3_T1rNiL);aDhAM64x1{ok2;fK%{8>H{3d
zp170?IOt-2dKDa8dQR%8{oAu#$<LCh_XN<_e%ut)Ie6Ha#*&^Gm~+_tM&C2R5e!p@
zCl2U8nWCCBym(MdlfMG~d6TsMxqC<CG{@)4v&uHG)aCSEfFnvH5PYxkwgYLX1!b^g
z$*gln72D77%l_^0GbdM@ly}P%`XBX?b+r<xD-4>;5cngQ@O6eg|I}rrY_J_G0eLz+
zcIuqojcAVa*Z~QL!VsR0Zmm5U`vv1-gZ*2hP0rh|F8$N-earWy8>Q<AhvO;V4oBN|
zn6gQ)H=Ww?DOIA3i|~m%tzv)_xbrknXWgPMz%CjmZC7o#%JBT%2Z}1+(t}UmW&txV
zsUH^2DPhY)DcZ_jry9ShE_6FqH7U~@IlzrSaVj7=Q>qcTd&(WbOFpZ`pP;MdQ+Iw2
z{3&;e8O0v)`X~69q52eKZN*{Jh?8GFKsW%8dX4cv8Hbu=X<s6gnAwAdN}256)~xU{
zpW!b$V>>Br7P9`#5B@$(^@g5unwh;NDB*3V0JF|F#VW{sO0guH630jw48Zb<b@qzE
zc>F$h|FzHB8liBW6b-EgM!=T`wdJt<^M1J_7`wG!8W93-DeF|^?B82PT<)a%=pysp
zDc38Z7*c46Ooa$DO-&Tjh8VPQ&s^$ZXaevHXhz-!IJtI&{*<m7Z<p1MRq&U*In2P@
zi!3K|J6{<7{Mw6aEKB0R=4+rf{#KDIGlqMX{TYqQBgcHa<?=c16Amsu->f6SUP}8g
z{lbsnd~esx&D8|ceZIq%Ps;gTS^VT@8b{GK&ZL@NIb3t*`lm3)z87BU64EZUWE-5y
zq}i7)e7eGz@L0j+Z!dtmk~|k@=D?u=>d{1Zu#t5<TL|op+hLzobYScjItJBSk&;6H
zc9lEL#9j(~J6}Y~@(P!~tq+NES=tIw&$KRF%cMJL821cZrqM%`63%~Ldn}tW1>pP3
zdqMniEDZ8<;oq$dB!*j;w|;uIT@d`mygQ*@zt=0%Oj=$9o0^@J0zABB#RxEERgH%I
zq5xzoE}YhsutE?2&+MC*v`+CJq8zP2N0)I%V62~4<KPIdD*(CQ^j*&B&iI$Wm!(=y
zqaFxZ$>*-~H>1}b(K4t37o}VEso(NnS)f3mF5BFlhxSg-jR1g_#;>E~Zizxjn+TgS
zp4ey|N^D=CyrF6~Q9LQLeky^#qpBmtuj}ox3sYBjFEbp_riI5LF>gJBkdpmH8(aQW
zzFHc*pEqfG);B!Q+MkvGTnO3WlxgiHWQ+S|+mcgdeeKiXB>=~=vO`!j5-8~EhjHV<
z;J(`(;>^%ESb-B?)>cZZ>BNOZL=ML{@#nMC=L&~k9Qo-V4tuYt&_Cz@hlKJV#9Ash
z??kI>%^Vt6mTokojeNvlkDp!+wNL_ov^yWGdfC6z+d!Xl{n$|XoAdET&X305?bp#H
zr-~d~DA#|7n$%PBIpM2d1J*>C3jAjlVsig@qQ>p_YHoV9HqN|q7nH$@WWaP2zt?*m
z*p7jiKpN;}KxmGZs|3ybYQmjKjYvV_N8a6xMdM6dtIyF`;rvP%>|E}a3KwUV2!H=6
zOII|yh*v5VU?>53g++=ZAn&t2mzUV~P-N!yi_FdsBQleD3+K$Pf;)?2sjL!&Ye0hx
z__j6|V&XjYTZ8@-0se=ql&!NfX`EfQU*p?%;TS)ZW1+CqdG!wC-0&!Xa^Q;I#hAOV
z7f;B`MlnXj4xnWlw4?ke7PQCuy~M1AnG@25E=G9hP<DT|voQb1WDtJvt5rEuHUwtP
zX1d<^PS|(N=Sao<E#0Pj`Ko$%1JMnZhp;|FlwV}$oQVB?PJJYT>RymZQ7lWz{Zr>|
zk?)>UiV^PWMKU6|7DtLcYH%7o<Gp@zM~aW1KDD5!zwuw-WpyF!V!5_S5I{SjrQUzB
zY`h57wsU&8``W-MhF;`oic`cqyMb7^Q=F}q-V8O^b%AHC>`#~r@N;v<wD~Zt-s7>x
zUSy7m!VvD^lP@f)AAYLs7AJV~XmJwrEdkXaP`>!ka?Y(nA{Wo9%5CUKsOmZYB)j;m
z7IG8e&e9BNX-fhpVb%HUJVt*4aY<gRYkxXRNm9%$)`w<B$(QWna-d}WLX!ihbrtc5
z#Ppi+qV(EW#sGGM$~b1GqPx{6Q<?scClK3#j5sCzJ74){&6~Iyxe0W}*P(5ZUg-|4
zBrNo!&9wlp5_;RITT%N*_N#v`gd@zNztZI<CPJx<9P)8t2mrYhgE1;SV|Bb9l2uIO
z`2M0%#b}aIG9rZYHRciPF;@;fErnRNf6WK7Ab^~4Qm2YMc-hUKPM9k`={%9XBc@Cm
zO4<~tpjJJ7b9se((!$V9oaUe*aBH<E#oF?t9)d#&x8Zp1pK}#~YxqyTwH3J!ShbPj
zdb&P>Iw~1cR&2^@SFbkn)0Q_Y^uVXYM4HLp1t$4BwlAYpSaj^Cc^i+neE0Xw&%*XZ
zJ}YfwIH^wAA{%Z~v;PyH>DNO3a?Sa6e7D=K(Fc6=JelL@$n6gv2E^XGqwDQ!V<JuK
zD%vOke1F><PNL9Dnz4Hm!@3J!y@%IBa?6jJ_x}QJdLE2{lVeTS2AH<{VeF)Pl&t@f
zu|l#^(m-n+)cy#0`&Pc;`2tpi9j&MQZ?{>7Fn>!5_L@-R<OAkG_k-a;<&oys90&&A
zIhE$O6${6Vj;V7YU%ypjs1@DGdnxqx7olF4`}9&J1EkR+XA&rMjjpXBP|ZUKHT6y|
zZqeT&v|aKQ`nkV}`<|i{z8e_CeOc<R_oE8sy7jI!lt9S>sQ!iYu69(?%t>gVomh8c
zN$)0u;H6i_exp+UN=*;Flz)w+>@4^)Q0$=^7|3d58ubAtkJoz(_NvDNy+-rSw7*tS
z(AiZ9mqC=D+lnAe2cZlRG<$Xb>Li#flM{P=5Lb*kcF-WVJ8(gKfvjenpvKi8`Rn4u
zCG?q>p%4If{J@H>8AbA}e7nO}NIR8PIC)E|@|rKLcP}_1M^Oo6Z>*e3ue9}}S4uX}
zw-1cM*E_4%gFB8d9&<ME<QnM3zsG2YlF&*Jp2IQHSo-k*5q`IeS+3)6j2?ibJx<l0
zxx(5)LHahe!5*(=Kh6^zbfY^QdwD%{3aA$>CuvKK>k1bY7v2boW=k)?JzzM0)9wlz
z%_tttZ{qjLLL$?7tOU`f1D9Nz6zB=vzP-qY@qNXNepX<1oo~D6F|V~7oD9Gc9(Tx8
zd$}amwnoyg8=(<s)C=ea=@%qu?Iq7ph_|jf=PJ8`gpEU(x9hU5CnMW!b6u8&fPM8r
z8>%6F>#+=MeJ93qU0aT`hyOju+l>o=6sF>x)a;AR8lpy?UH$ol8hsh9h&DiT5`jd;
zN%~1<V0H+1&5AL~5dMq$1~pN7R66MTBflO_7S1cr@apLMXzd>8V`_BI9ZY}w46d&%
z@X_xLwaoOGf&Q#V8lku$wpPo<(A680RFhX*o_I_swj=}zvWYW<IP&1-9<vUdBSs*z
z(BM$TZf<m2uB*Czw2^>1TGO*XB^|L^KVS9hdQQ3*=X>V9wQj>-#|HF;4aed)D_#mO
z>$P`}w<n#Fxi@=nj(0I5MVM_kX0^a1sa=+K@g2D))-=a8l4urrPWda_aV5T`W*?0@
zRF}6UaMrY#^<D8B_fX9rNxDvtvXox^ombp)x^_sfIQKm?RutM8_eBAEifvx!CR4qD
zV+<zOb@3-Hs0m?fKdTstJ?%}OL&#=5-Y?(#@+jeFrhqTsc?o+M!VQfGREFQ=m<oBG
zaztL4VtYvoN~^vn^`JwtEDkqBe0HR(G1?t1-20zNNZiVBv*6SzO3?uwa(IQiG^1nl
zhgcH(nqMY|zqyk_TjYfP>aTz)o%6R7bBeK>4mx$#%+U@`rmbyl7%Ue9nKpE{|4;_s
z79#4x2Rd3`8`qC*urKjQ#NHdM9xbYTzg|Se&y!i)=gd|*JcQ`yB0zgB{8~~lnZ5-j
z$7Hg7Y_Bh74}IU{4v{x_N9Sdcs%4p<|Ip~ZxFW|n4f5Sm8idDl<Ly-Fznnx$JPPO^
z6<J!YF-W?7-n}~$b5kj0rx0zt<vVy!l0~NX6bsr!54s`s>vL|%QsLAsPzW%&IvGi$
z``oa%3dSb5H|@{RK6HKDDil<lD0HjM6+&6qnegjzqTx`ssUGHVbrgl6gF`F~e1AQ<
z=$`3RYpawNjgxz*Iru9w*O_}Iwk_=OX^*xGS*H_wT4VgB45mHHd8ICDfqnE8f6Nve
z&3qNf^m>bdIGH1^&l(zda+c@al4=kaYen-H=lCwjDp(*Q?5BUVe&RQc>CAe~6`Htl
zOFP+$*L6`m8~C-4ttS<ld25DqS7#_SnuEMkyUouPPQzt=r4J*e{1b0;2_9VUFHgi%
zLt8kXKH~hi=7cUQr<==lG8Sf_P^Rld)!Lu+t+-ovL_xLl++}7rc+>|plJh<<$2bQO
z&;QDKwz9WCz8hM8G$%q6Xe|b0vgm;~p-XjFf}FB#6|%AClKDg;!w}l8cjA5W@hRLv
z?+kD^g5Ip1IQZsWYOw$rGQ7#L(*{Mg96UzNpXrXwNw!z8ys4sW=t>XvDukFZgo}5E
zX+KL5h4|$4_XQZU?-(XFZN-|VhP$?(qBl@z^B!h9hRf@ycx`I=rLaENt#Bvl|5`Cn
zmP|hAC<s9s6$XaihC9XTWbfNds&xqFmNP09DyJ`7qXmhc{9(ry3V>iQc%_|JIZ$c2
zxl*N$W$A+(IIOE27~=8VOUnL5aRr&ylR@NG-*?Iw=Q~9L#gm2NU3BQyd^r=?)ujcX
z>@;=ikZIb#a{B9`q-R0_F2h%qPD9xiC6D`P6+b&Bpe|%&nQE$pS7-n5U@zDH?!vQQ
z;z^L96-i-G>@pTJ@9z|;xcD4>SvUH-!<<f!XI;`7J2skFf+1^;8z_F}*OxIQ?ib^K
zbXk!(G1L$HVCnO+nM&P&{IS4yHhSL3%BNrRXuuwsCeP;x|LIlkdlO`P$BgwX*k1*d
z=#^g*2VOHjv!}hEqeMl}Ro~(Q<>zqjd2NR_Uyn!*Vb}?7FK_0`F^ozNs~8GG7H&UU
zw3x9ODq`B1sJS&(@OWPU8%t*2l@4mX=lR@*bl8eVVV8i3OG<$<zs~w)(&@q0$>KiE
zwhCDyS@##;B<CU3yReE2Q<_2}@oj7yQ!pz?04`n%WIm`y(6mpp^tFDGzQkF`Q)&y8
z!jwf(nCv=r@2Es_W92E7B}dKN)b&WJhisV?D3U|aCcdp~a2f0Ojf5<C*J19GDeEA=
zGy$$y-Q1|wXJiH!VE8YTKyD5X(TM;$&q172l^ug`7)T?C#rjA?bIN^j59|Ye;XP=k
zf{584l(G<448%Rb^4u*|J8VPHl2HJ!Ys53`d}VG)<_AP@Q*U7IM_UC4dMQE?_}Kn(
zV)c{lP|x_@(Ozjb=5|u%QHnQSkR86nKSWzt0`u;>wL!|1wZF(Qd8uc;p{HC{&A4jL
z^p`p!*+;6AW}(CCeOyHf%76CBN{H2vUGY1V6kyTk9JnA8?flPB9;IpQfBVUrxTQ5H
ze(nK?&;0@CD|(CVee_s%dUwpxmlUN+ukhd7jc`>NHW4no13F%|=K&{U2US#Li#TL%
zi-sgmt*OUT_BM|g{r~MinR#mIIxRC1i=vx`xrfy@P3hP1r>ocktghtTNQpfiRG!b7
z%>gv}6+<4pRoPbNA5L!InHlnhN@ojc34H;^+Qbe?Wz%kRQ(0|aERW3L)_%qyK3_yv
z4#iqPG^0qF<r8L6-tC2Nwo=+e8!{}kC{LoAWVawV{5A^WOgHfJdcb3pZR15uBmper
z^*^I*ALnD#Jb>-g8_{u6xe%1~8gm5Ua}q>8@Ev1MTIG_LEaFvyiD<G@mHiv_1<5%Z
zrWX|#!P*Ic?0tUPoJ|DT_XpdFRZghcv!=oYacXnwdVm$9+f5ET+MCiXhl@r_DadDF
zG6rQOeHN(Afy`V@#>j+`<6C_EK^&;oOx^{4DKW@<{Tu2$79jf<)tGAnQP#sP)tRrf
za6edXXoeRqUY(gZ^H5B&zOAZw;6-q=L0hDq7|8&igOZL4+xCqsLQ4=Twj+B}7lX>v
z;naP3`Lx6C*)b*#bA<KTco!LdmxOov%9Pg<KNocFeDz>IaG|67OQ#h5UCOxs3G38{
z9*)6+xxcj9RLuboTivA!(Vlznj0B(cGBP)bWa3hm`B#rujyzW>WgNd!7~h5_$vECL
zT<8KT#NRur-A$~7+9tg|JJj#$vo)9kz0jMr_)f-_EX|ygM{wl|(uWXLMz!p`%kc(E
zfF<u#1=|?k4at3MGMG%OR8*$Xl@2j-*TcDH7Eg}|C|7p3t~Yg6d|94T;W!Ar6$ls=
z#N@v!?JW4QUo3lJ2+Uy-o0NyB3A;7^6Sw(uyb%8HI#amyh(x}hC8T}2hwPOO0X`-M
z`nXQQa+E49aPP~}=<IVtkld_<9>3QN4jj#=pV@tA+EgUib=5=u%q@|voPF<`_Vmjh
zjt2-+K3>R`+vXmtbled}c0U?)JB{9cublVN%16EoJSACMRB2gFPh}L5LLGA2=uwgI
zgNA!Xk&i8^&wqCjU3l$H**V$D7_xWk!xK3F$G01S-yIg}wzx5Yv2>UsVTUv&R~Bcp
zK8qn;qRoPQLY`OslANV#S$u7b8)(x1JDt7FI_rp@lofy&^}SVWqJ$WsbjM&AoXeV&
z17s$9|635<nzf`y3Hau66W<wIj!loRKukM&_R!NcYg+c`ucQXiU)LfC3r^>fkstgk
zL%r=oS}VJHxqC6Jh!iCO?;q_K94(n6*uM8uS8_vCjZvWd4d!r>tw*gCuv3mQz`r96
zthCB}-2{KUgF!;!VYe;yDm7cLCehKxIE54}4q*PM*2ry+6*wTF_VPvyNhUWL0x(>0
z2wp9Bsz%7r`SpR%D5dWOWd!lsP_s<vQuh&vRrG})WkX^3^E}huvTybJWZCS&!(ul$
zSmPJ{-Oh;qV$bHOWWuPLe;KX32age1y1Ex;oxK@>OBV?$*y2t*%Lzyphe)Jbd{H0<
z;WG~Zv9e?59gsReI)z#1J!|uhfM_p0O3s^N!x+{Zj;DuD8qR@hv1*V?iv?bFy}I64
zR?6(m$J)!0r<adQeHr-yKLYy9a$R?GleM+-$u;wepa9gid6_wxUv@H538mIi+I%JS
zls%@n*^cO?SJ&8_>9$}N>J`_2qEYhM6w_W{$S)@}uudc>i=X~=XRp)>G~s_AiT2!!
zOU&CV(u)?^Q_m##FSl4KggJ36P#s`f9bQ4>Zg-cKzu!3zeo7m-9hI+qKaL`(sTVbC
zMdr2KMQe31YdO(DFB2bOcf`v3@vnEZDHFiEj$TRg2{|aQy;b%-I$+QCLs4ePrz*~^
zZhaQ=lR{nif)5qcu9_7m7IVAaKfXaeJBALv^$@|U6fZN>i+REIlpZ{_po@EwxqW8n
z9WKY`oI}MR3(m^IJe$EnfA}h4!oP_3CEPm2o@3U^IYQVxiTBS)JjFXbE^a{nwE3jx
zK(W?79k*nZ^(AZ*LL0k)J5QZgYmZkAl6+x*cblw0gFNk|<yXFMoNRYL^hDMi_O0`b
zH&I65ect-j-eC!;JM1>Bg?k6X-u34@%QtEfUJq5IB{tOPoo&uj$x@G8wh0Pw1-yNl
z{YAa+#fj**ebRUMJC9!vEG$fVBO7sUkoU9Y$;P>>L6&U(7w^CA_{a(Ra<fmmCsTs)
z&XXYK)05xAFK}vIu4a?}CQ<d{ouER^LV-!y0+a;Y+1cDj)se^-eewyI{gVEgBoegW
z3tM6ci;x&&<ne^2Io)nM@KoGZSlSN1&abp(Pt;|$vq%~p_w#g1PK4=jD=GSrQWw8I
z-0Eo&UwyxSoT{g}A;_e3CKy)tCgwDBIQGM5anExD^9_1bPx*Kyf+V}2D2er=hq}6t
zDVjX(ZRp|ncJq!U@q4??8#$em)3|wO@`VyQ-}P#|3|(y9wRc0)bU$4mK9$x!Baywi
zFvVx>!Z3)H_w68ilk9f7@X}DM+e55lalr(?u%st!QN-R;16fWJf;HrxP1|Q&9v+&s
zQYYEVTfe9eV`~sz7mv6FJa1(^8FD-*#_Yp4!Pe5r7t>Rdp}QW05?oF2#mR@F(dtV1
z&iancy}L@?pga1l$f;t!B>ha$yoygUwza+9&66%4Tf@T^DL*jJi|%`1f9B7}n=2lI
z73O5)%AZDA8{CjqwSlsICP!5TtlKExZp+)C?ul1h{GTyj_WOt^yZk<NErllu{kuYr
zfkWKe86FRo7EGRQwtOuAWtDJ#ls9-i>CtWM4>KW0e<eH4L=pZkBt3a_RBi-|W6$`8
zFKvxS>|--xrG@Jc68F7Y^1_zO@%w~ykNo}h#fuYV5Y9CGxA&JUg6v9zgoiUo{U^f6
zSL?I3^0m*WlWiun_997erHVd5j6B=yRjb$1fosdM?<l+3;%8oVTqu%=krQZ{UQNfB
zfYfgqEet<trfueKjuT+8!EP*I`SZgjKbVW&lw?>LN?cE9tq-m+uPxZgb&#__4o+qo
z^602umiK5~8+Bn-s72+(gC&yV=rOA6`=4B?5RN;(xMn7HflDzrW;4Ov5<pMSY@1qT
zePAo|6E9h%k`QU7C*F&s(nz|WoAY&KLB*CaxZ-}rPH9vyj@xhsa$nglJk1wB`55C+
z9p32}s+nKvwNMS@e&QCoW;od>a6QU7b-72%@DbOuh;mu2U|j0#ld-0>ZW-R<kJu-J
z!={FxcyQ$vN*@?zao_fV-2GkbX#v)sMvUWQw|d-@Ictp-?~F(yob+LERWLcoqO2vU
z#oC+De1fpgLZv?|%7q}*)<%H7v>qQ*xQ#^DxRVn>HGPW0JtH5v5V6tR5%q@ok3(6p
zf;s{mGbSfRv$ED7*Tg{<QNUpro}I*3!2LNGtZYYKp1DLEfKm{($gH13<bW+zg@;}>
zqjle2eQ-MT_*;RhlsDGNUN&O!^kV7NUR2tBSLA$|0m#CfH?@UU-{a<#n7C~|BrsI+
za(KA)xI<t80#;YzRf(7K_Ph7e2#UjVHFH~^2zB3M3g>Ak8lsxcw7S~{`GH2-#^>&*
z;?>W+3S(p(nq0h=^~d1<{vt@7C!Dx>iLy+6XU4fPQRG0%=fL54qG|U&pg+VQ7i{`d
zR_82!tNi4*!pT>WTEVK|no#6IP3ra!a#iUCl6Qy*_xm0~=~j2Min;4bksaxSjw%C}
ztGPQ(eaU5zOC=|2mBp8iknxNIeue~82w^F3-DPu<Grv~mrWV2m_37hKzxgoIjF*XZ
zW8zd<hA_~*4{TGDz5LuluzAURU2D&w)s!7pCmH^s;meoNF&X~PJf*^Dyj6;bsn^?c
zWf|J{M_je{misiNmY6y`eGP*<KY4{gwMKnPIK$aFu4`7KSP??p<x!VJ9pyHKk?8^V
zJr&br3h-e!_%|1Bsn&Kb{c?(!boAv+##PMeNw?Z4iPI(7GIzTaP|;4fw~5a<X(y*6
zL0&qJ)N0Lv3f$gP07B))ke9`0c~T23xPF_sSkls6?KkAG8nl-bJvPuE@@AOrAdC3I
zTXY8@UT;93t=%xj#~;2hJ@}{`-k-N9r|a9x(eBMwv@aajM5|cwm}g+GAXM!65^-_5
zGqtvSVW^E~pse;Mhx9bVGcO!ujY}b7y6YAIdD4NYnyc0XIx|193Pz*XIn<-J-s7;r
zG`if^FEM{3Xf9)2wUX(8F2Z4_gx(uhX#<el`lOTJY~`P|C-fL#&0Z!XrIUi=w*6PQ
z>v6bM&(Ej@7z|=P>5nmFNa9Hx0b7II_*?w4=Ib}k?cKUg8=9?VS{N(C6u-e3H)llG
z`v8~}do#Dmh#90qahCfrqOUd53af37`9_~K`sz)tyQ3)00RQ`yLPjVyYrk7EjnJnq
zHIFPV7*E3wkUnmuqTg4)xAs#kbHM6o5(YMu7+Z!|%75a$ubv+jSA4!eP^bMBy&b2)
zE*exMzUu8x?cV&RT<wzRL@wLU=%><t^K0hvBEogf)u5>B0XK;U8)IWTsguQ@<df!P
zO}>1797<eFBeYDb)MR}!eQ?Q(^SRk<RI#h!*UsgMC~o@ooiiNqBTY2~P89eKdhVsH
zPe~WZZka(P1h%tv*EV6Z@-AwuY-PZJ)sZtt&NVS>Jl%)@gEjM3jS^+Km}5r7m7m+x
zcwl?nx1n{IDgl)cjxi@FYMteE8sKe(j4+3KD~|Y$73@+tE8VT4zrEdUjR1Dn-l%(D
z;enORe1I7z?o@9-m*p(6<LsQ@=T7!?8sB+{b7-?RFJF8027<H^0yteO5@ghJEdv}V
zGD)gl4chfl(s8%Sb_nnGd45TOc{}#z!1c`U2a+u}JTs<lIdUSrW41glO#SrKmFO4c
zs`vJUDJ*+=#uZX`T|;SAUAx2+9nO~}v0t$t^`Wi3F=J_SO#SYnYcqOmH$~IPZe*hK
zxPs5U)~GJ4MPI&W-$&X^v*vR{Dw@hGGI7M5wSIF~Lxt}<HN6Zqg<N~|m}^xfT3Wli
zbJG+1c~k0Pv9XCT`Be@p`?hgG7VlM^guW+^aGhxq#ad#FSmzlEx;yO81+3LGuf=DL
ztC80F&kwcS;j?obJ8hbq?qp?x*sZ%>xVaFU+=`p;bW{KU<e8I4NB!En&|CP8-6*A0
zo!QVgjAb_M7n$v@Cg`XVtDZ91S;9`ojJYa)ERHeyc^leuyu43Tv@TIrA1ly3%Xi+z
z=ewm$y*t+0v6zwXv_g$qYbL1=;5j~LG7rF`2zm!7(j$-<!aY(*sH$9AcfJSl@pg9;
z#MFXD9e7m(S4wlOM=E?UYaZI-qYOG$(Sgxw^SJY6GZ9uM9>7XnJ(*OI9^g}lSD2{l
zbm#S3@hB5)@q(@Uyy2_1z>-wZ&-h-xdJ}1%O-P&W(g)ecL(AFaFJhWGpsFliwV#fc
zyUk1U(Y{j~#jJBo>8<Ku9pcSNpN9!TL2O(ifsVD6c5I@;J!;MjJ!4lZCiC3w#|aOn
zN-Nk3H*Y+#2`_V~T>+(n)HUR<zIk(<KOC(W-<9*eTvO!Xhp=W_zReYTW4R=FA)!;2
z5|7eJkM=YtYb$OSIM=DIWEXamfOTn7U$84IGX~egmVQoUl2HyQWBOLDixztMh7w&-
zMH-^bB~o2a^4Utvfer}atP3<t)eCHj3hCwenXt~jO;^v_Jf-0HZ9Bc?rRwYT@cIV*
zqio5Q^nI^gDJHbOqe{`r@NX}Gp+Y0v{JLn5(Zo!|MeD_CNJimQVzSaeQCMxbwC|>y
zOIdmLm?vi#+I&o*F=R)N;~)#tSDPCq@9dKeO^SWN1#ptU3MTTX+P&N+r$`$<sv&QE
z7|hQTiZk_87?X5gEsA!`y)ctix4$-&D)(h?G|FzXup1}u!T&w+83+W~dd0{8+<NkA
z*Svq-4NeYQ?&?=6V-HDd!%{%}3k2v>EB2CnX(B#M*d?*tdBe2VP4tNxX!55|4(ov?
zhUlT~N_fFj4_DTiw*%{F*~>E%>J@4btcQ2FlZBbn?uJhyB|hE4{=}y@4F{dW&b8I_
z#%FR>WhBqy+bP{>tZ&6*;-zzsbg!a0X!GdD-uf@dx~!Rh7egqgHLh2?t)HID(21-d
zYK)UB%-eT_buQ#G)SgUnFC-;e+nJZRG%A0s3p|HF(BgqPYL!YM(?HXfhXS5bqti8v
zRF%(spFeInceRY5waDi)qs)z%Hrik!1oN2hFK;`rDto4h!5r4*GLq}2!?|-c;KsPU
zM^1xz$)9w(Rb+DWSYyiB!8K$JSI!WI8u9}-y|r%U>$3?dr(lKnsNF&}S`34Wa@g^J
zs84vI2{snhQ2LlAX~yzqj>(`;hS<vXb*xS3SgQ^hJ#X_6<fKxY>QOL7?rjXgf`eeZ
z+$3%^Uhm+_Qrf<lcV>o+&gPPr=Xw-s?_<R%vy<w%+uR6OVV~i>wC4RQEa3hE!)w!a
z9DYXLnUDHArQ0WBZ&=!jxCWsqQjFplGFGr21Gm7Hc$n`Z-g(24u7$6+oP)?_2%L89
zQwOvS={=?gBt1$*XH9aJ87JgPd9NC}uB|;WUz#M@3h(xI0zPB30<9&KHhk)I6xLsf
zj7bs`J4e%v((R(id8`!|1($XOfbKIt7k596R7tBps>@Gw6BevPI^BF-KBez<0;903
z<FuPx-Z<7i`!!OgDc<>u$11unY3>28l$fz~t*)?6G?6D#DSyt%V4kyOQP0F{>pSkr
z*8o(>rU`qQ=~Bl#l-%`X+)Yty?1T0~+04Bp$|d~u&h+(+O&fXoB#l?raj{17%$jp8
zUFe=m9Ay(#1jjLQxKE+*^963*-Id8#8i_87@VsFu4<z0T9HKBbh_q#Qs>n+Iptv^h
z1!K-3HLzD}mbYNzgecgU+<1f+c%t04v{iYXzrPEuoxkTp{I%WvT@j5Af~~eLZSlIb
zbZNHyA!||gtEau8rz_0QRn8L?yRmYh0;bD$FY~?xGBI7+&C{-qk^ZL7<ytF!96nUx
zux1WB$;Tj3WbpW*Yfr#!4Qf&LFXMHag?7@ScX}w~Mt`qPstk%7yf<E!*t2OWam8N#
z`kt`KOV-(+QyXLWyk5~YQd06XR!iCYyZQgU@_SL@NSt~wE?6UY6oRn1Vx%!GHNLWZ
z!_Q8>HAEO30&5Lz?`9^NJGGUlB*)g-hAu5!Cr)Jg47~UMIWDoevS3v!<{}gm`?WAJ
zn%h09+{&R9`3Hca?|da?UhTRt416npDLo4}NP!J5rnUE>CSdPvZ|vQ`1zZ@fq%^X+
zA}ZKw9=cRlA&xY3U-cL!YWl4gLR>Z4MQT(>B7o_H9i}U=7P0CI^o188MHxu{1$^h5
zt2Lf(0_H(*^od+UTV>VO0#k&|?)%t*$*sutnU`7tcBuM9OA<@<MR8|S7;`%K;(9;P
zsZ$4S8=RPdtcLh9HK)`nZsYF%!am8mpAu;ye~`~6oO=5yW-bXoE55$7zFp2^-_GA*
zo7p6Osl*f2ul|Fnv!@O}G^8fs(C1NnArLsm&n53wU(wvTi_+!l+4Y|l95V@<_4sTz
zAnBU0I2{(29{c1f1%l2EqBd$it=5;>B^GzGJZbget_+VIVD`e3Ki1Wid+bHw@coH`
z9;6<3m5u_1#WPvO=`8>^$BEXE<G{kp#aYBbxo23F?k5=62Ocf6CagopXa=v@$Zz=&
zUnj!crT2}g+o70`7M}Y8^$w<f#pAWHnfQ!^CnnbkCc$ca>lv~^FvWe6y#+aO(cpz?
zczigIHwdIy)QujBu_iGxOTS$R)L|Hh3e+gb%bmgzvivPTG|=OxXZ`==S#=%si}P6O
z-3Om+K0y%ozbwMw{fu^MuHw4kNk)QPmP1b6mcC~INPeaVQXbz=)%fXqeWxz-Gq3Sv
zJ}+FZD%D2<_tr1@jyVF?a&%6J*JoZoJ728g6=w5ze(C)$qCxLC8MqX@65HQ6=6&@;
z>M0vH1d`%;^f%c`60|s*C!~~bZWm|@&1^d)ZFE7un%e6wV&IyTkmg!7^3vM(<!~}~
z`W8|LOlZef;Ms=zbaDxDKCu<fL70X1`)Ix$Jn71Ey4{>fQp43tcC@bJH_QW1F{U@o
ztaR!(qg7gM&2`SjaAQ;xt^;06A3T8m<WP58O-~d}T3KF#!4!dPpjx>v=1&C?it#>J
z{ufv?v%PsI$gpC1RduUf&Sf;YQ?TxobDvevsRdX3MVjpgEM2uy4m&l!u_t7tW83#*
zN}pZCu1qkrIviBvo<vHNX^pQaYu4S-c3mmVA*8Wg;Bp*S2Z5TGZ5qwSNw5kgQMD-^
zJ5$p^^)t_x(h~YlXpC~EZ+EzO@Ly6P#(_1rZltCb<YkAp?6UBrOD5`P56@JLv1zxI
zd3#VMjb7niXrgJzC`e+Kw!#uoo10XjxKCJ!P^uS<Rxkgk-D6k4%fGpJ-DhJ$Q1l=Y
zcVCe+y36XP6uoT4Ck9m|0gi9WjL-XK%{mIa?%^}4$K*su$9*KrnjR4*;;y+zFKOjV
zURwJ6{V09Xz1ve_*xFbf{X~o`rRz5PBG_t;UFnZcGy9a7{>oIIS<sh=wD^vkEGQMO
zO%8;6QT|Gb)rGY?iK1>{RfL8z*a52wD_SF|$qfxI0I@U{NEHY~H;@J+RLg_EX<SXs
zkp4mZw9j`nrI%guj${0<7+Q%kwq@-GUPe>fHFN)c0i@nzgur%X;b`qiZPTkS^T}Cz
zhHGO@IVeF{tbB{9$Bj6x!LqBX0Ws)9ehwf)u89#!UeCgAyXfTMIsY4Oi&nMQe4{zj
z-wk|IR~TQKybcdpQ}y&!7OmnP`vxz;3<tG$hg+Fw6?>IN)r2F>_r6q<W}3=3=~v^e
z#jPso((xnM^{gtV7P+NzXQT4~IWzikRa6iEq=Z6b^w?c5iF;Vd*6<#thiYlU@SUMq
zVW8HJGEIBtus}rs5~~9-GkkTh8>_u^Ro-*6=WW1#{GD;bfIH1ZrM(#Jjn5?>wNI+g
z^9aZ0z@6nud$kUA)9RkXM0NnOdG$sN<t9gYAhx#z3e}`wEV(nd&pc|ljB$4w=L@2e
zT^Ff66?&uff<ceG{0Pu%{N(`XwPX5wwfLFw93arQV=}{6FI)%A3ZHT{8?L-u&y$>0
zb^dF@b2$a(0*-I2((EOwfN%XGX-;-nzh4iaLm`awGCd*j^Mv`bT2i-JV|$|Dy@er`
z_6Kbug)8VH&k^{d%*NJu3FiE`8hC4@1s?=Uw<E>zc-Voq6}(2P-VQqES4H`B=9zLx
z^#P~6^OB>I6yLR?oVDbEtId;dM#0~hl8{yXONlVPg&{xJ-E2l?9&TkNj}ou14?p&B
ziWW>Ux22YDZ&%mDrXE0_I6YatQg6tE%&!>J|2oml*%`9;^Vzg(ueH-d*ixNTFt1P-
z@rD86@lJGa7`PnQlSBalD^keKnL#Mci!ynib+L)DF|LrVcEOlDwWj29oX)@{Q~x(?
zRJ<>`qq!OsCn8S!eBRAGD9>WpD!;+sj~?`H8$6AC5%|gC!3W!-CB9EC`O<7p;?uua
zYOE<%$Mk8R5FfOl^5(lhA?yl`puM8-Z`wF7jSu&=6rS%DaAjmjBY(JO;Bc*;G<rnM
z`2b#%V{OU1SZEEoEq)+Jq}UJWNGQQZSJ5=xqx~fwuZO09&t<LrF9Em%7IkUii_D7k
zH&@LG3UIx^3(Ss!BHm`H0ebWF*MMe22BAc<#<(XWbW5zd<-@q(o!JT5OODy18>Y6&
zM&^p$Y8tn?yOO=XQv}n=S6eNn)6t@8ce`B0M%1-x3uFr11Wwy<4wen1Za?aE5Cy`o
z@NX{n1hS@)y~h!DG53%00|MQXT~R$vWss>$s~=jJCIzg%mzZ8CQ3MKJWL7^x<>=5;
zF^caOWa_rR+A(iR(hf(&J4QDF;w@9ko$Gv}Cw=0%YMpYz0&ApXR#au>45v<n<*iew
z%jVFl2fDN`?BKp3mDet^s)0}S)hv;L9KFw-0vA7yH5Gz4wc2fbt#FT8LKyUr+DBQj
z)Z-qwq_=eu8rdV-sC&U*$g#kcwnoR~CMwd*qSeEh6Kaj~o_aLezF^s^_AGg%s*tgn
zSPJzLt?^nFK?Jhetyl6iFJ5Uq@T_~k%Q<0r2C$mBPBn3jAP?;VR4<#|apQD$$iNGZ
zXI7PB!#Cucj}6vBge8lu#}mdrY}wYZ9Lhz-i7>|?m@<?^1Dc$N#}5@H?X#>tSs=vM
zlDKPi2nbRz@0eHdR#l{*E0<%ZY#U#O>p*7gKnP+opj4^WBHT|6I!}=;#gU+;nZjDq
z`9tCpz=N{z4NZa1Po;_-CdNS!h|ePJ_{(v>I;+GSjUx9>fE)iNi%=xnW6)PkAvFya
zD1oje{VCLNP4SY8rhaBXB#97Sd(Ax3V}t*K+&KC2&AO9e*OM;Q?CVlA%sMra!g01l
zJe0t9;oYE5<9B((akYa_W17cYiBT_cT<K(&2`$&vm+5#l*W^hO@9CHAyB%LbSyf+*
z#>p@ld2yC>xj#r#{SL&4)=cJu+<@>@G<rC=UDpTCD?m|)!a%?qJoj)6d(Z$PXY$uO
zH<K>B*R1@yfOoo=Gtf~8z<v6C4Qnqj*zS(Li}f&d8d|?ohFy0ofz8T|d5*~*lAA^&
zeNjXq-Ur(%aw)>wnO^v7zB6H$vy-_NZ+E<z88z<%=SVws8IFB0RWm#PKB`n`RF~h;
zj_f(=rFQl6&utTvK=az);aAhpWk#5vnZ2MhG?ZS6hYh+Ufy}1~x(c1mdh>O4BS6!K
zH-hiXOV*J-iV1h><c=oQ=_gA8H@X<%xb=6XKwGT}5_Fb+zRW{8Q7xfb_TGA&?P@3p
zzHJEfvb(~Ey3l;NnITcMp41W*Ov8u80!$db;q#p06YD!`A1VR$<t6+c<%~ZCca{x-
zzVr=0K<s;t@ObY!y0Yg*Dy}K@;uQQ?X^iWLH}dSR<?40)2)7kXC*HA=R}>|9_tih8
zXAV2{{<A5pLXrirvrx@cn}>R@GiWdsBE?-^9_+njVtd1E7@&9a=#r+y(nLsr!=jc#
zqEq)H6z}-MJ?A-6n}u6nUkEH%E!fi>ms#&ETPY9|nZ!CHsklGtVhs{aHvJ6O!guU=
z?xY>Dnc%XasIBd8N=)-ob`fva?j`J}A7s8hLWeBOdFu+R5p<D~SC)qxb&DG`Qwn(d
zi^(1^NxpXyvK7;xx$K@rK3zTCB-d*C@&ly$6G68o&1)Vw_Vk${XcCEc+|xDjqWP(C
z+{jCqi<J*O#F9+WCZQL#TdtaBVnbB-9xS@?eW|UUOPVKU?fasSIm9K$MXtWRUm(xy
zeJ(S&F}QOrUP)AxJ>5<Xw!$>t32mS1p@g6=^!?<;GBvZgW>ev>(-6pxLKz#rudm6U
z^fJud0qYKBt#VOBC;^2?K6hKoCK?v<z_q8ETu4{s-E#QOUA-6BKEWZnZLa{h5U!XS
zA$@QBUc&MVy=!N~D!Vw;qxlKxo>3LU576gKJ}kZHIbR<$)ZC;;VMn>v7jVNY@5=f3
z`+Zb=BkCWp)b!iB!)`ak<MVt!Ru<)P5AW9<X+ZWI($1)4>3dNaw=xZY*hTyor~B&y
zj-hzrSKd>z8)Luapyrf~&tp4G0AyE>LVvuw8YG+rKP;n4(pa)3)U3q;YqlIrLX=&d
zLubW%CfUQ%Ye$Ltx}EhkyS?iOfzug)?)da<?s>pi8PQxKTxWf<drMJ~zZ!)i&9VcR
z&9Eg~Uy20-``s`b6_no*&f~nB+@FQ7138boR-U;oJKN95d=AU4<GF5$fQ%{J+Y{W^
zgp+3P^Esa)D1@C_E6*aWElgYeT(@;J7q4@}dT(b~>y%O8kNNH&;j-fpA2QR;@C0++
zU>)>sj#9$wxaC)N6n>0`Y=>Tv@&I^GkGyc5yTt3UE|iF$zn-?OF|RVO%QZY%Sq6V4
z>q{x)5F1W|CQE9V^emRUc30*nY8d#6ecfE-zB^GVRdFVN5uI<(03B9#)|$~DJ-(fe
z^$OOGn0vgUO6BPIv!JnZwDkdB{DbA0y}a<kfP0ZbJ*2VQL#8huDGq-kbYGU!iJpdR
ze6rW|?k|gvvH9MtH=OM^wpoY)7ORcBCbI4oqBdFbUzvK~)VIP}hBbHEG+&*yGp|YY
ztn5~-tJWd@OBa%)T+OkzwI8BCB3virgAYD_DDHLd*}3^V%e8N(@ZEWMd+D)ApgV=D
zC=kj#xx94%Et#9WJ4{L)m>b&(K*LpIDApAyLEp2zJ#g)TQ1ls8`Ze?KRpyY`_J8!s
zW{c)A)Hx)CZIfkT9YB_%aB8le@mjTW!e_p;4(w>Rd}Ks;fhKJLCR3|Q>somvxo0r*
zw0Ca83J7P+2B(fqR%HUEd?sqX((ifWV8H0h(<@`k?AwpAoc&$!HVS!x@eZ+!r^zi&
z{t?d4Ep`x-fT4OqH*IyU8TD+psn23pKwxY_^KfDwMX{t1X_0N*<HHc8l4L>j{Ph0O
zGBr|8rqElq6yfB!ia<<{+5Oz3`Xq&60aT)*5YcDtI&f+DjO{lzzC4PmHrOZgVHka^
zgp$1=B7OD6C8}ql&9$W{d@X5h5jeu>ylY`XD6N;YzG3SZ*|d&E>T=Yq834oepa!?N
zNoyg+eoCbEBBNV@t1VnAodpWsIZ2+QnmgF=_1UpvT;{rP&He|z-}M|P-k094yFrPt
zEZKV|Sca<)i7hjHq?K90HIe`|q7uOtx0X7F@IJ8N{?ROYgD1mvwJT&TB?HV&3Gl!=
z%z6Re=4|XXIsH0+w9OL+2eY%bgK-o|UOI{OJnt+A@0>i@LExx_gNijuJipZclu8CB
z6!l9d;t3FUWB!76Xdnx-H>uklShtb5u*@gWd(TlU-<k5AsfSQQU@U{3%oX>jtVOT%
z^t+Y7u={4WYr@E;&<C21S7-Q+X(F<wuHK2RFnWeH_?b<(>uqa6lMKA7wG~M)=34u?
zPBkj7?9i6{zlu(8r8trmG0pJcMSckGTdM-S0CBWb1egY;z#FN_Vph#-FMuT5m7L~*
z(&UY?Cd014ZCUf=I)HzrIjr91<GodLQrYSg6ECE)$&Vh-Y8{D(A)nIZFin1jrZ}?v
z?=%^2V^$71{Bfm|PT%jQx4L#KphMmTpVRGl09AglOVJt<S(~q{>RhOCNh-X4$NkzI
z*H4jd53}`feY1~46ov2kXZ7sDB)V6r0gEH$-_qPX@4D$+PLcC~8W*2;BpUAMXYKMS
zl!cuN(AZ90CI}ZH{vT~$9uH;r{*TFcgv1n6L>m%evSw{3Yo#K4<FRE+vJXSbzEsMR
zPzi0evW6MUpt5D(jitzLtYaDTJNFFF=jrqP{`GtPet*_|<J{+5*ZX>3@9R3}0I7#d
ztnyR7<#8)o#W7)L^5|vGXrDcLnv+>B4g%OI*JQ0WWVhevtGUhL*ViQWi{<@#`Wo5R
zo@}c;NGepQ_4#pO>3ei%?%F_)y_FMRyI!sLu$@vyc+;1jud^lQ_4I1Ga8urD((z2g
zHrbU}swM+C<<X6U;-vc4B`!|uvOvbPY8aoHGO6QWP2=SGTph>jz1Kt<_Ac(m?J#_<
zcT80*%B{fw+<5;!u=ducD+Z-g`>Dp}`Om%t6$-yW-IJMVU*RhBI-4KT`kF;I6Ib~-
zcyE76!)Eeyd&U69slT`~-u1)V%})<8`tjGwel6_Bzcrl~Thf|HwN@9C6(&t}%Mx2w
zC)oN83Yu#Fa;F^9f<*Y~Bw{z#$9)Bo9(xa6JzIEDdt<yrZ`Z)b<Q)B<Gqo2Jhl$24
zSNrBid4*Q4Ml5dhuX8eSrPL9%W_}$=jeoT^CRxoj>**`fxH9q4-g9JUJ_?UhE&NqH
z@8gp=_0;5C?u}dnRQE{PhAJjG3(Di&g;h($20)X?_;76eS)zZy>Ma1pMhDR709B(w
z9hL|CwQpNwp2^UOm38T`kqmg2JSkLMcE-EcU(QW88`sQqUwFan$-qQLMUH&;%7ZhC
z8Da@PIliQx$%K~;kiJC6eU0IOfcfPWe42Z^Pqym04mG@ar%kr%r)XhwU$fg-@9blz
z#7aKQI-W5>964d=<!+$T<IcI<7%G+Z_oL1m`6$hnaijO=)>>3r-E}FH5XQcfYSN-3
z%#VBAg=1&Ea4%=;B|9tfYx(AZl;l^YinAX(?*0b%cI8}1sGDz-z`1HG=T44x(~UPp
z*XHLH?%hUptX;Aa6-*z?D>GPEsYeR5VT}%6t}k$jDYUSvRabtccwV8S_<i7=R~HV2
zb}!-_H&TgZID7la7uc;DDB{HH@Ay4|i#{nW2$D~3Jzr|{zKmAX>z>heecZbuM;F3(
z4NMP@-kv}iwH7T>%LpIEdPPG^Pve76e)Xkp!v(Q$_2ccMFAVaF9@o4?O}(~HpT0yC
z^PBYG3x9j9OqTcSy4vg!&JVXedIWs3y+UfJ<7LynZ7BlTOI(P_fdScj=Is|;SMRC5
zUd^9+T+llrG5cI-DeOGwm+Wr4?^{lFvL^jTp{+@8MzYz9YwX__FwK?uQTqHXeHTm9
zCdZY+Q@q}h_qI!hooOa5m!Yru3HtJQbfN4-C3HsKCVfDaxx79w+aP-{t4DOxAnHcx
zIP1r$FUJ9Aaaa33E)hkq5yaWd=h{#BESvd#K)tNdc-}jimiwmBG5n^YS~S~!=N`A#
zt1Fkq^IT#Y^-HffETW@u;XCvPOf*)m`UZbZQt#C3MU-_GKNtMzer4mT@xnrzu4F-^
z?B>eMGwfL8vsUlKw>|S3j?3J7UCKgbdTpw|!rFo>Llw^RKTnzMzOtlWCZi_R*Hx;~
zsWIt1E2}%V_RSvq&7^`)`m3B>$+R!A`1((Sj@W{$s^ZvKd^e@_<o7Yw#Nqix<w%de
zN0hT{ovhvUvQ>WiK)#nNog4n^5UF6&Ui6};U#7z6OZ|6=`941tStXs03m@YV_46oe
zDY~_Ey)^Q!W>^W&xogLRdE473ruvUOj{)lvuJqdb`{o2+-MMbVi<oCk9)#;1?%&57
zZ<XRm1VVvyE+Nmm%#&2j(m=*K&qiGs`}J(ewpp2fuD^66cJnoU6x^+lZ|lZ<N2p%*
za{ig&M^?C($6tDVyTg&JbsDKNbsfv$C;PUo-0)jimYi4Mt@cCDHSP%!QwdQ$A0FI?
z7rwWYxhz*QiEQGT>}k;Y;R&(x+5C6YC0U!&K5oy7RoZ7w$L<N;Z4Z`vMe6xcnEk*w
zTlcZKXN*pN>xa5)cs`VWlY=goWJp_qv`gOlrJpQmT{rF%79>}_lG|n`OWp^fwf!i7
znp;*|Rc9YUf8=G!Kw5H$rD1GqJ)YghwyB>I{-WwZ3d@<O-praD#fyo?jo>~cxl)rr
zidg+?F0wEr-m<J|%;e+odLLX;v}o$cJ!jIl^bzdrD+W`8+|vs?6Bj%k9kqU{FNn@6
zu9`@Mksikz${jCG85QP|9QQF^{IOK?DSWN&^O-f%PX06De0C9$Ji~4WmQqg)exQu|
z&aWt%IX0OKWIq!pWOP1uEa_?QP<wBWlPYj3JA5c56y4&jNAjh|oWlj_Mj3|)g#CJB
zY*jq4>S{afC3N_K$!B4vr&7Z85Bpq19a9{@&58+kcs<V1s6>@yeYcI8$~Pds^Bvg8
z6H7@Lh*>FIb>AsR4>od5Up<cC`xe(_cJ1dWxeE(p_RjA&cKMnW7uOuGR%X^o&OK4f
zRo%O|W;!b?BF<G&P)$MAP>WBLH3_Xu-^Nn}sy(`EqQ;NAo{4Qdk&trF)BvrJO%X_m
ztG`wA!uVZ7b5Z(-q~(&F*rxC{ztuaP`C6D8ezV=KZ)XRApgS58nr|<xgwS)1$cy4U
zuRQUKW!=P_&(}~}qfREp@W~NSpdC=RuP}8D&dNRGEeWxI`<Yk)%h}$$k5*+DPko9p
z)wAkUI9KcGwm4Jk(K>Icrw!Quly*dlZk^sZ=b9xe5_u*3MqIq1#gCUC?5`&7`uSzR
z{$+-Uy$UU7oV1-!l7!!DzwnJyG9gROhqV~=Olb1lYZs#SYYC(w*z60xyG@S@+5Q~^
zI)T*ODGTdvzBAIf-=?4YEl-J7ocs3o(XyyA1GV$tr0n&HxZ7ICy{LZmiBl8F?$lFH
z|D{~?CMbkWhkZ*#_lz*C-jnc~0LB^TF-<egUr!!HR+kpEAP{xJ`r)}jDOXkVMzl1m
zooBx|y4PV_UteNv%r6=W{XIW<A;m4_+9QJ&oDhE%z3b3g6FALq9?!!g<}+&peCwk)
zll@vUHX37E&(*wEnpS1-=8J<bJTe!R8d#3X<xED}@m3o;M<jJ*OqY%FtfKuwFU#Z8
z=aQn;?>T-xW8}S||7mxM*}2(=BW`0CpEr$m8W);9&e`#g(#zk3i9-CovMV>cVUJSk
zhTg2lqq^;0fa7;s`ck#}{zhFlc{{Se?A9;x-h5Bs>yhbou)ABa@ZP5Jcb(x~q&$O^
z7bzcSo}zFW)_kKftz-Ls-RwA^cXLWptGZ;PLbWPwI593<v&q><lH{sbQ#hIatII3t
z_p7i1?=ifnYP#DpA>Gjh8$rSvr4+1in_cLOD{Ni==$e`@U*i1kt7#`Uw#(~y{xTP-
z)F5S1Y4wa^uvYemmC44vHOa=`vSs2lds|k@9L6*GzTqZ&^xb|GTaGOZ?n|^cwT0!0
zjV`3d_^_m83n;58dKFP8$XAXCt1A0p=B$@~b~lf6q<nK}92<|y{W)p2(e5$)P-jiI
zZ+|3neXxqoX`&$_lX-H}OZDAk&+t`eSl$cXzj?bGOU%qcgI}8Rt4>bPFf;o_;ZBU-
z&psDQCj!yiNQgtN2!M_lWsEm@=3F;3ZXa(nS!tOWR!3{JT_X@ik7@34Jek`*sK?64
zhwOE0ZQ-jQ{g$#w-YDZ9Y4%qZyw<~Xe<d$P9@$aWu@^Df*K#y+!a00qmFetJ2E$G#
zv->p&M6@ZjRIo(V`Q&2_m)+g^$P=bdb0^<nwS=EeE<T(4oqyBt8|B-F!kKQXR#A%T
ze|lollR_V27e41jps$;Ys}J8~b#JlH94Q%KYP^g_w>z?%edBG{Ph9cJ-f{Idev#6K
z{y5PQ%-LFSugu`JF5BX%l(?>|tORbeT*a@WinSx*zx@<%gx~g^v0O1e3+ce1aTb^`
zdi5*P#i+A=Bkh`u)n>MW!SJNfpm^w!;p%&hd%)Q%_C4sJ;lERse-8`<@>up<Sc=Q(
zFxEiv`J_oD^oZu4lYxKBw#+pe8$J71151m2k56<b$ZsaSho@C>X^I!Z<sngc{*Z8i
zg6glkr}!;5FLWnqN8Jsc?9$EcObi#jk#2G@Dx4>IulnBFtE8lw@wG+;J*#W@WAF>L
zy(`I{220C?^X^fa)uyvU0xnjKzup@ky>nH~meJfXe==PCW5atk^stk1;&i&v$&3UR
zfU81Jrj=r~Yac2abZYo2R$7@?WDh%}cuHL~Q=k4mQq=QNIe5N5towWBu>!a5D=rfG
z`l>;(roF?sZnxhgylLTwJy_3En|nA1e7fKMjS*Llt;fq`b-obF&UQ##2!-tWm&U`y
z4Wscfx3QgHY7AY)T-+PK-4364e^st?_EW~xvw~AtNleCc{>rBejMA^MjlPY~QP&U5
zy9AiJ(kdJ`z(F0LFZQ5t@=B4WS43au;!Tq0UnyaPN*=zB&~-20>ai=PdjqvPj_onm
z-Z7Qw>~$*Z5Xdd?GmmQrN;6k&@=Z$*<fqJL%%&tmEn?jXNMaIhwncrhxet<!GtE%B
z0jIxt3$ba!?`lrj=7_pn{YL08KKNVdvNNL9cK1hCzc2nT-NyyS|5nkQay~5F;oHM=
z=IKV9sXk-u6VLJ2{tkAON3k?&aE$cWOvzX62Bp>KX{p}&@f4}WRsQbQiI+#8&T;qa
zu^u)(QW<V4a-wruOemo2yxjoYx$>P)x?B9(`oGG$)1ZguX5O72Hjh);7Px)9Scx)>
z_^8?MY76m4XB<96cbcvG-D~{e;&lw=(#aIiBb^2|4|Aq&+OC_$U#EH-o_vAKcDV0s
zd~aUi+zMAl=;ZadCw{l>Tl=<IcB)I_YU}PaG&;&vl9c6{B5@;QjQv2ybkCQR9p{BC
zuS+&Ncak)#AAgMv6D*dx)cHe2IWZ1!e%xr7T<v1bz?!bx)x;yllZwE`J3CEuM&Lu`
zd`e&8pB~rz6ms3s-M}aLTk#7nD`q)mCZ(~;En?ysUfImpK-;172L1!*YxfUkMmw~|
zKD%c<qgi~z!&+MBcf?TqynB7Z6CDC<7)8n+<=byiSe+)??i=&vn80xx(Shry;>bmp
z5>KsE@=lH-8*E0arS~r!m$TD;gG!b6)5Ys=o*p?<orjAzm})J>Ppf{<w%fSz$!Vk?
z`?fR+?V;LqwYL|Y(0HXZyr#v@?7~7sTb8$AWa@(Z_o#DG)P>1HU!IhA*t@-N9GjId
z;q6QN+%q@imx|*8WqRK>m~OmVjRH4Ca;|kaf&yK><L}~Ub4g7)slmdTyC$R$jC7xO
z6;)~!yN>NX?Uz98Tr<JHbMC=Zl`IPrE2J;YILvP7ev!_V!#w^G2~-vpwPV%zjXF$&
z=BlHCxOf?EI7>ln#hH|s^~&@1ifQ2<kAimfK2cq5Hx_rvcC95X*PFxL%E_XQzg8Ya
zPAS^iz5cmDZfOe3n1E&DzC=%?E5?lqXwBBSl#uNHt49pAS<FWz%yju)f`~>?yaIC=
z9KT=T_^H%y`A>K>oyHgBMDpyCrpn;e&;37`dF$9Qo`KnOR9Z>0Cblx8KTx066?fvZ
z9Ur>tylgY5e6o}v)v;n^DX3Phxa7F-pS<xoxCbsg#V9(()g)Oz;=oSx{YOF#WUN2s
z`m1stsIoGSMBNiCTlD+w!)_I0Y67(xoFiNFk@=)`>#|Rz9}7@zD^*9G?`)BE^YtAF
z%4`!zthMVabHeb~Nxb9O({!T7=_HGs#M4Z-GPm9r9gg)Y-x&={t{V*b)UP*CdfXN`
z_@zBIu3~xE%gggnmuc;Q&dJS4%@MOqgf0KuxJYa;zqwug``q{QJ^QO1PdY83??+m7
zHY8~|JPnIp#6>G~AohJrH#3!|IK3rdiQdQ?e~;YbaB4mEyrJxYO1Fb)Uz&m(yR%Ut
zPVUnPM|5Ii=3SG7!KRtk8{YA;ze}e1De0RzmJYfO3sr9GHCcsDtp8h=YIaVEM2CWN
ziKTA!o@)DQ%}6%)y_TBmrb`GtJMq-3s85R~QN0oc9r=Zz$^hdF%ioIg#li7N6zL0j
zxYUclxEAWy1BYL1dkxM+y2x^ulZhGmmKXLfF4qJ4xGp=3znmRk&qbAk7<LFFE!R<`
zN@8bkiwyX(3XiIwPA+5DQZ@zoU^Jb4uD%P|TeDPlz-~R{!90~At$(lnl~K8#a+TP<
zvqJlum}h!q^YT)J8ta-monEGm>5VJ=yT9>Y^h12zOEW%IqAo0BQG{|cj8RYfV^V0M
z;rjfPDth?hWeQEJw&EqjiN}{tM8U)?28HRL0(X$F2vW&mK_Yqn^(|cqo`&^9Rb2@7
zwopc>`)`O3eL4x{@0UR=d`SD0Zl1;>P80`t9sm`d_IX;f;;5O<*!9@CtHft{Iwgyv
zuXQL|i%(onr8gGcY?<w0l&)=$Q(JqxDw%0IHrbcGxu{1}#D47mR5I~-e0EOziIOXU
z&?6g@1P=a6T-!Gmct~n)vk!p~t2qpWof7K&)aI|5`jAi}LNbKcf`Q#32ud<TLK(-b
z2MK;%oa}j)7XQ>_{!&5|TK*+ir3zkrYT-{a{PZ1?{O3#<VHOsq>}?J5cj~_s4Jo5{
zAsJvo$hVLt9AKk)=j4**qH~AqP`WBLErq%|3RRd5d+iK=QJ3{Le{bN|*RfO+rRvc!
zI|DSOWcgiT!kUg+4OPi}z2^kx(&di_f~d7>8&$5ML79R}W<-h&cEtGw^<izabCQU7
zZ?3D@Ry8a|FiH7uAXTl;_hF*e?!Pla?G6pyYcKgQZ^f*XJRE4ffiLu^eZ4TRnP;27
z#xO0s85l5a0raf>jQqQuSqNSGlsdx#xM1Y^(LJR5;Bygzw<9_8_@+2%3&t~)c*vzX
zKSUpV|4;CB&V%v%oEYJY{)|#mN8u9?ln*8xBISLszjSblRbJ)QolVotn@W3U-yi7n
zxJjbSZjL$+a5Im2w%V|EmCa6<;K}-GZkriuYt0TWG#`^gkuqjgPeJVu_$2ci{0FmI
zQ!Ffekf3jK3d**~L(3bxjV&klLouHN<-)=6I&z1mRE`pR#J{(n^bf^!`A=7r-<6_!
zOrW`BZT7g<+TAevs729F6uHEp=QMbMHHlZJ<bR$tz^-K&Uq}#cT-0P$q=uWX=XdXv
zi))G2vaiLi^Wk&lgdggM{>=Zp{9>AkjtJrby?QwEa2-qb4RbGV&kf+%cWVq>mv2t&
z+BF6_3}&tyD4M)v(1`~10@>IM$80sD&CTt^sT!DP3|M${((&B0GpUZkDrI5OjYOjS
zjYn;Stx6A8HWKQV8PWU{Hh4kcme*jMlvIP0a$Pg&Ut{E=R}#8vVWG5baIrt_d&;ig
zAH>g*U2^^P4-Y&0uJ?{{ACdgVlV_!b$|E$|;HhdasKI!0c#_iYjKdzRBiJzytOr*-
zZ4Z;Mu+t8w>?lE5Nd7e2F`$KJs?`=zZRM?-U;`MyBG(0#1V~F(tBRCM*qQxM_sDL<
z>=)N!HAXnQINzT>->rH&A{ARv?!LVkO^&r=InwS~dtngP>x<3U$)g0>9ay&Es|7P{
zzR{f`dtZhXg&ohPE?p$N>o*mW+MHJxOrnC5A>WNEQI-p-jl={>R<_n8UZ_xAiJdxz
zU2smu`z?%aNK!VM<PG--KWqrJX=<d#G^yJAnNtEi!nv<kf(R~-K*%%6BS7;3>Gd7_
zPs5A71=1I58!6LM|I5CW!nJiCxhm`b_t2Jpktko`66u)H;8wF{x~#Od9S3N(5U(KB
znXVmMfn&8Q{6(Oa^Uo#g&fN)~qR5N`1bZnd4yXikPMiH}2IJke06)XyaL_*U&n_3#
zCjJ^V!_>kj5orN7rR>Ia3(pksy6j?a3#LbmvB?FmwHK;H;ccgN9FFwiB9@=_MfyXV
z*o2`!xwa92)JO>oAW03<=7j=mcnMA0%)?T<aK<6r(Y^vS{K^mr`Tim9+)@?gPEu0;
z<Z=%{>t>)1n#r97R#(XYRZ`|SaAo4ebhYuOceh?T;Q}nvgVZO^MeG32PeUy(?8<?9
zl64v5dTXw?X~Rf3BHWRc00b7IZiDkX&iEHc;L506w8Lk%jj<0bP0_kD;Oqo#WpxLA
z8}vzJJkM6_nQCQHqMX5sbNpe3NWA%TVyl2u85?^JXyE;eIK_nRiz#A(PgI=l$G~a_
zCzr^IzB=Z!OxtECai>-#)WhPX0DC#zXtV|k{zry>YV%4o_DAQUEOgZa)NO^3FDVCI
z{n7D7T-Vh8$+CC(kWmFYU~W+DU_ToD;+=%eYy9}E<DbE0B(8T^YldYsHiYizi9*AP
za$JQK<@W$i5zA5J;d_|JxR;W#A=}|Gv?yH%vWEk-F@DscRYP_o^jHcByVsc5>pAIT
z0-^#v)>Tx~f?X45FX6}<JG(X;-F0Ehb^%G7FV$i}^!ukT6`FX-hFLq#_yJ}()aCcU
z**!pQ=29OFwq!wDz_}%FOcE|V+aq9mJiJ9C$pj^-%bajXbBhH*_f8CC&XXh-w4g5s
zyrv46bH}dI28lVzrWviv>%-N&f-)o2vN9!}q&S1u7pj_S7Nmh`Rg|wUfIz(C4#UMq
zP;k|T0NzF}BZT*SR{~Oyzm=s}j{Ke(26nlesFcsQNOtEYLIy~mr+%l6T_u()M%(b-
zcHgb%k_ii}q=Mn!RZ`Gw2Qc82>K8u2YCx++k#husx5c^K<+}z0J|UrcG?*JQmSTX*
z5$Kk#weRVVUGOdoi|2nrbSpsu_0W$Iw(yUsD@hX5z?RHnx~Y!_8BAz_s}2_aG4-a#
zI-7CHHG8LRkLw7MTo?YA_#?^`&A}|-y1+G|1x8+FQI0^^+YAeL;FL?K8^3p;NL*<2
zh9eSN71fn%O@{*$=^R_7fW7Py(SIzXvg$69n*%#MHhL?5Z1}Ej>I$~jmJn#BKgI3S
zm)OMuo^LH9T+JMp(ptMnl0Y#)ajtAZY2CSLM)QYzvDWB0)_!OO`qQHCI?omEVfRF%
zr?n&E$x}0%b)VO3lxVHiGebjrF<4QYo>KXI0o3oxfg%+s#jJCkE<bJh=hV5a?m#`-
zgu_O*2o+qAueLTv%$*s=OABwv4S&PG;N|7<+tICtz}qS87r-b5jZNBJ*t*lo-4qUN
zL<Sm5s5L}_O82yUk_KD9qJz|GN+Y}~POH#EEK>b_?c?9}Yu>zn4uU)?fr;_CUy^o<
z&g!h~y3$o3$2vhHb?lo8C$MkSen+Q)<pkU2;K?`lr`vJ5?1wz)-y}2R;Z5{k6wq59
z3SvLtD>feaM^u#%O^8;);WZ9+ZN!$pt=ZjA_IqU>d;gDxioi=&6YW?G2ZXl$E%e-s
z4nIK1S~^CJ)UCLz#jAqnTV%_0INAq6Eia#^FO;_S$NrNm<_FYn69~bz(VU<x3NE6H
zn?(>*){yKGfnZQz*O8X?ht6<bbIgwj>dNwr;XO06P#%td%{oXfFEX(Fy<<Nx{2E~R
zj2LUzFwZjp(Mc63-$(X=*+#Tbei)<AHfkqAI>0^!r-kxB;&jbyj*@#e^A?6`pD@fw
zBDhKA@coHTv+z^`d}<dwHh?}&0BW$3RrqoBH5bh-E~I%t$Mi2{3k$D57pksGB{xEq
z8P;376;n0~eW_KWU8Tabh0@kB%*Z6TOXc{2e}YXq<<jK-Wy-EZ%Z2AOa{*foKXRBK
zy$ANBqR;A}0t)W0<Zgwx|7=(Nhoa>mRB;Nil6OsW^6$|-tn}X84^^h4$gUHA1YD96
zN;9H-)52okR=};uh#P8MJVH^pPEQK1xm+p>Nr0Yj<pguTtjH%R8fv<GY4%e`Ab@x#
zFoRe0YYPG578&y%nQlffkdgwIA44q6+6KMhA+V{X)~x4RNyj2rCMGwbI{{EZ`rjE!
z6K5x|HGu7$5I7#FlqZiZZp46nWw8%v!T%<AtQ}kKKIl0;U1aw=rGkH>_d7=D7Q@!Y
zAwC>9?wm7PP!Mcmzm=h}fxWb;XI#D@hx%_OFd!^k%!}I1F1}^hBQkaO_OCtjOWOIz
z{Gc`!_hQooEL<A5<|jcq>Yb7cl3iPnZaC4pMD_6_YqpKs^D`P@KB2q83~Q~WAvQlM
z*S!JCY)0Y@&j|(uj9UUY6sx(-OWt0#a{z;o=E*q8Rv-zsZ9z_(Qpy_F%kuJ4)E~rT
zEYbzNhr$9+57;KuclWDaQv1QFRZa6V@x7gS;qe^c`8FV$zX+0S;ase`y6tD;0enh`
zk#(&l-yY@ya8(68H8vdt9A90#@2~fQ{~TpO{$1evbUmOrjh1JjhtvEYxbL1TFPHgq
zOc|l3=$#ZM_~^s!F?pEbw6M+Q;66ZzpVV_?x5XjZ!1L`fr6k2QwU{q<_R%f-KdICG
zA~wO4#AtnUDJ5`g)F1F1S0a5x*e|+Cx7y|%i{T3~I%P^0JN8zdk%PS+_6KG16fhJX
z{h?=J(X(yU1{u>I7C9->9(1ejBWY1WE1>7wR^4p3evERCT7O{Ms=13U{dS+bz4R;t
z;1L(NsKIr`V}ditBQ!um`=jaL|C*VW5Du*f@46rG3p&mKWTq@eI9M|+8i7?z>3(q-
zI&=e#xfiGUy{v+Gbqk9=@6m4EH7t#che$1-0v!J$-MmF|vF_?N2@q$l%L^=Gho^@!
zZs{GYeam#LoYKZbaq6`OkMpisN&J&+x>iUn9UZtI;6-0K^a~3C-P4c*f?COTlLZ&p
z+KwNaAhz*M>9TG)oPMQ{+aX;retPVm8~?Q`<Exnho^R<hPv<ni&MpYsw%9gEw;;-m
zCJ<)h#;AmQYxls_x&#7CN~Y><fj&<!cPtfj@Pk$qFY@ACfAFWe&#C&u5-z;#AoI@I
zmXAiu1AL&Hu$KPBgU&Ht!r3)`cJ_awzr825GQDdLyNM;8#XYn)FX!oE0&i@a7JmOg
zc8;hVGpuuagt6s1_a)qgaW!nXz!T*RNJC!0EXg9~7?KqPPQz}fYA?bO5HOVKKsmMV
z#q6E);NL+2t^Pe(#GrZkELiOA8ajUKH29tF9Rm7+Dt*-i`G~bSD7mbC+YzLJoH0$n
zLeIAtCCGv>8$%;qNcOg^cqWL!dC!3j<e;zx4#PmbN{&Bm-r8wN=i0-$ijkAtyTOom
z{|QOBv!y!#X>i?22L|;L*Aa4rAd7=F^jOQ6>uka20E5ec*h|k&1RZD8yLR*42iqn7
z9rG<W293Mm?EV2)=}-+(?bxJHEfm3pzz1ePb4#nZ#Bzr{YA0YaU;Yef<jyaf)m|1X
zU_I#M1CB3RW^)KQQC>a=9LsqSiMj2W^3RIV=tqTM7KPE+f=x<Fd3#<U+SB*P4wCt)
z-;4bGyQ0rIgy~cOityjyEzBdX#`6O>R@YX{ooXCe+wm9hmp^98rC;@I#2acwxzsic
zWCW2!r$P=?_ydE11V~8?zFeY<nVmgw+knjX*Tm%<ao+)>FI$JO@aAH_NJywJ`;aks
z(LaEj4on|e<aeo>t9bg|yUU3}p@+G}UD#19;JF;#jQXrS{i;wE49KoMe?Svbt+%a7
zL6AKlU}bD8%E3@v;O9_4Fb0{DB|6+5Q34iy3z$M+1i%*oo7v+3+w%Q?2o0DVXkS96
zyU@iy@tY82goaJ;m^?>ABlPeqrSM5E2Jovj{seGRLYs{zr$BkR_x3aecPt#53hFOE
zy^n6&YN88>sRv2W8{2r9w1i<Pxg{@kIcOV`rellgNhWYASIqnRj2whJ6PQMj`3iKM
z*2cISpeO436Sxrg6;h!2EndjL=+Vx_PUH^%E;e9bivML`9g4W>Q-g5!KEie)?$Ros
z!?Mf(t3uNuAmbK=)d#I7bqBFc3RGQMMYdkqVg*H9MG5ibIWnmtu^r(a#?ON#OE2#L
zxgeC8unde=L;`_8=&dhlIGpo2iMqAVsQLBK$`V<Ho>>E(=&!+&-<M}D9b^PQ2zZO?
z=TjGGBG(cbmK%)&X#kCZUm(NP_?p0}ZUxM+*``Sd&jk<ex({&TAIV~BA<%8R7XU@7
z&JQ&Qsw9-Dg91(CX7A?`NFeCm^_crht~AQ;>_@t@)54)Rieyz^1}c(((t_?*>JA1l
zX+d-+h-Yjbg&lSX;ixzb&WZR}GR!~1Lada7lwb6g^1DZxUmXJ_rw8caP%(apAI$-j
z-?Z)Z)y%DQA?yW9)Im=?LE=RE9yI*S4fDt~q(2{;xygV?x;(gakOkc2M93$@rjIT|
zstYY^LX{ujEb8Lvy$=liKUD#cm>Qn>$ngIGzW%dqvG4#XMF6*c`S7HTdWP~~1xx^Z
zyMKV}7Mh8UyYj;zfbRez(7yq`u!D4>kx?EJ%;=)QTx23HV5=Aa34VcU9Fuxo2%r1l
z{`hS_2u)Poeg%ToKk4um5e4TdiEqx?OtAvV2B-+2Jvn#zss=dNLw!nHTl=kuFpy!E
z47Z@{qwdI;9Xr7A9{jP05!t&XAvEFN=Ekj~n-4g04<SS7xIw-+#n%Pz^$%#E7oK2E
zgX)RvTynIyK*Nq60wD#rz60eFaRkHO3*zsOhuf*%3h|S)3$HsliOd8qKP|Y0U>Qdg
zcxstp7B40LKvk4qduO(SK)pXW*M~0BRj4_wv&dBlTUaR2?1>#G^Fs2LmIEu?2?T07
z>`OYWGjF}JB}&;>@j?l?r$XsaNf$SJTR1((qn#}AKeD_?h0D(TP$|igF8X8m4t!Pl
zYmdcCvwzDgMP}54axE*+IDk}^_ZM-{pb8uiN{F=>l%peAO3^f;Ye%Agz|c0i8q}*=
zMQpvY6{!CekRX+1)3q0y!z#xJ`vp-Ox|)BvnDdsH12g>lma!ichaGaS)U~is`BTqd
z%6X`VmIteObt_uGDH>F9VFKp(ioR~=MnWgKQfZ*PrRcx$98@7O(%ztH7_`JM>z}k3
zYz4n?ZCyZ(zlXC}ApSigU^88SUx7X6v||naL$%m2=S<!nlK64)j_MZC5=gBo5)J^q
zz*zOC<(t==AFE(O8VYV3SM!?RgXx?D$lqI(;z+;h{m2|H=#8z^Yx6UXYN6!70{=ow
zETq)|DVFX|DB@Em@0Vi&M#BaMMr(H{Vw2y{bpU7s*%4GOoax=i9}Nox2FUVfXiS+H
z(dTC~EBD_fd>FzC*VKK}auC32bYjC6sa6@)#l=qk$NxBp@;Pkoj6i1E0(-C@>f1SY
zVF9=eSqy}62&q8#&^i$9Caa;QH|>uHZ$RWzls=e&JXZxl78WqN|59BAZ!aA3g9%!^
zWZ#|??Sv)^k*OW<4ticQC_lN%;a=qgy|FbZxT~XLU93vrit_)?Y@nhLrwv)e9Y!0G
zy$xEW$YpMIq5^883JK)`Ibq0N08<X2hy_*g<fr)?Yb$`m+y2*51@~Y=h~+HEV^v!b
zQB{9bdh2h}CBz1Azrg++KJdmi{mXv3x^v4o|LuFb%rbHFi*sbaUY4YSoM~qIfSwQT
zwa*s=|NWmzseoC9b4U^x;K$&tGUG4rmjtIS4siMJA4z=NE!LDOUGQSwmLQeRA+m9i
z9||`5^k9=t9>Sn^gJ9#hy@)+?70v`s;3RU@+bqYuZi^8D2V6}z9Kj6lMZV<&CS}O!
za1d&2M=jB-pPkbpgiC9n2otq6uHT~!)j?gm*$IDA36$U53BZZVPm6AWyC$m2g#eL|
z4!Vr~F>qhwp$=dfm&3NWVEP_0esx-blrB>Lr}~0Iqjxw#tMvd%23h1K{<kvaWQ2i2
zu!{sOs?vlh$>|+YRky&J8bWqIm(U<O%nW5=f5si72hRU@aVN5T`g1#oD9YlabGM*a
zLpXgDO3mDbg@xPpA%1(T`HIt#UHL|aizyQm7}<ZNI0hkc&{sumtF3mf*h>0b(%Jlx
zWe$fx$MW*g?UkELZJ_+chdw8@+j7hOfXiF<4eHa<3fy)o*b>OM?SLYjwAk$K<$mu=
zv+fVy_23bb9asfOP=pLWj)}YHOgRkJ3dwg{`vJftB@4TUiY~Gt<9WAZbHCTB1myy@
zfrF;QNXwUAHAjm>&*=i=K8(AWDqV%x(qTxndM6O<%$pjr-$}+N9i|m!#G%}aw1=db
z6q0ITful!ZWNm!5<qwa=e*QlTL!@7)$S2))Waw{+cnxj2nv{?X3yXm*fbtmF)S@<H
z^|w<mX}5^0YQx8n@$%c*PGbMbKV(j@`=gYkTlyMkp)>zO&;yHCqwX=5+9l8{$xK&Z
zC7F-r1^NRCDD)40psX{+t^b=>N=kA&Ei74>H(d+ge9lLUeAZ5$X*hx*^n6=ioGQi8
zy3^?lK0lPcJsQ2?<Fu*cTQT(%8VwNifIMyt7Jys#9h(b+y<U($jFE#29=q2bslGV*
zCpl16wh~Nt8g!M|;syz9*6&0}d)ey&KZht3xIfu>Tz<__V%vm9?_Zy|WC98d|DEBC
zg*u|SDR6i?L{t7aath_AbON6SMD0`1=ED8x;Zsca6%k*{%Q1hh)>xnon$wpVo*uq!
z(D%OhX%c_PYn9X0GRCUB07Iawgl}hm)E8OU7Wu^n?rqKW&*R;i;`}{&PWQoKCA4bL
zf49b<RKF+*Rxfw?iEeQ@(SxrJ>`<1H()p7V*rDU%&*J?9ytW_`PE3lMr3+#-2zRX#
zTN0`P^3AqpUtu%$>+>QnMOJ>hqGw+fCx#*okwyaLKZrC%>2kH>YMaJJ$J%)7bs<Us
zmGfwaClCmcFV}`zt2_k1OU!ZjDKX>Ib`9Q%+8SV#|I5Z5C#9qS<@<LR!s=i`*Ew?_
zR&FH>aJ8hY6#Bf-2B=jo<#>=M5Io<ecWN1vDT^GwpLhI`$Z+SG&OBMY4Cya5opFPc
zd5rwC`{|?GF6`k*yU=KiTPN;2rDCveOa1JtI74B*1IcrLv=g+}NTHy!br;IFW1kXd
zN?OYAjAD8+I2vX=p;He`2`n#N_{eUoG8h+Gv&*8XLHmHKPo6B10MtWjKRqu6`TP83
zv{BjrXfkm<AbrKTX5GR<0Gg_c47IGILpv4`6d8km6HX*G`2$wpIY&uoi*RbQ#<e|E
zV1>tS)vGh&##$FeeHDeay-vUKh}$7mNMfS_W>makiS;LG()=Ag@l?Hv@?}Wt*lQ^y
zjO%;0B7g>h{*-npxR!`B=M>VARwo8GS!0Ld8aI)bPq1AB-A$~ZyCQ%{t)fnD3^q*Q
zI}pJ=0iD7-8)AY%;cLSDQkk#MX4>&&Rm}Rb)^q+es;X8@`aPRr>O6img&5cXt~6A#
zw2{gYXSY4`vwO1DJe+)y#EUyck>9`0pXA4eyUDW|YO^SU>=FPtl4$s|`h~R*l0eLr
zMH)(g|A}`;p_D(H^dVY*8%yP=faTAPFX}$A&`wIdsEzU5AcH}DliZx2jV!PiDIyBY
z<jNMnK@r41kFmwTmy$@Nk^(zFL{rO}{MKvpBwjV-zu^RnazCE@+ekZt$8jAgBw^ty
zmBS8&u1Own@SLLGB9MntHs?|(A(vp(89<c*l|;a}#qvW-b|bO{Z0Fx(aHfDy=*F*!
z;i(zyX0a&GSAyf}QaPsVn6XYQ8S)tX!*~TA?+W?e>Z2$IpTGdCEkR+@YE71+iPwcH
zLE0tp@x|<ZihI@QB>;b$FVzI@QWX_tKXJysCg1h-F<aQ&>Zx^QHx_(JWjS%phf3ZU
zTpH&Dn{M4fiGN%4NK6U^azaMQy#5T^ax86wem@$`%Du}hWivLp%j7=F4t56O{Eq0;
z!(G{URZ3lh1qh|a9>N{^vn=WvSX{&AkQo6+kCgcNI{b<mr`18>sE1|+iM*IVqGa_f
zRDWZpgFSCNsAeld)ol6-xh8mT_{Xc8L)ke)69N3`zN7cFJcLyh6e)4Gu$rnPxF}G$
zzKfcR1nnkR-?_ELlAd2G{Rv&0KA;$xE%246$Ce$O&`a@0suS-AkRV6RG}eY@p;VF5
zn7v^@{Y_2%Ts!OF5D{5X{z+<1a3f=Ov%NDKM{U>W1I!y77Feh1J&}|&7xxf5ybrS5
zU`CaQ=8(VDjD6ocwARudzvS%F0G0RVmZw+amX~EViLLgpu(?09*pAFKEK7w_E$yXp
zwCO3PUzs*O-F&?B9VqBWH7~L!C+y^T$Kt{T6?Enz(wHRk7{Bk;{9&zhUX$|&?c|Sd
z)lSbd)X42bvU#`d6y+o(KtUZ3K1J$fQh$CkQVEgz-!=SxMiaIfwS|UR3PEzCrCYFd
zpTbc<nk-)O!>GTbH&d`_Sj(29x0qab(ZlVq(1FFpS1P5ir^yvJPc`Q3EdW{2pbwVZ
z)P$W`Xm_4?74ds$FM%+}k$c~e5y&>_NPlPaV_w(&8}|CtVT{x@CHNrCo6beNRk`@X
z4+98uxwP<6+|NW%#(o#CKuj=XQeYiA8q(Xg{34nPG^NW3_+|zboIP5kwRYUuX4rZm
z4k%fB13z?;t!6i(<cc2)y!I+nE^+3}?P?_0HivM@R{zzrb0D~~{Hsx(J1Y0dwE~|w
zcahD;Z0ej|&~0RA#U+r68Y;pUonOi@#1?76(AC#^MX%~%ddrJDk`Bw>YI$%b^mum$
zS4EkT?}ZXX_(p6LXOB8Nq*49Fz7ejr{@JznrjW1a1=4kw4syCR3WW*G<`}X!f$_IT
zF_LR|y(&<IpdL%ubS+CzIRn2XQ+6+BCa89H?N+UkEx$4ikUGNV<D!S~<~Lvp#Wz#E
z%GL~-iZ1@OvbM;Aoi3s7K7%Sj00?J*??lZ_{m$!tW{6q@M*xpNIFj#_>UPI&heHD#
zMf!Fw&o<(Uy<ln!m`enE#K#L_ya;)!+$!)-ze&Lj*1(6A6_vsVnu>Sql9F;}-)J{q
zrKtJ3-&@N}p-gdZ>L5I1sb-Xg_P{!knf)l2>0t?-7k~5WApaH-`hfFWq-5XL0>61c
z^)z67P!rp3;zlpEd3LilEJc*~CR9|Vl!;g_PyXqS;a0L7OG7i@LaPb&c5~}#Ybw)B
zy}gwT{4pUV131c)QK#osvYbI?$_F)PB9@RHKfx+=F#tm*MLd%SkW(OQZvaXvCm~dc
z-K}dc%YFPMhlNQ|rpuufMtj$qa(TZc&dvNy%iLib#5w#bMNmHJw1jY$b!sjU^z~6F
zBN+^~5vSK*F<XFox!M3$-yY@i{LQD#U(VVBAP+qJ3Bfoo`P(JPQ3<vJb9JrszhCI?
z+SwYkf1?Kx9QMx0wy~Pv<4p8>7lyTZA|CRF`u!-FOp}Gk_Rgcntb@@QtS(N^v|>^Y
zH3xM?uF@PvOG7*h1+46919AZDd%zX1&h5kmHaWH06!Ur}iopl@jPDqDxz=io%8-{#
zD9^nE``=kGL|r-s2ktEKjs?ZdF3ti<7LC%&t7rLs)Y}Xs_qTgLGaGLt$P);0_OjT?
zS&HTPX}*x2&=Yl`Cl-Z#$8VKCAg~Y(eRVj|CezxOcZkao&n_OM=sme^3zMh@PB6#U
z<V@aW;vcYy?26@?j?&Q7!+A3HCByC9Px<7pX&#A)QJ7g8_Yg8852>wlAy|ZWfuzVk
zU}d&xDf^S(7<Sc?@?jNgrx)-B9G0d}Fm=Ws#pNEozLvc|()qavQF3*3Jh3$evLikG
z!lc>;LTD4Iy(p+{A?*MM#DJ01K%@*%yXSO{9Q6aX{krR#wgYF@u|}hM$K-o>KhNqL
zoIHkRf0Yd;{<@Xoc`@aFz%(!&(lPF+3eLjG;4VHN$-S^U5w)nbUCB3(kJ|B)_}LwJ
z!88%14T$nR46V$^uy0LX%N?^_WXLuU97CgxKde@pZ<Z~nt>LNW9k&g6LDLBXyUA@B
zZY7wyu>tmLtyWC75>Fm-`TSu$u{{PVd8X}s^r%aYKPKKVTT#xh`&{@%x^M#gP6ppy
zz>~>3cvvh^rVHQHq91ZtHc`0?FK6dI=l$7xeyKA9d$VMZmcojG-|EVM*3?oVb)8Dt
z=)|t4%vHj{pS~8zSgkt!(&x^-wXufthZ6XIDqTn)&g#_@n6R4@qMFV=ki2F5UG`IW
zXlQG&fy}q7EfWwoL3Dm?^lpJ?1=#Gf_Yc^QdP$C(Yw*~6<itKJj4RZy`g`cvMeUE(
z<D<;L@d%IikNo8bUl9U8+oSO0ln!f<LXaV(0X$$-NRPB!<Wol63Z4xW0|R;r<fHN7
zgb&2*JjMcDOM97EN&CA|&NuY(KBp60yg?^(Lyd%d+o`x5a<=b^VDe|PKx`~oq}D$s
z&Ehm)nJw>d%KGw3{!m?tn6RdN8gkW{vW{Pv?a3mrw6I~;W)PYE8rppy1F<-7i!}zm
zb@L0OR=DC}zC2rke;R?IhcUJ=G{E$Bvjj8qn1{H()=w*H%Xu^!;o0AH;;LRV=w@iv
zLa=iEePp@i=zU%}C<t-0ADgk`9kzaQM-<agZK^Z>>uTSx&`^7X$1l$8H<%c;($^WX
zR(h;qe2uF$6ZSn17i`Ru{8+LAoPh-KmK7G}Gt4LSW)EWNB+gD?v1G&GCO4uNF%y=p
zsckBhk>xJb!L;;*D#6^^UG-#+1C^Q{f5y0C{R^1PFJ!K$o4m#^)J;H$V~83bMuO9@
zchd!|kKv4-=?`qOqKaGKT{V*56GbyTg@j`n8f6&NiPZO@q0bT>=3{vIqU=sAvaHQM
zDa~O7AvNFPWw!$f;4(o;`0x#rJQhi9?LOtFB=4nMnH$`Q#EYjVWm~LFBPrQu7Y-9m
zNE}8oHJ+1EBn8f?wy*$J+h&O;*Os&W`6?<vCs!QP4v#{OP#*2UcI9WDqT&Ui55aYt
z98h383E%Hx&%M6b{lJvFBAt3ywO^=(V5-?-J7^LePaZZ;_=!eS*iL9&yTF+(gUI^H
z7%MaqR=_1s6XN`fg!dxCom)&pmo5i!Q^P*QQD4s`lNy%r4J}>RW^9sPNtHbLW?~A7
zkIVoguCtPbe_m1u!U(SF0;iE9Fz_SpM)>*L$Psu)6l&&y)s;(UD#vVizT(gT82{zc
zoHg}bmz>vQsmAkn-^CjqRy6B^faf{N0)+yHev2QLxZP18DId`MB@+EHv-{dnVPH+%
zC-z&))Qm$mY<XJw3EutXg%TdHkcYVUB*q)w-@*05U9rwX1o!@9>!Z?J7+ilhP5-vC
zIM{#a(`uYh+;G-CgJCC^I3D)cO%Fejy$G=@;KXR1*V=tTC85sG`{g7(M0kjX^E>f3
zgNQ$(7mpx+M+X?69R^CO!fm}GF`S&s^8C;<dl2bi#Kl^H&9DZjRSx*vs8zjP2#Z@a
zYz<uby&rZ*o3Hk_yr;Eoy^G2)68RQtK;v!dngz$Ejx#yLpnmO{#;eOwWm~$Fx_Vy~
zSsyy&sII{VbS!^D)r1d_abdg-RlIRu-d&WuBPv|rmMA>X<E^t`e(Ctl58X=mBOuD<
zeX037qGH@xN{Stz6v}aCSDvkW%r!X|sWUEL2DAE`p2rc`6259hGVHEmU{XS>OG!Dh
z8(uxWbAY=_bI*sLT8MLM<|<!3!W`U%aBGDNv4orVx~Fo`dV=YCWx*K49S)4NBlVzP
zvl>)m@WixEX}n+!t(IRN{BEV~=q_~Qqa(Ry(`x3m-ROIlISx*r0q@&!MKUHPm9ces
zLKxTTL#CiAt^kjM<Zuzd_atr?la!QO5#|v(ai`?c0HIX{1juPlBbsx}L-|%*p;E5<
zlLhx<a)**aCwAZH5dHXuIKGl*d61XWcuGHEXQ=a(<_7SRdrV>P3K%0~48uyiWjVQ)
zL%J4J_na_Fap9;vxeK6uc_Q)6+2IoaV3<7Lm5cSGPVU{)+xYlKI>%4S3YMSG0w$Hi
z&u*eZaRDjY@jD`w61~q1D<u+-cHt!-=V&1w8daN`mLRk+jwOi6p=X$2^k<dLJbvtJ
z$#E^ILCf-*HlCHN^Mp7|s^Pmh*3cuk;(=#|B~jN%o#N$H@~T<jsv{-<ynq3w^U7DE
zh=ky~g2U4B3@{X!1T+5Bz@dGfL2gHZpLjz^+#vmpl^2c9ynbmg)`@(Wl-OaNx18n@
zMKPX`JL7UZYlJf1goZf)*)Wn3!S&&qgUq2^bb5!&n~baCvPu3Fk#F{gTx9KK4XD1%
zCybPxg){seX*Cv$FaGImShnIm|0^S|2yQ`4!P-{^VPf0e(<geW@zR%g`xg2`ud}l5
zz4q$bPq*vib>HpLE~&S;dq}jnCC&xAIj9?0xFgqF)cv@p595YW-}NdyDwn^#A%iou
zKQyub1xRO(o@~=9kOla@j~rC=iBNPlu{=MJF&uk*$^T*XMFjU4rZr-OnB1QqY%rL}
zX53Y&@kN1&C}m)o1$9}-0$!B(`Q9_Y6cg?76;OlA(_0YC#x8nz!tuu!#Avm6@LIxC
zbxorD*#hGdguJ~`oDoBJez*46-A+%|(Wz%U#}@^LetvowvnUC+U`R+ks!<IO7C!3a
zd9x?L;6t{C#*10ak4vF|2U_(oP{!&Do$+s$6Xi}b*&Ba26Yj2(ehU)}HOv$Z$DBW3
zDt4l$9WlF#ICN!q+}o}P?2%u^xV+P1<OZ@;Yv2H;K-$$1RUGCUr{^#8y0htq;HCJ#
zE3@v!X>dg8bX_0HBE;?c*b6|_z4(QcZOcp6z-}pD|6iKdFyG`0EK!^J+SJ$P;|5Z9
z0vJc0o1Fhhe#=7HBUvpwr-Qr9L>xRvxB^UL&4K~<&FjsyG-#qW=GPLZMIXD7J+tzj
zK}Bc!pr8oaxA#SBh2iY;7`ffYtr8<dYv0Q54;_3io1k?j_dLg1Vehy^HFwLe$}fx3
zvj*l>w6VirJhR%TKei0NLR%t^#88hxjy0p%7ZPH>%K7BtMcZcW-5R0py8sxUW$)s*
zVKU0=y>wiM-(mid>fR^er4AXx#>2x}kNcl>#WzL%-tA)&BAE+wkC%pv58M>J5@*IE
zn3z$RbRbkm+hk1Qal?zDng>J2FA2SJJLugBdI8uPFP%Sg?eMW1mERrg3L1*jFa2F1
zHn$T5Mz&giQiNvpneb4aBSU<3>ix%u5+APDyr_NLmgMzg4~l`<H~hFj5@1RYN&&pD
zBE?XfcO`6{Pq`IluFr39MFi5YN&u#qNQiD+?eQ-IwvzbL(Ce$PpqHpOfW_m-<xr-_
zb4DmjyBfQgjKMKMmZx1B*P7AEng}j=r6Mt1Gbhz_9g94tRKxfA&aEbPIv72r#hLaz
zvD{`Z5Ql?%4+x^2r&Mg%-z@Nz5%c8+4`0gn@KaZ^4y$+IZ5Xvna7gq*NWIMq>wR+;
z5x)3L{%I4QV%f#O2mY4D!AP6&b(!VvnMZP`e!!64-A5~i?WC`G0=0@a=Am_^Me6Uc
z@4X0kw}`K&kgxv*xo5umJ{gopxZ3Q|5rf6OK;Ct-1ixg}Cp<t79_*}Xi@;ShIj!%L
zs}Qyr93Fc5!e&YuqhBeh2-<z(fK<=G?unFAC21<8KeZg($7zgFuLod!8aYR<#s%7}
z&DFQ(8uTz2SG6eWd{Is9m$kBFJ^B1VOP)Sys2ZOV`$z(tcD7`(?13j{b3iYiBZtLP
zO8o5(&eqCvJ@U({(QZ5}IvNiAX-j;eA+CqOh3A&nXEYrixK_*CHX~b6S)kH5xF04L
z_f0FY_w9@OJkvnm5uW>g!R)z)2H|B~=zi@fE2|!b0rM%Numd?TWV{-D&&X67*(Ucg
z0#<#|$LlPb<B{0Fvo2xwr105KN!`uDrZw``K4PSItLuAwH3aW73c`5C96ma_<itB`
z|GxGsX6E9lX|yD{rdB{T)RZ2YBc#`2@37~-&N4iMZ6!`ZB(CnnIBBk4F@A&}4N7fL
zZ2rz?kH_aK<&HDusiyM3nSb)>Gb{gd(*d(=)y9X_+#NLa&ZVqnW!cos{Xo@h=W@NH
z0ormZn4;X*<uRCgK+rm)t@H2Cqf6kRE8t$9wujLwp0}PeR_kUe$z&JWc%-ovbv-M(
zjmp*7d7|eR_KS6?QK#p#&2;>_Mfs@w@koO=oX0xgCXNoL$P(nvOYb+{?MCeJ37>gi
zWG4JRwRE?UCCe0u0pX0`_U=I^^eE_^(Ztz4@qa|Vcye-r^?c&_?wDB}uT$Snp2-!;
z8cg`LhRA(_V+Ku0GFN^NC(8JlkvPtxj~pP6&NE)d)UTju#b#!Jzp0UCLj15=nMCp3
z>Vw=;KcYa!z+3o+rAm5^T^ULt7$Njk?C{0D;<#*fMe^5v9fXCww6KHJmE7rLHcCA5
z!@~e%`Af}wKgOvp(1J((UYL%!7W%o0#^aqKdpU&;%T>gUGrvi@%HCc#Jn`_6`<+{z
zU(R5I$6j4Hg8h-KR<7CwTI(!cYVqZ;o#=@?`b^|l0qgnW#|yrlH-qB#!@>PZ7A#Uy
z=In1!y0g>m%BJz!yG(9%dg=vC-T8rU&IE--owxPwa?K}upJ$eFr##QrYxY<?fSg0U
zG!*ImiE2U*Uymro*j~uhcUkma@e#7p&^7(E2jjXrD6%=a&gWhsA#2Hi>$X)*jTu5J
zq<5RV8dW&kJJkFa>`r|RKdh-7b%z~*&Itf7@S%MrA-}k0yA&I)&!AQ%p9s%L-O8Q*
zWX&{Ens-2HVRl*?PhE~qI8n;IZXw9YyL^C*<Q4qndfT!r?v5dGj0xQkOt@rJlH2vJ
zMXvR%hQqbir}Fc*w#{Ef&advkvGB>FE&5j*<mB`31r`bKF8-=@-u87+-nAoMw`ihh
zP=HKhH`q32h{?N(TCg6(VS0AC7$}14QfeGLubb(X*N@(i;4se%j%S6J``;=bHZjVo
zkhd$%q^Mx3HX>F<!FTL}Uro+knbUFp{=kyop*ue43F!p1skuhXj<t4i6q&>T+VUeT
zK{9Yh>d}07S+GsV@IIySC(g@RJF1ORP>Jc5U#|7NN_r)9@`l}E%kLh7bdC}T#wNNc
zI{GfJDE{uF;nAgZ$p&jl15SIxoV3L;01Oii2jV5K+z;qMSzw;T%JJY^bWEL27FeEm
z&Pr^Y{rzp9&&i`4KfNAi9(u}4{lWmPdX5RZ;bEcZz_7=Db56n>^;}NIgEg-;zRMRo
z{?fDdz}Oe#E)ZJ^p=KuWnO`U_T(Qov10X4mqndFDmW*3=!F>D!*x1YE4~VyHN<*ej
zt$gaql;IEH<Bqmc=$?(8;A7{umv?9U8}g$MRCo7t*Bs<J3~P7ndN+7vFLEKde+N|1
z-U;6`_VI*Wy*_{G#`IxfGgZth!*_0plPpZlaKd6BPvk~GiW;rc(!~BXL2TS!v&Vn(
zeEWdomE7acZ@gHMSK{`u;FQY2up5@&@XAM!dJD~a^y^E#Q8z<G*cv25GbKRswKp-6
zl<{jF;j1kOo&3$iHk7#Qq8)V~?wfEj*<{MK3*Orn1{h|NhLPVx%fWcQZ~aD=e@zFe
z^+HiGM`J|~a^5DWTo3@V)I{x_(M3OBSes62UhDfSG^RgH|5Y$+glN-@C5>7JGO`9`
zs<p=3kS@EXJoS+{PY6pg;I!To)PI|^M7H*le9=?K-qE;?i<^*g4><X+cu_#G3yFFU
zT)4lR;;s!Tzs=wnrc_I$bulXWgOX4Aa7uNRJt?PJ>pVdvLrq?UBaSmSJ_ng~Gntc%
zcU&LprX;6}B;FI;MKswIVaDXtv*aS&!EUiR9r=Jg{EW5bs0OUqdm*PEx(c86fQ4cV
ze0qRsd!cp#OghOu?sDxlM-k6n`%K|qeu%au(K5@`88q)%R`gZlH?!07xT+hK3<_OQ
z9QCs;CnE#Au_q4VLY~E?_&n&H;M5_HUNsNkiOfxw?x^#PZu*%T8x>I8;Or#w!C|c7
z=v#BvN%D;5y-1xb=HFdR#^P`o57p_ZLCnJmbt)fnaG6lyz@A+WDJpFtjNt+Dnq+HO
za<2YR;(kh~T-6cKqg>9BTukzRGc1Iqh%?j<+UI89;&aeH0@46K@fKehW&KpaW@|DG
z^lyM_OM)fkh(tc4LGf4n%+taWGu&>rj#6qtvp6yXp9O4{Ss^}_qf)h7%W^1lWm4U!
z@hNlGs?eBQ&1n+yuU-p2s9NyTC1({=trTM&sc`F;+;^VW$DC))!gO+2k@1r7EG9X&
zsgWx@7+7`<LId<Ryss$VON`)kEIx_Rk5oe~C(m{z;`s2hgNcuS?~V$vL>2<&`A*rK
z>eaWIYoF%WQ9(!$4H%R^a~!TGkKW$&TvbU4G}X*)%EzMF9CBs;&v<f_zg?^7_ntF>
zTh3m*r+1^F#0)*Qyq>k<r&+zFB`(OZ?M_JeDG`z55La>d!`Y|5)qsgxpO=}N|8#fm
zy-Nii)g5bL3K9-~IR5mvGE@Q2(eAuUmp-^xcdP^}C<%xwcnmWExEG$a{avKl+Ax_*
zc}WH!uck@ntTYijz!bs2oxrHmz`B89ltY6s5Z-#=KmVt~hMP8z1FIQ;z|+;wWt~$(
F695%_snY-e

literal 0
HcmV?d00001


From db12bcdc30db540cfffba9327004f5f5ff91e119 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 12 Aug 2020 13:59:59 -0700
Subject: [PATCH 188/265] Link to Banzai docs

---
 content/rancher/v2.5/en/logging/_index.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.5/en/logging/_index.md b/content/rancher/v2.5/en/logging/_index.md
index ae8054f50bf..41cca5d4138 100644
--- a/content/rancher/v2.5/en/logging/_index.md
+++ b/content/rancher/v2.5/en/logging/_index.md
@@ -22,7 +22,10 @@ The following changes were introduced to logging in Rancher v2.5:
 - We now support filtering logs.
 - We now support writing logs to multiple outputs.
 
-<figcaption>How the Banzai Cloud Logging Operator Works with Fluentd</figcaption>
+
+The following figure from the [Banzai documentation](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture) shows the new logging architecture:
+
+<figcaption>How the Banzai Cloud Logging Operator Works with Fluentd and Fluent Bit</figcaption>
 
 ![How the Banzai Cloud Logging Operator Works with Fluentd]({{<baseurl>}}/img/rancher/banzai-cloud-logging-operator.png)
 

From 57463cfcc2f1646049ad0e54c6db369b08726254 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 12 Aug 2020 16:08:37 -0700
Subject: [PATCH 189/265] Update Rancher 2.5 monitoring docs

---
 content/rancher/v2.5/en/monitoring/_index.md | 52 +++++++-------------
 1 file changed, 18 insertions(+), 34 deletions(-)

diff --git a/content/rancher/v2.5/en/monitoring/_index.md b/content/rancher/v2.5/en/monitoring/_index.md
index 0c5e3944cab..ab7e27c7829 100644
--- a/content/rancher/v2.5/en/monitoring/_index.md
+++ b/content/rancher/v2.5/en/monitoring/_index.md
@@ -7,6 +7,8 @@ weight: 10
 
 Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
 
+This page describes how to enable monitoring for a cluster. 
+
 This section covers the following topics:
 
 - [About Prometheus](#about-prometheus)
@@ -20,27 +22,19 @@ This section covers the following topics:
 
 Prometheus provides a _time series_ of your data, which is, according to [Prometheus documentation](https://prometheus.io/docs/concepts/data_model/):
 
-You can configure these services to collect logs at either the cluster level or the project level. This page describes how to enable monitoring for a cluster. For details on enabling monitoring for a project, refer to the [project administration section]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/).
-
 >A stream of timestamped values belonging to the same metric and the same set of labeled dimensions, along with comprehensive statistics and metrics of the monitored cluster.
 
 In other words, Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Using timestamps, Prometheus lets you query and view these metrics in easy-to-read graphs and visuals, either through the Rancher UI or [Grafana](https://grafana.com/), which is an analytics viewing platform deployed along with Prometheus.
 
 By viewing data that Prometheus scrapes from your cluster control plane, nodes, and deployments, you can stay on top of everything happening in your cluster. You can then use these analytics to better run your organization: stop system emergencies before they start, develop maintenance strategies, restore crashed servers, etc.
 
-Multi-tenancy support in terms of cluster-only and project-only Prometheus instances are also supported.
-
 # Monitoring Scope
 
-Using Prometheus, you can monitor Rancher at both the cluster level and [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/). For each cluster and project that is enabled for monitoring, Rancher deploys a Prometheus server.
+Cluster monitoring allows you to view the health of your Kubernetes cluster. Prometheus collects metrics from the cluster components below, which you can view in graphs and charts.
 
-- Cluster monitoring allows you to view the health of your Kubernetes cluster. Prometheus collects metrics from the cluster components below, which you can view in graphs and charts.
-
-    - [Kubernetes control plane]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#kubernetes-components-metrics)
-    - [etcd database]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#etcd-metrics)
-    - [All nodes (including workers)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#cluster-metrics)
-
-- [Project monitoring]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/) allows you to view the state of pods running in a given project. Prometheus collects metrics from the project's deployed HTTP and TCP/UDP workloads.
+- [Kubernetes control plane]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#kubernetes-components-metrics)
+- [etcd database]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#etcd-metrics)
+- [All nodes (including workers)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#cluster-metrics)
 
 # Enabling Cluster Monitoring
 
@@ -48,16 +42,6 @@ As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-p
 
 > **Prerequisite:** Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
 
-1. From the **Global** view, navigate to the cluster that you want to configure cluster monitoring.
-
-1. Select **Tools > Monitoring** in the navigation bar.
-
-1. Select **Enable** to show the [Prometheus configuration options]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/). Review the [resource consumption recommendations](#resource-consumption) to ensure you have enough resources for Prometheus and on your worker nodes to enable monitoring. Enter in your desired configuration options.
-
-1. Click **Save**.
-
-**Result:** The Prometheus server will be deployed as well as two monitoring applications. The two monitoring applications, `cluster-monitoring` and `monitoring-operator`, are added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the cluster's `system` project. After the applications are `active`, you can start viewing [cluster metrics]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/) through the [Rancher dashboard]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics/#rancher-dashboard) or directly from [Grafana]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#grafana).
-
 > The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
 
 # Resource Consumption
@@ -78,18 +62,18 @@ Additional pod resource requirements for cluster level monitoring.
 
 | Workload            |      Container                  | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable |
 |---------------------|---------------------------------|---------------|---------------|-------------|-------------|--------------|
-| Prometheus          | prometheus                      |     750m      |     750Mi     |    1000m    |    1000Mi   |       Y      |
-|                     | prometheus-proxy                |      50m      |      50Mi     |     100m    |     100Mi   |       Y      |
-|                     | prometheus-auth                 |     100m      |     100Mi     |     500m    |     200Mi   |       Y      |
-|                     | prometheus-config-reloader      |       -       |       -       |      50m    |      50Mi   |       N      |
-|                     | rules-configmap-reloader        |       -       |       -       |     100m    |      25Mi   |       N      |
-| Grafana             | grafana-init-plugin-json-copy   |      50m      |      50Mi     |      50m    |      50Mi   |       Y      |
-|                     | grafana-init-plugin-json-modify |      50m      |      50Mi     |      50m    |      50Mi   |       Y      |
-|                     | grafana                         |     100m      |     100Mi     |     200m    |     200Mi   |       Y      |
-|                     | grafana-proxy                   |      50m      |      50Mi     |     100m    |     100Mi   |       Y      |
-| Kube-State Exporter | kube-state                      |     100m      |     130Mi     |     100m    |     200Mi   |       Y      |
-| Node Exporter       | exporter-node                   |     200m      |     200Mi     |     200m    |     200Mi   |       Y      |
-| Operator            | prometheus-operator             |     100m      |      50Mi     |     200m    |     100Mi   |       Y      |
+| Prometheus          | prometheus                      |     750Mi      |     750Mi     |    1500Mi    |    1500Mi  |       Y      |
+|                     | prometheus-proxy                |      50Mi      |      50Mi     |     100Mi    |     100Mi   |       Y      |
+|                     | prometheus-auth                 |     100Mi      |     100Mi     |     500Mi    |     200Mi   |       Y      |
+|                     | prometheus-config-reloader      |       -       |       -       |      50Mi    |      50Mi   |       N      |
+|                     | rules-configmap-reloader        |       -       |       -       |     100Mi    |      25Mi   |       N      |
+| Grafana             | grafana-init-plugin-json-copy   |      50Mi      |      50Mi     |      50Mi    |      50Mi   |       Y      |
+|                     | grafana-init-plugin-json-modify |      50Mi      |      50Mi     |      50Mi    |      50Mi   |       Y      |
+|                     | grafana                         |     100Mi      |     100Mi     |     200Mi    |     200Mi   |       Y      |
+|                     | grafana-proxy                   |      50Mi      |      50Mi     |     100Mi    |     100Mi   |       Y      |
+| Kube-State Exporter | kube-state                      |     100Mi      |     130Mi     |     100Mi    |     200Mi   |       Y      |
+| Node Exporter       | exporter-node                   |     200Mi     |     200Mi     |     200Mi    |     200Mi   |       Y      |
+| Operator            | prometheus-operator             |     100Mi      |      50Mi     |     200Mi    |     100Mi   |       Y      |
 
 
 ### Resource Consumption of Other Pods

From 706c7737631ef412551051e8fcd010fc03d9a4e8 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 12 Aug 2020 16:34:10 -0700
Subject: [PATCH 190/265] Remove outdated monitoring resource limits

---
 content/rancher/v2.5/en/monitoring/_index.md | 56 +++++---------------
 1 file changed, 13 insertions(+), 43 deletions(-)

diff --git a/content/rancher/v2.5/en/monitoring/_index.md b/content/rancher/v2.5/en/monitoring/_index.md
index ab7e27c7829..fcfeb1b2d08 100644
--- a/content/rancher/v2.5/en/monitoring/_index.md
+++ b/content/rancher/v2.5/en/monitoring/_index.md
@@ -11,6 +11,7 @@ This page describes how to enable monitoring for a cluster.
 
 This section covers the following topics:
 
+- [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
 - [About Prometheus](#about-prometheus)
 - [Monitoring scope](#monitoring-scope)
 - [Enabling cluster monitoring](#enabling-cluster-monitoring)
@@ -18,6 +19,18 @@ This section covers the following topics:
   - [Resource consumption of Prometheus pods](#resource-consumption-of-prometheus-pods)
   - [Resource consumption of other pods](#resources-consumption-of-other-pods)
 
+# Changes in Rancher v2.5
+
+Rancher's monitoring application is now powered by the Prometheus operator and relies less on Rancher's in-house monitoring tools.
+
+This change allows Rancher to automatically support new features of the Prometheus operator API.
+
+Previously, you would use the Rancher UI to configure monitoring. The Rancher UI created CRDs that were maintained by Rancher and updated the Prometheus state. In Rancher v2.5, you directly create CRDs for the monitoring application, and those CRDs are exposed in the Rancher UI.
+
+For information on configuring custom Prometheus metrics and alerting rules, refer to the upstream documentation for the [Prometheus operator.](https://github.com/prometheus-operator/prometheus-operator) This documentation can also help you set up RBAC, Thanos, or custom configuration.
+
+The Rancher monitoring application's Helm chart comes with a README that provides documentation. If you want to set up monitoring with advanced features, you can enable them when deploying the application.
+
 # About Prometheus
 
 Prometheus provides a _time series_ of your data, which is, according to [Prometheus documentation](https://prometheus.io/docs/concepts/data_model/):
@@ -43,46 +56,3 @@ As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-p
 > **Prerequisite:** Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
 
 > The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
-
-# Resource Consumption
-
-When enabling cluster monitoring, you need to ensure your worker nodes and Prometheus pod have enough resources. The tables below provides a guide of how much resource consumption will be used. In larger deployments, it is strongly advised that the monitoring infrastructure be placed on dedicated nodes in the cluster.
-
-### Resource Consumption of Prometheus Pods
-
-This table is the resource consumption of the Prometheus pod, which is based on the number of all the nodes in the cluster. The count of nodes includes the worker, control plane and etcd nodes. Total disk space allocation should be approximated by the `rate * retention` period set at the cluster level. When enabling cluster level monitoring, you should adjust the CPU and Memory limits and reservation.
-
-Number of Cluster Nodes | CPU (milli CPU) | Memory | Disk
-------------------------|-----|--------|------
-5 | 500 | 650 MB | ~1 GB/Day
-50| 2000 | 2 GB | ~5 GB/Day
-256| 4000 | 6 GB | ~18 GB/Day
-
-Additional pod resource requirements for cluster level monitoring.
-
-| Workload            |      Container                  | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable |
-|---------------------|---------------------------------|---------------|---------------|-------------|-------------|--------------|
-| Prometheus          | prometheus                      |     750Mi      |     750Mi     |    1500Mi    |    1500Mi  |       Y      |
-|                     | prometheus-proxy                |      50Mi      |      50Mi     |     100Mi    |     100Mi   |       Y      |
-|                     | prometheus-auth                 |     100Mi      |     100Mi     |     500Mi    |     200Mi   |       Y      |
-|                     | prometheus-config-reloader      |       -       |       -       |      50Mi    |      50Mi   |       N      |
-|                     | rules-configmap-reloader        |       -       |       -       |     100Mi    |      25Mi   |       N      |
-| Grafana             | grafana-init-plugin-json-copy   |      50Mi      |      50Mi     |      50Mi    |      50Mi   |       Y      |
-|                     | grafana-init-plugin-json-modify |      50Mi      |      50Mi     |      50Mi    |      50Mi   |       Y      |
-|                     | grafana                         |     100Mi      |     100Mi     |     200Mi    |     200Mi   |       Y      |
-|                     | grafana-proxy                   |      50Mi      |      50Mi     |     100Mi    |     100Mi   |       Y      |
-| Kube-State Exporter | kube-state                      |     100Mi      |     130Mi     |     100Mi    |     200Mi   |       Y      |
-| Node Exporter       | exporter-node                   |     200Mi     |     200Mi     |     200Mi    |     200Mi   |       Y      |
-| Operator            | prometheus-operator             |     100Mi      |      50Mi     |     200Mi    |     100Mi   |       Y      |
-
-
-### Resource Consumption of Other Pods
-
-Besides the Prometheus pod, there are components that are deployed that require additional resources on the worker nodes.
-
-Pod | CPU (milli CPU) | Memory (MB)
-----|-----------------|------------
-Node Exporter (Per Node) | 100 | 30
-Kube State Cluster Monitor | 100 | 130
-Grafana | 100 | 150
-Prometheus Cluster Monitoring Nginx | 50 | 50

From 9cdf2e0032b394c9d1617c78c8efc45f4ec07818 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 19 Aug 2020 14:10:00 -0700
Subject: [PATCH 191/265] Reorganize docs for Rancher v2.5

---
 content/rancher/v2.5/en/_index.md             |  12 -
 content/rancher/v2.5/en/api/_index.md         |  52 --
 .../rancher/v2.5/en/api/api-keys/_index.md    |  50 --
 .../rancher/v2.5/en/api/api-tokens/_index.md  |  29 -
 content/rancher/v2.5/en/backups/_index.md     |  14 -
 .../rancher/v2.5/en/backups/legacy/_index.md  |   6 -
 .../v2.5/en/backups/legacy/docker/_index.md   |   6 -
 .../legacy/docker/docker-backups/_index.md    |  69 --
 .../legacy/docker/docker-restore/_index.md    |  68 --
 .../legacy/special-scenarios/_index.md        |  74 --
 content/rancher/v2.5/en/cli/_index.md         |  80 ---
 .../v2.5/en/cli/backups-etcd/_index.md        |   8 -
 .../v2.5/en/cli/disaster-recovery/_index.md   |   8 -
 .../rancher/v2.5/en/cli/rancher-k8s/_index.md |  16 -
 .../v2.5/en/cluster-explorer/_index.md        | 113 ---
 .../certificate-rotation/_index.md            |  37 -
 .../cluster-explorer/certificates/_index.md   |  43 --
 .../cluster-autoscaler/_index.md              |  25 -
 .../cluster-autoscaler/amazon/_index.md       | 580 ----------------
 .../en/cluster-explorer/configmaps/_index.md  |  42 --
 .../load-balancers-and-ingress/_index.md      |  61 --
 .../ingress/_index.md                         |  80 ---
 .../load-balancers/_index.md                  |  72 --
 .../en/cluster-explorer/pipelines/_index.md   | 268 --------
 .../pipelines/concepts/_index.md              |  36 -
 .../pipelines/config/_index.md                | 645 ------------------
 .../pipelines/docs-for-v2.0.x/_index.md       | 123 ----
 .../pipelines/example-repos/_index.md         |  74 --
 .../pipelines/example/_index.md               |  72 --
 .../pipelines/storage/_index.md               | 103 ---
 .../pod-security-policy/_index.md             |  30 -
 .../cluster-explorer/project-admin/_index.md  |  41 --
 .../project-admin/namespaces/_index.md        |  68 --
 .../project-admin/project-features/_index.md  |  41 --
 .../project-features/alerts/_index.md         | 184 -----
 .../project-features/istio/_index.md          |  19 -
 .../project-features/logging/_index.md        | 108 ---
 .../project-features/monitoring/_index.md     |  81 ---
 .../project-admin/resource-quotas/_index.md   |  42 --
 .../override-container-default/_index.md      |  39 --
 .../override-namespace-default/_index.md      |  34 -
 .../quota-type-reference/_index.md            |  24 -
 .../quotas-for-projects/_index.md             |  41 --
 .../en/cluster-explorer/registries/_index.md  | 116 ----
 .../en/cluster-explorer/secrets/_index.md     |  44 --
 .../service-discovery/_index.md               |  50 --
 .../en/cluster-explorer/storage/_index.md     |  58 --
 .../attaching-existing-storage/_index.md      | 102 ---
 .../storage/examples/_index.md                |  11 -
 .../storage/examples/ebs/_index.md            |  16 -
 .../storage/examples/nfs/_index.md            |  66 --
 .../storage/examples/vsphere/_index.md        |  68 --
 .../storage/glusterfs-volumes/_index.md       |  32 -
 .../storage/how-storage-works/_index.md       |  76 ---
 .../storage/iscsi-volumes/_index.md           |  30 -
 .../provisioning-new-storage/_index.md        | 109 ---
 .../en/cluster-explorer/workloads/_index.md   |  79 ---
 .../workloads/add-a-sidecar/_index.md         |  35 -
 .../workloads/deploy-workloads/_index.md      |  57 --
 .../horitzontal-pod-autoscaler/_index.md      |  35 -
 .../hpa-background/_index.md                  |  40 --
 .../manage-hpa-with-kubectl/_index.md         | 200 ------
 .../manage-hpa-with-rancher-ui/_index.md      |  53 --
 .../testing-hpa/_index.md                     | 491 -------------
 .../workloads/rollback-workloads/_index.md    |  14 -
 .../workloads/upgrade-workloads/_index.md     |  21 -
 .../rancher/v2.5/en/contributing/_index.md    | 120 ----
 content/rancher/v2.5/en/ecm/_index.md         |  50 --
 .../v2.5/en/ecm/access-control/_index.md      |  36 -
 .../access-control/authentication/_index.md   |  98 ---
 .../authentication/ad/_index.md               | 197 ------
 .../authentication/azure-ad/_index.md         | 204 ------
 .../authentication/freeipa/_index.md          |  52 --
 .../authentication/github/_index.md           |  51 --
 .../authentication/google/_index.md           | 106 ---
 .../authentication/keycloak/_index.md         | 119 ----
 .../authentication/local/_index.md            |  14 -
 .../authentication/microsoft-adfs/_index.md   |  35 -
 .../microsoft-adfs-setup/_index.md            |  82 ---
 .../rancher-adfs-setup/_index.md              |  44 --
 .../authentication/okta/_index.md             |  51 --
 .../authentication/openldap/_index.md         |  48 --
 .../openldap/openldap-config/_index.md        |  86 ---
 .../authentication/ping-federate/_index.md    |  51 --
 .../authentication/shibboleth/_index.md       | 107 ---
 .../authentication/shibboleth/about/_index.md |  32 -
 .../authentication/user-groups/_index.md      |  60 --
 .../v2.5/en/ecm/access-control/rbac/_index.md |  28 -
 .../rbac/add-users-to-cluster/_index.md       |  55 --
 .../rbac/default-custom-roles/_index.md       | 158 -----
 .../rbac/locked-roles/_index.md               |  37 -
 .../en/ecm/access-control/rbac/mcm/_index.md  |   7 -
 .../ecm/access-control/rbac/mcm/ace/_index.md |  43 --
 .../rbac/mcm/cluster-project-roles/_index.md  | 183 -----
 .../rbac/mcm/custom-global-roles/_index.md    |   6 -
 .../rbac/mcm/global-permissions/_index.md     | 172 -----
 .../access-control/rbac/mcm/kubectl/_index.md | 103 ---
 .../rbac/mcm/project-members/_index.md        |  50 --
 .../en/ecm/backing-up-a-cluster/_index.md     | 137 ----
 .../v2.5/en/ecm/best-practices/_index.md      |  23 -
 .../v2.5/en/ecm/best-practices/mcm/_index.md  |   6 -
 .../architecture-recommendations/_index.md    | 119 ----
 .../best-practices/mcm/containers/_index.md   |  49 --
 .../mcm/deployment-strategies/_index.md       |  45 --
 .../mcm/deployment-types/_index.md            |  38 --
 .../best-practices/mcm/management/_index.md   | 132 ----
 .../best-practices/rancher-server/_index.md   |   6 -
 .../v2.5/en/ecm/cloning-clusters/_index.md    |  99 ---
 .../en/ecm/cluster-configuration/_index.md    |  68 --
 .../en/ecm/config-private-registry/_index.md  |  43 --
 .../v2.5/en/ecm/disconnecting-nodes/_index.md | 279 --------
 content/rancher/v2.5/en/ecm/drivers/_index.md |  44 --
 .../en/ecm/drivers/cluster-drivers/_index.md  |  42 --
 .../en/ecm/drivers/node-drivers/_index.md     |  37 -
 .../v2.5/en/ecm/feature-flags/_index.md       | 154 -----
 .../_index.md                                 |  40 --
 .../istio-virtual-service-ui/_index.md        |  31 -
 .../rancher/v2.5/en/ecm/globaldns/_index.md   | 118 ----
 .../v2.5/en/ecm/infrastructure/_index.md      |   4 -
 .../cloud-credentials/_index.md               |  49 --
 .../infrastructure/cloud-providers/_index.md  |  39 --
 .../cloud-providers/amazon/_index.md          | 150 ----
 .../cloud-providers/azure/_index.md           |  70 --
 .../cloud-providers/gce/_index.md             |  54 --
 .../infrastructure/node-templates/_index.md   |  47 --
 .../en/ecm/infrastructure/nodes/_index.md     | 224 ------
 .../v2.5/en/ecm/k8s-metadata/_index.md        |  89 ---
 .../_index.md                                 |  31 -
 .../en/ecm/pod-security-policies/_index.md    |  82 ---
 .../en/ecm/projects-and-namespaces/_index.md  | 194 ------
 .../v2.5/en/ecm/requirements/_index.md        | 314 ---------
 .../v2.5/en/ecm/requirements/ports/_index.md  | 186 -----
 .../en/ecm/restoring-from-backup/_index.md    | 111 ---
 .../v2.5/en/ecm/rke-templates/_index.md       | 125 ----
 .../applying-templates/_index.md              |  61 --
 .../creating-and-revising/_index.md           | 162 -----
 .../creator-permissions/_index.md             |  50 --
 .../ecm/rke-templates/enforcement/_index.md   |  38 --
 .../rke-templates/example-scenarios/_index.md |  71 --
 .../ecm/rke-templates/example-yaml/_index.md  | 112 ---
 .../en/ecm/rke-templates/overrides/_index.md  |  15 -
 .../rke-templates-and-hardware/_index.md      |  70 --
 .../template-access-and-sharing/_index.md     |  61 --
 .../v2.5/en/ecm/setting-up-k8s/_index.md      |  90 ---
 .../cluster-capabilities-table/index.md       |  22 -
 .../hosted-kubernetes-clusters/_index.md      |  32 -
 .../hosted-kubernetes-clusters/ack/_index.md  |  46 --
 .../hosted-kubernetes-clusters/aks/_index.md  | 140 ----
 .../hosted-kubernetes-clusters/cce/_index.md  |  80 ---
 .../hosted-kubernetes-clusters/eks/_index.md  | 289 --------
 .../hosted-kubernetes-clusters/gke/_index.md  |  41 --
 .../hosted-kubernetes-clusters/tke/_index.md  |  75 --
 .../imported-clusters/_index.md               | 177 -----
 .../imported-clusters/eks/_index.md           |   4 -
 .../imported-clusters/k3s/_index.md           |   4 -
 .../imported-clusters/rancher-k8s/_index.md   |   4 -
 .../production-checklist/_index.md            |  50 --
 .../nodes-and-roles/_index.md                 |  43 --
 .../recommended-architecture/_index.md        |  74 --
 .../ecm/setting-up-k8s/rke-clusters/_index.md |  34 -
 .../cluster-config-reference/_index.md        | 386 -----------
 .../pod-security-policies/_index.md           |  19 -
 .../rke-clusters/custom-nodes/_index.md       | 113 ---
 .../custom-nodes/agent-options/_index.md      |  54 --
 .../infrastructure-provider/_index.md         | 123 ----
 .../infrastructure-provider/azure/_index.md   |  48 --
 .../digital-ocean/_index.md                   |  43 --
 .../infrastructure-provider/ec2/_index.md     | 266 --------
 .../infrastructure-provider/vsphere/_index.md |  41 --
 .../provisioning-vsphere-clusters/_index.md   | 317 ---------
 .../creating-credentials/_index.md            |  41 --
 .../enabling-uuids/_index.md                  |  24 -
 .../node-template-reference/_index.md         |  93 ---
 .../rke-clusters/node-requirements/_index.md  | 184 -----
 .../rke-clusters/rancher-agents/_index.md     |  39 --
 .../rke-clusters/windows-clusters/_index.md   | 282 --------
 .../docs-for-2.1-and-2.2/_index.md            | 176 -----
 .../host-gateway-requirements/_index.md       |  37 -
 .../en/ecm/upgrading-kubernetes/_index.md     | 159 -----
 .../v2.5/en/ecm/upgrading-mcm/_index.md       |   6 -
 .../en/ecm/upgrading-mcm/rollbacks/_index.md  |   6 -
 content/rancher/v2.5/en/faq/_index.md         |  70 --
 content/rancher/v2.5/en/faq/kubectl/_index.md |  30 -
 .../v2.5/en/faq/mcm/networking/_index.md      |   9 -
 .../mcm/networking/cni-providers/_index.md    | 152 -----
 .../en/faq/mcm/removing-rancher/_index.md     |  52 --
 .../v2.5/en/faq/mcm/technical/_index.md       | 189 -----
 .../rancher/v2.5/en/faq/security/_index.md    |  15 -
 .../rancher/v2.5/en/faq/telemetry/_index.md   |  32 -
 .../v2.5/en/install-rancher-on-k8s/_index.md  |  18 -
 .../install-rancher-on-k8s/install/_index.md  | 274 --------
 .../install/chart-options/_index.md           | 255 -------
 .../install/choosing-version/_index.md        |  91 ---
 .../install/helm-version/_index.md            |  12 -
 .../install/resources/_index.md               |  30 -
 .../install/resources/advanced/_index.md      |   6 -
 .../advanced/api-audit-log/_index.md          | 577 ----------------
 .../advanced/arm64-platform/_index.md         |  25 -
 .../install/resources/advanced/etcd/_index.md |  40 --
 .../resources/advanced/firewall/_index.md     | 106 ---
 .../install/resources/air-gap/_index.md       |  24 -
 .../air-gap/install-rancher/_index.md         | 343 ----------
 .../air-gap/local-system-charts/_index.md     |  65 --
 .../populate-private-registry/_index.md       | 275 --------
 .../air-gap/prepare-registry/_index.md        |  25 -
 .../install/resources/encryption/_index.md    |   6 -
 .../custom-ca-root-certificate/_index.md      |  25 -
 .../encryption/tls-secrets/_index.md          |  36 -
 .../encryption/tls-settings/_index.md         |  32 -
 .../upgrading-cert-manager/_index.md          | 234 -------
 .../install/resources/k8s-tutorials/_index.md |   6 -
 .../resources/k8s-tutorials/ha-RKE/_index.md  | 170 -----
 .../resources/k8s-tutorials/ha-RKE2/_index.md |   7 -
 .../k8s-tutorials/how-ha-works/_index.md      |  25 -
 .../infrastructure-tutorials/_index.md        |  15 -
 .../ec2-node/_index.md                        |  64 --
 .../infrastructure-tutorials/nginx/_index.md  |  83 ---
 .../infrastructure-tutorials/nlb/_index.md    | 179 -----
 .../infrastructure-tutorials/rds/_index.md    |  34 -
 .../resources/single-node-docker/_index.md    | 150 ----
 .../single-node-docker/advanced/_index.md     |  91 ---
 .../installing-docker/_index.md               |  18 -
 .../single-node-docker/proxy/_index.md        |  36 -
 .../single-node-install-external-lb/_index.md | 240 -------
 .../install-rancher-on-k8s/upgrade/_index.md  | 222 ------
 .../upgrade/rollbacks/_index.md               |  12 -
 .../en/install-rancher-on-linux/_index.md     |  15 -
 .../install/_index.md                         |  10 -
 .../upgrade/_index.md                         |  28 -
 .../upgrade/cluster-upgrade/_index.md         |   8 -
 .../woker-node-upgrade/_index.md              |   8 -
 .../upgrade/image-upgrade/_index.md           |   6 -
 content/rancher/v2.5/en/istio/_index.md       |  84 ---
 .../rancher/v2.5/en/istio/legacy/_index.md    |   6 -
 .../en/istio/legacy/disabling-istio/_index.md |  27 -
 .../v2.5/en/istio/legacy/rbac/_index.md       |  58 --
 .../en/istio/legacy/release-notes/_index.md   |  19 -
 .../v2.5/en/istio/legacy/resources/_index.md  | 148 ----
 .../v2.5/en/istio/legacy/setup/_index.md      |  28 -
 .../legacy/setup/deploy-workloads/_index.md   | 322 ---------
 .../setup/enable-istio-in-cluster/_index.md   |  24 -
 .../enable-istio-with-psp/_index.md           |  48 --
 .../setup/enable-istio-in-namespace/_index.md |  48 --
 .../en/istio/legacy/setup/gateway/_index.md   | 130 ----
 .../legacy/setup/node-selectors/_index.md     |  38 --
 .../setup/set-up-traffic-management/_index.md |  61 --
 .../istio/legacy/setup/view-traffic/_index.md |  26 -
 .../rancher/v2.5/en/logging/legacy/_index.md  | 118 ----
 .../en/logging/legacy/elasticsearch/_index.md |  41 --
 .../v2.5/en/logging/legacy/fluentd/_index.md  |  34 -
 .../v2.5/en/logging/legacy/kafka/_index.md    |  41 --
 .../v2.5/en/logging/legacy/splunk/_index.md   |  73 --
 .../v2.5/en/logging/legacy/syslog/_index.md   |  41 --
 .../v2.5/en/longhorn-storage/_index.md        |   6 -
 .../v2.5/en/longhorn-storage/legacy/_index.md |   4 -
 .../v2.5/en/managing-applications/_index.md   | 101 ---
 .../creating-apps/_index.md                   | 123 ----
 .../creating-custom-libraries/_index.md       | 100 ---
 .../enabling-builtin-libraries/_index.md      |  25 -
 .../launching-apps/_index.md                  | 100 ---
 .../library-config/_index.md                  |  71 --
 .../managing-apps/_index.md                   |  82 ---
 .../multi-cluster-apps/_index.md              | 162 -----
 .../managing-applications/tutorial/_index.md  |  72 --
 .../v2.5/en/monitoring/legacy/_index.md       |   6 -
 .../en/monitoring/legacy/alerts/_index.md     | 243 -------
 .../legacy/alerts/default-alerts/_index.md    |  57 --
 .../legacy/alerts/expression/_index.md        | 430 ------------
 .../en/monitoring/legacy/monitoring/_index.md |   4 -
 .../monitoring/cluster-metrics/_index.md      | 110 ---
 .../monitoring/custom-metrics/_index.md       | 489 -------------
 .../legacy/monitoring/prometheus/_index.md    |  60 --
 .../monitoring/viewing-metrics/_index.md      |  58 --
 .../en/monitoring/legacy/notifiers/_index.md  | 130 ----
 .../rancher/v2.5/en/opa-gatekeper/_index.md   |   6 -
 .../v2.5/en/opa-gatekeper/legacy/_index.md    |  94 ---
 content/rancher/v2.5/en/overview/_index.md    |  66 --
 .../v2.5/en/overview/architecture/_index.md   | 203 ------
 .../v2.5/en/overview/concepts/_index.md       |  72 --
 content/rancher/v2.5/en/security/_index.md    | 101 ---
 .../rancher/v2.5/en/security/cve/_index.md    |  17 -
 .../v2.5/en/security/security-scan/_index.md  | 254 -------
 .../rancher/v2.5/en/system-tools/_index.md    | 116 ----
 .../rancher/v2.5/en/troubleshooting/_index.md |  42 --
 .../v2.5/en/troubleshooting/docker/_index.md  |   6 -
 .../v2.5/en/troubleshooting/mcm/_index.md     | 187 -----
 .../v2.5/en/troubleshooting/mcm/dns/_index.md | 217 ------
 .../mcm/imported-clusters/_index.md           |  62 --
 .../en/troubleshooting/mcm/logging/_index.md  |  48 --
 .../troubleshooting/mcm/networking/_index.md  | 118 ----
 .../v2.5/en/troubleshooting/rke/_index.md     |  18 -
 .../rke/controlplane/_index.md                |  40 --
 .../en/troubleshooting/rke/etcd/_index.md     | 365 ----------
 .../rke/kubernetes-resources/_index.md        | 271 --------
 .../troubleshooting/rke/nginx-proxy/_index.md |  69 --
 .../troubleshooting/rke/rancher_rke/_index.md |  80 ---
 .../rke/worker-and-generic/_index.md          |  35 -
 .../v2.5/en/user-preferences/_index.md        |  34 -
 content/rancher/v2.x/_index.md                |   2 +-
 content/rancher/v2.x/en/_index.md             |  11 +-
 .../tools/opa-gatekeper/_index.md             | 114 ----
 .../cluster-capabilities-table/index.md       |  22 -
 .../hosted-kubernetes-clusters/_index.md      |   2 +-
 .../hosted-kubernetes-clusters/eks/_index.md  |   5 +-
 .../imported-clusters/_index.md               |   4 +-
 .../cluster-provisioning/production/_index.md |   2 +-
 .../registering/_index.md                     |   4 +
 .../rke-clusters/_index.md                    |   2 +-
 content/rancher/v2.x/en/dashboard/_index.md   |   4 +
 .../en/dashboard/backup-restore/_index.md     |   4 +
 .../v2.x/en/dashboard/cis-scans/_index.md     |   4 +
 .../en/dashboard/cluster-explorer/_index.md   |   4 +
 .../rancher/v2.x/en/dashboard/istio/_index.md |   4 +
 .../en/dashboard}/logging/_index.md           |   6 +-
 .../dashboard/monitoring-alerting}/_index.md  |  60 +-
 .../rancher/v2.x/en/dashboard/opa/_index.md   |   4 +
 .../rancher/v2.x/en/dashboard/repos/_index.md |   4 +
 .../k8s-install/helm-rancher/_index.md        |   6 +-
 .../air-gap-helm2/install-rancher/_index.md   |   6 +-
 .../populate-private-registry/_index.md       |   4 +-
 .../options/chart-options/_index.md           |   2 +-
 .../options/helm2/helm-rancher/_index.md      |   2 +-
 .../helm-rancher/chart-options/_index.md      |   2 +-
 .../helm2/helm-rancher/tls-secrets/_index.md  |   4 +-
 .../options/tls-secrets/_index.md             |   4 +-
 .../options/upgrading-cert-manager/_index.md  |  28 +-
 .../helm-2-instructions/_index.md             |  13 +-
 .../air-gap/install-rancher/_index.md         |  11 +-
 .../populate-private-registry/_index.md       |   4 +-
 .../requirements/installing-docker/_index.md  |   6 +-
 .../en/security/benchmark-2.3.5/_index.md     | 105 ++-
 .../v2.x/en/security/benchmark-2.4/_index.md  |  90 ++-
 .../v2.x/en/security/hardening-2.3/_index.md  |  18 +-
 333 files changed, 308 insertions(+), 26590 deletions(-)
 delete mode 100644 content/rancher/v2.5/en/_index.md
 delete mode 100644 content/rancher/v2.5/en/api/_index.md
 delete mode 100644 content/rancher/v2.5/en/api/api-keys/_index.md
 delete mode 100644 content/rancher/v2.5/en/api/api-tokens/_index.md
 delete mode 100644 content/rancher/v2.5/en/backups/_index.md
 delete mode 100644 content/rancher/v2.5/en/backups/legacy/_index.md
 delete mode 100644 content/rancher/v2.5/en/backups/legacy/docker/_index.md
 delete mode 100644 content/rancher/v2.5/en/backups/legacy/docker/docker-backups/_index.md
 delete mode 100644 content/rancher/v2.5/en/backups/legacy/docker/docker-restore/_index.md
 delete mode 100644 content/rancher/v2.5/en/backups/legacy/special-scenarios/_index.md
 delete mode 100644 content/rancher/v2.5/en/cli/_index.md
 delete mode 100644 content/rancher/v2.5/en/cli/backups-etcd/_index.md
 delete mode 100644 content/rancher/v2.5/en/cli/disaster-recovery/_index.md
 delete mode 100644 content/rancher/v2.5/en/cli/rancher-k8s/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/certificates/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/registries/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/secrets/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md
 delete mode 100644 content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md
 delete mode 100644 content/rancher/v2.5/en/contributing/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/ad/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/github/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/local/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/openldap/openldap-config/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/add-users-to-cluster/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/locked-roles/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/mcm/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/mcm/ace/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/mcm/kubectl/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/access-control/rbac/mcm/project-members/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/mcm/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/mcm/architecture-recommendations/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/mcm/containers/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-strategies/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-types/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/mcm/management/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/best-practices/rancher-server/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/cloning-clusters/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/cluster-configuration/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/config-private-registry/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/disconnecting-nodes/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/drivers/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/drivers/node-drivers/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/feature-flags/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/globaldns/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/cloud-credentials/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/amazon/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/azure/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/gce/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/node-templates/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/k8s-metadata/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/pod-security-policies-in-projects/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/requirements/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/requirements/ports/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/restoring-from-backup/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/creating-and-revising/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/creator-permissions/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/enforcement/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/example-scenarios/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/example-yaml/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/overrides/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/rke-templates-and-hardware/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/rke-templates/template-access-and-sharing/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/cluster-capabilities-table/index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/eks/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/upgrading-mcm/_index.md
 delete mode 100644 content/rancher/v2.5/en/ecm/upgrading-mcm/rollbacks/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/kubectl/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/mcm/networking/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/mcm/technical/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/security/_index.md
 delete mode 100644 content/rancher/v2.5/en/faq/telemetry/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/choosing-version/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/helm-version/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/api-audit-log/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/etcd/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/firewall/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/local-system-charts/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/prepare-registry/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/custom-ca-root-certificate/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-secrets/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/upgrading-cert-manager/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE2/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/how-ha-works/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/installing-docker/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/proxy/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/single-node-install-external-lb/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/rollbacks/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-linux/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-linux/install/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
 delete mode 100644 content/rancher/v2.5/en/install-rancher-on-linux/upgrade/image-upgrade/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/disabling-istio/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/rbac/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/release-notes/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/resources/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/deploy-workloads/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/gateway/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/node-selectors/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/set-up-traffic-management/_index.md
 delete mode 100644 content/rancher/v2.5/en/istio/legacy/setup/view-traffic/_index.md
 delete mode 100644 content/rancher/v2.5/en/logging/legacy/_index.md
 delete mode 100644 content/rancher/v2.5/en/logging/legacy/elasticsearch/_index.md
 delete mode 100644 content/rancher/v2.5/en/logging/legacy/fluentd/_index.md
 delete mode 100644 content/rancher/v2.5/en/logging/legacy/kafka/_index.md
 delete mode 100644 content/rancher/v2.5/en/logging/legacy/splunk/_index.md
 delete mode 100644 content/rancher/v2.5/en/logging/legacy/syslog/_index.md
 delete mode 100644 content/rancher/v2.5/en/longhorn-storage/_index.md
 delete mode 100644 content/rancher/v2.5/en/longhorn-storage/legacy/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/enabling-builtin-libraries/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/library-config/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/managing-apps/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/multi-cluster-apps/_index.md
 delete mode 100644 content/rancher/v2.5/en/managing-applications/tutorial/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/alerts/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/alerts/default-alerts/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/alerts/expression/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/monitoring/cluster-metrics/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/monitoring/custom-metrics/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/monitoring/prometheus/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/monitoring/viewing-metrics/_index.md
 delete mode 100644 content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
 delete mode 100644 content/rancher/v2.5/en/opa-gatekeper/_index.md
 delete mode 100644 content/rancher/v2.5/en/opa-gatekeper/legacy/_index.md
 delete mode 100644 content/rancher/v2.5/en/overview/_index.md
 delete mode 100644 content/rancher/v2.5/en/overview/architecture/_index.md
 delete mode 100644 content/rancher/v2.5/en/overview/concepts/_index.md
 delete mode 100644 content/rancher/v2.5/en/security/_index.md
 delete mode 100644 content/rancher/v2.5/en/security/cve/_index.md
 delete mode 100644 content/rancher/v2.5/en/security/security-scan/_index.md
 delete mode 100644 content/rancher/v2.5/en/system-tools/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/docker/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/rke/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md
 delete mode 100644 content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md
 delete mode 100644 content/rancher/v2.5/en/user-preferences/_index.md
 delete mode 100644 content/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table/index.md
 create mode 100644 content/rancher/v2.x/en/cluster-provisioning/registering/_index.md
 create mode 100644 content/rancher/v2.x/en/dashboard/_index.md
 create mode 100644 content/rancher/v2.x/en/dashboard/backup-restore/_index.md
 create mode 100644 content/rancher/v2.x/en/dashboard/cis-scans/_index.md
 create mode 100644 content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md
 create mode 100644 content/rancher/v2.x/en/dashboard/istio/_index.md
 rename content/rancher/{v2.5/en => v2.x/en/dashboard}/logging/_index.md (94%)
 rename content/rancher/{v2.5/en/monitoring => v2.x/en/dashboard/monitoring-alerting}/_index.md (52%)
 create mode 100644 content/rancher/v2.x/en/dashboard/opa/_index.md
 create mode 100644 content/rancher/v2.x/en/dashboard/repos/_index.md

diff --git a/content/rancher/v2.5/en/_index.md b/content/rancher/v2.5/en/_index.md
deleted file mode 100644
index 84944368e11..00000000000
--- a/content/rancher/v2.5/en/_index.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: "Rancher 2.5"
-shortTitle: "Rancher 2.5"
-description: "Rancher adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
-metaTitle: "Rancher 2.5 Docs: What is New?"
-metaDescription: "Rancher 2 adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
-insertOneSix: false
-weight: 1
-ctaBanner: 0
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/api/_index.md b/content/rancher/v2.5/en/api/_index.md
deleted file mode 100644
index f873346680c..00000000000
--- a/content/rancher/v2.5/en/api/_index.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: API
-weight: 19
----
-
-## How to use the API
-
-The API has its own user interface accessible from a web browser.  This is an easy way to see resources, perform actions, and see the equivalent cURL or HTTP request & response.  To access it, click on your user avatar in the upper right corner. Under **API & Keys**, you can find the URL endpoint as well as create [API keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/).
-
-## Authentication
-
-API requests must include authentication information.  Authentication is done with HTTP basic authentication using [API Keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/). API keys can create new clusters and have access to multiple clusters via `/v3/clusters/`. [Cluster and project roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/) apply to these keys and restrict what clusters and projects the account can see and what actions they can take.
-
-By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. For details on how to invalidate them, refer to the [API tokens page]({{<baseurl>}}/rancher/v2.x/en/api/api-tokens).
-
-## Making requests
-
-The API is generally RESTful but has several features to make the definition of everything discoverable by a client so that generic clients can be written instead of having to write specific code for every type of resource.  For detailed info about the generic API spec, [see here](https://github.com/rancher/api-spec/blob/master/specification.md).
-
-- Every type has a Schema which describes:
-  - The URL to get to the collection of this type of resources
-  - Every field the resource can have, along with their type, basic validation rules, whether they are required or optional, etc.
-  - Every action that is possible on this type of resource, with their inputs and outputs (also as schemas).
-  - Every field that filtering is allowed on
-  - What HTTP verb methods are available for the collection itself, or for individual resources in the collection.
-
-
-- So the theory is that you can load just the list of schemas and know everything about the API.  This is in fact how the UI for the API works, it contains no code specific to Rancher itself.  The URL to get Schemas is sent in every HTTP response as a `X-Api-Schemas` header.  From there you can follow the `collection` link on each schema to know where to list resources, and other `links` inside of the returned resources to get any other information.
-
-- In practice, you will probably just want to construct URL strings.  We highly suggest limiting this to the top-level to list a collection (`/v3/<type>`) or get a specific resource (`/v3/<type>/<id>`).  Anything deeper than that is subject to change in future releases.
-
-- Resources have relationships between each other called links.  Each resource includes a map of `links` with the name of the link and the URL to retrieve that information.  Again you should `GET` the resource and then follow the URL in the `links` map, not construct these strings yourself.
-
-- Most resources have actions, which do something or change the state of the resource.  To use these, send a HTTP `POST` to the URL in the `actions` map for the action you want.  Some actions require input or produce output, see the individual documentation for each type or the schemas for specific information.
-
-- To edit a resource, send a HTTP `PUT` to the `links.update` link on the resource with the fields that you want to change.  If the link is missing then you don't have permission to update the resource. Unknown fields and ones that are not editable are ignored.
-
-- To delete a resource, send a HTTP `DELETE` to the `links.remove` link on the resource.  If the link is missing then you don't have permission to update the resource.
-
-- To create a new resource, HTTP `POST` to the collection URL in the schema (which is `/v3/<type>`).
-
-## Filtering
-
-Most collections can be filtered on the server-side by common fields using HTTP query parameters.  The `filters` map shows you what fields can be filtered on and what the filtered values were for the request you made.  The API UI has controls to setup filtering and show you the appropriate request.  For simple "equals" matches it's just `field=value`.  Modifiers can be added to the field name, e.g. `field_gt=42` for "field is greater than 42".  See the [API spec](https://github.com/rancher/api-spec/blob/master/specification.md#filtering) for full details.
-
-## Sorting
-
-Most collections can be sorted on the server-side by common fields using HTTP query parameters.  The `sortLinks` map shows you what sorts are available, along with the URL to get the collection sorted by that.  It also includes info about what the current response was sorted by, if specified.
-
-## Pagination
-
-API responses are paginated with a limit of 100 resources per page by default.  This can be changed with the `limit` query parameter, up to a maximum of 1000, e.g. `/v3/pods?limit=1000`.  The `pagination` map in collection responses tells you whether or not you have the full result set and has a link to the next page if you do not.
diff --git a/content/rancher/v2.5/en/api/api-keys/_index.md b/content/rancher/v2.5/en/api/api-keys/_index.md
deleted file mode 100644
index 1075ef67e6f..00000000000
--- a/content/rancher/v2.5/en/api/api-keys/_index.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: API Keys
-weight: 3
----
-
-If you want to access your Rancher clusters, projects, or other objects using external applications, you can do so using the Rancher API. However, before your application can access the API, you must provide the app with a key used to authenticate with Rancher. You can obtain a key using the Rancher UI.
-
-An API key is also required for using Rancher CLI.
-
-API Keys are composed of four components:
-
-- **Endpoint:** This is the IP address and path that other applications use to send requests to the Rancher API.
-- **Access Key:** The token's username.
-- **Secret Key:** The token's password. For applications that prompt you for two different strings for API authentication, you usually enter the two keys together.
-- **Bearer Token:** The token username and password concatenated together. Use this string for applications that prompt you for one authentication string.
-
-## Creating an API Key
-
-1. Select **User Avatar** > **API & Keys** from the **User Settings** menu in the upper-right.
-
-2. Click **Add Key**.
-
-3. **Optional:** Enter a description for the API key and select an expiration period or a scope. We recommend setting an expiration date.
-
-    The API key won't be valid after expiration. Shorter expiration periods are more secure.
-    
-    A scope will limit the API key so that it will only work against the Kubernetes API of the specified cluster. If the cluster is configured with an Authorized Cluster Endpoint, you will be able to use a scoped token directly against the cluster's API without proxying through the Rancher server. See [Authorized Cluster Endpoints]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) for more information.
-
-4. Click **Create**.
-
-    **Step Result:** Your API Key is created. Your API **Endpoint**, **Access Key**, **Secret Key**, and **Bearer Token** are displayed.
-
-    Use the **Bearer Token** to authenticate with Rancher CLI.
-
-5. Copy the information displayed to a secure location. This information is only displayed once, so if you lose your key, you'll have to make a new one.
-
-## What's Next?
-
-- Enter your API key information into the application that will send requests to the Rancher API.
-- Learn more about the Rancher endpoints and parameters by selecting **View in API** for an object in the Rancher UI.
-- API keys are used for API calls and [Rancher CLI]({{<baseurl>}}/rancher/v2.x/en/cli).
-
-## Deleting API Keys
-
-If you need to revoke an API key, delete it. You should delete API keys:
-
-- That may have been compromised.
-- That have expired.
-
-To delete an API, select the stale key and click **Delete**.
diff --git a/content/rancher/v2.5/en/api/api-tokens/_index.md b/content/rancher/v2.5/en/api/api-tokens/_index.md
deleted file mode 100644
index eb823bb7cea..00000000000
--- a/content/rancher/v2.5/en/api/api-tokens/_index.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-title: API Tokens
-weight: 1
----
-
-By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password.
-
-You can deactivate API tokens by deleting them or by deactivating the user account.
-
-To delete a token,
-
-1. Go to the list of all tokens in the Rancher API view at `https://<Rancher-Server-IP>/v3/tokens`.
-
-1. Access the token you want to delete by its ID. For example, `https://<Rancher-Server-IP>/v3/tokens/kubectl-shell-user-vqkqt`
-
-1. Click **Delete.**
-
-Here is the complete list of tokens that are generated with `ttl=0`:
-
-| Token | Description |
-|-------|-------------|
-| `kubeconfig-*` | Kubeconfig token |
-| `kubectl-shell-*` | Access to `kubectl` shell in the browser |
-| `agent-*` | Token for agent deployment |
-| `compose-token-*` | Token for compose |
-| `helm-token-*` | Token for Helm chart deployment |
-| `*-pipeline*` | Pipeline token for project |
-| `telemetry-*` | Telemetry token |
-| `drain-node-*` | Token for drain (we use `kubectl` for drain because there is no native Kubernetes API) |
diff --git a/content/rancher/v2.5/en/backups/_index.md b/content/rancher/v2.5/en/backups/_index.md
deleted file mode 100644
index 595fdeb458f..00000000000
--- a/content/rancher/v2.5/en/backups/_index.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-title: Backups and Disaster Recovery
-weight: 8
----
-
-> This section is under construction.
-
-This section is devoted to protecting your data in a disaster scenario.
-
-To protect yourself from a disaster scenario, you should create backups on a regular basis.
-
-We recommend using the backup/restore application to back up Rancher and to restore it from backup.
-
-The Helm chart for the application is available as in Rancher. After you have enabled the application, you will be able to use backup templates for Rancher, Fleet, and the Enterprise Cluster Manager.
diff --git a/content/rancher/v2.5/en/backups/legacy/_index.md b/content/rancher/v2.5/en/backups/legacy/_index.md
deleted file mode 100644
index 3845dfe3d96..00000000000
--- a/content/rancher/v2.5/en/backups/legacy/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Legacy Backup and Restore Docs
-weight: 2
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/backups/legacy/docker/_index.md b/content/rancher/v2.5/en/backups/legacy/docker/_index.md
deleted file mode 100644
index 3306f194e62..00000000000
--- a/content/rancher/v2.5/en/backups/legacy/docker/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Rancher Installed with Docker
-weight: 4
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/backups/legacy/docker/docker-backups/_index.md b/content/rancher/v2.5/en/backups/legacy/docker/docker-backups/_index.md
deleted file mode 100644
index 97825f9069a..00000000000
--- a/content/rancher/v2.5/en/backups/legacy/docker/docker-backups/_index.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: Backing up Rancher Installed with Docker
-weight: 4
----
-
-After completing your Docker installation of Rancher, we recommend creating backups of it on a regular basis. Having a recent backup will let you recover quickly from an unexpected disaster.
-
-## Before You Start
-
-During the creation of your backup, you'll enter a series of commands, replacing placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`). Here's an example of a command with a placeholder:
-
-```
-docker run  --volumes-from rancher-data-<DATE> -v $PWD:/backup busybox tar pzcvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz /var/lib/rancher
-```
-
-In this command, `<DATE>` is a placeholder for the date that the data container and backup were created. `9-27-18` for example.
-
-Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the [procedure below](#creating-a-backup).
-
-<sup>Terminal `docker ps` Command, Displaying Where to Find `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>`</sup>
-![Placeholder Reference]({{<baseurl>}}/img/rancher/placeholder-ref.png)
-
-| Placeholder                | Example                    | Description                                               |
-| -------------------------- | -------------------------- | --------------------------------------------------------- |
-| `<RANCHER_CONTAINER_TAG>`  | `v2.0.5`                   | The rancher/rancher image you pulled for initial install. |
-| `<RANCHER_CONTAINER_NAME>` | `festive_mestorf`          | The name of your Rancher container.                       |
-| `<RANCHER_VERSION>`        | `v2.0.5`                   | The version of Rancher that you're creating a backup for. |
-| `<DATE>`                   | `9-27-18`                  | The date that the data container or backup was created.   |
-<br/>
-
-You can obtain `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>` by logging into your Rancher Server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped with `docker ps -a`. Use these commands for help anytime while creating backups.
-
-## Creating a Backup
-
-This procedure creates a backup that you can restore if Rancher encounters a disaster scenario.
-
-
-1. Using a remote Terminal connection, log into the node running your Rancher Server.
-
-1. Stop the container currently running Rancher Server. Replace `<RANCHER_CONTAINER_NAME>` with the [name of your Rancher container](#before-you-start).
-
-    ```
-    docker stop <RANCHER_CONTAINER_NAME>
-    ```
-1. <a id="backup"></a>Use the command below, replacing each [placeholder](#before-you-start), to create a data container from the Rancher container that you just stopped.
-
-    ```
-    docker create --volumes-from <RANCHER_CONTAINER_NAME> --name rancher-data-<DATE> rancher/rancher:<RANCHER_CONTAINER_TAG>
-    ```
-
-1. <a id="tarball"></a>From the data container that you just created (`rancher-data-<DATE>`), create a backup tarball (`rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`). Use the following command, replacing each [placeholder](#before-you-start).
-
-    ```
-    docker run  --volumes-from rancher-data-<DATE> -v $PWD:/backup:z busybox tar pzcvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz /var/lib/rancher
-    ```
-
-    **Step Result:** A stream of commands runs on the screen.
-
-1. Enter the `ls` command to confirm that the backup tarball was created. It will have a name similar to `rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`.
-
-1. Move your backup tarball to a safe location external to your Rancher Server. Then delete the `rancher-data-<DATE>` container from your Rancher Server.
-
-1. Restart Rancher Server. Replace `<RANCHER_CONTAINER_NAME>` with the name of your [Rancher container](#before-you-start).
-
-    ```
-    docker start <RANCHER_CONTAINER_NAME>
-    ```
-
-**Result:** A backup tarball of your Rancher Server data is created. See [Restoring Backups: Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/single-node-restoration) if you need to restore backup data.
diff --git a/content/rancher/v2.5/en/backups/legacy/docker/docker-restore/_index.md b/content/rancher/v2.5/en/backups/legacy/docker/docker-restore/_index.md
deleted file mode 100644
index 18941da7d84..00000000000
--- a/content/rancher/v2.5/en/backups/legacy/docker/docker-restore/_index.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: Restoring Rancher Installed with Docker
-weight: 3
----
-
-If you encounter a disaster scenario, you can restore your Rancher Server to your most recent backup.
-
-## Before You Start
-
-When restoring your backup, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`). Here's an example of a command with a placeholder:
-
-```
-docker run  --volumes-from <RANCHER_CONTAINER_NAME> -v $PWD:/backup \
-busybox sh -c "rm /var/lib/rancher/* -rf  && \
-tar pzxvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>"
-```
-
-In this command, `<RANCHER_CONTAINER_NAME>` and `<RANCHER_VERSION>-<DATE>` are environment variables for your Rancher deployment.
-
-Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the [procedure below](#creating-a-backup).
-
-<sup>Terminal `docker ps` Command, Displaying Where to Find `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>`</sup>
-![Placeholder Reference]({{<baseurl>}}/img/rancher/placeholder-ref.png)
-
-| Placeholder                | Example                    | Description                                               |
-| -------------------------- | -------------------------- | --------------------------------------------------------- |
-| `<RANCHER_CONTAINER_TAG>`  | `v2.0.5`                   | The rancher/rancher image you pulled for initial install. |
-| `<RANCHER_CONTAINER_NAME>` | `festive_mestorf`          | The name of your Rancher container.                       |
-| `<RANCHER_VERSION>`        | `v2.0.5`                   | The version number for your Rancher backup.               |
-| `<DATE>`                   | `9-27-18`                  | The date that the data container or backup was created.   |
-<br/>
-
-You can obtain `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>` by logging into your Rancher Server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped using a different command: `docker ps -a`. Use these commands for help anytime during while creating backups.
-
-## Restoring Backups
-
-Using a [backup]({{<baseurl>}}/rancher/v2.x/en/backups/backups/single-node-backups/) that you created earlier, restore Rancher to its last known healthy state.
-
-1. Using a remote Terminal connection, log into the node running your Rancher Server.
-
-1. Stop the container currently running Rancher Server. Replace `<RANCHER_CONTAINER_NAME>` with the [name of your Rancher container](#before-you-start).
-
-    ```
-    docker stop <RANCHER_CONTAINER_NAME>
-    ```
-1. Move the backup tarball that you created during completion of [Creating Backups—Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/backups/single-node-backups/) onto your Rancher Server. Change to the directory that you moved it to. Enter `dir` to confirm that it's there.
-
-    If you followed the naming convention we suggested in [Creating Backups—Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/backups/single-node-backups/), it will have a name similar to  `rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`.
-
-1. Enter the following command to delete your current state data and replace it with your backup data, replacing the [placeholders](#before-you-start). Don't forget to close the quotes.
-
-    >**Warning!** This command deletes all current state data from your Rancher Server container. Any changes saved after your backup tarball was created will be lost.
-
-    ```
-    docker run  --volumes-from <RANCHER_CONTAINER_NAME> -v $PWD:/backup \
-    busybox sh -c "rm /var/lib/rancher/* -rf  && \
-    tar pzxvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz"
-    ```
-
-    **Step Result:** A series of commands should run.
-
-1. Restart your Rancher Server container, replacing the [placeholder](#before-you-start). It will restart using your backup data.
-
-    ```
-    docker start <RANCHER_CONTAINER_NAME>
-    ```
-
-1.  Wait a few moments and then open Rancher in a web browser. Confirm that the restoration succeeded and that your data is restored.
diff --git a/content/rancher/v2.5/en/backups/legacy/special-scenarios/_index.md b/content/rancher/v2.5/en/backups/legacy/special-scenarios/_index.md
deleted file mode 100644
index 889376b492a..00000000000
--- a/content/rancher/v2.5/en/backups/legacy/special-scenarios/_index.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: Special Scenarios for Rollbacks
-weight: 40
----
-
-If you are rolling back to versions in either of these scenarios, you must follow some extra instructions in order to get your clusters working.
-
-- Rolling back from v2.1.6+ to any version between v2.1.0 - v2.1.5 or v2.0.0 - v2.0.10.
-- Rolling back from v2.0.11+ to any version between v2.0.0 - v2.0.10.  
-
-Because of the changes necessary to address [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321), special steps are necessary if the user wants to roll back to a previous version of Rancher where this vulnerability exists. The steps are as follows:
-
-1. Record the `serviceAccountToken` for each cluster.  To do this, save the following script on a machine with `kubectl` access to the Rancher management plane and execute it.  You will need to run these commands on the machine where the rancher container is running. Ensure JQ is installed before running the command. The commands will vary depending on how you installed Rancher.
-
-
-    **Rancher Installed with Docker**
-    ```
-    docker exec <NAME OF RANCHER CONTAINER> kubectl get clusters -o json | jq '[.items[] | select(any(.status.conditions[]; .type == "ServiceAccountMigrated")) | {name: .metadata.name, token: .status.serviceAccountToken}]' > tokens.json
-    ```
-
-    **Rancher Installed on a Kubernetes Cluster**
-    ```
-    kubectl get clusters -o json | jq '[.items[] | select(any(.status.conditions[]; .type == "ServiceAccountMigrated")) | {name: .metadata.name, token: .status.serviceAccountToken}]' > tokens.json
-    ```
-
-2. After executing the command a `tokens.json` file will be created.  Important! Back up this file in a safe place.** You will need it to restore functionality to your clusters after rolling back Rancher.  **If you lose this file, you may lose access to your clusters.**
-
-3. Rollback Rancher following the [normal instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/).
-
-4. Once Rancher comes back up, every cluster managed by Rancher (except for Imported clusters) will be in an `Unavailable` state.
-
-5. Apply the backed up tokens based on how you installed Rancher.
-
-    **Rancher Installed with Docker**
-
-    Save the following script as `apply_tokens.sh` to the machine where the Rancher docker container is running. Also copy the `tokens.json` file created previously to the same directory as the script.
-    ```
-    set -e
-
-    tokens=$(jq .[] -c tokens.json)
-    for token in $tokens; do
-        name=$(echo $token | jq -r .name)
-        value=$(echo $token | jq -r .token)
-
-        docker exec $1 kubectl patch --type=merge clusters $name -p "{\"status\": {\"serviceAccountToken\": \"$value\"}}"
-    done
-    ```
-     the script to allow execution (`chmod +x apply_tokens.sh`) and execute the script as follows:
-    ```
-    ./apply_tokens.sh <DOCKER CONTAINER NAME>
-    ```
-    After a few moments the clusters will go from Unavailable back to Available.
-
-    **Rancher Installed on a Kubernetes Cluster**
-
-    Save the following script as `apply_tokens.sh` to a machine with kubectl access to the Rancher management plane. Also copy the `tokens.json` file created previously to the same directory as the script.
-    ```
-    set -e
-
-    tokens=$(jq .[] -c tokens.json)
-    for token in $tokens; do
-        name=$(echo $token | jq -r .name)
-        value=$(echo $token | jq -r .token)
-
-       kubectl patch --type=merge clusters $name -p "{\"status\": {\"serviceAccountToken\": \"$value\"}}"
-    done
-    ```
-    Set the script to allow execution (`chmod +x apply_tokens.sh`) and execute the script as follows:
-    ```
-    ./apply_tokens.sh
-    ```
-    After a few moments the clusters will go from `Unavailable` back to `Available`.
-
-6. Continue using Rancher as normal.
diff --git a/content/rancher/v2.5/en/cli/_index.md b/content/rancher/v2.5/en/cli/_index.md
deleted file mode 100644
index 6dafdd1aedd..00000000000
--- a/content/rancher/v2.5/en/cli/_index.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: The Rancher Command Line Interface 
-description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI
-metaTitle: "Using the Rancher Command Line Interface "
-metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI"
-weight: 16
----
-
-The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI.
-
-### Download Rancher CLI
-
-The binary can be downloaded directly from the UI. The link can be found in the right hand side of the footer in the UI. We have binaries for Windows, Mac, and Linux. You can also check the [releases page for our CLI](https://github.com/rancher/cli/releases) for direct downloads of the binary.
-
-### Requirements
-
-After you download the Rancher CLI, you need to make a few configurations. Rancher CLI requires:
-
-- Your [Rancher Server URL]({{<baseurl>}}/rancher/v2.x/en/admin-settings/server-url), which is used to connect to Rancher Server.
-- An API Bearer Token, which is used to authenticate with Rancher. For more information about obtaining a Bearer Token, see [Creating an API Key]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/).
-
-### CLI Authentication
-
-Before you can use Rancher CLI to control your Rancher Server, you must authenticate using an API Bearer Token. Log in using the following command (replace `<BEARER_TOKEN>` and `<SERVER_URL>` with your information):
-
-```bash
-$ ./rancher login https://<SERVER_URL> --token <BEARER_TOKEN>
-```
-
-If Rancher Server uses a self-signed certificate, Rancher CLI prompts you to continue with the connection.
-
-### Project Selection
-
-Before you can perform any commands, you must select a Rancher project to perform those commands against. To select a [project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/) to work on, use the command `./rancher context switch`. When you enter this command, a list of available projects displays. Enter a number to choose your project.
-
-**Example: `./rancher context switch` Output**
-```
-User:rancher-cli-directory user$ ./rancher context switch
-NUMBER    CLUSTER NAME   PROJECT ID              PROJECT NAME   
-1         cluster-2      c-7q96s:p-h4tmb         project-2      
-2         cluster-2      c-7q96s:project-j6z6d   Default        
-3         cluster-1      c-lchzv:p-xbpdt         project-1      
-4         cluster-1      c-lchzv:project-s2mch   Default       
-Select a Project:
-```
-
-After you enter a number, the console displays a message that you've changed projects.
-
-```
-INFO[0005] Setting new context to project project-1
-INFO[0005] Saving config to /Users/markbishop/.rancher/cli2.json
-```
-
-### Commands
-
-The following commands are available for use in Rancher CLI.
-
-| Command  | Result  |
-|---|---|
-| `apps, [app]`  | Performs operations on catalog applications (i.e. individual [Helm charts](https://docs.helm.sh/developing_charts/) or [Rancher charts]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/#chart-directory-structure)).  |
-| `catalog`  | Performs operations on [catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/).  |
-| `clusters, [cluster]`  | Performs operations on your [clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).  |
-| `context`  | Switches between Rancher [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/). For an example, see [Project Selection](#project-selection).  |
-| `inspect [OPTIONS] [RESOURCEID RESOURCENAME]`  | Displays details about [Kubernetes resources](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#resource-types) or Rancher resources (i.e.: [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/) and [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)). Specify resources by name or ID.  |
-| `kubectl`  |Runs [kubectl commands](https://kubernetes.io/docs/reference/kubectl/overview/#operations).   |
-| `login, [l]`  | Logs into a Rancher Server. For an example, see [CLI Authentication](#cli-authentication).  |
-| `namespaces, [namespace]`  |Performs operations on [namespaces]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces).   |
-| `nodes, [node]`  |Performs operations on [nodes]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#kubernetes).   |
-| `projects, [project]`  | Performs operations on [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).  |
-| `ps`  | Displays [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads) in a project.  |
-| `settings, [setting]`  | Shows the current settings for your Rancher Server.  |
-| `ssh`  | Connects to one of your cluster nodes using the SSH protocol.  |
-| `help, [h]`  | Shows a list of commands or help for one command.  |
-
-
-### Rancher CLI Help
-
-Once logged into Rancher Server using the CLI, enter `./rancher --help` for a list of commands.
-
-All commands accept the `--help` flag, which documents each command's usage.
diff --git a/content/rancher/v2.5/en/cli/backups-etcd/_index.md b/content/rancher/v2.5/en/cli/backups-etcd/_index.md
deleted file mode 100644
index 2c191c772ab..00000000000
--- a/content/rancher/v2.5/en/cli/backups-etcd/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Backups - Etcd snapshot
-weight: 1
----
-
-The Rancher Kubernetes cluster can be restored from an etcd snapshot.
-
-If Rancher was installed on another type of Kubernetes, refer to the official documentation of the Kubernetes distribution for more information about backing up the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cli/disaster-recovery/_index.md b/content/rancher/v2.5/en/cli/disaster-recovery/_index.md
deleted file mode 100644
index 6662f7bda76..00000000000
--- a/content/rancher/v2.5/en/cli/disaster-recovery/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Disaster Recovery - Etcd Restore Snapshot
-weight: 1
----
-
-The Rancher Kubernetes cluster can be restored from an etcd snapshot.
-
-If Rancher was installed on another type of Kubernetes, refer to the official documentation of the Kubernetes distribution for more information about backing up the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cli/rancher-k8s/_index.md b/content/rancher/v2.5/en/cli/rancher-k8s/_index.md
deleted file mode 100644
index acc0615f314..00000000000
--- a/content/rancher/v2.5/en/cli/rancher-k8s/_index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: Rancher Kubernetes
-weight: 1
----
-
-> This page is under construction.
-
-The Rancher CLI comes with a Kubernetes distribution called Rancher Kubernetes, which allows you to set up a Kubernetes cluster more easily as a prerequisite to installing Rancher.
-
-Rancher Kubernetes is based on K3s, and has more secure default settings. It is a new feature in Rancher 2.5.
-
-Rancher Kubernetes clusters can also be imported into Rancher.
-
-Rancher Kubernetes is not to be confused with RKE Kubernetes or K3s Kubernetes, which are separate Kubernetes distributions provided by Rancher. RKE is the oldest of the three distributions. When the Enterprise Cluster Manager is enabled, Rancher can provision RKE Kubernetes clusters, but Rancher Kubernetes clusters and K3s Kubernetes clusters have to be installed separately and imported into Rancher.
-
-In other words, Rancher can only install Rancher Kubernetes when you are using the Rancher CLI  to set up a local Kubernetes cluster for the Rancher server.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/_index.md b/content/rancher/v2.5/en/cluster-explorer/_index.md
deleted file mode 100644
index dc57d68980d..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/_index.md
+++ /dev/null
@@ -1,113 +0,0 @@
----
-title: Cluster Explorer
-weight: 5
----
-
-> This section is under construction.
-
-After you provision a cluster in Rancher, you can begin using powerful Kubernetes features to deploy and scale your containerized applications in development, testing, or production environments.
-
-This page covers the following topics:
-
-- [Switching between clusters](#switching-between-clusters)
-- [Managing clusters in Rancher](#managing-clusters-in-rancher)
-- [Configuring tools](#configuring-tools)
-
-> This section assumes a basic familiarity with Docker and Kubernetes. For a brief explanation of how Kubernetes components work together, refer to the [concepts]({{<baseurl>}}/rancher/v2.x/en/overview/concepts) page.
-
-## Switching between Clusters
-
-To switch between clusters, use the drop-down available in the navigation bar.
-
-Alternatively, you can switch between projects and clusters directly in the navigation bar. Open the **Global** view and select **Clusters** from the main menu. Then select the name of the cluster you want to open.
-
-## Managing Clusters in Rancher
-
-After clusters have been [provisioned into Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/), [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) will need to manage these clusters. There are many different options of how to manage your cluster. 
-
-{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
-
-## Configuring Tools
-
-Rancher contains a variety of tools that aren't included in Kubernetes to assist in your DevOps operations. Rancher can integrate with external services to help your clusters run more efficiently. Tools are divided into following categories:
-
-- Alerts
-- Notifiers
-- Logging
-- Monitoring
-- Istio Service Mesh
-- OPA Gatekeeper
-
-For more information, see [Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/)
-
-
-
-When your project is set up, [project members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can start managing their applications and all the components that comprise it.
-
-## Workloads
-
-Deploy applications to your cluster nodes using [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/), which are objects that contain pods that run your apps, along with metadata that set rules for the deployment's behavior. Workloads can be deployed within the scope of the entire clusters or within a namespace.
-
-When deploying a workload, you can deploy from any image. There are a variety of [workload types]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/#workload-types) to choose from which determine how your application should run.
-
-Following a workload deployment, you can continue working with it. You can:
-
-- [Upgrade]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/upgrade-workloads) the workload to a newer version of the application it's running.
-- [Roll back]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/rollback-workloads) a workload to a previous version, if an issue occurs during upgrade.
-- [Add a sidecar]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/add-a-sidecar), which is a workload that supports a primary workload.
-
-## Load Balancing and Ingress
-
-### Load Balancers
-
-After you launch an application, it's only available within the cluster. It can't be reached externally.
-
-If you want your applications to be externally accessible, you must add a load balancer to your cluster. Load balancers create a gateway for external connections to access your cluster, provided that the user knows the load balancer's IP address and the application's port number.
-
-Rancher supports two types of load balancers:
-
-- [Layer-4 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-4-load-balancer)
-- [Layer-7 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-7-load-balancer)
-
-For more information, see [load balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers).
-
-#### Ingress
-
-Load Balancers can only handle one IP address per service, which means if you run multiple services in your cluster, you must have a load balancer for each service. Running multiples load balancers can be expensive. You can get around this issue by using an ingress.
-
-Ingress is a set or rules that act as a load balancer. Ingress works in conjunction with one or more ingress controllers to dynamically route service requests. When the ingress receives a request, the ingress controller(s) in your cluster program the load balancer to direct the request to the correct service based on service subdomains or path rules that you've configured.
-
-For more information, see [Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress).
-
-When using ingresses in a project, you can program the ingress hostname to an external DNS by setting up a Global DNS entry.
-
-For more information, see [Global DNS]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
-
-## Service Discovery
-
-After you expose your cluster to external requests using a load balancer and/or ingress, it's only available by IP address. To create a resolveable hostname, you must create a service record, which is a record that maps an IP address, external hostname, DNS record alias, workload(s), or labelled pods to a specific hostname.
-
-For more information, see [Service Discovery]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/service-discovery).
-
-## Pipelines
-
-After your project has been [configured to a version control provider]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines/#version-control-providers), you can add the repositories and start configuring a pipeline for each repository.
-
-For more information, see [Pipelines]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/).
-
-## Applications
-
-Besides launching individual components of an application, you can use the Rancher catalog to start launching applications, which are Helm charts.
-
-For more information, see [Applications in a Project]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/).
-
-## Kubernetes Resources
-
-Within the context of a Rancher project or namespace, _resources_ are files and data that support operation of your pods. Within Rancher, certificates, registries, and secrets are all considered resources. However, Kubernetes classifies resources as different types of [secrets](https://kubernetes.io/docs/concepts/configuration/secret/). Therefore, within a single project or namespace, individual resources must have unique names to avoid conflicts. Although resources are primarily used to carry sensitive information, they have other uses as well.
-
-Resources include:
-
-- [Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/): Files used to encrypt/decrypt data entering or leaving the cluster.
-- [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/): Files that store general configuration information, such as a group of config files.
-- [Secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/): Files that store sensitive data like passwords, tokens, or keys.
-- [Registries]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries/): Files that carry credentials used to authenticate with private registries.
diff --git a/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
deleted file mode 100644
index 8b2d81f49e9..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/certificate-rotation/_index.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Certificate Rotation
-weight: 2
----
-
-> **Warning:** Rotating Kubernetes certificates may result in your cluster being temporarily unavailable as components are restarted. For production environments, it's recommended to perform this action during a maintenance window.
-
-By default, Kubernetes clusters require certificates and Rancher launched Kubernetes clusters automatically generate  certificates for the Kubernetes components. Rotating these certificates is important before the certificates expire as well as if a certificate is compromised. After the certificates are rotated, the Kubernetes components are automatically restarted.
-
-Certificates can be rotated for the following services:
-
-- etcd
-- kubelet
-- kube-apiserver
-- kube-proxy
-- kube-scheduler
-- kube-controller-manager
-
-
-### Certificate Rotation
-
-Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI.
-
-1. In the **Global** view, navigate to the cluster that you want to rotate certificates.
-
-2. Select the **&#8942; > Rotate Certificates**.
-
-3. Select which certificates that you want to rotate.
-
-   * Rotate all Service certificates (keep the same CA)
-   * Rotate an individual service and choose one of the services from the drop down menu
-
-4. Click **Save**.
-
-**Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate.
-
-> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/certificates/_index.md b/content/rancher/v2.5/en/cluster-explorer/certificates/_index.md
deleted file mode 100644
index 56a660ad63d..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/certificates/_index.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Encrypting HTTP Communication
-description: Learn how to add an SSL (Secure Sockets Layer) certificate or TLS (Transport Layer Security) certificate to either a project, a namespace, or both, so that you can add it to deployments
-weight: 1
----
-
-When you create an ingress within Rancher/Kubernetes, you must provide it with a secret that includes a TLS private key and certificate, which are used to encrypt and decrypt communications that come through the ingress. You can make certificates available for ingress use by navigating to its project or namespace, and then uploading the certificate. You can then add the certificate to the ingress deployment.
-
-Add SSL certificates to either projects, namespaces, or both. A project scoped certificate will be available in all its namespaces.
-
->**Prerequisites:** You must have a TLS private key and certificate available to upload.
-
-1. From the **Global** view, select the project where you want to deploy your ingress.
-
-1. From the main menu, select **Resources > Secrets > Certificates**. Click **Add Certificate**. (For Rancher prior to v2.3, click **Resources > Certificates.**)
-
-1. Enter a **Name** for the certificate.
-
-    >**Note:** Kubernetes classifies SSL certificates as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your SSL certificate must have a unique name among the other certificates, registries, and secrets within your project/workspace.
-
-1. Select the **Scope** of the certificate.
-
-    - **Available to all namespaces in this project:** The certificate is available for any deployment in any namespaces in the project.
-
-    - **Available to a single namespace:** The certificate is only available for the deployments in one [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces). If you choose this option, select a **Namespace** from the drop-down list or click **Add to a new namespace** to add the certificate to a namespace you create on the fly.
-
-1. From **Private Key**, either copy and paste your certificate's private key into the text box (include the header and footer), or click **Read from a file** to browse to the private key on your file system. If possible, we recommend using **Read from a file** to reduce likelihood of error.
-
-    Private key files end with an extension of `.key`.
-
-1. From **Certificate**, either copy and paste your certificate into the text box (include the header and footer), or click **Read from a file** to browse to the certificate on your file system. If possible, we recommend using **Read from a file** to reduce likelihood of error.
-
-    Certificate files end with an extension of `.crt`.
-
-**Result:** Your certificate is added to the project or namespace. You can now add it to deployments.
-
-- If you added an SSL certificate to the project, the certificate is available for deployments created in any project namespace.
-- If you added an SSL certificate to a namespace, the certificate is available only for deployments in that namespace.
-- Your certificate is added to the **Resources > Secrets > Certificates** view. (For Rancher prior to v2.3, it is added to **Resources > Certificates.**)
-
-## What's Next?
-
-Now you can add the certificate when launching an ingress within the current project or namespace. For more information, see [Adding Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md b/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md
deleted file mode 100644
index 4f1d2e14430..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/_index.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: Cluster Autoscaler
-weight: 1
----
-
-In this section, you'll learn how to install and use the [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
-
-The cluster autoscaler is a tool that automatically adjusts the size of the Kubernetes cluster when one of the following conditions is true:
-
-* There are pods that failed to run in the cluster due to insufficient resources.
-* There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes.
-
-To prevent your pod from being evicted, set a `priorityClassName: system-cluster-critical` property on your pod spec.
-
-Cluster Autoscaler is designed to run on Kubernetes master nodes. It can run in the `kube-system` namespace. Cluster Autoscaler doesn't scale down nodes with non-mirrored `kube-system` pods running on them.
-
-It's possible to run a customized deployment of Cluster Autoscaler on worker nodes, but extra care needs to be taken to ensure that Cluster Autoscaler remains up and running.
-
-# Cloud Providers
-
-Cluster Autoscaler provides support to distinct cloud providers. For more information, go to [cluster-autoscaler supported cloud providers.](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment)
-
-### Setting up Cluster Autoscaler on Amazon Cloud Provider
-
-For details on running the cluster autoscaler  on Amazon cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-autoscaler/amazon)
diff --git a/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md b/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md
deleted file mode 100644
index d173d444e27..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/cluster-autoscaler/amazon/_index.md
+++ /dev/null
@@ -1,580 +0,0 @@
----
-title: Cluster Autoscaler with AWS EC2 Auto Scaling Groups
-weight: 1
----
-
-This guide will show you how to install and use [Kubernetes cluster-autoscaler](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/) on Rancher custom clusters using AWS EC2 Auto Scaling Groups.
-
-We are going to install a Rancher RKE custom cluster with a fixed number of nodes with the etcd and controlplane roles, and a variable nodes with the worker role, managed by `cluster-autoscaler`. 
-
-- [Prerequisites](#prerequisites)
-- [1. Create a Custom Cluster](#1-create-a-custom-cluster)
-- [2. Configure the Cloud Provider](#2-configure-the-cloud-provider)
-- [3. Deploy Nodes](#3-deploy-nodes)
-- [4. Install cluster-autoscaler](#4-install-cluster-autoscaler)
-  - [Parameters](#parameters)
-  - [Deployment](#deployment)
-- [Testing](#testing)
-  - [Generating Load](#generating-load)
-  - [Checking Scale](#checking-scale)
-
-# Prerequisites
-
-These elements are required to follow this guide:
-
-* The Rancher server is up and running
-* You have an AWS EC2 user with proper permissions to create virtual machines, auto scaling groups, and IAM profiles and roles
-
-### 1. Create a Custom Cluster
-
-On Rancher server, we should create a custom k8s cluster v1.18.x. Be sure that cloud_provider name is set to `amazonec2`. Once cluster is created we need to get:
-
-* clusterID: `c-xxxxx` will be used on EC2 `kubernetes.io/cluster/<clusterID>` instance tag
-* clusterName: will be used on EC2 `k8s.io/cluster-autoscaler/<clusterName>` instance tag
-* nodeCommand: will be added on EC2 instance user_data to include new nodes on cluster
-
-    ```sh
-    sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CHECKSUM> <roles>
-    ```
-
-### 2. Configure the Cloud Provider
-
-On AWS EC2, we should create a few objects to configure our system. We've defined three distinct groups and IAM profiles to configure on AWS.
-
-1. Autoscaling group: Nodes that will be part of the EC2 Auto Scaling Group (ASG). The ASG will be used by `cluster-autoscaler` to scale up and down.
-  * IAM profile: Required by k8s nodes where cluster-autoscaler will be running. It is recommended for Kubernetes master nodes. This profile is called `K8sAutoscalerProfile`.
-
-      ```json
-      {
-          "Version": "2012-10-17",
-          "Statement": [
-              {
-                  "Effect": "Allow",
-                  "Action": [
-                      "autoscaling:DescribeAutoScalingGroups",
-                      "autoscaling:DescribeAutoScalingInstances",
-                      "autoscaling:DescribeLaunchConfigurations",
-                      "autoscaling:SetDesiredCapacity",
-                      "autoscaling:TerminateInstanceInAutoScalingGroup",
-                      "autoscaling:DescribeTags",
-                      "autoscaling:DescribeLaunchConfigurations",
-                      "ec2:DescribeLaunchTemplateVersions"
-                  ],
-                  "Resource": [
-                      "*"
-                  ]
-              }
-          ]
-      }
-      ```
-
-2. Master group: Nodes that will be part of the Kubernetes etcd and/or control planes. This will be out of the ASG. 
-  * IAM profile: Required by the Kubernetes cloud_provider integration. Optionally, `AWS_ACCESS_KEY` and `AWS_SECRET_KEY` can be used instead [using-aws-credentials.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md#using-aws-credentials) This profile is called `K8sMasterProfile`.
-
-      ```json
-      {
-          "Version": "2012-10-17",
-          "Statement": [
-              {
-                  "Effect": "Allow",
-                  "Action": [
-                      "autoscaling:DescribeAutoScalingGroups",
-                      "autoscaling:DescribeLaunchConfigurations",
-                      "autoscaling:DescribeTags",
-                      "ec2:DescribeInstances",
-                      "ec2:DescribeRegions",
-                      "ec2:DescribeRouteTables",
-                      "ec2:DescribeSecurityGroups",
-                      "ec2:DescribeSubnets",
-                      "ec2:DescribeVolumes",
-                      "ec2:CreateSecurityGroup",
-                      "ec2:CreateTags",
-                      "ec2:CreateVolume",
-                      "ec2:ModifyInstanceAttribute",
-                      "ec2:ModifyVolume",
-                      "ec2:AttachVolume",
-                      "ec2:AuthorizeSecurityGroupIngress",
-                      "ec2:CreateRoute",
-                      "ec2:DeleteRoute",
-                      "ec2:DeleteSecurityGroup",
-                      "ec2:DeleteVolume",
-                      "ec2:DetachVolume",
-                      "ec2:RevokeSecurityGroupIngress",
-                      "ec2:DescribeVpcs",
-                      "elasticloadbalancing:AddTags",
-                      "elasticloadbalancing:AttachLoadBalancerToSubnets",
-                      "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
-                      "elasticloadbalancing:CreateLoadBalancer",
-                      "elasticloadbalancing:CreateLoadBalancerPolicy",
-                      "elasticloadbalancing:CreateLoadBalancerListeners",
-                      "elasticloadbalancing:ConfigureHealthCheck",
-                      "elasticloadbalancing:DeleteLoadBalancer",
-                      "elasticloadbalancing:DeleteLoadBalancerListeners",
-                      "elasticloadbalancing:DescribeLoadBalancers",
-                      "elasticloadbalancing:DescribeLoadBalancerAttributes",
-                      "elasticloadbalancing:DetachLoadBalancerFromSubnets",
-                      "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
-                      "elasticloadbalancing:ModifyLoadBalancerAttributes",
-                      "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
-                      "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
-                      "elasticloadbalancing:AddTags",
-                      "elasticloadbalancing:CreateListener",
-                      "elasticloadbalancing:CreateTargetGroup",
-                      "elasticloadbalancing:DeleteListener",
-                      "elasticloadbalancing:DeleteTargetGroup",
-                      "elasticloadbalancing:DescribeListeners",
-                      "elasticloadbalancing:DescribeLoadBalancerPolicies",
-                      "elasticloadbalancing:DescribeTargetGroups",
-                      "elasticloadbalancing:DescribeTargetHealth",
-                      "elasticloadbalancing:ModifyListener",
-                      "elasticloadbalancing:ModifyTargetGroup",
-                      "elasticloadbalancing:RegisterTargets",
-                      "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
-                      "iam:CreateServiceLinkedRole",
-                      "ecr:GetAuthorizationToken",
-                      "ecr:BatchCheckLayerAvailability",
-                      "ecr:GetDownloadUrlForLayer",
-                      "ecr:GetRepositoryPolicy",
-                      "ecr:DescribeRepositories",
-                      "ecr:ListImages",
-                      "ecr:BatchGetImage",
-                      "kms:DescribeKey"
-                  ],
-                  "Resource": [
-                      "*"
-                  ]
-              }
-          ]
-      }
-      ```
-
-    * IAM role: `K8sMasterRole: [K8sMasterProfile,K8sAutoscalerProfile]`
-    * Security group: `K8sMasterSg` More info at[RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
-    * Tags:
-      `kubernetes.io/cluster/<clusterID>: owned`
-    * User data: `K8sMasterUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add etcd+controlplane node to the k8s cluster
-
-      ```sh
-      #!/bin/bash -x
-
-      cat <<EOF > /etc/sysctl.d/90-kubelet.conf
-      vm.overcommit_memory = 1
-      vm.panic_on_oom = 0
-      kernel.panic = 10
-      kernel.panic_on_oops = 1
-      kernel.keys.root_maxkeys = 1000000
-      kernel.keys.root_maxbytes = 25000000
-      EOF
-      sysctl -p /etc/sysctl.d/90-kubelet.conf
-
-      curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
-      sudo usermod -aG docker ubuntu
-
-      TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
-      PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
-      PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
-      K8S_ROLES="--etcd --controlplane"
-
-      sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
-      ```
-
-3. Worker group: Nodes that will be part of the k8s worker plane. Worker nodes will be scaled by cluster-autoscaler using the ASG.
-  * IAM profile: Provides cloud_provider worker integration.
-  This profile is called `K8sWorkerProfile`.
-
-      ```json
-      {
-          "Version": "2012-10-17",
-          "Statement": [
-              {
-                  "Effect": "Allow",
-                  "Action": [
-                      "ec2:DescribeInstances",
-                      "ec2:DescribeRegions",
-                      "ecr:GetAuthorizationToken",
-                      "ecr:BatchCheckLayerAvailability",
-                      "ecr:GetDownloadUrlForLayer",
-                      "ecr:GetRepositoryPolicy",
-                      "ecr:DescribeRepositories",
-                      "ecr:ListImages",
-                      "ecr:BatchGetImage"
-                  ],
-                  "Resource": "*"
-              }
-          ]
-      }
-      ```
-
-  * IAM role: `K8sWorkerRole: [K8sWorkerProfile]`
-  * Security group: `K8sWorkerSg` More info at [RKE ports (custom nodes tab)]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/ports/#downstream-kubernetes-cluster-nodes)
-  * Tags:
-    * `kubernetes.io/cluster/<clusterID>: owned`
-    * `k8s.io/cluster-autoscaler/<clusterName>: true`
-    * `k8s.io/cluster-autoscaler/enabled: true`
-  * User data: `K8sWorkerUserData` Ubuntu 18.04(ami-0e11cbb34015ff725), installs docker and add worker node to the k8s cluster 
-
-      ```sh
-      #!/bin/bash -x
-
-      cat <<EOF > /etc/sysctl.d/90-kubelet.conf
-      vm.overcommit_memory = 1
-      vm.panic_on_oom = 0
-      kernel.panic = 10
-      kernel.panic_on_oops = 1
-      kernel.keys.root_maxkeys = 1000000
-      kernel.keys.root_maxbytes = 25000000
-      EOF
-      sysctl -p /etc/sysctl.d/90-kubelet.conf
-
-      curl -sL https://releases.rancher.com/install-docker/19.03.sh | sh
-      sudo usermod -aG docker ubuntu
-
-      TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
-      PRIVATE_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/local-ipv4)
-      PUBLIC_IP=$(curl -H "X-aws-ec2-metadata-token: ${TOKEN}" -s http://169.254.169.254/latest/meta-data/public-ipv4)
-      K8S_ROLES="--worker"
-
-      sudo docker run -d --privileged --restart=unless-stopped --net=host -v /etc/kubernetes:/etc/kubernetes -v /var/run:/var/run rancher/rancher-agent:<RANCHER_VERSION> --server https://<RANCHER_URL> --token <RANCHER_TOKEN> --ca-checksum <RANCHER_CA_CHECKCSUM> --address ${PUBLIC_IP} --internal-address ${PRIVATE_IP} ${K8S_ROLES}
-      ```
-
-More info is at [RKE clusters on AWS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon/) and [Cluster Autoscaler on AWS.](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/README.md)
-
-### 3. Deploy Nodes
-
-Once we've configured AWS, let's create VMs to bootstrap our cluster:
-
-* master (etcd+controlplane): Depending your needs, deploy three master instances with proper size. More info is at [the recommendations for production-ready clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/)
-  * IAM role: `K8sMasterRole`
-  * Security group: `K8sMasterSg`
-  * Tags: 
-    * `kubernetes.io/cluster/<clusterID>: owned`
-  * User data: `K8sMasterUserData`
-
-* worker: Define an ASG on EC2 with the following settings:
-  * Name: `K8sWorkerAsg`
-  * IAM role: `K8sWorkerRole`
-  * Security group: `K8sWorkerSg`
-  * Tags: 
-    * `kubernetes.io/cluster/<clusterID>: owned`
-    * `k8s.io/cluster-autoscaler/<clusterName>: true`
-    * `k8s.io/cluster-autoscaler/enabled: true`
-  * User data: `K8sWorkerUserData`
-  * Instances:
-    * minimum: 2
-    * desired: 2
-    * maximum: 10
-
-Once the VMs are deployed, you should have a Rancher custom cluster up and running with three master and two worker nodes.
-
-### 4. Install Cluster-autoscaler
-
-At this point, we should have rancher cluster up and running. We are going to install cluster-autoscaler on master nodes and `kube-system` namespace, following cluster-autoscaler recommendation. 
-
-#### Parameters
-
-This table shows cluster-autoscaler parameters for fine tuning:
-
-| Parameter | Default | Description |
-|---|---|---|
-|cluster-name|-|Autoscaled cluster name, if available|
-|address|:8085|The address to expose Prometheus metrics|
-|kubernetes|-|Kubernetes master location. Leave blank for default|
-|kubeconfig|-|Path to kubeconfig file with authorization and master location information|
-|cloud-config|-|The path to the cloud provider configuration file.  Empty string for no configuration file|
-|namespace|"kube-system"|Namespace in which cluster-autoscaler run|
-|scale-down-enabled|true|Should CA scale down the cluster|
-|scale-down-delay-after-add|"10m"|How long after scale up that scale down evaluation resumes|
-|scale-down-delay-after-delete|0|How long after node deletion that scale down evaluation resumes, defaults to scanInterval|
-|scale-down-delay-after-failure|"3m"|How long after scale down failure that scale down evaluation resumes|
-|scale-down-unneeded-time|"10m"|How long a node should be unneeded before it is eligible for scale down|
-|scale-down-unready-time|"20m"|How long an unready node should be unneeded before it is eligible for scale down|
-|scale-down-utilization-threshold|0.5|Sum of cpu or memory of all pods running on the node divided by node's corresponding allocatable resource, below which a node can be considered for scale down|
-|scale-down-gpu-utilization-threshold|0.5|Sum of gpu requests of all pods running on the node divided by node's allocatable resource, below which a node can be considered for scale down|
-|scale-down-non-empty-candidates-count|30|Maximum number of non empty nodes considered in one iteration as candidates for scale down with drain|
-|scale-down-candidates-pool-ratio|0.1|A ratio of nodes that are considered as additional non empty candidates for scale down when some candidates from previous iteration are no longer valid|
-|scale-down-candidates-pool-min-count|50|Minimum number of nodes that are considered as additional non empty candidates for scale down when some candidates from previous iteration are no longer valid|
-|node-deletion-delay-timeout|"2m"|Maximum time CA waits for removing delay-deletion.cluster-autoscaler.kubernetes.io/ annotations before deleting the node|
-|scan-interval|"10s"|How often cluster is reevaluated for scale up or down|
-|max-nodes-total|0|Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number|
-|cores-total|"0:320000"|Minimum and maximum number of cores in cluster, in the format <min>:<max>. Cluster autoscaler will not scale the cluster beyond these numbers|
-|memory-total|"0:6400000"|Minimum and maximum number of gigabytes of memory in cluster, in the format <min>:<max>. Cluster autoscaler will not scale the cluster beyond these numbers|
-cloud-provider|-|Cloud provider type| 
-|max-bulk-soft-taint-count|10|Maximum number of nodes that can be tainted/untainted PreferNoSchedule at the same time. Set to 0 to turn off such tainting|
-|max-bulk-soft-taint-time|"3s"|Maximum duration of tainting/untainting nodes as PreferNoSchedule at the same time|
-|max-empty-bulk-delete|10|Maximum number of empty nodes that can be deleted at the same time|
-|max-graceful-termination-sec|600|Maximum number of seconds CA waits for pod termination when trying to scale down a node|
-|max-total-unready-percentage|45|Maximum percentage of unready nodes in the cluster.  After this is exceeded, CA halts operations|
-|ok-total-unready-count|3|Number of allowed unready nodes, irrespective of max-total-unready-percentage|
-|scale-up-from-zero|true|Should CA scale up when there 0 ready nodes|
-|max-node-provision-time|"15m"|Maximum time CA waits for node to be provisioned|
-|nodes|-|sets min,max size and other configuration data for a node group in a format accepted by cloud provider. Can be used multiple times. Format: <min>:<max>:<other...>|
-|node-group-auto-discovery|-|One or more definition(s) of node group auto-discovery. A definition is expressed `<name of discoverer>:[<key>[=<value>]]`|
-|estimator|-|"binpacking"|Type of resource estimator to be used in scale up. Available values: ["binpacking"]|
-|expander|"random"|Type of node group expander to be used in scale up. Available values: `["random","most-pods","least-waste","price","priority"]`|
-|ignore-daemonsets-utilization|false|Should CA ignore DaemonSet pods when calculating resource utilization for scaling down|
-|ignore-mirror-pods-utilization|false|Should CA ignore Mirror pods when calculating resource utilization for scaling down|
-|write-status-configmap|true|Should CA write status information to a configmap|
-|max-inactivity|"10m"|Maximum time from last recorded autoscaler activity before automatic restart|
-|max-failing-time|"15m"|Maximum time from last recorded successful autoscaler run before automatic restart|
-|balance-similar-node-groups|false|Detect similar node groups and balance the number of nodes between them|
-|node-autoprovisioning-enabled|false|Should CA autoprovision node groups when needed|
-|max-autoprovisioned-node-group-count|15|The maximum number of autoprovisioned groups in the cluster|
-|unremovable-node-recheck-timeout|"5m"|The timeout before we check again a node that couldn't be removed before|
-|expendable-pods-priority-cutoff|-10|Pods with priority below cutoff will be expendable. They can be killed without any consideration during scale down and they don't cause scale up. Pods with null priority (PodPriority disabled) are non expendable|
-|regional|false|Cluster is regional|
-|new-pod-scale-up-delay|"0s"|Pods less than this old will not be considered for scale-up|
-|ignore-taint|-|Specifies a taint to ignore in node templates when considering to scale a node group|
-|balancing-ignore-label|-|Specifies a label to ignore in addition to the basic and cloud-provider set of labels when comparing if two node groups are similar|
-|aws-use-static-instance-list|false|Should CA fetch instance types in runtime or use a static list. AWS only|
-|profiling|false|Is debug/pprof endpoint enabled|
-
-#### Deployment
-
-Based on [cluster-autoscaler-run-on-master.yaml](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/cloudprovider/aws/examples/cluster-autoscaler-run-on-master.yaml) example, we've created our own `cluster-autoscaler-deployment.yaml` to use preferred [auto-discovery setup](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#auto-discovery-setup), updating tolerations, nodeSelector, image version and command config:
-
-
-```yml
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    k8s-addon: cluster-autoscaler.addons.k8s.io
-    k8s-app: cluster-autoscaler
-  name: cluster-autoscaler
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: cluster-autoscaler
-  labels:
-    k8s-addon: cluster-autoscaler.addons.k8s.io
-    k8s-app: cluster-autoscaler
-rules:
-  - apiGroups: [""]
-    resources: ["events", "endpoints"]
-    verbs: ["create", "patch"]
-  - apiGroups: [""]
-    resources: ["pods/eviction"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["pods/status"]
-    verbs: ["update"]
-  - apiGroups: [""]
-    resources: ["endpoints"]
-    resourceNames: ["cluster-autoscaler"]
-    verbs: ["get", "update"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["watch", "list", "get", "update"]
-  - apiGroups: [""]
-    resources:
-      - "pods"
-      - "services"
-      - "replicationcontrollers"
-      - "persistentvolumeclaims"
-      - "persistentvolumes"
-    verbs: ["watch", "list", "get"]
-  - apiGroups: ["extensions"]
-    resources: ["replicasets", "daemonsets"]
-    verbs: ["watch", "list", "get"]
-  - apiGroups: ["policy"]
-    resources: ["poddisruptionbudgets"]
-    verbs: ["watch", "list"]
-  - apiGroups: ["apps"]
-    resources: ["statefulsets", "replicasets", "daemonsets"]
-    verbs: ["watch", "list", "get"]
-  - apiGroups: ["storage.k8s.io"]
-    resources: ["storageclasses", "csinodes"]
-    verbs: ["watch", "list", "get"]
-  - apiGroups: ["batch", "extensions"]
-    resources: ["jobs"]
-    verbs: ["get", "list", "watch", "patch"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["create"]
-  - apiGroups: ["coordination.k8s.io"]
-    resourceNames: ["cluster-autoscaler"]
-    resources: ["leases"]
-    verbs: ["get", "update"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: cluster-autoscaler
-  namespace: kube-system
-  labels:
-    k8s-addon: cluster-autoscaler.addons.k8s.io
-    k8s-app: cluster-autoscaler
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create","list","watch"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["cluster-autoscaler-status", "cluster-autoscaler-priority-expander"]
-    verbs: ["delete", "get", "update", "watch"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cluster-autoscaler
-  labels:
-    k8s-addon: cluster-autoscaler.addons.k8s.io
-    k8s-app: cluster-autoscaler
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-autoscaler
-subjects:
-  - kind: ServiceAccount
-    name: cluster-autoscaler
-    namespace: kube-system
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: cluster-autoscaler
-  namespace: kube-system
-  labels:
-    k8s-addon: cluster-autoscaler.addons.k8s.io
-    k8s-app: cluster-autoscaler
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: cluster-autoscaler
-subjects:
-  - kind: ServiceAccount
-    name: cluster-autoscaler
-    namespace: kube-system
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cluster-autoscaler
-  namespace: kube-system
-  labels:
-    app: cluster-autoscaler
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: cluster-autoscaler
-  template:
-    metadata:
-      labels:
-        app: cluster-autoscaler
-      annotations:
-        prometheus.io/scrape: 'true'
-        prometheus.io/port: '8085'
-    spec:
-      serviceAccountName: cluster-autoscaler
-      tolerations:
-        - effect: NoSchedule
-          operator: "Equal"
-          value: "true"
-          key: node-role.kubernetes.io/controlplane
-      nodeSelector:
-        node-role.kubernetes.io/controlplane: "true"
-      containers:
-        - image: eu.gcr.io/k8s-artifacts-prod/autoscaling/cluster-autoscaler:v1.18.1
-          name: cluster-autoscaler
-          resources:
-            limits:
-              cpu: 100m
-              memory: 300Mi
-            requests:
-              cpu: 100m
-              memory: 300Mi
-          command:
-            - ./cluster-autoscaler
-            - --v=4
-            - --stderrthreshold=info
-            - --cloud-provider=aws
-            - --skip-nodes-with-local-storage=false
-            - --expander=least-waste
-            - --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/<clusterName>
-          volumeMounts:
-            - name: ssl-certs
-              mountPath: /etc/ssl/certs/ca-certificates.crt
-              readOnly: true
-          imagePullPolicy: "Always"
-      volumes:
-        - name: ssl-certs
-          hostPath:
-            path: "/etc/ssl/certs/ca-certificates.crt"
-
-```
-
-Once the manifest file is prepared, deploy it in the Kubernetes cluster (Rancher UI can be used instead):
-
-```sh
-kubectl -n kube-system apply -f cluster-autoscaler-deployment.yaml
-```
-
-**Note:** Cluster-autoscaler deployment can also be set up using [manual configuration](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider/aws#manual-configuration)
-
-# Testing
-
-At this point, we should have a cluster-scaler up and running in our Rancher custom cluster. Cluster-scale should manage `K8sWorkerAsg` ASG to scale up and down between 2 and 10 nodes, when one of the following conditions is true: 
-
-* There are pods that failed to run in the cluster due to insufficient resources. In this case, the cluster is scaled up.
-* There are nodes in the cluster that have been underutilized for an extended period of time and their pods can be placed on other existing nodes. In this case, the cluster is scaled down.
-
-### Generating Load
-
-We've prepared a `test-deployment.yaml` just to generate load on the Kubernetes cluster and see if cluster-autoscaler is working properly. The test deployment is requesting 1000m CPU and 1024Mi memory by three replicas. Adjust the requested resources and/or replica to be sure you exhaust the Kubernetes cluster resources:
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: hello-world
-  name: hello-world
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: hello-world
-  strategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: hello-world
-    spec:
-      containers:
-      - image: rancher/hello-world
-        imagePullPolicy: Always
-        name: hello-world
-        ports:
-        - containerPort: 80
-          protocol: TCP
-        resources:
-          limits:
-            cpu: 1000m
-            memory: 1024Mi
-          requests:
-            cpu: 1000m
-            memory: 1024Mi
-```
-
-Once the test deployment is prepared, deploy it in the Kubernetes cluster default namespace (Rancher UI can be used instead):
-
-```
-kubectl -n default apply -f test-deployment.yaml
-```
-
-### Checking Scale
-
-Once the Kubernetes resources got exhausted, cluster-autoscaler should scale up worker nodes where pods failed to be scheduled. It should scale up until up until all pods became scheduled. You should see the new nodes on the ASG and on the Kubernetes cluster. Check the logs on the `kube-system` cluster-autoscaler pod.
-
-Once scale up is checked, let check for scale down. To do it, reduce the replica number on the test deployment until you release enough Kubernetes cluster resources to scale down. You should see nodes disappear on the ASG and on the Kubernetes cluster. Check the logs on the `kube-system` cluster-autoscaler pod.
diff --git a/content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md b/content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md
deleted file mode 100644
index f84deb4cceb..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/configmaps/_index.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: ConfigMaps
-weight: 3
----
-
-
-While most types of Kubernetes secrets store sensitive information, [ConfigMaps](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) store general configuration information, such as a group of config files. Because ConfigMaps don't store sensitive information, they can be updated automatically, and therefore don't require their containers to be restarted following update (unlike most secret types, which require manual updates and a container restart to take effect).
-
-ConfigMaps accept key value pairs in common string formats, like config files or JSON blobs. After you upload a config map, any workload can reference it as either an environment variable or a volume mount.
-
->**Note:** ConfigMaps can only be applied to namespaces and not projects.
-
-1. From the **Global** view, select the project containing the namespace that you want to add a ConfigMap to.
-
-1. From the main menu, select **Resources > Config Maps**. Click **Add Config Map**.
-
-1. Enter a **Name** for the Config Map.
-
-    >**Note:** Kubernetes classifies ConfigMaps as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your ConfigMaps must have a unique name among the other certificates, registries, and secrets within your workspace.
-
-1. Select the **Namespace** you want to add Config Map to. You can also add a new namespace on the fly by clicking **Add to a new namespace**.
-
-1. From **Config Map Values**, click **Add Config Map Value** to add a key value pair to your ConfigMap. Add as many values as you need.
-
-1. Click **Save**.
-
-	>**Note:** Don't use ConfigMaps to store sensitive data [use a secret]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/).
-	>
-	>**Tip:** You can add multiple key value pairs to the ConfigMap by copying and pasting.
-	>
-    > {{< img "/img/rancher/bulk-key-values.gif" "Bulk Key Value Pair Copy/Paste">}}
-
-**Result:** Your ConfigMap is added to the namespace. You can view it in the Rancher UI from the **Resources > Config Maps** view.
-
-## What's Next?
-
-Now that you have a ConfigMap added to a namespace, you can add it to a workload that you deploy from the namespace of origin. You can use the ConfigMap to specify information for you application to consume, such as:
-
-- Application environment variables.
-- Specifying parameters for a Volume mounted to the workload.
-
-For more information on adding ConfigMaps to a workload, see [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md
deleted file mode 100644
index 85fece31e33..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/_index.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-title: Set Up Load Balancer and Ingress Controller within Rancher
-description: Learn how you can set up load balancers and ingress controllers to redirect service requests within Rancher, and learn about the limitations of load balancers
-weight: 1
----
-
-Within Rancher, you can set up load balancers and ingress controllers to redirect service requests.
-
-## Load Balancers
-
-After you launch an application, the app is only available within the cluster. It can't be reached from outside the cluster.
-
-If you want your applications to be externally accessible, you must add a load balancer or ingress to your cluster. Load balancers create a gateway for external connections to access your cluster, provided that the user knows the load balancer's IP address and the application's port number.
-
-Rancher supports two types of load balancers:
-
-- [Layer-4 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-4-load-balancer)
-- [Layer-7 Load Balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#layer-7-load-balancer)
-
-For more information, see [load balancers]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers).
-
-### Load Balancer Limitations
-
-Load Balancers have a couple of limitations you should be aware of:
-
-- Load Balancers can only handle one IP address per service, which means if you run multiple services in your cluster, you must have a load balancer for each service. Running multiples load balancers can be expensive.
-
-- If you want to use a load balancer with a Hosted Kubernetes cluster (i.e., clusters hosted in GKE, EKS, or AKS), the load balancer must be running within that cloud provider's infrastructure. Please review the compatibility tables regarding support for load balancers based on how you've provisioned your clusters:
-
-
-    - [Support for Layer-4 Load Balancing]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#support-for-layer-4-load-balancing)
-
-    - [Support for Layer-7 Load Balancing]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/#support-for-layer-7-load-balancing)
-
-## Ingress
-
-As mentioned in the limitations above, the disadvantages of using a load balancer are:
-
-- Load Balancers can only handle one IP address per service.
-- If you run multiple services in your cluster, you must have a load balancer for each service.
-- It can be expensive to have a load balancer for every service.
-
-In contrast, when an ingress is used as the entrypoint into a cluster, the ingress can route traffic to multiple services with greater flexibility. It can map multiple HTTP requests to services without individual IP addresses for each service. 
-
-Therefore, it is useful to have an ingress if you want multiple services to be exposed with the same IP address, the same Layer 7 protocol, or the same privileged node-ports: 80 and 443.
-
-Ingress works in conjunction with one or more ingress controllers to dynamically route service requests. When the ingress receives a request, the ingress controller(s) in your cluster direct the request to the correct service based on service subdomains or path rules that you've configured.
-
-Each Kubernetes Ingress resource corresponds roughly to a file in `/etc/nginx/sites-available/` containing a `server{}` configuration block, where requests for specific files and folders are configured.
-
-Your ingress, which creates a port of entry to your cluster similar to a load balancer, can reside within your cluster or externally. Ingress and ingress controllers residing in RKE-launched clusters are powered by [Nginx](https://www.nginx.com/).
-
-Ingress can provide other functionality as well, such as SSL termination, name-based virtual hosting, and more.
-
->**Using Rancher in a High Availability Configuration?**
->
->Refrain from adding an Ingress to the `local` cluster. The Nginx Ingress Controller that Rancher uses acts as a global entry point for _all_ clusters managed by Rancher, including the `local` cluster.  Therefore, when users try to access an application, your Rancher connection may drop due to the Nginx configuration being reloaded. We recommend working around this issue by deploying applications only in clusters that you launch using Rancher.
-
-- For more information on how to set up ingress in Rancher, see [Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress).
-- For complete information about ingress and ingress controllers, see the [Kubernetes Ingress Documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/)
-- When using ingresses in a project, you can program the ingress hostname to an external DNS by setting up a Global DNS entry, see [Global DNS]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md
deleted file mode 100644
index f10a8928d22..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/ingress/_index.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: Adding Ingresses to Your Project
-description: Ingresses can be added for workloads to provide load balancing, SSL termination and host/path-based routing. Learn how to add Rancher ingress to your project
-weight: 3042
----
-
-Ingress can be added for workloads to provide load balancing, SSL termination and host/path based routing. When using ingresses in a project, you can program the ingress hostname to an external DNS by setting up a [Global DNS entry]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
-
-1. From the **Global** view, open the project that you want to add ingress to.
-
-1. Click **Resources** in the main navigation bar. Click the **Load Balancing** tab. (In versions prior to v2.3.0, just click the **Load Balancing** tab.) Then click **Add Ingress**.
-
-1. Enter a **Name** for the ingress.
-
-1. Select an existing **Namespace** from the drop-down list. Alternatively, you can create a new [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) on the fly by clicking **Add to a new namespace**.
-
-1. Create ingress forwarding **Rules**.
-
-    - **Automatically generate a xip.io hostname**
-
-        If you choose this option, ingress routes requests to hostname to a DNS name that's automatically generated. Rancher uses [xip.io](http://xip.io/) to automatically generates the DNS name. This option is best used for testing, _not_ production environments.
-
-        >**Note:** To use this option, you must be able to resolve to `xip.io` addresses.
-
-        1. Add a **Target Backend**. By default, a workload is added to the ingress, but you can add more targets by clicking either **Service** or **Workload**.
-
-        1. **Optional:** If you want specify a workload or service when a request is sent to a particular hostname path, add a **Path** for the target. For example, if you want requests for `www.mysite.com/contact-us` to be sent to a different service than `www.mysite.com`, enter `/contact-us` in the **Path** field.
-
-            Typically, the first rule that you create does not include a path.
-
-        1. Select a workload or service from the **Target** drop-down list for each target you've added.
-
-        1. Enter the **Port** number that each target operates on.
-
-    - **Specify a hostname to use**
-
-        If you use this option, ingress routes requests for a hostname to the service or workload that you specify.
-
-        1. Enter the hostname that your ingress will handle request forwarding for. For example, `www.mysite.com`.
-
-        1. Add a **Target Backend**. By default, a workload is added to the ingress, but you can add more targets by clicking either **Service** or **Workload**.
-
-        1. **Optional:** If you want specify a workload or service when a request is sent to a particular hostname path, add a **Path** for the target. For example, if you want requests for `www.mysite.com/contact-us` to be sent to a different service than `www.mysite.com`, enter `/contact-us` in the **Path** field.
-
-            Typically, the first rule that you create does not include a path.
-
-        1. Select a workload or service from the **Target** drop-down list for each target you've added.
-
-        1. Enter the **Port** number that each target operates on.
-
-
-    - **Use as the default backend**
-
-        Use this option to set an ingress rule for handling requests that don't match any other ingress rules. For example, use this option to route requests that can't be found to a `404` page.
-
-        >**Note:** If you deployed Rancher using RKE, a default backend for 404s and 202s is already configured.
-
-        1. Add a **Target Backend**. Click either **Service** or **Workload** to add the target.
-
-        1. Select a service or workload from the **Target** drop-down list.
-
-1. **Optional:** click **Add Rule** to create additional ingress rules. For example, after you create ingress rules to direct requests for your hostname, you'll likely want to create a default backend to handle 404s.
-
-1. If any of your ingress rules handle requests for encrypted ports, add a certificate to encrypt/decrypt communications.
-
-    >**Note:** You must have an SSL certificate that the ingress can use to encrypt/decrypt communications. For more information see [Adding SSL Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/).
-
-    1. Click **Add Certificate**.
-
-    1. Select a **Certificate** from the drop-down list.
-
-    1. Enter the **Host** using encrypted communication.
-
-    1. To add additional hosts that use the certificate, click **Add Hosts**.
-
-1. **Optional:** Add [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) and/or [Annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to provide metadata for your ingress.
-
-    For a list of annotations available for use, see the [Nginx Ingress Controller Documentation](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/).
-
-**Result:** Your ingress is added to the project. The ingress begins enforcing your ingress rules.
diff --git a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md b/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
deleted file mode 100644
index 1c634dc2342..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/load-balancers-and-ingress/load-balancers/_index.md
+++ /dev/null
@@ -1,72 +0,0 @@
----
-title: "Layer 4 and Layer 7 Load Balancing"
-description: "Kubernetes supports load balancing in two ways: Layer-4 Load Balancing and Layer-7 Load Balancing. Learn about the support for each way in different deployments"
-weight: 3041
----
-Kubernetes supports load balancing in two ways: Layer-4 Load Balancing and Layer-7 Load Balancing.
-
-## Layer-4 Load Balancer
-
-Layer-4 load balancer (or the external load balancer) forwards traffic to Nodeports. Layer-4 load balancer allows you to forward both HTTP and TCP traffic.
-
-Often, the Layer-4 load balancer is supported by the underlying cloud provider, so when you deploy RKE clusters on bare-metal servers and vSphere clusters, Layer-4 load balancer is not supported. However, a single [globally managed config-map](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/) can be used to expose services on NGINX or third-party ingress.
-
-> **Note:** It is possible to deploy a cluster with a non-cloud load balancer, such as [MetalLB.](https://metallb.universe.tf/) However, that use case is more advanced than the Layer-4 load balancer supported by a cloud provider, and it is not configurable in Rancher or RKE.
-
-### Support for Layer-4 Load Balancing
-
-Support for layer-4 load balancer varies based on the underlying cloud provider.
-
-Cluster Deployment                            | Layer-4 Load Balancer Support
-----------------------------------------------|--------------------------------
-Amazon EKS                | Supported by AWS cloud provider
-Google GKE                   | Supported by GCE cloud provider
-Azure AKS                       | Supported by Azure cloud provider
-RKE on EC2                 | Supported by AWS cloud provider
-RKE on DigitalOcean         | Limited NGINX or third-party Ingress*
-RKE on vSphere           | Limited NGINX or third party-Ingress*
-RKE on Custom Hosts<br/>(e.g. bare-metal servers) | Limited NGINX or third-party Ingress*
-Third-party MetalLB | Limited NGINX or third-party Ingress*
-
-\* Services can be exposed through a single [globally managed config-map.](https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/)
-
-## Layer-7 Load Balancer
-
-Layer-7 load balancer (or the ingress controller) supports host and path-based load balancing and SSL termination. Layer-7 load balancer only forwards HTTP and HTTPS traffic and therefore they listen on ports 80 and 443 only. Cloud providers such as Amazon and Google support layer-7 load balancer. In addition, RKE clusters deploys the Nginx Ingress Controller.
-
-### Support for Layer-7 Load Balancing
-
-Support for layer-7 load balancer varies based on the underlying cloud provider.
-
-Cluster Deployment                            | Layer-7 Load Balancer Support
-----------------------------------------------|--------------------------------
-Amazon EKS                                    | Supported by AWS cloud provider
-Google GKE                                    | Supported by GKE cloud provider
-Azure AKS                                     | Not Supported
-RKE on EC2                                    | Nginx Ingress Controller
-RKE on DigitalOcean                           | Nginx Ingress Controller
-RKE on vSphere                                | Nginx Ingress Controller
-RKE on Custom Hosts<br/>(e.g. bare-metal servers) | Nginx Ingress Controller
-
-### Host Names in Layer-7 Load Balancer
-
-Some cloud-managed layer-7 load balancers (such as the ALB ingress controller on AWS) expose DNS addresses for ingress rules. You need to map (via CNAME) your domain name to the DNS address generated by the layer-7 load balancer.
-
-Other layer-7 load balancers, such as the Google Load Balancer or Nginx Ingress Controller, directly expose one or more IP addresses. Google Load Balancer provides a single routable IP address. Nginx Ingress Controller exposes the external IP of all nodes that run the Nginx Ingress Controller. You can do either of the following:
-
-1.	Configure your own DNS to map (via A records) your domain name to the IP addresses exposes by the Layer-7 load balancer.
-2.	Ask Rancher to generate an xip.io host name for your ingress rule. Rancher will take one of your exposed IPs, say a.b.c.d, and generate a host name <ingressname>.<namespace>.a.b.c.d.xip.io.
-
-The benefit of using xip.io is that you obtain a working entrypoint URL immediately after you create the ingress rule. Setting up your own domain name, on the other hand, requires you to configure DNS servers and wait for DNS to propagate.
-
-## Related Links
-
-- [Create an External Load Balancer](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/)
-
-#### Tutorials
-
-- [Kubernetes installation with External Load Balancer (HTTPS/Layer 7)]({{<baseurl>}}/rancher/v2.x/en/installation/ha-server-install-external-lb)
-- [Kubernetes installation with External Load Balancer (TCP/Layer 4)]({{<baseurl>}}/rancher/v2.x/en/installation/ha-server-install)
-- [Docker Installation with External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/single-node-install-external-lb)
-
-
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
deleted file mode 100644
index 3d80f3c57ca..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/_index.md
+++ /dev/null
@@ -1,268 +0,0 @@
----
-title: Pipelines
-weight: 3047
----
-
-Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users.
-
-Setting up a pipeline can help developers deliver new software as quickly and efficiently as possible. Using Rancher, you can integrate with a GitHub repository to setup a continuous integration (CI) pipeline.
-
-After configuring Rancher and GitHub, you can deploy containers running Jenkins to automate a pipeline execution:
-
-- Build your application from code to image.
-- Validate your builds.
-- Deploy your build images to your cluster.
-- Run unit tests.  
-- Run regression tests.
-
->**Notes:**
->
->- Pipelines improved in Rancher v2.1. Therefore, if you configured pipelines while using v2.0.x, you'll have to reconfigure them after upgrading to v2.1.
->- Still using v2.0.x? See the pipeline documentation for [previous versions]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/docs-for-v2.0.x).
->- Rancher's pipeline provides a simple CI/CD experience, but it does not offer the full power and flexibility of and is not a replacement of enterprise-grade Jenkins or other CI tools your team uses.
-
-This section covers the following topics:
-
-- [Concepts](#concepts)
-- [How Pipelines Work](#how-pipelines-work)
-- [Roles-based Access Control for Pipelines](#roles-based-access-control-for-pipelines)
-- [Setting up Pipelines](#setting-up-pipelines)
-  - [Configure version control providers](#1-configure-version-control-providers)
-  - [Configure repositories](#2-configure-repositories)
-  - [Configure the pipeline](#3-configure-the-pipeline)
-- [Pipeline Configuration Reference](#pipeline-configuration-reference)
-- [Running your Pipelines](#running-your-pipelines)
-- [Triggering a Pipeline](#triggering-a-pipeline)
-  - [Modifying the Event Triggers for the Repository](#modifying-the-event-triggers-for-the-repository)
-
-# Concepts
-
-For an explanation of concepts and terminology used in this section, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/concepts)
-
-# How Pipelines Work
-
-After enabling the ability to use pipelines in a project, you can configure multiple pipelines in each project. Each pipeline is unique and can be configured independently.
-
-A pipeline is configured off of a group of files that are checked into source code repositories. Users can configure their pipelines either through the Rancher UI or by adding a `.rancher-pipeline.yml` into the repository.
-
-Before pipelines can be configured, you will need to configure authentication to your version control provider, e.g. GitHub, GitLab, Bitbucket. If you haven't configured a version control provider, you can always use [Rancher's example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/) to view some common pipeline deployments.
-
-When you configure a pipeline in one of your projects, a namespace specifically for the pipeline is automatically created. The following components are deployed to it:
-
-  - **Jenkins:**
-
-    The pipeline's build engine. Because project users do not directly interact with Jenkins, it's managed and locked.
-
-    >**Note:**  There is no option to use existing Jenkins deployments as the pipeline engine.
-
-  - **Docker Registry:**
-
-    Out-of-the-box, the default target for your build-publish step is an internal Docker Registry. However, you can make configurations to push to a remote registry instead. The internal Docker Registry is only accessible from cluster nodes and cannot be directly accessed by users. Images are not persisted beyond the lifetime of the pipeline and should only be used in pipeline runs. If you need to access your images outside of pipeline runs, please push to an external registry.
-
-  - **Minio:**
-
-    Minio storage is used to store the logs for pipeline executions.
-
-  >**Note:** The managed Jenkins instance works statelessly, so don't worry about its data persistency. The Docker Registry and Minio instances use ephemeral volumes by default, which is fine for most use cases. If you want to make sure pipeline logs can survive node failures, you can configure persistent volumes for them, as described in [data persistency for pipeline components]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/storage).
-
-# Roles-based Access Control for Pipelines
-
-If you can access a project, you can enable repositories to start building pipelines.
-
-Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure version control providers and manage global pipeline execution settings.
-
-Project members can only configure repositories and pipelines.
-
-# Setting up Pipelines
-
-To set up pipelines, you will need to do the following:
-
-1. [Configure version control providers](#1-configure-version-control-providers)
-2. [Configure repositories](#2-configure-repositories)
-3. [Configure the pipeline](#3-configure-the-pipeline)
-
-### 1. Configure Version Control Providers
-
-Before you can start configuring a pipeline for your repository, you must configure and authorize a version control provider.
-
-| Provider  | Available as of  |
-| --- | --- |
-| GitHub  | v2.0.0           |
-| GitLab | v2.1.0 |
-| Bitbucket | v2.2.0 |
-
-Select your provider's tab below and follow the directions.
-
-{{% tabs %}}
-{{% tab "GitHub" %}}
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
-
-1. Follow the directions displayed to **Setup a Github application**. Rancher redirects you to Github to setup an OAuth App in Github.
-
-1. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.
-
-1. If you're using GitHub for enterprise, select **Use a private github enterprise installation**. Enter the host address of your GitHub installation.
-
-1. Click **Authenticate**.
-
-{{% /tab %}}
-{{% tab "GitLab" %}}
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
-
-1. Follow the directions displayed to **Setup a GitLab application**. Rancher redirects you to GitLab.
-
-1. From GitLab, copy the **Application ID** and **Secret**. Paste them into Rancher.
-
-1. If you're using GitLab for enterprise setup, select **Use a private gitlab enterprise installation**. Enter the host address of your GitLab installation.
-
-1. Click **Authenticate**.
-
->**Note:**
-> 1. Pipeline uses Gitlab [v4 API](https://docs.gitlab.com/ee/api/v3_to_v4.html) and the supported Gitlab version is 9.0+.  
-> 2. If you use GitLab 10.7+ and your Rancher setup is in a local network, enable the **Allow requests to the local network from hooks and services** option in GitLab admin settings.
-{{% /tab %}}
-{{% tab "Bitbucket Cloud" %}}
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar.
-
-1. Choose the **Use public Bitbucket Cloud** option.
-
-1. Follow the directions displayed to **Setup a Bitbucket Cloud application**. Rancher redirects you to Bitbucket to setup an OAuth consumer in Bitbucket.
-
-1. From Bitbucket, copy the consumer **Key** and **Secret**. Paste them into Rancher.
-
-1. Click **Authenticate**.
-
-{{% /tab %}}
-{{% tab "Bitbucket Server" %}}
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar.
-
-1. Choose the **Use private Bitbucket Server setup** option.
-
-1. Follow the directions displayed to **Setup a Bitbucket Server application**.
-
-1. Enter the host address of your Bitbucket server installation.
-
-1. Click **Authenticate**.
-
->**Note:**
-> Bitbucket server needs to do SSL verification when sending webhooks to Rancher. Please ensure that Rancher server's certificate is trusted by the Bitbucket server. There are two options:
->
-> 1. Setup Rancher server with a certificate from a trusted CA.
-> 1. If you're using self-signed certificates, import Rancher server's certificate to the Bitbucket server. For instructions, see the Bitbucket server documentation for [configuring self-signed certificates](https://confluence.atlassian.com/bitbucketserver/if-you-use-self-signed-certificates-938028692.html).
->
-{{% /tab %}}
-{{% /tabs %}}
-
-**Result:** After the version control provider is authenticated, you will be automatically re-directed to start configuring which repositories you want start using with a pipeline.
-
-### 2. Configure Repositories
-
-After the version control provider is authorized, you are automatically re-directed to start configuring which repositories that you want start using pipelines with. Even if someone else has set up the version control provider, you will see their repositories and can build a pipeline.
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Click on **Configure Repositories**.
-
-1. A list of repositories are displayed. If you are configuring repositories the first time, click on **Authorize & Fetch Your Own Repositories** to fetch your repository list.
-
-1. For each repository that you want to set up a pipeline, click on **Enable**.
-
-1. When you're done enabling all your repositories, click on **Done**.
-
-**Results:** You have a list of repositories that you can start configuring pipelines for.
-
-### 3. Configure the Pipeline
-
-Now that repositories are added to your project, you can start configuring the pipeline by adding automated stages and steps. For your convenience, there are multiple built-in step types for dedicated tasks.
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Find the repository that you want to set up a pipeline for.
-
-1. Configure the pipeline through the UI or using a yaml file in the repository, i.e. `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`. Pipeline configuration is split into stages and steps. Stages must fully complete before moving onto the next stage, but steps in a stage run concurrently. For each stage, you can add different step types. Note: As you build out each step, there are different advanced options based on the step type. Advanced options include trigger rules, environment variables, and secrets. For more information on configuring the pipeline through the UI or the YAML file, refer to the [pipeline configuration reference.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config)
-
-   * If you are going to use the UI, select the vertical **&#8942; > Edit Config** to configure the pipeline using the UI. After the pipeline is configured, you must view the YAML file and push it to the repository.
-   * If you are going to use the YAML file, select the vertical **&#8942; > View/Edit YAML** to configure the pipeline. If you choose to use a YAML file, you need to push it to the repository after any changes in order for it to be updated in the repository. When editing the pipeline configuration, it takes a few moments for Rancher to check for an existing pipeline configuration.
-
-1. Select which `branch` to use from the list of branches.
-
-1. Optional: Set up notifications.
-
-1. Set up the trigger rules for the pipeline.
-
-1. Enter a **Timeout** for the pipeline. 
-
-1. When all the stages and steps are configured, click **Done**.
-
-**Results:** Your pipeline is now configured and ready to be run.
-
-
-# Pipeline Configuration Reference
-
-Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config) for details on how to configure a pipeline to:
-
-- Run a script
-- Build and publish images
-- Publish catalog templates
-- Deploy YAML
-- Deploy a catalog app
-
-The configuration reference also covers how to configure:
-
-- Notifications
-- Timeouts
-- The rules that trigger a pipeline
-- Environment variables
-- Secrets
-
-
-# Running your Pipelines
-
-Run your pipeline for the first time. From the project view in Rancher, go to **Resources > Pipelines.** (In versions prior to v2.3.0, go to the **Pipelines** tab.) Find your pipeline and select the vertical **&#8942; > Run**.
-
-During this initial run, your pipeline is tested, and the following pipeline components are deployed to your project as workloads in a new namespace dedicated to the pipeline:
-
-- `docker-registry`
-- `jenkins`
-- `minio`
-
-This process takes several minutes. When it completes, you can view each pipeline component from the project **Workloads** tab.
-
-# Triggering a Pipeline
-
-When a repository is enabled, a webhook is automatically set in the version control provider. By default, the pipeline is triggered by a **push** event to a repository, but you can modify the event(s) that trigger running the pipeline.
-
-Available Events:
-
-* **Push**: Whenever a commit is pushed to the branch in the repository, the pipeline is triggered.
-* **Pull Request**: Whenever a pull request is made to the repository, the pipeline is triggered.
-* **Tag**: When a tag is created in the repository, the pipeline is triggered.
-
-> **Note:** This option doesn't exist for Rancher's [example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/).
-
-### Modifying the Event Triggers for the Repository
-
-1. From the **Global** view, navigate to the project that you want to modify the event trigger for the pipeline.
-
-1. 1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Find the repository that you want to modify the event triggers. Select the vertical **&#8942; > Setting**.
-
-1. Select which event triggers (**Push**, **Pull Request** or **Tag**) you want for the repository.
-
-1. Click **Save**.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md
deleted file mode 100644
index db8e3a24a58..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/concepts/_index.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: Concepts
-weight: 1
----
-
-The purpose of this page is to explain common concepts and terminology related to pipelines.
-
-- **Pipeline:**
-
-    A _pipeline_ is a software delivery process that is broken into different stages and steps. Setting up a pipeline can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects. A pipeline is based on a specific repository. It defines the process to build, test, and deploy your code. Rancher uses the [pipeline as code](https://jenkins.io/doc/book/pipeline-as-code/) model. Pipeline configuration is represented as a pipeline file in the source code repository, using the file name `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`.
-
-- **Stages:**
-
-    A pipeline stage consists of multiple steps. Stages are executed in the order defined in the pipeline file. The steps in a stage are executed concurrently. A stage starts when all steps in the former stage finish without failure.
-
-- **Steps:**
-
-    A pipeline step is executed inside a specified stage. A step fails if it exits with a code other than `0`. If a step exits with this failure code, the entire pipeline fails and terminates.
-
-- **Workspace:**
-
-    The workspace is the working directory shared by all pipeline steps. In the beginning of a pipeline, source code is checked out to the workspace. The command for every step bootstraps in the workspace. During a pipeline execution, the artifacts from a previous step will be available in future steps. The working directory is an ephemeral volume and will be cleaned out with the executor pod when a pipeline execution is finished.
-
-Typically, pipeline stages include:
-
-- **Build:**
-
-    Each time code is checked into your repository, the pipeline automatically clones the repo and builds a new iteration of your software. Throughout this process, the software is typically reviewed by automated tests.
-
-- **Publish:**
-
-    After the build is completed, either a Docker image is built and published to a Docker registry or a catalog template is published.
-
-- **Deploy:**
-
-    After the artifacts are published, you would release your application so users could start using the updated product.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
deleted file mode 100644
index 3b9547fab67..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/config/_index.md
+++ /dev/null
@@ -1,645 +0,0 @@
----
-title: Pipeline Configuration Reference
-weight: 1
----
-
-In this section, you'll learn how to configure pipelines.
-
-- [Step Types](#step-types)
-- [Step Type: Run Script](#step-type-run-script)
-- [Step Type: Build and Publish Images](#step-type-build-and-publish-images)
-- [Step Type: Publish Catalog Template](#step-type-publish-catalog-template)
-- [Step Type: Deploy YAML](#step-type-deploy-yaml)
-- [Step Type: Deploy Catalog App](#step-type-deploy-catalog-app)
-- [Notifications](#notifications)
-- [Timeouts](#timeouts)
-- [Triggers and Trigger Rules](#triggers-and-trigger-rules)
-- [Environment Variables](#environment-variables)
-- [Secrets](#secrets)
-- [Pipeline Variable Substitution Reference](#pipeline-variable-substitution-reference)
-- [Global Pipeline Execution Settings](#global-pipeline-execution-settings)
-  - [Executor Quota](#executor-quota)
-  - [Resource Quota for Executors](#resource-quota-for-executors)
-  - [Custom CA](#custom-ca)
-- [Persistent Data for Pipeline Components](#persistent-data-for-pipeline-components)
-- [Example rancher-pipeline.yml](#example-rancher-pipeline-yml)
-
-# Step Types
-
-Within each stage, you can add as many steps as you'd like. When there are multiple steps in one stage, they run concurrently.
-
-Step types include:
-
-- [Run Script](#step-type-run-script)
-- [Build and Publish Images](#step-type-build-and-publish-images)
-- [Publish Catalog Template](#step-type-publish-catalog-template)
-- [Deploy YAML](#step-type-deploy-yaml)
-- [Deploy Catalog App](#step-type-deploy-catalog-app)
-
-<!--
-### Clone
-
-The first stage is preserved to be a cloning step that checks out source code from your repo. Rancher handles the cloning of the git repository. This action is equivalent to `git clone <repository_link> <workspace_dir>`.
--->
-
-### Configuring Steps By UI
-
-If you haven't added any stages, click **Configure pipeline for this branch** to configure the pipeline through the UI.
-
-1. Add stages to your pipeline execution by clicking **Add Stage**.
-
-   1. Enter a **Name** for each stage of your pipeline.
-   1. For each stage, you can configure [trigger rules](#triggers-and-trigger-rules) by clicking on **Show Advanced Options**. Note: this can always be updated at a later time.
-
-1. After you've created a stage, start [adding steps](#step-types) by clicking **Add a Step**. You can add multiple steps to each stage.
-
-### Configuring Steps by YAML
-
-For each stage, you can add multiple steps. Read more about each [step type](#step-types) and the advanced options to get all the details on how to configure the YAML. This is only a small example of how to have multiple stages with a singular step in each stage.
-
-```yaml
-# example
-stages:
-  - name: Build something
-    # Conditions for stages
-    when:
-      branch: master
-      event: [ push, pull_request ]
-    # Multiple steps run concurrently
-    steps:
-      - runScriptConfig:
-          image: busybox
-          shellScript: date -R
-  - name: Publish my image
-    steps:
-    - publishImageConfig:
-        dockerfilePath: ./Dockerfile
-        buildContext: .
-        tag: rancher/rancher:v2.0.0
-        # Optionally push to remote registry
-        pushRemote: true
-        registry: reg.example.com
-```
-# Step Type: Run Script
-
-The **Run Script** step executes arbitrary commands in the workspace inside a specified container. You can use it to build, test and do more, given whatever utilities the base image provides. For your convenience, you can use variables to refer to metadata of a pipeline execution. Please refer to the [pipeline variable substitution reference](#pipeline-variable-substitution-reference) for the list of available variables.
-
-### Configuring Script by UI
-
-1. From the **Step Type** drop-down, choose **Run Script** and fill in the form.
-
-1. Click **Add**.
-
-### Configuring Script by YAML
-```yaml
-# example
-stages:
-- name: Build something
-  steps:
-  - runScriptConfig:
-      image: golang
-      shellScript: go build
-```
-# Step Type: Build and Publish Images
-
-The **Build and Publish Image** step builds and publishes a Docker image. This process requires a Dockerfile in your source code's repository to complete successfully.
-
-The option to publish an image to an insecure registry is not exposed in the UI, but you can specify an environment variable in the YAML that allows you to publish an image insecurely.
-
-### Configuring Building and Publishing Images by UI
-1. From the **Step Type** drop-down, choose **Build and Publish**.
-
-1. Fill in the rest of the form. Descriptions for each field are listed below. When you're done, click **Add**.
-
-    Field | Description |
-    ---------|----------|
-     Dockerfile Path | The relative path to the Dockerfile in the source code repo. By default, this path is `./Dockerfile`, which assumes the Dockerfile is in the root directory. You can set it to other paths in different use cases (`./path/to/myDockerfile` for example). |
-     Image Name | The image name in `name:tag` format. The registry address is not required. For example, to build  `example.com/repo/my-image:dev`, enter `repo/my-image:dev`. |
-     Push image to remote repository | An option to set the registry that publishes the image that's built.  To use this option, enable it and choose a registry from the drop-down. If this option is disabled, the image is pushed to the internal registry. |
-     Build Context <br/><br/> (**Show advanced options**)| By default, the root directory of the source code (`.`). For more details, see the Docker [build command documentation](https://docs.docker.com/engine/reference/commandline/build/).
-
-### Configuring Building and Publishing Images by YAML
-
-You can use specific arguments for Docker daemon and the build. They are not exposed in the UI, but they are available in pipeline YAML format, as indicated in the example below. Available environment variables include:
-
-Variable Name           | Description
-------------------------|------------------------------------------------------------
-PLUGIN_DRY_RUN          | Disable docker push
-PLUGIN_DEBUG            | Docker daemon executes in debug mode
-PLUGIN_MIRROR           | Docker daemon registry mirror
-PLUGIN_INSECURE         | Docker daemon allows insecure registries
-PLUGIN_BUILD_ARGS       | Docker build args, a comma separated list
-
-<br>
-
-```yaml
-# This example shows an environment variable being used
-# in the Publish Image step. This variable allows you to
-# publish an image to an insecure registry:
-
-stages:
-- name: Publish Image
-  steps:
-  - publishImageConfig:
-      dockerfilePath: ./Dockerfile
-      buildContext: .
-      tag: repo/app:v1
-      pushRemote: true
-      registry: example.com
-    env:
-      PLUGIN_INSECURE: "true"
-```
-
-# Step Type: Publish Catalog Template
-
-The **Publish Catalog Template** step publishes a version of a catalog app template (i.e. Helm chart) to a [git hosted chart repository]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/). It generates a git commit and pushes it to your chart repository. This process requires a chart folder in your source code's repository and a pre-configured secret in the dedicated pipeline namespace to complete successfully. Any variables in the [pipeline variable substitution reference](#pipeline-variable-substitution-reference) is supported for any file in the chart folder.
-
-### Configuring Publishing a Catalog Template by UI
-
-1. From the **Step Type** drop-down, choose **Publish Catalog Template**.
-
-1. Fill in the rest of the form. Descriptions for each field are listed below. When you're done, click **Add**.
-
-    Field | Description |
-    ---------|----------|
-     Chart Folder | The relative path to the chart folder in the source code repo, where the `Chart.yaml` file is located. |
-     Catalog Template Name | The name of the template. For example, wordpress. |
-     Catalog Template Version | The version of the template you want to publish, it should be consistent with the version defined in the `Chart.yaml` file. |
-     Protocol | You can choose to publish via HTTP(S) or SSH protocol. |
-     Secret   | The secret that stores your Git credentials. You need to create a secret in dedicated pipeline namespace in the project before adding this step. If you use HTTP(S) protocol, store Git username and password in `USERNAME` and `PASSWORD` key of the secret. If you use SSH protocol, store Git deploy key in `DEPLOY_KEY` key of the secret. After the secret is created, select it in this option. |
-     Git URL  | The Git URL of the chart repository that the template will be published to. |
-     Git Branch | The Git branch of the chart repository that the template will be published to. |
-     Author Name | The author name used in the commit message. |
-     Author Email | The author email used in the commit message. |
-
-
-### Configuring Publishing a Catalog Template by YAML
-
-You can add **Publish Catalog Template** steps directly in the `.rancher-pipeline.yml` file.
-
-Under the `steps` section, add a step with `publishCatalogConfig`. You will provide the following information:
-
-* Path: The relative path to the chart folder in the source code repo, where the `Chart.yaml` file is located.
-* CatalogTemplate: The name of the template.
-* Version: The version of the template you want to publish, it should be consistent with the version defined in the `Chart.yaml` file.
-* GitUrl: The git URL of the chart repository that the template will be published to.
-* GitBranch: The git branch of the chart repository that the template will be published to.
-* GitAuthor: The author name used in the commit message.
-* GitEmail: The author email used in the commit message.
-* Credentials: You should provide Git credentials by referencing secrets in dedicated pipeline namespace. If you publish via SSH protocol, inject your deploy key to the `DEPLOY_KEY` environment variable. If you publish via HTTP(S) protocol, inject your username and password to `USERNAME` and `PASSWORD` environment variables.
-
-```yaml
-# example
-stages:
-- name: Publish Wordpress Template
-  steps:
-  - publishCatalogConfig:
-      path: ./charts/wordpress/latest
-      catalogTemplate: wordpress
-      version: ${CICD_GIT_TAG}
-      gitUrl: git@github.com:myrepo/charts.git
-      gitBranch: master
-      gitAuthor: example-user
-      gitEmail: user@example.com
-    envFrom:
-    - sourceName: publish-keys
-      sourceKey: DEPLOY_KEY
-```
-
-# Step Type: Deploy YAML
-
-This step deploys arbitrary Kubernetes resources to the project. This deployment requires a Kubernetes manifest file to be present in the source code repository. Pipeline variable substitution is supported in the manifest file. You can view an example file at [GitHub](https://github.com/rancher/pipeline-example-go/blob/master/deployment.yaml). Please refer to the [pipeline variable substitution reference](#pipeline-variable-substitution-reference) for the list of available variables.
-
-### Configure Deploying YAML by UI
-
-1. From the **Step Type** drop-down, choose **Deploy YAML** and fill in the form.
-
-1. Enter the **YAML Path**, which is the path to the manifest file in the source code.
-
-1. Click **Add**.
-
-### Configure Deploying YAML by YAML
-
-```yaml
-# example
-stages:
-- name: Deploy
-  steps:
-  - applyYamlConfig:
-      path: ./deployment.yaml
-```
-
-# Step Type :Deploy Catalog App
-
-The **Deploy Catalog App** step deploys a catalog app in the project. It will install a new app if it is not present, or upgrade an existing one.
-
-### Configure Deploying Catalog App by UI
-
-1. From the **Step Type** drop-down, choose **Deploy Catalog App**.
-
-1. Fill in the rest of the form. Descriptions for each field are listed below. When you're done, click **Add**.
-
-    Field | Description |
-    ---------|----------|
-     Catalog | The catalog from which the app template will be used. |
-     Template Name | The name of the app template. For example, wordpress. |
-     Template Version | The version of the app template you want to deploy. |
-     Namespace | The target namespace where you want to deploy the app. |
-     App Name  | The name of the app you want to deploy. |
-     Answers   | Key-value pairs of answers used to deploy the app. |
-
-
-### Configure Deploying Catalog App by YAML
-
-You can add **Deploy Catalog App** steps directly in the `.rancher-pipeline.yml` file.
-
-Under the `steps` section, add a step with `applyAppConfig`. You will provide the following information:
-
-* CatalogTemplate: The ID of the template. This can be found by clicking `Launch app` and selecting `View details` for the app. It is the last part of the URL.
-* Version: The version of the template you want to deploy.
-* Answers: Key-value pairs of answers used to deploy the app.
-* Name: The name of the app you want to deploy.
-* TargetNamespace: The target namespace where you want to deploy the app.
-
-```yaml
-# example
-stages:
-- name: Deploy App
-  steps:
-  - applyAppConfig:
-      catalogTemplate: cattle-global-data:library-mysql
-      version: 0.3.8
-      answers:
-        persistence.enabled: "false"
-      name: testmysql
-      targetNamespace: test
-```
-
-# Timeouts
-
-By default, each pipeline execution has a timeout of 60 minutes. If the pipeline execution cannot complete within its timeout period, the pipeline is aborted.
-
-### Configuring Timeouts by UI
-
-Enter a new value in the **Timeout** field.
-
-### Configuring Timeouts by YAML
-
-In the `timeout` section, enter the timeout value in minutes.
-
-```yaml
-# example
-stages:
-  - name: Build something
-    steps:
-    - runScriptConfig:
-        image: busybox
-        shellScript: ls
-# timeout in minutes
-timeout: 30
-```
-
-# Notifications
-
-You can enable notifications to any [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) based on the build status of a pipeline. Before enabling notifications, Rancher recommends [setting up notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/#adding-notifiers) so it will be easy to add recipients immediately.
-
-### Configuring Notifications by UI
-
-1. Within the **Notification** section, turn on notifications by clicking **Enable**.
-
-1. Select the conditions for the notification. You can select to get a notification for the following statuses: `Failed`, `Success`, `Changed`. For example, if you want to receive notifications when an execution fails, select **Failed**.
-
-1. If you don't have any existing [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers), Rancher will provide a warning that no notifiers are set up and provide a link to be able to go to the notifiers page. Follow the [instructions]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/#adding-notifiers) to add a notifier. If you  already have notifiers, you can add them to the notification by clicking the **Add Recipient** button.
-
-    > **Note:** Notifiers are configured at a cluster level and require a different level of permissions.
-
-1. For each recipient, select which notifier type from the dropdown. Based on the type of notifier, you can use the default recipient or override the recipient with a different one. For example, if you have a notifier for _Slack_, you can update which channel to send the notification to. You can add additional notifiers by clicking **Add Recipient**.
-
-### Configuring Notifications by YAML
-
-In the `notification` section, you will provide the following information:
-
-* **Recipients:** This will be the list of notifiers/recipients that will receive the notification.
-  * **Notifier:** The ID of the notifier. This can be found by finding the notifier and selecting **View in API** to get the ID.
-  * **Recipient:** Depending on the type of the notifier, the "default recipient" can be used or you can override this with a different recipient. For example, when configuring a slack notifier, you select a channel as your default recipient, but if you wanted to send notifications to a different channel, you can select a different recipient.
-* **Condition:** Select which conditions of when you want the notification to be sent.
-* **Message (Optional):** If you want to change the default notification message, you can edit this in the yaml. Note: This option is not available in the UI.
-
-```yaml
-# Example
-stages:
-  - name: Build something
-    steps:
-    - runScriptConfig:
-        image: busybox
-        shellScript: ls
-notification:
-  recipients:
-  - # Recipient
-    recipient: "#mychannel"
-    # ID of Notifier
-    notifier: "c-wdcsr:n-c9pg7"
-  - recipient: "test@example.com"
-    notifier: "c-wdcsr:n-lkrhd"
-  # Select which statuses you want the notification to be sent
-  condition: ["Failed", "Success", "Changed"]
-  # Ability to override the default message (Optional)
-  message: "my-message"
-```
-
-# Triggers and Trigger Rules
-
-After you configure a pipeline, you can trigger it using different methods:
-
-- **Manually:**
-
-    After you configure a pipeline, you can trigger a build using the latest CI definition from Rancher UI. When a pipeline execution is triggered, Rancher dynamically provisions a Kubernetes pod to run your CI tasks and then remove it upon completion.
-
-- **Automatically:**
-
-    When you enable a repository for a pipeline, webhooks are automatically added to the version control system. When project users interact with the repo by pushing code, opening pull requests, or creating a tag, the version control system sends a webhook to Rancher Server, triggering a pipeline execution.
-
-    To use this automation, webhook management permission is required for the repository. Therefore, when users authenticate and fetch their repositories, only those on which they have webhook management permission will be shown.
-
-Trigger rules can be created to have fine-grained control of pipeline executions in your pipeline configuration. Trigger rules come in two types:
-
-- **Run this when:** This type of rule starts the pipeline, stage, or step when a trigger explicitly occurs.
-
-- **Do Not Run this when:** This type of rule skips the pipeline, stage, or step when a trigger explicitly occurs.
-
-If all conditions evaluate to `true`, then the pipeline/stage/step is executed. Otherwise it is skipped. When a pipeline is skipped, none of the pipeline is executed. When a stage/step is skipped, it is considered successful and follow-up stages/steps continue to run.
-
-Wildcard character (`*`) expansion is supported in `branch` conditions.
-
-This section covers the following topics:
-
-- [Configuring pipeline triggers](#configuring-pipeline-triggers)
-- [Configuring stage triggers](#configuring-stage-triggers)
-- [Configuring step triggers](#configuring-step-triggers)
-- [Configuring triggers by YAML](#configuring-triggers-by-yaml)
-
-### Configuring Pipeline Triggers
-
-1. From the **Global** view, navigate to the project that you want to configure a pipeline trigger rule.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. From the repository for which you want to manage trigger rules, select the vertical **&#8942; > Edit Config**.
-
-1. Click on **Show Advanced Options**.
-
-1. In the **Trigger Rules** section, configure rules to run or skip the pipeline.
-
-    1.  Click **Add Rule**. In the **Value** field, enter the name of the branch that triggers the pipeline.
-
-    1. **Optional:** Add more branches that trigger a build.
-
-1. Click **Done.**
-
-### Configuring Stage Triggers
-
-1. From the **Global** view, navigate to the project that you want to configure a stage trigger rule.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. From the repository for which you want to manage trigger rules, select the vertical **&#8942; > Edit Config**.
-
-1. Find the **stage** that you want to manage trigger rules, click the **Edit** icon for that stage.
-
-1. Click **Show advanced options**.
-
-1. In the **Trigger Rules** section, configure rules to run or skip the stage.
-
-    1.  Click **Add Rule**.
-
-    1.  Choose the **Type** that triggers the stage and enter a value.
-
-        | Type   | Value                                                                |
-        | ------ | -------------------------------------------------------------------- |
-        | Branch | The name of the branch that triggers the stage.                      |
-        | Event  | The type of event that triggers the stage. Values are: `Push`, `Pull Request`, `Tag` |
-
-1. Click **Save**.
-
-### Configuring Step Triggers
-
-1. From the **Global** view, navigate to the project that you want to configure a stage trigger rule.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. From the repository for which you want to manage trigger rules, select the vertical **&#8942; > Edit Config**.
-
-1. Find the **step** that you want to manage trigger rules, click the **Edit** icon for that step.
-
-1. Click **Show advanced options**.
-
-1. In the **Trigger Rules** section, configure rules to run or skip the step.
-
-    1.  Click **Add Rule**.
-
-    1.  Choose the **Type** that triggers the step and enter a value.
-
-        | Type   | Value                                                                |
-        | ------ | -------------------------------------------------------------------- |
-        | Branch | The name of the branch that triggers the step.                      |
-        | Event  | The type of event that triggers the step. Values are: `Push`, `Pull Request`, `Tag` |
-
-1. Click **Save**.
-
-
-### Configuring Triggers by YAML
-
-```yaml
-# example
-stages:
-  - name: Build something
-    # Conditions for stages
-    when:
-      branch: master
-      event: [ push, pull_request ]
-    # Multiple steps run concurrently
-    steps:
-    - runScriptConfig:
-        image: busybox
-        shellScript: date -R
-      # Conditions for steps
-      when:
-        branch: [ master, dev ]
-        event: push
-# branch conditions for the pipeline
-branch:
-  include: [ master, feature/*]
-  exclude: [ dev ]
-```
-
-# Environment Variables
-
-When configuring a pipeline, certain [step types](#step-types) allow you to use environment variables to configure the step's script.
-
-### Configuring Environment Variables by UI
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. From the pipeline for which you want to edit build triggers, select **&#8942; > Edit Config**.
-
-1. Within one of the stages, find the **step** that you want to add an environment variable for, click the **Edit** icon.
-
-1. Click **Show advanced options**.
-
-1. Click **Add Variable**, and then enter a key and value in the fields that appear. Add more variables if needed.
-
-1. Add your environment variable(s) into either the script or file.
-
-1. Click **Save**.
-
-### Configuring Environment Variables by YAML
-
-```yaml
-# example
-stages:
-  - name: Build something
-    steps:
-    - runScriptConfig:
-        image: busybox
-        shellScript: echo ${FIRST_KEY} && echo ${SECOND_KEY}
-      env:
-        FIRST_KEY: VALUE
-        SECOND_KEY: VALUE2
-```
-
-# Secrets
-
-If you need to use security-sensitive information in your pipeline scripts (like a password), you can pass them in using Kubernetes [secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/).
-
-### Prerequisite
-Create a secret in the same project as your pipeline, or explicitly in the namespace where pipeline build pods run.
-<br>
-
->**Note:** Secret injection is disabled on [pull request events](#triggers-and-trigger-rules).
-
-### Configuring Secrets by UI
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. From the pipeline for which you want to edit build triggers, select **&#8942; > Edit Config**.
-
-1. Within one of the stages, find the **step** that you want to use a secret for, click the **Edit** icon.
-
-1. Click **Show advanced options**.
-
-1. Click **Add From Secret**. Select the secret file that you want to use. Then choose a key. Optionally, you can enter an alias for the key.
-
-1. Click **Save**.
-
-### Configuring Secrets by YAML
-
-```yaml
-# example
-stages:
-  - name: Build something
-    steps:
-    - runScriptConfig:
-        image: busybox
-        shellScript: echo ${ALIAS_ENV}
-      # environment variables from project secrets
-      envFrom:
-      - sourceName: my-secret
-        sourceKey: secret-key
-        targetKey: ALIAS_ENV
-```
-
-# Pipeline Variable Substitution Reference
-
-For your convenience, the following variables are available for your pipeline configuration scripts. During pipeline executions, these variables are replaced by metadata. You can reference them in the form of `${VAR_NAME}`.
-
-Variable Name           | Description
-------------------------|------------------------------------------------------------
-`CICD_GIT_REPO_NAME`      | Repository name (Github organization omitted).
-`CICD_GIT_URL`            | URL of the Git repository.
-`CICD_GIT_COMMIT`         | Git commit ID being executed.
-`CICD_GIT_BRANCH`         | Git branch of this event.
-`CICD_GIT_REF`            | Git reference specification of this event.
-`CICD_GIT_TAG`            | Git tag name, set on tag event.
-`CICD_EVENT`              | Event that triggered the build (`push`, `pull_request` or `tag`).
-`CICD_PIPELINE_ID`        | Rancher ID for the pipeline.
-`CICD_EXECUTION_SEQUENCE` | Build number of the pipeline.
-`CICD_EXECUTION_ID`       | Combination of `{CICD_PIPELINE_ID}-{CICD_EXECUTION_SEQUENCE}`.
-`CICD_REGISTRY`           | Address for the Docker registry for the previous publish image step, available in the Kubernetes manifest file of a `Deploy YAML` step.
-`CICD_IMAGE`              | Name of the image built from the previous publish image step, available in the Kubernetes manifest file of a `Deploy YAML` step. It does not contain the image tag.<br/><br/> [Example](https://github.com/rancher/pipeline-example-go/blob/master/deployment.yaml)
-
-# Global Pipeline Execution Settings
-
-After configuring a version control provider, there are several options that can be configured globally on how pipelines are executed in Rancher. These settings can be edited by selecting **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
-
-- [Executor Quota](#executor-quota)
-- [Resource Quota for Executors](#resource-quota-for-executors)
-- [Custom CA](#custom-ca)
-
-### Executor Quota
-
-Select the maximum number of pipeline executors. The _executor quota_ decides how many builds can run simultaneously in the project. If the number of triggered builds exceeds the quota, subsequent builds will queue until a vacancy opens. By default, the quota is `2`. A value of `0` or less removes the quota limit.
-
-### Resource Quota for Executors
-
-Configure compute resources for Jenkins agent containers. When a pipeline execution is triggered, a build pod is dynamically provisioned to run your CI tasks. Under the hood, A build pod consists of one Jenkins agent container and one container for each pipeline step. You can [manage compute resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) for every containers in the pod.
-
-Edit the **Memory Reservation**, **Memory Limit**, **CPU Reservation** or **CPU Limit**, then click **Update Limit and Reservation**.
-
-To configure compute resources for pipeline-step containers:
-
-You can configure compute resources for pipeline-step containers in the `.rancher-pipeline.yml` file.
-
-In a [step type]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/#step-types), you will provide the following information:
-
-* **CPU Reservation (`CpuRequest`)**: CPU request for the container of a pipeline step.
-* **CPU Limit (`CpuLimit`)**: CPU limit for the container of a pipeline step.
-* **Memory Reservation (`MemoryRequest`)**: Memory request for the container of a pipeline step.
-* **Memory Limit (`MemoryLimit`)**: Memory limit for the container of a pipeline step.
-
-```yaml
-# example
-stages:
-  - name: Build something
-    steps:
-    - runScriptConfig:
-        image: busybox
-        shellScript: ls
-      cpuRequest: 100m
-      cpuLimit: 1
-      memoryRequest:100Mi
-      memoryLimit: 1Gi
-    - publishImageConfig:
-        dockerfilePath: ./Dockerfile
-        buildContext: .
-        tag: repo/app:v1
-      cpuRequest: 100m
-      cpuLimit: 1
-      memoryRequest:100Mi
-      memoryLimit: 1Gi
-```
-
->**Note:** Rancher sets default compute resources for pipeline steps except for `Build and Publish Images` and `Run Script` steps. You can override the default value by specifying compute resources in the same way.
-
-### Custom CA
-
-If you want to use a version control provider with a certificate from a custom/internal CA root, the CA root certificates need to be added as part of the version control provider configuration in order for the pipeline build pods to succeed.
-
-1. Click **Edit cacerts**.
-
-1. Paste in the CA root certificates and click **Save cacerts**.
-
-**Result:** Pipelines can be used and new pods will be able to work with the self-signed-certificate.
-
-# Persistent Data for Pipeline Components
-
-The internal Docker registry and the Minio workloads use ephemeral volumes by default. This default storage works out-of-the-box and makes testing easy, but you lose the build images and build logs if the node running the Docker Registry or Minio fails. In most cases this is fine. If you want build images and logs to survive node failures, you can configure the Docker Registry and Minio to use persistent volumes.
-
-For details on setting up persistent storage for pipelines, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/storage)
-
-# Example rancher-pipeline.yml
-
-An example pipeline configuration file is on [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
deleted file mode 100644
index cd6f3c0da1d..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/docs-for-v2.0.x/_index.md
+++ /dev/null
@@ -1,123 +0,0 @@
----
-title: v2.0.x Pipeline Documentation
-weight: 9000
----
-
->**Note:** This section describes the pipeline feature as implemented in Rancher v2.0.x. If you are using Rancher v2.1 or later, where pipelines have been significantly improved, please refer to the new documentation for [v2.1 or later]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/).
-
-
-
-Pipelines help you automate the software delivery process. You can integrate Rancher with GitHub to create a pipeline.
-
-You can set up your pipeline to run a series of stages and steps to test your code and deploy it.
-
-<dl>
-	<dt>Pipelines</dt>
-	<dd>Contain a series of stages and steps. Out-of-the-box, the pipelines feature supports fan out and in capabilities.</dd>
-	<dt>Stages</dt>
-	<dd>Executed sequentially. The next stage will not execute until all of the steps within the stage execute.</dd>
-	<dt>Steps</dt>
-	<dd>Are executed in parallel within a stage. </dd>
-</dl>
-
-## Enabling CI Pipelines
-
-1. Select cluster from drop down.
-
-2. Under tools menu select pipelines.
-
-3. Follow instructions for setting up github auth on page.
-
-
-## Creating CI Pipelines
-
-1. Go to the project you want this pipeline to run in.
-
-2. Click **Resources > Pipelines.** In versions prior to v2.3.0,click **Workloads > Pipelines.**
-
-4. Click Add pipeline button.
-
-5. Enter in your repository name (Autocomplete should help zero in on it quickly).
-
-6. Select Branch options.
-
-	-	Only the branch {BRANCH NAME}: Only events triggered by changes to this branch will be built.
-
-	-	Everything but {BRANCH NAME}: Build any branch that triggered an event EXCEPT events from this branch.
-
-	-	All branches: Regardless of the branch that triggered the event always build.
-
-	>**Note:** If you want one path for master, but another for PRs or development/test/feature branches, create two separate pipelines.
-
-7. Select the build trigger events. By default, builds will only happen by manually clicking build now in Rancher UI.
-
-	- Automatically build this pipeline whenever there is a git commit. (This respects the branch selection above)
-
-	- Automatically build this pipeline whenever there is a new PR.
-
-	- Automatically build the pipeline. (Allows you to configure scheduled builds similar to Cron)
-
-8. Click Add button.
-
-	By default, Rancher provides a three stage pipeline for you. It consists of a build stage where you would compile, unit test, and scan code. The publish stage has a single step to publish a docker image.
-
-
-8. Add a name to the pipeline in order to complete adding a pipeline.
-
-9. Click on the ‘run a script’ box under the ‘Build’ stage.
-
-	Here you can set the image, or select from pre-packaged envs.
-
-10. Configure a shell script to run inside the container when building.
-
-11. Click Save to persist the changes.
-
-12. Click the “publish an image’ box under the “Publish” stage.
-
-13. Set the location of the Dockerfile. By default it looks in the root of the workspace. Instead, set the build context for building the image relative to the root of the workspace.
-
-14. Set the image information.
-
-	The registry is the remote registry URL. It is defaulted to Docker hub.
-	Repository is the `<org>/<repo>` in the repository.
-
-15. Select the Tag. You can hard code a tag like ‘latest’ or select from a list of available variables.
-
-16. If this is the first time using this registry, you can add the username/password for pushing the image. You must click save for the registry credentials AND also save for the modal.
-
-
-
-
-## Creating a New Stage
-
-1. To add a new stage the user must click the ‘add a new stage’ link in either create or edit mode of the pipeline view.
-
-2. Provide a name for the stage.
-
-3. Click save.
-
-
-## Creating a New Step
-
-1. Go to create / edit mode of the pipeline.
-
-2. Click “Add Step” button in the stage that you would like to add a step in.
-
-3. Fill out the form as detailed above
-
-
-## Environment Variables
-
-For your convenience the following environment variables are available in your build steps:
-
-Variable Name           | Description
-------------------------|------------------------------------------------------------
-CICD_GIT_REPO_NAME      | Repository Name (Stripped of Github Organization)
-CICD_PIPELINE_NAME      | Name of the pipeline
-CICD_GIT_BRANCH         | Git branch of this event
-CICD_TRIGGER_TYPE       | Event that triggered the build
-CICD_PIPELINE_ID        | Rancher ID for the pipeline
-CICD_GIT_URL            | URL of the Git repository
-CICD_EXECUTION_SEQUENCE | Build number of the pipeline
-CICD_EXECUTION_ID       | Combination of {CICD_PIPELINE_ID}-{CICD_EXECUTION_SEQUENCE}
-CICD_GIT_COMMIT         | Git commit ID being executed.
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
deleted file mode 100644
index 2e24fbfeeb1..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/example-repos/_index.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: Example Repositories
-weight: 500
----
-
-Rancher ships with several example repositories that you can use to familiarize yourself with pipelines. We recommend configuring and testing the example repository that most resembles your environment before using pipelines with your own repositories in a production environment. Use this example repository as a sandbox for repo configuration, build demonstration, etc. Rancher includes example repositories for:
-
-- Go
-- Maven
-- php
-
-> **Note:** The example repositories are only available if you have not [configured a version control provider]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines).
-
-To start using these example repositories,
-
-1. [Enable the example repositories](#1-enable-the-example-repositories)
-2. [View the example pipeline](#2-view-the-example-pipeline)
-3. [Run the example pipeline](#3-run-the-example-pipeline)
-
-### 1. Enable the Example Repositories
-
-By default, the example pipeline repositories are disabled. Enable one (or more) to test out the pipeline feature and see how it works.
-
-1. From the **Global** view, navigate to the project that you want to test out pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Click **Configure Repositories**.
-
-    **Step Result:** A list of example repositories displays.
-
-    >**Note:** Example repositories only display if you haven't fetched your own repos.
-
-1. Click **Enable** for one of the example repos (e.g., `https://github.com/rancher/pipeline-example-go.git`). Then click **Done**.
-
-**Results:**
-
-- The example repository is enabled to work with a pipeline is available in the **Pipeline** tab.
-
-- The following workloads are deployed to a new namespace:
-
-    - `docker-registry`
-    - `jenkins`
-    - `minio`
-
-### 2. View the Example Pipeline
-
-After enabling an example repository, review the pipeline to see how it is set up.
-
-1. From the **Global** view, navigate to the project that you want to test out pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Find the example repository, select the vertical **&#8942;**. There are two ways to view the pipeline:
-  * **Rancher UI**: Click on **Edit Config** to view the stages and steps of the pipeline.
-  * **YAML**: Click on View/Edit YAML to view the `./rancher-pipeline.yml` file.
-
-### 3. Run the Example Pipeline
-
-After enabling an example repository, run the pipeline to see how it works.
-
-1. From the **Global** view, navigate to the project that you want to test out pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Find the example repository, select the vertical **&#8942; > Run**.
-
-    >**Note:** When you run a pipeline the first time, it takes a few minutes to pull relevant images and provision necessary pipeline components.
-
-**Result:** The pipeline runs. You can see the results in the logs.
-
-### What's Next?
-
-For detailed information about setting up your own pipeline for your repository, [configure a version control provider]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines), [enable a repository](#configure-repositories) and finally [configure your pipeline]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/#pipeline-configuration).
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
deleted file mode 100644
index 28cad6e2b8f..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/example/_index.md
+++ /dev/null
@@ -1,72 +0,0 @@
----
-title: Example YAML File
-weight: 501
----
-
-Pipelines can be configured either through the UI or using a yaml file in the repository, i.e. `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`.
-
-In the [pipeline configuration reference]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config), we provide examples of how to configure each feature using the Rancher UI or using YAML configuration.
-
-Below is a full example `rancher-pipeline.yml` for those who want to jump right in.
-
-```yaml
-# example
-stages:
-  - name: Build something
-    # Conditions for stages
-    when:
-      branch: master
-      event: [ push, pull_request ]
-    # Multiple steps run concurrently
-    steps:
-    - runScriptConfig:
-        image: busybox
-        shellScript: echo ${FIRST_KEY} && echo ${ALIAS_ENV}
-      # Set environment variables in container for the step
-      env:
-        FIRST_KEY: VALUE
-        SECOND_KEY: VALUE2
-      # Set environment variables from project secrets
-      envFrom:
-      - sourceName: my-secret
-        sourceKey: secret-key
-        targetKey: ALIAS_ENV
-    - runScriptConfig:
-        image: busybox
-        shellScript: date -R
-      # Conditions for steps
-      when:
-        branch: [ master, dev ]
-        event: push
-  - name: Publish my image
-    steps:
-    - publishImageConfig:
-        dockerfilePath: ./Dockerfile
-        buildContext: .
-        tag: rancher/rancher:v2.0.0
-        # Optionally push to remote registry
-        pushRemote: true
-        registry: reg.example.com
-  - name: Deploy some workloads
-    steps:
-    - applyYamlConfig:
-        path: ./deployment.yaml
-# branch conditions for the pipeline
-branch:
-  include: [ master, feature/*]
-  exclude: [ dev ]
-# timeout in minutes
-timeout: 30
-notification:
-  recipients:
-  - # Recipient
-    recipient: "#mychannel"
-    # ID of Notifier
-    notifier: "c-wdcsr:n-c9pg7"
-  - recipient: "test@example.com"
-    notifier: "c-wdcsr:n-lkrhd"
-  # Select which statuses you want the notification to be sent  
-  condition: ["Failed", "Success", "Changed"]
-  # Ability to override the default message (Optional)
-  message: "my-message"
-```
diff --git a/content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md
deleted file mode 100644
index 6fec0fa6ccb..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pipelines/storage/_index.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: Configuring Persistent Data for Pipeline Components
-weight: 600
----
-
-The internal [Docker registry](#how-pipelines-work) and the [Minio](#how-pipelines-work) workloads use ephemeral volumes by default. This default storage works out-of-the-box and makes testing easy, but you lose the build images and build logs if the node running the Docker Registry or Minio fails. In most cases this is fine. If you want build images and logs to survive node failures, you can configure the Docker Registry and Minio to use persistent volumes.
-
-This section assumes that you understand how persistent storage works in Kubernetes. For more information, refer to the section on [how storage works.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/how-storage-works/)
-
->**Prerequisites (for both parts A and B):**
->
->[Persistent volumes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) must be available for the cluster.
-
-### A. Configuring Persistent Data for Docker Registry
-
-1. From the project that you're configuring a pipeline for, and click **Resources > Workloads.** In versions prior to v2.3.0, select the **Workloads** tab.
-
-1. Find the `docker-registry` workload and select **&#8942; > Edit**.
-
-1. Scroll to the **Volumes** section and expand it. Make one of the following selections from the **Add Volume** menu, which is near the bottom of the section:
-
-    - **Add Volume > Add a new persistent volume (claim)**
-    - **Add Volume > Use an existing persistent volume (claim)**
-
-1.  Complete the form that displays to choose a persistent volume for the internal Docker registry.
-{{% tabs %}}
-{{% tab "Add a new persistent volume" %}}
-<br/>
-1. Enter a **Name** for the volume claim.
-
-1. Select a volume claim **Source**:
-
-    - If you select **Use a Storage Class to provision a new persistent volume**, select a storage class and enter a **Capacity**.
-
-    - If you select **Use an existing persistent volume**, choose a **Persistent Volume** from the drop-down.
-1. From the **Customize** section, choose the read/write access for the volume.
-
-1. Click **Define**.
-
-{{% /tab %}}
-
-{{% tab "Use an existing persistent volume" %}}
-<br/>
-1. Enter a **Name** for the volume claim.
-
-1. Choose a **Persistent Volume Claim** from the drop-down.
-
-1. From the **Customize** section, choose the read/write access for the volume.
-
-1. Click **Define**.
-
-{{% /tab %}}
-
-{{% /tabs %}}
-
-1. From the **Mount Point** field, enter `/var/lib/registry`, which is the data storage path inside the Docker registry container.
-
-1. Click **Upgrade**.
-
-### B. Configuring Persistent Data for Minio
-
-1. From the project view, click **Resources > Workloads.** (In versions prior to v2.3.0, click the **Workloads** tab.) Find the `minio` workload and select **&#8942; > Edit**.
-
-1. Scroll to the **Volumes** section and expand it. Make one of the following selections from the **Add Volume** menu, which is near the bottom of the section:
-
-    - **Add Volume > Add a new persistent volume (claim)**
-    - **Add Volume > Use an existing persistent volume (claim)**
-
-1.  Complete the form that displays to choose a persistent volume for the internal Docker registry.
-{{% tabs %}}
-
-{{% tab "Add a new persistent volume" %}}
-<br/>
-1. Enter a **Name** for the volume claim.
-
-1. Select a volume claim **Source**:
-
-    - If you select **Use a Storage Class to provision a new persistent volume**, select a storage class and enter a **Capacity**.
-
-    - If you select **Use an existing persistent volume**, choose a **Persistent Volume** from the drop-down.
-1. From the **Customize** section, choose the read/write access for the volume.
-
-1. Click **Define**.
-
-{{% /tab %}}
-{{% tab "Use an existing persistent volume" %}}
-<br/>
-1. Enter a **Name** for the volume claim.
-
-1. Choose a **Persistent Volume Claim** from the drop-down.
-
-1. From the **Customize** section, choose the read/write access for the volume.
-
-1. Click **Define**.
-
-{{% /tab %}}
-{{% /tabs %}}
-
-1. From the **Mount Point** field, enter `/data`, which is the data storage path inside the Minio container.
-
-1. Click **Upgrade**.
-
-**Result:** Persistent storage is configured for your pipeline components.
diff --git a/content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md b/content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md
deleted file mode 100644
index 261e1e11782..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/pod-security-policy/_index.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Adding a Pod Security Policy
-weight: 80
----
-
-> **Prerequisite:** The options below are available only for clusters that are [launched using RKE.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) 
-
-When your cluster is running pods with security-sensitive configurations, assign it a [pod security policy]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/), which is a set of rules that monitors the conditions and settings in your pods. If a pod doesn't meet the rules specified in your policy, the policy stops it from running.
-
-You can assign a pod security policy when you provision a cluster. However, if you need to relax or restrict security for your pods later, you can update the policy while editing your cluster.
-
-1. From the **Global** view, find the cluster to which you want to apply a pod security policy. Select **&#8942; > Edit**.
-
-2. Expand **Cluster Options**.
-
-3. From **Pod Security Policy Support**, select **Enabled**.
-
-    >**Note:** This option is only available for clusters [provisioned by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
-
-4. From the **Default Pod Security Policy** drop-down, select the policy you want to apply to the cluster.
-
-	Rancher ships with [policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/#default-pod-security-policies) of `restricted` and `unrestricted`, although you can [create custom policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/#default-pod-security-policies) as well.
-
-5. Click **Save**.
-
-**Result:** The pod security policy is applied to the cluster and any projects within the cluster.
-
->**Note:** Workloads already running before assignment of a pod security policy are grandfathered in. Even if they don't meet your pod security policy, workloads running before assignment of the policy continue to run.
->
->To check if a running workload passes your pod security policy, clone or upgrade it.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md
deleted file mode 100644
index 8b66f65ae47..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Projects
-weight: 2500
----
-
-_Projects_ are objects introduced in Rancher that help organize namespaces in your Kubernetes cluster. You can use projects to create multi-tenant clusters, which allows a group of users to share the same underlying resources without interacting with each other's applications.
-
-In terms of hierarchy:
-
-- Clusters contain projects
-- Projects contain namespaces
-
-Within Rancher, projects allow you to manage multiple namespaces as a single entity. In native Kubernetes, which does not include projects, features like role-based access rights or cluster resources are assigned to individual namespaces. In clusters where multiple namespaces require the same set of access rights, assigning these rights to each individual namespace can become tedious. Even though all namespaces require the same rights, there's no way to apply those rights to all of your namespaces in a single action. You'd have to repetitively assign these rights to each namespace!
-
-Rancher projects resolve this issue by allowing you to apply resources and access rights at the project level. Each namespace in the project then inherits these resources and policies, so you only have to assign them to the project once, rather than assigning them to each individual namespace.
-
-You can use projects to perform actions like:
-
-- [Assign users access to a group of namespaces]({{<baseurl>}}/rancher/v2.x/en/project-admin/project-members)
-- Assign users [specific roles in a project]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles). A role can be owner, member, read-only, or [custom]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/)
-- [Set resource quotas]({{<baseurl>}}/rancher/v2.x/en/project-admin/resource-quotas/)
-- [Manage namespaces]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/)
-- [Configure tools]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/)
-- [Set up pipelines for continuous integration and deployment]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines)
-- [Configure pod security policies]({{<baseurl>}}/rancher/v2.x/en/project-admin/pod-security-policies)
-
-### Authorization
-
-Non-administrative users are only authorized for project access after an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owner or member]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) adds them to the project's **Members** tab.
-
-Whoever creates the project automatically becomes a [project owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles).
-
-## Switching between Projects
-
-To switch between projects, use the drop-down available in the navigation bar. Alternatively, you can switch between projects directly in the navigation bar.
-
-1. From the **Global** view, navigate to the project that you want to configure.
-
-1. Select **Projects/Namespaces** from the navigation bar.
-
-1. Select the link for the project that you want to open.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md
deleted file mode 100644
index 82b308daf17..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/namespaces/_index.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: Namespaces
-weight: 2520
----
-
-Within Rancher, you can further divide projects into different [namespaces](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/), which are virtual clusters within a project backed by a physical cluster. Should you require another level of organization beyond projects and the `default` namespace, you can use multiple namespaces to isolate applications and resources.
-
-Although you assign resources at the project level so that each namespace in the project can use them, you can override this inheritance by assigning resources explicitly to a namespace.
-
-Resources that you can assign directly to namespaces include:
-
-- [Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)
-- [Load Balancers/Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/)
-- [Service Discovery Records]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/service-discovery/)
-- [Persistent Volume Claims]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/persistent-volume-claims/)
-- [Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/)
-- [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/)
-- [Registries]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries/)
-- [Secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/)
-
-To manage permissions in a vanilla Kubernetes cluster, cluster admins configure role-based access policies for each namespace. With Rancher, user permissions are assigned on the project level instead, and permissions are automatically inherited by any namespace owned by the particular project.
-
-> **Note:** If you create a namespace with `kubectl`, it may be unusable because `kubectl` doesn't require your new namespace to be scoped within a project that you have access to. If your permissions are restricted to the project level, it is better to [create a namespace through Rancher]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/#creating-namespaces) to ensure that you will have permission to access the namespace.
-
-
-### Creating Namespaces
-
-Create a new namespace to isolate apps and resources in a project.
-
->**Tip:** When working with project resources that you can assign to a namespace (i.e., [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/), [certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/), [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps), etc.) you can create a namespace on the fly.
-
-1. From the **Global** view, open the project where you want to create a namespace.
-
-    >**Tip:** As a best practice, we recommend creating namespaces from the project level. However, cluster owners and members can create them from the cluster level as well.
-
-1. From the main menu, select **Namespace**. The click **Add Namespace**.
-
-1. **Optional:** If your project has [Resource Quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) in effect, you can override the default resource **Limits** (which places a cap on the resources that the namespace can consume).  
-
-1. Enter a **Name** and then click **Create**.
-
-**Result:** Your namespace is added to the project. You can begin assigning cluster resources to the namespace.
-
-### Moving Namespaces to Another Project
-
-Cluster admins and members may occasionally need to move a namespace to another project, such as when you want a different team to start using the application.
-
-1. From the **Global** view, open the cluster that contains the namespace you want to move.
-
-1. From the main menu, select **Projects/Namespaces**.
-
-1. Select the namespace(s) that you want to move to a different project. Then click **Move**. You can move multiple namespaces at one.
-
-    >**Notes:**
-    >
-    >- Don't move the namespaces in the `System` project. Moving these namespaces can adversely affect cluster networking.
-    >- You cannot move a namespace into a project that already has a [resource quota]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/) configured.
-    >- If you move a namespace from a project that has a quota set to a project with no quota set, the quota is removed from the namespace.
-
-1. Choose a new project for the new namespace and then click **Move**. Alternatively, you can remove the namespace from all projects by selecting **None**.
-
-**Result:** Your namespace is moved to a different project (or is unattached from all projects). If any project resources are attached to the namespace, the namespace releases them and then attached resources from the new project.
-
-### Editing Namespace Resource Quotas
-
-You can always override the namespace default limit to provide a specific namespace with access to more (or less) project resources.
-
-For more information, see how to [edit namespace resource quotas]({{<baseurl>}}/rancher/v2.x/en/project-admin//resource-quotas/override-namespace-default/#editing-namespace-resource-quotas).
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
deleted file mode 100644
index 4f1497b3a1b..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Project Applications
-weight: 2525
----
-
-> This section is under construction.
-
-Rancher contains a variety of tools that aren't included in Kubernetes to assist in your DevOps operations. Rancher can integrate with external services to help your clusters run more efficiently. Tools are divided into following categories:
-<!-- TOC -->
-
-- [Notifiers and Alerts](#notifiers-and-alerts)
-- [Logging](#logging)
-- [Monitoring](#monitoring)
-
-<!-- /TOC -->
-
-## Notifiers and Alerts
-
-Notifiers and alerts are two features that work together to inform you of events in the Rancher system.
-
-[Notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action. Notifications can be sent with Slack, email, PagerDuty, WeChat, and webhooks.
-
-[Alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts) are rules that trigger those notifications. Before you can receive alerts, you must configure one or more notifier in Rancher. The scope for alerts can be set at either the cluster or project level.
-
-## Logging
-
-Logging is helpful because it allows you to:
-
-- Capture and analyze the state of your cluster
-- Look for trends in your environment
-- Save your logs to a safe location outside of your cluster
-- Stay informed of events like a container crashing, a pod eviction, or a node dying
-- More easily debugg and troubleshoot problems
-
-Rancher can integrate with Elasticsearch, splunk, kafka, syslog, and fluentd.
-
-For details, refer to the [logging section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging)
-
-## Monitoring
-
-Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution. For details, refer to the [monitoring section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring)
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
deleted file mode 100644
index 0baf954ee0a..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/alerts/_index.md
+++ /dev/null
@@ -1,184 +0,0 @@
----
-title:  Project Alerts
-weight: 2
----
-
-To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. When an event occurs, your alert is triggered, and you are sent a notification. You can then, if necessary, follow up with corrective actions.
-
-Notifiers and alerts are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher can notify [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) and [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) of events they need to address.
-
-Before you can receive alerts, one or more [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) must be configured at the cluster level.
-
-Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can manage project alerts.
-
-This section covers the following topics:
-
-- [Alerts scope](#alerts-scope)
-- [Default project-level alerts](#default-project-level-alerts)
-- [Adding project alerts](#adding-project-alerts)
-- [Managing project alerts](#managing-project-alerts)
-
-## Alerts Scope
-
-The scope for alerts can be set at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) or project level.
-
-At the project level, Rancher monitors specific deployments and sends alerts for:
-
-* Deployment availability
-* Workloads status
-* Pod status
-* The Prometheus expression cross the thresholds
-
-## Default Project-level Alerts
-
-When you enable monitoring for the project, some project-level alerts are provided. You can receive these alerts if a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them is configured at the cluster level.
-
-| Alert | Explanation |
-|-------|-------------|
-| Less than half workload available | A critical alert is triggered if less than half of a workload is available, based on workloads where the key is `app` and the value is `workload`. |
-| Memory usage close to the quota | A warning alert is triggered if the workload's memory usage exceeds the memory resource quota that is set for the workload. You can see the memory limit in the Rancher UI if you go to the workload under the **Security & Host Config** tab. |
-
-For information on other default alerts, refer to the section on [cluster-level alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts)
-
-## Adding Project Alerts
-
->**Prerequisite:** Before you can receive project alerts, you must add a notifier.
-
-1. From the **Global** view, navigate to the project that you want to configure project alerts for. Select **Tools > Alerts**. In versions prior to v2.2.0, you can choose **Resources > Alerts**.
-
-1. Click **Add Alert Group**.
-
-1. Enter a **Name** for the alert that describes its purpose, you could group alert rules for the different purpose.
-
-1. Based on the type of alert you want to create, complete one of the instruction subsets below.
-
-{{% accordion id="pod" label="Pod Alerts" %}}
-This alert type monitors for the status of a specific pod.
-
-1. Select the **Pod** option, and then select a pod from the drop-down.
-1. Select a pod status that triggers an alert:
-
-    - **Not Running**
-    - **Not Scheduled**
-    - **Restarted `<x>` times with the last `<x>` Minutes**
-
-1. Select the urgency level of the alert. The options are:
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-
-    Select the urgency level of the alert based on pod state. For example, select **Info** for Job pod which stop running after job finished. However, if an important pod isn't scheduled, it may affect operations, so choose **Critical**.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-{{% accordion id="workload" label="Workload Alerts" %}}
-This alert type monitors for the availability of a workload.
-
-1. Choose the **Workload** option. Then choose a workload from the drop-down.
-
-1. Choose an availability percentage using the slider. The alert is triggered when the workload's availability on your cluster nodes drops below the set percentage.
-
-1. Select the urgency level of the alert.
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-
-    Select the urgency level of the alert based on the percentage you choose and the importance of the workload.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-{{% accordion id="workload-selector" label="Workload Selector Alerts" %}}
-This alert type monitors for the availability of all workloads marked with tags that you've specified.
-
-1. Select the **Workload Selector** option, and then click **Add Selector** to enter the key value pair for a label. If one of the workloads drops below your specifications, an alert is triggered. This label should be applied to one or more of your workloads.
-
-1. Select the urgency level of the alert.
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-
-    Select the urgency level of the alert based on the percentage you choose and the importance of the workload.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-{{% accordion id="project-expression" label="Metric Expression Alerts" %}}
-<br>
-
-If you enable [project monitoring]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/#monitoring), this alert type monitors for the overload from Prometheus expression querying.
-
-1. Input or select an **Expression**, the drop down shows the original metrics from Prometheus, including:
-
-  - [**Container**](https://github.com/google/cadvisor)
-  - [**Kubernetes Resources**](https://github.com/kubernetes/kube-state-metrics)
-  - [**Customize**]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#project-metrics)
-  - [**Project Level Grafana**](http://docs.grafana.org/administration/metrics/)
-  - **Project Level Prometheus**
-
-1. Choose a comparison.
-
-  - **Equal**: Trigger alert when expression value equal to the threshold.
-  - **Not Equal**: Trigger alert when expression value not equal to the threshold.
-  - **Greater Than**: Trigger alert when expression value greater than to threshold.
-  - **Less Than**: Trigger alert when expression value equal or less than the threshold.
-  - **Greater or Equal**: Trigger alert when expression value greater to equal to the threshold.
-  - **Less or Equal**: Trigger alert when expression value less or equal to the threshold.
-
-1. Input a **Threshold**, for trigger alert when the value of expression cross the threshold.
-
-1. Choose a **Comparison**.
-
-1. Select a **Duration**, for trigger alert when expression value crosses the threshold longer than the configured duration.
-
-1. Select the urgency level of the alert.
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-    <br/>
-    <br/>
-    Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a expression for container memory close to the limit raises above 60% deems an urgency of **Info**, but raised about 95% deems an urgency of **Critical**.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-<br>
-{{% /accordion %}}
-
-1. Continue adding more **Alert Rule** to the group.
-
-1. Finally, choose the [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) that send you alerts.
-
-    - You can set up multiple notifiers.
-    - You can change notifier recipients on the fly.
-
-**Result:** Your alert is configured. A notification is sent when the alert is triggered.
-
-## Managing Project Alerts
-
-To manage project alerts, browse to the project that alerts you want to manage. Then select **Tools > Alerts**. In versions prior to v2.2.0, you can choose **Resources > Alerts**. You can:
-
-- Deactivate/Reactive alerts
-- Edit alert settings
-- Delete unnecessary alerts
-- Mute firing alerts
-- Unmute muted alerts
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
deleted file mode 100644
index b64b9a7ae1d..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/istio/_index.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: Istio in Projects
-weight: 1
----
-
-Using Rancher, you can connect, secure, control, and observe services through integration with [Istio](https://istio.io/), a leading open-source service mesh solution. Istio provides behavioral insights and operational control over the service mesh as a whole, offering a complete solution to satisfy the diverse requirements of microservice applications.
-
-This service mesh provides features that include but are not limited to the following:
-
-- Traffic management features
-- Enhanced monitoring and tracing
-- Service discovery and routing
-- Secure connections and service-to-service authentication with mutual TLS
-- Load balancing
-- Automatic retries, backoff, and circuit breaking
-
-Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project for [comprehensive data visualizations,]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/#accessing-visualizations) traffic management, or any of its other features.
-
-For information on how Istio is integrated with Rancher and how to set it up, refer to the [section about Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md
deleted file mode 100644
index 9488490ab40..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/logging/_index.md
+++ /dev/null
@@ -1,108 +0,0 @@
----
-title: Project Logging
-weight: 3
----
-
-Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters.
-
-For background information about how logging integrations work, refer to the [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/#how-logging-integrations-work)
-
-Rancher supports the following services:
-
-- Elasticsearch
-- Splunk
-- Kafka
-- Syslog
-- Fluentd
-
->**Note:** You can only configure one logging service per cluster or per project.
-
-Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure Rancher to send Kubernetes logs to a logging service.
-
-## Requirements
-
-The Docker daemon on each node in the cluster should be [configured](https://docs.docker.com/config/containers/logging/configure/) with the (default) log-driver: `json-file`. You can check the log-driver by running the following command:
-
-```
-$ docker info | grep 'Logging Driver'
-Logging Driver: json-file
-```
-
-## Advantages
-
-Setting up a logging service to collect logs from your cluster/project has several advantages:
-
-- Logs errors and warnings in your Kubernetes infrastructure to a stream. The stream informs you of events like a container crashing, a pod eviction, or a node dying.
-- Allows you to capture and analyze the state of your cluster and look for trends in your environment using the log stream.
-- Helps you when troubleshooting or debugging.
-- Saves your logs to a safe location outside of your cluster, so that you can still access them even if your cluster encounters issues.
-
-## Logging Scope
-
-You can configure logging at either cluster level or project level.
-
-- [Cluster logging]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) writes logs for every pod in the cluster, i.e. in all the projects. For [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), it also writes logs for all the Kubernetes system components.
-
-- Project logging writes logs for every pod in that particular project.
-
-Logs that are sent to your logging service are from the following locations:
-
-  - Pod logs stored at `/var/log/containers`.
-
-  - Kubernetes system components logs stored at `/var/lib/rancher/rke/logs/`.
-
-## Enabling Project Logging
-
-1. From the **Global** view, navigate to the project that you want to configure project logging.
-
-1. Select **Tools > Logging** in the navigation bar. In versions prior to v2.2.0, you can choose **Resources > Logging**.
-
-1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports the following services:
-
-   - [Elasticsearch]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/)
-   - [Splunk]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/splunk/)
-   - [Kafka]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/kafka/)
-   - [Syslog]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/syslog/)
-   - [Fluentd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/)
-
-1. (Optional) Instead of using the UI to configure the logging services, you can enter custom advanced configurations by clicking on **Edit as File**, which is located above the logging targets. This link is only visible after you select a logging service.
-
-    - With the file editor, enter raw fluentd configuration for any logging service. Refer to the documentation for each logging service on how to setup the output configuration.
-
-       - [Elasticsearch Documentation](https://github.com/uken/fluent-plugin-elasticsearch)
-       - [Splunk Documentation](https://github.com/fluent/fluent-plugin-splunk)
-       - [Kafka Documentation](https://github.com/fluent/fluent-plugin-kafka)
-       - [Syslog Documentation](https://github.com/dlackty/fluent-plugin-remote_syslog)
-       - [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/out_forward)
-
-   - If the logging service is using TLS, you also need to complete the **SSL Configuration** form.
-       1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
-
-           - You can use either a self-signed certificate or one provided by a certificate authority.
-
-           - You can generate a self-signed certificate using an openssl command. For example:
-
-                ```
-                openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-                ```
-       2. If you are using a self-signed certificate, provide the **CA Certificate PEM**.  
-
-1. (Optional) Complete the **Additional Logging Configuration** form.
-
-    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
-
-    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes data to the logging server. Intervals are measured in seconds.
-
-    1. **Include System Log**. The logs from pods in system project and RKE components will be sent to the target. Uncheck it to exclude the system logs.
-
-1. Click **Test**. Rancher sends a test log to the service.
-
-    > **Note:** This button is replaced with _Dry Run_ if you are using the custom configuration editor. In this case, Rancher calls the fluentd dry run command to validate the configuration.
-
-1. Click **Save**.
-
-**Result:** Rancher is now configured to send logs to the selected service. Log into the logging service so that you can start viewing the logs.
-
-## Related Links
-
-[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md
deleted file mode 100644
index d87d48f296c..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/project-features/monitoring/_index.md
+++ /dev/null
@@ -1,81 +0,0 @@
----
-title: Project Monitoring
-weight: 4
----
-
-Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
-
-> For more information about how Prometheus works, refer to the [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#about-prometheus)
-
-This section covers the following topics:
-
-- [Monitoring scope](#monitoring-scope)
-- [Permissions to configure project monitoring](#permissions-to-configure-project-monitoring)
-- [Enabling project monitoring](#enabling-project-monitoring)
-- [Project-level monitoring resource requirements](#project-level-monitoring-resource-requirements)
-- [Project metrics](#project-metrics)
-
-### Monitoring Scope
-
-Using Prometheus, you can monitor Rancher at both the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and project level. For each cluster and project that is enabled for monitoring, Rancher deploys a Prometheus server.
-
-- [Cluster monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) allows you to view the health of your Kubernetes cluster. Prometheus collects metrics from the cluster components below, which you can view in graphs and charts.
-
-    - [Kubernetes control plane]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#kubernetes-components-metrics)
-    - [etcd database]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#etcd-metrics)
-    - [All nodes (including workers)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#cluster-metrics)
-
-- Project monitoring allows you to view the state of pods running in a given project. Prometheus collects metrics from the project's deployed HTTP and TCP/UDP workloads.
-
-### Permissions to Configure Project Monitoring
-
-Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure project level monitoring. Project members can only view monitoring metrics.
-
-### Enabling Project Monitoring
-
-> **Prerequisite:** Cluster monitoring must be [enabled.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/)
-
-1. Go to the project where monitoring should be enabled. Note: When cluster monitoring is enabled, monitoring is also enabled by default in the **System** project.
-
-1. Select **Tools > Monitoring** in the navigation bar.
-
-1. Select **Enable** to show the [Prometheus configuration options]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/). Enter in your desired configuration options.
-
-1. Click **Save**.
-
-### Project-Level Monitoring Resource Requirements
-
-Container| CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable
----------|---------------|---------------|-------------|-------------|-------------
-Prometheus|750m| 750Mi | 1000m | 1000Mi | Yes
-Grafana | 100m | 100Mi | 200m | 200Mi | No
-
-
-**Result:** A single application,`project-monitoring`, is added as an [application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) to the project. After the application is `active`, you can start viewing [project metrics](#project-metrics) through the [Rancher dashboard]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#rancher-dashboard) or directly from [Grafana]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#grafana).
-
-> The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
-
-### Project Metrics
-
-[Workload metrics]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/#workload-metrics) are available for the project if monitoring is enabled at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and at the [project level.](#enabling-project-monitoring)
-
-You can monitor custom metrics from any [exporters.](https://prometheus.io/docs/instrumenting/exporters/) You can also expose some custom endpoints on deployments without needing to configure Prometheus for your project.
-
-> **Example:**
-> A [Redis](https://redis.io/) application is deployed in the namespace `redis-app` in the project `Datacenter`. It is monitored via [Redis exporter](https://github.com/oliver006/redis_exporter). After enabling project monitoring, you can edit the application to configure the <b>Advanced Options -> Custom Metrics</b> section. Enter the `Container Port` and `Path` and select the `Protocol`.
-
-To access a project-level Grafana instance,
-
-1. From the **Global** view, navigate to a cluster that has monitoring enabled.
-
-1. Go to a project that has monitoring enabled.
-
-1. From the project view, click **Apps.** In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar.
-
-1. Go to the `project-monitoring` application.
-
-1. In the `project-monitoring` application, there are two `/index.html` links: one that leads to a Grafana instance and one that leads to a Prometheus instance. When you click the Grafana link, it will redirect you to a new webpage for Grafana, which shows metrics for the cluster.
-
-1. You will be signed in to the Grafana instance automatically. The default username is `admin` and the default password is `admin`. For security, we recommend that you log out of Grafana, log back in with the `admin` password, and change your password.
-
-**Results:** You will be logged into Grafana from the Grafana instance. After logging in, you can view the preset Grafana dashboards, which are imported via the [Grafana provisioning mechanism](http://docs.grafana.org/administration/provisioning/#dashboards), so you cannot modify them directly. For now, if you want to configure your own dashboards, clone the original and modify the new copy.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
deleted file mode 100644
index 0001609eeb5..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/_index.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: Project Resource Quotas
-weight: 3
----
-
-In situations where several teams share a cluster, one team may overconsume the resources available: CPU, memory, storage, services, Kubernetes objects like pods or secrets, and so on.  To prevent this overconsumption, you can apply a _resource quota_, which is a Rancher feature that limits the resources available to a project or namespace.
-
-This page is a how-to guide for creating resource quotas in existing projects.
-
-Resource quotas can also be set when a new project is created. For details, refer to the section on [creating new projects.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/#creating-projects)
-
-> Resource quotas in Rancher include the same functionality as the [native version of Kubernetes](https://kubernetes.io/docs/concepts/policy/resource-quotas/). However, in Rancher, resource quotas have been extended so that you can apply them to [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#projects). For details on how resource quotas work with projects in Rancher, refer to [this page.](./quotas-for-projects)
-
-### Applying Resource Quotas to Existing Projects
-
-Edit [resource quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) when:
-
-- You want to limit the resources that a project and its namespaces can use.
-- You want to scale the resources available to a project up or down when a research quota is already in effect.
-
-1. From the **Global** view, open the cluster containing the project to which you want to apply a resource quota.
-
-1. From the main menu, select **Projects/Namespaces**.
-
-1. Find the project that you want to add a resource quota to. From that project, select **&#8942; > Edit**.
-
-1. Expand **Resource Quotas** and click **Add Quota**. Alternatively, you can edit existing quotas.
-
-1. Select a [Resource Type]({{<baseurl>}}/rancher/v2.x/en/project-admin/resource-quotas/#resource-quota-types).
-
-1. Enter values for the **Project Limit** and the **Namespace Default Limit**.
-
-    | Field                   | Description                                                                                              |
-    | ----------------------- | -------------------------------------------------------------------------------------------------------- |
-    | Project Limit           | The overall resource limit for the project.                                                              |
-    | Namespace Default Limit | The default resource limit available for each namespace. This limit is propagated to each namespace in the project. The combined limit of all project namespaces shouldn't exceed the project limit. |
-
-1. **Optional:** Add more quotas.
-
-1. Click **Create**.
-
-**Result:** The resource quota is applied to your project and namespaces. When you add more namespaces in the future, Rancher validates that the project can accommodate the namespace. If the project can't allocate the resources, Rancher won't let you save your changes.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
deleted file mode 100644
index dde40c80fab..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-container-default/_index.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: Setting Container Default Resource Limits
-weight: 3
----
-
-When setting resource quotas, if you set anything related to CPU or Memory (i.e. limits or reservations) on a project / namespace, all containers will require a respective CPU or Memory field set during creation. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/#requests-vs-limits) for more details on why this is required.
-
-To avoid setting these limits on each and every container during workload creation, a default container resource limit can be specified on the namespace.
-
-### Editing the Container Default Resource Limit
-
-Edit [container default resource limit]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/#setting-container-default-resource-limit) when:
-
-- You have a CPU or Memory resource quota set on a project, and want to supply the corresponding default values for a container.
-- You want to edit the default container resource limit.
-
-1. From the **Global** view, open the cluster containing the project to which you want to edit the container default resource limit.
-1. From the main menu, select **Projects/Namespaces**.
-1. Find the project that you want to edit the container default resource limit. From that project, select **&#8942; > Edit**.
-1. Expand **Container Default Resource Limit** and edit the values.
-
-### Resource Limit Propagation
-
-When the default container resource limit is set at a project level, the parameter will be propagated to any namespace created in the project after the limit has been set. For any existing namespace in a project, this limit will not be automatically propagated. You will need to manually set the default container resource limit for any existing namespaces in the project in order for it to be used when creating any containers.
-
-> **Note:** Prior to v2.2.0, you could not launch catalog applications that did not have any limits set. With v2.2.0, you can set a default container resource limit on a project and launch any catalog applications.  
-
-Once a container default resource limit is configured on a namespace, the default will be pre-populated for any containers created in that namespace. These limits/reservations can always be overridden during workload creation.
-
-### Container Resource Quota Types
-
-The following resource limits can be configured:
-
-| Resource Type            | Description                                                                                                                                                                                       |
-| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| CPU Limit                | The maximum amount of CPU (in [millicores](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu)) allocated to the container.|
-| CPU Reservation          | The minimum amount of CPU (in millicores) guaranteed to the container.                                                                                                       |
-| Memory Limit             | The maximum amount of memory (in bytes) allocated to the container.                                                                                                          |
-| Memory Reservation       | The minimum amount of memory (in bytes) guaranteed to the container.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md
deleted file mode 100644
index f09feb9e83c..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/override-namespace-default/_index.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: Overriding the Default Limit for a Namespace
-weight: 2
----
-
-Although the **Namespace Default Limit** propagates from the project to each namespace when created, in some cases, you may need to increase (or decrease) the quotas for a specific namespace. In this situation, you can override the default limits by editing the namespace.
-
-In the diagram below, the Rancher administrator has a resource quota in effect for their project. However, the administrator wants to override the namespace limits for `Namespace 3` so that it has more resources available. Therefore, the administrator [raises the namespace limits]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#editing-namespace-resource-quotas) for `Namespace 3` so that the namespace can access more resources.
-
-<sup>Namespace Default Limit Override</sup>
-![Namespace Default Limit Override]({{<baseurl>}}/img/rancher/rancher-resource-quota-override.svg)
-
-How to: [Editing Namespace Resource Quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#editing-namespace-resource-quotas)
-
-### Editing Namespace Resource Quotas
-
-If there is a [resource quota]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) configured for a project, you can override the namespace default limit to provide a specific namespace with access to more (or less) project resources.
-
-1. From the **Global** view, open the cluster that contains the namespace for which you want to edit the resource quota.
-
-1. From the main menu, select **Projects/Namespaces**.
-
-1. Find the namespace for which you want to edit the resource quota. Select **&#8942; > Edit**.
-
-1. Edit the Resource Quota **Limits**.  These limits determine the resources available to the namespace. The limits must be set within the configured project limits.
-
-    For more information about each **Resource Type**, see [Resource Quota Types]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/#resource-quota-types).
-
-    >**Note:**
-    >
-    >- If a resource quota is not configured for the project, these options will not be available.
-    >- If you enter limits that exceed the configured project limits, Rancher will not let you save your edits.
-
-**Result:** Your override is applied to the namespace's resource quota.
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md
deleted file mode 100644
index e671a9afdb1..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quota-type-reference/_index.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-title: Resource Quota Type Reference
-weight: 4
----
-
-When you create a resource quota, you are configuring the pool of resources available to the project. You can set the following resource limits for the following resource types.
-
-| Resource Type            | Description                                                                                                                                                                                       |
-| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| CPU Limit*                | The maximum amount of CPU (in [millicores](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu)) allocated to the project/namespace.<sup>1</sup> |
-| CPU Reservation*         | The minimum amount of CPU (in millicores) guaranteed to the project/namespace.<sup>1</sup>                                                                                                        |
-| Memory Limit*           | The maximum amount of memory (in bytes) allocated to the project/namespace.<sup>1</sup>                                                                                                           |
-| Memory Reservation*       | The minimum amount of memory (in bytes) guaranteed to the project/namespace.<sup>1</sup>                                                                                                          |
-| Storage Reservation      | The minimum amount of storage (in gigabytes) guaranteed to the project/namespace.                                                                                                                 |
-| Services Load Balancers  | The maximum number of load balancers services that can exist in the project/namespace.                                                                                                            |
-| Services Node Ports      | The maximum number of node port services that can exist in the project/namespace.                                                                                                                 |
-| Pods                     | The maximum number of pods that can exist in the project/namespace in a non-terminal state (i.e., pods with a state of `.status.phase in (Failed, Succeeded)` equal to true).                     |
-| Services                 | The maximum number of services that can exist in the project/namespace.                                                                                                                           |
-| ConfigMaps               | The maximum number of ConfigMaps that can exist in the project/namespace.                                                                                                                         |
-| Persistent Volume Claims | The maximum number of persistent volume claims that can exist in the project/namespace.                                                                                                           |
-| Replications Controllers | The maximum number of replication controllers that can exist in the project/namespace.                                                                                                            |
-| Secrets                  | The maximum number of secrets that can exist in the project/namespace.                                                                                                                            |
-
->**<sup>*</sup>** When setting resource quotas, if you set anything related to CPU or Memory (i.e. limits or reservations) on a project / namespace, all containers will require a respective CPU or Memory field set during creation. As of v2.2.0, a [container default resource limit](#setting-container-default-resource-limit) can be set at the same time to avoid the need to explicitly set these limits for every workload. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/#requests-vs-limits) for more details on why this is required.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md b/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md
deleted file mode 100644
index 60f8c59d91a..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/project-admin/resource-quotas/quotas-for-projects/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: How Resource Quotas Work in Rancher Projects
-weight: 1
----
-
-Resource quotas in Rancher include the same functionality as the [native version of Kubernetes](https://kubernetes.io/docs/concepts/policy/resource-quotas/). However, in Rancher, resource quotas have been extended so that you can apply them to [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#projects).
-
-In a standard Kubernetes deployment, resource quotas are applied to individual namespaces. However, you cannot apply the quota to your namespaces simultaneously with a single action. Instead, the resource quota must be applied multiple times.
-
-In the following diagram, a Kubernetes administrator is trying to enforce a resource quota without Rancher. The administrator wants to apply a resource quota that sets the same CPU and memory limit to every namespace in his cluster (`Namespace 1-4`) . However, in the base version of Kubernetes, each namespace requires a unique resource quota. The administrator has to create four different resource quotas that have the same specs configured (`Resource Quota 1-4`) and apply them individually.
-
-<sup>Base Kubernetes: Unique Resource Quotas Being Applied to Each Namespace</sup>
-![Native Kubernetes Resource Quota Implementation]({{<baseurl>}}/img/rancher/kubernetes-resource-quota.svg)
-
-Resource quotas are a little different in Rancher. In Rancher, you apply a resource quota to the [project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#projects), and then the quota propagates to each namespace, whereafter Kubernetes enforces your limits using the native version of resource quotas. If you want to change the quota for a specific namespace, you can [override it](#overriding-the-default-limit-for-a-namespace).
-
-The resource quota includes two limits, which you set while creating or editing a project:
-<a id="project-limits"></a>
-
-- **Project Limits:**
-
-    This set of values configures an overall resource limit for the project. If you try to add a new namespace to the project, Rancher uses the limits you've set to validate that the project has enough resources to accommodate the namespace.  In other words, if you try to move a namespace into a project near its resource quota, Rancher blocks you from moving the namespace.
-
-- **Namespace Default Limits:**
-
-    This value is the default resource limit available for each namespace. When the resource quota is created at the project level, this limit is automatically propagated to each namespace in the project. Each namespace is bound to this default limit unless you [override it](#namespace-default-limit-overrides).
-    
-In the following diagram, a Rancher administrator wants to apply a resource quota that sets the same CPU and memory limit for every namespace in their project (`Namespace 1-4`). However, in Rancher, the administrator can set a resource quota for the project (`Project Resource Quota`) rather than individual namespaces. This quota includes resource limits for both the entire project (`Project Limit`) and individual namespaces (`Namespace Default Limit`). Rancher then propagates the `Namespace Default Limit` quotas to each namespace (`Namespace Resource Quota`) when created.
-
-<sup>Rancher: Resource Quotas Propagating to Each Namespace</sup>
-![Rancher Resource Quota Implementation]({{<baseurl>}}/img/rancher/rancher-resource-quota.svg)
-
-Let's highlight some more nuanced functionality. If a quota is deleted at the project level, it will also be removed from all namespaces contained within that project, despite any overrides that may exist. Further, updating an existing namespace default limit for a quota at the project level will not result in that value being propagated to existing namespaces in the project; the updated value will only be applied to newly created namespaces in that project. To update a namespace default limit for existing namespaces you can delete and subsequently recreate the quota at the project level with the new default value. This will result in the new default value being applied to all existing namespaces in the project.
-
-The following table explains the key differences between the two quota types.
-
-| Rancher Resource Quotas                                    | Kubernetes Resource Quotas                               |
-| ---------------------------------------------------------- | -------------------------------------------------------- |
-| Applies to projects and namespace.                         | Applies to namespaces only.                              |
-| Creates resource pool for all namespaces in project.       | Applies static resource limits to individual namespaces. |
-| Applies resource quotas to namespaces through propagation. | Applies only to the assigned namespace.
diff --git a/content/rancher/v2.5/en/cluster-explorer/registries/_index.md b/content/rancher/v2.5/en/cluster-explorer/registries/_index.md
deleted file mode 100644
index 16429e23910..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/registries/_index.md
+++ /dev/null
@@ -1,116 +0,0 @@
----
-title: Kubernetes Registry and Docker Registry
-description: Learn about the Docker registry and Kubernetes registry, their use cases and how to use a private registry with the Rancher UI
-weight: 6
----
-Registries are Kubernetes secrets containing credentials used to authenticate with [private Docker registries](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). 
-
-The word "registry" can mean two things, depending on whether it is used to refer to a Docker or Kubernetes registry:
-
-- A **Docker registry** contains Docker images that you can pull in order to use them in your deployment. The registry is a stateless, scalable server side application that stores and lets you distribute Docker images.
-- The **Kubernetes registry** is an image pull secret that your deployment uses to authenticate with a Docker registry.
-
-Deployments use the Kubernetes registry secret to authenticate with a private Docker registry and then pull a Docker image hosted on it.
-
-Currently, deployments pull the private registry credentials automatically only if the workload is created in the Rancher UI and not when it is created via kubectl.
-
-# Creating a Registry
-
->**Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/) available to use.
-
-1. From the **Global** view, select the project containing the namespace(s) where you want to add a registry.
-
-1. From the main menu, click **Resources > Secrets > Registry Credentials.** (For Rancher prior to v2.3, click **Resources > Registries.)**
-
-1. Click **Add Registry.**
-
-1. Enter a **Name** for the registry.
-
-    >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your registry must have a unique name among all secrets within your workspace.
-
-1. Select a **Scope** for the registry. You can either make the registry available for the entire project or a single [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces).
-
-1. Select the website that hosts your private registry. Then enter credentials that authenticate with the registry. For example, if you use DockerHub, provide your DockerHub username and password.
-
-1. Click **Save**.
-
-**Result:** 
-
-- Your secret is added to the project or namespace, depending on the scope you chose.
-- You can view the secret in the Rancher UI from the **Resources > Registries** view.
-- Any workload that you create in the Rancher UI will have the credentials to access the registry if the workload is within the registry's scope.
-
-# Using a Private Registry
-
-You can deploy a workload with an image from a private registry through the Rancher UI, or with `kubectl`.
-
-### Using the Private Registry with the Rancher UI
-
-To deploy a workload with an image from your private registry,
-
-1. Go to the project view,
-1. Click **Resources > Workloads.** In versions prior to v2.3.0, go to the **Workloads** tab.
-1. Click **Deploy.**
-1. Enter a unique name for the workload and choose a namespace.
-1. In the **Docker Image** field, enter the URL of the path to the Docker image in your private registry. For example, if your private registry is on Quay.io, you could use `quay.io/<Quay profile name>/<Image name>`.
-1. Click **Launch.**
-
-**Result:** Your deployment should launch, authenticate using the private registry credentials you added in the Rancher UI, and pull the Docker image that you specified.
-
-### Using the Private Registry with kubectl
-
-When you create the workload using `kubectl`, you need to configure the pod so that its YAML has the path to the image in the private registry. You also have to create and reference the registry secret because the pod only automatically gets access to the private registry credentials if it is created in the Rancher UI.
-
-The secret has to be created in the same namespace where the workload gets deployed.
-
-Below is an example `pod.yml` for a workload that uses an image from a private registry. In this example, the pod uses an image from Quay.io, and the .yml specifies the path to the image. The pod authenticates with the registry using credentials stored in a Kubernetes secret called `testquay`, which is specified in `spec.imagePullSecrets` in the `name` field:
-
-```
-apiVersion: v1
-kind: Pod
-metadata:
-  name: private-reg
-spec:
-  containers:
-  - name: private-reg-container
-    image: quay.io/<Quay profile name>/<image name>
-  imagePullSecrets:
-  - name: testquay
-```
-
-In this example, the secret named `testquay` is in the default namespace.
-
-You can use `kubectl` to create the secret with the private registry credentials. This command creates the secret named `testquay`:
-
-```
-kubectl create secret docker-registry testquay \
-    --docker-server=quay.io \
-    --docker-username=<Profile name> \
-    --docker-password=<password>
-```
-
-To see how the secret is stored in Kubernetes, you can use this command:
-
-```
-kubectl get secret testquay --output="jsonpath={.data.\.dockerconfigjson}" | base64 --decode
-```
-
-The result looks like this:
-
-```
-{"auths":{"quay.io":{"username":"<Profile name>","password":"<password>","auth":"c291bXlhbGo6dGVzdGFiYzEyMw=="}}}
-```
-
-After the workload is deployed, you can check if the image was pulled successfully:
-
-```
-kubectl get events
-```
-The result should look like this:
-```
-14s         Normal    Scheduled          Pod    Successfully assigned default/private-reg2 to minikube
-11s         Normal    Pulling            Pod    pulling image "quay.io/<Profile name>/<image name>"
-10s         Normal    Pulled             Pod    Successfully pulled image "quay.io/<Profile name>/<image name>"
-```
-
-For more information, refer to the Kubernetes documentation on [creating a pod that uses your secret.](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-pod-that-uses-your-secret)
diff --git a/content/rancher/v2.5/en/cluster-explorer/secrets/_index.md b/content/rancher/v2.5/en/cluster-explorer/secrets/_index.md
deleted file mode 100644
index 30ea15c7c49..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/secrets/_index.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: Secrets
-weight: 4
----
-
-[Secrets](https://kubernetes.io/docs/concepts/configuration/secret/#overview-of-secrets) store sensitive data like passwords, tokens, or keys. They may contain one or more key value pairs.
-
-> This page is about secrets in general. For details on setting up a private registry, refer to the section on [registries.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries)
-
-When configuring a workload, you'll be able to choose which secrets to include. Like config maps, secrets can be referenced by workloads as either an environment variable or a volume mount.
-
-Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)
-
-# Creating Secrets
-
-When creating a secret, you can make it available for any deployment within a project, or you can limit it to a single namespace.
-
-1. From the **Global** view, select the project containing the namespace(s) where you want to add a secret.
-
-2. From the main menu, select **Resources > Secrets**. Click **Add Secret**.
-
-3. Enter a **Name** for the secret.
-
-    >**Note:** Kubernetes classifies secrets, certificates, and registries all as [secrets](https://kubernetes.io/docs/concepts/configuration/secret/), and no two secrets in a project or namespace can have duplicate names. Therefore, to prevent conflicts, your secret must have a unique name among all secrets within your workspace.
-
-4. Select a **Scope** for the secret. You can either make the registry available for the entire project or a single [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces).
-
-5. From **Secret Values**, click **Add Secret Value** to add a key value pair. Add as many values as you need.
-
-    >**Tip:** You can add multiple key value pairs to the secret by copying and pasting.
-    >
-    > {{< img "/img/rancher/bulk-key-values.gif" "Bulk Key Value Pair Copy/Paste">}}
-
-1. Click **Save**.
-
-**Result:** Your secret is added to the project or namespace, depending on the scope you chose. You can view the secret in the Rancher UI from the **Resources > Secrets** view.
-
-Mounted secrets will be updated automatically unless they are mounted as subpath volumes. For details on how updated secrets are propagated, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically)
-
-# What's Next?
-
-Now that you have a secret added to the project or namespace, you can add it to a workload that you deploy.
-
-For more information on adding secret to a workload, see [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md b/content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md
deleted file mode 100644
index 721ce42d9be..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/service-discovery/_index.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: Service Discovery
-weight: 2
----
-
-For every workload created, a complementing Service Discovery entry is created. This Service Discovery entry enables DNS resolution for the workload's pods using the following naming convention:
-`<workload>.<namespace>.svc.cluster.local`.
-
-However, you also have the option of creating additional Service Discovery records. You can use these additional records so that a given [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) resolves with one or more external IP addresses, an external hostname, an alias to another DNS record, other workloads, or a set of pods that match a selector that you create.
-
-1. From the **Global** view, open the project that you want to add a DNS record to.
-
-1. Click **Resources** in the main navigation bar. Click the **Service Discovery** tab. (In versions prior to v2.3.0, just click the **Service Discovery** tab.) Then click **Add Record**.
-
-1. Enter a **Name** for the DNS record. This name is used for DNS resolution.
-
-1. Select a **Namespace** from the drop-down list. Alternatively, you can create a new namespace on the fly by clicking **Add to a new namespace**.
-
-1. Select one of the **Resolves To** options to route requests to the DNS record.
-
-    1. **One or more external IP addresses**
-
-        Enter an IP address in the **Target IP Addresses** field. Add more IP addresses by clicking **Add Target IP**.
-
-    1. **An external hostname**
-
-        Enter a **Target Hostname**.
-
-    1. **Alias of another DNS record's value**
-
-        Click **Add Target Record** and select another DNS record from the **Value** drop-down.
-
-    1. **One or more workloads**
-
-        Click **Add Target Workload** and select another workload from the **Value** drop-down.
-
-    1. **The set of pods which match a selector**
-
-        Enter key value pairs of [label selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) to create a record for all pods that match your parameters.
-
-1. Click **Create**
-
-**Result:** A new DNS record is created.
-
-- You can view the record by from the project's **Service Discovery** tab.
-- When you visit the new DNS name for the new record that you created (`<recordname>.<namespace>.svc.cluster.local`), it resolves the chosen namespace.
-
-## Related Links
-
-- [Adding entries to Pod /etc/hosts with HostAliases](https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/_index.md
deleted file mode 100644
index 5df888b5f05..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/_index.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: "Storage"
-description: "Learn about the two ways with which you can create persistent storage in Kubernetes: persistent volumes and storage classes"
-weight: 17
----
-When deploying an application that needs to retain data, you'll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to maintain application data, even if the application's pod fails.
-
-The documents in this section assume that you understand the Kubernetes concepts of persistent volumes, persistent volume claims, and storage classes. For more information, refer to the section on [how storage works.](./how-storage-works)
-
-### Prerequisites
-
-To set up persistent storage, the `Manage Volumes` [role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference) is required.
-
-If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
-
-For provisioning new storage with Rancher, the cloud provider must be enabled. For details on enabling cloud providers, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/)
-
-For attaching existing persistent storage to a cluster, the cloud provider does not need to be enabled.
-
-### Setting up Existing Storage
-
-The overall workflow for setting up existing storage is as follows:
-
-1. Set up persistent storage in an infrastructure provider.
-2. Add a persistent volume (PV) that refers to the persistent storage.
-3. Add a persistent volume claim (PVC) that refers to the PV.
-4. Mount the PVC as a volume in your workload.
-
-For details and prerequisites, refer to [this page.](./attaching-existing-storage)
-
-### Dynamically Provisioning New Storage in Rancher
-
-The overall workflow for provisioning new storage is as follows:
-
-1. Add a storage class and configure it to use your storage provider.
-2. Add a persistent volume claim (PVC) that refers to the storage class.
-3. Mount the PVC as a volume for your workload.
-
-For details and prerequisites, refer to [this page.](./provisioning-new-storage)
-
-### Provisioning Storage Examples
-
-We provide examples of how to provision storage with [NFS,](./examples/nfs) [vSphere,](./examples/vsphere) and [Amazon's EBS.](./examples/ebs)
-
-### GlusterFS Volumes
-
-In clusters that store data on GlusterFS volumes, you may experience an issue where pods fail to mount volumes after restarting the `kubelet`. For details on preventing this from happening, refer to [this page.](./glusterfs-volumes)
-
-### iSCSI Volumes
-
-In [Rancher Launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) that store data on iSCSI volumes, you may experience an issue where kubelets fail to automatically connect with iSCSI volumes. For details on resolving this issue, refer to [this page.](./iscsi-volumes)
-
-### hostPath Volumes
-Before you create a hostPath volume, you need to set up an [extra_bind]({{<baseurl>}}/rke/latest/en/config-options/services/services-extras/#extra-binds/) in your cluster configuration. This will mount the path as a volume in your kubelets, which can then be used for hostPath volumes in your workloads.
-
-### Related Links
-
-- [Kubernetes Documentation: Storage](https://kubernetes.io/docs/concepts/storage/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md
deleted file mode 100644
index c020ad8712a..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/attaching-existing-storage/_index.md
+++ /dev/null
@@ -1,102 +0,0 @@
----
-title: Setting up Existing Storage
-weight: 3
----
-
-This section describes how to set up existing persistent storage for workloads in Rancher.
-
-> This section assumes that you understand the Kubernetes concepts of persistent volumes and persistent volume claims. For more information, refer to the section on [how storage works.](../how-storage-works)
-
-To set up storage, follow these steps:
-
-1. [Set up persistent storage in an infrastructure provider.](#1-set-up-persistent-storage-in-an-infrastructure-provider)
-2. [Add a persistent volume that refers to the persistent storage.](#2-add-a-persistent-volume-that-refers-to-the-persistent-storage)
-3. [Add a persistent volume claim that refers to the persistent volume.](#3-add-a-persistent-volume-claim-that-refers-to-the-persistent-volume)
-4. [Mount the persistent volume claim as a volume in your workload.](#4-mount-the-persistent-storage-claim-as-a-volume-in-your-workload)
-
-### Prerequisites
-
-- To create a persistent volume as a Kubernetes resource, you must have the `Manage Volumes` [role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference)
-- If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
-
-### 1. Set up persistent storage in an infrastructure provider
-
-Creating a persistent volume in Rancher will not create a storage volume. It only creates a Kubernetes resource that maps to an existing volume. Therefore, before you can create a persistent volume as a Kubernetes resource, you must have storage provisioned.
-
-The steps to set up a persistent storage device will differ based on your infrastructure. We provide examples of how to set up storage using [vSphere,](../examples/vsphere) [NFS,](../examples/nfs) or Amazon's [EBS.](../examples/ebs)
-
-### 2. Add a persistent volume that refers to the persistent storage
-
-These steps describe how to set up a persistent volume at the cluster level in Kubernetes.
-
-1. From the cluster view, select **Storage > Persistent Volumes**.
-
-1. Click **Add Volume**.
-
-1. Enter a **Name** for the persistent volume.
-
-1. Select the **Volume Plugin** for the disk type or service that you're using. When adding storage to a cluster that's hosted by a cloud provider, use the cloud provider's plug-in for cloud storage. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it, you must use the `Amazon EBS Disk` volume plugin.
-
-1. Enter the **Capacity** of your volume in gigabytes.
-
-1. Complete the **Plugin Configuration** form. Each plugin type requires information specific to the vendor of disk type. For help regarding each plugin's form and the information that's required, refer to the plug-in's vendor documentation.
-
-1. Optional: In the **Customize** form, configure the [access modes.](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) This options sets how many nodes can access the volume, along with the node read/write permissions. The [Kubernetes Documentation](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) includes a table that lists which access modes are supported by the plugins available.
-
-1. Optional: In the **Customize** form, configure the [mount options.](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#mount-options) Each volume plugin allows you to specify additional command line options during the mounting process. Consult each plugin's vendor documentation for the mount options available.
-
-1. Click **Save**.
-
-**Result:** Your new persistent volume is created.
-
-### 3. Add a persistent volume claim that refers to the persistent volume
-
-These steps describe how to set up a PVC in the namespace where your stateful workload will be deployed.
-
-1. Go to the project containing a workload that you want to add a persistent volume claim to.
-
-1. Then click the **Volumes** tab and click **Add Volume**. (In versions prior to v2.3.0, click **Workloads** on the main navigation bar, then **Volumes.**) 
-
-1. Enter a **Name** for the volume claim.
-
-1. Select the [Namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) of the workload that you want to add the persistent storage to.
-
-1. In the section called **Use an existing persistent volume,** go to the **Persistent Volume** drop-down and choose the persistent volume that you created.
-
-1. **Optional:** From **Customize**, select the [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) that you want to use.
-
-1. Click **Create.**
-
-**Result:** Your PVC is created. You can now attach it to any workload in the project.
-
-### 4. Mount the persistent volume claim as a volume in your workload
-
-Mount PVCs to stateful workloads so that your applications can store their data.
-
-You can mount PVCs during the deployment of a workload, or following workload creation.
-
-The following steps describe how to assign existing storage to a new workload that is a stateful set:
-
-1. From the **Project** view, go to the **Workloads** tab.
-1. Click **Deploy.**
-1. Enter a name for the workload.
-1. Next to the **Workload Type** field, click **More Options.**
-1. Click **Stateful set of 1 pod.** Optionally, configure the number of pods.
-1. Choose the namespace where the workload will be deployed.
-1. Expand the **Volumes** section and click **Add Volume > Use an existing persistent volume (claim).**.
-1. In the **Persistent Volume Claim** field, select the PVC that you created.
-1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
-1. Click **Launch.**
-
-**Result:** When the workload is deployed, it will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
-
-The following steps describe how to assign persistent storage to an existing workload:
-
-1. From the **Project** view, go to the **Workloads** tab.
-1. Go to the workload that you want to add the persistent storage to. The workload type should be a stateful set. Click **&#8942; > Edit.**
-1. Expand the **Volumes** section and click **Add Volume > Use an existing persistent volume (claim).**.
-1. In the **Persistent Volume Claim** field, select the PVC that you created.
-1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
-1. Click **Save.**
-
-**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md
deleted file mode 100644
index 28f5a3dcebd..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/examples/_index.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Provisioning Storage Examples
-weight: 4
----
-
-Rancher supports persistent storage with a variety of volume plugins. However, before you use any of these plugins to bind persistent storage to your workloads, you have to configure the storage itself, whether its a cloud-based solution from a service-provider or an on-prem solution that you manage yourself.
-
-For your convenience, Rancher offers documentation on how to configure some of the popular storage methods:
-
-- [NFS]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/examples/nfs/)
-- [vSphere]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/examples/vsphere/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md
deleted file mode 100644
index b854daf0ef4..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/examples/ebs/_index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: Creating Persistent Storage in Amazon's EBS
-weight: 3053
----
-
-This section describes how to set up Amazon's Elastic Block Store in EC2.
-
-1. From the EC2 console, go to the **ELASTIC BLOCK STORE** section in the left panel and click **Volumes.**
-1. Click **Create Volume.**
-1. Optional: Configure the size of the volume or other options. The volume should be created in the same availability zone as the instance it will be attached to.
-1. Click **Create Volume.**
-1. Click **Close.**
-
-**Result:** Persistent storage has been created.
-
-For details on how to set up the newly created storage in Rancher, refer to the section on [setting up existing storage.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
deleted file mode 100644
index df801948faa..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/examples/nfs/_index.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: NFS Storage
-weight: 3054
----
-
-Before you can use the NFS storage volume plug-in with Rancher deployments, you need to provision an NFS server.
-
->**Note:**
->
->- If you already have an NFS share, you don't need to provision a new NFS server to use the NFS volume plugin within Rancher. Instead, skip the rest of this procedure and complete [adding storage]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/).
->
->- This procedure demonstrates how to set up an NFS server using Ubuntu, although you should be able to use these instructions for other Linux distros (e.g. Debian, RHEL, Arch Linux, etc.). For official instruction on how to create an NFS server using another Linux distro, consult the distro's documentation.
-
->**Recommended:** To simplify the process of managing firewall rules, use NFSv4.
-
-1. Using a remote Terminal connection, log into the Ubuntu server that you intend to use for NFS storage.
-
-1. Enter the following command:
-
-    ```
-    sudo apt-get install nfs-kernel-server
-    ```
-
-1. Enter the command below, which sets the directory used for storage, along with user access rights. Modify the command if you'd like to keep storage at a different directory.
-
-    ```
-    mkdir -p /nfs && chown nobody:nogroup /nfs
-    ```
-    - The `-p /nfs` parameter creates a directory named `nfs` at root.
-    - The `chown nobody:nogroup /nfs` parameter allows all access to the storage directory.
-
-1. Create an NFS exports table. This table sets the directory paths on your NFS server that are exposed to the nodes that will use the server for storage.
-
-    1. Open `/etc/exports` using your text editor of choice.
-    1. Add the path of the `/nfs` folder that you created in step 3, along with the IP addresses of your cluster nodes. Add an entry for each IP address in your cluster. Follow each address and its accompanying parameters with a single space that is a delimiter.
-
-        ```
-        /nfs <IP_ADDRESS1>(rw,sync,no_subtree_check) <IP_ADDRESS2>(rw,sync,no_subtree_check) <IP_ADDRESS3>(rw,sync,no_subtree_check)
-        ```
-
-        **Tip:**  You can replace the IP addresses with a subnet. For example: `10.212.50.12&#47;24`
-
-    1. Update the NFS table by entering the following command:
-
-        ```
-        exportfs -ra
-        ```
-
-1. Open the ports used by NFS.
-
-    1. To find out what ports NFS is using, enter the following command:
-
-        ```
-        rpcinfo -p | grep nfs
-        ```
-    2. [Open the ports](https://help.ubuntu.com/lts/serverguide/firewall.html.en) that the previous command outputs. For example, the following command opens port 2049:
-
-        ```
-        sudo ufw allow 2049
-        ```
-
-**Result:** Your NFS server is configured to be used for storage with your Rancher nodes.
-
-## What's Next?
-
-Within Rancher, add the NFS server as a [storage volume]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/#adding-a-persistent-volume) and/or [storage class]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/#adding-storage-classes). After adding the server, you can use it for storage for your deployments.
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
deleted file mode 100644
index 8a1e5b2a524..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/examples/vsphere/_index.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: vSphere Storage
-weight: 3055
----
-
-To provide stateful workloads with vSphere storage, we recommend creating a vSphereVolume [storage class]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/#storage-classes). This practice dynamically provisions vSphere storage when workloads request volumes through a [persistent volume claim]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/persistent-volume-claims/).
-
-### Prerequisites
-
-In order to provision vSphere volumes in a cluster created with the [Rancher Kubernetes Engine (RKE)]({{< baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), the [vSphere cloud provider]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere) must be explicitly enabled in the [cluster options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/).
-
-### Creating A Storage Class
-
-> **Note:**
->
-> The following steps can also be performed using the `kubectl` command line tool. See [Kubernetes documentation on persistent volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) for details.
-
-1. From the Global view, open the cluster where you want to provide vSphere storage.
-2. From the main menu, select **Storage > Storage Classes**. Then click **Add Class**.
-3. Enter a **Name** for the class.
-4. Under **Provisioner**, select **VMWare vSphere Volume**.
-
-    {{< img "/img/rancher/vsphere-storage-class.png" "vsphere-storage-class">}}
-
-5. Optionally, specify additional properties for this storage class under **Parameters**. Refer to the [vSphere storage documentation](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/storageclass.html) for details.
-5. Click **Save**.
-
-### Creating a Workload with a vSphere Volume
-
-1. From the cluster where you configured vSphere storage, begin creating a workload as you would in [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
-2. For **Workload Type**, select **Stateful set of 1 pod**.
-3. Expand the **Volumes** section and click **Add Volume**.
-4. Choose **Add a new persistent volume (claim)**. This option will implicitly create the claim once you deploy the workload.
-5. Assign a **Name** for the claim, ie. `test-volume` and select the vSphere storage class created in the previous step.
-6. Enter the required **Capacity** for the volume. Then click **Define**.
-
-    {{< img "/img/rancher/workload-add-volume.png" "workload-add-volume">}}
-
-7. Assign a path in the **Mount Point** field. This is the full path where the volume will be mounted in the container file system, e.g. `/persistent`.
-8. Click **Launch** to create the workload.
-
-### Verifying Persistence of the Volume
-
-1. From the context menu of the workload you just created, click **Execute Shell**.
-2. Note the directory at root where the volume has been mounted to (in this case `/persistent`).
-3. Create a file in the volume by executing the command `touch /<volumeMountPoint>/data.txt`.
-4. **Close** the shell window.
-5. Click on the name of the workload to reveal detail information.
-6. Open the context menu next to the Pod in the *Running* state.
-7. Delete the Pod by selecting **Delete**.
-8. Observe that the pod is deleted. Then a new pod is scheduled to replace it so that the workload maintains its configured scale of a single stateful pod.
-9. Once the replacement pod is running, click **Execute Shell**.
-10. Inspect the contents of the directory where the volume is mounted by entering `ls -l /<volumeMountPoint>`. Note that the file you created earlier is still present.
-
-    ![workload-persistent-data]({{<baseurl>}}/img/rancher/workload-persistent-data.png)
-
-## Why to Use StatefulSets Instead of Deployments
-
-You should always use [StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) for workloads consuming vSphere storage, as this resource type is designed to address a VMDK block storage caveat.
-
-Since vSphere volumes are backed by VMDK block storage, they only support an [access mode](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims) of `ReadWriteOnce`. This setting restricts the volume so that it can only be mounted to a single pod at a time, unless all pods consuming that volume are co-located on the same node. This behavior makes a deployment resource unusable for scaling beyond a single replica if it consumes vSphere volumes.
-
-Even using a deployment resource with just a single replica may result in a deadlock situation while updating the deployment. If the updated pod is scheduled to a node different from where the existing pod lives, it will fail to start because the VMDK is still attached to the other node.
-
-## Related Links
-
-- [vSphere Storage for Kubernetes](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/)
-- [Kubernetes Persistent Volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md
deleted file mode 100644
index 99e06766cf8..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/glusterfs-volumes/_index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: GlusterFS Volumes
-weight: 5
----
-
-> This section only applies to [RKE clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/)
-
-In clusters that store data on GlusterFS volumes, you may experience an issue where pods fail to mount volumes after restarting the `kubelet`. The logging of the `kubelet` will show: `transport endpoint is not connected`. To prevent this from happening, you can configure your cluster to mount the `systemd-run` binary in the `kubelet` container. There are two requirements before you can change the cluster configuration:
-
-- The node needs to have the `systemd-run` binary installed (this can be checked by using the command `which systemd-run` on each cluster node)
-- The `systemd-run` binary needs to be compatible with Debian OS on which the hyperkube image is based (this can be checked using the following command on each cluster node, replacing the image tag with the Kubernetes version you want to use)
-
-```
-docker run -v /usr/bin/systemd-run:/usr/bin/systemd-run --entrypoint /usr/bin/systemd-run rancher/hyperkube:v1.16.2-rancher1 --version
-```
-
->**Note:**
->
->Before updating your Kubernetes YAML to mount the `systemd-run` binary, make sure the `systemd` package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
-
-```
-services:
-  kubelet:
-    extra_binds:
-      - "/usr/bin/systemd-run:/usr/bin/systemd-run"
-```
-
-After the cluster has finished provisioning, you can check the `kubelet` container logging to see if the functionality is activated by looking for the following logline:
-
-```
-Detected OS with systemd
-```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md
deleted file mode 100644
index 6e257fa85c3..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/how-storage-works/_index.md
+++ /dev/null
@@ -1,76 +0,0 @@
----
-title: How Persistent Storage Works
-weight: 1
----
-
-A persistent volume (PV) is a piece of storage in the Kubernetes cluster, while a persistent volume claim (PVC) is a request for storage.
-
-There are two ways to use persistent storage in Kubernetes:
-
-- Use an existing persistent volume
-- Dynamically provision new persistent volumes
-
-To use an existing PV, your application will need to use a PVC that is bound to a PV, and the PV should include the minimum resources that the PVC requires.
-
-For dynamic storage provisioning, your application will need to use a PVC that is bound to a storage class. The storage class contains the authorization to provision new persistent volumes.
-
-![Setting Up New and Existing Persistent Storage]({{<baseurl>}}/img/rancher/rancher-storage.svg)
-
-For more information, refer to the [official Kubernetes documentation on storage](https://kubernetes.io/docs/concepts/storage/volumes/)
-
-This section covers the following topics:
-
-- [About persistent volume claims](#about-persistent-volume-claims)
-  - [PVCs are required for both new and existing persistent storage](#pvcs-are-required-for-both-new-and-existing-persistent-storage)
-- [Setting up existing storage with a PVC and PV](#setting-up-existing-storage-with-a-pvc-and-pv)
- - [Binding PVs to PVCs](#binding-pvs-to-pvcs)
-- [Provisioning new storage with a PVC and storage class](#provisioning-new-storage-with-a-pvc-and-storage-class)
-
-# About Persistent Volume Claims
-
-Persistent volume claims (PVCs) are objects that request storage resources from your cluster. They're similar to a voucher that your deployment can redeem for storage access. A PVC is mounted into a workloads as a volume so that the workload can claim its specified share of the persistent storage.
-
-To access persistent storage, a pod must have a PVC mounted as a volume. This PVC lets your deployment application store its data in an external location, so that if a pod fails, it can be replaced with a new pod and continue accessing its data stored externally, as though an outage never occurred.
-
-Each Rancher project contains a list of PVCs that you've created, available from **Resources > Workloads > Volumes.** (In versions prior to v2.3.0, the PVCs are in the **Volumes** tab.) You can reuse these PVCs when creating deployments in the future.
-
-### PVCs are Required for Both New and Existing Persistent Storage
-
-A PVC is required for pods to use any persistent storage, regardless of whether the workload is intended to use storage that already exists, or the workload will need to dynamically provision new storage on demand.
-
-If you are setting up existing storage for a workload, the workload mounts a PVC, which refers to a PV, which corresponds to existing storage infrastructure.
-
-If a workload should request new storage, the workload mounts PVC, which refers to a storage class, which has the capability to create a new PV along with its underlying storage infrastructure.
-
-Rancher lets you create as many PVCs within a project as you'd like.
-
-You can mount PVCs to a deployment as you create it, or later, after the deployment is running.
-
-# Setting up Existing Storage with a PVC and PV
-
-Your pods can store data in [volumes,](https://kubernetes.io/docs/concepts/storage/volumes/) but if the pod fails, that data is lost. To solve this issue, Kubernetes offers persistent volumes (PVs), which are Kubernetes resources that correspond to external storage disks or file systems that your pods can access. If a pod crashes, its replacement pod can access the data in persistent storage without any data loss.
-
-PVs can represent a physical disk or file system that you host on premise, or a vendor-hosted storage resource, such as Amazon EBS or Azure Disk.
-
-Creating a persistent volume in Rancher will not create a storage volume. It only creates a Kubernetes resource that maps to an existing volume. Therefore, before you can create a persistent volume as a Kubernetes resource, you must have storage provisioned.
-
-> **Important:** PVs are created at the cluster level, which means that in a multi-tenant cluster, teams with access to separate namespaces could have access to the same PV.
-
-### Binding PVs to PVCs
-
-When pods are set up to use persistent storage, they mount a persistent volume claim (PVC) that is mounted the same way as any other Kubernetes volume. When each PVC is created, the Kubernetes master considers it to be a request for storage and binds it to a PV that matches the minimum resource requirements of the PVC. Not every PVC is guaranteed to be bound to a PV. According to the Kubernetes [documentation,](https://kubernetes.io/docs/concepts/storage/persistent-volumes/)
-
-> Claims will remain unbound indefinitely if a matching volume does not exist. Claims will be bound as matching volumes become available. For example, a cluster provisioned with many 50Gi PVs would not match a PVC requesting 100Gi. The PVC can be bound when a 100Gi PV is added to the cluster.
-
-In other words, you can create unlimited PVCs, but they will only be bound to PVs if the Kubernetes master can find a sufficient PVs that has at least the amount of disk space required by the PVC.
-
-To dynamically provision new storage, the PVC mounted in the pod would have to correspond to a storage class instead of a persistent volume.
-
-# Provisioning New Storage with a PVC and Storage Class
-
-Storage Classes allow you to create PVs dynamically without having to create persistent storage in an infrastructure provider first.
-
-For example, if a workload is bound to a PVC and the PVC refers to an Amazon EBS Storage Class, the storage class can dynamically create an EBS volume and a corresponding PV.
-
-The Kubernetes master will then bind the newly created PV to your workload's PVC, allowing your workload to use the persistent storage.
-
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md
deleted file mode 100644
index 993e54c5c4a..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/iscsi-volumes/_index.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title:  iSCSI Volumes
-weight: 6
----
-
-In [Rancher Launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) that store data on iSCSI volumes, you may experience an issue where kubelets fail to automatically connect with iSCSI volumes. This failure is likely due to an incompatibility issue involving the iSCSI initiator tool. You can resolve this issue by installing the iSCSI initiator tool on each of your cluster nodes.
-
-Rancher Launched Kubernetes clusters storing data on iSCSI volumes leverage the [iSCSI initiator tool](http://www.open-iscsi.com/), which is embedded in the kubelet's `rancher/hyperkube` Docker image. From each kubelet (i.e., the _initiator_), the tool discovers and launches sessions with an iSCSI volume (i.e., the _target_). However, in some instances, the versions of the iSCSI initiator tool installed on the initiator and the target may not match, resulting in a connection failure.
-
-If you encounter this issue, you can work around it by installing the initiator tool on each node in your cluster. You can install the iSCSI initiator tool by logging into your cluster nodes and entering one of the following commands:
-
-| Platform      | Package Name            | Install Command                        |
-| ------------- | ----------------------- | -------------------------------------- |
-| Ubuntu/Debian | `open-iscsi`            | `sudo apt install open-iscsi`          |
-| RHEL          | `iscsi-initiator-utils` | `yum install iscsi-initiator-utils -y` |
-
-
-After installing the initiator tool on your nodes, edit the YAML for your cluster, editing the kubelet configuration to mount the iSCSI binary and configuration, as shown in the sample below.
-
->**Note:**
->
->Before updating your Kubernetes YAML to mount the iSCSI binary and configuration, make sure either the `open-iscsi` (deb) or `iscsi-initiator-utils` (yum) package is installed on your cluster nodes. If this package isn't installed _before_ the bind mounts are created in your Kubernetes YAML, Docker will automatically create the directories and files on each node and will not allow the package install to succeed.
-
-```
-services:
-  kubelet:
-    extra_binds:
-      - "/etc/iscsi:/etc/iscsi"
-      - "/sbin/iscsiadm:/sbin/iscsiadm"
-```
diff --git a/content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md b/content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md
deleted file mode 100644
index 50f33cce160..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/storage/provisioning-new-storage/_index.md
+++ /dev/null
@@ -1,109 +0,0 @@
----
-title: Dynamically Provisioning New Storage in Rancher
-weight: 2
----
-
-This section describes how to provision new persistent storage for workloads in Rancher.
-
-> This section assumes that you understand the Kubernetes concepts of storage classes and persistent volume claims. For more information, refer to the section on [how storage works.](../how-storage-works)
-
-To provision new storage for your workloads, follow these steps:
-
-1. [Add a storage class and configure it to use your storage provider.](#1-add-a-storage-class-and-configure-it-to-use-your-storage-provider)
-2. [Add a persistent volume claim that refers to the storage class.](#2-add-a-persistent-volume-claim-that-refers-to-the-storage-class)
-3. [Mount the persistent volume claim as a volume for your workload.](#3-mount-the-persistent-volume-claim-as-a-volume-for-your-workload)
-
-### Prerequisites
-
-- To set up persistent storage, the `Manage Volumes` [role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference) is required.
-- If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
-- The cloud provider must be enabled. For details on enabling cloud providers, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/)
-- Make sure your storage provisioner is available to be enabled.
-
-The following storage provisioners are enabled by default:
-
-Name | Plugin
---------|----------
-Amazon EBS Disk | `aws-ebs`
-AzureFile | `azure-file`
-AzureDisk | `azure-disk`
-Google Persistent Disk | `gce-pd`
-Longhorn | `flex-volume-longhorn`
-VMware vSphere Volume |  `vsphere-volume`
-Local | `local`
-Network File System | `nfs`
-hostPath | `host-path`
-
-To use a storage provisioner that is not on the above list, you will need to use a [feature flag to enable unsupported storage drivers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers/)
-
-### 1. Add a storage class and configure it to use your storage provider
-
-These steps describe how to set up a storage class at the cluster level.
-
-1. Go to the cluster for which you want to dynamically provision persistent storage volumes.
-
-1. From the cluster view, select `Storage > Storage Classes`. Click `Add Class`.
-
-1. Enter a `Name` for your storage class.
-
-1. From the `Provisioner` drop-down, select the service that you want to use to dynamically provision storage volumes. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it, use the `Amazon EBS Disk` provisioner.
-
-1. From the `Parameters` section, fill out the information required for the service to dynamically provision storage volumes. Each provisioner requires different information to dynamically provision storage volumes. Consult the service's documentation for help on how to obtain this information.
-
-1. Click `Save`.
-
-**Result:** The storage class is available to be consumed by a PVC.
-
-For full information about the storage class parameters, refer to the official [Kubernetes documentation.](https://kubernetes.io/docs/concepts/storage/storage-classes/#parameters).
-
-### 2. Add a persistent volume claim that refers to the storage class
-
-These steps describe how to set up a PVC in the namespace where your stateful workload will be deployed.
-
-1. Go to the project containing a workload that you want to add a PVC to.
-
-1. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Then select the **Volumes** tab. Click **Add Volume**.
-
-1. Enter a **Name** for the volume claim.
-
-1. Select the [Namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces) of the volume claim.
-
-1. In the **Source** field, click **Use a Storage Class to provision a new persistent volume.**
-
-1. Go to the **Storage Class** drop-down and select the storage class that you created.
-
-1. Enter a volume **Capacity**.
-
-1. Optional: Expand the **Customize** section and select the [Access Modes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) that you want to use.
-
-1. Click **Create.**
-
-**Result:** Your PVC is created. You can now attach it to any workload in the project.
-
-### 3. Mount the persistent volume claim as a volume for your workload
-
-Mount PVCs to workloads so that your applications can store their data.
-
-You can mount PVCs during the deployment of a workload, or following workload creation.
-
-To attach the PVC to a new workload,
-
-1. Create a workload as you would in [Deploying Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/).
-1. For **Workload Type**, select **Stateful set of 1 pod**.
-1. Expand the **Volumes** section and click **Add Volume > Add a New Persistent Volume (Claim).**
-1. In the **Persistent Volume Claim** section, select the newly created persistent volume claim that is attached to the storage class.
-1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
-1. Click **Launch.**
-
-**Result:** When the workload is deployed, it will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC.
-
-To attach the PVC to an existing workload,
-
-1. Go to the project that has the workload that will have the PVC attached.
-1. Go to the workload that will have persistent storage and click **&#8942; > Edit.**
-1. Expand the **Volumes** section and click **Add Volume > Add a New Persistent Volume (Claim).**
-1. In the **Persistent Volume Claim** section, select the newly created persistent volume claim that is attached to the storage class.
-1. In the **Mount Point** field, enter the path that the workload will use to access the volume.
-1. Click **Save.**
-
-**Result:** The workload will make a request for the specified amount of disk space to the Kubernetes master. If a PV with the specified resources is available when the workload is deployed, the Kubernetes master will bind the PV to the PVC. If not, Rancher will provision new persistent storage.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/_index.md
deleted file mode 100644
index 648c628f352..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/_index.md
+++ /dev/null
@@ -1,79 +0,0 @@
----
-title: "Kubernetes Workloads and Pods"
-description: "Learn about the two constructs with which you can build any complex containerized application in Kubernetes: Kubernetes workloads and pods"
-weight: 7
----
-
-You can build any complex containerized application in Kubernetes using two basic constructs: pods and workloads. Once you build an application, you can expose it for access either within the same cluster or on the Internet using a third construct: services.
-
-### Pods
-
-[_Pods_](https://kubernetes.io/docs/concepts/workloads/pods/pod-overview/) are one or more containers that share network namespaces and storage volumes. Most pods have only one container. Therefore when we discuss _pods_, the term is often synonymous with _containers_. You scale pods the same way you scale containers—by having multiple instances of the same pod that implement a service. Usually pods get scaled and managed by the workload.
-
-### Workloads
-
-_Workloads_ are objects that set deployment rules for pods. Based on these rules, Kubernetes performs the deployment and updates the workload with the current state of the application.
-Workloads let you define the rules for application scheduling, scaling, and upgrade.
-
-#### Workload Types
-
-Kubernetes divides workloads into different types. The most popular types supported by Kubernetes are:
-
-- [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
-
-    _Deployments_ are best used for stateless applications (i.e., when you don't have to maintain the workload's state). Pods managed by deployment workloads are treated as independent and disposable. If a pod encounters disruption, Kubernetes removes it and then recreates it. An example application would be an Nginx web server.
-
-- [StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/)
-
-    _StatefulSets_, in contrast to deployments, are best used when your application needs to maintain its identity and store data. An application would be something like Zookeeper—an application that requires a database for storage.
-
-- [DaemonSets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/)
-
-    _Daemonsets_ ensures that every node in the cluster runs a copy of pod. For use cases where you're collecting logs or monitoring node performance, this daemon-like workload works best.
-
-- [Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/)
-
-    _Jobs_ launch one or more pods and ensure that a specified number of them successfully terminate. Jobs are best used to run a finite task to completion as opposed to managing an ongoing desired application state.
-
-- [CronJobs](https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/)
-
-    _CronJobs_ are similar to jobs. CronJobs, however, runs to completion on a cron-based schedule.
-
-### Services
-
-In many use cases, a workload has to be either:
-
-- Accessed by other workloads in the cluster.
-- Exposed to the outside world.
-
-You can achieve these goals by creating a _Service_. Services are mapped to the underlying workload's pods using a [selector/label approach (view the code samples)](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#service-and-replicationcontroller). Rancher UI simplifies this mapping process by automatically creating a service along with the workload, using the service port and type that you select.
-
-#### Service Types
-
-There are several types of services available in Rancher. The descriptions below are sourced from the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types).
-
-- **ClusterIP**
-
-    >Exposes the service on a cluster-internal IP. Choosing this value makes the service only reachable from within the cluster. This is the default `ServiceType`.
-
-- **NodePort**
-
-    >Exposes the service on each Node’s IP at a static port (the `NodePort`). A `ClusterIP` service, to which the `NodePort` service will route, is automatically created. You’ll be able to contact the `NodePort` service, from outside the cluster, by requesting `<NodeIP>:<NodePort>`.
-
-- **LoadBalancer**
-
-    >Exposes the service externally using a cloud provider’s load balancer. `NodePort` and `ClusterIP` services, to which the external load balancer will route, are automatically created.
-
-## Workload Options
-
-This section of the documentation contains instructions for deploying workloads and using workload options.
-
-- [Deploy Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/)
-- [Upgrade Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/upgrade-workloads/)
-- [Rollback Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/rollback-workloads/)
-
-## Related Links
-
-### External Links
-
-- [Services](https://kubernetes.io/docs/concepts/services-networking/service/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md
deleted file mode 100644
index 2b111ad691c..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/add-a-sidecar/_index.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Adding a Sidecar
-weight: 4
----
-A _sidecar_ is a container that extends or enhances the main container in a pod. The main container and the sidecar share a pod, and therefore share the same network space and storage. You can add sidecars to existing workloads by using the **Add a Sidecar** option.
-
-1. From the **Global** view, open the project running the workload you want to add a sidecar to.
-
-1. Click **Resources > Workloads.** In versions prior to v2.3.0, select the **Workloads** tab.
-
-1. Find the workload that you want to extend. Select **&#8942; icon (...) > Add a Sidecar**.
-
-1. Enter a **Name** for the sidecar.
-
-1. Select a **Sidecar Type**. This option determines if the sidecar container is deployed before or after the main container is deployed.
-
-    - **Standard Container:**
-
-        The sidecar container is deployed after the main container.
-
-    - **Init Container:**
-
-        The sidecar container is deployed before the main container.
-
-1. From the **Docker Image** field, enter the name of the Docker image that you want to deploy in support of the main container. During deployment, Rancher pulls this image from [Docker Hub](https://hub.docker.com/explore/). Enter the name exactly as it appears on Docker Hub.
-
-1. Set the remaining options. You can read about them in [Deploying Workloads](../deploy-workloads).
-
-1. Click **Launch**.
-
-**Result:** The sidecar is deployed according to your parameters. Following its deployment, you can view the sidecar by selecting **&#8942; icon (...) > Edit** for the main deployment.
-
-## Related Links
-
-- [The Distributed System ToolKit: Patterns for Composite Containers](https://kubernetes.io/blog/2015/06/the-distributed-system-toolkit-patterns/)
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md
deleted file mode 100644
index 5c0ff40810b..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/deploy-workloads/_index.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Deploying Workloads
-description: Read this step by step guide for deploying workloads. Deploy a workload to run an application in one or more containers.
-weight: 1
----
-
-Deploy a workload to run an application in one or more containers.
-
-1. From the **Global** view, open the project that you want to deploy a workload to.
-
-1. 1. Click **Resources > Workloads.** (In versions prior to v2.3.0, click the **Workloads** tab.) From the **Workloads** view, click **Deploy**.
-
-1. Enter a **Name** for the workload.
-
-1. Select a [workload type]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/). The workload defaults to a scalable deployment, by can change the workload type by clicking **More options.**
-
-1. From the **Docker Image** field, enter the name of the Docker image that you want to deploy to the project, optionally prefacing it with the registry host (e.g. `quay.io`, `registry.gitlab.com`, etc.). During deployment, Rancher pulls this image from the specified public or private registry. If no registry host is provided, Rancher will pull the image from [Docker Hub](https://hub.docker.com/explore/). Enter the name exactly as it appears in the registry server, including any required path, and optionally including the desired tag (e.g. `registry.gitlab.com/user/path/image:tag`). If no tag is provided, the `latest` tag will be automatically used.
-
-1. Either select an existing [namespace]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#namespaces), or click **Add to a new namespace** and enter a new namespace.
-
-1. Click **Add Port** to enter a port mapping, which enables access to the application inside and outside of the cluster . For more information, see [Services]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/#services).
-
-1. Configure the remaining options:
-
-    - **Environment Variables**
-
-        Use this section to either specify environment variables for your workload to consume on the fly, or to pull them from another source, such as a secret or [ConfigMap]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/).
-
-    - **Node Scheduling**
-    - **Health Check**
-    - **Volumes**
-
-        Use this section to add storage for your workload. You can manually specify the volume that you want to add, use a persistent volume claim to dynamically create a volume for the workload, or read data for a volume to use from a file such as a [ConfigMap]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/).
-
-        When you are deploying a Stateful Set, you should use a Volume Claim Template when using Persistent Volumes. This will ensure that Persistent Volumes are created dynamically when you scale your Stateful Set. This option is available in the UI as of Rancher v2.2.0.
-
-    - **Scaling/Upgrade Policy**
-
-        >**Amazon Note for Volumes:**
-        >
-        > To mount an Amazon EBS volume:
-        >
-        >- In [Amazon AWS](https://aws.amazon.com/), the nodes must be in the same Availability Zone and possess IAM permissions to attach/unattach volumes.
-        >
-        >- The cluster must be using the [AWS cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws) option. For more information on enabling this option see [Creating an Amazon EC2 Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) or [Creating a Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes).
-
-
-1. Click **Show Advanced Options** and configure:
-
-    - **Command**
-    - **Networking**
-    - **Labels & Annotations**
-    - **Security and Host Config**
-
-1. Click **Launch**.
-
-**Result:** The workload is deployed to the chosen namespace. You can view the workload's status from the project's **Workloads** view.
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md
deleted file mode 100644
index 4a1ecdd03e4..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/_index.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: The Horizontal Pod Autoscaler
-description: Learn about the horizontal pod autoscaler (HPA). How to manage HPAs and how to test them with a service deployment
-weight: 5
----
-
-The [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) (HPA) is a Kubernetes feature that allows you to configure your cluster to automatically scale the services it's running up or down.
-
-Rancher provides some additional features to help manage HPAs, depending on the version of Rancher. 
-
-You can create, manage, and delete HPAs using the Rancher UI in Rancher v2.3.0-alpha4 and higher versions. It only supports HPA in the `autoscaling/v2beta2` API.
-
-## Managing HPAs
-
-The way that you manage HPAs is different based on your version of the Kubernetes API:
-
-- **For Kubernetes API version autoscaling/V2beta1:** This version of the Kubernetes API lets you autoscale your pods based on the CPU and memory utilization of your application.
-- **For Kubernetes API Version autoscaling/V2beta2:** This version of the Kubernetes API lets you autoscale your pods based on CPU and memory utilization, in addition to custom metrics.
-
-HPAs are also managed differently based on your version of Rancher:
-
-- **For Rancher v2.3.0+**: You can create, manage, and delete HPAs using the Rancher UI. From the Rancher UI you can configure the HPA to scale based on CPU and memory utilization. For more information, refer to [Managing HPAs with the Rancher UI]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui). To scale the HPA based on custom metrics, you still need to use `kubectl`. For more information, refer to [Configuring HPA to Scale Using Custom Metrics with Prometheus]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/#configuring-hpa-to-scale-using-custom-metrics-with-prometheus).
-- **For Rancher Prior to v2.3.0:** To manage and configure HPAs, you need to use `kubectl`. For instructions on how to create, manage, and scale HPAs, refer to [Managing HPAs with kubectl]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl).
-
-You might have additional HPA installation steps if you are using an older version of Rancher:
-
-- **For Rancher v2.0.7+:** Clusters created in Rancher v2.0.7 and higher automatically have all the requirements needed (metrics-server and Kubernetes cluster configuration) to use HPA.
-- **For Rancher Prior to v2.0.7:** Clusters created in Rancher prior to v2.0.7 don't automatically have the requirements needed to use HPA. For instructions on installing HPA for these clusters, refer to [Manual HPA Installation for Clusters Created Before Rancher v2.0.7]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7).
-
-## Testing HPAs with a Service Deployment
-
-In Rancher v2.3.x+, you can see your HPA's current number of replicas by going to your project and clicking **Resources > HPA.** For more information, refer to [Get HPA Metrics and Status]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/).
-
-You can also use `kubectl` to get the status of HPAs that you test with your load testing tool. For more information, refer to [Testing HPAs with kubectl]
-({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/testing-hpa/).
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md
deleted file mode 100644
index d1789809370..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/hpa-background/_index.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: Background Information on HPAs
-weight: 1
----
-
-The [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) (HPA) is a Kubernetes feature that allows you to configure your cluster to automatically scale the services it's running up or down. This section provides explanation on how HPA works with Kubernetes.
-
-## Why Use Horizontal Pod Autoscaler?
-
-Using HPA, you can automatically scale the number of pods within a replication controller, deployment, or replica set up or down. HPA automatically scales the number of pods that are running for maximum efficiency. Factors that affect the number of pods include:
-
-- A minimum and maximum number of pods allowed to run, as defined by the user.
-- Observed CPU/memory use, as reported in resource metrics.
-- Custom metrics provided by third-party metrics application like Prometheus, Datadog, etc.
-
-HPA improves your services by:
-
-- Releasing hardware resources that would otherwise be wasted by an excessive number of pods.
-- Increase/decrease performance as needed to accomplish service level agreements.
-
-## How HPA Works
-
-![HPA Schema]({{<baseurl>}}/img/rancher/horizontal-pod-autoscaler.jpg)
-
-HPA is implemented as a control loop, with a period controlled by the `kube-controller-manager` flags below:
-
-Flag | Default | Description |
----------|----------|----------|
- `--horizontal-pod-autoscaler-sync-period` | `30s` | How often HPA audits resource/custom metrics in a deployment.
- `--horizontal-pod-autoscaler-downscale-delay` | `5m0s` | Following completion of a downscale operation, how long HPA must wait before launching another downscale operations.
- `--horizontal-pod-autoscaler-upscale-delay` | `3m0s` | Following completion of an upscale operation, how long HPA must wait before launching another upscale operation.
-
-
-For full documentation on HPA, refer to the [Kubernetes Documentation](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/).
-
-## Horizontal Pod Autoscaler API Objects
-
-HPA is an API resource in the Kubernetes `autoscaling` API group. The current stable version is `autoscaling/v1`, which only includes support for CPU autoscaling. To get additional support for scaling based on memory and custom metrics, use the beta version instead: `autoscaling/v2beta1`.
-
-For more information about the HPA API object, see the [HPA GitHub Readme](https://git.k8s.io/community/contributors/design-proposals/autoscaling/horizontal-pod-autoscaler.md#horizontalpodautoscaler-object).
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
deleted file mode 100644
index f0df125ee88..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
+++ /dev/null
@@ -1,200 +0,0 @@
----
-title: Managing HPAs with kubectl
-weight: 3
----
-
-This section describes HPA management with `kubectl`. This document has instructions for how to:
-
-- Create an HPA
-- Get information on HPAs
-- Delete an HPA
-- Configure your HPAs to scale with CPU or memory utilization
-- Configure your HPAs to scale using custom metrics, if you use a third-party tool such as Prometheus for metrics
-
-### Note For Rancher v2.3.x
-
-In Rancher v2.3.x, you can create, view, and delete HPAs from the Rancher UI. You can also configure them to scale based on CPU or memory usage from the Rancher UI. For more information, refer to [Managing HPAs with the Rancher UI]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui). For scaling HPAs based on other metrics than CPU or memory, you still need `kubectl`.
-
-### Note For Rancher Prior to v2.0.7
-
-Clusters created with older versions of Rancher don't automatically have all the requirements to create an HPA. To install an HPA on these clusters, refer to [Manual HPA Installation for Clusters Created Before Rancher v2.0.7]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7).
-
-##### Basic kubectl Command for Managing HPAs
-
-If you have an HPA manifest file, you can create, manage, and delete HPAs using `kubectl`:
-
-- Creating HPA
-
-  - With manifest: `kubectl create -f <HPA_MANIFEST>`
-
-  - Without manifest (Just support CPU): `kubectl autoscale deployment hello-world --min=2 --max=5 --cpu-percent=50`
-
-- Getting HPA info
-
-  - Basic: `kubectl get hpa hello-world`
-
-  - Detailed description: `kubectl describe hpa hello-world`
-
-- Deleting HPA
-
-  - `kubectl delete hpa hello-world`
-
-##### HPA Manifest Definition Example
-
-The HPA manifest is the config file used for managing an HPA with `kubectl`.
-
-The following snippet demonstrates use of different directives in an HPA manifest. See the list below the sample to understand the purpose of each directive.
-
-```yml
-apiVersion: autoscaling/v2beta1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: hello-world
-spec:
-  scaleTargetRef:
-    apiVersion: extensions/v1beta1
-    kind: Deployment
-    name: hello-world
-  minReplicas: 1
-  maxReplicas: 10
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      targetAverageUtilization: 50
-  - type: Resource
-    resource:
-      name: memory
-      targetAverageValue: 100Mi
-```
-
-
-Directive | Description  
----------|----------|
- `apiVersion: autoscaling/v2beta1` | The version of the Kubernetes `autoscaling` API group in use. This example manifest uses the beta version, so scaling by CPU and memory is enabled. |
- `name: hello-world` | Indicates that HPA is performing autoscaling for the `hello-word` deployment. |
- `minReplicas: 1` | Indicates that the minimum number of replicas running can't go below 1. |
- `maxReplicas: 10`  | Indicates the maximum number of replicas in the deployment can't go above 10.
- `targetAverageUtilization: 50` |  Indicates the deployment will scale pods up when the average running pod uses more than 50% of its requested CPU.
- `targetAverageValue: 100Mi`  |  Indicates the deployment will scale pods up when the average running pod uses more that 100Mi of memory.
-<br/>
-
-##### Configuring HPA to Scale Using Resource Metrics (CPU and Memory)
-
-Clusters created in Rancher v2.0.7 and higher have all the requirements needed (metrics-server and Kubernetes cluster configuration) to use Horizontal Pod Autoscaler. Run the following commands to check if metrics are available in your installation:
-
-```
-$ kubectl top nodes
-NAME                              CPU(cores)   CPU%      MEMORY(bytes)   MEMORY%
-node-controlplane   196m         9%        1623Mi          42%
-node-etcd           80m          4%        1090Mi          28%
-node-worker         64m          3%        1146Mi          29%
-$ kubectl -n kube-system top pods
-NAME                                   CPU(cores)   MEMORY(bytes)
-canal-pgldr                            18m          46Mi
-canal-vhkgr                            20m          45Mi
-canal-x5q5v                            17m          37Mi
-canal-xknnz                            20m          37Mi
-kube-dns-7588d5b5f5-298j2              0m           22Mi
-kube-dns-autoscaler-5db9bbb766-t24hw   0m           5Mi
-metrics-server-97bc649d5-jxrlt         0m           12Mi
-$ kubectl -n kube-system logs -l k8s-app=metrics-server
-I1002 12:55:32.172841       1 heapster.go:71] /metrics-server --source=kubernetes.summary_api:https://kubernetes.default.svc?kubeletHttps=true&kubeletPort=10250&useServiceAccount=true&insecure=true
-I1002 12:55:32.172994       1 heapster.go:72] Metrics Server version v0.2.1
-I1002 12:55:32.173378       1 configs.go:61] Using Kubernetes client with master "https://kubernetes.default.svc" and version
-I1002 12:55:32.173401       1 configs.go:62] Using kubelet port 10250
-I1002 12:55:32.173946       1 heapster.go:128] Starting with Metric Sink
-I1002 12:55:32.592703       1 serving.go:308] Generated self-signed cert (apiserver.local.config/certificates/apiserver.crt, apiserver.local.config/certificates/apiserver.key)
-I1002 12:55:32.925630       1 heapster.go:101] Starting Heapster API server...
-[restful] 2018/10/02 12:55:32 log.go:33: [restful/swagger] listing is available at https:///swaggerapi
-[restful] 2018/10/02 12:55:32 log.go:33: [restful/swagger] https:///swaggerui/ is mapped to folder /swagger-ui/
-I1002 12:55:32.928597       1 serve.go:85] Serving securely on 0.0.0.0:443
-```
-
-If you have created your cluster in Rancher v2.0.6 or before, please refer to [Manual installation](#manual-installation)
-
-##### Configuring HPA to Scale Using Custom Metrics with Prometheus
-
-You can configure HPA to autoscale based on custom metrics provided by third-party software. The most common use case for autoscaling using third-party software is based on application-level metrics (i.e., HTTP requests per second). HPA uses the `custom.metrics.k8s.io` API to consume these metrics. This API is enabled by deploying a custom metrics adapter for the metrics collection solution.
-
-For this example, we are going to use [Prometheus](https://prometheus.io/). We are beginning with the following assumptions:
-
-- Prometheus is deployed in the cluster.
-- Prometheus is configured correctly and collecting proper metrics from pods, nodes, namespaces, etc.
-- Prometheus is exposed at the following URL and port: `http://prometheus.mycompany.io:80`
-
-Prometheus is available for deployment in the Rancher v2.0 catalog. Deploy it from Rancher catalog if it isn't already running in your cluster.
-
-For HPA to use custom metrics from Prometheus, package [k8s-prometheus-adapter](https://github.com/DirectXMan12/k8s-prometheus-adapter) is required in the `kube-system` namespace of your cluster. To install `k8s-prometheus-adapter`, we are using the Helm chart available at [banzai-charts](https://github.com/banzaicloud/banzai-charts).
-
-1. Initialize Helm in your cluster.
-  ```
-  # kubectl -n kube-system create serviceaccount tiller
-  kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller
-  helm init --service-account tiller
-  ```
-
-1. Clone the `banzai-charts` repo from GitHub:
-  ```
-  # git clone https://github.com/banzaicloud/banzai-charts
-  ```
-
-1. Install the `prometheus-adapter` chart, specifying the Prometheus URL and port number.
-  ```
-  # helm install --name prometheus-adapter banzai-charts/prometheus-adapter --set prometheus.url="http://prometheus.mycompany.io",prometheus.port="80" --namespace kube-system
-  ```
-
-1. Check that `prometheus-adapter` is running properly. Check the service pod and logs in the `kube-system` namespace.
-
-  1. Check that the service pod is `Running`. Enter the following command.
-    ```
-    # kubectl get pods -n kube-system
-    ```
-    From the resulting output, look for a status of `Running`.
-    ```
-    NAME                                  READY     STATUS    RESTARTS   AGE
-    ...
-    prometheus-adapter-prometheus-adapter-568674d97f-hbzfx   1/1       Running   0          7h
-    ...
-    ```
-  1. Check the service logs to make sure the service is running correctly by entering the command that follows.
-    ```
-    # kubectl logs prometheus-adapter-prometheus-adapter-568674d97f-hbzfx -n kube-system
-    ```
-    Then review the log output to confirm the service is running.
-    {{% accordion id="prometheus-logs" label="Prometheus Adaptor Logs" %}}
-    ...
-    I0724 10:18:45.696679       1 round_trippers.go:436] GET https://10.43.0.1:443/api/v1/namespaces/default/pods?labelSelector=app%3Dhello-world 200 OK in 2 milliseconds
-    I0724 10:18:45.696695       1 round_trippers.go:442] Response Headers:
-    I0724 10:18:45.696699       1 round_trippers.go:445]     Date: Tue, 24 Jul 2018 10:18:45 GMT
-    I0724 10:18:45.696703       1 round_trippers.go:445]     Content-Type: application/json
-    I0724 10:18:45.696706       1 round_trippers.go:445]     Content-Length: 2581
-    I0724 10:18:45.696766       1 request.go:836] Response Body: {"kind":"PodList","apiVersion":"v1","metadata":{"selfLink":"/api/v1/namespaces/default/pods","resourceVersion":"6237"},"items":[{"metadata":{"name":"hello-world-54764dfbf8-q6l82","generateName":"hello-world-54764dfbf8-","namespace":"default","selfLink":"/api/v1/namespaces/default/pods/hello-world-54764dfbf8-q6l82","uid":"484cb929-8f29-11e8-99d2-067cac34e79c","resourceVersion":"4066","creationTimestamp":"2018-07-24T10:06:50Z","labels":{"app":"hello-world","pod-template-hash":"1032089694"},"annotations":{"cni.projectcalico.org/podIP":"10.42.0.7/32"},"ownerReferences":[{"apiVersion":"extensions/v1beta1","kind":"ReplicaSet","name":"hello-world-54764dfbf8","uid":"4849b9b1-8f29-11e8-99d2-067cac34e79c","controller":true,"blockOwnerDeletion":true}]},"spec":{"volumes":[{"name":"default-token-ncvts","secret":{"secretName":"default-token-ncvts","defaultMode":420}}],"containers":[{"name":"hello-world","image":"rancher/hello-world","ports":[{"containerPort":80,"protocol":"TCP"}],"resources":{"requests":{"cpu":"500m","memory":"64Mi"}},"volumeMounts":[{"name":"default-token-ncvts","readOnly":true,"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount"}],"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","imagePullPolicy":"Always"}],"restartPolicy":"Always","terminationGracePeriodSeconds":30,"dnsPolicy":"ClusterFirst","serviceAccountName":"default","serviceAccount":"default","nodeName":"34.220.18.140","securityContext":{},"schedulerName":"default-scheduler","tolerations":[{"key":"node.kubernetes.io/not-ready","operator":"Exists","effect":"NoExecute","tolerationSeconds":300},{"key":"node.kubernetes.io/unreachable","operator":"Exists","effect":"NoExecute","tolerationSeconds":300}]},"status":{"phase":"Running","conditions":[{"type":"Initialized","status":"True","lastProbeTime":null,"lastTransitionTime":"2018-07-24T10:06:50Z"},{"type":"Ready","status":"True","lastProbeTime":null,"lastTransitionTime":"2018-07-24T10:06:54Z"},{"type":"PodScheduled","status":"True","lastProbeTime":null,"lastTransitionTime":"2018-07-24T10:06:50Z"}],"hostIP":"34.220.18.140","podIP":"10.42.0.7","startTime":"2018-07-24T10:06:50Z","containerStatuses":[{"name":"hello-world","state":{"running":{"startedAt":"2018-07-24T10:06:54Z"}},"lastState":{},"ready":true,"restartCount":0,"image":"rancher/hello-world:latest","imageID":"docker-pullable://rancher/hello-world@sha256:4b1559cb4b57ca36fa2b313a3c7dde774801aa3a2047930d94e11a45168bc053","containerID":"docker://cce4df5fc0408f03d4adf82c90de222f64c302bf7a04be1c82d584ec31530773"}],"qosClass":"Burstable"}}]}
-    I0724 10:18:45.699525       1 api.go:74] GET http://prometheus-server.prometheus.34.220.18.140.xip.io/api/v1/query?query=sum%28rate%28container_fs_read_seconds_total%7Bpod_name%3D%22hello-world-54764dfbf8-q6l82%22%2Ccontainer_name%21%3D%22POD%22%2Cnamespace%3D%22default%22%7D%5B5m%5D%29%29+by+%28pod_name%29&time=1532427525.697 200 OK
-    I0724 10:18:45.699620       1 api.go:93] Response Body: {"status":"success","data":{"resultType":"vector","result":[{"metric":{"pod_name":"hello-world-54764dfbf8-q6l82"},"value":[1532427525.697,"0"]}]}}
-    I0724 10:18:45.699939       1 wrap.go:42] GET /apis/custom.metrics.k8s.io/v1beta1/namespaces/default/pods/%2A/fs_read?labelSelector=app%3Dhello-world: (12.431262ms) 200 [[kube-controller-manager/v1.10.1 (linux/amd64) kubernetes/d4ab475/system:serviceaccount:kube-system:horizontal-pod-autoscaler] 10.42.0.0:24268]
-    I0724 10:18:51.727845       1 request.go:836] Request Body: {"kind":"SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","metadata":{"creationTimestamp":null},"spec":{"nonResourceAttributes":{"path":"/","verb":"get"},"user":"system:anonymous","group":["system:unauthenticated"]},"status":{"allowed":false}}
-    ...
-    {{% /accordion %}}
-
-
-
-1. Check that the metrics API is accessible from kubectl.
-
-  - If you are accessing the cluster directly, enter your Server URL in the kubectl config in the following format: `https://<Kubernetes_URL>:6443`.
-    ```
-    # kubectl get --raw /apis/custom.metrics.k8s.io/v1beta1
-    ```
-    If the API is accessible, you should receive output that's similar to what follows.
-    {{% accordion id="custom-metrics-api-response" label="API Response" %}}
-    {"kind":"APIResourceList","apiVersion":"v1","groupVersion":"custom.metrics.k8s.io/v1beta1","resources":[{"name":"pods/fs_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_rss","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_period","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_read","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_user","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/last_seen","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/tasks_state","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_quota","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/start_time_seconds","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_write","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_cache","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_working_set_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_udp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes_free","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time_weighted","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failures","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_swap","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_shares","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_swap_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_current","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failcnt","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_tcp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_max_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_reservation_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_load_average_10s","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_system","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]}]}
-    {{% /accordion %}}
-
-  - If you are accessing the cluster through Rancher, enter your Server URL in the kubectl config in the following format: `https://<RANCHER_URL>/k8s/clusters/<CLUSTER_ID>`. Add the suffix `/k8s/clusters/<CLUSTER_ID>` to API path.
-    ```
-    # kubectl get --raw /k8s/clusters/<CLUSTER_ID>/apis/custom.metrics.k8s.io/v1beta1
-    ```
-    If the API is accessible, you should receive output that's similar to what follows.
-    {{% accordion id="custom-metrics-api-response-rancher" label="API Response" %}}
-    {"kind":"APIResourceList","apiVersion":"v1","groupVersion":"custom.metrics.k8s.io/v1beta1","resources":[{"name":"pods/fs_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_rss","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_period","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_read","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_user","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/last_seen","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/tasks_state","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_quota","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/start_time_seconds","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_write","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_cache","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_cfs_throttled_periods","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_working_set_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_udp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes_free","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_inodes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_time_weighted","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failures","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_swap","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_cpu_shares","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_swap_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_io_current","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_failcnt","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_writes_merged","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/network_tcp_usage","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/memory_max_usage_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/spec_memory_reservation_limit_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_load_average_10s","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/cpu_system","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_reads_bytes","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]},{"name":"pods/fs_sector_reads","singularName":"","namespaced":true,"kind":"MetricValueList","verbs":["get"]}]}
-    {{% /accordion %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
deleted file mode 100644
index 1c7d8ed3aad..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
+++ /dev/null
@@ -1,53 +0,0 @@
----
-title: Managing HPAs with the Rancher UI
-weight: 2
----
-
-The Rancher UI supports creating, managing, and deleting HPAs. You can configure CPU or memory usage as the metric that the HPA uses to scale.
-
-If you want to create HPAs that scale based on other metrics than CPU and memory, refer to [Configuring HPA to Scale Using Custom Metrics with Prometheus]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/#configuring-hpa-to-scale-using-custom-metrics-with-prometheus).
-
-## Creating an HPA
-
-1. From the **Global** view, open the project that you want to deploy a HPA to.
-
-1. Click **Resources > HPA.**
-
-1. Click **Add HPA.**
-
-1. Enter a **Name** for the HPA.
-
-1. Select a **Namespace** for the HPA.
-
-1. Select a **Deployment** as scale target for the HPA.
-
-1. Specify the **Minimum Scale** and **Maximum Scale** for the HPA.
-
-1. Configure the metrics for the HPA. You can choose memory or CPU usage as the metric that will cause the HPA to scale the service up or down. In the **Quantity** field, enter the percentage of the workload's memory or CPU usage that will cause the HPA to scale the service. To configure other HPA metrics, including metrics available from Prometheus, you need to [manage HPAs using kubectl]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/#configuring-hpa-to-scale-using-custom-metrics-with-prometheus).
-
-1. Click **Create** to create the HPA.
-
-> **Result:** The HPA is deployed to the chosen namespace. You can view the HPA's status from the project's Resources > HPA view.
-
-## Get HPA Metrics and Status
-
-1. From the **Global** view, open the project with the HPAs you want to look at.
-
-1. Click **Resources > HPA.** The **HPA** tab shows the number of current replicas.
-
-1. For more detailed metrics and status of a specific HPA, click the name of the HPA. This leads to the HPA detail page.
-
-
-## Deleting an HPA
-
-1. From the **Global** view, open the project that you want to delete an HPA from.
-
-1. Click **Resources > HPA.**
-
-1. Find the HPA which you would like to delete.
-
-1. Click **&#8942; > Delete**.
-
-1. Click **Delete** to confirm.
-
-> **Result:** The HPA is deleted from the current cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md
deleted file mode 100644
index 09e689fcfa1..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/horitzontal-pod-autoscaler/testing-hpa/_index.md
+++ /dev/null
@@ -1,491 +0,0 @@
----
-title: Testing HPAs with kubectl
-weight: 4
----
-
-This document describes how to check the status of your HPAs after scaling them up or down with your load testing tool. For information on how to check the status from the Rancher UI (at least version 2.3.x), refer to [Managing HPAs with the Rancher UI]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/).
-
-For HPA to work correctly, service deployments should have resources request definitions for containers. Follow this hello-world example to test if HPA is working correctly.
-
-1. Configure `kubectl` to connect to your Kubernetes cluster.
-
-2. Copy the `hello-world` deployment manifest below.
-{{% accordion id="hello-world" label="Hello World Manifest" %}}
-```
-apiVersion: apps/v1beta2
-kind: Deployment
-metadata:
-  labels:
-    app: hello-world
-  name: hello-world
-  namespace: default
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hello-world
-  strategy:
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: hello-world
-    spec:
-      containers:
-      - image: rancher/hello-world
-        imagePullPolicy: Always
-        name: hello-world
-        resources:
-          requests:
-            cpu: 500m
-            memory: 64Mi
-        ports:
-        - containerPort: 80
-          protocol: TCP
-      restartPolicy: Always
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: hello-world
-  namespace: default
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: hello-world
-```
-{{% /accordion %}}
-
-1. Deploy it to your cluster.
-
-    ```
-    # kubectl create -f <HELLO_WORLD_MANIFEST>
-    ```
-
-1. Copy one of the HPAs below based on the metric type you're using:
-{{% accordion id="service-deployment-resource-metrics" label="Hello World HPA: Resource Metrics" %}}
-```
-apiVersion: autoscaling/v2beta1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: hello-world
-  namespace: default
-spec:
-  scaleTargetRef:
-    apiVersion: extensions/v1beta1
-    kind: Deployment
-    name: hello-world
-  minReplicas: 1
-  maxReplicas: 10
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      targetAverageUtilization: 50
-  - type: Resource
-    resource:
-      name: memory
-      targetAverageValue: 1000Mi
-```
-{{% /accordion %}}
-{{% accordion id="service-deployment-custom-metrics" label="Hello World HPA: Custom Metrics" %}}
-```
-apiVersion: autoscaling/v2beta1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: hello-world
-  namespace: default
-spec:
-  scaleTargetRef:
-    apiVersion: extensions/v1beta1
-    kind: Deployment
-    name: hello-world
-  minReplicas: 1
-  maxReplicas: 10
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      targetAverageUtilization: 50
-  - type: Resource
-    resource:
-      name: memory
-      targetAverageValue: 100Mi
-  - type: Pods
-    pods:
-      metricName: cpu_system
-      targetAverageValue: 20m
-```
-{{% /accordion %}}
-
-1. View the HPA info and description. Confirm that metric data is shown.
-    {{% accordion id="hpa-info-resource-metrics" label="Resource Metrics" %}}
-1. Enter the following commands.
-    ```
-    # kubectl get hpa
-    NAME          REFERENCE                TARGETS                     MINPODS   MAXPODS   REPLICAS   AGE
-    hello-world   Deployment/hello-world   1253376 / 100Mi, 0% / 50%   1         10        1          6m
-    # kubectl describe hpa
-    Name:                                                  hello-world
-    Namespace:                                             default
-    Labels:                                                <none>
-    Annotations:                                           <none>
-    CreationTimestamp:                                     Mon, 23 Jul 2018 20:21:16 +0200
-    Reference:                                             Deployment/hello-world
-    Metrics:                                               ( current / target )
-      resource memory on pods:                             1253376 / 100Mi
-      resource cpu on pods  (as a percentage of request):  0% (0) / 50%
-    Min replicas:                                          1
-    Max replicas:                                          10
-    Conditions:
-      Type            Status  Reason              Message
-      ----            ------  ------              -------
-      AbleToScale     True    ReadyForNewScale    the last scale time was sufficiently old as to warrant a new scale
-      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
-      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-    Events:           <none>
-    ```
-    {{% /accordion %}}
-    {{% accordion id="hpa-info-custom-metrics" label="Custom Metrics" %}}
-1. Enter the following command.
-    ```
-    # kubectl describe hpa
-    ```
-    You should receive the output that follows.
-    ```
-    Name:                                                  hello-world
-    Namespace:                                             default
-    Labels:                                                <none>
-    Annotations:                                           <none>
-    CreationTimestamp:                                     Tue, 24 Jul 2018 18:36:28 +0200
-    Reference:                                             Deployment/hello-world
-    Metrics:                                               ( current / target )
-      resource memory on pods:                             3514368 / 100Mi
-      "cpu_system" on pods:                                0 / 20m
-      resource cpu on pods  (as a percentage of request):  0% (0) / 50%
-    Min replicas:                                          1
-    Max replicas:                                          10
-    Conditions:
-      Type            Status  Reason              Message
-      ----            ------  ------              -------
-      AbleToScale     True    ReadyForNewScale    the last scale time was sufficiently old as to warrant a new scale
-      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
-      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-    Events:           <none>
-    ```
-    {{% /accordion %}}
-
-
-1. Generate a load for the service to test that your pods autoscale as intended. You can use any load-testing tool (Hey, Gatling, etc.), but we're using [Hey](https://github.com/rakyll/hey).
-
-1. Test that pod autoscaling works as intended.<br/></br>
-  **To Test Autoscaling Using Resource Metrics:**
-  {{% accordion id="observe-upscale-2-pods-cpu" label="Upscale to 2 Pods: CPU Usage Up to Target" %}}
-Use your load testing tool to scale up to two pods based on CPU Usage.
-
-1. View your HPA.
-    ```
-    # kubectl describe hpa
-    ```
-    You should receive output similar to what follows.
-    ```
-    Name:                                                  hello-world
-    Namespace:                                             default
-    Labels:                                                <none>
-    Annotations:                                           <none>
-    CreationTimestamp:                                     Mon, 23 Jul 2018 22:22:04 +0200
-    Reference:                                             Deployment/hello-world
-    Metrics:                                               ( current / target )
-      resource memory on pods:                             10928128 / 100Mi
-      resource cpu on pods  (as a percentage of request):  56% (280m) / 50%
-    Min replicas:                                          1
-    Max replicas:                                          10
-    Conditions:
-      Type            Status  Reason              Message
-      ----            ------  ------              -------
-      AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 2
-      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
-      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-    Events:
-      Type    Reason             Age   From                       Message
-      ----    ------             ----  ----                       -------
-      Normal  SuccessfulRescale  13s   horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
-      ```
-1. Enter the following command to confirm you've scaled to two pods.
-   ```
-      # kubectl get pods
-   ```
-   You should receive output similar to what follows:
-   ```
-      NAME                                                     READY     STATUS    RESTARTS   AGE
-      hello-world-54764dfbf8-k8ph2                             1/1       Running   0          1m
-      hello-world-54764dfbf8-q6l4v                             1/1       Running   0          3h
-   ```
-  {{% /accordion %}}
-  {{% accordion id="observe-upscale-3-pods-cpu-cooldown" label="Upscale to 3 pods: CPU Usage Up to Target" %}}
-Use your load testing tool to upscale to 3 pods based on CPU usage with `horizontal-pod-autoscaler-upscale-delay` set to 3 minutes.
-
-1. Enter the following command.
-   ```
-   # kubectl describe hpa
-   ```
-   You should receive output similar to what follows
-   ```
-      Name:                                                  hello-world
-      Namespace:                                             default
-      Labels:                                                <none>
-      Annotations:                                           <none>
-      CreationTimestamp:                                     Mon, 23 Jul 2018 22:22:04 +0200
-      Reference:                                             Deployment/hello-world
-      Metrics:                                               ( current / target )
-        resource memory on pods:                             9424896 / 100Mi
-        resource cpu on pods  (as a percentage of request):  66% (333m) / 50%
-      Min replicas:                                          1
-      Max replicas:                                          10
-      Conditions:
-        Type            Status  Reason              Message
-        ----            ------  ------              -------
-        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 3
-        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
-        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-      Events:
-        Type    Reason             Age   From                       Message
-        ----    ------             ----  ----                       -------
-        Normal  SuccessfulRescale  4m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
-        Normal  SuccessfulRescale  16s   horizontal-pod-autoscaler  New size: 3; reason: cpu resource utilization (percentage of request) above target
-    ```
-2. Enter the following command to confirm three pods are running.
-   ```
-   # kubectl get pods
-   ```
-    You should receive output similar to what follows.
-     ```
-      NAME                                                     READY     STATUS    RESTARTS   AGE
-      hello-world-54764dfbf8-f46kh                             0/1       Running   0          1m
-      hello-world-54764dfbf8-k8ph2                             1/1       Running   0          5m
-      hello-world-54764dfbf8-q6l4v                             1/1       Running   0          3h
-      ```
-  {{% /accordion %}}
-  {{% accordion id="observe-downscale-1-pod" label="Downscale to 1 Pod: All Metrics Below Target" %}}
-Use your load testing to scale down to 1 pod when all metrics are below target for `horizontal-pod-autoscaler-downscale-delay` (5 minutes by default).
-
-1. Enter the following command.
-  ```
-  # kubectl describe hpa
-  ```
-  You should receive output similar to what follows.
-  ```
-      Name:                                                  hello-world
-      Namespace:                                             default
-      Labels:                                                <none>
-      Annotations:                                           <none>
-      CreationTimestamp:                                     Mon, 23 Jul 2018 22:22:04 +0200
-      Reference:                                             Deployment/hello-world
-      Metrics:                                               ( current / target )
-        resource memory on pods:                             10070016 / 100Mi
-        resource cpu on pods  (as a percentage of request):  0% (0) / 50%
-      Min replicas:                                          1
-      Max replicas:                                          10
-      Conditions:
-        Type            Status  Reason              Message
-        ----            ------  ------              -------
-        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 1
-        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
-        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-      Events:
-        Type    Reason             Age   From                       Message
-        ----    ------             ----  ----                       -------
-        Normal  SuccessfulRescale  10m   horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
-        Normal  SuccessfulRescale  6m    horizontal-pod-autoscaler  New size: 3; reason: cpu resource utilization (percentage of request) above target
-        Normal  SuccessfulRescale  1s    horizontal-pod-autoscaler  New size: 1; reason: All metrics below target
-  ```
-  {{% /accordion %}}
-<br/>
-**To Test Autoscaling Using Custom Metrics:**
-  {{% accordion id="custom-observe-upscale-2-pods-cpu" label="Upscale to 2 Pods: CPU Usage Up to Target" %}}
-Use your load testing tool to upscale two pods based on CPU usage.
-
-1. Enter the following command.
-  ```
-    # kubectl describe hpa
-  ```
-  You should receive output similar to what follows.
-  ```
-    Name:                                                  hello-world
-    Namespace:                                             default
-    Labels:                                                <none>
-    Annotations:                                           <none>
-    CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
-    Reference:                                             Deployment/hello-world
-    Metrics:                                               ( current / target )
-      resource memory on pods:                             8159232 / 100Mi
-      "cpu_system" on pods:                                7m / 20m
-      resource cpu on pods  (as a percentage of request):  64% (321m) / 50%
-    Min replicas:                                          1
-    Max replicas:                                          10
-    Conditions:
-      Type            Status  Reason              Message
-      ----            ------  ------              -------
-      AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 2
-      ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
-      ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-    Events:
-      Type    Reason             Age   From                       Message
-      ----    ------             ----  ----                       -------
-      Normal  SuccessfulRescale  16s   horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
-  ```
-1. Enter the following command to confirm two pods are running.
-  ```
-    # kubectl get pods
-  ```
-  You should receive output similar to what follows.
-  ```
-        NAME                           READY     STATUS    RESTARTS   AGE
-        hello-world-54764dfbf8-5pfdr   1/1       Running   0          3s
-        hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
-  ```
-  {{% /accordion %}}
-{{% accordion id="observe-upscale-3-pods-cpu-cooldown-2" label="Upscale to 3 Pods: CPU Usage Up to Target" %}}
-Use your load testing tool to scale up to three pods when the cpu_system usage limit is up to target.
-
-1. Enter the following command.
-   ```
-   # kubectl describe hpa
-   ```
-   You should receive output similar to what follows:
-   ```
-      Name:                                                  hello-world
-      Namespace:                                             default
-      Labels:                                                <none>
-      Annotations:                                           <none>
-      CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
-      Reference:                                             Deployment/hello-world
-      Metrics:                                               ( current / target )
-        resource memory on pods:                             8374272 / 100Mi
-        "cpu_system" on pods:                                27m / 20m
-        resource cpu on pods  (as a percentage of request):  71% (357m) / 50%
-      Min replicas:                                          1
-      Max replicas:                                          10
-      Conditions:
-        Type            Status  Reason              Message
-        ----            ------  ------              -------
-        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 3
-        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
-        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-      Events:
-        Type    Reason             Age   From                       Message
-        ----    ------             ----  ----                       -------
-        Normal  SuccessfulRescale  3m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
-        Normal  SuccessfulRescale  3s    horizontal-pod-autoscaler  New size: 3; reason: pods metric cpu_system above target
-    ```
-1. Enter the following command to confirm three pods are running.
-   ```
-   # kubectl get pods
-   ```
-   You should receive output similar to what follows:
-   ```
-      # kubectl get pods
-      NAME                           READY     STATUS    RESTARTS   AGE
-      hello-world-54764dfbf8-5pfdr   1/1       Running   0          3m
-      hello-world-54764dfbf8-m2hrl   1/1       Running   0          1s
-      hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
-   ```
-{{% /accordion %}}
-{{% accordion id="observe-upscale-4-pods" label="Upscale to 4 Pods: CPU Usage Up to Target" %}}
-Use your load testing tool to upscale to four pods based on CPU usage. `horizontal-pod-autoscaler-upscale-delay` is set to three minutes by default.
-
-1. Enter the following command.
-  ```
-  # kubectl describe hpa
-  ```
-  You should receive output similar to what follows.
-  ```
-      Name:                                                  hello-world
-      Namespace:                                             default
-      Labels:                                                <none>
-      Annotations:                                           <none>
-      CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
-      Reference:                                             Deployment/hello-world
-      Metrics:                                               ( current / target )
-        resource memory on pods:                             8374272 / 100Mi
-        "cpu_system" on pods:                                27m / 20m
-        resource cpu on pods  (as a percentage of request):  71% (357m) / 50%
-      Min replicas:                                          1
-      Max replicas:                                          10
-      Conditions:
-        Type            Status  Reason              Message
-        ----            ------  ------              -------
-        AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 3
-        ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from cpu resource utilization (percentage of request)
-        ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-      Events:
-        Type    Reason             Age   From                       Message
-        ----    ------             ----  ----                       -------
-        Normal  SuccessfulRescale  5m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
-        Normal  SuccessfulRescale  3m    horizontal-pod-autoscaler  New size: 3; reason: pods metric cpu_system above target
-        Normal  SuccessfulRescale  4s    horizontal-pod-autoscaler  New size: 4; reason: cpu resource utilization (percentage of request) above target
-    ```
-1.  Enter the following command to confirm four pods are running.
-    ```
-    # kubectl get pods
-    ```
-    You should receive output similar to what follows.
-    ```
-      NAME                           READY     STATUS    RESTARTS   AGE
-      hello-world-54764dfbf8-2p9xb   1/1       Running   0          5m
-      hello-world-54764dfbf8-5pfdr   1/1       Running   0          2m
-      hello-world-54764dfbf8-m2hrl   1/1       Running   0          1s
-      hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
-    ```
-{{% /accordion %}}
-{{% accordion id="custom-metrics-observe-downscale-1-pod" label="Downscale to 1 Pod: All Metrics Below Target" %}}
-Use your load testing tool to scale down to one pod when all metrics below target for `horizontal-pod-autoscaler-downscale-delay`.
-
-1. Enter the following command.
-    ```
-    # kubectl describe hpa
-    ```
-    You should receive similar output to what follows.
-    ```
-        Name:                                                  hello-world
-        Namespace:                                             default
-        Labels:                                                <none>
-        Annotations:                                           <none>
-        CreationTimestamp:                                     Tue, 24 Jul 2018 18:01:11 +0200
-        Reference:                                             Deployment/hello-world
-        Metrics:                                               ( current / target )
-          resource memory on pods:                             8101888 / 100Mi
-          "cpu_system" on pods:                                8m / 20m
-          resource cpu on pods  (as a percentage of request):  0% (0) / 50%
-        Min replicas:                                          1
-        Max replicas:                                          10
-        Conditions:
-          Type            Status  Reason              Message
-          ----            ------  ------              -------
-          AbleToScale     True    SucceededRescale    the HPA controller was able to update the target scale to 1
-          ScalingActive   True    ValidMetricFound    the HPA was able to successfully calculate a replica count from memory resource
-          ScalingLimited  False   DesiredWithinRange  the desired count is within the acceptable range
-        Events:
-          Type    Reason             Age   From                       Message
-          ----    ------             ----  ----                       -------
-          Normal  SuccessfulRescale  10m    horizontal-pod-autoscaler  New size: 2; reason: cpu resource utilization (percentage of request) above target
-          Normal  SuccessfulRescale  8m    horizontal-pod-autoscaler  New size: 3; reason: pods metric cpu_system above target
-          Normal  SuccessfulRescale  5m    horizontal-pod-autoscaler  New size: 4; reason: cpu resource utilization (percentage of request) above target
-          Normal   SuccessfulRescale             13s               horizontal-pod-autoscaler  New size: 1; reason: All metrics below target
-    ```
-1. Enter the following command to confirm a single pods is running.
-    ```
-        # kubectl get pods
-    ```
-    You should receive output similar to what follows.
-    ```
-        NAME                           READY     STATUS    RESTARTS   AGE
-        hello-world-54764dfbf8-q6l82   1/1       Running   0          6h
-    ```
-{{% /accordion %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md
deleted file mode 100644
index a6701d94bd1..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/rollback-workloads/_index.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-title: Rolling Back Workloads
-weight: 3
----
-
-Sometimes there is a need to rollback to the previous version of the application, either for debugging purposes or because an upgrade did not go as planned.
-
-1. From the **Global** view, open the project running the workload you want to rollback.
-
-1. Find the workload that you want to rollback and select **Vertical &#8942; (... ) > Rollback**.
-
-1. Choose the revision that you want to roll back to. Click **Rollback**.
-
-**Result:** Your workload reverts to the previous version that you chose. Wait a few minutes for the action to complete.
diff --git a/content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md b/content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md
deleted file mode 100644
index 521e8d2901b..00000000000
--- a/content/rancher/v2.5/en/cluster-explorer/workloads/upgrade-workloads/_index.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: Upgrading Workloads
-weight: 2
----
-When a new version of an application image is released on Docker Hub, you can upgrade any workloads running a previous version of the application to the new one.
-
-1. From the **Global** view, open the project running the workload you want to upgrade.
-
-1. Find the workload that you want to upgrade and select **Vertical &#8942; (... ) > Edit**.
-
-1. Update the **Docker Image** to the updated version of the application image on Docker Hub.
-
-1. Update any other options that you want to change.
-
-1. Review and edit the workload's **Scaling/Upgrade** policy.
-
-    These options control how the upgrade rolls out to containers that are currently running. For example, for scalable deployments, you can chose whether you want to stop old pods before deploying new ones, or vice versa, as well as the upgrade batch size.
-
-1. Click **Upgrade**.
-
-**Result:** The workload begins upgrading its containers, per your specifications. Note that scaling up the deployment or updating the upgrade/scaling policy won't result in the pods recreation.
diff --git a/content/rancher/v2.5/en/contributing/_index.md b/content/rancher/v2.5/en/contributing/_index.md
deleted file mode 100644
index 69c09d3974a..00000000000
--- a/content/rancher/v2.5/en/contributing/_index.md
+++ /dev/null
@@ -1,120 +0,0 @@
----
-title: Contributing to Rancher
-weight: 22
----
-
-This section explains the repositories used for Rancher, how to build the repositories, and what information to include when you file an issue.
-
-For more detailed information on how to contribute to the development of Rancher projects, refer to the [Rancher Developer Wiki](https://github.com/rancher/rancher/wiki). The wiki has resources on many topics, including the following:
-
-- How to set up the Rancher development environment and run tests
-- The typical flow of an issue through the development lifecycle
-- Coding guidelines and development best practices
-- Debugging and troubleshooting
-- Developing the Rancher API
-
-On the Rancher Users Slack, the channel for developers is **#developer**.
-
-# Repositories
-
-All of repositories are located within our main GitHub organization. There are many repositories used for Rancher, but we'll provide descriptions of some of the main ones used in Rancher.
-
-Repository | URL | Description
------------|-----|-------------
-Rancher | https://github.com/rancher/rancher | This repository is the main source code for Rancher 2.x.
-Types | https://github.com/rancher/types | This repository is the repository that has all the API types for Rancher 2.x.
-API Framework | https://github.com/rancher/norman | This repository is an API framework for building Rancher style APIs backed by Kubernetes Custom Resources.
-User Interface | https://github.com/rancher/ui | This repository is the source of the UI.
-(Rancher) Docker Machine | https://github.com/rancher/machine | This repository is the source of the Docker Machine binary used when using Node Drivers. This is a fork of the `docker/machine` repository.
-machine-package | https://github.com/rancher/machine-package | This repository is used to build the Rancher Docker Machine binary.
-kontainer-engine | https://github.com/rancher/kontainer-engine | This repository is the source of kontainer-engine, the tool to provision hosted Kubernetes clusters.
-RKE repository | https://github.com/rancher/rke | This repository is the source of Rancher Kubernetes Engine, the tool to provision Kubernetes clusters on any machine.
-CLI | https://github.com/rancher/cli | This repository is the source code for the Rancher CLI used in Rancher 2.x.
-(Rancher) Helm repository | https://github.com/rancher/helm | This repository is the source of the packaged Helm binary. This is a fork of the `helm/helm` repository.
-Telemetry repository | https://github.com/rancher/telemetry | This repository is the source for the Telemetry binary.
-loglevel repository | https://github.com/rancher/loglevel | This repository is the source of the loglevel binary, used to dynamically change log levels.
-
-To see all libraries/projects used in Rancher, see the [`go.mod` file](https://github.com/rancher/rancher/blob/master/go.mod) in the `rancher/rancher` repository.
-
-![Rancher diagram]({{<baseurl>}}/img/rancher/ranchercomponentsdiagram.svg)<br/>
-<sup>Rancher components used for provisioning/managing Kubernetes clusters.</sup>
-
-# Building
-
-Every repository should have a Makefile and can be built using the `make` command. The `make` targets are based on the scripts in the `/scripts` directory in the repository, and each target will use [Dapper](https://github.com/rancher/dapper) to run the target in an isolated environment. The `Dockerfile.dapper` will be used for this process, and includes all the necessary build tooling needed.
-
-The default target is `ci`, and will run `./scripts/validate`, `./scripts/build`, `./scripts/test` and `./scripts/package`. The resulting binaries of the build will be in `./build/bin` and are usually also packaged in a Docker image.
-
-# Bugs, Issues or Questions
-
-If you find any bugs or are having any trouble, please search the [reported issue](https://github.com/rancher/rancher/issues) as someone may have experienced the same issue or we are actively working on a solution.
-
-If you can't find anything related to your issue, contact us by [filing an issue](https://github.com/rancher/rancher/issues/new). Though we have many repositories related to Rancher, we want the bugs filed in the Rancher repository so we won't miss them! If you want to ask a question or ask fellow users about an use case, we suggest creating a post on the [Rancher Forums](https://forums.rancher.com).
-
-### Checklist for Filing Issues
-
-Please follow this checklist when filing an issue which will helps us investigate and fix the issue. More info means more data we can use to determine what is causing the issue or what might be related to the issue.
-
->**Note:** For large amounts of data, please use [GitHub Gist](https://gist.github.com/) or similar and link the created resource in the issue.
->**Important:** Please remove any sensitive data as it will be publicly viewable.
-
-- **Resources:** Provide as much as detail as possible on the used resources. As the source of the issue can be many things, including as much of detail as possible helps to determine the root cause. See some examples below:
-  - **Hosts:** What specifications does the host have, like CPU/memory/disk, what cloud does it happen on, what Amazon Machine Image are you using, what DigitalOcean droplet are you using, what image are you provisioning that we can rebuild or use when we try to reproduce
-  - **Operating System:** What operating system are you using? Providing specifics helps here like the output of `cat /etc/os-release` for exact OS release and `uname -r` for exact kernel used
-  - **Docker:** What Docker version are you using, how did you install it? Most of the details of Docker can be found by supplying output of `docker version` and `docker info`
-  - **Environment:** Are you in a proxy environment, are you using recognized CA/self signed certificates, are you using an external loadbalancer
-  - **Rancher:** What version of Rancher are you using, this can be found on the bottom left of the UI or be retrieved from the image tag you are running on the host
-  - **Clusters:** What kind of cluster did you create, how did you create it, what did you specify when you were creating it
-- **Steps to reproduce the issue:** Provide as much detail on how you got into the reported situation. This helps the person to reproduce the situation you are in.
-  - Provide manual steps or automation scripts used to get from a newly created setup to the situation you reported.
-- **Logs:** Provide data/logs from the used resources.
-  - Rancher
-      - Docker install
-
-        ```
-        docker logs \
-        --timestamps \
-        $(docker ps | grep -E "rancher/rancher:|rancher/rancher " | awk '{ print $1 }')
-        ```
-      - Kubernetes install using `kubectl`
-
-        > **Note:** Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` if Rancher is installed on a Kubernetes cluster) or are using the embedded kubectl via the UI.
-
-        ```
-        kubectl -n cattle-system \
-        logs \
-        -l app=rancher \
-        --timestamps=true
-        ```
-      - Docker install using `docker` on each of the nodes in the RKE cluster
-
-        ```
-        docker logs \
-        --timestamps \
-        $(docker ps | grep -E "rancher/rancher@|rancher_rancher" | awk '{ print $1 }')
-        ```
-      - Kubernetes Install with RKE Add-On
-
-        > **Note:** Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` if the Rancher server is installed on a Kubernetes cluster) or are using the embedded kubectl via the UI.
-
-        ```
-        kubectl -n cattle-system \
-        logs \
-        --timestamps=true \
-        -f $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name="cattle-server") | .metadata.name')
-        ```
-  - System logging (these might not all exist, depending on operating system)
-      - `/var/log/messages`
-      - `/var/log/syslog`
-      - `/var/log/kern.log`
-  - Docker daemon logging (these might not all exist, depending on operating system)
-      - `/var/log/docker.log`
-- **Metrics:** If you are experiencing performance issues, please provide as much of data (files or screenshots) of metrics which can help determining what is going on. If you have an issue related to a machine, it helps to supply output of `top`, `free -m`, `df` which shows processes/memory/disk usage.
-
-# Docs
-
-If you have any updates to our documentation, please make any pull request to our docs repo.
-
-- [Rancher 2.x Docs repository](https://github.com/rancher/docs): This repo is where all the docs for Rancher 2.x are located. They are located in the `content` folder in the repo.
-
-- [Rancher 1.x Docs repository](https://github.com/rancher/rancher.github.io): This repo is where all the docs for Rancher 1.x are located. They are located in the `rancher` folder in the repo.
diff --git a/content/rancher/v2.5/en/ecm/_index.md b/content/rancher/v2.5/en/ecm/_index.md
deleted file mode 100644
index 0e359ce5891..00000000000
--- a/content/rancher/v2.5/en/ecm/_index.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: Enterprise Cluster Manager
-weight: 6
----
-
-After installation, the [system administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) should configure Rancher to configure authentication, authorization, security, default settings, security policies, drivers and global DNS entries.
-
-## First Log In
-
-After you log into Rancher for the first time, Rancher will prompt you for a **Rancher Server URL**.You should set the URL to the main entry point to the Rancher Server. When a load balancer sits in front a Rancher Server cluster, the URL should resolve to the load balancer. The system will automatically try to infer the Rancher Server URL from the IP address or host name of the host running the Rancher Server. This is only correct if you are running a single node Rancher Server installation. In most cases, therefore, you need to set the Rancher Server URL to the correct value yourself.
-
->**Important!** After you set the Rancher Server URL, we do not support updating it. Set the URL with extreme care.
-
-## Authentication
-
-One of the key features that Rancher adds to Kubernetes is centralized user authentication. This feature allows to set up local users and/or connect to an external authentication provider. By connecting to an external authentication provider, you can leverage that provider's user and groups.
-
-For more information how authentication works and how to configure each provider, see [Authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/).
-
-## Authorization
-
-Within Rancher, each person authenticates as a _user_, which is a login that grants you access to Rancher. Once the user logs in to Rancher, their _authorization_, or their access rights within the system, is determined by the user's role. Rancher provides built-in roles to allow you to easily configure a user's permissions to resources, but Rancher also provides the ability to customize the roles for each Kubernetes resource.
-
-For more information how authorization works and how to customize roles, see [Roles Based Access Control (RBAC)]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/).
-
-## Pod Security Policies
-
-_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification, e.g. root privileges. If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message.
-
-For more information how to create and use PSPs, see [Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
-
-## Provisioning Drivers
-
-Drivers in Rancher allow you to manage which providers can be used to provision [hosted Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) or [nodes in an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) to allow Rancher to deploy and manage Kubernetes.
-
-For more information, see [Provisioning Drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/).
-
-## Adding Kubernetes Versions into Rancher
-
-With this feature, you can upgrade to the latest version of Kubernetes as soon as it is released, without upgrading Rancher. This feature allows you to easily upgrade Kubernetes patch versions (i.e. `v1.15.X`), but not intended to upgrade Kubernetes minor versions (i.e. `v1.X.0`) as Kubernetes tends to deprecate or add APIs between minor versions.
-
-The information that Rancher uses to provision [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) is now located in the Rancher Kubernetes Metadata. For details on metadata configuration and how to change the Kubernetes version used for provisioning RKE clusters, see [Rancher Kubernetes Metadata.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/k8s-metadata/)
-
-Rancher Kubernetes Metadata contains Kubernetes version information which Rancher uses to provision [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
-
-For more information on how metadata works and how to configure metadata config, see [Rancher Kubernetes Metadata]({{<baseurl>}}/rancher/v2.x/en/admin-settings/k8s-metadata/).
-
-## Enabling Experimental Features
-
-Rancher includes some features that are experimental and disabled by default. Feature flags were introduced to allow you to try these features. For more information, refer to the section about [feature flags.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/feature-flags/)
diff --git a/content/rancher/v2.5/en/ecm/access-control/_index.md b/content/rancher/v2.5/en/ecm/access-control/_index.md
deleted file mode 100644
index 199a0368e3f..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/_index.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: Access Control
-weight: 1
----
-
-> This section is under construction.
-
-There are many ways you can interact with Kubernetes clusters that are managed by Rancher:
-
-- **Rancher UI**
-
-    Rancher provides an intuitive user interface for interacting with your clusters. All options available in the UI use the Rancher API. Therefore any action possible in the UI is also possible in the Rancher CLI or Rancher API.
-
-- **kubectl**
-
-    You can use the Kubernetes command-line tool, [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/), to manage   your clusters. You have two options for using kubectl:
-
-    - **Rancher kubectl shell**
-
-        Interact with your clusters by launching a kubectl shell available in the Rancher UI. This option requires no configuration actions on your part.
-
-        For more information, see [Accessing Clusters with kubectl Shell]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/kubectl/#accessing-clusters-with-kubectl-shell).
-
-    - **Terminal remote connection**
-
-        You can also interact with your clusters by installing [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) on your local desktop and then copying the cluster's kubeconfig file to your local `~/.kube/config` directory.
-
-        For more information, see [Accessing Clusters with kubectl and a kubeconfig File]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/kubectl/#accessing-clusters-with-kubectl-and-a-kubeconfig-file).
-
-- **Rancher CLI**
-
-    You can control your clusters by downloading Rancher's own command-line interface, [Rancher CLI]({{<baseurl>}}/rancher/v2.x/en/cli/). This CLI tool can interact directly with different clusters and projects or pass them `kubectl` commands.
-
-- **Rancher API**
-
-    Finally, you can interact with your clusters over the Rancher API. Before you use the API, you must obtain an [API key]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/). To view the different resource fields and actions for an API object, open the API UI, which can be accessed by clicking on **View in API** for any Rancher UI object.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/_index.md
deleted file mode 100644
index d8765f574e4..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/_index.md
+++ /dev/null
@@ -1,98 +0,0 @@
----
-title: Authentication Providers
-weight: 1
----
-
-> This section is under construction.
-
-One of the key features that Rancher adds to Kubernetes is centralized user authentication. This feature allows your users to use one set of credentials to authenticate with any of your Kubernetes clusters.
-
-This centralized user authentication is accomplished using the Rancher authentication proxy, which is installed along with the rest of Rancher. This proxy authenticates your users and forwards their requests to your Kubernetes clusters using a service account.
-
-<!-- todomark add diagram -->
-
-## External vs. Local Authentication
-
-The Rancher authentication proxy integrates with the following external authentication services. The following table lists the first version of Rancher each service debuted.
-
-| Auth Service                                                                                     | Available as of  |
-| ------------------------------------------------------------------------------------------------ | ---------------- |
-| [Microsoft Active Directory]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/)  | v2.0.0           |
-| [GitHub]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/github/)                  | v2.0.0           |
-| [Microsoft Azure AD]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/azure-ad/)    | v2.0.3           |
-| [FreeIPA]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/freeipa/)                | v2.0.5           |
-| [OpenLDAP]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/openldap/)              | v2.0.5           |
-| [Microsoft AD FS]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/) | v2.0.7           |
-| [PingIdentity]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ping-federate/)     | v2.0.7           |
-| [Keycloak]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/keycloak/)              | v2.1.0           |
-| [Okta]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/okta/)                      | v2.2.0           |
-| [Google OAuth]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/google/)            | v2.3.0           |
-| [Shibboleth]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/shibboleth)           | v2.4.0           |
-
-<br/>
-However, Rancher also provides [local authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/local/).
-
-In most cases, you should use an external authentication service over local authentication, as external authentication allows user management from a central location. However, you may want a few local authentication users for managing Rancher under rare circumstances, such as if your external authentication provider is unavailable or undergoing maintenance.
-
-## Users and Groups
-
-Rancher relies on users and groups to determine who is allowed to log in to Rancher and which resources they can access. When authenticating with an external provider, groups are provided from the external provider based on the user. These users and groups are given specific roles to resources like clusters, projects, multi-cluster apps, and global DNS providers and entries. When you give access to a group, all users who are a member of that group in the authentication provider will be able to access the resource with the permissions that you've specified. For more information on roles and permissions, see [Role Based Access Control]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/).
-
-> **Note:** Local authentication does not support creating or managing groups.
-
-For more information, see [Users and Groups]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/user-groups/)
-
-## Scope of Rancher Authorization
-
-After you configure Rancher to allow sign on using an external authentication service, you should configure who should be allowed to log in and use Rancher. The following options are available:
-
-| Access Level | Description |
-|----------------------------------------------|-------------|
-| Allow any valid Users                   | _Any_ user in the authorization service can access Rancher. We generally discourage use of this setting! |
-| Allow members of Clusters, Projects, plus Authorized Users and Organizations | Any user in the authorization service and any group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any user in the authentication service or group you add to the **Authorized Users and Organizations** list may log in to Rancher. |
-| Restrict access to only Authorized Users and Organizations | Only users in the authentication service or groups added to the Authorized Users and Organizations can log in to Rancher. |
-
-To set the Rancher access level for users in the authorization service, follow these steps:
-
-1. From the **Global** view, click **Security > Authentication.**
-
-1. Use the **Site Access** options to configure the scope of user authorization. The table above explains the access level for each option.
-
-1. Optional: If you choose an option other than **Allow any valid Users,** you can add users to the list of authorized users and organizations by searching for them in the text field that appears.
-
-1. Click **Save.**
-
-**Result:** The Rancher access configuration settings are applied.
-
-{{< saml_caveats >}}
-
-## External Authentication Configuration and Principal Users
-
-Configuration of external authentication requires:
-
-- A local user assigned the administrator role, called hereafter the _local principal_.
-- An external user that can authenticate with your external authentication service, called hereafter the _external principal_.
-
-Configuration of external authentication affects how principal users are managed within Rancher. Follow the list below to better understand these effects.
-
-1. Sign into Rancher as the local principal and complete configuration of external authentication.
-
-	![Sign In]({{<baseurl>}}/img/rancher/sign-in.png)
-
-2. Rancher associates the external principal with the local principal. These two users share the local principal's user ID.
-
-	![Principal ID Sharing]({{<baseurl>}}/img/rancher/principal-ID.png)
-
-3. After you complete configuration, Rancher automatically signs out the local principal.
-
-	![Sign Out Local Principal]({{<baseurl>}}/img/rancher/sign-out-local.png)
-
-4. Then, Rancher automatically signs you back in as the external principal.
-
-	![Sign In External Principal]({{<baseurl>}}/img/rancher/sign-in-external.png)
-
-5. Because the external principal and the local principal share an ID, no unique object for the external principal displays on the Users page.
-
-	![Sign In External Principal]({{<baseurl>}}/img/rancher/users-page.png)
-
-6. The external principal and the local principal share the same access rights.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/ad/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/ad/_index.md
deleted file mode 100644
index 757fe51cc35..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/ad/_index.md
+++ /dev/null
@@ -1,197 +0,0 @@
----
-title: Configuring Active Directory (AD)
-weight: 2
----
-
-If your organization uses Microsoft Active Directory as central user repository, you can configure Rancher to communicate with an Active Directory server to authenticate users. This allows Rancher admins to control access to clusters and projects based on users and groups managed externally in the Active Directory, while allowing end-users to authenticate with their AD credentials when logging in to the Rancher UI.
-
-Rancher uses LDAP to communicate with the Active Directory server. The authentication flow for Active Directory is therefore the same as for the [OpenLDAP authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/openldap) integration.
-
-> **Note:**
->
-> Before you start, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
-
-## Prerequisites
-
-You'll need to create or obtain from your AD administrator a new AD user to use as service account for Rancher. This user must have sufficient permissions to perform LDAP searches and read attributes of users and groups under your AD domain.
-
-Usually a (non-admin) **Domain User** account should be used for this purpose, as by default such user has read-only privileges for most objects in the domain partition.
-
-Note however, that in some locked-down Active Directory configurations this default behaviour may not apply. In such case you will need to ensure that the service account user has at least **Read** and **List Content** permissions granted either on the Base OU (enclosing users and groups) or globally for the domain.
-
-> **Using TLS?**
->
-> If the certificate used by the AD server is self-signed or not from a recognised certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
-
-## Configuration Steps
-### Open Active Directory Configuration
-
-1. Log into the Rancher UI using the initial local `admin` account.
-2. From the **Global** view, navigate to **Security** > **Authentication**
-3. Select **Active Directory**. The **Configure an AD server** form will be displayed.
-
-### Configure Active Directory Server Settings
-
-In the section titled `1. Configure an Active Directory server`,   complete the fields with the information specific to your Active Directory server. Please refer to the following table for detailed information on the required values for each parameter.
-
-> **Note:**
->
-> If you are unsure about the correct values to enter in the  user/group Search Base field, please refer to [Identify Search Base and Schema using ldapsearch](#annex-identify-search-base-and-schema-using-ldapsearch).
-
-**Table 1: AD Server parameters**
-
-| Parameter | Description |
-|:--|:--|
-| Hostname | Specify the hostname or IP address of the AD server |
-| Port | Specify the port at which the Active Directory server is listening for connections. Unencrypted LDAP normally uses the standard port of 389, while LDAPS uses port 636.|
-| TLS | Check this box to enable LDAP over SSL/TLS (commonly known as LDAPS).|
-| Server Connection Timeout | 	The duration in number of seconds that Rancher waits before considering the AD server unreachable. |
-| Service Account Username | Enter the username of an AD account with read-only access to your domain partition (see [Prerequisites](#prerequisites)). The username can be entered in NetBIOS format (e.g. "DOMAIN\serviceaccount") or UPN format (e.g. "serviceaccount@domain.com"). |
-| Service Account Password | The password for the service account.  |
-| Default Login Domain | When you configure this field with the NetBIOS name of your AD domain, usernames entered without a domain (e.g. "jdoe") will automatically be converted to a slashed,  NetBIOS logon (e.g. "LOGIN_DOMAIN\jdoe") when binding to the AD server. If your users authenticate with the UPN (e.g. "jdoe@acme.com") as username then this field **must** be left empty. |
-| User Search Base | The Distinguished Name of the node in your directory tree from which to start searching for user objects. All users must be descendents of this base DN. For example: "ou=people,dc=acme,dc=com".|
-| Group Search Base | If your groups live under a different node than the one configured under `User Search Base` you will need to provide the Distinguished Name here. Otherwise leave it empty. For example: "ou=groups,dc=acme,dc=com".|
-
----
-
-### Configure User/Group Schema
-
-In the section titled `2. Customize Schema` you must provide Rancher with a correct mapping of user and group attributes corresponding to the schema used in your directory.
-
-Rancher uses LDAP queries to search for and retrieve information about users and groups within the Active Directory. The attribute mappings configured in this section are used to construct search filters and resolve group membership. It is therefore paramount that the provided settings reflect the reality of your AD domain.
-
-> **Note:**
->
-> If you are unfamiliar with the schema used in your Active Directory domain, please refer to [Identify Search Base and Schema using ldapsearch](#annex-identify-search-base-and-schema-using-ldapsearch) to determine the correct configuration values.
-
-#### User Schema
-
-The table below details the parameters for the user schema section configuration.
-
-**Table 2: User schema configuration parameters**
-
-| Parameter | Description |
-|:--|:--|
-| Object Class | The name of the object class used for user objects in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx) |
-| Username Attribute | The user attribute whose value is suitable as a display name. |
-| Login Attribute | The attribute whose value matches the username part of credentials entered by your users when logging in to Rancher. If your users authenticate with their UPN (e.g. "jdoe@acme.com") as username then this field must normally be set to `userPrincipalName`. Otherwise for the old, NetBIOS-style logon names (e.g. "jdoe") it's usually `sAMAccountName`. |
-| User Member Attribute | The attribute containing the groups that a user is a member of. |
-| Search Attribute | When a user enters text to add users or groups in the UI, Rancher queries the AD server and attempts to match users by the attributes provided in this setting. Multiple attributes can be specified by separating them with the pipe ("\|") symbol. To match UPN usernames (e.g. jdoe@acme.com) you should usually set the value of this field to `userPrincipalName`. |
-| Search Filter | This filter gets applied to the list of users that is searched when Rancher attempts to add users to a site access list or tries to add members to clusters or projects. For example, a user search filter could be <code>(&#124;(memberOf=CN=group1,CN=Users,DC=testad,DC=rancher,DC=io)(memberOf=CN=group2,CN=Users,DC=testad,DC=rancher,DC=io))</code>. Note: If the search filter does not use [valid AD search syntax,](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) the list of users will be empty.  |
-| User Enabled Attribute | The attribute containing an integer value representing a bitwise enumeration of user account flags. Rancher uses this to determine if a user account is disabled. You should normally leave this set to the AD standard `userAccountControl`. |
-| Disabled Status Bitmask | This is the value of the `User Enabled Attribute` designating a disabled user account. You should normally leave this set to the default value of "2" as specified in the Microsoft Active Directory schema (see [here](https://docs.microsoft.com/en-us/windows/desktop/adschema/a-useraccountcontrol#remarks)). |
-
----
-
-#### Group Schema
-
-The table below details the parameters for the group schema configuration.
-
-**Table 3: Group schema configuration parameters**
-
-| Parameter | Description |
-|:--|:--|
-| Object Class | The name of the object class used for group objects in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx)  |
-| Name Attribute | The group attribute whose value is suitable for a display name. |
-| Group Member User Attribute | The name of the **user attribute** whose format matches the group members in the `Group Member Mapping Attribute`. |
-| Group Member Mapping Attribute | The name of the group attribute containing the members of a group. |
-| Search Attribute | Attribute used to construct search filters when adding groups to clusters or projects. See description of user schema `Search Attribute`. |
-| Search Filter | This filter gets applied to the list of groups that is searched when Rancher attempts to add groups to a site access list or tries to add groups to clusters or projects. For example, a group search filter could be <code>(&#124;(cn=group1)(cn=group2))</code>. Note: If the search filter does not use [valid AD search syntax,](https://docs.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax) the list of groups will be empty. |
-| Group DN Attribute | The name of the group attribute whose format matches the values in the user attribute describing a the user's memberships. See  `User Member Attribute`. |
-| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organisation makes use of these nested memberships (ie. you have groups that contain other groups as members). |
-
----
-
-### Test Authentication
-
-Once you have completed the configuration, proceed by testing the connection to the AD server **using your AD admin account**. If the test is successful, authentication with the configured Active Directory will be enabled implicitly with the account you test with set as admin.
-
-> **Note:**
->
-> The AD user pertaining to the credentials entered in this step will be mapped to the local principal account and assigned administrator privileges in Rancher. You should therefore make a conscious decision on which AD account you use to perform this step.
-
-1. Enter the **username** and **password** for the AD account that should be mapped to the local principal account.
-2. Click **Authenticate with Active Directory** to finalise the setup.
-
-**Result:**
-
-- Active Directory authentication has been enabled.
-- You have been signed into Rancher as administrator using the provided AD credentials.
-
-> **Note:**
->
-> You will still be able to login using the locally configured `admin` account and password in case of a disruption of LDAP services.
-
-## Annex: Identify Search Base and Schema using ldapsearch
-
-In order to successfully configure AD authentication it is crucial that you provide the correct configuration pertaining to the hierarchy and schema of your AD server.
-
-The [`ldapsearch`](http://manpages.ubuntu.com/manpages/artful/man1/ldapsearch.1.html) tool allows you to query your AD server to learn about the schema used for user and group objects.
-
-For the purpose of the example commands provided below we will assume:
-
-- The Active Directory server has a hostname of `ad.acme.com`
-- The server is listening for unencrypted connections on port `389`
-- The Active Directory domain is `acme`
-- You have a valid AD account with the username `jdoe` and password `secret`
-
-### Identify Search Base
-
-First we will use `ldapsearch` to identify the Distinguished Name (DN) of the parent node(s) for users and groups:
-
-```
-$ ldapsearch -x -D "acme\jdoe" -w "secret" -p 389 \
--h ad.acme.com -b "dc=acme,dc=com" -s sub "sAMAccountName=jdoe"
-```
-
-This command performs an LDAP search with the search base set to the domain root (`-b "dc=acme,dc=com"`) and a filter targeting the user account (`sAMAccountNam=jdoe`), returning the attributes for said user:
-
-{{< img "/img/rancher/ldapsearch-user.png" "LDAP User">}}
-
-Since in this case the user's DN is `CN=John Doe,CN=Users,DC=acme,DC=com` [5], we should configure the **User Search Base** with the parent node DN `CN=Users,DC=acme,DC=com`.
-
-Similarly, based on the DN of the group referenced in the **memberOf** attribute [4], the correct value for the **Group Search Base** would be the parent node of that value, ie. `OU=Groups,DC=acme,DC=com`.
-
-### Identify User Schema
-
-The output of the above `ldapsearch` query also allows to determine the correct values to use in the user schema configuration:
-
-- `Object Class`: **person** [1]
-- `Username Attribute`: **name** [2]
-- `Login Attribute`: **sAMAccountName** [3]
-- `User Member Attribute`: **memberOf** [4]
-
-> **Note:**
->
-> If the AD users in our organisation were to authenticate with their UPN (e.g. jdoe@acme.com) instead of the short logon name, then we would have to set the `Login Attribute` to **userPrincipalName** instead.
-
-We'll also set the `Search Attribute` parameter to **sAMAccountName|name**. That way users can be added to clusters/projects in the Rancher UI either by entering their username or full name.
-
-### Identify Group Schema
-
-Next, we'll query one of the groups associated with this user, in this case `CN=examplegroup,OU=Groups,DC=acme,DC=com`:
-
-```
-$ ldapsearch -x -D "acme\jdoe" -w "secret" -p 389 \
--h ad.acme.com -b "ou=groups,dc=acme,dc=com" \
--s sub "CN=examplegroup"
-```
-
-This command will inform us on the attributes used for group objects:
-
-{{< img "/img/rancher/ldapsearch-group.png" "LDAP Group">}}
-
-Again, this allows us to determine the correct values to enter in the group schema configuration:
-
-- `Object Class`: **group** [1]
-- `Name Attribute`: **name** [2]
-- `Group Member Mapping Attribute`: **member** [3]
-- `Search Attribute`: **sAMAccountName** [4]
-
-Looking  at the value of the  **member** attribute, we can see that it contains the DN of the referenced user. This  corresponds to the **distinguishedName** attribute in our user object. Accordingly will have to set the value of the `Group Member User Attribute` parameter to this attribute.
-
-In the same way, we can observe that the value in the **memberOf** attribute in the user object corresponds to the **distinguishedName** [5] of the group. We therefore need to set the value for the `Group DN Attribute` parameter to this attribute.
-
-## Annex: Troubleshooting
-
-If you are experiencing issues while testing the connection to the Active Directory server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
deleted file mode 100644
index 7353942296a..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/azure-ad/_index.md
+++ /dev/null
@@ -1,204 +0,0 @@
----
-title: Configuring Azure AD
-weight: 5
----
-
-If you have an instance of Active Directory (AD) hosted in Azure, you can configure Rancher to allow your users to log in using their AD accounts. Configuration of Azure AD external authentication requires you to make configurations in both Azure and Rancher.
-
->**Note:** Azure AD integration only supports Service Provider initiated logins.
-
->**Prerequisite:** Have an instance of Azure AD configured.
-
->**Note:** Most of this procedure takes place from the [Microsoft Azure Portal](https://portal.azure.com/).
-
-## Azure Active Directory Configuration Outline
-
-Configuring Rancher to allow your users to authenticate with their Azure AD accounts involves multiple procedures. Review the outline below before getting started.
-
-<a id="tip"></a>
-
->**Tip:** Before you start, we recommend creating an empty text file. You can use this file to copy values from Azure that you'll paste into Rancher later.
-
-<!-- TOC -->
-
-- [1. Register Rancher with Azure](#1-register-rancher-with-azure)
-- [2. Create an Azure API Key](#2-create-an-azure-api-key)
-- [3. Set Required Permissions for Rancher](#3-set-required-permissions-for-rancher)
-- [4. Copy Azure Application Data](#4-copy-azure-application-data)
-- [5. Configure Azure AD in Rancher](#5-configure-azure-ad-in-rancher)
-
-<!-- /TOC -->
-
-### 1. Register Rancher with Azure
-
-Before enabling Azure AD within Rancher, you must register Rancher with Azure.
-
-1. Log in to [Microsoft Azure](https://portal.azure.com/) as an administrative user. Configuration in future steps requires administrative access rights.
-
-1. Use search to open the **App registrations** service.
-
-    ![Open App Registrations]({{<baseurl>}}/img/rancher/search-app-registrations.png)
-
-1. Click **New registrations** and complete the **Create** form.
-
-    ![New App Registration]({{<baseurl>}}/img/rancher/new-app-registration.png)
-
-    1. Enter a **Name** (something like `Rancher`).
-
-    1. From **Supported account types**, select "Accounts in this organizational directory only (AzureADTest only - Single tenant)" This corresponds to the legacy app registration options.
-
-    1. In the **Redirect URI** section, make sure **Web** is selected from the dropdown and enter the URL of your Rancher Server in the text box next to the dropdown. This Rancher server URL should be appended with the verification path: `<MY_RANCHER_URL>/verify-auth-azure`.
-
-       >**Tip:** You can find your personalized Azure reply URL in Rancher on the Azure AD Authentication page (Global View > Security Authentication > Azure AD).
-
-    1. Click **Register**.
-
->**Note:** It can take up to five minutes for this change to take affect, so don't be alarmed if you can't authenticate immediately after Azure AD configuration.
-
-### 2. Create a new client secret
-
-From the Azure portal, create a client secret. Rancher will use this key to authenticate with Azure AD.
-
-1. Use search to open **App registrations** services. Then open the entry for Rancher that you created in the last procedure.
-
-     ![Open Rancher Registration]({{<baseurl>}}/img/rancher/open-rancher-app.png)
-
-1. From the navigation pane on left, click **Certificates and Secrets**.
-
-1. Click **New client secret**.
-
-     ![Create new client secret]({{< baseurl >}}/img/rancher/select-client-secret.png)
-
-    1. Enter a **Description** (something like `Rancher`).
-
-    1. Select duration for the key from the options under **Expires**. This drop-down sets the expiration date for the key. Shorter durations are more secure, but require you to create a new key after expiration.
-
-    1. Click **Add** (you don't need to enter a value—it will automatically populate after you save).
-<a id="secret"></a>
-
-1.  Copy the key value and save it to an [empty text file](#tip).
-
-    You'll enter this key into the Rancher UI later as your **Application Secret**.
-
-    You won't be able to access the key value again within the Azure UI.
-
-### 3. Set Required Permissions for Rancher
-
-Next, set API permissions for Rancher within Azure.
-
-1. From the navigation pane on left, select **API permissions**.
-
-    ![Open Required Permissions]({{<baseurl>}}/img/rancher/select-required-permissions.png)
-
-1. Click **Add a permission**.
-
-1. From the **Azure Active Directory Graph**, select the following **Delegated Permissions**:
-
-    ![Select API Permissions]({{< baseurl >}}/img/rancher/select-required-permissions-2.png)
-
-    <br/>
-    <br/>
-    - **Access the directory as the signed-in user**
-    - **Read directory data**
-    - **Read all groups**
-    - **Read all users' full profiles**
-    - **Read all users' basic profiles**
-    - **Sign in and read user profile**
-
-1. Click **Add permissions**.
-
-1. From **API permissions**, click **Grant admin consent**. Then click **Yes**.
-
-    >**Note:** You must be signed in as an Azure administrator to successfully save your permission settings.
-
-
-### 4. Add a Reply URL
-
-To use Azure AD with Rancher you must whitelist Rancher with Azure. You can complete this whitelisting by providing Azure with a reply URL for Rancher, which is your Rancher Server URL followed with a verification path.
-
-
-1. From the **Setting** blade, select **Reply URLs**.
-
-    ![Azure: Enter Reply URL]({{<baseurl>}}/img/rancher/enter-azure-reply-url.png)
-
-1. From the **Reply URLs** blade, enter the URL of your Rancher Server, appended with the verification path: `<MY_RANCHER_URL>/verify-auth-azure`.
-
-       >**Tip:** You can find your personalized Azure reply URL in Rancher on the Azure AD Authentication page (Global View > Security Authentication > Azure AD).
-
-1. Click **Save**.
-
-**Result:** Your reply URL is saved.
-
->**Note:** It can take up to five minutes for this change to take affect, so don't be alarmed if you can't authenticate immediately after Azure AD configuration.
-
-### 5. Copy Azure Application Data
-
-As your final step in Azure, copy the data that you'll use to configure Rancher for Azure AD authentication and paste it into an empty text file.
-
-1. Obtain your Rancher **Tenant ID**.
-
-    1. Use search to open the **Azure Active Directory** service.
-
-         ![Open Azure Active Directory]({{<baseurl>}}/img/rancher/search-azure-ad.png)
-
-    1. From the left navigation pane, open **Overview**.
-
-    2. Copy the **Directory ID** and paste it into your [text file](#tip).
-
-        You'll paste this value into Rancher as your **Tenant ID**.
-
-1. Obtain your Rancher **Application ID**.
-
-    1. Use search to open **App registrations**.
-
-         ![Open App Registrations]({{<baseurl>}}/img/rancher/search-app-registrations.png)
-
-    1. Find the entry you created for Rancher.
-
-    1. Copy the **Application ID** and paste it to your [text file](#tip).
-
-1. Obtain your Rancher **Graph Endpoint**, **Token Endpoint**, and **Auth Endpoint**.
-
-    1. From **App registrations**, click **Endpoints**.
-
-        ![Click Endpoints]({{<baseurl>}}/img/rancher/click-endpoints.png)
-
-    2. Copy the following endpoints to your clipboard and paste them into your [text file](#tip) (these values will be your Rancher endpoint values).
-    
-        - **Microsoft Graph API endpoint** (Graph Endpoint)
-        - **OAuth 2.0 token endpoint (v1)** (Token Endpoint)
-        - **OAuth 2.0 authorization endpoint (v1)** (Auth Endpoint)
-        
->**Note:** Copy the v1 version of the endpoints
-
-### 5. Configure Azure AD in Rancher
-
-From the Rancher UI, enter information about your AD instance hosted in Azure to complete configuration.
-
-Enter the values that you copied to your [text file](#tip).
-
-1. Log into Rancher. From the **Global** view, select **Security > Authentication**.
-
-1. Select **Azure AD**.
-
-1. Complete the **Configure Azure AD Account** form using the information you copied while completing [Copy Azure Application Data](#5-copy-azure-application-data).
-
-    >**Important:** When entering your Graph Endpoint, remove the tenant ID from the URL, like below.
-    >
-    ><code>http<span>s://g</span>raph.windows.net/<del>abb5adde-bee8-4821-8b03-e63efdc7701c</del></code>
-
-    The following table maps the values you copied in the Azure portal to the fields in Rancher.
-
-    | Rancher Field      | Azure Value                           |
-    | ------------------ | ------------------------------------- |
-    | Tenant ID          | Directory ID                          |
-    | Application ID     | Application ID                        |
-    | Application Secret | Key Value                             |
-    | Endpoint           | https://login.microsoftonline.com/    |
-    | Graph Endpoint     | Microsoft Azure AD Graph API Endpoint |
-    | Token Endpoint     | OAuth 2.0 Token Endpoint              |
-    | Auth Endpoint      | OAuth 2.0 Authorization Endpoint      |
-
-1. Click **Authenticate with Azure**.
-
-**Result:** Azure Active Directory authentication is configured.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
deleted file mode 100644
index 8090d483fa6..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/freeipa/_index.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: Configuring FreeIPA
-weight: 4
----
-
-If your organization uses FreeIPA for user authentication, you can configure Rancher to allow your users to login using their FreeIPA credentials.
-
->**Prerequisites:**
->
->- You must have a [FreeIPA Server](https://www.freeipa.org/) configured.
->- Create a service account in FreeIPA with `read-only` access. Rancher uses this account to verify group membership when a user makes a request using an API key.
->- Read [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
-
-1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
-
-2.	From the **Global** view, select **Security > Authentication** from the main menu.
-
-3.	Select **FreeIPA**.
-
-4.	Complete the **Configure an FreeIPA server** form.
-
-	You may need to log in to your domain controller to find the information requested in the form.
-
-	>**Using TLS?**
- 	>If the certificate is self-signed or not from a recognized certificate authority, make sure you provide the complete chain. That chain is needed to verify the server's certificate.
-	<br/>
-	<br/>
-	>**User Search Base vs. Group Search Base**
-	>
-	>Search base allows Rancher to search for users and groups that are in your FreeIPA.  These fields are only for search bases and not for search filters.
-	>
-	>* If your users and groups are in the same search base, complete only the User Search Base.
-	>* If your groups are in a different search base, you can optionally complete the Group Search Base. This field is dedicated to searching groups, but is not required.
-
-5.	If your FreeIPA deviates from the standard AD schema, complete the **Customize Schema** form to match it. Otherwise, skip this step.
-
-	>**Search Attribute** The Search Attribute field defaults with three specific values: `uid|sn|givenName`. After FreeIPA is configured, when a user enters text to add users or groups, Rancher automatically queries the FreeIPA server and attempts to match fields by user id, last name, or first name. Rancher specifically searches for users/groups that begin with the text entered in the search field.
-	>
-	>The default field value `uid|sn|givenName`, but you can configure this field to a subset of these fields. The pipe (`|`) between the fields separates these fields.
-	>
-	> * `uid`: User ID
-	> * `sn`: Last Name
-	> * `givenName`: First Name
-	>
-	> With this search attribute, Rancher creates search filters for users and groups, but you *cannot* add your own search filters in this field.
-
-6.	Enter your FreeIPA username and password in **Authenticate with FreeIPA** to confirm that Rancher is configured to use FreeIPA authentication.
-
-**Result:**
-
-- FreeIPA authentication is configured.
-- You are signed into Rancher with your FreeIPA account (i.e., the _external principal_).
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/github/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/github/_index.md
deleted file mode 100644
index fbd5a0cd90a..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/github/_index.md
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: Configuring GitHub
-weight: 6
----
-
-In environments using GitHub, you can configure Rancher to allow sign on using GitHub credentials.
-
->**Prerequisites:** Read [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
-
-1.  Sign into Rancher using a local user assigned the `administrator` role (i.e., the _local principal_).
-
-2.	From the **Global** view, select **Security > Authentication** from the main menu.
-
-3.	Select **GitHub**.
-
-4.	Follow the directions displayed to **Setup a GitHub Application**. Rancher redirects you to GitHub to complete registration.
-
-	>**What's an Authorization Callback URL?**
-	>
-	>The Authorization Callback URL is the URL where users go to begin using your application (i.e. the splash screen).
-
-	>When you use external authentication, authentication does not actually take place in your application. Instead, authentication takes place externally (in this case, GitHub). After this external authentication completes successfully, the Authorization Callback URL is the location where the user re-enters your application.
-
-5. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.
-
-	>**Where do I find the Client ID and Client Secret?**
-	>
-	>From GitHub, select Settings > Developer Settings > OAuth Apps. The Client ID and Client Secret are displayed prominently.
-
-6.	Click **Authenticate with GitHub**.
-
-7.	Use the **Site Access** options to configure the scope of user authorization.
-
-	-	**Allow any valid Users**
-
-		_Any_ GitHub user can access Rancher. We generally discourage use of this setting!
-
-	-	**Allow members of Clusters, Projects, plus Authorized Users and Organizations**
-
-		Any GitHub user or group added as a **Cluster Member** or **Project Member** can log in to Rancher. Additionally, any GitHub user or group you add to the **Authorized Users and Organizations** list may log in to Rancher.
-
-	-	**Restrict access to only Authorized Users and Organizations**
-
-		Only GitHub users or groups added to the Authorized Users and Organizations can log in to Rancher.
-		<br/>
-8.	Click **Save**.
-
-**Result:**
-
-- GitHub authentication is configured.
-- You are signed into Rancher with your GitHub account (i.e., the _external principal_).
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
deleted file mode 100644
index 1c77c5354b2..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/google/_index.md
+++ /dev/null
@@ -1,106 +0,0 @@
----
-title: Configuring Google OAuth
-weight: 12
----
-
-If your organization uses G Suite for user authentication, you can configure Rancher to allow your users to log in using their G Suite credentials.
-
-Only admins of the G Suite domain have access to the Admin SDK. Therefore, only G Suite admins can configure Google OAuth for Rancher.
-
-Within Rancher, only administrators or users with the **Manage Authentication** [global role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) can configure authentication.
-
-# Prerequisites
-- You must have a [G Suite admin account](https://admin.google.com) configured.
-- G Suite requires a [top private domain FQDN](https://github.com/google/guava/wiki/InternetDomainNameExplained#public-suffixes-and-private-domains) as an authorized domain. One way to get an FQDN is by creating an A-record in Route53 for your Rancher server. You do not need to update your Rancher Server URL setting with that record, because there could be clusters using that URL.
-- You must have the Admin SDK API enabled for your G Suite domain. You can enable it using the steps on [this page.](https://support.google.com/a/answer/60757?hl=en)
-
-After the Admin SDK API is enabled, your G Suite domain's API screen should look like this:
-![Enable Admin APIs]({{<baseurl>}}/img/rancher/Google-Enable-APIs-Screen.png)
-
-# Setting up G Suite for OAuth with Rancher
-Before you can set up Google OAuth in Rancher, you need to log in to your G Suite account and do the following:
-
-1. [Add Rancher as an authorized domain in G Suite](#1-adding-rancher-as-an-authorized-domain)
-1. [Generate OAuth2 credentials for the Rancher server](#2-creating-oauth2-credentials-for-the-rancher-server)
-1. [Create service account credentials for the Rancher server](#3-creating-service-account-credentials)
-1. [Register the service account key as an OAuth Client](#4-register-the-service-account-key-as-an-oauth-client)
-
-### 1. Adding Rancher as an Authorized Domain
-1. Click [here](https://console.developers.google.com/apis/credentials) to go to credentials page of your Google domain.
-1. Select your project and click **OAuth consent screen.**
-![OAuth Consent Screen]({{<baseurl>}}/img/rancher/Google-OAuth-consent-screen-tab.png)
-1. Go to **Authorized Domains** and enter the top private domain of your Rancher server URL in the list. The top private domain is the rightmost superdomain. So for example, www.foo.co.uk a top private domain of foo.co.uk. For more information on top-level domains, refer to [this article.](https://github.com/google/guava/wiki/InternetDomainNameExplained#public-suffixes-and-private-domains)
-1. Go to **Scopes for Google APIs** and make sure **email,** **profile** and **openid** are enabled.
-
-**Result:** Rancher has been added as an authorized domain for the Admin SDK API.
-
-### 2. Creating OAuth2 Credentials for the Rancher Server
-1. Go to the Google API console, select your project, and go to the [credentials page.](https://console.developers.google.com/apis/credentials)
-![Credentials]({{<baseurl>}}/img/rancher/Google-Credentials-tab.png)
-1. On the **Create Credentials** dropdown, select **OAuth client ID.**
-1. Click **Web application.**
-1. Provide a name.
-1. Fill out the **Authorized JavaScript origins** and **Authorized redirect URIs.** Note: The Rancher UI page for setting up Google OAuth (available from the Global view under **Security > Authentication > Google**) provides you the exact links to enter for this step.
- - Under **Authorized JavaScript origins,** enter your Rancher server URL.
- - Under **Authorized redirect URIs,** enter your Rancher server URL appended with the path `verify-auth`. For example, if your URI is `https://rancherServer`, you will enter `https://rancherServer/verify-auth`.
-1. Click on **Create.**
-1. After the credential is created, you will see a screen with a list of your credentials. Choose the credential you just created, and in that row on rightmost side, click **Download JSON.** Save the file so that you can provide these credentials to Rancher.
-
-**Result:** Your OAuth credentials have been successfully created.
-
-### 3. Creating Service Account Credentials
-Since the Google Admin SDK is available only to admins, regular users cannot use it to retrieve profiles of other users or their groups. Regular users cannot even retrieve their own groups.
-
-Since Rancher provides group-based membership access, we require the users to be able to get their own groups, and look up other users and groups when needed.
-
-As a workaround to get this capability, G Suite recommends creating a service account and delegating authority of your G Suite domain to that service account.
-
-This section describes how to:
-
-- Create a service account
-- Create a key for the service account and download the credentials as JSON
-
-1. Click [here](https://console.developers.google.com/iam-admin/serviceaccounts) and select your project for which you generated OAuth credentials.
-1. Click on **Create Service Account.**
-1. Enter a name and click **Create.**
-![Service account creation Step 1]({{<baseurl>}}/img/rancher/Google-svc-acc-step1.png)
-1. Don't provide any roles on the **Service account permissions** page and click **Continue**
-![Service account creation Step 2]({{<baseurl>}}/img/rancher/Google-svc-acc-step2.png)
-1. Click on **Create Key** and select the JSON option. Download the JSON file and save it so that you can provide it as the service account credentials to Rancher.
-![Service account creation Step 3]({{<baseurl>}}/img/rancher/Google-svc-acc-step3-key-creation.png)
-
-**Result:** Your service account is created.
-
-### 4. Register the Service Account Key as an OAuth Client
-
-You will need to grant some permissions to the service account you created in the last step. Rancher requires you to grant only read-only permissions for users and groups.
-
-Using the Unique ID of the service account key, register it as an Oauth Client using the following steps:
-
-1. Get the Unique ID of the key you just created. If it's not displayed in the list of keys right next to the one you created, you will have to enable it. To enable it, click **Unique ID** and click **OK.** This will add a **Unique ID** column to the list of service account keys. Save the one listed for the service account you created. NOTE: This is a numeric key, not to be confused with the alphanumeric field **Key ID.**
-
-	![Service account Unique ID]({{<baseurl>}}/img/rancher/Google-Select-UniqueID-column.png)
-1. Go to the [**Manage OAuth Client Access** page.](https://admin.google.com/AdminHome?chromeless=1#OGX:ManageOauthClients)
-1. Add the Unique ID obtained in the previous step in the **Client Name** field.
-1. In the **One or More API Scopes** field, add the following scopes:
-	```
-	openid,profile,email,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly
-	```
-1. Click **Authorize.**
-
-**Result:** The service account is registered as an OAuth client in your G Suite account.
-
-# Configuring Google OAuth in Rancher
-1. Sign into Rancher using a local user assigned the [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions) role. This user is also called the local principal.
-1.	From the **Global** view, click **Security > Authentication** from the main menu.
-1. Click **Google.** The instructions in the UI cover the steps to set up authentication with Google OAuth.
-	1. Admin Email: Provide the email of an administrator account from your GSuite setup. In order to perform user and group lookups, google apis require an administrator's email in conjunction with the service account key.
-	1. Domain: Provide the domain on which you have configured GSuite. Provide the exact domain and not any aliases.
-	1. Nested Group Membership: Check this box to enable nested group memberships. Rancher admins can disable this at any time after configuring auth.
-   - **Step One** is about adding Rancher as an authorized domain, which we already covered in [this section.](#1-adding-rancher-as-an-authorized-domain)
-   - For **Step Two,** provide the OAuth credentials JSON that you downloaded after completing [this section.](#2-creating-oauth2-credentials-for-the-rancher-server) You can upload the file or paste the contents into the **OAuth Credentials** field.
-   - For **Step Three,** provide the service account credentials JSON that downloaded at the end of [this section.](#3-creating-service-account-credentials) The credentials will only work if you successfully [registered the service account key](#4-register-the-service-account-key-as-an-oauth-client) as an OAuth client in your G Suite account.
-1.	Click **Authenticate with Google**.
-1.	Click **Save**.
-
-**Result:** Google authentication is successfully configured.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
deleted file mode 100644
index f73660636f0..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/keycloak/_index.md
+++ /dev/null
@@ -1,119 +0,0 @@
----
-title: Configuring Keycloak (SAML)
-description: Create a Keycloak SAML client and configure Rancher to work with Keycloak. By the end your users will be able to sign into Rancher using their Keycloak logins
-weight: 7
----
-
-If your organization uses Keycloak Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
-
-## Prerequisites
-
-- You must have a [Keycloak IdP Server](https://www.keycloak.org/docs/latest/server_installation/) configured.
-- In Keycloak, create a [new SAML client](https://www.keycloak.org/docs/latest/server_admin/#saml-clients), with the settings below. See the [Keycloak documentation](https://www.keycloak.org/docs/latest/server_admin/#saml-clients) for help.
-
-     Setting | Value
-     ------------|------------
-      `Sign Documents` | `ON` <sup>1</sup>
-      `Sign Assertions` | `ON` <sup>1</sup>
-      All other `ON/OFF` Settings | `OFF`
-      `Client ID` | `https://yourRancherHostURL/v1-saml/keycloak/saml/metadata`<sup>2</sup>
-      `Client Name` | <CLIENT_NAME> (e.g. `rancher`)
-      `Client Protocol` | `SAML`
-      `Valid Redirect URI` | `https://yourRancherHostURL/v1-saml/keycloak/saml/acs`
-
-      ><sup>1</sup>: Optionally, you can enable either one or both of these settings.
-      ><sup>2</sup>: Rancher SAML metadata won't be generated until a SAML provider is configured and saved.
-- Export a `metadata.xml` file from your Keycloak client:
-  From the `Installation` tab, choose the `SAML Metadata IDPSSODescriptor` format option and download your file.
-
-
-## Configuring Keycloak in Rancher
-
-
-1.	From the **Global** view, select **Security > Authentication** from the main menu.
-
-1.	Select **Keycloak**.
-
-1.	Complete the **Configure Keycloak Account** form. Keycloak IdP lets you specify what data store you want to use. You can either add a database or use an existing LDAP server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher.
-
-
-    | Field                     | Description                                                                   |
-    | ------------------------- | ----------------------------------------------------------------------------- |
-    | Display Name Field        | The AD attribute that contains the display name of users.                     |
-    | User Name Field           | The AD attribute that contains the user name/given name.                      |
-    | UID Field                 | An AD attribute that is unique to every user.                                 |
-    | Groups Field              | Make entries for managing group memberships.                                  |
-    | Rancher API Host          | The URL for your Rancher Server.                                              |
-    | Private Key / Certificate | A key/certificate pair to create a secure shell between Rancher and your IdP. |
-    | IDP-metadata              | The `metadata.xml` file that you exported from your IdP server.               |
-
-    >**Tip:** You can generate a key/certificate pair using an openssl command. For example:
-    >
-    >        openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.cert
-
-
-1. After you complete the **Configure Keycloak Account** form, click **Authenticate with Keycloak**, which is at the bottom of the page.
-
-    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Keycloak IdP to validate your Rancher Keycloak configuration.
-
-    >**Note:** You may have to disable your popup blocker to see the IdP login page.
-
-**Result:** Rancher is configured to work with Keycloak. Your users can now sign into Rancher using their Keycloak logins.
-
-{{< saml_caveats >}}
-
-## Annex: Troubleshooting
-
-If you are experiencing issues while testing the connection to the Keycloak server, first double-check the configuration option of your SAML client. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
-
-### You are not redirected to Keycloak
-
-When you click on **Authenticate with Keycloak**, your are not redirected to your IdP.
-
-  * Verify your Keycloak client configuration.
-  * Make sure `Force Post Binding` set to `OFF`.
-
-
-### Forbidden message displayed after IdP login
-
-You are correctly redirected to your IdP login page and you are able to enter your credentials, however you get a `Forbidden` message afterwards.
-
-  * Check the Rancher debug log.
-  * If the log displays `ERROR: either the Response or Assertion must be signed`, make sure either `Sign Documents` or `Sign assertions` is set to `ON` in your Keycloak client.
-
-### HTTP 502 when trying to access /v1-saml/keycloak/saml/metadata
-
-This is usually due to the metadata not being created until a SAML provider is configured.
-Try configuring and saving keycloak as your SAML provider and then accessing the metadata.
-
-### Keycloak Error: "We're sorry, failed to process response"
-
-  * Check your Keycloak log.
-  * If the log displays `failed: org.keycloak.common.VerificationException: Client does not have a public key`, set `Encrypt Assertions` to `OFF` in your Keycloak client.
-
-### Keycloak Error: "We're sorry, invalid requester"
-
-  * Check your Keycloak log.
-  * If the log displays `request validation failed: org.keycloak.common.VerificationException: SigAlg was null`, set `Client Signature Required` to `OFF` in your Keycloak client.
-
-### Keycloak 6.0.0+: IDPSSODescriptor missing from options
-
-Keycloak versions 6.0.0 and up no longer provide the IDP metadata under the `Installation` tab.
-You can still get the XML from the following url:
-
-`https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}/protocol/saml/descriptor`
-
-The XML obtained from this URL contains `EntitiesDescriptor` as the root element. Rancher expects the root element to be `EntityDescriptor` rather than `EntitiesDescriptor`. So before passing this XML to Rancher, follow these steps to adjust it:
-
-  * Copy all the tags from `EntitiesDescriptor` to the `EntityDescriptor`.
-  * Remove the `<EntitiesDescriptor>` tag from the beginning.
-  * Remove the `</EntitiesDescriptor>` from the end of the xml.
-
-You are left with something similar as the example below:
-
-```
-<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" entityID="https://{KEYCLOAK-URL}/auth/realms/{REALM-NAME}">
-  ....
-
-</EntityDescriptor>
-```
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/local/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/local/_index.md
deleted file mode 100644
index 8f973b8e26f..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/local/_index.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-title: Local Authentication
-weight: 1
----
-
-Local authentication is the default until you configure an external authentication provider. Local authentication is where Rancher stores the user information, i.e. names and passwords, of who can log in to Rancher. By default, the `admin` user that logs in to Rancher for the first time is a local user.
-
-## Adding Local Users
-
-Regardless of whether you use external authentication, you should create a few local authentication users so that you can continue using Rancher if your external authentication service encounters issues.
-
-1.	From the **Global** view, select **Users** from the navigation bar.
-
-2.	Click **Add User**. Then complete the **Add User** form. Click **Create** when you're done.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
deleted file mode 100644
index 8ddd77b8d85..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/_index.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Configuring Microsoft Active Directory Federation Service (SAML)
-weight: 9
----
-
-If your organization uses Microsoft Active Directory Federation Services (AD FS) for user authentication, you can configure Rancher to allow your users to log in using their AD FS credentials.
-
-## Prerequisites
-
-
-- You must have Rancher installed.
-
-  - Obtain your Rancher Server URL. During AD FS configuration, substitute this URL for the `<RANCHER_SERVER>` placeholder.
-
-  - You must have a global administrator account on your Rancher installation.
-
-- You must have a [Microsoft AD FS Server](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) configured.
-
-	- Obtain your AD FS Server IP/DNS name. During AD FS configuration, substitute this IP/DNS name for the `<AD_SERVER>` placeholder.
-
-	- You must have access to add [Relying Party Trusts](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust) on your AD FS Server.
-
-
-
-## Setup Outline
-
-Setting up Microsoft AD FS with Rancher Server requires configuring AD FS on your Active Directory server, and configuring Rancher to utilize your AD FS server. The following pages serve as guides for setting up Microsoft AD FS authentication on your Rancher installation.
-
-- [1 — Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup)
-- [2 — Configuring Rancher for Microsoft AD FS]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup)
-
-{{< saml_caveats >}}
-
-
-### [Next: Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup)
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
deleted file mode 100644
index 152834ec60c..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/microsoft-adfs-setup/_index.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: 1 — Configuring Microsoft AD FS for Rancher
-weight: 1205
----
-
-Before configuring Rancher to support AD FS users, you must add Rancher as a [relying party trust](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/understanding-key-ad-fs-concepts) in AD FS. 
-
-1. Log into your AD server as an administrative user.
-
-1. Open the **AD FS Management** console. Select **Add Relying Party Trust...** from the **Actions** menu and click **Start**.
-  
-    {{< img "/img/rancher/adfs/adfs-overview.png" "">}}
-
-1. Select **Enter data about the relying party manually** as the option for obtaining data about the relying party.
-
-    {{< img "/img/rancher/adfs/adfs-add-rpt-2.png" "">}}
-    
-1. Enter your desired **Display name** for your Relying Party Trust. For example, `Rancher`.
-
-    {{< img "/img/rancher/adfs/adfs-add-rpt-3.png" "">}}
-  
-1. Select **AD FS profile** as the configuration profile for your relying party trust.
-  
-    {{< img "/img/rancher/adfs/adfs-add-rpt-4.png" "">}}
-  
-1. Leave the **optional token encryption certificate** empty, as Rancher AD FS will not be using one.
-  
-  {{< img "/img/rancher/adfs/adfs-add-rpt-5.png" "">}}
-  
-1. Select **Enable support for the SAML 2.0 WebSSO protocol**
-  and enter `https://<rancher-server>/v1-saml/adfs/saml/acs` for the service URL.
-  
-  {{< img "/img/rancher/adfs/adfs-add-rpt-6.png" "">}}
-  
-1. Add `https://<rancher-server>/v1-saml/adfs/saml/metadata` as the **Relying party trust identifier**.
-  
-    {{< img "/img/rancher/adfs/adfs-add-rpt-7.png" "">}}
-  
-1. This tutorial will not cover multi-factor authentication; please refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs) if you would like to configure multi-factor authentication.
-  
-    {{< img "/img/rancher/adfs/adfs-add-rpt-8.png" "">}}
-  
-1. From **Choose Issuance Authorization RUles**, you may select either of the options available according to use case. However, for the purposes of this guide, select **Permit all users to access this relying party**.
-  
-    {{< img "/img/rancher/adfs/adfs-add-rpt-9.png" "">}}
-
-1. After reviewing your settings, select **Next** to add the relying party trust.
-  
-    {{< img "/img/rancher/adfs/adfs-add-rpt-10.png" "">}}
-
-  
-1. Select **Open the Edit Claim Rules...** and click **Close**.
-  
-    {{< img "/img/rancher/adfs/adfs-add-rpt-11.png" "">}}
-  
-1. On the **Issuance Transform Rules** tab, click **Add Rule...**.
-  
-    {{< img "/img/rancher/adfs/adfs-edit-cr.png" "">}}
-  
-1. Select **Send LDAP Attributes as Claims** as the **Claim rule template**.
-
-    {{< img "/img/rancher/adfs/adfs-add-tcr-1.png" "">}}
-  
-1. Set the **Claim rule name** to your desired name (for example, `Rancher Attributes`) and select **Active Directory** as the **Attribute store**. Create the following mapping to reflect the table below:
-
-    | LDAP Attribute                               | Outgoing Claim Type |
-    | -------------------------------------------- | ------------------- |
-    | Given-Name                                   | Given Name          |
-    | User-Principal-Name                          | UPN                 |
-    | Token-Groups - Qualified by Long Domain Name | Group               |
-    | SAM-Account-Name                             | Name                |
-    <br/>
-    {{< img "/img/rancher/adfs/adfs-add-tcr-2.png" "">}}
-
-1. Download the `federationmetadata.xml` from your AD server at: 
-```
-https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml
-```
-
-**Result:** You've added Rancher as a relying trust party. Now you can configure Rancher to leverage AD.
-
-### [Next: Configuring Rancher for Microsoft AD FS]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/rancher-adfs-setup/)
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
deleted file mode 100644
index 3feb62b8581..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/microsoft-adfs/rancher-adfs-setup/_index.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: 2 — Configuring Rancher for Microsoft AD FS
-weight: 1205
----
-
-After you complete [Configuring Microsoft AD FS for Rancher]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/microsoft-adfs/microsoft-adfs-setup/), enter your AD FS information into Rancher to allow AD FS users to authenticate with Rancher.
-
->**Important Notes For Configuring Your AD FS Server:**
-> 
->- The SAML 2.0 WebSSO Protocol Service URL is: `https://<RANCHER_SERVER>/v1-saml/adfs/saml/acs`
->- The Relying Party Trust identifier URL is: `https://<RANCHER_SERVER>/v1-saml/adfs/saml/metadata`
->- You must export the `federationmetadata.xml` file from your AD FS server. This can be found at: `https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml`
-
-
-1.	From the **Global** view, select **Security > Authentication** from the main menu.
-
-1.	Select **Microsoft Active Directory Federation Services**.
-
-1.	Complete the **Configure AD FS Account** form. Microsoft AD FS lets you specify an existing Active Directory (AD) server. The examples below describe how you can map AD attributes to fields within Rancher.
-
-    | Field                     | Description                                                                                                                                                                                                    |
-    | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-    | Display Name Field        | The AD attribute that contains the display name of users. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`                                                                      |
-    | User Name Field           | The AD attribute that contains the user name/given name. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`                                                                  |
-    | UID Field                 | An AD attribute that is unique to every user. <br/><br/>Example: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn`                                                                                   |
-    | Groups Field              | Make entries for managing group memberships. <br/><br/>Example: `http://schemas.xmlsoap.org/claims/Group`                                                                                                      |
-    | Rancher API Host          | The URL for your Rancher Server.                                                                                                                                                                               |
-    | Private Key / Certificate | This is a key-certificate pair to create a secure shell between Rancher and your AD FS. Ensure you set the Common Name (CN) to your Rancher Server URL.<br/><br/>[Certificate creation command](#cert-command) |
-    | Metadata XML              | The `federationmetadata.xml` file exported from your AD FS server. <br/><br/>You can find this file at `https://<AD_SERVER>/federationmetadata/2007-06/federationmetadata.xml`.                                |
-    <a id="cert-command"></a>    
-
-    >**Tip:** You can generate a certificate using an openssl command. For example:
-    >
-    >        openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-
-
- 
-1. After you complete the **Configure AD FS Account** form, click **Authenticate with AD FS**, which is at the bottom of the page.
-
-    Rancher redirects you to the AD FS login page. Enter credentials that authenticate with Microsoft AD FS to validate your Rancher AD FS configuration.
-
-    >**Note:** You may have to disable your popup blocker to see the AD FS login page.
-
-**Result:** Rancher is configured to work with MS FS. Your users can now sign into Rancher using their MS FS logins.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
deleted file mode 100644
index 53f37810ab4..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/okta/_index.md
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: Configuring Okta (SAML)
-weight: 10
----
-
-If your organization uses Okta Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
-
->**Note:** Okta integration only supports Service Provider initiated logins.
-
-## Prerequisites
-
-In Okta, create a SAML Application with the settings below. See the [Okta documentation](https://developer.okta.com/standards/SAML/setting_up_a_saml_application_in_okta) for help.
-
-Setting | Value    
-------------|------------
-`Single Sign on URL` | `https://yourRancherHostURL/v1-saml/okta/saml/acs`
-`Audience URI (SP Entity ID)` | `https://yourRancherHostURL/v1-saml/okta/saml/metadata`
-
-## Configuring Okta in Rancher
-
-1.	From the **Global** view, select **Security > Authentication** from the main menu.
-
-1.	Select **Okta**.
-
-1.	Complete the **Configure Okta Account** form. The examples below describe how you can map Okta attributes from attribute statements to fields within Rancher.
-
-    | Field                     | Description                                                                   |
-    | ------------------------- | ----------------------------------------------------------------------------- |
-    | Display Name Field        | The attribute name from an attribute statement that contains the display name of users.                        |
-    | User Name Field           | The attribute name from an attribute statement that contains the user name/given name.                         |
-    | UID Field                 | The attribute name from an attribute statement that is unique to every user.                                    |
-    | Groups Field              | The attribute name in a group attribute statement that exposes your groups.        |
-    | Rancher API Host          | The URL for your Rancher Server.                                              |
-    | Private Key / Certificate | A key/certificate pair used for Assertion Encryption.                         |
-    | Metadata XML              | The `Identity Provider metadata` file that you find in the application `Sign On` section.  |
-
-    >**Tip:** You can generate a key/certificate pair using an openssl command. For example:
-    >    
-    >        openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout myservice.key -out myservice.crt
-
-
-
-1. After you complete the **Configure Okta Account** form, click **Authenticate with Okta**, which is at the bottom of the page.
-
-    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Okta IdP to validate your Rancher Okta configuration.
-
-    >**Note:** If nothing seems to happen, it's likely because your browser blocked the pop-up. Make sure you disable the pop-up blocker for your rancher domain and whitelist it in any other extensions you might utilize.
-
-**Result:** Rancher is configured to work with Okta. Your users can now sign into Rancher using their Okta logins.
-
-{{< saml_caveats >}}
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
deleted file mode 100644
index 3ee68476cab..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/_index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: Configuring OpenLDAP
-weight: 3
----
-
-If your organization uses LDAP for user authentication, you can configure Rancher to communicate with an OpenLDAP server to authenticate users. This allows Rancher admins to control access to clusters and projects based on users and groups managed externally in the organisation's central user repository, while allowing end-users to authenticate with their LDAP credentials when logging in to the Rancher UI. 
-
-## Prerequisites
-
-Rancher must be configured with a LDAP bind account (aka service account) to search and retrieve LDAP entries pertaining to users and groups that should have access. It is recommended to not use an administrator account or personal account for this purpose and instead create a dedicated account in OpenLDAP with read-only access to users and groups under the configured search base (see below).
-
-> **Using TLS?**
->
-> If the certificate used by the OpenLDAP server is self-signed or not from a recognised certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
-
-## Configure OpenLDAP in Rancher
-
-Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.](./openldap-config)
-
-> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
-
-1. Log into the Rancher UI using the initial local `admin` account.
-2. From the **Global** view, navigate to **Security** > **Authentication**
-3. Select **OpenLDAP**. The **Configure an OpenLDAP server** form will be displayed.
-
-### Test Authentication
-
-Once you have completed the configuration, proceed by testing  the connection to the OpenLDAP server. Authentication with OpenLDAP will be enabled implicitly if the test is successful.
-
-> **Note:**
->
-> The OpenLDAP user pertaining to the credentials entered in this step will be mapped to the local principal account and assigned administrator privileges in Rancher. You should therefore make a conscious decision on which LDAP account you use to perform this step.
-
-1. Enter the **username** and **password** for the OpenLDAP account that should be mapped to the local principal account.
-2. Click **Authenticate With OpenLDAP** to test the OpenLDAP connection and finalise the setup.
-
-**Result:**
-
-- OpenLDAP authentication is configured.
-- The LDAP user pertaining to the entered credentials is mapped to the local principal (administrative) account.
-
-> **Note:**
->
-> You will still be able to login using the locally configured `admin` account and password in case of a disruption of LDAP services.
-
-## Annex: Troubleshooting
-
-If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/openldap-config/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/openldap-config/_index.md
deleted file mode 100644
index addd6773a60..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/openldap/openldap-config/_index.md
+++ /dev/null
@@ -1,86 +0,0 @@
----
-title: OpenLDAP Configuration Reference
-weight: 2
----
-
-This section is intended to be used as a reference when setting up an OpenLDAP authentication provider in Rancher.
-
-For further details on configuring OpenLDAP, refer to the [official documentation.](https://www.openldap.org/doc/)
-
-> Before you proceed with the configuration, please familiarize yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
-
-- [Background: OpenLDAP Authentication Flow](#background-openldap-authentication-flow)
-- [OpenLDAP server configuration](#openldap-server-configuration)
-- [User/group schema configuration](#user-group-schema-configuration)
-  - [User schema configuration](#user-schema-configuration)
-  - [Group schema configuration](#group-schema-configuration)
-
-## Background: OpenLDAP Authentication Flow 
- 
-1. When a user attempts to login with his LDAP credentials, Rancher creates an initial bind to the LDAP server using a service account with permissions to search the directory and read user/group attributes. 
-2. Rancher then searches the directory for the user by using a search filter based on the provided username and configured attribute mappings. 
-3. Once the user has been found, he is authenticated with another LDAP bind request using the user's DN and provided password. 
-4. Once authentication succeeded, Rancher then resolves the group memberships both from the membership attribute in the user's object and by performing a group search based on the configured user mapping attribute.
-
-# OpenLDAP Server Configuration
-
-You will need to enter the address, port, and protocol to connect to your OpenLDAP server. `389` is the standard port for insecure traffic, `636` for TLS traffic.
-
-> **Using TLS?**
->
-> If the certificate used by the OpenLDAP server is self-signed or not from a recognized certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
-
-If you are in doubt about the correct values to enter in the user/group Search Base configuration fields, consult your LDAP administrator or refer to the section [Identify Search Base and Schema using ldapsearch]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/#annex-identify-search-base-and-schema-using-ldapsearch) in the Active Directory authentication documentation.
-
-<figcaption>OpenLDAP Server Parameters</figcaption>
-
-| Parameter | Description |
-|:--|:--|
-| Hostname | Specify the hostname or IP address of the OpenLDAP server |
-| Port | Specify the port at which the OpenLDAP server is listening for connections. Unencrypted LDAP normally uses the standard port of 389, while LDAPS uses port 636.|
-| TLS | Check this box to enable LDAP over SSL/TLS (commonly known as LDAPS). You will also need to paste in the CA certificate if the server uses a self-signed/enterprise-signed certificate. |
-| Server Connection Timeout | 	The duration in number of seconds that Rancher waits before considering the server unreachable. |
-| Service Account Distinguished Name | Enter the Distinguished Name (DN) of the user that should be used to bind, search and retrieve LDAP entries. (see [Prerequisites](#prerequisites)). |
-| Service Account Password | The password for the service account.  |
-| User Search Base | Enter the Distinguished Name of the node in your directory tree from which to start searching for user objects. All users must be descendents of this base DN. For example: "ou=people,dc=acme,dc=com".|
-| Group Search Base | If your groups live under a different node than the one configured under `User Search Base` you will need to provide the Distinguished Name here. Otherwise leave this field empty. For example: "ou=groups,dc=acme,dc=com".|
-
-# User/Group Schema Configuration
-
-If your OpenLDAP directory deviates from the standard OpenLDAP schema, you must complete the **Customize Schema** section to match it.
-
-Note that the attribute mappings configured in this section are used by Rancher to construct search filters and resolve group membership. It is therefore always recommended to verify that the configuration here matches the schema used in your OpenLDAP.
-
-If you are unfamiliar with the user/group schema used in the OpenLDAP server, consult your LDAP administrator or refer to the section [Identify Search Base and Schema using ldapsearch]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/#annex-identify-search-base-and-schema-using-ldapsearch) in the Active Directory authentication documentation.
-
-### User Schema Configuration
-
-The table below details the parameters for the user schema configuration.
-
-<figcaption>User Schema Configuration Parameters</figcaption>
-
-| Parameter | Description |
-|:--|:--|
-| Object Class | The name of the object class used for user objects in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx) |
-| Username Attribute | The user attribute whose value is suitable as a display name. |
-| Login Attribute | The attribute whose value matches the username part of credentials entered by your users when logging in to Rancher. This is typically `uid`. |
-| User Member Attribute | The user attribute containing the Distinguished Name of groups a user is member of. Usually this is one of `memberOf` or `isMemberOf`. |
-| Search Attribute | When a user enters text to add users or groups in the UI, Rancher queries the LDAP server and attempts to match users by the attributes provided in this setting. Multiple attributes can be specified by separating them with the pipe ("\|") symbol. |
-| User Enabled Attribute | If the schema of your OpenLDAP server supports a user attribute whose value can be evaluated to determine if the account is disabled or locked, enter the name of that attribute. The default OpenLDAP schema does not support this and the field should usually be left empty. |
-| Disabled Status Bitmask | This is the value for a disabled/locked user account. The parameter is ignored if `User Enabled Attribute` is empty. |
-
-### Group Schema Configuration
-
-The table below details the parameters for the group schema configuration.
-
-<figcaption>Group Schema Configuration Parameters<figcaption>
-
-| Parameter | Description |
-|:--|:--|
-| Object Class | The name of the object class used for group entries in your domain. If defined, only specify the name of the object class - *don't* include it in an LDAP wrapper such as &(objectClass=xxxx) |
-| Name Attribute | The group attribute whose value is suitable for a display name. |
-| Group Member User Attribute | The name of the **user attribute** whose format matches the group members in the `Group Member Mapping Attribute`. |
-| Group Member Mapping Attribute | The name of the group attribute containing the members of a group. |
-| Search Attribute | Attribute used to construct search filters when adding groups to clusters or projects in the UI. See description of user schema `Search Attribute`. |
-| Group DN Attribute | The name of the group attribute whose format matches the values in the user's group membership attribute. See  `User Member Attribute`. |
-| Nested Group Membership | This settings defines whether Rancher should resolve nested group memberships. Use only if your organization makes use of these nested memberships (ie. you have groups that contain other groups as members). This option is disabled if you are using Shibboleth. |
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
deleted file mode 100644
index 1deef3746a5..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/ping-federate/_index.md
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: Configuring PingIdentity (SAML)
-weight: 8
----
-
-If your organization uses Ping Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
-
->**Prerequisites:**
->
->- You must have a [Ping IdP Server](https://www.pingidentity.com/) configured.
->- Following are the Rancher Service Provider URLs needed for configuration:
-Metadata URL: `https://<rancher-server>/v1-saml/ping/saml/metadata`
-Assertion Consumer Service (ACS) URL: `https://<rancher-server>/v1-saml/ping/saml/acs`
-Note that these URLs will not return valid data until the authentication configuration is saved in Rancher.
->- Export a `metadata.xml` file from your IdP Server. For more information, see the [PingIdentity documentation](https://documentation.pingidentity.com/pingfederate/pf83/index.shtml#concept_exportingMetadata.html).
-
-1.	From the **Global** view, select **Security > Authentication** from the main menu.
-
-1.	Select **PingIdentity**.
-
-1.	Complete the **Configure Ping Account** form. Ping IdP lets you specify what data store you want to use. You can either add a database or use an existing ldap server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher.
-
-    1. **Display Name Field**: Enter the AD attribute that contains the display name of users (example: `displayName`).
-
-	1. **User Name Field**: Enter the AD attribute that contains the user name/given name (example: `givenName`).
-
-    1. **UID Field**: Enter an AD attribute that is unique to every user (example: `sAMAccountName`, `distinguishedName`).
-
-    1. **Groups Field**: Make entries for managing group memberships (example: `memberOf`).
-
-    1. **Rancher API Host**: Enter the URL for your Rancher Server.
-
-	1. **Private Key** and **Certificate**: This is a key-certificate pair to create a secure shell between Rancher and your IdP.
-
-        You can generate one using an openssl command. For example:
-
-        ```
-        openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-        ```
-    1. **IDP-metadata**: The `metadata.xml` file that you [exported from your IdP server](https://documentation.pingidentity.com/pingfederate/pf83/index.shtml#concept_exportingMetadata.html).
-
-
-1. After you complete the **Configure Ping Account** form, click **Authenticate with Ping**, which is at the bottom of the page.
-
-    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Ping IdP to validate your Rancher PingIdentity configuration.
-
-    >**Note:** You may have to disable your popup blocker to see the IdP login page.
-
-**Result:** Rancher is configured to work with PingIdentity. Your users can now sign into Rancher using their PingIdentity logins.
-
-{{< saml_caveats >}}
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
deleted file mode 100644
index f31a13226fc..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/_index.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: Configuring Shibboleth (SAML)
-weight: 11
----
-
-If your organization uses Shibboleth Identity Provider (IdP) for user authentication, you can configure Rancher to allow your users to log in to Rancher using their Shibboleth credentials.
-
-In this configuration, when Rancher users log in, they will be redirected to the Shibboleth IdP to enter their credentials. After authentication, they will be redirected back to the Rancher UI.
-
-If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then the authenticated user will be able to access resources in Rancher that their groups have permissions for.
-
-> The instructions in this section assume that you understand how Rancher, Shibboleth, and OpenLDAP work together. For a more detailed explanation of how it works, refer to [this page.](./about)
-
-This section covers the following topics:
-
-- [Setting up Shibboleth in Rancher](#setting-up-shibboleth-in-rancher)
-  - [Shibboleth Prerequisites](#shibboleth-prerequisites)
-  - [Configure Shibboleth in Rancher](#configure-shibboleth-in-rancher)
-  - [SAML Provider Caveats](#saml-provider-caveats)
-- [Setting up OpenLDAP in Rancher](#setting-up-openldap-in-rancher)
-  - [OpenLDAP Prerequisites](#openldap-prerequisites)
-  - [Configure OpenLDAP in Rancher](#configure-openldap-in-rancher)
-  - [Troubleshooting](#troubleshooting)
-
-# Setting up Shibboleth in Rancher
-
-### Shibboleth Prerequisites
->
->- You must have a Shibboleth IdP Server configured.
->- Following are the Rancher Service Provider URLs needed for configuration:
-Metadata URL: `https://<rancher-server>/v1-saml/shibboleth/saml/metadata`
-Assertion Consumer Service (ACS) URL: `https://<rancher-server>/v1-saml/shibboleth/saml/acs`
->- Export a `metadata.xml` file from your IdP Server. For more information, see the [Shibboleth documentation.](https://wiki.shibboleth.net/confluence/display/SP3/Home)
-
-### Configure Shibboleth in Rancher
-If your organization uses Shibboleth for user authentication, you can configure Rancher to allow your users to log in using their IdP credentials.
-
-1.	From the **Global** view, select **Security > Authentication** from the main menu.
-
-1.	Select **Shibboleth**.
-
-1.	Complete the **Configure Shibboleth Account** form. Shibboleth IdP lets you specify what data store you want to use. You can either add a database or use an existing ldap server. For example, if you select your Active Directory (AD) server, the examples below describe how you can map AD attributes to fields within Rancher.
-
-    1. **Display Name Field**: Enter the AD attribute that contains the display name of users (example: `displayName`).
-
-	1. **User Name Field**: Enter the AD attribute that contains the user name/given name (example: `givenName`).
-
-    1. **UID Field**: Enter an AD attribute that is unique to every user (example: `sAMAccountName`, `distinguishedName`).
-
-    1. **Groups Field**: Make entries for managing group memberships (example: `memberOf`).
-
-    1. **Rancher API Host**: Enter the URL for your Rancher Server.
-
-	1. **Private Key** and **Certificate**: This is a key-certificate pair to create a secure shell between Rancher and your IdP.
-
-        You can generate one using an openssl command. For example:
-
-        ```
-        openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-        ```
-    1. **IDP-metadata**: The `metadata.xml` file that you exported from your IdP server.
-
-
-1. After you complete the **Configure Shibboleth Account** form, click **Authenticate with Shibboleth**, which is at the bottom of the page.
-
-    Rancher redirects you to the IdP login page. Enter credentials that authenticate with Shibboleth IdP to validate your Rancher Shibboleth configuration.
-
-    >**Note:** You may have to disable your popup blocker to see the IdP login page.
-
-**Result:** Rancher is configured to work with Shibboleth. Your users can now sign into Rancher using their Shibboleth logins.
-
-### SAML Provider Caveats
-
-If you configure Shibboleth without OpenLDAP, the following caveats apply due to the fact that SAML Protocol does not support search or lookup for users or groups.
-
-- There is no validation on users or groups when assigning permissions to them in Rancher.
-- When adding users, the exact user IDs (i.e. UID Field) must be entered correctly. As you type the user ID, there will be no search for other user IDs that may match.
-- When adding groups, you must select the group from the drop-down that is next to the text box. Rancher assumes that any input from the text box is a user.
-- The group drop-down shows only the groups that you are a member of. You will not be able to add groups that you are not a member of.
-
-To enable searching for groups when assigning permissions in Rancher, you will need to configure a back end for the SAML provider that supports groups, such as OpenLDAP.
-
-# Setting up OpenLDAP in Rancher
-
-If you also configure OpenLDAP as the back end to Shibboleth, it will return a SAML assertion to Rancher with user attributes that include groups. Then authenticated users will be able to access resources in Rancher that their groups have permissions for.
-
-### OpenLDAP Prerequisites
-
-Rancher must be configured with a LDAP bind account (aka service account) to search and retrieve LDAP entries pertaining to users and groups that should have access. It is recommended to not use an administrator account or personal account for this purpose and instead create a dedicated account in OpenLDAP with read-only access to users and groups under the configured search base (see below).
-
-> **Using TLS?**
->
-> If the certificate used by the OpenLDAP server is self-signed or not from a recognized certificate authority, make sure have at hand the CA certificate (concatenated with any intermediate certificates) in PEM format. You will have to paste in this certificate during the configuration so that Rancher is able to validate the certificate chain.
-
-### Configure OpenLDAP in Rancher
-
-Configure the settings for the OpenLDAP server, groups and users. For help filling out each field, refer to the [configuration reference.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/openldap/openldap-config) Note that nested group membership is not available for Shibboleth.
-
-> Before you proceed with the configuration, please familiarise yourself with the concepts of [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
-
-1. Log into the Rancher UI using the initial local `admin` account.
-2. From the **Global** view, navigate to **Security** > **Authentication**
-3. Select **OpenLDAP**. The **Configure an OpenLDAP server** form will be displayed.
-
-# Troubleshooting
-
-If you are experiencing issues while testing the connection to the OpenLDAP server, first double-check the credentials entered for the service account as well as the search base configuration. You may also inspect the Rancher logs to help pinpointing the problem cause. Debug logs may contain more detailed information about the error. Please refer to [How can I enable debug logging]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-can-i-enable-debug-logging) in this documentation.
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
deleted file mode 100644
index fc8797e82ef..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/shibboleth/about/_index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Group Permissions with Shibboleth and OpenLDAP
-weight: 1
----
-
-This page provides background information and context for Rancher users who intend to set up the Shibboleth authentication provider in Rancher. 
-
-Because Shibboleth is a SAML provider, it does not support searching for groups. While a Shibboleth integration can validate user credentials, it can't be used to assign permissions to groups in Rancher without additional configuration.
-
-One solution to this problem is to configure an OpenLDAP identity provider. With an OpenLDAP back end for Shibboleth, you will be able to search for groups in Rancher and assign them to resources such as clusters, projects, or namespaces from the Rancher UI.
-
-### Terminology
-
-- **Shibboleth** is a single sign-on log-in system for computer networks and the Internet. It allows people to sign in using just one identity to various systems. It validates user credentials, but does not, on its own, handle group memberships.
-- **SAML:** Security Assertion Markup Language, an open standard for exchanging authentication and authorization data between an identity provider and a service provider.
-- **OpenLDAP:** a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP). It is used to manage an organization’s computers and users. OpenLDAP is useful for Rancher users because it supports groups. In Rancher, it is possible to assign permissions to groups so that they can access resources such as clusters, projects, or namespaces, as long as the groups already exist in the identity provider.
-- **IdP or IDP:** An identity provider. OpenLDAP is an example of an identity provider.
-
-### Adding OpenLDAP Group Permissions to Rancher Resources
-
-The diagram below illustrates how members of an OpenLDAP group can access resources in Rancher that the group has permissions for.
-
-For example, a cluster owner could add an OpenLDAP group to a cluster so that they have permissions view most cluster level resources and create new projects. Then the OpenLDAP group members will have access to the cluster as soon as they log in to Rancher.
-
-In this scenario, OpenLDAP allows the cluster owner to search for groups when assigning persmissions. Without OpenLDAP, the functionality to search for groups would not be supported.
-
-When a member of the OpenLDAP group logs in to Rancher, she is redirected to Shibboleth and enters her username and password.
-
-Shibboleth validates her credentials, and retrieves user attributes from OpenLDAP, including groups. Then Shibboleth sends a SAML assertion to Rancher including the user attributes. Rancher uses the group data so that she can access all of the resources and permissions that her groups have permissions for.
-
-![Adding OpenLDAP Group Permissions to Rancher Resources]({{<baseurl>}}/img/rancher/shibboleth-with-openldap-groups.svg)
- 
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md b/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
deleted file mode 100644
index 8b3fd232551..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/authentication/user-groups/_index.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-title: Users and Groups
-weight: 1
----
-
-Rancher relies on users and groups to determine who is allowed to log in to Rancher and which resources they can access. When you configure an external authentication provider, users from that provider will be able to log in to your Rancher server. When a user logs in, the authentication provider will supply your Rancher server with a list of groups to which the user belongs.
-
-Access to clusters, projects, multi-cluster apps, and global DNS providers and entries can be controlled by adding either individual users or groups to these resources. When you add a group to a resource, all users who are members of that group in the authentication provider, will be able to access the resource with the permissions that you've specified for the group. For more information on roles and permissions, see [Role Based Access Control]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/).
-
-## Managing Members
-
-When adding a user or group to a resource, you can search for users or groups by beginning to type their name. The Rancher server will query the authentication provider to find users and groups that match what you've entered. Searching is limited to the authentication provider that you are currently logged in with. For example, if you've enabled GitHub authentication but are logged in using a [local]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/local/) user account, you will not be able to search for GitHub users or groups.
-
-All users, whether they are local users or from an authentication provider, can be viewed and managed. From the **Global** view, click on **Users**.
-
-{{< saml_caveats >}}
-
-## User Information
-
-Rancher maintains information about each user that logs in through an authentication provider. This information includes whether the user is allowed to access your Rancher server and the list of groups that the user belongs to. Rancher keeps this user information so that the CLI, API, and kubectl can accurately reflect the access that the user has based on their group membership in the authentication provider.
-
-Whenever a user logs in to the UI using an authentication provider, Rancher automatically updates this user information.
-
-### Automatically Refreshing User Information
-
-Rancher will periodically refresh the user information even before a user logs in through the UI. You can control how often Rancher performs this refresh.  From the **Global** view, click on **Settings**. Two settings control this behavior:
-
-- **`auth-user-info-max-age-seconds`**
-
-    This setting controls how old a user's information can be before Rancher refreshes it. If a user makes an API call (either directly or by using the Rancher CLI or kubectl) and the time since the user's last refresh is greater than this setting, then Rancher will trigger a refresh. This setting defaults to `3600` seconds, i.e. 1 hour.
-
-- **`auth-user-info-resync-cron`**
-
-    This setting controls a recurring schedule for resyncing authentication provider information for all users. Regardless of whether a user has logged in or used the API recently, this will cause the user to be refreshed at the specified interval. This setting defaults to `0 0 * * *`, i.e. once a day at midnight. See the [Cron documentation](https://en.wikipedia.org/wiki/Cron) for more information on valid values for this setting.
-
-
-> **Note:** Since SAML does not support user lookup, SAML-based authentication providers do not support periodically refreshing user information. User information will only be refreshed when the user logs into the Rancher UI.
-
-### Manually Refreshing User Information
-
-If you are not sure the last time Rancher performed an automatic refresh of user information, you can perform a manual refresh of all users.
-
-1. From the **Global** view, click on **Users** in the navigation bar.
-
-1. Click on **Refresh Group Memberships**.
-
-**Results:** Rancher refreshes the user information for all users. Requesting this refresh will update which users can access Rancher as well as all the groups that each user belongs to.
-
->**Note:** Since SAML does not support user lookup, SAML-based authentication providers do not support the ability to manually refresh user information. User information will only be refreshed when the user logs into the Rancher UI.
-
-
-## Session Length
-
-The default length (TTL) of each user session is adjustable. The default session length is 16 hours.
-
-1. From the **Global** view, click on **Settings**.
-1. In the **Settings** page, find **`auth-user-session-ttl-minutes`** and click **Edit.**
-1. Enter the amount of time in minutes a session length should last and click **Save.**
-
-**Result:** Users are automatically logged out of Rancher after the set number of minutes.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/_index.md
deleted file mode 100644
index 610aed2ab4a..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/_index.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Role-Based Access Control (RBAC)
-weight: 2
----
-
-> This section is under construction.
-
-Within Rancher, each person authenticates as a _user_, which is a login that grants you access to Rancher. As mentioned in [Authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/), users can either be local or external.
-
-After you configure external authentication, the users that display on the **Users** page changes.
-
-- If you are logged in as a local user, only local users display.
-
-- If you are logged in as an external user, both external and local users display.
-
-## Users and Roles
-
-Once the user logs in to Rancher, their _authorization_, or their access rights within the system, is determined by _global permissions_, and _cluster and project roles_.  
-
-- [Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/):
-
-    Define user authorization outside the scope of any particular cluster.
-
-- [Cluster and Project Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/):
-
-    Define user authorization inside the specific cluster or project where they are assigned the role.
-
-Both global permissions and cluster and project roles are implemented on top of [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/). Therefore, enforcement of permissions and roles is performed by Kubernetes.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/add-users-to-cluster/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/add-users-to-cluster/_index.md
deleted file mode 100644
index 60ca968ebdd..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/add-users-to-cluster/_index.md
+++ /dev/null
@@ -1,55 +0,0 @@
----
-title: Adding Users to a Cluster
-weight: 1
----
-
-> This section is under construction.
-
-If you want to provide a user with access and permissions to _all_ projects, nodes, and resources within a cluster, assign the user a cluster membership.
-
->**Tip:** Want to provide a user with access to a _specific_ project within a cluster? See [Adding Project Members]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/project-members/) instead.
-
-There are two contexts where you can add cluster members:
-
-- Adding Members to a New Cluster
-
-    You can add members to a cluster as you create it (recommended if possible).
-
-- [Adding Members to an Existing Cluster](#editing-cluster-membership)
-
-    You can always add members to a cluster after a cluster is provisioned.
-
-## Editing Cluster Membership
-
-Cluster administrators can edit the membership for a cluster, controlling which Rancher users can access the cluster and what features they can use.
-
-1. From the **Global** view, open the cluster that you want to add members to.
-
-2. From the main menu, select **Members**. Then click **Add Member**.
-
-3. Search for the user or group that you want to add to the cluster.
-
- 	If external authentication is configured:
-
-	-  Rancher returns users from your [external authentication]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) source as you type.
-
-		>**Using AD but can't find your users?**
-		>There may be an issue with your search attribute configuration. See [Configuring Active Directory Authentication: Step 5]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/ad/).
-
-	- A drop-down allows you to add groups instead of individual users. The drop-down only lists groups that you, the logged in user, are part of.
-
-		>**Note:** If you are logged in as a local user, external users do not display in your search results. For more information, see [External Authentication Configuration and Principal Users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-authentication-configuration-and-principal-users).
-
-4. Assign the user or group **Cluster** roles.  
-
-	[What are Cluster Roles?]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
-
-	>**Tip:** For Custom Roles, you can modify the list of individual roles available for assignment.
-	>
-	> - To add roles to the list, [Add a Custom Role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/).
-	> - To remove roles from the list, [Lock/Unlock Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles).
-
-**Result:** The chosen users are added to the cluster.
-
-- To revoke cluster membership, select the user and click **Delete**. This action deletes membership, not the user.
-- To modify a user's roles in the cluster, delete them from the cluster, and then re-add them with modified roles.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
deleted file mode 100644
index 73d87c95a55..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/default-custom-roles/_index.md
+++ /dev/null
@@ -1,158 +0,0 @@
----
-title: Custom Roles
-weight: 2
----
-
-Within Rancher, _roles_ determine what actions a user can make within a cluster or project.
-
-Note that _roles_ are different from _permissions_, which determine what clusters and projects you can access.
-
-This section covers the following topics:
-
-- [Prerequisites](#prerequisites)
-- [Creating a custom role for a cluster or project](#creating-a-custom-role-for-a-cluster-or-project)
-- [Creating a custom global role](#creating-a-custom-global-role)
-- [Deleting a custom global role](#deleting-a-custom-global-role)
-- [Assigning a custom global role to a group](#assigning-a-custom-global-role-to-a-group)
-
-## Prerequisites
-
-To complete the tasks on this page, one of the following permissions are required:
-
- - [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/).
- - [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
-
-## Creating A Custom Role for a Cluster or Project
-
-While Rancher comes out-of-the-box with a set of default user roles, you can also create default custom roles to provide users with very specific permissions within Rancher.
-
-The steps to add custom roles differ depending on the version of Rancher.
-
-{{% tabs %}}
-{{% tab "Rancher v2.0.7+" %}}
-
-1.  From the **Global** view, select **Security > Roles** from the main menu.
-
-1.  Select a tab to determine the scope of the roles you're adding. The tabs are:
-
-  - **Cluster:** The role is valid for assignment when adding/managing members to _only_ clusters.
-  - **Project:** The role is valid for assignment when adding/managing members to _only_ projects.
-
-1.  Click **Add Cluster/Project Role.**
-
-1.  **Name** the role.
-
-1.  Optional: Choose the **Cluster/Project Creator Default** option to assign this role to a user when they create a new cluster or project. Using this feature, you can expand or restrict the default roles for cluster/project creators.
-
-    > Out of the box, the Cluster Creator Default and the Project Creator Default roles are `Cluster Owner` and `Project Owner` respectively.
-
-1.  Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role.
-
-    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
-
-    You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign.
-
-1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. Note: When a custom role inherits from a parent role, the parent role cannot be deleted until the child role is deleted.
-
-1.  Click **Create**.
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.0.7" %}}
-
-1.  From the **Global** view, select **Security > Roles** from the main menu.
-
-1.  Click **Add Role**.
-
-1.  **Name** the role.
-
-1.  Choose whether to set the role to a status of [locked]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/).
-
-    > **Note:** Locked roles cannot be assigned to users.
-
-1.  In the **Context** dropdown menu, choose the scope of the role assigned to the user. The contexts are:
-
-    - **All:** The user can use their assigned role regardless of context. This role is valid for assignment when adding/managing members to clusters or projects.
-
-    - **Cluster:** This role is valid for assignment when adding/managing members to _only_ clusters.
-
-    - **Project:** This role is valid for assignment when adding/managing members to _only_ projects.
-
-1.  Use the **Grant Resources** options to assign individual [Kubernetes API endpoints](https://kubernetes.io/docs/reference/) to the role.
-
-    > When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
-
-    You can also choose the individual cURL methods (`Create`, `Delete`, `Get`, etc.) available for use with each endpoint you assign.
-
-1.  Use the **Inherit from a Role** options to assign individual Rancher roles to your custom roles. Note: When a custom role inherits from a parent role, the parent role cannot be deleted until the child role is deleted.
-
-1.  Click **Create**.
-
-{{% /tab %}}
-{{% /tabs %}}
-
-## Creating a Custom Global Role
-
-### Creating a Custom Global Role that Copies Rules from an Existing Role
-
-If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role in which all of the rules from another role, such as the administrator role, are copied into a new role. This allows you to only configure the variations between the existing role and the new role.
-
-The custom global role can then be assigned to a user or group so that the custom global role takes effect the first time the user or users sign into Rancher.
-
-To create a custom global role based on an existing role,
-
-1. Go to the **Global** view and click **Security > Roles.**
-1. On the **Global** tab, go to the role that the custom global role will be based on. Click **&#8942; (…) > Clone.**
-1. Enter a name for the role.
-1. Optional: To assign the custom role default for new users, go to the **New User Default** section and click **Yes: Default role for new users.**
-1. In the **Grant Resources** section, select the Kubernetes resource operations that will be enabled for users with the custom role.
-1. Click **Save.**
-
-### Creating a Custom Global Role that Does Not Copy Rules from Another Role
-
-Custom global roles don't have to be based on existing roles. To create a custom global role by choosing the specific Kubernetes resource operations that should be allowed for the role, follow these steps:
-
-1. Go to the **Global** view and click **Security > Roles.**
-1. On the **Global** tab, click **Add Global Role.**
-1. Enter a name for the role.
-1. Optional: To assign the custom role default for new users, go to the **New User Default** section and click **Yes: Default role for new users.**
-1. In the **Grant Resources** section, select the Kubernetes resource operations that will be enabled for users with the custom role.
-1. Click **Save.**
-
-## Deleting a Custom Global Role
-
-When deleting a custom global role, all global role bindings with this custom role are deleted.
-
-If a user is only assigned one custom global role, and the role is deleted, the user would lose access to Rancher. For the user to regain access, an administrator would need to edit the user and apply new global permissions.
-
-Custom global roles can be deleted, but built-in roles cannot be deleted.
-
-To delete a custom global role,
-
-1. Go to the **Global** view and click **Security > Roles.**
-2. On the **Global** tab, go to the custom global role that should be deleted and click **&#8942; (…) > Delete.**
-3. Click **Delete.**
-
-## Assigning a Custom Global Role to a Group
-
-If you have a group of individuals that need the same level of access in Rancher, it can save time to create a custom global role. When the role is assigned to a group, the users in the group have the appropriate level of access the first time they sign into Rancher.
-
-When a user in the group logs in, they get the built-in Standard User global role by default. They will also get the permissions assigned to their groups.
-
-If a user is removed from the external authentication provider group, they would lose their permissions from the custom global role that was assigned to the group. They would continue to have their individual Standard User role.
-
-> **Prerequisites:** You can only assign a global role to a group if:
->
-> * You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-vs-local-authentication)
-> * The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/user-groups/)
-> * You have already set up at least one user group with the authentication provider
-
-To assign a custom global role to a group, follow these steps:
-
-1. From the **Global** view, go to **Security > Groups.**
-1. Click **Assign Global Role.**
-1. In the **Select Group To Add** field, choose the existing group that will be assigned the custom global role.
-1. In the **Custom** section, choose any custom global role that will be assigned to the group.
-1. Optional: In the **Global Permissions** or **Built-in** sections, select any additional permissions that the group should have.
-1. Click **Create.**
-
-**Result:** The custom global role will take effect when the users in the group log into Rancher.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/locked-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/locked-roles/_index.md
deleted file mode 100644
index 616982432a5..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/locked-roles/_index.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Locked Roles
-weight: 3
----
-
-You can set roles to a status of `locked`. Locking roles prevent them from being assigned users in the future.
-
-Locked roles:
-
-- Cannot be assigned to users that don't already have it assigned.
-- Are not listed in the **Member Roles** drop-down when you are adding a user to a cluster or project.
-- Do not affect users assigned the role before you lock the role. These users retain access that the role provides.
-
-    **Example:** let's say your organization creates an internal policy that users assigned to a cluster are prohibited from creating new projects. It's your job to enforce this policy.
-
-    To enforce it, before you add new users to the cluster, you should lock the following roles: `Cluster Owner`, `Cluster Member`, and `Create Projects`. Then you could create a new custom role that includes the same permissions as a __Cluster Member__, except the ability to create projects. Then, you use this new custom role when adding users to a cluster.
-
-Roles can be locked by the following users:
-
-- Any user assigned the `Administrator` global permission.
-- Any user assigned the `Custom Users` permission, along with the `Manage Roles` role.
-
-
-## Locking/Unlocking Roles
-
-If you want to prevent a role from being assigned to users, you can set it to a status of `locked`.
-
-You can lock roles in two contexts:
-
-- When you're [adding a custom role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/).
-- When you editing an existing role (see below).
-
-1. From the **Global** view, select **Security** > **Roles**.
-
-2. From the role that you want to lock (or unlock), select **&#8942;** > **Edit**.
-
-3. From the **Locked** option, choose the **Yes** or **No** radio button. Then click **Save**.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/_index.md
deleted file mode 100644
index bcbb52e72eb..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Access Control for the Enterprise Cluster Manager and Projects
-shortTitle: Enterprise Cluster Manager
-weight: 4
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/ace/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/ace/_index.md
deleted file mode 100644
index 3a1c87250e4..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/ace/_index.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: How the Authorized Cluster Endpoint Works
-weight: 7
----
-
-This section describes how the kubectl CLI, the kubeconfig file, and the authorized cluster endpoint work together to allow you to access a downstream Kubernetes cluster directly, without authenticating through the Rancher server. It is intended to provide background information and context to the instructions for [how to set up kubectl to directly access a cluster.](../kubectl/#authenticating-directly-with-a-downstream-cluster)
-
-### About the kubeconfig File
-
-The _kubeconfig file_ is a file used to configure access to Kubernetes when used in conjunction with the kubectl command line tool (or other clients).
-
-This kubeconfig file and its contents are specific to the cluster you are viewing. It can be downloaded from the cluster view in Rancher. You will need a separate kubeconfig file for each cluster that you have access to in Rancher.
-
-After you download the kubeconfig file, you will be able to use the kubeconfig file and its Kubernetes [contexts](https://kubernetes.io/docs/reference/kubectl/cheatsheet/#kubectl-context-and-configuration) to access your downstream cluster.
-
-### Two Authentication Methods for RKE Clusters
-
-If the cluster is not an [RKE cluster,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) the kubeconfig file allows you to access the cluster in only one way: it lets you be authenticated with the Rancher server, then Rancher allows you to run kubectl commands on the cluster.
-
-For RKE clusters, the kubeconfig file allows you to be authenticated in two ways:
-
-- **Through the Rancher server authentication proxy:** Rancher's authentication proxy validates your identity, then connects you to the downstream cluster that you want to access.
-- **Directly with the downstream cluster's API server:** RKE clusters have an authorized cluster endpoint enabled by default. This endpoint allows you to access your downstream Kubernetes cluster with the kubectl CLI and a kubeconfig file, and it is enabled by default for RKE clusters. In this scenario, the downstream cluster's Kubernetes API server authenticates you by calling a webhook (the `kube-api-auth` microservice) that Rancher set up.
-
-This second method, the capability to connect directly to the cluster's Kubernetes API server, is important because it lets you access your downstream cluster if you can't connect to Rancher.
-
-To use the authorized cluster endpoint, you will need to configure kubectl to use the extra kubectl context in the kubeconfig file that Rancher generates for you when the RKE cluster is created. This file can be downloaded from the cluster view in the Rancher UI, and the instructions for configuring kubectl are on [this page.](../kubectl/#authenticating-directly-with-a-downstream-cluster)
-
-These methods of communicating with downstream Kubernetes clusters are also explained in the [architecture page]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#communicating-with-downstream-user-clusters) in the larger context of explaining how Rancher works and how Rancher communicates with downstream clusters.
-
-### About the kube-api-auth Authentication Webhook
-
-The `kube-api-auth` microservice is deployed to provide the user authentication functionality for the [authorized cluster endpoint,]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) which is only available for [RKE clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) When you access the user cluster using `kubectl`, the cluster's Kubernetes API server authenticates you by using the `kube-api-auth` service as a webhook.
-
-During cluster provisioning, the file `/etc/kubernetes/kube-api-authn-webhook.yaml` is deployed and `kube-apiserver` is configured with `--authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml`. This configures the `kube-apiserver` to query `http://127.0.0.1:6440/v1/authenticate` to determine authentication for bearer tokens.
-
-The scheduling rules for `kube-api-auth` are listed below:
-
-_Applies to v2.3.0 and higher_
-
-| Component            | nodeAffinity nodeSelectorTerms             | nodeSelector | Tolerations                                                                    |
-| -------------------- | ------------------------------------------ | ------------ | ------------------------------------------------------------------------------ |
-| kube-api-auth        | `beta.kubernetes.io/os:NotIn:windows`<br/>`node-role.kubernetes.io/controlplane:In:"true"` | none         | `operator:Exists`              |
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
deleted file mode 100644
index 4260529341f..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/cluster-project-roles/_index.md
+++ /dev/null
@@ -1,183 +0,0 @@
----
-title: Cluster and Project Roles
-weight: 5
----
-
-Cluster and project roles define user authorization inside a cluster or project. You can manage these roles from the **Global > Security > Roles** page.
-
-### Membership and Role Assignment
-
-The projects and clusters accessible to non-administrative users is determined by _membership_. Membership is a list of users who have access to a specific cluster or project based on the roles they were assigned in that cluster or project. Each cluster and project includes a tab that a user with the appropriate permissions can use to manage membership.
-
-When you create a cluster or project, Rancher automatically assigns you as the `Owner` for it. Users assigned the `Owner` role can assign other users roles in the cluster or project.
-
-> **Note:** Non-administrative users cannot access any existing projects/clusters by default. A user with appropriate permissions (typically the owner) must explicitly assign the project and cluster membership.
-
-### Cluster Roles
-
-_Cluster roles_ are roles that you can assign to users, granting them access to a cluster. There are two primary cluster roles: `Owner` and `Member`.
-
-- **Cluster Owner:**
-
-    These users have full control over the cluster and all resources in it.
-
-- **Cluster Member:**
-
-    These users can view most cluster level resources and create new projects.
-
-#### Custom Cluster Roles
-
-Rancher lets you assign _custom cluster roles_ to a standard user instead of the typical `Owner` or `Member` roles. These roles can be either a built-in custom cluster role or one defined by a Rancher administrator. They are convenient for defining narrow or specialized access for a standard user within a cluster. See the table below for a list of built-in custom cluster roles.
-
-#### Cluster Role Reference
-
-The following table lists each built-in custom cluster role available and whether that level of access is included in the default cluster-level permissions, `Cluster Owner` and `Cluster Member`.
-
-| Built-in Cluster Role                | Owner         | Member <a id="clus-roles"></a> |
-| ---------------------------------- | ------------- | --------------------------------- |
-| Create Projects                    | ✓             | ✓                                  |
-| Manage Cluster Backups             | ✓             |                                   |
-| Manage Cluster Catalogs            | ✓             |                                   |
-| Manage Cluster Members             | ✓             |                                   |
-| Manage Nodes                       | ✓             |                                   |
-| Manage Storage                     | ✓             |                                   |
-| View All Projects                  | ✓             |                                  |
-| View Cluster Catalogs              | ✓             | ✓                                 |
-| View Cluster Members               | ✓             | ✓                                 |
-| View Nodes                         | ✓             | ✓                                 |
-
-For details on how each cluster role can access Kubernetes resources, you can go to the **Global** view in the Rancher UI. Then click **Security > Roles** and go to the **Clusters** tab. If you click an individual role, you can refer to the **Grant Resources** table to see all of the operations and resources that are permitted by the role.
-
-> **Note:**
->When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
-
-### Giving a Custom Cluster Role to a Cluster Member
-
-After an administrator [sets up a custom cluster role,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/#adding-a-custom-role) cluster owners and admins can then assign those roles to cluster members.
-
-To assign a custom role to a new cluster member, you can use the Rancher UI. To modify the permissions of an existing member, you will need to use the Rancher API view.
-
-To assign the role to a new cluster member,
-
-1. Go to the **Cluster** view, then go to the **Members** tab.
-1. Click **Add Member.** Then in the **Cluster Permissions** section, choose the custom cluster role that should be assigned to the member.
-1. Click **Create.**
-
-**Result:** The member has the assigned role.
-
-To assign any custom role to an existing cluster member,
-
-1. Go to the member you want to give the role to. Click the **&#8942; > View in API.**
-1. In the **roleTemplateId** field, go to the drop-down menu and choose the role you want to assign to the member. Click **Show Request** and **Send Request.**
-
-**Result:** The member has the assigned role.
-
-### Project Roles
-
-_Project roles_ are roles that can be used to grant users access to a project. There are three primary project roles: `Owner`, `Member`, and `Read Only`.
-
-- **Project Owner:**
-
-    These users have full control over the project and all resources in it.
-
-- **Project Member:**
-
-    These users can manage project-scoped resources like namespaces and workloads, but cannot manage other project members.
-
-- **Read Only:**
-
-    These users can view everything in the project but cannot create, update, or delete anything.
-
-    >**Caveat:**
-    >
-    >Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `owner` or `member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned.
-
-
-#### Custom Project Roles
-
-Rancher lets you assign _custom project roles_ to a standard user instead of the typical `Owner`, `Member`, or `Read Only` roles. These roles can be either a built-in custom project role or one defined by a Rancher administrator. They are convenient for defining narrow or specialized access for a standard user within a project. See the table below for a list of built-in custom project roles.
-
-#### Project Role Reference
-
-The following table lists each built-in custom project role available in Rancher and whether it is also granted by the `Owner`, `Member`, or `Read Only` role.
-
-| Built-in Project Role                | Owner         | Member<a id="proj-roles"><a/> | Read Only     |
-| ---------------------------------- | ------------- | ----------------------------- | ------------- |
-| Manage Project Members             | ✓             |                               |               |
-| Create Namespaces                  | ✓             | ✓                             |               |
-| Manage Config Maps                 | ✓             | ✓                             |               |
-| Manage Ingress                     | ✓             | ✓                             |               |
-| Manage Project Catalogs            | ✓             |                               |               |
-| Manage Secrets                     | ✓             | ✓                             |               |
-| Manage Service Accounts            | ✓             | ✓                             |               |
-| Manage Services                    | ✓             | ✓                             |               |
-| Manage Volumes                     | ✓             | ✓                             |               |
-| Manage Workloads                   | ✓             | ✓                             |               |
-| View Config Maps                   | ✓             | ✓                             | ✓             |
-| View Ingress                       | ✓             | ✓                             | ✓             |
-| View Project Members               | ✓             | ✓                             | ✓             |
-| View Project Catalogs              | ✓             | ✓                             | ✓             |
-| View Secrets                       | ✓             | ✓                             | ✓             |
-| View Service Accounts              | ✓             | ✓                             | ✓             |
-| View Services                      | ✓             | ✓                             | ✓             |
-| View Volumes                       | ✓             | ✓                             | ✓             |
-| View Workloads                     | ✓             | ✓                             | ✓             |
-
-> **Notes:**
->
->- Each project role listed above, including `Owner`, `Member`, and `Read Only`, is comprised of multiple rules granting access to various resources. You can view the roles and their rules on the Global > Security > Roles page.
->- When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
->- The `Manage Project Members` role allows the project owner to manage any members of the project **and** grant them any project scoped role regardless of their access to the project resources. Be cautious when assigning this role out individually.
-
-### Defining Custom Roles
-As previously mentioned, custom roles can be defined for use at the cluster or project level. The context field defines whether the role will appear on the cluster member page, project member page, or both.
-
-When defining a custom role, you can grant access to specific resources or specify roles from which the custom role should inherit. A custom role can be made up of a combination of specific grants and inherited roles. All grants are additive. This means that defining a narrower grant for a specific resource **will not** override a broader grant defined in a role that the custom role is inheriting from.
-
-### Default Cluster and Project Roles
-
-By default, when a standard user creates a new cluster or project, they are automatically assigned an ownership role: either [cluster owner](#cluster-roles) or [project owner](#project-roles). However, in some organizations, these roles may overextend administrative access. In this use case, you can change the default role to something more restrictive, such as a set of individual roles or a custom role.
-
-There are two methods for changing default cluster/project roles:
-
-- **Assign Custom Roles**: Create a [custom role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles) for either your [cluster](#custom-cluster-roles) or [project](#custom-project-roles), and then set the custom role as default.
-
-- **Assign Individual Roles**: Configure multiple [cluster](#cluster-role-reference)/[project](#project-role-reference) roles as default for assignment to the creating user.
-
-    For example, instead of assigning a role that inherits other roles (such as `cluster owner`), you can choose a mix of individual roles (such as `manage nodes` and `manage storage`).
-
->**Note:**
->
->- Although you can [lock]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/) a default role, the system still assigns the role to users who create a cluster/project.
->- Only users that create clusters/projects inherit their roles. Users added to the cluster/project membership afterward must be explicitly assigned their roles.
-
-### Configuring Default Roles for Cluster and Project Creators
-
-You can change the cluster or project role(s) that are automatically assigned to the creating user.
-
-1. From the **Global** view, select **Security > Roles** from the main menu. Select either the **Cluster** or **Project** tab.
-
-1. Find the custom or individual role that you want to use as default. Then edit the role by selecting **&#8942; > Edit**.
-
-1. Enable the role as default.
-{{% accordion id="cluster" label="For Clusters" %}}
-1. From **Cluster Creator Default**, choose **Yes: Default role for new cluster creation**.
-1. Click **Save**.
-{{% /accordion %}}
-{{% accordion id="project" label="For Projects" %}}
-1. From **Project Creator Default**, choose **Yes: Default role for new project creation**.
-1. Click **Save**.
-{{% /accordion %}}
-
-1. If you want to remove a default role, edit the permission and select **No** from the default roles option.
-
-**Result:** The default roles are configured based on your changes. Roles assigned to cluster/project creators display a check in the **Cluster/Project Creator Default** column.
-
-### Cluster Membership Revocation Behavior
-
-When you revoke the cluster membership for a standard user that's explicitly assigned membership to both the cluster _and_ a project within the cluster, that standard user [loses their cluster roles](#clus-roles) but [retains their project roles](#proj-roles). In other words, although you have revoked the user's permissions to access the cluster and its nodes, the standard user can still:
-
-- Access the projects they hold membership in.
-- Exercise any [individual project roles](#project-role-reference) they are assigned.
-
-If you want to completely revoke a user's access within a cluster, revoke both their cluster and project memberships.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/custom-global-roles/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
deleted file mode 100644
index 150011ee05e..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/custom-global-roles/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Custom Global Roles
-weight: 3
----
-
-This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
deleted file mode 100644
index 0486688a0af..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/global-permissions/_index.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-title: Global Permissions
-weight: 4
----
-
-_Permissions_ are individual access rights that you can assign when selecting a custom permission for a user.
-
-Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are three default global permissions: `Administrator`, `Standard User` and `User-base`.
-
-- **Administrator:** These users have full control over the entire Rancher system and all clusters within it.
-
-- <a id="user"></a>**Standard User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters.
-
-- **User-Base:** User-Base users have login-access only.
-
-You cannot update or delete the built-in Global Permissions.
-
-This section covers the following topics:
-
-- [Global permission assignment](#global-permission-assignment)
-  - [Global permissions for new local users](#global-permissions-for-new-local-users)
-  - [Global permissions for users with external authentication](#global-permissions-for-users-with-external-authentication)
-- [Custom global permissions](#custom-global-permissions)
-  - [Custom global permissions reference](#custom-global-permissions-reference)
-  - [Configuring default global permissions for new users](#configuring-default-global-permissions)
-  - [Configuring global permissions for existing individual users](#configuring-global-permissions-for-existing-individual-users)
-  - [Configuring global permissions for groups](#configuring-global-permissions-for-groups)
-  - [Refreshing group memberships](#refreshing-group-memberships)
-
-# Global Permission Assignment
-
-Global permissions for local users are assigned differently than users who log in to Rancher using external authentication.
-
-### Global Permissions for New Local Users
-
-When you create a new local user, you assign them a global permission as you complete the **Add User** form.
-
-To see the default permissions for new users, go to the **Global** view and click **Security > Roles.** On the **Global** tab, there is a column named **New User Default.** When adding a new local user, the user receives all  default global permissions that are marked as checked in this column. You can [change the default global permissions to meet your needs.](#configuring-default-global-permissions)
-
-### Global Permissions for Users with External Authentication
-
-When a user logs into Rancher using an external authentication provider for the first time, they are automatically assigned the  **New User Default** global permissions. By default, Rancher assigns the **Standard User** permission for new users.
-
-To see the default permissions for new users, go to the **Global** view and click **Security > Roles.** On the **Global** tab, there is a column named **New User Default.** When adding a new local user, the user receives all default global permissions that are marked as checked in this column, and you can [change them to meet your needs.](#configuring-default-global-permissions)
-
-Permissions can be assigned to an individual user with [these steps.](#configuring-global-permissions-for-existing-individual-users)
-
-As of Rancher v2.4.0, you can [assign a role to everyone in the group at the same time](#configuring-global-permissions-for-groups) if the external authentication provider supports groups.
-
-# Custom Global Permissions
-
-Using custom permissions is convenient for providing users with narrow or specialized access to Rancher.
-
-When a user from an [external authentication source]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) signs into Rancher for the first time, they're automatically assigned a set of global permissions (hereafter, permissions). By default, after a user logs in for the first time, they are created as a user and assigned the default `user` permission. The standard `user` permission allows users to login and create clusters.
-
-However, in some organizations, these permissions may extend too much access. Rather than assigning users the default global permissions of `Administrator` or `Standard User`, you can assign them a more restrictive set of custom global permissions.
-
-The default roles, Administrator and Standard User, each come with multiple global permissions built into them. The Administrator role includes all global permissions, while the default user role includes three global permissions: Create Clusters, Use Catalog Templates, and User Base, which is equivalent to the minimum permission to log in to Rancher. In other words, the custom global permissions are modularized so that if you want to change the default user role permissions, you can choose which subset of global permissions are included in the new default user role.
-
-Administrators can enforce custom global permissions in multiple ways:
-
-- [Changing the default permissions for new users](#configuring-default-global-permissions)
-- [Editing the permissions of an existing user](#configuring-global-permissions-for-individual-users)
-- [Assigning a custom global permission to a group](#assigning-a-custom-global-permission-to-a-group)
-
-### Custom Global Permissions Reference
-
-The following table lists each custom global permission available and whether it is included in the default global permissions, `Administrator`, `Standard User` and `User-Base`.
-
-| Custom Global Permission           | Administrator | Standard User | User-Base |
-| ---------------------------------- | ------------- | ------------- |-----------|
-| Create Clusters                    | ✓             | ✓             |           |
-| Create RKE Templates               | ✓             | ✓             |           |
-| Manage Authentication              | ✓             |               |           |
-| Manage Catalogs                    | ✓             |               |           |
-| Manage Cluster Drivers             | ✓             |               |           |
-| Manage Node Drivers                | ✓             |               |           |
-| Manage PodSecurityPolicy Templates | ✓             |               |           |
-| Manage Roles                       | ✓             |               |           |
-| Manage Settings                    | ✓             |               |           |
-| Manage Users                       | ✓             |               |           |
-| Use Catalog Templates              | ✓             | ✓             |           |
-| User Base\* (Basic log-in access)  | ✓             | ✓             |           |
-
-> \*This role has two names:
->
-> - When you go to the <b>Users</b> tab and edit a user's global role, this role is called <b>Login Access</b> in the custom global permissions list.
-> - When you go to the <b>Security</b> tab and edit the roles from the roles page, this role is called <b>User Base.</b>
-
-For details on which Kubernetes resources correspond to each global permission, you can go to the **Global** view in the Rancher UI. Then click **Security > Roles** and go to the **Global** tab. If you click an individual role, you can refer to the **Grant Resources** table to see all of the operations and resources that are permitted by the role.
-
-> **Notes:**
->
-> - Each permission listed above is comprised of multiple individual permissions not listed in the Rancher UI. For a full list of these permissions and the rules they are comprised of, access through the API at `/v3/globalRoles`.
-> - When viewing the resources associated with default roles created by Rancher, if there are multiple Kubernetes API resources on one line item, the resource will have `(Custom)` appended to it. These are not custom resources but just an indication that there are multiple Kubernetes API resources as one resource.
-
-### Configuring Default Global Permissions
-
-If you want to restrict the default permissions for new users, you can remove the `user` permission as default role and then assign multiple individual permissions as default instead. Conversely, you can also add administrative permissions on top of a set of other standard permissions.
-
-> **Note:** Default roles are only assigned to users added from an external authentication provider. For local users, you must explicitly assign global permissions when adding a user to Rancher. You can customize these global permissions when adding the user.
-
-To change the default global permissions that are assigned to external users upon their first log in, follow these steps:
-
-1. From the **Global** view, select **Security > Roles** from the main menu. Make sure the **Global** tab is selected.
-
-1. Find the permissions set that you want to add or remove as a default. Then edit the permission by selecting **&#8942; > Edit**.
-
-1. If you want to add the permission as a default, Select **Yes: Default role for new users** and then click **Save**.
-
-1. If you want to remove a default permission, edit the permission and select **No** from **New User Default**.
-
-**Result:** The default global permissions are configured based on your changes. Permissions assigned to new users display a check in the **New User Default** column.
-
-### Configuring Global Permissions for Existing Individual Users
-
-To configure permission for a user,
-
-1. Go to the **Users** tab.
-
-1. On this page, go to the user whose access level you want to change and click **&#8942; > Edit.**
-
-1. In the **Global Permissions** section, click **Custom.**
-
-1. Check the boxes for each subset of permissions you want the user to have access to.
-
-1. Click **Save.**
-
-> **Result:** The user's global permissions have been updated.
-
-### Configuring Global Permissions for Groups
-
-If you have a group of individuals that need the same level of access in Rancher, it can save time to assign permissions to the entire group at once, so that the users in the group have the appropriate level of access the first time they sign into Rancher.
-
-After you assign a custom global role to a group, the custom global role will be assigned to a user in the group when they log in to Rancher.
-
-For existing users, the new permissions will take effect when the users log out of Rancher and back in again, or when an administrator [refreshes the group memberships.](#refreshing-group-memberships)
-
-For new users, the new permissions take effect when the users log in to Rancher for the first time. New users from this group will receive the permissions from the custom global role in addition to the **New User Default** global permissions. By default, the **New User Default** permissions are equivalent to the **Standard User** global role, but the default permissions can be [configured.](#configuring-default-global-permissions)
-
-If a user is removed from the external authentication provider group, they would lose their permissions from the custom global role that was assigned to the group. They would continue to have any remaining roles that were assigned to them, which would typically include the roles marked as **New User Default.** Rancher will remove the permissions that are associated with the group when the user logs out, or when an administrator [refreshes group memberships,]((#refreshing-group-memberships)) whichever comes first.
-
-> **Prerequisites:** You can only assign a global role to a group if:
->
-> * You have set up an [external authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/#external-vs-local-authentication)
-> * The external authentication provider supports [user groups]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/user-groups/)
-> * You have already set up at least one user group with the authentication provider
-
-To assign a custom global role to a group, follow these steps:
-
-1. From the **Global** view, go to **Security > Groups.**
-1. Click **Assign Global Role.**
-1. In the **Select Group To Add** field, choose the existing group that will be assigned the custom global role.
-1. In the **Global Permissions,** **Custom,** and/or **Built-in** sections, select the permissions that the group should have.
-1. Click **Create.**
-
-**Result:** The custom global role will take effect when the users in the group log into Rancher.
-
-### Refreshing Group Memberships
-
-When an administrator updates the global permissions for a group, the changes take effect for individual group members after they log out of Rancher and log in again.
-
-To make the changes take effect immediately, an administrator or cluster owner can refresh group memberships.
-
-An administrator might also want to refresh group memberships if a user is removed from a group in the external authentication service. In that case, the refresh makes Rancher aware that the user was removed from the group.
-
-To refresh group memberships,
-
-1. From the **Global** view, click **Security > Users.**
-1. Click **Refresh Group Memberships.**
-
-**Result:** Any changes to the group members' permissions will take effect.
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/kubectl/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/kubectl/_index.md
deleted file mode 100644
index d47673f71f4..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/kubectl/_index.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: "Access a Cluster with Kubectl and kubeconfig"
-description: "Learn how you can access and manage your Kubernetes clusters using kubectl with kubectl Shell or with kubectl CLI and kubeconfig file. A kubeconfig file is used to configure access to Kubernetes. When you create a cluster with Rancher, it automatically creates a kubeconfig for your cluster."
-weight: 6
----
-
-This section describes how to manipulate your downstream Kubernetes cluster with kubectl from the Rancher UI or from your workstation.
-
-For more information on using kubectl, see [Kubernetes Documentation: Overview of kubectl](https://kubernetes.io/docs/reference/kubectl/overview/).
-
-- [Accessing clusters with kubectl shell in the Rancher UI](#accessing-clusters-with-kubectl-shell-in-the-rancher-ui)
-- [Accessing clusters with kubectl from your workstation](#accessing-clusters-with-kubectl-from-your-workstation)
-- [Note on Resources created using kubectl](#note-on-resources-created-using-kubectl)
-- [Authenticating Directly with a Downstream Cluster](#authenticating-directly-with-a-downstream-cluster)
-  - [Connecting Directly to Clusters with FQDN Defined](#connecting-directly-to-clusters-with-fqdn-defined)
-  - [Connecting Directly to Clusters without FQDN Defined](#connecting-directly-to-clusters-without-fqdn-defined)
-
-
-### Accessing Clusters with kubectl Shell in the Rancher UI
-
-You can access and manage your clusters by logging into Rancher and opening the kubectl shell in the UI. No further configuration necessary.
-
-1. From the **Global** view, open the cluster that you want to access with kubectl.
-
-2. Click **Launch kubectl**. Use the window that opens to interact with your Kubernetes cluster.
-
-### Accessing Clusters with kubectl from Your Workstation
-
-This section describes how to download your cluster's kubeconfig file, launch kubectl from your workstation, and access your downstream cluster.
-
-This alternative method of accessing the cluster allows you to authenticate with Rancher and manage your cluster without using the Rancher UI.
-
-> **Prerequisites:** These instructions assume that you have already created a Kubernetes cluster, and that kubectl is installed on your workstation. For help installing kubectl, refer to the official [Kubernetes documentation.](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
-
-1. Log into Rancher. From the **Global** view, open the cluster that you want to access with kubectl.
-1. Click **Kubeconfig File**.
-1. Copy the contents displayed to your clipboard.
-1. Paste the contents into a new file on your local computer. Move the file to `~/.kube/config`. Note: The default location that kubectl uses for the kubeconfig file is `~/.kube/config`, but you can use any directory and specify it using the `--kubeconfig` flag, as in this command:
-  ```
-  kubectl --kubeconfig /custom/path/kube.config get pods
-  ```
-1. From your workstation, launch kubectl. Use it to interact with your kubernetes cluster.
-
-
-### Note on Resources Created Using kubectl
-
-Rancher will discover and show resources created by `kubectl`. However, these resources might not have all the necessary annotations on discovery. If an operation (for instance, scaling the workload) is done to the resource using the Rancher UI/API, this may trigger recreation of the resources due to the missing annotations. This should only happen the first time an operation is done to the discovered resource.
-
-# Authenticating Directly with a Downstream Cluster
-
-This section intended to help you set up an alternative method to access an [RKE cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters)
-
-This method is only available for RKE clusters that have the [authorized cluster endpoint]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) enabled. When Rancher creates this RKE cluster, it generates a kubeconfig file that includes additional kubectl context(s) for accessing your cluster. This additional context allows you to use kubectl to authenticate with the downstream cluster without authenticating through Rancher. For a longer explanation of how the authorized cluster endpoint works, refer to [this page.](../ace)
-
-We recommend that as a best practice, you should set up this method to access your RKE cluster, so that just in case you can’t connect to Rancher, you can still access the cluster.
-
-> **Prerequisites:** The following steps assume that you have created a Kubernetes cluster and followed the steps to [connect to your cluster with kubectl from your workstation.](#accessing-clusters-with-kubectl-from-your-workstation)
-
-To find the name of the context(s) in your downloaded kubeconfig file, run:
-
-```
-kubectl config get-contexts --kubeconfig /custom/path/kube.config
-CURRENT   NAME                        CLUSTER                     AUTHINFO     NAMESPACE
-*         my-cluster                  my-cluster                  user-46tmn
-          my-cluster-controlplane-1   my-cluster-controlplane-1   user-46tmn
-```
-
-In this example, when you use `kubectl` with the first context, `my-cluster`, you will be authenticated through the Rancher server.
-
-With the second context, `my-cluster-controlplane-1`, you would authenticate with the authorized cluster endpoint, communicating with an downstream RKE cluster directly.
-
-We recommend using a load balancer with the authorized cluster endpoint. For details, refer to the [recommended architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#architecture-for-an-authorized-cluster-endpoint)
-
-Now that you have the name of the context needed to authenticate directly with the cluster, you can pass the name of the context in as an option when running kubectl commands. The commands will differ depending on whether your cluster has an FQDN defined. Examples are provided in the sections below.
-
-When `kubectl` works normally, it confirms that you can access your cluster while bypassing Rancher's authentication proxy.
-
-### Connecting Directly to Clusters with FQDN Defined
-
-If an FQDN is defined for the cluster, a single context referencing the FQDN will be created. The context will be named `<CLUSTER_NAME>-fqdn`. When you want to use `kubectl` to access this cluster without Rancher, you will need to use this context.
-
-Assuming the kubeconfig file is located at `~/.kube/config`:
-
-```
-kubectl --context <CLUSTER_NAME>-fqdn get nodes
-```
-Directly referencing the location of the kubeconfig file:
-```
-kubectl --kubeconfig /custom/path/kube.config --context <CLUSTER_NAME>-fqdn get pods
-```
-
-### Connecting Directly to Clusters without FQDN Defined
-
-If there is no FQDN defined for the cluster, extra contexts will be created referencing the IP address of each node in the control plane. Each context will be named `<CLUSTER_NAME>-<NODE_NAME>`. When you want to use `kubectl` to access this cluster without Rancher, you will need to use this context.
-
-Assuming the kubeconfig file is located at `~/.kube/config`:
-```
-kubectl --context <CLUSTER_NAME>-<NODE_NAME> get nodes
-```
-Directly referencing the location of the kubeconfig file:
-```
-kubectl --kubeconfig /custom/path/kube.config --context <CLUSTER_NAME>-<NODE_NAME> get pods
-```
diff --git a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/project-members/_index.md b/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/project-members/_index.md
deleted file mode 100644
index c58f5848c34..00000000000
--- a/content/rancher/v2.5/en/ecm/access-control/rbac/mcm/project-members/_index.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: Adding Users to Projects
-weight: 2
----
-
-If you want to provide a user with access and permissions to _specific_ projects and resources within a cluster, assign the user a project membership.
-
-You can add members to a project as it is created, or add them to an existing project.
-
->**Tip:** Want to provide a user with access to _all_ projects within a cluster? See [Adding Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/cluster-members/) instead.
-
-### Adding Members to a New Project
-
-You can add members to a project as you create it (recommended if possible). For details on creating a new project, refer to the [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/)
-
-### Adding Members to an Existing Project
-
-Following project creation, you can add users as project members so that they can access its resources.
-
-1. From the **Global** view, open the project that you want to add members to.
-
-2. From the main menu, select **Members**. Then click **Add Member**.
-
-3. Search for the user or group that you want to add to the project.
-
- 	If external authentication is configured:
-
-	-  Rancher returns users from your external authentication source as you type.  
-
-	- A drop-down allows you to add groups instead of individual users. The dropdown only lists groups that you, the logged in user, are included in.
-
-	>**Note:** If you are logged in as a local user, external users do not display in your search results.
-
-1. Assign the user or group **Project** roles.  
-
-	[What are Project Roles?]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
-
-    >**Notes:**
-    >
-    >- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned.
-    >
-    >- For `Custom` roles, you can modify the list of individual roles available for assignment.
-    >
-    >    - To add roles to the list, [Add a Custom Role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles).
-    >    - To remove roles from the list, [Lock/Unlock Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/locked-roles/).
-
-**Result:** The chosen users are added to the project.
-
-- To revoke project membership, select the user and click **Delete**. This action deletes membership, not the user.
-- To modify a user's roles in the project, delete them from the project, and then re-add them with modified roles.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md b/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
deleted file mode 100644
index 343f8f6f841..00000000000
--- a/content/rancher/v2.5/en/ecm/backing-up-a-cluster/_index.md
+++ /dev/null
@@ -1,137 +0,0 @@
----
-title: Backing up a Cluster
-weight: 7
----
-
-In the Rancher UI, etcd backup and recovery for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) can be easily performed.
-
-Rancher recommends configuring recurrent `etcd` snapshots for all production clusters. Additionally, one-time snapshots can easily be taken as well.
-
-Snapshots of the etcd database are taken and saved either [locally onto the etcd nodes](#local-backup-target) or to a [S3 compatible target](#s3-backup-target). The advantages of configuring S3 is that if all etcd nodes are lost, your snapshot is saved remotely and can be used to restore the cluster.
-
-This section covers the following topics:
-
-- [How snapshots work](#how-snapshots-work)
-- [Configuring recurring snapshots](#configuring-recurring-snapshots)
-- [One-time snapshots](#one-time-snapshots)
-- [Snapshot backup targets](#snapshot-backup-targets)
-  - [Local backup target](#local-backup-target)
-  - [S3 backup target](#s3-backup-target)
-  - [Using a custom CA certificate for S3](#using-a-custom-ca-certificate-for-s3)
-  - [IAM Support for storing snapshots in S3](#iam-support-for-storing-snapshots-in-s3)
-- [Viewing available snapshots](#viewing-available-snapshots)
-- [Safe timestamps](#safe-timestamps)
-- [Enabling snapshot features for clusters created before Rancher v2.2.0](#enabling-snapshot-features-for-clusters-created-before-rancher-v2-2-0)
-
-# How Snapshots Work
-
-{{% tabs %}}
-{{% tab "Rancher v2.4.0+" %}}
-When Rancher creates a snapshot, it includes three components: 
-
-- The cluster data in etcd
-- The Kubernetes version
-- The cluster configuration in the form of the `cluster.yml`
-
-Because the Kubernetes version is now included in the snapshot, it is possible to restore a cluster to a prior Kubernetes version.
-
-The multiple components of the snapshot allow you to select from the following options if you need to a cluster from a snapshot:
-
-- **Restore just the etcd contents:** This restoration is similar to restoring to snapshots in Rancher prior to v2.4.0.
-- **Restore etcd and Kubernetes version:** This option should be used if a Kubernetes upgrade is the reason that your cluster is failing, and you haven't made any cluster configuration changes.
-- **Restore etcd, Kubernetes versions and cluster configuration:** This option should be used if you changed both the Kubernetes version and cluster configuration when upgrading.
-
-It's always recommended to take a new snapshot before any upgrades.
-{{% /tab %}}
-{{% tab "Rancher prior to v2.4.0" %}}
-When Rancher creates a snapshot, only the etcd data is included in the snapshot.
-
-Because the Kubernetes version is not included in the snapshot, there is no option to restore a cluster to a different Kubernetes version.
-
-It's always recommended to take a new snapshot before any upgrades.
-{{% /tab %}}
-{{% /tabs %}}
-
-# Configuring Recurring Snapshots
-
-Select how often you want recurring snapshots to be taken as well as how many snapshots to keep. The amount of time is measured in hours. With timestamped snapshots, the user has the ability to do a point-in-time recovery.
-
-By default, [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) are configured to take recurring snapshots (saved to local disk). To protect against local disk failure, using the [S3 Target](#s3-backup-target) or replicating the path on disk is advised.
-
-During cluster provisioning or editing the cluster, the configuration for snapshots can be found in the advanced section for **Cluster Options**. Click on **Show advanced options**.
-
-In the **Advanced Cluster Options** section, there are several options available to configure:
-
-| Option | Description | Default Value|
-| --- | ---| --- |
-|[etcd Snapshot Backup Target](#snapshot-backup-targets)| Select where you want the snapshots to be saved. Options are either local or in S3 | local|
-|Recurring etcd Snapshot Enabled| Enable/Disable recurring snapshots | Yes|
-|[Recurring etcd Snapshot Creation Period](#snapshot-creation-period-and-retention-count) | Time in hours between recurring snapshots| 12 hours |
-|[Recurring etcd Snapshot Retention Count](#snapshot-creation-period-and-retention-count)| Number of snapshots to retain| 6 |
-
-# One-Time Snapshots
-
-In addition to recurring snapshots, you may want to take a "one-time" snapshot. For example, before upgrading the Kubernetes version of a cluster it's best to backup the state of the cluster to protect against upgrade failure.
-
-1. In the **Global** view, navigate to the cluster that you want to take a one-time snapshot.
-
-2. Click the **&#8942; > Snapshot Now**.
-
-**Result:** Based on your [snapshot backup target](#snapshot-backup-targets), a one-time snapshot will be taken and saved in the selected backup target.
-
-# Snapshot Backup Targets
-
-Rancher supports two different backup targets:
-
-* [Local Target](#local-backup-target)
-* [S3 Target](#s3-backup-target)
-
-### Local Backup Target
-
-By default, the `local` backup target is selected. The benefits of this option is that there is no external configuration. Snapshots are automatically saved locally to the etcd nodes in the [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) in `/opt/rke/etcd-snapshots`. All recurring snapshots are taken at configured intervals. The downside of using the `local` backup target is that if there is a total disaster and _all_ etcd nodes are lost, there is no ability to restore the cluster.
-
-### S3 Backup Target
-
-The `S3` backup target allows users to configure a S3 compatible backend to store the snapshots. The primary benefit of this option is that if the cluster loses all the etcd nodes, the cluster can still be restored as the snapshots are stored externally. Rancher recommends external targets like `S3` backup, however its configuration requirements do require additional effort that should be considered.
-
-| Option | Description | Required|
-|---|---|---|
-|S3 Bucket Name| S3 bucket name where backups will be stored| *|
-|S3 Region|S3 region for the backup bucket| |
-|S3 Region Endpoint|S3 regions endpoint for the backup bucket|* |
-|S3 Access Key|S3 access key with permission to access the backup bucket|*|
-|S3 Secret Key|S3 secret key with permission to access the backup bucket|*|
-| Custom CA Certificate | A custom certificate used to access private S3 backends ||
-
-### Using a custom CA certificate for S3
-
-The backup snapshot can be stored on a custom `S3` backup like [minio](https://min.io/). If the S3 back end uses a self-signed or custom certificate, provide a custom certificate using the `Custom CA Certificate` option to connect to the S3 backend.
-
-### IAM Support for Storing Snapshots in S3
-
-The `S3` backup target supports using IAM authentication to AWS API in addition to using API credentials. An IAM role gives temporary permissions that an application can use when making API calls to S3 storage. To use IAM authentication, the following requirements must be met:
-
- - The cluster etcd nodes must have an instance role that has read/write access to the designated backup bucket.
- - The cluster etcd nodes must have network access to the specified S3 endpoint.
- - The Rancher Server worker node(s) must have an instance role that has read/write to the designated backup bucket.
- - The Rancher Server worker node(s) must have network access to the specified S3 endpoint.
-
- To give an application access to S3, refer to the AWS documentation on [Using an IAM Role to Grant Permissions to Applications Running on Amazon EC2 Instances.](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html)
-
-# Viewing Available Snapshots
-
-The list of all available snapshots for the cluster is available in the Rancher UI.
-
-1. In the **Global** view, navigate to the cluster that you want to view snapshots.
-
-2. Click **Tools > Snapshots** from the navigation bar to view the list of saved snapshots. These snapshots include a timestamp of when they were created.
-
-# Safe Timestamps
-
-As of v2.2.6, snapshot files are timestamped to simplify processing the files using external tools and scripts, but in some S3 compatible backends, these timestamps were unusable. As of Rancher v2.3.0, the option `safe_timestamp` is added to support compatible file names. When this flag is set to `true`, all special characters in the snapshot filename timestamp are replaced.
-
-This option is not available directly in the UI, and is only available through the `Edit as Yaml` interface.
-
-# Enabling Snapshot Features for Clusters Created Before Rancher v2.2.0
-
-If you have any Rancher launched Kubernetes clusters that were created prior to v2.2.0, after upgrading Rancher, you must [edit the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) and _save_ it, in order to enable the updated snapshot features. Even if you were already creating snapshots prior to v2.2.0, you must do this step as the older snapshots will not be available to use to [back up and restore etcd through the UI]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/).
diff --git a/content/rancher/v2.5/en/ecm/best-practices/_index.md b/content/rancher/v2.5/en/ecm/best-practices/_index.md
deleted file mode 100644
index 3c88c0ac9c6..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/_index.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-title: Best Practices Guide
-weight: 3
----
-
-The purpose of this section is to consolidate best practices for Rancher implementations. This also includes recommendations for related technologies, such as Kubernetes, Docker, containers, and more. The objective is to improve the outcome of a Rancher implementation using the operational experience of Rancher and its customers.
-
-If you have any questions about how these might apply to your use case, please contact your Customer Success Manager or Support.
-
-Use the navigation bar on the left to find the current best practices for managing and deploying the Rancher Server.
-
-For more guidance on best practices, you can consult these resources:
-
-- [Rancher Docs]({{<baseurl>}})
-    - [Monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/)
-    - [Backups and Disaster Recovery]({{<baseurl>}}/rancher/v2.x/en/backups/)
-    - [Security]({{<baseurl>}}/rancher/v2.x/en/security/)
-- [Rancher Blog](https://rancher.com/blog/)
-    - [Articles about best practices on the Rancher blog](https://rancher.com/tags/best-practices/)
-    - [101 More Security Best Practices for Kubernetes](https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/)
-- [Rancher Forum](https://forums.rancher.com/)
-- [Rancher Users Slack](https://slack.rancher.io/)
-- [Rancher Labs YouTube Channel - Online Meetups, Demos, Training, and Webinars](https://www.youtube.com/channel/UCh5Xtp82q8wjijP8npkVTBA/featured)
diff --git a/content/rancher/v2.5/en/ecm/best-practices/mcm/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/_index.md
deleted file mode 100644
index 569f3ed7602..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/mcm/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Recommendations for the Enterprise Cluster Manager
-weight: 2
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/best-practices/mcm/architecture-recommendations/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/architecture-recommendations/_index.md
deleted file mode 100644
index fd381be31e5..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/mcm/architecture-recommendations/_index.md
+++ /dev/null
@@ -1,119 +0,0 @@
----
-title: Architecture Recommendations
-weight: 3
----
-
-Kubernetes cluster. If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters)
-
-This section covers the following topics:
-
-- [Separation of Rancher and User Clusters](#separation-of-rancher-and-user-clusters)
-- [Why HA is Better for Rancher in Production](#why-ha-is-better-for-rancher-in-production)
-- [Recommended Load Balancer Configuration for Kubernetes Installations](#recommended-load-balancer-configuration-for-ha-installations)
-- [Environment for Kubernetes Installations](#environment-for-ha-installations)
-- [Recommended Node Roles for Kubernetes Installations](#recommended-node-roles-for-ha-installations)
-- [Architecture for an Authorized Cluster Endpoint](#architecture-for-an-authorized-cluster-endpoint)
-
-# Separation of Rancher and User Clusters
-
-A user cluster is a downstream Kubernetes cluster that runs your apps and services.
-
-If you have a Docker installation of Rancher, the node running the Rancher server should be separate from your downstream clusters.
-
-In Kubernetes installations of Rancher, the Rancher server cluster should also be separate from the user clusters.
-
-![Separation of Rancher Server from User Clusters]({{<baseurl>}}/img/rancher/rancher-architecture-separation-of-rancher-server.svg)
-
-# Why HA is Better for Rancher in Production
-
-We recommend installing the Rancher server on a high-availability Kubernetes cluster, primarily because it protects the Rancher server data. In a high-availability installation, a load balancer serves as the single point of contact for clients, distributing network traffic across multiple servers in the cluster and helping to prevent any one server from becoming a point of failure.
-
-We don't recommend installing Rancher in a single Docker container, because if the node goes down, there is no copy of the cluster data available on other nodes and you could lose the data on your Rancher server.
-
-Rancher needs to be installed on either a high-availability [RKE (Rancher Kubernetes Engine)]({{<baseurl>}}/rke/latest/en/) Kubernetes cluster, or a high-availability [K3s (Lightweight Kubernetes)]({{<baseurl>}}/k3s/latest/en/) Kubernetes cluster. Both RKE and K3s are fully certified Kubernetes distributions.
-
-### K3s Kubernetes Cluster Installations
-
-If you are installing Rancher v2.4 for the first time, we recommend installing it on a K3s Kubernetes cluster. One main advantage of this K3s architecture is that it allows an external datastore to hold the cluster data, allowing the K3s server nodes to be treated as ephemeral.
-
-The option to install Rancher on a K3s cluster is a feature introduced in Rancher v2.4. K3s is easy to install, with half the memory of Kubernetes, all in a binary less than 100 MB.
-
-<figcaption>Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server</figcaption>
-![Architecture of a K3s Kubernetes Cluster Running the Rancher Management Server]({{<baseurl>}}/img/rancher/k3s-server-storage.svg)
-
-### RKE Kubernetes Cluster Installations
-
-If you are installing Rancher prior to v2.4, you will need to install Rancher on an RKE cluster, in which the cluster data is stored on each node with the etcd role. As of Rancher v2.4, there is no migration path to transition the Rancher server from an RKE cluster to a K3s cluster. All versions of the Rancher server, including v2.4+, can be installed on an RKE cluster.
-
-In an RKE installation, the cluster data is replicated on each of three etcd nodes in the cluster, providing redundancy and data duplication in case one of the nodes fails.
-
-<figcaption>Architecture of an RKE Kubernetes Cluster Running the Rancher Management Server</figcaption>
-![Architecture of an RKE Kubernetes cluster running the Rancher management server]({{<baseurl>}}/img/rancher/rke-server-storage.svg)
-
-# Recommended Load Balancer Configuration for Kubernetes Installations
-
-We recommend the following configurations for the load balancer and Ingress controllers:
-
-* The DNS for Rancher should resolve to a Layer 4 load balancer (TCP)
-* The Load Balancer should forward port TCP/80 and TCP/443 to all 3 nodes in the Kubernetes cluster.
-* The Ingress controller will redirect HTTP to HTTPS and terminate SSL/TLS on port TCP/443.
-* The Ingress controller will forward traffic to port TCP/80 on the pod in the Rancher deployment.
-
-<figcaption>Rancher installed on a Kubernetes cluster with layer 4 load balancer, depicting SSL termination at Ingress controllers</figcaption>
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-
-# Environment for Kubernetes Installations
-
-It is strongly recommended to install Rancher on a Kubernetes cluster on hosted infrastructure such as Amazon's EC2 or Google Compute Engine.
-
-For the best performance and greater security, we recommend a dedicated Kubernetes cluster for the Rancher management server. Running user workloads on this cluster is not advised. After deploying Rancher, you can [create or import clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) for running your workloads.
-
-It is not recommended to install Rancher on top of a managed Kubernetes service such as Amazon’s EKS or Google Kubernetes Engine. These hosted Kubernetes solutions do not expose etcd to a degree that is manageable for Rancher, and their customizations can interfere with Rancher operations.
-
-# Recommended Node Roles for Kubernetes Installations
-
-Our recommendations for the roles of each node differ depending on whether Rancher is installed on a K3s Kubernetes cluster or an RKE Kubernetes cluster.
-
-### K3s Cluster Roles
-
-In K3s clusters, there are two types of nodes: server nodes and agent nodes. Both servers and agents can have workloads scheduled on them. Server nodes run the Kubernetes master.
-
-For the cluster running the Rancher management server, we recommend using two server nodes. Agent nodes are not required.
-
-### RKE Cluster Roles
-
-If Rancher is installed on an RKE Kubernetes cluster, the cluster should have three nodes, and each node should have all three Kubernetes roles: etcd, controlplane, and worker.
-
-### Contrasting RKE Cluster Architecture for Rancher Server and for Downstream Kubernetes Clusters
-
-Our recommendation for RKE node roles on the Rancher server cluster contrasts with our recommendations for the downstream user clusters that run your apps and services.
-
-Rancher uses RKE as a library when provisioning downstream Kubernetes clusters. Note: The capability to provision downstream K3s clusters will be added in a future version of Rancher.
-
-For downstream Kubernetes clusters, we recommend that each node in a user cluster should have a single role for stability and scalability.
-
-![Kubernetes Roles for Nodes in Rancher Server Cluster vs. User Clusters]({{<baseurl>}}/img/rancher/rancher-architecture-node-roles.svg)
-
-RKE only requires at least one node with each role and does not require nodes to be restricted to one role. However, for the clusters that run your apps, we recommend separate roles for each node so that workloads on worker nodes don't interfere with the Kubernetes master or cluster data as your services scale.
-
-We recommend that downstream user clusters should have at least:
-
-- **Three nodes with only the etcd role** to maintain a quorum if one node is lost, making the state of your cluster highly available
-- **Two nodes with only the controlplane role** to make the master component highly available
-- **One or more nodes with only the worker role** to run the Kubernetes node components, as well as the workloads for your apps and services
-
-With that said, it is safe to use all three roles on three nodes when setting up the Rancher server because:
-
-* It allows one `etcd` node failure.
-* It maintains multiple instances of the master components by having multiple `controlplane` nodes.
-* No other workloads than Rancher itself should be created on this cluster.
-
-Because no additional workloads will be deployed on the Rancher server cluster, in most cases it is not necessary to use the same architecture that we recommend for the scalability and reliability of downstream clusters.
-
-For more best practices for downstream clusters, refer to the [production checklist]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production) or our [best practices guide.]({{<baseurl>}}/rancher/v2.x/en/best-practices/management/#tips-for-scaling-and-reliability)
-
-# Architecture for an Authorized Cluster Endpoint
-
-If you are using an [authorized cluster endpoint,]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) we recommend creating an FQDN pointing to a load balancer which balances traffic across your nodes with the `controlplane` role.
-
-If you are using private CA signed certificates on the load balancer, you have to supply the CA certificate, which will be included in the generated kubeconfig file to validate the certificate chain. See the documentation on [kubeconfig files]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/kubeconfig/) and [API keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/#creating-an-api-key) for more information.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/best-practices/mcm/containers/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/containers/_index.md
deleted file mode 100644
index 83f1cc182ec..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/mcm/containers/_index.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: Tips for Setting Up Containers
-weight: 100
----
-
-Running well built containers can greatly impact the overall performance and security of your environment.
-
-Below are a few tips for setting up your containers.
-
-For a more detailed discussion of security for containers, you can also refer to Rancher's [Guide to Container Security.](https://rancher.com/complete-guide-container-security)
-
-### Use a Common Container OS
-
-When possible, you should try to standardize on a common container base OS. 
-
-Smaller distributions such as Alpine and BusyBox reduce container image size and generally have a smaller attack/vulnerability surface.
-
-Popular distributions such as Ubuntu, Fedora, and CentOS are more field-tested and offer more functionality.
-
-### Start with a FROM scratch container
-If your microservice is a standalone static binary, you should use a FROM scratch container. 
-
-The FROM scratch container is an [official Docker image](https://hub.docker.com/_/scratch) that is empty so that you can use it to design minimal images.
-
-This will have the smallest attack surface and smallest image size.
-
-### Run Container Processes as Unprivileged
-When possible, use a non-privileged user when running processes within your container. While container runtimes provide isolation, vulnerabilities and attacks are still possible. Inadvertent or accidental host mounts can also be impacted if the container is running as root. For details on configuring a security context for a pod or container, refer to the [Kubernetes docs](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-
-### Define Resource Limits
-Apply CPU and memory limits to your pods. This can help manage the resources on your worker nodes and avoid a malfunctioning microservice from impacting other microservices.
-
-In standard Kubernetes, you can set resource limits on the namespace level. In Rancher, you can set resource limits on the project level and they will propagate to all the namespaces within the project. For details, refer to the Rancher docs.
-
-When setting resource quotas, if you set anything related to CPU or Memory (i.e. limits or reservations) on a project or namespace, all containers will require a respective CPU or Memory field set during creation. To avoid setting these limits on each and every container during workload creation, a default container resource limit can be specified on the namespace.
-
-The Kubernetes docs have more information on how resource limits can be set at the [container level](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container) and the namespace level.
-
-### Define Resource Requirements
-You should apply CPU and memory requirements to your pods. This is crucial for informing the scheduler which type of compute node your pod needs to be placed on, and ensuring it does not over-provision that node. In Kubernetes, you can set a resource requirement by defining `resources.requests` in the resource requests field in a pod's container spec. For details, refer to the [Kubernetes docs](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container).
-
-> **Note:** If you set a resource limit for the namespace that the pod is deployed in, and the container doesn't have a specific resource request, the pod will not be allowed to start. To avoid setting these fields on each and every container during workload creation, a default container resource limit can be specified on the namespace.
-
-It is recommended to define resource requirements on the container level because otherwise, the scheduler makes assumptions that will likely not be helpful to your application when the cluster experiences load.
-
-### Liveness and Readiness Probes
-Set up liveness and readiness probes for your container. Unless your container completely crashes, Kubernetes will not know it's unhealthy unless you create an endpoint or mechanism that can report container status. Alternatively, make sure your container halts and crashes if unhealthy.
-
-The Kubernetes docs show how to [configure liveness and readiness probes for containers.](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)
diff --git a/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-strategies/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-strategies/_index.md
deleted file mode 100644
index cd6d01bb1c4..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-strategies/_index.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-title: Rancher Deployment Strategies
-weight: 100
----
-
-There are two recommended deployment strategies. Each one has its own pros and cons. Read more about which one would fit best for your use case:
-
-* [Hub and Spoke](#hub-and-spoke)
-* [Regional](#regional)
-
-# Hub & Spoke Strategy
----
-
-In this deployment scenario, there is a single Rancher control plane managing Kubernetes clusters across the globe. The control plane would be run on a high-availability Kubernetes cluster, and there would be impact due to latencies.
-
-{{< img "/img/rancher/bpg/hub-and-spoke.png" "Hub and Spoke Deployment">}}
-
-### Pros
-
-* Environments could have nodes and network connectivity across regions.
-* Single control plane interface to view/see all regions and environments.
-* Kubernetes does not require Rancher to operate and can tolerate losing connectivity to the Rancher control plane.
-
-### Cons
-
-* Subject to network latencies.
-* If the control plane goes out, global provisioning of new services is unavailable until it is restored. However, each Kubernetes cluster can continue to be managed individually.
-
-# Regional Strategy
----
-In the regional deployment model a control plane is deployed in close proximity to the compute nodes.
-
-{{< img "/img/rancher/bpg/regional.png" "Regional Deployment">}}
-
-### Pros
-
-* Rancher functionality in regions stay operational if a control plane in another region goes down.
-* Network latency is greatly reduced, improving the performance of functionality in Rancher.
-* Upgrades of the Rancher control plane can be done independently per region.
-
-### Cons
-
-* Overhead of managing multiple Rancher installations.
-* Visibility across global Kubernetes clusters requires multiple interfaces/panes of glass.
-* Deploying multi-cluster apps in Rancher requires repeating the process for each Rancher server.
diff --git a/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-types/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-types/_index.md
deleted file mode 100644
index ff493e7fbf2..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/mcm/deployment-types/_index.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: Tips for Running Rancher
-weight: 100
----
-
-A high-availability Kubernetes installation, defined as an installation of Rancher on a Kubernetes cluster with at least three nodes, should be used in any production installation of Rancher, as well as any installation deemed "important." Multiple Rancher instances running on multiple nodes ensure high availability that cannot be accomplished with a single node environment.
-
-When you set up your high-availability Rancher installation, consider the following:
-
-### Run Rancher on a Separate Cluster
-Don't run other workloads or microservices in the Kubernetes cluster that Rancher is installed on.
-
-### Don't Run Rancher on a Hosted Kubernetes Environment
-When the Rancher server is installed on a Kubernetes cluster, it should not be run in a hosted Kubernetes environment such as Google's GKE, Amazon's EKS, or Microsoft's AKS. These hosted Kubernetes solutions do not expose etcd to a degree that is manageable for Rancher, and their customizations can interfere with Rancher operations.
-
-It is strongly recommended to use hosted infrastructure such as Amazon's EC2 or Google's GCE instead. When you create a cluster using RKE on an infrastructure provider, you can configure the cluster to create etcd snapshots as a backup. You can then [use RKE]({{<baseurl>}}/rke/latest/en/etcd-snapshots/) or [Rancher]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/) to restore your cluster from one of these snapshots. In a hosted Kubernetes environment, this backup and restore functionality is not supported.
-
-### Make sure nodes are configured correctly for Kubernetes ###
-It's important to follow K8s and etcd best practices when deploying your nodes, including disabling swap, double checking you have full network connectivity between all machines in the cluster, using unique hostnames, MAC addresses, and product_uuids for every node, checking that all correct ports are opened, and deploying with ssd backed etcd.  More details can be found in the [kubernetes docs](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#before-you-begin) and [etcd's performance op guide](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/performance.md)
-
-### When using RKE: Backup the Statefile
-RKE keeps record of the cluster state in a file called `cluster.rkestate`. This file is important for the recovery of a cluster and/or the continued maintenance of the cluster through RKE. Because this file contains certificate material, we strongly recommend encrypting this file before backing up. After each run of `rke up` you should backup the state file. 
-
-### Run All Nodes in the Cluster in the Same Datacenter
-For best performance, run all three of your nodes in the same geographic datacenter. If you are running nodes in the cloud, such as AWS, run each node in a separate Availability Zone. For example, launch node 1 in us-west-2a, node 2 in us-west-2b, and node 3 in us-west-2c.
-
-### Development and Production Environments Should be Similar
-It's strongly recommended to have a "staging" or "pre-production" environment of the Kubernetes cluster that Rancher runs on. This environment should mirror your production environment as closely as possible in terms of software and hardware configuration.
-
-### Monitor Your Clusters to Plan Capacity
-The Rancher server's Kubernetes cluster should run within the [system and hardware requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/) as closely as possible. The more you deviate from the system and hardware requirements, the more risk you take.
-
-However, metrics-driven capacity planning analysis should be the ultimate guidance for scaling Rancher, because the published requirements take into account a variety of workload types.
-
-Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with Prometheus, a leading open-source monitoring solution, and Grafana, which lets you visualize the metrics from Prometheus. 
-
-After you [enable monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) in the cluster, you can set up [a notification channel]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) and [cluster alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) to let you know if your cluster is approaching its capacity. You can also use the Prometheus and Grafana monitoring framework to establish a baseline for key metrics as you scale.
-
diff --git a/content/rancher/v2.5/en/ecm/best-practices/mcm/management/_index.md b/content/rancher/v2.5/en/ecm/best-practices/mcm/management/_index.md
deleted file mode 100644
index 4fd202dc1ec..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/mcm/management/_index.md
+++ /dev/null
@@ -1,132 +0,0 @@
----
-title: Tips for Scaling, Security and Reliability
-weight: 101
----
-
-Rancher allows you to set up numerous combinations of configurations. Some configurations are more appropriate for development and testing, while there are other best practices for production environments for maximum availability and fault tolerance. The following best practices should be followed for production.
-
-# Tips for Preventing and Handling Problems
-
-These tips can help you solve problems before they happen.
-
-### Run Rancher on a Supported OS and Supported Docker Version
-Rancher is container-based and can potentially run on any Linux-based operating system. However, only operating systems listed in the [requirements documentation]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/) should be used for running Rancher, along with a supported version of Docker. These versions have been most thoroughly tested and can be properly supported by the Rancher Support team.
-
-### Upgrade Your Kubernetes Version
-Keep your Kubernetes cluster up to date with a recent and supported version. Typically the Kubernetes community will support the current version and previous three minor releases (for example, 1.14.x, 1.13.x, 1.12.x, and 1.11.x). After a new version is released, the third-oldest supported version reaches EOL (End of Life) status. Running on an EOL release can be a risk if a security issues are found and patches are not available. The community typically makes minor releases every quarter (every three months).
-
-Rancher’s SLAs are not community dependent, but as Kubernetes is a community-driven software, the quality of experience will degrade as you get farther away from the community's supported target.
-
-### Kill Pods Randomly During Testing
-Run chaoskube or a similar mechanism to randomly kill pods in your test environment. This will test the resiliency of your infrastructure and the ability of Kubernetes to self-heal. It's not recommended to run this in your production environment.
-
-### Deploy Complicated Clusters with Terraform
-Rancher's "Add Cluster" UI is preferable for getting started with Kubernetes cluster orchestration or for simple use cases. However, for more complex or demanding use cases, it is recommended to use a CLI/API driven approach. [Terraform](https://www.terraform.io/) is recommended as the tooling to implement this. When you use Terraform with version control and a CI/CD environment, you can have high assurances of consistency and reliability when deploying Kubernetes clusters. This approach also gives you the most customization options.
-
-Rancher [maintains a Terraform provider](https://rancher.com/blog/2019/rancher-2-terraform-provider/) for working with Rancher 2.0 Kubernetes. It is called the [Rancher2 Provider.](https://www.terraform.io/docs/providers/rancher2/index.html)
-
-### Upgrade Rancher in a Staging Environment
-All upgrades, both patch and feature upgrades, should be first tested on a staging environment before production is upgraded. The more closely the staging environment mirrors production, the higher chance your production upgrade will be successful.
-
-### Renew Certificates Before they Expire
-Multiple people in your organization should set up calendar reminders for certificate renewal. Consider renewing the certificate two weeks to one month in advance. If you have multiple certificates to track, consider using [monitoring and alerting mechanisms]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) to track certificate expiration.
-
-Rancher-provisioned Kubernetes clusters will use certificates that expire in one year. Clusters provisioned by other means may have a longer or shorter expiration.
-
-Certificates can be renewed for Rancher-provisioned clusters [through the Rancher user interface]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/).
-
-### Enable Recurring Snapshots for Backing up and Restoring the Cluster
-Make sure etcd recurring snapshots are enabled. Extend the snapshot retention to a period of time that meets your business needs. In the event of a catastrophic failure or deletion of data, this may be your only recourse for recovery. For details about configuring snapshots, refer to the [RKE documentation]({{<baseurl>}}/rke/latest/en/etcd-snapshots/) or the [Rancher documentation on backups]({{<baseurl>}}/rancher/v2.x/en/backups/).
-
-### Provision Clusters with Rancher
-When possible, use Rancher to provision your Kubernetes cluster rather than importing a cluster. This will ensure the best compatibility and supportability.
-
-### Use Stable and Supported Rancher Versions for Production
-Do not upgrade production environments to alpha, beta, release candidate (rc), or "latest" versions. These early releases are often not stable and may not have a future upgrade path.
-
-When installing or upgrading a non-production environment to an early release, anticipate problems such as features not working, data loss, outages, and inability to upgrade without a reinstall.
-
-Make sure the feature version you are upgrading to is considered "stable" as determined by Rancher. Use the beta, release candidate, and "latest" versions in a testing, development, or demo environment to try out new features. Feature version upgrades, for example 2.1.x to 2.2.x, should be considered as and when they are released. Some bug fixes and most features are not back ported into older versions.
-
-Keep in mind that Rancher does End of Life support for old versions, so you will eventually want to upgrade if you want to continue to receive patches.
-
-For more detail on what happens during the Rancher product lifecycle, refer to the [Support Maintenance Terms](https://rancher.com/support-maintenance-terms/).
-
-# Network Topology
-These tips can help Rancher work more smoothly with your network.
-
-### Use Low-latency Networks for Communication Within Clusters
-Kubernetes clusters are best served by low-latency networks. This is especially true for the control plane components and etcd, where lots of coordination and leader election traffic occurs. Networking between Rancher server and the Kubernetes clusters it manages are more tolerant of latency.
-
-### Allow Rancher to Communicate Directly with Clusters
-Limit the use of proxies or load balancers between Rancher server and Kubernetes clusters. As Rancher is maintaining a long-lived web sockets connection, these intermediaries can interfere with the connection lifecycle as they often weren't configured with this use case in mind.
-
-
-# Tips for Scaling and Reliability
-These tips can help you scale your cluster more easily.
-
-### Use One Kubernetes Role Per Host
-Separate the etcd, control plane, and worker roles onto different hosts. Don't assign multiple roles to the same host, such as a worker and control plane. This will give you maximum scalability.
-
-### Run the Control Plane and etcd on Virtual Machines
-Run your etcd and control plane nodes on virtual machines where you can scale vCPU and memory easily if needed in the future.
-
-### Use at Least Three etcd Nodes
-Provision 3 or 5 etcd nodes. Etcd requires a quorum to determine a leader by the majority of nodes, therefore it is not recommended to have clusters of even numbers. Three etcd nodes is generally sufficient for smaller clusters and five etcd nodes for large clusters.
-
-### Use at Least Two Control Plane Nodes
-Provision two or more control plane nodes. Some control plane components, such as the `kube-apiserver`, run in [active-active](https://www.jscape.com/blog/active-active-vs-active-passive-high-availability-cluster) mode and will give you more scalability. Other components such as kube-scheduler and kube-controller run in active-passive mode (leader elect) and give you more fault tolerance.
-
-### Monitor Your Cluster
-Closely monitor and scale your nodes as needed. You should [enable cluster monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and use the Prometheus metrics and Grafana visualization options as a starting point.
-
-
-# Tips for Security
-Below are some basic tips for increasing security in Rancher. For more detailed information about securing your cluster, you can refer to these resources:
-
-- Rancher's [security documentation and Kubernetes cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/)
-- [101 More Security Best Practices for Kubernetes](https://rancher.com/blog/2019/2019-01-17-101-more-kubernetes-security-best-practices/)
-
-### Update Rancher with Security Patches
-Keep your Rancher installation up to date with the latest patches. Patch updates have important software fixes and sometimes have security fixes. When patches with security fixes are released, customers with Rancher licenses are notified by e-mail. These updates are also posted on Rancher's [forum](https://forums.rancher.com/).
-
-### Report Security Issues Directly to Rancher
-If you believe you have uncovered a security-related problem in Rancher, please communicate this immediately and discretely to the Rancher team (security@rancher.com). Posting security issues on public forums such as Twitter, Rancher Slack, GitHub, etc. can potentially compromise security for all Rancher customers. Reporting security issues discretely allows Rancher to assess and mitigate the problem. Security patches are typically given high priority and released as quickly as possible.
-
-### Only Upgrade One Component at a Time
-In addition to Rancher software updates, closely monitor security fixes for related software, such as Docker, Linux, and any libraries used by your workloads. For production environments, try to avoid upgrading too many entities during a single maintenance window. Upgrading multiple components can make it difficult to root cause an issue in the event of a failure. As business requirements allow, upgrade one component at a time.
-
-# Tips for Multi-Tenant Clusters
-
-### Namespaces
-Each tenant should have their own unique namespaces within the cluster. This avoids naming conflicts and allows resources to be only visible to their owner through use of RBAC policy
-
-### Project Isolation
-Use Rancher's Project Isolation to automatically generate Network Policy between Projects (sets of Namespaces). This further protects workloads from interference
-
-### Resource Limits
-Enforce use of sane resource limit definitions for every deployment in your cluster. This not only protects the owners of the deployment, but the neighboring resources from other tenants as well. Remember, namespaces do not isolate at the node level, so over-consumption of resources on a node affects other namespace deployments. Admission controllers can be written to require resource limit definitions
-
-### Resource Requirements
-Enforce use of resource requirement definitions for each deployment in your cluster. This enables the scheduler to appropriately schedule workloads. Otherwise you will eventually end up with over-provisioned nodes.
-
-# Class of Service and Kubernetes Clusters
-A class of service describes the expectations around cluster uptime, durability, and duration of maintenance windows. Typically organizations group these characteristics into labels such as "dev" or "prod"
-
-### Consider fault domains
-Kubernetes clusters can span multiple classes of service, however it is important to consider the ability for one workload to affect another. Without proper deployment practices such as resource limits, requirements, etc, a deployment that is not behaving well has the potential to impact the health of the cluster. In a "dev" environment it is common for end-users to exercise less caution with deployments, thus increasing the chance of such behavior. Sharing this behavior with your production workload increases risk.
-
-### Upgrade risks
-Upgrades of Kubernetes are not without risk, the best way to predict the outcome of an upgrade is try it on a cluster of similar load and use case as your production cluster. This is where having non-prod class of service clusters can be advantageous.
-
-### Resource Efficiency
-Clusters can be built with varying degrees of redundancy. In a class of service with low expectations for uptime, resources and cost can be conserved by building clusters without redundant Kubernetes control components. This approach may also free up more budget/resources to increase the redundancy at the production level
-
-# Network Security
-In general, you can use network security best practices in your Rancher and Kubernetes clusters. Consider the following:
-
-### Use a Firewall Between your Hosts and the Internet
-Firewalls should be used between your hosts and the Internet (or corporate Intranet). This could be enterprise firewall appliances in a datacenter or SDN constructs in the cloud, such as VPCs, security groups, ingress, and egress rules. Try to limit inbound access only to ports and IP addresses that require it. Outbound access can be shut off (air gap) if environment sensitive information that requires this restriction. If available, use firewalls with intrusion detection and DDoS prevention.
-
-### Run Periodic Security Scans
-Run security and penetration scans on your environment periodically. Even with well design infrastructure, a poorly designed microservice could compromise the entire environment.
diff --git a/content/rancher/v2.5/en/ecm/best-practices/rancher-server/_index.md b/content/rancher/v2.5/en/ecm/best-practices/rancher-server/_index.md
deleted file mode 100644
index 1bd764c11f0..00000000000
--- a/content/rancher/v2.5/en/ecm/best-practices/rancher-server/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Best Practices for the Rancher Server
-weight: 1
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/cloning-clusters/_index.md b/content/rancher/v2.5/en/ecm/cloning-clusters/_index.md
deleted file mode 100644
index c5315fa3f37..00000000000
--- a/content/rancher/v2.5/en/ecm/cloning-clusters/_index.md
+++ /dev/null
@@ -1,99 +0,0 @@
----
-title: Cloning Clusters
-weight: 18
----
-
-If you have a cluster in Rancher that you want to use as a template for creating similar clusters, you can use Rancher CLI to clone the cluster's configuration, edit it, and then use it to quickly launch the cloned cluster.
-
-Duplication of imported clusters is not supported.
-
-| Cluster Type                     | Cloneable?    |
-|----------------------------------|---------------|
-| [Nodes Hosted by Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) | ✓ |
-| [Hosted Kubernetes Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | ✓    |
-| [Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes)              | ✓              |
-| [Imported Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)            |               |
-
-> **Warning:** During the process of duplicating a cluster, you will edit a config file full of cluster settings. However, we recommend editing only values explicitly listed in this document, as cluster duplication is designed for simple cluster copying, _not_ wide scale configuration changes. Editing other values may invalidate the config file, which will lead to cluster deployment failure.
-
-## Prerequisites
-
-Download and install [Rancher CLI]({{<baseurl>}}/rancher/v2.x/en/cli). Remember to [create an API bearer token]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys) if necessary.
-
-
-## 1. Export Cluster Config
-
-Begin by using Rancher CLI to export the configuration for the cluster that you want to clone.
-
-1. Open Terminal and change your directory to the location of the Rancher CLI binary, `rancher`.
-
-1. Enter the following command to list the clusters managed by Rancher.
-
-
-        ./rancher cluster ls
-
-
-1. Find the cluster that you want to clone, and copy either its resource `ID` or `NAME` to your clipboard. From this point on, we'll refer to the resource `ID` or `NAME` as `<RESOURCE_ID>`, which is used as a placeholder in the next step.
-
-1. Enter the following command to export the configuration for your cluster.
-
-
-        ./rancher clusters export <RESOURCE_ID>
-
-
-    **Step Result:** The YAML for a cloned cluster prints to Terminal.
-
-1. Copy the YAML to your clipboard and paste it in a new file. Save the file as `cluster-template.yml` (or any other name, as long as it has a `.yml` extension).
-
-## 2. Modify Cluster Config
-
-Use your favorite text editor to modify the cluster configuration in `cluster-template.yml` for your cloned cluster.
-
-> **Note:** As of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0)
-
-1. Open `cluster-template.yml` (or whatever you named your config) in your favorite text editor.
-
-    >**Warning:** Only edit the cluster config values explicitly called out below. Many of the values listed in this file are used to provision your cloned cluster, and editing their values may break the provisioning process.
-
-
-1. As depicted in the example below, at the `<CLUSTER_NAME>` placeholder, replace your original cluster's name with a unique name (`<CLUSTER_NAME>`). If your cloned cluster has a duplicate name, the cluster will not provision successfully.
-
-    ```yml
-    Version: v3
-    clusters:
-        <CLUSTER_NAME>: # ENTER UNIQUE NAME
-        dockerRootDir: /var/lib/docker
-        enableNetworkPolicy: false
-        rancherKubernetesEngineConfig:
-        addonJobTimeout: 30
-        authentication:
-            strategy: x509
-        authorization: {}
-        bastionHost: {}
-        cloudProvider: {}
-        ignoreDockerVersion: true
-    ```
-
-1. For each `nodePools` section, replace the original nodepool name with a unique name at the `<NODEPOOL_NAME>` placeholder.  If your cloned cluster has a duplicate nodepool name, the cluster will not provision successfully.
-
-    ```yml
-    nodePools:
-        <NODEPOOL_NAME>:
-        clusterId: do
-        controlPlane: true
-        etcd: true
-        hostnamePrefix: mark-do
-        nodeTemplateId: do
-        quantity: 1
-        worker: true
-    ```
-
-1. When you're done, save and close the configuration.
-
-## 3. Launch Cloned Cluster
-
-Move `cluster-template.yml` into the same directory as the Rancher CLI binary. Then run this command:
-
-    ./rancher up --file cluster-template.yml
-
-**Result:** Your cloned cluster begins provisioning. Enter `./rancher cluster ls` to confirm. You can also log into the Rancher UI and open the **Global** view to watch your provisioning cluster's progress.
diff --git a/content/rancher/v2.5/en/ecm/cluster-configuration/_index.md b/content/rancher/v2.5/en/ecm/cluster-configuration/_index.md
deleted file mode 100644
index 526e9de80b7..00000000000
--- a/content/rancher/v2.5/en/ecm/cluster-configuration/_index.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: RKE Cluster Configuration
-weight: 6
----
-
-After you provision a Kubernetes cluster using Rancher, you can still edit options and settings for the cluster. To edit your cluster, open the **Global** view, make sure the **Clusters** tab is selected, and then select **&#8942; > Edit** for the cluster that you want to edit.
-
-<sup>To Edit an Existing Cluster</sup>
-![Edit Cluster]({{<baseurl>}}/img/rancher/edit-cluster.png)
-
-The options and settings available for an existing cluster change based on the method that you used to provision it. For example, only clusters [provisioned by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) have **Cluster Options** available for editing.
-
-The following table summarizes the options and settings available for each cluster type:
-
-{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
-
-## Editing Cluster Membership
-
-Cluster administrators can [edit the membership for a cluster,]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members) controlling which Rancher users can access the cluster and what features they can use.
-
-## Cluster Options
-
-When editing clusters, clusters that are [launched using RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) feature more options than clusters that are imported or hosted by a Kubernetes provider. The headings that follow document options available only for RKE clusters.
-
-### Updating ingress-nginx
-
-Clusters that were created before Kubernetes 1.16 will have an `ingress-nginx` `updateStrategy` of `OnDelete`. Clusters that were created with Kubernetes 1.16 or newer will have `RollingUpdate`.
-
-If the `updateStrategy` of `ingress-nginx` is `OnDelete`, you will need to delete these pods to get the correct version for your deployment.
-
-# Editing Other Cluster Options
-
-In [clusters launched by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), you can edit any of the remaining options that follow.
-
->**Note:** These options are not available for imported clusters or hosted Kubernetes clusters.
-
-<sup>Options for RKE Clusters</sup>
-![Cluster Options]({{<baseurl>}}/img/rancher/cluster-options.png)
-
-
-Option | Description |
----------|----------|
- Kubernetes Version | The version of Kubernetes installed on each cluster node. For more detail, see [Upgrading Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes). |
- Network Provider | The [container networking interface]({{<baseurl>}}/rancher/v2.x/en/faq/networking/#cni-providers) that powers networking for your cluster.<br/><br/>**Note:** You can only choose this option while provisioning your cluster. It cannot be edited later. |
- Project Network Isolation | As of Rancher v2.0.7, if you're using the Canal network provider, you can choose whether to enable or disable inter-project communication. |
- Nginx Ingress | If you want to publish your applications in a high-availability configuration, and you're hosting your nodes with a cloud-provider that doesn't have a native load-balancing feature, enable this option to use Nginx ingress within the cluster. |
- Metrics Server Monitoring | Each cloud provider capable of launching a cluster using RKE can collect metrics and monitor for your cluster nodes. Enable this option to view your node metrics from your cloud provider's portal. |
- Pod Security Policy Support | Enables [pod security policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/) for the cluster. After enabling this option, choose a policy using the **Default Pod Security Policy** drop-down. |
- Docker version on nodes | Configures whether nodes are allowed to run versions of Docker that Rancher doesn't officially support. If you choose to require a [supported Docker version]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/), Rancher will stop pods from running on nodes that don't have a supported Docker version installed. |
- Docker Root Directory | The directory on your cluster nodes where you've installed Docker. If you install Docker on your nodes to a non-default directory, update this path. |
- Default Pod Security Policy | If you enable **Pod Security Policy Support**, use this drop-down to choose the pod security policy that's applied to the cluster. |
- Cloud Provider | If you're using a cloud provider to host cluster nodes launched by RKE, enable [this option]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) so that you can use the cloud provider's native features. If you want to store persistent data for your cloud-hosted cluster, this option is required.  |
-<br/>
-
-# Editing Cluster as YAML
-
->**Note:** In Rancher v2.0.5 and v2.0.6, the names of services in the Config File (YAML) should contain underscores only: `kube_api` and `kube_controller`.
-
-Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the options available in an RKE installation, except for system_images configuration, by specifying them in YAML.
-
-- To edit an RKE config file directly from the Rancher UI, click **Edit as YAML**.
-- To read from an existing RKE file, click **Read from File**.
-
-In Rancher v2.0.0-v2.2.x, the config file is identical to the  [cluster config file for the Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/config-options/), which is the tool Rancher uses to provision clusters. In Rancher v2.3.0, the RKE information is still included in the config file, but it is separated from other options, so that the RKE cluster config options are nested under the `rancher_kubernetes_engine_config` directive. For more information, see the [cluster configuration reference.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options)
-
-![image]({{<baseurl>}}/img/rancher/cluster-options-yaml.png)
-
-For an example of RKE config file syntax, see the [RKE documentation]({{<baseurl>}}/rke/latest/en/example-yamls/).  
diff --git a/content/rancher/v2.5/en/ecm/config-private-registry/_index.md b/content/rancher/v2.5/en/ecm/config-private-registry/_index.md
deleted file mode 100644
index 1ba3e37b8f8..00000000000
--- a/content/rancher/v2.5/en/ecm/config-private-registry/_index.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Configuring a Global Default Private Registry
-weight: 10
----
-
-You might want to use a private Docker registry to share your custom base images within your organization. With a private registry, you can keep a private, consistent, and centralized source of truth for the Docker images that are used in your clusters.
-
-There are two main ways to set up private registries in Rancher: by setting up the global default registry through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials.
-
-This section is about configuring the global default private registry, and focuses on how to configure the registry from the Rancher UI after Rancher is installed.
-
-For instructions on setting up a private registry with command line options during the installation of Rancher, refer to the [air gapped Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node) or [air gapped Kubernetes installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability) instructions.
-
-If your private registry requires credentials, it cannot be used as the default registry. There is no global way to set up a private registry with authorization for every Rancher-provisioned cluster. Therefore, if you want a Rancher-provisioned cluster to pull images from a private registry with credentials, you will have to [pass in the registry credentials through the advanced cluster options](#provisioning-clusters-with-private-registries-that-require-credentials) every time you create a new cluster.
-
-# Setting a Private Registry with No Credentials as the Default Registry
-
-1. Log into Rancher and configure the default administrator password.
-
-1. Go into the **Settings** view.
-
-    {{< img "/img/rancher/airgap/settings.png" "Settings" >}}
-
-1. Look for the setting called `system-default-registry` and choose **Edit**.
-
-    {{< img "/img/rancher/airgap/edit-system-default-registry.png" "Edit" >}}
-
-1. Change the value to your registry (e.g. `registry.yourdomain.com:port`). Do not prefix the registry with `http://` or `https://`.
-
-    {{< img "/img/rancher/airgap/enter-system-default-registry.png" "Save" >}}
-
-**Result:** Rancher will use your private registry to pull system images.
-
-# Setting a Private Registry with Credentials when Deploying a Cluster
-
-You can follow these steps to configure a private registry when you provision a cluster with Rancher:
-
-1. When you create a cluster through the Rancher UI, go to the **Cluster Options** section and click **Show Advanced Options.**
-1. In the <b>Enable Private Registries</b> section, click **Enabled.**
-1. Enter the registry URL and credentials.
-1. Click **Save.**
-
-**Result:** The new cluster will be able to pull images from the private registry.
diff --git a/content/rancher/v2.5/en/ecm/disconnecting-nodes/_index.md b/content/rancher/v2.5/en/ecm/disconnecting-nodes/_index.md
deleted file mode 100644
index 893e537ffb1..00000000000
--- a/content/rancher/v2.5/en/ecm/disconnecting-nodes/_index.md
+++ /dev/null
@@ -1,279 +0,0 @@
----
-title: Disconnecting Nodes from RKE Kubernetes Clusters
-description: Learn about cluster cleanup when removing nodes from your Rancher-launched Kubernetes cluster. What is removed, how to do it manually
-weight: 11
----
-
-This section describes how to disconnect a node from a Rancher-launched Kubernetes cluster and remove all of the Kubernetes components from the node. This process allows you to use the node for other purposes.
-
-When you use Rancher to [launch nodes for a cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher), resources (containers/virtual network interfaces) and configuration items (certificates/configuration files) are created.
-
-When removing nodes from your Rancher launched Kubernetes cluster (provided that they are in `Active` state), those resources are automatically cleaned, and the only action needed is to restart the node. When a node has become unreachable and the automatic cleanup process cannot be used, we describe the steps that need to be executed before the node can be added to a cluster again.
-
-## What Gets Removed?
-
-When cleaning nodes provisioned using Rancher, the following components are deleted based on the type of cluster node you're removing.
-
-| Removed Component                                                              | [Nodes Hosted by Infrastructure Provider][1] | [Custom Nodes][2] | [Hosted Cluster][3] | [Imported Nodes][4] |
-| ------------------------------------------------------------------------------ | --------------- | ----------------- | ------------------- | ------------------- |
-| The Rancher deployment namespace (`cattle-system` by default)                  | ✓               | ✓                 | ✓                   | ✓                   |
-| `serviceAccount`, `clusterRoles`, and `clusterRoleBindings` labeled by Rancher | ✓               | ✓                 | ✓                   | ✓                   |
-| Labels, Annotations, and Finalizers                                            | ✓               | ✓                 | ✓                   | ✓                   |
-| Rancher Deployment                                                             | ✓               | ✓                 | ✓                   |                     |
-| Machines, clusters, projects, and user custom resource definitions (CRDs)      | ✓               | ✓                 | ✓                   |                     |
-| All resources create under the `management.cattle.io` API Group                | ✓               | ✓                 | ✓                   |                     |
-| All CRDs created by Rancher v2.x                                               | ✓               | ✓                 | ✓                   |                     |
-
-[1]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/
-[2]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/
-[3]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/
-[4]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/
-
-## Removing a Node from a Cluster by Rancher UI
-
-When the node is in `Active` state, removing the node from a cluster will trigger a process to clean up the node. Please restart the node after the automatic cleanup process is done to make sure any non-persistent data is properly removed.
-
-**To restart a node:**
-
-```
-# using reboot
-$ sudo reboot
-
-# using shutdown
-$ sudo shutdown -r now
-```
-
-## Removing Rancher Components from a Cluster Manually
-
-When a node is unreachable and removed from the cluster, the automatic cleaning process can't be triggered because the node is unreachable. Please follow the steps below to manually remove the Rancher components.
-
->**Warning:** The commands listed below will remove data from the node. Make sure you have created a backup of files you want to keep before executing any of the commands as data will be lost.
-
-### Removing Rancher Components from Imported Clusters
-
-For imported clusters, the process for removing Rancher is a little different. You have the option of simply deleting the cluster in the Rancher UI, or your can run a script that removes Rancher components from the nodes. Both options make the same deletions.
-
-After the imported cluster is detached from Rancher, the cluster's workloads will be unaffected and you can access the cluster using the same methods that you did before the cluster was imported into Rancher.
-
-{{% tabs %}}
-{{% tab "By UI / API" %}}
->**Warning:** This process will remove data from your cluster. Make sure you have created a backup of files you want to keep before executing the command, as data will be lost.
-
-After you initiate the removal of an [imported cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#import-existing-cluster) using the Rancher UI (or API), the following events occur.
-
-1. Rancher creates a `serviceAccount` that it uses to remove the Rancher components from the cluster. This account is assigned the [clusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) and [clusterRoleBinding](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) permissions, which are required to remove the Rancher components.
-
-1. Using the `serviceAccount`, Rancher schedules and runs a [job](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/) that cleans the Rancher components off of the cluster. This job also references the `serviceAccount` and its roles as dependencies, so the job deletes them before its completion.
-
-1. Rancher is removed from the cluster. However, the cluster persists, running the native version of Kubernetes.
-
-**Result:** All components listed for imported clusters in [What Gets Removed?](#what-gets-removed) are deleted.
-
-{{% /tab %}}
-{{% tab "By Script" %}}
-Rather than cleaning imported cluster nodes using the Rancher UI, you can run a script instead. This functionality is available since `v2.1.0`.
-
->**Prerequisite:**
->
->Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
-
-1. Open a web browser, navigate to [GitHub](https://github.com/rancher/rancher/blob/master/cleanup/user-cluster.sh), and download `user-cluster.sh`.
-
-1. Make the script executable by running the following command from the same directory as `user-cluster.sh`:
-
-    ```
-    chmod +x user-cluster.sh
-    ```
-
-1. **Air Gap Environments Only:** Open `user-cluster.sh` and replace `yaml_url` with the URL in `user-cluster.yml`.
-
-    If you don't have an air gap environment, skip this step.
-
-1. From the same directory, run the script and provide the `rancher/rancher-agent` image version which should be equal to the version of Rancher used to manage the cluster. (`<RANCHER_VERSION>`):
-
-    >**Tip:**
-    >
-    >Add the `-dry-run` flag to preview the script's outcome without making changes.
-    ```
-    ./user-cluster.sh rancher/rancher-agent:<RANCHER_VERSION>
-    ```
-
-**Result:** The script runs. All components listed for imported clusters in [What Gets Removed?](#what-gets-removed) are deleted.
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### Windows Nodes
-
-To clean up a Windows node, you can run a cleanup script located in `c:\etc\rancher`. The script deletes Kubernetes generated resources and the execution binary. It also drops the firewall rules and network settings.
-
-To run the script, you can use this command in the PowerShell:
-
-```
-pushd c:\etc\rancher
-.\cleanup.ps1
-popd
-```
-
-**Result:** The node is reset and can be re-added to a Kubernetes cluster.
-
-### Docker Containers, Images, and Volumes
-
-Based on what role you assigned to the node, there are Kubernetes components in containers, containers belonging to overlay networking, DNS, ingress controller and Rancher agent. (and pods you created that have been scheduled to this node)
-
-**To clean all Docker containers, images and volumes:**
-
-```
-docker rm -f $(docker ps -qa)
-docker rmi -f $(docker images -q)
-docker volume rm $(docker volume ls -q)
-```
-
-### Mounts
-
-Kubernetes components and secrets leave behind mounts on the system that need to be unmounted.
-
-Mounts |
---------|
-`/var/lib/kubelet/pods/XXX` (miscellaneous mounts)  |
-`/var/lib/kubelet` |
-`/var/lib/rancher` |
-
-**To unmount all mounts:**
-
-```
-for mount in $(mount | grep tmpfs | grep '/var/lib/kubelet' | awk '{ print $3 }') /var/lib/kubelet /var/lib/rancher; do umount $mount; done
-```
-
-### Directories and Files
-
-The following directories are used when adding a node to a cluster, and should be removed. You can remove a directory using `rm -rf /directory_name`.
-
->**Note:** Depending on the role you assigned to the node, some of the directories will or won't be present on the node.
-
-Directories |
---------|
-`/etc/ceph` |
-`/etc/cni` |
-`/etc/kubernetes` |
-`/opt/cni` |
-`/opt/rke` |
-`/run/secrets/kubernetes.io` |
-`/run/calico` |
-`/run/flannel` |
-`/var/lib/calico` |
-`/var/lib/etcd` |
-`/var/lib/cni` |
-`/var/lib/kubelet` |
-`/var/lib/rancher/rke/log` |
-`/var/log/containers` |
-`/var/log/kube-audit` |
-`/var/log/pods` |
-`/var/run/calico` |
-
-**To clean the directories:**
-
-```
-rm -rf /etc/ceph \
-       /etc/cni \
-       /etc/kubernetes \
-       /opt/cni \
-       /opt/rke \
-       /run/secrets/kubernetes.io \
-       /run/calico \
-       /run/flannel \
-       /var/lib/calico \
-       /var/lib/etcd \
-       /var/lib/cni \
-       /var/lib/kubelet \
-       /var/lib/rancher/rke/log \
-       /var/log/containers \
-       /var/log/kube-audit \
-       /var/log/pods \
-       /var/run/calico
-```
-
-### Network Interfaces and Iptables
-
-The remaining two components that are changed/configured are (virtual) network interfaces and iptables rules. Both are non-persistent to the node, meaning that they will be cleared after a restart of the node. To remove these components, a restart is recommended.
-
-**To restart a node:**
-
-```
-# using reboot
-$ sudo reboot
-
-# using shutdown
-$ sudo shutdown -r now
-```
-
-If you want to know more on (virtual) network interfaces or iptables rules, please see the specific subjects below.
-
-### Network Interfaces
-
->**Note:** Depending on the network provider configured for the cluster the node was part of, some of the interfaces will or won't be present on the node.
-
-Interfaces |
---------|
-`flannel.1` |
-`cni0` |
-`tunl0` |
-`caliXXXXXXXXXXX` (random interface names)  |
-`vethXXXXXXXX` (random interface names)  |
-
-**To list all interfaces:**
-
-```
-# Using ip
-ip address show
-
-# Using ifconfig
-ifconfig -a
-```
-
-**To remove an interface:**
-
-```
-ip link delete interface_name
-```
-
-### Iptables
-
->**Note:** Depending on the network provider configured for the cluster the node was part of, some of the chains will or won't be present on the node.
-
-Iptables rules are used to route traffic from and to containers. The created rules are not persistent, so restarting the node will restore iptables to its original state.
-
-Chains |
---------|
-`cali-failsafe-in` |
-`cali-failsafe-out` |
-`cali-fip-dnat` |
-`cali-fip-snat` |
-`cali-from-hep-forward` |
-`cali-from-host-endpoint` |
-`cali-from-wl-dispatch` |
-`cali-fw-caliXXXXXXXXXXX` (random chain names) |
-`cali-nat-outgoing` |
-`cali-pri-kns.NAMESPACE` (chain per namespace) |
-`cali-pro-kns.NAMESPACE` (chain per namespace) |
-`cali-to-hep-forward` |
-`cali-to-host-endpoint` |
-`cali-to-wl-dispatch` |
-`cali-tw-caliXXXXXXXXXXX` (random chain names) |
-`cali-wl-to-host` |
-`KUBE-EXTERNAL-SERVICES` |
-`KUBE-FIREWALL` |
-`KUBE-MARK-DROP` |
-`KUBE-MARK-MASQ` |
-`KUBE-NODEPORTS` |
-`KUBE-SEP-XXXXXXXXXXXXXXXX` (random chain names) |
-`KUBE-SERVICES` |
-`KUBE-SVC-XXXXXXXXXXXXXXXX` (random chain names) |
-
-**To list all iptables rules:**
-
-```
-iptables -L -t nat
-iptables -L -t mangle
-iptables -L
-```
diff --git a/content/rancher/v2.5/en/ecm/drivers/_index.md b/content/rancher/v2.5/en/ecm/drivers/_index.md
deleted file mode 100644
index 1ca1981a571..00000000000
--- a/content/rancher/v2.5/en/ecm/drivers/_index.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: Provisioning Drivers
-weight: 12
----
-
-Drivers in Rancher allow you to manage which providers can be used to deploy [hosted Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) or [nodes in an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) to allow Rancher to deploy and manage Kubernetes.
-
-###  Rancher Drivers
-
-With Rancher drivers, you can enable/disable existing built-in drivers that are packaged in Rancher. Alternatively, you can add your own driver if Rancher has not yet implemented it.
-
-There are two types of drivers within Rancher:
-
-* [Cluster Drivers](#cluster-drivers)
-* [Node Drivers](#node-drivers)
-
-## Cluster Drivers  
-
-Cluster drivers are used to provision [hosted Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/), such as GKE, EKS, AKS, etc.. The availability of which cluster driver to display when creating a cluster is defined based on the cluster driver's status. Only `active` cluster drivers will be displayed as an option for creating clusters for hosted Kubernetes clusters. By default, Rancher is packaged with several existing cluster drivers, but you can also create custom cluster drivers to add to Rancher.
-
-By default, Rancher has activated several hosted Kubernetes cloud providers including:
-
-*  [Amazon EKS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/)
-*  [Google GKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/gke/)
-*  [Azure AKS]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/aks/)
-
-There are several other hosted Kubernetes cloud providers that are disabled by default, but are packaged in Rancher:
-
-* [Alibaba ACK]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/ack/)
-* [Huawei CCE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce/)
-* [Tencent]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke/)
-
-## Node Drivers
-
-Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. A node driver is the same as a [Docker Machine driver](https://docs.docker.com/machine/drivers/). The availability of which node driver to display when creating node templates is defined based on the node driver's status. Only `active` node drivers will be displayed as an option for creating node templates. By default, Rancher is packaged with many existing Docker Machine drivers, but you can also create custom node drivers to add to Rancher.
-
-If there are specific node drivers that you don't want to show to your users, you would need to de-activate these node drivers.
-
-Rancher supports several major cloud providers, but by default, these node drivers are active and available for deployment:
-
-*   [Amazon EC2]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/)
-*   [Azure]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/azure/)
-*   [Digital Ocean]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/digital-ocean/)
-*   [vSphere]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/)
diff --git a/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md b/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
deleted file mode 100644
index 03a67524ef3..00000000000
--- a/content/rancher/v2.5/en/ecm/drivers/cluster-drivers/_index.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: Cluster Drivers
-weight: 1
----
-
-Cluster drivers are used to create clusters in a [hosted Kubernetes provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/), such as Google GKE. The availability of which cluster driver to display when creating clusters is defined by the cluster driver's status. Only `active` cluster drivers will be displayed as an option for creating clusters. By default, Rancher is packaged with several existing cloud provider cluster drivers, but you can also add custom cluster drivers to Rancher.
-
-If there are specific cluster drivers that you do not want to show your users, you may deactivate those cluster drivers within Rancher and they will not appear as an option for cluster creation.
-
-### Managing Cluster Drivers
-
->**Prerequisites:** To create, edit, or delete cluster drivers, you need _one_ of the following permissions:
->
->- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
->- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Cluster Drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
-
-## Activating/Deactivating Cluster Drivers
-
-By default, Rancher only activates drivers for the most popular cloud providers, Google GKE, Amazon EKS and Azure AKS. If you want to show or hide any node driver, you can change its status.
-
-1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar.
-
-2.  From the **Drivers** page, select the **Cluster Drivers** tab.
-
-3.  Select the driver that you wish to **Activate** or **Deactivate** and select the appropriate icon.
-
-## Adding Custom Cluster Drivers
-
-If you want to use a cluster driver that Rancher doesn't support out-of-the-box, you can add the provider's driver in order to start using them to create _hosted_ kubernetes clusters.
-
-1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar.
-
-2.  From the **Drivers** page select the **Cluster Drivers** tab.
-
-3.  Click **Add Cluster Driver**.
-
-4.  Complete the **Add Cluster Driver** form. Then click **Create**.
-
-
-### Developing your own Cluster Driver
-
-In order to develop cluster driver to add to Rancher, please refer to our [example](https://github.com/rancher-plugins/kontainer-engine-driver-example).
diff --git a/content/rancher/v2.5/en/ecm/drivers/node-drivers/_index.md b/content/rancher/v2.5/en/ecm/drivers/node-drivers/_index.md
deleted file mode 100644
index 69975a929ff..00000000000
--- a/content/rancher/v2.5/en/ecm/drivers/node-drivers/_index.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Node Drivers
-weight: 2
----
-
-Node drivers are used to provision hosts, which Rancher uses to launch and manage Kubernetes clusters. A node driver is the same as a [Docker Machine driver](https://docs.docker.com/machine/drivers/). The availability of which node driver to display when creating node templates is defined based on the node driver's status. Only `active` node drivers will be displayed as an option for creating node templates. By default, Rancher is packaged with many existing Docker Machine drivers, but you can also create custom node drivers to add to Rancher.
-
-If there are specific node drivers that you don't want to show to your users, you would need to de-activate these node drivers.
-
-#### Managing Node Drivers
-
->**Prerequisites:** To create, edit, or delete drivers, you need _one_ of the following permissions:
->
->- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
->- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Node Drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
-
-## Activating/Deactivating Node Drivers
-
-By default, Rancher only activates drivers for the most popular cloud providers, Amazon EC2, Azure, DigitalOcean and vSphere. If you want to show or hide any node driver, you can change its status.
-
-1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar. From the **Drivers** page, select the **Node Drivers** tab. In version prior to v2.2.0, you can select **Node Drivers** directly in the navigation bar.
-
-2.	Select the driver that you wish to **Activate** or **Deactivate** and select the appropriate icon.
-
-## Adding Custom Node Drivers
-
-If you want to use a node driver that Rancher doesn't support out-of-the-box, you can add that provider's driver in order to start using them to create node templates and eventually node pools for your Kubernetes cluster.
-
-1.  From the **Global** view, choose **Tools > Drivers** in the navigation bar. From the **Drivers** page, select the **Node Drivers** tab. In version prior to v2.2.0, you can select **Node Drivers** directly in the navigation bar.  
-
-2.	Click **Add Node Driver**.
-
-3.	Complete the **Add Node Driver** form. Then click **Create**.
-
-### Developing your own node driver
-
-Node drivers are implemented with [Docker Machine](https://docs.docker.com/machine/).
diff --git a/content/rancher/v2.5/en/ecm/feature-flags/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/_index.md
deleted file mode 100644
index 4d766396545..00000000000
--- a/content/rancher/v2.5/en/ecm/feature-flags/_index.md
+++ /dev/null
@@ -1,154 +0,0 @@
----
-title: Enabling Experimental Features
-weight: 17
----
-
-> This page is under construction.
-
-Rancher includes some features that are experimental and disabled by default. You might want to enable these features, for example, if you decide that the benefits of using an [unsupported storage type]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers) outweighs the risk of using an untested feature. Feature flags were introduced to allow you to try these features that are not enabled by default.
-
-The features can be enabled in three ways:
-
-- [Enable features when starting Rancher.](#enabling-features-when-starting-rancher) When installing Rancher with a CLI, you can use a feature flag to enable a feature by default.
-- [Enable features from the Rancher UI](#enabling-features-with-the-rancher-ui) in Rancher v2.3.3+ by going to the **Settings** page.
-- [Enable features with the Rancher API](#enabling-features-with-the-rancher-api) after installing Rancher.
-
-Each feature has two values:
-
-- A default value, which can be configured with a flag or environment variable from the command line
-- A set value, which can be configured with the Rancher API or UI
-
-If no value has been set, Rancher uses the default value.
-
-Because the API sets the actual value and the command line sets the default value, that means that if you enable or disable a feature with the API or UI, it will override any value set with the command line.
-
-For example, if you install Rancher, then set a feature flag to true with the Rancher API, then upgrade Rancher with a command that sets the feature flag to false, the default value will still be false, but the feature will still be enabled because it was set with the Rancher API. If you then deleted the set value (true) with the Rancher API, setting it to NULL, the default value (false) would take effect.
-
-> **Note:** As of v2.4.0, there are some feature flags that may require a restart of the Rancher server container. These features that require a restart are marked in the table of these docs and in the UI.
-
-The following is a list of the feature flags available in Rancher:
-
-- `dashboard`: This feature enables the new experimental UI that has a new look and feel. The dashboard also leverages a new API in Rancher which allows the UI to access the default Kubernetes resources without any intervention from Rancher.
-- `istio-virtual-service-ui`: This feature enables a [UI to create, read, update, and delete Istio virtual services and destination rules]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/istio-virtual-service-ui), which are traffic management features of Istio.
-- `proxy`: This feature enables Rancher to use a new simplified code base for the proxy, which can help enhance performance and security. The proxy feature is known to have issues with Helm deployments, which prevents any catalog applications to be deployed which includes Rancher's tools like monitoring, logging, Istio, etc.
-- `unsupported-storage-drivers`: This feature [allows unsupported storage drivers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers) In other words, it enables types for storage providers and provisioners that are not enabled by default.
-
-The below table shows the availability and default value for feature flags in Rancher:
-
-| Feature Flag Name             | Default Value | Status       | Available as of | Rancher Restart Required? |
-| ----------------------------- | ------------- | ------------ | --------------- |---|
-| `dashboard` | `true` | Experimental | v2.4.0 | x |
-| `istio-virtual-service-ui`    | `false`       | Experimental | v2.3.0          | |
-| `istio-virtual-service-ui`    | `true`        | GA           | v2.3.2          | |
-| `proxy` | `false` | Experimental | v2.4.0 | |
-| `unsupported-storage-drivers` | `false`       | Experimental | v2.3.0          | |
-
-# Enabling Features when Starting Rancher
-
-When you install Rancher, enable the feature you want with a feature flag. The command is different depending on whether you are installing Rancher on a single node or if you are doing a Kubernetes Installation of Rancher.
-
-> **Note:** Values set from the Rancher API will override the value passed in through the command line.
-
-{{% tabs %}}
-{{% tab "Kubernetes Install" %}}
-When installing Rancher with a Helm chart, use the `--features` option. In the below example, two features are enabled by passing the feature flag names names in a comma separated list:
-
-```
-helm install rancher-latest/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
-  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
-```
-
-Note: If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
-
-### Rendering the Helm Chart for Air Gap Installations
-
-For an air gap installation of Rancher, you need to add a Helm chart repository and render a Helm template before installing Rancher with Helm. For details, refer to the [air gap installation documentation.]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher)
-
-Here is an example of a command for passing in the feature flag names when rendering the Helm template. In the below example, two features are enabled by passing the feature flag names in a comma separated list.
-
-The Helm 3 command is as follows:
-
-```
-helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
-  --namespace cattle-system \
-  --set hostname=<RANCHER.YOURDOMAIN.COM> \
-  --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-  --set ingress.tls.source=secret \
-  --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-  --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
-  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
-```
-
-The Helm 2 command is as follows:
-
-```
-helm template ./rancher-<VERSION>.tgz --output-dir . \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=<RANCHER.YOURDOMAIN.COM> \
-  --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-  --set ingress.tls.source=secret \
-  --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-  --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
-  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
-```
-
-{{% /tab %}}
-{{% tab "Docker Install" %}}
-When installing Rancher with Docker, use the `--features` option. In the below example, two features are enabled by passing the feature flag names in a comma separated list:
-
-```
-docker run -d -p 80:80 -p 443:443 \
-  --restart=unless-stopped \
-  rancher/rancher:rancher-latest \
-  --features=<FEATURE-FLAG-NAME-1>=true,<FEATURE-NAME-2>=true # Available as of v2.3.0
-```
-
-{{% /tab %}}
-{{% /tabs %}}
-
-# Enabling Features with the Rancher UI
-
-1. Go to the **Global** view and click **Settings.**
-1. Click the **Feature Flags** tab. You will see a list of experimental features.
-1. To enable a feature, go to the disabled feature you want to enable and click **&#8942; > Activate.**
-
-**Result:** The feature is enabled.
-
-### Disabling Features with the Rancher UI
-
-1. Go to the **Global** view and click **Settings.**
-1. Click the **Feature Flags** tab. You will see a list of experimental features.
-1. To disable a feature, go to the enabled feature you want to disable and click **&#8942; > Deactivate.**
-
-**Result:** The feature is disabled.
-
-# Enabling Features with the Rancher API
-
-1. Go to `<RANCHER-SERVER-URL>/v3/features`.
-1. In the `data` section, you will see an array containing all of the features that can be turned on with feature flags. The name of the feature is in the `id` field. Click the name of the feature you want to enable.
-1. In the upper left corner of the screen, under **Operations,** click **Edit.**
-1. In the **Value** drop-down menu, click **True.**
-1. Click **Show Request.**
-1. Click **Send Request.**
-1. Click **Close.**
-
-**Result:** The feature is enabled.
-
-### Disabling Features with the Rancher API
-
-1. Go to `<RANCHER-SERVER-URL>/v3/features`.
-1. In the `data` section, you will see an array containing all of the features that can be turned on with feature flags. The name of the feature is in the `id` field. Click the name of the feature you want to enable.
-1. In the upper left corner of the screen, under **Operations,** click **Edit.**
-1. In the **Value** drop-down menu, click **False.**
-1. Click **Show Request.**
-1. Click **Send Request.**
-1. Click **Close.**
-
-**Result:** The feature is disabled.
diff --git a/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
deleted file mode 100644
index 6fcea1be92f..00000000000
--- a/content/rancher/v2.5/en/ecm/feature-flags/enable-not-default-storage-drivers/_index.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: Allow Unsupported Storage Drivers
-weight: 1
----
-
-This feature allows you to use types for storage providers and provisioners that are not enabled by default.
-
-To enable or disable this feature, refer to the instructions on [the main page about enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
-
-Environment Variable Key | Default Value | Description
----|---|---
- `unsupported-storage-drivers` | `false` | This feature enables types for storage providers and provisioners that are not enabled by default.
-
-### Types for Persistent Volume Plugins that are Enabled by Default
-Below is a list of storage types for persistent volume plugins that are enabled by default. When enabling this feature flag, any persistent volume plugins that are not on this list are considered experimental and unsupported:
-
-Name | Plugin
---------|----------
-Amazon EBS Disk |  `aws-ebs`
-AzureFile | `azure-file`
-AzureDisk | `azure-disk`
-Google Persistent Disk | `gce-pd`
-Longhorn | `flex-volume-longhorn`
-VMware vSphere Volume |  `vsphere-volume`
-Local | `local`
-Network File System | `nfs`
-hostPath | `host-path`
-
-### Types for StorageClass that are Enabled by Default
-Below is a list of storage types for a StorageClass that are enabled by default. When enabling this feature flag, any persistent volume plugins that are not on this list are considered experimental and unsupported:
-
-Name | Plugin
---------|--------
-Amazon EBS Disk |  `aws-ebs`
-AzureFile | `azure-file`
-AzureDisk | `azure-disk`
-Google Persistent Disk | `gce-pd`
-Longhorn | `flex-volume-longhorn`
-VMware vSphere Volume | `vsphere-volume`
-Local | `local`
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md b/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
deleted file mode 100644
index 5bf7ca6a58e..00000000000
--- a/content/rancher/v2.5/en/ecm/feature-flags/istio-virtual-service-ui/_index.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-title: UI for Istio Virtual Services and Destination Rules
-weight: 2
----
-
-This feature enables a UI that lets you create, read, update and delete virtual services and destination rules, which are traffic management features of Istio.
-
-> **Prerequisite:** Turning on this feature does not enable Istio. A cluster administrator needs to [enable Istio for the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) in order to use the feature.
-
-To enable or disable this feature, refer to the instructions on [the main page about enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
-
-Environment Variable Key | Default Value | Status | Available as of
----|---|---|---
-`istio-virtual-service-ui` |`false` |  Experimental | v2.3.0
-`istio-virtual-service-ui` | `true` | GA                    | v2.3.2
-
-# About this Feature
-
-A central advantage of Istio's traffic management features is that they allow dynamic request routing, which is useful for canary deployments, blue/green deployments, or A/B testing.
-
-When enabled, this feature turns on a page that lets you configure some traffic management features of Istio using the Rancher UI. Without this feature, you need to use `kubectl` to manage traffic with Istio.
-
-The feature enables two UI tabs: one tab for **Virtual Services** and another for **Destination Rules.** 
-
-- **Virtual services** intercept and direct traffic to your Kubernetes services, allowing you to direct percentages of traffic from a request to different services. You can use them to define a set of routing rules to apply when a host is addressed. For details, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/)
-- **Destination rules** serve as the single source of truth about which service versions are available to receive traffic from virtual services. You can use these resources to define policies that apply to traffic that is intended for a service after routing has occurred. For details, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule)
-
-To see these tabs,
-
-1. Go to the project view in Rancher and click **Resources > Istio.**
-1. You will see tabs for **Traffic Graph,** which has the Kiali network visualization integrated into the UI, and **Traffic Metrics,** which shows metrics for the success rate and request volume of traffic to your services, among other metrics. Next to these tabs, you should see the tabs for **Virtual Services** and **Destination Rules.**
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/globaldns/_index.md b/content/rancher/v2.5/en/ecm/globaldns/_index.md
deleted file mode 100644
index fe1a88a175c..00000000000
--- a/content/rancher/v2.5/en/ecm/globaldns/_index.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-title: Global DNS
-weight: 100
----
-
- > This page is under construction.
-
-Rancher's Global DNS feature provides a way to program an external DNS provider to route traffic to your Kubernetes applications. Since the DNS programming supports spanning applications across different Kubernetes clusters, Global DNS is configured at a global level. An application can become highly available as it allows you to have one application run on different Kubernetes clusters. If one of your Kubernetes clusters goes down, the application would still be accessible.
-
-> **Note:** Global DNS is only available in [Kubernetes installations]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/) with the [`local` cluster enabled]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#import-local-cluster).
-
-## Global DNS Providers
-
-Prior to adding in Global DNS entries, you will need to configure access to an external provider.
-
-The following table lists the first version of Rancher each provider debuted.
-
-| DNS Provider | Available as of  |
-| --- | --- |
-| [AWS Route53](https://aws.amazon.com/route53/)  | v2.2.0 |
-| [CloudFlare](https://www.cloudflare.com/dns/) | v2.2.0 |
-| [AliDNS](https://www.alibabacloud.com/product/dns) | v2.2.0 |
-
-## Global DNS Entries
-
-For each application that you want to route traffic to, you will need to create a Global DNS Entry. This entry will use a fully qualified domain name (a.k.a FQDN) from a global DNS provider to target applications. The applications can either resolve to a single [multi-cluster application]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or to specific projects. You must [add specific annotation labels](#adding-annotations-to-ingresses-to-program-the-external-dns) to the ingresses in order for traffic to be routed correctly to the applications. Without this annotation, the programming for the DNS entry will not work.
-
-## Permissions for Global DNS Providers/Entries
-
-By default, only [global administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) and the creator of the Global DNS provider or Global DNS entry have access to use, edit and delete them. When creating the provider or entry, the creator can add additional users in order for those users to access and manage them. By default, these members will get `Owner` role to manage them.
-
-## Setting up Global DNS for Applications
-
-### Add a Global DNS Provider
-
-1. From the **Global View**, select **Tools > Global DNS Providers**.
-1. To add a provider, choose from the available provider options and configure the Global DNS Provider with necessary credentials and an optional domain.
-1. (Optional) Add additional users so they could  use the provider when creating Global DNS entries as well as manage the Global DNS provider.
-
-{{% accordion id="route53" label="Route53" %}}
-1. Enter a **Name** for the provider.
-1. (Optional) Enter the **Root Domain** of the hosted zone on AWS Route53. If this is not provided, Rancher's Global DNS Provider will work with all hosted zones that the AWS keys can access.
-1. Enter the AWS **Access Key**.
-1. Enter the AWS **Secret Key**.
-1. Under **Member Access**, search for any users that you want to have the ability to use this provider. By adding this user, they will also be able to manage the Global DNS Provider entry.
-1. Click **Create**.
-{{% /accordion %}}
-{{% accordion id="cloudflare" label="CloudFlare" %}}
-1. Enter a **Name** for the provider.
-1. Enter the **Root Domain**, this field is optional, in case this is not provided, Rancher's Global DNS Provider will work with all domains that the keys can access.
-1. Enter the CloudFlare **API Email**.
-1. Enter the CloudFlare **API Key**.
-1. Under **Member Access**, search for any users that you want to have the ability to use this provider. By adding this user, they will also be able to manage the Global DNS Provider entry.
-1. Click **Create**.
-{{% /accordion %}}
-{{% accordion id="alidns" label="AliDNS" %}}
-1. Enter a **Name** for the provider.
-1. Enter the **Root Domain**, this field is optional, in case this is not provided, Rancher's Global DNS Provider will work with all domains that the keys can access.
-1. Enter the **Access Key**.
-1. Enter the **Secret Key**.
-1. Under **Member Access**, search for any users that you want to have the ability to use this provider. By adding this user, they will also be able to manage the Global DNS Provider entry.
-1. Click **Create**.
-
->**Notes:**
->
->- Alibaba Cloud SDK uses TZ data. It needs to be present on `/usr/share/zoneinfo` path of the nodes running [`local` cluster]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#import-local-cluster), and it is mounted to the external DNS pods. If it is not available on the nodes, please follow the [instruction](https://www.ietf.org/timezones/tzdb-2018f/tz-link.html) to prepare it.
->- Different versions of AliDNS have different allowable TTL range, where the default TTL for a global DNS entry may not be valid. Please see the [reference](https://www.alibabacloud.com/help/doc-detail/34338.htm) before adding an AliDNS entry.
-{{% /accordion %}}
-
-### Add a Global DNS Entry
-
-1. From the **Global View**, select **Tools > Global DNS Entries**.
-1. Click on **Add DNS Entry**.
-1. Enter the **FQDN** you wish to program on the external DNS.
-1. Select a Global DNS **Provider** from the list.
-1. Select if this DNS entry will be for a [multi-cluster application]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or for workloads in different [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).  You will need to ensure that [annotations are added to any ingresses](#adding-annotations-to-ingresses-to-program-the-external-dns) for the applications that you want to target.
-1. Configure the **DNS TTL** value in seconds. By default, it will be 300 seconds.
-1. Under **Member Access**, search for any users that you want to have the ability to manage this Global DNS entry.
-
-## Adding Annotations to Ingresses to program the External DNS
-
-In order for Global DNS entries to be programmed, you will need to add a specific annotation on an ingress in your application or target project and this ingress needs to use a specific `hostname` and an annotation that should match the FQDN of the Global DNS entry.
-
-1. For any application that you want targeted for your Global DNS entry, find an ingress associated with the application.
-1. In order for the DNS to be programmed, the following requirements must be met:
-   * The ingress routing rule must be set to use a `hostname` that matches the FQDN of the Global DNS entry.
-   * The ingress must have an annotation (`rancher.io/globalDNS.hostname`) and the value of this annotation should match the FQDN of the Global DNS entry.
-1. Once the ingress in your [multi-cluster application]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or in your target projects are in `active` state, the FQDN will be programmed on the external DNS against the Ingress IP addresses.
-
-## Editing a Global DNS Provider
-
-The [global administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), creator of the Global DNS provider and any users added as `members` to a Global DNS provider, have _owner_ access to that provider. Any members can edit the following fields:
-
-- Root Domain
-- Access Key & Secret Key
-- Members
-
-1. From the **Global View**, select **Tools > Global DNS Providers**.
-
-1. For the Global DNS provider that you want to edit, click the **&#8942; > Edit**.
-
-## Editing a Global DNS Entry
-
-The [global administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), creator of the Global DNS entry and any users added as `members` to a Global DNS entry, have _owner_ access to that DNS entry. Any members can edit the following fields:
-
-- FQDN
-- Global DNS Provider
-- Target Projects or Multi-Cluster App
-- DNS TTL
-- Members
-
-Any users who can access the Global DNS entry can **only** add target projects that they have access to. However, users can remove **any** target project as there is no check to confirm if that user has access to the target project.
-
-Permission checks are relaxed for removing target projects in order to support situations where the user's permissions might have changed before they were able to delete the target project. Another use case could be that the target project was removed from the cluster before being removed from a target project of the Global DNS entry.
-
-1. From the **Global View**, select **Tools > Global DNS Entries**.
-
-1. For the Global DNS entry that you want to edit, click the **&#8942; > Edit**.
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/_index.md
deleted file mode 100644
index 2512a53d2a1..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Infrastructure Management
-weight: 14
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/cloud-credentials/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-credentials/_index.md
deleted file mode 100644
index a85ca3d3e06..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/cloud-credentials/_index.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: Managing Cloud Credentials
-weight: 3
----
-
-When you create a cluster [hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools), [node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) are used to provision the cluster nodes. These templates use Docker Machine configuration options to define an operating system image and settings/parameters for the node.
-
-Node templates can use cloud credentials to access the credential information required to provision nodes in the infrastructure providers. The same cloud credential can be used by multiple node templates. By using a cloud credential, you do not have to re-enter access keys for the same cloud provider. Cloud credentials are stored as Kubernetes secrets.
-
-Cloud credentials are only used by node templates if there are fields marked as `password`. The default `active` node drivers have their account access fields marked as `password`, but there may be some `inactive` node drivers, which are not using them yet. These node drivers will not use cloud credentials.
-
-You can create cloud credentials in two contexts:
-
-- [During creation of a node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) for a cluster.
-- In the **User Settings**
-
-All cloud credentials are bound to the user profile of who created it. They **cannot** be shared across users.
-
-## Creating a Cloud Credential from User Settings
-
-1. From your user settings, select **User Avatar > Cloud Credentials**.
-1. Click **Add Cloud Credential**.
-1. Enter a name for the cloud credential.
-1. Select a **Cloud Credential Type** from the drop down. The values of this dropdown is based on the `active` [node drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) in Rancher.
-1. Based on the selected cloud credential type, enter the required values to authenticate with the infrastructure provider.
-1. Click **Create**.
-
-**Result:** The cloud credential is created and can immediately be used to [create node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates).
-
-## Updating a Cloud Credential
-
-When access credentials are changed or compromised, updating a cloud credential allows you to rotate those credentials while keeping the same node template.  
-
-1. From your user settings, select **User Avatar > Cloud Credentials**.
-1. Choose the cloud credential you want to edit and click the **&#8942; > Edit**.
-1. Update the credential information and click **Save**.
-
-**Result:** The cloud credential is updated with the new access credentials. All existing node templates using this cloud credential will automatically use the updated information whenever [new nodes are added]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
-
-## Deleting a Cloud Credential
-
-In order to delete cloud credentials, there must not be any node template associated with it. If you are unable to delete the cloud credential, [delete any node templates]({{<baseurl>}}/rancher/v2.x/en/user-settings/node-templates/#deleting-a-node-template) that are still associated to that cloud credential.
-
-1. From your user settings, select **User Avatar > Cloud Credentials**.
-1. You can either individually delete a cloud credential or bulk delete.
-
-	- To individually delete one, choose the cloud credential you want to edit and click the **&#8942; > Delete**.
-	- To bulk delete cloud credentials, select one or more cloud credentials from the list. Click **Delete**.
-1. Confirm that you want to delete these cloud credentials.
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/_index.md
deleted file mode 100644
index 4eb2f7ac57b..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/_index.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: Setting up Cloud Providers
-weight: 4
----
-
-A _cloud provider_ is a module in Kubernetes that provides an interface for managing nodes, load balancers, and networking routes. For more information, refer to the [official Kubernetes documentation on cloud providers.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/)
-
-When a cloud provider is set up in Rancher, the Rancher server can automatically provision new nodes, load balancers or persistent storage devices when launching Kubernetes definitions, if the cloud provider you're using supports such automation.
-
-Your cluster will not provision correctly if you configure a cloud provider cluster of nodes that do not meet the prerequisites.
-
-By default, the **Cloud Provider** option is set to `None`.
-
-The following cloud providers can be enabled:
-
-* Amazon
-* Azure
-* GCE (Google Compute Engine)
-
-### Setting up the Amazon Cloud Provider
-
-For details on enabling the Amazon cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/amazon)
-
-### Setting up the Azure Cloud Provider
-
-For details on enabling the Azure cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/azure)
-
-### Setting up the GCE Cloud Provider
-
-For details on enabling the Google Compute Engine cloud provider, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce)
-
-### Setting up a Custom Cloud Provider
-
-The `Custom` cloud provider is available if you want to configure any [Kubernetes cloud provider](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/).
-
-For the custom cloud provider option, you can refer to the [RKE docs]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/) on how to edit the yaml file for your specific cloud provider. There are specific cloud providers that have more detailed configuration :
-
-* [vSphere]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere/)
-* [Openstack]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/openstack/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/amazon/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/amazon/_index.md
deleted file mode 100644
index 5a6fc9f45fb..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/amazon/_index.md
+++ /dev/null
@@ -1,150 +0,0 @@
----
-title: Setting up the Amazon Cloud Provider
-weight: 1
----
-
-When using the `Amazon` cloud provider, you can leverage the following capabilities:
-
-- **Load Balancers:** Launches an AWS Elastic Load Balancer (ELB) when choosing `Layer-4 Load Balancer` in **Port Mapping** or when launching a `Service` with `type: LoadBalancer`.
-- **Persistent Volumes**: Allows you to use AWS Elastic Block Stores (EBS) for persistent volumes.
-
-See [cloud-provider-aws README](https://github.com/kubernetes/cloud-provider-aws/blob/master/README.md) for all information regarding the Amazon cloud provider.
-
-To set up the Amazon cloud provider,
-
-1. [Create an IAM role and attach to the instances](#1-create-an-iam-role-and-attach-to-the-instances)
-2. [Configure the ClusterID](#2-configure-the-clusterid)
-
-### 1. Create an IAM Role and attach to the instances
-
-All nodes added to the cluster must be able to interact with EC2 so that they can create and remove resources. You can enable this interaction by using an IAM role attached to the instance. See [Amazon documentation: Creating an IAM Role](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#create-iam-role) how to create an IAM role. There are two example policies:
-
-* The first policy is for the nodes with the `controlplane` role. These nodes have to be able to create/remove EC2 resources. The following IAM policy is an example, please remove any unneeded permissions for your use case.
-* The second policy is for the nodes with the `etcd` or `worker` role. These nodes only have to be able to retrieve information from EC2.
-
-While creating an [Amazon EC2 cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/#create-the-amazon-ec2-cluster), you must fill in the **IAM Instance Profile Name** (not ARN) of the created IAM role when creating the **Node Template**.
-
-While creating a [Custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes), you must manually attach the IAM role to the instance(s).
-
-IAM Policy for nodes with the `controlplane` role:
-
-```json
-{
-"Version": "2012-10-17",
-"Statement": [
-  {
-    "Effect": "Allow",
-    "Action": [
-      "autoscaling:DescribeAutoScalingGroups",
-      "autoscaling:DescribeLaunchConfigurations",
-      "autoscaling:DescribeTags",
-      "ec2:DescribeInstances",
-      "ec2:DescribeRegions",
-      "ec2:DescribeRouteTables",
-      "ec2:DescribeSecurityGroups",
-      "ec2:DescribeSubnets",
-      "ec2:DescribeVolumes",
-      "ec2:CreateSecurityGroup",
-      "ec2:CreateTags",
-      "ec2:CreateVolume",
-      "ec2:ModifyInstanceAttribute",
-      "ec2:ModifyVolume",
-      "ec2:AttachVolume",
-      "ec2:AuthorizeSecurityGroupIngress",
-      "ec2:CreateRoute",
-      "ec2:DeleteRoute",
-      "ec2:DeleteSecurityGroup",
-      "ec2:DeleteVolume",
-      "ec2:DetachVolume",
-      "ec2:RevokeSecurityGroupIngress",
-      "ec2:DescribeVpcs",
-      "elasticloadbalancing:AddTags",
-      "elasticloadbalancing:AttachLoadBalancerToSubnets",
-      "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
-      "elasticloadbalancing:CreateLoadBalancer",
-      "elasticloadbalancing:CreateLoadBalancerPolicy",
-      "elasticloadbalancing:CreateLoadBalancerListeners",
-      "elasticloadbalancing:ConfigureHealthCheck",
-      "elasticloadbalancing:DeleteLoadBalancer",
-      "elasticloadbalancing:DeleteLoadBalancerListeners",
-      "elasticloadbalancing:DescribeLoadBalancers",
-      "elasticloadbalancing:DescribeLoadBalancerAttributes",
-      "elasticloadbalancing:DetachLoadBalancerFromSubnets",
-      "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
-      "elasticloadbalancing:ModifyLoadBalancerAttributes",
-      "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
-      "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",
-      "elasticloadbalancing:AddTags",
-      "elasticloadbalancing:CreateListener",
-      "elasticloadbalancing:CreateTargetGroup",
-      "elasticloadbalancing:DeleteListener",
-      "elasticloadbalancing:DeleteTargetGroup",
-      "elasticloadbalancing:DescribeListeners",
-      "elasticloadbalancing:DescribeLoadBalancerPolicies",
-      "elasticloadbalancing:DescribeTargetGroups",
-      "elasticloadbalancing:DescribeTargetHealth",
-      "elasticloadbalancing:ModifyListener",
-      "elasticloadbalancing:ModifyTargetGroup",
-      "elasticloadbalancing:RegisterTargets",
-      "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
-      "iam:CreateServiceLinkedRole",
-      "kms:DescribeKey"
-    ],
-    "Resource": [
-      "*"
-    ]
-  }
-]
-}
-```
-
-IAM policy for nodes with the `etcd` or `worker` role:
-
-```json
-{
-"Version": "2012-10-17",
-"Statement": [
-    {
-        "Effect": "Allow",
-        "Action": [
-            "ec2:DescribeInstances",
-            "ec2:DescribeRegions",
-            "ecr:GetAuthorizationToken",
-            "ecr:BatchCheckLayerAvailability",
-            "ecr:GetDownloadUrlForLayer",
-            "ecr:GetRepositoryPolicy",
-            "ecr:DescribeRepositories",
-            "ecr:ListImages",
-            "ecr:BatchGetImage"
-        ],
-        "Resource": "*"
-    }
-]
-}
-```
-
-### 2. Configure the ClusterID
-
-The following resources need to tagged with a `ClusterID`:
-
-- **Nodes**: All hosts added in Rancher.
-- **Subnet**: The subnet used for your cluster.
-- **Security Group**: The security group used for your cluster.
-
->**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating an Elastic Load Balancer (ELB).
-
-When you create an [Amazon EC2 Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/#create-the-amazon-ec2-cluster), the `ClusterID` is automatically configured for the created nodes. Other resources still need to be tagged manually.
-
-Use the following tag:
-
-**Key** = `kubernetes.io/cluster/CLUSTERID` **Value** = `owned`
-
-`CLUSTERID` can be any string you like, as long as it is equal across all tags set.
-
-Setting the value of the tag to `owned` tells the cluster that all resources with this tag are owned and managed by this cluster. If you share resources between clusters, you can change the tag to:
-
-**Key** = `kubernetes.io/cluster/CLUSTERID` **Value** = `shared`.
-
-### Using Amazon Elastic Container Registry (ECR)
-
-The kubelet component has the ability to automatically obtain ECR credentials, when the IAM profile mentioned in [Create an IAM Role and attach to the instances](#1-create-an-iam-role-and-attach-to-the-instances) is attached to the instance(s). When using a Kubernetes version older than v1.15.0, the Amazon cloud provider needs be configured in the cluster. Starting with Kubernetes version v1.15.0, the kubelet can obtain ECR credentials without having the Amazon cloud provider configured in the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/azure/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/azure/_index.md
deleted file mode 100644
index 25884572579..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/azure/_index.md
+++ /dev/null
@@ -1,70 +0,0 @@
----
-title: Setting up the Azure Cloud Provider
-weight: 2
----
-
-When using the `Azure` cloud provider, you can leverage the following capabilities:
-
-- **Load Balancers:** Launches an Azure Load Balancer within a specific Network Security Group.
-
-- **Persistent Volumes:** Supports using Azure Blob disks and Azure Managed Disks with standard and premium storage accounts.
-
-- **Network Storage:** Support Azure Files via CIFS mounts.
-
-The following account types are not supported for Azure Subscriptions:
-
-- Single tenant accounts (i.e. accounts with no subscriptions).
-- Multi-subscription accounts.
-
-To set up the Azure cloud provider following credentials need to be configured:
-
-1. [Set up the Azure Tenant ID](#1-set-up-the-azure-tenant-id)
-2. [Set up the Azure Client ID and Azure Client Secret](#2-set-up-the-azure-client-id-and-azure-client-secret)
-3. [Configure App Registration Permissions](#3-configure-app-registration-permissions)
-4. [Set up Azure Network Security Group Name](#4-set-up-azure-network-security-group-name)
-
-### 1. Set up the Azure Tenant ID
-
-Visit [Azure portal](https://portal.azure.com), login and go to **Azure Active Directory** and select **Properties**. Your **Directory ID** is your **Tenant ID** (tenantID).
-
-If you want to use the Azure CLI, you can run the command `az account show` to get the information.
-
-### 2. Set up the Azure Client ID and Azure Client Secret 
-
-Visit [Azure portal](https://portal.azure.com), login and follow the steps below to create an **App Registration** and the corresponding **Azure Client ID** (aadClientId) and **Azure Client Secret** (aadClientSecret).
-
-1. Select **Azure Active Directory**.
-1. Select **App registrations**.
-1. Select **New application registration**.
-1. Choose a **Name**, select `Web app / API` as **Application Type** and a **Sign-on URL** which can be anything in this case.
-1. Select **Create**.
-
-In the **App registrations** view, you should see your created App registration. The value shown in the column **APPLICATION ID** is what you need to use as **Azure Client ID**.
-
-The next step is to generate the **Azure Client Secret**:
-
-1. Open your created App registration.
-1. In the **Settings** view, open **Keys**.
-1. Enter a **Key description**, select an expiration time and select **Save**.
-1. The generated value shown in the column **Value** is what you need to use as **Azure Client Secret**. This value will only be shown once.
-
-### 3. Configure App Registration Permissions
-
-The last thing you will need to do, is assign the appropriate permissions to your App registration.
-
-1. Go to **More services**, search for **Subscriptions** and open it.
-1. Open **Access control (IAM)**.
-1. Select **Add**.
-1. For **Role**, select `Contributor`.
-1. For **Select**, select your created App registration name.
-1. Select **Save**.
-
-### 4. Set up Azure Network Security Group Name
-
-A custom Azure Network Security Group (securityGroupName) is needed to allow Azure Load Balancers to work.
-
-If you provision hosts using Rancher Machine Azure driver, you will need to edit them manually to assign them to this Network Security Group.
-
-You should already assign custom hosts to this Network Security Group during provisioning.
-
-Only hosts expected to be load balancer back ends need to be in this group.
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/gce/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/gce/_index.md
deleted file mode 100644
index 000b537c110..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/cloud-providers/gce/_index.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: Setting up the Google Compute Engine Cloud Provider
-weight: 3
----
-
-In this section, you'll learn how to enable the Google Compute Engine (GCE) cloud provider for custom clusters in Rancher. A custom cluster is one in which Rancher installs Kubernetes on existing nodes.
-
-The official Kubernetes documentation for the GCE cloud provider is [here.](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#gce)
-
-> **Prerequisites:** The service account of `Identity and API` access on GCE needs the `Computer Admin` permission. 
-
-If you are using Calico,
-
-1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
-1. Click **Edit as YAML,** and enter the following configuration:
-
-    ```
-    rancher_kubernetes_engine_config:
-      cloud_provider:
-        name: gce
-        customCloudProvider: |- 
-          [Global]
-          project-id=<your project ID, optional>
-          network-name=<your network, optional if using default network>
-          subnetwork-name=<your subnetwork of the above network, optional if using default network>
-          node-instance-prefix=<your instance group name/your instance name specific prefix, required>
-          node-tags=<your network tags, must patch one or some tags, required>
-      network:
-        options: 
-          calico_cloud_provider: "gce"
-        plugin: "calico"
-    ```
-
-If you are using Canal or Flannel,
-
-1. Go to the cluster view in the Rancher UI, and click **&#8942; > Edit.**
-1. Click **Edit as YAML,** and enter the following configuration:
-
-    ```
-    rancher_kubernetes_engine_config:
-      cloud_provider: 
-        name: gce
-        customCloudProvider: |- 
-          [Global]
-          project-id=<your project ID, optional>
-          network-name=<your network, optional if using default network>
-          subnetwork-name=<your subnetwork of the above network, optional if using default network>
-          node-instance-prefix=<your instance group name/your instance name specific prefix, required>
-          node-tags=<your network tags, must patch one or some tags, required>
-      services: 
-        kube_controller: 
-          extra_args:
-            configure-cloud-routes: true # we need to allow the cloud provider configure the routes for the hosts
-    ```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/node-templates/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/node-templates/_index.md
deleted file mode 100644
index 2ffe51ba190..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/node-templates/_index.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-title: Managing Node Templates
-weight: 2
----
-
-When you provision a cluster [hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools), [node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) are used to provision the cluster nodes. These templates use Docker Machine configuration options to define an operating system image and settings/parameters for the node. You can create node templates in two contexts:
-
-- While [provisioning a node pool cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools).
-- At any time, from your [user settings](#creating-a-node-template-from-user-settings).
-
-When you create a node template, it is bound to your user profile. Node templates cannot be shared among users. You can delete stale node templates that you no longer user from your user settings.
-
-## Creating a Node Template from User Settings
-
-1. From your user settings, select **User Avatar > Node Templates**.
-1. Click **Add Template**.
-1. Select one of the cloud providers available. Then follow the instructions on screen to configure the template.
-
-**Result:** The template is configured. You can use the template later when you [provision a node pool cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools).
-
-## Updating a Node Template
-
-1. From your user settings, select **User Avatar > Node Templates**.
-1. Choose the node template that you want to edit and click the **&#8942; > Edit**.
-
-	   > **Note:** As of v2.2.0, the default `active` [node drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) and any node driver, that has fields marked as `password`, are required to use [cloud credentials]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#cloud-credentials). If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
-
-1. Edit the required information and click **Save**.
-
-**Result:** The node template is updated. All node pools using this node template will automatically use the updated information when new nodes are added.
-
-## Cloning Node Templates
-
-When creating new node templates from your user settings, you can clone an existing template and quickly update its settings rather than creating a new one from scratch. Cloning templates saves you the hassle of re-entering access keys for the cloud provider.
-
-1. From your user settings, select **User Avatar > Node Templates**.
-1. Find the template you want to clone. Then select **&#8942; > Clone**.
-1. Complete the rest of the form.
-
-**Result:** The template is cloned and configured. You can use the template later when you [provision a node pool cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools).
-
-## Deleting a Node Template
-
-When you no longer use a node template, you can delete it from your user settings.
-
-1. From your user settings, select **User Avatar > Node Templates**.
-1. Select one or more template from the list. Then click **Delete**. Confirm the delete when prompted.
diff --git a/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md b/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
deleted file mode 100644
index 21b7b49284d..00000000000
--- a/content/rancher/v2.5/en/ecm/infrastructure/nodes/_index.md
+++ /dev/null
@@ -1,224 +0,0 @@
----
-title: Nodes and Node Pools
-weight: 1
----
-
-After you launch a Kubernetes cluster in Rancher, you can manage individual nodes from the cluster's **Node** tab. Depending on the [option used]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) to provision the cluster, there are different node options available.
-
-> If you want to manage the _cluster_ and not individual nodes, see [Editing Clusters]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters).
-
-This section covers the following topics:
-
-- [Node options available for each cluster creation option](#node-options-available-for-each-cluster-creation-option)
-  - [Nodes hosted by an infrastructure provider](#nodes-hosted-by-an-infrastructure-provider)
-  - [Nodes provisioned by hosted Kubernetes providers](#nodes-provisioned-by-hosted-kubernetes-providers)
-  - [Imported nodes](#imported-nodes)
-- [Managing and editing individual nodes](#managing-and-editing-individual-nodes)
-- [Viewing a node in the Rancher API](#viewing-a-node-in-the-rancher-api)
-- [Deleting a node](#deleting-a-node)
-- [Scaling nodes](#scaling-nodes)
-- [SSH into a node hosted by an infrastructure provider](#ssh-into-a-node-hosted-by-an-infrastructure-provider)
-- [Cordoning a node](#cordoning-a-node)
-- [Draining a node](#draining-a-node)
-  - [Aggressive and safe draining options](#aggressive-and-safe-draining-options)
-  - [Grace period](#grace-period)
-  - [Timeout](#timeout)
-  - [Drained and cordoned state](#drained-and-cordoned-state)
-- [Labeling a node to be ignored by Rancher](#labeling-a-node-to-be-ignored-by-rancher)
-
-# Node Options Available for Each Cluster Creation Option
-
-The following table lists which node options are available for each [type of cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options) in Rancher. Click the links in the **Option** column for more detailed information about each feature.
-
-| Option                                           | [Nodes Hosted by an Infrastructure Provider][1]                                   | [Custom Node][2] | [Hosted Cluster][3] | [Imported Nodes][4] | Description                                                        |
-| ------------------------------------------------ | ------------------------------------------------ | ---------------- | ------------------- | ------------------- | ------------------------------------------------------------------ |
-| [Cordon](#cordoning-a-node)                      | ✓                                                | ✓                | ✓                   |                     | Marks the node as unschedulable.                                   |
-| [Drain](#draining-a-node)                        | ✓                                                | ✓                | ✓                   |                     | Marks the node as unschedulable _and_ evicts all pods.             |
-| [Edit](#managing-and-editing-individual-nodes)                          | ✓                                                | ✓                | ✓                   |                     | Enter a custom name, description, label, or taints for a node. |
-| [View API](#viewing-a-node-in-the-rancher-api)                  | ✓                                                | ✓                | ✓                   |                     | View API data.                                                     |
-| [Delete](#deleting-a-node)                       | ✓                                                | ✓                |                     |                     | Deletes defective nodes from the cluster.                          |
-| [Download Keys](#ssh-into-a-node-hosted-by-an-infrastructure-provider) | ✓                                                |                  |                     |                     | Download SSH key for in order to SSH into the node.                     |
-| [Node Scaling](#scaling-nodes)                   | ✓                                                |                  |                     |                     | Scale the number of nodes in the node pool up or down.               |
-
-[1]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/
-[2]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/
-[3]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/
-[4]: {{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/
-
-### Nodes Hosted by an Infrastructure Provider
-
-Node pools are available when you provision Rancher-launched Kubernetes clusters on nodes that are [hosted in an infrastructure provider.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/)
-
-Clusters provisioned using [one of the node pool options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-pools) can be scaled up or down if the node pool is edited.
-
-A node pool can also automatically maintain the node scale that's set during the initial cluster provisioning if [node auto-replace is enabled.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-auto-replace) This scale determines the number of active nodes that Rancher maintains for the cluster.
-
-Rancher uses [node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) to replace nodes in the node pool. Each node template uses cloud provider credentials to allow Rancher to set up the node in the infrastructure provider.
-
-### Nodes Provisioned by Hosted Kubernetes Providers
-
-Options for managing nodes [hosted by a Kubernetes provider]({{<baseurl >}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) are somewhat limited in Rancher. Rather than using the Rancher UI to make edits such as scaling the number of nodes up or down, edit the cluster directly.
-
-### Imported Nodes
-
-Although you can deploy workloads to an [imported cluster]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/) using Rancher, you cannot manage individual cluster nodes. All management of imported cluster nodes must take place outside of Rancher.
-
-# Managing and Editing Individual Nodes
-
-Editing a node lets you:
-
-* Change its name
-* Change its description
-* Add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
-* Add/Remove [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
-
-To manage individual nodes, browse to the cluster that you want to manage and then select **Nodes** from the main menu. You can open the options menu for a node by clicking its **&#8942;** icon (**...**).
-
-# Viewing a Node in the Rancher API
-
-Select this option to view the node's [API endpoints]({{< baseurl >}}/rancher/v2.x/en/api/).
-
-# Deleting a Node
-
-Use **Delete** to remove defective nodes from the cloud provider.
-
-When you the delete a defective node, Rancher can automatically replace it with an identically provisioned node if the node is in a node pool and [node auto-replace is enabled.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-auto-replace)
-
->**Tip:** If your cluster is hosted by an infrastructure provider, and you want to scale your cluster down instead of deleting a defective node, [scale down](#scaling-nodes) rather than delete.
-
-# Scaling Nodes
-
-For nodes hosted by an infrastructure provider, you can scale the number of nodes in each [node pool]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-pools) by using the scale controls. This option isn't available for other cluster types.
-
-# SSH into a Node Hosted by an Infrastructure Provider
-
-For [nodes hosted by an infrastructure provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/), you have the option of downloading its SSH key so that you can connect to it remotely from your desktop.
-
-1. From the cluster hosted by an infrastructure provider, select **Nodes** from the main menu.
-
-1. Find the node that you want to remote into. Select **&#8942; > Download Keys**.
-
-    **Step Result:** A ZIP file containing files used for SSH is downloaded.
-
-1. Extract the ZIP file to any location.
-
-1. Open Terminal. Change your location to the extracted ZIP file.
-
-1. Enter the following command:
-
-    ```
-    ssh -i id_rsa root@<IP_OF_HOST>
-    ```
-
-# Cordoning a Node
-
-_Cordoning_ a node marks it as unschedulable. This feature is useful for performing short tasks on the node during small maintenance windows, like reboots, upgrades, or decommissions.  When you're done, power back on and make the node schedulable again by uncordoning it.
-
-# Draining a Node
-
-_Draining_ is the process of first cordoning the node, and then evicting all its pods. This feature is useful for performing node maintenance (like kernel upgrades or hardware maintenance). It prevents new pods from deploying to the node while redistributing existing pods so that users don't experience service interruption.
-
-- For pods with a replica set, the pod is replaced by a new pod that will be scheduled to a new node. Additionally, if the pod is part of a service, then clients will automatically be redirected to the new pod.
-
-- For pods with no replica set, you need to bring up a new copy of the pod, and assuming it is not part of a service, redirect clients to it.
-
-You can drain nodes that are in either a `cordoned` or `active` state. When you drain a node, the node is cordoned, the nodes are evaluated for conditions they must meet to be drained, and then (if it meets the conditions) the node evicts its pods.
-
-However, you can override the conditions draining when you initiate the drain. You're also given an opportunity to set a grace period and timeout value.
-
-### Aggressive and Safe Draining Options
-
-The node draining options are different based on your version of Rancher.
-
-{{% tabs %}}
-{{% tab "Rancher v2.2.x+" %}}
-There are two drain modes: aggressive and safe.
-
-- **Aggressive Mode**
-
-    In this mode, pods won't get rescheduled to a new node, even if they do not have a controller. Kubernetes expects you to have your own logic that handles the deletion of these pods.
-
-    Kubernetes also expects the implementation to decide what to do with pods using emptyDir. If a pod uses emptyDir to store local data, you might not be able to safely delete it, since the data in the emptyDir will be deleted once the pod is removed from the node. Choosing aggressive mode will delete these pods.
-
-- **Safe Mode**
-
-    If a node has standalone pods or ephemeral data it will be cordoned but not drained.
-{{% /tab %}}
-{{% tab "Rancher prior to v2.2.x" %}}
-
-The following list describes each drain option:
-
-- **Even if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet**
-
-    These types of pods won't get rescheduled to a new node, since they do not have a controller. Kubernetes expects you to have your own logic that handles the deletion of these pods. Kubernetes forces you to choose this option (which will delete/evict these pods) or drain won't proceed.
-
-- **Even if there are DaemonSet-managed pods**
-
-    Similar to above, if you have any daemonsets, drain would proceed only if this option is selected. Even when this option is on, pods won't be deleted since they'll immediately be replaced. On startup, Rancher currently has a few daemonsets running by default in the system, so this option is turned on by default.
-
-- **Even if there are pods using emptyDir**
-
-    If a pod uses emptyDir to store local data, you might not be able to safely delete it, since the data in the emptyDir will be deleted once the pod is removed from the node. Similar to the first option, Kubernetes expects the implementation to decide what to do with these pods. Choosing this option will delete these pods.
-{{% /tab %}}
-{{% /tabs %}}
-
-### Grace Period
-
-The timeout given to each pod for cleaning things up, so they will have chance to exit gracefully. For example, when pods might need to finish any outstanding requests, roll back transactions or save state to some external storage. If negative, the default value specified in the pod will be used.
-
-### Timeout
-
-The amount of time drain should continue to wait before giving up.
-
->**Kubernetes Known Issue:** The [timeout setting](https://github.com/kubernetes/kubernetes/pull/64378) was not enforced while draining a node prior to Kubernetes 1.12.
-
-### Drained and Cordoned State
-
-If there's any error related to user input, the node enters a `cordoned` state because the drain failed. You can either correct the input and attempt to drain the node again, or you can abort by uncordoning the node.
-
-If the drain continues without error, the node enters a `draining` state. You'll have the option to stop the drain when the node is in this state, which will stop the drain process and change the node's state to `cordoned`.
-
-Once drain successfully completes, the node will be in a state of `drained`. You can then power off or delete the node.
-
->**Want to know more about cordon and drain?** See the [Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#maintenance-on-a-node).
-
-# Labeling a Node to be Ignored by Rancher
-
-Some solutions, such as F5's BIG-IP integration, may require creating a node that is never registered to a cluster.
-
-Since the node will never finish registering, it will always be shown as unhealthy in the Rancher UI.
-
-In that case, you may want to label the node to be ignored by Rancher so that Rancher only shows nodes as unhealthy when they are actually failing.
-
-You can label nodes to be ignored by using a setting in the Rancher UI, or by using `kubectl`.
-
-> **Note:** There is an [open issue](https://github.com/rancher/rancher/issues/24172) in which nodes labeled to be ignored can get stuck in an updating state.
-
-### Labeling Nodes to be Ignored with the Rancher UI
-
-To add a node that is ignored by Rancher,
-
-1. From the **Global** view, click the **Settings** tab.
-1. Go to the `ignore-node-name` setting and click **&#8942; > Edit.**
-1. Enter a name that Rancher will use to ignore nodes. All nodes with this name will be ignored.
-1. Click **Save.**
-
-**Result:** Rancher will not wait to register nodes with this name. In the UI, the node will displayed with a grayed-out status. The node is still part of the cluster and can be listed with `kubectl`.
-
-If the setting is changed afterward, the ignored nodes will continue to be hidden.
-
-### Labeling Nodes to be Ignored with kubectl
-
-To add a node that will be ignored by Rancher, use `kubectl` to create a node that has the following label:
-
-```
-cattle.rancher.io/node-status: ignore
-```
-
-**Result:** If you add the node to a cluster, Rancher will not attempt to sync with this node. The node can still be part of the cluster and can be listed with `kubectl`.
-
-If the label is added before the node is added to the cluster, the node will not be shown in the Rancher UI. 
-
-If the label is added after the node is added to a Rancher cluster, the node will not be removed from the UI.
-
-If you delete the node from the Rancher server using the Rancher UI or API, the node will not be removed from the cluster if the `nodeName` is listed in the Rancher settings under `ignore-node-name`.
diff --git a/content/rancher/v2.5/en/ecm/k8s-metadata/_index.md b/content/rancher/v2.5/en/ecm/k8s-metadata/_index.md
deleted file mode 100644
index 990ed730a2a..00000000000
--- a/content/rancher/v2.5/en/ecm/k8s-metadata/_index.md
+++ /dev/null
@@ -1,89 +0,0 @@
----
-title: Upgrading Kubernetes without Upgrading Rancher
-weight: 13
----
-
-The RKE metadata feature allows you to provision clusters with new versions of Kubernetes as soon as they are released, without upgrading Rancher. This feature is useful for taking advantage of patch versions of Kubernetes, for example, if you want to upgrade to Kubernetes v1.14.7 when your Rancher server originally supported v1.14.6.
-
-> **Note:** The Kubernetes API can change between minor versions. Therefore, we don't support introducing minor Kubernetes versions, such as introducing v1.15 when Rancher currently supports v1.14. You would need to upgrade Rancher to add support for minor Kubernetes versions.
-
-Rancher's Kubernetes metadata contains information specific to the Kubernetes version that Rancher uses to provision [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/). Rancher syncs the data periodically and creates custom resource definitions (CRDs) for **system images,** **service options** and **addon templates.** Consequently, when a new Kubernetes version is compatible with the Rancher server version, the Kubernetes metadata makes the new version available to Rancher for provisioning clusters. The metadata gives you an overview of the information that the [Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/) (RKE) uses for deploying various Kubernetes versions.
-
-This table below describes the CRDs that are affected by the periodic data sync. 
-
-> **Note:** Only administrators can edit metadata CRDs. It is recommended not to update existing objects unless explicitly advised.
-
-| Resource | Description | Rancher API URL |
-|----------|-------------|-----------------|
-| System Images | List of system images used to deploy Kubernetes through RKE. | `<RANCHER_SERVER_URL>/v3/rkek8ssystemimages` |
-| Service Options | Default options passed to Kubernetes components like `kube-api`, `scheduler`, `kubelet`, `kube-proxy`, and `kube-controller-manager` | `<RANCHER_SERVER_URL>/v3/rkek8sserviceoptions` |
-| Addon Templates | YAML definitions used to deploy addon components like Canal, Calico, Flannel, Weave, Kube-dns, CoreDNS, `metrics-server`, `nginx-ingress` | `<RANCHER_SERVER_URL>/v3/rkeaddons` |
-
-Administrators might configure the RKE metadata settings to do the following:
-
-- Refresh the Kubernetes metadata, if a new patch version of Kubernetes comes out and they want Rancher to provision clusters with the latest version of Kubernetes without having to upgrade Rancher
-- Change the metadata URL that Rancher uses to sync the metadata, which is useful for air gap setups if you need to sync Rancher locally instead of with GitHub
-- Prevent Rancher from auto-syncing the metadata, which is one way to prevent new and unsupported Kubernetes versions from being available in Rancher
-
-### Refresh Kubernetes Metadata
-
-The option to refresh the Kubernetes metadata is available for administrators by default, or for any user who has the **Manage Cluster Drivers** [global role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
-
-To force Rancher to refresh the Kubernetes metadata, a manual refresh action is available under **Tools > Drivers > Refresh Kubernetes Metadata** on the right side corner. 
-
-### Configuring the Metadata Synchronization
-
-> Only administrators can change these settings.
-
-The RKE metadata config controls how often Rancher syncs metadata and where it downloads data from. You can configure the metadata from the settings in the Rancher UI, or through the Rancher API at the endpoint `v3/settings/rke-metadata-config`.
-
-The way that the metadata is configured depends on the Rancher version.
-
-{{% tabs %}}
-{{% tab "Rancher v2.4+" %}}
-To edit the metadata config in Rancher,
-
-1. Go to the **Global** view and click the **Settings** tab.
-1. Go to the **rke-metadata-config** section. Click the **&#8942;** and click **Edit.**
-1. You can optionally fill in the following parameters:
-
- - `refresh-interval-minutes`: This is the amount of time that Rancher waits to sync the metadata. To disable the periodic refresh, set `refresh-interval-minutes` to 0.
- - `url`: This is the HTTP path that Rancher fetches data from. The path must be a direct path to a JSON file. For example, the default URL for Rancher v2.4 is `https://releases.rancher.com/kontainer-driver-metadata/release-v2.4/data.json`.
-
-If you don't have an air gap setup, you don't need to specify the URL where Rancher gets the metadata, because the default setting is to pull from [Rancher's metadata Git repository.](https://github.com/rancher/kontainer-driver-metadata/blob/dev-v2.5/data/data.json)
-
-However, if you have an [air gap setup,](#air-gap-setups) you will need to mirror the Kubernetes metadata repository in a location available to Rancher. Then you need to change the URL to point to the new location of the JSON file. 
-{{% /tab %}}
-{{% tab "Rancher v2.3" %}}
-To edit the metadata config in Rancher,
-
-1. Go to the **Global** view and click the **Settings** tab.
-1. Go to the **rke-metadata-config** section. Click the **&#8942;** and click **Edit.**
-1. You can optionally fill in the following parameters:
-
- - `refresh-interval-minutes`: This is the amount of time that Rancher waits to sync the metadata. To disable the periodic refresh, set `refresh-interval-minutes` to 0.
- - `url`: This is the HTTP path that Rancher fetches data from.
- - `branch`: This refers to the Git branch name if the URL is a Git URL. 
-
-If you don't have an air gap setup, you don't need to specify the URL or Git branch where Rancher gets the metadata, because the default setting is to pull from [Rancher's metadata Git repository.](https://github.com/rancher/kontainer-driver-metadata.git)
-
-However, if you have an [air gap setup,](#air-gap-setups) you will need to mirror the Kubernetes metadata repository in a location available to Rancher. Then you need to change the URL and Git branch in the `rke-metadata-config` settings to point to the new location of the repository.
-{{% /tab %}}
-{{% /tabs %}}
-
-### Air Gap Setups
-
-Rancher relies on a periodic refresh of the `rke-metadata-config` to download new Kubernetes version metadata if it is supported with the current version of the Rancher server. For a table of compatible Kubernetes and Rancher versions, refer to the [service terms section.](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.2.8/)
-
-If you have an air gap setup, you might not be able to get the automatic periodic refresh of the Kubernetes metadata from Rancher's Git repository. In that case, you should disable the periodic refresh to prevent your logs from showing errors. Optionally, you can configure your metadata settings so that Rancher can sync with a local copy of the RKE metadata.
-
-To sync Rancher with a local mirror of the RKE metadata, an administrator would configure the `rke-metadata-config` settings to point to the mirror. For details, refer to [Configuring the Metadata Synchronization.](#configuring-the-metadata-synchronization)
-
-After new Kubernetes versions are loaded into the Rancher setup, additional steps would be required in order to use them for launching clusters. Rancher needs access to updated system images. While the metadata settings can only be changed by administrators, any user can download the Rancher system images and prepare a private Docker registry for them.
-
-1. To download the system images for the private registry, click the Rancher server version at the bottom left corner of the Rancher UI.
-1. Download the OS specific image lists for Linux or Windows.
-1. Download `rancher-images.txt`.
-1. Prepare the private registry using the same steps during the [air gap install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry), but instead of using the `rancher-images.txt` from the releases page, use the one obtained from the previous steps.
-
-**Result:** The air gap installation of Rancher can now sync the Kubernetes metadata. If you update your private registry when new versions of Kubernetes are released, you can provision clusters with the new version without having to upgrade Rancher.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/pod-security-policies-in-projects/_index.md b/content/rancher/v2.5/en/ecm/pod-security-policies-in-projects/_index.md
deleted file mode 100644
index af8ff997503..00000000000
--- a/content/rancher/v2.5/en/ecm/pod-security-policies-in-projects/_index.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-title: Pod Security Policies in Projects
-weight: 5600
---- 
-
-> These cluster options are only available for [clusters in which Rancher has launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).  
-
-You can always assign a pod security policy (PSP) to an existing project if you didn't assign one during creation.
-
-### Prerequisites
-
-- Create a Pod Security Policy within Rancher. Before you can assign a default PSP to an existing project, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
-- Assign a default Pod Security Policy to the project's cluster. You can't assign a PSP to a project until one is already applied to the cluster. For more information, see [Existing Cluster: Adding a Pod Security Policy]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/#adding-changing-a-pod-security-policy).
-
-### Applying a Pod Security Policy
-
-1. From the **Global** view, find the cluster containing the project you want to apply a PSP to.
-1. From the main menu, select **Projects/Namespaces**.
-1. Find the project that you want to add a PSP to. From that project, select **&#8942; > Edit**.
-1. From the **Pod Security Policy** drop-down, select the PSP you want to apply to the project.
-  Assigning a PSP to a project will:
-
-  - Override the cluster's default PSP.
-  - Apply the PSP to the project.
-  - Apply the PSP to any namespaces you add to the project later.
-
-1. Click **Save**.
-
-**Result:** The PSP is applied to the project and any namespaces added to the project.
-
->**Note:** Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked to determine if they comply with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md b/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
deleted file mode 100644
index 9b064ecf94f..00000000000
--- a/content/rancher/v2.5/en/ecm/pod-security-policies/_index.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Adding a Pod Security Policy
-weight: 5
----
-
-_Pod Security Policies_ (or PSPs) are objects that control security-sensitive aspects of pod specification (like root privileges). If a pod does not meet the conditions specified in the PSP, Kubernetes will not allow it to start, and Rancher will display an error message of `Pod <NAME> is forbidden: unable to validate...`.
-
-> **Note:** Assigning Pod Security Policies are only available for clusters that are [launched using RKE.]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/)
-
-- You can assign PSPs at the cluster or project level.
-- PSPs work through inheritance.
-
-    - By default, PSPs assigned to a cluster are inherited by its projects, as well as any namespaces added to those projects.
-    - **Exception:** Namespaces that are not assigned to projects do not inherit PSPs, regardless of whether the PSP is assigned to a cluster or project. Because these namespaces have no PSPs, workload deployments to these namespaces will fail, which is the default Kubernetes behavior.
-    - You can override the default PSP by assigning a different PSP directly to the project.
-- Any workloads that are already running in a cluster or project before a PSP is assigned will not be checked if it complies with the PSP. Workloads would need to be cloned or upgraded to see if they pass the PSP.
-
->**Note:** You must enable PSPs at the cluster level before you can assign them to a project. This can be configured by [editing the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/)
-
-Read more about Pod Security Policies in the [Kubernetes Documentation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/).
-
->**Best Practice:** Set pod security at the cluster level.
-
-Using Rancher, you can create a Pod Security Policy using our GUI rather than creating a YAML file.
-
-## Default Pod Security Policies
-
-Rancher ships with two default Pod Security Policies (PSPs): the `restricted` and `unrestricted` policies.
-
-- `restricted`
-
-	 This policy is based on the Kubernetes [example restricted policy](https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml). It significantly restricts what types of pods can be deployed to a cluster or project. This policy:
-	
-	- Prevents pods from running as a privileged user and prevents escalation of privileges.
-	- Validates that server-required security mechanisms are in place (such as restricting what volumes can be mounted to only the core volume types and preventing root supplemental groups from being added). 
-
-- `unrestricted`
-
-	This policy is equivalent to running Kubernetes with the PSP controller disabled. It has no restrictions on what pods can be deployed into a cluster or project.
-
-## Creating Pod Security Policies
-
-1.	From the **Global** view, select **Security** > **Pod Security Policies** from the main menu. Then click **Add Policy**.
-
-	**Step Result:** The **Add Policy** form opens.
-
-2. Name the policy.
-
-3. Complete each section of the form. Refer to the Kubernetes documentation linked below for more information on what each policy does.
-
-	- Basic Policies:
-
-		- [Privilege Escalation](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation)
-		- [Host Namespaces][2]
-		- [Read Only Root Filesystems][1]
-
-	- [Capability Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#capabilities)
-	- [Volume Policy][1]
-	- [Allowed Host Paths Policy][1]
-	- [FS Group Policy][1]
-	- [Host Ports Policy][2]
-	- [Run As User Policy][3]
-	- [SELinux Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux)
-	- [Supplemental Groups Policy][3]
-
-### What's Next?
-
-You can add a Pod Security Policy (PSPs hereafter) in the following contexts:
-
-- [When creating a cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/pod-security-policies/)
-- [When editing an existing cluster]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/)
-- [When creating a project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/#creating-a-project/)
-- [When editing an existing project]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/)
-
-> **Note:** We recommend adding PSPs during cluster and project creation instead of adding it to an existing one.
-
-
-<!-- links -->
-
-[1]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems
-[2]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces
-[3]: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#users-and-groups
diff --git a/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md b/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
deleted file mode 100644
index e7125947fca..00000000000
--- a/content/rancher/v2.5/en/ecm/projects-and-namespaces/_index.md
+++ /dev/null
@@ -1,194 +0,0 @@
----
-title: Projects and Kubernetes Namespaces with Rancher
-description: Rancher Projects ease the administrative burden of your cluster and support multi-tenancy. Learn to create projects and divide projects into Kubernetes namespaces
-weight: 200
----
-
-A namespace is a Kubernetes concept that allows a virtual cluster within a cluster, which is useful for dividing the cluster into separate "virtual clusters" that each have their own access control and resource quotas.
-
-A project is a group of namespaces, and it is a concept introduced by Rancher. Projects allow you to manage multiple namespaces as a group and perform Kubernetes operations in them. You can use projects to support multi-tenancy, so that a team can access a project within a cluster without having access to other projects in the same cluster.
-
-This section describes how projects and namespaces work with Rancher. It covers the following topics:
-
-- [About namespaces](#about-namespaces)
-- [About projects](#about-projects)
-  - [The cluster's default project](#the-cluster-s-default-project)
-  - [The system project](#the-system-project)
-- [Project authorization](#project-authorization)
-- [Pod security policies](#pod-security-policies)
-- [Creating projects](#creating-projects)
-- [Switching between clusters and projects](#switching-between-clusters-and-projects)
-
-# About Namespaces
-
-A namespace is a concept introduced by Kubernetes. According to the [official Kubernetes documentation on namespaces,](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/)
-
-> Kubernetes supports multiple virtual clusters backed by the same physical cluster. These virtual clusters are called namespaces. [...] Namespaces are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all.
-
-Namespaces provide the following functionality:
-
-- **Providing a scope for names:** Names of resources need to be unique within a namespace, but not across namespaces. Namespaces can not be nested inside one another and each Kubernetes resource can only be in one namespace.
-- **Resource quotas:** Namespaces provide a way to divide cluster resources between multiple users.
-
-You can assign resources at the project level so that each namespace in the project can use them. You can also bypass this inheritance by assigning resources explicitly to a namespace.
-
-You can assign the following resources directly to namespaces:
-
-- [Workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)
-- [Load Balancers/Ingress]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/)
-- [Service Discovery Records]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/service-discovery/)
-- [Persistent Volume Claims]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/persistent-volume-claims/)
-- [Certificates]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/certificates/)
-- [ConfigMaps]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/configmaps/)
-- [Registries]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/registries/)
-- [Secrets]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/secrets/)
-
-To manage permissions in a vanilla Kubernetes cluster, cluster admins configure role-based access policies for each namespace. With Rancher, user permissions are assigned on the project level instead, and permissions are automatically inherited by any namespace owned by the particular project.
-
-For more information on creating and moving namespaces, see [Namespaces]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/).
-
-### Role-based access control issues with namespaces and kubectl
-
-Because projects are a concept introduced by Rancher, kubectl does not have the capability to restrict the creation of namespaces to a project the creator has access to.
-
-This means that when standard users with project-scoped permissions create a namespaces with `kubectl`, it may be unusable because `kubectl` doesn't require the new namespace to be scoped within a certain project.
-
-If your permissions are restricted to the project level, it is better to [create a namespace through Rancher]({{<baseurl>}}/rancher/v2.x/en/project-admin/namespaces/#creating-namespaces) to ensure that you will have permission to access the namespace.
-
-If a standard user is a project owner, the user will be able to create namespaces within that project. The Rancher UI will prevent that user from creating namespaces outside the scope of the projects they have access to. 
-
-# About Projects
-
-In terms of hierarchy:
-
-- Clusters contain projects
-- Projects contain namespaces
-
-You can use projects to support multi-tenancy, so that a team can access a project within a cluster without having access to other projects in the same cluster.
-
-In the base version of Kubernetes, features like role-based access rights or cluster resources are assigned to individual namespaces. A project allows you to save time by giving an individual or a team access to multiple namespaces simultaneously.
-
-You can use projects to perform actions such as:
-
-- Assign users to a group of namespaces (i.e., [project membership]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/project-members)).
-- Assign users specific roles in a project. A role can be owner, member, read-only, or [custom]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/default-custom-roles/).
-- Assign resources to the project.
-- Assign Pod Security Policies.
-
-When you create a cluster, two projects are automatically created within it:
-
-- [Default Project](#the-cluster-s-default-project)
-- [System Project](#the-system-project)
-
-### The Cluster's Default Project
-
-When you provision a cluster with Rancher, it automatically creates a `default` project for the cluster. This is a project you can use to get started with your cluster, but you can always delete it and replace it with projects that have more descriptive names.
-
-If you don't have a need for more than the default namespace, you also do not need more than the **Default** project in Rancher.
-
-If you require another level of organization beyond the **Default** project, you can create more projects in Rancher to isolate namespaces, applications and resources.
-
-### The System Project
-
-When troubleshooting, you can view the `system` project to check if important namespaces in the Kubernetes system are working properly. This easily accessible project saves you from troubleshooting individual system namespace containers.
-
-To open it, open the **Global** menu, and then select the `system` project for your cluster.
-
-The `system` project:
-
-- Is automatically created when you provision a cluster.
-- Lists all namespaces that exist in `v3/settings/system-namespaces`, if they exist.
-- Allows you to add more namespaces or move its namespaces to other projects.
-- Cannot be deleted because it's required for cluster operations.
-
->**Note:** In clusters where both:
->
-> - The [Canal network plug-in]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#canal) is in use.
-> - The Project Network Isolation option is enabled.
->
->The `system` project overrides the Project Network Isolation option so that it can communicate with other projects, collect logs, and check health.
-
-# Project Authorization
-
-Standard users are only authorized for project access in two situations:
-
-- An administrator, cluster owner or cluster member explicitly adds the standard user to the project's **Members** tab.
-- Standard users can access projects that they create themselves.
-
-# Pod Security Policies
-
-Rancher extends Kubernetes to allow the application of [Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) at the [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/pod-security-policies) in addition to the [cluster level.](../pod-security-policy) However, as a best practice, we recommend applying Pod Security Policies at the cluster level.
-
-# Creating Projects
-
-This section describes how to create a new project with a name and with optional pod security policy, members, and resource quotas.
-
-1. [Name a new project.](#1-name-a-new-project)
-2. [Optional: Select a pod security policy.](#2-optional-select-a-pod-security-policy)
-3. [Recommended: Add project members.](#3-recommended-add-project-members)
-4. [Optional: Add resource quotas.](#4-optional-add-resource-quotas)
-
-### 1. Name a New Project
-
-1. From the **Global** view, choose **Clusters** from the main menu. From the **Clusters** page, open the cluster from which you want to create a project.
-
-1. From the main menu, choose **Projects/Namespaces**. Then click **Add Project**.
-
-1. Enter a **Project Name**.
-
-### 2. Optional: Select a Pod Security Policy
-
-This option is only available if you've already created a Pod Security Policy. For instruction, see [Creating Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
-
-Assigning a PSP to a project will:
-
-- Override the cluster's default PSP.
-- Apply the PSP to the project.
-- Apply the PSP to any namespaces you add to the project later.
-
-### 3. Recommended: Add Project Members
-
-Use the **Members** section to provide other users with project access and roles.
-
-By default, your user is added as the project `Owner`.
-
->**Notes on Permissions:**
->
->- Users assigned the `Owner` or `Member` role for a project automatically inherit the `namespace creation` role. However, this role is a [Kubernetes ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole), meaning its scope extends to all projects in the cluster. Therefore, users explicitly assigned the `Owner` or `Member` role for a project can create namespaces in other projects they're assigned to, even with only the `Read Only` role assigned.
->- Choose `Custom` to create a custom role on the fly: [Custom Project Roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles).
-
-To add members:
-
-1. Click **Add Member**.
-1. From the **Name** combo box, search for a user or group that you want to assign project access. Note: You can only search for groups if external authentication is enabled.
-1. From the **Role** drop-down, choose a role. For more information, refer to the [documentation on project roles.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
-
-### 4. Optional: Add Resource Quotas
-
-Resource quotas limit the resources that a project (and its namespaces) can consume. For more information, see [Resource Quotas]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas).
-
-To add a resource quota,
-
-1. Click **Add Quota**.
-1. Select a [Resource Type]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/#resource-quota-types).
-1. Enter values for the **Project Limit** and the **Namespace Default Limit**.
-1. **Optional:** Specify **Container Default Resource Limit**, which will be applied to every container started in the project. The parameter is recommended if you have CPU or Memory limits set by the Resource Quota. It can be overridden on per an individual namespace or a container level. For more information, see [Container Default Resource Limit]({{<baseurl>}}/rancher/v2.x/en/project-admin/resource-quotas/#setting-container-default-resource-limit) Note: This option is available as of v2.2.0.
-1. Click **Create**.
-
-**Result:** Your project is created. You can view it from the cluster's **Projects/Namespaces** view.
-
-| Field                   | Description                                                                                              |
-| ----------------------- | -------------------------------------------------------------------------------------------------------- |
-| Project Limit           | The overall resource limit for the project.                                                              |
-| Namespace Default Limit | The default resource limit available for each namespace. This limit is propagated to each namespace in the project when created. The combined limit of all project namespaces shouldn't exceed the project limit.  |
-
-# Switching between Clusters and Projects
-
-To switch between clusters and projects, use the **Global** drop-down available in the main menu.
-
-![Global Menu]({{<baseurl>}}/img/rancher/global-menu.png)
-
-Alternatively, you can switch between projects and clusters using the main menu.
-
-- To switch between clusters, open the **Global** view and select **Clusters** from the main menu. Then open a cluster.
-- To switch between projects, open a cluster, and then select **Projects/Namespaces** from the main menu. Select the link for the project that you want to open.
diff --git a/content/rancher/v2.5/en/ecm/requirements/_index.md b/content/rancher/v2.5/en/ecm/requirements/_index.md
deleted file mode 100644
index ab08b4e87b5..00000000000
--- a/content/rancher/v2.5/en/ecm/requirements/_index.md
+++ /dev/null
@@ -1,314 +0,0 @@
----
-title: Installation Requirements
-description: Learn the node requirements for each node running Rancher server when you’re configuring  Rancher to run either in a Docker or Kubernetes setup
-weight: 2
----
-
-> This section is under construction.
-
-This page describes the software, hardware, and networking requirements for the nodes where the Rancher server will be installed. The Rancher server can be installed on a single node or a high-availability Kubernetes cluster.
-
-> It is important to note that if you install Rancher on a Kubernetes cluster, requirements are different from the [node requirements for downstream user clusters,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/) which will run your apps and services.
-
-Make sure the node(s) for the Rancher server fulfill the following requirements:
-
-- [Operating Systems and Docker Requirements](#operating-systems-and-docker-requirements)
-- [Hardware Requirements](#hardware-requirements)
-  - [CPU and Memory](#cpu-and-memory)
-  - [CPU and Memory for Rancher prior to v2.4.0](#cpu-and-memory-for-rancher-prior-to-v2-4-0)
-  - [Disks](#disks)
-- [Networking Requirements](#networking-requirements)
-  - [Node IP Addresses](#node-ip-addresses)
-  - [Port Requirements](#port-requirements)
-
-For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section.]({{<baseurl>}}/rancher/v2.x/en/best-practices/deployment-types/)
-
-The Rancher UI works best in Firefox or Chrome.
-
-# Operating Systems and Container Runtime Requirements
-
-Rancher should work with any modern Linux distribution.
-
-For the container runtime, RKE should work with any modern Docker version, while K3s should work with any modern version of Docker or containerd.
-
-Rancher and RKE have been tested and are supported on Ubuntu, CentOS, Oracle Linux, RancherOS, and RedHat Enterprise Linux.
-
-K3s should run on just about any flavor of Linux. However, K3s is tested on the following operating systems and their subsequent non-major releases:
-
-- Ubuntu 16.04 (amd64)
-- Ubuntu 18.04 (amd64)
-- Raspbian Buster (armhf)
-
-If you are installing Rancher on a K3s cluster with **Raspbian Buster**, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#enabling-legacy-iptables-on-raspbian-buster) to switch to legacy iptables.
-
-If you are installing Rancher on a K3s cluster with Alpine Linux, follow [these steps]({{<baseurl>}}/k3s/latest/en/advanced/#additional-preparation-for-alpine-linux-setup) for additional setup.
-
-For details on which OS and Docker versions were tested with each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
-
-All supported operating systems are 64-bit x86.
-
-The `ntp` (Network Time Protocol) package should be installed. This prevents errors with certificate validation that can occur when the time is not synchronized between the client and server.
-
-Some distributions of Linux may have default firewall rules that block communication with Helm. This [how-to guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/firewall) shows how to check the default firewall rules for Oracle Linux and how to open the ports with `firewalld` if necessary.
-
-If you plan to run Rancher on ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/rancher/v2.x/en/installation/options/arm64-platform/)
-
-### Installing Docker
-
-Docker can be installed by following the steps in the official [Docker documentation.](https://docs.docker.com/) Rancher also provides [scripts]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/installing-docker) to install Docker with one command.
-
-# Hardware Requirements
-
-This section describes the CPU, memory, and disk requirements for the nodes where the Rancher server is installed.
-
-### CPU and Memory
-
-Hardware requirements scale based on the size of your Rancher deployment. Provision each individual node according to the requirements. The requirements are different depending on if you are installing Rancher in a single container with Docker, or if you are installing Rancher on a Kubernetes cluster.
-
-{{% tabs %}}
-{{% tab "RKE Install Requirements" %}}
-
-These requirements apply to each host in an [RKE Kubernetes cluster where the Rancher server is installed.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/)
-
-Performance increased in Rancher v2.4.0. For the requirements of Rancher prior to v2.4.0, refer to [this section.](#cpu-and-memory-for-rancher-prior-to-v2-4-0)
-
-| Deployment Size | Clusters   | Nodes        | vCPUs  | RAM     |
-| --------------- | ---------- | ------------ | -------| ------- |
-| Small           | Up to 150  | Up to 1500   | 2      | 8 GB    |
-| Medium          | Up to 300  | Up to 3000   | 4      | 16 GB   |
-| Large           | Up to 500  | Up to 5000   | 8      | 32 GB   |
-| X-Large         | Up to 1000 | Up to 10,000 | 16     | 64 GB   |
-| XX-Large        | Up to 2000 | Up to 20,000 | 32     | 128 GB  |
-
-[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. 
-{{% /tab %}}
-
-{{% tab "K3s Install Requirements" %}}
-
-These requirements apply to each host in a [K3s Kubernetes cluster where the Rancher server is installed.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/)
-
-| Deployment Size | Clusters   | Nodes        | vCPUs  | RAM      | Database Size             |
-| --------------- | ---------- | ------------ | -------| ---------| ------------------------- |
-| Small           | Up to 150  | Up to 1500   | 2      | 8 GB     | 2 cores, 4 GB + 1000 IOPS |
-| Medium          | Up to 300  | Up to 3000   | 4      | 16 GB    | 2 cores, 4 GB + 1000 IOPS |
-| Large           | Up to 500  | Up to 5000   | 8      | 32 GB    | 2 cores, 4 GB + 1000 IOPS |
-| X-Large         | Up to 1000 | Up to 10,000 | 16     | 64 GB    | 2 cores, 4 GB + 1000 IOPS |
-| XX-Large        | Up to 2000 | Up to 20,000 | 32     | 128 GB   | 2 cores, 4 GB + 1000 IOPS |
-
-[Contact Rancher](https://rancher.com/contact/) for more than 2000 clusters and/or 20,000 nodes. 
-
-{{% /tab %}}
-
-{{% tab "Docker Install Requirements" %}}
-
-These requirements apply to a host with a [single-node]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) installation of Rancher.
-
-| Deployment Size | Clusters | Nodes     | vCPUs | RAM  |
-| --------------- | -------- | --------- | ----- | ---- |
-| Small           | Up to 5  | Up to 50  | 1     | 4 GB |
-| Medium          | Up to 15 | Up to 200 | 2     | 8 GB |
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### CPU and Memory for Rancher prior to v2.4.0
-
-{{% accordion label="Click to expand" %}}
-These requirements apply to installing Rancher on an RKE Kubernetes cluster prior to Rancher v2.4.0:
-
-| Deployment Size | Clusters  | Nodes      | vCPUs                                           | RAM                                             |
-| --------------- | --------- | ---------- | ----------------------------------------------- | ----------------------------------------------- |
-| Small           | Up to 5   | Up to 50   | 2                                               | 8 GB                                            |
-| Medium          | Up to 15  | Up to 200  | 4                                               | 16 GB                                           |
-| Large           | Up to 50  | Up to 500  | 8                                               | 32 GB                                           |
-| X-Large         | Up to 100 | Up to 1000 | 32                                              | 128 GB                                          |
-| XX-Large        | 100+      | 1000+      | [Contact Rancher](https://rancher.com/contact/) | [Contact Rancher](https://rancher.com/contact/) |
-{{% /accordion %}}
-
-### Disks
-
-Rancher performance depends on etcd in the cluster performance. To ensure optimal speed, we recommend always using SSD disks to back your Rancher management Kubernetes cluster. On cloud providers, you will also want to use the minimum size that allows the maximum IOPS. In larger clusters, consider using dedicated storage devices for etcd data and wal directories.
-
-# Networking Requirements
-
-This section describes the networking requirements for the node(s) where the Rancher server is installed.
-
-### Node IP Addresses
-
-Each node used should have a static IP configured, regardless of whether you are installing Rancher on a single node or on an HA cluster. In case of DHCP, each node should have a DHCP reservation to make sure the node gets the same IP allocated.
-
-### Port Requirements
-
-This section describes the port requirements for nodes running the `rancher/rancher` container.
-
-The port requirements are different depending on whether you are installing Rancher on a K3s cluster, on an RKE cluster, or in a single Docker container.
-
-{{% tabs %}}
-{{% tab "K3s" %}}
-### Ports for Communication with Downstream Clusters
-
-To communicate with downstream clusters, Rancher requires different ports to be open depending on the infrastructure you are using.
-
-For example, if you are deploying Rancher on nodes hosted by an infrastructure provider, port `22` must be open for SSH.
-
-The following diagram depicts the ports that are opened for each [cluster type]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning).
-
-<figcaption>Port Requirements for the Rancher Management Plane</figcaption>
-
-![Basic Port Requirements]({{<baseurl>}}/img/rancher/port-communications.svg)
-
-The following tables break down the port requirements for inbound and outbound traffic:
-
-<figcaption>Inbound Rules for Rancher Nodes</figcaption>
-
-| Protocol | Port | Source                                                                                                                                                                                | Description                                          |
-| -------- | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
-| TCP      | 80   | Load balancer/proxy that does external SSL termination                                                                                                                                | Rancher UI/API when external SSL termination is used |
-| TCP      | 443  | <ul><li>server nodes</li><li>agent nodes</li><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl               |
-
-<figcaption>Outbound Rules for Rancher Nodes</figcaption>
-
-| Protocol | Port | Destination                                              | Description                                   |
-| -------- | ---- | -------------------------------------------------------- | --------------------------------------------- |
-| TCP      | 22   | Any node IP from a node created using Node Driver        | SSH provisioning of nodes using Node Driver   |
-| TCP      | 443  | `35.160.43.145/32`, `35.167.242.46/32`, `52.33.59.17/32` | git.rancher.io (catalogs)                     |
-| TCP      | 2376 | Any node IP from a node created using Node driver        | Docker daemon TLS port used by Docker Machine |
-| TCP      | 6443 | Hosted/Imported Kubernetes API                           | Kubernetes API server                         |
-
-**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
-
-### Additional Port Requirements for Nodes in a K3s Kubernetes Cluster
-
-You will need to open additional ports to launch the Kubernetes cluster that is required for a high-availability installation of Rancher.
-
-The K3s server needs port 6443 to be accessible by the nodes.
-
-The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
-
-If you wish to utilize the metrics server, you will need to open port 10250 on each node.
-
-> **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
-
-<figcaption>Inbound Rules for Rancher Server Nodes</figcaption>
-
-| Protocol | Port | Source | Description
-|-----|-----|----------------|---|
-| TCP | 6443 | K3s server nodes | Kubernetes API
-| UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN
-| TCP | 10250 | K3s server and agent nodes | kubelet
-
-Typically all outbound traffic is allowed.
-{{% /tab %}}
-{{% tab "RKE" %}}
-### Ports for Communication with Downstream Clusters
-
-To communicate with downstream clusters, Rancher requires different ports to be open depending on the infrastructure you are using.
-
-For example, if you are deploying Rancher on nodes hosted by an infrastructure provider, port `22` must be open for SSH.
-
-The following diagram depicts the ports that are opened for each [cluster type]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning).
-
-<figcaption>Port Requirements for the Rancher Management Plane</figcaption>
-
-![Basic Port Requirements]({{<baseurl>}}/img/rancher/port-communications.svg)
-
-The following tables break down the port requirements for inbound and outbound traffic:
-
-<figcaption>Inbound Rules for Rancher Nodes</figcaption>
-
-| Protocol | Port | Source                                                                                                                                                                                | Description                                          |
-| -------- | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
-| TCP      | 80   | Load balancer/proxy that does external SSL termination                                                                                                                                | Rancher UI/API when external SSL termination is used |
-| TCP      | 443  | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl               |
-
-<figcaption>Outbound Rules for Rancher Nodes</figcaption>
-
-| Protocol | Port | Destination                                              | Description                                   |
-| -------- | ---- | -------------------------------------------------------- | --------------------------------------------- |
-| TCP      | 22   | Any node IP from a node created using Node Driver        | SSH provisioning of nodes using Node Driver   |
-| TCP      | 443  | `35.160.43.145/32`, `35.167.242.46/32`, `52.33.59.17/32` | git.rancher.io (catalogs)                     |
-| TCP      | 2376 | Any node IP from a node created using Node driver        | Docker daemon TLS port used by Docker Machine |
-| TCP      | 6443 | Hosted/Imported Kubernetes API                           | Kubernetes API server                         |
-
-**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
-
-### Additional Port Requirements for Nodes in an RKE Kubernetes Cluster
-
-You will need to open additional ports to launch the Kubernetes cluster that is required for a high-availability installation of Rancher.
-
-If you follow the Rancher installation documentation for setting up a Kubernetes cluster using RKE, you will set up a cluster in which all three nodes have all three roles: etcd, controlplane, and worker. In that case, you can refer to this list of requirements for each node with all three roles.
-
-If you installed Rancher on a Kubernetes cluster that doesn't have all three roles on each node, refer to the [port requirements for the Rancher Kubernetes Engine (RKE).]({{<baseurl>}}/rke/latest/en/os/#ports) The RKE docs show a breakdown of the port requirements for each role.
-
-<figcaption>Inbound Rules for Nodes with All Three Roles: etcd, Controlplane, and Worker</figcaption>
-
-Protocol | Port | Source | Description
------------|------|----------|--------------
-TCP | 22 | Linux worker nodes only, and any network that you want to be able to remotely access this node from. | Remote access over SSH
-TCP | 80 | Any source that consumes Ingress services | Ingress controller (HTTP)
-TCP | 443 | Any source that consumes Ingress services | Ingress controller (HTTPS)
-TCP | 2376 | Rancher nodes | Docker daemon TLS port used by Docker Machine (only needed when using Node Driver/Templates)
-TCP | 2379 | etcd nodes and controlplane nodes | etcd client requests
-TCP | 2380 | etcd nodes and controlplane nodes | etcd peer communication
-TCP | 3389 | Windows worker nodes only, and any network that you want to be able to remotely access this node from. | Remote access over RDP
-TCP | 6443 | etcd nodes, controlplane nodes, and worker nodes | Kubernetes apiserver
-UDP | 8472 | etcd nodes, controlplane nodes, and worker nodes | Canal/Flannel VXLAN overlay networking
-TCP | 9099 | the node itself (local traffic, not across nodes) | Canal/Flannel livenessProbe/readinessProbe
-TCP | 10250 | controlplane nodes | kubelet
-TCP | 10254 | the node itself (local traffic, not across nodes) | Ingress controller livenessProbe/readinessProbe
-TCP/UDP | 30000-32767 | Any source that consumes NodePort services | NodePort port range
-
-<figcaption>Outbound Rules for Nodes with All Three Roles: etcd, Controlplane, and Worker</figcaption>
-
-Protocol | Port | Source | Destination | Description
------------|------|----------|---------------|--------------
-TCP | 22 | RKE node | Any node configured in Cluster Configuration File | SSH provisioning of node by RKE
-TCP | 443 | Rancher nodes | Rancher agent |
-TCP | 2379 | etcd nodes | etcd client requests |
-TCP | 2380 | etcd nodes | etcd peer communication |
-TCP | 6443 | RKE node | controlplane nodes | Kubernetes API server
-TCP | 6443 | controlplane nodes | Kubernetes API server |
-UDP | 8472 | etcd nodes, controlplane nodes, and worker nodes | Canal/Flannel VXLAN overlay networking |
-TCP | 9099 | the node itself (local traffic, not across nodes) | Canal/Flannel livenessProbe/readinessProbe |
-TCP | 10250 | etcd nodes, controlplane nodes, and worker nodes | kubelet |
-TCP | 10254 | the node itself (local traffic, not across nodes) | Ingress controller livenessProbe/readinessProbe
-
-{{% /tab %}}
-{{% tab "Docker" %}}
-### Ports for Communication with Downstream Clusters
-
-For a Docker installation, you only need to open the ports required to enable Rancher to communicate with downstream user clusters.
-
-The port requirements depend on the infrastructure you are using. For example, if you are deploying Rancher on nodes hosted by an infrastructure provider, port `22` must be open for SSH.
-
-The following diagram depicts the ports that are opened for each [cluster type]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning).
-
-<figcaption>Port Requirements for the Rancher Management Plane</figcaption>
-
-![Basic Port Requirements]({{<baseurl>}}/img/rancher/port-communications.svg)
-
-The following tables break down the port requirements for Rancher nodes, for inbound and outbound traffic:
-
-**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
-
-
-<figcaption>Inbound Rules</figcaption>
-
-| Protocol | Port | Source                                                                                                                                                                                | Description                                          |
-| -------- | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- |
-| TCP      | 80   | Load balancer/proxy that does external SSL termination                                                                                                                                | Rancher UI/API when external SSL termination is used |
-| TCP      | 443  | <ul><li>etcd nodes</li><li>controlplane nodes</li><li>worker nodes</li><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl               |
-
-
-<figcaption>Outbound Rules</figcaption>
-
-| Protocol | Port | Source                                                   | Description                                   |
-| -------- | ---- | -------------------------------------------------------- | --------------------------------------------- |
-| TCP      | 22   | Any node IP from a node created using Node Driver        | SSH provisioning of nodes using Node Driver   |
-| TCP      | 443  | `35.160.43.145/32`, `35.167.242.46/32`, `52.33.59.17/32` | git.rancher.io (catalogs)                     |
-| TCP      | 2376 | Any node IP from a node created using Node driver        | Docker daemon TLS port used by Docker Machine |
-| TCP      | 6443 | Hosted/Imported Kubernetes API                           | Kubernetes API server                         |
-
-**Note** Rancher nodes may also require additional outbound access for any external [authentication provider]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) which is configured (LDAP for example).
-{{% /tab %}}
-{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/ecm/requirements/ports/_index.md b/content/rancher/v2.5/en/ecm/requirements/ports/_index.md
deleted file mode 100644
index c6cb826bb90..00000000000
--- a/content/rancher/v2.5/en/ecm/requirements/ports/_index.md
+++ /dev/null
@@ -1,186 +0,0 @@
----
-title: Port Requirements
-description: Read about port requirements needed in order for Rancher to operate properly, both for Rancher nodes and downstream Kubernetes cluster nodes
-weight: 300
----
-
-To operate properly, Rancher requires a number of ports to be open on Rancher nodes and on downstream Kubernetes cluster nodes.
-
-## Rancher Nodes
-
-The following table lists the ports that need to be open to and from nodes that are running the Rancher server.
-
-The port requirements differ based on whether Rancher is installed in a K3s Kubernetes cluster, an RKE Kubernetes cluster, or a single Docker container.
-
-{{% tabs %}}
-{{% tab "K3s" %}}
-
-The K3s server needs port 6443 to be accessible by the nodes.
-
-The nodes need to be able to reach other nodes over UDP port 8472 when Flannel VXLAN is used. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then port 8472 is not needed by K3s.
-
-If you wish to utilize the metrics server, you will need to open port 10250 on each node.
-
-> **Important:** The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472.
-
-<figcaption>Inbound Rules for Rancher Server Nodes</figcaption>
-
-| Protocol | Port | Source | Description
-|-----|-----|----------------|---|
-| TCP | 6443 | K3s server nodes | Kubernetes API
-| UDP | 8472 | K3s server and agent nodes | Required only for Flannel VXLAN.
-| TCP | 10250 | K3s server and agent nodes | kubelet
-
-Typically all outbound traffic is allowed.
-
-{{% /tab %}}
-{{% tab "RKE" %}}
-<figcaption>Inbound Rules for Rancher Nodes</figcaption>
-
-| Protocol | Port | Source | Description |
-|-----|-----|----------------|---|
-| TCP | 80 | Load Balancer/Reverse Proxy | HTTP traffic to Rancher UI/API |
-| TCP | 443 | <ul><li>Load Balancer/Reverse Proxy</li><li>IPs of all cluster nodes and other API/UI clients</li></ul> | HTTPS traffic to Rancher UI/API |
-
-<figcaption>Outbound Rules for Rancher Nodes</figcaption>
-
-| Protocol | Port | Destination | Description |
-|-----|-----|----------------|---|
-| TCP | 443 | `35.160.43.145`,`35.167.242.46`,`52.33.59.17` | Rancher catalog (git.rancher.io) |
-| TCP | 22 | Any node created using a node driver | SSH provisioning of node by node driver |
-| TCP | 2376 | Any node created using a node driver | Docker daemon TLS port used by node driver |
-| TCP | Provider dependent | Port of the Kubernetes API endpoint in hosted cluster | Kubernetes API |
-
-{{% /tab %}}
-{{% tab "Docker" %}}
-
-<figcaption>Inbound Rules for Rancher Node</figcaption>
-
-| Protocol | Port | Source | Description
-|-----|-----|----------------|---|
-| TCP | 80 | Load balancer/proxy that does external SSL termination | Rancher UI/API when external SSL termination is used
-| TCP | 443 | <ul><li>hosted/imported Kubernetes</li><li>any source that needs to be able to use the Rancher UI or API</li></ul> | Rancher agent, Rancher UI/API, kubectl
-
-<figcaption>Outbound Rules for Rancher Node</figcaption>
-
-| Protocol | Port | Source | Description |
-|-----|-----|----------------|---|
-| TCP | 22 | Any node IP from a node created using Node Driver | SSH provisioning of nodes using Node Driver |
-| TCP | 443 | `35.160.43.145/32`,`35.167.242.46/32`,`52.33.59.17/32` | git.rancher.io (catalogs) |
-| TCP | 2376 | Any node IP from a node created using a node driver | Docker daemon TLS port used by Docker Machine |
-| TCP | 6443 | Hosted/Imported Kubernetes API | Kubernetes API server |
-
-{{% /tab %}}
-{{% /tabs %}}
-
-> **Notes:**
->
-> - Rancher nodes may also require additional outbound access for any external authentication provider which is configured (LDAP for example).
-> - Kubernetes recommends TCP 30000-32767 for node port services.
-> - For firewalls, traffic may need to be enabled within the cluster and pod CIDR.
-
-## Downstream Kubernetes Cluster Nodes
-
-Downstream Kubernetes clusters run your apps and services. This section describes what ports need to be opened on the nodes in downstream clusters so that Rancher can communicate with them.
-
-The port requirements differ depending on how the downstream cluster was launched. Each of the tabs below list the ports that need to be opened for different [cluster types]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options).
-
->**Tip:**
->
->If security isn't a large concern and you're okay with opening a few additional ports, you can use the table in [Commonly Used Ports](#commonly-used-ports) as your port reference instead of the comprehensive tables below.
-
-{{% tabs %}}
-
-{{% tab "Node Pools" %}}
-
-The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
-
->**Note:**
->The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean.
-
-{{< ports-iaas-nodes >}}
-
-{{% /tab %}}
-
-{{% tab "Custom Nodes" %}}
-
-The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/).
-
-{{< ports-custom-nodes >}}
-
-{{% /tab %}}
-
-{{% tab "Hosted Clusters" %}}
-
-The following table depicts the port requirements for [hosted clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters).
-
-{{< ports-imported-hosted >}}
-
-{{% /tab %}}
-
-{{% tab "Imported Clusters" %}}
-
-The following table depicts the port requirements for [imported clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/).
-
-{{< ports-imported-hosted >}}
-
-{{% /tab %}}
-
-{{% /tabs %}}
-
-
-## Other Port Considerations
-
-### Commonly Used Ports
-
-These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
-
-| Protocol 	|       Port       	| Description                                     	|
-|:--------:	|:----------------:	|-------------------------------------------------	|
-|    TCP   	|        22        	| Node driver SSH provisioning                    	|
-|    TCP   	|       2376       	| Node driver Docker daemon TLS port              	|
-|    TCP   	|       2379       	| etcd client requests                           	|
-|    TCP   	|       2380       	| etcd peer communication                         	|
-|    UDP   	|       8472       	| Canal/Flannel VXLAN overlay networking          	|
-|    UDP   	|       4789       	| Flannel VXLAN overlay networking on Windows cluster |
-|    TCP   	|       9099       	| Canal/Flannel livenessProbe/readinessProbe      	|
-|    TCP    |       9796        | Default port required by Monitoring to scrape metrics |
-|    TCP   	|       6783       	| Weave Port      	|
-|    UDP   	|       6783-6784   | Weave UDP Ports      	|
-|    TCP   	|       10250      	| kubelet API                                     	|
-|    TCP   	|       10254      	| Ingress controller livenessProbe/readinessProbe 	|
-| TCP/UDP  	| 30000-</br>32767 	| NodePort port range                             	|
-
-----
-
-### Local Node Traffic
-
-Ports marked as `local traffic` (i.e., `9099 TCP`) in the above requirements are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`).
-These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
-
-However, this traffic may be blocked when:
-
-- You have applied strict host firewall policies on the node.
-- You are using nodes that have multiple interfaces (multihomed).
-
-In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes / instances.
-
-### Rancher AWS EC2 security group
-
-When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
-
-|       Type      | Protocol |  Port Range | Source/Destination     | Rule Type |
-|-----------------|:--------:|:-----------:|------------------------|:---------:|
-|       SSH       |    TCP   | 22          | 0.0.0.0/0              | Inbound   |
-|       HTTP      |    TCP   | 80          | 0.0.0.0/0              | Inbound   |
-| Custom TCP Rule |    TCP   | 443         | 0.0.0.0/0              | Inbound   |
-| Custom TCP Rule |    TCP   | 2376        | 0.0.0.0/0              | Inbound   |
-| Custom TCP Rule |    TCP   | 2379-2380   | sg-xxx (rancher-nodes) | Inbound   |
-| Custom UDP Rule |    UDP   | 4789        | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 6443        | 0.0.0.0/0              | Inbound   |
-| Custom UDP Rule |    UDP   | 8472        | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 10250-10252 | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 10256       | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
-| Custom UDP Rule |    UDP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
-| All traffic     |    All   | All         | 0.0.0.0/0              | Outbound  |
diff --git a/content/rancher/v2.5/en/ecm/restoring-from-backup/_index.md b/content/rancher/v2.5/en/ecm/restoring-from-backup/_index.md
deleted file mode 100644
index 7dd374e363b..00000000000
--- a/content/rancher/v2.5/en/ecm/restoring-from-backup/_index.md
+++ /dev/null
@@ -1,111 +0,0 @@
----
-title: Restoring an RKE Kubernetes Cluster from Backup 
-weight: 8
----
-
-etcd backup and recovery for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) can be easily performed. Snapshots of the etcd database are taken and saved either locally onto the etcd nodes or to a S3 compatible target. The advantages of configuring S3 is that if all etcd nodes are lost, your snapshot is saved remotely and can be used to restore the cluster.
-
-Rancher recommends enabling the [ability to set up recurring snapshots of etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#configuring-recurring-snapshots), but [one-time snapshots]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#one-time-snapshots) can easily be taken as well. Rancher allows restore from [saved snapshots](#restoring-a-cluster-from-a-snapshot) or if you don't have any snapshots, you can still [restore etcd](#recovering-etcd-without-a-snapshot).
-
-As of Rancher v2.4.0, clusters can also be restored to a prior Kubernetes version and cluster configuration.
-
-This section covers the following topics:
-
-- [Viewing Available Snapshots](#viewing-available-snapshots)
-- [Restoring a Cluster from a Snapshot](#restoring-a-cluster-from-a-snapshot)
-- [Recovering etcd without a Snapshot](#recovering-etcd-without-a-snapshot)
-- [Enabling snapshot features for clusters created before Rancher v2.2.0](#enabling-snapshot-features-for-clusters-created-before-rancher-v2-2-0)
-
-## Viewing Available Snapshots
-
-The list of all available snapshots for the cluster is available.
-
-1. In the **Global** view, navigate to the cluster that you want to view snapshots.
-
-2. Click **Tools > Snapshots** from the navigation bar to view the list of saved snapshots. These snapshots include a timestamp of when they were created.
-
-## Restoring a Cluster from a Snapshot
-
-If your Kubernetes cluster is broken, you can restore the cluster from a snapshot.
-
-Restorations changed in Rancher v2.4.0.
-
-{{% tabs %}}
-{{% tab "Rancher v2.4.0+" %}}
-
-Snapshots are composed of the cluster data in etcd, the Kubernetes version, and the cluster configuration in the `cluster.yml.` These components allow you to select from the following options when restoring a cluster from a snapshot:
-
-- **Restore just the etcd contents:** This restoration is similar to restoring to snapshots in Rancher prior to v2.4.0.
-- **Restore etcd and Kubernetes version:** This option should be used if a Kubernetes upgrade is the reason that your cluster is failing, and you haven't made any cluster configuration changes.
-- **Restore etcd, Kubernetes versions and cluster configuration:** This option should be used if you changed both the Kubernetes version and cluster configuration when upgrading.
-
-When rolling back to a prior Kubernetes version, the [upgrade strategy options]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes/#configuring-the-upgrade-strategy) are ignored. Worker nodes are not cordoned or drained before being reverted to the older Kubernetes version, so that an unhealthy cluster can be more quickly restored to a healthy state.
-
-> **Prerequisite:** To restore snapshots from S3, the cluster needs to be configured to [take recurring snapshots on S3.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#configuring-recurring-snapshots)
-
-1. In the **Global** view, navigate to the cluster that you want to restore from a snapshots.
-
-2. Click the **&#8942; > Restore Snapshot**.
-
-3. Select the snapshot that you want to use for restoring your cluster from the dropdown of available snapshots.
-
-4. In the **Restoration Type** field, choose one of the restoration options described above.
-
-5. Click **Save**.
-
-**Result:** The cluster will go into `updating` state and the process of restoring the `etcd` nodes from the snapshot will start. The cluster is restored when it returns to an `active` state.
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.4.0" %}}
-
-> **Prerequisites:** 
->
-> - Make sure your etcd nodes are healthy. If you are restoring a cluster with unavailable etcd nodes, it's recommended that all etcd nodes are removed from Rancher before attempting to restore. For clusters in which Rancher used node pools to provision [nodes in an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/), new etcd nodes will automatically be created. For [custom clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/), please ensure that you add new etcd nodes to the cluster.
-> - To restore snapshots from S3, the cluster needs to be configured to [take recurring snapshots on S3.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#configuring-recurring-snapshots)
-
-1. In the **Global** view, navigate to the cluster that you want to restore from a snapshot.
-
-2. Click the **&#8942; > Restore Snapshot**.
-
-3. Select the snapshot that you want to use for restoring your cluster from the dropdown of available snapshots.
-
-4. Click **Save**. 
-
-**Result:** The cluster will go into `updating` state and the process of restoring the `etcd` nodes from the snapshot will start. The cluster is restored when it returns to an `active` state.
-
-{{% /tab %}}
-{{% /tabs %}}
-
-## Recovering etcd without a Snapshot
-
-If the group of etcd nodes loses quorum, the Kubernetes cluster will report a failure because no operations, e.g. deploying workloads, can be executed in the Kubernetes cluster. Please review the best practices for the what the [number of etcd nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/#count-of-etcd-nodes) should be in a Kubernetes cluster. If you want to recover your set of etcd nodes, follow these instructions:
-
-1. Keep only one etcd node in the cluster by removing all other etcd nodes.
-
-2. On the single remaining etcd node, run the following command:
-
-    ```
-    $ docker run --rm -v /var/run/docker.sock:/var/run/docker.sock assaflavie/runlike etcd
-    ```
-
-    This command outputs the running command for etcd, save this command to use later.
-
-3. Stop the etcd container that you launched in the previous step and rename it to `etcd-old`.
-
-    ```
-    $ docker stop etcd
-    $ docker rename etcd etcd-old
-    ```
-
-4. Take the saved command from Step 2 and revise it:
-
-    - If you originally had more than 1 etcd node, then you need to change `--initial-cluster` to only contain the node that remains.
-    - Add `--force-new-cluster` to the end of the command.
-
-5. Run the revised command.
-
-6. After the single nodes is up and running, Rancher recommends adding additional etcd nodes to your cluster. If you have a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) and you want to reuse an old node, you are required to [clean up the nodes]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) before attempting to add them back into a cluster.  
-
-# Enabling Snapshot Features for Clusters Created Before Rancher v2.2.0
-
-If you have any Rancher launched Kubernetes clusters that were created prior to v2.2.0, after upgrading Rancher, you must [edit the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) and _save_ it, in order to enable the updated snapshot features. Even if you were already creating snapshots prior to v2.2.0, you must do this step as the older snapshots will not be available to use to [back up and restore etcd through the UI]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/).
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/_index.md
deleted file mode 100644
index 5779b8eb458..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/_index.md
+++ /dev/null
@@ -1,125 +0,0 @@
----
-title: Managing RKE Cluster Templates
-weight: 9
----
-
-RKE templates are designed to allow DevOps and security teams to standardize and simplify the creation of Kubernetes clusters.
-
-RKE is the [Rancher Kubernetes Engine,]({{<baseurl>}}/rke/latest/en/) which is the tool that Rancher uses to provision Kubernetes clusters.
-
-With Kubernetes increasing in popularity, there is a trend toward managing a larger number of smaller clusters. When you want to create many clusters, it’s more important to manage them consistently. Multi-cluster management comes with challenges to enforcing security and add-on configurations that need to be standardized before turning clusters over to end users.
-
-RKE templates help standardize these configurations. Regardless of whether clusters are created with the Rancher UI, the Rancher API, or an automated process, Rancher will guarantee that every cluster it provisions from an RKE template is uniform and consistent in the way it is produced.
-
-Admins control which cluster options can be changed by end users. RKE templates can also be shared with specific users and groups, so that admins can create different RKE templates for different sets of users.
-
-If a cluster was created with an RKE template, you can't change it to a different RKE template. You can only update the cluster to a new revision of the same template.
-
-As of Rancher v2.3.3, you can [save the configuration of an existing cluster as an RKE template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#converting-an-existing-cluster-to-use-an-rke-template) Then the cluster's settings can only be changed if the template is updated. The new template can also be used to launch new clusters.
-
-The core features of RKE templates allow DevOps and security teams to:
-
-- Standardize cluster configuration and ensure that Rancher-provisioned clusters are created following best practices
-- Prevent less technical users from making uninformed choices when provisioning clusters
-- Share different templates with different sets of users and groups
-- Delegate ownership of templates to users who are trusted to make changes to them
-- Control which users can create templates
-- Require users to create clusters from a template
-
-# Configurable Settings
-
-RKE templates can be created in the Rancher UI or defined in YAML format. They can define all the same parameters that can be specified when you use Rancher to provision custom nodes or nodes from an infrastructure provider:
-
-- Cloud provider options
-- Pod security options
-- Network providers
-- Ingress controllers
-- Network security configuration
-- Network plugins
-- Private registry URL and credentials
-- Add-ons
-- Kubernetes options, including configurations for Kubernetes components such as kube-api, kube-controller, kubelet, and services
-
-The [add-on section](#add-ons) of an RKE template is especially powerful because it allows a wide range of customization options.
-
-# Scope of RKE Templates
-
-RKE templates are supported for Rancher-provisioned clusters. The templates can be used to provision custom clusters or clusters that are launched by an infrastructure provider.
-
-RKE templates are for defining Kubernetes and Rancher settings. Node templates are responsible for configuring nodes. For tips on how to use RKE templates in conjunction with hardware, refer to [RKE Templates and Hardware]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/rke-templates-and-hardware).
-
-RKE templates can be created from scratch to pre-define cluster configuration. They can be applied to launch new clusters, or templates can also be exported from existing running clusters.
-
-As of v2.3.3, the settings of an existing cluster can be [saved as an RKE template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#converting-an-existing-cluster-to-use-an-rke-template) This creates a new template and binds the cluster settings to the template, so that the cluster can only be upgraded if the [template is updated]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template), and the cluster is upgraded to [use a newer version of the template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#upgrading-a-cluster-to-use-a-new-template-revision) The new template can also be used to create new clusters.
-
-
-# Example Scenarios
-When an organization has both basic and advanced Rancher users, administrators might want to give the advanced users more options for cluster creation, while restricting the options for basic users.
-
-These [example scenarios]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios) describe how an organization could use templates to standardize cluster creation.
-
-Some of the example scenarios include the following:
-
-- **Enforcing templates:** Administrators might want to [enforce one or more template settings for everyone]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#enforcing-a-template-setting-for-everyone) if they want all new Rancher-provisioned clusters to have those settings.
-- **Sharing different templates with different users:** Administrators might give [different templates to basic and advanced users,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#templates-for-basic-and-advanced-users) so that basic users can have more restricted options and advanced users can use more discretion when creating clusters.
-- **Updating template settings:** If an organization's security and DevOps teams decide to embed best practices into the required settings for new clusters, those best practices could change over time. If the best practices change, [a template can be updated to a new revision]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#updating-templates-and-clusters-created-with-them) and clusters created from the template can [upgrade to the new version]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#upgrading-a-cluster-to-use-a-new-template-revision) of the template.
-- **Sharing ownership of a template:** When a template owner no longer wants to maintain a template, or wants to share ownership of the template, this scenario describes how [template ownership can be shared.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-scenarios/#allowing-other-users-to-control-and-share-a-template)
-
-# Template Management
-
-When you create an RKE template, it is available in the Rancher UI from the **Global** view under **Tools > RKE Templates.** When you create a template, you become the template owner, which gives you permission to revise and share the template. You can share the RKE templates with specific users or groups, and you can also make it public.
-
-Administrators can turn on template enforcement to require users to always use RKE templates when creating a cluster. This allows administrators to guarantee that Rancher always provisions clusters with specific settings.
-
-RKE template updates are handled through a revision system. If you want to change or update a template, you create a new revision of the template. Then a cluster that was created with the older version of the template can be upgraded to the new template revision.
-
-In an RKE template, settings can be restricted to what the template owner chooses, or they can be open for the end user to select the value. The difference is indicated by the **Allow User Override** toggle over each setting in the Rancher UI when the template is created.
-
-For the settings that cannot be overridden, the end user will not be able to directly edit them. In order for a user to get different options of these settings, an RKE template owner would need to create a new revision of the RKE template, which would allow the user to upgrade and change that option.
-
-The documents in this section explain the details of RKE template management:
-
-- [Getting permission to create templates]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creator-permissions/)
-- [Creating and revising templates]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/)
-- [Enforcing template settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/enforcement/#requiring-new-clusters-to-use-a-cluster-template)
-- [Overriding template settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/overrides/)
-- [Sharing templates with cluster creators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-templates-with-specific-users)
-- [Sharing ownership of a template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-ownership-of-templates)
-
-An [example YAML configuration file for a template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-yaml) is provided for reference.
-
-# Applying Templates
-
-You can [create a cluster from a template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#creating-a-cluster-from-a-cluster-template) that you created, or from a template that has been [shared with you.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing)
-
-If the RKE template owner creates a new revision of the template, you can [upgrade your cluster to that revision.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#updating-a-cluster-created-with-an-rke-template)
-
-RKE templates can be created from scratch to pre-define cluster configuration. They can be applied to launch new clusters, or templates can also be exported from existing running clusters.
-
-As of Rancher v2.3.3, you can [save the configuration of an existing cluster as an RKE template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#converting-an-existing-cluster-to-use-an-rke-template) Then the cluster's settings can only be changed if the template is updated.
-
-# Standardizing Hardware
-
-RKE templates are designed to standardize Kubernetes and Rancher settings. If you want to standardize your infrastructure as well, you use RKE templates [in conjunction with other tools]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/rke-templates-and-hardware).
-
-# YAML Customization
-
-If you define an RKE template as a YAML file, you can modify this [example RKE template YAML]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/example-yaml). The YAML in the RKE template uses the same customization that Rancher uses when creating an RKE cluster, but since the YAML is located within the context of a Rancher provisioned cluster, you will need to nest the RKE template customization under the `rancher_kubernetes_engine_config` directive in the YAML.
-
-The RKE documentation also has [annotated]({{<baseurl>}}/rke/latest/en/example-yamls/) `cluster.yml` files that you can use for reference.
-
-For guidance on available options, refer to the RKE documentation on [cluster configuration.]({{<baseurl>}}/rke/latest/en/config-options/)
-
-### Add-ons
-
-The add-on section of the RKE template configuration file works the same way as the [add-on section of a cluster configuration file]({{<baseurl>}}/rke/latest/en/config-options/add-ons/).
-
-The user-defined add-ons directive allows you to either call out and pull down Kubernetes manifests or put them inline directly. If you include these manifests as part of your RKE template, Rancher will provision those in the cluster.
-
-Some things you could do with add-ons include:
-
-- Install applications on the Kubernetes cluster after it starts
-- Install plugins on nodes that are deployed with a Kubernetes daemonset
-- Automatically set up namespaces, service accounts, or role binding
-
-The RKE template configuration must be nested within the `rancher_kubernetes_engine_config` directive. To set add-ons, when creating the template, you will click **Edit as YAML.** Then use the `addons` directive to add a manifest, or the `addons_include` directive to set which YAML files are used for the add-ons. For more information on custom add-ons, refer to the [user-defined add-ons documentation.]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/)
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
deleted file mode 100644
index 3dc23ad4a35..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/applying-templates/_index.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-title: Applying Templates
-weight: 50
----
-
-You can create a cluster from an RKE template that you created, or from a template that has been [shared with you.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing)
-
-RKE templates can be applied to new clusters.
-
-As of Rancher v2.3.3, you can [save the configuration of an existing cluster as an RKE template.](#converting-an-existing-cluster-to-use-an-rke-template) Then the cluster's settings can only be changed if the template is updated.
-
-You can't change a cluster to use a different RKE template. You can only update the cluster to a new revision of the same template.
-
-This section covers the following topics:
-
-- [Creating a cluster from an RKE template](#creating-a-cluster-from-an-rke-template)
-- [Updating a cluster created with an RKE template](#updating-a-cluster-created-with-an-rke-template)
-- [Converting an existing cluster to use an RKE template](#converting-an-existing-cluster-to-use-an-rke-template)
-
-### Creating a Cluster from an RKE Template
-
-To add a cluster [hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters) using an RKE template, use these steps:
-
-1. From the **Global** view, go to the **Clusters** tab.
-1. Click **Add Cluster** and choose the infrastructure provider.
-1. Provide the cluster name and node template details as usual.
-1. To use an RKE template, under the **Cluster Options**, check the box for **Use an existing RKE template and revision.**
-1. Choose an existing template and revision from the dropdown menu.
-1. Optional: You can edit any settings that the RKE template owner marked as **Allow User Override** when the template was created. If there are settings that you want to change, but don't have the option to, you will need to contact the template owner to get a new revision of the template. Then you will need to edit the cluster to upgrade it to the new revision.
-1. Click **Save** to launch the cluster.
-
-### Updating a Cluster Created with an RKE Template
-
-When the template owner creates a template, each setting has a switch in the Rancher UI that indicates if users can override the setting.
-
-- If the setting allows a user override, you can update these settings in the cluster by [editing the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/)
-- If the switch is turned off, you cannot change these settings unless the cluster owner creates a template revision that lets you override them. If there are settings that you want to change, but don't have the option to, you will need to contact the template owner to get a new revision of the template.
-
-If a cluster was created from an RKE template, you can edit the cluster to update the cluster to a new revision of the template.
-
-As of Rancher v2.3.3, an existing cluster's settings can be [saved as an RKE template.](#converting-an-existing-cluster-to-use-an-rke-template) In that situation, you can also edit the cluster to update the cluster to a new revision of the template.
-
-> **Note:** You can't change the cluster to use a different RKE template. You can only update the cluster to a new revision of the same template.
-
-### Converting an Existing Cluster to Use an RKE Template
-
-This section describes how to create an RKE template from an existing cluster.
-
-RKE templates cannot be applied to existing clusters, except if you save an existing cluster's settings as an RKE template. This exports the cluster's settings as a new RKE template, and also binds the cluster to that template. The result is that the cluster can only be changed if the [template is updated,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template) and the cluster is upgraded to [use a newer version of the template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#upgrading-a-cluster-to-use-a-new-template-revision)
-
-To convert an existing cluster to use an RKE template,
-
-1. From the **Global** view in Rancher, click the **Clusters** tab.
-1. Go to the cluster that will be converted to use an RKE template. Click **&#8942;** > **Save as RKE Template.**
-1. Enter a name for the template in the form that appears, and click **Create.**
-
-**Results:**
-
-- A new RKE template is created.
-- The cluster is converted to use the new template.
-- New clusters can be [created from the new template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#creating-a-cluster-from-an-rke-template)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/creating-and-revising/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/creating-and-revising/_index.md
deleted file mode 100644
index 10935277fa9..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/creating-and-revising/_index.md
+++ /dev/null
@@ -1,162 +0,0 @@
----
-title: Creating and Revising Templates
-weight: 32
----
-
-This section describes how to manage RKE templates and revisions. You an create, share, update, and delete templates from the **Global** view under **Tools > RKE Templates.**
-
-Template updates are handled through a revision system. When template owners want to change or update a template, they create a new revision of the template. Individual revisions cannot be edited. However, if you want to prevent a revision from being used to create a new cluster, you can disable it.
-
-Template revisions can be used in two ways: to create a new cluster, or to upgrade a cluster that was created with an earlier version of the template. The template creator can choose a default revision, but when end users create a cluster, they can choose any template and any template revision that is available to them. After the cluster is created from a specific revision, it cannot change to another template, but the cluster can be upgraded to a newer available revision of the same template.
-
-The template owner has full control over template revisions, and can create new revisions to update the template, delete or disable revisions that should not be used to create clusters, and choose which template revision is the default.
-
-This section covers the following topics:
-
-- [Prerequisites](#prerequisites)
-- [Creating a template](#creating-a-template)
-- [Updating a template](#updating-a-template)
-- [Deleting a template](#deleting-a-template)
-- [Creating a revision based on the default revision](#creating-a-revision-based-on-the-default-revision)
-- [Creating a revision based on a cloned revision](#creating-a-revision-based-on-a-cloned-revision)
-- [Disabling a template revision](#disabling-a-template-revision)
-- [Re-enabling a disabled template revision](#re-enabling-a-disabled-template-revision)
-- [Setting a template revision as default](#setting-a-template-revision-as-default)
-- [Deleting a template revision](#deleting-a-template-revision)
-- [Upgrading a cluster to use a new template revision](#upgrading-a-cluster-to-use-a-new-template-revision)
-- [Exporting a running cluster to a new RKE template and revision](#exporting-a-running-cluster-to-a-new-rke-template-and-revision)
-
-### Prerequisites
-
-You can create RKE templates if you have the **Create RKE Templates** permission, which can be [given by an administrator.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creator-permissions)
-
-You can revise, share, and delete a template if you are an owner of the template. For details on how to become an owner of a template, refer to [the documentation on sharing template ownership.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-ownership-of-templates)
-
-### Creating a Template
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Click **Add Template.**
-1. Provide a name for the template. An auto-generated name is already provided for the template' first version, which is created along with this template.
-1. Optional: Share the template with other users or groups by [adding them as members.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-templates-with-specific-users) You can also make the template public to share with everyone in the Rancher setup.
-1. Then follow the form on screen to save the cluster configuration parameters as part of the template's revision. The revision can be marked as default for this template.
-
-**Result:** An RKE template with one revision is configured. You can use this RKE template revision later when you [provision a Rancher-launched cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters). After a cluster is managed by an RKE template, it cannot be disconnected and the option to uncheck **Use an existing RKE Template and Revision** will be unavailable.
-
-### Updating a Template
-
-When you update an RKE template, you are creating a revision of the existing template. Clusters that were created with an older version of the template can be updated to match the new revision.
-
-You can't edit individual revisions. Since you can't edit individual revisions of a template, in order to prevent a revision from being used, you can [disable it.](#disabling-a-template-revision)
-
-When new template revisions are created, clusters using an older revision of the template are unaffected.
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the template that you want to edit and click the **&#8942; > Edit.**
-1. Edit the required information and click **Save.**
-1. Optional: You can change the default revision of this template and also change who it is shared with.
-
-**Result:** The template is updated. To apply it to a cluster using an older version of the template, refer to the section on [upgrading a cluster to use a new revision of a template.](#upgrading-a-cluster-to-use-a-new-template-revision)
-
-### Deleting a Template
-
-When you no longer use an RKE template for any of your clusters, you can delete it.
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the RKE template that you want to delete and click the **&#8942; > Delete.**
-1. Confirm the deletion when prompted.
-
-**Result:** The template is deleted.
-
-### Creating a Revision Based on the Default Revision
-
-You can clone the default template revision and quickly update its settings rather than creating a new revision from scratch. Cloning templates saves you the hassle of re-entering the access keys and other parameters needed for cluster creation.
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the RKE template that you want to clone and click the **&#8942; > New Revision From Default.**
-1. Complete the rest of the form to create a new revision.
-
-**Result:** The RKE template revision is cloned and configured.
-
-### Creating a Revision Based on a Cloned Revision
-
-When creating new RKE template revisions from your user settings, you can clone an existing revision and quickly update its settings rather than creating a new one from scratch. Cloning template revisions saves you the hassle of re-entering the cluster parameters.
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the template revision you want to clone. Then select **&#8942; > Clone Revision.**
-1. Complete the rest of the form.
-
-**Result:** The RKE template revision is cloned and configured. You can use the RKE template revision later when you provision a cluster. Any existing cluster using this RKE template can be upgraded to this new revision.
-
-### Disabling a Template Revision
-
-When you no longer want an RKE template revision to be used for creating new clusters, you can disable it. A disabled revision can be re-enabled.
-
-You can disable the revision if it is not being used by any cluster.
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the template revision you want to disable. Then select **&#8942; > Disable.**
-
-**Result:** The RKE template revision cannot be used to create a new cluster.
-
-### Re-enabling a Disabled Template Revision
-
-If you decide that a disabled RKE template revision should be used to create new clusters, you can re-enable it.
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the template revision you want to re-enable. Then select **&#8942; > Enable.**
-
-**Result:** The RKE template revision can be used to create a new cluster.
-
-### Setting a Template Revision as Default
-
-When end users create a cluster using an RKE template, they can choose which revision to create the cluster with. You can configure which revision is used by default.
-
-To set an RKE template revision as default,
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the RKE template revision that should be default and click the **&#8942; > Set as Default.**
-
-**Result:** The RKE template revision will be used as the default option when clusters are created with the template.
-
-### Deleting a Template Revision
-
-You can delete all revisions of a template except for the default revision.
-
-To permanently delete a revision,
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the RKE template revision that should be deleted and click the **&#8942; > Delete.**
-
-**Result:** The RKE template revision is deleted.
-
-### Upgrading a Cluster to Use a New Template Revision
-
-> This section assumes that you already have a cluster that [has an RKE template applied.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates)
-> This section also assumes that you have [updated the template that the cluster is using](#updating-a-template) so that a new template revision is available.
-
-To upgrade a cluster to use a new template revision,
-
-1. From the **Global** view in Rancher, click the **Clusters** tab.
-1. Go to the cluster that you want to upgrade and click **&#8942; > Edit.**
-1. In the **Cluster Options** section, click the dropdown menu for the template revision, then select the new template revision.
-1. Click **Save.**
-
-**Result:** The cluster is upgraded to use the settings defined in the new template revision.
-
-### Exporting a Running Cluster to a New RKE Template and Revision
-
-You can save an existing cluster's settings as an RKE template.
-
-This exports the cluster's settings as a new RKE template, and also binds the cluster to that template. The result is that the cluster can only be changed if the [template is updated,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template) and the cluster is upgraded to [use a newer version of the template.]
-
-To convert an existing cluster to use an RKE template,
-
-1. From the **Global** view in Rancher, click the **Clusters** tab.
-1. Go to the cluster that will be converted to use an RKE template. Click **&#8942;** > **Save as RKE Template.**
-1. Enter a name for the template in the form that appears, and click **Create.**
-
-**Results:**
-
-- A new RKE template is created.
-- The cluster is converted to use the new template.
-- New clusters can be [created from the new template and revision.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#creating-a-cluster-from-an-rke-template)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/creator-permissions/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/creator-permissions/_index.md
deleted file mode 100644
index 0773da504e3..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/creator-permissions/_index.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: Template Creator Permissions
-weight: 10
----
-
-Administrators have the permission to create RKE templates, and only administrators can give that permission to other users.
-
-For more information on administrator permissions, refer to the [documentation on global permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/).
-
-# Giving Users Permission to Create Templates
-
-Templates can only be created by users who have the global permission **Create RKE Templates.**
-
-Administrators have the global permission to create templates, and only administrators can give that permission to other users.
-
-For information on allowing users to modify existing templates, refer to [Sharing Templates.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing)
-
-Administrators can give users permission to create RKE templates in two ways:
-
-- By editing the permissions of an [individual user](#allowing-a-user-to-create-templates)
-- By changing the [default permissions of new users](#allowing-new-users-to-create-templates-by-default)
-
-### Allowing a User to Create Templates
-
-An administrator can individually grant the role **Create RKE Templates** to any existing user by following these steps:
-
-1. From the global view, click the **Users** tab. Choose the user you want to edit and click the **&#8942; > Edit.**
-1. In the **Global Permissions** section, choose **Custom** and select the **Create RKE Templates** role along with any other roles the user should have. Click **Save.**
-
-**Result:** The user has permission to create RKE templates.
-
-### Allowing New Users to Create Templates by Default
-
-Alternatively, the administrator can give all new users the default permission to create RKE templates by following the following steps. This will not affect the permissions of existing users.
-
-1. From the **Global** view, click **Security > Roles.**
-1. Under the **Global** roles tab, go to the role **Create RKE Templates** and click the **&#8942; > Edit**.
-1. Select the option **Yes: Default role for new users** and click **Save.**
-
-**Result:** Any new user created in this Rancher installation will be able to create RKE templates. Existing users will not get this permission.
-
-### Revoking Permission to Create Templates
-
-Administrators can remove a user's permission to create templates with the following steps:
-
-1. From the global view, click the **Users** tab. Choose the user you want to edit and click the **&#8942; > Edit.**
-1. In the **Global Permissions** section, un-check the box for **Create RKE Templates**. In this section, you can change the user back to a standard user, or give the user a different set of custom permissions.
-1. Click **Save.**
-
-**Result:** The user cannot create RKE templates.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/enforcement/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/enforcement/_index.md
deleted file mode 100644
index a1fa1e79ddb..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/enforcement/_index.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: Template Enforcement
-weight: 32
----
-
-This section describes how template administrators can enforce templates in Rancher, restricting the ability of users to create clusters without a template.
-
-By default, any standard user in Rancher can create clusters. But when RKE template enforcement is turned on,
-
-- Only an administrator has the ability to create clusters without a template.
-- All standard users must use an RKE template to create a new cluster.
-- Standard users cannot create a cluster without using a template.
-
-Users can only create new templates if the administrator [gives them permission.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creator-permissions/#allowing-a-user-to-create-templates)
-
-After a cluster is created with an RKE template, the cluster creator cannot edit settings that are defined in the template. The only way to change those settings after the cluster is created is to [upgrade the cluster to a new revision]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/applying-templates/#updating-a-cluster-created-with-an-rke-template) of the same template. If cluster creators want to change template-defined settings, they would need to contact the template owner to get a new revision of the template. For details on how template revisions work, refer to the [documentation on revising templates.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template)
-
-# Requiring New Clusters to Use an RKE Template
-
-You might want to require new clusters to use a template to ensure that any cluster launched by a [standard user]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) will use the Kubernetes and/or Rancher settings that are vetted by administrators.
-
-To require new clusters to use an RKE template, administrators can turn on RKE template enforcement with the following steps:
-
-1. From the **Global** view, click the **Settings** tab.
-1. Go to the `cluster-template-enforcement` setting. Click the vertical **&#8942;** and click **Edit.**
-1. Set the value to **True** and click **Save.**
-
-**Result:** All clusters provisioned by Rancher must use a template, unless the creator is an administrator.
-
-# Disabling RKE Template Enforcement
-
-To allow new clusters to be created without an RKE template, administrators can turn off RKE template enforcement with the following steps:
-
-1. From the **Global** view, click the **Settings** tab.
-1. Go to the `cluster-template-enforcement` setting. Click the vertical **&#8942;** and click **Edit.**
-1. Set the value to **False** and click **Save.**
-
-**Result:** When clusters are provisioned by Rancher, they don't need to use a template.
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/example-scenarios/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/example-scenarios/_index.md
deleted file mode 100644
index 4e93e102c62..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/example-scenarios/_index.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: Example Scenarios
-weight: 5
----
-
-These example scenarios describe how an organization could use templates to standardize cluster creation.
-
-- **Enforcing templates:** Administrators might want to [enforce one or more template settings for everyone](#enforcing-a-template-setting-for-everyone) if they want all new Rancher-provisioned clusters to have those settings.
-- **Sharing different templates with different users:** Administrators might give [different templates to basic and advanced users,](#templates-for-basic-and-advanced-users) so that basic users have more restricted options and advanced users have more discretion when creating clusters.
-- **Updating template settings:** If an organization's security and DevOps teams decide to embed best practices into the required settings for new clusters, those best practices could change over time. If the best practices change, [a template can be updated to a new revision](#updating-templates-and-clusters-created-with-them) and clusters created from the template can upgrade to the new version of the template.
-- **Sharing ownership of a template:** When a template owner no longer wants to maintain a template, or wants to delegate ownership of the template, this scenario describes how [template ownership can be shared.](#allowing-other-users-to-control-and-share-a-template)
-
-
-# Enforcing a Template Setting for Everyone
-
-Let's say there is an organization in which the administrators decide that all new clusters should be created with Kubernetes version 1.14.
-
-1. First, an administrator creates a template which specifies the Kubernetes version as 1.14 and marks all other settings as **Allow User Override**.
-1. The administrator makes the template public.
-1. The administrator turns on template enforcement.
-
-**Results:**
-
-- All Rancher users in the organization have access to the template.
-- All new clusters created by [standard users]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) with this template will use Kubernetes 1.14 and they are unable to use a different Kubernetes version. By default, standard users don't have permission to create templates, so this template will be the only template they can use unless more templates are shared with them.
-- All standard users must use a cluster template to create a new cluster. They cannot create a cluster without using a template.
-
-In this way, the administrators enforce the Kubernetes version across the organization, while still allowing end users to configure everything else.
-
-# Templates for Basic and Advanced Users
-
-Let's say an organization has both basic and advanced users. Administrators want the basic users to be required to use a template, while the advanced users and administrators create their clusters however they want.
-
-1. First, an administrator turns on [RKE template enforcement.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/enforcement/#requiring-new-clusters-to-use-a-cluster-template) This means that every [standard user]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) in Rancher will need to use an RKE template when they create a cluster.
-1. The administrator then creates two templates:
-
-  - One template for basic users, with almost every option specified except for access keys
-  - One template for advanced users, which has most or all options has **Allow User Override** turned on
-
-1. The administrator shares the advanced template with only the advanced users.
-1. The administrator makes the template for basic users public, so the more restrictive template is an option for everyone who creates a Rancher-provisioned cluster.
-
-**Result:** All Rancher users, except for administrators, are required to use a template when creating a cluster. Everyone has access to the restrictive template, but only advanced users have permission to use the more permissive template. The basic users are more restricted, while advanced users have more freedom when configuring their Kubernetes clusters.
-
-# Updating Templates and Clusters Created with Them
-
-Let's say an organization has a template that requires clusters to use Kubernetes v1.14. However, as time goes on, the administrators change their minds. They decide they want users to be able to upgrade their clusters to use newer versions of Kubernetes.
-
-In this organization, many clusters were created with a template that requires Kubernetes v1.14. Because the template does not allow that setting to be overridden, the users who created the cluster cannot directly edit that setting.
-
-The template owner has several options for allowing the cluster creators to upgrade Kubernetes on their clusters:
-
-- **Specify Kubernetes v1.15 on the template:** The template owner can create a new template revision that specifies Kubernetes v1.15. Then the owner of each cluster that uses that template can upgrade their cluster to a new revision of the template. This template upgrade allows the cluster creator to upgrade Kubernetes to v1.15 on their cluster.
-- **Allow any Kubernetes version on the template:** When creating a template revision, the template owner can also mark the the Kubernetes version as **Allow User Override** using the switch near that setting on the Rancher UI. This will allow clusters that upgrade to this template revision to use any version of Kubernetes.
-- **Allow the latest minor Kubernetes version on the template:** The template owner can also create a template revision in which the Kubernetes version is defined as **Latest v1.14 (Allows patch version upgrades).** This means clusters that use that revision will be able to get patch version upgrades, but major version upgrades will not be allowed.
-
-# Allowing Other Users to Control and Share a Template
-
-Let's say Alice is a Rancher administrator. She owns an RKE template that reflects her organization's agreed-upon best practices for creating a cluster.
-
-Bob is an advanced user who can make informed decisions about cluster configuration. Alice trusts Bob to create new revisions of her template as the best practices get updated over time. Therefore, she decides to make Bob an owner of the template.
-
-To share ownership of the template with Bob, Alice [adds Bob as an owner of her template.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing/#sharing-ownership-of-templates)
-
-The result is that as a template owner, Bob is in charge of version control for that template. Bob can now do all of the following:
-
-- [Revise the template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#updating-a-template) when the best practices change
-- [Disable outdated revisions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#disabling-a-template-revision) of the template so that no new clusters can be created with it
-- [Delete the whole template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#deleting-a-template) if the organization wants to go in a different direction
-- [Set a certain revision as default]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising/#setting-a-template-revision-as-default) when users create a cluster with it. End users of the template will still be able to choose which revision they want to create the cluster with.
-- [Share the template]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/template-access-and-sharing) with specific users, make the template available to all Rancher users, or share ownership of the template with another user.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/example-yaml/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/example-yaml/_index.md
deleted file mode 100644
index 3c85e86d616..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/example-yaml/_index.md
+++ /dev/null
@@ -1,112 +0,0 @@
----
-title: Example YAML
-weight: 60
----
-
-Below is an example RKE template configuration file for reference.
-
-The YAML in the RKE template uses the same customization that is used when you create an RKE cluster. However, since the YAML is within the context of a Rancher provisioned RKE cluster, the customization from the RKE docs needs to be nested under the `rancher_kubernetes_engine` directive.
-
-```yaml
-# 
-# Cluster Config
-# 
-docker_root_dir: /var/lib/docker
-
-enable_cluster_alerting: false
-# This setting is not enforced. Clusters
-# created with this sample template
-# would have alerting turned off by default,
-# but end users could still turn alerting
-# on or off.
-
-enable_cluster_monitoring: true 
-# This setting is not enforced. Clusters
-# created with this sample template
-# would have monitoring turned on
-# by default, but end users could still
-# turn monitoring on or off.
-
-enable_network_policy: false
-local_cluster_auth_endpoint:
-  enabled: true
-# 
-# Rancher Config
-# 
-rancher_kubernetes_engine_config: # Your RKE template config goes here.
-  addon_job_timeout: 30
-  authentication:
-    strategy: x509
-  ignore_docker_version: true
-# 
-# # Currently only nginx ingress provider is supported.
-# # To disable ingress controller, set `provider: none`
-# # To enable ingress on specific nodes, use the node_selector, eg:
-#    provider: nginx
-#    node_selector:
-#      app: ingress
-# 
-  ingress:
-    provider: nginx
-  kubernetes_version: v1.15.3-rancher3-1
-  monitoring:
-    provider: metrics-server
-# 
-#   If you are using calico on AWS
-# 
-#    network:
-#      plugin: calico
-#      calico_network_provider:
-#        cloud_provider: aws
-# 
-# # To specify flannel interface
-# 
-#    network:
-#      plugin: flannel
-#      flannel_network_provider:
-#      iface: eth1
-# 
-# # To specify flannel interface for canal plugin
-# 
-#    network:
-#      plugin: canal
-#      canal_network_provider:
-#        iface: eth1
-# 
-  network:
-    options:
-      flannel_backend_type: vxlan
-    plugin: canal
-# 
-#    services:
-#      kube-api:
-#        service_cluster_ip_range: 10.43.0.0/16
-#      kube-controller:
-#        cluster_cidr: 10.42.0.0/16
-#        service_cluster_ip_range: 10.43.0.0/16
-#      kubelet:
-#        cluster_domain: cluster.local
-#        cluster_dns_server: 10.43.0.10
-# 
-  services:
-    etcd:
-      backup_config:
-        enabled: true
-        interval_hours: 12
-        retention: 6
-        safe_timestamp: false
-      creation: 12h
-      extra_args:
-        election-timeout: 5000
-        heartbeat-interval: 500
-      gid: 0
-      retention: 72h
-      snapshot: false
-      uid: 0
-    kube_api:
-      always_pull_images: false
-      pod_security_policy: false
-      service_node_port_range: 30000-32767
-  ssh_agent_auth: false
-windows_prefered_cluster: false
-```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/overrides/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/overrides/_index.md
deleted file mode 100644
index bb5f00d4b9e..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/overrides/_index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: Overriding Template Settings
-weight: 33
----
-
-When a user creates an RKE template, each setting in the template has a switch in the Rancher UI that indicates if users can override the setting. This switch marks those settings as **Allow User Override.**
-
-After a cluster is created with a template, end users can't update any of the settings defined in the template unless the template owner marked them as **Allow User Override.** However, if the template is [updated to a new revision]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising) that changes the settings or allows end users to change them, the cluster can be upgraded to a new revision of the template and the changes in the new revision will be applied to the cluster.
-
-When any parameter is set as **Allow User Override** on the RKE template, it means that end users have to fill out those fields during cluster creation and they can edit those settings afterward at any time.
-
-The **Allow User Override** model of the RKE template is useful for situations such as:
-
-- Administrators know that some settings will need the flexibility to be frequently updated over time
-- End users will need to enter their own access keys or secret keys, for example, cloud credentials or credentials for backup snapshots
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/rke-templates-and-hardware/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/rke-templates-and-hardware/_index.md
deleted file mode 100644
index 67ca181a964..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/rke-templates-and-hardware/_index.md
+++ /dev/null
@@ -1,70 +0,0 @@
----
-title: RKE Templates and Infrastructure
-weight: 90
----
-
-In Rancher, RKE templates are used to provision Kubernetes and define Rancher settings, while node templates are used to provision nodes.
-
-Therefore, even if RKE template enforcement is turned on, the end user still has flexibility when picking the underlying hardware when creating a Rancher cluster. The end users of an RKE template can still choose an infrastructure provider and the nodes they want to use.
-
-If you want to standardize the hardware in your clusters, use RKE templates conjunction with node templates or with a server provisioning tool such as Terraform.
-
-### Node Templates
-
-[Node templates]({{<baseurl>}}/rancher/v2.x/en/user-settings/node-templates) are responsible for node configuration and node provisioning in Rancher. From your user profile, you can set up node templates to define which templates are used in each of your node pools. With node pools enabled, you can make sure you have the required number of nodes in each node pool, and ensure that all nodes in the pool are the same.
-
-### Terraform
-
-Terraform is a server provisioning tool. It uses infrastructure-as-code that lets you create almost every aspect of your infrastructure with Terraform configuration files. It can automate the process of server provisioning in a way that is self-documenting and easy to track in version control.
-
-This section focuses on how to use Terraform with the [Rancher 2 Terraform provider](https://www.terraform.io/docs/providers/rancher2/), which is a recommended option to standardize the hardware for your Kubernetes clusters. If you use the Rancher Terraform provider to provision hardware, and then use an RKE template to provision a Kubernetes cluster on that hardware, you can quickly create a comprehensive, production-ready cluster.
-
-Terraform allows you to:
-
-- Define almost any kind of infrastructure-as-code, including servers, databases, load balancers, monitoring, firewall settings, and SSL certificates
-- Leverage catalog apps and multi-cluster apps
-- Codify infrastructure across many platforms, including Rancher and major cloud providers
-- Commit infrastructure-as-code to version control
-- Easily repeat configuration and setup of infrastructure
-- Incorporate infrastructure changes into standard development practices
-- Prevent configuration drift, in which some servers become configured differently than others
-
-# How Does Terraform Work?
-
-Terraform is written in files with the extension `.tf`. It is written in HashiCorp Configuration Language, which is a declarative language that lets you define the infrastructure you want in your cluster, the cloud provider you are using, and your credentials for the provider. Then Terraform makes API calls to the provider in order to efficiently create that infrastructure.
-
-To create a Rancher-provisioned cluster with Terraform, go to your Terraform configuration file and define the provider as Rancher 2. You can set up your Rancher 2 provider with a Rancher API key. Note: The API key has the same permissions and access level as the user it is associated with.
-
-Then Terraform calls the Rancher API to provision your infrastructure, and Rancher calls the infrastructure provider. As an example, if you wanted to use Rancher to provision infrastructure on AWS, you would provide both your Rancher API key and your AWS credentials in the Terraform configuration file or in environment variables so that they could be used to provision the infrastructure.
-
-When you need to make changes to your infrastructure, instead of manually updating the servers, you can make changes in the Terraform configuration files. Then those files can be committed to version control, validated, and reviewed as necessary. Then when you run `terraform apply`, the changes would be deployed.
-
-# Tips for Working with Terraform
-
-- There are examples of how to provide most aspects of a cluster in the [documentation for the Rancher 2 provider.](https://www.terraform.io/docs/providers/rancher2/)
-
-- In the Terraform settings, you can install Docker Machine by using the Docker Machine node driver.
-
-- You can also modify auth in the Terraform provider.
-
-- You can reverse engineer how to do define a setting in Terraform by changing the setting in Rancher, then going back and checking your Terraform state file to see how it maps to the current state of your infrastructure.
-
-- If you want to manage Kubernetes cluster settings, Rancher settings, and hardware settings all in one place, use [Terraform modules](https://github.com/rancher/terraform-modules). You can pass a cluster configuration YAML file or an RKE template configuration file to a Terraform module so that the Terraform module will create it. In that case, you could use your infrastructure-as-code to manage the version control and revision history of both your Kubernetes cluster and its underlying hardware.
-
-# Tip for Creating CIS Benchmark Compliant Clusters
-
-This section describes one way that you can make security and compliance-related config files standard in your clusters.
-
-When you create a [CIS benchmark compliant cluster,]({{<baseurl>}}/rancher/v2.x/en/security/) you have an encryption config file and an audit log config file.
-
-Your infrastructure provisioning system can write those files to disk. Then in your RKE template, you would specify where those files will be, then add your encryption config file and audit log config file as extra mounts to the `kube-api-server`.
-
-Then you would make sure that the `kube-api-server` flag in your RKE template uses your CIS-compliant config files.
-
-In this way, you can create flags that comply with the CIS benchmark.
-
-# Resources
-
-- [Terraform documentation](https://www.terraform.io/docs/)
-- [Rancher2 Terraform provider documentation](https://www.terraform.io/docs/providers/rancher2/)
-- [The RanchCast - Episode 1: Rancher 2 Terraform Provider](https://youtu.be/YNCq-prI8-8): In this demo, Director of Community Jason van Brackel walks through using the Rancher 2 Terraform Provider to provision nodes and create a custom cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/rke-templates/template-access-and-sharing/_index.md b/content/rancher/v2.5/en/ecm/rke-templates/template-access-and-sharing/_index.md
deleted file mode 100644
index 863faa1bc8b..00000000000
--- a/content/rancher/v2.5/en/ecm/rke-templates/template-access-and-sharing/_index.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-title: Access and Sharing
-weight: 31
----
-
-If you are an RKE template owner, you can share it with users or groups of users, who can then use the template to create clusters.
-
-Since RKE templates are specifically shared with users and groups, owners can share different RKE templates with different sets of users.
-
-When you share a template, each user can have one of two access levels:
-
-- **Owner:** This user can update, delete, and share the templates that they own. The owner can also share the template with other users.
-- **User:** These users can create clusters using the template. They can also upgrade those clusters to new revisions of the same template. When you share a template as **Make Public (read-only),** all users in your Rancher setup have the User access level for the template.
-
-If you create a template, you automatically become an owner of that template. 
-
-If you want to delegate responsibility for updating the template, you can share ownership of the template. For details on how owners can modify templates, refer to the [documentation about revising templates.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rke-templates/creating-and-revising)
-
-There are several ways to share templates:
-
-- Add users to a new RKE template during template creation
-- Add users to an existing RKE template
-- Make the RKE template public, sharing it with all users in the Rancher setup
-- Share template ownership with users who are trusted to modify the template
-
-### Sharing Templates with Specific Users or Groups
-
-To allow users or groups to create clusters using your template, you can give them the basic **User** access level for the template.
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the template that you want to share and click the **&#8942; > Edit.**
-1. In the **Share Template** section, click on **Add Member**.
-1. Search in the **Name** field for the user or group you want to share the template with.
-1. Choose the **User** access type.
-1. Click **Save.**
-
-**Result:** The user or group can create clusters using the template.
-
-### Sharing Templates with All Users
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the template that you want to share and click the **&#8942; > Edit.**
-1. Under **Share Template,** click **Make Public (read-only).** Then click **Save.**
-
-**Result:** All users in the Rancher setup can create clusters using the template.
-
-### Sharing Ownership of Templates
-
-If you are the creator of a template, you might want to delegate responsibility for maintaining and updating a template to another user or group.
-
-In that case, you can give users the Owner access type, which allows another user to update your template, delete it, or share access to it with other users.
-
-To give Owner access to a user or group,
-
-1. From the **Global** view, click **Tools > RKE Templates.**
-1. Go to the RKE template that you want to share and click the **&#8942; > Edit.**
-1. Under **Share Template**, click on **Add Member** and search in the **Name** field for the user or group you want to share the template with.
-1. In the **Access Type** field, click **Owner.**
-1. Click **Save.**
-
-**Result:** The user or group has the Owner access type, and can modify, share, or delete the template.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
deleted file mode 100644
index 80456c25494..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/_index.md
+++ /dev/null
@@ -1,90 +0,0 @@
----
-title: Setting up Kubernetes Clusters in Rancher
-description: Provisioning Kubernetes Clusters
-weight: 2
----
-
-Rancher simplifies the creation of clusters by allowing you to create them through the Rancher UI rather than more complex alternatives. Rancher provides multiple options for launching a cluster. Use the option that best fits your use case.
-
-This section assumes a basic familiarity with Docker and Kubernetes. For a brief explanation of how Kubernetes components work together, refer to the [concepts]({{<baseurl>}}/rancher/v2.x/en/overview/concepts) page.
-
-For a conceptual overview of how the Rancher server provisions clusters and what tools it uses to provision them, refer to the [architecture]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/) page.
-
-This section covers the following topics:
-
-<!-- TOC -->
-
-- [Setting up clusters in a hosted Kubernetes provider](#setting-up-clusters-in-a-hosted-kubernetes-cluster)
-- [Launching Kubernetes with Rancher](#launching-kubernetes-with-rancher)
-  - [Launching Kubernetes and Provisioning Nodes in an Infrastructure Provider](#launching-kubernetes-and-provisioning-nodes-in-an-infrastructure-provider)
-  - [Launching Kubernetes on Existing Custom Nodes](#launching-kubernetes-on-existing-custom-nodes)
-- [Importing Existing Clusters](#importing-existing-clusters)
-  - [Importing and Editing K3s Clusters](#importing-and-editing-k3s-clusters)
-  <!-- /TOC -->
-
-The following table summarizes the options and settings available for each cluster type:
-
-{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
-
-# Setting up Clusters in a Hosted Kubernetes Provider
-
-In this scenario, Rancher does not provision Kubernetes because it is installed by providers such as Google Kubernetes Engine (GKE), Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.
-
-If you use a Kubernetes provider such as Google GKE, Rancher integrates with its cloud APIs, allowing you to create and manage role-based access control for the hosted cluster from the Rancher UI.
-
-For more information, refer to the section on [hosted Kubernetes clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters)
-
-# Launching Kubernetes with Rancher
-
-Rancher uses the [Rancher Kubernetes Engine (RKE)]({{<baseurl>}}/rke/latest/en/)as a library when provisioning Kubernetes on your own nodes. RKE is Rancher’s own lightweight Kubernetes installer.
-
-In RKE clusters, Rancher manages the deployment of Kubernetes. These clusters can be deployed on any bare metal server, cloud provider, or virtualization platform.
-
-These nodes can be dynamically provisioned through Rancher's UI, which calls [Docker Machine](https://docs.docker.com/machine/) to launch nodes on various cloud providers.
-
-If you already have a node that you want to add to an RKE cluster, you can add it to the cluster by running a Rancher agent container on it.
-
-For more information, refer to the section on [RKE clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/)
-
-### Launching Kubernetes and Provisioning Nodes in an Infrastructure Provider
-
-Rancher can dynamically provision nodes in infrastructure providers such as Amazon EC2, DigitalOcean, Azure, or vSphere, then install Kubernetes on them.
-
-Using Rancher, you can create pools of nodes based on a [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates). This template defines the parameters used to launch nodes in your cloud providers.
-
-One benefit of using nodes hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically replace it, thus maintaining the expected cluster configuration.
-
-The cloud providers available for creating a node template are decided based on the [node drivers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-drivers) active in the Rancher UI.
-
-For more information, refer to the section on [nodes hosted by an infrastructure provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/)
-
-### Launching Kubernetes on Existing Custom Nodes
-
-When setting up this type of cluster, Rancher installs Kubernetes on existing [custom nodes,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/) which creates a custom cluster.
-
-You can bring any nodes you want to Rancher and use them to create a cluster.
-
-These nodes include on-premise bare metal servers, cloud-hosted virtual machines, or on-premise virtual machines.
-
-# Importing Existing Clusters
-
-In this type of cluster, Rancher connects to a Kubernetes cluster that has already been set up. Therefore, Rancher does not provision Kubernetes, but only sets up the Rancher agents to communicate with the cluster.
-
-Note that Rancher does not automate the provisioning, scaling, or upgrade of imported clusters. Other Rancher features, including management of cluster, role-based access control, policy, and workloads, are available for imported clusters.
-
-For all imported Kubernetes clusters except for K3s clusters, the configuration of an imported cluster still has to be edited outside of Rancher. Some examples of editing the cluster include adding and removing nodes, upgrading the Kubernetes version, and changing Kubernetes component parameters.
-
-In Rancher v2.4, it became possible to import a K3s cluster and upgrade Kubernetes by editing the cluster in the Rancher UI.
-
-For more information, refer to the section on [importing existing clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)
-
-### Importing and Editing K3s Clusters
-
-[K3s]({{<baseurl>}}/k3s/latest/en/) is lightweight, fully compliant Kubernetes distribution. K3s Kubernetes clusters can now be imported into Rancher.
-
-When a K3s cluster is imported, Rancher will recognize it as K3s, and the Rancher UI will expose the following features in addition to the functionality for other imported clusters:
-
-- The ability to upgrade the K3s version
-- The ability to see a read-only version of the K3s cluster's configuration arguments and environment variables used to launch each node in the cluster.
-
-For more information, refer to the section on [imported K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-of-imported-k3s-clusters)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/cluster-capabilities-table/index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/cluster-capabilities-table/index.md
deleted file mode 100644
index b3560c76223..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/cluster-capabilities-table/index.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-headless: true
----
-| Action | [Rancher launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) | [Hosted Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | [Imported Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters) |
-| --- | --- | ---| ---|
-| [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | ✓ | ✓ | ✓ |
-| [Managing Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members/) | ✓ | ✓ | ✓ |
-| [Editing and Upgrading Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) | ✓ | ✓ | * |
-| [Managing Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes) | ✓ | ✓ | ✓ |
-| [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | ✓ | ✓ | ✓ |
-| [Managing Projects, Namespaces and Workloads]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | ✓ | ✓ | ✓ |
-| [Using App Catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/) | ✓ | ✓ | ✓ |
-| [Configuring Tools (Alerts, Notifiers, Logging, Monitoring, Istio)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) | ✓ | ✓ | ✓ |
-| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| ✓ | ✓ | |
-| [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | ✓ |  | |
-| [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | ✓ | | |
-| [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | ✓ | | |
-| [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/) | ✓ | | |
-| [Configuring Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/pod-security-policy/) | ✓ |  | |
-| [Running Security Scans]({{<baseurl>}}/rancher/v2.x/en/security/security-scan/) | ✓ |  | |
-
-/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
deleted file mode 100644
index dffe1dfa5c6..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/_index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Setting up Clusters from Hosted Kubernetes Providers
-weight: 2
----
-
-In this scenario, Rancher does not provision Kubernetes because it is installed by providers such as Google Kubernetes Engine (GKE), Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.
-
-If you use a Kubernetes provider such as Google GKE, Rancher integrates with its cloud APIs, allowing you to create and manage role-based access control for the hosted cluster from the Rancher UI.
-
-In this use case, Rancher sends a request to a hosted provider using the provider's API. The provider then provisions and hosts the cluster for you. When the cluster finishes building, you can manage it from the Rancher UI along with clusters you've provisioned that are hosted on-premise or in an infrastructure provider.
-
-Rancher supports the following Kubernetes providers:
-
-Kubernetes Providers | Available as of  |
- --- | --- |
-[Google GKE (Google Kubernetes Engine)](https://cloud.google.com/kubernetes-engine/) | v2.0.0 |
-[Amazon EKS (Amazon Elastic Container Service for Kubernetes)](https://aws.amazon.com/eks/) | v2.0.0 |
-[Microsoft AKS (Azure Kubernetes Service)](https://azure.microsoft.com/en-us/services/kubernetes-service/) | v2.0.0 |
-[Alibaba ACK (Alibaba Cloud Container Service for Kubernetes)](https://www.alibabacloud.com/product/kubernetes) | v2.2.0 |
-[Tencent TKE (Tencent Kubernetes Engine)](https://intl.cloud.tencent.com/product/tke) | v2.2.0 |
-[Huawei CCE (Huawei Cloud Container Engine)](https://www.huaweicloud.com/en-us/product/cce.html) | v2.2.0 |
-
-## Hosted Kubernetes Provider Authentication
-
-When using Rancher to create a cluster hosted by a provider, you are prompted for authentication information. This information is required to access the provider's API. For more information on how to obtain this information, see the following procedures:
-
-- [Creating a GKE Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/gke)
-- [Creating an EKS Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks)
-- [Creating an AKS Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/aks)
-- [Creating an ACK Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/ack)
-- [Creating a TKE Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/tke)
-- [Creating a CCE Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/cce)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
deleted file mode 100644
index 23da1eadf53..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/ack/_index.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-title: Creating an Aliyun ACK Cluster
-shortTitle: Alibaba Cloud Container Service for Kubernetes
-weight: 2120
----
-
-You can use Rancher to create a cluster hosted in Alibaba Cloud Kubernetes (ACK). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for ACK, but by default, this cluster driver is `inactive`. In order to launch ACK clusters, you will need to [enable the ACK cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning ACK clusters.
-
-## Prerequisites
-
->**Note**
->Deploying to ACK will incur charges.
-
-1. In Aliyun, activate the following services in their respective consoles.
-
-    - [Container Service](https://cs.console.aliyun.com)
-    - [Resource Orchestration Service](https://ros.console.aliyun.com)
-    - [RAM](https://ram.console.aliyun.com)
-
-2. Make sure that the account you will be using to create the ACK cluster has the appropriate permissions. Referring to the official Alibaba Cloud documentation about [Role authorization](https://www.alibabacloud.com/help/doc-detail/86483.htm) and [Use the Container Service console as a RAM user](https://www.alibabacloud.com/help/doc-detail/86484.htm) for details.
-
-3. In Alibaba Cloud, create an [access key](https://www.alibabacloud.com/help/doc-detail/53045.html).
-
-4. In Alibaba Cloud, create an [SSH key pair](https://www.alibabacloud.com/help/doc-detail/51793.html). This key is used to access nodes in the Kubernetes cluster.
-
-## Create an ACK Cluster
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-1. Choose **Alibaba ACK**.
-
-1. Enter a **Cluster Name**.
-
-1. {{< step_create-cluster_member-roles >}}
-
-1. Configure **Account Access** for the ACK cluster. Choose the geographical region in which to build your cluster, and input the access key that was created as part of the prerequisite steps.
-
-1. Click **Next: Configure Cluster**, then choose cluster type, the version of Kubernetes and the availability zone.
-
-1. If you choose **Kubernetes** as the cluster type, Click **Next: Configure Master Nodes**, then complete the **Master Nodes** form.
-
-1. Click **Next: Configure Worker Nodes**, then complete the **Worker Nodes** form.
-
-1. Review your options to confirm they're correct. Then click **Create**.
-
-{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
deleted file mode 100644
index 9a942184721..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/aks/_index.md
+++ /dev/null
@@ -1,140 +0,0 @@
----
-title: Creating an AKS Cluster
-shortTitle: Azure Kubernetes Service
-weight: 2115
----
-
-You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Service (AKS).
-
-## Prerequisites in Microsoft Azure
-
->**Note**
->Deploying to AKS will incur charges.
-
-To interact with Azure APIs, an AKS cluster requires an Azure Active Directory (AD) service principal. The service principal is needed to dynamically create and manage other Azure resources, and it provides credentials for your cluster to communicate with AKS. For more information about the service principal, refer to the [AKS documentation](https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal).
-
-Before creating the service principal, you need to obtain the following information from the [Microsoft Azure Portal](https://portal.azure.com):
-
-- Your subscription ID
-- Your tenant ID
-- An app ID (also called a client ID)
-- Client secret
-- A resource group
-
-The below sections describe how to set up these prerequisites using either the Azure command line tool or the Azure portal.
-
-### Setting Up the Service Principal with the Azure Command Line Tool
-
-You can create the service principal by running this command:
-
-```
-az ad sp create-for-rbac --skip-assignment
-```
-
-The result should show information about the new service principal:
-```
-{
-  "appId": "xxxx--xxx",
-  "displayName": "<SERVICE-PRINCIPAL-NAME>",
-  "name": "http://<SERVICE-PRINCIPAL-NAME>",
-  "password": "<SECRET>",
-  "tenant": "<TENANT NAME>"
-}
-```
-
-You also need to add roles to the service principal so that it has privileges for communication with the AKS API. It also needs access to create and list virtual networks.
-
-Below is an example command for assigning the Contributor role to a service principal. Contributors can manage anything on AKS but cannot give access to others:
-
-```
-az role assignment create \
-  --assignee $appId \
-  --scope /subscriptions/$<SUBSCRIPTION-ID>/resourceGroups/$<GROUP> \
-  --role Contributor
-```
-
-You can also create the service principal and give it Contributor privileges by combining the two commands into one. In this command, the scope needs to provide a full path to an Azure resource:
-
-```
-az ad sp create-for-rbac \
-  --scope /subscriptions/$<SUBSCRIPTION-ID>/resourceGroups/$<GROUP> \
-  --role Contributor
-```
-
-### Setting Up the Service Principal from the Azure Portal
-
-You can also follow these instructions to set up a service principal and give it role-based access from the Azure Portal.
-
-1. Go to the Microsoft Azure Portal [home page](https://portal.azure.com).
-
-1. Click **Azure Active Directory.**
-
-1. Click **App registrations.**
-
-1. Click **New registration.**
-
-1. Enter a name. This will be the name of your service principal.
-
-1. Optional: Choose which accounts can use the service principal.
-
-1. Click **Register.**
-
-1. You should now see the name of your service principal under **Azure Active Directory > App registrations.** 
-
-1. Click the name of your service principal. Take note of the tenant ID and application ID (also called app ID or client ID) so that you can use it when provisioning your AKS cluster. Then click **Certificates & secrets.**
-
-1. Click **New client secret.**
-
-1. Enter a short description, pick an expiration time, and click **Add.** Take note of the client secret so that you can use it when provisioning the AKS cluster.
-
-**Result:** You have created a service principal and you should be able to see it listed in the **Azure Active Directory** section under **App registrations.** You still need to give the service principal access to AKS. 
-
-To give role-based access to your service principal,
-
-1. Click **All Services** in the left navigation bar. Then click **Subscriptions.**
-
-1. Click the name of the subscription that you want to associate with your Kubernetes cluster. Take note of the subscription ID so that you can use it when provisioning your AKS cluster.
-
-1. Click **Access Control (IAM).**
-
-1. In the **Add role assignment** section, click **Add.**
-
-1. In the **Role** field, select a role that will have access to AKS. For example, you can use the **Contributor** role, which has permission to manage everything except for giving access to other users.
-
-1. In the **Assign access to** field, select **Azure AD user, group, or service principal.**
-
-1. In the **Select** field, select the name of your service principal and click **Save.**
-
-**Result:** Your service principal now has access to AKS.
-
-
-## Create the AKS Cluster
-
-Use Rancher to set up and configure your Kubernetes cluster.
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-1. Choose **Azure Kubernetes Service**.
-
-1. Enter a **Cluster Name**.
-
-1. {{< step_create-cluster_member-roles >}} 
-
-1. Use your subscription ID, tenant ID, app ID, and client secret to give your cluster access to AKS. If you don't have all of that information, you can retrieve it using these instructions:
-  - **App ID and tenant ID:** To get the app ID and tenant ID, you can go to the Azure Portal, then click **Azure Active Directory**, then click **App registrations,** then click the name of the service principal. The app ID and tenant ID are both on the app registration detail page. 
-  - **Client secret:** If you didn't copy the client secret when creating the service principal, you can get a new one if you go to the app registration detail page, then click **Certificates & secrets**, then click **New client secret.** 
-  - **Subscription ID:** You can get the subscription ID is available in the portal from **All services > Subscriptions.**
-
-1. {{< step_create-cluster_cluster-options >}}
-
-1. Complete the **Account Access** form using the output from your Service Principal. This information is used to authenticate with Azure.
-
-1. Use **Nodes** to provision each node in your cluster and choose a geographical region.
-
-	[Microsoft Documentation: How to create and use an SSH public and private key pair](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/mac-create-ssh-keys)
-<br/>
-1. Click **Create**.
-<br/>
-1. Review your options to confirm they're correct. Then click **Create**.
-
-{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
deleted file mode 100644
index 452a69d543b..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/cce/_index.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: Creating a Huawei CCE Cluster
-shortTitle: Huawei Cloud Kubernetes Service
-weight: 2130
----
-
-You can use Rancher to create a cluster hosted in Huawei Cloud Container Engine (CCE). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for CCE, but by default, this cluster driver is `inactive`. In order to launch CCE clusters, you will need to [enable the CCE cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning CCE clusters.
-
-## Prerequisites in Huawei
-
->**Note**
->Deploying to CCE will incur charges.
-
-1. Find your project ID in Huawei CCE portal. See the CCE documentation on how to [manage your projects](https://support.huaweicloud.com/en-us/usermanual-iam/en-us_topic_0066738518.html).
-
-2. Create an [Access Key ID and Secret Access Key](https://support.huaweicloud.com/en-us/usermanual-iam/en-us_topic_0079477318.html).
-
-## Limitations
-
-Huawei CCE service doesn't support the ability to create clusters with public access through their API. You are required to run Rancher in the same VPC as the CCE clusters that you want to provision.
-
-## Create the CCE Cluster
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-2. Choose **Huawei CCE**.
-
-3. Enter a **Cluster Name**.
-
-4. {{< step_create-cluster_member-roles >}}
-
-5. Enter **Project Id**, Access Key ID as **Access Key** and Secret Access Key **Secret Key**. Then Click **Next: Configure cluster**.
-
-6. Fill the following cluster configuration:
-
-    |Settings|Description|
-    |---|---|
-    | Cluster Type | Which type or node you want to include into the cluster, `VirtualMachine` or `BareMetal`. |
-	| Description | The description of the cluster. |
-	| Master Version | The Kubernetes version. |
-	| Management Scale Count | The max node count of the cluster. The options are 50, 200 and 1000. The larger of the scale count, the more the cost. |
-	| High Availability | Enable master node high availability. The cluster with high availability enabled will have more cost. |
-	| Container Network Mode | The network mode used in the cluster. `overlay_l2` and `vpc-router` is supported in `VirtualMachine` type and `underlay_ipvlan` is supported in `BareMetal` type |
-	| Container Network CIDR | Network CIDR for the cluster. |
-	| VPC Name | The VPC name which the cluster is going to deploy into. Rancher will create one if it is blank. |
-	| Subnet Name | The Subnet name which the cluster is going to deploy into. Rancher will create one if it is blank. |
-	| External Server | This option is reserved for the future we can enable CCE cluster public access via API. For now, it is always disabled. |
-	| Cluster Label | The labels for the cluster. |
-	| Highway Subnet | This option is only supported in `BareMetal` type. It requires you to select a VPC with high network speed for the bare metal machines. |
-
-	**Note:** If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0)
-
-7. Fill the following node configuration of the cluster:
-
-    |Settings|Description|
-	|---|---|
-	| Zone | The available zone at where the node(s) of the cluster is deployed. |
-	| Billing Mode | The bill mode for the cluster node(s). In `VirtualMachine` type, only `Pay-per-use` is supported. in `BareMetal`, you can choose `Pay-per-use` or `Yearly/Monthly`. |
-	| Validity Period | This option only shows in `Yearly/Monthly` bill mode. It means how long you want to pay for the cluster node(s). |
-	| Auto Renew | This option only shows in `Yearly/Monthly` bill mode. It means that the cluster node(s) will renew the `Yearly/Monthly` payment automatically or not. |
-	| Data Volume Type | Data volume type for the cluster node(s). `SATA`, `SSD` or `SAS` for this option. |
-	| Data Volume Size | Data volume size for the cluster node(s) |
-	| Root Volume Type | Root volume type for the cluster node(s). `SATA`, `SSD` or `SAS` for this option. |
-	| Root Volume Size | Root volume size for the cluster node(s) |
-	| Node Flavor | The node flavor of the cluster node(s). The flavor list in Rancher UI is fetched from Huawei Cloud. It includes all the supported node flavors. |
-	| Node Count | The node count of the cluster |
-	| Node Operating System | The operating system for the cluster node(s). Only `EulerOS 2.2` and `CentOS 7.4` are supported right now. |
-	| SSH Key Name | The ssh key for the cluster node(s) |
-	| EIP | The public IP options for the cluster node(s). `Disabled` means that the cluster node(s) are not going to bind a public IP. `Create EIP` means that the cluster node(s) will bind one or many newly created Eips after provisioned and more options will be shown in the UI to set the to-create EIP parameters. And `Select Existed EIP` means that the node(s) will bind to the EIPs you select.  |
-	| EIP Count | This option will only be shown when `Create EIP` is selected. It means how many EIPs you want to create for the node(s). |
-	| EIP Type | This option will only be shown when `Create EIP` is selected. The options are `5_bgp` and `5_sbgp`. |
-	| EIP Share Type | This option will only be shown when `Create EIP` is selected. The only option is `PER`. |
-	| EIP Charge Mode | This option will only be shown when `Create EIP` is selected. The options are pay by `BandWidth` and pay by `Traffic`. |
-	| EIP Bandwidth Size | This option will only be shown when `Create EIP` is selected. The BandWidth of the EIPs. |
-	| Authentication Mode | It means enabling `RBAC` or also enabling `Authenticating Proxy`. If you select `Authenticating Proxy`, the certificate which is used for authenticating proxy will be also required. |
-	| Node Label | The labels for the cluster node(s). |
-
-8. Click **Create** to create the CCE cluster.
-
-{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
deleted file mode 100644
index 1e87eee4c83..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/eks/_index.md
+++ /dev/null
@@ -1,289 +0,0 @@
----
-title: Creating an EKS Cluster
-shortTitle: Amazon EKS
-weight: 2110
----
-
-Amazon EKS provides a managed control plane for your Kubernetes cluster. Amazon EKS runs the Kubernetes control plane instances across multiple Availability Zones to ensure high availability. Rancher provides an intuitive user interface for managing and deploying the Kubernetes clusters you run in Amazon EKS. With this guide, you will use Rancher to quickly and easily launch an Amazon EKS Kubernetes cluster in your AWS account. For more information on Amazon EKS, see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html).
-
-
-## Prerequisites in Amazon Web Services
-
->**Note**
->Deploying to Amazon AWS will incur charges. For more information, refer to the [EKS pricing page](https://aws.amazon.com/eks/pricing/).
-
-To set up a cluster on EKS, you will need to set up an Amazon VPC (Virtual Private Cloud). You will also need to make sure that the account you will be using to create the EKS cluster has the appropriate permissions. For details, refer to the official guide on [Amazon EKS Prerequisites](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html#eks-prereqs).
-
-### Amazon VPC
-
-You need to set up an Amazon VPC to launch the EKS cluster. The VPC enables you to launch AWS resources into a virtual network that you've defined. For more information, refer to the [Tutorial: Creating a VPC with Public and Private Subnets for Your Amazon EKS Cluster](https://docs.aws.amazon.com/eks/latest/userguide/create-public-private-vpc.html).
-
-### IAM Policies
-
-Rancher needs access to your AWS account in order to provision and administer your Kubernetes clusters in Amazon EKS. You'll need to create a user for Rancher in your AWS account and define what that user can access.
-
-1. Create a user with programmatic access by following the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
-
-2. Next, create an IAM policy that defines what this user has access to in your AWS account. The required permissions are [here.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/#appendix-minimum-eks-permissions) Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
-
-3. Finally, follow the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey) to create an access key and secret key for this user.
-
-> **Note:** It's important to regularly rotate your access and secret keys. See this [documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#rotating_access_keys_console) for more information.
-
-For more detailed information on IAM policies for EKS, refer to the official [documentation on Amazon EKS IAM Policies, Roles, and Permissions](https://docs.aws.amazon.com/eks/latest/userguide/IAM_policies.html).
-
-## Architecture
-
-The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two Kubernetes clusters: one created by RKE and another created by EKS.
-
-![Rancher architecture with EKS hosted cluster]({{<baseurl>}}/img/rancher/rancher-architecture.svg)
-
-## Create the EKS Cluster
-
-Use Rancher to set up and configure your Kubernetes cluster.
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-1. Choose **Amazon EKS**.
-
-1. Enter a **Cluster Name**.
-
-1. {{< step_create-cluster_member-roles >}}
-
-1. Configure **Account Access** for the EKS cluster. Complete each drop-down and field using the information obtained in [2. Create Access Key and Secret Key](#prerequisites-in-amazon-web-services).
-
-    | Setting    | Description                                                                                                          |
-    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
-    | Region     | From the drop-down choose the geographical region in which to build your cluster.                                    |
-    | Access Key | Enter the access key that you created in [2. Create Access Key and Secret Key](#2-create-access-key-and-secret-key). |
-    | Secret Key | Enter the secret key that you created in [2. Create Access Key and Secret Key](#2-create-access-key-and-secret-key). |
-
-1. Click **Next: Select Service Role**. Then choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
-
-    Service Role | Description
-    -------------|---------------------------
-    Standard: Rancher generated service role | If you choose this role, Rancher automatically adds a service role for use with the cluster.
-    Custom: Choose from your existing service roles | If you choose this role, Rancher lets you choose from service roles that you're already created within AWS. For more information on creating a custom service role in AWS, see the [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role).
-
-1. Click **Next: Select VPC and Subnet**.
-
-1. Choose an option for **Public IP for Worker Nodes**. Your selection for this option determines what options are available for **VPC & Subnet**.
-
-    Option | Description
-    -------|------------
-    Yes | When your cluster nodes are provisioned, they're assigned a both a private and public IP address.
-    No: Private IPs only | When your cluster nodes are provisioned, they're assigned only a private IP address.<br/><br/>If you choose this option, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane.
-
-1. Now choose a **VPC & Subnet**. For more information, refer to the AWS documentation for [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html). Follow one of the sets of instructions below based on your selection from the previous step.
-
-	- [What Is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
-	- [VPCs and Subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)
-
-    {{% accordion id="yes" label="Public IP for Worker Nodes—Yes" %}}
-If you choose to assign a public IP address to your cluster's worker nodes, you have the option of choosing between a VPC that's automatically generated by Rancher (i.e., **Standard: Rancher generated VPC and Subnet**), or a VPC that you're already created with AWS (i.e., **Custom: Choose from your existing VPC and Subnets**). Choose the option that best fits your use case.
-
-1. Choose a **VPC and Subnet** option.
-
-    Option | Description
-    -------|------------
-    Standard: Rancher generated VPC and Subnet | While provisioning your cluster, Rancher generates a new VPC and Subnet.
-    Custom: Choose from your exiting VPC and Subnets | While provisioning your cluster, Rancher configures your nodes to use a VPC and Subnet that you've already [created in AWS](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html). If you choose this option, complete the remaining steps below.
-
-1.  If you're using **Custom: Choose from your existing VPC and Subnets**:
-
-    (If you're using **Standard**, skip to [step 11](#select-instance-options))
-
-	1. Make sure **Custom: Choose from your existing VPC and Subnets** is selected.
-
-	1. From the drop-down that displays, choose a VPC.
-
-	1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
-
-    1. Click **Next: Select Security Group**.
-    {{% /accordion %}}
-    {{% accordion id="no" label="Public IP for Worker Nodes—No: Private IPs only" %}}
-If you chose this option, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane. Follow the steps below.
-
->**Tip:** When using only private IP addresses, you can provide your nodes internet access by creating a VPC constructed with two subnets, a private set and a public set.  The private set should have its route tables configured to point toward a NAT in the public set.  For more information on routing traffic from private subnets, please see the [official AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html).
-
-    1. From the drop-down that displays, choose a VPC.
-
-	1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
-
-    1. Click **Next: Select Security Group**.
-    {{% /accordion %}}
-
-1. <a id="security-group"></a>Choose a **Security Group**. See the documentation below on how to create one.
-
-    Amazon Documentation:
-    - [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html)
-    - [Security Groups for Your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
-    - [Create a Security Group](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html#getting-started-create-security-group)
-
-1. <a id="select-instance-options"></a>Click **Select Instance Options**, and then edit the node options available. Instance type and size of your worker nodes affects how many IP addresses each worker node will have available. See this [documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI) for more information.
-
-    Option | Description
-    -------|------------
-    Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning.
-    Custom AMI Override | If you want to use a custom [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html#creating-an-ami) (AMI), specify it here. By default, Rancher will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the EKS version that you chose.
-    Desired ASG Size | The number of instances that your cluster will provision.
-    User Data | Custom commands can to be passed to perform automated configuration tasks **WARNING: Modifying this may cause your nodes to be unable to join the cluster.** _Note: Available as of v2.2.0_
-
-1. Click **Create**.
-
-{{< result_create-cluster >}}
-
-## Troubleshooting
-
-For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html).
-
-## AWS Service Events
-
-To find information on any AWS Service events, please see [this page](https://status.aws.amazon.com/).
-
-## Security and Compliance
-
-For more information on security and compliance with your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/shared-responsibilty.html).
-
-## Tutorial
-
-This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/) on the AWS Open Source Blog will walk you through how to set up an EKS cluster with Rancher, deploy a publicly accessible app to test the cluster, and deploy a sample project to track real-time geospatial data using a combination of other open-source software such as Grafana and InfluxDB.
-
-## Appendix - Minimum EKS Permissions
-
-Documented here is a minimum set of permissions necessary to use all functionality of the EKS driver in Rancher.
-
-Resource targeting uses `*` as the ARN of many of the resources created cannot be known prior to creating the EKS cluster in Rancher. Some permissions (for example `ec2:CreateVpc`) are only used in situations where Rancher handles the creation of certain resources.
-
-```json
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "EC2Permisssions",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:DeleteSubnet",
-                "ec2:CreateKeyPair",
-                "ec2:AttachInternetGateway",
-                "ec2:ReplaceRoute",
-                "ec2:DeleteRouteTable",
-                "ec2:AssociateRouteTable",
-                "ec2:DescribeInternetGateways",
-                "ec2:CreateRoute",
-                "ec2:CreateInternetGateway",
-                "ec2:RevokeSecurityGroupEgress",
-                "ec2:DescribeAccountAttributes",
-                "ec2:DeleteInternetGateway",
-                "ec2:DescribeKeyPairs",
-                "ec2:CreateTags",
-                "ec2:CreateRouteTable",
-                "ec2:DescribeRouteTables",
-                "ec2:DetachInternetGateway",
-                "ec2:DisassociateRouteTable",
-                "ec2:RevokeSecurityGroupIngress",
-                "ec2:DeleteVpc",
-                "ec2:CreateSubnet",
-                "ec2:DescribeSubnets",
-                "ec2:DeleteKeyPair",
-                "ec2:DeleteTags",
-                "ec2:CreateVpc",
-                "ec2:DescribeAvailabilityZones",
-                "ec2:CreateSecurityGroup",
-                "ec2:ModifyVpcAttribute",
-                "ec2:AuthorizeSecurityGroupEgress",
-                "ec2:DescribeTags",
-                "ec2:DeleteRoute",
-                "ec2:DescribeSecurityGroups",
-                "ec2:DescribeImages",
-                "ec2:DescribeVpcs",
-                "ec2:DeleteSecurityGroup"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "EKSPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "eks:DeleteFargateProfile",
-                "eks:DescribeFargateProfile",
-                "eks:ListTagsForResource",
-                "eks:UpdateClusterConfig",
-                "eks:DescribeNodegroup",
-                "eks:ListNodegroups",
-                "eks:DeleteCluster",
-                "eks:CreateFargateProfile",
-                "eks:DeleteNodegroup",
-                "eks:UpdateNodegroupConfig",
-                "eks:DescribeCluster",
-                "eks:ListClusters",
-                "eks:UpdateClusterVersion",
-                "eks:UpdateNodegroupVersion",
-                "eks:ListUpdates",
-                "eks:CreateCluster",
-                "eks:UntagResource",
-                "eks:CreateNodegroup",
-                "eks:ListFargateProfiles",
-                "eks:DescribeUpdate",
-                "eks:TagResource"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "IAMPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "iam:ListRoleTags",
-                "iam:RemoveRoleFromInstanceProfile",
-                "iam:CreateRole",
-                "iam:AttachRolePolicy",
-                "iam:AddRoleToInstanceProfile",
-                "iam:DetachRolePolicy",
-                "iam:GetRole",
-                "iam:DeleteRole",
-                "iam:CreateInstanceProfile",
-                "iam:ListInstanceProfilesForRole",
-                "iam:PassRole",
-                "iam:GetInstanceProfile",
-                "iam:ListRoles",
-                "iam:ListInstanceProfiles",
-                "iam:DeleteInstanceProfile"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "CloudFormationPermisssions",
-            "Effect": "Allow",
-            "Action": [
-                "cloudformation:DescribeStackResource",
-                "cloudformation:ListStackResources",
-                "cloudformation:DescribeStackResources",
-                "cloudformation:DescribeStacks",
-                "cloudformation:ListStacks",
-                "cloudformation:CreateStack",
-                "cloudformation:DeleteStack"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "AutoScalingPermissions",
-            "Effect": "Allow",
-            "Action": [
-                "autoscaling:DescribeAutoScalingGroups",
-                "autoscaling:UpdateAutoScalingGroup",
-                "autoscaling:TerminateInstanceInAutoScalingGroup",
-                "autoscaling:CreateOrUpdateTags",
-                "autoscaling:DeleteAutoScalingGroup",
-                "autoscaling:CreateAutoScalingGroup",
-                "autoscaling:DescribeAutoScalingInstances",
-                "autoscaling:DescribeLaunchConfigurations",
-                "autoscaling:DescribeScalingActivities",
-                "autoscaling:CreateLaunchConfiguration",
-                "autoscaling:DeleteLaunchConfiguration"
-            ],
-            "Resource": "*"
-        }
-    ]
-}
-```
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
deleted file mode 100644
index 25a1a88f2bd..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/gke/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Creating a GKE Cluster
-shortTitle: Google Kubernetes Engine
-weight: 2105
----
-
-## Prerequisites in Google Kubernetes Engine
-
->**Note**
->Deploying to GKE will incur charges.
-
-Create a service account using [Google Kubernetes Engine](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts). GKE uses this account to operate your cluster. Creating this account also generates a private key used for authentication.
-
-The service account requires the following roles:
-
-- **Compute Viewer:** `roles/compute.viewer`
-- **Project Viewer:** `roles/viewer`
-- **Kubernetes Engine Admin:** `roles/container.admin` 
-- **Service Account User:** `roles/iam.serviceAccountUser`
-
-[Google Documentation: Creating and Enabling Service Accounts](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances)
-
-## Create the GKE Cluster
-
-Use {{< product >}} to set up and configure your Kubernetes cluster.
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-2. Choose **Google Kubernetes Engine**.
-
-3. Enter a **Cluster Name**.
-
-4. {{< step_create-cluster_member-roles >}}
-
-5. Either paste your service account private key in the **Service Account** text box or **Read from a file**. Then click **Next: Configure Nodes**.
-
-	>**Note:** After submitting your private key, you may have to enable the Google Kubernetes Engine API. If prompted, browse to the URL displayed in the Rancher UI to enable the API.
-
-6. Select your **Cluster Options**, customize your **Nodes** and customize the **Security** for the GKE cluster. Review your options to confirm they're correct. Then click **Create**.
-
-{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
deleted file mode 100644
index f0046b905c2..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/hosted-kubernetes-clusters/tke/_index.md
+++ /dev/null
@@ -1,75 +0,0 @@
----
-title: Creating a Tencent TKE Cluster
-shortTitle: Tencent Kubernetes Engine
-weight: 2125
----
-
-You can use Rancher to create a cluster hosted in Tencent Kubernetes Engine (TKE). Rancher has already implemented and packaged the [cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/) for TKE, but by default, this cluster driver is `inactive`. In order to launch TKE clusters, you will need to [enable the TKE cluster driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/cluster-drivers/#activating-deactivating-cluster-drivers). After enabling the cluster driver, you can start provisioning TKE clusters.
-
-## Prerequisites in Tencent
-
->**Note**
->Deploying to TKE will incur charges.
-
-1. Make sure that the account you will be using to create the TKE cluster has the appropriate permissions by referring to the  [Cloud Access Management](https://intl.cloud.tencent.com/document/product/598/10600) documentation for details.
-
-2. Create a [Cloud API Secret ID and Secret Key](https://console.cloud.tencent.com/capi).
-
-3. Create a [Private Network and Subnet](https://intl.cloud.tencent.com/document/product/215/4927) in the region that you want to deploy your Kubernetes cluster.
-
-4. Create a [SSH key pair](https://intl.cloud.tencent.com/document/product/213/6092). This key is used to access the nodes in the Kubernetes cluster.
-
-## Create a TKE Cluster
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-2. Choose **Tencent TKE**.
-
-3. Enter a **Cluster Name**.
-
-4. {{< step_create-cluster_member-roles >}}
-
-5. Configure **Account Access** for the TKE cluster. Complete each drop-down and field using the information obtained in [Prerequisites](#prerequisites).
-
-    | Option    | Description                                                                                                          |
-    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
-    | Region     | From the drop-down chooses the geographical region in which to build your cluster.                                    |
-    | Secret ID  | Enter the Secret ID that you obtained from the Tencent Cloud Console. |
-    | Secret Key | Enter the Secret key that you obtained from Tencent Cloud Console. |
-
-6. Click `Next: Configure Cluster` to set your TKE cluster configurations.
-
-    | Option | Description                                                                                                          |
-    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
-    | Kubernetes Version | The TKE only supports Kubernetes version 1.10.5 now.  |
-    | Node Count  | Enter the amount of worker node you want to purchase for your Kubernetes cluster, up to 100. |
-    | VPC | Select the VPC name that you have created in the Tencent Cloud Console. |
-    | Container Network CIDR | Enter the CIDR range of your Kubernetes cluster, you may check the available range of the CIDR in the VPC service of the Tencent Cloud Console. Default to 172.16.0.0/16. |
-
-    **Note:** If you are editing the cluster in the `cluster.yml` instead of the Rancher UI, note that as of Rancher v2.3.0, cluster configuration directives must be nested under the `rancher_kubernetes_engine_config` directive in `cluster.yml`. For more information, refer to the section on [the config file structure in Rancher v2.3.0+.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file-structure-in-rancher-v2-3-0)
-
-7. Click `Next: Select Instance Type` to choose the instance type that will use for your TKE cluster.
-
-    | Option | Description                                                                                                          |
-    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
-    | Availability Zone | Choose the availability zone of the VPC region.  |
-    | Subnet  | Select the Subnet that you have created within the VPC, and add a new one if you don't have it in the chosen availability zone. |
-    | Instance Type | From the drop-down chooses the VM instance type that you want to use for the TKE cluster, default to S2.MEDIUM4 (CPU 2 Memory 4 GiB). |
-
-8. Click `Next: Configure Instance` to configure the VM instance that will use for your TKE cluster.
-
-    Option | Description
-    -------|------------
-    Operating System | The name of the operating system, currently supports Centos7.2x86_64 or ubuntu16.04.1 LTSx86_64
-    Security Group | Security group ID, default does not bind any security groups.
-    Root Disk Type | System disk type. System disk type restrictions are detailed in the [CVM instance configuration](https://cloud.tencent.com/document/product/213/11518).
-    Root Disk Size | System disk size. Linux system adjustment range is 20 - 50G, step size is 1.
-    Data Disk Type | Data disk type, default value to the SSD cloud drive
-    Data Disk Size | Data disk size (GB), the step size is 10
-    Band Width Type | Type of bandwidth, PayByTraffic or PayByHour
-    Band Width | Public network bandwidth (Mbps)
-    Key Pair | Key id, after associating the key can be used to logging to the VM node
-
-9. Click **Create**.
-
-{{< result_create-cluster >}}
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
deleted file mode 100644
index 70b3cef45e8..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/_index.md
+++ /dev/null
@@ -1,177 +0,0 @@
----
-title: Importing Existing Clusters into Rancher
-description: Learn how you can create a cluster in Rancher by importing an existing Kubernetes cluster. Then, you can manage it using Rancher
-metaTitle: 'Kubernetes Cluster Management'
-metaDescription: 'Learn how you can import an existing Kubernetes cluster and then manage it using Rancher'
-weight: 5
----
-
-When managing an imported cluster, Rancher connects to a Kubernetes cluster that has already been set up. Therefore, Rancher does not provision Kubernetes, but only sets up the Rancher agents to communicate with the cluster.
-
-Rancher features, including management of cluster, role-based access control, policy, and workloads, are available for imported clusters. Note that Rancher does not automate the provisioning or scaling of imported clusters.
-
-For all imported Kubernetes clusters except for K3s clusters, the configuration of an imported cluster still has to be edited outside of Rancher. Some examples of editing the cluster include adding and removing nodes, upgrading the Kubernetes version, and changing Kubernetes component parameters.
-
-Rancher v2.4 added the capability to import a K3s cluster into Rancher, as well as the ability to upgrade Kubernetes by editing the cluster in the Rancher UI.
-
-- [Features](#features)
-- [Prerequisites](#prerequisites)
-- [Importing a cluster](#importing-a-cluster)
-- [Imported K3s clusters](#imported-k3s-clusters)
-  - [Additional features for imported K3s clusters](#additional-features-for-imported-k3s-clusters)
-  - [Configuring a K3s Cluster to Enable Importation to Rancher](#configuring-a-k3s-cluster-to-enable-importation-to-rancher)
-  - [Debug Logging and Troubleshooting for Imported K3s clusters](#debug-logging-and-troubleshooting-for-imported-k3s-clusters)
-- [Annotating imported clusters](#annotating-imported-clusters)
-
-# Features
-
-After importing a cluster, the cluster owner can:
-
-- [Manage cluster access]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/) through role-based access control
-- Enable [monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) and [logging]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/)
-- Enable [Istio]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
-- Use [pipelines]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines/)
-- Configure [alerts]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) and [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/)
-- Manage [projects]({{<baseurl>}}/rancher/v2.x/en/project-admin/) and [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/)
-
-After importing a K3s cluster, the cluster owner can also [upgrade Kubernetes from the Rancher UI.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes/)
-
-# Prerequisites
-
-If your existing Kubernetes cluster already has a `cluster-admin` role defined, you must have this `cluster-admin` privilege to import the cluster into Rancher.
-
-In order to apply the privilege, you need to run:
-
-```plain
-kubectl create clusterrolebinding cluster-admin-binding \
-  --clusterrole cluster-admin \
-  --user [USER_ACCOUNT]
-```
-
-before running the `kubectl` command to import the cluster.
-
-By default, GKE users are not given this privilege, so you will need to run the command before importing GKE clusters. To learn more about role-based access control for GKE, please click [here](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control).
-
-> If you are importing a K3s cluster, make sure the `cluster.yml` is readable. It is protected by default. For details, refer to [Configuring a K3s cluster to enable importation to Rancher.](#configuring-a-k3s-cluster-to-enable-importation-to-rancher)
-
-# Importing a Cluster
-
-1. From the **Clusters** page, click **Add Cluster**.
-2. Choose **Import**.
-3. Enter a **Cluster Name**.
-4. {{< step_create-cluster_member-roles >}}
-5. Click **Create**.
-6. The prerequisite for `cluster-admin` privileges is shown (see **Prerequisites** above), including an example command to fulfil the prerequisite.
-7. Copy the `kubectl` command to your clipboard and run it on a node where kubeconfig is configured to point to the cluster you want to import. If you are unsure it is configured correctly, run `kubectl get nodes` to verify before running the command shown in {{< product >}}.
-8. If you are using self signed certificates, you will receive the message `certificate signed by unknown authority`. To work around this validation, copy the command starting with `curl` displayed in {{< product >}} to your clipboard. Then run the command on a node where kubeconfig is configured to point to the cluster you want to import.
-9. When you finish running the command(s) on your node, click **Done**.
-   {{< result_import-cluster >}}
-
-> **Note:**
-> You can not re-import a cluster that is currently active in a Rancher setup.
-
-# Imported K3s Clusters
-
-You can now import a K3s Kubernetes cluster into Rancher. [K3s]({{<baseurl>}}/k3s/latest/en/) is lightweight, fully compliant Kubernetes distribution. You can also upgrade Kubernetes by editing the K3s cluster in the Rancher UI.
-
-### Additional Features for Imported K3s Clusters
-
-When a K3s cluster is imported, Rancher will recognize it as K3s, and the Rancher UI will expose the following features in addition to the functionality for other imported clusters:
-
-- The ability to upgrade the K3s version
-- The ability to configure the maximum number of nodes that will be upgraded concurrently
-- The ability to see a read-only version of the K3s cluster's configuration arguments and environment variables used to launch each node in the cluster.
-
-### Configuring K3s Cluster Upgrades
-
-> It is a Kubernetes best practice to back up the cluster before upgrading. When upgrading a high-availability K3s cluster with an external database, back up the database in whichever way is recommended by the relational database provider.
-
-The **concurrency** is the maximum number of nodes that are permitted to be unavailable during an upgrade. If number of unavailable nodes is larger than the **concurrency,** the upgrade will fail. If an upgrade fails, you may need to repair or remove failed nodes before the upgrade can succeed.
-
-- **Controlplane concurrency:** The maximum number of server nodes to upgrade at a single time; also the maximum unavailable server nodes
-- **Worker concurrency:** The maximum number worker nodes to upgrade at the same time; also the maximum unavailable worker nodes
-
-In the K3s documentation, controlplane nodes are called server nodes. These nodes run the Kubernetes master, which maintains the desired state of the cluster. In K3s, these controlplane nodes have the capability to have workloads scheduled to them by default.
-
-Also in the K3s documentation, nodes with the worker role are called agent nodes. Any workloads or pods that are deployed in the cluster can be scheduled to these nodes by default.
-
-### Configuring a K3s Cluster to Enable Importation to Rancher
-
-The K3s server needs to be configured to allow writing to the kubeconfig file.
-
-This can be accomplished by passing `--write-kubeconfig-mode 644` as a flag during installation:
-
-```
-$ curl -sfL https://get.k3s.io | sh -s - --write-kubeconfig-mode 644
-```
-
-The option can also be specified using the environment variable `K3S_KUBECONFIG_MODE`:
-
-```
-$ curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" sh -s -
-```
-
-### Debug Logging and Troubleshooting for Imported K3s Clusters
-
-Nodes are upgraded by the system upgrade controller running in the downstream cluster. Based on the cluster configuration, Rancher deploys two [plans](https://github.com/rancher/system-upgrade-controller#example-upgrade-plan) to upgrade K3s nodes: one for controlplane nodes and one for workers. The system upgrade controller follows the plans and upgrades the nodes. 
-
-To enable debug logging on the system upgrade controller deployment, edit the [configmap](https://github.com/rancher/system-upgrade-controller/blob/50a4c8975543d75f1d76a8290001d87dc298bdb4/manifests/system-upgrade-controller.yaml#L32) to set the debug environment variable to true. Then restart the `system-upgrade-controller` pod.
-
-Logs created by the `system-upgrade-controller` can be viewed by running this command:
-
-```
-kubectl logs -n cattle-system system-upgrade-controller
-```
-
-The current status of the plans can be viewed with this command:
-
-```
-kubectl get plans -A -o yaml
-```
-
-If the cluster becomes stuck in upgrading, restart the `system-upgrade-controller`.
-
-To prevent issues when upgrading, the [Kubernetes upgrade best practices](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) should be followed.
-
-### Annotating Imported Clusters
-
-For all types of imported Kubernetes clusters except for K3s Kubernetes clusters, Rancher doesn't have any information about how the cluster is provisioned or configured.
-
-Therefore, when Rancher imports a cluster, it assumes that several capabilities are disabled by default. Rancher assumes this in order to avoid exposing UI options to the user even when the capabilities are not enabled in the imported cluster.
-
-However, if the cluster has a certain capability, such as the ability to use a pod security policy, a user of that cluster might still want to select pod security policies for the cluster in the Rancher UI. In order to do that, the user will need to manually indicate to Rancher that pod security policies are enabled for the cluster.
-
-By annotating an imported cluster, it is possible to indicate to Rancher that a cluster was given a pod security policy, or another capability, outside of Rancher.
-
-This example annotation indicates that a pod security policy is enabled:
-
-```json
-"capabilities.cattle.io/pspEnabled": "true"
-```
-
-The following annotation indicates Ingress capabilities. Note that that the values of non-primitive objects need to be JSON encoded, with quotations escaped.
-
-```json
-"capabilities.cattle.io/ingressCapabilities": "[{"customDefaultBackend":true,"ingressProvider":"asdf"}]"
-```
-
-These capabilities can be annotated for the cluster:
-
-- `ingressCapabilities`
-- `loadBalancerCapabilities`
-- `nodePoolScalingSupported`
-- `nodePortRange`
-- `pspEnabled`
-- `taintSupport`
-
-All the capabilities and their type definitions can be viewed in the Rancher API view, at `[Rancher Server URL]/v3/schemas/capabilities`.
-
-To annotate an imported cluster,
-
-1. Go to the cluster view in Rancher and select **&#8942; > Edit.**
-1. Expand the **Labels & Annotations** section.
-1. Click **Add Annotation.**
-1. Add an annotation to the cluster with the format `capabilities/<capability>: <value>` where `value` is the cluster capability that will be overridden by the annotation. In this scenario, Rancher is not aware of any capabilities of the cluster until you add the annotation.
-1. Click **Save.**
-
-**Result:** The annotation does not give the capabilities to the cluster, but it does indicate to Rancher that the cluster has those capabilities.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/eks/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/eks/_index.md
deleted file mode 100644
index f587a973aad..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/eks/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Importing EKS Clusters
-weight: 2
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/k3s/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
deleted file mode 100644
index de4669c4407..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/k3s/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Importing K3s Kubernetes Clusters
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
deleted file mode 100644
index 73dfb08b048..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/imported-clusters/rancher-k8s/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Importing Rancher Kubernetes Clusters
-weight: 3
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/_index.md
deleted file mode 100644
index a6c2c6e516f..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/_index.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-title: Checklist for Production-Ready Clusters
-weight: 1
----
-
-In this section, we recommend best practices for creating the production-ready Kubernetes clusters that will run your apps and services.
-
-For a list of requirements for your cluster, including the requirements for OS/Docker, hardware, and networking, refer to the section on [node requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements)
-
-This is a shortlist of best practices that we strongly recommend for all production clusters.
-
-For a full list of all the best practices that we recommend, refer to the [best practices section.]({{<baseurl>}}/rancher/v2.x/en/best-practices)
-
-### Node Requirements
-
-* Make sure your nodes fulfill all of the [node requirements,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/) including the port requirements.
-
-### Back up etcd
-
-* Enable etcd snapshots. Verify that snapshots are being created, and run a disaster recovery scenario to verify the snapshots are valid. etcd is the location where the state of your cluster is stored, and losing etcd data means losing your cluster. Make sure you configure [etcd Recurring Snapshots]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/#option-a-recurring-snapshots) for your cluster(s), and make sure the snapshots are stored externally (off the node) as well.
-
-### Cluster Architecture
-
-* Nodes should have one of the following role configurations:
-  * `etcd`
-  * `controlplane`
-  * `etcd` and `controlplane`
-  * `worker` (the `worker` role should not be used or added on nodes with the `etcd` or `controlplane` role)
-* Have at least three nodes with the role `etcd` to survive losing one node. Increase this count for higher node fault toleration, and spread them across (availability) zones to provide even better fault tolerance.
-* Assign two or more nodes the `controlplane` role for master component high availability.
-* Assign two or more nodes the `worker` role for workload rescheduling upon node failure.
-
-For more information on what each role is used for, refer to the [section on roles for nodes in Kubernetes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/nodes-and-roles)
-
-For more information about the 
-number of nodes for each Kubernetes role, refer to the section on [recommended architecture.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/)
-
-### Logging and Monitoring
-
-* Configure alerts/notifiers for Kubernetes components (System Service).
-* Configure logging for cluster analysis and post-mortems.
-
-### Reliability
-
-* Perform load tests on your cluster to verify that its hardware can support your workloads.
-
-### Networking
-
-* Minimize network latency. Rancher recommends minimizing latency between the etcd nodes. The default setting for `heartbeat-interval` is `500`, and the default setting for `election-timeout` is `5000`. These [settings for etcd tuning](https://coreos.com/etcd/docs/latest/tuning.html) allow etcd to run in most networks (except really high latency networks).
-* Cluster nodes should be located within a single region. Most cloud providers provide multiple availability zones within a region, which can be used to create higher availability for your cluster. Using multiple availability zones is fine for nodes with any role. If you are using [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) resources, consult the documentation for any restrictions (i.e. zone storage restrictions).
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
deleted file mode 100644
index 3722a97e451..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/nodes-and-roles/_index.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Roles for Nodes in Kubernetes
-weight: 1
----
-
-This section describes the roles for etcd nodes, controlplane nodes, and worker nodes in Kubernetes, and how the roles work together in a cluster.
-
-This diagram is applicable to Kubernetes clusters [launched with Rancher using RKE.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
-
-![Cluster diagram]({{<baseurl>}}/img/rancher/clusterdiagram.svg)<br/>
-<sup>Lines show the traffic flow between components. Colors are used purely for visual aid</sup>
-
-# etcd
-
-Nodes with the `etcd` role run etcd, which is a consistent and highly available key value store used as Kubernetes’ backing store for all cluster data. etcd replicates the data to each node.
-
->**Note:** Nodes with the `etcd` role are shown as `Unschedulable` in the UI, meaning no pods will be scheduled to these nodes by default.
-
-# controlplane
-
-Nodes with the `controlplane` role run the Kubernetes master components (excluding `etcd`, as it's a separate role). See [Kubernetes: Master Components](https://kubernetes.io/docs/concepts/overview/components/#master-components) for a detailed list of components.
-
->**Note:** Nodes with the `controlplane` role are shown as `Unschedulable` in the UI, meaning no pods will be scheduled to these nodes by default.
-
-### kube-apiserver
-
-The Kubernetes API server (`kube-apiserver`) scales horizontally. Each node with the role `controlplane` will be added to the NGINX proxy on the nodes with components that need to access the Kubernetes API server. This means that if a node becomes unreachable, the local NGINX proxy on the node will forward the request to another Kubernetes API server in the list.
-
-### kube-controller-manager
-
-The Kubernetes controller manager uses leader election using an endpoint in Kubernetes. One instance of the `kube-controller-manager` will create an entry in the Kubernetes endpoints and updates that entry in a configured interval. Other instances will see an active leader and wait for that entry to expire (for example, when a node is unresponsive).
-
-### kube-scheduler
-
-The Kubernetes scheduler uses leader election using an endpoint in Kubernetes. One instance of the `kube-scheduler` will create an entry in the Kubernetes endpoints and updates that entry in a configured interval. Other instances will see an active leader and wait for that entry to expire (for example, when a node is unresponsive).
-
-# worker
-
-Nodes with the `worker` role run the Kubernetes node components. See [Kubernetes: Node Components](https://kubernetes.io/docs/concepts/overview/components/#node-components) for a detailed list of components.
-
-# References
-
-* [Kubernetes: Node Components](https://kubernetes.io/docs/concepts/overview/components/#node-components)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
deleted file mode 100644
index 8dd5a53dfde..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/production-checklist/recommended-architecture/_index.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: Recommended Cluster Architecture
-weight: 1
----
-
-There are three roles that can be assigned to nodes: `etcd`, `controlplane` and `worker`. 
-
-# Separating Worker Nodes from Nodes with Other Roles
-
-When designing your cluster(s), you have two options:
-
-* Use dedicated nodes for each role. This ensures resource availability for the components needed for the specified role. It also strictly isolates network traffic between each of the roles according to the [port requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/).
-* Assign the `etcd` and `controlplane` roles to the same nodes. These nodes must meet the hardware requirements for both roles.
-
-In either case, the `worker` role should not be used or added to nodes with the `etcd` or `controlplane` role.
-
-Therefore, each node should have one of the following role configurations:
-
-  * `etcd`
-  * `controlplane`
-  * Both `etcd` and `controlplane`
-  * `worker`
-
-# Recommended Number of Nodes with Each Role
-
-The cluster should have:
-
-- At least three nodes with the role `etcd` to survive losing one node. Increase this count for higher node fault toleration, and spread them across (availability) zones to provide even better fault tolerance.
-- At least two nodes with the role `controlplane` for master component high availability.
-- At least two nodes with the role `worker` for workload rescheduling upon node failure.
-
-For more information on what each role is used for, refer to the [section on roles for nodes in Kubernetes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production/nodes-and-roles)
-
-
-### Number of Controlplane Nodes
-
-Adding more than one node with the `controlplane` role makes every master component highly available.
-
-### Number of etcd Nodes
-
-The number of nodes that you can lose at once while maintaining cluster availability is determined by the number of nodes assigned the `etcd` role. For a cluster with n members, the minimum is (n/2)+1. Therefore, we recommend creating an  `etcd` node in 3 different availability zones within a region to survive the loss of one availability zone. If you use only two zones, you can only survive the loss of the zone where you don't lose the majority of nodes.
-
-| Nodes with `etcd` role | Majority   | Failure Tolerance |
-|--------------|------------|-------------------|
-| 1 | 1 | 0 |
-| 2 | 2 | 0 |
-| 3 | 2 | **1** |
-| 4 | 3 | 1 |
-| 5 | 3 | **2** |
-| 6 | 4 | 2 |
-| 7 | 4 | **3** |
-| 8 | 5 | 3 |
-| 9 | 5 | **4** |
-
-References:
-
-* [Official etcd documentation on optimal etcd cluster size](https://etcd.io/docs/v3.4.0/faq/#what-is-failure-tolerance)
-* [Official Kubernetes documentation on operating etcd clusters for Kubernetes](https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/)
-
-### Number of Worker Nodes
-
-Adding more than one node with the `worker` role will make sure your workloads can be rescheduled if a node fails.
-
-### Why Production Requirements are Different for the Rancher Cluster and the Clusters Running Your Applications
-
-You may have noticed that our [Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/) instructions do not meet our definition of a production-ready cluster, as there are no dedicated nodes for the `worker` role. However, for your Rancher installation, this three node cluster is valid, because:
-
-* It allows one `etcd` node failure.
-* It maintains multiple instances of the master components by having multiple `controlplane` nodes.
-* No other workloads than Rancher itself should be created on this cluster.
-
-# References
-
-* [Kubernetes: Master Components](https://kubernetes.io/docs/concepts/overview/components/#master-components)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/_index.md
deleted file mode 100644
index 5f581d02208..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/_index.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: Launching Kubernetes with Rancher
-weight: 3
----
-
-You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, it uses [Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/) (RKE), which is Rancher's own lightweight Kubernetes installer. It can launch Kubernetes on any computers, including:
-
-- Bare-metal servers
-- On-premise virtual machines
-- Virtual machines hosted by an infrastructure provider
-
-Rancher can install Kubernetes on existing nodes, or it can dynamically provision nodes in an infrastructure provider and install Kubernetes on them.
-
-RKE clusters include clusters that Rancher launched on Windows nodes or other existing custom nodes, as well as clusters that Rancher launched with new nodes on Azure, Digital Ocean, EC2, or vSphere.
-
-### Requirements
-
-If you use RKE to set up a cluster, your nodes must meet the [requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements) for nodes in downstream user clusters.
-
-### Launching Kubernetes on New Nodes in an Infrastructure Provider
-
-Using Rancher, you can create pools of nodes based on a [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates). This node template defines the parameters you want to use to launch nodes in your cloud providers.
-
-One benefit of installing Kubernetes on node pools hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically create another node to join the cluster to ensure that the count of the node pool is as expected.
-
-For more information, refer to the section on [launching Kubernetes on new nodes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/)
-
-### Launching Kubernetes on Existing Custom Nodes
-
-In this scenario, you want to install Kubernetes on bare-metal servers, on-premise virtual machines, or virtual machines that already exist in a cloud provider. With this option, you will run a Rancher agent Docker container on the machine.
-
-If you want to reuse a node from a previous custom cluster, [clean the node]({{<baseurl>}}/rancher/v2.x/en/admin-settings/removing-rancher/rancher-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail.
-
-For more information, refer to the section on [custom nodes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
deleted file mode 100644
index e899bcb10db..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/_index.md
+++ /dev/null
@@ -1,386 +0,0 @@
----
-title: Cluster Configuration Reference
-weight: 5
----
-
-As you configure a new cluster that's [provisioned using RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), you can choose custom Kubernetes options.
-
-You can configure Kubernetes options one of two ways:
-
-- [Rancher UI](#rancher-ui): Use the Rancher UI to select options that are commonly customized when setting up a Kubernetes cluster.
-- [Cluster Config File](#cluster-config-file): Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the options available in an RKE installation, except for system_images configuration, by specifying them in YAML.
-
-In Rancher v2.0.0-v2.2.x, the config file is identical to the  [cluster config file for the Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/config-options/), which is the tool Rancher uses to provision clusters. In Rancher v2.3.0, the RKE information is still included in the config file, but it is separated from other options, so that the RKE cluster config options are nested under the `rancher_kubernetes_engine_config` directive. For more information, see the section about the [cluster config file.](#cluster-config-file)
-
-This section is a cluster configuration reference, covering the following topics:
-
-- [Rancher UI Options](#rancher-ui-options)
-  - [Kubernetes version](#kubernetes-version)
-  - [Network provider](#network-provider)
-  - [Kubernetes cloud providers](#kubernetes-cloud-providers)
-  - [Private registries](#private-registries)
-  - [Authorized cluster endpoint](#authorized-cluster-endpoint)
-- [Advanced Options](#advanced-options)
-  - [NGINX Ingress](#nginx-ingress)
-  - [Node port range](#node-port-range)
-  - [Metrics server monitoring](#metrics-server-monitoring)
-  - [Pod security policy support](#pod-security-policy-support)
-  - [Docker version on nodes](#docker-version-on-nodes)
-  - [Docker root directory](#docker-root-directory)
-  - [Recurring etcd snapshots](#recurring-etcd-snapshots)
-- [Cluster config file](#cluster-config-file)
-  - [Config file structure in Rancher v2.3.0+](#config-file-structure-in-rancher-v2-3-0+)
-  - [Config file structure in Rancher v2.0.0-v2.2.x](#config-file-structure-in-rancher-v2-0-0-v2-2-x)
-  - [Default DNS provider](#default-dns-provider)
-- [Rancher specific parameters](#rancher-specific-parameters)
-
-# Rancher UI Options
-
-When creating a cluster using one of the options described in [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), you can configure basic Kubernetes options using the **Cluster Options** section.
-
-### Kubernetes Version
-
-The version of Kubernetes installed on your cluster nodes. Rancher packages its own version of Kubernetes based on [hyperkube](https://github.com/rancher/hyperkube).
-
-### Network Provider
-
-The [Network Provider](https://kubernetes.io/docs/concepts/cluster-administration/networking/) that the cluster uses. For more details on the different networking providers, please view our [Networking FAQ]({{<baseurl>}}/rancher/v2.x/en/faq/networking/cni-providers/).
-
->**Note:** After you launch the cluster, you cannot change your network provider. Therefore, choose which network provider you want to use carefully, as Kubernetes doesn't allow switching between network providers. Once a cluster is created with a network provider, changing network providers would require you  tear down the entire cluster and all its applications.
-
-Out of the box, Rancher is compatible with the following network providers:
-
-- [Canal](https://github.com/projectcalico/canal)
-- [Flannel](https://github.com/coreos/flannel#flannel)
-- [Calico](https://docs.projectcalico.org/v3.11/introduction/)
-- [Weave](https://github.com/weaveworks/weave) (Available as of v2.2.0)
-
-**Notes on Canal:**
-  
-In v2.0.0 - v2.0.4 and v2.0.6, this was the default option for these clusters was Canal with network isolation. With the network isolation automatically enabled, it prevented any pod communication between [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).
-
-As of v2.0.7, if you use Canal, you also have the option of using **Project Network Isolation**, which will enable or disable communication between pods in different [projects]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/).
-
->**Attention Rancher v2.0.0 - v2.0.6 Users**
->
->- In previous Rancher releases, Canal isolates project network communications with no option to disable it. If you are using any of these Rancher releases, be aware that using Canal prevents all communication between pods in different projects.
->- If you have clusters using Canal and are upgrading to v2.0.7, those clusters enable Project Network Isolation by default. If you want to disable Project Network Isolation, edit the cluster and disable the option.
-
-**Notes on Flannel:**
-
-In v2.0.5, this was the default option, which did not prevent any network isolation between projects.
-
-**Notes on Weave:**
-
-When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file) and the [Weave Network Plug-in Options]({{<baseurl>}}/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options).
-
-### Kubernetes Cloud Providers
-
-You can configure a [Kubernetes cloud provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers). If you want to use [volumes and storage]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/) in Kubernetes, typically you must select the specific cloud provider in order to use it. For example, if you want to use Amazon EBS, you would need to select the `aws` cloud provider.
-
->**Note:** If the cloud provider you want to use is not listed as an option, you will need to use the [config file option](#config-file) to configure the cloud provider. Please reference the [RKE cloud provider documentation]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/) on how to configure the cloud provider.
-
-If you want to see all the configuration options for a cluster, please click **Show advanced options** on the bottom right. The advanced options are described below:
-
-### Private registries
-
-The cluster-level private registry configuration is only used for provisioning clusters.
-
-There are two main ways to set up private registries in Rancher: by setting up the [global default registry]({{<baseurl>}}/rancher/v2.x/en/admin-settings/config-private-registry) through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials.
-
-If your private registry requires credentials, you need to pass the credentials to Rancher by editing the cluster options for each cluster that needs to pull images from the registry.
-
-The private registry configuration option tells Rancher where to pull the [system images]({{<baseurl>}}/rke/latest/en/config-options/system-images/) or [addon images]({{<baseurl>}}/rke/latest/en/config-options/add-ons/) that will be used in your cluster.
-
-- **System images** are components needed to maintain the Kubernetes cluster.
-- **Add-ons** are used to deploy several cluster components, including network plug-ins, the ingress controller, the DNS provider, or the metrics server.
-
-See the [RKE documentation on private registries]({{<baseurl>}}/rke/latest/en/config-options/private-registries/) for more information on the private registry for components applied during the provisioning of the cluster.
-
-### Authorized Cluster Endpoint
-
-Authorized Cluster Endpoint can be used to directly access the Kubernetes API server, without requiring communication through Rancher.
-
-> The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#tools-for-provisioning-kubernetes-clusters) to provision the cluster. It is not available for clusters in a hosted Kubernetes provider, such as Amazon's EKS.
-
-This is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self signed certificates.
-
-For more detail on how an authorized cluster endpoint works and why it is used, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint)
-
-We recommend using a load balancer with the authorized cluster endpoint. For details, refer to the [recommended architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#architecture-for-an-authorized-cluster-endpoint)
-
-# Advanced Options
-
-The following options are available when you create clusters in the Rancher UI. They are located under **Advanced Options.**
-
-### NGINX Ingress
-
-Option to enable or disable the [NGINX ingress controller]({{<baseurl>}}/rke/latest/en/config-options/add-ons/ingress-controllers/).
-
-### Node Port Range
-
-Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). Default is `30000-32767`.
-
-### Metrics Server Monitoring
-
-Option to enable or disable [Metrics Server]({{<baseurl>}}/rke/latest/en/config-options/add-ons/metrics-server/).
-
-### Pod Security Policy Support
-
-Option to enable and select a default [Pod Security Policy]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies). You must have an existing Pod Security Policy configured before you can use this option.
-
-### Docker Version on Nodes
-
-Option to require [a supported Docker version]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/) installed on the cluster nodes that are added to the cluster, or to allow unsupported Docker versions installed on the cluster nodes.
-
-### Docker Root Directory
-
-If the nodes you are adding to the cluster have Docker configured with a non-default Docker Root Directory (default is `/var/lib/docker`), please specify the correct Docker Root Directory in this option.
-
-### Recurring etcd Snapshots
-
-Option to enable or disable [recurring etcd snapshots]({{<baseurl>}}/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots).
-
-# Cluster Config File
-
-Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the [options available]({{<baseurl>}}/rke/latest/en/config-options/) in an RKE installation, except for `system_images` configuration. The `system_images` option is not supported when creating a cluster with the Rancher UI or API.
-
->**Note:** In Rancher v2.0.5 and v2.0.6, the names of services in the Config File (YAML) should contain underscores only: `kube_api` and `kube_controller`.
-
-- To edit an RKE config file directly from the Rancher UI, click **Edit as YAML**.
-- To read from an existing RKE file, click **Read from a file**.
-
-![image]({{<baseurl>}}/img/rancher/cluster-options-yaml.png)
-
-The structure of the config file is different depending on your version of Rancher. Below are example config files for Rancher v2.0.0-v2.2.x and for Rancher v2.3.0+.
-
-### Config File Structure in Rancher v2.3.0+
-
-RKE (Rancher Kubernetes Engine) is the tool that Rancher uses to provision Kubernetes clusters. Rancher's cluster config files used to have the same structure as [RKE config files,]({{<baseurl>}}/rke/latest/en/example-yamls/) but the structure changed so that in Rancher, RKE cluster config items are separated from non-RKE config items. Therefore, configuration for your cluster needs to be nested under the `rancher_kubernetes_engine_config` directive in the cluster config file. Cluster config files created with earlier versions of Rancher will need to be updated for this format. An example cluster config file is included below.
-
-{{% accordion id="v2.3.0-cluster-config-file" label="Example Cluster Config File for Rancher v2.3.0+" %}}
-
-```yaml
-#
-# Cluster Config
-#
-docker_root_dir: /var/lib/docker
-enable_cluster_alerting: false
-enable_cluster_monitoring: false
-enable_network_policy: false
-local_cluster_auth_endpoint:
-  enabled: true
-#
-# Rancher Config
-#
-rancher_kubernetes_engine_config: # Your RKE template config goes here.
-  addon_job_timeout: 30
-  authentication:
-    strategy: x509
-  ignore_docker_version: true
-#
-# # Currently only nginx ingress provider is supported.
-# # To disable ingress controller, set `provider: none`
-# # To enable ingress on specific nodes, use the node_selector, eg:
-#    provider: nginx
-#    node_selector:
-#      app: ingress
-#
-  ingress:
-    provider: nginx
-  kubernetes_version: v1.15.3-rancher3-1
-  monitoring:
-    provider: metrics-server
-#
-#   If you are using calico on AWS
-#
-#    network:
-#      plugin: calico
-#      calico_network_provider:
-#        cloud_provider: aws
-#
-# # To specify flannel interface
-#
-#    network:
-#      plugin: flannel
-#      flannel_network_provider:
-#      iface: eth1
-#
-# # To specify flannel interface for canal plugin
-#
-#    network:
-#      plugin: canal
-#      canal_network_provider:
-#        iface: eth1
-#
-  network:
-    options:
-      flannel_backend_type: vxlan
-    plugin: canal
-#
-#    services:
-#      kube-api:
-#        service_cluster_ip_range: 10.43.0.0/16
-#      kube-controller:
-#        cluster_cidr: 10.42.0.0/16
-#        service_cluster_ip_range: 10.43.0.0/16
-#      kubelet:
-#        cluster_domain: cluster.local
-#        cluster_dns_server: 10.43.0.10
-#
-  services:
-    etcd:
-      backup_config:
-        enabled: true
-        interval_hours: 12
-        retention: 6
-        safe_timestamp: false
-      creation: 12h
-      extra_args:
-        election-timeout: 5000
-        heartbeat-interval: 500
-      gid: 0
-      retention: 72h
-      snapshot: false
-      uid: 0
-    kube_api:
-      always_pull_images: false
-      pod_security_policy: false
-      service_node_port_range: 30000-32767
-  ssh_agent_auth: false
-windows_prefered_cluster: false
-```
-{{% /accordion %}}
-
-### Config File Structure in Rancher v2.0.0-v2.2.x
-
-An example cluster config file is included below.
-
-{{% accordion id="prior-to-v2.3.0-cluster-config-file" label="Example Cluster Config File for Rancher v2.0.0-v2.2.x" %}}
-```yaml
-addon_job_timeout: 30
-authentication:
-  strategy: x509
-ignore_docker_version: true
-#
-# # Currently only nginx ingress provider is supported.
-# # To disable ingress controller, set `provider: none`
-# # To enable ingress on specific nodes, use the node_selector, eg:
-#    provider: nginx
-#    node_selector:
-#      app: ingress
-#
-ingress:
-  provider: nginx
-kubernetes_version: v1.15.3-rancher3-1
-monitoring:
-  provider: metrics-server
-#
-#   If you are using calico on AWS
-#
-#    network:
-#      plugin: calico
-#      calico_network_provider:
-#        cloud_provider: aws
-#
-# # To specify flannel interface
-#
-#    network:
-#      plugin: flannel
-#      flannel_network_provider:
-#      iface: eth1
-#
-# # To specify flannel interface for canal plugin
-#
-#    network:
-#      plugin: canal
-#      canal_network_provider:
-#        iface: eth1
-#
-network:
-  options:
-    flannel_backend_type: vxlan
-  plugin: canal
-#
-#    services:
-#      kube-api:
-#        service_cluster_ip_range: 10.43.0.0/16
-#      kube-controller:
-#        cluster_cidr: 10.42.0.0/16
-#        service_cluster_ip_range: 10.43.0.0/16
-#      kubelet:
-#        cluster_domain: cluster.local
-#        cluster_dns_server: 10.43.0.10
-#
-services:
-  etcd:
-    backup_config:
-      enabled: true
-      interval_hours: 12
-      retention: 6
-      safe_timestamp: false
-    creation: 12h
-    extra_args:
-      election-timeout: 5000
-      heartbeat-interval: 500
-    gid: 0
-    retention: 72h
-    snapshot: false
-    uid: 0
-  kube_api:
-    always_pull_images: false
-    pod_security_policy: false
-    service_node_port_range: 30000-32767
-ssh_agent_auth: false
-```
-{{% /accordion %}}
-
-### Default DNS provider
-
-The table below indicates what DNS provider is deployed by default. See [RKE documentation on DNS provider]({{<baseurl>}}/rke/latest/en/config-options/add-ons/dns/) for more information how to configure a different DNS provider. CoreDNS can only be used on Kubernetes v1.12.0 and higher.
-
-| Rancher version | Kubernetes version | Default DNS provider |
-|-------------|--------------------|----------------------|
-| v2.2.5 and higher | v1.14.0 and higher | CoreDNS |
-| v2.2.5 and higher | v1.13.x and lower | kube-dns |
-| v2.2.4 and lower | any | kube-dns |
-
-# Rancher specific parameters
-
-Besides the RKE config file options, there are also Rancher specific settings that can be configured in the Config File (YAML):
-
-### docker_root_dir
-
-See [Docker Root Directory](#docker-root-directory).
-
-### enable_cluster_monitoring
-
-Option to enable or disable [Cluster Monitoring]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/).
-
-### enable_network_policy
-
-Option to enable or disable Project Network Isolation.
-
-### local_cluster_auth_endpoint
-
-See [Authorized Cluster Endpoint](#authorized-cluster-endpoint).
-
-Example:
-
-```yaml
-local_cluster_auth_endpoint:
-  enabled: true
-  fqdn: "FQDN"
-  ca_certs: "BASE64_CACERT"
-```
-
-### Custom Network Plug-in
-
-You can add a custom network plug-in by using the [user-defined add-on functionality]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/) of RKE. You define any add-on that you want deployed after the Kubernetes cluster is deployed.
-
-There are two ways that you can specify an add-on:
-
-- [In-line Add-ons]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons)
-- [Referencing YAML Files for Add-ons]({{<baseurl>}}/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons)
-
-For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.]({{<baseurl>}}/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example)
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
deleted file mode 100644
index 52f54070a84..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/cluster-config-reference/pod-security-policies/_index.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: Assigning Pod Security Policies
-weight: 1
----
-
-_Pod Security Policies_ are objects that control security-sensitive aspects of pod specification (like root privileges).
-
-## Adding a Default Pod Security Policy
-
-When you create a new cluster with RKE, you can configure it to apply a PSP immediately. As you create the cluster, use the **Cluster Options** to enable a PSP. The PSP assigned to the cluster will be the default PSP for projects within the cluster.
-
->**Prerequisite:**
->Create a Pod Security Policy within Rancher. Before you can assign a default PSP to a new cluster, you must have a PSP available for assignment. For instruction, see [Creating Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/).
->**Note:**
->For security purposes, we recommend assigning a PSP as you create your clusters.
-
-To enable a default Pod Security Policy, set the **Pod Security Policy Support** option to  **Enabled**, and then make a selection from the **Default Pod Security Policy** drop-down.
-
-When the cluster finishes provisioning, the PSP you selected is applied to all projects within the cluster.
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
deleted file mode 100644
index 59ccd70fa8d..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/_index.md
+++ /dev/null
@@ -1,113 +0,0 @@
----
-title: Launching Kubernetes on Existing Custom Nodes
-description: To create a cluster with custom nodes, you’ll need to access servers in your cluster and provision them according to Rancher requirements 
-metaDescription: "To create a cluster with custom nodes, you’ll need to access servers in your cluster and provision them according to Rancher requirements"
-weight: 3
----
-
-When you create a custom cluster, Rancher uses RKE (the Rancher Kubernetes Engine) to create a Kubernetes cluster in on-premise bare-metal servers, on-premise virtual machines, or in any node hosted by an infrastructure provider.
-
-To use this option you'll need access to servers you intend to use in your Kubernetes cluster. Provision each server according to the [requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements), which includes some hardware specifications and Docker. After you install Docker on each server, run the command provided in the Rancher UI to turn each server into a Kubernetes node.
-
-This section describes how to set up a custom cluster.
-
-# Creating a Cluster with Custom Nodes
-
->**Want to use Windows hosts as Kubernetes workers?**
->
->See [Configuring Custom Clusters for Windows]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/) before you start.
-
-<!-- TOC -->
-
-- [1. Provision a Linux Host](#1-provision-a-linux-host)
-- [2. Create the Custom Cluster](#2-create-the-custom-cluster)
-- [3. Amazon Only: Tag Resources](#3-amazon-only-tag-resources)
-
-<!-- /TOC -->
-
-### 1. Provision a Linux Host
-
-Begin creation of a custom cluster by provisioning a Linux host. Your host can be:
-
-- A cloud-host virtual machine (VM)
-- An on-premise VM
-- A bare-metal server
-
-If you want to reuse a node from a previous custom cluster, [clean the node]({{<baseurl>}}/rancher/v2.x/en/admin-settings/removing-rancher/rancher-cluster-nodes/) before using it in a cluster again. If you reuse a node that hasn't been cleaned, cluster provisioning may fail.
-
-Provision the host according to the [installation requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements) and the [checklist for production-ready clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/production)
-
-### 2. Create the Custom Cluster
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-2. Choose **Custom**.
-
-3. Enter a **Cluster Name**.
-
-4. {{< step_create-cluster_member-roles >}}
-
-5. {{< step_create-cluster_cluster-options >}}
-
-    >**Using Windows nodes as Kubernetes workers?**
-    >
-    >- See [Enable the Windows Support Option]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/#enable-the-windows-support-option).
-    >- The only Network Provider available for clusters with Windows support is Flannel. See [Networking Option]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/#networking-option).
-6.	<a id="step-6"></a>Click **Next**.
-
-7.	From **Node Role**, choose the roles that you want filled by a cluster node.
-
-	>**Notes:**
-	>
-    >- Using Windows nodes as Kubernetes workers? See [Node Configuration]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/#node-configuration).
-	>- Bare-Metal Server Reminder: If you plan on dedicating bare-metal servers to each role, you must provision a bare-metal server for each role (i.e. provision multiple bare-metal servers).
-
-8.	<a id="step-8"></a>**Optional**: Click **[Show advanced options]({{<baseurl>}}/rancher/v2.x/en/admin-settings/agent-options/)** to specify IP address(es) to use when registering the node, override the hostname of the node, or to add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) or [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) to the node.
-
-9. Copy the command displayed on screen to your clipboard.
-
-10. Log in to your Linux host using your preferred shell, such as PuTTy or a remote Terminal connection. Run the command copied to your clipboard.
-
-	>**Note:** Repeat steps 7-10 if you want to dedicate specific hosts to specific node roles. Repeat the steps as many times as needed.
-
-11. When you finish running the command(s) on your Linux host(s), click **Done**.
-
-{{< result_create-cluster >}}
-
-### 3. Amazon Only: Tag Resources
-
-If you have configured your cluster to use Amazon as **Cloud Provider**, tag your AWS resources with a cluster ID.
-
-[Amazon Documentation: Tagging Your Amazon EC2 Resources](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html)
-
->**Note:** You can use Amazon EC2 instances without configuring a cloud provider in Kubernetes. You only have to configure the cloud provider if you want to use specific Kubernetes cloud provider functionality. For more information, see [Kubernetes Cloud Providers](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/)
-
-
-The following resources need to tagged with a `ClusterID`:
-
-- **Nodes**: All hosts added in Rancher.
-- **Subnet**: The subnet used for your cluster
-- **Security Group**: The security group used for your cluster.
-
-	>**Note:** Do not tag multiple security groups. Tagging multiple groups generates an error when creating Elastic Load Balancer.
-
-The tag that should be used is:
-
-```
-Key=kubernetes.io/cluster/<CLUSTERID>, Value=owned
-```
-
-`<CLUSTERID>` can be any string you choose. However, the same string must be used on every resource you tag. Setting the tag value to `owned` informs the cluster that all resources tagged with the `<CLUSTERID>` are owned and managed by this cluster.
-
-If you share resources between clusters, you can change the tag to:
-
-```
-Key=kubernetes.io/cluster/CLUSTERID, Value=shared
-```
-
-# Optional Next Steps
-
-After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
-
-- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
-- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
deleted file mode 100644
index 769bd5e0d01..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/custom-nodes/agent-options/_index.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: Rancher Agent Options
-weight: 2500
----
-
-Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) and add the options to the generated `docker run` command when adding a node.
-
-For an overview of how Rancher communicates with downstream clusters using node agents, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#3-node-agents)
-
-## General options
-
-| Parameter  | Environment variable | Description |
-| ---------- | -------------------- | ----------- |
-| `--server` | `CATTLE_SERVER` | The configured Rancher `server-url` setting which the agent connects to |
-| `--token`  | `CATTLE_TOKEN` | Token that is needed to register the node in Rancher |
-| `--ca-checksum`  | `CATTLE_CA_CHECKSUM` | The SHA256 checksum of the configured Rancher `cacerts` setting to validate |
-| `--node-name` | `CATTLE_NODE_NAME` | Override the hostname that is used to register the node (defaults to `hostname -s`) |
-| `--label` | `CATTLE_NODE_LABEL` | Add node labels to the node. For multiple labels, pass additional `--label` options. (`--label key=value`) |
-| `--taints` | `CATTLE_NODE_TAINTS` | Add node taints to the node. For multiple taints, pass additional `--taints` options.  (`--taints key=value:effect`) |
-
-## Role options
-
-| Parameter  | Environment variable | Description |
-| ---------- | -------------------- | ----------- |
-| `--all-roles` | `ALL=true` | Apply all roles (`etcd`,`controlplane`,`worker`) to the node |
-| `--etcd`  | `ETCD=true` | Apply the role `etcd` to the node |
-| `--controlplane`  | `CONTROL=true` | Apply the role `controlplane` to the node |
-| `--worker`  | `WORKER=true` | Apply the role `worker` to the node |
-
-## IP address options
-
-| Parameter  | Environment variable | Description |
-| ---------- | -------------------- | ----------- |
-| `--address` | `CATTLE_ADDRESS` | The IP address the node will be registered with (defaults to the IP used to reach `8.8.8.8`) |
-| `--internal-address` | `CATTLE_INTERNAL_ADDRESS` | The IP address used for inter-host communication on a private network |
-
-### Dynamic IP address options
-
-For automation purposes, you can't have a specific IP address in a command as it has to be generic to be used for every node. For this, we have dynamic IP address options. They are used as a value to the existing IP address options. This is supported for `--address` and `--internal-address`.
-
-| Value  | Example | Description |
-| ---------- | -------------------- | ----------- |
-| Interface name | `--address eth0` | The first configured IP address will be retrieved from the given interface |
-| `ipify` | `--address ipify` | Value retrieved from `https://api.ipify.org` will be used |
-| `awslocal` | `--address awslocal` | Value retrieved from `http://169.254.169.254/latest/meta-data/local-ipv4` will be used |
-| `awspublic` | `--address awspublic` | Value retrieved from `http://169.254.169.254/latest/meta-data/public-ipv4` will be used |
-| `doprivate` | `--address doprivate` | Value retrieved from `http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address` will be used |
-| `dopublic` | `--address dopublic` | Value retrieved from `http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address` will be used |
-| `azprivate` | `--address azprivate` | Value retrieved from `http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/privateIpAddress?api-version=2017-08-01&format=text` will be used |
-| `azpublic` | `--address azpublic` | Value retrieved from `http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-08-01&format=text` will be used |
-| `gceinternal` | `--address gceinternal` | Value retrieved from `http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip` will be used |
-| `gceexternal` | `--address gceexternal` | Value retrieved from `http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip` will be used |
-| `packetlocal` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/local-ipv4` will be used |
-| `packetpublic` | `--address packetlocal` | Value retrieved from `https://metadata.packet.net/2009-04-04/meta-data/public-ipv4` will be used |
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
deleted file mode 100644
index e832003971f..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/_index.md
+++ /dev/null
@@ -1,123 +0,0 @@
----
-title: Launching Kubernetes on New Nodes in an Infrastructure Provider
-weight: 2
----
-
-Using Rancher, you can create pools of nodes based on a [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates). This node template defines the parameters you want to use to launch nodes in your infrastructure providers or cloud providers.
-
-One benefit of installing Kubernetes on node pools hosted by an infrastructure provider is that if a node loses connectivity with the cluster, Rancher can automatically create another node to join the cluster to ensure that the count of the node pool is as expected.
-
-The available cloud providers to create a node template are decided based on active [node drivers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-drivers).
-
-This section covers the following topics:
-
-- [Node templates](#node-templates)
-  - [Node labels](#node-labels)
-  - [Node taints](#node-taints)
-  - [Administrator control of node templates](#administrator-control-of-node-templates)
-- [Node pools](#node-pools)
-  - [Node pool taints](#node-pool-taints)
-  - [About node auto-replace](#about-node-auto-replace)
-  - [Enabling node auto-replace](#enabling-node-auto-replace)
-  - [Disabling node auto-replace](#disabling-node-auto-replace)
-- [Cloud credentials](#cloud-credentials)
-- [Node drivers](#node-drivers)
-
-# Node Templates
-
-A node template is the saved configuration for the parameters to use when provisioning nodes in a specific cloud provider. These nodes can be launched from the UI. Rancher uses [Docker Machine](https://docs.docker.com/machine/) to provision these nodes. The available cloud providers to create node templates are based on the active node drivers in Rancher.
-
-After you create a node template in Rancher, it's saved so that you can use this template again to create node pools. Node templates are bound to your login. After you add a template, you can remove them from your user profile.
-
-### Node Labels
-
-You can add [labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) on each node template, so that any nodes created from the node template will automatically have these labels on them.
-
-### Node Taints
-
-You can add [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on each node template, so that any nodes created from the node template will automatically have these taints on them.
-
-Since taints can be added at a node template and node pool, if there is no conflict with the same key and effect of the taints, all taints will be added to the nodes. If there are taints with the same key and different effect, the taints from the node pool will override the taints from the node template.
-
-### Administrator Control of Node Templates
-
-Administrators can control all node templates. Admins can now maintain all the node templates within Rancher. When a node template owner is no longer using Rancher, the node templates created by them can be managed by administrators so the cluster can continue to be updated and maintained.
-
-To access all node templates, an administrator will need to do the following:
-
-1. In the Rancher UI, click the user profile icon in the upper right corner.
-1. Click **Node Templates.**
-
-**Result:** All node templates are listed and grouped by owner. The templates can be edited or cloned by clicking the **&#8942;.**
-
-# Node Pools
-
-Using Rancher, you can create pools of nodes based on a [node template](#node-templates). The benefit of using a node pool is that if a node is destroyed or deleted, you can increase the number of live nodes to compensate for the node that was lost. The node pool helps you ensure that the count of the node pool is as expected.
-
-Each node pool is assigned with a [node component]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) to specify how these nodes should be configured for the Kubernetes cluster.
-
-### Node Pool Taints
-
-If you haven't defined [taints](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) on your node template, you can add taints for each node pool. The benefit of adding taints at a node pool is beneficial over adding it at a node template is that you can swap out the node templates without worrying if the taint is on the node template.
-
-For each taint, they will automatically be added to any created node in the node pool. Therefore, if you add taints to a node pool that have existing nodes, the taints won't apply to existing nodes in the node pool, but any new node added into the node pool will get the taint.
-
-When there are taints on the node pool and node template, if there is no conflict with the same key and effect of the taints, all taints will be added to the nodes. If there are taints with the same key and different effect, the taints from the node pool will override the taints from the node template.
-
-### About Node Auto-replace
-
-If a node is in a node pool, Rancher can automatically replace unreachable nodes. Rancher will use the existing node template for the given node pool to recreate the node if it becomes inactive for a specified number of minutes.
-
-> **Important:** Self-healing node pools are designed to help you replace worker nodes for **stateless** applications. It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
-
-{{% accordion id="how-does-node-auto-replace-work" label="How does Node Auto-replace Work?" %}}
-   Node auto-replace works on top of the Kubernetes node controller. The node controller periodically checks the status of all the nodes (configurable via the `--node-monitor-period` flag of the `kube-controller`). When a node is unreachable, the node controller will taint that node. When this occurs, Rancher will begin its deletion countdown. You can configure the amount of time Rancher waits to delete the node. If the taint is not removed before the deletion countdown ends, Rancher will proceed to delete the node object. Rancher will then provision a node in accordance with the set quantity of the node pool.
-{{% /accordion %}}
-
-### Enabling Node Auto-replace
-
-When you create the node pool, you can specify the amount of time in minutes that Rancher will wait to replace an unresponsive node.
-
-1. In the form for creating a cluster, go to the **Node Pools** section.
-1. Go to the node pool where you want to enable node auto-replace. In the **Recreate Unreachable After** field, enter the number of minutes that Rancher should wait for a node to respond before replacing the node.
-1. Fill out the rest of the form for creating a cluster.
-
-**Result:** Node auto-replace is enabled for the node pool.
-
-You can also enable node auto-replace after the cluster is created with the following steps:
-
-1. From the Global view, click the Clusters tab.
-1. Go to the cluster where you want to enable node auto-replace, click the vertical &#8942; **(…)**, and click **Edit.**
-1. In the **Node Pools** section, go to the node pool where you want to enable node auto-replace. In the **Recreate Unreachable After** field, enter the number of minutes that Rancher should wait for a node to respond before replacing the node.
-1. Click **Save.**
-
-**Result:** Node auto-replace is enabled for the node pool.
-
-### Disabling Node Auto-replace
-
-You can disable node auto-replace from the Rancher UI with the following steps:
-
-1. From the Global view, click the Clusters tab.
-1. Go to the cluster where you want to enable node auto-replace, click the vertical &#8942; **(…)**, and click **Edit.**
-1. In the **Node Pools** section, go to the node pool where you want to enable node auto-replace. In the **Recreate Unreachable After** field, enter 0.
-1. Click **Save.**
-
-**Result:** Node auto-replace is disabled for the node pool.
-
-# Cloud Credentials
-
-Node templates can use cloud credentials to store credentials for launching nodes in your cloud provider, which has some benefits:
-
-- Credentials are stored as a Kubernetes secret, which is not only more secure, but it also allows you to edit a node template without having to enter your credentials every time.
-
-- After the cloud credential is created, it can be re-used to create additional node templates.
-
-- Multiple node templates can share the same cloud credential to create node pools. If your key is compromised or expired, the cloud credential can be updated in a single place, which allows all node templates that are using it to be updated at once.
-
-> **Note:** As of v2.2.0, the default `active` [node drivers]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/) and any node driver, that has fields marked as `password`, are required to use cloud credentials. If you have upgraded to v2.2.0, existing node templates will continue to work with the previous account access  information, but when you edit the node template, you will be required to create a cloud credential and the node template will start using it.
-
-After cloud credentials are created, the user can start [managing the cloud credentials that they created]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/).
-
-# Node Drivers
-
-If you don't find the node driver that you want to use, you can see if it is available in Rancher's built-in [node drivers and activate it]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/#activating-deactivating-node-drivers), or you can [add your own custom node driver]({{<baseurl>}}/rancher/v2.x/en/admin-settings/drivers/node-drivers/#adding-custom-node-drivers).
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
deleted file mode 100644
index a74cbf61504..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/azure/_index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: Creating an Azure Cluster
-shortTitle: Azure
-weight: 2220
----
-
-Use {{< product >}} to create a Kubernetes cluster in Azure.
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-2. Choose **Azure**.
-
-3. Enter a **Cluster Name**.
-
-4. {{< step_create-cluster_member-roles >}}
-
-5. {{< step_create-cluster_cluster-options >}}
-
-6. {{< step_create-cluster_node-pools >}}
-
-	1.	Click **Add Node Template**.
-
-	2.	Complete the **Azure Options** form.
-
-		- **Account Access** stores your account information for authenticating with Azure. Note: As of v2.2.0, account access information is stored as a cloud credentials. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. To create a new cloud credential, enter **Name** and **Account Access** data, then click **Create.**
-
-		- **Placement** sets the geographical region where your cluster is hosted and other location metadata.
-
-		- **Network** configures the networking used in your cluster.
-
-		- **Instance** customizes your VM configuration.
-
-	3. {{< step_rancher-template >}}
-
-	4. Click **Create**.
-
-	5. **Optional:** Add additional node pools.
-<br>
-7. Review your options to confirm they're correct. Then click **Create**.
-
-{{< result_create-cluster >}}
-
-# Optional Next Steps
-
-After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
-
-- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
-- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
deleted file mode 100644
index 36c912de8ce..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/digital-ocean/_index.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Creating a DigitalOcean Cluster
-shortTitle: DigitalOcean
-weight: 2215
----
-Use {{< product >}} to create a Kubernetes cluster using DigitalOcean.
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-2. Choose **DigitalOcean**.
-
-3. Enter a **Cluster Name**.
-
-4. {{< step_create-cluster_member-roles >}}
-
-5. {{< step_create-cluster_cluster-options >}}
-
-6. {{< step_create-cluster_node-pools >}}
-
-	1.	Click **Add Node Template**. Note: As of v2.2.0, account access information is stored as a cloud credentials. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. To create a new cloud credential, enter **Name** and **Account Access** data, then click **Create.**
-
-	2.  Complete the **Digital Ocean Options** form.
-
-		- **Access Token** stores your DigitalOcean Personal Access Token. Refer to [DigitalOcean Instructions: How To Generate a Personal Access Token](https://www.digitalocean.com/community/tutorials/how-to-use-the-digitalocean-api-v2#how-to-generate-a-personal-access-token).
-
-		- **Droplet Options** provision your cluster's geographical region and specifications.
-
-	4. {{< step_rancher-template >}}
-
-	5. Click **Create**.
-
-	6. **Optional:** Add additional node pools.
-<br/>
-7. Review your options to confirm they're correct. Then click **Create**.
-
-{{< result_create-cluster >}}
-
-# Optional Next Steps
-
-After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
-
-- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
-- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
deleted file mode 100644
index 4754951afde..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/ec2/_index.md
+++ /dev/null
@@ -1,266 +0,0 @@
----
-title: Creating an Amazon EC2 Cluster
-shortTitle: Amazon EC2
-description: Learn the prerequisites and steps required in order for you to create an Amazon EC2 cluster using Rancher
-weight: 2210
----
-Use Rancher to create a Kubernetes cluster in Amazon EC2.
-
-### Prerequisites
-
-- **AWS EC2 Access Key and Secret Key** that will be used to create the instances. See [Amazon Documentation: Creating Access Keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey) how to create an Access Key and Secret Key.
-- **IAM Policy created** to add to the user of the Access Key And Secret Key. See [Amazon Documentation: Creating IAM Policies (Console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html#access_policies_create-start) how to create an IAM policy. See our three example JSON policies below:
-  - [Example IAM Policy](#example-iam-policy)
-  - [Example IAM Policy with PassRole](#example-iam-policy-with-passrole) (needed if you want to use [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers) or want to pass an IAM Profile to an instance)
-  - [Example IAM Policy to allow encrypted EBS volumes](#example-iam-policy-to-allow-encrypted-ebs-volumes)
-- **IAM Policy added as Permission** to the user. See [Amazon Documentation: Adding Permissions to a User (Console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) how to attach it to an user.
-
-# Creating an EC2 Cluster
-
-The steps to create a cluster differ based on your Rancher version.
-
-{{% tabs %}}
-{{% tab "Rancher v2.2.0+" %}}
-
-1. [Create your cloud credentials](#1-create-your-cloud-credentials)
-2. [Create a node template with your cloud credentials and information from EC2](#2-create-a-node-template-with-your-cloud-credentials-and-information-from-ec2)
-3. [Create a cluster with node pools using the node template](#3-create-a-cluster-with-node-pools-using-the-node-template)
-
-### 1. Create your cloud credentials
-
-1. In the Rancher UI, click the user profile button in the upper right corner, and click **Cloud Credentials.**
-1. Click **Add Cloud Credential.**
-1. Enter a name for the cloud credential.
-1. In the **Cloud Credential Type** field, select **Amazon.**
-1. In the **Region** field, select the AWS region where your cluster nodes will be located.
-1. Enter your AWS EC2 **Access Key** and **Secret Key.**
-1. Click **Create.**
-
-**Result:** You have created the cloud credentials that will be used to provision nodes in your cluster. You can reuse these credentials for other node templates, or in other clusters. 
-
-### 2. Create a node template with your cloud credentials and information from EC2
-Complete each of the following forms using information available from the [EC2 Management Console](https://aws.amazon.com/ec2).
-
-1. In the Rancher UI, click the user profile button in the upper right corner, and click **Node Templates.**
-1. Click **Add Template.**
-1. In the **Region** field, select the same region that you used when creating your cloud credentials.
-1. In the **Cloud Credentials** field, select your newly created cloud credentials.
-1. Click **Next: Authenticate & configure nodes.**
-1. Choose an availability zone and network settings for your cluster. Click **Next: Select a Security Group.**
-1. Choose the default security group or configure a security group. Please refer to [Amazon EC2 security group when using Node Driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#security-group-for-nodes-on-aws-ec2) to see what rules are created in the `rancher-nodes` Security Group. Then click **Next: Set Instance options.**
-1. Configure the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI.
-
-> If you need to pass an <b>IAM Instance Profile Name</b> (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example IAM policy with PassRole](#example-iam-policy-with-passrole) for an example policy.
-
-Optional: In the **Engine Options** section of the node template, you can configure the Docker daemon. You may want to specify the docker version or a Docker registry mirror.
-
-### 3. Create a cluster with node pools using the node template
-
-{{< step_create-cluster_node-pools >}}
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-1. Choose **Amazon EC2**.
-
-1. Enter a **Cluster Name**.
-
-1. Create a node pool for each Kubernetes role. For each node pool, choose a node template that you created.
-
-1. Click **Add Member** to add users that can access the cluster.
-
-1. Use the **Role** drop-down to set permissions for each user.
-
-1. Use **Cluster Options** to choose the version of Kubernetes, what network provider will be used and if you want to enable project network isolation. Refer to [Selecting Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) to configure the Kubernetes Cloud Provider.
-
-1. Click **Create**.
-
-{{< result_create-cluster >}}
-{{% /tab %}}
-{{% tab "Rancher prior to v2.2.0+" %}}
-
-1. From the **Clusters** page, click **Add Cluster**.
-
-1. Choose **Amazon EC2**.
-
-1. Enter a **Cluster Name**.
-
-1. {{< step_create-cluster_member-roles >}}
-
-1. {{< step_create-cluster_cluster-options >}}Refer to [Selecting Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) to configure the Kubernetes Cloud Provider.
-
-1. {{< step_create-cluster_node-pools >}}
-
-  1. Click **Add Node Template**.
-
-  1. Complete each of the following forms using information available from the [EC2 Management Console](https://aws.amazon.com/ec2).
-
-	- **Account Access** is where you configure the region of the nodes, and the credentials (Access Key and Secret Key) used to create the machine. See [Prerequisites](#prerequisites) how to create the Access Key and Secret Key and the needed permissions.
-	- **Zone and Network** configures the availability zone and network settings for your cluster.
-	- **Security Groups** creates or configures the Security Groups applied to your nodes. Please refer to [Amazon EC2 security group when using Node Driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#security-group-for-nodes-on-aws-ec2) to see what rules are created in the `rancher-nodes` Security Group.
-	- **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI.
-<br><br>
-	If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example IAM policy with PassRole](#example-iam-policy-with-passrole) for an example policy.
-
-1. {{< step_rancher-template >}}
-1. Click **Create**.
-1. **Optional:** Add additional node pools.
-1. Review your cluster settings to confirm they are correct. Then click **Create**.
-
-{{< result_create-cluster >}}
-{{% /tab %}}
-{{% /tabs %}}
-
-### Optional Next Steps
-
-After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
-
-- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
-- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
-
-### Example IAM Policy
-
-```json
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "VisualEditor0",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:Describe*",
-                "ec2:ImportKeyPair",
-                "ec2:CreateKeyPair",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateTags",
-                "ec2:DeleteKeyPair"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "VisualEditor1",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RunInstances"
-            ],
-            "Resource": [
-                "arn:aws:ec2:REGION::image/ami-*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:placement-group/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:subnet/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:key-pair/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:network-interface/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:security-group/*"
-            ]
-        },
-        {
-            "Sid": "VisualEditor2",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RebootInstances",
-                "ec2:TerminateInstances",
-                "ec2:StartInstances",
-                "ec2:StopInstances"
-            ],
-            "Resource": "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*"
-        }
-    ]
-}
-```
-
-### Example IAM Policy with PassRole
-
-```json
-{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "VisualEditor0",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:AuthorizeSecurityGroupIngress",
-                "ec2:Describe*",
-                "ec2:ImportKeyPair",
-                "ec2:CreateKeyPair",
-                "ec2:CreateSecurityGroup",
-                "ec2:CreateTags",
-                "ec2:DeleteKeyPair"
-            ],
-            "Resource": "*"
-        },
-        {
-            "Sid": "VisualEditor1",
-            "Effect": "Allow",
-            "Action": [
-                "iam:PassRole",
-                "ec2:RunInstances"
-            ],
-            "Resource": [
-                "arn:aws:ec2:REGION::image/ami-*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:placement-group/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:subnet/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:key-pair/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:network-interface/*",
-                "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:security-group/*",
-                "arn:aws:iam::AWS_ACCOUNT_ID:role/YOUR_ROLE_NAME"
-            ]
-        },
-        {
-            "Sid": "VisualEditor2",
-            "Effect": "Allow",
-            "Action": [
-                "ec2:RebootInstances",
-                "ec2:TerminateInstances",
-                "ec2:StartInstances",
-                "ec2:StopInstances"
-            ],
-            "Resource": "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*"
-        }
-    ]
-}
-```
-### Example IAM Policy to allow encrypted EBS volumes
-``` json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "kms:Decrypt",
-        "kms:GenerateDataKeyWithoutPlaintext",
-        "kms:Encrypt",
-        "kms:DescribeKey",
-        "kms:CreateGrant",
-        "ec2:DetachVolume",
-        "ec2:AttachVolume",
-        "ec2:DeleteSnapshot",
-        "ec2:DeleteTags",
-        "ec2:CreateTags",
-        "ec2:CreateVolume",
-        "ec2:DeleteVolume",
-        "ec2:CreateSnapshot"
-      ],
-      "Resource": [
-        "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:volume/*",
-        "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:instance/*",
-        "arn:aws:ec2:REGION:AWS_ACCOUNT_ID:snapshot/*",
-        "arn:aws:kms:REGION:AWS_ACCOUNT_ID:key/KMS_KEY_ID"
-      ]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ec2:DescribeInstances",
-        "ec2:DescribeTags",
-        "ec2:DescribeVolumes",
-        "ec2:DescribeSnapshots"
-      ],
-      "Resource": "*"
-    }
-  ]
-}
-```
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
deleted file mode 100644
index dbc0be0f28e..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Creating a vSphere Cluster
-shortTitle: vSphere
-description: Use Rancher to create a vSphere cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. 
-metaDescription: Use Rancher to create a vSphere cluster. It may consist of groups of VMs with distinct properties which allow for fine-grained control over the sizing of nodes. 
-weight: 2225
----
-
-By using Rancher with vSphere, you can bring cloud operations on-premises.
-
-Rancher can provision nodes in vSphere and install Kubernetes on them. When creating a Kubernetes cluster in vSphere, Rancher first provisions the specified number of virtual machines by communicating with the vCenter API. Then it installs Kubernetes on top of them.
-
-A vSphere cluster may consist of multiple groups of VMs with distinct properties, such as the amount of memory or the number of vCPUs. This grouping allows for fine-grained control over the sizing of nodes for each Kubernetes role.
-
-# vSphere Enhancements  
-
-The vSphere node templates have been updated, allowing you to bring cloud operations on-premises with the following enhancements:
-
-### Self-healing Node Pools
-
-One of the biggest advantages of provisioning vSphere nodes with Rancher is that it allows you to take advantage of Rancher's self-healing node pools, also called the [node auto-replace feature,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-auto-replace) in your on-premises clusters. Self-healing node pools are designed to help you replace worker nodes for stateless applications. When Rancher provisions nodes from a node template, Rancher can automatically replace unreachable nodes.
-
-> **Important:** It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
-
-### Dynamically Populated Options for Instances and Scheduling
-
-Node templates for vSphere have been updated so that when you create a node template with your vSphere credentials, the template is automatically populated with the same options for provisioning VMs that you have access to in the vSphere console.
-
-For the fields to be populated, your setup needs to fulfill the [prerequisites.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/#prerequisites)
-
-### More Supported Operating Systems
-
-In Rancher v2.3.3+, you can provision VMs with any operating system that supports `cloud-init`. Only YAML format is supported for the [cloud config.](https://cloudinit.readthedocs.io/en/latest/topics/examples.html)
-
-In Rancher prior to v2.3.3, the vSphere node driver included in Rancher only supported the provisioning of VMs with [RancherOS]({{<baseurl>}}/os/v1.x/en/) as the guest operating system.
-
-# Video Walkthrough of v2.3.3 Node Template Features
-
-In this YouTube video, we demonstrate how to set up a node template with the new features designed to help you bring cloud operations to on-premises clusters.
-
-{{< youtube id="dPIwg6x1AlU">}}
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
deleted file mode 100644
index ca0b30b396b..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/_index.md
+++ /dev/null
@@ -1,317 +0,0 @@
----
-title: Provisioning Kubernetes Clusters in vSphere
-weight: 1
----
-
-This section explains how to configure Rancher with vSphere credentials, provision nodes in vSphere, and set up Kubernetes clusters on those nodes.
-
-# Prerequisites
-
-This section describes the requirements for setting up vSphere so that Rancher can provision VMs and clusters.
-
-The node templates are documented and tested with the vSphere Web Services API version 6.5.
-
-- [Create credentials in vSphere](#create-credentials-in-vsphere)
-- [Network permissions](#network-permissions)
-- [Valid ESXi License for vSphere API Access](#valid-esxi-license-for-vsphere-api-access)
-
-### Create Credentials in vSphere
-
-Before proceeding to create a cluster, you must ensure that you have a vSphere user with sufficient permissions. When you set up a node template, the template will need to use these vSphere credentials.
-
-Refer to this [how-to guide]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/creating-credentials) for instructions on how to create a user in vSphere with the required permissions. These steps result in a username and password that you will need to provide to Rancher, which allows Rancher to provision resources in vSphere.
-
-### Network Permissions
-
-It must be ensured that the hosts running the Rancher server are able to establish the following network connections:
-
-- To the vSphere API on the vCenter server (usually port 443/TCP).
-- To the Host API (port 443/TCP) on all ESXi hosts used to instantiate virtual machines for the clusters (*only required with Rancher prior to v2.3.3 or when using the ISO creation method in later versions*).
-- To port 22/TCP and 2376/TCP on the created VMs
-
-See [Node Networking Requirements]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements) for a detailed list of port requirements applicable for creating nodes on an infrastructure provider.
-
-### Valid ESXi License for vSphere API Access
-
-The free ESXi license does not support API access. The vSphere servers must have a valid or evaluation ESXi license.
-
-# Creating Clusters in vSphere with Rancher
-
-This section describes how to set up vSphere credentials, node templates, and vSphere clusters using the Rancher UI.
-
-You will need to do the following:
-
-1. [Create a node template using vSphere credentials](#1-create-a-node-template-using-vsphere-credentials)
-2. [Create a Kubernetes cluster using the node template](#2-create-a-kubernetes-cluster-using-the-node-template)
-3. [Optional: Provision storage](#3-optional-provision-storage)
-  - [Enable the vSphere cloud provider for the cluster](#enable-the-vsphere-cloud-provider-for-the-cluster)
-
-### Configuration References
-
-For details on configuring the node template, refer to the [node template configuration reference.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/node-template-reference/)
-
-Rancher uses the RKE library to provision Kubernetes clusters. For details on configuring clusters in vSphere, refer to the [cluster configuration reference in the RKE documentation.]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/)
-
-Note that the vSphere cloud provider must be [enabled](#enable-the-vsphere-cloud-provider-for-the-cluster) to allow dynamic provisioning of volumes.
-
-# 1. Create a Node Template Using vSphere Credentials
-
-To create a cluster, you need to create at least one vSphere [node template]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) that specifies how VMs are created in vSphere.
-
-After you create a node template, it is saved, and you can re-use it whenever you create additional vSphere clusters.
-
-To create a node template,
-
-1. Log in with an administrator account to the Rancher UI.
-
-1. From the user settings menu, select **Node Templates.**
-
-1. Click **Add Template** and then click on the **vSphere** icon.
-
-Then, configure your template:
-
-- [A. Configure the vSphere credential](#a-configure-the-vsphere-credential)
-- [B. Configure node scheduling](#b-configure-node-scheduling)
-- [C. Configure instances and operating systems](#c-configure-instances-and-operating-systems)
-- [D. Add networks](#d-add-networks)
-- [E. If not already enabled, enable disk UUIDs](#e-if-not-already-enabled-enable-disk-uuids)
-- [F. Optional: Configure node tags and custom attributes](#f-optional-configure-node-tags-and-custom-attributes)
-- [G. Optional: Configure cloud-init](#g-optional-configure-cloud-init)
-- [H. Saving the node template](#h-saving-the-node-template)
-
-### A. Configure the vSphere Credential
-
-The steps for configuring your vSphere credentials for the cluster are different depending on your version of Rancher.
-
-{{% tabs %}}
-{{% tab "Rancher v2.2.0+" %}}
-
-Your account access information is in a [cloud credential.]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/) Cloud credentials are stored as Kubernetes secrets. 
-
-You can use an existing cloud credential or create a new one. To create a new cloud credential, 
-
-1. Click **Add New.**
-1. In the **Name** field, enter a name for your vSphere credentials.
-1. In the **vCenter or ESXi Server** field, enter the vCenter or ESXi hostname/IP. ESXi is the virtualization platform where you create and run virtual machines and virtual appliances. vCenter Server is the service through which you manage multiple hosts connected in a network and pool host resources.
-1. Optional: In the **Port** field, configure the port of the vCenter or ESXi server.
-1. In the **Username** and **Password** fields, enter your vSphere login username and password.
-1. Click **Create.**
-
-**Result:** The node template has the credentials required to provision nodes in vSphere.
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.2.0" %}}
-In the **Account Access** section, enter the vCenter FQDN or IP address and the credentials for the vSphere user account.
-{{% /tab %}}
-{{% /tabs %}}
-
-### B. Configure Node Scheduling
-
-Choose what hypervisor the virtual machine will be scheduled to. The configuration options depend on your version of Rancher.
-
-{{% tabs %}}
-{{% tab "Rancher v2.3.3+" %}}
-
-The fields in the **Scheduling** section should auto-populate with the data center and other scheduling options that are available to you in vSphere.
-
-1. In the **Data Center** field, choose the data center where the VM will be scheduled.
-1. Optional: Select a **Resource Pool.** Resource pools can be used to partition available CPU and memory resources of a standalone host or cluster, and they can also be nested.
-1. If you have a data store cluster, you can toggle the **Data Store** field. This lets you select a data store cluster where your VM will be scheduled to. If the field is not toggled, you can select an individual disk.
-1. Optional: Select a folder where the VM will be placed. The VM folders in this dropdown menu directly correspond to your VM folders in vSphere. Note: The folder name should be prefaced with `vm/` in your vSphere config file.
-1. Optional: Choose a specific host to create the VM on. Leave this field blank for a standalone ESXi or for a cluster with DRS (Distributed Resource Scheduler). If specified, the host system's pool will be used and the **Resource Pool** parameter will be ignored.
-{{% /tab %}}
-{{% tab "Rancher prior to v2.3.3" %}}
-
-In the **Scheduling** section, enter: 
-
-- The name/path of the **Data Center** to create the VMs in
-- The name of the **VM Network** to attach to
-- The name/path of the **Datastore** to store the disks in
-
-    {{< img "/img/rancher/vsphere-node-template-2.png" "image" >}}
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### C. Configure Instances and Operating Systems
-
-Depending on the Rancher version there are different options available to configure instances.
-
-{{% tabs %}}
-{{% tab "Rancher v2.3.3+" %}}
-
-In the **Instance Options** section, configure the number of vCPUs, memory, and disk size for the VMs created by this template.
-
-In the **Creation method** field, configure the method used to provision VMs in vSphere. Available options include creating VMs that boot from a RancherOS ISO or creating VMs by cloning from an existing virtual machine or [VM template](https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.vm_admin.doc/GUID-F7BF0E6B-7C4F-4E46-8BBF-76229AEA7220.html).
-
-The existing VM or template may use any modern Linux operating system that is configured with support for [cloud-init](https://cloudinit.readthedocs.io/en/latest/) using the [NoCloud datasource](https://cloudinit.readthedocs.io/en/latest/topics/datasources/nocloud.html).
-
-Choose the way that the VM will be created:
-
-- **Deploy from template: Data Center:** Choose a VM template that exists in the data center that you selected.
-- **Deploy from template: Content Library:** First, select the [Content Library](https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.vm_admin.doc/GUID-254B2CE8-20A8-43F0-90E8-3F6776C2C896.html) that contains your template, then select the template from the populated list `Library templates`.
-- **Clone an existing virtual machine:** In the **Virtual machine** field, choose an existing VM that the new VM will be cloned from.
-- **Install from boot2docker ISO:** Ensure that the `OS ISO URL` field contains the URL of a VMware ISO release for RancherOS (rancheros-vmware.iso). Note that this URL must be accessible from the nodes running your Rancher server installation.
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.3.3" %}}
-
-In the **Instance Options** section, configure the number of vCPUs, memory, and disk size for the VMs created by this template.
-
-Only VMs booting from RancherOS ISO are supported.
-
-Ensure that the [OS ISO URL](#instance-options) contains the URL of the VMware ISO release for RancherOS: `rancheros-vmware.iso`.
-
-    ![image]({{<baseurl>}}/img/rancher/vsphere-node-template-1.png)
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### D. Add Networks
-
-The node template now allows a VM to be provisioned with multiple networks. In the **Networks** field, you can now click **Add Network** to add any networks available to you in vSphere.
-
-### E. If Not Already Enabled, Enable Disk UUIDs
-
-In order to provision nodes with RKE, all nodes must be configured with disk UUIDs.
-
-As of Rancher v2.0.4, disk UUIDs are enabled in vSphere node templates by default.
-
-If you are using Rancher prior to v2.0.4, refer to these [instructions]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/#enabling-disk-uuids-with-a-node-template) for details on how to enable a UUID with a Rancher node template.
-
-### F. Optional: Configure Node Tags and Custom Attributes
-
-The way to attach metadata to the VM is different depending on your Rancher version.
-
-{{% tabs %}}
-{{% tab "Rancher v2.3.3+" %}}
-
-**Optional:** Add vSphere tags and custom attributes. Tags allow you to attach metadata to objects in the vSphere inventory to make it easier to sort and search for these objects.
-
-For tags, all your vSphere tags will show up as options to select from in your node template.
-
-In the custom attributes, Rancher will let you select all the custom attributes you have already set up in vSphere. The custom attributes are keys and you can enter values for each one.
-
- > **Note:** Custom attributes are a legacy feature that will eventually be removed from vSphere. These attributes allow you to attach metadata to objects in the vSphere inventory to make it easier to sort and search for these objects.
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.3.3" %}}
-
-**Optional:**
-
-  - Provide a set of configuration parameters (instance-options) for the VMs.
-  - Assign labels to the VMs that can be used as a base for scheduling rules in the cluster.
-  - Customize the configuration of the Docker daemon on the VMs that will be created.
-
-> **Note:** Custom attributes are a legacy feature that will eventually be removed from vSphere. These attributes allow you to attach metadata to objects in the vSphere inventory to make it easier to sort and search for these objects.
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### G. Optional: Configure cloud-init
-
-[Cloud-init](https://cloudinit.readthedocs.io/en/latest/) allows you to initialize your nodes by applying configuration on the first boot. This may involve things such as creating users, authorizing SSH keys or setting up the network.
-
-The scope of cloud-init support for the VMs differs depending on the Rancher version.
-
-{{% tabs %}}
-{{% tab "Rancher v2.3.3+" %}}
-
-To make use of cloud-init initialization, create a cloud config file using valid YAML syntax and paste the file content in the the **Cloud Init** field. Refer to the [cloud-init documentation.](https://cloudinit.readthedocs.io/en/latest/topics/examples.html) for a commented set of examples of supported cloud config directives.
-
-*Note that cloud-init is not supported when using the ISO creation method.*
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.3.3" %}}
-
-You may specify the URL of a RancherOS cloud-config.yaml file in the the **Cloud Init** field. Refer to the [RancherOS Documentation]https://rancher.com/docs/os/v1.x/en/configuration/#cloud-config) for details on the supported configuration directives. Note that the URL must be network accessible from the VMs created by the template.
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### H. Saving the Node Template
-
-Assign a descriptive **Name** for this template and click **Create.**
-
-### Node Template Configuration Reference
-
-Refer to [this section]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/node-template-reference/) for a reference on the configuration options available for vSphere node templates.
-
-# 2. Create a Kubernetes Cluster Using the Node Template
-
-After you've created a template, you can use it to stand up the vSphere cluster itself.
-
-To install Kubernetes on vSphere nodes, you will need to enable the vSphere cloud provider by modifying the cluster YAML file. This requirement applies to both pre-created [custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/) and for nodes created in Rancher using the vSphere node driver.
-
-To create the cluster and enable the vSphere provider for cluster, follow these steps:
-
-- [A. Set up the cluster name and member roles](#a-set-up-the-cluster-name-and-member-roles)
-- [B. Configure Kubernetes options](#b-configure-kubernetes-options)
-- [C. Add node pools to the cluster](#c-add-node-pools-to-the-cluster)
-- [D. Optional: Add a self-healing node pool](#d-optional-add-a-self-healing-node-pool)
-- [E. Create the cluster](#e-create-the-cluster)
-
-### A. Set up the Cluster Name and Member Roles
-
-1. Log in to the Rancher UI as an administrator.
-2. Navigate to **Clusters** in the **Global** view.
-3. Click **Add Cluster** and select the **vSphere** infrastructure provider.
-4. Assign a **Cluster Name.**
-5. Assign **Member Roles** as required. {{< step_create-cluster_member-roles >}}
-
-> **Note:**
-> 
-> If you have a cluster with DRS enabled, setting up [VM-VM Affinity Rules](https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.resmgmt.doc/GUID-7297C302-378F-4AF2-9BD6-6EDB1E0A850A.html) is recommended. These rules allow VMs assigned the etcd and control-plane roles to operate on separate ESXi hosts when they are assigned to different node pools. This practice ensures that the failure of a single physical machine does not affect the availability of those planes.
-
-
-### B. Configure Kubernetes Options
-{{<step_create-cluster_cluster-options>}}
-
-### C. Add Node Pools to the Cluster
-{{<step_create-cluster_node-pools>}}
-
-### D. Optional: Add a Self-Healing Node Pool
-
-To make a node pool self-healing, enter a number greater than zero in the **Auto Replace** column. Rancher will use the node template for the given node pool to recreate the node if it becomes inactive for that number of minutes.
-
-> **Note:** Self-healing node pools are designed to help you replace worker nodes for stateless applications. It is not recommended to enable node auto-replace on a node pool of master nodes or nodes with persistent volumes attached, because VMs are treated ephemerally. When a node in a node pool loses connectivity with the cluster, its persistent volumes are destroyed, resulting in data loss for stateful applications.
-
-### E. Create the Cluster
-
-Click **Create** to start provisioning the VMs and Kubernetes services.
-
-{{< result_create-cluster >}}
-
-# 3. Optional: Provision Storage
-
-For an example of how to provision storage in vSphere using Rancher, refer to the 
- [cluster administration section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/examples/vsphere)
-
- In order to provision storage in vSphere, the vSphere provider must be enabled.
-
-### Enable the vSphere Cloud Provider for the Cluster
-
-1. Set **Cloud Provider** option to `Custom`.
-
-    {{< img "/img/rancher/vsphere-node-driver-cloudprovider.png" "vsphere-node-driver-cloudprovider">}}
-
-1. Click on **Edit as YAML**
-1. Insert the following structure to the pre-populated cluster YAML. As of Rancher v2.3+, this structure must be placed under `rancher_kubernetes_engine_config`. In versions prior to v2.3, it has to be defined as a top-level field. Note that the `name` *must* be set to `vsphere`. 
-
-    ```yaml
-    rancher_kubernetes_engine_config: # Required as of Rancher v2.3+
-      cloud_provider:
-          name: vsphere
-          vsphereCloudProvider:
-              [Insert provider configuration]
-    ```
-
-    Rancher uses RKE (the Rancher Kubernetes Engine) to provision Kubernetes clusters. Refer to the [vSphere configuration reference in the RKE documentation]({{<baseurl>}}/rke/latest/en/config-options/cloud-providers/vsphere/config-reference/) for details about the properties of the `vsphereCloudProvider` directive.
-
-
-# Optional Next Steps
-
-After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
-
-- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
-- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through Rancher. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
deleted file mode 100644
index 9c5bc71a0e2..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/creating-credentials/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Creating Credentials in the vSphere Console
-weight: 1
----
-
-This section describes how to create a vSphere username and password. You will need to provide these vSphere credentials to Rancher, which allows Rancher to provision resources in vSphere.
-
-The following table lists the permissions required for the vSphere user account:
-
-| Privilege Group       | Operations  |
-|:----------------------|:-----------------------------------------------------------------------|
-| Datastore             | AllocateSpace </br> Browse </br> FileManagement (Low level file operations) </br> UpdateVirtualMachineFiles </br> UpdateVirtualMachineMetadata |
-| Network               | Assign |
-| Resource              | AssignVMToPool |
-| Virtual Machine       | Config (All) </br> GuestOperations (All) </br> Interact (All) </br> Inventory (All) </br> Provisioning (All) |
-
-The following steps create a role with the required privileges and then assign it to a new user in the vSphere console:
-
-1. From the **vSphere** console, go to the **Administration** page.
-
-2. Go to the **Roles** tab.
-
-3. Create a new role.  Give it a name and select the privileges listed in the permissions table above.
-
-    {{< img "/img/rancher/rancherroles1.png" "image" >}}
-
-4. Go to the **Users and Groups** tab.
-
-5. Create a new user. Fill out the form and then click **OK**. Make sure to note the username and password, because you will need it when configuring node templates in Rancher.
-
-    {{< img "/img/rancher/rancheruser.png" "image" >}}
-
-6. Go to the **Global Permissions** tab.
-
-7. Create a new Global Permission. Add the user you created earlier and assign it the role you created earlier. Click **OK**.
-
-    {{< img "/img/rancher/globalpermissionuser.png" "image" >}}
-    
-    {{< img "/img/rancher/globalpermissionrole.png" "image" >}}
-
-**Result:** You now have credentials that Rancher can use to manipulate vSphere resources.
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
deleted file mode 100644
index 2388ad4e8ad..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/enabling-uuids/_index.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-title: Enabling Disk UUIDs in Node Templates
-weight: 3
----
-
-As of Rancher v2.0.4, disk UUIDs are enabled in vSphere node templates by default.
-
-For Rancher prior to v2.0.4, we recommend configuring a vSphere node template to automatically enable disk UUIDs because they are required for Rancher to manipulate vSphere resources.
-
-To enable disk UUIDs for all VMs created for a cluster,
-
-1. Navigate to the **Node Templates** in the Rancher UI while logged in as an administrator.
-
-2. Add or edit an existing vSphere node template.
-
-3. Under **Instance Options** click on **Add Parameter**.
-
-4. Enter `disk.enableUUID` as key with a value of **TRUE**.
-
-    {{< img "/img/rke/vsphere-nodedriver-enable-uuid.png" "vsphere-nodedriver-enable-uuid" >}}
-
-5. Click **Create** or **Save**.
-
-**Result:** The disk UUID is enabled in the vSphere node template.
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
deleted file mode 100644
index adf7cdbe8d4..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/infrastructure-provider/vsphere/provisioning-vsphere-clusters/node-template-reference/_index.md
+++ /dev/null
@@ -1,93 +0,0 @@
----
-title: vSphere Node Template Configuration Reference
-weight: 4
----
-
-The tables below describe the configuration options available in the vSphere node template:
-
-- [Account access](#account-access)
-- [Instance options](#instance-options)
-- [Scheduling options](#scheduling-options)
-
-# Account Access
-
-The account access parameters are different based on the Rancher version.
-
-{{% tabs %}}
-{{% tab "Rancher v2.2.0+" %}}
-
-| Parameter                | Required | Description |
-|:----------------------|:--------:|:-----|
-| Cloud Credentials   |   *      | Your vSphere account access information, stored in a [cloud credential.]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/)  |
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.2.0" %}}
-
-| Parameter                | Required | Description |
-|:------------------------|:--------:|:------------------------------------------------------------|
-| vCenter or ESXi Server   |   *      | IP or FQDN of the vCenter or ESXi server used for managing VMs. |
-| Port                     |   *      | Port to use when connecting to the server. Defaults to `443`.  |
-| Username                 |   *      | vCenter/ESXi user to authenticate with the server. |
-| Password                 |   *      | User's password. |
-
-{{% /tab %}}
-{{% /tabs %}}
-
-# Instance Options
-
-The options for creating and configuring an instance are different depending on your Rancher version.
-
-{{% tabs %}}
-{{% tab "Rancher v2.3.3+" %}}
-
-| Parameter                | Required | Description |
-|:----------------|:--------:|:-----------|
-| CPUs                     |   *      | Number of vCPUS to assign to VMs. |
-| Memory                   |   *      | Amount of memory to assign to VMs.  |
-| Disk                     |   *      | Size of the disk (in MB) to attach to the VMs. |
-| Creation method | * | The method for setting up an operating system on the node. The operating system can be installed from an ISO or from a VM template. Depending on the creation method, you will also have to specify a VM template, content library, existing VM, or ISO. For more information on creation methods, refer to the section on [configuring instances.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/#c-configure-instances-and-operating-systems) |
-| Cloud Init               |          | URL of a `cloud-config.yml` file or URL to provision VMs with. This file allows further customization of the operating system, such as network configuration, DNS servers, or system daemons. The operating system must support `cloud-init`. |
-| Networks | | Name(s) of the network to attach the VM to. |
-| Configuration Parameters used for guestinfo |          | Additional configuration parameters for the VMs. These correspond to the [Advanced Settings](https://kb.vmware.com/s/article/1016098) in the vSphere console. Example use cases include providing RancherOS [guestinfo]({{< baseurl >}}/os/v1.x/en/installation/cloud/vmware-esxi/#vmware-guestinfo) parameters or enabling disk UUIDs for the VMs (`disk.EnableUUID=TRUE`). |
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.3.3" %}}
-
-| Parameter                | Required | Description |
-|:------------------------|:--------:|:------------------------------------------------------------|
-| CPUs                     |   *      | Number of vCPUS to assign to VMs. |
-| Memory                   |   *      | Amount of memory to assign to VMs.  |
-| Disk                     |   *      | Size of the disk (in MB) to attach to the VMs. |
-| Cloud Init               |          | URL of a [RancherOS cloud-config]({{< baseurl >}}/os/v1.x/en/configuration/) file to provision VMs with. This file allows further customization of the RancherOS operating system, such as network configuration, DNS servers, or system daemons.|
-| OS ISO URL               |   *      | URL of a RancherOS vSphere ISO file to boot the VMs from. You can find URLs for specific versions in the [Rancher OS GitHub Repo](https://github.com/rancher/os). |
-| Configuration Parameters |          | Additional configuration parameters for the VMs. These correspond to the [Advanced Settings](https://kb.vmware.com/s/article/1016098) in the vSphere console. Example use cases include providing RancherOS [guestinfo]({{< baseurl >}}/os/v1.x/en/installation/cloud/vmware-esxi/#vmware-guestinfo) parameters or enabling disk UUIDs for the VMs (`disk.EnableUUID=TRUE`). |
-
-{{% /tab %}}
-{{% /tabs %}}
-
-# Scheduling Options
-The options for scheduling VMs to a hypervisor are different depending on your Rancher version.
-{{% tabs %}}
-{{% tab "Rancher v2.3.3+" %}}
-
-| Parameter                | Required | Description |
-|:------------------------|:--------:|:-------|
-| Data Center              |   *      | Name/path of the datacenter to create VMs in.          |
-| Resource Pool                     |          | Name of the resource pool to schedule the VMs in. Leave blank for standalone ESXi. If not specified, the default resource pool is used.  |
-| Data Store               |   *      | If you have a data store cluster, you can toggle the **Data Store** field. This lets you select a data store cluster where your VM will be scheduled to. If the field is not toggled, you can select an individual disk. |
-| Folder                   |          | Name of a folder in the datacenter to create the VMs in. Must already exist. The folder name should be prefaced with `vm/` in your vSphere config file. |
-| Host                     |          | The IP of the host system to schedule VMs in. If specified, the host system's pool will be used and the *Pool* parameter will be ignored. |
-
-{{% /tab %}}
-{{% tab "Rancher prior to v2.3.3" %}}
-
-| Parameter                | Required | Description |
-|:------------------------|:--------:|:------------------------------------------------------------|
-| Data Center              |   *      | Name/path of the datacenter to create VMs in.          |
-| Pool                     |          | Name/path of the resource pool to schedule the VMs in. If not specified, the default resource pool is used.  |
-| Host                     |          | Name/path of the host system to schedule VMs in. If specified, the host system's pool will be used and the *Pool* parameter will be ignored. |
-| Network                  |   *      | Name of the VM network to attach VMs to. |
-| Data Store               |   *      | Datastore to store the VM disks. |
-| Folder                   |          | Name of a folder in the datacenter to create the VMs in. Must already exist. The folder name should be prefaced with `vm/` in your vSphere config file. |
-{{% /tab %}}
-{{% /tabs %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
deleted file mode 100644
index 36fca204d9f..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/node-requirements/_index.md
+++ /dev/null
@@ -1,184 +0,0 @@
----
-title: Node Requirements for Rancher Managed Clusters
-weight: 1
----
-
-This page describes the requirements for the nodes where your apps and services will be installed.
-
-In this section, "user cluster" refers to a cluster running your apps, which should be separate from the cluster (or single node) running Rancher.
-
-> If Rancher is installed on a high-availability Kubernetes cluster, the Rancher server cluster and user clusters have different requirements. For Rancher installation requirements, refer to the node requirements in the [installation section.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-Make sure the nodes for the Rancher server fulfill the following requirements:
-
-- [Operating systems and container runtime requirements](#operating-systems-and-container-runtime-requirements)
-- [Hardware Requirements](#hardware-requirements)
-- [Networking Requirements](#networking-requirements)
-- [Optional: Security Considerations](#optional-security-considerations)
-
-# Operating Systems and Docker Requirements
-
-Rancher should work with any modern Linux distribution and any modern Docker version. Linux is required for the etcd and controlplane nodes of all downstream clusters. Worker nodes may run Linux or [Windows Server.](#requirements-for-windows-nodes) The capability to use Windows worker nodes in downstream clusters was added in Rancher v2.3.0.
-
-Rancher works has been tested and is supported with downstream clusters running Ubuntu, CentOS, Oracle Linux, RancherOS, and RedHat Enterprise Linux. For details on which OS and Docker versions were tested with each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/)
-
-All supported operating systems are 64-bit x86.
-
-If you plan to use ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/rancher/v2.x/en/installation/options/arm64-platform/)
-
-For information on how to install Docker, refer to the official [Docker documentation.](https://docs.docker.com/)
-
-Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm. This [how-to guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/firewall) shows how to check the default firewall rules and how to open the ports with `firewalld` if necessary.
-
-SUSE Linux may have a firewall that blocks all ports by default. In that situation, follow [these steps](#opening-suse-linux-ports) to open the ports needed for adding a host to a custom cluster.
-
-### Requirements for Windows Nodes
-
-_Windows worker nodes can be used as of Rancher v2.3.0_
-
-Nodes with Windows Server must run Docker Enterprise Edition.
-
-Windows nodes can be used for worker nodes only. See [Configuring Custom Clusters for Windows]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/)
-
-# Hardware Requirements
-
-The hardware requirements for nodes with the `worker` role mostly depend on your workloads. The minimum to run the Kubernetes node components is 1 CPU (core) and 1GB of memory.
-
-Regarding CPU and memory, it is recommended that the different planes of Kubernetes clusters (etcd, controlplane, and workers) should be hosted on different nodes so that they can scale separately from each other.
-
-For hardware recommendations for large Kubernetes clusters, refer to the official Kubernetes documentation on [building large clusters.](https://kubernetes.io/docs/setup/best-practices/cluster-large/)
-
-For hardware recommendations for etcd clusters in production, refer to the official [etcd documentation.](https://etcd.io/docs/v3.4.0/op-guide/hardware/)
-
-# Networking Requirements
-
-For a production cluster, we recommend that you restrict traffic by opening only the ports defined in the port requirements below.
-
-The ports required to be open are different depending on how the user cluster is launched. Each of the sections below list the ports that need to be opened for different [cluster creation options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-options).
-
-For a breakdown of the port requirements for etcd nodes, controlplane nodes, and worker nodes in a Kubernetes cluster, refer to the [port requirements for the Rancher Kubernetes Engine.]({{<baseurl>}}/rke/latest/en/os/#ports)
-
-Details on which ports are used in each situation are found in the following sections:
-
-- [Commonly used ports](#commonly-used-ports)
-- [Port requirements for custom clusters](#port-requirements-for-custom-clusters)
-- [Port requirements for clusters hosted by an infrastructure provider](#port-requirements-for-clusters-hosted-by-an-infrastructure-provider)
-  - [Security group for nodes on AWS EC2](#security-group-for-nodes-on-aws-ec2)
-- [Port requirements for clusters hosted by a Kubernetes provider](#port-requirements-for-clusters-hosted-by-a-kubernetes-provider)
-- [Port requirements for imported clusters](#port-requirements-for-imported-clusters)
-- [Port requirements for local traffic](#port-requirements-for-local-traffic)
-
-### Commonly Used Ports
-
-If security isn't a large concern and you're okay with opening a few additional ports, you can use this table as your port reference instead of the comprehensive tables in the following sections.
-
-These ports are typically opened on your Kubernetes nodes, regardless of what type of cluster it is.
-
-<figcaption>Commonly Used Ports Reference</figcaption>
-
-| Protocol 	|       Port       	| Description                                     	|
-|:--------:	|:----------------:	|-------------------------------------------------	|
-|    TCP   	|        22        	| Node driver SSH provisioning                    	|
-|    TCP   	|       2376       	| Node driver Docker daemon TLS port              	|
-|    TCP   	|       2379       	| etcd client requests                           	|
-|    TCP   	|       2380       	| etcd peer communication                         	|
-|    UDP   	|       8472       	| Canal/Flannel VXLAN overlay networking          	|
-|    UDP   	|       4789       	| Flannel VXLAN overlay networking on Windows cluster |
-|    TCP   	|       9099       	| Canal/Flannel livenessProbe/readinessProbe      	|
-|    TCP   	|       6783       	| Weave Port      	|
-|    UDP   	|       6783-6784   | Weave UDP Ports      	|
-|    TCP   	|       10250      	| kubelet API                                     	|
-|    TCP   	|       10254      	| Ingress controller livenessProbe/readinessProbe 	|
-| TCP/UDP  	| 30000-</br>32767 	| NodePort port range                             	|
-
-### Port Requirements for Custom Clusters
-
-If you are launching a Kubernetes cluster on your existing infrastructure, refer to these port requirements.
-
-The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with [custom nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/).
-
-{{< ports-custom-nodes >}}
-
-### Port Requirements for Clusters Hosted by an Infrastructure Provider
-
-If you are launching a Kubernetes cluster on nodes that are in an infrastructure provider such as Amazon EC2, Google Container Engine, DigitalOcean, Azure, or vSphere, these port requirements apply.
-
-These required ports are automatically opened by Rancher during creation of clusters using cloud providers.
-
-The following table depicts the port requirements for [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) with nodes created in an [Infrastructure Provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/).
-
->**Note:**
->The required ports are automatically opened by Rancher during creation of clusters in cloud providers like Amazon EC2 or DigitalOcean.
-
-{{< ports-iaas-nodes >}}
-
-#### Security Group for Nodes on AWS EC2
-
-When using the [AWS EC2 node driver]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/) to provision cluster nodes in Rancher, you can choose to let Rancher create a security group called `rancher-nodes`. The following rules are automatically added to this security group.
-
-|       Type      | Protocol |  Port Range | Source/Destination     | Rule Type |
-|-----------------|:--------:|:-----------:|------------------------|:---------:|
-|       SSH       |    TCP   | 22          | 0.0.0.0/0              | Inbound   |
-|       HTTP      |    TCP   | 80          | 0.0.0.0/0              | Inbound   |
-| Custom TCP Rule |    TCP   | 443         | 0.0.0.0/0              | Inbound   |
-| Custom TCP Rule |    TCP   | 2376        | 0.0.0.0/0              | Inbound   |
-| Custom TCP Rule |    TCP   | 2379-2380   | sg-xxx (rancher-nodes) | Inbound   |
-| Custom UDP Rule |    UDP   | 4789        | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 6443        | 0.0.0.0/0              | Inbound   |
-| Custom UDP Rule |    UDP   | 8472        | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 10250-10252 | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 10256       | sg-xxx (rancher-nodes) | Inbound   |
-| Custom TCP Rule |    TCP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
-| Custom UDP Rule |    UDP   | 30000-32767 | 0.0.0.0/0            | Inbound   |
-| All traffic     |    All   | All         | 0.0.0.0/0              | Outbound  |
-
-### Port Requirements for Clusters Hosted by a Kubernetes Provider
-
-If you are launching a cluster with a [hosted Kubernetes provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters). such as Google Kubernetes Engine, Amazon EKS, or Azure Kubernetes Service, refer to these port requirements.
-
-{{< ports-imported-hosted >}}
-
-
-### Port Requirements for Imported Clusters
-
-The following table depicts the port requirements for [imported clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/).
-
-{{< ports-imported-hosted >}}
-
-
-### Port Requirements for Local Traffic
-
-Ports marked as `local traffic` (i.e., `9099 TCP`) in the port requirements are used for Kubernetes healthchecks (`livenessProbe` and`readinessProbe`).
-These healthchecks are executed on the node itself. In most cloud environments, this local traffic is allowed by default.
-
-However, this traffic may be blocked when:
-
-- You have applied strict host firewall policies on the node.
-- You are using nodes that have multiple interfaces (multihomed).
-
-In these cases, you have to explicitly allow this traffic in your host firewall, or in case of public/private cloud hosted machines (i.e. AWS or OpenStack), in your security group configuration. Keep in mind that when using a security group as source or destination in your security group, explicitly opening ports only applies to the private interface of the nodes/instances.
-
-# Optional: Security Considerations
-
-If you want to provision a Kubernetes cluster that is compliant with the CIS (Center for Internet Security) Kubernetes Benchmark, we recommend to following our hardening guide to configure your nodes before installing Kubernetes.
-
-For more information on the hardening guide and details on which version of the guide corresponds to your Rancher and Kubernetes versions, refer to the [security section.]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide)
-
-# Opening SUSE Linux Ports
-
-SUSE Linux may have a firewall that blocks all ports by default. To open the ports needed for adding the host to a custom cluster,
-
-1. SSH into the instance.
-1. Edit /`etc/sysconfig/SuSEfirewall2` and open the required ports. In this example, ports 9796 and 10250 are also opened for monitoring:
-  ```
-  FW_SERVICES_EXT_TCP="22 80 443 2376 2379 2380 6443 9099 9796 10250 10254 30000:32767"
-  FW_SERVICES_EXT_UDP="8472 30000:32767"
-  FW_ROUTE=yes
-  ```
-1. Restart the firewall with the new ports:
-  ```
-  SuSEfirewall2
-  ```
-
-**Result:** The node has the open ports required to be added to a custom cluster.
-
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
deleted file mode 100644
index 9fdc10e9ff6..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/rancher-agents/_index.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-title: Rancher Agents
-weight: 6
----
-
-There are two different agent resources deployed on Rancher managed clusters:
-
-- [cattle-cluster-agent](#cattle-cluster-agent)
-- [cattle-node-agent](#cattle-node-agent)
-
-For a conceptual overview of how the Rancher server provisions clusters and communicates with them, refer to the [architecture]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/)
-
-### cattle-cluster-agent
-
-The `cattle-cluster-agent` is used to connect to the Kubernetes API of [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters. The `cattle-cluster-agent` is deployed using a Deployment resource.
-
-### cattle-node-agent
-
-The `cattle-node-agent` is used to interact with nodes in a [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) cluster when performing cluster operations. Examples of cluster operations are upgrading Kubernetes version and creating/restoring etcd snapshots. The `cattle-node-agent` is deployed using a DaemonSet resource to make sure it runs on every node. The `cattle-node-agent` is used as fallback option to connect to the Kubernetes API of [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters when `cattle-cluster-agent` is unavailable.
-
-> **Note:** In Rancher v2.2.4 and lower, the `cattle-node-agent` pods did not tolerate all taints, causing Kubernetes upgrades to fail on these nodes. The fix for this has been included in Rancher v2.2.5 and higher.
-
-### Scheduling rules
-
-_Applies to v2.3.0 and higher_
-
-| Component              | nodeAffinity nodeSelectorTerms             | nodeSelector | Tolerations                                                                    |
-| ---------------------- | ------------------------------------------ | ------------ | ------------------------------------------------------------------------------ |
-| `cattle-cluster-agent` | `beta.kubernetes.io/os:NotIn:windows`      | none         | `operator:Exists`                                                              |
-| `cattle-node-agent`    | `beta.kubernetes.io/os:NotIn:windows`      | none         | `operator:Exists`                                                              |
-
-The `cattle-cluster-agent` Deployment has preferred scheduling rules using `requiredDuringSchedulingIgnoredDuringExecution`, favoring to be scheduled on nodes with the `controlplane` node. See [Kubernetes: Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) to find more information about scheduling rules.
-
-The `requiredDuringSchedulingIgnoredDuringExecution` configuration is shown in the table below:
-
-| Weight | Expression                                       |
-| ------ | ------------------------------------------------ |
-| 100    | `node-role.kubernetes.io/controlplane:In:"true"` |
-| 1      | `node-role.kubernetes.io/etcd:In:"true"`         |
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
deleted file mode 100644
index 434407c8b9b..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/_index.md
+++ /dev/null
@@ -1,282 +0,0 @@
----
-title: Launching Kubernetes on Windows Clusters
-weight: 4
----
-
-When provisioning a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes) using Rancher, Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes custom cluster on your existing infrastructure.
-
-You can use a mix of Linux and Windows hosts as your cluster nodes. Windows nodes can only be used for deploying workloads, while Linux nodes are required for cluster management.
-
-You can only add Windows nodes to a cluster if Windows support is enabled. Windows support can be enabled for new custom clusters that use Kubernetes 1.15+ and the Flannel network provider. Windows support cannot be enabled for existing clusters.
-
-> Windows clusters have more requirements than Linux clusters. For example, Windows nodes must have 50 GB of disk space. Make sure your Windows cluster fulfills all of the [requirements.](#requirements-for-windows-clusters)
-
-For a summary of Kubernetes features supported in Windows, see the Kubernetes documentation on [supported functionality and limitations for using Kubernetes with Windows](https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#supported-functionality-and-limitations) or the [guide for scheduling Windows containers in Kubernetes](https://kubernetes.io/docs/setup/production-environment/windows/user-guide-windows-containers/).
-
-This guide covers the following topics:
-
-<!-- TOC -->
-
-- [Requirements](#requirements-for-windows-clusters)
-  - [OS and Docker](#os-and-docker-requirements)
-  - [Nodes](#node-requirements)
-  - [Networking](#networking-requirements)
-  - [Architecture](#architecture-requirements)
-  - [Containers](#container-requirements)
-  - [Cloud Providers](#cloud-providers)
-- [Tutorial: How to Create a Cluster with Windows Support](#tutorial-how-to-create-a-cluster-with-windows-support)
-- [Configuration for Storage Classes in Azure](#configuration-for-storage-classes-in-azure)
-  <!-- /TOC -->
-
-# Requirements for Windows Clusters
-
-For a custom cluster, the general node requirements for networking, operating systems, and Docker are the same as the node requirements for a [Rancher installation]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/).
-
-### OS and Docker Requirements
-
-In order to add Windows worker nodes to a cluster, the node must be running one of the following Windows Server versions and the corresponding version of Docker Engine - Enterprise Edition (EE):
-
-- Nodes with Windows Server core version 1809 should use Docker EE-basic 18.09 or Docker EE-basic 19.03.
-- Nodes with Windows Server core version 1903 should use Docker EE-basic 19.03.
-
-> **Notes:**
->
-> - If you are using AWS, Rancher recommends _Microsoft Windows Server 2019 Base with Containers_ as the Amazon Machine Image (AMI).
-> - If you are using GCE, Rancher recommends _Windows Server 2019 Datacenter for Containers_ as the OS image.
-
-### Node Requirements
-
-The hosts in the cluster need to have at least:
-
-- 2 core CPUs
-- 5 GB memory
-- 50 GB disk space
-
-Rancher will not provision the node if the node does not meet these requirements.
-
-### Networking Requirements
-
-Before provisioning a new cluster, be sure that you have already installed Rancher on a device that accepts inbound network traffic. This is required in order for the cluster nodes to communicate with Rancher. If you have not already installed Rancher, please refer to the [installation documentation]({{<baseurl>}}/rancher/v2.x/en/installation/) before proceeding with this guide.
-
-Rancher only supports Windows using Flannel as the network provider.
-
-There are two network options: [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) and [**VXLAN (Overlay)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). The default option is **VXLAN (Overlay)** mode.
-
-For **Host Gateway (L2bridge)** networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. For details, refer to the [documentation on configuring cloud-hosted VM routes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#cloud-hosted-vm-routes-configuration) You will also need to [disable private IP address checks]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#disabling-private-ip-address-checks) if you are using Amazon EC2, Google GCE, or Azure VM.
-
-For **VXLAN (Overlay)** networking, the [KB4489899](https://support.microsoft.com/en-us/help/4489899) hotfix must be installed. Most cloud-hosted VMs already have this hotfix.
-
-### Architecture Requirements
-
-The Kubernetes cluster management nodes (`etcd` and `controlplane`) must be run on Linux nodes.
-
-The `worker` nodes, which is where your workloads will be deployed on, will typically be Windows nodes, but there must be at least one `worker` node that is run on Linux in order to run the Rancher cluster agent, DNS, metrics server, and Ingress related containers.
-
-We recommend the minimum three-node architecture listed in the table below, but you can always add additional Linux and Windows workers to scale up your cluster for redundancy:
-
-<a id="guide-architecture"></a>
-
-| Node   | Operating System                                    | Kubernetes Cluster Role(s)                                                                                                                                                                                                                         | Purpose                                                                             |
-| ------ | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
-| Node 1 | Linux (Ubuntu Server 18.04 recommended)             | [Control Plane]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#control-plane-nodes), [etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#etcd-nodes), [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) | Manage the Kubernetes cluster                                                       |
-| Node 2 | Linux (Ubuntu Server 18.04 recommended)             | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)                                                                                                                                                                       | Support the Rancher Cluster agent, Metrics server, DNS, and Ingress for the cluster |
-| Node 3 | Windows (Windows Server core version 1809 or above) | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)                                                                                                                                                                       | Run your Windows containers                                                         |
-
-### Container Requirements
-
-Windows requires that containers must be built on the same Windows Server version that they are being deployed on. Therefore, containers must be built on Windows Server core version 1809 or above. If you have existing containers built for an earlier Windows Server core version, they must be re-built on Windows Server core version 1809 or above.
-
-### Cloud Providers
-
-If you set a Kubernetes cloud provider in your cluster, some additional steps are required. You might want to set a cloud provider if you want to want to leverage a cloud provider's capabilities, for example, to automatically provision storage, load balancers, or other infrastructure for your cluster. Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) for details on how to configure a cloud provider cluster of nodes that meet the prerequisites.
-
-If you are using the GCE (Google Compute Engine) cloud provider, you must do the following:
-
-- Enable the GCE cloud provider in the `cluster.yml` by following [these steps.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/cloud-providers/gce)
-- When provisioning the cluster in Rancher, choose **Custom cloud provider** as the cloud provider in the Rancher UI.
-
-# Tutorial: How to Create a Cluster with Windows Support
-
-This tutorial describes how to create a Rancher-provisioned cluster with the three nodes in the [recommended architecture.](#guide-architecture)
-
-When you provision a custom cluster with Rancher, you will add nodes to the cluster by installing the [Rancher agent]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/agent-options/) on each one. When you create or edit your cluster from the Rancher UI, you will see a **Customize Node Run Command** that you can run on each server to add it to your custom cluster.
-
-To set up a custom cluster with support for Windows nodes and containers, you will need to complete the tasks below.
-
-<!-- TOC -->
-
-1. [Provision Hosts](#1-provision-hosts)
-1. [Create the Custom Cluster](#2-create-the-custom-cluster)
-1. [Add Nodes to the Cluster](#3-add-nodes-to-the-cluster)
-1. [Optional: Configuration for Azure Files](#5-optional-configuration-for-azure-files)
-   <!-- /TOC -->
-
-# 1. Provision Hosts
-
-To begin provisioning a custom cluster with Windows support, prepare your hosts.
-
-Your hosts can be:
-
-- Cloud-hosted VMs
-- VMs from virtualization clusters
-- Bare-metal servers
-
-You will provision three nodes:
-
-- One Linux node, which manages the Kubernetes control plane and stores your `etcd`
-- A second Linux node, which will be another worker node
-- The Windows node, which will run your Windows containers as a worker node
-
-| Node   | Operating System                                             |
-| ------ | ------------------------------------------------------------ |
-| Node 1 | Linux (Ubuntu Server 18.04 recommended)                      |
-| Node 2 | Linux (Ubuntu Server 18.04 recommended)                      |
-| Node 3 | Windows (Windows Server core version 1809 or above required) |
-
-If your nodes are hosted by a **Cloud Provider** and you want automation support such as loadbalancers or persistent storage devices, your nodes have additional configuration requirements. For details, see [Selecting Cloud Providers.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers)
-
-# 2. Create the Custom Cluster
-
-The instructions for creating a custom cluster that supports Windows nodes are very similar to the general [instructions for creating a custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster) with some Windows-specific requirements.
-
-Windows support only be enabled if the cluster uses Kubernetes v1.15+ and the Flannel network provider.
-
-1. From the **Global** view, click on the **Clusters** tab and click **Add Cluster**.
-
-1. Click **From existing nodes (Custom)**.
-
-1. Enter a name for your cluster in the **Cluster Name** text box.
-
-1. In the **Kubernetes Version** dropdown menu, select v1.15 or above.
-
-1. In the **Network Provider** field, select **Flannel.**
-
-1. In the **Windows Support** section, click **Enable.**
-
-1. Optional: After you enable Windows support, you will be able to choose the Flannel backend. There are two network options: [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) and [**VXLAN (Overlay)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan). The default option is **VXLAN (Overlay)** mode.
-
-1. Click **Next**.
-
-> **Important:** For <b>Host Gateway (L2bridge)</b> networking, it's best to use the same Layer 2 network for all nodes. Otherwise, you need to configure the route rules for them. For details, refer to the [documentation on configuring cloud-hosted VM routes.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#cloud-hosted-vm-routes-configuration) You will also need to [disable private IP address checks]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/host-gateway-requirements/#disabling-private-ip-address-checks) if you are using Amazon EC2, Google GCE, or Azure VM.
-
-# 3. Add Nodes to the Cluster
-
-This section describes how to register your Linux and Worker nodes to your custom cluster.
-
-### Add Linux Master Node
-
-The first node in your cluster should be a Linux host has both the **Control Plane** and **etcd** roles. At a minimum, both of these roles must be enabled for this node, and this node must be added to your cluster before you can add Windows hosts.
-
-In this section, we fill out a form on the Rancher UI to get a custom command to install the Rancher agent on the Linux master node. Then we will copy the command and run it on our Linux master node to register the node in the cluster.
-
-1. In the **Node Operating System** section, click **Linux**.
-
-1. In the **Node Role** section, choose at least **etcd** and **Control Plane**. We recommend selecting all three.
-
-1. Optional: If you click **Show advanced options,** you can customize the settings for the [Rancher agent]({{<baseurl>}}/rancher/v2.x/en/admin-settings/agent-options/) and [node labels.](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
-
-1. Copy the command displayed on the screen to your clipboard.
-
-1. SSH into your Linux host and run the command that you copied to your clipboard.
-
-1. When you are finished provisioning your Linux node(s), select **Done**.
-
-{{< result_create-cluster >}}
-
-It may take a few minutes for the node to be registered in your cluster.
-
-### Add Linux Worker Node
-
-After the initial provisioning of your custom cluster, your cluster only has a single Linux host. Next, we add another Linux `worker` host, which will be used to support _Rancher cluster agent_, _Metrics server_, _DNS_ and _Ingress_ for your cluster.
-
-1. From the **Global** view, click **Clusters.**
-
-1. Go to the custom cluster that you created and click **&#8942; > Edit.**
-
-1. Scroll down to **Node Operating System**. Choose **Linux**.
-
-1. In the **Customize Node Run Command** section, go to the **Node Options** and select the **Worker** role.
-
-1. Copy the command displayed on screen to your clipboard.
-
-1. Log in to your Linux host using a remote Terminal connection. Run the command copied to your clipboard.
-
-1. From **Rancher**, click **Save**.
-
-**Result:** The **Worker** role is installed on your Linux host, and the node registers with Rancher. It may take a few minutes for the node to be registered in your cluster.
-
-> **Note:** Taints on Linux Worker Nodes
->
-> For each Linux worker node added into the cluster, the following taints will be added to Linux worker node. By adding this taint to the Linux worker node, any workloads added to the windows cluster will be automatically scheduled to the Windows worker node. If you want to schedule workloads specifically onto the Linux worker node, you will need to add tolerations to those workloads.
-
-> | Taint Key      | Taint Value | Taint Effect |
-> | -------------- | ----------- | ------------ |
-> | `cattle.io/os` | `linux`     | `NoSchedule` |
-
-### Add a Windows Worker Node
-
-You can add Windows hosts to a custom cluster by editing the cluster and choosing the **Windows** option.
-
-1. From the **Global** view, click **Clusters.**
-
-1. Go to the custom cluster that you created and click **&#8942; > Edit.**
-
-1. Scroll down to **Node Operating System**. Choose **Windows**. Note: You will see that the **worker** role is the only available role.
-
-1. Copy the command displayed on screen to your clipboard.
-
-1. Log in to your Windows host using your preferred tool, such as [Microsoft Remote Desktop](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). Run the command copied to your clipboard in the **Command Prompt (CMD)**.
-
-1. From Rancher, click **Save**.
-
-1. Optional: Repeat these instructions if you want to add more Windows nodes to your cluster.
-
-**Result:** The **Worker** role is installed on your Windows host, and the node registers with Rancher. It may take a few minutes for the node to be registered in your cluster. You now have a Windows Kubernetes cluster.
-
-### Optional Next Steps
-
-After creating your cluster, you can access it through the Rancher UI. As a best practice, we recommend setting up these alternate ways of accessing your cluster:
-
-- **Access your cluster with the kubectl CLI:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#accessing-clusters-with-kubectl-on-your-workstation) to access clusters with kubectl on your workstation. In this case, you will be authenticated through the Rancher server’s authentication proxy, then Rancher will connect you to the downstream cluster. This method lets you manage the cluster without the Rancher UI.
-- **Access your cluster with the kubectl CLI, using the authorized cluster endpoint:** Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) to access your cluster with kubectl directly, without authenticating through the Rancher server. We recommend setting up this alternative method to access your cluster so that in case you can’t connect to Rancher, you can still access the cluster.
-
-# Configuration for Storage Classes in Azure
-
-If you are using Azure VMs for your nodes, you can use [Azure files](https://docs.microsoft.com/en-us/azure/aks/azure-files-dynamic-pv) as a [storage class]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) for the cluster.
-
-In order to have the Azure platform create the required storage resources, follow these steps:
-
-1.  [Configure the Azure cloud provider.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/#azure)
-
-1.  Configure `kubectl` to connect to your cluster.
-
-1.  Copy the `ClusterRole` and `ClusterRoleBinding` manifest for the service account:
-
-        ---
-        apiVersion: rbac.authorization.k8s.io/v1
-        kind: ClusterRole
-        metadata:
-          name: system:azure-cloud-provider
-        rules:
-        - apiGroups: ['']
-          resources: ['secrets']
-          verbs:     ['get','create']
-        ---
-        apiVersion: rbac.authorization.k8s.io/v1
-        kind: ClusterRoleBinding
-        metadata:
-          name: system:azure-cloud-provider
-        roleRef:
-          kind: ClusterRole
-          apiGroup: rbac.authorization.k8s.io
-          name: system:azure-cloud-provider
-        subjects:
-        - kind: ServiceAccount
-          name: persistent-volume-binder
-          namespace: kube-system
-
-1.  Create these in your cluster using one of the follow command.
-
-    ```
-    # kubectl create -f <MANIFEST>
-    ```
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
deleted file mode 100644
index 8cc045883ff..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/docs-for-2.1-and-2.2/_index.md
+++ /dev/null
@@ -1,176 +0,0 @@
----
-title: v2.1.x and v2.2.x Windows Documentation (Experimental)
-weight: 9100
----
-
-_Available from v2.1.0 to v2.1.9 and v2.2.0 to v2.2.3_
-
-This section describes how to provision Windows clusters in Rancher v2.1.x and v2.2.x. If you are using Rancher v2.3.0 or later, please refer to the new documentation for [v2.3.0 or later]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/).
-
-When you create a [custom cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes), Rancher uses RKE (the Rancher Kubernetes Engine) to provision the Kubernetes cluster on your existing infrastructure.
-
-You can provision a custom Windows cluster using Rancher by using a mix of Linux and Windows hosts as your cluster nodes.
-
->**Important:** In versions of Rancher prior to v2.3, support for Windows nodes is experimental. Therefore, it is not recommended to use Windows nodes for production environments if you are using Rancher prior to v2.3.
-
-This guide walks you through create of a custom cluster that includes three nodes:
-
-- A Linux node, which serves as a Kubernetes control plane node
-- Another Linux node, which serves as a Kubernetes worker used to support Ingress for the cluster
-- A Windows node, which is assigned the Kubernetes worker role and runs your Windows containers
-
-For a summary of Kubernetes features supported in Windows, see [Using Windows in Kubernetes](https://kubernetes.io/docs/setup/windows/intro-windows-in-kubernetes/).
-
-## OS and Container Requirements
-
-- For clusters provisioned with Rancher v2.1.x and v2.2.x, containers must run on Windows Server 1809 or above.
-- You must build containers on a Windows Server core version 1809 or above to run these containers on the same server version.
-
-## Objectives for Creating Cluster with Windows Support
-
-When setting up a custom cluster with support for Windows nodes and containers, complete the series of tasks below.
-
-<!-- TOC -->
-
-- [1. Provision Hosts](#1-provision-hosts)
-- [2. Cloud-host VM Networking Configuration](#2-cloud-hosted-vm-networking-configuration)
-- [3. Create the Custom Cluster](#3-create-the-custom-cluster)
-- [4. Add Linux Host for Ingress Support](#4-add-linux-host-for-ingress-support)
-- [5. Adding Windows Workers](#5-adding-windows-workers)
-- [6. Cloud-host VM Routes Configuration](#6-cloud-hosted-vm-routes-configuration)
-
-<!-- /TOC -->
-
-## 1. Provision Hosts
-
-To begin provisioning a custom cluster with Windows support, prepare your host servers. Provision three nodes according to our [requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)—two Linux, one Windows. Your hosts can be:
-
-- Cloud-hosted VMs
-- VMs from virtualization clusters
-- Bare-metal servers
-
-The table below lists the [Kubernetes roles]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) you'll assign to each host, although you won't enable these roles until further along in the configuration process—we're just informing you of each node's purpose. The first node, a Linux host, is primarily responsible for managing the Kubernetes control plane, although, in this use case, we're installing all three roles on this node. Node 2 is also a Linux worker, which is responsible for Ingress support. Finally, the third node is your Windows worker, which will run your Windows applications.
-
-Node    | Operating System | Future Cluster Role(s)
---------|------------------|------
-Node 1  | Linux (Ubuntu Server 16.04 recommended)           | [Control Plane]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#control-plane-nodes), [etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#etcd), [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)
-Node 2  | Linux (Ubuntu Server 16.04 recommended)           | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes) (This node is used for Ingress support)
-Node 3  | Windows (Windows Server core version 1809 or above)          | [Worker]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#worker-nodes)
-
-### Requirements
-
-- You can view node requirements for Linux and Windows nodes in the [installation section]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/).
-- All nodes in a virtualization cluster or a bare metal cluster must be connected using a layer 2 network.
-- To support [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/), your cluster must include at least one Linux node dedicated to the worker role.
-- Although we recommend the three node architecture listed in the table above, you can add additional Linux and Windows workers to scale up your cluster for redundancy.
-
-
-## 2. Cloud-hosted VM Networking Configuration
-
->**Note:** This step only applies to nodes hosted on cloud-hosted virtual machines. If you're using virtualization clusters or bare-metal servers, skip ahead to [Create the Custom Cluster](#3-create-the-custom-cluster).
-
-If you're hosting your nodes on any of the cloud services listed below, you must disable the private IP address checks for both your Linux or Windows hosts on startup. To disable this check for each node, follow the directions provided by each service below.
-
-Service | Directions to disable private IP address checks
---------|------------------------------------------------
-Amazon EC2 | [Disabling Source/Destination Checks](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck)
-Google GCE | [Enabling IP Forwarding for Instances](https://cloud.google.com/vpc/docs/using-routes#canipforward)
-Azure VM | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding)
-
-## 3. Create the Custom Cluster
-
-To create a custom cluster that supports Windows nodes, follow the instructions in [Creating a Cluster with Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster), starting from [2. Create the Custom Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#2-create-the-custom-cluster). While completing the linked instructions, look for steps that requires special actions for Windows nodes, which are flagged with a note. These notes will link back here, to the special Windows instructions listed in the subheadings below.
-
-
-### Enable the Windows Support Option
-
-While choosing **Cluster Options**, set **Windows Support (Experimental)** to **Enabled**.
-
-After you select this option, resume [Creating a Cluster with Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 6]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-6).
-
-### Networking Option
-
-When choosing a network provider for a cluster that supports Windows, the only option available is Flannel, as [host-gw](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) is needed for IP routing.
-
-If your nodes are hosted by a cloud provider and you want automation support such as load balancers or persistent storage devices, see [Selecting Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers) for configuration info.
-
-### Node Configuration
-
-The first node in your cluster should be a Linux host that fills the Control Plane role. This role must be fulfilled before you can add Windows hosts to your cluster. At minimum, the node must have this role enabled, but we recommend enabling all three. The following table lists our recommended settings (we'll provide the recommended settings for nodes 2 and 3 later).
-
-Option | Setting
--------|--------
-Node Operating System | Linux
-Node Roles | etcd <br/> Control Plane <br/> Worker
-
-When you're done with these configurations, resume [Creating a Cluster with Custom Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#create-the-custom-cluster) from [step 8]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/custom-nodes/#step-8).
-
-
-
-## 4. Add Linux Host for Ingress Support
-
-After the initial provisioning of your custom cluster, your cluster only has a single Linux host. Add another Linux host, which will be used to support Ingress for your cluster.
-
-1. Using the content menu, open the custom cluster your created in [2. Create the Custom Cluster](#2-create-the-custom-cluster).
-
-1. From the main menu, select **Nodes**.
-
-1. Click **Edit Cluster**.
-
-1. Scroll down to **Node Operating System**. Choose **Linux**.
-
-1. Select the **Worker** role.
-
-1. Copy the command displayed on screen to your clipboard.
-
-1. Log in to your Linux host using a remote Terminal connection. Run the command copied to your clipboard.
-
-1. From **Rancher**, click **Save**.
-
-**Result:** The worker role is installed on your Linux host, and the node registers with Rancher.
-
-## 5. Adding Windows Workers
-
-You can add Windows hosts to a custom cluster by editing the cluster and choosing the **Windows** option.
-
-1. From the main menu, select **Nodes**.
-
-1. Click **Edit Cluster**.
-
-1. Scroll down to **Node Operating System**. Choose **Windows**.
-
-1. Select the **Worker** role.
-
-1. Copy the command displayed on screen to your clipboard.
-
-1. Log in to your Windows host using your preferred tool, such as [Microsoft Remote Desktop](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients). Run the command copied to your clipboard in the **Command Prompt (CMD)**.
-
-1. From Rancher, click **Save**.
-
-1. **Optional:** Repeat these instruction if you want to add more Windows nodes to your cluster.
-
-**Result:** The worker role is installed on your Windows host, and the node registers with Rancher.
-
-## 6. Cloud-hosted VM Routes Configuration
-
-In Windows clusters, containers communicate with each other using the `host-gw` mode of Flannel. In `host-gw` mode, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network.
-
-- When worker nodes are provisioned on AWS, virtualization clusters, or bare metal servers, make sure they belong to the same layer 2 subnet. If the nodes don't belong to the same layer 2 subnet, `host-gw` networking will not work.
-
-- When worker nodes are provisioned on GCE or Azure, they are not on the same layer 2 subnet. Nodes on GCE and Azure belong to a routable layer 3 network. Follow the instructions below to configure GCE and Azure so that the cloud network knows how to route the host subnets on each node.
-
-To configure host subnet routing on GCE or Azure, first run the following command to find out the host subnets on each worker node:
-
-```bash
-kubectl get nodes -o custom-columns=nodeName:.metadata.name,nodeIP:status.addresses[0].address,routeDestination:.spec.podCIDR
-```
-
-Then follow the instructions for each cloud provider to configure routing rules for each node:
-
-Service | Instructions
---------|-------------
-Google GCE | For GCE, add a static route for each node: [Adding a Static Route](https://cloud.google.com/vpc/docs/using-routes#addingroute).
-Azure VM | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined).
-
-
-` `
diff --git a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md b/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
deleted file mode 100644
index ee075c394de..00000000000
--- a/content/rancher/v2.5/en/ecm/setting-up-k8s/rke-clusters/windows-clusters/host-gateway-requirements/_index.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Networking Requirements for Host Gateway (L2bridge)
-weight: 1000
----
-
-This section describes how to configure custom Windows clusters that are using *Host Gateway (L2bridge)* mode.
-
-### Disabling Private IP Address Checks
-
-If you are using *Host Gateway (L2bridge)* mode and hosting your nodes on any of the cloud services listed below, you must disable the private IP address checks for both your Linux or Windows hosts on startup. To disable this check for each node, follow the directions provided by each service below.
-
-Service | Directions to disable private IP address checks
---------|------------------------------------------------
-Amazon EC2 | [Disabling Source/Destination Checks](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html#EIP_Disable_SrcDestCheck)
-Google GCE | [Enabling IP Forwarding for Instances](https://cloud.google.com/vpc/docs/using-routes#canipforward) (By default, a VM cannot forward a packet originated by another VM)
-Azure VM   | [Enable or Disable IP Forwarding](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface#enable-or-disable-ip-forwarding)
-
-### Cloud-hosted VM Routes Configuration
-
-If you are using the [**Host Gateway (L2bridge)**](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) backend of Flannel, all containers on the same node belong to a private subnet, and traffic routes from a subnet on one node to a subnet on another node through the host network.
-
-- When worker nodes are provisioned on AWS, virtualization clusters, or bare metal servers, make sure they belong to the same layer 2 subnet. If the nodes don't belong to the same layer 2 subnet, `host-gw` networking will not work.
-
-- When worker nodes are provisioned on GCE or Azure, they are not on the same layer 2 subnet. Nodes on GCE and Azure belong to a routable layer 3 network. Follow the instructions below to configure GCE and Azure so that the cloud network knows how to route the host subnets on each node.
-
-To configure host subnet routing on GCE or Azure, first run the following command to find out the host subnets on each worker node:
-
-```bash
-kubectl get nodes -o custom-columns=nodeName:.metadata.name,nodeIP:status.addresses[0].address,routeDestination:.spec.podCIDR
-```
-
-Then follow the instructions for each cloud provider to configure routing rules for each node:
-
-Service | Instructions
---------|-------------
-Google GCE | For GCE, add a static route for each node: [Adding a Static Route](https://cloud.google.com/vpc/docs/using-routes#addingroute).
-Azure VM   | For Azure, create a routing table: [Custom Routes: User-defined](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined).
diff --git a/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md b/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
deleted file mode 100644
index f75848a71b3..00000000000
--- a/content/rancher/v2.5/en/ecm/upgrading-kubernetes/_index.md
+++ /dev/null
@@ -1,159 +0,0 @@
----
-title: Upgrading and Rolling Back RKE Kubernetes Clusters
-weight: 3
----
-
-Following an upgrade to the latest version of Rancher, downstream Kubernetes clusters can be upgraded to use the latest supported version of Kubernetes.
-
-Rancher calls RKE (Rancher Kubernetes Engine) as a library when provisioning and editing RKE clusters. For more information on configuring the upgrade strategy for RKE clusters, refer to the [RKE documentation]({{<baseurl>}}/rke/latest/en/).
-
-This section covers the following topics:
-
-- [New Features](#new-features)
-- [Tested Kubernetes Versions](#tested-kubernetes-versions)
-- [How Upgrades Work](#how-upgrades-work)
-- [Recommended Best Practice for Upgrades](#recommended-best-practice-for-upgrades)
-- [Upgrading the Kubernetes Version](#upgrading-the-kubernetes-version)
-- [Rolling Back](#rolling-back)
-- [Configuring the Upgrade Strategy](#configuring-the-upgrade-strategy)
-  - [Configuring the Maximum Unavailable Worker Nodes in the Rancher UI](#configuring-the-maximum-unavailable-worker-nodes-in-the-rancher-ui)
-  - [Enabling Draining Nodes During Upgrades from the Rancher UI](#enabling-draining-nodes-during-upgrades-from-the-rancher-ui)
-  - [Maintaining Availability for Applications During Upgrades](#maintaining-availability-for-applications-during-upgrades)
-  - [Configuring the Upgrade Strategy in the cluster.yml](#configuring-the-upgrade-strategy-in-the-cluster-yml)
-- [Troubleshooting](#troubleshooting)
-
-# New Features
-
-As of Rancher v2.3.0, the Kubernetes metadata feature was added, which allows Rancher to ship Kubernetes patch versions without upgrading Rancher. For details, refer to the [section on Kubernetes metadata.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/k8s-metadata)
-
-As of Rancher v2.4.0,
-
-- The ability to import K3s Kubernetes clusters into Rancher was added, along with the ability to upgrade Kubernetes when editing those clusters. For details, refer to the [section on imported clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters)
-- New advanced options are exposed in the Rancher UI for configuring the upgrade strategy of an RKE cluster: **Maximum Worker Nodes Unavailable** and **Drain nodes.** These options leverage the new cluster upgrade process of RKE v1.1.0, in which worker nodes are upgraded in batches, so that applications can remain available during cluster upgrades, under [certain conditions.](#maintaining-availability-for-applications-during-upgrades)
-
-# Tested Kubernetes Versions
-
-Before a new version of Rancher is released, it's tested with the latest minor versions of Kubernetes to ensure compatibility. For example, Rancher v2.3.0 is was tested with Kubernetes v1.15.4, v1.14.7, and v1.13.11. For details on which versions of Kubernetes were tested on each Rancher version, refer to the [support maintenance terms.](https://rancher.com/support-maintenance-terms/all-supported-versions/rancher-v2.3.0/)
-
-# How Upgrades Work
-
-RKE v1.1.0 changed the way that clusters are upgraded.
-
-In this section of the [RKE documentation,]({{<baseurl>}}/rke/latest/en/upgrades/how-upgrades-work) you'll learn what happens when you edit or upgrade your RKE Kubernetes cluster.
-
-
-# Recommended Best Practice for Upgrades
-
-{{% tabs %}}
-{{% tab "Rancher v2.4+" %}}
-When upgrading the Kubernetes version of a cluster, we recommend that you:
-
-1. Take a snapshot.
-1. Initiate a Kubernetes upgrade.
-1. If the upgrade fails, revert the cluster to the pre-upgrade Kubernetes version. Before restoring the cluster from the snapshot in the etcd datastore, the cluster should be running the pre-upgrade Kubernetes version.
-1. Restore the cluster from the etcd snapshot.
-
-The restore operation will work on a cluster that is not in a healthy or active state.
-{{% /tab %}}
-{{% tab "Rancher prior to v2.4" %}}
-When upgrading the Kubernetes version of a cluster, we recommend that you:
-
-1. Take a snapshot.
-1. Initiate a Kubernetes upgrade.
-1. If the upgrade fails, restore the cluster from the etcd snapshot.
-
-The cluster cannot be downgraded to a previous Kubernetes version.
-{{% /tab %}}
-{{% /tabs %}}
-
-# Upgrading the Kubernetes Version
-
-> **Prerequisites:**
->
-> - The options below are available only for [Rancher-launched RKE Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) and [imported K3s Kubernetes clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
-> - Before upgrading Kubernetes, [back up your cluster.]({{<baseurl>}}/rancher/v2.x/en/backups)
-
-1. From the **Global** view, find the cluster for which you want to upgrade Kubernetes. Select **&#8942; > Edit**.
-
-1. Expand **Cluster Options**.
-
-1. From the **Kubernetes Version** drop-down, choose the version of Kubernetes that you want to use for the cluster.
-
-1. Click **Save**.
-
-**Result:** Kubernetes begins upgrading for the cluster.
-
-# Rolling Back
-
-A cluster can be restored to a backup in which the previous Kubernetes version was used. For more information, refer to the following sections:
-
-- [Backing up a cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/#how-snapshots-work)
-- [Restoring a cluster from backup]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/#restoring-a-cluster-from-a-snapshot)
-
-# Configuring the Upgrade Strategy
-
-As of RKE v1.1.0, additional upgrade options became available to give you more granular control over the upgrade process. These options can be used to maintain availability of your applications during a cluster upgrade if certain [conditions and requirements]({{<baseurl>}}/rke/latest/en/upgrades/maintaining-availability) are met.
-
-The upgrade strategy can be configured in the Rancher UI, or by editing the `cluster.yml`. More advanced options are available by editing the `cluster.yml`.
-
-### Configuring the Maximum Unavailable Worker Nodes in the Rancher UI
-
-From the Rancher UI, the maximum number of unavailable worker nodes can be configured. During a cluster upgrade, worker nodes will be upgraded in batches of this size.
-
-By default, the maximum number of unavailable worker is defined as 10 percent of all worker nodes. This number can be configured as a percentage or as an integer. When defined as a percentage, the batch size is rounded down to the nearest node, with a minimum of one node.
-
-To change the default number or percentage of worker nodes,
-
-1. Go to the cluster view in the Rancher UI.
-1. Click **&#8942; > Edit.**
-1. In the **Advanced Options** section, go to the **Maxiumum Worker Nodes Unavailable** field. Enter the percentage of worker nodes that can be upgraded in a batch. Optionally, select **Count** from the drop-down menu and enter the maximum unavailable worker nodes as an integer.
-1. Click **Save.**
-
-**Result:** The cluster is updated to use the new upgrade strategy.
-
-### Enabling Draining Nodes During Upgrades from the Rancher UI
-
-By default, RKE [cordons](https://kubernetes.io/docs/concepts/architecture/nodes/#manual-node-administration) each node before upgrading it. [Draining](https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/) is disabled during upgrades by default. If draining is enabled in the cluster configuration, RKE will both cordon and drain the node before it is upgraded.
-
-To enable draining each node during a cluster upgrade,
-
-1. Go to the cluster view in the Rancher UI.
-1. Click **&#8942; > Edit.**
-1. In the **Advanced Options** section, go to the **Drain nodes** field and click **Yes.**
-1. Choose a safe or aggressive drain option. For more information about each option, refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes/#aggressive-and-safe-draining-options)
-1. Optionally, configure a grace period. The grace period is the timeout given to each pod for cleaning things up, so they will have chance to exit gracefully. Pods might need to finish any outstanding requests, roll back transactions or save state to some external storage. If this value is negative, the default value specified in the pod will be used.
-1. Optionally, configure a timeout, which is the amount of time the drain should continue to wait before giving up.
-1. Click **Save.**
-
-**Result:** The cluster is updated to use the new upgrade strategy.
-
-> **Note:** As of Rancher v2.4.0, there is a [known issue](https://github.com/rancher/rancher/issues/25478) in which the Rancher UI doesn't show state of etcd and controlplane as drained, even though they are being drained.
-
-### Maintaining Availability for Applications During Upgrades
-
-_Available as of RKE v1.1.0_
-
-In [this section of the RKE documentation,]({{<baseurl>}}/rke/latest/en/upgrades/maintaining-availability/) you'll learn the requirements to prevent downtime for your applications when upgrading the cluster.
-
-### Configuring the Upgrade Strategy in the cluster.yml
-
-More advanced upgrade strategy configuration options are available by editing the `cluster.yml`.
-
-For details, refer to [Configuring the Upgrade Strategy]({{<baseurl>}}/rke/latest/en/upgrades/configuring-strategy) in the RKE documentation. The section also includes an example `cluster.yml` for configuring the upgrade strategy.
-
-# Troubleshooting
-
-If a node doesn't come up after an upgrade, the `rke up` command errors out.
-
-No upgrade will proceed if the number of unavailable nodes exceeds the configured maximum.
-
-If an upgrade stops, you may need to fix an unavailable node or remove it from the cluster before the upgrade can continue.
-
-A failed node could be in many different states:
-
-- Powered off
-- Unavailable
-- User drains a node while upgrade is in process, so there are no kubelets on the node
-- The upgrade itself failed
-
-If the max unavailable number of nodes is reached during an upgrade, Rancher user clusters will be stuck in updating state and not move forward with upgrading any other control plane nodes. It will continue to evaluate the set of unavailable nodes in case one of the nodes becomes available. If the node cannot be fixed, you must remove the node in order to continue the upgrade.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/upgrading-mcm/_index.md b/content/rancher/v2.5/en/ecm/upgrading-mcm/_index.md
deleted file mode 100644
index e8978ea379b..00000000000
--- a/content/rancher/v2.5/en/ecm/upgrading-mcm/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Upgrading the Enterprise Cluster Manager
-weight: 2
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/ecm/upgrading-mcm/rollbacks/_index.md b/content/rancher/v2.5/en/ecm/upgrading-mcm/rollbacks/_index.md
deleted file mode 100644
index 7ebe57e5c73..00000000000
--- a/content/rancher/v2.5/en/ecm/upgrading-mcm/rollbacks/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Rolling Back the Enterprise Cluster Manager
-weight: 1
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/faq/_index.md b/content/rancher/v2.5/en/faq/_index.md
deleted file mode 100644
index 26fd9dbbeb7..00000000000
--- a/content/rancher/v2.5/en/faq/_index.md
+++ /dev/null
@@ -1,70 +0,0 @@
----
-title: FAQ
-weight: 20
----
-
-This FAQ is a work in progress designed to answers the questions our users most frequently ask about Rancher v2.x.
-
-See [Technical FAQ]({{<baseurl>}}/rancher/v2.x/en/faq/technical/), for frequently asked technical questions.
-
-<br>
-
-**Does Rancher v2.x support Docker Swarm and Mesos as environment types?**
-
-When creating an environment in Rancher v2.x, Swarm and Mesos will no longer be standard options you can select. However, both Swarm and Mesos will continue to be available as Catalog applications you can deploy. It was a tough decision to make but, in the end, it came down to adoption. For example, out of more than 15,000 clusters, only about 200 or so are running Swarm.
-
-<br>
-
-**Is it possible to manage Azure Kubernetes Services with Rancher v2.x?**
-
-Yes.
-
-<br>
-
-**Does Rancher support Windows?**
-
-As of Rancher 2.3.0, we support Windows Server 1809 containers. For details on how to set up a cluster with Windows worker nodes, refer to the section on [configuring custom clusters for Windows.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/)
-
-<br>
-
-**Does Rancher support Istio?**
-
-As of Rancher 2.3.0, we support [Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
-
-Furthermore, Istio is implemented in our micro-PaaS "Rio", which works on Rancher 2.x along with any CNCF compliant Kubernetes cluster. You can read more about it [here](https://rio.io/)
-
-<br>
-
-**Will Rancher v2.x support Hashicorp's Vault for storing secrets?**
-
-Secrets management is on our roadmap but we haven't assigned it to a specific release yet. 
-
-<br>
-
-**Does Rancher v2.x support RKT containers as well?**
-
-At this time, we only support Docker.
-
-<br>
-
-**Does Rancher v2.x support Calico, Contiv, Contrail, Flannel, Weave net, etc., for embedded and imported Kubernetes?**
-
-Out-of-the-box, Rancher provides the following CNI network providers for Kubernetes clusters: Canal, Flannel, Calico and Weave (Weave is available as of v2.2.0).  Always refer to the [Rancher Support Matrix](https://rancher.com/support-maintenance-terms/) for details about what is officially supported.
-
-<br>
-
-**Are you planning on supporting Traefik for existing setups?**
-
-We don't currently plan on providing embedded Traefik support, but we're still exploring load-balancing approaches.
-
-<br>
-
-**Can I import OpenShift Kubernetes clusters into v2.x?**
-
-Our goal is to run any upstream Kubernetes clusters. Therefore, Rancher v2.x should work with OpenShift, but we haven't tested it yet.
-
-<br>
-
-**Are you going to integrate Longhorn?**
-
-Yes. Longhorn was on a bit of a hiatus while we were working on v2.0. We plan to re-engage on the project.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/faq/kubectl/_index.md b/content/rancher/v2.5/en/faq/kubectl/_index.md
deleted file mode 100644
index b4172ab0a40..00000000000
--- a/content/rancher/v2.5/en/faq/kubectl/_index.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Installing and Configuring kubectl
-weight: 100
----
-
-`kubectl` is a CLI utility for running commands against Kubernetes clusters. It's required for many maintenance and administrative tasks in Rancher 2.x.
-
-### Installation
-
-See [kubectl Installation](https://kubernetes.io/docs/tasks/tools/install-kubectl/) for installation on your operating system.
-
-### Configuration
-
-When you create a Kubernetes cluster with RKE, RKE creates a `kube_config_rancher-cluster.yml` in the local directory that contains credentials to connect to your new cluster with tools like `kubectl` or `helm`.
-
-You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set the `KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`.
-
-```
-export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml
-```
-
-Test your connectivity with `kubectl` and see if you can get the list of nodes back.
-
-```
-kubectl get nodes
- NAME                          STATUS    ROLES                      AGE       VERSION
-165.227.114.63                Ready     controlplane,etcd,worker   11m       v1.10.1
-165.227.116.167               Ready     controlplane,etcd,worker   11m       v1.10.1
-165.227.127.226               Ready     controlplane,etcd,worker   11m       v1.10.1
-```
diff --git a/content/rancher/v2.5/en/faq/mcm/networking/_index.md b/content/rancher/v2.5/en/faq/mcm/networking/_index.md
deleted file mode 100644
index 863ad97169d..00000000000
--- a/content/rancher/v2.5/en/faq/mcm/networking/_index.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-title: Networking
-weight: 8005
----
-
-Networking FAQ's
-
-- [CNI Providers]({{<baseurl>}}/rancher/v2.x/en/faq/networking/cni-providers/)
-
diff --git a/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md b/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
deleted file mode 100644
index 3a0352a90eb..00000000000
--- a/content/rancher/v2.5/en/faq/mcm/networking/cni-providers/_index.md
+++ /dev/null
@@ -1,152 +0,0 @@
----
-title: Container Network Interface (CNI) Providers
-description: Learn about Container Network Interface (CNI), the CNI providers Rancher provides, the features they offer, and how to choose a provider for you
-weight: 2300
----
-
-## What is CNI?
-
-CNI (Container Network Interface), a [Cloud Native Computing Foundation project](https://cncf.io/), consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of  plugins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
-
-Kubernetes uses CNI as an interface between network providers and Kubernetes pod networking.
-
-![CNI Logo]({{<baseurl>}}/img/rancher/cni-logo.png)
-
-For more information visit [CNI GitHub project](https://github.com/containernetworking/cni).
-
-### What Network Models are Used in CNI?
-
-CNI network providers implement their network fabric using either an encapsulated network model such as Virtual Extensible Lan ([VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan)) or an unencapsulated network model such as Border Gateway Protocol ([BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol)).
-
-#### What is an Encapsulated Network?
-
-This network model provides a logical Layer 2 (L2) network encapsulated over the existing Layer 3 (L3) network topology that spans the Kubernetes cluster nodes. With this model you have an isolated L2 network for containers without needing routing distribution, all at the cost of minimal overhead in terms of processing and increased IP package size, which comes from an IP header generated by overlay encapsulation. Encapsulation information is distributed by UDP ports between Kubernetes workers, interchanging network control plane information about how MAC addresses can be reached. Common encapsulation used in this kind of network model is VXLAN, Internet Protocol Security (IPSec), and IP-in-IP.
-
-In simple terms, this network model generates a kind of network bridge extended between Kubernetes workers, where pods are connected.
-
-This network model is used when an extended L2 bridge is preferred. This network model is sensitive to L3 network latencies of the Kubernetes workers. If datacenters are in distinct geolocations, be sure to have low latencies between them to avoid eventual network segmentation.
-
-CNI network providers using this network model include Flannel, Canal, and Weave.
-
-![Encapsulated Network]({{<baseurl>}}/img/rancher/encapsulated-network.png)
-
-#### What is an Unencapsulated Network?
-
-This network model provides an L3 network to route packets between containers. This model doesn't generate an isolated l2 network, nor generates overhead. These benefits come at the cost of Kubernetes workers having to manage any route distribution that's needed. Instead of using IP headers for encapsulation, this network model uses a network protocol between Kubernetes workers to distribute routing information to reach pods, such as [BGP](https://en.wikipedia.org/wiki/Border_Gateway_Protocol).
-
-In simple terms, this network model generates a kind of network router extended between Kubernetes workers, which provides information about how to reach pods.
-
-This network model is used when a routed L3 network is preferred. This mode dynamically updates routes at the OS level for Kubernetes workers. It's less sensitive to latency.
-
-CNI network providers using this network model include Calico and Romana.
-
-![Unencapsulated Network]({{<baseurl>}}/img/rancher/unencapsulated-network.png)
-
-### What CNI Providers are Provided by Rancher?
-
-Out-of-the-box, Rancher provides the following CNI network providers for Kubernetes clusters: Canal, Flannel, Calico and Weave (Weave is available as of v2.2.0). You can choose your CNI network provider when you create new Kubernetes clusters from Rancher.
-
-#### Canal
-
-![Canal Logo]({{<baseurl>}}/img/rancher/canal-logo.png)
-
-Canal is a CNI network provider that gives you the best of Flannel and Calico. It allows users to easily deploy Calico and Flannel networking together as a unified networking solution, combining Calico’s network policy enforcement with the rich superset of Calico (unencapsulated) and/or Flannel (encapsulated) network connectivity options.
-
-In Rancher, Canal is the default CNI network provider combined with Flannel and VXLAN encapsulation.
-
-Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). For details, refer to [the port requirements for user clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/)
-
-{{< img "/img/rancher/canal-diagram.png" "Canal Diagram">}}
-
-For more information, see the [Canal GitHub Page.](https://github.com/projectcalico/canal)
-
-#### Flannel
-
-![Flannel Logo]({{<baseurl>}}/img/rancher/flannel-logo.png)
-
-Flannel is a simple and easy way to configure L3 network fabric designed for Kubernetes. Flannel runs a single binary agent named flanneld on each host, which is responsible for allocating a subnet lease to each host out of a larger, preconfigured address space. Flannel uses either the Kubernetes API or etcd directly to store the network configuration, the allocated subnets, and any auxiliary data (such as the host's public IP). Packets are forwarded using one of several backend mechanisms, with the default encapsulation being [VXLAN](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan).
-
-Encapsulated traffic is unencrypted by default. Therefore, flannel provides an experimental backend for encryption, [IPSec](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#ipsec), which makes use of [strongSwan](https://www.strongswan.org/) to establish encrypted IPSec tunnels between Kubernetes workers.
-
-Kubernetes workers should open UDP port `8472` (VXLAN) and TCP port `9099` (healthcheck). See [the port requirements for user clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for more details.
-
-![Flannel Diagram]({{<baseurl>}}/img/rancher/flannel-diagram.png)
-
-For more information, see the [Flannel GitHub Page](https://github.com/coreos/flannel).
-
-#### Calico
-
-![Calico Logo]({{<baseurl>}}/img/rancher/calico-logo.png)
-
-Calico enables networking and network policy in Kubernetes clusters across the cloud. Calico uses a pure, unencapsulated IP network fabric and policy engine to provide networking for your Kubernetes workloads. Workloads are able to communicate over both cloud infrastructure and on-premise using BGP.
-
-Calico also provides a stateless IP-in-IP encapsulation mode that can be used, if necessary. Calico also offers policy isolation, allowing you to secure and govern your Kubernetes workloads using advanced ingress and egress policies.
-
-Kubernetes workers should open TCP port `179` (BGP). See [the port requirements for user clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for more details.
-
-![Calico Diagram]({{<baseurl>}}/img/rancher/calico-diagram.svg)
-
-For more information, see the following pages:
-
-- [Project Calico Official Site](https://www.projectcalico.org/)
-- [Project Calico GitHub Page](https://github.com/projectcalico/calico)
-
-
-#### Weave
-
-![Weave Logo]({{<baseurl>}}/img/rancher/weave-logo.png)
-
-Weave enables networking and network policy in Kubernetes clusters across the cloud. Additionally, it support encrypting traffic between the peers.
-
-Kubernetes workers should open TCP port `6783` (control port), UDP port `6783` and UDP port `6784` (data ports). See the [port requirements for user clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for more details.
-
-For more information, see the following pages:
-
-- [Weave Net Official Site](https://www.weave.works/)
-
-### CNI Features by Provider
-
-The following table summarizes the different features available for each CNI network provider provided by Rancher.
-
-| Provider | Network Model | Route Distribution | Network Policies | Mesh | External Datastore | Encryption | Ingress/Egress Policies |
-| ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |
-| Canal | Encapsulated (VXLAN) | No | Yes | No | K8S API | No | Yes |
-| Flannel | Encapsulated (VXLAN) | No | No | No | K8S API | No | No |
-| Calico | Encapsulated (VXLAN,IPIP) OR Unencapsulated | Yes | Yes | Yes | Etcd and K8S API | No | Yes |
-| Weave | Encapsulated | Yes | Yes | Yes | No | Yes | Yes |
-
-- Network Model: Encapsulated or unencapsulated. For more information, see [What Network Models are Used in CNI?](#what-network-models-are-used-in-cni)
-
-- Route Distribution: An exterior gateway protocol designed to exchange routing and reachability information on the Internet. BGP can assist with pod-to-pod networking between clusters. This feature is a must on unencapsulated CNI network providers, and it is typically done by BGP. If you plan to build clusters split across network segments, route distribution is a feature that's nice-to-have.
-
-- Network Policies: Kubernetes offers functionality to enforce rules about which services can communicate with each other using network policies. This feature is stable as of Kubernetes v1.7 and is ready to use with certain networking plugins.
-
-- Mesh: This feature allows service-to-service networking communication between distinct Kubernetes clusters.
-
-- External Datastore: CNI network providers with this feature need an external datastore for its data.
-
-- Encryption: This feature allows cyphered and secure network control and data planes.
-
-- Ingress/Egress Policies: This feature allows you to manage routing control for both Kubernetes and non-Kubernetes communications.
-
-#### CNI Community Popularity
-
-The following table summarizes different GitHub metrics to give you an idea of each project's popularity and activity. This data was collected in January 2020.
-
-| Provider | Project | Stars | Forks | Contributors |
-| ---- | ---- | ---- | ---- | ---- |
-| Canal | https://github.com/projectcalico/canal | 614 | 89 | 19 |
-| flannel | https://github.com/coreos/flannel | 4977 | 1.4k | 140 |
-| Calico | https://github.com/projectcalico/calico | 1534 | 429 | 135 |
-| Weave | https://github.com/weaveworks/weave/ | 5737 | 559 | 73 |
-
-<br/>
-### Which CNI Provider Should I Use?
-
-It depends on your project needs. There are many different providers, which each have various features and options. There isn't one provider that meets everyone's needs.
-
-As of Rancher v2.0.7, Canal is the default CNI network provider. We recommend it for most use cases. It provides encapsulated networking for containers with Flannel, while adding Calico network policies that can provide project/namespace isolation in terms of networking.
-
-### How can I configure a CNI network provider?
-
-Please see [Cluster Options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/) on how to configure a network provider for your cluster. For more advanced configuration options, please see how to configure your cluster using a [Config File]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file) and the options for [Network Plug-ins]({{<baseurl>}}/rke/latest/en/config-options/add-ons/network-plugins/).
diff --git a/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md b/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
deleted file mode 100644
index 8ea06632696..00000000000
--- a/content/rancher/v2.5/en/faq/mcm/removing-rancher/_index.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: Rancher is No Longer Needed
-weight: 8010
----
-
-This page is intended to answer questions about what happens if you don't want Rancher anymore, if you don't want a cluster to be managed by Rancher anymore, or if the Rancher server is deleted.
-
-- [If the Rancher server is deleted, what happens to the workloads in my downstream clusters?](#if-the-rancher-server-is-deleted-what-happens-to-the-workloads-in-my-downstream-clusters)
-- [If the Rancher server is deleted, how do I access my downstream clusters?](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
-- [What if I don't want Rancher anymore?](#what-if-i-don-t-want-rancher-anymore)
-- [What if I don't want my imported cluster managed by Rancher?](#what-if-i-don-t-want-my-imported-cluster-managed-by-rancher)
-- [What if I don't want my RKE cluster or hosted Kubernetes cluster managed by Rancher?](#what-if-i-don-t-want-my-rke-cluster-or-hosted-kubernetes-cluster-managed-by-rancher)
-
-### If the Rancher server is deleted, what happens to the workloads in my downstream clusters?
-
-If Rancher is ever deleted or unrecoverable, all workloads in the downstream Kubernetes clusters managed by Rancher will continue to function as normal.
-
-### If the Rancher server is deleted, how do I access my downstream clusters?
-
-The capability to access a downstream cluster without Rancher depends on the type of cluster and the way that the cluster was created. To summarize:
-
-- **Imported clusters:** The cluster will be unaffected and you can access the cluster using the same methods that you did before the cluster was imported into Rancher.
-- **Hosted Kubernetes clusters:** If you created the cluster in a cloud-hosted Kubernetes provider such as EKS, GKE, or AKS, you can continue to manage the cluster using your provider's cloud credentials.
-- **RKE clusters:** To access an [RKE cluster,]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) the cluster must have the [authorized cluster endpoint]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#4-authorized-cluster-endpoint) enabled, and you must have already downloaded the cluster's kubeconfig file from the Rancher UI. (The authorized cluster endpoint is enabled by default for RKE clusters.) With this endpoint, you can access your cluster with kubectl directly instead of communicating through the Rancher server's [authentication proxy.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/#1-the-authentication-proxy) For instructions on how to configure kubectl to use the authorized cluster endpoint, refer to the section about directly accessing clusters with [kubectl and the kubeconfig file.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/#authenticating-directly-with-a-downstream-cluster) These clusters will use a snapshot of the authentication as it was configured when Rancher was removed.
-
-### What if I don't want Rancher anymore?
-
-If you [installed Rancher on a Kubernetes cluster,]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/) remove Rancher by using the [System Tools]({{<baseurl>}}/rancher/v2.x/en/system-tools/) with the `remove` subcommand.
-
-If you installed Rancher with Docker, you can uninstall Rancher by removing the single Docker container that it runs in.
-
-Imported clusters will not be affected by Rancher being removed. For other types of clusters, refer to the section on [accessing downstream clusters when Rancher is removed.](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
-
-### What if I don't want my imported cluster managed by Rancher?
-
-If an imported cluster is deleted from the Rancher UI, the cluster is detached from Rancher, leaving it intact and accessible by the same methods that were used to access it before it was imported into Rancher.
-
-To detach the cluster,
-
-1. From the **Global** view in Rancher, go to the **Clusters** tab.
-2. Go to the imported cluster that should be detached from Rancher and click **&#8942; > Delete.**
-3. Click **Delete.**
-
-**Result:** The imported cluster is detached from Rancher and functions normally outside of Rancher.
-
-### What if I don't want my RKE cluster or hosted Kubernetes cluster managed by Rancher?
-
-At this time, there is no functionality to detach these clusters from Rancher. In this context, "detach" is defined as the ability to remove Rancher components from the cluster and manage access to the cluster independently of Rancher.
-
-The capability to manage these clusters without Rancher is being tracked in this [issue.](https://github.com/rancher/rancher/issues/25234)
-
-For information about how to access clusters if the Rancher server is deleted, refer to [this section.](#if-the-rancher-server-is-deleted-how-do-i-access-my-downstream-clusters)
diff --git a/content/rancher/v2.5/en/faq/mcm/technical/_index.md b/content/rancher/v2.5/en/faq/mcm/technical/_index.md
deleted file mode 100644
index 1151e35489c..00000000000
--- a/content/rancher/v2.5/en/faq/mcm/technical/_index.md
+++ /dev/null
@@ -1,189 +0,0 @@
----
-title: Technical
-weight: 8006
----
-
-### How can I reset the administrator password?
-
-Docker Install:
-```
-$ docker exec -ti <container_id> reset-password
-New password for default administrator (user-xxxxx):
-<new_password>
-```
-
-Kubernetes install (Helm):
-```
-$ KUBECONFIG=./kube_config_rancher-cluster.yml
-$ kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $(kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | head -1 | awk '{ print $1 }') -- reset-password
-New password for default administrator (user-xxxxx):
-<new_password>
-```
-
-Kubernetes install (RKE add-on):
-```
-$ KUBECONFIG=./kube_config_rancher-cluster.yml
-$ kubectl --kubeconfig $KUBECONFIG exec -n cattle-system $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name=="cattle-server") | .metadata.name') -- reset-password
-New password for default administrator (user-xxxxx):
-<new_password>
-```
-
-
-### I deleted/deactivated the last admin, how can I fix it?
-Docker Install:
-```
-$ docker exec -ti <container_id> ensure-default-admin
-New default administrator (user-xxxxx)
-New password for default administrator (user-xxxxx):
-<new_password>
-```
-
-Kubernetes install (Helm):
-```
-$ KUBECONFIG=./kube_config_rancher-cluster.yml
-$ kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $(kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | head -1 | awk '{ print $1 }') -- ensure-default-admin
-New password for default administrator (user-xxxxx):
-<new_password>
-```
-
-Kubernetes install (RKE add-on):
-```
-$ KUBECONFIG=./kube_config_rancher-cluster.yml
-$ kubectl --kubeconfig $KUBECONFIG exec -n cattle-system $(kubectl --kubeconfig $KUBECONFIG get pods -n cattle-system -o json | jq -r '.items[] | select(.spec.containers[].name=="cattle-server") | .metadata.name') -- ensure-default-admin
-New password for default admin user (user-xxxxx):
-<new_password>
-```
-
-### How can I enable debug logging?
-
-See [Troubleshooting: Logging]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/logging/)
-
-### My ClusterIP does not respond to ping
-
-ClusterIP is a virtual IP, which will not respond to ping. Best way to test if the ClusterIP is configured correctly, is by using `curl` to access the IP and port to see if it responds.
-
-### Where can I manage Node Templates?
-
-Node Templates can be accessed by opening your account menu (top right) and selecting `Node Templates`.
-
-### Why is my Layer-4 Load Balancer in `Pending` state?
-
-The Layer-4 Load Balancer is created as `type: LoadBalancer`. In Kubernetes, this needs a cloud provider or controller that can satisfy these requests, otherwise these will be in `Pending` state forever. More information can be found on [Cloud Providers]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/) or [Create External Load Balancer](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/)
-
-### Where is the state of Rancher stored?
-
-- Docker Install: in the embedded etcd of the `rancher/rancher` container, located at `/var/lib/rancher`.
-- Kubernetes install: in the etcd of the RKE cluster created to run Rancher.
-
-### How are the supported Docker versions determined?
-
-We follow the validated Docker versions for upstream Kubernetes releases. The validated versions can be found under [External Dependencies](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.10.md#external-dependencies) in the Kubernetes release CHANGELOG.md.
-
-### How can I access nodes created by Rancher?
-
-SSH keys to access the nodes created by Rancher can be downloaded via the **Nodes** view. Choose the node which you want to access and click on the vertical &#8942; button at the end of the row, and choose **Download Keys** as shown in the picture below.
-
-![Download Keys]({{<baseurl>}}/img/rancher/downloadsshkeys.png)
-
-Unzip the downloaded zip file, and use the file `id_rsa` to connect to you host. Be sure to use the correct username (`rancher` or `docker` for RancherOS, `ubuntu` for Ubuntu, `ec2-user` for Amazon Linux)
-
-```
-$ ssh -i id_rsa user@ip_of_node
-```
-
-### How can I automate task X in Rancher?
-
-The UI consists of static files, and works based on responses of the API. That means every action/task that you can execute in the UI, can be automated via the API. There are 2 ways to do this:
-
-* Visit `https://your_rancher_ip/v3` and browse the API options.
-* Capture the API calls when using the UI (Most commonly used for this is [Chrome Developer Tools](https://developers.google.com/web/tools/chrome-devtools/#network) but you can use anything you like)
-
-### The IP address of a node changed, how can I recover?
-
-A node is required to have a static IP configured (or a reserved IP via DHCP). If the IP of a node has changed, you will have to remove it from the cluster and readd it. After it is removed, Rancher will update the cluster to the correct state. If the cluster is no longer in `Provisioning` state, the node is removed from the cluster.
-
-When the IP address of the node changed, Rancher lost connection to the node, so it will be unable to clean the node properly. See [Cleaning cluster nodes]({{<baseurl>}}/rancher/v2.x/en/faq/cleaning-cluster-nodes/) to clean the node.
-
-When the node is removed from the cluster, and the node is cleaned, you can readd the node to the cluster.
-
-### How can I add additional arguments/binds/environment variables to Kubernetes components in a Rancher Launched Kubernetes cluster?
-
-You can add additional arguments/binds/environment variables via the [Config File]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#config-file) option in Cluster Options. For more information, see the [Extra Args, Extra Binds, and Extra Environment Variables]({{<baseurl>}}/rke/latest/en/config-options/services/services-extras/) in the RKE documentation or browse the [Example Cluster.ymls]({{<baseurl>}}/rke/latest/en/example-yamls/).
-
-### How do I check if my certificate chain is valid?
-
-Use the `openssl verify` command to validate your certificate chain:
-
->**Note:** Configure `SSL_CERT_DIR` and `SSL_CERT_FILE` to a dummy location to make sure the OS installed certificates are not used when verifying manually.
-
-```
-SSL_CERT_DIR=/dummy SSL_CERT_FILE=/dummy openssl verify -CAfile ca.pem rancher.yourdomain.com.pem
-rancher.yourdomain.com.pem: OK
-```
-
-If you receive the error `unable to get local issuer certificate`, the chain is incomplete. This usually means that there is an intermediate CA certificate that issued your server certificate. If you already have this certificate, you can use it in the verification of the certificate like shown below:
-
-```
-SSL_CERT_DIR=/dummy SSL_CERT_FILE=/dummy openssl verify -CAfile ca.pem -untrusted intermediate.pem rancher.yourdomain.com.pem
-rancher.yourdomain.com.pem: OK
-```
-
-If you have successfully verified your certificate chain, you should include needed intermediate CA certificates in the server certificate to complete the certificate chain for any connection made to Rancher (for example, by the Rancher agent). The order of the certificates in the server certificate file should be first the server certificate itself (contents of `rancher.yourdomain.com.pem`), followed by intermediate CA certificate(s) (contents of `intermediate.pem`).
-
-```
------BEGIN CERTIFICATE-----
-%YOUR_CERTIFICATE%
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-%YOUR_INTERMEDIATE_CERTIFICATE%
------END CERTIFICATE-----
-```
-
-If you still get errors during verification, you can retrieve the subject and the issuer of the server certificate using the following command:
-
-```
-openssl x509 -noout -subject -issuer -in rancher.yourdomain.com.pem
-subject= /C=GB/ST=England/O=Alice Ltd/CN=rancher.yourdomain.com
-issuer= /C=GB/ST=England/O=Alice Ltd/CN=Alice Intermediate CA
-```
-
-### How do I check `Common Name` and `Subject Alternative Names` in my server certificate?
-
-Although technically an entry in `Subject Alternative Names` is required, having the hostname in both `Common Name` and as entry in `Subject Alternative Names` gives you maximum compatibility with older browser/applications.
-
-Check `Common Name`:
-
-```
-openssl x509 -noout -subject -in cert.pem
-subject= /CN=rancher.my.org
-```
-
-Check `Subject Alternative Names`:
-
-```
-openssl x509 -noout -in cert.pem -text | grep DNS
-                DNS:rancher.my.org
-```
-
-### Why does it take 5+ minutes for a pod to be rescheduled when a node has failed?
-
-This is due to a combination of the following default Kubernetes settings:
-
-* kubelet
-  * `node-status-update-frequency`: Specifies how often kubelet posts node status to master (default 10s)
-* kube-controller-manager
-  * `node-monitor-period`: The period for syncing NodeStatus in NodeController (default 5s)
-  * `node-monitor-grace-period`: Amount of time which we allow running Node to be unresponsive before marking it unhealthy (default 40s)
-  * `pod-eviction-timeout`: The grace period for deleting pods on failed nodes (default 5m0s)
-
-See [Kubernetes: kubelet](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/) and [Kubernetes: kube-controller-manager](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/) for more information on these settings.
-
-In Kubernetes v1.13, the `TaintBasedEvictions` feature is enabled by default. See [Kubernetes: Taint based Evictions](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/#taint-based-evictions) for more information.
-
-* kube-apiserver (Kubernetes v1.13 and up)
-  * `default-not-ready-toleration-seconds`: Indicates the tolerationSeconds of the toleration for notReady:NoExecute that is added by default to every pod that does not already have such a toleration.
-  * `default-unreachable-toleration-seconds`: Indicates the tolerationSeconds of the toleration for unreachable:NoExecute that is added by default to every pod that does not already have such a toleration.
-
-### Can I use keyboard shortcuts in the UI?
-
-Yes, most parts of the UI can be reached using keyboard shortcuts. For an overview of the available shortcuts, press `?` anywhere in the UI.
diff --git a/content/rancher/v2.5/en/faq/security/_index.md b/content/rancher/v2.5/en/faq/security/_index.md
deleted file mode 100644
index f9d6ec86452..00000000000
--- a/content/rancher/v2.5/en/faq/security/_index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: Security
-weight: 8007
-
----
-
-**Is there a Hardening Guide?**
-
-The Hardening Guide is now located in the main [Security]({{<baseurl>}}/rancher/v2.x/en/security/) section.
-
-<br>
-
-**What are the results of Rancher's Kubernetes cluster when it is CIS benchmarked?**
-
-We have run the CIS Kubernetes benchmark against a hardened Rancher Kubernetes cluster.  The results of that assessment can be found in the main [Security]({{<baseurl>}}/rancher/v2.x/en/security/) section.
diff --git a/content/rancher/v2.5/en/faq/telemetry/_index.md b/content/rancher/v2.5/en/faq/telemetry/_index.md
deleted file mode 100644
index 6ab582667e1..00000000000
--- a/content/rancher/v2.5/en/faq/telemetry/_index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Telemetry
-weight: 8008
----
-
-### What is Telemetry?
-
-Telemetry collects aggregate information about the size of Rancher installations, versions of components used, and which features are used.  This information is used by Rancher Labs to help make the product better and is not shared with third-parties.
-
-### What information is collected?
-
-No specific identifying information like usernames, passwords, or the names or addresses of user resources will ever be collected.
-
-The primary things collected include:
-
-  - Aggregate counts (smallest, average, largest, total) of nodes per-cluster and their size (e.g. CPU cores & RAM).
-  - Aggregate counts of logical resources like Clusters, Projects, Namespaces, and Pods.
-  - Counts of what driver was used to deploy clusters and nodes (e.g. GKE vs EC2 vs Imported vs Custom).
-  - Versions of Kubernetes components, Operating Systems and Docker that are deployed on nodes.
-  - Whether some optional components are enabled or not (e.g. which auth providers are used).
-  - The image name & version of Rancher that is running.
-  - A unique randomly-generated identifier for this installation.
-
-### Can I see the information that is being sent?
-
-If Telemetry is enabled, you can go to `https://<your rancher server>/v1-telemetry` in your installation to see the current data.
-
-If Telemetry is not enabled, the process that collects the data is not running, so there is nothing being collected to look at.
-
-### How do I turn it on or off?
-
-After initial setup, an administrator can go to the `Settings` page in the `Global` section of the UI and click Edit to change the `telemetry-opt` setting to either `in` or `out`.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
deleted file mode 100644
index 03c104d537c..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/_index.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-title: Install on a Kubernetes Cluster
-description: Learn how to install Rancher in development and production environments. Read about single node and high availability installation
-weight: 3
----
-
-> This section is under construction.
-
-Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to set up a Rancher Kubernetes cluster that has the Rancher server Helm chart installed.
-
-There are two main ways that Rancher can be installed:
-
-1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
-2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
-
-The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
-
-This section focuses on the installation path in which the Rancher Helm chart is installed on an existing Kubernetes cluster.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/_index.md
deleted file mode 100644
index df088c803ec..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/_index.md
+++ /dev/null
@@ -1,274 +0,0 @@
----
-title: Install
-weight: 1
----
-
-> **Prerequisite:**
-> Set up the Rancher Kubernetes cluster. Rancher can be installed on any Kubernetes cluster.
->
-> This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
-
-# Install the Rancher Helm Chart
-
-Rancher is installed using the Helm package manager for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents.
-
-With Helm, we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at https://helm.sh/.
-
-For systems without direct internet access, see [Air Gap: Kubernetes install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/).
-
-To choose a Rancher version to install, refer to [Choosing a Rancher Version.]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags)
-
-To choose a version of Helm to install Rancher with, refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version)
-
-> **Note:** The installation instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older installation instructions for Rancher installed on an RKE Kubernetes cluster with Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
-
-To set up Rancher,
-
-1. [Install the required CLI tools](#1-install-the-required-cli-tools)
-2. [Add the Helm chart repository](#2-add-the-helm-chart-repository)
-3. [Create a namespace for Rancher](#3-create-a-namespace-for-rancher)
-4. [Choose your SSL configuration](#4-choose-your-ssl-configuration)
-5. [Install cert-manager](#5-install-cert-manager) (unless you are bringing your own certificates, or TLS will be terminated on a load balancer)
-6. [Install Rancher with Helm and your chosen certificate option](#6-install-rancher-with-helm-and-your-chosen-certificate-option)
-7. [Verify that the Rancher server is successfully deployed](#7-verify-that-the-rancher-server-is-successfully-deployed)
-8. [Save your options](#8-save-your-options)
-
-### 1. Install the Required CLI Tools
-
-The following CLI tools are required for setting up the Kubernetes cluster. Please make sure these tools are installed and available in your `$PATH`.
-
-Refer to the [instructions provided by the Helm project](https://helm.sh/docs/intro/install/) for your specific platform.
-
-- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool.
-- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-### 2. Add the Helm Chart Repository
-
-Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-
-{{< release-channel >}}
-
-```
-helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-```
-
-### 3. Create a Namespace for Rancher
-
-We'll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be `cattle-system`:
-
-```
-kubectl create namespace cattle-system
-```
-
-### 4. Choose your SSL Configuration
-
-The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
-
-> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
-
-There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
-
-- **Rancher-generated TLS certificate:** In this case, you will need to install `cert-manager` into the cluster. Rancher utilizes `cert-manager` to issue and maintain its certificates. Rancher will generate a CA certificate of its own, and sign a cert using that CA. `cert-manager` is then responsible for managing that certificate.
-- **Let's Encrypt:** The Let's Encrypt option also uses `cert-manager`. However, in this case, cert-manager is combined with a special Issuer for Let's Encrypt that performs all actions (including request and validation) necessary for getting a Let's Encrypt issued cert. This configuration uses HTTP validation (`HTTP-01`), so the load balancer must have a public DNS record and be accessible from the internet.
-- **Bring your own certificate:** This option allows you to bring your own public- or private-CA signed certificate. Rancher will use that certificate to secure websocket and HTTPS traffic. In this case, you must upload this certificate (and associated key) as PEM-encoded files with the name `tls.crt` and `tls.key`. If you are using a private CA, you must also upload that certificate. This is due to the fact that this private CA may not be trusted by your nodes. Rancher will take that CA certificate, and generate a checksum from it, which the various Rancher components will use to validate their connection to Rancher.
-
-
-| Configuration                  | Helm Chart Option           | Requires cert-manager                 |
-| ------------------------------ | ----------------------- | ------------------------------------- |
-| Rancher Generated Certificates (Default) | `ingress.tls.source=rancher`  | [yes](#5-install-cert-manager) |
-| Let’s Encrypt                  | `ingress.tls.source=letsEncrypt`  | [yes](#5-install-cert-manager) |
-| Certificates from Files        | `ingress.tls.source=secret`        | no               |
-
-### 5. Install cert-manager
-
-> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination). 
-
-This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`).
-
-{{% accordion id="cert-manager" label="Click to Expand" %}}
-
-> **Important:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-These instructions are adapted from the [official cert-manager documentation](https://cert-manager.io/docs/installation/kubernetes/#installing-with-helm).
-
-```
-# Install the CustomResourceDefinition resources separately
-kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.0/cert-manager.crds.yaml
-
-# **Important:**
-# If you are running Kubernetes v1.15 or below, you
-# will need to add the `--validate=false` flag to your
-# kubectl apply command, or else you will receive a
-# validation error relating to the
-# x-kubernetes-preserve-unknown-fields field in
-# cert-manager’s CustomResourceDefinition resources.
-# This is a benign error and occurs due to the way kubectl
-# performs resource validation.
-
-# Create the namespace for cert-manager
-kubectl create namespace cert-manager
-
-# Add the Jetstack Helm repository
-helm repo add jetstack https://charts.jetstack.io
-
-# Update your local Helm chart repository cache
-helm repo update
-
-# Install the cert-manager Helm chart
-helm install \
-  cert-manager jetstack/cert-manager \
-  --namespace cert-manager \
-  --version v0.15.0
-```
-
-Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
-
-```
-kubectl get pods --namespace cert-manager
-
-NAME                                       READY   STATUS    RESTARTS   AGE
-cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
-cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
-cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m
-```
-
-{{% /accordion %}}
-
-### 6. Install Rancher with Helm and Your Chosen Certificate Option
-
-The exact command to install Rancher differs depending on the certificate configuration.
-
-{{% tabs %}}
-{{% tab "Rancher-generated Certificates" %}}
-
-
-The default is for Rancher to generate a CA and uses `cert-manager` to issue the certificate for access to the Rancher server interface.
-
-Because `rancher` is the default option for `ingress.tls.source`, we are not specifying `ingress.tls.source` when running the `helm install` command.
-
-- Set the `hostname` to the DNS name you pointed at your load balancer.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`
-
-```
-helm install rancher rancher-<CHART_REPO>/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-{{% /tab %}}
-{{% tab "Let's Encrypt" %}}
-
-This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA.
-
-In the following command,
-
-- `hostname` is set to the public DNS record,
-- `ingress.tls.source` is set to `letsEncrypt`
-- `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices)
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher rancher-<CHART_REPO>/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=letsEncrypt \
-  --set letsEncrypt.email=me@example.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-{{% /tab %}}
-{{% tab "Certificates from Files" %}}
-In this option, Kubernetes secrets are created from your own certificates for Rancher to use.
-
-When you run this command, the `hostname` option must match the `Common Name` or a `Subject Alternative Names` entry in the server certificate or the Ingress controller will fail to configure correctly.
-
-Although an entry in the `Subject Alternative Names` is technically required, having a matching `Common Name` maximizes compatibility with older browsers and applications.
-
-> If you want to check if your certificates are correct, see [How do I check Common Name and Subject Alternative Names in my server certificate?]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-do-i-check-common-name-and-subject-alternative-names-in-my-server-certificate)
-
-- Set the `hostname`.
-- Set `ingress.tls.source` to `secret`.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher rancher-<CHART_REPO>/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret
-```
-
-If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
-
-```
-helm install rancher rancher-latest/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret \
-  --set privateCA=true
-```
-
-Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the Ingress controller can use them.
-{{% /tab %}}
-{{% /tabs %}}
-
-The Rancher chart configuration has many options for customizing the installation to suit your specific environment. Here are some common advanced scenarios.
-
-- [HTTP Proxy]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#http-proxy)
-- [Private Docker Image Registry]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#private-registry-and-air-gap-installs)
-- [TLS Termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
-
-See the [Chart Options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/) for the full list of options.
-
-
-### 7. Verify that the Rancher Server is Successfully Deployed
-
-After adding the secrets, check if Rancher was rolled out successfully:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-If you see the following error: `error: deployment "rancher" exceeded its progress deadline`, you can check the status of the deployment by running the following command:
-
-```
-kubectl -n cattle-system get deploy rancher
-NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
-rancher   3         3         3            3           3m
-```
-
-It should show the same count for `DESIRED` and `AVAILABLE`.
-
-### 8. Save Your Options
-
-Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
-
-### Finishing Up
-
-That's it. You should have a functional Rancher server.
-
-In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
-
-Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) Page
-
-
-### Optional Next Steps
-
-Enable the Enterprise Cluster Manager.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
deleted file mode 100644
index 0cb9130abd5..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/chart-options/_index.md
+++ /dev/null
@@ -1,255 +0,0 @@
----
-title: Helm Chart Options
-weight: 2
----
-
-> This page is under construction.
-
-- [Common Options](#common-options)
-- [Advanced Options](#advanced-options)
-- [API Audit Log](#api-audit-log)
-- [Setting Extra Environment Variables](#setting-extra-environment-variables)
-- [TLS Settings](#tls-settings)
-- [Import local Cluster](#import-local-cluster)
-- [Customizing your Ingress](#customizing-your-ingress)
-- [HTTP Proxy](#http-proxy)
-- [Additional Trusted CAs](#additional-trusted-cas)
-- [Private Registry and Air Gap Installs](#private-registry-and-air-gap-installs)
-- [External TLS Termination](#external-tls-termination)
-
-### Common Options
-
-| Option                    | Default Value | Description                                                                        |
-| ------------------------- | ------------- | ---------------------------------------------------------------------------------- |
-| `hostname`                | " "           | `string` - the Fully Qualified Domain Name for your Rancher Server                 |
-| `ingress.tls.source`      | "rancher"     | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
-| `letsEncrypt.email`       | " "           | `string` - Your email address                                                      |
-| `letsEncrypt.environment` | "production"  | `string` - Valid options: "staging, production"                                    |
-| `privateCA`               | false         | `bool` - Set to true if your cert is signed by a private CA                        |
-
-<br/>
-
-### Advanced Options
-
-| Option                         | Default Value                                         | Description                                                                                                                                       |
-| ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `additionalTrustedCAs`         | false                                                 | `bool` - See [Additional Trusted CAs](#additional-trusted-cas)                                                                                    |
-| `addLocal`                     | "auto"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster)                       |
-| `antiAffinity`                 | "preferred"                                           | `string` - AntiAffinity rule for Rancher pods - "preferred, required"                                                                             |
-| `replicas`                     | 3                                                     | `int` - Number of replicas of Rancher pods                                                                                                        |
-| `auditLog.destination`         | "sidecar"                                             | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath"                                                           |
-| `auditLog.hostPath`            | "/var/log/rancher/audit"                              | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`)                                           |
-| `auditLog.level`               | 0                                                     | `int` - set the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) level. 0 is off. [0-3]                                   |
-| `auditLog.maxAge`              | 1                                                     | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`)                      |
-| `auditLog.maxBackups`          | 1                                                     | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`)                               |
-| `auditLog.maxSize`             | 100                                                   | `int` - maximum size in megabytes of the audit log file before it gets rotated (only applies when `auditLog.destination` is set to `hostPath`)    |
-| `busyboxImage`                 | "busybox"                                             | `string` - Image location for busybox image used to collect audit logs _Note: Available as of v2.2.0_                                             |
-| `debug`                        | false                                                 | `bool` - set debug flag on rancher server                                                                                                         |
-| `certmanager.version`          | ""                                                    | `string` - set cert-manager compatibility                                                                                                         |
-| `extraEnv`                     | []                                                    | `list` - set additional environment variables for Rancher _Note: Available as of v2.2.0_                                                          |
-| `imagePullSecrets`             | []                                                    | `list` - list of names of Secret resource containing private registry credentials                                                                 |
-| `ingress.extraAnnotations`     | {}                                                    | `map` - additional annotations to customize the ingress                                                                                           |
-| `ingress.configurationSnippet` | ""                                                    | `string` - Add additional Nginx configuration. Can be used for proxy configuration. _Note: Available as of v2.0.15, v2.1.10 and v2.2.4_           |
-| `letsEncrypt.ingress.class`    | ""                                                    | `string` - optional ingress class for the cert-manager acmesolver ingress that responds to the Let's Encrypt ACME challenges                      |
-| `proxy`                        | ""                                                    | `string` - HTTP[S] proxy server for Rancher                                                                                                       |
-| `noProxy`                      | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" | `string` - comma separated list of hostnames or ip address not to use the proxy                                                                   |
-| `resources`                    | {}                                                    | `map` - rancher pod resource requests & limits                                                                                                    |
-| `rancherImage`                 | "rancher/rancher"                                     | `string` - rancher image source                                                                                                                   |
-| `rancherImageTag`              | same as chart version                                 | `string` - rancher/rancher image tag                                                                                                              |
-| `rancherImagePullPolicy`       | "IfNotPresent"                                        | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent"                                                 |
-| `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
-| `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/                   |
-| `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations.  |
-
-<br/>
-
-### API Audit Log
-
-Enabling the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing/).
-
-You can collect this log as you would any container log. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the `System` Project on the Rancher server cluster.
-
-```plain
---set auditLog.level=1
-```
-
-By default enabling Audit Logging will create a sidecar container in the Rancher pod. This container (`rancher-audit-log`) will stream the log to `stdout`. You can collect this log as you would any container log. When using the sidecar as the audit log destination, the `hostPath`, `maxAge`, `maxBackups`, and `maxSize` options do not apply. It's advised to use your OS or Docker daemon's log rotation features to control disk space use. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the Rancher server cluster or System Project.
-
-Set the `auditLog.destination` to `hostPath` to forward logs to volume shared with the host system instead of streaming to a sidecar container. When setting the destination to `hostPath` you may want to adjust the other auditLog parameters for log rotation.
-
-### Setting Extra Environment Variables
-
-You can set extra environment variables for Rancher server using `extraEnv`. This list uses the same `name` and `value` keys as the container manifest definitions. Remember to quote the values.
-
-```plain
---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
---set 'extraEnv[0].value=1.0'
-```
-
-### TLS Settings
-
-To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
-
-```plain
---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
---set 'extraEnv[0].value=1.0'
-```
-
-See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options.
-
-### Import `local` Cluster
-
-By default Rancher server will detect and import the `local` cluster it's running on. User with access to the `local` cluster will essentially have "root" access to all the clusters managed by Rancher server.
-
-If this is a concern in your environment you can set this option to "false" on your initial install.
-
-> Note: This option is only effective on the initial Rancher install. See [Issue 16522](https://github.com/rancher/rancher/issues/16522) for more information.
-
-```plain
---set addLocal="false"
-```
-
-### Customizing your Ingress
-
-To customize or use a different ingress with Rancher server you can set your own Ingress annotations.
-
-Example on setting a custom certificate issuer:
-
-```plain
---set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair
-```
-
-Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used.
-
-```plain
---set ingress.configurationSnippet='more_set_input_headers X-Forwarded-Host {{ .Values.hostname }};'
-```
-
-### HTTP Proxy
-
-Rancher requires internet access for some functionality (helm charts). Use `proxy` to set your proxy server.
-
-Add your IP exceptions to the `noProxy` list. Make sure you add the Service cluster IP range (default: 10.43.0.1/16) and any worker cluster `controlplane` nodes. Rancher supports CIDR notation ranges in this list.
-
-```plain
---set proxy="http://<username>:<password>@<proxy_url>:<proxy_port>/"
---set noProxy="127.0.0.0/8\,10.0.0.0/8\,172.16.0.0/12\,192.168.0.0/16"
-```
-
-### Additional Trusted CAs
-
-If you have private registries, catalogs or a proxy that intercepts certificates, you may need to add additional trusted CAs to Rancher.
-
-```plain
---set additionalTrustedCAs=true
-```
-
-Once the Rancher deployment is created, copy your CA certs in pem format into a file named `ca-additional.pem` and use `kubectl` to create the `tls-ca-additional` secret in the `cattle-system` namespace.
-
-```plain
-kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem
-```
-
-### Private Registry and Air Gap Installs
-
-For details on installing Rancher with a private registry, see:
-
-- [Air Gap: Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/)
-- [Air Gap: Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/)
-
-### External TLS Termination
-
-We recommend configuring your load balancer as a Layer 4 balancer, forwarding plain 80/tcp and 443/tcp to the Rancher Management cluster nodes. The Ingress Controller on the cluster will redirect http traffic on port 80 to https on port 443.
-
-You may terminate the SSL/TLS on a L7 load balancer external to the Rancher cluster (ingress). Use the `--set tls=external` option and point your load balancer at port http 80 on all of the Rancher cluster nodes. This will expose the Rancher interface on http port 80. Be aware that clients that are allowed to connect directly to the Rancher cluster will not be encrypted. If you choose to do this we recommend that you restrict direct access at the network level to just your load balancer.
-
-> **Note:** If you are using a Private CA signed certificate, add `--set privateCA=true` and see [Adding TLS Secrets - Using a Private CA Signed Certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/#using-a-private-ca-signed-certificate) to add the CA cert for Rancher.
-
-Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly.
-
-#### Configuring Ingress for External TLS when Using NGINX v0.25
-
-In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress:
-
-```yaml
-ingress:
-  provider: nginx
-  options:
-    use-forwarded-headers: 'true'
-```
-
-#### Required Headers
-
-- `Host`
-- `X-Forwarded-Proto`
-- `X-Forwarded-Port`
-- `X-Forwarded-For`
-
-#### Recommended Timeouts
-
-- Read Timeout: `1800 seconds`
-- Write Timeout: `1800 seconds`
-- Connect Timeout: `30 seconds`
-
-#### Health Checks
-
-Rancher will respond `200` to health checks on the `/healthz` endpoint.
-
-#### Example NGINX config
-
-This NGINX configuration is tested on NGINX 1.14.
-
-> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/).
-
-- Replace `IP_NODE1`, `IP_NODE2` and `IP_NODE3` with the IP addresses of the nodes in your cluster.
-- Replace both occurrences of `FQDN` to the DNS name for Rancher.
-- Replace `/certs/fullchain.pem` and `/certs/privkey.pem` to the location of the server certificate and the server certificate key respectively.
-
-```
-worker_processes 4;
-worker_rlimit_nofile 40000;
-
-events {
-    worker_connections 8192;
-}
-
-http {
-    upstream rancher {
-        server IP_NODE_1:80;
-        server IP_NODE_2:80;
-        server IP_NODE_3:80;
-    }
-
-    map $http_upgrade $connection_upgrade {
-        default Upgrade;
-        ''      close;
-    }
-
-    server {
-        listen 443 ssl http2;
-        server_name FQDN;
-        ssl_certificate /certs/fullchain.pem;
-        ssl_certificate_key /certs/privkey.pem;
-
-        location / {
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass http://rancher;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
-            proxy_read_timeout 900s;
-            proxy_buffering off;
-        }
-    }
-
-    server {
-        listen 80;
-        server_name FQDN;
-        return 301 https://$server_name$request_uri;
-    }
-}
-```
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/choosing-version/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/choosing-version/_index.md
deleted file mode 100644
index 36edeae1f5a..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/choosing-version/_index.md
+++ /dev/null
@@ -1,91 +0,0 @@
----
-title: Choosing a Rancher Version
-weight: 1
----
-
-This section describes how to choose a Rancher version.
-
-For a high-availability installation of Rancher, which is recommended for production, the Rancher server is installed using a **Helm chart** on a Kubernetes cluster. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-For Docker installations of Rancher, which is used for development and testing, you will install Rancher as a **Docker image.**
-
-{{% tabs %}}
-{{% tab "Helm Charts" %}}
-
-When installing, upgrading, or rolling back Rancher Server when it is [installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/), Rancher server is installed using a Helm chart on a Kubernetes cluster. Therefore, as you prepare to install or upgrade a high availability Rancher configuration, you must add a Helm chart repository that contains the charts for installing Rancher.
-
-Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-### Helm Chart Repositories
-
-Rancher provides several different Helm chart repositories to choose from. We align our latest and stable Helm chart repositories with the Docker tags that are used for a Docker installation. Therefore, the `rancher-latest` repository will contain charts for all the Rancher versions that have been tagged as `rancher/rancher:latest`. When a Rancher version has been promoted to the `rancher/rancher:stable`, it will get added to the `rancher-stable` repository.
-
-| Type           | Command to Add the Repo                                                          | Description of the Repo            |
-| -------------- | ------------ | ----------------- |
-| rancher-latest | `helm repo add rancher-latest https://releases.rancher.com/server-charts/latest` | Adds a repository of Helm charts for the latest versions of Rancher. We recommend using this repo for testing out new Rancher builds.                                                                                                                                                      |
-| rancher-stable | `helm repo add rancher-stable https://releases.rancher.com/server-charts/stable` | Adds a repository of Helm charts for older, stable versions of Rancher. We recommend using this repo for production environments.                                                                                                                                                          |
-| rancher-alpha  | `helm repo add rancher-alpha https://releases.rancher.com/server-charts/alpha`   | Adds a repository of Helm charts for alpha versions of Rancher for previewing upcoming releases. These releases are discouraged in production environments. Upgrades _to_ or _from_ charts in the rancher-alpha repository to any other chart, regardless or repository, aren't supported. |
-
-<br/>
-Instructions on when to select these repos are available below in [Switching to a Different Helm Chart Repository](#switching-to-a-different-helm-chart-repository).
-
-> **Note:** The introduction of the `rancher-latest` and `rancher-stable` Helm Chart repositories was introduced after Rancher v2.1.0, so the `rancher-stable` repository contains some Rancher versions that were never marked as `rancher/rancher:stable`. The versions of Rancher that were tagged as `rancher/rancher:stable` prior to v2.1.0 are v2.0.4, v2.0.6, v2.0.8. Post v2.1.0, all charts in the `rancher-stable` repository will correspond with any Rancher version tagged as `stable`.
-
-### Helm Chart Versions
-
-Rancher Helm chart versions match the Rancher version (i.e `appVersion`).
-
-For the Rancher v2.1.x versions, there were some Helm charts, that were using a version that was a build number, i.e. `yyyy.mm.<build-number>`. These charts have been replaced with the equivalent Rancher version and are no longer available.
-
-### Switching to a Different Helm Chart Repository
-
-After installing Rancher, if you want to change which Helm chart repository to install Rancher from, you will need to follow these steps.
-
-> **Note:** Because the rancher-alpha repository contains only alpha charts, switching between the rancher-alpha repository and the rancher-stable or rancher-latest repository for upgrades is not supported.
-
-{{< release-channel >}}
-
-1. List the current Helm chart repositories.
-
-    ```plain
-    helm repo list
-
-    NAME          	      URL
-    stable        	      https://kubernetes-charts.storage.googleapis.com
-    rancher-<CHART_REPO>		https://releases.rancher.com/server-charts/<CHART_REPO>
-    ```
-
-2. Remove the existing Helm Chart repository that contains your charts to install Rancher, which will either be `rancher-stable` or `rancher-latest` depending on what you had initially added.
-
-    ```plain
-    helm repo remove rancher-<CHART_REPO>
-    ```
-
-3. Add the Helm chart repository that you want to start installing Rancher from.
-
-    ```plain
-    helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-    ```
-
-4. Continue to follow the steps to [upgrade Rancher]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade-helm/) from the new Helm chart repository.
-{{% /tab %}}
-{{% tab "Docker Images" %}}
-When performing [Docker installs]({{<baseurl>}}/rancher/v2.x/en/installation/single-node), upgrades, or rollbacks, you can use _tags_ to install a specific version of Rancher.
-
-### Server Tags
-
-Rancher Server is distributed as a Docker image, which have tags attached to them. You can specify this tag when entering the command to deploy Rancher. Remember that if you use a tag without an explicit version (like `latest` or `stable`), you must explicitly pull a new version of that image tag. Otherwise, any image cached on the host will be used.
-
-| Tag                        | Description   |
-| -------------------------- | ------ |
-| `rancher/rancher:latest`   | Our latest development release. These builds are validated through our CI automation framework. These releases are not recommended for production environments. |
-| `rancher/rancher:stable`   | Our newest stable release. This tag is recommended for production.                                                                                              |
-| `rancher/rancher:<v2.X.X>` | You can install specific versions of Rancher by using the tag from a previous release. See what's available at DockerHub.                                       |
-
-> **Notes:**
->
-> - The `master` tag or any tag with `-rc` or another suffix is meant for the Rancher testing team to validate. You should not use these tags, as these builds are not officially supported.
-> - Want to install an alpha review for preview? Install using one of the alpha tags listed on our [announcements page](https://forums.rancher.com/c/announcements) (e.g., `v2.2.0-alpha1`). Caveat: Alpha releases cannot be upgraded to or from any other release.
-
-{{% /tab %}} 
-{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/helm-version/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/helm-version/_index.md
deleted file mode 100644
index 3a91781871a..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/helm-version/_index.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Helm Version Requirements
-weight: 3
----
-
-This section contains the requirements for Helm, which is the tool used to install Rancher on a high-availability Kubernetes cluster.
-
-> The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
-
-- Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using.
-- Helm v2.15.0 should not be used, because of an issue with converting/comparing numbers.
-- Helm v2.12.0 should not be used, because of an issue with `cert-manager`.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/_index.md
deleted file mode 100644
index 5743469d2de..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/_index.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Resources and Other Installation Methods
-weight: 3
----
-
-> This section is under construction.
-
-### Docker Installations
-
-The [single-node Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster using Helm, you install the Rancher server component on a single node using a `docker run` command.
-
-Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server.
-
-### Air Gapped Installations
-
-Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) to install the Rancher server in an air gapped environment.
-
-An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
-
-### Advanced Options
-
-When installing Rancher, there are several advanced options that can be enabled during installation. Within each install guide, these options are presented. Learn more about these options:
-
-| Advanced Option                                                                                                         | Available as of |
-| ----------------------------------------------------------------------------------------------------------------------- | --------------- |
-| [Custom CA Certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/custom-ca-root-certificate/)                 | v2.0.0          |
-| [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/options/api-audit-log/)                                      | v2.0.0          |
-| [TLS Settings]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-settings/)                                        | v2.1.7          |
-| [etcd configuration]({{<baseurl>}}/rancher/v2.x/en/installation/options/etcd/)                                          | v2.2.0          |
-| [Local System Charts for Air Gap Installations]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts) | v2.3.0          |
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/_index.md
deleted file mode 100644
index 6087cf17317..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Advanced
-weight: 5
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/api-audit-log/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/api-audit-log/_index.md
deleted file mode 100644
index d68051fc7bb..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/api-audit-log/_index.md
+++ /dev/null
@@ -1,577 +0,0 @@
----
-title: Enabling the API Audit Log to Record System Events
-weight: 4
----
-
-You can enable the API audit log to record the sequence of system events initiated by individual users. You can know what happened, when it happened, who initiated it, and what cluster it affected. When you enable this feature, all requests to the Rancher API and all responses from it are written to a log.
-
-You can enable API Auditing during Rancher installation or upgrade.
-
-## Enabling API Audit Log
-
-The Audit Log is enabled and configured by passing environment variables to the Rancher server container. See the following to enable on your installation.
-
-- [Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#api-audit-log)
-
-- [Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#api-audit-log)
-
-## API Audit Log Options
-
-The usage below defines rules about what the audit log should record and what data it should include:
-
-| Parameter                             | Description                                                                                                                                                                                                                                                                                                                                                                    |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| <a id="audit-level"></a>`AUDIT_LEVEL` | `0` - Disable audit log (default setting).<br/>`1` - Log event metadata.<br/>`2` - Log event metadata and request body.</br>`3` - Log event metadata, request body, and response body. Each log transaction for a request/response pair uses the same `auditID` value.<br/><br/>See [Audit Level Logging](#audit-log-levels) for a table that displays what each setting logs. |
-| `AUDIT_LOG_PATH`                      | Log path for Rancher Server API. Default path is `/var/log/auditlog/rancher-api-audit.log`. You can mount the log directory to host. <br/><br/>Usage Example: `AUDIT_LOG_PATH=/my/custom/path/`<br/>                                                                                                                                                                           |
-| `AUDIT_LOG_MAXAGE`                    | Defined the maximum number of days to retain old audit log files. Default is 10 days.                                                                                                                                                                                                                                                                                          |
-| `AUDIT_LOG_MAXBACKUP`                 | Defines the maximum number of audit log files to retain. Default is 10.                                                                                                                                                                                                                                                                                                        |
-| `AUDIT_LOG_MAXSIZE`                   | Defines the maximum size in megabytes of the audit log file before it gets rotated. Default size is 100M.                                                                                                                                                                                                                                                                      |
-
-<br/>
-
-### Audit Log Levels
-
-The following table displays what parts of API transactions are logged for each [`AUDIT_LEVEL`](#audit-level) setting.
-
-| `AUDIT_LEVEL` Setting | Request Metadata | Request Body | Response Metadata | Response Body |
-| --------------------- | ---------------- | ------------ | ----------------- | ------------- |
-| `0`                   |                  |              |                   |               |
-| `1`                   | ✓                |              |                   |               |
-| `2`                   | ✓                | ✓            |                   |               |
-| `3`                   | ✓                | ✓            | ✓                 | ✓             |
-
-## Viewing API Audit Logs
-
-### Docker Install
-
-Share the `AUDIT_LOG_PATH` directory (Default: `/var/log/auditlog`) with the host system. The log can be parsed by standard CLI tools or forwarded on to a log collection tool like Fluentd, Filebeat, Logstash, etc.
-
-### Kubernetes Install
-
-Enabling the API Audit Log with the Helm chart install will create a `rancher-audit-log` sidecar container in the Rancher pod. This container will stream the log to standard output (stdout). You can view the log as you would any container log.
-
-The `rancher-audit-log` container is part of the `rancher` pod in the `cattle-system` namespace.
-
-#### CLI
-
-```bash
-kubectl -n cattle-system logs -f rancher-84d886bdbb-s4s69 rancher-audit-log
-```
-
-#### Rancher Web GUI
-
-1. From the context menu, select **Cluster: local > System**.
-
-   ![Local Cluster: System Project]({{<baseurl>}}/img/rancher/audit_logs_gui/context_local_system.png)
-
-1. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Find the `cattle-system` namespace. Open the `rancher` workload by clicking its link.
-
-   ![Rancher Workload]({{<baseurl>}}/img/rancher/audit_logs_gui/rancher_workload.png)
-
-1. Pick one of the `rancher` pods and select **&#8942; > View Logs**.
-
-   ![View Logs]({{<baseurl>}}/img/rancher/audit_logs_gui/view_logs.png)
-
-1. From the **Logs** drop-down, select `rancher-audit-log`.
-
-   ![Select Audit Log]({{<baseurl>}}/img/rancher/audit_logs_gui/rancher_audit_log_container.png)
-
-#### Shipping the Audit Log
-
-You can enable Rancher's built in log collection and shipping for the cluster to ship the audit and other services logs to a supported collection endpoint. See [Rancher Tools - Logging]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging) for details.
-
-## Audit Log Samples
-
-After you enable auditing, each API request or response is logged by Rancher in the form of JSON. Each of the following code samples provide examples of how to identify each API transaction.
-
-### Metadata Level
-
-If you set your `AUDIT_LEVEL` to `1`, Rancher logs the metadata header for every API request, but not the body. The header provides basic information about the API transaction, such as the transaction's ID, who initiated the transaction, the time it occurred, etc.
-
-```json
-{
-  "auditID": "30022177-9e2e-43d1-b0d0-06ef9d3db183",
-  "requestURI": "/v3/schemas",
-  "sourceIPs": ["::1"],
-  "user": {
-    "name": "user-f4tt2",
-    "group": ["system:authenticated"]
-  },
-  "verb": "GET",
-  "stage": "RequestReceived",
-  "stageTimestamp": "2018-07-20 10:22:43 +0800"
-}
-```
-
-### Metadata and Request Body Level
-
-If you set your `AUDIT_LEVEL` to `2`, Rancher logs the metadata header and body for every API request.
-
-The code sample below depicts an API request, with both its metadata header and body.
-
-```json
-{
-  "auditID": "ef1d249e-bfac-4fd0-a61f-cbdcad53b9bb",
-  "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
-  "sourceIPs": ["::1"],
-  "user": {
-    "name": "user-f4tt2",
-    "group": ["system:authenticated"]
-  },
-  "verb": "PUT",
-  "stage": "RequestReceived",
-  "stageTimestamp": "2018-07-20 10:28:08 +0800",
-  "requestBody": {
-    "hostIPC": false,
-    "hostNetwork": false,
-    "hostPID": false,
-    "paused": false,
-    "annotations": {},
-    "baseType": "workload",
-    "containers": [
-      {
-        "allowPrivilegeEscalation": false,
-        "image": "nginx",
-        "imagePullPolicy": "Always",
-        "initContainer": false,
-        "name": "nginx",
-        "ports": [
-          {
-            "containerPort": 80,
-            "dnsName": "nginx-nodeport",
-            "kind": "NodePort",
-            "name": "80tcp01",
-            "protocol": "TCP",
-            "sourcePort": 0,
-            "type": "/v3/project/schemas/containerPort"
-          }
-        ],
-        "privileged": false,
-        "readOnly": false,
-        "resources": {
-          "type": "/v3/project/schemas/resourceRequirements",
-          "requests": {},
-          "limits": {}
-        },
-        "restartCount": 0,
-        "runAsNonRoot": false,
-        "stdin": true,
-        "stdinOnce": false,
-        "terminationMessagePath": "/dev/termination-log",
-        "terminationMessagePolicy": "File",
-        "tty": true,
-        "type": "/v3/project/schemas/container",
-        "environmentFrom": [],
-        "capAdd": [],
-        "capDrop": [],
-        "livenessProbe": null,
-        "volumeMounts": []
-      }
-    ],
-    "created": "2018-07-18T07:34:16Z",
-    "createdTS": 1531899256000,
-    "creatorId": null,
-    "deploymentConfig": {
-      "maxSurge": 1,
-      "maxUnavailable": 0,
-      "minReadySeconds": 0,
-      "progressDeadlineSeconds": 600,
-      "revisionHistoryLimit": 10,
-      "strategy": "RollingUpdate"
-    },
-    "deploymentStatus": {
-      "availableReplicas": 1,
-      "conditions": [
-        {
-          "lastTransitionTime": "2018-07-18T07:34:38Z",
-          "lastTransitionTimeTS": 1531899278000,
-          "lastUpdateTime": "2018-07-18T07:34:38Z",
-          "lastUpdateTimeTS": 1531899278000,
-          "message": "Deployment has minimum availability.",
-          "reason": "MinimumReplicasAvailable",
-          "status": "True",
-          "type": "Available"
-        },
-        {
-          "lastTransitionTime": "2018-07-18T07:34:16Z",
-          "lastTransitionTimeTS": 1531899256000,
-          "lastUpdateTime": "2018-07-18T07:34:38Z",
-          "lastUpdateTimeTS": 1531899278000,
-          "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
-          "reason": "NewReplicaSetAvailable",
-          "status": "True",
-          "type": "Progressing"
-        }
-      ],
-      "observedGeneration": 2,
-      "readyReplicas": 1,
-      "replicas": 1,
-      "type": "/v3/project/schemas/deploymentStatus",
-      "unavailableReplicas": 0,
-      "updatedReplicas": 1
-    },
-    "dnsPolicy": "ClusterFirst",
-    "id": "deployment:default:nginx",
-    "labels": {
-      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-    },
-    "name": "nginx",
-    "namespaceId": "default",
-    "projectId": "c-bcz5t:p-fdr4s",
-    "publicEndpoints": [
-      {
-        "addresses": ["10.64.3.58"],
-        "allNodes": true,
-        "ingressId": null,
-        "nodeId": null,
-        "podId": null,
-        "port": 30917,
-        "protocol": "TCP",
-        "serviceId": "default:nginx-nodeport",
-        "type": "publicEndpoint"
-      }
-    ],
-    "restartPolicy": "Always",
-    "scale": 1,
-    "schedulerName": "default-scheduler",
-    "selector": {
-      "matchLabels": {
-        "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-      },
-      "type": "/v3/project/schemas/labelSelector"
-    },
-    "state": "active",
-    "terminationGracePeriodSeconds": 30,
-    "transitioning": "no",
-    "transitioningMessage": "",
-    "type": "deployment",
-    "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
-    "workloadAnnotations": {
-      "deployment.kubernetes.io/revision": "1",
-      "field.cattle.io/creatorId": "user-f4tt2"
-    },
-    "workloadLabels": {
-      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-    },
-    "scheduling": {
-      "node": {}
-    },
-    "description": "my description",
-    "volumes": []
-  }
-}
-```
-
-### Metadata, Request Body, and Response Body Level
-
-If you set your `AUDIT_LEVEL` to `3`, Rancher logs:
-
-- The metadata header and body for every API request.
-- The metadata header and body for every API response.
-
-#### Request
-
-The code sample below depicts an API request, with both its metadata header and body.
-
-```json
-{
-  "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af",
-  "requestURI": "/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
-  "sourceIPs": ["::1"],
-  "user": {
-    "name": "user-f4tt2",
-    "group": ["system:authenticated"]
-  },
-  "verb": "PUT",
-  "stage": "RequestReceived",
-  "stageTimestamp": "2018-07-20 10:33:06 +0800",
-  "requestBody": {
-    "hostIPC": false,
-    "hostNetwork": false,
-    "hostPID": false,
-    "paused": false,
-    "annotations": {},
-    "baseType": "workload",
-    "containers": [
-      {
-        "allowPrivilegeEscalation": false,
-        "image": "nginx",
-        "imagePullPolicy": "Always",
-        "initContainer": false,
-        "name": "nginx",
-        "ports": [
-          {
-            "containerPort": 80,
-            "dnsName": "nginx-nodeport",
-            "kind": "NodePort",
-            "name": "80tcp01",
-            "protocol": "TCP",
-            "sourcePort": 0,
-            "type": "/v3/project/schemas/containerPort"
-          }
-        ],
-        "privileged": false,
-        "readOnly": false,
-        "resources": {
-          "type": "/v3/project/schemas/resourceRequirements",
-          "requests": {},
-          "limits": {}
-        },
-        "restartCount": 0,
-        "runAsNonRoot": false,
-        "stdin": true,
-        "stdinOnce": false,
-        "terminationMessagePath": "/dev/termination-log",
-        "terminationMessagePolicy": "File",
-        "tty": true,
-        "type": "/v3/project/schemas/container",
-        "environmentFrom": [],
-        "capAdd": [],
-        "capDrop": [],
-        "livenessProbe": null,
-        "volumeMounts": []
-      }
-    ],
-    "created": "2018-07-18T07:34:16Z",
-    "createdTS": 1531899256000,
-    "creatorId": null,
-    "deploymentConfig": {
-      "maxSurge": 1,
-      "maxUnavailable": 0,
-      "minReadySeconds": 0,
-      "progressDeadlineSeconds": 600,
-      "revisionHistoryLimit": 10,
-      "strategy": "RollingUpdate"
-    },
-    "deploymentStatus": {
-      "availableReplicas": 1,
-      "conditions": [
-        {
-          "lastTransitionTime": "2018-07-18T07:34:38Z",
-          "lastTransitionTimeTS": 1531899278000,
-          "lastUpdateTime": "2018-07-18T07:34:38Z",
-          "lastUpdateTimeTS": 1531899278000,
-          "message": "Deployment has minimum availability.",
-          "reason": "MinimumReplicasAvailable",
-          "status": "True",
-          "type": "Available"
-        },
-        {
-          "lastTransitionTime": "2018-07-18T07:34:16Z",
-          "lastTransitionTimeTS": 1531899256000,
-          "lastUpdateTime": "2018-07-18T07:34:38Z",
-          "lastUpdateTimeTS": 1531899278000,
-          "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
-          "reason": "NewReplicaSetAvailable",
-          "status": "True",
-          "type": "Progressing"
-        }
-      ],
-      "observedGeneration": 2,
-      "readyReplicas": 1,
-      "replicas": 1,
-      "type": "/v3/project/schemas/deploymentStatus",
-      "unavailableReplicas": 0,
-      "updatedReplicas": 1
-    },
-    "dnsPolicy": "ClusterFirst",
-    "id": "deployment:default:nginx",
-    "labels": {
-      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-    },
-    "name": "nginx",
-    "namespaceId": "default",
-    "projectId": "c-bcz5t:p-fdr4s",
-    "publicEndpoints": [
-      {
-        "addresses": ["10.64.3.58"],
-        "allNodes": true,
-        "ingressId": null,
-        "nodeId": null,
-        "podId": null,
-        "port": 30917,
-        "protocol": "TCP",
-        "serviceId": "default:nginx-nodeport",
-        "type": "publicEndpoint"
-      }
-    ],
-    "restartPolicy": "Always",
-    "scale": 1,
-    "schedulerName": "default-scheduler",
-    "selector": {
-      "matchLabels": {
-        "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-      },
-      "type": "/v3/project/schemas/labelSelector"
-    },
-    "state": "active",
-    "terminationGracePeriodSeconds": 30,
-    "transitioning": "no",
-    "transitioningMessage": "",
-    "type": "deployment",
-    "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
-    "workloadAnnotations": {
-      "deployment.kubernetes.io/revision": "1",
-      "field.cattle.io/creatorId": "user-f4tt2"
-    },
-    "workloadLabels": {
-      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-    },
-    "scheduling": {
-      "node": {}
-    },
-    "description": "my decript",
-    "volumes": []
-  }
-}
-```
-
-#### Response
-
-The code sample below depicts an API response, with both its metadata header and body.
-
-```json
-{
-  "auditID": "a886fd9f-5d6b-4ae3-9a10-5bff8f3d68af",
-  "responseStatus": "200",
-  "stage": "ResponseComplete",
-  "stageTimestamp": "2018-07-20 10:33:06 +0800",
-  "responseBody": {
-    "actionLinks": {
-      "pause": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=pause",
-      "resume": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=resume",
-      "rollback": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx?action=rollback"
-    },
-    "annotations": {},
-    "baseType": "workload",
-    "containers": [
-      {
-        "allowPrivilegeEscalation": false,
-        "image": "nginx",
-        "imagePullPolicy": "Always",
-        "initContainer": false,
-        "name": "nginx",
-        "ports": [
-          {
-            "containerPort": 80,
-            "dnsName": "nginx-nodeport",
-            "kind": "NodePort",
-            "name": "80tcp01",
-            "protocol": "TCP",
-            "sourcePort": 0,
-            "type": "/v3/project/schemas/containerPort"
-          }
-        ],
-        "privileged": false,
-        "readOnly": false,
-        "resources": {
-          "type": "/v3/project/schemas/resourceRequirements"
-        },
-        "restartCount": 0,
-        "runAsNonRoot": false,
-        "stdin": true,
-        "stdinOnce": false,
-        "terminationMessagePath": "/dev/termination-log",
-        "terminationMessagePolicy": "File",
-        "tty": true,
-        "type": "/v3/project/schemas/container"
-      }
-    ],
-    "created": "2018-07-18T07:34:16Z",
-    "createdTS": 1531899256000,
-    "creatorId": null,
-    "deploymentConfig": {
-      "maxSurge": 1,
-      "maxUnavailable": 0,
-      "minReadySeconds": 0,
-      "progressDeadlineSeconds": 600,
-      "revisionHistoryLimit": 10,
-      "strategy": "RollingUpdate"
-    },
-    "deploymentStatus": {
-      "availableReplicas": 1,
-      "conditions": [
-        {
-          "lastTransitionTime": "2018-07-18T07:34:38Z",
-          "lastTransitionTimeTS": 1531899278000,
-          "lastUpdateTime": "2018-07-18T07:34:38Z",
-          "lastUpdateTimeTS": 1531899278000,
-          "message": "Deployment has minimum availability.",
-          "reason": "MinimumReplicasAvailable",
-          "status": "True",
-          "type": "Available"
-        },
-        {
-          "lastTransitionTime": "2018-07-18T07:34:16Z",
-          "lastTransitionTimeTS": 1531899256000,
-          "lastUpdateTime": "2018-07-18T07:34:38Z",
-          "lastUpdateTimeTS": 1531899278000,
-          "message": "ReplicaSet \"nginx-64d85666f9\" has successfully progressed.",
-          "reason": "NewReplicaSetAvailable",
-          "status": "True",
-          "type": "Progressing"
-        }
-      ],
-      "observedGeneration": 2,
-      "readyReplicas": 1,
-      "replicas": 1,
-      "type": "/v3/project/schemas/deploymentStatus",
-      "unavailableReplicas": 0,
-      "updatedReplicas": 1
-    },
-    "dnsPolicy": "ClusterFirst",
-    "hostIPC": false,
-    "hostNetwork": false,
-    "hostPID": false,
-    "id": "deployment:default:nginx",
-    "labels": {
-      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-    },
-    "links": {
-      "remove": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
-      "revisions": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/revisions",
-      "self": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
-      "update": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx",
-      "yaml": "https://localhost:8443/v3/project/c-bcz5t:p-fdr4s/workloads/deployment:default:nginx/yaml"
-    },
-    "name": "nginx",
-    "namespaceId": "default",
-    "paused": false,
-    "projectId": "c-bcz5t:p-fdr4s",
-    "publicEndpoints": [
-      {
-        "addresses": ["10.64.3.58"],
-        "allNodes": true,
-        "ingressId": null,
-        "nodeId": null,
-        "podId": null,
-        "port": 30917,
-        "protocol": "TCP",
-        "serviceId": "default:nginx-nodeport"
-      }
-    ],
-    "restartPolicy": "Always",
-    "scale": 1,
-    "schedulerName": "default-scheduler",
-    "selector": {
-      "matchLabels": {
-        "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-      },
-      "type": "/v3/project/schemas/labelSelector"
-    },
-    "state": "active",
-    "terminationGracePeriodSeconds": 30,
-    "transitioning": "no",
-    "transitioningMessage": "",
-    "type": "deployment",
-    "uuid": "f998037d-8a5c-11e8-a4cf-0245a7ebb0fd",
-    "workloadAnnotations": {
-      "deployment.kubernetes.io/revision": "1",
-      "field.cattle.io/creatorId": "user-f4tt2"
-    },
-    "workloadLabels": {
-      "workload.user.cattle.io/workloadselector": "deployment-default-nginx"
-    }
-  }
-}
-```
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
deleted file mode 100644
index b0a7f913c38..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/arm64-platform/_index.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: Running on ARM64 (Experimental)
-weight: 3
----
-
-> **Important:**
->
-> Running on an ARM64 platform is currently an experimental feature and is not yet officially supported in Rancher. Therefore, we do not recommend using ARM64 based nodes in a production environment.
-
-The following options are available when using an ARM64 platform:
-
-- Running Rancher on ARM64 based node(s)
-  - Only [Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker)
-- Create custom cluster and adding ARM64 based node(s)
-  - Kubernetes cluster version must be 1.12 or higher
-  - CNI Network Provider must be [Flannel]({{<baseurl>}}/rancher/v2.x/en/faq/networking/cni-providers/#flannel)
-- Importing clusters that contain ARM64 based nodes
-  - Kubernetes cluster version must be 1.12 or higher
-
-Please see [Cluster Options]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/) how to configure the cluster options.
-
-The following features are not tested:
-
-- Monitoring, alerts, notifiers, pipelines and logging
-- Launching apps from the catalog
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/etcd/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/etcd/_index.md
deleted file mode 100644
index a605c7343aa..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/etcd/_index.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: Tuning etcd for Large Installations
-weight: 2
----
-
-When running larger Rancher installations with 15 or more clusters it is recommended to increase the default keyspace for etcd from the default 2GB. The maximum setting is 8GB and the host should have enough RAM to keep the entire dataset in memory. When increasing this value you should also increase the size of the host. The keyspace size can also be adjusted in smaller installations if you anticipate a high rate of change of pods during the garbage collection interval.
-
-The etcd data set is automatically cleaned up on a five minute interval by Kubernetes. There are situations, e.g. deployment thrashing, where enough events could be written to etcd and deleted before garbage collection occurs and cleans things up causing the keyspace to fill up. If you see `mvcc: database space exceeded` errors, in the etcd logs or Kubernetes API server logs, you should consider increasing the keyspace size. This can be accomplished by setting the [quota-backend-bytes](https://etcd.io/docs/v3.4.0/op-guide/maintenance/#space-quota) setting on the etcd servers.
-
-### Example: This snippet of the RKE cluster.yml file increases the keyspace size to 5GB
-
-```yaml
-# RKE cluster.yml
----
-services:
-  etcd:
-    extra_args:
-      quota-backend-bytes: 5368709120
-```
-
-## Scaling etcd disk performance
-
-You can follow the recommendations from [the etcd docs](https://etcd.io/docs/v3.4.0/tuning/#disk) on how to tune the disk priority on the host.
-
-Additionally, to reduce IO contention on the disks for etcd, you can use a dedicated device for the data and wal directory. Based on etcd best practices, mirroring RAID configurations are unnecessary because etcd replicates data between the nodes in the cluster. You can use stripping RAID configurations to increase available IOPS.
-
-To implement this solution in an RKE cluster, the `/var/lib/etcd/data` and `/var/lib/etcd/wal` directories will need to have disks mounted and formatted on the underlying host. In the `extra_args` directive of the `etcd` service, you must include the `wal_dir` directory. Without specifying the `wal_dir`, etcd process will try to manipulate the underlying `wal` mount with insufficient permissions.
-
-```yaml
-# RKE cluster.yml
----
-services:
-  etcd:
-    extra_args:
-      data-dir: '/var/lib/rancher/etcd/data/'
-      wal-dir: '/var/lib/rancher/etcd/wal/wal_dir'
-    extra_binds:
-      - '/var/lib/etcd/data:/var/lib/rancher/etcd/data'
-      - '/var/lib/etcd/wal:/var/lib/rancher/etcd/wal'
-```
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/firewall/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/firewall/_index.md
deleted file mode 100644
index 7386ba0880e..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/advanced/firewall/_index.md
+++ /dev/null
@@ -1,106 +0,0 @@
----
-title: Opening Ports with firewalld
-weight: 1
----
-
-Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm.
-
-For example, one Oracle Linux image in AWS has REJECT rules that stop Helm from communicating with Tiller:
-
-```
-Chain INPUT (policy ACCEPT)
-target     prot opt source               destination
-ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
-ACCEPT     icmp --  anywhere             anywhere
-ACCEPT     all  --  anywhere             anywhere
-ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
-REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
-
-Chain FORWARD (policy ACCEPT)
-target     prot opt source               destination
-REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
-
-Chain OUTPUT (policy ACCEPT)
-target     prot opt source               destination
-```
-
-You can check the default firewall rules with this command:
-
-```
-sudo iptables --list
-```
-
-This section describes how to use `firewalld` to apply the [firewall port rules]({{<baseurl>}}/rancher/v2.x/en/installation/references) for nodes in a high-availability Rancher server cluster.
-
-# Prerequisite
-
-Install v7.x or later ofv`firewalld`:
-
-```
-yum install firewalld
-systemctl start firewalld
-systemctl enable firewalld
-```
-
-# Applying Firewall Port Rules
-
-In the Rancher high-availability installation instructions, the Rancher server is set up on three nodes that have all three Kubernetes roles: etcd, controlplane, and worker. If your Rancher server nodes have all three roles, run the following commands on each node:
-
-```
-firewall-cmd --permanent --add-port=22/tcp
-firewall-cmd --permanent --add-port=80/tcp
-firewall-cmd --permanent --add-port=443/tcp
-firewall-cmd --permanent --add-port=2376/tcp
-firewall-cmd --permanent --add-port=2379/tcp
-firewall-cmd --permanent --add-port=2380/tcp
-firewall-cmd --permanent --add-port=6443/tcp
-firewall-cmd --permanent --add-port=8472/udp
-firewall-cmd --permanent --add-port=9099/tcp
-firewall-cmd --permanent --add-port=10250/tcp
-firewall-cmd --permanent --add-port=10254/tcp
-firewall-cmd --permanent --add-port=30000-32767/tcp
-firewall-cmd --permanent --add-port=30000-32767/udp
-```
-If your Rancher server nodes have separate roles, use the following commands based on the role of the node:
-
-```
-# For etcd nodes, run the following commands:
-firewall-cmd --permanent --add-port=2376/tcp
-firewall-cmd --permanent --add-port=2379/tcp
-firewall-cmd --permanent --add-port=2380/tcp
-firewall-cmd --permanent --add-port=8472/udp
-firewall-cmd --permanent --add-port=9099/tcp
-firewall-cmd --permanent --add-port=10250/tcp
-
-# For control plane nodes, run the following commands:
-firewall-cmd --permanent --add-port=80/tcp
-firewall-cmd --permanent --add-port=443/tcp
-firewall-cmd --permanent --add-port=2376/tcp
-firewall-cmd --permanent --add-port=6443/tcp
-firewall-cmd --permanent --add-port=8472/udp
-firewall-cmd --permanent --add-port=9099/tcp
-firewall-cmd --permanent --add-port=10250/tcp
-firewall-cmd --permanent --add-port=10254/tcp
-firewall-cmd --permanent --add-port=30000-32767/tcp
-firewall-cmd --permanent --add-port=30000-32767/udp
-
-# For worker nodes, run the following commands:
-firewall-cmd --permanent --add-port=22/tcp
-firewall-cmd --permanent --add-port=80/tcp
-firewall-cmd --permanent --add-port=443/tcp
-firewall-cmd --permanent --add-port=2376/tcp
-firewall-cmd --permanent --add-port=8472/udp
-firewall-cmd --permanent --add-port=9099/tcp
-firewall-cmd --permanent --add-port=10250/tcp
-firewall-cmd --permanent --add-port=10254/tcp
-firewall-cmd --permanent --add-port=30000-32767/tcp
-firewall-cmd --permanent --add-port=30000-32767/udp
-```
-
-After the `firewall-cmd` commands have been run on a node, use the following command to enable the firewall rules:
-
-```
-firewall-cmd --reload
-```
-
-**Result:** The firewall is updated so that Helm can communicate with the Rancher server nodes.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/_index.md
deleted file mode 100644
index 9287b5f398a..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/_index.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-title: Installing Rancher in an Air Gapped Environment
-weight: 2
----
-
-> This section is under construction.
-
-This section is about installations of Rancher server in an air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
-
-The installation steps differ depending on whether Rancher is installed on an RKE Kubernetes cluster, a K3s Kubernetes cluster, or a single Docker container.
-
-For more information on each installation option, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/)
-
-Throughout the installation instructions, there will be _tabs_ for each installation option.
-
-> **Important:** If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker Installation to a Kubernetes Installation.
-
-# Installation Outline
-
-1. [Set up private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/)
-2. [Collect and publish images to your private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/)
-3. [Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/)
-
-### [Next: Prepare your Node(s)]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/)
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
deleted file mode 100644
index d631b42f51d..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/install-rancher/_index.md
+++ /dev/null
@@ -1,343 +0,0 @@
----
-title: 3. Install Rancher
-weight: 400
----
-
-This section is about how to deploy Rancher for your air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy. There are _tabs_ for either a high availability (recommended) or a Docker installation.
-
-> **Note:** These installation instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/installation/options/air-gap-helm2) provides a copy of the older air gap installation instructions for Rancher installed on Kubernetes with Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
-
-
-{{% tabs %}}
-{{% tab "Kubernetes Install (Recommended)" %}}
-
-Rancher recommends installing Rancher on a Kubernetes cluster. A highly available Kubernetes install is comprised of three nodes running the Rancher server components on a Kubernetes cluster. The persistence layer (etcd) is also replicated on these three nodes, providing redundancy and data duplication in case one of the nodes fails.
-
-This section describes installing Rancher in five parts:
-
-- [A. Add the Helm Chart Repository](#a-add-the-helm-chart-repository)
-- [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration)
-- [C. Render the Rancher Helm Template](#c-render-the-rancher-helm-template)
-- [D. Install Rancher](#d-install-rancher)
-- [E. For Rancher versions prior to v2.3.0, Configure System Charts](#e-for-rancher-versions-prior-to-v2-3-0-configure-system-charts)
-
-
-### Prerequisite
-
-Start with any Kubernetes cluster.
-
-This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
-
-> **Need help installing Kubernetes?**
-> 
-> Our documentation contains instructions for installing Kubernetes with one of Rancher's distributions:
->
-> - [Install Kubernetes with the Rancher CLI (recommended for ease of use)]({{<baseurl>}}/rancher/v2.5/en/cli)
-> - Install a K3s Kubernetes cluster
-> - Install an RKE Kubernetes cluster
-
-### A. Add the Helm Chart Repository
-
-From a system that has access to the internet, fetch the latest Helm chart and copy the resulting manifests to a system that has access to the Rancher server cluster.
-
-1. If you haven't already, install `helm` locally on a workstation that has internet access. Note: Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-2. Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-  {{< release-channel >}}
-    ```
-    helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-    ```
-
-3. Fetch the latest Rancher chart. This will pull down the chart and save it in the current directory as a `.tgz` file.
-```plain
-helm fetch rancher-<CHART_REPO>/rancher
-```
-
-> Want additional options? Need help troubleshooting? See [Kubernetes Install: Advanced Options]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#advanced-configurations).
-
-### B. Choose your SSL Configuration
-
-Rancher Server is designed to be secure by default and requires SSL/TLS configuration.
-
-When Rancher is installed on an air gapped Kubernetes cluster, there are two recommended options for the source of the certificate.
-
-> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
-
-| Configuration                              | Chart option                 | Description                                                                                                                                                 | Requires cert-manager |
-| ------------------------------------------ | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
-| Rancher Generated Self-Signed Certificates | `ingress.tls.source=rancher` | Use certificates issued by Rancher's generated CA (self signed)<br> This is the **default** and does not need to be added when rendering the Helm template. | yes                   |
-| Certificates from Files                    | `ingress.tls.source=secret`  | Use your own certificate files by creating Kubernetes Secret(s). <br> This option must be passed when rendering the Rancher Helm template.                  | no                    |
-
-### C. Render the Rancher Helm Template
-
-When setting up the Rancher Helm template, there are several options in the Helm chart that are designed specifically for air gap installations.
-
-| Chart Option            | Chart Value                      | Description   |
-| ----------------------- | -------------------------------- | ---- |
-| `certmanager.version` | "<version>" | Configure proper Rancher TLS issuer depending of running cert-manager version. |
-| `systemDefaultRegistry` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `useBundledSystemChart` | `true`                           | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. |
-
-Based on the choice your made in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), complete one of the procedures below.
-
-{{% accordion id="self-signed" label="Option A-Default Self-Signed Certificate" %}}
-
-By default, Rancher generates a CA and uses cert-manager to issue the certificate for access to the Rancher server interface.
-
-> **Note:**
-> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade cert-manager documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-1. From a system connected to the internet, add the cert-manager repo to Helm.
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    ```
-
-1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
-
-   ```plain
-   helm fetch jetstack/cert-manager --version v0.12.0
-   ```
-
-1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
-   ```plain
-   helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
-       --namespace cert-manager \
-       --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller \
-       --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook \
-       --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
-   ```
-
-1. Download the required CRD file for cert-manager
-   ```plain
-   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-   ```
-1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
-
-
-    Placeholder | Description
-    ------------|-------------
-    `<VERSION>` | The version number of the output tarball.
-    `<RANCHER.YOURDOMAIN.COM>` | The DNS name you pointed at your load balancer.
-    `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.
-    `<CERTMANAGER_VERSION>` | Cert-manager version running on k8s cluster.
-
-     ```plain
-    helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
-     --namespace cattle-system \
-     --set hostname=<RANCHER.YOURDOMAIN.COM> \
-     --set certmanager.version=<CERTMANAGER_VERSION> \
-     --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-     --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-     --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.3.6`
-
-{{% /accordion %}}
-
-{{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
-
-Create Kubernetes secrets from your own certificates for Rancher to use. The common name for the cert will need to match the `hostname` option in the command below, or the ingress controller will fail to provision the site for Rancher.
-
-Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
-
-| Placeholder                      | Description                                     |
-| -------------------------------- | ----------------------------------------------- |
-| `<VERSION>`                      | The version number of the output tarball.       |
-| `<RANCHER.YOURDOMAIN.COM>`       | The DNS name you pointed at your load balancer. |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.         |
-
-```plain
-   helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
-    --namespace cattle-system \
-    --set hostname=<RANCHER.YOURDOMAIN.COM> \
-    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-    --set ingress.tls.source=secret \
-    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
-
-```plain
-   helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
-    --namespace cattle-system \
-    --set hostname=<RANCHER.YOURDOMAIN.COM> \
-    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-    --set ingress.tls.source=secret \
-    --set privateCA=true \
-    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-**Optional**: To install a specific Rancher version, set the `rancherImageTag` value, example: `--set rancherImageTag=v2.3.6`
-
-Then refer to [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
-
-{{% /accordion %}}
-
-### D. Install Rancher
-
-Copy the rendered manifest directories to a system that has access to the Rancher server cluster to complete installation.
-
-Use `kubectl` to create namespaces and apply the rendered manifests.
-
-If you chose to use self-signed certificates in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), install cert-manager.
-
-{{% accordion id="install-cert-manager" label="Self-Signed Certificate Installs - Install Cert-manager" %}}
-
-If you are using self-signed certificates, install cert-manager:
-
-1. Create the namespace for cert-manager.
-```plain
-kubectl create namespace cert-manager
-```
-
-1. Create the cert-manager CustomResourceDefinitions (CRDs).
-```plain
-kubectl apply -f cert-manager/cert-manager-crd.yaml
-```
-
-    > **Note:**
-    > If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false` flag to your `kubectl apply` command above, or else you will receive a validation error relating to the `x-kubernetes-preserve-unknown-fields` field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
-
-1. Launch cert-manager.
-```plain
-kubectl apply -R -f ./cert-manager
-```
-
-{{% /accordion %}}
-
-Install Rancher:
-
-```plain
-kubectl create namespace cattle-system
-kubectl -n cattle-system apply -R -f ./rancher
-```
-
-**Step Result:** If you are installing Rancher v2.3.0+, the installation is complete.
-
-### E. For Rancher versions prior to v2.3.0, Configure System Charts
-
-If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
-
-### Additional Resources
-
-These resources could be helpful when installing Rancher:
-
-- [Rancher Helm chart options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/)
-- [Adding TLS secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/)
-- [Troubleshooting Rancher Kubernetes Installations]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/)
-
-{{% /tab %}}
-{{% tab "Docker Install" %}}
-
-The Docker installation is for Rancher users that are wanting to **test** out Rancher. Instead of running on a Kubernetes cluster, you install the Rancher server component on a single node using a `docker run` command. Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server. **Important: If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker installation to a Kubernetes Installation.** Instead of running the single node installation, you have the option to follow the Kubernetes Install guide, but only use one node to install Rancher. Afterwards, you can scale up the etcd nodes in your Kubernetes cluster to make it a Kubernetes Installation.
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-| Environment Variable Key         | Environment Variable Value       | Description     |
-| -------------------------------- | -------------------------------- | ---- |
-| `CATTLE_SYSTEM_DEFAULT_REGISTRY` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `CATTLE_SYSTEM_CATALOG`          | `bundled`                        | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. |
-
-> **Do you want to...**
->
-> - Configure custom CA root certificate to access your services? See [Custom CA root certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/custom-ca-root-certificate/).
-> - Record all transactions with the Rancher API? See [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#api-audit-log).
-
-- For Rancher prior to v2.3.0, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach. Then, after Rancher is installed, you will need to configure Rancher to use that repository. For details, refer to the documentation on [setting up the system charts for Rancher prior to v2.3.0.]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0)
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
-
-If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself.
-
-Log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
-
-In development or testing environments where your team will access your Rancher server, create a self-signed certificate for use with your install so that your team can verify they're connecting to your instance of Rancher.
-
-> **Prerequisites:**
-> From a computer with an internet connection, create a self-signed certificate using [OpenSSL](https://www.openssl.org/) or another method of your choice.
->
-> - The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
-> - In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#cert-order).
-
-After creating your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Use the `-v` flag and provide the path to your certificates to mount them in your container.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
-| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
-| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<CA_CERTS.pem>`                     | The path to the certificate authority's certificate.                                                                          |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-    -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
-
-In development or testing environments where you're exposing an app publicly, use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings.
-
-> **Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
-
-After obtaining your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
-| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
-| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-> **Note:** Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    --no-cacerts \
-    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-
-If you are installing Rancher v2.3.0+, the installation is complete.
-
-If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
-
-{{% /tab %}}
-{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/local-system-charts/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/local-system-charts/_index.md
deleted file mode 100644
index 36df2bf2e54..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/local-system-charts/_index.md
+++ /dev/null
@@ -1,65 +0,0 @@
----
-title: Setting up Local System Charts for Air Gapped Installations
-weight: 1120
----
-
-The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS.
-
-In an air gapped installation of Rancher, you will need to configure Rancher to use a local copy of the system charts. This section describes how to use local system charts using a CLI flag in Rancher v2.3.0, and using a Git mirror for Rancher versions prior to v2.3.0.
-
-# Using Local System Charts in Rancher v2.3.0
-
-In Rancher v2.3.0, a local copy of `system-charts` has been packaged into the `rancher/rancher` container. To be able to use these features in an air gap install, you will need to run the Rancher install command with an extra environment variable, `CATTLE_SYSTEM_CATALOG=bundled`, which tells Rancher to use the local copy of the charts instead of attempting to fetch them from GitHub.
-
-Example commands for a Rancher installation with a bundled `system-charts` are included in the [air gap Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/install-rancher) instructions and the [air gap Kubernetes installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/#c-install-rancher) instructions.
-
-# Setting Up System Charts for Rancher Prior to v2.3.0
-
-### A. Prepare System Charts
-
-The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. To be able to use these features in an air gap install, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach and configure Rancher to use that repository.
-
-Refer to the release notes in the `system-charts` repository to see which branch corresponds to your version of Rancher.
-
-### B. Configure System Charts
-
-Rancher needs to be configured to use your Git mirror of the `system-charts` repository. You can configure the system charts repository either from the Rancher UI or from Rancher's API view.
-
-{{% tabs %}}
-{{% tab "Rancher UI" %}}
-
-In the catalog management page in the Rancher UI, follow these steps:
-
-1. Go to the **Global** view.
-
-1. Click **Tools > Catalogs.**
-
-1. The system chart is displayed under the name `system-library`. To edit the configuration of the system chart, click **&#8942; > Edit.**
-
-1. In the **Catalog URL** field, enter the location of the Git mirror of the `system-charts` repository.
-
-1. Click **Save.**
-
-**Result:** Rancher is configured to download all the required catalog items from your `system-charts` repository.
-
-{{% /tab %}}
-{{% tab "Rancher API" %}}
-
-1. Log into Rancher.
-
-1. Open `https://<your-rancher-server>/v3/catalogs/system-library` in your browser.
-
-   {{< img "/img/rancher/airgap/system-charts-setting.png" "Open">}}
-
-1. Click **Edit** on the upper right corner and update the value for **url** to the location of the Git mirror of the `system-charts` repository.
-
-   {{< img "/img/rancher/airgap/system-charts-update.png" "Update">}}
-
-1. Click **Show Request**
-
-1. Click **Send Request**
-
-**Result:** Rancher is configured to download all the required catalog items from your `system-charts` repository.
-
-{{% /tab %}}
-{{% /tabs %}}
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
deleted file mode 100644
index 1d063572262..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/populate-private-registry/_index.md
+++ /dev/null
@@ -1,275 +0,0 @@
----
-title: '2. Collect and Publish Images to your Private Registry'
-weight: 200
----
-
-This section describes how to set up your private registry so that when you install Rancher, Rancher will pull all the required images from this registry.
-
-By default, all images used to [provision Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/) or launch any [tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) in Rancher, e.g. monitoring, pipelines, alerts, are pulled from Docker Hub. In an air gapped installation of Rancher, you will need a private registry that is located somewhere accessible by your Rancher server. Then, you will load the registry with all the images.
-
-Populating the private registry with images is the same process for installing Rancher with Docker and for installing Rancher on a Kubernetes cluster.
-
-The steps in this section differ depending on whether or not you are planning to use Rancher to provision a downstream cluster with Windows nodes or not. By default, we provide the steps of how to populate your private registry assuming that Rancher will provision downstream Kubernetes clusters with only Linux nodes. But if you plan on provisioning any [downstream Kubernetes clusters using Windows nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/), there are separate instructions to support the images needed.
-
-> **Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry) available to use.
-
-{{% tabs %}}
-{{% tab "Linux Only Clusters" %}}
-
-For Rancher servers that will only provision Linux clusters, these are the steps to populate your private registry.
-
-1. [Find the required assets for your Rancher version](#1-find-the-required-assets-for-your-rancher-version)
-2. [Collect the cert-manager image](#2-collect-the-cert-manager-image) (unless you are bringing your own certificates or terminating TLS on a load balancer)
-3. [Save the images to your workstation](#3-save-the-images-to-your-workstation)
-4. [Populate the private registry](#4-populate-the-private-registry)
-
-### Prerequisites
-
-These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
-
-If you will use ARM64 hosts, the registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
-
-### 1. Find the required assets for your Rancher version
-
-1. Go to our [releases page,](https://github.com/rancher/rancher/releases) find the Rancher v2.x.x release that you want to install, and click **Assets.** Note: Don't use releases marked `rc` or `Pre-release`, as they are not stable for production environments.
-
-2. From the release's **Assets** section, download the following files, which are required to install Rancher in an air gap environment:
-
-| Release File   | Description  |
-| ---------------- | -------------- |
-| `rancher-images.txt`     | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools. |
-| `rancher-save-images.sh` | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-| `rancher-load-images.sh` | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.   |
-
-### 2. Collect the cert-manager image
-
-> Skip this step if you are using your own certificates, or if you are terminating TLS on an external load balancer.
-
-In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. 
-
-1.  Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-
-    > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    helm fetch jetstack/cert-manager --version v0.12.0
-    helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
-    ```
-
-2.  Sort and unique the images list to remove any overlap between the sources:
-
-    ```plain
-    sort -u rancher-images.txt -o rancher-images.txt
-    ```
-
-### 3. Save the images to your workstation
-
-1. Make `rancher-save-images.sh` an executable:
-   ```
-   chmod +x rancher-save-images.sh
-   ```
-
-1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-   ```plain
-   ./rancher-save-images.sh --image-list ./rancher-images.txt
-   ```
-   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
-
-### 4. Populate the private registry
-
-Next, you will move the images in the `rancher-images.tar.gz` to your private registry using the scripts to load the images.
-
-Move the images in the `rancher-images.tar.gz` to your private registry using the scripts to load the images.
-
-The `rancher-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script. The `rancher-images.tar.gz` should also be in the same directory.
-
-1.  Log into your private registry if required:
-   ```plain
-   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-1.  Make `rancher-load-images.sh` an executable:
-   ```
-   chmod +x rancher-load-images.sh
-   ```
-
-1.  Use `rancher-load-images.sh` to extract, tag and push `rancher-images.txt` and `rancher-images.tar.gz` to your private registry:
-   ```plain
-   ./rancher-load-images.sh --image-list ./rancher-images.txt --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-{{% /tab %}}
-{{% tab "Linux and Windows Clusters" %}}
-
-For Rancher servers that will provision Linux and Windows clusters, there are distinctive steps to populate your private registry for the Windows images and the Linux images. Since a Windows cluster is a mix of Linux and Windows nodes, the Linux images pushed into the private registry are manifests.
-
-### Windows Steps
-
-The Windows images need to be collected and pushed from a Windows server workstation.
-
-A. Find the required assets for your Rancher version <br>
-B. Save the images to your Windows Server workstation <br>
-C. Prepare the Docker daemon <br>
-D. Populate the private registry
-
-{{% accordion label="Collecting and Populating Windows Images into the Private Registry"%}}
-
-### Prerequisites
-
-These steps expect you to use a Windows Server 1809 workstation that has internet access, access to your private registry, and at least 50 GB of disk space.
-
-The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
-
-Your registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.
-
-2. From the release's "Assets" section, download the following files:
-
-| Release File                 | Description      |
-|----------------------------|------------------|
-| `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.                                                                    |
-| `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
-| `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.                                 |
-
-### B. Save the images to your Windows Server workstation
-
-1. Using `powershell`, go to the directory that has the files that were downloaded in the previous step.
-
-1. Run `rancher-save-images.ps1` to create a tarball of all the required images:
-   ```plain
-   ./rancher-save-images.ps1
-   ```
-
-   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-windows-images.tar.gz`. Check that the output is in the directory.
-
-### C. Prepare the Docker daemon
-
-Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
-
-   ```
-   {
-     ...
-     "allow-nondistributable-artifacts": [
-       ...
-       "<REGISTRY.YOURDOMAIN.COM:PORT>"
-     ]
-     ...
-   }
-   ```
-
-### D. Populate the private registry
-
-Move the images in the `rancher-windows-images.tar.gz` to your private registry using the scripts to load the images.
-
-The `rancher-windows-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.ps1` script. The `rancher-windows-images.tar.gz` should also be in the same directory.
-
-1. Using `powershell`, log into your private registry if required:
-   ```plain
-   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-1. Using `powershell`, use `rancher-load-images.ps1` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-   ```plain
-   ./rancher-load-images.ps1 --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-{{% /accordion %}}
-
-### Linux Steps
-
-The Linux images needs to be collected and pushed from a Linux host, but _must be done after_ populating the Windows images into the private registry. These step are different from the Linux only steps as the Linux images that are pushed will actually manifests that support Windows and Linux images.
-
-A. Find the required assets for your Rancher version <br>
-B. Collect all the required images <br>
-C. Save the images to your Linux workstation <br>
-D. Populate the private registry
-
-{{% accordion label="Collecting and Populating Linux Images into the Private Registry" %}}
-
-### Prerequisites
-
-You must populate the private registry with the Windows images before populating the private registry with Linux images. If you have already populated the registry with Linux images, you will need to follow these instructions again as they will publish manifests that support Windows and Linux images.
-
-These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
-
-The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments. Click **Assets.**
-
-2. From the release's **Assets** section, download the following files:
-
-| Release File                 | Description    |
-|----------------------------| -------------------------- |
-| `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.           |
-| `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
-| `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-| `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
-
-### B. Collect all the required images
-
-**For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
-
-   1. Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-      > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-      ```plain
-      helm repo add jetstack https://charts.jetstack.io
-      helm repo update
-      helm fetch jetstack/cert-manager --version v0.12.0
-      helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
-      ```
-
-   2. Sort and unique the images list to remove any overlap between the sources:
-      ```plain
-      sort -u rancher-images.txt -o rancher-images.txt
-      ```
-
-### C. Save the images to your workstation
-
-1. Make `rancher-save-images.sh` an executable:
-   ```
-   chmod +x rancher-save-images.sh
-   ```
-
-1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-   ```plain
-   ./rancher-save-images.sh --image-list ./rancher-images.txt
-   ```
-
-   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
-
-### D. Populate the private registry
-
-Move the images in the `rancher-images.tar.gz` to your private registry using the `rancher-load-images.sh script` to load the images.
-
-The image list, `rancher-images.txt` or `rancher-windows-images.txt`, is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script. The `rancher-images.tar.gz` should also be in the same directory.
-
-1. Log into your private registry if required:
-   ```plain
-   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-1. Make `rancher-load-images.sh` an executable:
-   ```
-   chmod +x rancher-load-images.sh
-   ```
-
-1. Use `rancher-load-images.sh` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-   ```plain
-   ./rancher-load-images.sh --image-list ./rancher-images.txt \
-     --windows-image-list ./rancher-windows-images.txt \
-     --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-{{% /accordion %}}
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### [Next step for Kubernetes Installs - Launch a Kubernetes Cluster]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/)
-
-### [Next step for Docker Installs - Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/)
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/prepare-registry/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/prepare-registry/_index.md
deleted file mode 100644
index a860bf48a9b..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/air-gap/prepare-registry/_index.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: '1. Set up Private Registry'
-weight: 100
----
-
-> This page is under construction.
-
-In this section, you will provision the underlying infrastructure for your Rancher management server in an air gapped environment. You will also set up the private Docker registry that must be available to your Rancher node(s).
-
-An air gapped environment is an environment where the Rancher server is installed offline or behind a firewall.
-
-The infrastructure depends on whether you are installing Rancher on a K3s Kubernetes cluster, an RKE Kubernetes cluster, or a single Docker container. For more information on each installation option, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/)
-
-
-
-### Set up a Private Docker Registry
-
-Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing Docker images to your machines.
-
-In a later step, when you set up your K3s Kubernetes cluster, you will create a [private registries configuration file]({{<baseurl>}}/k3s/latest/en/installation/private-registry/) with details from this registry.
-
-If you need help with creating a private registry, please refer to the [official Docker documentation.](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry)
-
-
-### [Next: Collect and Publish Images to your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/)
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/_index.md
deleted file mode 100644
index c49e516a62b..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Encryption
-weight: 3
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/custom-ca-root-certificate/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/custom-ca-root-certificate/_index.md
deleted file mode 100644
index 924bb8a8203..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/custom-ca-root-certificate/_index.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: About Custom CA Root Certificates
-weight: 1
----
-
-If you're using Rancher in an internal production environment where you aren't exposing apps publicly, use a certificate from a private certificate authority (CA).
-
-Services that Rancher needs to access are sometimes configured with a certificate from a custom/internal CA root, also known as self signed certificate. If the presented certificate from the service cannot be validated by Rancher, the following error displays: `x509: certificate signed by unknown authority`.
-
-To validate the certificate, the CA root certificates need to be added to Rancher. As Rancher is written in Go, we can use the environment variable `SSL_CERT_DIR` to point to the directory where the CA root certificates are located in the container. The CA root certificates directory can be mounted using the Docker volume option (`-v host-source-directory:container-destination-directory`) when starting the Rancher container.
-
-Examples of services that Rancher can access:
-
-- Catalogs
-- Authentication providers
-- Accessing hosting/cloud API when using Node Drivers
-
-## Installing with the custom CA Certificate
-
-For details on starting a Rancher container with your private CA certificates mounted, refer to the installation docs:
-
-- [Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#custom-ca-certificate)
-
-- [Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#additional-trusted-cas)
-
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-secrets/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-secrets/_index.md
deleted file mode 100644
index 2bc835cf922..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-secrets/_index.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: Adding TLS Secrets
-weight: 2
----
-
-Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key.
-
-Combine the server certificate followed by any intermediate certificate(s) needed into a file named `tls.crt`. Copy your certificate key into a file named `tls.key`.
-
-For example, [acme.sh](https://acme.sh) provides server certificate and CA chains in `fullchain.cer` file. 
-This `fullchain.cer` should be renamed to `tls.crt` & certificate key file as `tls.key`.
-
-Use `kubectl` with the `tls` secret type to create the secrets.
-
-```
-kubectl -n cattle-system create secret tls tls-rancher-ingress \
-  --cert=tls.crt \
-  --key=tls.key
-```
-
-> **Note:** If you want to replace the certificate, you can delete the `tls-rancher-ingress` secret using `kubectl -n cattle-system delete secret tls-rancher-ingress` and add a new one using the command shown above. If you are using a private CA signed certificate, replacing the certificate is only possible if the new certificate is signed by the same CA as the certificate currently in use.
-
-### Using a Private CA Signed Certificate
-
-If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server.
-
-Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
-
->**Important:** Make sure the file is called `cacerts.pem` as Rancher uses that filename to configure the CA certificate.
-
-```
-kubectl -n cattle-system create secret generic tls-ca \
-  --from-file=cacerts.pem
-```
-
-> **Note:** The configured `tls-ca` secret is retrieved when Rancher starts. On a running Rancher installation the updated CA will take effect after new Rancher pods are started.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
deleted file mode 100644
index fc57ede4a78..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/tls-settings/_index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: TLS Settings
-weight: 3
----
-
-In Rancher v2.1.7, the default TLS configuration changed to only accept TLS 1.2 and secure TLS cipher suites. TLS 1.3 and TLS 1.3 exclusive cipher suites are not supported.
-
-## Configuring TLS settings
-
-The Audit Log is enabled and configured by passing environment variables to the Rancher server container. See the following to enable on your installation.
-
-- [Installing Rancher on a single node with Docker]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#tls-settings)
-
-- [Installing Rancher on Kubernetes]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#tls-settings)
-
-## TLS settings
-
-| Parameter | Description | Default | Available options |
-|-----|-----|-----|-----|
-| `CATTLE_TLS_MIN_VERSION` | Minimum TLS version | `1.2` | `1.0`, `1.1`, `1.2` |
-| `CATTLE_TLS_CIPHERS` | Allowed TLS cipher suites | `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`<br/>`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305` | See [Golang tls constants](https://golang.org/pkg/crypto/tls/#pkg-constants) |
-
-
-## Legacy configuration
-
-If you need to configure TLS the same way as it was before Rancher v2.1.7, please use the following settings:
-
-
-| Parameter | Legacy value |
-|-----|-----|
-| `CATTLE_TLS_MIN_VERSION` | `1.0` |
-| `CATTLE_TLS_CIPHERS` | `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,`<br/>`TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,`<br/>`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,`<br/>`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,`<br/>`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,`<br/>`TLS_RSA_WITH_AES_128_GCM_SHA256,`<br/>`TLS_RSA_WITH_AES_256_GCM_SHA384,`<br/>`TLS_RSA_WITH_AES_128_CBC_SHA,`<br/>`TLS_RSA_WITH_AES_256_CBC_SHA,`<br/>`TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,`<br/>`TLS_RSA_WITH_3DES_EDE_CBC_SHA`
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/upgrading-cert-manager/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/upgrading-cert-manager/_index.md
deleted file mode 100644
index 19ee7d06ee9..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/encryption/upgrading-cert-manager/_index.md
+++ /dev/null
@@ -1,234 +0,0 @@
----
-title: Upgrading Cert-Manager
-weight: 4
----
-
-Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, three important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher:
-
-1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
-1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/). This change has no exact deadline.
-1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
-
-To address these changes, this guide will do two things:
-
-1. Document the procedure for upgrading cert-manager
-1. Explain the cert-manager API changes and link to cert-manager's official documentation for migrating your data
-
-> **Important:**
-> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them:
-
-> 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server
-> 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager
-> 3. Install the newer version of Rancher and cert-manager 
-
-> The reason is that when Helm upgrades Rancher, it will reject the upgrade and show error messages if the running Rancher app does not match the chart template used to install it. Because cert-manager changed its API group and we cannot modify released charts for Rancher, there will always be a mismatch on the cert-manager's API version, therefore the upgrade will be rejected.
-
-> For reinstalling Rancher with Helm, please check [Option B: Reinstalling Rancher Chart]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/#c-upgrade-rancher) under the upgrade Rancher section. 
-
-## Upgrade Cert-Manager
-
-The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-\* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues.
-
-> These instructions have been updated for Helm 3. If you are still using Helm 2, refer to [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions)
-
-In order to upgrade cert-manager, follow these instructions:
-
-{{% accordion id="normal" label="Upgrading cert-manager with Internet access" %}}
-1. [Back up existing resources](https://cert-manager.io/docs/tutorials/backup/) as a precaution
-
-    ```plain
-    kubectl get -o yaml --all-namespaces \
-    issuer,clusterissuer,certificates,certificaterequests > cert-manager-backup.yaml
-    ```
-
-    > **Important:**
-    > If you are upgrading from a version older than 0.11.0, Update the apiVersion on all your backed up resources from `certmanager.k8s.io/v1alpha1` to `cert-manager.io/v1alpha2`. If you use any cert-manager annotations on any of your other resources, you will need to update them to reflect the new API group. For details, refer to the documentation on [additional annotation changes.](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/#additional-annotation-changes)
-
-1. [Uninstall existing deployment](https://cert-manager.io/docs/installation/uninstall/kubernetes/#uninstalling-with-helm)
-
-    ```plain
-    helm uninstall cert-manager
-    ```
-
-    Delete the CustomResourceDefinition using the link to the version vX.Y you installed
-
-    ```plain
-    kubectl delete -f https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml
-    ```
-
-1. Install the CustomResourceDefinition resources separately
-
-    ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    ```
-
-    > **Note:**
-    > If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false` flag to your `kubectl apply` command above. Otherwise, you will receive a validation error relating to the `x-kubernetes-preserve-unknown-fields` field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
-
-1. Create the namespace for cert-manager if needed
-
-    ```plain
-    kubectl create namespace cert-manager
-    ```
-
-1. Add the Jetstack Helm repository
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    ```
-
-1. Update your local Helm chart repository cache
-
-    ```plain
-    helm repo update
-    ```
-
-1. Install the new version of cert-manager
-
-    ```plain
-    helm install \
-      cert-manager jetstack/cert-manager \
-      --namespace cert-manager \
-      --version v0.12.0 
-    ```
-
-1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources)
-
-    ```plain
-    kubectl apply -f cert-manager-backup.yaml
-    ```
-
-{{% /accordion %}}
-
-{{% accordion id="airgap" label="Upgrading cert-manager in an airgapped environment" %}}
-### Prerequisites
-
-Before you can perform the upgrade, you must prepare your air gapped environment by adding the necessary container images to your private registry and downloading or rendering the required Kubernetes manifest files.
-
-1. Follow the guide to [Prepare your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images needed for the upgrade.
-
-1. From a system connected to the internet, add the cert-manager repo to Helm
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    ```
-
-1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
-
-    ```plain
-    helm fetch jetstack/cert-manager --version v0.12.0
-    ```
-
-1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
-
-    The Helm 3 command is as follows:
-
-    ```plain
-    helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
-    --namespace cert-manager \
-    --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
-    --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
-    --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
-    ```
-
-    The Helm 2 command is as follows:
-
-    ```plain
-    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
-    --name cert-manager --namespace cert-manager \
-    --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
-    --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
-    --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
-    ```
-
-1. Download the required CRD file for cert-manager (old and new)
-
-    ```plain
-    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    curl -L -o cert-manager/cert-manager-crd-old.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml
-    ```
-
-### Install cert-manager
-
-1. Back up existing resources as a precaution
-
-    ```plain
-    kubectl get -o yaml --all-namespaces \
-    issuer,clusterissuer,certificates,certificaterequests > cert-manager-backup.yaml
-    ```
-
-    > **Important:**
-    > If you are upgrading from a version older than 0.11.0, Update the apiVersion on all your backed up resources from `certmanager.k8s.io/v1alpha1` to `cert-manager.io/v1alpha2`. If you use any cert-manager annotations on any of your other resources, you will need to update them to reflect the new API group. For details, refer to the documentation on [additional annotation changes.](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/#additional-annotation-changes)
-
-1. Delete the existing cert-manager installation
-
-    ```plain
-    kubectl -n cert-manager \
-    delete deployment,sa,clusterrole,clusterrolebinding \
-    -l 'app=cert-manager' -l 'chart=cert-manager-v0.5.2'
-    ```
-
-    Delete the CustomResourceDefinition using the link to the version vX.Y you installed
-
-    ```plain
-    kubectl delete -f cert-manager/cert-manager-crd-old.yaml
-    ```
-
-1. Install the CustomResourceDefinition resources separately
-
-    ```plain
-    kubectl apply -f cert-manager/cert-manager-crd.yaml
-    ```
-
-    > **Note:**
-    > If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false` flag to your `kubectl apply` command above. Otherwise, you will receive a validation error relating to the `x-kubernetes-preserve-unknown-fields` field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
-
-1. Create the namespace for cert-manager
-
-    ```plain
-    kubectl create namespace cert-manager
-    ```
-
-1. Install cert-manager
-
-    ```plain
-    kubectl -n cert-manager apply -R -f ./cert-manager
-    ```
-
-1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources)
-
-    ```plain
-    kubectl apply -f cert-manager-backup.yaml
-    ```
-
-{{% /accordion %}}
-
-
-Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods:
-
-```
-kubectl get pods --namespace cert-manager
-
-NAME                                       READY   STATUS    RESTARTS   AGE
-cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
-cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
-cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m
-```
-
-## Cert-Manager API change and data migration
-
-Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release.
-
-Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format.
-
-Details about the change and migration instructions can be found in the [cert-manager v0.7 to v0.8 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
-
-The v0.11 release marks the removal of the v1alpha1 API that was used in previous versions of cert-manager, as well as our API group changing to be cert-manager.io instead of certmanager.k8s.io.
-
-We have also removed support for the old configuration format that was deprecated in the v0.8 release. This means you must transition to using the new solvers style configuration format for your ACME issuers before upgrading to v0.11. For more information, see the [upgrading to v0.8 guide](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
-
-Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
-
-More info about [cert-manager upgrade information](https://cert-manager.io/docs/installation/upgrading/).
-
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/_index.md
deleted file mode 100644
index a85228adea1..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "Don't have a Kubernetes cluster? Try one of these tutorials."
-weight: 4
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE/_index.md
deleted file mode 100644
index c644050196b..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE/_index.md
+++ /dev/null
@@ -1,170 +0,0 @@
----
-title: Setting up a High-availability RKE Kubernetes Cluster
-shortTitle: Set up RKE Kubernetes
-weight: 3
----
-
-> This page is under construction.
-
-This section describes how to install a Kubernetes cluster according to our [best practices for the Rancher server environment.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) This cluster should be dedicated to run only the Rancher server.
-
-For Rancher prior to v2.4, Rancher should be installed on an RKE Kubernetes cluster. RKE is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers.
-
-As of Rancher v2.4, the Rancher management server can be installed on either an RKE cluster or a K3s Kubernetes cluster. K3s is also a fully certified Kubernetes distribution released by Rancher, but is newer than RKE. We recommend installing Rancher on K3s because K3s is easier to use, and more lightweight, with a binary size of less than 100 MB. Note: After Rancher is installed on an RKE cluster, there is no migration path to a K3s setup at this time.
-
-The Rancher management server can only be run on Kubernetes cluster in an infrastructure provider where Kubernetes is installed using RKE or K3s. Use of Rancher on hosted Kubernetes providers, such as EKS, is not supported.
-
-For systems without direct internet access, refer to [Air Gap: Kubernetes install.]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/)
-
-> **Single-node Installation Tip:**
-> In a single-node Kubernetes cluster, the Rancher server does not have high availability, which is important for running Rancher in production. However, installing Rancher on a single-node cluster can be useful if you want to save resources by using a single node in the short term, while preserving a high-availability migration path.
->
-> To set up a single-node RKE cluster, configure only one node in the `cluster.yml` . The single node should have all three roles: `etcd`, `controlplane`, and `worker`.
->
-> In both single-node setups, Rancher can be installed with Helm on the Kubernetes cluster in the same way that it would be installed on any other cluster.
-
-# Installing Kubernetes
-
-### Required CLI Tools
-
-Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool.
-
-Also install [RKE,]({{<baseurl>}}/rke/latest/en/installation/) the Rancher Kubernetes Engine, a Kubernetes distribution and command-line tool.
-
-### 1. Create the cluster configuration file
-
-In this section, you will create a Kubernetes cluster configuration file called `rancher-cluster.yml`. In a later step, when you set up the cluster with an RKE command, it will use this file to install Kubernetes on your nodes.
-
-Using the sample below as a guide, create the `rancher-cluster.yml` file. Replace the IP addresses in the `nodes` list with the IP address or DNS names of the 3 nodes you created.
-
-If your node has public and internal addresses, it is recommended to set the `internal_address:` so Kubernetes will use it for intra-cluster communication. Some services like AWS EC2 require setting the `internal_address:` if you want to use self-referencing security groups or firewalls.
-
-RKE will need to connect to each node over SSH, and it will look for a private key in the default location of `~/.ssh/id_rsa`. If your private key for a certain node is in a different location than the default, you will also need to configure the `ssh_key_path` option for that node.
-
-```yaml
-nodes:
-  - address: 165.227.114.63
-    internal_address: 172.16.22.12
-    user: ubuntu
-    role: [controlplane, worker, etcd]
-  - address: 165.227.116.167
-    internal_address: 172.16.32.37
-    user: ubuntu
-    role: [controlplane, worker, etcd]
-  - address: 165.227.127.226
-    internal_address: 172.16.42.73
-    user: ubuntu
-    role: [controlplane, worker, etcd]
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-# Required for external TLS termination with
-# ingress-nginx v0.22+
-ingress:
-  provider: nginx
-  options:
-    use-forwarded-headers: "true"
-```
-
-<figcaption>Common RKE Nodes Options</figcaption>
-
-| Option             | Required | Description                                                                            |
-| ------------------ | -------- | -------------------------------------------------------------------------------------- |
-| `address`          | yes      | The public DNS or IP address                                                           |
-| `user`             | yes      | A user that can run docker commands                                                    |
-| `role`             | yes      | List of Kubernetes roles assigned to the node                                          |
-| `internal_address` | no       | The private DNS or IP address for internal cluster traffic                             |
-| `ssh_key_path`     | no       | Path to SSH private key used to authenticate to the node (defaults to `~/.ssh/id_rsa`) |
-
-> **Advanced Configurations:** RKE has many configuration options for customizing the install to suit your specific environment.
->
-> Please see the [RKE Documentation]({{<baseurl>}}/rke/latest/en/config-options/) for the full list of options and capabilities.
-> 
-> For tuning your etcd cluster for larger Rancher installations, see the [etcd settings guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/etcd/).
-
-### 2. Run RKE
-
-```
-rke up --config ./rancher-cluster.yml
-```
-
-When finished, it should end with the line: `Finished building Kubernetes cluster successfully`.
-
-### 3. Test Your Cluster
-
-This section describes how to set up your workspace so that you can interact with this cluster using the `kubectl` command-line tool.
-
-Assuming you have installed `kubectl`, you need to place the `kubeconfig` file in a location where `kubectl` can reach it. The `kubeconfig` file contains the credentials necessary to access your cluster with `kubectl`.
-
-When you ran `rke up`, RKE should have created a `kubeconfig` file named `kube_config_rancher-cluster.yml`. This file has the credentials for `kubectl` and `helm`.
-
-> **Note:** If you have used a different file name from `rancher-cluster.yml`, then the kube config file will be named `kube_config_<FILE_NAME>.yml`.
-
-Move this file to `$HOME/.kube/config`, or if you are working with multiple Kubernetes clusters, set the `KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`:
-
-```
-export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml
-```
-
-Test your connectivity with `kubectl` and see if all your nodes are in `Ready` state:
-
-```
-kubectl get nodes
-
-NAME                          STATUS    ROLES                      AGE       VERSION
-165.227.114.63                Ready     controlplane,etcd,worker   11m       v1.13.5
-165.227.116.167               Ready     controlplane,etcd,worker   11m       v1.13.5
-165.227.127.226               Ready     controlplane,etcd,worker   11m       v1.13.5
-```
-
-### 4. Check the Health of Your Cluster Pods
-
-Check that all the required pods and containers are healthy are ready to continue.
-
-- Pods are in `Running` or `Completed` state.
-- `READY` column shows all the containers are running (i.e. `3/3`) for pods with `STATUS` `Running`
-- Pods with `STATUS` `Completed` are run-once Jobs. For these pods `READY` should be `0/1`.
-
-```
-kubectl get pods --all-namespaces
-
-NAMESPACE       NAME                                      READY     STATUS      RESTARTS   AGE
-ingress-nginx   nginx-ingress-controller-tnsn4            1/1       Running     0          30s
-ingress-nginx   nginx-ingress-controller-tw2ht            1/1       Running     0          30s
-ingress-nginx   nginx-ingress-controller-v874b            1/1       Running     0          30s
-kube-system     canal-jp4hz                               3/3       Running     0          30s
-kube-system     canal-z2hg8                               3/3       Running     0          30s
-kube-system     canal-z6kpw                               3/3       Running     0          30s
-kube-system     kube-dns-7588d5b5f5-sf4vh                 3/3       Running     0          30s
-kube-system     kube-dns-autoscaler-5db9bbb766-jz2k6      1/1       Running     0          30s
-kube-system     metrics-server-97bc649d5-4rl2q            1/1       Running     0          30s
-kube-system     rke-ingress-controller-deploy-job-bhzgm   0/1       Completed   0          30s
-kube-system     rke-kubedns-addon-deploy-job-gl7t4        0/1       Completed   0          30s
-kube-system     rke-metrics-addon-deploy-job-7ljkc        0/1       Completed   0          30s
-kube-system     rke-network-plugin-deploy-job-6pbgj       0/1       Completed   0          30s
-```
-
-This confirms that you have successfully installed a Kubernetes cluster that the Rancher server will run on.
-
-### 5. Save Your Files
-
-> **Important**
-> The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster.
-
-Save a copy of the following files in a secure location:
-
-- `rancher-cluster.yml`: The RKE cluster configuration file.
-- `kube_config_rancher-cluster.yml`: The [Kubeconfig file]({{<baseurl>}}/rke/latest/en/kubeconfig/) for the cluster, this file contains credentials for full access to the cluster.
-- `rancher-cluster.rkestate`: The [Kubernetes Cluster State file]({{<baseurl>}}/rke/latest/en/installation/#kubernetes-cluster-state), this file contains credentials for full access to the cluster.<br/><br/>_The Kubernetes Cluster State file is only created when using RKE v0.2.0 or higher._
-
-> **Note:** The "rancher-cluster" parts of the two latter file names are dependent on how you name the RKE cluster configuration file.
-
-### Issues or errors?
-
-See the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) page.
-
-### [Next: Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE2/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE2/_index.md
deleted file mode 100644
index 761f01d1c76..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/ha-RKE2/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Setting up a High-availability RKE2 Kubernetes Cluster
-shortTitle: Set up RKE2 Kubernetes
-weight: 4
----
-
-> This page is under construction
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/how-ha-works/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/how-ha-works/_index.md
deleted file mode 100644
index 9aaf3bb236d..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/how-ha-works/_index.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: About High-availability Installations
-weight: 1
----
-
-We recommend using [Helm,]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/concepts/#about-helm) a Kubernetes package manager, to install Rancher on a dedicated Kubernetes cluster. This is called a high-availability Kubernetes installation because increased availability is achieved by running Rancher on multiple nodes.
-
-In a standard installation, Kubernetes is first installed on three nodes that are hosted in an infrastructure provider such as Amazon's EC2 or Google Compute Engine.
-
-Then Helm is used to install Rancher on top of the Kubernetes cluster. Helm uses Rancher's Helm chart to install a replica of Rancher on each of the three nodes in the Kubernetes cluster. We recommend using a load balancer to direct traffic to each replica of Rancher in the cluster, in order to increase Rancher's availability.
-
-The Rancher server data is stored on etcd. This etcd database also runs on all three nodes, and requires an odd number of nodes so that it can always elect a leader with a majority of the etcd cluster. If the etcd database cannot elect a leader, etcd can fail, requiring the cluster to be restored from backup.
-
-For information on how Rancher works, regardless of the installation method, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture)
-
-### Recommended Architecture
-
-- DNS for Rancher should resolve to a layer 4 load balancer
-- The Load Balancer should forward port TCP/80 and TCP/443 to all 3 nodes in the Kubernetes cluster.
-- The Ingress controller will redirect HTTP to HTTPS and terminate SSL/TLS on port TCP/443.
-- The Ingress controller will forward traffic to port TCP/80 on the pod in the Rancher deployment.
-
-<figcaption>Kubernetes Rancher install with layer 4 load balancer, depicting SSL termination at ingress controllers</figcaption>
-![High-availability Kubernetes Installation of Rancher]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-<sup>Kubernetes Rancher install with Layer 4 load balancer (TCP), depicting SSL termination at ingress controllers</sup>
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/_index.md
deleted file mode 100644
index c24bffb45ad..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/_index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: Don't have infrastructure for your Kubernetes cluster? Try one of these tutorials.
-shortTitle: Infrastructure Tutorials
-weight: 5
----
-
-The K3s documentation has:
-
-- Instructions for [setting up infrastructure for a high-availability K3s Kubernetes cluster with an external DB]({{<baseurl>}}/k3s/latest/en/installation/tutorials/ha-with-external-db)
-- Instructions for [setting up a high-availability K3s Kubernetes cluster with an external DB for a Rancher server]({{<baseurl>}}/k3s/latest/en/installation/tutorials/ha-with-external-db)
-
-The RKE documentation has:
-
-- Instructions for [setting up infrastructure for a high-availability RKE Kubernetes cluster]({{<baseurl>}}/)
-- Instructions for [setting up a high-availability RKE cluster]()
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
deleted file mode 100644
index ecf063ca94e..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
+++ /dev/null
@@ -1,64 +0,0 @@
----
-title: Setting up Nodes in Amazon EC2
-weight: 3
----
-
-In this tutorial, you will learn one way to set up Linux nodes for the Rancher management server. These nodes will fulfill the node requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-If the Rancher server will be installed on an RKE Kubernetes cluster, you should provision three instances.
-
-If the Rancher server will be installed on a K3s Kubernetes cluster, you only need to provision two instances.
-
-If the Rancher server is installed in a single Docker container, you only need one instance.
-
-### 1. Optional Preparation
-
-- **Create IAM role:** To allow Rancher to manipulate AWS resources, such as provisioning new storage or new nodes, you will need to configure Amazon as a cloud provider. There are several things you'll need to do to set up the cloud provider on EC2, but part of this process is setting up an IAM role for the Rancher server nodes. For the full details on setting up the cloud provider, refer to this [page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/)
-- **Create security group:** We also recommend setting up a security group for the Rancher nodes that complies with the [port requirements for Rancher nodes.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/#port-requirements)
-
-### 2. Provision Instances
-
-1. Log into the [Amazon AWS EC2 Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to take note of the **Region** where your EC2 instances (Linux nodes) are created, because all of the infrastructure for the Rancher management server should be in the same region.
-1. In the left panel, click **Instances.**
-1. Click **Launch Instance.**
-1. In the section called **Step 1: Choose an Amazon Machine Image (AMI),** we will use Ubuntu 18.04 as the Linux OS, using `ami-0d1cd67c26f5fca19 (64-bit x86)`. Go to the Ubuntu AMI and click **Select.**
-1. In the **Step 2: Choose an Instance Type** section, select the `t2.medium` type.
-1. Click **Next: Configure Instance Details.**
-1. In the **Number of instances** field, enter the number of instances. A high-availability K3s cluster requires only two instances, while a high-availability RKE cluster requires three instances.
-1. Optional: If you created an IAM role for Rancher to manipulate AWS resources, select the new IAM role in the **IAM role** field.
-1. Click **Next: Add Storage,** **Next: Add Tags,** and **Next: Configure Security Group.**
-1. In **Step 6: Configure Security Group,** select a security group that complies with the [port requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/#port-requirements) for Rancher nodes.
-1. Click **Review and Launch.**
-1. Click **Launch.**
-1. Choose a new or existing key pair that you will use to connect to your instance later. If you are using an existing key pair, make sure you already have access to the private key.
-1. Click **Launch Instances.**
-
-**Result:** You have created Rancher nodes that satisfy the requirements for OS, hardware, and networking. Next, you will install Docker on each node.
-
-### 3. Install Docker and Create User
-
-1. From the [AWS EC2 console,](https://console.aws.amazon.com/ec2/) click **Instances** in the left panel.
-1. Go to the instance that you want to install Docker on. Select the instance and click **Actions > Connect.**
-1. Connect to the instance by following the instructions on the screen that appears. Copy the Public DNS of the instance. An example command to SSH into the instance is as follows:
-```
-sudo ssh -i [path-to-private-key] ubuntu@[public-DNS-of-instance]
-```
-1. When you are connected to the instance, run the following command on the instance to create a user:
-```
-sudo usermod -aG docker ubuntu
-```
-1. Run the following command on the instance to install Docker with one of Rancher's installation scripts:
-```
-curl https://releases.rancher.com/install-docker/18.09.sh | sh
-```
-1. Repeat these steps so that Docker is installed on each node that will eventually run the Rancher management server.
-
-> To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher’s Docker installation scripts.
-
-**Result:** You have set up Rancher server nodes that fulfill all the node requirements for OS, Docker, hardware and networking.
-
-### Next Steps for RKE Kubernetes Cluster Nodes
-
-If you are going to install an RKE cluster on the new nodes, take note of the **IPv4 Public IP** and **Private IP** of each node. This information can be found on the **Description** tab for each node after it is created. The public and private IP will be used to populate the `address` and `internal_address` of each node in the RKE cluster configuration file, `rancher-cluster.yml`.
-
-RKE will also need access to the private key to connect to each node. Therefore, you might want to take note of the path to your private keys to connect to the nodes, which can also be included in the `rancher-cluster.yml` under the `ssh_key_path` directive for each node.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
deleted file mode 100644
index fde4297dfae..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
+++ /dev/null
@@ -1,83 +0,0 @@
----
-title: Setting up an NGINX Load Balancer
-weight: 4
----
-
-NGINX will be configured as Layer 4 load balancer (TCP) that forwards connections to one of your Rancher nodes.
-
-In this configuration, the load balancer is positioned in front of your nodes. The load balancer can be any host capable of running NGINX.
-
-One caveat: do not use one of your Rancher nodes as the load balancer.
-
-> These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
-
-## Install NGINX
-
-Start by installing NGINX on the node you want to use as a load balancer. NGINX has packages available for all known operating systems. The versions tested are `1.14` and `1.15`. For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-The `stream` module is required, which is present when using the official NGINX packages. Please refer to your OS documentation on how to install and enable the NGINX `stream` module on your operating system.
-
-## Create NGINX Configuration
-
-After installing NGINX, you need to update the NGINX configuration file, `nginx.conf`, with the IP addresses for your nodes.
-
-1.  Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`.
-
-2.  From `nginx.conf`, replace both occurrences (port 80 and port 443) of `<IP_NODE_1>`, `<IP_NODE_2>`, and `<IP_NODE_3>` with the IPs of your [nodes]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/).
-
-    > **Note:** See [NGINX Documentation: TCP and UDP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/) for all configuration options.
-
-    <figcaption>Example NGINX config</figcaption>
-    ```
-    worker_processes 4;
-    worker_rlimit_nofile 40000;
-
-    events {
-        worker_connections 8192;
-    }
-
-    stream {
-        upstream rancher_servers_http {
-            least_conn;
-            server <IP_NODE_1>:80 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_2>:80 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_3>:80 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen 80;
-            proxy_pass rancher_servers_http;
-        }
-
-        upstream rancher_servers_https {
-            least_conn;
-            server <IP_NODE_1>:443 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_2>:443 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_3>:443 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen     443;
-            proxy_pass rancher_servers_https;
-        }
-
-    }
-    ```
-
-
-3.  Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`.
-
-4.  Load the updates to your NGINX configuration by running the following command:
-
-    ```
-    # nginx -s reload
-    ```
-
-## Option - Run NGINX as Docker container
-
-Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /etc/nginx.conf:/etc/nginx/nginx.conf \
-  nginx:1.14
-```
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
deleted file mode 100644
index 93dabfc5113..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
+++ /dev/null
@@ -1,179 +0,0 @@
----
-title: Setting up Amazon ELB Network Load Balancer
-weight: 5
----
-
-This how-to guide describes how to set up a Network Load Balancer (NLB) in Amazon's EC2 service that will direct traffic to multiple instances on EC2.
-
-These examples show the load balancer being configured to direct traffic to three Rancher server nodes. If Rancher is installed on an RKE Kubernetes cluster, three nodes are required. If Rancher is installed on a K3s Kubernetes cluster, only two nodes are required.
-
-This tutorial is about one possible way to set up your load balancer, not the only way. Other types of load balancers, such as a Classic Load Balancer or Application Load Balancer, could also direct traffic to the Rancher server nodes.
-
-Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ALB.
-
-# Setting up the Load Balancer
-
-Configuring an Amazon NLB is a multistage process:
-
-1. [Create Target Groups](#1-create-target-groups)
-2. [Register Targets](#2-register-targets)
-3. [Create Your NLB](#3-create-your-nlb)
-4. [Add listener to NLB for TCP port 80](#4-add-listener-to-nlb-for-tcp-port-80)
-
-# Requirements
-
-These instructions assume you have already created Linux instances in EC2. The load balancer will direct traffic to these nodes.
-
-# 1. Create Target Groups
-
-Begin by creating two target groups for the **TCP** protocol, one with TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
-
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but it's convenient to add a listener for port 80, because traffic to port 80 will be automatically redirected to port 443.
-
-Regardless of whether an NGINX Ingress or Traefik Ingress controller is used, the Ingress should redirect traffic from port 80 to port 443.
-
-1. Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
-1. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
-1. Click **Create target group** to create the first target group, regarding TCP port 443.
-
-> **Note:** Health checks are handled differently based on the Ingress. For details, refer to [this section.](#health-check-paths-for-nginx-ingress-and-traefik-ingresses)
-
-### Target Group (TCP port 443)
-
-Configure the first target group according to the table below.
-
-| Option            | Setting           |
-|-------------------|-------------------|
-| Target Group Name | `rancher-tcp-443` |
-| Target type       | `instance`        |
-| Protocol          | `TCP`             |
-| Port              | `443`             |
-| VPC               | Choose your VPC   |
-
-Health check settings:
-
-| Option              | Setting         |
-|---------------------|-----------------|
-| Protocol            | TCP             |
-| Port                | `override`,`80` |
-| Healthy threshold   | `3`             |
-| Unhealthy threshold | `3`             |
-| Timeout             | `6 seconds`     |
-| Interval            | `10 seconds`    |
-
-Click **Create target group** to create the second target group, regarding TCP port 80.
-
-### Target Group (TCP port 80)
-
-Configure the second target group according to the table below.
-
-| Option            | Setting          |
-|-------------------|------------------|
-| Target Group Name | `rancher-tcp-80` |
-| Target type       | `instance`       |
-| Protocol          | `TCP`            |
-| Port              | `80`             |
-| VPC               | Choose your VPC  |
-
-
-Health check settings:
-
-| Option              |Setting         |
-|---------------------|----------------|
-| Protocol            | TCP            |
-| Port                | `traffic port` |
-| Healthy threshold   | `3`            |
-| Unhealthy threshold | `3`            |
-| Timeout             | `6 seconds`    |
-| Interval            | `10 seconds`   |
-
-# 2. Register Targets
-
-Next, add your Linux nodes to both target groups.
-
-Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**.
-
-{{< img "/img/rancher/ha/nlb/edit-targetgroup-443.png" "Edit target group 443">}}
-
-Select the instances (Linux nodes) you want to add, and click **Add to registered**.
-
-<hr>
-**Screenshot Add targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/add-targets-targetgroup-443.png" "Add targets to target group 443">}}
-
-<hr>
-**Screenshot Added targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/added-targets-targetgroup-443.png" "Added targets to target group 443">}}
-
-When the instances are added, click **Save** on the bottom right of the screen.
-
-Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group.
-
-# 3. Create Your NLB
-
-Use Amazon's Wizard to create a Network Load Balancer. As part of this process, you'll add the target groups you created in [1. Create Target Groups](#1-create-target-groups).
-
-1.  From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
-
-2.  From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**.
-
-3.  Click **Create Load Balancer**.
-
-4.  Choose **Network Load Balancer** and click **Create**. Then complete each form.
-
-- [Step 1: Configure Load Balancer](#step-1-configure-load-balancer)
-- [Step 2: Configure Routing](#step-2-configure-routing)
-- [Step 3: Register Targets](#step-3-register-targets)
-- [Step 4: Review](#step-4-review)
-
-### Step 1: Configure Load Balancer
-
-Set the following fields in the form:
-
-- **Name:** `rancher`
-- **Scheme:** `internal` or `internet-facing`. The scheme that you choose for your NLB is dependent on the configuration of your instances and VPC. If your instances do not have public IPs associated with them, or you will only be accessing Rancher internally, you should set your NLB Scheme to `internal` rather than `internet-facing`.
-- **Listeners:** The Load Balancer Protocol should be `TCP` and the corresponding Load Balancer Port should be set to `443`.
-- **Availability Zones:** Select Your **VPC** and **Availability Zones**.
-
-### Step 2: Configure Routing
-
-1. From the **Target Group** drop-down, choose **Existing target group**.
-1. From the **Name** drop-down, choose `rancher-tcp-443`.
-1. Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.
-
-### Step 3: Register Targets
-
-Since you registered your targets earlier, all you have to do is click **Next: Review**.
-
-### Step 4: Review
-
-Look over the load balancer details and click **Create** when you're satisfied.
-
-After AWS creates the NLB, click **Close**.
-
-# 4. Add listener to NLB for TCP port 80
-
-1. Select your newly created NLB and select the **Listeners** tab.
-
-2. Click **Add listener**.
-
-3. Use `TCP`:`80` as **Protocol** : **Port**
-
-4. Click **Add action** and choose **Forward to...**
-
-5. From the **Forward to** drop-down, choose `rancher-tcp-80`.
-
-6. Click **Save** in the top right of the screen.
-
-# Health Check Paths for NGINX Ingress and Traefik Ingresses
-
-K3s and RKE Kubernetes clusters handle health checks differently because they use different Ingresses by default.
-
-For RKE Kubernetes clusters, NGINX Ingress is used by default, whereas for K3s Kubernetes clusters, Traefik is the default Ingress. 
-
-- **Traefik:** The health check path is `/ping`. By default `/ping` is always matched (regardless of Host), and a response from [Traefik itself](https://docs.traefik.io/operations/ping/) is always served.
-- **NGINX Ingress:** The default backend of the NGINX Ingress controller has a `/healthz` endpoint. By default `/healthz` is always matched (regardless of Host), and a response from [`ingress-nginx` itself](https://github.com/kubernetes/ingress-nginx/blob/0cbe783f43a9313c9c26136e888324b1ee91a72f/charts/ingress-nginx/values.yaml#L212) is always served.
-
-To simulate an accurate health check, it is a best practice to use the Host header (Rancher hostname) combined with `/ping` or `/healthz` (for K3s or for RKE clusters, respectively) wherever possible, to get a response from the Rancher Pods, not the Ingress.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
deleted file mode 100644
index f40b9f96b59..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: Setting up a MySQL Database in Amazon RDS
-weight: 4
----
-This tutorial describes how to set up a MySQL database in Amazon's RDS.
-
-This database can later be used as an external datastore for a high-availability K3s Kubernetes cluster.
-
-1. Log into the [Amazon AWS RDS Console](https://console.aws.amazon.com/rds/) to get started. Make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
-1. In the left panel, click **Databases.**
-1. Click **Create database.**
-1. In the **Engine type** section, click **MySQL.**
-1. In the **Version** section, choose **MySQL 5.7.22.**
-1. In **Settings** section, under **Credentials Settings,** enter a master password for the **admin** master username. Confirm the password.
-1. Expand the **Additional configuration** section. In the **Initial database name** field, enter a name. The name can have only letters, numbers, and underscores. This name will be used to connect to the database.
-1. Click **Create database.**
-
-You'll need to capture the following information about the new database so that the K3s Kubernetes cluster can connect to it.
-
-To see this information in the Amazon RDS console, click **Databases,** and click the name of the database that you created.
-
-- **Username:** Use the admin username.
-- **Password:** Use the admin password.
-- **Hostname:** Use the **Endpoint** as the hostname. The endpoint is available in the **Connectivity & security** section.
-- **Port:** The port should be 3306 by default. You can confirm it in the **Connectivity & security** section.
-- **Database name:** Confirm the name by going to the **Configuration** tab. The name is listed under **DB name.**
-
-This information will be used to connect to the database in the following format:
-
-```
-mysql://username:password@tcp(hostname:3306)/database-name
-```
-
-For more information on configuring the datastore for K3s, refer to the [K3s documentation.]({{<baseurl>}}/k3s/latest/en/installation/datastore/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/_index.md
deleted file mode 100644
index 09b8bca60bd..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/_index.md
+++ /dev/null
@@ -1,150 +0,0 @@
----
-title: Installing Rancher on a Single Node Using Docker
-description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container.
-weight: 1
----
-
-> This section is under construction.
-
-For development and testing environments only, Rancher can be installed by running a single Docker container.
-
-In this installation scenario, you'll install Docker on a single Linux host, and then deploy Rancher on your host using a single Docker container.
-
-> **Want to use an external load balancer?**
-> See [Docker Install with an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/single-node-install-external-lb) instead.
-
-# Requirements for OS, Docker, Hardware, and Networking
-
-Make sure that your node fulfills the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-# 1. Provision Linux Host
-
-Provision a single Linux host according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements) to launch your Rancher server.
-
-# 2. Choose an SSL Option and Install Rancher
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-> **Do you want to...**
->
-> - Use a proxy? See [HTTP Proxy Configuration]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/)
-> - Configure custom CA root certificate to access your services? See [Custom CA root certificate]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/#custom-ca-certificate/)
-> - Complete an Air Gap Installation? See [Air Gap: Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/)
-> - Record all transactions with the Rancher API? See [API Auditing](#api-audit-log)
-
-Choose from the following options:
-
-### Option A: Default Rancher-generated Self-signed Certificate
-
-If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself.
-
-Log into your Linux host, and then run the minimum installation command below.
-
-```bash
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  rancher/rancher:latest
-```
-
-### Option B: Bring Your Own Certificate, Self-signed
-In development or testing environments where your team will access your Rancher server, create a self-signed certificate for use with your install so that your team can verify they're connecting to your instance of Rancher.
-
-> **Prerequisites:**
-> Create a self-signed certificate using [OpenSSL](https://www.openssl.org/) or another method of your choice.
->
-> - The certificate files must be in [PEM format](#pem).
-> - In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-After creating your certificate, run the Docker command below to install Rancher. Use the `-v` flag and provide the path to your certificates to mount them in your container.
-
-| Placeholder         | Description     |
-| ------------------- | --------------------- |
-| `<CERT_DIRECTORY>`  | The path to the directory containing your certificate files. |
-| `<FULL_CHAIN.pem>`  | The path to your full certificate chain.                     |
-| `<PRIVATE_KEY.pem>` | The path to the private key for your certificate.            |
-| `<CA_CERTS.pem>`        | The path to the certificate authority's certificate.         |
-
-```bash
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-  -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
-  rancher/rancher:latest
-```
-
-### Option C: Bring Your Own Certificate, Signed by a Recognized CA
-
-In production environments where you're exposing an app publicly, use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings.
-
-> **Prerequisites:**
->
-> - The certificate files must be in [PEM format](#pem).
-> - In your certificate file, include all intermediate certificates provided by the recognized CA. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-After obtaining your certificate, run the Docker command below.
-
-- Use the `-v` flag and provide the path to your certificates to mount them in your container. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary.
-- Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
-
-| Placeholder         | Description    |
-| ------------------- | ----------------------------- |
-| `<CERT_DIRECTORY>`  | The path to the directory containing your certificate files. |
-| `<FULL_CHAIN.pem>`  | The path to your full certificate chain.                     |
-| `<PRIVATE_KEY.pem>` | The path to the private key for your certificate. |
-
-```bash
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-  rancher/rancher:latest \
-  --no-cacerts
-```
-
-### Option D: Let's Encrypt Certificate
-
-> **Remember:** Let's Encrypt provides rate limits for requesting new certificates. Therefore, limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/).
-
-For production environments, you also have the option of using [Let's Encrypt](https://letsencrypt.org/) certificates. Let's Encrypt uses an http-01 challenge to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS.
-
-> **Prerequisites:**
->
-> - Let's Encrypt is an Internet service. Therefore, this option cannot be used in an internal/air gapped network.
-> - Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example).
-> - Open port `TCP/80` on your Linux host. The Let's Encrypt http-01 challenge can come from any source IP address, so port `TCP/80` must be open to all IP addresses.
-
-After you fulfill the prerequisites, you can install Rancher using a Let's Encrypt certificate by running the following command.
-
-| Placeholder       | Description         |
-| ----------------- | ------------------- |
-| `<YOUR.DNS.NAME>` | Your domain address |
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  rancher/rancher:latest \
-  --acme-domain <YOUR.DNS.NAME>
-```
-
-## Advanced Options
-
-When installing Rancher on a single node with Docker, there are several advanced options that can be enabled:
-
-- Custom CA Certificate
-- API Audit Log
-- TLS Settings
-- Air Gap
-- Persistent Data
-- Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node
-
-Refer to [this page](./advanced) for details.
-
-## Troubleshooting
-
-Refer to [this page](./troubleshooting) for frequently asked questions and troubleshooting tips.
-
-## What's Next?
-
-- **Recommended:** Review [Single Node Backup and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). Although you don't have any data you need to back up right now, we recommend creating backups after regular Rancher use.
-- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
deleted file mode 100644
index 4330a41fe01..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/advanced/_index.md
+++ /dev/null
@@ -1,91 +0,0 @@
----
-title: Advanced Options for Docker Installs
-weight: 2
----
-
-When installing Rancher, there are several [advanced options]({{<baseurl>}}/rancher/v2.x/en/installation/options/) that can be enabled:
-
-- [Custom CA Certificate](#custom-ca-certificate)
-- [API Audit Log](#api-audit-log)
-- [TLS Settings](#tls-settings)
-- [Air Gap](#air-gap)
-- [Persistent Data](#persistent-data)
-- [Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node](#running-rancher-rancher-and-rancher-rancher-agent-on-the-same-node)
-
-### Custom CA Certificate
-
-If you want to configure Rancher to use a CA root certificate to be used when validating services, you would start the Rancher container sharing the directory that contains the CA root certificate.
-
-Use the command example to start a Rancher container with your private CA certificates mounted.
-
-- The volume flag (`-v`) should specify the host directory containing the CA root certificates.
-- The environment variable flag (`-e`) in combination with `SSL_CERT_DIR` and directory declares an environment variable that specifies the mounted CA root certificates directory location inside the container.
-- Passing environment variables to the Rancher container can be done using `-e KEY=VALUE` or `--env KEY=VALUE`.
-- Mounting a host directory inside the container can be done using `-v host-source-directory:container-destination-directory` or `--volume host-source-directory:container-destination-directory`.
-
-The example below is based on having the CA root certificates in the `/host/certs` directory on the host and mounting this directory on `/container/certs` inside the Rancher container.
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /host/certs:/container/certs \
-  -e SSL_CERT_DIR="/container/certs" \
-  rancher/rancher:latest
-```
-
-### API Audit Log
-
-The API Audit Log records all the user and system transactions made through Rancher server.
-
-The API Audit Log writes to `/var/log/auditlog` inside the rancher container by default. Share that directory as a volume and set your `AUDIT_LEVEL` to enable the log.
-
-See [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) for more information and options.
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /var/log/rancher/auditlog:/var/log/auditlog \
-  -e AUDIT_LEVEL=1 \
-  rancher/rancher:latest
-```
-
-### TLS settings
-
-To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -e CATTLE_TLS_MIN_VERSION="1.0" \
-  rancher/rancher:latest
-```
-
-See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options.
-
-### Air Gap
-
-If you are visiting this page to complete an air gap installation, you must prepend your private registry URL to the server tag when running the installation command in the option that you choose. Add `<REGISTRY.DOMAIN.COM:PORT>` with your private registry URL in front of `rancher/rancher:latest`.
-
-**Example:**
-
-     <REGISTRY.DOMAIN.COM:PORT>/rancher/rancher:latest
-
-### Persistent Data
-
-{{< persistentdata >}}
-
-### Running `rancher/rancher` and `rancher/rancher-agent` on the Same Node
-
-In the situation where you want to use a single node to run Rancher and to be able to add the same node to a cluster, you have to adjust the host ports mapped for the `rancher/rancher` container.
-
-If a node is added to a cluster, it deploys the nginx ingress controller which will use port 80 and 443. This will conflict with the default ports we advise to expose for the `rancher/rancher` container.
-
-Please note that this setup is not recommended for production use, but can be convenient for development/demo purposes.
-
-To change the host ports mapping, replace the following part `-p 80:80 -p 443:443` with `-p 8080:80 -p 8443:443`:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 8080:80 -p 8443:443 \
-  rancher/rancher:latest
-```
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/installing-docker/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/installing-docker/_index.md
deleted file mode 100644
index ac20da0afe8..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/installing-docker/_index.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-title: Installing Docker
-weight: 1
----
-
-Docker is required to be installed on any node that runs the Rancher server.
-
-There are a couple of options for installing Docker. One option is to refer to the [official Docker documentation](https://docs.docker.com/install/) about how to install Docker on Linux. The steps will vary based on the Linux distribution.
-
-Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker.
-
-For example, this command could be used to install Docker 18.09 on Ubuntu:
-
-```
-curl https://releases.rancher.com/install-docker/18.09.sh | sh
-```
-
-To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/proxy/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/proxy/_index.md
deleted file mode 100644
index 62445cbc6e1..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/proxy/_index.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: HTTP Proxy Configuration for Docker Installs
-weight: 3
----
-
-If you operate Rancher behind a proxy and you want to access services through the proxy (such as retrieving catalogs), you must provide Rancher information about your proxy. As Rancher is written in Go, it uses the common proxy environment variables as shown below.
-
-Make sure `NO_PROXY` contains the network addresses, network address ranges and domains that should be excluded from using the proxy.
-
-| Environment variable | Purpose                                                                                                                 |
-| -------------------- | ----------------------------------------------------------------------------------------------------------------------- |
-| HTTP_PROXY           | Proxy address to use when initiating HTTP connection(s)                                                                 |
-| HTTPS_PROXY          | Proxy address to use when initiating HTTPS connection(s)                                                                |
-| NO_PROXY             | Network address(es), network address range(s) and domains to exclude from using the proxy when initiating connection(s) |
-
-> **Note** NO_PROXY must be in uppercase to use network range (CIDR) notation.
-
-## Docker Installation
-
-Passing environment variables to the Rancher container can be done using `-e KEY=VALUE` or `--env KEY=VALUE`. Required values for `NO_PROXY` in a [Docker Installation]({{<baseurl>}}/rancher/v2.x/en/installation/single-node-install/) are:
-
-- `localhost`
-- `127.0.0.1`
-- `0.0.0.0`
-- `10.0.0.0/8`
-
-The example below is based on a proxy server accessible at `http://192.168.0.1:3128`, and excluding usage the proxy when accessing network range `192.168.10.0/24` and every hostname under the domain `example.com`.
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -e HTTP_PROXY="http://192.168.10.1:3128" \
-  -e HTTPS_PROXY="http://192.168.10.1:3128" \
-  -e NO_PROXY="localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,192.168.10.0/24,example.com" \
-  rancher/rancher:latest
-```
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/single-node-install-external-lb/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/single-node-install-external-lb/_index.md
deleted file mode 100644
index d02f30e551e..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/install/resources/single-node-docker/single-node-install-external-lb/_index.md
+++ /dev/null
@@ -1,240 +0,0 @@
----
-title: Docker Install with TLS Termination at Layer-7 NGINX Load Balancer
-weight: 4
----
-
-For development and testing environments that have a special requirement to terminate TLS/SSL at a load balancer instead of your Rancher Server container, deploy Rancher and configure a load balancer to work with it conjunction.
-
-A layer-7 load balancer can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with.
-
-This install procedure walks you through deployment of Rancher using a single container, and then provides a sample configuration for a layer-7 NGINX load balancer.
-
-> **Want to skip the external load balancer?**
-> See [Docker Installation]({{<baseurl>}}/rancher/v2.x/en/installation/single-node) instead.
-
-## Requirements for OS, Docker, Hardware, and Networking
-
-Make sure that your node fulfills the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-## Installation Outline
-
-<!-- TOC -->
-
-- [1. Provision Linux Host](#1-provision-linux-host)
-- [2. Choose an SSL Option and Install Rancher](#2-choose-an-ssl-option-and-install-rancher)
-- [3. Configure Load Balancer](#3-configure-load-balancer)
-
-<!-- /TOC -->
-
-## 1. Provision Linux Host
-
-Provision a single Linux host according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements) to launch your {{< product >}} Server.
-
-## 2. Choose an SSL Option and Install Rancher
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-> **Do you want to...**
->
-> - Complete an Air Gap Installation?
-> - Record all transactions with the Rancher API?
->
-> See [Advanced Options](#advanced-options) below before continuing.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A-Bring Your Own Certificate: Self-Signed" %}}
-If you elect to use a self-signed certificate to encrypt communication, you must install the certificate on your load balancer (which you'll do later) and your Rancher container. Run the Docker command to deploy Rancher, pointing it toward your certificate.
-
-> **Prerequisites:**
-> Create a self-signed certificate.
->
-> - The certificate files must be in [PEM format](#pem).
-
-**To Install Rancher Using a Self-Signed Cert:**
-
-1. While running the Docker command to deploy Rancher, point Docker toward your CA certificate file.
-
-   ```
-   docker run -d --restart=unless-stopped \
-     -p 80:80 -p 443:443 \
-     -v /etc/your_certificate_directory/cacerts.pem:/etc/rancher/ssl/cacerts.pem \
-     rancher/rancher:latest
-   ```
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Signed by Recognized CA" %}}
-If your cluster is public facing, it's best to use a certificate signed by a recognized CA.
-
-> **Prerequisites:**
->
-> - The certificate files must be in [PEM format](#pem).
-
-**To Install Rancher Using a Cert Signed by a Recognized CA:**
-
-If you use a certificate signed by a recognized CA, installing your certificate in the Rancher container isn't necessary. We do have to make sure there is no default CA certificate generated and stored, you can do this by passing the `--no-cacerts` parameter to the container.
-
-1.  Enter the following command.
-
-        ```
-        docker run -d --restart=unless-stopped \
-        -p 80:80 -p 443:443 \
-        rancher/rancher:latest --no-cacerts
-        ```
-
-    {{% /accordion %}}
-
-## 3. Configure Load Balancer
-
-When using a load balancer in front of your Rancher container, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https` header, this redirect is disabled.
-
-The load balancer or proxy has to be configured to support the following:
-
-- **WebSocket** connections
-- **SPDY** / **HTTP/2** protocols
-- Passing / setting the following headers:
-
-    | Header | Value | Description |
-    |--------|-------|-------------|
-    | `Host`                | Hostname used to reach Rancher.          | To identify the server requested by the client.
-    | `X-Forwarded-Proto`   | `https`                                  | To identify the protocol that a client used to connect to the load balancer or proxy.<br /><br/>**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS.
-    | `X-Forwarded-Port`    | Port used to reach Rancher.              | To identify the protocol that client used to connect to the load balancer or proxy.
-    | `X-Forwarded-For`     | IP of the client connection.             | To identify the originating IP address of a client.
-### Example NGINX configuration
-
-This NGINX configuration is tested on NGINX 1.14.
-
-> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/).
-
-- Replace `rancher-server` with the IP address or hostname of the node running the Rancher container.
-- Replace both occurrences of `FQDN` to the DNS name for Rancher.
-- Replace `/certs/fullchain.pem` and `/certs/privkey.pem` to the location of the server certificate and the server certificate key respectively.
-
-```
-worker_processes 4;
-worker_rlimit_nofile 40000;
-
-events {
-    worker_connections 8192;
-}
-
-http {
-    upstream rancher {
-        server rancher-server:80;
-    }
-
-    map $http_upgrade $connection_upgrade {
-        default Upgrade;
-        ''      close;
-    }
-
-    server {
-        listen 443 ssl http2;
-        server_name FQDN;
-        ssl_certificate /certs/fullchain.pem;
-        ssl_certificate_key /certs/privkey.pem;
-
-        location / {
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass http://rancher;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
-            proxy_read_timeout 900s;
-            proxy_buffering off;
-        }
-    }
-
-    server {
-        listen 80;
-        server_name FQDN;
-        return 301 https://$server_name$request_uri;
-    }
-}
-```
-
-<br/>
-
-## What's Next?
-
-- **Recommended:** Review [Single Node Backup and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). Although you don't have any data you need to back up right now, we recommend creating backups after regular Rancher use.
-- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_single >}}
-
-## Advanced Options
-
-### API Auditing
-
-If you want to record all transactions with the Rancher API, enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by adding the flags below into your install command.
-
-    -e AUDIT_LEVEL=1 \
-    -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
-    -e AUDIT_LOG_MAXAGE=20 \
-    -e AUDIT_LOG_MAXBACKUP=20 \
-    -e AUDIT_LOG_MAXSIZE=100 \
-
-### Air Gap
-
-If you are visiting this page to complete an [Air Gap Installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/), you must pre-pend your private registry URL to the server tag when running the installation command in the option that you choose. Add `<REGISTRY.DOMAIN.COM:PORT>` with your private registry URL in front of `rancher/rancher:latest`.
-
-**Example:**
-
-     <REGISTRY.DOMAIN.COM:PORT>/rancher/rancher:latest
-
-### Persistent Data
-
-{{< persistentdata >}}
-
-This layer 7 NGINX configuration is tested on NGINX version 1.13 (mainline) and 1.14 (stable).
-
-> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
-
-```
-upstream rancher {
-    server rancher-server:80;
-}
-
-map $http_upgrade $connection_upgrade {
-    default Upgrade;
-    ''      close;
-}
-
-server {
-    listen 443 ssl http2;
-    server_name rancher.yourdomain.com;
-    ssl_certificate /etc/your_certificate_directory/fullchain.pem;
-    ssl_certificate_key /etc/your_certificate_directory/privkey.pem;
-
-    location / {
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_pass http://rancher;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-        # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
-        proxy_read_timeout 900s;
-        proxy_buffering off;
-    }
-}
-
-server {
-    listen 80;
-    server_name rancher.yourdomain.com;
-    return 301 https://$server_name$request_uri;
-}
-```
-
-<br/>
-
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
deleted file mode 100644
index 37c71224458..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/_index.md
+++ /dev/null
@@ -1,222 +0,0 @@
----
-title: Upgrade
-weight: 2
----
-
-> This page is under construction.
-
-The following instructions will guide you through using Helm to upgrade a Rancher server that was installed on a Kubernetes cluster.
-
-### Note on Upgrading the Rancher Server Kubernetes Cluster
-
-If Rancher is installed on an RKE Kubernetes cluster, refer to the [RKE documentation on upgrading the cluster.](https://rancher.com/docs/rke/latest/en/upgrades/)
-
-If Rancher is installed on a K3s Kubernetes cluster, refer to the [K3s documentation on upgrading the cluster.](https://rancher.com/docs/k3s/latest/en/upgrades/basic/)
-
-If Rancher is installed on another type of Kubernetes cluster, refer to the official documentation about upgrades for that Kubernetes distribution.
-
-
-### Known Upgrade Issues
-
-A list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
-
-### Caveats
-Upgrades _to_ or _from_ any chart in the [rancher-alpha repository]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories/) aren't supported.
-
-### Recovering from Unsuccessful Upgrades
-
-If you upgrade Rancher and the upgrade does not complete successfully, you may need to roll back your Rancher Server to its last healthy state.
-
-Restoring a snapshot of the Rancher Server cluster will revert Rancher to the version and state at the time of the snapshot.
-
->**Note:** Managed cluster are authoritative for their state. This means restoring the Rancher server will not revert workload deployments or changes made on managed clusters after the snapshot was taken.
-
-# Prerequisites
-
-- **Review the [known upgrade issues]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#known-upgrade-issues) and [caveats]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#caveats)** in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
-- **For [air gap installs only,]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) collect and populate images for the new Rancher server version.** Follow the guide to [populate your private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/) with the images for the Rancher version that you want to upgrade to.
-
-# Upgrade Outline
-
-Follow the steps to upgrade Rancher server:
-
-- [A. Back up your Kubernetes cluster that is running Rancher server](#a-backup-your-kubernetes-cluster-that-is-running-rancher-server)
-- [B. Update the Helm chart repository](#b-update-the-helm-chart-repository)
-- [C. Upgrade Rancher](#c-upgrade-rancher)
-- [D. Verify the Upgrade](#d-verify-the-upgrade)
-
-### A. Back up Your Kubernetes Cluster that is Running Rancher Server
-
-[Take a one-time snapshot]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/#option-b-one-time-snapshots)
-of your Kubernetes cluster running Rancher server. You'll use the snapshot as a restoration point if something goes wrong during upgrade.
-
-### B. Update the Helm chart repository
-
-1. Update your local helm repo cache.
-
-    ```
-    helm repo update
-    ```
-
-1. Get the repository name that you used to install Rancher.
-
-    For information about the repos and their differences, see [Helm Chart Repositories]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-
-    {{< release-channel >}}
-
-    ```
-    helm repo list
-
-    NAME          	       URL
-    stable        	       https://kubernetes-charts.storage.googleapis.com
-    rancher-<CHART_REPO>	 https://releases.rancher.com/server-charts/<CHART_REPO>
-    ```
-
-    > **Note:** If you want to switch to a different Helm chart repository, please follow the [steps on how to switch repositories]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#switching-to-a-different-helm-chart-repository). If you switch repositories, make sure to list the repositories again before continuing onto Step 3 to ensure you have the correct one added.
-
-
-1. Fetch the latest chart to install Rancher from the Helm chart repository.
-
-    This command will pull down the latest charts and save it in the current directory as a `.tgz` file.
-
-    ```plain
-    helm fetch rancher-<CHART_REPO>/rancher
-    ```
-
-### C. Upgrade Rancher
-
-This section describes how to upgrade normal (Internet-connected) or air gap installations of Rancher with Helm.
-
-{{% tabs %}}
-{{% tab "Kubernetes Upgrade" %}}
-
-Get the values, which were passed with `--set`, from the current Rancher Helm chart that is installed.
-
-```
-helm get values rancher -n cattle-system
-
-hostname: rancher.my.org
-```
-
-> **Note:** There will be more values that are listed with this command. This is just an example of one of the values.
-
-If you are also upgrading cert-manager to the latest version from a version older than 0.11.0, follow `Option B: Reinstalling Rancher and cert-manager`. Otherwise, follow `Option A: Upgrading Rancher`.
-
-{{% accordion label="Option A: Upgrading Rancher" %}}
-
-Upgrade Rancher to the latest version with all your settings.
-
-Take all the values from the previous step and append them to the command using `--set key=value`:
-
-```
-helm upgrade rancher rancher-<CHART_REPO>/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org
-```
-
-> **Note:** There will be many more options from the previous step that need to be appended.
-
-{{% /accordion %}}
-
-{{% accordion label="Option B: Reinstalling Rancher and cert-manager" %}}
-
-If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, then you need to reinstall both Rancher and cert-manger due to the API change in cert-manger v0.11. 
-
-1. Uninstall Rancher
-
-    ```
-    helm delete rancher -n cattle-system
-    ```
-
-2. Uninstall and reinstall `cert-manager` according to the instructions on the [Upgrading Cert-Manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager) page.
-
-3. Reinstall Rancher to the latest version with all your settings. Take all the values from the step 1 and append them to the command using `--set key=value`. Note: There will be many more options from the step 1 that need to be appended.
-
-    ```
-    helm install rancher rancher-<CHART_REPO>/rancher \
-    --namespace cattle-system \
-    --set hostname=rancher.my.org
-    ```
-
-{{% /accordion %}}
-
-{{% /tab %}}
-
-{{% tab "Kubernetes Air Gap Upgrade" %}}
-
-1. Render the Rancher template using the same chosen options that were used when installing Rancher. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
-
-    Based on the choice you made during installation, complete one of the procedures below.
-
-    Placeholder | Description
-    ------------|-------------
-    `<VERSION>` | The version number of the output tarball.
-    `<RANCHER.YOURDOMAIN.COM>` | The DNS name you pointed at your load balancer.
-    `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.
-    `<CERTMANAGER_VERSION>` | Cert-manager version running on k8s cluster.
-
-{{% accordion id="self-signed" label="Option A-Default Self-Signed Certificate" %}}
-
- ```plain
-helm template ./rancher-<VERSION>.tgz --output-dir . \
- --name rancher \
- --namespace cattle-system \
- --set hostname=<RANCHER.YOURDOMAIN.COM> \
- --set certmanager.version=<CERTMANAGER_VERSION> \
- --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
- --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
- --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-{{% /accordion %}}
-{{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
-
-```plain
-helm template ./rancher-<VERSION>.tgz --output-dir . \
---name rancher \
---namespace cattle-system \
---set hostname=<RANCHER.YOURDOMAIN.COM> \
---set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
---set ingress.tls.source=secret \
---set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
---set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
-
-```plain
-helm template ./rancher-<VERSION>.tgz --output-dir . \
---name rancher \
---namespace cattle-system \
---set hostname=<RANCHER.YOURDOMAIN.COM> \
---set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
---set ingress.tls.source=secret \
---set privateCA=true \
---set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
---set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-{{% /accordion %}}
-
-2. Copy the rendered manifest directories to a system with access to the Rancher server cluster and apply the rendered templates.
-
-    Use `kubectl` to apply the rendered manifests.
-
-    ```plain
-    kubectl -n cattle-system apply -R -f ./rancher
-    ```
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### D. Verify the Upgrade
-
-Log into Rancher to confirm that the upgrade succeeded.
-
->**Having network issues following upgrade?**
->
-> See [Restoring Cluster Networking]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking).
-
-## Rolling Back
-
-Should something go wrong, follow the [roll back]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/) instructions to restore the snapshot you took before you preformed the upgrade.
diff --git a/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/rollbacks/_index.md b/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/rollbacks/_index.md
deleted file mode 100644
index 940b6fd4f89..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-k8s/upgrade/rollbacks/_index.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Rolling Back the Rancher Helm Chart
-weight: 1
----
-
-> This page is under construction.
-
-If you upgrade Rancher and the upgrade does not complete successfully, you may need to [restore Rancher from backup.](../../backups/restores)
-
-Restoring a snapshot of the Rancher Server cluster will revert Rancher to the version and state at the time of the snapshot.
-
->**Note:** Managed clusters are authoritative for their state. This means restoring the rancher server will not revert workload deployments or changes made on managed clusters after the snapshot was taken.
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/_index.md
deleted file mode 100644
index a39d752685c..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-linux/_index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: Install on a Linux OS
-weight: 2
----
-
-Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to install Rancher as a Helm chart on an existing Kubernetes cluster, without installing the Rancher Kubernetes distribution.
-
-There are two main ways that Rancher can be installed:
-
-1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
-2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
-
-The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
-
-This section focuses on the installation path in which the Rancher CLI is used to provision a new Kubernetes cluster with the Rancher Helm chart built in.
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/install/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/install/_index.md
deleted file mode 100644
index 1bb080bd47f..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-linux/install/_index.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: Install
-weight: 1
----
-
-> This page is under construction.
-
-In this section, you'll learn how to create a Rancher Kubernetes cluster that comes with the Rancher Helm chart built in.
-
-> To install Rancher on an existing Kubernetes cluster, refer to the instructions on [installing the Rancher Helm chart.](../../rancher-helm-install-upgrade/installation)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
deleted file mode 100644
index ba7375d5f63..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/_index.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Upgrade
-weight: 2
----
-
-> This page is under construction.
-
-This page is about how to upgrade the local Kubernetes cluster that Rancher is installed on, as well as the Rancher Helm chart.
-
-This information applies if you set up the local Rancher server cluster using the Rancher CLI.
-
-To upgrade the Rancher server's local Kubernetes cluster using the Rancher CLI, you will first upgrade the master nodes of the cluster, and then the worker nodes.
-
-### About Rancher Kubernetes
-
-Rancher is intended to be installed on any Kubernetes cluster.
-
-The Rancher CLI comes with a Kubernetes distribution called Rancher Kubernetes, which allows you to install Kubernetes more easily as a prerequisite to installing Rancher.
-
-Rancher Kubernetes clusters can also be imported into Rancher.
-
-
-### Known Upgrade Issues
-
-A list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
-
-### Caveats
-Upgrades _to_ or _from_ any chart in the [rancher-alpha repository]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories/) aren't supported.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/_index.md
deleted file mode 100644
index f33386702a1..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Cluster Upgrade
-weight: 2
----
-
-> This section is under construction.
-
-In this section, you'll learn how to upgrade the Rancher Helm chart and the master nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/woker-node-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
deleted file mode 100644
index 76f04a09ac2..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/cluster-upgrade/woker-node-upgrade/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Worker Node Upgrade
-weight: 1
----
-
-> This page is under construction.
-
-In this section, you'll learn how to upgrade the worker nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/image-upgrade/_index.md b/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/image-upgrade/_index.md
deleted file mode 100644
index c68c3d159e7..00000000000
--- a/content/rancher/v2.5/en/install-rancher-on-linux/upgrade/image-upgrade/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Upgrade the Rancher Image
-weight: 1
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/istio/_index.md b/content/rancher/v2.5/en/istio/_index.md
deleted file mode 100644
index 6bb8cb5b3cb..00000000000
--- a/content/rancher/v2.5/en/istio/_index.md
+++ /dev/null
@@ -1,84 +0,0 @@
----
-title: Istio
-weight: 13
----
-
-> This section is under construction.
-
- [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
-
- As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
-
-Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
-
-This service mesh provides features that include but are not limited to the following:
-
-- Traffic management features
-- Enhanced monitoring and tracing
-- Service discovery and routing
-- Secure connections and service-to-service authentication with mutual TLS
-- Load balancing
-- Automatic retries, backoff, and circuit breaking
-
-After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
-
-Rancher's Istio integration comes with comprehensive visualization aids:
-
-- **Trace the root cause of errors with Jaeger.** [Jaeger](https://www.jaegertracing.io/) is an open-source tool that provides a UI for a distributed tracing system, which is useful for root cause analysis and for determining what causes poor performance. Distributed tracing allows you to view an entire chain of calls, which might originate with a user request and traverse dozens of microservices.
-- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
-- **Gain insights from time series analytics with Grafana dashboards.** [Grafana](https://grafana.com/) is an analytics platform that allows you to query, visualize, alert on and understand the data gathered by Prometheus.
-- **Write custom queries for time series data with the Prometheus UI.** [Prometheus](https://prometheus.io/) is a systems monitoring and alerting toolkit. Prometheus scrapes data from your cluster, which is then used by Grafana. A Prometheus UI is also integrated into Rancher, and lets you write custom queries for time series data and see the results in the UI.
-
-# Prerequisites
-
-Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
-
-# Setup Guide
-
-Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
-
-# Disabling Istio
-
-To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
-
-# Accessing Visualizations
-
-> By default, only cluster owners have access to Jaeger and Kiali. For instructions on how to allow project members to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
-
-After Istio is set up in a cluster, Grafana, Prometheus, Jaeger, and Kiali are available in the Rancher UI.
-
-Your access to the visualizations depend on your role. Grafana and Prometheus are only available for cluster owners. The Kiali and Jaeger UIs are available only to cluster owners by default, but cluster owners can allow project members to access them by editing the Istio settings. When you go to your project and click **Resources > Istio,** you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
-
-To see the visualizations, go to the cluster where Istio is set up and click **Tools > Istio.** You should see links to each UI at the top of the page.
-
-You can also get to the visualization tools from the project view.
-
-# Viewing the Kiali Traffic Graph
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. If you are a cluster owner, you can go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
-
-# Viewing Traffic Metrics
-
-Istio’s monitoring features provide visibility into the performance of all your services.
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.** Cluster owners can see all of the metrics, while project members can see a subset of the metrics.
-
-# Architecture
-
-Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
-
-Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
-
-Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
-
-When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
-
-For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
-
-### Two Ingresses
-
-By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
-
-![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/istio/legacy/_index.md b/content/rancher/v2.5/en/istio/legacy/_index.md
deleted file mode 100644
index 9240f82fa7f..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Legacy UI Docs
-weight: 2
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/istio/legacy/disabling-istio/_index.md b/content/rancher/v2.5/en/istio/legacy/disabling-istio/_index.md
deleted file mode 100644
index d2035689626..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/disabling-istio/_index.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-title: Disabling Istio
-weight: 4
----
-
-This section describes how to disable Istio in a cluster, namespace, or workload.
-
-# Disable Istio in a Cluster
-
-To disable Istio,
-
-1. From the **Global** view, navigate to the cluster that you want to disable Istio for.
-1. Click **Tools > Istio.**
-1. Click **Disable,** then click the red button again to confirm the disable action.
-
-**Result:** The `cluster-istio` application in the cluster's `system` project gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster.
-
-# Disable Istio in a Namespace
-
-1. In the Rancher UI, go to the project that has the namespace where you want to disable Istio.
-1. On the **Workloads** tab, you will see a list of namespaces and the workloads deployed in them. Go to the namespace where you want to disable and click the **&#8942; > Disable Istio Auto Injection.**
-
-**Result:** When workloads are deployed in this namespace, they will not have the Istio sidecar.
-
-# Remove the Istio Sidecar from a Workload
-
-Disable Istio in the namespace, then redeploy the workloads with in it. They will be deployed without the Istio sidecar.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/istio/legacy/rbac/_index.md b/content/rancher/v2.5/en/istio/legacy/rbac/_index.md
deleted file mode 100644
index eb6f3c20fa7..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/rbac/_index.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: Role-based Access Control
-weight: 3
----
-
-This section describes the permissions required to access Istio features and how to configure access to the Kiali and Jaeger visualizations.
-
-# Cluster-level Access
-
-By default, only cluster administrators can:
-
-- Enable Istio for the cluster
-- Configure resource allocations for Istio
-- View each UI for Prometheus, Grafana, Kiali, and Jaeger
-
-# Project-level Access
-
-After Istio is enabled in a cluster, project owners and members have permission to:
-
-- Enable and disable Istio sidecar auto-injection for namespaces
-- Add the Istio sidecar to workloads
-- View the traffic metrics and traffic graph for the cluster
-- View the Kiali and Jaeger visualizations if cluster administrators give access to project members
-- Configure Istio's resources (such as the gateway, destination rules, or virtual services) with `kubectl` (This does not apply to read-only project members)
-
-# Access to Visualizations
-
-By default,  the Kiali and Jaeger visualizations are restricted to the cluster owner because the information in them could be sensitive.
-
-**Jaeger** provides a UI for a distributed tracing system, which is useful for root cause analysis and for determining what causes poor performance.
-
-**Kiali** provides a diagram that shows the services within a service mesh and how they are connected.
-
-Rancher supports giving groups permission to access Kiali and Jaeger, but not individuals.
-
-To configure who has permission to access the Kiali and Jaeger UI,
-
-1. Go to the cluster view and click **Tools > Istio.**
-1. Then go to the **Member Access** section. If you want to restrict access to certain groups, choose **Allow cluster owner and specified members to access Kiali and Jaeger UI.** Search for the groups that you want to have access to Kiali and Jaeger. If you want all members to have access to the tools, click **Allow all members to access Kiali and Jaeger UI.**
-1. Click **Save.**
-
-**Result:** The access levels for Kiali and Jaeger have been updated.
-
-# Summary of Default Permissions for Istio Users
-
-| Permission                         | Cluster Administrators | Project Owners | Project Members | Read-only Project Members |
-|------------------------------------------|----------------|----------------|-----------------|---------------------------|
-| Enable and disable Istio for the cluster | ✓              |                |                 |                           |
-| Configure Istio resource limits          | ✓              |                |                 |                           |
-| Control who has access to Kiali and the Jaeger UI | ✓     |                |                 |                           |
-| Enable and disable Istio for a namespace | ✓              | ✓              | ✓              |                           |
-| Enable and disable Istio on workloads    | ✓              | ✓              | ✓              |                           |
-| Configure Istio with `kubectl`           | ✓              | ✓              | ✓              |                          |
-| View Prometheus UI and Grafana UI           | ✓              |               |               |                          |
-| View Kiali UI and Jaeger UI ([Configurable](#access-to-visualizations)) | ✓              |                |                |                           |
-| View Istio project dashboard, including traffic metrics* | ✓          | ✓              | ✓            | ✓        |
-
-* By default, only the cluster owner will see the traffic graph. Project members will see only a subset of traffic metrics. Project members cannot see the traffic graph because it comes from Kiali, and access to Kiali is restricted to cluster owners by default.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/istio/legacy/release-notes/_index.md b/content/rancher/v2.5/en/istio/legacy/release-notes/_index.md
deleted file mode 100644
index 79cadd9be69..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/release-notes/_index.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: Release Notes
-weight: 5
----
-
-
-# Istio 1.5.8
-
-### Important note on 1.5.x versions
-
-When upgrading from any 1.4 version of Istio to any 1.5 version, the Rancher installer will delete several resources in order to complete the upgrade, at which point they will be immediately re-installed. This includes the `istio-reader-service-account`. If your Istio installation is using this service account be aware that any secrets tied to the service account will be deleted. Most notably this will **break specific [multi-cluster deployments](https://archive.istio.io/v1.4/docs/setup/install/multicluster/)**. Downgrades back to 1.4 are not possible.
-
-See the official upgrade notes for additional information on the 1.5 release and upgrading from 1.4: https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/
-
-> **Note:** Rancher continues to use the Helm installation method, which produces a different architecture from an istioctl installation.
-
-### Known Issues
-
-* The Kiali traffic graph is currently not working [#24924](https://github.com/istio/istio/issues/24924)
diff --git a/content/rancher/v2.5/en/istio/legacy/resources/_index.md b/content/rancher/v2.5/en/istio/legacy/resources/_index.md
deleted file mode 100644
index 6d9c4e70d24..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/resources/_index.md
+++ /dev/null
@@ -1,148 +0,0 @@
----
-title: CPU and Memory Allocations
-weight: 1
----
-
-This section describes the minimum recommended computing resources for the Istio components in a cluster.
-
-The CPU and memory allocations for each component are [configurable.](#configuring-resource-allocations)
-
-Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough CPU and memory to run all of the components of Istio.
-
-> **Tip:** In larger deployments, it is strongly advised that the infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
-
-The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each central Istio component.
-
-In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
-
-Workload | Container | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable
----------|-----------|---------------|---------------|-------------|-------------|-------------
-istio-pilot |discovery| 500m | 2048Mi | 1000m | 4096Mi | Y
- istio-telemetry |mixer| 1000m         | 1024Mi        | 4800m       | 4096Mi      | Y            
- istio-policy | mixer      | 1000m         | 1024Mi        | 4800m       | 4096Mi      | Y            
- istio-tracing   | jaeger     | 100m          | 100Mi         | 500m        | 1024Mi      | Y            
- prometheus      | prometheus | 750m          | 750Mi         | 1000m       | 1024Mi      | Y            
- grafana         | grafana    | 100m          | 100Mi         | 200m        | 512Mi       | Y            
- Others          | -        | 500m          | 500Mi         | -         | -         | N            
- **Total**           | **-**        | **3950m**         | **5546Mi**        | **>12300m**         | **>14848Mi**         | **-**   
-
-
-# Configuring Resource Allocations
-
-You can individually configure the resource allocation for each type of Istio component. This section includes the default resource allocations for each component.
-
-To make it easier to schedule the workloads to a node, a cluster administrator can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
-
-You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/docs/concepts/what-is-istio).
-
-To configure the resources allocated to an Istio component, 
-
-1. In Rancher, go to the cluster where you have Istio installed.
-1. Click **Tools > Istio.** This opens the Istio configuration page.
-1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
-1. Click **Save.**
-
-**Result:** The resource allocations for the Istio components are updated.
-
-## Pilot
-
-[Pilot](https://istio.io/docs/ops/deployment/architecture/#pilot)  provides the following:
-
-- Authentication configuration
-- Service discovery for the Envoy sidecars
-- Traffic management capabilities for intelligent routing (A/B tests and canary rollouts)
-- Configuration for resiliency (timeouts, retries, circuit breakers, etc)
-
-For more information on Pilot, refer to the [documentation](https://istio.io/docs/concepts/traffic-management/#pilot-and-envoy).
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Pilot CPU Limit | CPU resource limit for the istio-pilot pod.| Yes      | 1000
-Pilot CPU Reservation | CPU reservation for the istio-pilot pod. | Yes      | 500
-Pilot Memory Limit | Memory resource limit for the istio-pilot pod. | Yes      | 4096
-Pilot Memory Reservation | Memory resource requests for the istio-pilot pod. | Yes      | 2048
-Trace sampling Percentage | [Trace sampling percentage](https://istio.io/docs/tasks/telemetry/distributed-tracing/overview/#trace-sampling) | Yes      | 1
-Pilot Selector | Ability to select the nodes in which istio-pilot pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
-
-## Mixer
-
-[Mixer](https://istio.io/docs/ops/deployment/architecture/#mixer)  enforces access control and usage policies across the service mesh. It also integrates with plugins for monitoring tools such as Prometheus. The Envoy sidecar proxy passes telemetry data and monitoring data to Mixer, and Mixer passes the monitoring data to Prometheus.
-
-For more information on Mixer, policies and telemetry, refer to the [documentation](https://istio.io/docs/concepts/policies-and-telemetry/).
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Mixer Telemetry CPU Limit | CPU resource limit for the istio-telemetry pod.| Yes                      | 4800
-Mixer Telemetry CPU Reservation | CPU reservation for the istio-telemetry pod.| Yes                      | 1000
-Mixer Telemetry Memory Limit | Memory resource limit for the istio-telemetry pod.| Yes                      | 4096
-Mixer Telemetry Memory Reservation | Memory resource requests for the istio-telemetry pod.| Yes                      | 1024
-Enable Mixer Policy | Whether or not to deploy the istio-policy. | Yes                      | False
-Mixer Policy CPU Limit | CPU resource limit for the istio-policy pod. | Yes, when policy enabled | 4800
-Mixer Policy CPU Reservation | CPU reservation for the istio-policy pod. | Yes, when policy enabled | 1000
-Mixer Policy Memory Limit | Memory resource limit for the istio-policy pod. | Yes, when policy enabled | 4096
-Mixer Policy Memory Reservation | Memory resource requests for the istio-policy pod. | Yes, when policy enabled | 1024
-Mixer Selector | Ability to select the nodes in which istio-policy and istio-telemetry pods are deployed to. To use this option, the nodes must have labels. | No                       | n/a
-
-## Tracing
-
-[Distributed tracing](https://istio.io/docs/tasks/telemetry/distributed-tracing/overview/) enables users to track a request through a service mesh. This makes it easier to troubleshoot problems with latency, parallelism and serialization.
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Enable Tracing | Whether or not to deploy the istio-tracing. | Yes | True
-Tracing CPU Limit | CPU resource limit for the istio-tracing pod.  | Yes      | 500
-Tracing CPU Reservation | CPU reservation for the istio-tracing pod. | Yes      | 100
-Tracing Memory Limit | Memory resource limit for the istio-tracing pod. | Yes      | 1024
-Tracing Memory Reservation | Memory resource requests for the istio-tracing pod.  | Yes      | 100
-Tracing Selector | Ability to select the nodes in which tracing pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
-
-## Ingress Gateway
-
-The Istio gateway allows Istio features such as monitoring and route rules to be applied to traffic entering the cluster. This gateway is a prerequisite for outside traffic to make requests to Istio.
-
-For more information, refer to the [documentation](https://istio.io/docs/tasks/traffic-management/ingress/).
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Enable Ingress Gateway | Whether or not to deploy the istio-ingressgateway. | Yes      | False
-Service Type of Istio Ingress Gateway | How to expose the gateway. You can choose NodePort or Loadbalancer | Yes      | NodePort
-Http2 Port | The NodePort for http2 requests  | Yes      | 31380
-Https Port | The NodePort for https requests  | Yes      | 31390
-Load Balancer IP | Ingress Gateway Load Balancer IP | No       | n/a
-Load Balancer Source Ranges | Ingress Gateway Load Balancer Source Ranges | No       | n/a
-Ingress Gateway CPU Limit | CPU resource limit for the istio-ingressgateway pod. | Yes      | 2000
-Ingress Gateway CPU Reservation | CPU reservation for the istio-ingressgateway pod. | Yes      | 100
-Ingress Gateway Memory Limit | Memory resource limit for the istio-ingressgateway pod. | Yes      | 1024
-Ingress Gateway Memory Reservation | Memory resource requests for the istio-ingressgateway pod. | Yes      | 128
-Ingress Gateway Selector | Ability to select the nodes in which istio-ingressgateway pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
-
-## Prometheus
-
-You can query for Istio metrics using Prometheus. Prometheus is an open-source systems monitoring and alerting toolkit.
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Prometheus CPU Limit | CPU resource limit for the Prometheus pod.| Yes      | 1000
-Prometheus CPU Reservation | CPU reservation for the Prometheus pod.| Yes      | 750
-Prometheus Memory Limit | Memory resource limit for the Prometheus pod.| Yes      | 1024
-Prometheus Memory Reservation | Memory resource requests for the Prometheus pod.| Yes      | 750
-Retention for Prometheus | How long your Prometheus instance retains data | Yes      | 6
-Prometheus Selector | Ability to select the nodes in which Prometheus pod is deployed to. To use this option, the nodes must have labels.| No       | n/a
-
-## Grafana
-
-You can visualize metrics with Grafana. Grafana lets you visualize Istio traffic data scraped by Prometheus.
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Enable Grafana | Whether or not to deploy the Grafana.| Yes                                                         | True
-Grafana CPU Limit | CPU resource limit for the Grafana pod.| Yes, when Grafana enabled                                   | 200
-Grafana CPU Reservation | CPU reservation for the Grafana pod.| Yes, when Grafana enabled                                   | 100
-Grafana Memory Limit | Memory resource limit for the Grafana pod.| Yes, when Grafana enabled                                   | 512
-Grafana Memory Reservation | Memory resource requests for the Grafana pod.| Yes, when Grafana enabled                                   | 100
-Grafana Selector | Ability to select the nodes in which Grafana pod is deployed to. To use this option, the nodes must have labels. | No                                                          | n/a
-Enable Persistent Storage for Grafana | Enable Persistent Storage for Grafana | Yes, when Grafana enabled                                   | False
-Source | Use a Storage Class to provision a new persistent volume or Use an existing persistent volume claim | Yes, when Grafana enabled and enabled PV                    | Use SC
-Storage Class | Storage Class for provisioning PV for Grafana | Yes, when Grafana enabled, enabled PV and use storage class | Use the default class
-Persistent Volume Size | The size for the PV you would like to provision for Grafana | Yes, when Grafana enabled, enabled PV and use storage class | 5Gi
-Existing Claim | Use existing PVC for Grafana | Yes, when Grafana enabled, enabled PV and use existing PVC  | n/a
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/_index.md
deleted file mode 100644
index da1fbcacc7a..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/_index.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Setup Guide
-weight: 2
----
-
-This section describes how to enable Istio and start using it in your projects.
-
-This section assumes that you have Rancher installed, and you have a Rancher-provisioned Kubernetes cluster where you would like to set up Istio.
-
-If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below.
-
-> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
-
-1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster)
-1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
-1. [Select the nodes where the main Istio components will be deployed.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
-1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
-1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
-1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
-1. [Generate traffic and see Istio in action.](#generate-traffic-and-see-istio-in-action)
-
-# Prerequisites
-
-This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v2.x/en/installation) and you have already [provisioned a separate Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning) on which you will install Istio.
-
-The nodes in your cluster must meet the [CPU and memory requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/)
-
-The workloads and services that you want to be controlled by Istio must meet [Istio's requirements.](https://istio.io/docs/setup/additional-setup/requirements/)
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/deploy-workloads/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/deploy-workloads/_index.md
deleted file mode 100644
index 8e52d678bbf..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/deploy-workloads/_index.md
+++ /dev/null
@@ -1,322 +0,0 @@
----
-title: 4. Add Deployments and Services with the Istio Sidecar
-weight: 4
----
-
-> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have Istio enabled.  
-
-Enabling Istio in a namespace only enables automatic sidecar injection for new workloads. To enable the Envoy sidecar for existing workloads, you need to enable it manually for each workload.
-
-To inject the Istio sidecar on an existing workload in the namespace, go to the workload, click the **&#8942;,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
-
-Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see istio-init and istio-proxy alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
-
-### 3. Add Deployments and Services
-
-Next we add the Kubernetes resources for the sample deployments and services for the BookInfo app in Istio's documentation.
-
-1. Go to the project inside the cluster you want to deploy the workload on.
-1. In Workloads, click **Import YAML.**
-1. Copy the below resources into the form.
-1. Click **Import.**
-
-This will set up the following sample resources from Istio's example BookInfo app:
-
-Details service and deployment:
-
-- A `details` Service
-- A ServiceAccount for `bookinfo-details`
-- A `details-v1` Deployment
-
-Ratings service and deployment:
-
-- A `ratings` Service
-- A ServiceAccount for `bookinfo-ratings`
-- A `ratings-v1` Deployment
-
-Reviews service and deployments (three versions):
-
-- A `reviews` Service
-- A ServiceAccount for `bookinfo-reviews`
-- A `reviews-v1` Deployment
-- A `reviews-v2` Deployment
-- A `reviews-v3` Deployment
-
-Productpage service and deployment:
-
-This is the main page of the app, which will be visible from a web browser. The other services will be called from this page.
-
-- A `productpage` service
-- A ServiceAccount for `bookinfo-productpage`
-- A `productpage-v1` Deployment
-
-### Resource YAML
-
-```yaml
-# Copyright 2017 Istio Authors
-#
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-
-##################################################################################################
-# Details service
-##################################################################################################
-apiVersion: v1
-kind: Service
-metadata:
-  name: details
-  labels:
-    app: details
-    service: details
-spec:
-  ports:
-  - port: 9080
-    name: http
-  selector:
-    app: details
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bookinfo-details
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: details-v1
-  labels:
-    app: details
-    version: v1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: details
-      version: v1
-  template:
-    metadata:
-      labels:
-        app: details
-        version: v1
-    spec:
-      serviceAccountName: bookinfo-details
-      containers:
-      - name: details
-        image: docker.io/istio/examples-bookinfo-details-v1:1.15.0
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9080
----
-##################################################################################################
-# Ratings service
-##################################################################################################
-apiVersion: v1
-kind: Service
-metadata:
-  name: ratings
-  labels:
-    app: ratings
-    service: ratings
-spec:
-  ports:
-  - port: 9080
-    name: http
-  selector:
-    app: ratings
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bookinfo-ratings
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ratings-v1
-  labels:
-    app: ratings
-    version: v1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ratings
-      version: v1
-  template:
-    metadata:
-      labels:
-        app: ratings
-        version: v1
-    spec:
-      serviceAccountName: bookinfo-ratings
-      containers:
-      - name: ratings
-        image: docker.io/istio/examples-bookinfo-ratings-v1:1.15.0
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9080
----
-##################################################################################################
-# Reviews service
-##################################################################################################
-apiVersion: v1
-kind: Service
-metadata:
-  name: reviews
-  labels:
-    app: reviews
-    service: reviews
-spec:
-  ports:
-  - port: 9080
-    name: http
-  selector:
-    app: reviews
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bookinfo-reviews
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: reviews-v1
-  labels:
-    app: reviews
-    version: v1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: reviews
-      version: v1
-  template:
-    metadata:
-      labels:
-        app: reviews
-        version: v1
-    spec:
-      serviceAccountName: bookinfo-reviews
-      containers:
-      - name: reviews
-        image: docker.io/istio/examples-bookinfo-reviews-v1:1.15.0
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9080
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: reviews-v2
-  labels:
-    app: reviews
-    version: v2
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: reviews
-      version: v2
-  template:
-    metadata:
-      labels:
-        app: reviews
-        version: v2
-    spec:
-      serviceAccountName: bookinfo-reviews
-      containers:
-      - name: reviews
-        image: docker.io/istio/examples-bookinfo-reviews-v2:1.15.0
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9080
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: reviews-v3
-  labels:
-    app: reviews
-    version: v3
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: reviews
-      version: v3
-  template:
-    metadata:
-      labels:
-        app: reviews
-        version: v3
-    spec:
-      serviceAccountName: bookinfo-reviews
-      containers:
-      - name: reviews
-        image: docker.io/istio/examples-bookinfo-reviews-v3:1.15.0
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9080
----
-##################################################################################################
-# Productpage services
-##################################################################################################
-apiVersion: v1
-kind: Service
-metadata:
-  name: productpage
-  labels:
-    app: productpage
-    service: productpage
-spec:
-  ports:
-  - port: 9080
-    name: http
-  selector:
-    app: productpage
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bookinfo-productpage
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: productpage-v1
-  labels:
-    app: productpage
-    version: v1
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: productpage
-      version: v1
-  template:
-    metadata:
-      labels:
-        app: productpage
-        version: v1
-    spec:
-      serviceAccountName: bookinfo-productpage
-      containers:
-      - name: productpage
-        image: docker.io/istio/examples-bookinfo-productpage-v1:1.15.0
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 9080
----
-```
-
-### [Next: Set up the Istio Gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
deleted file mode 100644
index a98090a28ca..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-title: 1. Enable Istio in the Cluster
-weight: 1
----
-
-This cluster uses the default Nginx controller to allow traffic into the cluster.
-
-A Rancher [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) can configure Rancher to deploy Istio in a Kubernetes cluster.
-
-> If the cluster has a Pod Security Policy enabled there are [prerequisites steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
-
-1. From the **Global** view, navigate to the **cluster** where you want to enable Istio.
-1. Click **Tools > Istio.**
-1. Optional: Configure member access and [resource limits]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/) for the Istio components. Ensure you have enough resources on your worker nodes to enable Istio.
-1. Click **Enable**.
-1. Click **Save**.
-
-**Result:** Istio is enabled at the cluster level.
-
-The Istio application, `cluster-istio`, is added as an application to the cluster's `system` project.
-
-When Istio is enabled in the cluster, the label for Istio sidecar auto injection,`istio-injection=enabled`, will be automatically added to each new namespace in this cluster. This automatically enables Istio sidecar injection in all new workloads that are deployed in those namespaces. You will need to manually enable Istio in preexisting namespaces and workloads.
-
-### [Next: Enable Istio in a Namespace]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
deleted file mode 100644
index f31369cfc61..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: Enable Istio with Pod Security Policies
----
-
- >**Note:** The following guide is only for RKE provisioned clusters.
-
-If you have restrictive Pod Security Policies enabled, then Istio may not be able to function correctly, because it needs certain permissions in order to install itself and manage pod infrastructure. In this section, we will configure a cluster with PSPs enabled for an Istio install, and also set up the Istio CNI plugin. 
-
-The Istio CNI plugin removes the need for each application pod to have a privileged `NET_ADMIN` container. For further information, see the [Istio CNI Plugin docs](https://istio.io/docs/setup/additional-setup/cni). Please note that the [Istio CNI Plugin is in alpha](https://istio.io/about/feature-stages/).
-
-- 1. [Configure the System Project Policy to allow Istio install.](#2-configure-the-system-project-policy-to-allow-istio-install)
-- 2. [Install the CNI plugin in the System project.](#3-install-the-cni-plugin-in-the-system-project)
-- 3. [Install Istio.](#4-install-istio)
-
-### 1. Configure the System Project Policy to allow Istio install
-
-1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
-1. Find the **Project: System** project and select the **&#8942; > Edit**.
-1. Change the Pod Security Policy option to be unrestricted, then click Save.
-
-
-### 2. Install the CNI Plugin in the System Project
-
-1. From the main menu of the **Dashboard**, select **Projects/Namespaces**.
-1. Select the **Project: System** project.
-1. Choose **Tools > Catalogs** in the navigation bar.
-1. Add a catalog with the following:
-	1. Name: istio-cni
-	1. Catalog URL: https://github.com/istio/cni
-	1. Branch: The branch that matches your current release, for example: `release-1.4`.
-1. From the main menu select **Apps**
-1. Click Launch and select istio-cni
-1. Update the namespace to be "kube-system"
-1. In the answers section, click "Edit as YAML" and paste in the following, then click launch:
-
-```
----
-  logLevel: "info"
-  excludeNamespaces:
-    - "istio-system"
-    - "kube-system"
-```
-
-### 3. Install Istio
-
-Follow the [primary instructions]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/), adding a custom answer: `istio_cni.enabled: true`.
-
-After Istio has finished installing, the Apps page in System Projects should show both istio and `istio-cni` applications deployed successfully. Sidecar injection will now be functional.
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
deleted file mode 100644
index 2f1f6d74786..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: 2. Enable Istio in a Namespace
-weight: 2
----
-
-You will need to manually enable Istio in each namespace that you want to be tracked or controlled by Istio. When Istio is enabled in a namespace, the Envoy sidecar proxy will be automatically injected into all new workloads that are deployed in the namespace.
-
-This namespace setting will only affect new workloads in the namespace. Any preexisting workloads will need to be re-deployed to leverage the sidecar auto injection.
-
-> **Prerequisite:** To enable Istio in a namespace, the cluster must have Istio enabled.  
-
-1. In the Rancher UI, go to the cluster view. Click the **Projects/Namespaces** tab.
-1. Go to the namespace where you want to enable the Istio sidecar auto injection and click the **&#8942;.**
-1. Click **Edit.**
-1. In the **Istio sidecar auto injection** section, click **Enable.**
-1. Click **Save.**
-
-**Result:** The namespace now has the label `istio-injection=enabled`. All new workloads deployed in this namespace will have the Istio sidecar injected by default.
-
-### Verifying that Automatic Istio Sidecar Injection is Enabled
-
-To verify that Istio is enabled, deploy a hello-world workload in the namespace. Go to the workload and click the pod name. In the **Containers** section, you should see the `istio-proxy` container.
-
-### Excluding Workloads from Being Injected with the Istio Sidecar
-
-If you need to exclude a workload from getting injected with the Istio sidecar, use the following annotation on the workload:
-
-```
-sidecar.istio.io/inject: “false”
-```
-
-To add the annotation to a workload,
-
-1. From the **Global** view, open the project that has the workload that should not have the sidecar.
-1. Click **Resources > Workloads.**
-1. Go to the workload that should not have the sidecar and click **&#8942; > Edit.**
-1. Click **Show Advanced Options.** Then expand the **Labels & Annotations** section.
-1. Click **Add Annotation.**
-1. In the **Key** field, enter `sidecar.istio.io/inject`.
-1. In the **Value** field, enter `false`.
-1. Click **Save.**
-
-**Result:** The Istio sidecar will not be injected into the workload.
-
-> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. 
-
-
-### [Next: Select the Nodes ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/gateway/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/gateway/_index.md
deleted file mode 100644
index 47c9ff33812..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/gateway/_index.md
+++ /dev/null
@@ -1,130 +0,0 @@
----
-title: 5. Set up the Istio Gateway
-weight: 5
----
-
-The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. 
-
-You can use the NGINX ingress controller with or without Istio installed. If this is the only gateway to your cluster, Istio will be able to route traffic from service to service, but Istio will not be able to receive traffic from outside the cluster.
-
-To allow Istio to receive external traffic, you need to enable Istio's gateway, which works as a north-south proxy for external traffic. When you enable the Istio gateway, the result is that your cluster will have two ingresses.
-
-You will also need to set up a Kubernetes gateway for your services. This Kubernetes resource points to Istio's implementation of the ingress gateway to the cluster.
-
-You can route traffic into the service mesh with a load balancer or just Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
-
-For more information on the Istio gateway, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/gateway/) 
-
-![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
-
-# Enable the Istio Gateway
-
-The ingress gateway is a Kubernetes service that will be deployed in your cluster. There is only one Istio gateway per cluster.
-
-1. Go to the cluster where you want to allow outside traffic into Istio.
-1. Click **Tools > Istio.**
-1. Expand the **Ingress Gateway** section.
-1. Under **Enable Ingress Gateway,** click **True.** The default type of service for the Istio gateway is NodePort. You can also configure it as a [load balancer.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/)
-1. Optionally, configure the ports, service types, node selectors and tolerations, and resource requests and limits for this service. The default resource requests for CPU and memory are the minimum recommended resources.
-1. Click **Save.**
-
-**Result:** The gateway is deployed, which allows Istio to receive traffic from outside the cluster.
-
-# Add a Kubernetes Gateway that Points to the Istio Gateway
-
-To allow traffic to reach Ingress, you will also need to provide a Kubernetes gateway resource in your YAML that points to Istio's implementation of the ingress gateway to the cluster.
-
-1. Go to the namespace where you want to deploy the Kubernetes gateway and click **Import YAML.**
-1. Upload the gateway YAML as a file or paste it into the form. An example gateway YAML is provided below.
-1.  Click **Import.**
-
-```yaml
-apiVersion: networking.istio.io/v1alpha3
-kind: Gateway
-metadata:
-  name: bookinfo-gateway
-spec:
-  selector:
-    istio: ingressgateway # use istio default controller
-  servers:
-    - port:
-        number: 80
-        name: http
-        protocol: HTTP
-      hosts:
-        - "*"
----
-apiVersion: networking.istio.io/v1alpha3
-kind: VirtualService
-metadata:
-  name: bookinfo
-spec:
-  hosts:
-  - "*"
-  gateways:
-  - bookinfo-gateway
-  http:
-  - match:
-    - uri:
-        exact: /productpage
-    - uri:
-        prefix: /static
-    - uri:
-        exact: /login
-    - uri:
-        exact: /logout
-    - uri:
-        prefix: /api/v1/products
-    route:
-    - destination:
-        host: productpage
-        port:
-          number: 9080
-```
-
-**Result:** You have configured your gateway resource so that Istio can receive traffic from outside the cluster.
-
-Confirm that the resource exists by running:
-```
-kubectl get gateway -A
-```
-
-The result should be something like this:
-```
-NAME               AGE
-bookinfo-gateway   64m
-```
-
-### Access the ProductPage Service from a Web Browser
-
-To test and see if the BookInfo app deployed correctly, the app can be viewed a web browser using the Istio controller IP and port, combined with the request name specified in your Kubernetes gateway resource:
-
-`http://<IP of Istio controller>:<Port of istio controller>/productpage`
-
-To get the ingress gateway URL and port,
-
-1. Go to the `System` project in your cluster.
-1. Within the `System` project, go to `Resources` > `Workloads` then scroll down to the `istio-system` namespace. 
-1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Under the name of this workload, you should see links, such as `80/tcp`.
-1. Click one of those links. This should show you the URL of the ingress gateway in your web browser. Append `/productpage` to the URL.
-
-**Result:** You should see the BookInfo app in the web browser.
-
-For help inspecting the Istio controller URL and ports, try the commands the [Istio documentation.](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#determining-the-ingress-ip-and-ports)
-
-# Troubleshooting
-
-The [official Istio documentation](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#troubleshooting) suggests `kubectl` commands to inspect the correct ingress host and ingress port for external requests.
-
-### Confirming that the Kubernetes Gateway Matches Istio's Ingress Controller
-
-You can try the steps in this section to make sure the Kubernetes gateway is configured properly.
-
-In the gateway resource, the selector refers to Istio's default ingress controller by its label, in which the key of the label is `istio` and the value is `ingressgateway`.  To make sure the label is appropriate for the gateway, do the following:
-
-1. Go to the `System` project in your cluster.
-1. Within the `System` project, go to the namespace `istio-system`. 
-1. Within `istio-system`, there is a workload named `istio-ingressgateway`.
-1. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
-
-### [Next: Set up Istio's Components for Traffic Management]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/node-selectors/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/node-selectors/_index.md
deleted file mode 100644
index 994656361e3..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/node-selectors/_index.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: 3. Select the Nodes Where Istio Components Will be Deployed
-weight: 3
----
-
-> **Prerequisite:** Your cluster needs a worker node that can designated for Istio. The worker node should meet the [resource requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources)
-
-This section describes how use node selectors to configure Istio components to be deployed on a designated node.
-
-In larger deployments, it is strongly advised that Istio's infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
-
-# Adding a Label to the Istio Node
-
-First, add a label to the node where Istio components should be deployed. This label can have any key-value pair. For this example, we will use the key `istio` and the value `enabled`.
-
-1. From the cluster view, go to the **Nodes** tab.
-1. Go to a worker node that will host the Istio components and click **&#8942; > Edit.**
-1. Expand the **Labels & Annotations** section.
-1. Click **Add Label.**
-1. In the fields that appear, enter `istio` for the key and `enabled` for the value.
-1. Click **Save.**
-
-**Result:** A worker node has the label that will allow you to designate it for Istio components.
-
-# Configuring Istio Components to Use the Labeled Node
-
-Configure each Istio component to be deployed to the node with the Istio label. Each Istio component can be configured individually, but in this tutorial, we will configure all of the components to be scheduled on the same node for the sake of simplicity.
-
-For larger deployments, it is recommended to schedule each component of Istio onto separate nodes.
-
-1. From the cluster view, click **Tools > Istio.**
-1. Expand the **Pilot** section and click **Add Selector** in the form that appears. Enter the node selector label that you added to the Istio node. In our case, we are using the key `istio` and the value `enabled.`
-1. Repeat the previous step for the **Mixer** and **Tracing** sections.
-1. Click **Save.**
-
-**Result:** The Istio components will be deployed on the Istio node.
-
-### [Next: Add Deployments and Services]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/set-up-traffic-management/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/set-up-traffic-management/_index.md
deleted file mode 100644
index 2048e779265..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/set-up-traffic-management/_index.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-title: 6. Set up Istio's Components for Traffic Management
-weight: 6
----
-
-A central advantage of traffic management in Istio is that it allows dynamic request routing. Some common applications for dynamic request routing include canary deployments and blue/green deployments. The two key resources in Istio traffic management are *virtual services* and *destination rules*.
-
-- [Virtual services](https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/) intercept and direct traffic to your Kubernetes services, allowing you to divide percentages of traffic from a request to different services. You can use them to define a set of routing rules to apply when a host is addressed.
-- [Destination rules](https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/) serve as the single source of truth about which service versions are available to receive traffic from virtual services. You can use these resources to define policies that apply to traffic that is intended for a service after routing has occurred.
-
-This section describes how to add an example virtual service that corresponds to the `reviews` microservice in the sample BookInfo app. The purpose of this service is to divide traffic between two versions of the `reviews` service.
-
-In this example, we take the traffic to the `reviews` service and intercept it so that 50 percent of it goes to `v1` of the service and 50 percent goes to `v2`.
-
-After this virtual service is deployed, we will generate traffic and see from the Kiali visualization that traffic is being routed evenly between the two versions of the service.
-
-To deploy the virtual service and destination rules for the `reviews` service,
-
-1. Go to the project view and click **Import YAML.**
-1. Copy resources below into the form.
-1.  Click **Import.**
-
-```
-apiVersion: networking.istio.io/v1alpha3
-kind: VirtualService
-metadata:
-  name: reviews
-spec:
-  hosts:
-  - reviews
-  http:
-  - route:
-    - destination:
-        host: reviews
-        subset: v1
-      weight: 50
-    - destination:
-        host: reviews
-        subset: v3
-      weight: 50
----
-apiVersion: networking.istio.io/v1alpha3
-kind: DestinationRule
-metadata:
-  name: reviews
-spec:
-  host: reviews
-  subsets:
-  - name: v1
-    labels:
-      version: v1
-  - name: v2
-    labels:
-      version: v2
-  - name: v3
-    labels:
-      version: v3
-```
-**Result:** When you generate traffic to this service (for example, by refreshing the ingress gateway URL), the Kiali traffic graph will reflect that traffic to the `reviews` service is divided evenly between `v1` and `v3`.
-
-### [Next: Generate and View Traffic]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic)
diff --git a/content/rancher/v2.5/en/istio/legacy/setup/view-traffic/_index.md b/content/rancher/v2.5/en/istio/legacy/setup/view-traffic/_index.md
deleted file mode 100644
index bb6c979e28d..00000000000
--- a/content/rancher/v2.5/en/istio/legacy/setup/view-traffic/_index.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-title: 7. Generate and View Traffic
-weight: 7
----
-
-This section describes how to view the traffic that is being managed by Istio.
-
-# The Kiali Traffic Graph
-
-Rancher integrates a Kiali graph into the Rancher UI. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
-
-To see the traffic graph,
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. Go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
-
-If you refresh the URL to the BookInfo app several times, you should be able to see green arrows on the Kiali graph showing traffic to `v1` and `v3` of the `reviews` service. The control panel on the right side of the graph lets you configure details including how many minutes of the most recent traffic should be shown on the graph.
-
-For additional tools and visualizations, you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
-
-# Viewing Traffic Metrics
-
-Istio’s monitoring features provide visibility into the performance of all your services.
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.**
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/logging/legacy/_index.md b/content/rancher/v2.5/en/logging/legacy/_index.md
deleted file mode 100644
index 5f8404cf23d..00000000000
--- a/content/rancher/v2.5/en/logging/legacy/_index.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-title: Legacy UI Docs
-weight: 2
----
-
-Logging is helpful because it allows you to:
-
-- Capture and analyze the state of your cluster
-- Look for trends in your environment
-- Save your logs to a safe location outside of your cluster
-- Stay informed of events like a container crashing, a pod eviction, or a node dying
-- More easily debug and troubleshoot problems
-
-Rancher supports integration with the following services:
-
-- Elasticsearch
-- Splunk
-- Kafka
-- Syslog
-- Fluentd
-
-This section covers the following topics:
-
-- [How logging integrations work](#how-logging-integrations-work)
-- [Requirements](#requirements)
-- [Logging scope](#logging-scope)
-- [Enabling cluster logging](#enabling-cluster-logging)
-
-# How Logging Integrations Work
-
-Rancher can integrate with popular external services used for event streams, telemetry, or search. These services can log errors and warnings in your Kubernetes infrastructure to a stream.
-
-These services collect container log events, which are saved to the `/var/log/containers` directory on each of your nodes. The service collects both standard and error events. You can then log into your services to review the events collected, leveraging each service's unique features.
-
-When configuring Rancher to integrate with these services, you'll have to point Rancher toward the service's endpoint and provide authentication information.
-
-Additionally, you'll have the opportunity to enter key-value pairs to filter the log events collected. The service will only collect events for containers marked with your configured key-value pairs.
-
->**Note:** You can only configure one logging service per cluster or per project.
-
-# Requirements
-
-The Docker daemon on each node in the cluster should be [configured](https://docs.docker.com/config/containers/logging/configure/) with the (default) log-driver: `json-file`. You can check the log-driver by running the following command:
-
-```
-$ docker info | grep 'Logging Driver'
-Logging Driver: json-file
-```
-
-# Logging Scope
-
-You can configure logging at either cluster level or project level.
-
-- Cluster logging writes logs for every pod in the cluster, i.e. in all the projects. For [RKE clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters), it also writes logs for all the Kubernetes system components.
-- [Project logging]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/logging/) writes logs for every pod in that particular project.
-
-Logs that are sent to your logging service are from the following locations:
-
-  - Pod logs stored at `/var/log/containers`.
-  - Kubernetes system components logs stored at `/var/lib/rancher/rke/log/`.
-
-# Enabling Cluster Logging
-
-As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to send Kubernetes logs to a logging service.
-
-1. From the **Global** view, navigate to the cluster that you want to configure cluster logging.
-
-1. Select **Tools > Logging** in the navigation bar.
-
-1. Select a logging service and enter the configuration. Refer to the specific service for detailed configuration. Rancher supports integration with the following services:
-
-   - [Elasticsearch]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/)
-   - [Splunk]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/splunk/)
-   - [Kafka]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/kafka/)
-   - [Syslog]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/syslog/)
-   - [Fluentd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/)
-
-1. (Optional) Instead of using the UI to configure the logging services, you can enter custom advanced configurations by clicking on **Edit as File**, which is located above the logging targets. This link is only visible after you select a logging service.
-
-    - With the file editor, enter raw fluentd configuration for any logging service. Refer to the documentation for each logging service on how to setup the output configuration.
-
-       - [Elasticsearch Documentation](https://github.com/uken/fluent-plugin-elasticsearch)
-       - [Splunk Documentation](https://github.com/fluent/fluent-plugin-splunk)
-       - [Kafka Documentation](https://github.com/fluent/fluent-plugin-kafka)
-       - [Syslog Documentation](https://github.com/dlackty/fluent-plugin-remote_syslog)
-       - [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/out_forward)
-
-   - If the logging service is using TLS, you also need to complete the **SSL Configuration** form.
-       1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
-
-           - You can use either a self-signed certificate or one provided by a certificate authority.
-
-           - You can generate a self-signed certificate using an openssl command. For example:
-
-                ```
-                openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-                ```
-       2. If you are using a self-signed certificate, provide the **CA Certificate PEM**.
-
-1. (Optional) Complete the **Additional Logging Configuration** form.
-
-    1. **Optional:** Use the **Add Field** button to add custom log fields to your logging configuration. These fields are key value pairs (such as `foo=bar`) that you can use to filter the logs from another system.
-
-    1. Enter a **Flush Interval**. This value determines how often [Fluentd](https://www.fluentd.org/) flushes data to the logging server. Intervals are measured in seconds.
-
-    1. **Include System Log**. The logs from pods in system project and RKE components will be sent to the target. Uncheck it to exclude the system logs.
-
-1. Click **Test**. Rancher sends a test log to the service.
-
-    > **Note:** This button is replaced with _Dry Run_ if you are using the custom configuration editor. In this case, Rancher calls the fluentd dry run command to validate the configuration.
-
-1. Click **Save**.
-
-**Result:** Rancher is now configured to send logs to the selected service. Log into the logging service so that you can start viewing the logs.
-
-## Related Links
-
-[Logging Architecture](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
diff --git a/content/rancher/v2.5/en/logging/legacy/elasticsearch/_index.md b/content/rancher/v2.5/en/logging/legacy/elasticsearch/_index.md
deleted file mode 100644
index 5f9a2a7b724..00000000000
--- a/content/rancher/v2.5/en/logging/legacy/elasticsearch/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Elasticsearch
-weight: 200
----
-
-If your organization uses [Elasticsearch](https://www.elastic.co/), either on premise or in the cloud, you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Elasticsearch deployment to view logs.
-
->**Prerequisites:** Configure an [Elasticsearch deployment](https://www.elastic.co/guide/en/cloud/saas-release/ec-create-deployment.html).
-
-## Elasticsearch Deployment Configuration
-
-1. In the **Endpoint** field, enter the IP address and port of your Elasticsearch instance. You can find this information from the dashboard of your Elasticsearch deployment.
-
-    * Elasticsearch usually uses port `9200` for HTTP and `9243` for HTTPS.
-
-1. If you are using [X-Pack Security](https://www.elastic.co/guide/en/x-pack/current/xpack-introduction.html), enter your Elasticsearch **Username** and **Password** for authentication.
-
-1. Enter an [Index Pattern](https://www.elastic.co/guide/en/kibana/current/index-patterns.html).
-
-## SSL Configuration
-
-If your instance of Elasticsearch uses SSL, your **Endpoint** will need to begin with `https://`. With the correct endpoint, the **SSL Configuration** form is enabled and ready to be completed.
-
-1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
-
-    - You can use either a self-signed certificate or one provided by a certificate authority.
-
-    - You can generate a self-signed certificate using an openssl command. For example:
-
-         ```
-         openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-         ```
-
-1. Enter your **Client Key Password**.
-
-1. Enter your **SSL Version**. The default version is `TLSv1_2`.
-
-1. Select whether or not you want to verify your SSL.
-
-    * If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.  
-    * If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
diff --git a/content/rancher/v2.5/en/logging/legacy/fluentd/_index.md b/content/rancher/v2.5/en/logging/legacy/fluentd/_index.md
deleted file mode 100644
index 42f54794862..00000000000
--- a/content/rancher/v2.5/en/logging/legacy/fluentd/_index.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: Fluentd
-weight: 600
----
-
-If your organization uses [Fluentd](https://www.fluentd.org/), you can configure Rancher to send it Kubernetes logs.  Afterwards, you can log into your Fluentd server to view logs.
-
->**Prerequisites:** Configure Fluentd input forward to receive the event stream.
->
->See [Fluentd Documentation](https://docs.fluentd.org/v1.0/articles/in_forward) for details.
-
-## Fluentd Configuration
-
-You can add multiple Fluentd Servers. If you want to add additional Fluentd servers, click **Add Fluentd Server**. For each Fluentd server, complete the configuration information:
-
-1. In the **Endpoint** field, enter the address and port of your Fluentd instance, e.g. `http://Fluentd-server:24224`.
-
-1. Enter the **Shared Key** if your Fluentd Server is using a shared key for authentication.
-
-1. Enter the **Username** and **Password** if your Fluentd Server is using username and password for authentication.
-
-1. **Optional:** Enter the **Hostname** of the Fluentd server.
-
-1. Enter the load balancing **Weight** of the Fluentd server. If the weight of one server is 20 and the other server is 30, events will be sent in a 2:3 ratio. If you do not enter a weight, the default weight is 60.
-
-1. If this server is a standby server, check **Use as Standby Only**. Standby servers are used when all other servers are not available.
-
-After adding all the Fluentd servers, you have the option to select **Enable Gzip Compression**. By default, this is enabled because the transferred payload size will be reduced.
-
-## SSL Configuration
-
-If your Fluentd servers are using TLS, you need to select **Use TLS**. If you are using a self-signed certificate, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.
-
->**Note:** Fluentd does not support self-signed certificates when client authentication is enabled. 
diff --git a/content/rancher/v2.5/en/logging/legacy/kafka/_index.md b/content/rancher/v2.5/en/logging/legacy/kafka/_index.md
deleted file mode 100644
index 6c0b69bc508..00000000000
--- a/content/rancher/v2.5/en/logging/legacy/kafka/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Kafka
-weight: 400
----
-
-If your organization uses [Kafka](https://kafka.apache.org/), you can configure Rancher to send it Kubernetes logs.  Afterwards, you can log into your Kafka server to view logs.
-
->**Prerequisite:** You must have a Kafka server configured.
-
-## Kafka Server Configuration
-
-1. Select the type of **Endpoint** your Kafka server is using:
-
-  * **Zookeeper**: Enter the IP address and port. By default, Zookeeper uses port `2181`. Please note that a Zookeeper endpoint cannot enable TLS.
-  * **Broker**: Click on **Add Endpoint**. For each Kafka broker, enter the IP address and port. By default, Kafka brokers use port `9092`.
-
-1. In the **Topic** field, enter the name of a Kafka [topic](https://kafka.apache.org/documentation/#basic_ops_add_topic) that your Kubernetes cluster submits logs to.
-
-## **Broker** Endpoint Type
-
-### SSL Configuration
-
-If your Kafka cluster is using SSL for the **Broker**, you need to complete the **SSL Configuration** form.
-
-1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
-
-1. Provide the **CA Certificate PEM**. You can either copy and paste the certificate or upload it using the **Read from a file** button.
-
->**Note:** Kafka does not support self-signed certificates when client authentication is enabled. 
-
-### SASL configuration
-
-If your Kafka cluster is using [SASL authentication](https://kafka.apache.org/documentation/#security_sasl) for the Broker, you need to complete the **SASL Configuration** form.
-
-1. Enter the SASL **Username** and **Password**.
-
-1. Select the **SASL Type** that your Kafka cluster is using.
-
-    * If your Kafka is using **Plain**, please ensure your Kafka cluster is using SSL.
-
-    * If your Kafka is using **Scram**, you need to select which **Scram Mechanism** Kafka is using.
diff --git a/content/rancher/v2.5/en/logging/legacy/splunk/_index.md b/content/rancher/v2.5/en/logging/legacy/splunk/_index.md
deleted file mode 100644
index 67482f0aa3f..00000000000
--- a/content/rancher/v2.5/en/logging/legacy/splunk/_index.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-title: Splunk
-weight: 300
----
-
-If your organization uses [Splunk](https://www.splunk.com/), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Splunk server to view logs.
-
->**Prerequisites:**
->
->- Configure HTTP event collection for your Splunk Server (Splunk Enterprise or Splunk Cloud).
->- Either create a new token or copy an existing token.
->
->For more information, see [Splunk Documentation](http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector#About_Event_Collector_tokens).
-
-## Splunk Configuration
-
-1. In the **Endpoint** field, enter the IP address and port for you Splunk instance (i.e. `http://splunk-server:8088`)
-
-    * Splunk usually uses port `8088`. If you're using Splunk Cloud, you'll need to work with [Splunk support](https://www.splunk.com/en_us/support-and-services.html) to get an endpoint URL.
-
-1. Enter the **Token** you obtained while completing the prerequisites (i.e., when you created a token in Splunk).
-
-1. In the **Source** field, enter the name of the token as entered in Splunk.
-
-1. **Optional:** Provide one or more [index](http://docs.splunk.com/Documentation/Splunk/7.1.2/Indexer/Aboutindexesandindexers) that's allowed for your token.
-
-## SSL Configuration
-
-If your instance of Splunk uses SSL, your **Endpoint** will need to begin with `https://`. With the correct endpoint, the **SSL Configuration** form is enabled and ready to be completed.
-
-1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
-
-    - You can use either a self-signed certificate or one provided by a certificate authority.
-
-    - You can generate a self-signed certificate using an openssl command. For example:
-
-         ```
-         openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-         ```
-
-1. Enter your **Client Key Password**.
-
-1. Select whether or not you want to verify your SSL.
-
-    * If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.  
-    * If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
-
-## Viewing Logs
-
-1. Log into your Splunk server.
-
-1. Click on **Search & Reporting**. The number of **Indexed Events** listed should be increasing.
-
-1. Click on Data Summary and select the Sources tab.
-  ![View Logs]({{<baseurl>}}/img/rancher/splunk/splunk4.jpg)
-
-1. To view the actual logs, click on the source that you declared earlier.
-  ![View Logs]({{<baseurl>}}/img/rancher/splunk/splunk5.jpg)
-
-## Troubleshooting
-
-You can use curl to see if **HEC** is listening for HTTP event data.
-
-```
-$ curl http://splunk-server:8088/services/collector/event \
-    -H 'Authorization: Splunk 8da70994-b1b0-4a79-b154-bfaae8f93432' \
-    -d '{"event": "hello world"}'
-```
-
-If Splunk is configured correctly, you should receive **json** data returning `success code 0`. You should be able
-to send logging data to HEC.
-
-If you received an error, check your configuration in Splunk and Rancher.
diff --git a/content/rancher/v2.5/en/logging/legacy/syslog/_index.md b/content/rancher/v2.5/en/logging/legacy/syslog/_index.md
deleted file mode 100644
index aa997ca949a..00000000000
--- a/content/rancher/v2.5/en/logging/legacy/syslog/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Syslog
-weight: 500
----
-
-If your organization uses [Syslog](https://tools.ietf.org/html/rfc5424), you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Syslog server to view logs.
-
->**Prerequisite:** You must have a Syslog server configured.
-
-If you are using rsyslog, please make sure your rsyslog authentication mode is `x509/name`.
-
-## Syslog Server Configuration
-
-1. In the **Endpoint** field, enter the IP address and port for your Syslog server. Additionally, in the dropdown, select the protocol that your Syslog server uses.
-
-1. In the **Program** field, enter the name of the application sending logs to your Syslog server, e.g. `Rancher`.
-
-1. If you are using a cloud logging service, e.g. [Sumologic](https://www.sumologic.com/), enter a **Token** that authenticates with your Syslog server. You will need to create this token in the cloud logging service.
-
-1. Select a **Log Severity** for events that are logged to the Syslog server. For more information on each severity level, see the [Syslog protocol documentation](https://tools.ietf.org/html/rfc5424#page-11).
-
-    - By specifying a **Log Severity** does not mean that will act as a filtering mechanism for logs. To do that you should use a parser on the Syslog server.
-
-## Encryption Configuration
-
-If your Syslog server is using **TCP** protocol and uses TLS, you need to select **Use TLS** and complete the **Encryption Configuration** form.
-
-1. Provide the **Client Private Key** and **Client Certificate**. You can either copy and paste them or upload them by using the **Read from a file** button.
-
-    - You can use either a self-signed certificate or one provided by a certificate authority.
-
-    - You can generate a self-signed certificate using an openssl command. For example:
-
-         ```
-         openssl req -x509 -newkey rsa:2048 -keyout myservice.key -out myservice.cert -days 365 -nodes -subj "/CN=myservice.example.com"
-         ```
-
-1. Select whether or not you want to verify your SSL.
-
-    * If you are using a self-signed certificate, select **Enabled - Input trusted server certificate**, provide the **CA Certificate PEM**. You can copy and paste the certificate or upload it using the **Read from a file** button.  
-    * If you are using a certificate from a certificate authority, select **Enabled - Input trusted server certificate**. You do not need to provide a **CA Certificate PEM**.
diff --git a/content/rancher/v2.5/en/longhorn-storage/_index.md b/content/rancher/v2.5/en/longhorn-storage/_index.md
deleted file mode 100644
index 6fa8ec6a750..00000000000
--- a/content/rancher/v2.5/en/longhorn-storage/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Longhorn Storage
-weight: 14
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/longhorn-storage/legacy/_index.md b/content/rancher/v2.5/en/longhorn-storage/legacy/_index.md
deleted file mode 100644
index 1629da37c2d..00000000000
--- a/content/rancher/v2.5/en/longhorn-storage/legacy/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Legacy UI Docs
-weight: 2
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/managing-applications/_index.md b/content/rancher/v2.5/en/managing-applications/_index.md
deleted file mode 100644
index 808c3bf7ea6..00000000000
--- a/content/rancher/v2.5/en/managing-applications/_index.md
+++ /dev/null
@@ -1,101 +0,0 @@
----
-title: Managing Applications
-description: Rancher enables the use of catalogs to repeatedly deploy applications easily. Catalogs are GitHub or Helm Chart repositories filled with deployment-ready apps.
-weight: 7
----
-
-> This section is under construction.
-
-Rancher provides the ability to use a catalog of Helm charts that make it easy to repeatedly deploy applications.
-
-- **Catalogs** are GitHub repositories or Helm Chart repositories filled with applications that are ready-made for deployment. Applications are bundled in objects called _Helm charts_.
-- **Helm charts** are a collection of files that describe a related set of Kubernetes resources. A single chart might be used to deploy something simple, like a memcached pod, or something complex, like a full web app stack with HTTP servers, databases, caches, and so on.
-
-Rancher improves on Helm catalogs and charts. All native Helm charts can work within Rancher, but Rancher adds several enhancements to improve their user experience.
-
-This section covers the following topics:
-
-- [Catalog scopes](#catalog-scopes)
-- [Catalog Helm Deployment Versions](#catalog-helm-deployment-versions)
-- [When to use Helm 3](#when-to-use-helm-3)
-- [Helm 3 Backwards Compatibility](#helm-3-backwards-compatibility)
-- [Built-in global catalogs](#built-in-global-catalogs)
-- [Custom catalogs](#custom-catalogs)
-- [Creating and launching applications](#creating-and-launching-applications)
-- [Chart compatibility with Rancher](#chart-compatibility-with-rancher)
-- [Global DNS](#global-dns)
-
-# Catalog Scopes
-
-Within Rancher, you can manage catalogs at three different scopes. Global catalogs are shared across all clusters and project. There are some use cases where you might not want to share catalogs between different clusters or even projects in the same cluster. By leveraging cluster and project scoped catalogs, you will be able to provide applications for specific teams without needing to share them with all clusters and/or projects.
-
-Scope |  Description | Available As of |
---- |  --- | --- |
-Global | All clusters and all projects can access the Helm charts in this catalog | v2.0.0 |
-Cluster | All projects in the specific cluster can access the Helm charts in this catalog | v2.2.0 |
-Project | This specific cluster can access the Helm charts in this catalog |  v2.2.0 |
-
-# Catalog Helm Deployment Versions
-
-_Applicable as of v2.4.0_
-
-In November 2019, Helm 3 was released, and some features were deprecated or refactored. It is not fully [backwards compatible]({{<baseurl>}}/rancher/v2.x/en/catalog#helm-3-backwards-compatibility) with Helm 2. Therefore, catalogs in Rancher need to be separated, with each catalog only using one Helm version. This will help reduce app deployment issues as your Rancher users will not need to know which version of your chart is compatible with which Helm version - they can just select a catalog, select an app and deploy a version that has already been vetted for compatibility.
-
-When you create a custom catalog, you will have to configure the catalog to use either Helm 2 or Helm 3. This version cannot be changed later. If the catalog is added with the wrong Helm version, it will need to be deleted and re-added.
-
-When you launch a new app from a catalog, the app will be managed by the catalog's Helm version. A Helm 2 catalog will use Helm 2 to manage all of the apps, and a Helm 3 catalog will use Helm 3 to manage all apps.
-
-By default, catalogs are assumed to be deployed using Helm 2. If you run an app in Rancher prior to v2.4.0, then upgrade to Rancher v2.4.0+, the app will still be managed by Helm 2. If the app was already using a Helm 3 Chart (API version 2) it will no longer work in v2.4.0+. You must either downgrade the chart's API version or recreate the catalog to use Helm 3.
-
-Charts that are specific to Helm 2 should only be added to a Helm 2 catalog, and Helm 3 specific charts should only be added to a Helm 3 catalog.
-
-# When to use Helm 3
-
-_Applicable as of v2.4.0_
-
-- If you want to ensure that the security permissions are being pulled from the kubeconfig file
-- If you want to utilize apiVersion `v2` features such as creating a library chart to reduce code duplication, or moving your requirements from the `requirements.yaml` into the `Chart.yaml`
-
-Overall Helm 3 is a movement towards a more standardized Kubernetes feel. As the Kubernetes community has evolved, standards and best practices have as well. Helm 3 is an attempt to adopt those practices and streamline how charts are maintained.
-
-# Helm 3 Backwards Compatibility
-
-_Applicable as of v2.4.0_
-
-With the use of the OpenAPI schema to validate your rendered templates in Helm 3, you will find charts that worked in Helm 2 may not work in Helm 3. This will require you to update your chart templates to meet the new validation requirements. This is one of the main reasons support for Helm 2 and Helm 3 was provided starting in Rancher 2.4.x, as not all charts can be deployed immediately in Helm 3.
-
-Helm 3 does not create a namespace for you, so you will have to provide an existing one. This can cause issues if you have integrated code with Helm 2, as you will need to make code changes to ensure a namespace is being created and passed in for Helm 3. Rancher will continue to manage namespaces for Helm to ensure this does not impact your app deployment.  
-
-apiVersion `v2` is now reserved for Helm 3 charts. This apiVersion enforcement could cause issues as older versions of Helm 2 did not validate the apiVersion in the `Chart.yaml` file. In general, your Helm 2 chart’s apiVersion should be set to `v1` and your Helm 3 chart’s apiVersion should be set to `v2`. You can install charts with apiVersion `v1` with Helm 3, but you cannot install `v2` charts into Helm 2.
-
-# Built-in Global Catalogs
-
-Within Rancher, there are default catalogs packaged as part of Rancher. These can be enabled or disabled by an administrator. For details, refer to the section on managing [built-in global catalogs.]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in)
-
-# Custom Catalogs
-
-There are two types of catalogs in Rancher: [Built-in global catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in/) and [custom catalogs.]({{<baseurl>}}/rancher/v2.x/en/catalog/adding-catalogs/)
-
-Any user can create custom catalogs to add into Rancher.  Custom catalogs can be added into Rancher at the global level, cluster level, or project level. For details, refer to the [section on adding custom catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/adding-catalogs) and the [catalog configuration reference.]({{<baseurl>}}/rancher/v2.x/en/catalog/catalog-config)
-
-# Creating and Launching Applications
-
-In Rancher, applications are deployed from the templates in a catalog. This section covers the following topics:
-
-* [Multi-cluster applications]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/)
-* [Creating catalog apps]({{<baseurl>}}/rancher/v2.x/en/catalog/creating-apps)
-* [Launching catalog apps within a project]({{<baseurl>}}/rancher/v2.x/en/catalog/launching-apps)
-* [Managing catalog apps]({{<baseurl>}}/rancher/v2.x/en/catalog/managing-apps)
-* [Tutorial: Example custom chart creation]({{<baseurl>}}/rancher/v2.x/en/catalog/tutorial)
-
-# Chart Compatibility with Rancher
-
-Charts now support the fields `rancher_min_version` and `rancher_max_version` in the [`questions.yml` file](https://github.com/rancher/integration-test-charts/blob/master/charts/chartmuseum/v1.6.0/questions.yml) to specify the versions of Rancher that the chart is compatible with. When using the UI, only app versions that are valid for the version of Rancher running will be shown. API validation is done to ensure apps that don't meet the Rancher requirements cannot be launched. An app that is already running will not be affected on a Rancher upgrade if the newer Rancher version does not meet the app's requirements.
-
-# Global DNS
-
-_Available as v2.2.0_
-
-When creating applications that span multiple Kubernetes clusters, a Global DNS entry can be created to route traffic to the endpoints in all of the different clusters. An external DNS server will need be programmed to assign a fully qualified domain name (a.k.a FQDN) to your application. Rancher will use the FQDN you provide and the IP addresses where your application is running to program the DNS. Rancher will gather endpoints from all the Kubernetes clusters running your application and program the DNS.
-
-For more information on how to use this feature, see [Global DNS]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
diff --git a/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md b/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
deleted file mode 100644
index 6c6876d4f96..00000000000
--- a/content/rancher/v2.5/en/managing-applications/creating-apps/_index.md
+++ /dev/null
@@ -1,123 +0,0 @@
----
-title: Creating Library Apps
-weight: 4
----
-
-> This page is under construction.
-
-Rancher's catalog service requires any custom catalogs to be structured in a specific format for the catalog service to be able to leverage it in Rancher.
-
-> For a complete walkthrough of developing charts, see the [Chart Template Developer's Guide](https://helm.sh/docs/chart_template_guide/) in the official Helm documentation.
-
-- [Chart types](#chart-types)
-  - [Helm charts](#helm-charts)
-  - [Rancher charts](#rancher-charts)
-- [Chart directory structure](#chart-directory-structure)
-- [Additional Files for Rancher Charts](#additional-files-for-rancher-charts)
-  - [questions.yml](#questions-yml)
-  - [Min/Max Rancher versions](#min-max-rancher-versions)
-  - [Question variable reference](#question-variable-reference)
-- [Tutorial: Example Custom Chart Creation](#tutorial-example-custom-chart-creation)
-
-# Chart Types
-
-Rancher supports two different types of charts: Helm charts and Rancher charts.
-
-### Helm Charts
-
-Native Helm charts include an application along with other software required to run it. When deploying native Helm charts, you'll learn the chart's parameters and then configure them using **Answers**, which are sets of key value pairs.
-
-The Helm Stable and Helm Incubators are populated with native Helm charts. However, you can also use native Helm charts in Custom catalogs (although we recommend Rancher Charts).
-
-### Rancher Charts
-
-Rancher charts mirror native helm charts, although they add two files that enhance user experience: `app-readme.md` and `questions.yaml`. Read more about them in [Additional Files for Rancher Charts.](#additional-files-for-rancher-charts)
-
-Advantages of Rancher charts include:
-
-- **Enhanced revision tracking:** While Helm supports versioned deployments, Rancher adds tracking and revision history to display changes between different versions of the chart.
-- **Streamlined application launch:** Rancher charts add simplified chart descriptions and configuration forms to make catalog application deployment easy. Rancher users need not read through the entire list of Helm variables to understand how to launch an application.
-- **Application resource management:** Rancher tracks all the resources created by a specific application. Users can easily navigate to and troubleshoot on a page listing all the workload objects used to power an application.
-
-# Chart Directory Structure
-
-The following table demonstrates the directory structure for a chart, which can be found in a chart directory: `charts/<APPLICATION>/<APP_VERSION>/`. This information is helpful when customizing charts for a custom catalog. Files denoted with **Rancher Specific** are specific to Rancher charts, but are optional for chart customization.
-
-```
-charts/<APPLICATION>/<APP_VERSION>/
-|--charts/           # Directory containing dependency charts.
-|--templates/        # Directory containing templates that, when combined with values.yml, generates Kubernetes YAML.
-|--app-readme.md     # Text displayed in the charts header within the Rancher UI.*
-|--Chart.yml         # Required Helm chart information file.
-|--questions.yml     # Form questions displayed within the Rancher UI. Questions display in Configuration Options.*
-|--README.md         # Optional: Helm Readme file displayed within Rancher UI. This text displays in Detailed Descriptions.
-|--requirements.yml  # Optional: YAML file listing dependencies for the chart.
-|--values.yml        # Default configuration values for the chart.
-```
-
-# Additional Files for Rancher Charts
-
-Before you create your own custom catalog, you should have a basic understanding about how a Rancher chart differs from a native Helm chart. Rancher charts differ slightly from Helm charts in their directory structures. Rancher charts include two files that Helm charts do not.
-
-- `app-readme.md`
-
-    A file that provides descriptive text in the chart's UI header. The following image displays the difference between a Rancher chart (which includes `app-readme.md`) and a native Helm chart (which does not).
-
-	<figcaption>Rancher Chart with <code>app-readme.md</code> (left) vs. Helm Chart without (right)</figcaption>
-
-	![app-readme.md]({{<baseurl>}}/img/rancher/app-readme.png)
-
-- `questions.yml`
-
-    A file that contains questions for a form. These form questions simplify deployment of a chart. Without it, you must configure the deployment using key value pairs, which is more difficult. The following image displays the difference between a Rancher chart (which includes `questions.yml`) and a native Helm chart (which does not).
-
-
-	<figcaption>Rancher Chart with <code>questions.yml</code> (left) vs. Helm Chart without (right)</figcaption>
-
-	![questions.yml]({{<baseurl>}}/img/rancher/questions.png)
-
-
-### questions.yml
-
-Inside the `questions.yml`, most of the content will be around the questions to ask the end user, but there are some additional fields that can be set in this file.
-
-### Min/Max Rancher versions
-
-For each chart, you can add the minimum and/or maximum Rancher version, which determines whether or not this chart is available to be deployed from Rancher.
-
-> **Note:** Even though Rancher release versions are prefixed with a `v`, there is *no* prefix for the release version when using this option.
-
-```
-rancher_min_version: 2.3.0
-rancher_max_version: 2.3.99
-```
-
-### Question Variable Reference
-
-This reference contains variables that you can use in `questions.yml` nested under `questions:`.
-
-| Variable  | Type | Required | Description |
-| ------------- | ------------- | --- |------------- |
-| 	variable          | string  | true    |  Define the variable name specified in the `values.yml` file, using `foo.bar` for nested objects. |
-| 	label             | string  | true      |  Define the UI label. |
-| 	description       | string  | false      |  Specify the description of the variable.|
-| 	type              | string  | false      |  Default to `string` if not specified (current supported types are string, multiline, boolean, int, enum, password, storageclass, hostname, pvc, and secret).|
-| 	required          | bool    | false      |  Define if the variable is required or not (true \| false)|
-| 	default           | string  | false      |  Specify the default value. |
-| 	group             | string  | false      |  Group questions by input value. |
-| 	min_length        | int     | false      | Min character length.|
-| 	max_length        | int     | false      | Max character length.|
-| 	min               | int     | false      |  Min integer length. |
-| 	max               | int     | false      |  Max integer length. |
-| 	options           | []string | false     |  Specify the options when the variable type is `enum`, for example: options:<br> - "ClusterIP" <br> - "NodePort" <br> - "LoadBalancer"|
-| 	valid_chars       | string   | false     |  Regular expression for input chars validation. |
-| 	invalid_chars     | string   | false     |  Regular expression for invalid input chars validation.|
-| 	subquestions      | []subquestion | false|  Add an array of subquestions.|
-| 	show_if           | string      | false  | Show current variable if conditional variable is true. For example `show_if: "serviceType=Nodeport"` |
-| 	show\_subquestion_if |  string  | false     | Show subquestions if is true or equal to one of the options. for example `show_subquestion_if: "true"`|
-
->**Note:** `subquestions[]` cannot contain `subquestions` or `show_subquestions_if` keys, but all other keys in the above table are supported.
-
-# Tutorial: Example Custom Chart Creation
-
-For a tutorial on adding a custom Helm chart to a custom catalog, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/catalog/tutorial)
diff --git a/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md b/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
deleted file mode 100644
index 32533d3a1fa..00000000000
--- a/content/rancher/v2.5/en/managing-applications/creating-custom-libraries/_index.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: Creating Custom Libraries
-weight: 2
----
-
-> This page is under construction.
-
-Custom catalogs can be added into Rancher at a global scope, cluster scope, or project scope.
-
-- [Adding catalog repositories](#adding-catalog-repositories)
-  - [Add custom Git repositories](#add-custom-git-repositories)
-  - [Add custom Helm chart repositories](#add-custom-helm-chart-repositories)
-  - [Add private Git/Helm chart repositories](#add-private-git-helm-chart-repositories)
-- [Adding global catalogs](#adding-global-catalogs)
-- [Adding cluster level catalogs](#adding-cluster-level-catalogs)
-- [Adding project level catalogs](#adding-project-level-catalogs)
-- [Custom catalog configuration reference](#custom-catalog-configuration-reference)
-
-# Adding Catalog Repositories
-
-Adding a catalog is as simple as adding a catalog name, a URL and a branch name.
-
-**Prerequisite:** An [admin]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) of Rancher has the ability to add or remove catalogs globally in Rancher.
-
-### Add Custom Git Repositories
-The Git URL needs to be one that `git clone` [can handle](https://git-scm.com/docs/git-clone#_git_urls_a_id_urls_a) and must end in `.git`. The branch name must be a branch that is in your catalog URL. If no branch name is provided, it will use the `master` branch by default. Whenever you add a catalog to Rancher, it will be available immediately.
-
-### Add Custom Helm Chart Repositories
-
-A Helm chart repository is an HTTP server that houses one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server.
-
-Helm comes with built-in package server for developer testing (helm serve). The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum).
-
-In Rancher, you can add the custom Helm chart repository with only a catalog name and the URL address of the chart repository.
-
-### Add Private Git/Helm Chart Repositories
-
-Private catalog repositories can be added using credentials like Username and Password. You may also want to use the OAuth token if your Git or Helm repository server supports that.
-
-For more information on private Git/Helm catalogs, refer to the [custom catalog configuration reference.]({{<baseurl>}}/rancher/v2.x/en/catalog/catalog-config)
-
- 1. From the **Global** view, choose **Tools > Catalogs** in the navigation bar. In versions prior to v2.2.0, you can select **Catalogs** directly in the navigation bar.
- 2. Click **Add Catalog**.
- 3. Complete the form and click **Create**.
-
- **Result:** Your catalog is added to Rancher.
-
-# Adding Global Catalogs
-
->**Prerequisites:** In order to manage the [built-in catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in/) or manage global catalogs, you need _one_ of the following permissions:
->
->- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
->- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#global-permissions-reference) role assigned.
-
- 1. From the **Global** view, choose **Tools > Catalogs** in the navigation bar. In versions prior to v2.2.0, you can select **Catalogs** directly in the navigation bar.
- 2. Click **Add Catalog**.
- 3. Complete the form. Select the Helm version that will be used to launch all of the apps in the catalog. For more information about the Helm version, refer to [this section.](
-{{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions)
-4. Click **Create**.
-
- **Result**: Your custom global catalog is added to Rancher. Once it is in `Active` state, it has completed synchronization and you will be able to start deploying [multi-cluster apps]({{<baseurl>}}/rancher/v2.x/en/catalog/multi-cluster-apps/) or [applications in any project]({{<baseurl>}}/rancher/v2.x/en/catalog/launching-apps/) from this catalog.
-
-# Adding Cluster Level Catalogs
-
->**Prerequisites:** In order to manage cluster scoped catalogs, you need _one_ of the following permissions:
->
->- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
->- [Cluster Owner Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles)
->- [Custom Cluster Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) with the [Manage Cluster Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-role-reference) role assigned.
-
-1. From the **Global** view, navigate to your cluster that you want to start adding custom catalogs.
-2. Choose the **Tools > Catalogs** in the navigation bar.
-2. Click **Add Catalog**.
-3. Complete the form. By default, the form will provide the ability to select `Scope` of the catalog. When you have added a catalog from the **Cluster** scope, it is defaulted to `Cluster`. Select the Helm version that will be used to launch all of the apps in the catalog. For more information about the Helm version, refer to [this section.](
-{{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions)
-5. Click **Create**.
-
-**Result**: Your custom cluster catalog is added to Rancher. Once it is in `Active` state, it has completed synchronization and you will be able to start deploying  [applications in any project in that cluster]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) from this catalog.
-
-# Adding Project Level Catalogs
-
->**Prerequisites:** In order to manage project scoped catalogs, you need _one_ of the following permissions:
->
->- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
->- [Cluster Owner Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles)
->- [Project Owner Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles)
->- [Custom Project Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) with the [Manage Project Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference) role assigned.
-
-1. From the **Global** view, navigate to your project that you want to start adding custom catalogs.
-2. Choose the **Tools > Catalogs** in the navigation bar.
-2. Click **Add Catalog**.
-3. Complete the form. By default, the form will provide the ability to select `Scope` of the catalog. When you have added a catalog from the **Project** scope, it is defaulted to `Cluster`. Select the Helm version that will be used to launch all of the apps in the catalog. For more information about the Helm version, refer to [this section.](
-{{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions)
-5. Click **Create**.
-
-**Result**: Your custom project catalog is added to Rancher. Once it is in `Active` state, it has completed synchronization and you will be able to start deploying  [applications in that project]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/) from this catalog.
-
-# Custom Catalog Configuration Reference
-
-Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/catalog/catalog-config) more information on configuring custom catalogs.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/managing-applications/enabling-builtin-libraries/_index.md b/content/rancher/v2.5/en/managing-applications/enabling-builtin-libraries/_index.md
deleted file mode 100644
index a162db9daff..00000000000
--- a/content/rancher/v2.5/en/managing-applications/enabling-builtin-libraries/_index.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-title: Enabling and Disabling Built-in Global Libraries
-weight: 100
----
-
-> This page is under construction.
-
-There are default global catalogs packaged as part of Rancher.
-
-Within Rancher, there are default catalogs packaged as part of Rancher. These can be enabled or disabled by an administrator. 
-
->**Prerequisites:** In order to manage the built-in catalogs or manage global catalogs, you need _one_ of the following permissions:
->
->- [Administrator Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/)
->- [Custom Global Permissions]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions) with the [Manage Catalogs]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#custom-global-permissions-reference) role assigned.
-
-1. From the **Global** view, choose **Tools > Catalogs** in the navigation bar. In versions prior to v2.2.0, you can select **Catalogs** directly in the navigation bar.
-
-2. Toggle the default catalogs that you want to be enabled or disabled:
-
-    - **Library:**	The Library Catalog includes charts curated by Rancher. Rancher stores charts in a Git repository to expedite the fetch and update of charts. This catalog features Rancher Charts, which include some [notable advantages]({{<baseurl>}}/rancher/v2.x/en/catalog/creating-apps/#rancher-charts) over native Helm charts.
-    - **Helm Stable:** This catalog, which is maintained by the Kubernetes community, includes native [Helm charts](https://helm.sh/docs/chart_template_guide/). This catalog features the largest pool of apps.
-    - **Helm Incubator:** Similar in user experience to Helm Stable, but this catalog is filled with applications in **beta**.
-
- **Result**: The chosen catalogs are enabled. Wait a few minutes for Rancher to replicate the catalog charts. When replication completes, you'll be able to see them in any of your projects by selecting **Apps** from the main navigation bar. In versions prior to v2.2.0, within a project, you can select **Catalog Apps** from the main navigation bar.
diff --git a/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md b/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
deleted file mode 100644
index 7b411b55145..00000000000
--- a/content/rancher/v2.5/en/managing-applications/launching-apps/_index.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: Launching Library Apps
-weight: 7
----
-
-> This page is under construction.
-
-Within a project, when you want to deploy applications from catalogs, the applications available in your project will be based on the [scope of the catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-scope).
-
-If your application is using ingresses, you can program the ingress hostname to an external DNS by setting up a [Global DNS entry]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/).
-
-- [Prerequisites](#prerequisites)
-- [Launching a catalog app](#launching-a-catalog-app)
-- [Configuration options](#configuration-options)
-
-# Prerequisites
-
-When Rancher deploys a catalog app, it launches an ephemeral instance of a Helm service account that has the permissions of the user deploying the catalog app. Therefore, a user cannot gain more access to the cluster through Helm or a catalog application than they otherwise would have.
-
-To launch an app from a catalog in Rancher, you must have at least one of the following permissions:
-
-- A [project-member role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) in the target cluster, which gives you the ability to create, read, update, and delete the workloads
-- A [cluster owner role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) for the cluster that include the target project
-
-Before launching an app, you'll need to either [enable a built-in global catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/built-in) or [add your own custom catalog.]({{<baseurl>}}/rancher/v2.x/en/catalog/adding-catalogs)
-
-# Launching a Catalog App
-
-1. From the **Global** view, open the project that you want to deploy an app to.
-
-2. From the main navigation bar, choose **Apps**. In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar. Click **Launch**.
-
-3. Find the app that you want to launch, and then click **View Now**.
-
-4. Under **Configuration Options** enter a **Name**. By default, this name is also used to create a Kubernetes namespace for the application.
-
-    * If you would like to change the **Namespace**, click **Customize** and enter a new name.
-    * If you want to use a different namespace that already exists, click **Customize**, and then click **Use an existing namespace**. Choose a namespace from the list.
-
-5. Select a **Template Version**.
-
-6. Complete the rest of the **Configuration Options**.
-
-    * For native Helm charts (i.e., charts from the **Helm Stable** or **Helm Incubator** catalogs), answers are provided as key value pairs in the **Answers** section.
-    * Keys and values are available within **Detailed Descriptions**.
-    * When entering answers, you must format them using the syntax rules found in [Using Helm: The format and limitations of --set](https://helm.sh/docs/intro/using_helm/#the-format-and-limitations-of---set), as Rancher passes them as `--set` flags to Helm. For example, when entering an answer that includes two values separated by a comma (i.e., `abc, bcd`), wrap the values with double quotes (i.e., `"abc, bcd"`).
-
-7. Review the files in **Preview**. When you're satisfied, click **Launch**.
-
-**Result**: Your application is deployed to your chosen namespace. You can view the application status from the project's **Workloads** view or **Apps** view. In versions prior to v2.2.0, this is the **Catalog Apps** view.
-
-# Configuration Options
-
-For each Helm chart, there are a list of desired answers that must be entered in order to successfully deploy the chart. When entering answers, you must format them using the syntax rules found in [Using Helm: The format and limitations of –set](https://helm.sh/docs/intro/using_helm/#the-format-and-limitations-of---set), as Rancher passes them as `--set` flags to Helm.
-
-> For example, when entering an answer that includes two values separated by a comma (i.e. `abc, bcd`), it is required to wrap the values with double quotes (i.e., ``"abc, bcd"``).
-
-{{% tabs %}}
-{{% tab "UI" %}}
-
-### Using a questions.yml file
-
-If the Helm chart that you are deploying contains a `questions.yml` file, Rancher's UI will translate this file to display an easy to use UI to collect the answers for the questions.
-
-### Key Value Pairs for Native Helm Charts
-
-For native Helm charts (i.e., charts from the **Helm Stable** or **Helm Incubator** catalogs or a [custom Helm chart repository]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/#custom-helm-chart-repository)), answers are provided as key value pairs in the **Answers** section. These answers are used to override the default values.
-
-{{% /tab %}}
-{{% tab "Editing YAML Files" %}}
-
-If you do not want to input answers using the UI, you can choose the **Edit as YAML** option.
-
-With this example YAML:
-
-```YAML
-outer:
-  inner: value
-servers:
-- port: 80
-  host: example
-```
-
-### Key Value Pairs
-
-You can have a YAML file that translates these fields to match how to [format custom values so that it can be used with `--set`](https://github.com/helm/helm/blob/master/docs/using_helm.md#the-format-and-limitations-of---set).
-
-These values would be translated to:
-
-```
-outer.inner=value
-servers[0].port=80
-servers[0].host=example
-```
-
-### YAML files
-
-You can directly paste that YAML formatted structure into the YAML editor. By allowing custom values to be set using a YAML formatted structure, Rancher has the ability to easily customize for more complicated input values (e.g. multi-lines, array and JSON objects).
-{{% /tab %}}
-{{% /tabs %}}
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/managing-applications/library-config/_index.md b/content/rancher/v2.5/en/managing-applications/library-config/_index.md
deleted file mode 100644
index cf91b118956..00000000000
--- a/content/rancher/v2.5/en/managing-applications/library-config/_index.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: Custom Library Configuration Reference
-weight: 3
----
-
-> This page is under construction.
-
-Any user can create custom catalogs to add into Rancher. Besides the content of the catalog, users must ensure their catalogs are able to be added into Rancher.
-
-- [Types of Repositories](#types-of-repositories)
-- [Custom Git Repository](#custom-git-repository)
-- [Custom Helm Chart Repository](#custom-helm-chart-repository)
-- [Catalog Fields](#catalog-fields)
-- [Private Repositories](#private-repositories)
-  - [Using Username and Password](#using-username-and-password)
-  - [Using an OAuth token](#using-an-oauth-token)
-
-# Types of Repositories
-
-Rancher supports adding in different types of repositories as a catalog:
-
-* Custom Git Repository
-* Custom Helm Chart Repository
-
-# Custom Git Repository
-
-The Git URL needs to be one that `git clone` [can handle](https://git-scm.com/docs/git-clone#_git_urls_a_id_urls_a) and must end in `.git`. The branch name must be a branch that is in your catalog URL. If no branch name is provided, it will default to use the `master` branch. Whenever you add a catalog to Rancher, it will be available almost immediately.
-
-# Custom Helm Chart Repository
-
-A Helm chart repository is an HTTP server that contains one or more packaged charts. Any HTTP server that can serve YAML files and tar files and can answer GET requests can be used as a repository server.
-
-Helm comes with a built-in package server for developer testing (`helm serve`). The Helm team has tested other servers, including Google Cloud Storage with website mode enabled, S3 with website mode enabled or hosting custom chart repository server using open-source projects like [ChartMuseum](https://github.com/helm/chartmuseum).
-
-In Rancher, you can add the custom Helm chart repository with only a catalog name and the URL address of the chart repository.
-
-# Catalog Fields
-
-When [adding your catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/adding/) to Rancher, you'll provide the following information:
-
-
-| Variable              |  Description  |
-| --------------------  | ------------- |
-| 	Name                | Name for your custom catalog to distinguish the repositories in Rancher  |
-| 	Catalog URL         | URL of your custom chart repository|
-| 	Use Private Catalog | Selected if you are using a private repository that requires authentication |
-| Username (Optional) | Username or OAuth Token |
-| Password (Optional) | If you are authenticating using a username, enter the associated password. If you are using an OAuth token, use `x-oauth-basic`. |
-| 	Branch              | For a Git repository, the branch name. Default: `master`. For a Helm Chart repository, this field is ignored.  |
-| Helm version | The Helm version that will be used to deploy all of the charts in the catalog. This field cannot be changed later. For more information, refer to the [section on Helm versions.]({{<baseurl>}}/rancher/v2.x/en/catalog/#catalog-helm-deployment-versions) |
-
-# Private Repositories
-
-Private Git or Helm chart repositories can be added into Rancher using either credentials, i.e. `Username` and `Password`. Private Git repositories also support authentication using OAuth tokens.
-
-### Using Username and Password
-
-1. When [adding the catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/adding/), select the **Use private catalog** checkbox.
-
-2. Provide the `Username` and `Password` for your Git or Helm repository.
-
-### Using an OAuth token
-
-Read [using Git over HTTPS and OAuth](https://github.blog/2012-09-21-easier-builds-and-deployments-using-git-over-https-and-oauth/) for more details on how OAuth authentication works.
-
-1. Create an [OAuth token](https://github.com/settings/tokens)
-with `repo` permission selected, and click **Generate token**.
-
-2. When [adding the catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/adding/), select the **Use private catalog** checkbox.
-
-3. For `Username`, provide the Git generated OAuth token. For `Password`, enter `x-oauth-basic`.  
diff --git a/content/rancher/v2.5/en/managing-applications/managing-apps/_index.md b/content/rancher/v2.5/en/managing-applications/managing-apps/_index.md
deleted file mode 100644
index 32e05ca6ad4..00000000000
--- a/content/rancher/v2.5/en/managing-applications/managing-apps/_index.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Managing Library Apps
-weight: 5
----
-
-> This page is under construction.
-
-After deploying an application, one of the benefits of using an application versus individual workloads/resources is the ease of being able to manage many workloads/resources applications. Apps can be cloned, upgraded or rolled back.
-
-- [Cloning catalog applications](#cloning-catalog-applications)
-- [Upgrading catalog applications](#upgrading-catalog-applications)
-- [Rolling back catalog applications](#rolling-back-catalog-applications)
-- [Deleting catalog application deployments](#deleting-catalog-application-deployments)
-
-### Cloning Catalog Applications
-
-After an application is deployed, you can easily clone it to use create another application with almost the same configuration. It saves you the work of manually filling in duplicate information.
-
-### Upgrading Catalog Applications
-
-After an application is deployed, you can easily upgrade to a different template version.
-
-1. From the **Global** view, navigate to the project that contains the catalog application that you want to upgrade.
-
-1. From the main navigation bar, choose **Apps**. In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar. Click **Launch**.
-
-3. Find the application that you want to upgrade, and then click the &#8942; to find **Upgrade**.
-
-4. Select the **Template Version** that you want to deploy.
-
-5. (Optional) Update your **Configuration Options**.
-
-6. (Optional) Select whether or not you want to force the catalog application to be upgraded by checking the box for **Delete and recreate resources if needed during the upgrade**.
-
-    > In Kubernetes, some fields are designed to be immutable or cannot be updated directly. As of v2.2.0, you can now force your catalog application to be updated regardless of these fields. This will cause the catalog apps to be deleted and resources to be re-created if needed during the upgrade.
-
-7. Review the files in the **Preview** section. When you're satisfied, click **Launch**.
-
-**Result**: Your application is updated. You can view the application status from the project's:
-
-- **Workloads** view
-- **Apps** view. In versions prior to v2.2.0, this is the **Catalog Apps** view.
-
-
-### Rolling Back Catalog Applications
-
-After an application has been upgraded, you can easily rollback to a different template version.
-
-1. From the **Global** view, navigate to the project that contains the catalog application that you want to upgrade.
-
-1. From the main navigation bar, choose **Apps**. In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar. Click **Launch**.
-
-3. Find the application that you want to rollback, and then click the &#8942; to find **Rollback**.
-
-4. Select the **Revision** that you want to roll back to. By default, Rancher saves up to the last 10 revisions.
-
-5. (Optional) Select whether or not you want to force the catalog application to be upgraded by checking the box for **Delete and recreate resources if needed during the upgrade**.
-
-    > In Kubernetes, some fields are designed to be immutable or cannot be updated directly. As of v2.2.0, you can now force your catalog application to be updated regardless of these fields. This will cause the catalog apps to be deleted and resources to be re-created if needed during the rollback.
-
-7. Click **Rollback**.
-
-**Result**: Your application is updated. You can view the application status from the project's:
-
-- **Workloads** view
-- **Apps** view. In versions prior to v2.2.0, this is the **Catalog Apps** view.
-
-### Deleting Catalog Application Deployments
-
-As a safeguard to prevent you from unintentionally deleting other catalog applications that share a namespace, deleting catalog applications themselves does not delete the namespace they're assigned to.
-
-Therefore, if you want to delete both an app and the namespace that contains the app, you should remove the app and the namespace separately:
-
-1. Uninstall the app using the app's `uninstall` function.
-
-1. From the **Global** view, navigate to the project that contains the catalog application that you want to delete.
-
-1. From the main menu, choose **Namespaces**.
-
-1. Find the namespace running your catalog app. Select it and click **Delete**.
-
-**Result:** The catalog application deployment and its namespace are deleted.
diff --git a/content/rancher/v2.5/en/managing-applications/multi-cluster-apps/_index.md b/content/rancher/v2.5/en/managing-applications/multi-cluster-apps/_index.md
deleted file mode 100644
index c925c687233..00000000000
--- a/content/rancher/v2.5/en/managing-applications/multi-cluster-apps/_index.md
+++ /dev/null
@@ -1,162 +0,0 @@
----
-title: Multi-Cluster Apps
-weight: 6
----
-
-> This page is under construction.
-
-Typically, most applications are deployed on a single Kubernetes cluster, but there will be times you might want to deploy multiple copies of the same application across different clusters and/or projects. In Rancher, a _multi-cluster application_,  is an application deployed using a Helm chart across multiple clusters. With the ability to deploy the same application across multiple clusters, it avoids the repetition of the same action on each cluster, which could introduce user error during application configuration. With multi-cluster applications, you can customize to have the same configuration across all projects/clusters as well as have the ability to change the configuration based on your target project. Since multi-cluster application is considered a single application, it's easy to manage and maintain this application.
-
-Any Helm charts from a global catalog can be used to deploy and manage multi-cluster applications.
-
-After creating a multi-cluster application, you can program a [Global DNS entry]({{<baseurl>}}/rancher/v2.x/en/catalog/globaldns/) to make it easier to access the application.
-
-- [Prerequisites](#prerequisites)
-- [Launching a multi-cluster app](#launching-a-multi-cluster-app)
-- [Multi-cluster app configuration options](#multi-cluster-app-configuration-options)
-  - [Targets](#targets)
-  - [Upgrades](#upgrades)
-  - [Roles](#roles)
-- [Application configuration options](#application-configuration-options)
-  - [Using a questions.yml file](#using-a-questions-yml-file)
-  - [Key value pairs for native Helm charts](key-value-pairs-for-native-helm-charts)
-  - [Members](#members)
-  - [Overriding application configuration options for specific projects](#overriding-application-configuration-options-for-specific-projects)
-- [Upgrading multi-cluster app roles and projects](#upgrading-multi-cluster-app-roles-and-projects)
-- [Multi-cluster application management](#multi-cluster-application-managements)
-- [Deleting a multi-cluster application](#deleting-a-multi-cluster-application)
-
-# Prerequisites
-
-To create a multi-cluster app in Rancher, you must have at least one of the following permissions:
-
-- A [project-member role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) in the target cluster(s), which gives you the ability to create, read, update, and delete the workloads
-- A [cluster owner role]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) for the clusters(s) that include the target project(s)
-
-# Launching a Multi-Cluster App
-
-1. From the **Global** view, choose **Apps** in the navigation bar. Click **Launch**.
-
-2. Find the application that you want to launch, and then click **View Details**.
-
-3.  (Optional) Review the detailed descriptions, which are derived from the Helm chart's `README`.
-
-4. Under **Configuration Options** enter a **Name** for the multi-cluster application. By default, this name is also used to create a Kubernetes namespace in each [target project](#targets) for the multi-cluster application. The namespace is named as `<MULTI-CLUSTER_APPLICATION_NAME>-<PROJECT_ID>`.
-
-5. Select a **Template Version**.
-
-6. Complete the [multi-cluster applications specific configuration options](#multi-cluster-app-configuration-options) as well as the [application configuration options](#application-configuration-options).
-
-7. Select the **Members** who can [interact with the multi-cluster application](#members).
-
-8. Add any [custom application configuration answers](#overriding-application-configuration-options-for-specific-projects) that would change the configuration for specific project(s) from the default application configuration answers.
-
-7. Review the files in the **Preview** section. When you're satisfied, click **Launch**.
-
-**Result**: Your application is deployed to your chosen namespace. You can view the application status from the project's:
-
-# Multi-cluster App Configuration Options
-
-Rancher has divided the configuration option for the multi-cluster application into several sections.
-
-### Targets
-
-In the **Targets** section, select the projects that you want the application to be deployed in. The list of projects is based on what projects you have access to. For each project that you select, it will be added to the list, which shows the cluster name and project name that were selected. To remove a target project, click on **-**.
-
-### Upgrades
-
-In the **Upgrades** section, select the upgrade strategy to use, when you decide to upgrade your application.
-
-* **Rolling Update (batched):** When selecting this upgrade strategy, the number of applications upgraded at a time is based on the selected **Batch size** and the **Interval** specifies how many seconds to wait before starting the next batch of updates.
-
-* **Upgrade all apps simultaneously:** When selecting this upgrade strategy, all applications across all projects will be upgraded at the same time.
-
-### Roles
-
-In the **Roles** section, you define the role of the multi-cluster application. Typically, when a user [launches catalog applications]({{<baseurl>}}/rancher/v2.x/en/catalog/launching-apps), that specific user's permissions are used for creation of all workloads/resources that is required by the app.
-
-For multi-cluster applications, the application is deployed by a _system user_ and is assigned as the creator of all underlying resources. A _system user_ is used instead of the actual user due to the fact that the actual user could be removed from one of the target projects. If the actual user was removed from one of the projects, then that user would no longer be able to manage the application for the other projects.
-
-Rancher will let you select from two options for Roles, **Project** and **Cluster**. Rancher will allow creation using any of these roles based on the user's permissions.
-
-- **Project** - This is the equivalent of a [project member]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles). If you select this role, Rancher will check that in all the target projects, the user has minimally the [project member]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) role. While the user might not be explicitly granted the _project member_ role, if the user is an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), a [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or a [project owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles), then the user is considered to have the appropriate level of permissions.
-
-- **Cluster** - This is the equivalent of a [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles). If you select this role, Rancher will check that in all the target projects, the user has minimally the [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) role. While the user might not be explicitly granted the _cluster owner_ role, if the user is an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), then the user is considered to have the appropriate level of permissions.
-
-When launching the application, Rancher will confirm if you have these permissions in the target projects before launching the application.
-
-> **Note:** There are some applications like _Grafana_ or _Datadog_ that require access to specific cluster-scoped resources. These applications will require the _Cluster_ role. If you find out later that the application requires cluster roles, the multi-cluster application can be upgraded to update the roles.
-
-# Application Configuration Options
-
-For each Helm chart, there are a list of desired answers that must be entered in order to successfully deploy the chart. When entering answers, you must format them using the syntax rules found in [Using Helm: The format and limitations of –set](https://helm.sh/docs/intro/using_helm/#the-format-and-limitations-of---set), as Rancher passes them as `--set` flags to Helm.
-
-> For example, when entering an answer that includes two values separated by a comma (i.e. `abc, bcd`), it is required to wrap the values with double quotes (i.e., ``"abc, bcd"``).
-
-### Using a questions.yml file
-
-If the Helm chart that you are deploying contains a `questions.yml` file, Rancher's UI will translate this file to display an easy to use UI to collect the answers for the questions.
-
-### Key Value Pairs for Native Helm Charts
-
-For native Helm charts (i.e., charts from the **Helm Stable** or **Helm Incubator** catalogs or a [custom Helm chart repository]({{<baseurl>}}/rancher/v2.x/en/catalog/custom/#custom-helm-chart-repository)), answers are provided as key value pairs in the **Answers** section. These answers are used to override the default values.
-
-### Members
-
-By default, multi-cluster applications can only be managed by the user who created it. In the **Members** section, other users can be added so that they can also help manage or view the multi-cluster application.
-
-1. Find the user that you want to add by typing in the member's name in the **Member** search box.
-
-2. Select the **Access Type** for that member. There are three access types for a multi-cluster project, but due to how the permissions of a multi-cluster application are launched, please read carefully to understand what these access types mean.
-
-    - **Owner**: This access type can manage any configuration part of the multi-cluster application including the template version, the [multi-cluster applications specific configuration options](#Multi-cluster App Configuration Options), the [application specific configuration options](#application-configuration-options), the members who can interact with the multi-cluster application and the [custom application configuration answers](#overriding-application-configuration-options-for-specific-projects). Since a multi-cluster application is created with a different set of permissions from the user, any _owner_ of the multi-cluster application can manage/remove applications in [target projects](#targets) without explicitly having access to these project(s). Only trusted users should be provided with this access type.
-
-    - **Member**: This access type can only modify the template version, the [application specific configuration options](#application-configuration-options) and the [custom application configuration answers](#overriding-application-configuration-options-for-specific-projects). Since a multi-cluster application is created with a different set of permissions from the user, any _member_ of the multi-cluster application can modify the application without explicitly having access to these project(s). Only trusted users should be provided with this access type.
-
-    - **Read-only**: This access type cannot modify any configuration option for the multi-cluster application. Users can only view these applications.
-
-    > **Note:**  Please ensure only trusted users are given _Owner_ or _Member_ access as they will automatically be able to manage applications created for this multi-cluster application in target projects they might not have direct access to.
-
-### Overriding Application Configuration Options for Specific Projects
-
-The ability to use the same configuration to deploy the same application across multiple clusters/projects is one of the main benefits of multi-cluster applications. There might be a specific project that requires a slightly different configuration option, but you want to manage that application with all the other matching applications. Instead of creating a brand new application, you can override specific [application specific configuration options](#application-configuration-options) for specific projects.
-
-1. In the **Answer Overrides** section, click **Add Override**.
-
-2. For each override, you can select the following:
-
-	- **Scope**: Select which target projects you want to override the answer in the configuration option.
-
-	- **Question**: Select which question you want to override.
-
-	- **Answer**: Enter the answer that you want to be used instead.
-
-# Upgrading Multi-Cluster App Roles and Projects
-
-- **Changing Roles on an existing Multi-Cluster app**
-The creator and any users added with the access-type "owner" to a multi-cluster app, can upgrade its Roles. When adding a new Role, we check if the user has that exact role in all current target projects. These checks allow the same relaxations for global admins, cluster owners and project-owners as described in the installation section for the field `Roles`.
-
-- **Adding/Removing target projects**
-1. The creator and any users added with access-type "owner" to a multi-cluster app, can add or remove its target projects. When adding a new project, we check if the caller of this request has all Roles defined on multi-cluster app, in the new projects they want to add. The roles checks are again relaxed for global admins, cluster-owners and project-owners.
-2. We do not do these membership checks when removing target projects. This is because the caller's permissions could have with respect to the target project, or the project could have been deleted and hence the caller wants to remove it from targets list.
-
-
-# Multi-Cluster Application Management
-
-One of the benefits of using a multi-cluster application as opposed to multiple individual applications of the same type, is the ease of management. Multi-cluster applications can be cloned, upgraded or rolled back.
-
-1. From the **Global** view, choose **Apps** in the navigation bar.
-
-2. Choose the multi-cluster application you want to take one of these actions on and click the **&#8942;**. Select one of the following options:
-
-   * **Clone**: Creates another multi-cluster application with the same configuration. By using this option, you can easily duplicate a multi-cluster application.
-   * **Upgrade**: Upgrade your multi-cluster application to change some part of the configuration. When performing an upgrade for multi-cluster application, the [upgrade strategy](#upgrades) can be modified if you have the correct [access type](#members).
-   * **Rollback**: Rollback your application to a specific version. If after an upgrade, there are issues for your multi-cluster application for one or more of your [targets](#targets), Rancher has stored up to 10 versions of the multi-cluster application. Rolling back a multi-cluster application reverts the application for **all** target clusters and projects, not just the targets(s) affected by the upgrade issue.
-
-# Deleting a Multi-Cluster Application
-
-1. From the **Global** view, choose **Apps** in the navigation bar.
-
-2. Choose the multi-cluster application you want to delete and click the **&#8942; > Delete**. When deleting the multi-cluster application, all applications and namespaces are deleted in all of the target projects.
-
-   > **Note:** The applications in the target projects, that are created for a multi-cluster application, cannot be deleted individually. The applications can only be deleted when the multi-cluster application is deleted.
diff --git a/content/rancher/v2.5/en/managing-applications/tutorial/_index.md b/content/rancher/v2.5/en/managing-applications/tutorial/_index.md
deleted file mode 100644
index 2ed509e1a6a..00000000000
--- a/content/rancher/v2.5/en/managing-applications/tutorial/_index.md
+++ /dev/null
@@ -1,72 +0,0 @@
----
-title: "Tutorial: Example Custom Chart Creation"
-weight: 8
----
-
-In this tutorial, you'll learn how to create a Helm chart and deploy it to a  repository. The repository can then be used as a source for a custom catalog in Rancher.
-
-You can fill your custom catalogs with either Helm Charts or Rancher Charts, although we recommend Rancher Charts due to their enhanced user experience.
-
-> For a complete walkthrough of developing charts, see the upstream Helm chart [developer reference](https://helm.sh/docs/chart_template_guide/).
-
-1. Within the GitHub repo that you're using as your custom catalog, create a directory structure that mirrors the structure listed in [Chart Directory Structure](../creating-apps/#chart-directory-structure).
-
-    Rancher requires this directory structure, although `app-readme.md` and `questions.yml` are optional.
-
-    >**Tip:**
-    >
-    >- To begin customizing a chart, copy one from either the [Rancher Library](https://github.com/rancher/charts) or the [Helm Stable](https://github.com/kubernetes/charts/tree/master/stable).
-    >- For a complete walk through of developing charts, see the upstream Helm chart [developer reference](https://docs.helm.sh/developing_charts/).
-
-2. **Recommended:** Create an `app-readme.md` file.
-
-    Use this file to create custom text for your chart's header in the Rancher UI. You can use this text to notify users that the chart is customized for your environment or provide special instruction on how to use it.
-    <br/>
-    <br/>
-    **Example**:
-
-    ```
-    $ cat ./app-readme.md
-
-    # Wordpress ROCKS!
-    ```
-
-3. **Recommended:** Create a `questions.yml` file.
-
-    This file creates a form for users to specify deployment parameters when they deploy the custom chart. Without this file, users **must** specify the parameters manually using key value pairs, which isn't user-friendly.
-    <br/>
-    <br/>
-    The example below creates a form that prompts users for persistent volume size and a storage class.
-    <br/>
-    <br/>
-    For a list of variables you can use when creating a `questions.yml` file, see [Question Variable Reference]({{<baseurl>}}/rancher/v2.x/en/catalog/creating-apps/#question-variable-reference).
-
-    ```yaml
-        categories:
-        - Blog
-        - CMS
-        questions:
-        - variable: persistence.enabled
-        default: "false"
-        description: "Enable persistent volume for WordPress"
-        type: boolean
-        required: true
-        label: WordPress Persistent Volume Enabled
-        show_subquestion_if: true
-        group: "WordPress Settings"
-        subquestions:
-        - variable: persistence.size
-            default: "10Gi"
-            description: "WordPress Persistent Volume Size"
-            type: string
-            label: WordPress Volume Size
-        - variable: persistence.storageClass
-            default: ""
-            description: "If undefined or null, uses the default StorageClass. Default to null"
-            type: storageclass
-            label: Default StorageClass for WordPress
-    ```
-
-4. Check the customized chart into your GitHub repo.
-
-**Result:** Your custom chart is added to the repo. Your Rancher Server will replicate the chart within a few minutes.
diff --git a/content/rancher/v2.5/en/monitoring/legacy/_index.md b/content/rancher/v2.5/en/monitoring/legacy/_index.md
deleted file mode 100644
index 9240f82fa7f..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Legacy UI Docs
-weight: 2
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/monitoring/legacy/alerts/_index.md b/content/rancher/v2.5/en/monitoring/legacy/alerts/_index.md
deleted file mode 100644
index 1b0b9685295..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/alerts/_index.md
+++ /dev/null
@@ -1,243 +0,0 @@
----
-title: Alerts
-weight: 2
----
-
-To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. When an event occurs, your alert is triggered, and you are sent a notification. You can then, if necessary, follow up with corrective actions.
-
-Notifiers and alerts are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher can notify [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) and [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) of events they need to address.
-
-Before you can receive alerts, you must configure one or more notifier in Rancher.
-
-When you create a cluster, some alert rules are predefined. You can receive these alerts if you configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them.
-
-For details about what triggers the predefined alerts, refer to the [documentation on default alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts)
-
-This section covers the following topics:
-
-- [Alert event examples](#alert-event-examples)
-  - [Prometheus queries](#prometheus-queries)
-- [Urgency levels](#urgency-levels)
-- [Scope of alerts](#scope-of-alerts)
-- [Adding cluster alerts](#adding-cluster-alerts)
-- [Managing cluster alerts](#managing-cluster-alerts)
-
-# Alert Event Examples
-
-Some examples of alert events are:
-
-- A Kubernetes [master component]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#kubernetes-cluster-node-components) entering an unhealthy state.
-- A node or [workload]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/) error occurring.
-- A scheduled deployment taking place as planned.
-- A node's hardware resources becoming overstressed.
-
-### Prometheus Queries
-
-> **Prerequisite:** Monitoring must be [enabled]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) before you can trigger alerts with custom Prometheus queries or expressions.
-
-When you edit an alert rule, you will have the opportunity to configure the alert to be triggered based on a Prometheus expression. For examples of expressions, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression)
-
-# Urgency Levels
-
-You can set an urgency level for each alert. This urgency appears in the notification you receive, helping you to prioritize your response actions. For example, if you have an alert configured to inform you of a routine deployment, no action is required. These alerts can be assigned a low priority level. However, if a deployment fails, it can critically impact your organization, and you need to react quickly. Assign these alerts a high priority level.
-
-# Scope of Alerts
-
-The scope for alerts can be set at either the cluster level or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/).
-
-At the cluster level, Rancher monitors components in your Kubernetes cluster, and sends you alerts related to:
-
-- The state of your nodes.
-- The system services that manage your Kubernetes cluster.
-- The resource events from specific system services.
-- The Prometheus expression cross the thresholds
-
-# Adding Cluster Alerts
-
-As a [cluster owner]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), you can configure Rancher to send you alerts for cluster events.
-
->**Prerequisite:** Before you can receive cluster alerts, you must [add a notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/#adding-notifiers).
-
-1. From the **Global** view, navigate to the cluster that you want to configure cluster alerts for. Select **Tools > Alerts**. Then click **Add Alert Group**.
-
-1. Enter a **Name** for the alert that describes its purpose, you could group alert rules for the different purpose.
-
-1. Based on the type of alert you want to create, complete one of the instruction subsets below.
-{{% accordion id="system-service" label="System Service Alerts" %}}
-This alert type monitor for events that affect one of the Kubernetes master components, regardless of the node it occurs on.
-
-1. Select the **System Services** option, and then select an option from the drop-down.
-
-  - [controller-manager](https://kubernetes.io/docs/concepts/overview/components/#kube-controller-manager)
-  - [etcd](https://kubernetes.io/docs/concepts/overview/components/#etcd)
-  - [scheduler](https://kubernetes.io/docs/concepts/overview/components/#kube-scheduler)
-
-1. Select the urgency level of the alert. The options are:
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-    <br/>
-    <br/>
-    Select the urgency level based on the importance of the service and how many nodes fill the role within your cluster. For example, if you're making an alert for the `etcd` service, select **Critical**. If you're making an alert for redundant schedulers, **Warning** is more appropriate.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-{{% accordion id="resource-event" label="Resource Event Alerts" %}}
-This alert type monitors for specific events that are thrown from a resource type.
-
-1. Choose the type of resource event that triggers an alert. The options are:
-
-  - **Normal**: triggers an alert when any standard resource event occurs.
-  - **Warning**: triggers an alert when unexpected resource events occur.
-
-1. Select a resource type from the **Choose a Resource** drop-down that you want to trigger an alert.
-
-  - [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/)
-  - [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
-  - [Node](https://kubernetes.io/docs/concepts/architecture/nodes/)
-  - [Pod](https://kubernetes.io/docs/concepts/workloads/pods/pod/)
-  - [StatefulSet](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/)
-
-1. Select the urgency level of the alert.
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-    <br/>
-    <br/>
-    Select the urgency level of the alert by considering factors such as how often the event occurs or its importance. For example:
-
-    - If you set a normal alert for pods, you're likely to receive alerts often, and individual pods usually self-heal, so select an urgency of **Info**.
-    - If you set a warning alert for StatefulSets, it's very likely to impact operations, so select an urgency of **Critical**.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-{{% accordion id="node" label="Node Alerts" %}}
-This alert type monitors for events that occur on a specific node.
-
-1. Select the **Node** option, and then make a selection from the **Choose a Node** drop-down.
-
-1. Choose an event to trigger the alert.
-
-  - **Not Ready**: Sends you an alert when the node is unresponsive.
-  - **CPU usage over**: Sends you an alert when the node raises above an entered percentage of its processing allocation.
-  - **Mem usage over**: Sends you an alert when the node raises above an entered percentage of its memory allocation.
-
-1. Select the urgency level of the alert.
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-    <br/>
-    <br/>
-    Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a node's CPU raises above 60% deems an urgency of **Info**, but a node that is **Not Ready** deems an urgency of **Critical**.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-{{% accordion id="node-selector" label="Node Selector Alerts" %}}
-This alert type monitors for events that occur on any node on marked with a label. For more information, see the Kubernetes documentation for [Labels](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/).
-
-1. Select the **Node Selector** option, and then click **Add Selector** to enter a key value pair for a label. This label should be applied to one or more of your nodes. Add as many selectors as you'd like.
-
-1. Choose an event to trigger the alert.
-
-  - **Not Ready**: Sends you an alert when selected nodes are unresponsive.
-  - **CPU usage over**: Sends you an alert when selected nodes raise above an entered percentage of processing allocation.
-  - **Mem usage over**: Sends you an alert when selected nodes raise above an entered percentage of memory allocation.
-
-1. Select the urgency level of the alert.
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-    <br/>
-    <br/>
-      Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a node's CPU raises above 60% deems an urgency of **Info**, but a node that is **Not Ready** deems an urgency of **Critical**.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-{{% accordion id="cluster-expression" label="Metric Expression Alerts" %}}
-This alert type monitors for the overload from Prometheus expression querying, it would be available after you enable monitoring.
-
-1. Input or select an **Expression**, the drop down shows the original metrics from Prometheus, including:
-
-  - [**Node**](https://github.com/prometheus/node_exporter)
-  - [**Container**](https://github.com/google/cadvisor)
-  - [**ETCD**](https://etcd.io/docs/v3.4.0/op-guide/monitoring/)
-  - [**Kubernetes Components**](https://github.com/kubernetes/metrics)
-  - [**Kubernetes Resources**](https://github.com/kubernetes/kube-state-metrics)
-  - [**Fluentd**](https://docs.fluentd.org/v1.0/articles/monitoring-prometheus) (supported by [Logging]({{<baseurl>}}/rancher/v2.x//en/cluster-admin/tools/logging))
-  - [**Cluster Level Grafana**](http://docs.grafana.org/administration/metrics/)
-  - **Cluster Level Prometheus**
-
-1. Choose a **Comparison**.
-
-  - **Equal**: Trigger alert when expression value equal to the threshold.
-  - **Not Equal**: Trigger alert when expression value not equal to the threshold.
-  - **Greater Than**: Trigger alert when expression value greater than to threshold.
-  - **Less Than**: Trigger alert when expression value equal or less than the threshold.
-  - **Greater or Equal**: Trigger alert when expression value greater to equal to the threshold.
-  - **Less or Equal**: Trigger alert when expression value less or equal to the threshold.
-
-1. Input a **Threshold**, for trigger alert when the value of expression cross the threshold.
-
-1. Choose a **Comparison**.
-
-1. Select a duration, for trigger alert when expression value crosses the threshold longer than the configured duration.
-
-1. Select the urgency level of the alert.
-
-    - **Critical**: Most urgent
-    - **Warning**: Normal urgency
-    - **Info**: Least urgent
-    <br/>
-    <br/>
-    Select the urgency level of the alert based on its impact on operations. For example, an alert triggered when a node's load expression ```sum(node_load5)  / count(node_cpu_seconds_total{mode="system"})``` raises above 0.6 deems an urgency of **Info**, but 1 deems an urgency of **Critical**.
-
-1. Configure advanced options. By default, the below options will apply to all alert rules within the group. You can disable these advanced options when configuring a specific rule.
-
-    - **Group Wait Time**: How long to wait to buffer alerts of the same group before sending initially, default to 30 seconds.
-    - **Group Interval Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 30 seconds.
-    - **Repeat Wait Time**: How long to wait before sending an alert that has been added to a group which contains already fired alerts, default to 1 hour.
-
-{{% /accordion %}}
-
-1. Continue adding more **Alert Rule** to the group.
-
-1. Finally, choose the [notifiers]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) to send the alerts to.
-
-    - You can set up multiple notifiers.
-    - You can change notifier recipients on the fly.
-
-**Result:** Your alert is configured. A notification is sent when the alert is triggered.
-
-# Managing Cluster Alerts
-
-After you set up cluster alerts, you can manage each alert object. To manage alerts, browse to the cluster containing the alerts, and then select **Tools > Alerts** that you want to manage. You can:
-
-- Deactivate/Reactive alerts
-- Edit alert settings
-- Delete unnecessary alerts
-- Mute firing alerts
-- Unmute muted alerts
diff --git a/content/rancher/v2.5/en/monitoring/legacy/alerts/default-alerts/_index.md b/content/rancher/v2.5/en/monitoring/legacy/alerts/default-alerts/_index.md
deleted file mode 100644
index ea7f91ff0e0..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/alerts/default-alerts/_index.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Default Alerts for Cluster Monitoring
-weight: 1
----
-
-When you create a cluster, some alert rules are predefined. These alerts notify you about signs that the cluster could be unhealthy. You can receive these alerts if you configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them.
-
-Several of the alerts use Prometheus expressions as the metric that triggers the alert. For more information on how expressions work, you can refer to the Rancher [documentation about Prometheus expressions]({{<baseurl>}}
-/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/) or the Prometheus [documentation about querying metrics](https://prometheus.io/docs/prometheus/latest/querying/basics/).
-
-# Alerts for etcd
-Etcd is the key-value store that contains the state of the Kubernetes cluster. Rancher provides default alerts if the built-in monitoring detects a potential problem with etcd. You don't have to enable monitoring to receive these alerts.
-
-A leader is the node that handles all client requests that need cluster consensus. For more information, you can refer to this [explanation of how etcd works.](https://rancher.com/blog/2019/2019-01-29-what-is-etcd/#how-does-etcd-work)
-
-The leader of the cluster can change in response to certain events. It is normal for the leader to change, but too many changes can indicate a problem with the network or a high CPU load. With longer latencies, the default etcd configuration may cause frequent heartbeat timeouts, which trigger a new leader election.
-
-| Alert | Explanation |
-|-------|-------------|
-| A high number of leader changes within the etcd cluster are happening | A warning alert is triggered when the leader changes more than three times in one hour. |
-| Database usage close to the quota 500M | A warning alert is triggered when the size of etcd exceeds 500M.|
-| Etcd is unavailable | A critical alert is triggered when etcd becomes unavailable. |
-| Etcd member has no leader | A critical alert is triggered when the etcd cluster does not have a leader for at least three minutes. |
-
-
-# Alerts for Kubernetes Components
-Rancher provides alerts when core Kubernetes system components become unhealthy.
-
-Controllers update Kubernetes resources based on changes in etcd. The [controller manager](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/) monitors the cluster desired state through the Kubernetes API server and makes the necessary changes to the current state to reach the desired state.
-
-The [scheduler](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/) service is a core component of Kubernetes. It is responsible for scheduling cluster workloads to nodes, based on various configurations, metrics, resource requirements and workload-specific requirements.
-
-| Alert | Explanation |
-|-------|-------------|
-| Controller Manager is unavailable |  A critical warning is triggered when the cluster’s controller-manager becomes unavailable. |
-| Scheduler is unavailable | A critical warning is triggered when the cluster’s scheduler becomes unavailable. |
-
-
-# Alerts for Events
-Kubernetes events are objects that provide insight into what is happening inside a cluster, such as what decisions were made by the scheduler or why some pods were evicted from the node. In the Rancher UI, from the project view, you can see events for each workload.
-
-| Alert | Explanation |
-|-------|-------------|
-| Get warning deployment event | A warning alert is triggered when a warning event happens on a deployment. |
-
-
-# Alerts for Nodes
-Alerts can be triggered based on node metrics. Each computing resource in a Kubernetes cluster is called a node. [Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/#kubernetes-cluster-node-components) can be either bare-metal servers or virtual machines.
-
-| Alert | Explanation |
-|-------|-------------|
-| High CPU load | A warning alert is triggered if the node uses more than 100 percent of the node’s available CPU seconds for at least three minutes. |
-| High node memory utilization | A warning alert is triggered if the node uses more than 80 percent of its available memory for at least three minutes. |
-| Node disk is running full within 24 hours | A critical alert is triggered if the disk space on the node is expected to run out in the next 24 hours based on the disk growth over the last 6 hours. |
-
-# Project-level Alerts
-When you enable monitoring for the project, some project-level alerts are provided. For details, refer to the [section on project-level alerts.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/#default-project-level-alerts)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/monitoring/legacy/alerts/expression/_index.md b/content/rancher/v2.5/en/monitoring/legacy/alerts/expression/_index.md
deleted file mode 100644
index 9f5170c9779..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/alerts/expression/_index.md
+++ /dev/null
@@ -1,430 +0,0 @@
----
-title: Prometheus Expressions
-weight: 4
----
-
-The PromQL expressions in this doc can be used to configure [alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
-
-> Before expression can be used in alerts, monitoring must be enabled. For more information, refer to the documentation on enabling monitoring [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring)
-
-For more information about querying Prometheus, refer to the official [Prometheus documentation.](https://prometheus.io/docs/prometheus/latest/querying/basics/)
-
-<!-- TOC -->
-
-- [Cluster Metrics](#cluster-metrics)
-  - [Cluster CPU Utilization](#cluster-cpu-utilization)
-  - [Cluster Load Average](#cluster-load-average)
-  - [Cluster Memory Utilization](#cluster-memory-utilization)
-  - [Cluster Disk Utilization](#cluster-disk-utilization)
-  - [Cluster Disk I/O](#cluster-disk-i-o)
-  - [Cluster Network Packets](#cluster-network-packets)
-  - [Cluster Network I/O](#cluster-network-i-o)
-- [Node Metrics](#node-metrics)
-  - [Node CPU Utilization](#node-cpu-utilization)
-  - [Node Load Average](#node-load-average)
-  - [Node Memory Utilization](#node-memory-utilization)
-  - [Node Disk Utilization](#node-disk-utilization)
-  - [Node Disk I/O](#node-disk-i-o)
-  - [Node Network Packets](#node-network-packets)
-  - [Node Network I/O](#node-network-i-o)
-- [Etcd Metrics](#etcd-metrics)
-  - [Etcd Has a Leader](#etcd-has-a-leader)
-  - [Number of Times the Leader Changes](#number-of-times-the-leader-changes)
-  - [Number of Failed Proposals](#number-of-failed-proposals)
-  - [GRPC Client Traffic](#grpc-client-traffic)
-  - [Peer Traffic](#peer-traffic)
-  - [DB Size](#db-size)
-  - [Active Streams](#active-streams)
-  - [Raft Proposals](#raft-proposals)
-  - [RPC Rate](#rpc-rate)
-  - [Disk Operations](#disk-operations)
-  - [Disk Sync Duration](#disk-sync-duration)
-- [Kubernetes Components Metrics](#kubernetes-components-metrics)
-  - [API Server Request Latency](#api-server-request-latency)
-  - [API Server Request Rate](#api-server-request-rate)
-  - [Scheduling Failed Pods](#scheduling-failed-pods)
-  - [Controller Manager Queue Depth](#controller-manager-queue-depth)
-  - [Scheduler E2E Scheduling Latency](#scheduler-e2e-scheduling-latency)
-  - [Scheduler Preemption Attempts](#scheduler-preemption-attempts)
-  - [Ingress Controller Connections](#ingress-controller-connections)
-  - [Ingress Controller Request Process Time](#ingress-controller-request-process-time)
-- [Rancher Logging Metrics](#rancher-logging-metrics)
-  - [Fluentd Buffer Queue Rate](#fluentd-buffer-queue-rate)
-  - [Fluentd Input Rate](#fluentd-input-rate)
-  - [Fluentd Output Errors Rate](#fluentd-output-errors-rate)
-  - [Fluentd Output Rate](#fluentd-output-rate)
-- [Workload Metrics](#workload-metrics)
-  - [Workload CPU Utilization](#workload-cpu-utilization)
-  - [Workload Memory Utilization](#workload-memory-utilization)
-  - [Workload Network Packets](#workload-network-packets)
-  - [Workload Network I/O](#workload-network-i-o)
-  - [Workload Disk I/O](#workload-disk-i-o)
-- [Pod Metrics](#pod-metrics)
-  - [Pod CPU Utilization](#pod-cpu-utilization)
-  - [Pod Memory Utilization](#pod-memory-utilization)
-  - [Pod Network Packets](#pod-network-packets)
-  - [Pod Network I/O](#pod-network-i-o)
-  - [Pod Disk I/O](#pod-disk-i-o)
-- [Container Metrics](#container-metrics)
-  - [Container CPU Utilization](#container-cpu-utilization)
-  - [Container Memory Utilization](#container-memory-utilization)
-  - [Container Disk I/O](#container-disk-i-o)
-
-<!-- /TOC -->
-
-# Cluster Metrics
-
-### Cluster CPU Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])) by (instance))` |
-| Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle"}[5m])))` |
-
-### Cluster Load Average
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"}) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>load1</td><td>`sum(node_load1) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load5</td><td>`sum(node_load5) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr><tr><td>load15</td><td>`sum(node_load15) by (instance) / count(node_cpu_seconds_total{mode="system"})`</td></tr></table> |
-
-### Cluster Memory Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `1 - sum(node_memory_MemAvailable_bytes) by (instance) / sum(node_memory_MemTotal_bytes) by (instance)` |
-| Summary | `1 - sum(node_memory_MemAvailable_bytes) / sum(node_memory_MemTotal_bytes)` |
-
-### Cluster Disk Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `(sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance) - sum(node_filesystem_free_bytes{device!="rootfs"}) by (instance)) / sum(node_filesystem_size_bytes{device!="rootfs"}) by (instance)` |
-| Summary | `(sum(node_filesystem_size_bytes{device!="rootfs"}) - sum(node_filesystem_free_bytes{device!="rootfs"})) / sum(node_filesystem_size_bytes{device!="rootfs"})` |
-
-### Cluster Disk I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m])) by (instance)`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m])) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total[5m]))`</td></tr></table> |
-
-### Cluster Network Packets
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
-| Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
-
-### Cluster Network I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m])) by (instance)</code></td></tr></table> |
-| Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*"}[5m]))</code></td></tr></table> |
-
-# Node Metrics
-
-### Node CPU Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `avg(irate(node_cpu_seconds_total{mode!="idle", instance=~"$instance"}[5m])) by (mode)` |
-| Summary | `1 - (avg(irate(node_cpu_seconds_total{mode="idle", instance=~"$instance"}[5m])))` |
-
-### Node Load Average
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
-| Summary | <table><tr><td>load1</td><td>`sum(node_load1{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load5</td><td>`sum(node_load5{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr><tr><td>load15</td><td>`sum(node_load15{instance=~"$instance"}) / count(node_cpu_seconds_total{mode="system",instance=~"$instance"})`</td></tr></table> |
-
-### Node Memory Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"})` |
-| Summary | `1 - sum(node_memory_MemAvailable_bytes{instance=~"$instance"}) / sum(node_memory_MemTotal_bytes{instance=~"$instance"}) ` |
-
-### Node Disk Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"}) by (device)) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) by (device)` |
-| Summary | `(sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"}) - sum(node_filesystem_free_bytes{device!="rootfs",instance=~"$instance"})) / sum(node_filesystem_size_bytes{device!="rootfs",instance=~"$instance"})` |
-
-### Node Disk I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
-| Summary | <table><tr><td>read</td><td>`sum(rate(node_disk_read_bytes_total{instance=~"$instance"}[5m]))`</td></tr><tr><td>written</td><td>`sum(rate(node_disk_written_bytes_total{instance=~"$instance"}[5m]))`</td></tr></table> |
-
-### Node Network Packets
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
-| Summary | <table><tr><td>receive-dropped</td><td><code>sum(rate(node_network_receive_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-errs</td><td><code>sum(rate(node_network_receive_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>receive-packets</td><td><code>sum(rate(node_network_receive_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-dropped</td><td><code>sum(rate(node_network_transmit_drop_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-errs</td><td><code>sum(rate(node_network_transmit_errs_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit-packets</td><td><code>sum(rate(node_network_transmit_packets_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
-
-### Node Network I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m])) by (device)</code></td></tr></table> |
-| Summary | <table><tr><td>receive</td><td><code>sum(rate(node_network_receive_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr><tr><td>transmit</td><td><code>sum(rate(node_network_transmit_bytes_total{device!~"lo &#124; veth.* &#124; docker.* &#124; flannel.* &#124; cali.* &#124; cbr.*",instance=~"$instance"}[5m]))</code></td></tr></table> |
-
-# Etcd Metrics
-
-### Etcd Has a Leader
-
-`max(etcd_server_has_leader)`
-
-### Number of Times the Leader Changes
-
-`max(etcd_server_leader_changes_seen_total)`
-
-### Number of Failed Proposals
-
-`sum(etcd_server_proposals_failed_total)`
-
-### GRPC Client Traffic
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_client_grpc_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_client_grpc_sent_bytes_total[5m]))`</td></tr></table> |
-
-### Peer Traffic
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m])) by (instance)`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m])) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>in</td><td>`sum(rate(etcd_network_peer_received_bytes_total[5m]))`</td></tr><tr><td>out</td><td>`sum(rate(etcd_network_peer_sent_bytes_total[5m]))`</td></tr></table> |
-
-### DB Size
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(etcd_debugging_mvcc_db_total_size_in_bytes) by (instance)` |
-| Summary | `sum(etcd_debugging_mvcc_db_total_size_in_bytes)` |
-
-### Active Streams
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) by (instance)`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>lease-watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Lease",grpc_type="bidi_stream"})`</td></tr><tr><td>watch</td><td>`sum(grpc_server_started_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"}) - sum(grpc_server_handled_total{grpc_service="etcdserverpb.Watch",grpc_type="bidi_stream"})`</td></tr></table> |
-
-### Raft Proposals
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m])) by (instance)`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m])) by (instance)`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m])) by (instance)`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m])) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>applied</td><td>`sum(increase(etcd_server_proposals_applied_total[5m]))`</td></tr><tr><td>committed</td><td>`sum(increase(etcd_server_proposals_committed_total[5m]))`</td></tr><tr><td>pending</td><td>`sum(increase(etcd_server_proposals_pending[5m]))`</td></tr><tr><td>failed</td><td>`sum(increase(etcd_server_proposals_failed_total[5m]))`</td></tr></table> |
-
-### RPC Rate
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m])) by (instance)`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m])) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>total</td><td>`sum(rate(grpc_server_started_total{grpc_type="unary"}[5m]))`</td></tr><tr><td>fail</td><td>`sum(rate(grpc_server_handled_total{grpc_type="unary",grpc_code!="OK"}[5m]))`</td></tr></table> |
-
-### Disk Operations
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m])) by (instance)`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m])) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>commit-called-by-backend</td><td>`sum(rate(etcd_disk_backend_commit_duration_seconds_sum[1m]))`</td></tr><tr><td>fsync-called-by-wal</td><td>`sum(rate(etcd_disk_wal_fsync_duration_seconds_sum[1m]))`</td></tr></table> |
-
-### Disk Sync Duration
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>wal</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le))`</td></tr><tr><td>db</td><td>`histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le))`</td></tr></table> |
-| Summary | <table><tr><td>wal</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr><tr><td>db</td><td>`sum(histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket[5m])) by (instance, le)))`</td></tr></table> |
-
-# Kubernetes Components Metrics
-
-### API Server Request Latency
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance, verb) /1e+06` |
-| Summary | `avg(apiserver_request_latencies_sum / apiserver_request_latencies_count) by (instance) /1e+06` |
-
-### API Server Request Rate
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(rate(apiserver_request_count[5m])) by (instance, code)` |
-| Summary | `sum(rate(apiserver_request_count[5m])) by (instance)` |
-
-### Scheduling Failed Pods
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(kube_pod_status_scheduled{condition="false"})` |
-| Summary | `sum(kube_pod_status_scheduled{condition="false"})` |
-
-### Controller Manager Queue Depth
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>volumes</td><td>`sum(volumes_depth) by instance`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth) by instance`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth) by instance`</td></tr><tr><td>service</td><td>`sum(service_depth) by instance`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth) by instance`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth) by instance`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth) by instance`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth) by instance`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth) by instance`</td></tr></table> |
-| Summary | <table><tr><td>volumes</td><td>`sum(volumes_depth)`</td></tr><tr><td>deployment</td><td>`sum(deployment_depth)`</td></tr><tr><td>replicaset</td><td>`sum(replicaset_depth)`</td></tr><tr><td>service</td><td>`sum(service_depth)`</td></tr><tr><td>serviceaccount</td><td>`sum(serviceaccount_depth)`</td></tr><tr><td>endpoint</td><td>`sum(endpoint_depth)`</td></tr><tr><td>daemonset</td><td>`sum(daemonset_depth)`</td></tr><tr><td>statefulset</td><td>`sum(statefulset_depth)`</td></tr><tr><td>replicationmanager</td><td>`sum(replicationmanager_depth)`</td></tr></table> |
-
-### Scheduler E2E Scheduling Latency
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06` |
-| Summary | `sum(histogram_quantile(0.99, sum(scheduler_e2e_scheduling_latency_microseconds_bucket) by (le, instance)) / 1e+06)` |
-
-### Scheduler Preemption Attempts
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(rate(scheduler_total_preemption_attempts[5m])) by (instance)` |
-| Summary | `sum(rate(scheduler_total_preemption_attempts[5m]))` |
-
-### Ingress Controller Connections
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"}) by (instance)`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"}) by (instance)`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"}) by (instance)`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m]))) by (instance)`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m]))) by (instance)`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m]))) by (instance)`</td></tr></table> |
-| Summary | <table><tr><td>reading</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="reading"})`</td></tr><tr><td>waiting</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="waiting"})`</td></tr><tr><td>writing</td><td>`sum(nginx_ingress_controller_nginx_process_connections{state="writing"})`</td></tr><tr><td>accepted</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="accepted"}[5m])))`</td></tr><tr><td>active</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="active"}[5m])))`</td></tr><tr><td>handled</td><td>`sum(ceil(increase(nginx_ingress_controller_nginx_process_connections_total{state="handled"}[5m])))`</td></tr></table> |
-
-### Ingress Controller Request Process Time
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `topk(10, histogram_quantile(0.95,sum by (le, host, path)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
-| Summary | `topk(10, histogram_quantile(0.95,sum by (le, host)(rate(nginx_ingress_controller_request_duration_seconds_bucket{host!="_"}[5m]))))` |
-
-# Rancher Logging Metrics
-
-
-### Fluentd Buffer Queue Rate
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(rate(fluentd_output_status_buffer_queue_length[5m])) by (instance)` |
-| Summary | `sum(rate(fluentd_output_status_buffer_queue_length[5m]))` |
-
-### Fluentd Input Rate
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(rate(fluentd_input_status_num_records_total[5m])) by (instance)` |
-| Summary | `sum(rate(fluentd_input_status_num_records_total[5m]))` |
-
-### Fluentd Output Errors Rate
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(rate(fluentd_output_status_num_errors[5m])) by (type)` |
-| Summary | `sum(rate(fluentd_output_status_num_errors[5m]))` |
-
-### Fluentd Output Rate
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(rate(fluentd_output_status_num_records_total[5m])) by (instance)` |
-| Summary | `sum(rate(fluentd_output_status_num_records_total[5m]))` |
-
-# Workload Metrics
-
-### Workload CPU Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-| Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
-
-### Workload Memory Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""}) by (pod_name)` |
-| Summary | `sum(container_memory_working_set_bytes{namespace="$namespace",pod_name=~"$podName", container_name!=""})` |
-
-### Workload Network Packets
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-| Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
-
-### Workload Network I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-| Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
-
-### Workload Disk I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m])) by (pod_name)`</td></tr></table> |
-| Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name=~"$podName",container_name!=""}[5m]))`</td></tr></table> |
-
-# Pod Metrics
-
-### Pod CPU Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m])) by (container_name)`</td></tr></table> |
-| Summary | <table><tr><td>cfs throttled seconds</td><td>`sum(rate(container_cpu_cfs_throttled_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>usage seconds</td><td>`sum(rate(container_cpu_usage_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>system seconds</td><td>`sum(rate(container_cpu_system_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr><tr><td>user seconds</td><td>`sum(rate(container_cpu_user_seconds_total{container_name!="POD",namespace="$namespace",pod_name="$podName", container_name!=""}[5m]))`</td></tr></table> |
-
-### Pod Memory Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""}) by (container_name)` |
-| Summary | `sum(container_memory_working_set_bytes{container_name!="POD",namespace="$namespace",pod_name="$podName",container_name!=""})` |
-
-### Pod Network Packets
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
-| Summary | <table><tr><td>receive-packets</td><td>`sum(rate(container_network_receive_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-dropped</td><td>`sum(rate(container_network_receive_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>receive-errors</td><td>`sum(rate(container_network_receive_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-packets</td><td>`sum(rate(container_network_transmit_packets_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-dropped</td><td>`sum(rate(container_network_transmit_packets_dropped_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit-errors</td><td>`sum(rate(container_network_transmit_errors_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
-
-### Pod Network I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
-| Summary | <table><tr><td>receive</td><td>`sum(rate(container_network_receive_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>transmit</td><td>`sum(rate(container_network_transmit_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
-
-### Pod Disk I/O
-
-| Catalog | Expression |
-| --- | --- |
-| Detail | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m])) by (container_name)`</td></tr></table> |
-| Summary | <table><tr><td>read</td><td>`sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr><tr><td>write</td><td>`sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name!=""}[5m]))`</td></tr></table> |
-
-# Container Metrics
-
-### Container CPU Utilization
-
-| Catalog | Expression |
-| --- | --- |
-| cfs throttled seconds | `sum(rate(container_cpu_cfs_throttled_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-| usage seconds | `sum(rate(container_cpu_usage_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-| system seconds | `sum(rate(container_cpu_system_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-| user seconds | `sum(rate(container_cpu_user_seconds_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-
-### Container Memory Utilization
-
-`sum(container_memory_working_set_bytes{namespace="$namespace",pod_name="$podName",container_name="$containerName"})`
-
-### Container Disk I/O
-
-| Catalog | Expression |
-| --- | --- |
-| read | `sum(rate(container_fs_reads_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
-| write | `sum(rate(container_fs_writes_bytes_total{namespace="$namespace",pod_name="$podName",container_name="$containerName"}[5m]))` |
diff --git a/content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md
deleted file mode 100644
index 1cb62c544bf..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/monitoring/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Monitoring
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/monitoring/legacy/monitoring/cluster-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/cluster-metrics/_index.md
deleted file mode 100644
index 0d7175aaeb8..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/monitoring/cluster-metrics/_index.md
+++ /dev/null
@@ -1,110 +0,0 @@
----
-title: Cluster Metrics
-weight: 3
----
-Cluster metrics display the hardware utilization for all nodes in your cluster, regardless of its role. They give you a global monitoring insight into the cluster.
-
-Some of the biggest metrics to look out for:
-
-- **CPU Utilization**
-
-    High load either indicates that your cluster is running efficiently or that you're running out of CPU resources.
-
-- **Disk Utilization**
-
-    Be on the lookout for increased read and write rates on nodes nearing their disk capacity. This advice is especially true for etcd nodes, as running out of storage on an etcd node leads to cluster failure.
-
-- **Memory Utilization**
-
-    Deltas in memory utilization usually indicate a memory leak.
-
-- **Load Average**
-
-     Generally, you want your load average to match your number of logical CPUs for the cluster. For example, if your cluster has 8 logical CPUs, the ideal load average would be 8 as well. If you load average is well under the number of logical CPUs for the cluster, you may want to reduce cluster resources. On the other hand, if your average is over 8, your cluster may need more resources.
-
-## Finding Node Metrics
-
-1. From the **Global** view, navigate to the cluster that you want to view metrics.
-
-1. Select **Nodes** in the navigation bar.
-
-1. Select a specific node and click on its name.
-
-1. Click on **Node Metrics**.
-
-[_Get expressions for Cluster Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#cluster-metrics)
-
-### Etcd Metrics
-
->**Note:** Only supported for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
-
-Etcd metrics display the operations of the etcd database on each of your cluster nodes. After establishing a baseline of normal etcd operational metrics, observe them for abnormal deltas between metric refreshes, which indicate potential issues with etcd. Always address etcd issues immediately!
-
-You should also pay attention to the text at the top of the etcd metrics, which displays leader election statistics. This text indicates if etcd currently has a leader, which is the etcd instance that coordinates the other etcd instances in your cluster. A large increase in leader changes implies etcd is unstable. If you notice a change in leader election statistics, you should investigate them for issues.
-
-Some of the biggest metrics to look out for:
-
-- **Etcd has a leader**
-
-    etcd is usually deployed on multiple nodes and elects a leader to coordinate its operations. If etcd does not have a leader, its operations are not being coordinated.
-
-- **Number of leader changes**
-
-    If this statistic suddenly grows, it usually indicates network communication issues that constantly force the cluster to elect a new leader.
-
-[_Get expressions for Etcd Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#etcd-metrics)
-
-### Kubernetes Components Metrics
-
-Kubernetes components metrics display data about the cluster's individual Kubernetes components. Primarily, it displays information about connections and latency for each component: the API server, controller manager, scheduler, and ingress controller.
-
->**Note:** The metrics for the controller manager, scheduler and ingress controller are only supported for [Rancher launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/).
-
-When analyzing Kubernetes component metrics, don't be concerned about any single standalone metric in the charts and graphs that display. Rather, you should establish a baseline for metrics considered normal following a period of observation, e.g. the range of values that your components usually operate within and are considered normal. After you establish this baseline, be on the lookout for large deltas in the charts and graphs, as these big changes usually indicate a problem that you need to investigate.
-
-Some of the more important component metrics to monitor are:
-
-- **API Server Request Latency**
-
-    Increasing API response times indicate there's a generalized problem that requires investigation.
-
-- **API Server Request Rate**
-
-    Rising API request rates usually coincide with increased API response times. Increased request rates also indicate a generalized problem requiring investigation.
-
-- **Scheduler Preemption Attempts**
-
-    If you see a spike in scheduler preemptions, it's an indication that you're running out of hardware resources, as Kubernetes is recognizing it doesn't have enough resources to run all your pods and is prioritizing the more important ones.
-
-- **Scheduling Failed Pods**
-
-    Failed pods can have a variety of causes, such as unbound persistent volume claims, exhausted hardware resources, non-responsive nodes, etc.
-
-- **Ingress Controller Request Process Time**
-
-    How fast ingress is routing connections to your cluster services.
-
-[_Get expressions for Kubernetes Component Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#kubernetes-components-metrics)
-
-## Rancher Logging Metrics
-
-Although the Dashboard for a cluster primarily displays data sourced from Prometheus, it also displays information for cluster logging, provided that you have [configured Rancher to use a logging service]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/).
-
-[_Get expressions for Rancher Logging Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#rancher-logging-metrics)
-
-## Finding Workload Metrics
-
-Workload metrics display the hardware utilization for a Kubernetes workload. You can also view metrics for [deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/), [stateful sets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) and so on.
-
-1. From the **Global** view, navigate to the project that you want to view workload metrics.
-
-1. From the main navigation bar, choose **Resources > Workloads.** In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.
-
-1. Select a specific workload and click on its name.
-
-1. In the **Pods** section, select a specific pod and click on its name.
-
-    - **View the Pod Metrics:** Click on **Pod Metrics**.
-    - **View the Container Metrics:** In the **Containers** section, select a specific container and click on its name. Click on **Container Metrics**.
-
-[_Get expressions for Workload Metrics_]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/#workload-metrics)
diff --git a/content/rancher/v2.5/en/monitoring/legacy/monitoring/custom-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/custom-metrics/_index.md
deleted file mode 100644
index a78b62ee206..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/monitoring/custom-metrics/_index.md
+++ /dev/null
@@ -1,489 +0,0 @@
----
-title: Prometheus Custom Metrics Adapter
-weight: 5
----
-
-After you've enabled [cluster level monitoring]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring), You can view the metrics data from Rancher. You can also deploy the Prometheus custom metrics adapter then you can use the HPA with metrics stored in cluster monitoring.
-
-## Deploy Prometheus Custom Metrics Adapter
-
-We are going to use the [Prometheus custom metrics adapter](https://github.com/DirectXMan12/k8s-prometheus-adapter/releases/tag/v0.5.0), version v0.5.0. This is a great example for the [custom metrics server](https://github.com/kubernetes-incubator/custom-metrics-apiserver). And you must be the *cluster owner* to execute following steps.
-
-- Get the service account of the cluster monitoring is using. It should be configured in the workload ID: `statefulset:cattle-prometheus:prometheus-cluster-monitoring`. And if you didn't customize anything, the service account name should be `cluster-monitoring`.
-
-- Grant permission to that service account. You will need two kinds of permission. 
-One role is `extension-apiserver-authentication-reader` in `kube-system`, so you will need to create a `Rolebinding` to in `kube-system`. This permission is to get api aggregation configuration from config map in `kube-system`.
-
-```yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: custom-metrics-auth-reader
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: extension-apiserver-authentication-reader
-subjects:
-- kind: ServiceAccount
-  name: cluster-monitoring
-  namespace: cattle-prometheus
-```
-
-The other one is cluster role `system:auth-delegator`, so you will need to create a `ClusterRoleBinding`. This permission is to have subject access review permission.
-
-```yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: custom-metrics:system:auth-delegator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-- kind: ServiceAccount
-  name: cluster-monitoring
-  namespace: cattle-prometheus
-```
-
-- Create configuration for custom metrics adapter. Following is an example configuration. There will be a configuration details in next session.
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: adapter-config
-  namespace: cattle-prometheus
-data:
-  config.yaml: |
-    rules:
-    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
-      seriesFilters: []
-      resources:
-        overrides:
-          namespace:
-            resource: namespace
-          pod_name:
-            resource: pod
-      name:
-        matches: ^container_(.*)_seconds_total$
-        as: ""
-      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[1m])) by (<<.GroupBy>>)
-    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
-      seriesFilters:
-      - isNot: ^container_.*_seconds_total$
-      resources:
-        overrides:
-          namespace:
-            resource: namespace
-          pod_name:
-            resource: pod
-      name:
-        matches: ^container_(.*)_total$
-        as: ""
-      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[1m])) by (<<.GroupBy>>)
-    - seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
-      seriesFilters:
-      - isNot: ^container_.*_total$
-      resources:
-        overrides:
-          namespace:
-            resource: namespace
-          pod_name:
-            resource: pod
-      name:
-        matches: ^container_(.*)$
-        as: ""
-      metricsQuery: sum(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}) by (<<.GroupBy>>)
-    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
-      seriesFilters:
-      - isNot: .*_total$
-      resources:
-        template: <<.Resource>>
-      name:
-        matches: ""
-        as: ""
-      metricsQuery: sum(<<.Series>>{<<.LabelMatchers>>}) by (<<.GroupBy>>)
-    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
-      seriesFilters:
-      - isNot: .*_seconds_total
-      resources:
-        template: <<.Resource>>
-      name:
-        matches: ^(.*)_total$
-        as: ""
-      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
-    - seriesQuery: '{namespace!="",__name__!~"^container_.*"}'
-      seriesFilters: []
-      resources:
-        template: <<.Resource>>
-      name:
-        matches: ^(.*)_seconds_total$
-        as: ""
-      metricsQuery: sum(rate(<<.Series>>{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
-    resourceRules:
-      cpu:
-        containerQuery: sum(rate(container_cpu_usage_seconds_total{<<.LabelMatchers>>}[1m])) by (<<.GroupBy>>)
-        nodeQuery: sum(rate(container_cpu_usage_seconds_total{<<.LabelMatchers>>, id='/'}[1m])) by (<<.GroupBy>>)
-        resources:
-          overrides:
-            instance:
-              resource: node
-            namespace:
-              resource: namespace
-            pod_name:
-              resource: pod
-        containerLabel: container_name
-      memory:
-        containerQuery: sum(container_memory_working_set_bytes{<<.LabelMatchers>>}) by (<<.GroupBy>>)
-        nodeQuery: sum(container_memory_working_set_bytes{<<.LabelMatchers>>,id='/'}) by (<<.GroupBy>>)
-        resources:
-          overrides:
-            instance:
-              resource: node
-            namespace:
-              resource: namespace
-            pod_name:
-              resource: pod
-        containerLabel: container_name
-      window: 1m
-```
-
-- Create HTTPS TLS certs for your api server. You can use following command to create a self-signed cert.
-
-```bash
-openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out serving.crt -keyout serving.key -subj "/C=CN/CN=custom-metrics-apiserver.cattle-prometheus.svc.cluster.local"
-# And you will find serving.crt and serving.key in your path. And then you are going to create a secret in cattle-prometheus namespace.
-kubectl create secret generic -n cattle-prometheus cm-adapter-serving-certs --from-file=serving.key=./serving.key --from-file=serving.crt=./serving.crt 
-```
-
-- Then you can create the prometheus custom metrics adapter. And you will need a service for this deployment too. Creating it via Import YAML or Rancher would do. Please create those resources in `cattle-prometheus` namespaces.
-
-Here is the prometheus custom metrics adapter deployment.
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: custom-metrics-apiserver
-  name: custom-metrics-apiserver
-  namespace: cattle-prometheus
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: custom-metrics-apiserver
-  template:
-    metadata:
-      labels:
-        app: custom-metrics-apiserver
-      name: custom-metrics-apiserver
-    spec:
-      serviceAccountName: cluster-monitoring
-      containers:
-      - name: custom-metrics-apiserver
-        image: directxman12/k8s-prometheus-adapter-amd64:v0.5.0
-        args:
-        - --secure-port=6443
-        - --tls-cert-file=/var/run/serving-cert/serving.crt
-        - --tls-private-key-file=/var/run/serving-cert/serving.key
-        - --logtostderr=true
-        - --prometheus-url=http://prometheus-operated/
-        - --metrics-relist-interval=1m
-        - --v=10
-        - --config=/etc/adapter/config.yaml
-        ports:
-        - containerPort: 6443
-        volumeMounts:
-        - mountPath: /var/run/serving-cert
-          name: volume-serving-cert
-          readOnly: true
-        - mountPath: /etc/adapter/
-          name: config
-          readOnly: true
-        - mountPath: /tmp
-          name: tmp-vol
-      volumes:
-      - name: volume-serving-cert
-        secret:
-          secretName: cm-adapter-serving-certs
-      - name: config
-        configMap:
-          name: adapter-config
-      - name: tmp-vol
-        emptyDir: {}
-
-```
-
-Here is the service of the deployment.
-```yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: custom-metrics-apiserver
-  namespace: cattle-prometheus
-spec:
-  ports:
-  - port: 443
-    targetPort: 6443
-  selector:
-    app: custom-metrics-apiserver
-```
-
-- Create API service for your custom metric server.
-
-```yaml
-apiVersion: apiregistration.k8s.io/v1beta1
-kind: APIService
-metadata:
-  name: v1beta1.custom.metrics.k8s.io
-spec:
-  service:
-    name: custom-metrics-apiserver
-    namespace: cattle-prometheus
-  group: custom.metrics.k8s.io
-  version: v1beta1
-  insecureSkipTLSVerify: true
-  groupPriorityMinimum: 100
-  versionPriority: 100
-
-```
-
-- Then you can verify your custom metrics server by `kubectl get --raw /apis/custom.metrics.k8s.io/v1beta1`. If you see the return datas from the api, it means that the metrics server has been successfully set up.
-
-- You create HPA with custom metrics now. Here is an example of HPA. You will need to create a nginx deployment in your namespace first.
-
-```yaml
-kind: HorizontalPodAutoscaler
-apiVersion: autoscaling/v2beta1
-metadata:
-  name: nginx
-spec:
-  scaleTargetRef:
-    # point the HPA at the nginx deployment you just created
-    apiVersion: apps/v1
-    kind: Deployment
-    name: nginx
-  # autoscale between 1 and 10 replicas
-  minReplicas: 1
-  maxReplicas: 10
-  metrics:
-  # use a "Pods" metric, which takes the average of the
-  # given metric across all pods controlled by the autoscaling target
-  - type: Pods
-    pods:
-      metricName: memory_usage_bytes
-      targetAverageValue: 5000000
-```
-
-And then, you should see your nginx is scaling up. HPA with custom metrics works.
-
-## Configuration of prometheus custom metrics adapter
-
-> Refer to https://github.com/DirectXMan12/k8s-prometheus-adapter/blob/master/docs/config.md
-
-The adapter determines which metrics to expose, and how to expose them,
-through a set of "discovery" rules.  Each rule is executed independently
-(so make sure that your rules are mutually exclusive), and specifies each
-of the steps the adapter needs to take to expose a metric in the API.
-
-Each rule can be broken down into roughly four parts:
-
-- *Discovery*, which specifies how the adapter should find all Prometheus
-  metrics for this rule.
-
-- *Association*, which specifies how the adapter should determine which
-  Kubernetes resources a particular metric is associated with.
-
-- *Naming*, which specifies how the adapter should expose the metric in
-  the custom metrics API.
-
-- *Querying*, which specifies how a request for a particular metric on one
-  or more Kubernetes objects should be turned into a query to Prometheus.
-
-A more comprehensive configuration file can be found in
-[sample-config.yaml](sample-config.yaml), but a basic config with one rule
-might look like:
-
-```yaml
-rules:
-# this rule matches cumulative cAdvisor metrics measured in seconds
-- seriesQuery: '{__name__=~"^container_.*",container_name!="POD",namespace!="",pod_name!=""}'
-  resources:
-    # skip specifying generic resource<->label mappings, and just
-    # attach only pod and namespace resources by mapping label names to group-resources
-    overrides:
-      namespace: {resource: "namespace"},
-      pod_name: {resource: "pod"},
-  # specify that the `container_` and `_seconds_total` suffixes should be removed.
-  # this also introduces an implicit filter on metric family names
-  name:
-    # we use the value of the capture group implicitly as the API name
-    # we could also explicitly write `as: "$1"`
-    matches: "^container_(.*)_seconds_total$"
-  # specify how to construct a query to fetch samples for a given series
-  # This is a Go template where the `.Series` and `.LabelMatchers` string values
-  # are available, and the delimiters are `<<` and `>>` to avoid conflicts with
-  # the prometheus query language
-  metricsQuery: "sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[2m])) by (<<.GroupBy>>)"
-```
-
-### Discovery
-
-Discovery governs the process of finding the metrics that you want to
-expose in the custom metrics API.  There are two fields that factor into
-discovery: `seriesQuery` and `seriesFilters`.
-
-`seriesQuery` specifies Prometheus series query (as passed to the
-`/api/v1/series` endpoint in Prometheus) to use to find some set of
-Prometheus series.  The adapter will strip the label values from this
-series, and then use the resulting metric-name-label-names combinations
-later on.
-
-In many cases, `seriesQuery` will be sufficient to narrow down the list of
-Prometheus series.  However, sometimes (especially if two rules might
-otherwise overlap), it's useful to do additional filtering on metric
-names.  In this case, `seriesFilters` can be used.  After the list of
-series is returned from `seriesQuery`, each series has its metric name
-filtered through any specified filters.
-
-Filters may be either:
-
-- `is: <regex>`, which matches any series whose name matches the specified
-  regex.
-
-- `isNot: <regex>`, which matches any series whose name does not match the
-  specified regex.
-
-For example:
-
-```yaml
-# match all cAdvisor metrics that aren't measured in seconds
-seriesQuery: '{__name__=~"^container_.*_total",container_name!="POD",namespace!="",pod_name!=""}'
-seriesFilters:
-  isNot: "^container_.*_seconds_total"
-```
-
-### Association
-
-Association governs the process of figuring out which Kubernetes resources
-a particular metric could be attached to.  The `resources` field controls
-this process.
-
-There are two ways to associate resources with a particular metric.  In
-both cases, the value of the label becomes the name of the particular
-object.
-
-One way is to specify that any label name that matches some particular
-pattern refers to some group-resource based on the label name.  This can
-be done using the `template` field.   The pattern is specified as a Go
-template, with the `Group` and `Resource` fields representing group and
-resource. You don't necessarily have to use the `Group` field (in which
-case the group is guessed by the system). For instance:
-
-```yaml
-# any label `kube_<group>_<resource>` becomes <group>.<resource> in Kubernetes
-resources:
-  template: "kube_<<.Group>>_<<.Resource>>"
-```
-
-The other way is to specify that some particular label represents some
-particular Kubernetes resource.  This can be done using the `overrides`
-field.  Each override maps a Prometheus label to a Kubernetes
-group-resource. For instance:
-
-```yaml
-# the microservice label corresponds to the apps.deployment resource
-resource:
-  overrides:
-    microservice: {group: "apps", resource: "deployment"}
-```
-
-These two can be combined, so you can specify both a template and some
-individual overrides.
-
-The resources mentioned can be any resource available in your kubernetes
-cluster, as long as you've got a corresponding label.
-
-### Naming
-
-Naming governs the process of converting a Prometheus metric name into
-a metric in the custom metrics API, and vice versa.  It's controlled by
-the `name` field.
-
-Naming is controlled by specifying a pattern to extract an API name from
-a Prometheus name, and potentially a transformation on that extracted
-value.
-
-The pattern is specified in the `matches` field, and is just a regular
-expression.  If not specified, it defaults to `.*`.
-
-The transformation is specified by the `as` field.  You can use any
-capture groups defined in the `matches` field.  If the `matches` field
-doesn't contain capture groups, the `as` field defaults to `$0`.  If it
-contains a single capture group, the `as` field defautls to `$1`.
-Otherwise, it's an error not to specify the as field.
-
-For example:
-
-```yaml
-# match turn any name <name>_total to <name>_per_second
-# e.g. http_requests_total becomes http_requests_per_second
-name:
-  matches: "^(.*)_total$"
-  as: "${1}_per_second"
-```
-
-### Querying
-
-Querying governs the process of actually fetching values for a particular
-metric.  It's controlled by the `metricsQuery` field.
-
-The `metricsQuery` field is a Go template that gets turned into
-a Prometheus query, using input from a particular call to the custom
-metrics API. A given call to the custom metrics API is distilled down to
-a metric name, a group-resource, and one or more objects of that
-group-resource.  These get turned into the following fields in the
-template:
-
-- `Series`: the metric name
-- `LabelMatchers`: a comma-separated list of label matchers matching the
-  given objects.  Currently, this is the label for the particular
-  group-resource, plus the label for namespace, if the group-resource is
-  namespaced.
-- `GroupBy`: a comma-separated list of labels to group by.  Currently,
-  this contains the group-resource label used in `LabelMatchers`.
-
-For instance, suppose we had a series `http_requests_total` (exposed as
-`http_requests_per_second` in the API) with labels `service`, `pod`,
-`ingress`, `namespace`, and `verb`. The first four correspond to
-Kubernetes resources.  Then, if someone requested the metric
-`pods/http_request_per_second` for the pods `pod1` and `pod2` in the
-`somens` namespace, we'd have:
-
-- `Series: "http_requests_total"`
-- `LabelMatchers: "pod=~\"pod1|pod2",namespace="somens"`
-- `GroupBy`: `pod`
-
-Additionally, there are two advanced fields that are "raw" forms of other
-fields:
-
-- `LabelValuesByName`: a map mapping the labels and values from the
-  `LabelMatchers` field.  The values are pre-joined by `|`
-  (for used with the `=~` matcher in Prometheus).
-- `GroupBySlice`: the slice form of `GroupBy`.
-
-In general, you'll probably want to use the `Series`, `LabelMatchers`, and
-`GroupBy` fields.  The other two are for advanced usage.
-
-The query is expected to return one value for each object requested.  The
-adapter will use the labels on the returned series to associate a given
-series back to its corresponding object.
-
-For example:
-
-```yaml
-# convert cumulative cAdvisor metrics into rates calculated over 2 minutes
-metricsQuery: "sum(rate(<<.Series>>{<<.LabelMatchers>>,container_name!="POD"}[2m])) by (<<.GroupBy>>)"
-```
diff --git a/content/rancher/v2.5/en/monitoring/legacy/monitoring/prometheus/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/prometheus/_index.md
deleted file mode 100644
index 9325c12a9eb..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/monitoring/prometheus/_index.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-title: Prometheus Configuration
-weight: 1
----
-
-While configuring monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), there are multiple options that can be configured.
-
-Option | Description
--------|-------------
-Data Retention | How long your Prometheus instance retains monitoring data scraped from Rancher objects before it's purged.
-[Enable Node Exporter](#node-exporter) | Whether or not to deploy the node exporter.
-Node Exporter Host Port | The host port on which data is exposed, i.e. data that Prometheus collects from your node hardware. Required if you have enabled the node exporter.
-[Enable Persistent Storage](#persistent-storage) for Prometheus | Whether or not to configure storage for Prometheus so that metrics can be retained even if the Prometheus pod fails.
-[Enable Persistent Storage](#persistent-storage) for Grafana | Whether or not to configure storage for Grafana so that the Grafana dashboards and configuration  can be retained even if the Grafana pod fails.
-Prometheus [CPU Limit](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu) |  CPU resource limit for the Prometheus pod.
-Prometheus [CPU Reservation](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-cpu) | CPU reservation for the Prometheus pod.
-Prometheus [Memory Limit](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory) | Memory resource limit for the Prometheus pod.
-Prometheus [Memory Reservation](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#meaning-of-memory) | Memory resource requests for the Prometheus pod.
-Selector | Ability to select the nodes in which Prometheus and Grafana pods are deployed to. To use this option, the nodes must have labels.
-Advanced Options | Since monitoring is an [application](https://github.com/rancher/system-charts/tree/dev/charts/rancher-monitoring) from the [Rancher catalog]({{<baseurl>}}/rancher/v2.x/en/catalog/), it can be [configured like other catalog application]({{<baseurl>}}/rancher/v2.x/en/catalog/apps/#configuration-options). _Warning: Any modification to the application without understanding the entire application can lead to catastrophic errors._
-
-## Node Exporter
-
-The [node exporter](https://github.com/prometheus/node_exporter/blob/master/README.md) is a popular open source exporter, which exposes the metrics for hardware and \*NIX kernels OS. It is designed to monitor the host system. However, there are still issues with namespaces when running it in a container, mostly around filesystem mount spaces. In order to monitor actual network metrics for the container network, the node exporter must be deployed with the `hostNetwork` mode.
-
-When configuring Prometheus and enabling the node exporter, enter a host port in the **Node Exporter Host Port** that will not produce port conflicts with existing applications. The host port chosen must be open to allow internal traffic between Prometheus and the Node Exporter.
-
->**Warning:** In order for Prometheus to collect the metrics of the node exporter, after enabling cluster monitoring, you must open the <b>Node Exporter Host Port</b> in the host firewall rules to allow intranet access. By default, `9796` is used as that host port.
-
-## Persistent Storage
-
->**Prerequisite:** Configure one or more [storage class]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#adding-storage-classes) to use as [persistent storage]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) for your Prometheus or Grafana pod.
-
-By default, when you enable Prometheus for either a cluster or project, all monitoring data that Prometheus collects is stored on its own pod. With local storage, if the Prometheus or Grafana pods fail, all the data is lost. Rancher recommends configuring an external persistent storage to the cluster. With the external persistent storage, if the Prometheus or Grafana pods fail, the new pods can recover using data from the persistent storage.
-
-When enabling persistent storage for Prometheus or Grafana, specify the size of the persistent volume and select the [storage class]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/#storage-classes).
-
-## Remote Storage
-
->**Prerequisite:** Need a remote storage endpoint to be available. The possible list of integrations is available [here](https://prometheus.io/docs/operating/integrations/)
-
-Using advanced options, remote storage integration for the Prometheus installation can be configured as follows:
-
-```
-prometheus.remoteWrite[0].url = http://remote1/push
-prometheus.remoteWrite[0].remoteTimeout = 33s
-
-prometheus.remoteWrite[1].url = http://remote2/push
-
-
-prometheus.remoteRead[0].url = http://remote1/read
-prometheus.remoteRead[0].proxyUrl = http://proxy.url
-prometheus.remoteRead[0].bearerToken = token-value
-
-prometheus.remoteRead[1].url = http://remote2/read
-prometheus.remoteRead[1].remoteTimeout = 33s
-prometheus.remoteRead[1].readRecent = true
-```
-
-Additional fields can be set up based on the [ReadSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotereadspec) and [RemoteWriteSpec](https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#remotewritespec)
diff --git a/content/rancher/v2.5/en/monitoring/legacy/monitoring/viewing-metrics/_index.md b/content/rancher/v2.5/en/monitoring/legacy/monitoring/viewing-metrics/_index.md
deleted file mode 100644
index 412ead2d7b5..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/monitoring/viewing-metrics/_index.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: Viewing Metrics
-weight: 2
----
-
-After you've enabled monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), you will want to be start viewing the data being collected. There are multiple ways to view this data.
-
-## Rancher Dashboard
-
->**Note:** This is only available if you've enabled monitoring at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring). Project specific analytics must be viewed using the project's Grafana instance.
-
-Rancher's dashboards are available at multiple locations:
-
-- **Cluster Dashboard**: From the **Global** view, navigate to the cluster.
-- **Node Metrics**: From the **Global** view, navigate to the cluster. Select **Nodes**. Find the individual node and click on its name. Click **Node Metrics.**
-- **Workload Metrics**: From the **Global** view, navigate to the project. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Find the individual workload and click on its name. Click **Workload Metrics.**
-- **Pod Metrics**: From the **Global** view, navigate to the project. Select **Workloads > Workloads**. Find the individual workload and click on its name. Find the individual pod and click on its name. Click **Pod Metrics.**
-- **Container Metrics**: From the **Global** view, navigate to the project. From the main navigation bar, choose **Resources > Workloads.** (In versions prior to v2.3.0, choose **Workloads** on the main navigation bar.) Find the individual workload and click on its name. Find the individual pod and click on its name. Find the individual container and click on its name. Click **Container Metrics.**
-
-Prometheus metrics are displayed and are denoted with the Grafana icon. If you click on the icon, the metrics will open a new tab in Grafana.
-
-Within each Prometheus metrics widget, there are several ways to customize your view.
-
-- Toggle between two views:
-  - **Detail**: Displays graphs and charts that let you view each event in a Prometheus time series
-  - **Summary** Displays events in a Prometheus time series that are outside the norm.
-- Change the range of the time series that you're viewing to see a more refined or expansive data sample.
-- Customize the data sample to display data between specific dates and times.
-
-When analyzing these metrics, don't be concerned about any single standalone metric in the charts and graphs. Rather, you should establish a baseline for your metrics over the course of time, e.g. the range of values that your components usually operate within and are considered normal. After you establish the baseline, be on the lookout for any large deltas in the charts and graphs, as these big changes usually indicate a problem that you need to investigate.
-
-## Grafana
-
-If you've enabled monitoring at either the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring) or [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/#enabling-project-monitoring), Rancher automatically creates a link to Grafana instance. Use this link to view monitoring data.
-
-Grafana allows you to query, visualize, alert, and ultimately, understand your cluster and workload data. For more information on Grafana and its capabilities, visit the [Grafana website](https://grafana.com/grafana).
-
-### Authentication
-
-Rancher determines which users can access the new Grafana instance, as well as the objects they can view within it, by validating them against the user's [cluster or project roles]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/). In other words, a user's access in Grafana mirrors their access in Rancher.
-
-When you go to the Grafana instance, you will be logged in with the username `admin` and the password `admin`. If you log out and log in again, you will be prompted to change your password. You will only have access to the URL of the Grafana instance if you have access to view the corresponding metrics in Rancher. So for example, if your Rancher permissions are scoped to the project level, you won't be able to see the Grafana instance for cluster-level metrics.
-
-### Accessing the Cluster-level Grafana Instance
-
-1. From the **Global** view, navigate to a cluster that has monitoring enabled.
-
-1. Go to the **System** project view. This project is where the cluster-level Grafana instance runs.
-
-1. Click **Apps.** In versions prior to v2.2.0, choose **Catalog Apps** on the main navigation bar.
-
-1. Go to the `cluster-monitoring` application.
-
-1. In the `cluster-monitoring` application, there are two `/index.html` links: one that leads to a Grafana instance and one that leads to a Prometheus instance. When you click the Grafana link, it will redirect you to a new webpage for Grafana, which shows metrics for the cluster.
-
-1. You will be signed in to the Grafana instance automatically. The default username is `admin` and the default password is `admin`. For security, we recommend that you log out of Grafana, log back in with the `admin` password, and change your password.
-
-**Results:** You are logged into Grafana from the Grafana instance. After logging in, you can view the preset Grafana dashboards, which are imported via the [Grafana provisioning mechanism](http://docs.grafana.org/administration/provisioning/#dashboards), so you cannot modify them directly. For now, if you want to configure your own dashboards, clone the original and modify the new copy.
diff --git a/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md b/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
deleted file mode 100644
index e4f4ea96403..00000000000
--- a/content/rancher/v2.5/en/monitoring/legacy/notifiers/_index.md
+++ /dev/null
@@ -1,130 +0,0 @@
----
-title: Notifiers
-weight: 11
----
-
-Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action.
-
-Rancher integrates with a variety of popular IT services, including:
-
-- **Slack**: Send alert notifications to your Slack channels.
-- **Email**: Choose email recipients for alert notifications.
-- **PagerDuty**: Route notifications to staff by phone, SMS, or personal email.
-- **WebHooks**: Update a webpage with alert notifications.
-- **WeChat**: Send alert notifications to your Enterprise WeChat contacts.
-
-This section covers the following topics:
-
-- [Roles-based access control for notifiers](#roles-based-access-control-for-notifiers)
-- [Adding notifiers](#adding-notifiers)
-- [Managing notifiers](#managing-notifiers)
-- [Example payload for a webhook alert notifier](#example-payload-for-a-webhook-alert-notifier)
-
-### Roles-based Access Control for Notifiers
-
-Notifiers are configured at the cluster level. This model ensures that only cluster owners need to configure notifiers, leaving project owners to simply configure alerts in the scope of their projects. You don't need to dispense privileges like SMTP server access or cloud account access.
-
-### Adding Notifiers
-
-Set up a notifier so that you can begin configuring and sending alerts.
-
-1. From the **Global View**, open the cluster that you want to add a notifier.
-
-1. From the main menu, select **Tools > Notifiers**. Then click **Add Notifier**.
-
-1. Select the service you want to use as your notifier, and then fill out the form.
-{{% accordion id="slack" label="Slack" %}}
-1. Enter a **Name** for the notifier.
-1. From Slack, create a webhook. For instructions, see the [Slack Documentation](https://get.slack.help/hc/en-us/articles/115005265063-Incoming-WebHooks-for-Slack).
-1. From Rancher, enter your Slack webhook **URL**.
-1. Enter the name of the channel that you want to send alert notifications in the following format: `#<channelname>`.
-
-    Both public and private channels are supported.
-1. Click **Test**. If the test is successful, the Slack channel you're configuring for the notifier outputs `Slack setting validated`.
-{{% /accordion %}}
-{{% accordion id="email" label="Email" %}}
-1. Enter a **Name** for the notifier.
-1. In the **Sender** field, enter an email address available on your mail server that you want to send the notification.
-1. In the **Host** field, enter the IP address or hostname for your SMTP server. Example: `smtp.email.com`
-1. In the **Port** field, enter the port used for email. Typically, TLS uses `587` and SSL uses `465`. If you're using TLS, make sure **Use TLS** is selected.
-1. Enter a **Username** and **Password** that authenticate with the SMTP server.
-1. In the **Default Recipient** field, enter the email address that you want to receive the notification.
-1. Click **Test**. If the test is successful, Rancher prints `settings validated` and you receive a test notification email.
-{{% /accordion %}}
-{{% accordion id="pagerduty" label="PagerDuty" %}}
-1. Enter a **Name** for the notifier.
-1. From PagerDuty, create a Prometheus integration. For instructions, see the [PagerDuty Documentation](https://www.pagerduty.com/docs/guides/prometheus-integration-guide/).
-1. From PagerDuty, copy the integration's **Integration Key**.
-1. From Rancher, enter the key in the **Service Key** field.
-1. Click **Test**. If the test is successful, your PagerDuty endpoint outputs `PagerDuty setting validated`.
-{{% /accordion %}}
-{{% accordion id="webhook" label="WebHook" %}}
-1. Enter a **Name** for the notifier.
-1. Using the app of your choice, create a webhook URL.
-1. Enter your webhook **URL**.
-1. Click **Test**. If the test is successful, the URL you're configuring as a notifier outputs `Webhook setting validated`.
-{{% /accordion %}}
-{{% accordion id="WeChat" label="WeChat" %}}
-
-1. Enter a **Name** for the notifier.
-1. In the **Corporation ID** field, enter the "EnterpriseID" of your corporation, you could get it from [Profile page](https://work.weixin.qq.com/wework_admin/frame#profile).
-1. From Enterprise WeChat, create an application in the [Application page](https://work.weixin.qq.com/wework_admin/frame#apps), and then enter the "AgentId" and "Secret" of this application to the **Application Agent ID** and **Application Secret** fields.
-1. Select the **Recipient Type** and then enter a corresponding id to **Default Recipient** field, for example, the party id, tag id or user account that you want to receive the notification. You could get contact information from [Contacts page](https://work.weixin.qq.com/wework_admin/frame#contacts).
-{{% /accordion %}}
-
-1. Select **Enable** for **Send Resolved Alerts** if you wish to notify about resolved alerts.
-1. Click **Add** to complete adding the notifier.
-
-**Result:** Your notifier is added to Rancher.
-
-
-### Managing Notifiers
-
-After you set up notifiers, you can manage them. From the **Global** view, open the cluster that you want to manage your notifiers. Select **Tools > Notifiers**. You can:
-
-- **Edit** their settings that you configured during their initial setup.
-- **Clone** them, to quickly setup slightly different notifiers.
-- **Delete** them when they're no longer necessary.
-
-### Example Payload for a Webhook Alert Notifier
-
-```json
-{
-  "receiver": "c-2a3bc:kube-components-alert",
-  "status": "firing",
-  "alerts": [
-    {
-      "status": "firing",
-      "labels": {
-        "alert_name": "Scheduler is unavailable",
-        "alert_type": "systemService",
-        "cluster_name": "mycluster (ID: c-2a3bc)",
-        "component_name": "scheduler",
-        "group_id": "c-2a3bc:kube-components-alert",
-        "logs": "Get http://127.0.0.1:10251/healthz: dial tcp 127.0.0.1:10251: connect: connection refused",
-        "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service",
-        "severity": "critical"
-      },
-      "annotations": {},
-      "startsAt": "2020-01-30T19:18:13.321684733Z",
-      "endsAt": "0001-01-01T00:00:00Z",
-      "generatorURL": ""
-    }
-  ],
-  "groupLabels": {
-    "component_name": "scheduler",
-    "rule_id": "c-2a3bc:kube-components-alert_scheduler-system-service"
-  },
-  "commonLabels": {
-    "alert_name": "Scheduler is unavailable",
-    "alert_type": "systemService",
-    "cluster_name": "mycluster (ID: c-2a3bc)"
-  }
-}
-```
-### What's Next?
-
-After creating a notifier, set up alerts to receive notifications of Rancher system events.
-
-- [Cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) can set up alerts at the [cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/).
-- [Project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can set up alerts at the [project level]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/).
diff --git a/content/rancher/v2.5/en/opa-gatekeper/_index.md b/content/rancher/v2.5/en/opa-gatekeper/_index.md
deleted file mode 100644
index cd78f7c4a1d..00000000000
--- a/content/rancher/v2.5/en/opa-gatekeper/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: OPA Gatekeeper
-weight: 12
----
-
-> This page is under construction.
diff --git a/content/rancher/v2.5/en/opa-gatekeper/legacy/_index.md b/content/rancher/v2.5/en/opa-gatekeper/legacy/_index.md
deleted file mode 100644
index 55103e52eb9..00000000000
--- a/content/rancher/v2.5/en/opa-gatekeper/legacy/_index.md
+++ /dev/null
@@ -1,94 +0,0 @@
----
-title: Legacy UI Docs
-weight: 2
----
-
-To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. 
-
-OPA provides a high-level declarative language that lets you specify policy as code and ability to extend simple APIs to offload policy decision-making.
-
-[OPA Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is a project that provides integration between OPA and Kubernetes. OPA Gatekeeper provides:
-
-- An extensible, parameterized policy library.
-- Native Kubernetes CRDs for instantiating the policy library, also called “constraints."
-- Native Kubernetes CRDs for extending the policy library, also called "constraint templates."
-- Audit functionality.
-
-To read more about OPA, please refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/)
-
-# How the OPA Gatekeeper Integration Works
-
-Kubernetes provides the ability to extend API server functionality via admission controller webhooks, which are invoked whenever a resource is created, updated or deleted. Gatekeeper is installed as a validating webhook and enforces policies defined by Kubernetes custom resource definitions. In addition to the admission control usage, Gatekeeper provides the capability to audit existing resources in Kubernetes clusters and mark current violations of enabled policies.
-
-OPA Gatekeeper is made availale via Rancher's Helm system chart, and it is installed in a namespace named `gatekeeper-system.`
-
-# Enabling OPA Gatekeeper in a Cluster
-
-> **Prerequisites:** 
-> 
-> - Only administrators and cluster owners can enable OPA Gatekeeper.
-> - The dashboard needs to be enabled using the `dashboard` feature flag. For more information, refer to the [section on enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
-
-1. Navigate to the cluster's **Dashboard** view.
-1. On the left side menu, expand the cluster menu and click on **OPA Gatekeeper.**
-1. To install Gatekeeper with the default configuration, click on **Enable Gatekeeper (v0.1.0) with defaults.**
-1. To change any default configuration, click on **Customize Gatekeeper yaml configuration.**
-      
-# Constraint Templates
-
-[Constraint templates](https://github.com/open-policy-agent/gatekeeper#constraint-templates) are Kubernetes custom resources that define the schema and Rego logic of the OPA policy to be applied by Gatekeeper. For more information on the Rego policy language, refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/policy-language/)
-
-When OPA Gatekeeper is enabled, Rancher installs some templates by default.
-
-To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates.**
-
-Rancher also provides the ability to create your own constraint templates by importing YAML definitions.
-   
-# Creating and Configuring Constraints
-
-[Constraints](https://github.com/open-policy-agent/gatekeeper#constraints) are Kubernetes custom resources that define the scope of objects to which a specific constraint template applies to. The complete policy is defined by constraint templates and constraints together.
-
-> **Prerequisites:** OPA Gatekeeper must be enabled in the cluster.
-
-To list the constraints installed, go to the left side menu under OPA Gatekeeper, and click on **Constraints.**
-
-New constraints can be created from a constraint template.
-
-Rancher provides the ability to create a constraint by using a convenient form that lets you input the various constraint fields.
-
-The **Edit as yaml** option is also availble to configure the the constraint's yaml definition.
-
-### Exempting Rancher's System Namespaces from Constraints
-
-When a constraint is created, ensure that it does not apply to any Rancher or Kubernetes system namespaces. If the system namespaces are not excluded, then it is possible to see many resources under them marked as violations of the constraint.
-
-To limit the scope of the constraint only to user namespaces, always specify these namespaces under the **Match** field of the constraint.
-
-Also, the constraint may interfere with other Rancher functionality and deny system workloads from being deployed. To avoid this, exclude all Rancher-specific namespaces from your constraints.
-   
-# Enforcing Constraints in your Cluster
-
-When the **Enforcement Action** is **Deny,** the constraint is immediately enabled and will deny any requests that violate the policy defined. By default, the enforcement value is **Deny.**
-
-When the **Enforcement Action** is **Dryrun,** then any resources that violate the policy are only recorded under the constraint's status field.
-
-To enforce constraints, create a constraint using the form. In the **Enforcement Action** field, choose **Deny.** 
-
-# Audit and Violations in your Cluster
-
-OPA Gatekeeper runs a periodic audit to check if any existing resource violates any enforced constraint. The audit-interval (default 300s) can be configured while installing Gatekeeper.
-
-On the Gatekeeper page, any violations of the defined constraints are listed.
-
-Also under **Constraints,** the number of violations of the constraint can be found.
-
-The detail view of each constraint lists information about the resource that violated the constraint.
-
-# Disabling Gatekeeper
-
-1. Navigate to the cluster's Dashboard view
-1. On the left side menu, expand the cluster menu and click on **OPA Gatekeeper.**
-1. Click the **&#8942; > Disable**.
-
-**Result:** Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted.
-
diff --git a/content/rancher/v2.5/en/overview/_index.md b/content/rancher/v2.5/en/overview/_index.md
deleted file mode 100644
index 5a40167303b..00000000000
--- a/content/rancher/v2.5/en/overview/_index.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: Overview
-weight: 1
----
-
-> This page is under construction.
-
-Rancher is a container management platform built for organizations that deploy containers in production. Rancher makes it easy to run Kubernetes everywhere, meet IT requirements, and empower DevOps teams.
-
-# Run Kubernetes Everywhere
-
-Kubernetes has become the container orchestration standard. Most cloud and virtualization vendors now offer it as standard infrastructure. Rancher users have the choice of creating Kubernetes clusters with Rancher Kubernetes Engine (RKE) or cloud Kubernetes services, such as GKE, AKS, and EKS. Rancher users can also import and manage their existing Kubernetes clusters created using any Kubernetes distribution or installer.
-
-# Meet IT requirements
-
-Rancher supports centralized authentication, access control, and monitoring for all Kubernetes clusters under its control. For example, you can:
-
-- Use your Active Directory credentials to access Kubernetes clusters hosted by cloud vendors, such as GKE.
-- Setup and enforce access control and security policies across all users, groups, projects, clusters, and clouds.
-- View the health and capacity of your Kubernetes clusters from a single-pane-of-glass.
-
-# Empower DevOps Teams
-
-Rancher provides an intuitive user interface for DevOps engineers to manage their application workload. The user does not need to have in-depth knowledge of Kubernetes concepts to start using Rancher. Rancher catalog contains a set of useful DevOps tools. Rancher is certified with a wide selection of cloud native ecosystem products, including, for example, security tools, monitoring systems, container registries, and storage and networking drivers.
-
-The following figure illustrates the role Rancher plays in IT and DevOps organizations. Each team deploys their applications on the public or private clouds they choose. IT administrators gain visibility and enforce policies across all users, clusters, and clouds.
-
-![Platform]({{<baseurl>}}/img/rancher/platform.png)
-
-# Features of the Rancher API Server
-
-The Rancher API server is built on top of an embedded Kubernetes API server and an etcd database. It implements the following functionalities:
-
-### Authorization and Role-Based Access Control
-
--  **User management:** The Rancher API server [manages user identities]({{<baseurl>}}/rancher/v2.x/en/admin-settings/authentication/) that correspond to external authentication providers like Active Directory or GitHub, in addition to local users.
--	**Authorization:** The Rancher API server manages [access control]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/) and [security]({{<baseurl>}}/rancher/v2.x/en/admin-settings/pod-security-policies/) policies.
-
-### Working with Kubernetes
-
-- **Provisioning Kubernetes clusters:** The Rancher API server can [provision Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/) on existing nodes, or perform [Kubernetes upgrades.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/upgrading-kubernetes)
-- **Catalog management:** Rancher provides the ability to use a [catalog of Helm charts]({{<baseurl>}}/rancher/v2.x/en/catalog/) that make it easy to repeatedly deploy applications.
-- **Managing projects:** A project is a group of multiple namespaces and access control policies within a cluster. A project is a Rancher concept, not a Kubernetes concept, which allows you manage multiple namespaces as a group and perform Kubernetes operations in them. The Rancher UI provides features for [project administration]({{<baseurl>}}/rancher/v2.x/en/project-admin/) and for [managing applications within projects.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/)
-- **Pipelines:** Setting up a [pipeline]({{<baseurl>}}/rancher/v2.x/en/project-admin/pipelines/) can help developers deliver new software as quickly and efficiently as possible. Within Rancher, you can configure pipelines for each of your Rancher projects.
-- **Istio:** Our [integration with Istio]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/) is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
-
-### Working with Cloud Infrastructure
-
--  **Tracking nodes:** The Rancher API server tracks identities of all the [nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes/) in all clusters.
-- **Setting up infrastructure:**  When configured to use a cloud provider, Rancher can dynamically provision [new nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/) and [persistent storage]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) in the cloud.
-
-### Cluster Visibility
-
-- **Logging:** Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters. Logging can be set up [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/logging/)
-- **Monitoring:** Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with Prometheus, a leading open-source monitoring solution. Monitoring can be configured [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/monitoring/) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/monitoring/)
-- **Alerting:** To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. To help you stay informed of these events, you can configure alerts [at the cluster level]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/) or [at the project level.]({{<baseurl>}}/rancher/v2.x/en/project-admin/tools/alerts/)
-
-# Editing Downstream Clusters with Rancher
-
-The options and settings available for an existing cluster change based on the method that you used to provision it. For example, only clusters [provisioned by RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) have **Cluster Options** available for editing.
-
-After a cluster is created with Rancher, a cluster administrator can manage cluster membership, enable pod security policies, and manage node pools, among [other options.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/)
-
-The following table summarizes the options and settings available for each cluster type:
-
-{{% include file="/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table" %}}
diff --git a/content/rancher/v2.5/en/overview/architecture/_index.md b/content/rancher/v2.5/en/overview/architecture/_index.md
deleted file mode 100644
index 8087bcc74a4..00000000000
--- a/content/rancher/v2.5/en/overview/architecture/_index.md
+++ /dev/null
@@ -1,203 +0,0 @@
----
-title: Architecture
-weight: 1
----
-
-> This page is under construction.
-
-This section focuses on the Rancher server, its components, and how Rancher communicates with downstream Kubernetes clusters.
-
-> This section assumes a basic familiarity with Docker and Kubernetes. For a brief explanation of how Kubernetes components work together, refer to the [concepts]({{<baseurl>}}/rancher/v2.x/en/overview/concepts) page.
-
-This section covers the following topics:
-
-- [Components](#components)
-- [Installation](#installation)
-- [Features](#features)
-- [Infrastructure](#infrastructure)
-- [Architecture of the Enterprise Cluster Manager](#architecture-of-the-enterprise-cluster-manager)
-- [Communicating with downstream user clusters](#communicating-with-downstream-user-clusters)
-  - [The authentication proxy](#1-the-authentication-proxy)
-  - [Cluster controllers and cluster agents](#2-cluster-controllers-and-cluster-agents)
-  - [Node agents](#3-node-agents)
-  - [Authorized cluster endpoint](#4-authorized-cluster-endpoint)
-- [Important files](#important-files)
-- [Tools for provisioning Kubernetes clusters](#tools-for-provisioning-kubernetes-clusters)
-- [Rancher server components and source code](#rancher-server-components-and-source-code)
-
-# Components
-
-Rancher comes with to main components: the Rancher Helm chart, which is used for installing Rancher on a Kubernetes cluster, and the Rancher CLI. The CLI allows you to easily provision a Kubernetes cluster if you don't already have a cluster to install Rancher.
-
-
-# Installation
-
-There are two main ways that Rancher can be installed:
-
-1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
-2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
-
-The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
-
-# Features
-
-Rancher 2.5 allows many optional features to be enabled, including logging, monitoring, Istio, and the Enterprise Cluster Manager.
-
-For a list of main features of the Rancher API server, refer to the [overview section.]({{<baseurl>}}/rancher/v2.x/en/overview/#features-of-the-rancher-api-server)
-
-# Infrastructure
-
-For guidance about setting up the underlying infrastructure for the Rancher server, refer to the [architecture recommendations.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations)
-
-# Architecture of the Enterprise Cluster Manager
-
-The Enterprise Cluster Manager is an optional feature in Rancher. When enabled, it allows Rancher to centralize the authentication and management of multiple Kubernetes clusters.
-
-The majority of Rancher 2.x software runs on the Rancher Server. Rancher Server includes all the software components used to manage the entire Rancher deployment.
-
-The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two downstream Kubernetes clusters: one created by RKE and another created by Amazon EKS (Elastic Kubernetes Service).
-
-For the best performance and security, we recommend a dedicated Kubernetes cluster for the Rancher management server. Running user workloads on this cluster is not advised. After deploying Rancher, you can [create or import clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) for running your workloads.
-
-The diagram below shows how users can manipulate both [Rancher-launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters and [hosted Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) clusters through Rancher's authentication proxy:
-
-<figcaption>Managing Kubernetes Clusters through Rancher's Authentication Proxy</figcaption>
-
-![Architecture]({{<baseurl>}}/img/rancher/rancher-architecture-rancher-api-server.svg)
-
-You can install Rancher on a single node, or on a high-availability Kubernetes cluster.
-
-A high-availability Kubernetes installation is recommended for production. A Docker installation may be used for development and testing purposes, but there is no migration path from a single-node to a high-availability installation. Therefore, you may want to use a Kubernetes installation from the start.
-
-The Rancher server, regardless of the installation method, should always run on nodes that are separate from the downstream user clusters that it manages. If Rancher is installed on a high-availability Kubernetes cluster, it should run on a separate cluster from the cluster(s) it manages.
-
-# Communicating with Downstream User Clusters
-
-This section describes how Rancher provisions and manages the downstream user clusters that run your apps and services.
-
-The below diagram shows how the cluster controllers, cluster agents, and node agents allow Rancher to control downstream clusters.
-
-<figcaption>Communicating with Downstream Clusters</figcaption>
-
-![Rancher Components]({{<baseurl>}}/img/rancher/rancher-architecture-cluster-controller.svg)
-
-The following descriptions correspond to the numbers in the diagram above:
-
-1. [The Authentication Proxy](#1-the-authentication-proxy)
-2. [Cluster Controllers and Cluster Agents](#2-cluster-controllers-and-cluster-agents)
-3. [Node Agents](#3-node-agents)
-4. [Authorized Cluster Endpoint](#4-authorized-cluster-endpoint)
-
-### 1. The Authentication Proxy
-
-In this diagram, a user named Bob wants to see all pods running on a downstream user cluster called User Cluster 1. From within Rancher, he can run a `kubectl` command to see
-the pods. Bob is authenticated through Rancher's authentication proxy.
-
-The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters.
-
-Rancher communicates with Kubernetes clusters using a [service account,](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) which provides an identity for processes that run in a pod.
-
-By default, Rancher generates a [kubeconfig file]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`kube_config_rancher-cluster.yml`) contains full access to the cluster.
-
-### 2. Cluster Controllers and Cluster Agents
-
-Each downstream user cluster has a cluster agent, which opens a tunnel to the corresponding cluster controller within the Rancher server.
-
-There is one cluster controller and one cluster agent for each downstream cluster. Each cluster controller:
-
-- Watches for resource changes in the downstream cluster
-- Brings the current state of the downstream cluster to the desired state
--  Configures access control policies to clusters and projects
--  Provisions clusters by calling the required Docker machine drivers and Kubernetes engines, such as RKE and GKE
-
-By default, to enable Rancher to communicate with a downstream cluster, the cluster controller connects to the cluster agent. If the cluster agent is not available, the cluster controller can connect to a [node agent](#3-node-agents) instead.
-
-The cluster agent, also called `cattle-cluster-agent`, is a component that runs in a downstream user cluster. It performs the following tasks:
-
--  Connects to the Kubernetes API of Rancher-launched Kubernetes clusters
-- Manages workloads, pod creation and deployment within each cluster
--  Applies the roles and bindings defined in each cluster's global policies
-- Communicates between the cluster and Rancher server (through a tunnel to the cluster controller) about events, stats, node info, and health
-
-### 3. Node Agents
-
-If the cluster agent (also called `cattle-cluster-agent`) is not available, one of the node agents creates a tunnel to the cluster controller to communicate with Rancher.
-
-The `cattle-node-agent` is deployed using a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) resource to make sure it runs on every node in a Rancher-launched Kubernetes cluster. It is used to interact with the nodes when performing cluster operations. Examples of cluster operations include upgrading the Kubernetes version and creating or restoring etcd snapshots.
-
-### 4. Authorized Cluster Endpoint
-
-An authorized cluster endpoint allows users to connect to the Kubernetes API server of a downstream cluster without having to route their requests through the Rancher authentication proxy.
-
-> The authorized cluster endpoint only works on Rancher-launched Kubernetes clusters. In other words, it only works in clusters where Rancher [used RKE]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters) to provision the cluster. It is not available for imported clusters, or for clusters in a hosted Kubernetes provider, such as Amazon's EKS.
-
-There are two main reasons why a user might need the authorized cluster endpoint:
-
-- To access a downstream user cluster while Rancher is down
-- To reduce latency in situations where the Rancher server and downstream cluster are separated by a long distance
-
-The `kube-api-auth` microservice is deployed to provide the user authentication functionality for the authorized cluster endpoint. When you access the user cluster using `kubectl`, the cluster's Kubernetes API server authenticates you by using the `kube-api-auth` service as a webhook.
-
-Like the authorized cluster endpoint, the `kube-api-auth` authentication service is also only available for Rancher-launched Kubernetes clusters.
-
-> **Example scenario:** Let's say that the Rancher server is located in the United States, and User Cluster 1 is located in Australia. A user, Alice, also lives in Australia. Alice can manipulate resources in User Cluster 1 by using the Rancher UI, but her requests will have to be sent from Australia to the Rancher server in the United States, then be proxied back to Australia, where the downstream user cluster is. The geographical distance may cause significant latency, which Alice can reduce by using the authorized cluster endpoint.
-
-With this endpoint enabled for the downstream cluster, Rancher generates an extra Kubernetes context in the kubeconfig file in order to connect directly to the cluster. This file has the credentials for `kubectl` and `helm`. 
-
-You will need to use a context defined in this kubeconfig file to access the cluster if Rancher goes down. Therefore, we recommend exporting the kubeconfig file so that if Rancher goes down, you can still use the credentials in the file to access your cluster. For more information, refer to the section on accessing your cluster with [kubectl and the kubeconfig file.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl)
-
-# Important Files
-
-The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster:
-
-- `rancher-cluster.yml`: The RKE cluster configuration file.
-- `kube_config_rancher-cluster.yml`: The Kubeconfig file for the cluster, this file contains credentials for full access to the cluster. You can use this file to authenticate with a Rancher-launched Kubernetes cluster if Rancher goes down.
-- `rancher-cluster.rkestate`: The Kubernetes cluster state file. This file contains credentials for full access to the cluster. Note: This state file is only created when using RKE v0.2.0 or higher.
-
-> **Note:** The "rancher-cluster" parts of the two latter file names are dependent on how you name the RKE cluster configuration file.
-
-For more information on connecting to a cluster without the Rancher authentication proxy and other configuration options, refer to the [kubeconfig file]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) documentation.
-
-# Tools for Provisioning Kubernetes Clusters
-
-The tools that Rancher uses to provision downstream user clusters depends on the type of cluster that is being provisioned.
-
-### Rancher Launched Kubernetes for Nodes Hosted in an Infrastructure Provider
-
-Rancher can dynamically provision nodes in a provider such as Amazon EC2, DigitalOcean, Azure, or vSphere, then install Kubernetes on them.
-
-Rancher provisions this type of cluster using [RKE](https://github.com/rancher/rke) and [docker-machine.](https://github.com/rancher/machine)
-
-### Rancher Launched Kubernetes for Custom Nodes
-
-When setting up this type of cluster, Rancher installs Kubernetes on existing nodes, which creates a custom cluster.
-
-Rancher provisions this type of cluster using [RKE.](https://github.com/rancher/rke)
-
-### Hosted Kubernetes Providers
-
-When setting up this type of cluster, Kubernetes is installed by providers such as Google Kubernetes Engine, Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.
-
-Rancher provisions this type of cluster using [kontainer-engine.](https://github.com/rancher/kontainer-engine)
-
-### Imported Kubernetes Clusters
-
-In this type of cluster, Rancher connects to a Kubernetes cluster that has already been set up. Therefore, Rancher does not provision Kubernetes, but only sets up the Rancher agents to communicate with the cluster.
-
-# Rancher Server Components and Source Code
-
-This diagram shows each component that the Rancher server is composed of:
-
-![Rancher Components]({{<baseurl>}}/img/rancher/rancher-architecture-rancher-components.svg)
-
-The GitHub repositories for Rancher can be found at the following links:
-
-- [Main Rancher server repository](https://github.com/rancher/rancher)
-- [Rancher UI](https://github.com/rancher/ui)
-- [Rancher API UI](https://github.com/rancher/api-ui)
-- [Norman,](https://github.com/rancher/norman) Rancher's API framework
-- [Types](https://github.com/rancher/types)
-- [Rancher CLI](https://github.com/rancher/cli)
-- [Catalog applications](https://github.com/rancher/helm)
-
-This is a partial list of the most important Rancher repositories. For more details about Rancher source code, refer to the section on [contributing to Rancher.]({{<baseurl>}}/rancher/v2.x/en/contributing/#repositories) To see all libraries and projects used in Rancher, see the [`go.mod` file](https://github.com/rancher/rancher/blob/master/go.mod) in the `rancher/rancher` repository.
diff --git a/content/rancher/v2.5/en/overview/concepts/_index.md b/content/rancher/v2.5/en/overview/concepts/_index.md
deleted file mode 100644
index f4fe9fc26f0..00000000000
--- a/content/rancher/v2.5/en/overview/concepts/_index.md
+++ /dev/null
@@ -1,72 +0,0 @@
----
-title: Kubernetes Concepts
-weight: 4
----
-
-This page explains concepts related to Kubernetes that are important for understanding how Rancher works. The descriptions below provide a simplified interview of Kubernetes components. For more details, refer to the [official documentation on Kubernetes components.](https://kubernetes.io/docs/concepts/overview/components/)
-
-This section covers the following topics:
-
-- [About Docker](#about-docker)
-- [About Kubernetes](#about-kubernetes)
-- [What is a Kubernetes Cluster?](#what-is-a-kubernetes-cluster)
-- [Roles for Nodes in Kubernetes Clusters](#roles-for-nodes-in-kubernetes-clusters)
-  - [etcd Nodes](#etcd-nodes)
-  - [Controlplane Nodes](#controlplane-nodes)
-  - [Worker Nodes](#worker-nodes)
-- [About Helm](#about-helm)
-
-# About Docker
-
-Docker is the container packaging and runtime standard. Developers build container images from Dockerfiles and distribute container images from Docker registries. [Docker Hub](https://hub.docker.com) is the most popular public registry. Many organizations also set up private Docker registries. Docker is primarily used to manage containers on individual nodes.
-
->**Note:** Although Rancher 1.6 supported Docker Swarm clustering technology, it is no longer supported in Rancher 2.x due to the success of Kubernetes.
-
-# About Kubernetes
-
-Kubernetes is the container cluster management standard. YAML files specify containers and other resources that form an application. Kubernetes performs functions such as scheduling, scaling, service discovery, health check, secret management, and configuration management.
-
-# What is a Kubernetes Cluster?
-
-A cluster is a group of computers that work together as a single system.
-
-A _Kubernetes Cluster_ is a cluster that uses the [Kubernetes container-orchestration system](https://kubernetes.io/) to deploy, maintain, and scale Docker containers, allowing your organization to automate application operations.
-
-# Roles for Nodes in Kubernetes Clusters
-
-Each computing resource in a Kubernetes cluster is called a _node_. Nodes can be either bare-metal servers or virtual machines. Kubernetes classifies nodes into three types: _etcd_ nodes, _control plane_ nodes, and _worker_ nodes.
-
-A Kubernetes cluster consists of at least one etcd, controlplane, and worker node.
-
-### etcd Nodes
-
-Rancher uses etcd as a data store in both single node and high-availability installations. In Kubernetes, etcd is also a role for nodes that store the cluster state.
-
-The state of a Kubernetes cluster is maintained in [etcd.](https://kubernetes.io/docs/concepts/overview/components/#etcd)  The etcd nodes run the etcd database.
-
-The etcd database component is a distributed key-value store used as Kubernetes storage for all cluster data, such as cluster coordination and state management. It is recommended to run etcd on multiple nodes so that there's always a backup available for failover. 
-
-Although you can run etcd on just one node, etcd requires a majority of nodes, a quorum, to agree on updates to the cluster state. The cluster should always contain enough healthy etcd nodes to form a quorum. For a cluster with n members, a quorum is (n/2)+1. For any odd-sized cluster, adding one node will always increase the number of nodes necessary for a quorum.
-
-Three etcd nodes is generally sufficient for smaller clusters and five etcd nodes for large clusters.
-
-### Controlplane Nodes
-
-Controlplane nodes run the Kubernetes API server, scheduler, and controller manager. These nodes take care of routine tasks to ensure that your cluster maintains your configuration. Because all cluster data is stored on your etcd nodes, control plane nodes are stateless. You can run control plane on a single node, although two or more nodes are recommended for redundancy. Additionally, a single node can share the control plane and etcd roles.
-
-### Worker Nodes
-    
-Each [worker node](https://kubernetes.io/docs/concepts/architecture/nodes/) runs the following:
-
-- **Kubelets:** An agent that monitors the state of the node, ensuring your containers are healthy.
-- **Workloads:** The containers and pods that hold your apps, as well as other types of deployments.
-
-Worker nodes also run storage and networking drivers, and ingress controllers when required. You create as many worker nodes as necessary to run your  [workloads]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/workloads/).
-
-# About Helm
-
-For high-availability installations of Rancher, Helm is the tool used to install Rancher on a Kubernetes cluster.
-
-Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh).
-
-For more information on service accounts and cluster role binding, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/security/_index.md b/content/rancher/v2.5/en/security/_index.md
deleted file mode 100644
index d93f5e2d328..00000000000
--- a/content/rancher/v2.5/en/security/_index.md
+++ /dev/null
@@ -1,101 +0,0 @@
----
-title: Security
-weight: 15
----
-
-<table width="100%">
-<tr style="vertical-align: top;">
-<td width="30%" style="border: none;">
-<h4>Security policy</h4>
-<p style="padding: 8px">Rancher Labs supports responsible disclosure, and endeavours to resolve all issues in a reasonable time frame. </p>
-</td>
-<td width="30%" style="border: none;">
-<h4>Reporting process</h4>
-<p style="padding: 8px">Please submit possible security issues by emailing <a href="mailto:security@rancher.com">security@rancher.com</a></p>
-</td>
-<td width="30%" style="border: none;">
-<h4>Announcements</h4>
-<p style="padding: 8px">Subscribe to the <a href="https://forums.rancher.com/c/announcements">Rancher announcements forum</a> for release updates.</p>
-</td>
-</tr>
-</table>
-
-Security is at the heart of all Rancher features. From integrating with all the popular authentication tools and services, to an enterprise grade [RBAC capability,]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac) Rancher makes your Kubernetes clusters even more secure.
-
-On this page, we provide security-related documentation along with resources to help you secure your Rancher installation and your downstream Kubernetes clusters:
-
-- [Running a CIS security scan on a Kubernetes cluster](#running-a-cis-security-scan-on-a-kubernetes-cluster)
-- [Guide to hardening Rancher installations](#rancher-hardening-guide)
-- [The CIS Benchmark and self-assessment](#the-cis-benchmark-and-self-assessment)
-- [Third-party penetration test reports](#third-party-penetration-test-reports)
-- [Rancher CVEs and resolutions](#rancher-cves-and-resolutions)
-- [Security Tips and Best Practices](#security-tips-and-best-practices)
-
-### Running a CIS Security Scan on a Kubernetes Cluster
-
-Rancher leverages [kube-bench](https://github.com/aquasecurity/kube-bench) to run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS (Center for Internet Security) Kubernetes Benchmark.
-
-The CIS Kubernetes Benchmark is a reference document that can be used to establish a secure configuration baseline for Kubernetes.
-
-The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace."
-
-CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
-
-The Benchmark provides recommendations of two types: Scored and Not Scored. We run tests related to only Scored recommendations.
-
-When Rancher runs a CIS security scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests.
-
-For details, refer to the section on [security scans.]({{<baseurl>}}/rancher/v2.x/en/security/security-scan)
-
-### Rancher Hardening Guide
-
-The Rancher Hardening Guide is based off of controls and best practices found in the <a href="https://www.cisecurity.org/benchmark/kubernetes/" target="_blank">CIS Kubernetes Benchmark</a> from the Center for Internet Security.
-
-The hardening guide provides prescriptive guidance for hardening a production installation of Rancher v2.1.x, v2.2.x and v.2.3.x. See Rancher's [Self Assessment of the CIS Kubernetes Benchmark](#cis-benchmark-rancher-self-assessment) for the full list of security controls.
-
-> The hardening guides describe how to secure the nodes in your cluster, and it is recommended to follow a hardening guide before installing Kubernetes.
-
-Each version of the hardening guide is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
-
-Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
-------------------------|----------------|-----------------------|------------------
-[Hardening Guide v2.4]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.4/) | Rancher v2.4 | Benchmark v1.5 | Kubernetes v1.15
-[Hardening Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.5/) | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes v1.15
-[Hardening Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3.3/) | Rancher v2.3.3 | Benchmark v1.4.1 | Kubernetes v1.14, v1.15, and v1.16
-[Hardening Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.3/) | Rancher v2.3.0-v2.3.2 | Benchmark v1.4.1 | Kubernetes v1.15
-[Hardening Guide v2.2]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.2/) | Rancher v2.2.x | Benchmark v1.4.1 and 1.4.0 | Kubernetes v1.13
-[Hardening Guide v2.1]({{<baseurl>}}/rancher/v2.x/en/security/hardening-2.1/) | Rancher v2.1.x | Benchmark v1.3.0 | Kubernetes v1.11
-
-### The CIS Benchmark and Self-Assessment
-
-The benchmark self-assessment is a companion to the Rancher security hardening guide. While the hardening guide shows you how to harden the cluster, the benchmark guide is meant to help you evaluate the level of security of the hardened cluster.
-
-Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. This guide will walk through the various controls and provide updated example commands to audit compliance in Rancher created clusters. The original benchmark documents can be downloaded from the [CIS website](https://www.cisecurity.org/benchmark/kubernetes/).
-
-Each version of Rancher's self assessment guide corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
-
-Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
----------------------------|----------|---------|-------|-----
-[Self Assessment Guide v2.4]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.4/#cis-kubernetes-benchmark-1-5-0-rancher-2-4-+-with-kubernetes-1-15) | Rancher v2.4 | Hardening Guide v2.4 | Kubernetes v1.15 | Benchmark v1.5
-[Self Assessment Guide v2.3.5]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.5/#cis-kubernetes-benchmark-1-5-0-rancher-2-3-5-+-with-kubernetes-1-15) | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5
-[Self Assessment Guide v2.3.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-3-+-with-kubernetes-1-16) | Rancher v2.3.3 | Hardening Guide v2.3.3 | Kubernetes v1.16 | Benchmark v1.4.1
-[Self Assessment Guide v2.3]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.3/#cis-kubernetes-benchmark-1-4-1-rancher-2-3-0-2-3-2-with-kubernetes-1-15) | Rancher v2.3.0-2.3.2 | Hardening Guide v2.3 | Kubernetes v1.15 | Benchmark v1.4.1
-[Self Assessment Guide v2.2]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.2/) | Rancher v2.2.x | Hardening Guide v2.2 | Kubernetes v1.13 | Benchmark v1.4.0 and v1.4.1
-[Self Assessment Guide v2.1]({{<baseurl>}}/rancher/v2.x/en/security/benchmark-2.1/) | Rancher v2.1.x | Hardening Guide v2.1 | Kubernetes v1.11 | Benchmark 1.3.0
-
-### Third-party Penetration Test Reports
-
-Rancher periodically hires third parties to perform security audits and penetration tests of the Rancher 2.x software stack. The environments under test follow the Rancher provided hardening guides at the time of the testing. Results are posted when the third party has also verified fixes classified MEDIUM or above.
-
-Results:
-
-- [Cure53 Pen Test - 7/2019](https://releases.rancher.com/documents/security/pen-tests/2019/RAN-01-cure53-report.final.pdf)
-- [Untamed Theory Pen Test- 3/2019](https://releases.rancher.com/documents/security/pen-tests/2019/UntamedTheory-Rancher_SecurityAssessment-20190712_v5.pdf)
-
-### Rancher CVEs and Resolutions
-
-Rancher is committed to informing the community of security issues in our products. For the list of CVEs (Common Vulnerabilities and Exposures) for issues we have resolved, refer to [this page.](./cve)
-
-### Security Tips and Best Practices
-
-Our [best practices guide]({{<baseurl>}}/rancher/v2.x/en/best-practices/management/#tips-for-security) includes basic tips for increasing security in Rancher.
diff --git a/content/rancher/v2.5/en/security/cve/_index.md b/content/rancher/v2.5/en/security/cve/_index.md
deleted file mode 100644
index 02c00946dc9..00000000000
--- a/content/rancher/v2.5/en/security/cve/_index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: Rancher CVEs and Resolutions
-weight: 300
----
-
-Rancher is committed to informing the community of security issues in our products. Rancher will publish CVEs (Common Vulnerabilities and Exposures) for issues we have resolved.
-
-| ID | Description | Date | Resolution |
-|----|-------------|------|------------|
-| [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321) |  Any project member with access to the `default` namespace can mount the `netes-default` service account in a pod and then use that pod to execute administrative privileged commands against the Kubernetes cluster.  | 29 Jan 2019 | [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11) - Rolling back from these versions or greater have specific [instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/).  |
-| [CVE-2019-6287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6287) | Project members continue to get access to namespaces from projects that they were removed from if they were added to more than one project. | 29 Jan 2019  |  [Rancher v2.1.6](https://github.com/rancher/rancher/releases/tag/v2.1.6) and [Rancher v2.0.11](https://github.com/rancher/rancher/releases/tag/v2.0.11)  |
-| [CVE-2019-11202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11202) | The default admin, that is shipped with Rancher, will be re-created upon restart of Rancher despite being explicitly deleted. | 16 Apr 2019  |  [Rancher v2.2.2](https://github.com/rancher/rancher/releases/tag/v2.2.2), [Rancher v2.1.9](https://github.com/rancher/rancher/releases/tag/v2.1.9) and [Rancher v2.0.14](https://github.com/rancher/rancher/releases/tag/v2.0.14)  |
-| [CVE-2019-12274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12274) | Nodes using the built-in node drivers using a file path option allows the machine to read arbitrary files including sensitive ones from inside the Rancher server container. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)  |
-| [CVE-2019-12303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12303) |  Project owners can inject extra fluentd logging configurations that makes it possible to read files or execute arbitrary commands inside the fluentd container. Reported by Tyler Welton from Untamed Theory. | 5 Jun 2019  |  [Rancher v2.2.4](https://github.com/rancher/rancher/releases/tag/v2.2.4), [Rancher v2.1.10](https://github.com/rancher/rancher/releases/tag/v2.1.10) and [Rancher v2.0.15](https://github.com/rancher/rancher/releases/tag/v2.0.15)   |
-| [CVE-2019-13209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13209) |  The vulnerability is known as a [Cross-Site Websocket Hijacking attack](https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html). This attack allows an exploiter to gain access to clusters managed by Rancher with the roles/permissions of a victim. It requires that a victim to be logged into a Rancher server and then access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the Kubernetes API with the permissions and identity of the victim. Reported by Matt Belisle and Alex Stevenson from Workiva. | 15 Jul 2019  |   [Rancher v2.2.5](https://github.com/rancher/rancher/releases/tag/v2.2.5), [Rancher v2.1.11](https://github.com/rancher/rancher/releases/tag/v2.1.11) and [Rancher v2.0.16](https://github.com/rancher/rancher/releases/tag/v2.0.16) |
-| [CVE-2019-14436](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14436) |  The vulnerability allows a member of a project that has access to edit role bindings to be able to assign themselves or others a cluster level role granting them administrator access to that cluster. The issue was found and reported by Michal Lipinski at Nokia. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
-| [CVE-2019-14435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14435) |  This vulnerability allows authenticated users to potentially extract otherwise private data out of IPs reachable from system service containers used by Rancher. This can include but not only limited to services such as cloud provider metadata services. Although Rancher allow users to configure whitelisted domains for system service access, this flaw can still be exploited by a carefully crafted HTTP request. The issue was found and reported by Matt Belisle and Alex Stevenson at Workiva. | 5 Aug 2019  | [Rancher v2.2.7](https://github.com/rancher/rancher/releases/tag/v2.2.7) and [Rancher v2.1.12](https://github.com/rancher/rancher/releases/tag/v2.1.12) |
diff --git a/content/rancher/v2.5/en/security/security-scan/_index.md b/content/rancher/v2.5/en/security/security-scan/_index.md
deleted file mode 100644
index 4d9dc4f8831..00000000000
--- a/content/rancher/v2.5/en/security/security-scan/_index.md
+++ /dev/null
@@ -1,254 +0,0 @@
----
-title: Security Scans
-weight: 1
----
-
-Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
-
-The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
-
-CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
-
-The Benchmark provides recommendations of two types: Scored and Not Scored. We run tests related to only Scored recommendations.
-
-- [About the CIS Benchmark](#about-the-cis-benchmark)
-- [About the generated report](#about-the-generated-report)
-- [Test profiles](#test-profiles)
-- [Skipped and not applicable tests](#skipped-and-not-applicable-tests)
-  - [CIS Benchmark v1.4 skipped tests](#cis-benchmark-v1-4-skipped-tests)
-  - [CIS Benchmark v1.4 not applicable tests](#cis-benchmark-v1-4-not-applicable-tests)
-- [Prerequisites](#prerequisites)
-- [Running a scan](#running-a-scan)
-- [Scheduling recurring scans](#scheduling-recurring-scans)
-- [Skipping tests](#skipping-tests)
-- [Setting alerts](#setting-alerts)
-- [Deleting a report](#deleting-a-report)
-- [Downloading a report](#downloading-a-report)
-
-# About the CIS Benchmark
-
-The Center for Internet Security is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
-
-CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
-
-The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is [here.](https://learn.cisecurity.org/benchmarks)
-
-To check clusters for CIS Kubernetes Benchmark compliance, the security scan leverages [kube-bench,](https://github.com/aquasecurity/kube-bench) an open-source tool from Aqua Security.
-
-# About the Generated Report
-
-Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format.
-
-As of Rancher v2.4, the scan will use the CIS Benchmark v1.4. The Benchmark version is included in the generated report.
-
-The Benchmark provides recommendations of two types: Scored and Not Scored. Recommendations marked as Not Scored in the Benchmark are not included in the generated report.
-
-Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's [self-assessment guide for the corresponding Kubernetes version.]({{<baseurl>}}/rancher/v2.x/en/security/#the-cis-benchmark-and-self-assessment)
-
-The report contains the following information:
-
-| Column in Report | Description |
-|------------------|-------------|
-| ID               | The ID number of the CIS Benchmark. |
-| Description      | The description of the CIS Benchmark test. |
-| Remediation      | What needs to be fixed in order to pass the test. |
-| State of Test    | Indicates if the test passed, failed, was skipped, or was not applicable. |
-| Node type        | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. |
-| Nodes            | The name(s) of the node that the test was run on. |
-| Passed_Nodes | The name(s) of the nodes that the test passed on. |
-| Failed_Nodes | The name(s) of the nodes that the test failed on. |
-
-Refer to [the table in the cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
-
-# Test Profiles
-
-For every CIS benchmark version, Rancher ships with two types of profiles. These profiles are named based on the type of cluster (e.g. `RKE`), the CIS benchmark version (e.g. CIS 1.4) and the profile type (e.g. `Permissive` or `Hardened`). For example, a full profile name would be `RKE-CIS-1.4-Permissive`
-
-All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes.
-
-There are 2 types of profiles:
-
-- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests.
-- **Hardened:** This profile will not skip any tests, except for the non-applicable tests.
-
-In order to pass the "Hardened" profile, you will need to follow the steps on the [hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
-
-# Skipped and Not Applicable Tests
-
-### CIS Benchmark v1.4 Skipped Tests
-
-Number | Description | Reason for Skipping
----|---|---
-1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
-1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
-1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
-1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
-1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
-1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
-1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
-2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
-
-### CIS Benchmark v1.4 Not Applicable Tests
-
-Number | Description | Reason for being not applicable
----|---|---
-1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
-1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
-2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
-2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
-
-
-# Prerequisites
-
-To run security scans on a cluster and access the generated reports, you must be an [Administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [Cluster Owner.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
-
-Rancher can only run security scans on clusters that were created with RKE, which includes custom clusters and clusters that Rancher created in an infrastructure provider such as Amazon EC2 or GCE. Imported clusters and clusters in hosted Kubernetes providers can't be scanned by Rancher.
-
-The security scan cannot run in a cluster that has Windows nodes.
-
-You will only be able to see the CIS scan reports for clusters that you have access to.
-
-# Running a Scan
-
-1. From the cluster view in Rancher, click **Tools > CIS Scans.**
-1. Click **Run Scan.**
-1. Choose a CIS scan profile.
-
-**Result:** A report is generated and displayed in the **CIS Scans** page. To see details of the report, click the report's name.
-
-# Scheduling Recurring Scans
-
-Recurring scans can be scheduled to run on any RKE Kubernetes cluster.
-
-To enable recurring scans, edit the advanced options in the cluster configuration during cluster creation or after the cluster has been created.
-
-To schedule scans for an existing cluster:
-
-1. Go to the cluster view in Rancher.
-1. Click **Tools > CIS Scans.**
-1. Click **Add Schedule.** This takes you to the section of the cluster editing page that is applicable to configuring a schedule for CIS scans. (This section can also be reached by going to the cluster view, clicking **&#8942; > Edit,** and going to the **Advanced Options.**)
-1. In the **CIS Scan Enabled** field, click **Yes.**
-1. In the **CIS Scan Profile** field, choose a **Permissive** or **Hardened** profile. The corresponding CIS Benchmark version is included in the profile name. Note: Any skipped tests [defined in a separate ConfigMap](#skipping-tests) will be skipped regardless of whether a **Permissive** or **Hardened** profile is selected. When selecting the the permissive profile, you should see which tests were skipped by Rancher (tests that are skipped by default for RKE clusters) and which tests were skipped by a Rancher user. In the hardened test profile, the only skipped tests will be skipped by users.
-1. In the **CIS Scan Interval (cron)** job, enter a [cron expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) to define how often the cluster will be scanned.
-1. In the **CIS Scan Report Retention** field, enter the number of past reports that should be kept.
-
-**Result:** The security scan will run and generate reports at the scheduled intervals.
-
-The test schedule can be configured in the `cluster.yml`:
-
-```yaml
-scheduled_cluster_scan:
-    enabled: true
-    scan_config:
-        cis_scan_config:
-            override_benchmark_version: rke-cis-1.4
-            profile: permissive
-    schedule_config:
-        cron_schedule: 0 0 * * *
-        retention: 24
-```
-
-
-# Skipping Tests
-
-You can define a set of tests that will be skipped by the CIS scan when the next report is generated.
-
-These tests will be skipped for subsequent CIS scans, including both manually triggered and scheduled scans, and the tests will be skipped with any profile.
-
-The skipped tests will be listed alongside the test profile name in the cluster configuration options when a test profile is selected for a recurring cluster scan. The skipped tests will also be shown every time a scan is triggered manually from the Rancher UI by clicking **Run Scan.** The display of skipped tests allows you to know ahead of time which tests will be run in each scan.
-
-To skip tests, you will need to define them in a Kubernetes ConfigMap resource. Each skipped CIS scan test is listed in the ConfigMap alongside the version of the CIS benchmark that the test belongs to.
-
-To skip tests by editing a ConfigMap resource,
-
-1. Create a `security-scan` namespace.
-1. Create a ConfigMap named `security-scan-cfg`.
-1. Enter the skip information under the key `config.json` in the following format:
-
-    ```json
-    {
-      "skip": {
-        "rke-cis-1.4": [ 
-          "1.1.1", 
-          "1.2.2"
-        ]
-      }
-    }
-    ```
-    
-    In the example above, the CIS benchmark version is specified alongside the tests to be skipped for that version.
-
-**Result:** These tests will be skipped on subsequent scans that use the defined CIS Benchmark version.
-
-# Setting Alerts
-
-Rancher provides a set of alerts for cluster scans. which are not configured to have notifiers by default:
-
-- A manual cluster scan was completed
-- A manual cluster scan has failures
-- A scheduled cluster scan was completed
-- A scheduled cluster scan has failures
-
-> **Prerequisite:** You need to configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) before configuring, sending, or receiving alerts.
-
-To activate an existing alert for a CIS scan result,
-
-1. From the cluster view in Rancher, click **Tools > Alerts.**
-1. Go to the section called **A set of alerts for cluster scans.**
-1. Go to the alert you want to activate and click **&#8942; > Activate.**
-1. Go to the alert rule group **A set of alerts for cluster scans** and click **&#8942; > Edit.**
-1. Scroll down to the **Alert** section. In the **To** field, select the notifier that you would like to use for sending alert notifications.
-1. Optional: To limit the frequency of the notifications, click on **Show advanced options** and configure the time interval of the alerts.
-1. Click **Save.**
-
-**Result:** The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
-
-To create a new alert,
-
-1. Go to the cluster view and click **Tools > CIS Scans.**
-1. Click **Add Alert.**
-1. Fill out the form. 
-1. Enter a name for the alert.
-1. In the **Is** field, set the alert to be triggered when a scan is completed or when a scan has a failure.
-1. In the **Send a** field, set the alert as a **Critical,** **Warning,** or **Info** alert level.
-1. Choose a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) for the alert.
-
-**Result:** The alert is created and activated. The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
-
-For more information about alerts, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
-
-# Deleting a Report
-
-1. From the cluster view in Rancher, click **Tools > CIS Scans.**
-1. Go to the report that should be deleted.
-1. Click the **&#8942; > Delete.**
-1. Click **Delete.**
-
-# Downloading a Report
-
-1. From the cluster view in Rancher, click **Tools > CIS Scans.**
-1. Go to the report that you want to download. Click **&#8942; > Download.**
-
-**Result:** The report is downloaded in CSV format. For more information on each columns, refer to the [section about the generated report.](#about-the-generated-report)
diff --git a/content/rancher/v2.5/en/system-tools/_index.md b/content/rancher/v2.5/en/system-tools/_index.md
deleted file mode 100644
index 9707d6521e2..00000000000
--- a/content/rancher/v2.5/en/system-tools/_index.md
+++ /dev/null
@@ -1,116 +0,0 @@
----
-title: System Tools
-weight: 17
----
-
-System Tools is a tool to perform operational tasks on [Rancher launched RKE Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters or [installations of Rancher on an RKE cluster.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/) The tasks include:
-
-* Collect logging and system metrics from nodes.
-* Remove Kubernetes resources created by Rancher.
-
-The following commands are available:
-
-| Command | Description
-|---|---
-| [logs](#logs) | Collect Kubernetes cluster component logs from nodes.
-| [stats](#stats) | Stream system metrics from nodes.
-| [remove](#remove) | Remove Kubernetes resources created by Rancher.
-
-# Download System Tools
-
-You can download the latest version of System Tools from the [GitHub releases page](https://github.com/rancher/system-tools/releases/latest). Download the version of `system-tools` for the OS that you are using to interact with the cluster.
-
-Operating System | Filename
------------------|-----
-MacOS            | `system-tools_darwin-amd64`
-Linux            | `system-tools_linux-amd64`
-Windows          | `system-tools_windows-amd64.exe`
-
-After you download the tools, complete the following actions:
-
-1. Rename the file to `system-tools`.
-
-1. Give the file executable permissions by running the following command:
-
-    > **Using Windows?**
-    The file is already an executable, you can skip this step.
-
-    ```
-    chmod +x system-tools
-    ```
-
-# Logs
-
-The logs subcommand will collect log files of core Kubernetes cluster components from nodes in [Rancher-launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) or nodes on an [RKE Kubernetes cluster that Rancher is installed on.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/). See [Troubleshooting]({{<baseurl>}}//rancher/v2.x/en/troubleshooting/) for a list of core Kubernetes cluster components.
-
-System Tools will use the provided kubeconfig file to deploy a DaemonSet, that will copy all the logfiles from the core Kubernetes cluster components and add them to a single tar file (`cluster-logs.tar` by default). If you only want to collect logging from a single node, you can specify the node by using `--node NODENAME` or `-n NODENAME`.
-
-### Usage
-
-```
-./system-tools_darwin-amd64 logs --kubeconfig <KUBECONFIG>
-```
-
-The following are the options for the logs command:
-
-| Option                                                 | Description
-| ------------------------------------------------------ | ------------------------------------------------------
-| `--kubeconfig <KUBECONFIG_PATH>, -c <KUBECONFIG_PATH>` | The cluster's kubeconfig file.
-| `--output <FILENAME>, -o cluster-logs.tar`             | Name of the created tarball containing the logs. If no output filename is defined, the options defaults to `cluster-logs.tar`.
-| `--node <NODENAME>, -n node1`                         | Specify the nodes to collect the logs from. If no node is specified, logs from all nodes in the cluster will be collected.
-
-# Stats
-
-The stats subcommand will display system metrics from nodes in [Rancher-launched Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) or nodes in an [RKE Kubernetes cluster that Rancher is installed on.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/).
-
-System Tools will deploy a DaemonSet, and run a predefined command based on `sar` (System Activity Report) to show system metrics.
-
-### Usage
-
-```
-./system-tools_darwin-amd64 stats --kubeconfig <KUBECONFIG>
-```
-
-The following are the options for the stats command:
-
-| Option                                                 | Description
-| ------------------------------------------------------ | ------------------------------
-| `--kubeconfig <KUBECONFIG_PATH>, -c <KUBECONFIG_PATH>` | The cluster's kubeconfig file.
-| `--node <NODENAME>, -n node1`                          | Specify the nodes to display the system metrics from. If no node is specified, logs from all nodes in the cluster will be displayed.
-| `--stats-command value, -s value`                      | The command to run to display the system metrics. If no command is defined, the options defaults to `/usr/bin/sar -u -r -F 1 1`.
-
-# Remove
-
->**Warning:** This command will remove data from your etcd nodes. Make sure you have created a [backup of etcd]({{<baseurl>}}/rancher/v2.x/en/backups/backups) before executing the command.
-
-When you install Rancher on a Kubernetes cluster, it will create Kubernetes resources to run and to store configuration data. If you want to remove Rancher from your cluster, you can use the `remove` subcommand to remove the Kubernetes resources. When you use the `remove` subcommand, the following resources will be removed:
-
-- The Rancher deployment namespace (`cattle-system` by default).
-- Any `serviceAccount`, `clusterRoles`, and `clusterRoleBindings` that Rancher applied the `cattle.io/creator:norman` label to. Rancher applies this label to any resource that it creates as of v2.1.0.
-- Labels, annotations, and finalizers.
-- Rancher Deployment.
-- Machines, clusters, projects, and user custom resource deployments (CRDs).
-- All resources create under the `management.cattle.io` API Group.
-- All CRDs created by Rancher v2.x.
-
->**Using 2.0.8 or Earlier?**
->
->These versions of Rancher do not automatically delete the `serviceAccount`, `clusterRole`, and `clusterRoleBindings` resources after the job runs. You'll have to delete them yourself.
-
-### Usage
-
-When you run the command below, all the resources listed [above](#remove) will be removed from the cluster.
-
->**Warning:** This command will remove data from your etcd nodes. Make sure you have created a [backup of etcd]({{<baseurl>}}/rancher/v2.x/en/backups/backups) before executing the command.
-
-```
-./system-tools remove --kubeconfig <KUBECONFIG> --namespace <NAMESPACE>
-```
-
-The following are the options for the `remove` command:
-
-| Option                                         | Description
-| ---------------------------------------------- | ------------
-| `--kubeconfig <KUBECONFIG_PATH>, -c <KUBECONFIG_PATH>` | The cluster's kubeconfig file
-| `--namespace <NAMESPACE>, -n cattle-system`    | Rancher 2.x deployment namespace (`<NAMESPACE>`). If no namespace is defined, the options defaults to `cattle-system`.
-| `--force`                                      | Skips the interactive removal confirmation and removes the Rancher deployment without prompt.
diff --git a/content/rancher/v2.5/en/troubleshooting/_index.md b/content/rancher/v2.5/en/troubleshooting/_index.md
deleted file mode 100644
index 2e21c579727..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/_index.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: Troubleshooting
-weight: 21
----
-
-This section contains information to help you troubleshoot issues when using Rancher.
-
-- [Kubernetes components]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/)
-
-    If you need help troubleshooting core Kubernetes cluster components like:
-    * `etcd`
-    * `kube-apiserver`
-    * `kube-controller-manager`
-    * `kube-scheduler`
-    * `kubelet`
-    * `kube-proxy`
-    * `nginx-proxy`
-
-- [Kubernetes resources]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-resources/)
-
-    Options for troubleshooting Kubernetes resources like Nodes, Ingress Controller and Rancher Agents are described in this section.
-
-- [Networking]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/networking/)
-
-    Steps to troubleshoot networking issues can be found here.
-
-- [DNS]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/dns/)
-
-    When you experience name resolution issues in your cluster.
-
-- [Troubleshooting Rancher installed on Kubernetes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/rancherha/)
-
-    If you experience issues with your [Rancher server installed on Kubernetes]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/)
-
-- [Imported clusters]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/imported-clusters/)
-
-    If you experience issues when [Importing Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/)
-
-- [Logging]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/logging/)
-
-    Read more about what log levels can be configured and how to configure a log level.
-
diff --git a/content/rancher/v2.5/en/troubleshooting/docker/_index.md b/content/rancher/v2.5/en/troubleshooting/docker/_index.md
deleted file mode 100644
index ef7f0daf144..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/docker/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Troubleshooting Rancher Installed on a Single Node with Docker
-weight: 3
----
-
-{{< ssl_faq_single >}}
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/_index.md
deleted file mode 100644
index 317c7a34f40..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/mcm/_index.md
+++ /dev/null
@@ -1,187 +0,0 @@
----
-title: Troubleshooting the Enterprise Cluster Manager
-weight: 2
----
-
-> This page is under construction.
-
-This section describes how to troubleshoot an installation of Rancher on a Kubernetes cluster.
-
-### Relevant Namespaces
-
-Most of the troubleshooting will be done on objects in these 3 namespaces.
-
-- `cattle-system` - `rancher` deployment and pods.
-- `ingress-nginx` - Ingress controller pods and services.
-- `kube-system` - `tiller` and `cert-manager` pods.
-
-### "default backend - 404"
-
-A number of things can cause the ingress-controller not to forward traffic to your rancher instance. Most of the time it's due to a bad SSL configuration.
-
-Things to check
-
-- [Is Rancher Running](#is-rancher-running)
-- [Cert CN is "Kubernetes Ingress Controller Fake Certificate"](#cert-cn-is-kubernetes-ingress-controller-fake-certificate)
-
-### Check if Rancher is Running
-
-Use `kubectl` to check the `cattle-system` system namespace and see if the Rancher pods are in a Running state.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-If the state is not `Running`, run a `describe` on the pod and check the Events.
-
-```
-kubectl -n cattle-system describe pod
-
-...
-Events:
-  Type     Reason                 Age   From                Message
-  ----     ------                 ----  ----                -------
-  Normal   Scheduled              11m   default-scheduler   Successfully assigned rancher-784d94f59b-vgqzh to localhost
-  Normal   SuccessfulMountVolume  11m   kubelet, localhost  MountVolume.SetUp succeeded for volume "rancher-token-dj4mt"
-  Normal   Pulling                11m   kubelet, localhost  pulling image "rancher/rancher:v2.0.4"
-  Normal   Pulled                 11m   kubelet, localhost  Successfully pulled image "rancher/rancher:v2.0.4"
-  Normal   Created                11m   kubelet, localhost  Created container
-  Normal   Started                11m   kubelet, localhost  Started container
-```
-
-### Check the Rancher Logs
-
-Use `kubectl` to list the pods.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-Use `kubectl` and the pod name to list the logs from the pod.
-
-```
-kubectl -n cattle-system logs -f rancher-784d94f59b-vgqzh
-```
-
-### Cert CN is "Kubernetes Ingress Controller Fake Certificate"
-
-Use your browser to check the certificate details. If it says the Common Name is "Kubernetes Ingress Controller Fake Certificate", something may have gone wrong with reading or issuing your SSL cert.
-
-> **Note:** if you are using LetsEncrypt to issue certs it can sometimes take a few minuets to issue the cert.
-
-### Checking for issues with cert-manager issued certs (Rancher Generated or LetsEncrypt)
-
-`cert-manager` has 3 parts.
-
-- `cert-manager` pod in the `kube-system` namespace.
-- `Issuer` object in the `cattle-system` namespace.
-- `Certificate` object in the `cattle-system` namespace.
-
-Work backwards and do a `kubectl describe` on each object and check the events. You can track down what might be missing.
-
-For example there is a problem with the Issuer:
-
-```
-kubectl -n cattle-system describe certificate
-...
-Events:
-  Type     Reason          Age                 From          Message
-  ----     ------          ----                ----          -------
-  Warning  IssuerNotReady  18s (x23 over 19m)  cert-manager  Issuer rancher not ready
-```
-
-```
-kubectl -n cattle-system describe issuer
-...
-Events:
-  Type     Reason         Age                 From          Message
-  ----     ------         ----                ----          -------
-  Warning  ErrInitIssuer  19m (x12 over 19m)  cert-manager  Error initializing issuer: secret "tls-rancher" not found
-  Warning  ErrGetKeyPair  9m (x16 over 19m)   cert-manager  Error getting keypair for CA issuer: secret "tls-rancher" not found
-```
-
-### Checking for Issues with Your Own SSL Certs
-
-Your certs get applied directly to the Ingress object in the `cattle-system` namespace.
-
-Check the status of the Ingress object and see if its ready.
-
-```
-kubectl -n cattle-system describe ingress
-```
-
-If its ready and the SSL is still not working you may have a malformed cert or secret.
-
-Check the nginx-ingress-controller logs. Because the nginx-ingress-controller has multiple containers in its pod you will need to specify the name of the container.
-
-```
-kubectl -n ingress-nginx logs -f nginx-ingress-controller-rfjrq nginx-ingress-controller
-...
-W0705 23:04:58.240571       7 backend_ssl.go:49] error obtaining PEM from secret cattle-system/tls-rancher-ingress: error retrieving secret cattle-system/tls-rancher-ingress: secret cattle-system/tls-rancher-ingress was not found
-```
-
-### No matches for kind "Issuer"
-
-The [SSL configuration]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#choose-your-ssl-configuration) option you have chosen requires [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) to be installed before installing Rancher or else the following error is shown:
-
-```
-Error: validation failed: unable to recognize "": no matches for kind "Issuer" in version "certmanager.k8s.io/v1alpha1"
-```
-
-Install [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) and try installing Rancher again.
-
-
-### Canal Pods show READY 2/3
-
-The most common cause of this issue is port 8472/UDP is not open between the nodes. Check your local firewall, network routing or security groups.
-
-Once the network issue is resolved, the `canal` pods should timeout and restart to establish their connections.
-
-### nginx-ingress-controller Pods show RESTARTS
-
-The most common cause of this issue is the `canal` pods have failed to establish the overlay network. See [canal Pods show READY `2/3`](#canal-pods-show-ready-2-3) for troubleshooting.
-
-
-### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed)
-
-Some causes of this error include:
-
-* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`:
-
-```
-$ ssh user@server
-user@server$ docker ps
-CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
-```
-
-See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* SSH server version is not version 6.7 or higher. This is needed for socket forwarding to work, which is used to connect to the Docker socket over SSH. This can be checked using `sshd -V` on the host you are connecting to, or using netcat:
-```
-$ nc xxx.xxx.xxx.xxx 22
-SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
-```
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
-
-The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
-
-The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
-
-If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
-
-### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
-
-The node is not reachable on the configured `address` and `port`.
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md
deleted file mode 100644
index ecbe88a7588..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/mcm/dns/_index.md
+++ /dev/null
@@ -1,217 +0,0 @@
----
-title: DNS
-weight: 103
----
-
-The commands/steps listed on this page can be used to check name resolution issues in your cluster.
-
-Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
-
-Before running the DNS checks, check the [default DNS provider]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/#default-dns-provider) for your cluster and make sure that [the overlay network is functioning correctly]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/networking/#check-if-overlay-network-is-functioning-correctly) as this can also be the reason why DNS resolution (partly) fails.
-
-### Check if DNS pods are running
-
-```
-kubectl -n kube-system get pods -l k8s-app=kube-dns
-```
-
-Example output when using CoreDNS:
-```
-NAME                       READY   STATUS    RESTARTS   AGE
-coredns-799dffd9c4-6jhlz   1/1     Running   0          76m
-```
-
-Example output when using kube-dns:
-```
-NAME                        READY   STATUS    RESTARTS   AGE
-kube-dns-5fd74c7488-h6f7n   3/3     Running   0          4m13s
-```
-
-### Check if the DNS service is present with the correct cluster-ip
-
-```
-kubectl -n kube-system get svc -l k8s-app=kube-dns
-```
-
-```
-NAME               TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)         AGE
-service/kube-dns   ClusterIP   10.43.0.10   <none>        53/UDP,53/TCP   4m13s
-```
-
-### Check if domain names are resolving
-
-Check if internal cluster names are resolving (in this example, `kubernetes.default`), the IP shown after `Server:` should be the same as the `CLUSTER-IP` from the `kube-dns` service.
-
-```
-kubectl run -it --rm --restart=Never busybox --image=busybox:1.28 -- nslookup kubernetes.default
-```
-
-Example output:
-```
-Server:    10.43.0.10
-Address 1: 10.43.0.10 kube-dns.kube-system.svc.cluster.local
-
-Name:      kubernetes.default
-Address 1: 10.43.0.1 kubernetes.default.svc.cluster.local
-pod "busybox" deleted
-```
-
-Check if external names are resolving (in this example, `www.google.com`)
-
-```
-kubectl run -it --rm --restart=Never busybox --image=busybox:1.28 -- nslookup www.google.com
-```
-
-Example output:
-```
-Server:    10.43.0.10
-Address 1: 10.43.0.10 kube-dns.kube-system.svc.cluster.local
-
-Name:      www.google.com
-Address 1: 2a00:1450:4009:80b::2004 lhr35s04-in-x04.1e100.net
-Address 2: 216.58.211.100 ams15s32-in-f4.1e100.net
-pod "busybox" deleted
-```
-
-If you want to check resolving of domain names on all of the hosts, execute the following steps:
-
-1. Save the following file as `ds-dnstest.yml`
-
-    ```
-    apiVersion: apps/v1
-    kind: DaemonSet
-    metadata:
-      name: dnstest
-    spec:
-      selector:
-          matchLabels:
-            name: dnstest
-      template:
-        metadata:
-          labels:
-            name: dnstest
-        spec:
-          tolerations:
-          - operator: Exists
-          containers:
-          - image: busybox:1.28
-            imagePullPolicy: Always
-            name: alpine
-            command: ["sh", "-c", "tail -f /dev/null"]
-            terminationMessagePath: /dev/termination-log
-    ```
-
-2. Launch it using `kubectl create -f ds-dnstest.yml`
-3. Wait until `kubectl rollout status ds/dnstest -w` returns: `daemon set "dnstest" successfully rolled out`.
-4. Configure the environment variable `DOMAIN` to a fully qualified domain name (FQDN) that the host should be able to resolve (`www.google.com` is used as an example) and run the following command to let each container on every host resolve the configured domain name (it's a single line command).
-
-    ```
-    export DOMAIN=www.google.com; echo "=> Start DNS resolve test"; kubectl get pods -l name=dnstest --no-headers -o custom-columns=NAME:.metadata.name,HOSTIP:.status.hostIP | while read pod host; do kubectl exec $pod -- /bin/sh -c "nslookup $DOMAIN > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $host cannot resolve $DOMAIN; fi; done; echo "=> End DNS resolve test"
-    ```
-
-5. When this command has finished running, the output indicating everything is correct is:
-
-    ```
-    => Start DNS resolve test
-    => End DNS resolve test
-    ```
-
-If you see error in the output, that means that the mentioned host(s) is/are not able to resolve the given FQDN.
-
-Example error output of a situation where host with IP 209.97.182.150 had the UDP ports blocked.
-
-```
-=> Start DNS resolve test
-command terminated with exit code 1
-209.97.182.150 cannot resolve www.google.com
-=> End DNS resolve test
-```
-
-Cleanup the alpine DaemonSet by running `kubectl delete ds/dnstest`.
-
-### CoreDNS specific
-
-#### Check CoreDNS logging
-
-```
-kubectl -n kube-system logs -l k8s-app=kube-dns
-```
-
-#### Check configuration
-
-CoreDNS configuration is stored in the configmap `coredns` in the `kube-system` namespace.
-
-```
-kubectl -n kube-system get configmap coredns -o go-template={{.data.Corefile}}
-```
-
-#### Check upstream nameservers in resolv.conf
-
-By default, the configured nameservers on the host (in `/etc/resolv.conf`) will be used as upstream nameservers for CoreDNS. You can check this file on the host or run the following Pod with `dnsPolicy` set to `Default`, which will inherit the `/etc/resolv.conf` from the host it is running on.
-
-```
-kubectl run -i --restart=Never --rm test-${RANDOM} --image=ubuntu --overrides='{"kind":"Pod", "apiVersion":"v1", "spec": {"dnsPolicy":"Default"}}' -- sh -c 'cat /etc/resolv.conf'
-```
-
-#### Enable query logging
-
-Enabling query logging can be done by enabling the [log plugin](https://coredns.io/plugins/log/) in the Corefile configuration in the configmap `coredns`. You can do so by using `kubectl -n kube-system edit configmap coredns` or use the command below to replace the configuration in place:
-
-```
-kubectl get configmap -n kube-system coredns -o json |  kubectl get configmap -n kube-system coredns -o json | sed -e 's_loadbalance_log\\n    loadbalance_g' | kubectl apply -f -
-```
-
-All queries will now be logged and can be checked using the command in [Check CoreDNS logging](#check-coredns-logging).
-
-### kube-dns specific
-
-#### Check upstream nameservers in kubedns container
-
-By default, the configured nameservers on the host (in `/etc/resolv.conf`) will be used as upstream nameservers for kube-dns. Sometimes the host will run a local caching DNS nameserver, which means the address in `/etc/resolv.conf` will point to an address in the loopback range (`127.0.0.0/8`) which will be unreachable by the container. In case of Ubuntu 18.04, this is done by `systemd-resolved`. Since Rancher v2.0.7, we detect if `systemd-resolved` is running, and will automatically use the `/etc/resolv.conf` file with the correct upstream nameservers (which is located at `/run/systemd/resolve/resolv.conf`).
-
-Use the following command to check the upstream nameservers used by the kubedns container:
-
-```
-kubectl -n kube-system get pods -l k8s-app=kube-dns --no-headers -o custom-columns=NAME:.metadata.name,HOSTIP:.status.hostIP | while read pod host; do echo "Pod ${pod} on host ${host}"; kubectl -n kube-system exec $pod -c kubedns cat /etc/resolv.conf; done
-```
-
-Example output:
-```
-Pod kube-dns-667c7cb9dd-z4dsf on host x.x.x.x
-nameserver 1.1.1.1
-nameserver 8.8.4.4
-```
-
-If the output shows an address in the loopback range (`127.0.0.0/8`), you can correct this in two ways:
-
-* Make sure the correct nameservers are listed in `/etc/resolv.conf` on your nodes in the cluster, please consult your operating system documentation on how to do this. Make sure you execute this before provisioning a cluster, or reboot the nodes after making the modification.
-* Configure the `kubelet` to use a different file for resolving names, by using `extra_args` as shown below (where `/run/resolvconf/resolv.conf` is the file with the correct nameservers):
-
-```
-services:
-  kubelet:
-    extra_args:
-      resolv-conf: "/run/resolvconf/resolv.conf"
-```
-
-> **Note:** As the `kubelet` is running inside a container, the path for files located in `/etc` and `/usr` are in `/host/etc` and `/host/usr` inside the `kubelet` container.
-
-See [Editing Cluster as YAML]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/editing-clusters/#editing-cluster-as-yaml) how to apply this change. When the provisioning of the cluster has finished, you have to remove the kube-dns pod to activate the new setting in the pod:
-
-```
-kubectl delete pods -n kube-system -l k8s-app=kube-dns
-pod "kube-dns-5fd74c7488-6pwsf" deleted
-```
-
-Try to resolve name again using [Check if domain names are resolving](#check-if-domain-names-are-resolving).
-
-If you want to check the kube-dns configuration in your cluster (for example, to check if there are different upstream nameservers configured), you can run the following command to list the kube-dns configuration:
-
-```
-kubectl -n kube-system get configmap kube-dns -o go-template='{{range $key, $value := .data}}{{ $key }}{{":"}}{{ $value }}{{"\n"}}{{end}}'
-```
-
-Example output:
-```
-upstreamNameservers:["1.1.1.1"]
-```
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md
deleted file mode 100644
index b7a6e6b28eb..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/mcm/imported-clusters/_index.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: Imported clusters
-weight: 105
----
-
-The commands/steps listed on this page can be used to check clusters that you are importing or that are imported in Rancher.
-
-Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kubeconfig_from_imported_cluster.yml`)
-
-### Rancher agents
-
-Communication to the cluster (Kubernetes API via cattle-cluster-agent) and communication to the nodes is done through Rancher agents.
-
-If the cattle-cluster-agent cannot connect to the configured `server-url`, the cluster will remain in **Pending** state, showing `Waiting for full cluster configuration`. 
-
-#### cattle-node-agent
-
-Check if the cattle-node-agent pods are present on each node, have status **Running** and don't have a high count of Restarts:
-
-```
-kubectl -n cattle-system get pods -l app=cattle-agent -o wide
-```
-
-Example output:
-
-```
-NAME                      READY     STATUS    RESTARTS   AGE       IP                NODE
-cattle-node-agent-4gc2p   1/1       Running   0          2h        x.x.x.x           worker-1
-cattle-node-agent-8cxkk   1/1       Running   0          2h        x.x.x.x           etcd-1
-cattle-node-agent-kzrlg   1/1       Running   0          2h        x.x.x.x           etcd-0
-cattle-node-agent-nclz9   1/1       Running   0          2h        x.x.x.x           controlplane-0
-cattle-node-agent-pwxp7   1/1       Running   0          2h        x.x.x.x           worker-0
-cattle-node-agent-t5484   1/1       Running   0          2h        x.x.x.x           controlplane-1
-cattle-node-agent-t8mtz   1/1       Running   0          2h        x.x.x.x           etcd-2
-```
-
-Check logging of a specific cattle-node-agent pod or all cattle-node-agent pods:
-
-```
-kubectl -n cattle-system logs -l app=cattle-agent
-```
-
-#### cattle-cluster-agent
-
-Check if the cattle-cluster-agent pod is present in the cluster, has status **Running** and doesn't have a high count of Restarts:
-
-```
-kubectl -n cattle-system get pods -l app=cattle-cluster-agent -o wide
-```
-
-Example output:
-
-```
-NAME                                    READY     STATUS    RESTARTS   AGE       IP           NODE
-cattle-cluster-agent-54d7c6c54d-ht9h4   1/1       Running   0          2h        x.x.x.x      worker-1
-```
-
-Check logging of cattle-cluster-agent pod:
-
-```
-kubectl -n cattle-system logs -l app=cattle-cluster-agent
-```
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md
deleted file mode 100644
index 50024334901..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/mcm/logging/_index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: Logging
-weight: 110
----
-
-The following log levels are used in Rancher:
-
-| Name    | Description |
-|---------|-------------|
-| `info`  | Logs informational messages. This is the default log level. |
-| `debug` | Logs more detailed messages that can be used to debug. |
-| `trace` | Logs very detailed messages on internal functions. This is very verbose and can contain sensitive information. |
-
-### How to configure a log level
-
-* Kubernetes install
- * Configure debug log level
-```
-$ KUBECONFIG=./kube_config_rancher-cluster.yml
-$ kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | awk '{ print $1 }' | while read rancherpod; do kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $rancherpod -- loglevel --set debug; done
-OK
-OK
-OK
-$ kubectl --kubeconfig $KUBECONFIG -n cattle-system logs -l app=rancher
-```
-
- * Configure info log level
-```
-$ KUBECONFIG=./kube_config_rancher-cluster.yml
-$ kubectl --kubeconfig $KUBECONFIG -n cattle-system get pods -l app=rancher | grep '1/1' | awk '{ print $1 }' | while read rancherpod; do kubectl --kubeconfig $KUBECONFIG -n cattle-system exec $rancherpod -- loglevel --set info; done
-OK
-OK
-OK
-```
-
-* Docker Install
- * Configure debug log level
-```
-$ docker exec -ti <container_id> loglevel --set debug
-OK
-$ docker logs -f <container_id>
-```
-
- * Configure info log level
-```
-$ docker exec -ti <container_id> loglevel --set info
-OK
-```
diff --git a/content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md b/content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md
deleted file mode 100644
index 7259b61a3e0..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/mcm/networking/_index.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-title: Networking
-weight: 102
----
-
-The commands/steps listed on this page can be used to check networking related issues in your cluster.
-
-Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
-
-### Double check if all the required ports are opened in your (host) firewall
-
-Double check if all the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) are opened in your (host) firewall. The overlay network uses UDP in comparison to all other required ports which are TCP.
-
-### Check if overlay network is functioning correctly
-
-The pod can be scheduled to any of the hosts you used for your cluster, but that means that the NGINX ingress controller needs to be able to route the request from `NODE_1` to `NODE_2`. This happens over the overlay network. If the overlay network is not functioning, you will experience intermittent TCP/HTTP connection failures due to the NGINX ingress controller not being able to route to the pod.
-
-To test the overlay network, you can launch the following `DaemonSet` definition. This will run a `busybox` container on every host, which we will use to run a `ping` test between containers on all hosts.
-
-1. Save the following file as `ds-overlaytest.yml`
-
-    ```
-    apiVersion: apps/v1
-    kind: DaemonSet
-    metadata:
-      name: overlaytest
-    spec:
-      selector:
-          matchLabels:
-            name: overlaytest
-      template:
-        metadata:
-          labels:
-            name: overlaytest
-        spec:
-          tolerations:
-          - operator: Exists
-          containers:
-          - image: busybox:1.28
-            imagePullPolicy: Always
-            name: busybox
-            command: ["sh", "-c", "tail -f /dev/null"]
-            terminationMessagePath: /dev/termination-log
-    ```
-
-2. Launch it using `kubectl create -f ds-overlaytest.yml`
-3. Wait until `kubectl rollout status ds/overlaytest -w` returns: `daemon set "overlaytest" successfully rolled out`.
-4. Run the following command, from the same location, to let each container on every host ping each other (it's a single line bash command).
-
-    ```
-    echo "=> Start network overlay test"; kubectl get pods -l name=overlaytest -o jsonpath='{range .items[*]}{@.metadata.name}{" "}{@.spec.nodeName}{"\n"}{end}' | while read spod shost; do kubectl get pods -l name=overlaytest -o jsonpath='{range .items[*]}{@.status.podIP}{" "}{@.spec.nodeName}{"\n"}{end}' | while read tip thost; do kubectl --request-timeout='10s' exec $spod -- /bin/sh -c "ping -c2 $tip > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $shost cannot reach $thost; fi; done; done; echo "=> End network overlay test"
-    ```
-
-5. When this command has finished running, the output indicating everything is correct is:
-
-    ```
-    => Start network overlay test
-    => End network overlay test
-    ```
-
-If you see error in the output, that means that the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for overlay networking are not opened between the hosts indicated.
-
-Example error output of a situation where NODE1 had the UDP ports blocked.
-
-```
-=> Start network overlay test
-command terminated with exit code 1
-NODE2 cannot reach NODE1
-command terminated with exit code 1
-NODE3 cannot reach NODE1
-command terminated with exit code 1
-NODE1 cannot reach NODE2
-command terminated with exit code 1
-NODE1 cannot reach NODE3
-=> End network overlay test
-```
-
-Cleanup the busybox DaemonSet by running `kubectl delete ds/overlaytest`.
-
-### Check if MTU is correctly configured on hosts and on peering/tunnel appliances/devices
-
-When the MTU is incorrectly configured (either on hosts running Rancher, nodes in created/imported clusters or on appliances/devices in between), error messages will be logged in Rancher and in the agents, similar to:
-
-* `websocket: bad handshake`
-* `Failed to connect to proxy`
-* `read tcp: i/o timeout`
-
-See [Google Cloud VPN: MTU Considerations](https://cloud.google.com/vpn/docs/concepts/mtu-considerations#gateway_mtu_vs_system_mtu) for an example how to configure MTU correctly when using Google Cloud VPN between Rancher and cluster nodes.
-
-### Resolved issues
-
-#### Overlay network broken when using Canal/Flannel due to missing node annotations
-
-| | |
-|------------|------------|
-| GitHub issue | [#13644](https://github.com/rancher/rancher/issues/13644) |
-| Resolved in |  v2.1.2 |
-
-To check if your cluster is affected, the following command will list nodes that are broken (this command requires `jq` to be installed):
-
-```
-kubectl get nodes -o json | jq '.items[].metadata | select(.annotations["flannel.alpha.coreos.com/public-ip"] == null or .annotations["flannel.alpha.coreos.com/kube-subnet-manager"] == null or .annotations["flannel.alpha.coreos.com/backend-type"] == null or .annotations["flannel.alpha.coreos.com/backend-data"] == null) | .name'
-```
-
-If there is no output, the cluster is not affected.
-
-#### System namespace pods network connectivity broken
-
-> **Note:** This applies only to Rancher upgrades from v2.0.6 or earlier to v2.0.7 or later. Upgrades from v2.0.7 to later version are unaffected.
-
-| | |
-|------------|------------|
-| GitHub issue | [#15146](https://github.com/rancher/rancher/issues/15146) |
-
-If pods in system namespaces cannot communicate with pods in other system namespaces, you will need to follow the instructions in [Upgrading to v2.0.7+ — Namespace Migration]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/) to restore connectivity. Symptoms include:
-
-- NGINX ingress controller showing `504 Gateway Time-out` when accessed.
-- NGINX ingress controller logging `upstream timed out (110: Connection timed out) while connecting to upstream` when accessed.
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/_index.md
deleted file mode 100644
index c048db2fcf2..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/rke/_index.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-title: Troubleshooting an RKE Cluster
-weight: 1
----
-
-The commands and steps listed in this section apply to the core Kubernetes components on [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters.
-
-This section includes troubleshooting tips in the following categories:
-
-- [Troubleshooting etcd Nodes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/etcd)
-- [Troubleshooting Controlplane Nodes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/controlplane)
-- [Troubleshooting nginx-proxy Nodes]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/nginx-proxy)
-- [Troubleshooting Worker Nodes and Generic Components]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-components/worker-and-generic)
-
-# Kubernetes Component Diagram
-
-![Cluster diagram]({{<baseurl>}}/img/rancher/clusterdiagram.svg)<br/>
-<sup>Lines show the traffic flow between components. Colors are used purely for visual aid</sup>
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md
deleted file mode 100644
index 1ca42591cf2..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/rke/controlplane/_index.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: Troubleshooting Controlplane Nodes
-weight: 2
----
-
-This section applies to nodes with the `controlplane` role.
-
-# Check if the Controlplane Containers are Running
-
-There are three specific containers launched on nodes with the `controlplane` role:
-
-* `kube-apiserver`
-* `kube-controller-manager`
-* `kube-scheduler`
-
-The containers should have status **Up**. The duration shown after **Up** is the time the container has been running.
-
-```
-docker ps -a -f=name='kube-apiserver|kube-controller-manager|kube-scheduler'
-```
-
-Example output:
-```
-CONTAINER ID        IMAGE                                COMMAND                  CREATED             STATUS              PORTS               NAMES
-26c7159abbcc        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-apiserver
-f3d287ca4549        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-scheduler
-bdf3898b8063        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-controller-manager
-```
-
-# Controlplane Container Logging
-
-> **Note:** If you added multiple nodes with the `controlplane` role, both `kube-controller-manager` and `kube-scheduler` use a leader election process to determine the leader. Only the current leader will log the performed actions. See [Kubernetes leader election]({{<baseurl>}}/rancher/v2.x/en/troubleshooting/kubernetes-resources/#kubernetes-leader-election) how to retrieve the current leader.
-
-The logging of the containers can contain information on what the problem could be.
-
-```
-docker logs kube-apiserver
-docker logs kube-controller-manager
-docker logs kube-scheduler
-```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md
deleted file mode 100644
index f83d241a08a..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/rke/etcd/_index.md
+++ /dev/null
@@ -1,365 +0,0 @@
----
-title: Troubleshooting etcd Nodes
-weight: 1
----
-
-This section contains commands and tips for troubleshooting nodes with the `etcd` role.
-
-This page covers the following topics:
-
-- [Checking if the etcd Container is Running](#checking-if-the-etcd-container-is-running)
-- [etcd Container Logging](#etcd-container-logging)
-- [etcd Cluster and Connectivity Checks](#etcd-cluster-and-connectivity-checks)
-  - [Check etcd Members on all Nodes](#check-etcd-members-on-all-nodes)
-  - [Check Endpoint Status](#check-endpoint-status)
-  - [Check Endpoint Health](#check-endpoint-health)
-  - [Check Connectivity on Port TCP/2379](#check-connectivity-on-port-tcp-2379)
-  - [Check Connectivity on Port TCP/2380](#check-connectivity-on-port-tcp-2380)
-- [etcd Alarms](#etcd-alarms)
-- [etcd Space Errors](#etcd-space-errors)
-- [Log Level](#log-level)
-- [etcd Content](#etcd-content)
-  - [Watch Streaming Events](#watch-streaming-events)
-  - [Query etcd Directly](#query-etcd-directly)
-- [Replacing Unhealthy etcd Nodes](#replacing-unhealthy-etcd-nodes)
-
-# Checking if the etcd Container is Running
-
-The container for etcd should have status **Up**. The duration shown after **Up** is the time the container has been running.
-
-```
-docker ps -a -f=name=etcd$
-```
-
-Example output:
-```
-CONTAINER ID        IMAGE                         COMMAND                  CREATED             STATUS              PORTS               NAMES
-605a124503b9        rancher/coreos-etcd:v3.2.18   "/usr/local/bin/et..."   2 hours ago         Up 2 hours                              etcd
-```
-
-# etcd Container Logging
-
-The logging of the container can contain information on what the problem could be.
-
-```
-docker logs etcd
-```
-| Log | Explanation |
-|-----|------------------|
-| `health check for peer xxx could not connect: dial tcp IP:2380: getsockopt: connection refused` | A connection to the address shown on port 2380 cannot be established. Check if the etcd container is running on the host with the address shown. |
-| `xxx is starting a new election at term x` | The etcd cluster has lost its quorum and is trying to establish a new leader. This can happen when the majority of the nodes running etcd go down/unreachable. |
-| `connection error: desc = "transport: Error while dialing dial tcp 0.0.0.0:2379: i/o timeout"; Reconnecting to {0.0.0.0:2379 0  <nil>}` | The host firewall is preventing network communication. |
-| `rafthttp: request cluster ID mismatch` | The node with the etcd instance logging `rafthttp: request cluster ID mismatch` is trying to join a cluster that has already been formed with another peer. The node should be removed from the cluster, and re-added. |
-| `rafthttp: failed to find member` | The cluster state (`/var/lib/etcd`) contains wrong information to join the cluster. The node should be removed from the cluster, the state directory should be cleaned and the node should be re-added.
-
-# etcd Cluster and Connectivity Checks
-
-The address where etcd is listening depends on the address configuration of the host etcd is running on. If an internal address is configured for the host etcd is running on, the endpoint for `etcdctl` needs to be specified explicitly. If any of the commands respond with `Error:  context deadline exceeded`, the etcd instance is unhealthy (either quorum is lost or the instance is not correctly joined in the cluster)
-
-### Check etcd Members on all Nodes
-
-Output should contain all the nodes with the `etcd` role and the output should be identical on all nodes.
-
-Command:
-```
-docker exec etcd etcdctl member list
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list"
-```
-
-Example output:
-```
-xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001
-xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001
-xxx, started, etcd-xxx, https://IP:2380, https://IP:2379,https://IP:4001
-```
-
-### Check Endpoint Status
-
-The values for `RAFT TERM` should be equal and `RAFT INDEX` should be not be too far apart from each other.
-
-Command:
-```
-docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint status --write-out table
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table
-```
-
-Example output:
-```
-+-----------------+------------------+---------+---------+-----------+-----------+------------+
-| ENDPOINT        |        ID        | VERSION | DB SIZE | IS LEADER | RAFT TERM | RAFT INDEX |
-+-----------------+------------------+---------+---------+-----------+-----------+------------+
-| https://IP:2379 | 333ef673fc4add56 |  3.2.18 |   24 MB |     false |        72 |      66887 |
-| https://IP:2379 | 5feed52d940ce4cf |  3.2.18 |   24 MB |      true |        72 |      66887 |
-| https://IP:2379 | db6b3bdb559a848d |  3.2.18 |   25 MB |     false |        72 |      66887 |
-+-----------------+------------------+---------+---------+-----------+-----------+------------+
-```
-
-### Check Endpoint Health
-
-Command:
-```
-docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint health
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd etcdctl endpoint health --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','")
-```
-
-Example output:
-```
-https://IP:2379 is healthy: successfully committed proposal: took = 2.113189ms
-https://IP:2379 is healthy: successfully committed proposal: took = 2.649963ms
-https://IP:2379 is healthy: successfully committed proposal: took = 2.451201ms
-```
-
-### Check Connectivity on Port TCP/2379
-
-Command:
-```
-for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5"); do
-   echo "Validating connection to ${endpoint}/health"
-   docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/health"
-done
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5"); do
-  echo "Validating connection to ${endpoint}/health";
-  docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/health"
-done
-```
-
-Example output:
-```
-Validating connection to https://IP:2379/health
-{"health": "true"}
-Validating connection to https://IP:2379/health
-{"health": "true"}
-Validating connection to https://IP:2379/health
-{"health": "true"}
-```
-
-### Check Connectivity on Port TCP/2380
-
-Command:
-```
-for endpoint in $(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f4"); do
-  echo "Validating connection to ${endpoint}/version";
-  docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl --http1.1 -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/version"
-done
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-for endpoint in $(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f4"); do
-  echo "Validating connection to ${endpoint}/version";
-  docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl --http1.1 -s -w "\n" --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) "${endpoint}/version"
-done
-```
-
-Example output:
-```
-Validating connection to https://IP:2380/version
-{"etcdserver":"3.2.18","etcdcluster":"3.2.0"}
-Validating connection to https://IP:2380/version
-{"etcdserver":"3.2.18","etcdcluster":"3.2.0"}
-Validating connection to https://IP:2380/version
-{"etcdserver":"3.2.18","etcdcluster":"3.2.0"}
-```
-
-# etcd Alarms
-
-etcd will trigger alarms, for instance when it runs out of space.
-
-Command:
-```
-docker exec etcd etcdctl alarm list
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm list"
-```
-
-Example output when NOSPACE alarm is triggered:
-```
-memberID:x alarm:NOSPACE
-memberID:x alarm:NOSPACE
-memberID:x alarm:NOSPACE
-```
-
-# etcd Space Errors
-
-Related error messages are `etcdserver: mvcc: database space exceeded` or `applying raft message exceeded backend quota`. Alarm `NOSPACE` will be triggered.
-
-Resolutions:
-
-- [Compact the Keyspace](#compact-the-keyspace)
-- [Defrag All etcd Members](#defrag-all-etcd-members)
-- [Check Endpoint Status](#check-endpoint-status)
-- [Disarm Alarm](#disarm-alarm)
-
-### Compact the Keyspace
-
-Command:
-```
-rev=$(docker exec etcd etcdctl endpoint status --write-out json | egrep -o '"revision":[0-9]*' | egrep -o '[0-9]*')
-docker exec etcd etcdctl compact "$rev"
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-rev=$(docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT endpoint status --write-out json | egrep -o '\"revision\":[0-9]*' | egrep -o '[0-9]*'")
-docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT compact \"$rev\""
-```
-
-Example output:
-```
-compacted revision xxx
-```
-
-### Defrag All etcd Members
-
-Command:
-```
-docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl defrag
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd sh -c "etcdctl defrag --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','")"
-```
-
-Example output:
-```
-Finished defragmenting etcd member[https://IP:2379]
-Finished defragmenting etcd member[https://IP:2379]
-Finished defragmenting etcd member[https://IP:2379]
-```
-
-### Check Endpoint Status
-
-Command:
-```
-docker exec -e ETCDCTL_ENDPOINTS=$(docker exec etcd /bin/sh -c "etcdctl member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") etcd etcdctl endpoint status --write-out table
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd sh -c "etcdctl endpoint status --endpoints=$(docker exec etcd /bin/sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT member list | cut -d, -f5 | sed -e 's/ //g' | paste -sd ','") --write-out table"
-```
-
-Example output:
-```
-+-----------------+------------------+---------+---------+-----------+-----------+------------+
-| ENDPOINT        |        ID        | VERSION | DB SIZE | IS LEADER | RAFT TERM | RAFT INDEX |
-+-----------------+------------------+---------+---------+-----------+-----------+------------+
-| https://IP:2379 |  e973e4419737125 |  3.2.18 |  553 kB |     false |        32 |    2449410 |
-| https://IP:2379 | 4a509c997b26c206 |  3.2.18 |  553 kB |     false |        32 |    2449410 |
-| https://IP:2379 | b217e736575e9dd3 |  3.2.18 |  553 kB |      true |        32 |    2449410 |
-+-----------------+------------------+---------+---------+-----------+-----------+------------+
-```
-
-### Disarm Alarm
-
-After verifying that the DB size went down after compaction and defragmenting, the alarm needs to be disarmed for etcd to allow writes again.
-
-Command:
-```
-docker exec etcd etcdctl alarm list
-docker exec etcd etcdctl alarm disarm
-docker exec etcd etcdctl alarm list
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm list"
-docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm disarm"
-docker exec etcd sh -c "etcdctl --endpoints=\$ETCDCTL_ENDPOINT alarm list"
-```
-
-Example output:
-```
-docker exec etcd etcdctl alarm list
-memberID:x alarm:NOSPACE
-memberID:x alarm:NOSPACE
-memberID:x alarm:NOSPACE
-docker exec etcd etcdctl alarm disarm
-docker exec etcd etcdctl alarm list
-```
-
-# Log Level
-
-The log level of etcd can be changed dynamically via the API. You can configure debug logging using the commands below.
-
-Command:
-```
-docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"DEBUG"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINTS)/config/local/log
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"DEBUG"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINT)/config/local/log
-```
-
-To reset the log level back to the default (`INFO`), you can use the following command.
-
-Command:
-```
-docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"INFO"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINTS)/config/local/log
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker run --net=host -v $(docker inspect kubelet --format '{{ range .Mounts }}{{ if eq .Destination "/etc/kubernetes" }}{{ .Source }}{{ end }}{{ end }}')/ssl:/etc/kubernetes/ssl:ro appropriate/curl -s -XPUT -d '{"Level":"INFO"}' --cacert $(docker exec etcd printenv ETCDCTL_CACERT) --cert $(docker exec etcd printenv ETCDCTL_CERT) --key $(docker exec etcd printenv ETCDCTL_KEY) $(docker exec etcd printenv ETCDCTL_ENDPOINT)/config/local/log
-```
-
-# etcd Content
-
-If you want to investigate the contents of your etcd, you can either watch streaming events or you can query etcd directly, see below for examples.
-
-### Watch Streaming Events
-
-Command:
-```
-docker exec etcd etcdctl watch --prefix /registry
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd etcdctl --endpoints=\$ETCDCTL_ENDPOINT watch --prefix /registry
-```
-
-If you only want to see the affected keys (and not the binary data), you can append `| grep -a ^/registry` to the command to filter for keys only.
-
-### Query etcd Directly
-
-Command:
-```
-docker exec etcd etcdctl get /registry --prefix=true --keys-only
-```
-
-Command when using etcd version lower than 3.3.x (Kubernetes 1.13.x and lower) and `--internal-address` was specified when adding the node:
-```
-docker exec etcd etcdctl --endpoints=\$ETCDCTL_ENDPOINT get /registry --prefix=true --keys-only
-```
-
-You can process the data to get a summary of count per key, using the command below:
-
-```
-docker exec etcd etcdctl get /registry --prefix=true --keys-only | grep -v ^$ | awk -F'/' '{ if ($3 ~ /cattle.io/) {h[$3"/"$4]++} else { h[$3]++ }} END { for(k in h) print h[k], k }' | sort -nr
-```
-
-# Replacing Unhealthy etcd Nodes
-
-When a node in your etcd cluster becomes unhealthy, the recommended approach is to fix or remove the failed or unhealthy node before adding a new etcd node to the cluster.
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md
deleted file mode 100644
index 507573b7b69..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/rke/kubernetes-resources/_index.md
+++ /dev/null
@@ -1,271 +0,0 @@
----
-title: Kubernetes resources
-weight: 5
----
-
-The commands/steps listed on this page can be used to check the most important Kubernetes resources and apply to [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters.
-
-Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml` for Rancher HA) or are using the embedded kubectl via the UI.
-
-- [Nodes](#nodes)
-  - [Get nodes](#get-nodes)
-  - [Get node conditions](#get-node-conditions)
-- [Kubernetes leader election](#kubernetes-leader-election)
-  - [Kubernetes controller manager leader](#kubernetes-controller-manager-leader)
-  - [Kubernetes scheduler leader](#kubernetes-scheduler-leader)
-- [Ingress controller](#ingress-controller)
-  - [Pod details](#pod-details)
-  - [Pod container logs](#pod-container-logs)
-  - [Namespace events](#namespace-events)
-  - [Debug logging](#debug-logging)
-  - [Check configuration](#check-configuration)
-- [Rancher agents](#rancher-agents)
-  - [cattle-node-agent](#cattle-node-agent)
-  - [cattle-cluster-agent](#cattle-cluster-agent)
-- [Jobs and pods](#jobs-and-pods)
-  - [Check that pods or jobs have status Running/Completed](#check-that-pods-or-jobs-have-status-running-completed)
-  - [Describe pod](#describe-pod)
-  - [Pod container logs](#pod-container-logs)
-  - [Describe job](#describe-job)
-  - [Logs from the containers of pods of the job](#logs-from-the-containers-of-pods-of-the-job)
-  - [Evicted pods](#evicted-pods)
-  - [Job does not complete](#job-does-not-complete)
-
-# Nodes
-
-### Get nodes
-
-Run the command below and check the following:
-
-- All nodes in your cluster should be listed, make sure there is not one missing.
-- All nodes should have the **Ready** status (if not in **Ready** state, check the `kubelet` container logs on that node using `docker logs kubelet`)
-- Check if all nodes report the correct version.
-- Check if OS/Kernel/Docker values are shown as expected (possibly you can relate issues due to upgraded OS/Kernel/Docker)
-
-
-```
-kubectl get nodes -o wide
-``` 
-
-Example output:
-
-```
-NAME             STATUS   ROLES          AGE   VERSION   INTERNAL-IP      EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
-controlplane-0   Ready    controlplane   31m   v1.13.5   138.68.188.91    <none>        Ubuntu 18.04.2 LTS   4.15.0-47-generic   docker://18.9.5
-etcd-0           Ready    etcd           31m   v1.13.5   138.68.180.33    <none>        Ubuntu 18.04.2 LTS   4.15.0-47-generic   docker://18.9.5
-worker-0         Ready    worker         30m   v1.13.5   139.59.179.88    <none>        Ubuntu 18.04.2 LTS   4.15.0-47-generic   docker://18.9.5
-```
-
-### Get node conditions
-
-Run the command below to list nodes with [Node Conditions](https://kubernetes.io/docs/concepts/architecture/nodes/#condition)
-
-```
-kubectl get nodes -o go-template='{{range .items}}{{$node := .}}{{range .status.conditions}}{{$node.metadata.name}}{{": "}}{{.type}}{{":"}}{{.status}}{{"\n"}}{{end}}{{end}}'
-```
-
-Run the command below to list nodes with [Node Conditions](https://kubernetes.io/docs/concepts/architecture/nodes/#condition) that are active that could prevent normal operation.
-
-```
-kubectl get nodes -o go-template='{{range .items}}{{$node := .}}{{range .status.conditions}}{{if ne .type "Ready"}}{{if eq .status "True"}}{{$node.metadata.name}}{{": "}}{{.type}}{{":"}}{{.status}}{{"\n"}}{{end}}{{else}}{{if ne .status "True"}}{{$node.metadata.name}}{{": "}}{{.type}}{{": "}}{{.status}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}'
-```
-
-Example output:
-
-```
-worker-0: DiskPressure:True
-```
-
-# Kubernetes leader election
-
-### Kubernetes Controller Manager leader
-
-The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `kube-controller-manager` endpoint (in this example, `controlplane-0`).
-
-```
-kubectl -n kube-system get endpoints kube-controller-manager -o jsonpath='{.metadata.annotations.control-plane\.alpha\.kubernetes\.io/leader}'
-{"holderIdentity":"controlplane-0_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","leaseDurationSeconds":15,"acquireTime":"2018-12-27T08:59:45Z","renewTime":"2018-12-27T09:44:57Z","leaderTransitions":0}>
-```
-
-### Kubernetes Scheduler leader
-
-The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `kube-scheduler` endpoint (in this example, `controlplane-0`).
-
-```
-kubectl -n kube-system get endpoints kube-scheduler -o jsonpath='{.metadata.annotations.control-plane\.alpha\.kubernetes\.io/leader}'
-{"holderIdentity":"controlplane-0_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","leaseDurationSeconds":15,"acquireTime":"2018-12-27T08:59:45Z","renewTime":"2018-12-27T09:44:57Z","leaderTransitions":0}>
-```
-
-# Ingress Controller
-
-The default Ingress Controller is NGINX and is deployed as a DaemonSet in the `ingress-nginx` namespace. The pods are only scheduled to nodes with the `worker` role.
-
-Check if the pods are running on all nodes:
-
-```
-kubectl -n ingress-nginx get pods -o wide
-```
-
-Example output:
-
-```
-kubectl -n ingress-nginx get pods -o wide
-NAME                                    READY     STATUS    RESTARTS   AGE       IP               NODE
-default-http-backend-797c5bc547-kwwlq   1/1       Running   0          17m       x.x.x.x          worker-1
-nginx-ingress-controller-4qd64          1/1       Running   0          14m       x.x.x.x          worker-1
-nginx-ingress-controller-8wxhm          1/1       Running   0          13m       x.x.x.x          worker-0
-```
-
-If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.
-
-### Pod details
-
-```
-kubectl -n ingress-nginx describe pods -l app=ingress-nginx
-```
-
-### Pod container logs
-
-```
-kubectl -n ingress-nginx logs -l app=ingress-nginx
-```
-
-### Namespace events
-
-```
-kubectl -n ingress-nginx get events
-```
-
-### Debug logging
-
-To enable debug logging:
-
-```
-kubectl -n ingress-nginx patch ds nginx-ingress-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--v=5"}]'
-```
-
-### Check configuration
-
-Retrieve generated configuration in each pod:
-
-```
-kubectl -n ingress-nginx get pods -l app=ingress-nginx --no-headers -o custom-columns=.NAME:.metadata.name | while read pod; do kubectl -n ingress-nginx exec $pod -- cat /etc/nginx/nginx.conf; done
-```
-
-# Rancher agents
-
-Communication to the cluster (Kubernetes API via `cattle-cluster-agent`) and communication to the nodes (cluster provisioning via `cattle-node-agent`) is done through Rancher agents.
-
-#### cattle-node-agent
-
-Check if the cattle-node-agent pods are present on each node, have status **Running** and don't have a high count of Restarts:
-
-```
-kubectl -n cattle-system get pods -l app=cattle-agent -o wide
-```
-
-Example output:
-
-```
-NAME                      READY     STATUS    RESTARTS   AGE       IP                NODE
-cattle-node-agent-4gc2p   1/1       Running   0          2h        x.x.x.x           worker-1
-cattle-node-agent-8cxkk   1/1       Running   0          2h        x.x.x.x           etcd-1
-cattle-node-agent-kzrlg   1/1       Running   0          2h        x.x.x.x           etcd-0
-cattle-node-agent-nclz9   1/1       Running   0          2h        x.x.x.x           controlplane-0
-cattle-node-agent-pwxp7   1/1       Running   0          2h        x.x.x.x           worker-0
-cattle-node-agent-t5484   1/1       Running   0          2h        x.x.x.x           controlplane-1
-cattle-node-agent-t8mtz   1/1       Running   0          2h        x.x.x.x           etcd-2
-```
-
-Check logging of a specific cattle-node-agent pod or all cattle-node-agent pods:
-
-```
-kubectl -n cattle-system logs -l app=cattle-agent
-```
-
-#### cattle-cluster-agent
-
-Check if the cattle-cluster-agent pod is present in the cluster, has status **Running** and doesn't have a high count of Restarts:
-
-```
-kubectl -n cattle-system get pods -l app=cattle-cluster-agent -o wide
-```
-
-Example output:
-
-```
-NAME                                    READY     STATUS    RESTARTS   AGE       IP           NODE
-cattle-cluster-agent-54d7c6c54d-ht9h4   1/1       Running   0          2h        x.x.x.x      worker-1
-```
-
-Check logging of cattle-cluster-agent pod:
-
-```
-kubectl -n cattle-system logs -l app=cattle-cluster-agent
-```
-
-# Jobs and Pods
-
-### Check that pods or jobs have status **Running**/**Completed**
-
-To check, run the command:
-
-```
-kubectl get pods --all-namespaces
-```
-
-If a pod is not in **Running** state, you can dig into the root cause by running:
-
-### Describe pod
-
-```
-kubectl describe pod POD_NAME -n NAMESPACE
-```
-
-### Pod container logs
-
-```
-kubectl logs POD_NAME -n NAMESPACE
-```
-
-If a job is not in **Completed** state, you can dig into the root cause by running:
-
-### Describe job
-
-```
-kubectl describe job JOB_NAME -n NAMESPACE
-```
-
-### Logs from the containers of pods of the job
-
-```
-kubectl logs -l job-name=JOB_NAME -n NAMESPACE
-```
-
-### Evicted pods
-
-Pods can be evicted based on [eviction signals](https://kubernetes.io/docs/tasks/administer-cluster/out-of-resource/#eviction-policy).
-
-Retrieve a list of evicted pods (podname and namespace):
-
-```
-kubectl get pods --all-namespaces -o go-template='{{range .items}}{{if eq .status.phase "Failed"}}{{if eq .status.reason "Evicted"}}{{.metadata.name}}{{" "}}{{.metadata.namespace}}{{"\n"}}{{end}}{{end}}{{end}}'
-```
-
-To delete all evicted pods:
-
-```
-kubectl get pods --all-namespaces -o go-template='{{range .items}}{{if eq .status.phase "Failed"}}{{if eq .status.reason "Evicted"}}{{.metadata.name}}{{" "}}{{.metadata.namespace}}{{"\n"}}{{end}}{{end}}{{end}}' | while read epod enamespace; do kubectl -n $enamespace delete pod $epod; done
-```
-
-Retrieve a list of evicted pods, scheduled node and the reason:
-
-```
-kubectl get pods --all-namespaces -o go-template='{{range .items}}{{if eq .status.phase "Failed"}}{{if eq .status.reason "Evicted"}}{{.metadata.name}}{{" "}}{{.metadata.namespace}}{{"\n"}}{{end}}{{end}}{{end}}' | while read epod enamespace; do kubectl -n $enamespace get pod $epod -o=custom-columns=NAME:.metadata.name,NODE:.spec.nodeName,MSG:.status.message; done
-```
-
-### Job does not complete
-
-If you have enabled Istio, and you are having issues with a Job you deployed not completing, you will need to add an annotation to your pod using [these steps.](../../cluster-admin/tools/istio/setup/enable-istio-in-namespace/#excluding-workloads-from-being-injected-with-the-istio-sidecar)
-
-Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. This is a temporary workaround and will disable Istio for any traffic to/from the annotated Pod. Keep in mind this may not allow you to continue to use a Job for integration testing, as the Job will not have access to the service mesh.
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md
deleted file mode 100644
index 70505e96280..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/rke/nginx-proxy/_index.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: Troubleshooting nginx-proxy
-weight: 3
----
-
-The `nginx-proxy` container is deployed on every node that does not have the `controlplane` role. It provides access to all the nodes with the `controlplane` role by dynamically generating the NGINX configuration based on available nodes with the `controlplane` role.
-
-# Check if the Container is Running
-
-The container is called `nginx-proxy` and should have status `Up`. The duration shown after `Up` is the time the container has been running.
-
-```
-docker ps -a -f=name=nginx-proxy
-```
-
-Example output:
-
-```
-docker ps -a -f=name=nginx-proxy
-CONTAINER ID        IMAGE                       COMMAND                  CREATED             STATUS              PORTS               NAMES
-c3e933687c0e        rancher/rke-tools:v0.1.15   "nginx-proxy CP_HO..."   3 hours ago         Up 3 hours                              nginx-proxy
-```
-
-# Check Generated NGINX Configuration
-
-The generated configuration should include the IP addresses of the nodes with the `controlplane` role. The configuration can be checked using the following command:
-
-```
-docker exec nginx-proxy cat /etc/nginx/nginx.conf
-```
-
-Example output:
-```
-error_log stderr notice;
-
-worker_processes auto;
-events {
-  multi_accept on;
-  use epoll;
-  worker_connections 1024;
-}
-
-stream {
-        upstream kube_apiserver {
-            
-            server ip_of_controlplane_node1:6443;
-            
-            server ip_of_controlplane_node2:6443;
-            
-        }
-
-        server {
-            listen        6443;
-            proxy_pass    kube_apiserver;
-            proxy_timeout 30;
-            proxy_connect_timeout 2s;
-
-        }
-
-}
-```
-
-# nginx-proxy Container Logging
-
-The logging of the containers can contain information on what the problem could be.
-
-```
-docker logs nginx-proxy
-```
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md
deleted file mode 100644
index 5a96d695015..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/rke/rancher_rke/_index.md
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: Troubleshooting Rancher Installed on a Local RKE Cluster
-weight: 104
----
-
-The commands/steps listed on this page are intended to be used to troubleshoot an RKE Kubernetes cluster that Rancher is installed on.
-
-Make sure you configured the correct kubeconfig (for example, `export KUBECONFIG=$PWD/kube_config_rancher-cluster.yml`).
-
-### Check Rancher pods
-
-Rancher pods are deployed as a Deployment in the `cattle-system` namespace.
-
-Check if the pods are running on all nodes:
-
-```
-kubectl -n cattle-system get pods -l app=rancher -o wide
-```
-
-Example output:
-
-```
-NAME                       READY   STATUS    RESTARTS   AGE   IP          NODE
-rancher-7dbd7875f7-n6t5t   1/1     Running   0          8m    x.x.x.x     x.x.x.x
-rancher-7dbd7875f7-qbj5k   1/1     Running   0          8m    x.x.x.x     x.x.x.x
-rancher-7dbd7875f7-qw7wb   1/1     Running   0          8m    x.x.x.x     x.x.x.x
-```
-
-If a pod is unable to run (Status is not **Running**, Ready status is not showing `1/1` or you see a high count of Restarts), check the pod details, logs and namespace events.                                                                                                       
-
-#### Pod details
-
-```
-kubectl -n cattle-system describe pods -l app=rancher
-```
-
-#### Pod container logs
-
-```
-kubectl -n cattle-system logs -l app=rancher
-```
-
-#### Namespace events
-
-```
-kubectl -n cattle-system get events
-```
-
-### Check ingress
-
-Ingress should have the correct `HOSTS` (showing the configured FQDN) and `ADDRESS` (host address(es) it will be routed to).
-
-```
-kubectl -n cattle-system get ingress
-```
-
-Example output:
-
-```
-NAME      HOSTS                    ADDRESS                   PORTS     AGE
-rancher   rancher.yourdomain.com   x.x.x.x,x.x.x.x,x.x.x.x   80, 443   2m
-```
-
-### Check ingress controller logs
-
-When accessing your configured Rancher FQDN does not show you the UI, check the ingress controller logging to see what happens when you try to access Rancher:
-
-```
-kubectl -n ingress-nginx logs -l app=ingress-nginx
-```
-
-### Leader election
-
-The leader is determined by a leader election process. After the leader has been determined, the leader (`holderIdentity`) is saved in the `cattle-controllers` ConfigMap (in this example, `rancher-7dbd7875f7-qbj5k`).
-
-```
-kubectl -n kube-system get configmap cattle-controllers -o jsonpath='{.metadata.annotations.control-plane\.alpha\.kubernetes\.io/leader}'
-{"holderIdentity":"rancher-7dbd7875f7-qbj5k","leaseDurationSeconds":45,"acquireTime":"2019-04-04T11:53:12Z","renewTime":"2019-04-04T12:24:08Z","leaderTransitions":0}
-```
-
diff --git a/content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md b/content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md
deleted file mode 100644
index 28ee4499bb4..00000000000
--- a/content/rancher/v2.5/en/troubleshooting/rke/worker-and-generic/_index.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Troubleshooting Worker Nodes and Generic Components
-weight: 4
----
-
-This section applies to every node as it includes components that run on nodes with any role.
-
-# Check if the Containers are Running
-
-There are two specific containers launched on nodes with the `worker` role:
-
-* kubelet
-* kube-proxy
-
-The containers should have status `Up`. The duration shown after `Up` is the time the container has been running.
-
-```
-docker ps -a -f=name='kubelet|kube-proxy'
-```
-
-Example output:
-```
-CONTAINER ID        IMAGE                                COMMAND                  CREATED             STATUS              PORTS               NAMES
-158d0dcc33a5        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kube-proxy
-a30717ecfb55        rancher/hyperkube:v1.11.5-rancher1   "/opt/rke-tools/en..."   3 hours ago         Up 3 hours                              kubelet
-```
-
-# Container Logging
-
-The logging of the containers can contain information on what the problem could be.
-
-```
-docker logs kubelet
-docker logs kube-proxy
-```
diff --git a/content/rancher/v2.5/en/user-preferences/_index.md b/content/rancher/v2.5/en/user-preferences/_index.md
deleted file mode 100644
index 2695a5a3129..00000000000
--- a/content/rancher/v2.5/en/user-preferences/_index.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: User Preferences
-weight: 18
----
-
-> This page is under construction.
-
-Within Rancher, each user has a number of settings associated with their login: personal preferences, API keys, etc. You can configure these settings by choosing from the **User Settings** menu. You can open this menu by clicking your avatar, located within the main menu.
-
-![User Settings Menu]({{<baseurl>}}/img/rancher/user-settings.png)
-
-The available user settings are:
-
-- [API & Keys]({{<baseurl>}}/rancher/v2.x/en/user-settings/api-keys/): If you want to interact with Rancher programmatically, you need an API key. Follow the directions in this section to obtain a key.
-- [Cloud Credentials]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/): Manage cloud credentials [used by node templates]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/#node-templates) to [provision nodes for clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters). Note: Available as of v2.2.0. 
-- [Node Templates]({{<baseurl>}}/rancher/v2.x/en/user-settings/node-templates): Manage templates [used by Rancher to provision nodes for clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters).
-- [Preferences]({{<baseurl>}}/rancher/v2.x/en/user-settings/preferences): Sets superficial preferences for the Rancher UI.
-- Log Out: Ends your user session.
-
-# Preferences
-
-Each user can choose preferences to personalize their Rancher experience. To change preference settings, open the **User Settings** menu and then select **Preferences**.
-
-## Theme
-
-Choose your background color for the Rancher UI. If you choose **Auto**, the background color changes from light to dark at 6 PM, and then changes back at 6 AM.
-
-## My Account
-
-This section displays the **Name** (your display name) and **Username** (your login) used for your session. To change your login's current password, click the **Change Password** button.
-
-## Table Row per Page
-
-On pages that display system objects like clusters or deployments in a table, you can set the number of objects that display on the page before you must paginate. The default setting is `50`.
diff --git a/content/rancher/v2.x/_index.md b/content/rancher/v2.x/_index.md
index f0bb89915cf..fde0e8a648a 100644
--- a/content/rancher/v2.x/_index.md
+++ b/content/rancher/v2.x/_index.md
@@ -1,4 +1,4 @@
 ---
-title: v2.0-v2.4
+title: v2.x
 showBreadcrumb: false
 ---
diff --git a/content/rancher/v2.x/en/_index.md b/content/rancher/v2.x/en/_index.md
index 850af59c5f6..685ceec51a5 100644
--- a/content/rancher/v2.x/en/_index.md
+++ b/content/rancher/v2.x/en/_index.md
@@ -1,17 +1,14 @@
 ---
-title: "Rancher v2.0-v2.4 Documentation"
-shortTitle: "Rancher 2.0-2.4"
+title: "Rancher 2.x"
+shortTitle: "Rancher 2.x"
 description: "Rancher adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
-metaTitle: "Rancher 2.0-2.4 Docs"
+metaTitle: "Rancher 2.x Docs: What is New?"
 metaDescription: "Rancher 2 adds significant value on top of Kubernetes: managing hundreds of clusters from one interface, centralizing RBAC, enabling monitoring and alerting. Read more."
 insertOneSix: true
 weight: 1
 ctaBanner: 0
 ---
-
-> The Rancher v2.5 docs are [here.]({{<baseurl>}}/rancher/v2.5/en)
-
-Rancher was originally built to work with multiple orchestrators, and it included its own orchestrator called Cattle. With the rise of Kubernetes in the marketplace, Rancher 2 exclusively deploys and manages Kubernetes clusters running anywhere, on any provider.
+Rancher was originally built to work with multiple orchestrators, and it included its own orchestrator called Cattle. With the rise of Kubernetes in the marketplace, Rancher 2.x exclusively deploys and manages Kubernetes clusters running anywhere, on any provider.
 
 Rancher can provision Kubernetes from a hosted provider, provision compute nodes and then install Kubernetes onto them, or import existing Kubernetes clusters running anywhere.
 
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
index 6199ccd4bc7..dceb610f935 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
@@ -47,8 +47,6 @@ When OPA Gatekeeper is enabled, Rancher installs some templates by default.
 
 To list the constraint templates installed in the cluster, go to the left side menu under OPA Gatekeeper and click on **Templates.**
 
-For detailed steps on how to create constraints using these default templates, please refer to [this section.](#using-the-default-constraint-templates)
-
 Rancher also provides the ability to create your own constraint templates by importing YAML definitions.
    
 # Creating and Configuring Constraints
@@ -99,115 +97,3 @@ The detail view of each constraint lists information about the resource that vio
 
 **Result:** Upon disabling OPA Gatekeeper, all constraint templates and constraints will also be deleted.
 
-# Using the Default Constraint Templates
-
-When OPA Gatekeeper is enabled, Rancher installs some templates by default. Currently the following constraint templates are installed:
-
-1. `k8sallowedrepos` - Template that can be used to whitelist registries.
-1. `k8srequiredlabels` - Template that can be used to enforce desired labels on specific Kubernetes objects.
-
-This section describes how to use these templates to create constraints for enforcing certain policies on the cluster via the **Dashboard** view.
-
-Currently it is not possible to create a constraint via "Edit as Form" by passing non-scalar parameters, but one can create them by using the **Edit As YAML** option.
-
-The constraint created can be edited using the form.
-
-### Constraint to Whitelist Registries
-
-Suppose you want to apply a policy that restricts creation of any pods in your cluster to use images only from a whitelisted repository. In this case, you would create a constraint from the  `k8sallowedrepos` template.
-
-For example, suppose we want all pods launched in the namespace `test` to use images only from the quay.io registry.
-
-Steps to do that via Rancher's dashboard view are as follows:
-
-> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's <b>Dashboard</b> view.
-
-1. Navigate to **OPA Gatekeeper > Constraints > Create.**
-1. Use the **Edit As YAML** option on the right hand corner of the Create form. Paste the following YAML and click **Create** to add the constraint:
-
-    ```yaml
-    type: constraints.gatekeeper.sh.k8sallowedrepos
-    spec:
-      match:
-        excludedNamespaces:
-          - cattle-system
-          - gatekeeper-system
-          - ingress-nginx
-          - kube-node-lease
-          - kube-public
-          - kube-system
-          - security-scan
-        kinds:
-          - apiGroups: [""]
-            kinds: ["Pod"]
-        namespaces:
-          - "test"
-        labelSelector:
-          matchExpressions: []
-        namespaceSelector:
-          matchExpressions: []
-      parameters:
-        repos:
-          - "quay.io"
-      enforcementAction: deny
-    metadata:
-      name: test-repo-is-quay-io
-      annotations:
-        cattle.io/description: whitelist repo quay.io
-    ```
-    
-    The YAML specifies the directive `repos` as defined by the `k8sallowedrepos` template schema.
-
-    This constraint specifies that the image repository "quay.io" should be used by all pod objects in the `test` namespace. Notice that all the system namespaces are by default added to the list of `excludedNamespaces`. You can edit the constraint via the form to change the namespaces and other information.
-
-**Result:** After the above constraint is created, it will be listed under `K8sAllowedRepos` on the **Constraints** page.  Now if you navigate **Back to Rancher** and create a workload under the `test` namespace with any image other than the "quay.io" registry, you will get an error from OPA Gatekeeper.
-
-### Constraint to Enforce Labels
-
-Suppose you want to apply a policy that requires certain set of labels present on Kubernetes resources of a specific kind, then you can create a constraint from the  `k8srequiredlabels` template.
-
-For example, suppose we want all namespaces in the cluster to be labeled with the name of a team.
-
-Steps to do that via Rancher's dashboard view are as follows:
-
-> **Prerequisite:** OPA Gatekeeper must be enabled using the cluster's <b>Dashboard</b> view.
-
-1. Navigate to OPA Gatekeeper > Constraints > Create.
-1. Use the **Edit As YAML** option on the right hand corner of the Create form. Paste the following yaml and click **Create** to add the constraint:
-
-    ```yaml
-    type: constraints.gatekeeper.sh.k8srequiredlabels
-    spec:
-      match:
-        excludedNamespaces:
-          - cattle-system
-          - gatekeeper-system
-          - ingress-nginx
-          - kube-node-lease
-          - kube-public
-          - kube-system
-          - security-scan
-        kinds:
-          - apiGroups: [""]
-            kinds: ["Namespace"]
-        labelSelector:
-          matchExpressions: []
-        namespaceSelector:
-          matchExpressions: []
-      parameters:
-        message: "All namespaces must have a `team` label that points to your team name"
-        labels:
-          - key: team
-            allowedRegex: "^[a-zA-Z]+$"
-      enforcementAction: deny
-    metadata:
-      name: ns-must-have-label
-      annotations:
-        cattle.io/description: constraint for ns label
-    ```
-    
-    The YAML specifies the directives `message` and `labels` as defined by the `k8srequiredlabels` template schema. This constraint defines that all"namespaces must have a label `team` whose value should match the given "allowedRegex". Notice that all the system namespaces are by default added to list of `excludedNamespaces`.
-
-    You can edit the constraint via the form to change the namespaces and other information.
-
-**Result:** After the above constraint is created, it will be listed under `K8sRequiredLabels` on the **Constraints** page. Now if you navigate **Back to Rancher** and create a new namespace in the cluster without having the label `team`, the create request should be denied.
diff --git a/content/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table/index.md b/content/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table/index.md
deleted file mode 100644
index b3560c76223..00000000000
--- a/content/rancher/v2.x/en/cluster-provisioning/cluster-capabilities-table/index.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-headless: true
----
-| Action | [Rancher launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) | [Hosted Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/) | [Imported Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters) |
-| --- | --- | ---| ---|
-| [Using kubectl and a kubeconfig file to Access a Cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/kubectl/) | ✓ | ✓ | ✓ |
-| [Managing Cluster Members]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cluster-access/cluster-members/) | ✓ | ✓ | ✓ |
-| [Editing and Upgrading Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/editing-clusters/) | ✓ | ✓ | * |
-| [Managing Nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/nodes) | ✓ | ✓ | ✓ |
-| [Managing Persistent Volumes and Storage Classes]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/) | ✓ | ✓ | ✓ |
-| [Managing Projects, Namespaces and Workloads]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/projects-and-namespaces/) | ✓ | ✓ | ✓ |
-| [Using App Catalogs]({{<baseurl>}}/rancher/v2.x/en/catalog/) | ✓ | ✓ | ✓ |
-| [Configuring Tools (Alerts, Notifiers, Logging, Monitoring, Istio)]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) | ✓ | ✓ | ✓ |
-| [Cloning Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cloning-clusters/)| ✓ | ✓ | |
-| [Ability to rotate certificates]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/) | ✓ |  | |
-| [Ability to back up your Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/) | ✓ | | |
-| [Ability to recover and restore etcd]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/) | ✓ | | |
-| [Cleaning Kubernetes components when clusters are no longer reachable from Rancher]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/cleaning-cluster-nodes/) | ✓ | | |
-| [Configuring Pod Security Policies]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/pod-security-policy/) | ✓ |  | |
-| [Running Security Scans]({{<baseurl>}}/rancher/v2.x/en/security/security-scan/) | ✓ |  | |
-
-/* Cluster configuration options can't be edited for imported clusters, except for [K3s clusters.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/imported-clusters/#additional-features-for-imported-k3s-clusters)
diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/_index.md
index e2da323ee7a..5a84152ebef 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Setting up Clusters from Hosted Kubernetes Providers
-weight: 2100
+weight: 3
 ---
 
 In this scenario, Rancher does not provision Kubernetes because it is installed by providers such as Google Kubernetes Engine (GKE), Amazon Elastic Container Service for Kubernetes, or Azure Kubernetes Service.
diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index ec106076c14..5bb0f86029f 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -26,7 +26,7 @@ Rancher needs access to your AWS account in order to provision and administer yo
 
 1. Create a user with programmatic access by following the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
 
-2. Next, create an IAM policy that defines what this user has access to in your AWS account. The required permissions are [here.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/#appendix-minimum-eks-permissions) Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
+2. Next, create an IAM policy that defines what this user has access to in your AWS account. It's important to only grant this user minimal access within your account. Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
 
 3. Finally, follow the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey) to create an access key and secret key for this user.
 
@@ -263,8 +263,7 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
                 "cloudformation:DescribeStackResources",
                 "cloudformation:DescribeStacks",
                 "cloudformation:ListStacks",
-                "cloudformation:CreateStack",
-                "cloudformation:DeleteStack"
+                "cloudformation:CreateStack"
             ],
             "Resource": "*"
         },
diff --git a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
index 8f59cbb3348..5f37d312224 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
@@ -1,9 +1,9 @@
 ---
-title: Importing Existing Clusters into Rancher
+title: Importing Existing Clusters
 description: Learn how you can create a cluster in Rancher by importing an existing Kubernetes cluster. Then, you can manage it using Rancher
 metaTitle: 'Kubernetes Cluster Management'
 metaDescription: 'Learn how you can import an existing Kubernetes cluster and then manage it using Rancher'
-weight: 2300
+weight: 5
 aliases:
   - /rancher/v2.x/en/tasks/clusters/import-cluster/
 ---
diff --git a/content/rancher/v2.x/en/cluster-provisioning/production/_index.md b/content/rancher/v2.x/en/cluster-provisioning/production/_index.md
index d5ab40db6fd..2aea2df7329 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/production/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/production/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Checklist for Production-Ready Clusters
-weight: 2005
+weight: 2
 ---
 
 In this section, we recommend best practices for creating the production-ready Kubernetes clusters that will run your apps and services.
diff --git a/content/rancher/v2.x/en/cluster-provisioning/registering/_index.md b/content/rancher/v2.x/en/cluster-provisioning/registering/_index.md
new file mode 100644
index 00000000000..ee7821d0029
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-provisioning/registering/_index.md
@@ -0,0 +1,4 @@
+---
+title: Registering K3s, Rancher or EKS Clusters
+weight: 6
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md
index 111b0a58faa..ce7512f5ba7 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Launching Kubernetes with Rancher
-weight: 2200
+weight: 4
 ---
 
 You can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, it uses [Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/) (RKE), which is Rancher's own lightweight Kubernetes installer. It can launch Kubernetes on any computers, including:
diff --git a/content/rancher/v2.x/en/dashboard/_index.md b/content/rancher/v2.x/en/dashboard/_index.md
new file mode 100644
index 00000000000..15c9ffb624f
--- /dev/null
+++ b/content/rancher/v2.x/en/dashboard/_index.md
@@ -0,0 +1,4 @@
+---
+title: Dashboard
+weight: 5000
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/backup-restore/_index.md b/content/rancher/v2.x/en/dashboard/backup-restore/_index.md
new file mode 100644
index 00000000000..e3e41e6e16b
--- /dev/null
+++ b/content/rancher/v2.x/en/dashboard/backup-restore/_index.md
@@ -0,0 +1,4 @@
+---
+title: Backup and Restore
+weight: 7
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/cis-scans/_index.md b/content/rancher/v2.x/en/dashboard/cis-scans/_index.md
new file mode 100644
index 00000000000..15ced365507
--- /dev/null
+++ b/content/rancher/v2.x/en/dashboard/cis-scans/_index.md
@@ -0,0 +1,4 @@
+---
+title: CIS Security Scans
+weight: 6
+---
diff --git a/content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md b/content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md
new file mode 100644
index 00000000000..006d87e6e3b
--- /dev/null
+++ b/content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md
@@ -0,0 +1,4 @@
+---
+title: Cluster Explorer
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/istio/_index.md b/content/rancher/v2.x/en/dashboard/istio/_index.md
new file mode 100644
index 00000000000..fb765119eb0
--- /dev/null
+++ b/content/rancher/v2.x/en/dashboard/istio/_index.md
@@ -0,0 +1,4 @@
+---
+title: Istio
+weight: 4
+---
\ No newline at end of file
diff --git a/content/rancher/v2.5/en/logging/_index.md b/content/rancher/v2.x/en/dashboard/logging/_index.md
similarity index 94%
rename from content/rancher/v2.5/en/logging/_index.md
rename to content/rancher/v2.x/en/dashboard/logging/_index.md
index 41cca5d4138..cdd2711b5e6 100644
--- a/content/rancher/v2.5/en/logging/_index.md
+++ b/content/rancher/v2.x/en/dashboard/logging/_index.md
@@ -3,12 +3,12 @@ title: Rancher Integration with Logging Services
 shortTitle: Logging
 description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster.
 metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
-weight: 9
+weight: 3
 ---
 
 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
 - [Configuring the Logging Output for the Rancher Kubernetes Cluster](#configuring-the-logging-output-for-the-rancher-kubernetes-cluster)
-- [Enabling Logging for Rancher Managed Clusters with ECM](#enabling-logging-for-rancher-managed-clusters-with-ecm)
+- [Enabling Logging for Rancher Managed Clusters](#enabling-logging-for-rancher-managed-clusters)
 - [Configuring the Logging Application](#configuring-the-logging-application)
 
 
@@ -35,7 +35,7 @@ If you install Rancher as a Helm chart, you'll configure the Helm chart options
 
 If you install Rancher using the Rancher CLI on an Linux OS,  the Rancher Helm chart will be installed on a Kubernetes cluster with default options. Then when the Rancher UI is available, you'll enable the logging app from the Apps section of the UI. Then during the process of installing the logging application, you will configure the logging output.
 
-### Enabling Logging for Rancher Managed Clusters with ECM
+### Enabling Logging for Rancher Managed Clusters
 
 If you have Enterprise Cluster Manager enabled, you can enable the logging for a Rancher managed cluster by going to the Apps page and installing the logging app.
 
diff --git a/content/rancher/v2.5/en/monitoring/_index.md b/content/rancher/v2.x/en/dashboard/monitoring-alerting/_index.md
similarity index 52%
rename from content/rancher/v2.5/en/monitoring/_index.md
rename to content/rancher/v2.x/en/dashboard/monitoring-alerting/_index.md
index fcfeb1b2d08..dce5a8af638 100644
--- a/content/rancher/v2.5/en/monitoring/_index.md
+++ b/content/rancher/v2.x/en/dashboard/monitoring-alerting/_index.md
@@ -1,8 +1,8 @@
 ---
 title: Integrating Rancher and Prometheus for Cluster Monitoring
-shortTitle: Monitoring
+shortTitle: Monitoring/Alerting
 description: Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Learn about the scope of monitoring and how to enable cluster monitoring
-weight: 10
+weight: 2
 ---
 
 Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
@@ -15,21 +15,25 @@ This section covers the following topics:
 - [About Prometheus](#about-prometheus)
 - [Monitoring scope](#monitoring-scope)
 - [Enabling cluster monitoring](#enabling-cluster-monitoring)
-- [Resource consumption](#resource-consumption)
-  - [Resource consumption of Prometheus pods](#resource-consumption-of-prometheus-pods)
-  - [Resource consumption of other pods](#resources-consumption-of-other-pods)
+- [Configuration](#configuration)
+- [Examples](#examples)
+  - [Create ServiceMonitor Custom Resource](#create-servicemonitor-custom-resource)
+  - [PodMonitor](#podmonitor)
+  - [PrometheusRule](#prometheusrule)
+  - [Alertmanager Config](#alertmanager-config)
+  - [Configuring a Persistent Grafana Dashboard](#configuring-a-persistent-grafana-dashboard)
+  - [Configuring Grafana to Use Multiple Data Sources](#configuring-grafana-to-use-multiple-data-sources)
+
 
 # Changes in Rancher v2.5
 
-Rancher's monitoring application is now powered by the Prometheus operator and relies less on Rancher's in-house monitoring tools.
+Rancher's monitoring application is powered by the Prometheus operator, and it now relies less on Rancher's in-house monitoring tools.
 
-This change allows Rancher to automatically support new features of the Prometheus operator API.
+This change allows Rancher to automatically support new features of the Prometheus operator API. Now all of the features exposed by the upstream Prometheus operator are available in the monitoring application, and you have more flexibility to configure monitoring.
 
 Previously, you would use the Rancher UI to configure monitoring. The Rancher UI created CRDs that were maintained by Rancher and updated the Prometheus state. In Rancher v2.5, you directly create CRDs for the monitoring application, and those CRDs are exposed in the Rancher UI.
 
-For information on configuring custom Prometheus metrics and alerting rules, refer to the upstream documentation for the [Prometheus operator.](https://github.com/prometheus-operator/prometheus-operator) This documentation can also help you set up RBAC, Thanos, or custom configuration.
-
-The Rancher monitoring application's Helm chart comes with a README that provides documentation. If you want to set up monitoring with advanced features, you can enable them when deploying the application.
+The differences between Rancher's monitoring feature and the upstream Prometheus operator can be found in the [changelog.](https://github.com/rancher/charts/blob/dev-v2.5/packages/rancher-monitoring/overlay/CHANGELOG.md)
 
 # About Prometheus
 
@@ -56,3 +60,39 @@ As an [administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-p
 > **Prerequisite:** Make sure that you are allowing traffic on port 9796 for each of your nodes because Prometheus will scrape metrics from here.
 
 > The default username and password for the Grafana instance will be `admin/admin`. However, Grafana dashboards are served via the Rancher authentication proxy, so only users who are currently authenticated into the Rancher server have access to the Grafana dashboard.
+
+# Configuration
+
+For information on configuring custom Prometheus metrics and alerting rules, refer to the upstream documentation for the [Prometheus operator.](https://github.com/prometheus-operator/prometheus-operator) This documentation can help you set up RBAC, Thanos, or custom configuration.
+
+To create an additional scrape configuration, refer to [this page.](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/additional-scrape-config.md)
+
+# Examples
+
+### Create ServiceMonitor Custom Resource
+
+An example ServiceMonitor custom resource can be found [here.](https://github.com/prometheus-operator/prometheus-operator/blob/master/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml) 
+
+### PodMonitor
+
+An example PodMonitor can be found [here.](https://github.com/prometheus-operator/prometheus-operator/blob/master/example/user-guides/getting-started/example-app-pod-monitor.yaml) and an example Prometheus resource that refers to it can be found [here.](https://github.com/prometheus-operator/prometheus-operator/blob/master/example/user-guides/getting-started/prometheus-pod-monitor.yaml)
+
+### PrometheusRule
+
+Prometheus rule files are held in PrometheusRule custom resources. Use the label selector field ruleSelector in the Prometheus object to define the rule files that you want to be mounted into Prometheus. An example PrometheusRule is on [this page.](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/alerting.md)
+
+### Alertmanager Config
+
+The Prometheus Operator introduces an Alertmanager resource, which allows users to declaratively describe an Alertmanager cluster.
+
+The upstream Prometheus documentation includes information on how to [set up](https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/user-guides/alerting.md) and [configure](https://prometheus.io/docs/alerting/latest/configuration/) Alertmanager.
+
+### Configuring a Persistent Grafana Dashboard
+
+To allow the Grafana dashboard to persist after it restarts, you will need to add the configuration JSON into a ConfigMap.
+
+You can add this configuration to the ConfigMap using the Rancher UI.
+
+### Configuring Grafana to Use Multiple Data Sources
+
+The data from Prometheus is used as the data source for the Grafana dashboard. Multiple data sources can be configured for Grafana.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/opa/_index.md b/content/rancher/v2.x/en/dashboard/opa/_index.md
new file mode 100644
index 00000000000..3ea91a4c4c9
--- /dev/null
+++ b/content/rancher/v2.x/en/dashboard/opa/_index.md
@@ -0,0 +1,4 @@
+---
+title: OPA
+weight: 5
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/repos/_index.md b/content/rancher/v2.x/en/dashboard/repos/_index.md
new file mode 100644
index 00000000000..6e952ef3484
--- /dev/null
+++ b/content/rancher/v2.x/en/dashboard/repos/_index.md
@@ -0,0 +1,4 @@
+---
+title: Repos
+weight: 8
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
index be3c42f9c0c..74aa80b7789 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
@@ -89,7 +89,7 @@ These instructions are adapted from the [official cert-manager documentation](ht
 
 ```
 # Install the CustomResourceDefinition resources separately
-kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
+kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.0/cert-manager.crds.yaml
 
 # **Important:**
 # If you are running Kubernetes v1.15 or below, you
@@ -114,11 +114,7 @@ helm repo update
 helm install \
   cert-manager jetstack/cert-manager \
   --namespace cert-manager \
-<<<<<<< HEAD
-  --version v0.14.2
-=======
   --version v0.15.0
->>>>>>> jetstack cert-manager doc update
 ```
 
 Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
index 1767e4b7eb6..c1798f6ac09 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
@@ -87,12 +87,12 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
    ```plain
-   helm fetch jetstack/cert-manager --version v0.14.2
+   helm fetch jetstack/cert-manager --version v0.12.0
    ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
    ```plain
-   helm template ./cert-manager-v0.14.2.tgz --output-dir . \
+   helm template ./cert-manager-v0.12.0.tgz --output-dir . \
        --name cert-manager --namespace cert-manager \
        --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
        --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
@@ -101,7 +101,7 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 
 1. Download the required CRD file for cert-manager
    ```plain
-   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
+   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
    ```
 1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
 
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
index d5f39548c7c..b96ca100b47 100644
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
@@ -58,7 +58,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS
     ```plain
     helm repo add jetstack https://charts.jetstack.io
     helm repo update
-    helm fetch jetstack/cert-manager --version v0.14.2
+    helm fetch jetstack/cert-manager --version v0.12.0
     helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
     ```
 
@@ -220,7 +220,7 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
       ```plain
       helm repo add jetstack https://charts.jetstack.io
       helm repo update
-      helm fetch jetstack/cert-manager --version v0.14.2
+      helm fetch jetstack/cert-manager --version v0.12.0
       helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
       ```
 
diff --git a/content/rancher/v2.x/en/installation/options/chart-options/_index.md b/content/rancher/v2.x/en/installation/options/chart-options/_index.md
index e03b089d8b4..5cec85b61e6 100644
--- a/content/rancher/v2.x/en/installation/options/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/options/chart-options/_index.md
@@ -139,7 +139,7 @@ If you have private registries, catalogs or a proxy that intercepts certificates
 Once the Rancher deployment is created, copy your CA certs in pem format into a file named `ca-additional.pem` and use `kubectl` to create the `tls-ca-additional` secret in the `cattle-system` namespace.
 
 ```plain
-kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem
+kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem
 ```
 
 ### Private Registry and Air Gap Installs
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
index 3aba76da34c..ddd8d3db46e 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
@@ -79,7 +79,7 @@ These instructions are adapted from the [official cert-manager documentation](ht
     helm install \
       --name cert-manager \
       --namespace cert-manager \
-      --version v0.14.2 \
+      --version v0.12.0 \
       jetstack/cert-manager
     ```
 
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
index e773074fc13..261365488ac 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
@@ -135,7 +135,7 @@ If you have private registries, catalogs or a proxy that intercepts certificates
 Once the Rancher deployment is created, copy your CA certs in pem format into a file named `ca-additional.pem` and use `kubectl` to create the `tls-ca-additional` secret in the `cattle-system` namespace.
 
 ```plain
-kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem
+kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem
 ```
 
 ### Private Registry and Air Gap Installs
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
index 403cb958356..65a9b8435fa 100644
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
+++ b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
@@ -27,9 +27,7 @@ If you are using a private CA, Rancher requires a copy of the CA certificate whi
 
 Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
 
->**Important:** Make sure the file is called `cacerts.pem` as Rancher uses that filename to configure the CA certificate.
-
 ```
 kubectl -n cattle-system create secret generic tls-ca \
-  --from-file=cacerts.pem
+  --from-file=cacerts.pem=./cacerts.pem
 ```
diff --git a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
index 933bd4d5645..9693d584b0b 100644
--- a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
+++ b/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
@@ -28,11 +28,9 @@ If you are using a private CA, Rancher requires a copy of the CA certificate whi
 
 Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
 
->**Important:** Make sure the file is called `cacerts.pem` as Rancher uses that filename to configure the CA certificate.
-
 ```
 kubectl -n cattle-system create secret generic tls-ca \
-  --from-file=cacerts.pem
+  --from-file=cacerts.pem=./cacerts.pem
 ```
 
 > **Note:** The configured `tls-ca` secret is retrieved when Rancher starts. On a running Rancher installation the updated CA will take effect after new Rancher pods are started.
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
index e0afe6897d1..2f224f311b3 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
@@ -8,7 +8,6 @@ Rancher uses cert-manager to automatically generate and renew TLS certificates f
 1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
 1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/). This change has no exact deadline.
 1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
-1. [Cert-manager is changing the Deployment selector](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/)
 
 To address these changes, this guide will do two things:
 
@@ -19,21 +18,14 @@ To address these changes, this guide will do two things:
 > If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them:
 
 > 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server
-> 2. Uninstall Rancher, cert-manager and the CustomResourceDefinition for cert-manager
-> 3. Install the new CustomResourceDefinition for cert-manager, cert-manager and the newer version of Rancher 
+> 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager
+> 3. Install the newer version of Rancher and cert-manager 
 
 > The reason is that when Helm upgrades Rancher, it will reject the upgrade and show error messages if the running Rancher app does not match the chart template used to install it. Because cert-manager changed its API group and we cannot modify released charts for Rancher, there will always be a mismatch on the cert-manager's API version, therefore the upgrade will be rejected.
 
 > For reinstalling Rancher with Helm, please check [Option B: Reinstalling Rancher Chart]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/#c-upgrade-rancher) under the upgrade Rancher section. 
 
-## Upgrade Cert-Manager Only 
-
-If you are running cert-manager version 0.11.x or above, please follow official [upgrading doc](https://cert-manager.io/docs/installation/upgrading/#upgrading-with-helm) to upgrade it using helm. 
-
-Continue reading if you are coming from a cert-manager version older than 0.11
-
-> **Note:**
-> These instructions are applied if you have no plan to upgrade Rancher. 
+## Upgrade Cert-Manager
 
 The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-\* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues.
 
@@ -67,7 +59,7 @@ In order to upgrade cert-manager, follow these instructions:
 1. Install the CustomResourceDefinition resources separately
 
     ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
+    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
     ```
 
     > **Note:**
@@ -97,7 +89,7 @@ In order to upgrade cert-manager, follow these instructions:
     helm install \
       cert-manager jetstack/cert-manager \
       --namespace cert-manager \
-      --version v0.14.2 
+      --version v0.12.0 
     ```
 
 1. [Restore back up resources](https://cert-manager.io/docs/tutorials/backup/#restoring-resources)
@@ -125,7 +117,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
     ```plain
-    helm fetch jetstack/cert-manager --version v0.14.2
+    helm fetch jetstack/cert-manager --version v0.12.0
     ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
@@ -133,7 +125,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
     The Helm 3 command is as follows:
 
     ```plain
-    helm template cert-manager ./cert-manager-v0.14.2.tgz --output-dir . \
+    helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
     --namespace cert-manager \
     --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
     --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
@@ -143,7 +135,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
     The Helm 2 command is as follows:
 
     ```plain
-    helm template ./cert-manager-v0.14.2.tgz --output-dir . \
+    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
     --name cert-manager --namespace cert-manager \
     --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
     --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
@@ -153,7 +145,7 @@ Before you can perform the upgrade, you must prepare your air gapped environment
 1. Download the required CRD file for cert-manager (old and new)
 
     ```plain
-    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
+    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
     curl -L -o cert-manager/cert-manager-crd-old.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-X.Y/deploy/manifests/00-crds.yaml
     ```
 
@@ -238,7 +230,5 @@ We have also removed support for the old configuration format that was deprecate
 
 Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
 
-Details about the change and migration instructions can be found in the [cert-manager v0.13 to v0.14 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/).
-
 More info about [cert-manager upgrade information](https://cert-manager.io/docs/installation/upgrading/).
 
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
index bb3e77d418c..4aee1733f98 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
+++ b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
@@ -8,7 +8,6 @@ Rancher uses cert-manager to automatically generate and renew TLS certificates f
 1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
 1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.7-0.8.html#upgrading-from-v0-7-to-v0-8). This change has no exact deadline.
 1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
-1. [Cert-manager is changing the Deployment selector](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/)
 
 To address these changes, this guide will do two things:
 
@@ -28,10 +27,6 @@ To address these changes, this guide will do two things:
 
 ## Upgrade Cert-Manager Only 
 
-If you are running cert-manager version 0.11.x or above, please follow official [upgrading doc](https://cert-manager.io/docs/installation/upgrading/#upgrading-with-helm) to upgrade it using helm.
-
-Continue reading if you are comming from a cert-manager version older than 0.11
-
 > **Note:**
 > These instructions are applied if you have no plan to upgrade Rancher. 
 
@@ -73,7 +68,7 @@ In order to upgrade cert-manager, follow these instructions:
 1. Install the new version of cert-manager
 
     ```plain
-    helm install --version 0.14.2 --name cert-manager --namespace kube-system jetstack/cert-manager
+    helm install --version 0.12.0 --name cert-manager --namespace kube-system jetstack/cert-manager
     ```
 {{% /accordion %}}
 
@@ -94,13 +89,13 @@ Before you can perform the upgrade, you must prepare your air gapped environment
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
     ```plain
-    helm fetch jetstack/cert-manager --version v0.14.2
+    helm fetch jetstack/cert-manager --version v0.12.0
     ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
 
     ```plain
-    helm template ./cert-manager-v0.14.2.tgz --output-dir . \
+    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
     --name cert-manager --namespace kube-system \
     --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
     --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
@@ -174,6 +169,4 @@ We have also removed support for the old configuration format that was deprecate
 
 Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
 
-Details about the change and migration instructions can be found in the [cert-manager v0.13 to v0.14 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.13-0.14/).
-
 For information on upgrading from all other versions of cert-manager, refer to the [official documentation](https://cert-manager.io/docs/installation/upgrading/).
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index 08505aafb3a..80281d3e061 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -85,12 +85,12 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
 
    ```plain
-   helm fetch jetstack/cert-manager --version v0.14.2
+   helm fetch jetstack/cert-manager --version v0.12.0
    ```
 
 1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
    ```plain
-   helm template cert-manager ./cert-manager-v0.14.2.tgz --output-dir . \
+   helm template cert-manager ./cert-manager-v0.12.0.tgz --output-dir . \
        --namespace cert-manager \
        --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller \
        --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook \
@@ -99,7 +99,7 @@ By default, Rancher generates a CA and uses cert-manager to issue the certificat
 
 1. Download the required CRD file for cert-manager
    ```plain
-   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.14/deploy/manifests/00-crds.yaml
+   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
    ```
 1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
 
@@ -204,9 +204,10 @@ Install Rancher:
 kubectl create namespace cattle-system
 kubectl -n cattle-system apply -R -f ./rancher
 ```
-
 **Step Result:** If you are installing Rancher v2.3.0+, the installation is complete.
 
+> **Note:** If you don't intend to send telemetry data, opt out [telemetry]({{<baseurl>}}/rancher/v2.x/en/faq/telemetry/) during the initial login. Leaving this active in an air-gapped environment can cause issues if the sockets cannot be opened successfully.
+
 ### E. For Rancher versions prior to v2.3.0, Configure System Charts
 
 If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
@@ -326,6 +327,8 @@ docker run -d --restart=unless-stopped \
 
 If you are installing Rancher v2.3.0+, the installation is complete.
 
+> **Note:** If you don't intend to send telemetry data, opt out [telemetry]({{<baseurl>}}/rancher/v2.x/en/faq/telemetry/) during the initial login.
+
 If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
 
 {{% /tab %}}
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
index 346e7bd8304..6cef213e1ae 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
@@ -59,7 +59,7 @@ In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS
     ```plain
     helm repo add jetstack https://charts.jetstack.io
     helm repo update
-    helm fetch jetstack/cert-manager --version v0.14.2
+    helm fetch jetstack/cert-manager --version v0.12.0
     helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
     ```
 
@@ -226,7 +226,7 @@ The workstation must have Docker 18.02+ in order to support manifests, which are
       ```plain
       helm repo add jetstack https://charts.jetstack.io
       helm repo update
-      helm fetch jetstack/cert-manager --version v0.14.2
+      helm fetch jetstack/cert-manager --version v0.12.0
       helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
       ```
 
diff --git a/content/rancher/v2.x/en/installation/requirements/installing-docker/_index.md b/content/rancher/v2.x/en/installation/requirements/installing-docker/_index.md
index ac20da0afe8..b9f42e85179 100644
--- a/content/rancher/v2.x/en/installation/requirements/installing-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/requirements/installing-docker/_index.md
@@ -9,10 +9,10 @@ There are a couple of options for installing Docker. One option is to refer to t
 
 Another option is to use one of Rancher's Docker installation scripts, which are available for most recent versions of Docker.
 
-For example, this command could be used to install Docker 18.09 on Ubuntu:
+For example, this command could be used to install Docker 19.03 on Ubuntu:
 
 ```
-curl https://releases.rancher.com/install-docker/18.09.sh | sh
+curl https://releases.rancher.com/install-docker/19.03.sh | sh
 ```
 
-To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts.
\ No newline at end of file
+Rancher has installation scripts for every version of upstream Docker that Kubernetes supports. To find out whether a script is available for installing a certain Docker version, refer to this [GitHub repository,](https://github.com/rancher/install-docker) which contains all of Rancher's Docker installation scripts.
diff --git a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
index 2d836d12fc0..a67a0c6cbad 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
@@ -3,7 +3,7 @@ title: CIS Benchmark Rancher Self-Assessment Guide - v2.3.5
 weight: 205
 ---
 
-### CIS Kubernetes Benchmark 1.5 - Rancher 2.3.5 with Kubernetes 1.15
+### CIS Kubernetes Benchmark v1.5 - Rancher v2.3.5 with Kubernetes v1.15
 
 [Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.3.5/Rancher_Benchmark_Assessment.pdf)
 
@@ -1530,31 +1530,99 @@ RKE doesn’t require or maintain a configuration file for the kubelet service.
 
 #### 4.1.3 Ensure that the proxy kubeconfig file permissions are set to `644` or more restrictive (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the proxy service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example,
+
+``` bash
+chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present
+```
 
 #### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to `root:root` (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the proxy service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example, 
+
+``` bash
+chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'root:root' is present
+```
 
 #### 4.1.5 Ensure that the kubelet.conf file permissions are set to `644` or more restrictive (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example,
+
+``` bash
+chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present
+```
 
 #### 4.1.6 Ensure that the kubelet.conf file ownership is set to `root:root` (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example,
+
+``` bash
+chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'root:root' is equal to 'root:root'
+```
 
 #### 4.1.7 Ensure that the certificate authorities file permissions are set to `644` or more restrictive (Scored)
 
@@ -1975,7 +2043,7 @@ systemctl restart kubelet.service
 
 #### 5.1.5 Ensure that default service accounts are not actively used. (Scored)
 
-**Result:** FAIL
+**Result:** PASS
 
 **Remediation:**
 Create explicit service accounts wherever a Kubernetes workload requires specific access
@@ -2001,13 +2069,20 @@ fi
 
 accounts="$(kubectl --kubeconfig=${KUBECONFIG} get serviceaccounts -A -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true)) | "fail \(.metadata.name) \(.metadata.namespace)"')"
 
-if [[ "${accounts}" == "" ]]; then
-  echo "--pass"
-  exit 0
+if [[ "${accounts}" != "" ]]; then
+  echo "fail: automountServiceAccountToken not false for accounts: ${accounts}"
+  exit 1
 fi
 
-echo ${accounts}
-exit 1
+default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name=="default").metadata.uid' | wc -l)"
+
+if [[ "${default_binding}" -gt 0 ]]; then
+	echo "fail: default service accounts have non default bindings"
+	exit 1
+fi
+
+echo "--pass"
+exit 0
 ```
 
 **Audit Execution:**
diff --git a/content/rancher/v2.x/en/security/benchmark-2.4/_index.md b/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
index e5a16487085..672fbba7826 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
@@ -1530,31 +1530,99 @@ RKE doesn’t require or maintain a configuration file for the kubelet service.
 
 #### 4.1.3 Ensure that the proxy kubeconfig file permissions are set to `644` or more restrictive (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the proxy service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example,
+
+``` bash
+chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present
+```
 
 #### 4.1.4 Ensure that the proxy kubeconfig file ownership is set to `root:root` (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the proxy service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example, 
+
+``` bash
+chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'root:root' is present
+```
 
 #### 4.1.5 Ensure that the kubelet.conf file permissions are set to `644` or more restrictive (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example,
+
+``` bash
+chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present
+```
 
 #### 4.1.6 Ensure that the kubelet.conf file ownership is set to `root:root` (Scored)
 
-**Result:** Not Applicable
+**Result:** PASS
 
 **Remediation:**
-RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
+Run the below command (based on the file location on your system) on the each worker node.
+For example,
+
+``` bash
+chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
+```
+
+**Audit:**
+
+```
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' 
+```
+
+**Expected result**:
+
+```
+'root:root' is equal to 'root:root'
+```
 
 #### 4.1.7 Ensure that the certificate authorities file permissions are set to `644` or more restrictive (Scored)
 
@@ -1813,7 +1881,7 @@ systemctl restart kubelet.service
 **Expected result**:
 
 ```
-'1800s' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present
+'30m' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present
 ```
 
 #### 4.2.6 Ensure that the ```--protect-kernel-defaults``` argument is set to `true` (Scored)
@@ -1975,7 +2043,7 @@ systemctl restart kubelet.service
 
 #### 5.1.5 Ensure that default service accounts are not actively used. (Scored)
 
-**Result:** FAIL
+**Result:** PASS
 
 **Remediation:**
 Create explicit service accounts wherever a Kubernetes workload requires specific access
@@ -2006,7 +2074,7 @@ if [[ "${accounts}" != "" ]]; then
   exit 1
 fi
 
-default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name!="default").metadata.uid' | wc -l)"
+default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name=="default").metadata.uid' | wc -l)"
 
 if [[ "${default_binding}" -gt 0 ]]; then
 	echo "fail: default service accounts have non default bindings"
diff --git a/content/rancher/v2.x/en/security/hardening-2.3/_index.md b/content/rancher/v2.x/en/security/hardening-2.3/_index.md
index f237643c192..fb495c04b2a 100644
--- a/content/rancher/v2.x/en/security/hardening-2.3/_index.md
+++ b/content/rancher/v2.x/en/security/hardening-2.3/_index.md
@@ -608,22 +608,20 @@ To pass the following controls for the kube-api server ensure RKE configuration
 services:
   kube-api:
     pod_security_policy: true
+    event_rate_limit:
+      enabled: true
     extra_args:
       anonymous-auth: "false"
       profiling: "false"
       service-account-lookup: "true"
       enable-admission-plugins: "ServiceAccount,NamespaceLifecycle,LimitRanger,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds,AlwaysPullImages,DenyEscalatingExec,NodeRestriction,EventRateLimit,PodSecurityPolicy"
-      encryption-provider-config: /opt/kubernetes/encryption.yaml
-      admission-control-config-file: "/opt/kubernetes/admission.yaml"
       audit-log-path: "/var/log/kube-audit/audit-log.json"
       audit-log-maxage: "5"
       audit-log-maxbackup: "5"
       audit-log-maxsize: "100"
       audit-log-format: "json"
-      audit-policy-file: /opt/kubernetes/audit.yaml
       tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
     extra_binds:
-      - "/var/log/kube-audit:/var/log/kube-audit"
       - "/opt/kubernetes:/opt/kubernetes"
 ```
 
@@ -1269,13 +1267,13 @@ services:
       generate_serving_certificate: true
   kube-api:
     pod_security_policy: true
+    event_rate_limit:
+      enabled: true
     extra_args:
       anonymous-auth: "false"
       profiling: "false"
       service-account-lookup: "true"
       enable-admission-plugins: "ServiceAccount,NamespaceLifecycle,LimitRanger,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds,AlwaysPullImages,DenyEscalatingExec,NodeRestriction,EventRateLimit,PodSecurityPolicy"
-      encryption-provider-config: /opt/kubernetes/encryption.yaml
-      admission-control-config-file: "/opt/kubernetes/admission.yaml"
       audit-log-path: "/var/log/kube-audit/audit-log.json"
       audit-log-maxage: "5"
       audit-log-maxbackup: "5"
@@ -1284,7 +1282,6 @@ services:
       audit-policy-file: /opt/kubernetes/audit.yaml
       tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
     extra_binds:
-      - "/var/log/kube-audit:/var/log/kube-audit"
       - "/opt/kubernetes:/opt/kubernetes"
   scheduler:
     extra_args:
@@ -1438,6 +1435,7 @@ addons: |
 #
 # Cluster Config
 #
+default_pod_security_policy_template_id: restricted
 docker_root_dir: /var/lib/docker
 enable_cluster_alerting: false
 enable_cluster_monitoring: false
@@ -1500,24 +1498,22 @@ rancher_kubernetes_engine_config:
       uid: 1001
     kube_api:
       always_pull_images: false
+      event_rate_limit:
+        enabled: true
       extra_args:
-        admission-control-config-file: /opt/kubernetes/admission.yaml
         anonymous-auth: 'false'
         audit-log-format: json
         audit-log-maxage: '5'
         audit-log-maxbackup: '5'
         audit-log-maxsize: '100'
         audit-log-path: /var/log/kube-audit/audit-log.json
-        audit-policy-file: /opt/kubernetes/audit.yaml
         enable-admission-plugins: >-
           ServiceAccount,NamespaceLifecycle,LimitRanger,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota,DefaultTolerationSeconds,AlwaysPullImages,DenyEscalatingExec,NodeRestriction,EventRateLimit,PodSecurityPolicy
-        encryption-provider-config: /opt/kubernetes/encryption.yaml
         profiling: 'false'
         service-account-lookup: 'true'
         tls-cipher-suites: >-
           TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
       extra_binds:
-        - '/var/log/kube-audit:/var/log/kube-audit'
         - '/opt/kubernetes:/opt/kubernetes'
       pod_security_policy: true
       service_node_port_range: 30000-32767

From 8678b0ef28b25bd363c757dbd99b214d3cd6d170 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 28 Aug 2020 14:50:55 -0700
Subject: [PATCH 192/265] Reorganize doc structure

---
 .../rancher/v2.x/en/admin-settings/_index.md  |   2 +-
 content/rancher/v2.x/en/api/_index.md         |   2 +-
 content/rancher/v2.x/en/backups/_index.md     |   2 +-
 .../rancher/v2.x/en/backups/backups/_index.md |   2 +-
 .../en/backups/backups/k8s-backups/_index.md  |   6 +
 .../{ => k8s-backups}/ha-backups/_index.md    |   2 +
 .../{ => k8s-backups}/k3s-backups/_index.md   |   3 +
 .../backups/single-node-backups/_index.md     |   1 +
 .../v2.x/en/backups/restorations/_index.md    |   2 +-
 .../restorations/k8s-restore/_index.md        |   4 +
 .../k3s-restore}/_index.md                    |   3 +
 .../rke-restore}/_index.md                    |   5 +-
 .../single-node-restoration/_index.md         |   2 +-
 .../rancher/v2.x/en/best-practices/_index.md  |   2 +-
 content/rancher/v2.x/en/cis-scans/_index.md   | 119 ++++++
 .../v2.x/en/cis-scans/legacy/_index.md        | 147 +++++++
 content/rancher/v2.x/en/cli/_index.md         |   2 +-
 .../rancher/v2.x/en/cluster-admin/_index.md   |   2 +-
 .../v2.x/en/cluster-explorer/_index.md        |   8 +
 .../v2.x/en/cluster-provisioning/_index.md    |   2 +-
 .../hosted-kubernetes-clusters/eks/_index.md  |   8 +
 .../registered-clusters/_index.md             |  12 +
 .../registering/_index.md                     |   4 -
 .../rancher/v2.x/en/contributing/_index.md    |   2 +-
 content/rancher/v2.x/en/dashboard/_index.md   |   4 -
 .../en/dashboard/backup-restore/_index.md     |   4 -
 .../v2.x/en/dashboard/cis-scans/_index.md     |   4 -
 .../en/dashboard/cluster-explorer/_index.md   |   4 -
 .../rancher/v2.x/en/dashboard/opa/_index.md   |   4 -
 .../rancher/v2.x/en/dashboard/repos/_index.md |   4 -
 .../v2.x/en/deploy-across-clusters/_index.md  |  16 +
 .../en/deploy-across-clusters/fleet/_index.md |   8 +
 .../multi-cluster-apps/_index.md              |   5 +-
 content/rancher/v2.x/en/faq/_index.md         |   2 +-
 content/rancher/v2.x/en/helm-charts/_index.md |   6 +
 .../en/helm-charts/apps-marketplace/_index.md |  10 +
 .../legacy-catalogs}/_index.md                |   3 +-
 .../adding-catalogs/_index.md                 |   1 +
 .../legacy-catalogs}/built-in/_index.md       |   1 +
 .../legacy-catalogs}/catalog-config/_index.md |   1 +
 .../legacy-catalogs}/creating-apps/_index.md  |   1 +
 .../legacy-catalogs}/globaldns/_index.md      |   2 +
 .../legacy-catalogs}/launching-apps/_index.md |   0
 .../legacy-catalogs}/managing-apps/_index.md  |   2 +
 .../multi-cluster-apps/_index.md              |   9 +
 .../legacy-catalogs}/tutorial/_index.md       |   2 +
 .../rancher/v2.x/en/installation/_index.md    |   4 +-
 .../install-rancher-on-k8s/_index.md          |  17 +
 .../install}/_index.md                        |  19 +-
 .../install/aks/_index.md                     |   7 +
 .../install/any-k8s/_index.md                 |   7 +
 .../install/eks/_index.md                     |   7 +
 .../install/gke/_index.md                     |   7 +
 .../upgrades-rollbacks}/_index.md             |   9 +-
 .../upgrades-rollbacks}/rollbacks/_index.md   |  13 +-
 .../rollbacks/ha-server-rollbacks/_index.md   |   1 +
 .../upgrades-rollbacks}/upgrades/_index.md    |   6 +-
 .../upgrades-rollbacks}/upgrades/ha/_index.md |   0
 .../upgrades/ha/helm2/_index.md               |   0
 .../migrating-from-rke-add-on/_index.md       |   1 +
 .../upgrades/namespace-migration/_index.md    |   2 +
 .../install-rancher-on-linux/_index.md        |  17 +
 .../install/_index.md                         |  10 +
 .../upgrades-rollbacks/_index.md              |  28 ++
 .../cluster-upgrade/_index.md                 |   8 +
 .../woker-node-upgrade/_index.md              |   8 +
 .../image-upgrade/_index.md                   |   6 +
 .../upgrades-rollbacks/rollbacks/_index.md    |   4 +
 .../en/installation/k8s-install/_index.md     |  52 ---
 .../k8s-install/create-nodes-lb/_index.md     | 130 ------
 .../options/air-gap-helm2/_index.md           |  43 --
 .../air-gap-helm2/install-rancher/_index.md   | 333 ---------------
 .../air-gap-helm2/launch-kubernetes/_index.md |  82 ----
 .../populate-private-registry/_index.md       | 274 ------------
 .../air-gap-helm2/prepare-nodes/_index.md     | 105 -----
 .../3-node-certificate-recognizedca/_index.md | 160 -------
 .../3-node-certificate/_index.md              | 175 --------
 .../3-node-externalssl-certificate/_index.md  | 158 -------
 .../3-node-externalssl-recognizedca/_index.md | 142 -------
 .../options/cluster-yml-templates/_index.md   |   8 -
 .../options/feature-flags/_index.md           | 156 -------
 .../_index.md                                 |  43 --
 .../istio-virtual-service-ui/_index.md        |  34 --
 .../en/installation/options/helm2/_index.md   |  58 ---
 .../options/helm2/create-nodes-lb/_index.md   |  30 --
 .../helm2/create-nodes-lb/nginx/_index.md     |  79 ----
 .../helm2/create-nodes-lb/nlb/_index.md       | 175 --------
 .../options/helm2/helm-init/_index.md         |  66 ---
 .../helm2/helm-init/troubleshooting/_index.md |  23 -
 .../options/helm2/helm-rancher/_index.md      | 218 ----------
 .../helm-rancher/chart-options/_index.md      | 245 -----------
 .../helm2/helm-rancher/tls-secrets/_index.md  |  33 --
 .../helm-rancher/troubleshooting/_index.md    | 133 ------
 .../options/helm2/kubernetes-rke/_index.md    | 132 ------
 .../kubernetes-rke/troubleshooting/_index.md  |  52 ---
 .../options/helm2/rke-add-on/_index.md        |  16 -
 .../helm2/rke-add-on/api-auditing/_index.md   |  55 ---
 .../helm2/rke-add-on/layer-4-lb/_index.md     | 400 -----------------
 .../helm2/rke-add-on/layer-4-lb/nlb/_index.md | 181 --------
 .../helm2/rke-add-on/layer-7-lb/_index.md     | 288 -------------
 .../helm2/rke-add-on/layer-7-lb/alb/_index.md | 103 -----
 .../rke-add-on/layer-7-lb/nginx/_index.md     |  40 --
 .../options/helm2/rke-add-on/proxy/_index.md  |  69 ---
 .../404-default-backend/_index.md             |  48 ---
 .../rke-add-on/troubleshooting/_index.md      |  32 --
 .../generic-troubleshooting/_index.md         | 161 -------
 .../job-complete-status/_index.md             |  62 ---
 .../options/local-system-charts/_index.md     |  68 ---
 .../installation/options/rke-add-on/_index.md |  15 -
 .../options/rke-add-on/api-auditing/_index.md |  55 ---
 .../options/rke-add-on/layer-4-lb/_index.md   | 402 ------------------
 .../rke-add-on/layer-4-lb/nlb/_index.md       | 182 --------
 .../options/rke-add-on/layer-7-lb/_index.md   | 288 -------------
 .../rke-add-on/layer-7-lb/alb/_index.md       | 104 -----
 .../rke-add-on/layer-7-lb/nginx/_index.md     |  41 --
 .../options/rke-add-on/proxy/_index.md        |  71 ----
 .../404-default-backend/_index.md             |  48 ---
 .../rke-add-on/troubleshooting/_index.md      |  32 --
 .../generic-troubleshooting/_index.md         | 161 -------
 .../job-complete-status/_index.md             |  62 ---
 .../single-node-install-external-lb/_index.md | 243 -----------
 .../options/troubleshooting/_index.md         | 189 --------
 .../helm-2-instructions/_index.md             | 172 --------
 .../other-installation-methods/_index.md      |   2 +-
 .../single-node-rollbacks/_index.md           |   3 +-
 .../single-node-upgrades}/_index.md           |   1 +
 .../{options => resources}/_index.md          |  20 +-
 .../installation/resources/advanced/_index.md |   6 +
 .../advanced}/api-audit-log/_index.md         |   4 +-
 .../advanced}/arm64-platform/_index.md        |   6 +-
 .../advanced}/etcd/_index.md                  |   3 +-
 .../advanced}/firewall/_index.md              |   2 +-
 .../chart-options/_index.md                   |  32 +-
 .../choosing-version}/_index.md               |   4 +-
 .../resources/encryption/_index.md            |   6 +
 .../custom-ca-root-certificate/_index.md      |   4 +-
 .../encryption}/tls-secrets/_index.md         |   8 +-
 .../encryption}/tls-settings/_index.md        |   6 +-
 .../upgrading-cert-manager/_index.md          |   2 +-
 .../helm-version/_index.md                    |   4 +-
 .../installing-docker/_index.md               |   2 +
 .../resources/k8s-tutorials/_index.md         |   6 +
 .../k8s-tutorials/ha-RKE}/_index.md           | 115 +----
 .../resources/k8s-tutorials/ha-RKE2/_index.md |   7 +
 .../k8s-tutorials}/how-ha-works/_index.md     |   2 +-
 .../infrastructure-tutorials/_index.md        |  15 +
 .../ec2-node/_index.md                        |   4 +-
 .../infrastructure-tutorials}/nginx/_index.md |   5 +-
 .../infrastructure-tutorials}/nlb/_index.md   |   5 +-
 .../infrastructure-tutorials}/rds/_index.md   |   2 +-
 .../v2.x/en/{dashboard => }/istio/_index.md   |   2 +-
 .../rancher/v2.x/en/istio/legacy/_index.md    |   4 +
 .../legacy/cluster-istio}/_index.md           |  11 +-
 .../legacy}/disabling-istio/_index.md         |   2 +
 .../istio => istio/legacy}/rbac/_index.md     |   2 +
 .../legacy}/release-notes/_index.md           |   2 +
 .../legacy}/resources/_index.md               |   5 +-
 .../istio => istio/legacy}/setup/_index.md    |   2 +
 .../legacy}/setup/deploy-workloads/_index.md  |   2 +
 .../setup/enable-istio-in-cluster/_index.md   |   2 +
 .../enable-istio-with-psp/_index.md           |   2 +
 .../setup/enable-istio-in-namespace/_index.md |   2 +
 .../legacy}/setup/gateway/_index.md           |   2 +
 .../legacy}/setup/node-selectors/_index.md    |   2 +
 .../setup/set-up-traffic-management/_index.md |   2 +
 .../legacy}/setup/view-traffic/_index.md      |   2 +
 .../rancher/v2.x/en/k8s-in-rancher/_index.md  |   2 +-
 .../v2.x/en/{dashboard => }/logging/_index.md |   2 +-
 .../rancher/v2.x/en/logging/legacy/_index.md  |   4 +
 .../legacy/cluster-logging}/_index.md         |   5 +-
 .../cluster-logging}/elasticsearch/_index.md  |   1 +
 .../legacy/cluster-logging}/fluentd/_index.md |   2 +
 .../legacy/cluster-logging}/kafka/_index.md   |   1 +
 .../legacy/cluster-logging}/splunk/_index.md  |   0
 .../legacy/cluster-logging}/syslog/_index.md  |   0
 .../legacy/project-logging}/_index.md         |   4 +-
 .../monitoring-alerting/_index.md             |   4 +-
 .../en/monitoring-alerting/legacy/_index.md   |   4 +
 .../legacy/alerts/cluster-alerts}/_index.md   |   7 +-
 .../cluster-alerts}/default-alerts/_index.md  |   2 +
 .../legacy/alerts/project-alerts}/_index.md   |   4 +-
 .../legacy/monitoring/_index.md               |   4 +
 .../monitoring/cluster-monitoring}/_index.md  |   5 +
 .../cluster-metrics/_index.md                 |   2 +
 .../custom-metrics/_index.md                  |   2 +
 .../cluster-monitoring}/expression/_index.md  |   2 +
 .../cluster-monitoring}/prometheus/_index.md  |   2 +
 .../viewing-metrics/_index.md                 |   2 +
 .../monitoring/project-monitoring}/_index.md  |   4 +-
 .../legacy}/notifiers/_index.md               |   4 +
 .../tools => }/opa-gatekeper/_index.md        |   5 +-
 .../rancher/v2.x/en/project-admin/_index.md   |   2 +-
 .../v2.x/en/project-admin/istio/_index.md     |  21 -
 .../v2.x/en/quick-start-guide/_index.md       |   2 +-
 content/rancher/v2.x/en/security/_index.md    |   2 +-
 .../v2.x/en/security/rancher-2.5/_index.md    |   8 +
 .../en/security/rancher-2.5/k3s/_index.md     |   4 +
 .../rancher-2.5/k3s/benchmark-2.5/_index.md   |   4 +
 .../rancher-2.5/k3s/hardening-2.5/_index.md   |   4 +
 .../security/rancher-2.5/rancherd/_index.md   |   4 +
 .../rancherd/benchmark-2.5/_index.md          |   4 +
 .../rancherd/hardening-2.5/_index.md          |   4 +
 .../en/security/rancher-2.5/rke/_index.md     |   4 +
 .../rancher-2.5/rke/benchmark-2.5/_index.md   |   4 +
 .../rancher-2.5/rke/hardening-2.5/_index.md   |   4 +
 .../v2.x/en/security/security-scan/_index.md  | 252 +----------
 .../rancher/v2.x/en/system-tools/_index.md    |   2 +-
 .../rancher/v2.x/en/troubleshooting/_index.md |   2 +-
 .../rancher/v2.x/en/user-settings/_index.md   |   2 +-
 .../rancher/v2.x/en/v1.6-migration/_index.md  |   2 +-
 210 files changed, 824 insertions(+), 7248 deletions(-)
 create mode 100644 content/rancher/v2.x/en/backups/backups/k8s-backups/_index.md
 rename content/rancher/v2.x/en/backups/backups/{ => k8s-backups}/ha-backups/_index.md (98%)
 rename content/rancher/v2.x/en/backups/backups/{ => k8s-backups}/k3s-backups/_index.md (94%)
 create mode 100644 content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md
 rename content/rancher/v2.x/en/backups/restorations/{k3s-restoration => k8s-restore/k3s-restore}/_index.md (90%)
 rename content/rancher/v2.x/en/backups/restorations/{ha-restoration => k8s-restore/rke-restore}/_index.md (98%)
 create mode 100644 content/rancher/v2.x/en/cis-scans/_index.md
 create mode 100644 content/rancher/v2.x/en/cis-scans/legacy/_index.md
 create mode 100644 content/rancher/v2.x/en/cluster-explorer/_index.md
 create mode 100644 content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md
 delete mode 100644 content/rancher/v2.x/en/cluster-provisioning/registering/_index.md
 delete mode 100644 content/rancher/v2.x/en/dashboard/_index.md
 delete mode 100644 content/rancher/v2.x/en/dashboard/backup-restore/_index.md
 delete mode 100644 content/rancher/v2.x/en/dashboard/cis-scans/_index.md
 delete mode 100644 content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md
 delete mode 100644 content/rancher/v2.x/en/dashboard/opa/_index.md
 delete mode 100644 content/rancher/v2.x/en/dashboard/repos/_index.md
 create mode 100644 content/rancher/v2.x/en/deploy-across-clusters/_index.md
 create mode 100644 content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
 rename content/rancher/v2.x/en/{catalog => deploy-across-clusters}/multi-cluster-apps/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/helm-charts/_index.md
 create mode 100644 content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/_index.md (99%)
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/adding-catalogs/_index.md (99%)
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/built-in/_index.md (98%)
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/catalog-config/_index.md (98%)
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/creating-apps/_index.md (99%)
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/globaldns/_index.md (99%)
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/launching-apps/_index.md (100%)
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/managing-apps/_index.md (98%)
 create mode 100644 content/rancher/v2.x/en/helm-charts/legacy-catalogs/multi-cluster-apps/_index.md
 rename content/rancher/v2.x/en/{catalog => helm-charts/legacy-catalogs}/tutorial/_index.md (98%)
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
 rename content/rancher/v2.x/en/installation/{k8s-install/helm-rancher => install-rancher-on-k8s/install}/_index.md (97%)
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/_index.md (59%)
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/rollbacks/_index.md (88%)
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/rollbacks/ha-server-rollbacks/_index.md (92%)
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/upgrades/_index.md (93%)
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/upgrades/ha/_index.md (100%)
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/upgrades/ha/helm2/_index.md (100%)
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/upgrades/migrating-from-rke-add-on/_index.md (98%)
 rename content/rancher/v2.x/en/{upgrades => installation/install-rancher-on-k8s/upgrades-rollbacks}/upgrades/namespace-migration/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
 create mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/k8s-install/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/air-gap-helm2/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/air-gap-helm2/launch-kubernetes/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/air-gap-helm2/prepare-nodes/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/feature-flags/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/feature-flags/istio-virtual-service-ui/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nginx/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nlb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-init/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-init/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/nlb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/alb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/nginx/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/proxy/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/404-default-backend/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/generic-troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/job-complete-status/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/local-system-charts/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/api-auditing/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/nlb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/alb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/nginx/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/proxy/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/404-default-backend/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/generic-troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/job-complete-status/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/single-node-install-external-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
 rename content/rancher/v2.x/en/{upgrades/rollbacks => installation/other-installation-methods/single-node-docker}/single-node-rollbacks/_index.md (97%)
 rename content/rancher/v2.x/en/{upgrades/upgrades/single-node => installation/other-installation-methods/single-node-docker/single-node-upgrades}/_index.md (99%)
 rename content/rancher/v2.x/en/installation/{options => resources}/_index.md (55%)
 create mode 100644 content/rancher/v2.x/en/installation/resources/advanced/_index.md
 rename content/rancher/v2.x/en/installation/{options => resources/advanced}/api-audit-log/_index.md (99%)
 rename content/rancher/v2.x/en/installation/{options => resources/advanced}/arm64-platform/_index.md (91%)
 rename content/rancher/v2.x/en/installation/{options => resources/advanced}/etcd/_index.md (99%)
 rename content/rancher/v2.x/en/installation/{options => resources/advanced}/firewall/_index.md (99%)
 rename content/rancher/v2.x/en/installation/{options => resources}/chart-options/_index.md (95%)
 rename content/rancher/v2.x/en/installation/{options/server-tags => resources/choosing-version}/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/installation/resources/encryption/_index.md
 rename content/rancher/v2.x/en/installation/{options => resources/encryption}/custom-ca-root-certificate/_index.md (94%)
 rename content/rancher/v2.x/en/installation/{options => resources/encryption}/tls-secrets/_index.md (91%)
 rename content/rancher/v2.x/en/installation/{options => resources/encryption}/tls-settings/_index.md (97%)
 rename content/rancher/v2.x/en/installation/{options => resources/encryption}/upgrading-cert-manager/_index.md (99%)
 rename content/rancher/v2.x/en/installation/{options => resources}/helm-version/_index.md (93%)
 rename content/rancher/v2.x/en/installation/{requirements => resources}/installing-docker/_index.md (92%)
 create mode 100644 content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md
 rename content/rancher/v2.x/en/installation/{k8s-install/kubernetes-rke => resources/k8s-tutorials/ha-RKE}/_index.md (67%)
 create mode 100644 content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md
 rename content/rancher/v2.x/en/installation/{ => resources/k8s-tutorials}/how-ha-works/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
 rename content/rancher/v2.x/en/installation/{options => resources/k8s-tutorials/infrastructure-tutorials}/ec2-node/_index.md (97%)
 rename content/rancher/v2.x/en/installation/{options => resources/k8s-tutorials/infrastructure-tutorials}/nginx/_index.md (95%)
 rename content/rancher/v2.x/en/installation/{options => resources/k8s-tutorials/infrastructure-tutorials}/nlb/_index.md (98%)
 rename content/rancher/v2.x/en/installation/{options => resources/k8s-tutorials/infrastructure-tutorials}/rds/_index.md (99%)
 rename content/rancher/v2.x/en/{dashboard => }/istio/_index.md (64%)
 create mode 100644 content/rancher/v2.x/en/istio/legacy/_index.md
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy/cluster-istio}/_index.md (93%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/disabling-istio/_index.md (94%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/rbac/_index.md (98%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/release-notes/_index.md (93%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/resources/_index.md (98%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/_index.md (97%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/deploy-workloads/_index.md (99%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/enable-istio-in-cluster/_index.md (95%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md (95%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/enable-istio-in-namespace/_index.md (96%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/gateway/_index.md (98%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/node-selectors/_index.md (96%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/set-up-traffic-management/_index.md (96%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/istio => istio/legacy}/setup/view-traffic/_index.md (95%)
 rename content/rancher/v2.x/en/{dashboard => }/logging/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/logging/legacy/_index.md
 rename content/rancher/v2.x/en/{cluster-admin/tools/logging => logging/legacy/cluster-logging}/_index.md (95%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/logging => logging/legacy/cluster-logging}/elasticsearch/_index.md (97%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/logging => logging/legacy/cluster-logging}/fluentd/_index.md (96%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/logging => logging/legacy/cluster-logging}/kafka/_index.md (97%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/logging => logging/legacy/cluster-logging}/splunk/_index.md (100%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/logging => logging/legacy/cluster-logging}/syslog/_index.md (100%)
 rename content/rancher/v2.x/en/{project-admin/tools/logging => logging/legacy/project-logging}/_index.md (98%)
 rename content/rancher/v2.x/en/{dashboard => }/monitoring-alerting/_index.md (98%)
 create mode 100644 content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
 rename content/rancher/v2.x/en/{cluster-admin/tools/alerts => monitoring-alerting/legacy/alerts/cluster-alerts}/_index.md (97%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/alerts => monitoring-alerting/legacy/alerts/cluster-alerts}/default-alerts/_index.md (98%)
 rename content/rancher/v2.x/en/{project-admin/tools/alerts => monitoring-alerting/legacy/alerts/project-alerts}/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md
 rename content/rancher/v2.x/en/{cluster-admin/tools/monitoring => monitoring-alerting/legacy/monitoring/cluster-monitoring}/_index.md (95%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/monitoring => monitoring-alerting/legacy/monitoring/cluster-monitoring}/cluster-metrics/_index.md (98%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/monitoring => monitoring-alerting/legacy/monitoring/cluster-monitoring}/custom-metrics/_index.md (99%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/monitoring => monitoring-alerting/legacy/monitoring/cluster-monitoring}/expression/_index.md (99%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/monitoring => monitoring-alerting/legacy/monitoring/cluster-monitoring}/prometheus/_index.md (98%)
 rename content/rancher/v2.x/en/{cluster-admin/tools/monitoring => monitoring-alerting/legacy/monitoring/cluster-monitoring}/viewing-metrics/_index.md (98%)
 rename content/rancher/v2.x/en/{project-admin/tools/monitoring => monitoring-alerting/legacy/monitoring/project-monitoring}/_index.md (98%)
 rename content/rancher/v2.x/en/{cluster-admin/tools => monitoring-alerting/legacy}/notifiers/_index.md (95%)
 rename content/rancher/v2.x/en/{cluster-admin/tools => }/opa-gatekeper/_index.md (95%)
 delete mode 100644 content/rancher/v2.x/en/project-admin/istio/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/k3s/benchmark-2.5/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/k3s/hardening-2.5/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md

diff --git a/content/rancher/v2.x/en/admin-settings/_index.md b/content/rancher/v2.x/en/admin-settings/_index.md
index 2242b4d3328..0cfab9191f7 100644
--- a/content/rancher/v2.x/en/admin-settings/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Authentication, Permissions and Global Configuration
-weight: 1100
+weight: 6
 aliases:
   - /rancher/v2.x/en/concepts/global-configuration/
   - /rancher/v2.x/en/tasks/global-configuration/
diff --git a/content/rancher/v2.x/en/api/_index.md b/content/rancher/v2.x/en/api/_index.md
index b2f9e84816d..ed20589ce7c 100644
--- a/content/rancher/v2.x/en/api/_index.md
+++ b/content/rancher/v2.x/en/api/_index.md
@@ -1,6 +1,6 @@
 ---
 title: API
-weight: 7500
+weight: 23
 ---
 
 ## How to use the API
diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index d9b66a43114..b15ac0dd7f0 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Backups and Disaster Recovery
-weight: 1000
+weight: 5
 ---
 
 This section is devoted to protecting your data in a disaster scenario.
diff --git a/content/rancher/v2.x/en/backups/backups/_index.md b/content/rancher/v2.x/en/backups/backups/_index.md
index 072c1913cac..635d713f9d2 100644
--- a/content/rancher/v2.x/en/backups/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/backups/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Backups
+title: Backup
 weight: 50
 aliases:
   - /rancher/v2.x/en/installation/after-installation/
diff --git a/content/rancher/v2.x/en/backups/backups/k8s-backups/_index.md b/content/rancher/v2.x/en/backups/backups/k8s-backups/_index.md
new file mode 100644
index 00000000000..000bc49ee7c
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/backups/k8s-backups/_index.md
@@ -0,0 +1,6 @@
+---
+title: Kubernetes Backups
+weight: 1
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md b/content/rancher/v2.x/en/backups/backups/k8s-backups/ha-backups/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/backups/backups/ha-backups/_index.md
rename to content/rancher/v2.x/en/backups/backups/k8s-backups/ha-backups/_index.md
index 808e2377dd6..7700618773a 100644
--- a/content/rancher/v2.x/en/backups/backups/ha-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/backups/k8s-backups/ha-backups/_index.md
@@ -1,9 +1,11 @@
 ---
 title: Backing up Rancher Installed on an RKE Kubernetes Cluster
+shortTitle: RKE Installs
 weight: 2
 aliases:
   - /rancher/v2.x/en/installation/after-installation/k8s-install-backup-and-restoration/
   - /rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration/
+  - /rancher/v2.x/en/backups/backups/ha-backups
 ---
 This section describes how to create backups of your high-availability Rancher install.
 
diff --git a/content/rancher/v2.x/en/backups/backups/k3s-backups/_index.md b/content/rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups/_index.md
similarity index 94%
rename from content/rancher/v2.x/en/backups/backups/k3s-backups/_index.md
rename to content/rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups/_index.md
index 01408849bb0..90ea8eba6f3 100644
--- a/content/rancher/v2.x/en/backups/backups/k3s-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups/_index.md
@@ -1,6 +1,9 @@
 ---
 title: Backing up Rancher Installed on a K3s Kubernetes Cluster
+shortTitle: K3s Installs
 weight: 1
+aliases:
+  - /rancher/v2.x/en/backups/backups/k3s-backups
 ---
 
 When Rancher is installed on a high-availability Kubernetes cluster, we recommend using an external database to store the cluster data.
diff --git a/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md b/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md
index ae0ee7b1ae7..911bd43d124 100644
--- a/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md
@@ -1,5 +1,6 @@
 ---
 title: Backing up Rancher Installed with Docker
+shortTitle: Docker Installs
 weight: 3
 aliases:
   - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/
diff --git a/content/rancher/v2.x/en/backups/restorations/_index.md b/content/rancher/v2.x/en/backups/restorations/_index.md
index 2f32ad1d9e2..2c0c9e6c2c3 100644
--- a/content/rancher/v2.x/en/backups/restorations/_index.md
+++ b/content/rancher/v2.x/en/backups/restorations/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Restorations
+title: Restore
 weight: 1010
 ---
 If you lose the data on your Rancher Server, you can restore it if you have backups stored in a safe location.
diff --git a/content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md b/content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md
new file mode 100644
index 00000000000..04bab5fb1f0
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md
@@ -0,0 +1,4 @@
+---
+title: Kubernetes Installs
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/restorations/k3s-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore/_index.md
similarity index 90%
rename from content/rancher/v2.x/en/backups/restorations/k3s-restoration/_index.md
rename to content/rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore/_index.md
index 16b242a6024..b7b0ae0457e 100644
--- a/content/rancher/v2.x/en/backups/restorations/k3s-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore/_index.md
@@ -1,6 +1,9 @@
 ---
 title: Restoring Rancher Installed on a K3s Kubernetes Cluster
+shortTitle: K3s Installs
 weight: 1
+aliases:
+  - /rancher/v2.x/en/backups/restorations/k3s-restoration
 ---
 
 When Rancher is installed on a high-availability Kubernetes cluster, we recommend using an external database to store the cluster data.
diff --git a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
rename to content/rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore/_index.md
index c04aab3cf55..edcb140139b 100644
--- a/content/rancher/v2.x/en/backups/restorations/ha-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore/_index.md
@@ -1,9 +1,10 @@
 ---
 title: Restoring Backups—Kubernetes installs
-shortTitle: Kubernetes Installs
-weight: 370
+shortTitle: RKE Installs
+weight: 2
 aliases:
   - /rancher/v2.x/en/installation/after-installation/ha-backup-and-restoration/
+  - /rancher/v2.x/en/backups/restorations/ha-restoration
 ---
 
 This procedure describes how to use RKE to restore a snapshot of the Rancher Kubernetes cluster. 
diff --git a/content/rancher/v2.x/en/backups/restorations/single-node-restoration/_index.md b/content/rancher/v2.x/en/backups/restorations/single-node-restoration/_index.md
index aefa51a9da5..e5f2b67f0c3 100644
--- a/content/rancher/v2.x/en/backups/restorations/single-node-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/restorations/single-node-restoration/_index.md
@@ -1,7 +1,7 @@
 ---
 title: Restoring Backups—Docker Installs
 shortTitle: Docker Installs
-weight: 365
+weight: 3
 aliases:
   - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/
 ---
diff --git a/content/rancher/v2.x/en/best-practices/_index.md b/content/rancher/v2.x/en/best-practices/_index.md
index 41bbb4cc9c4..0894996d4c8 100644
--- a/content/rancher/v2.x/en/best-practices/_index.md
+++ b/content/rancher/v2.x/en/best-practices/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Best Practices Guide
-weight: 1000
+weight: 4
 ---
 
 The purpose of this section is to consolidate best practices for Rancher implementations. This also includes recommendations for related technologies, such as Kubernetes, Docker, containers, and more. The objective is to improve the outcome of a Rancher implementation using the operational experience of Rancher and its customers.
diff --git a/content/rancher/v2.x/en/cis-scans/_index.md b/content/rancher/v2.x/en/cis-scans/_index.md
new file mode 100644
index 00000000000..467a03023c6
--- /dev/null
+++ b/content/rancher/v2.x/en/cis-scans/_index.md
@@ -0,0 +1,119 @@
+---
+title: CIS Scans
+weight: 15
+---
+
+_Available as of v2.4.0_
+
+Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
+
+The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
+
+CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
+
+The Benchmark provides recommendations of two types: Scored and Not Scored. We run tests related to only Scored recommendations.
+
+- [About the CIS Benchmark](#about-the-cis-benchmark)
+- [About the generated report](#about-the-generated-report)
+- [Test profiles](#test-profiles)
+- [Skipped and not applicable tests](#skipped-and-not-applicable-tests)
+  - [CIS Benchmark v1.4 skipped tests](#cis-benchmark-v1-4-skipped-tests)
+  - [CIS Benchmark v1.4 not applicable tests](#cis-benchmark-v1-4-not-applicable-tests)
+
+
+# About the CIS Benchmark
+
+The Center for Internet Security is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
+
+CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
+
+The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is [here.](https://learn.cisecurity.org/benchmarks)
+
+To check clusters for CIS Kubernetes Benchmark compliance, the security scan leverages [kube-bench,](https://github.com/aquasecurity/kube-bench) an open-source tool from Aqua Security.
+
+# About the Generated Report
+
+Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format.
+
+As of Rancher v2.4, the scan will use the CIS Benchmark v1.4. The Benchmark version is included in the generated report.
+
+The Benchmark provides recommendations of two types: Scored and Not Scored. Recommendations marked as Not Scored in the Benchmark are not included in the generated report.
+
+Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's [self-assessment guide for the corresponding Kubernetes version.]({{<baseurl>}}/rancher/v2.x/en/security/#the-cis-benchmark-and-self-assessment)
+
+The report contains the following information:
+
+| Column in Report | Description |
+|------------------|-------------|
+| ID               | The ID number of the CIS Benchmark. |
+| Description      | The description of the CIS Benchmark test. |
+| Remediation      | What needs to be fixed in order to pass the test. |
+| State of Test    | Indicates if the test passed, failed, was skipped, or was not applicable. |
+| Node type        | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. |
+| Nodes            | The name(s) of the node that the test was run on. |
+| Passed_Nodes | The name(s) of the nodes that the test passed on. |
+| Failed_Nodes | The name(s) of the nodes that the test failed on. |
+
+Refer to [the table in the cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
+
+
+
+# Test Profiles
+
+For every CIS benchmark version, Rancher ships with two types of profiles. These profiles are named based on the type of cluster (e.g. `RKE`), the CIS benchmark version (e.g. CIS 1.4) and the profile type (e.g. `Permissive` or `Hardened`). For example, a full profile name would be `RKE-CIS-1.4-Permissive`
+
+All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes.
+
+There are 2 types of profiles:
+
+- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests.
+- **Hardened:** This profile will not skip any tests, except for the non-applicable tests.
+
+In order to pass the "Hardened" profile, you will need to follow the steps on the [hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
+
+# Skipped and Not Applicable Tests
+
+### CIS Benchmark v1.4 Skipped Tests
+
+Number | Description | Reason for Skipping
+---|---|---
+1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
+1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
+1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
+1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
+1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
+1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
+2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+
+### CIS Benchmark v1.4 Not Applicable Tests
+
+Number | Description | Reason for being not applicable
+---|---|---
+1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
+1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
+2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+
diff --git a/content/rancher/v2.x/en/cis-scans/legacy/_index.md b/content/rancher/v2.x/en/cis-scans/legacy/_index.md
new file mode 100644
index 00000000000..05b44c346b8
--- /dev/null
+++ b/content/rancher/v2.x/en/cis-scans/legacy/_index.md
@@ -0,0 +1,147 @@
+---
+title: Legacy UI Documentation
+weight: 1
+---
+_Available as of v2.4.0_
+
+- [Prerequisites](#prerequisites)
+- [Running a scan](#running-a-scan)
+- [Scheduling recurring scans](#scheduling-recurring-scans)
+- [Skipping tests](#skipping-tests)
+- [Setting alerts](#setting-alerts)
+- [Deleting a report](#deleting-a-report)
+- [Downloading a report](#downloading-a-report)
+
+
+# Prerequisites
+
+To run security scans on a cluster and access the generated reports, you must be an [Administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [Cluster Owner.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
+
+Rancher can only run security scans on clusters that were created with RKE, which includes custom clusters and clusters that Rancher created in an infrastructure provider such as Amazon EC2 or GCE. Imported clusters and clusters in hosted Kubernetes providers can't be scanned by Rancher.
+
+The security scan cannot run in a cluster that has Windows nodes.
+
+You will only be able to see the CIS scan reports for clusters that you have access to.
+
+# Running a Scan
+
+1. From the cluster view in Rancher, click **Tools > CIS Scans.**
+1. Click **Run Scan.**
+1. Choose a CIS scan profile.
+
+**Result:** A report is generated and displayed in the **CIS Scans** page. To see details of the report, click the report's name.
+
+# Scheduling Recurring Scans
+
+Recurring scans can be scheduled to run on any RKE Kubernetes cluster.
+
+To enable recurring scans, edit the advanced options in the cluster configuration during cluster creation or after the cluster has been created.
+
+To schedule scans for an existing cluster:
+
+1. Go to the cluster view in Rancher.
+1. Click **Tools > CIS Scans.**
+1. Click **Add Schedule.** This takes you to the section of the cluster editing page that is applicable to configuring a schedule for CIS scans. (This section can also be reached by going to the cluster view, clicking **&#8942; > Edit,** and going to the **Advanced Options.**)
+1. In the **CIS Scan Enabled** field, click **Yes.**
+1. In the **CIS Scan Profile** field, choose a **Permissive** or **Hardened** profile. The corresponding CIS Benchmark version is included in the profile name. Note: Any skipped tests [defined in a separate ConfigMap](#skipping-tests) will be skipped regardless of whether a **Permissive** or **Hardened** profile is selected. When selecting the the permissive profile, you should see which tests were skipped by Rancher (tests that are skipped by default for RKE clusters) and which tests were skipped by a Rancher user. In the hardened test profile, the only skipped tests will be skipped by users.
+1. In the **CIS Scan Interval (cron)** job, enter a [cron expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) to define how often the cluster will be scanned.
+1. In the **CIS Scan Report Retention** field, enter the number of past reports that should be kept.
+
+**Result:** The security scan will run and generate reports at the scheduled intervals.
+
+The test schedule can be configured in the `cluster.yml`:
+
+```yaml
+scheduled_cluster_scan:
+    enabled: true
+    scan_config:
+        cis_scan_config:
+            override_benchmark_version: rke-cis-1.4
+            profile: permissive
+    schedule_config:
+        cron_schedule: 0 0 * * *
+        retention: 24
+```
+
+
+# Skipping Tests
+
+You can define a set of tests that will be skipped by the CIS scan when the next report is generated.
+
+These tests will be skipped for subsequent CIS scans, including both manually triggered and scheduled scans, and the tests will be skipped with any profile.
+
+The skipped tests will be listed alongside the test profile name in the cluster configuration options when a test profile is selected for a recurring cluster scan. The skipped tests will also be shown every time a scan is triggered manually from the Rancher UI by clicking **Run Scan.** The display of skipped tests allows you to know ahead of time which tests will be run in each scan.
+
+To skip tests, you will need to define them in a Kubernetes ConfigMap resource. Each skipped CIS scan test is listed in the ConfigMap alongside the version of the CIS benchmark that the test belongs to.
+
+To skip tests by editing a ConfigMap resource,
+
+1. Create a `security-scan` namespace.
+1. Create a ConfigMap named `security-scan-cfg`.
+1. Enter the skip information under the key `config.json` in the following format:
+
+    ```json
+    {
+      "skip": {
+        "rke-cis-1.4": [ 
+          "1.1.1", 
+          "1.2.2"
+        ]
+      }
+    }
+    ```
+    
+    In the example above, the CIS benchmark version is specified alongside the tests to be skipped for that version.
+
+**Result:** These tests will be skipped on subsequent scans that use the defined CIS Benchmark version.
+
+# Setting Alerts
+
+Rancher provides a set of alerts for cluster scans. which are not configured to have notifiers by default:
+
+- A manual cluster scan was completed
+- A manual cluster scan has failures
+- A scheduled cluster scan was completed
+- A scheduled cluster scan has failures
+
+> **Prerequisite:** You need to configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) before configuring, sending, or receiving alerts.
+
+To activate an existing alert for a CIS scan result,
+
+1. From the cluster view in Rancher, click **Tools > Alerts.**
+1. Go to the section called **A set of alerts for cluster scans.**
+1. Go to the alert you want to activate and click **&#8942; > Activate.**
+1. Go to the alert rule group **A set of alerts for cluster scans** and click **&#8942; > Edit.**
+1. Scroll down to the **Alert** section. In the **To** field, select the notifier that you would like to use for sending alert notifications.
+1. Optional: To limit the frequency of the notifications, click on **Show advanced options** and configure the time interval of the alerts.
+1. Click **Save.**
+
+**Result:** The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
+
+To create a new alert,
+
+1. Go to the cluster view and click **Tools > CIS Scans.**
+1. Click **Add Alert.**
+1. Fill out the form. 
+1. Enter a name for the alert.
+1. In the **Is** field, set the alert to be triggered when a scan is completed or when a scan has a failure.
+1. In the **Send a** field, set the alert as a **Critical,** **Warning,** or **Info** alert level.
+1. Choose a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) for the alert.
+
+**Result:** The alert is created and activated. The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
+
+For more information about alerts, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
+
+# Deleting a Report
+
+1. From the cluster view in Rancher, click **Tools > CIS Scans.**
+1. Go to the report that should be deleted.
+1. Click the **&#8942; > Delete.**
+1. Click **Delete.**
+
+# Downloading a Report
+
+1. From the cluster view in Rancher, click **Tools > CIS Scans.**
+1. Go to the report that you want to download. Click **&#8942; > Download.**
+
+**Result:** The report is downloaded in CSV format. For more information on each columns, refer to the [section about the generated report.](#about-the-generated-report)
diff --git a/content/rancher/v2.x/en/cli/_index.md b/content/rancher/v2.x/en/cli/_index.md
index dd4d656fd19..ce2e5e14463 100644
--- a/content/rancher/v2.x/en/cli/_index.md
+++ b/content/rancher/v2.x/en/cli/_index.md
@@ -3,7 +3,7 @@ title: Using the Rancher Command Line Interface
 description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI
 metaTitle: "Using the Rancher Command Line Interface "
 metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI"
-weight: 6000
+weight: 20
 ---
 
 The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI.
diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index 59615cb48a2..022d90a8da5 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Cluster Administration
-weight: 2005
+weight: 8
 ---
 
 After you provision a cluster in Rancher, you can begin using powerful Kubernetes features to deploy and scale your containerized applications in development, testing, or production environments.
diff --git a/content/rancher/v2.x/en/cluster-explorer/_index.md b/content/rancher/v2.x/en/cluster-explorer/_index.md
new file mode 100644
index 00000000000..7f185017440
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-explorer/_index.md
@@ -0,0 +1,8 @@
+---
+title: Cluster Explorer
+weight: 10
+---
+
+_Available as of v2.5_
+
+The cluster explorer is a new feature in Rancher v2.5 that allows you to view and manipulate all of the custom resources and CRDs in a Kubernetes cluster from the Rancher UI.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-provisioning/_index.md b/content/rancher/v2.x/en/cluster-provisioning/_index.md
index eb65528492b..31129b3e6cb 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/_index.md
@@ -1,7 +1,7 @@
 ---
 title: Setting up Kubernetes Clusters in Rancher
 description: Provisioning Kubernetes Clusters
-weight: 2000
+weight: 7
 aliases:
   - /rancher/v2.x/en/concepts/clusters/
   - /rancher/v2.x/en/concepts/clusters/cluster-providers/
diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index 5bb0f86029f..ed2eb5c6632 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -44,6 +44,12 @@ The figure below illustrates the high-level architecture of Rancher 2.x. The fig
 
 Use Rancher to set up and configure your Kubernetes cluster.
 
+The form to create EKS clusters was improved in Rancher 2.5.
+
+{{% tabs %}}
+{{% tab "Rancher v2.5+" %}}
+{{% /tab %}}
+{{% tab "Rancher prior to v2.5" %}}
 1. From the **Clusters** page, click **Add Cluster**.
 
 1. Choose **Amazon EKS**.
@@ -134,6 +140,8 @@ If you chose this option, you must also choose a **VPC & Subnet** that allow you
 1. Click **Create**.
 
 {{< result_create-cluster >}}
+{{% /tab %}}
+{{% /tabs %}}
 
 ## Troubleshooting
 
diff --git a/content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md
new file mode 100644
index 00000000000..6295dad2c16
--- /dev/null
+++ b/content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md
@@ -0,0 +1,12 @@
+---
+title: Registering Clusters
+weight: 6
+---
+
+> This section is under construction.
+
+The following types of Kubernetes clusters can be registered in Rancher:
+
+- K3s
+- RancherD
+- EKS
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-provisioning/registering/_index.md b/content/rancher/v2.x/en/cluster-provisioning/registering/_index.md
deleted file mode 100644
index ee7821d0029..00000000000
--- a/content/rancher/v2.x/en/cluster-provisioning/registering/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Registering K3s, Rancher or EKS Clusters
-weight: 6
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/contributing/_index.md b/content/rancher/v2.x/en/contributing/_index.md
index 1cbf8bd694e..3e9f1b0f4a3 100644
--- a/content/rancher/v2.x/en/contributing/_index.md
+++ b/content/rancher/v2.x/en/contributing/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Contributing to Rancher
-weight: 9000
+weight: 26
 aliases:
   - /rancher/v2.x/en/faq/contributing/
 ---
diff --git a/content/rancher/v2.x/en/dashboard/_index.md b/content/rancher/v2.x/en/dashboard/_index.md
deleted file mode 100644
index 15c9ffb624f..00000000000
--- a/content/rancher/v2.x/en/dashboard/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Dashboard
-weight: 5000
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/backup-restore/_index.md b/content/rancher/v2.x/en/dashboard/backup-restore/_index.md
deleted file mode 100644
index e3e41e6e16b..00000000000
--- a/content/rancher/v2.x/en/dashboard/backup-restore/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Backup and Restore
-weight: 7
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/cis-scans/_index.md b/content/rancher/v2.x/en/dashboard/cis-scans/_index.md
deleted file mode 100644
index 15ced365507..00000000000
--- a/content/rancher/v2.x/en/dashboard/cis-scans/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: CIS Security Scans
-weight: 6
----
diff --git a/content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md b/content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md
deleted file mode 100644
index 006d87e6e3b..00000000000
--- a/content/rancher/v2.x/en/dashboard/cluster-explorer/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Cluster Explorer
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/opa/_index.md b/content/rancher/v2.x/en/dashboard/opa/_index.md
deleted file mode 100644
index 3ea91a4c4c9..00000000000
--- a/content/rancher/v2.x/en/dashboard/opa/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: OPA
-weight: 5
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/dashboard/repos/_index.md b/content/rancher/v2.x/en/dashboard/repos/_index.md
deleted file mode 100644
index 6e952ef3484..00000000000
--- a/content/rancher/v2.x/en/dashboard/repos/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Repos
-weight: 8
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/deploy-across-clusters/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/_index.md
new file mode 100644
index 00000000000..13f60285d81
--- /dev/null
+++ b/content/rancher/v2.x/en/deploy-across-clusters/_index.md
@@ -0,0 +1,16 @@
+---
+title: Deploying Applications across Clusters
+weight: 18
+---
+
+> This section is under construction.
+
+### Fleet
+
+_Available in v2.5_
+
+Refer to the [Fleet documentation.]()
+
+### Legacy UI Documentation for Multi-cluster Apps
+
+Refer to the documentation [here.]()
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
new file mode 100644
index 00000000000..3d66fde4d51
--- /dev/null
+++ b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
@@ -0,0 +1,8 @@
+---
+title: Fleet
+weight: 1
+---
+
+_Available as of Rancher v2.5_
+
+This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/catalog/multi-cluster-apps/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/catalog/multi-cluster-apps/_index.md
rename to content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md
index 37fe0c6304b..ca3f249520b 100644
--- a/content/rancher/v2.x/en/catalog/multi-cluster-apps/_index.md
+++ b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md
@@ -1,7 +1,8 @@
 ---
-title: Multi-Cluster Apps
-weight: 600
+title: Legacy UI Documentation
+weight: 2
 ---
+
 _Available as of v2.2.0_
 
 Typically, most applications are deployed on a single Kubernetes cluster, but there will be times you might want to deploy multiple copies of the same application across different clusters and/or projects. In Rancher, a _multi-cluster application_,  is an application deployed using a Helm chart across multiple clusters. With the ability to deploy the same application across multiple clusters, it avoids the repetition of the same action on each cluster, which could introduce user error during application configuration. With multi-cluster applications, you can customize to have the same configuration across all projects/clusters as well as have the ability to change the configuration based on your target project. Since multi-cluster application is considered a single application, it's easy to manage and maintain this application.
diff --git a/content/rancher/v2.x/en/faq/_index.md b/content/rancher/v2.x/en/faq/_index.md
index 60f260984b5..db87829e1f9 100644
--- a/content/rancher/v2.x/en/faq/_index.md
+++ b/content/rancher/v2.x/en/faq/_index.md
@@ -1,6 +1,6 @@
 ---
 title: FAQ
-weight: 8000
+weight: 24
 aliases:
   - /rancher/v2.x/en/about/
 ---
diff --git a/content/rancher/v2.x/en/helm-charts/_index.md b/content/rancher/v2.x/en/helm-charts/_index.md
new file mode 100644
index 00000000000..bbe3afe2ebc
--- /dev/null
+++ b/content/rancher/v2.x/en/helm-charts/_index.md
@@ -0,0 +1,6 @@
+---
+title: Helm Charts in Rancher
+weight: 17
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md b/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md
new file mode 100644
index 00000000000..907e2ba3d5e
--- /dev/null
+++ b/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md
@@ -0,0 +1,10 @@
+---
+title: Apps and Marketplace
+weight: 1
+---
+
+_Available as of v2.5_
+
+> This section is under construction.
+
+In this section, you'll learn how to manage Helm chart repositories and applications in Rancher.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/catalog/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/catalog/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md
index b6e76fa7b0d..328e1acd5b6 100644
--- a/content/rancher/v2.x/en/catalog/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md
@@ -1,11 +1,12 @@
 ---
-title: Catalogs, Helm Charts and Apps
+title: Legacy UI Documentation
 description: Rancher enables the use of catalogs to repeatedly deploy applications easily. Catalogs are GitHub or Helm Chart repositories filled with deployment-ready apps.
 weight: 4000
 aliases:
   - /rancher/v2.x/en/concepts/global-configuration/catalog/
   - /rancher/v2.x/en/concepts/catalogs/
   - /rancher/v2.x/en/tasks/global-configuration/catalog/
+  - /rancher/v2.x/en/catalog
 ---
 
 Rancher provides the ability to use a catalog of Helm charts that make it easy to repeatedly deploy applications.
diff --git a/content/rancher/v2.x/en/catalog/adding-catalogs/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/adding-catalogs/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/catalog/adding-catalogs/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/adding-catalogs/_index.md
index d8540b3cf42..9e550715817 100644
--- a/content/rancher/v2.x/en/catalog/adding-catalogs/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/adding-catalogs/_index.md
@@ -4,6 +4,7 @@ weight: 200
 aliases:
   - /rancher/v2.x/en/tasks/global-configuration/catalog/adding-custom-catalogs/
   - /rancher/v2.x/en/catalog/custom/adding
+  - /rancher/v2.x/en/catalog/adding-catalogs
 ---
 
 Custom catalogs can be added into Rancher at a global scope, cluster scope, or project scope.
diff --git a/content/rancher/v2.x/en/catalog/built-in/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/built-in/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/catalog/built-in/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/built-in/_index.md
index 5b86667717b..e3b78b13b2a 100644
--- a/content/rancher/v2.x/en/catalog/built-in/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/built-in/_index.md
@@ -3,6 +3,7 @@ title: Enabling and Disabling Built-in Global Catalogs
 weight: 100
 aliases:
   - /rancher/v2.x/en/tasks/global-configuration/catalog/enabling-default-catalogs/
+  - /rancher/v2.x/en/catalog/built-in
 ---
 
 There are default global catalogs packaged as part of Rancher.
diff --git a/content/rancher/v2.x/en/catalog/catalog-config/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/catalog-config/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/catalog/catalog-config/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/catalog-config/_index.md
index 229f65e1c97..15dca5019eb 100644
--- a/content/rancher/v2.x/en/catalog/catalog-config/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/catalog-config/_index.md
@@ -3,6 +3,7 @@ title: Custom Catalog Configuration Reference
 weight: 300
 aliases:
   - /rancher/v2.x/en/catalog/catalog-config
+  - /rancher/v2.x/en/catalog/catalog-config
 ---
 
 Any user can create custom catalogs to add into Rancher. Besides the content of the catalog, users must ensure their catalogs are able to be added into Rancher.
diff --git a/content/rancher/v2.x/en/catalog/creating-apps/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/creating-apps/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/catalog/creating-apps/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/creating-apps/_index.md
index d59893cd9de..ff72fb6bb19 100644
--- a/content/rancher/v2.x/en/catalog/creating-apps/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/creating-apps/_index.md
@@ -4,6 +4,7 @@ weight: 400
 aliases:
   - /rancher/v2.x/en/tasks/global-configuration/catalog/customizing-charts/
   - /rancher/v2.x/en/catalog/custom/creating
+  - /rancher/v2.x/en/catalog/creating-apps
 ---
 
 Rancher's catalog service requires any custom catalogs to be structured in a specific format for the catalog service to be able to leverage it in Rancher.
diff --git a/content/rancher/v2.x/en/catalog/globaldns/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/globaldns/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/catalog/globaldns/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/globaldns/_index.md
index 7be91731f1c..38ab916d26f 100644
--- a/content/rancher/v2.x/en/catalog/globaldns/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/globaldns/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Global DNS
 weight: 5010
+aliases:
+  - /rancher/v2.x/en/catalog/globaldns
 ---
 
 _Available as of v2.2.0_
diff --git a/content/rancher/v2.x/en/catalog/launching-apps/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/launching-apps/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/catalog/launching-apps/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/launching-apps/_index.md
diff --git a/content/rancher/v2.x/en/catalog/managing-apps/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/managing-apps/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/catalog/managing-apps/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/managing-apps/_index.md
index 1351c90b3bc..465f3cd95ce 100644
--- a/content/rancher/v2.x/en/catalog/managing-apps/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/managing-apps/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Managing Catalog Apps
 weight: 500
+aliases:
+  - /rancher/v2.x/en/catalog/managing-apps
 ---
 
 After deploying an application, one of the benefits of using an application versus individual workloads/resources is the ease of being able to manage many workloads/resources applications. Apps can be cloned, upgraded or rolled back.
diff --git a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/multi-cluster-apps/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/multi-cluster-apps/_index.md
new file mode 100644
index 00000000000..91cb1f44f2c
--- /dev/null
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/multi-cluster-apps/_index.md
@@ -0,0 +1,9 @@
+---
+title: Multi-Cluster Apps
+weight: 600
+aliases:
+  - /rancher/v2.x/en/catalog/multi-cluster-apps
+---
+_Available as of v2.2.0_
+
+The documentation about multi-cluster apps has moved [here.]({{<baseurl>}}/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps)
diff --git a/content/rancher/v2.x/en/catalog/tutorial/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/tutorial/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/catalog/tutorial/_index.md
rename to content/rancher/v2.x/en/helm-charts/legacy-catalogs/tutorial/_index.md
index 141cc544680..4b861e42f57 100644
--- a/content/rancher/v2.x/en/catalog/tutorial/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/tutorial/_index.md
@@ -1,6 +1,8 @@
 ---
 title: "Tutorial: Example Custom Chart Creation"
 weight: 800
+aliases:
+  - /rancher/v2.x/en/catalog/tutorial
 ---
 
 In this tutorial, you'll learn how to create a Helm chart and deploy it to a  repository. The repository can then be used as a source for a custom catalog in Rancher.
diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md
index 21044984828..7daf5a1c0e3 100644
--- a/content/rancher/v2.x/en/installation/_index.md
+++ b/content/rancher/v2.x/en/installation/_index.md
@@ -1,7 +1,7 @@
 ---
-title: Installing Rancher
+title: Installing/Upgrading Rancher
 description: Learn how to install Rancher in development and production environments. Read about single node and high availability installation
-weight: 50
+weight: 3
 aliases:
   - /rancher/v2.x/en/installation/how-ha-works/
 ---
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
new file mode 100644
index 00000000000..9d8b186a279
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
@@ -0,0 +1,17 @@
+---
+title: Install Rancher on a Kubernetes Cluster
+description: Learn how to install Rancher in development and production environments. Read about single node and high availability installation
+weight: 3
+---
+
+Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to install Rancher as a Helm chart on an existing Kubernetes cluster, without installing the Rancher Kubernetes distribution.
+
+There are two main ways that Rancher can be installed:
+
+1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
+2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
+
+The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
+
+This section focuses on the installation path in which the Rancher CLI is used to provision a new Kubernetes cluster with the Rancher Helm chart built in.
+
diff --git a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/_index.md
index 74aa80b7789..df088c803ec 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/_index.md
@@ -1,11 +1,15 @@
 ---
-title: 3. Install Rancher on the Kubernetes Cluster
-description: Rancher installation is managed using the Helm Kubernetes package manager. Use Helm to install the prerequisites and charts to install Rancher
-weight: 200
-aliases:
-  - /rancher/v2.x/en/installation/ha/helm-rancher
+title: Install
+weight: 1
 ---
 
+> **Prerequisite:**
+> Set up the Rancher Kubernetes cluster. Rancher can be installed on any Kubernetes cluster.
+>
+> This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
+
+# Install the Rancher Helm Chart
+
 Rancher is installed using the Helm package manager for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents.
 
 With Helm, we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at https://helm.sh/.
@@ -263,3 +267,8 @@ That's it. You should have a functional Rancher server.
 In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
 
 Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) Page
+
+
+### Optional Next Steps
+
+Enable the Enterprise Cluster Manager.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
new file mode 100644
index 00000000000..319965a7229
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
@@ -0,0 +1,7 @@
+---
+title: Installing Rancher on an AKS Kubernetes Cluster
+shortTitle: AKS
+weight: 2
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
new file mode 100644
index 00000000000..46a6a887dbb
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
@@ -0,0 +1,7 @@
+---
+title: Installing Rancher on Any Kubernetes Cluster
+shortTitle: Any Kubernetes Cluster
+weight: 4
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
new file mode 100644
index 00000000000..97c254dd05a
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
@@ -0,0 +1,7 @@
+---
+title: Installing Rancher on an EKS Kubernetes Cluster
+shortTitle: EKS
+weight: 1
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
new file mode 100644
index 00000000000..241a7d0822a
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
@@ -0,0 +1,7 @@
+---
+title: Installing Rancher on a GKE Kubernetes Cluster
+shortTitle: GKE
+weight: 3
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/upgrades/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/_index.md
similarity index 59%
rename from content/rancher/v2.x/en/upgrades/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/_index.md
index 4debea3156e..bacce397ecb 100644
--- a/content/rancher/v2.x/en/upgrades/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/_index.md
@@ -1,18 +1,17 @@
 ---
 title: Upgrades and Rollbacks
 weight: 150
+aliases:
+  - /rancher/v2.x/en/upgrades
 ---
 
 ### Upgrading Rancher
 
-- [Upgrades]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/)
+To upgrade Rancher, refer to [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades/upgrades/)
 
 ### Rolling Back Unsuccessful Upgrades
 
-In the event that your Rancher Server does not upgrade successfully, you can rollback to your installation prior to upgrade:
-
-- [Rollbacks for Rancher installed with Docker]({{<baseurl>}}/rancher/v2.x/en/upgrades/single-node-rollbacks)
-- [Rollbacks for Rancher installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/upgrades/ha-server-rollbacks)
+In the event that your Rancher Server does not upgrade successfully, you can rollback to your installation prior to upgrade using these instructions: [Rollbacks for Rancher installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/upgrades/ha-server-rollbacks)
 
 > **Note:** If you are rolling back to versions in either of these scenarios, you must follow some extra [instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/) in order to get your clusters working.
 >
diff --git a/content/rancher/v2.x/en/upgrades/rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md
similarity index 88%
rename from content/rancher/v2.x/en/upgrades/rollbacks/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md
index 4a3c79a010a..8c53a2b5e3f 100644
--- a/content/rancher/v2.x/en/upgrades/rollbacks/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md
@@ -1,9 +1,21 @@
 ---
 title: Rollbacks
 weight: 1010
+aliases:
+  - /rancher/v2.x/en/upgrades/rollbacks
 ---
+
+
+> This page is under construction.
+
 This section contains information about how to rollback your Rancher server to a previous version.
 
+If you upgrade Rancher and the upgrade does not complete successfully, you may need to [restore Rancher from backup.](../../backups/restores)
+
+Restoring a snapshot of the Rancher Server cluster will revert Rancher to the version and state at the time of the snapshot.
+
+>**Note:** Managed clusters are authoritative for their state. This means restoring the rancher server will not revert workload deployments or changes made on managed clusters after the snapshot was taken.
+
 - [Rolling back Rancher installed with Docker]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/)
 - [Rolling back Rancher installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/)
 
@@ -14,7 +26,6 @@ If you are rolling back to versions in either of these scenarios, you must follo
 - Rolling back from v2.1.6+ to any version between v2.1.0 - v2.1.5 or v2.0.0 - v2.0.10.
 - Rolling back from v2.0.11+ to any version between v2.0.0 - v2.0.10.  
 
-
 Because of the changes necessary to address [CVE-2018-20321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20321), special steps are necessary if the user wants to roll back to a previous version of Rancher where this vulnerability exists. The steps are as follows:
 
 1. Record the `serviceAccountToken` for each cluster.  To do this, save the following script on a machine with `kubectl` access to the Rancher management plane and execute it.  You will need to run these commands on the machine where the rancher container is running. Ensure JQ is installed before running the command. The commands will vary depending on how you installed Rancher.
diff --git a/content/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
similarity index 92%
rename from content/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
index 2cca7a4b78a..257a1130528 100644
--- a/content/rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
@@ -3,6 +3,7 @@ title: Kubernetes Rollback
 weight: 1025
 aliases:
   - /rancher/v2.x/en/upgrades/ha-server-rollbacks
+  - /rancher/v2.x/en/upgrades/rollbacks/ha-server-rollbacks
 ---
 
 If you upgrade Rancher and the upgrade does not complete successfully, you may need to rollback your Rancher Server to its last healthy state.
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/_index.md
similarity index 93%
rename from content/rancher/v2.x/en/upgrades/upgrades/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/_index.md
index 68539cc09c1..e8a3487c327 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/_index.md
@@ -1,11 +1,13 @@
 ---
 title: Upgrades
 weight: 1005
+aliases:
+  - /rancher/v2.x/en/upgrades/upgrades
 ---
 This section contains information about how to upgrade your Rancher server to a newer version. Regardless if you installed in an air gap environment or not, the upgrade steps mainly depend on whether you have a single node or high-availability installation of Rancher. Select from the following options:
 
-- [Upgrading Rancher installed with Docker]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/single-node/)
-- [Upgrading Rancher installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/)
+- [Upgrading Rancher installed with Docker]({{<baseurl>}}/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades/upgrades/single-node/)
+- [Upgrading Rancher installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades/upgrades/ha/)
 
 ### Known Upgrade Issues
 
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/upgrades/upgrades/ha/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/helm2/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/upgrades/upgrades/ha/helm2/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/helm2/_index.md
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md
index 77b7a515e7a..c48914cb4da 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md
@@ -4,6 +4,7 @@ weight: 1030
 aliases:
   - /rancher/v2.x/en/upgrades/ha-server-upgrade/
   - /rancher/v2.x/en/upgrades/upgrades/ha-server-upgrade/
+  - /rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on
 ---
 
 > **Important: RKE add-on install is only supported up to Rancher v2.0.8**
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/namespace-migration/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md
rename to content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/namespace-migration/_index.md
index 56855eb7b5e..01dff5d23b3 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/namespace-migration/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/namespace-migration/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Upgrading to v2.0.7+ — Namespace Migration
 weight: 1040
+aliases:
+  - /rancher/v2.x/en/upgrades/upgrades/namespace-migration
 ---
 >This section applies only to Rancher upgrades from v2.0.6 or earlier to v2.0.7 or later. Upgrades from v2.0.7 to later version are unaffected.
 
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
new file mode 100644
index 00000000000..993ad916a60
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
@@ -0,0 +1,17 @@
+---
+title: Install Rancher on a Linux OS
+weight: 2
+---
+
+> This section is under construction.
+
+Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to install the Rancher binary. You will use the Rancher CLI to set up a Rancher Kubernetes cluster that has the Rancher server Helm chart preinstalled.
+
+There are two main ways that Rancher can be installed:
+
+1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
+2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
+
+The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
+
+This section focuses on the installation path in which the Rancher Helm chart is installed on an existing Kubernetes cluster.
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
new file mode 100644
index 00000000000..1bb080bd47f
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
@@ -0,0 +1,10 @@
+---
+title: Install
+weight: 1
+---
+
+> This page is under construction.
+
+In this section, you'll learn how to create a Rancher Kubernetes cluster that comes with the Rancher Helm chart built in.
+
+> To install Rancher on an existing Kubernetes cluster, refer to the instructions on [installing the Rancher Helm chart.](../../rancher-helm-install-upgrade/installation)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
new file mode 100644
index 00000000000..a171755b27a
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
@@ -0,0 +1,28 @@
+---
+title: Upgrades and Rollbacks
+weight: 2
+---
+
+> This page is under construction.
+
+This page is about how to upgrade the local Kubernetes cluster that Rancher is installed on, as well as the Rancher Helm chart.
+
+This information applies if you set up the local Rancher server cluster using the Rancher CLI.
+
+To upgrade the Rancher server's local Kubernetes cluster using the Rancher CLI, you will first upgrade the master nodes of the cluster, and then the worker nodes.
+
+### About Rancher Kubernetes
+
+Rancher is intended to be installed on any Kubernetes cluster.
+
+The Rancher CLI comes with a Kubernetes distribution called Rancher Kubernetes, which allows you to install Kubernetes more easily as a prerequisite to installing Rancher.
+
+Rancher Kubernetes clusters can also be imported into Rancher.
+
+
+### Known Upgrade Issues
+
+A list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
+
+### Caveats
+Upgrades _to_ or _from_ any chart in the [rancher-alpha repository]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories/) aren't supported.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
new file mode 100644
index 00000000000..f33386702a1
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
@@ -0,0 +1,8 @@
+---
+title: Cluster Upgrade
+weight: 2
+---
+
+> This section is under construction.
+
+In this section, you'll learn how to upgrade the Rancher Helm chart and the master nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
new file mode 100644
index 00000000000..76f04a09ac2
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
@@ -0,0 +1,8 @@
+---
+title: Worker Node Upgrade
+weight: 1
+---
+
+> This page is under construction.
+
+In this section, you'll learn how to upgrade the worker nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
new file mode 100644
index 00000000000..c68c3d159e7
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
@@ -0,0 +1,6 @@
+---
+title: Upgrade the Rancher Image
+weight: 1
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md
new file mode 100644
index 00000000000..04d894708a2
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md
@@ -0,0 +1,4 @@
+---
+title: Rollbacks
+weight: 3
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/k8s-install/_index.md b/content/rancher/v2.x/en/installation/k8s-install/_index.md
deleted file mode 100644
index 4a51dbf90b3..00000000000
--- a/content/rancher/v2.x/en/installation/k8s-install/_index.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: Installing Rancher on a Kubernetes Cluster
-weight: 3
-description: For production environments, install Rancher in a high-availability configuration. Read the guide for setting up a 3-node cluster and still install Rancher using a Helm chart.
-aliases:
-  - /rancher/v2.x/en/installation/ha/
----
-
-For production environments, we recommend installing Rancher in a high-availability configuration so that your user base can always access Rancher Server. When installed in a Kubernetes cluster, Rancher will integrate with the cluster's etcd database and take advantage of Kubernetes scheduling for high-availability.
-
-This section describes how to create and manage a Kubernetes cluster, then install Rancher onto that cluster. For this type of architecture, you will need to deploy nodes - typically virtual machines - in the infrastructure provider of your choice. You will also need to configure a load balancer to direct front-end traffic to the three VMs. When the VMs are running and fulfill the [node requirements,]({{<baseurl>}}/rancher/v2.x/en/installation/requirements) you can use RKE or K3s to deploy Kubernetes onto them, then use the Helm package manager to deploy Rancher onto Kubernetes.
-
-### Optional: Installing Rancher on a Single-node Kubernetes Cluster
-
-If you only have one node, but you want to use the Rancher server in production in the future, it is better to install Rancher on a single-node Kubernetes cluster than to install it with Docker.
-
-One option is to install Rancher with Helm on a Kubernetes cluster, but to only use a single node in the cluster. In this case, the Rancher server does not have high availability, which is important for running Rancher in production. However, this option is useful if you want to save resources by using a single node in the short term, while preserving a high-availability migration path. In the future, you can add nodes to the cluster to get a high-availability Rancher server.
-
-To set up a single-node RKE cluster, configure only one node in the `cluster.yml` . The single node should have all three roles: `etcd`, `controlplane`, and `worker`.
-
-To set up a single-node K3s cluster, run the Rancher server installation command on just one node instead of two nodes.
-
-In both single-node Kubernetes setups, Rancher can be installed with Helm on the Kubernetes cluster in the same way that it would be installed on any other cluster.
-
-### Important Notes on Architecture
-
-The Rancher management server can only be run on Kubernetes cluster in an infrastructure provider where Kubernetes is installed using K3s or RKE. Use of Rancher on hosted Kubernetes providers, such as EKS, is not supported.
-
-For the best performance and security, we recommend a dedicated Kubernetes cluster for the Rancher management server. Running user workloads on this cluster is not advised. After deploying Rancher, you can [create or import clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) for running your workloads.
-
-For information on how Rancher works, regardless of the installation method, refer to the [architecture section.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture)
-
-## Installation Outline
-
-- [Set up Infrastructure]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/)
-- [Set up a Kubernetes Cluster]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/)
-- [Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/)
-
-## Additional Install Options
-
-- [Migrating from a high-availability Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/)
-- [Installing Rancher with Helm 2:]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) This section provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
-
-## Previous Methods
-
-[RKE add-on install]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/)
-
-> **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
-> Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
-> If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
diff --git a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
deleted file mode 100644
index 8add940e8ce..00000000000
--- a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
+++ /dev/null
@@ -1,130 +0,0 @@
----
-title: '1. Set up Infrastructure'
-weight: 185
-aliases:
-  - /rancher/v2.x/en/installation/ha/create-nodes-lb
----
-
-In this section, you will provision the underlying infrastructure for your Rancher management server.
-
-The recommended infrastructure for the Rancher-only Kubernetes cluster differs depending on whether Rancher will be installed on a K3s Kubernetes cluster, an RKE Kubernetes cluster, or a single Docker container.
-
-For more information about each installation option, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation)
-
-> **Note:** These nodes must be in the same region. You may place these servers in separate availability zones (datacenter).
-
-{{% tabs %}}
-{{% tab "K3s" %}}
-To install the Rancher management server on a high-availability K3s cluster, we recommend setting up the following infrastructure:
-
-- **Two Linux nodes,** typically virtual machines, in the infrastructure provider of your choice.
-- **An external database** to store the cluster data. We recommend MySQL.
-- **A load balancer** to direct traffic to the two nodes.
-- **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it.
-
-### 1. Set up Linux Nodes
-
-Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2.
-
-### 2. Set up External Datastore
-
-The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available options allow you to select a datastore that best fits your use case.
-
-For a high-availability K3s installation, you will need to set a [MySQL](https://www.mysql.com/) external database. Rancher has been tested on K3s Kubernetes clusters using MySQL version 5.7 as the datastore.
-
-When you install Kubernetes using the K3s installation script, you will pass in details for K3s to connect to the database.
-
-For an example of one way to set up the MySQL database, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/rds/) for setting up MySQL on Amazon's RDS service.
-
-For the complete list of options that are available for configuring a K3s cluster datastore, refer to the [K3s documentation.]({{<baseurl>}}/k3s/latest/en/installation/datastore/)
-
-### 3. Set up the Load Balancer
-
-You will also need to set up a load balancer to direct traffic to the Rancher replica on both nodes. That will prevent an outage of any single node from taking down communications to the Rancher management server.
-
-When Kubernetes gets set up in a later step, the K3s tool will deploy a Traefik Ingress controller. This controller will listen on ports 80 and 443 of the worker nodes, answering traffic destined for specific hostnames.
-
-When Rancher is installed (also in a later step), the Rancher system creates an Ingress resource. That Ingress tells the Traefik Ingress controller to listen for traffic destined for the Rancher hostname. The Traefik Ingress controller, when receiving traffic destined for the Rancher hostname, will forward that traffic to the running Rancher pods in the cluster.
-
-For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer:
-
-- **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment.
-- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
-
-For an example showing how to set up an NGINX load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nginx/)
-
-For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nlb/)
-
-> **Important:**
-> Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications.
-
-### 4. Set up the DNS Record
-
-Once you have set up your load balancer, you will need to create a DNS record to send traffic to this load balancer.
-
-Depending on your environment, this may be an A record pointing to the load balancer IP, or it may be a CNAME pointing to the load balancer hostname. In either case, make sure this record is the hostname that you intend Rancher to respond on.
-
-You will need to specify this hostname in a later step when you install Rancher, and it is not possible to change it later. Make sure that your decision is a final one.
-
-For a how-to guide for setting up a DNS record to route domain traffic to an Amazon ELB load balancer, refer to the [official AWS documentation.](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer)
-
-
-
-{{% /tab %}}
-{{% tab "RKE" %}}
-To install the Rancher management server on a high-availability RKE cluster, we recommend setting up the following infrastructure:
-
-- **Three Linux nodes,** typically virtual machines, in an infrastructure provider such as Amazon's EC2, Google Compute Engine, or vSphere.
-- **A load balancer** to direct front-end traffic to the three nodes.
-- **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it.
-
-These nodes must be in the same region/data center. You may place these servers in separate availability zones.
-
-### Why three nodes?
-
-In an RKE cluster, Rancher server data is stored on etcd. This etcd database runs on all three nodes.
-
-The etcd database requires an odd number of nodes so that it can always elect a leader with a majority of the etcd cluster. If the etcd database cannot elect a leader, etcd can suffer from [split brain](https://www.quora.com/What-is-split-brain-in-distributed-systems), requiring the cluster to be restored from backup. If one of the three etcd nodes fails, the two remaining nodes can elect a leader because they have the majority of the total number of etcd nodes.
-
-### 1. Set up Linux Nodes
-
-Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node/) for setting up nodes as instances in Amazon EC2.
-
-### 2. Set up the Load Balancer
-
-You will also need to set up a load balancer to direct traffic to the Rancher replica on both nodes. That will prevent an outage of any single node from taking down communications to the Rancher management server.
-
-When Kubernetes gets set up in a later step, the RKE tool will deploy an NGINX Ingress controller. This controller will listen on ports 80 and 443 of the worker nodes, answering traffic destined for specific hostnames.
-
-When Rancher is installed (also in a later step), the Rancher system creates an Ingress resource. That Ingress tells the NGINX Ingress controller to listen for traffic destined for the Rancher hostname. The NGINX Ingress controller, when receiving traffic destined for the Rancher hostname, will forward that traffic to the running Rancher pods in the cluster.
-
-For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer:
-
-- **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment.
-- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
-
-For an example showing how to set up an NGINX load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nginx/)
-
-For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nlb/)
-
-> **Important:**
-> Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications.
-
-### 3. Set up the DNS Record
-
-Once you have set up your load balancer, you will need to create a DNS record to send traffic to this load balancer.
-
-Depending on your environment, this may be an A record pointing to the LB IP, or it may be a CNAME pointing to the load balancer hostname. In either case, make sure this record is the hostname that you intend Rancher to respond on.
-
-You will need to specify this hostname in a later step when you install Rancher, and it is not possible to change it later. Make sure that your decision is a final one.
-
-For a how-to guide for setting up a DNS record to route domain traffic to an Amazon ELB load balancer, refer to the [official AWS documentation.](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer)
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### [Next: Set up a Kubernetes Cluster]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/_index.md
deleted file mode 100644
index 1212425742a..00000000000
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/_index.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Installing Rancher in an Air Gapped Environment with Helm 2
-weight: 2
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-installation/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/
-  - /rancher/v2.x/en/installation/air-gap-single-node/
----
-
-> After Helm 3 was released, the Rancher installation instructions were updated to use Helm 3.
->
-> If you are using Helm 2, we recommend [migrating to Helm 3](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) because it is simpler to use and more secure than Helm 2.
->
-> This section provides a copy of the older instructions for installing Rancher on a Kubernetes cluster using Helm 2 in an air air gap environment, and it is intended to be used if upgrading to Helm 3 is not feasible.
-
-This section is about installations of Rancher server in an air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
-
-Throughout the installations instructions, there will be _tabs_ for either a high availability Kubernetes installation or a single-node Docker installation.
-
-### Air Gapped Kubernetes Installations
-
-This section covers how to install Rancher on a Kubernetes cluster in an air gapped environment.
-
-A Kubernetes installation is comprised of three nodes running the Rancher server components on a Kubernetes cluster. The persistence layer (etcd) is also replicated on these three nodes, providing redundancy and data duplication in case one of the nodes fails.
-
-### Air Gapped Docker Installations
-
-These instructions also cover how to install Rancher on a single node in an air gapped environment.
-
-The Docker installation is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster, you install the Rancher server component on a single node using a `docker run` command. Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server.
-
-> **Important:** If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker Installation to a Kubernetes Installation.
-
-Instead of running the Docker installation, you have the option to follow the Kubernetes Install guide, but only use one node to install Rancher. Afterwards, you can scale up the etcd nodes in your Kubernetes cluster to make it a Kubernetes Installation.
-
-# Installation Outline
-
-- [1. Prepare your Node(s)]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/)
-- [2. Collect and Publish Images to your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/)
-- [3. Launch a Kubernetes Cluster with RKE]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/)
-- [4. Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/)
-
-### [Next: Prepare your Node(s)]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/prepare-nodes/)
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
deleted file mode 100644
index c1798f6ac09..00000000000
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
+++ /dev/null
@@ -1,333 +0,0 @@
----
-title: 4. Install Rancher
-weight: 400
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-installation/install-rancher/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/
-  - /rancher/v2.x/en/installation/air-gap-single-node/install-rancher
-  - /rancher/v2.x/en/installation/air-gap/install-rancher
----
-
-This section is about how to deploy Rancher for your air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy. There are _tabs_ for either a high availability (recommended) or a Docker installation.
-
-{{% tabs %}}
-{{% tab "Kubernetes Install (Recommended)" %}}
-
-Rancher recommends installing Rancher on a Kubernetes cluster. A highly available Kubernetes Installation is comprised of three nodes running the Rancher server components on a Kubernetes cluster. The persistence layer (etcd) is also replicated on these three nodes, providing redundancy and data duplication in case one of the nodes fails.
-
-This section describes installing Rancher in five parts:
-
-- [A. Add the Helm Chart Repository](#a-add-the-helm-chart-repository)
-- [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration)
-- [C. Render the Rancher Helm Template](#c-render-the-rancher-helm-template)
-- [D. Install Rancher](#d-install-rancher)
-- [E. For Rancher versions prior to v2.3.0, Configure System Charts](#e-for-rancher-versions-prior-to-v2-3-0-configure-system-charts)
-
-### A. Add the Helm Chart Repository
-
-From a system that has access to the internet, fetch the latest Helm chart and copy the resulting manifests to a system that has access to the Rancher server cluster.
-
-1. If you haven't already, initialize `helm` locally on a workstation that has internet access. Note: Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-    ```plain
-    helm init -c
-    ```
-
-2. Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-  {{< release-channel >}}
-    ```
-    helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-    ```
-
-3. Fetch the latest Rancher chart. This will pull down the chart and save it in the current directory as a `.tgz` file.
-```plain
-helm fetch rancher-<CHART_REPO>/rancher
-```
-
-> Want additional options? Need help troubleshooting? See [Kubernetes Install: Advanced Options]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#advanced-configurations).
-
-### B. Choose your SSL Configuration
-
-Rancher Server is designed to be secure by default and requires SSL/TLS configuration.
-
-When Rancher is installed on an air gapped Kubernetes cluster, there are two recommended options for the source of the certificate.
-
-> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
-
-| Configuration                              | Chart option                 | Description                                                                                                                                                 | Requires cert-manager |
-| ------------------------------------------ | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
-| Rancher Generated Self-Signed Certificates | `ingress.tls.source=rancher` | Use certificates issued by Rancher's generated CA (self signed)<br> This is the **default** and does not need to be added when rendering the Helm template. | yes                   |
-| Certificates from Files                    | `ingress.tls.source=secret`  | Use your own certificate files by creating Kubernetes Secret(s). <br> This option must be passed when rendering the Rancher Helm template.                  | no                    |
-
-### C. Render the Rancher Helm Template
-
-When setting up the Rancher Helm template, there are several options in the Helm chart that are designed specifically for air gap installations.
-
-| Chart Option            | Chart Value                      | Description   |
-| ----------------------- | -------------------------------- | ---- |
-| `certmanager.version` | "<version>" | Configure proper Rancher TLS issuer depending of running cert-manager version. |
-| `systemDefaultRegistry` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `useBundledSystemChart` | `true`                           | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
-
-Based on the choice your made in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), complete one of the procedures below.
-
-{{% accordion id="self-signed" label="Option A-Default Self-Signed Certificate" %}}
-
-By default, Rancher generates a CA and uses cert-manager to issue the certificate for access to the Rancher server interface.
-
-> **Note:**
-> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade cert-manager documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-1. From a system connected to the internet, add the cert-manager repo to Helm.
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    ```
-
-1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
-
-   ```plain
-   helm fetch jetstack/cert-manager --version v0.12.0
-   ```
-
-1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
-   ```plain
-   helm template ./cert-manager-v0.12.0.tgz --output-dir . \
-       --name cert-manager --namespace cert-manager \
-       --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
-       --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
-       --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
-   ```
-
-1. Download the required CRD file for cert-manager
-   ```plain
-   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-   ```
-1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
-
-
-    Placeholder | Description
-    ------------|-------------
-    `<VERSION>` | The version number of the output tarball.
-    `<RANCHER.YOURDOMAIN.COM>` | The DNS name you pointed at your load balancer.
-    `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.
-    `<CERTMANAGER_VERSION>` | Cert-manager version running on k8s cluster.
-
-     ```plain
-    helm template ./rancher-<VERSION>.tgz --output-dir . \
-     --name rancher \
-     --namespace cattle-system \
-     --set hostname=<RANCHER.YOURDOMAIN.COM> \
-     --set certmanager.version=<CERTMANAGER_VERSION> \
-     --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-     --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-     --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-{{% /accordion %}}
-
-{{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
-
-Create Kubernetes secrets from your own certificates for Rancher to use. The common name for the cert will need to match the `hostname` option in the command below, or the ingress controller will fail to provision the site for Rancher.
-
-Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
-
-| Placeholder                      | Description                                     |
-| -------------------------------- | ----------------------------------------------- |
-| `<VERSION>`                      | The version number of the output tarball.       |
-| `<RANCHER.YOURDOMAIN.COM>`       | The DNS name you pointed at your load balancer. |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.         |
-
-```plain
-   helm template ./rancher-<VERSION>.tgz --output-dir . \
-    --name rancher \
-    --namespace cattle-system \
-    --set hostname=<RANCHER.YOURDOMAIN.COM> \
-    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-    --set ingress.tls.source=secret \
-    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
-
-```plain
-   helm template ./rancher-<VERSION>.tgz --output-dir . \
-    --name rancher \
-    --namespace cattle-system \
-    --set hostname=<RANCHER.YOURDOMAIN.COM> \
-    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-    --set ingress.tls.source=secret \
-    --set privateCA=true \
-    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-Then refer to [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
-
-{{% /accordion %}}
-
-### D. Install Rancher
-
-Copy the rendered manifest directories to a system that has access to the Rancher server cluster to complete installation.
-
-Use `kubectl` to create namespaces and apply the rendered manifests.
-
-If you chose to use self-signed certificates in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), install cert-manager.
-
-{{% accordion id="install-cert-manager" label="Self-Signed Certificate Installs - Install Cert-manager" %}}
-
-If you are using self-signed certificates, install cert-manager:
-
-1. Create the namespace for cert-manager.
-```plain
-kubectl create namespace cert-manager
-```
-
-1. Create the cert-manager CustomResourceDefinitions (CRDs).
-```plain
-kubectl apply -f cert-manager/cert-manager-crd.yaml
-```
-
-> **Important:**
-> If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false flag to your kubectl apply command above else you will receive a validation error relating to the x-kubernetes-preserve-unknown-fields field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
-
-1. Launch cert-manager.
-```plain
-kubectl apply -R -f ./cert-manager
-```
-
-{{% /accordion %}}
-
-Install Rancher:
-
-```plain
-kubectl create namespace cattle-system
-kubectl -n cattle-system apply -R -f ./rancher
-```
-
-**Step Result:** If you are installing Rancher v2.3.0+, the installation is complete.
-
-### E. For Rancher versions prior to v2.3.0, Configure System Charts
-
-If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
-
-### Additional Resources
-
-These resources could be helpful when installing Rancher:
-
-- [Rancher Helm chart options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/)
-- [Adding TLS secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/)
-- [Troubleshooting Rancher Kubernetes Installations]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/)
-
-{{% /tab %}}
-{{% tab "Docker Install" %}}
-
-The Docker installation is for Rancher users that are wanting to **test** out Rancher. Instead of running on a Kubernetes cluster, you install the Rancher server component on a single node using a `docker run` command. Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server. **Important: If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker installation to a Kubernetes Installation.** Instead of running the single node installation, you have the option to follow the Kubernetes Install guide, but only use one node to install Rancher. Afterwards, you can scale up the etcd nodes in your Kubernetes cluster to make it a Kubernetes Installation.
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-| Environment Variable Key         | Environment Variable Value       | Description     |
-| -------------------------------- | -------------------------------- | ---- |
-| `CATTLE_SYSTEM_DEFAULT_REGISTRY` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `CATTLE_SYSTEM_CATALOG`          | `bundled`                        | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
-
-> **Do you want to...**
->
-> - Configure custom CA root certificate to access your services? See [Custom CA root certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#additional-trusted-cas).
-> - Record all transactions with the Rancher API? See [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#api-audit-log).
-
-- For Rancher prior to v2.3.0, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach. Then, after Rancher is installed, you will need to configure Rancher to use that repository. For details, refer to the documentation on [setting up the system charts for Rancher prior to v2.3.0.]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0)
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
-
-If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself.
-
-Log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
-
-In development or testing environments where your team will access your Rancher server, create a self-signed certificate for use with your install so that your team can verify they're connecting to your instance of Rancher.
-
-> **Prerequisites:**
-> From a computer with an internet connection, create a self-signed certificate using [OpenSSL](https://www.openssl.org/) or another method of your choice.
->
-> - The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
-> - In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#cert-order).
-
-After creating your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Use the `-v` flag and provide the path to your certificates to mount them in your container.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
-| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
-| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<CA_CERTS.pem>`                     | The path to the certificate authority's certificate.                                                                          |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-    -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
-
-In development or testing environments where you're exposing an app publicly, use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings.
-
-> **Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
-
-After obtaining your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
-| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
-| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-> **Note:** Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    --no-cacerts \
-    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-
-If you are installing Rancher v2.3.0+, the installation is complete.
-
-If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
-
-{{% /tab %}}
-{{% /tabs %}}
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/launch-kubernetes/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/launch-kubernetes/_index.md
deleted file mode 100644
index 3faa3ac73c7..00000000000
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/launch-kubernetes/_index.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: '3. Install Kubernetes with RKE (Kubernetes Installs Only)'
-weight: 300
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-high-availability/install-kube
----
-
-This section is about how to prepare to launch a Kubernetes cluster which is used to deploy Rancher server for your air gapped environment.
-
-Since a Kubernetes Installation requires a Kubernetes cluster, we will create a Kubernetes cluster using [Rancher Kubernetes Engine]({{<baseurl>}}/rke/latest/en/) (RKE). Before being able to start your Kubernetes cluster, you'll need to [install RKE]({{<baseurl>}}/rke/latest/en/installation/) and create a RKE config file.
-
-- [A. Create an RKE Config File](#a-create-an-rke-config-file)
-- [B. Run RKE](#b-run-rke)
-- [C. Save Your Files](#c-save-your-files)
-
-### A. Create an RKE Config File
-
-From a system that can access ports 22/tcp and 6443/tcp on your host nodes, use the sample below to create a new file named `rancher-cluster.yml`. This file is a Rancher Kubernetes Engine configuration file (RKE config file), which is a configuration for the cluster you're deploying Rancher to.
-
-Replace values in the code sample below with help of the _RKE Options_ table. Use the IP address or DNS names of the [3 nodes]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/provision-hosts) you created.
-
-> **Tip:** For more details on the options available, see the RKE [Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-<figcaption>RKE Options</figcaption>
-
-| Option             | Required             | Description                                                                             |
-| ------------------ | -------------------- | --------------------------------------------------------------------------------------- |
-| `address`          | ✓                    | The DNS or IP address for the node within the air gap network.                          |
-| `user`             | ✓                    | A user that can run docker commands.                                                    |
-| `role`             | ✓                    | List of Kubernetes roles assigned to the node.                                          |
-| `internal_address` | optional<sup>1</sup> | The DNS or IP address used for internal cluster traffic.                                |
-| `ssh_key_path`     |                      | Path to SSH private key used to authenticate to the node (defaults to `~/.ssh/id_rsa`). |
-
-> <sup>1</sup> Some services like AWS EC2 require setting the `internal_address` if you want to use self-referencing security groups or firewalls.
-
-```yaml
-nodes:
-  - address: 10.10.3.187 # node air gap network IP
-    internal_address: 172.31.7.22 # node intra-cluster IP
-    user: rancher
-    role: ['controlplane', 'etcd', 'worker']
-    ssh_key_path: /home/user/.ssh/id_rsa
-  - address: 10.10.3.254 # node air gap network IP
-    internal_address: 172.31.13.132 # node intra-cluster IP
-    user: rancher
-    role: ['controlplane', 'etcd', 'worker']
-    ssh_key_path: /home/user/.ssh/id_rsa
-  - address: 10.10.3.89 # node air gap network IP
-    internal_address: 172.31.3.216 # node intra-cluster IP
-    user: rancher
-    role: ['controlplane', 'etcd', 'worker']
-    ssh_key_path: /home/user/.ssh/id_rsa
-
-private_registries:
-  - url: <REGISTRY.YOURDOMAIN.COM:PORT> # private registry url
-    user: rancher
-    password: '*********'
-    is_default: true
-```
-
-### B. Run RKE
-
-After configuring `rancher-cluster.yml`, bring up your Kubernetes cluster:
-
-```
-rke up --config ./rancher-cluster.yml
-```
-
-### C. Save Your Files
-
-> **Important**
-> The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster.
-
-Save a copy of the following files in a secure location:
-
-- `rancher-cluster.yml`: The RKE cluster configuration file.
-- `kube_config_rancher-cluster.yml`: The [Kubeconfig file]({{<baseurl>}}/rke/latest/en/kubeconfig/) for the cluster, this file contains credentials for full access to the cluster.
-- `rancher-cluster.rkestate`: The [Kubernetes Cluster State file]({{<baseurl>}}/rke/latest/en/installation/#kubernetes-cluster-state), this file contains credentials for full access to the cluster.<br/><br/>_The Kubernetes Cluster State file is only created when using RKE v0.2.0 or higher._
-
-> **Note:** The "rancher-cluster" parts of the two latter file names are dependent on how you name the RKE cluster configuration file.
-
-### [Next: Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher)
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
deleted file mode 100644
index b96ca100b47..00000000000
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
+++ /dev/null
@@ -1,274 +0,0 @@
----
-title: '2. Collect and Publish Images to your Private Registry'
-weight: 200
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/
-  - /rancher/v2.x/en/installation/air-gap-single-node/prepare-private-registry/
-  - /rancher/v2.x/en/installation/air-gap-single-node/config-rancher-for-private-reg/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/
----
-
-> **Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/) available to use.
->
-> **Note:** Populating the private registry with images is the same process for HA and Docker installations, the differences in this section is based on whether or not you are planning to provision a Windows cluster or not.
-
-By default, all images used to [provision Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/) or launch any [tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) in Rancher, e.g. monitoring, pipelines, alerts, are pulled from Docker Hub. In an air gap installation of Rancher, you will need a private registry that is located somewhere accessible by your Rancher server. Then, you will load the registry with all the images.
-
-This section describes how to set up your private registry so that when you install Rancher, Rancher will pull all the required images from this registry.
-
-By default, we provide the steps of how to populate your private registry assuming you are provisioning Linux only clusters, but if you plan on provisioning any [Windows clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/), there are separate instructions to support the images needed for a Windows cluster.
-
-{{% tabs %}}
-{{% tab "Linux Only Clusters" %}}
-
-For Rancher servers that will only provision Linux clusters, these are the steps to populate your private registry.
-
-A. Find the required assets for your Rancher version <br>
-B. Collect all the required images <br>
-C. Save the images to your workstation <br>
-D. Populate the private registry
-
-### Prerequisites
-
-These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
-
-If you will use ARM64 hosts, the registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments. Click **Assets*.*
-
-2. From the release's **Assets** section, download the following files:
-
-| Release File   | Description  |
-| ---------------- | -------------- |
-| `rancher-images.txt`     | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools. |
-| `rancher-save-images.sh` | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-| `rancher-load-images.sh` | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.   |
-
-### B. Collect all the required images (For Kubernetes Installs using Rancher Generated Self-Signed Certificate)
-
-In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
-
-1.  Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-
-    > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    helm fetch jetstack/cert-manager --version v0.12.0
-    helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
-    ```
-
-2.  Sort and unique the images list to remove any overlap between the sources:
-
-    ```plain
-    sort -u rancher-images.txt -o rancher-images.txt
-    ```
-
-### C. Save the images to your workstation
-
-1. Make `rancher-save-images.sh` an executable:
-   ```
-   chmod +x rancher-save-images.sh
-   ```
-
-1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-   ```plain
-   ./rancher-save-images.sh --image-list ./rancher-images.txt
-   ```
-   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
-
-### D. Populate the private registry
-
-Move the images in the `rancher-images.tar.gz` to your private registry using the scripts to load the images. The `rancher-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script.
-
-1.  Log into your private registry if required:
-    ```plain
-    docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-    ```
-1.  Make `rancher-load-images.sh` an executable:
-    ```
-    chmod +x rancher-load-images.sh
-    ```
-
-1.  Use `rancher-load-images.sh` to extract, tag and push `rancher-images.txt` and `rancher-images.tar.gz` to your private registry:
-    ```plain
-     ./rancher-load-images.sh --image-list ./rancher-images.txt --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-    ```
-{{% /tab %}}
-{{% tab "Linux and Windows Clusters" %}}
-
-_Available as of v2.3.0_
-
-For Rancher servers that will provision Linux and Windows clusters, there are distinctive steps to populate your private registry for the Windows images and the Linux images. Since a Windows cluster is a mix of Linux and Windows nodes, the Linux images pushed into the private registry are manifests.
-
-### Windows Steps
-
-The Windows images need to be collected and pushed from a Windows server workstation.
-
-A. Find the required assets for your Rancher version <br>
-B. Save the images to your Windows Server workstation <br>
-C. Prepare the Docker daemon <br>
-D. Populate the private registry
-
-{{% accordion label="Collecting and Populating Windows Images into the Private Registry"%}}
-
-### Prerequisites
-
-These steps expect you to use a Windows Server 1809 workstation that has internet access, access to your private registry, and at least 50 GB of disk space.
-
-The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
-
-Your registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.
-
-2. From the release's "Assets" section, download the following files:
-
-| Release File         | Description      |
-|------------------------|-------------------|
-| `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.         |
-| `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
-| `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.  |
-
-### B. Save the images to your Windows Server workstation
-
-1. Using `powershell`, go to the directory that has the files that were downloaded in the previous step.
-
-1. Run `rancher-save-images.ps1` to create a tarball of all the required images:
-
-   ```plain
-   ./rancher-save-images.ps1
-   ```
-
-   **Step Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-windows-images.tar.gz`. Check that the output is in the directory.
-
-### C. Prepare the Docker daemon
-
-Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
-
-   ```
-   {
-     ...
-     "allow-nondistributable-artifacts": [
-       ...
-       "<REGISTRY.YOURDOMAIN.COM:PORT>"
-     ]
-     ...
-   }
-   ```
-
-### D. Populate the private registry
-
-Move the images in the `rancher-windows-images.tar.gz` to your private registry using the scripts to load the images. The `rancher-windows-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.ps1` script.
-
-1. Using `powershell`, log into your private registry if required:
-   ```plain
-   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-1. Using `powershell`, use `rancher-load-images.ps1` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-   ```plain
-   ./rancher-load-images.ps1 --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-{{% /accordion %}}
-
-### Linux Steps
-
-The Linux images needs to be collected and pushed from a Linux host, but _must be done after_ populating the Windows images into the private registry. These step are different from the Linux only steps as the Linux images that are pushed will actually manifests that support Windows and Linux images.
-
-A. Find the required assets for your Rancher version <br>
-B. Collect all the required images <br>
-C. Save the images to your Linux workstation <br>
-D. Populate the private registry
-
-{{% accordion label="Collecting and Populating Linux Images into the Private Registry" %}}
-
-### Prerequisites
-
-You must populate the private registry with the Windows images before populating the private registry with Linux images. If you have already populated the registry with Linux images, you will need to follow these instructions again as they will publish manifests that support Windows and Linux images.
-
-These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
-
-The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.
-
-2. From the release's **Assets** section, download the following files, which are required to install Rancher in an air gap environment:
-
-| Release File                 | Description |
-|----------------------------|------|
-| `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.                            |
-| `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
-| `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-| `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
-
-### B. Collect all the required images
-
-**For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
-
-   1. Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-      > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-      ```plain
-      helm repo add jetstack https://charts.jetstack.io
-      helm repo update
-      helm fetch jetstack/cert-manager --version v0.12.0
-      helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
-      ```
-
-   2. Sort and unique the images list to remove any overlap between the sources:
-      ```plain
-      sort -u rancher-images.txt -o rancher-images.txt
-      ```
-
-### C. Save the images to your workstation
-
-1. Make `rancher-save-images.sh` an executable:
-   ```
-   chmod +x rancher-save-images.sh
-   ```
-
-1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-   ```plain
-   ./rancher-save-images.sh --image-list ./rancher-images.txt
-   ```
-
-   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
-
-### D. Populate the private registry
-
-Move the images in the `rancher-images.tar.gz` to your private registry using the `rancher-load-images.sh script` to load the images. The `rancher-images.txt` / `rancher-windows-images.txt` image list is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script.
-
-1. Log into your private registry if required:
-   ```plain
-   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-1. Make `rancher-load-images.sh` an executable:
-   ```
-   chmod +x rancher-load-images.sh
-   ```
-
-1. Use `rancher-load-images.sh` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-   ```plain
-   ./rancher-load-images.sh --image-list ./rancher-images.txt \
-     --windows-image-list ./rancher-windows-images.txt \
-     --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-{{% /accordion %}}
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### [Next: Kubernetes Installs - Launch a Kubernetes Cluster with RKE]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/)
-
-### [Next: Docker Installs - Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/)
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/prepare-nodes/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/prepare-nodes/_index.md
deleted file mode 100644
index 554c05bd98b..00000000000
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/prepare-nodes/_index.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: '1. Prepare your Node(s)'
-weight: 100
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-high-availability/provision-hosts
-  - /rancher/v2.x/en/installation/air-gap-single-node/provision-host
----
-
-This section is about how to prepare your node(s) to install Rancher for your air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy. There are _tabs_ for either a high availability (recommended) or a Docker installation.
-
-# Prerequisites
-
-{{% tabs %}}
-{{% tab "Kubernetes Install (Recommended)" %}}
-
-### OS, Docker, Hardware, and Networking
-
-Make sure that your node(s) fulfill the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-### Private Registry
-
-Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing Docker images to your machines.
-
-If you need help with creating a private registry, please refer to the [Docker documentation](https://docs.docker.com/registry/).
-
-### CLI Tools
-
-The following CLI tools are required for the Kubernetes Install. Make sure these tools are installed on your workstation and available in your `$PATH`.
-
-- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool.
-- [rke]({{<baseurl>}}/rke/latest/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters.
-- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-{{% /tab %}}
-{{% tab "Docker Install" %}}
-
-### OS, Docker, Hardware, and Networking
-
-Make sure that your node(s) fulfill the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-### Private Registry
-
-Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing Docker images to your machines.
-
-If you need help with creating a private registry, please refer to the [Docker documentation](https://docs.docker.com/registry/).
-{{% /tab %}}
-{{% /tabs %}}
-
-# Set up Infrastructure
-
-{{% tabs %}}
-{{% tab "Kubernetes Install (Recommended)" %}}
-
-Rancher recommends installing Rancher on a Kubernetes cluster. A highly available Kubernetes install is comprised of three nodes running the Rancher server components on a Kubernetes cluster. The persistence layer (etcd) is also replicated on these three nodes, providing redundancy and data duplication in case one of the nodes fails.
-
-### Recommended Architecture
-
-- DNS for Rancher should resolve to a layer 4 load balancer
-- The Load Balancer should forward port TCP/80 and TCP/443 to all 3 nodes in the Kubernetes cluster.
-- The Ingress controller will redirect HTTP to HTTPS and terminate SSL/TLS on port TCP/443.
-- The Ingress controller will forward traffic to port TCP/80 on the pod in the Rancher deployment.
-
-<figcaption>Rancher installed on a Kubernetes cluster with layer 4 load balancer, depicting SSL termination at ingress controllers</figcaption>
-
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-
-### A. Provision three air gapped Linux hosts according to our requirements
-
-These hosts will be disconnected from the internet, but require being able to connect with your private registry.
-
-View hardware and software requirements for each of your cluster nodes in [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-### B. Set up your Load Balancer
-
-When setting up the Kubernetes cluster that will run the Rancher server components, an Ingress controller pod will be deployed on each of your nodes. The Ingress controller pods are bound to ports TCP/80 and TCP/443 on the host network and are the entry point for HTTPS traffic to the Rancher server.
-
-You will need to configure a load balancer as a basic Layer 4 TCP forwarder to direct traffic to these ingress controller pods. The exact configuration will vary depending on your environment.
-
-> **Important:**
-> Only use this load balancer (i.e, the `local` cluster Ingress) to load balance the Rancher server. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps.
-
-**Load Balancer Configuration Samples:**
-
-- For an example showing how to set up an NGINX load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nginx)
-- For an example showing how to set up an Amazon NLB load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nlb)
-
-{{% /tab %}}
-{{% tab "Docker Install" %}}
-
-The Docker installation is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster, you install the Rancher server component on a single node using a `docker run` command. Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server.
-
-> **Important:** If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker installation to a Kubernetes Installation.
-
-Instead of running the Docker installation, you have the option to follow the Kubernetes Install guide, but only use one node to install Rancher. Afterwards, you can scale up the etcd nodes in your Kubernetes cluster to make it a Kubernetes Installation.
-
-### A. Provision a single, air gapped Linux host according to our Requirements
-
-These hosts will be disconnected from the internet, but require being able to connect with your private registry.
-
-View hardware and software requirements for each of your cluster nodes in [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### [Next: Collect and Publish Images to your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/)
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
deleted file mode 100644
index b67ccc5370e..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
+++ /dev/null
@@ -1,160 +0,0 @@
----
-title: Template for an RKE Cluster with a Certificate Signed by Recognized CA and a Layer 4 Load Balancer
-weight: 3
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Certificate signed by a recognized CA
-- Layer 4 load balancer
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/)
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-ingress
-    namespace: cattle-system
-  type: Opaque
-  data:
-    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If self-signed, must be signed by same CA as cattle server
-    tls.key: <BASE64_KEY>  # ssl key for ingress. If self-signed, must be signed by same CA as cattle server
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    - port: 443
-      targetPort: 443
-      protocol: TCP
-      name: https
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: <FQDN>  # FQDN to access cattle server
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - <FQDN>      # FQDN to access cattle server
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          args:
-          - --no-cacerts
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          - containerPort: 443
-            protocol: TCP
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
deleted file mode 100644
index 9b24f5b39d5..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
+++ /dev/null
@@ -1,175 +0,0 @@
----
-title: Template for an RKE Cluster with a Self-signed Certificate and Layer 4 Load Balancer
-weight: 2
----
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Self-signed SSL
-- Layer 4 load balancer
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/)
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-ingress
-    namespace: cattle-system
-  type: Opaque
-  data:
-    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server
-    tls.key: <BASE64_KEY>  # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-server
-    namespace: cattle-system
-  type: Opaque
-  data:
-    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    - port: 443
-      targetPort: 443
-      protocol: TCP
-      name: https
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: <FQDN>  # FQDN to access cattle server
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - <FQDN>      # FQDN to access cattle server
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          - containerPort: 443
-            protocol: TCP
-          volumeMounts:
-          - mountPath: /etc/rancher/ssl
-            name: cattle-keys-volume
-            readOnly: true
-        volumes:
-        - name: cattle-keys-volume
-          secret:
-            defaultMode: 420
-            secretName: cattle-keys-server
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
deleted file mode 100644
index 74f1b8e2e6d..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
+++ /dev/null
@@ -1,158 +0,0 @@
----
-title: Template for an RKE Cluster with a Self-signed Certificate and SSL Termination on Layer 7 Load Balancer
-weight: 3
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Layer 7 load balancer with self-signed SSL termination (HTTPS)
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) 
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-server
-    namespace: cattle-system
-  type: Opaque
-  data:
-    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/ssl-redirect: "false"        # Disable redirect to ssl
-  spec:
-    rules:
-    - host: <FQDN>
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          volumeMounts:
-          - mountPath: /etc/rancher/ssl
-            name: cattle-keys-volume
-            readOnly: true
-        volumes:
-        - name: cattle-keys-volume
-          secret:
-            defaultMode: 420
-            secretName: cattle-keys-server
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
deleted file mode 100644
index 4bb8694b284..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
+++ /dev/null
@@ -1,142 +0,0 @@
----
-title: Template for an RKE Cluster with a Recognized CA Certificate and SSL Termination on Layer 7 Load Balancer
-weight: 4
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Layer 7 load balancer with SSL termination (HTTPS)
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) 
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/ssl-redirect: "false"        # Disable redirect to ssl
-  spec:
-    rules:
-    - host: <FQDN>
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          args:
-          - --no-cacerts
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
deleted file mode 100644
index 2e4c7d93f60..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: cluster.yml Templates
-weight: 1
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster. This section provides templates that can be used to create the cluster.yml.
-
-> For more cluster.yml options, refer to the[RKE configuration reference.]({{<baseurl>}}/rke/latest/en/config-options/).
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/feature-flags/_index.md b/content/rancher/v2.x/en/installation/options/feature-flags/_index.md
deleted file mode 100644
index 7df5e71056c..00000000000
--- a/content/rancher/v2.x/en/installation/options/feature-flags/_index.md
+++ /dev/null
@@ -1,156 +0,0 @@
----
-title: Enabling Experimental Features
-weight: 8000
----
-
-_Available as of v2.3.0_
-
-Rancher includes some features that are experimental and disabled by default. You might want to enable these features, for example, if you decide that the benefits of using an [unsupported storage type]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers) outweighs the risk of using an untested feature. Feature flags were introduced to allow you to try these features that are not enabled by default.
-
-The features can be enabled in three ways:
-
-- [Enable features when starting Rancher.](#enabling-features-when-starting-rancher) When installing Rancher with a CLI, you can use a feature flag to enable a feature by default.
-- [Enable features from the Rancher UI](#enabling-features-with-the-rancher-ui) in Rancher v2.3.3+ by going to the **Settings** page.
-- [Enable features with the Rancher API](#enabling-features-with-the-rancher-api) after installing Rancher.
-
-Each feature has two values:
-
-- A default value, which can be configured with a flag or environment variable from the command line
-- A set value, which can be configured with the Rancher API or UI
-
-If no value has been set, Rancher uses the default value.
-
-Because the API sets the actual value and the command line sets the default value, that means that if you enable or disable a feature with the API or UI, it will override any value set with the command line.
-
-For example, if you install Rancher, then set a feature flag to true with the Rancher API, then upgrade Rancher with a command that sets the feature flag to false, the default value will still be false, but the feature will still be enabled because it was set with the Rancher API. If you then deleted the set value (true) with the Rancher API, setting it to NULL, the default value (false) would take effect.
-
-> **Note:** As of v2.4.0, there are some feature flags that may require a restart of the Rancher server container. These features that require a restart are marked in the table of these docs and in the UI.
-
-The following is a list of the feature flags available in Rancher:
-
-- `dashboard`: This feature enables the new experimental UI that has a new look and feel. The dashboard also leverages a new API in Rancher which allows the UI to access the default Kubernetes resources without any intervention from Rancher.
-- `istio-virtual-service-ui`: This feature enables a [UI to create, read, update, and delete Istio virtual services and destination rules]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/istio-virtual-service-ui), which are traffic management features of Istio.
-- `proxy`: This feature enables Rancher to use a new simplified code base for the proxy, which can help enhance performance and security. The proxy feature is known to have issues with Helm deployments, which prevents any catalog applications to be deployed which includes Rancher's tools like monitoring, logging, Istio, etc.
-- `unsupported-storage-drivers`: This feature [allows unsupported storage drivers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers) In other words, it enables types for storage providers and provisioners that are not enabled by default.
-
-The below table shows the availability and default value for feature flags in Rancher:
-
-| Feature Flag Name             | Default Value | Status       | Available as of | Rancher Restart Required? |
-| ----------------------------- | ------------- | ------------ | --------------- |---|
-| `dashboard` | `true` | Experimental | v2.4.0 | x |
-| `istio-virtual-service-ui`    | `false`       | Experimental | v2.3.0          | |
-| `istio-virtual-service-ui`    | `true`        | GA           | v2.3.2          | |
-| `proxy` | `false` | Experimental | v2.4.0 | |
-| `unsupported-storage-drivers` | `false`       | Experimental | v2.3.0          | |
-
-# Enabling Features when Starting Rancher
-
-When you install Rancher, enable the feature you want with a feature flag. The command is different depending on whether you are installing Rancher on a single node or if you are doing a Kubernetes Installation of Rancher.
-
-> **Note:** Values set from the Rancher API will override the value passed in through the command line.
-
-{{% tabs %}}
-{{% tab "Kubernetes Install" %}}
-When installing Rancher with a Helm chart, use the `--features` option. In the below example, two features are enabled by passing the feature flag names names in a comma separated list:
-
-```
-helm install rancher-latest/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
-  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
-```
-
-Note: If you are installing an alpha version, Helm requires adding the `--devel` option to the command.
-
-### Rendering the Helm Chart for Air Gap Installations
-
-For an air gap installation of Rancher, you need to add a Helm chart repository and render a Helm template before installing Rancher with Helm. For details, refer to the [air gap installation documentation.]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher)
-
-Here is an example of a command for passing in the feature flag names when rendering the Helm template. In the below example, two features are enabled by passing the feature flag names in a comma separated list.
-
-The Helm 3 command is as follows:
-
-```
-helm template rancher ./rancher-<VERSION>.tgz --output-dir . \
-  --namespace cattle-system \
-  --set hostname=<RANCHER.YOURDOMAIN.COM> \
-  --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-  --set ingress.tls.source=secret \
-  --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-  --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
-  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
-```
-
-The Helm 2 command is as follows:
-
-```
-helm template ./rancher-<VERSION>.tgz --output-dir . \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=<RANCHER.YOURDOMAIN.COM> \
-  --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-  --set ingress.tls.source=secret \
-  --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-  --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-  --set 'extraEnv[0].name=CATTLE_FEATURES' # Available as of v2.3.0
-  --set 'extraEnv[0].value=<FEATURE-FLAG-NAME-1>=true,<FEATURE-FLAG-NAME-2>=true' # Available as of v2.3.0
-```
-
-{{% /tab %}}
-{{% tab "Docker Install" %}}
-When installing Rancher with Docker, use the `--features` option. In the below example, two features are enabled by passing the feature flag names in a comma separated list:
-
-```
-docker run -d -p 80:80 -p 443:443 \
-  --restart=unless-stopped \
-  rancher/rancher:rancher-latest \
-  --features=<FEATURE-FLAG-NAME-1>=true,<FEATURE-NAME-2>=true # Available as of v2.3.0
-```
-
-{{% /tab %}}
-{{% /tabs %}}
-
-# Enabling Features with the Rancher UI
-
-_Available as of Rancher v2.3.3_
-
-1. Go to the **Global** view and click **Settings.**
-1. Click the **Feature Flags** tab. You will see a list of experimental features.
-1. To enable a feature, go to the disabled feature you want to enable and click **&#8942; > Activate.**
-
-**Result:** The feature is enabled.
-
-### Disabling Features with the Rancher UI
-
-1. Go to the **Global** view and click **Settings.**
-1. Click the **Feature Flags** tab. You will see a list of experimental features.
-1. To disable a feature, go to the enabled feature you want to disable and click **&#8942; > Deactivate.**
-
-**Result:** The feature is disabled.
-
-# Enabling Features with the Rancher API
-
-1. Go to `<RANCHER-SERVER-URL>/v3/features`.
-1. In the `data` section, you will see an array containing all of the features that can be turned on with feature flags. The name of the feature is in the `id` field. Click the name of the feature you want to enable.
-1. In the upper left corner of the screen, under **Operations,** click **Edit.**
-1. In the **Value** drop-down menu, click **True.**
-1. Click **Show Request.**
-1. Click **Send Request.**
-1. Click **Close.**
-
-**Result:** The feature is enabled.
-
-### Disabling Features with the Rancher API
-
-1. Go to `<RANCHER-SERVER-URL>/v3/features`.
-1. In the `data` section, you will see an array containing all of the features that can be turned on with feature flags. The name of the feature is in the `id` field. Click the name of the feature you want to enable.
-1. In the upper left corner of the screen, under **Operations,** click **Edit.**
-1. In the **Value** drop-down menu, click **False.**
-1. Click **Show Request.**
-1. Click **Send Request.**
-1. Click **Close.**
-
-**Result:** The feature is disabled.
diff --git a/content/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers/_index.md b/content/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers/_index.md
deleted file mode 100644
index 8d254d8bd6d..00000000000
--- a/content/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers/_index.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Allow Unsupported Storage Drivers
-weight: 1
-aliases:
-  - /rancher/v2.x/en/admin-settings/feature-flags/enable-not-default-storage-drivers
----
-_Available as of v2.3.0_
-
-This feature allows you to use types for storage providers and provisioners that are not enabled by default.
-
-To enable or disable this feature, refer to the instructions on [the main page about enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
-
-Environment Variable Key | Default Value | Description
----|---|---
- `unsupported-storage-drivers` | `false` | This feature enables types for storage providers and provisioners that are not enabled by default.
-
-### Types for Persistent Volume Plugins that are Enabled by Default
-Below is a list of storage types for persistent volume plugins that are enabled by default. When enabling this feature flag, any persistent volume plugins that are not on this list are considered experimental and unsupported:
-
-Name | Plugin
---------|----------
-Amazon EBS Disk |  `aws-ebs`
-AzureFile | `azure-file`
-AzureDisk | `azure-disk`
-Google Persistent Disk | `gce-pd`
-Longhorn | `flex-volume-longhorn`
-VMware vSphere Volume |  `vsphere-volume`
-Local | `local`
-Network File System | `nfs`
-hostPath | `host-path`
-
-### Types for StorageClass that are Enabled by Default
-Below is a list of storage types for a StorageClass that are enabled by default. When enabling this feature flag, any persistent volume plugins that are not on this list are considered experimental and unsupported:
-
-Name | Plugin
---------|--------
-Amazon EBS Disk |  `aws-ebs`
-AzureFile | `azure-file`
-AzureDisk | `azure-disk`
-Google Persistent Disk | `gce-pd`
-Longhorn | `flex-volume-longhorn`
-VMware vSphere Volume | `vsphere-volume`
-Local | `local`
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/feature-flags/istio-virtual-service-ui/_index.md b/content/rancher/v2.x/en/installation/options/feature-flags/istio-virtual-service-ui/_index.md
deleted file mode 100644
index f631b54d2ee..00000000000
--- a/content/rancher/v2.x/en/installation/options/feature-flags/istio-virtual-service-ui/_index.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: UI for Istio Virtual Services and Destination Rules
-weight: 2
-aliases:
-  - /rancher/v2.x/en/admin-settings/feature-flags/istio-virtual-service-ui
----
-_Available as of v2.3.0_
-
-This feature enables a UI that lets you create, read, update and delete virtual services and destination rules, which are traffic management features of Istio.
-
-> **Prerequisite:** Turning on this feature does not enable Istio. A cluster administrator needs to [enable Istio for the cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) in order to use the feature.
-
-To enable or disable this feature, refer to the instructions on [the main page about enabling experimental features.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/)
-
-Environment Variable Key | Default Value | Status | Available as of
----|---|---|---
-`istio-virtual-service-ui` |`false` |  Experimental | v2.3.0
-`istio-virtual-service-ui` | `true` | GA                    | v2.3.2
-
-# About this Feature
-
-A central advantage of Istio's traffic management features is that they allow dynamic request routing, which is useful for canary deployments, blue/green deployments, or A/B testing.
-
-When enabled, this feature turns on a page that lets you configure some traffic management features of Istio using the Rancher UI. Without this feature, you need to use `kubectl` to manage traffic with Istio.
-
-The feature enables two UI tabs: one tab for **Virtual Services** and another for **Destination Rules.** 
-
-- **Virtual services** intercept and direct traffic to your Kubernetes services, allowing you to direct percentages of traffic from a request to different services. You can use them to define a set of routing rules to apply when a host is addressed. For details, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/)
-- **Destination rules** serve as the single source of truth about which service versions are available to receive traffic from virtual services. You can use these resources to define policies that apply to traffic that is intended for a service after routing has occurred. For details, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule)
-
-To see these tabs,
-
-1. Go to the project view in Rancher and click **Resources > Istio.**
-1. You will see tabs for **Traffic Graph,** which has the Kiali network visualization integrated into the UI, and **Traffic Metrics,** which shows metrics for the success rate and request volume of traffic to your services, among other metrics. Next to these tabs, you should see the tabs for **Virtual Services** and **Destination Rules.**
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/helm2/_index.md b/content/rancher/v2.x/en/installation/options/helm2/_index.md
deleted file mode 100644
index cb60fb18d6d..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/_index.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: Kubernetes Installation Using Helm 2
-weight: 1
----
-
-> After Helm 3 was released, the Rancher installation instructions were updated to use Helm 3.
->
-> If you are using Helm 2, we recommend [migrating to Helm 3](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) because it is simpler to use and more secure than Helm 2.
->
-> This section provides a copy of the older high-availability Kubernetes Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
-
-For production environments, we recommend installing Rancher in a high-availability configuration so that your user base can always access Rancher Server. When installed in a Kubernetes cluster, Rancher will integrate with the cluster's etcd database and take advantage of Kubernetes scheduling for high-availability.
-
-This procedure walks you through setting up a 3-node cluster with Rancher Kubernetes Engine (RKE) and installing the Rancher chart with the Helm package manager.
-
-> **Important:** The Rancher management server can only be run on an RKE-managed Kubernetes cluster. Use of Rancher on hosted Kubernetes or other providers is not supported.
-
-> **Important:** For the best performance, we recommend a dedicated Kubernetes cluster for the Rancher management server. Running user workloads on this cluster is not advised. After deploying Rancher, you can [create or import clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/#cluster-creation-in-rancher) for running your workloads.
-
-## Recommended Architecture
-
-- DNS for Rancher should resolve to a Layer 4 load balancer (TCP)
-- The Load Balancer should forward port TCP/80 and TCP/443 to all 3 nodes in the Kubernetes cluster.
-- The Ingress controller will redirect HTTP to HTTPS and terminate SSL/TLS on port TCP/443.
-- The Ingress controller will forward traffic to port TCP/80 on the pod in the Rancher deployment.
-
-<figcaption>Kubernetes Rancher install with layer 4 load balancer, depicting SSL termination at ingress controllers</figcaption>
-![High-availability Kubernetes Install]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-<sup>Kubernetes Rancher install with Layer 4 load balancer (TCP), depicting SSL termination at ingress controllers</sup>
-
-## Required Tools
-
-The following CLI tools are required for this install. Please make sure these tools are installed and available in your `$PATH`
-
-- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool.
-- [rke]({{<baseurl>}}/rke/latest/en/installation/) - Rancher Kubernetes Engine, cli for building Kubernetes clusters.
-- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-## Installation Outline
-
-- [Create Nodes and Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/)
-- [Install Kubernetes with RKE]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/)
-- [Initialize Helm (tiller)]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-init/)
-- [Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/)
-
-## Additional Install Options
-
-- [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/)
-
-## Previous Methods
-
-[RKE add-on install]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/)
-
-> **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
-> Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
-> If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the Helm chart.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/_index.md
deleted file mode 100644
index cd5da9e8763..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/_index.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: "1. Create Nodes and Load Balancer"
-weight: 185
----
-
-Use your provider of choice to provision 3 nodes and a Load Balancer endpoint for your RKE install.
-
-> **Note:** These nodes must be in the same region/datacenter.  You may place these servers in separate availability zones.
-
-### Node Requirements
-
-View the supported operating systems and hardware/software/networking requirements for nodes running Rancher at [Node Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-View the OS requirements for RKE at [RKE Requirements]({{<baseurl>}}/rke/latest/en/os/)
-
-### Load Balancer
-
-RKE will configure an Ingress controller pod, on each of your nodes. The Ingress controller pods are bound to ports TCP/80 and TCP/443 on the host network and are the entry point for HTTPS traffic to the Rancher server.
-
-Configure a load balancer as a basic Layer 4 TCP forwarder. The exact configuration will vary depending on your environment. 
-
->**Important:**
->Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications.
-
-#### Examples
-
-* [Nginx]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nginx/)
-* [Amazon NLB]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nlb/)
-
-### [Next: Install Kubernetes with RKE]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/)
diff --git a/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nginx/_index.md
deleted file mode 100644
index 253ca02b735..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nginx/_index.md
+++ /dev/null
@@ -1,79 +0,0 @@
----
-title: NGINX
-weight: 270
----
-NGINX will be configured as Layer 4 load balancer (TCP) that forwards connections to one of your Rancher nodes.
-
->**Note:**
-> In this configuration, the load balancer is positioned in front of your nodes. The load balancer can be any host capable of running NGINX.
->
-> One caveat: do not use one of your Rancher nodes as the load balancer.
-
-## Install NGINX
-
-Start by installing NGINX on the node you want to use as a load balancer. NGINX has packages available for all known operating systems. The versions tested are `1.14` and `1.15`. For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-The `stream` module is required, which is present when using the official NGINX packages. Please refer to your OS documentation on how to install and enable the NGINX `stream` module on your operating system.
-
-## Create NGINX Configuration
-
-After installing NGINX, you need to update the NGINX configuration file, `nginx.conf`, with the IP addresses for your nodes.
-
-1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`.
-
-2. From `nginx.conf`, replace both occurrences (port 80 and port 443) of `<IP_NODE_1>`, `<IP_NODE_2>`, and `<IP_NODE_3>` with the IPs of your [nodes]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/).
-
-    >**Note:** See [NGINX Documentation: TCP and UDP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/) for all configuration options.
-
-    <figcaption>Example NGINX config</figcaption>
-    ```
-    worker_processes 4;
-    worker_rlimit_nofile 40000;
-
-    events {
-        worker_connections 8192;
-    }
-
-    stream {
-        upstream rancher_servers_http {
-            least_conn;
-            server <IP_NODE_1>:80 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_2>:80 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_3>:80 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen     80;
-            proxy_pass rancher_servers_http;
-        }
-
-        upstream rancher_servers_https {
-            least_conn;
-            server <IP_NODE_1>:443 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_2>:443 max_fails=3 fail_timeout=5s;
-            server <IP_NODE_3>:443 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen     443;
-            proxy_pass rancher_servers_https;
-        }
-    }
-    ```
-
-3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`.
-
-4. Load the updates to your NGINX configuration by running the following command:
-
-    ```
-    # nginx -s reload
-    ```
-
-## Option - Run NGINX as Docker container
-
-Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /etc/nginx.conf:/etc/nginx/nginx.conf \
-  nginx:1.14
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nlb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nlb/_index.md
deleted file mode 100644
index c22d03a5739..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/create-nodes-lb/nlb/_index.md
+++ /dev/null
@@ -1,175 +0,0 @@
----
-title: Amazon NLB
-weight: 277
----
-## Objectives
-
-Configuring an Amazon NLB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow.
-
-1. [Create Target Groups](#create-target-groups)
-
-	Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
-
-2. [Register Targets](#register-targets)
-
-	Add your Linux nodes to the target groups.
-
-3. [Create Your NLB](#create-your-nlb)
-
-	Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
-
-> **Note:** Rancher only supports using the Amazon NLB when terminating traffic in `tcp` mode for port 443 rather than `tls` mode. This is due to the fact that the NLB does not inject the correct headers into requests when terminated at the NLB. This means that if you want to use certificates managed by the Amazon Certificate Manager (ACM), you should use an ELB or ALB.
-
-## Create Target Groups
-
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX ingress controller on the nodes will make sure that port 80 gets redirected to port 443.
-
-Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
-
-The Target Groups configuration resides in the **Load Balancing** section of the **EC2** service. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
-
-{{< img "/img/rancher/ha/nlb/ec2-loadbalancing.png" "EC2 Load Balancing section">}}
-
-Click **Create target group** to create the first target group, regarding TCP port 443.
-
-### Target Group (TCP port 443)
-
-Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
-
-Option                                | Setting
---------------------------------------|------------------------------------
-Target Group Name                     | `rancher-tcp-443`
-Protocol                              | `TCP`
-Port                                  | `443`
-Target type                           | `instance`
-VPC                                   | Choose your VPC
-Protocol<br/>(Health Check)           | `HTTP`
-Path<br/>(Health Check)               | `/healthz`
-Port (Advanced health check)          | `override`,`80`
-Healthy threshold (Advanced health)   | `3`
-Unhealthy threshold (Advanced)        | `3`
-Timeout (Advanced)                    | `6 seconds`
-Interval (Advanced)                   | `10 second`
-Success codes                         | `200-399`
-
-<hr>
-**Screenshot Target group TCP port 443 settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-443.png" "Target group 443">}}
-
-<hr>
-**Screenshot Target group TCP port 443 Advanced settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-443-advanced.png" "Target group 443 Advanced">}}
-
-<hr>
-
-Click **Create target group** to create the second target group, regarding TCP port 80.
-
-### Target Group (TCP port 80)
-
-Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table.
-
-Option                                | Setting
---------------------------------------|------------------------------------
-Target Group Name                     | `rancher-tcp-80`
-Protocol                              | `TCP`
-Port                                  | `80`
-Target type                           | `instance`
-VPC                                   | Choose your VPC
-Protocol<br/>(Health Check)           | `HTTP`
-Path<br/>(Health Check)               | `/healthz`
-Port (Advanced health check)          | `traffic port`
-Healthy threshold (Advanced health)   | `3`
-Unhealthy threshold (Advanced)        | `3`
-Timeout (Advanced)                    | `6 seconds`
-Interval (Advanced)                   | `10 second`
-Success codes                         | `200-399`
-
-<hr>
-**Screenshot Target group TCP port 80 settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-80.png" "Target group 80">}}
-
-<hr>
-**Screenshot Target group TCP port 80 Advanced settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-80-advanced.png" "Target group 80 Advanced">}}
-
-<hr>
-
-## Register Targets
-
-Next, add your Linux nodes to both target groups.
-
-Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**.
-
-{{< img "/img/rancher/ha/nlb/edit-targetgroup-443.png" "Edit target group 443">}}
-
-Select the instances (Linux nodes) you want to add, and click **Add to registered**.
-
-<hr>
-**Screenshot Add targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/add-targets-targetgroup-443.png" "Add targets to target group 443">}}
-
-<hr>
-**Screenshot Added targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/added-targets-targetgroup-443.png" "Added targets to target group 443">}}
-
-When the instances are added, click **Save** on the bottom right of the screen.
-
-Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group.
-
-## Create Your NLB
-
-Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in [Create Target Groups](#create-target-groups).
-
-1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
-
-2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**.
-
-3. Click **Create Load Balancer**.
-
-4. Choose **Network Load Balancer** and click **Create**.
-
-5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
-
-	   - Name: `rancher`
-	   - Scheme: `internal` or `internet-facing`
-	   
-	     The Scheme that you choose for your NLB is dependent on the configuration of your instances/VPC. If your instances do not have public IPs associated with them, or you will only be accessing Rancher internally, you should set your NLB Scheme to `internal` rather than `internet-facing`. 
-	- **Listeners**
-
-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `TCP`: `443`
-
-	- **Availability Zones**
-
-	   - Select Your **VPC** and **Availability Zones**.
-
-6. Complete the **Step 2: Configure Routing** form.
-
-	- From the **Target Group** drop-down, choose **Existing target group**.
-
-	- From the **Name** drop-down, choose `rancher-tcp-443`.
-
-	- Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.
-
-7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**.
-
-8. Complete **Step 4: Review**. Look over the load balancer details and click **Create** when you're satisfied.
-
-9. After AWS creates the NLB, click **Close**.
-
-## Add listener to NLB for TCP port 80
-
-1. Select your newly created NLB and select the **Listeners** tab.
-
-2. Click **Add listener**.
-
-3. Use `TCP`:`80` as **Protocol** : **Port**
-
-4. Click **Add action** and choose **Forward to...**
-
-5. From the **Forward to** drop-down, choose `rancher-tcp-80`.
-
-6. Click **Save** in the top right of the screen.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-init/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-init/_index.md
deleted file mode 100644
index 3eefe165e48..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-init/_index.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: "Initialize Helm: Install the Tiller Service"
-description: "With Helm, you can create configurable deployments instead of using static files. In order to use Helm, the Tiller service needs to be installed on your cluster."
-weight: 195
----
-
-Helm is the package management tool of choice for Kubernetes. Helm "charts" provide templating syntax for Kubernetes YAML manifest documents. With Helm we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at [https://helm.sh/](https://helm.sh/). To be able to use Helm, the server-side component `tiller` needs to be installed on your cluster.
-
-For systems without direct internet access, see [Helm - Air Gap]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#helm) for install details.
-
-Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-> **Note:** The installation instructions assume you are using Helm 2. The instructions will be updated for Helm 3 soon. In the meantime, if you want to use Helm 3, refer to [these instructions.](https://github.com/ibrokethecloud/rancher-helm3)
-
-### Install Tiller on the Cluster
-
-> **Important:** Due to an issue with Helm v2.12.0 and cert-manager, please use Helm v2.12.1 or higher.
-
-Helm installs the `tiller` service on your cluster to manage charts. Since RKE enables RBAC by default we will need to use `kubectl` to create a `serviceaccount` and `clusterrolebinding` so `tiller` has permission to deploy to the cluster.
-
-* Create the `ServiceAccount` in the `kube-system` namespace.
-* Create the `ClusterRoleBinding` to give the `tiller` account access to the cluster.
-* Finally use `helm` to install the `tiller` service
-
-```plain
-kubectl -n kube-system create serviceaccount tiller
-
-kubectl create clusterrolebinding tiller \
-  --clusterrole=cluster-admin \
-  --serviceaccount=kube-system:tiller
-
-helm init --service-account tiller
-
-# Users in China: You will need to specify a specific tiller-image in order to initialize tiller. 
-# The list of tiller image tags are available here: https://dev.aliyun.com/detail.html?spm=5176.1972343.2.18.ErFNgC&repoId=62085. 
-# When initializing tiller, you'll need to pass in --tiller-image
-
-helm init --service-account tiller \
---tiller-image registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:<tag>
-```
-
-> **Note:** This`tiller`install has full cluster access, which should be acceptable if the cluster is dedicated to Rancher server. Check out the [helm docs](https://docs.helm.sh/using_helm/#role-based-access-control) for restricting `tiller` access to suit your security requirements.
-
-### Test your Tiller installation
-
-Run the following command to verify the installation of `tiller` on your cluster:
-
-```
-kubectl -n kube-system  rollout status deploy/tiller-deploy
-Waiting for deployment "tiller-deploy" rollout to finish: 0 of 1 updated replicas are available...
-deployment "tiller-deploy" successfully rolled out
-```
-
-And run the following command to validate Helm can talk to the `tiller` service:
-
-```
-helm version
-Client: &version.Version{SemVer:"v2.12.1", GitCommit:"02a47c7249b1fc6d8fd3b94e6b4babf9d818144e", GitTreeState:"clean"}
-Server: &version.Version{SemVer:"v2.12.1", GitCommit:"02a47c7249b1fc6d8fd3b94e6b4babf9d818144e", GitTreeState:"clean"}
-```
-
-### Issues or errors?
-
-See the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-init/troubleshooting/) page.
-
-### [Next: Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/)
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-init/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-init/troubleshooting/_index.md
deleted file mode 100644
index 6dd085454eb..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-init/troubleshooting/_index.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-title: Troubleshooting
-weight: 276
----
-
-### Helm commands show forbidden
-
-When Helm is initiated in the cluster without specifying the correct `ServiceAccount`, the command `helm init` will succeed but you won't be able to execute most of the other `helm` commands. The following error will be shown:
-
-```
-Error: configmaps is forbidden: User "system:serviceaccount:kube-system:default" cannot list configmaps in the namespace "kube-system"
-```
-
-To resolve this, the server component (`tiller`) needs to be removed and added with the correct `ServiceAccount`. You can use `helm reset --force` to remove the `tiller` from the cluster. Please check if it is removed using `helm version --server`.
-
-```
-helm reset --force
-Tiller (the Helm server-side component) has been uninstalled from your Kubernetes Cluster.
-helm version --server
-Error: could not find tiller
-```
-
-When you have confirmed that `tiller` has been removed, please follow the steps provided in [Initialize Helm (Install tiller)]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-init/) to install `tiller` with the correct `ServiceAccount`.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
deleted file mode 100644
index ddd8d3db46e..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ /dev/null
@@ -1,218 +0,0 @@
----
-title: "4.  Install Rancher"
-weight: 200
----
-
-Rancher installation is managed using the Helm package manager for Kubernetes.  Use `helm` to install the prerequisite and charts to install Rancher.
-
-For systems without direct internet access, see [Air Gap: Kubernetes install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/).
-
-Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-> **Note:** The installation instructions assume you are using Helm 2. The instructions will be updated for Helm 3 soon. In the meantime, if you want to use Helm 3, refer to [these instructions.](https://github.com/ibrokethecloud/rancher-helm3)
-
-### Add the Helm Chart Repository
-
-Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-
-{{< release-channel >}}
-
-```
-helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-```
-
-### Choose your SSL Configuration
-
-Rancher Server is designed to be secure by default and requires SSL/TLS configuration.
-
-There are three recommended options for the source of the certificate.
-
-> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#external-tls-termination).
-
-| Configuration | Chart option | Description | Requires cert-manager |
-|-----|-----|-----|-----|
-| [Rancher Generated Certificates](#rancher-generated-certificates) | `ingress.tls.source=rancher` | Use certificates issued by Rancher's generated CA (self signed)<br/>This is the **default** | [yes](#optional-install-cert-manager) |
-| [Let’s Encrypt](#let-s-encrypt) | `ingress.tls.source=letsEncrypt` | Use [Let's Encrypt](https://letsencrypt.org/) to issue a certificate | [yes](#optional-install-cert-manager) |
-| [Certificates from Files](#certificates-from-files) | `ingress.tls.source=secret` | Use your own certificate files by creating Kubernetes Secret(s) | no |
-
-### Optional: Install cert-manager
-
-**Note:** cert-manager is only required for certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) and Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). You should skip this step if you are using your own certificate files (option `ingress.tls.source=secret`) or if you use [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#external-tls-termination).
-
-> **Important:**
-> Due to an issue with Helm v2.12.0 and cert-manager, please use Helm v2.12.1 or higher.
-
-> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-Rancher relies on [cert-manager](https://github.com/jetstack/cert-manager) to issue certificates from Rancher's own generated CA or to request Let's Encrypt certificates.
-
-These instructions are adapted from the [official cert-manager documentation](https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html#installing-with-helm).
-
-
-1. Install the CustomResourceDefinition resources separately
-    ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    ```
-
-1. Create the namespace for cert-manager
-    ```plain
-    kubectl create namespace cert-manager
-    ```
-
-1. Label the cert-manager namespace to disable resource validation
-    ```plain
-    kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true
-    ```
-
-1. Add the Jetstack Helm repository
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    ```
-
-1. Update your local Helm chart repository cache
-    ```plain
-    helm repo update
-    ```
-
-1. Install the cert-manager Helm chart
-    ```plain
-    helm install \
-      --name cert-manager \
-      --namespace cert-manager \
-      --version v0.12.0 \
-      jetstack/cert-manager
-    ```
-
-Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
-
-```
-kubectl get pods --namespace cert-manager
-
-NAME                                            READY   STATUS      RESTARTS   AGE
-cert-manager-7cbdc48784-rpgnt                   1/1     Running     0          3m
-cert-manager-webhook-5b5dd6999-kst4x            1/1     Running     0          3m
-cert-manager-cainjector-3ba5cd2bcd-de332x       1/1     Running     0          3m
-```
-
-If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check the [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide.
-
-<br/>
-
-#### Rancher Generated Certificates
-
-> **Note:** You need to have [cert-manager](#optional-install-cert-manager) installed before proceeding.
-
-The default is for Rancher to generate a CA and uses `cert-manager` to issue the certificate for access to the Rancher server interface. Because `rancher` is the default option for `ingress.tls.source`, we are not specifying `ingress.tls.source` when running the `helm install` command.
-
-- Set the `hostname` to the DNS name you pointed at your load balancer.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-#### Let's Encrypt
-
-> **Note:** You need to have [cert-manager](#optional-install-cert-manager) installed before proceeding.
-
-This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA. This configuration uses HTTP validation (`HTTP-01`) so the load balancer must have a public DNS record and be accessible from the internet.
-
-- Set `hostname` to the public DNS record, set `ingress.tls.source` to `letsEncrypt` and `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices)
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=letsEncrypt \
-  --set letsEncrypt.email=me@example.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-#### Certificates from Files
-
-Create Kubernetes secrets from your own certificates for Rancher to use.
-
-
-> **Note:** The `Common Name` or a `Subject Alternative Names` entry in the server certificate must match the `hostname` option, or the ingress controller will fail to configure correctly. Although an entry in the `Subject Alternative Names` is technically required, having a matching `Common Name` maximizes compatibility with older browsers/applications. If you want to check if your certificates are correct, see [How do I check Common Name and Subject Alternative Names in my server certificate?]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-do-i-check-common-name-and-subject-alternative-names-in-my-server-certificate)
-
-- Set `hostname` and set `ingress.tls.source` to `secret`.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret
-```
-
-If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret
-  --set privateCA=true
-```
-
-Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
-
-After adding the secrets, check if Rancher was rolled out successfully:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-If you see the following error: `error: deployment "rancher" exceeded its progress deadline`, you can check the status of the deployment by running the following command:
-
-```
-kubectl -n cattle-system get deploy rancher
-NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
-rancher   3         3         3            3           3m
-```
-
-It should show the same count for `DESIRED` and `AVAILABLE`.
-
-### Advanced Configurations
-
-The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios.
-
-* [HTTP Proxy]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#http-proxy)
-* [Private Docker Image Registry]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#private-registry-and-air-gap-installs)
-* [TLS Termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#external-tls-termination)
-
-See the [Chart Options]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/) for the full list of options.
-
-### Save your options
-
-Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
-
-### Finishing Up
-
-That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page.
-
-Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/) Page
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
deleted file mode 100644
index 261365488ac..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
+++ /dev/null
@@ -1,245 +0,0 @@
----
-title: Chart Options
-weight: 276
----
-
-### Common Options
-
-| Option | Default Value | Description |
-| --- | --- | --- |
-| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server |
-| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
-| `letsEncrypt.email` | " " | `string` - Your email address |
-| `letsEncrypt.environment` | "production" | `string` - Valid options: "staging, production" |
-| `privateCA` | false | `bool` - Set to true if your cert is signed by a private CA |
-
-<br/>
-
-### Advanced Options
-
-| Option | Default Value | Description |
-| --- | --- | --- |
-| `additionalTrustedCAs` | false | `bool` - See [Additional Trusted CAs](#additional-trusted-cas) |
-| `addLocal` | "auto" | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster) |
-| `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" |
-| `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" |
-| `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) |
-| `auditLog.level` | 0 | `int` - set the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) level. 0 is off. [0-3] |
-| `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) |
-| `auditLog.maxBackups` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) |
-| `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated  (only applies when `auditLog.destination` is set to `hostPath`) |
-| `busyboxImage` | "busybox" | `string` - Image location for busybox image used to collect audit logs _Note: Available as of v2.2.0_ |
-| `debug` | false | `bool` - set debug flag on rancher server |
-| `extraEnv` | [] | `list` - set additional environment variables for Rancher _Note: Available as of v2.2.0_ |
-| `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials |
-| `ingress.extraAnnotations` | {} | `map` - additional annotations to customize the ingress |
-| `ingress.configurationSnippet` | "" | `string` - Add additional Nginx configuration. Can be used for proxy configuration. _Note: Available as of v2.0.15, v2.1.10 and v2.2.4_ |
-| `proxy` | "" | `string` -  HTTP[S] proxy server for Rancher |
-| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" | `string` - comma separated list of hostnames or ip address not to use the proxy |
-| `resources` | {} | `map` - rancher pod resource requests & limits |
-| `rancherImage` | "rancher/rancher" | `string` - rancher image source |
-| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag |
-| `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" |
-| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/ _Available as of v2.3.0_ |
-| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. _Available as of v2.3.0_
-
-<br/>
-
-### API Audit Log
-
-Enabling the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing/).
-
-You can collect this log as you would any container log. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the `System` Project on the Rancher server cluster.
-
-```plain
---set auditLog.level=1
-```
-
-By default enabling Audit Logging will create a sidecar container in the Rancher pod. This container (`rancher-audit-log`) will stream the log to `stdout`.  You can collect this log as you would any container log. When using the sidecar as the audit log destination, the `hostPath`, `maxAge`, `maxBackups`, and `maxSize` options do not apply. It's advised to use your OS or Docker daemon's log rotation features to control disk space use. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the Rancher server cluster or System Project.
-
-Set the `auditLog.destination` to `hostPath` to forward logs to volume shared with the host system instead of streaming to a sidecar container. When setting the destination to `hostPath` you may want to adjust the other auditLog parameters for log rotation.
-
-### Setting Extra Environment Variables
-
-_Available as of v2.2.0_
-
-You can set extra environment variables for Rancher server using `extraEnv`. This list uses the same `name` and `value` keys as the container manifest definitions. Remember to quote the values.
-
-```plain
---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
---set 'extraEnv[0].value=1.0'
-```
-
-### TLS settings
-
-_Available as of v2.2.0_
-
-To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
-
-```plain
---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
---set 'extraEnv[0].value=1.0'
-```
-
-See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options.
-
-### Import `local` Cluster
-
-By default Rancher server will detect and import the `local` cluster it's running on.  User with access to the `local` cluster will essentially have "root" access to all the clusters managed by Rancher server.
-
-If this is a concern in your environment you can set this option to "false" on your initial install.
-
-> Note: This option is only effective on the initial Rancher install. See [Issue 16522](https://github.com/rancher/rancher/issues/16522) for more information.
-
-```plain
---set addLocal="false"
-```
-
-### Customizing your Ingress
-
-To customize or use a different ingress with Rancher server you can set your own Ingress annotations.
-
-Example on setting a custom certificate issuer:
-
-```plain
---set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair
-```
-
-_Available as of v2.0.15, v2.1.10 and v2.2.4_
-
-Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used.
-
-```plain
---set ingress.configurationSnippet='more_set_input_headers X-Forwarded-Host {{ .Values.hostname }};'
-```
-
-### HTTP Proxy
-
-Rancher requires internet access for some functionality (helm charts). Use `proxy` to set your proxy server.
-
-Add your IP exceptions to the `noProxy` list. Make sure you add the Service cluster IP range (default: 10.43.0.1/16) and any worker cluster `controlplane` nodes. Rancher supports CIDR notation ranges in this list.
-
-```plain
---set proxy="http://<username>:<password>@<proxy_url>:<proxy_port>/"
---set noProxy="127.0.0.0/8\,10.0.0.0/8\,172.16.0.0/12\,192.168.0.0/16"
-```
-
-### Additional Trusted CAs
-
-If you have private registries, catalogs or a proxy that intercepts certificates, you may need to add additional trusted CAs to Rancher.
-
-```plain
---set additionalTrustedCAs=true
-```
-
-Once the Rancher deployment is created, copy your CA certs in pem format into a file named `ca-additional.pem` and use `kubectl` to create the `tls-ca-additional` secret in the `cattle-system` namespace.
-
-```plain
-kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem
-```
-
-### Private Registry and Air Gap Installs
-
-For details on installing Rancher with a private registry, see:
-
-- [Air Gap: Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/)
-- [Air Gap: Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/)
-
-
-### External TLS Termination
-
-We recommend configuring your load balancer as a Layer 4 balancer, forwarding plain 80/tcp and 443/tcp to the Rancher Management cluster nodes. The Ingress Controller on the cluster will redirect http traffic on port 80 to https on port 443.
-
-You may terminate the SSL/TLS on a L7 load balancer external to the Rancher cluster (ingress). Use the `--set tls=external` option and point your load balancer at port http 80 on all of the Rancher cluster nodes. This will expose the Rancher interface on http port 80. Be aware that clients that are allowed to connect directly to the Rancher cluster will not be encrypted. If you choose to do this we recommend that you restrict direct access at the network level to just your load balancer.
-
-> **Note:** If you are using a Private CA signed certificate, add `--set privateCA=true` and see [Adding TLS Secrets - Using a Private CA Signed Certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/#using-a-private-ca-signed-certificate) to add the CA cert for Rancher.
-
-Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly.
-
-#### Configuring Ingress for External TLS when Using NGINX v0.25
-
-In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress:
-
-```yaml
-ingress:
-  provider: nginx
-  options:
-    use-forwarded-headers: "true"
-```
-
-#### Required Headers
-
-* `Host`
-* `X-Forwarded-Proto`
-* `X-Forwarded-Port`
-* `X-Forwarded-For`
-
-#### Recommended Timeouts
-
-* Read Timeout: `1800 seconds`
-* Write Timeout: `1800 seconds`
-* Connect Timeout: `30 seconds`
-
-#### Health Checks
-
-Rancher will respond `200` to health checks on the `/healthz` endpoint.
-
-
-#### Example NGINX config
-
-This NGINX configuration is tested on NGINX 1.14.
-
-  >**Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/).
-
-* Replace `IP_NODE1`, `IP_NODE2` and `IP_NODE3` with the IP addresses of the nodes in your cluster.
-* Replace both occurrences of `FQDN` to the DNS name for Rancher.
-* Replace `/certs/fullchain.pem` and `/certs/privkey.pem` to the location of the server certificate and the server certificate key respectively.
-
-```
-worker_processes 4;
-worker_rlimit_nofile 40000;
-
-events {
-    worker_connections 8192;
-}
-
-http {
-    upstream rancher {
-        server IP_NODE_1:80;
-        server IP_NODE_2:80;
-        server IP_NODE_3:80;
-    }
-
-    map $http_upgrade $connection_upgrade {
-        default Upgrade;
-        ''      close;
-    }
-
-    server {
-        listen 443 ssl http2;
-        server_name FQDN;
-        ssl_certificate /certs/fullchain.pem;
-        ssl_certificate_key /certs/privkey.pem;
-
-        location / {
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass http://rancher;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
-            proxy_read_timeout 900s;
-            proxy_buffering off;
-        }
-    }
-
-    server {
-        listen 80;
-        server_name FQDN;
-        return 301 https://$server_name$request_uri;
-    }
-}
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
deleted file mode 100644
index 65a9b8435fa..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-title: Adding Kubernetes TLS Secrets
-description: Read about how to populate the Kubernetes TLS secret for a Rancher installation  
-weight: 276
----
-
-Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key.
-
-Combine the server certificate followed by any intermediate certificate(s) needed into a file named `tls.crt`. Copy your certificate key into a file named `tls.key`.
-
-For example, [acme.sh](https://acme.sh) provides server certificate and CA chains in `fullchain.cer` file. 
-This `fullchain.cer` should be renamed to `tls.crt` & certificate key file as `tls.key`.
-
-Use `kubectl` with the `tls` secret type to create the secrets.
-
-```
-kubectl -n cattle-system create secret tls tls-rancher-ingress \
-  --cert=tls.crt \
-  --key=tls.key
-```
-
-> **Note:** If you want to replace the certificate, you can delete the `tls-rancher-ingress` secret using `kubectl -n cattle-system delete secret tls-rancher-ingress` and add a new one using the command shown above. If you are using a private CA signed certificate, replacing the certificate is only possible if the new certificate is signed by the same CA as the certificate currently in use.
-
-### Using a Private CA Signed Certificate
-
-If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server.
-
-Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
-
-```
-kubectl -n cattle-system create secret generic tls-ca \
-  --from-file=cacerts.pem=./cacerts.pem
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/_index.md
deleted file mode 100644
index d5ef3d045f6..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/_index.md
+++ /dev/null
@@ -1,133 +0,0 @@
----
-title: Troubleshooting
-weight: 276
----
-
-### Where is everything
-
-Most of the troubleshooting will be done on objects in these 3 namespaces.
-
-* `cattle-system` - `rancher` deployment and pods.
-* `ingress-nginx` - Ingress controller pods and services.
-* `kube-system` - `tiller` and `cert-manager` pods.
-
-### "default backend - 404"
-
-A number of things can cause the ingress-controller not to forward traffic to your rancher instance. Most of the time its due to a bad ssl configuration.
-
-Things to check
-
-* [Is Rancher Running](#is-rancher-running)
-* [Cert CN is "Kubernetes Ingress Controller Fake Certificate"](#cert-cn-is-kubernetes-ingress-controller-fake-certificate)
-
-### Is Rancher Running
-
-Use `kubectl` to check the `cattle-system` system namespace and see if the Rancher pods are in a Running state.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-If the state is not `Running`, run a `describe` on the pod and check the Events.
-
-```
-kubectl -n cattle-system describe pod
-
-...
-Events:
-  Type     Reason                 Age   From                Message
-  ----     ------                 ----  ----                -------
-  Normal   Scheduled              11m   default-scheduler   Successfully assigned rancher-784d94f59b-vgqzh to localhost
-  Normal   SuccessfulMountVolume  11m   kubelet, localhost  MountVolume.SetUp succeeded for volume "rancher-token-dj4mt"
-  Normal   Pulling                11m   kubelet, localhost  pulling image "rancher/rancher:v2.0.4"
-  Normal   Pulled                 11m   kubelet, localhost  Successfully pulled image "rancher/rancher:v2.0.4"
-  Normal   Created                11m   kubelet, localhost  Created container
-  Normal   Started                11m   kubelet, localhost  Started container
-```
-
-### Checking the rancher logs
-
-Use `kubectl` to list the pods.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-Use `kubectl` and the pod name to list the logs from the pod.
-
-```
-kubectl -n cattle-system logs -f rancher-784d94f59b-vgqzh
-```
-
-### Cert CN is "Kubernetes Ingress Controller Fake Certificate"
-
-Use your browser to check the certificate details. If it says the Common Name is "Kubernetes Ingress Controller Fake Certificate", something may have gone wrong with reading or issuing your SSL cert.
-
-> **Note:** if you are using LetsEncrypt to issue certs it can sometimes take a few minuets to issue the cert.
-
-#### cert-manager issued certs (Rancher Generated or LetsEncrypt)
-
-`cert-manager` has 3 parts.
-
-* `cert-manager` pod in the `kube-system` namespace.
-* `Issuer` object in the `cattle-system` namespace.
-* `Certificate` object in the `cattle-system` namespace.
-
-Work backwards and do a `kubectl describe` on each object and check the events. You can track down what might be missing.
-
-For example there is a problem with the Issuer:
-
-```
-kubectl -n cattle-system describe certificate
-...
-Events:
-  Type     Reason          Age                 From          Message
-  ----     ------          ----                ----          -------
-  Warning  IssuerNotReady  18s (x23 over 19m)  cert-manager  Issuer rancher not ready
-```
-
-```
-kubectl -n cattle-system describe issuer
-...
-Events:
-  Type     Reason         Age                 From          Message
-  ----     ------         ----                ----          -------
-  Warning  ErrInitIssuer  19m (x12 over 19m)  cert-manager  Error initializing issuer: secret "tls-rancher" not found
-  Warning  ErrGetKeyPair  9m (x16 over 19m)   cert-manager  Error getting keypair for CA issuer: secret "tls-rancher" not found
-```
-
-#### Bring Your Own SSL Certs
-
-Your certs get applied directly to the Ingress object in the `cattle-system` namespace.
-
-Check the status of the Ingress object and see if its ready.
-
-```
-kubectl -n cattle-system describe ingress
-```
-
-If its ready and the SSL is still not working you may have a malformed cert or secret.
-
-Check the nginx-ingress-controller logs. Because the nginx-ingress-controller has multiple containers in its pod you will need to specify the name of the container.
-
-```
-kubectl -n ingress-nginx logs -f nginx-ingress-controller-rfjrq nginx-ingress-controller
-...
-W0705 23:04:58.240571       7 backend_ssl.go:49] error obtaining PEM from secret cattle-system/tls-rancher-ingress: error retrieving secret cattle-system/tls-rancher-ingress: secret cattle-system/tls-rancher-ingress was not found
-```
-
-### no matches for kind "Issuer"
-
-The [SSL configuration]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/#choose-your-ssl-configuration) option you have chosen requires [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/#optional-install-cert-manager) to be installed before installing Rancher or else the following error is shown:
-
-```
-Error: validation failed: unable to recognize "": no matches for kind "Issuer" in version "certmanager.k8s.io/v1alpha1"
-```
-
-Install [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/#optional-install-cert-manager) and try installing Rancher again.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/_index.md
deleted file mode 100644
index 10efe3341a3..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/_index.md
+++ /dev/null
@@ -1,132 +0,0 @@
----
-title: "2. Install Kubernetes with RKE"
-weight: 190
----
-
-Use RKE to install Kubernetes with a high availability etcd configuration.
-
->**Note:** For systems without direct internet access see [Air Gap: Kubernetes install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/) for install details.
-
-### Create the `rancher-cluster.yml` File
-
-Using the sample below create the `rancher-cluster.yml` file. Replace the IP Addresses in the `nodes` list with the IP address or DNS names of the 3 nodes you created.
-
-> **Note:**  If your node has public and internal addresses, it is recommended to set the `internal_address:` so Kubernetes will use it for intra-cluster communication.  Some services like AWS EC2 require setting the `internal_address:` if you want to use self-referencing security groups or firewalls.
-
-
-```yaml
-nodes:
-  - address: 165.227.114.63
-    internal_address: 172.16.22.12
-    user: ubuntu
-    role: [controlplane,worker,etcd]
-  - address: 165.227.116.167
-    internal_address: 172.16.32.37
-    user: ubuntu
-    role: [controlplane,worker,etcd]
-  - address: 165.227.127.226
-    internal_address: 172.16.42.73
-    user: ubuntu
-    role: [controlplane,worker,etcd]
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-```
-
-#### Common RKE Nodes Options
-
-| Option | Required | Description |
-| --- | --- | --- |
-| `address` | yes | The public DNS or IP address |
-| `user` | yes | A user that can run docker commands |
-| `role` | yes | List of Kubernetes roles assigned to the node |
-| `internal_address` | no | The private DNS or IP address for internal cluster traffic |
-| `ssh_key_path` | no | Path to SSH private key used to authenticate to the node (defaults to `~/.ssh/id_rsa`) |
-
-#### Advanced Configurations
-
-RKE has many configuration options for customizing the install to suit your specific environment.
-
-Please see the [RKE Documentation]({{<baseurl>}}/rke/latest/en/config-options/) for the full list of options and capabilities.
-
-For tuning your etcd cluster for larger Rancher installations see the [etcd settings guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/etcd/).
-
-### Run RKE
-
-```
-rke up --config ./rancher-cluster.yml
-```
-
-When finished, it should end with the line: `Finished building Kubernetes cluster successfully`.
-
-### Testing Your Cluster
-
-RKE should have created a file `kube_config_rancher-cluster.yml`. This file has the credentials for `kubectl` and `helm`.
-
-> **Note:** If you have used a different file name from `rancher-cluster.yml`, then the kube config file will be named `kube_config_<FILE_NAME>.yml`.
-
-You can copy this file to `$HOME/.kube/config` or if you are working with multiple Kubernetes clusters, set the `KUBECONFIG` environmental variable to the path of `kube_config_rancher-cluster.yml`.
-
-```
-export KUBECONFIG=$(pwd)/kube_config_rancher-cluster.yml
-```
-
-Test your connectivity with `kubectl` and see if all your nodes are in `Ready` state.
-
-```
-kubectl get nodes
-
-NAME                          STATUS    ROLES                      AGE       VERSION
-165.227.114.63                Ready     controlplane,etcd,worker   11m       v1.13.5
-165.227.116.167               Ready     controlplane,etcd,worker   11m       v1.13.5
-165.227.127.226               Ready     controlplane,etcd,worker   11m       v1.13.5
-```
-
-### Check the Health of Your Cluster Pods
-
-Check that all the required pods and containers are healthy are ready to continue.
-
-* Pods are in `Running` or `Completed` state.
-* `READY` column shows all the containers are running (i.e. `3/3`) for pods with `STATUS` `Running`
-* Pods with `STATUS` `Completed` are run-once Jobs. For these pods `READY` should be `0/1`.
-
-```
-kubectl get pods --all-namespaces
-
-NAMESPACE       NAME                                      READY     STATUS      RESTARTS   AGE
-ingress-nginx   nginx-ingress-controller-tnsn4            1/1       Running     0          30s
-ingress-nginx   nginx-ingress-controller-tw2ht            1/1       Running     0          30s
-ingress-nginx   nginx-ingress-controller-v874b            1/1       Running     0          30s
-kube-system     canal-jp4hz                               3/3       Running     0          30s
-kube-system     canal-z2hg8                               3/3       Running     0          30s
-kube-system     canal-z6kpw                               3/3       Running     0          30s
-kube-system     kube-dns-7588d5b5f5-sf4vh                 3/3       Running     0          30s
-kube-system     kube-dns-autoscaler-5db9bbb766-jz2k6      1/1       Running     0          30s
-kube-system     metrics-server-97bc649d5-4rl2q            1/1       Running     0          30s
-kube-system     rke-ingress-controller-deploy-job-bhzgm   0/1       Completed   0          30s
-kube-system     rke-kubedns-addon-deploy-job-gl7t4        0/1       Completed   0          30s
-kube-system     rke-metrics-addon-deploy-job-7ljkc        0/1       Completed   0          30s
-kube-system     rke-network-plugin-deploy-job-6pbgj       0/1       Completed   0          30s
-```
-
-### Save Your Files
-
-> **Important**
-> The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster.
-
-Save a copy of the following files in a secure location:
-
-- `rancher-cluster.yml`: The RKE cluster configuration file.
-- `kube_config_rancher-cluster.yml`: The [Kubeconfig file]({{<baseurl>}}/rke/latest/en/kubeconfig/) for the cluster, this file contains credentials for full access to the cluster.
-- `rancher-cluster.rkestate`: The [Kubernetes Cluster State file]({{<baseurl>}}/rke/latest/en/installation/#kubernetes-cluster-state), this file contains credentials for full access to the cluster.<br/><br/>_The Kubernetes Cluster State file is only created when using RKE v0.2.0 or higher._
-
-> **Note:** The "rancher-cluster" parts of the two latter file names are dependent on how you name the RKE cluster configuration file.
-
-### Issues or errors?
-
-See the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/troubleshooting/) page.
-
-### [Next: Initialize Helm (Install tiller)]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-init/)
diff --git a/content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/troubleshooting/_index.md
deleted file mode 100644
index 275fbb7c94b..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/kubernetes-rke/troubleshooting/_index.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-title: Troubleshooting
-weight: 276
----
-
-### canal Pods show READY 2/3
-
-The most common cause of this issue is port 8472/UDP is not open between the nodes. Check your local firewall, network routing or security groups.
-
-Once the network issue is resolved, the `canal` pods should timeout and restart to establish their connections.
-
-### nginx-ingress-controller Pods show RESTARTS
-
-The most common cause of this issue is the `canal` pods have failed to establish the overlay network. See [canal Pods show READY `2/3`](#canal-pods-show-ready-2-3) for troubleshooting.
-
-### Failed to set up SSH tunneling for host [xxx.xxx.xxx.xxx]: Can't retrieve Docker Info
-
-#### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed)
-
-* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`:
-
-```
-$ ssh user@server
-user@server$ docker ps
-CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
-```
-
-See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* SSH server version is not version 6.7 or higher. This is needed for socket forwarding to work, which is used to connect to the Docker socket over SSH. This can be checked using `sshd -V` on the host you are connecting to, or using netcat:
-```
-$ nc xxx.xxx.xxx.xxx 22
-SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
-```
-
-#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
-
-* The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
-
-#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
-
-* The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with.
-
-#### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
-
-* If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
-
-#### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
-
-* The node is not reachable on the configured `address` and `port`.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/_index.md
deleted file mode 100644
index d540cb07167..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/_index.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-title: RKE Add-On Install
-weight: 276
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-
-* [Kubernetes installation with External Load Balancer (TCP/Layer 4)]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb)
-* [Kubernetes installation with External Load Balancer (HTTPS/Layer 7)]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb)
-* [HTTP Proxy Configuration for a Kubernetes installation]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/proxy/)
-* [Troubleshooting RKE Add-on Installs]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/)
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/_index.md
deleted file mode 100644
index a99f7966714..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/_index.md
+++ /dev/null
@@ -1,55 +0,0 @@
----
-title: Enable API Auditing
-weight: 300
-aliases:
-  - /rke/latest/en/config-options/add-ons/api-auditing/
----
-
->**Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-If you're using RKE to install Rancher, you can use directives to enable API Auditing for your Rancher install. You can know what happened, when it happened, who initiated it, and what cluster it affected. API auditing records all requests and responses to and from the Rancher API, which includes use of the Rancher UI and any other use of the Rancher API through programmatic use.
-
-## In-line Arguments
-
-Enable API Auditing using RKE by adding arguments to your Rancher container.
-
-To enable API auditing:
-
-- Add API Auditing arguments (`args`) to your Rancher container.
-- Declare a `mountPath` in the `volumeMounts` directive of the container.
-- Declare a `path` in the `volumes` directive.
-
-For more information about each argument, its syntax, and how to view API Audit logs, see [Rancher v2.0 Documentation: API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing).
-
-```yaml
-...
-containers:
-        - image: rancher/rancher:latest
-          imagePullPolicy: Always
-          name: cattle-server
-          args: ["--audit-log-path", "/var/log/auditlog/rancher-api-audit.log", "--audit-log-maxbackup", "5", "--audit-log-maxsize", "50", "--audit-level", "2"]
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          - containerPort: 443
-            protocol: TCP
-          volumeMounts:
-          - mountPath: /etc/rancher/ssl
-            name: cattle-keys-volume
-            readOnly: true
-          - mountPath: /var/log/auditlog
-            name: audit-log-dir
-        volumes:
-        - name: cattle-keys-volume
-          secret:
-            defaultMode: 420
-            secretName: cattle-keys-server
-        - name: audit-log-dir
-          hostPath:
-            path: /var/log/rancher/auditlog
-            type: Directory
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
deleted file mode 100644
index 6b88e593545..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
+++ /dev/null
@@ -1,400 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (TCP/Layer 4)
-weight: 275
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a High-availability Kubernetes install with an RKE add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the Helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 4 load balancer (TCP)
-- [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/)
-
-In a Kubernetes setup that uses a layer 4 load balancer, the load balancer accepts Rancher client connections over the TCP/UDP protocols (i.e., the transport level). The load balancer then forwards these connections to individual cluster nodes without reading the request itself. Because the load balancer cannot read the packets it's forwarding, the routing decisions it can make are limited.
-
-<sup>Kubernetes Rancher install with layer 4 load balancer, depicting SSL termination at ingress controllers</sup>
-![High-availability Kubernetes installation of Rancher]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-<!-- /TOC -->
-
-<br/>
-
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install-server-install/nlb/)
-
->**Note:**
-> In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX.
->
->One caveat: do not use one of your Rancher nodes as the load balancer.
-
-### A. Install NGINX
-
-Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-The `stream` module is required, which is present when using the official NGINX packages. Please refer to your OS documentation how to install and enable the NGINX `stream` module on your operating system.
-
-### B. Create NGINX Configuration
-
-After installing NGINX, you need to update the NGINX config file, `nginx.conf`, with the IP addresses for your nodes.
-
-1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`.
-
-2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts).
-
-    >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
-
-    **Example NGINX config:**
-    ```
-    worker_processes 4;
-    worker_rlimit_nofile 40000;
-
-    events {
-        worker_connections 8192;
-    }
-
-    http {
-        server {
-            listen         80;
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    stream {
-        upstream rancher_servers {
-            least_conn;
-            server IP_NODE_1:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_2:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_3:443 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen     443;
-            proxy_pass rancher_servers;
-        }
-    }
-    ```
-
-3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`.
-
-4. Load the updates to your NGINX configuration by running the following command:
-
-    ```
-    # nginx -s reload
-    ```
-
-### Option - Run NGINX as Docker container
-
-Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /etc/nginx.conf:/etc/nginx/nginx.conf \
-  nginx:1.14
-```
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) >for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
-
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [Intermediate Certificates](#cert-order).
-
-1. In `kind: Secret` with `name: cattle-keys-ingress`:
-
-    * Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-    * Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-        name: cattle-keys-ingress
-        namespace: cattle-system
-    type: Opaque
-    data:
-        tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-        tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-    ```
-
-2. In `kind: Secret` with `name: cattle-keys-server`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`).
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-
-    **Step Result:** The file should look like the example below (the base64 encoded string should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-      name: cattle-keys-server
-      namespace: cattle-system
-    type: Opaque
-    data:
-      cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    ```
-
-{{% /accordion %}}
-
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
->**Note:**
-> If you are using Self Signed Certificate, [click here](#option-a-bring-your-own-certificate-self-signed) to proceed.
-
-If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#cert-order) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included.
-
-In the `kind: Secret` with `name: cattle-keys-ingress`:
-
-* Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-* Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
->**Note:**
-> The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-```yaml
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cattle-keys-ingress
-  namespace: cattle-system
-type: Opaque
-data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-```
-
-{{% /accordion %}}
-
-
-
-## 8. Configure FQDN
-
-There are two references to `<FQDN>` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-In the `kind: Ingress` with `name: cattle-ingress-http`:
-
-* Replace `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-After replacing `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example):
-
-```yaml
- ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: rancher.yourdomain.com
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - rancher.yourdomain.com
-```
-
-Save the `.yml` file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-```
-rke up --config rancher-cluster.yml
-```
-
-**Step Result:** The output should be similar to the snippet below:
-
-```
-INFO[0000] Building Kubernetes cluster
-INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-INFO[0000] [network] Deploying port listener containers
-INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-...
-INFO[0101] Finished building Kubernetes cluster successfully
-```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-You have a couple of options:
-
-- Create a backup of your Rancher Server in case of a disaster scenario: [High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration).
-- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/nlb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/nlb/_index.md
deleted file mode 100644
index 1e6bdcffe44..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/nlb/_index.md
+++ /dev/null
@@ -1,181 +0,0 @@
----
-title: Amazon NLB Configuration
-weight: 277
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install/nlb/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a High-availability Kubernetes install with an RKE add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-## Objectives
-
-Configuring an Amazon NLB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow.
-
-1. [Create Target Groups](#create-target-groups)
-
-	Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
-
-2. [Register Targets](#register-targets)
-
-	Add your Linux nodes to the target groups.
-
-3. [Create Your NLB](#create-your-nlb)
-
-	Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
-
-
-## Create Target Groups
-
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443.
-
-Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
-
-The Target Groups configuration resides in the **Load Balancing** section of the **EC2** service. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
-
-{{< img "/img/rancher/ha/nlb/ec2-loadbalancing.png" "EC2 Load Balancing section">}}
-
-Click **Create target group** to create the first target group, regarding TCP port 443.
-
-### Target Group (TCP port 443)
-
-Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
-
-Option                                | Setting
---------------------------------------|------------------------------------
-Target Group Name                     | `rancher-tcp-443`
-Protocol                              | `TCP`
-Port                                  | `443`
-Target type                           | `instance`
-VPC                                   | Choose your VPC
-Protocol<br/>(Health Check)           | `HTTP`
-Path<br/>(Health Check)               | `/healthz`
-Port (Advanced health check)          | `override`,`80`
-Healthy threshold (Advanced health)   | `3`
-Unhealthy threshold (Advanced)        | `3`
-Timeout (Advanced)                    | `6 seconds`
-Interval (Advanced)                   | `10 second`
-Success codes                         | `200-399`
-
-<hr>
-**Screenshot Target group TCP port 443 settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-443.png" "Target group 443">}}
-
-<hr>
-**Screenshot Target group TCP port 443 Advanced settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-443-advanced.png" "Target group 443 Advanced">}}
-
-<hr>
-
-Click **Create target group** to create the second target group, regarding TCP port 80.
-
-### Target Group (TCP port 80)
-
-Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table.
-
-Option                                | Setting
---------------------------------------|------------------------------------
-Target Group Name                     | `rancher-tcp-80`
-Protocol                              | `TCP`
-Port                                  | `80`
-Target type                           | `instance`
-VPC                                   | Choose your VPC
-Protocol<br/>(Health Check)           | `HTTP`
-Path<br/>(Health Check)               | `/healthz`
-Port (Advanced health check)          | `traffic port`
-Healthy threshold (Advanced health)   | `3`
-Unhealthy threshold (Advanced)        | `3`
-Timeout (Advanced)                    | `6 seconds`
-Interval (Advanced)                   | `10 second`
-Success codes                         | `200-399`
-
-<hr>
-**Screenshot Target group TCP port 80 settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-80.png" "Target group 80">}}
-
-<hr>
-**Screenshot Target group TCP port 80 Advanced settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-80-advanced.png" "Target group 80 Advanced">}}
-
-<hr>
-
-## Register Targets
-
-Next, add your Linux nodes to both target groups.
-
-Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**.
-
-{{< img "/img/rancher/ha/nlb/edit-targetgroup-443.png" "Edit target group 443">}}
-
-Select the instances (Linux nodes) you want to add, and click **Add to registered**.
-
-<hr>
-**Screenshot Add targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/add-targets-targetgroup-443.png" "Add targets to target group 443">}}
-
-<hr>
-**Screenshot Added targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/added-targets-targetgroup-443.png" "Added targets to target group 443">}}
-
-When the instances are added, click **Save** on the bottom right of the screen.
-
-Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group.
-
-## Create Your NLB
-
-Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in [Create Target Groups](#create-target-groups).
-
-1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
-
-2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**.
-
-3. Click **Create Load Balancer**.
-
-4. Choose **Network Load Balancer** and click **Create**.
-
-5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
-
-	   - Name: `rancher`
-	   - Scheme: `internet-facing`
-	- **Listeners**
-
-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `TCP`: `443`
-
-	- **Availability Zones**
-
-	   - Select Your **VPC** and **Availability Zones**.
-
-6. Complete the **Step 2: Configure Routing** form.
-
-	- From the **Target Group** drop-down, choose **Existing target group**.
-
-	- From the **Name** drop-down, choose `rancher-tcp-443`.
-
-	- Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.
-
-7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**.
-
-8. Complete **Step 4: Review**. Look over the load balancer details and click **Create** when you're satisfied.
-
-9. After AWS creates the NLB, click **Close**.
-
-## Add listener to NLB for TCP port 80
-
-1. Select your newly created NLB and select the **Listeners** tab.
-
-2. Click **Add listener**.
-
-3. Use `TCP`:`80` as **Protocol** : **Port**
-
-4. Click **Add action** and choose **Forward to...**
-
-5. From the **Forward to** drop-down, choose `rancher-tcp-80`.
-
-6. Click **Save** in the top right of the screen.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
deleted file mode 100644
index f5485b14c82..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
+++ /dev/null
@@ -1,288 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (HTTPS/Layer 7)
-weight: 276
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install-external-lb/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 7 Loadbalancer with SSL termination (HTTPS)
-- [NGINX Ingress controller (HTTP)](https://kubernetes.github.io/ingress-nginx/)
-
-In an Kubernetes setup that uses a layer 7 load balancer, the load balancer accepts Rancher client connections over the HTTP protocol (i.e., the application level). This application-level access allows the load balancer to read client requests and then redirect to them to cluster nodes using logic that optimally distributes load.
-
-<sup>Kubernetes Rancher install with layer 7 load balancer, depicting SSL termination at load balancer</sup>
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha-l7.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-
-<!-- /TOC -->
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally.
-
-The load balancer has to be configured to support the following:
-
-* **WebSocket** connections
-* **SPDY** / **HTTP/2** protocols
-* Passing / setting the following headers:
-
-| Header              | Value                                  | Description                                                                                                                                                              |
-|---------------------|----------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `Host`              | FQDN used to reach Rancher. | To identify the server requested by the client.                                                                                                                           |
-| `X-Forwarded-Proto` | `https`                                | To identify the protocol that a client used to connect to the load balancer.<br /><br/>**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS. |
-| `X-Forwarded-Port`  | Port used to reach Rancher.             | To identify the protocol that client used to connect to the load balancer.                                                                                       |
-| `X-Forwarded-For`   | IP of the client connection.            | To identify the originating IP address of a client.                                                                                                                       |
-
-Health checks can be executed on the `/healthz` endpoint of the node, this will return HTTP 200.
-
-We have example configurations for the following load balancers:
-
-* [Amazon ALB configuration](alb/)
-* [NGINX configuration](nginx/)
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a YAML config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    >
-    >When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-In `kind: Secret` with `name: cattle-keys-ingress`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`)
-
->**Note:** The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-        ---
-        apiVersion: v1
-        kind: Secret
-        metadata:
-            name: cattle-keys-server
-            namespace: cattle-system
-        type: Opaque
-        data:
-            cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
-If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part.
-{{% /accordion %}}
-
-## 8. Configure FQDN
-
-There is one reference to `<FQDN>` in the RKE config file. Replace this reference with the FQDN you chose in [3. Configure DNS](#3-configure-dns).
-
-1. Open `rancher-cluster.yml`.
-
-2. In the `kind: Ingress` with `name: cattle-ingress-http:`
-
-    Replace `<FQDN>` with the FQDN chosen in [3. Configure DNS](#3-configure-dns).
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```
-    apiVersion: extensions/v1beta1
-      kind: Ingress
-      metadata:
-        namespace: cattle-system
-        name: cattle-ingress-http
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-          nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      spec:
-        rules:
-        - host: rancher.yourdomain.com
-          http:
-            paths:
-            - backend:
-                serviceName: cattle-service
-                servicePort: 80
-    ```
-
-
-3. Save the file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your RKE config file, `rancher-cluster.yml`, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-    ```
-    rke up --config rancher-cluster.yml
-    ```
-
-    **Step Result:** The output should be similar to the snippet below:
-
-    ```
-    INFO[0000] Building Kubernetes cluster
-    INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-    INFO[0000] [network] Deploying port listener containers
-    INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-    ...
-    INFO[0101] Finished building Kubernetes cluster successfully
-    ```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-- **Recommended:** Review [Creating Backups—High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/) to learn how to backup your Rancher Server in case of a disaster scenario.
-- Create a Kubernetes cluster: [Creating a Cluster]({{<baseurl>}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/alb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/alb/_index.md
deleted file mode 100644
index 3741167921f..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/alb/_index.md
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: Amazon ALB Configuration
-weight: 277
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install-external-lb/alb/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Kubernetes Rancher. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-## Objectives
-
-Configuring an Amazon ALB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow.
-
-1. [Create Target Group](#create-target-group)
-
-	Begin by creating one target group for the http protocol. You'll add your Linux nodes to this group.
-
-2. [Register Targets](#register-targets)
-
-	Add your Linux nodes to the target group.
-
-3. [Create Your ALB](#create-your-alb)
-
-	Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
-
-
-## Create Target Group
-
-Your first ALB configuration step is to create one target group for HTTP.
-
-Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started.
-
-The document below will guide you through this process. Use the data in the tables below to complete the procedure.
-
-[Amazon Documentation: Create a Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-target-group.html)
-
-### Target Group (HTTP)
-
-Option                      | Setting
-----------------------------|------------------------------------
-Target Group Name           | `rancher-http-80`
-Protocol                    | `HTTP`
-Port                        | `80`
-Target type                 | `instance`
-VPC                         | Choose your VPC
-Protocol<br/>(Health Check) | `HTTP`
-Path<br/>(Health Check)     | `/healthz`
-
-## Register Targets
-
-Next, add your Linux nodes to your target group.
-
-[Amazon Documentation: Register Targets with Your Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-register-targets.html)
-
-### Create Your ALB
-
-Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target group you created in [Create Target Group](#create-target-group).
-
-1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
-
-2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**.
-
-3. Click **Create Load Balancer**.
-
-4. Choose **Application Load Balancer**.
-
-5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
-
-	   - Name: `rancher-http`
-	   - Scheme: `internet-facing`
-	   - IP address type: `ipv4`
-	- **Listeners**
-
-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `HTTP`: `80`
-		- `HTTPS`: `443`
-
-	- **Availability Zones**
-
-	   - Select Your **VPC** and **Availability Zones**.
-
-6. Complete the **Step 2: Configure Security Settings** form.
-
-	Configure the certificate you want to use for SSL termination.
-
-7. Complete the **Step 3: Configure Security Groups** form.
-
-8. Complete the **Step 4: Configure Routing** form.
-
-	- From the **Target Group** drop-down, choose **Existing target group**.
-
-	- Add target group `rancher-http-80`.
-
-9. Complete **Step 5: Register Targets**. Since you registered your targets earlier, all you have to do it click **Next: Review**.
-
-10. Complete **Step 6: Review**. Look over the load balancer details and click **Create** when you're satisfied.
-
-11. After AWS creates the ALB, click **Close**.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/nginx/_index.md
deleted file mode 100644
index 00ed78da136..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/nginx/_index.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: NGINX Configuration
-weight: 277
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-## Install NGINX
-
-Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems.
-
-For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-## Create NGINX Configuration
-
-See [Example NGINX config]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#example-nginx-config).
-
-## Run NGINX
-
-* Reload or restart NGINX
-
-    ````
-    # Reload NGINX
-    nginx -s reload
-
-    # Restart NGINX
-    # Depending on your Linux distribution
-    service nginx restart
-    systemctl restart nginx
-    ````
-
-## Browse to Rancher UI
-
-You should now be to able to browse to `https://FQDN`.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/proxy/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/proxy/_index.md
deleted file mode 100644
index 5e7eb1f4a80..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/proxy/_index.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: HTTP Proxy Configuration
-weight: 277
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-If you operate Rancher behind a proxy and you want to access services through the proxy (such as retrieving catalogs), you must provide Rancher information about your proxy. As Rancher is written in Go, it uses the common proxy environment variables as shown below.
-
-Make sure `NO_PROXY` contains the network addresses, network address ranges and domains that should be excluded from using the proxy.
-
-Environment variable      | Purpose
---------------------------|---------
-HTTP_PROXY                | Proxy address to use when initiating HTTP connection(s)
-HTTPS_PROXY               | Proxy address to use when initiating HTTPS connection(s)
-NO_PROXY                  | Network address(es), network address range(s) and domains to exclude from using the proxy when initiating connection(s)
-
-> **Note** NO_PROXY must be in uppercase to use network range (CIDR) notation.
-
-## Kubernetes installation
-
-When using Kubernetes installation, the environment variables need to be added to the RKE Config File template.
-
-* [Kubernetes Installation with External Load Balancer (TCP/Layer 4) RKE Config File Template]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install-server-install/#5-download-rke-config-file-template)
-* [Kubernetes Installation with External Load Balancer (HTTPS/Layer 7) RKE Config File Template]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install-server-install-external-lb/#5-download-rke-config-file-template)
-
-The environment variables should be defined in the `Deployment` inside the RKE Config File Template. You only have to add the part starting with `env:` to (but not including) `ports:`. Make sure the indentation is identical to the preceding `name:`. Required values for `NO_PROXY` are:
-
-* `localhost`
-* `127.0.0.1`
-* `0.0.0.0`
-* Configured `service_cluster_ip_range` (default: `10.43.0.0/16`)
-
-The example below is based on a proxy server accessible at `http://192.168.0.1:3128`, and excluding usage of the proxy when accessing network range `192.168.10.0/24`, the configured `service_cluster_ip_range` (`10.43.0.0/16`) and every hostname under the domain `example.com`. If you have changed the `service_cluster_ip_range`, you have to update the value below accordingly.
-
-```yaml
-...
----
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:latest
-          imagePullPolicy: Always
-          name: cattle-server
-          env:
-          - name: HTTP_PROXY
-            value: "http://192.168.10.1:3128"
-          - name: HTTPS_PROXY
-            value: "http://192.168.10.1:3128"
-          - name: NO_PROXY
-            value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,192.168.10.0/24,example.com"
-          ports:
-...
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/404-default-backend/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/404-default-backend/_index.md
deleted file mode 100644
index 4571ade2775..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/404-default-backend/_index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: 404 - default backend
-weight: 30
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform.
-
-When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors.
-
-### Possible causes
-
-The nginx ingress controller is not able to serve the configured host in `rancher-cluster.yml`. This should be the FQDN you configured to access Rancher. You can check if it is properly configured by viewing the ingress that is created by running the following command:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get ingress -n cattle-system -o wide
-```
-
-Check if the `HOSTS` column is displaying the FQDN you configured in the template, and that the used nodes are listed in the `ADDRESS` column. If that is configured correctly, we can check the logging of the nginx ingress controller.
-
-The logging of the nginx ingress controller will show why it cannot serve the requested host. To view the logs, you can run the following command
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx
-```
-
-<b>Errors</b>
-
-* `x509: certificate is valid for fqdn, not your_configured_fqdn`
-
-The used certificates do not contain the correct hostname. Generate new certificates that contain the chosen FQDN to access Rancher and redeploy.
-
-* `Port 80 is already in use. Please check the flag --http-port`
-
-There is a process on the node occupying port 80, this port is needed for the nginx ingress controller to route requests to Rancher. You can find the process by running the command: `netstat -plant | grep \:80`.
-
-Stop/kill the process and redeploy.
-
-* `unexpected error creating pem file: no valid PEM formatted block found`
-
-The base64 encoded string configured in the template is not valid. Please check if you can decode the configured string using `base64 -D STRING`, this should return the same output as the content of the file you used to generate the string. If this is correct, please check if the base64 encoded string is placed directly after the key, without any newlines before, in between or after. (For example: `tls.crt: LS01..`)
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/_index.md
deleted file mode 100644
index 45201a0dc19..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/_index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Troubleshooting HA RKE Add-On Install
-weight: 370
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This section contains common errors seen when setting up a Kubernetes installation.
-
-Choose from the following options:
-
-- [Generic troubleshooting](generic-troubleshooting/)
-
-	In this section, you can find generic ways to debug your Kubernetes cluster.
-
-- [Failed to set up SSH tunneling for host]({{<baseurl>}}/rke/latest/en/troubleshooting/ssh-connectivity-errors/)
-
-	In this section, you can find errors related to SSH tunneling when you run the `rke` command to setup your nodes.
-
-- [Failed to get job complete status](job-complete-status/)
-
-	In this section, you can find errors related to deploying addons.
-
-- [404 - default backend](404-default-backend/)
-
-	In this section, you can find errors related to the `404 - default backend` page that is shown when trying to access Rancher.
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/generic-troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/generic-troubleshooting/_index.md
deleted file mode 100644
index bffba0352bd..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/generic-troubleshooting/_index.md
+++ /dev/null
@@ -1,161 +0,0 @@
----
-title: Generic troubleshooting
-weight: 5
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-Below are steps that you can follow to determine what is wrong in your cluster.
-
-### Double check if all the required ports are opened in your (host) firewall
-
-Double check if all the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) are opened in your (host) firewall.
-
-### All nodes should be present and in **Ready** state
-
-To check, run the command:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get nodes
-```
-
-If a node is not shown in this output or a node is not in **Ready** state, you can check the logging of the `kubelet` container. Login to the node and run `docker logs kubelet`.
-
-### All pods/jobs should be in **Running**/**Completed** state
-
-To check, run the command:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get pods --all-namespaces
-```
-
-If a pod is not in **Running** state, you can dig into the root cause by running:
-
-#### Describe pod
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml describe pod POD_NAME -n NAMESPACE
-```
-
-#### Pod container logs</h3>
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs POD_NAME -n NAMESPACE
-```
-
-If a job is not in **Completed** state, you can dig into the root cause by running:
-
-#### Describe job
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml describe job JOB_NAME -n NAMESPACE
-```
-
-#### Logs from the containers of pods of the job
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=JOB_NAME -n NAMESPACE
-```
-
-### Check ingress
-
-Ingress should have the correct `HOSTS` (showing the configured FQDN) and `ADDRESS` (address(es) it will be routed to).
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get ingress --all-namespaces
-```
-
-### List all Kubernetes cluster events
-
-Kubernetes cluster events are stored, and can be retrieved by running:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get events --all-namespaces
-```
-
-### Check Rancher container logging
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=cattle -n cattle-system
-```
-
-### Check NGINX ingress controller logging
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx
-```
-
-### Check if overlay network is functioning correctly
-
-The pod can be scheduled to any of the hosts you used for your cluster, but that means that the NGINX ingress controller needs to be able to route the request from `NODE_1` to `NODE_2`. This happens over the overlay network. If the overlay network is not functioning, you will experience intermittent TCP/HTTP connection failures due to the NGINX ingress controller not being able to route to the pod.
-
-To test the overlay network, you can launch the following `DaemonSet` definition. This will run an `alpine` container on every host, which we will use to run a `ping` test between containers on all hosts.
-
-1. Save the following file as `ds-alpine.yml`
-
-    ```
-    apiVersion: apps/v1
-    kind: DaemonSet
-    metadata:
-      name: alpine
-    spec:
-      selector:
-          matchLabels:
-            name: alpine
-      template:
-        metadata:
-          labels:
-            name: alpine
-        spec:
-          tolerations:
-          - effect: NoExecute
-            key: "node-role.kubernetes.io/etcd"
-            value: "true"
-          - effect: NoSchedule
-            key: "node-role.kubernetes.io/controlplane"
-            value: "true"
-          containers:
-          - image: alpine
-            imagePullPolicy: Always
-            name: alpine
-            command: ["sh", "-c", "tail -f /dev/null"]
-            terminationMessagePath: /dev/termination-log
-    ```
-
-2. Launch it using `kubectl --kubeconfig kube_config_rancher-cluster.yml create -f ds-alpine.yml`
-3. Wait until `kubectl --kubeconfig kube_config_rancher-cluster.yml rollout status ds/alpine -w` returns: `daemon set "alpine" successfully rolled out`.
-4. Run the following command to let each container on every host ping each other (it's a single line command).
-
-    ```
-    echo "=> Start"; kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.metadata.name}{" "}{@.spec.nodeName}{"\n"}{end}' | while read spod shost; do kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.status.podIP}{" "}{@.spec.nodeName}{"\n"}{end}' | while read tip thost; do kubectl --kubeconfig kube_config_rancher-cluster.yml --request-timeout='10s' exec $spod -- /bin/sh -c "ping -c2 $tip > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $shost cannot reach $thost; fi; done; done; echo "=> End"
-    ```
-
-5. When this command has finished running, the output indicating everything is correct is:
-
-    ```
-    => Start
-    => End
-    ```
-
-If you see error in the output, that means that the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for overlay networking are not opened between the hosts indicated.
-
-Example error output of a situation where NODE1 had the UDP ports blocked.
-
-```
-=> Start
-command terminated with exit code 1
-NODE2 cannot reach NODE1
-command terminated with exit code 1
-NODE3 cannot reach NODE1
-command terminated with exit code 1
-NODE1 cannot reach NODE2
-command terminated with exit code 1
-NODE1 cannot reach NODE3
-=> End
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/job-complete-status/_index.md
deleted file mode 100644
index ab746496d68..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/troubleshooting/job-complete-status/_index.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: Failed to get job complete status
-weight: 20
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform.
-
-When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors.
-
-### Failed to deploy addon execute job [rke-user-includes-addons]: Failed to get job complete status
-
-Something is wrong in the addons definitions, you can run the following command to get the root cause in the logging of the job:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=rke-user-addon-deploy-job -n kube-system
-```
-
-#### error: error converting YAML to JSON: yaml: line 9:
-
-The structure of the addons definition in `rancher-cluster.yml` is wrong. In the different resources specified in the addons section, there is a error in the structure of the YAML. The pointer  `yaml line 9` references to the line number of the addon that is causing issues.
-
-<b>Things to check</b>
-<ul>
-<ul>
-<li>Is each of the base64 encoded certificate string placed directly after the key, for example: `tls.crt: LS01...`, there should be no newline/space before, in between or after.</li>
-<li>Is the YAML properly formatted, each indentation should be 2 spaces as shown in the template files.</li>
-<li>Verify the integrity of your certificate by running this command `cat MyCertificate | base64 -d` on Linux, `cat MyCertificate | base64 -D` on Mac OS . If any error exists, the command output will tell you.
-</ul>
-</ul>
-
-#### Error from server (BadRequest): error when creating "/etc/config/rke-user-addon.yaml": Secret in version "v1" cannot be handled as a Secret
-
-The base64 string of one of the certificate strings is wrong. The log message will try to show you what part of the string is not recognized as valid base64.
-
-<b>Things to check</b>
-<ul>
-<ul>
-<li>Check if the base64 string is valid by running one of the commands below:</li>
-
-```
-# MacOS
-echo BASE64_CRT | base64 -D
-# Linux
-echo BASE64_CRT | base64 -d
-# Windows
-certutil -decode FILENAME.base64 FILENAME.verify
-```
-
-</ul>
-</ul>
-
-#### The Ingress "cattle-ingress-http" is invalid: spec.rules[0].host: Invalid value: "IP": must be a DNS name, not an IP address
-
-The host value can only contain a host name, as it is needed by the ingress controller to match the hostname and pass to the correct backend.
diff --git a/content/rancher/v2.x/en/installation/options/local-system-charts/_index.md b/content/rancher/v2.x/en/installation/options/local-system-charts/_index.md
deleted file mode 100644
index 82def8c7c92..00000000000
--- a/content/rancher/v2.x/en/installation/options/local-system-charts/_index.md
+++ /dev/null
@@ -1,68 +0,0 @@
----
-title: Setting up Local System Charts for Air Gapped Installations
-weight: 1120
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-single-node/config-rancher-system-charts/_index.md
-  - /rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/_index.md
----
-
-The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS.
-
-In an air gapped installation of Rancher, you will need to configure Rancher to use a local copy of the system charts. This section describes how to use local system charts using a CLI flag in Rancher v2.3.0, and using a Git mirror for Rancher versions prior to v2.3.0.
-
-# Using Local System Charts in Rancher v2.3.0
-
-In Rancher v2.3.0, a local copy of `system-charts` has been packaged into the `rancher/rancher` container. To be able to use these features in an air gap install, you will need to run the Rancher install command with an extra environment variable, `CATTLE_SYSTEM_CATALOG=bundled`, which tells Rancher to use the local copy of the charts instead of attempting to fetch them from GitHub.
-
-Example commands for a Rancher installation with a bundled `system-charts` are included in the [air gap Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/install-rancher) instructions and the [air gap Kubernetes installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/install-rancher/#c-install-rancher) instructions.
-
-# Setting Up System Charts for Rancher Prior to v2.3.0
-
-### A. Prepare System Charts
-
-The [System Charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. To be able to use these features in an air gap install, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach and configure Rancher to use that repository.
-
-Refer to the release notes in the `system-charts` repository to see which branch corresponds to your version of Rancher.
-
-### B. Configure System Charts
-
-Rancher needs to be configured to use your Git mirror of the `system-charts` repository. You can configure the system charts repository either from the Rancher UI or from Rancher's API view.
-
-{{% tabs %}}
-{{% tab "Rancher UI" %}}
-
-In the catalog management page in the Rancher UI, follow these steps:
-
-1. Go to the **Global** view.
-
-1. Click **Tools > Catalogs.**
-
-1. The system chart is displayed under the name `system-library`. To edit the configuration of the system chart, click **&#8942; > Edit.**
-
-1. In the **Catalog URL** field, enter the location of the Git mirror of the `system-charts` repository.
-
-1. Click **Save.**
-
-**Result:** Rancher is configured to download all the required catalog items from your `system-charts` repository.
-
-{{% /tab %}}
-{{% tab "Rancher API" %}}
-
-1. Log into Rancher.
-
-1. Open `https://<your-rancher-server>/v3/catalogs/system-library` in your browser.
-
-   {{< img "/img/rancher/airgap/system-charts-setting.png" "Open">}}
-
-1. Click **Edit** on the upper right corner and update the value for **url** to the location of the Git mirror of the `system-charts` repository.
-
-   {{< img "/img/rancher/airgap/system-charts-update.png" "Update">}}
-
-1. Click **Show Request**
-
-1. Click **Send Request**
-
-**Result:** Rancher is configured to download all the required catalog items from your `system-charts` repository.
-
-{{% /tab %}}
-{{% /tabs %}}
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/_index.md
deleted file mode 100644
index 4904cb0edf6..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/_index.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-title: RKE Add-On Install
-weight: 276
----
-
-> **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
-> Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
-> If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-- [Kubernetes Installation with External Load Balancer (TCP/Layer 4)]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb)
-- [Kubernetes Installation with External Load Balancer (HTTPS/Layer 7)]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb)
-- [HTTP Proxy Configuration for a Kubernetes installation]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/proxy/)
-- [Troubleshooting RKE Add-on Installs]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/)
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/api-auditing/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/api-auditing/_index.md
deleted file mode 100644
index 914f283c582..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/api-auditing/_index.md
+++ /dev/null
@@ -1,55 +0,0 @@
----
-title: Enable API Auditing
-weight: 300
-aliases:
-  - /rke/latest/en/config-options/add-ons/api-auditing/
----
-
->**Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-If you're using RKE to install Rancher, you can use directives to enable API Auditing for your Rancher install. You can know what happened, when it happened, who initiated it, and what cluster it affected. API auditing records all requests and responses to and from the Rancher API, which includes use of the Rancher UI and any other use of the Rancher API through programmatic use.
-
-## In-line Arguments
-
-Enable API Auditing using RKE by adding arguments to your Rancher container.
-
-To enable API auditing:
-
-- Add API Auditing arguments (`args`) to your Rancher container.
-- Declare a `mountPath` in the `volumeMounts` directive of the container.
-- Declare a `path` in the `volumes` directive.
-
-For more information about each argument, its syntax, and how to view API Audit logs, see [Rancher v2.0 Documentation: API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing).
-
-```yaml
-...
-containers:
-        - image: rancher/rancher:latest
-          imagePullPolicy: Always
-          name: cattle-server
-          args: ["--audit-log-path", "/var/log/auditlog/rancher-api-audit.log", "--audit-log-maxbackup", "5", "--audit-log-maxsize", "50", "--audit-level", "2"]
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          - containerPort: 443
-            protocol: TCP
-          volumeMounts:
-          - mountPath: /etc/rancher/ssl
-            name: cattle-keys-volume
-            readOnly: true
-          - mountPath: /var/log/auditlog
-            name: audit-log-dir
-        volumes:
-        - name: cattle-keys-volume
-          secret:
-            defaultMode: 420
-            secretName: cattle-keys-server
-        - name: audit-log-dir
-          hostPath:
-            path: /var/log/rancher/auditlog
-            type: Directory
-```
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
deleted file mode 100644
index f40f56075be..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
+++ /dev/null
@@ -1,402 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (TCP/Layer 4)
-weight: 275
-aliases:
-- /rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 4 load balancer (TCP)
-- [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/)
-
-In an HA setup that uses a layer 4 load balancer, the load balancer accepts Rancher client connections over the TCP/UDP protocols (i.e., the transport level). The load balancer then forwards these connections to individual cluster nodes without reading the request itself. Because the load balancer cannot read the packets it's forwarding, the routing decisions it can make are limited.
-
-<sup>Rancher installed on a Kubernetes cluster with layer 4 load balancer, depicting SSL termination at ingress controllers</sup>
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-<!-- /TOC -->
-
-<br/>
-
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/nlb/)
-
->**Note:**
-> In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX.
->
->One caveat: do not use one of your Rancher nodes as the load balancer.
-
-### A. Install NGINX
-
-Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-The `stream` module is required, which is present when using the official NGINX packages. Please refer to your OS documentation how to install and enable the NGINX `stream` module on your operating system.
-
-### B. Create NGINX Configuration
-
-After installing NGINX, you need to update the NGINX config file, `nginx.conf`, with the IP addresses for your nodes.
-
-1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`.
-
-2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts).
-
-    >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
-
-    **Example NGINX config:**
-    ```
-    worker_processes 4;
-    worker_rlimit_nofile 40000;
-
-    events {
-        worker_connections 8192;
-    }
-
-    http {
-        server {
-            listen         80;
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    stream {
-        upstream rancher_servers {
-            least_conn;
-            server IP_NODE_1:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_2:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_3:443 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen     443;
-            proxy_pass rancher_servers;
-        }
-    }
-    ```
-
-3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`.
-
-4. Load the updates to your NGINX configuration by running the following command:
-
-    ```
-    # nginx -s reload
-    ```
-
-### Option - Run NGINX as Docker container
-
-Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /etc/nginx.conf:/etc/nginx/nginx.conf \
-  nginx:1.14
-```
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) >for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
-
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [Intermediate Certificates](#cert-order).
-
-1. In `kind: Secret` with `name: cattle-keys-ingress`:
-
-    * Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-    * Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-        name: cattle-keys-ingress
-        namespace: cattle-system
-    type: Opaque
-    data:
-        tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-        tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-    ```
-
-2. In `kind: Secret` with `name: cattle-keys-server`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`).
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-
-    **Step Result:** The file should look like the example below (the base64 encoded string should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-      name: cattle-keys-server
-      namespace: cattle-system
-    type: Opaque
-    data:
-      cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    ```
-
-{{% /accordion %}}
-
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
->**Note:**
-> If you are using Self Signed Certificate, [click here](#option-a-bring-your-own-certificate-self-signed) to proceed.
-
-If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#cert-order) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included.
-
-In the `kind: Secret` with `name: cattle-keys-ingress`:
-
-* Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-* Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
->**Note:**
-> The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-```yaml
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cattle-keys-ingress
-  namespace: cattle-system
-type: Opaque
-data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-```
-
-{{% /accordion %}}
-
-
-
-## 8. Configure FQDN
-
-There are two references to `<FQDN>` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-In the `kind: Ingress` with `name: cattle-ingress-http`:
-
-* Replace `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-After replacing `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example):
-
-```yaml
- ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: rancher.yourdomain.com
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - rancher.yourdomain.com
-```
-
-Save the `.yml` file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-```
-rke up --config rancher-cluster.yml
-```
-
-**Step Result:** The output should be similar to the snippet below:
-
-```
-INFO[0000] Building Kubernetes cluster
-INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-INFO[0000] [network] Deploying port listener containers
-INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-...
-INFO[0101] Finished building Kubernetes cluster successfully
-```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-You have a couple of options:
-
-- Create a backup of your Rancher Server in case of a disaster scenario: [High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration).
-- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/nlb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/nlb/_index.md
deleted file mode 100644
index fc41dcad175..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/nlb/_index.md
+++ /dev/null
@@ -1,182 +0,0 @@
----
-title: Amazon NLB Configuration
-weight: 277
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install/nlb/
-- /rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb/nlb
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-## Objectives
-
-Configuring an Amazon NLB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow.
-
-1. [Create Target Groups](#create-target-groups)
-
-	Begin by creating two target groups for the **TCP** protocol, one regarding TCP port 443 and one regarding TCP port 80 (providing redirect to TCP port 443). You'll add your Linux nodes to these groups.
-
-2. [Register Targets](#register-targets)
-
-	Add your Linux nodes to the target groups.
-
-3. [Create Your NLB](#create-your-nlb)
-
-	Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
-
-
-## Create Target Groups
-
-Your first NLB configuration step is to create two target groups. Technically, only port 443 is needed to access Rancher, but its convenient to add a listener for port 80 which will be redirected to port 443 automatically. The NGINX controller on the nodes will make sure that port 80 gets redirected to port 443.
-
-Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started, make sure to select the **Region** where your EC2 instances (Linux nodes) are created.
-
-The Target Groups configuration resides in the **Load Balancing** section of the **EC2** service. Select **Services** and choose **EC2**, find the section **Load Balancing** and open **Target Groups**.
-
-{{< img "/img/rancher/ha/nlb/ec2-loadbalancing.png" "EC2 Load Balancing section">}}
-
-Click **Create target group** to create the first target group, regarding TCP port 443.
-
-### Target Group (TCP port 443)
-
-Configure the first target group according to the table below. Screenshots of the configuration are shown just below the table.
-
-Option                                | Setting
---------------------------------------|------------------------------------
-Target Group Name                     | `rancher-tcp-443`
-Protocol                              | `TCP`
-Port                                  | `443`
-Target type                           | `instance`
-VPC                                   | Choose your VPC
-Protocol<br/>(Health Check)           | `HTTP`
-Path<br/>(Health Check)               | `/healthz`
-Port (Advanced health check)          | `override`,`80`
-Healthy threshold (Advanced health)   | `3`
-Unhealthy threshold (Advanced)        | `3`
-Timeout (Advanced)                    | `6 seconds`
-Interval (Advanced)                   | `10 second`
-Success codes                         | `200-399`
-
-<hr>
-**Screenshot Target group TCP port 443 settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-443.png" "Target group 443">}}
-
-<hr>
-**Screenshot Target group TCP port 443 Advanced settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-443-advanced.png" "Target group 443 Advanced">}}
-
-<hr>
-
-Click **Create target group** to create the second target group, regarding TCP port 80.
-
-### Target Group (TCP port 80)
-
-Configure the second target group according to the table below. Screenshots of the configuration are shown just below the table.
-
-Option                                | Setting
---------------------------------------|------------------------------------
-Target Group Name                     | `rancher-tcp-80`
-Protocol                              | `TCP`
-Port                                  | `80`
-Target type                           | `instance`
-VPC                                   | Choose your VPC
-Protocol<br/>(Health Check)           | `HTTP`
-Path<br/>(Health Check)               | `/healthz`
-Port (Advanced health check)          | `traffic port`
-Healthy threshold (Advanced health)   | `3`
-Unhealthy threshold (Advanced)        | `3`
-Timeout (Advanced)                    | `6 seconds`
-Interval (Advanced)                   | `10 second`
-Success codes                         | `200-399`
-
-<hr>
-**Screenshot Target group TCP port 80 settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-80.png" "Target group 80">}}
-
-<hr>
-**Screenshot Target group TCP port 80 Advanced settings**<br/>
-{{< img "/img/rancher/ha/nlb/create-targetgroup-80-advanced.png" "Target group 80 Advanced">}}
-
-<hr>
-
-## Register Targets
-
-Next, add your Linux nodes to both target groups.
-
-Select the target group named **rancher-tcp-443**, click the tab **Targets** and choose **Edit**.
-
-{{< img "/img/rancher/ha/nlb/edit-targetgroup-443.png" "Edit target group 443">}}
-
-Select the instances (Linux nodes) you want to add, and click **Add to registered**.
-
-<hr>
-**Screenshot Add targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/add-targets-targetgroup-443.png" "Add targets to target group 443">}}
-
-<hr>
-**Screenshot Added targets to target group TCP port 443**<br/>
-
-{{< img "/img/rancher/ha/nlb/added-targets-targetgroup-443.png" "Added targets to target group 443">}}
-
-When the instances are added, click **Save** on the bottom right of the screen.
-
-Repeat those steps, replacing **rancher-tcp-443** with **rancher-tcp-80**. The same instances need to be added as targets to this target group.
-
-## Create Your NLB
-
-Use Amazon's Wizard to create an Network Load Balancer. As part of this process, you'll add the target groups you created in [Create Target Groups](#create-target-groups).
-
-1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
-
-2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**.
-
-3. Click **Create Load Balancer**.
-
-4. Choose **Network Load Balancer** and click **Create**.
-
-5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
-
-	   - Name: `rancher`
-	   - Scheme: `internet-facing`
-	- **Listeners**
-
-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `TCP`: `443`
-
-	- **Availability Zones**
-
-	   - Select Your **VPC** and **Availability Zones**.
-
-6. Complete the **Step 2: Configure Routing** form.
-
-	- From the **Target Group** drop-down, choose **Existing target group**.
-
-	- From the **Name** drop-down, choose `rancher-tcp-443`.
-
-	- Open **Advanced health check settings**, and configure **Interval** to `10 seconds`.
-
-7. Complete **Step 3: Register Targets**. Since you registered your targets earlier, all you have to do is click **Next: Review**.
-
-8. Complete **Step 4: Review**. Look over the load balancer details and click **Create** when you're satisfied.
-
-9. After AWS creates the NLB, click **Close**.
-
-## Add listener to NLB for TCP port 80
-
-1. Select your newly created NLB and select the **Listeners** tab.
-
-2. Click **Add listener**.
-
-3. Use `TCP`:`80` as **Protocol** : **Port**
-
-4. Click **Add action** and choose **Forward to...**
-
-5. From the **Forward to** drop-down, choose `rancher-tcp-80`.
-
-6. Click **Save** in the top right of the screen.
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
deleted file mode 100644
index a41889022ff..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
+++ /dev/null
@@ -1,288 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (HTTPS/Layer 7)
-weight: 276
-aliases:
-- /rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 7 load balancer with SSL termination (HTTPS)
-- [NGINX Ingress controller (HTTP)](https://kubernetes.github.io/ingress-nginx/)
-
-In an HA setup that uses a layer 7 load balancer, the load balancer accepts Rancher client connections over the HTTP protocol (i.e., the application level). This application-level access allows the load balancer to read client requests and then redirect to them to cluster nodes using logic that optimally distributes load.
-
-<sup>Rancher installed on a Kubernetes cluster with layer 7 load balancer, depicting SSL termination at load balancer</sup>
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha-l7.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-
-<!-- /TOC -->
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally.
-
-The load balancer has to be configured to support the following:
-
-* **WebSocket** connections
-* **SPDY** / **HTTP/2** protocols
-* Passing / setting the following headers:
-
-| Header              | Value                                  | Description                                                                                                                                                              |
-|---------------------|----------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `Host`              | FQDN used to reach Rancher. | To identify the server requested by the client.                                                                                                                           |
-| `X-Forwarded-Proto` | `https`                                | To identify the protocol that a client used to connect to the load balancer.<br /><br/>**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS. |
-| `X-Forwarded-Port`  | Port used to reach Rancher.             | To identify the protocol that client used to connect to the load balancer.                                                                                       |
-| `X-Forwarded-For`   | IP of the client connection.            | To identify the originating IP address of a client.                                                                                                                       |
-
-Health checks can be executed on the `/healthz` endpoint of the node, this will return HTTP 200.
-
-We have example configurations for the following load balancers:
-
-* [Amazon ALB configuration](alb/)
-* [NGINX configuration](nginx/)
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a YAML config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    >
-    >When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-In `kind: Secret` with `name: cattle-keys-ingress`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`)
-
->**Note:** The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-        ---
-        apiVersion: v1
-        kind: Secret
-        metadata:
-            name: cattle-keys-server
-            namespace: cattle-system
-        type: Opaque
-        data:
-            cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
-If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part.
-{{% /accordion %}}
-
-## 8. Configure FQDN
-
-There is one reference to `<FQDN>` in the RKE config file. Replace this reference with the FQDN you chose in [3. Configure DNS](#3-configure-dns).
-
-1. Open `rancher-cluster.yml`.
-
-2. In the `kind: Ingress` with `name: cattle-ingress-http:`
-
-    Replace `<FQDN>` with the FQDN chosen in [3. Configure DNS](#3-configure-dns).
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```
-    apiVersion: extensions/v1beta1
-      kind: Ingress
-      metadata:
-        namespace: cattle-system
-        name: cattle-ingress-http
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-          nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      spec:
-        rules:
-        - host: rancher.yourdomain.com
-          http:
-            paths:
-            - backend:
-                serviceName: cattle-service
-                servicePort: 80
-    ```
-
-
-3. Save the file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your RKE config file, `rancher-cluster.yml`, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-    ```
-    rke up --config rancher-cluster.yml
-    ```
-
-    **Step Result:** The output should be similar to the snippet below:
-
-    ```
-    INFO[0000] Building Kubernetes cluster
-    INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-    INFO[0000] [network] Deploying port listener containers
-    INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-    ...
-    INFO[0101] Finished building Kubernetes cluster successfully
-    ```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-- **Recommended:** Review [Creating Backups—High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/) to learn how to backup your Rancher Server in case of a disaster scenario.
-- Create a Kubernetes cluster: [Creating a Cluster]({{<baseurl>}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/alb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/alb/_index.md
deleted file mode 100644
index 760f25be970..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/alb/_index.md
+++ /dev/null
@@ -1,104 +0,0 @@
----
-title: Amazon ALB Configuration
-weight: 277
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install-external-lb/alb/
-- /rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/alb
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-## Objectives
-
-Configuring an Amazon ALB is a multistage process. We've broken it down into multiple tasks so that it's easy to follow.
-
-1. [Create Target Group](#create-target-group)
-
-	Begin by creating one target group for the http protocol. You'll add your Linux nodes to this group.
-
-2. [Register Targets](#register-targets)
-
-	Add your Linux nodes to the target group.
-
-3. [Create Your ALB](#create-your-alb)
-
-	Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target groups you created in **1. Create Target Groups**.
-
-
-## Create Target Group
-
-Your first ALB configuration step is to create one target group for HTTP.
-
-Log into the [Amazon AWS Console](https://console.aws.amazon.com/ec2/) to get started.
-
-The document below will guide you through this process. Use the data in the tables below to complete the procedure.
-
-[Amazon Documentation: Create a Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-target-group.html)
-
-### Target Group (HTTP)
-
-Option                      | Setting
-----------------------------|------------------------------------
-Target Group Name           | `rancher-http-80`
-Protocol                    | `HTTP`
-Port                        | `80`
-Target type                 | `instance`
-VPC                         | Choose your VPC
-Protocol<br/>(Health Check) | `HTTP`
-Path<br/>(Health Check)     | `/healthz`
-
-## Register Targets
-
-Next, add your Linux nodes to your target group.
-
-[Amazon Documentation: Register Targets with Your Target Group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-register-targets.html)
-
-### Create Your ALB
-
-Use Amazon's Wizard to create an Application Load Balancer. As part of this process, you'll add the target group you created in [Create Target Group](#create-target-group).
-
-1. From your web browser, navigate to the [Amazon EC2 Console](https://console.aws.amazon.com/ec2/).
-
-2. From the navigation pane, choose **LOAD BALANCING** > **Load Balancers**.
-
-3. Click **Create Load Balancer**.
-
-4. Choose **Application Load Balancer**.
-
-5. Complete the **Step 1: Configure Load Balancer** form.
-	- **Basic Configuration**
-
-	   - Name: `rancher-http`
-	   - Scheme: `internet-facing`
-	   - IP address type: `ipv4`
-	- **Listeners**
-
-		Add the **Load Balancer Protocols** and **Load Balancer Ports** below.
-		- `HTTP`: `80`
-		- `HTTPS`: `443`
-
-	- **Availability Zones**
-
-	   - Select Your **VPC** and **Availability Zones**.
-
-6. Complete the **Step 2: Configure Security Settings** form.
-
-	Configure the certificate you want to use for SSL termination.
-
-7. Complete the **Step 3: Configure Security Groups** form.
-
-8. Complete the **Step 4: Configure Routing** form.
-
-	- From the **Target Group** drop-down, choose **Existing target group**.
-
-	- Add target group `rancher-http-80`.
-
-9. Complete **Step 5: Register Targets**. Since you registered your targets earlier, all you have to do it click **Next: Review**.
-
-10. Complete **Step 6: Review**. Look over the load balancer details and click **Create** when you're satisfied.
-
-11. After AWS creates the ALB, click **Close**.
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/nginx/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/nginx/_index.md
deleted file mode 100644
index c2b9f8fe1ad..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/nginx/_index.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: NGINX Configuration
-weight: 277
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install-external-lb/nginx/
-- /rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb/nginx
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-## Install NGINX
-
-Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems.
-
-For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-## Create NGINX Configuration
-
-See [Example NGINX config]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#example-nginx-config).
-
-## Run NGINX
-
-* Reload or restart NGINX
-
-    ````
-    # Reload NGINX
-    nginx -s reload
-
-    # Restart NGINX
-    # Depending on your Linux distribution
-    service nginx restart
-    systemctl restart nginx
-    ````
-
-## Browse to Rancher UI
-
-You should now be to able to browse to `https://FQDN`.
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/proxy/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/proxy/_index.md
deleted file mode 100644
index 4345e9cb121..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/proxy/_index.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: HTTP Proxy Configuration
-weight: 277
-aliases:
- - /rancher/v2.x/en/installation/ha/rke-add-on/proxy
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-If you operate Rancher behind a proxy and you want to access services through the proxy (such as retrieving catalogs), you must provide Rancher information about your proxy. As Rancher is written in Go, it uses the common proxy environment variables as shown below.
-
-Make sure `NO_PROXY` contains the network addresses, network address ranges and domains that should be excluded from using the proxy.
-
-Environment variable      | Purpose
---------------------------|---------
-HTTP_PROXY                | Proxy address to use when initiating HTTP connection(s)
-HTTPS_PROXY               | Proxy address to use when initiating HTTPS connection(s)
-NO_PROXY                  | Network address(es), network address range(s) and domains to exclude from using the proxy when initiating connection(s)
-
-> **Note** NO_PROXY must be in uppercase to use network range (CIDR) notation.
-
-##  Installing Rancher on a Kubernetes Cluster
-
-When using Kubernetes installation, the environment variables need to be added to the RKE Config File template.
-
-* [Kubernetes Installation with External Load Balancer (TCP/Layer 4) RKE Config File Template]({{<baseurl>}}/rancher/v2.x/en/installation/ha-server-install/#5-download-rke-config-file-template)
-* [Kubernetes Installation with External Load Balancer (HTTPS/Layer 7) RKE Config File Template]({{<baseurl>}}/rancher/v2.x/en/installation/ha-server-install-external-lb/#5-download-rke-config-file-template)
-
-The environment variables should be defined in the `Deployment` inside the RKE Config File Template. You only have to add the part starting with `env:` to (but not including) `ports:`. Make sure the indentation is identical to the preceding `name:`. Required values for `NO_PROXY` are:
-
-* `localhost`
-* `127.0.0.1`
-* `0.0.0.0`
-* Configured `service_cluster_ip_range` (default: `10.43.0.0/16`)
-
-The example below is based on a proxy server accessible at `http://192.168.0.1:3128`, and excluding usage of the proxy when accessing network range `192.168.10.0/24`, the configured `service_cluster_ip_range` (`10.43.0.0/16`) and every hostname under the domain `example.com`. If you have changed the `service_cluster_ip_range`, you have to update the value below accordingly.
-
-```yaml
-...
----
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:latest
-          imagePullPolicy: Always
-          name: cattle-server
-          env:
-          - name: HTTP_PROXY
-            value: "http://192.168.10.1:3128"
-          - name: HTTPS_PROXY
-            value: "http://192.168.10.1:3128"
-          - name: NO_PROXY
-            value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,192.168.10.0/24,example.com"
-          ports:
-...
-```
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/404-default-backend/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/404-default-backend/_index.md
deleted file mode 100644
index 0b036c0df28..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/404-default-backend/_index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: 404 - default backend
-weight: 30
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/404-default-backend/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform.
-
-When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors.
-
-### Possible causes
-
-The nginx ingress controller is not able to serve the configured host in `rancher-cluster.yml`. This should be the FQDN you configured to access Rancher. You can check if it is properly configured by viewing the ingress that is created by running the following command:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get ingress -n cattle-system -o wide
-```
-
-Check if the `HOSTS` column is displaying the FQDN you configured in the template, and that the used nodes are listed in the `ADDRESS` column. If that is configured correctly, we can check the logging of the nginx ingress controller.
-
-The logging of the nginx ingress controller will show why it cannot serve the requested host. To view the logs, you can run the following command
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx
-```
-
-<b>Errors</b>
-
-* `x509: certificate is valid for fqdn, not your_configured_fqdn`
-
-The used certificates do not contain the correct hostname. Generate new certificates that contain the chosen FQDN to access Rancher and redeploy.
-
-* `Port 80 is already in use. Please check the flag --http-port`
-
-There is a process on the node occupying port 80, this port is needed for the nginx ingress controller to route requests to Rancher. You can find the process by running the command: `netstat -plant | grep \:80`.
-
-Stop/kill the process and redeploy.
-
-* `unexpected error creating pem file: no valid PEM formatted block found`
-
-The base64 encoded string configured in the template is not valid. Please check if you can decode the configured string using `base64 -D STRING`, this should return the same output as the content of the file you used to generate the string. If this is correct, please check if the base64 encoded string is placed directly after the key, without any newlines before, in between or after. (For example: `tls.crt: LS01..`)
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/_index.md
deleted file mode 100644
index e9362246aec..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/_index.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-title: Troubleshooting HA RKE Add-On Install
-weight: 370
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This section contains common errors seen when setting up a Kubernetes installation.
-
-Choose from the following options:
-
-- [Generic troubleshooting](generic-troubleshooting/)
-
-	In this section, you can find generic ways to debug your Kubernetes cluster.
-
-- [Failed to set up SSH tunneling for host]({{<baseurl>}}/rke/latest/en/troubleshooting/ssh-connectivity-errors/)
-
-	In this section, you can find errors related to SSH tunneling when you run the `rke` command to setup your nodes.
-
-- [Failed to get job complete status](job-complete-status/)
-
-	In this section, you can find errors related to deploying addons.
-
-- [404 - default backend](404-default-backend/)
-
-	In this section, you can find errors related to the `404 - default backend` page that is shown when trying to access Rancher.
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/generic-troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/generic-troubleshooting/_index.md
deleted file mode 100644
index df8d4381f4a..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/generic-troubleshooting/_index.md
+++ /dev/null
@@ -1,161 +0,0 @@
----
-title: Generic troubleshooting
-weight: 5
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/generic-troubleshooting/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-Below are steps that you can follow to determine what is wrong in your cluster.
-
-### Double check if all the required ports are opened in your (host) firewall
-
-Double check if all the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) are opened in your (host) firewall.
-
-### All nodes should be present and in **Ready** state
-
-To check, run the command:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get nodes
-```
-
-If a node is not shown in this output or a node is not in **Ready** state, you can check the logging of the `kubelet` container. Login to the node and run `docker logs kubelet`.
-
-### All pods/jobs should be in **Running**/**Completed** state
-
-To check, run the command:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get pods --all-namespaces
-```
-
-If a pod is not in **Running** state, you can dig into the root cause by running:
-
-#### Describe pod
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml describe pod POD_NAME -n NAMESPACE
-```
-
-#### Pod container logs</h3>
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs POD_NAME -n NAMESPACE
-```
-
-If a job is not in **Completed** state, you can dig into the root cause by running:
-
-#### Describe job
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml describe job JOB_NAME -n NAMESPACE
-```
-
-#### Logs from the containers of pods of the job
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=JOB_NAME -n NAMESPACE
-```
-
-### Check ingress
-
-Ingress should have the correct `HOSTS` (showing the configured FQDN) and `ADDRESS` (address(es) it will be routed to).
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get ingress --all-namespaces
-```
-
-### List all Kubernetes cluster events
-
-Kubernetes cluster events are stored, and can be retrieved by running:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml get events --all-namespaces
-```
-
-### Check Rancher container logging
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=cattle -n cattle-system
-```
-
-### Check NGINX ingress controller logging
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l app=ingress-nginx -n ingress-nginx
-```
-
-### Check if overlay network is functioning correctly
-
-The pod can be scheduled to any of the hosts you used for your cluster, but that means that the NGINX ingress controller needs to be able to route the request from `NODE_1` to `NODE_2`. This happens over the overlay network. If the overlay network is not functioning, you will experience intermittent TCP/HTTP connection failures due to the NGINX ingress controller not being able to route to the pod.
-
-To test the overlay network, you can launch the following `DaemonSet` definition. This will run an `alpine` container on every host, which we will use to run a `ping` test between containers on all hosts.
-
-1. Save the following file as `ds-alpine.yml`
-
-    ```
-    apiVersion: apps/v1
-    kind: DaemonSet
-    metadata:
-      name: alpine
-    spec:
-      selector:
-          matchLabels:
-            name: alpine
-      template:
-        metadata:
-          labels:
-            name: alpine
-        spec:
-          tolerations:
-          - effect: NoExecute
-            key: "node-role.kubernetes.io/etcd"
-            value: "true"
-          - effect: NoSchedule
-            key: "node-role.kubernetes.io/controlplane"
-            value: "true"
-          containers:
-          - image: alpine
-            imagePullPolicy: Always
-            name: alpine
-            command: ["sh", "-c", "tail -f /dev/null"]
-            terminationMessagePath: /dev/termination-log
-    ```
-
-2. Launch it using `kubectl --kubeconfig kube_config_rancher-cluster.yml create -f ds-alpine.yml`
-3. Wait until `kubectl --kubeconfig kube_config_rancher-cluster.yml rollout status ds/alpine -w` returns: `daemon set "alpine" successfully rolled out`.
-4. Run the following command to let each container on every host ping each other (it's a single line command).
-
-    ```
-    echo "=> Start"; kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.metadata.name}{" "}{@.spec.nodeName}{"\n"}{end}' | while read spod shost; do kubectl --kubeconfig kube_config_rancher-cluster.yml get pods -l name=alpine -o jsonpath='{range .items[*]}{@.status.podIP}{" "}{@.spec.nodeName}{"\n"}{end}' | while read tip thost; do kubectl --kubeconfig kube_config_rancher-cluster.yml --request-timeout='10s' exec $spod -- /bin/sh -c "ping -c2 $tip > /dev/null 2>&1"; RC=$?; if [ $RC -ne 0 ]; then echo $shost cannot reach $thost; fi; done; done; echo "=> End"
-    ```
-
-5. When this command has finished running, the output indicating everything is correct is:
-
-    ```
-    => Start
-    => End
-    ```
-
-If you see error in the output, that means that the [required ports]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/node-requirements/#networking-requirements/) for overlay networking are not opened between the hosts indicated.
-
-Example error output of a situation where NODE1 had the UDP ports blocked.
-
-```
-=> Start
-command terminated with exit code 1
-NODE2 cannot reach NODE1
-command terminated with exit code 1
-NODE3 cannot reach NODE1
-command terminated with exit code 1
-NODE1 cannot reach NODE2
-command terminated with exit code 1
-NODE1 cannot reach NODE3
-=> End
-```
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/job-complete-status/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/job-complete-status/_index.md
deleted file mode 100644
index 8fd5e32b41b..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/troubleshooting/job-complete-status/_index.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: Failed to get job complete status
-weight: 20
-aliases:
-- /rancher/v2.x/en/installation/troubleshooting-ha/job-complete-status/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-To debug issues around this error, you will need to download the command-line tool `kubectl`. See [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) how to download `kubectl` for your platform.
-
-When you have made changes to `rancher-cluster.yml`, you will have to run `rke remove --config rancher-cluster.yml` to clean the nodes, so it cannot conflict with previous configuration errors.
-
-### Failed to deploy addon execute job [rke-user-includes-addons]: Failed to get job complete status
-
-Something is wrong in the addons definitions, you can run the following command to get the root cause in the logging of the job:
-
-```
-kubectl --kubeconfig kube_config_rancher-cluster.yml logs -l job-name=rke-user-addon-deploy-job -n kube-system
-```
-
-#### error: error converting YAML to JSON: yaml: line 9:
-
-The structure of the addons definition in `rancher-cluster.yml` is wrong. In the different resources specified in the addons section, there is a error in the structure of the YAML. The pointer  `yaml line 9` references to the line number of the addon that is causing issues.
-
-<b>Things to check</b>
-<ul>
-<ul>
-<li>Is each of the base64 encoded certificate string placed directly after the key, for example: `tls.crt: LS01...`, there should be no newline/space before, in between or after.</li>
-<li>Is the YAML properly formatted, each indentation should be 2 spaces as shown in the template files.</li>
-<li>Verify the integrity of your certificate by running this command `cat MyCertificate | base64 -d` on Linux, `cat MyCertificate | base64 -D` on Mac OS . If any error exists, the command output will tell you.
-</ul>
-</ul>
-
-#### Error from server (BadRequest): error when creating "/etc/config/rke-user-addon.yaml": Secret in version "v1" cannot be handled as a Secret
-
-The base64 string of one of the certificate strings is wrong. The log message will try to show you what part of the string is not recognized as valid base64.
-
-<b>Things to check</b>
-<ul>
-<ul>
-<li>Check if the base64 string is valid by running one of the commands below:</li>
-
-```
-# MacOS
-echo BASE64_CRT | base64 -D
-# Linux
-echo BASE64_CRT | base64 -d
-# Windows
-certutil -decode FILENAME.base64 FILENAME.verify
-```
-
-</ul>
-</ul>
-
-#### The Ingress "cattle-ingress-http" is invalid: spec.rules[0].host: Invalid value: "IP": must be a DNS name, not an IP address
-
-The host value can only contain a host name, as it is needed by the ingress controller to match the hostname and pass to the correct backend.
diff --git a/content/rancher/v2.x/en/installation/options/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/options/single-node-install-external-lb/_index.md
deleted file mode 100644
index c2aa176b058..00000000000
--- a/content/rancher/v2.x/en/installation/options/single-node-install-external-lb/_index.md
+++ /dev/null
@@ -1,243 +0,0 @@
----
-title: Docker Install with TLS Termination at Layer-7 NGINX Load Balancer
-weight: 252
-aliases:
-  - /rancher/v2.x/en/installation/single-node/single-node-install-external-lb/
-  - /rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-install-external-lb
----
-
-For development and testing environments that have a special requirement to terminate TLS/SSL at a load balancer instead of your Rancher Server container, deploy Rancher and configure a load balancer to work with it conjunction.
-
-A layer-7 load balancer can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with.
-
-This install procedure walks you through deployment of Rancher using a single container, and then provides a sample configuration for a layer-7 NGINX load balancer.
-
-> **Want to skip the external load balancer?**
-> See [Docker Installation]({{<baseurl>}}/rancher/v2.x/en/installation/single-node) instead.
-
-## Requirements for OS, Docker, Hardware, and Networking
-
-Make sure that your node fulfills the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-## Installation Outline
-
-<!-- TOC -->
-
-- [1. Provision Linux Host](#1-provision-linux-host)
-- [2. Choose an SSL Option and Install Rancher](#2-choose-an-ssl-option-and-install-rancher)
-- [3. Configure Load Balancer](#3-configure-load-balancer)
-
-<!-- /TOC -->
-
-## 1. Provision Linux Host
-
-Provision a single Linux host according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements) to launch your {{< product >}} Server.
-
-## 2. Choose an SSL Option and Install Rancher
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-> **Do you want to...**
->
-> - Complete an Air Gap Installation?
-> - Record all transactions with the Rancher API?
->
-> See [Advanced Options](#advanced-options) below before continuing.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A-Bring Your Own Certificate: Self-Signed" %}}
-If you elect to use a self-signed certificate to encrypt communication, you must install the certificate on your load balancer (which you'll do later) and your Rancher container. Run the Docker command to deploy Rancher, pointing it toward your certificate.
-
-> **Prerequisites:**
-> Create a self-signed certificate.
->
-> - The certificate files must be in [PEM format](#pem).
-
-**To Install Rancher Using a Self-Signed Cert:**
-
-1. While running the Docker command to deploy Rancher, point Docker toward your CA certificate file.
-
-   ```
-   docker run -d --restart=unless-stopped \
-     -p 80:80 -p 443:443 \
-     -v /etc/your_certificate_directory/cacerts.pem:/etc/rancher/ssl/cacerts.pem \
-     rancher/rancher:latest
-   ```
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Signed by Recognized CA" %}}
-If your cluster is public facing, it's best to use a certificate signed by a recognized CA.
-
-> **Prerequisites:**
->
-> - The certificate files must be in [PEM format](#pem).
-
-**To Install Rancher Using a Cert Signed by a Recognized CA:**
-
-If you use a certificate signed by a recognized CA, installing your certificate in the Rancher container isn't necessary. We do have to make sure there is no default CA certificate generated and stored, you can do this by passing the `--no-cacerts` parameter to the container.
-
-1.  Enter the following command.
-
-        ```
-        docker run -d --restart=unless-stopped \
-        -p 80:80 -p 443:443 \
-        rancher/rancher:latest --no-cacerts
-        ```
-
-    {{% /accordion %}}
-
-## 3. Configure Load Balancer
-
-When using a load balancer in front of your Rancher container, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https` header, this redirect is disabled.
-
-The load balancer or proxy has to be configured to support the following:
-
-- **WebSocket** connections
-- **SPDY** / **HTTP/2** protocols
-- Passing / setting the following headers:
-
-    | Header | Value | Description |
-    |--------|-------|-------------|
-    | `Host`                | Hostname used to reach Rancher.          | To identify the server requested by the client.
-    | `X-Forwarded-Proto`   | `https`                                  | To identify the protocol that a client used to connect to the load balancer or proxy.<br /><br/>**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS.
-    | `X-Forwarded-Port`    | Port used to reach Rancher.              | To identify the protocol that client used to connect to the load balancer or proxy.
-    | `X-Forwarded-For`     | IP of the client connection.             | To identify the originating IP address of a client.
-### Example NGINX configuration
-
-This NGINX configuration is tested on NGINX 1.14.
-
-> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/).
-
-- Replace `rancher-server` with the IP address or hostname of the node running the Rancher container.
-- Replace both occurrences of `FQDN` to the DNS name for Rancher.
-- Replace `/certs/fullchain.pem` and `/certs/privkey.pem` to the location of the server certificate and the server certificate key respectively.
-
-```
-worker_processes 4;
-worker_rlimit_nofile 40000;
-
-events {
-    worker_connections 8192;
-}
-
-http {
-    upstream rancher {
-        server rancher-server:80;
-    }
-
-    map $http_upgrade $connection_upgrade {
-        default Upgrade;
-        ''      close;
-    }
-
-    server {
-        listen 443 ssl http2;
-        server_name FQDN;
-        ssl_certificate /certs/fullchain.pem;
-        ssl_certificate_key /certs/privkey.pem;
-
-        location / {
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass http://rancher;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
-            proxy_read_timeout 900s;
-            proxy_buffering off;
-        }
-    }
-
-    server {
-        listen 80;
-        server_name FQDN;
-        return 301 https://$server_name$request_uri;
-    }
-}
-```
-
-<br/>
-
-## What's Next?
-
-- **Recommended:** Review [Single Node Backup and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). Although you don't have any data you need to back up right now, we recommend creating backups after regular Rancher use.
-- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_single >}}
-
-## Advanced Options
-
-### API Auditing
-
-If you want to record all transactions with the Rancher API, enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by adding the flags below into your install command.
-
-    -e AUDIT_LEVEL=1 \
-    -e AUDIT_LOG_PATH=/var/log/auditlog/rancher-api-audit.log \
-    -e AUDIT_LOG_MAXAGE=20 \
-    -e AUDIT_LOG_MAXBACKUP=20 \
-    -e AUDIT_LOG_MAXSIZE=100 \
-
-### Air Gap
-
-If you are visiting this page to complete an [Air Gap Installation]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/), you must pre-pend your private registry URL to the server tag when running the installation command in the option that you choose. Add `<REGISTRY.DOMAIN.COM:PORT>` with your private registry URL in front of `rancher/rancher:latest`.
-
-**Example:**
-
-     <REGISTRY.DOMAIN.COM:PORT>/rancher/rancher:latest
-
-### Persistent Data
-
-{{< persistentdata >}}
-
-This layer 7 NGINX configuration is tested on NGINX version 1.13 (mainline) and 1.14 (stable).
-
-> **Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
-
-```
-upstream rancher {
-    server rancher-server:80;
-}
-
-map $http_upgrade $connection_upgrade {
-    default Upgrade;
-    ''      close;
-}
-
-server {
-    listen 443 ssl http2;
-    server_name rancher.yourdomain.com;
-    ssl_certificate /etc/your_certificate_directory/fullchain.pem;
-    ssl_certificate_key /etc/your_certificate_directory/privkey.pem;
-
-    location / {
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Port $server_port;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_pass http://rancher;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-        # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
-        proxy_read_timeout 900s;
-        proxy_buffering off;
-    }
-}
-
-server {
-    listen 80;
-    server_name rancher.yourdomain.com;
-    return 301 https://$server_name$request_uri;
-}
-```
-
-<br/>
-
diff --git a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
deleted file mode 100644
index 08a26d99bef..00000000000
--- a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
+++ /dev/null
@@ -1,189 +0,0 @@
----
-title: Troubleshooting the Rancher Server Kubernetes Cluster
-weight: 276
-aliases:
-  - /rancher/v2.x/en/installation/k8s-install/helm-rancher/troubleshooting/
-  - /rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting
-  - /rancher/v2.x/en/installation/k8s-install/kubernetes-rke/troubleshooting
----
-
-This section describes how to troubleshoot an installation of Rancher on a Kubernetes cluster.
-
-### Relevant Namespaces
-
-Most of the troubleshooting will be done on objects in these 3 namespaces.
-
-- `cattle-system` - `rancher` deployment and pods.
-- `ingress-nginx` - Ingress controller pods and services.
-- `kube-system` - `tiller` and `cert-manager` pods.
-
-### "default backend - 404"
-
-A number of things can cause the ingress-controller not to forward traffic to your rancher instance. Most of the time its due to a bad ssl configuration.
-
-Things to check
-
-- [Is Rancher Running](#is-rancher-running)
-- [Cert CN is "Kubernetes Ingress Controller Fake Certificate"](#cert-cn-is-kubernetes-ingress-controller-fake-certificate)
-
-### Check if Rancher is Running
-
-Use `kubectl` to check the `cattle-system` system namespace and see if the Rancher pods are in a Running state.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-If the state is not `Running`, run a `describe` on the pod and check the Events.
-
-```
-kubectl -n cattle-system describe pod
-
-...
-Events:
-  Type     Reason                 Age   From                Message
-  ----     ------                 ----  ----                -------
-  Normal   Scheduled              11m   default-scheduler   Successfully assigned rancher-784d94f59b-vgqzh to localhost
-  Normal   SuccessfulMountVolume  11m   kubelet, localhost  MountVolume.SetUp succeeded for volume "rancher-token-dj4mt"
-  Normal   Pulling                11m   kubelet, localhost  pulling image "rancher/rancher:v2.0.4"
-  Normal   Pulled                 11m   kubelet, localhost  Successfully pulled image "rancher/rancher:v2.0.4"
-  Normal   Created                11m   kubelet, localhost  Created container
-  Normal   Started                11m   kubelet, localhost  Started container
-```
-
-### Check the Rancher Logs
-
-Use `kubectl` to list the pods.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-Use `kubectl` and the pod name to list the logs from the pod.
-
-```
-kubectl -n cattle-system logs -f rancher-784d94f59b-vgqzh
-```
-
-### Cert CN is "Kubernetes Ingress Controller Fake Certificate"
-
-Use your browser to check the certificate details. If it says the Common Name is "Kubernetes Ingress Controller Fake Certificate", something may have gone wrong with reading or issuing your SSL cert.
-
-> **Note:** if you are using LetsEncrypt to issue certs it can sometimes take a few minuets to issue the cert.
-
-### Checking for issues with cert-manager issued certs (Rancher Generated or LetsEncrypt)
-
-`cert-manager` has 3 parts.
-
-- `cert-manager` pod in the `kube-system` namespace.
-- `Issuer` object in the `cattle-system` namespace.
-- `Certificate` object in the `cattle-system` namespace.
-
-Work backwards and do a `kubectl describe` on each object and check the events. You can track down what might be missing.
-
-For example there is a problem with the Issuer:
-
-```
-kubectl -n cattle-system describe certificate
-...
-Events:
-  Type     Reason          Age                 From          Message
-  ----     ------          ----                ----          -------
-  Warning  IssuerNotReady  18s (x23 over 19m)  cert-manager  Issuer rancher not ready
-```
-
-```
-kubectl -n cattle-system describe issuer
-...
-Events:
-  Type     Reason         Age                 From          Message
-  ----     ------         ----                ----          -------
-  Warning  ErrInitIssuer  19m (x12 over 19m)  cert-manager  Error initializing issuer: secret "tls-rancher" not found
-  Warning  ErrGetKeyPair  9m (x16 over 19m)   cert-manager  Error getting keypair for CA issuer: secret "tls-rancher" not found
-```
-
-### Checking for Issues with Your Own SSL Certs
-
-Your certs get applied directly to the Ingress object in the `cattle-system` namespace.
-
-Check the status of the Ingress object and see if its ready.
-
-```
-kubectl -n cattle-system describe ingress
-```
-
-If its ready and the SSL is still not working you may have a malformed cert or secret.
-
-Check the nginx-ingress-controller logs. Because the nginx-ingress-controller has multiple containers in its pod you will need to specify the name of the container.
-
-```
-kubectl -n ingress-nginx logs -f nginx-ingress-controller-rfjrq nginx-ingress-controller
-...
-W0705 23:04:58.240571       7 backend_ssl.go:49] error obtaining PEM from secret cattle-system/tls-rancher-ingress: error retrieving secret cattle-system/tls-rancher-ingress: secret cattle-system/tls-rancher-ingress was not found
-```
-
-### No matches for kind "Issuer"
-
-The [SSL configuration]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#choose-your-ssl-configuration) option you have chosen requires [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) to be installed before installing Rancher or else the following error is shown:
-
-```
-Error: validation failed: unable to recognize "": no matches for kind "Issuer" in version "certmanager.k8s.io/v1alpha1"
-```
-
-Install [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) and try installing Rancher again.
-
-
-### Canal Pods show READY 2/3
-
-The most common cause of this issue is port 8472/UDP is not open between the nodes. Check your local firewall, network routing or security groups.
-
-Once the network issue is resolved, the `canal` pods should timeout and restart to establish their connections.
-
-### nginx-ingress-controller Pods show RESTARTS
-
-The most common cause of this issue is the `canal` pods have failed to establish the overlay network. See [canal Pods show READY `2/3`](#canal-pods-show-ready-2-3) for troubleshooting.
-
-
-### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed)
-
-Some causes of this error include:
-
-* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`:
-
-```
-$ ssh user@server
-user@server$ docker ps
-CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
-```
-
-See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* SSH server version is not version 6.7 or higher. This is needed for socket forwarding to work, which is used to connect to the Docker socket over SSH. This can be checked using `sshd -V` on the host you are connecting to, or using netcat:
-```
-$ nc xxx.xxx.xxx.xxx 22
-SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
-```
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
-
-The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
-
-The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
-
-If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
-
-### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
-
-The node is not reachable on the configured `address` and `port`.
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
deleted file mode 100644
index 4aee1733f98..00000000000
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-title: Upgrading Cert-Manager with Helm 2
-weight: 2040
----
-
-Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, three important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher:
-
-1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
-1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.7-0.8.html#upgrading-from-v0-7-to-v0-8). This change has no exact deadline.
-1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
-
-To address these changes, this guide will do two things:
-
-1. Document the procedure for upgrading cert-manager
-1. Explain the cert-manager API changes and link to cert-manager's offficial documentation for migrating your data
-
-> **Important:**
-> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them:
-
-> 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server
-> 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager
-> 3. Install the newer version of Rancher and cert-manager 
-
-> The reason is that when Helm upgrades Rancher, it will reject the upgrade and show error messages if the running Rancher app does not match the chart template used to install it. Because cert-manager changed its API group and we cannot modify released charts for Rancher, there will always be a mismatch on the cert-manager's API version, therefore the upgrade will be rejected.
-
-> For reinstalling Rancher with Helm, please check [Option B: Reinstalling Rancher Chart]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/#c-upgrade-rancher) under the upgrade Rancher section. 
-
-## Upgrade Cert-Manager Only 
-
-> **Note:**
-> These instructions are applied if you have no plan to upgrade Rancher. 
-
-The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-\* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues.
-
-In order to upgrade cert-manager, follow these instructions:
-
-{{% accordion id="normal" label="Upgrading cert-manager with Internet access" %}}
-1. Back up existing resources as a precaution
-
-    ```plain
-    kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml
-    ```
-
-1. Delete the existing deployment
-
-    ```plain
-    helm delete --purge cert-manager
-    ```
-
-1. Install the CustomResourceDefinition resources separately
-
-    ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    ```
-
-1. Add the Jetstack Helm repository
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    ```
-
-1. Update your local Helm chart repository cache
-
-    ```plain
-    helm repo update
-    ```
-
-1. Install the new version of cert-manager
-
-    ```plain
-    helm install --version 0.12.0 --name cert-manager --namespace kube-system jetstack/cert-manager
-    ```
-{{% /accordion %}}
-
-{{% accordion id="airgap" label="Upgrading cert-manager in an airgapped environment" %}}
-### Prerequisites
-
-Before you can perform the upgrade, you must prepare your air gapped environment by adding the necessary container images to your private registry and downloading or rendering the required Kubernetes manifest files.
-
-1. Follow the guide to [Prepare your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images needed for the upgrade.
-
-1. From a system connected to the internet, add the cert-manager repo to Helm
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    ```
-
-1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
-
-    ```plain
-    helm fetch jetstack/cert-manager --version v0.12.0
-    ```
-
-1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
-
-    ```plain
-    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
-    --name cert-manager --namespace kube-system \
-    --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
-    --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
-    --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
-    ```
-
-1. Download the required CRD file for cert-manager
-
-    ```plain
-    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    ```
-
-### Install cert-manager
-
-1. Back up existing resources as a precaution
-
-    ```plain
-    kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml
-    ```
-
-1. Delete the existing cert-manager installation
-
-    ```plain
-    kubectl -n kube-system delete deployment,sa,clusterrole,clusterrolebinding -l 'app=cert-manager' -l 'chart=cert-manager-v0.5.2'
-    ```
-
-1. Install the CustomResourceDefinition resources separately
-
-    ```plain
-    kubectl apply -f cert-manager/cert-manager-crd.yaml
-    ```
-
-
-1. Install cert-manager
-
-    ```plain
-    kubectl -n kube-system apply -R -f ./cert-manager
-    ```
-{{% /accordion %}}
-
-
-Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods:
-
-```
-kubectl get pods --namespace kube-system
-
-NAME                                            READY   STATUS      RESTARTS   AGE
-cert-manager-7cbdc48784-rpgnt                   1/1     Running     0          3m
-cert-manager-webhook-5b5dd6999-kst4x            1/1     Running     0          3m
-cert-manager-cainjector-3ba5cd2bcd-de332x       1/1     Running     0          3m
-```
-
-If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check cert-manager's [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide.
-
-> **Note:** The above instructions ask you to add the disable-validation label to the kube-system namespace. Here are additional resources that explain why this is necessary:
->
-> - [Information on the disable-validation label](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.4-0.5.html?highlight=certmanager.k8s.io%2Fdisable-validation#disabling-resource-validation-on-the-cert-manager-namespace)
-> - [Information on webhook validation for certificates](https://docs.cert-manager.io/en/latest/getting-started/webhook.html)
-
-## Cert-Manager API change and data migration
-
-Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release.
-
-Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format.
-
-Details about the change and migration instructions can be found in the [cert-manager v0.7 to v0.8 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
-
-The v0.11 release marks the removal of the v1alpha1 API that was used in previous versions of cert-manager, as well as our API group changing to be `cert-manager.io` instead of `certmanager.k8s.io.`
-
-We have also removed support for the old configuration format that was deprecated in the v0.8 release. This means you must transition to using the new solvers style configuration format for your ACME issuers before upgrading to v0.11. For more information, see the [upgrading to v0.8 guide](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
-
-Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
-
-For information on upgrading from all other versions of cert-manager, refer to the [official documentation](https://cert-manager.io/docs/installation/upgrading/).
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/_index.md
index e417c9260a5..868519c447c 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Other Installation Methods
-weight: 4
+weight: 3
 ---
 
 ### Docker Installations
diff --git a/content/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-rollbacks/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/_index.md
rename to content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-rollbacks/_index.md
index 4705d65d1d8..c74ccc9c9bb 100644
--- a/content/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-rollbacks/_index.md
@@ -1,8 +1,9 @@
 ---
-title: Docker Rollback
+title: Rolling Back Rancher Installed with Docker
 weight: 1015
 aliases:
   - /rancher/v2.x/en/upgrades/single-node-rollbacks
+  - /rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks
 ---
 
 If a Rancher upgrade does not complete successfully, you'll have to roll back to your Rancher setup that you were using before [Docker Upgrade]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade). Rolling back restores:
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
rename to content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md
index d83c6a64e2e..ad2babc1fb7 100644
--- a/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md
@@ -4,6 +4,7 @@ weight: 1010
 aliases:
   - /rancher/v2.x/en/upgrades/single-node-upgrade/
   - /rancher/v2.x/en/upgrades/upgrades/single-node-air-gap-upgrade
+  - /rancher/v2.x/en/upgrades/upgrades/single-node
 ---
 
 The following instructions will guide you through upgrading a Rancher server that was installed with Docker.
diff --git a/content/rancher/v2.x/en/installation/options/_index.md b/content/rancher/v2.x/en/installation/resources/_index.md
similarity index 55%
rename from content/rancher/v2.x/en/installation/options/_index.md
rename to content/rancher/v2.x/en/installation/resources/_index.md
index be369e77a78..fd1c2975bbf 100644
--- a/content/rancher/v2.x/en/installation/options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/_index.md
@@ -1,8 +1,24 @@
 ---
-title: Resources, References, and Advanced Options
-weight: 5
+title: Resources
+weight: 4
 ---
 
+> This section is under construction.
+
+### Docker Installations
+
+The [single-node Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster using Helm, you install the Rancher server component on a single node using a `docker run` command.
+
+Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server.
+
+### Air Gapped Installations
+
+Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) to install the Rancher server in an air gapped environment.
+
+An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
+
+### Advanced Options
+
 When installing Rancher, there are several advanced options that can be enabled during installation. Within each install guide, these options are presented. Learn more about these options:
 
 | Advanced Option                                                                                                         | Available as of |
diff --git a/content/rancher/v2.x/en/installation/resources/advanced/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/_index.md
new file mode 100644
index 00000000000..6087cf17317
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/resources/advanced/_index.md
@@ -0,0 +1,6 @@
+---
+title: Advanced
+weight: 5
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/api-audit-log/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/api-audit-log/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/installation/options/api-audit-log/_index.md
rename to content/rancher/v2.x/en/installation/resources/advanced/api-audit-log/_index.md
index e465c60eb6c..d68051fc7bb 100644
--- a/content/rancher/v2.x/en/installation/options/api-audit-log/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/advanced/api-audit-log/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Enabling the API Audit Log to Record System Events
-weight: 10000
-aliases:
-  - /rancher/v2.x/en/admin-settings/api-auditing/
+weight: 4
 ---
 
 You can enable the API audit log to record the sequence of system events initiated by individual users. You can know what happened, when it happened, who initiated it, and what cluster it affected. When you enable this feature, all requests to the Rancher API and all responses from it are written to a log.
diff --git a/content/rancher/v2.x/en/installation/options/arm64-platform/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/arm64-platform/_index.md
similarity index 91%
rename from content/rancher/v2.x/en/installation/options/arm64-platform/_index.md
rename to content/rancher/v2.x/en/installation/resources/advanced/arm64-platform/_index.md
index 762d3c1541d..b0a7f913c38 100644
--- a/content/rancher/v2.x/en/installation/options/arm64-platform/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/advanced/arm64-platform/_index.md
@@ -1,12 +1,8 @@
 ---
 title: Running on ARM64 (Experimental)
-weight: 7600
-aliases:
-  - /rancher/v2.x/en/installation/arm64-platform
+weight: 3
 ---
 
-_Available as of v2.2.0_
-
 > **Important:**
 >
 > Running on an ARM64 platform is currently an experimental feature and is not yet officially supported in Rancher. Therefore, we do not recommend using ARM64 based nodes in a production environment.
diff --git a/content/rancher/v2.x/en/installation/options/etcd/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/etcd/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/installation/options/etcd/_index.md
rename to content/rancher/v2.x/en/installation/resources/advanced/etcd/_index.md
index bbfefa11a28..a605c7343aa 100644
--- a/content/rancher/v2.x/en/installation/options/etcd/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/advanced/etcd/_index.md
@@ -1,7 +1,6 @@
 ---
 title: Tuning etcd for Large Installations
-weight: 3
-aliases:
+weight: 2
 ---
 
 When running larger Rancher installations with 15 or more clusters it is recommended to increase the default keyspace for etcd from the default 2GB. The maximum setting is 8GB and the host should have enough RAM to keep the entire dataset in memory. When increasing this value you should also increase the size of the host. The keyspace size can also be adjusted in smaller installations if you anticipate a high rate of change of pods during the garbage collection interval.
diff --git a/content/rancher/v2.x/en/installation/options/firewall/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/firewall/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/installation/options/firewall/_index.md
rename to content/rancher/v2.x/en/installation/resources/advanced/firewall/_index.md
index 601d8c046ee..7386ba0880e 100644
--- a/content/rancher/v2.x/en/installation/options/firewall/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/advanced/firewall/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Opening Ports with firewalld
-weight: 12000
+weight: 1
 ---
 
 Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm.
diff --git a/content/rancher/v2.x/en/installation/options/chart-options/_index.md b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/installation/options/chart-options/_index.md
rename to content/rancher/v2.x/en/installation/resources/chart-options/_index.md
index 5cec85b61e6..0cb9130abd5 100644
--- a/content/rancher/v2.x/en/installation/options/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
@@ -1,8 +1,22 @@
 ---
-title: Helm Chart Options for Kubernetes Installations
-weight: 276
+title: Helm Chart Options
+weight: 2
 ---
 
+> This page is under construction.
+
+- [Common Options](#common-options)
+- [Advanced Options](#advanced-options)
+- [API Audit Log](#api-audit-log)
+- [Setting Extra Environment Variables](#setting-extra-environment-variables)
+- [TLS Settings](#tls-settings)
+- [Import local Cluster](#import-local-cluster)
+- [Customizing your Ingress](#customizing-your-ingress)
+- [HTTP Proxy](#http-proxy)
+- [Additional Trusted CAs](#additional-trusted-cas)
+- [Private Registry and Air Gap Installs](#private-registry-and-air-gap-installs)
+- [External TLS Termination](#external-tls-termination)
+
 ### Common Options
 
 | Option                    | Default Value | Description                                                                        |
@@ -44,8 +58,8 @@ weight: 276
 | `rancherImageTag`              | same as chart version                                 | `string` - rancher/rancher image tag                                                                                                              |
 | `rancherImagePullPolicy`       | "IfNotPresent"                                        | `string` - Override imagePullPolicy for rancher server images - "Always", "Never", "IfNotPresent"                                                 |
 | `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
-| `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/ _Available as of v2.3.0_                  |
-| `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. _Available as of v2.3.0_ |
+| `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/                   |
+| `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations.  |
 
 <br/>
 
@@ -65,8 +79,6 @@ Set the `auditLog.destination` to `hostPath` to forward logs to volume shared wi
 
 ### Setting Extra Environment Variables
 
-_Available as of v2.2.0_
-
 You can set extra environment variables for Rancher server using `extraEnv`. This list uses the same `name` and `value` keys as the container manifest definitions. Remember to quote the values.
 
 ```plain
@@ -74,9 +86,7 @@ You can set extra environment variables for Rancher server using `extraEnv`. Thi
 --set 'extraEnv[0].value=1.0'
 ```
 
-### TLS settings
-
-_Available as of v2.2.0_
+### TLS Settings
 
 To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
 
@@ -109,8 +119,6 @@ Example on setting a custom certificate issuer:
 --set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair
 ```
 
-_Available as of v2.0.15, v2.1.10 and v2.2.4_
-
 Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used.
 
 ```plain
@@ -139,7 +147,7 @@ If you have private registries, catalogs or a proxy that intercepts certificates
 Once the Rancher deployment is created, copy your CA certs in pem format into a file named `ca-additional.pem` and use `kubectl` to create the `tls-ca-additional` secret in the `cattle-system` namespace.
 
 ```plain
-kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem
+kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem
 ```
 
 ### Private Registry and Air Gap Installs
diff --git a/content/rancher/v2.x/en/installation/options/server-tags/_index.md b/content/rancher/v2.x/en/installation/resources/choosing-version/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/installation/options/server-tags/_index.md
rename to content/rancher/v2.x/en/installation/resources/choosing-version/_index.md
index 103b487d081..36edeae1f5a 100644
--- a/content/rancher/v2.x/en/installation/options/server-tags/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/choosing-version/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Choosing a Rancher Version
-weight: 230
-aliases:
- - /rancher/v2.x/en/installation/server-tags
+weight: 1
 ---
 
 This section describes how to choose a Rancher version.
diff --git a/content/rancher/v2.x/en/installation/resources/encryption/_index.md b/content/rancher/v2.x/en/installation/resources/encryption/_index.md
new file mode 100644
index 00000000000..c49e516a62b
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/resources/encryption/_index.md
@@ -0,0 +1,6 @@
+---
+title: Encryption
+weight: 3
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/custom-ca-root-certificate/_index.md b/content/rancher/v2.x/en/installation/resources/encryption/custom-ca-root-certificate/_index.md
similarity index 94%
rename from content/rancher/v2.x/en/installation/options/custom-ca-root-certificate/_index.md
rename to content/rancher/v2.x/en/installation/resources/encryption/custom-ca-root-certificate/_index.md
index 69a2a82944e..924bb8a8203 100644
--- a/content/rancher/v2.x/en/installation/options/custom-ca-root-certificate/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/encryption/custom-ca-root-certificate/_index.md
@@ -1,8 +1,6 @@
 ---
 title: About Custom CA Root Certificates
-weight: 1110
-aliases:
-  - /rancher/v2.x/en/installation/custom-ca-root-certificate/
+weight: 1
 ---
 
 If you're using Rancher in an internal production environment where you aren't exposing apps publicly, use a certificate from a private certificate authority (CA).
diff --git a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/resources/encryption/tls-secrets/_index.md
similarity index 91%
rename from content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
rename to content/rancher/v2.x/en/installation/resources/encryption/tls-secrets/_index.md
index 9693d584b0b..2bc835cf922 100644
--- a/content/rancher/v2.x/en/installation/options/tls-secrets/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/encryption/tls-secrets/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Adding TLS Secrets
-weight: 276
-aliases:
-- /rancher/v2.x/en/installation/k8s-install/helm-rancher/tls-secrets/
+weight: 2
 ---
 
 Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key.
@@ -28,9 +26,11 @@ If you are using a private CA, Rancher requires a copy of the CA certificate whi
 
 Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
 
+>**Important:** Make sure the file is called `cacerts.pem` as Rancher uses that filename to configure the CA certificate.
+
 ```
 kubectl -n cattle-system create secret generic tls-ca \
-  --from-file=cacerts.pem=./cacerts.pem
+  --from-file=cacerts.pem
 ```
 
 > **Note:** The configured `tls-ca` secret is retrieved when Rancher starts. On a running Rancher installation the updated CA will take effect after new Rancher pods are started.
diff --git a/content/rancher/v2.x/en/installation/options/tls-settings/_index.md b/content/rancher/v2.x/en/installation/resources/encryption/tls-settings/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/installation/options/tls-settings/_index.md
rename to content/rancher/v2.x/en/installation/resources/encryption/tls-settings/_index.md
index 2cefd9fc853..fc57ede4a78 100644
--- a/content/rancher/v2.x/en/installation/options/tls-settings/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/encryption/tls-settings/_index.md
@@ -1,10 +1,8 @@
 ---
-title: TLS settings
-weight: 11000
+title: TLS Settings
+weight: 3
 ---
 
-_Available as of v2.1.7_
-
 In Rancher v2.1.7, the default TLS configuration changed to only accept TLS 1.2 and secure TLS cipher suites. TLS 1.3 and TLS 1.3 exclusive cipher suites are not supported.
 
 ## Configuring TLS settings
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md b/content/rancher/v2.x/en/installation/resources/encryption/upgrading-cert-manager/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
rename to content/rancher/v2.x/en/installation/resources/encryption/upgrading-cert-manager/_index.md
index 2f224f311b3..19ee7d06ee9 100644
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/encryption/upgrading-cert-manager/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Upgrading Cert-Manager
-weight: 2040
+weight: 4
 ---
 
 Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, three important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher:
diff --git a/content/rancher/v2.x/en/installation/options/helm-version/_index.md b/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
similarity index 93%
rename from content/rancher/v2.x/en/installation/options/helm-version/_index.md
rename to content/rancher/v2.x/en/installation/resources/helm-version/_index.md
index 11900d73e09..3a91781871a 100644
--- a/content/rancher/v2.x/en/installation/options/helm-version/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
@@ -1,8 +1,6 @@
 ---
 title: Helm Version Requirements
-weight: 400
-aliases:
-- /rancher/v2.x/en/installation/helm-version
+weight: 3
 ---
 
 This section contains the requirements for Helm, which is the tool used to install Rancher on a high-availability Kubernetes cluster.
diff --git a/content/rancher/v2.x/en/installation/requirements/installing-docker/_index.md b/content/rancher/v2.x/en/installation/resources/installing-docker/_index.md
similarity index 92%
rename from content/rancher/v2.x/en/installation/requirements/installing-docker/_index.md
rename to content/rancher/v2.x/en/installation/resources/installing-docker/_index.md
index b9f42e85179..9e040067e5d 100644
--- a/content/rancher/v2.x/en/installation/requirements/installing-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/installing-docker/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Installing Docker
 weight: 1
+aliases:
+  - /rancher/v2.x/en/installation/requirements/installing-docker
 ---
 
 Docker is required to be installed on any node that runs the Rancher server.
diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md
new file mode 100644
index 00000000000..a85228adea1
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md
@@ -0,0 +1,6 @@
+---
+title: "Don't have a Kubernetes cluster? Try one of these tutorials."
+weight: 4
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE/_index.md
similarity index 67%
rename from content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
rename to content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE/_index.md
index e5b82679211..c644050196b 100644
--- a/content/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE/_index.md
@@ -1,11 +1,11 @@
 ---
-title: 2. Set up a Kubernetes Cluster
-description: Learn how to use Rancher Kubernetes Engine (RKE) to install Kubernetes with a high availability etcd configuration.
-weight: 190
-aliases:
-  - /rancher/v2.x/en/installation/ha/kubernetes-rke/
+title: Setting up a High-availability RKE Kubernetes Cluster
+shortTitle: Set up RKE Kubernetes
+weight: 3
 ---
 
+> This page is under construction.
+
 This section describes how to install a Kubernetes cluster according to our [best practices for the Rancher server environment.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) This cluster should be dedicated to run only the Rancher server.
 
 For Rancher prior to v2.4, Rancher should be installed on an RKE Kubernetes cluster. RKE is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers.
@@ -21,111 +21,10 @@ For systems without direct internet access, refer to [Air Gap: Kubernetes instal
 >
 > To set up a single-node RKE cluster, configure only one node in the `cluster.yml` . The single node should have all three roles: `etcd`, `controlplane`, and `worker`.
 >
-> To set up a single-node K3s cluster, run the Rancher server installation command on just one node instead of two nodes.
->
 > In both single-node setups, Rancher can be installed with Helm on the Kubernetes cluster in the same way that it would be installed on any other cluster.
 
 # Installing Kubernetes
 
-
-The steps to set up the Kubernetes cluster differ depending on whether you are using RKE or K3s.
-
-{{% tabs %}}
-{{% tab "K3s" %}}
-
-### 1. Install Kubernetes and Set up the K3s Server
-
-When running the command to start the K3s Kubernetes API server, you will pass in an option to use the external datastore that you set up earlier.
-
-1. Connect to one of the Linux nodes that you have prepared to run the Rancher server.
-1. On the Linux node, run this command to start the K3s server and connect it to the external datastore:
-  ```
-  curl -sfL https://get.k3s.io | sh -s - server \
-    --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"
-  ```
-  Note: The datastore endpoint can also be passed in using the environment variable `$K3S_DATASTORE_ENDPOINT`.
-
-1. Repeat the same command on your second K3s server node.
-
-### 2. Confirm that K3s is Running
-
-To confirm that K3s has been set up successfully, run the following command on either of the K3s server nodes:
-```
-sudo k3s kubectl get nodes
-```
-
-Then you should see two nodes with the master role:
-```
-ubuntu@ip-172-31-60-194:~$ sudo k3s kubectl get nodes
-NAME               STATUS   ROLES    AGE    VERSION
-ip-172-31-60-194   Ready    master   44m    v1.17.2+k3s1
-ip-172-31-63-88    Ready    master   6m8s   v1.17.2+k3s1  
-```
-
-Then test the health of the cluster pods:
-```
-sudo k3s kubectl get pods --all-namespaces
-```
-
-**Result:** You have successfully set up a K3s Kubernetes cluster.
-
-### 3. Save and Start Using the kubeconfig File
-
-When you installed K3s on each Rancher server node, a `kubeconfig` file was created on the node at `/etc/rancher/k3s/k3s.yaml`. This file contains credentials for full access to the cluster, and you should save this file in a secure location.
-
-To use this `kubeconfig` file, 
-
-1. Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool.
-2. Copy the file at `/etc/rancher/k3s/k3s.yaml` and save it to the directory `~/.kube/config` on your local machine.
-3. In the kubeconfig file, the `server` directive is defined as localhost. Configure the server as the DNS of your load balancer, referring to port 6443. (The Kubernetes API server will be reached at port 6443, while the Rancher server will be reached at ports 80 and 443.) Here is an example `k3s.yaml`:
-
-```
-apiVersion: v1
-clusters:
-- cluster:
-    certificate-authority-data: [CERTIFICATE-DATA]
-    server: [LOAD-BALANCER-DNS]:6443 # Edit this line
-  name: default
-contexts:
-- context:
-    cluster: default
-    user: default
-  name: default
-current-context: default
-kind: Config
-preferences: {}
-users:
-- name: default
-  user:
-    password: [PASSWORD]
-    username: admin
-```
-
-**Result:** You can now use `kubectl` to manage your K3s cluster. If you have more than one kubeconfig file, you can specify which one you want to use by passing in the path to the file when using `kubectl`:
-
-```
-kubectl --kubeconfig ~/.kube/config/k3s.yaml get pods --all-namespaces
-```
-
-For more information about the `kubeconfig` file, refer to the [K3s documentation]({{<baseurl>}}/k3s/latest/en/cluster-access/) or the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) about organizing cluster access using `kubeconfig` files.
-
-### 4. Check the Health of Your Cluster Pods
-
-Now that you have set up the `kubeconfig` file, you can use `kubectl` to access the cluster from your local machine.
-
-Check that all the required pods and containers are healthy are ready to continue:
-```
-ubuntu@ip-172-31-60-194:~$ sudo kubectl get pods --all-namespaces
-NAMESPACE       NAME                                      READY   STATUS    RESTARTS   AGE
-kube-system     metrics-server-6d684c7b5-bw59k            1/1     Running   0          8d
-kube-system     local-path-provisioner-58fb86bdfd-fmkvd   1/1     Running   0          8d
-kube-system     coredns-d798c9dd-ljjnf                    1/1     Running   0          8d
-```
-
-**Result:** You have confirmed that you can access the cluster with `kubectl` and the K3s cluster is running successfully. Now the Rancher management server can be installed on the cluster.
-{{% /tab %}}
-{{% tab "RKE" %}}
-
 ### Required CLI Tools
 
 Install [kubectl,](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) a Kubernetes command-line tool.
@@ -267,7 +166,5 @@ Save a copy of the following files in a secure location:
 ### Issues or errors?
 
 See the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) page.
-{{% /tab %}}
-{{% /tabs %}}
 
-### [Next: Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/)
+### [Next: Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md
new file mode 100644
index 00000000000..761f01d1c76
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md
@@ -0,0 +1,7 @@
+---
+title: Setting up a High-availability RKE2 Kubernetes Cluster
+shortTitle: Set up RKE2 Kubernetes
+weight: 4
+---
+
+> This page is under construction
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/how-ha-works/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/how-ha-works/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/installation/how-ha-works/_index.md
rename to content/rancher/v2.x/en/installation/resources/k8s-tutorials/how-ha-works/_index.md
index 0eeb43cfc3b..9aaf3bb236d 100644
--- a/content/rancher/v2.x/en/installation/how-ha-works/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/how-ha-works/_index.md
@@ -1,6 +1,6 @@
 ---
 title: About High-availability Installations
-weight: 2
+weight: 1
 ---
 
 We recommend using [Helm,]({{<baseurl>}}/rancher/v2.x/en/overview/architecture/concepts/#about-helm) a Kubernetes package manager, to install Rancher on a dedicated Kubernetes cluster. This is called a high-availability Kubernetes installation because increased availability is achieved by running Rancher on multiple nodes.
diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
new file mode 100644
index 00000000000..c24bffb45ad
--- /dev/null
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/_index.md
@@ -0,0 +1,15 @@
+---
+title: Don't have infrastructure for your Kubernetes cluster? Try one of these tutorials.
+shortTitle: Infrastructure Tutorials
+weight: 5
+---
+
+The K3s documentation has:
+
+- Instructions for [setting up infrastructure for a high-availability K3s Kubernetes cluster with an external DB]({{<baseurl>}}/k3s/latest/en/installation/tutorials/ha-with-external-db)
+- Instructions for [setting up a high-availability K3s Kubernetes cluster with an external DB for a Rancher server]({{<baseurl>}}/k3s/latest/en/installation/tutorials/ha-with-external-db)
+
+The RKE documentation has:
+
+- Instructions for [setting up infrastructure for a high-availability RKE Kubernetes cluster]({{<baseurl>}}/)
+- Instructions for [setting up a high-availability RKE cluster]()
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/ec2-node/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/installation/options/ec2-node/_index.md
rename to content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
index 0df051accda..ecf063ca94e 100644
--- a/content/rancher/v2.x/en/installation/options/ec2-node/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/ec2-node/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Setting up Nodes in Amazon EC2
-weight: 280
+weight: 3
 ---
 
 In this tutorial, you will learn one way to set up Linux nodes for the Rancher management server. These nodes will fulfill the node requirements for [OS, Docker, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
@@ -14,7 +14,7 @@ If the Rancher server is installed in a single Docker container, you only need o
 ### 1. Optional Preparation
 
 - **Create IAM role:** To allow Rancher to manipulate AWS resources, such as provisioning new storage or new nodes, you will need to configure Amazon as a cloud provider. There are several things you'll need to do to set up the cloud provider on EC2, but part of this process is setting up an IAM role for the Rancher server nodes. For the full details on setting up the cloud provider, refer to this [page.]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers/)
-- **Create security group:** We also recommend setting up a security group for the Rancher nodes that complies with the [port requirements for Rancher nodes.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/#port-requirements) The exact requirements will differ depending on whether Kubernetes is installed with RKE or K3s.
+- **Create security group:** We also recommend setting up a security group for the Rancher nodes that complies with the [port requirements for Rancher nodes.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/#port-requirements)
 
 ### 2. Provision Instances
 
diff --git a/content/rancher/v2.x/en/installation/options/nginx/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/installation/options/nginx/_index.md
rename to content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
index 02beb3f87ae..fde4297dfae 100644
--- a/content/rancher/v2.x/en/installation/options/nginx/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nginx/_index.md
@@ -1,9 +1,6 @@
 ---
 title: Setting up an NGINX Load Balancer
-weight: 270
-aliases:
-  - /rancher/v2.x/en/installation/ha/create-nodes-lb/nginx
-  - /rancher/v2.x/en/installation/k8s-install/create-nodes-lb/nginx
+weight: 4
 ---
 
 NGINX will be configured as Layer 4 load balancer (TCP) that forwards connections to one of your Rancher nodes.
diff --git a/content/rancher/v2.x/en/installation/options/nlb/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/installation/options/nlb/_index.md
rename to content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
index cf863775ba5..93dabfc5113 100644
--- a/content/rancher/v2.x/en/installation/options/nlb/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/nlb/_index.md
@@ -1,9 +1,6 @@
 ---
 title: Setting up Amazon ELB Network Load Balancer
-weight: 277
-aliases:
-  - /rancher/v2.x/en/installation/ha/create-nodes-lb/nlb
-  - /rancher/v2.x/en/installation/k8s-install/create-nodes-lb/nlb
+weight: 5
 ---
 
 This how-to guide describes how to set up a Network Load Balancer (NLB) in Amazon's EC2 service that will direct traffic to multiple instances on EC2.
diff --git a/content/rancher/v2.x/en/installation/options/rds/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/installation/options/rds/_index.md
rename to content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
index 41d7b8eb501..f40b9f96b59 100644
--- a/content/rancher/v2.x/en/installation/options/rds/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/infrastructure-tutorials/rds/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Setting up a MySQL Database in Amazon RDS
-weight: 290
+weight: 4
 ---
 This tutorial describes how to set up a MySQL database in Amazon's RDS.
 
diff --git a/content/rancher/v2.x/en/dashboard/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
similarity index 64%
rename from content/rancher/v2.x/en/dashboard/istio/_index.md
rename to content/rancher/v2.x/en/istio/_index.md
index fb765119eb0..40027d58254 100644
--- a/content/rancher/v2.x/en/dashboard/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -1,4 +1,4 @@
 ---
 title: Istio
-weight: 4
+weight: 13
 ---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/legacy/_index.md b/content/rancher/v2.x/en/istio/legacy/_index.md
new file mode 100644
index 00000000000..48f7fba4552
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/legacy/_index.md
@@ -0,0 +1,4 @@
+---
+title: Legacy UI Documentation
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/_index.md b/content/rancher/v2.x/en/istio/legacy/cluster-istio/_index.md
similarity index 93%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/_index.md
rename to content/rancher/v2.x/en/istio/legacy/cluster-istio/_index.md
index 71313bc816f..53443e7af30 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/cluster-istio/_index.md
@@ -2,12 +2,14 @@
 title: Istio
 weight: 5
 aliases:
-    - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/_index.md
-    - /rancher/v2.x/en/cluster-admin/tools/istio/_index.md
-    - /rancher/v2.x/en/project-admin/istio/index.md
+    - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/
+    - /rancher/v2.x/en/cluster-admin/tools/istio/
+    - /rancher/v2.x/en/project-admin/istio
 ---
 _Available as of v2.3.0_
 
+> In Rancher 2.5, the Istio application was improved. There are now two ways to enable Istio. The older way is documented in this section, and the new application for Istio is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/istio)
+
  [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
 
  As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
@@ -32,6 +34,9 @@ Rancher's Istio integration comes with comprehensive visualization aids:
 - **Gain insights from time series analytics with Grafana dashboards.** [Grafana](https://grafana.com/) is an analytics platform that allows you to query, visualize, alert on and understand the data gathered by Prometheus.
 - **Write custom queries for time series data with the Prometheus UI.** [Prometheus](https://prometheus.io/) is a systems monitoring and alerting toolkit. Prometheus scrapes data from your cluster, which is then used by Grafana. A Prometheus UI is also integrated into Rancher, and lets you write custom queries for time series data and see the results in the UI.
 
+
+Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project.
+
 # Prerequisites
 
 Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio/_index.md b/content/rancher/v2.x/en/istio/legacy/disabling-istio/_index.md
similarity index 94%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio/_index.md
rename to content/rancher/v2.x/en/istio/legacy/disabling-istio/_index.md
index d2035689626..46821dc798c 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/disabling-istio/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Disabling Istio
 weight: 4
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio
 ---
 
 This section describes how to disable Istio in a cluster, namespace, or workload.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/rbac/_index.md b/content/rancher/v2.x/en/istio/legacy/rbac/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/rbac/_index.md
rename to content/rancher/v2.x/en/istio/legacy/rbac/_index.md
index eb6f3c20fa7..4f11c00f6d9 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/rbac/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/rbac/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Role-based Access Control
 weight: 3
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/rbac
 ---
 
 This section describes the permissions required to access Istio features and how to configure access to the Kiali and Jaeger visualizations.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md b/content/rancher/v2.x/en/istio/legacy/release-notes/_index.md
similarity index 93%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md
rename to content/rancher/v2.x/en/istio/legacy/release-notes/_index.md
index 9b819eb4500..af54839bc48 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/release-notes/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/release-notes/_index.md
@@ -1,5 +1,7 @@
 ---
 title: Release Notes
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/release-notes
 ---
 
 
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/resources/_index.md b/content/rancher/v2.x/en/istio/legacy/resources/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/resources/_index.md
rename to content/rancher/v2.x/en/istio/legacy/resources/_index.md
index 9b0dea50923..8a6dafeb684 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/resources/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/resources/_index.md
@@ -2,8 +2,9 @@
 title: CPU and Memory Allocations
 weight: 1
 aliases:
-    - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/_index.md
-    - /rancher/v2.x/en/project-admin/istio/config/_index.md
+  - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/
+  - /rancher/v2.x/en/project-admin/istio/config/
+  - /rancher/v2.x/en/cluster-admin/tools/istio/resources
 ---
 _Available as of v2.3.0_
 
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/_index.md
index da1fbcacc7a..ab842cf4f30 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Setup Guide
 weight: 2
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup
 ---
 
 This section describes how to enable Istio and start using it in your projects.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/deploy-workloads/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/deploy-workloads/_index.md
index 8e52d678bbf..e1338e861bf 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/deploy-workloads/_index.md
@@ -1,6 +1,8 @@
 ---
 title: 4. Add Deployments and Services with the Istio Sidecar
 weight: 4
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads
 ---
 
 > **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have Istio enabled.  
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
index a98090a28ca..a17cc358d30 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/_index.md
@@ -1,6 +1,8 @@
 ---
 title: 1. Enable Istio in the Cluster
 weight: 1
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster
 ---
 
 This cluster uses the default Nginx controller to allow traffic into the cluster.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
index f31369cfc61..5a6cc65b8c7 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-cluster/enable-istio-with-psp/_index.md
@@ -1,5 +1,7 @@
 ---
 title: Enable Istio with Pod Security Policies
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp
 ---
 
  >**Note:** The following guide is only for RKE provisioned clusters.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
similarity index 96%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
index 2f1f6d74786..24c594e80eb 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/enable-istio-in-namespace/_index.md
@@ -1,6 +1,8 @@
 ---
 title: 2. Enable Istio in a Namespace
 weight: 2
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace
 ---
 
 You will need to manually enable Istio in each namespace that you want to be tracked or controlled by Istio. When Istio is enabled in a namespace, the Envoy sidecar proxy will be automatically injected into all new workloads that are deployed in the namespace.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/gateway/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/gateway/_index.md
index 47c9ff33812..60f8780fd65 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/gateway/_index.md
@@ -1,6 +1,8 @@
 ---
 title: 5. Set up the Istio Gateway
 weight: 5
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway
 ---
 
 The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. 
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/node-selectors/_index.md
similarity index 96%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/node-selectors/_index.md
index 994656361e3..f226580b0de 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/node-selectors/_index.md
@@ -1,6 +1,8 @@
 ---
 title: 3. Select the Nodes Where Istio Components Will be Deployed
 weight: 3
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors
 ---
 
 > **Prerequisite:** Your cluster needs a worker node that can designated for Istio. The worker node should meet the [resource requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources)
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/set-up-traffic-management/_index.md
similarity index 96%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/set-up-traffic-management/_index.md
index 2048e779265..b9d44ea7193 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/set-up-traffic-management/_index.md
@@ -1,6 +1,8 @@
 ---
 title: 6. Set up Istio's Components for Traffic Management
 weight: 6
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management
 ---
 
 A central advantage of traffic management in Istio is that it allows dynamic request routing. Some common applications for dynamic request routing include canary deployments and blue/green deployments. The two key resources in Istio traffic management are *virtual services* and *destination rules*.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic/_index.md b/content/rancher/v2.x/en/istio/legacy/setup/view-traffic/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic/_index.md
rename to content/rancher/v2.x/en/istio/legacy/setup/view-traffic/_index.md
index bb6c979e28d..e456dd14b81 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/setup/view-traffic/_index.md
@@ -1,6 +1,8 @@
 ---
 title: 7. Generate and View Traffic
 weight: 7
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic
 ---
 
 This section describes how to view the traffic that is being managed by Istio.
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/_index.md
index 71830fc1f00..8f4be343681 100644
--- a/content/rancher/v2.x/en/k8s-in-rancher/_index.md
+++ b/content/rancher/v2.x/en/k8s-in-rancher/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Kubernetes Resources, Registries and Pipelines
-weight: 3000
+weight: 19
 aliases:
   - /rancher/v2.x/en/concepts/
   - /rancher/v2.x/en/tasks/
diff --git a/content/rancher/v2.x/en/dashboard/logging/_index.md b/content/rancher/v2.x/en/logging/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/dashboard/logging/_index.md
rename to content/rancher/v2.x/en/logging/_index.md
index cdd2711b5e6..0a3ac907e5d 100644
--- a/content/rancher/v2.x/en/dashboard/logging/_index.md
+++ b/content/rancher/v2.x/en/logging/_index.md
@@ -3,7 +3,7 @@ title: Rancher Integration with Logging Services
 shortTitle: Logging
 description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster.
 metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
-weight: 3
+weight: 11
 ---
 
 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
diff --git a/content/rancher/v2.x/en/logging/legacy/_index.md b/content/rancher/v2.x/en/logging/legacy/_index.md
new file mode 100644
index 00000000000..48f7fba4552
--- /dev/null
+++ b/content/rancher/v2.x/en/logging/legacy/_index.md
@@ -0,0 +1,4 @@
+---
+title: Legacy UI Documentation
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md b/content/rancher/v2.x/en/logging/legacy/cluster-logging/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md
rename to content/rancher/v2.x/en/logging/legacy/cluster-logging/_index.md
index 07c80a651cf..2fae22bbe8b 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/logging/_index.md
+++ b/content/rancher/v2.x/en/logging/legacy/cluster-logging/_index.md
@@ -1,12 +1,15 @@
 ---
-title: Rancher Integration with Logging Services
+title: Cluster Logging
 description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster.
 metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
 weight: 3
 aliases:
   - /rancher/v2.x/en/tasks/logging/
+  - /rancher/v2.x/en/cluster-admin/tools/logging
 ---
 
+> In Rancher 2.5, the logging application was improved. There are now two ways to enable logging. The older way is documented in this section, and the new application for logging is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/logging)
+
 Logging is helpful because it allows you to:
 
 - Capture and analyze the state of your cluster
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/_index.md b/content/rancher/v2.x/en/logging/legacy/cluster-logging/elasticsearch/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/_index.md
rename to content/rancher/v2.x/en/logging/legacy/cluster-logging/elasticsearch/_index.md
index 1b50e42bad0..a27b5674187 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch/_index.md
+++ b/content/rancher/v2.x/en/logging/legacy/cluster-logging/elasticsearch/_index.md
@@ -3,6 +3,7 @@ title: Elasticsearch
 weight: 200
 aliases:
   - /rancher/v2.x/en/tools/logging/elasticsearch/
+  - /rancher/v2.x/en/cluster-admin/tools/logging/elasticsearch
 ---
 
 If your organization uses [Elasticsearch](https://www.elastic.co/), either on premise or in the cloud, you can configure Rancher to send it Kubernetes logs. Afterwards, you can log into your Elasticsearch deployment to view logs.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/_index.md b/content/rancher/v2.x/en/logging/legacy/cluster-logging/fluentd/_index.md
similarity index 96%
rename from content/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/_index.md
rename to content/rancher/v2.x/en/logging/legacy/cluster-logging/fluentd/_index.md
index 42f54794862..111cb33e007 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/logging/fluentd/_index.md
+++ b/content/rancher/v2.x/en/logging/legacy/cluster-logging/fluentd/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Fluentd
 weight: 600
+aliases:
+    - /rancher/v2.x/en/cluster-admin/tools/logging/fluentd
 ---
 
 If your organization uses [Fluentd](https://www.fluentd.org/), you can configure Rancher to send it Kubernetes logs.  Afterwards, you can log into your Fluentd server to view logs.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/logging/kafka/_index.md b/content/rancher/v2.x/en/logging/legacy/cluster-logging/kafka/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/cluster-admin/tools/logging/kafka/_index.md
rename to content/rancher/v2.x/en/logging/legacy/cluster-logging/kafka/_index.md
index bb2b5ac2344..06ef0b12b2b 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/logging/kafka/_index.md
+++ b/content/rancher/v2.x/en/logging/legacy/cluster-logging/kafka/_index.md
@@ -3,6 +3,7 @@ title: Kafka
 weight: 400
 aliases:
   - /rancher/v2.x/en/tools/logging/kafka/
+  - /rancher/v2.x/en/cluster-admin/tools/logging/kafka
 ---
 
 If your organization uses [Kafka](https://kafka.apache.org/), you can configure Rancher to send it Kubernetes logs.  Afterwards, you can log into your Kafka server to view logs.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/logging/splunk/_index.md b/content/rancher/v2.x/en/logging/legacy/cluster-logging/splunk/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/cluster-admin/tools/logging/splunk/_index.md
rename to content/rancher/v2.x/en/logging/legacy/cluster-logging/splunk/_index.md
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/logging/syslog/_index.md b/content/rancher/v2.x/en/logging/legacy/cluster-logging/syslog/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/cluster-admin/tools/logging/syslog/_index.md
rename to content/rancher/v2.x/en/logging/legacy/cluster-logging/syslog/_index.md
diff --git a/content/rancher/v2.x/en/project-admin/tools/logging/_index.md b/content/rancher/v2.x/en/logging/legacy/project-logging/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/project-admin/tools/logging/_index.md
rename to content/rancher/v2.x/en/logging/legacy/project-logging/_index.md
index 8c60ddf64eb..6099cbdd09f 100644
--- a/content/rancher/v2.x/en/project-admin/tools/logging/_index.md
+++ b/content/rancher/v2.x/en/logging/legacy/project-logging/_index.md
@@ -1,6 +1,8 @@
 ---
-title: Logging
+title: Project Logging
 weight: 2527
+aliases:
+  - /rancher/v2.x/en/project-admin/tools/logging
 ---
 
 Rancher can integrate with a variety of popular logging services and tools that exist outside of your Kubernetes clusters.
diff --git a/content/rancher/v2.x/en/dashboard/monitoring-alerting/_index.md b/content/rancher/v2.x/en/monitoring-alerting/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/dashboard/monitoring-alerting/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/_index.md
index dce5a8af638..9bb7663b38e 100644
--- a/content/rancher/v2.x/en/dashboard/monitoring-alerting/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/_index.md
@@ -1,8 +1,8 @@
 ---
-title: Integrating Rancher and Prometheus for Cluster Monitoring
+title: Monitoring and Alerting
 shortTitle: Monitoring/Alerting
 description: Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Learn about the scope of monitoring and how to enable cluster monitoring
-weight: 2
+weight: 12
 ---
 
 Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
new file mode 100644
index 00000000000..48f7fba4552
--- /dev/null
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
@@ -0,0 +1,4 @@
+---
+title: Legacy UI Documentation
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/alerts/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/cluster-admin/tools/alerts/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/_index.md
index 1b0b9685295..98bdc97bdfb 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/alerts/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/_index.md
@@ -1,8 +1,13 @@
 ---
-title: Alerts
+title: Cluster Alerts
 weight: 2
+aliases:
+  - rancher/v2.x/en/cluster-admin/tools/alerts
 ---
 
+
+> In Rancher 2.5, the monitoring application was improved. There are now two ways to enable monitoring and alerting. The older way is documented in this section, and the new application for monitoring and alerting is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/monitoring-alerting)
+
 To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. When an event occurs, your alert is triggered, and you are sent a notification. You can then, if necessary, follow up with corrective actions.
 
 Notifiers and alerts are built on top of the [Prometheus Alertmanager](https://prometheus.io/docs/alerting/alertmanager/). Leveraging these tools, Rancher can notify [cluster owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles) and [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) of events they need to address.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/default-alerts/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/default-alerts/_index.md
index ea7f91ff0e0..81feba5aeb0 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/cluster-alerts/default-alerts/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Default Alerts for Cluster Monitoring
 weight: 1
+aliases:
+  - rancher/v2.x/en/cluster-admin/tools/alerts/default-alerts
 ---
 
 When you create a cluster, some alert rules are predefined. These alerts notify you about signs that the cluster could be unhealthy. You can receive these alerts if you configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers) for them.
diff --git a/content/rancher/v2.x/en/project-admin/tools/alerts/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/project-alerts/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/project-admin/tools/alerts/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/project-alerts/_index.md
index 786722a3827..a9386817c72 100644
--- a/content/rancher/v2.x/en/project-admin/tools/alerts/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/alerts/project-alerts/_index.md
@@ -1,6 +1,8 @@
 ---
-title:  Alerts
+title:  Project Alerts
 weight: 2526
+aliases:
+  - rancher/v2.x/en/project-admin/tools/alerts
 ---
 
 To keep your clusters and applications healthy and driving your organizational productivity forward, you need to stay informed of events occurring in your clusters and projects, both planned and unplanned. When an event occurs, your alert is triggered, and you are sent a notification. You can then, if necessary, follow up with corrective actions.
diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md
new file mode 100644
index 00000000000..1cb62c544bf
--- /dev/null
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/_index.md
@@ -0,0 +1,4 @@
+---
+title: Monitoring
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/_index.md
index 7620e43b643..b52ec1fe810 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/_index.md
@@ -1,11 +1,16 @@
 ---
 title: Integrating Rancher and Prometheus for Cluster Monitoring
+shortTitle: Cluster Monitoring
 description: Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Learn about the scope of monitoring and how to enable cluster monitoring
 weight: 4
+aliases:
+  - rancher/v2.x/en/project-admin/tools/monitoring
 ---
 
 _Available as of v2.2.0_
 
+> In Rancher 2.5, the monitoring application was improved. There are now two ways to enable monitoring and alerting. The older way is documented in this section, and the new application for monitoring and alerting is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/monitoring-alerting)
+
 Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
 
 This section covers the following topics:
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/cluster-metrics/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/cluster-metrics/_index.md
index 61c20f040c0..1f117ec5f65 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/cluster-metrics/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/cluster-metrics/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Cluster Metrics
 weight: 3
+aliases:
+  - rancher/v2.x/en/project-admin/tools/monitoring/cluster-metrics
 ---
 
 _Available as of v2.2.0_
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/custom-metrics/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/custom-metrics/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/cluster-admin/tools/monitoring/custom-metrics/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/custom-metrics/_index.md
index a78b62ee206..4ae3893e895 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/custom-metrics/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/custom-metrics/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Prometheus Custom Metrics Adapter
 weight: 5
+aliases:
+  - rancher/v2.x/en/project-admin/tools/monitoring/custom-metrics
 ---
 
 After you've enabled [cluster level monitoring]({{< baseurl >}}/rancher/v2.x/en/cluster-admin/tools/monitoring/#enabling-cluster-monitoring), You can view the metrics data from Rancher. You can also deploy the Prometheus custom metrics adapter then you can use the HPA with metrics stored in cluster monitoring.
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/expression/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/expression/_index.md
index 9f5170c9779..ad6981f3a66 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/expression/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/expression/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Prometheus Expressions
 weight: 4
+aliases:
+  - rancher/v2.x/en/project-admin/tools/monitoring/expression
 ---
 
 The PromQL expressions in this doc can be used to configure [alerts.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/prometheus/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/prometheus/_index.md
index 6fd878ec3ff..c360aa64b1f 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/prometheus/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/prometheus/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Prometheus Configuration
 weight: 1
+aliases:
+  - rancher/v2.x/en/project-admin/tools/monitoring/prometheus
 ---
 
 _Available as of v2.2.0_
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/viewing-metrics/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/viewing-metrics/_index.md
index a1dd3946219..af4c34d5fbd 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/monitoring/viewing-metrics/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/cluster-monitoring/viewing-metrics/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Viewing Metrics
 weight: 2
+aliases:
+  - rancher/v2.x/en/project-admin/tools/monitoring/viewing-metrics
 ---
 
 _Available as of v2.2.0_
diff --git a/content/rancher/v2.x/en/project-admin/tools/monitoring/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/project-monitoring/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/project-admin/tools/monitoring/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/project-monitoring/_index.md
index 80f8c7e5474..770fdbbc59e 100644
--- a/content/rancher/v2.x/en/project-admin/tools/monitoring/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/monitoring/project-monitoring/_index.md
@@ -1,6 +1,8 @@
 ---
-title: Monitoring
+title: Project Monitoring
 weight: 2528
+aliases:
+  - rancher/v2.x/en/project-admin/tools/monitoring
 ---
 
 _Available as of v2.2.4_
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/notifiers/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/notifiers/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/cluster-admin/tools/notifiers/_index.md
rename to content/rancher/v2.x/en/monitoring-alerting/legacy/notifiers/_index.md
index c5860f0c33e..42c4073f85f 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/notifiers/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/notifiers/_index.md
@@ -1,8 +1,12 @@
 ---
 title: Notifiers
 weight: 1
+aliases:
+  - rancher/v2.x/en/project-admin/tools/notifiers
 ---
 
+> In Rancher 2.5, the notifier application was improved. There are now two ways to enable notifiers. The older way is documented in this section, and the new application for notifiers is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/notifiers)
+
 Notifiers are services that inform you of alert events. You can configure notifiers to send alert notifications to staff best suited to take corrective action.
 
 Rancher integrates with a variety of popular IT services, including:
diff --git a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
rename to content/rancher/v2.x/en/opa-gatekeper/_index.md
index dceb610f935..3c6093525db 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md
@@ -1,11 +1,14 @@
 ---
 title: OPA Gatekeeper
-weight: 1
+weight: 14
 aliases:
  - /rancher/v2.x/en/cluster-admin/tools/opa-gatekeeper
+ 
 ---
 _Available as of v2.4.0_
 
+> In Rancher 2.5, the OPA Gatekeeper application was improved. There are now two ways to enable OPA Gatekeeper. The older way is documented in this section, and the new application for OPA Gatekeeper is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/monitoring-alerting)
+
 > This is an experimental feature for the Rancher v2.4 release.
 
 To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. 
diff --git a/content/rancher/v2.x/en/project-admin/_index.md b/content/rancher/v2.x/en/project-admin/_index.md
index 508e627147d..ade4e5ac6e8 100644
--- a/content/rancher/v2.x/en/project-admin/_index.md
+++ b/content/rancher/v2.x/en/project-admin/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Project Administration
-weight: 2500
+weight: 9
 aliases:
   - /rancher/v2.x/en/project-admin/editing-projects/
 ---
diff --git a/content/rancher/v2.x/en/project-admin/istio/_index.md b/content/rancher/v2.x/en/project-admin/istio/_index.md
deleted file mode 100644
index 82ef83353cf..00000000000
--- a/content/rancher/v2.x/en/project-admin/istio/_index.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-title: Istio
-weight: 3528
----
-
-_Available as of v2.3.0_
-
-Using Rancher, you can connect, secure, control, and observe services through integration with [Istio](https://istio.io/), a leading open-source service mesh solution. Istio provides behavioral insights and operational control over the service mesh as a whole, offering a complete solution to satisfy the diverse requirements of microservice applications.
-
-This service mesh provides features that include but are not limited to the following:
-
-- Traffic management features
-- Enhanced monitoring and tracing
-- Service discovery and routing
-- Secure connections and service-to-service authentication with mutual TLS
-- Load balancing
-- Automatic retries, backoff, and circuit breaking
-
-Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project for [comprehensive data visualizations,]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/#accessing-visualizations) traffic management, or any of its other features.
-
-For information on how Istio is integrated with Rancher and how to set it up, refer to the [section about Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio)
diff --git a/content/rancher/v2.x/en/quick-start-guide/_index.md b/content/rancher/v2.x/en/quick-start-guide/_index.md
index be103b469ef..1aae6c15c02 100644
--- a/content/rancher/v2.x/en/quick-start-guide/_index.md
+++ b/content/rancher/v2.x/en/quick-start-guide/_index.md
@@ -2,7 +2,7 @@
 title: Rancher Deployment Quick Start Guides
 metaDescription: Use this section to jump start your Rancher deployment and testing. It contains instructions for a simple Rancher setup and some common use cases.
 short title: Use this section to jump start your Rancher deployment and testing. It contains instructions for a simple Rancher setup and some common use cases. 
-weight: 25
+weight: 2
 ---
 >**Note:** The intent of these guides is to quickly launch a sandbox that you can use to evaluate Rancher. These guides are not intended for production environments. For comprehensive setup instructions, see [Installation]({{<baseurl>}}/rancher/v2.x/en/installation/).
 
diff --git a/content/rancher/v2.x/en/security/_index.md b/content/rancher/v2.x/en/security/_index.md
index d0b2dd70089..820912ebf30 100644
--- a/content/rancher/v2.x/en/security/_index.md
+++ b/content/rancher/v2.x/en/security/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Security
-weight: 7505
+weight: 16
 ---
 
 <table width="100%">
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/_index.md
new file mode 100644
index 00000000000..84810ef66ba
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/_index.md
@@ -0,0 +1,8 @@
+---
+title: Rancher v2.5
+weight: 1
+---
+
+> This section is under construction.
+
+This section contains the hardening and self-assessment guides for Rancher v2.5. Separate guides are available for RancherD Kubernetes clusters, RKE Kubernetes clusters, and K3s Kubernetes clusters.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md
new file mode 100644
index 00000000000..470c4e4c880
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md
@@ -0,0 +1,4 @@
+---
+title: K3s
+weight: 3
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/k3s/benchmark-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/k3s/benchmark-2.5/_index.md
new file mode 100644
index 00000000000..4631d4c984f
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/k3s/benchmark-2.5/_index.md
@@ -0,0 +1,4 @@
+---
+title: Self Assessment Guide
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/k3s/hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/k3s/hardening-2.5/_index.md
new file mode 100644
index 00000000000..cfb41e6e16a
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/k3s/hardening-2.5/_index.md
@@ -0,0 +1,4 @@
+---
+title: Hardening Guide
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md
new file mode 100644
index 00000000000..8c8c7247e3e
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md
@@ -0,0 +1,4 @@
+---
+title: RancherD
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md
new file mode 100644
index 00000000000..4631d4c984f
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md
@@ -0,0 +1,4 @@
+---
+title: Self Assessment Guide
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md
new file mode 100644
index 00000000000..cfb41e6e16a
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md
@@ -0,0 +1,4 @@
+---
+title: Hardening Guide
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md
new file mode 100644
index 00000000000..d7b8737d2c6
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md
@@ -0,0 +1,4 @@
+---
+title: RKE
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md
new file mode 100644
index 00000000000..4631d4c984f
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md
@@ -0,0 +1,4 @@
+---
+title: Self Assessment Guide
+weight: 2
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md
new file mode 100644
index 00000000000..cfb41e6e16a
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md
@@ -0,0 +1,4 @@
+---
+title: Hardening Guide
+weight: 1
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/security-scan/_index.md b/content/rancher/v2.x/en/security/security-scan/_index.md
index 3782ebb6a3e..ddfc7763543 100644
--- a/content/rancher/v2.x/en/security/security-scan/_index.md
+++ b/content/rancher/v2.x/en/security/security-scan/_index.md
@@ -3,254 +3,4 @@ title: Security Scans
 weight: 1
 ---
 
-_Available as of v2.4.0_
-
-Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
-
-The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
-
-CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
-
-The Benchmark provides recommendations of two types: Scored and Not Scored. We run tests related to only Scored recommendations.
-
-- [About the CIS Benchmark](#about-the-cis-benchmark)
-- [About the generated report](#about-the-generated-report)
-- [Test profiles](#test-profiles)
-- [Skipped and not applicable tests](#skipped-and-not-applicable-tests)
-  - [CIS Benchmark v1.4 skipped tests](#cis-benchmark-v1-4-skipped-tests)
-  - [CIS Benchmark v1.4 not applicable tests](#cis-benchmark-v1-4-not-applicable-tests)
-- [Prerequisites](#prerequisites)
-- [Running a scan](#running-a-scan)
-- [Scheduling recurring scans](#scheduling-recurring-scans)
-- [Skipping tests](#skipping-tests)
-- [Setting alerts](#setting-alerts)
-- [Deleting a report](#deleting-a-report)
-- [Downloading a report](#downloading-a-report)
-
-# About the CIS Benchmark
-
-The Center for Internet Security is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
-
-CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
-
-The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is [here.](https://learn.cisecurity.org/benchmarks)
-
-To check clusters for CIS Kubernetes Benchmark compliance, the security scan leverages [kube-bench,](https://github.com/aquasecurity/kube-bench) an open-source tool from Aqua Security.
-
-# About the Generated Report
-
-Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format.
-
-As of Rancher v2.4, the scan will use the CIS Benchmark v1.4. The Benchmark version is included in the generated report.
-
-The Benchmark provides recommendations of two types: Scored and Not Scored. Recommendations marked as Not Scored in the Benchmark are not included in the generated report.
-
-Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's [self-assessment guide for the corresponding Kubernetes version.]({{<baseurl>}}/rancher/v2.x/en/security/#the-cis-benchmark-and-self-assessment)
-
-The report contains the following information:
-
-| Column in Report | Description |
-|------------------|-------------|
-| ID               | The ID number of the CIS Benchmark. |
-| Description      | The description of the CIS Benchmark test. |
-| Remediation      | What needs to be fixed in order to pass the test. |
-| State of Test    | Indicates if the test passed, failed, was skipped, or was not applicable. |
-| Node type        | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. |
-| Nodes            | The name(s) of the node that the test was run on. |
-| Passed_Nodes | The name(s) of the nodes that the test passed on. |
-| Failed_Nodes | The name(s) of the nodes that the test failed on. |
-
-Refer to [the table in the cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
-
-# Test Profiles
-
-For every CIS benchmark version, Rancher ships with two types of profiles. These profiles are named based on the type of cluster (e.g. `RKE`), the CIS benchmark version (e.g. CIS 1.4) and the profile type (e.g. `Permissive` or `Hardened`). For example, a full profile name would be `RKE-CIS-1.4-Permissive`
-
-All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes.
-
-There are 2 types of profiles:
-
-- **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests.
-- **Hardened:** This profile will not skip any tests, except for the non-applicable tests.
-
-In order to pass the "Hardened" profile, you will need to follow the steps on the [hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
-
-# Skipped and Not Applicable Tests
-
-### CIS Benchmark v1.4 Skipped Tests
-
-Number | Description | Reason for Skipping
----|---|---
-1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
-1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
-1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
-1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
-1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
-1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
-1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
-2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
-
-### CIS Benchmark v1.4 Not Applicable Tests
-
-Number | Description | Reason for being not applicable
----|---|---
-1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
-1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
-2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
-2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
-
-
-# Prerequisites
-
-To run security scans on a cluster and access the generated reports, you must be an [Administrator]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/) or [Cluster Owner.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/)
-
-Rancher can only run security scans on clusters that were created with RKE, which includes custom clusters and clusters that Rancher created in an infrastructure provider such as Amazon EC2 or GCE. Imported clusters and clusters in hosted Kubernetes providers can't be scanned by Rancher.
-
-The security scan cannot run in a cluster that has Windows nodes.
-
-You will only be able to see the CIS scan reports for clusters that you have access to.
-
-# Running a Scan
-
-1. From the cluster view in Rancher, click **Tools > CIS Scans.**
-1. Click **Run Scan.**
-1. Choose a CIS scan profile.
-
-**Result:** A report is generated and displayed in the **CIS Scans** page. To see details of the report, click the report's name.
-
-# Scheduling Recurring Scans
-
-Recurring scans can be scheduled to run on any RKE Kubernetes cluster.
-
-To enable recurring scans, edit the advanced options in the cluster configuration during cluster creation or after the cluster has been created.
-
-To schedule scans for an existing cluster:
-
-1. Go to the cluster view in Rancher.
-1. Click **Tools > CIS Scans.**
-1. Click **Add Schedule.** This takes you to the section of the cluster editing page that is applicable to configuring a schedule for CIS scans. (This section can also be reached by going to the cluster view, clicking **&#8942; > Edit,** and going to the **Advanced Options.**)
-1. In the **CIS Scan Enabled** field, click **Yes.**
-1. In the **CIS Scan Profile** field, choose a **Permissive** or **Hardened** profile. The corresponding CIS Benchmark version is included in the profile name. Note: Any skipped tests [defined in a separate ConfigMap](#skipping-tests) will be skipped regardless of whether a **Permissive** or **Hardened** profile is selected. When selecting the the permissive profile, you should see which tests were skipped by Rancher (tests that are skipped by default for RKE clusters) and which tests were skipped by a Rancher user. In the hardened test profile, the only skipped tests will be skipped by users.
-1. In the **CIS Scan Interval (cron)** job, enter a [cron expression](https://en.wikipedia.org/wiki/Cron#CRON_expression) to define how often the cluster will be scanned.
-1. In the **CIS Scan Report Retention** field, enter the number of past reports that should be kept.
-
-**Result:** The security scan will run and generate reports at the scheduled intervals.
-
-The test schedule can be configured in the `cluster.yml`:
-
-```yaml
-scheduled_cluster_scan:
-    enabled: true
-    scan_config:
-        cis_scan_config:
-            override_benchmark_version: rke-cis-1.4
-            profile: permissive
-    schedule_config:
-        cron_schedule: 0 0 * * *
-        retention: 24
-```
-
-
-# Skipping Tests
-
-You can define a set of tests that will be skipped by the CIS scan when the next report is generated.
-
-These tests will be skipped for subsequent CIS scans, including both manually triggered and scheduled scans, and the tests will be skipped with any profile.
-
-The skipped tests will be listed alongside the test profile name in the cluster configuration options when a test profile is selected for a recurring cluster scan. The skipped tests will also be shown every time a scan is triggered manually from the Rancher UI by clicking **Run Scan.** The display of skipped tests allows you to know ahead of time which tests will be run in each scan.
-
-To skip tests, you will need to define them in a Kubernetes ConfigMap resource. Each skipped CIS scan test is listed in the ConfigMap alongside the version of the CIS benchmark that the test belongs to.
-
-To skip tests by editing a ConfigMap resource,
-
-1. Create a `security-scan` namespace.
-1. Create a ConfigMap named `security-scan-cfg`.
-1. Enter the skip information under the key `config.json` in the following format:
-
-    ```json
-    {
-      "skip": {
-        "rke-cis-1.4": [ 
-          "1.1.1", 
-          "1.2.2"
-        ]
-      }
-    }
-    ```
-    
-    In the example above, the CIS benchmark version is specified alongside the tests to be skipped for that version.
-
-**Result:** These tests will be skipped on subsequent scans that use the defined CIS Benchmark version.
-
-# Setting Alerts
-
-Rancher provides a set of alerts for cluster scans. which are not configured to have notifiers by default:
-
-- A manual cluster scan was completed
-- A manual cluster scan has failures
-- A scheduled cluster scan was completed
-- A scheduled cluster scan has failures
-
-> **Prerequisite:** You need to configure a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) before configuring, sending, or receiving alerts.
-
-To activate an existing alert for a CIS scan result,
-
-1. From the cluster view in Rancher, click **Tools > Alerts.**
-1. Go to the section called **A set of alerts for cluster scans.**
-1. Go to the alert you want to activate and click **&#8942; > Activate.**
-1. Go to the alert rule group **A set of alerts for cluster scans** and click **&#8942; > Edit.**
-1. Scroll down to the **Alert** section. In the **To** field, select the notifier that you would like to use for sending alert notifications.
-1. Optional: To limit the frequency of the notifications, click on **Show advanced options** and configure the time interval of the alerts.
-1. Click **Save.**
-
-**Result:** The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
-
-To create a new alert,
-
-1. Go to the cluster view and click **Tools > CIS Scans.**
-1. Click **Add Alert.**
-1. Fill out the form. 
-1. Enter a name for the alert.
-1. In the **Is** field, set the alert to be triggered when a scan is completed or when a scan has a failure.
-1. In the **Send a** field, set the alert as a **Critical,** **Warning,** or **Info** alert level.
-1. Choose a [notifier]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/notifiers/) for the alert.
-
-**Result:** The alert is created and activated. The notifications will be triggered when the a scan is run on a cluster and the active alerts have satisfied conditions.
-
-For more information about alerts, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/alerts/)
-
-# Deleting a Report
-
-1. From the cluster view in Rancher, click **Tools > CIS Scans.**
-1. Go to the report that should be deleted.
-1. Click the **&#8942; > Delete.**
-1. Click **Delete.**
-
-# Downloading a Report
-
-1. From the cluster view in Rancher, click **Tools > CIS Scans.**
-1. Go to the report that you want to download. Click **&#8942; > Download.**
-
-**Result:** The report is downloaded in CSV format. For more information on each columns, refer to the [section about the generated report.](#about-the-generated-report)
+The documentation about CIS security scans has moved [here.]({{<baseurl>}}/rancher/v2.x/en/cis-scans)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/system-tools/_index.md b/content/rancher/v2.x/en/system-tools/_index.md
index 257f73cf171..78ba660c9af 100644
--- a/content/rancher/v2.x/en/system-tools/_index.md
+++ b/content/rancher/v2.x/en/system-tools/_index.md
@@ -1,6 +1,6 @@
 ---
 title: System Tools
-weight: 6001
+weight: 21
 ---
 
 System Tools is a tool to perform operational tasks on [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters or [installations of Rancher on an RKE cluster.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/) The tasks include:
diff --git a/content/rancher/v2.x/en/troubleshooting/_index.md b/content/rancher/v2.x/en/troubleshooting/_index.md
index edb5fb4f061..62ab028174e 100644
--- a/content/rancher/v2.x/en/troubleshooting/_index.md
+++ b/content/rancher/v2.x/en/troubleshooting/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Troubleshooting
-weight: 8100
+weight: 25
 ---
 
 This section contains information to help you troubleshoot issues when using Rancher.
diff --git a/content/rancher/v2.x/en/user-settings/_index.md b/content/rancher/v2.x/en/user-settings/_index.md
index 6f163c24753..e0d1962706b 100644
--- a/content/rancher/v2.x/en/user-settings/_index.md
+++ b/content/rancher/v2.x/en/user-settings/_index.md
@@ -1,6 +1,6 @@
 ---
 title: User Settings
-weight: 7000
+weight: 22
 aliases:
   - /rancher/v2.x/en/tasks/user-settings/
 ---
diff --git a/content/rancher/v2.x/en/v1.6-migration/_index.md b/content/rancher/v2.x/en/v1.6-migration/_index.md
index 0766c009821..0eee1e2bd5b 100644
--- a/content/rancher/v2.x/en/v1.6-migration/_index.md
+++ b/content/rancher/v2.x/en/v1.6-migration/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Migrating from v1.6 to v2.x
-weight: 10000
+weight: 27
 ---
 
 Rancher v2.x has been rearchitected and rewritten with the goal of providing a complete management solution for Kubernetes and Docker.  Due to these extensive changes, there is no direct upgrade path from v1.6 to v2.x, but rather a migration of your v1.6 services into v2.x as Kubernetes workloads.  In v1.6, the most common orchestration used was Rancher's own engine called Cattle. The following guide explains and educates our Cattle users on running workloads in a Kubernetes environment.

From 4956cf3a4a44c25595ed453634ff3a2f855006eb Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 31 Aug 2020 15:14:18 -0700
Subject: [PATCH 193/265] Reorganize docs based on feedback

---
 content/rancher/v2.x/en/cis-scans/_index.md                | 2 +-
 content/rancher/v2.x/en/cis-scans/legacy/_index.md         | 3 ++-
 content/rancher/v2.x/en/cluster-admin/_index.md            | 2 --
 content/rancher/v2.x/en/deploy-across-clusters/_index.md   | 2 +-
 .../en/deploy-across-clusters/multi-cluster-apps/_index.md | 3 ++-
 content/rancher/v2.x/en/helm-charts/_index.md              | 2 +-
 .../rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md  | 5 +++--
 content/rancher/v2.x/en/istio/_index.md                    | 2 +-
 content/rancher/v2.x/en/istio/legacy/_index.md             | 3 ++-
 .../v2.x/en/{cluster-explorer => k8s-resources}/_index.md  | 5 ++++-
 .../v2.x/en/{ => k8s-resources}/k8s-in-rancher/_index.md   | 2 +-
 .../k8s-in-rancher/certificates/_index.md                  | 0
 .../k8s-in-rancher/configmaps/_index.md                    | 0
 .../k8s-in-rancher/horitzontal-pod-autoscaler/_index.md    | 0
 .../horitzontal-pod-autoscaler/hpa-background/_index.md    | 0
 .../hpa-for-rancher-before-2_0_7/_index.md                 | 0
 .../manage-hpa-with-kubectl/_index.md                      | 0
 .../manage-hpa-with-rancher-ui/_index.md                   | 0
 .../horitzontal-pod-autoscaler/testing-hpa/_index.md       | 0
 .../k8s-in-rancher/load-balancers-and-ingress/_index.md    | 0
 .../load-balancers-and-ingress/ingress/_index.md           | 0
 .../load-balancers-and-ingress/load-balancers/_index.md    | 0
 .../k8s-in-rancher/registries/_index.md                    | 0
 .../{ => k8s-resources}/k8s-in-rancher/secrets/_index.md   | 0
 .../k8s-in-rancher/service-discovery/_index.md             | 0
 .../{ => k8s-resources}/k8s-in-rancher/workloads/_index.md | 0
 .../k8s-in-rancher/workloads/add-a-sidecar/_index.md       | 0
 .../k8s-in-rancher/workloads/deploy-workloads/_index.md    | 0
 .../k8s-in-rancher/workloads/rollback-workloads/_index.md  | 0
 .../k8s-in-rancher/workloads/upgrade-workloads/_index.md   | 0
 content/rancher/v2.x/en/logging/_index.md                  | 2 +-
 content/rancher/v2.x/en/logging/legacy/_index.md           | 7 +++++--
 content/rancher/v2.x/en/monitoring-alerting/_index.md      | 2 +-
 .../rancher/v2.x/en/monitoring-alerting/legacy/_index.md   | 7 +++++--
 content/rancher/v2.x/en/opa-gatekeper/_index.md            | 2 +-
 content/rancher/v2.x/en/pipelines/_index.md                | 6 ++++++
 .../pipelines => pipelines/legacy}/_index.md               | 5 +++--
 .../pipelines => pipelines/legacy}/concepts/_index.md      | 0
 .../pipelines => pipelines/legacy}/config/_index.md        | 0
 .../legacy}/docs-for-v2.0.x/_index.md                      | 0
 .../pipelines => pipelines/legacy}/example-repos/_index.md | 0
 .../pipelines => pipelines/legacy}/example/_index.md       | 0
 .../pipelines => pipelines/legacy}/storage/_index.md       | 0
 content/rancher/v2.x/en/security/_index.md                 | 2 +-
 44 files changed, 41 insertions(+), 23 deletions(-)
 rename content/rancher/v2.x/en/{cluster-explorer => k8s-resources}/_index.md (78%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/_index.md (99%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/certificates/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/configmaps/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-background/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/horitzontal-pod-autoscaler/testing-hpa/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/load-balancers-and-ingress/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/load-balancers-and-ingress/load-balancers/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/registries/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/secrets/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/service-discovery/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/workloads/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/workloads/add-a-sidecar/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/workloads/deploy-workloads/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/workloads/rollback-workloads/_index.md (100%)
 rename content/rancher/v2.x/en/{ => k8s-resources}/k8s-in-rancher/workloads/upgrade-workloads/_index.md (100%)
 create mode 100644 content/rancher/v2.x/en/pipelines/_index.md
 rename content/rancher/v2.x/en/{k8s-in-rancher/pipelines => pipelines/legacy}/_index.md (99%)
 rename content/rancher/v2.x/en/{k8s-in-rancher/pipelines => pipelines/legacy}/concepts/_index.md (100%)
 rename content/rancher/v2.x/en/{k8s-in-rancher/pipelines => pipelines/legacy}/config/_index.md (100%)
 rename content/rancher/v2.x/en/{k8s-in-rancher/pipelines => pipelines/legacy}/docs-for-v2.0.x/_index.md (100%)
 rename content/rancher/v2.x/en/{k8s-in-rancher/pipelines => pipelines/legacy}/example-repos/_index.md (100%)
 rename content/rancher/v2.x/en/{k8s-in-rancher/pipelines => pipelines/legacy}/example/_index.md (100%)
 rename content/rancher/v2.x/en/{k8s-in-rancher/pipelines => pipelines/legacy}/storage/_index.md (100%)

diff --git a/content/rancher/v2.x/en/cis-scans/_index.md b/content/rancher/v2.x/en/cis-scans/_index.md
index 467a03023c6..844a3c620f8 100644
--- a/content/rancher/v2.x/en/cis-scans/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/_index.md
@@ -1,6 +1,6 @@
 ---
 title: CIS Scans
-weight: 15
+weight: 18
 ---
 
 _Available as of v2.4.0_
diff --git a/content/rancher/v2.x/en/cis-scans/legacy/_index.md b/content/rancher/v2.x/en/cis-scans/legacy/_index.md
index 05b44c346b8..efd9cf3ca4f 100644
--- a/content/rancher/v2.x/en/cis-scans/legacy/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/legacy/_index.md
@@ -1,5 +1,6 @@
 ---
-title: Legacy UI Documentation
+title: Legacy CIS Scan Documentation
+shortTitle: Legacy
 weight: 1
 ---
 _Available as of v2.4.0_
diff --git a/content/rancher/v2.x/en/cluster-admin/_index.md b/content/rancher/v2.x/en/cluster-admin/_index.md
index 022d90a8da5..5f6f85a09ac 100644
--- a/content/rancher/v2.x/en/cluster-admin/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/_index.md
@@ -35,5 +35,3 @@ Rancher contains a variety of tools that aren't included in Kubernetes to assist
 - Monitoring
 - Istio Service Mesh
 - OPA Gatekeeper
-
-For more information, see [Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/)
diff --git a/content/rancher/v2.x/en/deploy-across-clusters/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/_index.md
index 13f60285d81..ebb2d67e8b2 100644
--- a/content/rancher/v2.x/en/deploy-across-clusters/_index.md
+++ b/content/rancher/v2.x/en/deploy-across-clusters/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Deploying Applications across Clusters
-weight: 18
+weight: 13
 ---
 
 > This section is under construction.
diff --git a/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md
index ca3f249520b..1199650261a 100644
--- a/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md
+++ b/content/rancher/v2.x/en/deploy-across-clusters/multi-cluster-apps/_index.md
@@ -1,5 +1,6 @@
 ---
-title: Legacy UI Documentation
+title: Legacy Multi-Cluster App Documentation
+shortTitle: Legacy
 weight: 2
 ---
 
diff --git a/content/rancher/v2.x/en/helm-charts/_index.md b/content/rancher/v2.x/en/helm-charts/_index.md
index bbe3afe2ebc..3650ca0e355 100644
--- a/content/rancher/v2.x/en/helm-charts/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Helm Charts in Rancher
-weight: 17
+weight: 12
 ---
 
 > This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md
index 328e1acd5b6..fa9eefa88d6 100644
--- a/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/legacy-catalogs/_index.md
@@ -1,7 +1,8 @@
 ---
-title: Legacy UI Documentation
+title: Legacy Catalog Documentation
+shortTitle: Legacy
 description: Rancher enables the use of catalogs to repeatedly deploy applications easily. Catalogs are GitHub or Helm Chart repositories filled with deployment-ready apps.
-weight: 4000
+weight: 1
 aliases:
   - /rancher/v2.x/en/concepts/global-configuration/catalog/
   - /rancher/v2.x/en/concepts/catalogs/
diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
index 40027d58254..935eb2e0b2d 100644
--- a/content/rancher/v2.x/en/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -1,4 +1,4 @@
 ---
 title: Istio
-weight: 13
+weight: 15
 ---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/legacy/_index.md b/content/rancher/v2.x/en/istio/legacy/_index.md
index 48f7fba4552..f4e8a5d3219 100644
--- a/content/rancher/v2.x/en/istio/legacy/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/_index.md
@@ -1,4 +1,5 @@
 ---
-title: Legacy UI Documentation
+title: Legacy Istio Documentation
+shortTitle: Legacy
 weight: 1
 ---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cluster-explorer/_index.md b/content/rancher/v2.x/en/k8s-resources/_index.md
similarity index 78%
rename from content/rancher/v2.x/en/cluster-explorer/_index.md
rename to content/rancher/v2.x/en/k8s-resources/_index.md
index 7f185017440..2c460974c1e 100644
--- a/content/rancher/v2.x/en/cluster-explorer/_index.md
+++ b/content/rancher/v2.x/en/k8s-resources/_index.md
@@ -1,8 +1,11 @@
 ---
-title: Cluster Explorer
+title: Kubernetes Resources
 weight: 10
 ---
 
+
+### About the Cluster Explorer
+
 _Available as of v2.5_
 
 The cluster explorer is a new feature in Rancher v2.5 that allows you to view and manipulate all of the custom resources and CRDs in a Kubernetes cluster from the Rancher UI.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/k8s-in-rancher/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/_index.md
index 8f4be343681..5e50a555387 100644
--- a/content/rancher/v2.x/en/k8s-in-rancher/_index.md
+++ b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Kubernetes Resources, Registries and Pipelines
+title: Legacy
 weight: 19
 aliases:
   - /rancher/v2.x/en/concepts/
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/certificates/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/certificates/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/certificates/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/certificates/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/configmaps/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/configmaps/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/configmaps/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/configmaps/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-background/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-background/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-background/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-background/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/hpa-for-rancher-before-2_0_7/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-kubectl/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/manage-hpa-with-rancher-ui/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/testing-hpa/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/testing-hpa/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/horitzontal-pod-autoscaler/testing-hpa/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/horitzontal-pod-autoscaler/testing-hpa/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/load-balancers-and-ingress/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/load-balancers-and-ingress/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/load-balancers-and-ingress/ingress/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/load-balancers-and-ingress/load-balancers/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/load-balancers-and-ingress/load-balancers/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/registries/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/registries/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/registries/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/registries/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/secrets/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/secrets/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/secrets/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/secrets/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/service-discovery/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/service-discovery/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/service-discovery/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/service-discovery/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/workloads/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/workloads/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/workloads/add-a-sidecar/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/add-a-sidecar/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/workloads/add-a-sidecar/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/add-a-sidecar/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/deploy-workloads/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/workloads/deploy-workloads/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/deploy-workloads/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/workloads/rollback-workloads/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/rollback-workloads/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/workloads/rollback-workloads/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/rollback-workloads/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/workloads/upgrade-workloads/_index.md b/content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/upgrade-workloads/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/workloads/upgrade-workloads/_index.md
rename to content/rancher/v2.x/en/k8s-resources/k8s-in-rancher/workloads/upgrade-workloads/_index.md
diff --git a/content/rancher/v2.x/en/logging/_index.md b/content/rancher/v2.x/en/logging/_index.md
index 0a3ac907e5d..865facc62b5 100644
--- a/content/rancher/v2.x/en/logging/_index.md
+++ b/content/rancher/v2.x/en/logging/_index.md
@@ -3,7 +3,7 @@ title: Rancher Integration with Logging Services
 shortTitle: Logging
 description: Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster.
 metaDescription: "Rancher integrates with popular logging services. Learn the requirements and benefits of integrating with logging services, and enable logging on your cluster."
-weight: 11
+weight: 16
 ---
 
 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
diff --git a/content/rancher/v2.x/en/logging/legacy/_index.md b/content/rancher/v2.x/en/logging/legacy/_index.md
index 48f7fba4552..5df4db7e0cf 100644
--- a/content/rancher/v2.x/en/logging/legacy/_index.md
+++ b/content/rancher/v2.x/en/logging/legacy/_index.md
@@ -1,4 +1,7 @@
 ---
-title: Legacy UI Documentation
+title: Legacy Logging Documentation
+shortTitle: Legacy
 weight: 1
----
\ No newline at end of file
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/monitoring-alerting/_index.md b/content/rancher/v2.x/en/monitoring-alerting/_index.md
index 9bb7663b38e..c4889c05aa2 100644
--- a/content/rancher/v2.x/en/monitoring-alerting/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/_index.md
@@ -2,7 +2,7 @@
 title: Monitoring and Alerting
 shortTitle: Monitoring/Alerting
 description: Prometheus lets you view metrics from your different Rancher and Kubernetes objects. Learn about the scope of monitoring and how to enable cluster monitoring
-weight: 12
+weight: 14
 ---
 
 Using Rancher, you can monitor the state and processes of your cluster nodes, Kubernetes components, and software deployments through integration with [Prometheus](https://prometheus.io/), a leading open-source monitoring solution.
diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
index 48f7fba4552..baa3262eb9d 100644
--- a/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
@@ -1,4 +1,7 @@
 ---
-title: Legacy UI Documentation
+title: Legacy Monitoring/Alerting Documentation
+shortTitle: Legacy
 weight: 1
----
\ No newline at end of file
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md
index 3c6093525db..16056835c59 100644
--- a/content/rancher/v2.x/en/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md
@@ -1,6 +1,6 @@
 ---
 title: OPA Gatekeeper
-weight: 14
+weight: 17
 aliases:
  - /rancher/v2.x/en/cluster-admin/tools/opa-gatekeeper
  
diff --git a/content/rancher/v2.x/en/pipelines/_index.md b/content/rancher/v2.x/en/pipelines/_index.md
new file mode 100644
index 00000000000..0a996afa07a
--- /dev/null
+++ b/content/rancher/v2.x/en/pipelines/_index.md
@@ -0,0 +1,6 @@
+---
+title: Pipelines
+weight: 11
+---
+
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/_index.md b/content/rancher/v2.x/en/pipelines/legacy/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/k8s-in-rancher/pipelines/_index.md
rename to content/rancher/v2.x/en/pipelines/legacy/_index.md
index e20e1794245..393ede2e437 100644
--- a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/_index.md
+++ b/content/rancher/v2.x/en/pipelines/legacy/_index.md
@@ -1,6 +1,7 @@
 ---
-title: Pipelines
-weight: 3047
+title: Legacy Pipeline Documentation
+shortTitle: Legacy
+weight: 1
 aliases:
   - /rancher/v2.x/en/tools/pipelines/concepts/
 
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/concepts/_index.md b/content/rancher/v2.x/en/pipelines/legacy/concepts/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/pipelines/concepts/_index.md
rename to content/rancher/v2.x/en/pipelines/legacy/concepts/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/config/_index.md b/content/rancher/v2.x/en/pipelines/legacy/config/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/pipelines/config/_index.md
rename to content/rancher/v2.x/en/pipelines/legacy/config/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/docs-for-v2.0.x/_index.md b/content/rancher/v2.x/en/pipelines/legacy/docs-for-v2.0.x/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/pipelines/docs-for-v2.0.x/_index.md
rename to content/rancher/v2.x/en/pipelines/legacy/docs-for-v2.0.x/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/_index.md b/content/rancher/v2.x/en/pipelines/legacy/example-repos/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/_index.md
rename to content/rancher/v2.x/en/pipelines/legacy/example-repos/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/example/_index.md b/content/rancher/v2.x/en/pipelines/legacy/example/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/pipelines/example/_index.md
rename to content/rancher/v2.x/en/pipelines/legacy/example/_index.md
diff --git a/content/rancher/v2.x/en/k8s-in-rancher/pipelines/storage/_index.md b/content/rancher/v2.x/en/pipelines/legacy/storage/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/k8s-in-rancher/pipelines/storage/_index.md
rename to content/rancher/v2.x/en/pipelines/legacy/storage/_index.md
diff --git a/content/rancher/v2.x/en/security/_index.md b/content/rancher/v2.x/en/security/_index.md
index 820912ebf30..86101062333 100644
--- a/content/rancher/v2.x/en/security/_index.md
+++ b/content/rancher/v2.x/en/security/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Security
-weight: 16
+weight: 19
 ---
 
 <table width="100%">

From d99139d10bb9f489b641daf77955f776c8a006d8 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 31 Aug 2020 22:44:08 -0700
Subject: [PATCH 194/265] Discourage Docker installs

---
 .../other-installation-methods/_index.md       | 18 +++++++++++-------
 .../air-gap/_index.md                          |  2 +-
 .../single-node-docker/_index.md               |  6 ++++--
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/_index.md
index 868519c447c..b9e2266abf8 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/_index.md
@@ -3,14 +3,18 @@ title: Other Installation Methods
 weight: 3
 ---
 
-### Docker Installations
-
-The [single-node Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster using Helm, you install the Rancher server component on a single node using a `docker run` command.
-
-Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server.
-
 ### Air Gapped Installations
 
 Follow [these steps]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) to install the Rancher server in an air gapped environment.
 
-An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
\ No newline at end of file
+An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy.
+
+### Docker Installations
+
+The [single-node Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster using Helm, you install the Rancher server component on a single node using a `docker run` command.
+
+The Docker installation is for development and testing environments only. 
+
+Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server.
+
+When the Rancher server is installed with Docker, it cannot be migrated to a Kubernetes cluster for a production environment.
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/_index.md
index fb264adc5e9..2c4d94963b6 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Installing Rancher in an Air Gapped Environment
-weight: 3
+weight: 1
 aliases:
   - /rancher/v2.x/en/installation/air-gap-installation/
   - /rancher/v2.x/en/installation/air-gap-high-availability/
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
index 97e9673c322..56890fe07da 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
@@ -1,14 +1,16 @@
 ---
 title: Installing Rancher on a Single Node Using Docker
 description: For development and testing environments only, use a Docker install. Install Docker on a single Linux host, and deploy Rancher with a single Docker container.
-weight: 1
+weight: 2
 aliases:
   - /rancher/v2.x/en/installation/single-node-install/
   - /rancher/v2.x/en/installation/single-node
   - /rancher/v2.x/en/installation/other-installation-methods/single-node
 ---
 
-For development and testing environments only, Rancher can be installed by running a single Docker container.
+> The Docker installation is for development and testing environments only. When the Rancher server is installed with Docker, it cannot be migrated to a Kubernetes cluster for a production environment.
+
+Rancher can be installed by running a single Docker container.
 
 In this installation scenario, you'll install Docker on a single Linux host, and then deploy Rancher on your host using a single Docker container.
 

From 08d3a3346f3e8f6e1b706d74a9917f5ee8b662ae Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 1 Sep 2020 09:33:59 -0700
Subject: [PATCH 195/265] Clean up EKS cluster creation page

---
 .../hosted-kubernetes-clusters/eks/_index.md  | 222 ++++++++++--------
 1 file changed, 124 insertions(+), 98 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index ed2eb5c6632..fabedc6a51b 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -8,13 +8,24 @@ aliases:
 
 Amazon EKS provides a managed control plane for your Kubernetes cluster. Amazon EKS runs the Kubernetes control plane instances across multiple Availability Zones to ensure high availability. Rancher provides an intuitive user interface for managing and deploying the Kubernetes clusters you run in Amazon EKS. With this guide, you will use Rancher to quickly and easily launch an Amazon EKS Kubernetes cluster in your AWS account. For more information on Amazon EKS, see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html).
 
+- [Prerequisites in Amazon Web Services](#prerequisites-in-amazon-web-services)
+  - [Amazon VPC](#amazon-vpc)
+  - [IAM Policies](#iam-policies)
+- [Architecture](#architecture)
+- [Create the EKS Cluster](#create-the-eks-cluster)
+- [EKS Cluster Configuration Reference](#eks-cluster-configuration-reference)
+- [Troubleshooting](#troubleshooting)
+- [AWS Service Events](#aws-service-events)
+- [Security and Compliance](#security-and-compliance)
+- [Tutorial](#tutorial)
+- [Minimum EKS Permissions](#minimum-eks-permissions)
 
-## Prerequisites in Amazon Web Services
+# Prerequisites in Amazon Web Services
 
 >**Note**
 >Deploying to Amazon AWS will incur charges. For more information, refer to the [EKS pricing page](https://aws.amazon.com/eks/pricing/).
 
-To set up a cluster on EKS, you will need to set up an Amazon VPC (Virtual Private Cloud). You will also need to make sure that the account you will be using to create the EKS cluster has the appropriate permissions. For details, refer to the official guide on [Amazon EKS Prerequisites](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html#eks-prereqs).
+To set up a cluster on EKS, you will need to set up an Amazon VPC (Virtual Private Cloud). You will also need to make sure that the account you will be using to create the EKS cluster has the appropriate [permissions.](#minimum-eks-permissions) For details, refer to the official guide on [Amazon EKS Prerequisites](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html#eks-prereqs).
 
 ### Amazon VPC
 
@@ -26,7 +37,7 @@ Rancher needs access to your AWS account in order to provision and administer yo
 
 1. Create a user with programmatic access by following the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
 
-2. Next, create an IAM policy that defines what this user has access to in your AWS account. It's important to only grant this user minimal access within your account. Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
+2. Next, create an IAM policy that defines what this user has access to in your AWS account. It's important to only grant this user minimal access within your account. The minimum permissions required for an EKS cluster are listed [here.](#minimum-eks-permissions) Follow the steps [here](https://docs.aws.amazon.com/eks/latest/userguide/EKS_IAM_user_policies.html) to create an IAM policy and attach it to your user.
 
 3. Finally, follow the steps [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey) to create an access key and secret key for this user.
 
@@ -34,132 +45,147 @@ Rancher needs access to your AWS account in order to provision and administer yo
 
 For more detailed information on IAM policies for EKS, refer to the official [documentation on Amazon EKS IAM Policies, Roles, and Permissions](https://docs.aws.amazon.com/eks/latest/userguide/IAM_policies.html).
 
-## Architecture
+# Architecture
 
 The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two Kubernetes clusters: one created by RKE and another created by EKS.
 
-![Rancher architecture with EKS hosted cluster]({{<baseurl>}}/img/rancher/rancher-architecture.svg)
+<figcaption>Managing Kubernetes Clusters through Rancher's Authentication Proxy</figcaption>
 
-## Create the EKS Cluster
+![Architecture]({{<baseurl>}}/img/rancher/rancher-architecture-rancher-api-server.svg)
+
+# Create the EKS Cluster
 
 Use Rancher to set up and configure your Kubernetes cluster.
 
-The form to create EKS clusters was improved in Rancher 2.5.
-
-{{% tabs %}}
-{{% tab "Rancher v2.5+" %}}
-{{% /tab %}}
-{{% tab "Rancher prior to v2.5" %}}
 1. From the **Clusters** page, click **Add Cluster**.
 
 1. Choose **Amazon EKS**.
 
-1. Enter a **Cluster Name**.
+1. Enter a **Cluster Name.**
 
 1. {{< step_create-cluster_member-roles >}}
 
-1. Configure **Account Access** for the EKS cluster. Complete each drop-down and field using the information obtained in [2. Create Access Key and Secret Key](#prerequisites-in-amazon-web-services).
-
-    | Setting    | Description                                                                                                          |
-    | ---------- | -------------------------------------------------------------------------------------------------------------------- |
-    | Region     | From the drop-down choose the geographical region in which to build your cluster.                                    |
-    | Access Key | Enter the access key that you created in [2. Create Access Key and Secret Key](#2-create-access-key-and-secret-key). |
-    | Secret Key | Enter the secret key that you created in [2. Create Access Key and Secret Key](#2-create-access-key-and-secret-key). |
-
-1. Click **Next: Select Service Role**. Then choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
-
-    Service Role | Description
-    -------------|---------------------------
-    Standard: Rancher generated service role | If you choose this role, Rancher automatically adds a service role for use with the cluster.
-    Custom: Choose from your existing service roles | If you choose this role, Rancher lets you choose from service roles that you're already created within AWS. For more information on creating a custom service role in AWS, see the [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role).
-
-1. Click **Next: Select VPC and Subnet**.
-
-1. Choose an option for **Public IP for Worker Nodes**. Your selection for this option determines what options are available for **VPC & Subnet**.
-
-    Option | Description
-    -------|------------
-    Yes | When your cluster nodes are provisioned, they're assigned a both a private and public IP address.
-    No: Private IPs only | When your cluster nodes are provisioned, they're assigned only a private IP address.<br/><br/>If you choose this option, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane.
-
-1. Now choose a **VPC & Subnet**. For more information, refer to the AWS documentation for [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html). Follow one of the sets of instructions below based on your selection from the previous step.
-
-	- [What Is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
-	- [VPCs and Subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)
-
-    {{% accordion id="yes" label="Public IP for Worker Nodes—Yes" %}}
-If you choose to assign a public IP address to your cluster's worker nodes, you have the option of choosing between a VPC that's automatically generated by Rancher (i.e., **Standard: Rancher generated VPC and Subnet**), or a VPC that you're already created with AWS (i.e., **Custom: Choose from your existing VPC and Subnets**). Choose the option that best fits your use case.
-
-1. Choose a **VPC and Subnet** option.
-
-    Option | Description
-    -------|------------
-    Standard: Rancher generated VPC and Subnet | While provisioning your cluster, Rancher generates a new VPC and Subnet.
-    Custom: Choose from your exiting VPC and Subnets | While provisioning your cluster, Rancher configures your nodes to use a VPC and Subnet that you've already [created in AWS](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html). If you choose this option, complete the remaining steps below.
-
-1.  If you're using **Custom: Choose from your existing VPC and Subnets**:
-
-    (If you're using **Standard**, skip to [step 11](#select-instance-options))
-
-	1. Make sure **Custom: Choose from your existing VPC and Subnets** is selected.
-
-	1. From the drop-down that displays, choose a VPC.
-
-	1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
-
-    1. Click **Next: Select Security Group**.
-    {{% /accordion %}}
-    {{% accordion id="no" label="Public IP for Worker Nodes—No: Private IPs only" %}}
-If you chose this option, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane. Follow the steps below.
-
->**Tip:** When using only private IP addresses, you can provide your nodes internet access by creating a VPC constructed with two subnets, a private set and a public set.  The private set should have its route tables configured to point toward a NAT in the public set.  For more information on routing traffic from private subnets, please see the [official AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html).
-
-    1. From the drop-down that displays, choose a VPC.
-
-	1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
-
-    1. Click **Next: Select Security Group**.
-    {{% /accordion %}}
-
-1. <a id="security-group"></a>Choose a **Security Group**. See the documentation below on how to create one.
-
-    Amazon Documentation:
-    - [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html)
-    - [Security Groups for Your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
-    - [Create a Security Group](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html#getting-started-create-security-group)
-
-1. <a id="select-instance-options"></a>Click **Select Instance Options**, and then edit the node options available. Instance type and size of your worker nodes affects how many IP addresses each worker node will have available. See this [documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI) for more information.
-
-    Option | Description
-    -------|------------
-    Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning.
-    Custom AMI Override | If you want to use a custom [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html#creating-an-ami) (AMI), specify it here. By default, Rancher will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the EKS version that you chose.
-    Desired ASG Size | The number of instances that your cluster will provision.
-    User Data | Custom commands can to be passed to perform automated configuration tasks **WARNING: Modifying this may cause your nodes to be unable to join the cluster.** _Note: Available as of v2.2.0_
+1. Fill out the rest of the form. For help, refer to the [configuration reference.](#eks-cluster-configuration-reference) 
 
 1. Click **Create**.
 
 {{< result_create-cluster >}}
-{{% /tab %}}
-{{% /tabs %}}
 
-## Troubleshooting
+# EKS Cluster Configuration Reference
+
+### Account Access
+
+Complete each drop-down and field using the information obtained for your [IAM policy.](#iam-policy)
+
+| Setting    | Description                                                                                                          |
+| ---------- | -------------------------------------------------------------------------------------------------------------------- |
+| Region     | From the drop-down choose the geographical region in which to build your cluster.                                    |
+| Access Key | Enter the access key that you created for your [IAM policy.](#iam-policy) |
+| Secret Key | Enter the secret key that you created for your [IAM policy.](#iam-policy) |
+
+### Service Role
+
+Choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
+
+Service Role | Description
+-------------|---------------------------
+Standard: Rancher generated service role | If you choose this role, Rancher automatically adds a service role for use with the cluster.
+Custom: Choose from your existing service roles | If you choose this role, Rancher lets you choose from service roles that you're already created within AWS. For more information on creating a custom service role in AWS, see the [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role).
+
+### Public IP for Worker Nodes
+
+Your selection for this option determines what options are available for **VPC & Subnet**.
+
+Option | Description
+-------|------------
+Yes | When your cluster nodes are provisioned, they're assigned a both a private and public IP address.
+No: Private IPs only | When your cluster nodes are provisioned, they're assigned only a private IP address.<br/><br/>If you choose this option, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane.
+
+### VPC & Subnet
+
+The available options depend on the [public IP for worker nodes.](#public-ip-for-worker-nodes)
+
+Option | Description
+    -------|------------
+    Standard: Rancher generated VPC and Subnet | While provisioning your cluster, Rancher generates a new VPC and Subnet.
+    Custom: Choose from your existing VPC and Subnets | While provisioning your cluster, Rancher configures your nodes to use a VPC and Subnet that you've already [created in AWS](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html). If you choose this option, complete the remaining steps below.
+
+ For more information, refer to the AWS documentation for [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html). Follow one of the sets of instructions below based on your selection from the previous step.
+
+- [What Is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
+- [VPCs and Subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)
+
+
+If you choose to assign a public IP address to your cluster's worker nodes, you have the option of choosing between a VPC that's automatically generated by Rancher (i.e., **Standard: Rancher generated VPC and Subnet**), or a VPC that you've already created with AWS (i.e., **Custom: Choose from your existing VPC and Subnets**). Choose the option that best fits your use case.
+
+{{% accordion id="yes" label="Click to expand" %}}
+
+If you're using **Custom: Choose from your existing VPC and Subnets**:
+
+(If you're using **Standard**, skip to the [instance options.)](#select-instance-options)
+
+1. Make sure **Custom: Choose from your existing VPC and Subnets** is selected.
+
+1. From the drop-down that displays, choose a VPC.
+
+1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
+
+1. Click **Next: Select Security Group**.
+{{% /accordion %}}
+
+If your worker nodes have Private IPs only, you must also choose a **VPC & Subnet** that allow your instances to access the internet. This access is required so that your worker nodes can connect to the Kubernetes control plane.
+{{% accordion id="no" label="Click to expand" %}}
+Follow the steps below.
+
+>**Tip:** When using only private IP addresses, you can provide your nodes internet access by creating a VPC constructed with two subnets, a private set and a public set.  The private set should have its route tables configured to point toward a NAT in the public set.  For more information on routing traffic from private subnets, please see the [official AWS documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html).
+
+1. From the drop-down that displays, choose a VPC.
+
+1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
+
+1. Click **Next: Select Security Group**.
+{{% /accordion %}}
+
+### Security Group
+
+<a id="security-group"></a>
+
+Amazon Documentation:
+
+- [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html)
+- [Security Groups for Your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
+- [Create a Security Group](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html#getting-started-create-security-group)
+
+### Instance Options
+
+<a id="select-instance-options"></a>
+
+Instance type and size of your worker nodes affects how many IP addresses each worker node will have available. See this [documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI) for more information.
+
+Option | Description
+-------|------------
+Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning.
+Custom AMI Override | If you want to use a custom [Amazon Machine Image](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html#creating-an-ami) (AMI), specify it here. By default, Rancher will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the EKS version that you chose.
+Desired ASG Size | The number of instances that your cluster will provision.
+User Data | Custom commands can to be passed to perform automated configuration tasks **WARNING: Modifying this may cause your nodes to be unable to join the cluster.** _Note: Available as of v2.2.0_
+
+# Troubleshooting
 
 For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html).
 
-## AWS Service Events
+# AWS Service Events
 
 To find information on any AWS Service events, please see [this page](https://status.aws.amazon.com/).
 
-## Security and Compliance
+# Security and Compliance
 
 For more information on security and compliance with your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/shared-responsibilty.html).
 
-## Tutorial
+# Tutorial
 
 This [tutorial](https://aws.amazon.com/blogs/opensource/managing-eks-clusters-rancher/) on the AWS Open Source Blog will walk you through how to set up an EKS cluster with Rancher, deploy a publicly accessible app to test the cluster, and deploy a sample project to track real-time geospatial data using a combination of other open-source software such as Grafana and InfluxDB.
 
-## Appendix - Minimum EKS Permissions
+# Minimum EKS Permissions
 
 Documented here is a minimum set of permissions necessary to use all functionality of the EKS driver in Rancher.
 

From 8fa10ca39f1ff8e8215319746b062fd739433c7f Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 1 Sep 2020 09:52:32 -0700
Subject: [PATCH 196/265] Update internal links in EKS doc

---
 .../hosted-kubernetes-clusters/eks/_index.md  | 25 ++++++++++++++++---
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index fabedc6a51b..1375d4f33bf 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -73,8 +73,16 @@ Use Rancher to set up and configure your Kubernetes cluster.
 
 # EKS Cluster Configuration Reference
 
+{{% tabs %}}
+{{% tab "Rancher v2.5+" %}}
+{{% /tab %}}
+{{% tab "Rancher prior to v2.5" %}}
+
+
 ### Account Access
 
+<a id="account-access-2-4"></a>
+
 Complete each drop-down and field using the information obtained for your [IAM policy.](#iam-policy)
 
 | Setting    | Description                                                                                                          |
@@ -85,6 +93,8 @@ Complete each drop-down and field using the information obtained for your [IAM p
 
 ### Service Role
 
+<a id="service-role-2-4"></a>
+
 Choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
 
 Service Role | Description
@@ -94,6 +104,8 @@ Custom: Choose from your existing service roles | If you choose this role, Ranch
 
 ### Public IP for Worker Nodes
 
+<a id="public-ip-for-worker-nodes-2-4"></a>
+
 Your selection for this option determines what options are available for **VPC & Subnet**.
 
 Option | Description
@@ -103,6 +115,8 @@ No: Private IPs only | When your cluster nodes are provisioned, they're assigned
 
 ### VPC & Subnet
 
+<a id="vpc-and-subnet-2-4"></a>
+
 The available options depend on the [public IP for worker nodes.](#public-ip-for-worker-nodes)
 
 Option | Description
@@ -122,7 +136,7 @@ If you choose to assign a public IP address to your cluster's worker nodes, you
 
 If you're using **Custom: Choose from your existing VPC and Subnets**:
 
-(If you're using **Standard**, skip to the [instance options.)](#select-instance-options)
+(If you're using **Standard**, skip to the [instance options.)](#select-instance-options-2-4)
 
 1. Make sure **Custom: Choose from your existing VPC and Subnets** is selected.
 
@@ -143,12 +157,11 @@ Follow the steps below.
 
 1. Click **Next: Select Subnets**. Then choose one of the **Subnets** that displays.
 
-1. Click **Next: Select Security Group**.
 {{% /accordion %}}
 
 ### Security Group
 
-<a id="security-group"></a>
+<a id="security-group-2-4"></a>
 
 Amazon Documentation:
 
@@ -158,7 +171,7 @@ Amazon Documentation:
 
 ### Instance Options
 
-<a id="select-instance-options"></a>
+<a id="select-instance-options-2-4"></a>
 
 Instance type and size of your worker nodes affects how many IP addresses each worker node will have available. See this [documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI) for more information.
 
@@ -169,6 +182,10 @@ Custom AMI Override | If you want to use a custom [Amazon Machine Image](https:/
 Desired ASG Size | The number of instances that your cluster will provision.
 User Data | Custom commands can to be passed to perform automated configuration tasks **WARNING: Modifying this may cause your nodes to be unable to join the cluster.** _Note: Available as of v2.2.0_
 
+{{% /tab %}}
+{{% /tabs %}}
+
+
 # Troubleshooting
 
 For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html).

From 5052893ae08dfa0714b8c3d7b39051934b5aa381 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 1 Sep 2020 14:16:52 -0700
Subject: [PATCH 197/265] Document EKS cluster creation changes in Rancher v2.5

---
 .../hosted-kubernetes-clusters/eks/_index.md  | 113 ++++++++++++++++++
 1 file changed, 113 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index 1375d4f33bf..29db4557005 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -73,8 +73,121 @@ Use Rancher to set up and configure your Kubernetes cluster.
 
 # EKS Cluster Configuration Reference
 
+### Changes in Rancher v2.5
+
+More EKS options can be configured when you create an EKS cluster in Rancher, including the following:
+
+- Managed node groups
+- The Kubernetes Cluster Autoscaler
+- Control plane logging
+- Secrets encryption with KMS
+
+The following capabilities have been added for configuring EKS clusters in Rancher:
+
+- GPU support
+- Automatically update AMIs
+- Add new nodes
+- Upgrade nodes
+- Add and remove node groups
+- Disable and enable private access
+- Add restrictions to public access
+- Use your cloud credentials to create the EKS cluster instead of passing in your access key and secret key
+
 {{% tabs %}}
 {{% tab "Rancher v2.5+" %}}
+
+### Account Access
+
+<a id="account-access-2-5"></a>
+
+Complete each drop-down and field using the information obtained for your [IAM policy.](#iam-policy)
+
+| Setting    | Description       |
+| ---------- | -------------------------------------------------------------------------------------------------------------------- |
+| Region     | From the drop-down choose the geographical region in which to build your cluster.                                    |
+| Cloud Credentials | Select the cloud credentials that you created for your [IAM policy.](#iam-policy) For more information on creating cloud credentials in Rancher, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/) |
+
+### Service Role
+
+<a id="service-role-2-5"></a>
+
+Choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
+
+Service Role | Description
+-------------|---------------------------
+Standard: Rancher generated service role | If you choose this role, Rancher automatically adds a service role for use with the cluster.
+Custom: Choose from your existing service roles | If you choose this role, Rancher lets you choose from service roles that you're already created within AWS. For more information on creating a custom service role in AWS, see the [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role).
+
+### Secrets Encryption
+
+<a id="secrets-encryption-2-5"></a>
+
+Optional: To encrypt secrets, select or enter a key created in [AWS Key Management Service (KMS)](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
+
+### API Server Endpoint Access
+
+<a id="api-server-endpoint-access-2-5"></a>
+
+Configuring Public/Private API access is an advanced use case. For details, refer to the EKS cluster endpoint access control [documentation.](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)
+
+### Public Access Endpoints
+
+<a id="public-access-endpoints-2-5"></a>
+
+Optionally limit access to the public endpoint via explicit CIDR blocks. If you limit access to specific CIDR blocks, then it is recommended that you also enable the private access to avoid losing network communication to the cluster.
+
+For more information about public and private access to the cluster endpoint, refer to the [Amazon EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)
+
+### Subnet
+
+<a id="subnet-2-5"></a>
+
+| Option | Description |
+| ------- | ------------ |
+| Standard: Rancher generated VPC and Subnet | While provisioning your cluster, Rancher generates a new VPC and Subnet. |
+| Custom: Choose from your existing VPC and Subnets | While provisioning your cluster, Rancher configures your nodes to use a VPC and Subnet that you've already [created in AWS](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html).  |
+
+ For more information, refer to the AWS documentation for [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html). Follow one of the sets of instructions below based on your selection from the previous step.
+
+- [What Is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
+- [VPCs and Subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)
+
+### Security Group
+
+<a id="security-group-2-5"></a>
+
+Amazon Documentation:
+
+- [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html)
+- [Security Groups for Your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
+- [Create a Security Group](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html#getting-started-create-security-group)
+
+### Logging
+
+<a id="logging-2-5"></a>
+
+Configure control plane logs to send to Amazon CloudWatch. You are charged the standard CloudWatch Logs data ingestion and storage costs for any logs sent to CloudWatch Logs from your clusters.
+
+Each log type corresponds to a component of the Kubernetes control plane. To learn more about these components, see [Kubernetes Components](https://kubernetes.io/docs/concepts/overview/components/) in the Kubernetes documentation.
+
+For more information on EKS control plane logging, refer to the official [documentation.](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
+
+### Managed Node Groups
+
+<a id="managed-node-groups-2-5"></a>
+
+Amazon EKS managed node groups automate the provisioning and lifecycle management of nodes (Amazon EC2 instances) for Amazon EKS Kubernetes clusters. 
+
+For more information about how node groups work and how they are configured, refer to the [EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html)
+
+Amazon will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the Kubernetes version. You can configure whether the AMI has GPU enabled.
+
+| Option | Description |
+| ------- | ------------ |
+| Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning. |
+| Maximum ASG Size | The maximum number of instances. This setting won't take effect until the [Cluster Autoscaler](https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html) is installed. |
+| Minimum ASG Size | The minimum number of instances. This setting won't take effect until the [Cluster Autoscaler](https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html) is installed. |
+
 {{% /tab %}}
 {{% tab "Rancher prior to v2.5" %}}
 

From 39530b7080113627e379467e465f5b3202191f1f Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 4 Sep 2020 13:28:28 -0700
Subject: [PATCH 198/265] Update backup/restore doc structure for Rancher 2.5

---
 content/rancher/v2.x/en/backups/_index.md     | 15 +------------
 .../rancher/v2.x/en/backups/legacy/_index.md  | 22 +++++++++++++++++++
 .../{backups => legacy/backup}/_index.md      |  1 +
 .../backup}/k8s-backups/_index.md             |  2 ++
 .../backup}/k8s-backups/ha-backups/_index.md  |  1 +
 .../backup}/k8s-backups/k3s-backups/_index.md |  1 +
 .../backup}/single-node-backups/_index.md     |  1 +
 .../restore}/_index.md                        |  2 ++
 .../legacy/restore/k8s-restore/_index.md      |  6 +++++
 .../k8s-restore/k3s-restore/_index.md         |  1 +
 .../k8s-restore/rke-restore/_index.md         |  1 +
 .../single-node-restoration/_index.md         |  1 +
 .../restorations/k8s-restore/_index.md        |  4 ----
 13 files changed, 40 insertions(+), 18 deletions(-)
 create mode 100644 content/rancher/v2.x/en/backups/legacy/_index.md
 rename content/rancher/v2.x/en/backups/{backups => legacy/backup}/_index.md (95%)
 rename content/rancher/v2.x/en/backups/{backups => legacy/backup}/k8s-backups/_index.md (58%)
 rename content/rancher/v2.x/en/backups/{backups => legacy/backup}/k8s-backups/ha-backups/_index.md (99%)
 rename content/rancher/v2.x/en/backups/{backups => legacy/backup}/k8s-backups/k3s-backups/_index.md (95%)
 rename content/rancher/v2.x/en/backups/{backups => legacy/backup}/single-node-backups/_index.md (98%)
 rename content/rancher/v2.x/en/backups/{restorations => legacy/restore}/_index.md (92%)
 create mode 100644 content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md
 rename content/rancher/v2.x/en/backups/{restorations => legacy/restore}/k8s-restore/k3s-restore/_index.md (93%)
 rename content/rancher/v2.x/en/backups/{restorations => legacy/restore}/k8s-restore/rke-restore/_index.md (99%)
 rename content/rancher/v2.x/en/backups/{restorations => legacy/restore}/single-node-restoration/_index.md (98%)
 delete mode 100644 content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md

diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index b15ac0dd7f0..e73e5d6e32f 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -3,17 +3,4 @@ title: Backups and Disaster Recovery
 weight: 5
 ---
 
-This section is devoted to protecting your data in a disaster scenario.
-
-To protect yourself from a disaster scenario, you should create backups on a regular basis.
-
-  - Rancher server backups:
-    - [Rancher installed on a K3s Kubernetes cluster](./backups/k3s-backups)
-    - [Rancher installed on an RKE Kubernetes cluster](./backups/ha-backups)
-    - [Rancher installed with Docker](./backups/single-node-backups/)
-  - [Backing up Rancher Launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/)
-
-In a disaster scenario, you can restore your `etcd` database by restoring a backup.
-
-   - [Rancher Server Restorations]({{<baseurl>}}/rancher/v2.x/en/backups/restorations)
-   - [Restoring Rancher Launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/)
+> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/legacy/_index.md b/content/rancher/v2.x/en/backups/legacy/_index.md
new file mode 100644
index 00000000000..2315b1a7b8c
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/legacy/_index.md
@@ -0,0 +1,22 @@
+---
+title: Legacy Backup and Restore Documentation
+weight: 1
+---
+
+> This section is under construction.
+
+
+This section is devoted to protecting your data in a disaster scenario.
+
+To protect yourself from a disaster scenario, you should create backups on a regular basis.
+
+  - Rancher server backups:
+    - [Rancher installed on a K3s Kubernetes cluster](./backups/k3s-backups)
+    - [Rancher installed on an RKE Kubernetes cluster](./backups/ha-backups)
+    - [Rancher installed with Docker](./backups/single-node-backups/)
+  - [Backing up Rancher Launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/)
+
+In a disaster scenario, you can restore your `etcd` database by restoring a backup.
+
+   - [Rancher Server Restorations]({{<baseurl>}}/rancher/v2.x/en/backups/restorations)
+   - [Restoring Rancher Launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/)
diff --git a/content/rancher/v2.x/en/backups/backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/backups/backups/_index.md
rename to content/rancher/v2.x/en/backups/legacy/backup/_index.md
index 635d713f9d2..1a776f62c29 100644
--- a/content/rancher/v2.x/en/backups/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/backup/_index.md
@@ -4,6 +4,7 @@ weight: 50
 aliases:
   - /rancher/v2.x/en/installation/after-installation/
   - /rancher/v2.x/en/backups/
+  - /rancher/v2.x/en/backups/backups
 ---
 This section contains information about how to create backups of your Rancher data and how to restore them in a disaster scenario.
 
diff --git a/content/rancher/v2.x/en/backups/backups/k8s-backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/_index.md
similarity index 58%
rename from content/rancher/v2.x/en/backups/backups/k8s-backups/_index.md
rename to content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/_index.md
index 000bc49ee7c..0221ac77312 100644
--- a/content/rancher/v2.x/en/backups/backups/k8s-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Kubernetes Backups
 weight: 1
+aliases:
+  - /rancher/v2.x/en/backups/backups/k8s-backups
 ---
 
 > This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/backups/k8s-backups/ha-backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/backups/backups/k8s-backups/ha-backups/_index.md
rename to content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/_index.md
index 7700618773a..b659ba7a1e9 100644
--- a/content/rancher/v2.x/en/backups/backups/k8s-backups/ha-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/_index.md
@@ -6,6 +6,7 @@ aliases:
   - /rancher/v2.x/en/installation/after-installation/k8s-install-backup-and-restoration/
   - /rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration/
   - /rancher/v2.x/en/backups/backups/ha-backups
+  - /rancher/v2.x/en/backups/backups/k8s-backups/ha-backups
 ---
 This section describes how to create backups of your high-availability Rancher install.
 
diff --git a/content/rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups/_index.md
rename to content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/_index.md
index 90ea8eba6f3..f2aea16e349 100644
--- a/content/rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/_index.md
@@ -4,6 +4,7 @@ shortTitle: K3s Installs
 weight: 1
 aliases:
   - /rancher/v2.x/en/backups/backups/k3s-backups
+  - /rancher/v2.x/en/backups/backups/k8s-backups/k3s-backups
 ---
 
 When Rancher is installed on a high-availability Kubernetes cluster, we recommend using an external database to store the cluster data.
diff --git a/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/single-node-backups/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md
rename to content/rancher/v2.x/en/backups/legacy/backup/single-node-backups/_index.md
index 911bd43d124..d8ff02e977c 100644
--- a/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/backup/single-node-backups/_index.md
@@ -4,6 +4,7 @@ shortTitle: Docker Installs
 weight: 3
 aliases:
   - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/
+  - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/
 ---
 
 After completing your Docker installation of Rancher, we recommend creating backups of it on a regular basis. Having a recent backup will let you recover quickly from an unexpected disaster.
diff --git a/content/rancher/v2.x/en/backups/restorations/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/_index.md
similarity index 92%
rename from content/rancher/v2.x/en/backups/restorations/_index.md
rename to content/rancher/v2.x/en/backups/legacy/restore/_index.md
index 2c0c9e6c2c3..d90a64cc4d0 100644
--- a/content/rancher/v2.x/en/backups/restorations/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/restore/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Restore
 weight: 1010
+aliases:
+  - /rancher/v2.x/en/backups/restorations
 ---
 If you lose the data on your Rancher Server, you can restore it if you have backups stored in a safe location.
 
diff --git a/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md
new file mode 100644
index 00000000000..c0dd69de384
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md
@@ -0,0 +1,6 @@
+---
+title: Kubernetes Installs
+weight: 1
+aliases:
+  - /rancher/v2.x/en/backups/restorations/k8s-restore
+---
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/_index.md
similarity index 93%
rename from content/rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore/_index.md
rename to content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/_index.md
index b7b0ae0457e..472c8a30239 100644
--- a/content/rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/_index.md
@@ -4,6 +4,7 @@ shortTitle: K3s Installs
 weight: 1
 aliases:
   - /rancher/v2.x/en/backups/restorations/k3s-restoration
+  - /rancher/v2.x/en/backups/restorations/k8s-restore/k3s-restore
 ---
 
 When Rancher is installed on a high-availability Kubernetes cluster, we recommend using an external database to store the cluster data.
diff --git a/content/rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore/_index.md
rename to content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/_index.md
index edcb140139b..4826a35171c 100644
--- a/content/rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/_index.md
@@ -5,6 +5,7 @@ weight: 2
 aliases:
   - /rancher/v2.x/en/installation/after-installation/ha-backup-and-restoration/
   - /rancher/v2.x/en/backups/restorations/ha-restoration
+  - /rancher/v2.x/en/backups/restorations/k8s-restore/rke-restore
 ---
 
 This procedure describes how to use RKE to restore a snapshot of the Rancher Kubernetes cluster. 
diff --git a/content/rancher/v2.x/en/backups/restorations/single-node-restoration/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/_index.md
similarity index 98%
rename from content/rancher/v2.x/en/backups/restorations/single-node-restoration/_index.md
rename to content/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/_index.md
index e5f2b67f0c3..ce66594f4fa 100644
--- a/content/rancher/v2.x/en/backups/restorations/single-node-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/_index.md
@@ -4,6 +4,7 @@ shortTitle: Docker Installs
 weight: 3
 aliases:
   - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/
+  - /rancher/v2.x/en/backups/restorations/single-node-restoration
 ---
 
 If you encounter a disaster scenario, you can restore your Rancher Server to your most recent backup.
diff --git a/content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md b/content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md
deleted file mode 100644
index 04bab5fb1f0..00000000000
--- a/content/rancher/v2.x/en/backups/restorations/k8s-restore/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Kubernetes Installs
-weight: 1
----
\ No newline at end of file

From 5cd3f450ee43eba1d585c65f6a2000269c4c4434 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 4 Sep 2020 13:29:57 -0700
Subject: [PATCH 199/265] Revert "Document EKS cluster creation changes in
 Rancher v2.5"

This reverts commit 5052893ae08dfa0714b8c3d7b39051934b5aa381.
---
 .../hosted-kubernetes-clusters/eks/_index.md  | 113 ------------------
 1 file changed, 113 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index 29db4557005..1375d4f33bf 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -73,121 +73,8 @@ Use Rancher to set up and configure your Kubernetes cluster.
 
 # EKS Cluster Configuration Reference
 
-### Changes in Rancher v2.5
-
-More EKS options can be configured when you create an EKS cluster in Rancher, including the following:
-
-- Managed node groups
-- The Kubernetes Cluster Autoscaler
-- Control plane logging
-- Secrets encryption with KMS
-
-The following capabilities have been added for configuring EKS clusters in Rancher:
-
-- GPU support
-- Automatically update AMIs
-- Add new nodes
-- Upgrade nodes
-- Add and remove node groups
-- Disable and enable private access
-- Add restrictions to public access
-- Use your cloud credentials to create the EKS cluster instead of passing in your access key and secret key
-
 {{% tabs %}}
 {{% tab "Rancher v2.5+" %}}
-
-### Account Access
-
-<a id="account-access-2-5"></a>
-
-Complete each drop-down and field using the information obtained for your [IAM policy.](#iam-policy)
-
-| Setting    | Description       |
-| ---------- | -------------------------------------------------------------------------------------------------------------------- |
-| Region     | From the drop-down choose the geographical region in which to build your cluster.                                    |
-| Cloud Credentials | Select the cloud credentials that you created for your [IAM policy.](#iam-policy) For more information on creating cloud credentials in Rancher, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/) |
-
-### Service Role
-
-<a id="service-role-2-5"></a>
-
-Choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
-
-Service Role | Description
--------------|---------------------------
-Standard: Rancher generated service role | If you choose this role, Rancher automatically adds a service role for use with the cluster.
-Custom: Choose from your existing service roles | If you choose this role, Rancher lets you choose from service roles that you're already created within AWS. For more information on creating a custom service role in AWS, see the [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role).
-
-### Secrets Encryption
-
-<a id="secrets-encryption-2-5"></a>
-
-Optional: To encrypt secrets, select or enter a key created in [AWS Key Management Service (KMS)](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
-
-### API Server Endpoint Access
-
-<a id="api-server-endpoint-access-2-5"></a>
-
-Configuring Public/Private API access is an advanced use case. For details, refer to the EKS cluster endpoint access control [documentation.](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)
-
-### Public Access Endpoints
-
-<a id="public-access-endpoints-2-5"></a>
-
-Optionally limit access to the public endpoint via explicit CIDR blocks. If you limit access to specific CIDR blocks, then it is recommended that you also enable the private access to avoid losing network communication to the cluster.
-
-For more information about public and private access to the cluster endpoint, refer to the [Amazon EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)
-
-### Subnet
-
-<a id="subnet-2-5"></a>
-
-| Option | Description |
-| ------- | ------------ |
-| Standard: Rancher generated VPC and Subnet | While provisioning your cluster, Rancher generates a new VPC and Subnet. |
-| Custom: Choose from your existing VPC and Subnets | While provisioning your cluster, Rancher configures your nodes to use a VPC and Subnet that you've already [created in AWS](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html).  |
-
- For more information, refer to the AWS documentation for [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html). Follow one of the sets of instructions below based on your selection from the previous step.
-
-- [What Is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
-- [VPCs and Subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)
-
-### Security Group
-
-<a id="security-group-2-5"></a>
-
-Amazon Documentation:
-
-- [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html)
-- [Security Groups for Your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
-- [Create a Security Group](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html#getting-started-create-security-group)
-
-### Logging
-
-<a id="logging-2-5"></a>
-
-Configure control plane logs to send to Amazon CloudWatch. You are charged the standard CloudWatch Logs data ingestion and storage costs for any logs sent to CloudWatch Logs from your clusters.
-
-Each log type corresponds to a component of the Kubernetes control plane. To learn more about these components, see [Kubernetes Components](https://kubernetes.io/docs/concepts/overview/components/) in the Kubernetes documentation.
-
-For more information on EKS control plane logging, refer to the official [documentation.](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
-
-### Managed Node Groups
-
-<a id="managed-node-groups-2-5"></a>
-
-Amazon EKS managed node groups automate the provisioning and lifecycle management of nodes (Amazon EC2 instances) for Amazon EKS Kubernetes clusters. 
-
-For more information about how node groups work and how they are configured, refer to the [EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html)
-
-Amazon will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the Kubernetes version. You can configure whether the AMI has GPU enabled.
-
-| Option | Description |
-| ------- | ------------ |
-| Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning. |
-| Maximum ASG Size | The maximum number of instances. This setting won't take effect until the [Cluster Autoscaler](https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html) is installed. |
-| Minimum ASG Size | The minimum number of instances. This setting won't take effect until the [Cluster Autoscaler](https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html) is installed. |
-
 {{% /tab %}}
 {{% tab "Rancher prior to v2.5" %}}
 

From a9558bb6372764450e081c6949e598aae5793385 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 4 Sep 2020 13:59:05 -0700
Subject: [PATCH 200/265] Add page for Longhorn storage

---
 content/rancher/v2.x/en/api/_index.md             | 2 +-
 content/rancher/v2.x/en/cli/_index.md             | 2 +-
 content/rancher/v2.x/en/contributing/_index.md    | 2 +-
 content/rancher/v2.x/en/faq/_index.md             | 2 +-
 content/rancher/v2.x/en/longhorn/_index.md        | 6 ++++++
 content/rancher/v2.x/en/security/_index.md        | 2 +-
 content/rancher/v2.x/en/system-tools/_index.md    | 2 +-
 content/rancher/v2.x/en/troubleshooting/_index.md | 2 +-
 content/rancher/v2.x/en/user-settings/_index.md   | 2 +-
 content/rancher/v2.x/en/v1.6-migration/_index.md  | 2 +-
 10 files changed, 15 insertions(+), 9 deletions(-)
 create mode 100644 content/rancher/v2.x/en/longhorn/_index.md

diff --git a/content/rancher/v2.x/en/api/_index.md b/content/rancher/v2.x/en/api/_index.md
index ed20589ce7c..66d9a267b71 100644
--- a/content/rancher/v2.x/en/api/_index.md
+++ b/content/rancher/v2.x/en/api/_index.md
@@ -1,6 +1,6 @@
 ---
 title: API
-weight: 23
+weight: 24
 ---
 
 ## How to use the API
diff --git a/content/rancher/v2.x/en/cli/_index.md b/content/rancher/v2.x/en/cli/_index.md
index ce2e5e14463..69d6f7a1805 100644
--- a/content/rancher/v2.x/en/cli/_index.md
+++ b/content/rancher/v2.x/en/cli/_index.md
@@ -3,7 +3,7 @@ title: Using the Rancher Command Line Interface
 description: The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI
 metaTitle: "Using the Rancher Command Line Interface "
 metaDescription: "The Rancher CLI is a unified tool that you can use to interact with Rancher. With it, you can operate Rancher using a command line interface rather than the GUI"
-weight: 20
+weight: 21
 ---
 
 The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI.
diff --git a/content/rancher/v2.x/en/contributing/_index.md b/content/rancher/v2.x/en/contributing/_index.md
index 3e9f1b0f4a3..ab70037540f 100644
--- a/content/rancher/v2.x/en/contributing/_index.md
+++ b/content/rancher/v2.x/en/contributing/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Contributing to Rancher
-weight: 26
+weight: 27
 aliases:
   - /rancher/v2.x/en/faq/contributing/
 ---
diff --git a/content/rancher/v2.x/en/faq/_index.md b/content/rancher/v2.x/en/faq/_index.md
index db87829e1f9..de15dd4cb78 100644
--- a/content/rancher/v2.x/en/faq/_index.md
+++ b/content/rancher/v2.x/en/faq/_index.md
@@ -1,6 +1,6 @@
 ---
 title: FAQ
-weight: 24
+weight: 25
 aliases:
   - /rancher/v2.x/en/about/
 ---
diff --git a/content/rancher/v2.x/en/longhorn/_index.md b/content/rancher/v2.x/en/longhorn/_index.md
new file mode 100644
index 00000000000..348afd30d1d
--- /dev/null
+++ b/content/rancher/v2.x/en/longhorn/_index.md
@@ -0,0 +1,6 @@
+---
+title: Longhorn Storage
+weight: 19
+---
+
+> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/_index.md b/content/rancher/v2.x/en/security/_index.md
index 86101062333..8f99fc5b739 100644
--- a/content/rancher/v2.x/en/security/_index.md
+++ b/content/rancher/v2.x/en/security/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Security
-weight: 19
+weight: 20
 ---
 
 <table width="100%">
diff --git a/content/rancher/v2.x/en/system-tools/_index.md b/content/rancher/v2.x/en/system-tools/_index.md
index 78ba660c9af..b1dab07c826 100644
--- a/content/rancher/v2.x/en/system-tools/_index.md
+++ b/content/rancher/v2.x/en/system-tools/_index.md
@@ -1,6 +1,6 @@
 ---
 title: System Tools
-weight: 21
+weight: 22
 ---
 
 System Tools is a tool to perform operational tasks on [Rancher Launched Kubernetes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/) clusters or [installations of Rancher on an RKE cluster.]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/) The tasks include:
diff --git a/content/rancher/v2.x/en/troubleshooting/_index.md b/content/rancher/v2.x/en/troubleshooting/_index.md
index 62ab028174e..fc5f9154c7a 100644
--- a/content/rancher/v2.x/en/troubleshooting/_index.md
+++ b/content/rancher/v2.x/en/troubleshooting/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Troubleshooting
-weight: 25
+weight: 26
 ---
 
 This section contains information to help you troubleshoot issues when using Rancher.
diff --git a/content/rancher/v2.x/en/user-settings/_index.md b/content/rancher/v2.x/en/user-settings/_index.md
index e0d1962706b..ba1a3bc6d64 100644
--- a/content/rancher/v2.x/en/user-settings/_index.md
+++ b/content/rancher/v2.x/en/user-settings/_index.md
@@ -1,6 +1,6 @@
 ---
 title: User Settings
-weight: 22
+weight: 23
 aliases:
   - /rancher/v2.x/en/tasks/user-settings/
 ---
diff --git a/content/rancher/v2.x/en/v1.6-migration/_index.md b/content/rancher/v2.x/en/v1.6-migration/_index.md
index 0eee1e2bd5b..27bb78e7b32 100644
--- a/content/rancher/v2.x/en/v1.6-migration/_index.md
+++ b/content/rancher/v2.x/en/v1.6-migration/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Migrating from v1.6 to v2.x
-weight: 27
+weight: 28
 ---
 
 Rancher v2.x has been rearchitected and rewritten with the goal of providing a complete management solution for Kubernetes and Docker.  Due to these extensive changes, there is no direct upgrade path from v1.6 to v2.x, but rather a migration of your v1.6 services into v2.x as Kubernetes workloads.  In v1.6, the most common orchestration used was Rancher's own engine called Cattle. The following guide explains and educates our Cattle users on running workloads in a Kubernetes environment.

From b1e261651e7a71adb403b252e81e7b3d3c1b6f11 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 4 Sep 2020 18:45:10 -0700
Subject: [PATCH 201/265] Update docker install command for Rancher 2.5

---
 .../air-gap/install-rancher/_index.md         |  13 +
 .../single-node-docker/_index.md              |  16 +
 .../single-node-docker/advanced/_index.md     |  12 +
 .../single-node-docker/proxy/_index.md        |   3 +
 .../single-node-rollbacks/_index.md           |   7 +-
 .../single-node-upgrades/_index.md            |  19 +
 .../quickstart-manual-setup/_index.md         |   2 +-
 .../upgrades/upgrades/single-node/_index.md   | 332 ++++++++++++++++++
 8 files changed, 402 insertions(+), 2 deletions(-)
 create mode 100644 content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md

diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index 80281d3e061..f8096d2c2cf 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -12,6 +12,10 @@ This section is about how to deploy Rancher for your air gapped environment. An
 
 > **Note:** These installation instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/installation/options/air-gap-helm2) provides a copy of the older air gap installation instructions for Rancher installed on Kubernetes with Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
 
+### Privileged Access for Rancher v2.5+
+
+When the Rancher server is deployed in the Docker container, a local Kubernetes cluster is installed within the container, then Rancher is deployed on the cluster. Because privileged access is required to run containers within containers, you will need to install Rancher with the `--privileged` option in order to access many features of Rancher, including deploying pods on the local Kubernetes cluster.
+
 {{% tabs %}}
 {{% tab "Kubernetes Install (Recommended)" %}}
 
@@ -252,11 +256,14 @@ Log into your Linux host, and then run the installation command below. When ente
 | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
 | `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
 
+As of Rancher v2.5, privileged access is [required.](#privileged-access-for-rancher-v2-5)
+
 ```
 docker run -d --restart=unless-stopped \
     -p 80:80 -p 443:443 \
     -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
     -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    --privileged \
     <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
 ```
 
@@ -282,6 +289,8 @@ After creating your certificate, log into your Linux host, and then run the inst
 | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
 | `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
 
+As of Rancher v2.5, privileged access is [required.](#privileged-access-for-rancher-v2-5)
+
 ```
 docker run -d --restart=unless-stopped \
     -p 80:80 -p 443:443 \
@@ -290,6 +299,7 @@ docker run -d --restart=unless-stopped \
     -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
     -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
     -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    --privileged \
     <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
 ```
 
@@ -312,6 +322,8 @@ After obtaining your certificate, log into your Linux host, and then run the ins
 
 > **Note:** Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
 
+As of Rancher v2.5, privileged access is [required.](#privileged-access-for-rancher-v2-5)
+
 ```
 docker run -d --restart=unless-stopped \
     -p 80:80 -p 443:443 \
@@ -320,6 +332,7 @@ docker run -d --restart=unless-stopped \
     -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
     -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
     -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    --privileged
     <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
 ```
 
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
index 56890fe07da..35e2c65a748 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
@@ -17,6 +17,10 @@ In this installation scenario, you'll install Docker on a single Linux host, and
 > **Want to use an external load balancer?**
 > See [Docker Install with an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/single-node-install-external-lb) instead.
 
+### Privileged Access for Rancher v2.5+
+
+When the Rancher server is deployed in the Docker container, a local Kubernetes cluster is installed within the container, then Rancher is deployed on the cluster. Because privileged access is required to run containers within containers, you will need to install Rancher with the `--privileged` option in order to access many features of Rancher, including deploying pods on the local Kubernetes cluster.
+
 # Requirements for OS, Docker, Hardware, and Networking
 
 Make sure that your node fulfills the general [installation requirements.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
@@ -44,9 +48,12 @@ If you are installing Rancher in a development or testing environment where iden
 
 Log into your Linux host, and then run the minimum installation command below.
 
+As of Rancher v2.5, privileged access is [required.](#privileged-access-for-rancher-v2-5)
+
 ```bash
 docker run -d --restart=unless-stopped \
   -p 80:80 -p 443:443 \
+  --privileged \
   rancher/rancher:latest
 ```
 
@@ -68,12 +75,15 @@ After creating your certificate, run the Docker command below to install Rancher
 | `<PRIVATE_KEY.pem>` | The path to the private key for your certificate.            |
 | `<CA_CERTS.pem>`        | The path to the certificate authority's certificate.         |
 
+As of Rancher v2.5, privileged access is [required.](#privileged-access-for-rancher-v2-5)
+
 ```bash
 docker run -d --restart=unless-stopped \
   -p 80:80 -p 443:443 \
   -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
   -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
   -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
+  --privileged \
   rancher/rancher:latest
 ```
 
@@ -97,12 +107,15 @@ After obtaining your certificate, run the Docker command below.
 | `<FULL_CHAIN.pem>`  | The path to your full certificate chain.                     |
 | `<PRIVATE_KEY.pem>` | The path to the private key for your certificate. |
 
+As of Rancher v2.5, privileged access is [required.](#privileged-access-for-rancher-v2-5)
+
 ```bash
 docker run -d --restart=unless-stopped \
   -p 80:80 -p 443:443 \
   -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
   -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
   rancher/rancher:latest \
+  --privileged \
   --no-cacerts
 ```
 
@@ -124,10 +137,13 @@ After you fulfill the prerequisites, you can install Rancher using a Let's Encry
 | ----------------- | ------------------- |
 | `<YOUR.DNS.NAME>` | Your domain address |
 
+As of Rancher v2.5, privileged access is [required.](#privileged-access-for-rancher-v2-5)
+
 ```
 docker run -d --restart=unless-stopped \
   -p 80:80 -p 443:443 \
   rancher/rancher:latest \
+  --privileged \
   --acme-domain <YOUR.DNS.NAME>
 ```
 
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/_index.md
index 3aa2362b502..8eefb2db503 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/_index.md
@@ -25,11 +25,14 @@ Use the command example to start a Rancher container with your private CA certif
 
 The example below is based on having the CA root certificates in the `/host/certs` directory on the host and mounting this directory on `/container/certs` inside the Rancher container.
 
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
 ```
 docker run -d --restart=unless-stopped \
   -p 80:80 -p 443:443 \
   -v /host/certs:/container/certs \
   -e SSL_CERT_DIR="/container/certs" \
+  --privileged \
   rancher/rancher:latest
 ```
 
@@ -41,11 +44,14 @@ The API Audit Log writes to `/var/log/auditlog` inside the rancher container by
 
 See [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) for more information and options.
 
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
 ```
 docker run -d --restart=unless-stopped \
   -p 80:80 -p 443:443 \
   -v /var/log/rancher/auditlog:/var/log/auditlog \
   -e AUDIT_LEVEL=1 \
+  --privileged \
   rancher/rancher:latest
 ```
 
@@ -59,9 +65,12 @@ To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` a
 docker run -d --restart=unless-stopped \
   -p 80:80 -p 443:443 \
   -e CATTLE_TLS_MIN_VERSION="1.0" \
+  --privileged \
   rancher/rancher:latest
 ```
 
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
 See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options.
 
 ### Air Gap
@@ -89,5 +98,8 @@ To change the host ports mapping, replace the following part `-p 80:80 -p 443:44
 ```
 docker run -d --restart=unless-stopped \
   -p 8080:80 -p 8443:443 \
+  --privileged \
   rancher/rancher:latest
 ```
+
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/_index.md
index da3e4484bfe..100acc4f282 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/_index.md
@@ -35,5 +35,8 @@ docker run -d --restart=unless-stopped \
   -e HTTP_PROXY="http://192.168.10.1:3128" \
   -e HTTPS_PROXY="http://192.168.10.1:3128" \
   -e NO_PROXY="localhost,127.0.0.1,0.0.0.0,10.0.0.0/8,192.168.10.0/24,example.com" \
+  --privileged \
   rancher/rancher:latest
 ```
+
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-rollbacks/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-rollbacks/_index.md
index c74ccc9c9bb..c87b0571c8b 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-rollbacks/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-rollbacks/_index.md
@@ -74,8 +74,13 @@ If you have issues upgrading Rancher, roll it back to its latest known healthy s
 1. Start a new Rancher Server container with the `<PRIOR_RANCHER_VERSION>` tag [placeholder](#before-you-start) pointing to the data container.
     ```
     docker run -d --volumes-from rancher-data \
-    --restart=unless-stopped -p 80:80 -p 443:443 rancher/rancher:<PRIOR_RANCHER_VERSION>
+    --restart=unless-stopped \
+    -p 80:80 -p 443:443 \
+    --privileged \
+    rancher/rancher:<PRIOR_RANCHER_VERSION>
     ```
+    As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+    
     >**Note:** _Do not_ stop the rollback after initiating it, even if the rollback process seems longer than expected. Stopping the rollback may result in database issues during future upgrades.
 
 1.  Wait a few moments and then open Rancher in a web browser. Confirm that the rollback succeeded and that your data is restored.
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md
index ad2babc1fb7..ec0e0c6236f 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/single-node-upgrades/_index.md
@@ -136,9 +136,12 @@ Placeholder | Description
 docker run -d --volumes-from rancher-data \
   --restart=unless-stopped \
   -p 80:80 -p 443:443 \
+  --privileged \
   rancher/rancher:<RANCHER_VERSION_TAG>
 ```
 
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
 {{% /accordion %}}
 
 {{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
@@ -162,9 +165,12 @@ docker run -d --volumes-from rancher-data \
   - /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
   - /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
   - /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
+  --privileged
   rancher/rancher:<RANCHER_VERSION_TAG>
 ```
 
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
 {{% /accordion %}}
 {{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
 
@@ -186,8 +192,11 @@ docker run -d --volumes-from rancher-data \
   - /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
   - /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
   rancher/rancher:<RANCHER_VERSION_TAG> \
+  --privileged \
   --no-cacerts
 ```
+
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
 {{% /accordion %}}
 {{% accordion id="option-d" label="Option D-Let's Encrypt Certificate" %}}
 
@@ -209,10 +218,13 @@ Placeholder | Description
 docker run -d --volumes-from rancher-data \
   --restart=unless-stopped \
   -p 80:80 -p 443:443 \
+  --privileged \
   rancher/rancher:<RANCHER_VERSION_TAG> \
   --acme-domain <YOUR.DNS.NAME>
 ```
 
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
 {{% /accordion %}}
 
 {{% /tab %}}
@@ -239,8 +251,11 @@ Placeholder | Description
       -p 80:80 -p 443:443 \
       -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
       -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+      --privileged \
       <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
 ```
+
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
 {{% /accordion %}}
 
 {{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
@@ -266,8 +281,10 @@ docker run -d --restart=unless-stopped \
     -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
     -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
     -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    --privileged \
     <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
 ```
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
 {{% /accordion %}}
 
 {{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
@@ -295,8 +312,10 @@ docker run -d --volumes-from rancher-data \
      -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
      -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
      -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+     --privileged
      <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
 ```
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
 {{% /accordion %}}
 {{% /tab %}}
 {{% /tabs %}}
diff --git a/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md b/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md
index b4c2457eeaa..f0ee9913026 100644
--- a/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md
+++ b/content/rancher/v2.x/en/quick-start-guide/deployment/quickstart-manual-setup/_index.md
@@ -49,7 +49,7 @@ To install Rancher on your host, connect to it and then use a shell to install.
 2.  From your shell, enter the following command:
 
 	```
-sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 rancher/rancher
+sudo docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged rancher/rancher
 	```
 
 **Result:** Rancher is installed.
diff --git a/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
new file mode 100644
index 00000000000..5ec2e0fe082
--- /dev/null
+++ b/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
@@ -0,0 +1,332 @@
+---
+title: Upgrading Rancher Installed with Docker
+weight: 1010
+aliases:
+  - /rancher/v2.x/en/upgrades/single-node-upgrade/
+  - /rancher/v2.x/en/upgrades/upgrades/single-node-air-gap-upgrade
+---
+
+The following instructions will guide you through upgrading a Rancher server that was installed with Docker.
+
+# Prerequisites
+
+- **Review the [known upgrade issues]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#known-upgrade-issues) and [caveats]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#caveats)** in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
+- **For [air gap installs only,]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) collect and populate images for the new Rancher server version.** Follow the guide to [populate your private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/) with the images for the Rancher version that you want to upgrade to.
+
+# Placeholder Review
+
+During upgrade, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`).
+
+Here's an **example** of a command with a placeholder:
+
+```
+docker stop <RANCHER_CONTAINER_NAME>
+```
+
+In this command, `<RANCHER_CONTAINER_NAME>` is the name of your Rancher container.
+
+Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the upgrade.
+
+<sup>Terminal `docker ps` Command, Displaying Where to Find `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>`</sup>
+![Placeholder Reference]({{<baseurl>}}/img/rancher/placeholder-ref.png)
+
+| Placeholder                | Example                    | Description                                               |
+| -------------------------- | -------------------------- | --------------------------------------------------------- |
+| `<RANCHER_CONTAINER_TAG>`  | `v2.1.3`                   | The rancher/rancher image you pulled for initial install. |
+| `<RANCHER_CONTAINER_NAME>` | `festive_mestorf`          | The name of your Rancher container.                       |
+| `<RANCHER_VERSION>`        | `v2.1.3`                   | The version of Rancher that you're creating a backup for. |
+| `<DATE>`                   | `2018-12-19`               | The date that the data container or backup was created.   |
+<br/>
+
+You can obtain `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>` by logging into your Rancher server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped using a different command: `docker ps -a`. Use these commands for help anytime during while creating backups.
+
+# Upgrade Outline
+
+During upgrade, you create a copy of the data from your current Rancher container and a backup in case something goes wrong. Then you deploy the new version of Rancher in a new container using your existing data. Follow the steps to upgrade Rancher server:
+
+- [A. Create a copy of the data from your Rancher server container](#a-create-a-copy-of-the-data-from-your-rancher-server-container)
+- [B. Create a backup tarball](#b-create-a-backup-tarball)
+- [C. Pull the new Docker image](#c-pull-the-new-docker-image)
+- [D. Start the new Rancher server container](#d-start-the-new-rancher-server-container)
+- [E. Verify the Upgrade](#e-verify-the-upgrade)
+- [F. Clean up your old Rancher server container](#f-clean-up-your-old-rancher-server-container)
+
+### A. Create a copy of the data from your Rancher server container
+
+1. Using a remote Terminal connection, log into the node running your Rancher server.
+
+1. Stop the container currently running Rancher server. Replace `<RANCHER_CONTAINER_NAME>` with the name of your Rancher container.
+
+    ```
+    docker stop <RANCHER_CONTAINER_NAME>
+    ```
+
+1. <a id="backup"></a>Use the command below, replacing each placeholder, to create a data container from the Rancher container that you just stopped.
+
+    ```
+    docker create --volumes-from <RANCHER_CONTAINER_NAME> --name rancher-data rancher/rancher:<RANCHER_CONTAINER_TAG>
+    ```
+
+### B. Create a backup tarball
+
+1. <a id="tarball"></a>From the data container that you just created (`rancher-data`), create a backup tarball (`rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`).
+
+    This tarball will serve as a rollback point if something goes wrong during upgrade. Use the following command, replacing each [placeholder](#before-you-start).
+
+
+    ```
+    docker run --volumes-from rancher-data -v $PWD:/backup busybox tar zcvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz /var/lib/rancher
+    ```
+
+    **Step Result:** When you enter this command, a series of commands should run.
+
+1. Enter the `ls` command to confirm that the backup tarball was created. It will have a name similar to `rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`.
+
+    ```
+   [rancher@ip-10-0-0-50 ~]$ ls
+   rancher-data-backup-v2.1.3-20181219.tar.gz
+    ```
+
+1. Move your backup tarball to a safe location external from your Rancher server.
+
+### C. Pull the New Docker Image
+
+Pull the image of the Rancher version that you want to upgrade to.
+
+Placeholder | Description
+------------|-------------
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
+
+```
+docker pull rancher/rancher:<RANCHER_VERSION_TAG>
+```
+
+### D. Start the New Rancher Server Container
+
+Start a new Rancher server container using the data from the `rancher-data` container. Remember to pass in all the environment variables that you had used when you started the original container.
+
+>**Important:** _Do not_ stop the upgrade after initiating it, even if the upgrade process seems longer than expected. Stopping the upgrade may result in database migration errors during future upgrades.
+
+If you used a proxy, see [HTTP Proxy Configuration.]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/)
+
+If you configured a custom CA root certificate to access your services, see [Custom CA root certificate.]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/#custom-ca-certificate)
+
+If you are recording all transactions with the Rancher API, see [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/#api-audit-log)
+
+To see the command to use when starting the new Rancher server container, choose from the following options:
+
+- Docker Upgrade
+- Docker Upgrade for Air Gap Installs
+
+{{% tabs %}}
+{{% tab "Docker Upgrade" %}}
+
+Select which option you had installed Rancher server
+
+{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
+
+If you have selected to use the Rancher generated self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container.
+
+Placeholder | Description
+------------|-------------
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
+
+```
+docker run -d --volumes-from rancher-data \
+  --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  --privileged \
+  rancher/rancher:<RANCHER_VERSION_TAG>
+```
+
+{{% /accordion %}}
+
+{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
+
+If you have selected to bring your own self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificate that you had originally installed with.
+
+>**Reminder of the Cert Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
+
+Placeholder | Description
+------------|-------------
+ `<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
+`<FULL_CHAIN.pem>` | The path to your full certificate chain.
+`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
+`<CA_CERTS.pem>` | The path to the certificate authority's certificate.
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
+
+```
+docker run -d --volumes-from rancher-data \
+  --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+  -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
+  --privileged \
+  rancher/rancher:<RANCHER_VERSION_TAG>
+```
+
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
+{{% /accordion %}}
+{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
+
+If you have selected to use a certificate signed by a recognized CA, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificates that you had originally installed with. Remember to include `--no-cacerts` as an argument to the container to disable the default CA certificate generated by Rancher.
+
+>**Reminder of the Cert Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates provided by the recognized CA. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
+
+Placeholder | Description
+------------|-------------
+`<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
+`<FULL_CHAIN.pem>` | The path to your full certificate chain.
+`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
+
+```
+docker run -d --volumes-from rancher-data \
+  --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+  rancher/rancher:<RANCHER_VERSION_TAG> \
+  --privileged \
+  --no-cacerts
+```
+{{% /accordion %}}
+{{% accordion id="option-d" label="Option D-Let's Encrypt Certificate" %}}
+
+>**Remember:** Let's Encrypt provides rate limits for requesting new certificates. Therefore, limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/).
+
+If you have selected to use [Let's Encrypt](https://letsencrypt.org/) certificates, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to provide the domain that you had used when you originally installed Rancher.
+
+>**Reminder of the Cert Prerequisites:**
+>
+>- Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example).
+>- Open port `TCP/80` on your Linux host. The Let's Encrypt http-01 challenge can come from any source IP address, so port `TCP/80` must be open to all IP addresses.
+
+Placeholder | Description
+------------|-------------
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
+`<YOUR.DNS.NAME>` | The domain address that you had originally started with
+
+```
+docker run -d --volumes-from rancher-data \
+  --restart=unless-stopped \
+  -p 80:80 -p 443:443 \
+  --privileged \
+  rancher/rancher:<RANCHER_VERSION_TAG> \
+  --acme-domain <YOUR.DNS.NAME>
+```
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+
+{{% /accordion %}}
+
+{{% /tab %}}
+{{% tab "Docker Air Gap Upgrade" %}}
+
+For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
+
+> For Rancher versions from v2.2.0 to v2.2.x, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach. Then, after Rancher is installed, you will need to configure Rancher to use that repository. For details, refer to the documentation on [setting up the system charts for Rancher prior to v2.3.0.]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0)
+
+When starting the new Rancher server container, choose from the following options:
+
+{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
+
+If you have selected to use the Rancher generated self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container.
+
+Placeholder | Description
+------------|-------------
+`<REGISTRY.YOURDOMAIN.COM:PORT>` |  Your private registry URL and port.
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to to upgrade to.
+
+```
+  docker run -d --volumes-from rancher-data \
+      --restart=unless-stopped \
+      -p 80:80 -p 443:443 \
+      -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
+      -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+      --privileged
+      <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
+```
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+{{% /accordion %}}
+
+{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
+
+If you have selected to bring your own self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificate that you had originally installed with.
+
+>**Reminder of the Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
+
+Placeholder | Description
+------------|-------------
+`<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
+`<FULL_CHAIN.pem>` | The path to your full certificate chain.
+`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
+`<CA_CERTS.pem>` | The path to the certificate authority's certificate.
+`<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
+
+```
+docker run -d --restart=unless-stopped \
+    -p 80:80 -p 443:443 \
+    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+    -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
+    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
+    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+    --privileged \
+    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
+```
+{{% /accordion %}}
+
+{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
+
+If you have selected to use a certificate signed by a recognized CA, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificates that you had originally installed with.
+
+ >**Reminder of the Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates provided by the recognized CA. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
+
+Placeholder | Description
+------------|-------------
+`<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
+`<FULL_CHAIN.pem>` | The path to your full certificate chain.
+`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
+`<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.
+`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
+
+> **Note:**  Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
+
+```
+docker run -d --volumes-from rancher-data \
+    --restart=unless-stopped \
+     -p 80:80 -p 443:443 \
+     --no-cacerts \
+     -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
+     -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
+     -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
+     -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
+     --privileged \
+     <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
+```
+As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
+{{% /accordion %}}
+{{% /tab %}}
+{{% /tabs %}}
+
+**Result:** You have upgraded Rancher. Data from your upgraded server is now saved to the `rancher-data` container for use in future upgrades.
+
+### E. Verify the Upgrade
+
+Log into Rancher. Confirm that the upgrade succeeded by checking the version displayed in the bottom-left corner of the browser window.
+
+>**Having network issues in your user clusters following upgrade?**
+>
+> See [Restoring Cluster Networking]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking).
+
+
+### F. Clean up Your Old Rancher Server Container
+
+Remove the previous Rancher server container. If you only stop the previous Rancher server container (and don't remove it), the container may restart after the next server reboot.
+
+## Rolling Back
+
+If your upgrade does not complete successfully, you can roll back Rancher server and its data back to its last healthy state. For more information, see [Docker Rollback]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/).

From f55065b5d080e89af438ece5ce0decc466ea8d2f Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 9 Sep 2020 09:17:58 -0700
Subject: [PATCH 202/265] Rephrase explanation of --privileged requirement

Co-authored-by: Caleb Bron <cbron@users.noreply.github.com>
---
 .../air-gap/install-rancher/_index.md                           | 2 +-
 .../other-installation-methods/single-node-docker/_index.md     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
index f8096d2c2cf..a7393895f68 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/_index.md
@@ -14,7 +14,7 @@ This section is about how to deploy Rancher for your air gapped environment. An
 
 ### Privileged Access for Rancher v2.5+
 
-When the Rancher server is deployed in the Docker container, a local Kubernetes cluster is installed within the container, then Rancher is deployed on the cluster. Because privileged access is required to run containers within containers, you will need to install Rancher with the `--privileged` option in order to access many features of Rancher, including deploying pods on the local Kubernetes cluster.
+When the Rancher server is deployed in the Docker container, a local Kubernetes cluster is installed within the container for Rancher to use. Because many features of Rancher run as deployments, and privileged mode is required to run containers within containers, you will need to install Rancher with the `--privileged` option.
 
 {{% tabs %}}
 {{% tab "Kubernetes Install (Recommended)" %}}
diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
index 35e2c65a748..1136fac80da 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/_index.md
@@ -19,7 +19,7 @@ In this installation scenario, you'll install Docker on a single Linux host, and
 
 ### Privileged Access for Rancher v2.5+
 
-When the Rancher server is deployed in the Docker container, a local Kubernetes cluster is installed within the container, then Rancher is deployed on the cluster. Because privileged access is required to run containers within containers, you will need to install Rancher with the `--privileged` option in order to access many features of Rancher, including deploying pods on the local Kubernetes cluster.
+When the Rancher server is deployed in the Docker container, a local Kubernetes cluster is installed within the container for Rancher to use. Because many features of Rancher run as deployments, and privileged mode is required to run containers within containers, you will need to install Rancher with the `--privileged` option.
 
 # Requirements for OS, Docker, Hardware, and Networking
 

From 22cdd4f02f568e81bc02042213d49d1728b96bd6 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 9 Sep 2020 11:32:41 -0700
Subject: [PATCH 203/265] Delete files that were already moved to installation
 section

---
 .../upgrades/upgrades/single-node/_index.md   | 332 ------------------
 1 file changed, 332 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md

diff --git a/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md b/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
deleted file mode 100644
index 5ec2e0fe082..00000000000
--- a/content/rancher/v2.x/en/upgrades/upgrades/single-node/_index.md
+++ /dev/null
@@ -1,332 +0,0 @@
----
-title: Upgrading Rancher Installed with Docker
-weight: 1010
-aliases:
-  - /rancher/v2.x/en/upgrades/single-node-upgrade/
-  - /rancher/v2.x/en/upgrades/upgrades/single-node-air-gap-upgrade
----
-
-The following instructions will guide you through upgrading a Rancher server that was installed with Docker.
-
-# Prerequisites
-
-- **Review the [known upgrade issues]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#known-upgrade-issues) and [caveats]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/#caveats)** in the Rancher documentation for the most noteworthy issues to consider when upgrading Rancher. A more complete list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
-- **For [air gap installs only,]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap) collect and populate images for the new Rancher server version.** Follow the guide to [populate your private registry]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/) with the images for the Rancher version that you want to upgrade to.
-
-# Placeholder Review
-
-During upgrade, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`).
-
-Here's an **example** of a command with a placeholder:
-
-```
-docker stop <RANCHER_CONTAINER_NAME>
-```
-
-In this command, `<RANCHER_CONTAINER_NAME>` is the name of your Rancher container.
-
-Cross reference the image and reference table below to learn how to obtain this placeholder data. Write down or copy this information before starting the upgrade.
-
-<sup>Terminal `docker ps` Command, Displaying Where to Find `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>`</sup>
-![Placeholder Reference]({{<baseurl>}}/img/rancher/placeholder-ref.png)
-
-| Placeholder                | Example                    | Description                                               |
-| -------------------------- | -------------------------- | --------------------------------------------------------- |
-| `<RANCHER_CONTAINER_TAG>`  | `v2.1.3`                   | The rancher/rancher image you pulled for initial install. |
-| `<RANCHER_CONTAINER_NAME>` | `festive_mestorf`          | The name of your Rancher container.                       |
-| `<RANCHER_VERSION>`        | `v2.1.3`                   | The version of Rancher that you're creating a backup for. |
-| `<DATE>`                   | `2018-12-19`               | The date that the data container or backup was created.   |
-<br/>
-
-You can obtain `<RANCHER_CONTAINER_TAG>` and `<RANCHER_CONTAINER_NAME>` by logging into your Rancher server by remote connection and entering the command to view the containers that are running: `docker ps`. You can also view containers that are stopped using a different command: `docker ps -a`. Use these commands for help anytime during while creating backups.
-
-# Upgrade Outline
-
-During upgrade, you create a copy of the data from your current Rancher container and a backup in case something goes wrong. Then you deploy the new version of Rancher in a new container using your existing data. Follow the steps to upgrade Rancher server:
-
-- [A. Create a copy of the data from your Rancher server container](#a-create-a-copy-of-the-data-from-your-rancher-server-container)
-- [B. Create a backup tarball](#b-create-a-backup-tarball)
-- [C. Pull the new Docker image](#c-pull-the-new-docker-image)
-- [D. Start the new Rancher server container](#d-start-the-new-rancher-server-container)
-- [E. Verify the Upgrade](#e-verify-the-upgrade)
-- [F. Clean up your old Rancher server container](#f-clean-up-your-old-rancher-server-container)
-
-### A. Create a copy of the data from your Rancher server container
-
-1. Using a remote Terminal connection, log into the node running your Rancher server.
-
-1. Stop the container currently running Rancher server. Replace `<RANCHER_CONTAINER_NAME>` with the name of your Rancher container.
-
-    ```
-    docker stop <RANCHER_CONTAINER_NAME>
-    ```
-
-1. <a id="backup"></a>Use the command below, replacing each placeholder, to create a data container from the Rancher container that you just stopped.
-
-    ```
-    docker create --volumes-from <RANCHER_CONTAINER_NAME> --name rancher-data rancher/rancher:<RANCHER_CONTAINER_TAG>
-    ```
-
-### B. Create a backup tarball
-
-1. <a id="tarball"></a>From the data container that you just created (`rancher-data`), create a backup tarball (`rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`).
-
-    This tarball will serve as a rollback point if something goes wrong during upgrade. Use the following command, replacing each [placeholder](#before-you-start).
-
-
-    ```
-    docker run --volumes-from rancher-data -v $PWD:/backup busybox tar zcvf /backup/rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz /var/lib/rancher
-    ```
-
-    **Step Result:** When you enter this command, a series of commands should run.
-
-1. Enter the `ls` command to confirm that the backup tarball was created. It will have a name similar to `rancher-data-backup-<RANCHER_VERSION>-<DATE>.tar.gz`.
-
-    ```
-   [rancher@ip-10-0-0-50 ~]$ ls
-   rancher-data-backup-v2.1.3-20181219.tar.gz
-    ```
-
-1. Move your backup tarball to a safe location external from your Rancher server.
-
-### C. Pull the New Docker Image
-
-Pull the image of the Rancher version that you want to upgrade to.
-
-Placeholder | Description
-------------|-------------
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
-
-```
-docker pull rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-### D. Start the New Rancher Server Container
-
-Start a new Rancher server container using the data from the `rancher-data` container. Remember to pass in all the environment variables that you had used when you started the original container.
-
->**Important:** _Do not_ stop the upgrade after initiating it, even if the upgrade process seems longer than expected. Stopping the upgrade may result in database migration errors during future upgrades.
-
-If you used a proxy, see [HTTP Proxy Configuration.]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/proxy/)
-
-If you configured a custom CA root certificate to access your services, see [Custom CA root certificate.]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/#custom-ca-certificate)
-
-If you are recording all transactions with the Rancher API, see [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/advanced/#api-audit-log)
-
-To see the command to use when starting the new Rancher server container, choose from the following options:
-
-- Docker Upgrade
-- Docker Upgrade for Air Gap Installs
-
-{{% tabs %}}
-{{% tab "Docker Upgrade" %}}
-
-Select which option you had installed Rancher server
-
-{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
-
-If you have selected to use the Rancher generated self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container.
-
-Placeholder | Description
-------------|-------------
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
-
-```
-docker run -d --volumes-from rancher-data \
-  --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  --privileged \
-  rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-
-{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
-
-If you have selected to bring your own self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificate that you had originally installed with.
-
->**Reminder of the Cert Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-Placeholder | Description
-------------|-------------
- `<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
-`<FULL_CHAIN.pem>` | The path to your full certificate chain.
-`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
-`<CA_CERTS.pem>` | The path to the certificate authority's certificate.
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
-
-```
-docker run -d --volumes-from rancher-data \
-  --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-  -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
-  --privileged \
-  rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
-
-{{% /accordion %}}
-{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
-
-If you have selected to use a certificate signed by a recognized CA, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificates that you had originally installed with. Remember to include `--no-cacerts` as an argument to the container to disable the default CA certificate generated by Rancher.
-
->**Reminder of the Cert Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates provided by the recognized CA. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-Placeholder | Description
-------------|-------------
-`<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
-`<FULL_CHAIN.pem>` | The path to your full certificate chain.
-`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
-
-```
-docker run -d --volumes-from rancher-data \
-  --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-  -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-  rancher/rancher:<RANCHER_VERSION_TAG> \
-  --privileged \
-  --no-cacerts
-```
-{{% /accordion %}}
-{{% accordion id="option-d" label="Option D-Let's Encrypt Certificate" %}}
-
->**Remember:** Let's Encrypt provides rate limits for requesting new certificates. Therefore, limit how often you create or destroy the container. For more information, see [Let's Encrypt documentation on rate limits](https://letsencrypt.org/docs/rate-limits/).
-
-If you have selected to use [Let's Encrypt](https://letsencrypt.org/) certificates, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to provide the domain that you had used when you originally installed Rancher.
-
->**Reminder of the Cert Prerequisites:**
->
->- Create a record in your DNS that binds your Linux host IP address to the hostname that you want to use for Rancher access (`rancher.mydomain.com` for example).
->- Open port `TCP/80` on your Linux host. The Let's Encrypt http-01 challenge can come from any source IP address, so port `TCP/80` must be open to all IP addresses.
-
-Placeholder | Description
-------------|-------------
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
-`<YOUR.DNS.NAME>` | The domain address that you had originally started with
-
-```
-docker run -d --volumes-from rancher-data \
-  --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  --privileged \
-  rancher/rancher:<RANCHER_VERSION_TAG> \
-  --acme-domain <YOUR.DNS.NAME>
-```
-As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
-
-{{% /accordion %}}
-
-{{% /tab %}}
-{{% tab "Docker Air Gap Upgrade" %}}
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-> For Rancher versions from v2.2.0 to v2.2.x, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach. Then, after Rancher is installed, you will need to configure Rancher to use that repository. For details, refer to the documentation on [setting up the system charts for Rancher prior to v2.3.0.]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0)
-
-When starting the new Rancher server container, choose from the following options:
-
-{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
-
-If you have selected to use the Rancher generated self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container.
-
-Placeholder | Description
-------------|-------------
-`<REGISTRY.YOURDOMAIN.COM:PORT>` |  Your private registry URL and port.
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to to upgrade to.
-
-```
-  docker run -d --volumes-from rancher-data \
-      --restart=unless-stopped \
-      -p 80:80 -p 443:443 \
-      -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-      -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-      --privileged
-      <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
-{{% /accordion %}}
-
-{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
-
-If you have selected to bring your own self-signed certificate, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificate that you had originally installed with.
-
->**Reminder of the Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-Placeholder | Description
-------------|-------------
-`<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
-`<FULL_CHAIN.pem>` | The path to your full certificate chain.
-`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
-`<CA_CERTS.pem>` | The path to the certificate authority's certificate.
-`<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-    -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    --privileged \
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-{{% /accordion %}}
-
-{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
-
-If you have selected to use a certificate signed by a recognized CA, you add the `--volumes-from rancher-data` to the command that you had started your original Rancher server container and need to have access to the same certificates that you had originally installed with.
-
- >**Reminder of the Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem). In your certificate file, include all intermediate certificates provided by the recognized CA. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-Placeholder | Description
-------------|-------------
-`<CERT_DIRECTORY>` | The path to the directory containing your certificate files.
-`<FULL_CHAIN.pem>` | The path to your full certificate chain.
-`<PRIVATE_KEY.pem>` | The path to the private key for your certificate.
-`<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.
-`<RANCHER_VERSION_TAG>` | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to upgrade to.
-
-> **Note:**  Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
-
-```
-docker run -d --volumes-from rancher-data \
-    --restart=unless-stopped \
-     -p 80:80 -p 443:443 \
-     --no-cacerts \
-     -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-     -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-     -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-     -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-     --privileged \
-     <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-As of Rancher v2.5, privileged access is [required.](../#privileged-access-for-rancher-v2-5)
-{{% /accordion %}}
-{{% /tab %}}
-{{% /tabs %}}
-
-**Result:** You have upgraded Rancher. Data from your upgraded server is now saved to the `rancher-data` container for use in future upgrades.
-
-### E. Verify the Upgrade
-
-Log into Rancher. Confirm that the upgrade succeeded by checking the version displayed in the bottom-left corner of the browser window.
-
->**Having network issues in your user clusters following upgrade?**
->
-> See [Restoring Cluster Networking]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/namespace-migration/#restoring-cluster-networking).
-
-
-### F. Clean up Your Old Rancher Server Container
-
-Remove the previous Rancher server container. If you only stop the previous Rancher server container (and don't remove it), the container may restart after the next server reboot.
-
-## Rolling Back
-
-If your upgrade does not complete successfully, you can roll back Rancher server and its data back to its last healthy state. For more information, see [Docker Rollback]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/single-node-rollbacks/).

From afde1830e5da719b794eedd83dc22da5d4388ebf Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 9 Sep 2020 11:38:06 -0700
Subject: [PATCH 204/265] Change addLocal default value to true in Rancher Helm
 chart config reference

---
 .../v2.x/en/installation/resources/chart-options/_index.md      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
index 0cb9130abd5..d79600fed1b 100644
--- a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
@@ -34,7 +34,7 @@ weight: 2
 | Option                         | Default Value                                         | Description                                                                                                                                       |
 | ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `additionalTrustedCAs`         | false                                                 | `bool` - See [Additional Trusted CAs](#additional-trusted-cas)                                                                                    |
-| `addLocal`                     | "auto"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster)                       |
+| `addLocal`                     | "true"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster)                       |
 | `antiAffinity`                 | "preferred"                                           | `string` - AntiAffinity rule for Rancher pods - "preferred, required"                                                                             |
 | `replicas`                     | 3                                                     | `int` - Number of replicas of Rancher pods                                                                                                        |
 | `auditLog.destination`         | "sidecar"                                             | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath"                                                           |

From 2c2a8079aa76625d902de9c9cdfcd61372923186 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 11 Sep 2020 16:37:29 -0700
Subject: [PATCH 205/265] Say that addLocal should not be turned off for
 Rancher v2.5

---
 .../v2.x/en/installation/resources/chart-options/_index.md  | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
index d79600fed1b..14d25c815de 100644
--- a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
@@ -34,7 +34,7 @@ weight: 2
 | Option                         | Default Value                                         | Description                                                                                                                                       |
 | ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `additionalTrustedCAs`         | false                                                 | `bool` - See [Additional Trusted CAs](#additional-trusted-cas)                                                                                    |
-| `addLocal`                     | "true"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster)                       |
+| `addLocal`                     | "true"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster. For more information, see [Import local Cluster.](#import-local-cluster)  If you turn addLocal off, most Rancher v2.5 features won't work, including the EKS provisioner.                  |
 | `antiAffinity`                 | "preferred"                                           | `string` - AntiAffinity rule for Rancher pods - "preferred, required"                                                                             |
 | `replicas`                     | 3                                                     | `int` - Number of replicas of Rancher pods                                                                                                        |
 | `auditLog.destination`         | "sidecar"                                             | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath"                                                           |
@@ -101,9 +101,11 @@ See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) fo
 
 By default Rancher server will detect and import the `local` cluster it's running on. User with access to the `local` cluster will essentially have "root" access to all the clusters managed by Rancher server.
 
+> **Important:**  If you turn addLocal off, most Rancher v2.5 features won't work, including the EKS provisioner. 
+
 If this is a concern in your environment you can set this option to "false" on your initial install.
 
-> Note: This option is only effective on the initial Rancher install. See [Issue 16522](https://github.com/rancher/rancher/issues/16522) for more information.
+This option is only effective on the initial Rancher install. See [Issue 16522](https://github.com/rancher/rancher/issues/16522) for more information.
 
 ```plain
 --set addLocal="false"

From 844b14238c903fea2bd19cef3c1b0d5eed3162b3 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 4 Sep 2020 15:17:15 -0700
Subject: [PATCH 206/265] Update EKS cluster creation page for Rancher v2.5

---
 .../hosted-kubernetes-clusters/eks/_index.md  | 121 +++++++++++++++++-
 1 file changed, 120 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index 1375d4f33bf..1b2225a2fe9 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -73,8 +73,127 @@ Use Rancher to set up and configure your Kubernetes cluster.
 
 # EKS Cluster Configuration Reference
 
+### Changes in Rancher v2.5
+
+More EKS options can be configured when you create an EKS cluster in Rancher, including the following:
+
+- Managed node groups
+- Desired size, minimum size, maximum size (requires the Cluster Autoscaler to be installed)
+- Control plane logging
+- Secrets encryption with KMS
+
+The following capabilities have been added for configuring EKS clusters in Rancher:
+
+- GPU support
+- Exclusively use managed nodegroups that come with the most up-to-date AMIs
+- Add new nodes
+- Upgrade nodes
+- Add and remove node groups
+- Disable and enable private access
+- Add restrictions to public access
+- Use your cloud credentials to create the EKS cluster instead of passing in your access key and secret key
+
 {{% tabs %}}
 {{% tab "Rancher v2.5+" %}}
+
+### Account Access
+
+<a id="account-access-2-5"></a>
+
+Complete each drop-down and field using the information obtained for your [IAM policy.](#iam-policy)
+
+| Setting    | Description       |
+| ---------- | -------------------------------------------------------------------------------------------------------------------- |
+| Region     | From the drop-down choose the geographical region in which to build your cluster.                                    |
+| Cloud Credentials | Select the cloud credentials that you created for your [IAM policy.](#iam-policy) For more information on creating cloud credentials in Rancher, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/user-settings/cloud-credentials/) |
+
+### Service Role
+
+<a id="service-role-2-5"></a>
+
+Choose a [service role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html).
+
+Service Role | Description
+-------------|---------------------------
+Standard: Rancher generated service role | If you choose this role, Rancher automatically adds a service role for use with the cluster.
+Custom: Choose from your existing service roles | If you choose this role, Rancher lets you choose from service roles that you're already created within AWS. For more information on creating a custom service role in AWS, see the [Amazon documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role).
+
+### Secrets Encryption
+
+<a id="secrets-encryption-2-5"></a>
+
+Optional: To encrypt secrets, select or enter a key created in [AWS Key Management Service (KMS)](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
+
+### API Server Endpoint Access
+
+<a id="api-server-endpoint-access-2-5"></a>
+
+Configuring Public/Private API access is an advanced use case. For details, refer to the EKS cluster endpoint access control [documentation.](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)
+
+### Public Access Endpoints
+
+<a id="public-access-endpoints-2-5"></a>
+
+Optionally limit access to the public endpoint via explicit CIDR blocks.
+
+If you limit access to specific CIDR blocks, then it is recommended that you also enable the private access to avoid losing network communication to the cluster.
+
+One of the following is required to enable private access:
+- Rancher's IP must be part of an allowed CIDR block
+- Private access should be enabled, and Rancher must share a subnet with the cluster and have network access to the cluster, which can be configured with a security group
+
+For more information about public and private access to the cluster endpoint, refer to the [Amazon EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html)
+
+### Subnet
+
+<a id="subnet-2-5"></a>
+
+| Option | Description |
+| ------- | ------------ |
+| Standard: Rancher generated VPC and Subnet | While provisioning your cluster, Rancher generates a new VPC with 3 public subnets. |
+| Custom: Choose from your existing VPC and Subnets | While provisioning your cluster, Rancher configures your Control Plane and nodes to use a VPC and Subnet that you've already [created in AWS](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html).  |
+
+ For more information, refer to the AWS documentation for [Cluster VPC Considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html). Follow one of the sets of instructions below based on your selection from the previous step.
+
+- [What Is Amazon VPC?](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)
+- [VPCs and Subnets](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html)
+
+### Security Group
+
+<a id="security-group-2-5"></a>
+
+Amazon Documentation:
+
+- [Cluster Security Group Considerations](https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html)
+- [Security Groups for Your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
+- [Create a Security Group](https://docs.aws.amazon.com/vpc/latest/userguide/getting-started-ipv4.html#getting-started-create-security-group)
+
+### Logging
+
+<a id="logging-2-5"></a>
+
+Configure control plane logs to send to Amazon CloudWatch. You are charged the standard CloudWatch Logs data ingestion and storage costs for any logs sent to CloudWatch Logs from your clusters.
+
+Each log type corresponds to a component of the Kubernetes control plane. To learn more about these components, see [Kubernetes Components](https://kubernetes.io/docs/concepts/overview/components/) in the Kubernetes documentation.
+
+For more information on EKS control plane logging, refer to the official [documentation.](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
+
+### Managed Node Groups
+
+<a id="managed-node-groups-2-5"></a>
+
+Amazon EKS managed node groups automate the provisioning and lifecycle management of nodes (Amazon EC2 instances) for Amazon EKS Kubernetes clusters. 
+
+For more information about how node groups work and how they are configured, refer to the [EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html)
+
+Amazon will use the [EKS-optimized AMI](https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html) for the Kubernetes version. You can configure whether the AMI has GPU enabled.
+
+| Option | Description |
+| ------- | ------------ |
+| Instance Type | Choose the [hardware specs](https://aws.amazon.com/ec2/instance-types/) for the instance you're provisioning. |
+| Maximum ASG Size | The maximum number of instances. This setting won't take effect until the [Cluster Autoscaler](https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html) is installed. |
+| Minimum ASG Size | The minimum number of instances. This setting won't take effect until the [Cluster Autoscaler](https://docs.aws.amazon.com/eks/latest/userguide/cluster-autoscaler.html) is installed. |
+
 {{% /tab %}}
 {{% tab "Rancher prior to v2.5" %}}
 
@@ -338,4 +457,4 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
         }
     ]
 }
-```
+```
\ No newline at end of file

From 42774e425e17e1f36377277f5f50073024c63161 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 28 Sep 2020 01:28:35 -0700
Subject: [PATCH 207/265] Update rancher-backup docs

---
 content/rancher/v2.x/en/backups/_index.md     | 100 +++++-
 .../v2.x/en/backups/back-up-rancher/_index.md |  58 ++++
 .../v2.x/en/backups/configuration/_index.md   |  10 +
 .../configuration/backup-config/_index.md     | 150 +++++++++
 .../configuration/restore-config/_index.md    |  42 +++
 .../configuration/storage-config/_index.md    | 122 +++++++
 .../v2.x/en/backups/examples/_index.md        | 297 ++++++++++++++++++
 .../rancher/v2.x/en/backups/legacy/_index.md  |   2 +-
 .../en/backups/migrating-rancher/_index.md    |  68 ++++
 .../en/backups/restoring-rancher/_index.md    |  58 ++++
 10 files changed, 905 insertions(+), 2 deletions(-)
 create mode 100644 content/rancher/v2.x/en/backups/back-up-rancher/_index.md
 create mode 100644 content/rancher/v2.x/en/backups/configuration/_index.md
 create mode 100644 content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
 create mode 100644 content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
 create mode 100644 content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
 create mode 100644 content/rancher/v2.x/en/backups/examples/_index.md
 create mode 100644 content/rancher/v2.x/en/backups/migrating-rancher/_index.md
 create mode 100644 content/rancher/v2.x/en/backups/restoring-rancher/_index.md

diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index e73e5d6e32f..8f9b990ec18 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -3,4 +3,102 @@ title: Backups and Disaster Recovery
 weight: 5
 ---
 
-> This section is under construction.
\ No newline at end of file
+In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new server.
+
+- [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
+- [Backup and Restore for Rancher Prior to v2.5](#backup-and-restore-for-rancher-prior-to-v2-5)
+- [How Backups and Restores Work](#how-backups-and-restores-work)
+- [Installing the rancher-backup Operator](#installing-the-rancher-backup-operator)
+  - [Installing rancher-backup with the Rancher UI](#installing-rancher-backup-with-the-rancher-ui)
+  - [Installing rancher-backup with the Helm CLI](#installing-rancher-backup-with-the-helm-cli)
+- [Backing up Rancher](#backing-up-rancher)
+- [Restoring Rancher](#restoring-rancher)
+- [Migrating Rancher to a New Cluster](#migrating-rancher-to-a-new-cluster)
+- [Default Storage Location Configuration](#default-storage-location-configuration)
+  - [Example values.yaml for the rancher-backup Helm Chart](#example-values-yaml-for-the-rancher-backup-helm-chart)
+
+### Changes in Rancher v2.5
+
+The new `rancher-backup` operator allows Rancher to be backed up and restored on any Kubernetes cluster. This application is a Helm chart, and it can be deployed through the Rancher **Apps & Marketplace** page, or by using the Helm CLI.
+
+Previously, the way that cluster data was backed up depended on the type of Kubernetes cluster that was used. 
+
+In Rancher v2.4, it was only supported to install Rancher on two types of Kubernetes clusters: an RKE cluster, or a K3s cluster with an external database. If Rancher was installed on an RKE cluster, [RKE would be used]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/) to take a snapshot of the etcd database and restore the cluster. If Rancher was installed on a K3s cluster with an external database, the database would need to be backed up and restored using the upstream documentation for the database.
+
+In Rancher v2.5, it is now supported to install Rancher hosted Kubernetes clusters, such as Amazon EKS clusters, which do not expose etcd to a degree that would allow snapshots to be created by an external tool. etcd doesn't need to be exposed for `rancher-backup` to work, because the operator gathers resources by making calls to `kube-apiserver`.
+
+### Backup and Restore for Rancher Prior to v2.5
+
+For Rancher prior to v2.5, the way that Rancher is backed up and restored differs based on the way that Rancher was installed. Our legacy backup and restore documentation is here:
+
+- For Rancher installed on an RKE Kubernetes cluster, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/) documentation.
+- For Rancher installed on a K3s Kubernetes cluster, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/) documentation.
+- For Rancher installed with Docker, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/single-node-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/) documentation.
+
+### How Backups and Restores Work
+
+The `rancher-backup` operator introduces three custom resources: Backups, Restores, and ResourceSets. The following cluster-scoped custom resource definitions are added to the cluster:
+
+- `backups.resources.cattle.io`
+- `resourcesets.resources.cattle.io`
+- `restores.resources.cattle.io`
+
+The ResourceSet defines which Kubernetes resources need to be backed up. The ResourceSet is not available to be configured in the Rancher UI because the values required to back up Rancher are predefined.
+
+When a Backup custom resource is created, the `rancher-backup` operator calls the `kube-apiserver` to get the resources in the ResourceSet (specifically, the predefined `rancher-resource-set`) that the Backup custom resource refers to.
+
+The operator then creates the backup file in the .tar.gz format and stores it in the location configured in the Backup resource.
+
+When a Restore custom resource is created, the operator accesses the backup .tar.gz file specified by the Restore, and restores the application from that file.
+
+The Backup and Restore custom resources can be created in the Rancher UI, or by using `kubectl apply`.
+
+# Installing the rancher-backup Operator
+
+The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server.
+
+### Installing rancher-backup with the Rancher UI
+
+1. In the Rancher UI, go to the **Cluster Explorer.**
+1. Click **Apps.**
+1. Click the `rancher-backup` operator.
+1. Optional: Configure the default storage location. For help, refer to the [configuration section.](./configuration/storage-config)
+
+**Result:** The `rancher-backup` operator is installed.
+
+From the **Cluster Explorer,** you can see the `rancher-backup` operator listed under **Deployments.**
+
+To configure the backup app in Rancher, click **Cluster Explorer** in the upper left corner and click **Rancher Backups.**
+
+### Installing rancher-backup with the Helm CLI
+
+Install the backup app as a Helm chart:
+
+```
+helm repo add rancherchart https://charts.rancher.io
+helm repo update
+helm install rancher-backup-crd rancherchart/rancher-backup-crd -n cattle-resources-system --create-namespace
+helm install rancher-backup rancherchart/rancher-backup -n cattle-resources-system
+```
+
+# Backing up Rancher
+
+A backup is performed by creating a Backup custom resource. For a tutorial, refer to [this page.](../back-up-rancher)
+
+# Restoring Rancher
+
+A restore is performed by creating a Restore custom resource. For a tutorial, refer to [this page.](../restoring-rancher)
+
+# Migrating Rancher to a New Cluster
+
+A migration is performed by following [these steps.](../migrating-rancher)
+
+# Default Storage Location Configuration
+
+Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible or Minio object store.
+
+For information on configuring these options, refer to [this page.](../storage-config)
+
+### Example values.yaml for the rancher-backup Helm Chart
+
+The example [values.yaml file](../example-values) can be used to configure the `rancher-backup` operator when the Helm CLI is used to install it.
diff --git a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
new file mode 100644
index 00000000000..d142f7ccffc
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
@@ -0,0 +1,58 @@
+---
+title: Backing up Rancher
+weight: 1
+---
+
+In this section, you'll learn how to back up Rancher.
+
+### 1. Install the `rancher-backup` operator
+
+The backup storage location is an operator-level setting, so it needs to be configured when `rancher-backup` is installed or upgraded.
+
+Backups are created as .tar.gz files. These files can be pushed to S3 or Minio, or they can be stored in a persistent volume.
+
+1. In the Rancher UI, go to the **Cluster Explorer.**
+1. Click **Apps.**
+1. Click `rancher-backup`.
+1. Configure the default storage location. For help, refer to the [storage configuration section.](#configuring-the-storage-location)
+
+### 2. Perform a Backup
+
+To perform a backup, a custom resource of type Backup must be created.
+
+1. In the **Cluster Explorer,** go to the dropdown menu in the upper left corner and click **Rancher Backups.**
+1. Click **Backup.**
+1. Create the Backup with the form, or with YAML. For this example, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3:
+
+    ```yaml
+    apiVersion: resources.cattle.io/v1
+    kind: Backup
+    metadata:
+      name: test-s3-recurring-backup
+    spec:
+      storageLocation:
+        s3:
+          credentialSecretName: s3-creds
+          credentialSecretNamespace: default
+          bucketName: rajashree-backup-test
+          folder: ecm1
+          region: us-west-2
+          endpoint: s3.us-west-2.amazonaws.com
+      resourceSetName: rancher-resource-set
+      encryptionConfigSecretName: test-encryptionconfig
+      schedule: "@every 2m"
+      retentionCount: 3
+      ```
+
+
+
+
+
+    For help configuring the Backup, refer to the [configuration reference](../../configuration/backup-config) and to the [examples.](../../examples/backups)
+
+    Recurring backups are scheduled by editing the `Schedule` and `RetentionCount` fields. For more information, refer to the [Backup configuration reference.](../../backup-config/#schedule)
+
+    > **Important:** The `rancher-backup` operator doesn't save the EncryptionConfiguration file. The contents of the EncryptionConfiguration file must be saved when an encrypted backup is created, and the same file must be used when restoring from this backup.
+1. Click **Create.**
+
+**Result:** The backup file is created in the storage location configured in the Backup custom resource. The name of this file is used when performing a restore.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/configuration/_index.md b/content/rancher/v2.x/en/backups/configuration/_index.md
new file mode 100644
index 00000000000..d83cc04b29f
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/configuration/_index.md
@@ -0,0 +1,10 @@
+---
+title: Rancher Backup Configuration Reference
+shortTitle: Configuration
+weight: 4
+---
+
+- [Backup configuration](./backup-config)
+- [Restore configuration](./restore-config)
+- [Storage location configuration](./storage-config)
+- [Example Backup and Restore Custom Resources](../examples)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
new file mode 100644
index 00000000000..aace0aaee59
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
@@ -0,0 +1,150 @@
+---
+title: Backup Configuration
+shortTitle: Backup
+weight: 1
+---
+
+The OpenAPI schema for the Backup custom resource definition is [here.](https://github.com/rancher/rancher-backup/blob/master/crds/backup.yaml#L14)
+
+The Backup custom resource accepts the following fields:
+
+- [EncryptionConfigName](#encryptionconfigname)
+- [StorageLocation](#storagelocation)
+  - [S3](#s3)
+  - [Example S3 Compatible Storage Configuration](#example-s3-compatible-storage-configuration)
+  - [Example credentialSecret](#example-credentialsecret)
+  - [IAM Permissions for EC2 Nodes to Access S3](#iam-permissions-for-ec2-nodes-to-access-s3)
+- [Schedule](#schedule)
+- [RetentionCount](#retentioncount)
+- [Examples](#examples)
+
+# EncryptionConfigName
+
+This field is optional.
+
+The rancher-backup gathers resources by making calls to the kube-apiserver. Objects returned by apiserver are decrypted, so even if [encryption At rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) is enabled, even the encrypted objects gathered by the backup will be in plaintext.
+
+To avoid storing them in plaintext, you can use the same encryptionConfig file that was used for at-rest encryption, to encrypt certain resources in your backup.
+
+> **Important:** You must save the encryptionConfig file, because it won’t be saved by the rancher-backup operator.
+
+The same encryptionFile needs to be used when performing a restore.
+
+The operator consumes this encryptionConfig as a secret, and the secret must be in the operator’s namespace. Rancher installs the `rancher-backup` operator in the `cattle-resources-system` namespace, so create this encryptionConfig secret in that namespace.
+
+For the `EncryptionConfiguration`, you can use the [sample file provided in the Kubernetes documentation.](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#understanding-the-encryption-at-rest-configuration)
+
+To create the secret, the encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret.
+
+Save the `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command:
+
+```
+kubectl create secret generic test-encryptionconfig \
+  --from-file=./encryption-provider-config.yaml \
+  -n cattle-resources-system
+```
+
+This will ensure that the secret contains a key named `encryption-provider-config.yaml`, and the operator will use this key to get the encryption configuration.
+
+In the example command above, the name `test-encryptionconfig` can be changed to anything.
+
+# StorageLocation
+
+[Optional]. It can be set if you want to provide a specific S3 bucket details for the current backup CR. To set that, you must set the `StorageLocation.s3` field.
+
+### S3
+
+The S3 storage location contains the following configuration fields:
+
+| YAML Directive Name | Description | Required |
+| ---------------- | ---------------- | ------------ |
+| `credentialSecretName` |  If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace as long as you provide that namespace in `credentialSecretNamespace`. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3)  |  |
+| `credentialSecretNamespace` | The namespace of the secret containing the credentials to access S3. This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3) |  |
+| `bucketName` | The name of the S3 bucket where backup files will be stored. | ✓ |
+| `folder` | The name of the folder in the S3 bucket where backup files will be stored. | |
+| `region` | The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. | ✓ |
+| `endpoint` |  The [endpoint](https://docs.aws.amazon.com/general/latest/gr/s3.html)  that is used to access S3 in the region of your bucket.  | ✓ |
+| `endpointCA` | This should be the Base64 encoded CA cert. For an example, refer to the [example S3 compatible configuration.](#example-s3-storage-configuration) |  |
+| `insecureTLSSkipVerify` | Set to true if you are not using TLS. | |
+
+### Example S3 Compatible Storage Configuration
+
+```yaml
+s3:
+  credentialSecretName: minio-creds
+  bucketName: rancherbackups
+  endpoint: minio.35.202.130.254.xip.io
+  endpointCA: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURHakNDQWdLZ0F3SUJBZ0lKQUtpWFZpNEpBb0J5TUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NakF3T0RNd01UZ3lOVFE1V2hjTk1qQXhNREk1TVRneU5UUTVXakFTTVJBdwpEZ1lEVlFRRERBZDBaWE4wTFdOaE1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCjA4dnV3Q2Y0SEhtR2Q2azVNTmozRW5NOG00T2RpS3czSGszd1NlOUlXQkwyVzY5WDZxenBhN2I2M3U2L05mMnkKSnZWNDVqeXplRFB6bFJycjlpbEpWaVZ1NFNqWlFjdG9jWmFCaVNsL0xDbEFDdkFaUlYvKzN0TFVTZSs1ZDY0QQpWcUhDQlZObU5xM3E3aVY0TE1aSVpRc3N6K0FxaU1Sd0pOMVVKQTZ6V0tUc2Yzc3ByQ0J2dWxJWmZsVXVETVAyCnRCTCt6cXZEc0pDdWlhNEEvU2JNT29tVmM2WnNtTGkwMjdub3dGRld3MnRpSkM5d0xMRE14NnJoVHQ4a3VvVHYKQXJpUjB4WktiRU45L1Uzb011eUVKbHZyck9YS2ZuUDUwbk8ycGNaQnZCb3pUTStYZnRvQ1d5UnhKUmI5cFNTRApKQjlmUEFtLzNZcFpMMGRKY2sxR1h3SURBUUFCbzNNd2NUQWRCZ05WSFE0RUZnUVU5NHU4WXlMdmE2MTJnT1pyCm44QnlFQ2NucVFjd1FnWURWUjBqQkRzd09ZQVU5NHU4WXlMdmE2MTJnT1pybjhCeUVDY25xUWVoRnFRVU1CSXgKRURBT0JnTlZCQU1NQjNSbGMzUXRZMkdDQ1FDb2wxWXVDUUtBY2pBTUJnTlZIUk1FQlRBREFRSC9NQTBHQ1NxRwpTSWIzRFFFQkN3VUFBNElCQVFER1JRZ1RtdzdVNXRQRHA5Q2psOXlLRW9Vd2pYWWM2UlAwdm1GSHpubXJ3dUVLCjFrTkVJNzhBTUw1MEpuS29CY0ljVDNEeGQ3TGdIbTNCRE5mVVh2anArNnZqaXhJYXR2UWhsSFNVaWIyZjJsSTkKVEMxNzVyNCtROFkzelc1RlFXSDdLK08vY3pJTGh5ei93aHRDUlFkQ29lS1dXZkFiby8wd0VSejZzNkhkVFJzNwpHcWlGNWZtWGp6S0lOcTBjMHRyZ0xtalNKd1hwSnU0ZnNGOEcyZUh4b2pOKzdJQ1FuSkg5cGRIRVpUQUtOL2ppCnIvem04RlZtd1kvdTBndEZneWVQY1ZWbXBqRm03Y0ZOSkc4Y2ZYd0QzcEFwVjhVOGNocTZGeFBHTkVvWFZnclMKY1VRMklaU0RJd1FFY3FvSzFKSGdCUWw2RXBaUVpWMW1DRklrdFBwSQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+```
+### Example credentialSecret
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: creds
+type: Opaque
+data:
+  accessKey: <Enter your access key>
+  secretKey: <Enter your secret key>
+```
+
+### IAM Permissions for EC2 Nodes to Access S3
+
+There are two ways to set up the `rancher-backup` operator to use S3 as the backup storage location.
+
+One way is to configure the `credentialSecretName` in the Backup custom resource, which refers to AWS credentials that have access to S3.
+
+If the cluster nodes are in Amazon EC2, the S3 access can also be set up by assigning IAM permissions to the EC2 nodes so that they can access S3. 
+
+To allow a node to access S3, follow the instructions in the [AWS documentation](https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-access-s3-bucket/) to create an IAM role for EC2. When you add a custom policy to the role, add the following permissions, and replace the `Resource` with your bucket name:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:ListBucket"
+      ],
+     "Resource": [
+        "arn:aws:s3:::backup-test"
+      ]
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:DeleteObject",
+        "s3:PutObjectAcl"
+      ],
+      "Resource": [
+         "arn:aws:s3:::backup-test/*"
+      ]
+    }
+  ]
+}
+```
+
+After the role is created, and you have attached the corresponding instance profile to your EC2 instance(s), the `credentialSecretName` directive can be left empty in the Backup custom resource. 
+
+# Schedule
+
+This field is optional.
+
+Recurring backups can be enabled by setting this field. It accepts:
+
+- Standard [cron expressions](https://en.wikipedia.org/wiki/Cron)
+- Descriptors, such as "@midnight" or "@every 1h30m"
+
+# RetentionCount
+
+This field is optional and applicable only for recurring backups. The default is 10.
+
+This value specifies how many backup files for a particular app must be retained. If files exceed the given retentionCount,  the oldest files will be deleted.
+
+# Examples
+
+For example Backup custom resources, refer to [this page.](../../examples/#backup)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
new file mode 100644
index 00000000000..5175e2ec76c
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
@@ -0,0 +1,42 @@
+---
+title: Restore Configuration
+shortTitle: Restore
+weight: 2
+---
+
+The OpenAPI schema for the Restore custom resource definition is [here.](https://github.com/rancher/rancher-backup/blob/master/crds/restore.yaml)
+
+The Restore custom resource accepts the following fields:
+
+- [BackupFilename]
+- [EncryptionConfigName]
+
+### BackupFilename
+
+This is the name of the backup file that the `rancher-backup` operator will use to perform the restore.
+
+This field is required.
+
+To obtain this file name from S3, go to your S3 bucket (and folder if it was specified while performing backup).
+
+Copy the filename and store it in your Restore custom resource. So for instance,
+
+- If your bucket name is `s3bucket` and no folder was specified, the `backupFilename` to use will be the `Key` value from S3.
+- If your bucket name is `s3bucket` and the base folder is`s3folder`, the `Key` will be `s3Folder/backupfile`, so the `backupFilename` to use is only `backupfile` . 
+- If there is a subfolder inside `s3Folder` called `s3sub`, and that has your backup file named `backupfileSub`, then the `backupFilename` to use is `s3sub/backupfileSub`.
+
+### EncryptionConfigName
+
+This is encryption configuration secret. It must be the same secret as the one used for the Backup custom resource while performing the backup. If the encryption configuration doesn't match, the restore will fail.
+
+This field is optional.
+
+### StorageLocation
+
+This field is optional.
+
+Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../backup-config/storagelocation)
+
+If the StorageLocation is specified, the operator will retrieve the backup location from that particular S3 bucket. If not specified, operator will try to find this file in the operator-level S3 store, and in the operator-level PVC store.
+
+The operator-level configuration is the storage location that was configured when the `rancher-backup` operator was installed or upgraded.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
new file mode 100644
index 00000000000..4c2f8b23b0c
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
@@ -0,0 +1,122 @@
+---
+title: Backup Storage Location Configuration
+shortTitle: Storage
+weight: 3
+---
+
+Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible object store.
+
+The storage location is configured at the operator level. Therefore, it must be configured when the `rancher-backup` operator is installed or upgraded.
+
+Only one storage location can be configured for each backup.
+
+- [Storage Location Configuration](#storage-location-configuration)
+  - [No Default Storage Location](#no-default-storage-location)
+  - [Use the Default Storage Class (gp2)](#use-the-default-storage-class-gp2)
+  - [S3-compatible Object Store](#s3-compatible-object-store)
+  - [Existing StorageClass](#existing-storageclass)
+  - [Existing PersistentVolume](#existing-persistentvolume)
+- [Encryption](#encryption)
+- [Example values.yaml for the rancher-backup Helm Chart](#example-values-yaml-for-the-rancher-backup-helm-chart)
+
+# Storage Location Configuration
+
+### No Default Storage Location
+
+This option is the default.
+
+### Use the Default Storage Class (gp2)
+
+If this option is selected, the cluster's [default StorageClass](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/) will be used to store the backups.
+
+### S3-compatible Object Store
+
+| Parameter | Description |
+| -------------- | -------------- |
+| Credential Secret | Choose the credentials for S3 from your secrets in Rancher. |
+| Bucket Name | Enter the name of the [S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html) where the backups will be stored. Default: `rancherbackups`. |
+| Region | The [AWS region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. |
+| Folder | The [folder in the S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/using-folders.html) where the backups will be stored. |
+| Endpoint | The [S3 endpoint](https://docs.aws.amazon.com/general/latest/gr/s3.html) For example, `s3.us-west-2.amazonaws.com`. |
+| Endpoint CA | The CA cert used to for the S3 endpoint. Default: base64 encoded CA cert |
+
+### Existing StorageClass
+
+Configure an existing storage class that will be used to store your backups. For information about creating storage classes in refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/provisioning-new-storage/#1-add-a-storage-class-and-configure-it-to-use-your-storage-provider)
+
+If a StorageClass is selected, a new PersistentVolumeClaim will be created on the same host on which the `rancher-backup` operator pod is running. This will in turn create a new PersistentVolume due to dynamic provisioning.
+
+### Existing PersistentVolume
+
+Configure an existing PersistentVolume that will be used to store your backups. For information about creating PersistentVolumes in Rancher, refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/#2-add-a-persistent-volume-that-refers-to-the-persistent-storage)
+
+# Encryption
+
+Resources can be encrypted before they are saved in a backup file.
+
+The `rancher-backup` operator uses the same process to encrypt the backups as is described in the [official Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) for encrypting data at rest.Encryption details are provided in an EncryptionConfiguration YAML file.
+
+You can use any EncryptionConfiguration YAML, including one that is already used in your Kubernetes cluster.
+
+In order for `rancher-backup` operator to use the EncryptionConfiguration, the file must be named `encryption-provider-config.yaml`.
+
+> **Important:** The `rancher-backup` operator doesn't save the EncryptionConfiguration file. The contents of the EncryptionConfiguration file must be saved when a backup is created, and the same file must be used when restoring from this backup.
+
+# Example values.yaml for the rancher-backup Helm Chart
+
+
+This values.yaml file can be used to configure `rancher-backup` operator when the Helm CLI is used to install it.
+
+For more information about `values.yaml` files and configuring Helm charts during installation, refer to the [Helm documentation.](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing)
+
+```yaml
+image:
+  repository: rancher/rancher-backup
+  tag: v0.0.1-rc10
+
+## Default s3 bucket for storing all backup files created by the rancher-backup operator
+s3:
+  enabled: false
+  ## credentialSecretName if set, should be the name of the Secret containing AWS credentials.
+  ## To use IAM Role, don't set this field
+  credentialSecretName: creds 
+  credentialSecretNamespace: ""
+  region: us-west-2
+  bucketName: rancherbackups
+  folder: base folder
+  endpoint: s3.us-west-2.amazonaws.com
+  endpointCA: base64 encoded CA cert
+  # insecureTLSSkipVerify: optional
+
+## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
+## If persistence is enabled, operator will create a PVC with mountPath /var/lib/backups
+persistence: 
+  enabled: false
+
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack). 
+  ## Refer to https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class-1
+  ##
+  storageClass: "-"
+
+  ## If you want to disable dynamic provisioning by setting storageClass to "-" above, 
+  ## and want to target a particular PV, provide name of the target volume 
+  volumeName: ""
+
+  ## Only certain StorageClasses allow resizing PVs; Refer to https://kubernetes.io/blog/2018/07/12/resizing-persistent-volumes-using-kubernetes/
+  size: 2Gi
+
+
+global:
+  cattle:
+    systemDefaultRegistry: ""
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/examples/_index.md b/content/rancher/v2.x/en/backups/examples/_index.md
new file mode 100644
index 00000000000..273712df63d
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/examples/_index.md
@@ -0,0 +1,297 @@
+---
+title: Examples
+weight: 5
+---
+
+This section contains examples of Backup and Restore custom resources. The original source is [here.](https://github.com/rancher/rancher-backup/tree/master/examples)
+
+The default backup storage location is configured when the `rancher-backup` operator is installed or upgraded.
+
+Encrypted backups can only be restored if the Restore custom resource uses the same encryption configuration secret that was used to create the backup.
+
+- [Backup](#backup)
+  - [Backup in the default location with encryption](#backup-in-the-default-location-with-encryption)
+  - [Recurring backup in the default location](#recurring-backup-in-the-default-location)
+  - [Encrypted recurring backup in the default location](#encrypted-recurring-backup-in-the-default-location)
+  - [Encrypted backup in Minio](#encrypted-backup-in-minio)
+  - [Backup in S3 using AWS credential secret](#backup-in-s3-using-aws-credential-secret)
+  - [Recurring backup in S3 using AWS credential secret](#recurring-backup-in-s3-using-aws-credential-secret)
+  - [Backup from EC2 nodes with IAM permission to access S3](#backup-from-ec2-nodes-with-iam-permission-to-access-s3)
+- [Restore](#restore)
+  - [Restore using the default backup file location](#restore-using-the-default-backup-file-location)
+  - [Restore for Rancher migration](#restore-for-rancher-migration)
+  - [Restore from encrypted backup](#restore-from-encrypted-backup)
+  - [Restore an encrypted backup from Minio](#restore-an-encrypted-backup-from-minio)
+  - [Restore from backup using an AWS credential secret to access S3](#restore-from-backup-using-an-aws-credential-secret-to-access-s3)
+  - [Restore from EC2 nodes with IAM permissions to access S3](#restore-from-ec2-nodes-with-iam-permissions-to-access-s3)
+- [Example Credential Secret for Storing Backups in S3](#example-credential-secret-for-storing-backups-in-s3)
+- [Example EncryptionConfiguration](#example-encryptionconfiguration)
+
+# Backup
+
+### Backup in the Default Location with Encryption
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: test-s3-def-backup
+spec:
+  resourceSetName: rancher-resource-set
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+### Recurring Backup in the Default Location
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: test-default-location-recurring-backup
+spec:
+  resourceSetName: rancher-resource-set
+  schedule: "@every 2m"
+  retentionCount: 3
+```
+
+### Encrypted Recurring Backup in the Default Location
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: test-s3-recurring-backup
+spec:
+  resourceSetName: ecm-resource-set
+  encryptionConfigSecretName: test-encryptionconfig
+  schedule: "@every 1m"
+  retentionCount: 3
+```
+
+### Encrypted Backup in Minio
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: minio-backup-demo
+spec:
+  storageLocation:
+    s3:
+      credentialSecretName: minio-creds
+      credentialSecretNamespace: default
+      bucketName: rancherbackups
+      endpoint: minio.xip.io
+      endpointCA: LS0tLS1CRUdJTi3VUFNQkl5UUT.....pbEpWaVzNkRS0tLS0t
+  resourceSetName: rancher-resource-set
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+### Backup in S3 Using AWS Credential Secret
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: s3-backup-demo
+spec:
+  storageLocation:
+    s3:
+      credentialSecretName: s3-creds
+      credentialSecretNamespace: default
+      bucketName: rajashree-backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+  resourceSetName: rancher-resource-set
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+### Recurring Backup in S3 Using AWS Credential Secret
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: test-s3-recurring-backup
+spec:
+  storageLocation:
+    s3:
+      credentialSecretName: s3-creds
+      credentialSecretNamespace: default
+      bucketName: rajashree-backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+  resourceSetName: rancher-resource-set
+  encryptionConfigSecretName: test-encryptionconfig
+  schedule: "@every 2m"
+  retentionCount: 3
+```
+
+### Backup from EC2 Nodes with IAM Permission to Access S3
+
+This example shows that the AWS credential secret does not have to be provided to create a backup if the nodes running `rancher-backup` have [these permissions for access to S3.](../../configuration/backup-config/#iam-permissions-for-eC2-nodes-to-access-s3)
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Backup
+metadata:
+  name: s3-backup-demo
+spec:
+  storageLocation:
+    s3:
+      bucketName: rajashree-backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+  resourceSetName: rancher-resource-set
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+# Restore
+
+### Restore Using the Default Backup File Location
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-pvc-demo
+spec:
+  backupFilename: test-default-location-recurring-backup-752ecd87-d958-4d20-8350-072f8d090045-2020-09-26T12-29-54-07-00.tar.gz
+#  encryptionConfigSecretName: test-encryptionconfig
+```
+
+### Restore for Rancher Migration
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-migration
+spec:
+  backupFilename: b-eks-2-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07#27#09Z.tar.gz
+  prune: false
+  storageLocation:
+    s3:
+      credentialSecretName: s3-creds
+      credentialSecretNamespace: default
+      bucketName: rajashree-backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+```
+
+### Restore from Encrypted Backup
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-s3-demo
+spec:
+  backupFilename: default-test-s3-def-backup-c583d8f2-6daf-4648-8ead-ed826c591471-2020-08-24T20#47#05Z.tar.gz
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+### Restore an Encrypted Backup from Minio
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-minio
+spec:
+  backupFilename: default-minio-backup-demo-aa5c04b7-4dba-4c48-9ac4-ab7916812eaa-2020-08-30T13#18#17-07#00.tar.gz
+  storageLocation:
+    s3:
+      credentialSecretName: minio-creds
+      credentialSecretNamespace: default
+      bucketName: rancherbackups
+      endpoint: minio.xip.io
+      endpointCA: LS0tLS1CRUdJTi3VUFNQkl5UUT.....pbEpWaVzNkRS0tLS0t
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+### Restore from Backup Using an AWS Credential Secret to Access S3
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-s3-demo
+spec:
+  backupFilename: test-s3-recurring-backup-752ecd87-d958-4d20-8350-072f8d090045-2020-09-26T12-49-34-07-00.tar.gz.enc
+  storageLocation:
+    s3:
+      credentialSecretName: s3-creds
+      credentialSecretNamespace: default
+      bucketName: rajashree-backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+### Restore from EC2 Nodes with IAM Permissions to Access S3
+
+This example shows that the AWS credential secret does not have to be provided to restore from backup if the nodes running `rancher-backup` have [these permissions for access to S3.](../../configuration/backup-config/#iam-permissions-for-eC2-nodes-to-access-s3)
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-s3-demo
+spec:
+  backupFilename: default-test-s3-recurring-backup-84bf8dd8-0ef3-4240-8ad1-fc7ec308e216-2020-08-24T10#52#44-07#00.tar.gz
+  storageLocation:
+    s3:
+      bucketName: rajashree-backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+  encryptionConfigSecretName: test-encryptionconfig
+```
+
+# Example Credential Secret for Storing Backups in S3
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: creds
+type: Opaque
+data:
+  accessKey: <Enter your access key>
+  secretKey: <Enter your secret key>
+```
+
+# Example EncryptionConfiguration
+
+```yaml
+apiVersion: apiserver.config.k8s.io/v1
+kind: EncryptionConfiguration
+resources:
+  - resources:
+      - secrets
+    providers:
+      - aesgcm:
+          keys:
+            - name: key1
+              secret: c2VjcmV0IGlzIHNlY3VyZQ==
+            - name: key2
+              secret: dGhpcyBpcyBwYXNzd29yZA==
+      - aescbc:
+          keys:
+            - name: key1
+              secret: c2VjcmV0IGlzIHNlY3VyZQ==
+            - name: key2
+              secret: dGhpcyBpcyBwYXNzd29yZA==
+      - secretbox:
+          keys:
+            - name: key1
+              secret: YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY=
+```
+
+
+
diff --git a/content/rancher/v2.x/en/backups/legacy/_index.md b/content/rancher/v2.x/en/backups/legacy/_index.md
index 2315b1a7b8c..3b35e376401 100644
--- a/content/rancher/v2.x/en/backups/legacy/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Legacy Backup and Restore Documentation
-weight: 1
+weight: 6
 ---
 
 > This section is under construction.
diff --git a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
new file mode 100644
index 00000000000..36563a5ef63
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
@@ -0,0 +1,68 @@
+---
+title: Migrating Rancher to a New Cluster
+weight: 3
+---
+
+If you are migrating Rancher to a new Kubernetes cluster, you don't need to install Rancher on the new cluster first. If Rancher is restored to a new cluster with Rancher already installed, it can cause problems with [permissions](https://github.com/rancher/rancher-backup/issues/24) and [namespaces.](https://github.com/rancher/rancher-backup/issues/6)
+
+### Prerequisites
+
+These instructions assume you have [created a backup](../back-up-rancher) and you have already installed a new Kubernetes cluster where Rancher will be deployed.
+
+Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes clusters such as Amazon EKS clusters. For help installing Kubernetes, refer to the documentation of the Kubernetes distribution. One of Rancher's Kubernetes distributions may also be used:
+
+- [RKE Kubernetes installation docs]({{<baseurl>}}/rke/latest/en/installation/)
+- [K3s Kubernetes installation docs]({{<baseurl>}}/k3s/latest/en/installation/)
+
+### 1. Install the rancher-backup Helm chart
+```
+helm repo add rancherchart https://charts.rancher.io
+helm repo update
+helm install rancher-backup-crd rancherchart/rancher-backup-crd -n cattle-resources-system --create-namespace
+helm install rancher-backup rancherchart/rancher-backup -n cattle-resources-system
+```
+
+### 2. Restore from backup using a Restore custom resource
+
+In the Restore custom resource, `prune` must be set to false. 
+
+Create a Restore custom resource like the example below:
+
+```yaml
+# migrationResource.yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-migration
+spec:
+  backupFilename: b-eks-2-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07#27#09Z.tar.gz
+  prune: false
+  storageLocation:
+    s3:
+      credentialSecretName: s3-creds
+      credentialSecretNamespace: default
+      bucketName: backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+```
+
+Then apply the resource:
+
+```
+kubectl apply -f migrationResource.yaml 
+```
+
+### 3. Install cert-manager
+
+Follow the steps to [install cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/install-rancher-on-k8s/install/#5-install-cert-manager) in the documentation about installing cert-manager on Kubernetes.
+
+### 4. Bring up Rancher with Helm
+
+```
+helm upgrade rancher rancher-alpha/rancher \
+  --version 2.5.0-alpha1 \
+  --namespace cattle-system \
+  --set hostname=<same hostname as first Rancher server> \
+  --set rancherImageTag=master-head
+```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
new file mode 100644
index 00000000000..13ba992265f
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
@@ -0,0 +1,58 @@
+---
+title: Restoring Rancher
+weight: 2
+---
+
+A restore is performed by creating a Restore custom resource.
+
+### 1. Create the Restore Custom Resource
+
+1. In the **Cluster Explorer,** go to the dropdown menu in the upper left corner and click **Rancher Backups.**
+1. Click **Restore.**
+1. Create the Restore with the form, or with YAML. For this example, we can use **Create > Create from YAML.**
+
+Create a Restore custom resource such as the following. 
+
+The `prune` directive needs to be set to false so that the secret associated with the operator's service account will not get deleted.
+
+Replace the `backupFilename` and `storageLocation` with your own information.
+
+```yaml
+apiVersion: resources.cattle.io/v1
+kind: Restore
+metadata:
+  name: restore-migration
+spec:
+  backupFilename: b-eks-2-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07#27#09Z.tar.gz
+  prune: false
+  storageLocation:
+    s3:
+      credentialSecretName: s3-creds
+      credentialSecretNamespace: default
+      bucketName: backup-test
+      folder: ecm1
+      region: us-west-2
+      endpoint: s3.us-west-2.amazonaws.com
+```
+
+**Result:** Helm 3 stores the chart release as a Kubernetes [Secret.](https://kubernetes.io/docs/concepts/configuration/secret/) When the restore is performed, the Rancher chart release in the backup is created in the cluster where the restore is performed. Now Rancher does not need to be reinstalled. It just needs to be upgraded.
+
+### 2. Install cert-manager
+
+Follow the steps to [install cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/install-rancher-on-k8s/install/#5-install-cert-manager) in the documentation about installing cert-manager on Kubernetes.
+
+### 3. Upgrade the Rancher Release
+
+If Rancher was scaled down when the backup was created, you can set the size of the deployment through the `helm upgrade` command.
+
+```
+helm upgrade rancher rancher-alpha/rancher \
+  --version 2.5.0-alpha1 \
+  --namespace cattle-system \
+  -set hostname=<same hostname as first rancher server> \
+  --set rancherImageTag=master-head
+```
+
+For more information about Rancher image tags, see [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/resources/choosing-version/)
+
+**Result:** Rancher is restored.
\ No newline at end of file

From 4d3458a10a273eed615aa87e43304bcd8b2b3759 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 28 Sep 2020 22:15:49 -0700
Subject: [PATCH 208/265] Fix links

---
 content/rancher/v2.x/en/backups/_index.md              | 10 +++++-----
 .../rancher/v2.x/en/backups/back-up-rancher/_index.md  | 10 +++-------
 .../en/backups/configuration/backup-config/_index.md   |  4 +---
 .../en/backups/configuration/restore-config/_index.md  |  9 ++++-----
 .../en/backups/configuration/storage-config/_index.md  |  2 +-
 content/rancher/v2.x/en/backups/examples/_index.md     | 10 +++++++---
 .../v2.x/en/backups/migrating-rancher/_index.md        |  2 +-
 7 files changed, 22 insertions(+), 25 deletions(-)

diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index 8f9b990ec18..8fe30be800e 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -83,22 +83,22 @@ helm install rancher-backup rancherchart/rancher-backup -n cattle-resources-syst
 
 # Backing up Rancher
 
-A backup is performed by creating a Backup custom resource. For a tutorial, refer to [this page.](../back-up-rancher)
+A backup is performed by creating a Backup custom resource. For a tutorial, refer to [this page.](./back-up-rancher)
 
 # Restoring Rancher
 
-A restore is performed by creating a Restore custom resource. For a tutorial, refer to [this page.](../restoring-rancher)
+A restore is performed by creating a Restore custom resource. For a tutorial, refer to [this page.](./restoring-rancher)
 
 # Migrating Rancher to a New Cluster
 
-A migration is performed by following [these steps.](../migrating-rancher)
+A migration is performed by following [these steps.](./migrating-rancher)
 
 # Default Storage Location Configuration
 
 Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible or Minio object store.
 
-For information on configuring these options, refer to [this page.](../storage-config)
+For information on configuring these options, refer to [this page.](./configuration/storage-config)
 
 ### Example values.yaml for the rancher-backup Helm Chart
 
-The example [values.yaml file](../example-values) can be used to configure the `rancher-backup` operator when the Helm CLI is used to install it.
+The example [values.yaml file](./configuration/storage-config/#example-values-yaml-for-the-rancher-backup-helm-chart) can be used to configure the `rancher-backup` operator when the Helm CLI is used to install it.
diff --git a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
index d142f7ccffc..4fb5d63484b 100644
--- a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
@@ -14,7 +14,7 @@ Backups are created as .tar.gz files. These files can be pushed to S3 or Minio,
 1. In the Rancher UI, go to the **Cluster Explorer.**
 1. Click **Apps.**
 1. Click `rancher-backup`.
-1. Configure the default storage location. For help, refer to the [storage configuration section.](#configuring-the-storage-location)
+1. Configure the default storage location. For help, refer to the [storage configuration section.](../configuration/storage-config)
 
 ### 2. Perform a Backup
 
@@ -44,13 +44,9 @@ To perform a backup, a custom resource of type Backup must be created.
       retentionCount: 3
       ```
 
+    For help configuring the Backup, refer to the [configuration reference](../configuration/backup-config) and to the [examples.](../examples/#backup)
 
-
-
-
-    For help configuring the Backup, refer to the [configuration reference](../../configuration/backup-config) and to the [examples.](../../examples/backups)
-
-    Recurring backups are scheduled by editing the `Schedule` and `RetentionCount` fields. For more information, refer to the [Backup configuration reference.](../../backup-config/#schedule)
+    Recurring backups are scheduled by editing the `Schedule` and `RetentionCount` fields. For more information, refer to the [Backup configuration reference.](../configuration/backup-config/#schedule)
 
     > **Important:** The `rancher-backup` operator doesn't save the EncryptionConfiguration file. The contents of the EncryptionConfiguration file must be saved when an encrypted backup is created, and the same file must be used when restoring from this backup.
 1. Click **Create.**
diff --git a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
index aace0aaee59..682b741cf27 100644
--- a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
@@ -4,8 +4,6 @@ shortTitle: Backup
 weight: 1
 ---
 
-The OpenAPI schema for the Backup custom resource definition is [here.](https://github.com/rancher/rancher-backup/blob/master/crds/backup.yaml#L14)
-
 The Backup custom resource accepts the following fields:
 
 - [EncryptionConfigName](#encryptionconfigname)
@@ -64,7 +62,7 @@ The S3 storage location contains the following configuration fields:
 | `folder` | The name of the folder in the S3 bucket where backup files will be stored. | |
 | `region` | The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. | ✓ |
 | `endpoint` |  The [endpoint](https://docs.aws.amazon.com/general/latest/gr/s3.html)  that is used to access S3 in the region of your bucket.  | ✓ |
-| `endpointCA` | This should be the Base64 encoded CA cert. For an example, refer to the [example S3 compatible configuration.](#example-s3-storage-configuration) |  |
+| `endpointCA` | This should be the Base64 encoded CA cert. For an example, refer to the [example S3 compatible configuration.](#example-s3-compatible-storage-configuration) |  |
 | `insecureTLSSkipVerify` | Set to true if you are not using TLS. | |
 
 ### Example S3 Compatible Storage Configuration
diff --git a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
index 5175e2ec76c..fe0054e693e 100644
--- a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
@@ -4,12 +4,11 @@ shortTitle: Restore
 weight: 2
 ---
 
-The OpenAPI schema for the Restore custom resource definition is [here.](https://github.com/rancher/rancher-backup/blob/master/crds/restore.yaml)
-
 The Restore custom resource accepts the following fields:
 
-- [BackupFilename]
-- [EncryptionConfigName]
+- [BackupFilename](#backupfilename)
+- [EncryptionConfigName](#encryptionconfigname)
+- [StorageLocation](#storagelocation)
 
 ### BackupFilename
 
@@ -35,7 +34,7 @@ This field is optional.
 
 This field is optional.
 
-Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../backup-config/storagelocation)
+Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../configuration/backup-config/#storagelocation)
 
 If the StorageLocation is specified, the operator will retrieve the backup location from that particular S3 bucket. If not specified, operator will try to find this file in the operator-level S3 store, and in the operator-level PVC store.
 
diff --git a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
index 4c2f8b23b0c..499f710251a 100644
--- a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
@@ -54,7 +54,7 @@ Configure an existing PersistentVolume that will be used to store your backups.
 
 Resources can be encrypted before they are saved in a backup file.
 
-The `rancher-backup` operator uses the same process to encrypt the backups as is described in the [official Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) for encrypting data at rest.Encryption details are provided in an EncryptionConfiguration YAML file.
+The `rancher-backup` operator uses the same process to encrypt the backups as is described in the [official Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) for encrypting data at rest. Encryption details are provided in an EncryptionConfiguration YAML file.
 
 You can use any EncryptionConfiguration YAML, including one that is already used in your Kubernetes cluster.
 
diff --git a/content/rancher/v2.x/en/backups/examples/_index.md b/content/rancher/v2.x/en/backups/examples/_index.md
index 273712df63d..c6fff372088 100644
--- a/content/rancher/v2.x/en/backups/examples/_index.md
+++ b/content/rancher/v2.x/en/backups/examples/_index.md
@@ -3,7 +3,7 @@ title: Examples
 weight: 5
 ---
 
-This section contains examples of Backup and Restore custom resources. The original source is [here.](https://github.com/rancher/rancher-backup/tree/master/examples)
+This section contains examples of Backup and Restore custom resources.
 
 The default backup storage location is configured when the `rancher-backup` operator is installed or upgraded.
 
@@ -29,6 +29,8 @@ Encrypted backups can only be restored if the Restore custom resource uses the s
 
 # Backup
 
+This section contains example Backup custom resources.
+
 ### Backup in the Default Location with Encryption
 
 ```yaml
@@ -131,7 +133,7 @@ spec:
 
 ### Backup from EC2 Nodes with IAM Permission to Access S3
 
-This example shows that the AWS credential secret does not have to be provided to create a backup if the nodes running `rancher-backup` have [these permissions for access to S3.](../../configuration/backup-config/#iam-permissions-for-eC2-nodes-to-access-s3)
+This example shows that the AWS credential secret does not have to be provided to create a backup if the nodes running `rancher-backup` have [these permissions for access to S3.](../configuration/backup-config/#iam-permissions-for-ec2-nodes-to-access-s3)
 
 ```yaml
 apiVersion: resources.cattle.io/v1
@@ -151,6 +153,8 @@ spec:
 
 # Restore
 
+This section contains example Restore custom resources.
+
 ### Restore Using the Default Backup File Location
 
 ```yaml
@@ -235,7 +239,7 @@ spec:
 
 ### Restore from EC2 Nodes with IAM Permissions to Access S3
 
-This example shows that the AWS credential secret does not have to be provided to restore from backup if the nodes running `rancher-backup` have [these permissions for access to S3.](../../configuration/backup-config/#iam-permissions-for-eC2-nodes-to-access-s3)
+This example shows that the AWS credential secret does not have to be provided to restore from backup if the nodes running `rancher-backup` have [these permissions for access to S3.](../configuration/backup-config/#iam-permissions-for-ec2-nodes-to-access-s3)
 
 ```yaml
 apiVersion: resources.cattle.io/v1
diff --git a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
index 36563a5ef63..191521059af 100644
--- a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
@@ -3,7 +3,7 @@ title: Migrating Rancher to a New Cluster
 weight: 3
 ---
 
-If you are migrating Rancher to a new Kubernetes cluster, you don't need to install Rancher on the new cluster first. If Rancher is restored to a new cluster with Rancher already installed, it can cause problems with [permissions](https://github.com/rancher/rancher-backup/issues/24) and [namespaces.](https://github.com/rancher/rancher-backup/issues/6)
+If you are migrating Rancher to a new Kubernetes cluster, you don't need to install Rancher on the new cluster first. If Rancher is restored to a new cluster with Rancher already installed, it can cause problems.
 
 ### Prerequisites
 

From 9d498d254b425ddae45fcd7d95919d60c84b64d2 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Tue, 29 Sep 2020 10:45:15 -0700
Subject: [PATCH 209/265] Update OPA Gatekeeper docs for Rancher v2.5

---
 .../rancher/v2.x/en/opa-gatekeper/_index.md   | 39 ++++++++++++++++---
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/content/rancher/v2.x/en/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md
index 16056835c59..e0a22d901bd 100644
--- a/content/rancher/v2.x/en/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md
@@ -7,8 +7,6 @@ aliases:
 ---
 _Available as of v2.4.0_
 
-> In Rancher 2.5, the OPA Gatekeeper application was improved. There are now two ways to enable OPA Gatekeeper. The older way is documented in this section, and the new application for OPA Gatekeeper is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/monitoring-alerting)
-
 > This is an experimental feature for the Rancher v2.4 release.
 
 To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. 
@@ -28,10 +26,39 @@ To read more about OPA, please refer to the [official documentation.](https://ww
 
 Kubernetes provides the ability to extend API server functionality via admission controller webhooks, which are invoked whenever a resource is created, updated or deleted. Gatekeeper is installed as a validating webhook and enforces policies defined by Kubernetes custom resource definitions. In addition to the admission control usage, Gatekeeper provides the capability to audit existing resources in Kubernetes clusters and mark current violations of enabled policies.
 
-OPA Gatekeeper is made availale via Rancher's Helm system chart, and it is installed in a namespace named `gatekeeper-system.`
+OPA Gatekeeper is made available via Rancher's Helm system chart, and it is installed in a namespace named `gatekeeper-system.`
 
 # Enabling OPA Gatekeeper in a Cluster
 
+In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper from the old UI, then reinstall it in Rancher v2.5.
+
+{{% tabs %}}
+{{% tab "Rancher v2.5" %}}
+
+> **Prerequisite:** Only administrators and cluster owners can enable OPA Gatekeeper.
+
+OPA Gatekeeper can be installed from the new **Cluster Explorer** view in Rancher v2.5, or from the legacy cluster view.
+
+### Enabling OPA Gatekeeper from Cluster Explorer
+
+1. Go to the cluster view in the Rancher UI. Click **Cluster Explorer.**
+1. Click **Apps** in the top navigation bar.
+1. Click **rancher-gatekeeper.**
+1. Click **Install.**
+
+**Result:** OPA Gatekeeper is deployed in your Kubernetes cluster.
+
+### Enabling OPA Gatekeeper from the Legacy Cluster View
+
+1. Go to the cluster view in the Rancher UI.
+1. Click **Tools > OPA Gatekeeper.**
+1. Click **Install.**
+
+**Result:** OPA Gatekeeper is deployed in your Kubernetes cluster.
+
+{{% /tab %}}
+{{% tab "Rancher v2.4" %}}
+
 > **Prerequisites:** 
 > 
 > - Only administrators and cluster owners can enable OPA Gatekeeper.
@@ -41,7 +68,9 @@ OPA Gatekeeper is made availale via Rancher's Helm system chart, and it is insta
 1. On the left side menu, expand the cluster menu and click on **OPA Gatekeeper.**
 1. To install Gatekeeper with the default configuration, click on **Enable Gatekeeper (v0.1.0) with defaults.**
 1. To change any default configuration, click on **Customize Gatekeeper yaml configuration.**
-      
+{{% /tab %}}
+{{% /tabs %}}
+
 # Constraint Templates
 
 [Constraint templates](https://github.com/open-policy-agent/gatekeeper#constraint-templates) are Kubernetes custom resources that define the schema and Rego logic of the OPA policy to be applied by Gatekeeper. For more information on the Rego policy language, refer to the [official documentation.](https://www.openpolicyagent.org/docs/latest/policy-language/)
@@ -64,7 +93,7 @@ New constraints can be created from a constraint template.
 
 Rancher provides the ability to create a constraint by using a convenient form that lets you input the various constraint fields.
 
-The **Edit as yaml** option is also availble to configure the the constraint's yaml definition.
+The **Edit as yaml** option is also available to configure the the constraint's yaml definition.
 
 ### Exempting Rancher's System Namespaces from Constraints
 

From acba44214e9da34c4d94918a7bde19144b0328d8 Mon Sep 17 00:00:00 2001
From: Arvind Iyengar <arvind.iyengar@rancher.com>
Date: Tue, 29 Sep 2020 17:30:52 -0700
Subject: [PATCH 210/265] Add basic RBAC docs

---
 .../monitoring-alerting/2.5.x/rbac/_index.md  | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100644 content/rancher/v2.x/en/monitoring-alerting/2.5.x/rbac/_index.md

diff --git a/content/rancher/v2.x/en/monitoring-alerting/2.5.x/rbac/_index.md b/content/rancher/v2.x/en/monitoring-alerting/2.5.x/rbac/_index.md
new file mode 100644
index 00000000000..3301d45b9f4
--- /dev/null
+++ b/content/rancher/v2.x/en/monitoring-alerting/2.5.x/rbac/_index.md
@@ -0,0 +1,63 @@
+---
+title: RBAC
+weight: 3
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/monitoring/rbac
+---
+
+This section describes the permissions required to access Monitoring features.
+
+The `rancher-monitoring` chart installs three `ClusterRoles`.
+
+# Cluster-Admin Access
+
+By default, only those with the cluster-admin `ClusterRole` can:
+
+- Install the `rancher-monitoring` App onto a cluster and all other relevant configuration performed on the chart deploy
+  - e.g. whether default dashboards are created, what exporters are deployed onto the cluster to collect metrics, etc.
+- Create / modify / delete Prometheus deployments in the cluster via Prometheus CRs
+- Create / modify / delete Alertmanager deployments in the cluster via Alertmanager CRs
+- Persist new Grafana dashboards or datasources via creating ConfigMaps in the appropriate namespace
+- Expose certain Prometheus metrics to the k8s Custom Metrics API for HPA via a Secret in the `cattle-monitoring-system` namespace
+
+## Admin and Edit access
+
+By default, only Admin and Edit roles can:
+
+- View the configuration of Prometheuses that are deployed within the cluster
+- View the configuraiton of Alertmanagers that are deployed within the cluster
+- Modify the scrape configuration of Prometheus deployments via ServiceMonitor and PodMonitor CRs
+- Modify the alerting / recording rules of a Prometheus deployment via PrometheusRules CRs
+
+# Summary of Default Permissions for Kubernetes Default Roles
+
+Monitoring creates three `ClusterRoles` and adds Monitoring CRD access to the following default K8s `ClusterRoles`:
+
+| ClusterRole created by chart | Default K8s ClusterRole  | 
+| ------------------------------| ---------------------------|
+| `monitoring-admin` | `admin`|
+| `monitoring-edit`| `edit` |
+| `monitoring-view` | `view `| 
+
+Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create (C), Get (G), List (L), Update (U), Patch (P), Delete(D), All (*)) that can be performed. 
+
+
+|CRDs                        | Admin | Edit | View | 
+|----------------------------| ------| -----| -----|
+| <ul><li>`monitoring.coreos.com`</li><ul><li>`prometheuses`</li><li>`alertmanagers`</li></ul></ul>| GLW | GLW | GLW|
+| <ul><li>`monitoring.coreos.com`</li><ul><li>`servicemonitors`</li><li>`podmonitors`</li><li>`prometheusrules`</li></ul></ul>| * | * | GLW|
+
+# Additional Roles
+
+Monitoring also creates six `Roles` to enable admins to assign more fine-grained access to monitoring within a cluster:
+
+| Role created by chart | Purpose  | 
+| ------------------------------| ---------------------------|
+monitoring-config-admin | Allow admins to assign roles to users to be able to view / modify Secrets and ConfigMaps within the cattle-monitoring-system namespace. Modifying Secrets / ConfigMaps in this namespace could allow users to alter the cluster's Alertmanager configuration, Prometheus Adapter configuration, additional Grafana datasources, TLS secrets, etc. |
+monitoring-config-edit | Allow admins to assign roles to users to be able to view / modify Secrets and ConfigMaps within the cattle-monitoring-system namespace. Modifying Secrets / ConfigMaps in this namespace could allow users to alter the cluster's Alertmanager configuration, Prometheus Adapter configuration, additional Grafana datasources, TLS secrets, etc. |
+monitoring-config-view | Allow admins to assign roles to users to be able to view Secrets and ConfigMaps within the cattle-monitoring-system namespace. Viewing Secrets / ConfigMaps in this namespace could allow users to observe the cluster's Alertmanager configuration, Prometheus Adapter configuration, additional Grafana datasources, TLS secrets, etc. |
+monitoring-dashboard-admin | Allow admins to assign roles to users to be able to edit / view ConfigMaps within the cattle-dashboards namespace. ConfigMaps in this namespace will correspond to Grafana Dashboards that are persisted onto the cluster. |
+monitoring-dashboard-edit | Allow admins to assign roles to users to be able to edit / view ConfigMaps within the cattle-dashboards namespace. ConfigMaps in this namespace will correspond to Grafana Dashboards that are persisted onto the cluster. |
+monitoring-dashboard-view | Allow admins to assign roles to users to be able to view ConfigMaps within the cattle-dashboards namespace. ConfigMaps in this namespace will correspond to Grafana Dashboards that are persisted onto the cluster. |
+
+These Roles are not assigned by default but will be created in the cluster.
\ No newline at end of file

From 2c61b8424485812498f55dc5feefa1b6310f04fd Mon Sep 17 00:00:00 2001
From: rajashree <rajashree.28m@gmail.com>
Date: Tue, 29 Sep 2020 17:05:13 -0700
Subject: [PATCH 211/265] Specify RBAC permissions for backup-restore chart

---
 .../rancher/v2.x/en/backups/back-up-rancher/_index.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
index 4fb5d63484b..56e76f1f599 100644
--- a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
@@ -51,4 +51,13 @@ To perform a backup, a custom resource of type Backup must be created.
     > **Important:** The `rancher-backup` operator doesn't save the EncryptionConfiguration file. The contents of the EncryptionConfiguration file must be saved when an encrypted backup is created, and the same file must be used when restoring from this backup.
 1. Click **Create.**
 
-**Result:** The backup file is created in the storage location configured in the Backup custom resource. The name of this file is used when performing a restore.
\ No newline at end of file
+**Result:** The backup file is created in the storage location configured in the Backup custom resource. The name of this file is used when performing a restore.
+
+
+### RBAC/Permissions
+
+Rancher Backup & Restore is a cluster-admin only feature and available only for the local cluster.
+Which means only the rancher admins, and local cluster’s cluster-owner can:
+* Install the Chart
+* See the navigation links for Backup and Restore CRDs (there is no overview page for this feature, after the chart is installed there’s a separate navigation link for its CRDs)
+* Perform a backup or restore by creating a Backup CR and Restore CR respectively, list backups/restores performed so far
\ No newline at end of file

From ab38c543ceabe6d127da1a9bf2f7daa415280fda Mon Sep 17 00:00:00 2001
From: Prachi Damle <prachi@rancher.com>
Date: Tue, 29 Sep 2020 18:19:35 -0700
Subject: [PATCH 212/265] RBAC for CIS v2

---
 .../v2.x/en/cis-scans/2.5.x/rbac/_index.md    | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 content/rancher/v2.x/en/cis-scans/2.5.x/rbac/_index.md

diff --git a/content/rancher/v2.x/en/cis-scans/2.5.x/rbac/_index.md b/content/rancher/v2.x/en/cis-scans/2.5.x/rbac/_index.md
new file mode 100644
index 00000000000..d6c2fd8b0ef
--- /dev/null
+++ b/content/rancher/v2.x/en/cis-scans/2.5.x/rbac/_index.md
@@ -0,0 +1,40 @@
+---
+title: RBAC
+weight: 3
+---
+
+This section describes the permissions required to use the rancher-cis-benchmark App.
+
+The rancher-cis-benchmark is a cluster-admin only feature by default.
+
+However, the `rancher-cis-benchmark` chart installs three default `ClusterRoles`:
+- cis-admin
+- cis-edit
+- cis-view
+
+# Cluster-Admin Access
+
+Rancher CIS Scans is a cluster-admin only feature by default.
+This means only the rancher global admins, and the cluster’s cluster-owner can:
+
+- Install/Uninstall the rancher-cis-benchmark App
+- See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans
+- List the default ClusterScanBenchmarks and ClusterScanProfiles
+- Create/Edit/Delete new ClusterScanProfiles
+- Create/Edit/Delete a new ClusterScan to run the CIS scan on the cluster
+- View and Download the ClusterScanReport created after the ClusterScan is complete
+
+
+# Summary of Default Permissions for Kubernetes Default Roles
+
+The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmark CRD access to the following default K8s `ClusterRoles`:
+
+| ClusterRole created by chart | Default K8s ClusterRole  | Permissions given with Role
+| ------------------------------| ---------------------------| ---------------------------|
+| `cis-admin` | `admin`| Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
+| `cis-edit`| `edit` | Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
+| `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
+
+Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but these default k8s roles will determine access to CIS feature.
+By default only cluster-owner role will have ability to use `rancher-cis-benchmark` feature.
+But the above ClusterRoles can be granted to cluster-member, project-owner, project-member users if a cluster-owner wants to share access.

From 23434ce11ee4fb59ed02c8b81e95996a0d18ead0 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 30 Sep 2020 00:32:18 -0700
Subject: [PATCH 213/265] Update structure for Hardening and Self Assessment
 guides

---
 content/rancher/v2.x/en/security/_index.md    |  2 +-
 .../v2.x/en/security/rancher-2.1/_index.md    | 20 +++++++++++++++++++
 .../{ => rancher-2.1}/benchmark-2.1/_index.md |  2 ++
 .../{ => rancher-2.1}/hardening-2.1/_index.md |  2 ++
 .../v2.x/en/security/rancher-2.2/_index.md    | 20 +++++++++++++++++++
 .../{ => rancher-2.2}/benchmark-2.2/_index.md |  2 ++
 .../{ => rancher-2.2}/hardening-2.2/_index.md |  2 ++
 .../v2.x/en/security/rancher-2.3.x/_index.md  | 10 ++++++++++
 .../rancher-2.3.x/rancher-v2.3.0/_index.md    | 20 +++++++++++++++++++
 .../rancher-v2.3.0}/benchmark-2.3/_index.md   |  2 ++
 .../rancher-v2.3.0}/hardening-2.3/_index.md   |  2 ++
 .../rancher-2.3.x/rancher-v2.3.3/_index.md    | 20 +++++++++++++++++++
 .../rancher-v2.3.3}/benchmark-2.3.3/_index.md |  2 ++
 .../rancher-v2.3.3}/hardening-2.3.3/_index.md |  2 ++
 .../rancher-2.3.x/rancher-v2.3.5/_index.md    | 20 +++++++++++++++++++
 .../rancher-v2.3.5}/benchmark-2.3.5/_index.md |  2 ++
 .../rancher-v2.3.5}/hardening-2.3.5/_index.md |  2 ++
 .../v2.x/en/security/rancher-2.4/_index.md    | 20 +++++++++++++++++++
 .../{ => rancher-2.4}/benchmark-2.4/_index.md |  2 ++
 .../{ => rancher-2.4}/hardening-2.4/_index.md |  2 ++
 .../v2.x/en/security/rancher-2.5/_index.md    |  2 +-
 .../{k3s => }/benchmark-2.5/_index.md         |  0
 .../{k3s => }/hardening-2.5/_index.md         |  0
 .../en/security/rancher-2.5/k3s/_index.md     |  4 ----
 .../security/rancher-2.5/rancherd/_index.md   |  4 ----
 .../rancherd/benchmark-2.5/_index.md          |  4 ----
 .../rancherd/hardening-2.5/_index.md          |  4 ----
 .../en/security/rancher-2.5/rke/_index.md     |  4 ----
 .../rancher-2.5/rke/benchmark-2.5/_index.md   |  4 ----
 .../rancher-2.5/rke/hardening-2.5/_index.md   |  4 ----
 .../v2.x/en/security/security-scan/_index.md  |  2 +-
 31 files changed, 157 insertions(+), 31 deletions(-)
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.1/_index.md
 rename content/rancher/v2.x/en/security/{ => rancher-2.1}/benchmark-2.1/_index.md (99%)
 rename content/rancher/v2.x/en/security/{ => rancher-2.1}/hardening-2.1/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.2/_index.md
 rename content/rancher/v2.x/en/security/{ => rancher-2.2}/benchmark-2.2/_index.md (99%)
 rename content/rancher/v2.x/en/security/{ => rancher-2.2}/hardening-2.2/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.3.x/_index.md
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/_index.md
 rename content/rancher/v2.x/en/security/{ => rancher-2.3.x/rancher-v2.3.0}/benchmark-2.3/_index.md (99%)
 rename content/rancher/v2.x/en/security/{ => rancher-2.3.x/rancher-v2.3.0}/hardening-2.3/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/_index.md
 rename content/rancher/v2.x/en/security/{ => rancher-2.3.x/rancher-v2.3.3}/benchmark-2.3.3/_index.md (99%)
 rename content/rancher/v2.x/en/security/{ => rancher-2.3.x/rancher-v2.3.3}/hardening-2.3.3/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/_index.md
 rename content/rancher/v2.x/en/security/{ => rancher-2.3.x/rancher-v2.3.5}/benchmark-2.3.5/_index.md (99%)
 rename content/rancher/v2.x/en/security/{ => rancher-2.3.x/rancher-v2.3.5}/hardening-2.3.5/_index.md (99%)
 create mode 100644 content/rancher/v2.x/en/security/rancher-2.4/_index.md
 rename content/rancher/v2.x/en/security/{ => rancher-2.4}/benchmark-2.4/_index.md (99%)
 rename content/rancher/v2.x/en/security/{ => rancher-2.4}/hardening-2.4/_index.md (99%)
 rename content/rancher/v2.x/en/security/rancher-2.5/{k3s => }/benchmark-2.5/_index.md (100%)
 rename content/rancher/v2.x/en/security/rancher-2.5/{k3s => }/hardening-2.5/_index.md (100%)
 delete mode 100644 content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md
 delete mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md
 delete mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md
 delete mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md
 delete mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md
 delete mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md
 delete mode 100644 content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md

diff --git a/content/rancher/v2.x/en/security/_index.md b/content/rancher/v2.x/en/security/_index.md
index 8f99fc5b739..7107c1a8802 100644
--- a/content/rancher/v2.x/en/security/_index.md
+++ b/content/rancher/v2.x/en/security/_index.md
@@ -47,7 +47,7 @@ The Benchmark provides recommendations of two types: Scored and Not Scored. We r
 
 When Rancher runs a CIS security scan on a cluster, it generates a report showing the results of each test, including a summary with the number of passed, skipped and failed tests. The report also includes remediation steps for any failed tests.
 
-For details, refer to the section on [security scans.]({{<baseurl>}}/rancher/v2.x/en/security/security-scan)
+For details, refer to the section on [security scans.]({{<baseurl>}}/rancher/v2.x/en/cis-scans)
 
 ### Rancher Hardening Guide
 
diff --git a/content/rancher/v2.x/en/security/rancher-2.1/_index.md b/content/rancher/v2.x/en/security/rancher-2.1/_index.md
new file mode 100644
index 00000000000..31ca2f58b5a
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.1/_index.md
@@ -0,0 +1,20 @@
+---
+title: Rancher v2.1
+weight: 5
+---
+
+### Self Assessment Guide
+
+This [guide](./benchmark-2.1) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.1 | Rancher v2.1.x | Hardening Guide v2.1 | Kubernetes 1.11 | Benchmark 1.3.0
+
+### Hardening Guide
+
+This hardening [guide](./hardening-2.1) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+Hardening Guide v2.1 | Rancher v2.1.x | Benchmark v1.3.0 | Kubernetes 1.11
diff --git a/content/rancher/v2.x/en/security/benchmark-2.1/_index.md b/content/rancher/v2.x/en/security/rancher-2.1/benchmark-2.1/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/benchmark-2.1/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.1/benchmark-2.1/_index.md
index 50b79795bf2..84112b8af6a 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.1/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.1/benchmark-2.1/_index.md
@@ -1,6 +1,8 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide v2.1
 weight: 209
+aliases:
+  - /rancher/v2.x/en/security/benchmark-2.1
 ---
 
 This document is a companion to the Rancher v2.1 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/hardening-2.1/_index.md b/content/rancher/v2.x/en/security/rancher-2.1/hardening-2.1/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/hardening-2.1/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.1/hardening-2.1/_index.md
index 0248d9f3f9d..7244d56d823 100644
--- a/content/rancher/v2.x/en/security/hardening-2.1/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.1/hardening-2.1/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Hardening Guide v2.1
 weight: 104
+aliases:
+  - /rancher/v2.x/en/security/hardening-2.1
 ---
 
 This document provides prescriptive guidance for hardening a production installation of Rancher v2.1.x. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
diff --git a/content/rancher/v2.x/en/security/rancher-2.2/_index.md b/content/rancher/v2.x/en/security/rancher-2.2/_index.md
new file mode 100644
index 00000000000..457ecb4477d
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.2/_index.md
@@ -0,0 +1,20 @@
+---
+title: Rancher v2.2
+weight: 4
+---
+
+### Self Assessment Guide
+
+This [guide](./benchmark-2.2) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.2 | Rancher v2.2.x | Hardening Guide v2.2 | Kubernetes 1.13 | Benchmark v1.4.0 and v1.4.1
+
+### Hardening Guide
+
+This hardening [guide](./hardening-2.2) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+Hardening Guide v2.2 | Rancher v2.2.x | Benchmark v1.4.1, 1.4.0 | Kubernetes 1.13
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md b/content/rancher/v2.x/en/security/rancher-2.2/benchmark-2.2/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/benchmark-2.2/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.2/benchmark-2.2/_index.md
index 68bbaa1ad7b..9ae8594599c 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.2/benchmark-2.2/_index.md
@@ -1,6 +1,8 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide v2.2
 weight: 208
+aliases:
+  - /rancher/v2.x/en/security/benchmark-2.2
 ---
 
 This document is a companion to the Rancher v2.2 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/hardening-2.2/_index.md b/content/rancher/v2.x/en/security/rancher-2.2/hardening-2.2/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/hardening-2.2/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.2/hardening-2.2/_index.md
index de19613499f..4afb7f76d8d 100644
--- a/content/rancher/v2.x/en/security/hardening-2.2/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.2/hardening-2.2/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Hardening Guide v2.2
 weight: 103
+aliases:
+  - /rancher/v2.x/en/security/hardening-2.2
 ---
 
 This document provides prescriptive guidance for hardening a production installation of Rancher v2.2.x. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
diff --git a/content/rancher/v2.x/en/security/rancher-2.3.x/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/_index.md
new file mode 100644
index 00000000000..0f3f04da692
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/_index.md
@@ -0,0 +1,10 @@
+---
+title: Rancher v2.3.x
+weight: 3
+---
+
+The relevant Hardening Guide and Self Assessment guide depends on your Rancher version:
+
+- [Rancher v2.3.5](./rancher-v2.3.5)
+- [Rancher v2.3.3](./rancher-v2.3.3)
+- [Rancher v2.3.0](./rancher-v2.3.0)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/_index.md
new file mode 100644
index 00000000000..aa31c9c9af7
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/_index.md
@@ -0,0 +1,20 @@
+---
+title: Rancher v2.3.0
+weight: 3
+---
+
+### Self Assessment Guide
+
+This [guide](./benchmark-2.3) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.3 | Rancher v2.3.0-2.3.2 | Hardening Guide v2.3 | Kubernetes 1.15 | Benchmark v1.4.1
+
+### Hardening Guide
+
+This hardening [guide](./hardening-2.3) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+Hardening Guide v2.3 | Rancher v2.3.0-v2.3.2 | Benchmark v1.4.1 | Kubernetes 1.15
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/benchmark-2.3/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/benchmark-2.3/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/benchmark-2.3/_index.md
index 09b6915dca7..1b705633948 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/benchmark-2.3/_index.md
@@ -1,6 +1,8 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide v2.3
 weight: 207
+aliases:
+  - /rancher/v2.x/en/security/benchmark-2.3
 ---
 
 This document is a companion to the Rancher v2.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/hardening-2.3/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/hardening-2.3/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/hardening-2.3/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/hardening-2.3/_index.md
index fb495c04b2a..4c6907e9f64 100644
--- a/content/rancher/v2.x/en/security/hardening-2.3/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.0/hardening-2.3/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Hardening Guide v2.3
 weight: 102
+aliases:
+  - /rancher/v2.x/en/security/hardening-2.3
 ---
 This document provides prescriptive guidance for hardening a production installation of Rancher v2.3.0-v2.3.2. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
 
diff --git a/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/_index.md
new file mode 100644
index 00000000000..77c1c408ad9
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/_index.md
@@ -0,0 +1,20 @@
+---
+title: Rancher v2.3.3
+weight: 2
+---
+
+### Self Assessment Guide
+
+This [guide](./benchmark-2.3.3) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.3.3 | Rancher v2.3.3 | Hardening Guide v2.3.3 | Kubernetes v1.16 | Benchmark v1.4.1
+
+### Hardening Guide
+
+This hardening [guide](./hardening-2.3.3) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+Hardening Guide v2.3.3 | Rancher v2.3.3 | Benchmark v1.4.1 | Kubernetes 1.14, 1.15, and 1.16
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/benchmark-2.3.3/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/benchmark-2.3.3/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/benchmark-2.3.3/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/benchmark-2.3.3/_index.md
index 4f8d2d1b1f6..385d077c025 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3.3/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/benchmark-2.3.3/_index.md
@@ -1,6 +1,8 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide - Rancher v2.3.3
 weight: 206
+aliases:
+  - /rancher/v2.x/en/security/benchmark-2.3.3
 ---
 
 This document is a companion to the Rancher v2.3.3 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark.
diff --git a/content/rancher/v2.x/en/security/hardening-2.3.3/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/hardening-2.3.3/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/hardening-2.3.3/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/hardening-2.3.3/_index.md
index d25489d2e06..90ba7608d1a 100644
--- a/content/rancher/v2.x/en/security/hardening-2.3.3/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.3/hardening-2.3.3/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Hardening Guide v2.3.3
 weight: 101
+aliases:
+  - /rancher/v2.x/en/security/hardening-2.3.3
 ---
 
 This document provides prescriptive guidance for hardening a production installation of Rancher v2.3.3. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
diff --git a/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/_index.md
new file mode 100644
index 00000000000..d6bbefc794c
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/_index.md
@@ -0,0 +1,20 @@
+---
+title: Rancher v2.3.5
+weight: 1
+---
+
+### Self Assessment Guide
+
+This [guide](./benchmark-2.3.5) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.3.5 | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5
+
+### Hardening Guide
+
+This hardening [guide](./hardening-2.3.5) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+Hardening Guide v2.3.5 | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes 1.15
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/_index.md
index a67a0c6cbad..6d0734a8bc8 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/_index.md
@@ -1,6 +1,8 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide - v2.3.5
 weight: 205
+aliases:
+  - /rancher/v2.x/en/security/benchmark-2.3.5
 ---
 
 ### CIS Kubernetes Benchmark v1.5 - Rancher v2.3.5 with Kubernetes v1.15
diff --git a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/hardening-2.3.5/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/hardening-2.3.5/_index.md
index 4f9aa6849e8..1701e56ff39 100644
--- a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.3.x/rancher-v2.3.5/hardening-2.3.5/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Hardening Guide v2.3.5
 weight: 100
+aliases:
+  - /rancher/v2.x/en/security/hardening-2.3.5
 ---
 
 This document provides prescriptive guidance for hardening a production installation of Rancher v2.3.5. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
diff --git a/content/rancher/v2.x/en/security/rancher-2.4/_index.md b/content/rancher/v2.x/en/security/rancher-2.4/_index.md
new file mode 100644
index 00000000000..67cda4137b8
--- /dev/null
+++ b/content/rancher/v2.x/en/security/rancher-2.4/_index.md
@@ -0,0 +1,20 @@
+---
+title: Rancher v2.4
+weight: 2
+---
+
+### Self Assessment Guide
+
+This [guide](./benchmark-2.4) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark:
+
+Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version
+---------------------------|----------|---------|-------|-----
+Self Assessment Guide v2.4 | Rancher v2.4 | Hardening Guide v2.4 | Kubernetes v1.15 | Benchmark v1.5
+
+### Hardening Guide
+
+This hardening [guide](./hardening-2.4) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher:
+
+Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version
+------------------------|----------------|-----------------------|------------------
+Hardening Guide v2.4 | Rancher v2.4 | Benchmark v1.5 | Kubernetes 1.15
diff --git a/content/rancher/v2.x/en/security/benchmark-2.4/_index.md b/content/rancher/v2.x/en/security/rancher-2.4/benchmark-2.4/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/benchmark-2.4/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.4/benchmark-2.4/_index.md
index 672fbba7826..2f6baa62064 100644
--- a/content/rancher/v2.x/en/security/benchmark-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.4/benchmark-2.4/_index.md
@@ -1,6 +1,8 @@
 ---
 title: CIS Benchmark Rancher Self-Assessment Guide - v2.4
 weight: 204
+aliases:
+  - /rancher/v2.x/en/security/benchmark-2.4
 ---
 
 ### CIS Kubernetes Benchmark v1.5 - Rancher v2.4 with Kubernetes v1.15
diff --git a/content/rancher/v2.x/en/security/hardening-2.4/_index.md b/content/rancher/v2.x/en/security/rancher-2.4/hardening-2.4/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/security/hardening-2.4/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.4/hardening-2.4/_index.md
index d4ddfccc434..583080c10af 100644
--- a/content/rancher/v2.x/en/security/hardening-2.4/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.4/hardening-2.4/_index.md
@@ -1,6 +1,8 @@
 ---
 title: Hardening Guide v2.4
 weight: 99
+aliases:
+  - /rancher/v2.x/en/security/hardening-2.4
 ---
 
 This document provides prescriptive guidance for hardening a production installation of Rancher v2.4. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/_index.md
index 84810ef66ba..65db8244e94 100644
--- a/content/rancher/v2.x/en/security/rancher-2.5/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.5/_index.md
@@ -5,4 +5,4 @@ weight: 1
 
 > This section is under construction.
 
-This section contains the hardening and self-assessment guides for Rancher v2.5. Separate guides are available for RancherD Kubernetes clusters, RKE Kubernetes clusters, and K3s Kubernetes clusters.
\ No newline at end of file
+This section contains the hardening and self-assessment guides for Rancher v2.5.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/k3s/benchmark-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/benchmark-2.5/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/security/rancher-2.5/k3s/benchmark-2.5/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.5/benchmark-2.5/_index.md
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/k3s/hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/hardening-2.5/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/security/rancher-2.5/k3s/hardening-2.5/_index.md
rename to content/rancher/v2.x/en/security/rancher-2.5/hardening-2.5/_index.md
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md
deleted file mode 100644
index 470c4e4c880..00000000000
--- a/content/rancher/v2.x/en/security/rancher-2.5/k3s/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: K3s
-weight: 3
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md
deleted file mode 100644
index 8c8c7247e3e..00000000000
--- a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: RancherD
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md
deleted file mode 100644
index 4631d4c984f..00000000000
--- a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/benchmark-2.5/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Self Assessment Guide
-weight: 2
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md
deleted file mode 100644
index cfb41e6e16a..00000000000
--- a/content/rancher/v2.x/en/security/rancher-2.5/rancherd/hardening-2.5/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Hardening Guide
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md
deleted file mode 100644
index d7b8737d2c6..00000000000
--- a/content/rancher/v2.x/en/security/rancher-2.5/rke/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: RKE
-weight: 2
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md
deleted file mode 100644
index 4631d4c984f..00000000000
--- a/content/rancher/v2.x/en/security/rancher-2.5/rke/benchmark-2.5/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Self Assessment Guide
-weight: 2
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md
deleted file mode 100644
index cfb41e6e16a..00000000000
--- a/content/rancher/v2.x/en/security/rancher-2.5/rke/hardening-2.5/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Hardening Guide
-weight: 1
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/security/security-scan/_index.md b/content/rancher/v2.x/en/security/security-scan/_index.md
index ddfc7763543..bb82838bc9a 100644
--- a/content/rancher/v2.x/en/security/security-scan/_index.md
+++ b/content/rancher/v2.x/en/security/security-scan/_index.md
@@ -1,6 +1,6 @@
 ---
 title: Security Scans
-weight: 1
+weight: 299
 ---
 
 The documentation about CIS security scans has moved [here.]({{<baseurl>}}/rancher/v2.x/en/cis-scans)
\ No newline at end of file

From 7c5a752e23bcff13e3032c21b89e5cf93a703f5e Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 30 Sep 2020 01:44:39 -0700
Subject: [PATCH 214/265] Add Fleet info to Rancher docs

---
 .../en/deploy-across-clusters/fleet/_index.md |  24 ++++++++++++++++--
 static/img/rancher/fleet-architecture.png     | Bin 0 -> 85204 bytes
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 static/img/rancher/fleet-architecture.png

diff --git a/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
index 3d66fde4d51..aedf09fdb38 100644
--- a/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
+++ b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
@@ -1,8 +1,28 @@
 ---
-title: Fleet
+title: Fleet - GitOps at Scale
+shortTitle: Fleet
 weight: 1
 ---
 
 _Available as of Rancher v2.5_
 
-This section is under construction.
\ No newline at end of file
+Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that is works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a large scale. By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization.
+
+Fleet is a separate project from Rancher, and can be installed on any Kubernetes cluster with Helm.
+
+![Architecture]({{<baseurl>}}/img/rancher/fleet-architecture.png)
+
+Fleet can manage deployments from git of raw Kubernetes YAML, Helm charts, or Kustomize or any combination of the three. Regardless of the source, all resources are dynamically turned into Helm charts, and Helm is used as the engine to
+deploy everything in the cluster. This give a high degree of control, consistency, and auditability. Fleet focuses not only on the ability to scale, but to give one a high degree of control and visibility to exactly what is installed on the cluster.
+
+### Accessing Fleet in the Rancher UI
+
+Fleet comes preinstalled in Rancher v2.5. To access it, go to the **Cluster Explorer** in the Rancher UI. In the top left dropdown menu, click **Cluster Explorer > Fleet.** On this page, you can edit Kubernetes resources and cluster groups managed by Fleet.
+
+### GitHub Repository
+
+The Fleet Helm charts are available [here.](https://github.com/rancher/fleet)
+
+### Documentation
+
+The Fleet documentation is at [https://fleet.rancher.io/.](https://fleet.rancher.io/)
\ No newline at end of file
diff --git a/static/img/rancher/fleet-architecture.png b/static/img/rancher/fleet-architecture.png
new file mode 100644
index 0000000000000000000000000000000000000000..f8584482ca2ab47c606af38798fb9999fc9715e1
GIT binary patch
literal 85204
zcmd43$L_4m+Ap@HBiYs`ouMb5Z^<6)Epiw_)8q!4rb*HnkVBI*+=1`PQ{R;z*8BM!
z%UAG9z5a_-MHTgg-;?V9v<&IL{>T6JAOHBrKmMyC3-&+$@n8OL`1e2mFaHx<`Hz49
zum9~I|M>o2%hO-lBd?n5AOFN3e;xf3L&|<${)r3!#IR@>{+(7)F-7hC?=D;565Mb5
zw92b2{p%SF!H|C;%)c<oL79Kz9C804*?&_g7XI~oRAk+Mc1Zpkfe!w6A4UI<zwTvA
zRQ%PCULso}f8>v9JlB8a#~WStzn<B$X|DS2ug6gQ-_*a!ziuq&ko|Qv&9*AZ?yL9{
zrt+U-hF5h_`=5_kFpPhpe>JTBbL=b<p*T(v|B48T{1+YP#J^}PPyU558HQmfnbHxA
z_wJMq(Xgddh26M+Vxr@sm__Yta~5mM>1$QzaMj+Q_VM|;VcsG1^|K>&@Z2Uf9Ng{D
z`0T<-b)JD5TqVt15BAK%40HOe#_EH}H(Pv87gA9N^z{4K_Ah#G|HOD1PWco56!yn`
zyLt5{N|!v)W#xmgrjM^wnsTpN_W&4rc8El&E5@p!X)kX9jU#y8rE}u+>2J%r=}p^k
zi=H!)xVuIJsa%P2g^MEl#R<}SpKK;Fx%l1urJ#eHU$=@Zz2OkpKwpj}5r%}Fzv+h5
zXSLxq^ujaVLPuI3(*6U^;P<xp^CQ967JqQIHhX2YlkZNrLS7lhIO)`{mj}cI4~wVn
zqMNc6^}E=xBsXGopW*Uci!Z%$HiF4xIL#Jz(pZ$5=Y5vFg-tV`{6t%7!9Dmz&#xcv
zYd>#`-Y7#+gp=RZq8dz(;Kjg;G#$+n?SY>6(<1bEzq)W;f$`VVWF!qvEgqf}bC`tq
z?U|WmVf5lY7M_z&SIXnlEAHG4sPAr@b}oim0+RPB5V}~WQEm%OSkg~8vmRuUtMDKf
z`Td6Bsj*+#v|q$ZbChE0yVX-A+^#sHGxeLMXc=Lwi%6G^UKF!DsvM(pT)Q4r`M_6=
zVJEDj(}lxwc$!DX=JBAQ860bQ?39Qp)|1cd3}rb-n|!+?no0*7g+~vM_MWA-E%rG~
zDQ5#UettT+>ZgaY$M|AUm?RQz1-+fAHg)^GZZsj=lTBn-EmDZFWB0;V$FkYdWa_a>
z?iWY{(WGp`JTUz<IwA=fU(+8n5Hk|N)9o*~;1T|O83NO}FQgpd6lE>ZaHoqTw=);W
z%=v2)qAN+z27V#_yqCgMqwFJjE~QT+)fb;}#Nnp)BKZ9#^#)l;W;8@uq~Vk&v3xss
z9Q)|;hr%2>N7SWBzF{WQN0XB&fo-hLZn^27;Zf(rqGw9rKtsIsif{MZxPF3*8uMdZ
z*C7^~X5!q3`|zsRS9y0}qk+9&%%e9~!T}RSFdtq<yGH?%M@+}?Lwyng0jd_s`u-cb
zF~M9(jU#sV4WiI0&+<XQjWSg-Nv7u*`R!kRM7jIRtT*j7N|ev0*34VE9*J}lR@Dyv
ziBg{&>5Ecx^Rs&VYBGR#YZ+NGKbDx6{h&tC$ivt?SaP?;E`tv<?}LM?zv%i+{rgv;
zo;BDs&YAZJ9ybw9FXphslEohnw<^6_6a6W!1iHej!%jou=Ff)Qeo?N9qZXZ*Yr+*&
z_u32%oyO2H=!*B{iF|5A#4%6zVv`kDja1In@YCRIgATLVXg3=fjP{FlIQR$~*<-pH
zolm=)QypE#c!hpu$Ai0p>DSBK)8r<a>-1DRqb{kHX<9Alj&Gx1^hiZlY>h{PzZPh=
zVO@qY3|?B!-TZW&;9|3B#kHBl#tEBMEePJ;`kV~%B%0KW2V#oiPZy2k&u)4A(5;h3
z!({b=vBl|WA*!C>@h0Y(NcrEDdi6A(|8N)65OJa~cWr*|)did1(kGLJ61S%L{6*^R
z#ai3&mTWq8@ee80IEGD|;WZ}T;W3J`UX)(`e)GLZ(qBL8?1o~op#UAjH>qE&OKUhK
zE|CkGW-AI;3wZPrQN)`k_W+63kJppQ<tTpdxwpT)G>vQ(AN<Vffd=`rhxdzh|88rZ
zmfv{cJq+C7`zf+SR9FaFue`KQ<1-zD*Kk1R-RpJ8k8J)F!qmjgClvt*45gqZzSYn(
zky3X1Dw%Z1+xZ7-h;PyFvPBOkbzC^(J4Q%j@q6Kn8sKZp;{~?X<7aKy*Kx@r)qPj@
zb4mWKk5Dn67A(zkHq$Bntw$QeSR?1XTWanBZtxP8ip@(z$EU!QnJ#ShwuZC9kPTU;
zaDU&XuRg75H4bEQx+6XL;$Ss%H!I;IrQ>WJQTTK<qQ>Sr8lm!Gu5w{0!>TVILp=CY
zpVgXA+e?$r8_5UPwso1=c4?;g<O0%YzY-<ByM?#Alp|hNiamJKmNa&HM3e5j3r4U%
zwIk>x3L|rMZR*#@PGV#hnLfB>C{1#Ggh*IMYq+YfEvf8r&6@ZnygYrr6$i-(8r$;^
zdwJ3`Md{7v3S#)<F3e`QY<+;{@z81+S>TE?x{CLh@6<3Q1{N<yO=DfZIyP;6V)Ae%
zvNz&X$AWM88g5p!P|E)mf-Ipbj-WgUge!1pm@y}2D!PVBGsbWE$oOwAwZLt>LdzyQ
zF>12itJ%1nU%!&gf%gpA=0v^T(e0-E9D93j-1+;MrHRnrn{JXvl3HOq^}imAC}iu#
zPjg~z9tsNd<WFI^S#&0#eccarEg%E8A}<d#qR4SIW}t*I@lCQl0pp2R6x;ctNvsoa
z80}(tA0Rp_ZtFEYQYL=2_$^?Y;`|;4bZ%_;$H2mMtCMnc$)(;VHkQ`9xb%?JsnidR
zgxT={xt#n(0@CWm*D0)AFs0%tf!6yP_F-`w9_U`oW<s-soz*MM;Tq7rh~J2UoYA^7
zhuGuh*77#2cS30|L}|8AG|nP~W4ayp7!ZSr5+_G>c27nMg(b|!^BGH++nwf$cHWOi
zh&T<TRPK`a=4M}<dD@vw&KRt+Sy&LCOKeV6Tg$bXUPP4pQhUvEI%G+P588Yr$;ISu
zXKW-%zsW5h-JCy;14H=Bif`q2+>Gp#vh}ofB%DqYi!aZUT^lr}*vRiB_8uwbyBSix
zzKHc^%V~{2rg^ouO05UEK7QICVGpOxVeRr54MFq0?0B=N1qsurBO;;P)NLcJe!mqU
z>jxWahFvgRCie^z7YQ5rS1#ifn`GKb60Qd75-d?nrMmGwkJ#~nZul1riHr6WL3N6H
z&O36>Jo^*65>x~)o`FDE!DH|fT&Pql8$fQ3Z?Eg1Rj~T?r48G@Cv;|RIr|g+4W-;i
zQ}lr=ZKO-Ycjup(+eUrx>7dnrrJ1V1qWNT!HX2d+R~2(wj~F8i2$^A?^-jf^_rz%?
zlY;fx0a6iWyP6fT{)&QY&O*-4)ojh<_iMB0Ab!q+55vy8RQZ*E>I6j<;;4VpiPn5=
zmRLQ*@~Gph=>x^#FB_(HtQY^eWjuD8Tp=>Am@qr-+3x10sM{DhnK4rdEne0fZgq<2
z-i?F!HkrT7BQl2{>X<^5c$6s^Vy}KhJmgBxPksv?I_1p16Vs_Ki|yA%OMlBkb7^Po
zKB0vxrQ07)y-1NRTB)*@h0ACR)=#wA>08@ZEl6iK60c2ujLd}hxut0F?s(zDGq@_|
z5sqbil#x+s&o}KWGtb90dF`+)WyUPyS|4$T&NO^@zK_E*k`|=JnBYOKdE2&}eJPhI
zFnI?6xbTC7dFt;C3F_Svx$fcI7=(6ox_xS75oaah#VN>-TwV{G9G`SL6<s{dSoPt|
z=fs<@>6Te>xm5f{_!jwIFI_o|_Qs}sEH$1I=Ms`KFMjqtGiZq`y@8c0(1}bE#HNPX
zm6U$VVcaFx)=RtT$`dnsu36(_76Y8Jm^DU7iyA9F2wd7YaE=KWSV`{=fIVO2Uw_@g
z8QI(iV-M2KRE<f0p9{|BCWfj<H_lc!llMpujJLt)P%B@m=@<0Q!$M?DUK<!Iu0r^d
zSnYMCo^`cZYIV#x<x33)PcbQeMPK9l<``5d(kxWTl?vc{iIwok%wP7-40IiuKo=>(
z+quxKGZ{ZrW#RU#Bw0Od>bQ7B4^}FRCeC-y=Z;&2TERYiqawtfZk)<j`J3NdG!5z`
z+*r!oxl(f;6R`X@DFFO5eAEgxum#2;$T9P^6u<S?C!xz~m5<$Corqf~E>(*6uoQ{S
zU1~rpau*%JM?puTlfI)YM6;RuCv7zbmrWdN@=WvH(?Oztg_?3w_}s7;C#rETJX!a9
zBY}%MW3+b))mPs_e@5yu7+_s-b0bn=RLGaAxprEk?D3;>@sJihr6%#7fyOn$=7fbD
z@&zuf3a{Yl*W}Y#{+P9%n1p-1Q`J_0l56?FEDk_g5uc7wGfTWsqtfGEK3Y9E#;f`u
zdbs+$i!9fzAx6GvE`Oazg$y_P_S|zssQL1e*`k`!Y|5Ew=I2fb%OfibT@LMHs-I1r
z?32gky~PaTFgr*j;;0_*yEX~#sP;fGFP^C%lIK`F8m;|~;x}V-4<pD5bCy8N6IR)_
za7`y3$eI<mTsM;B=y4aWidc9(vhg;WaJzoT^!pWXF2B=a8Xfk}Sau7V&YuO8S{~0*
zDTD{U8Vp9q8c8eG%d8tpRm<&{AR=2>zav$IM?RVi?%_d$uWM*mc*N%~DP(Vcx<^;9
zBKjtL_>UMbE|>UHqgkXD7T377(Nwue!(nacKCt*xTJ+r}#E+$LDSk3liqMNw;+Q06
zI5K#lQl^t6;l}Sm?lN-P4O5G2>wRl`|6U+nY?f)(&N%k;WBs~%t5)T)!X1lL-l<C$
zIN{AaMdd-JpJsx!Blt%!Z~hwFkLH+qRNHq_wU-ef>;f=cmI+6x`-Th^+G!*CSzb&b
zpuc>Nnk$D9ao6uQNZ&sEIa^}?5f<{r``84H?WxaaT6)I1TchB8el)*n)w=g|&A^E2
zHqU%4cs$*=z!kVg3aIvdqIKSwZmtA0@4~k<-P;OSL86GIo4hJ-5$KnYm}fyp<=gSN
z^Y;1h^>{VO)9WRgYx(&hKg}>mvxoEeh@EDc4@bzAx%V#lshNN-_-#20OVRTp&cDT+
zN>_aJK6-yA8;^}rX61=EN*-<Rxur?bzMt7rM{OZ19L^oc>8e)PocIk4Hm|z><I5@B
zUh^d<^qZIL^ae3pI*9o@ii2m5VPyq^R57Mbe#7I8MMaN6l0Uo<jn6AGw-3?KFASYT
zKm`l=&>p+L7XC|M+Pbn{0)>dj=;$HW?VfXTA?c;Nw-$Tc|KzUyeTgzVIT?`%Ed^vN
z)I%{mj*kp(jbr&08O7K9Qj>EsNxW>hr_R4^O@Gs1Cq9z0yXo#*mRPYZaj_KgGlXu&
zhR0P@Pha^Wn|u80Hx`7BXg6`7d6kYiUqU<;^p8~<;QJ#aE?o>?Wb^7Uy_+5<vsQwx
zJBOnX=#q12|FqZ}*%%hW-BPwTaGLBB&Dy;a*nuaEXJ#tcp1q$b&yvgqkZ{8UiE=Oj
zC-PKoTfayd+#oDGSnJY?xaR)Mx$X4ANFK_$Rzsb|<wgtw#ckI;Tp=?>bSQ7&etoZy
z^|-G8Fehg9U;3^2L3ld7^(f8TSz)%f#A*~@$ZHUexiGh0b_Tzg4#SItTeLc}$>LYi
zGaMbD@ovx`YA@#4I3)D#%dizaP?@1A$v4X^Ht~(^@m838c?r4ADmt?+6!R{F8{%KX
z&)BtkL%<{lG0bMAj<-4H?iYXHNy|yOyTi9<21Mu-E-jo^bxqCck1ee}JMxKJ7JrGz
zgTdVEkrPiQdTl+aZpr&aaUlPWT4rvg{}N{f)H4ru0Km``RoVC67vCIzR^*0J94@SU
z9<XGhq2%x)=l83+xIf;yE?bwIlJgq^lvB(vvzV4-^}wol3t~dsJsLC@{X&Agk1u`i
z_^ef_J$smRXm`oB8tfJDzS!Kbjz&PliujALzz<XjlsqaHmCVdgC@F52{fZXzf$yKA
zUdTdMww}UoZe97zQ}!d7+EfOkQfk44`Ic5KE9$T<)<bTstQ>ZUs)g*CFm}PSJdd2;
zh%BuKbvbODvZw!Q=qDLk%FZt<X4|WufJ;_XXigvPWT-!4B4y-otV}w8W$OARmqq&E
z7nt*-w{c|(`Lw%)aJmeZJATn^knMk<G&%Jwa(#~=ejh9WLWF;SkmMOTSPe0E7GDa=
zywGBy17vpGfQOu=TM66J3eb!F5KACsj=I^X1CC^(wV7MDzwr><(G^pqOU$kDz%`rM
zcc7i%p5SQQS`24(KbV{)9a4v>R?Q8F?Zfwrg%a{IptJcZ0{u35c|^*%dJJE;t^mA9
zR=IsJGPT<m`1ZiJQy#PKzbqD}C0DrqCh6x0kILGs&z`9KN@je&*$IP*^U$Msl)9zS
zLd@sW`gm*(_^fzCndk>d%u`Z}DJ))xuw47fEtOC5?i2qyByap8rj`^?hWq-?$>xh+
zQxaU97V|!FZm0_)HoRZ-e$iFgAV1+5x8u`FB;N4z&myG}nq?qqCf(t|^By-_u2tW_
zql7H>Wf(vIp=B5lD!tfAGJx{6APrCi6hGer;CV$SJKrZC#hrISG#39itAz3*olDw{
zI<oZFD^skc{ds86T_r<ohYH3{f8vx9Khl8ZL?^q2xRlWbQ{i9iqP2+;*!^puJezi+
zB!Eyt;0da#HATFI%KKiM(#axlIEhP(w+`4m;%B;%3Bg{orwMbp*LCp13ZJ~e!S{TL
znWKB8r3$;BD`3^;-4D3B0Ljxv#v1zl%M7?vCeiK{f)py$B1fSm>%Bdd<VkbV(?K6*
zcyobbT<m3+92Dc8o~>2d7ZM%a)j0e5^{eFO@)YwvWONu?@npCyICo{6>1r#$X3b2O
zct~qyvkSL@J59{6GNcSKJSKWfUTex-GspG;S+T3@2SG*B%W;mv6&?EFom>~c8gQBj
zoow?fB7h4WSlYjp!7@<r7ls&GNVlL>2;WV-8nIhFf|^Y-4huHCdK#X1NXYZpI!dyT
ze3K$FjwC$NP2h;TeF7-Q17BrCc5Q#FlkY39apJ++!iCjxyK|Ct(baMz!0Dlt1OylS
zSmW}!uC^;}MU#yLg$>TRdU>Zu(sAhj6!6XSuSG4{x=mrNKwXn$uW@q$<{{7L?e5k$
z<rnhNUWE-15ATc3YzPk1GzFS4lObA367WWX2e>RgOvJxK2y8Kl8}e|Kvd0rRuk+vY
zRQ`B{X8z}gCb>Bf42dh_%-6u%zYGZuq|Q#U?)3`~ozcjuVY;qN4jI|T^Q%k>@i1p+
z;po?<n>lY8U`fVxcIZ21%bO7N$aNiPIT=lS0l6O@#;7wDU+eKGyDtast?(?vq^Efz
zOF#aVWWk3`G}!~G&D*n|G!XAnfttj@E=zna%fK#g1w4|`8JxAw1&nxHt(70^?9Jtc
zJOlfACBKX+*dys)2PH897*OJy9Cf3J%lUdt&y}P5<&xyGUEV4H<wWo9PTR=#5BErB
z6>S)VTueF1;Y$Ok;>B7h3z0Qn2ilWHx)ChO6#Ie2-F%7n$DOTn=p9lm=_@Fa<-jjv
z?+Ufv(J=ow{8~uUfC)37;kD^Rn@x3MVprYoq8sz)nZ*?~MQ#eOJFf7|-;=oz&EdYL
zQ9TVumrtXx<n7B+Kz3r%<xwRC_A!XJ+rO-Zz>gnqgQ?XJ(4ZYvqWmkK2X2c*{mK}y
zB@9#CDF4{O1C2N9o>A~|Z-Pbnl;}9_5L-qk(609(US!ll{pu%tHktD<0~2CW@0mQR
zn_s=}`}IJ}Z7JnbUSFQ?i3^1KlvA9O@#W@eypb1!x7oLJpF)JB;<XBoPGSTR9L-|)
z1aJUmy~!#&I)aAh`Dh9f{Gtb=yxjA(yY0*i#6~*ZN4Jv@v`HLt?!v1ZedBUTp|oTd
z*BgZM8Ciqfhdq2GCuc<>8#A~t<8{Ac6mPG)E9%*;9X;Y^nCF%WvJJ7QU&7zfWAWAX
z`vdhfY+zUv!2L6NE&SH6WCAKnoJ9s2T`{idS@rdoRG7&r=fJzQ&XPx73vQKpLMZ{;
zyt$b4UO|syV4)k~J=3rg!^hQf0&XBe;?Hk+jO9^Jf`JiC$0l{6F0b<oZ*YvnhXx<A
zjudQRTn2zYoO|+0k%2XM7sAuVN5OFVtA@N@X1|4OidtNj%2L;3^%QECM*5ak!}*h0
z#Zn>SlezI2@@#9~qWC14nHE<w$zx2tm$AE*t_xJX{34MJ@t(i-c4{S+<+sthqyo>M
zo`P0EN~ytY(6npik|MF3T|xLq=9^8R3eNN}b3Q#IDb1x8FPMzD-U#OrXJni&&25w3
z7`Kg?>~Q)4RVD}&3{rSAbdOuV-(!w)F{%vqkpaM(S~-g&O)8vtNX@h~eh#@9rBJKh
z8~Gg$Z4;Ya|FnS*yS@N;x0abeQy-;>b@`sZ4v<^CIYgX(%Sw1W*`8;HWyR$A{Sv9h
z8ybCEtk|RDlT@aNdy6W?cQDkA>XL4zQ#d`L`Y5FP&F;kk%*^w1Xh=5!#nE$d{q=Tv
zQ%NdJH?O*N1&(4nB!xLvlw?%{g95960e6DiF@9v@*y$|f&|7p$#w!2FZ_Iv`diy-B
zFIHHUg@%2eOt)}%Tp(#(Vq3-W4_TW>`Vq<FA@3HbE#TGsrT8BRqNMQ^_UR2-&Rr~X
zxJSg{RMs-@BrrxAQC#}&P~4tuHGTTu;i6s>;GyvR%qUje2>qe&DP=qkwn&EN2`V3d
z;ON6TraiZ?GM($%FVJfy99lN613Lop)?%fyDmkA}d~Ee^jQ&aOlFW-fbuQ8h=DqmG
z+o#L)#QOB5FfD61mGv9McE7*o4M<*nk<a}y!QuPXLhyfGgbcqO(}~qV#vd&EyMYW6
zzPnia;8mcMWWwBwgeWvjnt%A2yQ4orGHoU@S>WGw33dCq6(*Aa8sSk%T+=8LUh|n=
z(p-AbmOJc1Aho0i5X5Vn)CQP9+V8h>pJot)gwH5?YS*lI5LSnDn9IE+&5fC6V?q5b
zzm;*#wuueC85V?tC`~c}=wpy2<NUF?lQ>x@``N8Csyyj79p(M`j=Fq=_`%4ma9U*&
z`aJamztZkpwo*;)3qf??NuKi7PqJLtfw5Cc)Bt#S=d2x1S!w_WD?n_<Amc5&;Z{--
zs}+Y8Zi4!MI6((NU;F6P_w>v)$zX+CqY65+&ZvKEf!=EA4Z@H7*z*${tui4p?K<B?
zrEtcfeW{W7{qmcj%r(9m<oPu-(r~*aY5Wj4OMIK8k4w1|2-C>$#fLhJ5CR}1Sv~@a
zo@c!m2^+JovVIyQ2QmW_{A5AjnScDYx%0yDO4u&Xh_?F9???Wb1uCDXNg+#pM#uWx
zf}=#5c0Ouh=lkz;z`_v-%^+W<>YnK#o<)RwjneqG-j{gH@yB3;I3Z>Cpzd+EGV{$!
ze6ljOV%DbyBJ~zMPZ<_XL<;aWhz&a-YGsU=qGK51;~<^HN^uVX!{X$cnWHOu`0C<<
z)#0`dEo&7Tw;XV#&PaU>X0~^3wIg%+WU$Wgc5f%qy&Qm5r|d+fb=!XM06s>`1xkQl
z`lRu0szFIl-H6{!n^;OuF~D;X#czf78k0<P(&$lMIJ#WJ^BJ&sn#V}Y%eD0M=~#lN
ziu9(%;7kky_~4!xUHV7fEJ+(r6R;h>yOZmj?hnwqhiB7+c|~IrdZ@|TWG!!d4Pl46
z$!zvK%?(?ujc)_w;j@W?G33zAHybG1`fckg%XhGDZ%35)RqXr?QB8RUR2K^FfD4cw
zQ`P$O){x^Q(y#9BwhCkRs=g@QEkug8C*mc^3>ex2;ui@o@K^5K;ZQdf)A=STD(PF^
z+zCJYrruVcNZ0)u^!dZq?<T?61m%QrU2^k#NblWGTHwgB)A`z~^!kPr7UTCK2Nk+)
zWpgz_%8uVW9<sZM8L>vB)*Ew;{dL2A{vEF=0S@>%&O#hs5#HD>*5s@p$l95Wen#gQ
zBs#wej)|RCOx|maC1flp1N%y$iO00J@MZ_fYV-03i80m$@vse|2%$gPBK0(Qd((sZ
zlUm;vpz`3}OM}RVh(`W+b+;VaC2NqD7JN7Q>Q>X~HrWm?Bbc4Y=H;_CKi5`t`#aer
z`ciOedr&Wj%&+$0$}J{mkhk*NKMZumPuvmHUmAc)^aC1(E1oA@Gz^tz5N!P#g*-jv
zb8Gp8?>es~@TX-O-iL7*uG6@uzh#_{Q4kMJ16rtKz!j;xDoQMQ*)1>X&|8Is6u@cw
z#FQ@IC<2IrC(MBMI3(z>1~OFKT{!(NE%_-SCynl9I<&HcTBDAh8IBNMr6PhyMwNa_
zNedDuF8)r}m%z20I~RmOLXRnU!&7z>Biw%()2(V5&-esyIM7#+jp7FOfcSCY+!dLy
zS96r%*|K!dTayJox*%+FGlsS;O_OFG-o8i(6hotuU`-zl79VI$v_u*vWnNOWoGL)u
z0skOBcdZSuZPKB9vI5bV#0Q>4v0NvylohF4-Sd7kE#ormV0H({MyuUAe$|Yj2@2cx
zGdWe_S@YQCpNgf!I*4|acTCuA8D_X!7(I8Nno$btH}p)HlXYwBV#Ny5VIVu=nz;KL
zB-bEH-mlje-;8eI!Ck)1;zJ$u1mycUduskR=`eVy*b02T)QkG#fX_?3q><@hFQ(F{
z%Q7KrvWMoDKsXt_`Drarwn8Sj&akI+4ha&Sy|Yf?cT<5S`AnBwx1{%^#2-c+h%6pY
zXW~xzh2-*Fj(QPGbRD@w5<zk(&cv$6Jwbi}kb*xY$OPM&VJ7SGjgRnCwMotv1s8yF
z5s%b7)$eQU`Yi>=4C8OV*r9I`*>yKVF_TN!6a8c{@P4kQbK^oI1o6g)z9mo8+Xp?j
z#io>2@iCju5}2q);XXZ47yC>0j#MJdz7=e6kn-z!vw%Mkx&QfT{XNDx2KQJ2DG;62
zC0=pA`A6(e$B{D)Rb~c7DK^(?UWG^~c-(rzw#1i$zAx$d3h6dk^Rake;R@|y>G#PF
z1HpYCFpu8aG>L$u5gYum&2MLFL3W6B37?K2H)f@9HLM}I;J^m(!=crAzHh=X)l!s8
zHh8nQ?4#TFT&O}GIWr5VZz9u8!MdeYe!}p@+@j&QJkXoAZ#u-O`#C@=JeZN2i(~#q
zja!mmIH)P!?{J_b@ot|9+tgb(10Vqt84zWqpp~d*8M|KY2#1TTjLEcmZ0GXD&{Ug3
zTS($hf28s4eC07b{C)El-Yp8=F+PW!Bi1p|H*7e}8{@#Q@j3MfHkzt_w|ovj->_oB
zZxw}SWUpKMi-AP7Z<m0{AvL@AxyQ+!_k4s~8j^42F+OKre|!oEu0rP7-}AVhV&b!p
zqYGK4qR)xd#OpVmYV%{X3W$BiFCH>~bFPXW&AarJrc#54_cuMhfrmh7H+gV7AaSwi
zpW_KvdG4`)z((7Y=(2p-B9TM%Dx3G-O`!%K@7erak8>=28nO1GF5+`O=2s=n9WjEx
z%`%!VD|@{A@VKUgNw`n2%>SOp4w@orFfy<ZJ5j-3e%63HWSGd-zl`R#mt^m`JQG!W
zJmzvzKKm2WDF2qnI%Drm|LIy;^mnz?ZR=Ln!%vA2m-!VFiX5`{fORT$?z8`TMLYkd
z$6FsO(SD;3ySatd<NHRdzMO97fHpq|>)XgwtT-rIiGNed`u|eBgR%%8G+r7oZpwLg
z6u(wr^vNN3A^o^ji1|}S<o)+uk^fFDpn-X(s6dAC#UDvlDlqb0p{S&qUf|n+8@}^&
zBk}Lc_5WjS;LC>yl-DTNWR<$2?IUQ!yqfM<dBNbWgQUR+^w8gy=l@@MWP(YiKfDh6
z|MUKMLW*#nR=rP9JKC4!@D1En4JuGAf7j#uG$q$|Ai>?K^j$jKq5;_~x~H<_@1HpO
zkS<y_#fSHbTT51;{Qs`UVEHS5v?NYw$YY+jf}g*|o1z(IcBt#hT&qN37Jv77z&B>&
z?BQvfwV2Ar#j?ihH=@?>X$W9FlxXF?O8{Y&tBBDpmH(c{Mx4Vm+!BJ!Oqg+==si3r
zd<r_WZK*XECdqq9H=6twZhu3{zvnT!Fj`Q0d6c+0=cz8KF`S(;x0N8t2irX~l*o%&
zWS@1M)k|uX^On6G=|d39OyY0jgy3k2=jGAy-#3*hADN}=0kWHq+5|i#f~$>3Gc)<t
znK)UH`3gSmZJT})$yg0(4e*GO1P_+j{Q)A$)9{6F_-odQ8Xu$f%lg~4tmbfMZkG(%
zJ#H-J%}$B>aNw6<y#byVb%SjyQa1BAEex^`Zofkf+09{69M+SmWmatm<``RMhQ!tT
z=8xGuwfYg;ZLmSX9Ogk)pD+KC4Km)<5+{%C`^w7Oo5sDP4KpQ{$iRvd_je!?>ALBV
z4gxR7a_h$@DJ6F=Pi89VHk5Sg_FKOF&7C*i%xr&%SUYH{As;CkaVS~(KoT8mbvPe6
z)GrVisQAJH@bS0zED5?<DoA}ep_6$-{4Mo~kT}qqxeZ!}ef~)%QHQ)RP9J?YpM1s}
zi>=0#DGk&gH2*bQVACwVPRw{H>dJaUxG_hT%=`?_-ASxwWB4F`G`KAO<R5Bl{_s~~
zWD2_Ze$qq7a|nQ;5!`<Ic`qI!0t*LCS?xB6;egi0krh7VkScPJDKadzxLS75-exLH
zX?FcVBo~kL+0y%M=X6DjjCt&K+ro&odRlkelZ#A&JYX?oY^Q-9%k}m^Y`lomVDeh@
z*Nx#j@C-V;G3qO~fg83^xy4!Z5>5fQ21LBSZg@B5mF{X#E9$pscN8R8uF$w^+46G0
zEBl+^BZ%+0E;AWO+;AyV=XacN`5||RS_0?d9}B&ES1XI7#Bic4<W#=z*-!zIL#}iM
zX~_O<&%;-N5#5N(?_&AoHQU!xRQ(9R>jSx~?jzXTq1#%_@#Pdl?^p!xei~+hV%Ep)
z*^Y@}qvgvL#XnU^<n1`B2%n+E+oK>}CR_e|;;q4DyrKN<SmYdKzu-TU9DzhbNZ)ic
zC`ITVJC=LXQV|2)@%O5%Ubzq+A*j7+-7Hc=A7Y2}PR9VV@gg%!=ZCm0NhB+q10kPl
znH%gkT19JiZ)iNRsfgjMZ`~g7P8Or-=0W&bA7w+J*ywgt>~wIR^ar=<eU<eb?kcn|
zqg7thj0CaP42oKb$Cehj@f$@=-wO{uu=vO$LaC`~%4@q@?l0ka-?2iO<**V6gfF+_
zWP4%T#4xeE<py(86~0vx)NwVro-yvDONI5}=KDQ|$EXrF5LPk6-*9@<zzGfx!3F9{
z6r+2o?UB~wLE{J3Gd?Li#3vMug!Y!N^n}Ns!2Rv2T-}0-U4bt|>W}A}m0*!Yy{RE~
z8PXN+mURq#E#6Y4Et5WHmYeQ)WK*=oQUYNg>6K@|<H`TLgw6S!f>FR(e1CJXRAu_U
z$Ap`I+{9eB=KDk1$wwHYY5EgJE+B9s=-flSKR{|q=65jIHLkyh`6_k@%SbGnRlW8j
zjQ8R!_lguX4;8y00L2Q%db1L6&h6ZIWr;9V0f-XuNiBpPtXMXm3*&XbzoHpi2lvP+
z{JA^i3VC_l>@xv06RVB6NgBQ!{B=!f*H#s&f9lN{IMY66cuLeu@g%eMxHA|!;g)vP
zSJ)Msv>Dx&$$OsgdqD3Hk~<ZCV@0vc_q)d`zv%?-8moG7Q%v1+O<;j}`Cb8FZBf;I
z1oFT{<*``dPjN>mmAJ_k63(i7J^?F>H-k{oX{8hJ6+c**bFa&+di*`T$GOq|O&a%O
zDazjR?Uh^@y#Z5yb|q8km%BB>e131vz#{(sme&FvJy=Z(Vtz0de$wv>QYa?A?jdhO
zJuv&rvWhZ-i~x#erMJakw~=ytVNABKa4=`+6_mllFQ9bI&AY8bv%72FcHz1B;Wo_n
zfsyh!ME8*)5}?wX^<Fv7C2TT>!2uy{tAZ3VVbQJOp2~vF&N;ug&#R6Hmgy1h8Iy!=
zajdAYdzgKS=;1Tkd+T(ZD#F|~><xu>v*v3PPIUpZTb3h(jN3>MrIah@7!+-Vy>Ihl
z{Q)r!dcciupBQ&NX6j;mxRm+7n;J@Xvjix5>SXKkR_m66C;T%#54jz;F@_Cp_N30^
z4QC%(Va~AwEJ01ot{S(4l?8w9ws8SY*D)=YO=Y<|(iw6Exz^`QM3!JlJ?+>2lbfgj
zG@GcU*yPQoeDfCOK@Oyjj@R3_BDp_3q`CG%3NV^YM+Obhj$<b|hXk54f}+-+=^B~Q
zmsB$0xz~NA+RUQ`!SAkq^Qn>v?Kda;(X%}uFe<9=Ik?E9m-`h#>gel0%$iRaDF4e|
z+54I)TA1n`Tj(IcV#e2fVNs#rUYdb7c#{u;t(!hf<HP7s)%HV{A5dpC#~r<;<~A0_
zy%H3~Mo{7piFA0Uv*~+}kL^k(!cH1^N-8pzE~%kd(@ZCZY=nRf$#jUXovwkivr#fu
zi0irD;^GE5RUc?$<Wr`957x>~SEK6Dd^dx)xOh6;Y)3-YEgjpdZqFG_AdZuGc43y(
zIH=+5RAlA9#W@V)44)}SurRQP`0kxAL3^eToczS!KkUNOxMEHu^`pG@&8soS_B0*)
z*|!VB{bqSBnhgexVMW|HlhmlKiTpBN9g4T~n^COhqZk6+mKn|d+?;O6${wh2I)b%}
zJ|=|djUV-4ChF_psifMQK|ZH`qSVG8s70k$*R|Vk26+$hInt>7z3!+3_Q5_ct2^y6
zo>_8}2RrEa_)0djgA6KtEOJ%G{*Vqq)zjM-wqP`ny!wXmX&LE=AXGC+8H8B~cRpil
zndR??TDQ-y3A9|gn|eJI>QONi0)3mtytW4tqp)KIr1x4MSTXVA7esB?xnT=}k1tW;
zK-$RQK`!>(ed#UkJ{j8JX(Ol<UCwHR_eb+`x-W?hw)@RBFIl`<gB)Bs@lMtpal3jr
zP_LxRLJHCdvQ)8SlA|ocjl-xP6f-+IM<Jo_+8#<ESNeFRHf6n01AR5p2z<jbuLMom
zIHsxPPsl6ECd&1E*8FN*H)UV%xa`{xVRd=z(KckLz&w6U`E;k@c&E|mqEHJ?x%R22
zvfzDDGRY!U+DUqP@V15mCbrX0;l+s+G<x`1$uE*mDXXp!R{T?WEkyLtcIX901J8ZR
z(EKDD-Ku?*W6{#G@dQPy0*`Muwpa#q-*JV%oM@TiRvpS_w1iB&(t(Y?ON(tKWV3{p
z^J8so>0^9l<#2B7tJ%Z?ucZd|_DHJ}weinU*}-Qr_ER2~!K(dr!qDi2ix4RtBHvBj
zC6!ilUQx(}jNk2Kn~cL+irbP?1R-4Soh08kuEz0JFBL$-#<S2N0<a@d=tzc7*;~EQ
zTBp%1ep=$_FP8w_B{m5t76>e!=no>y#%YmvLIRKVrhFbbGMIZ+#!$*yJy`sE8!OcD
zt)W)(nt+D+X$l{2NOZl`WCf+paDNE=WN2N~AHM)GyR^8q;=2F9B#}ZUh=Ty#s2$KB
z2o!#y?bT?pLI2edPBm7tgdHkSGp-hD^C1s3a$BrazK$7hC>B3%dA<xWYP}hu+onW@
z45O3FmN3;Yl*yxCV~Ebg--1O!eF|#DFsggv$##^MYCL?<gHZfB<L#$ra#l=5bhBKs
zjMeQ$e+je5A;O&{Tl?t(wz6s{@?-KFJZv89D)FREk0ck;vjUw1_&&1dWcqkZl3pJ)
z;m_GOHXS0TjrFBpsFcG)`8$`s#nVs3>T$pfd|rF>9?Tm?21&%^=itw3Q-ASzv%j#}
zL6yvAAhG5_bgRavs^`(p{mtVqeXr7*c_alfvWe3zR|5Em1h3H;rb-)<FWOaP)YQzo
zT?vN!81EZRSTxoaU_lJSPytgz0ViBE1v2Uu+WbBs{l9l-3xOpP!}7NEM6bcQkN!2c
zF--HZ!E%xrobQcteD8?MzQn;FfLxY}dGNH1M&`F^V+z!c<l^(XJYu$9w<Unw&{x<j
zwB)q(8loH$-QXdn=JFncm`+OadLlCRWLNfyG=qk02<6S_XBeQ$9yV53w`A(S^>8DS
zFwK&yU&pvYdIdL<Ekh(cdmzFPt-}OKqwfVwO10-&BmIn-<v2?Oj(x1X<b%fUZDd5U
zz?uxF+ebiHJfx)<24V?fg)W*yLg|P;x_3IqEljdB!tz-sV`BXP!O$K*!v+GdS<j1I
z;t1tf`=w15#;PBN9C^GfV)Eig14VXzrB0V2|7hvg$&4SzG8Pfb=&BXA_ujsdSLb#c
zOUE-c%)&MFw+W|azJU)7>y8|hxfdU^LB00s=;+*RL}Fb3HBjZUa>5iyxGpDBP8+6Q
zvFA+^+)_UK*rju*>VNi&VF)$yi&&^IgqxEyVjH44s<fv11_?^<ui{Cg<3RA*=}|I5
z)4|Z#EHXpdJbU?=xReqH_8E6{IU*)VAoRxIP+EsVxVehE3@U_LQlq_wxQ(3!3Tr^C
zN^wa6(&oKJ%YCgKAMDnju1H_aq;}G8Xk3a}SV|uqh~Z%bi6>BW@ml4ZwKDuUVNH#H
zVfj-RF=9*8sTp_B(*x>%wQTndo$S08r=EZ4Sk!xdInotgZQVKzSmDwcf}7<%X!Im}
zV(BWOO!P=~=*f|ra#wBDENc>~ayWsCTK;EiG}<1m;X=e2isap^$>msTsQ}j_ksGe)
znu8%{dxQF7hvj4~8vj@wcFpl|WDLEgr=54IDAb6m4CTUx4(M;l9QWW(Ff`4c*6=y<
z%?y)ZR~E}PLtKoxVsmRyBDDXMDE5Om7?OO=1)cmP^#CJ6fi$Ul#Sk!%)5E6x=O8^K
zhQzckBBqmFybtZKmD_#ABzof;Z1zC8zuRW_&M{Ymc#t8T%dM$Z)m7^Grq}_jCvlpf
z^nhqi%l}%)k}s5sXX`J9V%`(K-5}9eY#)1+C^&Y58#+PV^3o03pF>mNaM<X{_daXV
z1n%dh6{<I(s9dnOsq~Z38$N@8Hxf&yj2r(gqt!i8k{<?Sg(OOcQ7EYRx9QPdf%kbv
zjH@q6+JbQ>c>9`1u0P3A$4bWM6T3|uFys;sgM2;JZ}YtCIzdT75jK~h1b&FdUwXfi
zc4?}J1+ZbmA$?+6(A*OU3-pj&$hSu1IReL2i)0-Wqj?2;0eC6kmHNrXWAZW3GIAl0
zbSh=!3b4ys;)-m-M`Z}|NjzmAiVVU#O<Q#JI&`&x%6>agsFpr|pH*hBrbW%g!_&zF
zONyt`TcARUaB9gTjm%G?@7MG+jGB$#H%q_{8%~Sk*#fmfkrd|fcSxo4C~wtkZMSMv
zz%kQ*qz-B|a(h@#k~eWO;cq3JRVE2mBJbZbl$_homx+)IL!=v-Pl|c*_7`Q}PL1AR
z4(lyGczvUCd5sWZ_7Y;iW6j5>2#J0@b2=~m>n)z)UxeuGTdqHUw?~B^(&!$?;At6i
zX!oE8g3Bn<C%|HkYVQksEPPV8wV=9oxN68Kf^2j-@E_(QfwG9|j{}LZtdEmxi%KN-
z$mMNOrzdy;k(ji&Mw+5(IbZm|D;PcH_8T5iVJ{9z>3*2?#@5a}&vU6!*t#oN+xb(`
z`4k-&v$Do}+gqr7z<woE{n+zhqh57F_T(>k*RkY=t4k{4al2LQswR#RYS6I_(htvU
zf`Xja$MEbqzDe3EgMm0dhq6X4nmajI9udmmkjw%Orv-%$0Gm^Ow94T<CHOV>o(6L}
z5yW*viVfV#ZJl9|H|BV`4<Pe}*u%qUTEmX)FE6sa&Y0ktt2&$c#xEbyoya$aWE>QH
zgk1Z2$Qx>1(I<kASQFvjcBVZf1N0oT3BXAaE6XqYS*Ofg4uY71BO>DS`7kl-dkGHg
zn=?7}Dw`1ozE}30juODoH%i*(@AvB0I-xe$>S#cybD4}*h~8pK3T;IzE9;ExH%rmn
zlDd9+(JSnMRZK5PXHBNqi><fhMU_+92-VYGRGUbN>P4FXycs>0weSK)tcIOCGN0`e
zdm#!N>==!%t;llufYdh``P_JUQzgiBm>l&?2meZq?P*cW(56P;iji?af#0;HG`WbA
zp(+kSS1HmIGNi9{t`frD4pfEL6(mZiM^8U#@rDfDXB0vx6N%o%5sgRbpHG~jFxV1E
zgcKsZ(ps~9I%90YCRSMNEUMt?&o8)o>(^FTL=?_yVJ9<i4va6vejyTRPa=3x-)hzM
z=zF_T5e%KzI&{WSke<I{*UU!OtGfBrJ_D_cX27lza<wb}p^>bj-4Zai>BS3z-LD*X
z^<Zb74t1?}YqJu9Eg35YZDZ&4h(W!!NoS7_1xZWma*H|mxe=uDK_?Fl%Fy&fN)EfU
zPbdJ1&w*`dpPVS3YxfOG^N2U9S(mbYr<=xoH(%dPLw~TBN$Z3G?lPYK9x-f2Hi5&1
zvZ=2*GX8WDhJjnxOMH6wD~XeWBKJ|3Wi5!9<$ZsP4AlqwrfV3W0>!YK4z=B{#Pe#X
zZq)}c#MZa*GOH_0V4tBNo2m1$>Y7ujEr?Wy5wX^5JjaK0U3f#WyPGle+?Hj^oNe3q
zVK-Dej?pNa&B{Uq8Dxr-NMdTd%FJ;LD5{w=yzANP=w!Z#PJkMaC_Rx#10qD+v1Ejt
zJ0m(+@EeJe>U&?fY=DlsU>_&kMG(J;z<R=ZIk_BhxU|{mP#bAG3}FS;EuXKR9ITiC
zACBlnY+bm-iL9`(3I#<z28cbNQTjc75|SmujzmE?K3~KRFNtB3l_a-X-KQvn>Y*&b
z+`K!Vp4TqqCq)ka`%Zou8yS7@U)<^+v&Z4!cuh9E0@GIf{n84O^09U76pPo@kK4v$
zR<r7?Ba69ui;TurewPUG^w>DI*tvH0#cz`;vPbvQ4Ll(!@SEFqGfrDq4?>f7Q5S^%
z)w{QkG><xQ|DulOiU_0mMgZ3WHrv<V3*t?Q--u1q`TonvlLp)8WwNdLPCn(sAlkp!
zSs(XARj^N#ZtOvei9C4t?I4FomiXtd?NArz9}nx)QwliM6U;6{klZ4HPMRUrAN2B{
z3wV(E7K9}vOls%wI2ULS75!cmw;uzXRyyEB9^59KM7kZaB(TVQ<0mnyFP`}>MwLb9
zx!FT$v7B%*=PfxUFnM?=$cKGzoJP8s@r(M^Wb2kPc7cUOg*&!TRn|`WQ<S!EOpsGx
z&<~^*0nD!6HoeClrPt#g$?}1{Pfq7lOKT(vy4TOp%^D5Fok11b9XfhJ;n?|YRu5IM
z*<}&;|KaW}!=hT-HeeJ36WoG`!ce1#C<sb3fJmcsNs6FIOUDpmp`?rgN{XO#Nw<QO
zD4kLQgLHR)*Nxl#?B{)ceaG?r`u^;LJ+s!m?zrMS&+A&F@^#gFcV+k$c`rHGaov_y
zQ#I1Kf7!zB@^y6uD;u-h7F<di>bJR!c?=Y-jk)DaK(&B(yt()lukfhDHdx!-GqN(!
z5|fcJle%s1WMz6&>n^XOIgf^^yu8g-_4}p<#@t-SR~+C{buK{gl9q~ccX({B+%;7+
zH-#gCmq6e{IeB<F*_PMJ(&R2DkG%42`Ad$nC|+>!%4=%eu)QSC&7+8{0G%QHoGJYG
z&o7$p{Jbgr|KC5>dRZd7nlqY&gn>jx{Hm%`_(Tu>b)EfI)oeX2C-$(-*Ei={`C@6W
z?JrXgKKd#?tCCTbsQ8XTn-Jae<GZXt0<A2I_{M8H&9lrIVU$5<yzEb2yZf!k-Q(N0
zV%xC%>HO(8_^Em~C*jm_Tiq^PU;gy6+w^9ae*J2sZ&CXEitw39o#-zdzf3+=-b`lD
z4Y0iV_We4~X!}BW??yX0{Lm~3V?AZ|=NezTi`~Uq5gLAK<#!%wGUn_v4}Z@=K0R0E
zcm!RvJF-h!Z$2vJi}mZ|U8jvRjA`IQ(GFXhn&#Y66I{3EmhJ)i!|kEl=8MD2JHzgl
zjSk!x3EtcG$nTET#h%=nzP@W{Br>wSOmA@2$xmzdnGDam@stFhPj3aOU_G3jLKgW9
z_g0P-nI_BMjqO^~+YMhmppp;#CQ;z6cYw_+VY~88+we?PXvyXc?LIklXL{MO8o6bQ
zkC;23(}SmaVq+uNlI#1^DyY(S!MBf(OJOsq^GAZRY@cACs9`gCcP7rqNyvh|8RtAP
zVm3l8<4=AuoGE`kF{7;{9F6(YN|JD5O3wmUx!c)(i+C)e+VNP@eQ)B^T0Y___+E77
z(qGFG!XnSAESx)M>tSM4d34Ho5_2J5jyG3rc4l2lBXcU<I(U)d&|~y)cNvl7x+tLm
zC-c$X8+(Pb?)wmnY%|al8Cs6j)b2woTRXG-Vjx-{%a5VY9U2l7xx$1dOCqMCDP=RP
zfN2cf)TX1C+_KHYr$kKHVQk#RxzP8IKcxE+O%km5B<^pqxl%j)`wJi9)@kDtWIvD7
zjLHu)a&#B}nDmmwlEPi0_YQ_h%WLv~yR#uL=T@GfyS2_(DE8+oA8E{*1fh1`r+uPt
zjIt>;r#3(u{Vef=2Fkg>iK&KB7*G~&&al|>amv5;=eAMlsceUjUA$4-4hqf6eKRZ9
zm<c;;yz;~jTUaP&zg3<r=rQ+9%IoGZ<DYNLv4w{U=gBj-=4RN_g#THzw4{v^{;3cC
zwLRv~K1fS`EIf3dYS^@G*p{khFsI0Tv-mjtW-<whqU%-qnro%fHr^_Z%lyKDfvIS-
zm99?<mDCRzbfhxfB&=D5n`~bG{nWQk4+RL+Q+g@-P2_^OCAl?&5Gx0*vD27}EbO9|
zV7_LctNSyrGNzp=KK6O*OGLxv+1PK*`}9<F*A1@IcAZJ4{l)WPo+*znFnn2SmE-V<
z37?%kqF{f>PVjOMB=QBU)Rq^9mv#26R;-dg(#ykV*G|q=*;zB+B!H<JZD#&{z$d}0
zR5im@7HQcp=|r>(9ADP*z7f$xhrC2uL*IPnxseQ`EhC4A)ZD}N6WaPu`0vlWZLfbx
z2ptQlzi@`Tb<H^EXLf}Ed|FE*qLuk$&6PgIdaIA3Yo2l#PX>q9L`4}Go^GS*dFwlU
z$tG`|-Ri#Le3rSgo}>u9+}OYi{9dl<>@Ylck5zifK{W8<{0f`hiK3j2HDiYx%cr}y
zly0rW7^c+oZZu}dU+#>I<J<A(SE&yIh<au$)O;Q*8$O2lhx#_C$4})B-3jT6pl>em
zCc^&i-(0N`w>ip`KO%t**;=N6(|XVLmf5*GIOGtnp3ft;pitI+i%p-}J|ng4sNa$V
zR<3UO?$JsK>@WktM^D^l)Po#sNU>ly4?*`y=PKT{=ZO_MhbMYlhaLn;!sYm^M;6Cw
z_@5EqQ3vX*{h67sk)u+uh++?&@Z|TPG~Ec^iCSr}3{2KA%klrY*oXKys9a}X3NJno
zS3I}4N<Dr)MLIa#ii7I9k96HtEOqfSV$(JTT>GuvUL7pHfZ7@Cg*|tEAz0ywZgSEU
z=9@P3L!JfCh_vE1jXu)so70T2QdtdAiH~vkz#a>h1Wk>SB@LMEu<ZVFCW0+RjRXf%
z{z9o2Ty{=(7gbH<l!QZWMBK7MoyU-whm=iv&k67UdGvMc`fZMnyvqv6KeMHSAC9Mw
ziv|$!PsvqeO%oL~48$%HLXtJ7=Ibv`wy=g=KEXn8!}TrW-S3Ac@YQD+RoJBURb>s|
zU7z^dGA@BT(;6x)Gf@wJZO>u4c`&j(l@v#)?-SJ2g0VK~3@V-zMJcQMP|$d#^GW<;
z5}O*{MPhuQSETbUc7LrwySR<Ns6R7Pr^oJ9JY4jEaOjz|LvDL}b8&e|ug^pP%yKZ@
zjEP^0q3T%Rgox(`4z3cd*(;7M6m;a<=C7PuI*KoV0K~G+M)2|eCMq%!DqVN1+FBgD
zuE5}d(utx?8*^umoA11S!jGQb{sHshdg-ZB>kkm6C+CI*1Ew=EWw7tN`Td_6Z66>`
zqo5;O=Yr+vDXbZ~zq-7(=3<pu%A6mM7c6wC6V?2mDQBLlfiRv=dtp1jd}_*ZV$?0L
zxW{K=T-q|v{KZpnW}C2iD}5?yFoyp#F?E=jMbunhRYy<nU4>~Mop6#xdn~UGC@)J^
z_W3;!wNv(U22N=G_v&x@8EJS)ZWG))GHyU{x8^U3!-x5tj(UHrCPKvd%cMcOr_(Wx
z|Jk&gK1PmSnBf3LN9v+EJ8}!_^2{qt`TbnW_=fpyPX@&kf#J+A2IKhxi{Pl=$9@RD
z=T<trKfw5cJT}Cx<W-9*9iLM}T$KGk+sf40!`K2#=g+atZqMe!hmoEkoMt~A8&S2K
z-!0t0J^+45M&vs$4~FMF-$@Pjl;OJBclFNz>M+3GLZRY_=Ddp>c*^cG{I2;|U`zV@
zS-6@awiIvS!83QxWhaW47@Q&W&{>9yoYS4O_)Z@<WtpPdbS*^gG93K+fR3M_4s$1U
z?aO&vQgoF6+@f1ywG}@JxurH5!uF)n{o%eY+Gl|}EfPh$hk_OVKF&8N{ywl;!4Z1k
z`jv%+9EH@>7j8_<#a}Xm9kA3?Z_n^Yg-V|#JpVm%?>ru|l9v6}ihZ^hw+Ek#%aaLF
z|D8zi)Lp4m4tu=D`OhT!m!%!39<L6zHy?7yFPwbIaa3(d3QN7{PHJGqwX^BZU|_Jj
zpQqjZ;ODXImay*g^kS1!ISM5OBSEFGO=dDp4IBg*u=66*pQ&;aaQVC+3s=5-d}ep-
z|CMy@)h12N)Yb#VrX;)LHR4=>6M}#IWtE$t8(~~@cU!%RXDU^_$86H5$|3b=*U}xu
zwabK_;z-pwHhZ{dZq=;Ddq`I1#>K`p_j+<ny=J&H`=~2xLIO$=3L@j8TNrSUx5SMT
zHB;;#gSO!(RCB$4IJ-tk)pK85^n2?^6zvJS{^!{7bCGTde1Wvj{&@GiHnvcpMPS>x
za>|lCNW>k-Z!UNeTx<ERnU&33DVwOPq}h;<&S*tWSR5wuF%dRdUX<>KC!XUkmH3!c
z9y70RRQs~)8cLuxr}cHyYwtoJVCib>C5i?ZS=ISmeE#3zWL^$i*mW&@TXCGwi}~8F
z;hA%+=19oi-d>~sagSB7u1Ur^L7^YI(!=D}H2Sqp;cr?<d@L-k;hFk-P5(6^2xmUl
zL#2t?ER2(*lhF@xVEneFyqy}kc}#@j<NqCl-eYQ}%6PUhw>7-9sE3ynqbX{pmXg=;
z{}{kh)StbT1si-~(OZ!xbi_mhAFE&#%VsisFp5K?f64+yr3B5i>9LZgRS`ijh2UpK
z9tZypTB$9}&fm9Eo|N3*TE`R~GEq31y~Jz9oPT9yO}6)cLL6M(+1lH%5j|>3o)O15
zY2`^#L$I1Ya05$y@x|aX>3>a#o3L&bK05bgzK+qsv2PFnBPC4}&mLK9Vdx`icDjn^
zF(&oj)lm{@_k6Vf&^PsPX}yoP^XrXmse2&>G`&tsuTRS=-H$-0=*+oRa0d-=ak{R&
z!s!f_;R{_9=K{mGZLtJ7ed~evE9wTH)xhpjhGeaoI`yOUO+3h-8G(2HR7wn-7#nL?
zP1BqlQ<qwu#!s-vT9CbhWXoYLi49?g{a~M3et=w=3<Ep<BxS=O_wII^SZ<9+ynRz0
z6?;@|r47{wp1ZSEjF5Yd{`U>;{p{*95I6S+UdK`|<3$lP-9ygwMvb_WbK$M^KTBXB
z+>~Jd|MbFhN)S#wW}o}oA=}QJ{8@a<j|ee0tql_JOs$SdoV+tm+a#HEKlzE*lb=36
zY8(Elo$3k!dOS0KZ9{e)uh`VS2R3Q@m6HM@6Zx)l@A16+IbGnKwUa2>HO_w){CsK$
z^WKts&YVBb5|HQS2_QeQ|Krs$2#``;REw@Nw1J1g;YfOCYxrxXn8rdD%Kdk4w<(0U
ze(a9$Zw~Ol(bb_p6);+%YasBZmiwIyXyT0y5;%IH-=H2YIZ=Zk<GL86CGjI6M^FsY
zv9x7k?#a+qs`q+#Y-ch*>7sgfn*z6C*B=4UOWT#wS=t&i*^TSt81-uP82py54}{?U
zD$PHaOWKruH4q34oSLhsv~a$8BxFb@ytc;yK>Xau>WB9w{h1Vp+lDLy1ph3>1d{5n
zRa{`t<gSZ#xZra8zlRbO4ghAhfuAOFujgu!tNqOut|f?nES-)B&(-B)|NW6`oGMd(
zeEQsC@k<XG5!xIt-QVQlr{Mb&5KvZ^duvv655-CBu$c$buS~J)>%BGlnBJjA8%K7#
zbHBO6C&Blp;A&@g1ta}#L7F;b)g&Y{@(EJtalYICT!s19Roj1dbK|eSpHzMI_hTG=
zvABXeSK;osW$~rf;+Oq}(!a?6LSvRa0cOz<>~L<mk1w+!$Z@ZkzC~5&Xy$gWyS?rB
zMRW<-8A*Zzrf)bz`tII7#G5Cl&!Nv({A$+8fz4-QjFLZThX){QU<l`9avm+Y(e}uf
z%E{+i3c^T_kH6fe?+E+$we*9PM|0cq&U2H2>H_!wh`F2mNfQQX1$E#bwjI7L3O?9I
z>UYQSjO(TD$<0JG4udMyGou=j<r{bRPH7cby)4~<wImc22mOqm<G%Li{Uv-d73m3o
z)B*2W>0p~WrC+!8`ZGXls0d2lnGP;DFx(jC_{HW~DySA2%O_!Q5*ugA9U~)oO#1sI
zAL#t1z9jj-cb~-Ow=Ix>lcRA+s(&9M$&25VjD&&uw-t%*m_n_)z{`~U((u-nsE1}3
z1zto))fshdt-vX=qVav&=mq0sPb++NJyB#<(SN;*o|%M17@goPrLy+8WGPD-jm_^S
zIU<rIB(6^(P<>+R@*GdvOClQ20FO^U=W$POb&)ki#DV=>ThQ?2uKln-6tDu#S0Y!^
zZph@~{Hs!L$gse*jL&y&ho?UHgvj@;V=zzATgZmepTSoQ={xs{!&elVuvP<$?XAtw
zO9l_umL`+thH8_<o*W!&Pm4NxBQ%zD|IrQ%xdBAZhs_BpaapdbHn@d`Yh#TuUZK2J
zsVgf^6_u6enV7^fGBUga0yHx3es3wpJNnUFmaGlFsG@ahnQH%Ty1>H>=HK63mdZA5
zZQ59!Uu;$o8Er{Wk(HBcj>O@wcx<`0#w%U39j?p9ofU&HvnSx&x9ff<ImPV9T9k~8
zVtqOF(yFVaTT^wlpFe*tfL}_U%-!>rLY(VCdY04dZQN3ap@b!``-W5T>aQ^O*JS<P
z())I6J2>RzSoNizS4*U1^Y+oAVpCU@mG%CZnQ2j~wsXh^#&zNRn7uZU&yTa5XJt*G
zWD(<ICU}0zcAmcr&ni?MSlLiZQom@?o!7Xey^n#3M)Y-OsYj`4YvR!2v|5^;Zt3Qd
zHtY4r_oc9;p2H2%*T#NiC+Wjot@*abTiZu&(ZI@+ufM)@b$+;hd2Kn;W6L>hNtiT}
z37#^ywLZ<p&R!?WFr4!7PVHEPV{gW$5{Us=7lk@HiYWKBn(@A_VtlS;;UrHV`Qvo-
z7{lrpjOv3c8{GFA7`o^WP(Yq1F?jE~IwxR1_Nu+qagHdXd;jy^_m_^9!M=Bdym^x#
zA0covV4$o`O+)v+ukYb5`ePL8J9oiBR}@H{3G{6OJ8`&k_io}fucK{-9X+O9ITxc3
zuYln&BrlA&E8v$VX4jVax=+1-BE4_oU<<B#IBjXN%Qo!XCj~Upou*isih}#?-TAiM
z&T~X%I0ApT@IaRB3m>gV`^j@Q19usCqJ<r$<$HUI+tg_j4?El1U+yJm!1P#<i6(t;
zbGgs)bS$@7o2r=D!$kFzu@DmffPi)?4V~yvZnJ_O%g&E?azq3eh~SoGb?8ZO-~qYx
zf)3^xXivdSwgv4*6a#aee`FYX8Lm&4tjotp`kfEr!*JeyTmnZ`WwyC87+{&pq4MGI
zveG_TbUYW3&4Bfb1$Oz-2?pcU-l-m|d9ZCi`6Ij931|E3x@Vsp*y(Fd!|p9Tu*I)I
zY;j<Vxm`!-g>_gIPHdD$WE$6>;Mev#O1Ck~xohYAatH*1YO#wwZhK??2OOY$q)@_3
z76sGgsh&_l$5dF|SB%js0VbN6wC`cO)HKmILa$h_)4~wSDO%ZA@Jr^KU>%s^snO=R
z#fi-NM6GO70jHU_T^3<H7FtAKv-Z@*6&&fzQFK6?OI=nj6B$)@T^6~l?CkQ^*471+
zIbBzr=ZxyEKGmmy)fgEYCpk?1kl1$*W{^_XS?D;;WSp#)6#Vhy$K<*LkIzG}u(=T-
zpr-QSdIoM^+2O#$EA?=|I01z`jWj*=;fdzB04ZDd*$Qg);XPth5KtgWb^s9CQh6^+
z6)-UWl`Snxz&J@gMJO~=Ht78Sy(;j{o6%OaIQW-QlD|1mb@QkF5^|gh590S!1k`{6
zC=X22!}la-+2G6tl@Gp0=>&}K)E#G$kH7wg3sdj1y}7LY<~Z3MaQPR5-}QgG<v$oe
z2Oh5y=U=srFR>d{PRev&>G#6apQ5L?vR7xIoVButP>rie2fLH)gW%;|WM$oJ+E-FM
zX?;efUDq)}YF<)OQcLg(EtwjGehBjh*R~pxOZji8cnF-POxpSdy5UvB)wv<e^qZbS
z$24>wetBxq>6caMX4_Jps5Hb>lm$-DdELFl!SDiwMoh(BxWgh~EEdiT^BtXI7lw+A
z_3tN?U+hxQChsPsYUf1dY;rRBI@`os2VihQ-rswR@#_Y+>leq{>tpiuorkEpVs<lv
zzoEorzA}2<!E+w}$V4}ckZSlQM?~Ur=95FzV`E8aZ8;WQI+o2v&b9%!ZEFZ;+{26R
z$pv4Sy*Cvbi~ZLa4{LZ$Zfbc<gd0+^+>hH>DQvcNDtu<R=V38^InliHW1?opy8`=h
z^?Mhps;cmmVS)}5=`%-lx=P#%rEKd%xoel=|E$>emiqMkl{DtnxXYb6Rr_2Azyuw2
ziVM;;{r&tF&++t3`sMV8S(U&X;v!wX{`<yXlZ;)9!U~x<uAdo~jq65+qdeMzFKRE;
zutbgYIQF&nZErb#j}p<Z$1R6f2GFNLXcTy2Sm8~DVyevC%8~*YfA)raM9R&~%9#8(
z`3O_IDnl%!G|0=6m*$st-}-E)aQAV*t5=l8Yhy{FLe3wjist3BO`0Vm1niX|ir9l0
zC)tm;p)7_Tu^;0k$}HvIQcf<C3=xU?8SxNDks@47z*baLI8%nzi)<GSDSYZIa-J6o
z#jh=l=1A=oJNVlP_9Pj;QGV~&OJ}NU!klaIP#2uIsp-8Ox68u4Y_oRx#>Pg|&X4b>
z@`o|F#TFHp@s!+!dXFs?6B7yg#rw!*&!7K#tV*}gp_RAKb#TSGHBk-c{avrvCFqy-
zl2(+k8y^czIwW9Z1`oeyTsLX-JbcF0Em4zts=$8Tq)zUszC}m+)#GQcD?-XuOVQ%S
zt&PN>FvDZjoBZwDfbIeI=`!6X71oip?1kTAI*NWiJS4kz!Y%Rc_fX7toK>&Tzl>z}
zcLn2*+>3FUd)t0S7<<!IK1o>%Yrf(%{6<XQ=b5C;85S0^m6`rTo&1jlj?<}cE*qae
zbEd+$ej5TnyhT^elS=DI$muSWVX*M8bw_=tT^$@8Jg-&jUYvS)c;&?3n-)6I`=chr
zY%{|)M`Yig=oqPhG1!#Mv9^>XaQzVuk5!+o^}g-kuVxWAd``6m#$|*t;CA!Lm<k{2
zkgwsrXd8thork^#<y8IWC{8iaeEt=+y%9H6vTmuCpezBAxvj))-8=v*gF*=IXx)b!
zVLvb$gki5|rwtdt-a0YVe|+=UJp|!cMYi<b*>6|U+f6^6_SsygwLGGLWnmdlEu2z@
z;Jfg{EUgn0_aH0lN`MvV9p6T<aufUBq1q6<kQt;0DSY!TC&+#1w8R=AOOa0H@Q~55
zva%M8eh6!czP8_OYjrrM%6fdjhhvFPsP+|W41g@nH}fNnF_<VHb6+JefRt|s9&@3X
ze5{5{LPkbLoXd6U+ndX$AdhL~m?s2?Y;`R0VPvjfU*Hq+;{@Q<4hOLzFbL^_ik^PD
zHGH|-HbCEaPuZ^D`~8?{30vO&t3C?3(-<r}8|SUTb@_6!w}PSXyLayvM&qK^?v#K}
zunGwL7^m^Uk6$23g+z;d>YU41LfjSmG1V?ZhCQyZji&9X5t9D2Ciqvk3unp>9TLB*
zqZ6K5Fm@i2_jLe*PoCa;dG<z@MHf$0ALcw8n_O3pg-Y{>8^!*HhQ91YGh$J7qzwDf
z%q0Czy+6h**?}RQVcl9G)t8o)RYteEtvhtZysFOabJu3L(v@vC{Hzav%i?Hr)ty%m
zEYz<(J=|D0U6MravC#<OvaYVJbbHh4;?0lZ05;U$aNY5ys&XDrN-LRLl-eT-p;wx~
zW8U%BEUj2wx4^D(ZE@TpfOO@smv&4nvSOte$xci;3qV6P0I<6=AV$bV@L88-e2>~%
zU<qL2hOBz?=1oko!`-_d&Z{SDzB^Y}YT6RtKWny=gGmU!oKLol89FjpXexq2LlXf!
z0!UQLk(y0Fv7=$c*U!)1{AEN$3ZOJfn#9r3QN7}&nwKnYCu&eGUz8$cpx!=9#xN04
zy3A*l#zk>3uYlWoaIsw<0U!gsuX1y~?XXxmOfS^m;wZiF#8U59s`IMn+RQ@OG*Z8K
zx-PbAtdGTzD3Sq6)wInH@hi3>qjC-DPpP8!&~fas51HhYZ4G3W(y1KtqIVzZn1cT*
z!W<9vO!a%wv$vUvK=L|skl4|oNhj>up+Ud*ffxkUGIb@qFTV&)^aEQ$zn>@R{;@a4
zkr}wB`bFzgg-;~!`JA{Io+Ai|yw`o*q6a@+T(H=t&27?zbzAB*7I2)>$<SLaUhZX6
z!j=NgDsfsT>4v=h_@Y7`?$?IV9zn266}Pp8#(@eSi-3NOC%SLhn3&2;tUjgz>dxr!
zMD`Z)Lx*I`%VV9CB3P(L?%Qe&nFCl;^GgL`6a3*ldE;rNdbJ@OxwxlPlU=zSSEN-`
zROE&hx2CtZ(lk9?zjL?0`YJ?n5Lnz}I;-X643?vxeWy9Rxd0y(&sLt!sY*Y4`LYVc
zu8UW$17@@gS$<mg?c0U6aR{rQ$3-n$6NBJi1(luS+2ynYVZ95DU(dfhmi){p&$jkr
z?mbAkFb4bO%gsYnY4fQ@J&=jdV6pMmgO%qsQp1I}Rt9euw;4yd{aVBj2lnwl7y#Jt
zIEWB#h?XMRz58Hlw_~5%T9wEa9Q1=gu#zud!~+HwACU{6Ya372Eo>WXKgnhEETHcU
ziNcJPD@mE8%<?{4cdm!W@C2pTtcR$t5B%u`Q28+Ogjz2hCn>6xar?>FSF9>VpGuZ{
z@f9vx;GLAK-FLpeYSgwW9vXDq_eljYsGmuS415&kD|G{|hfZAhdA>%1&t)NAz+qy9
z$0!7REqNFg5a1(J6uQnp>Hsl8EHZ7G1U>zLmo{^0igs=yK>3_1vQwvd%oPE?9`x&k
z<>YGCuYTT7Pr2sGZQ9ZRxWaYgC<!HaJp(bQGXG0>l<%$2kw(Otx;k}n@yC;#59QU>
zgL5o<5@9p}iOI3nB%ejsnwlE<dX<dZ5^iALU%!5xn<bKX`*_rnQZ&h$rEv_iFl$oO
zRNDfW%P)#JCd6w)l)e$pmmyxyX;8N3%-ORxt)>j3Xv*p)Rl8<AZ++@-dl3t4Zw%sH
z4sIXGp1t5L(sS*RdUXntZwCYTJMye!z(tMlhe^mzA+SlTw|xrc@98To`Q#wgtKi_f
zJ6~;t(E$*hE-r+1i1HX#9=;LA^L+_~g*`{mh@I&MkAljhEQ;9`DVMPO{ejw!T6wI8
zSr*Mo0&x?Cyw!XrMCYBhWxj-2TQci{qh;};dRl;bXO2bKK5|SlM5rVL$so<5zzU<^
zfS6I@#708V1cZx3>|`MANkH`PAs*D6jCuX~B(gY#C}Go{f@~&cW=KpIbGwy)npQoL
zu&Iy49m2Vsfj|u5L)qLs*_Si%X66T%rHKRxky<dBmz<LDh}L#}58Y5JDw2m72+pEp
z%!J9V-*oqkq3_efH1Aa6<oP#UfkKRR=V$tI%3i;2x7G<UWdU4J02ln?#oJ21)6`B8
z5Lz@VPr|uN>$@!mHP=I?;kNj3MM6S?_3T;6KDXtFfL=P1$EXJXfTHr^+lfL5CNO1U
z%}ZU&m%+gwz+BD?2xtM6vRQY1A~6SvAZcXe9=CaiB8x(#-D=@<(Y(JeC%}cUT8p|!
zT++mZdG2Kr(Q~LZfXrY*CTINT=SSYpo;6fZ>nAtIDHQfB0l#j1!FX+9C`4ZXGY<O3
z;QetT(TK({ysbKr`HT#2kKIdOPDrme12601C$qUK?=6nC5@M<KoUT@$+?<cvR)vkE
zqM=EE9GVDtO;%R+{LH$Ei3!S&cAa-Z5cvYdqR}F^=L3B2ypc~L%J6$e;vaPnQM13|
zlpL%I;Aop34j}fquit>+soYawuLex<qE?o)zWeHX`6%HO2*Cj3T4RP?=fCsb@wL`j
z6yhM9<~EImW452})g|3`Sn+!(H*6SgxqEP>2NsV$h8?%+)miRwj7rV_bxJ}~G7-|N
zfa}Wrj9wO!J%8<Nwj{QT+j>Bp#xU!Cf7$I#_bur<+pYdKfch^uCFukm7Do8t-yk;f
zZG5nc6uZemh>3~Gc9_(va;WmBQz>+qgm2)8BlOH>etwp(=QnLR2SYi{4%{wQAR)sd
z0gcgosyjdYrFkRBA$NRP7fvW}6fY=ymdE*VB2mfkv;q_V^reZSk&9m&W2El*Dgih+
z15et2lveXrS6b<oR^`dX={|kJLZ@*Qn0Db*L9Iz4z^%!SjF{^Agk20Lk$m;|(h|07
zaiLkE_GAp?{^`B$5IY2V+?IRf*|@lx#-+D_lECP|4}?NZ)|V!^Dn|;&Q(rEWO6z6a
zQ;O~aj)OP=!RGb~ATbA>jq%mtsCEDsuY!Vx8qG*WFCpEH%m7Yqx_CL#m-E!+yVnD|
zFoF)rns|ajgur_^4G4VSW8R?D7uR)TNMa6R*TJ4GZ?@F?E>rp*n`+B_9;Jz@2?HJL
zZjBPuqZw70W&mnJp}R<SgZ4nO`US)@VPU-^r>-<0odck6yi@?@6wW0J<FR3l@C+hh
zxU)YwnL1P5)|XhhxRjA5=HgP&Wzn8|QzcnCIQFz<9vEox_SU*Y-K*S5aK3Y+9)TOc
z3{MoefeG8M4uw!VZ2%TsTN_VX{C2rMUgqUlFz+wVj!BdVlk5Q<f@F>#a=1S&|2u$G
zN(l)Gvhwn6EK#oS$c0x#QL?3T?2ZQdaJ}-Ru0!XY0?3mKux+NG9Og*vKUm>Ln5-4#
zSe>n+cg(*5AW19NQg=dHUPeYqRrS>=Udv<%9r>;ikQX#6PiEh16dSIKKxa|sK{YM}
z7GN7{0v7GEF<X`GIIR~q+0@(&`27sT%1=XZ7U^&nZ(lo1bVP%ScaD=&36w<T@wSvj
z;!A}wK;Rj;Q$IgN8m$8`N(O-jAcPnYI#n&L(B^swS4m-(1u_ukRP5}sqylwvEqivS
zy>xssD#xBL4#-?yL=eP?NcS}p2`MQQcGouM>*+*lJ?zJUj0<8!tOp)LK0IgWE4;a&
zBGV+YHA_xocm+~S-0(I)G%9N9I6!<Z%l#yxBmgr$N#&S#zGI1W5<76<03w-p>mx1j
z*ay-_DZquAf;9A44Sl}`Urge$_z|yP>W=u~ZFtWQ!T`{#BnTZ6k~Uzn;NUR<!ifRG
zYt^$(u&I$QW2_ZlzEq!#aakN24c4|)0<TmnadoCKRE?9TOVKO-F}ga(v<mj82vOc;
zc`D`VqkTyJlh?=rWjriZJ2%yr6G<SFz9*wGIG1=(0KL7v&(Cy|Q20V#Iky+wuz@*1
z=p9I0H$b<92V~;@Dx(af<#XTObi5HItb0*Ar)4j-&fB~^K6H>EYdLIKeF13w0V3t+
zSwRTba0IOd_GUqV9stdspApc`wQT+5NeYrFE{Ih{5(P=vw>0pDv4zp*y*c$hMA&Jw
zrHM{}%|YyWKX>aw#t*%0><^ecB4-=yirZ=C7BYv~4WP-HKy4>{0uGQQLwJ2ldFRd@
zlV9K7fTs~KPCs|iiMV$!Nt0a$d7%ZQW(xp`=|$4Lkdr5sNEjF(eEekb*k12LI>0!h
znv+Ttk{vI7-=S}OK_M48E$o{2BiBm*=UBR^2?Ifi5<DavaKx?8AXlWq?weHl(&R{8
zea1{sdId5JinQS>JE9m#`aKXs3jkPJ1b9-Qn%GY|xch>3u}k(T9`k$n!;j-ZmqE&4
zP8FcGd+<;S5?DF2p|8VquLYhGYIW&I6(cd}&f|=RD$9<5zw6i2)0T=LU{7+2wSm3>
z#z8nEcW~o^prAI2`M#W?eAe%(>Q~pNOCct9W*V>CsFuDK@hE|vF`Qi7p79a^%VA3^
zY8v8!%?{zL+%b0u1(3&qn0nE6K_=C%JP9_qZs=MHSbo_KR2U#<Bx0u^TJ4HAD1Z7R
z(>MTTKuD6V1J*@KF2rEy3xxt=tL;8pEQGwpF$mK^?ZU1r>9=p+raXQeEo-7fX~Y4Z
zso{5u`-<C|T~+8669VM;vxdH?iqPk=t*bmDH3u0wA-C717I4%K${~Y)bd~dKbv2;b
zYSs&c%*;$~(06GJ7XXjqH^aA{5kVlNbh-e*2Eqwj<NOa_V(G>Z2ZVaScMgTiCGMMR
zveMG$7K{fg{Q%?mP;&%Rt_9LkQK=1V*X<&if+MAP`?n<Bfng?6o~S8*dIYWnt7cDk
z1Gr>29N~DvsYt@-1j=66VQKf#_aQA{+-k|1N^}Bt4Nx#Sv@wO~=jLpHhbqX%C~%>C
z9Obc<-^>F^wFR)qBEXI@&<@lfAz@_@2?Z9OQo1>5g)kly6O$b>#zrZ6HE?u|G}|r4
zZz%1=hKrmM0y1yf{K4;Q2uB(u-|^=xkqzKE;gKFd-w+am3P&tdV$d_e(d^e(haG|R
z!~;A8$c*^3D)`+UV`J)$I$f+)Pk~zHNk4iKJ>`2+b1?hXI0gDHLlV(ya3zKZZU8yP
zIy2+ojK8i13f=xfMq{YcE7uVwZP}Lm20bamu*wv8g=tglbAU^E_oD}wQMiMV#tCxl
z*0ciM$u}=Um_q2ue-h$mJR)e+x^{to9Y3B8LahvcVE5arq(N*N@_>fg%bpyvZ@$3`
zss3i>UFSss!2D>n?4=tvV2R@(ix6y%j{13fH^DY?1EWMN6M~j<d#Y|wP|z8fA6X_Z
zLBnVP(vBo-a*>U6_JR>61fgbyrY3re!KP6xBOpaQ#Cn{a00!p<0UX4AnP|G2&GqGW
zq~ai8?+g%TPabeJb;BzEY_Pj(A0n8f9MlmAoRWYS?49ow@*)d*-_oL5#ZwhPuYoog
zszg<K9sYEJiO%!C1l-oL3=08uCc%mdhy*#>0DEu&$kFq4g7Rry@8zgz3~3uL$k5Qx
z0FcZ<tRSv$nP^`p((M9x5bPIngtbeLhMsf9Y`#nr;8V2^*J<L4YpsfApMoK#fiqFh
z$q0lA*eCjO{>U~9!H$9+0)`9b%a(3o5a{~r8x4{L!Q+%61;Yt3v1T#nLmGZEWwM`S
zM~J)n7Ro)0s~np=L<t+fqLg%WDO;QC5Iw3e_~eGk;^#zQirJqWoQHedHy7IlfENPl
z2iTk517RB?5QrNWSXpe600%L67ub!y^I<QD|1|A5-uC@iVQ*30YT(AtN92i65ZJ4?
z3;^W3c24qC;k2+!6XX~sL*Ek@wN#Vun*q~LEm<>-t3rofQB_5~@<_r!BezZ){9k_h
zvMMtYMaO!J3nw{A7%rfIxd%ZNu=y^-$B&Do{r&yhVEJq^$Z~=GfY$qAcNhM6%@f@P
zHh%ujjQtMtzrM2@a##)ZY$d_TLVe4^b9fxWsAt}*aKrYnc7728?5$*OsUtXm9ARm?
zFYPznfu-H>*chZ=1i0g37r#iY@7li-Q}%H0A=)G;2EbVXO~3!6Bt1zR=$9@~=mxOB
zpIH|1l5=3Y$Y7CoX##>_kiMXqE{ZTA&|N(}tOz)^e-#Qpu#(m^{nAfrvAPmAFx5li
zHU`vNUk{amt|-XP#SH`#e1W<E>PW1tEQCVvqMxg<-^wGc@$*%wylJ-X*zJCD4@Iz3
zoh`kst}9T?Lkg73%;){B?<5Y<7*f*H>k}&q=juouv)7iVr?ZL+Z3*?%iGkg*GRNIO
zWr1w;ARQ_?q7<W0?C>l$pYcyx$8u=r0OkXLT0J@oTyxZ4aO%Db$~j1UqJRx{UU?s)
z2fhKAQNVp8&zI8$gr7s^%dHyv{5{(_*uaVJ<Kgr*hLyfb?`4Ay(#|2vEZ$lh_m}R?
zw~ce(n3amNAiR7@MMtMQLQgekWMmW%GcOoROggyf3<V`hKvw|&s|@=wHBh%whfr=2
zu#3dt5s0h|HmKZbT|ou%gDGmr-go4b>d)IZ0e2P5ePxTt!GqZX3!$h1HF^yg0bLj9
zdSbwJk<drGoCD!H38aQNkYM?81fjwPicK<Ty>+viGEALe?fEd#RuFBgM7I03H=~+c
z-_2hS=L1)+VjM-)1aP;Asm`##z-So7?9+o?dw<nt+6>7;bb;csn1`@g+XYBi5cv5q
zhnA%yd95Nbt}|DWMRXvGsD|QjwCJZ#wo^>2U!EUN)JTg26!Q*o2j#j*HACNhhflsm
zv>YO(24K2@fq{eKHt+|!3WN+(C`O<N1Fk!nwY&|HRvon1Q&;Z21#!^~%G(7KA8S=1
zcDO-$@t>4ERTEiKmy+9?2oTL|cA#Pn(h^o?b8Qhqhhw+3*RStkaUebc4jymQwzAiW
z9Z&PvO!|!(Bk@!GH{NhbfW)H=N_SiG&B3{OsDO6?CmvmKt<N>C$IuwI#7L3voK?9O
zc{}8I^S{rE<S~_F-~}0^5y8!=rCTnLk=SrJUD!euh*CzrN}vNFoqrKjJW*^Z)NT+F
zg4*u~RE|LflBY*bA1tbbDBDu#XoXq^W@l#+(uyckJMWCeuL(rCExlm}x(Q_)6R>_l
zY;y92@2@$p0cKT&eF^2UNQ6S5K##mELC>jwFT$_jVH$90Yqpt293B@n4W|H6$~=0S
ztrXz-IZz>BiD6i#e4Tuoy~21B(NR$EJ`q4?{(3To)39=7g5PnXgVE6UgF@6)=I}xg
z$VVfgW~muC$>-r<YrsuC00~~21Bak;39|h&fTAA}Kt>`Ulv5(^Ma_fI_xGR_H~;N2
zu%&Pm=aM1L-I9rywCN2B@;Xd2u)r61*eT7pJ`$=s0Xw@2wLua&K<yIGeSB1a68>}7
z^Cam=PQ#}lko1+7LWvhE1Kz4Q-CKM}s0t`5ka!4RSbnKF$Q-TEuA!Eya}(;&8n<u1
z^9Nw?lfN!PFplQ(U9=7*kiAq(-QE0X`IWa<>pc#d;}=Ghj?f9HqC3E)TT--nFY4qq
z%+5pgq4wlpRxrEnd1yf?3L+5RfnfXt@M9Sis!4(YT|sOEOM{G>1ey?C0RD7MgrFl5
z>|1gyw2xqfG(+@U62RPA;sYVV53FoL1t$^IGp@>baN4!zsI6Fb-2%X|U|GOp-25$;
zC%fW6En_=>UKZ!F(0~McZp&_vpZqX5EyAnN(6KyjMSzEJ)=ZN<g&KdsE}Cs^te)bx
ziA5VWfwsA3HL&P@znFx$IO5-^!K68-S8{IEOUD?fMMt^;u;q!44F4*GGvTOjg#B75
zN-J4|<U7`tn>LsM>jZN^(Hc`*U9AY@jq2F3=;_jJy}!J)NlUoy{}jEbSJZ)!tpl7`
zI@SY=JO^M*6L-6g%E+c-u^$mg#3&?5`K}LfaY;};M#yk516G;{QnG(}!90`-B7i6c
zMMkEAcY)5K49cgj=cMr32s1($&@qyLg{FcanBW)`Qgi=Vpo|_i*Su31@+s^j)E0%G
z6X!{}6<`M;i-Uq^H`c-mzMHBmh(hyTb--5e1#|!eg@;ef?*07C=q(Za?gM1<PIR8I
zizLBBiI1F;yuD5_D5OEegU*lLT`s3<pgiRio%UNCLNzu7P1x=Srj)focv-AGZN*pY
zFSzAT1l_85p-B!gWGE@6cvG>RXJovpAiNse)YRm<<>CyiC<Z1sroX+Wkx=|J4lGM+
z#KZB}v12>1sbux;``FkH%yB)<Y||hp<X9pICkGHtlR#agq3@QB)HLK}kh#u7R{@MS
zn3V$5#V2N-dDU}2=G+3e74+877=p0-0Tcr;EGS1&@{faK!1|MKW_owGMFqM}ba3iI
z4aL9Sx+Pu-+E-q|_bgD$f>0A7<lGdO_J+l3dJR658(J+6T*l?W*>dj?9VkUj6^ye(
zmsBG3=%8MZNu~a1z=b;u5~W<|!+LP$iEhstFyatSNspCs`tY0-#ps8YdHqj!*K@+I
ziZSN{P1{>{Ss0Kd_(rr3M@h%5rmJfaU|*FH*Lvag<VdH112Rn<r5nm4Is{ZrN1+R(
zHv)EBat?UfTdq4_N3z@X*k&?OK7l<1Hu_pY|8hVY)9OTL=99?dQ+`Fzo@*o%Eus&w
z9uzNLOP%L>Rl&frIxwH7kwl%MnNfy}7<C<`e`$3ifIfwEk&T&aRfYhM)nHCwC%>G`
zA=)G=zxS?9(jM*`4+{!<4+jY@0?@i`cEvCNch>N_Cr;g2BNub&)`P(eut`=>ZK7P~
zo)2a~_ZN(H1Lo*o?my483Yo{+MP6TO4(tc~s-I^AVNE3TFf(5xyn6jQ9?pca!;)AX
z2%R#CgHeboLS0+eeRaqiVk2Z~J77~|Kp+UQC;`y5g}-?5bEOCHs}3??Xvj%KerDBI
zvIbhip>Ou!SSH}{-hO`Y8(Yb6vT>jlZ!VW^w}LXNntAsI!iA^|2~4cp{e*<X9586e
zVNkCR$7};ZMF~YMQB?-2E-g?1O9D37X%gnKIj)bIb9P3ESG)?jw5iLgRQD(Mi3^%<
zfw7G~JjC7rh$<0klBh?{KWf;mZ+`1Ffo1yHQzS(z*SQt?acX7V3k2{S3x>@fAv_aO
zx*-7ttX8DUKsSgfNU(eF&JL}Ad=CQ9-V$CCl5Id6pZ?MaEP|>m=<o>;QP!a2>WmDO
z-W?_w0ftp^gH())=B-H@99IY&K%pQa0QSMnd?GE_n5zYcfDW=DJA-uOQox8Il)y2a
z0<FX{e+affA^{eF%$Tlg>PNO5jH3b61IbX}RD4sV8x7aU`EvwqfB6DNSBsH6g6JBO
zo{8(y7|43Qoc{MOegoiQKlAfyRZt1ej|jU9Mgzt%irNEEWdv#9lRwl53-k3Nf>Zl9
zL8==E_7;eB1E}lm@2?Ii2Du(|RLLOH3FX=myD6Ixc3stIvAwOJncDvP))>xjs|t-v
z=zvh+1I`o#ak0gz9^i_bkmVfKZ&Fg#fGh}-JxHK$2QvWoD}g~4fH$N5EYxG+AHM;!
zVwOR?$h0jv0j$LA+iOmjxf&LPxgnd}190O%jCw15IScxqo<?^<SqjxQLiFA92gxZR
z%b;=rLXRLD0p>}=$^cfj-k1P6S_9-&(EkfU(mDD<E<&Xt5yAqB>E=j_f-E0Q>=+Mo
z<Q@g3>t5O81Bv>jB|F6*C17(|04>CrS0{7()RmP90(K*B53%QoYUo%$0TE&N+0+K0
z!<gB@Dn#CplK`%U`pP9KMdC8FP)I%6cLYfXwD>+f_tiUq)dVegfrg;!6@ZBbDS9_-
z&2nIOrm+It|2?U1_6k8e>s~Y<2SJN@MEbz;WEB)bRA=swLjq5LkZ1ZME1`LBIfDF%
z{6kTva4-YXIf_)U)pkNWJEaLbkh26ag0QLYVqy+W>=KTGh+SRX0OE0+WluqZ@_SkT
zt^;)ZHsV3&)sQF<k<$kZ7&M6(@Ie9GG%B@r{6h6@0JhwS<u@saY{o)aB`)SD)&%Oc
zz}gV5#ZEKlgWL;BUsSWXl9H1A^6GCn9sWjSMxig{2FMX(4bhMO>^g-J(m|2c?Jc{~
zeZ}I3Dv<Q|8l{6KSdf)blPMsXE*;@^Kon-}?2r|$dW&{<9X)kL8v645J*E)n>=c1`
z3A6y}qkOnXD4T&4o9CvVnra!5J1{s%hhI2j0zC*^mFKv*vp?DDf~;oRkscizjvE9n
zMkmlR#MsACvhr?F-Cz|?CJDA0G2hsMNtrq;U<9x{*j!r|SAZ)npjX)eVv8!_2-{j~
zFAe^Yzd-T;b=W_6Ygc}R_tlR`B6u+?lp&yi1jq@HEz%e1ypGE4WnKjV+QykN%{bDz
za<pLv4l5q$vwRn^rw$S8(OJOAPP8?{`aNrqa$1n41$8>;d#dBy2I+N@Cy`A(`5Y^Y
z=KNF&9S}L7R`O6zuq}{X%CjD%1mdvJNgRc_1I#~Lvo7tv&?ps=QwRlX)W@=9I|DJy
zWTYW_uP_U|!2nS0!CPokAg6Mcp99?pDQ#7ZeW^^&0MX<FFAV7@t@`oyHXy0F(7}Sn
z(5`|?gU^!H-W@wUc|Z?p5}w0R&`;#cxx;&c^x&l<7XIl)ksVpzwjKvL9m@5Fh-+)^
z$am97E`z2>CD=(|sAzFjj9ah;_B1unHm44J8=LQsig_sw(vhIXG&`VP3#32gMm++r
zy@9q<WP4R%hw`CL@~f!Qv6uanLkTqeAq<BY!kHmp{L!u8O;T86BcpquPk_h17#xPS
z6aR*9K0+E^+VxQ)rJv^ezztAa!61dRhtwRT@{5MPTcA8j6MFH}I2v10W#~Eo{ks5$
z2ajZcqX~#@gKEuw|KuX1yJV<&e3`9!T2v0=<5Jh|dZ1CvRTIvE8=!BT5YSc%6uR@3
z5<(ZBZolqVesT|JHwLTO8fsp?qXPbhOzA&ML5$b?`SZqFj#8bU#t4S|<{X0=z>Lnp
z+NAtxt%Y)c7y<wiU|I$3Lj!6sz|x5euAmrzp-y{j7shT&*!1>xqA&r<4dS!mmTp;4
z2m&6L06E#eYJ;xEIkO&G$d&6X3J^y}cmX;tGI}6#LSo7?X~u3&3wICqd7~;gkeuMy
z@OqB3XDde^8WI-j1gH5n8yTkCZoz@s{IG;YVI*wyt}8?efej<VD=t0)YK^d)ehw`V
zgX;3HyGY)nKL0%_fV5Ge(7#I?xAOB50)MC?Uv)8aZiz{5yX(;pU@oY73rs~FP8Nzm
z!*+R#5O!0aJtOOJ9*zhF4PG(;gIa&$p>*J%<ZjiKa|0ZimQNA%4Z^F;TrOZQFh&Ca
z&MUC}a3(Pg+M=tM3G-7gg`knJ$`BgJ0UQD|ZogbF6oYC@z<o^{-g*uOkb$wNT)*y%
zn&+U~QWi}lO|RGp5{IL8?_{23!RXoV5rP`1A_kW=Uwj)I?(+f;WDM0Kq4B1*)WZV=
z+jD2neyD~wD2`s^sT_fJw<e(7Z$WF-fV3yC@oX7f(EySw>i%k_Az|p=2_X*9%=;b6
z2JL$I6xj6-0LsQuPbwV9!D1V0$ULxPvGMUxCvE}V6UcZuD?uTgFB<g-fUKkl+z%D6
z&_+T23~9DSHC)t+I=EFsfKkpO;Ei4_01(%bYt^?Ke_@lZhJXMR*mm7$jx0nNMNrl4
z`kzoILapnRkW>0#(WnsgRiNtcPMQa#1(J{pT!E^)Sv`GQOT4JUgz_m87yxYXPb!7j
zSZ1~W_|bLhe*)MB@H%QURLwS33t-|0$qU&xYQKZZ7wUBL*qV<z6iz-_yF6r-Rx~H;
zsjaz-WCIz^<M(g|CtNu0tyFz}w4ZctNiGN4Qj{PGWuZKhjLHrV^;|~JpjZxYx(F7g
ze^Ivp{Y}vZ(3<Qjz@mmbA-bsBM6Up3<3$LqJIo7JVi?ChgjqI0?gk<3(;<{|KnmKC
z1pGi0qiD@Al(P7dRRg05*#UI{l!N}JSVAK!!5b7VAO@jZul2dk`~CITUpu$Lk1;%;
z;D&cGfay0aolG}}M1tDN;Y;!&2*?FP!P@`1a1pBW{5_@A{m-S3VxU72`Na;~L~DBo
zh3r@m@nFKisFxRZ1G;U5W@gIC$Mc6HGokb5F%F7iV!+#4?M50Hy9_@;hvNPK=m;2x
zjPvn77XWSpAmf5AVB&Ymf`-~KUMtkP^Lu~}kjBxR|Ng!uO<x~^`OAN1Qieb>cngpg
zc=zQf=1y&JD`3k1tYZoKv&Vmhp&>6Y5gwI8bwd@h3WPWkAZDV{a!|sCwp!RNpJ&9M
z>9)i0?>6*y!)}tGg*KsrGnhSS94C;Afv5;`_fCga1PB>B4MFI#Ilg+%q6`*(z9JB-
zP66M6`JqBF0}(pq#Gx8dJjr?MKp-tGlHXtkNHT%9O-RHbW%XpiV6eQunE3gGpc4x;
ztk8dM2M3Y{s0YuyzzCC1Hz;3#Sl#+(dUGAusCr@A_p9g}f48ZTkiZ*24_+)ox9&)^
z7v|56s2B^@iR^D@U31U}@d3)*0XbC<&OqpC2Z9J97E=~z2v9Ibh0C3Bsx~#sPvZ%X
zt`)m1qImsh+p4<??2&?T2Y*;o47=Y8goJUZ82ob|k_rKAHo&PomOkp*+1UxbI_Yq#
zJMUC6PC+O}<ni~etjI&S0C52A3VQeI0YwPVNhnbN-j$ijzEXX#BV;r?w;MozGkXKj
z2spGu&xoIv0qV(x=-50*+lF55A|nMbpW(i>Y78ShM8#N;-C(7sLHARFt^&Ak=VdR^
zlX*aUvQaat;iuhTpCwRsNs<d;N9#aug)tlk-9+XzuVoe-00V)vZ$G{3Tgd8Ne`b2=
z(ydP<s8Jmj3gv%SXj5#5H%XBBp|{E40nik=xbunt=?RJ&Ppkg2Ck5bZ|CzxER2_TW
zmUYn#nD}Rkp;-mWweY;Z*ZS6Dd&>n%7Jt?Xz|=O6n`93Km`~X!=nskk9Rv(w=kZ{k
zO)Im5{~0|Gnntp3ecp}s0SZ^6;MCc;ecevLU>3g|S3srTogKgQ0ys8oS|b_=2lE{G
z^4w)@H10nmIRX1Zl>6^_;x=Z=U7+XvpOrpCczRGIYMY~f)#GV{By1))yKU_L-%}M+
zh2CmZYc&Pk012W%Y~KUG8iUM@zA_KkFTzOJjw-%P?(@$5=L|Jbm`ZN;3p17Y%S+s~
zEm_xZ2+1CwzAT=(@#c+`vt9fvsoUP~3?$=UYdw#pJKH<(oDBQRQ;O-l*8{WQAH&Q0
zC#%bLADWn$m~{qz9eJ`OQ?T&+(RqQ)%asa>iWFt#<w1If#mE@9KTDr|OmP`{>-HQy
zdi1`dqZGt~#zZx?yu!lr-d+q;dlX$}pZUhCo*ymsk(>kF{{0uGK;@Hy4i`Wlk6E})
zAx5@JF3H9C_%$btKq2<2rse>YtKg5`UcJ!@Ca&fZH@xpD?t{Emy{}M~ISop`S7~W!
zlaG}5B}o0^;^OCuPd=s)+j<muos9ABb!llba|;W`#}6oW=j7xFd7JNwuV=b%V^aor
z+b=H4{S*wJo|{{RY;j>AkO^L@*$qam;=)PB_;_PK^BW4WZ?ubzMi_~l3lo!*@3)7?
zGRcxtQiAj@yn6x_enx<8qZJH~Ddy;Xjl{?}ZCj*XI#YIjBs*{*Q0ykzuG6PaV<dQ#
zp&#%er1kgIk0`{dJuVRrFn-w$zeoI2$>>n*eeC?XkF$TBJo(J;H1GL;&HltEP+8KU
zp$u+2d2(kGJeGPMoA%~EvSj{w=sUhQZ{A4Xxbgm#^7%)w#`K&Vbyxm-HNZY7(R+p*
z``>@K3uW@A!i+E14Y0>6Af;V}V}t8yT%o&u7FwLnmC(LYPP8(-efw3f-<i7ynctlA
z7a+vl2z&bC1%)gtTq-MP2N}-Sh>6YD=pEmfbZ>z@o9cNg^bPC#Gi#7<ISJ2`FA<&(
zTq5jTpOBi!><qN*nUBvk=qzd~%>4507ChYmtFkko?j7v$d^DZ^|9ud2nT7XI75jvQ
zxfmrA`NgYWw)VD=`3Yt1$v7}>JyE7dB;I8!>3y9DyUB}o)7J=gBx_(RJd5Vox`+fZ
z`hCZnqP>O6xrWpEQSrwL*z5%zuvVYjy@aK{Y*B0wvLt2~t0@0_|Av-9OVHfvx?s+q
ze}a{!re#l$4byHmhkA8aT`q2#8ga{$HR9GMYv8<0R&|RVF-PMj)r1!A4GB4M9@U@H
ze!H?}B+Es3-u=%JHqFu4^HJ{S_`-^DQWe4ErJo)r_lRC`xpV%%E>rHoZB(VLoOORQ
zU?8<<M(kJo64jNmvUca-|G7*z(@NN1|G9?HSiC#VW%Ux%lGnKs_css!YZp{`IrKz)
z)bPUULL>1)PbXI?Lb&Q!OCo6s|IcLs;az^!<<Z_%v_VzX<#N^wuHggYZ!&77&)Sqr
zpY<-6{s1erx9xjF*Abd7-}vIV7-jR1AE)fcTCa+3lWe$5P)mf=fA2Z6Ym+oKYLafE
z(eajk1*s-=se-1LTY?~^e!Z`*Bv;^RNiHQ?6@OxKxFFw)S3Zwq@~cZyHs%y%S-Gto
z&v<x!XJI~1Yw+A7@{2$5V#j^#;iTpIs;@Zu;4T@qeFm~C_rLkMtJu^%J@9&~_2hLe
zPO|C8<mJ?bcQr;b7W;`o*EreEYp$(&7+kxAcT2xrtAY{Pwm%g-8T!2XnjA$~ItE#h
zyk*Y7ctl3c-%B&}4%`^_bG@+1ekkI@hjNbr?iGcir}8Sz$JX3VG+7O?mAJyvzc+ss
zpZhha&*VDIqUm^_)8VYu=hT+T4*V30>EkKc9)G$T?U}{s`ePX)drGkuO0GSZ&;GHJ
z>#PJ0z1k|4(_D@2bKI={K5G+1yKjB3pJ&-sa)HNhY6VKmmqb2(Us@O6a_nAWvbMbV
zt%|8m?=+7}CgwNQM^N}+6}OqI5V{_a_ngNngtkh;Vt$GHn<jJ_P|s89yMw|1GLT^6
zzhKG!KZYo9@9-bfIcbZf$G!A<&Sp7ATX|+xz2gQg?q$--c=Rh}(;vaS1m>fz-jApU
zD9MEq>B)6E{1&}R6<u+vT7OQ?(3hyoV#8@V>nB@ftt7>f@7cpbQw!U}cGsDSpNBOx
z*N5vGGr1SjR<~tEyTqA4KE)X<T~``YM!w(X($AOUE&+q@N`yH`yN>>1*!G|ExOeXT
zt5E-;=fohq@RwP(S#K%2)-)*&dP(rke~+RhK*+R8qR3`Do%StNla_va5VM5cQj2yb
z{iRd2*7q^+Wzq&cEo?<)T56!{&oax$72nnV%kG8GpZT+&%7L!T^GDSy?#7HSEF9dM
zs>L1T>`NUNXSf*9nfJzCYF0$()u~5N)O$ej?s}R|K0<0_jF*5PSA-N|2L}c&8C6rP
ztge3U?4;4t(;NAb&4%81TlqLz3sn0p=;2NE1_lNcVz+=Gdvk>GCzxTkUoTuN5#Goj
z;FKEToSRXm#nH#Dti`|j<BPK5Hg-BkBk^%I*2z5EQ`d-nZt)>iE?Yfz=DlGtEA;fT
zLF#lhIQ-I=w^tv@E`XA{&yNU_w3D+lBdC~hv#YDCuX!v^L3w_+nVH$j$_fJm1Btu4
zdwNEOC&g}0PtSdLedF(;dpS5bbc&pmrUSl9^Y|7>&gG~m{dVi-C35Yywzhbcw4=M%
z_Wx`*EIn7?YB^;|HbT#^X+C``poDb&Jmyouid&h$gj`Sbzi0o{pLnEnXk>A{f~Bsn
z{Q11c_#$WSl;Js*T9`Bt;5+`@Mp&yKSqH?(09K4#affUMNTj}=9GVpxS9EXRW&#er
zpK*`y_J-}FqBJP{Jf_$U?=Ea#xgq({poN=|8~!Z5#Vzpow$O8MxAcDLlj_q^0bn&3
za$l++E_*f8|N8Xi2V(e<<Civ*IA3SorszFD|CGbwduoH>czF$**KKvx^o9BDvZuF}
z)^1e<#|gP_jbFLY#eF=`E0}@D0OzmU;S=6%UeT^_?Vs>4B0YuED5d^Y5WGmz{t+{>
z$f>`{cWqWg^ws$Ue(^bw0e<%PdqNR-uq{Pft14W?1H;3^GqbeRRy#K|G{nf8OJo}v
zKUD(|>%y{aEnQ81etvabPB_^)nQQ;=LJA%C<3E=2)R(xRy&811qwRQ_!Ax9k`aLuD
z+XHG%;~ki^vhaA?!v_;K+=4b)^scR?xK?bFDJ8yIdqylO68aV)NR3{U^zk`VR8&Mk
zOX~}722kP;>sC69Hc5;-zLV2R1@dx@%(J1PK{><&$^t-#_5=8d<=liyYB?1Do&nuP
z)gmWo?Vbhk?Vc~c;}q><iWPWQJRJ(%PEJmuWS(%*EfDAcNd;9VDom@7kB=V;l6?Yo
z8M*02=+{#M4dw93OQNCEP-t?3H*6Zy4X&xCXi<SqC=|@0uQy>oa;ionRp)a@hG9S4
z%)-I~ayBg#=?>V~T&aIMJ2zJbrIY)!0}^(VKd1nz38aw!N(~PTcf}o$^N3JNU~W*o
z2{!Y|yC;)MUtuUX@H+8n;C0HX7lB2C)suh4WVMGMUI=}uG%ziwQ0zZL=bRV3`1V`7
z-No@;CoH~83@4nS&t@NAb-)y-tk5&c27UY(82<9*BhVK_$#!{oc=%#)r=Y_UtQ5Kp
zo1aPPR#kraatlf!;Pne5jhfI>ogl>nyzT(wo>aYJt*LeqASs$RZ}vl(uL^YH#x#8q
z0P`_W*d{x4=w)RBb3SyMq<{P<CMrsT6jjuHNg?(Y%3am<{||d#8jkhazN=JJijXNo
zrjjukicln;R7itag(yQI8AF4qWXzC~AyZZ%$vl-=DUqqnbE3@iw9lVb>wVw<fA4)9
z`_ulg_m_37W$`?};l8i?y3Xr7&r4*MA`8e*H2Ux~3Oi90pfb6mGQ}5!?X&UV!Gn`O
z8a8)zb*U$vY0kO6TTf5#!nJGAb~{}Ff(@d#oI4F6<0{`bL|c`p7NrEL-$hGHU-UFC
zqOCkSHiifxl0SN<{FD{K!@70rq5)T2ZhXn?NzGv}%t0%7N{ah`dcNfHC;r>AgfDdn
zQ@o=+2iM52BUFtxJPx&udcAEfTECh??Poaq6}PW!o$OS*rc$F>H-2;4GNIeeo$sv5
z4IVJ%cYqPt@B`5I#t;=}9yd_A@F1rxK63K|PQ&FvgOL2Wc|79k&+p$U_wUcLDVhej
zQ~d7T8bF_4vfnm>19A#vNDv~oK(M5q#D4TO%~~iF>m6990!NBhK1ctwHNU}=mz}*6
z9f!w}QBnSYXx`!jtgZc1o;gqSpS1ne%B(=?%iWTzXoHtvVPWygs3LarR%~VBIpKmp
zT&lChBLY&h9{9TO6ur&y(<vms1EYJk8hD?U8GY_5V|8(VBgeAB*wk6!KUn}3bJY<!
zp}9&+z3%g5n~Lp56W7PIUioo@b)_e=e7wKIh3~0OfrEL9xXW0hUbTJ{x2)>L%!(Ir
z1I$^1r#Jm7{^BD&EaoZ_u9K46x>kkF=^IxLVCc(WFWS;)yaJW%?$f7FCuO_FA2di1
zY-LV&LOStb=^Mc}rQ{s_xW9vbp$&ZtPWJ#+`*X^#{r%O_(g3e`(X53qASfY(p^6}Q
zmM;RsqI0LA+_Z^*x*0exZn^XA?YcLwxuke`*DFv`ameL2_q1hOlS5nWfR_}11qUD&
zZBU;|Yr;#`K-MSptGT2Xj`2XRBir1rW_1s}Wc?=z;SaiQbN2Ft-CzfKBwfhe#g(;^
z!eb&41@r#puT$E?{XdP!N_#j>eUcfp_bK`il3@SXi7id}49i61(geqz=!xS8iuIZ$
zubn@lnlkR@&3Cr=Jpg;Wx<UG0Z*OlyyC3y9VhA8z&*<!5<7~$=)6?(f<vHh^cfN4p
z!o3cAIh$TeL@Q8KC_;Xm;-O{{f8N~8dptB)AV~A2R*dKh;GUiCZxPZngcH5IC?F>h
zTGBhWN?yKiY&miRs|_2C^W#Wgp9hXCfkI)HCpL=X$Wyy#LmbLt{eCpXhEa1Hx_SSX
z`=;jU3uTF~v-j`F^PA-AIQU7#);8zW3;X`#M(0MV1*R9QKkSSDe(qu9)M4&7$0yYH
zsfosgUb)0I2i)Wmy9a~91?-YOmKPc!B0<>wn>g1ApD)z=k&VU>j8dp|GwJn0GSMHx
zd0#6%jUY>-&<S+Si-;0;@80$C6}rZQj-a-Y>(sWN#S@H~fL%r>Cxcyu1%eJi6R@wt
z6oKT5D^@pBn?1yR&HMF|Gum+rUQOwiN7iCd<CPs8v!YwLN9a!`6~pD&Hyu>uuUG#}
z`S$75<yZ*|2`)$FG1AsYPj1&6D#!Zx3sjv=%WvD5aYBHOi0IhL==Ta-Zy$efHt9WM
zmAt$>78yFD@qW%Y2qX+`vEX<OMu!mjaR=yTc&fyAkc4x$7!=-=a;HJR?QUbAE8t;q
zuFRJtgCbX1cN%Z7nFb4{$H(sgzvv!%mX<U^S{5DDz3DQ0z0An(y-{yh`~fF9)v>8_
z9sjlzE8MJ)3~*O{6RrzEcuII##ZO!1ubL&yQgph}IAr!fy#7?~t82nVF|!<8Dj~04
zYi1#mJKeiYz)fhk$0`_opsPYN$;!^oGcj@ZzI|`b8|}nCArKooyU?q*LG-Ss?K$Hj
zZijqFJ*n5X7o;-<%G&_Y8J#Vrw#^o2-RBnwLZrs)gqY#X@E8QYd%+e*n@Q(!IjJ$F
zklV2(iO=GsR^sK#D+gb^{XZ(au1)>ho60E(wtZSGezPKWw2djuKi$oYePg?;qKE3r
z(O=VCGsn)kaX6|4`q(d>`o2&}Mw8O_JYDkOiDR0J)Z5}!w7!yDL1e+!08dP!{I66k
z{n<OG`<P$&^`Z+uI4KPPdAGjSi|^*gR8)elCK9BEEAybCZN;J@j&5)W>L%fgfdiic
ztjC8b!}_&^Oe-)UguV*HI*3E);X^v$wYyIi-53hB?HdNE?AYU!4-LsJS=XqM0a$bt
z>i6V;ikV<7zc1u|pk5Fb=>1lH6+co+mo|CHUC(34uy4#}O(3i_aHRUVRK0I|{63i5
z@xwjJ#m9mx9;dea^E^1Yq{i}pB_4P&ayP<lhEp0I0jj4{88`QtYg50vXkS?VCO?ll
z&DGvDZGkTevBwsHsG#4N^rbGH<9oi$F~)KF6(hx@m}Cp0ZThyUiBW-41~wZAoeJoI
zse|JIQk!lM$;`1FnZaT2I}3ZD;?&LkapPEjf4?CZLr8$%zu$y_as=ERbl}7Wy}v@u
z<OxQ?<?0z|<FQiEBQiwKkm-QcPN4mskU@}U_MS_6&rwAX>S@-3XK>{5Wxg|i1#xS~
zYj8?RGN`Jm0u4J1G!tY-K5>g?0D(Z_6pUU92i^p|g*YIQFMY3z-wX>9f8=uVl(z|h
zD^G17cTRRcOV#qv#f;@&KL@WdzU+BeAsWP774**`@7+69bZLk_?(U(2JwlomF)d;@
zhzLFQmxh6douN-_chYFBu_fc$Fa70hQukLxpVfapCmD2>e>=#aqkvS2lpj}!qf4~i
zp=XO8=w8i6-=!r51U7^Bp@3Y9h^}n4LLWeyAmW;woSc=dts-JZEl^pFEN7%t^61Ts
zg6R}{E?I|2M1AxXU*rcyJbL7f`yg;m$YXA)oOR-PafUxa#*vnINcePh^wZGuS%cE7
ztbCBRivR38muQMDEbiEOZ&Avj5Be6$!#mX{K023(1!b6D30!Qc(nk*FJn}2VHS$Xn
zZQ$&{9;MgJm4EO9Z&GC1bf~I)?rfg&jBKNwPr}bW%D!i}hYzK7GMqNs)Uod`anqLt
zNwXZ>L~R-q4@L1I#+zkbPqjx#Ulv>DVm+d+rKOFC@MUv358wV-_r|Q@#l>M=qp{`1
zaI5R~4^@BuI`rny)+pIH(G@jiyJxzG_t(EXOBb0TTbq7fZTRH3*wZ{5q_6(VM;2mF
zJ@h0VReJwP(d+G0Jn>N`JRf%ciPW52b0J@I_4!_mdSsV-n3%Dhew6OEeAhZAoQd&q
zlC_Fmdz+We02}fRmUJi6Le&rSdk1p6-5#JmXYmT9t=br-W;m20bh)c(ExvqgqBe@3
zwd!R4ledkZ7|50L{jPAFJW`RuhRnlX&fmMJar6%tz)yAM)qrz$ZccG|;|AG<>9?cS
zCAH75aMw@#wb_|sL4$iP%;-?;d{0By_g?R&4Mq2@S2im=F>OH^adk}_Q`Npd51ZSb
zC$XbWNC}k<QDGkcaCSCSEg5Bw`sH1XjC1TZ>M;RZH+`(XsXxZQ&co!{l&**Bz}8w<
zX?yL2j`s*-w7^^XB$`OVW9?t3?V1-qWU=&o*iofGDd?{!eDXL@m{7G0_lM~Z#ee2}
zswqaKJ@2;iU8Q5U$kPDBtT!arG*iv&oV<$zU2H5LCdyl`;S%Gw9cQj``cqvf|01=!
zX3t*vlFNE**~(>Wzhd7`q&LY~Hfy7;k3Y{Dy8gzmDsO?t`kvcG)iYb=1jQ3%W{xk5
zE@yVT1>i~Zr{*Zx)V|QAre^V!OPvuupfL2^`*ViBLVA8+>+>tIhDPMd46Xh$yxh#n
zH5^3JPLZ!?(c09JDj*T0W+1%=l|L1;SX^_y*C!NZYnQz8afYP-*}XRKT)+G?@uay}
zLImRgQPlcm_8ZnV<{N5e2v6Jy>mk`xCY;c2-+{H75RXea)^SWO*oh`%sKGPcCw-Ew
zdtAvT?3ez1Up5)1SM*gsMr75(CE}a2>8?~9_w7wCvJ{#kWz#4OO^5{v?EbUzS_5S+
z%PZX*lj7^$bw@#L+p<w)c}QYLAfm2cRGw!4f#}Z2s*0MnBTmd+Hy8b#DLVrFrA|pP
z(QAx1q)>Pn^DR@{(@;qo*U{lgG?tOZ#LS7Xc%|_NY6<4P#+DtMg;~LqYG9~3Hkf$P
z+*H?)r((Em7n{&lADx&6--D8SgQf)kTng&LhcD`8Rjn>ET7DF|ku&~FuC#l^M)a!o
zF6knBw&cwpoflgRXa^3u{)#N0c;ot_^N#-Yrh&^5nNM-G<317P1(#n;3m9ZMF0hP`
zhpfaZ?ukF6EhHLrch`2s@%=4a@uaKE#uJ7;o&}<B6u{o?uBE*uwmn@Wp`M%ALByKE
zW-+j6FEORQcxqOmblB%2&ye;Xj7^Gru9t(?ZDc>6INk0~Z6(tV+Y?@X3gXHhJ^NQi
z+lTB4=cePnZ8(@Dgy(tn<DIU0iuVskt&kYk?O?T`Yw0<Az<SvrN%^5j{6x1taJ@l1
zvx*gKrm6fN#qVm@jJdHYsVKcWnyJ^OXFa*N?MiEVob2--r!o`*BZ2}SsEXJT#I`sZ
zwJMTQcU0o2VNJ><gY2PrO#}DXhuo5j*#<pQPSZl!9nO=Vd><Ig{y~VjO?h@lep%|)
z`X>DL#<R*(7gz2*p3(SJv_OLsGa7}quX>{$b#HOvl^Xrjg|gCmgThY)sC>Lhk2}XC
z`7x8k#W>H@tv|e2A|;Sv^iuCS-qW!#Doe@P+47!IOfKAS<B00vEj27wH?AjJ@my<J
zAjciVpMFtMD8cYC%EAvpGbU2AO@rIfbW!!p3xh4_M17yq5qaQZE_hRS4(F)r?In7b
zYs^*dXQ&7mI;ZGi>qu-+(L=o;5C2_^TiPdwl{>_QZ>IJ%9AwvLJ}A3z+eC{|I^&@1
zkbF*<*NjR+y~6_^pAy(ObPfzqn3|dbcZ)$a-VDo?v^3BV)_2^9*mrcSFQGpsN9naB
z+f&vqTs!9n#>)@XR1W#x8#$@iHcwRDTR7M0%x1jJ|Ez`pitfVfV5Mq){SdE1<8*0{
z1c!3gt*hQ&8Oc}dmgALdRFw8j^OVQT+#;*Lrp4i>>UX)ng=$2^fdeqP;lD-q*1!l`
zPU@e#!$edl+?-AuF%KwhXPslq8m=t}m>7{$97yt4eep|XD!070*ZRYzl)q&6t4uVi
z{}{~u23VR$zw$H@9z(CXy2^pUPox<{qKUJYl9KXPR1^nF;hpY>FI<Q&m+`#+Z?NOo
z%)R$7q?9moIr}E9b)ua>A!|85cX+^kv@h=?VB-K@w4JnzSIygSYm{y7Qsh2;hsf;G
zBAP<(^F5-HrF~(}Qm)ePoq0~1Q3>m2qVtK`ql++{Dms4Rgd%EFtOtTac5?q2;D=|d
zHa`KksjOo+f9eBc9rl0T=Mlx%D)Gewx*zP<H37wc*&d#HBmDTmOSz*--#qTg+GMrX
ztjyWxAKDjR-ub^q?Lrg6ZFoBJ9Z!$VJY@(AJn@11&#f3eC!I?=!?aT7yNT_Tu+xhK
z?7?{Mvg?Ia?}8<?iHP;cVSCCIn4f2Eb`0s86}if{tn96!(+Oh{9Eq1NUry>lmf;Ra
zrV|uL^`tk-uK~k3fzxKuZrQTwR~8EcLxQLal0h)=gun{F4|-WFFp*~XvP>=z`PqW-
z04_bQL;2{@7*GL5M@J7sz4RF(TGj(rhkK+zy~5f8spb{DQtMx8(-CeRi!O;}mw3L6
z;}DHAB>GWI`+~%-|B4>*>MIJ+>}uH`!f2Tl$p4{`!(^w}fFA+K#IJ{DlU9LJ54v%^
ziL;VHU?6VhTqh$dI|dhrSO|U5^SzUiAwlpMo}XFYp&YsQ;#wd~vQFZ-249FP(3OUJ
zBJcw2l8Z2H``(tfpOuxB0HruwXXTyPZ}8MaNYMd9_}=h>5l!#yZXH*wnXBH&><ikM
z#6&dmJRcYXF}$uhQ9IT)X>-&(F{vrOuZ=xbAvZL(%xru_u5{WVWb%4qQrSqj-eb0o
zlNC8H^4sX*%j05Wxm#OX-^-rA#61U|*%2Ti@!!t^8Oyfj##MqeE`G9Qun`t7cS1t8
zL%iWvU9Eh+?SS1dlb*i*DbP2KFI|$4ccQNn78dpf|7&q6f%gL`p)WA-1gVVZyNcQp
z3w!u@zHj5Tkb%6a^;z~TS%RCF=~82++?2yAgg%sFRXoa*qv#2}WC)1%^L&wGy=JjN
z!RZ-ii7eM4mTBH`1^r-_hv1(ey#)2JFEVRi;LU|;%jV{00Q?)WT^4HXy3mItE{h=k
zUU{5JVwcJ8WY`ZOme8~w;TQET*~ZW)Mnm>~FQf!V#%7*`3Uh~tDx>MY9W8r$<$J`U
zrCbr!O|&}OvGp&mnf-;!9otOx)p88dxm%(~*2JIL|8sb_^VctfUvvD<JUR9w?I=oG
zT6TceT?#SH^Qq#C-?+YZba0@^15;5^^zNNI*pbhU`a~07OL$@|8+@tzj}^wZy^23%
z)5CM2Y^gt5<U$6#t!lYHBjX8?virgEQ?nXr&NaLfPWQJ^EgffLWMlIMVf-Ta4eCk!
z998JRgY8KD8Hn)UGd<J_MD6n_>X3-<7lu`VPugau?Ne|}bSIDvAnPw@olhROuL;+>
z8AX$nHG7HYNfzh>{2PeQSx{hvi>}9VRIn>&YQw<^tLYlI_e*VtQ}*HhNIgt0P)9`F
zZpnGSQX3O&rs>jq;~yLXR|jK_Xaa0$N<E)C^`p@Y&MO|+fZd?SqrN1Hg{KGCGtT0w
z3JVJ_x98`mrmC@3saSYjnUe{ar;}vWj>(#pP~>sW8Wo<V7SFWHyxcY5^EQxt3`IqV
z)1ph2^O)X%Y1jAf-o)vEP_J~7N!zMy`or$2ah7j#EgO6vi=UBkVy;^M2eaT~CLZmT
z!MX2?26Mu_@oIS|iu?qa^MfSf%Pq{z_#>V^?HU}s2gkZ(BMl9W&dyFU996x&y@%uZ
zrB=ne7R$g%%@xP-Pf-{n4MW7=tTkmBrE&UnjK&rJUU(J)Q<d+rQ#adxwbdKq9}t5!
zt0ys4B^Y<dJ6K3(e(UA>icFrUwx`*e8QX>OF^_${{||Ppyc?Dt9BzuEl<1WiSJNnt
zv}z5KA{UoeKF2#VD!tzJCtZkL-9D_URb^lLvID{jEf%IFSk*qBUi9A*|HfkA;}i6O
zZr;2Z0DAgZ9$IhU)}a&@)XP>ka;hbzXr{75t?Gxv_t+OG3CO9bseMUUC!REG30s70
zt0s_DyGBN+ot>Tcls5$Cn>FxXX$7!=K#U4J{)N`xWg(ITxVUZ|pV*udS3{CyyFPK%
z$Y9vvp^x!y)7{BMy6icuDOXdTpDSST(?6gSQ!&z-EXMv~>`{B@{%AL{*48$9YCR>J
zsy{D>=?D=OZl)j4+Uz*^C3)dG{mPLedm28rw(31#)wZ&QCBlCc`}B37uAY=$uM=O#
zUUjW-4tyVn?t8oU;<c<>zy4iG2|0YM`0R40;GD6Ra~(8MaAi?8LSN;%b~=9fk(^7e
zxbUuB8*peYEEqvzR##R~ubB-PtQdT}y>P6^&dGUKUcLeNNm#!r&y&!OsM$?Lk@rM>
zNUBw&a*EAzpz^GsJ!u%YsIj{~Ni$JzA|f{^n#2=T80uYmNKG_IV9%f2Ic@cbt<K1z
zVyNU$8bkPc{0y8J(8M_KvO2Mf(UXjYFkL4LF+&OkJ=p8F!@?NB@BwEiHB|(RU2VZ2
zIPva<GQz>xxdb)0zw9&<R1p3k?wgf5oIA$=hPFG7z7pKN+wxrEWFBG+;TAwpprBd$
z43;c$+!;wRS0!9>>fipdeSeJw*PP-vYm{a&NouEk2ay{U>walh*j&V5WotvEU7|LN
zBvut!Z**IE^yIXM^FA4Mu=oT&=uXrvD(VD6{%T@$>l>HME$%e0>|c3Z6F5(lgtCdg
zzP{x>TTqPQ58sS57d8(zqV9SZAbR9;Y2L<&h^It;O4t7M)@e-%@_d~sGp2<`t^7l7
zyRbNrFCk<7{=0fFC8gZ@Q-zh&SLMv{Q_a1Z#5yVAj51kmgd6k4zkmGnsV|xuX6r=a
za~*nbvKF>-7-9qtQuEzQQT0sM=XJOM8I)ih={wsV9qqOLUYmFj4c|K(e0OxJ|By$?
zucTGK>CLG5?H~SUmGQ3@9UQ04c=nH7T^kiD_Xt~&W>IzTUruK{e0{eR`Y&un{;9>h
z-7~W$^ENX4;%Db}nv6&$2j1+}lldX>oI*fAAb;|`59Q;@4d3i7s5#d~nk~==)v1{)
z+R%;cdX<r0_I6vU(KqEUpVQ2hDLFsKs@W^qtT+CfjU<{toIjP7`FFSZT&-lNj16l&
zthCGC8=R(dpTsoPF8;jjK`M+i9uI64irxWeH!PnK7xZZC*gKD5x%26YMtZa5R%n@B
ztbD{-CvKUj8%AH1tdmuDpuy?V88FixNe}4bT>O#@0$g)eInw-qzRlw0zES(w6)11M
zo;30$F(_PSO(O^vDD4F&TrTpMBd`1232f%l{#h&L*z6{)nL5sea!F<Cio!R}n{Q+(
z(-QY{E!Vj|^z98JHvlcVC~@ijQ`h87?TLiv9j{zHxE#lR9A)X5<{be9cdhVXj9#E#
z(M1=T+TnYKAMCh(9?;X%Cmx9}>1zF(Q)s|*Qz%fr`}Z}#La>LDlClr-ZivY<*$M7O
z=t!hTS<wlJB+}J}-0iGSS>vM`I@*MeY3^^@bacE?Ust@GZE@*v4)<Jr!#W~MXfiK&
zQy9wNS~zOfi#bb2uk8uJN_iJcf#RF*?_Il<I~=642LJu9zgUa*2)Z7~+1jyN@v$OL
zRKD%nt7j!dTKi75k*m!gy7%h&b{&1@?dM`h?U^$a1&TJP1XUjNV&M@RNP;T|$deN0
z68;C%Y<}wS54C11V~=Bs<HKsE01}UhwTC9iHk79}H^en~rs&_l(cu!Wg~FXD*5Iy_
zjv9p;3I&h~zJHD<=hjyG(;!<VQzf~c%%}H1S#fTM3y;?|t@T-dT}5%a9Xl>Cp(bKK
zxdLT%#Qq~jixD*@=uz976mXlPotGQTQWd-V!5x~lKE;e?51t&z=#=|@o$=!(o)7=!
zDWv8&W{HZ}<<}~{_D$Y`!*<VCx65wWEd*>rRE_3YmxW7`UTh>lE(J>4?{#Z>mKog#
zqz`T0p}Rxey!{OK^C`BfBjr>;UaqOR?dY)Zsb{Gos_NgRoo}Rz^M%FWG2-UjX-2ON
zoF8UTe_*`y{y&&hQzJ9G3yV`t4Igj?`4~8S0Dwl+uuWb?e)_vz8>G({_dO(bT)wVD
zNp0=6sU3|Km1Er2->c<)tpRvHDrgyvTX~2$r967@oesAYZ)~SQ)m>$3rJe*|0z>Op
zldO0$qWTs$!qUT3HUDS9dj+1r&im0ZSuLPda4oVs@I=VNKN;<B;^6q-L8q9Mss2xC
zr9{w__@hiyB8$I~Zw|aEdoR%9;y-EnD&Ovm0bSkJuGpXQ-m(ST#=@q>f`k<RB%!~*
zm8HCGk0@oE1o=hl>uEP<1O=Bb@pFHDfYqcS`VW~d>0&|PQ$HVO)3K7O8?$np8e@-Q
z$7h$4NW*h3dEG-#3jcHQy?59-wcFyrYX#!hvX?72u^w1>2;$m*{k2C9d)S}&C7+Y&
ze=c)Xn!)c&m_L7E<e=^!&}H=o|9bHE;vo1rV?9560-~Z4XPpuN8T=dFFUiK$ty^Hx
zX_wMibnN_8nAo8UEmf)8&lmLu{2f((-!8xD?~_Sw?0M|G#Lb$D?8vFa?xC=M`k=pw
zotI>7<UkmtJ|#2!+*Oa@^yxRhn04X}`*T$Me!7k|da@oF6bxK*PC?y)$^s_iQ(v^w
zMb??7^70qTRsA`kfA4jPt^fHh1lV29?C<$9ZRFgobTi+DRW-g$ppd=lPaov(KN7Z2
zEZu3_L<QDV*?3#}E3=V`dP@C5XNGgX=4cS03};3}@2Bqf4Em4TWJ&xxu6!~$9;fuZ
z>_K{ErK;vlS<yHDaRZ>kzW9IQ2R}##=_Xqs{Xe-%+r4rxMLQj&6Jrme7-J(MKCuCT
zk5sNlaq<ZYoiwz`kl50oQ6?83T(`n1YPgPY$eXoMS4k3O*|rTh%ImkJT}nsw^jL{s
zpjS9d`S<@tIz5k1f3PWj|7&1<f}l=KXslZM+!vt+YL93B>>5*5>2nf^6dkPbIAG`c
z*E;cGUK%RC4R9e9DA;_w8ekZwJB^_+IxVSMJTrq|l)(%K<y&y=-~WSti*W}2n=+7N
zxr`V8@_^D(InYrYRBlR9R)VF?S?Z1UKcX*T9thEK7y9C;oD?XDpc>EUPyC`YQx*Qy
zds`YtrVJJ}1it)fzxtUJzrQ4o-k10w_eyGlB2Fo)@%z`iz-Y#gmB64Tek$|(+ep8E
z>WPhpKVjPQ`=_G>4cwiE8&8_}Df{0a{QIXRV6hUHPXGI-4!=J>uz2;SRR8TuhXT>0
z<pOyQ8kbuDX(DfqA0wz!AlR|=5M~F24^K?I_!d}yA;~i_*+q5%g8j?2&yMDBpg5NW
zLq|g5Z0d*o$iQWmCcikjR6j$Ci84exs-$&nV&aIE)vG!md6LIJ_wsT#!T3Q21xa5u
zkP%Qbl#5)KE?m0g0iA0nlpS?iIb4otWX+-@KDnH&a$z_SLNh_C9g-(f{k4PND~*He
z;TwNEtQ(4%4dFFRfdWBu?X*W$bp#5yOKoZxlI>8SJn=+w3&a<x<s+C{L4i^YBBm>k
z^#Uzal|Md^4ca0P*aXEAZUTnvJ13aAZCrNE{^tilj6(|#77>O@Gw>sP(S<v9XvcM)
z6$s;JVFbiqAc!vzVV7}G@0vR)8#FOK&cDRe&t65%F2gq_7At~9S^v+i>m5T=9qsQz
z2ux@zfE=|Jy6Dd5T;_3ha_WY|)#pdM<>ZjhMM&S+L}oSfOCOzgasXd<fb+o3?+#25
z*YbI9;dJ->F@Sj~B}4}m0wAJ(g1xsqbbymGz!bnG0O{(H^bLNZc!bn}oUCwh{5bk;
zn@~GG*Ub_}`I0y$eV>+%Z3_hjMQKGvEHr&s+X@h)kHR~w8=Ew=eEo(E&rpt(_1jxn
zy#<uF<_t<2F)>jH*ooFQ#8+h?&82~^WEiN|=)9H;jw~h6Gu}e`_8CN&4t*h-qi{+*
zUc>>GO1V9uUB3-wz)Rh%t!gr3>%d7`7u~tC6nE_5XIN|;ICwA?pGBa6<=5Ma+&EAl
zc>4QO6V2dXZFxO-*_V{Y@!I#orLrET>cFfne@WN^vz9evgy*Lg$Kv8*+#LRUto3?L
z44%yMbIB~kJfK1GrMmtFET_+yZ$U88&<cJ8BoD@y$CunRf;&4e*p9TbK`43$y8y}$
z)YSeUp<RCPrB7^4aDm@n+;eb{D1-WA3s45)NuqNtctdK-T>Fo4$IpEkv=i=s_M;6i
z`n2Z(9l>Y!uL+s$_j;i=D{g4m4kV}qJQ`8>)PSf2tD-ezz#_VS{v<5lxg;dEQ*+2E
z>gcevwzZAbpH{mF?f~d=cTr9P<g<dK7nwiT9K4nlv0Yw4wAl-;7PbjECFrng<=F`V
z&)xv#2wLFJN}Hgh-h#N4otw+GcP|a(r4G<p61{p5=#I1OR^}mGRf*;_kU&vW^w7M#
zdVu#-z&0ddTUBoUZeXEzvG52FCwC7IPB8IcDJqY+H#XXJgzOu44q%DP4S#KKOwsp&
zcbJUBC>eap;jbeRcWW!KbRdoh8*z^CRa%Sc3WYu=7uQ;Dr3V3_d2uAy*-=h({5=5`
zUwC(Cy;hD5FF}h1g(5B?K_OnF3rp)a3ypOAI5`<%Q4jbKF^7_xx&olw=Y*3x4oFLP
zgN@4jDGL)-v~+cQV7*cTwYD$#KE$RVTvTTZU9{IxP?WT_u}x1;6SQGsFHC}kr$9N#
z!9dm~N0<9D7Ubd4@o@z#0GjRF3G!wvJ_5uRB~?|wQ~6oBH`)2e9eMiK{E5%KDzBZU
z%qThUv)vQ)y{~A4a(%B!HPhe>_WfJ1n8vUIRKDDg)R6{#T4t=2F57t~MO<kAe#Xei
zNG9>iG`ExkTcIHJ9pJ!!0PlDyY6-%f16&!7-_(bX8jS*di}m?5!}X{Yi`)*8IdVAy
zu*1%V6+_({zy%bzWR}2}ADn5~*|)CpF8O^4YhY2>vtMz1bJPZ_ClJn!Cv|a7V?_r>
zM7&IU2~xEpICN{s;P8#6DU`-vm?ogi3}vbM!Tpg?s*3*v2*xC3!vo7avcn5W1t89r
zg8ll^TEzv_We|{je7;C`z|XN3{*qL1lQLq4ixf~BVA~nOv66T0-j!IkR{jXiD#1b+
zR2j{^xyx2td1-O6v%i1Wk{dbu(>tlIQTGiiXBa;JoKO#};TEO-=N!}w0@W1VW}LBu
zGHORri~)qVvx60^m=#(Gt?){3?qTpXR#Q{Mit56oGnQ$b<=+N1l*i%KD$Y*$PGRAI
zJT;5uY>idC?|hhakWV@6<rc|xb#>tnNOnsma1nlST}g?N{E|x``+oK|)^C3Zo?|f}
z2ViS&!MzCx3_LY#opIC#1QUt!b%=(5hRY(4FSRGc#~=HkIr-*mTwI(6x749S99S~S
zca6_U@%-TeY}oP&)`4(*;V3H)o?2=`*3pA^$0TO*pj=wdwh+#il$_X>r-m~eoSZ_3
zE}K|c?M36@zRP)iwiGXFjt$W*rV3#<>cJvGRBU*Z;EI<wT$}sA^X9cRZF1Dx=VWLn
zZv89h<lyVVJC1GLvc&@gEp$=VMH>c2goJq5w>wfmQwbn9B_)Med%_0!d>>CA2*PdY
z4m-d1xM6QkF$#Pc!#l<nv4GLT;UjF20Y?y!8o`#eRXnld2kBhVr(y!3#F0X=Q;i2g
zadw<LdnA`I{vw!5yJ<#I_B>3jE}EJG)`W=r9x!B;q9z7{`NmSy2G0(SC=pK1HDV^!
zpB)S&_(T4x9^pxhi@WeSTK>6C2ERMabNxKY1l6bf>w`0QeyFZ4g}-@MfByz$W#!rV
z`Dbt`i1&<`=eVPy(XwDb`|jPl%lON*K}Hb+EM_nT*Z%97fkpGhA>uU`^WIkH&EKaT
zpH~h9KBD+1g%YSLT3PnNOD=9{$t!&!RfHKU&tYgVnJygoa_hrl#yuL>!MH}?i@}*c
zIyDuNz$hDp`KR{@fqH$Prn1cy&6bb2M5uU)Sk&CoVjkhC$8>{-QLc}f?|^>Or%zi6
z5;xh;Q_&hpNN>(|kq8^6M((P>z(5w|pc{^Ao37)K$GJuU%>vdewj<daWw0XnD8Nfb
ztc#Z`oIf)ORMmG7e8N3qK@CKdh2XvzCI%ObjPAmwneNu~&Y{*EF(8vxv!fTUxX8i{
zGl|o_yL2NZC$>!OzOZ;f73rXSNQZsXY2Gh{^Ic(Uu)ATd&!z3#IwBO^G9Vw;q*6`y
zPs-@Da}{Yl@mM^m`O^x_1~?Vp$p$yj`}RWeL4T0fwl&*YgQhj#kq#*US|#q~kKkiR
zXf1OeovGdVy)k(Q{2E?ZUmA>vU?sA`y76H8Dp(5?gXk!cK=``oaBKNW2f+p|S=0rA
zibjE?Imfoom=eBQw-MZwS<<b0lqfmTHjasjVM!cXyME=?Sn+0&%ZjgsN2;K59)l^l
z%7}nE%?Ic>>g>I4-0Pj27$_+#TaO1-`$!J?C}hJM$*kbHM#&j>y0!s%ZB{)HAIlwt
zhl6#QWpt<a{Be<jb<qw1vNvaGKolcj=5iTm--RW5p;9DTljsUuskZN}+(xj=kaiX{
zUaI$;Ke+k|zmSuYcXfAjJ+(7vG+q1Ik}a9Uvtztqz3qa`ncfLfHTl1us3Edu1aE|!
zVqCl^^3Z%(XCmV&#(<S1Ytg7@fvvD70M>N@PSW1KzGbjTym;+e>b7+-8MqC0F6IjP
zL+IHJn=7z<^K8@hkU8{+n-WWJ5xvT6w-q@Uml6bd==ZncAXC6DM#{QHQ&V$L!HD<h
zIC3_)gKp1<BZ;@4UpXQtyw}9U@yJUT_+DW0cN-fH_anx}JiF8)sgOt5!XAtz3t<I;
z3Nll)GuPlSaDVYa0OyIojT=Ka>)+w8;ASscIR8U{NTCR$CnA*6P3`#xzlKe4N=h><
z+e9cAaQu=^oLCpF%hQo_9b7c=!#FiZp@#0lfD8rXG)S4CT#d6v6!t{Vb=QeUw;(`=
zdFL8*2X1+JDc=i>h>YC2fB$|214CHN&*H`j<{tvpF~&NLq%+So;y1ws#1}3cWMoJu
zyr9n5DJV#FXnB?!$<eN-#fRWpg+YDhPp@HsT-^$)coI?Y0FzgO#vdD%jDGR1IvS>E
z$*6a)BqB3JmQjp##c^|V4U&!B1-ntPgq07Dhkw4b`o`xA8v6e0DK->{RH&QC)o|K&
zA!^_+dtkc2pGl`H9`xnQm%k+u0QZpI8bYMNB5yVI<17{PzIC`3&%1ZYiG-gTg8??t
zli@5QN27oOcRo1T1~z02c8&wimiUFGNEt_s$BA*ILi-VRlTQ)%h<5^_Kare|c9mqf
zb`Tp4tlRsyZjnK;5)BuQN0`=D?rgQP?2-@D3lO6bJYiq)4l4r5sD9D{Pe<;J&B*+Z
z;<^Z-0jTh-Zi{1HN<2g3kz~Y6`V4tC^7S5~=?wdXxEI&SbC14u3dgs55J45s3-X&X
z#76OQ9N8QY#ox)w+D~M*b;m`zU{T|hm1UolsLLU3O9`WHVueG>(K#}5e%RtJ+;<pp
z)P|%OxONq<pB(;5clGL3<Yz?uKu$vlsNdlmV6><+K)%WEz8tIttZv*OE_WL}eVp~F
zboBhf99gd8NX;)O*v806m?M-R1t*fGj+qU%3n#w6_B%IeYks8gzbALb+&DaTuq3X1
zLi>Z%XeaSKsPe-H0lQ14hPgyV39SI{vH@FF-@D*LbbTIC6dM1kwiU0P;R(7ohq)i?
zi6sxRFRxz`iHFXx>R<J_)7?OeufuT3od0BZ3_sqpDgoy#MPYxhJ=<xDADo0cXfEw3
z;439bIgaxX<O4zi{_ysn(|#4ni2K(^{vVY5|5tDZT|Po^4{{9@kZ%Z@tCiI)Og+)o
zK|Dg^ZqKsZX_YIEQ)6TA;2RR$-p3oKus2AEewE_E7hfN@W$RWY*tBh9W3$ZUUt-5E
zAEny5wHyX>|MttXMUgay^VrQ{2QLEXakpAHae_HC$b$es9+9_h1S6uyy~Wh<{i|R>
z;*FKEcB(P~LD}6ZM|avY-Z+MMp8aI@#Q=H^bWMjp+9$}nnLt@YDYEHs7?p3#swoY=
zxJR20S%kOL+oyX0)u?8>>`I_IUZp@3`PFNFxo=bOwl4lDCVELrg@J%`47XbCegH&<
z?rPM%JtZ2i)rm~^`mNPVjQIbT`2U~c|9flk0mPDJ2*??aF~#pjLQsE~!xv^8Ip(oC
z?0)-O9i&7vo8FK0A9BU~Bh)JawSv?Yx}O}b8c9X=9OpO$Z8C9gDW%J>){ONrivU9*
zuw_((+r=>XYUl*c1^ge@YtMT62vh~<`o6zbKd=yEcEQ35`}YsTXMVKLC)*^Mk3TCD
zOfJO_q}s(RK6p6wq~l{_9g~R<s~MYTPnCN`Lub@X^1Ih18QQb@d+I&$A_@Jyy*q`3
zPQH+mlF~61zQXP|;NZ7EWejSW_(+Xs)ELnb$EJMR>DmE&a%9g3v1LF>M`5Lb+~_!4
z;<aqwK8MvmX>|a(gG4%vgHZHKUELeGV*rCHuFF(Bc{^KtP}3&H)ekdqLtAK9f4gN2
z<={Jv$)bU&`;P-IC6<E3?_STp*)s!6U+cridT1-kHGUCSpV~17DJ^oH(y}s6PR@5c
z?K_Ci7?{2PK-0?%J{yhJ^PVkQt3Pv?D}PZ#t1%)lA$Qnai_F9SaBybV=Zfpk?K|NZ
zJh=?AwV_~KeEc4ks@8H^1@C1(r^CmXy7TV4(_9iQ{S-2PhY}aowUw2#bodm9Z$J+R
zTgE#}L15m>wd5+rG>I2!6@tqGly_3O*m?kd-+0w%Bd6jDeVe8U&dD`Q<CN>{J1IF8
z<+6Q&!Y`c$_j6AFD5B~G@23JsqVA9=IXx8zQ<JQB9H-=*PyD`y_uXcB8bhg3%5|LX
zXSPP(Mt8p7$LV}{;0f>b@3?8)X*8sWm}^)_3KX2N-yZwy*=KmMiJLc40S$!~NB+Wv
zotT>8<GVEeK?Gzd!p5@c(%xM*HZ}x%gOE`G3MA5Az>5URgJVZ&u#7vdn9pSs7Y>lM
z@r4QHt9R%>e=Eo~%Gf2!GaP9OjD#Ve1vN(o`3cyigisOm5Tv$%N+kM4&+y<y(V;F1
znv!~x1_*0aQM`tckrCe+)9eg>qv2>Dmm<gL_f4FowCX>oWQb=~YE{Wl^}AriuMxl!
z@a=`45KCwiG()sN0upxc2LW#xg}qSaJnK;ckGx=Rz8RMy2<9nZ#`;+obXnjs2O1>|
zK)2*tlrD;vZlnD5cAJ9W8lrA_bV!3|Xd>@ErU8I$1b!u-bv67h!Hz^;zVoD5AE^*N
zUH6I>0PxmkTN?rO2OdaU0q0c$LP2WJKb7;VqsSkb%vlHR4<883-fd;6=|YY2q(7%!
zibMQO1#jL9mAXH+W9gyo;{S{ySdqC$KoL#?;8}SD2M5zuECQq?D3!o}xK9eORACkf
zfDCMDe#sS7Qg~e``{J*lVKEEG_Rin>X}F~`;)(+bhnzd#uA$@<he!M~@fFk+dm(2d
z-iDR6HJFE6_QDG_E-}$uW(F2#1f6VQX2b}#OZeaKke936O#b0U^Sz_Ujd_H16i|*4
z$~YFcMOgpedi(aUUXd#sQqH@{$;p$4Msa^-@cAR4=Xc07L2oSqdSTu7e!FjlP>pjA
zn5wA9;S@*YvnW~#<q`n%Z7eK0{pLH%y*RnU8Q1W*YpwMx)FsPGbEo0rI64zD#a;#C
zB+Pk~KpOlYdkrE<;)?*tQLQq^2=^l5hVUDNE)Ozi4_IYgz-19yXri1(CBTWU!r^zd
zbuf(vafGlh0wD7pm;nG6{1(KOg0flCK^49`yny7e;=vT7VFw@*wv2e%1k^p_yp~?k
z23F>TF%t+)MgSJF9Vd1zFU_1M6xj-tuxX`-sqVX#uLmcx`Ccq9aWI^+CKnA8FROnO
zx36hfRN_l3-_+okrdd*a%r3KpX9-CmI~3!yubmN23J+~I>@Q4BO3K+~a>sk;T0a4+
zrRC0p_SGB2_RdH*EllMuU+%A#HT|WWGN3mjHE^Bq^&@;AfNaD4GBD-TqX0b=D)a*9
zsKAI*MrVpBb<t$P@>N*c`ixzr`mhz5GUXT#6JerspxNEne&no-RVNvkXlPUDEnA#Y
z7>6SOh;z6}p>Hq^qz4gCKlhB&$99_`;2Xds;hJ9BJq1{wMS(IOHo|r0K;}Hqq9FQa
zfCA}f^Dt@&Xe<ymtqZ!&1nyi>K>;yWIo4iW(?_v-O#P?;b{gM=dP*73u?K@h0}KRC
zkfx`mGPKwuLqm5hg`z3P@FR=nhPt6ud?T%*0_7?4c>ns?3PjtRT55b7?L|re!62Vy
z0-p3CN=StyIdb<G4z{CtaP=l+U@+9JGoMzlfyj(t`98U$bNFiI)WpQyD&w^QJAyoD
zAllD3UGxI$1+WBqZjvM6n<KP|;b0n1Q1gP!+=YshA<D81BXYM3ctTy?td|8W7QYTz
zB-tj$AfUx3pJY-{v!i^3fr!<QEIP~RUMlyxbOCo7%h7>ik7j0ub8+Uw>@rNdO+VV4
z_J6QZHk3x8)qhIs>rYNcz>h%mLGKoJ%jDyf5)-5Iml=m*nds@DL$;X}6LPP9&)8ap
z0uxPFbm1x>^|hP?41{-qlAio+5$7C=R@J2xOf;zCdewgk*YD8dyPqdK?18RVFShWv
zo0;%PgsoQE!c!dZxOy!Awd&aci|D_6EwIBe42<B+DE02g@>R@~IUB5GuD8)f=BU0Y
zjq+jOTzYuB@{tVX!FI<)^`_>fUwOoT4MtIwCP`gyZ9UR+*#GPXCqd3gkCK4ll!E)n
zFTj!l*edesC+P5FMJr2cI-Yv<#ri;{<N<NSrF(nOJU^2}ivrUN`-=4Q<&klir4N7V
z*D=QfAzR*3#mvmC+V&6zb<_%!aCoC$pSc8q<gjNi3TvG=AF8Tuqml-|W<Ddm>KC9O
z?UTEg^K0$O95MUc0hWWC7KId@`9#UPe(`$ab{JM~C%joJPL1+Nx%--+%z-`c2dNHH
zP`#SHIq!Axz*9B(6B4JoNd=4174NC>j%rGr6pmG<QB7bB)~&FxF!2d9e{kK;{B>p{
zAs`Rs%%cqgZP8NUbvTB9u*x{lz|5H-m|{u78FaGn2BCLNyYi5uKOmwbP0dj|(}LNZ
z2FRf9ZOcQmo#c6(IWR|;v;?Mf(QAEOwR}^)!rKt%E6c-Z-&oFk0~1p4%tgs(a!z^)
z6=F?7UExED$0L@02(+>;NY+(Mr`JlpVBz#@uC19)A2eF%>VK4FZ8ByU?sj{K>1V#7
z(@Wk-Ed`k!6I$A#0gG@M16}L$XLYZEAy?S=Vb!6#P-pI^Fpkl^76h4~Mt5BvpsS0E
zvt!w|gF#0RKCE&FV1gs{wA07P!42!zf8FwoY!nmE4B>lG=a$D3#3AEw3)*=`2i4Vf
zG!ijswjkXMv-O7#9ePsmp6oMbegJvg-ImgN{5mO9vuqydg(`>X(KlXo9wzrU)#zop
zo2JkSS?`i$*zYx?<Rtg4F;T6ssreiJ8KuV2zQdG3_)I^A)V)B3eX@<TSZ0cws%(Cq
z9j;G$DDM0?GV<zJJBaJvICM&&$pvN=WRNA<hWTqM&JQMN85wsA-Ik=t!wbW9fmN{9
zn*y7@O^ZuQLj1D(FMlRO%OdMCn9m3DIP3J<asfBjnWuOflR@W`{>H)-_V$vyGI7S^
zG;N9x$j88)B=2+We>LHJamNZI>;ek<-xpNtwmIR%)@YfWw0(2A7HqOb%m7kdvFm28
zOj{Rdnxb1Q)^zXO?Dbl%R;m#X+ugmFl^mT{mQ`JrO&mlPrR-CRi$060uqK&OI|<5$
zvLE+ee6%|_?s`yL0o4S+XN_ongZu+<<h+lbMzl@ed%QlaG($K%dX||E%Z6Kgj$VVH
zfjITI>f|j#F4oVRz4y_T#8fsmsFmR_f`z#kcF(ua$R>hv(enHY+m8d0&RbV~dPpA0
zkfYPk(h~Gz2{U&Bf+BD!qW^p@+3b`&wit8e(xJxa=$*geP_zXIRTQ!6VKMU=DG=d_
z1Ae@!M=x-1B5lMMqxDCS`Z1)Nii3lL=vZMDF#LR45N7hl1tV=CvGT&oL@Ki?6<3hr
zY|M7H^Ds?mA)Xq;?DZ~%Rw`$<LE%a#|8c)H<a+aqA73>=-5jk_)J&W4Ng$!3&S)^r
zozKex*C$bowq*>Q5hwwez{7nMZR8jPCA%n{Z=0*I&Z!~8xeXhZV`_AHH-<bxDEKB5
zp6@WmH9!5+2kqEr7&A*W%?%v;wkLIlhQoyy05K)6O7L4)9que}9r(mX*uiYsA?aRJ
zbO;HgFY>6bF8j0}1yGT}{fOvb5|Cjq-zma~2~3go7`ku^QGzTd{hMRh+<{G1hkv#I
zLXu67h^`E0;?ZU!|1Q{eym1x`PM@i>$i-?pVrwhTB5C1`c^c6$wV%Zf%?Vca;yZP@
zyp8-oWX{#iHF~>sE|_XDU7h~<>vi?nRQs(gXP(!bUtD$$adQ+_+E_KIrTZOOl$Zvo
zvBaPZpnf+1VKe&@nqGU6j|q7&9QANM+N*F+*7lddol3DLOCrVy3_A?4wGKCYyp-(t
zBT2y}CA#3F%Cp`;C&!qIeg*&d3R*6TMmm*ex28+UFOnqLRXmODKc<XU-_UjFm#(F4
zS(rMaGZS{H>D<9Jhd1-N=#UW$+MicZ?q$V$s;bfrp2j^fiZRUg)SV9fxk576pI-L0
zbXnj^K0cr@s8o?jvYcYo&=tS_{G;Q26SFM^UdB!@g%HWcP2YxcI@m8*W#n;gmgLmF
zS8!kPJm%Uy!*-B#&bjA$%8>dg>v0;#{#;(-Ljx^c<~x-Vr`Pjmxah`-TlT)mG&``9
z{Qb4lv8&5P@ua5($34bIyVA|(2cNAl3@mS$a-VV!Qa5DY#i^(tEGXXd>Fahp=8eQ-
zzNFhxm|dIT>#Nc7M*jV2wVap9=N8UZ6@A9So78$HUXrOyTJ!bgjJ@C4Jl(5hPA{ti
zPIyy98{<Aj<a@)1Lh*c_oz0vX@~R)u<(`^rBsu<a)JxSYQva4vD_f~^8;=N2mX|sE
z(xa1yCCy7ys5cefQng|V>T7*LqO9GZG8}V#hF0;<Yrj-+aHMlS_QvL9OX&kmXMb9n
zO==OLgRktC&=Ix`#_38dJbb#ylX$~WYt|nfR1o`h=kFbLPJ5#MG%4j=%O#hE*&Z|d
zwmlEB*ZQ-YZ<Y;pkS5Qh+Ov1(lkJ%|o_}k*v7<k2-;sTs?C$KJj%cop%=smUcU<-1
zll<L)Gs$)_8DfGbenzS9RHCZ-<;gxI_dQK<i{~$<LEFQw7cG_bs!piqeYkpLQ<ciE
zvpnuhj2U4&X@9<36JeTW^p;F7`CMM*x7wnjZ-;o#*MCb;^5<>*Y;=#6szc&i{H>e(
zeQ&<$+X?h<<Q<GKE)Xu^alcIdDTT)Tz^w_^%$X5?cV)A@lPw*tx<8|OX)?}r)*9WD
znAGaNy1~+=27fL-m;FsYbc?64f(#k2$<70}xEt{XYA%>Z$;}P~N?#2-=i?yCLzjHm
zpZAw>XX70oTV}@%Us?9>Tu<fVEI)eh-FAUKx^Bne?@iQU>`B~D-Y^9>tX`vgrH9zr
zm%h0aUmswx@I}jVmXh%?2WhVhpsBeqaBGcss)4fIl^cT@bpoTr-jia=GzzYuFn(+I
z_mU{3T1R2!?yxlv(bes&TlMNo@R*Na@NvWiDby!Cuee!Ibe$?pYlTCSGrWOzqo|w;
zRf^W0D15<8=eq+?QifeJkS-7te5oE)6qi<ztwOA6T7{Qa@`UN1Hmzi-N4eOySTPK~
zzl%$}z)7j_z&}WgMsO|3J55T;oZ-_MH!4%}1F6Z^@-JHZvMnv-P0oomaFoD+_{@CS
zw>#{|Dc9Wc8_GMjCi8mh3t<<#&zTn^<TH!^Eb89XJ79`>m~Pr*>sw)!tJJnOBS)D!
zuc;ZsuyLjlKQt_-@^JA#we*Jz;1**SgKLyt{@k#uGIJ%y=X4ZXc0<N3i+b70#sgGU
zFGES*W2X$Q%2eju9X7aqdg66jg1scEGk0so+*H#<L3w6-!Nk%cesDm-Ia8siQmVe4
zSTm*9k>|^|+=!X;{I=+DO?e&pYx0-7gVzBM>6WtEaEGQ_RaHdCo$lS#u-OEr<K6JJ
zEO0)UUp}~gv+?r!l#=ZZ?lcmW#7B&r7v9^Psn2LOGr?`=+ed4@d#`^8bI``Iod?L}
zDXsUreTwoodUwM*-$eG9uG5swAPbgXOZP;D_<_3?o}A${&o-?8xN{)nhG^<L!MZ+i
z4U$QQqJsB9b?1#-oQkrlpCWx@@#k+$WG!4KJ}T%NDX%Oa&`D?a+tAc7$!?sHnN(}E
zam?bEX`B6??~i>Pw|tWh7OND#5UC#Y>DW0Z<^-vT)4`9sFO;~HmQ@|fQ|O3(vvc0l
zMYXh)R3WoH^y$Tmvpo|vZS~xa-ae;I*GJAd_jLC@eV0(9p+n=+C}*GkE0^A(C1t2u
zw$ei}BY>4L%zT<YKB2o?#waI(R*a^<=!(?H9+$gycVx=;d%IN28P^A#h>FLTyfk|K
zI{mYW{_e115%SkVBu?$Yg8L?Peh(g$;yl@-atb4P9D_FsFkk4?yF==Tt`AO}+mPn3
z(^4Ni+MM5UBr3ihS0J_eA;}AOUMGsAZLruKthnaqr4ox`BoH1|#?SbUX25{lf8Ryk
zBd;UU1tzzsoOFDAEnxAK`TEFKvF1r_m6NrmPj?IK{vfpG>q8&gzTZLCF|K+SD;-_W
zw)I275q+0P2@m+yCbk3}qN<|rbFDSiFKI9|h>*8?aFTTHg$~!rM;fOiO^UIfg0=p+
z(khPltfV~|)lcM(C+(SkIh3ta?c*Hq(?~XkCs@lf{Jip{adFa>tXB()($f*73g0I`
zX1w_GWj?xx2#RwL3~zF|ix2JJq4=ay_U=jCE4@pm74aEszA_9Ue7>g3wGpBdYm9%^
z@LW-xO6_pT=(;y7A>QE~iCkk&2|t!%^}-UvUj=!XFa=#d+OaoM=Hq^E$%~|A%}MQ^
zdvdxC5kmcCyp7Y=I15rjzdz^Jk?iu>82)JS<fg~eY5~<vIyGC=O6x=Rc&o)R4;_m%
zE5=#z@cKrs)$97Pqm&j)D?HFSe7{Sm#_7qg&rYd}iZBe?5b;ahhS|j6jYaWp5t9qm
zLB`_DKbmhQHyB@DTVB4ar?-r%VL@%Xpqj+R_{|@)cg$~yPmpQY@6BtL{Py&wdBOOE
z@99S?PKk<q+Ii5+@#V|80AhYw*(Z}HjCmXG%IV$vEH7|BPM#yBG{0HmuP6y+sdH$o
z7Z(@rbzO8Qg?-*&T|Agn*ZDF`s9Jqd5VUUj=aM~*=LL^OHApv><!4iTb&Lym*=tai
zf54nrEl0Jqn2sj#$8Pm(y+?bTW^hMvq+-Y3U1pZ2Pn!`pS@-aJx}PZHM6OxxUv`?d
z9*zpfq<3p4Pb^1BbOHZuh`M?zG7*;2k6%6H6D9W1B=%9-DQB#+m6Y%4!R(4ryf(2<
z0`$}m-VZv`Um)tV|01ucV+MT?zKUhv{cAJ}dwB-#udWusz#V&d1PU|*cbyoNSK6~P
z#`spq>Z7l_`=EPAshruh(+^jleBIse>7{KzF7B=U_F==xNBIAS#Yml`Of|pn2xgDl
z-ckAfeKEA}ei**B25BRq`pdQZc^?G6?3>9jbnii>b@WG#`$jr-448sr)VGUIAgPUo
zoS08Dg_Xd$KoK<pf#&GEL5})A+lIRCehqEU1=({Zq)_?)zK)5@_%yzchf#HMOAl#t
zVPIsW9|jvSz!I<wvopL=$s6HC5s*SB$ll;_=Gqp3#$<>((c_nzh6XKIH*rPBoFU_<
zD7(MC1Yjt^(l7+D2amSHpzNig&Q);B(%Z}P#dOb9-1;cq^5R`Q0%wJ4PbohzF4j!B
zWLTbi277|<X-$*a87>nr<4T8Qstx@2-QOr6nyq0-EatkqZ#s7XLsA0k!FsTc_sPt;
zms)E$*JWO9`!P9npC!nj?cfH^bywT-2Vb3pc{$7suTD5&tpLQ){5}%8`JY`rD6ccB
zZ77Ii!kzZR-iaaaZ6{_86?W}%dw8e6gpI>wrFB&Cgnsy)S;fa`k;e3N=U#t)@H-??
zYqabS3JU53U$xAK@u0;Qj4dPR(PRWBj&kQ+_Y%y$j;CV25t9Ohu|!Ff*Yx4jr*cdf
zQO9&_6x$n+^M@(S;$6kpZ001?`*}?S^9!Tq3@7G+Yzhf&gLmp4kT@*Ih(3ug`a~Fw
ze&mQK+CBuq1gnFRii)7X5(I{%B?Mu@QIq&=FtaRTLZe>X`yDcIy{7lZUa<>^@i5B&
zZ#Q}Dqu&u|g3+a97I#UY>A-3M-FjIPoC;*wYxoZEbmZAngABJ8SoB?>+FuLWu^wq?
zXl}v3X}F_^1Ju@AD2xdSJ9Nkd2OG@tJ$p6+z_m*iz3~HtKZ571sHD^lWEe~S_2mg5
z3eQkU*12^QI5VzUvqlR*$*tA^Jxr5*z$!%xl#rr-)sp~K6dBnpex0ZoVT4Dp#^4`?
z{>8hl60eE8_{VoRb1u}H`if+@gfdZkacciEyXPm}Elek8H~h%ZH2tHG{$0c)#qZJE
zkJd#~YZ@91vozE^j%CGoBwF}HF&%Q1L92>jEuu>#6<pWCpm!A2k&Uo?+_lg9CwFGJ
z7(pOSG)zE>Es+GF5!f&WRjl_k-nr7(2;$%^l!P!xGaYjR9h;D^l6?}&+Hec+JQfoa
z958kY@M?}tA7SKxitZ4ZjqC}^+bCDpkQJ^hI|uWh-2|+U04OnIR@=v1Zeci`prVpR
zqpV#8mJC!?w=Q?AEVyaq+FmJKdhdgCwz{%_IKHA9?$%Fh$K&Jgm)&Pg=RfoO77FVK
zITxMA5w&B-pko8)HF(Ooz7*J&R-#Ek<U@<A%BRd!h6bkg=%cRuyq}NzeOqBy^@(w?
z>%e%TjP4A_tp(h~_#H}4iw!YQ`M$$sAo90!0TE${N`w%ZSiJ~8YaZ^&>LjL=#}yK*
z6dLD*$#8r>2tB3U(jc)B_koU*`d?@E;M2<o<(iKqZ+B3UkBWc5SFlp>_=pWkUb~TY
zUm(OrAgyY_0+8Kh@)U^f9}IQx<&C)qSd`10lhh+2^*FOM$k69V3^w)HDDdanj|q2J
znW))-_Jut`@z#|D2M*i7Bjeb81g;U?8L)^D`wWK&Nlh)w@frvf;2fgZCcA|Lff##I
zSy{OnvcN6(>9`ark?AUgSqa$e6`=eKPruV<3K~ogc8v=g)0Tg9<aL3{3X#9y!Ky|C
z{9KUT$0LxVDJo(UZYBSdPi1TPO!@aVcb_}IkEuYO#A{Tn2WUVEEyq5$oM;C+i&!GG
z{UwW-2^H`iv)Tl}a>626k|PTe#KeaD>2Ky_o3>UFs48%n!sU7MCo_^)TOoT9mlGAq
z!TpIt5^R`OAyowQ0g!@tJ4`@*W&l(B?m3;%{4-1z#Z^N6zH9S>mw1>j-3&cXYR`8>
z+XGE9vVc5aV}M-591eo+kEu@Y`@1@c77kF8cZ3lHI8pEdHa~UU5VIXFBP_iS74pFX
z@4;NbKm{8`#dUy8Osor_NqC0I#o5;f{HTfyw5#b<>ZGd7p3W%KB|O;45TI^i=TRun
ze9UHE2@PF>*9B<tCUyfsP)>tZX7XnXEcJ+=XtV&5Q7KD?u*%n8Zk`g3qYRvL7*(l&
zmPTN3u<^_S;baFK+z2*{2jK9@#l^My6iaPPa;7luP5q^oC=od@2oFk%9VRuAzOcB7
z24RfB@`?DBwLqbu4=C=Qx}z|TH=v&HU|s!KVl!a;QtxftXrK*gbO~o@c2>zYC)Q{v
z1)VB4MIQm%4m0y=F}hX;C{o=J0r%?V?1O)?AGmfGFouKgbOM#6MKfX)z-lo0fM}(;
zt+?LAY;e9)&j`uOX0o?9AG&&a?qW3YW`N(N7?4auPtW7g3$7UuTI{If9bdtUheS&)
zCNGAH$YVELX>$)*O>X%Hz&M6qNf%TYN6`)2hRBOUnhEn)X^DvKV>dI>K}d-ZlF2yN
z5!x3J#kAcC>yBu{vir~~gtU#k$9Y6BAu*>eSXiG0ZMyUWI#pj~s|d;@Hp3|lCJGkP
zWgu1)<O>!iyYWxKO%CCE_;|?Q0_BZk4kbEh#B{+zm)D-0Qb<)*sO#outF>9T|Dsih
z##9w}G=zTJux?!^POyyGMMxQHF#(S3EgCJBnLXH$8xXq5Zo$f=#3W%BkuXc^sy>XO
z3B3<lKtu%9`Sa&t0ohh?NaqsLze$6mk6&&4@9E2%tHmlCw4}mz*6shkLn(;Cg`1bR
ztiPF8Xy27O9+|n`hkxD7`qon4YtWC>yoTkN&g9qP3#nG1Xy<`6;ERW+C4FpX(O&%=
zn@fXE0D#Mo$B06)@W!%*p}oCbgLD<(D*C+_#+E=jeoa}0$!-d0zLJr_?Nc7jr3u+n
z^3;DPcAmSRjE0zpKS~qco~*>HGBA<xC()OtPH&1OF81$~Z*mLwv7y44qeOccjiqP+
zl3=8s%Md|w{m^*>5zHlm9(1SA{X7;aVa|YEx0wvF2@VeE&sHEnTCO9*Vj;jo8U_YW
zAlw(wJAuuk4}H)M2{U85ppO|lt2yVuw}(M_IZ~jpsFg(kn4`BN4xQh&ip6dE@xRP^
z;%?BLvk493{8|7}p{CBv79m0?1zZ?yU-*rjT_|3y4Mk#SUy3y(qYpqvM&PX&!+P`y
z(9nx$Ad}q!-Siu4$P5Plsc;fzGm--z-Oz`ZY)FPfEz~$`U_QHu{eN`X*UX46DC94q
zx{18-zpqA;pS+^IE5IB2_X}@yIpWg_swRA{&*kkP3-0(k*10s2_T8`PXAHtjOHK43
zitpo{-2wg1r25fqbRUhd&hTJD{c4Bmljw-s!Vi1UOLz-24I+Tp4%V#)yFYZ3{nSVY
z2O;YMY7XY;7BpC^xp@3BN(U^yIs?;!e-(<sl3h5-x6f5em`aG)ZQ0<GO&fFf9Q`q(
z7;;QAryttimkY+rHoP!|0d7#t(fWhdGvY|nl)B12h5ymle}H4%{%_#8v`|Kgl9fmj
zku9spjHF?O5~Yk}B{Is6imXB@B(is8MX4l&$Ot7R$p|Hc-+A5Y`F#J!@&EnO@jOSj
z`@Y}r_cdPEYn<o#5_fFKdP7;qZJxfTnM<s42J<J4cxwd|<Bkzn%q6DkzFQT`SFu79
ze6QevTT?Wt$l<R7JbDi@-3PFrJs{F-_~<O>tD7RB2n?1`5g;Xs0{0-$L=?V%jrNAZ
z@`i*FZBPsgwVC@1_l)ljJRR?^C%%nr_O{nzjoo=d<AMDF<FKB_X}*!FRGt{ceP{Me
z8Vz(*c*=QrdO8euN*0#(v2p}hmZWdl^)1MlpM#C<;Y^G0tBG|iEXirK+j9f=H*5)-
zq<_VnTx8F*4=2zmwULuOlSZ$YRqwjQBNc9GX-RZGXz1yWl**kYwKn)8Np~Z@+x`u@
z)EH_V5u3^DInF%CfdJ|y+?sQvJqmGCr0fLquR^1D|G;llwi1;6>8OZ{g&L57yU3O;
z%fX-7ixCL}0tGPGu65TOqCmQP9j{QT@$Q_T@%FJuAH{uciEp{?4qicl9}r~JG~)8V
zUAyE)(sX)sTEo<9wbsWvNRwySl46ge9yP%3s*fmIg7f;hEzARCwAJWN?`{vvPiPZ|
zIb8s5QB~}@!c#K##%h~xWalSw1%lN@8{@wDxmjyhRo1_O>>EG)`i73-mA`|uSK}<I
z1mFvvobZBA@&le>sU+V~kVHsSk?`hSQQ%r+UF@v2geQ>Di5K7vZ49zmtP!>D8V%()
z$vN0^)_m%U^LN=B*V(08M;VV?VC(RUx@DSRFC#J&;BbGh2E~p<Zu2EI*HHzKD1d+n
zx^g9#hQKQbD-3~BAgMOM(`-jywHg<6H6lR^q5Z(0xFu~Lzb?GK#*Au{ygY|8jpncD
zqc6al#IH!j6~~w#j61J_f~org_6nv}6|kaj@3KQlx9}Tb8Etg(lqKB|qG-dx=H{VB
zw^Ai9z~!?s|EY|9s_A-Hnx{QrHcxz+dZ<y>@bvpnfkJJ=S|hUnOBa$CiKHQf6**Fi
za?pMW<3i$Kz*?#|^XUR0k3WPofPvn5;u#IW6#!zrk_wZ~PQp^0I5`)m&O+7d9tu3?
zRmKSv21GGJ6@YD8jy(Zn{dM9f;GgY}?70zG2BR0*8bsjFU~nBE*F{Qc1l0okLon(>
z^1s?G#wI2#G<Nh&y|LoNW62|jYxD28vM|+t`K;gm;2V$PPfx$!WseVfxcv~*T@CTJ
zh_}ddEzP)1vKQC!Y*~1=7uPwTq6=mqkqL4a0b+l&Y=QxbN4)<1@Jyb-8AE8FU%Vf2
z#r@BnV2r4Mc2YA7hCy(5*y{Ejj~dv+E8$}J`T1?yx>em>iI;aNd2p1>bHKzVkp;A^
zZuTfqG|}_?Eejt#tR-Q?kRcLHS|L0o=sj=&zDkJ49bh^VfUzh3jgOBHBDIz5j9ZH+
zMW4Jq%tfuWA#5A+`Pg&<c1azxkz|X#l$%>C<F-@f=lr4Nb<E0(3B03C(pN>2mB+Ct
z^x*Q}(&i_g3%UVT1HyM|O?cxSIV)FhQhy$ME#CM6P9>9ayHI7kxYhmyWk+lS;b@D2
zR)8CRfGwSXe1ufx5I!9)%oq1xQt&8=_L2hn;enB9B}(ssfX$l&z=EYsnsveW^*@N;
zxRjELTMEOl+UA|0lT;USQX3{eYWXo3>+#XgoZIrHCQC1)H*zTW>eanS8W0x~{Z@c}
zSqC?g;d9pKCZtK+9f@Uh)Y#wqk{#0ajt9{9!2_gP)QiPQw1tV1Vfokn%ktEzPWswo
z=xUvyJWjGAh=tylUwo&AUb`E1p784qGr@5Z(7)NMv9oZ}XeMJoBlCxmS1~VNAb6-T
zR`I!RbLcouM3qQOiTgwBv~gh>hYR<ra~hTE$MI7_w^yd(mH(wPQ++-M+xOGgQi);*
z5OfZyyCUIsztV2#a~qn-<rMG7NtT@434h=P%Ev-Iqb(`AxIHxQ^AF^5r{Ry#bYFn4
zMo6*1-Z8PWhhQro6?#;0?jtpL1Sc75QEgbvvnA3+uT_8YnZ6cGJvF3=et-<VSw?09
zDy6$MG=l1vYTCe}`J;Y)blu5imjKJLeP6r=<ZO}_0vkf8=h$QCZTK}ofq;I#5g{UY
z8DeO=yBaMw%D@o+jbTgvg`kxH;`FjiWC`^SYIV*nrUw{?Xt$W(iH#ZwYSWQHFS(y7
zM<WNe2@1Z-^uCEh?1mGGIP|U`+0dKAP>YG#i%irH^mHb@WvPTz#Hg-vD{&!#_5u#=
zIk1~x8Hg4hp&f>m7IcDh2u1R33|#U-@Cr7d7rDS;3c~~)*sma6K@{xBNlWY-Nc&V&
zh@*Vfx!jgDDok;ZQx`q@SO~)hGMe9cjD-8+Nh&_lqU54SG<O?M2kP%gt-XM0^Z}{y
z1Kc2WXz+}q&|%j_@*AkYlg=VU06>Uq7xfdg97jlj`%Qkg>-_g1Xy`4W0&GzaS(38J
z=6y2GUzysnkA?mXbf_*tNsT0g;MKgq23*6;ycD1eI6Y7AJW@GNasO0p)%6@-mPtQ1
zr3{!kS=!%HMJvoX!<P^bKJ`EXHFUhG+5`Fle9^wMi-mCAFwulFg?8pOeUC8}d(o1U
zB!CbP8l^?j7qf;h`G7ek3^=kQ0G#T}eAJ_?r4>Bs<>4U@6u?#B2GRbO5hx8c_~C5f
zt7tu=6FKU-Kjr_yR4LP7ndrHDgMb3465uk^W&?<%$f6;F6T`#wc#s0{E`e){?j-OO
zx<b@|z)vKA>LvXF{oug%;ha7=3&h7g<Q}OmA#1srkMCKZ9G22m91E2+m1b`L`7iqQ
zQT*Bux0TRo2>f$gf*pl~S>tzZMp9XvcZvkhs<P4HiZ&vADGwfKjm8}VbRhb$M3a!Z
zY6&30W0<8x6zR!LK(%cN)xRL2KWjyrS@~n<wB1N;5QtpJ&|Y=*eLN-b6G=AbqIVe`
zfwQ4Z`^BGMTkm@EK$y_hNqSsA!15$X;vR%6@hbN%L#><DwTX&oG^N4JYJNGNT`?nw
z+>3=1z<&0;00E+j(z3A9*5_Em$QIO~YcQPss+9-3$}YF}*bpib?0EM~SL-u*q=I*x
zkQ3e}Im~+guEvXa=D}izLv!;7{BN4@XE>u~t<rn0@+<rEH7a>xlvMXn+1LE%H}qBV
zc!?rL+0VA4QrS>WWhS5qO#HTTR<sv_R4c*Ep{Y-#nTP-%BfHdU5aIJKcmpvCq-Fku
zlD-ORN44d_ZV9xdy8j<(-{w!p4JfYB)RhWz`N1aX$skfpGDZyNau;_J(W5+$W9>lV
zURq-10OXTA|GoV(GEOUWVkPzf`H3v{jzUgJ>vc#@+fv)_;gJRYliV%hAqO-9ejO*x
zI6puCIO81sAGrj+I}sUeZr;X{1`4;vYW%dd=lPe{2g)hFo-g@$<<?`d<v*@SSSV<Q
z`kHP*|2cM5<VcH~lkC5)p(F`V^bvlHyNc>j77M#*Ylb!b13=tF%i3^)j3Esy{rr}N
zoQDnaW2$~2=&}bemCUg2yp#LL4h2>1me|SQf)t}{QNH!LcQ)>F+qu*tnlGvLz>6<7
znfxluqEb?9NZzLQc&8mN>H3=rz+MgFF=8V%qq~JHo^8Ly@)~1xxr)yZ$99@FEjy^8
z@1DI`r`?59{?7F=+1mZ=*}U{IaaVm)T8=CzzzpGgR_9O>o5ee30tQ~b^pzG)_$4J-
za?`EF%5=SFo0H|<yY;VLDXXciAebQ>UWKJe8yArua01So#f9Ggl-ZcY(&3T$^Vh(;
zoS&|-xvXUUlA734w<c+MT{VufGi<2N*OJPZi`k@6W5gQIwlZ5e0RbBLJBLc;(#%O=
z0;{nk(yh*q`+Q2mY=8P$>0>r?mD@B8E4R|eJbEk5Eok8AZ@J}^8yhLX>=Ntypi@VR
z34{6ZTX|<}p(6<1Cjl;}ce5PHrLEOEvd{VLn#|aAV}6fM4`}P8dv_1e`iu8I9T+(=
z`$Nuu=6fA;_KBKkc8z@oy?*kh_;T5m23kVM^0u${^c9P_Dtn<t?B7AxR)L~W?cTeR
zVt9DvD<^MFyX;N>l2$-_Y+s50v{KKL5R0{|PTo5ev+b2+=XK3z)pyTslKmO|?NtB6
zW(y4|N{R64!AW|-Y?%uat10JzF{($OF=@qyq{JN3-oR;GC``ZLR(bl1jsBNmTg#q?
z^L2&s+%Z9ta?OXO`E(;WS~H^rC7y<9_ujKl<z?uRUrI`3p85)KfFM*Y<VxIvrnC~l
zlhwVpnoc3+u`d19rW_^b8Z+OSlt!p!6!gR8{Pm``WZ8|18{21AoYdtg+vfXU?l^8c
z@`Ji?1W%B%r%6D}`q*<>W-<Le)r_<cjWjgs9fu?rW;MgVJ?KBv?4%LRJfoI{!j*!<
z*n`!J^*~!vJ0rIfN@6IJXXjP*`hLFN%x;-9wrujM`l~XeOg2$z?%i{^?E2Tj!Jsbt
z@R8AgIeu-E_yDe!5U;bxP#EPiYdqY2OJ374Cg*QKuwsua>q`4qPr`&kMVc|=?kFYy
z{?ClWjZIvRW6%+CKCxDLE5EEq<<Hb~!!f57YY*nrmA%8A2bslPZ%g7(ViEp2>m_^P
zkc-7Q-(Ztp6s7!Yf8ctudhZ+F|4N67`(#=1_5TG{B7%Z+$a^}aB0Kyv_FVtB!+{TO
zI>@oJJ<4xtX^41^=XhCsXLwwpvG~rlD|L2L?UPrvqbnNqyb~*Q^vHv_OPEt^2I9!v
z$*=70dxu#rI5r+9Yd6xO$x2~mt4dzJSR(CIu=5|wb6r2=s2m{*X_>X=(MA`Rz{c*v
z;?S5!`N_$0cQbWvnl0Gc?c&eWh{%e#Nk6O8JheJV^Tuk0(V;eX@mF)RX3;`MK7ccS
z1SQoMbqEsAk&+->X(>D8(?MK-i;(?z&o>Of?axOx^R*z^FiAh{>D&I|kg}L(G_p>~
zjqYL;<B{kV;|hWV>LDD~fLaGgd@OKgj$K`7f8mr4rtI~C_)EJNqaVI2O$m>DtUe~z
zw5zXo%dS=4wP8K8wx*9K-P839etcRIQDfC;RwBaY{J?kXEjQGbeYzNO7m$T#+PD!q
zK*8%pt|OF7B+&*1JWH}ws16+7`H@lS4-;6=Pmp}4Kly*Me3SH_J$&2Mfq8NiK{QMj
z#iWrgDQT>GW3~qF)0YE)Ipco2w>D2mD&!lho2VwXRz$y+*A<zt{wNZ2FwVcyvb{`c
z6ThmMi};m?MyzV_cYnoeyVltwhb9M*F8bgdJScRN7Q}tsRKwiOV7=tn_bS%t$WS6*
zpd5P+@Ml<R=vxyf6I=4-5IdjuTjR?q{i~(^4I^Ef#mNB6DD4Y9D_+c+W}KXh{P9|8
zYItLcKkb68O|^)wRyA8(%AKNNjx+P2(!qa9!TPs?Dh^_pcjj@3caRUx$q`k#1p)57
zZ~PfR4ylNF`c{|=^=_JmCBRgXXMbKrsip2zLUx+d8txgMd{2Is?A-lkvo%3iyE-=H
z3belRTQF^~u*>3QP2N?u-|Gm=g!R~W8`b%4RB8hdV4%PJ_Z%H)3KRbfq@8}7YGm})
zV5996kxq7pa1<mJ2EohD`Uo**kZR;fTRhUlZ((lK`v?5=eRjwVq2t)$N-xjBawG{M
zo<IvgG4U8l-i%Z}kc_)o<0=9PG_>tfa9;;`Bei6$D1sAiMK+`=s+mN@lk_tIWfgnI
z)iaUs*zvz9uEG=x9HB|fIXx%fQ=L{5v^V9deO2Sa#-UesF)|lx#x*|$EafklQDW{s
z?!o|b@_uedS7xxv?YjKl<y5TgZfR$9h1K|22c?gdI4<w$=>aC*VLD%R=SQS465t^L
zR*Q~LglmIZ44u8bJwbbeup_O_&kUs|KavfAq}E+U&UAz9fLcps)G~|<PNN7-fSRBN
zu_IRiDgXiTBXYN}s3wegEFP@&V5IF*k^gPjEuc_(f^lXAX0oa(POr)51vP>{nDSNL
zfzLcC2f`82kDu1xKBjD;XeBanUds5|<6!-ytj-M%%GRtE9kFMA7(XAj&1jE3<FvoG
zWBXK-_1hzU`?bT(_LbfE?Cib&Pn6!*-g1i<3@Elj>`7JUH#|T1($}PWa!yY{+X@UA
z#QK`q9Y-6OSy+}+_)N!tOye~yIb_B=Z=J)W4eMV%Tn9sO`As#|b;>F~H+Jf9!G~Nb
z$_j6-?&WddW>Cp{-@0~H$QqpsI8XPpnKiz&98~;sE9H+jW&e8}Qgp3XR5Iq|37a~T
zT&~RgtH9C5IKlf-2gmHsp_EkGxT%h^`I#ZsVO%!=8NrW;H>YFActhoVpkBozF5dE`
z6eXq=aQZ<u>aO<dbsM;|d5--CZf%3fw(@07T$9&Kh#Bki0wnCg^3dg9^G|(+NjR~Z
zRQNagZ!)P0;+L2D_4rW0RL5iQ#@2k-WlvVDzuMk;i9KL|%ltV1=#6F5XKXWuR2g1(
zqB}P_;vp^h)-M}(1m*<B1W^btO2mjbifq!__-~^;!9xmPB=6pi<exr97qxCyetD=!
z>BQ#fpW4(PP;p}w=6KKh&^Ch)+m?Gut;ZxsZ&(FDzBG^Q|2bH?Z=D;UZD2X^^5|Fd
zC$HC)+KoH@dgZzLR*cUQ@k2t<e=OfO6wP)l*}08kw|2Fr+}vs=JULnc$nv6wG@Y#+
zNL-Mrphty5FpoA)o1fsYi5?mh9+ImWQT;)5y9_K*&R8fS1PTYM$~5Ddgtadqn-wcz
zp80zBOL|Y<^<-5Ra|iUBe9bR;1KaY<5GU<5>nmBurOd68U6}Wmjoj{#T&?@$#;U3N
zvtd&jm(@Pf(!|C1u;|a4RF7|PX@9-0Znn7BFDGW(X^H;cp{d(vy-N=4(JDJT>(^+c
zfC4Kt48r5TcN~I{o}hk45Ms5>!ou|@nay%f_+O)qi@I^+GPpk{UPW#rLO6^39u?*a
zkLf&}xIdOs9~0+Go04eL%a`pG`QN;w!nx&t^DeYleKa-=IK%J**&Aen98wVn4p#d~
zf6q6K{`5NHRjB@b^S*HjTRE>6BYI1ygsyYkDyW`cIAis`;d#*~S5XJIjf$^Yo<~jm
z_UiP`e^c3O8;0D`Ge}x|FPf&1BzHq>=l(m6m~%Z+r>?PyKd<&9t%AWtL%qE-u^YiX
zsm_5&6v%HY7DKY52w6IZhv4&zp8swbD_S54@X<?hery_1M<LvJ-0+g3O#sf|EzkE(
z@W_f7%fIb8qI2}5x6yTlni9i5JUo)CnrvFuluJE*V0~iGvy!p<jx*mPH+TCY@I?;W
zz|3vALALP@Mq>z};b3Jz3GF+&6(3{v>c62*?f`MfU?DO-`}UoG%`XokAnZC)MIocR
zyyxXXiy+K4c4jFNUa=T$1l*`Lp`4%hyR5{$4?=qn+?e%GtWdUDDkDC5?N0&_5kWSh
zd|k?S>$%C&{>r$GZ^%45agBEIivqsDFKrg?V%4V}9Iw)4V~wI8zTqav9@y9`oWmJ*
zk-zujgzF8%OFOw0UDvPjYIyeS^O>(ZyB#EJ;#(quof**pAas$JuujB`180;PO8Q7`
zEQ7-UCKkN0kj8fLk6`HGu~F(LR6OX!sbIP5<(^Po#f)Of6POS%8R7w>K=WBDh>)nj
zsFB($GPi@Vh|s~PLa6u@1wV7Kn6Su5KOn5|eOB>qD*y(84Im|VF3@vAQeurI&9|&D
zFwTtB?fp&JChIr>t2@(bv1G>9j98mQU054H8YNXdJjzsr!J3=kza4!xuiYu!0FyQ`
zHw>roN5^Al_-uQIg3?b%4&-AvTz;249T+wC&`shgS<VCBF5i$f5+fC(U+0(jt}{Ee
z9caAf=8*Fugx3gZh(1yYM_f%%6qrxa^zj9@v|VSH_(uq8p|DL&q+$TVS!6bPO@Ce=
zryxQEli2OcE@M5CA%)3Og-4j|!*GgI$%}&s?7(5fS!Vvjl&F)UAV!7rok$FlG&Bsf
zNJyhiD`Li4<L%VIc#_HI5GbeCP3KxgECmL@8(F2tbhXn7ZF<YHzD_w^pNjIU*RHxT
z;hJk+Nz2RnK#M=_5nW<={y03c`ghvmXRVH|ixM6BthvCY@BQo5oQW?(qcAIZv-*zr
z^;2g)Cy4ti6__z}qX8)@vo6J<YWCsV`RZhsCVXCUoA)bw2`QF6bJ-An$5%0K6*-j(
zuIXsB85cgQPF%^X=+!gbx9Zeq;jweizCE;fdaf>iM$F!dcQIBl+K^i={%d^4(%6FP
z=@Trc=DhYF<+qinWeNYxVREMYV1)uXQ+TiVN}tqokBj9}V7=FfgPQk>qKyeTSE5(#
zDfZ#gZnqRm=z4K|s!Zl!PfAo<K<tH2y`DmDjm<}YPgF*&XSTOA+UOdetO74{$5e`d
z)epUIKw612xeHLA4#3tI4JSe2WIqm7TwtRnB?3c4tl#dZ`zPx1m#3!U<?%OaSu0(d
z$KP)aabt{YEW2~9Eot7gsKx#5k&u+Ar6(NIrS==2oqpE!=W)KZqWqGr^L>Z3$^j|G
zWi~!(A_c{@EA8Vi$IIgq%~sd8%w#wKO<HIu+{E&_lK1}{MMre-Jm#OO;&v!;7AP9P
zxr$l7qqcT72A=-$s>bNRF7JHdmd{?c@`k^~e+&Gi_-tH)pW}!zxXQ=S6S)U&xjQjr
zs9#4TDN+NU?Q0>EpX8U`j~Q<z%t0y>X?y(3FUR}>HS2u%nW;wukNCEZ9=uof=fa1g
zy55DF$BB0;)gRhdyT@G)1LoB8sRqJ*wySy6y4%P;BNO29+T!F>KTD^X(2x)nZSAWn
zun_y1iJ28W-BzfqkXxWgx9QXQqDel-zC4MmhLOR`m8>?Ot*jkM`1y-Yb=`gV#}ChH
z$McnF8`_IAIjUeiZ_q?Myi_I6hOB0_wTnS!cI(;+m0FeIki^J>qhDuk4Eb*!=VJUI
z`0M&M0S!|nEoH6Pomx{vs)+JHZeV4Z39$IeJ`={}sS=u6sG~DV_Qr&-Vmc!wEG9VA
z4vjj|pC_vMBWMQ}YWLRNxUwVW1RSO0-p5$>SI)<)#nxheNpR==XyeI?{KvekWyRLu
zy@$Ia<#lkK@<x=1=lv@ZbQkkt+s7tHuy~|ICXGCU6^CRui1DE)C-)X^l;lZr9l6ln
zy-7R`?4PQSIfgQBV2TJ1_*fG7x>9}{?a~tmMNjAn!s<M|bZgz@)v_I&?)F&)#bfIS
z8mVn1_?F0p<}>-N(KfuoMpMrCfozEK5NwF!8aw1k!J<d??oW>UVc)l1Wa;)?ce%9S
zLke8Lr0L?z)wl1u{#=MZy{q)TRa2w%VQF67D3bwf-C{AVWRHtv-?}p)tiRVLCCPhH
zX!l(>Z6vZUUIbFGGi1i*)LK^OxGj%Mnl@Zw5HDk_^zr@qKl?A+sS7{Odc4LhZ;~VY
zr`fVMTqIiHdR7&e2W!;$l8pG0nG9ffC3jHbFZ!6VYjOO4>>cO*H)FwF&Nmn-Eptsa
zzc6AJ1Ix>L`a`ykPIbNW&ucFuwiswcJFTdGxl{)0PK6Qc4sfq-Vp!5wl01u!hLm#Q
zUV}Fj7wg&9Q;9BqHvXI6Ka{e_>T_JXeM_2f32I-y+j;e0Ns~48br055NORZQtKTV3
zGi4owERu{KM2jx;;2?t%Y(oO@HHUYSz2TYC+|=%`yk_KJO9HKo2fvET(!@!&@cIo8
zY3{N8y{UR}(L_qjkfHeZDMRUN8?@+|rDC)Vi#kg1>9?JxXVT&rw}jGemtAW9YzYS(
z(S(%_V_(=dG~vWTu)&?!xN&_TPe*F&+RUAS{x}kW$d-8v^weQVawCi<vbUdl!YypY
zLnExY1Lyv^lh3rK|Bba+YPn8*(4ys^`8#bShiy&o%3&>%(k!m?l_kbIfyOn}z;dma
z{X={C$UpqHZ`o+J5JOQQ2t!fTqW|IH5;C+${^g7^%*i8YXqEUYHodbH|L{nuGT{C?
zR-ZSq$Xz8NaH1uTafGCtR@aV$R?ujD1oo2G-!jQy-|Nudzb^zDKX!h|uic*En<Abw
z6zcpaSanmuc7@oS&V5W#J}|d$(kMw71eWoAi&J9y-`0$&6BTy&B|r_(H})ApVhFe_
zriU`0B!T)yf%dmK9oINdMR){`haW{>T;W63N^+LWg+m~=xg<0mv?iNSgD2)9i*N$%
zA#1HHCvu>;8B<ohfMiWooES{QH7;^q9X#|m;YN3QG#8ivNn}sIUs0v1$EC?T$&wEJ
zzwgAsaQ@P?8u%9G@Lbj<r()q)($+dQ5N1D!7g432zWt0UdAm?FkW|GMkmBixNZaz*
zXIf1!GS<-*%lq8t+Ng1I0pTF*<OA+;8x=@olDr(_5cqd#a_wBWtGAf@5zu0Rj)j&q
zPsi1*>zCXou#i#@U{iE|5gUI-1rI>U;GXyS!%&zau%-X{w>GW%-4|x48m@LOoDz7|
zvasSBox-nUZ|B*Q1m-z6uEe5iN#F7%u+#g}y3drA1<p@N>YRN*qRfSem8eQLSuCgy
zSMChP5?zTRUzIY`a%OIBUA?qdroIW7<@r0?{m6F*^JsAuQ|rp5&Pl83;YQYQb2ox^
zmr}(>qfE1H<7%RKVsbz1we=N0Cf9qvC@KQf@Y=w$;o0l87$kgo3%m!-w$-;ydHgO=
zBa=yy7;qHjWA0l5`gqk6Xt*#RC)(j;oq@;ptXN=Y@d+Z_v6UDvP?G&#l5rEbSI*z@
zXTaE_=*%+39wz>D#V!fzu7(WPhxTV49m@IkfkUWA(zLBYxJQyRoe>!Q;lnDEy6JOb
zbby4hLiOSTwO01x)jf~|a9JNNeb+2-)a%&Qr#Bft9B$S$a``>J#N(pnjg~#K!{_N(
zhi?aa{*bdA?Rt1WqMf~xGvvIE%eElvTyNvyn>P-eAS)C1ScRwKAt|DvhsJ#+Hr~fS
zC%6SKdst@dd0KIYiJac?g$h~GRTo7BnI~U&PP{vxp(ye0;cQCl{F%aIYRZc|IAwWS
zVCN~Lrbt|$c)C3t#l>t&9LFA9(3t<&F2+&(`{?Dlqh&Ua`#j~MoY#i9>NtJFH!R+Y
z;|d>DDvUVjfqqPVUW;C$T*KKXvAs71xE@r<<t^)KWcBdIs6EhXpS_@R>(CSirp3DQ
zsvle!4(PE2dAuR2FLNM@xu-_I410|q6N$(TCb<U{d7iz5HM$1Y8qdfJ;%z)+LY@pi
zj!hp{Ll0*iy+Y;_2u1X5q>vd^^1e~Nn#Kww=KH5H(a_bop_~_=wndCj96vS`o}zNl
zTFN%Xw~kv-C|GSz#k2z~$<J_g2McBT>Ey}u3#`P&{(h_9+Ql1|UjphO%}zxM^H!De
zvHt3WXCJh5qsD1@?&tjX-R4NQ)1A)VwjrDiKdS=6d5jpzXx&ex?0s^1%Km~!SpNS$
zvzr$m_#;uvNCAV6>EPi=3O&w`X*wtVz*={~WmSuVCKHK#j>?+d$}~;e!K$TkP@<fY
z0hX<pbT2mAEmnjqiI3eQQX8{y6Mr5M{;~THYlc#h_7BmYPjgSooO5uZ%yz7xx&4o<
z!TsGznZL+N-V7kZ<N**BmFYr&x%@lbiwowquHxm^!1b7KeeT%6Rkd4JeeeCI;*>kp
z$Dle}G>~og``4I!%E(=P%5AJ^*bP0@rZ+8g^5_YWWzMyIND$D|qWq!UFH<!#9&VN2
z_k0`sJZI>6VafU1vrP{xl6&{pB$^(|9q5y)@##stbLfV{i;|RD<6(T`$-VvYmqi<M
z4C|V%uIkEH=*lne=~P!&PiGA;bk}W<AMS`BzSe9;SL>b;T|8&Yft|aS+ny%k$X&aQ
z;Ic|Zc*(K!a>WPM$feYFKB_5wU|#=mddEry%2RL7GWYs=N?6@jv&iZq{+1URSj5G)
zjne+TP*)s<$zQTM0+aHZu{$HG_mINkTNUtD$2~(+e&hx^dIW|E+mPz@K5Y)R%cVP&
z{PUxe*w+93)<Pxs$yDo4{Fyz>i?1XVtZ(B!4u;`Xb(7n9{-^prIdMNW+ODWbd7O@(
z1H+t!5zLvrf8SpIX#II59h#l%v;r+N<(FHMTP?a-TD~!2m2u@(+s0q`>uyiX=gQ*@
zweB*EcaWk*j|Is!TB9KE3WUn?4Si0Pro5*7R#~7N&yy%mOe}dx23vrK>k?O^%2vt?
zd+C==3GPy7a6CL$_Wm@*4wzjD4Yi{5V4&gQ<M!)8!F$unp-}H@%jFcGzhJMnY<X|T
zoO^Cyt4y5p>*V=6S~7m*H+b>naIX(1x5d*R$(KSB4pI!mBm=HTxzcpfY}lXA@dCE8
z6U_4(@&Si5x1MahyzgR;r7K^<F}cCRy$xIDE^jI2b@<SHwqy2}df!f4#quS`My@-~
z^ekGaH6Pr*E<Q$o=$i?%8qNW!4=K#)Cm9d68JF2?968lp`^esPBrfN|JBgavUoBVc
zb0^;GF7J_Bod3m-URVLVySqui^jwqS_u?GQAG?3nSIHK8eDbL9EcN&#4=a20N5!yA
zC2j9Q#r-E27cK1KXPFvzzvGcT@5)znw>R~|J>wiFu^q|%-dU5$k@<!>a~3tTMRV`f
zo{hwseJF3SUMT1kDStZghIGKd{$)VY#UXpq0OUE1{hOlOD(l|wEfu9$G&wRmluI=b
zE0FP!7<c!;fdnFi3B$;t+<1|Nm>;(AJ1V2<<;Zd4<-~Q$jdh}bU-kvRmGbJqag9?N
zZHFm0ku>n{F7(zW43r12t|dQN2``d*$QMAf2QQzz_4j4UNrYE5=E+^zq!DYT_vX{T
zu@|_4v0t>5l=dL#AR>38L9^}CKdVc*JYF>a|9=CNVd$Gux5%CQ!(X$s^_7Z~!}N21
zG}&ytw(9qnC$<>Hi9h@v3$x+WqjxA~W{^{X`zKT_aZ^FzK|XP(Zw_018k?w<3|^VG
zr8MP}S6jEo?D?q*+I{DB4a)45?)+gbZCo(<-z1Q;m3-Lg>n>O)gNsTvUs~A5u*5oi
z-(KEVntS1$^Pi|cDTh2u!#vjRJFnjNB)L0pYB=<n#qZ(9pTDi`3tFc3FD~e-@&D}|
zO~3gm!7m?Pe5xbc;Wy4h+t^ai&8#E0eVpFSpL^(PmBm%#!+H1kNYRzNU-nhkb;nw`
zx0_U4q!_zogGrCK?3Cf>(b`<Rx<%G8Ea}_8XSK!atoT1mfhZLGpDC;=4+byYUH%(z
zH{`jttT74D3>tXy_bJJ|G578H`a|A%aVjGBo&#B)%rpKI9^$-TjA#u|Mug^vGeo9-
zP)&Ms?OJ@tt4)8sr~jW7idE)H)TqdpI52c5kAu?1<ChbL>=iWhccRG!Dvv5z*+q3|
zka2)O^ea(;x;8d;PIdN!;KFpHH=POBMR1dd{uWgI#-^s!AtpBl^_5QufLVuUAQb@Q
zuWaddcF?M-AxK0d`w8m-B)SVDB?Dv7g-h$qMw;Io9VD8)N4rbcqsIfuhK=-;hX7oo
zLX&W1ON0DBgE+th{TYeCeo~!;3i1o!69F??O}Z(dqICLQ)}5o3*_$R=!y_Uhe*FFv
zI?(k61R52B&j!1}FEEf7NH>yGL%NkDhymc<XT9A(qbJv5C875`I`-~0ps8;XRaZp{
z8Lb6L;`g`oY*93SaUOZkrc47NVw0lL9YN?;Vh$Ewv-e-wc2<J^0#1uV)^QoqAw_P-
z6IT2;mAGl)r?_b#kvq#EaxV&MAM|-2d0BaV73LE$%3B6FK0~jrj*co)s7+`~14+1}
zWv-Baj}$q^1$s&NWUL9#G?cehfcJXuWhze5U83&wn$4`g2wavgiiq=nCUiS0dRd4h
z3TP(}yXj$o{@Iu`zkVbgQA_b%Ips?&N=3zbkzfHBS!ZU5-ahzrEyF)q!wFmxi{Qn_
zSv<Lbe#QnUv)N9~t>IN8nl=EiuDmxFcKgN+^QoVJ&?8$5Rg=y#*FV1<-e#GyvrF0L
zxQT4vUYG36J#r5nPFU-*3zz-dS<htsOfIratf~d%TOAWZ*ppOGFoB@t>FY<UmNIbe
zx`*}E>`k<RxIHJ=pgrX>6rPBt8X?1wTxv)oCkmG&n+$L>r9TjWall>)iSjjqL_}KE
zkkWfwW(d)D0kXPz_T~;#!d)VAY-HsDqErP);ny)Pf<S~?4(k$82?<E85fSrd8-hCY
zV`?5hjVK%-Ktqp5l7-f-)es2(HZ}*&<wpQzn-!o5MrdT{vmvaQ50cTMuHIlFishfc
zkPN^*fZ7zWWa$cx%Y`WHv0iNOMgyRS3z(~?=x-8mFj*@BKySlJukspKe?PzDGn0d4
zr5%7)8X#(2bDTu5nu(g3Upr@d%Df)sttQ}rU*A>YCY50*nv<TrLdFFz9}E-ye`uFR
zZZ}}Swh-;{oHC8`94A^kq~9`uB%+i@it50z3YK#ND|UldowO~HnjPgF*6b;?0qObU
z@?~HPL1FL(-kDsvbjt@l`$gl@9~x!@`2#+0u)_??F6?9#F}vE4Z<Tbc(o5h-+PaF_
z5xIw%+j+nbc!i2C(E}Al8II(x0r7&+>T)We#Hk7Ti#)hU#c%4n-t)4AFipoI*v}pw
zNY75ni$vlZpiWBHcT@>T&j_k8^ymcfFA=+qAmlOhfj~x9H8wVW^cn$f6J2bU6N!I7
z<WW=w%us6>6?EI3?6Y%Iz2pWNMu&kNCk<{;fRdf(eiB?wVPip$3e9&nOG&XNsfPxj
zzYT_eDHXxHHkG>C6CF#dhTD5kBm)BT4Tw{RGYs|Us(=<1gVGWq4G)$oD=UwIThoW>
zR<pIuc<Sv6*)-Bq7F-Dw)rk?b09P7BtfDh=Xt+bBhY%StyreZ3QQv1$HuM`qQ6C*3
z*a@JJ7$DNho4{hB%6|m~PiiVsn8iR*rUts7W3^lFZUW2~yE%%BFGhtB<52AO1={2j
zke=13QG`WAfX^ds*SQQ8DAI!fontrbau(3Kx#Jo}Qg*J=LeKo4FX(N_So`ZRC}$y0
z`n5E6fXa?u#`oX7zNioS4FeUWgA!o7Mz4d8Rd}#r79om*cH&FH;zKXBH+{2EGrb??
z^y|A3^fzrg#0KXGCk6=i8em_BdwfAQfekYg+~EQvfr>a-l@j(nCf0|FY>iMYQJyim
ztLQmyI`2iHxDrDfXqT}~TVn+4701HKrZ4%8iur~IZOh-gqv;oH(ye+rA3VlKu>7Lu
z<<Jxe)Pv@y*Z#ajD~vL?2?Cc#i(VBP!fygQ{NPM4=SzCvTI15*VJ)cd-c2PYF8<>~
z)l!HfCZVvwYDXH)@GPV7n>U~Z1lV3SO-d6gp(rm?{g&p7%QZV|#~F@R8k+dN<`Znc
zQA8BdU-OdwpK0UsCZ>&3_)&$|+^)suVmau}LzU&<56LjYf)c>D(MAU_b*fDQ0x!?j
zd;;RT)m$T9$y*VyZU+pFN%6To&DhEJ-$cd4Tmc^jcLy;`HW}BE+lQt;k~$Muhr-<v
z>fD|%h#92EFP_7JLL|z8bSqU!LJ0uh=w)8?)FxJ&A7Ic9zxRIxv^C<<hYO`@=*|(0
zIA!C%g8}=}8#kqBhRZ&Vp6)dOWuHiHrOeuY0bm&tVJiufmGBT@BFR4qCme{+IB)eY
zIgf$HAsV!FkJ~&mOiJ=3_RXUkMjt^qOwYrFYfe=~h24&g1;Pl{!q%Z2;7jn(HJi4)
zqu7-Gg-5QVd-PgIxt}NvjnLVa<|I{9*-<;P(2B12dB*eRV9F0=NjFYri`81b&o^z>
z(d&|slyteJsa{o@_|S6G=b-CqYm%Y|PY<qBvokk4z0TgGr&8&bLM21pj#X6#)l)X7
z7TWU}fqa_(P(CnmJMg8{nf;DdB2Nq6MZ9lsrvbEt5L9>1Dm&Jle7Uf?c50;Cmx&rg
zzykLM0OjL&&{4VWi_xg}$S9;HZ%Le4JL#@~CZoT8shv7?D*a<q;=OxRbpF)PRIEY+
z4?nP+p4v+7^Q;A-%zuAMgmN=r$S1QqSg`?16>6iRqR`{u8No+83-L)yNE`=o5%^=#
zb#%+o<pW6n1N!>>b2@cl9MG4aDwp@1k+}3FOdb?Rsbf}pdN(rEXYNALlLo@PgPt&{
z{@K~tN4f#^6`B(`WMX1F^;<}(`m6IU^p)sRDEj3`JPjB`;5iDXW3Ql;9Q3uyZ4(b0
z)m1fKAj+uP8EVntNuNh{%NAArmT~R8($b6RR^e8!Z<&kpWgF&FZ@l*W<GZ#uZ!V2i
z%rXG6@2izujkR+&zv#h(6?ky4V0_?m5Gpib9zK^FE%U`A*Hw>zGI6HRq*#*J%D2{q
z^^M!natenld@(AHRkhJn9mWFiVF-BI7x{M?S=ofgk2hX&(cnT~A{B)qlz#DmcKJJS
zCTnVHN^vtXFhqOV=DP4tV-*7Efwm+E4ef?reFJ}r7}riO?4CgdJ6(;UKcdZ!4?typ
z<nVj!qyEJVxkCo^DqF!%-u&&%{jm2P<-xy{$I&Zf$u%|JJ1k~6dymMZr=|HsL>wwr
zafFtJyu7?6udk4}zn#D3zU)C95tg&0%Oo&F$ED&NAmzJZ^@{YEG8k0S`s91XdbOlA
zSFT*i>uEvpcf&O`%)vI9rG#`KQB)fbmO1CHI}B*opzm4E!oq?M5jC*u+w5%E!r|ZO
zrHi-0?5BNq3JMK<<X(w}dH`@eKUBE77KJ0@%r<L@RuF}eR~6}YmEeO9!!8)5)ppTV
z&&Y_@U->dllcm2G;`>3ptNX^k|29pgen@Ah@!QtcJ=yP$){AGQre3;x_wFPoy2|W=
zyx#V>J*GxR+lG#wwb#wVFIrt|98Ws!8ygWcmHc*%tdi7}HFh_hwQUR@^`PO0B4je*
z6zoPTG$Ocq2_V5e2?q#O1b{8oJ$sf=Q&Zp5Pw(QS90=%2M=)mC{WUnUnc!u>h?N>V
z^7>J;o*b&+;}8=2Erp9xSQpMxO}0{`9|oj;mCek!=;-JO>)2nJ$DjWw&iSpvjYaK+
zHaDG@2<CSPan6Dk%Hb6Xtw@?eV|w4JOQ31d!wNouCI0a38y#BA0CQuOX2%u|eP+fe
zEq{0gL=}{HQ3wTu_^eKyQhs=tn5ZWWcjSOLAa@A=>;wKqbqSvP=|bam>(}p_dklL=
zI(-oJ72xN1AfKU3(?2k<uW|IWMg{aM(cLfMu;5O&aZ4e1?tr3!Qy)9&W*A)xasuf)
zVw}n9G|-^x<yA5H9*myOl+UHIKnU6Pl(B&XM6dxM1syOjSb1;yRX5fLTy6M)3eh`E
z=}`2?3L8|v@++VpqP@xq2S^Cko_BH;n({1_mVUHQ+nUK1PTA5NEuVQxKI^2kn1iFJ
zZ{XJhL0;;mOL1?>J#QfYaX!%Uo~-lHFMMdQ$cs%Vcm8`0dpPLzM5`WcrAPx4>><$@
z?YvcjQ8#b$?%cTspry<D={3L?@|X^`$1e&E14*dadCDk20le%pUFdvg+pwzWGkm2N
z;EjiZPI6jeqhCP4W*8H?9#&zMybfD6Y$mh}+~jx3EL$A|A;d@2MIcWPy<n=_ckY;r
zZV<KWlsJ6kh~}*9#a}{@BPV@~>eJ_8WynH+Lx>51CtRoIwd8uBB^7Be<mlvd<JK)g
zzQF?L1r~I)d@BCCkUM~r@Wx<61E7O~EeL&+%_1U=)_48={eeEZyg$Xa>i81?O@09Q
z`pOzdvLD<*(w}c+WCW@sW#4`5hUsf}PsIF2B@X=xs}bxB4i4t!x0)uWe@S3Qc(&%J
zL}KYr!5%2ENJ>gF&WLge;{U}UEBY#4^{!tVUTbV{&7F7A*ettgeo(h6%$8k6jC}Nl
z#fI>QFOF*zW&ZEWe9D909wKcvlarJ2ZI25ZxPGbuCbsu&3k~%4+%F(@BcJVf5vD!K
zH2B@^EBWPKg=@#NH<Q=Vw@v&ECFZC6qv`2&o|2_nT3SR32hE9;(_1%VfUw@4z&w<G
zm#wR-TLVFnYihpmD*NDsGATR9O}7=9Ja)$V##R~I!~IGnv-F?A%tGbHO!Wmgg9sX-
z_JRfV#8Qmx2AF?{FF^JE>`i%lWo2qa(!?@KNJ;e}z!%+kEj2CeTlm0GDo8d7_wMa}
ze9Y98KB*}P4Oo<(ByGOFI7p6HPnY@u_eJ{l^?1$N;efB@>O!MIKPIe5)A9H4>Yx%b
z8t&=(0BF_*!I6Lsf7kufu=fmz;AEi5lS!Rd6UL*0E_O{H=cJ{i5@DHJU%)PnwH>v0
zxzM{nls<;f*%|ot&&;^TjmpXfOuSj#J-qGdUvGW;h8BuBr|LJxNxHbWq-JJD+0`{R
zs)H?5U@VO9C;VYT*bTL^v^)-Z3epD&t^m$$Fk6VbOZ5bpv`v0t-L^mZZbn6st$5DK
z=_$<B804L+j*A{gtV$I-d(fXr#^ZO+_YF6NjHt`aM7r-nR)F*>3J#`&*o`@;VN{nO
zXu~TkOpn|M`VErCqY#9>|Be|tx^fL*k|m|3y-M5KVJl@Z-d_t%cqJm43h+@<S((Xs
zZM1ZISzoUTOsxCV2z{Y33_49@WMsjd`3;u;#{7er_6rXfWSpZAaCiP~56n6y01fYg
zeSE0N9CviEAwIupjZ1&{`0+CKnmMAFc5u(*y=KnP@EkaJ(C5Jeez>bka7*frj$%7Z
ziZ9`n^e_)Jd`oS$zRD@b3N`#&;#Le28|eYo+_f&87qt7eYkd&de1agw@;4kNAVP+e
zI1Ow@=R)kX1L>`B-<MIDAjSZV+ZRd!<ZF>#F!t|<-0zc?7UmVcOGr|HBwDab1){Vf
zqoOolFtM@Gq7x(R**{7k)?-4`>2nzO^B#`N{%#}LV4jXWq#2$c6OjkuNUL=Cv;uPs
zaiwitq>lie%-ERjo-E&^)xD?k*#x8Luy?|W3Qf*-i}7vc<0GBZ!iD!W)YtnnC93ck
z(Od@URileUXSkaV)e<Tqw1lI+c`mvx^JqXn(eH%`kM=LX$|LPdrKI#bS#h`Mp=DC;
zexy_1(2#~_*>x@jI&1ERMK{Iq>hbJEi{Oxuqx83mI6#(#CJWs5ykQ+3oj2Bnw-7E|
z`f_0K%a>C>r!X8iWuiv9R@MIe`SZZT!-j>{QMTLzjdw@SX|xSGOC9SXp3wXsHzL#o
zLkF?92rirL<YA7#P1OTr6iQE#T3euj!HDM$1&BxAf^F;PuU5O;WETB_mx@&<Z(Yyz
zQ@99q5@4>O@1K^ImSfi?h2b(awL7vNhiHGlB~^Vwb8l~N+5-h1B(Ulr>H~CJp6A=P
zw(~N4E0-@f;yh$-&V&8b1W6_YCOkN5kS`pjBV8m&h?((g5iosjdi*3+Jx|F=PL=UW
zSUzI%EV)(ke9@?d&@z!sl#syQj0g*(LU>12zrG22Cy9yGX$`HdN9dj)1V@{T93ag}
za|i}PfQ6+nEDA+hr#2xB%_vW@gda6a=p6SbDJjW|{{WGmg6#ydLokf`*{+~$9}tXc
zzC8%3I_T-YwB8WDpzwEg@^o_ynjBF5hp3i<Lbss6z~|4J;*poXaP<)8>6tTU@*Y!?
z5|`nbbL<}Qv!sGG+#qFp%a$9cJ{*F_$}S+g-;wt{AYjGnjS{K#VP&VAHe)HnXVdKZ
zHZ%lV-jo%F1CoC0)~zHVm1hCBY&V2G3a;@G=5A0B*D{LP-^CB11>_?kZI3J$OeRUE
z-a8<`#KpCPeY5}>27pVE8HI=oClaNB=qijBBgwH1bhQvmx&(io^hpNlo(BR;aJunK
zA|i~tol=M2Wpg7YC8|IkGlMA?AZd{RCvSD_mM!T1dK}Us0)m3d@csaP_%JfUKydo{
z`qZZxs^It3)YPOte3(mDi&P<K)GLXVgmty;EFfDW)2uu8?^Ddb+Yl~CG*dvuUWUsh
zv<!;Ey+BIg0Be{qk?~1tBK|Cz;OP(WxvFWbh`o71T~!qaKWTv><Md@U0&2)496n@b
zb{$l4896zmBhkjVs59cd7~j%*g?DJcaY;X2Ra<*CBCo*laYrH;0DoW!)oq1~tnj)>
z4-Ui_=}zI^Q12ma{;;VCZW}QYUStcGV?>pPoUgKKbhY1){ITCIB=ihaV9Tz>g9{=_
zc1L;<QNl-MXH!*JkLu0h+Y3yU7nT#}Q!Q!FnKRoUi+2TVi_PFir|HIU?O$C>R`%ZO
z<{BeB1X)VU%)dL~0J2gbK#)v$=Jk7tf&aUBjzO-~!_3SY7)(op1pdBMY2s&WexczM
zeiH&nkez#d_IS~<Z_(0i`SCxyOXC+u`Q^@o8uJ77`n@M?3Nx$}hDyB^{(Bz7c{jxQ
z(o*(4SCJLzQgAwQ_^_pmg~E_g@7&OmzXyhONbBu>0G5f|RPIFw?z-aCf0vkFA7Dwj
ziP8+^aV7hr`5R|5qkm>tc}`^y$U9ShGmDt3vm<q(I%X%it>JV^D7Lw4p7D@Whx6%>
SO>|WFqp7-oZ<g|LpZ^Dipwhtr

literal 0
HcmV?d00001


From 885d230dd00b102b89140f6342e8e46ccfa3f530 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 30 Sep 2020 01:58:31 -0700
Subject: [PATCH 215/265] Edit note about OPA Gatekeeper feature

---
 content/rancher/v2.x/en/opa-gatekeper/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md
index e0a22d901bd..8d08d3ed087 100644
--- a/content/rancher/v2.x/en/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md
@@ -7,7 +7,7 @@ aliases:
 ---
 _Available as of v2.4.0_
 
-> This is an experimental feature for the Rancher v2.4 release.
+> This is an experimental feature.
 
 To ensure consistency and compliance, every organization needs the ability to define and enforce policies in its environment in an automated way. OPA [https://www.openpolicyagent.org/] (Open Policy Agent) is a policy engine that facilitates policy-based control for cloud native environments. Rancher provides the ability to enable OPA Gatekeeper in Kubernetes clusters, and also installs a couple of built-in policy definitions, which are also called constraint templates. 
 

From c5363d85fd0ac9fef58f7309353f110973f235c6 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 30 Sep 2020 03:26:11 -0700
Subject: [PATCH 216/265] Add Longhorn info to Rancher v2.5 docs

---
 .../volumes-and-storage/_index.md             |  14 ++++-
 .../attaching-existing-storage/_index.md      |   8 ++-
 .../provisioning-new-storage/_index.md        |  10 ++-
 content/rancher/v2.x/en/longhorn/_index.md    |  59 +++++++++++++++++-
 static/img/rancher/longhorn-logo.png          | Bin 0 -> 23002 bytes
 5 files changed, 81 insertions(+), 10 deletions(-)
 create mode 100644 static/img/rancher/longhorn-logo.png

diff --git a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md
index 145e647c331..cdc9bfaef3b 100644
--- a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/_index.md
@@ -24,7 +24,7 @@ For attaching existing persistent storage to a cluster, the cloud provider does
 
 The overall workflow for setting up existing storage is as follows:
 
-1. Set up persistent storage in an infrastructure provider.
+1. Set up your persistent storage. This may be storage in an infrastructure provider, or it could be your own storage.
 2. Add a persistent volume (PV) that refers to the persistent storage.
 3. Add a persistent volume claim (PVC) that refers to the PV.
 4. Mount the PVC as a volume in your workload.
@@ -35,12 +35,22 @@ For details and prerequisites, refer to [this page.](./attaching-existing-storag
 
 The overall workflow for provisioning new storage is as follows:
 
-1. Add a storage class and configure it to use your storage provider.
+1. Add a StorageClass and configure it to use your storage provider. The StorageClass could refer to storage in an infrastructure provider, or it could refer to your own storage.
 2. Add a persistent volume claim (PVC) that refers to the storage class.
 3. Mount the PVC as a volume for your workload.
 
 For details and prerequisites, refer to [this page.](./provisioning-new-storage)
 
+### Longhorn Storage
+
+[Longhorn](https://longhorn.io/) is a lightweight, reliable and easy-to-use distributed block storage system for Kubernetes.
+
+Longhorn is free, open source software. Originally developed by Rancher Labs, it is now being developed as a sandbox project of the Cloud Native Computing Foundation. It can be installed on any Kubernetes cluster with Helm, with kubectl, or with the Rancher UI.
+
+If you have a pool of block storage, Longhorn can help you provide persistent storage to your Kubernetes cluster without relying on cloud providers. For more information about Longhorn features, refer to the [documentation.](https://longhorn.io/docs/1.0.2/what-is-longhorn/)
+
+Rancher v2.5 simplified the process of installing Longhorn on a Rancher-managed cluster. For more information, see [this page.]({{<baseurl>}}/rancher/v2.x/en/longhorn)
+
 ### Provisioning Storage Examples
 
 We provide examples of how to provision storage with [NFS,](./examples/nfs) [vSphere,](./examples/vsphere) and [Amazon's EBS.](./examples/ebs)
diff --git a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/_index.md b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/_index.md
index d85a4e9ad3d..0044a07d13b 100644
--- a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/_index.md
@@ -9,7 +9,7 @@ This section describes how to set up existing persistent storage for workloads i
 
 To set up storage, follow these steps:
 
-1. [Set up persistent storage in an infrastructure provider.](#1-set-up-persistent-storage-in-an-infrastructure-provider)
+1. [Set up persistent storage.](#1-set-up-persistent-storage)
 2. [Add a persistent volume that refers to the persistent storage.](#2-add-a-persistent-volume-that-refers-to-the-persistent-storage)
 3. [Add a persistent volume claim that refers to the persistent volume.](#3-add-a-persistent-volume-claim-that-refers-to-the-persistent-volume)
 4. [Mount the persistent volume claim as a volume in your workload.](#4-mount-the-persistent-storage-claim-as-a-volume-in-your-workload)
@@ -19,11 +19,13 @@ To set up storage, follow these steps:
 - To create a persistent volume as a Kubernetes resource, you must have the `Manage Volumes` [role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference)
 - If you are provisioning storage for a cluster hosted in the cloud, the storage and cluster hosts must have the same cloud provider.
 
-### 1. Set up persistent storage in an infrastructure provider
+### 1. Set up persistent storage
 
 Creating a persistent volume in Rancher will not create a storage volume. It only creates a Kubernetes resource that maps to an existing volume. Therefore, before you can create a persistent volume as a Kubernetes resource, you must have storage provisioned.
 
-The steps to set up a persistent storage device will differ based on your infrastructure. We provide examples of how to set up storage using [vSphere,](../examples/vsphere) [NFS,](../examples/nfs) or Amazon's [EBS.](../examples/ebs)
+The steps to set up a persistent storage device will differ based on your infrastructure. We provide examples of how to set up storage using [vSphere,](../examples/vsphere) [NFS,](../examples/nfs) or Amazon's [EBS.](../examples/ebs) 
+
+If you have a pool of block storage, and you don't want to use a cloud provider, Longhorn could help you provide persistent storage to your Kubernetes cluster. For more information, see [this page.]({{<baseurl>}}/rancher/v2.x/en/longhorn)
 
 ### 2. Add a persistent volume that refers to the persistent storage
 
diff --git a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/provisioning-new-storage/_index.md b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/provisioning-new-storage/_index.md
index 50f33cce160..fef9bfcda05 100644
--- a/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/provisioning-new-storage/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/volumes-and-storage/provisioning-new-storage/_index.md
@@ -5,11 +5,15 @@ weight: 2
 
 This section describes how to provision new persistent storage for workloads in Rancher.
 
-> This section assumes that you understand the Kubernetes concepts of storage classes and persistent volume claims. For more information, refer to the section on [how storage works.](../how-storage-works)
+This section assumes that you understand the Kubernetes concepts of storage classes and persistent volume claims. For more information, refer to the section on [how storage works.](../how-storage-works)
+
+New storage is often provisioned by a cloud provider such as Amazon EBS. However, new storage doesn't have to be in the cloud.
+
+If you have a pool of block storage, and you don't want to use a cloud provider, Longhorn could help you provide persistent storage to your Kubernetes cluster. For more information, see [this page.]({{<baseurl>}}/rancher/v2.x/en/longhorn)
 
 To provision new storage for your workloads, follow these steps:
 
-1. [Add a storage class and configure it to use your storage provider.](#1-add-a-storage-class-and-configure-it-to-use-your-storage-provider)
+1. [Add a storage class and configure it to use your storage.](#1-add-a-storage-class-and-configure-it-to-use-your-storage)
 2. [Add a persistent volume claim that refers to the storage class.](#2-add-a-persistent-volume-claim-that-refers-to-the-storage-class)
 3. [Mount the persistent volume claim as a volume for your workload.](#3-mount-the-persistent-volume-claim-as-a-volume-for-your-workload)
 
@@ -36,7 +40,7 @@ hostPath | `host-path`
 
 To use a storage provisioner that is not on the above list, you will need to use a [feature flag to enable unsupported storage drivers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/feature-flags/enable-not-default-storage-drivers/)
 
-### 1. Add a storage class and configure it to use your storage provider
+### 1. Add a storage class and configure it to use your storage
 
 These steps describe how to set up a storage class at the cluster level.
 
diff --git a/content/rancher/v2.x/en/longhorn/_index.md b/content/rancher/v2.x/en/longhorn/_index.md
index 348afd30d1d..c2e80598ba2 100644
--- a/content/rancher/v2.x/en/longhorn/_index.md
+++ b/content/rancher/v2.x/en/longhorn/_index.md
@@ -1,6 +1,61 @@
 ---
-title: Longhorn Storage
+title: Longhorn - Cloud native distributed block storage for Kubernetes
+shortTitle: Longhorn Storage
 weight: 19
 ---
 
-> This page is under construction.
\ No newline at end of file
+[Longhorn](https://longhorn.io/) is a lightweight, reliable and easy-to-use distributed block storage system for Kubernetes.
+
+Longhorn is free, open source software. Originally developed by Rancher Labs, it is now being developed as a sandbox project of the Cloud Native Computing Foundation. It can be installed on any Kubernetes cluster with Helm, with kubectl, or with the Rancher UI.
+
+With Longhorn, you can:
+
+- Use Longhorn volumes as persistent storage for the distributed stateful applications in your Kubernetes cluster
+- Partition your block storage into Longhorn volumes so that you can use Kubernetes volumes with or without a cloud provider
+- Replicate block storage across multiple nodes and data centers to increase availability
+- Store backup data in external storage such as NFS or AWS S3
+- Create cross-cluster disaster recovery volumes so that data from a primary Kubernetes cluster can be quickly recovered from backup in a second Kubernetes cluster
+- Schedule recurring snapshots of a volume, and schedule recurring backups to NFS or S3-compatible secondary storage
+- Restore volumes from backup
+- Upgrade Longhorn without disrupting persistent volumes
+- Manipulate Longhorn resources with kubectl
+
+### New in Rancher v2.5
+
+Prior to Rancher v2.5, Longhorn could be installed as a Rancher catalog app. In Rancher v2.5, the catalog system was replaced by the **Apps & Marketplace,** and it became possible to install Longhorn as an app from that page. The **Cluster Explorer** now allows you to manipulate Longhorn's Kubernetes resources from the Rancher UI. So now you can control the Longhorn functionality with the Longhorn UI, or with kubectl, or by manipulating Longhorn's Kubernetes custom resources in the Rancher UI.
+
+These instructions assume you are using Rancher v2.5, but Longhorn can be installed with earlier Rancher versions. For documentation about installing Longhorn as a catalog app using the legacy Rancher UI, refer to the [Longhorn documentation.](https://longhorn.io/docs/1.0.2/deploy/install/install-with-rancher/)
+
+### Installing Longhorn with Rancher
+
+1. Go to the **Cluster Explorer** in the Rancher UI.
+1. Click **Apps.**
+1. Click `longhorn`.
+1. Optional: To customize the initial settings, click **Longhorn Default Settings** and edit the configuration. For help customizing the settings, refer to the [Longhorn documentation.](https://longhorn.io/docs/1.0.2/references/settings/)
+1. Click **Install.**
+
+**Result:** Longhorn is deployed in the Kubernetes cluster.
+
+### Accessing Longhorn from the Rancher UI
+
+1. From the **Cluster Explorer," go to the top left dropdown menu and click **Cluster Explorer > Longhorn.**
+1. On this page, you can edit Kubernetes resources managed by Longhorn. To view the Longhorn UI, click the **Longhorn** button in the **Overview**section.
+
+**Result:** You will be taken to the Longhorn UI, where you can manage your Longhorn volumes and their replicas in the Kubernetes cluster, as well as secondary backups of your Longhorn storage that may exist in another Kubernetes cluster or in S3.
+
+### Uninstalling Longhorn from the Rancher UI
+
+1. Click **Cluster Explorer > Apps & Marketplace.**
+1. Click **Installed Apps.**
+1. Go to the `longhorn-system` namespace and check the boxes next to the `longhorn` and `longhorn-crd` apps.
+1. Click **Delete,** and confirm **Delete.**
+
+**Result:** Longhorn is uninstalled.
+
+### GitHub Repository
+
+The Longhorn project is available [here.](https://github.com/longhorn/longhorn)
+
+### Documentation
+
+The Longhorn documentation is [here.](https://longhorn.io/docs/)
\ No newline at end of file
diff --git a/static/img/rancher/longhorn-logo.png b/static/img/rancher/longhorn-logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..b5112fc6795fca81823fc04b23f38eb78752e718
GIT binary patch
literal 23002
zcmeEuhdW%~6Zc)cmq^srgGjJQ^qL?dS`aPD5<Pk+*hM4=QGy_9v?$Sg-BqGT?}<)`
zy3xD$itq1z-aq2q=kc)T+&gDx&YU@OW<E#gGc`q0B6=bK07#Xd$ZG-s0SW*hg9LbB
zOF(+)H290q>50B80PwM2{Xo33Wjp|Y1yGWI_}nXbV;bdQpg09vUAurL_a2qS5ca8Y
zo)F1f#UwUi#Y~!iERtQg6;+2dsB7Zk_DEx}S3ak#iv<3#b<$jlxNwS>mhH*eBt!0b
zQ-3-2rws@FsXPAl9@^(?g{U~aoO{J@X_{x)fsOU1*d43$`&&8)T#z3C@YkSoJzCCc
zG9E$q*kF(20A|7k%?av4H`yt$|2-hP+kO*~7^~U$YGV1@g#^I=O#%3A#=TsHXZEij
zNarpLhS#BcBKLKHIWJ2goZT=MlIyNQYoW6;(U#Q}&2De(aV)@hv+13Q!&7e8&1>4|
z(h6#Xevr{jtY!|WAu)id@Giu2)xXzz{W|(#<qZVoYl#2fddfh^zqYx72*!U+Uev4!
z;}LRL*R2#0w-92y*@khNYQEh7#Sq)kPEqX6SO@XHZgdnGBO-C+DXiExABbvMAjk^S
z>`sYf_}A&rdNvL*aM##ezRX8q0b(j^0>NSM%QVgI%N1Are~+ZABV}Z5)z&B#nb%~n
zf#Zh!eyj*doa;VaIbDQ4kJI^!r((OM5ZTw4<*_@+Pns7z*=Mtp4A*k{BS`2FVg=3d
zdHqCy-VSnP<xOP7!)xA6;7EpCT=-~a1OSZH!m`hvJx#P_{YM+{5RyMy_Tygu#f1gf
zndm${&cidk?lH0T3x?ys0e|}+wz#wq+UwS;F{>j53@$Jc2mCh!5`XTUu^nLn8_K|y
z8G`d&xKD|o^o0N?Y`}k$pmRWqB4`2tKLZ?-rUFn0S08ldMU&!g!wv9BJbvzM-`xM(
z?ooK=0<xk#j0IrV@n)Z81zb;!S1)pNKzta~8(;PrIWI9lvWgr{-%5FWJ+MiN(OuM;
z&Qr0$3;-Q)#`3?>#gVgR7DZR0U>iUyMF&^^4G&0~Ct-SQxR>K}Z~!tpN?-5d!T*No
zMA}c>4O94fX+JImINiQ1h~3GH-MKuueh<*AvRRH7$&StYgbhTjHnQ+tw-*TKow;Z}
ztsQg$(9!3SAeZ0-wc=mXlwEOTsAvn;?9QXc2I&9FaWD4;|JO4)H<9VuOar6~IQp_&
zlX6SVKil!)w#csp{M&Oc{?ivqO6Pdl5LCYPh!69B+FuUshUJ5r<<&a>Z?#p%!Jqp<
zfES1DT-Wx4uIq-OK(igHCIbe<N8#5)eDulP=?R@92KaBtoTgv5x%k{U+Y$811c1y^
z(R}BH#p{7PZNW9BCn>(`2LO+keg$6-6gB?pXt{UG1~4&)`dyC{H32p$!tuZ+wWr)#
z%=G`r%BuCu(<m}Q0JCMf>xp8?TgLR{!5{#?X8!oK7H(HU5vA5RK=`Ol;mhkaAuD(n
z^llnnpRS*Hl1q$IStkZezNz`TT=RSEHcu0#0H7xtF@)EwF0r3s0rK+`?EfC{530k2
zr3?YGI9QF>Z*=8e^$YIX{P+0KTR5k*C%^&(7+=3(PCXy5#Vig`wB2XE{jW)u4|(W~
z4FrfD5d8bjLKg>G(i7<N_1CEIZWthYn@d{tnt)-@e+mWw+Cqh+<+qXK|2n{RA)tAD
ztvc}U!5at&kdb&Ke=Xb&#no4_zoGx}#R{@{{Xtt3f?Bx#@V{t*{qOJaPnc`h12$xG
z{Qt-QAI*%3NY{PnRpvh2-?us^-&!jkK6&9)y0Z;nVpUHQR`%1>EACvY(U<kCY{s5@
znb{rUQnief;Lc9|q>13kP98<#`}bu;9_yVZoHCv!&{RfJ)?C{-OCx!9EYkb@bl-=2
z+1J0M`=#@auKmXH@^ais<*J!6=|BfhApdsdHr)8DRJFkMIHafb<SVn(^;^h0*}l3@
zYx5MJ?b(#JUVhD%VfL4#9&P1&#q1;{%j{acx3X?_{mv6EpCb!n8WL1-Sg>3Y<Iy(u
zoENoU?>hE7%};W|C;$25p-w2GR%(IoxM-+%o&9VYAlWX$V=Rsw7%QLZFeG_qalPVz
z&oM%0E*g=n;s+UX?nclQ#$$0{wSS#nTI`_lJm)~*P_c>ZdR*G)RhXUzJ{+dZsUGn|
zYA(p5gmIH)f&9jA!`cD0`?s!LI!nIFe7v_2U?*TcWMrWH1quj@IEtDNy>;39Pv)Rl
zj<X>bO!oca4uQ!Oa(+IuRkNp?W;iC-!w_)E9a->%eM})%WPyZttFy10ZPC~K$HS`X
zJ50}d^joF6lD>ujTgaSqu_7&}evrE*so}MA0QT5kA1zyEDN6RPFWd$;UqH1yrCRzG
znXlQCy%XIEE3acme%pFnmrE4Y+`z>8Kqu_Ib$nCa_4x7>VrMRtbF1mfidw*fKkok0
zzYC@R+rS7i-odxlY&U*;{KkH;;*h1dCS~3`YJ2_S+$`A3hWprIqZi-$X_hqSQ@xx2
zdi>kizz)8pybG*>cRqgqIp_+Gmq*J+*y97$Nw0Bk03EkVBWtxxuRHw(!oc8!XJ%U1
ziBYa5^zak#*n;WE7%DLGpA<I+TVNV*V8o~gPNYDh!j>5uO5~c0K=93DMeK3@Sf36}
z0IIztZK-ogcil&uVm%*Uk5^>+WN?;Qw&#BnGLZgcKAt4ZBaOZW&p(`6TjO{0>|qC9
z(X|Hxs;IfoKAH~pMc)KEqUSFPBCp#`V%grpGqyWn5m|ufXPFxh&c6lxrwRW;1tOIB
zWN9kv686An9>4Il|GZPUS{6o`nwk?r22;j7L*KYo&mbj&j`@n&RI`<9M$<K-TVVQ+
zSdst4%YFBs&m#>3!$Dyu(%`uXcK=qF+5a}ScVY+DzRy_zQJ#64>-Vh_Fg-`VEF8g&
z{q(-Z8>_sG>j{))0qK4vHEjLT>(Zd=&uLD?Nc5i*<rfFLX0M2|onbkN>PI9=*vwt;
zQ-F!>EY7Pkl`xOPuDjC!blC6XSlSh5;T>I?v(7uRGCMEBJj)0UFH3h&(}l-YfQvyY
zxj_npPnCsGPw+|FX*MaveTD&GD3Pa7NR>&?bE>Mi7A~gg*YsdqRQ<s=0f0{l>iAFY
zI~kE9DPRLOEdTWx2hdX|+hbE$=3QpF<9WxC>B!Yexme~C^_{n7z=EjJnqwVqyAAd(
z!U(?W{AZT;1y;EFc!!%`&u;dmeaHvXq`qpYk$wVGEcB-fFlM5#ZeDi;C1*_@>nHU$
z<;D9fbK7RIK(o65uPBpTMvnk@LQiDS=LHwyD|=zSSOIZV+FG$^XapY)ZRY63ig_Eu
z&n;V-y}SdN!xI*NP8D03`-O4b!9+DAn+|ztwIVCHz`8>IndVxn@;gQvya6CM+J*+6
zvxp55T<7$!@0z`Hc<He6dvfSfxPYpaIi52dA{w!LvGPC<ccn;1${^oxZ2w_T04?y&
zy-si})TQlEE@`~JX*qLF2JodU-04xzj{S*Ov`BGr>yj4>I=!yh?fx-xJ}rO~_c<bz
zW9ok7HdpW%qtTuj`g^;*J8|?S|3hDj!F!+hnq+2=nfxqN(tL96Ms~R9(6ID>Je0Bc
zlhA}DFhAfNN<L_@;9j=J9(U#$Z1<a#>6c3^+7n8g9+&>DGq=N%vH!5pKnlyw7`xpf
zZz0vJg=}&2vsr#7|6|{Y1nEO&HXTIQ4Mbw1C_rnN)BG|PjGWT8|5yoOKKkA8ntXZY
zW(?1cV3Zkyt9~pkRFV?jdDPR4Tt$wpPvzLsgvA2&`rjbuJbK4*MMRTHaRbOt`+_f%
zq%pfqTl(e1t-glhOq1o*No#jQCTm1rg3G?2zUG}AB?3Zg{OK*f#4Vt`KXCD&PNB0v
zocot5S;10sPTzW;!#sDHgu#mt^ZNy1v0)c0DW`<!H#o*s<<OHf*uDT3U_QXO*&seU
z%^2!ie1k__ub0xVIJ$j(yLm=E2R|*6)DT<NO`nrV+Ydrp{5`1e^tJD_4{@Y~M8W2v
z&$%{#tf~UvF-c_NSm?aM<!-@+6)ddESNk-5cI{=h0DaVS)(knapjbB$CZX@pF>5Qa
zX4bh{5iyM@>@P-*W*VybGUz#%Jr_uzd{2$&a*O%+6o*zPXPSa(2hyIMgg$Fb6>@ks
zlU8Ie!^11vV%Epo7S(HG^q|CFI6NkfKj)M<>WAC1v~^#;Oi#16y|RZ9ZquwC=K@5y
zHe9a)qnrb&zTpnEcHb22b+cnZC#bIX-6nn+434P1QiyBJ^w)SXO19ee?9JPNH+rOX
z`A_iVJzs2lq6+-oDSFQ9q~C4StrYRi`B^k^H0J$yws?#8O!J2ONFRU)a=ExH*^6Ca
z?|rz)K-G*dlDBzLPeEdv{Ne#iiEI6KWRU?yl`NtB5|gLlS7mM3TZ8%H4vqYZq@?5O
z==ZdUt{sJ&;N0otbi+7HAyW_XBq9(Z^FuhSv`m>if`iFpZ~5cer%VHAL)xSYdATar
z-u7cRi5g9XEY<Y;*0J1VrxG~(XangVR0LYPTq0AvobauOer6L=PnAIfDW7I!o)BxO
z#8b1sUHUn~OH0fNF?(?9wat{v9VKS$G}U-v&c;#ByoL%7L21fXSU&@3N?p(6fVqLP
zAh?P(cExh<-^ZB(dBl;Z#G0>lLlof?=G<O?QiaJ@D#^<Tu)~{Ow3W|QPSw_}+${`=
zE=}20q^XjI+B-@W7Y_smeQ-r9cp!51qQDe?p+yeT-H|CJrtbbw8$TE4L%O`J5cUqw
z5B)oA;or^EwXO1BM2r=jggbp|WHsrka0t@i7Qi2cKjwUS#4#-EIEEGi<lW*|wJOm>
zPQIKs&AhUSNLsMNRjP?+2k{m~jEG)hRlF>_iK%uHHP%XFm&_%O`bj|bv+e#tjXVh|
zR$hc|p2pwQTwI55*f{_wOw6Ud(KllCdFJ^(&Et%M7Zx-K9wUljKJ&SWx>qo)3+E%1
zdDG(O0fgJXECc?A&?CBB-qbpRI{@2BEXV{uz7y0c;ts)&C0&Pn)Igo<VeUYkNel~<
z6G_Z#Xvkew0ryeg=MVi+;&~AB=AD}GT}8H6M;yv0ceO0A{N=iz>-S{bL(dx}lBhK=
zm>GwOg;q~81aP_&f85@GIM0h51A-ThMIwua5}p!ZbbtFSXr5c#4uZFDyK^t|4W8oC
z4zcaIB&{~Bu|nrcI6bhk&Hf4$$EQ|W_qGL^KQ)SDK4dqsw#t8>J*-_<Qc8A_U(ZbR
zv@LUOlt7*oB?-zwwp<sx1D-A&vtzfFxoP&1R3Q*ALmIc*Z-;~6sTmADkGVCLX{c@h
z!NaN~b%(#*jAf8vk=`me)7G6zQm@pRV~6tq68@6vyNp>JhQ#Fe@ox?%qT#1ageOg9
zIe)g+Z6}rdq>51|UvLCJkDe}mr6+6fbo+(!KEe|XzptoL@*MACA;6hIpz&LhmZYbP
z3RfUG4{kbQ03Rad13QvEXKKhbW1K7JgZ@6g_eq54Sq1N_qwg<gXs`rig#-DL?nB7<
z8(bA<N|xG|bnnK93ml01$T>Y&seDkqf_RThn{Gwb0WHlSen^N$)1;yn#0p`MgvSb`
zsMr_h96hDCe%=UyWKg(G_J;|;CD8-~O&E$8cr8za^lK|bAo~FRUkX2p0sLl~F|p#=
zNMhFt3^PbX<2>861?GnH(tnJwZm*y0ng6_=+mZk$%Ej9Zp9epOd_lm7c`rpks06#2
zCe=k}d<8Mkk47e7hb&h_)H;-j$cM27!_~5i4mc^Wp<(GgrU|(K?K=fUVbh&^k>91}
zhwvE5mQ<MA@IIZgnAw|X1;Xss<Ylnoi6bj+GBg4Wln5KGB}~}#Mk_@K<b-q81v(t=
zNIwVQz$e}TDoncBv1w%@SZ^c-@k`%+KU^N4!iPvIVBXrNj98i6qL?S{hdZliBd=)m
zgy9vj5(m(lXdNm)jQ6=!7xDB6Hys%W+js<U2A7NT9h~(%t79A!epC8kxQ_q$MFAv|
z!q-%HWgkW59{{87hdZu^IcuF~KfH_LzZpO)JCJS9$pf4$ClDS8<kh2^bRn<`k<?JS
zC%TWO4QcDWv^zFAw*uUYdf7{Zcg5Q&D}rEkrC<Ke*QnwqPEm=SEtr0j!V;i}PwzRB
z?3n=oDVJUxzXWj_nFg&<IBjR~@8*eN?M9Iw4{nz%oNMlrO~j>h_-;0m^0PMZWE-AB
ze^QEp;RYH$xmrcohCU*wYcp|yrZXFTC#&E5^Tze>qSpD_CZj}=FZeyTIsx&OK-k`@
zAF2Lp>UaG)?!LKqhiX(`q1E@}AIp=Y68xFC0%)y+)0GW}H%Nhj82Gf-pGj}OgSxR2
z)|4@`A%}7ioJP@Ns=|R_DvO^19Qg)<L44MEL$tnCUY{<5-Qx#A&9Dx(!nz4NSSheu
zsoc80KjKASY*bm@(M|1mRDT2U1%LR&C{Vibo1&&(Y|t;xeNna5q^D+>%6l?YnO{$o
z<uZcdP4;v2v=Oo-8)^d_B4BD{W4qVE2d^sO=0#uMm#Cb|mmR7H?@VA3zsv|?Ui_KI
zFC@<UV@9j#IZ}{mJXcP&*h(=&5M9ms`sn+Du{4$dM(81pP9hqZ=$9vSB1=C_J<lqY
zdu`?tBh?_Z^4(ued-&amaiYu$0NuwzTKLkoF1R*y&Jc7^OPwt|!SALDNcir#q;PH(
z)-2Dm+QO;w64>ZadqS37!0%T0y*2T~ZgNm5<@sCI#^TWqe?v8BUI!%4jS!woM&G({
zzv21$a!nAtbM1?4uNya*)NQ3Ds4KbGfrYiv2NJO_?ew$Vxt-<UnMR1L`m#eCYy!b^
z8R~F)a@VK@o_BHM%^FM*WJL3ozp2m?K%O`{zBzQsMIm<&$7nU?#vh<QamxNO>$EQF
zvh<?;`162wwZ^=+UlaA67sW|8FTRWtn_I=u=lT>7PDU+82)pW@rm63H_A?Ps@bz!6
zhA~-!qYZXQZWbMIAxCDtFJ(h&*Oi-$@+BQ(4qjXByVtKX0|6@Ml0hW|QI{`Cx4i^|
z;5jX@jfX7n%qZMUtvT-l9=kKHv$|Wa29}G0tv)SVZQQp%r}^qJ7rbA_<d=0qte!Zw
zO^g&Ob`@qGe|~IaWt8Twxm^oeD^5IR8-=rwE3Wz3R|$?yRuC=9o%fjMA&&<ee(BD@
zaCKSh<6B^?4W&h%lKOX1H5vn;b)MW_Z4s!Ef!J;LMqn;$3hMP7d{WalQo|fxg-(=<
zi}4WbPL2ZheSh;VT5^hh5npB!H#9Jqv>J@l7>y&hPcn8>FH=jsxX-Y-4UZEp?Txp+
zQG35oz45}t4Ta~&`i&h#Exrzs-yi*5$1B2(*sLfL5kK(yrMBMldY1A`s@caE+><Hb
zH1E6(dZI5qxtHr-8!u-s32Ij-?A9UFuMQbad|QU=1Y#7#)xgiB1d5A(d5q`2*zey!
ze|7b~*q{0n+k>vOP{vx*Mh&twuH-R=vJK07=Pj&vrC^5&@q{ZLYCOG<yjFg{zZgcH
zd8Sk|)*=72>&%YFN6oMB*IeL9Yi$bP?TRRVWIcO{6>3Hq(xp1^R%eozsH9Q1tK*i4
zB3XJb7}Mw^+>GdHqmArhLK~7bLfL$4x9DfaY-?ub4i#TQ@D{q6cHo=vi20@fTWf`b
z6~<M9#tswg)@XAAR03@l2bO>UVI4o`iGu&83Ki_>EHAFw3-8C99#4#gop?K5YKrE#
zCVA>DN*>=ovoNb)SaILDJP)|rUxEJnhGM*+O=dR!1Fl*fi(1ZwMcmtk#o7W}`e5Jl
zXYk^}FTNJ9$Ye-B2{5XGht^Jy*DaO5B=ouERcwTv6l}XN)a{~VM&VMi0>Tm4I1_5^
zb3F}ec-3{~e#Wg!VJj<#gj{cv85zfu>Q*5=WqADC<X#nnd|T^*KeS2jC<y0;MNi(l
zA^TuBD=wvd0ObpRqeMreTC6js6jH#@Uld_WV>ZpaUat822gEA$jZ?JBx?Z#E9>gN|
zOfy-(iy)6;81I%*NN2=L{~xMUJl2J4)Vu9YS#q9*bX=4hOz;2vI>WtJrh`+LcX&9)
zb++P;V3D)lyh;?Tjwb~r@fIsS*UzpWvr}xcgudC;^>mlYF(B`$!&{uZN2Um6*87AB
zdrv3NLUEtxAx&9HI#x-o9rno2XdYp{o(fFOMq8GX9%sAWr@yC|y3)l1Vdt21X2FOc
zJwZGYFbj5{)96-$-R@9o@Sk6NjFGXMD`*=EXM%mkE3)N-Ax~K>MFRQEmjmcbTqp6q
zitN+5eCv-eit|_LZ{mDwCSKX85?8v`^Zm))NU7VefgFhwf)LhW*QJKO(}>C!OOmFQ
z%EaHl)fLF#n-Q06_SEo4+_SwO9K&(81Lm3h<tRgr?>(eBdPIBE#5IvKD3fPmnu8dv
zqWbPF$ArAnkyH&qNr|V{ic!XE%A>}IoQZ+ByOcUrhFp(iYDxQBC9@>RczP0M%XOh)
zb3FwcADr&YE_o#lJ<k#`Ao}i><IZ}P<&i<zojW}~{`I85g!oLmDkT%B?|#4vwf}nJ
zmoj$|Wez=Rzwh|OXrCs{-uP=*>NGp=YGa`*4`pj8Ry;*(&+Rm`tU2Yc4AmC21s-NQ
zDgn&Gu5b|_<dc%Y;m2co#$!PIusGf)j<c6ecyI<Emd69QRbOw=qb<ue1nWs(%eVUZ
z!BL=r%Tav{S@%mB;rPl!9FwhM^P#GwGPmK>2ThTKOG}GV%80sDD4A1UVH?zNgT008
zWfE5__|Ckrw3ql)bkg&4gH)h`r-SJh_JfHh1&W+vbp$70U^recK83cOrZ>m;*=Ovc
zkq&e8tMDA6=Vzl2lw_W-iC)$Ptgrr*bYeEA#B1M_RB~?{zsDe*8A`vQ@18L`PiX{j
zitiqmHat&3dL_2N#FZv~e8Cn7<l_$yZK5z?r{fG-+1KZLoj1CETLQOVH8m(Mo9GrY
zE_<!V4->VZI&e%(%+K#Ycao6X+-;%X?y4}5#wCwT<x#>4OH>Kp4UXqN+sOc@`OXPZ
z8$lg<9xO@Oakd6w6#P<q=G;FTMc)l-%Q{h3qm$nC-VDotO&NiSB0nGM^-bBkR)ko?
z<?^G<R?YXkJ<6Wnd+9me+;R4MZ?QDM#sp;6N?eI{gfoElA&qD%bEOnIMvaO@*6~d|
z02fjh<hD~ZH`M(tsM#gx>7IBy!HdSJNN$;iwwR<pOh5mNn*-JJTJDxPI~JGKO)&cr
zaFKT*m<}dbGh%|?7?57^>a4ORFAhY8NwX$%5R|P+uWp@MX!-f+g{{=+PBO4YlMu&v
zDp9YAqbi)~8cUULwR5+Yzx-sfoZo|^EmaOB?Al_(i;xKH5J)+-3y$GE%ZR~YVIS=W
zQiYW$KJ`1bwTU}YsSp+HP>(D3yKtKmezOvb$Z)0lwtWi`;QW3D)%y|mUi=TLy+W<9
zHanIVa|uU9zU{4@)QD0BGXL<{L2R!Vd(JIJWs4C^HyYPI>|z!*&pCogcC|&6JeRGu
zkpYWgP25NB3sK0tbCtcP>%vvLu|LxfA<e}#YU^RC7R0EV#Qwl-R|iif^kYF40xO!@
zn=T!eku}DzbBJND_j5=jhR2T;lj1Ay$L#U*aW$v02A#=-G3|-;&2#UjFZwYUzKqeQ
zm2JoLC<VIw2A-|8mhN~1>S4x@#n#nMgXPn1dhBT!Qc;<Gu@K!^HCiw_*6?J*Uc|U!
z`u~)H8$|QBh|`R27s=bF$GPXUbfa**C;>3;e3V`R1qK@jXCZdCPi}uEoQGwo6Q%t*
zmD3u86|J5RupK#1qurred);QT^=yX%bay2j*iUNI2hzUQF!Mhah8^<Q9$5&`9W@24
z1O8ulZnPFx@Sz{Gsb@@&pz+}#TUG3W!lUq)@0${0YS)xkv>4(cx2euM*;y}9-4uJl
z9rA@<wr`Z})V}@EAHyi;F=oT407^n{EIWrA4Q;Dnn)i!P`D+}7=N|IyIVZ|0gEX#e
zur~W{HS;-Iwn*3Ke%^XZvd{KPCC)v^yz2gk1qh+_5A{_MNt;|6%Iuww*Hk8~wE-x8
z6jLhz!qkl<ULz^$r|+Ref~?TAC|4f3K-k@=Kal~8M`BL(mqTcwiaW3OX&xd|KQ>OW
zEI!aK$&{IFg@t9U;)7*kEN{m_Vv~C?ERlG^`TZ>{So;(u-E3aJXl&>Cvq75k;J37M
z1DpZlQW^M?2e)ds_epxSa3bgmL?UX|6c0cN;kPB0AR%*&LHy{kjIElqBnpJ)(i#ku
z?<<cBG@8cQG9v4U*d7AaT<U%q7#A4^-IFQ()IoJYG9mkDM2u(4zPL=}5pxh++Q9b<
zLJNZDPf6tqnV3<UGrAQBQxE&~_=?ntGD)=OGEG<vpm?jcETOb-7`jX3oNF1=p*#vd
z;5yq;@WlBTLFF&-=LFVF<G-nZIH;aGs`$Q@_j3&9q8R<g$k#cW_c81Q8vDHq^}ddn
z*;;Ev`uEJa8@on_7)Nt-w5&1JH6`6?tc9PS_=tcp(ZaYM91(~ImHUvLrPV-ta&Uh_
z3W02-@zQsOuo(DhW+m}d^kP!F-!NLSmEhQsb0=Xy6hA~|KVFIuCAsmzEDErm$lBUF
zpG!9IZ<J4Y5Z2IB?C2pc=;7!an3;n`2grr|LeZ|<@x6jW#eU)PYb?9Vw7}L=Mu1))
zMs9#qtoS@;#}haW_2mi2?bwu0k*#JI49;7FWeO2C{pnsXSIIv{i^`KeEVx^h(&<-P
zO1AFH@Xg}+ubw}K!ls@rFm(gpW&}+jWG;mBgx!BeA%!PNV#nI{l6G?6;VH+k<jkEg
z$*0lC$5zx_tvj_XqVkOE@_r7?PnR+ypVyi*E}CRKTXt7$fhDa|GuBTZP%}Yjr}Rnd
z2^xXDZSMi$%3*}hl{i}35XG+Oo8i&^ycLc&ye^(xmPtKCmW5Vvqsw)T^HCd5jx2n*
z_P-U*f=MuV;&U7m^<jDsZ-b}D&z>IZaxagcM455HWG^$+KKa?r(YJHDR6-X=B#mEN
zLQ`^Cdoy4}n~~rFke$LkIkRQiA%iKA?W{$7u!#W)dVFYqT-EH1h*|wyyQEvyfuEmW
zK1w{2)L(n}gax75<Cd!T4G^u#jj?EFuCFCNNeOAF>4U4TwI^3kSv+8aO|6D4lwn9V
z!{`xX)f=2H^(iODC2R}3mD^qpR$J~rsStl=yRb#{0%-jkaEyQ{D)&cTI&iyfvjH=+
z*v=mo8t2P(Tj4qO(UDm-hm3~nKOYy{YKu5}!#x>bGVp}qpaTU`8E}5;>(kBVsLpTP
z1Itdme=+Ti4iYV}VDMBL^(LJdEt-4s=u?#znPj|D3aw8{BkN<?(fH(u^I8})-4HLE
zrzuBAs4TQy{M!lbgR_iojsjyG+vr*h@%}~ONe^`pJVKEL&*T@#Uwe<k6CL+31SJiz
z%Excj1fgfNb^<0E&8sO&L%$WsP`<C`=mppE%X{Oc-<)PEP#xlQvb$Iac)03f4-MwJ
zbmf<u@V<nil9-=zqwow0G|nxETVVE-ArR}BbYfW^&LI79kam_TQL!hSCMa_=$VesJ
z=z$aCw?iJMp9$439LG=px`Zr8o`5x%GbF%)`CD}I>0I6(l{@R{;Y#h)WSr|O66SMN
z#`O)SLABfX$%v>L8<_>cr?@Dvo%E*t4!zGuWr<i)a}Pb{<Im+&^ll*Z9i3rb1~d`u
zs<C{W-}$s(TfZ3ThCMBp+4}NtwEnoo;NC;X&l@`{rNZI#dxsm%E&ULK=JGiQ&Pw`M
zV0kMq39R%Bvz!U4VF>`|6mF1Cu2;)^{g<a<;(1J)zjj%FjVuPT)!xlMySX8ya6{+}
ztP?xaC@WIg+%qB2Xocl7Z>S%=?aYBhN`6jSnVeLzuh%a@IOm`ASO&otz$}ngayl_6
zZD1xL>Rf>lCYJx#W*h4ryl-u{$lG67;k@?ds#kL8D--MfH&rDU7Dyz?ISsTcbj9cu
zMuvWN{k)O*X!_Z?1$GOpl&}rZC#(ZXBBrAxIj8#4Z-`<>gNyF=eT(>zDRsX|;J2gZ
zQfX)t!CXzyJ^hs;X@<w_tNk|Ud>HYiHMn^4lZI;vX%UHInMq*fjQ7V4L>FirAz)<b
zZ!e0U)&b^WZ!V)nc9hX8onTH!l>d;<fAPI2mu2#BWUgNYyRoZ5P}&T>eE=BRn0~7h
zOYtT}C*%7dVanX&`{#dwd7AgKB>ZfFe89%NSKLm-5$8v=d&iHCmQ8yk6zYvk2R$P5
zFNRV(&1h$ZCZ>t&y(YCrh-j$~Pbl4a(sz^{bRUWo|EfFO{~hl?AFm`;HR-xY-vavv
z!popZpbq6i#Kkx#1|oAeX)6~7n{+xFMBHz1e;gK{TrqTdXBo(J;QDIjjg*4a+Kw6a
zIE6x+nKa|y&*R$YXL23Uil^RHd+=G@LQKI)4|@=pjssb}`H%)6<5*Zq(40G`M09N$
zp+S2Xg@YDHSt*HXBJgL`o50pd!Dp<F%g%f~F}-%yQBVKrz5IT>A_1zTSQSg)kV!Lu
z0~8pl)z%G5tvsa?I@<wDQv>;3L;V9hs}U2RONROrnS=FWcZ6z9nT$rHmsBOUMBHJ(
zy{1_Dk#x9-yWEpD_6W!D)+Wxg778Y!w%$)z0-jg`QSU&Rc|%_>MH9|nfLp{fGT+9S
zxUL<~hiUp?icoPRtwRQ^00Rr9?|@kPRb-lpUvq*zvS6`LLB@sQ!GlWL6*##3RF8cQ
z@a9aY8He@HAA*RnV=M0EL(T5uN}gexx$gv>3t7^#hNEe_$T&?z0eN;Y2(Pl19l`C8
z0T1R+Ha>T43a@&a(APXTnvhR9EfFPjGVBkmLZu^-89Iv2ZMMF}YvOY6=E9Cc&ZQpA
zynmsw@=FS1dl%)TG933zMS~UZv77=8U>)2Qjrf73#*_=<H009uVajGBPwLiS?GqhT
z-ougKmHZdWjudp7PMuT6K2+(qm&cPD$~`}P7%9q^kMdPLdOJqYChG$_u@JVktON|P
zx`u^oWAGO7_`_CMOr7nO%0I@j&;xdAC1vob7=Z+yLUKzY;k=Wf;u!obZxoKvPx0by
z-dFC$g@h=6JS+hxQE<}aEfr~#j#laJG<v7_hI?@y_0Vq#AaWcz4ImNsUZRI~pQ19V
zR(8QS{@g7fo_W2P?uuZrFfcvx^bw^9exm@>>7%2!r8hzX&cS6VOX7hk4Gs2?*61!5
zvd8dQA1Un903k}*GG#l{%<)~=>o+C~*o_NLT==&Gb-bkti}xT2Y-f-7u>?v|!MTpz
zu^$k|`1WwB5XsmXDdetN1>P(0gKBh`p0EP%Fd791d~3VBr-@{=5y;ZL{w5!IQo)H}
zNQ}_KsHAl8jB(OK(*lzRGj5MT*)Sy=^`R5JMsr;hRaE;b7){h74T!lA$i0gT@EdEH
z&1Ke>NQ;HICm}5ZB1NSOZRe{=4SO^QQBl#dB+&$*G!Az~&<Li2kl{@t16@YT-oAA*
zxkCzoR%SQA{P$_U-Zar&sKN+)1Wl3e*Qdum*y8}N9$BmJo$NCZ)(B#1#?c}V+wK3R
zoP*nVwPyF}YX=m*AJEy+B9!!=c5by*>(&<pUB}Of(CHLFw#QBlH{)|bn^^8j<k|dT
zKqUT)-qS4jFf}4zzfQKde<}n|zX1SD7*d%%T^YURmks?d=9rR#81Fw+0p88&HD36I
zgPGPWsON)k9d{c(fi;Buy(`Z?XTynY6TQs=*lp)E!)}Jvd`lQ#jLdi{Bj918ar))o
z3Ib@~*eVV~r|suz)Ap{GzsY?MrJ>Kc5_k}kC+dujSPDlR*<S;fqdniI5RHM54rp6O
z#;C2TRE?@IqhZ9El=SbryLhtmG!x+%;=;cvIDmg^0*D>~p^;3~+6u@4fBe#}-_=QI
zMRndlSTTJ~L?#6y;Ku}^qU{C<gL!|K!-*fH&D&mYbp?wlVb~2aU$OEZb8n8%H4Q6$
zZ@9c~F}4P4ft4gWR#K5twqpU}NNYmT5Pgj6BuEa#>514x3j25W1BIt~Oy2SaMcT+v
z#Uor{b}<!YUuFo9E|c`GhkcvK09x>R2JOzTmLCNH(5-w=xjm<Hly-4O;UK8C;~^mm
zZ5c#r-E}_=#9u&v8DW%qM8MMW;_WL~8r%Q}?oiRAVOQ71@p?brZP6DLxL5v<Bt2U=
zi0tTarmLCOM$)C0LIGfj<w%fhumF{8Rd4~~Gm`ErDcloQ{RUDwe{X!g+}$4e(8d4&
zLhLDXj+8JK&)Ia5+>`kz0u=gp5ZwA<-R>~}!YGTekt|_O?I7X-)VYZrHRL@QdsIu;
zYIHq2=lDT?c*R@z_j38Pk&2lO19kD#F@^)4!PX!OY5>@?{aHHWH~pPvKO{Y#(4#53
zC$4nQ#CY6?4UqLXtX$~f@sSH3ac3k}EFAOJexpAR%KlqWH8y!%P_KN-6q%phxE(19
znZh+n9f!xuL@HllRZJA?pX)Y|KoNiPQ4RKUFVe}mBFLG-GeOIgc8u_{$8OI3v2JxF
zy?QE9SlrnmdYNPv3Fe<3;ZOf?6d?4~dBYD1aD^r{etKM~7L-c%V9@ymmjO*mFIeV7
zj-oDKsd^Ww)Q6{vfM^vUYWmw2N!Z<;2oNgdFU^BRMYGRwH1x?xxb_!L@vq&S09)GR
zZdggJlApyYnyJ24UH6fIML&^1q_*4S^BhbVh-U-_-W8oFw?&1l!CGrXa<Bn^iY?pK
z@03yYQyk!-*y@DUIw>pnYKne}bv?WBD%gBcE+C<7L}!;i{Mf@L!?8|rrF?roLLY9A
z2ee^YRtOZ!X;&JE8+_I*3LVVw&5#uwfLu*aSrWroXNjep0iXR%g7u=N45p-$atv_^
zj}|69GU;>&iL6>lt5nOuH?WGu24oFp#=0^?%)ToX+LizKtL7mE8ivO7Xg5ouu(_2R
zotM;BLldfGb{+-lfu9ph%9z#u726>ICStn?O$g!x4EC2lq2Lx&;3@d?ci$lpYQo&h
zn_WU6HjRVG{HYVhFzRW1gj*Gp_w9@s#L#fIyQKJe313tLfTBfUpeg~hyf6uUi~Fm)
z6|LmH6a?_Mrk=kT2P>^t<~9AC&Cx}yIL=rEL}Lb6d>)`vR=5R1MS;~}VJcui<NR&!
z6*M%&T&Kfp*4~?h$GJB!au+V-MEV9?)tjORxl$UQdeXPo=-vPT2~5lSjCKnvQdKQn
z0q|$XoDHH>;x<ib!kl*%NE;j6zuCSX4?tm?iqwL}e^4gr7HR4tIXsB#F$4j~|AwP;
zRHjI`*)TpoEnoIhx&lsmsk@!MhiQI4)-|eRVl|tJFG;cyA~U%5p-P}HehWA8iI9F3
z%pM8&Zv?^98OzaB*;WR>9E0Fv!@>Z`!?!YmyXRKA)ymq&d>>N;(Z6T#m^vCKF^3=4
z&WS+=pnf9}>L1|nG*CnnBy%Mz!!zR)zXl!ZM8&f&&fuaXH2O|6`o^o<Vu1RygD5`d
z8CJ7}I8FJ!lTyy}LvX7EmHAijizjV#4_n&!P-n@S0WTIB=nX#T$5TFfDbVB%20C~S
zSh{#b)m;kU9L49cyKQJlkf;Fu?vh+3gv)616>;kcYt2ZR*YDG{rB7J>7sF0A0)+kE
zTd5zE5}?oWaVKR*)?h!O&XPo+OKen$5ig7{>vjVZOp8^3$sLU}MirvNb^R=nR*l~E
zzlxOhE}ULDi#F93&UpS`2*hLJKtk>>?xE3U)Nyc!H&p}2cqpp}X8NEzQ~d;}^t{Q*
z<!EOr>q_(i(8GebR+A|M0)91wulpzWRGgSBO>Y3gE42;qyOqtaSFrf)Sk^e>RU@S7
zf9M?~f%3Oof3_Z4YZ}BiyMjvldh2xFB(e0N{uQ~H5xc`WcX~1@6?}`D%M=-Qy4KOQ
zS)*hjz(iA8mvE5{zx%FbvCo#{i|u9`eR<uWMa)xfGr_#=Kb$Q|l!$=oWE?)n%KXuQ
z;VYZ|a;K3TICt8hObVfu^cd-O{xzyw@sxXIzhT$?@cC@@en!=Y?@AN1;PnP!X9*(I
zhGVITkMMyAM1rC_M_t!_H)Q+PdPC8<eMN0eT4oR&>Vs47otiuSV%j}phZra+%$<*S
zyb1w>LRYm$$~q%A-L!11rR=eRpU%Htg3I3Sx9%>M<jc}8^G0Yqale<mE)QJu!TCs1
zssH?<@r%XN8TteOh@_0&R3BM6>+QG${plAwt#uFKu=dJ207MveaF{6R<dY3mE0Lnn
z;^PlRCK`R0E*XB<K>tx8CgGhygLo#u<CcJ|t)eE9XGSon$G=eAy`rTrLx<J%5=XQs
z7Xr9uo`=5pVT=i5P3Dw|i0b(9CSq3(x&m%l^*uXt(+gM{BV8@Q39>jq>dQwpG8$=(
zDg?~qJgaRJVEmcbZd*Sf4Un+DI#L)w$xPj-+HLnGj;tXRtxA%gSlUqqqZ%_I)d!)H
zwsx#@TG-=GcbJNRbT}B9-b}u8_$w@To@VyLVto-u5Ie7U@@QJ(D51=JM2Et;x1_3v
zB*=J1pO#{wjtdE8M{}ywNvRj&(xOM^&(D*T_f3eu-~}5$?D2<5;6BV8=qKzr2A!7t
zyg~vR;&g@<N_7ZP_!cfGHPQqg-T;=5GH(!{xi~Lg|K&mZc!lt{{B^g8E)HxgR!CoQ
z#~v5pOoP(lqGf+W3Vd>Puv(Kgo!j~=BAhd%XZe1=FdqFuQnFUm#P*i>tF5qbxFuCE
zxHWldaJ4h<l$NeLZ%_gy1-TMzQup`RUxDUQF)u!6<vfEH8o-m-g+#y>^tfJDel!c2
ziYP2JFt4DUJ$nw<xCd>bY+IzH6nXPaV!`Vs7&mz)Qq#WpoSwq<xgkxj6YDCk6#ln&
zATlJTB@kv`OLBnVw8i4rk06*)7`baijRQo$)?Cx1Es^bEB%4)C<Tst6{DgYVF&Dpz
z#W<~d`#OFd5~0vrg4ulr^r9A@<v$>dIRU8Lh=QWT*5TJR;$SB#jP%|>QAzH@R%v;A
zhAUpTBh%9Y#D>7L_PXdvHE&qy3i-ovr#`9eosb^?#fDK;zRcQLkSe0=c8<YoJrJ4)
z9NcoAA5?2PSFo46B|1d~CQkBv26WgiRi+ZjoeVWjX<f5UeFP3fO5UN}eSQl8RDa98
zhe6%sC}7r&O8S3WV2_tjfwQLmiLl9Aj{F{o%zY<U`i22`N9n9N5rnzO*jjjBhwat7
z^-3S}M2D-LM_!Wel>(<9CE8hG6PX6?9cEms{j3V$c{=~1g}vyF-^y3B^Cr+EBLv;u
z3MHRd-u>xtcpD&LU)v2*N&s^o&qY{&<%~Da^uJPCQc0rr052M#DKeNKnaIih+pCi0
z&T2omup_*wi@@-3>H)dlvip9>qDHtGxI@S!YOWMYs#uD53}aCPB(3^K=C4pH^M3^r
zM^j8SRG0|RCB`G)>96O#JPlN(JmX64gNddj|64Hia38NW_Y%aB@3OVQJk1jpEsF?h
z>QKS#T3%xa+9~6m4P#<WeJF-l(TUD(2;r_vyH03|#eZ}3yWTA!$-UA5+c_H=$eX8*
zSA5-S?6%zn%|<3dN}T7)UHXO4=L)el)aTmA=e=5><>d^R#eFUFRe6zC!kPIiGZyIG
zu^}f3(+bnK=O;3q6UG6R+gi8syxQzbY7^o?x2OYBL&n^;pJ-_{&v9KOT?I@;chiZ>
zxk6J_PpRD(x`UifGvXAsINN;>nP@8gIE7sRs1ca&RRAH_IvO3~cMT&HEBIx>U7pJj
z?^XJ8NxWGkODGTP+bbbA4TaLN{Y@v``^$3sjT2iI&4kE>1%98M{^-SqO-$etgT~S!
zb`n1=Kf}UmC&f3Ik4mnC{SB$7KY5>VwM06u%=to)mmhi>FjT4t$ig!|VT&A>F~q?|
zbCP7!M&$uZGYzD4CQ~86PhFm_&G+@Uvgd-A?hAneZ5TVqRYwEai1>;bktPB(K=g!^
z@*d#~v$HA7PG61oQw3}^W-Czb`I+8R@1JP*aHS=56sE_EhqGN8#~T)AWD2H%#9vhB
z_PSAH{3^ZF?T?ME1!!nn1Xi4a-CoGG+HG~D+gl{xSBp0@kVm%I_(izl(2)PZf)@u?
z^d*&^ZT#b28*#iFg7nP6f6;LZKx5dLeI5|j{dBzpCc`}BB6^Jc6pp0tLYfl6{4Dk9
zmrtHXO_jE^wCIj>zrV!u@r4S0oURS)qP(f(v$#G7-c*<;TqjiA7@^M;k)TULCI%99
zB+Jr(tMcS#ZGN)C%H{;A(ml2~h2J({I(lCY%%lk66e1`4l+uY93UJOl*2O0*Q(U#r
zyyR()7X1IsKbkzcAfi?_mixzMxEmlEo=at^(F&DIz$0Tqf?4E=zQ*a^Jb5zHe~wi!
zjJ_oNY(qLIZLu*M8Foez_pps0-2<NbJ&fwD7{Ti~d+a@OhXRfRiQ@Q5rdQ<V{ma1&
z7!TVvllHMiG9RPCr>7$nIS4TC_B$XAcV8gMwc%djdp!`xhUZ-+QoQI(CVzx`GQXNx
zgWMLlGfxNvQ|=$XT=0HrrctoeyTL<Wm{``CCr@gsX1@lAifi+^YR!NAq)>2Cmhi@V
z6zx7x#J~_s1|H~6{_<!@Fqz$u()yb2#sxstmi%Q$ZjAeV#+ea&C9+hb@RP9Xb#zA^
zc;5l4JK~QH^<RF>cG%i3E?|i7BLmY$&Jz|34VV(3WMu?#sV_uZX8&}ugE3P?a_2o4
zhDlN}2UjXHn_u{3;^3l%>Mr@C!ONHfb@2~pb(h#1%M!<5(Q3%g7|O|P1s#&ff&4^s
zmpFwd?S5rHOX;|Z8=yKPQU0OvUlmd)jB7w})I|S>%z~kiligQV7nXwBH}J@8nY^M^
z(L2u3rzXT5rG|JuGXGqG$NVl`>XoX8gZczGP4541*Nf?7g~YV1D@bF@xNwBpJx6x2
zx@2=o?51(D;E-^?VlJ=oOa*UU6uyV<T!PmqWRaH5zs++}k=`vldfziS2~o1hGO$q1
ze)cgh_Dd)X5dGF^5z{Ye@a>kj;-~2-=U*q1S|Mk2#HP}!`?@Ai0xyo`i-EOC(Nxdo
zndmi`<nqwFY||?$g1kIXmjLV3T=oRLbS(eOBMztXpYD5=t5hw~sD3(yd$@h$mH~1J
z9=~O_vJR90xmt4H@P%6M5&RU~Edw@W+WmUsgIdtLYgt0%;HqFicOiOWO`DkCH1QV~
z=%DmgG++8SUN25A$qKFgsG;N8&GwbTo2DFLE!E62N5K~9&cl!7br~g8Wcq%K7gG$v
zm1=d)Eks*j18Fp&Q#-?u%c9Pev|_<)YUAf^Sr}cgg810@S0`9^I%3ncbHSN?9kBtB
zvF`j@Q@&Mk!S-4RYL-&t@CFz1968S&wtZ?__yCMPR>6h%E;=uE9<*`@Q1-rIeWoZA
ztd|n}B&8b$&!p@{s}^Vba`2@53nJ)~3Wa5hE0lx>-^wc6VRf{~H_S29E#6;l9LXJ2
z4$x)c|53cU%?ApSR&6^zNE6K!#I8oW^F6z)b6$bW^f5Wp)*}=NRCCYFn3uocq~%DV
zz=J!vgY!9(&L1?3dp)H>!6aE%*QA3f{J16=Vp^692~8i{F-c}Ao^`8&SwaCq1P=2+
zYG=o~zR3m8YZ-=PiC(L6e^X36)|}+L@DXRoRn`Sz@#2|i+d|YFG2rwhnrkGdi|g%u
zo(JMPcbclZ*@CH$_1<fGW-%Nh4xX~y5-q8p>!+BcNr2-bFC!$o*{70wvzU-Lk)b;K
ztE=Go3ZBU6LMC8xbqA1)`}J~oZ%oTz|IgICvybmWOD7xxQ8F=?;H}OMs>T!LF(Na%
znfkS0?_W41Z_-9-zPZMmK)s%U^H;nQI<-3txrmS<!+2IaI+g%Ln^qx#-|8dOY`+I|
z;=p%mN_T}SRyoeq8C5Bz!wD<yowQ7OZ(5akr=`OM#=1Bb8oPIy)l0jw!HV2Ku?pm!
zoJx(Q`1%&Os{ue8+^e^0-CC0?D6^bFFn)ZJfu-aWN70~Bso|Jij+V-LoTu5)_8m)S
z8HriFK?fp-%Gpjr8xqaci(_&E-orfac60l|+TAY(UYr!IAc?Wvrs9<}=I|=^<O~|F
zRj$%tNm@0n`kt{=4Cau&SoqD#8e|*_BvL1QReE$WDDo9knftKOmDM`ci4ikVd^HId
z7K8#M=YXKPTV~oFAACSHRJ!?-1%$6>=_BEMGGCd9tO;G8kBm~)sr%qIf`1F2K8kfU
z&4L7D8;IaIDQ){k;~wr~LG>Uqp<wMNIcTu(oSjBFvQJm{Wg|FR9l~PfByh`lzV&_N
ziQN@S^E2GNowivZUk~SX19-bAk|PkaerZ{7%ANjo&ei1J+e%I!rW>^<J&~aHP%2dP
zax+0PWJgxjzaM}Yd4GWfu1QmBcU|)w#skhESD!*27d?GM)hrh+IZAhd$y()II&$f+
zY)+<D5kn1L1lKEC-+VR}^_mgc)2mf3r9P4)hxc4Co8c<X1JG~_I=jaPu{}3^6O$;^
z)b*EYwr*(4oeN<&*_vt674+|hD?n+I@r!3_d0s7(3)6TfyRreT><(*QQH-D?x`g_S
zkavKwQb+8cC()$N3@QLX=XUjf0q%skPUCofvbsmr5_`M8y1e^_-P+bP<(q^+m~27W
zo<KBp!hKx$`)>RZvBXXY0HI}CWU9djwU=fVd2)486>5;v{CfhMe=-oJ@SQy0Tk0aj
z%i)H$e98!7RU3P}tXM&2FKO{ZK)VIeiK3oKAGL4S9!c9`1~cxIl*kL_m!m0buzD&)
zfT=kMdl~tmdv(M4VUE(g;KJLE@4F-0U8w~s1m(SltVMPb7e%k&55{o2tKA{&S_&p6
z4TAduX2vFnB%UM9=aME$@0|N8X42S#(0|6?9{l=%Atq@ZR0Q=2UWhiGFSTD$QpQc9
zu#5{WO>m%MvUQhk>E`~r|9SR-6EBd|O}&>k=G>|evK;#T==XS#U)VE|g0kn5jha$X
zw<b^i%=l6*`GME;sp7IelTsWUXRgQ;TX+OPme}@0laFN~Qw}9!zu5z-+>O($VDyNb
z&4^Cgo+bA*K2?HU|015Ut|7hO?kzGuTXd^sy@!va9AD7f6+BRoB`IE);!%!jAdWR0
zzsMf-|6{|rZk{Ycy<;`1>POw@l(rUOQ(tW6Z}bK;d}1|C=JWxoQ-!Dl)Asz~R-se-
z2!Fyc6|2d{tMi^{@;!U0gzvkp<k;u)@r3wE(=BFURIMxfR@{qoNMji)ug+|Y@{_Q%
z<Fpt)|CDiETh@f{{gcXHXjuHevG(ZhGhNh`exFxjTrr>WDpeV!Vfy%2+FcXdX?tC2
zO)F*hbKx<aSfSb5t827t+cXF|)VK3JV=xWS+WCN6NIs7G%EovTIqp{0zY-8Q^O3T>
zm@thQrthR1E>-dKiN_G!6!rvx98X;9(=Qtdj!vWRAynf}+5{MrAeh+otbjK*g;={^
z0x+1Yh-!p7)HiXQ|Ayp}_+QbZZ+OhoBR*{?CNKBh+r{5R-o{p@%_M?T%s%W;-}L5g
zxjeZb)p9pr@<5PWn9IFvS&ubgS3GgJrEO2($E(v;v$EjZ8D&%_<-2vyj{CD&dZYY?
zY#O&ObWYLt6lt&_7UcS=d>@3!810hz-Wr!d*UKWJWFiv_UY1oxvez4r^~|U{svhCK
zi?MiQ9s*u))T{ycnLIN52%FE!`J_|HMIZi5ah>IL67SBA4FluAgC8p4Z{r%tUkK|H
zww&plzOSxCO;q)Z8WGhs6eEqR!wx=_N<^Vm%gk1pU0$5V@ok8XG$L!ssa_webf&4&
zE=DE(pfEVHe4tCTcwg1!{^xOBIQgH%8+p{ufQg~QdXENv+RwRfd^cuBt!hqBrVi-5
zG`Zr{<NI>^q#+G!V}UpZde8G;|5>?{yd`Y{J+6$&R_G4yYfUTMQyr#s)T^Uu2f@)A
zt+bQw9lsj$U1ti+QtS(2l1F5A6*gO^TTz@#{hXFUK-9i<iT!?~P0C_@?!0d*%NbUy
znCgRvezS`>hB<1-;CcZ7yOm0(c3q|^3zVclLqgVx*`G@vu-HWHoR+gj@pG-44Q^BG
z#G|rh*=riFjnWgv#T(L&^tmISFlx@dH=9`83x_!_`Bsh0%CGsn%K~4ixrvxeFl$?=
zEvI{VA2jr2N2*Huw0W9;=9Q%Xd?sWi`NHt7V-FdakD)etS<0XIv(cyljiy%YKU>wm
z(1?lib_$ECr`oYH$Vb`rK_96UuTvIEE^O1|<HguSVLHI<offzcliY@wBp0p!rQ)xs
zKk<8GBuXQbV;eJRbN;ar;{V18hcwvbi#V=C&0gbV$lpgQheAL*SO+!{O$;RU!_^Ut
z6Ro%h0PR2I8Re1;d`;B5J3E$UqT)jx<|wwb7v}&6yE~?eVb3}wJ{;b0)h?Y}+QFHp
zq3z3R5?sA^_L2KT{+TEc{_~~aJXabkc3p`<7*hgmn38s`uLF-cfS)zQA@`Y3uk@>J
zze1#oilyEC#j_5u<WN%f9QkMc;i8s0vX53$ea{%ek}rX+hWD~Lpy}5!-&=Q^mlC%m
zk^|(Z+AQzL5b~9Lt*xc~NCo)(pKh-F5$f*yUrR!gElb7{l8}ZL*&^#BYltkvNc0q0
zvZc^aGGz-zlI^jVLUv;dQAWtVZ($OKY>lOS@0jU%K7Yga_1oP0p1YiT&$;KG_j$h_
zKy{Jo`l1u?w5#ouNBk^~21HkT=P|07-bk+5IQL<Sl&(yqPr`^A&&C|K`PTLAQwe6&
zN{GK&W>XZbGs2<w7HKXFHQ#>-=?9S7stI0cN4fcU>+=K?)RpURDLn6Ih@7_Vh!GsQ
zEuMLeXmnK^l)^_@q)h83qEvRaEdP;1K?08qm<<OuWi2WblDE;z!9i6%QOt9L>L!2t
zO19GI_?T`T>JJq@sNvo?*I;JR(x8pq3&Y$6h`YrV`mx(xWcTu0U-e^wd0i&=hsBIF
zRbBP=)jm6ndObX;d-C@jA7}{JztO<<V7oR;Wx4#|)14P^2+lD%_02UC&-4jw(DmOB
z)OLvTP7XTp++1gYWAs;(AZhW~0X04P;{zY6BBNE(kxvr}mMpfbrYE;*)uGzQXKse+
zc7Ik8!iUfTYaBbqUN3C1)jFbyrqv)k<V?|PMTBE(P+Y6Cswim4^1pWWsdLao?b6Bk
zu&=e|aQI6IkD>&9fp?4api!LsgvHrn{@Ap%5nT2IkL$7Q9m4huXQpxWX}L&EC-oIQ
zxXEq@vnGC8MaN_wVgpyjyX#E-b<T2gIuurvg^%SC(F}h_8`By65SZXa+*?gxKC8f|
zD!q}FAQe<@E4JzK^H|}_X?s#J`Eza7uUWs3FP6wlNgI0V`>r{<aP&<Io;;Rm<LHKs
ze&@;eH;TuVgpL)GqK5&6xk^Fb8B^gjEz(?7B%LWdnI{}yZHrvmJoO9%gn8g+jZ8Hi
z!CGtaWBwdz$HjM2`k0KHzIF~XBROc1c^v*}dw5PyrJM%igcJE6R7j{})9`B+7;<JY
z>JM^kFJS-~MT|<@S9#=5y9<-l_Yvdk{TjW~wzqPm17*gX-00C}++PzHRZL-}#?0Mh
zW2Dc$O}VVnejtk<WvoBp&P$8*ntuQ=FJ0&8!-2jnPa8T*HlC<^tm<GTf5`m4({<%c
z)-$DyRsKg|3q(%UovZ`r#L9S0GZv#l?8cGg*D%Oq&tnA&i*K0YML1Kw_6{Bu-WQJI
zDfK#mpVk)APIrxod>>+0{^{JJ1pG|=vSs@VdT?$om`xHhCA_3L_x8AXhP}rt6wfA;
zFqU6uEMwVf{81B1jHQm`m(jiD33)o)c_nK*$njC*?`o?@IXTl%eW|hS&*P4Ty~HPJ
zeVVyy^OWWaE<YgRuC-0kCf`uUd)_L;_4zr46qDuvUrTGa<KRs><e%>_s6JWxP_&cv
zulq0hK8<%P-Q<1dJY8ry%YDSHNM4hU-VT#9vnH4=`ImB2LHK7IQesADn=Z5w_R3vt
zIh(XV8C}Zt6e+75Shn_DH1>UXM1i@?id8@>Ay655cntEv9QI!Atgqtbv@L0o#1d&-
zyW%Kxwi}E$LMHD5pgcL)xRmo*pW)=KGNS4+?|`Tl)zBj(TFCYA>rxP3zRY<34TQrP
zUon0rl+*lOvVaXspv4AtoRyCzQlvE_FO=POk$YZ<TV=}fvRkx=7l}zAT?rCKx<SZq
zC*`>2>|i}j<N-l-pJL9}+&_Q#4p_lgJgm*p@>PG0(SkbhO3!XnVh3+DPBCclqvSv3
zoRb%vZ5JI?8SPkSY(wNRJFD`<(3^>Ug*jhsc6Qc@yts(3;dG><En1azM;UL^zDFsV
zpllK(Q3=XHnVe4)gYx7K&T?Xjo$QK1voc9(ZMn3*7vkmH@`{4bbBG0vBqfb4swlJF
z32YB@!;E~GzgKIYXQ(|G@x716g|1-*b<@)vdi(+tJpK#-V~{D7b<MB-i@;=qTssdI
zCFT@v%h&VjblSNI{KC5`uDa~E)`Tv_gDiO84V&@2b#>$&9?{{w3iqxhIo_;Y39(C6
zYVWSRaf~FFTg?dSs!!ka3qf!8u~wJU#S~gyj>P!CpWD}*q~jbH#wJO3*)2Ir{-`>#
z8rRVi!;C7cBt{1Pl8~>+Ifgy4O*^7sHus9}9vGM9e!~{7w2V8ls(y3c0o&`*+{txd
z#cBbZ@rnMK&{l@)u^s)U87e2~GgB48Y{vPKCoqVZ(I#ZN_O|!@0(>oBdgY51>nHkY
z*MtYz=CkS_t<#NqZC^~9TqK@yJI-@hlfhlp;9J$~IVaUh{xE;`Vg=g`1Ew8SLcql(
z-}<UOWfghTC*kYik<MS~woQVdKg;p;={3*T25Zlxqrs|ufk`bDZ1u1FYIxCnHEV;Y
zdVgOaNT}>t>r~iSx0(9d9cVk#xu`=*$8QVx9oDaBjBtFEZw;?8Wi=*?k^)+d8S5ed
zD4n!RK=@qy{Y!dzYLREdUWE5|_Txvg#5b0#vnvShJe6-A_Scm$NtUIRvS)%K2BVaI
zdJibNrkpi@-y~yEe??>LCnM9lM}GU|<zQ&5?1Auiu~mBDm6m`A{PJSBifiifYk}JX
z?L6)V-0!nx{7;mBkXzLGDP@y<CAz_WOGb>=E34Yfi1V^<@;h6lrDgSa<J(Wuh<9iF
ztPQP(7!rAZ8OWsUNAsti(XpbpAmpq=T?`Ima%pKKWWNyB_Z&@V(_vjU2`@@>xf&Yh
zcW?Qe5d+S_>u21ag@y%H*EsPzMxm7+QCEk{vMrM*#f02yTACAQFOQ<nxn=|m4kfE9
zX$+OE`^kE{j7<!-8#Jxs^4EV1m(2B^L%)bp_*|IX#BY>u5jfXj@VU9s?}yXiR<f>h
z;Iw7n=!c3$<rKGHPj|+`lAE0`cE}DD-mVt^cn{eaF%&!<i!E=lGfw4?SMV?p=xiKQ
za@e2Lc?&V_v!MIpe)Mla7x4$91c%^H${6BjbD6*5vH}i&@t{v-fjw66sx*!7_)nKb
zzLh~Dy0)L^4eV??9ue+(U^SSZ=xOLVw4?@ACn_Mf;YL;0#va9^(7fI&>P@<^_YG4b
zN9#((T4=9k0TUWCVOg!@^B0d;yc7?|uVla*syp|5C9mgL7CqiP`%#K{r6B;$<bb4!
zUhc^fq3TtK?}WiHpaO}M`jahRo9Y)2{^P?Jd3}A>pw6*y8Kl~TzHw+N@^2mJk<AK_
zU)XvU_E<d@cqbIs@67%nm`fDBo^uTA-T!WJWyRYbA4*%7N^ZTAX`XOH_0Ba>TOpx`
z`tVCy>$$;=Q9}K6WkBh#v!Kwa?N+QpYmWogeIGc`GtAOaN*wF8%$xmPLmUH`<K&C{
zOU=fR&8S{6-++OsP__cpAEu&%11I}C_yx{4Eo8!|(k|+V<dC5WKgnTDD3j~XMk#rh
z@51XmjGAU{;m^)Oi@u8vc6bH1`2PEr6N|Q19}lGv!%DvD*Yq5@YBtJiL@gu2iR_3g
zAkS|&v3s~6sC+M#FhtYvgqAb3>7Uz#66*g!sx$Pp5rjDWu|Z2BIemu=wNSFdo5k*N
zL;3NklaNqw7r)>kVeiMsuG5qu!HE~3HoFSL%?}C6zCmd$ZqmLK&Lq$w1RclZZrv$V
zpi{p|cCv%R|5jvK5+&;01rCW)+Qs~ahnKs+J`0v!X<q`h+0<)rTrP1ve96U#o@b6!
z5+Cpoisj*=4RAuj{6h*Dv`Kqfgh5xWI7#kxH5;{50~(`gHq30)zoJ%ylCm@bGnuk;
zX3SOF(vZS#7fAj36UNE%3iJ&`ftkn?oX}s{1+Vx7k3?6YaZ_8hnFFN=GXZ_0TbXag
zRIMVf&52hOwIxPZQ#o)j7dZlh-Whm;nbxzeAEbTnDhR&6OPx$k@Y25UhU=_1^&<%P
zlV&quni3htf>26P8Yr}2M()t{pdl(5lCcUbj@M=N*nX)YFf85kUD>zw3)x1KkqQHW
zNW(6~_X4g?A%k1KFS*zh1qYj`9l68gf23=u!jy*${fh3l=~K1T$)vi&Nrrw!Y?i-r
zSIEfi__P0R2RON;Nrr9|VzFiH9tk^w>FHRKIAkQ;1=2*ZRxQay{;7Nge+zDy&xr*u
zA~1a<`FGM-{J(PjIJ-@YC{Y*bW0#G>3N4S}gDkGaDGeZ|uIU}34$BNK(cg*F&G>D%
zzKtJ;L$Abbc=w6>;j%V7p4jcfQ91)=hNL~^2AmId4Xt-ZD%te!{F)Pe?N_jTM=@p^
zrU>k!A1cB4VR65Nw9+1U3*AM5=iLib@+F{_OLq1skoX_Qv=8LaD+Q^S|0pB?TzVv`
zTmk0Ff4pnP|1u5%@c2KjHMPS3myI_$xl&o_zW+x<r&ee}a<nH=Wd<ZJGS~VesWf~5
zJpK4i=T8-vRES;N!vlc#QAH3%%X9RYYi;-;DJcaPGFIT#QCyu$$@lCFWX0o+wTlqn
ztyV*=FXK?Wz5q=>!@#~<lqzFD()!5*&@A+KD61yf^}sGrZV9MO#Qj;kwd?gK;vgm8
z1p;)+$VgR>gZW`i>PMA!e`1(VPsC?J(n{lUJvs_?pK(fcuTrTQR6NP^RQkUQB@HK3
zNziD7a7<EmLQeM$LVV@{T3{@E_|HQNZ>kpbgy=!4TATfD<3O_HP@qTODPa6UZ)A>A
z^u6Tm3ceoNFNu#o87TUdYWsR3-kpXC7Inr@1?Fwd6IhW`EdkVIM-NF-hFYnDS|N4`
zba!E&_t+u;ddYCPf~uj<tok;NNJG9wE@AK2*1QxRJ4~fY#q@}sR-^sG9$LWQY)9S2
zm_)@|vHaKhtN>|NSwk7tQsR(e?E@lo&(;1MC3SADbK5ahCgK2%_JW~sGRA$479~EM
zV3&=+CdAMHx`J@*3DL>)_moD2&wShFsMx~4yML1gl;fQVM=0gRBRv~OmXmsR9${;9
z5uhV|4tthL2M3B(Ds)c26`3?%1DIt0XgVb2FH1OsIF%bOFFV0RxlhiJ26Gp^16K#q
zwV7+Sr9>jlIKVe!=4$^p<CMBQ&y*#-sW2lbom_Fy5yVv!@OBF(kCGwpw~T4g7n!^O
z7{Ir>Fl@Qm-;@g1cRw*L(kmenzGymtTeX5QW->51<%|_QQSZQwiy<@^fpRRCGlWtz
zE@LEgG0je7QbQAwD+da+R)!s^2AR0}d`a)taX<%LE-IFh<V4O%QWg#*-gY4!p-01m
zUzfnuE_x+5b+;Gba)W;&o()3-1a<#(ym!Ey^5|YN0V)~e?@RdtADM$0q{#29mjOn}
zMzgUmn0lNjcgG4`a^+^XV3(DZ19kgr!mt*PDQ3COVP0~ZLxFVb*?lO}2uIdxn;gmp
z2T>&pj!}c>v>V4f8E5jfnZZXru^KG)o&@z67%J#Hf6#6^%tlX?0bJ6<BUIY|5WV(4
zM#<bQmh{FbL}5iW_JT{gH2u&qJT*_95zIcdJA@ym5m({X<^ZprR94ULqi(SRDWkhN
z^QxkgTUe5jCgPAK;LY@7t;%xvt)oFP%yn<QD(1f^c45y(U>!tRK>CwPTy^IxbxkOh
zv$O-cwyYENIdp1;gUw!lc7|e?FCqR?E@x|51!wEk%ZUsiFFH>Cj?@z6_*S!f$Q^h+
zV;p}`)1Q+)w4q-N2wP7T;D@&5DFa`1f*ES1*QFRw^0ztBs9lOvSX#a>LzOa%E)%(u
zNbmV1CA(qZ6yQxN&iJy0@ToWhb9KpJxp;jd{!-WQey2D(S<VrAFg_ZmFdQQ&w7g=&
zM_EUS^RpB2iNzX7Q-LdBoYSDdF*lv6y;@<|9oo1sw_gN%+1;J4t7WM9RvjJuf3D=q
Ao&W#<

literal 0
HcmV?d00001


From ff976cc7f8bfa86d2f9ede36592d19d62eeac648 Mon Sep 17 00:00:00 2001
From: Steven Crespo <steven.crespo@rancher.com>
Date: Wed, 30 Sep 2020 16:05:29 -0700
Subject: [PATCH 217/265] Update _index.md

Update documentation to include step for CRDs cleanup before installing v2 OPA in Rancher v2.5
---
 content/rancher/v2.x/en/opa-gatekeper/_index.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md
index 8d08d3ed087..31a1d481a5c 100644
--- a/content/rancher/v2.x/en/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md
@@ -30,8 +30,7 @@ OPA Gatekeeper is made available via Rancher's Helm system chart, and it is inst
 
 # Enabling OPA Gatekeeper in a Cluster
 
-In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper from the old UI, then reinstall it in Rancher v2.5.
-
+In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper and its CRDs from the old UI, then reinstall it in Rancher v2.5. To uninstall the CRDs run the following command in the kubectl console `kubectl delete crd configs.config.gatekeeper.sh constrainttemplates.templates.gatekeeper.sh`
 {{% tabs %}}
 {{% tab "Rancher v2.5" %}}
 

From 80599a08b9d84bd134a37f9955d07530c92dd701 Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Tue, 15 Sep 2020 02:06:57 -0700
Subject: [PATCH 218/265] Adding first pass documentation

---
 content/rancher/v2.x/en/istio/_index.md       |  73 +++-
 .../v2.x/en/istio/cluster-istio/_index.md     |  85 +++++
 .../v2.x/en/istio/disabling-istio/_index.md   |  31 ++
 content/rancher/v2.x/en/istio/rbac/_index.md  |  30 ++
 .../v2.x/en/istio/release-notes/_index.md     |  20 ++
 .../rancher/v2.x/en/istio/resources/_index.md |  92 +++++
 content/rancher/v2.x/en/istio/setup/_index.md |  30 ++
 .../en/istio/setup/deploy-workloads/_index.md | 324 ++++++++++++++++++
 .../setup/enable-istio-in-cluster/_index.md   |  41 +++
 .../setup/enable-istio-in-namespace/_index.md |  43 +++
 .../v2.x/en/istio/setup/gateway/_index.md     | 132 +++++++
 .../en/istio/setup/node-selectors/_index.md   |  40 +++
 .../setup/set-up-traffic-management/_index.md |  63 ++++
 .../en/istio/setup/view-traffic/_index.md     |  28 ++
 14 files changed, 1031 insertions(+), 1 deletion(-)
 create mode 100644 content/rancher/v2.x/en/istio/cluster-istio/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/disabling-istio/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/rbac/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/release-notes/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/resources/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/gateway/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/node-selectors/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md
 create mode 100644 content/rancher/v2.x/en/istio/setup/view-traffic/_index.md

diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
index 935eb2e0b2d..d2f6c8db74a 100644
--- a/content/rancher/v2.x/en/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -1,4 +1,75 @@
 ---
 title: Istio
 weight: 15
----
\ No newline at end of file
+---
+
+_Available as of v2.5.0_
+
+[Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
+
+As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
+
+Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+
+This service mesh provides features that include but are not limited to the following:
+
+- Traffic management features
+- Enhanced monitoring and tracing
+- Service discovery and routing
+- Secure connections and service-to-service authentication with mutual TLS
+- Load balancing
+- Automatic retries, backoff, and circuit breaking
+
+After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
+
+Rancher's Istio integration comes with support for the following addon(s):
+
+- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
+
+# What's New
+
+The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
+
+Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin ) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
+
+A Prometheus integration will still be available through an installation of Rancher Monitoring (insert link here), or by installing your own prometheus operator. Rancher's Istio chart will also install kiali by default to ensure you can get a full picture of your microservice out of the box.
+
+Istio has migrated away from Helm as a way to install Istio and now provides installation through the Istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a helm chart that utilizes the Istioctl binary to manage your Istio installation.
+
+This helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it ca be used in the project.
+
+# Prerequisites
+
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory](instert new url here) to run all of the components of Istio.
+
+# Setup Guide
+
+Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
+
+# Disabling Istio
+
+To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+
+# Architecture
+
+Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
+
+Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
+
+Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
+
+When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
+
+For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
+
+### Multiple Ingresses
+
+By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
+
+![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
+
+Additional Ingresses can be configured via the [overlay file] (overlay file link here)
+
+### Egress Support
+
+By default an Egress gateway is not installed, but can be configured via the [overlay file] (overlay file link here)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/cluster-istio/_index.md b/content/rancher/v2.x/en/istio/cluster-istio/_index.md
new file mode 100644
index 00000000000..9634043898d
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/cluster-istio/_index.md
@@ -0,0 +1,85 @@
+---
+title: Istio
+weight: 5
+
+---
+_Available as of v2.5.0_
+
+> If you are usnig a rancher version less than v2.5.0, the older way of setting up Istio is documented in [this section]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
+
+ [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
+
+ As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
+
+Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+
+This service mesh provides features that include but are not limited to the following:
+
+- Traffic management features
+- Enhanced monitoring and tracing
+- Service discovery and routing
+- Secure connections and service-to-service authentication with mutual TLS
+- Load balancing
+- Automatic retries, backoff, and circuit breaking
+
+After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
+
+Rancher's Istio integration comes with comprehensive visualization aids:
+
+- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
+
+Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project.
+
+# Prerequisites
+
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
+
+# Setup Guide
+
+Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
+
+# Disabling Istio
+
+To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+
+# Accessing Visualizations
+
+> By default, only cluster owners have access to Jaeger and Kiali. For instructions on how to allow project members to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
+
+After Istio is set up in a cluster, Grafana, Prometheus, Jaeger, and Kiali are available in the Rancher UI.
+
+Your access to the visualizations depend on your role. Grafana and Prometheus are only available for cluster owners. The Kiali and Jaeger UIs are available only to cluster owners by default, but cluster owners can allow project members to access them by editing the Istio settings. When you go to your project and click **Resources > Istio,** you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
+
+To see the visualizations, go to the cluster where Istio is set up and click **Tools > Istio.** You should see links to each UI at the top of the page.
+
+You can also get to the visualization tools from the project view.
+
+# Viewing the Kiali Traffic Graph
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. If you are a cluster owner, you can go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
+
+# Viewing Traffic Metrics
+
+Istio’s monitoring features provide visibility into the performance of all your services.
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.** Cluster owners can see all of the metrics, while project members can see a subset of the metrics.
+
+# Architecture
+
+Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
+
+Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
+
+Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
+
+When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
+
+For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
+
+### Two Ingresses
+
+By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
+
+![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
diff --git a/content/rancher/v2.x/en/istio/disabling-istio/_index.md b/content/rancher/v2.x/en/istio/disabling-istio/_index.md
new file mode 100644
index 00000000000..3457d3fd51d
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/disabling-istio/_index.md
@@ -0,0 +1,31 @@
+---
+title: Disabling Istio
+weight: 4
+
+---
+
+This section describes how to uninstall Istio in a cluster or disable a namespace, or workload.
+
+# Uninstall Istio in a Cluster
+
+To Uninstall Istio,
+
+1. From Dashboard UI, navigate to **Installed Apps** in **Apps & Marketplace** and locate the rancher-istio installation
+1. Select all the apps in the `istio-system` namespace and click  **Delete**. 
+
+**Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster. 
+
+**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual yamls to refer to. 
+
+# Disable Istio in a Namespace
+
+1. From the **Cluster Explorer** view, use the side-nav to select **Namespaces** page 
+1. On the **Namespace** page, you will see a list of namespaces. Go to the namespace where you want to disable and click the select **Edit as Form** or **Edit as Yaml**
+1. Remove the `istio-injection=enabled` label from the namespace
+1. Click **Save**
+
+**Result:** When workloads are deployed in this namespace, they will not have the Istio sidecar.
+
+# Remove the Istio Sidecar from a Workload
+
+Disable Istio in the namespace, then redeploy the workloads with in it. They will be deployed without the Istio sidecar.
diff --git a/content/rancher/v2.x/en/istio/rbac/_index.md b/content/rancher/v2.x/en/istio/rbac/_index.md
new file mode 100644
index 00000000000..2df5676cd34
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/rbac/_index.md
@@ -0,0 +1,30 @@
+---
+title: Role-based Access Control
+weight: 3
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/rbac
+---
+
+This section describes the permissions required to access Istio features.
+
+## Admin and Edit access
+
+By default, only Admin and Edit roles can:
+
+- Install Istio for the cluster
+- Configure resource allocations for Istio
+- Enable and disable Istio sidecar auto-injection for namespaces
+- Add the Istio sidecar to workloads
+- View the traffic metrics and traffic graph for the cluster
+- Configure Istio's resources (such as the gateway, destination rules, or virtual services)
+
+# Summary of Default Permissions for Kubernetes Default roles
+
+| Permission                         | Admin | Edit | View |
+|------------------------------------------|----------------|----------------|-----------------|
+| Enable and disable Istio for the cluster | ✓              | ✓              |                 |
+| Configure Istio resource limits          | ✓              | ✓              |                 |
+| Enable and disable Istio for a namespace | ✓              | ✓              |                 |
+| Enable and disable Istio on workloads    | ✓              | ✓              |                 |
+| Configure Istio with `kubectl`           | ✓              | ✓              |                 |
+| View Istio project dashboard, including traffic metrics* | ✓          | ✓              | ✓            |
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/release-notes/_index.md b/content/rancher/v2.x/en/istio/release-notes/_index.md
new file mode 100644
index 00000000000..52962b8596c
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/release-notes/_index.md
@@ -0,0 +1,20 @@
+---
+title: Release Notes
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/release-notes
+---
+
+
+# Istio 1.5.8
+
+### Important note on 1.5.x versions
+
+When upgrading from any 1.4 version of Istio to any 1.5 version, the Rancher installer will delete several resources in order to complete the upgrade, at which point they will be immediately re-installed. This includes the `istio-reader-service-account`. If your Istio installation is using this service account be aware that any secrets tied to the service account will be deleted. Most notably this will **break specific [multi-cluster deployments](https://archive.istio.io/v1.4/docs/setup/install/multicluster/)**. Downgrades back to 1.4 are not possible.
+
+See the official upgrade notes for additional information on the 1.5 release and upgrading from 1.4: https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/
+
+> **Note:** Rancher continues to use the Helm installation method, which produces a different architecture from an istioctl installation.
+
+### Known Issues
+
+* The Kiali traffic graph is currently not working [#24924](https://github.com/istio/istio/issues/24924)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/resources/_index.md b/content/rancher/v2.x/en/istio/resources/_index.md
new file mode 100644
index 00000000000..fc6ea7f46e1
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/resources/_index.md
@@ -0,0 +1,92 @@
+---
+title: CPU and Memory Allocations
+weight: 1
+aliases:
+  - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/
+  - /rancher/v2.x/en/project-admin/istio/config/
+  - /rancher/v2.x/en/cluster-admin/tools/istio/resources
+---
+_Available as of v2.5.0_
+
+This section describes the minimum recommended computing resources for the Istio components in a cluster.
+
+The CPU and memory allocations for each component are [configurable.](#configuring-resource-allocations)
+
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough CPU and memory to run all of the components of Istio.
+
+> **Tip:** In larger deployments, it is strongly advised that the infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
+
+The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each central Istio component.
+
+In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
+
+Workload | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable
+---------|---------------|---------------|-------------|-------------|-------------
+istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | Y
+ istio-telemetry | 1000m         | 10214Mi        | 4800m       | 4096Mi      | Y        
+ istio-policy | 1000m         | 1024Mi        | 4800m       | 4096Mi      | Y      
+istio-ingressgateway | 2000m | 1024Mi  | 10m |  40Mi | Y                   
+ Others          | 500m          | 500Mi         | -         | -         | Y           
+ **Total**       | **4500m**         | **5620Mi**        | **>12300m**         | **>14848Mi**         | **-**   
+
+
+# Configuring Resource Allocations
+
+You can individually configure the resource allocation for each type of Istio component. This section includes the default resource allocations for each component.
+
+To make it easier to schedule the workloads to a node, a cluster administrator can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
+
+You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/docs/concepts/what-is-istio).
+
+To configure the resources allocated to an Istio component,
+
+1. In Rancher Dashboard, navigate to your Istio installation in Apps & Marketplace
+1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file](link to overlayfile install instructions). 
+1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
+1. Click **Upgrade.** to rollout changes
+
+**Result:** The resource allocations for the Istio components are updated.
+
+## Istiod
+
+[Istiod](https://istio.io/latest/docs/ops/deployment/architecture/#istiod)  provides the following:
+
+- Authentication configuration
+- Service discovery for the Envoy sidecars
+- Traffic management capabilities for intelligent routing (A/B tests and canary rollouts)
+- Configuration for resiliency (timeouts, retries, circuit breakers, etc)
+
+For more information on Istiod, refer to the [documentation](https://istio.io/latest/docs/ops/deployment/architecture/#components).
+
+## Tracing
+
+[Distributed tracing](https://istio.io/latest/docs/tasks/observability/distributed-tracing/overview/) enables users to track a request through a service mesh. This makes it easier to troubleshoot problems with latency, parallelism and serialization.
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Enable Tracing | Whether or not to deploy the istio-tracing. | Yes | True
+Tracing CPU Limit | CPU resource limit for the istio-tracing pod.  | Yes      | 500
+Tracing CPU Reservation | CPU reservation for the istio-tracing pod. | Yes      | 100
+Tracing Memory Limit | Memory resource limit for the istio-tracing pod. | Yes      | 1024
+Tracing Memory Reservation | Memory resource requests for the istio-tracing pod.  | Yes      | 100
+Tracing Selector | Ability to select the nodes in which tracing pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
+
+## Ingress Gateway
+
+The Istio gateway allows Istio features such as monitoring and route rules to be applied to traffic entering the cluster. This gateway is a prerequisite for outside traffic to make requests to Istio.
+
+For more information, refer to the [documentation](https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/).
+
+Option | Description| Required | Default
+-------|------------|-------|-------
+Enable Ingress Gateway | Whether or not to deploy the istio-ingressgateway. | Yes      | False
+Service Type of Istio Ingress Gateway | How to expose the gateway. You can choose NodePort or Loadbalancer | Yes      | NodePort
+Http2 Port | The NodePort for http2 requests  | Yes      | 31380
+Https Port | The NodePort for https requests  | Yes      | 31390
+Load Balancer IP | Ingress Gateway Load Balancer IP | No       | n/a
+Load Balancer Source Ranges | Ingress Gateway Load Balancer Source Ranges | No       | n/a
+Ingress Gateway CPU Limit | CPU resource limit for the istio-ingressgateway pod. | Yes      | 2000
+Ingress Gateway CPU Reservation | CPU reservation for the istio-ingressgateway pod. | Yes      | 100
+Ingress Gateway Memory Limit | Memory resource limit for the istio-ingressgateway pod. | Yes      | 1024
+Ingress Gateway Memory Reservation | Memory resource requests for the istio-ingressgateway pod. | Yes      | 128
+Ingress Gateway Selector | Ability to select the nodes in which istio-ingressgateway pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
diff --git a/content/rancher/v2.x/en/istio/setup/_index.md b/content/rancher/v2.x/en/istio/setup/_index.md
new file mode 100644
index 00000000000..ab842cf4f30
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/_index.md
@@ -0,0 +1,30 @@
+---
+title: Setup Guide
+weight: 2
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup
+---
+
+This section describes how to enable Istio and start using it in your projects.
+
+This section assumes that you have Rancher installed, and you have a Rancher-provisioned Kubernetes cluster where you would like to set up Istio.
+
+If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below.
+
+> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
+
+1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster)
+1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
+1. [Select the nodes where the main Istio components will be deployed.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
+1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
+1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
+1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
+1. [Generate traffic and see Istio in action.](#generate-traffic-and-see-istio-in-action)
+
+# Prerequisites
+
+This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v2.x/en/installation) and you have already [provisioned a separate Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning) on which you will install Istio.
+
+The nodes in your cluster must meet the [CPU and memory requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/)
+
+The workloads and services that you want to be controlled by Istio must meet [Istio's requirements.](https://istio.io/docs/setup/additional-setup/requirements/)
diff --git a/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md b/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
new file mode 100644
index 00000000000..e1338e861bf
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
@@ -0,0 +1,324 @@
+---
+title: 4. Add Deployments and Services with the Istio Sidecar
+weight: 4
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads
+---
+
+> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have Istio enabled.  
+
+Enabling Istio in a namespace only enables automatic sidecar injection for new workloads. To enable the Envoy sidecar for existing workloads, you need to enable it manually for each workload.
+
+To inject the Istio sidecar on an existing workload in the namespace, go to the workload, click the **&#8942;,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
+
+Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see istio-init and istio-proxy alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
+
+### 3. Add Deployments and Services
+
+Next we add the Kubernetes resources for the sample deployments and services for the BookInfo app in Istio's documentation.
+
+1. Go to the project inside the cluster you want to deploy the workload on.
+1. In Workloads, click **Import YAML.**
+1. Copy the below resources into the form.
+1. Click **Import.**
+
+This will set up the following sample resources from Istio's example BookInfo app:
+
+Details service and deployment:
+
+- A `details` Service
+- A ServiceAccount for `bookinfo-details`
+- A `details-v1` Deployment
+
+Ratings service and deployment:
+
+- A `ratings` Service
+- A ServiceAccount for `bookinfo-ratings`
+- A `ratings-v1` Deployment
+
+Reviews service and deployments (three versions):
+
+- A `reviews` Service
+- A ServiceAccount for `bookinfo-reviews`
+- A `reviews-v1` Deployment
+- A `reviews-v2` Deployment
+- A `reviews-v3` Deployment
+
+Productpage service and deployment:
+
+This is the main page of the app, which will be visible from a web browser. The other services will be called from this page.
+
+- A `productpage` service
+- A ServiceAccount for `bookinfo-productpage`
+- A `productpage-v1` Deployment
+
+### Resource YAML
+
+```yaml
+# Copyright 2017 Istio Authors
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+##################################################################################################
+# Details service
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: details
+  labels:
+    app: details
+    service: details
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: details
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-details
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: details-v1
+  labels:
+    app: details
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: details
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: details
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-details
+      containers:
+      - name: details
+        image: docker.io/istio/examples-bookinfo-details-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+##################################################################################################
+# Ratings service
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: ratings
+  labels:
+    app: ratings
+    service: ratings
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: ratings
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-ratings
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ratings-v1
+  labels:
+    app: ratings
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ratings
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: ratings
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-ratings
+      containers:
+      - name: ratings
+        image: docker.io/istio/examples-bookinfo-ratings-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+##################################################################################################
+# Reviews service
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: reviews
+  labels:
+    app: reviews
+    service: reviews
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: reviews
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-reviews
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: reviews-v1
+  labels:
+    app: reviews
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: reviews
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: reviews
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-reviews
+      containers:
+      - name: reviews
+        image: docker.io/istio/examples-bookinfo-reviews-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: reviews-v2
+  labels:
+    app: reviews
+    version: v2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: reviews
+      version: v2
+  template:
+    metadata:
+      labels:
+        app: reviews
+        version: v2
+    spec:
+      serviceAccountName: bookinfo-reviews
+      containers:
+      - name: reviews
+        image: docker.io/istio/examples-bookinfo-reviews-v2:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: reviews-v3
+  labels:
+    app: reviews
+    version: v3
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: reviews
+      version: v3
+  template:
+    metadata:
+      labels:
+        app: reviews
+        version: v3
+    spec:
+      serviceAccountName: bookinfo-reviews
+      containers:
+      - name: reviews
+        image: docker.io/istio/examples-bookinfo-reviews-v3:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+##################################################################################################
+# Productpage services
+##################################################################################################
+apiVersion: v1
+kind: Service
+metadata:
+  name: productpage
+  labels:
+    app: productpage
+    service: productpage
+spec:
+  ports:
+  - port: 9080
+    name: http
+  selector:
+    app: productpage
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bookinfo-productpage
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: productpage-v1
+  labels:
+    app: productpage
+    version: v1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: productpage
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: productpage
+        version: v1
+    spec:
+      serviceAccountName: bookinfo-productpage
+      containers:
+      - name: productpage
+        image: docker.io/istio/examples-bookinfo-productpage-v1:1.15.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 9080
+---
+```
+
+### [Next: Set up the Istio Gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
new file mode 100644
index 00000000000..fd6b5a91f69
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
@@ -0,0 +1,41 @@
+---
+title: 1. Enable Istio in the Cluster
+weight: 1
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster
+---
+
+This cluster uses the default Nginx controller to allow traffic into the cluster.
+
+Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. 
+ - Admin
+ - Edit
+
+> If the cluster has a Pod Security Policy enabled there are [prerequisites steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
+
+1. From the Rancher Dashboard's **Cluster Explorer** view, navigate to available Charts in **Apps & Marketplace** 
+1. Select the Istio chart from the rancher provided charts
+1. Optional: Configure member access and [resource limits]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/) for the Istio components. Ensure you have enough resources on your worker nodes to enable Istio.
+1. Optional: Make additional configuration changes to values.yaml if needed
+1. Optional: Add additioanl resources or configuartion via the [overlay file](link to overlay file)
+1. Click **Install**.
+
+**Result:** Istio is installed at the cluster level.
+
+The Istio application, `rancher-istio`, is added as an application to the cluster's `system` project.
+
+When Istio is installed in the cluster, the label for Istio sidecar auto injection,`istio-injection=enabled`, will be automatically added to each new namespace in this cluster. This automatically enables Istio sidecar injection in all new workloads that are deployed in those namespaces. You will need to manually enable Istio in preexisting namespaces and workloads.
+
+### [Next: Enable Istio in a Namespace]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
+
+
+### Advanced Config Options
+
+## Overlay File
+
+An Overlay File is designed to support extensive configation of your Istio installation. It allows you to make changes to any values available in the [IstioOperator API](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/). This will ensure you can customize the default installation to fit any scenario. 
+
+The Overlay File will add configuration ontop of the default installation that is provided from the Istio chart installation. This means you do not need to redefine the components that already defined for installation. 
+
+For more information on Overlay Files, refer to the (documentation)[https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings]
+
diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md
new file mode 100644
index 00000000000..3eca4d8ec98
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md
@@ -0,0 +1,43 @@
+---
+title: 2. Enable Istio in a Namespace
+weight: 2
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace
+---
+
+You will need to manually enable Istio in each namespace that you want to be tracked or controlled by Istio. When Istio is enabled in a namespace, the Envoy sidecar proxy will be automatically injected into all new workloads that are deployed in the namespace.
+
+This namespace setting will only affect new workloads in the namespace. Any preexisting workloads will need to be re-deployed to leverage the sidecar auto injection.
+
+> **Prerequisite:** To enable Istio in a namespace, the cluster must have Istio installed.  
+
+1. In the Rancher Dashboard, open the kubectl shell
+1. Then run `kubectl label namespace <namespace> istio-injection=enabled`
+
+**Result:** The namespace now has the label `istio-injection=enabled`. All new workloads deployed in this namespace will have the Istio sidecar injected by default.
+
+### Verifying that Automatic Istio Sidecar Injection is Enabled
+
+To verify that Istio is enabled, deploy a hello-world workload in the namespace. Go to the workload and click the pod name. In the **Containers** section, you should see the `istio-proxy` container.
+
+### Excluding Workloads from Being Injected with the Istio Sidecar
+
+If you need to exclude a workload from getting injected with the Istio sidecar, use the following annotation on the workload:
+
+```
+sidecar.istio.io/inject: “false”
+```
+
+To add the annotation to a workload,
+
+1. From the **Cluster Explorer** view, use the side-nav to select the **Overview** page for workloads
+1. Go to the workload that should not have the sidecar and edit as yaml
+1. Add the following key, value `sidecar.istio.io/inject: false` as an annotation on the workload
+1. Click **Save.**
+
+**Result:** The Istio sidecar will not be injected into the workload.
+
+> **NOTE:** If you are having issues with a Job you deployed not completing, you will need to add this annotation to your pod using the provided steps. Since Istio Sidecars run indefinitely, a Job cannot be considered complete even after its task has completed. 
+
+
+### [Next: Select the Nodes ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/setup/gateway/_index.md b/content/rancher/v2.x/en/istio/setup/gateway/_index.md
new file mode 100644
index 00000000000..60f8780fd65
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/gateway/_index.md
@@ -0,0 +1,132 @@
+---
+title: 5. Set up the Istio Gateway
+weight: 5
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway
+---
+
+The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. 
+
+You can use the NGINX ingress controller with or without Istio installed. If this is the only gateway to your cluster, Istio will be able to route traffic from service to service, but Istio will not be able to receive traffic from outside the cluster.
+
+To allow Istio to receive external traffic, you need to enable Istio's gateway, which works as a north-south proxy for external traffic. When you enable the Istio gateway, the result is that your cluster will have two ingresses.
+
+You will also need to set up a Kubernetes gateway for your services. This Kubernetes resource points to Istio's implementation of the ingress gateway to the cluster.
+
+You can route traffic into the service mesh with a load balancer or just Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
+
+For more information on the Istio gateway, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/gateway/) 
+
+![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
+
+# Enable the Istio Gateway
+
+The ingress gateway is a Kubernetes service that will be deployed in your cluster. There is only one Istio gateway per cluster.
+
+1. Go to the cluster where you want to allow outside traffic into Istio.
+1. Click **Tools > Istio.**
+1. Expand the **Ingress Gateway** section.
+1. Under **Enable Ingress Gateway,** click **True.** The default type of service for the Istio gateway is NodePort. You can also configure it as a [load balancer.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/)
+1. Optionally, configure the ports, service types, node selectors and tolerations, and resource requests and limits for this service. The default resource requests for CPU and memory are the minimum recommended resources.
+1. Click **Save.**
+
+**Result:** The gateway is deployed, which allows Istio to receive traffic from outside the cluster.
+
+# Add a Kubernetes Gateway that Points to the Istio Gateway
+
+To allow traffic to reach Ingress, you will also need to provide a Kubernetes gateway resource in your YAML that points to Istio's implementation of the ingress gateway to the cluster.
+
+1. Go to the namespace where you want to deploy the Kubernetes gateway and click **Import YAML.**
+1. Upload the gateway YAML as a file or paste it into the form. An example gateway YAML is provided below.
+1.  Click **Import.**
+
+```yaml
+apiVersion: networking.istio.io/v1alpha3
+kind: Gateway
+metadata:
+  name: bookinfo-gateway
+spec:
+  selector:
+    istio: ingressgateway # use istio default controller
+  servers:
+    - port:
+        number: 80
+        name: http
+        protocol: HTTP
+      hosts:
+        - "*"
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: bookinfo
+spec:
+  hosts:
+  - "*"
+  gateways:
+  - bookinfo-gateway
+  http:
+  - match:
+    - uri:
+        exact: /productpage
+    - uri:
+        prefix: /static
+    - uri:
+        exact: /login
+    - uri:
+        exact: /logout
+    - uri:
+        prefix: /api/v1/products
+    route:
+    - destination:
+        host: productpage
+        port:
+          number: 9080
+```
+
+**Result:** You have configured your gateway resource so that Istio can receive traffic from outside the cluster.
+
+Confirm that the resource exists by running:
+```
+kubectl get gateway -A
+```
+
+The result should be something like this:
+```
+NAME               AGE
+bookinfo-gateway   64m
+```
+
+### Access the ProductPage Service from a Web Browser
+
+To test and see if the BookInfo app deployed correctly, the app can be viewed a web browser using the Istio controller IP and port, combined with the request name specified in your Kubernetes gateway resource:
+
+`http://<IP of Istio controller>:<Port of istio controller>/productpage`
+
+To get the ingress gateway URL and port,
+
+1. Go to the `System` project in your cluster.
+1. Within the `System` project, go to `Resources` > `Workloads` then scroll down to the `istio-system` namespace. 
+1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Under the name of this workload, you should see links, such as `80/tcp`.
+1. Click one of those links. This should show you the URL of the ingress gateway in your web browser. Append `/productpage` to the URL.
+
+**Result:** You should see the BookInfo app in the web browser.
+
+For help inspecting the Istio controller URL and ports, try the commands the [Istio documentation.](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#determining-the-ingress-ip-and-ports)
+
+# Troubleshooting
+
+The [official Istio documentation](https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/#troubleshooting) suggests `kubectl` commands to inspect the correct ingress host and ingress port for external requests.
+
+### Confirming that the Kubernetes Gateway Matches Istio's Ingress Controller
+
+You can try the steps in this section to make sure the Kubernetes gateway is configured properly.
+
+In the gateway resource, the selector refers to Istio's default ingress controller by its label, in which the key of the label is `istio` and the value is `ingressgateway`.  To make sure the label is appropriate for the gateway, do the following:
+
+1. Go to the `System` project in your cluster.
+1. Within the `System` project, go to the namespace `istio-system`. 
+1. Within `istio-system`, there is a workload named `istio-ingressgateway`.
+1. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
+
+### [Next: Set up Istio's Components for Traffic Management]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
diff --git a/content/rancher/v2.x/en/istio/setup/node-selectors/_index.md b/content/rancher/v2.x/en/istio/setup/node-selectors/_index.md
new file mode 100644
index 00000000000..f226580b0de
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/node-selectors/_index.md
@@ -0,0 +1,40 @@
+---
+title: 3. Select the Nodes Where Istio Components Will be Deployed
+weight: 3
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors
+---
+
+> **Prerequisite:** Your cluster needs a worker node that can designated for Istio. The worker node should meet the [resource requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources)
+
+This section describes how use node selectors to configure Istio components to be deployed on a designated node.
+
+In larger deployments, it is strongly advised that Istio's infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
+
+# Adding a Label to the Istio Node
+
+First, add a label to the node where Istio components should be deployed. This label can have any key-value pair. For this example, we will use the key `istio` and the value `enabled`.
+
+1. From the cluster view, go to the **Nodes** tab.
+1. Go to a worker node that will host the Istio components and click **&#8942; > Edit.**
+1. Expand the **Labels & Annotations** section.
+1. Click **Add Label.**
+1. In the fields that appear, enter `istio` for the key and `enabled` for the value.
+1. Click **Save.**
+
+**Result:** A worker node has the label that will allow you to designate it for Istio components.
+
+# Configuring Istio Components to Use the Labeled Node
+
+Configure each Istio component to be deployed to the node with the Istio label. Each Istio component can be configured individually, but in this tutorial, we will configure all of the components to be scheduled on the same node for the sake of simplicity.
+
+For larger deployments, it is recommended to schedule each component of Istio onto separate nodes.
+
+1. From the cluster view, click **Tools > Istio.**
+1. Expand the **Pilot** section and click **Add Selector** in the form that appears. Enter the node selector label that you added to the Istio node. In our case, we are using the key `istio` and the value `enabled.`
+1. Repeat the previous step for the **Mixer** and **Tracing** sections.
+1. Click **Save.**
+
+**Result:** The Istio components will be deployed on the Istio node.
+
+### [Next: Add Deployments and Services]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md b/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md
new file mode 100644
index 00000000000..b9d44ea7193
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md
@@ -0,0 +1,63 @@
+---
+title: 6. Set up Istio's Components for Traffic Management
+weight: 6
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management
+---
+
+A central advantage of traffic management in Istio is that it allows dynamic request routing. Some common applications for dynamic request routing include canary deployments and blue/green deployments. The two key resources in Istio traffic management are *virtual services* and *destination rules*.
+
+- [Virtual services](https://istio.io/docs/reference/config/networking/v1alpha3/virtual-service/) intercept and direct traffic to your Kubernetes services, allowing you to divide percentages of traffic from a request to different services. You can use them to define a set of routing rules to apply when a host is addressed.
+- [Destination rules](https://istio.io/docs/reference/config/networking/v1alpha3/destination-rule/) serve as the single source of truth about which service versions are available to receive traffic from virtual services. You can use these resources to define policies that apply to traffic that is intended for a service after routing has occurred.
+
+This section describes how to add an example virtual service that corresponds to the `reviews` microservice in the sample BookInfo app. The purpose of this service is to divide traffic between two versions of the `reviews` service.
+
+In this example, we take the traffic to the `reviews` service and intercept it so that 50 percent of it goes to `v1` of the service and 50 percent goes to `v2`.
+
+After this virtual service is deployed, we will generate traffic and see from the Kiali visualization that traffic is being routed evenly between the two versions of the service.
+
+To deploy the virtual service and destination rules for the `reviews` service,
+
+1. Go to the project view and click **Import YAML.**
+1. Copy resources below into the form.
+1.  Click **Import.**
+
+```
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: reviews
+spec:
+  hosts:
+  - reviews
+  http:
+  - route:
+    - destination:
+        host: reviews
+        subset: v1
+      weight: 50
+    - destination:
+        host: reviews
+        subset: v3
+      weight: 50
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: reviews
+spec:
+  host: reviews
+  subsets:
+  - name: v1
+    labels:
+      version: v1
+  - name: v2
+    labels:
+      version: v2
+  - name: v3
+    labels:
+      version: v3
+```
+**Result:** When you generate traffic to this service (for example, by refreshing the ingress gateway URL), the Kiali traffic graph will reflect that traffic to the `reviews` service is divided evenly between `v1` and `v3`.
+
+### [Next: Generate and View Traffic]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic)
diff --git a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
new file mode 100644
index 00000000000..e456dd14b81
--- /dev/null
+++ b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
@@ -0,0 +1,28 @@
+---
+title: 7. Generate and View Traffic
+weight: 7
+aliases:
+  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic
+---
+
+This section describes how to view the traffic that is being managed by Istio.
+
+# The Kiali Traffic Graph
+
+Rancher integrates a Kiali graph into the Rancher UI. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
+
+To see the traffic graph,
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. Go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
+
+If you refresh the URL to the BookInfo app several times, you should be able to see green arrows on the Kiali graph showing traffic to `v1` and `v3` of the `reviews` service. The control panel on the right side of the graph lets you configure details including how many minutes of the most recent traffic should be shown on the graph.
+
+For additional tools and visualizations, you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
+
+# Viewing Traffic Metrics
+
+Istio’s monitoring features provide visibility into the performance of all your services.
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.**
\ No newline at end of file

From 72bd167c703fbc40af180f5109c8ffd821ccddfd Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Wed, 16 Sep 2020 19:23:50 -0700
Subject: [PATCH 219/265] Copy edit Istio docs

---
 content/rancher/v2.x/en/istio/_index.md       | 20 +++++++++----------
 .../v2.x/en/istio/cluster-istio/_index.md     |  4 ++--
 .../v2.x/en/istio/disabling-istio/_index.md   |  6 +++---
 .../rancher/v2.x/en/istio/resources/_index.md |  2 +-
 .../setup/enable-istio-in-cluster/_index.md   |  9 +++++----
 .../setup/enable-istio-in-namespace/_index.md |  4 ++--
 .../v2.x/en/istio/setup/gateway/_index.md     |  6 +++---
 7 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
index d2f6c8db74a..891169a5498 100644
--- a/content/rancher/v2.x/en/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -3,10 +3,12 @@ title: Istio
 weight: 15
 ---
 
-_Available as of v2.5.0_
+_Available as of v2.4.0_
 
 [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
 
+> Rancher's Istio integration changed significantly in v2.5. If you are using Rancher v2.4, refer to the [legacy documentation.](../legacy)
+
 As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
 
 Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
@@ -22,25 +24,23 @@ This service mesh provides features that include but are not limited to the foll
 
 After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
 
-Rancher's Istio integration comes with support for the following addon(s):
+Rancher's Istio integration comes with support for [Kiali.](https://www.kiali.io/) Kiali provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
 
-- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
-
-# What's New
+# What's New in Rancher v2.5
 
 The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
 
-Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin ) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
+Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
 
-A Prometheus integration will still be available through an installation of Rancher Monitoring (insert link here), or by installing your own prometheus operator. Rancher's Istio chart will also install kiali by default to ensure you can get a full picture of your microservice out of the box.
+A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
 
-Istio has migrated away from Helm as a way to install Istio and now provides installation through the Istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a helm chart that utilizes the Istioctl binary to manage your Istio installation.
+Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
 
-This helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it ca be used in the project.
+This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
 
 # Prerequisites
 
-Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory](instert new url here) to run all of the components of Istio.
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory](./resources) to run all of the components of Istio.
 
 # Setup Guide
 
diff --git a/content/rancher/v2.x/en/istio/cluster-istio/_index.md b/content/rancher/v2.x/en/istio/cluster-istio/_index.md
index 9634043898d..f5a85b3da49 100644
--- a/content/rancher/v2.x/en/istio/cluster-istio/_index.md
+++ b/content/rancher/v2.x/en/istio/cluster-istio/_index.md
@@ -3,9 +3,9 @@ title: Istio
 weight: 5
 
 ---
-_Available as of v2.5.0_
+_Available as of v2.4.0_
 
-> If you are usnig a rancher version less than v2.5.0, the older way of setting up Istio is documented in [this section]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
+> This section is about the new version of the Istio app in Rancher v2.5.0. If you are using a rancher version less than v2.5.0, the older way of setting up Istio is documented in [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
 
  [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
 
diff --git a/content/rancher/v2.x/en/istio/disabling-istio/_index.md b/content/rancher/v2.x/en/istio/disabling-istio/_index.md
index 3457d3fd51d..56f8acc197e 100644
--- a/content/rancher/v2.x/en/istio/disabling-istio/_index.md
+++ b/content/rancher/v2.x/en/istio/disabling-istio/_index.md
@@ -8,14 +8,14 @@ This section describes how to uninstall Istio in a cluster or disable a namespac
 
 # Uninstall Istio in a Cluster
 
-To Uninstall Istio,
+To uninstall Istio,
 
-1. From Dashboard UI, navigate to **Installed Apps** in **Apps & Marketplace** and locate the rancher-istio installation
+1. From the **Cluster Explorer,** navigate to **Installed Apps** in **Apps & Marketplace** and locate the `rancher-istio` installation.
 1. Select all the apps in the `istio-system` namespace and click  **Delete**. 
 
 **Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster. 
 
-**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual yamls to refer to. 
+**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer to. 
 
 # Disable Istio in a Namespace
 
diff --git a/content/rancher/v2.x/en/istio/resources/_index.md b/content/rancher/v2.x/en/istio/resources/_index.md
index fc6ea7f46e1..27783c6e78d 100644
--- a/content/rancher/v2.x/en/istio/resources/_index.md
+++ b/content/rancher/v2.x/en/istio/resources/_index.md
@@ -6,7 +6,7 @@ aliases:
   - /rancher/v2.x/en/project-admin/istio/config/
   - /rancher/v2.x/en/cluster-admin/tools/istio/resources
 ---
-_Available as of v2.5.0_
+_This section applies to Istio in Rancher v2.5.0. If you are using Rancher v2.4.x, refer to [this section.](../../legacy/resources)_
 
 This section describes the minimum recommended computing resources for the Istio components in a cluster.
 
diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
index fd6b5a91f69..718d6f94551 100644
--- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
@@ -8,16 +8,17 @@ aliases:
 This cluster uses the default Nginx controller to allow traffic into the cluster.
 
 Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. 
+
  - Admin
  - Edit
 
-> If the cluster has a Pod Security Policy enabled there are [prerequisites steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
+> If the cluster has a Pod Security Policy enabled there are [prerequisites steps.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
 
 1. From the Rancher Dashboard's **Cluster Explorer** view, navigate to available Charts in **Apps & Marketplace** 
 1. Select the Istio chart from the rancher provided charts
 1. Optional: Configure member access and [resource limits]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/) for the Istio components. Ensure you have enough resources on your worker nodes to enable Istio.
 1. Optional: Make additional configuration changes to values.yaml if needed
-1. Optional: Add additioanl resources or configuartion via the [overlay file](link to overlay file)
+1. Optional: Add additional resources or configuration via the [overlay file](#overlay-file)
 1. Click **Install**.
 
 **Result:** Istio is installed at the cluster level.
@@ -33,9 +34,9 @@ When Istio is installed in the cluster, the label for Istio sidecar auto injecti
 
 ## Overlay File
 
-An Overlay File is designed to support extensive configation of your Istio installation. It allows you to make changes to any values available in the [IstioOperator API](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/). This will ensure you can customize the default installation to fit any scenario. 
+An Overlay File is designed to support extensive configuration of your Istio installation. It allows you to make changes to any values available in the [IstioOperator API](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/). This will ensure you can customize the default installation to fit any scenario. 
 
-The Overlay File will add configuration ontop of the default installation that is provided from the Istio chart installation. This means you do not need to redefine the components that already defined for installation. 
+The Overlay File will add configuration on top of the default installation that is provided from the Istio chart installation. This means you do not need to redefine the components that already defined for installation. 
 
 For more information on Overlay Files, refer to the (documentation)[https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings]
 
diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md
index 3eca4d8ec98..4e74c56d523 100644
--- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-namespace/_index.md
@@ -11,7 +11,7 @@ This namespace setting will only affect new workloads in the namespace. Any pree
 
 > **Prerequisite:** To enable Istio in a namespace, the cluster must have Istio installed.  
 
-1. In the Rancher Dashboard, open the kubectl shell
+1. In the Rancher **Cluster Explorer,** open the kubectl shell.
 1. Then run `kubectl label namespace <namespace> istio-injection=enabled`
 
 **Result:** The namespace now has the label `istio-injection=enabled`. All new workloads deployed in this namespace will have the Istio sidecar injected by default.
@@ -30,7 +30,7 @@ sidecar.istio.io/inject: “false”
 
 To add the annotation to a workload,
 
-1. From the **Cluster Explorer** view, use the side-nav to select the **Overview** page for workloads
+1. From the **Cluster Explorer** view, use the side-nav to select the **Overview** page for workloads.
 1. Go to the workload that should not have the sidecar and edit as yaml
 1. Add the following key, value `sidecar.istio.io/inject: false` as an annotation on the workload
 1. Click **Save.**
diff --git a/content/rancher/v2.x/en/istio/setup/gateway/_index.md b/content/rancher/v2.x/en/istio/setup/gateway/_index.md
index 60f8780fd65..1fd1fcd7c51 100644
--- a/content/rancher/v2.x/en/istio/setup/gateway/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/gateway/_index.md
@@ -7,9 +7,9 @@ aliases:
 
 The gateway to each cluster can have its own port or load balancer, which is unrelated to a service mesh. By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. 
 
-You can use the NGINX ingress controller with or without Istio installed. If this is the only gateway to your cluster, Istio will be able to route traffic from service to service, but Istio will not be able to receive traffic from outside the cluster.
+You can use the Nginx Ingress controller with or without Istio installed. If this is the only gateway to your cluster, Istio will be able to route traffic from service to service, but Istio will not be able to receive traffic from outside the cluster.
 
-To allow Istio to receive external traffic, you need to enable Istio's gateway, which works as a north-south proxy for external traffic. When you enable the Istio gateway, the result is that your cluster will have two ingresses.
+To allow Istio to receive external traffic, you need to enable Istio's gateway, which works as a north-south proxy for external traffic. When you enable the Istio gateway, the result is that your cluster will have two Ingresses.
 
 You will also need to set up a Kubernetes gateway for your services. This Kubernetes resource points to Istio's implementation of the ingress gateway to the cluster.
 
@@ -17,7 +17,7 @@ You can route traffic into the service mesh with a load balancer or just Istio's
 
 For more information on the Istio gateway, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/gateway/) 
 
-![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
+![In an Istio-enabled cluster, you can have two Ingresses: the default Nginx Ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
 
 # Enable the Istio Gateway
 

From 7fb695872582b049e8329c844cc0fb56141fb327 Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Thu, 24 Sep 2020 19:08:18 -0700
Subject: [PATCH 220/265] Add rbac, add overlay information, add scrap config
 docs

---
 content/rancher/v2.x/en/istio/_index.md       |  71 ----------
 .../v2.x/en/istio/cluster-istio/_index.md     |  62 ++++----
 .../v2.x/en/istio/disabling-istio/_index.md   |   2 +-
 content/rancher/v2.x/en/istio/rbac/_index.md  |  36 +++--
 .../rancher/v2.x/en/istio/resources/_index.md |  52 +------
 content/rancher/v2.x/en/istio/setup/_index.md |  24 ++--
 .../en/istio/setup/deploy-workloads/_index.md |  38 ++++-
 .../setup/enable-istio-in-cluster/_index.md   | 133 ++++++++++++++++--
 .../v2.x/en/istio/setup/gateway/_index.md     |  64 +++++----
 .../en/istio/setup/node-selectors/_index.md   |  40 ------
 .../setup/set-up-traffic-management/_index.md |  51 ++++---
 .../en/istio/setup/view-traffic/_index.md     |  20 ++-
 12 files changed, 307 insertions(+), 286 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/istio/setup/node-selectors/_index.md

diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
index 891169a5498..20ca3297925 100644
--- a/content/rancher/v2.x/en/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -2,74 +2,3 @@
 title: Istio
 weight: 15
 ---
-
-_Available as of v2.4.0_
-
-[Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
-
-> Rancher's Istio integration changed significantly in v2.5. If you are using Rancher v2.4, refer to the [legacy documentation.](../legacy)
-
-As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
-
-Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
-
-This service mesh provides features that include but are not limited to the following:
-
-- Traffic management features
-- Enhanced monitoring and tracing
-- Service discovery and routing
-- Secure connections and service-to-service authentication with mutual TLS
-- Load balancing
-- Automatic retries, backoff, and circuit breaking
-
-After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
-
-Rancher's Istio integration comes with support for [Kiali.](https://www.kiali.io/) Kiali provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
-
-# What's New in Rancher v2.5
-
-The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
-
-Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
-
-A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
-
-Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
-
-This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
-
-# Prerequisites
-
-Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory](./resources) to run all of the components of Istio.
-
-# Setup Guide
-
-Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
-
-# Disabling Istio
-
-To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
-
-# Architecture
-
-Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
-
-Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
-
-Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
-
-When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
-
-For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
-
-### Multiple Ingresses
-
-By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
-
-![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
-
-Additional Ingresses can be configured via the [overlay file] (overlay file link here)
-
-### Egress Support
-
-By default an Egress gateway is not installed, but can be configured via the [overlay file] (overlay file link here)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/cluster-istio/_index.md b/content/rancher/v2.x/en/istio/cluster-istio/_index.md
index f5a85b3da49..da07b8bb833 100644
--- a/content/rancher/v2.x/en/istio/cluster-istio/_index.md
+++ b/content/rancher/v2.x/en/istio/cluster-istio/_index.md
@@ -11,7 +11,7 @@ _Available as of v2.4.0_
 
  As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
 
-Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster administrator, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
 
 This service mesh provides features that include but are not limited to the following:
 
@@ -24,11 +24,23 @@ This service mesh provides features that include but are not limited to the foll
 
 After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
 
-Rancher's Istio integration comes with comprehensive visualization aids:
+Rancher's Istio integration comes with a comprehensive visualization aid:
 
 - **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
 
-Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project.
+Istio needs to be set up by a `cluster-admin` before it can be used in a project.
+
+# What's New in Rancher v2.5
+
+The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
+
+Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
+
+A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
+
+Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
+
+This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
 
 # Prerequisites
 
@@ -38,33 +50,27 @@ Before enabling Istio, we recommend that you confirm that your Rancher worker no
 
 Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
 
-# Disabling Istio
+# Remove Istio
 
-To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+
+# Migrate From Previous Istio Version
+
+There is no upgrade path for Istio versions less than 1.7
 
 # Accessing Visualizations
 
-> By default, only cluster owners have access to Jaeger and Kiali. For instructions on how to allow project members to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
+> By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
 
-After Istio is set up in a cluster, Grafana, Prometheus, Jaeger, and Kiali are available in the Rancher UI.
+After Istio is set up in a cluster, Grafana, Prometheus,and Kiali are available in the Rancher UI. 
 
-Your access to the visualizations depend on your role. Grafana and Prometheus are only available for cluster owners. The Kiali and Jaeger UIs are available only to cluster owners by default, but cluster owners can allow project members to access them by editing the Istio settings. When you go to your project and click **Resources > Istio,** you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
+To access the Grafana and Prometheus visualizations, from the **Cluster Explorer** navigate to the **Monitoring** app overview page, and click on **Grafana** or **Prometheus**
 
-To see the visualizations, go to the cluster where Istio is set up and click **Tools > Istio.** You should see links to each UI at the top of the page.
+To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. 
 
-You can also get to the visualization tools from the project view.
+By default, only the `istio-system` namespace will picked up by prometheus, which means the other visualization addons will not have displays for resources deployed in other namespaces. Refer to [selector/scrape config setup](URLNEEDED) to get full use of your Grafana and Kiali dashboards.
 
-# Viewing the Kiali Traffic Graph
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. If you are a cluster owner, you can go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
-
-# Viewing Traffic Metrics
-
-Istio’s monitoring features provide visibility into the performance of all your services.
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.** Cluster owners can see all of the metrics, while project members can see a subset of the metrics.
+Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.
 
 # Architecture
 
@@ -72,14 +78,18 @@ Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/
 
 Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
 
-Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
-
 When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
 
-For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
+For more information on the Istio sidecar, refer to the [Istio sidecare-injection docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/) and for more information on Istio's architecture, refer to the [Istio Architecture docs](https://istio.io/latest/docs/ops/deployment/architecture/)
 
-### Two Ingresses
+### Multiple Ingresses
 
-By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
+By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. Istio also installs an ingress gateway by default into the `istio-system` namespace.  The result is that your cluster will have two ingresses in your cluster.
 
 ![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
+ 
+ Additional Istio Ingress gateways can be enabled via the [overlay file.](URLNEEDED)
+
+### Egress Support
+
+By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](URLNEEDED)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/disabling-istio/_index.md b/content/rancher/v2.x/en/istio/disabling-istio/_index.md
index 56f8acc197e..2c054c556f0 100644
--- a/content/rancher/v2.x/en/istio/disabling-istio/_index.md
+++ b/content/rancher/v2.x/en/istio/disabling-istio/_index.md
@@ -15,7 +15,7 @@ To uninstall Istio,
 
 **Result:** The `rancher-istio` app in the cluster gets removed. The Istio sidecar cannot be deployed on any workloads in the cluster. 
 
-**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer to. 
+**Note:** You can no longer disable and reenable your Istio installation. If you would like to save your settings for a future install, view and save individual YAMLs to refer back to / reuse for future installations. 
 
 # Disable Istio in a Namespace
 
diff --git a/content/rancher/v2.x/en/istio/rbac/_index.md b/content/rancher/v2.x/en/istio/rbac/_index.md
index 2df5676cd34..b4ee158ea23 100644
--- a/content/rancher/v2.x/en/istio/rbac/_index.md
+++ b/content/rancher/v2.x/en/istio/rbac/_index.md
@@ -7,12 +7,20 @@ aliases:
 
 This section describes the permissions required to access Istio features.
 
+The rancher istio chart installs three `ClusterRoles` 
+
+# Cluster-Admin Access
+
+By default, only those with the `cluster-admin` `ClusterRole` can:
+
+- Install istio app in a cluster
+- Configure resource allocations for Istio
+
+
 ## Admin and Edit access
 
 By default, only Admin and Edit roles can:
 
-- Install Istio for the cluster
-- Configure resource allocations for Istio
 - Enable and disable Istio sidecar auto-injection for namespaces
 - Add the Istio sidecar to workloads
 - View the traffic metrics and traffic graph for the cluster
@@ -20,11 +28,19 @@ By default, only Admin and Edit roles can:
 
 # Summary of Default Permissions for Kubernetes Default roles
 
-| Permission                         | Admin | Edit | View |
-|------------------------------------------|----------------|----------------|-----------------|
-| Enable and disable Istio for the cluster | ✓              | ✓              |                 |
-| Configure Istio resource limits          | ✓              | ✓              |                 |
-| Enable and disable Istio for a namespace | ✓              | ✓              |                 |
-| Enable and disable Istio on workloads    | ✓              | ✓              |                 |
-| Configure Istio with `kubectl`           | ✓              | ✓              |                 |
-| View Istio project dashboard, including traffic metrics* | ✓          | ✓              | ✓            |
\ No newline at end of file
+Istio creates three `ClusterRoles` and adds Istio CRD access to the following default K8s `ClusterRole`:
+
+| ClusterRole create by chart | Default K8s ClusterRole  | Rancher Role | 
+| ------------------------------| ---------------------------|---------|
+| `istio-admin` | admin| Project Owner, Project Member | 
+| `istio-edit`| edit | Project Owner, Project Member | 
+| `istio-view` | view | Read-only | 
+
+Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create (C), Get (G), List (L), Update (U), Patch (P), Delete(D), All (*)) that can be performed. 
+
+
+|CRDs                        | Admin | Edit | View | 
+|----------------------------| ------| -----| -----|
+| <ul><li>`config.istio.io`</li><ul><li>`adapters`</li><li>`attributemanifests`<li>`handlers`</li><li>`httpapispecbindings`</li><li>`httpapispecs`</li><li>`instances`</li><li>`quotaspecbindings`</li><li>`quotaspecs`</li><li>`rules`</lli><li>`templates`</li></ul></ul>| GLW | GLW | GLW|
+|<ul><li>`networking.istio.io`</li><ul><li>`destinationrules`</li><li>`envoyfilters`<li>`gateways`</li><li>`serviceentries`</li><li>`sidecars`</li><li>`virtualservices`</li><li>`workloadentries`</li></ul></ul>| * | * | GLW |
+|<ul><li>`security.istio.io`</li><ul><li>`authorizationpolicies`</li><li>`peerauthentications`<li>`requestauthentications`</li></ul></ul>| * | * | GLW |
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/resources/_index.md b/content/rancher/v2.x/en/istio/resources/_index.md
index 27783c6e78d..a1c3face6e3 100644
--- a/content/rancher/v2.x/en/istio/resources/_index.md
+++ b/content/rancher/v2.x/en/istio/resources/_index.md
@@ -34,59 +34,15 @@ istio-ingressgateway | 2000m | 1024Mi  | 10m |  40Mi | Y
 
 You can individually configure the resource allocation for each type of Istio component. This section includes the default resource allocations for each component.
 
-To make it easier to schedule the workloads to a node, a cluster administrator can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
+To make it easier to schedule the workloads to a node, a cluster-admin can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
 
 You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/docs/concepts/what-is-istio).
 
 To configure the resources allocated to an Istio component,
 
-1. In Rancher Dashboard, navigate to your Istio installation in Apps & Marketplace
-1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file](link to overlayfile install instructions). 
+1. In the Rancher **Cluster Explorer**, navigate to your Istio installation in **Apps & Marketplace**
+1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file](URLNEEDED). 
 1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
 1. Click **Upgrade.** to rollout changes
 
-**Result:** The resource allocations for the Istio components are updated.
-
-## Istiod
-
-[Istiod](https://istio.io/latest/docs/ops/deployment/architecture/#istiod)  provides the following:
-
-- Authentication configuration
-- Service discovery for the Envoy sidecars
-- Traffic management capabilities for intelligent routing (A/B tests and canary rollouts)
-- Configuration for resiliency (timeouts, retries, circuit breakers, etc)
-
-For more information on Istiod, refer to the [documentation](https://istio.io/latest/docs/ops/deployment/architecture/#components).
-
-## Tracing
-
-[Distributed tracing](https://istio.io/latest/docs/tasks/observability/distributed-tracing/overview/) enables users to track a request through a service mesh. This makes it easier to troubleshoot problems with latency, parallelism and serialization.
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Enable Tracing | Whether or not to deploy the istio-tracing. | Yes | True
-Tracing CPU Limit | CPU resource limit for the istio-tracing pod.  | Yes      | 500
-Tracing CPU Reservation | CPU reservation for the istio-tracing pod. | Yes      | 100
-Tracing Memory Limit | Memory resource limit for the istio-tracing pod. | Yes      | 1024
-Tracing Memory Reservation | Memory resource requests for the istio-tracing pod.  | Yes      | 100
-Tracing Selector | Ability to select the nodes in which tracing pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
-
-## Ingress Gateway
-
-The Istio gateway allows Istio features such as monitoring and route rules to be applied to traffic entering the cluster. This gateway is a prerequisite for outside traffic to make requests to Istio.
-
-For more information, refer to the [documentation](https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/).
-
-Option | Description| Required | Default
--------|------------|-------|-------
-Enable Ingress Gateway | Whether or not to deploy the istio-ingressgateway. | Yes      | False
-Service Type of Istio Ingress Gateway | How to expose the gateway. You can choose NodePort or Loadbalancer | Yes      | NodePort
-Http2 Port | The NodePort for http2 requests  | Yes      | 31380
-Https Port | The NodePort for https requests  | Yes      | 31390
-Load Balancer IP | Ingress Gateway Load Balancer IP | No       | n/a
-Load Balancer Source Ranges | Ingress Gateway Load Balancer Source Ranges | No       | n/a
-Ingress Gateway CPU Limit | CPU resource limit for the istio-ingressgateway pod. | Yes      | 2000
-Ingress Gateway CPU Reservation | CPU reservation for the istio-ingressgateway pod. | Yes      | 100
-Ingress Gateway Memory Limit | Memory resource limit for the istio-ingressgateway pod. | Yes      | 1024
-Ingress Gateway Memory Reservation | Memory resource requests for the istio-ingressgateway pod. | Yes      | 128
-Ingress Gateway Selector | Ability to select the nodes in which istio-ingressgateway pod is deployed to. To use this option, the nodes must have labels. | No       | n/a
+**Result:** The resource allocations for the Istio components are updated.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/setup/_index.md b/content/rancher/v2.x/en/istio/setup/_index.md
index ab842cf4f30..f7237953385 100644
--- a/content/rancher/v2.x/en/istio/setup/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/_index.md
@@ -7,20 +7,8 @@ aliases:
 
 This section describes how to enable Istio and start using it in your projects.
 
-This section assumes that you have Rancher installed, and you have a Rancher-provisioned Kubernetes cluster where you would like to set up Istio.
-
 If you use Istio for traffic management, you will need to allow external traffic to the cluster. In that case, you will need to follow all of the steps below.
 
-> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
-
-1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster)
-1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
-1. [Select the nodes where the main Istio components will be deployed.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
-1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
-1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
-1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
-1. [Generate traffic and see Istio in action.](#generate-traffic-and-see-istio-in-action)
-
 # Prerequisites
 
 This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v2.x/en/installation) and you have already [provisioned a separate Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning) on which you will install Istio.
@@ -28,3 +16,15 @@ This guide assumes you have already [installed Rancher,]({{<baseurl>}}/rancher/v
 The nodes in your cluster must meet the [CPU and memory requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/)
 
 The workloads and services that you want to be controlled by Istio must meet [Istio's requirements.](https://istio.io/docs/setup/additional-setup/requirements/)
+
+
+# Install
+
+> **Quick Setup** If you don't need external traffic to reach Istio, and you just want to set up Istio for monitoring and tracing traffic within the cluster, skip the steps for [setting up the Istio gateway]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway) and [setting up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
+
+1. [Enable Istio in the cluster.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster)
+1. [Enable Istio in all the namespaces where you want to use it.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
+1. [Add deployments and services that have the Istio sidecar injected.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
+1. [Set up the Istio gateway. ]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/gateway)
+1. [Set up Istio's components for traffic management.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
+1. [Generate traffic and see Istio in action.](#generate-traffic-and-see-istio-in-action)
diff --git a/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md b/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
index e1338e861bf..1c8b19cfc67 100644
--- a/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
@@ -5,22 +5,46 @@ aliases:
   - /rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads
 ---
 
-> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have Istio enabled.  
+> **Prerequisite:** To enable Istio for a workload, the cluster and namespace must have the Istio app installed.  
 
 Enabling Istio in a namespace only enables automatic sidecar injection for new workloads. To enable the Envoy sidecar for existing workloads, you need to enable it manually for each workload.
 
-To inject the Istio sidecar on an existing workload in the namespace, go to the workload, click the **&#8942;,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
+To inject the Istio sidecar on an existing workload in the namespace, from the **Cluster Explorer** go to the workload, click the **&#8942;,** and click **Redeploy.** When the workload is redeployed, it will have the Envoy sidecar automatically injected.
 
-Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see istio-init and istio-proxy alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
+Wait a few minutes for the workload to upgrade to have the istio sidecar. Click it and go to the Containers section. You should be able to see `istio-proxy` alongside your original workload. This means the Istio sidecar is enabled for the workload. Istio is doing all the wiring for the sidecar envoy. Now Istio can do all the features automatically if you enable them in the yaml.
 
 ### 3. Add Deployments and Services
 
+There are a few ways to add new **Deployments** in your namespace
+
+1. From the **Cluster Explorer** click on Workload > Overview
+1. Click **Create**
+1. Select **Deployment** from the various workload options
+1. Fill out the form, or **Edit as Yaml**
+1. Click **Create** 
+
+Alternatively, you can select the specific workload you want to deploy from worklod > specific workload and create from there.
+
+To add a **Service** to your namespace
+
+1. From the **Cluster Explorer** click on **Service Discovery > Services**
+1. Click **Create**
+1. Select the type of service you want to create from the various options
+1. Fill out the form, or **Edit as Yaml**
+1. Click **Create** 
+
+You can also create deployments and services using the kubectl **shell**
+1. Run `kubectl create -f <name of service/deployment file>.yaml` if your file is stored locally in the cluster
+1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command. 
+
+### 4. Example Deployments and Services
+
 Next we add the Kubernetes resources for the sample deployments and services for the BookInfo app in Istio's documentation.
 
-1. Go to the project inside the cluster you want to deploy the workload on.
-1. In Workloads, click **Import YAML.**
-1. Copy the below resources into the form.
-1. Click **Import.**
+1. From the **Cluster Explorer**, open the kubectl **shell**
+1. Run `cat<< EOF | kubectl apply -f -`
+1. Copy the below resources into the the shell
+1. Run `EOF`
 
 This will set up the following sample resources from Istio's example BookInfo app:
 
diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
index 718d6f94551..382a67c8daa 100644
--- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
@@ -5,17 +5,15 @@ aliases:
   - /rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster
 ---
 
-This cluster uses the default Nginx controller to allow traffic into the cluster.
-
 Only a user with the following [Kubernetes default roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) assigned can configure and install Istio in a Kubernetes cluster. 
 
- - Admin
- - Edit
+ - `cluster-admin`
 
 > If the cluster has a Pod Security Policy enabled there are [prerequisites steps.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
 
-1. From the Rancher Dashboard's **Cluster Explorer** view, navigate to available Charts in **Apps & Marketplace** 
+1. From the **Cluster Explorer**, navigate to available **Charts** in **Apps & Marketplace** 
 1. Select the Istio chart from the rancher provided charts
+1. If you have not already installed your own monitoring app, you will be prompted to install the rancher-monitoring app. Optional: Set your Selector or Scrape config options on rancher-monitoring app install. 
 1. Optional: Configure member access and [resource limits]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources/) for the Istio components. Ensure you have enough resources on your worker nodes to enable Istio.
 1. Optional: Make additional configuration changes to values.yaml if needed
 1. Optional: Add additional resources or configuration via the [overlay file](#overlay-file)
@@ -23,20 +21,127 @@ Only a user with the following [Kubernetes default roles](https://kubernetes.io/
 
 **Result:** Istio is installed at the cluster level.
 
-The Istio application, `rancher-istio`, is added as an application to the cluster's `system` project.
+Automatic sidecar injection is disabled by default. To enable this, set the `sidecarInjectorWebhook.enableNamespacesByDefault=true` in the values.yaml on install or upgrade. This automatically enables Istio sidecar injection into all new namespaces that are deployed. 
 
-When Istio is installed in the cluster, the label for Istio sidecar auto injection,`istio-injection=enabled`, will be automatically added to each new namespace in this cluster. This automatically enables Istio sidecar injection in all new workloads that are deployed in those namespaces. You will need to manually enable Istio in preexisting namespaces and workloads.
+## Additonal Config Options
 
-### [Next: Enable Istio in a Namespace]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace)
-
-
-### Advanced Config Options
-
-## Overlay File
+### Overlay File
 
 An Overlay File is designed to support extensive configuration of your Istio installation. It allows you to make changes to any values available in the [IstioOperator API](https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/). This will ensure you can customize the default installation to fit any scenario. 
 
 The Overlay File will add configuration on top of the default installation that is provided from the Istio chart installation. This means you do not need to redefine the components that already defined for installation. 
 
-For more information on Overlay Files, refer to the (documentation)[https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings]
+For more information on Overlay Files, refer to the [documentation](https://istio.io/latest/docs/setup/install/istioctl/#configure-component-settings)
 
+## Selectors & Scrape Configs
+
+The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=true` which means only the `istio-system` namespace will be scraped by prometheus by default. To ensure you can view traffic, metrics and graphs for resources deployed in other namespaces you will need to add additional configuration.
+
+There are three different ways to enable prometheus to detect resources in other namespaces: 
+
+1. Add a Service Monitor or Pod Monitor in the namespace with the targets you want to scrape.
+1. Set `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` on your rancher-monitoring instance.
+1. Add an `additionalScrapeConfig` to your rancher-monitoring instance to scrape all targets in all namespaces.
+
+**Option 1: Create a Service Monitor or Pod Monitor** 
+
+This option allows you to define which specific services or pods you would like monitored in a specific namespace. 
+
+ >Usability tradeoff is that you have to create the service monitor / pod monitor per namespace since you cannot monitor across namespaces. 
+
+ **Pre Requisite:** define a ServiceMonitor or PodMonitor for `<your namespace>`. Example ServiceMonitor is provided below. 
+
+1. From the **Cluster Explorer**, open the kubectl shell
+1. Run `kubectl create -f <name of service/pod monitor file>.yaml` if the file is stored locally in your cluster. 
+1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command. 
+1. If starting a new install, **Click** the **rancher-monitoring** chart and scroll down to **Preview Yaml**. 
+1. Run `kubectl label namespace <your namespace> istio-injection=enabled` to enable the envoy sidecar injection
+
+**Result:**  `<your namspace>` can be scraped by prometheus. 
+
+**Example Service Monitor for Istio Proxies**
+
+```yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: envoy-stats-monitor
+  namespace: istio-system
+  labels:
+    monitoring: istio-proxies
+spec:
+  selector:
+    matchExpressions:
+    - {key: istio-prometheus-ignore, operator: DoesNotExist}
+  namespaceSelector:
+    any: true
+  jobLabel: envoy-stats
+  endpoints:
+  - path: /stats/prometheus
+    targetPort: 15090
+    interval: 15s
+    relabelings:
+    - sourceLabels: [__meta_kubernetes_pod_container_port_name]
+      action: keep
+      regex: '.*-envoy-prom'
+    - action: labeldrop
+      regex: "__meta_kubernetes_pod_label_(.+)"
+    - sourceLabels: [__meta_kubernetes_namespace]
+      action: replace
+      targetLabel: namespace
+    - sourceLabels: [__meta_kubernetes_pod_name]
+      action: replace
+      targetLabel: pod_name
+```
+
+**Option 2: Set ingnoreNamspaceSelectors to False** 
+
+This enables monitoring accross namespaces which means ServiceMonitors or PodMonitors will not need to be created per namespace. 
+
+ >Potential security trade off is  users in namespace A can create a service monitor that monitors services in namespace B despite not having permissions to namespace B
+1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace** 
+1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**. 
+1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**. 
+1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true`
+1. Complete install or upgrade
+
+**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus.
+
+**Option 3: Set ingnoreNamspaceSelectors to False** 
+
+This enables monitoring accross namespaces by giving prometheus additional scrape configurations. 
+
+ >Usability tradeoff is that  all of prometheus' additionalScrapeConfigs are maintained in a single Secret. This could make upgrading difficult if monitoring is already deployed with additionalScrapeConfigs prior to installing Istio. 
+1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**. 
+1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**. 
+1. If updating an existing installation, click on **Upgrade** and then **Preview Yaml**.
+1. Set`prometheus.prometheusSpec.additionalScrapeConfigs` array to the **Additional Scrape Config** provided below. 
+1. Complete install or upgrade
+
+**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus.
+
+**Additional Scrape Config:**
+``` yaml
+- job_name: 'istio/envoy-stats'
+  scrape_interval: 15s
+  metrics_path: /stats/prometheus
+  kubernetes_sd_configs:
+    - role: pod
+  relabel_configs:
+    - source_labels: [__meta_kubernetes_pod_container_port_name]
+      action: keep
+      regex: '.*-envoy-prom'
+    - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
+      action: replace
+      regex: ([^:]+)(?::\d+)?;(\d+)
+      replacement: $1:15090
+      target_label: __address__
+    - action: labelmap
+      regex: __meta_kubernetes_pod_label_(.+)
+    - source_labels: [__meta_kubernetes_namespace]
+      action: replace
+      target_label: namespace
+    - source_labels: [__meta_kubernetes_pod_name]
+      action: replace
+      target_label: pod_name
+``` 
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/setup/gateway/_index.md b/content/rancher/v2.x/en/istio/setup/gateway/_index.md
index 1fd1fcd7c51..68743ee852e 100644
--- a/content/rancher/v2.x/en/istio/setup/gateway/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/gateway/_index.md
@@ -13,32 +13,33 @@ To allow Istio to receive external traffic, you need to enable Istio's gateway,
 
 You will also need to set up a Kubernetes gateway for your services. This Kubernetes resource points to Istio's implementation of the ingress gateway to the cluster.
 
-You can route traffic into the service mesh with a load balancer or just Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
+You can route traffic into the service mesh with a load balancer or use Istio's NodePort gateway. This section describes how to set up the NodePort gateway.
 
 For more information on the Istio gateway, refer to the [Istio documentation.](https://istio.io/docs/reference/config/networking/v1alpha3/gateway/) 
 
 ![In an Istio-enabled cluster, you can have two Ingresses: the default Nginx Ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
 
-# Enable the Istio Gateway
+# Enable an Istio Gateway
 
-The ingress gateway is a Kubernetes service that will be deployed in your cluster. There is only one Istio gateway per cluster.
+The ingress gateway is a Kubernetes service that will be deployed in your cluster. The Istio Gateway allows for more extensive customization and flexibility.  
 
-1. Go to the cluster where you want to allow outside traffic into Istio.
-1. Click **Tools > Istio.**
-1. Expand the **Ingress Gateway** section.
-1. Under **Enable Ingress Gateway,** click **True.** The default type of service for the Istio gateway is NodePort. You can also configure it as a [load balancer.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/load-balancers-and-ingress/load-balancers/)
-1. Optionally, configure the ports, service types, node selectors and tolerations, and resource requests and limits for this service. The default resource requests for CPU and memory are the minimum recommended resources.
-1. Click **Save.**
+1. From the **Cluster Explorer**, select **Istio** from the nav dropdown. 
+1. Click **Gateways** in the side nav bar.
+1. Click **Create from Yaml**.
+1. Paste your Istio Gateway yaml, or **Read from File**.
+1. Click **Create**.
 
-**Result:** The gateway is deployed, which allows Istio to receive traffic from outside the cluster.
+**Result:** The gateway is deployed, and will now route traffic with applied rules
 
-# Add a Kubernetes Gateway that Points to the Istio Gateway
+# Example Istio Gateway
 
-To allow traffic to reach Ingress, you will also need to provide a Kubernetes gateway resource in your YAML that points to Istio's implementation of the ingress gateway to the cluster.
+We add the BookInfo app deployments in services when going through the Workloads example. Next we add an Istio Gateway so that the app is accessible from outside your cluster.
 
-1. Go to the namespace where you want to deploy the Kubernetes gateway and click **Import YAML.**
-1. Upload the gateway YAML as a file or paste it into the form. An example gateway YAML is provided below.
-1.  Click **Import.**
+1. From the **Cluster Explorer**, select **Istio** from the nav dropdown. 
+1. Click **Gateways** in the side nav bar.
+1. Click **Create from Yaml**.
+1. Copy and paste the Gateway yaml provided below.
+1. Click **Create**.
 
 ```yaml
 apiVersion: networking.istio.io/v1alpha3
@@ -49,13 +50,23 @@ spec:
   selector:
     istio: ingressgateway # use istio default controller
   servers:
-    - port:
-        number: 80
-        name: http
-        protocol: HTTP
-      hosts:
-        - "*"
+  - port:
+      number: 80
+      name: http
+      protocol: HTTP
+    hosts:
+    - "*"
 ---
+```
+
+Then to deploy the VirtualService that provides the traffic routing for the Gateway
+
+1. Click **VirtualService** in the side nav bar.
+1. Click **Create from Yaml**.
+1. Copy and paste the VirtualService yaml provided below.
+1. Click **Create**.
+
+```yaml
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
@@ -105,8 +116,8 @@ To test and see if the BookInfo app deployed correctly, the app can be viewed a
 
 To get the ingress gateway URL and port,
 
-1. Go to the `System` project in your cluster.
-1. Within the `System` project, go to `Resources` > `Workloads` then scroll down to the `istio-system` namespace. 
+1. From the **Cluster Explorer**, Click on **Workloads > Overview**. 
+1. Scroll down to the `istio-system` namespace. 
 1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Under the name of this workload, you should see links, such as `80/tcp`.
 1. Click one of those links. This should show you the URL of the ingress gateway in your web browser. Append `/productpage` to the URL.
 
@@ -124,9 +135,8 @@ You can try the steps in this section to make sure the Kubernetes gateway is con
 
 In the gateway resource, the selector refers to Istio's default ingress controller by its label, in which the key of the label is `istio` and the value is `ingressgateway`.  To make sure the label is appropriate for the gateway, do the following:
 
-1. Go to the `System` project in your cluster.
-1. Within the `System` project, go to the namespace `istio-system`. 
-1. Within `istio-system`, there is a workload named `istio-ingressgateway`.
-1. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
+1. From the **Cluster Explorer**, Click on **Workloads > Overview**. 
+1. Scroll down to the `istio-system` namespace. 
+1. Within `istio-system`, there is a workload named `istio-ingressgateway`. Click the name of this workload and go to the **Labels and Annotations** section. You should see that it has the key `istio` and the value `ingressgateway`. This confirms that the selector in the Gateway resource matches Istio's default ingress controller.
 
 ### [Next: Set up Istio's Components for Traffic Management]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/set-up-traffic-management)
diff --git a/content/rancher/v2.x/en/istio/setup/node-selectors/_index.md b/content/rancher/v2.x/en/istio/setup/node-selectors/_index.md
deleted file mode 100644
index f226580b0de..00000000000
--- a/content/rancher/v2.x/en/istio/setup/node-selectors/_index.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: 3. Select the Nodes Where Istio Components Will be Deployed
-weight: 3
-aliases:
-  - /rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors
----
-
-> **Prerequisite:** Your cluster needs a worker node that can designated for Istio. The worker node should meet the [resource requirements.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources)
-
-This section describes how use node selectors to configure Istio components to be deployed on a designated node.
-
-In larger deployments, it is strongly advised that Istio's infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
-
-# Adding a Label to the Istio Node
-
-First, add a label to the node where Istio components should be deployed. This label can have any key-value pair. For this example, we will use the key `istio` and the value `enabled`.
-
-1. From the cluster view, go to the **Nodes** tab.
-1. Go to a worker node that will host the Istio components and click **&#8942; > Edit.**
-1. Expand the **Labels & Annotations** section.
-1. Click **Add Label.**
-1. In the fields that appear, enter `istio` for the key and `enabled` for the value.
-1. Click **Save.**
-
-**Result:** A worker node has the label that will allow you to designate it for Istio components.
-
-# Configuring Istio Components to Use the Labeled Node
-
-Configure each Istio component to be deployed to the node with the Istio label. Each Istio component can be configured individually, but in this tutorial, we will configure all of the components to be scheduled on the same node for the sake of simplicity.
-
-For larger deployments, it is recommended to schedule each component of Istio onto separate nodes.
-
-1. From the cluster view, click **Tools > Istio.**
-1. Expand the **Pilot** section and click **Add Selector** in the form that appears. Enter the node selector label that you added to the Istio node. In our case, we are using the key `istio` and the value `enabled.`
-1. Repeat the previous step for the **Mixer** and **Tracing** sections.
-1. Click **Save.**
-
-**Result:** The Istio components will be deployed on the Istio node.
-
-### [Next: Add Deployments and Services]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/deploy-workloads)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md b/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md
index b9d44ea7193..aa3ff5c1e8c 100644
--- a/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/set-up-traffic-management/_index.md
@@ -18,11 +18,39 @@ After this virtual service is deployed, we will generate traffic and see from th
 
 To deploy the virtual service and destination rules for the `reviews` service,
 
-1. Go to the project view and click **Import YAML.**
-1. Copy resources below into the form.
-1.  Click **Import.**
+1. From the **Cluster Explorer**, select **Istio** from the nav dropdown. 
+1. Click **DestinationRule** in the side nav bar.
+1. Click **Create from Yaml**.
+1. Copy and paste the DestinationRule yaml provided below.
+1. Click **Create**.
 
+```yaml
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: reviews
+spec:
+  host: reviews
+  subsets:
+  - name: v1
+    labels:
+      version: v1
+  - name: v2
+    labels:
+      version: v2
+  - name: v3
+    labels:
+      version: v3
 ```
+
+Then to deploy the VirtualService that provides the traffic routing that utilizes the DestinationRule
+
+1. Click **VirtualService** in the side nav bar.
+1. Click **Create from Yaml**.
+1. Copy and paste the VirtualService yaml provided below.
+1. Click **Create**.
+
+```yaml
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
@@ -41,23 +69,8 @@ spec:
         subset: v3
       weight: 50
 ---
-apiVersion: networking.istio.io/v1alpha3
-kind: DestinationRule
-metadata:
-  name: reviews
-spec:
-  host: reviews
-  subsets:
-  - name: v1
-    labels:
-      version: v1
-  - name: v2
-    labels:
-      version: v2
-  - name: v3
-    labels:
-      version: v3
 ```
+
 **Result:** When you generate traffic to this service (for example, by refreshing the ingress gateway URL), the Kiali traffic graph will reflect that traffic to the `reviews` service is divided evenly between `v1` and `v3`.
 
 ### [Next: Generate and View Traffic]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/view-traffic)
diff --git a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
index e456dd14b81..b6be6ae7864 100644
--- a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
@@ -9,20 +9,18 @@ This section describes how to view the traffic that is being managed by Istio.
 
 # The Kiali Traffic Graph
 
-Rancher integrates a Kiali graph into the Rancher UI. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
+The Istio overpage provides a link to the Kiali dashboard. From the Kiali dashboard, you are able to view graphs for each namespace. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
+
+>**Prerequisite:** To enable traffic to show up in the graph, ensure you have enabled one of the [Selectors & Scrape Configs](NEEDSURL) options. If you do not have this configured, you will not see information on the graph. 
 
 To see the traffic graph,
 
-1. From the project view in Rancher, click **Resources > Istio.**
-1. Go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
+
+1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
+1. Click the **Kiali** link on the Istio **Overview** page.
+1. Click on **Graph** in the side nav.
+1. Change the namespace in the **Namesace** dropdown to view the traffic for each namespace. 
 
 If you refresh the URL to the BookInfo app several times, you should be able to see green arrows on the Kiali graph showing traffic to `v1` and `v3` of the `reviews` service. The control panel on the right side of the graph lets you configure details including how many minutes of the most recent traffic should be shown on the graph.
 
-For additional tools and visualizations, you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
-
-# Viewing Traffic Metrics
-
-Istio’s monitoring features provide visibility into the performance of all your services.
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.**
\ No newline at end of file
+For additional tools and visualizations, you can go to Grafana, and Prometheus dashboards from the **Monitoring** **Overview** page

From a441becedb7ee454efc523a7eb1c6a602fbb2888 Mon Sep 17 00:00:00 2001
From: Steven Crespo <steven.crespo@rancher.com>
Date: Wed, 30 Sep 2020 16:30:57 -0700
Subject: [PATCH 221/265] Revert "Update _index.md"

This reverts commit ff976cc7f8bfa86d2f9ede36592d19d62eeac648.
---
 content/rancher/v2.x/en/opa-gatekeper/_index.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md
index 31a1d481a5c..8d08d3ed087 100644
--- a/content/rancher/v2.x/en/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md
@@ -30,7 +30,8 @@ OPA Gatekeeper is made available via Rancher's Helm system chart, and it is inst
 
 # Enabling OPA Gatekeeper in a Cluster
 
-In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper and its CRDs from the old UI, then reinstall it in Rancher v2.5. To uninstall the CRDs run the following command in the kubectl console `kubectl delete crd configs.config.gatekeeper.sh constrainttemplates.templates.gatekeeper.sh`
+In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper from the old UI, then reinstall it in Rancher v2.5.
+
 {{% tabs %}}
 {{% tab "Rancher v2.5" %}}
 

From 58ffede72e8b191f7a8a0bc7b6d73e692914d0e0 Mon Sep 17 00:00:00 2001
From: Steven Crespo <steven.crespo@rancher.com>
Date: Wed, 30 Sep 2020 16:33:38 -0700
Subject: [PATCH 222/265] Update opa docs with CRD cleanup step

---
 content/rancher/v2.x/en/opa-gatekeper/_index.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/opa-gatekeper/_index.md b/content/rancher/v2.x/en/opa-gatekeper/_index.md
index 8d08d3ed087..f73ef16be98 100644
--- a/content/rancher/v2.x/en/opa-gatekeper/_index.md
+++ b/content/rancher/v2.x/en/opa-gatekeper/_index.md
@@ -30,7 +30,7 @@ OPA Gatekeeper is made available via Rancher's Helm system chart, and it is inst
 
 # Enabling OPA Gatekeeper in a Cluster
 
-In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper from the old UI, then reinstall it in Rancher v2.5.
+In Rancher v2.5, the OPA Gatekeeper application was improved. The Rancher v2.4 feature can't be upgraded to the new version in Rancher v2.5. If you installed OPA Gatekeeper in Rancher v2.4, you will need to uninstall OPA Gatekeeper and its CRDs from the old UI, then reinstall it in Rancher v2.5. To uninstall the CRDs run the following command in the kubectl console `kubectl delete crd configs.config.gatekeeper.sh constrainttemplates.templates.gatekeeper.sh`.
 
 {{% tabs %}}
 {{% tab "Rancher v2.5" %}}

From 419f48ac7357c856b0258cbe72cbb57d59f02b7c Mon Sep 17 00:00:00 2001
From: Jacob Payne <jacob.payne@rancher.com>
Date: Wed, 30 Sep 2020 14:17:08 -0700
Subject: [PATCH 223/265] added logging documentation for rbac and examples

---
 content/rancher/v2.x/en/logging/_index.md | 193 +++++++++++++++++++++-
 1 file changed, 192 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/logging/_index.md b/content/rancher/v2.x/en/logging/_index.md
index 865facc62b5..417ba9e97d3 100644
--- a/content/rancher/v2.x/en/logging/_index.md
+++ b/content/rancher/v2.x/en/logging/_index.md
@@ -48,4 +48,195 @@ The following Custom Resource Definitions are used to configure logging:
 
 According to the [Banzai Cloud documentation,](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture)
 
-> You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify.
\ No newline at end of file
+> You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify.
+
+### RBAC
+Rancher logging has two roles, `logging-admin` and `logging-view`. `logging-admin` allows users full access to namespaced flows and outputs.  The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs.  Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster.  Cluster admin is the only role with full access to all rancher-logging resources.  Cluster members are not able to edit or read any logging resources.  Project owners are able to create namespaced flows and outputs in the namespaces under their projects.  This means that project owners can collect logs from anything in their project namespaces.  Project members are able to view the flows and outputs in the namespaces under their projects. 
+
+
+### Examples
+
+Let's say you wanted to send all logs in your cluster to an elasticsearch cluster.
+
+First lets create our cluster output: 
+```yaml
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: ClusterOutput
+metadata:
+    name: "example-es"
+    namespace: "cattle-logging-system"
+spec:
+    elasticsearch:
+      host: elasticsearch.example.com
+      port: 9200
+      scheme: http
+```
+
+We have created a cluster output, without elasticsearch configuration, in the same namespace as our operator `cattle-logging-system.`. Any time we create a cluster flow or cluster output we have to put it in the `cattle-logging-system` namespace.
+
+Now we have configured where we want the logs to go, lets configure all logs to go to that output.
+
+```yaml
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: ClusterFlow
+metadata:
+    name: "all-logs"
+    namespace: "cattle-logging-system"
+spec:
+  globalOutputRefs:
+    - "example-es
+``` 
+
+We should now see our configured index with logs in it.
+
+What if we have an application team who only wants logs from a specific namespaces sent to a splunk server? For this case can use namespaced outputs and flows. 
+
+Before we start lets set up a scenario.
+
+```yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: devteam
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coolapp
+  namespace: devteam
+  labels:
+    app: coolapp
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: coolapp
+  template:
+    metadata:
+      labels:
+        app: coolapp
+    spec:
+      containers:
+        - name: generator
+          image: paynejacob/loggenerator:latest
+``` 
+
+like before we start with an output, unlike cluster outputs we create our output in our application's namespace:
+
+```yaml
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: Output
+metadata:
+    name: "devteam-splunk"
+    namespace: "devteam"
+spec:
+    SplunkHec:
+        host: splunk.example.com
+        port: 8088
+        protocol: http
+```
+
+Once again, lets give our output some logs:
+
+```yaml
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: Flow
+metadata:
+    name: "devteam-logs"
+    namespace: "devteam"
+spec:
+  localOutputRefs:
+    - "devteam-splunk"
+```
+
+For the final example we create an output to write logs to a destination that is not supported out of the box (e.g. syslog):
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: syslog-config
+  namespace: cattle-logging-system
+type: Opaque
+stringData:
+  fluent-bit.conf: |
+    [INPUT]
+        Name              forward
+        Port              24224
+
+    [OUTPUT]
+        Name              syslog
+        InstanceName      syslog-output
+        Match             *
+        Addr              syslog.example.com
+        Port              514
+        Cluster           ranchers
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fluentbit-syslog-forwarder
+  namespace: cattle-logging-system
+  labels:
+    output: syslog
+spec:
+  selector:
+    matchLabels:
+      output: syslog
+  template:
+    metadata:
+      labels:
+        output: syslog
+    spec:
+      containers:
+      - name: fluentbit
+        image: paynejacob/fluent-bit-out-syslog:latest
+        ports:
+          - containerPort: 24224
+        volumeMounts:
+          - mountPath: "/fluent-bit/etc/"
+            name: configuration
+      volumes:
+      - name: configuration
+        secret:
+          secretName: syslog-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: syslog-forwarder
+  namespace: cattle-logging-system
+spec:
+  selector:
+    output: syslog
+  ports:
+    - protocol: TCP
+      port: 24224
+      targetPort: 24224
+---
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: ClusterFlow
+metadata:
+  name: all-logs
+  namespace: cattle-logging-system
+spec:
+  globalOutputRefs:
+    - syslog
+---
+apiVersion: logging.banzaicloud.io/v1beta1
+kind: ClusterOutput
+metadata:
+  name: syslog
+  namespace: cattle-logging-system
+spec:
+  forward:
+    servers:
+      - host: "syslog-forwarder.cattle-logging-system"
+    require_ack_response: false
+    ignore_network_errors_at_startup: false
+```
+
+if we break down what is happening, first we create a deployment of a container that has the additional syslog plugin and accepts logs forwarded from another fluentd.  Next we create an output configured as a forwarder to our deployment. The deployment fluentd will then forward all logs to the configured syslog destination.  
+
+

From 947af1acbe6efc0cc7cc36e4e857c909733c911f Mon Sep 17 00:00:00 2001
From: rmweir <ricardo.weir1@gmail.com>
Date: Thu, 24 Sep 2020 18:53:41 -0700
Subject: [PATCH 224/265] Add syncing explanation to EKS

---
 .../hosted-kubernetes-clusters/eks/_index.md  | 33 ++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index 1b2225a2fe9..ccd2fd32f4e 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -93,6 +93,8 @@ The following capabilities have been added for configuring EKS clusters in Ranch
 - Add restrictions to public access
 - Use your cloud credentials to create the EKS cluster instead of passing in your access key and secret key
 
+Due to the way that the cluster data is synced with EKS, if the cluster is modified from another source, such as in the EKS console, and in Rancher within five minutes, it could cause some changes to be overwritten. For information about how the sync works and how to configure it, refer to [this section](#syncing).
+
 {{% tabs %}}
 {{% tab "Rancher v2.5+" %}}
 
@@ -307,6 +309,8 @@ User Data | Custom commands can to be passed to perform automated configuration
 
 # Troubleshooting
 
+If your changes were overwritten, it could be due to the way the cluster data is synced with EKS. Changes shouldn't be made to the cluster from another source, such as in the EKS console, and in Rancher within a five-minute span. For information on how this works and how to configure the refresh interval, refer to [Syncing.](#syncing)
+
 For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html).
 
 # AWS Service Events
@@ -457,4 +461,31 @@ Resource targeting uses `*` as the ARN of many of the resources created cannot b
         }
     ]
 }
-```
\ No newline at end of file
+```
+
+# Syncing
+
+Syncing is the feature that causes Rancher to update its EKS clusters' values so they are up to date with their corresponding cluster object in the EKS console. This enables Rancher to not be the sole owner of an EKS cluster’s state. Its largest limitation is that processing an update from Rancher and another source at the same time or within 5 minutes of one finishing may cause the state from one source to completely overwrite the other.
+
+### How it works
+
+There are two fields on the Rancher Cluster object that must be understood to understand how syncing works:
+
+1. EKSConfig which is located on the Spec of the Cluster.
+2. UpstreamSpec which is located on the EKSStatus field on the Status of the Cluster.
+
+Both of which are defined by the struct EKSClusterConfigSpec found in the eks-operator project: https://github.com/rancher/eks-operator/blob/master/pkg/apis/eks.cattle.io/v1/types.go
+
+All fields with the exception of DisplayName, AmazonCredentialSecret, Region, and Imported are nillable on the EKSClusterConfigSpec.
+
+The EKSConfig represents desired state for its non-nil values. Fields that are non-nil in the EKSConfig can be thought of as “managed".When a cluster is created in Rancher, all fields are non-nil and therefore “managed”. When a pre-existing cluster is registered in rancher all nillable fields are nil and are not “managed”. Those fields become managed once their value has been changed by Rancher.
+
+UpstreamSpec represents the cluster as it is in EKS and is refreshed on an interval of 5 minutes. After the UpstreamSpec has been refreshed rancher checks if the EKS cluster has an update in progress. If it is updating, nothing further is done. If it is not currently updating, any “managed” fields on EKSConfig are overwritten with their corresponding value from the recently updated UpstreamSpec.
+
+The effective desired state can be thought of as the UpstreamSpec + all non-nil fields in the EKSConfig. This is what is displayed in the UI.
+
+If Rancher and another source attempt to update an EKS cluster at the same time or within the 5 minute refresh window of an update finishing, then it is likely any “managed” fields can be caught in a race condition. For example, a cluster may have PrivateAccess as a managed field. If PrivateAccess is false and then enabled in EKS console, then finishes at 11:01, and then tags are updated from Rancher before 11:05 the value will likely be overwritten. This would also occur if tags were updated while the cluster was processing the update. If the cluster was registered and the PrivateAccess fields was nil then this issue should not occur in the aforementioend case.
+
+### Configuring the Refresh Interval
+
+It is possible to change the refresh interval through the setting “eks-refresh-cron". This setting accepts values in the Cron format. The default is `*/5 * * * *`. The shorter the refresh window is the less likely any race conditions will occur, but it does increase the likelihood of encountering request limits that may be in place for AWS APIs.

From a563747361f98f15f2af0a733ba0ceea936d2d43 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 1 Oct 2020 12:20:08 -0700
Subject: [PATCH 225/265] Move Istio pages

---
 content/rancher/v2.x/en/istio/_index.md       | 89 +++++++++++++++++
 .../v2.x/en/istio/cluster-istio/_index.md     | 95 -------------------
 .../rancher/v2.x/en/istio/legacy/_index.md    | 91 +++++++++++++++++-
 .../en/istio/legacy/cluster-istio/_index.md   | 92 ------------------
 4 files changed, 179 insertions(+), 188 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/istio/cluster-istio/_index.md
 delete mode 100644 content/rancher/v2.x/en/istio/legacy/cluster-istio/_index.md

diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
index 20ca3297925..7a4c71709c0 100644
--- a/content/rancher/v2.x/en/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -2,3 +2,92 @@
 title: Istio
 weight: 15
 ---
+
+> This section is about the new version of the Istio app in Rancher v2.5.0. If you are using a Rancher version from v2.3.0 to v2.5.0, the older way of setting up Istio is documented in [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
+
+ [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
+
+ As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
+
+Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster administrator, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+
+This service mesh provides features that include but are not limited to the following:
+
+- Traffic management features
+- Enhanced monitoring and tracing
+- Service discovery and routing
+- Secure connections and service-to-service authentication with mutual TLS
+- Load balancing
+- Automatic retries, backoff, and circuit breaking
+
+After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
+
+Rancher's Istio integration comes with a comprehensive visualization aid:
+
+- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
+
+Istio needs to be set up by a `cluster-admin` before it can be used in a project.
+
+# What's New in Rancher v2.5
+
+The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
+
+Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
+
+A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
+
+Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
+
+This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
+
+# Prerequisites
+
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
+
+# Setup Guide
+
+Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
+
+# Remove Istio
+
+To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+
+# Migrate From Previous Istio Version
+
+There is no upgrade path for Istio versions less than 1.7
+
+# Accessing Visualizations
+
+> By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
+
+After Istio is set up in a cluster, Grafana, Prometheus,and Kiali are available in the Rancher UI. 
+
+To access the Grafana and Prometheus visualizations, from the **Cluster Explorer** navigate to the **Monitoring** app overview page, and click on **Grafana** or **Prometheus**
+
+To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. 
+
+By default, only the `istio-system` namespace will picked up by prometheus, which means the other visualization addons will not have displays for resources deployed in other namespaces. Refer to [selector/scrape config setup](URLNEEDED) to get full use of your Grafana and Kiali dashboards.
+
+Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.
+
+# Architecture
+
+Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
+
+Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
+
+When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
+
+For more information on the Istio sidecar, refer to the [Istio sidecare-injection docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/) and for more information on Istio's architecture, refer to the [Istio Architecture docs](https://istio.io/latest/docs/ops/deployment/architecture/)
+
+### Multiple Ingresses
+
+By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. Istio also installs an ingress gateway by default into the `istio-system` namespace.  The result is that your cluster will have two ingresses in your cluster.
+
+![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
+ 
+ Additional Istio Ingress gateways can be enabled via the [overlay file.](URLNEEDED)
+
+### Egress Support
+
+By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](URLNEEDED)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/cluster-istio/_index.md b/content/rancher/v2.x/en/istio/cluster-istio/_index.md
deleted file mode 100644
index da07b8bb833..00000000000
--- a/content/rancher/v2.x/en/istio/cluster-istio/_index.md
+++ /dev/null
@@ -1,95 +0,0 @@
----
-title: Istio
-weight: 5
-
----
-_Available as of v2.4.0_
-
-> This section is about the new version of the Istio app in Rancher v2.5.0. If you are using a rancher version less than v2.5.0, the older way of setting up Istio is documented in [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
-
- [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
-
- As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
-
-Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster administrator, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
-
-This service mesh provides features that include but are not limited to the following:
-
-- Traffic management features
-- Enhanced monitoring and tracing
-- Service discovery and routing
-- Secure connections and service-to-service authentication with mutual TLS
-- Load balancing
-- Automatic retries, backoff, and circuit breaking
-
-After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
-
-Rancher's Istio integration comes with a comprehensive visualization aid:
-
-- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
-
-Istio needs to be set up by a `cluster-admin` before it can be used in a project.
-
-# What's New in Rancher v2.5
-
-The overall architecture of Istio has been simplified. A single component, Istiod, has been created by combining Pilot, Citadel, Galley and the sidecar injector. Node Agent functionality has also been merged into istio-agent.
-
-Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
-
-A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
-
-Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
-
-This Helm chart will be available via the Apps and Marketplace in the UI. A user that has access to the Rancher Chart's catalog will need to set up Istio before it can be used in the project.
-
-# Prerequisites
-
-Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
-
-# Setup Guide
-
-Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
-
-# Remove Istio
-
-To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
-
-# Migrate From Previous Istio Version
-
-There is no upgrade path for Istio versions less than 1.7
-
-# Accessing Visualizations
-
-> By default, only cluster-admins have access to Kiali. For instructions on how to allow admin, edit or views roles to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
-
-After Istio is set up in a cluster, Grafana, Prometheus,and Kiali are available in the Rancher UI. 
-
-To access the Grafana and Prometheus visualizations, from the **Cluster Explorer** navigate to the **Monitoring** app overview page, and click on **Grafana** or **Prometheus**
-
-To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. 
-
-By default, only the `istio-system` namespace will picked up by prometheus, which means the other visualization addons will not have displays for resources deployed in other namespaces. Refer to [selector/scrape config setup](URLNEEDED) to get full use of your Grafana and Kiali dashboards.
-
-Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.
-
-# Architecture
-
-Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
-
-Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
-
-When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
-
-For more information on the Istio sidecar, refer to the [Istio sidecare-injection docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/) and for more information on Istio's architecture, refer to the [Istio Architecture docs](https://istio.io/latest/docs/ops/deployment/architecture/)
-
-### Multiple Ingresses
-
-By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. Istio also installs an ingress gateway by default into the `istio-system` namespace.  The result is that your cluster will have two ingresses in your cluster.
-
-![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
- 
- Additional Istio Ingress gateways can be enabled via the [overlay file.](URLNEEDED)
-
-### Egress Support
-
-By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](URLNEEDED)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/legacy/_index.md b/content/rancher/v2.x/en/istio/legacy/_index.md
index f4e8a5d3219..9df562214ff 100644
--- a/content/rancher/v2.x/en/istio/legacy/_index.md
+++ b/content/rancher/v2.x/en/istio/legacy/_index.md
@@ -2,4 +2,93 @@
 title: Legacy Istio Documentation
 shortTitle: Legacy
 weight: 1
----
\ No newline at end of file
+aliases:
+    - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/
+    - /rancher/v2.x/en/cluster-admin/tools/istio/
+    - /rancher/v2.x/en/project-admin/istio
+    - /rancher/v2.x/en/istio/legacy/cluster-istio
+---
+_Available as of v2.3.0_
+
+> In Rancher 2.5, the Istio application was improved. There are now two ways to enable Istio. The older way is documented in this section, and the new application for Istio is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/istio)
+
+ [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
+
+ As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
+
+Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+
+This service mesh provides features that include but are not limited to the following:
+
+- Traffic management features
+- Enhanced monitoring and tracing
+- Service discovery and routing
+- Secure connections and service-to-service authentication with mutual TLS
+- Load balancing
+- Automatic retries, backoff, and circuit breaking
+
+After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
+
+Rancher's Istio integration comes with comprehensive visualization aids:
+
+- **Trace the root cause of errors with Jaeger.** [Jaeger](https://www.jaegertracing.io/) is an open-source tool that provides a UI for a distributed tracing system, which is useful for root cause analysis and for determining what causes poor performance. Distributed tracing allows you to view an entire chain of calls, which might originate with a user request and traverse dozens of microservices.
+- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
+- **Gain insights from time series analytics with Grafana dashboards.** [Grafana](https://grafana.com/) is an analytics platform that allows you to query, visualize, alert on and understand the data gathered by Prometheus.
+- **Write custom queries for time series data with the Prometheus UI.** [Prometheus](https://prometheus.io/) is a systems monitoring and alerting toolkit. Prometheus scrapes data from your cluster, which is then used by Grafana. A Prometheus UI is also integrated into Rancher, and lets you write custom queries for time series data and see the results in the UI.
+
+
+Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project.
+
+# Prerequisites
+
+Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
+
+# Setup Guide
+
+Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
+
+# Disabling Istio
+
+To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+
+# Accessing Visualizations
+
+> By default, only cluster owners have access to Jaeger and Kiali. For instructions on how to allow project members to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
+
+After Istio is set up in a cluster, Grafana, Prometheus, Jaeger, and Kiali are available in the Rancher UI.
+
+Your access to the visualizations depend on your role. Grafana and Prometheus are only available for cluster owners. The Kiali and Jaeger UIs are available only to cluster owners by default, but cluster owners can allow project members to access them by editing the Istio settings. When you go to your project and click **Resources > Istio,** you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
+
+To see the visualizations, go to the cluster where Istio is set up and click **Tools > Istio.** You should see links to each UI at the top of the page.
+
+You can also get to the visualization tools from the project view.
+
+# Viewing the Kiali Traffic Graph
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. If you are a cluster owner, you can go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
+
+# Viewing Traffic Metrics
+
+Istio’s monitoring features provide visibility into the performance of all your services.
+
+1. From the project view in Rancher, click **Resources > Istio.**
+1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.** Cluster owners can see all of the metrics, while project members can see a subset of the metrics.
+
+# Architecture
+
+Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
+
+Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
+
+Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
+
+When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
+
+For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
+
+### Two Ingresses
+
+By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
+
+![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/legacy/cluster-istio/_index.md b/content/rancher/v2.x/en/istio/legacy/cluster-istio/_index.md
deleted file mode 100644
index 53443e7af30..00000000000
--- a/content/rancher/v2.x/en/istio/legacy/cluster-istio/_index.md
+++ /dev/null
@@ -1,92 +0,0 @@
----
-title: Istio
-weight: 5
-aliases:
-    - /rancher/v2.x/en/project-admin/istio/configuring-resource-allocations/
-    - /rancher/v2.x/en/cluster-admin/tools/istio/
-    - /rancher/v2.x/en/project-admin/istio
----
-_Available as of v2.3.0_
-
-> In Rancher 2.5, the Istio application was improved. There are now two ways to enable Istio. The older way is documented in this section, and the new application for Istio is documented in the [dashboard section.]({{<baseurl>}}/rancher/v2.x/en/dashboard/istio)
-
- [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
-
- As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
-
-Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
-
-This service mesh provides features that include but are not limited to the following:
-
-- Traffic management features
-- Enhanced monitoring and tracing
-- Service discovery and routing
-- Secure connections and service-to-service authentication with mutual TLS
-- Load balancing
-- Automatic retries, backoff, and circuit breaking
-
-After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
-
-Rancher's Istio integration comes with comprehensive visualization aids:
-
-- **Trace the root cause of errors with Jaeger.** [Jaeger](https://www.jaegertracing.io/) is an open-source tool that provides a UI for a distributed tracing system, which is useful for root cause analysis and for determining what causes poor performance. Distributed tracing allows you to view an entire chain of calls, which might originate with a user request and traverse dozens of microservices.
-- **Get the full picture of your microservice architecture with Kiali.** [Kiali](https://www.kiali.io/) provides a diagram that shows the services within a service mesh and how they are connected, including the traffic rates and latencies between them. You can check the health of the service mesh, or drill down to see the incoming and outgoing requests to a single component.
-- **Gain insights from time series analytics with Grafana dashboards.** [Grafana](https://grafana.com/) is an analytics platform that allows you to query, visualize, alert on and understand the data gathered by Prometheus.
-- **Write custom queries for time series data with the Prometheus UI.** [Prometheus](https://prometheus.io/) is a systems monitoring and alerting toolkit. Prometheus scrapes data from your cluster, which is then used by Grafana. A Prometheus UI is also integrated into Rancher, and lets you write custom queries for time series data and see the results in the UI.
-
-
-Istio needs to be set up by a Rancher administrator or cluster administrator before it can be used in a project.
-
-# Prerequisites
-
-Before enabling Istio, we recommend that you confirm that your Rancher worker nodes have enough [CPU and memory]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/resources) to run all of the components of Istio.
-
-# Setup Guide
-
-Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) for instructions on how to set up Istio and use it in a project.
-
-# Disabling Istio
-
-To remove Istio components from a cluster, namespace, or workload, refer to the section on [disabling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
-
-# Accessing Visualizations
-
-> By default, only cluster owners have access to Jaeger and Kiali. For instructions on how to allow project members to access them, refer to [Access to Visualizations.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/rbac/#access-to-visualizations)
-
-After Istio is set up in a cluster, Grafana, Prometheus, Jaeger, and Kiali are available in the Rancher UI.
-
-Your access to the visualizations depend on your role. Grafana and Prometheus are only available for cluster owners. The Kiali and Jaeger UIs are available only to cluster owners by default, but cluster owners can allow project members to access them by editing the Istio settings. When you go to your project and click **Resources > Istio,** you can go to each UI for Kiali, Jaeger, Grafana, and Prometheus by clicking their icons in the top right corner of the page.
-
-To see the visualizations, go to the cluster where Istio is set up and click **Tools > Istio.** You should see links to each UI at the top of the page.
-
-You can also get to the visualization tools from the project view.
-
-# Viewing the Kiali Traffic Graph
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. If you are a cluster owner, you can go to the **Traffic Graph** tab. This tab has the Kiali network visualization integrated into the UI.
-
-# Viewing Traffic Metrics
-
-Istio’s monitoring features provide visibility into the performance of all your services.
-
-1. From the project view in Rancher, click **Resources > Istio.**
-1. Go to the **Traffic Metrics** tab. After traffic is generated in your cluster, you should be able to see metrics for **Success Rate, Request Volume, 4xx Response Count, Project 5xx Response Count** and **Request Duration.** Cluster owners can see all of the metrics, while project members can see a subset of the metrics.
-
-# Architecture
-
-Istio installs a service mesh that uses [Envoy](https://www.envoyproxy.io/learn/service-mesh) sidecar proxies to intercept traffic to each workload. These sidecars intercept and manage service-to-service communication, allowing fine-grained observation and control over traffic within the cluster.
-
-Only workloads that have the Istio sidecar injected can be tracked and controlled by Istio.
-
-Enabling Istio in Rancher enables monitoring in the cluster, and enables Istio in all new namespaces that are created in a cluster. You need to manually enable Istio in preexisting namespaces.
-
-When a namespace has Istio enabled, new workloads deployed in the namespace will automatically have the Istio sidecar. You need to manually enable Istio in preexisting workloads.
-
-For more information on the Istio sidecar, refer to the [Istio docs](https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/).
-
-### Two Ingresses
-
-By default, each Rancher-provisioned cluster has one NGINX ingress controller allowing traffic into the cluster. To allow Istio to receive external traffic, you need to enable the Istio ingress gateway for the cluster. The result is that your cluster will have two ingresses.
-
-![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
\ No newline at end of file

From 408a630b5c36a5292f15ffb2d6795f73ead28009 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 1 Oct 2020 16:06:21 -0700
Subject: [PATCH 226/265] Update links in Fleet docs

---
 .../rancher/v2.x/en/deploy-across-clusters/fleet/_index.md    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
index aedf09fdb38..762f2f0bc26 100644
--- a/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
+++ b/content/rancher/v2.x/en/deploy-across-clusters/fleet/_index.md
@@ -6,7 +6,7 @@ weight: 1
 
 _Available as of Rancher v2.5_
 
-Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that is works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a large scale. By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization.
+Fleet is GitOps at scale. Fleet is designed to manage up to a million clusters. It's also lightweight enough that is works great for a [single cluster](https://fleet.rancher.io/single-cluster-install/) too, but it really shines when you get to a [large scale.](https://fleet.rancher.io/multi-cluster-install/) By large scale we mean either a lot of clusters, a lot of deployments, or a lot of teams in a single organization.
 
 Fleet is a separate project from Rancher, and can be installed on any Kubernetes cluster with Helm.
 
@@ -21,7 +21,7 @@ Fleet comes preinstalled in Rancher v2.5. To access it, go to the **Cluster Expl
 
 ### GitHub Repository
 
-The Fleet Helm charts are available [here.](https://github.com/rancher/fleet)
+The Fleet Helm charts are available [here.](https://github.com/rancher/fleet/releases/latest)
 
 ### Documentation
 

From dc88f7a1195ffb68a9775c6be8d425cf7247a4fa Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Thu, 1 Oct 2020 16:15:24 -0700
Subject: [PATCH 227/265] Remove 'Manipulate Longhorn resources with kubectl'

---
 content/rancher/v2.x/en/longhorn/_index.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/content/rancher/v2.x/en/longhorn/_index.md b/content/rancher/v2.x/en/longhorn/_index.md
index c2e80598ba2..350e67e1068 100644
--- a/content/rancher/v2.x/en/longhorn/_index.md
+++ b/content/rancher/v2.x/en/longhorn/_index.md
@@ -18,7 +18,6 @@ With Longhorn, you can:
 - Schedule recurring snapshots of a volume, and schedule recurring backups to NFS or S3-compatible secondary storage
 - Restore volumes from backup
 - Upgrade Longhorn without disrupting persistent volumes
-- Manipulate Longhorn resources with kubectl
 
 ### New in Rancher v2.5
 

From 0350254e7c29fd38f00af04b89b8bda14b141772 Mon Sep 17 00:00:00 2001
From: rmweir <ricardo.weir1@gmail.com>
Date: Thu, 1 Oct 2020 13:57:05 -0700
Subject: [PATCH 228/265] Documentation for adding users and roles

---
 .../hosted-kubernetes-clusters/eks/_index.md                  | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
index ccd2fd32f4e..74d9e9ef038 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/hosted-kubernetes-clusters/eks/_index.md
@@ -311,6 +311,8 @@ User Data | Custom commands can to be passed to perform automated configuration
 
 If your changes were overwritten, it could be due to the way the cluster data is synced with EKS. Changes shouldn't be made to the cluster from another source, such as in the EKS console, and in Rancher within a five-minute span. For information on how this works and how to configure the refresh interval, refer to [Syncing.](#syncing)
 
+If an unauthorized error is returned while attempting to modify or register the cluster and the cluster was not created with the role or user that your credentials belong to, refer to [Security and Compliance.](#security-and-compliance)
+
 For any issues or troubleshooting details for your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/troubleshooting.html).
 
 # AWS Service Events
@@ -319,6 +321,8 @@ To find information on any AWS Service events, please see [this page](https://st
 
 # Security and Compliance
 
+By default only the IAM user or role that created a cluster has access to it. Attempting to access the cluster with any other user or role without additional configuration will lead to an error. In Rancher, this means using a credential that maps to a user or role that was not used to create the cluster will cause an unauthorized error. For example, an EKSCtl cluster will not register in Rancher unless the credentials used to register the cluster match the role or user used by EKSCtl. Additional users and roles can be authorized to access a cluster by being added to the aws-auth configmap in the kube-system namespace. For a more in-depth explanation and detailed instructions, please see this [documentation](https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/).
+
 For more information on security and compliance with your Amazon EKS Kubernetes cluster, please see this [documentation](https://docs.aws.amazon.com/eks/latest/userguide/shared-responsibilty.html).
 
 # Tutorial

From 93b258b0c12cc9daf1e7e70f41e4bae960f32b6b Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Fri, 2 Oct 2020 08:42:22 -0700
Subject: [PATCH 229/265] Update CIS scan docs

---
 content/rancher/v2.x/en/cis-scans/_index.md   | 222 +++++++++++++-----
 .../v2.x/en/cis-scans/configuration/_index.md |  90 +++++++
 .../en/cis-scans/{2.5.x => }/rbac/_index.md   |   3 +-
 .../v2.x/en/cis-scans/skipped-tests/_index.md |  59 +++++
 4 files changed, 318 insertions(+), 56 deletions(-)
 create mode 100644 content/rancher/v2.x/en/cis-scans/configuration/_index.md
 rename content/rancher/v2.x/en/cis-scans/{2.5.x => }/rbac/_index.md (97%)
 create mode 100644 content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md

diff --git a/content/rancher/v2.x/en/cis-scans/_index.md b/content/rancher/v2.x/en/cis-scans/_index.md
index 844a3c620f8..7f6e21506ed 100644
--- a/content/rancher/v2.x/en/cis-scans/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/_index.md
@@ -7,19 +7,46 @@ _Available as of v2.4.0_
 
 Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
 
-The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization, formed in October 2000, with a mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace". The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.
+The `rancher-cis-application` leverages [kube-bench,](https://github.com/aquasecurity/kube-bench) an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes [Sonobuoy](https://github.com/vmware-tanzu/sonobuoy) for report aggregation.
 
-CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
-
-The Benchmark provides recommendations of two types: Scored and Not Scored. We run tests related to only Scored recommendations.
+> The CIS scan feature was improved in Rancher v2.5. If you are using Rancher v2.4, refer to the older version of the CIS scan documentation [here.](./legacy)
 
+- [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
 - [About the CIS Benchmark](#about-the-cis-benchmark)
+- [Installing rancher-cis-benchmark](#installing-rancher-cis-benchmark)
+- [Uninstalling rancher-cis-benchmark](#uninstalling-rancher-cis-benchmark)
+- [Running a Scan](#running-a-scan)
+- [Skipping Tests](#skipping-tests)
+- [Viewing Reports](#viewing-reports)
 - [About the generated report](#about-the-generated-report)
-- [Test profiles](#test-profiles)
-- [Skipped and not applicable tests](#skipped-and-not-applicable-tests)
-  - [CIS Benchmark v1.4 skipped tests](#cis-benchmark-v1-4-skipped-tests)
-  - [CIS Benchmark v1.4 not applicable tests](#cis-benchmark-v1-4-not-applicable-tests)
+- [Test Profiles](#test-profiles)
+- [About Skipped and Not Applicable Tests](#about-skipped-and-not-applicable-tests)
+- [Roles-based access control](./rbac)
+- [Configuration](./configuration)
 
+### Changes in Rancher v2.5
+
+We now support running CIS scans on any Kubernetes cluster, including hosted Kubernetes providers such as EKS, AKS, and GKE. Previously it was only supported to run CIS scans on RKE Kubernetes clusters.
+
+In Rancher v2.4, the CIS scan tool was available from the **cluster manager** in the Rancher UI. Now it is available in the **Cluster Explorer** and it can be enabled and deployed using a Helm chart. It can be installed from the Rancher UI, but it can also be installed independently of Rancher. It  deploys a CIS scan operator for the cluster, and deploys Kubernetes custom resources for cluster scans. The custom resources can be managed directly from the **Cluster Explorer.**
+
+In v1 of the CIS scan tool, which was available in Rancher v2.4 through the cluster manager, recurring scans could be scheduled. The ability to schedule recurring scans is not yet available in Rancher v2.5.
+
+Support for alerting for the cluster scan results is not available for Rancher v2.5 yet.
+
+More test profiles were added. In Rancher v2.4, permissive and hardened profiles were included. In Rancher v2.5, the following profiles are available:
+
+- Generic CIS 1.5 (default)
+- RKE permissive
+- RKE hardened
+- EKS
+- GKE
+
+EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters.
+
+The `rancher-cis-benchmark` currently supports the CIS 1.5 Benchmark version.
+
+> **Note:** The old and new versions of monitoring shouldn't run on the cluster at the same time.
 
 # About the CIS Benchmark
 
@@ -29,7 +56,113 @@ CIS Benchmarks are best practices for the secure configuration of a target syste
 
 The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is [here.](https://learn.cisecurity.org/benchmarks)
 
-To check clusters for CIS Kubernetes Benchmark compliance, the security scan leverages [kube-bench,](https://github.com/aquasecurity/kube-bench) an open-source tool from Aqua Security.
+# Installing rancher-cis-benchmark
+
+The application can be installed with the Rancher UI or with Helm.
+
+### Installing with the Rancher UI
+
+1. In the Rancher UI, go to the **Cluster Explorer.**
+1. Click **Apps.**
+1. Click `rancher-cis-benchmark`.
+1. Click **Install.**
+
+**Result:** The CIS scan application is deployed on the Kubernetes cluster.
+
+### Installing with Helm
+
+There are two Helm charts for the application:
+
+- `rancher-cis-benchmark-crds`, the custom resource definition chart
+- `rancher-cis-benchmark`, the chart deploying [rancher/cis-operator](https://github.com/rancher/cis-operator)
+
+To install the charts, run the following commands:
+```
+helm install clusterscan-operator-crds \
+  ./rancher-cis-benchmark-crds/charts/ \
+  --kubeconfig <cluster-kubeconfig>
+helm install clusterscan-operator \
+  ./rancher-cis-benchmark/charts/ \
+  --create-namespace=true \
+  -n cis-operator-system \
+  --kubeconfig <cluster-kubeconfig>
+```
+
+# Uninstalling rancher-cis-benchmark
+
+The application can be uninstalled with the Rancher UI or with Helm.
+
+### Uninstalling with the Rancher UI
+
+1. From the **Cluster Explorer,** go to the top left dropdown menu and click **Apps & Marketplace.**
+1. Click **Installed Apps.**
+1. Go to the `cis-operator-system` namespace and check the boxes next to `rancher-cis-benchmark-crd` and `rancher-cis-benchmark`.
+1. Click **Delete** and confirm **Delete.**
+
+**Result:** The `rancher-cis-benchmark` application is uninstalled.
+
+### Uninstalling with Helm
+
+Run the following commands:
+
+```
+helm uninstall clusterscan-operator -n cis-operator-system --kubeconfig <cluster-kubeconfig>
+helm uninstall clusterscan-operator-crds --kubeconfig <cluster-kubeconfig>
+```
+
+# Running a Scan
+
+When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile.
+
+Note: There is currently a limitation of running only one CIS scan at a time for a cluster.
+
+To run a scan,
+
+1. Go to the **Cluster Explorer** in the Rancher UI. In the top left dropdown menu, click **Cluster Explorer > CIS Benchmark.**
+1. In the **Scans** section, click **Create.**
+1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. The CIS Operator will choose a default profile applicable to the type of Kubernetes cluster it is installed on.
+1. Click **Create.**
+
+**Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears.
+
+# Skipping Tests
+
+CIS scans can be run using test profiles with user-defined skips.
+
+To skip tests, you will create a custom CIS scan profile. A profile contains the configuration for the CIS scan, which includes the benchmark versions to use and any specific tests to skip in that benchmark.
+
+1. In the **Cluster Explorer,** go to the top-left dropdown menu and click **CIS Benchmark.**
+1. Click **Profiles.**
+1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile, click the three vertical dots, and click **Clone as YAML.**  If you are filling out the form, add the tests to skip using the tests IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name:
+
+    ```yaml
+    apiVersion: cis.cattle.io/v1
+    kind: ClusterScanProfile
+    metadata:
+      annotations:
+        meta.helm.sh/release-name: clusterscan-operator
+        meta.helm.sh/release-namespace: cis-operator-system
+      labels:
+        app.kubernetes.io/managed-by: Helm
+      name: "<example-profile>"
+    spec:
+      benchmarkVersion: cis-1.5
+      skipTests:
+        - "1.1.20"
+        - "1.1.21"
+    ```
+1. Click **Create.**
+
+**Result:** A new CIS scan profile is created.
+
+When you [run a scan](#running-a-scan) that uses this profile, the defined tests will be skipped during the scan. The skipped tests will be marked in the generated report as `Skip`.
+
+# Viewing Reports
+
+To view the generated CIS scan reports,
+
+1. In the **Cluster Explorer,** go to the top left dropdown menu and click **Cluster Explorer > CIS Benchmark.**
+1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name.
 
 # About the Generated Report
 
@@ -54,66 +187,45 @@ The report contains the following information:
 | Passed_Nodes | The name(s) of the nodes that the test passed on. |
 | Failed_Nodes | The name(s) of the nodes that the test failed on. |
 
-Refer to [the table in the cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
-
-
+Refer to [the table in the cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
 
 # Test Profiles
 
-For every CIS benchmark version, Rancher ships with two types of profiles. These profiles are named based on the type of cluster (e.g. `RKE`), the CIS benchmark version (e.g. CIS 1.4) and the profile type (e.g. `Permissive` or `Hardened`). For example, a full profile name would be `RKE-CIS-1.4-Permissive`
+The following profiles are available:
+
+- Generic CIS 1.5 (default)
+- RKE permissive
+- RKE hardened
+- EKS
+- GKE
+
+You also have the ability to customize a profile by saving a set of tests to skip.
 
 All profiles will have a set of not applicable tests that will be skipped during the CIS scan. These tests are not applicable based on how a RKE cluster manages Kubernetes.
 
-There are 2 types of profiles:
+There are 2 types of RKE cluster scan profiles:
 
 - **Permissive:** This profile has a set of tests that have been will be skipped as these tests will fail on a default RKE Kubernetes cluster. Besides the list of skipped tests, the profile will also not run the not applicable tests.
 - **Hardened:** This profile will not skip any tests, except for the non-applicable tests.
 
+The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters.
+
 In order to pass the "Hardened" profile, you will need to follow the steps on the [hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
 
-# Skipped and Not Applicable Tests
 
-### CIS Benchmark v1.4 Skipped Tests
 
-Number | Description | Reason for Skipping
----|---|---
-1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
-1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
-1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
-1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
-1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
-1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
-1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
-2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+# About Skipped and Not Applicable Tests
 
-### CIS Benchmark v1.4 Not Applicable Tests
+For a list of skipped and not applicable tests, refer to [this page.](./skipped-tests)
 
-Number | Description | Reason for being not applicable
----|---|---
-1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
-1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
-2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
-2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+For now, only user-defined skipped tests are marked as skipped in the generated report.
 
+Any skipped tests that are defined as being skipped by one of the default profiles are marked as not applicable.
+
+# Roles-based Access Control
+
+For information about permissions, refer to [this page.](./rbac)
+
+# Configuration
+
+For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to [this page.](./configuration)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cis-scans/configuration/_index.md b/content/rancher/v2.x/en/cis-scans/configuration/_index.md
new file mode 100644
index 00000000000..e6fda15e071
--- /dev/null
+++ b/content/rancher/v2.x/en/cis-scans/configuration/_index.md
@@ -0,0 +1,90 @@
+---
+title: Configuration
+weight: 3
+---
+
+This configuration reference is intended to help you manage the custom resources created by the `rancher-cis-benchmark` application. These resources are used for performing CIS scans on a cluster, skipping tests, setting the test profile that will be used during a scan, and other customization.
+
+To configure the custom resources, go to the **Cluster Explorer** in the Rancher UI. In dropdown menu in the top left corner, click **Cluster Explorer > CIS Benchmark.**
+
+### Scans
+
+A scan is created to trigger a CIS scan on the cluster based on the defined profile. A report is created after the scan is completed.
+
+When configuring a scan, you need to define the name of the scan profile that will be used with the `scanProfileName` directive.
+
+An example ClusterScan custom resource is below:
+
+```yaml
+apiVersion: cis.cattle.io/v1
+kind: ClusterScan
+metadata:
+  name: rke-cis
+spec:
+  scanProfileName: rke-profile-hardened
+```
+
+### Profiles
+
+A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark.
+
+Skipped tests are listed under the `skipTests` directive.
+
+When you create a new profile, you will also need to give it a name.
+
+An example `ClusterScanProfile` is below:
+
+```yaml
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanProfile
+metadata:
+  annotations:
+    meta.helm.sh/release-name: clusterscan-operator
+    meta.helm.sh/release-namespace: cis-operator-system
+  labels:
+    app.kubernetes.io/managed-by: Helm
+  name: "<example-profile>"
+spec:
+  benchmarkVersion: cis-1.5
+  skipTests:
+    - "1.1.20"
+    - "1.1.21"
+```
+
+### Benchmark Versions
+
+A benchmark version is the name of benchmark to run using `kube-bench`, as well as the valid configuration parameters for that benchmark.
+
+A `ClusterScanBenchmark` defines the CIS `BenchmarkVersion` name and test configurations. The `BenchmarkVersion` name is a parameter provided to the `kube-bench` tool.
+
+By default, a few `BenchmarkVersion` names and test configurations are packaged as part of the CIS scan application. When this feature is enabled, these default BenchmarkVersions will be automatically installed and available for users to create a ClusterScanProfile.
+
+> If the default BenchmarkVersions are edited, the next chart update will reset them back. Therefore we don't recommend editing the default ClusterScanBenchmarks.
+
+A ClusterScanBenchmark consists of the fields:
+
+- `ClusterProvider`: This is the cluster provider name for which this benchmark is applicable. For example: RKE, EKS, GKE, etc. Leave it empty if this benchmark can be run on any cluster type.
+- `MinKubernetesVersion`: Specifies the cluster's minimum kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular Kubernetes version.
+- `MaxKubernetesVersion`: Specifies the cluster's maximum Kubernetes version necessary to run this benchmark. Leave it empty if there is no dependency on a particular k8s version.
+
+An example `ClusterScanBenchmark` is below:
+
+```yaml
+apiVersion: cis.cattle.io/v1
+kind: ClusterScanBenchmark
+metadata:
+  annotations:
+    meta.helm.sh/release-name: clusterscan-operator
+    meta.helm.sh/release-namespace: cis-operator-system
+  creationTimestamp: "2020-08-28T18:18:07Z"
+  generation: 1
+  labels:
+    app.kubernetes.io/managed-by: Helm
+  name: cis-1.5
+  resourceVersion: "203878"
+  selfLink: /apis/cis.cattle.io/v1/clusterscanbenchmarks/cis-1.5
+  uid: 309e543e-9102-4091-be91-08d7af7fb7a7
+spec:
+  clusterProvider: ""
+  minKubernetesVersion: 1.15.0
+```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cis-scans/2.5.x/rbac/_index.md b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
similarity index 97%
rename from content/rancher/v2.x/en/cis-scans/2.5.x/rbac/_index.md
rename to content/rancher/v2.x/en/cis-scans/rbac/_index.md
index d6c2fd8b0ef..ad59f21f0fe 100644
--- a/content/rancher/v2.x/en/cis-scans/2.5.x/rbac/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
@@ -1,5 +1,6 @@
 ---
-title: RBAC
+title: Roles-based Access Contro
+shortTitle: RBAC
 weight: 3
 ---
 
diff --git a/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md b/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
new file mode 100644
index 00000000000..61235d798da
--- /dev/null
+++ b/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
@@ -0,0 +1,59 @@
+---
+title: Skipped and Not Applicable Tests
+weight: 3
+---
+
+This section lists the tests that are skipped in the permissive test profile for RKE.
+
+# CIS Benchmark v1.5
+
+This skipped and not applicable tests for CIS Benchmark v1.5 are listed in [this file.](https://github.com/rancher/kontainer-driver-metadata/blob/dev-v2.5/rke/cis_config.go#L81-L119)
+
+# CIS Benchmark v1.4
+
+The skipped and not applicable tests for CIS Benchmark v1.4 are as follows:
+
+### CIS Benchmark v1.4 Skipped Tests
+
+Number | Description | Reason for Skipping
+---|---|---
+1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
+1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
+1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
+1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
+1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
+1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
+2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+
+### CIS Benchmark v1.4 Not Applicable Tests
+
+Number | Description | Reason for being not applicable
+---|---|---
+1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
+1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
+2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+

From 46665a50b13a3098050737543ef21963361a17a6 Mon Sep 17 00:00:00 2001
From: Caleb Bron <caleb@rancher.com>
Date: Fri, 2 Oct 2020 13:37:23 -0700
Subject: [PATCH 230/265] Add apps and marketplace docs

---
 .../en/helm-charts/apps-marketplace/_index.md | 38 ++++++++++++++++++-
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md b/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md
index 907e2ba3d5e..007941b3f18 100644
--- a/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/apps-marketplace/_index.md
@@ -5,6 +5,40 @@ weight: 1
 
 _Available as of v2.5_
 
-> This section is under construction.
+In this section, you'll learn how to manage Helm chart repositories and applications in Rancher.
 
-In this section, you'll learn how to manage Helm chart repositories and applications in Rancher.
\ No newline at end of file
+In the cluster manager Rancher uses a catalog system to import bundles of charts and then uses those charts to either deploy custom helm applications or Rancher's tools such as Monitoring or Istio. Now in the Cluster Explorer, Rancher uses a similar but simplified version of the same system. Repositories can be added in the same way that catalogs were, but are specific to the current cluster. Rancher tools come as pre-loaded repositories which deploy as standalone helm charts.
+
+### Charts
+
+From the top-left menu select _"Apps & Marketplace"_ and you will be taken to the Charts page. 
+
+The charts page contains all Rancher, Partner, and Custom Charts. 
+
+* Rancher tools such as Logging or Monitoring are included under the Rancher label
+* Partner charts reside under the Partners label
+* Custom charts will show up under the name of the repository
+
+All three types are deployed and managed in the same way. 
+
+### Repositories
+
+From the left sidebar select _"Repositories"_. 
+
+These items represent helm repositories, and can be either traditional helm endpoints which have an index.yaml, or git repositories which will be cloned and can point to a specific branch. In order to use custom charts, simply add your repository here and they will become available in the Charts tab under the name of the repository.
+
+
+### Helm compatilbitiy
+
+The Cluster Explorer only supports Helm 3 compatible charts. 
+
+
+### Deployment and Upgrades
+
+From the _"Charts"_ tab select a Chart to install. Rancher and Partner charts may have extra configurations available through custom pages or questions.yaml files, but all chart installations can modify the values.yaml and other basic settings. Once you click install, a helm operation job is deployed, and the console for the job is displayed. 
+
+To view all recent changes, go to the _"Recent Operations"_ tab. From there you can view the call that was made, conditions, events, and logs.
+
+After installing a chart, you can find it in the _"Installed Apps"_ tab. In this section you can upgrade or delete the installation, and see further details. When choosing to upgrade, the form and values presented will be the same as installation. 
+
+Most Rancher tools have additional pages located in the toolbar below the _"Apps & Marketplace"_ section to help manage and use the features. These pages include links to dashboards, forms to easily add Custom Resources, and additional information. 

From e9beb2fa503c26c64c18faf98b7e261cd521dbd1 Mon Sep 17 00:00:00 2001
From: Jacob Payne <jacob.payne@rancher.com>
Date: Fri, 2 Oct 2020 14:58:24 -0700
Subject: [PATCH 231/265] added note about project namespace requirements and
 control plane / etcd log support

---
 content/rancher/v2.x/en/logging/_index.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/logging/_index.md b/content/rancher/v2.x/en/logging/_index.md
index 417ba9e97d3..6c096f25e05 100644
--- a/content/rancher/v2.x/en/logging/_index.md
+++ b/content/rancher/v2.x/en/logging/_index.md
@@ -21,6 +21,7 @@ The following changes were introduced to logging in Rancher v2.5:
 - Logging can be configured with a Kubernetes manifest, because now the logging uses a Kubernetes operator with Custom Resource Definitions.
 - We now support filtering logs.
 - We now support writing logs to multiple outputs.
+- We now always collect Control Plane and etcd logs.
 
 
 The following figure from the [Banzai documentation](https://banzaicloud.com/docs/one-eye/logging-operator/#architecture) shows the new logging architecture:
@@ -51,7 +52,7 @@ According to the [Banzai Cloud documentation,](https://banzaicloud.com/docs/one-
 > You can define `outputs` (destinations where you want to send your log messages, for example, Elasticsearch, or and Amazon S3 bucket), and `flows` that use filters and selectors to route log messages to the appropriate outputs. You can also define cluster-wide outputs and flows, for example, to use a centralized output that namespaced users cannot modify.
 
 ### RBAC
-Rancher logging has two roles, `logging-admin` and `logging-view`. `logging-admin` allows users full access to namespaced flows and outputs.  The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs.  Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster.  Cluster admin is the only role with full access to all rancher-logging resources.  Cluster members are not able to edit or read any logging resources.  Project owners are able to create namespaced flows and outputs in the namespaces under their projects.  This means that project owners can collect logs from anything in their project namespaces.  Project members are able to view the flows and outputs in the namespaces under their projects. 
+Rancher logging has two roles, `logging-admin` and `logging-view`. `logging-admin` allows users full access to namespaced flows and outputs.  The `logging-view` role allows users to view namespaced flows and outputs, and cluster flows and outputs.  Edit access to the cluster flow and cluster output resources is powerful as it allows any user with edit access control of all logs in the cluster.  Cluster admin is the only role with full access to all rancher-logging resources.  Cluster members are not able to edit or read any logging resources.  Project owners are able to create namespaced flows and outputs in the namespaces under their projects.  This means that project owners can collect logs from anything in their project namespaces.  Project members are able to view the flows and outputs in the namespaces under their projects. Project owners and project members require at least 1 namespace in their project to use logging.  If they do not have at least one namespace in their project they may not see the logging button in the top nav dropdown. 
 
 
 ### Examples

From dfa6dbc80e44f8d3e3d40e48359da9de7d251afa Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Sat, 3 Oct 2020 19:56:35 -0700
Subject: [PATCH 232/265] Revise CIS scan docs

---
 content/rancher/v2.x/en/cis-scans/_index.md   |  70 ++++++------
 .../v2.x/en/cis-scans/legacy/_index.md        |  13 ++-
 .../cis-scans/legacy/skipped-tests/_index.md  | 104 ++++++++++++++++++
 .../rancher/v2.x/en/cis-scans/rbac/_index.md  |   8 +-
 .../v2.x/en/cis-scans/skipped-tests/_index.md |  87 +++++++--------
 5 files changed, 194 insertions(+), 88 deletions(-)
 create mode 100644 content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md

diff --git a/content/rancher/v2.x/en/cis-scans/_index.md b/content/rancher/v2.x/en/cis-scans/_index.md
index 7f6e21506ed..3dbc69795c0 100644
--- a/content/rancher/v2.x/en/cis-scans/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/_index.md
@@ -7,7 +7,7 @@ _Available as of v2.4.0_
 
 Rancher can run a security scan to check whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark.
 
-The `rancher-cis-application` leverages [kube-bench,](https://github.com/aquasecurity/kube-bench) an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes [Sonobuoy](https://github.com/vmware-tanzu/sonobuoy) for report aggregation.
+The `rancher-cis-benchmark` app leverages <a href="https://github.com/aquasecurity/kube-bench" target="_blank">kube-bench,</a> an open-source tool from Aqua Security, to check clusters for CIS Kubernetes Benchmark compliance. Also, to generate a cluster-wide report, the application utilizes <a href="https://github.com/vmware-tanzu/sonobuoy" target="_blank">Sonobuoy</a> for report aggregation.
 
 > The CIS scan feature was improved in Rancher v2.5. If you are using Rancher v2.4, refer to the older version of the CIS scan documentation [here.](./legacy)
 
@@ -36,17 +36,21 @@ Support for alerting for the cluster scan results is not available for Rancher v
 
 More test profiles were added. In Rancher v2.4, permissive and hardened profiles were included. In Rancher v2.5, the following profiles are available:
 
-- Generic CIS 1.5 (default)
+- Generic CIS 1.5
 - RKE permissive
 - RKE hardened
 - EKS
 - GKE
 
-EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters.
+The default profile depends on the type of cluster that will be scanned:
+
+- For RKE Kubernetes clusters, the RKE permissive profile is the default.
+- EKS and GKE have their own CIS Benchmarks published by `kube-bench`. The corresponding test profiles are used by default for those clusters.
+- For cluster types other than RKE, EKS and GKE, the Generic CIS 1.5 profile will be used by default.
 
 The `rancher-cis-benchmark` currently supports the CIS 1.5 Benchmark version.
 
-> **Note:** The old and new versions of monitoring shouldn't run on the cluster at the same time.
+> **Note:** CIS v1 cannot run on a cluster when CIS v2 is deployed. In other words, after `rancher-cis-benchmark` is installed, you can't run scans by going to the Cluster Manager view in the Rancher UI and clicking **Tools > CIS Scans.**
 
 # About the CIS Benchmark
 
@@ -54,7 +58,8 @@ The Center for Internet Security is a 501(c)(3) nonprofit organization, formed i
 
 CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
 
-The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is [here.](https://learn.cisecurity.org/benchmarks)
+The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is 
+<a href="https://learn.cisecurity.org/benchmarks" target="_blank">here.</a>
 
 # Installing rancher-cis-benchmark
 
@@ -74,18 +79,14 @@ The application can be installed with the Rancher UI or with Helm.
 There are two Helm charts for the application:
 
 - `rancher-cis-benchmark-crds`, the custom resource definition chart
-- `rancher-cis-benchmark`, the chart deploying [rancher/cis-operator](https://github.com/rancher/cis-operator)
+- `rancher-cis-benchmark`, the chart deploying <a href="https://github.com/rancher/cis-operator" target="_blank">rancher/cis-operator</a>
 
 To install the charts, run the following commands:
 ```
-helm install clusterscan-operator-crds \
-  ./rancher-cis-benchmark-crds/charts/ \
-  --kubeconfig <cluster-kubeconfig>
-helm install clusterscan-operator \
-  ./rancher-cis-benchmark/charts/ \
-  --create-namespace=true \
-  -n cis-operator-system \
-  --kubeconfig <cluster-kubeconfig>
+helm repo add rancherchart https://charts.rancher.io
+helm repo update
+helm install rancher-cis-benchmark-crd --kubeconfig <> rancherchart/rancher-cis-benchmark-crd --create-namespace -n cis-operator-system
+helm install rancher-cis-benchmark --kubeconfig <> rancherchart/rancher-cis-benchmark -n cis-operator-system
 ```
 
 # Uninstalling rancher-cis-benchmark
@@ -106,21 +107,21 @@ The application can be uninstalled with the Rancher UI or with Helm.
 Run the following commands:
 
 ```
-helm uninstall clusterscan-operator -n cis-operator-system --kubeconfig <cluster-kubeconfig>
-helm uninstall clusterscan-operator-crds --kubeconfig <cluster-kubeconfig>
+helm uninstall rancher-cis-benchmark -n cis-operator-system
+helm uninstall rancher-cis-benchmark-crd -n cis-operator-system
 ```
 
 # Running a Scan
 
 When a ClusterScan custom resource is created, it launches a new CIS scan on the cluster for the chosen ClusterScanProfile.
 
-Note: There is currently a limitation of running only one CIS scan at a time for a cluster.
+Note: There is currently a limitation of running only one CIS scan at a time for a cluster. If you create multiple ClusterScan custom resources, they will be run one after the other by the operator, and until one scan finishes, the rest of the ClusterScan custom resources will be in the "Pending" state.
 
 To run a scan,
 
 1. Go to the **Cluster Explorer** in the Rancher UI. In the top left dropdown menu, click **Cluster Explorer > CIS Benchmark.**
 1. In the **Scans** section, click **Create.**
-1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. The CIS Operator will choose a default profile applicable to the type of Kubernetes cluster it is installed on.
+1. Choose a cluster scan profile. The profile determines which CIS Benchmark version will be used and which tests will be performed. If you choose the Default profile, then the CIS Operator will choose a profile applicable to the type of Kubernetes cluster it is installed on.
 1. Click **Create.**
 
 **Result:** A report is generated with the scan results. To see the results, click the name of the scan that appears.
@@ -133,7 +134,7 @@ To skip tests, you will create a custom CIS scan profile. A profile contains the
 
 1. In the **Cluster Explorer,** go to the top-left dropdown menu and click **CIS Benchmark.**
 1. Click **Profiles.**
-1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile, click the three vertical dots, and click **Clone as YAML.**  If you are filling out the form, add the tests to skip using the tests IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name:
+1. From here, you can create a profile in multiple ways. To make a new profile, click **Create** and fill out the form in the UI. To make a new profile based on an existing profile, go to the existing profile, click the three vertical dots, and click **Clone as YAML.**  If you are filling out the form, add the tests to skip using the test IDs, using the relevant CIS Benchmark as a reference. If you are creating the new test profile as YAML, you will add the IDs of the tests to skip in the `skipTests` directive. You will also give the profile a name:
 
     ```yaml
     apiVersion: cis.cattle.io/v1
@@ -164,30 +165,29 @@ To view the generated CIS scan reports,
 1. In the **Cluster Explorer,** go to the top left dropdown menu and click **Cluster Explorer > CIS Benchmark.**
 1. The **Scans** page will show the generated reports. To see a detailed report, go to a scan report and click the name.
 
+One can download the report from the Scans list or from the scan detail page.
+
 # About the Generated Report
 
 Each scan generates a report can be viewed in the Rancher UI and can be downloaded in CSV format.
 
-As of Rancher v2.4, the scan will use the CIS Benchmark v1.4. The Benchmark version is included in the generated report.
+In Rancher v2.5, the scan will use the CIS Benchmark v1.5. The Benchmark version is included in the generated report.
 
 The Benchmark provides recommendations of two types: Scored and Not Scored. Recommendations marked as Not Scored in the Benchmark are not included in the generated report.
 
-Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's [self-assessment guide for the corresponding Kubernetes version.]({{<baseurl>}}/rancher/v2.x/en/security/#the-cis-benchmark-and-self-assessment)
+Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's <a href="{{<baseurl>}}/rancher/v2.x/en/security/#the-cis-benchmark-and-self-assessment" target="_blank">self-assessment guide for the corresponding Kubernetes version.</a>
 
 The report contains the following information:
 
 | Column in Report | Description |
 |------------------|-------------|
-| ID               | The ID number of the CIS Benchmark. |
-| Description      | The description of the CIS Benchmark test. |
-| Remediation      | What needs to be fixed in order to pass the test. |
-| State of Test    | Indicates if the test passed, failed, was skipped, or was not applicable. |
-| Node type        | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. |
-| Nodes            | The name(s) of the node that the test was run on. |
-| Passed_Nodes | The name(s) of the nodes that the test passed on. |
-| Failed_Nodes | The name(s) of the nodes that the test failed on. |
+| `id`               | The ID number of the CIS Benchmark. |
+| `description`      | The description of the CIS Benchmark test. |
+| `remediation`      | What needs to be fixed in order to pass the test. |
+| `state`    | Indicates if the test passed, failed, was skipped, or was not applicable. |
+| `node_type`        | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. |
 
-Refer to [the table in the cluster hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/) for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
+Refer to <a href="{{<baseurl>}}/rancher/v2.x/en/security/" target="_blank">the table in the cluster hardening guide</a> for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
 
 # Test Profiles
 
@@ -210,13 +210,11 @@ There are 2 types of RKE cluster scan profiles:
 
 The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters.
 
-In order to pass the "Hardened" profile, you will need to follow the steps on the [hardening guide]({{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide) and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
-
-
+In order to pass the "Hardened" profile, you will need to follow the steps on the <a href="{{<baseurl>}}/rancher/v2.x/en/security/#rancher-hardening-guide" target="_blank">hardening guide</a> and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
 
 # About Skipped and Not Applicable Tests
 
-For a list of skipped and not applicable tests, refer to [this page.](./skipped-tests)
+For a list of skipped and not applicable tests, refer to <a href="{{<baseurl>}}/rancher/v2.x/en/cis-scans/skipped-tests" target="_blank">this page.</a>
 
 For now, only user-defined skipped tests are marked as skipped in the generated report.
 
@@ -224,8 +222,8 @@ Any skipped tests that are defined as being skipped by one of the default profil
 
 # Roles-based Access Control
 
-For information about permissions, refer to [this page.](./rbac)
+For information about permissions, refer to <a href="{{<baseurl>}}/rancher/v2.x/en/cis-scans/rbac" target="_blank">this page.</a>
 
 # Configuration
 
-For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to [this page.](./configuration)
\ No newline at end of file
+For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to <a href="{{<baseurl>}}/rancher/v2.x/en/cis-scans/configuration" target="_blank">this page.</a>
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cis-scans/legacy/_index.md b/content/rancher/v2.x/en/cis-scans/legacy/_index.md
index efd9cf3ca4f..155073640f1 100644
--- a/content/rancher/v2.x/en/cis-scans/legacy/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/legacy/_index.md
@@ -1,10 +1,14 @@
 ---
-title: Legacy CIS Scan Documentation
-shortTitle: Legacy
+title: Cluster Manager CIS Scan (Deprecated)
+shortTitle: Cluster Manager
 weight: 1
 ---
 _Available as of v2.4.0_
 
+This section contains the legacy documentation for the CIS Scan tool that was released in Rancher v2.4, and was available under the **Tools** menu in the top navigation bar of the cluster manager.
+
+As of Rancher v2.5, it is deprecated and replaced with the `rancher-cis-benchmark` application.
+
 - [Prerequisites](#prerequisites)
 - [Running a scan](#running-a-scan)
 - [Scheduling recurring scans](#scheduling-recurring-scans)
@@ -12,6 +16,7 @@ _Available as of v2.4.0_
 - [Setting alerts](#setting-alerts)
 - [Deleting a report](#deleting-a-report)
 - [Downloading a report](#downloading-a-report)
+- [List of skipped and not applicable tests](#list-of-skipped-and-not-applicable-tests)
 
 
 # Prerequisites
@@ -146,3 +151,7 @@ For more information about alerts, refer to [this page.]({{<baseurl>}}/rancher/v
 1. Go to the report that you want to download. Click **&#8942; > Download.**
 
 **Result:** The report is downloaded in CSV format. For more information on each columns, refer to the [section about the generated report.](#about-the-generated-report)
+
+# List of Skipped and Not Applicable Tests
+
+For a list of skipped and not applicable tests, refer to <a href="{{<baseurl>}}/rancher/v2.x/en/cis-scans/legacy/skipped-tests" target="_blank">this page.</a>
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md b/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md
new file mode 100644
index 00000000000..9505eb42b7c
--- /dev/null
+++ b/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md
@@ -0,0 +1,104 @@
+---
+title: Skipped and Not Applicable Tests
+weight: 1
+---
+
+
+This section lists the tests that are skipped in the permissive test profile for RKE.
+
+- [CIS Benchmark v1.5](#cis-benchmark-v1-5)
+- [CIS Benchmark v1.4](#cis-benchmark-v1-4)
+
+# CIS Benchmark v1.5
+
+### CIS Benchmark v1.5 Skipped Tests
+
+| Number | Description | Reason for Skipping |
+| ---------- | ------------- | --------- |
+| 1.1.12 |  Ensure that the etcd data directory ownership is set to etcd:etcd (Scored) |  A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.     |
+| 1.2.6 | Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)  |  When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.  |
+| 1.2.16 | Ensure that the admission control plugin PodSecurityPolicy is set (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 1.2.33 | Ensure that the --encryption-provider-config argument is set as appropriate (Not Scored)  |  Enabling encryption changes how data can be recovered as data is encrypted.     |
+| 1.2.34 | Ensure that encryption providers are appropriately configured (Not Scored) |  Enabling encryption changes how data can be recovered as data is encrypted.     |
+| 4.2.6 | Ensure that the --protect-kernel-defaults argument is set to true (Scored) |  System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.     |
+| 4.2.10 |  Ensure that the--tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored) |  When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.     |
+| 5.1.5 |  Ensure that default service accounts are not actively used. (Scored)  |  Kubernetes provides default service accounts to be used.     |
+| 5.2.2 | Minimize the admission of containers wishing to share the host process ID namespace (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.2.3 |  Minimize the admission of containers wishing to share the host IPC namespace (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.2.4 |  Minimize the admission of containers wishing to share the host network namespace (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.2.5 |   Minimize the admission of containers with allowPrivilegeEscalation (Scored)  |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.3.2 | Ensure that all Namespaces have Network Policies defined (Scored) |  Enabling Network Policies can prevent certain applications from communicating with each other.     |
+| 5.6.4 | The default namespace should not be used (Scored)  |  Kubernetes provides a default namespace.     |
+
+### CIS Benchmark v1.5 Not Applicable Tests
+
+| Number | Description | Reason for being not applicable |
+| ---------- | ------------- | --------- |
+| 1.1.1 | Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.     |
+| 1.1.2 |  Ensure that the API server pod specification file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.     |
+| 1.1.3 |  Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.1.4 |  Ensure that the controller manager pod specification file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.1.5 |  Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
+| 1.1.6 |  Ensure that the scheduler pod specification file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
+| 1.1.7 |  Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.     |
+| 1.1.8 |  Ensure that the etcd pod specification file ownership is set to root:root (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.     |
+| 1.1.13 |  Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.     |
+| 1.1.14 | Ensure that the admin.conf file ownership is set to root:root (Scored)  |  Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.     |
+| 1.1.15 | Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.  |
+| 1.1.16 |  Ensure that the scheduler.conf file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
+| 1.1.17 | Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.1.18 | Ensure that the controller-manager.conf file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.3.6 | Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)  |  Clusters provisioned by RKE handles certificate rotation directly through RKE.     |
+| 4.1.1 |  Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.     |
+| 4.1.2 | Ensure that the kubelet service file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.     |
+| 4.1.9 | Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.     |
+| 4.1.10 |  Ensure that the kubelet configuration file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.     |
+| 4.2.12 |  Ensure that the RotateKubeletServerCertificate argument is set to true (Scored) |  Clusters provisioned by RKE handles certificate rotation directly through RKE.     |
+
+# CIS Benchmark v1.4
+
+The skipped and not applicable tests for CIS Benchmark v1.4 are as follows:
+
+### CIS Benchmark v1.4 Skipped Tests
+
+Number | Description | Reason for Skipping
+---|---|---
+1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
+1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
+1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
+1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
+1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
+1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
+1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
+2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
+2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
+
+### CIS Benchmark v1.4 Not Applicable Tests
+
+Number | Description | Reason for being not applicable
+---|---|---
+1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
+1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
+1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
+1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
+1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
+1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
+2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
+2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
+2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
+2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
diff --git a/content/rancher/v2.x/en/cis-scans/rbac/_index.md b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
index ad59f21f0fe..46f6dae1e93 100644
--- a/content/rancher/v2.x/en/cis-scans/rbac/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
@@ -1,5 +1,5 @@
 ---
-title: Roles-based Access Contro
+title: Roles-based Access Control
 shortTitle: RBAC
 weight: 3
 ---
@@ -16,7 +16,7 @@ However, the `rancher-cis-benchmark` chart installs three default `ClusterRoles`
 # Cluster-Admin Access
 
 Rancher CIS Scans is a cluster-admin only feature by default.
-This means only the rancher global admins, and the cluster’s cluster-owner can:
+This means only the Rancher global admins, and the cluster’s cluster-owner can:
 
 - Install/Uninstall the rancher-cis-benchmark App
 - See the navigation links for CIS Benchmark CRDs - ClusterScanBenchmarks, ClusterScanProfiles, ClusterScans
@@ -36,6 +36,8 @@ The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmar
 | `cis-edit`| `edit` | Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
 | `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
 
-Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but these default k8s roles will determine access to CIS feature.
+Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but these default k8s roles will determine access to the CIS feature.
+
 By default only cluster-owner role will have ability to use `rancher-cis-benchmark` feature.
+
 But the above ClusterRoles can be granted to cluster-member, project-owner, project-member users if a cluster-owner wants to share access.
diff --git a/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md b/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
index 61235d798da..3f30315daa4 100644
--- a/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
@@ -7,53 +7,46 @@ This section lists the tests that are skipped in the permissive test profile for
 
 # CIS Benchmark v1.5
 
-This skipped and not applicable tests for CIS Benchmark v1.5 are listed in [this file.](https://github.com/rancher/kontainer-driver-metadata/blob/dev-v2.5/rke/cis_config.go#L81-L119)
+### CIS Benchmark v1.5 Skipped Tests
 
-# CIS Benchmark v1.4
+| Number | Description | Reason for Skipping |
+| ---------- | ------------- | --------- |
+| 1.1.12 |  Ensure that the etcd data directory ownership is set to etcd:etcd (Scored) |  A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.     |
+| 1.2.6 | Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)  |  When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.  |
+| 1.2.16 | Ensure that the admission control plugin PodSecurityPolicy is set (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 1.2.33 | Ensure that the --encryption-provider-config argument is set as appropriate (Not Scored)  |  Enabling encryption changes how data can be recovered as data is encrypted.     |
+| 1.2.34 | Ensure that encryption providers are appropriately configured (Not Scored) |  Enabling encryption changes how data can be recovered as data is encrypted.     |
+| 4.2.6 | Ensure that the --protect-kernel-defaults argument is set to true (Scored) |  System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.     |
+| 4.2.10 |  Ensure that the--tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored) |  When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.     |
+| 5.1.5 |  Ensure that default service accounts are not actively used. (Scored)  |  Kubernetes provides default service accounts to be used.     |
+| 5.2.2 | Minimize the admission of containers wishing to share the host process ID namespace (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.2.3 |  Minimize the admission of containers wishing to share the host IPC namespace (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.2.4 |  Minimize the admission of containers wishing to share the host network namespace (Scored) |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.2.5 |   Minimize the admission of containers with allowPrivilegeEscalation (Scored)  |  Enabling Pod Security Policy can cause applications to unexpectedly fail.     |
+| 5.3.2 | Ensure that all Namespaces have Network Policies defined (Scored) |  Enabling Network Policies can prevent certain applications from communicating with each other.     |
+| 5.6.4 | The default namespace should not be used (Scored)  |  Kubernetes provides a default namespace.     |
 
-The skipped and not applicable tests for CIS Benchmark v1.4 are as follows:
-
-### CIS Benchmark v1.4 Skipped Tests
-
-Number | Description | Reason for Skipping
----|---|---
-1.1.11 | "Ensure that the admission control plugin AlwaysPullImages is set (Scored)" | Enabling AlwaysPullImages can use significant bandwidth.
-1.1.21 | "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
-1.1.24 | "Ensure that the admission control plugin PodSecurityPolicy is set (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.1.34 | "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.35 | "Ensure that the encryption provider is set to aescbc (Scored)" | Enabling encryption changes how data can be recovered as data is encrypted.
-1.1.36 | "Ensure that the admission control plugin EventRateLimit is set (Scored)" | EventRateLimit needs to be tuned depending on the cluster.
-1.2.2 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the scheduler.
-1.3.7 | "Ensure that the --address argument is set to 127.0.0.1 (Scored)" | Adding this argument prevents Rancher's monitoring tool to collect metrics on the controller manager.
-1.4.12 | "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)" | A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
-1.7.2 | "Do not admit containers wishing to share the host process ID namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.3 | "Do not admit containers wishing to share the host IPC namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.4 | "Do not admit containers wishing to share the host network namespace (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-1.7.5 | " Do not admit containers with allowPrivilegeEscalation (Scored)" | Enabling Pod Security Policy can cause applications to unexpectedly fail.
-2.1.6 | "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" | System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.
-2.1.10 | "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" | When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.
-
-### CIS Benchmark v1.4 Not Applicable Tests
-
-Number | Description | Reason for being not applicable
----|---|---
-1.1.9 | "Ensure that the --repair-malformed-updates argument is set to false (Scored)" | The argument --repair-malformed-updates has been removed as of Kubernetes version 1.14
-1.3.6 | "Ensure that the RotateKubeletServerCertificate argument is set to true" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-1.4.1 | "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.2 | "Ensure that the API server pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver.
-1.4.3 | "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.4 | "Ensure that the controller manager pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager.
-1.4.5 | "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.6 | "Ensure that the scheduler pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler.
-1.4.7 | "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.8 | "Ensure that the etcd pod specification file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd.
-1.4.13 |  "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-1.4.14 | "Ensure that the admin.conf file ownership is set to root:root (Scored)" | Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
-2.1.8 | "Ensure that the --hostname-override argument is not set (Scored)" | Clusters provisioned by RKE clusters and most cloud providers require hostnames.
-2.1.12 | "Ensure that the --rotate-certificates argument is not set to false (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.1.13 | "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)" | Cluster provisioned by RKE handles certificate rotation directly through RKE.
-2.2.3 | "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.4 | "Ensure that the kubelet service file ownership is set to root:root (Scored)" | Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service.
-2.2.9 | "Ensure that the kubelet configuration file ownership is set to root:root (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
-2.2.10 | "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)" | RKE doesn’t require or maintain a configuration file for the kubelet.
+### CIS Benchmark v1.5 Not Applicable Tests
 
+| Number | Description | Reason for being not applicable |
+| ---------- | ------------- | --------- |
+| 1.1.1 | Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.     |
+| 1.1.2 |  Ensure that the API server pod specification file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.     |
+| 1.1.3 |  Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.1.4 |  Ensure that the controller manager pod specification file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.1.5 |  Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
+| 1.1.6 |  Ensure that the scheduler pod specification file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
+| 1.1.7 |  Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.     |
+| 1.1.8 |  Ensure that the etcd pod specification file ownership is set to root:root (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.     |
+| 1.1.13 |  Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.     |
+| 1.1.14 | Ensure that the admin.conf file ownership is set to root:root (Scored)  |  Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.     |
+| 1.1.15 | Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)  |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.  |
+| 1.1.16 |  Ensure that the scheduler.conf file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.     |
+| 1.1.17 | Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.1.18 | Ensure that the controller-manager.conf file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.     |
+| 1.3.6 | Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)  |  Clusters provisioned by RKE handles certificate rotation directly through RKE.     |
+| 4.1.1 |  Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.     |
+| 4.1.2 | Ensure that the kubelet service file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.     |
+| 4.1.9 | Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.     |
+| 4.1.10 |  Ensure that the kubelet configuration file ownership is set to root:root (Scored) |  Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.     |
+| 4.2.12 |  Ensure that the RotateKubeletServerCertificate argument is set to true (Scored) |  Clusters provisioned by RKE handles certificate rotation directly through RKE.     |
\ No newline at end of file

From 197ba66671f79f92fd143a52799e6db1a5e24ea4 Mon Sep 17 00:00:00 2001
From: rajashree <rajashree.28m@gmail.com>
Date: Sat, 3 Oct 2020 15:02:44 -0700
Subject: [PATCH 233/265] Update backup config docs

---
 .../rancher/backup_restore/backup/backup.png  | Bin 0 -> 336511 bytes
 .../backup_restore/backup/encryption.png      | Bin 0 -> 85790 bytes
 .../backup_restore/backup/schedule.png        | Bin 0 -> 69112 bytes
 .../backup_restore/backup/storageLocation.png | Bin 0 -> 136628 bytes
 .../v2.x/en/backups/back-up-rancher/_index.md |  21 ++--
 .../configuration/backup-config/_index.md     |  99 ++++++++++++------
 6 files changed, 79 insertions(+), 41 deletions(-)
 create mode 100644 assets/img/rancher/backup_restore/backup/backup.png
 create mode 100644 assets/img/rancher/backup_restore/backup/encryption.png
 create mode 100644 assets/img/rancher/backup_restore/backup/schedule.png
 create mode 100644 assets/img/rancher/backup_restore/backup/storageLocation.png

diff --git a/assets/img/rancher/backup_restore/backup/backup.png b/assets/img/rancher/backup_restore/backup/backup.png
new file mode 100644
index 0000000000000000000000000000000000000000..681b6f1f3f39b672c9b08715b35d8d52c168235b
GIT binary patch
literal 336511
zcmbSyWmubCwkS|2R;&~#MQcEDDNcZv;%>pUI0SbsP@qtx6nA%m6CijgP}~Xb9)bso
z-+VK3&OK+Id%u})^5cE-?ySAm-fJ)4E8!|i(gb+V@X*lE2xMhGsG*_Zv!S73J;Hg2
z8VNg1-$O%tL}4u<p&~0GL9gQMU}0@%j)o=^o}h)Tp)O02silS^%M_@R|9J^B)-WF?
zlR(J#{;>=b7iLgID=TxOdv$j44&E0K+b34$7w#0DOBDFb{ZQ?yoD*fd9cX~yJ-~A5
zdMU%_(D$M(MUV%rxXJP7n!X0jClS@0SM03c627PQyZ}7J$$s!`6y1>8K2U(3kMFTK
zrT4wTl0n$CO2y28>22+Od&I*SqYf;z@DPDut&XAK-^6H*qFStPFh7l=BQ4bNySZ=3
zP1$f?;h@E`cIn{R(RWee?K3sVe!&kCc#6iI&=qTjE}qnFN#;~*ObvZ%Dovuy6y(YB
zvrQj84BLs~=gZTRLh*8`kQt%%W&xdmuPI#Aab11SdLr~U-V>6Oe{m6<xF2!8ap)UJ
zAdE7>qtc|ujfvZQ1P8|PynY}0+#_Eno`mK>HN#KK5Rs<VN6X|gU8D);tqVc)+B_YY
zXjmdjj+j5I5}DLf<DO>!RH6=FpqR@W`|;jA=&_|t;m<egd6KycJ2K|!-58=iI9ez8
z@7KcYxI=R6zN{)p5Ru_O{!S(`26<tk_V%ai7hyc-wU_a27hkd7jY;r5woZ?%75wSI
z^E$@~k4k~R(wK>3FmNC?rU1V>Acy|B{_59)BYd?NVFE|LJD=kbK8@j!({S!u*~g1i
zze@b#@-g9D`?VN9tCFgvUBElln{S7k?*%%axOLE4xb*Ze|NeORGo%_9&t8D=#XDl0
zhphA=Y!4LBXT@ih=11|{p8#?`J$OZre-zlN#<LO2dPve~DZ=zH;Qdc*tS<k+6GKs^
zpev3p-R=omvwoki8?=HexIeubMGwCEtj8Yh5~YzI1o{wOR!@dXy$&S~4qyGLk~_pn
z#BP>>pN5HZAH|N*cF8GBNin8ExV%P^Ni2j*gbTwl_^d~dE0QR!s;fvooOIKXj+HA;
z5lLP;$o`;bpR%Tt?YXU%2=PVW&2x|RaQFkC1uTolpRPL>^mERALdQ+)mu)WBJ-Mfs
zxAP_^K)V%k<dj_j3|2FHy-e?xr@mk>lZfe>eyt9kq1?xGC$#N(hK4U3&1*_goyRRA
zLP|Se`D4_|$=P0zGurW2PxWwh@A0Xa)HV~P%*H*{lanH{e)12aPmW!~IptM;;e8V3
z&gv$2qLHder_NY8V47bhoA0G6^j(%p-frJL(L+084e2j;5Q?Tmlg>oz@Vrp8Jb%Vs
zNrpy^Sdn`ziATfkLyU%1+?kMr9r=l}DpXJqoqvVk<{i#cd{c1@8LT+tDJ*)TnoK;4
zAg^r9_&_pawiz7ACq(wceROQ`2UZUmJFFeiT|e2b5T;Wtu3+svIP5?RqJQ-{l#>|n
z^J%sCJ~89Z2gj1{zsbBJl$9KhW&QA3CN||4M*bt65W5eM=k>oTf01lpIuq`GuzybU
zjdp|g1h-p-xisWiZsHEp<O2fnm!p`jFH%Fc^1654yHY}F!S6ltkUO|%7~TYk_eR;b
zPdhZY7%YNjKhkOwlLr@=q$FdeMJ1SSYLh`IY=iEv@TNnMrgTm(hC6f`0qI$*o-c;G
zPmgDRtNFe(42G?Pev{pxFNFoX9>sZxDI7!*s3`N?jHK|f9M0zFjL%)4)g2M8q)Q~>
z9~j0Wb_ih>%v@;#!Hw~aDUC5R@AqGczBrGQc?I}R(--zcV(lBA?CX4j{KfqB{DFM?
zaqJrA+2s8Xgs+QYB{wcNoKM(KxK7MZ)K5M|KqEpTlH?-sl+B_2&IvTkip)tGP|b%-
z&z`VE5WNoku9zaNqdY4wDA^?Ml~-D7Q@U3oq@-Caq~+GS=RZ|jN~9sC##;iJq~F6V
zjfY0+DuQyBa@%sotP<Y_=sp8~gG2)5g=L$Suf;7#X?E;{Vno9X-&GbF6}D@rtJbRE
ztEA-v%YhZ{Dv0m8mCy)if%i8dX+MZ}$Q22aYVY>hqo}cGT+h6o$@98fr%!km%8u7f
zJ{sGwW}jTB@KQS^dGIlrE9j|y4@M7R&l{-*a@7I3uiyl*W?{W_nL(Mdp8C9`u&ht2
zd&s#ef}NqK&a5V-X>fD!!61B4StwKpUC1}%wUCb+JG=!(lLN0DfU!+27WpV%#L>!g
zeBh9FC@>6O0{H1K0|V0UG;ZZ?)vsD#)=7EBtVA=>I2r#0J(%p6rXMyA?Q{?R`tUYX
zD%2#@w2L5=k-#S^S?W$|R?0RqniBbxC(<t}q{lWghDyxRx)wvbsT^6(2h0i&lx+;3
zG)t3h?)y}dV4b_`JK<M&G00>=Yms7MJE%K!H5fINH)xp(OIe1fR3B9lYnRswd^}zn
z@8_O%jx`V7<Y6&jfoN81W=t8_rq*Y<wYeoAHK}r=!W5&2EYb+|Ca0%>#(E|`eT4Nc
zwWM<(2%K8>>8_yK+Zvk<0-sX9Pkym}8MhCx3nlWqe8V1wCFKoD7ewg_?hO`KMpr~P
zMGI3OMov=$+|O>t6!VOPXN8<HnA0nSCekG`wgvcw+MTOiR+}}T3$EskQcdj6Ah+AK
ztpf(9dHD3Y{XynITi<PHSfX@!uUbrPCgzCvh+yVWCSB`73tlUs=j|rwFk`)S;Cl9H
z8P^S$aF56d7jpHt-RbU$`DNj?JrZ%kbG-gr^Ad2zf4Y5ncoy)?nDiS>mGFvr_Q&j3
zM~*Ak^p)8<@7OxE9km^;9euu7$e8}>`F5RCn4^>9mg8qqVZ!r6_XqAO$tp{iLlwcS
zzB^m9L;3ZL&d2!|#U#fhR4-|z=A`6aq~(qlSF4ug9Z2bY_?k;)D*i~=!fmisyKLrW
zX1Rx?w>!G*>BTF1*M-4Gp5w^heaFpf%dasRSd|;&tTLDs?G)AIQ@?4XorwwxcxgIo
z^%uwMyrED-s)v+BS?AZ~*JW7Wu1oY((kufy-QM?ohLeIBl+rxyzu)CA$VxMoDQ+o<
zCM(G(D=jD7rI2=&tesg_@$i|SIR!Vu8#z4hT6kM%+lT_l?yU=zw@L>sbwqW_YP~W2
zgPh-0a>_KS{$>^y@sU5jPEStXOYdCRSn%`OXgO<n`9e`Ox)>BO7H_RC)a}0Z*h#BR
z>u&BwRQ9u(CAu1Cb#}E1KCK(O9JoMCmhQ<Vx#knU<kYvwmA6sWxz-d#^GZhCx7JQp
z#~eIIlnaz#9z~1cv`b@PM>(iAc9ybMZ##KNN1({Zer6%nE8a`+)IaM`AYkgI0slM2
zTei3Q0v@Y*SwH+sS#pwO<m_2b4C~Cf+O!)R{lZVb6UetEp2&?P2__~a`5E>bc;9W0
ziB;ZvIqGcHoNw9>uxJr$eF5ql?Kad{B=nT7X~qDh!4*bby6Vs^#9W{4NJ4YGgO0Qg
zqXDd5)Y)(S;VA(NpYIaWj3@X-mFY4=u%bL)>+;~dZ_{|Y^C5W`o4KASh|IpViOo*W
zFTq^%(tYhb7oqI_3L$X%wU?t_80nFSxKU#(Jtz$?vo3S11TUIb*?Q6FGJ@f=027bi
z%oRYC58}dpzIQ<jLbsoE5O8OERS6^dKy3xsadJF-{#7E4kcTj7`XzD#e*FxSz#yt5
zDnq)5)*5tTFLaaE<uEnGFhnL@AHyytB?vj1Svg)?zhzrXTq4zBq^(!7Z*}3`+?awm
zfe=M6lrjJ`-d7tbpLlvluF^rG+inNHykbrXC>Gc!ja*wje|x}|i5i;gVMfmFlQXNc
zW0Qh~r!(g51B?}zMuL6`e#js7JGL1x(#qu)u2m_R;?j_1gR?^`)WFqeWq6_ab92GP
z<YB@xf1?pHY>4g}x&Vz9#qoDMHo55%j%kcB6k+$gY4TYmor^mu>QT1M5(L;D;39TC
zMen>W@Q=R+E`1l{y<0dNzuL@czqyCbB#pyv<xXslkmLN`4yDV`77!u^(SFZ<xY%($
zPUKBzBkJuda{A_SVj{34OEwD@P<=Um#=8bz>}=_L$0hwEmJW+^W^_;i%~0!sxO|8u
zwr5P<DA@%^6Mckm9(CaTXEKksO^xU(2qN({eY6*=lm(CZ@V}HCu?hP#{(dky>(%(C
zfPP|DmgFm*1J`Gw;9!SG==8kkN0QtE0##m)M+1a1=j3Q?mk~Z$3SW*Q+o#@z3PFv6
z=r)b)UV;2i<v)(1p`lM%YiPS_D=G+mbO5oNm^ql5vwMOZQ7Hr(nuw<m>MO|H)r8&?
zWM}Up<Oz83HwYor_dkX?UeNyy#MKt?LR(RVUc$lIoSv8cEj#B6Q9OEjdJ$(c3n8@+
zQvaBadIP+$a&>hS;^6S`@L>1gVRvx0<lqt%6y)IK=HTXLLqV{)c-gy}c(U2My!<<o
z|HAXZ+~uRQwWF)GgFXEpcuh<l+*|=KUi?AmzdwIpr>nKa|D|N_@{etyHpubEFC1L#
zoE-m+8#Ptrk5M5B2auz)xr+-5zbKc;-yr|j*#D*TcX(xIYje~}|5(p|!~f5*e}-4F
za&UD(an0HKqpZEFxigB`KW20PgWCTe;vcv~IR4o9|6s)5x%{_L6q`lyL^%HY$VBll
zW<Ft|p^2l(et4(hiN3#xZ~SDl_2Ss*0Jkr+gW>aMy~hec;^L7qFPW1dGJ4{GV(B{R
zvU(u6GSmAk{c3Ix?gcL?x|)*%*_HsT^lZWP5E-%(vUjgF#edSLetKn$gNf7dYD3O5
zYZh)-Bg;qO9C%m<A08GN;Tbti>Dy;N&AJa&Y`<4#?EZ{~fkXcZ4da0!Js-fQ<06*u
z1?uf@L;uF36Z1zfn;GT54gWt;j_P4xvRx#;Li|DgfBx|Ayo#%!2PFpAR1u?N5{sk#
z#fP{2r|iw8@A)+U!CYb-X7N#H6>{>w!lwV)owx%oaovL6_qyP}zGF0ucUUii+0CE-
zWnQ6Z)sYle&Ma9_;tNsGPdIN&#s6iVp|~7Ki}TI83ENXc@~<+SSbzuX&K<VkPx(70
z!0W?EWietJ(tdOK{A#J45Dr|-1iqMXR>mrc`A^tFgNNejb0QX!|6otqMSsYk#<#2g
zI-$R^fYBUrvoKqo@PA{DI0s(c+v(k($2J*u_O4>ON@u3<w;?F4lci@Bd2bRshQ}ZC
z<#{;X*Jwn-ffMa6nbb2})lcgJADAMZqtqez!-_@*47=~>x-|{8-fQ;k2mf-x9hCHr
zC;6#mWs~|YzaKqimH2>$F29oB^ky}`NwpJ?+g{XPBNn&o$*!ZEiOJ%FHIZ=uzYS96
z(|V({uZ9%rgde7hS7yPm7jUrM!`|cR4pRzhh_!f!+WTCAG^qtetEA1mx4%S<kF>kz
z_}7)nr1cXL{=OT3_b+v7#g)QJ<adg0>NEYWM={arjeU(a=EezqKl@R(sHo%<S)E-?
zX~Wy;<_Aebiuh~<ZV^h96JT@~+Ff$01aIaJrv>$QdoNL3c_5#iGy;EM>-eCZe>KPT
zc>eS>UX;~Piz1S!z_UF`$8lJDGynCjPg2JGp<m9w!Lbx}V{>f?Mq<~GE(0ClO9jXj
zCuyTX$4QF68Ry-EVaGze@hw;{;1n2Y4yPU+*EsBlE=^UV7FPOn(?=1-IT({Q4$2li
zCB|s=G^8V5r!>phd21yIu>Nwwqpsi8Pnq(TDb%B)s2!MHpYS>r_g~ws>;Oz9D8>__
zCO+C&PJI(quG<L`NCX<jEwk}0Li#6>3o@ta>YI``cV*c4o8gx^Osa((m;%w)?^8g3
zm{mW<(YRCZW#q}(oLbSlfm(+AODSJ_sTv1=`Vj%sJm1AMH%R+^Tgc$QVS~@Y#a$4p
zF!vuHLz!5)p~{dxDPnPBV?6D^chgNBsY;&11UYB%r!q`(@w+VO(d%vBErd~0D!z>4
zdeO4P-zt0y8MhvFR+?KG&`2jH-JMszq&#39Ys31th^KV)ZArl(Kl0YE?9%K|Tz*&~
z?&(@y=E9cgBEbaM6nPx+*!)TjbqE~wv*ain>9~glbukn}wh93nMp1O#_g3(Ahh^nY
z5a9jE56dDv|5Afc>|=4P>7%KmCf~j9UT8z0>q(#m2EHODUlpbBd=M+KOSK)V63;Y|
zghAcwS26_o!$zuejAoo(l^jm(Hii7k3P8MH{&h|(SV0G7R&(=<b4UT8&FETj9J09L
zS(b|ekXwwUoFj`V)J|j0Kc%oDON0?B*#Cx9z%dw=A&o2{ZmH^J@F?{MD0XCtdwwn(
zVboLlyx=kX^0~TdRplRoAeZ_#|LXU0GzujMuKQ>6a%TP(avjCaQiM}lS^Dd`7DEl0
zx=9YLcN#5*oS^i((*i}^%gzIPUWcfU>a(5pQw5Lz6PI(QkUa!02U=|2M4D-p0YldU
zxfcVx+Q#ETUFR~4&4aLvJm!e8{<`xf7SGngd=Xs#eFYaN%0EHVLS3#9z<S-2j_Z9?
za3Q>Krd1dPsucxkZ+8xZn5+M?t3sWjJ7z`m#{gklA)}jsd%xtKC|ZHO5aGjW*X+H|
zcZkkXm57IIq;IX73fuZL1+=HvvcYF#KlUecXzZ;!1wSIAW-S}u#PM*K3~`hH8+!H6
zAfpC>h=K#p`GZLZE0Ng@n_JzYrptV9?yc;11Fx^6p$`)hpDb4f+qNF3*R6E+0v(ZJ
z0roA4PtvEL5pXwm8`IHER+O#(mv;D{LH-b32CLcr8hu1x9m+_YlpMa}hkSFmLY`8w
z<24n&WY;BGH4z%){+&B6LHi2pKk&CtvoTh|*PBB%`(L7LT5VL?qhqW|vjD}t65Ia?
zHdc&xL5VSs65A$}|MG7CFw>YAprFJHTG4|&ca(0P(>je11v$CSbU))s{OG1glW6k#
zKN0-&XMw+_hZ6UN_w>$Y%INlDUuT`R(w6f~3nc#~X}^;05EPQc@9BBNX8nbl7u$6i
zT6(uDQwidg!!Imgdih35P&QWgvH_uMFku@tLHvi!)5WX9)rG`3BN%<$;3o}d2o6Qn
z;a@rDnuuY&*%X>;RXNU>yUcR5eY%uSn~LVx*Uc<;bbmoqcE|$pxxc^VVUb-mF{wCb
zj^^9pr()4Ry%*(IpI+<VlLFi>(ZXs1(&BP{9dT+-@$Hrb#5X7U!GBcCeF=9Q;?J}i
z+fyz*8*5XiaBE%(dbF5MelTY!vB?EH&AuC{(pYpmX6kNyIF<{(rDNwW7TguVz)7e4
z<D4iIsHliHY_V?qk=qWR%T2IY?{Al|o+lkDy(?4R7CTb&C{-&W!g4;XaecQ(Y)%-X
zwVOy(*V33n)ZicLz|18H%XC=m<JH(*m3F(QgIHHBr@4n7s)qh~%sC3fzzx^s=2Eo|
zck2IAF%euD?=l3gyg;8vxdML@$7pvOLug;9u!z!F7~#(9Mf910m=NIN`|R`_rFA&h
z)uE(d+b46|6f(Pg0$szmg58*GVb<4yx<;cXS`39u4BYz7gj1J6iS5a74Y~Jqnv1+c
z1B%n;?Q`X!TjYnihJN<0^>9L6dlBBWovAzbIc@c?&lI0KjB>}SW<;p|p~5O@*_)N=
zJWAa@F?$#Hzv~7>b{X96i7GS4HoY|jXt1cSE(VI2NBnpaBZ&Ook2=#GYz<ml!iT@6
zAFyS9QL9OLY1KsJftL3EpY6f_5{suD7$*HsSHJNrVJfB==k3i2B~aVjOe{x+=ehX=
zcD1$?=uS`ZS2Wd|n4)9gJi-Xv!E`y5REtknUA3{Z(a_m+(yRv{E~RQ#f>@3C^fjlE
zD3@HcZOA<jJ)dYasjm36nHa~2l<Ip9t2xO-w)y?`mQDCEcz>>W-DR~rV^~mp<VaIq
z|HE!^VqTbNfP}O}+r>^lnO7maI@XymT&<fc0N|jL`FAU_LlDUKZUC6);b$EIuP!+g
z|1~eegFdj^wI;zHz(6*b?w^?nePu8vl+$A|^6RDITZdEJz6IXNnVIa2&Fiyf{)WAb
z;G!6XRwO0kFd(ysP;{SgpG5d9tHGfBvg@S==v=Gr@@w^Z4t#duWNOCqJy{sxZq(2`
z(r#=lkmt!Y!iw#n8TwFZdk6Pl7?4}~Z{P9{2dRp@KAHk3NkD#9)<D@=^xKuqMdo96
zKJ=lsa9exPh>D@lyA@?4Q>K=UrOI_oLd<HK=H}3o&Hn5m0Y(e>><E#Tt9ospJ|(-f
zMqcJ`1UbM%z{&}gqKY$OoDS1fI;8XH?>Zd}LeAF++>p!*x;fX=4N(L&mR(@J?RL=&
zAz_rn@)>*7)um59D09bTtu?&K(gek6`UfC~`8H_{)VFjk%<UmTi79_KVFFVa?}8Is
zsfI=rj)zYc9t6&+s}Ci;VcB&2Y?^CF(3F@0J05c;bg}X_gq-_A4ft=pSv+>;lCRwO
zydt;qp#cxOT8V~~g*^Y@;m=)R#VY@$-(1jBdFiv?4zQis2!8|@mGqxVB+5?%F)p{2
zN5_M5z=?B)q0-EZEQ$k%3S%xTOEA&`Mi2}3jNSVPe<!4N6i*6Qp6xlj-%<|y2)U_k
zE}*C#blLuLoaSwcs7*4rMoA5Qd94fSW>rK=b$8>mbblONNXDA{`Di-^iOG1vcBF>$
z`?|aBMSzg~_e_HHHwyelZWR^EwqmSI4D7(#BFo*3KBe205aqh>X%8L_ALKFqJ-STq
z!9WBE2}WTr!X!@3wcJ6!KbMxJ4I1Q3hfOiPeiROjBpcaJk%}6brfZwd9}zRyH~8ri
zfS1fc2K-@lL1F44U0Mpxn!wR=wX4IGYH(v0mG$s<$t<PQ1(V$wjaQKwlm9O@{ePsu
zSGpbjOY;oIvt~~h>n<9f<(bCEk#n$AOamnQcZaPv3^<Q6^K##^FOd$W5x*?jHJR#w
z7qm-H7dQ>T<fixVWTIg~B;%ylw~`AkPN@ldvm{G37LpQh(-tY?PdNJD1QqV#YfcqQ
z8wIa-<^$MiIRgg-DHLo-tMuKfbYJ)CZg5h%)y9D+x7S1W&Sy(>FV&77?L7FLW?%Ps
z#;?&(%+IGmDRVy~&8`%lW`NL16SUaE{`rLWgFN221}C@DFw;d8N0b|Z_i5h9nZofg
zG4yEx)^^NzOC+Y&tyJ7`I~1anCJM;5gwWWki+!w9udR8Uu>JNBytPFsnLLwCI>cNi
zkZ)8mPjP0E#urufH<`*-M_<;eRFYTA_Q2dD+%1(}hWJ@Of_Y7xx-KWxyzM7#+5a^-
z<<~TiRB@ua|0#7Cc~oa_-c_n~27Z4JGqrRswbys7s2GeyMhY7?7{(TmwcB3DJuBjU
z6fE)QLTfCJ_sV*AI}H2GZeoiD`q98R*`f1t);rs{(H(TBO+<d7gr?mg<#Q?-g%GO2
z#i5<Kj1Nr~=i>3yBd#Iq)aQINhRN1|_mpZ&BRWB`RCD$wQUKu6Siz5l?Wt$d-={b=
zG@+1fX!F(osFqE4_H9SAZ>amBm0ui-@mp3_g}4c7@BMN8MPyPSaU*p>8e>{k)Vb17
z{Z;271k#^RT?B6zG32*QbM7VF)x}6`)eYWiTGI~pZ?JZ#L^kxiLc)j6z2~a2jFO9e
z7_kQG>59_1WObdFo-ZEnyC>Au=0t|4Y~2QYPCwAL)GP7aw0sTU`f6KmXI`E8hM#ff
zvqr0<MCkZ@yqng5jGNVYovQbx1Kr*#DE%8KdGL>l+Tvq+t0p}=K(X1+I7PR6trc?6
zLX~6^taq=KWgI{t&19Q@X{@bJQ<XC~IF_1`miy-AS^~9g+pMG%6SPUyyqV=}qm+i3
zfC&*0n<A`4@u;B<m(SX7m0hbT1uM>NDF4Z8X}#ESMg^*@-7pr9nXAo8hb))En29Kg
z=&|^GZAs}=)}K*|%!?l4EYoDRAIlEo&%KdRKzGwH`$oH(t-{^`Hy3A@Rz7kN>}5#C
zBAB8=9*@B$wxPYJ>R7uTNM=7#3yy4=kL2q7sb$tI))Eg|&ha3W+a^<(BJk=mxWl$3
z+)+KvX#wy!2!pde=7Cqt0!E#uI^_T-XSU8a@PbsaK?5Q0FM!*chLEQjN&Ip=y+urn
zZ=}L|0CW58QtLIxc?j<o^#^4cPuWs=-zAx)aV1|x4Kccw7wS@pEfs905qa`InR79X
zsL0s3y<~CGx8v>&fgAA*^5OL~`kR&<s}vYoty5K`Y;Bux>sv;Xt2-1GWqQ;?kV8}6
z?!mJS7J3bX0Qm{&pUls>`}cip2ZfQNbIuM0^dkq=!+q3yf>J}G{J^Yu;9g7!xPdZX
z=<C0TYdJAaw_?;o*>J2UphRxHTM+cBkV6pc<^rm;MV*oB^=6tE7KidmB{jfmg|V*h
zbpl-(XeGzLR9m&@+~?(FCXo~B@mY@<!-^^^6uy~jdROdx5o4N-*ZWRW)FTjf?Oist
z_~q%)fV`%rS+cE;j!pp{Q3D|~dg8m_ZfeG}BFs46@qTZ8x0U2f7FHf}u+*FqWy%|7
z8D}GT_P4MX1A~<~94T=*Ub{|PC(d6>nVH=#pu`obggmp%V6NG<axmCDvi?K@+t7Ge
zP<YHOV>}^hmU$z^H1|hKE&9l?NqA~TM!t)B7}Km-W;Dc~jsM3PqKX%?h=?9)Q||9S
zZ|XNUi=ISozk1VkqgLa_*1VT&{W0pe1b4=)<7=k*hO6a$I$#ddt(P*JwD6G2#5s8|
zb65b@t-TD{QjDJH|MU?;cTrTSHK>h22b|ndbxB_UFiHSdoDHwgaP_0*#syA`_A;0u
z2z#<BJ8;PaPi3<B7D@Q`roaxmt~Ic^kG=an`iQWY`qx_OEfG_&E!V6i(Oxz0wNQnv
zoW(|Jdu4dn&~g&e!={ilYEGj?IR+$Z+G@I2*um*iQ57x7GIpXT9Go>svsJWAQysV+
zf6hliMOi_)zToug@Ia{4d&IvXsj?KLCh=|aoV%6Fh|@9xR~tg}6PSn2Uzd!Nzp<+8
zKk#Akc!LjQ(>gZz2yiVKH{PE2hQUz2kcj`?07FGV=i39Xdr-SvKDobBF2sIY>ic<=
zc5p`ui{rN9l0ZuZRk@*Fk=7lp-1%<^$YE*jcAlak;q6{;`~H%T(}xeqsQh?zDP=A?
z={0~D$Gi9mLgTn#w;%blnNYc!&`f#M*)-Ac3RcplFbL+)5bQ4z#A>=4$TEUSq}`&|
zFFDt8q?YRSHj47v$hpQpw%D+ShKECxQ%Yo0U6exG+Rxm;I5+k?Z?;DL_>GF?rM-CY
zu5GuYWyfxINj0xjV=Jz^2=!zt+ZEQ5MF97gT>X!}Y`ZbJXhe`JvP_tZ%~Rh5+g<5+
z-$6ypAy=#~iX@s+cCYp<=aExI5J*Xy=o>AM;rg~6IiGaJe%Z`&J)Yb4^?2(xjqMMp
z=ssJxYx!_=OIO3S7-jsg=Nn)yN@+P-9P$kuHA87mPup!dO2;p<^kLDh@q(aKe+Z|9
z(uIB9l=Ar50v8nd{pHo=DZIX=4sq8&c0NcrrR>nGg6iu)+T8r2sq@|BH5vspWjgJL
zqhjWHUCkI+lu^HWW)WR9LKvBki*uoTj;!yO0rU0t$dKBDvetN+r%Eo>rFRPp4ohd+
z`Uizi3wMdM%o^|C<xW9GPGhjNhBL}@b3sr<OlM3zP}4J9ycxrVv5<vZMBi4lLM869
zw|*)8$54C5km&s49h@$qtN__gaK6=Jh5skP%pA$n-0pP{j6ViJ^sH(@X>*t&Z7_0#
z{oDxVocw9k9K6;uUORzGMuca-GhZZUZ=QT|-yTXS#xC@n#x6fL3rb%so^l8%#a0~M
z%Y&tZF_w8nl~;dh8;J3DY1O_uNXCO*2h%zin%nMncg^ej49G;N`@5Gy{2L{f^(XlB
zou<!F+3HsG$}^7^$=%vvwKl(bCx%h3`0P!F5#HqKPGi|{UE>Oxc^;e*DtP-B0}#e9
zYOVu00tR{!$B1zW{`9ihLj2CcNVAVg8HJDIWOhSg^ACaZ7qTIg>vJ<2Y?P#)VE&i0
zzs&^e=gg*jtK5J?v=$q#sry+#PJ^meT00TJ6b7F}Mysaf3(G3P%+-NA{krAXju+|Z
zPa4yS$sB!oGp+1BI5g{rJ!#9$>Lg+e#d;Qg5&sUey9Ezr3cMHd+>!u4dbT3=fylrI
zV!_xzs2IUhjVVzta9>R8yG07NcdM1IVy`L(i&w~c{tm_xwBdt6EdkXzih)=RT-k2=
zQab!)u1?U~+!eCuDSo(poZ?NM-#ZV_BRK;DA-g&+qq^4Bx=DD`)NAkDnT0dbgyKWi
z;prb5BV1(bqY_C)HvZy;N6&S=Wo<fu@(K!ri?$afLKa`hl_(3~r(pxLjv5V~a9*0x
z{>5EgV)e>)GP?1?nrCD*eDm^8b1R4Xrja^JBaf?folU+2D|QXP8HpEp2BI!HIIqiB
z8Q2*WY{dX(YtFg>nQ+QaWJxZ^o*vf@c9nY<jp=0^iaY0@P-VS#NYeRjn#ru?Pz~*3
zid6KMQTg^~vl*ooLIwercqZz+Ta28^P-fyh%=sm&I;!ck<uhy2@;T_Om4WvxD;wSo
z`zEuQ`36$SWeY-}eO{p+FR^?(r?D)5uh4kV1X3FPWFA0Cs%?uALQ#L(&FS%-&3Ja1
zMhlrd`3O)?fAk>OR`N`s^=t@;J^<bm>NSH;2^ZGmMex>B-J*ZVE6k!IuG+V0K4|1S
zm+PpRN|m69JnOpN*4I;$p_^LExH=f(*&wWShn?Q?dz5CjvubzLRDOPvlwWE1wjYvx
zJL_YgW{$5difV#5=51ZU)rf((wLuHWAVq!NS$e3Z0=N4sPXikwZTl(xNFIZB>()c=
zqP-CWChN8Ilbn_ok;QNOMn9-A3`o9kX6fI#Zc`wS#70IhD$^_Y?=RjPm>nD-z}EfA
ztGXZO&LH=D03%>f0!`MRU1VGVjX%`XfU2F-L}y^l^D#9>KS6}v2!*9=gWAnK@_Sx|
zvX_?>%Jz)Lv(rOIRzuC6b<PTE4ARDh^m@<l?cD0`b^TlqJlPy*s;FnM6f>O@4S&C%
zFN=?YD5T<VH{faWrIm@Q!I!PDUB-atRwGxXi$2IgjzD1fmSUBWn5^2ni0vRRmkd6{
z1-8mYB;og_VWs8aa~B5l-JI}qkSE^Uxvckja>u7lv@DsS>s;I?4vYR2+|Igzv*;5$
z)!sRp9nNl`*3vx;KGrGPF(Tj-c=WdDWUiQIW9n0!YaV0PmLpv4zyV;-W*o3zkH?FL
zoyh6-q`p#nd5Bsx*Wga<xw*pAvY_c+Qwr~O8JZ<jDy9YCR=P+{<DXM9@m>jSfuIkZ
zO91?fX&cQWwvgElpoW3Rl^wZ#FQH^r`(V0#!7(#XCVvjXN2;o3(EwtmRC?&wg?Yad
zzNxo>J^&0>>^(a=<lpTMzI)Ke<(>~`czSrwT^Oa=hPbUUJMG<iNFGPB&;sC_riOim
zH`tCTFTrxnvyzQSj+94Q>Lj)9+O$zI5WXEZ3Yk@;rvL1K-dPQslpve=m-fdlIP}CC
z9T5YUT}XB0s8$VfC24qk*&d)wVZngKHlGpVWsR!~LP<mWTA@qAsL^55A|;wzIi3IR
z;%+6~zFK$e`c=<<txv=1L@}?PezAkb@a{(p?l&-v>qCFdb$0OYNleUMAiO>o547Mf
zBZ*yB@G}Q$()nmH8Q!}7)(|!<KNXRX(B?j$HmmZx?LfDFz}LxrCo_#>Iw4P_)j684
zGh452ArZjuGK~f0o;nAQ_`dVL35oKC)B&5CD51x>`a_hYWdvo@mqA9s_7@+(nSPfB
zfVRuxcoC&`F2+dxks;MQ21}NSv*t<QaVVT&fG*VM{b38TqU{#S%NJ(fR3XkEeGxgI
zk`q=0nrH|%OM&oOT2R%m=HbO92pV$rLK^ypskQljmtFN-b&!ooxGlrjClwCaIc@pv
z-{3P%R9%vSl6m#RuP>|<`gWjq6EB$o)AW{C0)7_}C8@iLS^F|Dwv<)x;>r6}Ic}X;
zjuAYoN>7*AJ7fY)X*f-(B&y62MUg+C6CjSNq*#gzUgIBfHS9!qp<mbRfZqc&%$74-
zfgD4y6xLA=(B#RQO}E(=sv5{W7Eqq%=izZc4$#;?=t{uag`k~DfxSNF9T@3ZM^8AK
zr+!3)ejOga;W{p5Uz}#{a^XNGSPbI?qAH5Oys+y-#|UmQm(yQUSrY*w_Z8FrH4V}a
zEsGd;`>5E}@)7n^CdXXR!WC9Fy;G-{xkBzgDR;Rl(!c!p1u>^y%Ln4uA@y-N>BaWQ
zn_^;1F>d}fqf%sE34-wy6vn8kGIQ#DYv+5Z7)RPwUs9#;TBzdwLajPobqku>cXqwA
zuzCREgY8wf?*k>{$&Ti8728-r5@$OUb~>LF3i~aAiB>67cbr9uhKU8f6A<14<!5Ex
zwq<9gmh0BVur%T5l!1D#x$AfH`-2rdy0?sgZaP77Pz9`ltqivR<{&abaF*c+{EJk^
zz6RIQ(=@S+h+0)PPQA7jlwvCws2-Pjc~pGDD7iPZ7OdNRoh-*3lLl{B)#U`pdnhWO
zATDMnhRC)-=7CeeEv203Qy1U`5QK$|bGGsjY2J>?Nlw=_erF<PcHO0hIsLXzt=roA
z_T$Vs{E9967XvE<z1Hhp?Q4X!IYedgC(ifM;H~pCPp^4!XugVIJYZQraRQavOq)6I
z%{AtDpFw;<i-sjd_!p@1=tYfz{alN>N7^HJRK$cwMdr?kd)me%vaA0rl5N6w_|nog
zlWo_adl&%S+;rAT?`gqj*a_UtOe6WR?h3on0Q)zc3Q!P2!~;j7C*esU)0KA*m$Sx5
z7zj!%=PXS%ga({biAi%zBo;_Er1w%aK(DpW6wckoAhxSZ$kq#y5496FId)T7h$)wM
z+*qQJ^K5bs+SOURa&jfA+=RoX^>PdI`6a!yGGwsZmS5S><YYl|4!Ae9p0jU}!zi<z
z4^)GyowQ&W2?^`ueQ%-cAClH{S^C}igZlO`VIDcHG@lmI@SY-*F`4yLnN?Jnlf5^+
zxkA(<Kl7?LlfCZ4*xi$(tX-cR3Sj7FuOZv`6xO;=PW?n3t_yz}8|};^ZhaohjI#T5
z+mREUO3e@krdd9=d!!9pL#z7`t#B!0K!fhEFgvUulPYCgTG!*X>y61lMndJzJk>K1
zuqHef6@%Xdr0q1T_ubczF|Um-V!g?%*(xcKYq)jH;PXy=LUA}5kSrZ}`F`H9JZ}Z2
z3piPyy35`QZgve=6#$6ACY)Sec|Wi<P-NWND}!XMyz#dM<7)GD4p)@uDnBDyydhiM
z!G&acjeY30TcW->Fo(Nnd;rtl_t^lbz8qR}oE5#{vE041K5&wf?zNiaRIW6b|90+M
z*KGj@T@<$=*R@(Xd`C3Nn$HjgNbkEl{P^8)+>vJv2R!V^=n1n*cFvS)K;R;<d+kR9
zlB0~Uao$R#l)^9oCSs}(x)n+&rlLcanm&PlwkUERR$IEpcIEvoOTw9dN&X%TFpf@Y
z@avVAu&!pmS1ez;(oH-Z_#JZjaj?U^iSH>5;vPFJ6i{$QL|V0<sjFcVU3)#We(ZX>
zS@6SQQXWu{!Xwi`@(S+M*faodSKQjn#AMe)A83bK13R!^a@hJRRJJX8r)^UHNdh25
zT=kmfAX_5<91)KgPnHv1SS8ekKqn^ie}FbCq<eM*5)zspXvy~jN@#~hrnGDuudfbp
zNh1yXS?Trir#`bx<R6}VsLk~8|C)$sm`>hxOgPXsEHd(CQI0b(&viqx78&}s28)};
z&Fsw;Ma<jvE*f9o6U<<nFxFoM=P@+b34iI1<y$cOwq%J>Q{dHfx6@-_&L9J}|6)IU
zqW`ttJQ8VNveByi_8xG^a_ABVtl$7neJk;H{m!V;qrI6tHO)7d#tcc??bm97y)H<w
zmE(0-d$Q?sW4b|fa|$sr-|+3Z{&BtE_e=2RijtvmsC6_WcA|M%jd#9wLAQAq@z|)N
z1_{mIQ3r4_yt}Yyz7`eammGt~q@axj){24sx$8MNzhNXLwKnS2+V`C-KBAACaCAOr
z0@%=^%KmfE(@&X~(jk0UxHtrSKlqnDjV{Q%4(*C3x>zo3&SAZEq?V71=0}iQ+DXrt
zFLvZmN0|YvY~Wr{nmpM(;EpbjO|@Lp2m0V2QGf5q%p>r=Y8}NmyIVA~zpv}}A^jjT
zg#AR9lS}f#pNqwK_Kg=8tL(b(p}}~?iMy#pKTCbR*XM1(AoWMZr4EF^Cea1|sPQ7^
zM0fPoMxo6+i(Kxtg+P(0EdUc+_p${=TAl!gW&WqG1<WyTJR<yw0JdKTsw*{QRX1PD
z7#>Cq>^2zjTLDxI!(Oe#5I-vM><s~?vJOl!IHr_52yA?EyL!N}s|j0Y@rHNGBlDW>
zh@62#1P-7{{AvCe;-cJ_cR%i$RuZVrpEMAZf-945+g>;b)Ru*8aHSgKr?Or3k{h9w
z`r*@Hv!*3$#J#@6x|UMdjF32JPH#cXTxSXn-MJ7k$jnky?X$4~njk;!UvL@j-f0E8
zY>8+?O<ZCgB!Z<rQXls#xHZ!LaRC_OR<T%XpmlFjge=9MK-ZkXUfLV6JbyK^7y|st
zV0?4E^l9@Gn=5ryxdo|eMtYeTYZX?HR>E%0vRi#6Iu*fgcW6TpHAjJ@?#E{99zpj=
zZU9(vUUa)Vk{WC~F`t=Rs?gz#eXsvmt)0o$0^hf8yXvqgW&iO~$EFVH`2JUk)I%oY
z*(=IoWoD84r(|ljPyXb-FK~(Ym&e>VFYlxc=u4+pYc*nco-?ot;u)R3pjxpqH;rsT
z9|#-(!A9*sGXt1rsUprY%AOAr{X(MQyQTqXX&)Ph`n7t5CvqvY+yKV2r5SM>xFQh4
z52;*qOAZ)A<rEeXk+7h#X@z8qsB?>T+vzKiqVr4zmC$#^qhw9ipVsOjh=_}Da;;H^
zW=+(;&93dx2M(N(r8q6|i}pxkmh#B-r9S^RGjdj2SwWU}>^Fnc7tgucoQUFYcMru}
z5P!tuF%@r44Ppl6J$9<)UC1UFK6?7FosB!kk=)E>J+XExxc5ARP?J*Fawo)$jaQD0
z;@`(po-M4i*#h+5_1=9lA4z=}7Y+mda^HZ~G;Pl)y(wD;QEBVdw7oZPYw?Wje`;YH
zIr|Os``Qa+Q)Esm*D$%(W3{1`kn)d{HY46=m&bbuHSs}(+KB#}L-nN>2itKrRp0Tw
z3#lizjVCJna@vn6(!~rpd~HJ$M@B~17FPS|geQ?qzn<A(BnQ_Ib7K-)DI3qX=`LSq
zw?^_iUgnlpWSt4)X+zeWBQ9Wb{M|Qb6jgqchhECK+Jr-+t4IE;HkxfEh5=p(5TLH}
zZj8N3!QL>DJVlt9M?|d8cyTOFbo^YBqslW)D~b)`0Xm%PktpRnJk1Mg>9er#IT&?I
z08Ku0*|zm4>|t0gQZzz_8b}X@&2)SM9rojM-+C<W9+CL18JGlA*f^R4-TkJco|Vq_
zF$f4+F>FeKImJ}RS>jf0IVHkz8>olc(LC=-I=ls$^&A$(q((&VLuok(f6E-qx<<06
zh#K<ng!NOxE36RhZx9EfVZ-w0m3A{)C2I$dUN|@UyHCh0(?pl@%*G@^;u4_32oDv;
zX@8%_O8u`9irKfm4v97{<R{TJ#S6aI7Zx+oUtk%_EgJkl+R@S&=DM{!ZZbMMAL`3g
z^M`@NSfVqU1qEddd&BZ4bCX98*_ThR19re`exPY=J!33ZF(h(@G7)?-LUu4(M(0mn
z&OGoZ<?NLwcprQ?-e>#(xwh}FGnd$?`j;|(<8^9GToyDS%c2?UM_|{T$Gv36$64Cz
zPsHF+1XAPB*44wv_2EzLu^y(;|1eG~DVxsf4+ih}>L|&@SE|&pSY0$OEzFnqeJocA
zaU@gVq)Z(6xN+S%1APX5yXf{|7Q<JO6oHW2#wj9KmgDXmQ$64wVwf+K_1sKrfw}nM
z>keTO*oc;(jw@v0=Wy2>XngF1^6K6Pg)-Rmd+Bu0LR$r4`t2_KF%J!@U2g!G*r#U^
z?UqoBktCMIqhD!<|7>*BL=T|nrB8I{AD8(wqjY{mSu+q9&#6x6=Xh`A=!xE%Yj50q
zT}eh1F9fqmX;~w$m4WreB6<2gI5ReOB}VyM-=6-#P!OEW1i;^)jsZx?RwTD#VLo&8
zK`%Y`9`wN~M{B$H*u{+Nt&ptEoLMngKy0rv5cb)Oq*mzP1u{otef8OOKV2-IxfGm%
z72g878dORNWiA}_#%%cR*ZRC&QxUCQy2}gY5vdkBPJrlqZNcWz4B*h|<3JuIV|mGX
z|EqKRMgOrzzK<8EL%wznUt%X<L(g_=^Qp;rG%)=zbGb#i((gUqAm7XbPxPWm{~5ul
z`h)8?G{=xiAY<v-$g)w<xce24%d{8tI+yDi*~V9SVNLG<rwJ#}{<-B2Fw57V6~0fE
zYl+j<vonR=>nfB<pB1v`win%hW2025AZcp^gTbzX`#*kHckSBmgK~|W3X76dL(fxn
znEkBkfxqq3qQ(fc206{sZ5m>ppH-CKsNfXnl2r$l<mGPG(eT?EdJ9`Y_JO?0y93CA
zDJajx?tEyH&3Y-)`#BsRmE7JptjZ{IRStbT(BRde8>2ItFYf(%bKL>M;lXizw=#<q
zenLZ;qbDX-t;ojWco|zJR-}TF)QUc!iddiop;~5s*MmWjPK-Zkml8l?gaAJnKp1m0
z6w>h?=hv(pHy5?>yn`J5{3@IfaH`XPY*0_6b(Opdo%J3}C}ob>35P}0&z-XrzDwP8
zRlWMn+UjBn?A;tJ(7PvtcH~ZBE26or<bE^K=`>vGOFMQ(GV((GBCoG(u8LRt`=Vkm
z`b`p=7;Hk)H8dxaF@b~^NKKca2_L}Nd?F8z!9B0AVw?mH>-jY9)xy$i+qfstyuSWl
zUa&K>g6new=>h<pkj^7&Xw{ptBp?-_Hegu8I2JyE*lvVDBPJ)Y+zv->DSt4%F~uxj
z8M(A9`psINJx+t|{jF^trgmXb+RuW__R>~Y+LAF4d#PEg4%n8mHHnmn(dX55xmU4o
z-P?QvyjbFvxOj+9Sq*x_P#PyDq^Dys@+6S_^-sNC$*SxN@!%dI7J))U{1&w-xjXrz
ztm65iIgCWTJ>=ltW47AcXPs*Ur*5#Biu9xT^N`m#>DCw{t?kNVB&*QNAP83gaOH%E
ze2Xc*!`z|6Io_IO=Imyx^{P*=IT&m@i$;#q#*gh7hV2JaNSrV8|E=Y>Bw}A{sS)kC
z*IXNPuixo)y1gUqqKC!G&ugQs36^8A)to{I+cg)@E^J&qp6b^1(`adRh_g6ty=r=X
zq+GbVf)2Rs<-OYGC!Fb_tdz&UF=B9Nx_rDi$86k`16kT{w@FC#d%D+Z-5WhU4<T8z
zBTf{=$M-e5lCUed_$rCDn{3NM;JslPFm<t1isP-{EAZVFL1r{64@;lA_RH-?>Ek8T
z6mWR~de@5}(7#*wP4W(=hcAJveK%H`>khBQ_>(YS2`nxSF^rqypG(}?p0pSIIh|JO
z+NCTu$s=s5N%JbUgojs_NT0vUETAr^!kZJzaP85OiYIo+ob1x$mgm>woCUMo*!<JY
z9ClhMcC}<nrr{E9%^=@2(Q~sg?v!Z1z<#ddicc;MWKmDcD9EF5A8GTY7?(v)mhBs7
zFxvzhUol_!_9VpCW@~oTB*aeC-+F7#V$?rqu&A**Jdcu#u3oQOD^(bx0(`h^dRc!~
z*vDLTD|Avwba6?rPvBNn=G(2*cXw7ltbmOH>^M;-&jLrT9%NW!u?8GY(J=4!W}EwX
z$je>qwk<o14N{1qA|2(|3_~SYMSIkgKe(tC%baM=NwV5beNer1FsgG@f1RJ@BrO4?
zFlTlubIPJV<?#NEev>sM&Qv@slxZlD*U`cJNFj81<9u)a8C7EO+j%aiH!=(zRm<zM
zGTj3i556FVcJNR!pAGyN2?C-VV3ru4XG^~3oA^(g1#ow4P*%tTy-y9dZA)TOBC~cA
zP+`~geu6p2VSU95-=l#vVTq)2127EZDn3_u<ihN@J~69!>b^yzm=Tm>QQ3090=4w@
zxoCa(cDj~gth%3ztuBcGY8mCB(hSiplZ#C5i<nz_lE*-Xb^mDGFu~Bk5bFMw?}_ib
z2|$(yH@Et0mX|JDW(LCj(}!KxXRXU^WiUc-vD+|s(Q?zIR%M=2L6I)wuD#jQilw5g
z!!I!Kgh=3IbnF#EQ|D@&&fUGPNgX<T<;Af4WTW=Lwvs9j_S(|BlsqG?K$2AbE%VZ$
z05iYxJpjRT+q<PA(dMW3@nIlZ;5}F1z_hEpFlAD}*%ba6Vz~k)Cb~$c5`!uO6B_<=
zOD?K0;UC@Nob*`z%+c4i$W#UCOG+p2Ek{dAifeBsH{J6SAe(w}-zTB>_zc3l4&@Sr
z^9eUWUu)});pE_b3+}SLU}>a<d9bMvo~S)%UyZllj#Ix(jbu;?7qo~O3`j0`-DhFo
zS$;B9pb48)E1D|Ej7)_Lgii~FA&>|cbx^w_s?<g0zITAsY(rb#X~EUyX}CpudeH;D
zUPfIa`yLbwIqUNpz<ge8q+7o{>sW)xx|X^hjMJnA)0N#eh&9`~Z%x{A7<(-ig<;da
z_X;`i;+Gw{dR!yPyl9rERq0W$lNLdgLPhoi6wm+`7%a&)^Wax@1g8qc8Twn;$N%oW
zIx(bjcIyf^1Xb$MlnIu959R8=z<jlBmUg;+Rl}z!SX98Y*ia|gO}2Dup20_B1N2Y5
zR(#7a)lyWdU*=~%KWt{knA&o;RHF0RXU@W%p?C@2#e-o$;duqPh$35N!pU^H9Fuo(
zyD*ACE*<2dN0C-hcR0<pR{2c{B6|3Yu{YX1PKpl#Kv{+coZ}NP&)aJ^%iVgT!=nqp
zY|GfyN8b9q0+?b)4gboN0qfiyV8p1_V{5;9ltkifXA8W2OEl?B=^9aIx?KJPj{Kd)
zpB2Q>hp=nW`+Dm$RZ5G%ts15gTR87*1}<ManUrO_&MPap)+}z2glEKCS-RPM2Hsq{
znOo>rTy`y(r^gkhW-kL4ajpocErs>=Q5RzXtJ(ArjPnMtyQXA8qFzjbntkUZ0I%5M
zwwIxQXx%K0qfOZlRty939VSP?7a|Ja2T8*C+WxDp885n=lRO@f{r@A+9lyYnmvd9!
zOQ}bYlQ(a+p!-{GienlyuL6~i0y8yatqW*tX$w2Pb0|+CW~(!Et97kvNGg2~J?Bdq
z=h$s(^AEnz`uiEBbr<;u;@;F;ZAZv)27WcayQ^F>v<*tUH8BMmJtL%6%V|*OC8*e+
zARK8sE#iKbD^hfi;U#&jv}l5nh)};Oi44L?jpgC&0Ix@;16Lq!t;=E$eU_<g;Acfh
z;j^E7?FoLZwr$JjmT8$)9Soes7>R&ec9t^LU|ijEhH~V6#_YrC44rw!hd|_y_M|;Q
z)9=kMXH7Cb@8Cq8nw{NQ87YRDOXyJ2kQDAe@pv?F{-EAQgv8SxzaUDb9}^ReAG=3P
z)=gIj=uk7_vvmJmt^Vxh7TR@pN0E?QKrv&lU|o!gt#9@G?crRD>3j>d^gs`Tj2!*|
zqpjxZZe3MJ|3Zrtru?vF;X*!sfhd9rm-(BI9!k^>bEoaq9~y?umiIgz_Ae`rh(ZN1
zl}H1lF_OTI>C=G&8Cb0CjRk6E+O!MU(nrcaf_)T%OD{C3mZq5JGi;)dN!^qS18`E}
zzJol@-j;f5!TIf2#HWqg8n)%cgv<sIR5`QTJ`OGj1REBlp=~lzRe)WxVdG&1onz%=
zp0}OnWsl9x!}JYW=)2A(|G55p2>0x`t36z{0g3DoJ&va2)lI@Iqx-?lvT%8q1sbE(
zn-xqN8qWoe{Xp+kbNLpq`YWB7Q%TR|oh6(K9?YsdcH?><T6RIB#+1|B9dfuAlko29
zi5WiY`|L6dRJ;)vuuNW;%J1m4H?!KW;IvaxIijW^oPu*_g^@^i2~W&M{OMmSuXI<w
z0F&l(L*t}&##(@5lIR9_w*0e7;#`Mcrxmeq`}MfroV}7-vH)*y8@|yDza7u<EASJ2
zAtIBtn8MK7O`RuI+;N?&oQ1jxdc{BED+igalxP;N_ba-7RtDFca6%vxJS_X%+35K6
z*X>|h7r=+O2T?U4@6Jv(yJ;;qsJZ?Rdv6^TRrmgZN{NV+h=@oi3epM!62pK9D5<10
zNJ)1NGl)niB~sGe-9vXvcOwl$*8syX_h7v5{oebn-*4Tu?pk-<zZedibM|@m6QAev
z?EQ>{D#UX(D%+uLVcWDPe`fR^Vz=0d2boFYiOUAi0ORTSy$KUzBG=wH8l}B!c*pvp
z7R~Ig@Rd_{oMnkf+p<pLompqu=-9l>y+iq8^EwV%b@I@wqPn)~fGzCbM{j&C7JE4D
zLT2n%k`2o4HsE&8N~>WcFLJU?NnKCmG(ZSa9tQ;vyXQZOtUxQmMB}vKLW+KNvFdMO
zF1o`OYMli&BscO<N`~k2rc)|u&#dMRi>HF4vUvF9`;&Eg96;J|7jIhjTZvwH<CW8=
z)R{RUpdR>~-^!}Ter)G0-sgTRGJT&p87I~G+?mp9s%$OjE)iE*71>a7wV@i#K|4z_
z6l0%ppVSlL_PoLZpnil`JRVIAu%Mq`p2VA2wmR=+efrE5Z{sQJe%d!Rhcr?vP-dfk
zj@^LVqQ6}~w{7aTh3S&pFMdA5{7jW2?r!>uVdhKdmJVg^ek=YK*GkF0J>nL|$7|JE
zL*2+K1mq%ooXI;e?;{zxIUPbhhW{XKy*4||B(07bG@g`gX`|;NVzea9S@(+Dv&6OI
z3>$q=ltXVO*PWy*3XiNXUQ;cXDZz`7ZVRNfb4bXTI(oow>APIUrEV|okv1uu@qDsQ
zB>E<-d@aF(o{=2ctvKoS`WwGl)K+xZTh`GY^98x-k^vaLLv<~rtK|LB2HL^@4ztEt
zb?CR$i1P=mx-pyP9p%oa{&ryq$WmOzQItt%2~AqO`N@##Jw~T2VC#>cgP2i4zF4w@
zXi;tw#x5scnET4X^MvC1C7meUr4=j8Gasxj@O|A1rmFXq|N3m$L1n$2`y{#bbfNAR
zzw3b;>yrFjXt1CPryIg8w}M%fYDT#X;jGfCJ87us^r?wwVyVi=5ZkQSLM>3{QwyWU
z-d80JgRpX~Ub}`C@`J|Vg)pnxKx3^Ef}Y!y)@md1hmR8?+n-Y0$7QprDd3VlP1|`2
zvK}6zZ|JtEg#N&VGI18n*1CdXA7km5ls(4P#LCGWN>fK&jyg2LANSHv5^9KOb<1b}
zCfJ0#i6_H|v%<h_{wejtWe5DB)d4~$2{|i@;$B$^In<DvM328eF6MB2=N8l^iol=x
z`h)btM`|(qlGlQ{+jk$)AEiSRzN2t2zpb}D01Dxbufw;r+-hOFUP?M=pYjKdS|j;Y
zNMsAqn|z~dvKoyb$T&wY9q}1TF8+yjx$))m+&32LE7Pf%&^7RiE1v;|`ikRLX+EDr
zyE(#(`cAJE%*ZeKlmGC>%cjyt?j?IQ(^dirW~$1Ut5?#3XcDWI<5MToiAa3aGRM@?
zs>)BctanTLQmWil)3_!fUi04}hK^qm!CQhG45hl2FQ>+oGMPSa5}YLQ<j=8zAX;%-
zQCvfltdn*rH+#FvXv%#`hHu`F6*ht|8wT}l;#q*r#%}A~^x#&wP=R<I{+D&=2xgkg
zY?wM8L*ta`HQv>uy1PX6!N5TtflH8KLM@i*Bn&f6t_C-VEH}^|y+bH=csSbaj8v-H
zTHS?tM7xYXIPGn|$BxNRUx9MSBV|agsRU4kWkU9ZhZ)4rU#-L)7Knm1tK{u&ev6l~
zmF=(Gi;{MjNssDZV)@ex0HvgdmTCHu7{%WTb=o;gVbm%yH|ynH$+f^X$D}_U#eD&R
z?KK!^ocDX`^k3e$lSRmuO&>gFuB2xbPu8SklvtO95Cavfi8F4G@=|R`oNYf_&68=<
zo>P1ByyoWP_f?)+)LATpTGUhLsbNPXyt|ccxQmR{r-d^)S4S!K)7Cq`*9&Ib^+sn&
z&uFBN3Sqqa3Qllp_FL?`4{q4`cMfP^;*y*?r)KB4xg<<O&9o{_9qY2%q&MR$HERft
z<%hkWfnZ0f_AAc4h0EXjwmAh8x-gnsEUM~;s7J=%<10^uK($BQ{9MKM`VH;xN!+oB
z%8_r!UZ9uHIZc{;st%Up$SZYE)uJLz{ib;7cq3eMLIE~hCuHfg(H=2co0G4iycY0P
zDolyDgP%hyLhfbo;LYN*AK^tuWu3OTmF&8B96piTU9&NQh0+#psKN=}Y+a}F`q!t+
zR;fLrpsv<-Md5P$+7X1Rq7CD&`U<&M!P(0C_Wq3Nf}ynApYj4^20{oGc`!>-%6AI1
z1pPjZ;_SCY(`N~Q%CZ{CuV|&4X8W#WLC#yq4_^&g<_g_TY*`6V5Vb``EZC*V_9YKa
zHN29xl2&P%VNlm_d~WEV7Znqn<E1upt}YXxUNe4^jDnsr^MR_|m*iu(t&Gv|S<2;U
z^k6Pa374$)Q%$_MIW|f4sE#L*DG}vcd>$jgQ9>*oxKmMPu__vB{1eKx;=P9|^-1OK
zyuzhVGT9Q)A*YHRub1SXER=BAjL;64Lb9ZJvilv^iW57iOSH1D+A;ICadQ|uhQl6%
zrMhN7IjjAQsHF|1)Jg1AinYEPyO>Hn*|2g|5ah^U@j$!I$#79-EZ4Yflo=CKXn{R7
zMa3^GQU8`tLQO5;_SHLE^-DYN*sG7(*sl#FXL(ANZiLB~4CpU+-kF$1alZif9*7h4
zlbv?V7l-K;JyTcQ|8x@yq{He+llq34HksG12Ln%LOVJ%6TqW}x{VdrzuhkU4y<LyG
z5o>yW9)jH~|3G|+Wvw)hcdgJV=-rW~)sd!MoVtDORmbho&LRQ+uXkA5Unt2XRgp+j
zj+pd!o#UFv#z8=l7BqQv4o*gsF{ehk=Ng$;H&<e{se9`!AAZ-I)3(hMOiRxydztMw
zy;8Mt1BLR1TvLtZR#4d+&_8547`4FHB;@R(PJ9}o%lVjh=i5`|WJ|W0L}SL-WP}C5
zZ9_|7v!~3&B4~vo!sI+ooxR33XAji&Qp7z9QR>>n0Xm)ue&13{x!n5A%v~XOTQe-%
z%Ovg=1p?H9I`13Ek=1ZS1UguH4riCO_Y1wAjauXfqi%C?mkzt`L|U*!#$+3FI?@de
zFDbL^hw*3Pt8TtNpMQ<TcO@mD#4@XJT4a&6_Zqfw*?S5&o7WmOUUC(#p5Yrt-3n;~
zoXQ<$mo}HWAp@V-Y19I&?mOD3AH|L|^lN~{NvfY$1vv~u6`@wTE|lGUNe<bijkw$A
z@KrYStkAa4r#Id4g4041h++bkS~u_WHzjhZqMyea#XWO~YTK{cqtD?kr+N7#3d_eT
zYR<C5-(D}+Tg<C~CZ)G4IM22$mZl#|?n8sK`lE!|Rr9|6P|=d5<54o@d&duV$!2`!
zN<~h$O>mu9ySg&#8K%&_m{ZVkco|u0IugM%>jt-#1#%777OzSkX9wn<%x&%1?9p%v
zh}4tSNqNiueT=|xeC*Si#K>h&g}EEK;*^Gw2}?8{ep>n1ZJ3Sx*%7?i$n3Q^&b{Qc
z*ld(=Zl9Pqd)CCOlqBipPE_`rz}NZ*(`K!>CWAHYD8uS$?2*sDZ;-I)kxJm)6x6Y%
znjzqE`L)R)d7r^dX~LLX)(V~I`kifaM|^L5&UyvhO3t0^(w4lcGRqjAyD1XdQ?I1z
zZC@z-n_?PpfS)&aGOO)++IpV3eB=GWfLkFk?~d+o^NiKQEZCixq)pktMzADdwY9uq
z#%#;HL-JkriK^0P@}U}p(SY|ay_yEepB6WD6jgZ<(HXn-PEfUL#C>4!Ye}=v2U!Zb
z%@MyNk?N?cxk67Rq=o9<Y`?gZ^<c33P+{~&CZsMVNj(1!u+7Kq$orb1vuBA+T8GzQ
zn@i_-d=ii4$Cp~JW3^-$R}_yBW`K10YZ7`C6LotM_qnAy^3!s@S$-^|g}_+OhsRrA
zyko9$3#-mKhR|w4UKOuEE?Z^E_s}G#F89xbazBvfbAOd;7^e%bxAhoRz!}AJS?X-(
zS0Hf)PP~(;Q}M4*;4&lB7kk=I(&sI<E|sIJ4!dHT>>=TpH`i1KBZZWZ+7bB&l(VBn
zwye67vHT@Ez!uj)V2i6!ERPVq?#Vff<V~65i;yknM42uOvl#yj;pvay&POW|{*Fhg
z!&_RFdRizC+G&1#B?<}zesbFCjHbNqhjB;mj&KNStSt7$3xB(oPPmvwx5aJ1GfYQX
z41&_FS&MTW;(9VO74+~I-c>C%)GQ_tyedoc-FY+(3r0<y_t)Om>9Z~9pXRdje|xW~
z6!9vS^WBNrN|1uo2X{`sC|vJ08Pem-XgSmIcwR(Hzg)NU<84qklad0g4=4>!T6SYi
z7oNS3Vfgw4qLhO|r<|lzU@d>U+BI1f+@?DD{my8U`&f<-x%WF!$E2*IJ0T3i)jD)}
zBc`bQG)PwU@hNW&oL6q2@qQ<j30G{S$ksZJWJ%Fb2$ic{p^;_4;0FRRWo2!X*)K}k
zdE!B;rrL3XLp*igt<T`&B%2snJe6e%Y~#54!R^h*HvD=;J>WzcPO^eKR|gYV?4&+~
z^M%n2O~@aaj(jZ9Zpz5C8rUWTZ<ZdNW+!@!Nm@8fj=AdLF<J38bkqvEEjTPq-N=38
zAd-)^DZLJCz5@;e=vBuvLwT~Z4{A~oN?&ynR#vLEW3o6{Nv^!f6SjoDvT?6}>f9Hb
zII21;s9z;LT-APF-FT4bJo*HE{MA1JEUBnfAs>WEe8uXvT@jGA3-#tt1o?b06y>d3
z_z~-7SVNezVme)C@Aa9(%y>iPQx?u?d<5U>_(1)o5&dQ7UD>uQ&uG-u1M{@RJZ(b?
z)Ip=hWJ!`T*q||D8?#Go3SYz45=h&m?9J+RTrWy5Tm5Xdyw;<MWLhWTi@<YS9g{=v
zyQ{1TL#S`Y@*#FUNmw{rW!ILPM&xU^Er7GE(3Nl8F-CbSTb)<5PEYJ)`}QOhF&VX%
zA5z@y7L;5n7t9o8OBvgb9l~yECT+Xce#Fm0`MIuS9VunPQWTS`p@(@H*&_>eFs)t{
zXUbcd^SP&IIPq&eW<A3c6)!D<9J1dj*6_N$%BfP>I>7TrY3LGr%#b_p1q5jYINXGr
z1N9nYCyA?7Q^}t$P5&$}Nq;`qqFT1v{oNity75GoIJ~sqyfkaiH@rq=qsx+YKRc1c
z%GxxOlYVSn9lkf<^X<|DCsM_ZQwvu%o1!gKI~&=oWAmUqXvItS>TXT_(k%5l14QK2
zQH#OvNjE^Q9q%Z{+%tzX>V^1*hD{8A5Q9_}3BDEOLgvSV!fc>rSJe%r!#ZfyZ2Rme
zdLvA@CJmy@A-Mxr>+_B`5@=x+O3~&Ks=3`tRoEj_KX8?O1gcoxA--Ag3JBjj<^gL&
zzB10HJ{t|E_5%->_Oq)CKt9IIyf?QJV-Ik(ImCB0caPFOUccouvgEDr+JCda+)A3q
zp&|c4{K0niNb<Itgxp$1MESeYj;m1g;`7w#gr`V@GD@mMn@q8=EyAn5Lx(!w2L`*q
zJQZc#L%pcM!Pjx-*wkRbEF7MIylbTxV`X>aH)Rgy?x~i}wski(W0IryziNtxmX+43
zv5x3%;x`lzd)pK5U?PtvN_ulN4-=)14Av9<Bp-ra*ncfW4==kSnxdf|j9cq~U+FM6
z6Wx63tXap#HY%>xq&XgvYZy;chPe$dy>C4MOBkUj(X<(IH)72d$YWr{Dd*vddzwih
zj#3_61+QE#>x1NH$&}5nbP8JKn_|dn;C1`9o8cM!d129@?PSzsZT#gSv#i1OBx3BO
z?$fZ%JU+ENzazXSZG^yX0iAjQcQr+0puAhZmu%LlX?P;9;Za<i9Lhg3b!i|VvpPwQ
z4z_U`Ivy|q%D(P6AOkXM)ImYXbKJW2$~6h^6ux#f=vcAOJ6Vg0lY<1^83pyC#ejwr
zM<tmJTHuL9>9n+m<5P$C_qiE{QAZ}?h270LI!}0%l^G|u1R2K<Govof-fNrZj?noJ
z;29w;**Hcs>qH+)aHj_-NaUcTHT0pSyfF350hM?y`QdMn<mqpVH?+QjhA1B1v3T1q
zUA8?WNO3N|J8~*ME>==#tt!&zQeW1sHQ>jXnqfMM^}wGCQ({vfl^-?{=<y!NH}y7G
zm>I3lzMXX3r+M74pW1-kt6|lY7!O+^tYzz=R;fv{ik#Jn<OfNw8O75`zfgGFeYfV7
zeS$-aN`6yVbaWnbQ;kzsX~xDJRt>oVojOm8G_EVXb=Oq!u=bp-J1$#WnlV!M$-n7$
z1w{9C*0L(zJ3Ldd#c+35y~(VO%BKMN-_LY==oU@#YO4UnmQY%jibqxLZJ?2WdESCJ
zA|;FX4mZ_pPuwRJoy{2=B7R)nk@0X$^O?OHWb@?q(f8*qne?opRAN(+?{CYFbQJ9|
zFd__Ahz!2TgyE^ANez~-GcZC@I<8PXIjHY^5*hi>ht;}|#jMqwqs)~%x@>D;&Y5Pp
z6BfH*%RL$#Eo;=3#8CD)@{nBeVR8>Hd&K2&V-QWsxYef7V#x$AVw#E{nc0UcE6McS
z<*QWWrIV;5<mT6|^hooPtrP>(yb&Vs^a!JLshlTz+`c{b2g?vb2WLxYo*$OOR<5!<
zLBKG7m|7e{VWN#R$l_^8svCck*twqI-Z5<|K(Cl<l319iEnXFrm6A5v=q0eJDrfY0
zFQn2r5OFX?J<M2av7PB4a9`EK!|e_j+HGK%4i8z;LQaw#nkXZCJqa1pR<-TOy?AoR
zDs?buqymtViUQk2U0HSlKJ;&1=0Hl;+dB0k+^fti%b9<j?<m8J7bJUcSDR$y)jml~
zzPFi&LLf>{&le;ov}XH12Q%C|7|5R@a1>-2ovD1m+6Pa*=&+F^`7necA%@#FgB1>+
zFsLlW{<hy;WXD}a2d_r%*r<*eW!G@SOmjxes0FUv;X$a{m()gF^7C`d8XHtGiH8!K
z^a)1GezD>VNCZcjJQ6Ku{hnOYp^kah<{mgun5_PKl|UiyDNjS^%=rn@4h205x7g<A
zov75G+^8ZF6cSfQKbL?|bZbqws62A3La2EFjg#I`MKm=w+BdaSU{RlSp$rY)5R?AE
z`%{bhyDIhPljn<i11-&(+z@lWqaQ=x5=KWNMK%$+E~-?>M%lXtf!8uDx%h70jFzl#
z?9&d7lnGn*aTbivkqHsy;&sxtp^tc)Dcgcyk~z&0bvVf)_-59!rBB74nPG(#y?81l
z>xdV?XEvVCyA~NW7wuAb3<tj(*W@F*{n15zt9OnT2fFqtJS2<TqZO&crOiwbr@K$<
zIC1p@Y}HB-GWNO7HHdroG<y9=^W~aHSpzb*bOdnS-^*gjifDm)@U2yBl~zLpEFO^-
zbai#Ti*A#t$@YEw+Tp!{XsU{2JvEOum61i<5Ku+&nvZI4pM`u~?$r>Q@hINNgm;LB
zUlFoi_r~$bY`MwGxxTtNmp5PRyZ%`)%V<1rI8ke2pYgxh_5idKfRR1TOJZP;iZMqQ
zSp%#Qb?(Z!(hM&>Kg&xD4@0JoYr8}hr|uGKUXJBzX~Gh;?RMoXmFcfOfREa7VTHAt
zg0j5FUHb~dQv*qSWpo4aen%ululuI+uE4hz5IG+x?9VPb!kl;Q3$kV%=<S|%v)dh@
z+}+l%s%)`^*rgLG{5n1E0lVp(o1r=4`R@+a0JS2Itt+84X5n9_Bb{UQB}}?8Qp&@H
zjLO42QFBW#h~)iWySnLKksL3BvLJd|GX__%kvR|hE0W16Oj7+e8k7dda)_$rHuE`<
z36S4TZZ7o7SuR{^#B=RC>6NqQ$%b#Ez@C54Qjct)Mb&9*Oz~kreT%4$nrL^T0fbmR
z((4NSqaEC5!r9lV^9C9It$Z(P{&PxKa@<bHDW)EY7n6f>eIz?04M6iBEc4cjYby1+
zgA)*Mp6=jYoGt67@wu$swn~OAF*mzxu<EQYUCu7?bc#>Yz6y)wm&|p^ukcqFRMvK=
z1gHV`rvE0AD|N(YdU~Zpz<5JQi7toq-|gi3Eop9<1UV$TyF4LBdtc-C=K<WJ?*lWe
z%RLSa<_WT?*Oe7uO00Za1M6s}-bZxaewVOonET!eddbi%)o3KGXgt-kg0FP<V_(>0
zJ=H@}+rB-jcTHc&L=w8N*<Ibnbq<{)5U;WR&3=bpCBLWBcygvorwaQ|r`tM?fgV?N
zcq35PHx&%?kWy-PCi(SP1+ID|3roO7J3!-vOQK!Ib8^P*{|pcQ^J~_wSA~GyJT*1@
z1u?s?Yk2FmeAY|yD+@;_lJ8zDn+LZd&=ix~u8!OEKd$00(E;!DR2I+ij!+&AzWiXr
zW452S5oIM6eg~0j``3)yKj~5NyX>j^>I!Lz&_hS^*#AZUD%~BR52TPYk_Pmj`iA_I
z#rS{q$<K*DYY)8q@1_2i055;3pXpq-M5bk)7?dN9R9ncI<g%Fb8Q)dZ9o?DypLglJ
zRf3JNS6oWigg6Pn60*cWRCdlzyi)(GHmM@?N*)||?4v_`UK5t>OHxNP1Ql%mo1S4J
zx;q5+%<o*5@T***AI-oslL(6e`hOh*|EPa`J?Ry~AZw?TrRMro(i%X+&nb3d2;Ek^
zNnICMyIk($vVT7Kbg9iI{!uX*ApC@0+)5km?c&;4BkIo^ozAd|WpdSBycK`NXXZ+(
zS!K)`McWy`MSTkv!7(Em!rwakmo5CYDu4e$j>Kap<5ujur+FbvQHz8^LLl$fhrpAl
zu`e1XHYV$f<#oH<H(<GX6b#IRPPCZnVje-bK;Odc<h)qN=rx5tTc9%;Eu^&l@ag7#
zps(bgxBF{D%Ae5x=MN(JgdZalE?BXf`@X(cK`#nN1)q5WUYZ_Pecen8II2SZY=dki
zm^AU>i19_=LWyqg3-cEyTkUbFkr!~hZF&Ff$sKaBf3rXQj{)7H$0pkqOD%X*`eX!Q
zpxAV2jbi#j&ZJLGdT`j6g-DHh2*|{)i)~@A1b@kVIEH`my!YQ3e?ITV>Xu6lNtLs@
z#pi^jK~pELTmR7lbae?nia%%Wd^|OrNnYwhph^3t%4deY&lr0|mXIls&c=ds;76!~
z<rRl{q3c;UmgGt=we4o!OoLvC)e6tmR(pFgE>2j(PYCMW_~P$%`j?+BCy6|7w2sZl
z=AlwS3~Oqo?yNo?Wnde?W%ri6*32=;gi8wanhGZu7@u10EIG%F3z9!&&a$(rYpVZV
zU%=^!{ejdQ*8^AfnuN`#FYqtld>h~&HHlia7$}JzGvapmctajY%wt#Fjgr2?LPmb=
zHiNS=z0{*;xZ-Mt%HB|_Z(be%pCUZ0Jghto;+`Iy=9b@$&Rohl973JXDt51Nw`B*a
z^YF4h{CYM*W2z-6pkQWj;{^rQ##80{nfTbG??oI*UnJ%kw-GI=aDFR^(dhM?d3Fi7
zehHWU64n)wfBCWfB{p6x<PCXv5Y0?F<0INqnC+g#>Jwc0SH{@g!v=;mowizh_9=Ob
z4<n?o$81<k6exi^dVD9($j>uAC$`PTmr?J@T@kms`)?ofdmf979@Ro7GiAk3SXsiO
z7<_VuRS&P`Fbzo=n**<~aQ{oXibAiMHhuSyJS@BHYr2YB-l%ur5FwoxLgJEO9yOno
zDDWojD%i}Uhvqf?Y@3uJ;l&3HeeD0{4gVHFK(I*hhwvo#u?vw5g<TR*P_+&1Vgz1`
z7esW5{ZmXt;t6VEJkJIHv*iB1?>~$c8N6SgvXpi*RblpDP3j;1`PXVaxrN2Z&Uef7
z_J{wpdjEP3U!0adx-dm8=h}__dV<H)y;noIPs#;k{=236qcVM02$VM7j9%GhL6<j6
zb*&l85dM=X{~7&nmEhd~ZWP~I)yndJr7QpBmaho0&sq-D>un7UQw=Gv5&v)RbID_f
zTz9~BJyL<;KbXhA5HPSVbNA{~{{K1re@71Of|}Y6_YQ~uR*6i;zAQt#j;^i{au(a{
z*opWT)^X;w&kw(73vTUvP_;O_0cp@Kh*(^>eSUpb#~0NR5LA$S?1)QuOd8=U-5fII
z%OsRO<t*2%JkMei2LG&`Jlf$F82?aPS90t%%f`dt*x(+xmkr^<&3ReJX6iUGM<M+A
zdp5!FZ(H#8lqIF!hsnafT!={2l^f-zKcWiEwcm_Qa&lO|_dK7wDOgWjfOB?<Mg+eP
z%l?1zqg{pOU3i*{vJ&C%$RP5W;5mNiX*6^T%W=$Q%z^t61BgFxr-)yVb4;46(z9-k
zb3(4q@B1p=6n7KNv>37vWKV|{cjtaA*Sb|uB{N2|K-&uPhulJvx^t1c&&5$~HG}49
zZGzxF=Sg*u&fATDk0JtZ>7_2+kbjsg@cZQ|uM`XvLEc+l?%Al}wA^`*54(>3fPelT
zJV$bjBk-O$0cZ8nfBR!R1t+H@CNI)(==Zz5c<eFZo;-f7`a~kl=@K!CGhF9I0saOS
z#J4tKo}^-vq#24j(QB))XcGd*(b+`8WrU<T;u@Iw<(etxuiALQKWHaKsN>s$Xm#7h
zZ1f8jG?8Mbz3{I#4;DJTKerJL6IXiYC7P|O8y$Lwg)0gr`mg^ExNG<3bWFxe7HD2Y
zdx#$kzvdsXz}D0JfkP*I31wZ^F5xmqcZ`2dc8Fgmmof=H+l<_|FPBF1Vl_?H`H;9h
z!K%~xX19TZsu$iNNya~i-h=L}@U49647MbHRDA|Hu9qa=ne^gs6D}axz`;CnotsV9
zp!?t7g-f3<r^K8s2=vP#(svOY*R7>inUSP4))G*;fq>~R*m;q-&7aU5c|djPez4Zf
z(XAZ@6@(?v#c6NtcyU$+Z6()LJ53184L8}h;cpOEb$y&poy^Oe&1NV?-ywzV=xa_m
zx1}~i=Y?%%Yu<ZXko;7V{N2`?w5{2nm*e5HO2Q<%sfIMWKZ7(71NcSi>jsLP>P>|c
zbV(?YBD9ct+5(?dKbrrYf<z8ssi^mOyfn2Z`-P4Y2tGoKxdguKxbOE}D?yL)BZ=#O
zV38mR369=_bV+{L;9=S=G4xxLz4(INmV!$sJ8r(k&1&<?rt=hc6q|zK&o%FHkVW(<
z9w;G1%Gz)?ZU}bc33fYzlidALw~&vwy26~JSkcc_`<3k}v~uIM3kSIN=YH!5|FZ<;
zuA3_I-IvDf1vi8?T$5~5CUNJC>)z>-jCnF%n80bvr1_Yb;{;Cc1HpJgm_B*EaH0IX
z?`xb^<yBGBgG+&#Ki&zE$L-vgqq3rxOT=Fl<z2^e{G?@+tQFPn0eu@kmcDzr_4WU4
zY<um~7OAd&<0i7-D~=!-!!bie`&Ab2_H<t*`?MEK8_(c2N8a0ep<$>#I_LY85jznF
zr-Z#&f<vw!<5Nd_=LmIx#RO~2Ta+E(Xg#Ow7q=$^&4WH7NfA73TPp{L0TIVkFz@)(
z+1_<TdZ@AHclb9Oo2+?<taZ_dz6bUMTAhv{y;MVpf0xy7Z!kjs&~o^h>@~&dA##PG
z8QOQPTTKH^dC{&f@~Ksi*Rb5DH?PBXnqWJ0^YX6qB$|UwVQ}%OdzNJ7eX0kg9NP<P
zfplXJ93ul9BQ2}aVXcP#UAH25hL1;;wyCEjk^NA>b1l@QGuI+@kz-KB5=bjlR)4BZ
zs!MA2kIGeu)Sobha_fz2>xsC((kGd^$4dNkMQ@ZmjA8oPN6(5zeBmQM?4v~fV+VXp
zJ$NT*2Oe{wBFSB=TsEKJIS%xvqOeMbh*K)0f$fyo6w?+t@)PPp!58AvxVISo`qd^L
zE<d$m_Yfjf5BIepTS#i<;&_|7r1>pXg6=oA`7Dwh&dx?`Bx0HHG1f;*UMbK%`qJ43
z=6xG&0dU&Ny`C;7Oy=H)_aK9G(2i!&e#P^t%QVX5FZ;>#iJFxUuDXkmtmoq&lfgdH
z4bKM25FL}Be*{xm>BdCmx_-$;bA^jx`d-@)IpYX?rcD5p2Yq-6+!(Zze2NOr#B%Sn
zbbp&_sGqs<dp3YE(!LR|eVtpYunyv*^KGun^JcW^3MP(scJu<g!k7=Np?FiohlrD8
zqp1r=SetgOlw{+2-O!OYN1`B6rl3FJU^ZgMD}OY;=2YURV5pFfw)WTW*@VEUI4zee
zp`^b>1;}PQz^)m}8PsY>_m^{+7iMLjEbI9PWogt-?Ad1uN}ev$=^JvnKb>-%FSrtX
zt;gl-p}+~V6`8ejy}bK5UG3NVZgZZ{IXWqP?7F*w!YR+`d{Mku^R~^sJK3SfVfym^
z5Go`Kb|7d@=UDZozZpZ(N3E#c2e3~%Mjko>HXm$o7B06EHK*TbW16p(t?yR@R6ib0
zH$3huGDp|R9;)>XL+9XJ-*#_qM+9v549s9eeP|b_At%Jw*4sy8FG*&-frSY`)B%3>
zM*QD?_UUYnz3>-;lQg~iTC;&5`p=8fMKOcKOFz;t4+MgA!P<~|aJ5hY$uE(jcJ^L`
zKr>8hHtVN<3V6&X0{`g8k_Xh;MVC&S7Wh@tdqa!|v5DW?^8f6B;H9GmsV?>1@juQ>
z<frrEjI}ZnKfU8f>o`5dvgZ0MFHukX5<egAuedbxUN`~2A`$;55|U7J))wNN&)K~^
z&*u7`c1WD0fO;d1!%;t!64d}Jpj#mF7whw!>cfdsv=m}WW)tF!qqG@u#<95x0@OGO
ze~idck+SM>ryp7uTwwqP1Su5pN05N~Vr3L$os~M<H`vcij7Czc#xyn6G;;lP<NXwE
zyZC2!{m>q8x|6Q!$IP&(7FZ`d8cB=-6Zf%pW4UL<gGrIQ3};tpL?sdF$vd7p906Uv
zKdly6W$~%bRJd2oNU!!UL$;~QTz$yOZl+=E`71|T1bP(b4oP*{s9e5@rmM@dUkP^`
z-K5lDQicwXYXsVR^>>pA(^fSC;ra{*ZGR;pNG&x;DB=p%23PjR*I%j?D6l`{C7iAl
zPt*0mOse8~xvxeuyQG${#wzRS`l;K~!QF;knT_jJ-|tm@FVX1}Uf^xDkh9mF8fl+T
z-Z!8ghbB(0@>Xs-^HtLH^Qovij^q0L&i!&26C`Y1Me_L|y4#>pZj0$P#(0eD0d<rk
zC<Ri{(AI?m=vBS&KdM<dV2f0vZx%#mogYm*N}{#FlE{A;k&*k`T9@$rAwuyuN!f>k
z%Et}8`xUO?YlJ_Y8`Bo|)^02FeA!PW4MrS^{`Q8l;-hLNYOKQ4zoQTSl@ilT6?K(p
z+KjAT*;sZU7*;aBaJ9Yj!;rilK-mWN`0folPp}T|al2w6zgtUQU{I22N%#I)8UK(%
z!3_>_$2Pc+4ao%(ZI1umOb0ji76cHe<P^hJV%@40<4je-U!&w1TR|7v^B3F!v}g84
z08H%3xl7T>P#>79;kz4om>tTClr{?I$m1do<6J+u1ZszYn&oyC&z_*rp*9o?EUn7^
z*$Nc-ipnIFA2|}GSFgJ^LU6aq#xb-W@$>1&CPygd1=H4H|7<GNbQbOOELtGsJ&Wi|
zH6JBcQ6JIQ<ozA>h)LfKOXZeqsO#~kb-8{pdF49hpoq2BFg14(@C$<IwHm-XB(j&F
z?Q+n$3WF6pQNDgz`w+N?aB}b3EmeKhF=c^`&lkBwE4#mjFXuRwjx)#jiKcIKv+O*h
z4LMXIesEXYTT4%Mt$_7nNYT5gMyamWyW?WNsG*|R_r(M0u9#6ymSBpnhrtfCA%H>W
z$cVT;;yWHYx^V95MsDX{UOBm)Fw^xTe8CO9KeZ;K9GY;UcCu4@Ek9flpYw(71zReK
zbY=t(Cf&3aoV2?1oW``E8^jkD9$$&zJ@>>6wYmGE!qGdzjVRwk%v&<|Iq0Yv$?@Nw
z%%J9{W|>a;&MtqO-K$lNK!Q}%%Vx<=h<>Fk?XK9l>RDmo!)Z9Rx6=hQF0vNIF9(ZH
z8@m|a*XVL~tP-DpsC$RKDsFUuy%qT*a4QkAN?RFpk&fJA(g$Y5xDohES^Ocs;K)y4
z>)vZlKT{UTDX|Nss&=}V_pecLGX9V^CgaYukiS4mL0zK5vjC+-LciNZl8oMX@l4U2
zuR$qoE7$0b$LQ#BQFnjB<W9n`{u;;9=rg>YRco#Vv9lZ)>@xV6Z1fXi{JK?fD&6Y6
zN?(p7zg4pByVXAT&tqz9cdvt+dUuKsP-;+g=$^kH6(u)^oN~3CGHCVsPbC}AW6CMX
zX@dil*@f@%xI?cC7<*+F6GxSbrehwHzze0ogJU4mh<AqhTm)rF=NpaS0R)}i;*Z}@
zoi0t-^d(~$kg9$ps~28hp|d7pe6Ka!n>U9Ko_8!LTg?Vili-(_E5$$kO^ViA_c6L7
z%CsJT>OP;-HL-7o4W%&6AHZOhZ<PjYmW2bh#|(Gzej(~FhPdB9W1CLt66JJPxYNB1
z%4yD#OgQ4(4Pjf+APd<8z?(Vqi_YyGx?ZWBRs2&A*pmd<(_PxCrmfq3TfUHH5L)}g
z`SHekBu8ua1iOsT(YB%i-7yVprGNIuxN_xY_$k!U?7(A1a_ZfCxCdsb3`2&5_L59L
z=j-n-sk0*GbE|BE2lQ%$ZDr(&9z?*m_v<dt2X39flOe0xrw&13;TElD-oN~|0SK#j
zpoo?})5gxenDJ4SoGf5@Az}8Qy2kOZ%cfHGB(Sld-OC7ZUS=(>2Rn3U_?X8tUj#4>
z`8%v<EQc^d)8@Jz&a*COvGw`zOfpPXw0lFY<y3)S^ra(DH0h}SZPL+D+8vibePUAy
ze}NteO#29o%Km^;aMOF`Cz$UwA96S&#|+^%9x!hRIC@Su7gGaxyIm9o<UtGYKhR4}
zzW!Wdk^sYpc3Y7H=D1HJJCKX{))zlEMjqbHcbVZLC3JuE9soF<#CNpB!4_H~bj6Bv
zE*EZ~kI261H0bj7(-8Rl(hr@xSA};9Rk?oDe4i)1Iop&+?&K@jOoPU5gMaDeJ{I!n
zEoP&6_hdoJo=8h_wBNzL#%4`m+oCLweD=cvwdRM4Ilg0}c&8_oy@GE{)OyAB{)&Ns
zENzMH!#Msc>iPe~t?iHk?@B@}_ZwM^%hXpX_^V;5AjgWYhXKfF)j?7I4Uj;`?GTi)
z0>UY9xQ^<(;}1SYuHqjB6QJsU@(Z#3;0+Q~)A=pRTcDloexHL?93VXy9^-WTA+5=f
zM|E)#|KKk9>HBFtr^o`q<O`+tK|ki;0<!01lC^$(c$!akq0Vt*1U#JGCLk=ll)dPJ
za0X^-`yTL*MThB}nl!|MBvqE5zvi{+_Y=|X)YI<Zi(LZniS28W0*wt`%FUb8r37<z
z$DHS8Ln7$jV1bX4Z)vR?<#s}vVQ+2cIFAX>-&T7(jm~!cl8xpKm&Ekz*^dGE+y5v2
zehaFX-yuJ{Ul{-G&at!{ijb9^TFi*#FRvGDbt&%AEUpYdMF|%xJUppkRcXSZJr&2t
z6l`8(13Nw&qc~?bz%BB{v+`7`kMatHU&!x4i2<r=e*8~NCTH>`-<`)j>W6Q50vX6f
ze$s!~nu-vTk29{ex$`@6^94Tz@LuQ8AG`;oMQSGelmgO!a+Cj>2ZmoTJcO73ppgwm
zU6n-zcTtu-B0+@wN|cp4Kg5A@%WAG7kBLRHvh30!pX!{k&7&jTZSu+34ifNW;5CwC
z6WXz$Li{r^4bM-;MnTY_QQ-pCjjMHBu5XW4rJxR8du4eE`KxBU>#V=B-|Kw7)Ds;2
zOa}x|u5AV*9SrjN+10wne1C8x6pj89D<_M1YK_e5`eg0N0sk?WC=a;SQZJ(4o(u;!
zCM^8$qdE`A)#=8IEcElwEOZ>VfNmq5qw*tW4jgsqG?*6s-pm!Aq_KLl(#taWViJLn
zLg@`I>dmh<<O__gvi{M&@@t>utz}76=Wp8h0dVq}PXDO6TYe))VV8M{^u-8;N0vaY
zweaF^gQwq<-6LP7Ub>4aI4D3EwMY-dQsi{=Nq~Nty6#y^-EaD52l0WwH&oalYg%TO
zZ*$W1`#uxEN%%@jkf0$4i8kvvy`?t7sta{OI&qvfv2e?S`Z`Ivs5If7spw@pzVlw-
zE3UaYbTxH<Uca3#yrW6IV#fn)URgTf{Q>Wh>N0)NbosXq;$Z{7SM;f!Uir-){&J-M
zgs%U;6a(tT6HdV8G`6v}fBy4*ya=pVi21t}Bl|(EOI%6&C<ImQAX>Y6;5|Mxd)_CF
zQJ;l(DOT+OkbWuibbeS&z^x$28r%e6p)(vzd$@BnJ6hx?>!9^K=qp4=jI+P%boBwi
zI6T;|AQkZJ8Im*xmI@!$5oZJXsn(<JHaD~+B8nv=3MJ1T$DY6VgGZTr7Hdv_&{F*P
zqwb^`gdRrgO<(6f7!A~BRFtrrThah60}VP025h-P+j0J9Z*RchVKhF*e2V*9iWJyw
z!=`OMEM^7>4=I=Y98DEBw>P|7xnDdf+6Jr%PooVh)sL*}iFa`RN7U}$T(HN~0KjyO
z2zUKnw--1bN9-Cef_T|eltp1urpBpDp}Hy8e*v2Rb_wZmaNn5l<Mf$a|7jpmmp#yu
z*@h0|WaIGsXDmT9@(r@_q`SE#=Bl^Rt)VXgKUu5yqLPuci%6K4@`B6+_u)&Dg!l`}
z!K6jzR(9Ue!vN?QV3{mPlq)C)S*^YI9?gH$Ct}lUlK*KU-eGbqc0VHH`wG46GzZ*$
zlWN_L+e|Ei1|kx{US;k4C*KX9@EK;m;GyR8{UIfi@OiiJQ+As+nB2&M4VZJD_y|#k
ze+B?diIpGM+wru9y&F(@OSG0Wck`UlE!c~<nU*fm0q8O}YW6pxD!KkHO=9pt3;W_C
zFW$ht+1q!ADr@EdPjHDRqqYE%rZ(VNVTcpIpx^-4B#uz+ynDFck#~EIKfxzvY67jr
z9j9|747LyxqKlLN!eQ)Ls~aCM3ht+|$De-8LS5B%p}h<voZl(V82HehE8)?-M0Ldk
zx^-imHscwh8?*qY^x+Jrs-EM+M&rXPKXGI$^;_fxB=bA>n0{Mc@vdCLqflp~-0=tz
zhkl#m`#TA~gnh9|wwd5$(K<}sr9!ha+jRX6<RJR>GPRe>h{x?q>btYCd7QXfqp}FM
z6l2!-tRUXbR6E{|uzjcYZ{m=}S|?;zveouyA-*`eBR@=%&Z<+{x|7i%0Wg_c$d*7K
zDn3J%h&dAX*4#Df^6S5-n%Ymr=b%#{&nF3xr`s_*yIp7L2D6ywI}dPQm_07<$0?Si
z?8CFi(z+n2`GlcBs7L$%u`;3;^mS@+2b*v1Z+?y%%^C)zY^IDCY4=`aScS*r#L5Q*
zqEVkvX4LK*whIWkL;vdaUHl=_@g5bWhnrXZo|~?m%GnVAh7JEkJQCp`*98bRnCk(}
zudx1Aq<fdV$Wh*FgC#%D5Cd#S%VDofvc1SBil5nurEEjpJ<ry*&6YR`lfnCx;z5Up
zC;7P%5jU;Av{+dMQ*2v>9BMdq>6PAd5Ic}}S1i8kGE`f0<+5?aCOXx9B97Qx{Xs8?
zS3IwxAUgD5gCP}-l5}@P27k4jHW(XTSll(H?5wPzSYKn@9v!#H7jlmay2-jR9=_p?
z^pPp`o7P7jgDQQ_#{}NfCixI$`T#IEeUoTf)akZ@Qvu%w5u|Ghe!(JMB-(e0$$dUG
zMfx=nZMy$q%=#)rI*x$cMFk4`o#}BsOE5+~<Ii*uRj`<3Wk*nQqtodc%PvApTHH{&
z6>JkkRh-xQ<W&{)b*(>QRJ#YQ>12|7Gp$so9br4026*Q9%<-A@yz|Q3l9<Y)8l+)Q
z1~_<@=1sX0ZM=1=P<8twX-n`teo#lV&1|T)xNK9cXQr;srwu>*GlnszgW*RQf+|bX
zdo&lpn6G(j_rjO^9unFCOuHQBXLj3QWsW_@bo5e_$CUKKUV<u*@d0E!)MDw6tp^?>
zInuAb>loxdM>oFuo9s2YaRb#Xj4+M|(t5W~e@G!5+_H`QP#S#J5OX#6Vi|lG&!v+2
zIz+TlPetsO8$+iP=ygSC+6uzMl&1Xi?a0$D+LPrRr=^b3GAW0z$k>5%$kRzp>MR(T
z2l3eTG}#WmnV^S?pg0QSLAop5MDJB8xXNuZu_4mobHS5~-{UAd>{y)`4-no(bvdxw
zHpkBDHrn7%<gJ;*Idv=#9+)nzcSu9e6FTPUUPDCbs*n1fZZc$}RZbYtW-*SG!&F<n
z+1#sn|3K(<jN{u-RAu^2la^alHMj#Ah)=I{lIu6kset8Pe@uc#<d3+u6**M11x@~r
z`&qn=^dNQl9H2F@*@LrM<{%UR(amW8&@4^3!qXM0C9I~j<&;MNTUBhJJipvxnz}@?
z4j(AO$bDAth?hi$jhrI_cB(B|+4-K4^4myL6zM*rtAM$(2tYE~#&<Q=D0MC?^uMwk
zeO)M*x9w8PW<A?d&}PsT)77FLIt`80|F5G;(dSF7?8d_j3EV%8w@-;6XIA4bMOz>f
z9D3NzWo8F$5?B-(ckAKf6<g1=s+<m5-LAFpGuVr?Fx*=^>J>9CQ*E;_(A>tZNO>B?
zxtuZYJB8jWTjlG@z4nQJs2mf?zMbATw#|p!vO1)*B#AE&+K`Lf??e<?b~!Rn7K(M2
znSVLV)`?h&i(z9p3sQ*%7aol6t=$y3>jLi0ff}v4@PO}b;vBoE#1#y14}s%!7T4<Q
z648T~Ns!*la*&BVUyb8<3;bi8^Y^q*VrY{DSBba5{*X^q&06!8O)b+hDC*yM+F0G^
zUAztcLZCOb({Gj=ruexEP}pqYy59sl6;of4OKptGfWlt%8d#RH3NODTM<?{do{tva
zVHy~^KabQ`QKvnP3^AOq&{AT0HUX}dpK-T}kb#sx8;Q=VJPP4NaEeu~N5<Y=imk4Q
zj++9&8pQpGp%Z<snu97n5L)4Fo1el*_PENnY7g~7JDl8}jnp26PT4L&i=<Mg1g%p2
zY1HRCLr`uX96F}ng0{BD1gIuA-6Acr22kI^!V$0QlsT6MkIv?@ucUO<4k+gz_6>|#
zt(Oz*ob|;f><XQGxC6us&M9dM$rzp^nE_=p(fnl_Pxwo>cQLyjD-%!SS#6@>vQvzf
z$=j=tJ_wDYhZgQQ-UYcHU^i6{uu|oJSSc=<xz)nk;|VI7#Iu^SY{jkF>n$y(Sz$1b
z{%Aoh<13YxD}<a8f%aO)2HE}DFWc6fqKR!Mz9>YVm-424G{y`>)$DdLEhc6A4Z_Mo
zkyE8Eph0v`@VU=~q5c|%!{wfJ<DQ7i{2>w7(OZxne=X*)YED3{WZB_lp?Y)?+&fGj
z?o#`59Qn9OdGag7Q%B*<Rupr)2A0AqoSv<{X*^K}c)q+4%Y$(cZ3|G6I>15ShovwH
z*YkihKLO+|0QL!?;yT5<HJ7WJIg0x^sQ4aRzMX1@e>(0xZ=wFv3m`P^7<cr*`T<bH
z^3@o>ReoWz<bO=o?@G)>?JFsD%I1TI&Z$e^%+>7l05y24s?M>=Le9Awr9?N%sri7<
zii@sY{PT^{a7syJ@Ed`<%C!06S$oO0$FEZFWMzc!UDcYk$;=@$8B9x!u~(2Z(F*O{
zwpQ-?0m5Glna%<YOC*}+(t~wA4|8u06?)!S6;C2J?*Ke}!q*sS;XL@J>J&>#Rx4~7
zFZb$FO3!AB1LA%H&kj1gMo9c}AnbnHFq8J|L)8P$&lPbagiH7an`!K}2}ue(iVwwG
zHdBmE<V{9}M6=si7DdKY#)}r-f6JG;K~Wl##}t3>L9Bu`N#!{Xz9D7?$F`vQ8B1X1
zxpGF$jhCZapwt!S2MVDXL89fPB?EhgK^@_<+IgmVvyQs*ksDK$io~n6S-BZ5i6!i7
z%v#bD!@2o~2;$V=_VgbiK|r90R@&7k0#~L;e>2h1S2mt1vB#>HemOHboebTQm0vEY
z(~C@35fZYwcLw;PPZy4;3VAwKo4f<7niR~8j*6=8h!a{J3ds+ekI0|WV%*LJKV$`G
zeHq6;?CjB-6b>s8^A0chx_xc)E>w^ri}PE{%IzraLizBTQpGq;Rdz&ER7fsYibbNE
z*^5sxFjM?6>HO!nCbbW!Q_eqs*q?N?mQkrbOZ@&&@GjGmS?79snuKtN)dLc(eP)x*
zqUg@e=*9Con(&+AF6*XoKySqty}dDPe6iE~1z=0T$-N+wB@d$EEFw@p3ht)R|7@#f
zd2m2_n8FdvWO~#gZCBp$l?CLXvAFPg*>-#Nd?4GaHvXzwxm)&`p12p=?rfezt=Q>J
zz6dk?i1vzf2dS|-`naw0bVg|Ucj9jaLhsJF_i_h6&z~CRPR^n@D-aq%?LB#3rUH96
zGudjSVSH=XdH7X#h0Anqb{|)0LNPJ7Y)6Gp!i9w9Lv^(!ojMyU<U2eUXoHm>Kj`+-
zv)vxTd@;+v!|}jt7v0@mZjLrpJ6~2%JDwMcta(?O$z}k4)p~CG!M|et4zmfZC0KGc
zo@usf(<NBg^jTTf+H;pwww=+Z7=n`-BEk)OpgFh8bdoc4aG7G>ib?KHm@+3u4aRR6
z!{$4<WYz}0ub)T7j3YmyBYtH&KUy+3-swH<E1kWg(IFT8h-1TdcLKS!&DUW~=(a$y
zPXJ9e|I)IV{AYn`{+f+9TuM_szaODgov!zDSC6j^!NT>{2maE&OciAE&T<vIF}~Tr
z4j@z0c@|do=ubp{rT5PhG@`NB`sL&U{Vah{Y;;LC&*x`_m&0K#nzD`#NYL(|mg|RH
z)3F}2Z=VrlWycTApJ9;inYdd#e6`JCJdftpz0r86LdrW4^vH8@#p0J>j_8QokjLAn
zjH=P*dZ;pSF1zPCYr_*cd*<upFD+A--od7um)#$ZY}5FeYzFSjg;}{(=2p^n>qMMx
z?okxI8xe5nW9u?24d)z`B>7S+-ha9&2k&8Z>}*yO1ciLvrg<#lT{_OJ7(c_#*>WIo
z{A~7X8P_Itx`fKO<FJ(>GEQ}KmVu5=fqZ0`Wt1s<xP&muWpG;P?J4!EcqUBRN~%G-
z#p75v+a+SE{%%b<SqO#M@{8X6wn(Yrb0f7{{SOCOnylmy9r~aug()ABx=PVJny~?g
zjxG7|ul!urDOJL%;q^@(d(E>eofMv>L~A5hzb{wS(GVJr&26_v;#zd#Z8}i*X7Nr`
zT~9vDk9F|8MuSXZWj|^9K~l};Uaj|qg*3O9!y;aF<IO!Jajk+8lTPZ?>1r3(Zl_1q
z^E<S6H^rj~wn)~zFS)H7=~!n|^KJAnz6Z*U%{<AM^%gD<5CIh^!GjMgUub%<>Iw*S
zgT@#Zt|VXfXXx`hSjD=a8=W}-y73P8jL01^l0HxKKAa6w!S9y^p9Et;nrR2kf{fDq
z3!fhSaZCnS9<fWq3Q$cF-05fmRaTn`x;v`~o1TzvV`aMZxX=`hFgWbN=*&!R+<2km
z$-I&2fa!~qn=J#1oGt2Y7Do_6E}LCBWq}l!*}bH^sg%)n6ya<(`lF#%OT$$v?iJ{`
z=4PJ!u$hGs9lwL)a;3?vaQ*~b7>IirSWMzfY^cqK%t0urruzX*S=%ht%!w-aCUMZ0
zy(}4OE3$D^|FXL5n~|2$2%1oo&P-llHF6u2|B6*EKU{jnGUBm2>P;)#7-K|_COd2A
zLCW5j^Ojus@(l~C&Ao39F!9TB;fd1<igoEV%P>!2`Y>CiIF#t|N5f#ff&BEif{o4I
zWxTqKrH_Wt?d+xS{G*6AOet%cusm7|(qZgyBw$e)Ft}L3Bgv2oeCu$5R;=l;*VW+&
z93i3HsEt!rUiL3>r7;CLeqb0%+_qaEQ-p9BUit9@$=CB^X}_&xjL^|Lmgi$^BBU(#
zht)ClxlyL**i%+^8)EeCI*GtX;zY4k(#q9gap!vAJ5Kcjf&va}cQnq*9;4Wg0-*Y{
z0el?klXag^Ww4ZJ?!(ELLcR_5rg+ZBCgax`V83bMB0rIUsDf&=ZdkseX=4!&Nxxe%
za}Q8M%(*!~6!O)6)?$@Hiu`E1fNher%66xZqa~}TV2|CfJptQYf5c@r$*m$q(L-~#
zSVW>!c}cA70o_I@lEiD+s&jk|qM8>X$fw44{Y|vx_JmxwVTSvR$$ex7mR71NA@q8m
zwr;@8QLZhjybJ9Y*u1zknd>=a@Az`j6|`P%x)XuqTaib`qxSv2J8xTmzuF~6kuNBv
z(INW)i#wS?nQgL2@_bLvB?IkNZJs<;ES_7iF&@|jazA+?ESz_0XmNf%yj=Y(986cW
zzP)2sOTQTt=47TAzx68V%rSp+cGI9MX|{`fe|q$+4JTEV6)Fqpn2SQ;kqiI+sY$Ti
zw&n5a?%qyvPzQOCTv%bm8pTKb@=p=h!o38O4qJ|`V441R=#(52uGMXrRvh9lEY0kK
zznJ;pEfr2yEtSo7VIlh3k_T#UPi8l(dXor<8}1FK_hyfF)QHv6X*Lu@FHtH|1g!xn
zCY|Q(Z^l2+5gpADhtDl*@P^`F&E8vjNK&UXLE>mUNe=VUNgc>9VA>#nT%~c+*uskc
zzI%6T^7Nxz^5E*LW&10bCd^Kq_da;OcGGH=xYBd$NzB&Vg}Q|EyEAM}p8H(r2{14N
z3!Psvtb&6PaNBvG<BDQ;aXN`El0t9HR!L4ct+RR7T8FzGedp|`?<EQ5-JEj2SLq@6
zZL^zZf_)M^{s84@9=e_<ws_EM-*ZGe2>zKOW#D*dnU*evXi&b;v*TgznK+34EG(RO
zGq62`oGEE#MC$t1{tIEu;qxVhI7_Fg6N}lG&UKqdW(MeIrPuSLqSvSQ76sFtUPm-`
zm9LFzdsiznCNb7)Yfh+KJ}_scnaudq(_KAfnKj1A8g3o|;XPr3f0lvhXUotfG6`lm
z9`Ie$(xegg0f%RHp+h=1XS7j~fwr6cpp=A2pu6o|HO#jBVxkkPK~2v{W<Zou&V2cB
z?kalqbQ4vK*gHQ0Ar~M9M^m7p@6j()GQxyzq+?!=(%ECq%W~|jF!~!@{|95|0o2s`
z_xY=+Tt(#yA~uMkfPlaiM5M+7A~n*bMg>GbKx(9f*b$H>O=?h@5FqqUVxvZS2|WS{
z0RjmGl90af{_p$l?#%A&&cF;O6Ec%?k|$5T<@2jD+g?cW^L3x8aviR|Fi=gh9E*0}
z#A#x<I>EDZ>sUU=K!q8MTaKOX-_la_8Sk_ZWFYN(dX<d|ohWtz+|Dr6eV%o*?J*T9
z-3WdNh_K<(_26fs_H(W@Kw(ZJgsh>}tUPwB_WRIDQ9=wR!r0K`c}}Xm9EH51Bs=~m
zZUPs@oHcJ`Dp?WjF+mtPOmn-)Silb;szUBK(&YjqcgtlHDG%*?6;>0nbXy_#X*O$}
z2wO75#+Wrb`APAU4xS1vj%<L4dSP8FcGh|YPzqP+nRYwg&X;v+fy2^185bu#<2+|=
ztNIG4?t*ZvJsQC`YIs+c`f2HP1N5}3EH=XxzmBUat??VT9iHoGT$r#_@IK<;H8}%5
z4`sfab`LFdV2~vT(6Trkd9|U*@Td$-MI$n;tIOq#I8?j?0MIk6oYb~uNlY=|c|_#Z
zr#l^3?p^lBNb3b6J-av<H=)<^mpb{HX71Hkfg-YF6r6L6<w`sWS+e4sCmZ1;16P_q
z3X*9pGfzWK@H^2XE5EarDBetUb-bq_M4+DA5(B*tZhj2@k7g7AvOdYsSS}<$TOmE$
zV6!Bcs*_?@VubwuwDk$OxFvoM%WJ$mGbex^7C4ef&Ipy#ZYGL7DgW~^AH82KwD;7p
zIQ7nc&tWyYT>`B;KUr*0)mBH;)_CA>xYfrw8KIE+#wE9=ej3q^9PD!qF#;9j>P*90
z$mu>h$w+?p&24=SSEmjd-L^gDmw80}z61XKE_q|zcuUO&RsI0zeUIDdf$!tzJ#q&g
zpL`YPWEr6aeJY&En~DhBYB`zGGlj%CDchF0?fuBH=#Irgx-5>_6;ZAdZJ3>2zGKO=
zc|kBk-$F`KgBtf;d(G38s1*d&fpLTtX%qN!X%&4sts|%rlX5963-i+wT2znbc86^<
zJCE8(&d}H_|6XB<Aicy#Tr&0f>+(1(e9pX*`+`SJ%f%_+KE>zge6oq6|8#8T=OZIK
zjyP18+<FsirKCoBK&F3}^lG4L(Tt|z6etMQEA8K~C)jl^)kuCwB^XO=q&$;5w*{r-
z(puiNcjx`>n<0MUp+_UTpw*H-bue=|8*ni&<>Dk&eT7)QTY4SVIy_Is7h~NYP(<(n
zkdZC_jMt}(df(3Rc#}j!A!Krm6!z_h{Ua>>;QC7T5GPKXmO?S-#?|R;lzxyX;I~^=
zltm^`!J0r?(ILJ24p=u^d*}0)z`hq%>QFQHi;Sj}yes9*oSf>=<6DBue~z5EO9s@2
zvaDS8f3}<@!}Z64{J87;R<y6vAmN23KAJ{(cXx!so*IBc9ukpg=t^t>_t1iocI3Nu
z=K48-tsMjYcxrhc>sKtP@@ky^r^M#+#2t+&-$`WWvr2`1ZHZnwXDY+EU->9OCZUO@
zhF$x<>|9AZh5k+noTOBN*Cg45tva&~oIn%(Pn08LKi8|u7!&@9S^(r%pPpzmifFBs
zI98w9d!Sy-5n*Q)fPWj}0(uk`(c@FY16C&K$Z@_2CjBYgiF;Y*i@`(CtoAkgkp#!(
zKyUI5+K{5xP)+Soh?kOVF8elGeV-|MSl{X|$a_=elfG}u1&y-A_WBEd8~tbdo_|T~
z>YbImI|$ynTNOuFU5&fdpN+zu-xLXC8vfU`hG2>{)14%(q2OR{w(V<c+vVQTpy;rG
za<R{|6f#*$i>dIT!)|K{$@8H);^{8T8)PI!QoB1T1hv20+iI<AENmEIc$;~1+N1NZ
zJy9mQK!3VV=l&$?yq4M*jrGRm3q;q!>uFC8MRK`~y&dBe6pn`UeV6+a5zAq8TdmmQ
zR~x;$>iqj(mO&WU9wG^LxA_BWmLYk!JL?tM?C#-<;Lma@ko2=bkpo7yjri~FY6eIf
zUzS&z|1pRzwz}xVn(X(kSy&oy7#(X)YFFYoHip(8TrHLF-Zx5G0lN%W?Ar~SWv?AL
z5pmtVb@p0ROZ!V|i4q`2fggv)70F#}Wi6_LXFyTgj2`NaJ!LDEONc|b|L_gZB;M11
zP;r1#hQ)7Tk^2be$XOTFa8CReg3+)Kg24)EgrEAwZ6!`J1QhQ>;6sWcI&%Cx_<p?=
zT}TzNAG3rxd!6gAVE+#0ke3~md@(pJPcJ0d>~uhGUC<cdk#M2X#a+%qd7_-%SI5Sp
zRvi<FpW2-Dgm>l}m(!`QlXm{ILeiPSf>h^1#w0OAE@1(_BhQP0ofM=4NM)iS%AQjt
zy8q;CZi#Xtws%3V0cr%chABr3{Zk)(c~hKUE@1Bo`WZky=BuB%%qAAvn+va^)0sj2
z8K+=ZEqUC5BI*tv-mNF9D>EAbGl>ddR8WUnM9a<CjJ5P0H~&;6|0b7Pysr4-N5gCv
z%FkqbT%G;-1n_6{yF4{RlzttE^SJQe2*t?{UxwT?0_$3CIW`Q6tBn2FrIfn5e@}Q2
z<(zo#gWr}kb;Y7ldzIq|c9pfp+G-JF4zrFm-bqPo#jKR9j>Yw*|Adm-w81afKC`YW
z7wu9W=qc$CV{WJn%QSK3L`8eTUD`dBk}&<3!HOofeBDEz#arjTQ;_ivQjWy7#WwxG
zaCwrCWAclyTuqvRT5~8liiEjOa4{6ytUomF@<m@o@x4wzz2Y;e+B4U@9@m0!9yitl
zP#|;oqC?R(OqEq1FEY{T4DqnN&qn_=VA|C<;>7S+<Ol`|CsWC!WV#*=vHc~vHtQ9*
zf=ZOPoLkM*0jsTd%_SVnR&4yRACr|*DfbqaAggw%c;_i|>Q`toVt!rn(CM>o1pTlH
z+o&-v(qz*2r2(+{3Hvsg7t4yee(SU2vAZFLQ4ZjJw=3IPKS0-1N|4JzIIh&Rj7ag0
zy@T|HM&~QtmETzFm0h-|r%92Nhsm$WW9jw-$q-CsMv(Fua$w7+XY|D}z&3}&Es1=E
z*tZLJoE^IM-J@|L&9I|Ea%~^_y5_eKp??zKGc?f!6ajrwXi@smb>AsC?G2b%3EtvV
zfjN@=LvfV**r7wgLbKO22Zc?ApQ^rX6aLV2k3M1KHzhovtO-9A)z$Paz`?iEqpuEA
z805r7dQjK=0b6Ew{jeWXX6Pfrg*S;RdBr-RD#?5f44ryxFTL=+u7;8evW4@L&vBds
zSI?wqmZt1x?2)%!s3GA=tHf`ZH>Uoey*}>aI~e>5p;gab>-oQ-C!yz1qeR1&`|SY;
zw|eZNR7CLu{LH~;V$L8Nm9do;9omFR>oMal`a>B%F@_6?Cw%C&#RTl**M+skEPG{&
z@81LG!rg9$H>9Ox7q!3yD#1Bh*yOS12(KdG^;?IoI-oXJ7Jh`z&o3h7VtDMhtNbHn
z;@^6^j#`OF($>JaxB*S8L|cOrqNx{Pi{nE3j2^BolF5%G=1~{A`vV0;;1$FYlcC(3
zk-aZCT@pQ{KAeZ<8LSHzwX){54z|KVW~WxO$X-9Rn;|nr-Wm(f*bH5qxK#rceCc&G
z@X3Am;eZ#^zSeH6bknGPRNC4_2oCfY{QO9^WNg+0=_*+V{o+Ct0D8%S>4G2xz?z@i
zV>~O2yJ9e+?N$|s*C*{TEj0znN--GuHSi~1O6A?IFqC<2qDRcsVU0gE<#T`O%l}`~
z*IDZ~?U9Q*0l1}K8*iTk^jBl{)tkm=2b6d~cjQ^G^b63gdgUehj=e9y^Y%NoCjUfH
zu5?zsbE^H{qA2;G>*^sg`6M)=tUQ&^q!?Qm3iV$d(U#`L`y1CjWCj*;s%-2h#r+kP
zl*+dnq_lgrzOU~WBSz7D?4sIlY`s$uH^kZ#*S{%H*LGSx>R8QT9He{i@E8@Zu1+8o
z4V@&;(o$1ja~xQYR1*HRP!E~j!&!>w{1mqK_U{A62Kjm1mH~eXU(I$EwFw_yF+C;P
z^P!o9UkW36Y~3HrWYJ5OnpTsuvu!^jGswZYcx~jADh06ZVP68iI5whc-7}57g>v<Z
zNc_2j;eD{pV~6@6?Fz;by4YeUm^<zzMtB+9%-o|7e|AGd+f8h}^sy9h%<;_+n~(D8
z!WpW|qvp4u?8}+F_JQ8*AtCqC$=OIHHAEndn)soAv=(K+-E4%^zdQaJ{XsI4KThlB
zwzJbC9PYK|eSCRNyeZ`Zcw)S~`!Q?dQ(LQHVpj?*$_|!L%IS*a+7fs9JeX#rRYi>e
zYC)Ai4@#TwfvfC!`-AU8_fN--f{*L;g>T0CmQ~`X8f(1Bc>9Bq^e@f6$7t1}YX@4t
zC9YD89Q#R&(W%h@dcoso0hTY{1^s$VI@A(J{?xjx68={D%4^1%wbMHO2SWRs5(1<a
zwL3$8==_`Ja1zcMY`U<K=&W==VRDHZ^(L|{q}Cc6L770v0vV$Rhk)dDbSG|Jzdix?
zl)0CfRY`0vDaMRxa=$d&A%yDx%;LFiFNwY+)pY2+>0aiCJKKSy5RYpVr{xIYn+AHS
z7u*rrbxxtaxHHoY<aDm^Xt}J$N{dOw@{HTBdnYzB_48Oa%Ql?n&;do|uI;zzQkAJM
zUffV14;zIuD5|rjkqCnb6WObl&>57bT7e?EHkfkcj(y+tNmQS!Lkrg!TG%uQ_AFY%
zwYl`t2vyoLhGldmxvbZ9Y2^0pLWN{5DZOV^<5UH^%r3~uL?4nDx%m#yOwI63HTN0s
zrn_WSmsQo5v8}m95L`aW(VQwG@Z+x)$lh^vIX5<b9;A08!2GGYP-FRA1i%z$Q9<b6
zWhj%!?y=siy+s#zx{OBYv`OKL<PYVVLG`v0B*y9FOF?#+_U{&H_n}kgyXJR}Ot$$o
zw(%{SFDfC@WhLfNuizbvk<N#^jy{$XGI1<LZ1#@Po5N0NIV5y{3S)azGHPyHDuq4z
zp|I-BU2Q~|7xQ_Cm$wWEFM3Bmp$%UTUn-7uOa)D#4Y-h!uHf^5XI;4aANg;;9!6fs
zq$l(~m#QXAOOS@1s1e4X_URpVNe2h0E;ZgvF^9I`(u)ptCdVpWrS5<xWHl*OQ7p_G
z!j>xz9Q6f!=Meau_?MJsq}z3w_hztm?(HmC%|J}#YBTk8l@jM5@PCGScKtuYK!MkV
zhp%`wFDxHnl19*ta{KDMXK%fUB3L<G=4-7?6d73XhnxFfJ(qIQe?P`|lmj0Re{Mor
zbq2R=$POu8Bn6tfhFK<@)^{I+FqbI^rdIfaJFyKGdWDT;-qwZMjKYT?5shj5$|Xrm
zTSy)Pm6EJB&oovWWQmWU&f~mnC)L81qTTSXt5_;+AZgzG*s#k0rmQd2J>IPSY3fCF
z4;6Nr<Nfd^tspu^THC3(zY)}>OH*zBJgVu_99Uq6ewf-;P@8J;9;mCK7JP$VsVUbz
zq2PZvZI+pxSwrc$q((9qP`D}4HhPfW@9KW3WK{8|uu;oCzcAWI5%=&ye?g3_2irA}
zntblf?SPyf!gWH^?+DbH**#?q6{)iR6_zl=YlZBMWJT#8;%!s3rQ5dgj)z7K6d2c>
zumuCO^q+GF2ftBE&dsjo&`5<U6@)sFuy8L*vFk65%{A6{_NaSTB7vt|>3|VDgmayP
z1zGL3MeTyyAh(QXPsxxlh4j7)vAu*4Gl~$ST=?vo3wA+%PH(?txK;RC<I^y~s%OCO
zc2Fk!`e0UFm>QRg8lGAK`A$O)+&cVTfudS45Te!oI<3*#4c3b3P(o(18c#a#jf=Lm
zZOxy7CQz-p;rf8~2Ty($+nuw(Y-w`oSFS#|jqcu?LY`}-AWaV6#p!RQ10r}Oc!-dp
zootp-Ira8EX-GtiAC{R{uNJ|A^-LJKZePjT&TQpZhF4HoGr45sC|ueJ6==V9e(m+5
zO457zu|Bz+yHfjp%qFzL$fOoz44c>v?41Tp^zA}P!)pI%W**nsqRbzIpZeVqO#G)K
z_%^;vuKyPxlP0=#niG*{`VcO{nFr0B@!JWR%qb9Ez6ss_I*|-Z6x0xC)k=a`-q)zQ
zvVGILct?JAY`g%4GmrQ4^kzmdQm74C74NbA4KKHuM(V9YqkJ9%$p3ik>^Mx{u{@^B
zKB3v%+dH9$IEKfcBJ)bOg62BFjZ|l9g-@=Jc02CNfN@{7o7%$}P&rlGI>a`O!-kty
za1_|}zVU6VWoD|Yr`k%5FWnb^m%Dq*eV8!f4qH2|Bp)481uNogQ?H7rhZNh(V?_LY
zx6)0YhTd__`;}GY9Nx%TBG2zCQY@OPH*=56??Ly8bTEY`O3r@>wjZ4Ia+``L@5gX+
zN#kEzywvF5N^bCuHuZmG0rf+_1yZd1HB`+`oHM;L)j%+xKlppKd-Lb#F_JxJQ-#^z
zh(0$0$h)Wx$i4`J`b3!MSXZFB-9V2<#>y7kbZJiDk!=0MwZ7&_Hd0<OV>K87s04ez
zCNy!!*Bi-ah_08f@gfuQl2&mR-F2D`w^Tak81v@Y_@$DDUcHdKs&d3(qGNrD46EZz
zi4U2xKhLycXX;QnWNH(TlY}ncF>opOVOP^+J?(c9%1v2eduGu<v=)|03wXh^AK!EM
zYZ?A&AVGW#9Jl?+LRPIi7&kePtUT^KQN;#5f$g7$oU9R5oTaUpl7l4qvAH!*laY_{
zm*-!3<f=aTR^!(<o7evcjtr+qDXhS*>&aatwK#LJw9b0bTwMDKXR{ZOR&RRa*?EDO
zKfQm~!u$~=*MNIYkGJ&_bVEN~=aB{L+Iqzyzx~Y}V~2LWin@r#vD5p10Zn{o!x68s
z&;;(6E?-fF22uI`k|tL{{*1nSoc_A9HRN5>E$5(VA=Y3%>)MR{o>cB;SajdlYT@7$
zf(WQG<QibGtMeG(bS_p{U?K{tp^bX?06Wps(t-AX@{sw9v!<KKdW5~UMie>D6Vo-_
zaF;k6p110p2pMd*2RLjlJ(z54H4A2<f&6!A(Dev@`dP_HS=XUob?FP`ATKo=Une<q
z>%%rJ2`2saiqsXLCb~99XVW5C2<qOQ`LYOKc*V;3vl`Z>w^$aPu?fsOR!Y>Y*?B40
zy$em<BGFFU_P#I01=xj-8@om6fmK+}fDju6k5d^vm=ymsNfs!X0xgOzasQMurrz28
zQ`5Y1UX8FxDufQca!-++<PN#3XGMM|%sHgsxAkM6XLUEOHM+U4@+)J`>z_xW)U9si
z9r@xp4Rqm3p3pN4U|Inb1{rt4?p$eay_47M^P(+i{wT8s=J9Cc@;}9wLuUDF?R%-M
zr@E$<Mp~!*=Cv(4?i<!;<$FQZN`%j>9x_{}3ij~9B*V^rVsqYS=duwYKYc&6%X*`J
z1>9`9#e_WbNu{NMrgOM=DOP+K(H#M^b<*t7lx#tzEh-j>M%O7PeVi4<3$BoV-IZlr
z1TJ7oaZf_B=U5e6oP0_|*p_?*>^V(`L0KREyi3Ys1JxdgJ4~Tv=wC<~vG9`5_#hFT
zOFhel47bxJJn7udb=aLtaH-C8QN`5HF!HweS*3@<x&R_?hG4xDsU4b@w;F24^z$O_
z(zv@?yf53!3y1xX2>A@t9EgkB)dx1z>vx0u=auI|&<9(gw;oksdG}r%lyX*-T_2rb
ze&{d0md16cY=T;tW#+SHd5=oiafWb+pa{haEWHX6%)#l1S_YSM4c28xVK26U({Rw;
znO=I-2++gV73gad+9SwUKfrlceLQ_VXix_r$^mc@wa|O^I}$A~D#h&IBHk&b9x~{1
zh!1xrw17HO<~H35qR72%%|OalC$If~EroU~u+NaUPy=jz3fp`c3iM4$7hRhy`0-<I
zj)O*<b{vVgF{on-&PZ&0e8sp1x^;`RLkI(5rcGUgD*ZVddZZoEM8VFWSagOKE+&@S
z)^cr$hLfeAuTh*tElGsYZ1s}uko(H%;1(z8_La7#`e1%<d|(>TDC*<3KL1wclkZAu
zD~<FYGmI;1hjZ(k>%%^pMQAwoe8}V{#p%1rZ5%T(UI|lUm5!-tXUUcp)L;Scjr)Jx
zOAZ(?OP;HEub8!9cFv<$Ddm$du`%teW?$+hQh%u2d0@MHQC8h)OpA&6ACQJ&<G`Ui
z8uuriFFaOiA2_W540n5FV|;(R#n|(AMM4lywlh0*L39dNTJ4Bc`tEPiqzIeUb}X{H
z5UT%HL-nFowP*{jTe#PFn_qX`JAM8b-vIxN+QsNuLo>G~eG?UZRSQsqH?<qaRZA-+
zZ4q2?YOSa}hATYFJ@^@yiqInWAJ<Aq5&T7)oBr9QVHh~_)-SM!zm}BIW~@d_I}|vz
z{M=g%;>(&x{LnTpj&$kWo3;szzDj)EM-a1p%}0skT)&~lO|XWE382*GTcK2kv5dVa
zC&lTY+b%;&FH1g4l}Lkcj(fdlM64MsgBy=uVp(Z?K3t~5t2d!#sKjQmr&OIT-1I-3
zRi$et9Tob*`BEKHQTz+xE~weg+%ZpTq!7vbLR?fmdIxr=IS{7Bj%-@6yelkig)(G?
zm=&Xq=>uV8{6OE+uAoIhFSj)D<&K2FBb&GX|AA~=a~pYHXYN?}`E8|R6P_|uDy5X6
zEWusG@tC(Z;69-lV;(a!7U?aF_ePgHaSC-Yc|T@#mCx=8vHEljh9Hd>7}cpnJP3Yb
z-pb>eT%I>g!DISg5ta#4rzILMCYAY$;OPJ$;b`kB7TJ>|O=~()QalAX$Xp2-+K;ga
z&<J2=YnB;f(A7xY+B*%n(7a%XYH+FbOiDVoFIgfx8k6Mu@CKw%O~ZI5v*2j+kHfz|
zW{dx<1BNtthks<9P+82&I)9UOI@N*ba#6ML<IS<IzH83*mBQ`<LG2&Rz<<;<cA6Rb
z9G7HOE>|v1H@~Z=LIRd1xsI=X3*{rm*AIW-TnHR-DCz!uU235YeAZS2g}>@7qTTrZ
zY@k7USZotTe%N2h1&kC0+n>{DNpT@0AWx@exNd^_^;O(>HI}ZN24+oSD{ylPGUhMU
zf>{x{&xK^f*`pOG{S^HxE7#XoBjxlSg^(gwri+StQ_R>gt4Q<kn1fQlJMO*SjQH-C
ziOTPt-njajJ6ZIr&N4DSLqXQ7KXQTnT*;8Mpy<;5<EXQAaZ^aQ#Hz?K`jU!&Wiw-Q
zI0R_XUB*O1B;TGEO(Bl|d>^FKjA><8)Y|S%9m$wsE~GIeAsOnlCQM^$)b~;Mbwkzg
z0|`&JL&B&g!f)mKe88ylq)`{xC%SRt{uZq-13r|jJBmAB#xR#`oz3+Gz5Z!Xyvql@
ze<JHsr(Uf8!T)pV!PBuckPBw4(WQ5KK%BQy?XxDr9^O34|Aszp@1?OlwJU0#unX|t
z_4fazhJ4Ox?IrPj?m)+c@IW;2J3E&C=AO>&IpB+j&nIZ(Taebnxw$9FY{J22_H(cU
z(T%sI&zv<i%>_U!HFL=*UOeSpbtP~E7-W#4nceCdq&x}rua6C&4D*KBrmJ0w?#OrL
zi7>SX`9B5ho4n7cGQDZ{b*iR&kCI3^+ykka)Im9K-C%V^8JjY_w*GEwA2wn)nFm?w
zL8A5MY!q&G4%i}&8%^r$KNRwp8o!XM01u@7%C~WVotz0VmO2)^qUw1yW4wFRr#~HR
z7G`4C)@a$A*kpG<l=|d%H|9+3p76w-m>KpLvoLBrxF^YqCL8BwD^`=_*{<VQA!u*#
z*ZSrn`nRYLhARXt96>uOV|e?S4$_6YOX9Ps?J<##uPx}4Vg67<vrd$(U_Uqz`gVT7
zA6T59T?-eekKJJ3CmChQw1^OPkDerqofm{Swv{vMySylF^~4*H>2UJzNS&v5qqvD`
zh-W4GFn)#OH&Ub1r4?_$ojLCx%pzfYC1*U7G^0pyr%Ua@0!H}M0<pSh&GeXjUWeej
zFwh<*#HN_5>cI*r`lBnK<UN?uI^eSDMBkrd@MlDEU-Y%9($~G*=~jV5q*5BbkPecA
zW?bY{``gu(LD$Ml>8}U|G`3Dje*qUXib7ZQ$-0KoqIDiL>_xcfdXGhY;w8Jn*s<|G
zn|a8nCUd>n;YEWeqZX`1)v5o}3#MR~pwKq(G<)+3MI?^_-!~`)idc?%Nz&)64?wfL
zIX-2K_*qTgRw8qYGq%xra{h0!#|&vm2%~ti5%w2jY>NPW$v9;AWp1tANVqETmK(s!
z$*b9iA$>$hY_ghm?!-2;wtVZmu;^`4!+K8LxAgEd-Q@I&SUs%h+N`e&C1AA#&v%WS
z(;i39(6l8}w3?p8ayZ0ux+$+PnDOqK68Y|J&$azss+`Ew+a#>}_TVpLG(oVT6G===
z4)d2AxwoKO!VvM34=~n=&U?)5kE{=`&U&j%+SZ%7;HF~THQAIqYE)sS(BGT-93k7d
zqN>Sf={IjC^z=)$sq@c<B#KTF!7Ub@vrlplGR?S6T4_PQUupTMJyadc3bFOFg0H1*
zVa-yLBW%d*udxUXR|uT6*~*?d*<BiW2@7Qo=SqK>7#T2F2k6N~2(4BvzHLT(Pez=%
zVqNMQqiM-i)C&y?pl7HmrjNuKr0*=<Msk+(50dO2*xDl40!PQY3e!b5DOs+-?k(wU
zsyO9Qh7?t8XT(Hqjvfy5)8uLbw&PFeSF)=sr)ZyV;vRxQqcHH<kdrp(R_=sY3|mqe
z?aw{p0I)VxS5UdL{)QTt&X`FYbFzn#?x3LjpwX#S`bpA|Uq!mStFtmOLHcM|RH+Ye
z>W!931K-<YzIN0Kv(=swn^8WasP?I(?BZTdf^-tZywRB*#hp4Yu;<@tZR;WjiEe?}
z&{vJx@%AVmbdb$qiU~%ItEZ5C+05jkP6F7q@fb2{cs|8}eLI)@lq}TRMNx+SK-GQo
zcrY`+*)`bIy*1Cg2R9!8ZbopV(f;941MFjqG6crd#)*t8UjwuTq*{O1Dxr&i=pz@m
zwDplbKNe;F0fvBP{Ivss_e%APC<+t5)ffw9Q*fB2W4)g;liBC77)`-EheqVU3yjt@
z6fmNIz{-{F#Bt~uDQ!q{Z*RdTO!oSA?VGIcQ|pPH4^>rGR3+z_!p&PXkETRmuE%z|
z$}qqW=dg)%i@RiQQL-BKjgH5*FQgYcw%S)e8|!pzyy2}pUoPmOAlD_2PL_1VJ*<2<
zi_(sft_Lo9Grx11)t08iwUhiKwiGh8mv)~3F2;ZH#AEstes|4p8RjoFMH$DmeZCt3
zjSzr>gePOD8U`(X-`hJ#js245$SGTL<h-ooP4$(K_gP76^M9FZ7`+5}Nol<s_XKai
zv&9}#KoEH2`{4vRa4>&Zm`$iE0n!M73Z3vm_Q%Et&G_uxa#f*8LD`$3I&lVI-^xae
zyy!3R_+(Vf%jc{{m5E}~zZCtrN!8K)q<qzg*+VT&k~p=S_wMGjj8?P53!e76{3=*^
zBu=<j8F+koCRXe2RWjOrQyOZAVTmniDt~}dX$;O!Nwc$_=+)#CHD$UEyq3E;^ifHT
zDIJaMmk5tRg(&_(KYz5s!ep1%KyS$i*Xap2wDJ*j-9jPlI`5O3A+N=eZzyW*e;JL|
zC1(8*SuXmsX4v)pmeAU9ozBFe>b0>;f=>4jU<v~yp#DJCRhQ*jV*KQg*@E`(dkpW!
zKdr+PjK8|xx;3Bfs=`f8s{U8&R%+I4x{zQU&Pbc%uEn(Z*z=wIcuRkmmTJjiB+-gE
z{uHx+AVpLFWS>@rQQ`d>xjccn=z$}<jBB{K`j@0fIa;h(drOs&?LS5aj21o$@mEQ4
z(HOF3FXvxm8V1wA3hkD~KlvGEVUONBhj8PmG#|gzIF&MPA)!VunsaE3#UY6kdtX%(
zwFs^|n;kVjd8Cd0`tqw+Bk#~<CzD@Ta0#DuV6p?KP1UgAaR7elR2%FKbc8>rIB>Dr
ze!-%~<e%2`qw{;V<6`H2ikP+u`kR@Ov%v%`jn(*+8%iVYNN2WpH|A7TDxzQK6x!(|
z1m20hRPE$Wu+#fKZVUdaQ3`;0c}YBAk){e_9ez}Fis7drQS-Eb?DK-|oksSR2}hT~
zd|NQ>#63`EsmU#Lm6p{VoKYL^M=8!EFaw$7p}Lkd$&(2nX%gHH#Msy%RL^7vw_}~Y
zF!Mn8uP;N(*bJ$ct$T=AZmIrxC0@1b5~|H^NyS-JsUd6A?i$ya25f*4=XB5BqmpEr
zKk>QA`@gm{_S83q_L$a0MmOYEaavRu$EE=~8V!-Hs?HbA%@|fJ8d87d*sfl<0*j2;
z-wj)P^}|9p?;K+EL4V9Djzb-(`LdcwvJcRWpfyrdN)ov%yNJ2^s*PnGCEV#mIiRXU
zPb#vYePVs@b~Nkg$v#8>jnaC4$AswV>T{gWyeOOOt9$&Px~cxyG)r*%2Tk)=z}u?^
zr+eK`f8(7T=lx5o0nGZ|oqes@rmod5BUpk2z#49`c(gzjb}(IGP%_W-Wf^8Kk2S(k
z7hjHf_nbp<T}YlAe{nst4EtMtDfQP!2?0G_*guK=RdiNHC6O(7uV{e?*RMa17#_G@
zs=b704{R-W^{k|2?6;<*&gIT{jB-9a>#-^}n21{Mbh&SA3|2)bq&~-GohN&>TdTt5
z*rY*t;i-z7on`IQ9w`XtFIh2_quuwTKBjJ;xG3ogG|q#1pqvR=Na+Td(8sdQzirCF
ztAFA(G1em~+kY7P)33??2D5lO2^2XesRUlHfBGo&^j!1JrT)WN=atmz>RwLxTsU>u
zdu&#0YxfD?)uP11cg5XqYT2gtyxaTmhEHA2l9O-zUNf#MS=nM;MzgurD4|5fO57bH
z9S4Jru|2A@Znw^PUuoh!f^p-YZV3bnBnP4ilMX=<^L3j8k=h$ekba+puA`1MwzUU(
zkPly>(NA8^cvi@)sd~HSY}2Z!Jhj!fVk>FqDnqFswIxtBhUzZ$^rGg->coa;&*-D-
zxx7)Mz<~%O_s(>a%<7f5Gh2;`?w!EUeZ<7+sB2s~Sjk5!qBNsSn>&5*#5jAO!(;Os
z3D&NXI#qTL6I*Y;Noc!%>mX0n0U`H?@a9J2JzOK|WDd|9sM!7}X+~TBp6xOKd>$R)
zq#o0StK=8R!cwbKz&0u2LQ_hsik_Wzs;23r=Rwzaw<9D-c^T?Rc%}ch)-?MvtCpO(
z8@<Bjsd;F-!*4dW#<5m!X6ZLu1xAqJB0e35s;E4_6c9Y}AZ+7}k-Kl$ZN3-{zWry|
zj;x!%E8E;1ep1=ldO+g{WZ1{EWaCA~xI+6!`(=snJ3zfJiGxRik4hQ-H&My-UwqR4
ziKw)){3!TV^*HLNKNNK8ykvaaRA~q(Gw<}rpGvAA-eNz%5$Gw3{?S5D^LO>ig)tH$
z@ZI+#b`Q<D49UJ!<&A4tY5%IVo3r6hp&mNa^{VE|%g!;ot?HriB+v*W<8U=h*r`zQ
zk(GI!Bm486aJbe?^G^TwI3c@|p!X>{RS)^0>4-djniAh1--&A>_oOYHmJUfMJOd1W
zoX`urD~HTVnOYNhq3#bx{hhT@guD#_EIxYBZHdsQ)&pjx-gkTa&UD7ZuRUi`E%I2N
z`&L;Ai|}cosUJ+SF>8MCtZ=RJWWe2C(G1MIz>pg_OAETwD_Y9U)2j(vJnYc6bF-Nb
zLEy8uAeeX04ATt{;ERJyY(nM)?;g3(;hNM8%uFL>Z(!L}?ahZjSq4j431Rduk4@q5
zH<d1)7m1;PJr2scvTG^gfdd>3H5kD!WOW^WTK^11)k#ScSZ_<V7x(gyx_{HXX#Q{1
zuCcCdd9Ve#FxnZA6hf!^);vfg-+at{y&7i^<$5S8y3?mya41gK7&v<e!ww`CKgGQ<
zanIm&u5Eef&@mgH<Ct`A+Uko$EH76LGH#c7WN>Y8*dj1cL|{a6_B&KRD&Z*PH#bw(
zQzh6h!+z-F3>a=Dq9?h}W=;*JcgF>G{L)to7`IZeMm%McfOi{QkLiY@Q&U~fxOrA2
zjQ;KNCV^j@b^LTTuptJ|D)AYf&cq6;N6OR!Q&2`V+U1iRd*5h@+#eYgu4Qt>&=l2#
zHm8Tcz?XsoTe~fs5p|%*2SBPJV%MhSd%l^onmgwPD$`);M~E{^J(Qf!J>N|sd$zlL
z0ex{lcqa?3O{8>X5(gR`w7G~0**JLaInzj5Js{ltSCG@jBBs!NCZ&da?Fm~rv^;$>
z#XrgQCQ4a!04{S=eh*N!gnJxT4;Nnf8X4dItwcZaMevc<5tHXGV_lWMq6OW7ON%y)
zrXR74Wz_&(@y%lb&W+lA$UBkal79=B3)eV3W}N2{51YgpztJ}f(yTb%!-aN{fA1w=
zs=7a%8JXeYxGPsttHnAV%mu@m2%>!8&aYjF7zuxs^hO?q5;&fLJ~@I1!+GtG*^dfB
z+8=ja@c{=0LYh}Qb=;`qt2a#b`g$5mZFvp+i0AKeuc~GZ7F8TI8YnM#p#n8PGC2t$
zS3nKxndfI|kqWhG$|+vfpHc!5h&AJra+B?psB~BHNqnxHI)B^n1f$|B`JxpnAk#6e
z34L&FWIRZZY~1rCZ2LLsw|wK_$;Mq$qrAhq<1=%GVkJx%wWIhI&Go2q*IJi1^uWHW
zlk_)cEdhbontx;nX2#o3@(91%C5S7ksVj-?^G8t|BzPS3m|a=cag9YUFW9E7T9y4;
zI}*ADw~+djC;z({_q^C3KMWO-f6w*qT05_^7;;8}-@?p4Tkc#oydEA2TKRRBxs;PX
z77u0Ku%NW>*a)_UYuwz(TaqWr<cd``(;@;px@w+&cWqwznJ|oK$~-*<R#5_8y?|DU
zbMc*U38u%c57%$Ja@M}xWvS{9oeLi<4WyKXQ1i1=S8-A895*J73c@?d_7%nVwvvBc
za#(;rtB|wd`#EIJ=>E{#H9ebvwu6!_8qxPNu;m5L5t)t-VNq)tCFD%TM_o3TH#}r-
zF%_I{*};Cm(s!zMY`CB340H5Zu}P8#z#{KFL?VtwlzHEQ{nYSBn*j^x9@M>SqS6AF
z8*74FSW+u5yrz8xs6v9+^g8=UOh4mzr+GvShvRvA;)ViYLvQq;;syAct>{OnQrbg?
z=9Iv;7B!{FxM6jbVC%4=@&k`HHv{Z@7Z(lo9cs1FpRUMV1KyDnSyDaFeWLj?=?Zg^
zmeI}Fx9T6-jK032YK7rJw2ktfZhM~yXP<@{s<FH5%K(;$OQ7`Y?bF7F%w3Z;ex(<4
zcn^N+^`V%NCj``8=ON$}T36xykws~VOjs+DENE#Y=?AV4NT*Psw8txsk#|BXU1VY0
z@9W;*kg5pEcGlNLe6xqR`y)!j^A@>2Q1ZMtZ8^H6oSquVS&GANO2W>duc8e?D<f^C
z^Ca#=9X>v0uHPQB-a6gdt&9Z9iRJ<R4hSEIs@ZT4qQlypwKtA>IXEadHI%0j;vRP2
z@DGw%4V%?5pe^>I$^g|YXBhjyIBj%Nl_uQL=S+;7y^oC_stlS{U4bcgDO<E%3CN~C
zbbbr#N@&b#fgKU-rIvTM+zTEQ&{GD5w?A&K2t~z%7qRgJNOMjndefhCihm{i9$j#!
zXDaz3f&d}AvskoGk3S86lOm7_2>iYe$|G_K84P>WdfmnkAz&IL1Faxolz11*V|L1f
zS)04_&}e-Men?o5^|2=JOdeJ6E|t$5b&Cjjt~=}5s^QS^I?KlrMT2H);>@J4(C8Wa
zHA{QiconvuE0vX#Dd~pAuDm3(4<WhRq`6ykB=~~0|7oP$38O}cblzDXG)HL#s}SC&
zrKkn!bSYkaYc_G0z5#LPylM5oYw49=oX+S^Dj8FZm-+6|i;I$NpS~(9E}fbKi=GLa
zv{qBLVvIm$Ww^(Fraj-KbW;*iJw1|!Vr^{>w~m}Y;W%a3%j4Rg;4emtHAtj?WC*nO
z2@zn@C2{`EeRPTn;ncBSkS^^|MqGbvgH%O{Rl2#3Q?Xt_C5Li(1v;6lMpYu3P^4W7
zSzq=!aEEWIZJp@rm{U0|ePweJfA6=zpC54KLY15{X;;=<n~(<Oi$<0JQkM#Xw9F=q
z%^&6TX7Eu>i8)cRdiSkF2X(ostBR036ezvCinr%^NjptgiI8Uqh^TA^31ZnP9t`^)
zQ<N<f#vDKFWj$=yzwV8q<Ck2|f3I9U8v&m>)^xIpjDz=<&G!8`&0m>y35>~lJc}?K
z42timRB4)q%)+qN9^;<4j3J8jmPA=PKy^ZK#3)Cs*{`=THE2L3T^Jmb8_>?Xmo~!~
zcLnPuk8or%!|tQrZKkS=n*>W+quUep;lEaA?6Dbu6k0Zi3n5k|%7e%4D{9t|V7Sp0
zociUAb?9Bb8B@CuvHz<`df$7>p%d$ovVGIV-DQT=;?KB(bo$0-Ek3LJl?M{a4w~k^
zqngj~qwFoxh@;@Yn-_T92Cm?=L{RepL>6CXHGopJ0$Q?_R)JQ$r(5fRecKaiwG_1Z
zLmVJt*10)^BQS4!FXQ&CXa#m8HPl3Q4HVjM-D7J9ZHpQfM`CTnX9r*gQF!>#-)kLt
z{eB=xa;h{k6l%ytD<FvLsn5^J8)8}#j#<FPSh_BgqaT-&KcHPYqx?ES-dmgt$o*di
zCXmy74n5kXd3{goSN|FMU-3>+=u0^p08Ld+*Tm~dHvzHk@?p<J*u9Jik1JEMEnd^I
zf`IM<{41RJBLZ#+Tp$Sx{IPtc<=Bdp$u0dCeqC7Koi8Q&i_-rkuqXzgGo_~rBS;fP
z2(u4YtSg(ya$d!}w)VLMX@!i}uuLUW9!fAoF>G#RJj^^^fFO2=LPfIQOcP2Hf2Jnn
z(iC6OX6KT^(7AFT1l%FfTtrZFbtdO(s6Tmu#50nR{MB3b!g=qF3sjRR&O2evvzqrO
z`wQh(6S7NqYY`h)@MLt)^6;anVy0-%=qAJgNEdkF4R@B>J&;$W`n(bjX9;auL@TC#
zg!HAIwOBow8H}~A0p8mU>d8D;K31?^?&H4XQh;Y2ksS5^R#WykrLt=KP^MPEyLViA
z2Wme?MspzNd^;^tonLI%t^z#S-sHu*oEhGAp_v;<D;YtaTFk7vSOme?-h3&iZ-fc@
zjUCFbKJqBJ#LiXkqwu5fT48Tiw#`z9J%zhsfpSbYwecTb(I`gSm5_Fnz<$8?xV9bc
zE<vR&@1mDoemtt`1Dm|_T2QRdoPq)n{>G;=pD;@Z2|>GGq+}IFv<T4jtB|KB$$i@0
zpGl*!nCoCGli<dV*J@j3RzBYXpKz~ByaF;(#>yIiaolrzy~h>=-;ZXY$-SQlA{N}#
z2e#Sw?>+z7c8iA1(xs4{@@!=5R3TA8Ir7-h;eo%I>z<N~w6m<R<Gf^ODmZytTdTZ3
zQb9S!A9!g%vzT`Q*oc$J3;)Ooz&KHV?3kvYPk=1y9Vu;%_{2pOn~~>k>(eP?+STm&
zZOyZ=TrhrSnrDAZFT6Iyc^dp3w(;R2uFj?M_>6uMe`CK7K4z#M5wezo6!1%c@1x}p
z#wlFoc%IAMj~OD87LdGe-S1a4J5ohj{|;D1c!yUb+7_JEw&ffct8Qu+$_M$L6qjG5
z&txG!ybyuFrd^yoR#WX^RC8%!m*l&E2Y>!$(xxDL`7bf*3-fN3u)4FY`&$Q;lF|Rg
z0>Fc&fZU8?V-tRA)Qy(&UMWc(reY??#7zDq-C4Nv<eU0llgICrs}9{tuXZ=BDU3iC
z>Ul2ZHLDjigJw&%rILsNOS(%s=q+}x)>byo9K!j=|MclP#nLhzWLg0*gF4Ish*5G>
zEjAuBv!B9!33?F?(*Gs)Q?`EgTIFy&;&j*zRRz7vK{NXSEK#oKQj^A$nOl5I?ZT_{
z(z}EQn(OSnxP@+I>g&i$l@FX_qWVDSZ^}Tw38}Tip~9^%c?K}YElpI|wn?LCw{oCU
ze4x_`H<oU@)bzKce_Ak-tX}M3(T#Ohf-(Da2n(XFvX}_Fy-Pz~{Eb*80@5aU34`R-
zE#gl<rCt=J=LF|DQ{n#aPf>P?X1Ei$o)hi6=JaE<rv_L#k&6x4&IzcV-U$7tDUob@
z)$Z|D8+ZJV`9^4Pio}>!Sh|m?&UM^o-ONr$qP%EJ&IdvvqlbvvGHv!V^;es%9}_c{
z2G`DDm)_I|u1mpkbt4#jRUj_lYO{Ys7PeP1YFmm4t))2n?<B&MaS>~Ko97e7gtMJv
zysofq90!E?HoTEHTf6(i;WJOLBUE<D&XiAoxlam?zaT<gr*LweYbH-`BL`9tJak13
zO$U%c*M^;B|8D*+U3p#=tKw8}I-~DpEXt9ekv<o!zHx_0NL96No-9$-{%UZcpFCG?
zcetAJNTg>>=_Fxb!0`f(S>Vci9cYINUbOPCcEK)&Z~6v2sYF`X!CNiJ?3ag`pXng;
z#?i6fL&Tg5xJduR%bz*(DcJ5=qJcAj_m;Ky#o?IGYQt27Z;A-6(Upv<GS{DaUwK2v
zH^lTVZ|R#Kv%_e-yVouo^n{73x!77lfhqD11(G9L@j|G_;S4AAO2#>Bb!LS=!={<?
z?QPq+Gl}fMv6A3!D1XJ>Ve<2;D7M!d@@eX@4#&EFAmciv;WB27qGOH<y0!R@%JBpT
zKQJJ3Hk=4Eer$Wq;U4ZP4lD;h(8Pd;vtw$s-<LsIJ7)S>b*?WciKIv<H-0vd8N$E7
zcAZdZ<TFcZgI=|7d=Dh$iuRDP{KUv@so55}R(*J+lkhD6^3GItGK|U@scf>W-#pt)
zLq|@yJm_6djM}6S=5ge-R^GOi!=%`ZejMntxeA&P!o>2Sajc4@ZA@!ri=|=7+&N9>
zwodH;t|$Mx^iC&HH&cZ#>ewqrD{4Y%P}o6)U`}FSwR{Oo&?e(3Loj3=)%w%lLdu+?
zj^%`B>b6lD1F_0j&yaz+kTFR@7oX~+wf&Mrn30ZnmXj9w(+<_`KdZ&(*3zxJjpUe_
z*(>_(uV&6@-b!Sx9SB$Qk{nWUZGG!%t6QaHa?qK+hdWQOw4~0rfF#CLwqx00LhZ4x
z9hHBRzg4!ZNi4=Xyi;;MUCnk)=uXQJrV0??kx#?U2oT`i0*<cW(9(|ig-pua+rFXO
zv2}F7S_OK?uHB}MiOPaa(uz^NH5ZKz1KtziGiQy26T4p|7zR!`_^aNrA;`EU#Qv!p
z{N&m#dE3(-5?`A<=GDCXA%>oH!{8KFzpLf-qw1=H@zyMkhnSAqnVNj-DW_UNEPVO#
zz;W#-*TxVzF^RWqb&h#r{p{zFT+S^f2h8&)bx-pIo2d}kpwiIC?`nU`3`^_F-5k2&
z&=6UzWVF<`9FRuoz8~XY`RV)crzz}Q-nV(Jpn#lzI)s<^$T51AiQHt)tucCosv`7r
zj-N<<x#Prz*|@rt9I2sRu8bM%#IZW~YSW2deYEX)P0=0<v>?#^v5A4vpLQ^jw0M`W
z2dx($``eAaXfp3kwom9rQveyVCCV8oQ}u4udS?#m1DRj$6(t_TAfj*KyPw69rlgY_
zsx8ApKHW-h&@^V$9QKOG-_7&+Bg>W>mJ56c-Xbl^RG5op9#1(^nj!0=ToX7cLnz7l
zP7@vjkTRUe%NfG6xgRgdh&mUY?xZoTy9mFOUQ($(ZeoWJ>=9iBq%<;3!lkb!c=ATf
zg=nrb-j$md-Nt%=ZYzg*f2wq~gU=`^N$?joMSh9fFSg!fyEEo))=&m59jZfLALRNq
z8aP=bNnl37j00Xy`N%nWV9`usV$T<z5Oo!S>_wf64;;?&n&b}OcX)E6(R=a03YnZ*
zd?#vMr;fdMk~!>m;<zpI=E(3w)isN|<H|l3j^{)icRwv9<w*nH&+34ah~SeMkamj8
za52>bLmZ^ICdnVg#q2@f>S%6doOc)*k&Q3Qc}yTqeB{>n!xyUk?^@g)Q8ogHJIFa6
z!^BD`6}6T)P1P?(sj%`>8R~c7Lvzefv`HB;7;Q+d8MmHX{rH$BO*jkNMz3}4-<D)y
zoYz%@Xe~?AJMpAGURZp9*Z}1B&5_dB`-~HOH{t4+6W7;%MK-+LGUrvZC!lNkp)k~P
zdyTeoE7X3X(sj3V31PR+imj@I<KbO@{xsd)>&46#{DMb2vJ<Z!=$OAu_|p8@JUXc!
z@H557`es8{Usx$Mxe~xhiJPAXXRC9%`t(<>?CLlddSTFu>1j`Ek$H5=@8Ka}G#s<3
z5rmEga3#4Obw)Ml4^j8Wmk!oa!1g}j^$pV-CBH|vd`G|eXLO762Pj^Mc};%_%+JS-
zP*xaQNSqrZY>pU)yNedAI(=!U1XBi5{KPkcF0nVBC(7N!e?{NYPZGty<jrG69-^ID
zADwCG?3PkEQ7R8&MuCIEo3DfoJ^mLvaOQ8N-68GNl`hw$)-ia3Hu!Uqf{na6EyUZg
z<KV<PZM)8uBwI}}28B2qPMKsU2JaN6AR_VK#fG23Uf{35sq29`QO_df?|!!j{vsA@
zCIh#@9|gt`O*|A=EtI$U7dI=)rH^}(X&99Zj=1MDZQU6{4%izCXa%8vg(VVQ)?Q4j
z{Oy-By?9G-2>`8$vt492Mm4+PrsoYn{|e*TKbHp33WTlcTVUvGn*4w3Y>MgEBCK=A
zt}sB)mxVMmSaIrG`DM}mWUft@I^mq2p8XEKze@~^19q2?tHU?xPIx5<GmxYwpvudO
zO1ECc5`@~zG!(;atv6^d>lQnj=Tw{Y*IpojgTU0R;7O6~ml;O3J<%k6JKNSF%(BOJ
zjgjaGtUdgAEB>GL@u$!4MN!_ReWQ(3Td>sv{=3rMd4(i8VZOGMlS%m^cox40Qe*=c
zU31dw>uP@{T-*MT0$h4r{d*z$WA|&B!J(rjM?HX_C%{KZ*wb?YBG)<YrWx~gG+4X2
z*GT_G_zUKZJ0)SHm*@=P$Tr<1!Q2M?cZ^#UMmT&7#h;Ma-W`4&<dwzy8%_H}KI9sf
z4|^K+r3+Kgf<HGofI!S{o3dOq7&>@K!MUGZG+RrwmyVqVR<W;u^B60TqBY0_cVSgy
z=Non!KIHEwEjZDrbm30D<-LurA6i34o?e%Il_#+$P<{}#s=Jc>d7ER2EO(eokJyF(
z4=p@(&$kc_vHjD@>0I!!tnS?pa~1W*em?<Gp4Ie|OFlc{=$*^XKeg{Rm3ZFjydAmU
zpPH!=slF-eg87gv$v?@wuD?_ed4|!=jZBRw;3vcI0H&w2`}T8~o;~fmbGu3qze#^v
zJ6x*WPjFj&)HUEwBZ207j<ID)j^`Qi1pfdJ_&6lYqdAX>3f}BLxr?kp(sIbQc5-@%
z>b*>f=jn|o5RX;OKMUtAz*2Cys;71y$tMI!u0Qs)?U~A6%@rCML8+3;p?dk|kzNE-
zP{@pme2D&UI<!bSVutYj$bIZSYILN82`X4CJRl=FGVJ#mb|d#jGqjs2uF^palmK2b
zl-&Y31DG(^lQrX46TVCXmIa@kX+FTVbv!C8%!UlTNy&$-NpAV+nDLAFEreZMLYgou
zdj9@+gVgi53}J33Mu@pVy(XBN@b5+beRu&L`E>d#bd!1k2b~YgBMN>*aC~o`2R7TW
z=I(!iDnI|dTSG&GI^HkmWntjx*Kqnn-?PEXSH_~s7Bi`W2~W@9dK)Uwbbqi2={hXJ
zb?a1D&4%uQN=MoI#N%xuozo8vfS#@j8`Yi>-MT5=G_bX(KZ5k#-K|4S$W@>E($;hz
z_tyti)_s&SF|rluj5Pm)+1c+#jKA`wzd-ac^bg@}neZd+kN(UT9TZ*`8acH@z8Vu{
z0W5(JaHISxlXw<|9_K{L|3zp?+{&*lnhUr)Zk|my5DQs%>T+Sn{P~m4<SkZmzeE=5
z<jlL#{){$~dEZzI*MR3I6v<3`<l>~OvTw^YV?j~eXQDu5;bl!0=my}YG54il3$wHB
zJQsSZHD=a*=1Wsg323QswwxYtR<MvzNF@`{JjT;G^PlP;0YiyFmOvS7H_bVf<PAt1
ziE0IZf)9e0<p&~4Ug%~FA(!p95#Ja}YoSF`zB0;ABMzK@vAmxz?yg@w*Mf5rOJ=p;
zvB7h<G2vgzM(%$9_>FL{4b0o_ze&wDkc@CL%`LzB(OjQa>4(qY#Yx{xED#<PTHdw&
zNBAFl&!n%3=Kud4-jiP0C8Mkq;Q4RE(&psz%G(o*f;_vY5ywRPa~70{xj+)Jun&K5
z&8=VkaQ{P~2g*RJaQg848%a)^?*Aa|&EuhdyZ`Z|l7uKpw(M&Z$-We_?_?V!TXqIx
zH%St*jBT>ZzLR~dm25NieWw`PSTY7NhTkaNpZ9&=eIJkS=lA_@jMszfb)9pb=XuV#
zu5&69qTU1pTSI)1HjLn+qwh((Xe4=AC0#;g?-ta4QOA~WC#Tw|wd4DvlkQ3|v$UH^
zKsmlKja=z+0>EP55ta)cYT5lsj(Zc})>QZ18!mo~^#1fW{mj30Fz@|xnIMhGi{ZO>
z^zx(qojW^LH74(i_FPL%se$6P$OJ3`H?lB7w@VF4h{uzI-wn{YLuFF0RQesp+#Imq
z{~l50puHZdTWQ0t9cv#OvnGKbZua9N%TpHe&LDOfaE5f<202=j9{tI`FcSMZwXOHL
z4UJ7k*}z!vEgL3<PA#Uze>KV~=NK{9sM8p6O)oDR*IVZXQTazS^L=%@4SY>U^*Hht
z^d4V9q$@EbLCwtSZ2Cj~weu=0yMlBH9z%_0>{gS)kUD`>1s^BCw~PF~Up_^;he+JP
zFC<MSQ~HG{XRXw{)SZy{J0ZwTqTwi$c0LQ}a=2s)|5&K0LRr?>0BS`%&CRR#(QjD?
zqWi=J_-p{Zb&c+Ow;DobS~t!2m!f9a1}hRkH-9&_lnK7}_BG1V(WY{^PC8Sis)yEg
zB0y$X_9ial>us`50^I*fcmCtyjF{bXkOZEuN)gs)TaO29;9zFEOo)|Q$8m+Gzj>mI
zZf{-shW8MDwham>YBm!=w@KJIAKYkJR=dKFXG|)`xQh+W`;3^&J{KfoS{Oc@^n+KV
zM~1-Vc+xauHZZl~hym@cI3DugJRahxe)(^~&Cij~6s#>2qSM!67|+~#I)_iPB0_oQ
z<JnT+Y8j<9?P2B9fb>IOX6J0Hq31in8DQxV*Awq`{Nyq#ux%)Q?~~5q0*^CVBp#Cd
zO9|v!Dv0ltb@G7PUl6vNtOOll2&T~s);<hJ^C9#CO$6evrDPa&gQR5CAwzc2Iu?e}
z`ioTFLQR3LHxKVf`=6^ls!L2GlKyEPqUxM~Njz>+klUN;UwlZ@@;t{~hd6gKM7<Bk
ztH@oecn0fnLT7B9^o-o}He+906b5rT5yKrvhNorG<dRI34$u|GwhcxXh0UsCEnK%>
zVETv`B*1VwfY|J(0KPD%$%_RP0|$&(?qY8Gkl?<!UF@TZ-v`LIWSb50^OTthI9X43
z*Co2TeO!0@2$y&MP}^_3QUV|1mopm80{qbw8e(2&5=5vYDUI<w-e|~qcUj&rJp1^D
z5GW)4e~m8xp&_R~=37e2WFz14Jx@97vd&2sn3Qzea9}n%zO}+B@VaQ<b#p_1ig-J`
zY_11Jxyz6EX(ha2X>?HUBtbt0cbSl9N%u3>&&4T&6ABp?Z^QU<04&a(wCJZ|;*Y^a
zrN?h(YPYC?#wI`n?t6gw*hkcO+0i;RUS@A*K5strEEiwVz~qe*j#!gN8!y(}M%GLo
z(rlExb!CPmj5t0!!@;;D8575dl&W&2$=j%k(n-9b^ybokup0&+^Ji<*3&%qkx=E#0
zk@$fW0~h)kSEBAT1O;%G1!Um&coizx(Ylg@USs>&YKEVJL)9VmxmpBpCJ|a(SU}0w
zW$r~vSg{<;^0cSsX|Mft9oO~ifbdqThTxemPI|dB%!3sJ>VJG08*~4S!r0oh{*+k!
zCM5-EDm}UM6uU-pPtu$U6a1oZ;i;%C8j_aA<2N5$I>*G=NrZ;rX9!6DVql*am=;Ux
zfJA0LpYNCZj;Eu?8S9`S;vn*0An^e_&|*Yxu(KoDJ=8ZEaL2RLM0C-q2B;En+T8z^
zuz3r*(#!=BMSGehn<-Flkj=I#Y5Kzm@C%#O<u4MuEr-8V?6Hk+_Q0Vya!r@&`VGU#
z1(!#BD~$hppY%Uk6Q4!&wkoBl<JR(74`}oq&9aoZxy+RKF<!fFgt?(U&5?Z5;rIUQ
z6Q8To*Swy|UDlTxq;mAij^n`xG8y3P(FP3pp@JyB06v!>eaM6>Pr+R~kUfr;Zdb~w
z=*TG~YI<WTTlQhBUs%HCh2%>~&N9gi#zFGckQFA3i}&umqi<&LW#)gO3Mk~Cs1hbG
zqo8X_Spdx`A&pURvC^n?&$il7ECk<f_ajKaYw#&Qt!?2AG6MnMG~VHF|13@0^cw%6
zGaUCw_5L9Vh@?U9D(tayR_(x4+t3t-|8UIVkos3((kH?HCQZJt_emeKbf*Se7x|xX
z1zN5WZwZa=_zq_|`>KyaQYG6eO8nN@^yk1Y6b8cp{yYyML`BVnI4|ny>f4(>8EbMi
zij{cu9Sw3y0xH&ew+f2GWKE-?0L%^aEBvA+rgl|v7sZ29;nsfdl_C`t__LrSdC*n7
zxjf(F__YP;E;pV@@u0jPuTz2w-h+q_xJ&)a@$u7X*yK}F=X109M@hCT<-gX|AeW8&
za*(S<`MXD{%$l8Db`uw?33ok^6`-%lEH+qiP!U!w`7D@_4)cj#RE8{?@Q~ntM`8Y`
z3%42hHCtH5rsa*_lLK}jGX8iI?x#!;3Qt~qciq@><V*W2abEk<UZ}@&@_Q-%REAH;
z8&h$*s|AtCN7=rjxB09|@m+kdi4c;?UqLO4ZHQ{iJ^Moi??a+#L@Pb47RCbZWCT$(
zyuf_G#|WH}0Wa-c>uw(e^ZR|Y9~a6ZKeERV9)6%ZB!J0o!kIjuoG{^^M|ae9t`MHw
z#%a>w&W(L{5kiyTZE*~4J@&S$xSo;Ztbr>%0Wy~N!=%x!e(cX7tdO>uK93`*$6(>H
z^2ZfL#L${FZs^_;qFfhS5NQKf@cBX@q0);#wzT{C96Bc6G_$4OY=wV~FpGIL{CT`e
zOU~S&bNHC^su^CXsBt`I*i>gJ44Ds6Q_$=qu%&QWShJkj)0pOL{9~2gjIU=OJL|>F
zK4yR@EZ#p^Ci^Yz3Gz$gf+6eOoiB9FNY9pe?mU%xM!|hnA)&QL3jPNj|L?pZ2_r+Q
zj-cB7@MPyK&LBR2su;lTmOZey?Vt`lhvZL^2d!<z_|bxUrJb{H!VO!Aq&gMQ;buep
z-ATufPB;}#WHzH4fSvR{QLa{+7wB22ts?>+OMgheBJGrIc1pN|xAe#FwhO(pkIM?#
zqJDKM*Fl5@c;1v@vr`g8(D2ek<|Gr0*q#oaX7WTvi=WN~R+ii>XuE!T=k>JzNZ{I?
zjFxwmm#z@lOS+IM<HNT&*<Vw}0Qmd|i(*;7^a|rBbdqbG46S8)AoI(pVNuWlW8{eO
zj}YmFD_D7e)FCaNwDc)B^*5}TV4RM9pvST&Ts9}4f2AQLwrIr{&9WH#$yY*Pd5kM#
z82iKBY1CMIz)(vp4o_%CzU4jPIg4*HS?*$6id9cxuaJLHWDeWLE;0Xs@zx4|DA8lH
z*Yt-(xS(S#Z~T}lCA{l@YT9B+_gUmi(pzh~oF^lgzQ-s+ypYoaf=#)qOg~7R&Q==^
z-?>6xt7q5HPrE{jd4gOcJ><Z}9ve2{t~d1UNcCYQw)!~4@j+I~pE<C4kMD5C1Toar
zw^RvYtsN!b7j|~96S=*L>bZ!gE3Yt@@k@Y&&pa}P^YE{@Vnlo-wjYPN@-H0U=u;Rk
zKu>c0q)w1NLyIhZk|O<Y#C^(XC#UI*U!ZaWR2Z{y18rz<@b&jsxPxr{&?*31q}_w-
zzr~Wla@PiHrB}1O-NtU_utxN3k!|~&?gt9JI_YUf6am#i72Wm<`DYvf-)F$B<$Jy6
zDXk*pxVHf*;R~F2_K+41?5T@zr9GWVI9~e<dkOlCZ=7`f5{R%NFhEYaw{4mEf1WZf
zbftwPYzLmrjnX9!1T+^{UaFEyVi}}^ES+b83`t+XB84TsDP<G+eqo{(FJbH_@s`3x
z2PjJOf~9%gTXGw}tSNbYsf-5IPNQF+rJs<avUq}@ssgGWMADokrFcv<2Bg|Az9XTG
zthwmL|0h$0AJ{=@3sa^WdBJ{$sR~AW0in6gwYq(egoFfJ@@p<t5p-<uKhRlbF_AX-
z!VwQR<pVfE+{=K=H4VtosBs*;ksp~rvew~bQTuUfd;@07SdMkuX?}kCljHhB5G}4(
zq6MgnJ{r8`L(ufn^ztCdJ6alH0jHFPy})IEjFb;Jca8+)yg4b!eAhm__x!IM)3yBb
z=SPFWI0UjJUB)^_5~w~7_<83LRXyt1*wMx>#w~~(Eqn3^+&x^hqJXhrn<BzI^r3Bv
zn624}lcv15V1!{gbmd!9INR@?oA^m+M~%UL%<0HDjbDKDO9^Wj?rlkbM2sVWlgQ@?
z#{cm(8rev07wxRjvlg{#G73gDEv!0(dvae1PQ>(l3K!U=S3?P0A_3oQ#M|#kcSh}=
zlRwc)kLn)o`$ZBCiGU%~@v@t@sPFR)g0A6p7az6Kk>50y9^6{-#54@<H$30BhuZ+!
z>cU*DxUp$#B0hvofwMBs8H`?h^RQ=|lGOcWt78}xY^;o?mZM_>PpM6x@t(m4_nm7P
zt5oEjJSi?Ad;9sd$v*cKccK1~^hG;`)^koj0?E;jPGqDr7>fp^?$mZV3c>F#@U@$~
zYq;h4?<DN=W`^`Y`pD1e*VD|kBb>FTPu$;pJ{^pM_XT|ZQ`F28TPK4g6n#>PU_VP@
zJ_uaOjRqF$MR5o%g}d(hTZQ@Cf9DS0S;s32RJNX>|1(E?%D<GQvzL$B*zEZ}&w|tq
ztdx!vh`J$srfoBGt4E{FT9E(c%qOR3!sWE5#<It}BjJ-XrGn4&bzm0OwmRZVZC)_;
zkxB^b_PP=NkAzgStsDal&p=*J=2PQ~esW&B&P@?sq74**WB(~#(&(d-`q7oc$jp!D
z`<Xrjd-<$;w|Y-!v|BMST0rrFw^~O7K0@7)V*RIyQUM<t|8}>lefJa7Emk-%*AJDJ
z0>1p3bFSPT@78A88;_E~6B&F`73qMX`R@(!Nql-@C~f=YHrb@>{~H16C)CTt^VN5Z
zbiXY#L-{h^A>R$L8g=O>R9ifUXE!TE|9|PQE`;IEATVB}a6t7emUq)pB(2&=kGZxR
zoMPJDOz%2YT}G5G#7^mq_R96k&Rf31_%j>ji4O$={qjvSzMjMC_+ah*J73Lc$Z0CV
znS5xP-kGZJ5uNOu|E1~qv-lZ3HjQ0g4VVSTb#~D82E!&$<s_E>Ony5OWrSjE8=BQ9
zkIB9|ftfnWGo)IMo#7a)sJZ+<dOk1mYLyg4Qt<VYi8v>Azj{IY)2V33rnOH;u}701
zh6tIz3`jNi?2kf@M0K*^XP^52Pt26=>bBk9bC!wUN+<fd`P}nkLtAA7a?|YW+o+lS
zNql<UYHfd(d~pb2QG*UVgVG(PGCV$BNf~~@e1?zLUpN(N$X(MV1ns5^J-cteA+s!J
z;GUBwmd3@nN*vO7<8-#Y{3jomt82eEt6v&!1xD!c`;a$<%*t+k0KZD_=#N_Ic)q4^
zNRNwL*2=N+-?6Yx$D>0AxL^96)Q_?vJ!xJ022${3l<5<^vPIy(8X#XG!nCU5WLh%J
z`uVN*NG$O5z%3Vi&6Y-5<V=L|*AxQ`p<YZ`M3$S>8JjrO4kZn-gbS`g<bK_R<meAR
zL0H5RFD6pdOj@&*Jm3k#k^N$p2#&C{?VH^qb@Pw5QuDFXe~<rPA;1-)MKTyq$TSTu
z<mi-jE-?S1qq43TLVR2~(utoY7;e&9O5;EOi(w%9$vf$R`eZP{LvnmTq|6GIGb*K2
z5K1Ec4dySLt`rc&9GcTeYF0I~#tvhB?m&9H6X8rIq<up!_;OKn)UeOnUwaT&3V!yh
z{Gjtx0c_A(cNevM(Tj;6109@LeY`LH3%a9b_<zw1yhG#m1iU<x*0}BZ15iD1!~Fx6
z<4nz{jmmUgysbj3B!q<678b4pG2?Hq(lNvdAI?>c`j|0}t)A%_!DTOE5wgpNf$}&g
z$c+3&r6|9SC|>RHgG}F(6R$WI3S0K8WDns<@!o6W`<RQMbXSf0i&yae=7}@4hVxL%
zidp6AZ-p|m)k>3&zx6DyKV+r#AcGv@w&*9-DGEwmX2CN?RJmtOQ_v}l_3a!>+@_9y
zFo<4Uj6>$rMYK1X8W8xBlI{+U-h|XoR{Yc>s(LGXhWBX7Q_b@;OmI;gCFdK3Y7yX>
zJ1Wqr-Y>hA=s<C%Y=sf;c8G9U+8g#cH6%@;vvSUv!UGzip`f%@FEX{AqqL%?Q}S9&
zZLmUxQ6|_`F7<i4L$fT1zd9}QyLiPxf3QN1Avz?)nU_Y%4!Es|V(5IFN>QTwyAki6
zjCiWFnX$8HCbXi5<7&lr0Yw+o!4ytqGj|J0N+1_WjB=O&TT&^zAWX#AqHz=%B4cfM
z*CW&+wy>i9c4$5>;Z1b05d%a}-%~03KI*wB#c#@`dGowl1e5RM>07|jAN~B7qY3fg
zmcjUcnR5OUul*}st$EQWgB6mX@FWt^x$?f_vx+z~N)bMg53**6kKB7o9Q;^7#9j6K
zwo)GqlE5A+mn7LyF)?v6&UX;oT;QM{&!b_=sh=_uKLWFo<a)?Db*#}M;o+zJd}9N+
zkdR~LNEZJqdmyuV`GIio@Hz4Ap{O+#6?@l>qAhUDs`VW^f5_@DFj$3sA(BdxDGUhl
zyK_pJvH*t!4bB=eT$1ZF<R4C5h!qA1!wBGIrlX1r!s{@K8b5sf);^bH?5+e8h`2#l
zwc)iNm45SSx^f+VuCLwy9ro6KPrB<L5ba}WV5~^b4%^?7d+@N;d?GS~4l+4uq|xT#
zQ9W47%)=Pq*69Wimk5cEtvp89-XDlBQ5CAl$x=5eX6nhN6M4v{0rShM-4tW?Wk)T(
zspao22#ZOVpn>LH%Cih9_2T5#s=fkkq|p66st|c+zVYona$c%t2HNy!2*fqC?K`C&
z_}I*tlSp>$_3y5VXDQM%w>+XM(_%(E7Lsj>tFC!y*rIEwbCJSb0H=LpM{$HVzUue<
zv9pKIG+mihvtUP2-ot1#R<k2ALS$c7BilAFCpY&AYJ7M&Zdd-@tX7~#oZwI#(6SVg
z+kR=_x^6^-ISu2O6D%|HepKgo`HfM1s?k8eiLFzNJ-_KHT!@XunJxy)Koi$+y%!;F
zD#hDZV#0}{_DU@<Nrbo1ltSLx26u2x(OLe^t-Hm)+&!-hHWXTrkBcmh5!w7zLtgyY
z%dcL)bg~4ofP)y*i)vq?Uj6N*t(Y>TuP~;+H3YY^Sa4rc4d2ZR`g+5ynM0IOZ~TCj
z6ylv-@s=|FFXLhFbr4_ZWvQ-Jbc{$;;4VGUEIi206uXPM+!Y(E(_1n^hVY@$>)1{A
zrMZ0@v}H8aZf>}>0(AE-fh^H1TY1QcvioLHjwxGqQNqwOt}v`k?xyXk^zG}0{n0g@
zD-dC;<uvmNX)&%f2gqb}N`)OHrJ~!FLp|Ayl`jZOhUgvZKq~4s*cZL%`WEe;KF-{P
zpjH;?v=MvAjU`u86p>;N%EffOUk5L|m1EB<u}2vUGeO!jy4hRft~NisBfcM{bmH|z
z$GEy_|L#UbK-+mY?WAfDh9T}zYIW(OdT2gMZ)5V{yZMA*{$|NiIViMvO|{MW@m@=I
zDK;Yi9XF8&Y1zW-o1#05Y=twng&rIcSG#)kZ(v!t?eaVtpWNhgh@0IcTZOyKO}CYw
zN-E<vu}EZB`y<%nF(OlG-hq6_og#>!<JnZ>|4_xp&sJ9Q-$lqHzvhq-O1TU3r*V7w
z&)>l-BC~zfS^W3UVV!|%?3!G7MRYS7jnr$uZ|JLv%I~tUxUQYoyhkoPEbi$H1P%fn
z>@@Lh@Xl4<3bDHGI1x9N$;^&=(S6bQCa5#-_8X+}bx<g-qkZHFcixn%_ZqYeu0|9S
zIS%4ON;PcNVL%TM>1I{hVlmMBm5B;ua7Ss{7)L=JInz<C0`jivJWqIn4mGUzEg~{~
zBev}JoLy{YCYRqaHO^W?%EKuf&?qpD6&7>RtT}$JxT*4!TRgD}Rc6=lfH9#3ywAPr
zq?Fq|9o7}8K-T5>l*atvn61MKg>$YiW#iW8r6YGYifjhSIC)zdfPRu}=<iBPbB;NQ
zY1I@fEsM}YQ(Gok#<q4U^)GJfko{<(kBgvJ1MVL1WQ)gaUiwM<N$NC<aYQT^MVCO&
zf3?dkgkyw=eh8mvVzF;9vfSB9<uqyQmxmvTMj{S{uMBR`hAgQrQ;FbuKAY1e>`-$7
z|6%~=0#k@p<tzk59x&5yP)xbPKJ7>j$#X|}XQwy|(fk`u{3aGJKNVjV*-@nDe&#6F
zlEvIZWZROLDSB5!b==iOh-t&Cn1$6o5BcUzc~v!=q(w)2``zW-rQ9bxJ=aoGB-lS1
zs7@MfxOtd1$z^HjnR4enj}?b{0G^n9zQgjZ{zhWnA}oEsOD&|St7#3>M65916x4yV
zke+0jJDD$h)`5fwFR~-ckK$@C&&^g%?@h@LHuyk_fk#mb0+~l)f_EWrZq)9qJc1p6
zV46VjWaw{*cSI^6H8yA1YE6A&ij@~$P>-&Z)W{(%;N}x8?);$Jsj6b=q((DQ-Ue!6
zVgI8V4%1p@5wnjE$6dYq%1ob<Awarzd363o0QGSV(#S4|4H;rC)$^6x71~qu43mAP
zym#ai<#%iaCHTmlltAy_ik@jU0nT_!0*}MarHUk9vX!>lWr|*?bD)dmu`H1m5i88Z
z)<F*sqlL)wi}2KwU+Ys;<aGQm`}$q<{KvL05eIS!k!OPwfqs6En`D*Lqfv^YcY7j6
z%fz0dk06O-&lzmfF7raqXy30)*O{PXCNAr)NoZf;ADeIsYm12lkbW!wy0EusXu=t<
zQ(oH}EyiD%NvNu(7T)WelHdWm=wTGF@ZLeK7p0_PA#kOtL4Lp=yVwUHL+BS9v+6sQ
zr&<u1`Rg5jA6Td%{9&nEbG-K!&|v;SyrFvLWUw4z4twe(;hg9I_#iQArJSh{V!2GB
zu-JF_yu#Zf51;I}ag5vHUrp$Vg-_T!XiA~OUlY2>W*xQ4b0~&~Z5GVTvXH!TTCQ^d
zkE6={W|poakMt%*Mfh+nQ~YBRC0QycD`lyZANJ^>eb7{c;c)}3$WY#ktZN=(YY2Wd
z_W>{l<~7tdX_`I^nW?Y~6mvexcQ`>lf+5Q{-Zk#7$^wtONU{-(oT4DPng+TAVSeX$
z`?-Kjx!WV5ABk!FaODy|zTSuVW<D*IydHvNb*RA`+jEK)uyrlaK>bNTi@SGh@m4-0
zm7iX}zO!^U!K{fJ!7pj(e_6ZkDXW<XjG51v3{kMBLoXcJ7px||g#D7++^p_jHLNRg
zF79mp?mxwYKaML(fYb6S@d0a>oo~BZ1iMwcfd2SxVGvf=v;W!Gd>M=pUTxnVH(jm;
zJILW)W!jrFbX^Qm`yGA!yC2j%cRq0$a+7t*8=XAYH51jfr+)<vy!#1Rc&<)I$)<EW
zlo<8h{j(Up@8Fj}!>tYu$Ea@$+%f2{a;l6K2?o<39|nf)Cl2mV``#YA62F|*wCj16
zmUE8|X3L%c6l5y`U~{WaIW#&W^J1>Qpw(xkPw=qofX4$X8=1Gj!%{X=;R<oGJC9fU
zLrd9is|ifhWwLxLFV@J9|M4og;y5K3Jv0<g=!)p>O!=nx)d{>)=KwLE$gM2MkEe&+
zoby<Hy-4X_V&?RbnPsY@v>`*k*UY-~KC6kn?_z1a)IsNU;tu3D3hy;Vz(c-n^#^<=
zp0E6#w`N)fH{UHfeodI(+-rRDqPkchu!fep^8nm`X8^nwJ5}uVy~2M?E0My{P(EVC
z6J7%0nQaD$@^X+33v(VL7UA(Gz+lSwa;_=SbkfsZ4d&<{m|;&gql=+mBO-BX%2x1y
zYmVxUXc1;AVi@N!qaXHA@9I6)LRJAp+7|tpEa{?nY&HUva)}>MVW1T5q5q0){@oM4
zd70)L+7`oq?)lnG_+fKXCb$66?F=KFTS4JPI;}VQn~0s+?U`gVeq4C949P_ZM8&1r
z*fCtie0^_->GMmJSI~%59u%FR8|&?U6fRz-?g^!J4}e>AL?Il>*KbaFI4F}{RflCV
zOu<UU_rE4;1$e}ST|V*x&T8=Cn%V>liOT@I>0W*<eq-p*X>lxYqPkX*(WFWfiqv$U
zjrZ$}CcHCuo6EltkRjL`nm~ab@yn7Nu-X%<>+**5_D%^sk*z><N@tS#!Po1B8=<mO
z0m7`beTm)?U38%(_2mEvo+G7?Y!$ZD7TsMfU%xTRnXEyIaMYOE2lqh|E54=JIjSNe
zspsPK1lRD0w0^OT;ldqFx%1z8bAYYbDN8v+s%4fdMa`Ec{Cp}qS!xEn4kPZv#t*c!
z&XEEYDkyN5;Mkm4@SNYkqG%e|9PeP(z+xHiN>Pap<Jg~5BmV%<(~mboWE@L8H|6_!
z;(Vk!3;ClCSeGDSEZ5_%{QH*wM&DPLFZ8f@AB7h4e=`YC^zPpGg5$4tyii9}SHoku
zKe|`d8uhlzDum>eRLkF{jlCaLt%EmPEnBmG?r$y?qFGrM0zQ6#n|!)V`Fg`kpFfxv
zJ@AC(9yyFnU25vpRd0S1?RPLuRS^&xDzlz#KszAZq5D9sa#+Q)$dkEWomeTvsTrwQ
zoRT@GJMhq-><hihu*W`I%3BT#G{^pC%w0sXm5Or_Cas_ETYCmjt?8hcV^IbyP`|TO
zs;iaA0<_jB@vG%`buvNE<`j7#)<B`z;*aF>XHkXV1!A>8n-F8&TkBsdWaZf+;Ln{g
zEA8xtW$F_Um%(Oin=Ej@v=um0e-Q{bp3JcioD-jpYrl;T8)YbnA8>~tUw)rSpLc&<
zIh04xc7d_*m7?h88x-{E|3U5BnC8J|0y(oe?-koe%0W7KT~`Zo{40DJoPV^Vm|*r1
zy}`9Bp*^TlS3bu1p+1|%&JU=4`^)ZAQlG)@jcUiEM9ieWpB+4svlu}W&X%=RkLaoH
zN{+Am2)Z{VD8c5dwp7m!TPAeg7VAo?`sAT{{9U0XwuvT_PJzRO0&*QG_tXQ?gWd1k
z#dE^1Q)G11xV-0-h$mD@2U*D)ae5>{sd<FSv8|tX5kaYMO7LgPR6v+0&W>;LG>OI1
z_d8AaJ%Tm^wlk)2N1ul|R^ntz?*g|QrjW37Qnu6%j=aT$Wg>Y@I&k1*xIVbTs+E{#
zDy12yeOmJAPWv>E>bkt2=Z?(f5FBx0M!ra1Ww__ntgCG%m59;pP!kPS?;8#n{QC&W
zFx5}O&X!A|VM2^?&Ij_jGTVQ{jC1E{F2~t7=l6f`PenMqC{K;sC7@S><+hh{-;6?J
z0|5`gI%36DMpZlUqPb&-5*ss;CC5VtJ(Qq$`$(&5C#MA3S>Fmk(Q$Jl7tN|6dxs^q
zIXlSkp_LWTVAM*^=8(52i%Arj%7NJLbBtFZJc>!bO$Y5eaVT@}U+Qs4g6xQXtV0Nj
znryOey4xs4TYx6729k9(({0PRFq1&xq>K_;P5_D+Q?r|FlIRjV2<)HCTTP@-m857<
z5}lfAci5+&=2XP9e($wen!?Y=;dr?f#kh<5gobIEDy4T29OA!@jiS}k+j1aOzY`k&
zj3Mv_opJ5L@QnuF+0H|&KHen=I+Yw=d-NE<ZT0V<{Ad3bH8O^G9_2QFmp38{X2qY=
z@bc4s{;}>V-6(~tJUjbyfqT!K8(c~0>0P(PrZ(L?ymt$y8*d`-75TeXHvlbr1YnzU
zhl>fs4cSux9x@M2VMbyV+;vY&#hcVp?NbKN3l!9g-OO>a>3}2Aq4CV=x9B0bGE#Wt
zTm*ddTXyB<3_nARPCa#Jd+)H-h2f-a%?E}2b@zWt)JnU#IchQAbT*vjUG^*x&&XuW
z1AK`nK$YsN_UeFjTxmofu!`?r?ZPuGbR3t106Q4{gWzDb4bemK%b_SMK2uJ^B40YF
z4A&tS)eT3q=hyrpKnY09U2-eu3)ZNMdZ&3^v>N}95$&_2_kZwDnaB&ul8lyg*=}hX
z@a=k$zhn<iH~iCu=>SDG3_o|VesPqNv9Vkvo#+~!kb3twmnLL?@%1Vlw+FXl@iD>h
z2wUcT9uAw06@VFI#c1x!nwrPnU?KRy@{`2`vs((Q?;ZTnYOuXx`CRU;NouA#&l&Ai
zKDl>m32)uY2EfcveDu`3*IB;svSA~K30c)RK1FttHZ?GwezUyAO-A%?8L6Ts*?5qw
zlEU|%4YfxcJ%{6p7ILFyYM(`*gZ8qNh7|@6*IL}#kp+%rooYDZysgh#6Iq#e%ap$*
zr>Y30kl<hE4)yt<lN$Zwbr)s@lPo|gJa<t$|74m50?hS?xWOB?ocVs;ruq*jgV(Mc
zwr9+vx`*{uy7{DkRn2FY0tF73sJ`ri+N<9anj_t(r{gdTsqXUQj`ofexUu1U3&wD<
zvd@#w5f2c<aT_nigyP+^9i5(1c%e{g1C?g{hU{jbgA2}6LU+U?$Scb*KZw;TCPW{y
ziGy-P21GgbBYspM(E~`hha}WW;9GvOfJP7|?R{gL#s+P|r-Y8k&b?zxCVS`&xUJ#H
zTzoNDVNTNp*HySPZWk9}Q;TSq0LENA#rqGJ->t94MoBWN+|cI{HmlHP4(6WLQ-8L2
z8zn5#M3JCoNn6<~WH!6pFbO{^W&Wq`&|I!#S<FrphU0sJ%OIhFSM~lDe-d1-!$Vd8
z=c?A4ohp+s3!E5MGg|rtJW)nXZ|Lm@kjIf4L^3i$yOhMMKDq)&Dc)BLx|u_b3{N7-
zpp~d9KnqUBg(`x?N<~4y7By7Xm6oLxVi!v(ImkZ+_Sei@dI|Q&kixLbWu3>6I%)Y0
z#`tCYt-R<VIV})f6bF0u+|SO7arxvPWgZPZ^2kjNwOg98OniNkAcLAjlY)3b{Ttkw
z)rH`QqT;T6zpeXF&nlhe*X!O(dfuB6&l0au5&QI&nI#aJdJT1bo4qwHye5}F+Tked
zwNK-4nz-a-2wbr*gDZgYuWf}Q+da!-beP-jm$5&N+zr1fBot#SJ+&hcAL~&c`03Qq
z{yVKdMYary3&Zx8cD^W;sYpr3S>cd@vL%0e?%eq|GNZ>bhQ0fi#-^PQG7M0YleZ14
zTmrAs(<d14t`_@Z#`9G<m#t<rn^aZhtN^%(2yc3QkE$hnCb>kZ=2h+e3b|5Kf88`6
z(Qhv$M0lr6>7jRdVh28Kh{;xLt0IrEBnx~JZ0RjvsNeTRkm%0Wayf+#%jH?EgHiK_
z6qQ!<gRgJoXO|)w6SiihIrj^)jJKxl8rLT+9?iaWuO5MSelwpqo>~B=ZxlHqeU}SC
z&c~mcxF!yN6am{NpNM8;-kKA*me3&8zYwtrdsYy}>92as`>n_?9slXs3*AzwCKKiX
zSMQ?&7Ieus%Wu%MQMQ?jS6|#sRaty9YJOms8R_V+U^(@T;-I3iCCgg-5UXG{Rq8tN
zA^FGmfCKD)S%MSeF-~I>($`XKwH)n-I%oxMbU6ayp`?^)?+~++3dkaC43Mp)M-a_X
z7J2uSsa#~g=OR-IUaZqu@mSu)gEVu}C>_hhdurXBu)6h^&j|l6Gu~6&jPvxj`XHP0
zcVUqQ(&3`7Ai=tFeca1~atg|(;{)t0aG0kqZdG2Kr-42$3Y!wYD~ivV+iHQIJ~-$9
z>}mK0-3EWAuTCD|5ZHoLEgo|6#k_P_H@!=Ld?!(*9*ND{f<)mS(kL7>G`v}CXgFdE
zqZ3Jx=uk?1AE#xbU}=2ves@`H(P0l%jabrEcis(0h9L<nSSW7zbbMQ=SkPLyC(P%0
zG8OIjeSey)k2@2CA1o#1F^58ze6`isWrXH22zaO1$%`2wl{HNDjb@XXCXPZ((4oGE
z$cA<<UlDHb-pYrUlnVl05~V4TP0wi}>NAZr)Vmz{$+(D?U#_q9L;Fl_rhL-+6>YJ*
zEM`n&`pefxAlvZ)4V#UoqF{O15BA#$%UEES-v?bTduNM@v(p;?;k-G80+kav;KPyH
zZXcxnMk&t`FrH%Vfr*=c3HNj<NWuvZsb7K}2dAewKZtE0h1>=@JnAER>9m%q@ezye
zBH{^gU$J^N=mP+hD_-TI%CP0uK+PfOk%I3Z?ycVdfPCR_w6JgTJ9tF}To8w{3nrFa
zGy!hJO9D~#PbOYO9*mJP!JKrUM>7d8k4oM2o7{q@`>9+|ac(~+$@Z&R1xEOy!{^3$
zYSZYVty8sm#?ofFq?^3F@3G`<irKoBHa)3l4wOr+OpQ1U2CjzqE+Qlg*2*9}`n3oX
zMp5}uevB9|O5ka#TgCLwW-z*d3^|$pe4?V!@c3IrtlsfCJ}$J&tyAcpz3}7^S%lAP
z=D8Cb23@5>`orkrC4CQ5TT=O(n6O0cJEhE=S<=9WgI8U}I=?EZX1%MAB9?CbF1h|E
zj;~(Mej9DE<lS9wxg#IC_uePfWA&}(^}j!SjbN@(tzaqK?#Yv^&rENFZX3>9#B$p?
zJ-8iTP+*I%TgAK7&4$4N^LAm{0L)4>CTjdcP%C_(K1Y(7!tC|@FjWysN{ly%#r5NJ
zfw2)qg=~3ITXBZZ1(o&MnJfx9Cocf>1s~}e#cw{S*Vb`pZ@2o<qxCVlbVo?B<5j{9
z4(e||98iq<8;oM5lg{CeBE^$s<2(cAr{{t-1<nunmvv&nRwqE2No7>hVj6i1TPqQh
zt;!G9hg{+omoCTG&0^uSX?uLS6i0s!I{b(EhAGT<&X?!?NQ*b2k_1~a-xG{lggLJN
zhkE|P@xaXM`ElOaiRO;s0jphC)^siBb8~s=9Agc+t$7+VOzNo@r|6IwP0s?|k*RZ~
z!gPjrW*~G^nsc1^n9nS7;tJ@{0p-l=h9$Z5>J>g4Rmh$p^{~s%mV~O?d}7$fbbX~d
zRMmp+{jTUHK7J5HB7|qEAVPnai}&Tz(6^wE@tdJZvu_&ri{=7}*ZKcLpnDlt>;Cit
z_~*NPVvg?cQ_np}a~MRdRdtty{B}^fEP+2N;?YAqh#}w(b3Wx5lIijP$t%6YwrR5U
zGA8aN?p37S4XnG0A%8mzQnaxl4!Y3x#Bx453_UZ-m0Hqhm$G5PD*a#U&)~h_-uN}?
zHog~g&bSTx2VT!)<+C8k`<kNPH%sOr-D$BX73O~(ar`%t$q*3h9v(q#%?S9tk8e^z
z^J)X+11b>g<x4Sro$<+H;ZYWLGBvaA4UKX6tKa(qlx9cUQ0?D?@-F=stjGiszxPg}
zEVC!^qq#wZ_syrKBJ=SwYqLv?vI+HS{es1UK*G=PjzL|@%D!-o9MKTg|N0~N4ZH^>
z)?I6aw3xKj6Md``jIvycZEyeHR#?)FY`0o@RzY0WA{sNzwKV$m?bUiXBVAgNp9yu>
zf77gIe3U=>#^PS2Yosq{-g8y^_1^bvh~KC858F2xpuTDdz4zbIAzc%uTgQC$?mcDu
zs$;v<0W{E!xjMrdMnSf8rt}kpN_Oiy`{?#DJ#a|4#?UvpwApla$oNZoE2cWw<Zmya
z`S3hj8hKKWpU(YT8@RSwWMl_9(GB{T-n5~`^_^Khn^L|<55B*=dE;19aS~dneSOE8
zgD>nxaoEQJ3K|-k*!JMmL8C368m8wxJ*2E;o>l0=0fo2!{jX$3t|_8Cvr98?t#-5O
zMtJpW{$9;XPHD?23K->BTfOv$OAU*f2CVo#t2He@$Y2=VvMC_1*rsmZeEXx%m;Ote
z&Yj<hczM|0M7bP+A>s3E2=g#rYb~&T^If2SzxYV*B-nQmm;Uo*vDwoN#-@<PZk`s_
zCR`9Dd9AXILSU&)v4#_NGBtDIp+ax7a%oF`hi`+OI1=7cXL{+<8@3y((UA$d-AxnY
zfALxw=*xA>_D4IyZIgH{MlZg+d3LS#74dsTQK2Oj_7gD*L+>Z2C*8n-gF(h7<yqVL
zCc}dJ$3}b-yUezC4Z3dpJ&}Bwz{WIRW=B%p+nS-P*v2qmz*S+fDZNn{6XhBa71fFI
z7e{VyXuw~lnT73jNzOGIwo75zyp8p%Ti8jI6!ZgG6ha=4HYS6NoU|WZI1inCvbxS4
z9qaz=BHdrA%o!^eth=$@z-A7WmR!5^2(Cl_59iN}q3zla`E0IHYPEv|V@h=~BXx|@
zMDq^7yN^rsXwk|6aEXkxbACShYEgdocAd}aV2zx*(a>GB>d$u>Y3ZW3HH+M<3aRg9
z5u(4B>RTEhNrI_Wwv2tVTaO;(D*M{*6VSYCx5>RowIOC!n^lRuTanxFi68oE4f!|U
z<(B@*-ReXen&`=W9PuJ9k}Wm#AX(jTa)!kwZ6D<Q6II)_N6@fG6i_8Q3f=_RUU|{|
z>3F7MYd-qx2$)ja?GZ;hYwBGB4t6rqz5TAwW5bQHN$bSH%y5X;$6|v~t^(695v1gu
z$C9B3+0l0P%an#6mO>hrqYxR9*3;8mC54+G1EnTrJPq214|vp#cvOr>CUn+PvMdUz
zb_WN(rSqsPM&%!^F?U=dSDq_!9(S{#gv?fl3Upf)98`X$7&*>wcJieWf5_aL#j-Zm
z_uOu_NUxe@;LClF&ALM2VavYMM1g74_}lt+98fXdJf7MKIvYFaGQ8s{Ye8u^Y~C{#
zLAnlY#)UZM_Jmu_)ThPmcx~EE{H0iXN9DX#k^;IHY&r2%{g3M60}o6%{jPD+^Af%5
zgPS(Krn$fhHGY8@O=G$5YiuE=X?5TbfEPUB6I6ND`YRIV+j4hb!fo7ld?LIvm=T+u
z(lUwFwwX_CSgi3idunqxA)H@Yt>)w>1&ZT-s)ICHm#?&E)8RpnBM=pp=1yizD{acl
zcsR{rWs(PePX&cC90xk!tkU=Wn#MqH06QH}Mb9LtnV_KSg};&RpQj$~#m(IVBh#NI
z8(j8MVztU!(IjOsWz!>gszAm*5d)-SKb?&l)WCd+d^173d7E$|`DYtHkMZ|(4=CU+
z<K*y$6sy2Ahw;g#x;NLnpH}4OWwT>**bhujsRRppJnA@40`s^ZF!J1cze9?5xp-4^
zxdXXcB8<=g74%q9cgE9_!AG&4V#s2cL#Ws&7h%gW2W;b!Z|Uk64X_fvrm>U-IA|?G
zeu;=h|5#`iEx>NYt3km}X5H#>_i^LL3dqr|4VSfkT9&?P9`MdPf6l5^ZrFAVL-lp&
zoZpGH_q>q5UnszBfg@+C)zETlVIM(HE@f|n!8L4V7A?x!pnw3x@JolLRgkw5{o1rU
z#Nn+p7x}@`PC(|`VL$b7N^*Pa*=gT@Mw&8@E@$tGYYW|Ak(77%{0cxG{D%T)K07b8
zCLev9g0sb{`l-q!&Y=&Xt6sBO|41HiTR(-#W}nrxk#34<YCqCOEBP?A`{BMVQz+;1
z@}dAUIrsz&H>HnmufAIJwtEj~z;KTY;TWDXbfDB-ceIEybEQj=<-V={RY{yzx^Y2k
zn~IBwabJwrlTXK6HMJux9{h9C1bEMyto$z;d+xmVHO^hXe%>|2!kTq@PJsg7^n7<`
z=lJVTuHvxB4XF6>D6+gbz|nrSViCqadm;&2*beG?_(EYSd4>$Zv<j#h7gBhTDfRj!
zm@Y-YFs^dT^JEl%b5?p#*r}a41o^?NB}PP)Pga34xlHmq{vNUd6jWmrx?s^78mr4{
zwO`HI@tgyUvFb3N5D&>YPk8hb<UQW~afHM8`;E0pg8?gpuU21O2P0LwgEiBoetb3I
z!q?0W!^vk?MT}7X_KCM3pT91Bx=t=ehDbXQ^p*|y85Pz2-c7~Q;^G;x_(v*0hT+2C
zA$<Wl43ZXbi8(6#&cCRRJoB>yo+3qr-NzP7<&Wz4(Lz5R5FW@eN1joE!8uMF(||yU
z;~vMSR8c28WTGc-)RymRrb{v_0n-%v(hCzM0quemqBeG#3=Jrd_X}u15zruQT!^zN
zkE69}xWSZq6+UVLitu|86d5LX=j2GZ7ID1;qvbo1!8`~kWEsq-*4xL8Y@pu-*t)HI
z0$tY6uL`yBi`5%%s>(GDP`sEunK<D@HMkqMBVpJUo_z^d1IHHL{S6V$bbPOR|Blii
z@Za*?GEXmbOGFqJse1RYP>F+|QtPC|){m7^dAA=Ui>W=yJAElzKJ5<noha?G7Xs>6
z3DMgsqeeUG7PvlybijfskJ!#E5ts?vR}T;4rIW533cKoHwJM=6buvMc%|gNb;z#vd
zm#n8GXDSpdlfWJs(RB1yV*Y}7WM^CYQFddAvH1B8t7pq(uw^I<`Zy}(8=&gsqUqwI
z8*;F=MgDPh1Uzw4E@UqqX}RCyRB({5QFOq`lODErG*gC<^{=Vj-ZPWpU*1n+Q=6gg
zR0F#Pq60Q#r<$!5vNk2K+_1e&hR`DN4cXEca4viL*}HQMCsuhBHsBwEXrjDHND9%&
z?%W|xp`?mn*Y#w``6MRAHg`ccFik+ueI@E-j3>KRk3NDvjxk_^aj`8!R5*|Q;eRJ1
zuXQHAOgz~x(|gpGqQN`}?DY)0`kNRB3Q%Ys!)GremcrTRjD-4*2fJ$3J^X5r^=Rt&
z?yq(3yy7ao!jM=Z20iI-iSkv*Q3mg+H?cAJTdt65dSGuutw_&|XTRK25Sb{g$_RpH
z%G{7~ElzN*hBdJUX?OZlfu5}m$52Y_aQm^Db1dX*ASvUK;uricUc~J}{bWYj2FZ@C
zIR>6n@*4c<E%J{nel!t*poYb0;oDE%nZUedSKDAXr2u1f(fOYJB}!CmNSb2z?CZX0
zp6mD(_2!liEy5A%O1g6#Cu#4a!eA`43OB{c5QkqQt?ZGqCpZ$Id6_HU%?X_Sl$KGR
z^Wh332VKH$T3Ejy9EMKRFk?+En4RRx!)NIlWk!oPA+xhNgK=vTCe!cOSgFB#vBV)(
zskb0*Qb*=Oh<Jm;G_~VHD4#wq>3v6_0X<NhH`(D43a7!k{7G!iJ06c9eH#Y;fqqX!
zWu{aB3@09D&!<|9m>EyLC^+E%kZy}^uhRYHrM|Ay(>(ua>7v)}?Z_Tib7#KaQ4&?N
zUvv>o`BS2lp}0J5CNMH?_MiYQY4%VQ8|uEp7I#utnclgzZev*L*391`X1dOnYnqti
zKVhAhv_URW@O&WOle!n;PU}j;Ko=btuq&K#oEg!Jpjp1CC$lG%=flE?>J-?kFqmzE
zO|55}kTX0~AD}R-g&)P`b`5eR_nJCv(M^>wKS*BqbC>nsW2;~F0o~XWKkZ2Ur_)0U
zZ!GU=$u44aaz^xxJ8W%4cN812mx_mdpgWbA8J^lXZ2mg^z4Q|7mG@$teFiN*bE3);
zYD<*F1hKtWr)MxB$+2Xkfi~IVbp~S8hl9!WR;>bVynOe?S1LrK_r*ksa+iLL(h?yp
zT~#!u@&UOUR`bF7ucT+U0C;j0<30YD(}5XYzo64D9I|<0Q17L$(DmmHx|3cW$0(6s
z=601tg(E6n=8hy==}eJ%e}51EG0B2XK6XQ<xTl+|k;2`g9AdEnupyvJZ^iB9s`m@o
z>vYOamdN{(rF1zx$>|i{D@2~~g)YkC6(KB$UY+j#GECzc?cZ36rP3V=nmq00DAk6F
z#-z-Yo0x6v_<XdW^Mi_=M=*;|8#Mq9N`H9=eXEh|d`a;2waMauRQr&lA2d^12lIka
zo%CxO9bB6;E~S8<y*-075HHfafJYAF0JUZ9(ClP{z_KW+t-{IBNxfJ7sl9BqzVL+G
zHzq^Zn8UX6u~|*x5M)l!0{5#OhqZnx*zzac#Z{1hckP2Gydf^(20{Ei>-8)K$rgVT
zHs_T<;7`VHRe(5Sr4MI7!hG#L1y=|4>Uer-(zT;Doi~2RK;St47d@gIG>{#BG1;`A
z1C>uFWv9}hyVTh}1p=ISZ{dhmePF1XU8$fB7{9a4BCdx?Ufh1}1S0|v`ulf50fOB0
z>8`H{|A^@i6*)B)d}$^pjT~Oo4B*TEv`p5Lm~!n(@b$`vP9d`vAy#FFD%Dr(n?=n$
zC#V;b(i9e(v5a~xYgWLoR%JlbQ7|pv$vc3LPu`xz=*bk~^#tdZ4{wjq(v-mRZ6qnp
za9S7raSY%G_v@gR;PtZ`%l|OZCDK5;qd;`hiIP?T@c7wm^wQ%q*QKW{BM;YNN~rE|
zg)1To@HZZX%~Yvan_e3jYxsva)a@Hi(RhzN^mb@7LbXMqszXMSK2skHt(H%N-uN92
zQ7bvyKmRFMZRT{cv(@#PvPyiS^ew>afUV*|aFmAxLrkx(mbG%fdf`7Q+Zj2?I3&K|
z-pmo@o$s*5&w*^}TX!$qTGb+JYi0wYF9KJm^lp4#e65at=LL97uM&&3E5c$(7L9g=
zABx=ZZvgX5F-|fOT_@}AJNl_^Sh+@0p{}MN+NRezt&y*Vj|h7wm{wnKb)z0H-?j=(
zxwidGdA$y$lt%B)-tmu}`SX!eAn>KxI``WX%{K?E`|C20vgq%By!(400;_SWcBrBd
zNY2WnPTWLP#Mn&iAj&w;kR|F%F3Lx_#=Y|Zn!?<7WYA)H8`4oLNn@}xe~jzhR)ab!
z;ZvVkvFh3b!jH{$+Un$<rm@;v%O&1l{hOk`{KR`23UE$&b9*R(<QT^MMtJ!Iw~B-M
z5QP5h`_ET5Dq48U%G8?qXdxiO%0pH+?NL;2q`G0PZTO+MJ_B}h4le6I$>k}xw;P41
zkN;qqjSM6NisYuG&J3hhmgZ=3L?Tr9-@h2#7@SCG4A3C$O-WdO5tbVLKy0~%$(Ot>
z$2YNTn#Ea!;KE~`1Vx>&7?G?0iS+oqk?rN~_hqhF`U3VFEKM~Jpil1pQTZFMUPkJ&
zgz~4ld+#;VdyB%-zv1r$9ps`e#ks6%QaFqn>>ii~)J<wS2YlC|CppL*zj}mqPKC05
z7wd~}l1YxJaFW%?EUuII@u@Np85u!o!hY>4(H~L#LybDqWSC<jdZULVV%!44ymOhe
zQ4eo=Y^%|<5rGi&VBfOq+aguw;l;KejjtK`gkh4}*Xzv!hMYkF)OcO&7#%&strS<)
zY%L#szK3~lSA<=6XTGbFE2TStL3a|<#>4O(_P+Bj2y7;U!dmu<B?5T0jO&cW{AOF1
zFdr?fd6E-?EqiiDdPAp9c0GG*CcL({6?$^rc}E~=f6Kmdas*ZdC={BvDR$VxQan@Y
z&)!Is@*X61gFlfH?;8aqIs`YcEb~A6(&c?3p@N7ZapVkig_>#AG>vsAZR)uAD!b|N
z)y8r)C#>tBx7Uw(T7id%(QL%5_oVpOqwyDjrl0i(3gVW}44PJM(?SDrEwSL^CH=)B
zvj)R7TE!Y+6YuQ5P?mFnx);tbhg#pCiye{BWkBZHfz2bM5XUC|6`o~>QwNO_M_JAY
zHM5hzb&o63@}=HUJV`*uycEwG*9T7-Q^5<)R@hzwn(#I&2QL{@zoSR6)!bwxkF?J$
zm-&1!5z@IiAenpL$=j(+%u}@o#o4hGB+eM`8*uQ(&D1`8L$c{OH96ISe+Jxe^kaKQ
zKthZ!2nP>6m_7LbKM6~s1*&t+x4%95u_TVPoq6IR8H7!bn`(jeaDi73XxmP*p0&^U
zE+#50<^;OZ&}usR{WPQj0WUhcr-4d&)mYoi>hzsjPP}P!cg(gwQh0BFc1Dn=(<o){
zbz+4*iKxH)s^|RC-ZQ{fmc0{oK-br(lXlS4C~M0XWAq0n-qREC3|7!@w+EP8Mw~0=
zPoBoEz1*`*a|M72kWytC*vf{AIM@(u8|2g|<FkeD8~LTnSam;_gcXedYfFDE2zci<
z_7Jw4>qx0BtwR&#(-*$wqv_=9@(}>miV|k(Xfog?TFYfP=ttU!L=Lh{+8W^wpy|?{
znxkf&B(&1hdw(~DN6Wrp4_e}IBa1${iAuM%BH^BwtT!b*!u?kKlXEI(@$1|q@65%g
zSvZO>f8{<osW)NROJhcV$*S1*&r@>7)iwU)*O)9I6i23QZD7)Ex6=JWQ--Ws!tB@d
zcAdOtU8nuGKQnSFm^#<^2K>k`#!kbue?mR|(Xm@IeA3%bIVh!MXHUo$tWy+=w;*a9
z;YXIxS+HzP0M432-wXvj_?i3E2HgGzUk^np2qWf>%IKdCe&*PWH%@==nvjC~h_Eb(
z!gp$lQPA#%v1yo}4!8eD6nXkF5I~%7=EENXrhp{4HEE@swl_bmQgaaOW-5~3>V~RJ
z-Zuo8@l9ZBT7joGI<4bPZ}2gN%2Aft-agNrZ^FIR{GyuULzllP$_TbM1ntyD<~!V6
zC~sUv_jQt{H*|--Y%J~g`uL&EBx-m|!@60@ZsQ(>w^7b4blUrn4H#snQdV?VUF{ni
z@EcJX1m$V~iZ1`%<?i1Wiw}9vFNInQ&BeA!=*}XSUA+@49@NwjrBPntPY_yL*oy*h
z`oQ*r1nCn>RJkY7zQ@>I^sL%v#%g}a-SY?CCp#T*{6WMS&gG&Csemp+O5)=C%(Q%m
z<<l-mnzUgLsQ;r<*m|){-eL|s@o>`q6<vaVtZEu%ta!n4xty490;`6qgS<~~y!{D=
za`md0j@J@$tTUHJ$BM~taGl@Uddf&+f?3#aPrz_!Nm_rSwj^Oc08N4>Dhetv6rFbS
z4P_qefn6N_!t|E}dIekbmo3h%gEZcwq|-{-q*>DGsf%9%y28;vd<)3Tk^ENFdgBDm
zHMIRad&{5gpb~l;`6cp!mOlKGkJmGq_B`D<D=HTb;N!e1F=ya#-}60kWefeh2l4qP
zPmOOI=eYVAe7Bn!m^8>tD!B9)MS#hj7P6LsK2JeCr}e$SZm|&wZLT3Kw;zL2JH9S6
z{$6e}$<mUQ9kNGe3tWnk=qyS7_?dv_e#<(QQ%q!}VunRUteYJGpZLzXKghkn(n@KV
zzl4vSwiXdS7J!<f%U$H;D_2z(lUjaeyGN12Ke=u=(L+yjydcZ8C}3&P(~CC^vTt1w
z5y`WU>6Ol|doi}8Dd_fW)d2Fl2gpAag7aZuhIh7hFVU*ZyZYwDbQx+aoQv_#rX5|b
z`~L`g>$s-d?|)oEP!Um45hN54q?PV4XhwH;cXufWC<r4545UX(cZf8jHyDk?sDU($
z`px^s_kDkE{XTyG?J>sndR^z7>zwO6Pf;%=vVr<0s2uq)6w5}s8)kRICLrW-I0ZMP
zLY*{Nm%dkAHD6LP%4PkHAuXqm=OX?`0;v(EGXUqCEakJ+Y=(%Esbqeq(}zt}iv0C9
zx%2S&zW%oIw)+X=Zy7&lzv9>4hzUY=nZaXrU5~>PZT<8eH~x_2f`QSVrV>dX2`wGT
zxdfIZe*dKkyTAeGwz&K4(RzCc5@8>|No%_?Jwg3EcFA_?{muU-z&|H>iP`|VRf9Pk
z0<+4or%OSv8vpz|DQr8Dth-S9`HGZp0}uXoH`8~nA5kwI(JUnTmIL<Rs3;CIrBSl{
z0p!1e?VK!1ZS>JKTC<-f&gHyox~bNezJ~ud;$ehV;TX5)x&PY{r=^Iizt-Z##im(0
zYIadNL4c8AQ{)N&z$$<V@y{;){m#z_0ulXNvCsWAkNPsD7l^|m2&-j$Ehu$)6Mp%>
z|I%ZkaNM4G{coIa;MJkTm#Tb;elE->69oL(cZ%t&6Ue6=z$QYi^_z$N^Qp@`SQJkr
zSWJ_tddkj^eSzV=`yZX={m)`j^hsiF&qst4Chz=iAyj43$#*4WRaJ^=1|9yQLSh20
z)u_Eiemi=&d*<5I;cH2NGX^7flB*_b6Z!Y{{@JuC&8KxA0HUAm(PvMkFE>g)wCxDi
zj_Ld!+Iy^zt%-he-|75X?vjuFgX2qqS$dpK1AErIRH4sr*}R<oo?COVSH*5(&*?`x
z;7^>nf<=Tia4Po&8EmH9lneV~m>TO^Y>Fu9X@r9o>#=Um%fFWqJ;yC%OW0%cp=)y4
zDfyWtV7Eg;D|FFIP5%en;;)1;Ot#nJizt=B;|$Jyk~Jp={NI(%PZv%eTlgX~=!hsg
ziD-Cfp&|v@Nd0rN4(3nk<hX*-PA)ii^#zk$^ZyQM^EHwy<o%&m?B_~SkDtAa1VEiA
zyHnIRj<ZaH5r6Rie;PM}K=wWojOQ9JAa|LK6DWAShGuDnT4@8bF-*HMx>=i%-3G?L
z1_=JctzSI6_rApj=`J1LEIKCh;@6k|_DeBn^j*n$ca^^5Cn@o}4eBPBF_hSMqT!N!
z5bD{ZC=%~xX4$-Zf22vv6NQcAw4k`Hip0O_5Po|^VA<`iVIqjZu2{ZsN_?+VF645d
zPxOJ`NC0#(PVGgz4b1<~*B8wmz{KD0uQ)OM!4mw<6f<znTkHS6{C5I+$f&Dky28&X
zoS5JJCp9GCRk{-L<0;CCtnW{OR*Y0=UOPfsOP5BCIB9Nj{wl!Sq5X7J2I=sbkA2pG
z7;u>4V|&wt$U%Cl{vz9dp7ZQBmbo8&uO}_?^z~W4-<MsI6|eutMhx6=rMaoHmXjT{
zz|)P?JePu1fs64C<dWHv?^X(&kVXn1v%7dE_lCcwbN{xdzx0gAKMxf9`M{G${eOb%
z{@P%yjj$w?=cjaO%l;!>iIP2Wb^W_#UB6qhpYo;f7(0&Ne$ie%kTt>RPo%wqyF)vd
zR>IKg_iP|1=2tdppwsQ=(XmXfy0_?5^^vi%AKsWc)rqftHMG12Q#rfui1nM~U=DY*
zXm<aj<4INV*D9BdEE5TEbBtb)M#+Vb!ljgr8-KWcc5vt7e(~f>w<Y8{Oh&n;*x{=3
zW!EnZ&+|C3&yPWOHx?>%EMJOxU%oHm_Mkp@QeY5&vp7mX1UA<rvVieY%jMi*P&01a
z9MhlahIxE%tdrh%?*+Z*+|hoBXjvft1HrMc#rg<8i#pB<Fmt|!IUoUY28^r=LsCf~
zkWwI}Rd#mvXS5%`hHhITXfG86QW;aAkCwcz_v(Jnf{M#a@q34Lb^J?h1t}hnmTQ<^
z+vtRd8-)qn2ZkM0xV-)f79dG}&)BIAOBmJHeU-@>itO$U)m)2S*;afiqs%R{KSL)x
zO<hE|`!-b~X#BE&ps0cHoo7ov!{k(u0s1fVT7Ovs1HC&Ae9Y_Xx12O?31TWwY(|hU
zxo6+n*ScT2^Nrk91?GR0^Qqj*`O5u=!-61Ad?C*{c?>o}V(@lej7Ceu$E8zs8Ch7k
zZZ5V|EU5Yp(2FMPNU=_gXK1yoy_X>%M4I5?BYn0ib*KeV2lP54NR5W;`e_lX9y)YS
znY*hAfb4EQFTaN==e!*01|pB(Hv3&!F*JvFqZpAtLhufsRQ=D0wWQD}^c-i^3Ifuc
zgIcd%`mZXIrUGA`o)*hEdgmCkb8;5bdAhn-e#{UDO;9T}3O8}VUEf<5KUYahQDVNT
zwD!AR6g7yvllRS&26ePyr!MtLzPoEkF)TlfR@pW0i{?bWJ2ixMG!GZsls;XcusrWr
z*}OiSd-*Gu${o90h~1`DJ)>!7ZDQXeuF58+!Xjr(Vb;#N^4%>eA9M5KbkKl9Z&1uz
zosvd1d{wurDG<W#nH*4iVAU^V?o(g@rNA-LHoO6&T|&HHvR|I{jBANq+;MfR?1kOi
ziI@;z!IwKLUEdrnt%~7K<ccb)xO;wBjMf#`q46LSG7LM7xgLKI$+Dj%@#5!hrk;GB
zY22hh4Qho9$V7OohAW^~ncZun#;FOcwrf~9JUl~9SnH*~MEJtDBWy^KulTWb(|r7c
zu(y>7B)wBK3J*zBKo1i#jbF&<S+#u}o>9_|&Rc$~Bj3I_{>3p##n-v6N^gRMGry({
zOQs5W)uia?)pd#KaC;;(na1QGEep_?oia_03OOp387?h6mY}p69U@sS8!4OT_|{09
zBt}xXvMCs}ez$f17bu}{8{2F+>#eo8`qf(JdzaDPXD_gJvw;wJGiFr5MZ?RjWUq({
z@cUX}Tlvu!5Wje9El;#sS3PK|q@h?(Ym(79Ncb?~3H~4C*pyyj1tY|<>e!Mm_CKH8
zOsj;{$mRvdecwx_2(e630f!z`%64bDeJlPH5T&eK)mGLNdC@yle?=RpdKI*u;tf9B
z7RfL5&<MEpbRfR$K0^mKOK$7K#A_3z9WA%av5o6iKc^=8y{#&_EkXFIKAW&Y+k!CT
z37$<@^bM9*(yf&FvFcBV2%bG7c;>00q8<m;zwp;brg--YnZx`0QfuA8eY<{(wTHd$
zy>}O_k^S~1jqv_BCiMe37upfhr=<@`F(Y2?HYzHJ8kxT=#?NP}kilzIs(mz(B-RVu
zRBv(1kPZ=*TAQ47I(QWagzKeJB4TU_b<F;`Ss=q(*iS{cZ%+ic^b9nJ@Tr&9YWyuh
zEp&Gs2<svKUI;y9ud}iQlxG6_R!_G>Uzwh_{6zb{BilRNcYp8>Fitsk@4*Fg-RTrT
zl6f0uz#g<r{X_AV314DE>W!-Ok~IPQ^<;COcPZgoB`?2DR7kUk<LM$;Y6*-T3c1Mr
z#GD#;te*+oKTICT6<YN>S7a75u*KDZeR<(!Vq3xc;(u&RjA_X@6Qb#%8QF=oZQK0Y
zSOiwyeNIVgJU+5J*WG?^9kuP*2`%&OHbA57KHZ__m8)gG55@khFGP?7bdv{xY(3*4
zlYG~E8RD`Psrtul*!hwN>_L_VT5%Kc3qN2w_vusZK2^TlJIbMCb7Cx7AYMJ-9FcWU
zkz%X_ZE%)hss~`{)+e`Fa&L*f(9+6<4dL76D%NVHNvl>>TPwkt#fl=u?W|$>`yiDm
z#<kWnJ9SKbd@{)HkX5X@-t}4BK8I6fgNu+>Xcb&6voqM5<D!B^HVHaq{B^?oA}vi{
z!R|t3eH5s-rBY6a=zEou9E(GF>^ibAksGLkSl>)b>58VYHa**$tnyPExJ$Z{YZ|rB
z5#K0D*XIaL4N+0<3oYj1@AtukPnPn|Y!Gfj&cCUL79ZR`x%?S_tqXuxlcfJ3ryrws
z)ZFQ=?)-S>iSAie{j`iPhu7|Ogb$6-{u4=>6T7MXXd6}QHGC!cDD(|2P~|bF*Z6~@
z+f|R0c89T_3Wt1?Fd5kDKOy6sCSIp}-W2FH5ly^B8PE3&QbOZMFDdV<X=`g#-h<}&
z{wjmYFqI}vwUl*0Wa-GvMZ_EG=b1aKb`e$-1aa0pBd6Qbp4Q(U-LiaOO?Zu{*fuMw
zm$Ho4OvpB~s;Xd{0MUKq0-D@^B9b(1x4e6Nbvh<xb}iRB?X6#H;Q^|k<csk-=?QV_
z0!)28{4LLPQ|{V=fa0uy{D|!##pj1eW9if6rx33Ez_j(OX}A{}RcCzq0igOJZRDum
zEV?x-F)y|9f`~kj^dTU15N3M--O-$2mrVu8^E(v^8!$N`&ITzBmwi|BWnBo_=-bL2
z)74<=^{Mj(TszO3b?RN;`&s*QjeRoH3qOrS=owe1F!+>p$QSOYlhN8Ttx0UHRK`_$
zCsN)$s*zc11DiBg&}hme!bMWD)$1AkizLrwwKq4ojV=njmpq&Ch4zQ?iFgi%tn~A_
zl9f$|(sbm}l`C#9seCi+rPp$2Z<vhxyUkJ2=h#;CcRS<6MX(3~mcHo8?Kd1Hy+xJ#
z`YsPf1M`UDn79y=-1_#i>p%8(BUC7`1*U+RG`@63`=3^c_v>uN%265GUwe|;>GeY?
z9c^OaH1ZNqW}@xNry?P)u6p&8#yMM2^U?XlTJ((a(NK6C-4&k#rD$>EqvL3y<fP=L
zv0-x~GuitZI%n!ie8oI#G#wnflas56w__{9@=UAch55n@1ZfMk>Zbm=VAPv2xW!tc
zz0YCkyXTkLxHfcH1Nz1v(jECt`bbvf$^5A*lAb{>GlA!9?w0ni><PLMy~V+IUUKuE
zL7Up@Q@bv_u2!zqO6W*u38m*(7+$Tg7Cz)7cd$7eNIn$kbaJri<-#hy&(faufur_5
zs*Fp4-e_bWu$Nub|I&9f8|e91V`!;3o3fDW0-()8m|xVBP4F>xL4O*#=3w6r$tYh>
zm(N^WYn9rFt-hKD&d*e$NQ{fYbC94sDTZ$cX?LE7=?H9mb0u5BskS}5Tk*W)mUiVv
z`jVaoV9#ejO^isbGf6nss=C1G#R58pqTCNUP~z+HtaDo7R>(lQjyOz?3Y!Ar%$nE}
zH`gk4`xJH0#VdcT=z}}!mh|zF<Ski;8iCbU8NmfYmK!K(y(ypdAJ6>87b)^l?s8NQ
zN8PJTJN<`OH#_WqKi;vp87C&|7g7U736C3RSWB!<V%52zn?i(nVU1V42AW46c2#B$
z24_anuD-_`Gr6~dmh3@S`PdJ}Rry-aY?d?yv{~yyY`41Xgl=*Q*jDa8wdgcgm<Hxh
z1wWvih9zXf+)Z-VBJo%z-;Fl-dK3yrjY{ioSY??vcy&cNGvc3gW;lXgDbJ-@Sv$<N
zqi9Rz&nQFDJHCRJ0c%S#(3W1)u}Y!}$~*k!#Y!V2ofIOe(<S!BEX5j_fWv0t?z`tB
zRZ}7soneG2-`kH|>d5+ZZ0&mW#6O`={lpG!y0_qlOb1VU;G%0JQx7ODPO96TO|wn1
zk?0#TWTI-;WXM#VMmXsX;Y2wZ)jStrR$+nc=4*D#>ZIEB*$qn(s+Fc!Mn$GNFu!tV
zM+uud<=yGtW@jk$?35hn?HunxZ@z#)n>p!5vDiuH+J(S&dXiJ<$!C_PS<7x!bqiF8
zg&q23y>5IeL3bs3=M(w!A{}}O{$@^#BZmvo;L{Y><=mc?CN#yP`ZaaV?Oe?f6=BVN
z<;`lJ;~PEXxWYEtr||Sbu|D8N!p=K+RT6LR*+ZSpgbMro=IJ2@I-2*<ou7|ZvaW5Z
z%Pf74i^oS%V0wR9dU`Lj$U^9CU!d9h&i%kme6U42da?%1=;_8~g`kN3p=ff;Paa<U
zs(hRIH_3A&olk7^ZMz|Bgw+G!wJ~}w->~!Ab5~Q|z0<EE3#(Exl=cV{rtYed1!G@7
zMPRRYag%hFHDOLU%fTRDB7!>Tm~2l{%bjpF?~QJ<^JidnJte2Jzs<Tw7by)Nl1Iw0
zPv&}@mhOR@)r>|<S4;F7NiumSAG3$}=tzRq1bS-oyB&1W<blr_NJ!YBL`Wub8kKqS
z7G5zDfA#_C(qXr^r)gA>ef_-~XxK&X!AhmJQ+hZ9rNBhNAW}cn%QnvI73(6SRXxY0
z>1x3v)~FPb97tGVM;HWQ6xd&e-vMwfktcbIq0y!~dyLH+0d}8vhEjj$buEB}kLCjw
zi_92SZh8`Ts8dsVC+Wt?g<EL^ln);#-J>iax2OuXF_$kb_k16-#OyvvTYgKoHvUd2
zxq6F93gv-&M>6orfrF~fv`N$txmpW8=X&AvdauFj9Mbije9dxr-wVbj+5i;hX?<zi
z*UcA5sKA;YHN&H*3B%J-W`r_PWE4*l>o8XLHW)3sx*a?pU}|3P`5p+nnM$+pdSJqc
z2ySyNaKsA_tLn`!75Fd6paxe*KUh<L&$N1z06py()Yh{mF_CZSHdkW<OkzjsO&gj9
z-4Df%Uts6Fy;t*;d&<2)PtNCNoxD27EpxeL8O81_ef#`&aF~hfo{X-rF+Gs<MG_vF
zY$`=5`Bo-EJ*t@Usb57=U6Uj#_H&>EK3NU9d}9?!sZRdNIi2o$jnsPFkNz1?KeM&1
z?(2_T2F7hE%+ZSvzLU7f-#aT-Nnsjm(P<`?>#(~>*Xyx2DJz|TWNESmcUzm+yL!yL
z2n>bnv@HOA<p%2?ohI76Xhu6_iOsoz^zcy8{SAV85Bg?m6Y}C7-q3IhcR%^8i;}F+
z<q{lolDh)V7J6Uae`|}ZBuTV*!MBl$EOy<6$sXvXET@F`k%j`CbI^^}M1&ID9E+_W
z^4>`+H<p@Y1?LpY_+*XM_!83XVaG%5maRSeAt^MWeqh`tIP()Ccj&B91V~ICFZ5s$
zgl^hB0l4@P77Mw#<`oMMy?&^P)mtTQW>=<|+&8wp_+y2fFm22vH<I35A8FozID0Xe
z4iyx~Aq?_89n|95%3HOSaX8xOn<~d|9!r<_py=*d*UV+)VdnX;j@$j6b4)Z!*xG*s
zlSKw-DbxNqw?ry$zPfwI_X#710fO&G#bk6Rj5U{Dem0NNm6Zbl(_B66n-Y$JhT)k;
zc>&C&RnBJNeP?cD7SAvI)LP1>#gIZU-4Ke)Vx_r0V#(P=7Dv8R*&lu7OW2qGv3XE{
zdqRnNtX>sKl3w$MsrSs)ffLXYjUys%-`R2*7tQbr`iU3~*fRw3<2<qpnYUd3ge*#~
zB6qFjtV*6ojw;zt9&*+9LUI;db;A8tNnI_h<4wjyREFgp^u{^TdPl5pl^vNhoT1`D
ztMiWT4=?JoiJ0!5OE(S0Hs+9uTZzZwKxK^@E4>;+Db6@k<vQ7$Rz3*jEU1skYgO$5
zO<K(fxjr>!q<x<pHh<Oe#Vrp&tGyK{Y%w~;&wdK_&%XhJ8L@SR3?(d_(MTO9!jvJT
zVJ`KUL}(eDxP<@{-xYJPgco%lsa0gA&0MSIXi`IcHHDAxfl8`5KH!WWonEdvNqHj5
zrmFqme~`id@b)&`c+`ca%W<3f^I1?J`byy|QJH+$R|&)Ak(mSGSrempFFkRoi#^l*
z_Ki*MJsEXs3SyrJ_=47h5q@B%BSv*i-&;$O<8pKh>07kVP0_6hPYH7<_dgXEpJ%f)
zMwa;*t}C3qI*75VYbthqVVA|i(gqMB>~}4xFHEv#+koTfzmlk?KtzniL`LoP$}4hz
zt228fxN24EyqK^CX@*RWE3$>-F?eF}o9<h$m@k~H%?{rDN@o5HMFWMCsoKbJaDdpP
zlE&qCAs+NDV`@Wb1Kow$fr`ZgeHA0%DquH!0ydZNir%6d_faKTJpxf8SH$k)<Y!8+
zpAULXpmv+{d5;4Z>b@)pd$KB%Wqb5>c}Ekc9AHjIrJc_9nWgw<cu#^^SCQovKh^SA
zYO!A|6kKF{rEMoYyq?$+Hsm9HZ}ovykaX6IV6%^-4b_UzwJH?Pyo*M}A2*Hkq$~UE
zl&g%Cl*g$8_GCfRJpG^Qvr*amDz6!zXSe9blXIT-u7~QuwQ{M%L*v%CAbAZ$qXX&$
zG5WDE{k$@W@HZO5E0yd8X}Sb!<(YTNwR?=8I0@<Odwg7_q4T!nLn(8ia(o+BO_$VW
z7e<8<EQlFfJYNOQyzS?JbVc}nJ^?jfNj^Xj_IU6yz<be8iVfVv+WqB4z-W{-tU)$I
ztirU-BuI)QlB%{zElw}9*-fQ3IenG}CSms-Sa{bQ2K0qyY`Dn58o3bD5PWn_3DR!8
z_lj+1z{jm|*V_gDykAHSKU&EZm7DofS(p<=DhG11z14ZYFRBK0O+6q6_O<&QJIFLY
z<lD{ane38!rC<77c+D5Kt9JDk=SqdE)^6WePm-zbIL4x?ac$HkEww&)4i(ItHb+IF
z0C)4O^9{he8*9$s80i*>*{NNn>uHufJeKi%jNf}%Cc_SY5J@h;_{x<Fqu<<kjPISi
z@1p&L7&CueyJPdtmJHAH<klBHLU!i*dVDW;?Q-#CB+o>YHd&$Ipr4mmC&zr2<~LLV
zZ_s_TkMw>|6)7jknr}1#kGjpasbfg39#P6YEp(^(mmYcdw|kvz{MuX1!kOaIzb2$k
z=b1MQD63_H*Pk>jHSDkXJ@lLsoJ@HCWx?Z-+@KwA0ObAlWSV$?%tok~OreU|&{ITH
z4HMzIDJ+ytV4t|wOoS+3jyqLeTm*7o#AT2;pW~tok2w^`zYA;CELfXd2ZedoIdL$h
zHI|h`KJ0u_2^*BR>WEZ#eY=GU_Y38i$t{R13gkaF-<|Ahk*BCjU?mhWDI6tpk}6q|
zK6PO6SuysJs|EV89t^)TTcqXbp9HxS^Vz^Y*SlK^9Q^<@WJ1y$Z1qv!HoQR)>i3C}
zfWhH`0y>mZJOTPxRp4lbeP5Z+^YpRPje?OrT;8oZ#78Hlp5N=|TApFc>|Njzr94nP
z&qEJXqegMF#;G}<w|BU~I0wsZH>X|MvFvmqorgzmhkFf$Y5dKLK5Gq4(}U>=#?UW`
zU``JJj++1+KWoX|g=E0^b89+xUMIP30U{vDMRVRsvwS1OJH=|QtON3f#1uO&l?^0;
zU!dQL*8}3x<|=Y`I`DGV)(;SgIm`1~UfPU|r`-IK9T=-xd)Gf(nq$!F%0RXiPh=z4
z8@L;F+Iu`EME>DuwIPnE-0}c#7o7aL8z?vl54-N1k@$x@!!6NaQRaO)U3lHou`K;M
zD_0!-{&6d4eQ?!4ytMiXVB}`~+GK&mIk*^)B{$dab~d?*g+i+f$BTs6TvzsdDrsK_
z=w54&kGH!z-q@}0RX2jtjfqsy0S>iwjSI9C&s)v8_#Ax<sxD;dgAqt}YZ*EZ-uGWv
ztv@+*wU}HlnUEbm4#m?BLC;4Xv;hnKEC_}JIQNHgavztT8A%lj&4lA9$jfnp9NF1q
zi$}}}6PVVN8=rs8wZcB*pP*UL6UdaWG78dyW(5{Kg{g>XlVRF-h9vi0NF5SHCVpW(
zKA(@lvnUXZ+8Lo!{pjziRa~OFU(nN(Uu?k6Ugd2lkJHFyU0GnUkO_@K>}OF~E5d~{
zv3eB|rb34Yk>_0UaW!jV$do33jjS*A^klmaW$A$EgW_{b?Jzu8RLW?)u1a%-5VFfx
z!gkb2=b~y`Q6C;6?ULQ(JmluOw3f7_>c8(rTSAwgUleoGElG!RN2U)E1KV`o>kQO(
zq@aHrX4zM}-%iN2QI94Wr<J=2loiJ#pEO;|8sOWYG$nLsN+;siX`C2&d@k0=x4@CH
z*hk}UTFPfzpzAPUCbRA^)buU$glErFD-$uM{<LR1;%@HpI!=EWnUyu_$+G9vy9iT+
z|J1}I-`3aq@2xc27sxy1FJZn8VvScmLy32ObkHneUj{?WBSbe;-fuSS#_z%>CAeiK
zn{G}CIX0(ghLtTOa=@mqsq8-Qa+GAwq+95j8s-^U2w1W}mPwtg%O3Y@ndh$LrWtCL
zU}P;m)tBr2q{$~uxJ$nMEWJkWaNiF)d+VwN4<&l*qa!vwj_s&7yBrK!I-HwZh0<J{
z0s*sH=X(1TK+~?I(V?X>Dv#Mi!MNfD6r(lW{V_v|SS3pjO%wD`url)I>F;s=K2d`Y
zvt2W*Y)}!-`D62%GO1guyn&zTp7r6uRXDx)wh1lV)Yy#8)w)5N<JUEA9X==3E<fN(
zvX+Bu39OQoO+7Z!o!<3fCX*H7H$yz&6qG0D>gL{$sI?38GOqa{&2hbqqXahj`ij^S
zSP0(5(@M;!z2OqxBz!rAAMAP+;5beB)OV~QA!a2Mpgqvkw`^Z1_3B$)LR3@DeX@#`
zF3AC@)Tzo<GF2tn$6n7Zt4vN>j{}p#H1)yiWAN8NZ((hl%|JQ@=v8C4QRmvu+GdVk
z$9eP3PmRL@ecD|!B09;_M4jy(%L#d!EuDG>=R+K}ic}d1zC4Us2#3aZP5p_p^y^pL
z{BDiSB34da4wIW%?JUuNcTFmv=8X>A$+UJjU=dOezVlhN;q>*=)Q$*xu~#MJ?D>5v
za$ONzZYSK@Yx1wj@*Tiq_U;5c?sN6E{5HY9HO@f7`0+!6>)sMMrVD@S#20`6rM?dR
zPxLu6U-OJf3MI^9LKXLWXW}suy)TiF(DW?&{+vEMz!cMv`26T=*I+5L+8$F(q!G&c
z!O7D{Q_S4-fE^lNVo|s6E5-@-cS~*HUY&V*q{6R*Q&VrT&yhwF0B8Sp>*B9{TS&HO
zDGf3`v|C~Ry!b2a&OAAwY1L#VJaYQVcCtLA7f?dwKGiU(oU8xsdy98^I^rEgZr$-s
zEvZJT`9Ud;oIK?WJu0^(<_t<;?49b+a%ZVjK}R(L^D|nJ6Yh6_QfEG-Vf?x!C~I`}
zfG><HXT@<%6iO~w7hR7&>O2a`aTiQJJPyqbJ6^>BSNTm;7639mZWhJ7AWSXXt>*%@
z_@`{xk=J#{*c?-?dqkXkqV0QIE`0ovsh#M*h|IVRcEJHY^t-$k*}UCcLTS6YH9#d9
zFH=RD-blm>rY!O@g?*fIu7AHS#P=$hja7!{_xG&GD=f`wo8L(7z1K#RBvcz-b>`5*
zxt>D3K&!@Khv3al2wpv%@NM8{_nPI7-S5Syq`A$aZ$ye?3AF<1XUy*mSvbdgyNv{O
zp&c7SH088MW3eSkX^qzk7E|;NFrx^8y750`j@2<Z;!SPZzAPIp?ebDB^Jp`(q6Dry
zrrRA&=<=^7%|e|-=IrY9ML?Bu_YBRl{eY1!dyBgIx^_A+`wNS~vSg_D_pfSSi~%Ay
zF%z`cLiJM7AX444cRjsznuKgT#JSZcWe;NdS5rS{oxdERblYuFQyME8re9ZOG&US^
zg?P43kka?*ETMhm*gYkx1y1Pw49!jVoGFEB@0)<-aEm90NdzWLAyz?gb?2~#zKVml
z3>T%)AR(Q~A#2%?@r_;zUmds_lg$h!=CD4&_0FPrw2<c0(7Ru~0JQixO7sYH5@n)p
zjv3Q=K4dl91Esj7<%+2FafI`(xZO6PvtQ>;&neR!6IR^@@4kiYnu^-Sb<3u`fT>8z
zSfv%dH=O`|STNIy>lW9)D_NJv7$()BdH%xGTy_!OivhON@x~ITY;J5So?e#u+1$c1
zZZ@8@wM(25t7MJ(AOkW!q4uRtew7Tm44!bO2Hd*$JutZTf&1K?p0?Ln&BF5ZCfHl7
zSpf8o4!q|q+nq_NtDV1^dv)JXVKI@1)Y{~uSg)f{BNbe3p(w@T^SYNNJB2mz{qmaB
zJ;LLHD5?)E_6JP;j9#*qTDfg)Rl=Xh%k|ZUdUcSl3TG;7+tE6Fl+IsW{3*%>l7DxR
zl5mF)6L!(w@xDIGZ~Cf+FRWBG%NJ^SR?KRdr=Q{Mq>sVmgT{7(Lv!7@VmViGnN!^!
za&Zi9yw%+|dH2O^`OW$w$chiky_<6Pl&otAhQmju{%vsIw)?7_uGiAw@);pPo}K-P
zKA22>Q)QB*MK<`uPEe@ya$rF!9tfhEoRdU6XXCE@tszHDS7Io4;rkVO<W+a#PdX)5
zRdC5?HdksNRW!uia1b1N+`Ui*#B#lJfBG$Z$f8S(G}B~ee1&W<i6_Qfc=$#e+1%dO
z@+sq+TP}*gd$inW^2xcwp)x1LT_x|r#$++j^HJ_7knWK$O68=IMmb-(j>7kj_=Rku
zgsQ$0!daO?V6AhM`lbuC05eKA22X!^wdOQ4XHsdz03Lrb{Catw$spcy=4xSzRMZFF
zE#{r)88wA+#FZzpXJ6{3W4*SX`GL*)1qPd7FZ@xF;a?(wRgcP0e)FS1V>v4z{f8Mp
zwBT!$HV6GR-gU2BO`hw?nrQ9j$#|xyY6<l>rj|qBIni%z-u>;mGN%QYcc`z(Yqb^~
z@60=1-bPz$pWGIhKn=F`(_p`v+=WL8*uhZ|cGsa3>))8y3(lMzJeW`L=hKc+!awe~
zo<Aa)PfD6HYaxyqDilIA!^v)Fa1&+qpwTBPNzokA`umI^57;+8s{e)9{tA)@asUjv
z<QMtL_9n&}eXk!)9zYM$H=4)={IYz{rk(U}kLkp4KibU5SAtmQwAMT)jHyJpaZOs^
zUCY5L(0lIc(<1F}a{T19#P1!94>q@M3fSf7t&1rnTPLZdo90^o!2nN^o!G|FARf=_
zyu}GE6KcFJ$ts|~#Gb?~hqhA}WCC!@?6RL4inlmvj?ma!n)SV2&dFOOo!R%eu;4X7
z91*}YYnJ>DHg0k}+sH-$6vl6$?>iT0&my8D1h@z}4-c;=;E^>HVnwYL^p7N>i@(~8
z+_;x;7}RM~`5{V+w!CH#`#e#dvO{lJX`+!?faJhLqCC|+!cl)hqSI;r`2~aavZE%+
z!i|^k15dbIOHKu+ZgU?&GX9Ou%Okw}^i$am(+`qpOV1hZh073p3*+@~JPQXM<NcY^
zH*E*BMK)_RtJxlg_=%6W??843B9s7W13o(?Y?WT88jl;>#92c7zvi(hEqtrgdEaDd
z&))vQD`9H!iaWTLxe_$J5J^w9BrSK~wjQ?N;XoaQabSqv#%m?LcxSJ==WN0l4*@Sx
zsA?%KV{Oqg{|i9;>toCDljn={($jIp-X~wRUvfOEhwxUOJ`P5`-%VMW+!2WA^U^7{
zdZ2j5sB!PJP489;?R^fcqFz5<^&#sCCAQc3?ZkKM3=3l1xLr*z#xZ?ZanSU(d~kye
zl&Pwho|zZRGXIFW@!Dp|NV=;3JA^48&<w~G`0*?q3y+Q{IED94w`!Yk*X?P-vQCg}
zLPu`Ak7OaURK^mRTs!cFm3B-AU<6abB+UEiLymTT<^4t#Xe<Iymuz8%gFwJGG90s3
zMGs0SBM0mn!q-Ow4iv;YQVJ!75w5VOw?Gfutiqw?E8Rs}x~ywy-RUz!35tNe-H64H
z_fUI6a&^OTz4eBXzSaD>blGlLdK!-FCjRd7(-B>Vh9#h+B7H^VZdcpOV#|(m4f}k6
z4VfcqwO5-S?Y_2};a5$ApBlblDrnBJ#^udB_h@|SDxti1F;&-|i~Ws6BnOvV2#3*L
z7EVObVs=({{#U(UUh<RMQw?;kx`EBlyk(<R0`>p?9@D(_Z2;0ooqk#r|HhX`j~i{)
zQ!X(&sDK`5srv>h$#|`@+YM|`lDLg~!s<n`t661yQXw}v$@@0Pxm;F_=6=NW+!&iJ
z&KnD{t96uyzAdhnC7b#Zf{6#}B_<49#cZnUpw>AX+>w&ERP?_xfPSUA1tP99PhOM<
z?3g##oMQF{Y;lii?)(uiHh}vPbY=F9+*4N>Oi+5=@Jb?se>ym}n3zCE+vHP4ky{Uu
zB5a_ZhyLL3?K|?VYM{;FL<gNsC!R_bk@j%Ss7{Q$1;C6<Fp=c-68?9~$3J3=lNjzy
zzz1uu^Rrs+yel;XsNRZsZ!-Phn$DZ@^EE3PMzV&9)xB5`PRltJ@|`>^s2#7NTzR8i
zE;iM|!p1hzV`k(7yjvwEHDdC+_f1_;H`w|ZwncAi$M}iK!5MAh+$*QM|M~=~nJ~&g
zuQxj9Ozdv=-47ZYcVBpl{kwmDW?u%q?dsDa`Ao}mGA#&kt=C}K$!hu|MBL~x!2DW9
z1ycK<A+6!Xoi0P>8xU&^{&G|Om6)D1Ny>Pq&11B&CUFrbbhawovHs~vkxA+BNV*T?
zWJ1{+d^~PxHd=PVh2;#1W8j$l#$NpxU^uuF`!0^LEE6%Bbm>DOKL(KQv{!jxor9wt
zWdX;^GvKspvw5#egWLY(HqkxVxT%1pLQ`#&;|Ysbz0lUnWl&Lz*OSTyrAoSl(QY5Z
zfs6XQ^*w8~Z4*koBzaZ<XRTNfrGa-vlO_1ba-#<ZZRAf1C1GIuTqM=MX5j3VtZt?e
zaIvbQZNXbo*Pq=A@zWZbZEDI^c1#nC-P?_P2ddg@1uB0A3-g-(lLYchI1AtYgnVS4
z*^`n_0Jx2T*X`MQqg)In+#dB))T8+ypiUs1`Q11o3o=73X|x~83dNwL{YeY~HJi-d
z<7&1{e7VINvPo{$vwR0-Bk(Hsr5L=$_7TzY&`1UjR8V+S>Re|<-&eLkL=en8e)Z;P
z)yJTaU?HxT<Fy$r%~mo$=GvK%y9Dr*YpcqHMjwb-tVNwxdN}o&%F6~5fRQv$>!MNt
zTw=k!ZoIFmHdi+dh;+US%HZV+O_$|QeH63)$Vp&Heu`3a2nWi4Dew*n^K+jTbrs6U
zKN|-S>~~uQ%eheSov>7}9$+I=4lCtN^+vAEr>M&>t7$f$S0_hDtBoMM`H?E+>?OWs
zjGYCN@;<vsquxt>4PGDhyJ7>kLs{IT1U)qdH4|V|OdoS<+Gw<=D{iJN-ULm|pvzS5
zx>mV(KZ2|3A2?FoS*5?le?aYoJb$r_pq6)ZGW>$|SEQ={IhOtVyoFU&minBNn+r?B
zzg+Hj0cIKptnH83S02<0**6M#Y){&D6C@V|w}ffNgPLHv@SAw|_uXpzwd;yC-816%
zZMXWv<QYl;+J;&{hjQW9{M&bJQ+iq}<98JpN@ACa*sMD&#;QkbD`_cSP4hq0L&7Af
zoIFfxC?%)A_<F1e#qLDHu5NvfW_6E@;-KI$J3Aj@)a7Ty?|=6$ZOFxXHlZz;xTIN@
z?!F!A?&(a77i`u1Y(u^fv=vObu^ucYf3VEQ_R9cXZsMmPF=MUMOUI*19GW&!ezwcn
z!|6<&mSw61mOsL`Ua_BNu@LGMaTVxw%mFvvk0A<_^TX)0BXbWN@9L=Mt2ql7P;Lny
zNDQ3q#7=w5^tw*prf1>n{}Gi6t}wkwPu+1(3Rt8yP^;p+GC)f<YTsG!=#iTmUy(As
z0YNp`H$N~_m*q%{LB!*Q2)xgBb`f0USSPO(nl*YFH}8e;Yb`@l*a9Cm$GM)xa(x;C
zsM3GUN1E^#sQ`Vebnp`?$DMJ$xYnjwC8!=Xvzrd;jb=HAc4vjkmZc?3D|2Y%){7y#
z4znW{xDs?a?+eFex(xbXypH5oV|0=59r}v0kJ#@%0Hz<;05nC)4z+D`%lZYn`Jq-D
zjB2~oZ?vB5^OuSAbo1wer<&cKh1zxweuGi25ZtxXo*-;HpSQN;Q-BUCCD~-7D_IPO
zcJ=Co7ANhg(A=MuWcH#8QxLK04YWe+O%H^U^e8(L_%Ziu415%cRjenV<mtS~B@AiO
zS(xy!Zs|Es%qcPDy`B`DdBVT!Fc!zCy7eyFbW+><I^h=Iyl5W@?J)m&7A&47x9t3d
zFJBL@cyrj}&d|>Ma$V7b!oL3jzyVz62VU`8Y);~-2U)+qzWt0fa5P!&RrQpcH(G6~
zxLUpH2vxQC1`4IW1C%NsG|6edcKB@dRcKMB-f2s=H6{0I8{`X6IFG%JO(wI_pElS`
zH`vE}*v|3+dA*^HSntGVYC=LEp)!CBVc|@(S5{i;h=JMJp6R5?8mYEKqd1b<yU3XD
zA!k-ocK@hbr#q(NHbj`yN=<%o9MU$wfUop|=z`Otrerk|1D^S@s^B#4i}mPDhtc&j
zI*YAW$#Rnsh*H4R54Fo0Da!bSH$8}Q`WT>X`5o^<4i&7$RJ)mTie34d;9*MzxkS;F
zTaa=sisq-j7Q-<6wh4SCT|%8=y@><tJ`MuYr~mh6jL9K4Fv9LV#6OOz90r6tBGZmu
zc5Lzv-i)_<CIus`BjeW!w(PO}vK>TcY_8vCJ@t6}^Q#;k#j&|MfcOs`mixQ{re9h&
zJF1<>)g_YrGS6P)B(B$cmu0q=2!KeB^ND??g!yCbavA9swnWb)JBS>~+8Iz(@k>s(
zlbDB<{H4DZ(?WGm_>N-y=o%U6@udb`*Gr#%jDYe!94oq*Q^CQDLX*YX-o23`tr-kv
zvy(r6=)`ZPY6<6eGNDoWIIyw(3c_OrYSiGgcI-iBr}-SR+a!mxO|oggZL+h0PcBs2
zr7{e#Yo*CNRu5BRRHjMh_k+mCz%Efy6=&;SXQsBZk>t6-c>u152U&~)b^*DQ3Is=~
zEWslW3T<<`AIdt-7dJUNXchOku2m<yPfR#f#^4oM2Fw`LQ#MEr!VS0%d;OMmaw&Ax
zXScCKruqAr#;TatNo*d{S0CsC<3?={r8$<$bxP%{d>xo^;=;gd^)r^5ZfskU@tEFB
z%~!|T*^}Jt^mrK{ecE=72VZp7$FMIv<!u8<cvCcw3cZwkXVkgIr&Bb5;X0Pd!dlV!
z=+=*RTx?AmB$a%&kQfuj;;lUYBP%8I-JQ^FqEIRxatrUhwsk(f`0%Rk_Y#kj)H(O1
z_oeWgeC6Vm#+uj*nW{}XKZ4bJd6R9EQV}j=734zfb+-!Ys#3Ht)mkudeW4pD&-EXY
z6X>NLP|ug4q%*LerYNckrM=wO9U=S_VW+l-2=~?F`2=qbblE>v(CsA2rKcZ02ug?Y
zQfKSN+uGBpJeBiNfdwosDypedHhbm!a#axIZaWtiAB^ZC)U=b`Wp!OEBf(j@HhmHN
zSjl!WJzgm%Pr_5wj4qR;3~(^@AXv(0j^`=I)ojD~<$*1b%Y<SB=W8BqxF26q)Y`CF
zPx(d6*bUSN)SeuRFRVN|d;co+Eg+@v_yf@O^M}H4evgJDE!T<4C~eU3S9i`xX5-I~
zLPcQev$kGIPNT&6uA|khlR)^F!lb;jC;I9fjO3KrlrtY{B17O$&QdaS`}5S+U#GTm
z8}Kowr^TVnUn6#H^0zDwY;yww`A?%pv6@T9md#eH>Tk-b8S~(Tj)ld{xz=AyIYVE5
z^5ZpUU$4-nu(Uiu1T4)7q9JjG`~$l9H~yQq9k?rDFmw)n8e6?0zAY?c#~vT)M!QPT
z9w{M)qsIX>&p%{Y;!muZSe1Q0ABa}+gA(SYRPdhlBx>sy!K9G1*EG1FCiZ=ydr+%0
zOL;>@NR>)c=InMz6rl!p=S}q4T%sRxyceufZ27z}SX`tvo2^{Hbu)P*Cv2<;LK-#Q
zjeDyqvxT1c<^&jfuA*;EV6sVHzBZ9$FKX|N8=H1k$SF4)rx2Br0y6vL>e)blXo|EF
zW{?xfu+EfW;~p=5t%XpvQ0>rx`s@ssFP7gk13s&pG{jPmy(-v2aznKJfxzx`XVK*W
z7DCLV!Wyx3oyW;JN*(s*v$Q`V!NpYZ>x8pWkR}yi_W=k`G8ZR4cx2@uvn|rS<4sSc
zcIh@j)o972^i@n(mnssab8Y7-9btsi^g0z?O%=rvja>IKh-)=8iEhfixbCfa__;i$
zjqB$Lk^{10T*!D{6k5`^bpa>7EyipJnBk{gGP~lW?mGR&viAv<uVxjO0w1`dAJee4
zm=RJ;sBz0pjnCHnP-|<-v32)s1wu#)k7IPsS0CZG#DK**6O4P33h(Y6c{oyfK6JL-
zTt4#I>{&TvK69KChg<WRkq;{JJ@3{poQ{;wW{ck7=ZC0R=L8|R*8K+$NBh08dZ}Tk
z98R4_W;b+88=>aP@r?v@4AC5rNTQSE3-W?YU!Ih*s22-iYA3IW4_;&Sw)W$!)(0~n
zIe&!-Y}l~|s#seufa-o;Q?=bUAp(CZ^Ep}KADg?d7wk@mn1|J~8P$`!tOk^3n}h_?
zGi&{9HFm>J-+=tL%9|YS+spge=u3*sNmi+n$<<b%V%NoZPF9o0yEm2KJRPC*=0wQc
z>5?p*W{=^4cz*K;HT&+X(3W*wJ)Z#nKr&a6JOskbUkxOHcAzP+TT3V&UEIm`a-y*F
zwZYOVn2zwSHBFqB);e6?jMN#uDF~Ez-eFQ*isAn}HIP<^EM9pPzRqfIeUN2h3;n1x
zCJViORwh+i{-fLEew`g#bL8^d`@WAoG&w9sfj!I(l=uFgy7%jDkAVS@?=P?SLq+pV
zuTW;SeFF0BK3BUD<0Bj1W@KBr*AH$SP#m*Sq#O4Xt93TSrs*5GdQTEjy17k<vu}e`
z_fsiqONB7w&d|PVa{H>d`WeG5Zw{C22oGkUKh`-pcgxmG*jw!!Ep#jI;NGcYwuOBt
z>5}oX=2?X1n&ps+vRTAi?(dtV&ZguvWRu3TS*m>_$3P%{tqlZHaP?_s0y9@B4sEZv
zN>X*8u{3F5-#!KOTGGNKhv}xy1TX@y)~WQSSvuh!gK6h%0;<`?t^b%0a&wuSvZ%NV
zL+B&~xfjL#T~)5s<@Hd|o1={FL$CDAU26o{W1r(4@K_q-s{AR7Xz{f5Gsp$ZfBSK9
zqz!4afnCVzu}|3~S>YD?4X`|4WO$wf;a5J^Zu&WO7${c_0G<|eR;zX%qbDiVhc}k%
z*FrxoF=^xGi~_al%&eNzeQjckU$~AB`?=2#mqxi4`fHdrf95|ABK{=gndW*nDUNJc
zr!sV`PS_Jfe;0i~QuNAs%mn=LmJAe=V(0ZErB5kWo~8I@)C$8cn1XqGg3kVM^~4wg
zSD3CYO6neA|Nb3DV$G?&y%h2BNxjzWt+cb(Rue+cPHjyjJ0E-M&!>#d0Qx#;V}{oI
z%CU0FmTQNWgpf-?*CQFMFJ?Hr9uGVqA~q!aTi6YZG3vkV>5>0V4;w|tEMVfHn#yJI
zodfH2&PQ}_K6ICE;4vdvkVVxi51P+<^?koRpzJGAMsCr`Ei0$fldagKxaIcLg1tOc
z-&(I)yO9I$n8*md62D<3MsZT+zyGX%Slco$c*Ik39;RJBU$I}Fgx;X(DprQc$C&Xm
zGzJe7_(GR65uO?9-=)_+u&1>>+6m1e(%#vDST?6C<rrzv`;O1yao|s$fHci@^0S}9
zM|{knK2=<zxlUEt0JIi*9(H#?e&}D4{ntl_gKIjTr!Dn)_MT|sR8e62i9g-041#e9
z(-T(TcXab!9}hHYQB~MpOr+h<^n!LqYZhjZkP=Ypk?Sb3$D~YG@OhgBSD194aOv1h
z7QSE?d%p#j&`y;zcx#xPHy8BfMW2yHzv>Hpx!!{DJnNJs&5&j*++>&g+^uX6M>WfX
z+&O`+gN5kl2wYR|F!Br(og_CK)=Tt6t{(U$-fr(L4j3NWqlZ*U{7lx2X%XN)bp)WI
z8Ml_DV#H=O0*9;9(4s22<V=;z*y8{}LOXWw^@F|IfO*il>>~g&8Tx7ax^G$7tV&}}
z2NmS&XVr%wy6FKEE4^m_ag#7qx2W&PQ(}$J{JGr0{Yh`+!TC|u1qikMidGfY0yeFE
zXr6)sfxzCD^`tfbKDcK&9$uf%1}^kkvx=W;f_yRi%oVt}&)_p!U=}}M#^ptOaXKIG
zxoD_^0NSQyi>#?r$$Jeezq$8*J9dB(oAmjB(O!*%k73hWP_}AFi9z;(8b{xwWKE?L
zBlc-|+V$m!$n}hoy{-8I(@ViiPsAPe%QDZSvfSaN^_Dw62RlS<PhQumVotg&fw}>B
zd{c|n?&&~#Th7bxBCzzOh3=qu0!@F$KeP~RDa0+K;)ZHXtVIf(_+<r>>k7n1p509}
zGi&gHB#}O=;a__rLfjWV^Kz8vzeTFt$)bv<k_G;*_T`fwCoZ237k}*KC?eQw#!Omk
zW6fvR{Kmc-X?pATDp3p^UrLD`ad61|xnVy*6RL@ytIId;jvc>W0YlBp7nS62Cp$h!
zv=tXnl=*Myk5?O4yn}+JmC9tmyoqDrSNGc%yxTv7i%o<*m*IT>%U@04`_0$*3F5VQ
zUHcor8^bZHHAkgkyy6-rbfv33qv~3j`mUho%)xHMmGa#ww9ch{`vv`BT`NouKo)5P
zG@B3abX7EL#v@PvK0<-lufH7-P$G@zazO~=Z&zcEKE3v-n>PC{*X`1mr6J1B(*NBF
z<`x$Is-^Clk4SXU?DsRV1D|<PI<{H(iY)Zx>~p}<Pb_u|hM57wx@TlirI2#(_rlRc
zaLeL(%A4clt_ne4CP&;$1;v8<l_%!syO<!FAdB_`+V%xa82{2_xqwa~rbt=}AdjEH
z*7V|6eb~S1cpW0Io1BC(e`-Go-Z=isA*<I^G^7biu)fbw33#)&3(<}XAARHsDHsT0
zNW0RvgDCygq~aeYmy%%vPn=I{XtnECqv$OVWyY5h@QfFWIEqYUc`%d;XKUo<GBnrZ
z@h2T=tG{A(;FLstCK`qK)J9!|CgPa)&L23}PFHH=KX~&z%V;<Gi`x=Nr%6_A39`~^
z!>F_Idpji!S}e?rfurGiVt3Bq=FSLhGDjcJXc95aUpkLDN|e0R1~7k>8J{U8z^vp(
ze}GZULPwl{UA?>AgMXnh|N5vVZ_s|8?s%T@0aalBmGt+(-_ON$u=U85_!W&pL^>z^
zBT=|4^+he0MFl_mh4ZAy7B4vzJN7E-o?%3-VZRFFVMxFXe`oK{dwMAyHt;y?0g`BE
zz`VC|*T;VZ^us~x53+>m<nms$N}ql<jd)Y!!YwHNj@aM7Y6-c0ZB|2?eQBI0@$|0;
z(%qbp-L;>+{XylAb@VBk|9xbV?G@IW|J4CM$%4tcwrK`5iI^*Hzrkg(e;=SA_xD2s
zeA^gkqZ?{t8*My4PTCJmqC9^oseh64=f}d(pEs%qHhUo*UZy{A9aH`L^tmqi@b}YK
zxGa+o4E~X(lMrPM=pr-+lb`!y;Xr%O&0BBz7jyq_@Mir<sfGW*_g-xxlKwxmkHC=G
z;JPeHXa(=ZZL!{}tBL<pr!7tMDx;pQ+loSeqPWBI^?NY;*y6Dy`)jPX|3sgADWVhl
z<@u%<CCvIz<x-6rTp#C23FoigH~D|+#y9(qvezpq`BVPs$N%pgwcM3Fu~w^;9W1lO
zy4-SL5OJwJ=Q|j4_hYR){Vsf}7aRKvk;(4f`FENBRAGoA{D&5=Q?Zc~pc>v=;y>sD
z3~x;CKBRExY;5j~((Vxfr!Vy_8(hLSm?nxFkK_!YcuL`FZ#i@Us(jvmpW}Soh(Ggy
ziKdj&e{k<SD-LV^^`C!|ge%@jA-A=)y%4{HQ5}5cd>WTiOrKF=oro(bBHL-iKmJF4
zE@N}l3M$Qtb$ZAG)tWz^4h2DMOMhs7{B<o>FtY;9-|Q5n`+M1>IJ4hjslQA`&$Yif
z+!NqH{U;H)5-9s?-F}-}YL}D_moT{9IDD^Pn%zs&r0lFCj^p^?`<+bjKW%%?=MJV8
z!vemWTB0^@^(T!Yx_#|KqyR`z&qC{`e6|CxT3wpGE?R|fJ<A*BIHZlt><GVwo+KY{
zvuw>jjDG#8N!b5Nn(=D-|6>3p8)uRK`~PtJD-X~HZ|OU<y6V*MO|!kVj$r)g&(eI%
z!vC@#KUD&MV8vGZky#;6&WiJ?WHPJo=&z<c{}_oYfpXLev?4K7x)oCQAeYB}F6GX(
zS=lnu*a)5yRVKZNy%S&iq^p0Xdix#86FsX+>Aj_*@5dj9{a8*VBY-&4zsF-R;<0e;
zUU$^%!JQho(WO04e~gQ#7@p#wcGq8%gUx#~Rkm*i?br!znihQMoU2y9z`FCtUY()_
zfw)>MvxiD0szBLZrX75_<y^7@o_Pta^v4SK{!59UlKJq}<B_Pv<EUXriMDfc5mw6s
zj6I05Wahq9G2t)M?`3CQH^+I=Yj%3uJm0YjS;Qmpf!_{{@~(%b+w>Mp3dIGt8Lu7y
zxYGH_R>wd74@3UHq|c!<5MHwMVSyu!2%evVDHf8$)MOVVK%G?g!1iAL#D27sPJjH@
z7N=_;c4$!IFND|Mv+XETvmz%LercV+tG7#W-hHkucEE{Vz+iHftjmEhVKn`Mb{(iV
zt2eB=Q*oUolpX5U*a`L13m!>Se~<?Z6(Z;jeAp{{;9t*#zNASNG)Vg2^~-ASz4G)=
ziYZX)+Cvc~*ip0#@(tSi`;JYm8#r8^dSr*T=$r80>jz@rzQ!^376(r`)q@XxhfTtD
zpJR>pgw63JJ3_!n_)X8RTjBo|PRz|@-%C}WcJ?};>X!c}KF5uOo?YcP&!*7x65;93
ze|5S4=dy=+btdY$<LC_Mx^uE}#)DmEO98RoI~rz}uaQCgJSiG_4;s|R*X_hmX>-`C
zu@zT-gp&9AZd&VMD3Hf=@t?!-QzS5ai<f9QG5{AgJ)E_#@bDif>+v53{-9xz=YK}}
zrz1s+Yb2snVWoKvc65}>Zp$RDmsb+-`=zoKc(I}4PtQ4ni&9>EKOm$p?`NGnt~raZ
zZ5-i?#$+zJ)C=(qHT$JK30;Dc|7rQYm+3mJQbibK_Z+p!o&8xe9;JfouMnSR6@#vX
zMY*K=Wl{RkMnwGaHk}v|uuVfs6|?<RQ$*>>sRS;|0IZn&@;atL8W@7dl8i61EJwd<
zi6`)>OBd`S!t(!d_Ac;D{_p=dQ97|oB{_@~m6#}Jn^IJiN=42R5)m@TZKP5;mqQXG
zMI~p2hLIc>BRQYjoEkQ>vGe{n>HYb9fB(nh`~7~tkL@ANJ-fZ`>v~?#>v>(*>-PKL
z+Yh$yYL=(ouabj2C*5If;ksn-?hm6qLr=l7(QRG$cra0f>11oMGsGq_I8&lCYWg&7
zAL}tY{w(KbUlen8JvSO@43pyPZ#B?BXM}?}dwM0@Y~zNT=AD;|*;C(CpSxd|db#P(
zpIfv^*eu6IZ-#sBuF#znrSv$x*tzV=uOd*zTA24qXgr9hP#CZuGC-U=!A~vZ*B(z3
z@I8*Utpg$ZK6wt`==lMg29svNLC>Dp?n@yhni4@wBObL(gRp^CAIg$9FB#JXTQcfE
zn5100BAaOuTD>ma$R2-6H38?}dVm_qQ8DGU2Azwe|8<X@QDH6bJag_kT5TR-l;P@z
z`ZLOF-ek3V>C6!N#K6RQ+S4NRdcRzUPT-SiahV~)@W;HY;MayM`CD;CL7T5aXo|sI
zb4t@OH)cdxO5Eo>$-V8(ue=kv-{$?WpP%?f4cE;(259!qcc6L)QN`>&#4Pd+Yzr~c
z2vT4P`3mN_1=&7XTdZ(dZ6$)Nx=JK)w}-W`IKJtH8O}BIS4~S|`K$5~`~8DTgpGyq
z0>Je$dmS(hp-C7CAc|!Xg3I)~CgiN;j*w{t4Z;eLA>1U2RoX-j9i4X?s;`Lj0WG;1
zEQ!pM#$$);=be^|LZ%&PWZij8ydKd@#<vML0{^Aa;HLHG>bN!Q${Z7(jXB5J@V-Dz
zs5kIBYS2YbE9F?5PaRL8)g`1^s;1vJGE@$13|?89>+nt7B3rH@HhZ*_9G!egrvp|9
zb4&@9r7Q%=fuSH`{nRB#CWR(F_xb2t&iP#o?_03OJJEw?-i||!6-hoAH;{3(UKO{D
z9Eekh-NKR_MA%an|GqUml%XFFLW@wx7p*cw1L4T<iQAWk;`WuBKDQx8@s4|h3Zy2V
zCp)bL9Zvzl=kEO%bPL2bBnRPwNKG<LOP#jkLSTYgkvKI>Uk>zHYd`4K++J4GZMMje
z(Yog0+Y@3VltwY@xhR=a;E&h9RxJ_i+m-cFBYg&W2w<^<Xmy9_;d4RFGQQ>KDvd_s
z0TuAJL!-fTME7qY<)FI`DglA@QW&>S_}g=`smbE=oV9b=`O?r!ad-YF$upIMZ4dhd
zKVzWPU>sB{ur`8sqfCS)#MSY%?1*dViKE%jb_Z{%ewd;9IU@&g3w?UT%@Ob*z+j;8
z^_Y?~nEU#>Y%+@eyZ|<^^E5cm?tn%~r#SsNiWgL(eA8Of8vWPT1Xq3S;-~I5n|7dI
zOZ#)A@R-ENHaSppguEdt6ZS&trk*^gAyH)D?TfjS*iD<{(9KHlZ?}aSuTDoaObcnN
zKFXd;r94oAw=Qj%-N_O_Ts(yc103&kqN#^Yyg5;vSymnHvy<g`lqC=wHGV5ZQGfhN
zdP#NG3;0tr+*vkdZIjE3x7JObKd({rbhJ;pSbqjNc|Z413U~ZrmDvbr1~B0j(7C!4
zcy;PTVODR4$MkX9`FA26k<<15zl~V(+>T~&@J55O3kDB3@~Gy~-}77kECNAxRuwLR
z!RTTz^SnoEK1Av<%F~CXCL0A!t=+B)xLNm*87|0sL#z#ciPG4k`FSECqtsx3{N#-k
zz$T1pTaAKa0Yh$X`pp*M#v)CyHVAC#QXJ2OpUv;&e}n?lxo^SAR}1oC6OqD4;%L%P
z%2DATzD_9#Afga66J>>n&%l2GyBf4-pb19nl1+lez>GcX+$)Q4%_7wB&<@yt_dDVm
za3ZP6`B#pvZ5RL~Djdc99*xkhA6padjlI!ePr9gqdR&2)aOpwO^3VcGIEZ?J-`s`y
z18+jUEfq>0`j72TLh>yjzyg7(<yAf!a4;rr7`znW6i}qsmp;)i!|DxYORT=yG#?qP
z{VVgFV0D#!^;Q%E;y3gMf%4Pq=hrVyMh_y?RiyI&Dmr}v>%4MYZ0rcJnnJtv`d#$Q
z3*B_~3!ptKPXK^z6vhKirbKx<@&-wSrNT`{dVJam---x>8iHRT5QeZ^bQd0vgq2&K
zLFHn*M(=oQV+o-&fnWiHFxevE4iUh$!skTY0&M@wp%U_4B}p6pl~LUt{itzO=9A}!
zGFMEh@mv#}AqO58RpTDGC^5aIJ8jy0wn_1~5OH_q@Tp1{=~nGTpMwOk*<R13EncNQ
z^#B3`s~|&DV)==a)8cK2aPf&`9|?kLqg^zn$f2|!Qqk5ZiirTQ+B0Vu_~=f1vo&TR
zDmUh8{n^|8Xxs+J0c2f_w4e67tsRhQ(6kUsaP^Nc1Z9eJ2u%yF{Z0S#f1l=x0E(61
ziQ8AU|A~r@8@JMS6+0T{D}0#!qeDo4c3XU4-n^b^2#w|ybL9<8R$^mzAU6Ve7W>9w
zccFtd`z-$r>IZBF*n#NHRO#=?>v5%1Q-QP{!JDdY(oY1(A`M}g;HSCZ=@gnN%VmM}
z_7j?Bz8az2fgeNjkT2-kA;?%0NLEUR>B{eD=m6ccRumIki`4QfUh}ziDW-_#JHnzN
zj{xYgOYBO52(fNkCaeP-t<ZF#x!$!|Xs%3h?i6<OCb`09Wq2ci9(L0a{WQTLSAuJZ
zEN3iIrleX>?*U*Ap7)`K7ZSS8$6I(@kGCZ53i<?~$8MIRCPJXRzoI`w1jcZR^z`oA
zs&^`9;!QPUO({KiOmO+UnnmX&oU5Vh=QQ`9NY6+Rb^Azdr^7n`@S2O&Pk7&up0A;X
zUI~Ne6Kxu^qKzaY)#q!GZLZicO)0HeF}MhDX-}YD!?YG^HdUVX(z@g&8E|y|#!y4W
z7WVNp?)^c}p%wd>ZFe1z0Zf0cVU4!_F@1K9+~O^PoH>c1=A)4jtpeQpyfA1c_&>br
zYbKHz7#wDXliK#ic-LBn`6!J2$V#oKXV<v?UdQP(9wie#O~r^~CX8C8JlFtlCB`;4
z6;;1RJ>cHxXVv*$z^5SWTmJ-m_iE>qPS6SvP-zi!ZZkT6@XH>Xjq1b#5x%f&_!AD-
z16tCbVV2-cnbQU|*<eV1z^pn;kQ;`y%0L!zj~L_vF?%`yM+%@7`qLolD&it*H_+?b
zw(9y5j*dABkF&Ju%>?`!f$Xdp08gM}2tdJj5N!*~zi&Ph+?xmPG@U*G*xw-pEX>}%
z(EbsOBO30~Kjo4XHMFlBmuN%W!aP}%>?Seo;D$jtEmw|CA<=Ba{PI=MyAS2kMImm3
z^Xbb=4XeEINsS3Pa*2F|bXr|yu;;IIeNa1m%=k3v)}-rGZ`*r8(``!PMX!pHLq4A1
zHsE|DyUBo;2r(Z^pX)=*W2!v4+q6r@YJBH$UY4y*1&)?Q%G1kdK<`f8BYWd9$WyAJ
zK}EdyMO6t~7-2)BXtY!j$gK<7QQ%f;S3KBvXI2v~1*~TPS9+;tccr0f3Gu#<5aCg&
zu9sX_$;|M7L5QA;{p7YA$>ZCHI`&D>wj>GC1c7*I2>YMW;QtRD;ro6Is;hV##_zql
zHWapJoe<*T;XN0BKi>B$&L-m?)@Py!p*v5xpE6TO!?w_Nav$<eqOQNHF(hXOxJp7^
zM|Rdvk2lOXvBbIVN!(39C}^5DCo375XXjeJ&rQ%G-btYTjhKDAW?T2oZKhuF4Enmd
z_I=#NtlX9|GwHP(k2@M|6b9&(+?&{+1g$J8FhxiD)Tnjid15_}a#?cYI-U5G1#T>G
z0$JEhNRJDu*WVtnGEjBoh!Nimj(Svc%0czA!w<m3hR}YfSi8D{BR>k{%o~!G0A{li
zrcBHwY|Oi$W%zwfE~|70j6ucDZca`9RQ$L9G|f;>O!~Oi5$o{;00#700ENYgeXE@k
z9_KIDG1^Ev0C0$hydAnj$ytyhc63Oxyyf&Anr3iFP;eUWH2-BTU~ns3Y93as(3cQ2
zyOCOYof@&m8K&pjehijL%pJ#Ti>@w}^D;g`1_%S1nrpigIEt?<!Kc^3*k@Hvjq3XG
z0CD@jf&c2|uH7&VTwxD|zrw#}c&(v@l87K~K?+VtzGFP;!!AbX768{btwlP>P&Pht
ze<_UXRLvE{fT<>8y~>f4NEm!O=COfwjKTfI+uF{(MIL>}XZNypBRpueU*-gTA4~5(
zA=Wz#(uNV#8(pGt?NJ8$klrWuCWYC(c#OSL7gh1p`%5N&(u}Yj8v!>nZ?)Rj?yFza
z4XzVt`tA<{Hccn=$?j+-Y+j)=%_fZZ_fCf+7wC67P5^G^EVCq0X*Ay>9}xbdUR7PS
zV?lu0gpeS7?T(EqW>3q|fOhX{jCD1xLTi5*_j(*RoE==zMV?uHB*2a1HC3eflz&*a
zONd;Fxdbxp0s(Ij3l^!)KJ5B7Sn1+z)1Mv+tx8=b59`+w<%@UM`N)-2Ivw@@q^0_$
zPO2i>dWF))O#&y^fjt>{B6%bW)v=NulE94#r?Jwqpq0Qj{gys+fCUCVvAl{GIqU}H
zLUBImf$O^>&fv|)l)kAtr#J_-P!trv4auN2b8MQ|n13>-O@J=yhY}YT&X2~f*~wJ%
zJdjuHQBnM}YCxq6ST+xXHqq1(G|MlfUUw!K<1pgmxh(Q+g#=<Lg4bV0**yY<Mn^RK
zLo$B>B=afqG}by4Te1`d*yd{hs#geN?^|$>zkLYz6}bAb{V9kwz$&xB9iZvR27p-Y
z0^ak9fpnRZ;Qo2fb>PQ^rm&BsswI{VEO<Nco-&r4fkP$|0H?2i+o3(z2|^-XU+c5c
z6f#+E!#H9#Xu1`cyZyYItaP}yA5GP$s5faiSt*C2VUJXw;%A~V!O6McPRz6&ZJrXi
zXO$5h!OwSKdj_#<na5~nJ!3JH|LX9q6{MY`rA~uad^T9LI@TU$6Fls0-l!5i7+3>7
zup`^yTd-JlnEjp~Tii-f@$T2Xul>uPGdthCb35#NabWXGd47f58m*&5jmn9J)e6Z@
zZjc1RlNvw|8-9wEnI0WnU;Sj{l=ls-4*c|#OLTUEGV!*gZ$rgHpDl#ljVgU9HwGkD
zvY7kB-@I;U6{k(R(H7O`aq<5gW_qGY1xRkwpZ`s6r&p3&n(I|*ZP%W(FPOo$Finr@
za)(AA&j9VOZf6Qsq=+638i-}m3PiV_Jn#yt>{%9#i|jNdb(;eIM`)y+7*waNFm3GC
z%9GyN<(-4Lu0bIC?$zgRS;Y}QEV(~Ht?LF=e;dpI8N4gLuU!sYqwnd+uU$i0znjY~
zWuAM}{*|-6eCd9@>HYXkZ$tl<p|JIWt&_%z1D>v_t63~V^a8`Bc^8mWoC<yf5br%D
zdef2g-y*Y6f^3o?>uoGbLC>Y}>w=IJ_sQ@{=!#^a@fHlERQ}GBuNKNxZ!Am8_92K7
zyzmv1mZ$)m(F9g-#LkQ*L~xxo8lQ{M+#W1d9W!F=jegHg-Ok&qt|Fo!&RdhXo|-#m
zDqQi)-Z6UdG;X1`d)NzJDkKn4z1tDz6mo3rA)e^_kkf&B&AZPtL<wtspT_?Js5x+Q
zjR>b&_2Bo~!B2b?2*!;uCs4Mn6_RUUE2F2EfbQr=9SVLzT}^mvvPC*fYeu(KlNJr3
zp|Z`9cp)ZbMGT1ZlLrrx{jhj0beTPM%l3SZ%T?CjKzv@Vqr(ihAex$ABvX--ve=Wm
z><lC-g+t#T2+A>Pn}+1FARQ8q1X!6bSYhx(u9!@%&a~<Cvm02F+^T4wW4;e<Rg4Pu
zl&g6;4SlUx&%SKNK8e{`YFCujcYan8E)ED?_KgV1e;sycy5b?gk^R*Frf%tB)t8R?
zS@Z_#q=)N}+qyQzN?EE7n)pS6LXGLBfWH_*PexiKh94?+?#nHPBVO^;VvkhhG@3Mb
z5BVOyFy9wzS6|@NTLdE&WA8eE0%m35AWY=25r7fBKBF;1@&TlHy+(r-LsXlu<9%%6
z)glaribMJgW=E`N0o@^n`Y#P6Jjd0#XW_DTgOHNlPpKE$6y*Ww*%zfXJBKJla1*@2
z-LM{Fv0~?dH2}%Nhpkq6A7K$Ks)e1%4%LAjpJiUVK1u2AQ(gVzE%f#iZqvkBI`=q`
z4rpg#5qm+~E&M<7!0js@cn#6?ms<<3tC!q)yuL(AAX7oK^p;2o96I+$Tw>pvr-b9*
zA)l;JUy~cT_jzM|Dy*hZt`MfsCqWl^qTovGwB<tJo@#Zp{fgpPzB6FxK48%rfY{Yk
zk>Ud(@DkIZ^*qmi5Pe09>_c$wF=i-TZ)stw!33g4DD3VvHXs$mY|~gXZ_O}6BMp@%
zA&AZBcFDYTCOsA0)d0BhPXL6wYO_SR5xh&%+^~$3=I@OzGze5bus<AYe^PcPj@C3m
zH(C8ae1(W!RC+_ZD!zSp{u=R^MRwA5&^K+$M0etG9r)&5zMuYphG_V@-x5IdZEyJ-
z>F%wA%O$kFd$s(?e=^uFrfY>~owWZdMLf%rStWW|*gcUybZHG=+M`B{{)m2PI-vWJ
znLSvV9&1>)F>N}1F+boIY5?uSXEkzHNfn9_b-C}r><+j)0{(<oJ_LlrHI4QR{+WCK
zv46OZ(8fM9T-_O!8u{L*BvCWU2j+uCip33PQ?Z@T;ZglH0m2Zt&9e-R5KLF_ePZhx
zBQldhnoC)MMZmjpC3xIniRy<VC%v=EJ0L@rcO8y?6zRDGo>@yqC%(|vO}P!VS0Jn)
zRw0!$+<JSH;F_7<)7(y*>HN~Xa@V<0z*tfp|0;UIf-)_V5#G{Qvc{KF&cDgW49}<7
zgKq-+ygFg<qR>@=@!wR!71Y210UfCgJvo0(IRKaJ(Yib+&RqJdDEjnF2m$B=;=-m(
z=kdYVNmgi3V*ztTWo!z1{)Y*8XGAfB1*)eP!{YwIpVv5%H4OzVQGGsVBIfbs>}P9Y
z^7b_M{;gNe?;CS05&S*_Y$h|qwG!J@tGxAriEO+GAe0!QUVLlMggku<nJ%Z<u;v&G
zM}zaMf}@r)4YmsY6)TJY3g4jz1mORTSn*~>thj3bx14lZ$<h1Dcd3b-g3h#wI;pHW
zU&dq>!swXa3X_ArR1O`}_%JFD22`o-x`{XRCi)Jrnta)jL1F8cZ-qV>S`Vpcpl);B
zaRNHakOZ*G7IBtOnF!~NFCHukbzGKQ{szxLVvcf?*;x}KpgM^fV@SqTcHp(bD5NRY
z0LR_UG_FY?mwKe63}cJgt2phKVTgYPLV<w%!TDca7S>iK9sToISZbwun2>L#7NvP5
zTRQW9%9aFah6{8+{{0m5Vy(m@bwVy!qjzhO+2qDFcO6vF5AIj9oy>_M1EMItg(wzu
z!af@L8r$KZSZpyJ)$n@@;8n3mEo5l)$n}pS;Y#|F%lY0zQESf8=QOJZ4@AHNySbpX
zaAlbvpbaK$ZImQQ{Z(jr%%b|6);%@t{{lD7t`f<29-NYq;%SGSdv5IpkaaL<HG8(p
zs)KOuiBrXQ6j3w%07MbuZqxm47O+u~WkP$e_x5O`DkLOC4f^=yfn*C>&%mHd|J()U
zVcIp2JYQZA7r`^<JCxd;gtZ^2j{Cb8fQlu|X<3LKH=-fj!G0(im%S_<v^7MDx*`%?
zm~H~+!dB>;Ux<X+^e$TKeOjw_bv=B}=QH;7FvMO{<{A4A<H#lG$}!ol_gh*e0V*D1
zJSUc#e8<i0Z=Z*5_`xo!T#}EDm8QQrFanGovLZ=YOE%s4wbbM6kRrlkAuFfq!AX$N
zY$=_Br+x@aSw=+_xd5BU1~Z=NQ)7C*l6v(5k5ur?5ey+}9Ul6bLXD6jZkq5CpNJ%B
z{H{kiFY3>L2GC0|WvV$=C3e`PFw?UAslAhJE{`%6uEv`9IHc7$H>1mH(+(6O19?VT
zzt{9t+U<{#nit7(*k%Y-YIy2n7XJnS_i5Vp4PK5~MN*_vDH^tI9<_>s4kAPED<o(G
zuB1;@OA1{jm6bRDVvK+w;J`I?nC*-9mex&obmrl2t@F=)DpqQH`4v90@fBa!+P4YI
zTVI(cuK6q9n-LV$RtnsJ#)cN;3L$SnQE=2`4CwymYu?-@sz+f^&q>l$GU^15->^Of
z+qd*GU4ecPzW$lVK*W-vY^U3QAQ=855vaw;zB{P8mVO8bYla(AjIXy;StZ}({IE<~
zOi>y(AGMOc-cB0~i8DAz#w=c_WRFC?O}k-JP1{*XpD0YU48@n;v=LIPH@lZz;LHIA
zDrU~gike?hN#jOHP!x&BYB)j6pT9$_E7fi>b!8ALUyxqRwgZVUGTo08N)?4MCP>T)
z5`^geoQNNgAg-$%-d}mzJ^_&P^y0Xi$)Mcs$h&DVgJrM!!FmtVzh21l?kta5aKPu9
zCm0cnHu^SK+^Rutg)xp6+_cqsZ-BlBqiqgeUwz-c-xG17!}oCf)6;9EFQ-lK+*D-)
zQ_mUWCS#75j;Kb8>6fmmJzM%}__geb81HIaVxo?JA@oQ9mp4cwr&6<FOa<!K++#{u
zRf`)v{usB`0WYEI#aM?rc==PO5S7n}WILpsr3bNzdDVUlJ<PZ4KqbJ4g%mFS%H8vD
zSeI%SM07Vz6TSuWR>nz^V9%0Zy`{i|`dJ_h9;lIx7J)tcxv^BqUbO-z+j3PlreN{)
zO3@9_)mV{iv3b2~sL>OvMX+n5<UPv;cZO^<Xa6QW+W<W=ID3bFX0H-o*S=e+ds6gV
zz`W<`Fnv%tnD?pb(5@oRw>10xg{(TuRvea$AsRp5u9G2~SdJxR|45(w^1b+auS`m6
zsllEx^IDZc&U$I`wWH<3liK_e97z2J{t_(Kp^#Gt<~1I<`5V7}T8o$`Ky}#*B+Bi9
zVeo*8TYBqXjcF_d?qHrk-l#swKY`k#7r{Fc&HFa5$C9i(5^byQb(gpU^8`qw)V-`S
z5nqAV{ljgGZNw~RcLU4vaQGy4_hijx47pE<SfU0LA6gPj8_!2cYbCh%-}`HuwTjz1
zq;|zfZ8V<lU#tT96-qVGsgGr`oR&ELU|f~Ml5?_Fvj>VQ>Ko;HS?sdtZLR|y<e)Ih
z_+c_J#~&99I+LLS;}J$7-KmAR9*rYV=$tftxp43hN^$-@fv`CzC?{pk2M!%ya!G-G
z^KWJOgnn?SgUou1w`x%%I5&Sg5#8RyqkvjY_NYrVrc<v!IMPRyu(w+B`Zt7K&d7-x
zW1Pf_QqDrpDb45r`IH=xDwWw6;ie<oeuBydT|Y~4RXw$c5=<A{uNB{Z*VClA@%iAf
zXKf9wpwO`hyZ(EalN}|kYJUYHg^knAr8^BC|47~NBicqR!{&U^Xoauh@JLc&=y<X4
zL|b8E%B@=8FB!cs(r)Gxt>Gh05jmc{)ItJr>}VywYq>>2wq{?o{nf*529*mo8H)H2
zp2oxtl`8osI{V#{&bgTCd?JQpITfKxrYI#l@uPOb&!>>RQN&3%TdgbTdt4qVg`9#P
zVXtQz=PCWz{(gvZlUZO>V^lNoB}Z~OM!$yMoI=bnH;{|7_wa~0?90_atCS;`OI<>m
z-e>Z*;)?wy2K5rLLDT1okmN_XE#jXodM$6`P+Y3>56vmaTx&U$8=N2MS5**@n??0M
zUBzF>_T}e7mCzv!pNZSC1J9(;Y#D007R-)TrcmfTL@$*=&hWlb->|yo@E1@rc~gf_
zx|qP8AbFEM`PpsosgER`0uZK2`%q2c;=IWCv%4qEGnJ-6G?DqJ3W#ph^6BQ|zKGou
zFMXs4nk%*9BJchsQPqCiBB?&n*~aUoQb0fFcIe-&X?CWD#dfqA-qemr^07*#&j3c(
z#a6jpsnp9;eSBZ^;5AaxtKb>t;q&er1WT^dy>Lpr(SQ~`7{~GAg&wSp{o;n8Ia72-
zB6;>Fi<LXEJmP~H^6S3-9!6$%*!hk(6egkBCR(P)qX?ar6U)fOd|!Mv&&PGfh|E{0
zoMGE574jqTo!>jISBVh|0ysHCKICu|r3reNT+Q83+2M1)(jSDC3899MGF&PN-t|V_
zh<ZHEBO|~6y&bg4A*H;EdB<rtiDf!r$!p7d#ME(H!kPbOYk{lmkOTv8z*004IV&3!
zr*DCz<vJ)qLN6b`iX}2Ub(}+Fy#wEex-3bQjw}fQ%^D|UclUy)EddIt3RFIx+BFoY
zwioQK1_;7xa*gby@1#2eR(;clu;XunRB*$xI4`O+?=;zbO@Vc|XYlC-E9vS#TL5h9
z6JDo#vX_A!yYTkK;-k>PEnbh$!eQ{-A(RV?g=E3_tmZHmzxyF0ev$h3eo-FdKL|Er
z$-+lG#>({OP_x6-b}Xw=t%>JMMI$wL6@6^FmL7o(T-GDHjre#g^3AIWqg&S>u_SfY
z?JcSzCpsfpbG=DDXG@Ge&Dy5i@y>5vkHH<NR>X{?56&4)L{1p^;`LVc3fA4w1U=}@
zPeLi9L-!Ln^Ff;-kv~UMAc3_;dfHsgw*fPNBF|bMEC^H_{{ua~NX%f&gnA41mme5r
zW(wbXGlsoxRW%{SA1OV4yU%qO(hA9zK%L82MieGnBKd8;goepJ78o^-pf1Jf^gl(j
zb}*+3Q4jT<3lHThJEWL%8q$5)!=P4WegiB)%A=j0oA#0C8N|hg=IfKszAUbwzo?pO
z!>WRxsvks6nnUHAwD@7JhcCpU#^Oc}pr7FSo?BwaMSTbT3c3uj$)V%eDw`2%6G+$w
zvs_~{A53KWrnxF;Zoivj@C6l;!htO-O6E+sm$#T#kBbn`4hH}B4m~@<9`ugF-!V_{
zGVwN?{D~XH%MNvd?Oo@lb!XwFI@Mf;DRpU-ZChnRXBH-+S)C~@^x$7T&L|Z!Cx9G}
zPxGBH9ARR>iQarmh@bj7rB{zy&!ZzJtW-aSs+l0CwLVx=X?sbL^y9%hgR&etApbC!
z|IHO>FOrq(@|CWsU)ycWux`^WVp^<eL|FIT0)@n%CBqrzK+R{-YZTe8Ohh3TGDN70
z0i*KX!30RNIfvujI>(=|4<f$I+136rz!XZ$z&vw?R9`{PG&$r8;$p_Wr1c_7t7b*`
zPpX)`$kX-<TSbjEQ@k|<luTv{r*Lt6YTO23=5A?Ht0j+@lA;*$V$61#qvY@m_GNH`
zb<_~+5lRx6LZqfq@9@X`sm|q!l5fbIE_M|G#>^#~x7N^hFe_2?r*e+{KfT#3w-yg1
zD~9?Z_W(v1JG7Vv_t#3>*hGVSiwp;~&N)=FFFd*N`E())QUl#;r5XBCOW%e!BjuoE
zUgpmjU{5?h@yOGU`^9&2WhvXO2k#E~ELA}HMBULYE(;`bC-`Sr^>2W>un{(E)NIuI
zqs(i52WlEd1LuJhKVjf}|Cu=d^nl^sHfBss`+|h_a!RuZTom)ju9T(zN=d&1l=dEc
ztGvxqYY^lP8vtQm0pR>>6cC<)oLYexZYw7NpzR|WlMIpSGaV(r_5X_B#@jj)o&-T%
zysYjAQR=V5Kc@-asX~{oTo~`d)&L#_-wNZ8r#znAx0EyA9XSz!;&?H;wQ4RQCjv&4
zKr*L$ok+bu%vybJ<~QGgakwQCwkE&7<ZUqg&3dIV%zD(@9HZ!8Jn?2iYuSrJB1n(2
zehX1AhH|2apWQs3-gLt}8LFOPV`0!5c2d(Dm-6KrRkYcTJ-Bl0@3+3(ix^LwAAiK+
zmxeHGcA?I;5I^|R2f-6FqHh^&JM>K%tAb|t)h{%9qq<Gs%-rc+B<q{l2bGFyl3TJz
zZv}DgQ&sR;B-2lz!O}qyq%*yT!)kgQbb%iZ;|Li9!zUE(ly?j!=xP(@Vn<GqotN7S
z>~m3FSQEPUY>o3&J}i6zN<cIsE;VJMguTLR$q%tl*(Y;ho<-P=7;>2c99FjcN5yj*
zDy@Tyq9UJ?A1~DdqHra;vuSn+|Nf;mc)3(qMJlcKUn!;T$*zU7YL~Z622cG`$t|B!
z0d~j|9K_O-Epdh10emxzYf|2F-u&41Z#>%c)ci9o?rb5BEAj>U!Hv`@^4zo5H$s2e
z-RY4F#vsG38-J+Ax_!)-D|%MZskE?uApxTQLYjL&x8>nSY8vKsWqSS0hYdO&X5JUk
zOX0JFbnB@UeX?$;(>uH1>cHHwri+-Mw8%Kn;9!5td(_th{qspEjz9DJRZRXqt>Fs2
zE3i`3;^okX)CP$A<jnEbI7|LL19e6)yVRf*L0EbK3N4{U&bc)=x#ED$BWSPS!?W<W
z+*>f3CgDe!eK|nH7W2U$rQb|7H!zd806C%CP;G_$9SNXx?NmyS`1iK}g<8G*-Z^#F
zcqmCkS!71X*QaLU{!%U%KUU$S{j|BU?4PaZGp&S=saufEUuorSuCc|);konR_^BF(
z$eWP6r)wB9pjHfupM4>o>`Wcx&sS5Gv6K(mi{4u~KQt!J4qDhcggVNi3owzoCx^JN
z&Myzk!xkZ45-4vCTi@*1kh*c#o1q+vWxAn9g36+<mA#%$uH<bKx552QY<irwj!WQ#
zM=NPR$={qe-G)6_9xz1e6e6*D&u*TECmN3U7a>bo@^hy{f>>Ugt6P1hPtbrm<9`;l
z!ep&h;d2MN9<r856>oZR=I5B`2S@##RpGCIHbVQR?Fw-=Jxjkw{Hayspii71-kgtB
zEXAqx_j%yN5LxJxLS?ToR>qaKi3`@FjN0wJQ}YC$ds?*1f;d;3!?l)XFJ02V*H-Q3
zJmsg}h|t?z$ay#XtD0sKjKQcBrVk^2G>Is|;grvMB)XfHOp&Li9`MG6r<Fu^M#xlD
zK?*@B#epI34Rn5)W{SA>qK)7y8Q=*Z*`NHWEFM?isWmM{Yip&8!qM!j^S!wg38&m5
zi@x_sgNGUu8ZWdVQRvCP>ZN;iE%gTdi2iux8H_=p{@-S}s^FW?V*_44DqH+3JIMie
zdS$&i%}t+tbfEc-6sOsKwUB-U$<7#BV)eEdz!pAh8!hn0-9zn;a`NJE$E(|ODo3{W
zO7=pacfaxGp|VXkjp*+o&-hFi{LYy)v-&SkZB&_o_53-D0<F5%FSdt{KaY63W3E7|
zikj`>hR>Rt|6E1#UrzlHx?KBoi2A`2cV6OHpw5?!K#!`S=ab@S?SxkioYLRUs(ND*
zb}$^pP__)y34TNavz+Bwy9+KYpTuXnb(HoKE;c$v*LTFZorA4N8{w7N4(RvD82+iW
z=RVQ|ZH`bXPw<cQ?6;wDQ?&RVrF8Vv;WZ|Q%9w?wCb#X0{99z&F1*3VHF`|+P_<vN
z_c<3;(qqLHg)q6gIyfS9@PI_%74!4JjT6$b$;u)YKVi@gPV@M$`RwI#Mc+EgjBaWo
zMk!@N&w+L_s6_?x%%+Bo`O1vS4l3jPkbpU4INGy+5IoF-z6|Y2VZV^xaP~zL8U@&g
z`uDhxguD^i$wv)6u#wUJdS!=FMURc}WAvNk9EsL|n2H)3`_QN%PIUD+HR`Z=Y8B1*
zz4uWzZ0@+VcfAPoIty_bp*e$Wmh{z(dnFHR22ty^#Y4n@hx?O^2D0|d6?y55ar#_l
z)!~vMccHU_bD_`yNldI=Q-O1D=kj#OT7#Ba@Yt*9Et{-kPX@kN)BQJ_8!BA#fAs<K
zb9W%p_q1&A8-p(yCJxU-3Ute|N$w*IvrbM;=RLV)4xNyV^U>+6|2||#rur`X^uXwY
z8R?!uG$CrLvIR9JZob6?wrDlUG}qm$Gix>j*Pq!hrTl4p(E&rY4?5W25N#2OCwMNm
zj`CcYaHTVxc?=Au)BACexZq-7n~*XN^mk<fglSshKi7xkdW3{k^aP=Q_XybeGVIAI
z(UGF9vw@VHtQ4PKptsq+sZJp-&6~Zel5n1XZG@JGmBZ2_ms^pLmOawF82*c@WmpZa
zg%c7nM0;Z#XxEmDGxa`aJ*GhpPT8;xL+>6Awj@3WbCj9JFk5i1md+7AYY6d5>uMUl
z;`+0$C1N_33uQh6^a&jjRRPW2Qn@JZu#77-u(L;&p2bLCaNyMI5w|pbPX9_8<$o0+
zsswnbmFfjeXc2QHhPHWE^ZnwC=cHvvxxY<_DI*J=fgzN7J*3>QxYEHdIrN3kT0}hu
z-ggFLzM7n@2hDZ7YJUUi$|p1t3t*fuAnoWKwa0EsTv{>*<Kc``zEe1Kk`ghJmmRG5
z+2RmTyLn-Q>L8zFQrVKhO;abZ|8I+N6Kl0D0RDn@(>GWS93W3k8=#w5^b7~^0B}5;
zq2HbXNZ~*t#VzeE#D5w2#iB$kO4mXq((M0Kdbl%eQMjAmTze0mGmGbrS|k3^>o#A=
zyxhOpV~_BLmjHgH&e)Ps&s@0fKtl}>$Q$QC+!mV&7>d<=<y1lF1hkUGMX7?IBhT7D
zMFN>W)0_H<O@1~SjFX`@a2->|Mjw)yPRuNF1=RM^z%wOSu_9`z6Jo3<-R!_+4*UA&
z9Y!sGikwhh=2dcf$eeIa_Y_QNS$5=LdG%P@Ytnp61eoQ=yb*Xis4)PA)}Q+F0maR=
zBr2em4sE(H9QcS6K@Lg2qJpNb4?0J{QMb3vN}HKDBw!g`KqJ{E^Y{|iSl$2voeX0Q
zk0!$yV-gc}c+T6O=zu(Z!i~#3y7|XuG@`GE>BD631F*CD1mpM1vd`oAEpt?`H~-W<
zgK^Jg8(vKnO{X`A?qL9T2<34_$Vv4$^XE!l=++e2QZ6;m8*6G74cC85DxB*!2)qcT
z^{c6|rls!m_v<|4!z&cbYiiy{CILls^JgObSxCdTu(TOvG;k;RWk#~TQ~8n6K$<+0
zC^DkV=gpyxfI=ruFq<uZQ>!7t!C#e<MGQKgmr7SgExTdxTaf==L~43Kb(*vO7^$SM
zIs%^8@QFlketDtU;r6RHW_z?G>(qX%wDn%*o^ZL(bJBe@BU8EzA|5_q(z>HkeVxmj
z+wjU?fed+ogwL9`X57j>cps5vcX{q&JiKnTJ)!SBO@q}hrF5hjDsS1`txkLj^f4r_
zi?wMklYV-Dzt$KiWhfU^`hBSI#r6=j@>J#Yi3CzQ_v?cD<@Qq(lhP;xpMq-U!$}s>
zu?EavKnh%ro#OgVfk#vWs>o2K`jUBgm-0j|YWn(!|IZAbI`cgkS!3B~K(4l!@7UTH
zFqAHh<&Q7pQtlW#=EpsE>r=*8*A!UXE*cqM`Z<U^WgoJbQQB1RJB1lh#4b#hw+w#b
zp?ir<@L*aeA})m90!ae1!NVk^l^2SHO>y9Mm$%4(ksY#=ZC!JVKP840C4LzMQ?o`x
z(l|dLyf2(~FjC*1#8sOk|Kzuro2wtfb+d^}qt!+uOf>K0QvR!-HP`L=&-u^&#1bN*
zOUNKx+UQ~LAQFby4uZw+<OjsHAQM{#CM2-^sa-tJIM(*iD&F|-_d&ER)Q6$+Fyr$|
zOS%>?JvgxOa>e=DJJOb)vwJNFs;rbtCVdBJ$}InncJ`mSweuzml`V|N0MgoqU~S>p
z+|b6i(WVhTw<fui>*SSgmKyq^NpP4C2<TfdXhGCgmThqx26_`oD+Ilm-6$wC%0D`<
zgISr?Nc;RxuZ=+XxvLr~X<DT3&EL}_1BlNH%bTWTv=)~>=re;L$>eIL@r*vJD0J>z
zB1^k%>4ybz0>)6FJ_3hk{cO_=skv3d{wdMA3?*-RnaYG#{<r`>;!B8fIK-djbL4|=
z8|*0-(Nc{IWkvY%cZs`Wl*+3(*c7RN`}gZ3&R6D&P>W&gQ!m_^uU)Ncfb$6Hbx4xJ
z5?rYFNqWAcZdk?i@vhbwtx-i73(pG(n$b93)fZA<yuTMkikev8E7M{EWp{KWjPfG*
zR>;|I^CZmc+Oc6bKBAI-{iS=q0gA3$Il+{e2#*^9_jDeb_`1bjp3ic#R~n@;F+`rn
zm+@ca?p*YEFKX&NH9rD^YXV1?oK7Q{n-eQX**hw0cDLes9(pGadLat#@s^Ox)+F(%
zt)2KUpK%_jQ@lbjlT75hk?k@G?+QZ6DwQ^n{r$;B6B3h7TSU^r&N_Ok#ut~~aI;&q
z8{1G4w*F&yXuPE3(Q!%H=Y}WMk8X{VZxL<TRx=j*0Ay7ssTV-`*e5wF<){|EwXtrS
zg0vJTQHCksa{KIXNsZr!-#<-<^Lw(pyMGi$>)83r`nU6Exucj50p6B29eYFPc;kr8
z-$x;Ft}resyC&{c1eogLp3#|d_X)4>+s?*@R}tpHp|uALRGZI(u?NOX?t>T)IMzg?
zOHVqtSbQy{<QdmC8&w=h4Bh#=#+5q+G<3bTmqRm-GmZ~9)|qD~p!+O|!N*#U!=*4W
z!`EKM41eA@LOD?(oyUmo_D|!waTx{-gU%38suK5zJM2T(PTw$rjenk}WWt~N?ke-t
z5oV>h95`H;sy;5+u3<+m94+bz2spD?WAvjl+gCa-sL}NB%}_-8PiYC9HkrZ|XD>I`
zv~NyTFE&|{`JHsAYwsKN<e=ekUW6VwIT<1H=97l|xU_O!GV3h82f>zsbRW_SIBxp!
z^SL+GmW}v}iz+hBp%x{}1nxd@<<nvZCMwQ~UbaXL;a?dP?C<{}uU>HOcN}^@A@2w7
zEOlDm9oljDkc!EHqwmwLl<3EI^#qr;T*Z>eCaN=NBy3++;ZyTI@RA4@pYENV1ED<T
zg^TL%K3;hf3Us5MTNv0y(;8r{lwb+VW6O12os;fMkzC0Ousv%f*ka|rr13K4W{a|k
zKh3Sq%S}7X#ml7W8;?(l05^VEd5W#uHF3Dl65Q%guEDi-OU3)$ncDh%v7)SeyTIrW
zaT`zwKDKUp3+wf-&qG2%&2jo+9>}}L?{BFY+Y%>vr?#M8gmPjhLqO-0Shiebqq<yN
zvjX*2nILQvv>60mJ@zGVY?O?~K$uJfXe{C&Wu@)X_=H%Di=k{nlYXo7dte{xZ32R;
z&+vB&nW*bIleb)~di>f#Gd%Rz4puGtV)TBW4PZ)3PUPyWh@*pXt8Cm)#MtpbQTvGA
zF{uV29sRhv6p9O!xx?TTXk4BilZu2TPgL)rk41!zmB;Q5(Xs9kgw*3G>Q!6O?#sJi
zyF=oKWdS99lfIyN?17B^T_vA4N&i_Axr@RZuUvU&h7)2Qcz#_R8z!~KYizx}P^SiQ
z{YqW@lf1Y|7PEHtRMu1-cl>l<=PiY*jo?~fA$W}1=;(|rx9QZ*4YR7D0>F#eDWLDI
z9ey-v1FeCu;YiS!5W|s14ZkiK9Gj6nWh_<1&Q1h1m(4!WMjHwUuRP@jHf|l0sBoT<
zu;To>Xi$91Bx$RWj@v#F2ys0^zO?BU&Pt%L&V#bIN^>AEhJI^V76xV~kJN;l2HTE_
z1`3UQ^Qw)b5N?I4o-9Zpbsp?x-1+n9E2k}q+WsKiAFc&TzQ(!3KojJozS!E@A6zGV
zxb<p|3xdcp{a`!TpFIgxox3AkYl(%>#V7(Gq98(TW39-;aiP1At@F**F#^D(;JC;h
z&9TbO&^?k+fvJSL{#%-X5nAx}TS9O#Xc%a7od_@rX1TFa<9po7R1&&#14oYGc#|RU
z%4CCEcK?{@NS{u&sDjrNumC6UN^58GSbH5pqq$%3d+YNbV*c7)Udi8Wud`>)T)~~d
ztEsMB(S!a*upd-0jsUC{^pGGDc&HjC45>4vTpkbH#5Lk~U^z2jpaZ3lZo1&9P1s5H
zJ9b3BaIq>DSqsXJ2JQ*Dk_BQ#upq1!Ei`5n_LPfUllZ|3aI_hYHN0MA4M}ziuG_Wi
za90Uy<N(3RpeW~k+r8mqZ;^K^?xTSPh~R8}l+ppFnJ5ULh>@_`<FJaaHk92}>%Hp>
zDIPny_QV~P(XVZPX^pQwoX}Kf^vXdu%8P9JRAzT`He-z!DmPc2Qq4Y?!Z^=3Uq8K4
zAw0PAz`uZu0#WuCE=4-F&`k4=_2zHYzs|bkO-S8jNf88-Ht9r+thTBo^s8opncbk-
z<e0((ZbFolcpRto0OLMnrEw9_8i!cd%Nct*{ME||_-KkU=R=U(ZG2Mm0bj|}mEXL-
z{&_$rnxNr;dpE2e)mdf(bZdNR5nMxx(_x0ED_hGx#sO!fk?!`zEAAOvdj%%UacHey
z@uku)#l}RCzk`|$;zfvpL3g{I`WQQ_PZoCMjrS^R>|;GdW;qy31;$2i2A^_~HCBHC
z(%)ph_fDA7xDZ1Cx(5k0EbLIG-Dc2RqaOo@PNx9Y()W&X;>x7c{s?C6bIO~}4S~Kd
zn80L6#;t`-tG*&2ye~G4x>3cX_R#spn-0cxhKL*zm!6Gu)Q*q{6g>q=kN|x45+u;K
z%y}ADOIvSyrz$=zyhSuHTmrrc^MHHs0=uqe*Hn#DKryDzZdR2eit>=%^UlD~D?Y8R
zxy^7QdWmsp<<XaRt50f4elI)B?wjfjiA67omNMxD%CVfkK)OLt3uu%u+_bh@Yf!R^
zvH#=ur|$#3IZ-#WUns6!_X^29KOyXM9PCFeEDe`6TL`9Gx1W?WL`;ndL7PQbPA+B3
z3-@&*!DEppsSyeFcUMMzAFhr1QqsP{TVB<Jj0hqT&K1JFS>v0LW0AnMe;Cvayi75Y
zXVx`4RjkbWo?M;xl}9noJ7I3Nk4I)LMARL%y-(`6yB<cV_d4C>mEeAzr1)>%08F`&
z(680RuZcb45^tym@~@Z-kaDi)Ab$>S3^Na|T$xXf5nzQQt+20-J{aqh@p~G&(->M?
ztyZD1tho*tyo<C`^K?woF(^!xod&Tq_Ha+EuC-{DvqBgz6E+>^B$W5fyV$|+y5p%N
z@M~R&!rAX2`-he>nzebG1!vD~@7twNObIx~OhY`GtjW{@eyI{wrwR#9O%^S`c>fOv
zFeGlj7@JA2B`03XF`p6*n*cLN8g{)=Kj+?+`=|xpvhuC#E)#)K7I9ms5j@6(ATkWh
zp{iZxgaQ4d599SX`)uYrU^Ec76a^uT)%qnZavwG-IB?<%ea8I*4bZ+(q4EyRmb}?@
ztm9wkTQK;=M+CPt6jKxxBFwoH=znkVFdN4+?uY!D)Twei20xdSJwyhYX+}K$4RV3;
zvD0dnIUD~kR)Z7<VACW5zh++B+=WkKKWbn<=F+$&_TF;Z>yhCbfwo|tlcsN&w4BJa
zpuPa8R)`|-zy8NCJP2^MbHX}nktuV}wjvFcyf9n6ech?PIg4h!ZRg(OMNKFr+YRmG
zB}grwz#}IdIwWEQLND#95m^2@CPuCcp~zN&_+POPDbEx1hy~kxBS$0tJh+FVxq`q!
ze}}Cp5RT2`DOF%3TlvAzIKXLkHj-Dy3=RI$gU9;oexG=IO7Fv$pU>Oi86Fs3V-{4e
z9dL<$+BTpSFFtN)ZZ}K)7@}@|kRfkk^jv`=1Y2py2)Qi1^Z;=<7V&kpgxhzOvA3p2
zU+qdrn6$h}J#b`_5sT0}20R?&j2mUc7n{eTSDTDqJN7o0eXM*ew1zfM1qAiFe7Bn=
z9$K@rzl`%A>iOS&W4I9*Xo(aU-?{eNUPp!TCFrbW@4Ce?2#9|8NAGek1WhN;d!&H9
zhZF+xnWeUiztA^l_=_eaa!lUKj~=ifzqrt!KgMx}odGh;SLpW8I>yXIW3xCTEG|WU
z1NT_4(>a<D_uw1k9-XZz0KQ*8Q+bLP4|MMoVs8fS<r=~sy#^b{emwv*Xp5dMSlzdv
z&MR{6DS#!LaUfUl*8}X!eF#CIC=Vpz^;Mqj<01^FgB(ZVLEC*m7JiYq8EA@meGs<N
z$hY&~Z~>m<GI6nA_MryBY$~-N?P07ZcK`%xEhW#UOfJ1iHS8(L(pBvZ%{h^*d12Nq
z-StI+T^v30MHf^JCMCF}q*Z+yupj_9?$=DC*0oDlwi*@8ZO~n1AQIKm(e|$aU@#Wo
zg~6zGV4yEJ2~_zfmH`uJrpM;Cuy?c}{>lanNo0GI-%1Pmgi!&-hGO%2raa!ge_HXM
zs46Q+&%FFv=BnNA7FRv|Cp#2jYd&(Y?!geF@H}-o50f7@LA84Ft%;d_$Dk%)T6fr3
zL<`2k*uB<JBYTkc)_$Q|_212s4FwD?NEiW_e9EuRlv{mV9#=eYy?wal(@4t>OWH0(
zOhL_!<vZL5xnqX{4}Z~rh<uHno}$bst#Xr10H%$1j}xxaHX)vtK>uj+oQz`UT)^a(
zU;e))_cQeuCS-785X-e1z{H((`FLf=duO4SRWlZL*A9b1$4}|_-KK}Jy7sIY*P74%
z;gtXVS2^8{@$NdhA$4YdDX8+g>K>TN$Fx3dQEB_ILmw&c_ZNQ#D!g|&7{z^*%^OC{
z`S!k?1MX1U{z|_i%%ytku*q`w34HJo8R2}?buH<|MP!!cp3u$y{BJyNiJy1r{?cYq
z#%_Dm<^$kq3C?|<L^;o66P(^R1u80Rs4koZvm+fcH;E!6Mw@#4(lDdfGX^`h1lA>q
zb80fvn_p`&uKsy6+=fN@k5E*rwvfMKC=z%T{qkEX7kwRNph3;lq5C6@yL$z^7&4k(
zfbwl&R%M#w(xiWJ%_$9kZU^v7*#w8|BA97)1?7-jlbCs<J<l$lXheO!A4B*(b*Ux%
zfR(2BJyVTG?G+s2ff)6-IcD7x-n^w4lTilS-bNl&UDj=HPdH6&ZsVW-rP`Y9U0pfz
zM9`5!GM64w8HDviROXU=mzd~h=RBJ0;@t3$c?zFUWBJ<+M~ow@isQ1K!FR5mge15T
z`&pBXmo@@a$xt@hpE4^H9B!W}fuMi2Jpt<g(dutSxM_XgMa$NvM<A5j5k_QB;dlq4
z1je&Z0J9ZLY!n$wl)7MCTDzsHNW)m_X=giN<AVm!@U;N=4G4e%PvBMe-sirY)9;0I
zV>Bo%6J$AVvsFQKl9-O;^-((!gS2SeC@(IqJIRyOj;P6R!%WoYgZoi1)~WUB@ToA5
zdBW6Z^N2l=ew8Pua#@2}JjGY)i$Nt#jd^rPB&}_hP%D3SV!z23CS}ZEzkcl7A0NvH
z6AHh!dry(CHCrg#CniDi<3E89ybiZ)*WaGNb*YIRDgq|}+G<kM*M7uOei3{lrw+C}
zB{aJg@cn4n73^khUCD0-rpJ%dBoW4F4bsZ^P$69?<AKt6%Xj@J$V_nd+0|a%Stt_U
zSL^|RQApdrcxqU>yUu{P9eZ3ph}LcQS}0lky?l<9m`Zna(A0X3n=|jljXqVP=Lcv{
z_1PS2_xaz0xl0fHh)?rUT81|0Ie3lkeu$-xe`uO$5oP;joSAz~ny52%#not`6CyJL
z)K&19E3%d2(hfNjuOgMt)Sv3Y`I6)8&!foHz3%#Rp4T}I_?Dsf3Rv&KUXEc679MxJ
zyg>^lC!rO~k^Ui6fAw#+`zPo9pT0icz3!%UY!6aRYVCc^j|~gk13hGxAhRVIQv(;c
zjv6Fwp^vDgbXQV)y-d+Zk>k!ULtZ#oi{0drq5L@N^i!H3jwPF~H~K6$8D(Sdr7r0g
zDFNo<YQw*4*@ZlOka4@+WS_fMddZmebtHez7e5@JBZ$*!?o|68@Q(C})#RMoJJ_vw
zKCK650Ycfxa+l*CMUxGuq+VEEp_C|IJ;la_?pil%saqrU4jMbNG`&4oIL<0HxA7Qg
zEHb(R{J826e?8k`4_j#dVVz9IL$^=ZhrBElW0*0la0fId6DTqg9$@@3paP79APZd(
zTd38dz$IT9$c>ZN12)5H8v3t3OoE(A%>5;s3Wz#dGLcx`aJ9)q!STVj`q%c^9Wvli
zz^=1k2X#}|ZcC<D2S3<alY6eF^p{FGerQW!vT{4j?)KFiL*MFTN|sV{UAXOu7O?AH
z)=12&-->N>D9+GQ!w`}}IIsllLS=L6hL79F9~Xk=Djk|9>wi~q?p4mS9$t2TW~*dz
z`M6*5_jlbVu$9ei9aC;`Y7F{Y61s0es&e@W{aW`|W$#3nnC>45vkBkE4N8~+h0QD#
z`^g!Xa+FCj5aZ}M_%i(}Qn`Kf&IR646fx@sGdGYZp<~qkw6|R%F5`5U`8pT_#FL8R
zL=Gt|J71bFuAdo68560Eq>NjQ84;y*z*~G{)0^5ogvaz4Vl_sfF~L9qSvC7ktFee9
z?j-#^4B@}ba@%_0#BBT5(w{~g`}5jOKZZ396{PV}S)!kLFqqdTL){#-67}AT;$BUe
zWNcoc8D_q05%$^S8f#s$#3;qT^47>HrLAR_he_toqR15vd#~y5gLvMyC>@2s?C2&z
z#8&e>yllaf2$44m*Hq|)yf@_-Be*BG^cdJH>E>D6y%$oIaxYkf|7_>Isn;szi!<+r
zl$PZLU%_ln?PMI%sm!`z$hOw;PyU{M?X{QlQnd{{G0L;&h53v9eo}5{ZCjpLlF@wm
znTw?NFE2uNz0JYep>Me-#|GyA?0v_SHjpFNEGLvHn(nuUp52RosX{;M_Uf~15Z@eq
z#?<X{_xa>TX6c)nBT=@WL*^_D4*a<L>yY{~5vY7G;sWmSf_;`QS!kWTeYG|?#vWCF
zQzxiB)px)fovg&alh&O%gJ-+UJn0f5C=G};*BGeyQqExR-OKyg<#P45Y;Nm&QC-S#
zeJ-9WK1Ut@9QTHKCim$Muo7K-@6E<T8gH-V_oksWj@nt_FD(ULtNuOuZ2I%z54RQ1
zy=^?(a^BP?_lrlNw50_kX`zFwXMGiM?#9(_^_nkcbUM(?)7!c4yiLG4zmUjVwz=q!
zMDn+RkJMf_gnOWo%J*j`-iQ(I47o*zA<V3AjyY79tHuZmak^_VUo15MeT|xS_%d~r
zA&6{Ng4OC##HzBvwL$iDSgtd$)d#aoui4UR;?EGK^YTIng-u~sk==|j4l83~D<Zyg
z!@PLeNBcWIe*>tGTqbZMEVGEWq>9PFVH*CYcM*Ni`if(&?lXg){rUKME==QdO|RkP
zD2rztG-~EL^452uN_WZ(-#vC+aSH@%+v6Q<{j$58m_~A8yX4|pd@#t-G-YDeRQZRO
zExt2X7q7wzpRVb-$zA=JC>d3dqz7Rp&YAr7$rrV7xs9#jJO?*_QGDLgPr9o2|B?3Q
z(NOpC|96s9L|t9w5}8U-lqnLzOr=tYBKtB52{D!!+su%neUfFe4k@yZ?E6@<j-|4%
zLzcl{#xln2_eWP<-|xB4eV=px&VAm0baXz)GBfY@`?Wlt&lmq*Ib+D@YJ@$Tp~j$R
zZh7GIDAPLAD@Wae&+S!?3WCK1f$SWL6TK!*dz0VI%@<blkW#pvIqpeT35OmpiE?ZV
z^2!(jE+duKoU&03BOOY(gj4;aK`#>rQ;eb3)^L2<m5wQ{s^U~;vELc5ly2aTa6{NB
z$eXj5sc`Q4jzA;}f(kZFQq%vs)5-(#){_#|LBQ%_`3glwV+O9|(=qr_T0kbFW4J}9
zJDfb#YDx`wjl^}9O$C<U|Nij#u*kY=@MQEcNF->K?cn0=DnZ%^vC+yf{!6ouh(N7n
z`O-O3R4j33_96nA)fY3A%i?^S-v^}z222rMZ94<Cnc0zz63I&VYEJlPnj7hh)xpln
z%S)UUP7xd4boLVn%HZ9X$@*xw7$IbEOQ{Zz=N*As?GE!cKEXZNgY00HL#qVft~v*&
z1byBBx9TiVS=cyiBNhwVKHN2e<I(=A+6I<{?7-3lfm+)Y4CtHw+F#YLlI;$%pKr#p
z@+_DC$H#9^Mi_JVEB;9jLN2cD{T64rs1wsh5=+h&h4TWlQ#~Xq#$bdaJ!++tR|T>@
z(u;ke73Fw%KZrkN`0zV<Mg!NqhQDz8fNDJH(PAWnF(B#X8_^f5V@Ti@{MdFX+n}La
z$~BR4wDNq;Thp6|I?E*qI(^XPGO)cyy7DO_A9j(4)oBLrx^T+;I(NaXFEFSjM0#T#
z+MD+{AW1gh4*L8mWwG$QqJ2QUqsuMH#6{WT;8Xl`seEbpd%0qdQB=T8GyeL~bLiJk
zq4wny+j^Tt5gVtOJhkLV+sx3Gj8TnI79_Y?L@624y`YQ#O1bG-F{%bhz2-U+kPXbI
zGE26gN2(}_^O1P%eWDgh_~l%4r((O}+g6V}YwFcJ%h=s=**MzPSZ5pm>RlFnlEwSy
zy<}lWm%UQy2>B8F<qP`-m-=BwydlTxofc**{b%Z=@JzbI)OS@L{YevooZ-B<NT}Wp
z=Z<M`!&c7!&D};yU6$IQzr=kin=QtvxhLzu!?d>Jg_kcv9{V2#UDA4sIV{tny9cus
z(C5L9gaBE%Ao%JFtUoEm;>Pk{98oB_VYAh03Ypq97GC<r`atE1O`VVFRC4w&SvzW+
z?Uj%r!jTapoP?vIB&NsTJMH=t%Y;5Sx`#Jy(&s~Y8a90?Q(fNlO>KZr5RflHZjbog
za`x@?MJ5#>-4axiT9py$Z4VRnV#*9OEQKo0FP09KE*f2LeI8@RF55PmUal~_<ZD)9
z8;OKNvX%G4zpyy{vD)4@(y&KL7pr{>0y9j3^E-6Jhx}CeYQ|+l>9^QBXI9-V<oa~G
zTJl>53m)AMe#@SIg@5siof~E^7!d*UcXzf4cp2;z+WEB#X2*(+pS+8otk3qqDt5*l
z`{8rZu8it6__;unIB~i_W%;Ux=_RL80#`7=HKsLR>t<d#JCM0>=XKC!9*qbh7UJE4
zOWQ;!2w`Oi#r*~pP32`O6*IKY-jFdVPaIw+4)eblo7L1byPUZhi%P$Q?1TNCNpHMQ
z+;48H@H{-ud!=W4=A$zY+*wI&epO9vcShEmDt~ylp33ZBq;rQ$TUEewuZGsWnw-?y
z%sX+JhI+@oFpO3>d`4Dc0Nqsis*tpG>Dk@BbM5?5GWsxuUXvx8ryPWKe=aYcg+)B+
z&%Sah|7Hz~CX<BjJ?%ZH5s0}08A%DtS=3O&+kz`=)b;PHuj*qm4i4m)W4D7z+|P(9
z0U(*Z_Z@RDPF^d`LTIdU$v$FPg{Ja~BnlFJC!WvN>Ux0QO4tRgcVyFrx`BM*h1G!p
z=Y<P?hX8sgf;tfd1Rf#6;{qLm4lQ7yo$^<}e`PMQZAB4(bsmeF0Md}Ydf_u3vFoz0
z@2-o=U9$OEvrtizA(6wFw1TewjW|iALOw%=H_9Y>Bf_ut6L-J7uOX0Ltvp>wejygq
z8zJVk-lX5s#OH?Be0cNT22r>#KZlXw{my2+6kBmA3%!BIEZ*<rZZCjjI6%1#xjhv*
zI{2>agw($En5W&nryg+~E&Y?R`vaSvstpMc19_8jt&a)o^QRIMmrDpNsz=lK(|$We
zT$0)JEAx{$?uw~*xKE`mo<Med&{+j~<Gf@@E6(8G@Ti_dl~eNIZPntuZxZ=h`W~z$
z60!Bd;SqVhJkF=2UHi)=g*9KwY|M}eR34@*SzHN;jeUaP$BK{bksq^g?J}{L4RLa=
zYRkmE!;hqH&Cl>(9DSZC9y5K`C4gcX060)yN7a{mckOo8A5jCLgV;WvHF5LYelm*b
zSH314hQudUZ0xeUx9wI*Yh`7X=)^UY@G+xMW;nUIJThX9Eesi-BuDIx7GCT7qGF|@
zy9e=dM;Ry(cDP!X_YJYpN$)=G`;Wf=CZ%IFmMaL|2COHHL$tcjWSxJTA;9sFv8R^W
zNIfKr0{<6{SAq;AXCG<{{Vr68T>N|QKegcOwN>^G{?S69#v>c!&Wx^j5t<9mPa5>f
z$;tJ#wiakPsJqG|WokI^)*uWc+>ugKzqnJ4)8v-S;=scsE@h_m!%jt~B-d_Eo&397
zl4!-KVMnH|QDtc1l4GLyOE~JHl1Gl{81!3<T8*lgkIaL=7pT@G7gzU+gh<@Sgo{B1
zHbpI+>I=Q><~t0pB}BfZa1bT!TIc&T+S==k%Qe%St5Hs?+ksz=)@L7nKLed#t&I+<
zddTNn*ab~uyzAc?={t?1{P=f1*jkApJ`41e@45$0Sa9m;OB<pr#&!@&Rqj*V^b<vi
zb2ARK?~4nva+N%{;;NFmHS<e72-uX9XCI@u&v}SqEC}!FlIem0pXq)BoZV!5{~A78
zr7QV3#jd0fi1j)G4YbK)DCY8ZTnZ;t_x5CJiMWQE*2`q)Qfr`+NfQd*30tQ(ylfY*
z2O7Jx<Q7O*)K$6WcG%((l;p2vDHi;%*$NP{B>+n*w;6YKLhZK?BJZC9_O{cCUgSS5
z)q58&I*WM$VH@~#P+_7}L<zyK!Gd(l_WZp|#9pV#p4d70Qk19Xd>ES&9EnZk?^PQ&
zyK}%EDG^qvrq{M>icTVBuR=0eR}#)4G|Vf;qHx^nLi4OQWks!QxzFYLyR*pI^K_)j
zq3W7fb-+l$62EXs@>9eX5L%Htm_Q)N#r3Fsi?D^G{dhRzRTBnd>Kn|hiSia1WMX&~
z&~*$NIaL!Z<67RF-Yz_9NCJ-rclcL~X&$igeQD!um3s_B*DENz=~vB<&9N!I?c`_J
zI)lYUb!gTc!;H|(6~c-~`7P@R$LY41f`E*;C^a)$lm|)nQ0~n9IhXf$(yuM!OYv24
zeIKZV3HL7rf!W%yU<#=v(-b)@Z04|7iVl|Ajc6BT_nY(dKGxh8jvl^5q{0Vtw+=f`
z=YYmg>2dJ$$vfM-nlu%`-yxdtF!2r1t0dOM?KQ2+BmofZEK1z3or)co04yVQ92W)s
zVA^aN=kA#B6*I$tnhECp6J2UREh>!TPlf%mSCAR=agg}(a^Py0(i=bIACHsoojx`6
zy+t`EF#i?)1Oyl_PjG8L5O6BuN^_mQVUPOR6tyQTOZxtT0MhN}7{y3OObs7Mb{`_~
zp*dietr58=H9|EcX)c<y=bFpqg;IAEyT__?AWxR*{c~N0)hk6+qV4WKdU_6c%qGd-
zxs}@lg;;x3FyT}7*c!Y>;_@*$dEBi}O809BYNY(c_g@U=@M`_6wit5<^ezmwH)t}z
z%}nwmfb+B;bdPYR_=flIgD{qiRZ|TWvK6n8;}68_uSBgp(pXjTab$9#rPRV{)xqRj
zmbr@hAE%RIR+9F^1CmT<$V~y=$7GCJ*$E3<V3j{AacYQS(1kZzu}D-+T`uNYACK0=
z_FlfRid=D^Ez@t6?w-t~&d7uYGO}3X9sP@>u_bs4B!TUOBMjr#OL#8QKPE&V<NLlf
z@0geH7NORe&;TF&7tE8V8@p<|^d_6d!vU@R0JpAXx0a~5LxlfWGwSaQu08364=Mjw
z-_K8i7fw(W7wwTbtk%+DKXpIF`&tku`q{=wU@x^z{@F`EFJ26KYuBWrD40VXL9KYr
ztJs>0UGGEbe1<Z<S~2@ipEk}SyzJ_}+hi9we<kQpQ|d}?DV3!#HKn0?6h0p^!7T`|
z&Q4^_4T%!k4O`d64G!2xR#+X9cAu27cvpjCO>UPN=t{ENhk%%kWFwLFTIDlsKA(=p
z-5H);Ow&eTjyXi#Ih+Tf#GK4XmfJ0f(#WN7z3u6YrH6E?3B04fzoi_5=B1ZVH`1Gw
za(y*d#rtP3TH3;oe<)FKa~w2<y_2kY)xhIr-myuK7V4kGce$go_#54ht(^Cqdr_U~
zRj_zJgx=(Wm?fi1B0spvsh_Ay?lQYeawYX}5P95Ct@RZd=biVVNcJbId44-D!5|1p
zCX1#X1eed>8(bdIb1}wRk%BLw&IhFjPbWSP<r)|6KE$I(AWYPXDS}Bk+%+OD9&JO+
zLiQLLujKZ}MWHsR)ba5JFgL08C`bm$0C70Mf{^ose`?OK+&WiZV2liP*J{M5jAFMJ
zM$($G{k}fv1nMB#eC#b6u<F>!JG5_Icr1cZSOu;HulnyHYynnnw{S9X*G3hjhivxi
zLc<r~E}A%R*>Z8qjVqV#JYy7XqDC944qx$gzmnYn?%65Eo}z~zG*4XmO=7I<7>N8b
zBlOyIp8ROCZ1zWDf-#H+Qwx0+@EHd!wmO(K`D0}1X^xoMN83z0icI1BBY!-^+nV&s
z2$%ObmXse@wVrU(dwC9LBKbB+!WI=g1bw$#Gxz>Hy3ldy(W1g&S$wux+yN*|q!cpa
zWCgJ~+D&eMcd`$8)7qIg^C+J^xsI5st0t(__%6A9goIBw^{mGznxyH=@98^4f;mrS
zvYUzR^d~)?7jDk<#rZfxX3jNp3*$AAtj?~MYR%94AKJWAKQ??bd~v5lON@fOhD;d_
zU(I?z`|M4w(e+zcj5Tr25?Kmtp!8GDM(ld;p>9$WxC(?ex_B!IH7LV@*^q;N+m%I6
zSXR}WdDeJHYh>9WD~V5==bAfs1mRKrGdDe=!dq3BxNAv;UAREnGST^#%v;=HnK-6y
zvB~2*-&p6W#+MB}4=uRu!8~5FPMr>COPImyKpY*^K_KN&w92P{fTC!{IzSgVaXKAZ
z{z0bliS4c`Xeex=zlEmgN1|hZv{P9*@Hy$puN4huCjxEQ)BYl3k4ulXfIoRW5(NF%
z?l}57r1RNb&`{bf!if$)57qY6&Gt?{FTU%X1tRa2IN{~prYcrWYx(4OJ7K-Z$0@H{
z-!CuH88)2TS-(-#Ml|BuSS9)GetCfS>OII=CFEoSx5L*Yi&ZdJkn%l|AWuMXFUBJ&
zu}}7s56Qq&$m>XD;?uZ@lMRy@RJhgfCy@9k3Ao_0->MvF_f{}2@Sdh7b*0<I%wI1;
zFu=_M%)*H0jm?7~4jbVal~Yo1ijvj(V<6@6kZD!Gh)br?qi`o9_&U*zplTUwszY%O
zuBg#7v_8|kSnRP_iDW2d&bS|1_xEt1AL$*H{nF&L(!2WVRY_~1IR4!MSWpn%4?kKt
zEI0}0chL)oQ2Tf~WxgbBCml@+d<P;{^!v(rA-_6at4=B$w#L^ix#5j87_EZ-hsDz_
zLch5IKvhJ)AgbZSxN2Wok=3FsM~sj$i2y7NuFC_~2UX8U^9Lfy)|}eg42bBj0_|!Q
z1{VP=H9wBlABslD54|D#LfYrjpPKyPGgUj@zk1#VlnV*gd(&7i7tWFU1RuszSk=BI
zD4iVGkos-I%<Nm2%9=mg2yw*vQ=5M{%zq*HXBiGB+#QXZfqJ~N@#2;*JvvWV)3M}n
zvJ0|5-4v5~h(&7hP8cC6K?O_ux*gxxFrfD%JkR@9h>}P!G9E)5)CYSilK9h;EA8RA
zKjLqNwk<9eaFa-_4hRyMF-Cv4K#^=im6x^@5bUJbQGAr0tp%j&V7ERsyA*{VlY+N7
zOT0W(qx5cMMX?;+NOgp{WgOG|>qnKt%c`{jwW%?<)(P|gwp|$p*P_ZO++DY(wnf|o
zwMJN%wz3ImeN^?&2yaRlxU6o*yFOSW)ws)Oboh}Lr=+Tc{<a$TT(BUJIa%=C@op@)
zAP64e>Oum3BA7PA8`BH0fBG(}Pwa-Y)?u_orLjjP1;re+?(him5y^fu1z*DQuXTbE
zt`+Co7-(kbFvM>DsWE}Dd^#r1X0$XzXAD+)xrUFo7Hn{NU(KauozL^Pu?zG`ICkOP
zj{whvDjEhFD`$eNH`Yk&90uVDAfx#XR2b%+2o4gayLYk<qF@<Le(WcxRog(-1!5b)
zl`~l!>CJbT(2T0-S5MhA_YHw;8^gW6Opr(pBadtNdlaooQ%tPhz+S?r!SFxgBZn3x
ztAOd~KA-=3<5#2wl3etmW!v?*`q^UwHfmfIx>PtzxaN$BhZQ|idJ!UbmcIJA=S!+U
zcJr(rz0J$%(@HKl@c|yaXBDr(J<6Q_fSJzR?H4{eqt@S&HV-GIUCS#YySn`23_X0X
zN^mg|R#wiAToG!S53gaGer~VqKRs})tIEZ>ezeN<=|j8y|J+QfIxU4ziqbdCI@rS+
z8Mje=myGB0?(+gwc@32^IXf8)#&=vUs+0BZ!+|9kNLAK-qOW<<X>n~viRo~K%WJKV
zyl_k}dO#LudA<-<zRqw%B0p&{EBG&{t53S8-PBIU>S+@;PL*#|9Smq|yEr13jpi5?
zRM?c)*zz<eH76~(8%B<-mEox#y<WU`tPO&$vGNT(R<OO#2Yv1wqoYe(ewa*>lW(TK
z{5XDh(gchhLzY)D$6uO_KcY~eSgc{Ck&<S$**%r6=%>?eiz#zS_%<DqzpDDh+4cn!
znzx=^5YL6K=5PA(T3*f4*5~Z0t~K%Ko(yuw-En9TUxlVTDZJ4zZ4~zMWMo%et9;pR
zF|{eN>N`840Sw2ef_xIF96wWr)@~wgpDe7j5iZ)hu|SP56t&hXk|sZ^>oqUTHcMoO
zk1cEMohI)Dyw0yc(%6taz`;Nc2q#NAWHd~lm=Xq{2M29+;opeov!f}5XWt`ihhXiW
z$!+81nO%=;q0i>MRxF^!=_9+8`h0o?h&ruhIqdipvMx61sEO-Oop}C;zDFc{EI6~>
z{W`xgw@HXNl|0QqERvzlIO{*xxbeo~A3}kZi>ETB31brXNQdrh#}xM_$0)q-Q442U
z1l4PJk1mQ^2oNhK?bqe)W?rSwye%h`rzx1SL!_BmYi-<BM%KCeb<EyABkwG?V;)X`
z^e-dPC+-x1tN-JHvRIJd$<+69#JuXOGLN>#`kLB9j&SZx7xTvIx~5fss8emqXPSnm
zpTljB%V*a*sPM~SH8=A#;PL%q+fJz^X0I~^%9pBI{cM@1;y$o7C<)%{p9(mA`cBv4
z%bR;qNcxggQizl4ZPMP=NfSgYP!cHZSRN{*d~D3ZV-=Tb&hJ)=n*Nahk9;Y0Xs~F#
zr><M{UR$`!58=oajg{UY>bpWp6+MAI>oG|C1b_+RM*Q9Azms@R{P$H~!+)pTPU%Mx
zF0-9yq$}URCb7aB&=cYgSD^!pFXhxGv3&jlfh6{7|CkQXy<C^yoX#txI{1(#wEc~a
zq<r1N>{tH>Sxep7Cb+Wqt3y$XF#Ey<MlbCjfN)aSmhWcA(Ye9??(ylsAAWYr*4w%%
zRl$jr7JBPP3fn1$E~is0>dYx3c|K7N31>4qBZko3V}8taIJ87r$-GJbc%-yNn^SkQ
zqXoog-fMn$2d#rpS#2s-f>5xCR=i_%d=i6?)!Xkc)nc<)Ny;Bb<e03hmg@CBv6_R7
zC^+q#|Cp{E%dTO~sPu3pTY2ss!XMKLtg<c)f2#ao^#;F~a68a~*73yXgYEjErCTd$
z1*fn8!?SygTZuVGyp$PrvRJ`F{U%?Q9e@0`rK0I`vm0jpH%7hIQM(TjJT%G(whC_d
zehgV1rSI-VsvKj_6e2ssr`T?brzVIV{5PlKlA~t?v(TpaV{e+A+IpV5kl|Ar_>BwV
z7IU;o-b|f7;dzS+;S37J)STbAR=XsgBoR}y;Tc{E@Vfgd?{ao*2%)}0{DbWWbr(=|
zBt)$~P<j9R=W!eevssmIK110wRKp7<1#1!6e~n>jHD4z!Ibs`kdzNMYt;|p*bx@#7
z#M_u#4yfNe*!baFw>_LIOe5hCgC3FiqD?F(Pu7Hxd;AE7<ALQcQ+A1&MRX<x8;o8U
zOrw$*&wzx|xVS1W+7_*6`!uH5(%Hh0V5rj6lG8lW5q!J7{L&WA>S-L%)c&^H$}V`7
zt03zWBLIsT$H6(0P>D*1D}M!?dR6sr|H*wD03C^I-W}LN5dHs$2S3gC`83wS{GUdq
z)3!Bmc=6-|?2voQzZ96H6*q^a$6V$oo<`W6(E;Levoqf5Ax^KW^SXf@zj#Q(0E^>v
zU32l=8tY@t_%@SGetXD#zD_=2Y}yD?^e|BO+?sWlaKMRITD1`e5mVsLXxdf)$EX#d
z-FquhC#ZF;5ci)Gw8p~7gA$(>#I2fNP9eaBXeYXI)IX&8!Ft$l`&abBfCgZC>+)X>
z=IF)R&Z38MuF$tG*hZdE;z^ZW=gs!VL@ufC#}T&#F=9!qp$m1%OXUpZRU1&1aWq3d
zJ>{PGAf`Om&7a&aVbo;A7tsd}>a-)Uv;ckyo_Q(WfH;l`PG<|{M~awyz@6W^9pkBC
zwJe!SQD!%@n$m3w`GDnR@?FCB1x7vmpg;pKtoHiFy#AY&2HejP<`brAhXngI*Mzy3
z(BD8|AroPqad=knYqy!MjbGnuCuBTr?+)TqjbFC<g4{E~dz6HU;(&wtk`Y=;AWXMx
z8;JIO$CK&$L|G6sRvhqzmrUFC=a84(v*C32IrGyelM3=sZo#3G*`hE+m&zK^hYJW?
zr>F-EV|2k<jcv7nHLnp7&ZBnczG}nR_!o@$FP+o4Dx^dKLq4dZTU8*hNEjQ;T~5^K
z$%xc@#*(_wapA_*JcxP~HCYzqU<}Dm*w{V9_X*fyw_{~X)jwYanLB=l25<Y-^|*59
zmt7lxiHM_c9fI>WZ``JpRKoTaE4Ft<W;|OG_k(@}#EVsAG=J~y>Zj&u9oY-w?6f`4
z78u_)B~GzM*bG__EeJqESsXyfq&Wfl`wwpEyKTXMxE>a**8humOYWfv8&kK4)1H-S
z9W!|sUG{a-$`!EuQvJEIix4>D^mT2&U5LcEkkRrt;WYu|MUd#$v>5Sgl!|NYnlBJ3
zfhh^i*GcCe*0K+699DyD$r$leju)~Uf0}f5C?qKqP)^*N+8o_*`dYbatT6K`N?48n
z3^J+E`2!s9)vaY6k7GXl6z{g~L&lnMODJ&Z`NBz2$hZSEWKezTw#?77iuRIKx;x;C
z-_Bv!tsAk8SCb=5lE1J6$amKcR5#+6$V|b?=eAOYmEl@W*iGkg7)2`Zovl%=aB#jp
zOT=fx`yA~!`<XOmyG9e>3jKu$D2XjS)<qM&8+KMc229IeZLhox5W;jBzTodq!mR9`
z_M(TH_lAy_qQ6|-DaOLOwFm$}YKrjx0g3t_v%2TzrtQg^L(lsozbnudJGP<Dn%_gY
zXw()EP(2aKEl+7eAez_K20_*X<$k~%Rd^+J!StD0hXyMW#yz7Rq3_uRUK$svp+TxZ
zGqyfrfQSH4Kgv2!`~_Hbubf1*NB~N?3C5GfHvkm5LKNRl_T0I|Y&;ZPCjt1(imc}S
z;;w@M?z+(PIe-f@qXDrlQ{inez)F`}|G5NjiSF2@a(Y;$FEr}-JO(j9h$cQ7ElPuE
zdyE61Ghn4P=Pv}{nCG_Abj~qDH&N!=gkK3(2yTKLywUp`a)j6YyK1g<*W`o0k4S8q
z>;leXPd1;@!v1d85rhcGvrr;{O{<^r9|HR8-f!XxcH8x-PeYKS5H<Qx>P>_#_`4SE
z7Jgau=l#w)apopy)*u{i-l4JC-i-vk)t^#+;k^_76X90=1UD|f;j+PXUE2jf{NXVC
zCP@jb;Sa8`v<qPWePd75CT?y#C;yeKAI>k|_J{Q6^v$wz0U+zg{}K)WK-Qqa9nFUq
z8obNe@8ISt=8UReht$d10GhA|+v>gVcK(_Ya}g>EdP2OstdqLr*4M>#-zF+E@mFxI
zuI!#z5uabvXa4O^-~Sn5(0>y>|Nr{Hfft}%zOX{n5?t1vwgU^4)enZ|+r0PrWiGt=
zCr>EvgF04tuuT5%52Srtxs>iC8y5X%mwRpd!7u3K{QMR@v{-N`*FJ6zARs@34lV&&
z2P@Eb!eNkP^_k-vAx0M}p9YJ*hJIHBUauA9X(`Cr<3OMc+};tu$!eLyxs|heenSQA
zFKHK!-3@x855(3XAlAx%)Zc(O!0iGl_~vg{V8KkaAiL9?d7FAAuoTdN-xar>HfnWQ
z{eS8lZ$dhYat>K@jT+v|ZnBJk>|yNM7LIq+rcCMkjuh~$zLMY0nieoDC1UnS-~a(F
zDn5;ksFes--8zsK`9*hJOIf{PQ%AHN-%v_(|2w(xt<Kb$UEa@NPySun2PK2Hb;^dR
z{IbG%8Ey;E>vv`Uqp{Vu&Rn{RWwrR_!5pW5<Pp3+cfC;oUWxPCR{#;fR0FE+iS|6n
zLp%l;Hn5>RYssTO{2Zu<=4=Jl<B5X)230WtF92jae+Ae3Z0p+l9sTB_(RY)zbF9D@
zu-Ctqw#|BASyL!>{J8&4JB95K00+PSzw!A;=}wFHDCo<N|B`+yxb|-Y@^>Hd|KOjL
z_x=Fqes#~sroVqz{w~Ve^FNF^9=PR%U-V~`FKs*TTr~!R&hH<BBsTa1pW4G9B(r69
z=dXA8X}5S<#Kd3KSHRzi^?;Fn1c0{9!UmKQR#R8PB;{?yd~H|_*0k6kS)$Zofb86S
zn|C#eKdk^)3IF2bIZ?^N<IQVj{{#r&QYRcdMX}=-&H?k>IDm#I`w9gKj6RC7`lD{V
zc=m9L%4s*<%X|~D8Cs{da0ACg+^=$+&I5EovTuLsf&gjKUH=`Zvrx~Lr`QSc4OtvV
z0C=G{kapXJj6mZ_!7FcGE1@Fg;Tu;suC9y2bnC%amVU)9HLZzL%L2e{DUOQE5Kkk5
zrE)1h1GWM<z=Zq8Yx2QlHx{HnMPgPc@VhyfCZ&rfT?e+y=>OU-?O`vJ=zFyoHHSO=
zstG7&9(7?MHdZJ1$4KyXzeUJlO~@dgcb+&_E$jqey`<s)`DR50Fmd={P*R=mbP(zl
z&NdIYZ9cSvH&q?6(<X$LdXMdd_a)00!A%8r_7ZQ=QzYI8VfGo;g5ai#t6Byb_?q<i
z*Lv4l<6I#Iua%;0uM&XLY-)Y#W`mS2;=jAC1+LAhqJr)dk_?De7yj&`lpTA%0j9V&
z`XzJfKLuQhq4;(ynGh!O;Be~O2HiJ$S!4^t>&;CuZBLeay={D-?yr3~vrkFal{dkT
z_gMmQ8nf#fqk+?fCG;{f!t<9CcQcJ59Qf2O)w}_3-h={VOcH?bX%nG&`ZMD4Xnzil
z-SCojwCVxC&D4tnSj`y@Cj@wUwwFeU`SS16sjzVIdZ*Nl)LRTy3YiByy#ss@_zn%N
z!0e&UlaF3p`+Ydw^4}I1R1J%@<gevXZ8YB?=S@R=hJb@Ws)^-@(DS3ZM-rqT7H*Bz
z*Vq44rKP0W8)Iy3a@=>HTMmI$Sd&iC(+9MxXpI3^CwoIVlU>0iuwsN4>S<F1J0sG1
zy*~y49GJ5W6d>iF7-%Ts>=CHM`PsFc_D;Cz@$10OSDtRbZ6F2L+4<}j+HVsCh`WJV
zV=qS=m+nDdbffa&jpgu7RTc1`BIpKEym0V(ibV~H91ygJJu~b~6C?;wxc|g}lus)n
z;{I3P3*dJ-#N*TvyHE|aPnKB3k`Tl#Vo;j-nL2OK#v@3_Iy48G9`??>V-{_BsdXlK
zuq`j|<FN~srX&ZmJ*yulo3nY-S;UqOC}{&ox~9d0>-s$nARD`Z(K;XGV9ANYDyyAe
z5@sTdW={u7sRDt|Q{b|r3x%%=DX}!puy=dNO@6QS3`0!V`b&&Gg-&$c3s$<~5jlJ>
z+M1*E?^@^|Uy#@=nEaZYWRmC?VL+V8RsT<7AT6+(@<AVvmgC$IBYsodPj<$%5g&^m
zbP9aLhT>bhQp1hN37IbNH*j^!_7(%=u6>eNU(l$zu(lc%n)CR5<(-a}b{JttyFBE!
z6tp++q95wVsoWd1-Shf)*W_JSCOU)x$%~d|TKR=%fK~NZ2gl{*wMUNBm$uiIL{2g`
zg;t!q*yb#*R5m4?F@f|4jYaSu%8UmDKh$O%Wwcb6pl7)QKY}=Rz#98PVQhNl0PgR}
zU#1v<2GM(!3Hl>K1Oe4LOG5lIA;0BO@?1s0w+?4yf#$T(DQx3MR$1GT&|%cMBcrbE
zKYsibcj1%a&o3ih|2zi<F0=&yjAJY_Jff{Zc8d$&rOU}*D2{DqBU2CCClek-rn?7y
zVuBBOuMDD(cV{n3oV<EkyiuvEolwSn#+6#*)oBjo+He}q!b@X7NeIF&8L4xaBf#`M
zRvg>s_^-5=vDNZ-Fnz5Ow6m+uhbFD1HWcuNz6=Rr2#m3}{3%H5`$ZZM4WEhq!4?34
z_}ExVTJquu_1k^74A8cSO5R2N?3hF4Ri_|RfSy7A!t9`<4a9T2C51ekH2b#mO2(r{
zkFH<Fvb5sfE!|lvn-RoMG@(-_eTxpQJ?9;9S$rWQbE6Pe!=)GwfxWj^j7>ZwmAj>B
zG1tJ3(^;@q0%u)TagVEdGwAiocF6Z`{N*8$sk<9fp~y8m$0Ozq^5z48YkO2AFfgzt
z9N!@!t}`JxwL{~em_~i41398z=T{H;RU+(P&utOD_Lg5`52Q3I)%xgvCh|1@B|d-W
z>7NjE%T_?MdE+_xGi7djSBxMzTTLvNcQu{Aso}69jU~VRxNDoz>C-W7S>D<s`O>D%
zrq{EIbt-xXbTNKyUcLK0(yK=L`j1d#P`COH8A6jbp0utEu0p{22Rg8<G7vek(WpzQ
zESW<hxCSSQM?W{Vmia<Qcti<Pkyb;&g=>(ekEzQh-aHsMQp6CRuY@^)^6HAo^OjTn
zzyRIl_USt!_jZeesD)4mYlw&wBeL?#X~Y7Qje&*0Lb$iP+~&KkLlI#B&)WQJ8s~ua
zh6Jy1i5;+|GQ^ff)Zr1Dcl><K5nA5D{{^-IUVP7Vi>3w9`_P4Zcyd(D4;><D0cb!@
zgTVfGx@`HiF_C5D3DNcoZ*OzwR*58O7G2E)O^?77QRIv*Z_9mBc<)grrX4F|0%FO8
zS;DmRMSWLjsKJdDk(H!M-t93DC23S3a&TQ0Oy4as{hW%jT`Fgvx8$|>{y3v_k7Djs
zH%YJWmO1I-5olxv;dXgb90-wSz4slLDVmv))da>p3z9i#1bS~J+wbd7#dTq3dm&1!
zNvU3nCg%sFV5AUI2=_$0&+08Ec2oQzHDA*Ws(d}#<k7%)h~f`!mhFBUSBdj6H+jya
z=9!vb#BT3W(A-4P0nh)bwI2}RrhKqHPYG>=ZC7?@ZMLjsE#7pU=|}j=9q;vNZ!55|
zlL7fj)89YuRHDe(j*c4Jncc_B>e`I#ys2)!REGR==hNR}t!9ISNo`9mC(xzjU{Nbr
zh98r-M#D~R+-;I4BZ=KS$7(eFN}TaxOXH4Ff;-tPfL{G17&T~VJclJi7zl)+>w#bZ
zoboI=wok9`FZY#+bo1$csgj}HetB55C8A=a*fG#<N>dv(HnJwq2)&GVKGkZ}$CWw^
zrw^i8;?Ed$@NINbNonK|$iI1d;`*XUphgM(9oLz^f9uB6F`w<6g&;eS0(6suiHG%o
z)?ELgyM7M5f&SIAkcX{nz$SmIv+Ka;#mCK8ZBm)v2CkYM(1Y&sC0)iRuqUzO*jE~a
zCn-*c?$-b5U0n?c=}cVU*H@B!Rzp<3p~4=b&wY1E{Re{~O2sex8&p)h^Im&^jgD#T
zoqWmKs@2S_h*HRYJL%^3slGnr+Pu6`RJk*NYA+$J{3zFK(eJp6$Bki&S}F0%K^GjG
zh0(Fd2<zjYwk9iLa0;u2nl}{m3K#V=7TBH<3j=72cgluYay_kU`|h_zFWc4nBCNBE
zj+?liKPw3{S3K(jb>?4qQ*`}<?kN8LhdYg7ltnH7i*Md!$4)kz-++IxgbZ+=7aa@w
zgqm^j9%^?L!FlxZ?TzBj^~|jrGHFTB8>`<9GZW94bZQ|hd<mT;I^O4c6@iMavB_Q=
zqkOd9x;wwc4pU*|-T;{Bu77Oz9z<P-j4XeV*2?L}MjP&bFyd{GIagh28eh3^D3jeD
ztbuqT(ee!e9ZibLTJ|;0@H~;(yC_e56?LCjUyg4<8s!xqT;$RA&GG8bom|!ahCqC-
zUE{KQk>YwEvYUq@Sm9AqMb}iRIV;_%1?uRd!wKSgdOvsJpDR1eJpXZP-zq@UC-DCM
z$EcN9Cz})-92?WGce8jt<JyHEAEtCWz-DHrC$nRuHyD)}COq#H9lflqk9j3W&)6Zd
zhnk~@nxDIZ^e;G(`!J4-P`|nBa!#Bg%au6|*HOv7?ts}4PQb93#^*lJOVgGOR;x1i
zql+?RldIEQk$4XaUl#tV&!a2bdGdjxV0ad2HuuMel%y$Xt$c?|1Tn2zLBi=_AKl2-
z&2lY<)Ueuc3kRB|1`)zYuW<i(LAU(sm;(D07@S99*bOW`8(vJESNykxyCfc?`{E<?
z60y!=U*{hoUcrtHf_;hd+=k4p2D03w+eRROgN>dPsZ`!?k%-s9<c7soRz&p)5-;{m
zc4k^LjKz!QF~bC)n^cx^Ejh68rmcx&FvG89q)DNa2c~kb$)EzOclqxI0nG$!c=W1K
zfuO<Ya?ghQO?(>$Rn*ivF1^ry1|1hn&+58?tTOlGG>Zc=C{~TCclQb#=u}Z(u1$^c
zquDaN;$9|43iOsZ^O>#A9^=gH3YZN@a`FfISX^mK=Gs9Q)lwJEJ1wtO*z<Gzj9_H>
zD7v-STz`0#@b<M~etwH|-166A<>>(#<{%duEjL<vH*VJ$FL4*n4?upP`~v;s^x>F-
z<^1yJCg*JqlQvk&8mL5Zqq*3QY?M;h!+`^?BaAgVbTRU&NxBfDVFZSC9kA=ZxtL^0
z7$js_`Z!kP6bp8m+IwTZzf2ZfsfTJSNiF_8bblNE6i!x++feMCwSUW@=m^=HgedvK
zh0)#SwuhUuLr66d$@npX*dXm|7=Rj&9<7-LaQk<IN1tP+zfiT@7fm=?zKg`dV9Jfw
zY$&rNr$_2GD)bb3<Fck;u}oK~xDQq-c8YHazPSXsQ1}2iK+9K;#(fZsRP~4ju;Gdf
z^a;0;2h91PcH6)ho7F}m{YLffv38t~EbMN;<Omqnq8~j~*B!KeT#x;eAu_(7fD1{w
z1k6U+5C~HJJLu_X^Ba5JeA$7$3oW;R34JCu|4rzl`FSm$XE&mDHyZux!8E}A;;5^~
z4hMS*{Sk#8ezD`d@P4j{RZ_R=aJk<DAD4cTx?rYJdf=%6J^fX(-K?-Sa!tl0yGuZr
z&)ILk6e)(2U3^|dAH`K2CDDaWHA|(pzS@~Shq7dTEp=*;SBT1oLo%zSrg;~?xf!_1
z`PYqfB=ogJoL+}C5nU7O6ig*Y`tM*R9v)QOxfJ9^Jd!~=AJ7EK&&fNVIAY%+|9zeg
zE3F5<K6q38b`yo|D_><#&U><}y#%y_9?0Rsf?BtoYIbbe8I=^2{efx9oa2ujut0Zb
z@ux*B-n5RaD!mn24MyH6CBiH9W5MW)OBRm8r`XFPOPFhon)TkKWin$S#A(!#<tQIk
zVrA}9+!HW*=dkDN9@hHBijuY{4F2{+<5(a)slqg6Lol^^mC+r<_<ku3RwHGx;zWgY
zXW_~Oh~D+a0k?!sSyN1o+WS>@{v}*lT|M@(DE_mLsu5HssRkL0&fRIz$F{#_vibm}
zBNO-tX|FAXW>sIT^>%M?bfMj)@rKA#ueqbHz4x_wOu*|N3K|NNSlOe^y$Jpe@GXIX
zlIs-p=B^#=FNwljPg={N|3>ZMYw@)nGahO$ZDGF~41|GzSIo)M@zSZK(m&j%ML~ky
z+AHwPW6baLaLd;3I<<kfz6-?4MdgT{YyY=b()y()gZy4-sLYEgV)dr6$&xW^nC{(N
z7e`Q7NYhf9tS>thtjj~bOgd@hSde(W!SS3&44OY^m66uM>>rcEc9;v)%^R&+6JjHh
zgBr4|xkR-oj;2BQPs0Ev%&ZdWN`{?6*c9Gs$~O2qy4bP8(g(NI1Yn8fCJS62DJxK-
zusH%{=k8CMQ~-I8---(Z6K1w%np3iq&UQD+%RERmbaiYs#p<Q)vdPU#@(|w0y33Ij
znmPqoY{KJ4R%5zuB(=3?3l>s?{EK6d6#?C5b9X|^_Xm!(x)*pipvX<#Q`zFY>O`~b
ze&1A^ku|AusxBqBLV~~8RY035?4_foEQ<Ru@_ms8dRe+c&$3hK$$5T*<#ULYZtVGZ
zE6WncWO$W=rRU(Z@vy0UMn}BDq$06L-E}N?c*>c-Q52k_vLA%ffvEeZ2B&w<nnrNg
zgn_tBdWz~Q_+4cl6K<T=Ka9F)hny1{gi?1|ezRY1tu98P@|&P#bLI*@C6;`xa&lkS
zaG3?`foh?q#v+%3m@xAZStzx>i*Q$`dY99Q&X$vY=X1>kR)8Mkc!%3`N3}%Dhs?7l
zZy=B2J<hJKQgxm`Dq4!|w+p@<pAI{Q!?{lWRfe<LNq%Fqu88Bdg6Wove{Wb-oqfnU
zU+;$=n0YNNikA+N_rKS??2s>fUi_6G#1Yrr1i|=e+(&Ml-dqEPBMXx1)8YGoN$Q)m
z{8}vS(@f~SQsI`f-dYEz$_D6fnZtqaogpjDpWlDp{-+MOC3MG8z_dwX$DVoWh<XvX
zSSp<r8Q#9@Nw=88n^gq4pYtVntyL!T_SwFZH(K%-q_;5q=sjWN{IyjHVrGnA%3arH
zsRCa9s0xIyplLr?4r|bmXjM%Zd*|$%zuH;q6!ddzC5#A~_RYW;lwDlfklLTWp#I3I
zcXz=o++*iLnkJZ{<F5^Tq^j*+^UmG$VD%NRa|QjkS)VRv`dOYI-sY$&zNBz;;HwX%
z?~)dhD|LXV2H!~RnO*M14fLou-Dq&N?9LgA&Tg-LQ{}tBy0Ug0dG3^zTt=@yct_Sj
zsJy-$9_xD{y>!m#$B56HbJ6Sa{bQVX7{7dkUZMI3$3I=kL|FzJo7(dxrMlh;3260H
zx!rGVgvHB(v<RlJBi|*lHKz)FvvA4$y3;H1aOzTp8DNc0H#2(I1!FVTH(a^vfyi$4
zJYzZ_uC-c@_4#rwFNk(92wAi4v8BY-sak!xqf0GbrAAh~=EX)8xV2iresJ9OY|xjH
z{6|q*<$Yq&D0b3lf&cuC9|^_+V;+QqaUMc%h9~Dj=*QJY<n-xP!3^=P2p`%d2x~Iq
zS+ARn4t_$_UwhoS&SCH5NdVkfBg|ft36~QGDgZJZ2nXW-=z$hs8)I&O+W9*?aR8iy
z8XZgD_NTV~iC8duWsW}>+&wcc_@`7LC4dGz0p_xjje7Y>TaHs~ga(*h#X3@(&Cb-G
z<~!lj(QPF;DoSL<VQ+<A2X|wwJmpp~PvqE=M@)uHzd$xpJn6<pog2AQy+rzqq|em@
ziQ3k_JAU%!u99Co3^27Nfp2ysdC%Y2U%<vtD+In}ASWKG*;{t0jlifzv>k7#_}u`w
zldS=d+n+yz2!<){zsO}?0|qH52~B-{CyTeel~+aC?TpfMr3WLu$$j(fwfB*kPl7bk
z1p|;^<F%y8z^#2=7p*FToL=lZytK}E4JYE4dih_N^w-LWrh9R>CGBuO!W<){wFZ=K
z#H3p4IlMcOG%IHDLD^nP%g=pmYH4%?oS3#^OySbz=`C@z$Wb`agn(>V#0!4yIulx7
zfqROP2+5VV$9F+%G*4$&n^SG^36R0146FC7C_@~$ps#aB^1NBx=U&{q0=;6`&uwqv
zG0igU7#m<Thxh!>s85%j-t?`W<>neEF>G;mcr=QowY!FeS`&tz7H)~iH5d8@PHUc3
z1$?L+N<~5T{a^G4roU544{HA_>l{Ef2>;F=f2G=+={79IKZJU6Bl$xMA>&Not6zS=
zUnt??*H%{{mxyf-|G-;7`Pp82pPEA=^J&b<q}n<NJuZ*Y4-cVF-kZ!xnRaMiktoXP
zPsezDYP)@Cob$J+B}NF1z}YZQ?vHhAGIgSa3VPrWXs(D04?2Gb<Isr68t+fCqxl#M
zjnBVu)J+(6ZW28-<3>2KjB(R`pw94;vIYfHe$Z?5f)?$n@p_%fQ0+5t;GIniS0O*!
zb!2JSuz2T~Zc;Y<LJpI~(l`I%ItPm&48`N-&CdqJe>HvTQ602uHfN!HGpik`$!MvR
z+wH?V85-imFI(c$wQ?$l5LvdKPe+!~Nk@-Y&sXfa;$gOdw=TXGf5&giHleRAEn&Sy
z8)J9e<lZ{R#2wc%1j~)}oexZJAV7K536N^54l5Fr$kPa$r=N!h>cpEixg=F<)XZMf
zO!F-xWcfDULhis&MV<F6$@FoNs<tO9agipbu=Bp@2Ie>YvI!kjcvPqUef_I*=gNO(
z`Alhc4aVWD5jDrVwC<uk9%$*tp0YmXjI+T9I$PqNLg{@F$*P9q8$#22gSB|4KJpG@
zTRvT`EtZ{iI=A*?L6Eg6&7?&ET_+6-)ISfQK4@0MCQst{r{ugx8}%pTa9NQ5_4sVY
z|KsD=o`7~(tv80y_Wp6Kc@-ix{$Oir{U<-I;;_hn>*WG{SZw1beW4ORdDCy{ZBG(0
zKwg6Jk83N^s%2(64K+V$T&aeiHVrL088Deaij^oGa9HB4qUN}FUaRFDger|)7+Qx%
zod+)$sJu7-_~>vhOST5m`f(pE&I6Xn43eESn&7Uwj?&ZTuzsXmKRa|auV^u+GH~%R
zV>vH_Ld~XoN<pnV6Al+#68ekSS-kSiD9U^Es<Xb+y^I{*vWS^|?ovOkKVvxV6*~qB
z{#II0VAa(B{vz#QW-jhj24DwZhNR#Y*sVb;GwX)s*PWvwYk4D#aS@Lh2TJnm!jE=N
zXph0Q<fzaA3H2P>3e{Et2tJnz!S``%pZ!8g=$C~4wk87?){MSk^!8D3J_Ht0HYg6O
z?j2;}D#gvJ@l9(!Q?&<Sb4iNvqhpZ%q}Ah=5SLgEp^I<~bZ*$ETUJ%A`Z!^OXI<b?
zHw{p0&L^L%Qf`>AX0UcBW!f7w>J@b^Vzbwf{ZaPyNGRqt(SF(?pIeK3P!<N-aDnLX
zA8MRo?NO=|4lYXmm&gc<68Dsn_Gn3ZEd_{APHY>W7Nx2J-6z=>tWdx#>~^$1N5NX@
zyV2S{?pOS|;D7#y?EqSBkFlGb*k`mbiRY6qpN`A^KHdQ#?;cN;85dy_&A(<OZg1Kz
z0G^tMDT<23kHxt<?+op|AbSktf^zP<-5Jl^KN~9|))~lI{UWG$&wDAxoEQ(!*^?v{
z&_A?)WyYDHC?XdG8`xkc`b_|JaMw?}9{bW5F`0KTJvYrm3+6HWXU%MqJUZymkAoxT
z`14hE_$CSegiizyoSjE-Xi?V9ban;>kB@6efEC-U<PJ}VS%XTqhFO>9V5!*zp6pne
zK~2d+vv8*W#_(##dFbo@E9K+$-A)ZYRLfF-f=j8*h`RL{m#*(o>%GW%IsGR4K%0Ld
z2nPd~LTdV4;ko9M>AVe$g_eZ&YT!AgYMX<lgcEM@J;e=hqJ!f7R@wgKUST7?Z9RM9
z^~^Sz1g@yrK$#@7dnLD?Lb)TQ_?*71I^S-Gks<v2sxl3yCV@v6PZvz4iBA{v{VmT^
ziv-^%kb-a9v3d;3S8~otV!4wE!jjrchnaOz7#h!e33W-drltQDU8LI7YMW7AH(>ku
zf-IaWKHKoQ513{QbiX3V5vdU9HxhfR6!J3eLmqH_FF>?}jIJhSya%C#NU|s0a>p7(
zg<<0T>a)iKpWBJy>^>L;e3yS5%e{0sc>8ZgV+TO%)SE){Hx6|?BD3mFi~`NX-32uT
zA8eXlE5;-zJD4?1udHn3f5<FU2Wk2l+?$s%OP?0V>w-!$>b?ZNu_=5MuT}1c$ueve
zfd*aetYWMhr+S&7@6{ZS?nyrJI>V?auacYO$6GDKcd>5@PuEAK53}Fitr@F|wmu-T
zL{Z28sKggSYqCyFvaJIo{kf~A4Vk>Lz0r!)3Z5f<wKam!7r4j#bPlgW^Vr0lCLjr2
z7}9g07+iPa8d&;|p`*Ia8O|3bUqoxad1+q44DgRD|Ju8KO)p|$=&rIze@ibGn6A*t
zxublKLBsbGNT73v-Z{yeuBSOKo%x{<<<x49$3jQwMf<f9N7g=Q5pD==>tYCP%bxMD
zsBANk`Pwb7Zl+1#1u`PNok2FidLJE1u^JV3n;bQL3h;KMjGPL)gJkfXxXiAYMXBUS
zDt^dyH><8W;v*yHLhle73gy+*f`kbvoLk~DE&7gY!rEfX3RMS+RK^8ll1YC{j;%0b
z0P<*(L5z%$o)XvuXqh=UGF^IYho&QCZ}3)Jt^9ZLzO}!#uNtM{GdA{@B-fkM_6Msz
zs=18$CcE}vHt>mU3H`*+VB>j_(EqhzpX~Kish@{=y9moZp8mSrd*E?W(x|sV2OOwx
zn_YgLiCLb+NcFH{oM&WEoP$_9h1con0l7JW8I6bdPrAF#s;=->!TLT%u#rkrKNr4#
zH#uo>eUQ5nIEdY~Xr86{ZOr{t&_`wpnj;p#oi-nxr=cqM&xi4Ob$&HwuH3m{=2jQe
z)zCG@Ynj>7NpXDUVLPNjtW=HPOU`14TFaqQ(or>7(DUH?CHwLd3puQr3_)ZA*SMo#
zV*2#bo%^^47!X(mt6+Mj4AgJOoK%Fr*Lyy9(TlE&p^&JyV8RasA;>tDUD@#L(eaPR
zHq~sX)S%^#{m@7R#(xs~S$+Pa$#7NWU^Tu5-Mp^mm=vQh=&{EpL-XS!X)}h`j2m`z
zWrpDXNa|eT?6$sa`bR7AmPij0Hwh(=JJ;b3i@UAFS{E6^2GVxS@AnVUeOp>9sFlBu
zcJ%+diylnoFc2gU{_h}JZ8e(dWU-AnnWgygluVRN%--_J2jqN#tmYq<v6HR~@$*^Z
z;8Q+dFEzSV=pOble^_CI>eVV;>cH{!{N!RLbDEO^(@(|OXO*<*kOIsg1N};)tzs_2
zz_6wjBB-UGz)ayRoZcVeI&*gM6b#3hN(Ic$t=CJglfUb%OjzSvbP!`;M6Q3cJGHC5
zYWX!(k9^jbbfqvSh!s>&(dsB-7Fu~fIOAO54<~!=P~e?3yXNF<n-!sE7jDqhr#{GL
zyCNr<A+g+*DI_U+8pFLP6U5Q5ES|RvSZLk9vf>81ZmpNAat32S1~Mfy|IImM)lJ9<
zEApIsfO%imvP{`3Zo0VPzFfEC($13LW1}t$SUMhk?4+Cap@IOq`1IgS_w=xZv0UZd
z2>~BRseoVe*wLGCJa!rpY*NEpMO3dZotO^`qi%GABc%@XsH?iKv_tt;Z{9CEob_5g
z2_HNGr<w{-UG3OoL04rqcn8%|ED`JLx|2T-xf9TaGR$e}C(F4jh!0oof+o<d^GWHb
z*i+i0oePN<imu93@x21ZDg0Al0w6}XvltXqF+JXSdZlnb<)(0E(jAI52BxIEDBN!w
zaF(qn`ObXm#AgDqkpX;b=l_Aj;y*IC_+lFWW0C<x*4(XK+djq{WV39Xlj+zCAxgG@
zpJ_V(Os~-eRMo;L;+D{Q`bX}A%UJ;9?h)ZRdv?tt@b&H}xiwq(n^iSQ5Bi<@4QX`e
z@q+74lu>&jf=3iCZ%Bbu^YBfDbId7rC2_hV!mda~7&La&NPEGFu1Xx@tjNu&J7?ap
zEHiI;s%CdY3QIU__F!RxF_j@saE>3EPM2_6Y+iMod+wyn#UIe;Op|j$dPk*_qk`17
zCB&-`Lm7+N<$3yU+H>n&q?RHT|ME}!;gk~5mZ+d!-kzooOePxGO9X?1eR+E{y*%~e
z5lgoP7b0y9Js0!Ra|@O}S$cOP;BT8IgWr_HkxN=VH%GoLHb_mk%2(yo*Uj~|d@9Xe
zRw&|_w=($-sk=BO!>IgumvXllv40GOwubrg88B8Vr(!~&{PUOk`F<)29(bt_scaOR
zxW{BMETYbNEJm&6@l6ad!8VIWlUf-7lUqs&Ia4Q5?>G#?i&i5v-n>W`wM+|Jc{#pk
zDXtP#ZM0;{ZdmF^9~aLgOgK!KN)R8(`>fSKtL_nTyQE=^k?sPek%0?1S*+3{WmrZO
z&c?s7WiPiE@@WFlt8R_2bN;qY?7|BKk#NDOSm5GSTM6vP*%@POzw!2O`fP;ZA{D2A
z`q$Hc9eIZbun&eL){n=t9|I#r@2P!Bps8>YF=XYbUFB^NHWNUh?@BHFNVoUU7BQti
zeBauhGX!;Ifvh%YF>K2}5%tkSUcKUHW=5hrH*fD^$N`Xil-%pmEelI#p~S_V8tKxc
zP?-wMQg-vV=AQ89%1Y@rSX5t94Jxsx?*gG$!6@SYV(q=dn%cH^VG%VdO2CFn35bY_
zfQpK=1Vuol>9!y>7K(@vIs{TcL}Vi%pdivkMMXdn=_DXsN<f;_Pyz`pg_Z&d-wI{#
zv(I;b&pqef`^-P`JYg-e)|_LG@s4-Ab54uzC`R`?>Mjd7TtUO|(7+M<x_tbCcTPcz
z4Z$=1BlvU<{YS=#9}!spu$u~0=9*s6P)t2F_{O|>wV&yAITHv#Ym$lHzvKXHn6bM+
z!ujl=MBx~9!ZyoYD{E87R3m4x@t!YUXKtRiVE(de;tW@dO+UFW^v9uF$(dNo@o?`B
z(`)-muu~F+%*gC|&sfE1IRmj`teE1fVGHsZ<TM;Zw$W}nh4m~g`C}Z_x*7BAQpJ|^
z`kag`)2@W2b4|%+gH3RIP2BL$AlyQn|A>RzTpzPu%QSIf+wSPDYo28}fwULw4vc+I
zv7E|{vYdCOxULQK#Dk{&n4l=(h5Kl(*fbn8#UNW_;*U8@Du~%zdX@Hi)JYWU6m~nM
z<qs~@+Qd=qmd-G<Bjq}YO0mf*byiDT40zVmLdF4y$<_{PYr*Zf-fxTMaXZ{uKR#ox
za9-LjHK^}}rQplC8)2qP&tV3}n-m~{Q|WE)7n$#1tlht8%Nul>utlqhC*?4mujs|U
zy~%2u3iG*VXEBBptz|V9;rE;$K>l+5dHgc(Rsp_-Zk;mS^3<oK(B<zj{O{AcsQHj7
zDW6@DArUF7T5JK4y(c#Otgr5ZUyO(2bW02m7Lm%};lNUu;mZc^-n=pVdE>a9lD?_w
zA3FeKF!}q0W1~87E{3DlhutoHiB2HWMg5>>*_Z1gZ4AdJ9OXI)DE07D29EYG+irSX
zbTr94Wq4g6hqLi~0sNEBYYX2=FS$=vMo+v3F`^o<9Q*v-k7s9ovo4*qMVS#jy(XW_
z(-uNbIh=d-<ra?Vzm;ViT;q~yFzlORRa!oNL*SQdoTlxY7jX;kx^3YG*@kg{^mr$I
zD$OS*KEP+#UPj;O_Htl;OJ;lLo-+9K>1I(x?oZd~{cqp2v4`Z0@J$h&KTAzM=U=zy
z1m)LS8N9ED&z~~5<oWU-*t3?kk2?$Vy%?VR=|%g4zCTVHS9f+A1U1z@bV-rOLr<l3
zI?V6vZKXrbrbf_3G&lSgj{Mmcslzh&)nc2EbgylcH7NSwa3|a2MoQ{TXwlun#YM&M
z-n}y_iuTGQ0V<gzp*07yc;jWIw;m>Jd<gJhYQ#(JSsGpUHY!YP?K1`)o7h%g^`-xA
zPx4?gB6yKQ1=*rwyGyDKMv@UwjYgd3&rb-n#Tkj4PS=~KrxEC@NB=a;3WnrQ`u2St
zR&`6>ncMq?;#)|LGIMb8#2_s%EFS-L)(t=Dwh1~Am>8r#$loQ7zgf$F@*z#sOyPxj
zuI=WsF5s?q+0TKGf;;Av>lfc`VKvMZImCV>9tT)}mvwDNJl#-Mna{*cKRt@PF>n4-
zw=h#nCeumMjeaG5&J^3x>5<r!C2`GZV&Z`fr_DD5e!H~dEIxPmBu)_?7!^^_X6Tjs
z(cztD;kZ***2(qx-}CAtWfgPoO%zWr-dnm4bd6o~3(LJF6(cEBT5H7Bc4Ezy4*cS%
z-xc9uyC(g14tn7y=SfO3R3b7WMe?+p?a#Ya>9@#MlLdhG_L9s1uI%)*h*ArorLNd6
zxeGpTI^z#W_u`b<wVefayk`-XV&}6WVXK=zizAEod-4JR)xM8_^>NMJO2B5g0+_vM
zK(d$CNtvUxI^M&#(EKsc4qak`KlIo3uRpndWW?*{-I>rsD$8pFmUs14pK)7gF&?8D
zU&`Kk`^>&qo_Zs$M}^!=jvZ<TbT?*Zy<WFo4BLet&e8{ccooR*63_^F|J{uk(II{-
z=SB2L5eN~j@?h%Ffc>!jx|!j~->JtNflXVj{LqcWWOv|9w38E^_kV%skq;-o#h9VL
z5GPeJhcN|>o9N}YMk>A*Ig|SJ{JAyYGNAc`YxY2XECBj<Fs)+YUMRDR_O+C_$_T=4
zP6C^eHyU4Ci!*JaS9o!ADMO1p3~K7_G*sh~IF71ObHMxbJ>DPJeZ}7PHq^l`Fu~`C
zjY67R1u5hY*w>pshm6bI!Y3r^*p4NIaIeCQgwpFVMBkueue8jD96XLf@4QaH*0oQE
zVT+8KK5rx>kdDN;MSj*&in&2^-)|BoqKnbSH-kv38u<BOu&>jS!7lFL1#UBG+hUn=
z&kSh!Flt${J>ThR!WfH>`I<v-{U+)jbK+W!tXZ>?%g~@}=rz&ScG>uP*Sjuv@`*oP
z;8sW0$F;ox*2t|eZC#`xTRtz%c#Cj{(4)K0LAzag6fcckdRbfW>gO9tQ}BG%afIY=
z@t4T?*~{a%F5f*Wi)@+ndqEHV2|WoWiIqMT&VCa?k>xyv{`e0!+P)&fU(k>{-1<s#
zm1HT{{0e^a4|Rch<3o1zr)Q<UzS?>{E9%d!^0(vA-yn;d9#s_V2st9b#oOppWtEtM
zU2v|np&v<HO?zec$NzL*-`++C2D<Ocap;=U$`w7V46!$AwlV*1?As2zbp5XV<I~@~
z1;tyfO!1LFyCZyo^*%OH3ac`DmP~1%;wjj;*sb5_??U0pX$42+v30rnS&<N6RnZC5
zI&4`oM@T>xeDyn@m)PS~-+IkQykBWke|VAA9Sq0G)Pu-etzO~=9dvJ$(2hPLpZ*5F
zicYe@#B_BYzc7tf_ksbasQ-cm;&<|!K0qnjV^OoTwm$=BGX->*d%zm@<pYc=_;RVY
zZ9>d!4B(?9IFki{O8b@AK1%GbO~Jv}_YH`%<e!3AE6akm#iEvvCeZ`|N0aoK0ta*C
zC*hxj=5J4;3oV}9i&@)|zG7ipzx{6k5lX~e!NsCC(-VBtTHbcR31&Q4#uQOQ!5)$}
zE{MK}y&DOc&pgZAUOJ47Cr_QzLPR^LabzAeh^!jdG2nEKd*kR&T<vk??V6k*ccqnu
zSoy9SAmTtD{o6u^np!|c9NeGkEt~EATWiryRW|z%ZT?l5C&@GAgq6i1Cl`Seo#3@%
zUVXs1IFBJ)E5HNRdwatc17R%34bL<m8>|de#Bt?UGv(72w->h0;bzHN@-(#@q_6IK
z(VJu2mX;<<g`P{c$C24DuY+Hv96X$I`6A_<5aY}7j^FzQWlw2u>j)p&>$10I$f;LA
zGNZqo>hg`{q`9d_>wSPj+B?bZ)URIKzuDEi{$9FWa=ZAz@#a^Xe81|~)=D4zE@!jl
zy7rcjDVP6v`GISk1gwpYV_x+{^fmZlFI_QXm&jw;OFUw1zOj_q`b$dAg*Tzkawngj
z2wt~AdY!;#Qi8u<;8``3@NI*6_L=s6BqN*FmLAAQX|>?wC0#+(q*&AzVTvHy2Yh>r
z)mg|n2qkSFN86i{wXdjx`9UF!N{1|hmg3mt%R}J>vQ#@L^@HDXTX_8v8$VablEU$~
zEn|TRlA7KPi|!y-{a#UT6^M6RY2!z~eGY15$+r7a%a5X6CQ2ELljODT9}THWF8R@}
zSd8^OAN#GtR6TquX5Hd!fV8eD@F;uNSArM;Fc$J`lz048M5UbTCCgD|rT8f!6i&_`
zHWZObiJ<Ja%72qpXF*cbSqEsM>G{9N`-dJCNGn|)epD2&+&<ozxtC!rh6_Us_prQv
z5%)TDsmZ#p9#q=Dr6Bw&uQusD>|^Zjw0cR-M(evI69m4NbGhbgsirBbEZwp<6+9aN
z{h>*!5@gHQ)`!i5VwVQ9ppU6`hTdTvr^)i!QKoenr2N{8@{x<1Vm*{d+ov}n14{yc
zN2~^!PZjR9N}IUZcG^>XrLh&Y@a1xeLck^G`tO&PlwYhz(o*ym_`{^VZaq{0@z$2x
zr%-EX>wKs)vP*H|Q_5`>Y_nmOcfDE7*S?Ae$9*J|B)~Q8ir*xmm9ct(n;yY#j2Jj$
zhk{u$m~jYfG)S(XBUu4wYb8ZIgrkcsR<Toy)_cN9YQ<)}i~TjR3|rJbxEEaidF%^q
zI@j>qbX2QsGV#^og?_{~Q;+%?oQyw06yDZ;M>18Wd<G*tesmg&d#pTYkY(&72)BD{
zd+qtj)pIQW)Gk8>+{HaT13t!q(}OO1bUCSRbn5=A`)bgUmrxF;SkSjKuZROMS1EeP
zj5fqoYVH@vQoN#_ErA*|=<mEQP4gqb=cb)%c4Eun?}wBroB9lORawGBdpi2b)Vgzv
zAH=V8?*5b|ON(YQ6j4INJkJET0h-8-MfC5npheM6gR8R@XoXR<EY+uf6zO-F(DN+U
z^0D!QT+#I+{=gJS*)TfmG0yyG&Up1h^-R7`gIE(|%50*K@lbWc<-+osaUpaHct{X?
zadh|M2_o+)-&oE7HdB)vTx-E@vgl17>w`=~k;x?{{qn#=II@#om1vZf^gP6n(Esv%
z*v@Vgbu{xe#A2?<oQrcsS7qfFVjByv&vGAflaiO8WnDn;&do$=FT}5+!lj@a^lJ3G
zxreH7mpBZuU(8CbcR&y_dk!@KW~K3DQe4;qeQ$aWjK>s(uC&F|-xoLLe{_|lJ@>BF
zAW1InTsk)7zOzU-U$;%sQ*5QN9UriToUaY*^~(U4{TbuE*FlYG)plQcbq4MLW}uTs
z_iOC_>gy7ACnXWBF-H0sxpObW@A)CK=m92$1v(I54%(3AhSI(=&h@8LQ>oWtKVE@+
zEBy-H0B8LHYP6KRu-p}O3nZ&)C8YQ0wDY&&u+{#FpVC1=Jwcu|4egSv9YoYa#zw|C
zg_N7DPCnk20^y&d0aanU9&YW-9r?Wc>#Tve>fKQKM>*jZA>VV#^FoIfulJQ<D~hkO
z3$K!$Jc`v|&=8ZMXqG8wMuPVg7Bizi^rRpacQf{(3%Zfb7<7X^gErR~jt8zjNu35M
zF|I*_l3D1>w;teWxo4*D=$SWR#ZH@VUY>Fy^v$z?byy}FHrm*626h~a_k8c~+EZ%F
zl+D5Ya($>w0G{ZGm^aWNDG?W>4lHdz7PjyP{=lgQFFbQa%%VpYNxP@FBIV{$!T4d?
zp%Vw?Jpz<aR##N{?ZY`e^bYJcp8;^yeDJMt{Z7j35?as(+|7sZVV>*K2a9hLH>WX=
z*Li}0W|GmV^(<H7t0pFB)p5Vp9%@uaw;xBfHuw!6E&NO<t(zM?_odhMVKA6e8?G=E
z$dZOW1uJKd9><S<w_+W_g&>CFS<xJA;h9Z5%ZJ!QSx*&ERfOzFS~>mu-G%+kh=m$=
zoq2b`Rb%#pYWMBr#-3qm*k1rsWUcjgmu4OOtEW7Hp7Nxf+7DXksm)tvXB+Z@il8n=
zMUgs&gRk=*;wVNI@UgRb76WFMgMtv9b?5<QR>qTnP3sxYAuws$umNia;60*aYwOu{
z^<m-qtJ4LMOK`!AZyo=0v2FL-9I`$HTsIRPD=rzaW;OSd>sr|R9J*r8uAMSVO7@>P
z>>zckH$LXQi;+c>Isey#!8ixt=abEcL`qY{X7A!}|1fFa-hlTQz~67%EJfnZ`hIBX
zRm0x%+zw}*`K8(-#yOgUs|Bn<uPvH&0C&p<egRL(e>rEcY}D-|;)|vG$?_4oZc^un
zRlihMJ1ajDq4LX(SNx&n{E8L(>!+lrUn6r!4-cudf?^wNzeU6yovN9imH-~c&GiYi
z8N{LQ+|GVK#_k}YR0jE-K?1F3_(MKydI}mU7ka#BR<QIS;s9+YnU(P5(UuL^O<>3d
z%@2Xs1uJzXDg&)UR3n)!r(H8swfk$psC^>fN}UW&fEbCA;A?%_pD^g2Iqn`w-mhow
z^`0QH;_aS$uMbh3n7vW)JKpZ=NUiv-uXFFq6ul*S1_Plv!+$Ot%#dt0`*ily4^@T{
zYA3NWxee4n+~*@atd`p_<Cn>i=3C81cxJom@8qI{qLKnnwKeBgQ#VXv42?3(hhx{g
z;au2y8sXpKSU^%zmvw5^%hy>gf3_Q92G#eO&F95~ZuMo`plx7z6(ICu*XuVdMPVao
z5HP)BW1IEw&8>MFnQTA3d&jTOl!y#gxeE|BR+^MAuFYs!WI_qNiuqR5x=pK1D=5Pc
z7)8DhhDFuz$Ma7tB%Bgdl<w~dUVUPHR7v{`R2Dc-LULy3Y7b%8bG)z5_{T}4KKP|s
zc92+diXXOWF%L}!Hzj|O)#MxrQvkv~3Q`SY5TXD-kCmofV?GDYBo&2x8b`|Hz>r}j
zF~ucMp!J=7tF{VZT$;vcMqKNxM5aWXjX3|e4_YXn5k+QhoHoBe2x_PgbB6u(WbfN&
zq+}Jz_|W}|k5^_qunx^v-7`sR{q;#Bg_?%REb!SIkQyHSymF<%cW5AdK#Zk}Sv+qs
zWV8&49vlX0@Ah>1xw4ArjlSC8%ptI^d}#<UGBus2cGWJh0+a=Z0(|b@fYBdGBwizA
zY@(~7vTmTm0i-0372+CUXAUhxrc=9o`VpS6+iz_h*?&(p?I6{Oy9o1_NI`|X<Rd<g
zYRU^0LZvUz712I_;>W;XpBLhVqUg4(5E7cUkdcdxT%Xu})xIrYrIF%MByp+^lq!gf
zEV*cXP<g0^^>se&KFj^Ex{kd{s>=BOl{Rezo!-urfiMG>FKfDJZS!_y(fevz&`QV@
zh|o46Jj}k5Js#$(`1VtGglgO8qJ~i4QGpFo^y3?v1%U}Q5Ug7dBB23v@FV}vQH$Kp
z>xpfNZGG43;Uw-y*9vdCBr3K<r@tH)%Idw)um7*{(zCN|S`3MO(94gg)5bD0!hp3j
zkI1itOX;NzvjW-Uk>U+vW}Mp<n`58oZ1436+-*&H=bJ2J{Zwp74#qgY93#`Ha)1Y`
z`@ivYYD++%mRSwdvdyinAKlR>Pe;cU1_T5aF31&XIhOWBOkEq^3d_)$4aB@3GN=SI
z()J&Rml++&PEDTX1Sk~!h;5hqyv_3L26v`VPiDkHwKC9B8SEK)mjd*u#ZXLvqIIu&
zvJ55!J`~IH#5_;1XX|wMdTaJDb^~+X75HKp%o5~X(ZotShgb~d`M6F@D>E#N7Ek`l
zNq4~jD3w1dTeVY2jq0k8zQoJx-^|KQni`We)lhOys(Lv^Zv}-PsgdKHgHeK64%aab
zZOCQV_9LGj%fj0Xqgon)P%#{B46Z|_&9;1)DVlf3c=T<vN`s9X^V_tEFE7AAU2GXi
zpX)D!Fluh1oX>SqigtS%_38EP>2Lx7o<H=#sa1e?8wlYIdCCW0J~R9n(kH(4XEJ-q
z!*FbK%#j7Th<jZrSxG7-13|!8&Af3xje7>nqOe&ZbijJaKgciI0$IYi){De*aEcK6
zbhhvzV5ZX-Q-ya)y8fvyB1I`zFl1rgoSqRx;!o2Qkk80RlG0x@HFXz7vB+>3Kb(=#
zVONr9nrY5~WDPy@yd!aINN;gx^N)kv#tc$?OwpvbWjH?IRZcPm;`Lx<9*MwNp`3M?
z%a}Sd-a(}h1JtFAwuCCVsZ{6pKy$v1asIpG#F7+zvTBL$8-YA%M=U$kVBBuGjp~h%
z^%BJZqo*sP6oPp_F4nVYZ}fy#&vcdwaCvKM)%N3;Cj5A?pt`g$T>!O?f57H{`|;<1
z;IrJ%>T8D&?|P(7-;^NkYGyH2D!N;#M>OVJ=eNG_ve>HaQ2N)6D37;#L-kcb@jGFZ
zipr2y9k+1k>ojnIYH)EYY;iC`IZ7-6a*zyIS@UMBwkhS4XptK)2-hsed6TtbfQ<~$
z+SMk2=TL`TY+`^GQ$>0HS<N?OJw_IV(5cxaW1*2TLM;YidgoV+^1_eEnC~ekcL&9l
zh{hTP*!n(~i@mm-T1s^o0?0N(=K1brAO{{wGvf`k3y`=`zMJ9I{G_PR4EJnl02Ve2
znZ}K&UFB$P2C~@GC#k?gorkx*Z2Y7Ephxt$)HserT>4<ZZ|3<*GHY1r=K=uo4fbPJ
zpJduZ8^8BE;)l_LC7T&gQLWp<O4~lFST41(@OI(9p-S+y$+v05H>en~f=SmxftRjA
zTnO+;vI<~g58uLecvni|hRJYLENx*@XxnbQJm1TR$Hj_gDzBm`Cd$7k7-%&Mymu|g
z{4O#-OIZfH{KraIQhJapvJ(0RL^tc3cj$88v}>xK_<w5={+(CV)PLmUsn5T^QIPPx
zKdhu-e*El@dbjh+lq${N0CWjNm&r*@?*+3?6*Z(O)rkYSvK|YirzrxSdj?v56~fFB
zWKhW;gpx-|)0y(CZ&#B(Gu7G)p_*t-oLv11kzN8=dJyHEp6sfn9~it?|NgeB*5;R&
zn<Len3cI;S6N9Hl)G9#GPXbHH4?ju7QZ@qMaOmA~E>XpwFF>q-fAZt~P-fJ}%^D0v
z6&Nl^ZHD{^w)+*_Ebgm=P+=x$F9Sk$e`1M2zZ|W}vfs(8B$D5?=xNM1^nE*Ma%9X)
zm7OaNJ4IxJA$q^Zvs2(>gE@Y~Kb<0gV>~7WtqKw}!>2|He}JGPL&89+IeQM{aFgfM
zK_2p3p-y1cphNA#!x(>9HL^^;>0S{>n)*}&1tM0NPE2I9&e?`X5W%zi$S17O&sTmN
ziZh496SI`vQHz)q!r6$izu-nso#{S@LXpz8`v+G8nEJ1rU(LexgW`6_Dg?Dez`z-y
z{`}K(|Jx7tynvp0$3n%1m2BYf27&A}x7jcwC(nl$vR%|1OZ`+rr`lZ~$BsO<ZVp9$
zk(YW3TG$9?Jg@O7OK-82^1Re9jd-s5gRBBTk`MNpE3cAdQl~(A={vf6_60&~wQHf!
zL`3o^&jmYf7Q5El8Y8>)%#|)EpWeS^<@cY4=RVx()f(89?9l=hDJ;ZmIilYU|90L|
zrfl^Wg(ND@AQCiKI_}(n0>H=C16#qze)6?0%a5Pvp$Fq-j<+vrwGTH-7R85Co54WH
zy2f+@sFXP4#pg_9KN$%d!fVoI0K`euuPY|?jgk87CW2RiuOQ_9R8eqbjMa}j!Yhwd
zt0ACxWh(wgzp}MsD>3)=EVI?>uIvd@Xj2bSqhXh}1Q?bP_`ow5)3Eb#=(T0a=7;K!
zI#}3z&1c_~mgIUi13fK;ga8`pBw#w*ADWN?7`Net{Ym+&nXD%BW4~sPgE3ErrW&kK
zgvg=}f|u+#N*o<*V;ckjmV_CcsgED``a?}Rv+8D(0pOKR3a{DcIsjeT$@d>?)AN%I
zjjK3!`Zi8q8|<PDsucJ?F$q!|Xs?6W0`vGPAGGycnZn`kZ<>*u_!!^ayxO16)()^d
zizNCdV^d)A{SIeP-tC7RvVIyH_e^YhFOV1B$cg}5FY*w2UukN--uN1UP^UtQ(;MA4
z`%)RbW)ZjqW%ww@1-9QT_-~8Y_fLxu85`?}jA?v3SH#pNDZaA3Ru(VS$Rh!qCwRX8
z>@vUj%QFbt94w=a5`j1%LD>6QFp*dQNsn26;P`e)o?8@wRYrtv8miGU(Kvvd3ogl1
zp!MEQmh;Ed`jNEAn@FW^NLt=C-R=19xuPB}&Yc^xj+5@3>g?*Q-S<n$Q)q<<O_FUM
z!qr@?r|PM!Qn0%M{Fy0lwx4!Kym!A=z^TuZO*J!w)8_AKpniD-LVwomMh#qR@@@ff
z?!SlDPLMpOeI2x(DG%2-&f3lf^Y(vSMjC+Oc_XXi<6XBMMVZukP5&V~vxD>CGe48%
z=RidEXH|IszFc9(<>*zUo}SUku#TNMk(GVgv!3fTIisyGWBb-t`5i;>uRKUg3-Aui
zpvQSH3!#xe1SCIfYUb~zvjg;Bdk2=b49Y(;W`?LAwr4d69uvqe>)2{Qo;SK+HC1}a
zyeQ#2pHaz24Vor4H4FKEl_a+qoW>cJh$x2v2C)bF82qxMf~AD(xk%K7Q!?T>2Ug-3
zdRheeAr85j+xVHc`mPXSq8TwrwItrm{%?Db(KCN9E3xW~r8oE%dA_w(Da1}!D~;vw
z?y8?Eu5%)oLnhPlZzXHI4Ax;Nfh-s2E2Xpo*{2X-HoCSPcW3AT)OBTFLrvnsg`o(R
zEYI>(gJr*a^6xB0XI5t)m6<q^zo8k1j4hey^)H#gfxIu6w?oWV2|vIZ<Pg#MiQ>=m
zd*l$s8qga{@#C(oT+8tM4Fe|q2M}ti_kH^Bz8w)cjbEKK(<WtF&2fcsCAL_pV~%n+
zoY7z4)d0T(;d}+#d_6m}ma$i$?nLTiYaNT}%PG4mBONumeX;O2&(KoT6!}@7@$&A%
zR)F5o?@J;UB`&+D_+ujrxtlIL3&tl+(HYZwInvNitOewNnA#k88uNo3;y6^aaY&tp
zYkfO^;#ZCUVa>Cz3rLcZbm;QC(o(HQ&YGe&!c+<71h0B9G{zqQbHWhT-u0KP3T%NK
zxmlk#6u9hK7pvru(M3I)`Gs|3GHUk4a?eRaF@w=fAf++O=Iyvpn!0z2k{gg-Xq>N`
zbB>#0WylQ7K2K0JfHZP|m97A<Kj3qaybRLXf-Lm-45SF82^=+Z3|nhX3kUw;KmT6%
zOFz9B(y$u;MQYW6aFlcNdUQ1Byj5_MN6^x!i<_Dw+70ikL_^MLHwpaGTw!fiGVRqo
zW|eqfO*H>;L7C{SBA=AIu(!VR%CASDuhdoyYu);d(gU8?&v0Y7srOFC7}eO#Y%+Vt
z9WN?f$GU%D?VA79KU@K+|N4sqJ6{d*bR}seehsv_N<}_d%`XH<69C(_2gxcFN4|*b
ziA*0{2kN;B5q8<EpHd?R5Jv$%|0RT%hC{W}M>LtnX-+E-7O)u@;;G!vo)?ZgSebcs
zP2B=Kbu4)^gw?jgdl@LjqDw@V>PL?Zy~8nvYAe3uEC;ukp!y1haN&>v5OP{jERM3n
zYV=YpMO5pJKDnvQh;<IlEjuEVH8--=#3w30q4;?|uq}_Y31;BHPOCTdnqxb(-qdWO
zxW>$AjIMPLDZ&5926aQ-`*!LP$9hx+E2f<Bq`wLXYxS2M$iq?TPa~?UK}b0J^^vQP
z)Z*%KVH{nK#>NFM4d7K0uza_0PoqtXp=oHfgB$=I(rngG0CAqq)D}Z)7ku%6|K{$?
z%AcVM<tkH$N#D<cXGO_ZPc7rAHm%G4C6EbF+fQ86#d_<?nSb$*eSm+AGc2`kj5lnj
zk`r^E%;ezZ))B`&o&p$0MjLQl?Igv;yS|un38MCuaqgni!hruA0A<oZm1?fW3Hg|W
zVugeKA>KoMx;hIT>{Y)SzHa#{rTst-A>9<>K2$O{+-r3wzD7e<QA6hVUr__#e{)Cx
zk7s+W`8BukdcEr;Sb6p?<Y@?m0HuTHt}ebn{jmY2oleQ!tp2X)Ex%<+!`tQI<zJx^
zbp|B4=^e-|uqu;Kx<rt1i-V}gWh>p4hWliKdvp(dHY&E(fb_1HET?CFMz8AMJb>m0
z8>2eaue}(vi7o(G**_>c52MtGNMoKRe<aB*rhVm|1JcpTckXe&)EMW0p!&{rutNk=
z^$bk4I6)J4wcnBgpEa=da=xN24}BVu%hDF39551VItLJ=+7PAvm&rhx?`kDWJD-yG
zw8&HV8KwoXn*#(XvEyqK8!3N#hu>_NZ)-ortz-W49MvbUMonGG8E`@uh8xCyGy*YG
z8**s>FHddMTX)xz{Z;8Jr2>4r5HnlNHIUbwTt}{iFib0pgjcF5%UJ#o@8|gUG5CQq
zr=0=TM;IAg5{Mm2)<rp=Uw)Q%)Hl>msnok~ZFe3wT%9xPMJUSv;{^)XHVnYKS_X6E
zJ6MBtNetEXg96~0ppf`xL4bu*+W$Hh9-=e!{Om)FMA06Rh)P)o<xMIQ+44Q*#_-o0
z*%|FL@lJl<Odmx4DilEOfPH8J4_ud&7c-+j5<^z&3L-ZFdnx`&0a5n!?YWw-Gy`;_
zMIZ)X!Z!-9l`lm%zb%ck*@2xk(#W429W8pG7S0_EvYr&wHMbOn0R4InMLPYDs=%B8
zfNwshLw1-}?j~eZ-(bA-<!se#+3EWe(PzAz=#=IXh=sZGd;i^pXBMZb)MOPcKK@0a
z`mF~_mxYKU+gFLp|Ghh1^?oAqWf$vRrH-wIKO^aByF_Hm9}Tdtciz|f7Ec1p5Qu}N
zPZQA+J@xKEV3c8rD7?cSB_g^66s7}N_hVqECfw^nS2HK6fQwqB7(O@P%G2&GJZsPt
zqA`@^>Z;#ofD(mQ#>RTSrlbA-CAns7rk5asL<ap~XMRC|Ynv#cz{xtE{<OVTKG)4J
zLx93L@tWQ0h?nf#3`~oSA*OL`#U}G6bDGkN<qSv8-?|w<E;_*Uf3gnKB7yh!b1xWP
z$>xUfEQHFqjYlx`b*cuy7c94F6ZdIwZ+t~!iGIH<Es{xxFXrzfSW$%gPV0E{nQWsE
zen4@0qtxG{`$~1fFm*q=LWyr`g}|>@@M+-o8cD`^;Ablh{>d49h57>!MrACxQqt9a
z_6co3LuE{ZvK@fcqwU-kin=IR(@^RVSXCKJ@K{_0O+3Q|<7j9^WK3oodo{1B)e5-%
zcBD7|#imsl_pbqKrA)o%z5i{{pY8;1JPVFly`fO<w)N*-SZPU>Kit^1ODB&~O~*8W
zdfGmIg->a@!q-kdG4w9aM~3FN;e+4Nw&2PePOcl3eIfy-9od+TbP`*sXC2~^L<b5V
zlXu8I{)Df|egO+n82U;17-jt1Sn{R`@tg@|i&ndGMCX1J>y8R$onKq)p<UxQO*;1n
zPr|MtpGU@^3HF=TQZ(T0Y_FvtUp^uZeFo}|)bm}|lKMVo>w&0ueORMXh;euGfLJ3#
z2;iSIR^U987rJyN%~)?)5s?NIL-|c+>6H9ZS*coY9grCSNgH^n3LDSp4Wc$%sd(u3
z>GZWeUQP}N)>Ifk3V{69yz7%X^N@<kF;LI9j(EX(0Ee<tA|?wC098Dom{;qFY5W`E
z$xjI4Ae#t|017=Ti9HAuWzrz1s#XEqr}IxKGBbYX;mQvqX3hhJb&710tSU#ER)bPf
zWp0FjXKqBlAzYL^kE)*8j6B^Wh^|E1j0?i6Oc^(>*&@};RF8pbWLs5H*1A1F#OqHS
z0j&a$r45hx82<WNadZul{QsfLzgdE`9svIDoxQbs11Z)Y`Sp**0FQ>vM@M406CVoT
z?`FP~YT5&$ikN~6%KXkwu6Y{UJrq<z6HTE4#pNBQ->Y_)4CwYBLXiLIxAgt_TcbV`
z`NWgL|G``ChxE(pcQib2X`w+{sq(Ye@tW3-nn*J+QJ!|yB>u_=3oR>0iJT?Fk#l<H
z^IFOKR^N`se><aq(HmR$DK>Q{eeX|vvdpC$tmCF6e`M`o=q&DC&(goQD3}#C_$Ok}
zg0%-1h9AmCe)emT<8xLY<3B97T9dFk6Bnm#rqg?np(VQgKj4f`O{i(Afk&La)gP)?
zRohdYfzTm#aV?7JN~a+9_)5k!_8J~R>@S+K=8n_s=G`Y0B!OxnzjW#58qBX29!3ks
zE#4b`)56p4S546RX^jS?CVI<KlYC|*>x_ivX%V7kC&SWlTWSMyo%P!<eF}o~?Woo&
zLC@5=?KOc#Kj`%PS4^*%?s}ia=kEcMYku=UPY}b&8&5|p`W@wkIX5?6_Xwoz?V~g6
z-mpQkihhyx;J?c98~6pOk86D4zm4+$YzErT*2yZ?xO`c?p;kG76n~XJ@)wb5pBG)<
zAyU5LbDljbTMzb00WDU^`r~7s-42GGX@!Is4E>@+s0%|Lya%VkfMnN>s#ad_%Yq^!
ze0v|SCwAV_kp`Hgq0}I5*%LK_pC*D1XlK%?<zTJ#ZD>VnW~#eK)`q7udm`M&%}qOj
zDg}+*u<C-4{9uE`>*Ru0GT#66b!ra)_nFz;0<Ss^S>Sl@iN#dgM^n`8nIzw(HwPAw
zj*o2fYLI2h%d-n8`SAheD(=)T1!|f32)oXBg(9cV&Vxd5IT6iZ5xlFG2q1r<$kqjx
zq+e)*4Ovbez@4|c2;e4w3jb}+7J%1uGCWa|aD*b9ne~LG!-CdAE}hv&T&*!C&jxig
zit{6s#orMM@VO;KneNpZ{eL=PZA5|lj-C9xCJ}q)kN(z-c;P45{=G$ULD{;neQ>kR
z4JmTdu<<}lAF}UckD@@0AavQ)@ZHJ3yzr-XQ1AQd#t~OmIYGq5_rn=#FOLG^ra*>j
z*yV<75H1jiMyw{oh42MUKu1=Nwd=<|)c}aCcy@s-txNPaV_9B?T#^Au&mrg0;qVe-
zZV6CPZkmnLS+O`bW5Bz(V*=MyWdE}r{xi9IehIiwrR9sjD&e8Co@$gGRY>gk)am_O
z^?j7=IoA@xM(9UbzclddozI7w&&AOA6i~|+4t?_m#?a7@M)5T~3B#p!SE)W+M<_su
zVEK5`a)}?e=#7=`M{(iV!xL3=o<K!SQ49}^7Oo|DCWIuhO!lG<qRSPB!Bw-M6;Q0N
zmHl&sCecy$>4OD;=$O9$@5hp9_u4VqPvr;z9hNy!{lkv{5=*K%Fm$7eKA0k)^?1Yd
z9&nZ|(ot-xTs7fLql8upXjWtgFwugqZ2!KHrm;sdRW|*vi-GAUb6tnQZLtz6((5!9
zvJ002knZL!d_BU4CqoNq#d|!$vJ&?+0RJa=PrIP3qCVmner@m!`GbdYzrX*#OOCI^
z04^oAszPtoH(@sW$SM}Aj;UATuErGh4kEI1Aw7=6Ta|r2%G*>+0$Bhb9{!V9?*P$t
z7F`Z;p98wZXZ=7C*!~b2RGO+f+fh=qBIg3?`oVP-q`}dV!MK%r9>AR>I}jcE$p9x(
zt+B?PZr-rhp>VTz$eI5V6*&O+sfBHwSoKJ12M0>cDBUA^zU?Ew#jBnDI{4Xc-}Ga6
zQ5N9;=~{={y@5|{h*ZG)N)QlSY}>>bcTAo|j=ZNt5#*J9&Nuj213(y1Yi@W?BKVSC
zgv%~Zn{iitK6?pNgEzd6`d3w^i8~6i<b+s~11^h3AAsK8lU8r^QD1gyaAuepxUiFa
zH3JGj&ub#E)kkFWohBQv|KG-di~Re>EN=;|I!(!d-|?3u-^prJ=6k=zhnO=8E|YEj
zo_+gtFmD_2ESU8VCjw;a`no_iUW$6={GiR~O?Uug@w#Ant>kVrh+CN?2oQAkdc%C`
zUG<Rx>o`u5Df7>N;Fb;sC{Va=oQBn*aglB@rYLF!_^f)W$kT5Wi$dJbtN!J}NVfp6
z|M~7;HO&CP+{6ZzT2}4tpPuA@jvUfqz<udg??|qKjNlD_=<jOwdLK@I`5ij3-Duu~
zyji(^Bj5_!wU1990P;hM43?qI&zo&|Ls9Bc>c1-A8Gj@=0%Lj$X=ntYJb2K{cZBM$
z!5E+>!PtDI^YD|nc|q>Q0@Z*8L!v!2LUXwA7$clG=&h1uKQjtAoN=jW@br6wZk@!t
z9v`oj&YS|0wXDB{97(_vl6iYtwEw|x{coM9bRck_z5kult8a$b@W9tSM77^%xKRv{
zfVJHF4VPIqxna>V@KzECKubXYXu7<PsPr7+j&IIz&HOk@`zRGmZSM2%SbmwfBE(Ku
zCBb7TxCAk$BO$8a8X^nm7@EPJhF7N@u6BoH4`r~9;><yKe&&7g@5~#BR_l8YzFyVr
z{ijjx?GE6+>&HH?CaI(de^s~FXEHvCwtec$7Di~dw<$ph{V=MDr@9_crOY4tgaVhQ
z#CmlI0cFU$vk?F$pPCG$K)CtQygBoa5dhZb3Zt?UQ4yLE{XJ$he#fU_f%yH<9&%xc
zf=`^y?)*6eAQzwxgDIZH-+5~bD?bsqVoIb$?QVXNa_pjmPls>5LQgB8J>3C#E!jp>
z0R2~pltHG)z`e1kelfl%OSMj%rNZldTD0FPHA9c`XHn2fTZ|$s{y^7}(K3iA)w+0+
z(c(U=bEW&fqVuL<&AUB?JPoWT_5gygmbx`Tm^-k&yd2vu@rY&VoHG^g3KVA(erVD8
zBsePtyr6A}+N(<E%AJT3;6+i3!^Kbot=pE?^xvPUPXR46OT~F$!oTRmJgWaN_CB!j
z8=ADp+K(IUdL3qua?(R>UrNn7h120(BEVcOksl#|MFN{}A$*-StM^e>i>Jc)>!PqC
z#SG_rz_3dGJ**eS9SYYqz7P2yGRpsPoF7NVhzhKjWs3BMpQUE85&>P7QTf=r7hXki
ze@ls<*aVfN)4Bevt0F8xhPI~9hOL93?qBC~cf!j}=`V*^TN#&2c4V`|Or7>2;W7i)
zSi7Jv;mHU1`qFP0#z*@DG=&X-9;V!MoUBl}lW{?FL^UbbmV^%SHyOOfx{g7A3TM<^
ztj9IStuYzKWk9h_>Uslg`|x{yW(nwNi{-A^V1|Q(NiRz)exc9fKi@htV09%jyT)?e
zRJIZ|(-$CY03rdI(>}DZFKxlA4V_VSqVwLC0ejXy%xJH4ahAOC)15<a-4Y740Hslo
zk88{GMAKfWN(1O{&_Wbp;e79{^^~3HD0`sfV9yBTummI~Dq3_8X%1dWa%*``(5$*x
zKgb<aT@9gGTMB-3H#A;%?%H*`eR3roSMx>*;}65}o@o!eJ@CEmOg(nJ{CsTtC2Du}
z_M_>J-9nJrJNVmW#4vFYaEp&L%|a_hXz0LxF#txSfX1KPY>deCwOSTT1G;H(!s%*I
zEr@~AwiFSo+=%m6u11SW(eICtH~m$+*91yqH)(%+Cw~A18Bqfo6iqd<JtTUD5fX<A
zM-vH@@ZgaNrsnQ5egkfWQ;rjFJK@pH`BvQB2|&ckRe^u7HKL?_<@o!l3wU(i>MIw+
zu`or<SKk5ZtEHAz`-fDKj(1p_B<DPwqEL^nTVUzj<H{HyT@c5-SwCV+Vn?7PtwjOs
z{kJe1-M_DG{AFq%Gxk+#HDL%qiMnh|Q>9U!*VSD*vGK80c0C7Pknj~KWO@FEa(*h4
z=9jqp;xve!FT-3swzu6#3$7;VU}yIgx{cJ`DW0ISZ3}Z*>|ze*z!%-3o5y0+c&|Ts
zv<{)v3vkmo0SN0wy#hs+$hnejk_jq6uyF`L=>W!wLqQb8SMt7Pfp5+*pnmL2+fOM2
ze8S~2bYnGBayL%?T~<ogVK=LD%go(JzYh!i)}2n3`&aSD=fA5u>jhMP<xD-_m3M~E
zC~4$G_INK&=@pXeWSCcN$+5jIp_XW4M0@9maYyZZJfU`&9h`){#Us?@)i*c4LJeiW
zqe3?oON8I@13&b;oYbv;&`Mr0)*$PaTsp-WSt2zPd|I^y#}ZGV`-2#Ry#h<0I>4X$
z2$8l})TU(D7JtG3f6d<&P1s+$GIPVl9r()Z&`sm?2i%lyV7Jrx8hiRavF)sF%M4`I
zj3A&_lXDIg%g?H+L`*U2FV-7tt>x5e@&j8FO9&c%Z$@;}w+U}M+!eB;D6QtgCeP!e
zC2$k#ZdFdTSC^`dMj+&@rc89VLzia3!5-BwZkZ@I+c6FabFAmbK4F)Op|XHryLlsW
z!+$4?3g9eg=bB!<WPjl18V~jyvi`lu$!odNKlxnY*73OC&QP6A9Y4izdB(l3%327j
z@oDw#mZp9*NQ{%!)?L<=^wQyg1p+r8df#me=KkR_0m*?-K#+VNRb~kERr5H;A1Dr>
zgp(aTlZQDUCO%A*<aA^>F6&SD>k;^>$|uOL?ZW}f1;1#fMIZT1r`SB^E0nORv|qQu
z?Q)r%iw3P(7#|%8tCf$nIu~mR+gUH_ul{<vK<Tw{eS5AStKD>j?&oXujbk$wg(=0!
zP8U1jBQuq!V!ygdW)^0cG+C6IL%)2+53z+y^9(TGoQg|$)vpXaJTKF>aNS1D$Uh4e
zjH9Wy{Pb+^GoL?u?bRgyLYM1qGenm{&W}0e(5AMGO==l+@Fv`CX6aA!(sf1~G>rDl
zGT&o)ER7s*qJ>+p1~&HCt&)qQ4M{I#D|DtggD13nvyNHXL9v$BM4S<Z8)Z%VUGVHk
zx~_t0U3a^ET|y;VYqr~Y-_=Kc!Fscwz0|+>;Y*+yrr{;&vPuN?t4-H$hSTD+sWIOD
z-%7~9xqrO=hl$&!`jzl#hgb<8zlNk+>?~H<QFim60RyN@iDAN!=Q5=+m&RUhtlv~R
zFHFOjVZPfIZ;OaiNLI8@$iECNdGOJiY)DaD;52YA=Ox?v1c4VRfj;-&`Fv0!424!|
zxe_nCMkKYU_&O7d!hwUeunYlI3L5RN?$46v^~m%1L)RK0M66*lxbqD3P-*G#O0o7D
zGuK3l;zRDccW5+j6^R2y&446o7e@crm()BLWh=m_<{y&g`yx;#RE!6n`ypB>w#V5j
zUDBdLHMQ}{ECCV?!gHLELm#^Cy+Z*ytm)s?Ae&$_LqjwKr-x&}GA~2Qkq_~jKD5&5
zO6w_7g1X`hlU|?F&sH7w`QcMh7S8=|B?CRpJu^{r@Tu4y8dB4XWV`gnB#A}Cqz?vo
zy47?lG1Z~PiM?|Y{nN6Ab37;BxH~CBJUjNBmG1}w5$%_pTa%5a?nh3PH%|BVP${(~
z_V0RqCem#kvPVwy#)qdz!Xos%E-uU+U^i7~<Z9%`z1gO#R5-Y&kR#DquCD1d`(4qE
z*cWdbT%&FYSv>Q_+<CFLJ!kSlakW*lS$AruTLf0o6g$63ZPA+;TQk2&{|P=J*Bm%)
zx&7n^t&X&sc*$E?hosKGpg)RbpYJdN!qnR_0jreIQ&t1wG3%DgR88AIR9IAj%}3M|
zP8Ld`_9uI__?rMncmnQe98|f{^_=C4>L3dp0N7Oq1Kz3jCL{1>p>Vok7AUzo-Rjgp
zs{`h^LS+SF4YrWt{0&HU&hOpo->>^@hrdjY8~1Wgi2wP$b#iAP)ElSqAij6!)R*3!
zOEofjJcn<K_v^ppyU+SW-eEKHai;Gpa@1__i<5X~QOVxl@rUNxW)_LI^@4JeF}izx
z{=|BI?a{HhA3E6*5Yoz``e6LN5C`5lmI~L~;i*#iz+4`W&TSE{XG}z;^^mCX*rPf{
z$!g9+A7JZqcu8v8XF;-N@n~PcCkGPE$Ew(rY5E@aXkwjked0Ng3(fsWQfx8)>s5?j
z!7Qt(_WR;&(*59(O0|BBHEsc0dW*y62sC!cCnIPXg`IMo0bYs;T#S--ixH4L=vYk%
z>A72_$P8W3m8^Czzdpmf9<eO81`*3)KF$M$<$e#3wlVKiD!Ll<?ooFBSiI8GU*pq#
zC03XrV^OYb%eCq~=ru&3Esfn^n0n`ssmlwCEH9X8*_pdocVNNyR`rUTt<KDi3ErRC
zE$-oqbzz;g3&x$P!8O68a(wS$lUGuu>P~19a-Y@rCdi%NZpe{H5UH@1QXbl2DZ5mE
zBg3Zuvn$e(a)UiWphnAk3D<@#O_(Fzk|=Wq5lN@qCO1xGy$~{ve?FKdWIJYtb_>uv
zYEfz;6$N*KMDEVuJW?)b91kB}7%6lbq%?_H7aYv%(>TRCAq|+Ly4klk@Cfmk8f?K;
zsjcB?YbgxRjXm7XJ!#)HG7Z7GMtXQo%<)*TIuq`>1m%)>cenN~cajyifNI_2(3PO>
zrNy(a@;rGcVzJR~AGo{a$b>4&7@Fgz-TAD(pA3m9mh$N!svm^?o_*2FW`FP3GVI3>
z?D};C(&GNP)7^0VA_32?JH#Gr^?EzSP>iT+T4JEg1|uXSo#4}`V>L90=D@j<TX0ot
z9nI_EptGsVuyP=S^(ka05QQIZ#9yeP6zujeTwaFr(V*78eMIH#jhc{>^VTxi&rRtD
zi#fZKqMJ{sJ8zV{7JD`JhD9tukYo~Bf7Oiyt_{T10W5dFre)qlUrv1Sk297^Sj%AG
z2ym?NV#)W1s>w%!=WDa`N{?COmmF56EaAIy8siaYo^Dr08Y?D`pz(9bH5@fa$c~*c
z47N=?RJ_TiPrlO^?+5evK>E!X_9Lb0JK39kL%TG3PFI;^Md6gJUiHaw)0Ja0c(bsd
zlHM5On6V>P<&#;R6JH*xD>=&d&Z+hv=)}(6WjBw1cdL3m((T}_-SK&gz5#~Hjx`8}
z^ew!ZJRThX(f)f0aQe@!g~?4b?y0DG0wPB;#?!&g3vY=Vtj`&J>k^SkaAN8`qEg0R
z@_3jy@4NV8=6T0|r+V}1PTE`J6F&8Dj!EIQ2D$DU#S<zsvc<_!HH*eXy9JIoB1WM^
zxc-TL>@jPuE1TmfR;Z&p4?Rkd`eK!!m`!49jQosuW@sFXUpQgfk8SrwJa+JoqL4e^
zKo*em&^UKFSn|{su7WJ<3FiWkFUCN+rJ?7OD^-magEi?v|4KdcB@g^HmW}QDugC?;
z$RcIUh|{V{1K_0s$Uww0_mOrBs1)@qv^x`Lo_EqS4=n8A=;A4z3%=b;#dc1fAOKe&
zhJuUI^9p2WyHsh%f8{iatxZi*lE1>0#@-hX7$aZ&74rcUJl8E%rdecl2GK2bOz&>+
z*0*bW0bmPBPb_R0CH+woE(?}!6{p>vjJbS{R%rGkCys`3#KU(<STiI0dTf&Wtgz!3
zt05Yl7JtsXIu!^5kySKqCG}_ZU#zzR;#O9(b)$2s2Co4OKQ=v^=2hdQT#FlC`lIQU
zB!&l_dOr2OJoIMWN8Te1=<oNkXOlhevI@QYl0TOYNgz4$(2PVvJ&zG;8<*EENfa%;
zuN7y8cz?S%-^O#0JHGVPc?tbC?Bo|?B}R5D<Ft*j)%Tl9B}-<=CJoH_B+TfILeg+O
zmk^qaM>Nj4v7@p!oAg052ot#|>5-X<ciCS`$2tk~(;R;=>L(kh-@JzwAgW3bq^jw;
zW2k|hnfHtw_Q9W+B!Eyun&uXeWoo!MuKN<RZDZz?V=tVF=q1qe5A(SzfR6;qhWge|
zM>meY@5qW@Rl4C5r-9{57N!4EdZ(VNT2A7$%5HXNU+rl`Dj0ERCX27tO}Nx}a&BCH
z=(ptWr5|qMyfC35o0w)|ekAm+tcZp6=*4_|Tzp;QR8;M5u^!<f=h7a$d)?*2vZ;f`
zq#&%+Ow8o`9d`S-L6K@PjLRh#Yj2bbr6ptl9BP-?gPDHga?mz%i`tnx5iUKAn(Bok
zB(MDbDRE~=w4`#7lY}NBWbcJRFTcvSv-QDBVOOYQ#~iXXn3knMay5XvRXGqG`>-=G
zKGOsWYtv$aw03|qMZvu_9R(4G@I&>ilMF*mamewV0P?qCpX>1T(COu~2s~}cbCQEE
zuPWZq7wxP(?b_$-YSd@E+>%}rzjX}rnT7yF?i(0jsG076SFr`IJ$+TT`=G<jXJD<b
zRe%L;Y82(Q|2Y9OtRAQ8>^D$Eh@YH_-Z=9{cJ@i<NcbuDd_23)I-3~X`MLQBPV1N>
zr^)(&yFp&?Lh*2KuSOj6UTVU}(!@SrRn>U)+~V2Srv-E79C{ecLb3T;&Tg{rRFq&b
zsW6RtEMtVL&T*OL6(~AWn<hr>(98ih$yAo>B}nRTYrIB(Lp0e$sTkeps}hI2c+sW`
zDOm1VG?k^5*nPFj2xQH%-?u>dbqi#l-zZ5QrTVCNUz?pt>xrHUQ<7(@knj2-xqy_s
zuE4dv(!`GgVwP&rG+Yrh4UYa&n{JzK6F7S2=3Ma2QYG)D0w_>Ss_9HzU2GA~^QX3;
zHOBkdFyLZJa#1t;oLm1VUh}8U5h|oJ7${;)O-%qShUN1uEBWu0b?c+wKk5W_qGKR~
z-y#U+w5HZqQ+e+=?zdkaQ!j*X0(m~R;bH^g3GR}C1~Ay!o7l1DrKrvu&c!`vm~SU%
z>|MXr7}vg?4;2<7vB=5n!5dUr8`7B5$;o_LnSt_#36QdtT>5wvH-XN&4dTj8ET%;!
zM%BcRP+sKqC93u+FQSUE1-7Uk&r&Rlv<j1-J@W$<&e=&NMloxq$n$mG&dhoqDldJ4
z$N;n=KdY2E_wCUG86?U0fMNEVT%|jHxl(~(WLo0PCXRC6GW?##$!J^YSPkRALS&${
z{`*hf(`AOLd&G4%4A+tm{MEq9Kx<;izeL+wS~*w8I;AzIT@ALXG%S>FPBl474QM}g
z2IX?XAbLli6jclkA1m;6QYACq-y8nw73Vq9?F9alcgzXv;W%B?mp7Oi*iU}zWU_$r
zPKZl)^42Vl`TRoYQDSmzW_H|sSe+1Ia%+b*t6VN}VOJjP_c^R9IrKY?{zW2W(xzLq
zN2<#X)7b6YS)5owh{zV(CobNScsW0wd#JdVp$_|QYB$j!NgH*J_&{w?r}^Z!9Gm!)
z?prZ6uemRomMs4b{ZQF&NvEH#i>-w31!qpd20eE$fm8)jt>aizdL-YnPuI%!{s5K*
zUtqy0?i8uM{0J&Qb)v_U?w1TNO_7#J=m~7wLM2+GN^51M@<N9eza~kXnbtyRw3m9A
zpYgSSv_f<4^7r?<a>8BZrG*zb_vO4}o0q$_>PyG;F8RVfz@FQkVTaT&<iNsc{mRa5
zLnMYnJ@u@LNsrXD#Pid!!W)X09`s=1B#6p*DYuN9^$W2c8znEkA-ns%Li*t7GkQdf
z&g83VFOybb6}g^!o!!6`>~n45_L6l8OT~TfTiwRkjf{$gM?z8Mx<c=Ih=eJ`sPpAK
zf}&|RwR>#dzH3LIzAp+`gmGuH2&9WKh>|j<JU&|&zH?<Qb;QlO*i1J`)=3;+ea(tn
z)=V8E2Ul)!y*nFVGO%+5wVq$qYf<++&G*<qA=)9m#5mnH!+UM*j~k%q{jlqfRFIjY
zUs{bGB)1Qllcx-wNN{QGA=GvZvcz^%S-D7`+pOF1dC3lhIEba>Bn~m*)iv`o)U6EO
z>OFQ;?FLr4hnm#XHdTx*l{=fAko(6TW=vAe)N!6Q+pCD%pji@bt%hj-al5s))q>Rc
z+iPj2+PiMp;)n1+{mpGJa#hb>>Sh!*X<doq{varqCY>^#1j~Dz1NImAua(`IV}ii=
zmO8vz%}O^)AOE-;dF#37MU<J)%ir@C2X_E#zzaAJ!7g6jb(625u(Q7ws*3x6GrD@n
zi{(enL?0$SZ^X`g*(Mp`9=Eq&&O|F;;YW)zShy8_`D`^5ucI!OEGt$Z2p}SFgl~sp
z-3Y|;HL|2<tSmaBKItoqtCq8Hq>z?8SzBX=*Nsh5cK1js!FY!!DsK;x4B0u=TJ?KZ
zX_AU^$=RGKBpU%EzPwL+yf`i&Zwvp@dA`s^7ydZ5UH^+2HY5qJ!}O?khU7o&-reUM
z`z^xWZ;TrZ|DX&gnWK0YQI#{7=jPVC?j~F#z58FGs=1EfB!VCA6BAj82rEU<gR++-
z^cQ1L#42Dv0)N;GU^^wKCzvQWttIV=)iimoI?R`$>bC%LfR!a#Q^OO9Svp%*RbJ~h
zOdF->D4a6=5Knwl-wzxBn-6yb3by0lwWQT%pY<}~^OsD&9N^SHewO^@GLI6S@kqF+
zC3BSdYrcm0)G4_X*n<B-A&OaU<&~bAPMTMyMnzbDzwBGAK0<FIkAx^LlsbWoOU$5!
zIm&0Tv!6!_%%OrgqrU{YIHW7H$GPb5mS5hg{3=)N$K<<rwoJJ(8}sYrAQs9HO+Rft
z9(x~qFpyB(s1A9qplrD}NxmR^kWvFmT8z_ltJb$2V|0=tm&jMuhOfb+Oftti@7)lK
zREdM9b;@!xMqa;!y=?56G}ho@qI-)Fi74N`%W+tbTNw5?5GmHLf?&p|b0jtVf0Vsv
zR8!p=t}QmKL`6huR8&-&g3?J)L@Wp*DxHXkNDaLvL_|QPM5HM#ASx&&N^c3$dy^7+
z=m7!*2x%mNZ{hp8_a5gvf6kac{Ih}?D{DS;&gZ`FdpU2aR%m4}Ep*Xs7dVG4%8+?Q
ziC*<f7;jBq3x9&(@|X|v%$isic>NS)PzF*#t}|+q`p&bOOF{Jrq)1$+bvom3j@+~u
zX<i57@KC?D*g6R!XpGGakYYpDo#DtWBOIb*4oZq<EHW$+#43guN9;6Rw8x(4{nt5=
z#WF1=nW)P62aEkz1U&@c?=!nw*6%b4QlI(v`Hjp7R2&=@|1BC7U&PdSS`#}C*VrNd
zEjiAD2O{pgBHNjRZm*FojN%p4XkS*I%yXDd&=9eq9#gVk3GiLGI%J^YH=hCav+S#+
zxP8o$OzGjj(P7s<iL?}g*jkpDPBn$5XT;#|7&V<QJ4^P-&!4MUw6N}Y%~_==kvE??
zA<7(UcB_;dbwo2cUmPH(EYOh0==hVq3xVvQ9gLAp1rzGV!91U$#-ERKxM!ZDWfRC{
z%V_v}q_=YnY#o`aQ>1=@F~51H+r+3DjO}7if(6^POw-F`%)z5*7xda<EHe+cwh`~r
zC-BXcvLrY(o*ww%lgOGu7jge06j&|vhbR5pNzv{=%lsGEv;+LwVIrZ#8CT-PO8h5x
zVu%%(IJuv>9q9Qh|KryLn(G><6S-SH1KPykG<-ts7%@L)|G$#@7D%5;v-1m#dsy-;
z$D3p~Mz?pRBOkwM^<0e7n@c2(X3R%dv2f=JL*M*ahEI1s&Y?K!T%L;!%Plv7pcYN%
z+}Xi8vk8#WWotr{H-5(3Sh2yA@m46kKhZC)5#c>5k5JWzosTcE=CB4qvTur&Tq_3J
zJdBrA$)`;6l^v5&CGE$WC7mm@bKiz<6SIsjavx=_(mHbEtCnAk6<0k}y`Sf0oYLcv
z47O3m5=axwSp@wBV#1-g5rc5FaY1n6c}f=yMW))JIOXF!YJ-ubR6RZ~C^a1an@a9$
z7caik+}K^#qy~G5mW`VR)VAxM#zi$n_HP#V;ts(U$K{yz97sC*|5j;yyLcIAFpRpn
zAa)JcKqm9RZ<SQEhwPR(r^Sg`=LK3+hXlX4ULF168VCjAVzkJt9j<rH`3X6KgdUkW
z&lWX`xB_bP@1m@Eg0!=&{8@wAgxzkmXX_nVGHurVZqsXA(_w^}x375!Y(y?y@<1c!
zO_1A7HEFry3(@VTGtSGRol*Dj8(iBQd%s651bC&XUfURsw8>2w=4Ohm_%2H*H5w7*
zV!Osq3i;_w)wW+!QSOqu6Mx_}JwA6LAfl;r^rR3{Urn>)Hy<H`uhD#wl@o8k=8A)(
z2{4iO5`MY2#CZLdDj-72CTgd2z^^kJZEr7rn_rijO`*GOc2ascFPK@?DEB3(VbhLb
z#stwDKrPV#L|e1zfa0?c<}@JT9qfPLWkBIU`L9F&?1%p>&5{&g^D?(N%%E2QO6_WZ
z$PD-Kk83oIvwvl9H{BC`Q4fYpTum5V>qV;pUE4Fi&?)aX&fJ+kiq^umW=Ww>`p$+1
zgxY9O-lB^8yo_aQ^pytY`d@j&X6T^C`(hI&EB;QGsq;%l*aNekyS9!B6>;o=Ua9?S
z=A)#t$!Mx+dq%^fo-?E{Y6!2o?r=$o7HHN=)lXCB5w!NO>*Zu+fT-u?-itqa26OC7
zGN66G-IBlsI?iv&Xx%Nmz(v<Z$0eAvYlx!(%L)+F7=&qz7l3d-jGEYoo4Jq8f1vfR
zp31Z5=nKuxpAS%b#j^`WMsGGf%iZ)Rk9aBR=h~{Yf4d=`&g<1Q19yrcMa~C~7TnLp
zKR>~S%tB`H*E9N&zYj{scU?kshT5O#CjCKBtPt-QPU>S@Q~J>Qc0fcu1j-QsZ5?6X
zz!Bn@29g<p1mw-A2^0SuYj*$>|2lF@6kO{p^E~mVjUWPCHS~)lWM=}G|1U{X5t%dC
z`CaF0=Z=>zi{d6dU=-y@^ooezxD{(0jd{Q0s;x~{0!_(MW=B3ZvLVEMH?+K%yO${J
zkyMpGuRP{6VRGe#Wh1Xs6sT$FXT{xNeumRwMvuzYSTrMTRrRwQO*^J|RyEl(JQJ0;
ziNC1N7<+M=JxrnFx4!Y#iJN%V7l4y!Hx&LAao=jDdVKC``ti7X|G9x&as~9U9XetR
zWHK5c5ZTRN#~}ICSg*BNyy0uvKb?^193>S;KkE~_ny9RrX8WT%6JlSb^gC)F^6c7+
zEudFo_W5gQ&kQKxSp_rD%xO5&|42n9d&2j1h3H>YaI0VQ{0CrB>CyNe_?{A&>5%CV
zF1yUTB}{4n%<n(7b4xsLtG%)jS((97E7KITE8B9?hRd3^f>lR-86Qf|{`Z;IOU>~2
zGJbu1P?%klnTsu0;A<O1FUD!U@2FjBm~Qdjyml-{T?bMy|D<#l2I!IJC8RS}{M}n>
z+(=xrr;k@&WHSjy&9Pa$@)X0tm8(4Siu39Nkm3a|*On%gA(_C_g20<_00S5h-=MOt
z3HI&NxsP=g0-P1<<YUNB`fImF##bM@MM7g3p{M1F4-~I%Wm;+ds=EV(0058G3CMf=
zSX|;FC|9h>H-D&(WVXGD4H(6?t^s^wI{)~-Zox7O!vCQNqNe$SX}qd3<z@|kfd=^Y
z5kSq8x?aHRuz*qT0K_(Iyh*ojKiKj+4}7PjfL>>yF!G^bC_qDLamK(3)A0&46#!QV
z0Xo*qgPtckcD12oPw@d3jUO!6n-;o%hPolk=PQI4Rzq06f;d<?t`bBFpMlyQ3avfq
z+Rst`ESnNl_8}_n;q$-r!l^?*1a3CX-uTBHMY=`{W8KB$8Yp*&_y2i=4Se9;9q@-Q
zjNpGy-P;1UANtUf=4>q%-If?PxRjc1?^f<iEs`W`#pM03lRPRp{vTfyarMj6t=a5r
zxSQr@eR_@IHK46*vVi~7B=E~!ryAtDbdIgT^`J@u2?rlJVE~=^Q}qDRDU+f{C{}?S
z#v+Kv2oAx_e{|#?4X67IpwYYge@M8pa$Em450GMRn@Nkw7Q?({rYzD@2iT^NZ9tuv
zWn@>q5?}qsyL1Oa3EMBa1Y+=lJ-ak50>NXvwB;QhuOjEuBuK3Qwx1>`c(CU@^D2b<
zVvA>(NZMNOPNK`6pFmIWGOucIwuz;s`^`40DEM8|_wC~c2*8^*|Fv7^oU5q*jY*uT
zkK-Q#-l+&L7utTd2o^kfAvu0=Z_2VZO!(+kz(4XAy#2%K>KcLrK~;sh=Cq>P4&MJO
zi53BLNU6wBR!S(v|A?nBUS0-v>HS+I$~axlRh`qRKgF(6ZTKf)h#+l9Dmev@DsD83
zXfdlLtWAXdtHlm|SpxW<=u3aqyj>?c(<Nlc40$?ePwRN9uqKd*z^D`cqjWP*LjE5;
z`I<aic3axnOaG}{zi=i(9uIm2e)5Ga-F3%($ouolFu#RdOFlz;aMc@FX118z>9nVo
z)nH*V$fX$3WpT}R%4z<|yz0DZWl96stOdL!P*R7r&5IwIQ!8RhFbJ>!*7_THQhiW&
zt9uC)O~9EhXCV1ba7b0I$ZtgV-;<5gdj?SDgOdL?j&^SUW1Slg%5-q=bNh#KJn{mw
zIQA02P)}~HCF=-L-Pw~EzcKt26<_je9Ps-u8vsv(z?KXLf@<o_W{Ru2wTGv4^82}U
zX(qn}Pj!Pz<X9DQ?J6bEVeo2Z*zVPH!0qd)0d*c${T>>bq>wJT7GtXcJg#96X8sZ9
z0xS4C-&RXWb4!Jq^M~_9Tr++L049{fTcK{YvpbNfAmkWUUhc45M1<f{&~#Y4aF)Ur
z9s>Auh*J_o7x1bpxG`)>d-as>VQ4)%0(4mwoT}iV$gk>95UB$7<lh>s>@vjejCtiK
zqedXiV1fih6}0>FUik}UFYjHOz1cD-Cw+XSN2>Oe$1tFc+;vv@k4g6btbHymZL6Wr
zkk0wo#16&=WC@6jx^t`NzFazZ&3bL(Y)0r*(pEtaGYipoXKr~=x-@`5$?@S((p3^~
zQ>jFZIVEl&5+$-#qkZEbd41)RfPGI{yh#NyX1(XM=Xl&7(_C#RHE62BWTP{?!;{bf
z6yivo|MB)3ByM4$=R^Lry#gD^v$WpZM$10#sDaCBWeckIPk~LlmA|SI(>NK3$&8wj
z0>~RHk3i^DH~7!b^ygUcUTN8uQ+n9*%76H@{Q#r3pLGVq`iEc|J^hDc`@_1C<UN9O
zh0~<wkIl!a_sIaANQd+PZL6f3>6j`;8)e=wO)LZ$HnC><+ToXD)_Z|=OqAlwqkyst
zxHq&Q+`z3$@^UK(@2u|*R6Rz-z$jhHqj!&mLGism;~i}EBka#toVvSu);GH14Ro?2
z!beu?PZZ53z|Y@gJpu%b$jbi(&{y>|r5;eO)?pG+?6ToJzS;$+E&8~{{nb{}Q3zNE
zXSFIdPZ6h15#7L<{^8)LEn6kvzGS6ptnx5QHI@{7lPmNrC9#tXrpCW>oyb^53U=&T
zq?x~<OtP5}JW&=8VDB?%zrRZi;5h68B5h#C7ky#IyYFo5Fnc<{H3h7?{#<`iAa+OH
z_`)>6KldI9o!td+i=Fr0gx1#wNgO2AyM@RhRy;|HJxyC2i7wP7>NQ`Nm4fH%jZW~o
zyR)vvEAZt$P}1+QVdM7YU^(Bm(u2MS0ncH=9Ixz=u9K>cU-^JTcj8_yFqhmBf9FyX
z|A!tUsk?#C&tmU+w3uG1jpHtkix?M*2_p3BeKYd8vr*Ra2$$=82gG8KY+{TNgRe=P
zyIDvG#Q}McLtW{UbXAdM)+N0p=tHIM(#qvt-Vgg+o4kl<05a5fe|QM=aHjAvYAyOZ
zMtugkdhI%CR`FqR?G@iH=FW}S4Rswrk)H<q<|mz>cpjs9RJ5lqz5OG10S2foSHjeT
ze`*wTmAeoBa1U|9H;y#m){#G(UIA>e{**81a?>#^;I%V>U;OWe^iNQLZ?OI6s;vcW
zBu$}|o9x{%wVdW{Gr{y<nrvye?MOKz*#^C;r<|tL4?jEP0Ey|KuA_euCAYBpjgbo<
zI(PUrri*v}@d+in0vn+>5R1#pNrB*=2GE!>I8s&~Fi@|?05$6<P_w4GK>u87F{6nA
z2)?rCsgc#7`AJ@vY><xN$K_X&zRlWN8>>epWI`Ds#J_0v*;Ij8BV#u8y^;+7P>|A(
zBS4Ke>R6m?sK*(^gof$>Dr5dL&zt)C@oUNbQq=XC+nY_u(ajm}{B}nLwkV;!4L*12
z+0L0aE0b3&yfud4KB1(1PR;aG;t#+|_7c#k{?!lvy`c{>(CR>dT0vrkJw=XzE|Cn#
zEZ2f&w=-(EZ!lir;MLt_aGjA!|DK2&3?_Jk5V;ZhM`1|$vjzf8i^GNkfn3j6K_V)-
z2p}xyuI=f6x2l>vd;V0#O=b7heWfuuz<tk+7z~(dyyQ!5(^?&!`s{T*<qXcf45!z$
z<lfST78i@Zq_Kfxj7FP?iMh>xquNA@V-&A^=Pu<dR}$bu<L5pCX+MT5XCzN=A;svh
zkl(Balh)rGN{_jy1G!mc&(9_EZy93^gaw@su5=|aw_Ka){($={4Z8ZtJ?M{z`SK}9
zr$CwgtK6iZG`Y24y!qvr_BTLYl+a4xA8Q{;^bj|#@?$3$*onNh{<{-V0qjn(ss*o=
zw!8Kvh7JI~iV}BGr?6(FQv~iW7FS-bYBO3<`Vi<)6jz0pI7VJ-NYLw;G5^Y6aQ>YX
zjIlNZhe~oIZa~0zATaCX%DBc4NyKrW&yqj}0r4bu&7XZlC+_?wK=<#{uK(}Tj&l9z
zO-x0$AuWTToD3>b_}}Ai19eY_!+&`9qyJuB>EmkVLA29j1K6cUz?1*9?KO*mL>*va
zqYIS&0D=VuLufIP__ULiHE!M+Nj}%G?8ftLL|<>+NU_A_8|IcjQemoU4wGY$0t3R3
zFbN!;Ho~5!DTRLVUSZ`u`B7}2Tv$&t0vnlQ&)joTj{uL#RkCPaDi=@w9#YX+*Ec)Y
zvhny^tC87je45E3t2F}+7JsjSJ=kO>fpe>xpME0xHEyy^<!j~UhlP=!Fr4$v8EMNi
zQt@kgEWi2gly{{5<$wY1_f=o-NW}BD(z_G<MH!=n238(T4QWA|#z(Y7W}wb%C1*7K
zn%i$v_ddXVh<vEnw-iEgD-o}|*sJ~maJ%%asBvESr1+`x^G+RJ&7|E!Je`M3?3s{c
z?hTmubh2{gdeV`MTDy(Op2BxNXDr_s2_9s%W#tC@MiBld97apKSu0uA<?m{7;+^|;
zQ!9_>U*>QoUn^%d{Wjd(a^cs$I0O1wB({TI9HLXv73E)6KJ|)!Mpxwf+#09-vzNIz
z=AF{0`soZ1o!~RFLKe}u{8{Xv&Q!l^IUc_8LfW`f>0s^(l@I`PbKyjBR|($m_lMn!
z^;FLlkCf@n#LQ+v*3X^B*wtC^Ey1G)D=A>qX(G3&=qSio7E@^*B)y~<@JJ1#QQ3c*
zp+5KRAzy2`cCM<K+5z&L-$*Q-YKHM_DD|D-q_d}a8O%%F?)UIiL2zv8H+-Ti!exX;
z#8bda(O@PbMBm{EX168mAtSVdL4A6yICxzCq#9}?Q=MKksMBE@fu#w<3@S5G!>Llt
z5Y`^#fX}(_D3{F=RJX6CY+1nTAt9vrIbDl~9v0mJ2wXB!jGMmc1~hP^85ygLlK^#n
zo+P!kHA4$+su}in#QrJVm1}JO)kjiOGO98e9_fz-{xv1U@6-(y>%N$yxiBmvNiqR!
zwdIo;mB{Nl+Tw)vy8LHt??+2DJZqGV)S&vJ;<R>d`|JlXoXVJi1-l`%sAb1y!;U=9
zo1qAqkLy!;`W8|~mL(5ZWz;!@qwc7x`YC>#WXo7Z?s+$FQX+)-ZN!_(nv_?RKNU($
zez(!h`?<v&wWeBlDk&qY!a4P;gq>S?@o+0Wk*>(5N<Mv1c<5sIs>5!Kg!SsP>xpfo
z=n^PzajmK}L&j2;8p+oLL0Y9cv`xF+c+*}zsY5hqm$3frKmX!+Kg;hxu{V9~yz7vi
zN{?#^^2S=$;=U)(@VoDI(}XNhvdqhB5GLn+$;U_LG0eMm=6Yn#8OEK@h8oq06-+lw
zd{Sr`mO&b#x^8&nE<t|rLWIAZU%A6MF1rOshco|y`_pAl0PS*MUBt{xfw%0=e>!Ut
zl<_SGdrEnySeZk}pQv|X7^C$!`tiS&LNj&G&eofsz9yTV9Ps@zZO_Q^NSQANtFGnh
z<az5AxBiCq5gg=6@}$ertnfi)-R9arnN={n5}FQRZsgbME0dHK(&oC55J(x_B;g%k
zhIeP*D7BuPlz()EG4K1(8=Qf{OQ?xQV~OjSsYo@YW(jQgSE|DCRu9K@j1if8zIwwN
zd;R#*@vM`4B316X;(P_H{VGqE%-Yv{9}~j9J{<L^%5Z)UA1SzsXBH+-N5WBe@t(b_
z3-rjPn4wD7#Ef3b23K}OE(oLM+ea4~8&5dVuvRR@tVrNgU&(!gu(yYg0xt&Ch-hRR
zRQe7x62nWfm6X!0<?zpDsq-TN?M61ZX0FUNv6ymTOL7=?R;K`&-2J)&WaOa@;8P;t
zUofAPGvFyX@Sk+4kCi2#oj?5<j{lqLxH>Hd7?3VC{SDpN$%Cqu?G`lN3`i9S#+%p$
zypbL1{j-)tEb5@eqbD1P-3D=LpEDXnS_nxw&e1BQ{;2d(TTu;F*^x3)mrnij4buY{
zN3Y4ex6=5V5Nas-X`LNTUQtoHl1R_y%r@xz4t1CnJ}5h79uy^BSm{wp^)Ei@2hLjx
zOFOKBDqO@Yv24AyZ{x!|K=21b7FWJ;yKx(SqQqV?tJ&m>M?&dEA%01Lix$pDe><~7
zJV)15=rbbt&#KcEHao6zJZNpvxo(KEvX_U$aaDs6mfg&CTgJqBC;!XhA_XH?s#>Y_
z(C22yDuu?Zm&_C>`a{To(h_;q5B2m;__KC~E^PX7!ZWspnBL^NN`T)wU;+C&xz!y_
z1-FIRd5ZYTB!`_B&lLIkkWmF9)_E%+1cAi(#E&rG5#|>79fDQIC(PZM1p(`Gy~aP{
z4tE*AK31fg0b^h(^Yt43V(+g1s1K!QQiDGjeTZ$PwcXt0xr7I@Rn_#7#pp;eTBoPB
zT4SHkSC!(qADpGx!*hLlpXUh475KwKe%)85L|M%ki!=KRwkPyd*0yT=ggrv|;1KMW
zy{px^ds)9&`#rfO;i95ZO#{~Q6MlEaM52{I5skx>lVx}#y<{R;49w+du^EjiI4!s5
zi0X2ENjc6A6W^Is#+Y!WToE!IF81zcuJ3OmK}t*~<mphKhMUW^si`_rbMqPGI7=sF
z>dT`4RE`9{eA*CioGgLL_iE_Q+9Au$+Hy)`+T<yn(VnP4uHC|7klWLzx}##482*{$
zQ|>XreeCg`kuPG!+VylwOirc0mQKpCIaOCpS!GmdE3G7$gtpv#dP}VZRyht<gSd)?
zu2H?0G|r_r=R34F$@|owQgII)zrW6sz*3@!IMve<`x+gg)8W%@qrbc5J5W<&?<&;T
z*KuffoBNc-6tVItPaKI~ELq-VhUG@DUfvKF5sEsjL7Ejg91;p@?oTriQp=Tikrgsy
z&pYwMVi5053&4M7Q2Sqnqr(o!DlD$3Eu9_0VxS%_y6bvf)N@1wTwJn$cI53+bPEs|
z_c@*XS~T*xJ9GK9n=pZfd!#?Z(@tW~Y*^%>C_ge<a&sYbP^4zNx%`Rb4Z3kTZt^zE
zlpER7nPRb8P6R*Do8h=WU3u$nGxuU%$!&Nx&FUjS6V^~>gZ&IEJ#ZPA%{ZTi;EE#*
zn96}lg_FrTYn+X!bU3=vY8skG==<h`A!f*3U~)JXpYsionlKfg>B>rJt@N1<@8*}&
zq!yF?GfziR-J=8)BX408b&r;_GU%C*M8mslPYWawSKKj1s@{YQnXV5XbHcRLU@=B~
zv)nE!qaAjNqK1lUT^UML4_NEu5%S}vR(v5SKl2zGklG)YEMdD#ogXpmdqd|bi4tzv
zP%x70w#wl#sX%;N`=}f_%-hhQK0uydE?Z-cOUzpjo)FyRr$jcMr1eHd%Fd~k>KA}3
zibv{5QBhX3{asvk4(xgn8h_<8<ZIa~!qM2$m-P?_vQAm*VD7+y!q`t1_o;k_VY)g#
z`1MUKs3<~4JlRw&_&0ooS4!q$f!MwZa_;%a2?9wBng;nX!r&2jO!>Bd8cC9gRavJT
z(JmdNJ3xH6KRhtX=a7<_xmQMEE0f5)eEoJyU;KfjcLB&HCIL1eQBJ(LPL3&+WVC!z
zh--YwO2fBtKOQ$ghI==?Gz_OiG_?yBwU8;{a~pT2xwa|iBog?m5mSRg0ZWZlRthfo
zA{cV~sYph{<wGEGN*oWaLrly%k1=hLr>|k7i}V_uYXLrn5g$)jRC2$~Im_XsX$&DT
z7t0`beUq}(s~7c*P7+*wxv`7Q*0qza%|ds2<@AqHzU-2m(&Qbd1vlud<qY5M=<v!a
zKRUu|-ZBDaR)LVll~u51!p)H=k<IJzv-0S&(?DlFQ!R@H;n}RNtR@{GB|85B)wWu<
z|6nCx;GGH1i$G2*D;hAjycwFPbIM1if4~q|+RJD3KmJF}0StrQj0JP0m0z7#v0ARg
zH@M%Kku8&hKkcupIej#U=jGMQjci~Blrma~(PGaiDPdEI#jxp!sRZBUe%Vsm%-!+E
z)-!6Br-=hTv1?_tQ17Oh%F)vu2TKK_Shu966_k*sk6OdByI~-8Z_Mz@<l_2}TWLUz
z%4+vrP$<T`PjV_3%8f5`G7n%ka`Wc8ELMWre&5QP?!dbgN~`_!F!X4Pti;`2Lb{zU
zyFh0rh&V@Ob#zGy5zi30t7ivni|iAz%Is7Q2Sab53z(cEpeEhjuA-iJiVX^>rLR`#
z`#Rs9RQX{Fp;E9h0$kwzB;8M-Com;mvFhAk>24?bwnb^jTS~&1%+k@p??Qh51fPyb
zP!kAWVqp2(nwMaHUN90W1>zd6R!a;!bbZZZRXHV2ongyfo!G~odh39Vr)3GA?aPo8
zA6<zV_V1`Ulhitj%<5|q%rzr7^n6fX>xH-Qe*+jC<bW+aO3G+w7e8XG|6kvkv?OZI
zH2>-nbIJ`)ThhTxqG*}DB;WYl*cyF^O`(X&IX{p@mUaj%&Yw~N^ZHz{@=|~F1OaOz
zJfz`%QdmL$1S$E-S-C~sTGNi(to+U8Ipd^AFmrP%cL){N{2TFz*zCD#D<T_jcpu`^
zzz==z4<3%o)1G>nrPx>)FC)k=WB|D|YVAKYnpg?P-D8yNPHx_g*t|E1T>UuY95=ft
zgjy70H75goXdz}W@nvTNu!BYC#AIx4n0N*;FPF>+vpAAQzKd_+x6IzoX4vK+NOW3S
z$NUm+%IIltPA${w6L3N^m`EoM(lduk=T_bqk)=+pz7c`HyA!8PQ<d#-D$`a>9J=Td
zW$wQ6+EK4mGTw>#-n=xgR{D#%^g(-RCuU8d+uPDNyeUx~MCVeN>qw#e>LkG2Yv#91
z2WgZ~5k^;EAZFSVp9aI<RDBT}J%y?C%(qatOCEM5PyZHBA^DPJ<KIYv<sx?AzG4w8
z7lba8vg+Wil6TJ(@l~8-I3rR&i&=#ACeoLR8B?EIrqzmb!|bXokN>6d{yH%JTCo1t
zryY3eNaxS=zu3|tAg~tsr8WG++>Q3jTDEbpKBey!T&YDP%pyO(s`^*G{AX8kD=xwx
zCCuR%Yspdy)v+d-wQ1DTCW?=}dgf;HSAW&W4MmyfM-omNk_K_zsFW*@)y6(f7HX}5
zoFlx9`^NRsyN8CRM$IVi<43z<qdG){AhVP&Vjk%LNxqmG`N=Vt%+Rk@lLpyK%8Kpj
z(}P3hP_zj4Q_S2+<C*nx|4+$_!&T#mDs?rFyf5F${%a_wd;nvIC@kzRhApv2)8*rs
z74t(TbzD_v-y3SujO3%{g?u*b3iY4X{i6))-XFwsmAzK)bMzKS;Jzr+#mlFm?qYHN
zyPtMxGF8|q6)<r>ZJoScvGOt!lbzAAoBfQJL^P_?VB_#|#|uawBK^o1`mb)#F0nXk
zhN-BxQ{`yx?ZLGh_Y{+rAI4jSPU{JotDiv5Z1{D*=5PW-Z7_QWYPq_yXv!up>sdjK
zn+xBju9<ioJb-MavOq3($6H`F4AmI2zYo7_tG}u4)1vyst<>%#Ul7o3VzJaJr&Oi=
z85h+<y+Piyv;AFU5rSShN__5zV`Nv<i;)7FBr)C}(;q*If9mf!kf<)MDqKdeDmCoz
zPEbo;Z&Qru#=IpQ9D(A=Q_PlQ7T+n$_}Agjc?T=k%@#i-GAnjeR>+N7l}ZK-_wi!7
z4tvnjM`&e_N~W6*`_7{F1Du0t<<;EZfRAR=StCAq!EJ3rS5#%8{j^2>U=Y>LYzJ5*
zO42-ZI;H#R^5<oUsE=R%Fzx0X?KHMShM~%BRg!q#0HwT+Jm)Og-ToTWb5tja*&Q8G
zxxSyJ_qoQ6@avk1$NSAoexv}eVy|k{!w5xYg{x3N4H2^D*l9H&s&rgba<%p=+a^OO
zNu%1~n%awoC%06;$Ti=#wj-GpA+1&ODiZ?&Pz5!4xf*t*+3WA_*lVpO0&jauMaH!R
z#ut^;Ous}UHOmUbPC}#N#XZI1BA$(K30i9jOU#yroDQRDr46KVTzF3R6H?*NFLJ^=
z7kkK;15p0JU$hIu<+>8A1}wB+S>G3wmO9ORus8&?kq^nOsP934qQ36YI%|7_D&4ZI
z2|Clk-^0_x1H|8wa9(hzFBsg=u(IOCxSC5`Kk?rdHz2UCAT61KHdLFl|Ji1<&ZLTY
z6~f*!K0kRjL(J|l&-DTfQs1oDz&Y?E&W65F?`gWUP>_B%@o;<_EcJrh@*os2L9Dm|
z(A1)GMt5YxQoP(|%?oon9C`}C(n}AtlOx<0Ab0R?4Y1c9=*Ak9Ya(ZOO<CP82SM$l
z$-~Xnu%32GmKaJAFNJ!eiKeIi<B?9LIb0_*>3Ce|=CgDTBBRJ~^c|Sv6E<9E^{{ia
zz3KYiKKDp-s*b~#%5uY*<ev}D>R85snTuB>L{aN^M5coF-{qaU#47a4=5%#`H5i(1
z&<DPj`Ok}^8?R;Ka?5Wmt!IkU-bOz0$BNa_^F*BEqyXmK6=z{_EJI_|{FO+P;Slv>
zBDVMNCz@%YH62N0rZ`?1D$t@*(Am)fU%}Y%O}$Uaus*L8XVs(jYA9hl68~U3`ng)0
z?e)QU^MGlJVyJq0`Yo_XG;w26e>#fL9uF;b>2#pL!Of3R<^w3=Pw@M@iLiI&8>EMU
zmSw8d&i!9iNOOA%39#=HJ@YhCpCujD?L}fubfd}<Y*JiH-sU(pZoJ*)^jOOVPF~$e
z$X?Q*rZcR@8y2@IinEOjF16h(&SUEMcPMVwIIISv($ilH2V4mHa72^=ahklok1;x}
zI-g^oZ&>K-e?74{Q&AG(G=D{Gs90u7*`*Z0y+fWlx*0U;N7H7NgCVDPpnP(qSC>#i
z;I5TQ@OqWR?r0^MvNcoILPJNqCC+t{7Z!K->y94-t8~NFd{|B#*$C9QF1Hz+ZM46C
zW$cF7^pH9Ag(Gw3?kYs-Ldj(8YvQN^p~(VO+AcCei-bF_-Z&**;Sq$Go@}w<e3(<u
zt!TAX;eG&`VCA73=V~fZ>pE@(eU5+0UCQ{|O$@F$5dFQZFBJ1j_x;{mFLugnGB01p
zOQ)_{?UL)1D)?>Y*tPL(0^7;>)EhAJ1YT#K^~gbr_K4D3R1}LBTo*L+tHVzSNcX?o
z^<by;eV(XPM99+<ds!!<TMtZGIAHQS7To2dciwuu-9bvly?xYwu@Hmn%V+5JWgk`9
z_(?vq?_B}=sNSd2VO{q$w#yu!I*qyS$_zffZ!FzG@bM3Cbu_*Y{_9&lU8s9Ai!u2z
zG_K#;sb)T>`yvXF@&&rml4NF^4pH8twSMfxubG?tS?32{>zr3kdUUuDzNopY&CJGZ
zhSm2wUgXiz7vZdM{2Tde`r@CRs~bie-V))}v!%spzs&VV`s*D?;FS8^mV6gB4DwfU
z=3eb5`mFRY>Jg<M4a5B~Lw=X+mXuuiZ7FA~*p{Rd4tGdy``&5Dr|;pKK+`K75E?1s
zulp)|apN*&8Z8o~Hx43MpCUNgblglOVearHyU}aIm*ZYOvm0Aol(Sk{Eq*ZaU2wGe
zb2&C2|Lf{xY5k{i6K|Q?o)(oXc^fNBy7Hriu@{qvyukac&+Q5^V|yIWLRs7BJxf!u
zwjEb1Mjk2s>|dbxs!i@aHzFbE4bl;Hn(Z#w9tjbt8{zJmy7$84Re_Inp?#hW`D&}U
zXRtNt?&pS-wn58%7wwei>U~NDbe0EIn0<l`fTJ0%vFic0P+lao@5!Bkr@D*Q)Cg#k
z<*dYHA;F6AeJ5U9Ii#hrIN&?d;R@fq`n4)Y>Z?g!lp-rdULA#&SEp8_pUh^rbsMMC
z^+kgF7Jv+MTJiE-KgiRYyX30E_V!H~lnScXiXTZ*yPqUi2j3cM7-F-EZhM*=U%WfB
zVWbl33>_EycYu6}CnzGSME33#Ghht0lZxGzHu_0Rkzp4mw4+Y#*|YuSixVe+e-=Zx
z;SAC`KAu}`WX@RRv7dIBB<4rCD=wBUvZS4=0%>V1z7MJ(D)!4`RSRLQeodb6Ffih{
z_omBU%b|cn28QCidIqPH_?2!{)h2zDZ{st5L_T!BswL4=u{EHCtfrKT7JKnwrlqD8
zJNo8{#;9zwy$Quc$wKF96U^TQayGK!K)fL6+Pm#9LC&UH;~tMbGN)N32|MCq19;3m
zyUoLk$dS$gX!$2aj|D|fH_|>=8lJO|BU329UqXl&^n|Ed_ctu~>)lH~6zbJVx_aEj
zb06`vWP`}Q4(1(7#`+yTZA&dbO?H*$eLXts$8bC_u4(iIwN2vuV>%I@HfD`SFM3;T
zUg0~&7+5Wz8qfD0ovy}z4xFxSARR7oxwo)*^hc62`wk`x@+S46wopW&x(H0|vE@VW
zGwQc2%j)CT!OWp~W<pycI%|D4yqd?HtIbHb@?pac-B2|LGb~}tKp8aJm@`>RE2B#|
z@7uR)4q0m%x^>cVD=H(6X;`l&8BICM0RIivj@(~H;uRo;P<!qIONjYA<&BsRf1>`N
z+rF<8WUpU&d6<+M7k2eWzoQH04DXArsosL$M}L%hc%3d%+98*NHr0>dB^a93nD!zb
zps)ez$6~AJ_Pg-%N)OSv4T%mn5B6Ic<L9tKlP>JL>Dk%64=}xO>0=1HqhaZJU^USF
zx8@X|y-PWCj{DJLNW${wlJ*A_;X#HUsop|1KuA77{l@(pGtzB>pJ7X#O&>IRQhX;*
zJ`hG2lrruL+-uwJelB%gO7w>#nSWM66jqvum%ewX7=8ujzor=iiXFn#{4RF7F?Y2p
zZGXL*j|%g-(-q5lglBA-A9=C)uo6;4X^5vqJzynfGiXj#=%Te>=IBrTFPM`=Ps)Lr
zk7#EsnTG4rfqHW?JvW}PM;{Lrqgu^}9eJhmAyrwn<3$E^Khe>U9rb=cROYH-k3ZD&
zwA=<mbJsIm%Wkt?2Ept6U16W(st}|WLTdRUXijDAOoAM02kcWSDnp}5p@rs+6v2oo
ziPmX_T};*Aw!ssx#t}w(i!@um5|pa<dj+y$Ta`0jWKF8upKA{!Gu(dVMOZ(cy*v!5
zF}dit>HqDF{>t|zB|82lPfNRxK@hsBcxg;-M?d+<titZ%L_96ZiTBcA5MjVzZEB?$
z$-c2>z?Pk($o*Qw%G6$0$SSwAHG}a>UXl5R#`4PH#!mV?haB=hggOK%@nLClhE*AR
zI`#s?qC#DALk1XP4EO-Uh8W+WHApZ0w0t8;=_xoC`GAu~T@PAd=TTbla_o&W1?W4S
z@^VE-uWBATv~wrV)l`KOn(zm+$ggjI<>%&%7}nqD#TR-l8e$cs$>A+xJa*DIzBzqk
za*yiXIBe*I!GO~%nRnF-Tx8GkHM(Ybxj`SvZ3@`<nn%_g&1#gi5^Nt%$O}*u!G7Nt
zYpzoVomV|-IF)$^3_E%DZl`td57P6X^3nOXNw*X(#dPC@so(b4HK{On+N^obMc??S
zkkMadBgwcwV~xgJa%ngX%Y2qEd4I0vN#6Y;>zOP3Yu@CK<P?}`XL<%N7|od-2mLTa
zU*$=Xa5sGpGnuOnILC`hSOwnuWL3%DBa>}_4Q16D@2l^l7LzA=^4l5++@9Wd4a^7P
z*t{&ewveu}^7#>mX9FK)VEa8?7}*)Q-c8-0x!Xl^MWAM{l(yYA@$UtgXrf^!BC|ao
z(nhjvdef41j&L<NCTiW#=q0~nq7Q3#<XhfjAzuC*9jQa{q*%-XWVBl&B?~w5y!NI<
zkP<YV7LHBps+3*As!Z0OA_Upu5C6btyqa13rtbmI(!509)krH{IdC9to8d^RVz}{k
z-zXQE=9X*c)Q(;A?R8}a9p!uv>xR5dHp_19GQWac{q>COG(I6tJTh6+<^5>9GLF2V
zT|!O~NxR`XHAJ2aA41?ffN8|hCJ4|O>rk5#Fzj>I;V|DdY9yADEPiW{>^EXbPRFPP
zOwD1*p8oSN*Hg|!{+mYeNCU3qSH$lnfm55eYKh#7pI*zKcb75)CwwjMpA=&?ls`IV
z{awtJTk?#a!A{(m-t*}M$u6EsIG3rsF2cEO!tnlmBbAn!;W)3e*q**Qx32~40cHDI
zS_O7nwuoJRi$D4#-uU!PE<xZhC|8{_s0_}Bf3wg>>(G3^!WW^=O-|oEm6JB#SG``c
zEZ=_uouX3rE`!!fjrG5FYuR-u3z!5Kefuk<H^!%pN-Im~=$-7mJd_D3%puuE0~oMq
zqy^J*l(84I=g+tZYAn6i9-Id@S7iq-<G03we|$ZjvYrh2i2KhR&^&bW;ZA0vCuhHp
z>bLIT+;we^C4qW1QsS708rPg?Ca`EmN!Kk9{ehTi6`I{PLl3#%_VJb1+!N%rbW(R8
z%M<LgYerf$Smofue#VBZqmQQy{neAWgoyIxS|CDe!e6omyOSR>v-5zuP^F7!EdQ%G
zqyFyT;`(BL5Fas5A;}F@*6rT;2`fHA2*@R*i`#rD((7SNZ+h>wBt)=o4@iO*eph+*
z=piTb1j;Y6^G94R%}gfPzLF>~%QWJC(=j|gZTltT5-LJ2%!)e)@k)@W&pA>do#Og{
zK>hJu1h<E9yq`gytLm`-Ff{TjrEZX$b5q<Q>A2+Sq6VYYoQ8J&dTlhEZg}tj^7n7y
z_9tx%(v8DJp*NP-KlR}h4D@j$mILT4iSY)v14s@MTf^BalDtr+L$nODodt(dkLiC1
z5rH7Zb~6g(zs$2#YE<PK-K5a@Pap2v@8+09)2tBpdYtAI87IEtmu2hDEkMoE9A_%&
zALg&E7d!xm8Lx^JvVu((HfWL)iiYJ50x9Q>(qg^t_}%F#AvQe=zd_F`!Ces{7Qt+f
zdkLlE5-`|pbx-Tr$3-^Wu5u6D8~&D;kq|_gs1r1LLb6&UMSf=Pk8606_~|KS-4(i%
zx>yXa_i0<}ZaZAlPAIPG5ONR+{I;nGs{7azbtaLUOkcY;E{H8&irCH985dA?_QrAJ
zb^9t!Y}$@*ewFrlwnpcjrN91qoDT(AW6=TG(<`ylE6jEd(^618#4>ART?jVR3VTXy
zn55&}d);0set3z<gjNuI#}Z(i^XGyUZFWae<;dg<MH@f;lGQMIL4xlW?LM@!27I1x
zcDlW^4pI3Sc9#=ku5FSGgXJXP^3#uY^BTTWZj$lU;r%A~xcY}WucVB=#d(qPVDR{J
zG?}7yDEL7WPsg<X?apP^sUM{-IFp{7G;giC0al!F@z?sjrhJj-?+amQ6@`#oD<PvH
zN|K-7xVo2REorj<;9hyx=#3)co`5IN!JJyuE7;LX`%qp*+^WGwn-SHaGCSn7c@6L7
zpD-ton{%u?&Rx{q@-^x;s)ShF1S}#U3yIZX)nU$-JwA=4rp%QmQ#u2Tx?H&%<;O;g
z=$8hH6WGN&WfCg`V+sH6DPL+{kkFJ=-QXk;e=KW*9b5e^u)@a|*QkB#$#;;dHc;o!
znwd8*KeM^Ev`yMXQBYi}t70e{^-TON_VYsH8WusYm$uC7`mI<XY}RZciVgXj1&~`c
z1&Jv$nzZe$rSvu>#C8gZj%k~C!H>uISa>MN=rg=ilwd}}Bj=~j+_?CK`k?ZM!X9cZ
zZZ*QcaHA|t9BP6)7Lz?X3l~3aM#w+tmE}2=YCvJu<38Rl=5Q}uK1_e+@3d)}gfCvG
z@wLaLvPw8LnSJ!n<m3yWQF9{wO1_~rnWcO!dMq8NqY;$>di;cSJESi@9bO6|Ua$-k
zkjvIl*_Ca2CIkt`8g8C#w|K2GdG33k8cGIJPZiPx9|-Qc{7PO~gl4ZUlaM>ZtPp>6
zD;ra4*|tWoU?u26N6s4HauwJj8*igyRN^<zNX3d8IggF#LQ^sopk{BoMs48VRh>Ho
zDEQYp@lN?_D`$A?($}j<XsZrBsb5A9g;ys6Zn)_U3EV(l<AxvpL|=!a+y$Q<{OVX%
zwBd()fEpPs$0Oj!;K2W~<~oIW%RBF;ppjzO0m6|RIu<?+mCs~IMXZ>wlY{R(g3rPS
zy`7#z?V}TSHk@ss5mc9Zv!E?XVTSPRQ@o}AG=-%rkgvz{ak<6v$=xa1WV4Mv|ICt~
zdsucSD`-U#>=&-*iYC%yQ~Gum^y~~6I262t$M(U@u1>!>XAh?$*|V&|8MCL=!%%bI
zR@QIy5vS}h3F7g5A&PQIJ*}%mnac|9gGM2~2_kACqNrn=uGHYL%~w$APggkF!1B-%
zyo%X>C3n=;22m{b8dkD$i0v|Yl0IIqwNMig+8-(c`Uz4JAB60TuPtdTedYQSH1B3<
z<otfwUA2P*9mLiK00Z?3dfyXu_aW|;Qt+Rl_7XEusc{Az{Xb`<^WocY68A7#U6N9d
z&K{#&F+t{$%24bc-tBXlIr}B-d5?MTd~fRIRjj+d%a1(^7FFSgCFTiMB1ZNRzGr_q
z5QF5NPMJ!KcB#*=FFaM2y*pS!xjV0~p(LToyh!~F;b_uhi}SfHvMMFxeFL+YFSSEt
zEFo+{&^lnJU3gJ{aNP5`rqzO!N2rVxy(DQl2v{H2jeWCPGXMLS#w}T{Aef*4Y4W_i
zTg)KY^+;QX-J9z17`u-|N##YE(i;^rdsFFNIMsU%<=yUDcvh0@k1`b><=znWM~Mx^
zR7t~V(bgn25pLsk8Qd`8d2J{pi4{k4-MPA-J(?71f*o|=wC=luPr<yYdFQI|V|HHX
zdFH<Hpb@j5ODLuBOtD{OHmoDz6&wiS<x64y@r<eCQtFu}y6bDI3BnCMH93`U6k7B@
zW0cZkX08~1cR=2}m+#s}%O~^GNGqOALRWUUpEV4jcHag%q1sPwc2I0*6Gg#5^=tDq
z^t%`GluvK^y{pjbIU6V8@5_VW37(d8xaEsd!m*Rd%j3RcG8~lv`t5JM4JPp8S(*V|
zy|u)B(l!Vg^9m-@g`1P_vdj|viT>P&$8En8%J<8to+Ps9#Qu5X%8XNlb#A)-lXgSK
zc-C)1dMNtk@Zx)dlv*IyhepU@eP3+)MSR#sTiIB-(3e<lw%%P=MmU&6DnhVXuRm_`
zcCYW!d{aI`*JNZ^Us^jIT2x!c_Far_@D$L%uk?5DtVN3Zspnulon#v<;5pvnxn*Cs
znfXxcheO_f7l|S+L+Jhc!Z$LkmenR*Q1Q>`>UT>6rVOIpocn;+Z%%Bpc!&x}-CszG
zr&q*?m%YtZN&h-|hd|qLW)D2XT6lc6C4VDN^F&6*`X^rMGY$A@S&c={D^q8)CAEjW
zu)x+z@IE{jJH}tk>x6lU9`znEs>)#DFKkF`q_a*v<VrlG-S!;5Uip;L@Dz4vRB%)<
z;84KLX+|t?Z1A;!fZk9H6R@<09Ibx_HIOlA!b;1Z&sh=V2FGuWD_|e&G3d?CJXXs+
zUzxw{gwOKZMN@0myY?0j#DY(M*QcAe*fp%TwjS_U9Nd+mk1-I6SCDUgZ6UrqywBDZ
z;{Nqk#JGO(Q^O>~318~Ha6=KYLVkoqlprjw?&`A?5<d6nEywtDf4-Bq2LfUr>6IVn
zqZIBqbpEAczf=p(xy=2gC)M>{)&;AnV+R}dM4rC$U{D$A{57njt0M^Q{44MUCt>L0
zswb|i@}b7!Mp>4GQXm3mw0q#fv@nonY(1Q7F;VqShX{Sus9Qan3IB9xLIQlepX46$
zcoFJ%wCwDA$^-uy{Z&tczUoOKF1J2m+FVgo!nbX~Z=?fR$W{Z*rN9!Y_dpA~XWTPD
zxD)*ev`Ig$%GQeQ;VB%Gb;fx|W*z$H_gCpV9aaqNj$@9C-yE!TcyTIWaX8DLFQvBi
z<WuTb@t>xmsXn(J%I`j@BNLVq%1x5ZnIq+R`{mtICV!nCG#WW~6_<P8sC={lYr0n3
zI9_9B0{;H2?nonHU3K!DhQ@mGg*tk)SD5BDlW?<=eY_rhWO0HO-!5tQ$C+^%xu%&v
z19%#WZo8&RhfD<aDG8YN=r^T#@<rCY#ELb1f|(9Xc|$fG9OcSDM$=J{8O{U$JjeTu
zU7?oDn^2=m1meB^I;r8nL9x-&nmOSEGxgJhwA__K^O2xar8t^}r^TlYy<{_#E!P7l
z9-3=$a8PII!~wDClcplzk=`n8=vbCF_hzo)!UkgHXGFh^_bmbE<GO*k8@Lv1N%Hvy
zymv$gHI+9=GIEC{?5@m{{!+PD)yurY3AcI99w6z?-&zQBY?i`q%=$n2B~Rl!cFdT_
z9&?RRXX||OoI64!JDgwet(~4S+kN1fcR<ceGHh(;O~TS(*m9fpk6A5jd51=BUrma4
zzV9t0Lc_PJf-KA216e>!Kyy}|9V(=0)pF;Xu+_kMxd{&@l4t=L*a`4IBLP%FXm183
zKZHkA&dOCt10$RD%U=MPDu)7|w}U1Gw?-TH8U^@(U<Arz{7UTqEE>t%cxZ`kzoYq{
zc<2>MpcecC9{0Ex+LL@oO)K4VC|$TjVb$S7RYEyvKR0Kn@v)Yv-x>tr^hIjeSh8T;
z<GC{Kqx$<ff|HH>k+DD*@pi1^J{hfxq4%fU()=W&U9Q-?qmM0tFCLJ{j{7xU=#x>M
zFWc+?GxxgEIn9ehhS)4!B-6z3><xYCJO^u^mAafhhYqGy`yQks+2Kz1mofOmH4csG
zg-cMb)O&;-QrdN~KHc^ddoN*d?wQ8A|1_H&;Wl0x99OGWdEBPnMvVbldknK9XRUn=
zv{&zUU&v8_DCONb#qkicz)h0Bn>N>z`=Bqn_|+X|>d;Ff^LzYxp=S7F&66wSr?kk8
zwU=*kZ?_Gdg)a9HVjiCAa}3})Aa*S<yv*fjriwUJX^A)dc)HodY!=*fyyXUR(O)Dv
zJ9joE6rqpG%Kw5jf+_{5J0ms*Df3wxJ|9<Q#$|z{pYQwt{w*!vLh9%FK;#$gfsTX7
z#BrVN;eIlFX@~3&a9OM<r^Iv8!?H)W36J^hdmquzw4S6}^!=gXp2UOV+jAmpP#=$9
za{UnZiqJP0_)A)!ENGK7!BmNu)6PD*54EBzUGfO)FO$NayOVj5ttNKcpk2WH0rGev
zY~c9_8B@>cWzyZ-^C;C&w?kN5+TrCil;tlAiWr7+E6$pbcE4wywQ`)s`}0}Oj9nRn
zPE!1SZ&&<NTFAzZ+|(Da@&#6n{VT@+1N6d1*Pvh4E+SQGgy<(+ss8{zOGG_IWT#^}
z0@F{Y+Sh+(A74>{6(Zh~E?BY<`eGd9jVGVPdMsB7y~fm;fUKbxSq8fPdh+F&P@$qh
z6*r0g)n>EycU4z4%xUdqhloDDXK<a1W{E96=KkAF13p9A4b=@`io3~=InnSZ{vW$i
z$Sq!vqc^VYba>J{=|{DkAMx1(aaON|4EwxB{&#03QMVY>>)<uo#m+6&Z!Yut?m0c}
zmhAqNJN*B<ysHVgG#*K$s=Q6|Pe4XattZ`DK8#RRp){3#@Fh}xzxm3M{S78-TBO)`
zpkIZ}2On3@<W!f$Gt>kRLXH%)*2`%B)3ee%G<#sr^4{1EYr3|!^qEq)gPLcB+Wyj<
zLQ0>^wo0OoP*g|i#sjVLwB|hHvn}oIUlHNAW|D7Kt`bn8Bt=R?d+!~W4p98#8an9w
zMeGrQhq1~P<h$xr?q;oCGWV$V@nN;deE!G%%wviRd}(;uS29@VUwC`V(CxaLj!^%|
zOWDk>?*4$xBjd&gu7rAx*@9%eUmn{Juh<*ZEmN56**$yu7u09^^3KKe*<8VuvELEr
zum>fM@TGIcWU~<yyd|4~p+9j+*P4#3>AyzHz*`23?^)`*LHges?GenV?9&nXKxp^C
zU9zlt=&S)YuJ=<s(Yy-6hYH4|pvRKs`??iS6dZP&VaDvQ+xz+gI1R?-Sx2o**{dM0
z$92}k8jVf-k!jnKbY8YjO1)aBl!1O#;+0ThU5EJE<Bt7v;Te)oU=gfy>`UKq^v_vE
z9M;_!rB?<;-cpY$SJD!Um+h5~fi|2an(fc+DGFTMoYlxitn!vnctMlN?*x_?X48Xz
z_o}7b0qda1!O=r8PE_2X@uSsd4t>^OZNIop?iuw0rt2^@nzXFf<ob%dchmU80#YLm
z8^#+j;}+sd;k2>G1WK;T-I`QXr`OtxrqT}TR4cD8*{hd0CZ=<<OQVxpvj;b_Z=1QI
zH`+OED<wNd94fPr{$gIC&nxn{#*Fz#KZaD+R~=;cuA2$a^)2-2o=64uso_RgP4CGC
z1ozCadq)j(gECrp?9;*Z`i6nvI&@Ag@AT0<erH2=m_3?!6TdKKV1L<R=G^b@BUwB0
zT-`(z7r#9B@54e~Jw$7~k>LXcyA((-^lL3QlM_~|4o?KFHy;{hwS<+hQ+R)P_&3_Y
zaV`LwC`ht;&v)cZqObilThAY}JE_bOc>9IbH96sH#^u*-r;BV>v?sr<`~+_E(yfXg
zHc({gtL5x|v;dSPK%aBo@obF$Xje)nUSl<{AhJKK*y~=;h2GGX(T04`<^}N+*tO-x
zZfm>L!T?izE`ecA^p?&owssG+@LAC5u<|w$`}CA}B`wH!v%1@O?U#gcSuE{heRp1r
zxR<sAjXP{D6R@VTpn8K{_wB;MP?>mGC41YF$qk;lkbs$sxhq09Z7UGwo)OcZyE-iw
ze(pf(=nC^yW+g8@zLkUY2X@j>GlPJ)jM&?b>osye=6{I)+(Up_$$c1Un@XgWe}G3?
zx7g2!RDa1DDt@%F)?i$m=p%VVyF~Gow^GF`?J)5wM*J%0a^zKA4vD$JnwTISp)WuU
zVh-zTlrXhzHy@Y^l@!!P>WY5R7z#UB5mY%Wb?u1yU~S72=!D#aTx+`D=4~<mcb>P}
zJfqx0lhmFPb;VMSqK={}K5z`^$N`4oiuwh0DRuu#E7|?|{q7eA^8e{{WBf2RO^_~E
z_Nx^sd*SPE|0r93nh~F6x35LyUEZf|=a%aw`qrJ2qwhro7T_$(|3}(;Mm3>zTf-u7
zXbLI<A|)sSA_xj9oq&RfAXTIjq)6|*B%v3nB7#U&1f+)E37t@+_ZoVD&><uw5Z-v6
zd!FaM-;ZyM``$5sFh)jxkX_bZd(FA#PDgSedIhdWc4;V)X-?nl_7@7ZEEUY~lZWkY
z{VZ5^N*I_ehVELL-(PfU##rsC?;;A;j)lKJm-y<oXGF0nV4QTO8htwUsOYraWZbts
zfv-#+OL)Yl?(e`JW&~u>u91zs`aq-T=Ag`Jt>bl4^($H`SIapm8^(jQ$;xo6G7&Bq
ze9(4gh<JZ+^iIS2A!US6E_C5=L@K9tOO)KODyry?Ie*lFufWFMBg*di=7sBDq*lXg
zOKRK-P4>@L@Xs_qyx|)giGj9cqv%II6MgzrpkkOY+}3FqEE(!3#M?x;_bk(brb@43
z)uzaWW;QGbdVX&=eSsnP;`Ch`5opj#l$?{zfi-1Jh;LnO<{xcM-?I63kTN1uHHyA*
z>q%G464>QR1L))tFQ)DaC`F1s?qSWOAS?5%iVNnqe3FqigH|-c{Jav3xZ*J8t3jug
zyv1KpVUybY)IpS7)NVUE|GTmGZgPWBwzydK2Xg~ZvnWtTophD-x-{DSj6n)u5SBf6
zu>VpTlf`!=Btx&JACOP(|I8$bsF^;Tidrkr!=26fckNh1;CEGXZy}jp?`R47Y`<4p
zOPG_djS~4wzz3gi04x^9pm6ra2wih<>g?oaPQs59sfp~>iLzT;6`03(Lwpyhmq^~4
zEyG8Uv!fX8%KN*$67p<-c-Mb-hFwsTHNviJOE=D3=dUIXJ9isZV{<*ss_4eWO2gwP
zpO0U)P^o+4Oi_m@XXoGZw-lCdtc)^>Aw{X2faT9E8;j=~uL#H1GE^viFmLIw*@u~w
zWB|ZmiCrj(xL>rL$}88+Q@)aVQ5r&&VAy7nsC6KE+>|Rkh+diWKPRuXoe?j>r-!bD
zSz1i?H6CvJCFPw3uGP=}^0R7W#zmc3uj^hgR0|TbnYjF1S(45w>zcQXn#h-2Mn5SA
zDHoNySt*#aXE1Dc9QLC{52mG1rhVoD32{~CloM~*LRrcA6~0o5M2V`ooe5>W(oX}4
z`P5wc{PN^ot@ruNO`qc!ma?y;b<<H-F@&_d;DkTMw#AhntWF}baiDcG5f?0PcmpGD
zqT%K$J8N*?C@X^Z%IO$;w8{BB&j*wz<~_@`Fh36wpR&67DfIJw1gdc74JdVGJ&7A*
z4-d+$X4%u(ez8ruL*iQd=<vknN5K>AeoaHZJ-D{iKQJ*F!L~8{0U#4l3Gjg}>;3@%
z3G0CV3yp*Vc=OO%7G~c>xY9%fzMuOC$;rp(h!v`y%DHW^ABX=%Y>|rkniL!NirT*7
zdWFSXLUcTKWAGM(hUiIpj4V|5czx0A!6#};p~+B}F1COiTSH<ixK_At@rK|=V2N=<
zwe%hZp6ahy#E*+whMN9clzfIitu_{ap`9lg_S!ox+rD2kc=VorUA44a@0&4gFqs0=
zuFqFY6V)SV@1u$t9~rY=d+Foz!Mov^;%Ez4>U=MPq;;Y~AVZW`240qZ_8Hr4Nsflp
zzF!bKXdk>%zRJ4+0K~1aEIv!fsSrc(U|u-t`uU#^byGV`>)&=gbbsqcZ`t5EYn*!A
z*g7HFioY*YMKq>$9u3C6ANYB<IK~C@e)+c#j+s)>(0k2%qN&&vdZD_?+oDUCQ!6b7
zA+l3AG=itut!*c$KAU}Q=d-<?x489gV!N;M1AFOjT5G?>Nu#%10OP9!w-q(?&*QRv
z1~t_WsdZnUKl7RFpVafr3rPjKK04^~@pf<Z9z2^n<T$TqKzKpU-WUPj>X-3Hm}q-$
z3(rR?X69i=j><5DXkfRaiuj>`I{0j%8kh}Po^vwO60JG<{wQj#av8|lb=$Mzu6O#u
z7qCox2Rxwdv8Xeao9=O9WZQ6F9mIfBJxay7P4)M;pA}sOgE&;grkl&&!*=5%z-eb_
zZNGgXc@kYo>kp-#3`~dUM~!&p=XwnF_kn~7`<uLr<QD-hdd`E!4@~P6{e5FQ=Wpu4
z`f@KCn3)8DSlYRYfXm4qq41Mi;SIa`a;^AxWoMl`7xnzK_@^~B(eL$~_q<$mIICRu
zkB@6md1yCSBMse$C#ccIDg9bP32SxiNxjIU`sR15f~R!gk`4wy9iukmjM!<f6>52S
zZ&0qKu=)0&Iq0W)mY+Hm;*yRO-sK{w%(h7R<|4A_QQigmxoTd3B@7%mIVS~oQ+MSz
zKfb5UHT}XR)>5n=FR??bG1XpI23lRjQ_?*~*}BRm4XW?BBpkiDblve)%5N*+RFG3l
zm4D&Xl0<?!>o*i*%@ag>c>d9DM-YFt`tUbNPltioA@wc86M<Hx{m19iXrvk74-U>t
zv`@qB0PcIU%aebQJ_hqyIwlxPV5@hIXa@<*t?IbFA8WvAZ2BOd<haipZ{w4v)04)T
z!XGbs3D2;y4^hlwoMGT@5)lAz1SDdEx7cm=+Z6pvR12kYApPBAeE-hUuTf~-3Umi5
zz8sPNg4`^mQ+mW(hho^89VvM#fzm<_U28pH9Ct6Zf1WI4e63qm>E+9c(%O&+F|DMD
zM;M^n`jt12-%!e1efU`;xi^7{`BDFalyEb<ie~?Exa4~1cX!c_b#f#B!P^PvYAai0
zlh|c_ni-`wYMr;k{`{r&g@C$KpY9)1Pcoq89=67yLg<?f@wOC+Zrfjq_e9xF=lOlL
zqhth5HPh}F|NPza6Y5KkU!|H+1j;neXi#H*g0jBTYmU_DV%_3FpePNGTN2a8n%bGM
zjX~_O=r=`9MPzG;!dF)T-$v^1)_BQYo-rPv&AfLw{@kWHD(lDgJ+o+Fe_0lvVp9E9
zacDk2-S;~JR4JIJ5g*p>0{Kjz+F60`Rx$l5k}BT*?l*YZLhFNxb|(I#>zIPQU;mXX
zt3i7l<Hjtr-^cU<1x215k&}vZif)MO4HyEE2&-qsJ$W0dF)w#yV+Ga1SrfK0BEQYt
za`j7Sc5Nwq4A;$^*k!X-Mq2awTg2&CGC%CCKsYUr4H+M8sIa;aA|^PMEVb2-Hytgl
zpG|(oxE;v9V<>+ppjGqq+@Ki9_;UK-zH7y8jZuZOp^q1w{urCH$r-KAB{4z&TcRZO
zlmJYgOX}*9BmjThN5FYcyu0xi8Lk^TBol|5LEa&nm(&<E<5j;wuRPTR9`?Y&C{u=q
zOB^Ni!$d|owGT43YN)$YqHy8@#<354nwz87ID#*{l#K$j93hU~4=xRg`a5&%UcfN6
zO|(`Ja%750#K)0qBjuYa;(X{&hPUj$h-Fs_>3BS@DyfsnZ^{KS^3CM+7Q8YU6dZf2
zG@O3YrW)(58!*LEAu}A=uHCUT@25==dRQYiS<I6*+h#X%G3Twm&v@1W2!$CedzHn-
zR>ZyaZWbokFT2G|ff3V9X;Q0mcZfVhkNgZ$(pdwXT#Z5<QPh!~+28ue4=A=#wLw{g
zFaD5WaDS5ayvFD?p^@St-<2;3;s2(*w(i7dsI`_J%c?fLAKv0=P(Nv`g6tRpA{F?%
z%b16MeR)`?lKkW+0i0Mosg%i=(~8QL(2VR<D`eoPGY%o9OSCg)O}(;3kSz8+!z?lJ
z(4XCB3IH}T{kZDWoM*RMRrY@j8mEmY?<}=^%R5NqsFcRoF_^w{Y5Atbm#&^?99Pbv
z*XT{zJ5CWc3}XHo$K_O<;Xw_pWX1xkOsZ%}$(5oQb0olo0y1T@Ghv=-;`hbRK)*~K
z(b&n^!Px;=-d)56@BiBWxy|T;An8v2#t^kpk-u}<0NM;BmXaA7Fa_HlEmyaDW_{vQ
zd_+{Mxdy!seGk1ZbxrEp!dTILqBG4t*~Mc!{(nX#fNO~LT2?R(wBq9rzhdO<;W%7(
zD;3j|;ntpnuW|$X)&s!7KHY<T@{=XTZy&jmTWXdR(`kE-`o4WPUI0D&mg&MlCFnNW
zm?5z-%co8$i1sOP!~2XivzF{c$93~js5UV94;Df{o=2XiS6uLOo3YQ93cDCC?X40{
z^p~|=?19hDp(-vljHOqi;TSiy7S}fLXGEz=o38;tCnP!DBf*VIKLl57&ae!yXRtbe
zgpe^3t`n3$VRKm0FKA0Xf`sZlm=+SjFHYV}i-jUXk&I2kEDhHhURkiXI>x&Nr?IWh
zaS_@(>ww+$CTZvggzD|tawopI8lKT|yt_8!-$J|mxPacuqVd(*yO^#{w>R%Hx9gJJ
zGPbyHCi)k^TYGYgL?5}mv`i1JGpteV?b`Ml+>_o!`3LK){D6tTLj$_n{h0hI054nY
zSnwv>D?cjZ$P4*L59_s_ihZ&1xo>G8n+jImZf`@c;FRovB!9$?ff9R~`x$kYyx!z(
z_b59%B-xxEjU`1n?ll=yY3+3?BI#tAFW+X^(;<~*Zjr%^H~h*-j9FRS36|kNfP}&m
ztiW`QERn!;1pdDNnFMXZ(P!Kj5_AZJFMn=cN2iJ`4h##0V}{hEC#A4K>WD?|TF)yb
zW;JbuHo`Y!p^duNA`cPC@+LI@=neB@<bs^W(3c*kKh}IB2dLcK0`JbvHp@Bh)@4t_
zgSSLQ&NimG*;<1#9*`epkx|~7YOd-1#lAhSZK<o4cWK??$n|)K>s&#0mW(Y3!8!05
zOic`Go&uo`n)U8={g&$tzcgCC95ayJoGq-rB)ttC@ZM>K!6CQi+uLNtw{HIi;Q|;-
zx1(3mbyZ<3@v||^zYUR`zA54#&jze?%ONhDj07ga({p*;umfpLI7$n}gS!b&MHEKW
zJB8-Gjkp@z2fmBI{bV|1=l`$TSbH_YG?s>X8oPF0uuLUFF)O?}*9vKkZPi_I({Dw@
zgfFiA%}gqNoC(KO?SI>^-?kf&K;2k$=&Af2CHU`Cbc2HWmulZx-IeA~BRtb2rm-0F
z*_V#273Sc{dvf=rjXI*)=o|4y%w1X_&X3n&CRxzwx}S|O^v+o;^ov~I=%j_X_HWn9
z$am2MXPe@tu_)u3wMHBL&r_dqQGf7(d@1;-lL}?W-c&A<v7fe|cJkMf#1c6P!AFBs
z%U*wgLhc<$EJOcbhHaJIAC6n}kIB}3*TtB@m@&G*CGACqlOxS+zxscl*-K!zne+aF
zRjh+U9<M*MYmUqvF7K*o`c9J$lMYbAk$WDNffj-x2rZu;T+R_e76z<|6N`5VH;s0&
zn^*b{An6PA+Te7B=CKoQeSm)E+jXBZ^|C?c?TT@5CUi;RT*pQ}cFa(mCWD#YjKPe7
z|C|_p^({_SHm*SdD>j`ccwu$>8fW~VTL++nWN8uGIM^_SB`5v3Kd6gJNBurk&b15;
zJNsJ-_vhlE1t8PSwLE{rS7(3>xXDgIg^8j&G_M<>!UY9Skxd6o1?~s#f5!#x2mFsA
z_wgXW!a(i(*3)5)f9jZ}*A`WkPvqN9b1f4H)zx-yV#gSdtpXbsdAuW=D%0~iKz}eZ
z2(mz0L4TMhNU~G`O75zAzxIB8ri|0UJ!QhOl&O^Uy{%M{5bLQ^9(d#Gm~ftNe!|yU
zW$ye1ta9>jy2b)|1HuG((}~qFOEyc+w@xN~$4y%)J@wwG$aK=bRZt`);36p?G35?2
z9kYFXW^9P&!!Td&asE5X$Zc~!-ut5giGUi3L#~<JFnN7^)o00)gf%)u-=B5Cu?hW`
z$PnTNVOd~W*m<?UM7Tkyk3Zr0yP!)FAnvV^O($D`>f;FsQy|1l<|Go+w75`KO9u}U
z=FU3r_hTY#JR-!a_RZ9;KKM6>D0w;YVDglg4ZUS?Dfjc|bp4_Hn!QvRr{c`9n&`qs
zZd~Q6*T1sc0mwZ9!}Yf5?O9YWpnR_Zhmc@M7bqD)h8E&5J|}i%z%rnOZg<_?X=289
z-G11AAvlU^6&&aRS=;&EIru3@w(8(|vuAM}u4-p+xkjiVeo#QL;o8Nu3k^ck{tMJP
z)il-^&DY3FLf7@NY7V22Gp>}R;<YcC|D1Aiz1*as+&&LWCPlKZKP=x;J*%Uow;(6+
zLkw+H%T#UT|F7V0Cr_}ESbH(1Apehov*l$=&({|yYLBd3#xLN~lLbD%T?amF$d3Nv
z18*7=GvOW|rN3$0mA2FHZNfIRI5RFJ?+=97)gv$dpeplUxlEeh>Kq@TV7ss!R*i&z
z+alikXXY}uq<Qc?bqWJKJ6=Mcz@R_HH%nx5;)zaArE1!LQhril{#CA}0go>-4_Vry
zv;VhZmGj#F0vpoOq|vo0{`v2NGyO6dA9pFS>jSF(S-M1USQmAHo!XLx2gid#+iQ|8
zH@>gv{3<GG?fLBSE5A_bh4^zT<!^?3nXnBc$y9ejWugzy^}_iY`-TD+A?}>=&H>dQ
zkfI&g{|JF6Yh<L~F3a<uKz)VUeL}S_X83*^CMH6`+=|kz9vSYapR%7vxYsU{eo-X$
z+?9#F`>#LQ)kp_@2ZIGL{#?%ce~zr9KcOV|>3=jS?z9wXzvFJg@-9y#fImlm_*@Fd
zK#F^0Qt{UJ3Pc|0YQMAeY7tQ~ay>99&cpkJ1f>`L61Fmpb!`z<7h7t4La!x^E7iC0
z+c)Wy?f3&=V`J8y6cG5c4UU|HO9D&&6lnT)@XJeA%bfmTXK=x8YY$Yu$9ISv1Boro
zE1+}F)hE>dRCrD-`>7TR_erwjNSyrk^OG0_&+n(C&;MY6=?{-Oh9d1E##5&)Sn9sx
z506nIADZvv)0`|RB)#YUzeY4yweRUujJ0)ir9hFsK5O>??NCor$B2Y(2`M56{y#<H
z|HN)N)Y6|xwEJ(9c$4~GKUZOMzULC`jXUk??`{&!ti<dV3BsmXcN`k);Ck2)E?7|P
zQlBtD^8&K(D<MOtIj_uKG|@V601?cA!{sd<9VOkm==Dg?3RErNA~=J{Q|qPz|KNY|
z@5-tC*$0u_|7{<T1->1u{7u%U!)JFrN>igO&tBS}7K+dMi*HNa&-MoLq<8D1uu(=7
z`Y(68i5ApeP)41^EA(^z<jpiI4)@gu;_+7_WFmmCcs&pPr>p-zdnGXO&pwzFy!o2*
z-#e85qufU;*WwacODe&mo;a1yz2AQ8CuYuT=3Gu1ZOCmMZ0%B}opfQNcU+g9!+L|q
z936UM6xFlq*KbDV`C(qZC<!7@iI@r|-9P?UL-zXU&xw2E2~Qj)*}uYN;M*5m^T=^6
zWscI#9BcuTBie0VNWZz_7c9S6>4mw1iq@nI-|Yj?tXh`rOo%Gz_H8rCuhZj#n=!ke
z*VNmaW6+`3n?#Hp$OEsey3=)J+JKvM=i3NINR_7lZ%Y1WwR2-gk+*!5uogI(WVRNm
zS$iI}@(G>2xqtn&_hg&=HsSJ&*R8$AQg*|$QRhii)SM^(3IB-=e0=m|vFYQ5XEf=?
z!4X_o4I;fQYe`Wl;|=@QLAMMrF&V;gbTV-8)MR6rPY)sT3&PfWObcWFi%qs6jf0pb
zQVMP@-Kg7&TJBJqz$_c-?lhOf%i+-hq~=A;jWULw$|4qnlK*yM$z^W;B3DTeP^$b}
zr~|FoW=Cfa|Kcbu0{YlqrV_kZ?O%CdDiJKgm+8<VB20;0g0mn0E<Z`LF4gV6&ByL2
z_vCiAmGb($+7aVvkkj+#dW9VU1LIik@E5-#r#$ZvlfQZiYZ9!J4$jiHxj*)5P(Bc7
zS7=xE-bh<LN=i^D;e=I8c)e?qlG@$*2|b=d?vHIXiQ`YAaMKr@_Kp|j@V17?0m6<2
z^x?tsr{*)-!KN|*!2}fK0T|~qp(-2fs7(vUXrgplFGe~*6XzpFUQ0}N^PR*_qVQ1N
ztCRUC+_`(fQQ>|D2_{E_%3AYIia?2)G9)dO4hm%_GB;drI2HHgCd6(_rCTFEsrLE5
zjQ_WQ!~HVF$SD7)NT;qoSz^AMjJ|Pr1TAN^oU|T?%jG2SG3M7)iW|9Z-(qxM+?n>Z
zrV8=3ES-^a+2ak;yEC;vXCyr;WtR%H{M{dg^x{>Gz&p+qV{H5ed32DgE8SE%)Eo?V
z+*<Ua*<Vf9X%EE-Nvl=9D<)Z@@a{tVzwCh9OE(TqseMHQO!hI3?a~IRd1HA2$d_d+
zYfZJ-T1&^8=$&vM-SwORlk{o$ZD(tw%QnMsGPv7mv;lYRif4NZ(Pwc*v5+VXamm<*
z-4K9d#jBr`@31TxMzNSW*B8Z2@m(vPiMu-cg8D>2ZYloms+C8UamVwi^7kz9NS4sx
zzrI7&C8Z9CYJ-{QyPv0C2nTBF9d|fT_ritG_zCSkGl1@$4&>ip2%-A_htLg9QjWKk
z{P6I_KZ!8ulC$B|H9g5Y2p&;Q%<wG6NTuRm_Lj4MhrU~46xrX7eei`tVl>%vfUHk2
zE;z%ZYb~$(-4LT4JKVL@{mJu{!eCaJJUfx|Yz&5)#AQ2y+G$E2VkU9CpP~7afYVtm
z!P9x#MqHank$`drE2eQp7kYD0wt`}?sgza)Qpbtmgbtx|VJKr@oNT@{1oxJy;ivHf
z&Gr&x<T22R$iZ#$Q+5B-OFXLX*$h_P;o!?6s_Ty9h34CFTSM~Kw%iX78@e7ZARl5I
z$HVP3J)eXmF!X7-a)p#1etWi~zLS%gw9-Usb`Me_Hc)uk7j!K%sJ%bf)%IR(vh`mP
z&iP7u#EyRJ_a-NF!gc1VE{p7%_*)Z7&ieUPuSz0Ho*39HSVNu^7zrW<(dv2bM=Fd-
zbb%pv;1VFT7w5WD25M%WC|O4=W85?E-_p^mx1f2(9-CRgPOu(4RkSO^f2q<tXt4C&
z5>{G~UKeO_05x^-qKx(MTaW|fz1paA1A=q-loi_o*7yMq?c)mz@>_Px>iQ$lxREZ_
zAsbRNIE$j}lFi*w1BGUWWEw2<Iq)qMPQ^^UQSszHxkJM68J6W6spF>us5K3&O!tME
z)tJ@f+t-+7nq>kIvMc$tE6t2ay8i^60Iv81YG(x@{-h7aquwa7-QtK6?<PkSn52fP
z$cMq47RekcM@kR&`PqNG>iS(`V;xcEx}$xYza=g>iy>h<CLHZDAK-Xz>UK@6`^F}A
z)Ip^-q-^(q)PmWQgrQLbk*Zrat0K_Ti{_oW4U_y;1f^jO?Wk|sk5@H$fz1YO)th^R
z-FKXK?zb~<A2tqVZu9EeP0TC3TggyY!YiQ+p)a{5WCPPO!pPU|B+sesyRCHMIDE|k
zyHm*5A5VWf>Us2C`{}puNCU0Ti^|J@yK8yTdgR@GwU-jU?M{avnfGk;B(@n|`SM*N
z(e~LF6bKZFfeIj&%_Apdu7UuwY?%$^S?!bRd%=#)MV(QFYGxIbJm;$Ic}F7}`ry9|
z)khs(UIK3lv)+f7V>P`lJWCry$Mu@)Z$`!OwW01i@^8ha@-oOhOXrXTI%!>VaUkDn
z%lpK#?c(X_xAo!-E08ns8uK+wUw6F$zh`((Cw=7Gt*?xYVvqj1udJH+m^Jt)A}t0i
zzN^bZ4wts8X)+NxQqfH<A<35YclJ0$puO;tLA6s(2=$fJKsMTiw%a0|hgAamadvy{
z){b+UXG{8fDxT+*$S6~&Db@i*ywUs_Tzr(7I)fCJv;ZZ#eW@6vgFA9MIhnAKocE5v
zX_IgZWb&V@gM^s3kNnBiX)%Kt(%O=&`4^e+r+x%_K!95qd@xM@PuQiUc-z5z-ZlY0
zjQldNqr5jeLt+n<w^9ev<e&6jS3hH87kYymHR*kzoD*0PQSCM?KLo|M+<p<qmSf-d
zrs##h5#}gU*C}Up%`MSLpw^@Vvy|Xbd+{AnhCARZTMzc_gU?8V$mf!_%li+vJ*?wS
z44%H8@a2cWmZRKSD+c)vI@&K{6|sUH*-@xFzu-jgO}vVh^z32PkRU)@4VzGf*r$;`
zM3C2hx%`BsS@DxoKW;X>ER!vaMRt~9a8RhNQGnl6R_CBVsFUFxyULAH`{Dy(&yfA@
zBu0+rg?{II7e$4gApNTk6r0>iw=P&iL&aiSxQ|M>{DbxI)5M$7$Uw-P`wiiXrB?|7
zmMSph9;~as@8pN771!P?u;f(i-EjK%6LeHP)p3jC<TpK_%qtwYS=;k*fNB#)l0q82
zsqPeMWLt*Xsq)@ZVleHjK1>=6Prrq%XswWdRj$+pO^#Q{qSh8%Q;sU&zC|BS5+d{6
ztfs0+LIL>d*@oMleObB-8DX?AzH}wBDdmhC@_ssaDijyG$?~V@V#dI-p7sEh7z@n%
zn-s$7BM2#J+^g(&P}CAiKYJmm4}7VGY5#`jBS6)$p)eu&n(OsH-G_g3wSkFpa#mA^
zCK5rx5GdOJNNbYMZ$S-nHAa(-857BRk`}Q@VacqTryBW*p4wo&RqrGcKPs-r(VDd@
zNt;qGDW-6Z+M?EFe*ihbEYr1Q2ucrYN%@LV;Hcf?F?Ktm+ZN+8`a&`3*(S`iM(|%B
z-nU0NwdO<0WpZyo!fazRe<na!TA;ua{OT(AR|oQMulDHo<L*<2I{KIk<JD8bTJ@`q
zbI<Vlvinof&#(OcIeE;(5S6$2bY&t2&gGJ^uOdDW+6A*?S$(YVcI4Eqa>nskXA`C5
z8E?R!_A4fGGIRpT+DtD1D(HBZL7iM8D}9pxJbFh7dX-Bn?gb!mWqRkm{m!>QSlnLD
zoLYbTW@d;L&=DL2`Sdwv%E=~NR;J<3e9L30DYj`|I1Qc;A@i{uj40)syE@vX#~R3Z
z@On+k5~rA5e5wAL?D->4t{h7Tdj<VznzPdw+p~<VC||1hNgf(bp$0B}{DPm1z&T^L
zO*nDWIC?L1)IDJZ#nF7jkodt$zw5p#`|XI?s0==jve#tmf@$H`J35DRZ$0RvH#;iO
znPM#;cxsq&@$jY5%W0=08Sm=$Gozzn-_62qFIY{NB50Nz;BYw%AVnPFJghPTcj&H6
zds=j38EyqDv)YxV_}83aYBV4#8Wb`35YM|94kv)``3+;rizr5@{$!M!@vIy2RR`5w
zWI5XbfP}b22<Xecv`_v~@_y34ur9x+gOev=X?ca}z>WlT)F2E)YJS~0bP^R&yug!g
z4*zOnC;f>JqJA<gmNGIH7^YU>?y$4aiyQZCm{`467^mQ_5G*NS?#F7mp3?@Z-TL*z
z(n;D#UB2(ks=PQN%X+&q{nMjq|En=071y^vC;yZ|0}v8M9_)GbAF_3^f=mIPrpWO7
zg$0U&{o#x8n)i2;*KGHUlbv^5{423s54a!Wz$wRh%XE*eHJo}&d&#(bInbJ{1;M~V
zF;}+{4bZzFEEb?7Qw5M-rd?IAvu=E1v38=+l57gWJpE;#CC8JH{3SI`6@W$td@R3>
zYoPk{c{(Jlz<jFa;=b+Ot2Y-DW0r??v!L`G<PK6KhVaEz%5UKUZS)#TTdzax$i<l)
zo{J^0an;p>&7|Dx+me;b+t;Q};}|sCKO`{AT`VP=J40?Xnq9pQWPYw_$z*%GJ!06s
zydK*gaXmPGng`Aq*##4N*h*~I`IQ$vOZ=U2e*?+z0<R&L77Ux^@&W6|mcUAWY2beF
zGoDsMu2u=g&74-mCx2G%U)iaHI_NMhZDey{jc^+a`FTExI%C;>PHj=gCE{my=-Ij1
z+Y=os3_;PHQa2@R!E=XiFZ5)3fs!F{)WLec!;6a8ZypOMyqEVhf;X8Ac$W~UZ40)p
z-2sn?x_+8{2!|U$6cx$eh>n(9u~9jY{5D+u6;>)9o}QDf9&g7GU(lv*8iI@i_cxz}
zdI(WoLlbG$2hZBSzrZcZQCC%F*(0-+7~a4$o?LK0A%5yLINZARW9iWY^|wpiaE|+B
z<OeTTW7>jfnhaaHgJy<k5&<xUwfskx!8O}v`=#%x6QFg+RR>YSzPc}a@@!;Mzul$g
z_~{{#_mo%a_a>ON%ZSr`n@1D6=X>8kYd1bDgL3{8g8z$*w;}dysv1D+TwEj*<0w=9
zsTFi4?!r!pdv?v!Dn5g$rMoXuY@=>;f%G0))QfOCjdv=q3HQ0aZdVTmENrZo*YG}h
zr^CHP$0d~tUmezq0sGl$D$*Ps;g4J7K4v>cf07Nfx3G#I5F*@#TH7k@^hAU<3kO?h
zKo)XGBi>Ek9pPb|u1m3|om|`xG)NpDy`7=_LjJw_vNHWp^;t>ex=%sI<ytm24J+-J
z_t+IVEXi{%l^A>a@6;7EiJGujc;#`K!eqB(g9@^l#NTqthwKiIQG)+MnVWJde&n-9
z255g-jboMg3DtcvuJisPQ1b1w1T|UU$B#kXd8k;pFSwGJLHM|%bRc-qN+z^w*oV4#
zCv!p>!^ch)y&I+!mj2v0*|D_aw!b`nJPCmKBx0AYkIYD<sq?;M`9)1U!vxqSnYyk-
z^xV&W@OHejdvDab$?v_Xllj71kdlYTxPkmkS47m-7JBHWgn4ncgqq|urR62;GV}MQ
z#l=s)mV8`((u(Ywnyj7pmB&)IBvs+*;r^k`O#^?aed)q6Ks|4D{YB$d!a!kNj5lA1
zU#Rs|XTryBsF02K6S!mQD%r#1lx#8@)mSUlD2q!*^H&g>u0@*Q$llCdB?yweoGy-|
z?yQ973stY?bGM_sylig^fW?th?-!1AUMae1&zFPuslgjVT!%Q7n*|x`+UjUk!mmhd
z{)~3SnBo_Zr3LD4Qz-b!yJ|Ya?Zw?Rnw4w!hWoeWSZ`lgKQ}>2ug)AE9{Of`k1^?C
zJKFW!zM}2QU`5Q?NB0Z#(N-|^)7B>32KA1p&2OeTCvn>Px}A|eQHN=(rwkK`!?K>;
z%iu6!81(wfp*p2WKa5Lyh3)2C=`87e1yQ<3?#Gthe8ji-G|AX`zoMf=;q>F&^C!SN
z8CS*SQJKfvTsy(;B{bj&FKnna+`Xh55OKYo?vu@|)z_dVEW2RNdB&D6eH-7)lTc)E
za=vg4((91|>ULY~;8R8SlFiRJBexR5>*#?vzl}4!7bqo=ulkibGw~qS)y(>P<qRj8
zqE~U&gOHGj<ZNl!!uccrDLISb)3Ov98)(#6R*17OEL)Uo=OQ#%2yqR6L%y*TFqG~H
z+wW`Nu=6!PLL>6cSgHY6%-6Ysq4s{F2X0s=c>oV+i&D6{fq6hi$gk0TM{!$WTj5N>
zyUow>Ga+fPDkyI8^EO!7YEk=7348B~=N|>>Y>LmjZQX6LFWb8RDs3lY3CX>1i?a!C
zq5zE#&p%`Y_2v9<x!X!th9uG%3LeDfej%|oQigT)=d47_vIjpIzPxyPvqPT8_a#ub
zW(WVGPu4=QZKizG8UKXRvMMZU;@-$J_CBOZSSNH!rHS?tVWMp6?95;YU?kQXbw5pn
z0a@qb9psVU8HRk=TEKB9y9uHnpbtt9&u^Cqw!Z0fadN$AO3{P-gNEF?rl5Y0*gJl>
zqu7aqzxw>@Z@mBjBsb#SeDMX4h+`B4PufDyYdBkex60b<AC~fnn%{D)<qdlZ+pFQ3
zN&W)u_*qBiGCEHAdLeK!qe~Q~J(Q(cEq&o;U$(~w#*ocDNxQ6v1OKo(!+{%*fD=N9
zBxApHpc~BY<(xO4W2Q)Vi@?X`izSrz?v8@E3yghkf85Co|A^N2xWs8ETn`_`lc=wy
zB344V;ykHq^}RL^IWqa{BRVyV9G$e7KmP0)>*UgK=5K{dSM{(fh_b+7#Ifiz8^5!m
zb)?zB>)p@64V+C3on(G81MG+jtaPNz+ZBKZ2k%pO<W-&|^&xH@6My)n8Zefvwm_J2
zj_oM_)Kms?@_XikcfOiT*itp@cdHJ$VQcf!Bgjej4W4%B&SgQO*{3oSO?y0s+q*2}
z-j;;K%H;d`guJp3$$sY#V*;;_qL!;!b$<o;bi6Lx{+?GBCqVbX?4W5f@cO$(i{C)+
z9YNLTrcj*>592_{*Nbx}EiMj>SC{&WQ>5-nB+`KbQB(8w#C{=aD&#UQ2J>jL!oTnJ
z;k1LYV)WO#OEn;;rR8W4k(v3SNe*7M-sYJZ)aSaPny<o5qj17rN~HhmEZf-0AHb=*
zBllYjm&||HOrLMQ7W6B**_<c)`7hM6b{=}a`#tS|J8f})D&PJpOPIL=gI3$q3to0#
z0{PrQ21}FemT|0)?s3<{75<HHT`+$v`CNVa?CJjMs;YEzzEH-UTBTcxH{**M?_{&R
z>*x3(a`^42*zbZ1j>~;I@bf)*KiJOiyRB8^L(!{9&QF2K*e7}-mAe<ezDr;_8154u
zp*bGPgr#1*4s>}r{Td`$n?iKqzdgs+{PhF60dvU_Jb3tBQS3^4rEE2D_6R2Bd`X>H
zMW1?Ae`~FQ?=jrz88i69Bg*t|IHiN#i=;)9*fMldBqA)WtI1@pT6cN&Gu4u4vSCVT
z|7itrmmt~r9*tO$l@7ivD3cPTL%2eFneVC5IXc#SZR=WwOs7o0)(hF&ZB8GU%(*;7
z5K%A?i?sBe0AMq?R|e}<c(D2XRL|QOG%oB~`GjnO&*g{~7HGI4unkn4Li=RMM(SR;
zQ(P!Ns51I7<s%qo!)anJk<~JFcpK8n6LWb)f@?0yocCimR%ei-`Db+j)PpqxoPSwB
z-S9?H=FMGF2k8;Xxapy;_K7X5@!K_GDQ}2ne`#@+$6(8#)s?Ox&W_eFBp81vt@=Y)
zSlU??O)EW-cgfuEQ}b{#B&q22k9NJ0rCt--y%)3e%dzJN#3FQs6CfL!Gy%#q2pKd^
zN<+jE!QtcakXT~KnsEQVsgzczNvQz-VVa;6jp=e8to0j@Q$91#&0kTPVH~=RaaNq5
zFtDd-B@Y5GfzOqC3?1PzxTVcGp58BO*aQ%O)KM7T*y)jZxm4nW3|roHJY8^`kd(Bl
z^Zc<U`&<9`QW&RUj1ttUzi&A8Wb_mZA<w2$HHqjP1X50#4&WXXd4~?VyzIFZt_b`V
zdI&scS3&OIpIx~vSby=7Vw{EHS6tW1u}cvVGwR)6kykO6_PD}%uTg!3WhwduRS8ol
zL*-cNEz8tgcVeMmyuM==Yei7$-1We1CSYhzv?LJ_w3;gC$Q-d3X&A)^nQc^ewhnYz
zubSv@ZRdmmDH~r<J|s8vOdL5KmG+9yxD6!HvyhPDf4l%(k!dh%jyD-jT~;JAizF~z
zw%P?N?q8D*QL+Sm0zW;ddxJYzUR2UYM45AhlIYJdl<^@^ZvoIp0Q)ox?_op#E?XKb
z1*)vgS)c7_ozF7V(f%V-36itDo26Fj9$y2SaI#21)>IkWxh9Mqi8U6P8LMl2=s(hF
z)1=>sibHn53{zp*>{U5~2m?Eiwx$i1dP$L^G)+@3#fhJ~TSy563ezFnZ?9A_p-6?C
zn(MZdH!IOodTrfkD|mDB_OIid=r8PYh_!tK-4+qx?I+8O$EfOJEy4-m*OH47`g$9)
zlqu`2@Inc$&^8_Rlo-GC086Mma8<)q$M~5r^hTkIxOXWH@yc#;BSpg~cFv$(SC}f2
zf0C?E27hOYTgYorrMYdyVeKyy$f}2!q?U#n{d*?iD!n7LRaxAP?D{UC_D3s#JC$Gq
zKD7FMyQ~2)M%RdoPHV7zulWXp-plK|zKef3pFN(Ws-NZXUJz>J4|I=-UF?hQLqTE^
z4`z0m=c|Tk^ysy!4c&G!{myiEPZOOwUz7x_v6nxl{at0bv}z)aZF|<cZ9iMA1W;-&
zd6RWEQn2b`rAxTQUe%yI#D%t-bUNLMGbZbkplq_~Uq;%^Rm5H%;&0El1zdeG$eH*(
zQB+rQh3!ZfYW{_>l$~A96Vd;czjGw>g7v-m*|#Q`Y1wts$4}|C`L09_X5wRTBkA79
zO90b@W|#QNm|#1|Sj4Vd@WCf<@oE|>rFvw=H~6d4$sO1MhT<7)jI58HeIiv+kEimw
zib-ySlN+3-%WHhrnET-dx-zdQJ$(Blm0?VrtnagHgK6V=+K83e(zoFK-a>z?Oexcp
zpq;MK8|d=wrq91DSh&IHE%#NcD|Gz<mIWDahpuLFe}0!!#u>iVc;b1RhlicV=F4Er
zPy3b-B@WB*>eq}!Z7M;pogii2N%miD+^P4);}5dylX~?AvYcj>(wBV-J<Pdd9F{?l
zfXl8i0hZ<ibLQwW$+<Jad1C)`B};FT-MRcFje1i))4E@&hRBOK_gg&g_s$sSbahvB
zWWcn?@5o9@4)hq^{0Xw}0xd5--#1M`=MNd};WDwBKip%maWEvSbQXCM&7iuMcFV64
zs8D`OVYr|PDtgvR8!w)sSEu`MqS=%}a8$g8p}*r{;xBQNGh9E*U+>3@Nj7RJ;_W74
zlaiV*@nlU^oNp}J0fBD>?g%ZAiqqaFirji%QQz1y(dAzJS*JU+HO6VY_8?~}!MMR_
zY-|2Yd)bcR-#<f^yr9Ia5vI~B8r6rpKfOZW(T91=?o;xT_S_tLoGX*hX+G4v2k4x;
zJqiihWn9UpikJ<J^!h3i-tcife?wmSh@0C~B3sPGC{5U_<ctaIlAoCSzHjX`tzVWc
zCwhe;g{<#DMq$&<l_kSxLwUR8=_;eqf?E=;-maz`YbZw0Os@<_#%DSWj-`3O2_xF>
z@Wp1bqB4gJNqWK9ItDSv_T@d<MG8UGl}Fgwn*F|uoTC)(ILuY^c5U_BWPO#uD?52i
z3Ofyj&KJT+g~ViJ*PhYImqW2RlBJmynw_bAxV=ka_EsDwhSMZYi8PD5x*KWD8|;L!
z_9^H4%ZJI<o2hzdhTNtpJ8iNnNy%Ty=1=NVPUKgpXobB7e(9%C&S(o`9sO9ODHuM(
zX8Soi_KX@Q9Bb=O$a2p*r0=gpg1jO?QB6D&R8dWlO*DW$IJY#{AE2}(k_9;9v4P25
z1UY?_ih26ld1m9qk^cac|F98NqwK%<A5{VMW&X&3^Q-nALD^W8Wc%|GKiTQZocZbA
zs#(OwV25F-`rDSs(%6Oa4A0fU;0)Ei$4qk*GyYXCJsaNbA2hUa@H-!NQGNyHyyAH#
zh&*Jsbf3?ma72QyRD9%bNP8%J)@t|erJ+u0@btyW8&%SIDX&SpJ|BXbm{_bn^}K(#
zIF9vgkFo2^H|=RXPt;iOqbtdnmlKyv$KMx-pEAFGARAS9xPn(w!4~|67a$YMsAteS
zNz)894~+r}|8h1Ju?!%tsh9N*Fym%sIKG;kDPPHeUsLxFyX=ZB?m8c|w{ZE2A16GD
z5@8puBzphWr}NCKmjLpDQ$!@<9%__sXGeDpPO-*#$u`q4tvEi1$4oBvh?#jpZgz50
z-TC@PvRtC`LD~Dw&w5o+<nFQNM}A-Kb0(vvj^N3<;zuvzTyPWfV(%YydItvCdNr5b
zu!}VgoaNJFeeoqz++dil8u^jKdwVi<J5TmEaktUC%c5j5blLA4A?4+y3DpkpX6d@5
zo^}$Vq1lBSe>5_=OKJ%eEb|cRv`hS0?oIpt1=?e^spi<4`j3=1lh1J3Lz<)O6SOgO
zP2j}*WQV;-rPBoD@y4P#_8w$uLf!6ax=k9Io2slw#M~CiK*x#aed*frEQYa!zccqj
zKQN(9|Lbd3N1e@H311JFK2$)HH%HZXL8KShNyu{IC;U3?JIJEV_Ue^PKChKm=Xnl|
z?NgP{VZjb=?KF>WLnoTI5uzc}vRmaS2DIi8&YxnM{^>%->487_Ibx|gl`dZQZAhER
z%~DnT-G?8+Y)LCA$wl_5sWtwuJi(N@dfvIC<M)Z0qAr7H=y-K-He#Uz3jpPmzf00i
zTHcR&!CyMRn@8YlstL(0l+%FhwDvXT`IMbX<`e>e7j2fezP*^z3_$N?0>dm-VOQU?
z+p4x}FbydkZuK5Sd94I?d|01;wQ=j6V^LRxO=q{Z_L#3!w#KD0KpeQ7>TsmtuGH7?
zSCXMu3Vye~nexq|e<7h#n1M|BJXO$aDi3nKH646O>%_V{I~kNY#FEMO1;)uaQ$I=b
zYe7~1yJe=JTqarY{+9GN=UVo-vrqo125JwsVgP51rvjhfNRF2o#l$68%n5+E_7Ck6
z9VUe`g?ig3FY*B+r|@qgv#wbJ&Ag2!3pz1|Bnvl_pwrP&z}XR(>g{f|+nuqxz?P;5
zqr0q$>~<|0#2XPA&AU!>N@`sduhnmly|K)7%x?<Sz5V)GQhw3Qllzv$tBa??H|4>@
zi&rRVoBgjvjn@DM7TKUOA9aDcUnv+ClLTlV#fijK%=t)RXINqUxQxq4py>U8<L7O7
z0psp|ta;La<GdIH3=(!(D3uz`i<SIZs}!5jVn%u*HevRv@SHTow5@S~O)3(>0eB>)
zbbw;Wu04N{(EjX0NowF|%Xj@26Tc=~wWal(y``k@(_fzzvHZmxzvc$aCfR{c>p2#4
z>p*=U6(2mYi)rSR{MZS5%Rj4sy5QpPYcKm(IpA|z!kaZ0dr^`7RJN!`@j)Zk>9SY%
z!uMT0o~_65`k8_^%lh^<h94$-A$}5BU-7X4UWL3Xmrc|QU-{X7F(Y}_KC$#|$s1!J
zwt&o#yp_rN{7BdBCt2OS6sJlxs-J(wf41yb;@`4$iqznvS{F+;4l7+6_kOo@om--G
zBB8=>+*RO(tPFpnrx5%^u{T5AwH@KPn2*r?6<tp-F^C~g%z-`{l_^F{Z&x(vK8)Jy
zNlbwZHxDYri&6A`Xu?lQE{cWl2rP6mUP!*{v0`sT6%B*%yzA;*O{3IUfNW$xpK_Qn
z??U}Gx2{i3ne^{Fv6&srZotR;W|)=G0aH2_Gm(p&ppV#6oKoMoQ8E7V@6+A%uT#le
z&!zSk%>~{jp=P|WcU1|cy=khraSdKGkH1#bq-*wu=Dyl*DI+fKa!6FySTIpi#I+xj
zJ&}Y>BIb45j#=)REN0mhio4}n+9zF4LAXpb)7ugKisz%mJvh^wyRN-^+gsBV(m7~|
ziq;XfZ~YnSo}ocx?y9#eOp}#hTwh!ej>&0$ChvLO7oY;j=JLvW7AbR^067iM>7Wia
zg3{b60VNP)iCVDjm;0}J<ANBZvUm6v&PAr(oTTb%wpI3T09Ven&*aZqJz^8wBDO0Y
zZdc@Yv6RR4$np}tZm;Bbsr-mbD_k}Da(0fd!;_?n|K(X(cle5L)9GS88u?ZEzp+Md
zU&>iN%N-mYS561&V*N)){E!o#3lJ+0Qe*s{s_-RuU!#?oyF%3;`6gG0;m~L*Ofz5v
zy$5C(Z1fz$gG+<${9m)H`VtcRikdsrFs+5Mtb;;`%zZX=x!+2v8bX<l*=&T1HcAU4
zO9A^D*1$4Q9^{h-QFEh>NC{KCkmTSFXZc=RD|}fNSW@elI3GaVJ|*0lBsDO2g^&6i
z>fD?!LhVVf1<W}uKA@k{Tv;>i)m@jU&$eKTRd@wua(F%Ij%nMP554>2RR%1|57M*K
z&U%yEaXnydAy&4NREh8vfP~$4XqO7#QOzoH8nFB-?IKPoXeGI`)Ym=+P1&SA+qiEP
zS9xr0`v9>%De*c&g^YPlhAmiPJsv$ue(SNN5ZsN9Qc+@OvrcFe;+{iPfm%@V9jqvW
zh|hSjE06ddBCQA2IsAq&b5T+7nv$)Bf~?H!(v60Sw=Lycnc5+<yWh6PcKzH~+B`4t
zucSAg)IjC^8%t6)pleS^-ThF-vW!d<P<^#D<cF_J<M+MITkc=kL;JFUq_&LHzg!7s
zlGA(XnRTkgQJm^3!`S+!dannBr4j=FwY1AgI$&R*YEG6`;jI<K^Qr9M5nt6#capYY
z)e;oO_Q5)PI*y$0#^O$A@b-GI9m3QZK(9Bk1HPXj$;iDuoJ~bvFXC2kP`R)Q#h#-r
zR%eNedt%QVYi>@Vak?UB#`w}9(b|=Z-8SxKWGFyd{Q_5iCgXpeL$20kVFfp!`uOwg
zw7;E{`6inBJjqjjvEnp+7A7;nA)bF(tPYK9ZF24#Z(=_ip~I8j6c0DQq9n+Mmuw#r
zZ%z@tV*ZitQ9OQK^Vy7SGD>5>rBG1dd$+#1?5B}$-uvroGWX^5R@jog`=%hcWX<EX
z%YKc4jDIb0@`*ZK@w<PmHb3%##8g5MJ}p2Kvhw@zzNtiPI1f<BI8JFY8*xBKueUl<
z%m$YY4c6bm?}D8PS7R*%XLWLxk2(CReDgDr8Sg^usJc#lw)yVYzGX?pHsWh{`&GNx
z-#RX?MOzgm7sQ3^6UcuSJ}}<5qg5N!9-cTZvZK$1ln6VP+qpE}rfOo%+^JVqY$DC_
z1fP?Fx@tLkghm}LF?+S=>2X@3<t&r=f<1>`K<LWj&f%mMr?|Z+$1dr=)b6EL7L;Zu
z-c2=3^>Ticq|OBq>)lh?az+SH?WbHUgnluM{gH&d^NhSHmRHSKwA9o9Bt>6Iv)TIG
zpJ2=J?RLAPrS4qjWi%Eoto;c9hJU@Bq<kNZ>g&+xU4-xZ(nsX@S;@NO$jU?qweVpO
zL#>pzhQhalaGO});#c9bK&Bd!?FB^7ddoSH$R5ypcejhp_?A<-T~{j6YaJEs)ZdVw
z&q?q^gZszSCk-cStM9N+d0kVY2joDh4t8^a<_GgPy9-YfPqHEvPvC&rxMZ<H_O4^g
z1ee<M%Soh1p~%4q)7Io;R&$^y=dYRri74<yqB;mt7j-#_&c7ON>}R%~?)CoHJO4@0
zIOz7P5a^xsiuKWC&LYfaOyuX|4Eewb(Y=negGNBS5r~Y}`{Z-2bb(m!7;J>7h63nh
z0<Y+nQ8&!(JCR(GGo@&S5DLahsI1yXUwfZvTHIRj$Qf)t>(9=3N9I^>UX2O8n{YZH
z6~2-8)JX?MB^d?IIZKaG)2M=O8_|x$W@ZQJ{%$!3apvXJZ}T4xvrU=8WU#3+U0Vn|
z1p*mSm)%WY$G-59+@jz$kai66CY61<vu0yX;T3;f3gvN5Helc>@pTYp?kUh=Fv$YH
zZuT&pFZvYiTi<n%=qq+X%^8HKBPcy@zS+#UVB<Mp9f<h5Z^Oh0^+2MA8dP}(-)URs
zCcx7&*UtQRQC3T*bbaPQ&5N161p9*Nyno_1q~JhHX_N8dYAw++*ytZ2CYd}J&-GW@
zd~da4f<a?G#^+%@ZZLFR;ItYLHMnB9HF@Hj8ONPb8!!E!=`!AA-g6@^u#UadBBoCl
zKt)%#o@z?WeaUC1X-CYyR7*a76TaE@bYY3nTzsgfqoSw#ft`#lrcA4`xSZS#`Tnc4
zpxg{AM(Fh92>0mgaVR=IX9j`UdrI=xXmaWkdLoYTm^yuSF5#u~^8K;gNB_}7j+A4o
z2|u4MhAV9fADyacDT}-2F!fzBAm6Q&W<mx!J>&j1A}}Dy$c{)B%?Vn4LM_&TVnOh|
zgg%fB87f=3FD#(sb8nGCw@~A`p~?0>)l@#u)%563(~jqiGc}HJ+1{tgKrcMYfRSA5
zcp_8Mn9C-*5@qAFhJNh^@q`-d46)UDh8fQTA6bZh^Z?&mj-Hee(*<_I*VI?yU^~x!
zo>Il~#KR_a&&?joH*xcm!PPjh73g!a4kct%rcBw53vp-mCA}bGwQTGyHWnFR4y;7*
zmLl1#$+>&ZW5^iww}GA@CKNLad%7)GNP4nBl&q*g`iKZzTClgc6L^WN9Zp@V!Sr@W
zvtYuZvUp;7VpvTH=uoJg?)0;2+{Pij-k&M2+Pry~wW><TaG1eCQAKKFjHyWKZaK{-
z9*P^?SMS|pIh5IxK!FEcljlPG+LaH14>SA*8ZH({j#t<WLK@#PEoRek%_axM?QwB@
zR@3!Oqq#FFFI~z|^J#|-h<&mj=K)q5iOA0T(RMr8uz9yCR-+iL4g}^V`fqdy+}#s6
z=>ejz6wN;5ENML*SG;$)`}IZ*xP4ODYc_6WzN)01;G;C<x}8gPIy+gPqQ7!avRJ|X
z8K#i<_U)3iz{iSJ+qvL3uT|517AjvhS(^fmcxhBep<tF<+Qmi5QqT>-Hg~3y35k<P
zqq<FeNt$J?BY5F3Lprxf`pIr$tOSB5To-?r-4GL3)TZMrF~dEauQU0^$5;d~szlhS
zI3zjl^z1nw88;lQtS75)RXd&G4MyBg*TGZkH^1o_2bK-Xou9sN(JCg@w#fB#ocfxC
z_U<kIj1-~Dm8la@j4rI+gKIYn{VF)gK~oUmj(mfP(a&l0cLBO^8$077j_T$zTO}R)
z8Y@(?WIFo0DDTp#@VKdbu>gZ-U%K~VJFn64Mz|hav8$kO&qboY;2{f28G3HX$+yGg
z@zC?4db^F=S6s(ZgDm3>IPfqRD%mW4kZC31>x)M&@4c`w_0L(5^?&f`r_5&VjP!dm
z@4R*M|HIdNM>Vy4@uSy@ih_uUNV|f7f`W)hCn6#OLg+yWL`8Zpp#+jxC{hHGrcy%h
zMLL8Ml@1EhJE0^52sIEOA?3w;z2EoV@2&OL=dAn@&f-kw%zXBqy+3<~+~H+itM{4V
zD3r@YFDfRg?z2x-ZrYPJc>Q1WN4AgigvfcUxh6HlE+_LpJGPOSY1{Ghe*JRH)O%_e
zqJ7$?_{r!~vI0dpIg_a}P0f;H8RJjSA<S*<x$N<gWQBpJN6f=D8<R^rM3Fz|9q?aP
zNiqC<0@2$*KH`E@eM-wu_kH3O&-AoAM!{dBMyr!9-U2cXhblq?Crlc2iJN0;xaz0d
zZiHsVU4zoi8i~Cyp;sm;)j5a+*yZ-P_4CAD^uQ(Wl%AZ`DQ??7TnP{-^`t;a_c&jY
zf&0Ye?L~pgnAD{?=RHC`MyX%N_3LNXJIs+LH%n22kKq|Ytj$UDIvW6n<m`{gX%CGE
zpBB_ItQkz%>(rBM#t}N@@Dla3_j+E^&xP>FYik$C5kXglhd4_c?1a1E;Z4HZWfIS<
zAT1Lzr43Vl9@sXx#9ACuFqTd16+wyNoO=*ph@h!f1^xaHzyJOXu8o}XJBpMa0w`@h
zI(+5sKi661!_>$KX7P+mcV+VldtZpVgK<L7?P==3Q`rx`_%PHnu{U3`%tDfX(2dSP
zMIIIkr?h&D%3vFes+IOT2+JmO_fwc{SsC-{g##-~Z##^PO9ZxX-zkSQQ+F<REjAmB
zIu^oBO0#%=DnIjor&ua}&3*;6ohw)5Egx-caN8X2oBhbyI@0-ugblGTZnWtQ&=T18
zf?~3i+Mw_mkZOGgloFi+D`9+c%30_>WJWLWiWB-)=a_Y6KF!NN@nJ1$y$yG*yS#%h
z%w(id*1o&Ir&b66fnskvDcxfm3^OoI8z2@x>Xuz;?6PsGf49+Ush2bx4k(Rhk;kG3
zl?yAw(bOyZ{Pn4KOB+c-d5#djM@lws5J%=UKeOgdQ!p}A@t7DtN>@QU9f5^I=X6FL
z*OUhede~!~9(`CZ9hd&(3xA7lLbaU#)WOBtB5DhR8D*I4kvf*K{_CS8AnCkrcGn;v
za*(;`aGLxRHJ!$Xs%4_#Tn~|Go%ft+q*$YUQclO*F1FFp_U&*}co@<NDI}}I7^2s2
zd;A#F?Q3Ks8V!r_V_GeDX8eSP#&guxl1!hc{LpJ^y!}_~8gQa@uH<3fMq8k}Qy%Ts
zBYs=$)}b{@N1js0R#ybGUBq*CvUuf@uZ2*ekopsK(-~jAe%9%Z<UlDy`UhuwaM$E0
z-J=J-@b=V@llD`n3gWM|kT=h?9~t~`4{5$&&7e+Grzn##zH;qBQ3B5cPWko&YSZeu
zuN2qVtM1lC$eIKQAkq~DzJ?`Rik+&QpLy*^OgT{#()Q6>sdEiwDYh$k_JK9!gQuyW
z_!~&h$`Nyyh`HkOLUnm{Vj>+Cj2K&}rRG&Wp2FYjy>Vk*SuVF*hId!-l;O47%Nj3-
zGln{v-L25f^3WGOmiN$kYGu=v+hRnNsq@6iUepx}GCre8Y~4cR>5GJOr`->Ho4-Bh
zEj};@nxWA?y(4N*QJt}YkOc2@Lpu1q;iA%1O}rdgEOF2aBo78Fj*cJR?F|+GQDhWr
zx#kIVc{g_~5B*qFPc_ISW^x5dF=Xv=&9ewy*IdYba2<){U3dKz8>`|;+$L@zWl*8z
zx1Oz$&c!x8c{}AY8P0a0$l+l3W(k}376-Sj0Gp{`szWWVuRFB9<wKX&7o@K>5hF5c
zgFALn4Ka+}wF3&*Ou&EbUw=EJz6#oYmQ+hoff56}7qON|!_rJ^mAPbqJkW_@Mo&|h
zI8Y=w*AX&x#4(b;CdOWjjEr@+)nR7fW?EXD?ak2AmTmRNAvyJ?M3)Li5%2w-2`hQs
z65avXJPZ|Vosr@yDDgPKtvyeDG7R>r8-g*2t*nfZT^85zG~)dn!~1?Lm7~7K`t+AU
zeOW1t<l+?YFX9w-(xnVoINO}yzeG6Gy!@^+x{p@<*JFSwvpB$vOw8gZcCW+M9)jOF
zR#ylQk(KO=5LRVj-rjE}EXFzl`xuudAp@Wlfp0VD;l<EuR03mdx?u8L*j9^kF@nF@
zJTUid(3cK8Fo`2Si0Xjdhz9&}SBuWZYn6UV3zeZ5s;g3wSDQCX+~WZD8Pl2511uRY
zOox&lWT^i70Op6$rYkDaXVE{PpNIyTY8h5aiVgP=xDL3U|K1JoUj4fFGyz>Ux;$Ht
z8E2y;M6jKF|JOg)UDV%C=^iDp!aGhYFHmn{Wqn|U2UaY?Q~LmTNF&B?f85cGmc<|2
ze<<?wLEEdkmIc)pVs^^_^!n3myv6{p+WHXPPuWP8%iF&17II*6rFp)9Ll|_BST8)g
zo~yi_F_6P==PedpG($Ds?K8#oZS+D8MXLrJPow<Q?Wz}ahff7}X@i~}XuDt1&WN*%
ziM<UBFv&x&P3>iGOyia7u4Jp&PVaK}STdy2sKuVJNz=Z-a|1a-gs}#h^=yUt@C~|f
z$Fos`>-_3mVP?FSXTA*hZVrbul9vOGf%lkk%OSlRY8wYqGgx2oXueM`f@XqF(tI*a
zdXr1za4Cumy2H+Mg$2G>6hJdy9IwoGZkduh-VyLK{tKMIPK<3`&^HCoA18P&Td*8~
zWD86W2r4RTHEkA#q5XQyJHPvkduwSS@{3c$8o1DFxD3u6!<bCAP!3dgYxK`uij=cX
za1iW;wlC}@RUUvsYz!_&D_9#pt(j#At48&dDY4l^wgw#R0qc-x#J=Z6)a}fg^V?O-
z8JpU<IsE!XmTxK^Q+htt<$GbmrDi0}JYZTL%0ZHMWNe9($a#}(B+nhs>WiW}i-xGU
zvE-+)=X3*(L4e73#uqFW@jO6c`h1*$KTfBot@E1g$9;`B{7vfWgm{X)wYA4sIXkB!
z;=8?WFoeg@gaCT}i~|VIrJMH!?GNZ*3)7BZB)c$t;DN3-Y>R@qs`2#Y8MpDqR39tD
zR5iLRULTE7k8|7CL)$x;%L3tcG$BgWgdF?P&2DqgQyjU;&UvDX%45u@%tsv!7n5+?
zJA)?O=&}PV<=pe$kV$)`<CrfnmBQ9rsR~U3H<JBkU*V$_>drG(kE+a93WZ6RmBo4W
zNZlK*Gn)S@&GdC^`)=>6Z19V1vtuvWV_4QKEyVPaqsmJylFV@VPj0>$oKfIe`QD@T
z55MWV715d*flTpX_2oA-J*dm1d#!zUauj3t5zNDSTlXeq)5zj^)1xc*GDSTkb|4^C
zfzcVn5%EZfGo7UENmy_~{@pP_c34XZe(p{e`qUyFUM0me7JMg|##nij2EF6RR3ncf
zuk_;WWAsHv(YKU}0%YmiSYR<$$B)#oj84hJz!*Lspu2euI=yfih(iAwiq>}2&tJCK
zil|J5Ra&CjM(XKt)F$mOO!1$S7;~4Id?IiFGrNCYJCE6~$}MrJe2s`hIsQGT8CLC@
z^p=cr^BO!pzDA+C50_PD>-tUJNLK$w(YtKi{-ew<sIZpdJdI36E#nqyIT1qfoB+-e
z0PaHy`&z`$5RwKZ-3s4)e^Rr_ZOM5etl3dm(H-tRlkYc`bVb#j6okrSamZESAnSN1
zI1q~Ree(~pSUj<(aFHH(wC|5&boX$^m9s(Kg+<QvMKcfu_E{(az=suA2Su};iWYnv
z3~+OJbqbbJq)E}pU%*YAqm;qEXSsEven=Y{^myIi`w*l3f!sgCadOFCBvrgm_+l`0
zxdZ~r?OkbB?s}Y}5ha{V&Z`)9W%6e*h^;W%@~(fVPzEFDKv(M0JimKs3+<Dc#dbt=
zioy}?cSal~Zp@%+<-Mlm{^y>jxY-==eCF~NW6O+#P}dl#$H+!^|Ia?|StlEDp%Jr7
z0)rhow;#;aY){*kwvgU0c&wcv*cd;)pKC<wP?(os(%4-_LR7b%-FP0LXPvhzNm7qf
zZ*wN;j|W2lwFc79{dZ=xE|M46Zw`2U>550WseRQZ_xaV4#~Y7lSR4zjNeP!UTBluu
zCPVn5DKs9%MRw2Cu?jBX8%V*v=4?@*dlEuDtQ?>&tZC9+dpNBW?%uJA2*hXj(;k7z
zYgzr}c_;Ztirb5N(pmzcHCIMukcWZ#{BJ1QDqOeq&3x6?X?f1rb0_k$2b<+kaq7$)
z;LY`){!U3(HY{&M4?HPNT@5kuT!W%C%k3F)-PqpRE$4+V;86BbCPdMZW+*DGholK!
zFCUYL#-7$u|F~rVThJ@tX+@<?%~()z=hvoKOO~E}HR`7^Bv9p4mV9a<Dw+n{EZ8N#
zxdyxz@a+3flm*5OYk3dP84a2!%5P1I`0Qbyd~~8D@>yP0QtdaWu^QBA<?W6RF|sZV
zWplsw48R>!yd_4&D8x-dWU%38&ksxkgdy%qC(~V5l3Zr8gSP^?r+1CFuD?%`veQu{
z@EETq0DZIY@pBi8{g17NGbdaZetf={6qd&nlF_jT8@KEF^*j;X+Qla0nox!Yw_t-u
z@T)K_4&4XyiG3R_k0ULMlRSkir;n2R0>QW7ii?k9E6w)Mm;54jGDNrD4eri|0BWC@
zxyL;m@?}mX+L>{-V}D+~m-ZN3Vm<LZJtZV8-g0eHA;rr{RD@YuFE(l-ufJ&cnyZtw
zfhBn^LbO$B=5f1^Z&Bk;hKbg>J9zyPQiikA0Bq*j@w#Iu7uOD)?6GjVg4rawkg6@f
z4EO<m!iaeJWT8f;C9B7NUf2#4i2HT^-guPUP3DULE{%6BD`kZ1m;JNM<VWB=y-Uxn
zN-LE`Z&E!1Qy;!(+c1%E9L;XfT4VUHHYQ<)g;CbauXXlUt`Lg{$h1Ii0fcqa_Lbz_
zY`}xn&>vs%+rYd1h<edBI&J=~cG$tlH6V1|pL?f&l6fLD`hsDDX=Eyigev?tiBx-L
z@N;D#TV)S-du@uMsI|M`gyLVd2WP5-1jUOAcCs2DthE$taS0x1{Y{$c?A@i+K_}Mo
zsfX#|^2+jmi5cO)3OwXoBvfk)-O!q??gx?{{wh07&dI~Os7d&dvZj6aP7blH93j7=
zrehR>M}-W51$je*o5X8-<JZ!dw)^x@T4x_q0RD7)7TpI$5!FZOuPUTrNOclJ^4tH-
zHkU=8Vw7y%hi+j0!pqJD%>f&GZ=*;J4?)0{oy^R`txw{!V&juI9>oDV)QkPk`c^4l
zR`UK@W|i{Bl;1`w-aFU{Bp7g2(lFZDNnk~?&42ZWIb&$55wHIWm!e;h*QCKUiggJT
zT$z03IRns7%SPs2D#Fg}sx4eAY@5>gYT_)m*PXC``;NfI=(t$V;#*B`LyjrkxJ`$a
zLO)k+o`<v_T$<pHt8GBx*iwJ-Y~qLcQ-V727$CrZ^u<+aE`rQ8?0z`^vio`);i=cB
z&mg5Ce^q$7#K<C-;1xPFnrfDO7T{d$c^9a}MBnv3ubqnETY)s4K~|)^z_xzx$eZtt
zw6|axS}4L%@+#1PQ!LCLaT{qO?MWM}Jc%403mZxYizt5H^`Z1$4IO^;T?d7F8`nD(
z%;v^8W?rDYSE6ZSDHJN{V&0&`T3}|x93G!PSkzV`6E&-o8-sj2cyfQJ8ZlB|0<B?3
z0ah+5XOa6lqJKw|7)m+=$mwADFHg}1r>iiSL&>g4t#m^XQJ`eYj9tBvMR=AS>q*hc
z4g%lK1=OoP;jeW<-i!Z9sbGZ@7J0R9Yp2882EC6`&^q6?vKw|2bqA~uBNZ^@Yx?L(
zz*iWkMbhIhqHnvbU3NrRYO~tl2cUW*$?$cSL^v%dU4Wqc#VwFs`A%V<*ZB)J?Pp`f
zAk5V(QuQX)>+YC!?k$9GG?$rJnhzY*+g+xlg?uCpglU-ae94+=Zh&&C2U=ucXpE+@
zY<e-9mXX<#AgVw%oDndf%31*u`5-!ccAOL8JWgGc7*44d#fjWyF)<PtpDaVI+t6s<
znwr_;r`b27Y$oq0WNvhxGJ*l&XcrNgxPi91E2!_!7P}z5mhKDY9h#tag(B70vav@T
z!U;An%q}kqnZ1$KJTj$5_aTB7_G*&+UHkH;IeWfM&Es~RkDc0V*_wakZ1y6l*2Ih@
z$a_T;jsew#|K)RPvTA#&<{3*fgtbHshk1(X!@DMccYq-Q0|nCUWrICMV2J_Xovy=X
zmaY@t0W0c7p2V%BxfBd4473ih6Dx($P8O??l*7Nf<Y|+p&7{Pg89Ud)R1%g*XoEep
z3en{XB*iM#W?MV?*X7v6wN4tknZt$Q9~me5n#-(Bmzu&*sr^~4hT8R?zU@a-w#r*}
zhWbtn>Iem}T)fW`7)iUm&bY$Cto1a5+!s4@aW61AmCIXV)_J9U>t)gzPe!(544%n7
z8F@@BJAC`;a9*G+ee)a;CLxkWkKrrxX(92BBqYB37SFfRRy9O7Sxe*uDchE9Z8TwD
zvgb*51Okzy#+Xy`oIv#EOuYsM%-YH3+c$XFWb@oc38XKn+s^YTLKsQf>Jbgdp4Di|
znAu;u74SZ+p)4Jqu5KtyMX4K>6^srM8F`~L^&f;ox@C@7M{L}<U-vP*$S1JJ^enm`
zFnXpB7)S+iq_K{QefZDyUFRz!Gjpcc7_;FV7K|I+<#(_m5DU|WmL;{cENiIG<cGp#
z3~qpGjj{!9RR%37WAX*0Qg%(b3poQQ6cSxsjdxJcbIFvW-U<&I{v@h{h+9+)wIK6E
zwQa@ubSq!C%4jsDZ;$lPVMglLf>tCymX@-6?58ZG6cfMT3UVwKz^Oh#CE0B43)zQC
z9L`jY8r2?_kqonfo{!c@SQx{RzQjG3yycbTl}lP-OyGx*3Xxe^mZ)suv51_qB|xBb
zv=Wb)Im}c<aYc0ge(ng_HISgM(CzhXXoy!(UU1MS0}YseSAvE^%}+|+dv;1_P4Jw2
z`3b_5$FcbH1z9$fvaQwz{ai#*W9k)+6Se8%QNR`V$+u#9)!PY^X>(;gYi{4tUaBIf
zi#_Ki$JH|z9%OZ9Z)nkX??4XB;ac(+^F-t<wV$efqnMB0>Wg;1wo>b|H#~~oI&*!P
zV{m5cL|ODA?6%&+2iPDTxJ`#-nD~KVX|5Z(IoXcZOp`=OZrmV@jG`H?+^&J^pt5h(
zkb_H%<#wXS!l+COUnMxqwia#$NvFRhek>7Dr;^-R+W``{0!6^i0sU%~ecz~1r*t(r
z<Tsi!%A}Y3(0EnSO(gmZA?1!$E$FQyH`u;a0y|}g!*<$$l~Pw|uMj!Q$l<D6k9^Ri
z@1z_18+HftKf*Oz;kUKmA9Bj&e_02yCBj80sW#a#jqmYnS3=96RXvf?%@oo*Y!_~M
zqci+XYVue1qD%ctJ=pNX7{7Vh)U1b@T?Yfu*C}xm3KG+UX>*_6W6pcqqrE){NaXA4
z^1p@aXPN|MiWDxGQa+yoXEywrdhO>MuKlGJS$<qqYU9M1cJux3N%v-aQsaLCQvW6d
zBVYqVKKlb|j$YW*use+hGwLek`4?-!iaa3rGv#J6f}Xm{jN<hMN?g?Bvfn~?wZ%S7
z!htJqx0SZ$Pnd4X<>nq{*C|AbN_u28PyPzVPaa8$7ic@;>;2-G^oVWn8tHiW%hiP|
zqms8O`7ph!Dex3A)R5n+-c0IyLsV3r71eEJJGxK0u9Ba)^p;QJBh+!Yf%uDSH3nLu
zlHER615%}!f}idRS#HkGb3TIk?3{iy(q=CGz2~_kSk1@ZXO&z%nhL$6Y**;6kLWqo
zxwZ^(kxwk-EiJZDd|)woKecqDXIxIG0hxB&Mj?gq`3k&*7+0wTR);l;U&~N;S4!w9
zkTG5uA1rB=lNpuxv=JQ)Pc)lx{ZZ1_nPp(Qmfz<anA6f~G_7PE5MX;3vEaXffed!3
zTZjGpb)fllc%d(2=7TqLUuAcnoKyEa*t0XbiOM^~wm-@ou4EfjeZ*X2lm^&W528-=
zDk5CcF^pYqLeetg;Jy%Uu9of7R{GS7cAZa>lWwv|ATEk_6)+^cZc{fCY(t+_4Ym=g
zllHR0p*x|myB~M!6q-Rsy;tp<F56FydO*0N;b&446QoIhA3FE@dZn&$SCzjQUI;hm
zJP|b7z5OlD4da=6d=Y~+t6$GfO3XhIXpDj4=5Q0=SQ2tA%f>-oqk*np3vm$!1uLdd
z6xecQ$fnkr{7r7%l&<j39mxuoRB<?i$~rD7m3j6$gG$@;8WOTf7j1R->sEXe%m}r8
z9f<W8aaAi_A^!V0!w%8anVv-0b-2sr3)ky-+#fSSd=YWupCqi19*j`^)Nn5IMMd+b
zN&|uD;kMHPW>V2FzilP!+W7AuFvAtpXQFGO>+ZJ&p4qz&er~Ld@)Zd^j&IR{v(jT(
z2zRL!5GI^pZ7ors!nmZ4X6`;_I7ges$h5jc9><uU^qA~#JPDkF3P<$~WP5u=DK1Qq
z9ThBRO8`tB6|=kG0t{n~;4$hxbDJ#hHuL(<G~&fk12wI{?e?vqX+Zk`=ar_MGh|`R
z8;SKgK6b{QhzoXO8CB3#Dr_6JfMTp4_1=4@eI?VgG7d5!Q$ALR8}?sFJs#<9Nq17+
zJR(6VHybd)ES5P>?TN2n=yk5C&dka><7{mm9C)E8MX6(XJ6CyO<7*&rCQ@ai?u?(B
zNc58BrG80{R>462Ed~k^DK^o6A>ryZj{`!odzhYeD>s)Hp6DM~biXbEF<chJg=N+f
zqBL0tr5GSpd=W2&;Y{lwW^RZDX%V)1Ua9R+Y@ELEY%HWXzaf(J%+>(;^9JR;9nIY7
zrd3k)27iEYY-j310%R%_S-)Vv-=($}o>I8|#{YR2G12-n?HazXB#%MHJax_LOpL08
z5_M^~=)9;F#Txf&+>fEW_Bpk4E2H7Q7?b6^g1&3+Ny;yIifU{Isj%Y7FM`ha#$9gc
zOoVdy*<vce%V)x9+H+AN06on)Y&~3c`6KbX<>(jw+Ut~~llM6%k}qwo6P-Or%FGwa
z6B>??m5zP*iCT$SK|1m@<MxkX27bK)rHE|j>RuU(4|>UFJ^9ui>wLFCQO0l8>1!s|
ztwm%S9B|Ffyb}a8vHt8iU_K<TlkKp)7Y(}}NH+0wGcy&KK{qy=<BJN*?;hOH3trGe
zfy2-r<K5j`YGOtf^vaZaYm9dj<2dzX5js1Y!11)fQXK_)?Ewfn<Pg*{7OB`w!G-xV
zreUk$YZ`iVj_XWRjOU2Snf=)Nwa8Vgtp~kDt&NWBpiOr`)1?iU@bJ{PS++fP*Mlm!
zq*7#20j(#Z%0<X|bI+*uccHSSvvqX*55-~E$e5JLC!P!$KzuX&Z6FfE(I>-Wxqnb?
zA>BJCj(i!pQZCjpsW3l)cQrK1!R&16(hzMITqe0RdrB|db{mht$}lcs&1KRQJ9hec
zd>bfcir$$$%OilGU|V5@Cn*!j{N+w<%0UYt;^t2RUhJG1xEcit>4Wvq5Iol4!MDDY
z$g}T~Yo7LV3(v1=k7OFrP*7%yU5Q>1#sE{oZ;X9>k}Myd0!>#N2{!8)ollM_?NCT`
zNnGvq*AHk|WW!Eg?xnesK*!YEZh3+g8gC1yLK1{kFKj!d3YEYGQ5K9}zD;g)bjPb*
zTw89ObearT^qOW<)b@NXM?({BPI0=yZiZZDfv(UPA#ha5E6g_W^7b_2!uDrcHtOj7
zL#a?-#a>0f_(3lLAZ=5<QB1jHC1$uO5=HANdq)?fQ`lvDVIZA7NQ`#xtr!h;art8q
z=d>Lfk(B#BPd%?OIeT(%6UvQ`Gm!aOZlB^}Y<>gH%Zb_N`fR!2@UHF4R%+5#oI5sR
zL)!loxdOLOb=NIe@qrrzivJvJ-a(G_OW0HySW?a-%3oBko_rxJCL?zpzUfAzTG3bH
zUJNXlEeOkV=W)s&^CYZc+QXiM<|~*EGc{Z?(p0_+Q(pW+0fRGr77Ilw5pp}`y1UAL
z3|h?Cj3nJLX08RG_F6^QZ||uz=QJ|GUDW#VwN#Ui%{aV_?a}s)HOTk<HP~sH+yla3
zC#oemsI#L8c!+WncD@ef;Fs^G-k{TzX`RzAwF3NV{i}JO9J1Te_l7h_h_#{2qBmA!
zuK6`d`hj`trK!99Lx2^OpK$5|)IEJtxby(Lmq6F|m)2|Ao_toShY*6Bsu!c8;_J5m
zn2kf{PAD7-=emj=9C}~{m#e~7J@QL+R42DTN5ckkw9ST|hx-U@7+T+TVoMD}rkI6T
zT2Dkb&A$-fLS@w*B&`P?wHPi3X0|6h+*w4X$PZOzO+-Fe+Z}GcP4{nGZmAM#;b!h>
zc;gRlz7RtA5c#eer8I>>m*=EgpkVncN$4^IUs!*3r6+#XZ*$XYvL4se7Bkz_Hq-r5
zn{|4GC<ZR6%J`g{7T*}@EbDh}bLdH)^j42la-c}4<(eLws@I&mt6*9k@^acH_Iw^;
z!GmJ2t>fs&i0tT#e;eNOMHgRU8LEP5_z^FO+B}kSTX()V_XBU-AY-#VlWi+>%VH?p
zwr-xpz3Qo_wqT%q#8%HWEO)G%;BoMpaF&bhYaP+sfoIi%a(dkY{7yLN*@s~UZd<x#
z%8z%RN9wuHX+6fadR^&QVP~?x|M*D@k9G&=AT$(eP6ts<)VG7clzv_NwCDbtGl1Cx
zrk8ZLa-_!(`<NEFm@y6&8HU$oYg$h2ar$_gUkmW(8^Til0sA^;TP96qx1(bGoQ8i?
zU19;Ewf5<9QBBGars4En59UQjRb=0{XK8Pnbjb3`$L;%~XTRZfZ`IEBH@LTCbxE4g
zeQ?!`HQQ*pabMc90_QwXXB*gdOhU3xJTIlo2Ere3A`08PF>%e)2CBOP8&cxbT8M5d
zXi1vW>d;UT?=MkvdpriN<#4|aKb{9U5KNKFQO%+8=&5<LC(ZGQsT`QkGlZv4@pLuV
zpo$87*;xDQ2s62ABhz@LR4y&m^2LZrST}H8EECmc&}I~7*G7c)osS54JXi<F&jF-U
zqbKg=Ak)q}KIn_l{emCX#}cZXyMS9Kg5bV#){ot!ew^|=-9++JMwDAEa)rmM`mLOe
z3U^pXm-;MRYwuscJI}KT`TovsI%-$#b)iaom6%`wxnTe^HcZ8U+x=0`Bc)w&<@4Kx
zwF}3#GPr>OLEE38xt$?xZ#;+X<KI-(iwQT<Z+vg844Y4t@S8uDkW<eCid^v8{HRiJ
z$=m6LKy;(!TA*A3qm%i=Kgc<uR;_5kI7X`P0+I;3*?VwLenh?h>7Ld~185OUXBTqz
zTd!R7{t;fiKa%^d4n!Ln9>dUS?N80i``YT9b`7O4%cx6XN{8uj@?AfIK6@7I-3!|O
zI|&VLFvApr-c_EhwCmE-k?Dy%z4BguKg3QaZdCjFBFWLH#eBBOPL-0gb@95_^6p?u
zLE~xc#i`dQOPjUUKEV5%jVq833lTQj&vp%$gI6#^3X3?S{q{W6JR#BFZ@xFFO@o5J
z`>mv*{F?fuY7uN9T~=avmOoixfk5gF{XDG#NmQps!}lo>srxfqW=<d1GeUDqkHAtb
zAS87c7vYfdkw~%BtNCVJsJ&TFv%qa3Fm>z+xl8%D@SUTT+SyOEBRzi*UaV1o)w^%?
zFHENf>AsT_=D?o!9jegOWQ89WRl^Qa<?)}w66Zf!_C2US?K6P2mULchN|QISHua>w
zFsNV@FDqV(vlS?8UN5e+0XCe^E8Pb~3nr26=caR?Y(MMls_VWKqlQUr{CJ=8^k-Ni
z0P4%_s&Z8!h2qHR@uj^?+%)HaqgEXo6zOu5U|D8ZSXV8rNag`5v4J|%)?;r6DpwQy
z7Y4mO7-J%V&8GCUmQlcR?quRLXPh)~AJ5x&Hf%1zd|6&k_?ur6Op=7C+F#o0g1oP@
zQ=h3@I2lNvsy@d#<2pKbgEZsqo&_EGGy;Kj_DHoCfWR*S)AaahR5e2lRhuGm4p(ip
z%Q;`_E~uS`C@#(;$)*DuN4Dd>tA9u;k@<dknW~}Ax0R7*)Hf8`UMxD49JLeL=-^ks
zu6STK5u<Jo_%~zP2j|?Ao$Bxqmh;$^{V$CQFdTs^1jTN@IRgA&YGm%pQ_N#W_aRs2
zp*{8|^Uz#Myzo6V3~eA&nR!DmFj4!6q18EPN~CL;Est1zUYKN2Y8pl^@5#yqw%e25
z-<6B5_Ix5E&vy5ijZ1T!e6l)1SbV1l`0G+{zj2gDrt^d2DjfNVZz8Q2`H`46M41Z&
zaP6sW$DMw{({BLDFx$52sYK2~Ay&R0J&8Ij0F5}1_-fY0%BGTbM&qz1Yj1Uw4`&8e
zx(pOpcpQXWysV;8i!ehdN@L~@OJr6iv&>xv_@~VTW0}_C$;h#9=s!$eyKLf#f6edV
zQ(vfUc7;$Oy6NiZUe#i3JIvAJEz_Wp@{y3-EFd2cJc&TaOVg5)Ws$x2tr`dd-?j+g
zSH!kw<2#@{>Y@UtwiS(2(OO$#ihL^#*3dt1gxEQ@AJ(Toobw}~wV$xi?hGLOaQ;BK
zrSz&R?#k-Z*^fc(Jo__k+I0&tQEh-}#1ZL-${g2JUx@TFC(g__TDWfO_5e5sWzdK6
zfV%P9S<<virSwL*w8O7vHvy|v#4oeR)R?Z%8ecG#TITK;V_fSe8KqAx;k4B_;Z%#+
z#nENFCiG#4*L^`Ymq0}5Jk6c?*C@nO-2h;dw!L8*ej1hnlxFxa-M0$%f2~ljQ?|A)
zMzFg#ad<mVZ#jqIxxAaBCO6QByi=v`=f#u@BsP5D^m%ZzYNDX5xHUoI2Bvw}ihlLR
zrEHySKr$)KrLg`kJtqg<9HjEPNdmqU)#bk!bt<Kx(!cPth4ouhs>+O~Ma@B89J|`C
z<X9TI^z&sdceRdB++klon}0flL;!QYQ9k19tJFCn=Isf<_8+>->3n6>n<wOeyljKt
zz8$_>LPD^Qbp$gKM`uIzoW7*%lEeil`y=I|V%?;-S4i_+t3;sCspHx=`*oyE-FuD>
zm{=#B?l=SCi&PPRpdaABXp^bfhrP3LbLv)E`!eua?`ObCb}?kd!iR7kf6|BWtNH`Y
zy{NC66CZI^k1ze)d)JWO`1ME6kGc7`t3?Xf`;BR)m%kHYBL}*;H)+R2JtwQaS=?-+
zD3}R!7pcXZZN0Yl3a>n0Q8<<;mzCG1={b{>w*au?-0jL=EN+)G8u_K7uELQd!1ETD
z3VO9Io%~j1^;aWoX)(y|=TlWxrbn#1qdCLA3!ko=;@4FdZ(I6V{XBa#2nqSRo>y=^
ze5RfZ?GKX?jxIO9@1n+#1jEcj!e6^h+*R+!;iUjbCX~Xpjl;7yw0>@jWbN!Xv$rTy
zn(tL;LX2_i6J+9KessK;o-M`9;@|nU(pAG#g62wUpEAHQ0jXRU;X4G61y^i^K%#!&
z^b`98LCi5w+J`!~Li5~IuS3mDtI1arL+)hkn&x+Py-<5$E<c1IrEs%EVtxMxWw32F
z$v!g4z+2#lRlqx#3;cFQQ<h9KpMrIe@qn7u<2BDZQmEy-mI^+Uqtq{q^hg3%rA)_b
zJ>ajLpGr>x&y`~4ZdKOm&dSpqXtQCXvqM(`ImcbPnwM@(F`DFzid)-1AOp7Chpq=P
zQG{e=eVY(&TN(c|2BST`??)LW{wrI<2D^NU1jT@io8hYHpacPlZmB^!RbL4AY*o9R
zdao&S#?T#Irm(L3kdi?&MC5bAAX5sfheqkmvcRFD<{VIpOmETzXMgiRbEqfeQGGTz
z)JVGC&1?F{PxPnJiae`gA<loo9ls+UU%0QH)xJ_~H0o}CtdGj>o4W^XHpQdkgeC_=
z%_-bVPCb&?os#WBLDzkSaEE*mY2NTGgXEM3@1<M5!T4t%?>tJmp+@HA;YpwJx>AMt
zy39D<H+~TUth1ym{tBg1?an79*|>YlNfv6KU_W^0G2ORL24>dGeEAg}d_DF9Ca@#q
z;)<$8KN;$~-iBJ=znp0C%|LsO+JFi7bk!dl5$P}7-nDVhJ}(-U_^`4I`>1xKqufSM
zbXSTk<FMziUEC;sN6D7C5Ln)najZ@3%`Y_OXp2<jQJYNK3aO!XIIBdCQ&2GVY8l_<
zUMn<mZLHpvH$vOolIsh!fqMO^5vJjc?fe+uq~*)*xtyz;RawMQ${Rw}a^UAL-bk)Y
z*BeXM`CmtzQ@EE~+7a&#i443z%M%Rn*e7^|-5;324!yJspAv9%*R<D?4^7AxLgsBc
zO^v_i2zMw{JR^Cn?aL|r)k!$TEzWl`QkN^HI{k%%e1sO$2l>X{ia9f8(E4O|lG55=
zRa|jSOh`NDsS>=The(`NvVtYkx(-qst}MQ&63Eg{6pxL$)40Dqxf#WiUv+7eL45bo
zbf}t<5A%y`B(#aqT-t6%<$DnHyB^ONmIXmkWuWN6cQTK0FOxia|Jw`T&HCoDHHAJl
zSjT^msdaVLLEHXW_);)2UC0Fl$y;Y48XNq1nx`Es*MyOd$JIq;1eUz0jmvmWPjZLv
z+xcVmz=Zs9L5GR)==>ih+LlMnhI6b+E!P_SL~AzwB8eEC7BY5HvLjMW_JEUYpD;}~
z#_Ah1yCc!}+bCZue(cC)k%R&>CWi@bNmy*OTElK;<^5HwM<cBt&c%1DE>U0GS4GZj
zI3@T5O!W_LNh~9457vs=e3`o$o;^bOojq^D%rhRX-u;4IgYtVY2GkNgex%+Oz^c?w
z<Y5XXuoA@Cw3;JVZ}0~vjv-D<OU0!Ryg9c5yo$Y~8JB=OySo|^&#QvUhM-aA6nNnE
z`m0j!{uV!!6~>|Ru>Kd>?0)}%h)w=`-kXPs^=0%%#ph&MpL~L1W|F2<!xKN(URQod
zs~>YM=E7u!5@?o<S8zsN7)vWSJ~$@-xNjwSHxo>)4D?fx4CPpZK}3kFzJ1D;V#H$D
zmTt_bUvy7%p2lfy>+`83uX|e6LozbW!GmtpgPe}o52%?@)A&pqKXwrwt5x>H+XJ?A
z14I#guC63wyjHlgDu}oayItFL$#5uo3^C4Y=36b}q@A@|scd?nC3f*LC1(z|EwwjF
z!vuOT^?YwrOv>tc2>M$a8^)yVXc>L_b<_i72tVaL@D@EAY$(mr@#PYa<HJar6rHAx
z41^)zd%keIUbpQ<{D%XMK5tzFmPc;*C*ekr_1{iEH&~lEe<*Wj2~#3#<ZznmQ@mvQ
zMy1b_8rG4q$Um8xzjuzF$~3sx_I|g@u~w1b^ENJ>Fm{zgma}m%SpVm)aEp0t9A~Ex
zT9Yo(#r3oA4Ndr<)zd`Krh6^_r*E)r?Ojs~Q}ZhiDxlsweZUR1`m>xErvOnKQi#Ir
z6G7z>g(>svO$&EA90L?f6CO6liPee62yic1grTnc|MGnzbc?eVOI11>2wQYcqk*QF
zPLFQsx4jO$lIi_n)%pJ7M(vBVij<?kUN?C})rF+yT<iO>S%ruDkj*0uf&GnK5I7I-
z4)+!5y`)#b`S(g-k}G+?-R6vigc@dZti@y4NatSp#(0D!qJdlLO5ap?i)RmZ>3uQW
zz3$oSR$vTMO31p@Mbu-LTst4-IaGABcku42iT1R!#g|P!=cRtWZBN3e9moCC0&@S!
z_x=^}{eM5dYMk4oxsJXm4sZKk&dW<TeULF3G7t*$HlUBH=b;Utm?AGVePLtui?MGf
zo;ZZz45AWF<N=gz6-z%q4u5t|-$+R`&&$Gm)AVz97Rg%P`)$17E2r=wXJOx_SPjZW
z5u<fjU{F|b(@3ht_PVqGe)Pu0Fxy$hpa3_hlaj~V0uvx%`~ACG_IeJozv@(1nX`%+
zxI|D8w2+2m9#NmF6I8i!&e{8VC>1y|-`26=Es)4FrW?;|oaQabOf4C!_he6F(!)wy
zD&AujhWbfZ)9r%AcBNYuNnR7k8X4|br?k}rz8u~M9#wKVkqk6nAEuT^#qW-u&)kKo
zRj1a81pY4`v1?z7E8bm?^hoU@p`kb}(9_RyY{|79oeDicj$!C$oQHj@Jr6Eu-;$W0
zz;NqvJtWBQT^lM(BZ7cC5?RnxST{7Dm|tye1gY3md$k+P0`C0;_k`?3dD<#(Jz!&+
zt`rbgJ76;5JVA6BbMEHCU*-2|g@zN2Ar?s&9mgqMArgN~<O!8SDgzZ0Pak8>D^BY}
zQ&*aWY~2P_+Lrx6-jVmg(R!LA3O=<cuM!a%W{z9geQURlnP>y<SC6$!rNb93V-tX-
zH@NHx4g(~~@1*x6V|EQY0WTG6a^sA;SBuFov+G01{<5(Ox?+076nsFJx>+xhAaEtJ
zDy4yehtc4<jC~jlCobqnF`Z(_*k{)9;<EZSb?j=NpG&2hhka6eAJ0rZ;ABRz=Yf=#
z;|bs~%r5$jB63*>D{x&ADzNxYIK^vPN67Khc3dQ78P?P#<hRjCJu2dFWEw0X^XVx0
zQY`&%`C)YH&N|6)8hwF(K1;UAT>EkF4DHFFt&)I8GkQcS+1!s%1|Yakqd8FR&Nl-d
zh08zc=3cWzChmFkD2#?^R$}MTXWg1+X&#94hbFWqIvD$EVP5+6>oHzGp~=KMqps_g
zb<JWBY^RtKZz(@mq0Vim1NtU5vD$Uv)1L(IJ%g_ZQEAT9)D`x~iNrAo_yffLb6F7#
zos^b@ve(j(mX<#Ec>q8(v|s)LF6!(_5;l63OgLRDa+67FY}xGDeqhO!;GQP;Xdu*I
zAd!xbj5uYel>MVrSK#lsn1(?5+UJFgGWY$e<qK_{?~OhlP<l4A0$sxJJ_{QTwGn@X
zB%Grwr=|!{w{nse)Q13`-$A9+mA4#Hd^bq}hTEV!TnaP3XADqkT(;-5l;*BpZ>dtU
zU!YpLwH+IjlKT<}e`tNHVxdVT?RD%MS&;tsbXBlw>3PmRRJ4g;7(Ra24x{26!d2em
zIGQsf2!wpu7{@0xLCbyDO=%sg-|C)zdD6fg^O%&`e?ua=bzV<Av#N)Fg3u(f4OVqJ
zmpj~T9TDURx@QN9bP~7V=(#o;@}68PLCr&4oZBDTW1HCU=;6f2!*tbhQZrLIYEu_k
zucCsYn#j`Xz<-A@>q|YXx)#y*0#4Pcda{(ozhyj(ujPYLRVn-Y*Ejyt7GFI%7MrL!
zUY(t4+@EN<TcbN<8w0W&NLh9-T<XpdYkT`ZbXjh9bcimvq<A)A%g^Seps_fl`}E2K
zK07ss!-C({CQ8DUm&6Z1#}bQ=Y}M5vwMDLq_gJT4kG!lHot~4vC1c%d9J=v+m-K@C
z+&db)isdA$Khk)mIN*g2j0Gf%{F{pV|Nnf&(0U0_*e#>r9R3vtP-PDt`~=G1-Qf2v
zD3kj+It`QiS(ft7>;>*J&zm+jgMdC=Oo?b^rCD?4P{fqL4MUEePw!L)8RSpY<638L
z7|x<)8He#-rry!aZ|X1lVW(Eb-NPWJb$colZ(OM*Y1AYj;yzbw5_be%EaW-)!|U+P
z(MrnG0D0#cYx_G$%92l=eImrGfOc#}N^DL0BJPI5_H1Ve?O4cbk(1%lJpp^T2ufFx
zitk&}y?~6yeDW2A-4yCDb|=#7JKg@`E{d*SrYKa}0uHO^JV~Tp8bS2C4g3rBt-zC*
zq^mbN*I{>AA#9_viZamnh{;HjU_-~l9w(WuH-F|2^{;=J>Mx75AcGkE1mYIX+H$#I
zo%m`Ofp#h{DVdIFY-D~#_y{fC55nB{h!?$eRXBhWa4{ax>E$6U8P$EWX~SG+IjY^&
zOoF*g-zrCb>J%e%h~K3=a;v>69M7rslG-mv|GPHLGiy5IALP)p=~b$2smC;M8Ni^8
z>?vcngUl%}Rvi!Tp4F6}Cw*m{s^zA(&<+hFa*PU=s#Kw>P;i!v5TEEZ$%{`skX~<q
z)ohSpM;x!s|HlIl{|-L7s!&7vHGU0Z@dD#inyR4qvpPYV@?mD95WGIXGcZ4YFFt|C
zlIx?CRL{*u*one0v-HBksfc{Awe@S3(9H8`VrTSaBGPWkyCY`JUStpFzWNur!(BqI
zA~{~TJElTz&JrM3$%I#9hg4RqAR{W>GWaCYq~GYz=28rJ&-Gy8llJ-^9gEzD|N19O
zph4N(P7m4-FjS|h-n%UPJFdi*78!O=TJ7NG#JjT-XL>nNpv?d+EZq9rKl(U0O8E4i
z8Uy|SFzF{d;B_K(U`*_fMS1w(Yjjo0b*<^RGsQCV6}?F->VvL_adBX`Kb@>W-)!zL
zS$nN+qW=Awa0<(XXD7F_UPE?}msS7B-&>F9>4=^CfU64e$!VSMYVNXr5+`2US#$mq
zRfB#a3t=dIE$Lajo~y<+R6MXdZzQx;j{Jt&&rMICGIWE9C`=qSLR<yFH4zsb9}}<t
zC*M2kb(o>RPEH;u9IV)S^!D^8YICWCnNqG)8cv(?uoN`Jxx%(~WX;BcbscCm==_U=
zR=91&MiE$;!wsI!8l3r{Zzo>pN^uyJS)|eG-0{uw#YE@-*Zmt}H0uxa4Y47q6&|wW
z0jv$~thiSaRaLzELG|Cs{4kyK>=)4+J)z$b=WsiU!_dM5So)*BDA9oNqgQ3(c{lh!
z#j|xE!E2Opj2vl=8nLw!0a4?MVBXX2BktU@wEoh8QYYuLLJft1_vzV)P$R&#r1+kj
z-C}Fvd(eo#*0@=Ss|g(+WMj1;0+s-88jv@}<U@vJO3sX1*803-xf08~_2ejid@rlp
zGiW;{(043Twf4Uu`rA|;xxR1rxR7YdlF%58e-XcLXNRDN3bM*R@`bC|s@S?YJerm)
ziHFFEFukT6R{6)erEl_f8%6o!hSh&z$v$W>vGZH8XgsP}4DjEVz=rAC)jNd9ZRpK|
z+y5{(s}e+5k$6J%M%a|byJ^us)TqxIMa5+=S_*w#7Ef3cgJ<E^d4vb*xHyBd-{Yt|
z%-U)QWY?|v5vS32nh@f}CtjbeYAkduW<uF}I$N!?RPEOXt<rJ4ZW^u&s%ObtYWcg_
z&nnoS$o<n@U1IoH(!+qEkxvKW6K_^0j@)>R`)pN;(@6u@RzXh=qT3$!tQT)`|M6>s
zKi?ftV9)8$!CL4;A=(ypFfTWpjduo1sUCc{`|TjBMQnJ{AgV@FwzaWLOJ33xXac5l
zaG!;E_`&`Em<?R(+LQ^;VBsVRp251aAZcz;Z=K(zDI1>2LU%L#HwWf}#z&<}Cu^)j
zel_15sCabhzlg>X`_a{hJq(3I2`ygMAKvz`_|Nl}nvw#k{N!)ReAntJ)>Ozi@k>2;
zP~F4&yOK;*@^63@98iuZ@A9%-uu-YkWzbZu2lhLhomGef`Ci}r&y8S(-!T*%TIb-=
zK}zI?ZM;;snKUlq;KI7)ceMMnY}=Al)wn+uI-Mu;WhB3K<^@oH-lRlcnAtJiOF&kV
zLnO46a^pDhn$2fT00M#YwNh1_zcE+MS!EeeWqI%J<np7vNM!(PeP)A<nMJ#MZ}uD^
zvl5lNZG8)dT^$)tNyOtA&dr0n{uoX}Kmlr~k5PmI@6iur*0t%XSB3vACFl-AvElzs
zZ*pCr%r*vlTkpdov9<efDFtlpMMotZhtsOipBLwF*f-l2j*qD;u8By@i!iuDV2z{$
zrC7Frw-OkotDLN<_QohI7#c$5a-;u}>j*ftr|OAN1c2?Us&#3Mdn__C1l$_sOpSwS
zvc!H4uCwTSfp=N>g<N|j#79nn8K{j;e1)QRU$T(SoH(L(Yek9mb!qi0B7#}X7FD&X
zs|1Ms({=eLEn+d*VIz;VU;p;D5g`0Ww{0=Z4_p+>a&jGB>Fks?vSzVB($q3L`MvMM
zW!|;xEV!(%UMELVdBo}SX!jmb@&_27c+<b*eJTv^1n)I#s<Qk8nHs@#wQRN1acaMZ
zVuI>`biZ^+mo(l`h|h6+BANvFudWnvSaP6(oF_4a{o6CzbhKdI&n$ZR&LL79U@P`j
z%I{`G{6!9--V5v}qf?v%b=0zjj5#@*gchIlJ;vz2+>K_Tmtj(XyW7ym5|F+Y`3j9C
zij2NtV1x|&3J62nj55O1s3)WYF1S|>YZ|qmIQ9=hUOnYxakFLMf9l7-aYu{ag(Kp0
z(gw2|dV6l7NP7Ap&cUuQ(q+!}0$^fly4r7?C{s&Mtq`np$oq}&&UyK$A>fMr?oQlq
zFE9sKRrDL<l|@4mD<&Vw;s5%EQ+pn%^UACu!3fePD+=y^0`C_fzW;Niu(~6#GgN=g
z;s;mb$jNU9jRt-1f;uHqt&Lc7E1t6nov-Z~A9l0rO&VV>JO0)qFP(tj@1PpGh}H>w
zZxxs>774EGNl@*IBPP~JgKHf)9XP+g;H<JU{%x{8=yi*-I48eEZco38ZM>T8Nkyl8
z1Gp<rwcgE<crF(j8Jjr$c<z5IGx<ZrpUTS_^w8Ap+-JX;7}{!)Yu_H*=wcAh+Z}oK
z{rkaqwzgN)yYLfP>VJ%4DSr*v`1iyCu8UT>ayo(>{y~K+$O7dGa)3BOS{xvM%*E&#
zOX=Ttu1M_R$7{l>r2fTtjnw7RnApU&rT+u~ubS`P)p}CHIQm}VyVviAkQF~kBk$ch
z5{<LvPH!}{&X-x|uVX3fH7}B1dFj-j&H{T0x548@?*7YvbodpP9nxy*ZnpOPmv*LV
zL!j_8&KL&;$A5v^ZwkihRWO@^S@&gH+d|6f+|O(@C$P+t59z;3=*tpM;YR)L_qq^2
z{cgbbtO?6OuMWC_qshQC<9<JV0Gy<)|9LV053bNo#J?dn1I{(hY1H==OnE~1#<cAp
zmvtot!Lfr^A&9^`U)LHQ6Rz^cvtNFSd-jreY*fFLMVV^5FNvC%C&E#wgvQ;X06e-4
z8cDn`dSk**z0b_|uAp_`-THL!l{ofwej4oD5I<?TA&9lOesX+Y_`k(9;1G}FxY`ge
zA4RL1de6pvw#j`43Pmm70T3h8+l=CVMoCd(Q3HVP80I_s5?<;fmVI-v$_&DdAdENi
z{f1Pk0V8aC&`&{-bgSMHD{%<vCw}kve^zspwOjJck{ruxIkKk7tmGVWUXdrGnalE{
zt_a8v{GL`f2%9ML-`&C|uzM^5NVP@$S%bVX<TivD4n0fNzhc|rIRI8!p2)c6j|Jyl
z?eIyKp^S6XKM=YVuM&qM*{T`dRPB@zWt}GU+qELy?e086mJp@SvARU>grWN?S#*J3
zQ7#Aet6MijIsm92S%shf6jJP|*$KC7=<&fJw;Jm<7MjaA*AMFcDgEq&VvB8lI|V%(
ztq+9i%9fK3F8$Y31>a_7*+Ep5OFeSy|6r?QkD9+MiT?JPtP*U{`Y&m?Lx|&E4_J$i
ztA~epSJ>CIMu}dfYhvX0u!m}@JFt(=YWDOyhbB~hgAnG3fDGEjVzq}jKmR6v&6mV0
z<X0@#hRdW|o3LctbYK~|J%p-H&qbJE-t4~gef1A6JMdDs<wb80$MOHU@hl&Snt9H@
zQt~2~9)wtV$=I)377$=$jbrx=g*||0G#f(lWuBGuK3is66ZwN!z;hXvRJ<Z`+*<e=
zD82~XX;y=eCwoFV;g|P9z-1Mc*0DCeie6Up=-<(rb8FYu93lHcT1q)7yT_F9%@GHM
zE^9?B>U8A(pF?ousA;xs^|22ax{Zp6WvtKds6yX_VRk{-GU@NIpj(M5-R$@fYUa#e
z25w0O!b36O6*hb{EUAm}-uJEV)g;!EO^cElM4nN9|1V!!0eBbwdA#vPiQZ7{)C&Kf
z754gI@8U@B2N_DJBewJ3RY2*%5l5@%*|wfivl@T4D}cXxIg$SHU19i9qRZ6b(NBxs
z*s({}oP(~?I33ED=D&~bM6ulXrD&^M7IAo8lL6<|8F;3C5Voi@u#~woAoPoc9c18L
zwY)Twz5`5}H>71Frk=)lNLjHYwf*<ls!4c{n|HG!gsn1W;eV7~70oJ#gKQex2>%H&
z-aV23uxI4Ka0Ja+ROfea>v)&X_@>?0*v5e#KFa$Tk-LHSSSS>+81Kj!2-6&1&k$0W
z1XOuxGjL@mela|RzrycsY#jML6<4e_h=O}+EOUZwfnzhCAUVw%ssjH2K%4otA=t!h
zdIQsL%9<fJ&v;@3mv)<2et%Ak{eN_zbch%k5&kzp{if00@SHw~f8xcSzItvP@LYXH
zQ1+-4>9TN7?*L)|5&8?^HBD#^J7{jD-yC%<odnme3Bw#%#Rc$xCKha(x%2tAYgXqz
z*DN+nO<Pf4JN^epFua?A8q5RhyG^;QF@1ot_Qs~cu)Pm^bpJ2Dz62V|_Wl1Yz0qc<
zS7e){sKm6}XOv13l0w!bk$vCBj6|jqlU-Rxh$M#W%NSX*W#6}9Y=bd|8I0NZkCu1+
z{{H7aXFQH`#`E0wb$zbS^|`L+zLk7_=^((vDMw_pkBzb(3pKdv1O)04?ri1K+$J~4
zhYTs*&XtiCx+{@eD!NU{31BobC<2g6G>t2j8w8YMm=A~U4)q4*XLB+$-S}z5FAZi@
zNkF9=+`$<u5ayr%ow%Ct)1Qh|JAP4s-yH!@2^;r;LXXP;3R(G~KPgEH&xf$*gYioI
zabc1nFRDccN`EJBk&=UiXwxQyfADY9wfW}?L9yV64snkmwh*_+kd@GzJzDec`BKa%
zXnoU?f3QRi+b!hBpr<%9DZU6TCGQ!i?HF<d1M)~-_p3_DjV@!CoJ?uY)Wm73v7#ML
z4{ha37hOj6yn=`bS#DS>+zrQ=sq9?r;*2%hQ4R_A{Z#v>9<iMR?)R{l-ZK;Cm3rB^
z&1XiX)Zj{y!oJ71Z()mHbtZt5#Yw!PsQsu>K9+afz7=g(qnIBYhSi4zzK<A(VS&B|
zSi+I&)nkdoJ%nS4)XU#<&nC~HwKr>uf@3Ymze9xpO?IRt*mG=uXHC<eYP(wLu36AY
z*z`y-S`11newStiQJQcSRY*Cqx%_AQ-oGwpPXw}9Dpw@=uS`v^b$zKne*AeUzoW-P
zx#TdeM;5-}U*SW%yQkE6oArX+)D%-hZvkw%|2-HbVw|__lfj1`D*iO?S?le%>n)bJ
zlqP-ag`v@>Mq2iu0}tH)>__>>#pyhr=(w1a%E}#dU%JQ2f$c2I1c(EIUUp(SilRwR
zPs$KW`5$BU%0{)He?w>FPcl7rY<#$M>i3IoU+l#qj`&~&bBQJLot9<fmxrJ_zqU{L
zv5Cr$&kh97`G&Oz&{{ccts6*XbFR<*<QjrH>3KX;<(Bwyz~Y{RW^=U?{%yL-WY-V#
zcFFNN71t_a%goZg!+F-~Gh$T^u<*dv$Rb^VbOEjzFRBB8gLl8rLSUeFwFu{!^$q~9
zgoyks=xnn45{KdQUNpOEWB`f%zgI+c`^gEntM&JZh#VYTJYD0>yrRICXkw-O+iftr
z-IasefUAdNVAnlSZt7*4((*sj%_6h+TNSQP9KnVTyL9#b4DA@)g2G_05Ikj4xf}jv
zC6=lsMJ3V-r!>;|{}2$k-;v@^Klk1)s`Zya|5PV_y^wT0C36R_hu4G64K7>zVMKU1
zJ41MNzptjNMC$MSEv|~6+K~ew-6<X2@ojDrf*UVpt1S+u!-X^+4RQY*+lKx=0yiFU
zQ(6zm!v8c!o(q9_&R1xKg>=qQRzbH6j9=M4<P(d9J@ok%O#WdsYTH#MQ_Oc8wi`F!
z&`L?h_#g+84U|rGcSeMVUp~Cht~Ur#5?zr;aD^kh5ME)N@#G&PMcM0#P76-jkM$>^
zlzQzI7zg|mnUPtJ4ybN=;HROom}Y2tXSQPI_y41yrMAYi1BI!ZWReK#_xy40A5il7
z?4uBWcX$+pyY&lIrx`d6`m#K6Yi^8_&id7R-sPFn+bCT;uGq15*eB!ro9%=BfIp=f
zqTs5`c}5JUaRGA<iflCcB{;lR%jNmw`buItpxHX;J@P(h6AUGbi`|gXO0Fb|^o><L
z#q=J(`1fdEssBSuZWIsX;#SJH_YTcE4S@g<VIME{Gw8ZYpU&+d6YVpGcbrF#zwvL>
z;OA+6R<(6sZW6$sNxxT%SKWKK9!E18>9>UnsQ^zhT|Nx;PTDXpZflkFkpfcmc06@^
zhdu#()50w&YyTMk7b{Y8_J~Zn+h5^sf#py7Xo~Do<!$+BzPhIRi?RH<{68-ONBC~(
zG~?72&tz|ANe;TFimQ?%-g+p)9<isi=r?-y%p=%wzdZ)JSpgd_$eU)B^q4Frlsc!w
z-oy4yR>l6zH^%B<`o%PD4`YMA<X>BftZduvCn?nD4peKD`w1EUs!OV2rTF>?*B0W~
zT+)iK)s?t+a8#TiN(AHCZ}Z$7CFK(PpD;8F*)kzEWBDkz#&>+_K=A~_xcX2=?x+4`
zt3QA35Zo2art>rV1K{`5Ykw2l`JuhX<{y6XmyZM{4{TGCrPXJKFZ^)b>L*9XEoLK@
zG8Nf#Sr@OF#SncNPZIy&efv`q|Ch&JzH*pOeU}U&=M$~yQ>Lp_d5Q$eBYZapEE>Kv
zB8ty_IXC^%&GWR|)$g4(x0MI<ARmB;+mNS3OjU;IZ8^Yu)7u-z1Ii*GO0tMq%Oe$+
ze}d>7&pK9(YlG+^@;m$4wWNxZ{nQl?n2qrN<s*x`js}?bPzkDDuv4hSY`C}vcxn>1
z@p1Yx>L;6!)%f?#r2KzwhOlu+!sM5|eB!&#{@pmhQn8TmX>VlAPfGKzmHlnkO1#<t
z3YZ^&Sfh*4qXHPf5e|dsQark)lSKn^(+au%IR^8&Jd78Y(;x?r{_v<k+%dkjeJ<p#
z`}Y5PZPm74+HM&DuiIGWHs7dDNCNsaMTkDu<&6KtOIvQnN3oP{x1|^2=wFQmg*&>O
zOP@?_@veOi#a-&5VPe0;&z~{%*As8Me0aDW>H+)WUYsobJF&O_6NK&#rsS7xJ<A+C
zo{Xk+S~OhcgsO~{Hx%s(Fds>Y1SDA~F*Pc#b4L7-L=vMDvJ#}z!Zmg27((-h?E-ny
zaq(H8;@8~Dj6J!u#Q7@R>?0Wrgl|UZUzYVtxCR|)T%(GcSu7>y5H!E|tzIDNZX_c8
z9pttISsJ~hZx3wo`@Qsz5yB?ZMs;XRF^)f7qF-k-*VOs}xy%tVZykG4t)Cfq5zevo
z=}hE;@^>q$esbislhsH0(+G-6id0b0vHuBcfqeUUm{iF%5bVlPj&ZBg{o^Pa^fcCc
z@7G6wly^z#N$LOK4UOSjv(5uN`C04d8oqv|R<pCT03lM7+q`;O^&ZL>`M<sCdJ2u_
zs0ySj;7vB79eR^v$Sa`42qe`%lJh)#+phr&M>}mej@5*i5mJdFesMhp;cPXqKRa^5
z``UN#aGhNV@_S>tX&V>m-buL(p6cc%d6~B)ueITzre9<KoMOKlhlRzCULED;DHmr;
z2|kpZ(ANFY2Z3f5UJ@*7yBlL&WpDm}+4;jbH7osZhWPl}5EDoqH|oILO$@uT(Xo9o
z5K0ONuiuE^q&f6Fv4AXWApk*9#AYK3wK$_C7u+G|ONw+9+wzA+ljzBSVw&Tx2rw+A
z#@-zVKhyQO@8+K}-O3KmTd+m%ZX<9;gZ&#G?2tm*rOQ&&<saoan|ZZM*6mO-?#T0%
z5q_}D=N)PGKaE*IXgh|j(&z|cyPv#};nAKSuLF(-FuA85w)<uQxlACY%EW*T-7=v8
zw=Z-8%blZ0H?4j#7labMUE;i*NXTK{ei$~XMb<kvdx{t*KaWCbI88~W{(=03`mfd2
zclpTgWb6r5%9edfGbU(xLJa5d(h5(YJ}KLfI4=m;i!YJcn&8UfapD5pIAScawEVH?
zgT0;lQQ=GJ9z1r}kPX57@44^F?)fQr{~cSZzwlq*NIY)X9^`>xj10G@c~mgIttoCc
zB}d%`JCt!sSK93H%GFlits<i4f9!vYseL7%UYO?Oz!r>4&M`qyMnl)HU}3*QN!dCm
zmN59-!&5f*Tc2P>F2(wUs^Q^@9LL$&RLaCes+`;2r74)KE#<H+r-aRX((PvdX`8aJ
zafhp#5(;?fp7n)~G5|K`<*R}nG+AT3#5~<dm2<?{#=}3LPSf*gNaXq31`_@s=gud|
z;6BCu+w>Vb1933%hj6uTUDRWJ4Rm5F;Z3xBvkB^Ti8;JY7n5SXvI{d_l?KHMMhg0R
z5@^=VE$?CkbD5a=v1(3hIww7TzS$}9naP1t5#2+BT0fEO7ATy4<YbF{Ms*Qnbm+cj
z_+l*aBks;z*_+ghl`91mOSjz_L)p6Q-MPw+{*0S!r3>MGMtfzUlOII&!h-jiTb?*+
z&DzHs)ciSE^j&Iqxv#)Mke@K{;&XS;rQ<?KcM#J=6mltSmQOUF=8EmNEb|w#YYryO
zh~2{EB)b~5iN#LtvtOFB!fLf~zmKQZhr0BgDMI|F!~0gHBV=GvXlSC|qp@w9xxo);
z{4;0h*yLGRqaH57th8s{R@Hsrn;=5J1%Fk01q5z?zp=WH?M`UgWc}EpsMfVGb#$R<
zY?~RUE|<2Uw`mG%Tx29>`;|GTa0+Cpqq`GeyGj~vY(mW&`G3{}sxR^9UEKdgK4~iO
z74CkzHu<rlS%Ba)!0!Iz-5R^Qk1A=##BeE>I}jPx>&xosd*^5TS2>$yN$`a!V1?s0
z$ED7nuj4zBb7gvb$!S{x*y!mq-Sp=VK3yBA+7{q53obNuKcFKbCX^`&C{wxM$f|SG
zF>t)8$jmPF5BK5?PqT!H9VsgFOh(FABB5}`dE?u>pMOV#*?i_Og2M=dR<K`eKtFbm
zO$|eELkxiZc+KRcjB^$L0YAxLPX)a^!+*!c*ZkYafQZMa1J>)6(h?Kla+&RBDxe3x
zzD|NXDz7`;RVdoxmfG$d+yqYBAD$PSPIiOvO(%Pyh^c(zRgui*ZDr`0?{ZGn!uIVO
zrx|Y<otdkWmEtmoRN+=qKaEL9VaEzU_%n6M@mr5f4=(Jjj;`lePgJTYvfEu%U>f!1
zu3>U;D%XonZ>{W)?xTJmh{$W_2D+vN-}zl3E7QI9n07Nu+b8ox4+Wg9V$>hdGr4y(
zB3)z&-=dYj-dprslzKJMjYl-L*T{ID`0cfwo&7hP=TMi`;2;;HMcXe8G6shYphv=U
zv{iKjV11K$Dt-rZD_z8;_6mS=v<J!=+A8!F`&e~qv?MQ)%G<KrsZb5`IwdjondZ(1
zxy?)eA;5v!hv^*J3n4cxDgHq$DWfr{3T?>EGTUO5H%D&U9jNX&W@}iQdyL5@+-f;C
z%-J_@Dst@wXEYV)Hg;7-`2DGw?;=z^gRlV$nQ@}3-@~dJ@W|_>ovur*`Qt_K6yZu#
z8Zj~L)T#Qs`5O=S+ZGjNZF7t`dnfiqnw5sge4k_W+RVWhuVupDTV+~a7Hq3%zEtcq
znrUknw?E>@9Rp-t{LuW9_J<;G?@UcZ+C}f%X)JQ_ert%BZ4ApwN>}}{%A>1OvL9cA
z3DWPnhn{8>^UA!to(dGy=+($<yPc)Kb7-hgK;)v6`X`JwX9Jwz$KAK|XPm|+pvHX4
zhu?b@zu7tTHlglI36JB%FsV<bDd)DgNwxy~;IQe<UG3bii8&^QguF=R@9L*5DG%?o
ztVfF16k8g~+&~OjIXHf(4Jj9UUjNLb>GVw$7)&3CGC0^Eq6=|M6*6qE;^|M4Z=E_N
zm;E*0#^U9i^o4EKF@a^b29I{Rj_!0ADsRb3<4OCfd(F}FB=`MIRz2<feYP;P?U?8V
zshdeNA|;Q+hV9FP2ikTP^5);G@FwYk*OKcpT19RdV)xk1OfFw6To`$lV<JCp6(L59
zSK8ZP4o}YvrdjO~_L?VZmM+d0=#d%?md9`0RG8U2a^6u2JR;PvQj6j3Eq|40od{H(
zjDCFClcaEye^4i&QAO*IIc?=XhIwALAW|NA$bMA){GqwQO566OhMwb9uyZW~(3fKA
zoG=CXHjj)L;Yy7HDl46U9nTeh(WGz3{(Qvu0o1s&(D1B+M)#Uj-Ho1`8drDRh-!S&
z_Lp?@E2!;#xV;VFujsd71y{3XZ#=&?bxGV@Ltsm~N}zPKw9_9G%EFDqRST^Otp*FN
zqNSS;OlulY_x8u#q;6HJd$PZ+zGUpb0XtL0#YN{AZ}_FWz@9$wo;+c4de`!}Q{5-~
z%>=|uSiaK_+*h<I1r;0=#xeFSLj7_ciify^RQ9(B%BlyUXA3^Oao?4z3jIvZg>^nP
zOkO``zFzHmcy(GR<Q%$mhr9IM=23+W#;lo9r7<`>8PS3qe5rwAH%=wH)MyxOGENf9
zS9;Ln8QuFOm*DH)RDD=n6^$nh$AY`<B%P9ek8&AuWiAs8<>Qrd0Q;@I*PiuHINJ>A
zWF%}5AWKWxCwJ#SD~o2gRZg3>RZU2-NJpm&Wq7|JN1j0(40cJn_U0I-^|?iQoo#;1
z&TgN;A9JpdS3zZ<*aD_1(x*eX_W7(7GnezHvXfyK!(X7Q_c+tbWI5%)s%5*IhK=P)
z5A2sB4=o-wU2rv8J1Bb)F+I+2vMDSMw|#s+nPmE2BQemPfO>w`LZY2@x4njd47FU|
z@4eyCrx<63DBvv_CcZ3^OKX>dGIc5~1;p9)<h&{~!gW`3HgB<)=!>`2ETb~z2Lqi8
z(J~*d=$*A$pRjY~(=qTC1#Z&Ms4!9k7arZ#`-X*!+eIm4W?GrZI)Jd_SMGeQy7;Nu
z5n}eB*SDD!$_Hh5`?S2eEBYzG=R|bRMOfip8k+$+67fZSWpy6guxt?hIHDhM)f{Fv
z8d#4lZ9nnHmudO2S0~<7e&KTn>Hl|J=xE>d&oC-Ip(of*Z$wh8Ma?2rxHJ4$oarv4
z^i4X1fC*?<Cd5&-Do|2gQZ((y0l*CQ?C=^#$lZX~!H@xBv%_xM6?JrKOF_<9lc^Yk
zE~(7>i^DTcZfh5bx3iH(tkz$}9C~EN?9OTYrpc*n=Vs1*G!+Ur>XyqCQC{LE<(Zz|
zd!hGz2Gqm?wznPaopxY&*TiwU1#Mk4R&p9=o2$H3LqsWf*5zk+(o22cv|HXA%}F{t
z>eg`wWr8yfjc1H23ope^=I!<0si7GDHluB==&PmT5xr!sJtH+Of}==?G7Nbz{pAq{
zg1038Yv%*e>yxuQKCdpG+SI;*u)f=k(1Jf>#;&Ve4}|SMF*IjTOF8z{vdph=rN0c|
zP&)~b3##*8q}UFX9votq`?b9Yu`v97autntLf3vq#GD+ae7QXWqjgn_`poDiIu_M_
zeqd&{SiC-u2G;szQqA(cv<6W}aAsZ(T#K7o#5~cg<X}a2@FZ}uhw4&W;#}kH#J=Ii
zxe>?0+eb8%WsA_&sSvd01dEu?t#e}r!`o8jYX=trj4X?|#;ysz>_;yZ#0-3WKfS1o
z+*jj;Nps3MqYACo()AIGecwhg){>e?*nIj-ob&Eq#n+{SFgCJcsrk{d#3N`<uP0V_
ztykgBL8*#%=)Y}4?QaRexw&MkGfA91v?;ZYFA0@B$iN(6bm$Z|;1+0SvAN5J;^v6F
z%UFj+f5V27+>qn<K}vzSV|b&V{aJxJ%4fX2?^@ddO?5}dUJ*@7iD+b%UIK+9#Bz3s
z-0!C6`e{X6Kk@jNd8b+vY|Qa*UROqG2F~^O4vfrx$+3^~JyH>Sqo+Un*nGAdHY^RF
z*1t3rD!bnG9(Cp}(`4I?%;Z;~#M8VHtRp?Ivafa8j{hz&SnB)x#q&vlX)4>EPOjSL
z@YH|&+@+`?M7SG}B)R<FeuGyd%pkmJ|275|{!;Mb0PZUYvkumIb9zq^wJLmAhs(Gh
zRF4GuY2QUC8jd_Kkcv41|E)`q7`qA#7+r*251vFMo7p>kdlMkrrc|@`%5lHc9w0q5
zrth#0IzScwNHn`aLVz(JJ=<XjC$_}jlJZtAo>*2EuSPWMaj0@}aa(P$T<XNd-rhIh
zn<!%|aOP&mQ$j#l&%>-Y?)<qbP~kiJ%NZAZR>WPE46<6$cmVlZUA<1Qoo7qGcbO73
zyZ^!BjtdGeYFKr;`RiQM!4+IUXQ$d7FAQ?-p)Dxn{i8$S$5mk)o~7$NCnP^fe8Nx<
zdw<iD))`eA@@`E;UypV+S!`2+ikma)Ro4q5qk7vXCNZcl%bKZT2`_I2&ozWKXoYjp
z8G^uCM>KD3V)qPwK(ZmN{M54p%;XE}F|JC2WsHo*UY?keePmUpg^ydAaJw-J+h5G-
zknda=Udpr>iio<)<e+DmJ?QPTvxjW_b-8fs>~7n5##Pbmqz?y<sK-r2?`f~~adnfE
z%Z^ZtC}Xsqy&L2C?VuvlM59d@cke0lU{2m5c4=X^Xh7==1ro}s{&81q3sguBJ4cL9
zrTaV_&Wilio$)skclB_udulS6>^e`RaQK_<W@0#}X=K#hbgLsQ$-jfsU)xC<)7XlX
z9)4H9Z;-r>k@!d7;2UdZ9g0a8iu%>-$`d%Apt0Xiy-NJU^Og;s7KSmZ!Ynu2Pd|eo
z^pI+?G+9CZVulNVRPF<8B8dya3zv!%o|}VhDqU~ofZbwU`FI%}xxS-bZ|``1t6Ct2
z*M2U4nZj6#awT1`NmJ@=%VIn<^`@)bd~;s>fYkG#NAMlpx(cQOv6A5>edh;&Nt;gW
zahN-drB^glz?69Ej`b~?%=@$$`(W`{Tzr*P?XcG!(^1rihTjc`3=sX6gXIwu5YLvl
za{h2#_DfeIgFzYT)^ohYcB1Gi@#n=3^P(?goGW|0j0|Y07vhy|(luMB)C;S{)DMq4
zH%}~=3mD-Rj<$%}BCI{7Zz~>(vv3bN!NhO+zdk!r;I>jM7Ml~PV4Qk5LH(Rp8xGEU
z!ZrOmVYw|RD`g+Ce?X_L`gEdiIq^7p#&fMqIw8@1p5^vnzY5T9#`I~Z4RoNGT%D~2
zM=%%5_mtq+GL<VjN#CM3KR`#5Caq>H<`qt5t6Wu>uM9ms+Eld~hBUpVoo!k?&3XBP
zUR?XRS@@7?SQ!=lRZvA|Tt{HWquCG}-u+1DAWR6P*A|*GGk@16_lSn+L($l~f%9){
zCbjgF=wqyl7qe#jG<`Jg9Q3rH#v*^Ue*Rfpd9vf_j@v5IH|Q!2zEyQAEA4}g9CcC^
z@qSB)KLN~2-qc?_?p+qG+$=a9N;#I`u$Ucn^%{vndpv{;DgZ_+hgy*7@=MITY3Iur
zRRzp3toZVz?#35_Z{^Q|Kw#c}zRiaM_Xfj`zur*l_P=deGOrzjHO#wEl2XsqJwkUH
z67%TvfSzUZh+XKz5X!%n(_HS$;EZ#KZ-OT?)1Mm=PfV~Cn285+W~*?}7=1JDxm9Q1
z#7p&8eWp!@6F(uW7_$#mg+t~~Iy+LzN)I+%UwOoQo~G_?I5v+jd)y$G`EZAOI7O*v
zsKh>8MaR^hl!gz|HO(|2Bzt~L4iOgH)(?d=pb~^lrN>T4i$$E~j_5>8#&6F&u<zuA
z`)A&;y6F53dRxz9rF)J|i}h9vryXCO)af-enNAOUzIWAoah?ycPR;!av2c%Q<g{dE
z-lXni`F5(8k`UO{u->G}+c!}{$0c)@3J7}(WNgi?njOtn16|?CZp}BNJ$q%H%M}#c
z-;CP~6?P|OTZQXH7tFaoQoOKG9U|t48(RNW()d%SyPhJl!;k69H{2btOIEqPzcEUM
zg#D!9JKyHMbf-O=846yFb6uhNPORIO*p{5#WJfYCbNWEi`#ACl3tUa+ng@k->+tSS
ze)CN$Lj;M9kNKs(q{#0wvbfWeV2p!cUUQ1cFw%PB^h%;TN7*>nu6p@FZMlYuxW;mx
z#9~-=X828vF0JUxdW=DTN}&nbbKijmD`#|~j)KltkV7o7l^l9*wkbY^b5QmC%^kyC
zgSl1(SmH#)r^HB@crO2|H>dc$<ej5}#nyf76RzZIcjaPJ<#LBQZlN(K#JjVHnp1DL
zSoXSQ%HGr)1)FKSToD}&zc9!1^|ftP(}-QD-aU!1ijB{jevz*{BOO$$?gqcroH)*k
zJyN<4*kAOn@0@c2*x1@G8C*8xzc{ZxIQw|L<^ly>w2Rme3pU(@9s)bL%)Dbuj%-%j
zm##7n9MdWF4mVk<vBK75<C^QUpxt(@ok<No*_}K+Jx8sGIdz+5jOUuWc&GA{%J+@e
zLN<7n{gZ@(`&#X_j~ycBocIFxFQIt*L?Gg16ychpAGmJqoWGOC21U70;pjs;{U|Yw
zWxX;|iJk+l9xWJCXAD(-#+q`M^11=lm^#el1*pjMQ@4nla;47WRqud{BC~~`P*cml
z3Wo2bQ^rntwAoo5*^El6fbp7VmIJ@V<q%D&*+Pg(B>k0w<;?i&8`>D==eyV|b*gxm
zN=~;@mJ2t|q(69<#+_8l)?ulqq~(Sluk8H3NBzqMCck$-yf}FfF(fr@XmaS=g3{+B
z_6|=Se-k4md+m>k!o4Uj2r1vWE6o&|r!%6Npg5br+2!_xP7C_pYUN4?mP_zP^urg6
zrnJ7>D)fm>8?w&0RK>i~CQ2t+dhV-7%7JqA>)SPz_@36~U4Ol|G4hh-qt{<{#3+2;
z8^9-ODYZAX&Qj>oF0M379ut>aM}!3|g<iefurk^iCZtv@wEbbXgGWia#AtrPN)*Q&
zos<0Lahb(7SszVSE6K!O7;%vRU!>94NlKoJzPF`U&Z{0*p}fm?r@Ccoo22F@8?lBx
zM+NW`V>0LiUS|ANd6UcdT@4<#%E{1vZTZ!?+EK-t<<zr%sRvvM1w$3YjJy(E4GM=8
z@A<O9bNI<`+yDA-+&<|9aKkK;-0XXCA)u-(c3koeu}}RzMrfKgjc7tk#u88z;HHe{
zVevjgl@8TW>CFQ)qRe9d9Myawti!33vTfTAKDFPr?GV<yU*>G^_2Y<w#;HS!1qyGS
zg%x~{#>5R+6pvaL_uJOUlzx%T%!r6a%P76r7>#q{-Mr{!T(vw;G_mo!BKpqP*ZW+_
znSIX^mE_u=$&Qs&T0sS{u(AB^h2mV;BV}|!sW+OM<H7EW(%Fsw_*s9g7gcdWg*w$8
zqR{)mS7+dDNWRldAwAkA*bvN2z)!Svvq}3<8;#BgUBj13f^G2SJ<SoNGQ_x&yjA{o
z9*`0-0na5HUO|?lpSrDdBoWqDP@AvH@B*Fs_AJM21!8e%8R~02Ureh-EswbL6^DhM
z>Ce{}R)uMyw|gxRB>y&xocUA(ZJ%@m*ljj-O&6OCj`2Lm;XO3zfK4~tI343B;;xKU
z;Fs1vBt0*%HLh|)mPNQ3Z@nO|X$?czOBf9d!da(HUK#ps#SZ^j{O63mRlBcl#Hu+2
zsTYQhO{YG+PzMicJGZbVb=cVT(9Fz1Wp#4-1(yDT7_7$Fqi4k9vckEwdUkihgQlvD
zBA13yz+Q`roKw^MHW|FFEpOHk&Zhca^ZW4IEQt}L*{&@zYo-G}Msl?!HDStvHM>^B
zd%WQ?Bb`ImixPm{Y4gIB^kDrOe!P3Wmh*xdyw#>A4B|CZtyAfqaIpcSB{f!R?XAEJ
zwxYI1Q<-aZ{P8B)yvh;|;&<`chNRDhe2b+gkPlP@!&T>k^X8IamKN#0HIhKF<fZlQ
zTI1C+T+jP+OjG6|GC)IR#S)L#y4G!OJXOXk0h`Q_bBGh~^42EMYxo-wQNS}-BpAt^
z*M6AUcU$9p1Ul{bIx0TpM+d!Ib<PwihV9c;(Qnx0$FED`J+BAw4+Jg!UUeMQxF^Xs
zQ2dbzfKpWnBDXM!^#s6N-v?{4pUZbXN^SY-F^q(9-<_Af%U^Ac!}SSk=EN2+vJt+W
zkR?{qMY_7}8hs4!{w@tTJ!JlPBY0_GpsX~}X*X))!Q$N8{`&C3$MFPfU3Wa*2Atv9
z(~56~(C?Jy7p(+0BzF)Tn6(@Ac-K(&K_}*e()rvziF~fbSaC5I+K9e#Ui;my=dAz;
zHF`}PwULc3f)D`x=Bsa5XTqN(T=Ns}T!8`h*r47jKM0WVAMer)Q8kk*VlqG>AX97w
z=RmGn@m}0yxD3SNmF=iGKV+e7tpG3LTh9jaN%d)ajmhG>`_mT(Bt%_jsI@X1?Dk+m
z49glX0NQ-B<P7&w6pIzCF_hc9zaF#+)$iAPSqrPE$%L?T`otRaqU19rV&p?KYH-4d
zzxDzsuE+3gtmt9~hRl;l_F>J5{o+u&K1UvJ)8#jL#Hz~o7qHHXN_*Z>{m0g41+>})
zbt_!F7YEEL4DyAnQq4o0D()fvjy^n}+_&40;<~{W%N6*c5^2Rv7m~k>Bf3^_%yKAV
zE_*09x$C-(GBcfCI9X~r{r0?IKYA`2EG$s6qKS%8IRdV?Ioi=i;Hok#qNRzH-wSb?
z67#hYriSaZbk1u3K)IXTfviWCF!L(Cw;vx&CwTkf?AgzYk-`(X?ax3K0s5u+8{~55
z5aqQ~XfErL)QxI=)POlVtYz%L#`s6)5Y_wx(~DyH2dEljVz~9M@(A=PQp*T9qaPtV
z4D1!w^OXpX_SfgB|4@SDL4HEonks(5Epa=u@2}T{Rn$~*?XjfEqV|w|$pR$Ra9A^7
zZQ%*i8^tgkC~^)M5KyL>`+8R5o;)Vb>GJyePdu{+3*+4BhP8`6tePqeeh7)>oa{Xo
zljNwba3Yae2N%oXHnn};ii9pwCv01C=8D^cOE4$SmTrXS*|g*Gh_TKgkj>FC9ziod
z-}Qm_<Xsj6{3v=~cg>)0={&SbNG|-9(_jJQ>@aY#bmrw!F~oEsg_%ZBadkaU@(*)u
zb+=gX!C(vnPFF5FlEd4nu$+MW0~8I&p(<CCnURWH6}b%d5`O(A8gnFRG6;{xdgu=n
zLA?jWHb*(Hht_bzNvilEC}mkX1R-h$$N4d$hSK~%{%p!pAB2^VC*x*(U8!u^9<PgI
z&bZ)BaKfvj{2C33;>m6g!Tp~235(5J>tDl1EyqSHYQroTH%r&|IrBQRYSA-dJKHOg
zot^y;-47TjAjU5B$6-O0XJYYysveofwGiEawFFCxp6Rdv+MA^kdES`|rMK3$!qP9i
z*tX-*Yc(RsUDi=rSPy!OsO#E*)x_Dw3A;n@Fw1kt6pzFaP^-64-8S!{j*%MQ900dY
zO_rUfmOU5o&7Ac$>I+!6BhfUMCBStWh0g>SwKtFlyeD)<a#R-U+K*0TrtPWUd$FzT
z*pGks=!Kf_p|Vx=n@sI2c*}Bj$1SETtx|OjC@^2|6b-eq=>>RUzeVWsqM6S!pNR(n
zK;j2<i+!r<d*`|{qEP(s`FsmU?=H;RBo?SlGN93y$N^F+l)Jj-=7fH2>ELsd$J+wl
zG64-boZOtg?j_wdFQ63Xv>V7I(Snhlxi?S%=uHKhW?6!3nQQkh<Zb`}bwWcRJP8JZ
zQzvE{Ihgx&DcEXWdd?_3?dE0$3jV-nn9SDBr-WxigyqW1t)Rrodmw)&1+PQuX24lZ
zzqztudydJWeehAW!*Y%>o5_viU1JW;=Bzxv#R0JfOYkEtpXN{$Fc(H7Bb2+o4sS@Y
zW=vX`MkDfTj$ooq4R&@|v(lZsUe^9$h+9eHv$)sP7(J>6nY>!PRAI>0cYXJ)V&lX}
zghp$){bH%C*OhQFS0rq{J=idDRGd;_@Zm!OB7=7+Kh15(tzR1t0`K3H9hAvYIHE$h
z3*j%G=|3Q!^ap%Cu^~7Va@%VHC!*|OA-dU{3E6BG!*jQ_iFM0|6j-c`EIsq~KmW&Q
z5V>5AwWy5F7T>R27QoQVe3rSl-s?HFzQ6)nf5CDrP0)%S4D|8mL6ujQE{dTTY!`f{
z8^6;o>CI-}P+GiUg5*D_6wj+7)#L2E3vFxC{j~|W3BbJSkWGEVtFPRs7@H&8T!E7n
zV`NKzejwwxQsYPI)+ZLtOioZj;|g@<FO<myJyQ8;tF}sk$DAL=IvXFfP@5EtHwuug
zdOZ_y$1kUynZsVw`z>*ghUl3(Wdnpab}bTIi~#Z%ACweBoTkCF+L?`nDy7PmG9+i4
zLHdA(s$?bQ{ixC@kg9Icd3St-jcUf{`CZ5yFQr@u2U!Qzxl39GK-aFQTA2X)pqY}L
z(>_9_O0I=lT~N);u_Da-=~32mo8W#n%e}UCSd!?KINPXS<8Hn-zw}Li$m+1Sg9B`#
zCV(2tU3}4rm#PISTM_jo>n9)FAZ7<hC3@O{!Qkw03{qik8GjXBewdY@;c%kgDO@ZG
z<n!34S#z|RR_)T~ZXs$;|AZ3@%(emPmOZ9&4fT)QInWtv<(`R?tO-Km2J}Aj%?xX_
zKFdi^))K3!MXkEyS#heMM0SrfBC~K)^^8hoS}j=&^)gL5lRq7LGa(#$(`Oo8sg%g<
z(I`aU8S^A&>Fx#jk+N$iiw)4&)y{Tabf~am+563ASA^>EM0ONtAKKB|$jNck&(DVh
z!YCvT>U~{vor_1ouhMv1Msp*09g@hOa@*&hFAdnJfGQUuATJ}i+@jSpc!4ug#O@JS
ztzPr7hO_@*g?Zw;KEa^6o^=ugG^LT`l4kFmZ4THx31DTb%%(M48LZ&T+GgBi<Qbb)
z&j4VOpldm6Lld}iriJmEHqA~aFSr-nMzzw^$5uwO$ort=D(R1-!9OFYw)AO;_jP)P
z2fW~;B{iVZ)8==)p2<bS*i1Wo72C2uSJiToKcRL51FhlLaNM`rmfcc;GQ)dYY$m%M
zol>|>p`!!5Y(2|J3auMUbKaE~Oz-VYW2P*1S@_;lupC>=Bcjv?gfwJvkP=0Q(c7e>
z!>%sG$;$&6D{sZG%a*kZ*p<CZFY@lO7ipI=<<Rc5VbNj-agWyb1fzlr+!OBWZB+xV
zFz^C~sOHaW!T=+lRd^#t$6h4C_3?n=KYTrjjg^nyi!5GYu7xNszDm2?aM>|T%rV>S
zMT`CjB>*A>r@nMMzF1(+8d~}mg|MvR?8bu=TLU@l)^JeaTU$g<$^gaar{>bD3ge+(
zq}@z;CteX6dDk9S@V9fg5*x$HYvp}adES=RL-VJaCg=|a1!rnw*FTl#KL$n>-g0?$
z6gjZJ*u!@&1%n3sl@W2Ss+Eqo*f6xNh;{E;uCO_?-?DZnY)JCT$v8sPwae*TN-12f
z)!gg90mr%gp8%G&fxrJ^R08I-L}^$hBY%9?`8U-p*1LS4B(iY*yO_{vhRRrd9+3*i
zgo`*aWlIiX9I2W$cf5_A#_EUsOV=pg2uLXd^)f1nwO|-5m^A1ZJ<z7p0@w>GA1Bl_
zCG^cO+RiF&XF9QbN|#C?hJTDJqBqcZS1o8Z0@mLElar+#s_LdpEjGpQ|2^yl>g^xM
zx6&wG4iTvdPg1UJTL)<m7d!50s0)yG9up5&oQc;nhtIcR(z_|k!xO6MYial)_k+#~
zWD68Qb)HE5Oga|$Ee+hjjk=PO8(Mi2xRSpg*0FE&(-nDt8&516j~KIqquv7<_rl;)
zFkcHC4R(?c!SF9<zau|+MDP3d^LA3U?Vu!tEF&@}bZw@l8I}DUmQ7vG9>M)~x%K2_
z(PQ+lBDny=fQd=`kXOKBLomUElsEDzRi<@_KOVx`Mv8(hBmwvCX@}Y=(Bow-CoLsT
zEsTmemEpBGf+j1J1bcOO<Qksq@Ba5ma(h-91!W5NT@S^shb~Qn0?LG}Glof-{K4%C
zldqQ2AdEEpm<n@H>9luH^sq0*KZc}Af?yKc4N=OQ%|ml%HCRibJN&{`w1F#~+CYy>
zf}<W1=xE8iF994P&?EC1*hlD|2Xq@RezTy{&sxm13<B)jC1t(sdkT2JbC1BC`{PlN
z^t&HfJMYRpL{FO&xy4F8ldc)JjWp9`4Xcz{GnvhuF)bG|Ioy1$(uFcJ4-eJ4W^DfO
zj23DwL}qMR1m8^xCt}E?=jTvBbLIkK75C-f-)Ie=+WoIQBcA<cc=<6}mCM}wxDYmz
z1|lwAbQ%#dU#}4iiK|+$#y3hLP5bf-3f;*Ou~f705}2*)4$k>gyT-?04^<f{$SZ38
zdj)|C`x;)LmjtS64C%+P3l~$D3#Yl2GA8eJEEm=%QDS#|B|^$*`WepQzd-01A2IWB
z@bvmg1ADNo?*Myel1(E?d-~!#H`OJ4rhs9xGUXEfn~f?5F}2xBr{bQOuA67)Ayf~4
zV?u=v__^7`1|@3-(SDu^v@GN<6Xe3$EkaFxCK$}>X)({Lr5LAqga7`pw&w$N{U;9K
zEs|kgrBjhwu^vX?#nQ=|N#N%C5_)qLE4T5!{jnJ#T1hd}s#~$E?56B?^%9YNgSbh5
z_2OE5S*4d&<&v?EGR?2QC4QJr2akc^2xGD<VPpD)uig4sT7ApV*U(A}N_uutuRyZT
zMG*SX<9k|CKMYI%@_qP5hf&wcBePGp?#$44hM1vfM9-1tVv)y+REJiw3C|u{+p{wI
z5Ca~{J#hx{)vD5<58376Tmiabb}E=_&z@!QOihONsM1+on(Rr{zuW8K)6c7qkvW@0
z&8CLdz-aX#&78UQNhE-f<ZbTbw-D@4X_6-N#?Zs$aYA6%=@|Uy7CDae?q?4jmOzN^
zZ-Z>ImI^=tzR*!WdY(u6bWV;*J4t!fS4!Uk73T=r^-z3O5xjnMyQkTdHD|^3W`lBP
z?fxjAFd5aLd^4q(vR*)zGjUPu6fiIb@@l@ajMZkbzfoo0-G51Q$9#EX%SwJMqvMzq
zu}SoYZD$;?MY_Bm%lk&X<M>kG{jp(a4$xy{cZqz`SZRxQ<5}fXnUs2bjHi(}El8NU
z`hWzL0~53pF3#tvJX(?aM=IEQ*ae?3CJJZw2Vh1m=^Sg_i)C4CXsuJXJa-eb@?Mqm
zZC#md-yWk1ot31-5;A(|ib>~^prg848@COe2u;*8C4$=JnC4Y`Qb=+D&Fjvxp4&U*
zqxo9*$20DD5r0XxoHQq6EE%(*a|IZMLB5-L>>3oGT`-%?@i>}n{BPgYv737W>2y}E
z-lq=-C1nYbG~>l0c!#UZuv7Z<x7Htz{`b71oPT`@0TGq+86^%S=-{eUE9Jw>{U=^X
z7x&8&YFp*UM9sxD468T@JcPi|YxdNZ5t4_^&D#*p0nFiiu9YuK)!gD@7agvXPTI?h
zy-KnnS5n(9KsLJ~VoT~TXJUI|GM9@1?@<G0z|Bu!KRy8KzAWoW_^hq0M|9Gg<k=U=
zZs$K_E(JYe1QNQw5h9ansmuOToud1)Thq#D-4k^G%Rlm<z(@NzCk)OfJPV42Vq7oI
zmI^pIOI>*X^RItBQs7R$b<Uv=!W+XPxDL4{K%(ol^)09r@HWzszLAu)<yMsFT-VkM
z{ZsYtX0p_mt>f61>nP^{!_svzGOu&llA|SUaa3JQ`I`=uwzyA_{Z)C0fSrn@A)sW8
zcf5KWRu}pZFHlTYsOsGa8KVqIEZ4|*jgJE*DabP=RA{)QU$}pyE=AM#DJl+J4PY`Q
zk~%b-1t-!2635T&@qblV$&!L-{LnH_^KYk85nqXNgw`C>Z$|lMeVnx#yWaAqMDZWq
zwZ+zZb|re_eDPEi(=?wE&n<QUOo`YOD|XaM+m410mATs}5E6j^<*K4Ig+Ty#W0{lu
zTC1bhO_oc&vBb#c4TQL#t<Q9}Ie)m){D)@7v>c~Z0D>s7SP5UkkVo|uSDt|w-j>X@
zC>f%`=N~@U{pl0TCVy`@Py;HAd-EHnbJ%SN)1P2or>S`#qv}m-5u`ux!uDJU6Q8wY
z&q|D)7!8HGqS7vj$7@4QcTrMnU_TZpWpGFNE0<e$Iv&7^Hl*&NSADS&4$c=<->d&4
z%iWU3cJZ%INkaw~^AcY!g?pQ-<keC}y~o7hB*TEB^*Ass;WmNb(Y8;d3!wO})S!GO
zuUnONNBNJ;$*${-g4jt_e48>^bnU#>8nM?>ku*ShtEH0{DPT7A;@XgSk1HmkP+l>h
zViYhYG$!VE+%xGz`l_q?84J^5O!FSpN#x^B1mR**dl+ch+E>$jW{d?rwrWuRE+J<2
z8b%#sWlR)Pl0~O?wx9Va&^%Ss)76!wig2FG_8mxMN;$S=HRt8MxYeL=lioGW)2`Zo
z4*=iEjjc+cH->0NItwP=Yu}CZ{bn`Pf&rT{0s+BVAWR`k5CVAHrHG<`vnlo_Rz8AS
zBLODGDu+eg8oN+h2Hmb@7KrJdGRABga#8Q?-CS{R=&gp;m%wJFSa;>#k3$JcZ3I@Y
z*Cqe&G(8CXQ6=Lpu-n+F3bi6g_4Rv~Dv5m2auVSGaf`)o{rNkYUp<pedvE@FCEHwW
z>@IMU$X(lIP<po*q4*0ju3bs_&>kxmIV^dpZYTQA7kiMP<jXn^B?u*DC4Fje&E_1x
zH0)*kpQnvC-(E5XhpsorVMnS0H$67!q;@vg!)u<z8X?EGxo6sE*aOZv;wlwc%(%)t
zVs6<aWpT8k!iijb*3$^yu<38Jj-$nfk0-7LZ1_U>HQwTeNFBXsVxLao+qL92YFMgj
z6MeE<ljI?3#}VHw7;hKXCn`n*HdBameMJNUJ&X2g#@l$cY7R|nVp8BXqJs3#X+R!W
zN5iW*t6E$I`NiGs2Yx!+`K0f}_c^=Eixrqg+@g76=+-q8r_mT)qi@Ke&t;z-e$@>A
z5@-5=fq*)_$T5~Z)?j2^5=d`c3IMO=zdJ1Y3i8#TH3<Z*X{VhN1l<R?PGMnf?lndI
z<|YfiUqG8~KAoZF=j-&Q<>bd!0QeF(u`8De^qYN$zq`3isEL&|DR*j@aYszUm}`W)
zF?4D>v&m)Xai&3E&Le!=DD)%(<>J4%7ju!M8WUxBFcAw?HVp{|fMp&xyhlYoS)UV!
zlzI@3IMrz%ISj5tR3?nN%$fS%wDI?G>ZXsl?eK#qqbj4*Eaxg;0VHKX$E^1Kn26S+
zd;y<igv}>TA**kjnU8RE$COEfBFvkf=-q!|?awQz>*F7@bL}kH3kB^?0pcqXp0~l1
zug<*;sP!_^AuLp0BNTC)fgB;r>4*@)O{Sp7=!LLSR`@1;aVd%HUqW0fbQ=+itvHxI
z>Qp$OQ}}T$d5zxHI|0xlS#wg)>daqOx@D|>#I$mt(_L{)SrgQ{DwmRqItgH8QBshc
zA0M`UAUo&M{KQ7GRjxIdVK_&zi3;9=Hk1xSJ&bj#9{m8L`@%eRez&iS#Z4l;xLbtP
z+ovsQA|A=sj;Ng>&Cma#@os^%)v=`<XIM52Lk{Rk8$xlz)`zj|VVAXTlsQWag-B9D
zclwenk&wCc1Kb{_aKrxamay5pL?^fBUTM}vG=;HhF9j8SsC5tSH7V8ye-%{Q5Lzm{
zNaN!W)%E73sw3ugp+1kDDjPY93Yi+j{L*Mu5Y^ye98PcikuF!?;X6J*H@6SHE&)qh
zFluxD?Vu!}o<#C>#9nI1v18s*yL0_NekUXyn567g2rBU;_N@^v0m1Yp-4Nzt1)77Q
z0A)|}H0n^TIBHFKE*&QpCwTDS#PgQk@RlH@Q=4_V$s#(+q#lp?PTeds+eFeO^+Nre
zkC-NU+9O5@*HE}F*6RTy-U)UyJqbmonE7Us$<F?s<*;5VmG#!tIg%CyhM`trRrC7(
z70p($EAP4~vk5$AKl~=JNa9wH#%<kckMh(8Hx|}Z+zUKgde_k+p~B;znZZ_Mh?m$t
z#$NOu_NG2zj$zrp9SEouVO+%%-bVCmRo<F-b0*C=pi47IS&lqdAipqN0`YnPw>d-h
z%I&eF>mmIfmT0Hl>+gg|4~H7`;?7-Bj;7L_Gi$j~ZT#JCrZbAL4h;zGVNwslLtUQj
zp$=TR1Pqn*q_qD5XcA~v46rSROcCy&piZrDr(`5SlAL>rJYT5t_R%GqtKUP{ebTNv
zhB;IF^MuGFV?F=wSDSIv%0$BI>a-h~<1sK2dEn4LlG-h&x!=5N1e=z|Ij}<MG;+T9
zy9LFVlGCFY-lp(jlK@H6^_h~3nYC`^O)F5#oFv=3oYamQ_JM<RChdF1UKHAN0oelZ
z!IAX?f*hoK-M>F>X1<TZoM!d?n=NEoEJ|};B~(h18<o4?cyla2%tz{nfn)@#eR4i1
zkh?F``Q$2x8iKKJ6eCI9)wlk~J$~9zEarZb=~v-JvI`LJMYP#_m_y(9b1Y`Sm0k}r
zTEklbEfwQjIA$JE3@F=}xbBsuen{MBDq`Q<C6!OrfNNdh*r#rdB2Dd9sR9iXMyy66
zMF}Em34U$kA3$Ndx<G_hy9Tr3<_i-=C_htej((V$Y!20zyZHJKi~BG6C2m9Y$`T3n
z@(tFaB_G)dZMyWoaQElc{e>OkD=FMXXgaOmw0lG4BOs}NwsOrb*So7pIz+H?DH8#%
zr@|)^mp*8yy3MltJsR2~1fhi@IUm^#^vTH^B<JM-|B7O*33cFv6^Rwt?y<=ZYF|18
zF7N_NCf7yz*y*Tjg^m(9(EqJ&`$t`3VP!^6pianltf=PMRR_F0<Qy(=A!>zrohF~<
zmjepWn}dyfEJiN%B?<orFf*d6@7W~v%B{y3nh*YUzi98~6T^u4(nO_GC^&<LUUQRy
zfH#s$9tP)bBVEt71Kj9$-{>PZjt<W)ohZARj)?@<6QY?>rTA<!4WDE;vzAcG1NuhX
z`oXcPk{)bH6LYJO_^cfC%?+cOIsL)=XOz>wl;VCgfg%Ds<wcWk@yi)IJ<f4J)b8iI
zU;GFBCXX&jLMW1?7BeWR2%nMQWCud8B0Ls7!c;uXmC+`x{<j*YUvRj!d>ovRgZxdU
zc`aqad-^lX?g&XQ7l@ME(4?*OW0K;*8Oq?<x4F}vtHP`0Q(PxHOIT`{%n#%e-w(9*
zXt0VQM}3K-_3PvMA1fAF#s65^_?_GHldGm$KdxNGxbK+hqvSDH{jCZbe3^@oeS2g0
z|1+~+Z;XEdz+Kh@&$ZcFP)UMjJsTtB+BMSfaDp<V#L$c0;k)S3>Om?>ei_~ZTAw?X
zsY*x;P#)xub$?M_cwp7BJwJeDRys>p@u)~(FW+Flm+IO$Y2I&E*>#UL23bE1oT;Vo
z1xz7F;Xu?HORe8SHMBf=t@O@DXRk5<GahHLIp$^(`-{7ukE?!%sOwuAIGu#eyMrr~
z>1+60Qd}}t{V@kr;$8W!ID~UV195S8rFH@@`jpAvwXg4w7PzW;pV*g!*OkLomePr6
zELdf(Ntd@l9O_^pl&P{{Y1y5jjenu*|6o0f0D*jKZCxGR47FfA@M$r@b>RqM&VKp|
zbLmk-E%tQ$hcx7Fq!OE1i${nZ)WN}T`}7sSk0w&`^!q6L)lv3i8_<(XTmY4AOj39C
z%uce6CS9s6)GveEwToy&MK`P)cKXlR?<e6WpJVS~K)#pE$A|qBuy+H<cb(A`BQ%54
zc9CPA!WnsB;_o7BIG8T$n)A;DEimIiJc_)|wd(}5fng8*2qNrTU6nMgn(i~Bf2?PH
zkWG+jIrv}CX75+vB$PD-2(4^;^%;PYl>e0Erm_P^1k`@AFj96d(Y+0c5E~oPOC)o1
zL==}n>$sezvIKafvNt*FkLBRWl7nIonZ+Vud9V-1UvZGXgoFHWQaK0ZlNgP>x`G~^
zS$q6axcwRzKj2ybk6HkqKdbf+`sF5P5>7bVcxO+M!g0Ex!#~rQ-#Cicb%CLkQ2oR>
zXX7<<aWCv8!o9w=ok#SK{wD(4?hNe5EPCSe6wbQ7y-k=vG0RYUplf%OM{?8C=S1gB
z%Q*P{^>;zjyh#1luV>T?MP#!v4fLHHq32$)p-#GLBzW%J=CLml!>yUJ=JmZUSj5d?
z_q*o4lI%9=s(RXKER7PnIxYC!$%TGDXO8s_2(9Ae`GdA09)jQV6XFv!&Q6?mjn@T=
zK3`2+mAV}_9dtF6J-(%M9U68nYrWn=R10zXw;u%x9QdIMJWq<FdQjF#cnn9`QCO}!
zK>cXl>Rd&iS)#;YRYrVj_mL)X{`hD35%+dSP&)(hUQ#x*Gdnc-G-f!=0c3r~L0QDy
z=h*g@v!)e=KKF)w-l!>W-oiqB+U%K$%XR1YU)xN*v4n3<3l@+BDPWE$ofCW<l#B2S
zjEHTCo(cFdr*Cx+%NwPGPUS>MzT8>o)RJ|1*l~-F7GUT*V)*`p0aDiwdrHBVLoG(+
zF3mgmFDeqY@~ZQkTT~^j27%LI-Dl<o+IU;$Mu=IpZiYJFn~2thZY!I<)lO064PebV
z7jsUJe6{J#Th(kxpLbw>BoOHr%W!g>7L0j`c?sfiUCuUf%|DA7)#v$+a}?3v9al}{
z0{C9YP~FfZOdmkWX={ReueTg3_=N^PGXAYhenrYfQ`C%}8Y;J&HtKBw&74F+z~7Vm
zIUAIi4wyc*#%Ke`<9w{v>tYN;TI4EDjrb9BNZJTdx9bX<ENX50SG~CY;leGUENJ*e
zY$r~C=^L}3aL5Y=GcU#*eeK&rSRaq#>G6z+n+pP$&jrcNrY6X(Ut8X|#S5qs)~us_
zh;?av^4WaeeOPO|r=0I0p#T2BPY8zp9fnY^uRA>n`_C`2>Sc61Rt#<Ysh)*!+&MJh
z@VnKJ=@11-Jg$(KKk_|CC}78$cpLDD7g@Vo4{raDhH?1yE{+0<;=!(jVuh-xN#v=!
zB)V&Zn4maooEzadTr5EJS{ym#gk`U}3_F$-(VBqbOHa6iOIWl`@#Kw_Ou}8FT@^>~
zcQvspxV7meIlMgApL>0awqb@x8^nN7wglaPFRmlBIX`~{`Fw+SU7F7y$f!^aUo5NT
zg8y^C^1CK_hr*<8=Co(8|J<YR+$`hGmY;k={b6DB(y)AjVBS)uPEBF=xp0adhaUUB
zU46gsBj5jP311~tn|Y54z^O3uo;Y*A#{<}a&ChaJ*U7I-HG);AD_5*Rdo;v-r#^=#
zy-$ksFb0D?S9JDW%em)=A9V{%tA4_*`kZ_DHP4Ejq4Qg?R7V@6hYZl3Ojnukdpq&g
zd@ja3QyPF&HlJqW8JAu$%Sy$^W`-q~NeU0scKtN@jHhZ&*R?H-y2iZbOGbnPeaAU1
zRt1S9{cU;@|Dl{ICwAPnncQT(?GKjOp!`49-UJ-#wtWMBqSB_RRLV9LQiMunpHY%F
zB!#lION#8<EO`{7OvsijrI5Ak>yR~+AzRjA7;B6f#_Z<12QAO?{=fJAj_<gS=P~q~
z?Y^)3y07az&+GarRw@Dmf^tT6g%i~0WUWNV(vzWcdbMw^cYtIw<E5{S@@0K5%#6-w
z{;q+$B)tA(2#nM9VJx8xw!66zM`K_MzC$DE{gRns;%A6~xj118YBpjg^XT+d*k?cM
z3csg0J-HWgr<XRc?iGhOMAJNDWa%kDFen=+o&G@t{+QPCoQ?l)RF6&Z+u(4wv6BsE
zqMdfnQ6_fh)x#<760_S5?@(Zz=SN$|pPBz0$58r>+PZ}o7$(TS_z@?Hta1jbixXSb
zBKr<~wl`m|3IN}fJOh61o5%kFL!A&h8581i*0Nf1{5HIP@<i$#(&I^kAQFDPA8#sb
zz^*b*z<eL1s#-L+-Er1|&uYU<(N<eP1Q|j$#L+yW6viAwir&DPqG9s@@(aj=`|Vob
z-1qDA1p;Vx=YB$4AoR7`X+y@<lm;f@0jxItT5)i=x;yKiIq0e<-dY`i`*3kmZ<g)y
z0%(u8)uzcd-e-CI2lBb3a>Sk6<ZZ9T&DgV;xNH3(>kdz>>o|WUN&t3`kAhNdf>`a9
z-l<r3X0OH2WB6G=_$L;@xaU>}1$j-JKDRT_pj&3?_yQD#`GHeBn>uczm~`Gvp;oZ^
zQ-ejj$(-5X<e2kP8u6Ed+PiM!$w{5CxwxHO!LlrMiL%S;lE_(mziQq|JDb{8E7isD
zV{oqK(unR3O7#V=6q&Cx>)87H(5+a%^nS0f5-X-jbuBV39R;`W&XCm*w<4ahx+pQ&
z<`*0;Wd9>*)mpHjZ^oQ=JR36b_TT*XV+*Kc0(i3|`VE+e%)Q^uBLuN?{ohH?$OoX~
zs7K-pncj6gH&uRCXpiig4>jLf8D}fqoPHSQuZXyO^M>1Zih~`ip%tP%86ymL*lcHy
zs~dSQtU8H4^gEpzc>oH)&&@dpWOpq(z{gtn;BckauU~Hxrj&FrH{MnL>gap#2M_hz
zTRrhxSmw7*ECZyS*QxkMX~jVwgI&*f+8zPq*<(;=UANFCi#Y&j!<j~kpHS!GX8fAz
z{22)YFQ|cv*vDG!+DLuq^%gL7+24N4sVZ8p9}l0+XBXWgfu!$oet7r4rc!@+Uy^y&
z<=387YW;OmFQd%)_yJtLm-^_QF7+|Yd{zbpah|OFZbF}lwJ4ia$HkG{8gvQT2q}wc
zzs^|!oXe3oIpC%c#Uc5i$v&lE(NlTv-O=RshWPs9uD+_}BPTA$@@?F^G%>$@_0OBV
zGr+pONABTZVRdtRJ8I+RU$3m%2@MgbTK3zXURXxKxn+{_xC=9HqK_`X1U7s+k9M{1
zGn?_rC6=I?5P<RMgSAZeiv9Bd+P`ACXO3`sL8<j8*F7Vcu1}KIE>VL%5ahl*+m7zc
zYF#cpd8WRhfI8v}fgvJDx60CRfOEN>1#hLkh!_jEi%v6RzQKi!ww!D*RQ{P)KL`#_
z8rZw{Z^~Mp_3Vf7owyv778ukvta4m%+o`kQ*3bXK!QU?7nIqz!U&a#ZGrnr`mQ>S9
zyK#hz+sN&IgqHv+Z`-tFkn8>{gS;d9hd5@zp35Uwf%iHaZ?W<p(bI;=O}vi_Nuduk
ziuolklT3LmfZFko&C}2Slm?c-;8bP8wMDmf|9!G)wTSCaCUtaDV&gw&|3UeU)$2O#
z4mpFvr5egSvb^MVn)->k3Vw*^Hf#(kmwa%}6@|soh?*W{M1FSCXId)Np*B@nKB-S?
zsw##Qhec;blw5s79CiC&rvC84)EnykFH`^4KAfnmFjF!=+!jx@%|*H>|NAOj6uO-Y
zO~2@6km<U61Y?lWaPoQ7nb<)S$NB~KaZJqP87#$fbPKe!-5Ql=qIyfgBM4ZQ%-m3F
zoA68)eFKz`;6dK0Q2n;xuBCZ>^iA`O_P8fGVya8$7D$4@p7Bk3^W?YPvJ{Av)4@Wj
zW*zzS{Gjf+gM0^L0$RY5&68~zr^SAVI~J85-W8zhv<5a$+hhp@y|{ebUN)?O{9LCx
z560)jqhvPTwQB2C-S$tL(7MvLyeLoT>3hv&$5K;fy(3#XBkQhLm;mge#H=ClDD<Ml
z#6{=?6-!K?FXQ(67|i;*`X!|acxd;XEc)d644&c{8BU+>Nt`KstnP8i((+Vk)n9f`
zc}Q@$)2nVlAqO3@cGCj}i0%tG;oYu8$w0<}E=c}Y<n`-On!NWb-OG&;lWjpayiWZQ
zH#Hdu;=sob=#gg;{jlv*2n>m=iN&EA_WAf;-5BU-(A4f%#fB4Ij5B<M;!SuEwtHV)
z^uk&#t1p~LJazbmN-jR~X+!QLQS{!K4iLq^?G7Ad|Ap;cT7~@wc;yFotQ314;#^bs
z{3l<1No^1EgK+%gG>-MsyRy5<k$mqz&bKPa;FDoVzVQ4DCA%j;aTk>N+-)f0tH5|!
zra>1}GvXF3;?zV1^^Ao-C|U<7ym0U&{72$*rS4?IJG^7_xy~nr!Qs)FJEi{_sdVnz
zKYOx4&{lU`^;)Xqk(5%LQvj+te$E6}ITK%-yv*ZIKxX~!aJ=8~wl2<?^`>~ydtT)u
zMqekd3|wQHsr*1V--Kpnj^_yG9R4O@aCIqv|BFpT?(jZcY`9PNrs{l_*(Jc7@$*pl
z1^Au!V_OU?rQ>61{dMOa-8uEs(hxZ`)#IyMm;myEN0aWtkIzA{TU6{&TXHi!LQ?}D
zQt8MlZNl9h2e<bi7yh#Q8K-o&r`M2q$xXw@elXcRAj4hP_=A@EEfU!V@s0&?RRg9F
znXJi|I1#aY8k!*<YB?&saf4#-;EISTbNWhrzbGOUPN|*Ubu#vr4kX(VnmuRUV{qyL
zj4>s`%mAn6hsZ@~WYc{<oq3FXe=c6?3~|yl!yd<K>k!WG94QF1Qw*Ac{+n+D_i!)P
z+yfd_4{YSoj8dY71T)7^p4&{ktg#aFbegRnG#8e&ehiyZY3SrOFKf?C{f)X<n7cO+
zkFshx?{PXx)jxXjq9q|?f&O^$nr9jHvrBLL1?cCX_`|YyHl$|_D|e31Aml1Da4f2t
z-6x(r=Z`P{i2wiaCT|#3{YrT@sXBRnm@_d`qW!O_qVa3U0^R9LN}Hk`W>1@aA!UQm
zHnkbEP=bIpAZnbCGbn@uw*%L5TC`IU{T*eOE^W@{+`4Lh+RC}B;ay@#_+VMa#LUSr
zwq=}W+9_=Ttf>k1%J4Ne|IMCE<@l(15wGvv`aF5Gx-_TzEg@vW%_d3I0-#R8e{gc=
z5601>^|)kn>zP8(xtL@ztA~&A(BNYC0zLEBYEP;k)e}#!?8zJ{uqtDM*s8U3De|z{
zu^-+szWHTYGVzxIVJEurf-D+76tiB}4r>(|t)5f*{V(FHAKtZVqp4|ua!>9^T(?Y5
z0r~xVsyB@U3%S&1`*~7la=k!?)u!?|n0l=TK#;bbfH)tMsT@5X8)hxE4E0fwuH#xc
z_Ef-OUr;r9w$=g5Pwr8UP1W9Y>-O-H3u#i})8XW3I-W!f%7(qiJ9h272hG8Y+>6U}
zIoFrZ^&0#9ukrTA4d3!JyXG9fvCVC(+Q_*A#IkiqGJtY7@R-PTFKC~8iy1%L`ST<j
zOi3VXWfd|-d5*=wxgtidyOz;Dv9KgMRyl88e!Mg^ohD+VdU5pZ;s-jr3}{E_8HVJw
z=ThJM^nI?U9lBk1xGVMqjnN*YE~oP{4u0rvkGp%M`s}lB*bs#q|GJoay;)Q0+onoM
zSb9eWR(QQwK|b<D>vu~0Jze?vw$#ISNS8{q*f}p<L5LS<*)?!|=*;{FS?=f4gj7UW
z=J0KQ@h*CO3StEuRblXALZ<Kr;lj&+7BNA}{1fKK9)i%^kNo$=*&U^07iU>|TUuv*
zEzFy}RHu|$c~wU2xk8n%lwe(y6@ALWE&o6w6t`Z?l&$o3QV{m*^!W8CZM(OmGTJIK
zP!WSE*8D^zNQ!;aS4OZzV%@)ny1&a~)kbauRZtT={k&fa?4f`J2Zc$*<hJ>hWJ<gS
zBMXH9NY8=3A7vZ--VE>w9AEe%L+^a!)Mu|p_bp?Qz7?wXI9=IEy7@1G|Bn5~`256=
z2nTf*y)CJD*yYoeKf*k*{EYa%nd6XIEr_a!ao@Z`P*t$XWuzEU$zO&n1(Y*s8j9d?
zQgf9MNB~afOD_YN)k@+=V^We>%uge`0F3O_wnFLf{a=iZvgDJ*eLL-&Ji-f+6YT;I
zzeJNFf)4InNKF6wzbDVihb50Zy7!@yQttZtf-h?FWZs}Ql&sjDOE|9K@3*^}-$H-L
zZN0}uK(p?BI=e?vpWtRZpWVpO?Wto4jp9GLwHK1Ay5o+Q0<XTh<Yz9h<hh=tSFHCG
zQoy&wb57)Nyl7&p-0-FFefxSu*YDf+5V(td2!)sbgw8;s_I~+#)f?K8anWm?X8e3f
z#rT^0^s6((SCV(|HW3Yshz<omVapi3S76#wo3)QzQ+u7zHtLTW^+RPv*92W6OG>!k
z;L~f-Hfm@)q+efIOLun-eD}rHDbTI|rw$-W%QHb0YieSw6&NhBerp4fIa}jYXpU$O
zV!2qA72uQep<B_1)Y;ROcZec*sxA`U7&lu$*ErKFudt9z)cDZ-3sWl<>6LrfS1BHN
zC-G`0i`k6`a+rzm;8DvklQub^I5o6<E=;VxqdvL|GG7k8g@X<u9pp2t6*GwGFKesw
z0h1GmYI=^Rf!J_!1hv52d@Iye6nf&aog?Yc%|-1@yiYmXT+BvQuW-<@u+?ip##lQS
z@<;54M;d`U8_DH95?lF?@fNI#U;OJ;A?L`LV2QC{38zEJ$}>LA^kux<QBv3nLHq#r
z*fw~-fZjB}+MCMVqx-E_dcM*1{M;NLTLn2WC{PgOYa3(^zCo?yp|cv8Tu-=sc<oQ%
zV7K?{`3p}jY;TAdeiu1OH0ETLzU-r)?k-M)I=`Ic6cT(4)Elcz+WdT{rOA@0D%>a~
z8x#;E^qHhW8_u+8r1za)2qZx~d0++e<ceVyqKv}1v&PwMuOdE54Nqnx;%G>eGk!#%
zI%468Nqr{d)l}>q&C{h>3x{OlIp~i{IVlp*G-}@d1s<SaSlbJTmT|*xrrwi9r5#L!
zNO!SQWs;N@PZW&b2q(yF?1zSuAw4pcF}$#`mc~%z#vCt=ni{p+RAfXlTo}RV-J$6F
zaqHYX4EjQ8Lz?pqXc=;8;LmHeU*}o7YX6VaTg6*iQYMK~qqt88=~8!6xU_vl`R+YZ
zqhMUfT0lKhBDO(RA5X%~QpLfX-0^%Bcc2Es%b?BrLh{?p?s%A%roZsBPO;ntu;-=k
zMww^YWQNd)JiT(n;tv|j>=N{x;(0J$y!8wY4o`^v-4(SLpP(wsdCAi*$Jw{fwJS$&
z-JmhO2RqiReN;<>heBrGY#w+=iCFhS1ga-*viltZ@hEfXcBF(=o%Gf+f(d*0_HBK3
zz!`_V3emz5g~tg-hya|J;Fr4S!s9I>aX>+AGm^mu-Y2wUDEIqHiU@og2HLM7(Wsh5
zt}%;kXx=}kVf}`vGYeaEG)=epbdc}5KPA~{UyeJC?~BEkWMta6sjJgc#jIJIg6Php
z0kF}8VI=@9<jkx_N2US5is&ylu6a>B0BDzfg_=CUN8*@dxXhOOr_>*ew0|EN2Dl8?
zz@$q)SLU`sQ|x=tpws0GiGuaSc*c3!w_q{J9VuW0Wmw8BPH7p6f(;Hgs`UTqpqeCX
zJl52w`2REA`UM94?U9xYh^XDZPH$g`lf738?ZNj<y8Ebx9iFcXnG-Dy145~p=u3HS
zBfdC_v#+ov2jLGJ^?`YgjO7MFJS;2?$a(EWjxbnbZSBY)L9aw!rf)%zZbAxH9(qa~
z67-C+E9EIfKomAZ9-DK(;bzSAOZ65l0L>W^l$5V^S6-ao{esK8z^_5|Hw}o6;ala5
z#y^SK&h`RQqH!+d2J_fME1iqd&j``i?0cIb94S76A9@-`W+jy<PF3~N2lY#nZYYpu
zpz}&7ZZNGnra%-8JURunE55H1Ei+I?f%WPgbECwT$dKw-<C>v$aLW9Rf(9?}7v-oD
zu+RtR*o!!W*5K+livHEnH>;JaDT1kjy(d}&fzB3ZpV-+)6wKXOK<Kb?qxT#62GdWA
z$x13wA`YUr*gS!qcm?r@$vE*!4$O>VO9XwB)%an()DA#sKUO5aO=N_4CV(+G+BNuN
z7jUv9FB;<a2<bC+8Dj9dZD(4~Bo_YIHD$59B~JM5c%D1i&~nc7pRn&=(wx82v1%aG
zF68(9RUr|gJaPW&AbzD>M+aWxdoC6mM<hB_ugyd`=q}I^Ga>YC_Yj|0(pGAs>5bFX
zCb6L-L(#W}L~*aS<Bswizm7*RbY^gfKcP{;`GoagQ)jZvclNj*Z%{h#Gu9;ysMN_(
z0!j|9^#FGsGpzlIcxdsWHm&P$;#{k3A#i2!la&rtsZv^svj?A${DsLOtEL0%=qsi|
z2O4Q~3H%_79l_Oq9edWzS$TEuJ6iI>_yh+lS76{<%v(n<iUgNf7E15a`FYLRl)me4
zh+@d4K;qC#P;C76h-0O%L<7%@W!%lgdOsGB*o&>wP2HL0m)Y-wbEIr2ePW_WiPYGQ
zsT)MNm0$yv`$E%%f%Pm@Fl$qqq-Hj7o|>SSeA&-Std}myOwzdV=9g5VMQg{?oR>+2
zwMLevH2~GiGr{+#B>-f(QQ3Sf;j|Wy&oO-ZxbdxFt?o#!8XUtcYE+!6Mp{>0ga`7<
z98wN67fQj5g`qL~)Zv3gY8mu_+I)5Kx6Dib-=FFcLjLfL_3rZSGe6?^{e15#-UFFJ
zL5jH*a%TTz*F7XlP_LVOYS-A|*9yoc0i-`<zKP=9^=XqJwRUqB1@%xX-{`Fw^{X+*
zf=$W1L0|`>x2SE)=nHlYqg4yylk<GunIxNR#(shl{hmu%r&)&Co$8A#9g(%KGou(g
zD$m#86IR{YXP?=QuU=u*zZP*-lkqw@Jai&@F(Z!T<Fk1~ykIzq5K8NC%%n1o+=B*5
zT1qeTd=+sOp<Ch~ar}YR*&0ROQ3j4WU?d}DY`0C+8$}7lr$+TbQUAi2k2*X55qYo&
zz;V3ujt)-5Dw@L2Ypl;xB|yqOs-(NXpTrL=4^Wgn)2AXYx_(@8e{Jt&$^AJZTYWX`
z$QnTgCBh!9y3-#8pv(<Wwu`EVjiDmjY4iMEQcK$&XKA}^T#GRB9ZjC;P10#|k9-1L
ze&_&p8_2Pq@?+2a2n~2p6NnI+Eua*Xn*znL?h!aB#w8KCKSY8FQOy2{F9?NkaiY^J
z17;d?bbKZN_;)|4pRvG#NnO}EN=xj0&k|I_Omb8K$X=%M1_BBTUOv4nC=wWW;)cYt
z+K370_DM%fHaw1Cr0PlE3}Pep6;Jk#hzmUdW)9In<~$<6egOTP0Uc5o8X=g!9J&3B
z##ja}%bpNmG*%U=2#=_W3~?^a`BVcH0qz&evcvnr&QnH)2Oei;QO$sgK#;%jx)-{U
z-ru6Q9xzLz2`A08iSp#EBKKgLUn;b@bKKb%ilV$I*^NIWiFaTB#eF^Hb;%yZ`apIh
zR0g`u1s1QQChFICBK`V^iT!ynLU6tf)}SKhlx48VP*~?Dxf7Qa;u5%vxB!qKANuOp
ztkq`t)snZFweQh<6O|7+9m>J}p{TH4+?ufg<QG*&K`Y6J_QE4uU1mbvkg!hzPKTzC
zqRJukkE0x|myeYkjxbdkOg7kq^NM);94_WL^z3*MqplbR9r95Xq3>9juUXWN#;Pb4
zQRGXaoPT~@Z8X4GM3(T0+bZ6#37c(GY$Ptv%tb#0QDfyPiKB&ipkg6!&}2M~>bskh
zbHZO-VX6v4-v~dTSqIP6(3IeoTlA&0LuwP$m!dF+^+ARJt?qsVh{(X726?88FJ6HA
z)Tt7SL*anRo*%sc{&KzjK@S|j&q(o!?u+~R244)oTDByW>};HIj2+SQD1_ygN}U@C
zi6DQJ+4#vb8OK{9ZA2?_r=meUbhk_IDSZA!t?wK5^q|H}GHynJO7-ZR3(*=jjN`F4
z=Q?yO6CupVhp@#@giY#u+ZWYqQo4h66dAj^tz+aS;NYWlk$r*SR#Oc3Zj+iVa1TAp
zhN+#IH{r=RrB_U5$z64>-tsJo@tLsk>u+m`6YAK%@$+mZxY3bu%u>cADDzD2Y_$gF
z#`cDu!j~eKK{8sDZeRAwMjd9ze+hC)*&_;71>tUhc0%adZIBn^7!dfi2U9M(NM-!4
z4CiTX+f!lf6UbDPoD(kt_@<FxXt`n#%CW-|^y>>)-q}=GVs1}o((|$uZHG&L+o%Up
znUQU*^NQ0*OK#ZaUY@l4!#!(KFYU&?=MR^ngg^M6N;Ro|byT=Q*1l-z&y!Djgc421
z>h`Ot5HHgEwV|paTai+k8=)W`9J+nm4&iU)Agdn@O)7jyxL6X<0YcF)sf7>qo^~XL
zr;hbJ&y>=FQ=Vx&@70nZ2(%0c#I`tVBz@l(8!;k{8@~O_8f;P1$I!((z)p`bKUAU~
z9H3^+wo6!W<?78_zGzf9ra3%sAZlzWb@J*-H_ga2&~#&oTdTunH<mT|L+6|81!A!E
zP{#F8PO$wuniMkevHe?(K9Ry>r6#5Dn&s#rO!g?oS+65I*%qJgs2PMED^6}t?GUD_
zP?;2#IL~YE+_-1ZTX8cvzEs;wH&}+~cj+?(OKPF+8}FiV%rUP>McAh~=It|_pYfD4
zxRLHA&$|(O$|9o&wIBrVpGBPgzf+L^=P&UCFmR_H`hy>^55M<mU1Iwx$H|}uD$!lL
zdY(!RPqjKXT`pO38mICaxJ3y0fIP$ba($f%L)MCz%1)VGhWZ3C8T2EZ6qDvmZ-ixu
zKwm+buj0nuMJyyLnSGM>4c(Nv*`dj{n$!j8kTQP<c_SbQz;o-|mwa)HR=m?2qIq9W
za3QwG7Kwy6NG~g?4=M(k`{M`h8zAo_(Xpdf)n@xu^=h3qnSj&lt%=9(VsB4jxM>u$
zKkuNODrLITK%%~R2ZYRz+AoOGN^({cRQnS3h^L?cDXulyCycSoPHr$<5&~xry%G~_
z3HAeYJiTP8uqeKHc|d?`n$25}7fktD;bh+~0FK-x;eZ~7S-q2YbXTq1#JIhWvCWzq
zdv)B85>g@sh;&Nz-J!KOha<5GCHoW`8Yl<hBO{dvOoEWw_7h8ua>lp(?V?KJO-Xr~
z{QXNo`ikXhx|bDX)joV4{!rn=FMeFG2^<}MgkNR3|K}q9xJ)Y>S$?v?sOgm6#zp6T
za=Gl533|#+Jh6lu&jDX$BNTCMUv61b6TfDYkNfRAsC#z`>AUem(Ete#gOx)V1DBbv
z3O1RXG5~2`+S|+~A<bqZr-{jh7%i3dsfCiG(c7a@+D_iPlrptrzxK}n4b;jXsE*B!
zg$-=~cF@sW^|l9a-x13_9jZXx?E{#anxotFo;Gg?$ah&feg|p<dYgNtoNH--gfU=0
zE_+Lb&+osC?pH_nk)~scAk)3gOa&}`Hy^d2p&_AN7psqijZdhd0UNIQI~(5QM^9!Q
zvy>PDh&huN8%8W2@1Y#z6$xH~P*ss<^#M@QIR0B~vgQK&rtFuN3z_F!?5rsK?ayij
z)iMDz!8`p67EXT!@v}oouPDqN+-Ee~`C}%wuTzf}WtS!vuX>XW1FRjG5_k$*BV~pn
zkLAHL=y!|<q%ByJH$&T!PB9Y-(#XOQgsgQ9k86l;kRPeG*k{NW@M*v8(*ho4Tk(X;
z<~S|$hVI;gsZZSi#97_5ZZTg>6dDz?DYVtLDOomA%r1Yp*5bI}KE`VxPdqA2`160;
z;pL`0doaBJD_MA}P4N|MTceFs?K}4YjVvY3_e_73snIX?QPKo9;qPZtm(+4zpC@($
zo7?0qWLg_lAOhd4OV~5!hnWs;qp#vLK{#g(O3fG2O{#>4Szma5l8k-k5zD0n%w$5+
z$hjmq{CfG10F=jC9tm-NJLtJNofx#f#=S|qRjasCb>S@qVC4ezKmN|@BYxQQU;agF
z5W)LG&wqZQ2kTSRq{g4UOE~i1y}(~ytvrVbZr9V&bVhGU^6tO<g33jeq}+;kJ%k7}
zS@D1PWD75RMPG6M5;-5ao-Zt*+gEU)|D#W!c+~YTFa-sLS~J<X%uJv(lFh?Ac4v(J
z@$UJ54=ij5g4@~p_dZJD1Q|D@lfP%S7F&e|hd*Ab&)&Q9oX6mP>bW4J;L#QhRPtTS
zL;#V=1XUr|yks#yaPr?cvcIOZzy2Z7r@VkAeD9kVP4i}E(pZ1O(q~LF<8yNIb0$TK
zJq9K1cQq9Z`6q)WfqS0aA@Sd?-;e3{Ud;p|2}#6H->+4BL;SvrR{PPo|INY|r~NWg
zD~V_``ZjTi7C+7xw#GWmW7eXP1?j@g&5MCxt>*mmqjlaAquvr#+D4rCcSHj4dG-{&
z`8N_#2rZatH)2OdRagN*4&ibSxy3*uH1o*evLm_XgcCi7RP9DXVPn~a9(ss5jDbhl
zkhToR<xdDqDP-ix_fl4D>qy-X5u2dQeq|G^?dFMBIy(D=^LhD}Pf&KL)C2r|wFF_$
zQ_Det&lvmsDM)BDKgh`yAoV_!c+Wq$AmL6HXcp(8DdU=pgMzz3f$*;3rR1?CwP*%O
z3hVakn$Tn#VBU0Nm%=<FtsQ8?Q!|ICX8K#YuFi=%OLViGK+_hK!-6F8CVwd6dC!#`
z@(xl2LibB2LpSw0z;Bg_dW^dT2;Y|bFNd~x=zt7?E?xHW(cG$qYWWYIQHuj{#2i*>
zqoNNGh+Uay(U#3Ns;W`HP_j$pdMne<saqU1rZ>n0TAi!%0VnqV7>~Rd;#ZS5I4W~k
zXOY+5u`&6=j%!b|vdr;)w!CA6HWC1V9mspVuE;4KGi82I5iz|Ho-l(Ev!)gnfF4G6
z&JHrzDjq^aEs2iMorEydsEp*y2{uCUjzWFBx&U*uQF^9A07|ZeXF*#>eAutBXiEuz
zNF!wKNdL<P33Gl-DuuH267s*Uu&ze@hjo80_oT3(G@MsI{&G@!8M|I__m2Q3#!6)D
zRg~wn`3r{mkfFx~iHn$i9NS|vbx+ajRKwBJr8<iPWpfKfUbsll!>I4MGD8V1QB6De
z^P;zpsl0OTPlpy0?JH|m4Jpdn#3rJE7+U=^;Jp5tJ>I<%f(a3QaztW?6GBQ>Rp;Jz
zd7_A=B$n)r6O6#!7YPalEBZ-}vZib(BD+cAXsxrxS~X)uqlFRrm&|bt2Qo)}{U4=s
zYgT=(1v*6GutpCBPwVP^_i#r4N+W~x=mtn#WQdT^B0DS^^lJEP0Y3zQ0G*KW8O!-5
zTO_RSAITDkID<hgf8298FQuHf_?sGeA^+mNffqx2A!S;~pTGhASj$4#BMSE7EuhP-
zbzc0W@?*rqoT|au-&**RHjxY7PZ-wg0;;{5aV7wU9hJO^xy7_LYN%GGuf*@Un_!Ey
z;Ne3%Va6}YOgzQ#0}H_k<`yb$5XUZzg9n22e>NET8kV#W92?Rem3)RKwm>!V#}Iae
z420e6nX-m=5n!w8Jo&j}_6zG?);H3hE&TMmvG_`O#`_%yIJ{qLe~66d?L-L;APEt6
zFxnJvz<jQoC7NtP_Q@sli*@*34?3$sexBrb=#vrq0rXHaWHdw}I=SJcD$i3X>H2tX
zhMS7Q%N_2i41cN;GVqYq)t;d|4-OZOdup(F<{XOE$}mmhg}O;=zU}`9_>pz=IPA3D
z{x0`tv@_U*;qUB(wgXsteKaNUFTUWD96Q9S@tD_g@fPyFQPa}1ivuRA5I1m0OlHBO
zB*HVnxBtyw?1zGHZ*_t4T<+SBuYYp|q%7nQ&8A96grDW;BTL6Q)4TiYZBK|p2a6h$
zNtF!7DrjA^1`4_n4I)K712!=P;4X4@PKQ24g9(`S>7@D~tO4#4I0L9F*aF<(%GrUB
z0=Nr7L)WJSo(k@;N7Q-BTJ+Rf39H`(*rYsr^Da43OvBW|E*;lBgD9*O7rSo>{3d7<
zbNXdFA%q9apLe}{_e%2gGc<FUdUW1f&SDF-(io9T-H~Cu#l(lu=;~1#Qd?zpxQ}iS
zRx2`*Fgat3u*BAM&@TrlP)}3qvwV(AOAO@(4<BYEq2~wAAfgm!ZkEl2!J6i@fdESX
znt#ha=3rW11k;kslz`DMV9|N(^hp7w7c`)pjD7z%qnYOm5A5MVy+><1EjN|pMAQ1N
ze6ibKLK>1>Kt@zWYJ}kg{hr6g<XQ{tYq}7cpr~6(r&wYMo=?kwI%0xTSj-LigVRt<
zv2*43a4V&M^en`s-K8~*Fc3j2VK@Nlc+T<{C9$Z<te1>YG;$1dA-Kd?0)K%rz})c6
ze>`W1!gm>a3P0W+Jldzo2zrq{gE6k96XfiH<@}Cg@5-D$gHl~PxzYJ-ZFc;1>cPeF
zm$N8pzU0~);?RvB(cXh{1Ryt&hGU0`0hf?oK&A%oZdhZn0IlFo6BH&Eh+W4+`(gqy
z%~b+CGII;?bqGz}%CCiVpsl-ZV?J~^Apm0-<JL-aoez01Qmf3k<?8d+32g5wzk+0;
z{<R2i#nyyt4hxv@hiwq5L5m0|nP2FOv&pKy`Mt9Otey@ez31<l`YbR%T9T{9G~C}G
zbaYIXSL~D^y-uEPofCC8zsHpx$t|UbO<zh>0Jy^C^$l?Z;jGIV(<3Qy{YJzCJc82G
zp!Gq)rCU9%h;4B8d5)A`^-EZ**%{SCN@Y3D^*qj3mOsp1cReM%q;04~CoZ)msRaL-
zxy>R|zk@y?W4~qjdChj38h%0+KLI$RIK}De%bGUEWq|Q4OkP8WET$C0LXkjap7f5+
z*KOFd1oB}7mu;^(STL+TU5P<C9$H5_!&pTIRIEXeZ*CyeK{}(Vt*iDTEP=ksiXf+3
z*+oo8oFM0B(JSuV>>14fpvtUd=1t{i9rTaRbnlTv;<&x)fg?nZx@-V)UP6^aj0pmu
zidL>!&(#t@0XAPTK-4$1<b#3i)=@_ZIAD9#izgQp2!Bbkp9?Oh7&`hi*Z6?$HR6Y@
zN1*9J<Z2Ue6cV!sDBJZb9YRbNVwHgiw&T_=$<fFl>!Y>fHy6iWtn46%$ClL9{XjRC
zd20YM_U4OA>G6LGfqw<V;F0$lz~`CVH(k6q{^RoX5@}CfimjBdHQU=)4$X<1Y#0m>
zwv><FV72ifFYI}>qiGe~U)tulDxD7iJ735v$a^HJ2fu?BI!Ye!WBpEuAl#P>++%yP
zJXUy69Th^8T#hXlrdPaH1O)63iCfANgqS+kM!vW~Cxo3VGGhx+C)z#!l^}isi>W9(
zW>7i%!jq@rj;oyubExJaU9;JntTrvu*9l~Zxo%|`?@g-n8FJ`**GeN4#<Ct4U0A?`
z0V*7KA~f#4xS)y089*=($<NnYMbk?IeqM7q&=aH=PEt{e2ParGig4&51ET|&!)=Yk
z3l5XTeXfWQch50jo|CK+K##_nL{DL2yPaYAi9p=gx|TPFB5n-}<K9N$ba?Bh=Mf5@
z85!btI6XOIxPFU-oE_$E>YCcagD>JBSo#V1H#T~Mc`n#3wWWh+ECLM3QGY7wPsqZ?
zVyDh@W-9jP6U_V4Q0PdiXJ&A?*+;v@qFbQX90Gz!OMT)$I*9xq9NzfyCpqRa*Opk?
z#7!#h?<u#gZp#rPC5SnAL@mGp4PNWr2iho`$=i-DtjrodNwSaoaPUhL9_X)LRItU0
za0c->^W+sBhS%F#vN*QVjlQ018bzWQ%&VT_Zq6qh8N+}wqf^WcoMup_z1(<~gDfNq
zWgZHj*q3iUH^Ps&f`Gl(CxGg^^!S5IDvmMm(RyZO-XQ+_<gh6a<WpY39~N6KgVMx3
z__VvFSGR*3bTIm#{W{!RwKmx2DnDTu4B*(_@Fy)$;1*AN1{&d+uO{hI!P9F|!Ok0G
zP#briwbeLlTR5iQBR%uV%45&i4t>hGhdV&-v{8_s;H^J;V_VGhMGxt*hgRS@h8rTs
zJrh;7))L&AgDQO=FR+>->+RnVjo(KvvHZ>e0kC5Vo&QS@tp9uajp~3@zx0#o65QFc
z3LMj3+553~I$zW)=Wfjh3I-ZTte$yno+*%B0)w=m7d4-sp*QJXs5nSDKdb|9bH6Ny
z{^)YZeC&whQ-|23&)3tPqj4i_&<l<q|3f{1p{8KKx!5Vwi$1)be(ZN~D$uCv8c~~D
z9qSs%b#&}Y;yZE8;3j>wSyBYs2QcM*lj)tNPA`))!;T;Pt&d9LQ6Aoua`-0~1{QQ$
z;LQ@L@Jns>pC2`a@)q><how#l!yEVDr9Ml(9A*$!HMA`h6$1WV64j<Wouxn#gCb62
z(wOU!)0pHyY01DF7DKAsZBNntY9blV4IOk5tC380?qjND(VK?d<L66HEe@239;yP&
z4N-o<1<-+$AkbugUSl&kp$C|v>%H6`0VDWGqFn#Y|E#n8i^KeV(|K+HOax@V@lx=u
z!sjqluR&BU^aKJF_^3*^WZ}*GHER_;xA#SW#CW4(LZGlmnN+zoeO=u47@WT%SsMF7
z$O=GhajT|@tB$htwyy(lL&&D8%Fi|0*aKLD5kiS7)qxBgY=XPkMU+IF2Lpg>W{A|s
z^B{I$U-&7$0Zv?*y=<?<zi4&;CgAw->#P*-9`?8IE;;_I%L!|*F!Vk-!frFJ*m94u
zI<XoV?gLv&cLrTiG8g;0wzMhG9o(Db$%Go>X(stFw#L4dKNRvwAoPm>;hb22Hi$4}
zCMxNJ@J5o(66Z|`Dp6`I(Y6n5i(bOTnbTK+T*LI2dIKo+1r1L9vnRvftJHqZdb}u4
zf0A%*sWZ5q)COJGFGi@!Y}2W21G4rcUJtN5UB@UV;S3(1A`jgJoeU;rlPCi7`%j_w
zIPX!YzPagGMr{=a@y-X}s^i{^je&Udk4Q3x?k_88A>2TQW8(^{1i}+n!jy3`n!-5H
zS3w4yLQLJWdj1<8%2<i-7d;%;FN#pwp5S@&b-x#G9f~w#K6V+vhH`k!wUZaZtv`eK
z*1Q1AU9_ItFy0bzx9{Eg-!GA~3|OKm^R&hO8}S~?)%sq_;*-ZYw=QNXXZWhyHF?~t
z1<k)Blsm`d92Q8UX}{acZN{g4$n?QC84WbL<yUo%-tMXDIJyveq61A=!0VCAA_Z!U
z@a82zr`>|Trr}?9M`PMg7L(iTS7Kn2(A4%CGZ2_rg53tO9qbMq5warKGRV@TKv9Qm
zcELdL&G{D!TwwMCuJcO{oxyYHZ0k1<{|AR212$W+(}%4~A>78%gMV5WehLb9p*Y6U
zJQM2YPR6fQF4+|E*1o@aZK;1mpZzFk=Ggp@9<Qx-_s{ih2_fJ=`bIcGHz89wK*?cu
z;|Zws_~E^ct+sUevU`8xzwQ)2a@3D<?dz+OPdr9dghSf^uBz%B9XwmQyZVyS_+ha7
z&GG1^-5&=&P&D_+^Z#M@7YTuBa8qbstO{z<;3Gdux{7CuxRw!iM>trrbotx`)3rTc
z36l?&*ar%evt9s>I~4VTe2ac3RuUk(vy%1{Clu@~?EfTF{>ivxpU(vEyz$Hbp9^4G
zv+7Tsfv2nP9`BcWcyqKyv;;J43cgIl4Dq)pQx;l<>GkR1o{|Er$m&l${Lp&sWpv&)
zXfd%Gi4LXevB`16B=H|RKT_k!7mp{Xh$O2;?H-3Z6#duv=9T{$!7;Cg&&#1fuA{uD
zQG9PX>u|+@KCEm9SvwP5@wgkh>4<pOrgG0hZW@i*!<q53^N^l+2z&7kvJiIlJYNnV
z0b<zqm1jl>+K4nM*r>0a@$2aCT0qJ_8w&b8nIrr$yK4k2zTOmai4uPf8w-Uw@p32#
z`9laj9<-x>Y?s9k#9?QnP#_=m=~ycJP89Or^5u1GvqW%4?(5Q?51NzT?jeh6b3jzs
zUJApC!)ATgR!Wz-*tm10NrIVWbftj@^nM825Ea?ZR!Jug7b7A-%b<CpS6va;G6ZE9
z5K3anukVt}>3HLAdenTg!*O0AEx~#vM;m#`@|mz1wJHc-HpDroK<7vIL$XI8gv;iE
z6P<y!)bLmyCKlmHgD?7yr!q}0Z-|Kz%szh5f}K?fR}@<{<1}*>)iV6v20Ql180&KM
z3SMv^olE3gwPxMQ_l@JU%~Vz%$u*(>Rr>s&Pw4l)U{{y;?vGjQg5@2&X_Rrxf+IL%
zy!SHy=UIuX*T)>jRy5{*<CX`BR@9<LVg@2CS-#UutHS-}bX%@u$$>^I?it~SR-S{^
z1C&&|Rjl2n*gu=pO6I91mLd$RZ7AZOT#-Ij1lLrw(97BLwiJn>_v$NpetL4?Ve3_o
z?GAay<gX`T6Z>Hr2F$o&`iSJIvWb0|LOj(1LuPAoZ?MPHb(m(Dd8;0kMS7&3f8q$_
zc9}m0B|c`=XMpRbAsx!Fgua=%k`ANT1X@bpU<i<a*^>4UcC2|7nJUnjWgucx_`L9!
zSOlD^7vOStcBd2Ocuj-w#8vrt>QgSfgdAc(l%q!3LlhBTJO*a3UpHtrkL6ddByuOT
z2W*S&AS`|M<NF`iN?5q=`_etrxet=$vnCTcFldi3Dxee->+iwYA=6zWcNK+iJsAnY
zaW55oug~-oSEu=nVCN1GtnR)>8&Yt{CIw~sm6eQ>Dl0z94;UJt&%1v!Ot<^2RFfcX
zwMBF2k&0WH1+{rM=zM0uPH<qx8>z*tj2SL}W#ai3r~}5Yvaj4kJ?O44AbzTZz&-Zp
z`e;-Ez~c~oS<Kh5L!*bRw*q3>^9v9<S3``41wi*Cvmg!jbf_N?I_pRr{7NAVQkD>z
zTS6x#PreB-_L6!GYp9%xm~vMg5zpcFT0w*@DDQGiyt-WL2P>4&-!Bb(hoa0?rsgNx
z$d!TvU-68)Doq}oN16k+9e4@XnxI@SyT0vPzfQ$;%V!4EvIkaQiT$daukvLF9?6}h
z-tTU-Fob(mG#0O)eG;u#8!Hma8N><VG-);iSIvfRh1WJ=4<vZr=ccRB5Y}HwUCh`E
zeMzaE?O~u<MdKCC50lZLN~R^v-lMEF6GZ7PVzmI1obApoRd`gpFV7^SKtdL<xpj(F
zE3BR=4+%1^Acy#I9!L#qpt+3b2rTIvk1=d_SrQ)n!6&%;{Z6FOV<VrDeB@lfH@!m!
zW|cFRGnDCvhe8}}J=>icSL3ns*#mBUGqnSG_wT51+YHvuq<70sO}u9~-XP|nr>=DO
zv*hh;w-D9u(;Dyhj=)7xBn%v?yBu}hz2X4*NvaC|9C5GfY3^Yw1MOY|6U+3Cp@XZ3
z*GCgsXEDv3baNScGw;ws{3}iP$G?$*-VQvrZ^b?CPtH9+IpdnnUcvV-Z;3Zd28#p;
zk}c08WlJAeeV$q7gAsM^o9~7^MAK^;b)H$XQ?n`^byZu)y7uT}DqMN%he!eCM|$t<
zZMv}Um3t7~vG>1e=KB>>wqx_<dORB@2T(MLRRRR>=zN%z#x&{-$qOHZUS(A{H8C)!
zKIi-B&jxdq;pZfXHO$lN+w(hWxf8-YbENgkq;F=^oh8(V_h&gr9v0ipv+lPE+pTh|
zCfx1wyyHF&i4!>@jiRxgzJX2|19@hHtD3ku>fZzTX%Yo)JMXG7cMi<fqR=W14K-W8
zO(AH#C?vgJ*?wI<smscoRPL>L6*tveT{_9I#CC4TU>2j-!DrL_F2qh?W4PO}ls4On
zNqiqv_f3!=4!Ti-Tu}R{#X!UJCeDrQ7#LSX-YenU^A_C9_Jf8McB<$;D}Qb)akc2K
ziAl^lYuNDf_j~6#LGw)i?!l8?csk3r!bSOefS7Ovn_Y9il`P|@`!Y{cEZYMMIx5~b
z5tC=+na%I)*;+{IEZ(qn7p?HAS%sto@`TFdPF?xE_*i?+bp*<<#xPvCxRF%C$a_Ed
zjP(df{wC-ru~EX49d3M7`&+)3^*4tO>@|;h|MUTRg7QVWTOT(lx=bRYc*^(vpgM7W
zXY9mtUAUTtE318u5#Ga{S5IiXc1dlPg~JDVa?ZC-WPI9B>1D_J`6=N%FQ};9aj7F8
zp3hT!%FQ5KJh+@<#h#vsP)@Rdh62s8ZI?>|8{rU+491Rmg;V88wTh?7EQb+V?$xeS
zbUv%dn^y7m%tTV_eYI%D(Z0AZBlY==BluVgJjhDC4wL1<KI>A?p`|6wWi0f;KTM8V
zN}hmXa(MV!W)r*8T)}p!!FI|dtD+W9PrOfbYY6=u!w8uUkL$5in3czQPmkr7?KDT7
z!Mf8JW%SMtzY$o;;X6)h`1zOt3Zz5{!DK#~5_p(CP?!mBp&|@<THBgYMv6vnwdD4d
z$p)!&R&e*ebYb~bNP|YpwI2F{Wz+4#zK_aE51G#fXS$_XG06qls9kI}1`gC4qd8}a
z`i||x7hhx8ja|fc73OIkE*TR>OKo;@zi&mKfRrjDX2&gZW9q95jbcR_(Vduw*Vo^>
zm(gp*K{XJO1BzT$bVXb~Gt8bf5b>}BW*s>qlu5>sEfvH=Tx8EjP`=YE;vNN}xS7Wk
zMQURh*9W9W=Fh1d>}&DvhKpKqC(u1kctVDO`+52!?sR6w0i9Z!`{(qyb(vnQE!ByA
zT+TW7mQ1ecw^muaGTilQ!4NlG{N+evfTyPQUJTL=vDe&_>{me*7ym3bf}isl7~xi8
z{Dd&0rrl~>>_kFipV9dD94E_7jYShi100i{rVrQWBTq<k8Q<#44j*$CMpX+xFDah9
zDX>E0G#}vfK8R;VlPFK`ZUSgSt5!g$23b#Ibf>Nl`#?Hse>$<T-UtQz><3hmR{<JI
z|9AzyL56Vr<vKvO`GGu_APp#*;T-12oN#qH0|sM1w6VF|&u`l28|x>PY;<&o%-o@a
zb}s@pI-1Q~Q=N~H{gcx!%&H!oK~Z`A1h1<QS%b;h={5u7@U>RON($@t(T<53Dnr}6
zupZY_{p=jj>Xm+dvvbno;Unuw8YmO`sCwUKg|gjGouliUKTf_swA@J*Np<V91o!{#
zu=hHtGXBixszYW8?JMJ+335*f*PbBg9E+}u8AuSWp}07k_8}_j26Buf%+){6O=o8!
z_1t?!Euji*9PYM@DQw&PT)sk@i)rlI7+T(aPEtj;B{%r}V4r)DH)0SLL&GZ^9X9O7
z9)|~0GuPKKNs<%NwSLo+nQYQ@9!xykDA=x;iK%SMuf3W!NS^snQmUq$ABb+SdX&$}
z#O0kp1hGgM$sLdvdG}U3i4&vY2q$nu$>D<-6<o;_`#e32Ye;%87N^5Xre6gTEOq>S
zLwc86u^7CpV59>^nLq7EY#iBMkuj~y9mG`Tw|J=6o0#v8ITBF|>LC-hLI??ykS%fL
zZ@)YOx&UmQGUNIf|08HUL@5*s+SM7MggOib5ch5&(wm$R@$9E%<ot?0x%u4+RgVfx
zMT99QwhObpfx@SAMgSCURa3uL=X##Oc{W@#2%vmmL6;Kr7pHe14Nn;{yN^*l=3m|V
zM)fGOtWCeqA}7U(R9y6M?pLp1p(p>m-v!~Cx(~NBuBsL96p=2>W>-^{AE6m%GFMy6
zR~g<SfrDY7o2z1>`H;mur^1E9<nNX!yWS9-85m7iFK3*@;ttoM6wP}NP$q4-<BtYP
zl43=URHMGQ^-|tW&*!7}^cYWx!#Lg0HA!Ve>4B<Np(A<>Ci!~GDtXtSUXe!Fh|NIq
zd-Z)i+$Y~0T(wn(1!6brm#IAzikp2i?H`)|NK)B;ee|^hv`M-ry-7O4H#6@<7<S%Z
zUKYVhgF<xk8@ZD>v<BP7)~u*L+lst)U~f{6+NY^vO~mLu(mE62Zu?bG&i5%50@-lv
z)3q+Q%Gye(MX_m03+lV{zzTy-iPaC^4~oXE6Si>Fxim~d?lhk>F<3VOCvrc~j`Ux=
z(9uU%e8zuD>Z8=~@=dVwo3yl+Z#lZ`sNCF|%&+ZzU8%4(+G+b-?$;Djy5*$Thy1QP
znQu*4t+2K{_f%wSzI&kj<qs=lcg6S1?82|6glXxYeYV``Sfe+)BQ{Di+qzM8=j!DY
zvZ%yC>s#n_j+rf|JvQ{Py8f=5*a#2(L@R5t3FV`8_571=3inn_l>SM@38uw;HEr0D
z0&PPZt%&s)7I(W4zsia;B_DZEL-d2B%Qwz|ndxlp;XN;%)Ncu1%zl1-dbzo#tCC2)
zLdA*%-&fOOkGxiW!0j@XsVh^wm*b}E`~61AyMaySk^DEp&AnOkB<WSB2+Txo{su+6
z55+GKl?ZcnS^lSdHhYwC-5bpstW84Wma$ISR%GG#9r-RPZh}{XX4gD=Yqu`!^`LGX
zy1~Z6M~7Rw5`y=Lx~bg$<>CBfN@BV(dU_3t$vUhLC0)~Ih<#R2V!sh&HeV}t6>owz
zh`Z~Vx5}qObtkJ7Z*zmVo1onfib6Thl+D$WtXeYV1&(kc=8tl(m`|V_^iF+tiRPGx
zeMZ&U4&~l(JzBQY{+Y7T%x;d)d~*!P#~}_3s}BWVu76Yle>%#2-{XV#Q}b;S!a}4n
zgF8NfXZ3sPTG4i(`t=*~qGn_^?%+HAVATfi49o+@t(cJZ663WdGhMO~&{L$;uqR@k
zM?;%328mG#85K{3y^1?huI6P}2I!*cJEoBR4kZN?{tHk$<9y_x_3+S6xUwk2C*a)O
z2tJO|Gv#wr#NpEwS+isQk7^uC3NFi>;J=w|Us)n2eYNva+t9kG2gRuSLK=Hz-&2se
zLRl>zVl&NCTCaH3b~i_I`z<0hU3Mj!d#WZr4VAif5v{e?u5j?y=a&}(js+V??~{9}
zv{rX8+}?^bS>WXi85enbR$Tt6JDPZlmCfE4tBKP$Z6CB=S3}MJ;?f|Qil?}qJ+awV
z+S>%$X*6=R@5x5vimZ^N`>k8(AC;3Pu3b<-3buK|iqJD^QS-g+l%1Cf0rMM#G(B^T
zT!O=7g;a)Vs8;SKWU%aKuX8MOHUA9JW#UWcwkUgx?I|x|mEDuxmpb=qna4JdvAb;0
zQN79{4mzA;Bq$xsY4@O0K0n^G{kg65J~JwA&Gq4qvd48(L0t|PB<?>jz-?Bq)7Cdu
z2sl$Bo~|SiE7*;FbC$>-J!3Qjk<j;Wriq%`eE$PQb(_i-3QwnO2vB?x$g;y$*_PU?
z9=Xu1u4ASg!|>Yj;DA*WsWS6EVM~Eyyh-Khi;#M2%hZ%%>f_m3N4RAb4kIvGiP6Qp
zheR!>cJWhF_yWY#G9n$yi*SwvZB{(mU+@{%YbV!;l;c&+tx?lbKz0nRfJ;=>E<BO<
z<b@ZAcn{h5r{~z8o(Bl~soI?T7Kz`^e=mnQSe!=PpY&#bTZY;^>u)A-KLOuNTE6V&
z%Go%(LHOCrc_ra+|34Ou&6$6B$mH@@!j`8I*&1z}E2Ty#@rp-WXXvmM`f)^4YRxlA
zRKXfst4mMfVAD|d8_oE0??MrJg*OGvXie&SS@ky~207~e#E`86^--0jE0XV|jay?X
zU4%;Ddp=OxAR8{Oz2GuB|6Q)?=F2*(vh~uJ8U-yR(x4@ckc1|iYcWq8uWwaxd-MIX
zXsd2U@JspZcP363CvOT5(|YRa)_*a1?nzPOSO;ONPIiUm>7C#3y)4((=oYmwjB$c?
zk9J*CdsCnfRUmexmYFHK(WMr1ZK8;O%KvJoi`VCJDN5p*BLzxj59fUb-x3p=PR{D!
zr8ue{<o5E_ll)YRv6m2i4o9@K%IRTdMNUYS__G<Av$Z$!kz%&^u4sRZ0#rp@SwHN?
zoj8rCJ^SXqx2BBCMW~n9#UX_h2}Fv4;!Iqhn!V1;SudvMq!n9B)kkbrfXUB!<wobH
z_NdREwX`<BZf*^3=p0IFQ;T!eQtzLMy}ZT2qTFQ};~6>Lt%`rV&}}rz;i*H6LvO$Y
zSQ+C&_R-~wYZEWJBfhUS51V|!V4q`-Yj3-!%y^OyQQByjAOpb%dRP^U-5k(5pE$d{
zGiwc|kGm(YT_(y;q(y^orpM|-ubjBb8tt#4gXfP_e_LTP`FR36Hr49pwf#xmV5@#(
zdcO$fwIfT{l*P0){cvoa%Mna7o!k9V^U-AN=Q*{3%clu?r-szGDz#)=l%9~>aw24U
z)#lWpo^p0`i1+t(@(98DRB2YRCbL~H-M%E0N~$YHoBUyG4Fr_#HzSt6Z>OBxG?!R8
z^<bNleu%5k@ZeMHw%M@SbEWxW6Zp*~Tc+f!Dkn0zf~4)p#P0@>i3!Czgo`Fr!tlBM
zjO)z$IQ4Z=DNq+Wv!QZ@(wgtAaclIlPbO1aUX=|BcvDISPIz6^Jl8nU{@usD8Fm}0
z0JZIt#yr#AuG^Kbu*<S4kZm)wdr+4a0L?M$N)ND_?Vcj$w+d6MU1U09#Gm5D@9FmK
zBt3Kcq&@_JDNh%E^t?N6T&DX9|J8mhzZYj;I5jn0q<$dqlQA5<Y1uBV#TBs-Tt=-4
zQ|nRAyj*B!t4a0Bn49g6WpW(%4-*uxd>&HVF?UJ4UOD3<0gipNQaakD^-A;g%>Iw8
zk@BueW84|xRHqQ~F&kN@c34(z_%5X|HjpI9WI@`<hn^>!6=A2OG(;X5NBn7hzhqb~
z&1!CwrRhB>(zxr#>~OgJS|A}79W;L05s_Y-)@<_4QH^7gVRlnW#xM9f{}l{ru9zRA
zK*#0^<#@@}`4xO_Q0pO^70%@v9K@HiwdGf~4=$h3Dh!O!|8$Wfmv%FCEacfNUU<K!
z)+z6^ts664)Pt^$bT^QDpzYh{2ts|uP0V$TRvjlVW=u?Yp5A{Q728w(=|GlQUIuhj
z@y({N7|E=3zUEZvkC!Yam__HLvqU+?#LMUu%PdN{yRrI36B^F((Moc>W)pf;U}zcT
z503{EtD*%y`3+U}mHXv5b$Qsocd9vDbNJ@SkUB-25roo`*a3MaKt~F6JTe!aOLW;e
zD6uds6$89_Y&uarg9bkr0=kU$MQ!6nqDfIlmZKqlu(+e~LaWR4{NpZ{^B$vV8czzH
z6;RXJtowRV!DkWff=4bK?&dRFyI<E8d3slwy1_dk&E1bb4woP)6Z)-%5(iGbp$;Sl
zQZqg^(j_ve?qf1*`ByiL?NJbYL=Kg?%Kr9o|1HA4_<N<#zmy!Kt^aNo1f3t>@;%K?
zD`)4Qv~bRP4EFp$xG*j@=$K2`jd=(8Xft)PHaqgp9^F6Lj*|Xy7A=gZH$8rFMpLap
zHOnV%5Jk}W_8%`3ZEaajBx^~@hML-<w+${{+Ve4JbAK7|=AGJS4xlQe&c^OvlckvF
zCS^m~QlE5z=!wYAQiTtq_U(RgWGFkp*{ip#=n^z^;DU~-b0P93_YkXtScFY!zRY-B
zW35U~;7Bp!<}&;Gp#j=|mV6Z*)+;9Ux*BkdxC*$n1CKRLHExq%vEz|VFwZQcsjGf*
z5<V1kNxAbe^Sjo(($s+|>QF&P_hdK4sRmhttfmbiiR+(u{dv@WM5i%sLLvg<bp?^*
zo*~c}h&od?S%*5qntG39Io{jMB`-!YyuDMjhi@v{B@baUm7Dgkb-=R0n#u_)GWPSp
z7hRB(8JV|H#MKb-1uI0SEQY2Ind99*b6%f%9D0BGklV;xS&65KFRh9`NGd(^*=Mb7
zF0AadV=aW`tB{G$T9XN#lYRRCaP}ThO?6$nsEUe!5&@MCA|;9x0g+BbM4B`aklqDp
zp$MTSDgq)+KtQE~h}6(KM0%56LJz$MNGO3cZhYVG{m%EF^WSssxnqva7#nuju-06&
zJo8y|eU$)6S%}nM>D_6*0qw*s4h5t=%qd=MNe%sNZ8T4w&hnk_mNb0T5O^gmu#H?;
zV7gW|SratAcWqy^Wy~@;TE2}zV!3>3!&#kPghPmF1o`ae3dDnUagBDKcE&%z9AR9N
z$ZLGM(GmUo#yBmnE6nijA@4ic$(M4%yXTLPB~$}N`$tRK+;Z%YS$9@i{sm+1yX1X>
zujHcHh1Ip5+`GAgI-dsIJ`Gy9sb*`qJD)DMo#4FOpZD1VH$KUwd7yTt@Eb?)PNYMw
z_Au6GJqfL2WvN7}K~|mnz>Sgf!idQrs=lIx)7*W-d}jU4cqw&N4}(i#9y&a~Y6d6*
zmN~cdw`5h`vof<Y+ph8`&4q6rH^6V~+|V(0=y2_DMRIgaFT1Y!JrO&P*j@56*9iwi
z5+Vs^IQLm(#3CESq^d6!6#h?45OjW&-Eoud>t}El>xyep?#tOUsE!Kh;9MlfPg&3C
z`C~lv^xBF)`56bwJjAi2(aRiCqJcYqnd4)_>%;HBuwt;~Bq)B~z<dWCnxc5*|C>O(
z1hk%PKKW9vT(P6tn?rzvj<i!wAh5bqOj?sG*)vVz87UIIGU_(C!=OB=!sM~g&TQTD
zS^Y~^e_3m}_c&4?n8{~4r=)ocrXlA+0L;hUM8MA77|$=d1NSm#rm>nG$OEd6&3#_{
ziGR$P9$z7~62tZLO;VXWJ!Do;POsp-y;0K>$$ZH7O`ShRjWBXp2tHnJ$=mI|vOUMk
zxPgC5-W2pcx_?zf@X>AE9UnO8e6Kg6D4|*v(T#T?e8!L9wR0>J=>UV!x-gQi&aAS|
z$F1&><?HynBm?+q7xi**G*(G<T8v(dKK?JiQmkA<Uy69Ur5&h-$e}ov`gD}%Y@as-
z@=>A!S!@sgGyH#qQp>CzDRbQ+s{iBnw|GD8y-by_{n_vgcg5zAkEv#SC2uEv6T2$=
zeEemW@272zWR2pEpcmk6E0-~e75(%vkLThR@m)sJKKDx&-<YrMnNCdIqh?<1%8{|q
zyq0X}TD8?RuszfoyKxs1(Ew<|-tLhaud(-Q_j^muQQJ%oFCt^uOR%pR%RSGoD!4Ou
z*r}b{6??@a_b_af_P76D1)=m}99cX<gP}vvfthl|I2p>RA<#Xsx!28H<K|qOzs40x
z`Wc{(7nO%xE16MOGkn2)qmY^nEkwF+J>q<}uyRiP<2?(;Q6pIj>9fNp&~Nmy4!kZ+
zj7)Z&HmBjIWAW1v$)0H;{WNNilhZBUj~PSzYT5)Ki${-lto!dW*$P~<&XK@{db8^h
z5}qwP`yJNSo`Zw0$$3Y|4ZGipuG3BRuAetX(##=|`SRh=8S)G5Ku7K(f)SW<^vgqw
z^(dc#npe{bq;#^*>2A>0IlKZX4T>TV)3&&Z13shTPXmCIXuDB=cR2{F=$GyhLqy4)
zr2Frt`a8@x%<S@eq{|6U_p+1u{z}l!-WptCaHMH4b}%p4%`FNkNICashJKoN_BvyR
zv*|GFE!3E{VSp~&Q^tVn=N%;GQX*;9*!NZ1h1;BblMS1?hu@o$F9rI_9Tha#mp6WP
zxSae3<3o4C+Ucd!cySVebcIt+@~XcK_h+BC!Sc5Tt{AqIOo#0^v!c>q0vb>3>m_e-
zYc3YU<wFk#M1A5S;w!)(t#XrJ1YD}`#bqf@eee~Eo)~&ED)pGbfL)Rr)6Eu|XTMW2
zaX>-RpA}pa3KN6gFXQY@40=OZzD<c<&q$`6G9Y{iV<(_uK<MjwCmvy`oXs1yb2={v
zKQ2uZAKgTX476P^igs6x0vkv2bC0sEIGOZKob=00_)Uz%tY77sa>q9Qj3%tX+)0d5
zG$sa-ocl@B`2D(x+A*>7R3OdM{I4zD3fmZOLR^HXhvpl|Udu;MfG8b`WiG%&OmNmD
zSj_Krl`H%r*{u|R^%pX+H5Q~&%O4}C$ph-uUq=mzQfR9^LH-e^jut;=M|J|@XHAdX
z+RUdw==390z@h~h2kQtb^(F=8aHJ1ta&bjQ*Z?X3_^_-C#SzyO;<(%CUpK6G5Y;Sr
z;q^XG5dv_J*=b(i#%j=jC;14^XAr34onBKJ%}#lZQ{&^)4U4UpI~9dDaPt3=EDiro
z^?GcvJ9T5O-VoK6PpeLu_F47MM&v`*hMncGM7TvHwV|le<g(^HsG~qusmuGUILG?H
z^4Jm~xtltv5v5cW4bi`<Ca~ofMHTm@%mOCepEp%=z;{?EN7ST85Gx*;1(6(GOt!bX
z>cKKM<aI;X!42oy9oqGp-0oPIt!>j6;sui<j9W+h2Yfn3w2yK~BQ3qf8NK@#dy8uw
zOL}{g7Kd^+YCOiJmpO`>^FhQLcY7O0oi)epP2G`39X#I;J~MQ5ksr2cm_^&JNa$GQ
z$fWJd1g!I!;VLIt;E*3rF6kG4jRGlD{m#=1$>qYI6&Pruk5^sgIeK-S(zQjaaMot`
zTqE!<pnBjr&E&ILza{P7^m~@1Cut*IcI{wHYxRXBKGg&FYvoM=+%K;HmNwxu<FLJw
zrc<S6{KaPfhqQ&7Wr0Uh>v1x-O|jB^D@fUK64_y*9PRm(tFXiES16)bDW~O?)p^RX
z6VzW%YJF6;)_mm2$Kt>17sM~KUR6F}7hTv`i5Ai>@`jm&yn^&8S%dUpZkuwqY{Gg!
zu4OFyUbi5PcwU2{18T^Dm0ne1k%vPrqEcAkLV<14e2B15Bi3GLA<V#Np`+mQ6^@oV
zkU~TyL7x3Kp$DmZ%WvMWGxT(_s4-oM<k+~u*6g_}do!IE)O+EB&jcbYDXIpd6?pv?
z*PnD;RjLFK43Ssxp{jiaIgo<{Y0ho<G$^0uoDRc+1{887$>KZp175k;Ay_WIm<GtI
zZwy)WbgPft`Nwm^8g2K^Aa*ezP{G~(0IkKP&enHfM@t<HQ<U_6IYMNe`)?nSXp1Fq
ziJgxC`1{Ok5=f`@^B@<&)qlssk2CJ_4yqQZ7g9SLXTEOs(%v|q;`N;)`A8<bNjkc&
zr*Wdno4KbN+#YQ%Np0{M`%f<b&ra!{m$uD)OblgnmyPH|zZ#+BmpT18ca0_`K?Rdh
zIMnP1tl-A}I+Wu#SB$!H**&W+>C0{tkx>M8G(CT;?}!|GiQBB)#A-DB;}cu*>?z&J
zhW07F8wPLg>q>H~ckQ?uNXEuOWxmh7;c1sHv1zPN_H0cndV!mAYB=hUJFe-MVk$@<
zIC6cYzwtb>I|0%%jL-gF!96#jyOUn7kVPo3ZK7pI7Il;kXmxZoKoczptCw5f&-fQk
z7c#+PvdaP`9u&f;cim>9gCzS?a*`%~F?@MYd^Kp=4j{H|QqQ)MzOfLKed6dfeA=n9
zxk&fY>NWHd)yEE-J%(m~RCozj$O+CYn5cM`@Ra=x&02cYm945rt|CRzq4~2DRgGrk
zU6ocb0$22o3cglftj_oL#U0BFKvDM2E!^U4rSsmD^HzyR()KWiyyA3())1qa;*+>k
zPL6(&-_0mX)Up-oLkwu@15RqUtRsKM_v+G1^A9N%Hv&yc>DhfI_ctYo=ggqRd=l(O
z(snH;$1Y2z6KhuEW{q^a#Q}6%4_w-s{97;biIIy%W6GGuqmD4GXXTQ=Iy$89n2CyW
zl)g0Z#5|3x+U^9y{Vn8~m`4;}0V=4clyA<l5H(LTV1uA_?!S{S`M=YvE~@|CZJhw%
z-Yc0e$1TqP&a|$*RSY8df}eNSwOCj|a=b1DcRuZ~Ujrz4eWxXCHY}TPf2WFYUttEf
zNFiP;;(=dPn~&AkEgL!I@~O}SX6va6_1oP^!jY!<Eccn5FS;|-E8N@flEa)Y-+$TR
zeVlX(rvLcJiHGY~Ug^cVs0zro76`}qTM?#vD=moHYSG@-{WZ#PJ8xv8%Ky#l-wh}A
z$Nfn7qf^qZt!k8@XbUq!{ECAq&G5t95b2lZVyx+R>9ZYuX`aMz-8t>-IkmpMK0U9g
zNIsrrd-_F^!D-}G4)Uyut^4FeAjeD{E5%`dpi(^=^f>OM;2$&hyldi1gsvC9pB?YV
zJRJ7S&_~&yEhZ0NRzET%(Tv-k-{N_9NGP%*xi;5<u^0mV?Ut1hRocX9b0GtyEZPVy
zO*#bkx8}4vsctv1cs4&z8F?PA6+nOT{TZ{pgj)*^;YIbte!DXi?Zddg1}88+Nf8cq
zR>0BOmhnY_gL37YAG9!uv{r;G4_fZYnlw^vRZRs&rpYofQKzqTilK!fzbal=CX6qV
zJOd!kh=&)xoK&*A6PVi*;}=jD<p{5LRVPYD(i|qge`UE7zPKZQ5a@ff72<m}#*X}?
zKEr%aga!1!SAhTJr{-zY!_k4`g`;i3m#+Q`2w7jebbwA4@XM1uYc&3~EIT7eIMZw=
z04dIpK-}DxW@*?p2ZA9zJ<05P=A=7Woi>SqnH87q*4A#x-EB0eJv<(29s5asF7Csx
zBqIR?gwzUVN=`N;>p}LIMmeK;wW}ZcuL~_RukwyeVvKMOz;^=9aE}U){mp>m`;wy>
zb;ar(F+AhqXOu&4;PKTxAT8DI68Va@WCn2Qd6l1*i1Ur><m`IO)_0adkiz0K)e64M
zPhRr(AYYh9buokl^F6{Du%tz$2u&uOM6OGPPUT<PwCOBN%~K|o$C`eM5CZDS)k2BK
z54iK57`U?0(uwODc|BhBqW8S`^MtP%v2lss5SgjIEhpf&;HT31DJh2#fALw9W!&_>
z=40;esa(m0`MFEq9&`7Qv9v8+UH7Jd81|y{^MT3PHUpA21LC?Sm%dV6%(w>v=0KUI
zfC-{QVEyQUqdP>)Es1bag(`xwr&AzGbhfvtOYUQOcYy^5k7$*>`Qm~KA@lSTNFH_*
z_L`b(H3J04S9eb@qjwG)RyQJuDr6@ROl)Taye@^tv15y);}5v;08-~t@D3)3dP&hQ
zqCsVD)2(5pds^|-ez>fSpX*Pp;javx>fFYLf3Cf<NjPDXIe#Y;erU|RCo7|!`evXX
z1d0S2Nxe`QAnu$qlQWAeieI!00g?|rKATGNzdBKks}M3M;(ZmA`!w|hbm~AoXmD;F
zY(v$(7`ehx5hG&D9Z6TAkI#F_UmQ=#lBlps18Y=x8Bz*#Zl7c}@QJJq%SAYY*BiG2
z|A0gkJ2iOe6NN>*OohIp05N|E%1s{`2xv;*VjV{DOzQkQ6ubJ??d_Y&@?y38{!RDd
zv1H9v?*g38X!J_a($vL3+OU}N(M)Jz(2DSAhYD!(Y-?^Vi%;=!a(v15b6i5fruspC
zem-HCyEi<>UM5=M7#(q>L@}5LvXs(}mDzG#vu8k~wvE|A=UK|fxhepEU$ZTWEI1Xd
zSzWN;GmKvv%3%<;fmjwTo{sVz{NYXQ7u=vUcN1KZBo&D_liIIs_Pn_!^Igj$?8xh7
z`ZNoUl_J7ZWyc!Cw+$;XwhF?<Ub*(uGbi!?T3Zj3RDV^El$oTzpp#6iXQM9-2G2Kz
z^j;3oQ1zH}{QTZ4HkST=py!!g*Sv=_g&r8K<8F|8nZ%(+{SV6#!2hy%|97VTKOSDs
zl>e2Q81<e9`tRf>fuUqBrR)Y@nRvo}c<~{-BQU?ylYKxx#0a0U@dX5_u-5Q+o(S%k
z@^&uqJY;jZBp{Sz9$k;fXH1;_VYIn5x*6fis6%L{##@>$(votV33N-BNME3Vi-%%<
zh0gmde-$ePVq#qbMO>T}@YhKnp<_OXEX1JYy68btF`H$5zS*)CR=_X5K^<D=_a;zH
zQ9gl^NM~8z3AhFSWTedxe{B%3sNGwZxcqOtT<+%l^ebaJp)E=0X2u3>Z_tYv<b!jm
zZ;TGCE<A9V_)x^XtK_|WHB0;%@#mDK4Cmy+y^g0}-gh%UeW-5zL*B2;HQ`e+z=8=d
z6?}9NPkr(xaPWp=M(UvUlnwBk@hi~^=BbFIi^URM)U)w`pVd2gQhoBH+=rdgg^h1L
zzEC#RJJN9vYC8g5OPTr#DG$@3RRXAxtjobW-PEI|xY6X7T$?d?TaNL$!5`AUzuN;u
zptt@>CvzCocJCIXRNUX{tGh2V4L14FWC(s*nKKuTx2~19uAqV}sx&x?=J|zF>WCRI
z3Q6JKj@N9fH!2+28L9k7QklcnEpw5GztxNt*Il2R1PPbID8_H8{Xy^k5}uAs3Dz)2
zST2(M&vOBEyW+2EHFI<Ir2p~yT<4ln6IV{U$njU@nW#(8PEnDR(ol}n%gR_D(w`;z
z2dVuJ4f;Rd)`<fS7!LRT0~9=aZnIA#!1`6X&TCi1+nfh>ZkBT6KnrxK1ZCVpj&7Z8
zTQH`SQWl=#snCN}AUqFg?<t-K9do2gSgKop-M%y;N$(fc@Pv}f#e$DhGJW4*=6`ok
zQJ(t*RpYt^NH^vZAh(^qR%902k@!n+i8ZaMiS<fxY%2dKddAf~bVVUgDdWnhRHr9}
zB9U)02&{!=`3O}rsD<36<bkwjr>IXth~HQsT`>-c+})bX{8&c6JIC@5EfmWeo>F?a
zJjy6v^l~`Vtk0SC`7t}(<Y-v|?~kB6fTy7?BME_XYx|1nxRVA^`J2z-9#%73lOFKu
zt)#zd!>FYIY!m0H|2<L9T>B!kw14Ao-scOcuOE`COfqF0jB5m7BZBQDrb^q|U?4`*
z$*2M_6}BHjgI4yPz-NsrR);5TfDY3857M7+ot@%D7fYa{k5mX*LB<HRg}M)0StCs%
zb~BJ;B<<tzx|A)<gFv0On!dl~ct~N1`fyy~u%o8;FVQ3mz)a-_`_~MouAqPL`m}me
zBROYZ&o-wfw)^@0I|QJ=bnIhdh=>tK39U*}P=3B9KXpWg<)G*~^Z!Sy^FQg#y7(U>
zRIi-KX8+IR+`Pm$+uUpNqPIt*zuB`k_5fPK1$RyPz>Mbq$~{DhY-!}yDqHF)3$6ES
z1#^cOMM~Qa@A-Xg2o&)9O3{<8rvzIHc=MN}Sf_0KmR2TgnjE$Ng_;i3=veHSG&~K`
z<xZ`o|L3_~VUJKbVTmiz|5#)xrC)QejD<%HLd!0>^7mgD$m`LcMWT)8#LU9eaaMB-
z^?Z~~q%OZs;w8~*l2ZV5*irlxj0MSxWKCi<dYy7PtsAgRja434qQ*;-zCmaAi6)(3
zyc8*!taUmbm@%+?0ejBxZ9~S%O<w`fC+;qQLJaph^1vDIJ+SZ0iP%8RyfSuqOU>~2
z(s{e{<_+nI!M9~#-i1h9=+{$O1HXJi9d{zZW3*;nf}*gT7`dq!SE;{ze=f;`V0RJ>
zRYhc@QlSVrV}yM`G5cp!9HJY=xd8sx4A->&CB6TxE<l!RqkNR>H$Kd|&o+Cj;$A@9
zb60jg<vd~iM_DhOJJRmODlsPNBlJ4{u3rCN8i)U4NnR^(QOFQkO#d02;I$qRbegxM
zmKpyVe$XUzat_)Wdt7z&BiHvuf!zD@l;c6@D6_yfonQw_>YUAcq*R|d`?}5T{^=mp
z5mdq5Vc$pHEOC<QjHNmpmORWNh2b-yEJmzGlHBJ9{>+c+@!P-uO-FJj>Cb1(k{lH;
zQ6|qkp8ID~aUL@oGzvIut(n5q^!%@Sx?SOtnRVlx;E0w;pxnLOI(Vj?pXbbnn5Z-8
z;G@_`qjl~BK**VYzy8r2A2?2mRjO-Xd9DA2(MYkQQL43(S+)CYi#HuoI8xMHqDfcO
zTwgRY`EOZvz<N2zCk_3N2Ztq*!W7LQ2n_r?h?72tk5a&G^F`Mpn^IjymfIB%t#~cj
z&kqz;>03%n03OqzUxS3I8Qa4F=m@e3RDJ#|miI)@f={C)VuTSiFj`|K<v!cyosGXm
z`hBcG`U|LNB>$<DV*OGEmIAqS=Fcj|?E5uz7WcB^n24l`z=4)EVMQ>;uK=eA9y;AP
zbr?SV6XcvU46Kpn_8SH$L*@I9t)2H@ZZ3mCZQ_+NW84@H<FwEr;gP{P`2Ra>`C~vR
zZpA&<zEtNwmE{gfXjG2wb?|=JSo%WuA+`IiC8z^*Iza#1&tGDd=q9m>c>Wd^aA-@!
zqp5!Wj4}zIP_S;=RC=?ohI!&BRbsRmbEHYZZ{q&%JlwyOczzUf24b>9Z|w9r_Fp#S
z&CO49MvczjDf+==s2sN`J4UhPTPfI;m9V{;4z}mq;Tva76qxBRE&K?#{w=65orkPk
z9r00EfAx%9HA(4&$&k@FXff5Yf5427c=T{TL~%sKk@<)DAeSR0*^dEk01m>^mMP_&
zK#TePmT&|!?`}LUfN^&uEudQAZ`VipN`J5;{g8wcA^r0m9M{~McCQIip6P$&brsU#
z>O1U#MHab!a>ObV9TFP~ddA5VfiAH0xb1|_BCbyf-nFiU`LjI=vM)_t)V0r#)^H=k
zB@+y%gH@wV!lzPs(hmj9fc@#D>H!N%JKoKwidjKJP5xCu-cdC=pzQQR7f?1d57i&w
zb_+I)m|COwNFwwhhJo}W2&&xhfqAJ$;|veXN0t12&arxS$c+{9FG0xOKzuOmbhn+c
zrpQLLN0^*&uG+Un*MFiG^DA!;Ui%@{#!WYw^=B7|)`t$qLnz#$+P;U~hixs)68hcq
zYSuwGfK2*mEe+c<p0$~qRRMi24>)Exe5~M2-ISX;to<t2hHBO>=!wh*{J;o*_pglP
zfAUrT?X5!`b<IfG1UKNHKWFwVrAXa!W33M_5@<-%i)*Tz)_7qk2dtK|Hr`OK)N?f$
z-fx7>MnzFaPsq`DFZdON1VM(GR&tsg;pXW&)0??NYUc?B`3$^(*f3Tg(>Pt}MNCZN
z*v}Y<)?DtXPm={(L4ls%y>~D1s_$SGlKmwXYtwg-_6iQ>Phgpd!Ss!R|AQ-jJNn=F
z-0wJpUADZC)E>2R9zED5Zy%-j<a9P=n^Id({fPZocY7zE&o;q@gE7_?J#8hUgscNp
zE@4HBg;f^bKyR&nO-^SlagO3vIZV@dtax&bRk_pJPP#mzJNK${N52&E*05CM-hA_I
z_HO|_+vQNp3v;Maq{irFdplk;`OB?g*KTSu&Rw{)=9r9H$D@b96~(mmID@RRBbE+J
z9~xR^^FGCE=ToI%?DIRLuxkX!w$k^bGg&fA_gu|tROj_cs}jc>+||>Yx9e{JU|Y}L
zYX_4cAX54S2(U95ioPB&G{N}j_UGsZVl#_{NhtBM!gMh!OqO>Cxf95|i#*f5cFp?u
zXLFZE*_<OcxTDky&GvZMK#1jiY%A70%?+^Yq*Y<BVAl<q7Y^KY&_usviK;){zj5sd
zE!$wwxbuqmI{XM#>wA2pd3E!sVfI5$DnZv=KV<!v#~0b+Umpm1&uIZh?D8{tc;-HC
zGn|}|Sy^k<Tk#OgwfC0;cD6B-FywOI5eB(oY*dwu`hFH&0GTp!Xd^x7G??NfX<wDr
zM@ijD<J)C`O>ranAD!<X@=n{5jZbI6bq6dfU@gE)3JR9Rgf3WP>?sTG6|Qk;r<-uJ
zqy>%)*uW1(JN%=Zk29QkGnfVOZ*vOLPMx)K5=v6O&Qa@43ZK{k5)KL}N3ri!2F2CL
zx8N@r2dtrHCO+84Weg8XQ5ln#xA}ai2cn*d3JbrFj69%^V%mm}z}fF&+C<YH1)uY`
z;^cbao{;cjd}HayFVT~lPTeLO8AGlctOT9TU_hVJllm#(h!HOZ@?Z1y$d>d%e7%wy
z6}Iyw8mfT;Dnygsq~xcQoYOk8#xz1*E~op`w8Y)X=en&wwnmbOj5+SjvIN<lXdaDP
zyWKK}AT@)uQrD;?!>%&b8`1d923h19kbSQt5|Oqqm@ygmLFOm37i#=pJb`0(>xz0Y
z`R(A18nh}PLukp4Bo&HHun_W{?=08RY;Yp}-UEzgHq~ATF*ff6ZGyy>nJlBbrC!g@
z!IJ6ct92Azz0f(zV(5mFPSuuHghHSE%w9LoK<b61nmt>8ARM557Z$s#K*+KPFi6Qt
zPjxYS8K7A0oqBkc^p&gz`wselb0`@Q%$fMaMoV)H(?3z3NYopXp9NBVjQvNb&yIwk
zS)F_zpk7np8c$&0`fYJ-y_Pb=t|8xuv9;nlfx@51*NhT+v>VZ}h|+Ta(HF~ng8i+4
z;=5YIiqVG=&^OFgKlREzrh{?Tc0U^LxiIel-=>2(AW)CT0I7^7vFHXRYly=`2s!iq
z@`pCVO*dGp;>;1cB3WMqp#W90E02C#Mtn}`eSsZoBxH$N*VYtXEB!|Mm`}`qYFm9B
z5=W{wXwp4(p$?i19Xrr*CceBc$)QAI7&4Dt7s(`!P8#WFM|w$r{Qd5p=lR8|p7dY9
z)bFS7J+$MYj2)6hehJd(Li)Y_yfhR>U=%iWQ}mr(*1eR}3{*<9pG{a9f3fVx_HpgQ
z<0+AYTIwUj#z|)oP47Zx@LN3F!snVdCU45#Jq<6%Vy^8O<({nF8IR}$*XFv+y%bu1
zjquo(ysLT=rsx?vf^cqAQGg*%Z}?Jn;wCGm+mJRfV>14a$5{^<mHY2JjBc1%iE!X#
zMTpK+s{hz49smc*2YwtEj?x>Iyni#z;{h%8k>)3m!>4rK5ORH6-DH>-a1$AZ7<btF
zjcIqQ8>)MQ-zWHiD^V0qpzCQ0hyu8!)}&>^CNOV_525Sf#E11i%yEzFU(VRfZ1$ka
zhZSF?I}9uSiI@IFOa)82do!)aZ`FJ8kfi@~%CEzudededfqjyx?>G~KHwS|haY|Q;
z1$$jl(M~+PejPo}^#<g8Y~DelGk2I2^7%5RzVfMWUYPdY@m}g*sW}aoOtg|fRGvY8
z7T7t+%jwVyun;WoPc~ZXK~{N~(PY|HAV+{eWSa1Fs`dzGEZ~Nf=foUqeQ6a}Ch_;k
z0~l*pa!OCH_;!At&4nApo}pRvX|%KI%ab01tS`ohR-{(_UKdIG89CAv6D*pT`VFd+
z5NKY=t#6%s{&eIXB2^R=3QXl}1QUjWXyoQXMVnXwiDUEb`j*SgE2eTEd=$8(RgUKF
z_#$n#9wej`M*m?P_ucmJS&WhzwZi4HUd5rkq5Mo$JbIv_hLQLs*A?)NhwPGpFYOJ*
zd$iPm&U+;pS6PEbrTWb~xdv)ZA0#fta!<fYc>+4*XF%1qu%VWL+~OZA!7bCfpr&WM
zZazZv4;IHlKxL=jT7UJ%liR~v?o`jeEpxhmKkSp-Z6n53685#rOgxS{dfJ;f2u6I4
z@Et^S>--=5=^vI`hJ;^6%t`MpsKCEMUJCz7<eZbklg4|aazAqFw7pLsqqTno>U;Cv
zQngt}8Hp>&Zs-OX^|D;A)Z4vM|6p-3{4<+sx9btTx}z+s{OGxz=M{jENXYNPhV;iL
z3Yi8Lx;7_YOTy-fwxOSZqB^|!0AHHW*3|d*ArM20XaW$WbAb$O8R=;o_M%${D$EYf
z-YE<Fjy=$-_NjPoW7k9f6&M32o$-;~)09n5eEHnfIL3afK(;-tvTju7<k-QV9KJLy
zHzydr67sPre5D5^?$ye2e?t2OJ)Rq`^Q#l1Q)=3%n;E@#@0w;yS=H&mHiZ==K$xT^
z))yfU1F9Fs5N?kvg3;5P1Fl6#!&(EFU@1}|rEU1ALgyvqrI4B-w2YMNlAaKuq!Q9~
z%|y{0iYkFoCkhkJXt{pqWv#t%%d)AF7skGs{wydLCt=f-*V<W`%D0c{(eCrzp`Y6n
z)#hW>Sx88*{P1Yf!<fV$s{fIjz?+u)fm<KTOaSA&P_Lpy9n?U}rOR8^c)d;O33lQ;
zd@fnPi0akp+`ce{7#hj_2asc5V*Dcr7!NESAy-D9Gdt)eYa?X_ai1MBM{+(92sv@)
z{m+?XJ11PW_?*sw^lNymAH0)SeN#@vPdn9{10rjohq?1)nSV!mhD|Z;X`aWyW*6|}
zLWRbJxJR*E4P8RO)}Z?~%P@idp@kj`CC<sP%t*VdYI~*1Wj0v3uk&g|Wk$*OYism(
z9pkx@V@9(VYKYxOI^WDnv%&zGrA-V&6bCGQli65M$v`1|JsWl@Xr)elndokG-Xr#|
z!WKsgsOk5V@o>W3+q)Qn?KzXTn|R*D6yvpPOEW{tu?airu%4qP@;8ROiSXI6L-D3<
z#~1gn*=k}x-3fn;SDVx^-E+ETwy1h_j3$(-+@o;el9O#;7985u&uO)lZ5+2=08(--
zS}&;WPD4)St=TWk3WW~}$DK*p<yUkjNl{pnOT|pro)U{tRFya9e9s?x3<c-a>ug<h
z?RuO&p=7A7C~nue`&rsiUPY7|f^JSzPX9;@ij}-cy`U5<_WfRGRj)6T)0XWeN$z*r
z=Oek?9tKBpJ3BqO%}YILd_+I$&n4V<I8pA!oewg=Gmwtt*m*lsBHRrH{n+%FW!?=M
zU+7}}6xy-r=~8ffJ}O9JuU2eH_p>l5f`c0H*nNGFXH-gs!RY9#1dDCQW$@U}H+s%r
zo%MnqYTFI`H<a~Tc}5Kk7aE1@t#ZG|v|fk@x7~~iO9AZ6g(?`lQ`NluD)XL3XLQTW
z*xuCi?4-}gA5CpH^)XKS3r^23X;-S+r_}rgp0@4l;axua&{~d(T<dvk;d@U*gLd|@
zzi?7Ma~}Dcci3ioadf82o{$i0RGIr5<YH9TfWT;XFB|@6!HpCZOR<qT`#G(5u<Vrb
z{u_k2RJ-^|qo9O|5$I&B@t)yItx7u6snFAKOIugTtW1t&`v|kFwb^OTG{=pI7KXJ<
z7u|<*ObhVd_LyGK9KX+P(Tw-+ffsLBb$wXq(q3g=+^w(PEj>}M+)WP~_A(u+FYBy(
za#_B!BlAufKn~JNU+}Ry9%CJUtfv(mYUC3Pet5XxZ^xw{IM27US-yS;W);Ud5;K|=
zIG{KhB<Qap7y9$}t}goQ_Dl^YLs$V;<jZZj7OCuoPsh0jNuwYYly_yz39EVs&F{O<
zN~z=uwyth+cYF!w{bal6txEi^wD{y??n9qf4{U(x)ByJNA-9d_6m;4rdTG8NJ)xhy
zdROiZfK>#u>te@R`tXo9)Dd@gzaZiGNAc{jz)CTv6wLsV4o(BO=vQQXd@@)Hy+n7K
zn<HtxM*Xh-SnFlKZX^gkfd#dTeuOC-pLF%#!zW;fXqBDW>k~|R4b$)5hU7@YD-vpE
zeJ{y@<|69+?L}K`wXWFc7~DQ}56dOc0j)Hww~i}U5u8WLrMX=@K@-9r_n<=We;1y;
z&0!XqRnnrq94l=MS!Q{p<!x~}5B!kiaQH!8{_-LF%?8xKSU~xNx0Y7aZ=J=jCdk{3
zH$GbE&u43?iWL>8O1iQ8)~NeP!xeSI>RMGFgFo&{FmNf-^3rLYmXm0LvK<GV-(~ki
zbDUl|cD5~Q^RTy+DT9g=+bh;WgWn-7l0`>JM4lq}^f&r3HF*xJ{de=V4r`s-fme9U
z#BcCMJoTfJ{&H00zEFwMru6a3u>8dQUm&*s9-ey`vvO8IH~^u(1pFsUFlRfPu$PII
zA5DH%CSH2u=UipazF4n!<NO~0!}p|ER<8EJc(`$IsjbhsF%k96G7m=rQGVs3yST@`
zU^g%~O%P=EHka(hP__A;#j?@G%&%4WOORe{W)e$PBmVM@qMv(X6(Se4TZpG#oErV&
zc%3Yy!d+N6(1<<!^{{X2evEDK$WjGZ<X4ia{ggj4o1>_urybGObHxB3?F~JvQnNzX
z7gH3~LwK7eF6HVJdB#2NdwJm)3vuhLi2GeNZGNcgi(MPYlz*d-*KK~8K2$AdS%i47
zcpcuRPX`SzdSWC^yun4;r`Df(Zsv$W6FJ^r^4&qRl_z3k*o|ObiZ7#js@7K4QLS?9
zlsYo^lb8PZaD&DW0<3Cu({{@B9YL*mwiKZE23ft7RBt4o_85YAI+(hG_(5WY&gwSN
z#weC@K<V5=*`(Q|$h%u&tLx6b$KjOLnb^Dqbi41oE5Q(-v%eP)6Y@T+-aiB_cIWKk
zH@6}%UTX`9ti0#s8Cyehq3@Zi)QU2VtmoPdUR2nXyS)=b4s>3qKYg?IpyJ)3>$}4)
z7i!T?@*+b6@p#EMC_VMtw$GP6YYD|E?#>Jzp6_GmUre9?+2*R}@fhT6wCN9e38Ic4
zJQoxLOvOZb5F7G(Vyw^-i1rBf_`bX|Naz;(7vuc3Y_w4n<UCxnKIvH{VO98xj36_n
ztKRn@mj45b_!sW-PK%I}YKymlnq-!7(yFR&=}e(sFf*6w`ixp<1GmB(v9c3S;x9I#
z<4N%?C}#VlW=o@8H8k+BzT`MuW#W^|{M#k>X-+9?yXbW8d?Y9;U1Uxqh?aTg9)okb
zCD$i{%C&)-3y?le;bFlB5;|y!eMQa^X1G0A&g<pVLk~{TqaCW@hn;LP=j_P6ypAik
zFPBgtRCRzXf>m&eFFhU~57&P2+}3KiR-zLFxRAa?U9yhi)|vm@$u*d=Nbdk!2XO+(
zzVz3qCiWw2N7B=qM+)NIgEBViTob;;jl5TdHFROOGGH1P^K!uo(W_y$a}6IIX5V*9
zYPLU7@HyTb47<lKwEv2defwmtGQc|u5V19STzj2ll}k%+q$1AGB|?Qb;?@<)F6a=6
zljmVqI?j~`y{_(bfTksoRdjSdq<y~2H*ZK1XgclEOiVF?k_7GxL2t0nu-s>Zh&Hf>
z43jswr_c;(QDLWOafqrd3p&>v!fA6i$*R>FJT;!X_j(2g_xc1U$GzV&5(})TD5?Y9
z#NYAUqn#IpGJ$TB>j(Ex#?hx55u1kyCeRFzO~n`hP2Peujfb+735tcfd}3J?x-V3S
zxaFZlbi%ZB#_fll`+4d(a|Euw6!zu#MVAaHg^<`Ny$^{X9WfO^*V;H_bflkc@YD?)
z0;}bWnS99sG+buB!s6{QHU?ld4#>SUUXByLB7j4n@miz%qv(SH(XxfFOzz8!3th<`
zNale`bVmweONV?CaKyh~zF9uQoy$q!fl_#y)PC(NXR+_nfvi$Q-$BLydcBq;T=gqF
z)G>;W@ENH@hf?tSxIpfu;_O%4f9hd}3T8=>6i&4n?idlaiff|<bQGnrRpV<AGYi!J
z*t5qOn!HxKYCoZ%ye8ukh+TPlZXuY>u5mR54HV8zGwJ+FVGvL@SdMjQXQW<Pb|_s!
zr=<hq!&T34!{Y)yH`N~@v#5W+UwQpL?8eRMS>dv?chfCHNrIVELz*j2uoll3aX$Pi
z<BIf%;7-`y{i9y`=tT0fb>OIuID@GSZ5hEIZJ@wEu+Zn$;_16?<qOU=SlF;6_f1(3
zR)kGJ)fpui6G!;-@_jS7DlUqW7nKU9rd?ue7lu9taTK&=ss4HOH9GCh54#0epo-~$
z=^Sx7(&(v=?&u=FoF>-Z<B2S`{{h`dtZ=<pfGU**g^pAzu^9zF$ng1G0ccjZX(|75
z_f~Pw$ViG$bkI*~ew_OO_a>@tr$uI?Xd1lCDL=3IqW_6U&99NQ1+=eQx7>%r{rlTJ
zR)M$g^!SiY=j%{8PhS{nJrFj3ubQ~yxiu}%q&f@K4kIKI7!${4vy^JPdOdoI^cf4&
zuNAHYU5u&TEZug9@uTS_(cSaw;Fp$i>9^-tg`HZ+A7_WTuUxI=MnwR*#2FKFv@p6l
zxygz0Z-ItJALmR;bw;39VzpqOir$y58Ub?EUKmC>?ZtgYRFv~%AXvubd2msb(I}Mx
zKN)t5;;Z}^xKXRP^ge&hBb+a_SMz*~XpuWUCR@>Xr{XT`j;C^!LWg2R9c0Xb9UO*Q
zG&nAD|B_U)t^QJyan2X}R<*QpD8`bMDVwXaa4xl^umlh=VN?ud6E#?;L=Ewn>E_BF
zddmCA<P)$7{>G-AW)MH@Fj*&;G8*rU9}pbWZM{hb9Uzlk&&SJsIc_awi^@7qePQDL
zLr<!kBqqmos4mDs<gIcWZZ7Z(<u1)==GtOkB;#JIS~l(n_|7-OI?W{_>{Zb>9Fw}~
zWbhsYxr>uG#}yBxWfi;VH!8LDRz5mVP!GYclA=c28GTTj=;_Ex#7V8FwTx-!T|b&9
zyNs?^&^@oJjE<NG2_B`@e{^NE^w-jbjm~)q(12j$gGb6tZNgLY{9rh-@oS0DGXO^@
z2Y>nymumL7Hqs>KC81LDbxRqrToTvCCWMbT(hMNWCE>k6FP#`?Q5blOEuH&XWV2#D
zW<Q#5l#AvVK3;#U)VQ7D#_f8j91F*zAGCj3)qO*k5_^zmSJI{uV#$5d%ZUFWdlzBw
zAU`I1dL<;sXz(`n8x$U)lGS!n9|9%NtgO`WZz?~F9)*g^z3p{2$cqsVPmT`iV80R>
z^OLhN;dwOaK`%b%3P<gV#3^xeYpNx7K<)Rv&T@38R8uCH31p<0$d11SRU+?MGI4{r
zpwJCJa*ki5|E{_J?uJj_$qD)^8QmFtwD8xJojXmv)I<t=T)%7XgBl@y+uxs-AWi?h
znHF3Q_`{Jn#SIeECQi80|7?ZY?T$j-&mo%wH2<N1UwtbP^Tt13TjA$d@UuVpJgT4l
zRR9Q`$9*E?GxhLUy=?UbYJI3qjp6F9L0m|B!q7Y4u^V9K{=Jp5=|$#Gz;FjA;#6ZY
z2D_VhE3own%PpAG4BKuw=W!7q=aedg8xiSOW91$?3T_EF-9Miepl{FP)=3BEaEIVE
zf578JXF@`ZsD`jcCBG)MAgfZlt(9fU?&W-HxRIqi)UN{NU7=TKUtg*x^xM?;H9hBG
z^3huPPZ^nTQqblpr3tRxOBSTv6+`_)+o?XtV((h7VX7xbAmq*s#nZ&YlNJ6gvBT(%
z^|krf9{OG*p(A%TUz(jJun6s#hQy8Lk18=s2DZ#PsKDtEqdPl($2=A9H!+*Mpk|Fq
z=j~q`HLzxvWsYi$(IWujz$8#+m!+qJUU|XzYu1e+Bu3en1c_P55q6RqVk?~Xyu>To
z!*p=K{E$96KlnUIU+Qq7ntO{ziP?A{_7#ibmiCZ2TbA6F*;#?Qc+N1}PClC6QtlB&
zt$;bihSn@^i^S@}PHjJZ7v{Dg$e(UNr1)3T>5BNW-C4TReLBZif}J|Bz0Z|&#l_q)
zxk_u<l^k=Sz@(q4vS`Yl@7-UOOmxBlMY9+wdE%CVq0(bUU8$$AGx1TJwfyj5h+Rx0
zhh?hbxy&YGmS-v9zsuJaHT}dQ<-yXl<=Y3PiMEw5NCyK7g;GeH<?n&c4L=mXlm7aR
z^o<-i6y}1uz;#lfhlr1e>3d+&Y`4_X7}{vzNYlXIfvt*Y%y^UY&PUNkn(82Xp|Uov
zYy<9jW{{~%Uwz<4!Gy4!X3~2ieh4p#@vbY=e(6V2?cD<^e40unrungO8y<~BVi9C6
z9g%7h{t%dCgB@^tl$pKTf$oj+nLHkbG(~Oj-wM#YJeG`{uf2YyOya10oH+8xzJ?qs
z%4;Ic!5?C6m)~Y^g48X&2p~CqO_)KIkf}z4N}u~M_O)&Ag5DRjTl6F;3e-dH?%e)W
zghPdwQgH+%L70VLj1U|>EM)?_mRqXD+!I}js&{^H@i6`fBP&Gcv(;|N-(Du1D*kFQ
z1=e{8j4o0rMw1s#UQS*x&Y4l2gVKXY!Ks17xm67_Q^S`70~jC^7>SB`KF``pe@H*+
zMAo8)SYf!wt%z5ocxF_W!JkqqPixFIqrSH2AZ3Zm)sqe-P&`14AJxID<vRpCq&X?M
z3^`qkiS>ES%vB4EEssA?so8a~RBFnil`+Ay1@fA0_UG1~6E%_5tNeIxmwdvKJsLe(
zQ)MG_gXokX_=`@|$f~EBgG8seYCV;H|G>^D1wD}@nKn@gws<E0a@_liUSfpqX}R7l
z{0tU^#>M~mXwacOcj0&w=hpdIsV63T0=rr6>(nlyGjrbJVEQYC7>y#&PbPo7fYT7t
z_2DY$=utr&w4Xzy`YPW+AW6p3=MOepg%{Yb93lb5%9FpEx_a(B`7wX{Yk?xs#5rBj
z=fO_Xium3BPC#)I=cgnSDC=Ymr`BRpKB8ix`21|TGy1tAHFAfT+_r5nZf9}a+xf+l
zz_(QnR%|}G@Y%Ts$p9*xs+eQbC+UhUq}Aq}%U<8|WfGLiV=1GvBzL^Ne2q&_?7Y@>
z-(~75(iXlCYhwUvXG-LJX^r(p^47}$Y!#(gWFDF2BYay$<oB7@azrK<e5W&IYIHrL
zD~ZKdn@@Tw{nqh`3g44xRV~6g_H+Z?+<C+~N#jX~w_$06949<Z_Sz?;o<hm9kFLBp
z>T2!yW<_6S+o!e#Z2Nft@4!ulqnfI^qbE%(AGX9oP?FTvemswh*b_-pOI^9-lA%R4
zVesufxO89a=1%jK0h<MzFy3m8Uy}A@gxz4i0$+2)Vf=oSYdSQ@iFAAtf({Q`El;x*
zUA{n}*VL_@P+DtOM}H3*Y1#llVOA9G4^T9YxjO=C!N=8>4TPPx{)_yBN?zoEn2aM*
z7Qg;O^<h^1r6C>rSmE$j7FNNe-jHspYE(`SguVls-K&H^(*lpEbcT;8=ZH>p$oPz^
zb@bEJ)AZ&CkxM*k{F)oTD2VsA2jJM@4|fUDC#$9@@9lG9E}I?4NLe>XJXx8Fv0Ga*
zJh&YmaDyzn|GaX`d3UgYF;VM8p)|sM8V9aoq_mTOs(kUAw1Q8t!2NK^zN8ZK&x#8I
zfg8kg$l{Ay-y+yMWmy#obIoZ2r@k~t{4iPa;flZJ#OoQ~HM95j)Q?Tc=YHeIQ@?EQ
zJQc3KLU56?5R6r044HYJN#3|bL7*&dm8~#S_1-&N)Vs|w&nINMQv1cPkApd4Hla*8
z>up#L*xaehf$&vC*8xHL>5LmBy&|#5h283#V>JZ|CF3P9x=Sic+Ew3Qr|6r_FC?Ue
zXVD}rrG+)UEfb=)OgJ-(dfHXKqKQ1#gayo*txnnbju%lndvJlkqXspaafof+Xe9D;
zz*2W$U>F}76|`l*B3F0WJ}0=yt}HQy;fvym+52)k$SVl><cmk2OZCQ1kB)gjk%$zd
z9=!Iq_6wgqE}1RQiC6o-c8UVF$u=v#Ct97^c%2q`ptW&#y77I6{bKI5Nd3230ccKG
zu<u2<dGm5`XLi)Y9<!XDWrC$2p@_xuCpwox&0g55@%iai%gP>^Dp6g8nbM+cLoIx7
z&yKp<vLw=J-osr1>ixhUFVaz~O#A88%E%<XM<g{`G)YDg@>+D0?Fxxjk*78BQJmU(
zIfM=*oGi;uc3K36S60i=^d<&w_|@Po-ITw&)vZW6Q+qOrnqN!vxVzd{!IWs==eu~#
z$mr{;uQ;f@F$_%SRNc73cY$g$Y3`%xk1Jl70har;)iZZQecz*x>XH8PY)wvF#bU>I
zU<b_ZxqR5^u(HWt^b01AlBg;QHe<AKJxSjVxbd|8^rKE8^X1D;u}z1>Eb61WeVTz9
zHe0(Se+AU#p|ymmFTId?tC^wP(R%=MOG38sDn5RR`=xQ|F{WWMURNOe6MrjqXm~~p
zbmD#@SUruAnt9h9T*2*NwY?3VUyW!a<=HP5b5pPQz*j_>3N5VL-pLiKWLE7%Ll%u7
z$2M=%s%Ph}t0?kK#Ue&6-4f03U{*IHo>(t;iC+sj44nE<?>>WDo22R0pd2CE-zik2
z8ZK!v*CD8nE4Ky;O&{AuH~bzX`8=1C3v;elA1r83UcD?YH@vhlT!pu`{cT#kd@anp
z-en{H?P9pm{0=wjV{BZB%OQNbA>H~^{L65d2BpVL!B$EvlRYyg6I&LUTH>-0uW$|-
z_^N`}f+ImP%7Wu6v7r?%I+pG?fyZ^QLx)sY<O;8{KH=zPFjI)036^aXDcvrBuOYI4
zmCv5h^!^|!dOWYKTJybNF)Vg5*kk(CgOM_S>1Mylt7vHSYqIAXCsC@J5#8>&>i$p6
z{z5@jR)Zl)EF7;Q*FM)T?VD661v&!KPDi+=b^sOZQ&FIP2EZcE7Gv?<n&SDo9@914
zy+1Z8#r7}JAvQ%0#JIws-$}1U3D*B&F79eI^nJI-A)gZe)rI1((mmJnWrBloE??T%
zxd+C77=Y>e#$1ZMS|^*YZ>lc$^tWT-3fO>0e#iV3I0_P1fBK29sZRC8M*b+wV8VFz
zlP9r`jg&i6?lISO_H5&OG4D`5>Vl;``pFaN+BqV=w7?WZg@>#l4O*7&Eeo9zAD=Pb
zEKgTXUvCq)>Io^M${>y`<?kP}CP|~6bS*fwZsQhUg=gc=xp0^5V_3Sq_7i%eOa0;o
z*SPxSKNAHkmh6Ex`q7Dr@6K4Hk?Mn3<>J0!r<W*jvF?@pf?FRRF9+UlRl9|qj@g`4
zxO`G!S!<u4rk6%*84w6h7(<NoyTA!jYpL<V)0MKSC;N!D#p}rodDY@M=Z<}kvbU0#
z90@-o9Fw1R{-)zs8T(`zWhswgROhOS>FO~5z_wz6C}YPZi6|Rdk<*ACqe$9*>ho((
zGTeRlOO6h15PoZR^=~7k=D96A9UICnMtwv^2X0Oo9)&P{VqyWI)Gklgl?(7I3N+27
z$P<U7IhAta+W?WRA@)ZRmneg^@U9olsc%3iD)aggvWuabutLuj?L>D}c-a%2sX*{X
z2dTP-+ET9A;OL<7v766tntrZRC2WtBSQJoClkK2klwaDZ-Kj?D)7a7-2Wn&)nQ0qk
zb1Arwek!oYu>`zUzdwvkj@)gP+8{0+ue$~y^~P2T^IA<;z%k5iFGX)3ZWu&?>=tuE
z`wSl*&Eb|u9^F-Z?el#cdqSESL^#0#3)h%Iz@5!oTZL;#4sUQ+KlUK)gU<OYed^2c
zAC(C1a-RWHFmITJ@!8_0!rzv2^BXdRmi<_!7oy9S^ZdGQv#cH+QCXQ5I6*VH@o7Jc
z-UJC<iD1Ut49rml0gBM`m35le={zI-Owr|mrN3O))^(&ReaBdJVzv@1Lz5$A%Ab?$
zgXe2Pp*h)BwL5Zw<k~L!;@sDnub9iW8WkUvB_m`2IZ^{sw|+vVHvIV3$G+w6Xr<~;
zhhST+0>DB#AQ`GY7Ob?zi`olgVQ6VC7x)U6PmKd5g;;$unnwx1#*{y3*uVo0Xt0SQ
zn1h9Ac*OGd7U~y>OTi{4d+}o%Gq>uGGC&AKoTM4FySJ<~%OlnCJ*M%pecWxdGb*=h
zAeO*B>&aiM*r9W~Y;~bur(^#$rDIKE^8UELmEW1uH)-Jj4CVxg=6wt4y32)%Givlc
zOA;6oaioAx?MY@v?&d?BC$T=7_2_7yzlqen-qcG*or}yKTP$voa(`s@?oL;e?0;-v
zp>TPj4>$7HTF&x3R^0c&Z9RQDu!&MlliQ|FtXi<vuqA~~lP-iz&K2e`g$+|{bqdEL
z=Qpk#xxo{_qMh+rOV?K82Pd><3eIdASTrYTc=(%c&_kg8gZY)*^cJVX_jdeMUB*5l
zGmR=hIy%F+7q-#xCf}zG55AW{QHj#v>d<Z4B6l%D0{yHFe`rThlfdHK>7M97CjN@D
zwt8jw&h$=VK@`lp{_)A<G+v8gPv4eHcKIGDZM=kSAA6X4FUhy@;NVt6@v=^MQX;Pb
zj2?;w&Y}p@;&&&FoOuTyiIAl8opJZvpJ7cGYeJ4H(<}u8nby$Y+-aa3vv&QB_){#)
z12yb*yO`xGy=e)j*izV80T`LqOvdXLHl;0}DQ3iR;`{csw1VYJ6UK&Bd{hOoqbyj|
zSWKXM%()b)r@Qhl6*0&~(sj5E2HU3=RXJ|Th7AS8bGdR)RM>MDa|qJxN6TvkRA&ye
ziUw?7vg;;wOvzTGLWMOkkE1lQo_lu7Ki8NTqJ>nO-k&~#6EyuF914+Yj-`;A&*~+7
zYr3kbDt3SpkT?2DsT>5EsY_D367npQWfI_XO=la}DZ9@jL`9l^1QqfA=rmXx-yX?#
zP<yHA(2IPryO3m*0(?e5Tl9elE+Khy+;ipnl7OH#+qs|s`49wzZwvVuk;8wnd&npH
z*82f<$l(q=cUi(O^NgQg8mR`~!!ciOEZG!NFT16T$y`CCrIDolaYaXUsVSs=G1^hp
zw<?Fp1~0xpu&vrI$7Z8H^b0-;ovB_Oc@eJl&4!Sabx$HZ@CV5lO)(noVr!D_9HHqe
zNL$;~+_g|)(S>l!%2l98=T1nqcNY2A5K9)exRTgE8Dn&nnF=&p+#Go!r)$uEXvOmZ
zzzDqA<lv@pmDz!g+KYU4=C{uRO}5b7rG8!|gyCrw@nyh$Dd2>?t_8o&led<*C?oo#
z4p-TEWDuhn(~5*DX3421mv}G7T#b3ktu@Ia`2Qj8y@Q(Wws&z65ETI%0@4&z6cA9P
zLxLipB2A=82?&UY^bR2rkY0iyAksxT(tAnhy-4q&gc?d{36T1W?>X;#&b{-U-<`R4
z*6>F{GHgD3?X{o1_IjSxElQF1x={P-ZI{)RXw246FdrD}xfkSXu$Ke0Sm~h6F7X@8
z2EWr*Onbhi2+JJ6)&rZup|Uipg21oPx)g^;N(lQ}8&FRw7tsF0E?A)W?!>lcwa(g>
zUl@Tq>Z|Q9;B7y^<%#EYPg5HA`XFvVc^~gvfK*@Va%KCY&-H(->HHn*_33%<DkkRm
zKZgUA8&gT<-Wea(lx~U41{}#9ct3@lk<^vqyCt{X9_16tm2>&kTy^D0*{!GwYd{g#
zKpK@%-S8P_fBVGjYnlhC@f)a)D?FhvhTGCDOS(r&xD&Mx-DmPxz&{VvgCYmK6@Sh?
z%N^~XEw9eB5mcDouVuQtQn_yiPLz%bMosyB!1U6&pbMz_QK>(fzMOxwPA6v}O?u$o
z2f6XAsduBew5ms4SQm9W3AUq_((kMphFgrwM?B(cS)yl5vAkce=k7@tlpGs6DUhVS
zGcZyNRhzHVY3_93ty4@P9jFBs+heL8ZFMI@wLmyGnj+{r;48`N+_hrlj=4{TN=yP<
zFJ;0JrEuV6F1?JN;TE`&h8}FKIq$~A2Q_ts^qabrI_Ln36#*PLi@{=M(OF9Qsqw74
z00CMj-f^VoiPc&+b06kSXh&Qx+hSh)<{sh>i}FY(W@%$hzqVC9ReF|Z@QSIsK!OQk
z1)86!(Z~>ONnQoNuJx+HS~0x!xVsnpewwxGe4mua1afgwvu;SE#D$<n?Ghd-y0kct
zK)La63|Uz)@L!b;`o$^KK=8x;n#pOIu+9H8g0rrX;hRB6<5*h3_{!bg+ZWGl&umED
zfQ=#Kem*c2I<7x{a@DP`Syb7#c!y?mOpS8Vj8|!?ZkdZ7WK{#uVKa7WR230BzGDOH
zno}^Z8r)ZtFq^Uf;-=u9$Go$A+1((cqQuV;>!!q&iSRi(;;xkiNsgB@<#vzt)hZ=;
z1w^I33Lk3u1v9=^2=(?iF*uN967plaf<?M^MbL+?K<dveeeAm#YI3ZmGnqH+a8YWl
zu5~*ysK{jb*o`uh^L0n`$-5Ci1Mz1Dfddt7kq84J(~(RC6)KGJ^?Y<&!?2uCkDG8j
z%168Eu)U3aKddcU|Mi6vNfF_ztv0j(8#m6<g^YGn;mdw4R{YVT^)Dyvzar?;BkPJ<
z{?-DZztENAAcSxst<s^!ASJiXslJHuyc=Y<pKxlH-wd|ndvdXD5RRL0TzLS$6#g**
z@xl?i`x%$7dgQq55Du-ei|L!^o?joV6dl(rVOz4od;9=iN<)USV3BgzB9tUnljJfN
z?LDXYhh_Pcl5R3m<nzPC#UvI@V4RlQPT5RG4p3{@mmlxn@G6noOWzZ^j?ot+KK-{S
z&Zo1k3UqzkE2I9pz#7-MgWF2wdu#XI)<;xJ<d8DQ8*uAL`TDtoiOb4Wn8#q8*iX50
zqIV#5QI!F<W}TypY$ky|cYGhaLw>2W<2*{2RwQy=FT*9}DOU%$y+j8R=p>(ax<q|6
z_HA{$+f%|@(&zM*{I(Q+_p6DWX0HBRimcJ*p(6Cd$_K7ya$&?R6Z;CbQ&^LTL>Gm3
zS6}?Fxm+LC{<bUOzI4ET(uARm*G^RC(1J#^Y-ty_diG+}h*LwvP6T;ai_mOqdU?C)
zdChi|t(bFq`4!xrujgT^K(gf%A)T(2gwSBub!7FLP1I^9kQJVvlDKAxE#B39>%qgb
zT0`r&$mY;Y??PotJMvc9doqerQ}7(rG+&x%>u&HWpC}Co0sbIAcqd%zTZ%#IYOiMm
zr|0*B_(7^P4`dTyY-Q$q$-dr2q^B%}+ZE-rJBd)(Fth91EYz-9OPxAK@|U?)Oj5>K
z!&eZ{<OeRRi|FAC*7C)|K3lrS=)>k`;hZEJ`F0JZ6J@(yfx#W!!6HP+T%B~F+LwEz
zGut=jx=uw2B6K{T-6@~h`Ai0%6=L%_*NZ|tWT9%OK9Mx5UenPfs>$PD#3?K`9a9(Q
z2h8G6I+yLf8WXVneoFip^Dc66sxx$J!qy@p2m57tYw723D=iV-vsrO~W>zuRC?ofG
z8u+Z4se!ncl_cO^1`}skzFDOr-l4wJdzft=LF{kaNq#g8>|8;3{Y>cZ@OYQNfj=9;
zzwb>-yuae|NwjY`9h`k^hl?f4MC;paeICi&`$@!z3)8~V;fHQ2?nP{jF(-NVawE3W
zf*pd+i2R`F9iq#1bVWZU1!A6896irku6AVqWQ##uF`{5g_1u6IUX@!3s`$ObqSZB^
zv1wU{cu%rzWOZPg5!YcXS17NP8dqp$)d!ZU#zr2|leb+3>|~Vfm*Ukc(M?>S?vq7O
zd<|9W?aJy>5%jx1SEJ4WYr$?~XZ*}7x@8yTSTgAVJ2=T%JU;kkVlIp`C$4t0k|YH2
z>x}0vsjoa-z-~rb?bfkaLz(WwY=G^VF0p9Fn@XlupaHPPGA}YDHQC!ZH2~LRJ5o%&
zC1seV^@{yJk~h~k<ju%c6NHrWz)SxohTJ%9!c0@CliVZZ<PmMVQuhm67^opcs>lJi
zq|=;DV|}tLE;_gMI>7VwWx6r;tlC7q3A=dBr_NdV4xgqU=x%FoIzZ{-yz86%GR2;{
zn_?4YCJem-*`XU;Cs2Alg*`D-5q&v`q}gEeorr|{tV%I8?|HQ?q4rlhRzs1=tuI`)
zJsFCP#tMp<<eUT&;SGYX(A8IjXjKym=y-DEZymV6Xj;XblVgA9_N26mIylQ0lARf&
z1?;YZnT*_TOuq_xxzX7wTC)6Tbw<0PB4T`Mz1V)xwE8`IqNt;b%R!*~+SG$-xtAxS
zCJGL5S{p~@uH}gVX*i|g6j$>F+XSD?=Yqw4!3fGYsgie}A?_{Scxvh(U%~T3bL?b(
zox&Txx{hnh*3)=*)mP_o&+vTUT@aqQQ=kPAi;BrWGWW-mKjhDvn2)H1-7?q5zU$q@
z6#(c~^{ahgM)KRXE?b|iA_tu!b4-*`Sp#E)<hhvJ8$h4;dABgCmlVE-Hr(VF!<MOu
zJ={9+$c0s}+0!~da38JR`351p9>HzRa1FwO?<Hsh6&PiP%av)qm`J;Bowt1P_E#V*
zz<L|v0KeTXQw10yaL7HvDBp??x_n7y<2cd{IZ#ELgDMa-H$>gGUJ*quR<j{eZg0-p
z<^eYLlzcx5k2Ut#?Y9JNRTS=HT)n>k<kQ=6yqtA=?oo0AHJLeF?Qy(P>bQ44l1v8z
zQIKxg=D|K~%)LQ^#k)P~@ZFENQ#~wg!b#X3WwIvo@kdEDyi+f&bK-t(V!dip>KtLe
zxwSKXP*|Lx7QUr4dhaC*%QblS6VlM#hX+CC`&l}U=7~S)jl}MJDF!)`pU8JC4s<q;
z+<g&UtOOYr;9M*@%#R@Ns=Ve&40vG8;oMULm;Umk7$D=)YAQV0z^y(J$JZKMzBc#)
zkmsnOzt=65x?AIOOd7V%9?sO{IheL{fNf$Ou71O6e)hqdDjg~RAiPvMN(k9ut$D~a
zPt@tQ?pa8i?<Sbb?lUBqPaB^=$4rUt%~vL~gLEF;`W_^I6PyM-I)Kd&4~O*3d0QWR
zoIQq7^HJ+LhK~Ep6k;EN2kE!>vuVX|JqHlg0LiBci%7WoRBNXBvP166qi_OgFNt$i
zDp22%3sJLhwtjsU#$9J|K@T3s@8?xl-_?)`zRdF9)jY*^A8}9fH`!}@f^F{x&mmg?
zFD*DeY;9fYkQ1-I2~nc9YCah;(jVciO91YA@$C_4i+pN!Zo=F|c{1U-qD8IK@W05d
zYqG)A9rmi!m}$s=oj~nBeR|PVejvO|qmPNOR#>}bT3tzHoZC2@sIy%)c=j$k4Szdm
z=O8=up-Pxn&R3~|vnVSz%T4KqGX;X9fIP@7GrXQFDOs?q`%8mvaRcC0@H^Br50I80
zXf1Htupgg`H<ZS_oiZGfUGm)1#JoY#twc(86cX;OVEYF*G&Gp{J7aKbV_IGc5V_Ka
zzOMAG_F)~SKQV7Nm#n1ko@;#UwG^p-jzmwWE+SZEJ{7pd17XBGznsi6-=$JmS@t;P
z=G=)Jm#Drcws~9gmFw+GTD%z-yh<MIhJcTYlGe}0iM?M~TznlELJaiOB&!q}RjGK~
zTYG)nQzJMur@td%D}DVSat({Y4BGRyH$Ss@>syLi4C;PP?;)S^l~+MH?SlN9TbHo2
zd6_1U^$MrC?m9GQOPRX#9)u;Q+{v;Igki)wbex0mKIcL<NF<!gZfmtdVOFZtyh_7S
zSouuJtsSIq=dT))(ScJ=vcpNIkk++vIpG;n7F(op;<dNEmkVX0>54rcg+lQwdmRZl
z{JN-|V=s`g__vv{nBI&Ay&hPLy9sg4fov6QAG#|;yS4vY>!myWY#^(HzQ6)!EEs4D
zE@h#8@PJJddOx?L4zbxLop(ENzk9p<oH}2b10Wu5GE~S?C-1v{H)2Sc5RYoCqsmv$
zl>RW*KWilCWJ|b2<LZ}8+Bc{<d2xlBKQxN=dl1VcXH52UfW$XAO+7FqKX$L+@!hyv
z?O|2!4RDv)T|`gJ?l-)(V6YiOO1t{bA@@NhJFURdlzRyKw<%1NX%doizb8!gycni_
zzWG=6d|3TXGHeD8xi7+H_`dtsUIkv<eKqR!*l|x1uBh{TfI$D=FE0bsB=8V?NR(X_
zNW9BcXa}d+1Vk9@*PwW)rD?J$zeP~j55`evR^Fdu+HLpu;HRk%0WXBpH{-m+;^MII
zJ$J;32Tb$nMapqqoGe3!cyZ*1Z5xM22aDwdU!|k@6UkLy+tl63Y9~U!i_>F6pNV^`
zcgZJieJq^X+|P~IDlD0wgmNfd0MD|&N~;;zH5IuGVQ#C1={2sLPZM!?T7$C~4i4*m
zOc?t0lII#yTxQrf_@?^S9%h;+3z+wQ8WztRoV0vfqMe`Y?6%Eq>V+`RT!f#e)<ThQ
z0?9T^a!gUeB_0qD{L#VlnGW&22P>L)M0-iNr}7~Tq|QOj<;bVV+nUh=T~{Eff7*`j
z@u8FlL)b<w27mKY8SO7k-x>3z#SYHw&%Th$NU3Po_>)2Yky9w7;j8lHDCx#ON)n26
z8aMywtqOkW^M)tT8<uesU-RjO5d=PXl&$E;t-k%d^@J^wSCs;XU-%OH<Owzl|JoO%
z8$aWBVztmx(D=DF4&i-Kv=Hf!Zq<G?%H4zqQm!$kC0J^#eFL97^T=uJ>PXma;%D3=
zsiwC2$nn1qd-2x9g+E`ixTU<;?KD%gcvDY$b2?+ur-5@}YB4Lc2v9&kFy|$Q4^OZ=
z{l_DN&`<P7z>p(;y*rumP+9zoJpKEuCFUndAy1PW9SJj@ZgV0N%njGkN0%TZBSgk;
z)|d4h@|X0{PwhW;v;?QNjtfo&%8q}=qZJHDouDPamxDx)+oc*)I@BJ#p7h_qR$s)!
zZrK9&jXs7ydMvB-)DgePua?{fs1LJAySEqPRTY$w8Y7#u-<@th<RgT9oU#Qj=;7xT
zY1K^gh_T92F&U$ox-{J?^wa&WdlZv{@8@g_=Q;M~o*amOLg8G6o6SX#f+<tJyXtQ(
z(NJU%WkZisuOSfKahFdH*<Mz;5}yhtuP$+R22&2$uL1V?<@fvMEfc1c-hcfij8YFS
zv1xzXfW9NKdQ<JC#-@>gw?sqZX`_73p<DIz#Rj;jh18(kwqEV6vzO;<*kR;BhO*Y|
zTkaB)3z=Dnwh_*)3bpjBQvK|yuOS7sehJsv?%RK7M;e`oe4s#a$TRSK^h;jfCj;GV
z$)}oc1zinbzoh*$ES=B)+6+y>%P}Et*S2eNP~!ZMkVb)yUGpW`=^y0J1tgPic@^uL
z4eds5P3O7IufEXMejRq>?N7cl&&2$0MHjm~*{R1NZJ{e*nsYJ&UXs8`YfR<Dw5`IX
zSDMGR3z9Va0k^iGS{$xmH>RX&XLbAg_MVKilIe|aN9CZUJY`Lbp|UXp5=EqQ*s9oU
zq%-bec)qWVXgPbVz>8DqrOLbLSVUVLtl+osmnL<$v13ov2jXE4qZsDIu1cY1Z{m28
z7->0aIAJSvTd@(@rXL4-cyhgda0X-?p^v1z+G^y8bc^$}+j~n?eyGGb6P;I6B|He9
zZ=cX8+1&Q_dJyk085m^IpF2g78K*!l@enuUOFdlVCEvOkm7a{eaUowX*qv@^pZqbC
zFj`Hx?NXn_tFiEwcHD0EHc2*Y5b1j*Nhs<KvAX^SZ=0zE<RURU-XQQ&!{K`IUUP!P
z83+~x`K)}PKUrlcyM3qo^7dM_?wABr5{|onWh21Ql-Pex#12dklRvWFV)L;n%xj_g
z#(Bv8NU&X_%)yd_mvsI5ie2s{LTFbF1rO3h)gEyTAic*f!T?iqF)ZX0ee13MerpN9
z#Oi|e(xPCPId5>u;o8CO@e+tJ4b)^?ptq1mv94V|v>y#8O%q+LSCJ>o0C_XCGFD@#
zo8l9x*0>xc@EZ}KctP%q;;yIr!w)g7Cz|Bl3*$S{!t2iSLA3Ry#CbMzwG`WB5t9Sd
z2VTbc4&UBA`eG5|AkF;m(L>jon_=@;LHMwKsj;%i@IJL{x`Iu+2_GY;-P{HD29C5s
zqbO@V8PN;u*k$j4;A^683KkGjjbZ12#E@r(nz~$N=apc#^8zlhwP^&gYl7TH4W|nz
zoAknO_LJ8e)<3OBTJx|{e&95#t#%ZSsxg^8KSrwy&YP-Gt6nJP4|qT|r(i(J8Nduk
z2$$+N-f<n=K)#*8!g1H|I0g3z&t!xYBYIfq(vMSYgwQMGD*MHYlJ?};-_~({h9@xA
znTq?T2|_Sw6l3)a_A5fcAjh?{4kXMSPo6ot90?|fqnP+CA91&!LFahwBIQ5#(5{9n
zT-Tg~Rx|`KwV*mObtm_8s&^9|C)-BO^fV1EYF;WzK|A8IpwKhCJ35dIRwimXUI*4-
z=2GQ4-Ov7^4P;ceu&R2M;JC9srb{7CcXkjr$aStt12c7;aX?`Kz%;p=cP3SsV#a%<
zNZ`YC`?Nc3GjJnThiT%k@D_2loiB8ICA!PVqmWKIk|yNL|FN~Y&dh^DTho-B`Gcj$
z5YN45N|4`}k-zNd4x(5`NCuI!`!|o2hA%qi?4-kZUej5x-BIAntZDMvJpRm%VIxE5
z8<^5<<9Gv<&h%@}`!V!24kawB8a#ZP6|tPqp-Ce#s{_#z_q3^$`vs;=@w(jg*XrKh
z$%eW_2RevXQM!Bh3>s;L;-&riQ@`^&w6ux;dg))=>ev~fwtZ?U$j)~6GZE`h0Gx!W
zWxt{M;j}8A^RdG6g)d`T?ipNTVCNd#N-7Sxbt!`P7UF5GBoJUOK=+K~ztJMfpkuAs
z86POr|0%hS+Y{Fvg_<GbRo}x8<+`3X)t5c5HXGdx|MhXqXSa~<W&5-|QQ>*RR@0r@
z(E7%*y?K@QDI6hFB`!=nK8{SMr&^TcCcC$EE!PBvjder3MuIr73?Ofb)5XPN{%3@w
zikfC4OT95GAPvYfk*|utyjt&WzCx9AJA@Slc3}>Fmtcs_Luq)RN&db0*}ws^)Jt~Z
zM5<3$?R4U+`)`z>?HtVWh>=y1-vIPkPh>J7dNLg_I@9UAqFI>L<=w*SFyhUc&7Oy|
zC#~ncQD)RTHhQY{mrAR#tOJmkUGtKGuQrFh_rw8S$0Jc0`ViF;N!q$4i^l7Wl!A*a
z6yMrIDF%I{{A2&-et3EoO&np=lVvjTwU9d;rXLLEJXkdjh(1KkZaTCc+l7}*olXDP
zG(9iU@dh+evaJr5L?zvw;0PntpizZf%W5X9gkRFT$KZ6=@0Q-F2L21bZN+?+It}Xf
zJ`LePrpEq=V@&2lG<iff2Jwb;`XkyASvz6AI%(&AV;iSCXkM>rq(|IQkHAmZI+9p#
z3X88+(-crp=L!enpMM<k!{FbwWVNe_9kU%}$agLqO|>V`I5fO9)~el+=`+bGo(ta(
z1YS%&ES*+E7|Y5WPS1$hY+ji(qieu)hP7+fiAn<1#y8~zm~gw=8-b1IAVHA#TqYa=
zk%WzdJ)GB?*=ocCcg6bQjvVlG4XK^2#N*KSZtR6|kAcerZ{+i4g_Gw#9(9n#HlTC<
z4qc24Ror=APImTOUp3lBmGnPlm09U(4i*~@+Kd)R>1f|NFjo}9<{#y;8R8go`ZtAy
z0PXmM!R9U1cZ;)-VNH&SuTC`b^~(LVeeJP~B`r47gy&O9jG7)92q?NPwlucMP=6`@
zi$j=uF8OH*xjMWA>C1m)-R^OM;z86y@x<S@*%qVUmE%Q^<%>kMuo44?){z}GTT*>Z
zqrOSIZLRStH3TzX_oLQU9V)4yhJ*BK&15EY)PrzcYDcNKL1PtCYr7L?9}?xY3SoaY
zNV(K=aCu=BorM49N|A4%UfejJ+Kkz~xdx@kUWljMY-s{Y_o0+#$@P2`;aU7#Zy@LD
zoAp@T!KG$hnxUo;;+}n41Mz|$+h99(ZTSYj++b#<Ci@!#Re|=^y=e>duGp*?;Ip-q
zP}+^_wU4S);8mXYUa<8w*LwAkUBuAe4@z)HY1g@@Z^$Fl>v7c=c@VY{*RyR822`h(
zIevW6tb4S7ZlZErHS5cgz^v?DDfgm-nc#-wWyek*#C!M5?O-2?w6<{h8!Yb`MrqKe
z+&;-Fa;GzEG33(zPcPGRHa~r)ar#>`Mv-oq#*f)y{Q2_dQZ1+Le$SNU!A*QAI_2d_
zBB^Zez&40II{(v(PIpZq8lAod(%=aD0e{S~-5n*$5{n^8^}#osbHzrOjofeEQBR8u
zcHmiTkzkkrh)KC~+t|!j$d#ClXQe_|BWo`)?lhiTxhy<m-pdnlubLvxllto2ya0gQ
zUZXobJe8D!JHvmAM)i#7;q%%w-ZbKA6LH?=mj~Vo#oNl6d%OG|=C8aSJ+=I(<IwIO
z3=c47owx<v@)k^QbNhG*dbl)TygOLq971RAU3Kct93+8`V32qr3r2Pi>zw_1s<>Xk
zGw)Q^(&YkbQz8$_zGxfi2pRH<4JT{nMU3z%UGUqGjL#gn_o%~sR38hu>(`qK?|n>B
zdqC*)c(G7ZOK*(QLrJ?3)xZ6`DJdfJ38DAm%rjKoli6!-J1>5NYJNHG9s&)5WEgka
zBlVLl=7y>_q0B{;#m3{Inzx#y-gmQ+d#R9IZ<?<--7m11b4345F-qr%6FkLaX3U;)
z;Ml9cvV?ab7?RvqCu#+A?+h66Tn}Zi1P_(KojbVtJj{KEWHg{k{5ead!8<KS*`|@*
z6SC0G$giKo8n=CD2kmno?F0jqYixFmXPw){OwdyaQDn&-pQoq6x=m%op&E1}!+hVX
zSw5QConQMYnnNGQ<UFPoj=LiYGCw?hzf3o)fB{5k(S#Hca&e+~azKp_euevlUrLZ$
zf%RzKh3T~ad{@%i!nlwzYLuo|IRPcW2#Jy_Dk*zmofhzxwL};iL1v3==dzhc&<Az>
z<Rp5;S)LH|KXE?oe5b*+Q`dFkNp4FL!(?nmoN~g{{4}>cH~{bq@wUfD(p#)MKOzot
zxrndMqbfBCJW3r41HAKr4{do^HLta;Y-u{RI-Ywh)q&}wHvSz3asqAPKQ=P7fl|Cm
zzxF-{r3K1wdYb^>$I-uF>|>L5^&+2@-<{NS>{QoLFiw4hlV@WCbPmsdd{STq<hO^j
z#rDeGWm1`Y#8{q_V(ku;dw*a68w3_HALH)H-;{eW)8A5K2xQejzbwa@XvywL&RWmB
zP$f)|hDjwy!!WsPv)m(WeXsn|K9sL^7EJ&yjzGbxR}qFGoR~V!3EMtlh}@A>k~n#c
zX6qqPqt;3l|8NtoQ7aPd8;pN^HQBsh7gAJ#UNT&lx7e|E|3+9Ws+|wWqMTTt+i^p0
z?8zSKlU(fJd-vwXl4h7A@jP;`vz*hKF3t)xH<bE@(4C<;GVgF1S(-ZRInQ3$n;!y)
ztecSOM=p?@3<_xD8BpWA6t1Je-_uu{WUOCM=l*e8vv!5M)b%ma()w;l(hhciDC^6S
z=tXW9Tg#$=0`CXg@ugH6fy&FnYO&6id6}Hmsc^~-W6Gy>%+p@7aY8;UTSX)8#>X{C
zKKxR1p?ldq-=kfAc4wQPSpS$}IKjK0vGE8uSS#9l-v_q=?@-2sf-Y~mv++vUdutMh
zuK)*(yazb9qw4Gnlh!BXH}Bf9d29M+!ky;&)@Xh)cx#%Zi)gXQqEBxJY`!QGBF!JU
zRm8etc{ipV(3jmp>qcGN@^rQd>km#SA8P-THNOW_%%+pc9^rJGVdiQVMb27V8V|&|
zcB{+crJw(F;}&n-H)PipHn$XvO*wx-X2q9ILbo#HS^67$9fg)M(X-Ff)&1R*Sa_e9
zl)FK@uS&nyf^+0v&N21XW&N(P3m75{g-r*jUerSkcB>9GwUHu`8m`3aoB6+gCkJaq
z5fj$!4B4ei(%P`eTu4cc#K)h{bVDEWK7*$Wv=(qPjqQWl)Z%v}yFJ+jMV`W$pY=wc
z%!9%kn%lX>pQ&EgHW|4i{piO{B}WZ^w)1QF{OgLRb6YNJDda*^VL7WLzVm~H5NVfa
zg!~ymXOi}TTO-|0(n>QV)N9&+|6o#Z;;8#6Mf}W7Rr)Hzs&>C-<gWDHHCivyk3%UH
zD0sVOMq*VR&k^63c5=J@>=Xw~9l4rn7}5~&j*D1!&2CsDx28>kcYt&q;d$jC71F8|
z`Xkh12_kf*%I+u<n_Fb7k_%<Nex2_u(^UvnN4vrT#H%LyTCV>g8K<|*6cQBMi~NbG
zB?SUiR0g9w>zv-}6J=bl)@DH7e~=a=COD~Xrb$HMa3yrRtm(O3rEAXu`ZNirlBa-g
z?%1~vW}ZR#lNhz41^mLCR<mfCf8~=e<)z&_Qg9+{{WcW_$4Wa)T5AB8C3vY7=cg{9
z*{mA$<iaL`11A!llOwoY-vKQaXB>A=p#w3^G|E4&Xs>2?@x~Lu=LD}N5kQgj2MrvX
zaoj;xMDxYxMN8f1)-7B1Qa-0Vz0Q)Et#bVBKA7cp_YvJeas-cCoBqj~_wtH$MiHDl
zAnXcZ>a*vq^|jFP;(5?L$gAUTP!(4>yV>w8mxO5-Aati%nWCYXCR>2`p<4Na&3rH5
z{F>z<pomg+sJ=KBf9dIBB5jJ>ljXb2<2~W>4?#Tg?Qj-JLFkpo_HYM<i<-f@jjj8q
zwN#Rh#fOv(Y0>URR*lZmO0MEza~$$TS9p3om43{4b+1=(VnUAdlqz3=Ou0f(s&e~P
zoU0Ran4JYSjKl8BgBSwcCjWjQI74F!65;*0aY5F9^UnX@#($a6mcDX}KgW~fZwVZG
zl^fAhs;0SL>63{=MujMYwJT$rTl<5yNxP%jq)C^WsrRx*{$){WxRu?#b<9h8f@M04
z2)uazQaSh=-Rb~o{Nh!txVW%~J7qF8R55=y@L;HQEpx+#=(<xLgS~t=4Zz?LDL&%u
zeeAKNBfr1v{HRMp@coIO&DyPBKFgXcYcPps9(WfOz}k19)9yC~UE5GRiS%45D%Hcx
zl5ASg^v>!jSM$<WYGW$ljD#5l>073-_h#N26id_XTEz2J@+*rF<epnHA^FyXg93{v
zwQU4=*1g3!@YLS(os$kr#yvhz7aP|1l$RpUt%JskZX-`W;hy+pG#+-WRi#={MjxQr
z-6CW=+)M_C-3A2KbZ%bkMRdw)BBQ1DJe45Pyc<0%=NOk%{<$IlNqf2@Ago907WDP3
zbAtt{zwlO(+UP)De46-OHchqcQNo=ID%$humm;`?%nbYe1a)Y71)rV3g&0tY2w>+0
z0}bcdoN3TFY*1)P3B0tS@dRSI_BQu+6{}EMJNgLF-i*H9{SAB-Td8~eaWlyitu1b5
zXc7-%4=Zpvhe=QrFiZmjya3jG^AWWSf~L(ex|qfAfU(@-Vm1J82U|UmO5TPg()5P)
zwODys=ct_|3qlZUGrFg4`s{$>YoWX#uILL#FFMh-yY1HG+CkOqKKV6)TCDBhn&t%h
z)E+-v05fqJ2#NvawTt3e@vK&uir&#OwE>2;0LZsN1(TJu`g{}gHMj6O<+&g5-CF-a
z*1RKQ<@%o{!y-C^BDMBAb#CI~_X~Kx{1c_0(bCN(#z%^NwG6z~D_N=WkTxU2Li|8+
z>tN2P=%HwFfwaFuWxw>e_v}Cu7}xaiu(zkJ#GlL92%w0oeb6!1NYaduBUry9hqbFM
zjm+%j84zrRO{#&VOE?4<%RnPdfP9?_`OuyGbNHB3h|GBq-w^k$_ih{a!A@)7iAg^Q
zZGVW>T0<d?_s*=|kvS4y>u****&DY_nFo$&xYm1XLXt%w7oi8i^rFnmyeDkiUU7KW
z51ZGgS+~R7SHQqb>{HBN6j+9BrA<F*S`j|Fh%|m&P8qdAKXfyszNP7#4$$J2MbmEk
zyFad9f6q1zrS|(u_T^F-&tLjp^I!W_l;XQ=VqxAx=IY*-2%jaY6gTtmYX+RXFRkr_
zgR-)l62ll16Gv1*@yWFg(?@h(HnIS;3uaFz5(NG{G2Rf$BFKDm$-*U_Viu9)Dsd+g
zagm+|zn%Jytsi9Hik`6O_dO?)ba?+|!`oYDtgt*j3;3_@$dRpNR0c$QBG>kRIt=`8
zM}>4-*H4M@zCe+K=)Y+j`Fsll6@`TL2AgY}{SPrGPq7B}d>0w@sV;o=^m4HLH+GI_
zO%o8`qS!RQdBt-dzd~a=@ler|F)yMs!fAE|f8Ur{ZQWUVILhn>i{C=tOlRm}TEm74
zvTL@wXRBKIVKhgVa(rK7DokW8#f{b%NTF0T6OzteOtY_GNj$xzNtCml^W=k+=4|p(
zr$o6vhWBOr?>xq+wC#<$&b`F5S`;6u1_IJ&twHA~*M}-74BSrJBqOVLa;QCQs1j|1
zJ3a?>#V{WEqras*Lli&oo5|<q_GO}TI8LlOe1&s-J6GMv2chWFSy<-Lw`0$}8;Aza
zXkJtKm_^ka?23A(JkHK8w|*bAZPvR*A77yY&zQwD0$yho_B8*Dzf9K^0E7R2`}aZ7
zG-m=FN8ILg!1umrg2D?hy}0(BuTfTsvhi^%l}byf_5kAHU#X=Vz<>RPE~@xB7%4U3
zWNQ3g%2fW(PZx_Q&vGyu%YJJ(!^vWMX8lR?n(v>B$HgO)(UsBRl^q;o10sP%p&zh*
zwDFhud@pK0FzTyFp5C+B;{JD(r{Sa#A1RZHjVN_w)x>OB#C6JwG6FLJy|;P#0yF>M
zG?u-aK(3S__lzSd%bQ`FAG;Oc{+zm?vr|om9rkOL6son;@&-*Z2A5gA##kGE%>T=>
zq0iMREnd(2y)x#1{>uP5Y4uCB5e<CBb^d>8t;Ss6y!P%*l~VJu-`~DOee7pU4H$L2
z+IysN7^|}auBH<(UD%4=4VMeX)UjNm+hTav&p=7Vv6>`2(r61lzAHBj-o<poVo?lE
zax$}zDAb;9nIhT=l|08sqYP*zK{Tz`bJJ`-(Mm{6+Ooh&w_DseEhQE2=!{pK)nJzD
z2QH}+*AvzgD*neWtlis>O^k03`Dc|rW1#DM*;|SPhhwv|DDtrFQzN+?+0>yqAxd8W
zqFI&$V)MS@qNj1uTlh~0-=+_`P8Ny3F~2cdgPGQ{831qW7x|l-Kdjm^QaramdtPKI
zDyS(!-y@ghL<H2mG|3jxNyxJXM=iR%?2K53P@YjQn|^Cto(Y||_e?I@eEIH;M(|w;
z+<&A^&A=HM^Tx4pszi&FP?;e&VHk{`szSU^|9IG46&@|R%($IZPjv8@OQ=(w%iPgE
z$^~XKYq8`7=jgE5cvQ%>OQD(F)?CrdCo1qS4s+B+@$WomFytH6Y6!&L4XXOL?_Wk5
z`6V~!0etu79Xr?GIN{M_YCsqZxIX_?Z9;10_?_^H8X*g!jVNTGh;$!{f-K#h*Dv4q
znu%+;jp!2H?>)X5gzsN#xB?l-qGnTr2NS^XW!bRJyG5DagR)_ewExxqN>m*3aIY)i
z2442sT+Z#V|GOWk*tNIMt--n=%RO~@c&N2P)2)6^Q|McFm4=XnVMFwNlDgor(SEf2
zOM0GR(Ld&Fq6l^MCSGy^C`gYK5B+7@4tdpiyUEHtF~NCFN=4x{B1=@oZa#eG2nrT*
zu+f|diKN<nR^oN>`{HN*QKkNVW1+u7nDHJzKig4Tv-hXlynTwkONv~hjGW6fR5<aQ
z`F~EW{BP0pe|f3cvvErNe$Mms>-B$kqHFR*sf*^iy&E*>EFJjM0s!NmLUoxV+6yO&
zR9_pQy}y04a?1}gpUkrVu+p>pWC2W7gARYXOiTT}YpTL;OcL&?Nk);DzO1JHd(8@g
zX&v<R6%yPgZS)@cs+*vjTNv&+;is>As_*cBfArO4>NlIj2abQo!(lqVzL(gdFXTnu
zGObeb=4BL(3d@s(%|;6Nhd0&Z{s^`2ZAB4p0J~V$=sEGcS7<tUJ%0I0AIUTxW$n0a
zH(UlSsUe;qp7=`9&es<0;yw2L8?-2>7$g_qx5F^iWN`~)>O}>4EE|O^%Mv622{55x
zd^A)nM8^eHM5GQt6o%?X6Rr1C8*=94aEf!AiFKVXd$WfRK!1x%*nIjV+;^CyRrXLE
z65`0s$*4~-@coiiq~9w0#XEG`$_qUEheR;Vxjpz-&<r5%{uO4WA5b&+NyNpvwKmVp
zA^<D06tKq+ogK8U0E+Uyr$%_$1l~i!At4N8eB@eW;$)&UxAS7|4x+1AXOZpCK>syV
zr@1vO|6zfty!SQWKQR|JZ=G!=F){l$dHpBNX`1eekHVu^C{wG#o|d1=|FygPD~tDx
zmfI|Q<<Z$!7Hog(f#0Q*r|I1fGn}<(yr}LvXCvZZ$Aoe;p@oy{m>KdvXw_0|!IhMY
z`7GRzu@kCV`W_eVFP0qKaQaTLwtk_eO`Jr~H3)!~HcwM0)&CRe2kpu4@?%AW)qsH4
zT)Aie$uju-=|dygR_2Ljr!=TflIfrO4<X+zyM{H-T9JjiPn$oGXo~k{O&(#?7Y%Sr
z!&{?IVM{zVZhC1Vg(#|jQUAl&k`m)N7*zj_oo}dL+<o_EJjI<9UCe8_v_m~=eBaNE
zRDb{e{ZpeEC*Ob?!pm;K6kc?AL&HaoNCJbm$^G#fLwi0&a6`iobst_1rV2ARBLsk5
zFxS=Kv_bs0hC9V0i4)7BCu(HpxgVrN===<}85RuK*{*RU-Z}l9g{(mR2hY<0MGqgG
zJf@=gJX_vr4U*6F{q1=7q&jys>bm%&5D7v2f>AFK;R6WG*RYj4ry;Y45B~b%pKXY^
zE&>r7DO=_F2RgjsqTw(93K<bpa?`u^8gIaWLt8Xr90A&m1NT{iXSCdMuc=0HNt})+
z9Cj<ZyI;(J)L#CY9PICR6IF~a9LRg<7J1$t0RGwB)x;I`G}-A6m&Y1zo*6vmxlcal
zsY*o6-2SuJT$8AaO(T$ZhYf7J{o7&4q1{CEl}E0eNaOnI+L<CM!z(UteiT!KS4Z$l
z97t{lxnG&Er^17};LX&@dHxZ=tC_!$fimK_;f^UX3uSynb>LN6s$BZws?zi(?ca{w
zxaRZr-5b5ZrT_L}<jdY7`U1!e%~D@mHFnU%cxGec+}WoC{oRuOF|mGi%4kW6>ZRj7
zluFZnx<7c?(mIg^c~4TqXR#0BMAeDs|9|rOi@FToY-AF<?wKn6?LPDuL-6l1Oc&N)
zHsK90q&3Zv((?v@*E-g8!q)V(U4xh;*QPT6H&(_2gM$J21^%gs_^R(lZ&D(9=i~u$
zV%SHE-Gme5-DP4DBSB{YWb4a{gSwr?n(L=y?^UdIyAGjN1^fdT1hq}(wtUm64X%|g
zKI8D+adKCk!%WrnoU9PTAj7a>SauArx)k6~ERD54=petM;?2AR;!~fW3fZv=)VIM|
zbHnx{-S*x3`*GlvI*cXhsCztfM~gahqbZL@S*Y8)-;GD^|KOpAXD#35dqgImy4Tgx
zDl>jxdga{>-A*bDP5IzuTf+o``nFv#7&xB}nm3*cjh*II82>yz9&%|?>$UVLKSjmq
zA=Ick8s#o?iI*+@N}B0l8m$A0ETC`H;lcyiFG!RYAGvTtX~g{X))Wl={oU8d+N)W<
zV^-ah`r`2EMz%2!uc8Iz%QwfzrK7_}53#=p9vP(ZtpY_W>_je0a^$(p*liFy)No(S
z^p{xY!?$>@S(zd&?>u}#^(cGV`A?Z}ti3P4s7=D?ZFE`aDN+n1<1?hxgV3G|p!|ub
z|FZKme}L--9uxa&k#OzbNaHWOQRL%2SO@zzAV5?f`%*)M@mlKNV6lh)28(5p)a^)y
z*8~GMq%O~91M}IfmVN%<&B#wHTN-B#^fF&P9+X8nZ!ey~NRQF)ICXM>Y<2j*Cw(9K
z`LMTx0~%XbB*XVBpJ8EnMyj~_H0@FaX4?T@Ie&}8`v?MONZT$_Y~LBw)-}Pjl&`^n
zb8DJdMD1Ql^T&g<H;+E|^Lmc5-Bgdmm~A-dFU0AJqNcEEy|?XsLd6m4ah^C}YHL`+
zd=p+1mYq&|^!6ae%5$e(*AshUbzFGQkieXof%GeIPD{d|!7<0Vn@j6D4nr)Wrfq}a
zs$7H@K|qB`jHeTyLxX2BpF^%1fLnkHpzv;MGNJgT%HXRb40zI2Fmk~=ZBTBs|LeGV
zkx%Uo77UGj3sJZP`~&(UF@eJo)uEpK&S+=Z&4<)T=zbgeuhRfi92NlD_nHY;9W-Ri
ze;xSG>b~grNU_PYyv(H0XpN4&s<+e$Y0%W;WkP+pn{~NZjZ)%!iz_W(BoC=X;Ms;`
z4JC<U2WCEO<k?{U_a8q#HZ^rWbm~MyE$DfY>MsZ`%ec0ueDgRcxr^oZ^q6Y(w8=rc
zpDkyT57{?n1V!2w;(Q)^)p$#p66Y8vO}RrK7T<jN9l}|}E7jIEwgf`?nM{`KnS7jY
z<W+wqBvsEF6vZCCrw<BpSoZNszFO?_fGqG?^XDZdH`O8b?&d`0lPD2`<CV{6>Q+lm
zWu&X=`wyTV7cpW!AF){80KL(bjOPr=P%FaKJ%PF|I0&2cZHuN9=qc$>e-)<qpUv~*
zz<$b5dMU4IP2q%%XTsqeUe;InfbY@Zgjta3WUifbnB%~y<ixbw<;o;+M-4XLYS)AV
z6=XK6gNf|O?Ya(}!sbIXE!Gde;BBhm;hR1$h3%Jsk+BM-7iEKT3SA<`;02-!xt1D-
zb5wu%{DBGdH0bMYzf?D_PuLORDjU~HMy?bU;~%IebLsY4Qr<u9Wwp<tk9_R^hGHR#
zJ$z=+2U*uv(dueP0pS#b`?E2%10c**80YotOhjjwvLV%JbfJ1>TvBYHMPz@jgLDx5
z@<rb#C>Ms;FFs|HXydIL%ts-=d<y-q$2LvrAl6KI^N>NE*NPsUekJh)=}RkFXzb6#
z`?59D!z8G%Ds!@8Ny^i0=H{Rk)9@2Ftl-C~n)5n4Co)Cc-`UbS8|miP!SY@JU82*2
zc>70B4sRcmbEKsvau}5L7xq+xGV3y!G9CwZ^}5FSyz7%q`<W`OYqH%wk~boc(4dUw
zSne^IwV1#bh_sa<%gdSX%``5Mo>eK-iaeKRN=aZ7;ek$iFTVZJ;P{{)+oGJaG!as%
zNj$x|N%x(sZ$X}Q;4jvh!SI1!g@DeHob^#&d<}f|0`G#`!aaxJ8XxD>8$$GlHw&*A
zvuVS)6|z%?2Hsm!TQqE<u~IW@M>2<MQJ^0RuD_^I`CmmGI@a}i)}f+%>RE2w|Jnmd
z5Yc_L3vX~LqPrn~ho1BN3+HdV4%Nm6girU<#;qCLf1jD6`5JSz$H=JVy{(+RrQyH;
zv%73met-7rH5AYNMX|Dg<|tIu2sB5@o~yCO%ZHnOLV7#Nv!K4se*RnbBVp)~m44HH
zbngS7j!J0{EuQO1wpz6)lR|^q?z8WCoQ4d~_8ebF;LC-~YA>RS8n3R<H{q(0CE^mr
zzTO-?yaem7d3~jlAfG#s93OCVA>{PW^Kar8e9le6yeaSit<i~IXl&XC=EG~hX6I6?
zjVB(S_SY;Y-?D&GCqaNC7$jve?QtsLMHs!Ri_7j|6hduFE_%hXWS|UhH>0+O1b(w)
z(!%A;KyQgdP5g_O{35L<mS$E+)ty7N4eR?5&Y+c42Hbpo)H4@TXNcA5ZU<Fsn|V{f
zZ+PQhX_Cvk0g$v!-4#$o;P;uqTMJC2hopxSw~N+*_>?RAa-*=FF_wSD{y)3H!G_pG
zqbYE}Es_oPXpP}N6G6D}Mh_6q`S;<oLh;6n>=%`eV=Q7HFwlb+37xX@p(~M>wF;}u
zN;c!!^0%*@i?aXl@v$D|(;@OY^fJmNdopgQSAV`%#n;)yx)S7L#v*t$_T%PokYYOT
z`4?eYl0PpRmhM2eF1qhbhqwN+I~zQsZS2mh@|9JVgqxe^fdPt-zP#g-*NSYd4A!0>
z{`~CeL(L=6<`e#&=vWS4B&Th`@2g#^kKvX<ad;3IFO!ds;){5BHO=>CkJ^%D#MqGp
z4l8Xb@DjiRtR<XDwy|36k8PURchcG0RZdtcP78J#q7PsKtj3uH8|s6j60UbHk!M89
z#j8vo?l?CPh*vyqlFsMO!M1&pwDm+tA%ST-suBBV5@F{PVcC+2FseQ(&#SPqACOlC
znI@x{`S3;pbB4%e$sUII)W|PZf)^!ZA-}K^(p=q7wEZd)h9U+5c=oZ*>E9v;5cd-q
zc4M=}iSdxew4Dxp)$h@lx|F9vz8tGS;-`vsf`=$7qk6o`Vy{EM-QZaRqtHQ$`zg1F
zX?7eplU*Kv_0}UjJJ5cutGl>6q5AtS5%%o;anp~R?1np=&?HMf;GH9xYo&R{J|$<U
z(|^&P<p$ygFO7uh$;e%l?PVT%7Y06{=57qb4L4-D)k?QHzaY8piY`^Ib?v-;fNYfJ
zfV7b+(Txx}=CgOg=FQ`*{RY6L6z<DWoyGfn<NFOKN6gw}JtZVU6FdK*_}O$UP?ANM
zEKOqM`!*J}idHzbRhHn(H$HYDEAwkD47Ax}`G-BPV*7u+QeeEfsH9gxR{qRTPrf6m
z=P<pNevHc_=tI*_vx2%CdcxV8w@xoQo(sCRlBpnka5u3e;C|)X^40Oz0<}G`G5%S;
z3tc<GMEJGA!o4XJ7F&F>dy{AfTh|I7{>8QU_|l8s7tsz4V!y+JT2=k}?mYT-nYrRo
zW;UFs_R``PV_+_{^CS<rP$p1IX=)bn*`EVVd00fM!M;Cbt5$=4hSCOK=<F)DY`8|5
zhUuD56#3?Ai#9*=GEc0Kd+k}&J9m(ei8Uh%6o^WuZcIb!a7hOr&}?fkcg?vg61%?`
z4j)iq{bRy9l`PLVO~3sk)8w~<qe)&WZys#4Gc^~sEa5eG#Y-LW$NJqE|Ji~NkEu4q
zPgI#uW|h&V`EM@Z>C+u7NBe<a*CMqIqrIX`R!RppPkkB?p&oG}wBNaz|1SGrM1Q|J
zNLMRcD7sl<XA&h|XFU<F2LhSzm~2nzE=+;$w~BC&uGNZt?iPRdw&&Zc1DfV_eIbA$
zK|cN$Vb&$f={M!oEJ;-AM`3XR=^M$Royq``&}*<(Wg<*7n)guZIAeng`sy@%7^;cP
znuW9X*UmekA{>@PMd5xQH2d|b_wvkriIT=2o;Q9wO5pWuxh!U6tvkRIA}?e%<%_^2
zKZ&SoszsddlBcZth-oT_c}}w|#1x1oq_0R7o*}J_J8_wEZjb3N)ZXsBWm|5owfcA{
z>l-O^^LBYT>u*B@gHVEe`2C@xZ79vVc^}T617G*oBuSn(HPi1MX4R!KHejL_^$t6#
z{oeu-t@TlRs`|$z^d0jMQF|^s`m3BMhxT|YM3b6aR`=F{*h-n$xcw|@o5=eU8R6qJ
z!d{;0=U~KY>h0`w2rrnPqV_-rLCvs0e|1XjsbamFB!$lj*MK%DXU)d_RmEPN&YqbO
z+?yqWT5Bra3-b7y`G2`NbK$2OTAzY-6ZX|S-HIh{#;YJdd6gGMUo^)MWh8t(1tFE(
zE#E2NGn+zRx4o->uXEn2nHw|xagwkf6sB%aW~t7wrQ4e^q~kQdt$*`sIh0W99vA_g
zfoQ6l`abx~xsw<WY88|5rawuS67Du=wxPoMp0{O-p5=%9gdF@kj0&PCxclcaa1L*w
zN3(%@aNO(qi>4xMrYdW@?8JqcspC1uBn2kPhU&`)^WvKHMKxDobMk%GAP6C^6K{p+
zm`=&Za93ZNK!(lSSzgM6LdUy$?LgW`%-8y%ow5yF2Wd5rSEpN0x3)GG>fgYE7NdAm
zgA<_j9krknbx&f^1Lxwi?nNdd-#5w`$HK`LPsJUs^&i3pdw~j|Gw?dZ2VTv2Z-d&T
z>PDN{QWD&vvoVpat#g@XyVZ)N@flk;bRQwG33Q9Bdsht2+uZ-XuoU2pbmqOnD@yG=
z{!b3+%M)UHQLQT=a5Zp{6O3H%9^_n>I#Gvs%)8M4*|@092MKA5!9LA()i8O#|1PUK
zMboG#@$giEl+X(7P03S*C^u@FK<BPQ?8oX4n<F{Y{Yy|OY`V`(n1gbTdg99e(AlO=
zT|d8Yw;f%lz#dJ`r<7w%WWN3?wr|3-P5db9-xwrEB0sJCxEXMJc4!)n>=b7K2EXWT
zNUot6-d!&i%J)5$L3USjp8Zrw+2efu$jj^Z4UWYA?Te;EG`&-Scker+_3VwKCIAjm
zgZzOGj-M<=tG?TMF$j(C#Oyx7klyZ#^$<t79O=VU?!kI(sU-)q`6rGHKHg$^5MEB9
zsAs|S^IbH=cW^ngsUx`Q9J6o=<*GaPK~zpH^4$LHei^d?^ErqHX<JmJg(PccXfBk9
zz*e1{u;xmyrp`-JLFohHDD^W}&xwBIp-G}vmrJllG6Qw9KhEV&TL)W`QwZr+Qt=`X
z?*0z&=b?*2Rdeqx*w0uQ)eQ-9B)ZiLj+9#i`cI=oVnQd+8pIRoYOhSyUOz~q<kCXj
zsN77}Vi5_8R`GCSnqHdj663cZWQm=`Dm6LX=gHLxsBC=7{IP}lT+0}h#@@G9Nqj>r
zxIH>PwnF}H(_|11zExgo!OBF{9ke(u8K0q;#lxS_i}yCvbxhP@)a6&tQ^y^5maR{Y
z<}FlHw5h{aFnOvyxQf<O&yypm)o3pvKo(JE-&@c7=EuWNokz4r@ucA^C0v4nPrrl%
z>&JgJ)d%xmj^?r!5`A=fTC+WsOCd(ljyjmxs`t5xUZxvg<jiWj6hz&Ol*OUJq!=%m
z48ZYfj=l+I$*TCe$7#7|mIA^#CPStTkjOtdV%cEuGjqUiOz(@~O86a~wgB+6V{n(7
z=tSe;=Dn?nD+&|CgF}DW?csCr;c-7p2VBU~P<!(5pL8BTi!GPY-ekQQ?5L~|vhDJp
zV!&7IG;54FW{#_w4K`U2M-9&u1o9qNbtSh{NpIg)UHXdRjgcBvgNOIi){m1zBO^0i
zBJq|>Y)HhFv~~X<1$zrHM1cRx1IFm@zPzZ)`ClqS5gf-sJ&J|9a#frN!z^*(gavAS
z(pk2I<!842#|tcKB};a!hWLA?)1IeX?i4ijPm;8^<08|7Fsz@QcId6{qHW)OQZ{0e
z6ahty$?1wM-~5O)3~=eZP_`y_x4D1EuC2nb#^P;lvYqN!JZns#SFkp*IqHQmRHL?W
z7dDU}A5jNpA1{6=o~~Eu!^}diy%<a0kz*(Hmun}dC8Wc};doJG$E!_blMK6Cyi}&$
zAwdqS>($PyFMF^!&~)9tW1t$;k;ZKN$q?12*p))5<f?ykQTfVlEFt@c^j(@f|M_W(
z@kjb0o|bY1<*a5OK06ZRqox1wC}T)!$#15UPgSLk#Nyfoa{XHiAbdCZL9pJ`<VFpJ
zkoiU6;JEn!X5KEzx(hyAFPNkanB_>Te!ke=*b;s-pLkbN*o&*!kRxQGm>_f~0Td)0
z0F`0)7;*jl=FAe&{PIF_!KwtUdG{kygC&{#Q<?d;(2hW*j??qUJlXPxm~VXYg$CHK
zmS^<jh1v?ejuycw8C5XsJI{2J)7mNO&<yJ(htvtffbgOkCXadfVRjH{M`~{!+F)*Z
zHR_`e2k&S^M?3uhvBt=C#+no*wL1+c82uhBZpAa5lz%JN<AG#>@FZ(N>0<ALZ}M$D
z(RLBQ>7*^yQoNMymQkEW15<fUBFXmGT%Z*UVErz-Xy&s%k~bhxZ}o%t|3}=LheO%M
z{li(J)siAvMoB7LNOnVtiVT%~8Kn?1_T3DrDA_6`dlFeA`!;0X$ujn_lfl?#G3$G2
zx$kFrpZE9t{(6t=IMi{?ImcYrd4Biv`}v&vv<(M@`Ccc0Q=S`$_`2!I9Fy{8bc|38
zvt9s!TSUsC_S+i!uPG$TPT}!>l%L*8jumh3n_EI_J>>)un*teQEAi+CqJQDl`X8uX
z8qq&A-e?h*esSBcf-|*-`l?}O^zQR0^sZoE4Qmvbk{4r8Wj`xE0nX>Y?>lo^XU48{
zDH)uLm<jxNxC$jw;Xb8$^8Taau$;oCMLJC6A`3d`re=rq&mx4j*2ei^@qi<kA&Z^V
zAYb=F&GQq7n7_?G`{FI?2!X5K;r$M)#9ci8uv6z`<|BJ>+2LL@65|o>?xg2B53R=f
z!`SIx2Y+-;npCFWxjYctuQo-r*=kiq^b=!S7KT-t7p}vao~v;3>DgHAspx!RcJ<HD
zFId$sSZYpP49`clS+w2>?cuD{^t~(P4rHJqH9BklvC_sn%*BG-<B%`LgJLT~U%**E
zBJH(HGVYcO7wG)3wfx~}aGjAs{_h6LwKQ4Iukf#Bf+ik93A8iy2!2cry{boPy({M2
z!0^k+-p8_6B75Xk-uha8YL4B!jBH~wF(QC2&tL6IBHz`O@MiQT&`f1&%#KD>Q(2Ab
zi%H+lvBpmX@M)PoicJKU$;`K`M{(LGfRAvsL|kHw>#o<SRCDJzX9XT|I7s}s6;=W(
z%OK@5zT5fCD1dmlUp$x8%mZafR!~G$NH$P2Yhk)IOtOV8GIJjnIIiURF+jTL``4ix
ze0k_9_WS}eA6N)8=OSWdR&n4kPgf%)%h-G*DI|e?A~OAA&`4F!B+!Wgsbse2Yp8JW
zcwVs$b=FE?YdgAV{fYT&Pt3jt8So0m!rFYh2bXMh>WdG(lUo-h-rmg`J#XBd{bVVT
znAhIWs{!dat8d9Fp6jLkn*7<InP}Hmz83Uoh`ucv>DqBt-Ndr6b?G>>%Ul#z8hFDk
zcm*j^c~w!P*?$D&RX2S&Hmc>(v9AS;ai0FBy9>m1G<*4n*J)dhVm4*W;<@Dg-;$!|
zt@TOij4S!-<VdQ4lk57@&fP7)sG5TWbB0cbfZfKzhGdk3;I*$ajZ7_6kHD;g>RK(Q
z-3;EET$$&+HJwSUHg)ddu5(e&C7P>XqW<+OtxGmO*zpkyyUCl2TEL^@iw|j857$Oo
zIzf>~Zx`T`X!|#6L3CM38OFFF>X!6wPXeC*T3Kzl)V*^ayBVapGEr~(8Gm#GORiLK
zfBEd^{^k~3j#dAAJ{Qal%tCM=cJ6Q@)KHMEmlV%;A9xKo%l0$P^4U5pFpWw^+X)M7
zm*mMdzz1%*h*OAO*H0%R-4-(L0h8cs1;22v_d`ha=ktg435MITKbZljeUV?o>BbXZ
zC*X(h^Ua0K-w-sW*VWc1dnBYZU7eNjG~WmvSvxa^&K#s~1#!{b@<U~#Y^tA%L2K%P
zR6#T6jdOxhe#;e;UN^1YD``}_kWb&G+k?)rmGEo@llt6uf~&MF=YWk6L6RqM;Zo*M
zT%)poOAKd{trb!GEqHd40D`e!n|o9^Y!h?DEG~8B-=-yY<}Oyr6Z<}cOa`q$qSXMI
zY*7Jt)GhhGsh!38Azk5^D;c9{F|MQGp@NWA8b<JXVb+Sj{C1T(+G5G0`Ib0|YEI0n
zvg)}G%fk2F$B;NA`KNllEl;;V#4mSZyynCXKHMqis-|-eqKwi>^{4ss3a%RJ6bL*_
zz|02c6ml2)@yU&K>E-|^t>oz8hgeX3b|SW+#vj&Par*RRNoC=9NGZUJr3p5_|2j*P
zj+_dW7z)+5%#xkRaY#6JeAIShWED69P?Ew6-+CMBLWd}=^AzMnEAiS-5-yY_dhhQj
z{C?mdK<N0xpG*slN*k`aa><RcBcfh+DO~Jf+yjb<Dz~g`v5hh5+_7%~{Re~_i=B~c
z6<mjuepbh8?1w9REe{T$l>IG@o_&-Jp!NuysaV-M@SPJ{`2o^?)>3%exd(CdgY03C
z{pxo5aTv-rb^^Vc6%loJd<bEP9zDb&R#4T7icIIRu!nM}4KH6PKYS0d=BI7&CFJ!t
zspiVvDZIYR>2o-FM<Xoh$ANk84Ucl0VP%U<nH!1YVY%AmjrjV7(>&G|Wu6*1wtH6;
z2?Mx$_5Pc@J-&1B1{oCpU?;!Ag0sI{OKk9m!sNQw)${yJ+N|g!77Ckgn7B}VgC{I;
z+W0juSD&X38@$%%HhPtvv(S>XF=9)0YOHAbh#&blL;}7aF=_sM@d_5VzPX&6F5^QU
zkGc=RdrGg~jIG{0Z0Rb{A)-H8AiCh(%`c~dZq!a2$xKM~Ta-NonIIBc+~f<^Hwj)A
z3bYX~kdAj7NIR<ywAK2A9iA)#Y-Fy_ho(jW8<}UNs^7)~t!LUaMa+%-PCp1aEima-
zpuONO0cg7MyjXJv0emeKK8`isk;bL_<1~6h5WT)Xr+iP-no{B4wyB?EX*$$P-4TDv
zm-{$xJYh}>Dt&##^kfI(Njgv4O)S@t^7E~(F5T>)g}K%!P1Z}^S5km;0xn8_2pse`
zHfRB5(e<Do2fs1xB;|UL8{QnOuvtAPj_B<gGvA%!Gr5Q`93I&!LIHfvg-v}=#bvFf
zGk6VIJzSibtjz0<@MT_8H8~aRZ^}!2kj3V4uc2_!*Pr$ghs<XI)fI7zq1J+&O)rwJ
z<O<~0jTZRcZ0b0f%l(4|_L{c5a&rPY^lhUZjJZ1DhTZ>u%Hw3}+Ej1^!jCESo_Vdq
zXz+Ci?0W{gu6mqjtwG`ZnTbIE1GpHi)yZASD^BB5^5}?1hk2%7_=6gnP8+e@7uLT+
z=&XhnyEr()iVwef!950a?Yoa(w+YOTFmA9uG3^+Eek8w3HS8<yX<3ylhcT6uDG>~a
zRj-tKQmgwKZsU4KA5Mt~abILArbsVd=iu{8d3b3mONJ+rVQ^tVQOnnnYL!PX95Mk|
zTT5oC$Ngz?QER*9E!YAWzV{TeI?b><KQ~o|R-d4$f6-2C0fs9GwEy50Io~+Mo>NsE
zZhRYe%o>)=6Dbb8Bf)B0ImW6VWvP^HTKpl=$KE2qzY-Ccp96EwY`!Rt8b{*s{KvC}
z?8!1&6FKLUdE=R1B=WxS^xdbaeI!m%pK?#5B|@RRt1E52Oq4)9#WpJ6fCtwFt$>y1
z?ga1NK9-gz-^i9ppP6%JQ%*>rZqK!7l&6zs)UX?^N`=HPyUC_c&224SwOR$Bv!{ec
zQ&RoMC>HnN7YdS<4#vMbx>d3?p&j_6;ynNfnFr1k*_Wzny5LNa<h49wH#uj&W52kv
zfNWs7U`&u-x%v6AwrpU)PKhwpBMOb8`w+*dHwh%T%8qMQR5;apwMu^L!*=g33LZh>
zG4v)wNUEej5a=>EI}zB#wAHTt6d1;niC)IRLujXKsUgGC^px!nQ`;T8a}?Lf7SBW|
z3I~Y4Hzs5e=()7oakg@yDbiIvChOB4;SyE;33DC?2Vp{Qn!eBO7O3YIOY3(3m2~$W
zVmVtU`+C@gSz~wNM52TFlVI!5Dg_BXXO-2e!KMxGD@IW#K}mQi3Jv1wy~}5^yJem|
z%<%pg(d2YPXKx$YRd&63N4mM?>1g`{ao4veQk9F|PPHs#o6<f6`{Gr+>X9r`-TueS
zSN$2&Ki)sDD$Em8=zYUF(|PcS_@Kt5ZFN<iFwEoTEV*?Vx~`t2OuG0kDkUgKz;UAq
zCZBNIsIVc9DSoEoO`0QoOaF@BCs!4RuFUry?WelR3!v0l<%-$hT!4y)t$@~_d_LDO
zcw*7Ew~(30{f=FBT=p@{N{FHKQ2G09?1!)wh+~ZOg18O*-lGU_)+8rNxA}W|$^p0l
z<|nOEXE1PWvt4v3^|O*dS3yBZha>oVjkfVv11jg!jj!jUSJ9>8UKJId54K^mpUq_D
zBSITNS=R{Y<-+GtlGnoz)q8Ff^<rq9f(+iaSeASDmW5oG9LRUSJw|&W?gbi?a}XK_
z-G|4gF1GJjeBOFZZY?a-C)-oqd;B{r=fX?g<L*_)i>|cQq*hBE9rEw99?x(<S6`3R
z@h`wf+&LKLjfTc!@IzBINM{`ZWddpek24~ZDy+LA-XmHr<q@f!BbiXiXwuLLtj%-g
zOND&O0`7J6+YN*KQT-LTsMJ*6{?+!C)VkCoeM8qCP(0|Cw{_6?3ZFHH9%A-o+1*VH
z-jn`dX56MD-*?q>4!@Z)hs{nb;aho;@2)nvzFBnx*wtHY$FPtBO*54-x6POA2_@td
zC&I6iPdMRQ9sTDM%-EEY^NOHnR29nKGYStOW4rMXWbaZS9DSdNd<X}Zrm`=~{}_fT
zAW3|h)8K#i_EyeJ2T124(sVKd_4K$S1s$)B91>qY#P2yCxNQ;qs(`h^$7h*#4?z++
zbGPH{PLXg5>D0{-v4*&*tzv0(3zJP<NXyv8fI3I9VX7<F#eC~o2`S0OFn7eO@GX(I
zIg>XI+_jx})}T1$wZo{y-+ry=p_Nhk<sy=0^^*{;uM>zPwrJ&}3%j<qv-q-Flbu4H
zh}Y#Q&#Oz8*gba2VBURIl6Yz@?jzJVpy6Iu3h@H4;TPh}4hnDc$?F;z4vDQ!?%Qv3
z=}_WVOHa+GR))((9bHLxWsV5zbb(SPQI0iTwYgYRZZ_#n_W}vkLiK``5d`xInxA_-
z#@zv{hOM)T-Ccqt513Q@Xf)=t92Sp=hP*Y0Ngsl7Ao}JbWoyODB$f#RyRpzG*~?Js
zxpgSzg{Q2P^X3wIHGVyFta{Tc6|10D8O0p#7#aE^Uc>Zb0d^3F*M>&Xc&3N3&=(Uf
z=I?e7WJs8tUGpW+wYImt0ZL1G3J^6#f;@R<=R0Nooxe`fb`||TfVq0E@AV?#r`aSr
zJZk_<*yX&NW%DDU^6BkXukkZaPMSEBE&bFqisSdHu_9<=la<cVcXl7*D<5TSX0X=1
z9JY}gG2i69g2XA6VP#uQsZ+OVlpY-T9CbxjQkh^-yG7`{plaanHuuSFlQ6!>`p$ML
z><7OTVh8smCe7Zql~k2PUasKenf=k9LdAF6j2&Ei=5_V|1Gf2}nhEQF4luAtC?k>E
zf3fJn$F=J%gtDV0O0D%u1HHVsWn{@|`D+ShX5ZU-yq0=ZJnan=TcgVP2nTL`Uf?=~
z_%z8@axE}~(<J+<Rjq>H^~|1kV+e&?B56bB&Voza$LGFp-d(`TjeMP#t}#ky+{gEo
zU=0xM>zo^LQXM|`tVb|%`*2si(Gc{+p_5NQYicW1W3~RCHYe#+%<G^>{=lyF&}dD-
zC2WR{a-?SbGOei!QM}|%u8MyrfL(%#8sC3t7o`_aTaY^1I`i(38Z36T{bJTPNpCDu
z;5}k)r6IhE=l-0TydGx&ZWNArweQuTEsM3~4-Qxu+H%nuV!1S>_sL4w>&ZYu9P3B>
zpzq&!p@B2Z{Zk~wdxp*`uwGhLRaQCZ<s!PN{bw$p{8C=Pn|hZ(a4jrn;)&h&Zn<+m
zc(d-JCR4?6hk`1H7(znhHQnBHZoV83S+Nt6g06fpSsODCzwjv2ZP*i8mO;Ea?us`(
zu%LxWeXS#-?!R(ys@iKsu}z~OE5!i{)2j_)jvhB(7Jmm#W9*%a5}TfJxooAhhM|oT
z+T0?(F-a*858#H>M!cgRYDq;S<881l=$Qn=>Ihr#s6X?X+tg~gr>JIQ&06v+Rgu{Y
zV_9wMYr%?o-H!ArRmpCh_1f+00F}+!{5<XrUXz?o?Sua>TTuH-mHJv~oJpX+O^O_Q
zq7v}!_I{Ty@-=r{Q$Z_^)+2)xujYmk&HcP-Ib|O{be~7*pT{<}rkcMppysCxKKcIQ
z)gl|w@JV1}7cEz^v$tGUS}ch#hkcy)p1_2=%X;6LT!T@Z!S<Wb!>w%JdaiGD<eD$I
zx9&Pzk*V@h!KR|D;{?_(H1thja%rTL*hi+$GaVy2>sj1=J&XBvahM+ueFk3vWs)Pk
z`GwJWNP_}c?spPh(OT|&19JCbhLdbrp4s!LT*JP60`2w*km6{@w!5kVxfKiUITgU5
zwOoMpXTl0BkEFUJ`XZ+}4xaS3B;U_32W8Wb%bax-yXx9zS<stXORnKFHe5s^m9olB
za3A{l@x$S(<FAe$>vMEEW^XRU@NK0|?~+|)@~$~yX|8;#=;Do-80oRfR9Skr{Tp=z
zIC8Pb65zE;Dx55Q>NANG9@zr-1hOW7VGK)ltNxrA)gUWfU=hDs@0geyK)8z&wm+o2
zb`4u-YNa%LX7c1k`i^9d1;H41N{uG#^;3+*qrNaQy!Lb8;&LVatGiWfD4`bH#qjFv
z$mj*{je8ObOGs(Ayvg~3SV#TI#bo1*Nt*~fb;#9a;|9A_Ils%;0QEI-te;`!w&#-+
zG6rJ<wC{)ZaqLH>KMGlcV{}IyEJ$kEj&Z!3c+9=k3*2y9r28d@RYfDjJKMUY2A#P{
zk36{*U(23a@47J7&9KbFDrkeO$5JIcz%Js`U#;2y6Nda>W0Ymgda}fc{;-$*ubaCA
zV!&yonq8_!uewJL$#h(Z^0e9?U0HZH1232w;A>@d<!P{PdsqN}MC(0kmnEkh2|yl7
zC*>i}M-}Jpd2a}61ITH~-RkYto;+yrKB*@YFGFw<_Q007w=tCkQd7|=3G&8OwiUbN
zjFp|*=1~g{<u0gaJz;3?@W!RiMHr6-s5|op68uDZDq(%g+MCU&8*Let*S+dq@AkrE
z*0~-#v^3O$=3<-KZPptPZ=^Ht<iK+!jOa7ZIA=p}<_5wHVGcAlXMamlF5}1Ud@n@i
zvxCYt`Vv+02(q3jg`DeW$d}sqsvO*km+Rb^eu}nk99C5@F%KCVYa}|fj+-dKq|3%l
z--ZHb#xf@!2|zb&JwLqBu?R5`4o-}5k*ymcDJ@F*cGd;%j?8FrTOsH*t&#yUhov7s
zNH>Hs@}~l&M(<Ug0=bV>5BQ8E0}ilLF=7h#%#u7dTZ6~QWATDiIkgdE;f5m4K`i+|
z_+nu+Wn|GvX-(@0?%{CRp}b@ySnmr6oONwHK`CQJ*_<h^mwvSD9{*LF3d7>Z$dD}V
z!lG~;q~~)1dq>uoThVJR<%F~$`z&6BCGN73(?BijMKQ-m_>67@(=dJa?&T{(84o(m
zNA4L&5&BW1<(ElIgWf%2G&LI8+eLr>>lab8lW4GTLbK<tFR?njyYkY;%Nx^$hM$Ng
zmI#xUtQLVLfGMai_A6$g*`&^u=TuYVsi+|vY}sv}6+3pDsgT7QATlM-H6WL->h`k?
zZ>gnltk!WTJ9EPWMZBcxzO9l4sjiu!P%qK5X9=0l!@oZEKJon+s|AvvD(=>;v0IYs
z`k7UfK&jlxoIj&GETw79Du~$GAK*59-t0Q)R1RS#AFL7)DoEQO2a{teJu3K++va0<
zW1-rvPTu%wyx1vkeMS=0j3}!@EJR#lOp}A{<Q_f>a2u$7an`c&+&^46`N}WcSTG<D
zuI=DG+rJxriQaJC<Xb6Y=?}Pn;>HuSo;YG%g6|bY_9~u&A*U?}IE|d9s2Dw$a72H%
z!`*_}jNVlUR{dh$T;Hn%_1HWcZ(H|NJB9vjBa1ixc0~4AHItN7N~rJCIo6^4A9082
z3Ug8Ise)F>^2o%RG)o`PzEbB)9#4rJsa%21E>H+98tkn0DXwl00Pwir%H;O7>deWi
z-DoqfPEWD5w?NasiYYy?7zebS3IO<zP*TGZOD0o*^R2=q#$OH4I+H6BRr$1DyZ_L5
z_CY8ObnlKYR6jauMN|8%i`3JM)(?G!u=NY+xnufI9zA?$tsne~!=uh#iIe|T%jDAw
zFgl|nAz^Z~cx8V(%S4f5x|r<)(z1pdk7ufF07X>nn-h*L&t#VQioZi-%|R|5Mz>m(
z8w+fW0<x0Lb5eCMiyvQ~98HNv(w^X0$*%41WH4$|0G&t0i%2@#RgBf8r;dDH1r0Xr
z1sXzpVIvyfZF6IibBkOIPYb3PIhSPBMSH=jRBb@6kM5NgY`^21^CG=P;O!5dp9pan
zvYr&I!GEN9$~z<2X5v_#HC=7@bqkBA*Ua9%@X~s_v$q{eKC`5`d$htPpol+pBp?n!
zFtVt8B29bn@SHQi^g=u3m~6B#K=xVB?{uZlA3Ks9z<2IRAS2)Fo?o0Qeg&7=NRawu
zE}g*b>DsP{DC9MP@dYIZR7IPzB&=4|=W+X)nt9cO523GkjpI$$7N$F}R*^WQ+%BO#
z$8NJPC+Okl$TkqR46^{W@$Bz))$~n~j!ciYV91lzD6}B(FXj)R5HGi&-Ip2NaJ;4E
zWY}hdr4e<?LFF`pI$i;?ih`L0Piax}__J#|4>>fqwk{QF{Vb`LwtH}JtD~^7t7v><
z!rwLxx5qEz&pPf8!UoEnK*fL2on)iyDtmyIrpKz+>+!pt-MVw+D>DhZiIhpr{wC83
zzZ-FOR<%3=-*f3jCky=`9sCxN<^cg4V{iSfwl6)xdpMa^{5TR+I3D~6;x!nyRtVFa
zdk@nQ^m6B4f)lR1MwcB(v~lwhi#r?&dM{pcBqd~1I5^%bCsMFp#+Oqac4F7=KA!kJ
z+s81F2sYBEoz6qJ@(yEerBHo|Q;)721-APH;CxN0?~F=(odMWiG@#_`2cpn&i=Wmm
zT!9bQEXLUYd^Py+lec6+Q8@{$uAA>p8?=tch_3s(ZHF$+jq?CK^d&qi2mcRDDF1pf
z02--|T2Wur1SgVVB!d0=U$g~B@Zj|{2nYu{n=RkjMgJgdNC+f7JR>G1G-_$yH|#Y*
z<U4Rny^vWTwau%hR-pB)a`qt;BlG(+>dYYtTR$JRrar$P4}E^0`k{#Yw(zWDKCClN
zyiOh+i6D7Z9=A_oI_b3#dnZfIPvF@l=dmMQw5jv$%PTv%*lEs+6$--$p<gsRR<|HU
z!vE6e2_-IY(xoO(P#_p>MY^mvHY%}p*<_8s96x8*)d05i=JujIVvW416AyPhq;>pJ
zd)ARb!<ujj|HxD25=f6@9ft?~9gOItl9_EVQaHgPm_fL8X6ruFr!H?O%JnPaLP3%W
z_j85U5Ip~P*9=1}_`0y@G>A?Re|=G(zq>xDxWD4+SUzb>HXyJID*VjgE}g*}f;@TA
zu540j5_yfRM!odlhshCpg`i}p0N(4`RlnBTwE}bn-)uRM;z`ME;~xPW<M?4>!G0~>
z8czCBva#@B>v)vQ<dTnjCr=A5u(y_Zu9LOHjtd#a?2IYi(h)sWcF6r3T<A`?JiWNH
zewiY6Zf2F?6yXvLA0Lse&n04R;CnD~=)<;63d7X}<2gF1-CJaNe8#}5-^Jom8YdP@
z?D$TtD3xl+2iLJ9<V#K@f@!xt9I)Oxif-UF9abR4oy1MW_^nG^nh&s0b5<agp=OhD
zpbr}P)X>=vVxglH&#1j_pO1OAJa|*;mGO&B^W*e`2yl)*n`H&Az4hx4ZYR>R4ms{<
zD0wbNtT%3|G=um(_Y*`yCJx{lJ%9P(5!y^B_`9Lq!VOD1N(z2*=^N|JR<718u@16P
zZiW;I7l0rIz?9)jFnZr&mqrZpIr?P6$nMLx7c4!MF5g+4p2FzA|9L8Y0#%e%_rUJW
zLFMI(Jb9v)rjf&iUN*4Mx-d1}+Wp^PNdC$|i@BAzq1&RC=lFp=)<*hyenH#m&l~3j
zq#0YiYL*g1_i0%waX0p^F7ajgrc&<5-{0v|X;-h~E0u8Yn92`Wz1KxT%cm)H{xnAa
zm^tY}<XW9TFIQIV)PzghK9nX+&#$&OurH@+57*%NRPJ1sg<f_yKHe?P*-Z(yxBary
z`4grKukdZh?3d+%zGU4L0%Z&TFF?ots^MfF6R&nuX%1BSpS>6%#tV@E&4;Yt)biUj
zs}lzTzQcS(a!@xHx+U_nzvOFImt-*(xVsleCkyBvT8N9g^x=cK3#CG_MfR+}d)%O0
z3;F^zJneH8cT7^i{1ue2IQeOSSfgVSKGBgqy`b4ILtI%~2E4=<{CsmUv##pU?RE0A
zd9}?&i56;v*O&|kTe&du)5+5ZlP+V&UyU(oN1NZVw{?p!Krgmmh}G7I-VOg;rt-|q
ztiLZQxGycZjmx>k0f{qFWh-aqJT#bb`c3G^V5*)2#b6w!^eROAR6iITR%OF*<l>v%
zFgYMv%|WW2p>|!<`n=PMhF$on0<YY-H1?!LsXe-SxQ%G>v>M^b-toavKTuqgvHUqE
zIN<n+rWvTYESnLEk9t^#9<IZpSaTSaL2_Yv^@`beH)FMX(b!}q@X7GudG`9Wx;MTf
zmIVc<xnc78g`-2EO<Haok0Y(qYE+_6L?I)7fM%|%TODr0fDb4h+qYU271q_5p3x@I
z$37#h&B=dh-)?2W>o$XR>=&#UOw}l)am!ZSUw!>;;8V&S%HwD_%NR#bWCWx+=Q_Z2
z7Hw~Q+O{_}#C`kY^f{s&DqQXILK?!E*^_g|<`}7O>a35zW3BUGuA{BR%xJjuW+`ro
zd3QWu_0q~p<DyENjtKSeLn|lhMt9US-(!{6r!b_xef_Z(C?7dm(dx~3N3~tT&3E$r
zO3zx7;BAg-7i%z~8oRbEn`{)lH^@!m+avUWoH`IJFo}7+%$dVjBR|8E0~F830V;%M
z1S(?KR#<T%Bo{vbCRVQY8Nd+Fsusq8=2>_9`=NKix9QgdZ#)U?Q^8>sVP8~XNuVBf
zswA}lS`Jj5gGn3^&}9h4f9plf%T~Uv5DLHxc*$PzOWy^nzb7c9kvZGC?wL9ztDnl!
zp6Yt5RNs*r^Fy)Fu_XuPyO2L~DU#n=UE#rJ)^*`gt#4;BZhaj!{0FkT+SRXh7+!j0
zQhYJDtK*`H=@X3$Qs<YW)YGD<OkWMGDFZmFw_Wxs8^s49s%h^xhYrIXM%>>op)-wn
zs(3zLUB3r*stYzCDE@&ge(`8G?+Zm_6<6j9Cs$e<`rf?MZ*(-SBZ6`k+zz1z#7$ww
zxO@dOsfh<XVria+)k)<A$?~&00VfzspnCw>A71sIF}qK*@ocAfYP~no0hmHIpTOEx
zbGBbyrfGrim8OZ^9w=4-*bo71wPGGuaa+b4?r{B6fxjjs!QlcIGGe!KkR>eomIk5N
zA8z)F?oGpJL)yb2fv{kvtNI$Kizh2hi_gpRKe-yHDeNGUW=b_o9a1#>Tws7=i`LC+
zzP>*tXkor((wFKzmn|!Gt|gh^JvST^U&{q*v|d9bu^yeBL*)<7XanbgnK-bDGi44G
z$TG&Y!?uja^QW>R5n-i*Hw3EP#vv=yS^*Q=Z~ST&DK7A3?-I)uRoq>2^;7}-sn9`7
zNHs3JW@vk8+_!VHdhKbI9`#N@n%W)EZOa><qE3m99bJ1-r7=0^7kxwCq{ov73F*f?
zsfB>3eO`J<2yg-Cis~T!W#I7%ack3@a3RLunQ-*jfo0uJhxQD?uRmN1Wu)Y<l%3>_
z9ghN)%U;TT-N743y1}xjJHN1S>xyk`$K}A*go5oxxOc3jNKc7wUDo^Ba)IwZ5SGsl
zbxJU6={47waz*P{-ZH0a24XG-+Efo>j}O3BE_*87PJO$awG7$2{*NW0;Hi&HT_sNY
z&$#>p&0OHLC)Am~yw+;8xbO@m;*iDFX}Gw+up4OL(XvmNX<MF!=VQtI5#bEC8D6UN
zSHuC+i$SA@6r}OVK8P|=cE6@?=EM`uMaR$i3q57n4o(cvy{~4=J^SKI$fF;Jq!;jt
zKDvx?+wUa%;Z@B5Ht=#u{8^%QQX3ZlQ2qda1;6!kA5{ap!J4!*CEYvdxuWEm43F@G
z)MowRughez;Q64ErrIay7or-yH17+WR-}Gt-?nnbc9n=nDgA?N0@zs+5>{C4OB2A?
z5>w{{ME#SUU!rnB#AKjfE=q4+Q{kyg>b}=!XIa_-oO&+TZfps(?~pbPr%Q9S@?Wg^
z;e4C94YrjCzniPE)f-a9vX*5x#=cZ)*CVzT2Zx?kCw~rfpUfDF#;4)bv2rphpY`-b
zOXT!Lvsnk3Ry2ACn8xJRK6p)TubM@L;n&Jw0Gh34`X4mgDIx2J9|mC-HxY9nOjp;-
z0vq1|egLp64HDAj*L%a>u&+3ehds<rbULAgEoDBSD6kXBf!rxJCQ<MHcs!=MHg$mG
z<9cTNx@(;RwAR=1CLnl)M2NsAHoUFCS$aEtstNHIV6jYCCiuNYW7YzGqy4kcSOKLr
z-Og7(|D7#{z1gx9#@QzCT6d_r3W4m||F2y2e;NF9Pp*<!G#pmX{N<it3ihJfW|qd=
z)J|Ulh|B@*iNZpg%H8^po0rfdy03HVQiz;jTz%HAI?ZQSo%|cEy+?}S!3_>`L`~;-
zrVx)oNdWIfiJ(WEGX|e6H5mW4p9iqPio8?$-p}M+>$HW{nnEdIR8`rv4F5F%g0gq@
zW|)OW)MC63{=#bYZSMqo-LC#@Nl>XCh9}`C`|A=OC%FD+@cTmBkgbx(wtLOo!@>cH
zO+TE_v{O@vPc(Z8Ys5ZWkY6;LpL)uhte^FFS8`tNTZ_ft@*i@DrflaIXpp7XLKXD2
zvxUu00MQQ93Ii@}3B$0K<fW&K-SsNazTux$J1|u$w=?Cb_9q{)XZ9--1aQSEcK_rV
z0CGG<{!1p3)GfYU<GJcLptQ2bv?2)F<5?LDXY#UjPo4bbt$;><$-w0T@*enfP<2HR
z*E-0MA4>Ao1sa!UGd%8Wr+*`ASj8AyHi&iK-3q6iK`KGZA45M|8bI~*pkd?fGg{Rd
zlLr|og6IyDFKg-FQnWq%2Sr!j7Rz?CZgqBszAcS<o1e85jH}&NxANQkOH-mJ3x5B2
z)Fqt~`WGd&A{?FYWlHW2K!D4tPOu`Vj&75xOaOWqz?<kYUj|Y9foDI?2)A0c0X!yv
zXGRA0t=oH-R1d(scl<5nwL1eo`lb^G?N;24mt}pgTY2s;%r@U~+;KFstSlJxn?^f6
zqb%X1J8v^z7Nk+zXWff&J5*Do<KlDT9;bkVXFB>njQY}hh@qRcR#d7j+`dK#T(Q3F
zi(vzl(63kZFP`Y0w)&LQ4|YkV#$w+*TI}<jT$N#8tfv5`Xd*&*b91Y~PZ+((3nY)u
z{-?n;0cn8%56qrGs)6r?J8VydR`_oUsr@&4mOZ8cSJH0!`VAz4<ceMQU7}9*rY0ez
zK-r!D4365F3tf?>!b#ocRojtN-~g)K+8F#&DJ#kF7uQSF-8~%C9w~x>v68uQ%~~dR
z9bl<dRyIL@8~DCN0sKLg`tl%?kF_^5Thj{M8Iy3M^O&Efsssc9!knmO*rhjnQ28JL
z4RWJJ%0Q~hNXkC6L~|_Nh?gV+NM?{<-!?7?kj$)PLVz+#_!A(RkFjH?{IE)?f9k!L
z8Gp&Jy18brB~M?^<E4`A6xfpAv)b{ggvX}aLH>WA2H<0Wb9Id9Am#*hv?e|QOjvB4
zb91@@VNpV9GVFa*gCT~DmJbxyp5uRb`e_J!WD_HQ?73t2<(p;Jw-Tu_<BOv_)Vg-<
zF_ATy*wr@yXF=`S1&vi5U~j|fL5bfaQ-RW+L4G$>bwyP77^Y5uzUT~Q-usa$IV&tH
z!S}fb@pnh#liDw1mSGP_;`3akLV}+-028-Kw%h$ObBhv&{xTx6s|nQ1#*`J|y5rBM
zFk(AJh+a1?hS@h0emCZ>O<h|$x|t6B2>r35j{JnHN1_hw_F`<}yrb%l5!M@$Yq9`}
zo52-L<d=UxyNf)rM=}s74sTK_#C)5$ram`=-qS#ijqR(Tw|jA=2DuNAVefb~4^$wI
z=!@WDhzLbMfC;)<-+MSv7v40-Dl6d#cY*wcxeswh%ZqjIk0Kd!E8&Y`XNJ^_n522G
zPGOFrwyn@bmT|4E$v_Rz$Ll7*XD}a%x7m@hQdRJz>mqwSqYj;1akBCqw;@}p=uJA;
zu5m)81e;KQU<_%$SYNUv@9<2brTV0P+uIl#<<I>B+-1w{$k1&}voMt!=dF?ieD~#2
z{BLtw<@&K|rdF+X!{+nCJ$8K?`rm0c*+Z{CuNv#xU%jh1<ywsT8Rt{$$Ki5iRzszY
zbu2_H$WLAM2CJ$Nq<z3+`hw>Wz`u6OKeN_B?gnkw2$e>CkJsb}Y$j*^p+V07t#qoI
zv%i0A+AI4HBg2n<4Ajr>DvhHYi}hU}nGCo3!PNQ`Q6k2@l_|KPt9=b2#0zzbdmIw1
zYmG&$fKNy#;|v00u3LTta)2GB_W&)=I^5E0HHM^1AKazAgr@=|Q!4@0ADuCt$JfH~
z*U4@>LUJi$%LG9FL{{$P{CqP28WRP|tUpIIm-6_4`(lG9R&Lp0UJY0QQY|YX_W7TN
z`e>Hl5dWQ!SN?^{h1_4;lTfH;fa--yd)DSm+V1p!kr`LgT8Ni6V4#!X)fwoyDpOU&
z&)Wd=g<a*#AP`TWZh#&eXx7WEBF200$x4|KdqLtJvC*m1bl<=(x0S+QEE(8~a1X=k
zD!LQ;e-z5pJhdbz)j-6sJZGN|k+4U!#7wE_Yn^ZXIlm{Ab*}$GD8I^HEbo-L#jS@g
zGBc`-@|<>S-JZgjtTziw7ffMZrt+}QE&;4o|2ptJ-YmT&P|l07nl%n%Kn(vy)9i7o
z|Km}>;6Z_(1PFM2QWaZ+B>PMCAmiBwAN|991swdPiF*$RQx_#BeOqbnlbl$B_Aggb
zweIb+7a3Hn&sFte?ELZD{D4V_^83%u>9OQsH*1`I!u_3-gPx?|3kets&d2FYnk#Tv
zz2<3kwQId?*MVlcKD9gApzOPY7YfKF#<v8j2US1*q6Qf|WuKay$(lSAnZjG9o%~Vn
zv16K^0Xq=yg$x4Gp2*r8uLM7@FaFnlQHhkwxd=>}`t_NvEhpUf2MBoHm9ebcbNI<1
zE1}#qFZ$PPeu)Um6Rm|A?E;{>6pY1E_j8j~KXK#3a<iJW1MD8>+{Yk4sx+x-aD8xf
zFG9ck%lMA@?AM{gT07%A<1FmrYA%-81*WyeaP3puf8regcq>>yu2{#ZBC?90@~et^
z^xrH1|NiC5=P{8~;<Qt}zIUL}%s~I~-IVtUaYuj7{?nau2lSf+i1bto<`B$_RT#w_
zD{b5&DgZ`}tCy{v9hmsOsW!@kFdq*A!Kz1l`wCv4^Mk82Rnr9Z+5HLxmt*?({Du3I
zqdVk3fzV2@An&hG2sNyZg#5n^RJ{x6^XPqre@;UKdKWzwjell}HeP*a<31Bdth%=L
z)q*=nG)Q^#jMaR&Uyu>I-XI9D7t<aq3;?OD=42*19k>*e;h_N-tGfQbQ18%c<ItDj
zO>i<s@^@qm{1qT25B&6QD_>vW`=|Z)$9;eSg}e7}`=t6Qq3DF)qVsSn?=DKzJy}qt
zP!#y-vKRAfx`5s4gWH1v;Q&u&vQBzJRkv%vp3zF#`N2vze!XFp6}!D%iR_puYCNHi
zX)OY;<v%c7@9FIQQ^R}GxK{-W0it#X$27J(zhtQZ#Wcpd_S$P0=k*!8LH|Z@Ht@1o
zsKuh>OU?3)%FPHm=4B#$Hhkkkd|!2=Yq|Ktl7oZ!uT4)UF^u|8CpV4q@>#WM1_*xF
zQLwW{zAu6(*zte6-+FfB;Wf3>UL%XgnCpV`t%dW#CEANW#SK=KnBB>REhQStVajrb
zsdq|;3s2g6<yYmIB6sODbe`F_&o9f3TKHro%mwaT-N(ogw2!%1Po10<BcGc@%klcO
zs$0K*yqnF|KeLsWqq(Qki<lO*Qz5Jt#y%TDv^S(Z86wR369wx+u`}QT_V<X4%^>hK
z-+IxGj4Od0-c8B<Ty-IZg9FCPDAZ!-MhNt>AO-`O58P7oO@*^l>qw-FzKJ!HZ8es;
zb#3Hd_mQ$&YO)fE0S$}{2h@QlYGVja5!^0_sWiB0Uc!`Ep}OYoFIXn(9ulRqFEB02
zAt01^8h(U<k|9T9APl>-5;jx=*wL+sO|;QYV!uF@<MZ`pLLW9At%(e!41Az40fR)b
zF@!e%c~uGz{Yi5mPnD*3exCqUkfhp;ApoIzg#4{vKOLk#d~k#}wlrm(ule)$#TU&5
ziIKV0&Yf+Etu**L=Q^?qv42SdSL-CNG80aFGxvrlq_)9IDKemqWN*)!6S?c2!)By*
zFcq-N2G&~|F38Ch$_<NS@lB8Lv&BPo^@IUf7J90V>a{l=HIS*^G3o&-8%bbC`4kE(
zgndhBC(l#$I><n1cqV24uf-9HW@1!Tb=ID&y?+pCYNrM<gODez#K+%OHnfTasr6~U
zDdYe(g`N%qKO6wr$2*lBu6qfaO`JbU;YB!KL!Pos&(&If1wTyXCQ0m=w@Hn5NtNha
z8Gl}LbLuSYjr^t^rIM5IX!($(+*RWp^X2k~h3N0PomV6;oZk0qIZQ>TcOW>e=AMmv
zZj-ClczGV9cGp#QshvCUBu=TO!<$!Y9*UrCGX;rf>cXUE!-+8%CSZL=Zh+7Bgvn+|
z1+b(({?wZ$we!5Lc%V@9*E{a`w{^}x+H&*Sa?6;D0p?-vHs6};r~()e1TX90eau3@
zug?dm18b9?=VdY}m`F|QDjsxolIl63w&4or)q5$w6AZllEtloiCT*KJ;RuxpzD|L<
zjb_5Y1S`4~v=ORB(lnb-SN1^Nm`vaM`5zPUaCTas3F5|G!QW#=u$h(YzU+v4(5av7
zk7GjD`z(b$L+kpCw{gt?Umd)6X-_?b_66s0x{wZjZnPI<wKu&qS6tmZ+AzAFZ|q|6
zWxKdm!JAm0Wn%G>9e5z!t1?PL;Ohzs_Z-5b+IGd!N=ZEEoP5h^R&W3a-J04?j#wt7
ziFphiu<VDWqpu>L!w>I@B<?=<YPYS9mTym-zrA&i_8KfdTX*E2m5a;6n*&yqV%77n
zhFE`ov}RJNYE(G<81p!FJp7TrFaONKF?FfsX5NFQ-@U_lW}7+crOf7dTwq7N0sUws
zYy|E}|8+3$WO}vHawMRQfcyhX0nTp+?+w}#^o^>~o@(4vqzUi6i90me52(=q1<o!j
zF<z1J?Dw)fOb!|V5Anr5<&EoR*{-Y%+Q66e&XJ1*7g*SRp3NOlO=I2BhfkfhGUJn)
z4~z#ZIpwp>up_q4`MwPpObTFLT68&A7=vnaoR_0;BjwckRsw?9`tNgljI1b3lYhqd
zOJzWZFYJE3TfhZvMQ!5r2%ffPSJc}6efeMJVf)$T%(Af}orx5DrRvdt^+B#qlfnUh
zv5(e&iXP<eSTXn8TFoJeFfmg1GTUV7RUkk8V<BjdZ_|Q-L2rLqhb=)`IK6DP?(jb|
zl(LBP2d2J-Pvn<GstaM5580YrIWf$~orQF`wXN+l=?oz!tw~A|&tg~r>-3=RsahW^
z=|*pLekA+WDPM^%;1LJQE$aNyEiJEYmdyk#@$4@hXmFRt*p;3AZCAg-Ii$8%*nRWM
z7a-KlM*+OhGT_c8D}@1Zeus7TX@!vFp}Fsi?6VmHvmpTCZi?xiegMW&QK)YqL*TBR
zbmq^nQIRLAYuk5PizY?(A-6nUSoMXUR<GfZT9_B1d@O=%@E;3pO84a5ItC8{O|!0H
zS(_AH^^(dFN#kN?rvQ5JNiEGK{Pre8z&=ntt2hH?AGn^~>2e7S8KfZE^Ku&><?jDH
zSpcZZIeDrd{9~$>7_tyK0`X6IWB-2=1%N+~|6bh1Kc4K*to+v6-;el9f&bfo4{!os
z<Tyh6E7Bi=z!@Q59>tSq4IjREMA)`o44wD1`?z?fwMaD~ap4e%c+CzUwxtd-5WM2-
zbPz=30M8`2e)P+hQ*%mc?lkM|-0b&y3VX*&`aNh_xPvM1nr~Xv`KVhsPBglpvGhv8
zMhJ)?7Euj7y=N$MNyK7bHLGLBO($Fp11&hgP3)VRl&0+*OIRs*#ILE-2o;WPmEXJ_
zAiJ*PRcnR-G=5G@{EtE6=Qse=KG<T$nOwpP`l{RoJ~w_6PI{{*<;g#8DWX7MNM<hB
z2#z`(q_)9B89L02I+nzGf|zkQ!;q#v)f&Gc63|ZiI;WKmcghWD9}dN~rfy`B$Xvdu
z6=w=oK*sYDS*$bG>d@uRmXM4?q*#&EMsur(6~Y_9K@nx@oB~;(MvU{BaZ4h(ty&AU
zdSLJ`cP5H82dxIx^y+r%32(Fi(HMYo^=O)`X0f~I$s<XZ<uAn~y!D*)uz#yoPA(Eq
zTh6%T92PZO#|R=S{Cq)q(@wc%C0h6v)sDFWQGT>c+XooujZpkHE5NmUu3%iM;EAB<
zF9$~~gIkkvM8>)xsp-S6(61OG6D<f_k_zTPHOaY7!d-7q4Od+0HY1W{fRv4g`;UJY
zJisg~v6Nmm$obp5{#K*^v%mzYs{>4_Ox%?He<c4h!&0*n`CMFF=I|ul?b=W3t>n-(
zE$+o`sq$y6Dt%0wfRcr_uolO$_lZ<>eU$vhEjkzq=cg)=T-V-60j(q(durYizbU(J
zQxSE68W5~-S}*MF57(>6H*gW^EmG`%8m6<$3#34)|GLH?fclpT5v|}=BSJ1Tp}LcU
zb|K<TV7tjDKiw3+AGUh2&#wWpaaW2XEVPTn;0sFqp0#m-l%K-@VQC6sWfV;49xrVX
z1C}kScgDSxbf7i&g$gexMDT#m!!oow;F0I<5|8_u%T2cj`E01y3xD&i9`+FdOxLDj
zK!Fjcy??W-B+t$6ud99<B%tuv*<`f~`FZX`NebTg%iM_I5&he<fa=^k7P`E@HjRhC
zzy&u`f}vJ;=Be{E{d@~WK~QV!rYq$HqWb}u#qwjP_{tkN7xf(J_D*6OB%&SS^5lr|
z7PoJB&Go78&`p&1lySO_N5XZ0y!az}Fb&QHEaiiDr(*wTahQUv1QX-`?YgoZyfom(
z#usr>b1xcJw>#!ymG=!+{MgiCk}3s$H&r<3JL0@!Yg^)_<5SP1%E3-#fZGQMIqvTJ
z^}sTYu2%z>Tl=FjKq$%GV#@-iy+sAq7Cfi+g8cqRFHacP>@$T60-`%&KaGDBeu9qv
z$6=N4Ql$rqHxK@mPqqWVON`TZo+i%J(vM%y-twxh<m!V*BS(651X{g#5*j<RcqpRa
zX(o{7zQAcIqN8>6JWm9x@ByapVrJ>=TWWQKhbBwS2muJkKvvoY?9mj)gBr6JSO%g(
z0zn<>h?;@GmzXT*bgK<VN~CzP3o^+&a8I%4sr4p4YzYxd(Y^%36$nzKlgj-kPAz9v
zN<%m5c9s?W8x~qCp92Eq9!f3%cpK`g+SV9bN~a!+vZ)5E^QxT_+UdzYHu)SM3ZnF}
zZ-yXF^2sTk7Y5co_3zqGVOgUAHJ|s~Qu3{R>05h`b{deb+XR_UZ$IzIYofK0`)JEi
za0cqrbNIu*Qw3^@KKL~p%9Zl%h0g#s6Ft5Im-=IPLbvp*mjH^vE5336#?5=A!?>OG
zfx}m_0-e1dR=Xn~yB>cB*hLy!Y*pG`ymqItk;)(&C_5f|TX-i#O72B&tW3bncv!`C
zs3Zdr%$}*s<2xSrcrylwF_^|*ip_RtY2LpX07Tr{_bo;sVNp&ktZQ$&y-qt@FfMZi
zzA?_{JN_MFdHgRIKwJ~+roruiG(L~J5zcu`>7bprTvQ;aJ!<wh;b=K{ZEATaMlS|O
zOpH&L|9XZT>uT|k{%pH=^1yX}KfO@!Fx!U27oD9Dco>MnM8Ev_6K$8NAY$g$)EQVz
zd7C*=j5ZclW9bOjh+mcougWt-@k5Z|a2~4Umbn`|L`Q~ai^VsjMq{cTv<dWyNL@uO
zR|$CDMn=HR?;s<9U_#R5pI~CTtArmRD+$CA?*7S6-lXf?q5e$Eg}zL0ObG|mcy>Pa
zf~ouW;=AckP1`M2*PB3YGa9aAE<F2|cvkJnWtUV#DR4H**QwJ*E#OdUaeokGh8574
zXjQO~<V&4d8GqNuj@JT?r8Z?nu#oz3TOoeQtz}1+8UfqHca(UKg}P^CeYbf2_>OVr
zq{wSdwk<^62(QVw$FhvyYKgDwfdzaiKigUzEH>ahy}$6*)^Wctg;s6m^Adoq;DhED
z7JlbSF<nPR|B`w@gkPz|E~q?L!{kE#$aAYP29vw-%r1^>@H;iFL2LNFN{BOD|Lb5?
zI9vdB^An!V*{iSOHa)8^0PxKkgLb~yD@upvUI1wykPkN=YfA*pmrnW4=?1oQ%^$>E
z*~!>oqNK&bt%W%SJ~kSya8T31J9d-r;hgY36Y$qtA?`McjXZVpa+oVX@VgIep9vbd
zaV>QDYpl{W#B$+H5~ego`%i2Yq+WJV+@7^a2mRH<O4?(p#NvFF)jIsJ-|VfPPTIy*
zsfE_lK=Q>Q)ui)n%k^6wE3^@{As28I>FV5doC%2WN_yDCG-vfe^V6EdOTF6{ee`Zk
z7386}#)$7I)^t<F09!M*)Z{q#0rydW31m&EuYoxZM`#<lfwYjGkOGa#oWYtXTElO2
zJOR(3R>1UEbdRqeD?JXBfPyO^&|EdkRo`1vSb`J;8uul9Kt@?Pm!A4|*B98M2Q;va
zG1z%c7>@_KV_{K8Bu&M`cd$lyzJ$k$hjY@{{zNe{d&VviUQ3f)k@}U!FpXLXYWq|&
z_Z{}T(E7j5VFdcI3H=%(Xv#u`%I?^O`vEWI)NUP^4^=P6bJC_;Vz+)K8sCIQ70hR&
z6=Xx{^V*LGk27*)#|2>r<i9`&FPvBNpyNN_8j-`@I!~8+ETgyY@;q4sEM4$xE|V$`
z^|+%Fn^vFtI$k(^;icYSk+8E6y2t+8%~&7Yd9R$%$G7G6g2TK8T_cWD9Di$fvdF?I
zp(S>0L&uM6Y~_30vUY0ry&3ZjVIc6^ZoK2Ud3VjVNx)Tm!Vu*BE9~O{=XW6UNmjq}
zG*wDg6}dEzyaZjHkSa{AnpcUe!>rsN^=gi;amO9wHJ!jvqLXo?a(`-AHU4$AnWwVr
zeJy-a#rbNsl(%+h1x!<6Li0AAQk&~`qCAtrO3gsP?GD)Lm)G6bnH3)2bTtbkp;iXK
zhN-msPa#>Q(6J>`CvVw|t)?c$gycD7&;3?U{i{M!%p{NDg_xMrrX|^sCs~!f)hA1m
zcw+S-zhbFnA4b5w#yy=vD8iJQJ4@DpG<0rs{n%HPS&@Kgn*&Xr_fh?<Bz2%TfeY~&
zy@;?MB8*{{$d-(8+BMJE1C9h&NUkaYpD%|H_wt_s%4xvrsEq%&&jmh3!DtUGXzOT5
z$5yb_?hn|L=tR`fA2d@ZM7iOH1ZH5fxN(=VwYI&5pv;FQ)m>idDx>fwyDDxe-_hDV
zPV6<q0Zo<JLSVZR8eH{Ds*aFgyqAF5hBR}Y;OwK&<+*t6!7RE&L)Jh6c+I_2N_f0C
zCHcXNN8{Y@INDA#$j)tT=;zTN6*iJ?*W@+go&DMV7;m6-cDr7;Vp-*js}l2KgxNO-
zTQAp6B9IOPz8XJkF~gMlz%}%DKB%)-r3k6PZh3mx!bcAgqF(L9_dT-lJP0Me;jw`~
z1JCq&c0giOLJRr~lRd6aorAqCSC)riRecTWwsYT}Vm<?{bJum2VPa{QN@xcXYhi6H
zfy2Y}UOd(cd=^T{k2v>k0qd0-&6JguLAHyAP9U7USj6LL)Npt>9}h94v!P#;1$Ud=
zr?yGKtsm9gg4(DFpkPxTvZ|_$L62gU4l{4*PE&TnWin(x%a0=fmge4^^z~n=+GoI=
zln|E;`gk=yxoj`rez(@+?j7E^7PRYV75dsUb)TPx6sbBH3AlzJL5fS8F73bD`}J=t
z3#>S$s3*KVp^%xoS59qQprqMQryaq8<|(7zT517nVU*D|%;bA@_R&73wde@1uL);F
z*Y4Ypgi(_5;M&0C{J?YD6DY6elqKp4ct=NO(y9c~r;^|+>6H793sF3@<^kWY_GG*_
zj{6?laBq^T)LkCQ(NlMU>`+nUQpLlf*RREoI-r^9_dhS}lSgR$E`Q40uCG&cMpuYe
z34ZWRTZWUK1+R^*Zn${{35KyQv7CKh$-I|@v?et%`My@Mr6j8835rGmwJeZ_mRee}
zaz^q$Q4AbGeBINM1H?&>CX63;BNDTjQkYKdF3l_IA53<x{@zsFHuG&D0V{u<l69N7
z9q<AzusML=9MEcZ4~Cf2zdbsb3cFXE(;gCUXPcbV2nOQOx`RL^KbbOgZSSE29AAw6
z4pUh<!@5dVDK6<ekjLwt(?M)~46Z@!(@eyDYX8GO_hy(78*8d=u3lDk+o9O#hC0F7
zFoiRbIbj*%R6SP*2d#B_Xst|fg?3%(oIrvzgc6D_Cnn#OQ=e)tfyjLf+?pTAETFI1
zWO<}z+)M%-rFzOi4{z`Gs#38JE3H6(h+VV3_ixj1o)O<|L13Ax`;tdxSz`ELiBdMl
z2Agdyc_B;YM%LXz*hvQdMX<|`rdAU`<{Q<2lopIA`3~;;RlVIS)B?q*)c;bvt;OS@
zveu*GI!O$j!&o1|xQM0TwOr+`TXS0-uNtoF>84iBcfXIHS(<RAw`)z9g3i*Gy%QBm
z{e+~BrQTN^Tx1txAs-4DTQDE@HSdSo)fW%Eqc8<eaJ^53-r)6qxNS|PzSQWfj6cfr
zJ1b1SS`VDW<9F!upfZp5WF^!~Ey@WM+zCV?i&~lUu9-cZ_}PgWCXlG!OE5;ctO>CJ
z-GaOXLNS^Uut~8=dPyw!x&9%j-g|SBh3uSP*S$F*Kj`)=xq3@T4uBv-e^tbB{<pEC
z;#UfsZX(C@AG;#o)I>?<c9FGeZHqRYI`f)K%{$XlOmkBgY;{)b%<`J++6exx0!>Fr
zmy7eD$hL)1pSqW{_|_Vj)U#uN<5guyggA}<KYYD+RFi4<E<DO8R!~tHM2J{Gr75VP
zCMu(-C{a<68WkxD5;_D@L{wCofDn-q5CxSI={->aDFFh~Yv=(&2qc6wl6((3^Pcnm
z&N<&-uEmnY1KIb!_f_`wOk-q26MVE4w0_sP!PC<dk<JX2zq^ZRSG$7%aORMF05y^!
zyQNt!y*AJU)M%%n&HEb0yPu5h)eFb{x}8pH&HrL__Y=pEJ$c}M&>Xjxd>*S!`$f5H
z&l~zHVH>KUy)?QJ^HSh^&ja)T@U6Ld@>D#(jACY|)-8v2a)7_!e;4dzm<qk9SG&<B
z?<9SCFL4S{>cL8{ff5pLJUGQ&FM##%Kao|PzO3^9tBlPnFM#wGT&niT$lCRxQxT$<
zCe`(a!B^P@ld)BHYT-9Y^*{az`HUV(t#|NAjev4Ydom9A-YAX=G*8N<s<U?VAU~-I
zS`&!(W&1OfFrbI>5<~B$_Z`s_pbe+@N&Y;Q1Mlk;o^iHmB{`R^{awV{*3Ktg>4$kL
zCucS<eTKFjL;%ctY8az&aKs{M9$<7&PTzo^1x-t#PiR3J03ag=?{*nK^!rA8E_`fX
z4`R*87TH1uBFlURwu;`t1&6GsajxomW;dd1U0#QA9@>_?gk=*;yLwu<R&T-V9X;(q
z@0jianMJGnD~C!C2+XH`mJ5zjBn1S;fB#&6qbnB0HEEM8ZqL+zlhZOPY2)TaE+Y|8
zub>U{g2%`_B^%hlYL`xBT#HHw*95L1&tz-+-W_NF^V}JJbFq8PVoY-#>%mU^`IORj
z&eTetgDa^Us3;R`@gM>KDIJ$YufPq8gVCPQyX>n~wEzXfS~<h@PB^T+BsUoo&wFQI
z(5Gby>bsAxs`V>M?Hk4A=+5Gr4+RTgd1?$?^V4OY@)K~-Bp=SE@9MfZ!z}GN1I)D(
z_|qR2K||CjIopI~+4Y(<xUSurU$egNhLGu`E6Xhwm&#oKaE;z3<9S-TcFq5*mjQk5
z^an`VwQ-Gj<$CeUNLqmrPD=p);hq9Q-bvvvH<}qQ8m`EY5GnX#x0T{>Ngq88APHEo
zv_8y$A7-{-=2GE*m72ka0`?!5)h~ULeKPt;=7!YtD*5?B>K7IIKdS6^>3v=f304kn
zLF$M*LH5y6ZP&UC#`GVSU<eIncC-(v(}uQ!Ok>w*e;&HXeudf49%l}X#R5vgid^p(
zjFSaZ8kmG7Z$~%%f?jDR8xE5C-UF@j%!8G!Jw+4-#vL}b9)#Nr6w`y8Pr7x#z-oa!
zsP+(mxtz7NR+)qoUN4~Il*k1a-=}$d($#<QBwdY2TU)C2f>qtCa@w5<w6ArF*3idR
zBIad}u8?Dj@0y9j;6|Sj4UI9eB5iENmw!K&LUiI8GQVew)$i7)boMkJXAp1{Gn4n0
z_OYE(tvK|a(z3w?!L1$dl>se{LbmP0Y(lU5#m>zMLXoc?Ax3SZV8J1?^z;kZ?Z1fo
zIf23AMbz$a0CkC!p_Djo2Bl`2`)27I`i#-)=y&+DY~8p9FZ}K?3MJRWeFkI4L&}xN
z_3&&$l*yebid}s)oDF674<)YSU^Mbh_YSHlHYI~}P(pSb{!cv>i&`JBRYMcl1ckhR
zdfk&p<=2h}G+<_Oo^_iHRDKseg#<)td+!~HS3})c-&g^h*-+lGQ<qUZ<nxv5{tg~R
z*mq`Qv1JjQxLjyE;Q#=uLxrY_@&G&UtqA%DATkHxx1gnmh^e;lfd0ZdMi!j8`sf#C
zp$4E*Rmm%^ZH@6}ubKW}P7m{ZvGAR9x3AJv((2>emtlDCI<`IK#ur65y%+FuP7?Kr
z#+a;&ERxY|lY=xMExf|6ZJFo#rr;~wz4vVX4SxSvtDpvu`^>}o0q<<CU8+9tRLbD$
z)-)*qHXfAuzt-fhFMjNoo=47|q&4y^u)f9yXH9R?pVNx^1l9Ysy;5+i?PVruInB6#
zl-usVNIGB&GZ0-611ug3cDqIpf2A69FY~{8%LoxD%s*-0KA}Uw|L6<VI;{(jaeH2g
zkJ&iby^~*h?C>0So_{W*H5{mcRSlHXM$v_whBR10eocWp;NNkDlVm<Z)^C@~H~21-
zDS`3-R+{fP%@}mMqhHWLgrdiE67R(iSb<~`rnYQw7=U0aa;_yXUDy9QEP8T3rXM+>
zJ!S{<ciMuLUV1O<9?%R2_}7Iqpn0jaW1otcBl5g;n05ow>P@Tyi^*!JnYhF9q_aE=
z$D{ud9FrJ^D7cWTd*XBQI_$MA3c(KM0PSg|h;z8*A`aM3O7-A55s6(T(p<L`A5ucG
z(OGoCK(ra~sZF8(?Zzi6@&BV2kC=aPcbRXyPN*~smYG`r!>Dm1Aq%ZcjpiH%2Yx-U
z*K~S~aa!1tkqPRaI;26^ue?#D;`>%J<)?CyG%~*G67e&P_}CGx7mI5!n>YlBHG6oU
z&{eJIo1;F<mbA^jd!~0%^O{S6y8>gJvXD`|I6BAo%x3>Vr4qTC7k|wGgwWMF02<=V
zHK}NY*`GqA{$UsY_)`Z6PB5j``KLDDKX-()QE6{m$b&zWMx=Qv|3A~?=`M&T#gU*7
z`+*l^(A&2ge6}$)%4+Fm?n1txS9QvvUCgLO(u{T)QglhUL`gsB=Zq-}p#OoYR_rFY
z&x-Z|JnjG1>DO>uR2gb|vgQm$+A8eF8ALJSy`ITebv{}OYiEt^0J!3%vsEXWwD<Tq
zpf*##mo8|oJjJ9gu3?=iVXgVaI`MW8lQrS3*x--ZdYi?c|I+DUsxULiv%WLu{gyd$
zxh~7}aOLcd1IPhS6KXB&#IJT|kpI8h-P`|ecV82a0qJ^l9}8O4hu(^rtFH_33iqw&
zjNHRy1)iX7+h8Bi(xk823*p`Tb*oMWfKxiBtSTE9W{V3;Qo{brBDqsXh5aOa`nAc`
z=Frf~_68UyQh(XfcLO#_j?eL}(PndUON`6l^ke|yPi~)$8^YMdN+ypp2mW(KiT3{Y
z&A2Auv6G=sSVGW{eZS8!@Ud3KigZp9r9}>Zw|-SZIbfXk%bl?gQt%dDXrqmiqt*h#
z(aJ^i*NuOQLQeUTo<YZ=uNmLSlpT9n_T6d|K6Esj_dt{Q64QLuAmAJPb?Dgh*-yob
z=YH2e@`W2IRdr>BT4|#gFtLtj%06AfS}Sk|p;h_tkx+hnO7$uN2F9k(i~!3dutHHX
zw#9SZZ=|U5=L$Hf%Bn!*SB>ciS?FN^Xt;0w5B9O0z|@aAk=ADVa@DXPy%=MU-N#hp
zhAn6UA8}J2VmrQ8ZP6NyTBV{dQbHDPqISV^hph~aFeh^L!oxynA1q}TuOGSp<|H1N
znR*<cRO(xQLJUc+QxF~Sc8XroED&;vg!N`iI5QESWc3qM1XpKea$+Lr+FcSI2ZSsE
zZ#4(-8h@<it8I%$K=I%PtN-!n%~IFcPZ~8lod5bVP<*1&4fd{J{H)N&XqCgZh+&R^
zh}1DW&!s~YSG795gG9qumHnmmPuIT!PU{tlnTqi{()#It8;l9WY#6-e45_~T42OTF
zqquN{V7=5cI}lI1any|+{PM_mNV^JgwO|QULKY`q=00ewuy8zXIZKoRzGNh|#JP=b
z8)>{Y%+d-4WDQrTwH{y%U+mBbMj<p|;PeT*wZBKF^&yYJNlOJSkrBhCde|qW0NE|G
zfmv^0)MgU2cl+w!`V4B~5Ps@ID(@)qC1EU^catSj6hDVrjz!mQ_j<jwcLV5~>CwgQ
zKqnsy%7^tV;=a@7a--yb*KV_!op7~q7rA+s^(s`@a0Km2H<EZWdL?-R%h5v=BQtF5
z|5x>jzy0@cdUe4$&LLnS^8;~lC*WPF@^lWF_Hyr0WNb5KKhdaYT|O+!`=yl1E^VI-
zfxI(nGktCPP_U1goobgh!MFg;JZ0am{RG~bwZJ(1@Bi784JaMJIgIWYO$U?$?IpXS
zeB!`H(cSpC!V&G4Dvp%URYBvy_|MJsW~lZeedY=NAp&I_g#9M6{Ete@Z#Vt#qt}md
z=?o)NfER}R7Y?YSy8i^HR9o%4vb~D0BpUQR@m;7nE#2-{V!G;l`bX*g_t{pTAI&*4
zY?W%x%_7>(fVY=MM%XSrCAP_PbGxRP529-V7L-uZ)Njx-#Dz-4&uPzuA_gyP>^P-8
z<y|>91t0<iTlq|I*|prB_O(Nn??Av^bgo)3g@+PnHfXa2<RH{lXdEUfDL{RZU^AfB
zC}F+fGX5#;tJ#E`K}P?_K%^7EYX`^2_K=6P108kwM((iSLXgAc^fpl%{t{~QYRkQj
zNsX@G3<xTh9Zo@A$1-@X9LP(|bG%WV>^~|?9H2LFT5XpX4aBj=*j2qIJCa;gTMUQM
z&faG}7^oaZhOie=AuAn$&`ZEY>HVKEtx%{^%{TqA>z}FHAoP*YITq>pxhEU8<z;S?
z^rp!<t63w!-lG6nII=qo099$SYW6YFO$`IZf?pk1MEoflw;7KZ|HZZhS+X8l&W5ZS
zjsV{gsF;F&j;?4$pIe?+e_pu!qR^Sv^6R<4D}hnHPiW60=jvffhAQ=xR`R=><a^`O
ze=ri+%kSZBy_hrqT?2hYK)?RqC*gep=eX9x?|M>B6<+G6O>I1r|7!$}QMUSZvbKS&
zTL{*<^1oGSRq=bs$e)j8+`|V+qq5hO7hbRq=lyQG5$R)!@x1jS));XUNcUZn{et}D
ztK-<2Csj~=%%x=}^r*HG_Nq*BDn~%6eb`A;rv(4giJO^L^H1yN@kdEw8@?B+%-Bf0
z*=6!6O{Phm1knnMN={H9RSz;O2uz$34F5_RZ+Hma%YU{q_a@S%U;DG#ie^)W4<}{<
z8zMUu7XEMZev5_zTSNczH%)1;PncTs_;Fk66Wd-LhEGXw+4Zt-(hzgK^yt6gD!+7(
z!7?@4kY&B8CB5r`777ZO-kf?$pThtVC<g**6!y(UkGk>p5G|_-+o8EHLBhc5n^YzS
zAzdU{$+--FlaPo!G(4mkE)aeo5GtE#e8yX@b|WPfq9scyKZ?4|h;Vlp&W8HjGVU#~
zCy=~)aJaH%`i#QWPT4*6Y69cw>>Lc|1DVyCdIWhUGub(q7e{s?kEKz4f>1wBWm!Ok
zKkoOH_{ZyRtIlD|*BUdJPtTpln{+^mOQN^Fncy`<YXf-DeQ!wL%>BgFYM=<ztB0z8
zLffci+T+biSJEuu*-L@zH3NzU%L0FK0S$6%gkPzeEsC@tlaGl|<Zqu%wVu_g^J_4D
zRZ0BG-m%!;%lmbuwb?uRNdvs@s;LOyJpn2!eP;N}TXle0Opx@uOnhq&o373ag6e8P
ze<qqrrrs#z?zKOqJrl1~n)BK)Pl3@(TR}SywyeXE_iMJLD}1yJCe<9(q#KEXg5>^e
zqh#lcDA8naK<aCevEc5Lr%6{GQj>7)Th%AN$>tn^BMb^$%dvSLGhh;IwxWyva}73w
zUEe~-{aw=2Wp(p#t`U`JPl_>>X*m+T&bkP7fr#SXiV<iuxItGUQKH_*h1jpg(^i+~
zF!sv*#_Dc6XCq2leyCeEf)IsL#5mFIS&kHIQa&@q@p7=greZ8f@cfhMcd?HgD}@9-
zN_a8*&UAvc^mx#Z)>VKu!TMt1P<!v73M(S-h1<l-kSFZoH`vNST<>!)G-dW%0)Nzl
z5Lz(&r}N~38>JD35o}h#Cr74KS^e-BRwWfb%+85IBHT?aRjzIi@pM3(PjzbZKG#yy
z`j3j#z5N14_lP+2L!}48vpKHyQj{Y$FkN1F`m|#T?;F%kK~HvXyOj8i6ZYWhyz$(2
z>=fB69MY~Pcu%!|D9&5fTkXX_OI`^Tu4mWyT!(ytRdtk%gSv$EqcjJc_S}nB$OB}O
zx8$iczbVggzXWn5np%1>VfK%*W6Y@M1KYL*q&>l;$tzEN4VpC4=+3DJ8e(Z5QYLAv
zWAaB$^QR+7RR2{?)Wz=wC6l>6_Pf|6^>20NVFzr%jR$nJ2+1jN?Ke#d&>gpzR&X$~
zuEg8U;muoI;^YCARRAH{gS$SDrZQ}$!H5+ZEc94MU1_33wKOr@g5wCZ=4*VxH)J1k
zUQ;&5eh<5JbAb@7TL5=SreePt(>6=DHbo6sHD29rd^rN%?YMizaiaEh)rW`BZv2S+
zIBg>TjaErwNNYY@T5z26CN8menJ3Os&)ma`S9|eXdCV(5%nyJ%eg{1lU!j-?k~$*O
zU&Ze<TOFE!pi8Lic1oi(Shi=8tQhdQFD`fj6aZ0^lani$pBGLJD_WhHC+qp#{PQiq
z>EG;%4gJ@h<!Z3TCw!Wy;wEkrrtPOs&i~KOAI)O#Uc7Ew^@`ilEcZcZI-PSW<(n*K
z;v{PiUsaL+%)jBh;Vb#Z@QHJ*yN3My;Vb%^xi?>?*ZOcTmB3cK5#Jt7R$6H$Xj4xd
zg!gx<l?Dx_++`KmnU@hBs-=7oI6n`SNuLly&Pc~kxBkeld(dOS@0k&PHYUMgqKpGe
z!>+>yHQs^ceiuvK%><;@>0ps3yl!zfB;Zc4W=yu<2&*1z>#~6E`TTu386PLFI^~3u
zNkxw?MaVpFK~zOox#gl9Tr^6^aLF9wJDroq?4hJAN^6i~&y)+_ew$`iTDVMDBTA6L
zki<%jVDr}92z(p2vc82(Hq}<0$~Qqw)AB#SgEmn>9WZzXr+<`IdS%Bl<$GBZCb^fM
zmLnI!w_sJ9I!Yx7Ey*oRN!nnssJg(({TS;UP3wotohbL#&ZfaS3-4Rf8nFAhQK=^+
z1@|IP7YZW*mj2|rs{rS@N|l`6w1)e%yG^m60?)>O^}0lZoG1bm=Ed<_gb3ZLk((Ma
zzx2Bq<V)U11nL#nK6UytvEs3sQKRF;ahBOB_U2#K2f#%P_*Pq11cm6mk)*eJd2x6c
zQB#&71B>oaj~)yzwln^$>-Cn#7f1}9EM=-!GL60jTPllrCv`qMZrx0Rk}5tQ)V{S<
z>xs+TQ^`9wR9yaf?tY3*rZr7ISB+sGy<BklT*YKGG$_S=j=l6wF_~RY_C_PR^{l?!
z*o#No8zfbgPCpuW8BKW&+R_*{TzY|+PcH~Q6GxlO8rSu%|2+IL8jrPA?rL0Ous#g*
zyj0jQS5lbGeIZ4gJXdM*aj=-1Gg#t%ZV6Q})FQ|BexTE@Jk{nRlN=XJ*!w&gduR0B
zUcKvj>}7RR)yY<M;8Xd$R!nDmL^x>DzbLc*k_U(iy2)*-uEA}6-_QA6sv2m>Kfd={
z3K&ss;!IJFb-}OX?X6}J?OH4c9ktIA2-s_`hkUD7`fS#6ro(m)Q~qW<1R5T7eHhGU
z{L|A4Hoh5vvGMmjca*cA<qfxG=HV*wNRz@|<SP3XqwMnU=+Rhe{Ym<_@p?bz#;|A)
z<^{Za3|Fh*<(vwnJn$}PLLOt<U^k%4Yl?*{3h2(fX#GA>T*tTOw+77<bi=&(NRgLh
zK3;to9XVHZs9(92OED+cF8X-$YR@I=LDemM_Ty+%PBTC2yoU@e8+RQDw@9Vay$~q@
z&R^*E6*sygm&o7iF6w_loOLifsiqqgMGV1|Pd@W2@Jf_PGZ&%1b$#n>lw-LmT@6@S
zsj{1IUlV5V_1^e1m2ymn>ns=4?{ju}Z>0u}Q|W70q5(HPTw3i@y=7U=E{l&*Kg||~
zi9t#~{H_mG)V=jfZ4dfM$t}mbg#=9&1)27|+k{4s#_knx%I5U%jNQ7|{ti;^L4MFz
zplVP|7zYWA&yY?mfFk{^D={~GlM8%X%p23kI|^KvA7Abj%v}DCP)d4r$Y=8p)qD5q
zycPCLYq7bo>eTRAvvFG20qw^7xf4ar*(5(Q>)JTjtwVHP>YbU(Da;jVF7f2??E0As
zF@isRw=aiS;%tqb4th!VnttoY8Znce-0ri(p2!-!)`w)?n&9=MLKP<-r+)x0!<Che
zf?z!Q+Xpk{syujVzfYt7)Qkyj!l#t*D!mpXiAdI$_lL!_*o27?DRH{?ZcYbRDw$6&
z^6#TmU50uBeM6vcHgD8iH?WmdD|pW{6v|IJU8_va9d@_AGg$J)9ss!AAzy0=_h{MQ
zw$wU;dR6d&Ou=J0t_)lSB%q4ljj#*rhZ8nOrLA`w>c7JXyV6Lsf+y6}cm5fKYlsI^
zk6Pt+%6uYSCb#!+n}%z~b&Rv05&Tc+`F|Mn96G79cesU06*&gYzK#GHs*GouH<n*K
zdB)hkq!exmFF%(zQ04G0?16_~(51{ufs_9rWvz~}*Nq>r<)*=i#<kTt70$&=rV__B
z0;C@&{3fnz(}prkr;+4NoA<iNn!JCi-*Shia<4u(&}Oqw&CKqg8b`}<`qYp7g;jI2
zaqIC48T{esviT7}T_-+SRoB1B?xo}LL!cA0SckEMvO^w<@};%%i|0_=;s1@d0v+Bi
zSM@^J<^xgK8`B`1c~h%g!smvl0K(#WjU@Kp>}%IC5HZVvkGhvIHDYJrYkiNRUmo1?
ze1*TvnOc};{vl6kIsnx>qW#9i(&3dUAq6Mxzb+I$s5_&-Y~DnpR+~eX^CsKJ8BAFL
zo{5>lM>p2QjWU<T!@&*`JuO+$@|(emJ8e+RRKp#966kVM9#6&Kk+nZQ0g9!r=eHR?
zOA#IDQR=5E9Zm<;>c!V+=2%354-Orodog+}BwvCuMeiWjV#JzP33EMPKThxxO~NMB
zp+?N0=UA=CQ7J@2NqXJ|)W9-}0$K(cFOR~ani4{+`7=<Z*M!>YdqL-wQ3h`w^Fm~`
zVuG8ud~?_rHr@v%jl&9A-z^Aa6E#uOIY}TrR?u<;InwRtP2qT9lj4n`{c3QdTYB^_
zd#et!$Q|AT(~nT%)+;(Coib@!KM+^vgCviPSO<)|HRR%0V~y4+N_|P!u&j?LTJFBx
zB$QC_onGmAK9$qA)TqR?R;lOi^^!J#(YG|xrY19;hGM9pBAzFyOA<h0_e9JYp3LYO
zZQ<qYQ=>wdr2`MmDkh(99_G;hT3U-;piGIceW|`Doc7`cysv&Ih-BrLWdy-oaS=WM
z*t9kbsi}l-O1T$47=P@xKJXF^%6;S{6NH27G0zMh=3>Q4ED-`_^}{4M#oi|c>WUOh
zlUY1T;HkjG+Ig;kFu?~cH3iR$ihw+{UCS1w$x1k;u|N~qL3G<bbd*43#Tuz+Pu6gm
zujrkdQ=9~4C?OWrgFJJnO4vyUrXrFDbS56Q(ui-o<yz!(lT(<Lk@NO+A)0hMIjHL-
z?ey=P_m4mKT>6T>?E<W;6WSGb0^+j72cgkY-ygR@d1oN_RQms6Ao(KO*#K>gM9Z-W
z!hLJzTc)Cz<3b*U7%llM>$-1*)GbS{gcD9;(+qu02S*Kg9zN(&OKNM)VvulFgJ*_b
zaT44*cKY&r+xe;=N*`^tsOL(~ynGD<86Ch1S@#iNtv?P|8+3fsZ@v6H$XiF}Hqys8
z_6Gllc68JHk(B#|X;APH7z*t4wE&)lL{7V8J!V2h2`G(IxAnznS!lrDL^i$fDG9-&
zb<*1;iGm3gj{*$THGg*rqJ$^loap-br>U@~7qa`Km1U=xHk_cnd&?~u^D?)eA0f9k
z&70*&^eTPB4Q~gX&)nh6-`YARK3P^qSXqYs<+B$`&Cpi%TfZ%gAo&`-yj$j06n|{9
zoctuh!N7Wn+w%p=d1#{!x7mRbnm~I(dWV^%(y36nEn;P*Si^44uIXS_ix2Bv0B@?;
z%;`(OEf0rX$;_wKE_V2?=y!|hx|f4>jlx^CL<?8Y;xm=Qdh(wnwqbKoLj`CvlJ0@R
zK4eeKW*sFiR-!Qvx`SzFf;pqa981XV(j*v5C?r<PG}&yt+^85Fn)uv`gw2ky3~Z`1
zS$+g>bj)8vb|wqr&4!eG&(l_?wP4|QpW)UfZGVWWA>7ajHk~l^;O!BqgixjWNnteO
z^+tLZI^4<e%kfFVwVAC#uVRjwz99$)`vpjOUuK&Khl2mzbZGNkJ0Jc!9h_6V-h3?j
z_5FbkNWeUvW8@ydw^3f)0a>{C5}Yju0Mj<pJCOa52jqcbR?VvMe<QpAvg7w|i7OPl
zFYkrhScPb;e+pO{<9V2)2Be3s4Nq$~)%^IN*};zhby;6z6x=)At!4h8erep4pb$eL
zdY#W}vwlJ7NQ}VE>I;00`kQMvBF7RfSXU4$eQ|`;Sfx@8d0oh%g)@k&>0)^zqX0RX
zW>kc}Twm;GC^<4uU>a${f)xX1Bi@6l#G~FTwot?U)D21qXFu^^NwH3+u6A6O>Vyj=
z<#m`^#U!2UFsc-AEfp<D78xiV8&Z>{muL#8yWnNMmY5|dHG!l*(@oEpk0Se5=bbdj
zwRuA@4m=aq{}d{lN1mrFd-HE)wu=huwQVSKUE1`O*jbmvw*_X>A?v(uL=ak^uY~H(
zZy^nDB$ho49V~XbwR<XSGS@1)K_2s|@UO6hk*YJOXQzUxhWiGf2C4&7zEfl2a;#5T
z)%TwY<;m3H!t>9jmg+X5%N<>No445IV5SV3mmSJyGJ$E|%BMgixYJkQ{bI{!Q~#O0
zsd8b%38t96%{xRb@Z?tm^A5CbN9VJt#?$-^OYeanD#)t@glm4c8{kCPtFIzi8q`Ok
zDr}Xj{QO?Z9_m7z_8_6JPDl?&EX&a*)+vn#*h;*Rz*}cnR!fze2rw56WLtz-*j6lf
z9Nx{C&E|B)%XugxS&<j{bKTdD$3>ryBKcZl9-;-;aXHlwuAXB04>0c=PpvV|glU(W
zwKl1jD2t?6=1SW{HwP{Rp)QK_sBT=d3b8k5S2lK{DkT^*u+ziv{o)m&k>TL#ta0JC
z;C0murAo_t@@Bqu6d6*ju-<^qG!9|}Pgc)r(|lEVn%R*_m&tid$T$K=)MUL7G82w7
zN?&x3^0DH)IfId)ej*d9KHeh=$tmd=^(VZ_1@*qOC?nu<d*DYhG6V(ZNXlSC%`iC9
zhL~O0S4mc6{UjFNMO~?|BBQY^{KT9)!LFA}Vew>#J^dA`Mh^hCi>Ssqr(8GY-S!hB
znkPFcsgDaDti6a#KSu4LU~`H-=N*&&&q3O|cFNyCC+<?aU-cT_5_(eNIj*B2>S+5e
zz|%JU0R>V8<W1)vn~~HmMZmIoQg^;hF~|h56mAobwdGX*UWE<j!77IXrpFy!?)T8$
zo?>k?Gjn)CX{*L82qtn6BYL2qq|mvBJS3<*9laEp7Xw4ztHmF(m~wWqlRj2Ipt&-X
zWVN-ihE#g-JZ@P}$RXTP163NFFgh)rdoBuZd<ZsIY%xCbm3ReUco=ji*BE8$kh)2>
z6*+9a+96f2WayM3^Wzjz4}H&$_&|--`7KPA8W8EOU_F-_aQjw?WH_EhbB>58Y;Ka}
zCU=d$6K$&OQaGHhzR1WiMaI|E=tLF~*0%Ns0alJ|cz0mD1&G|)HdspgxHnMrrfNAU
zqkzWAaNw8B8J?P~C18m!99i*gx63IcMBLzq!dk<DVBdu10DDc?@TX886SM22!$o~i
ztfWmxVXyLQ6{Xv#(xLP$Q_C$|XK5xnCki?{oRADEY334gft#0L>wB6ya$V`mV8&v)
z_(V|GE*2cI)p_qQRuC)G!d|)OVIDQW>`t#REQxGvdn9w~)PTHZLX0}NNrbPkOy$+?
z?kgxN2&7ZX%!zXpkE5(ka@gb~JXNM8&1gS3at|olo?1jaJqG*SuUVR-=sBzFJE_y>
zOb;4;y!XwekI^#cxl?Al5^b+W)p%#6d|3K^PXGNlIfa?@<~1USR`IZAhjpRHeNPYF
zv>`j}OHfixY)L)W#W)?kH}3;q;fJ%Aem!}XGBD@wLwJmJQ*G<WCOCCE9+yfO(v5sb
zRpC;D!|VbWk*wi|rO$0*E`!k5Qn@0`4Tzwg!~}jB_z>yra4;3r7>t4$YEYQ%;Nxe>
zy}?-cypWNrQ(|u1yXDp?GXyE(p$N@iDE_vqioa|fki;*=UVSDlbn2S*6T65^1V0-e
zVe-UIC4C>d1%2$RmZoWa;_VgcpYp!%{byzA(P^Izda`pxStEn4&!~E*z!mEN?nOSx
zM0e51oe*JIHR3cD!&9eZ0lTA513%&6BZfTl>)37hI+w*h0bgVBZzHE8slPTcFrz-l
zP<!yLu`n7edU@uQ*hUtc64w!zeuiXlp?OQqM<RR=SxDY39h$(YYQ6mS!5??vMT}1t
z1C5~pk-Jt>kDa({T2dbTYyd4__=q){r+7+CTMN&sLM$SUy$A-ZJmpA+j?#jBF3bwo
z`nNzUMZeQ_8D<yN*~7!x4~Fbm9JiJ&MU+*)oN3b043Jn(ZYQM*O!MjYZ;A?932B(!
zA1$;Rto#<{LZSFq+QtDkL>{}t0eN1T-*V##HxaD$Bx)|Ml6w5FJ`Wyu=8+Y)Ek94K
z*lPOV#sMkBPWJb|r7)%nHcEk!OMy~PIpN<S8B~o*-%P=GCNp0AAzuN{`TBFQ^uj#v
z5%kF|hd{UMV%BNTT>L-@<W0MtFA*5}3&?9bz6C3uwAN$vK{Wz2@)dVaJe6|U6iqsI
zKpf~YRBX0>GBeVDx~FOmLw-or4O@#H#&mhpRxnrmJlSPY4<qdGA{&B6o7G40)0MmY
z&ubV19-RELNQhJ_f7}%yOwX^ikV`L9j?Ztuy$><z(mgU?c@5)27d$qp#}-l~Ioy73
z<4q~?XRaw}5LF*34wD-nzRVJ<&0upJjAs#-Ka1>K*SmVDz2<UDu_p>J%Z7(LHl7%8
z3B5Bv<9GLexls0PGx|~p*2wGxYqo4H^~t!^N?ZP+#?ULN1V3B2*u4wzDAl2)SG{F1
zsW?R?5U_?}c^&(uy<&U?7*MGOR5h`Iq4<B*O@1LdW|>edVq_q=MhPxe2PLm@*eR!P
zmpy6P!<SP(Q5H36e-d%pO<pM<<`)|8Cwe>oJs+D_PA;HA1H7?DMb-j2V!*v}g--A|
z!<pEVT%TLd+m3Czm$D0SI`6LwAFW&^d3j_5N4H~o%<e7&3)g#<!6;Jek~_}6UaKJj
zgEt(pDIM5qvs-5HC`aTD>-bQ&=b>yi*tR4U4~KP#S6bu$f<Co-S%hC_^RDWmH0>GF
z1(qT^#w)o}WANvxM)+fN^Gr>>ZOT(p$y>&<k%#qJynJgDM2TmJ@o!DJ*4JEyI`!9k
zMTNhr178g0oGLP_?$n4T1=%T6ea;dCYra&mXSZ7yUUqTMJBQ8gCYxjc$ZIsFR$yG}
zVW(0$9r2-^u0v;g-zJ!c&1o8zYzZTh;2ss1!n~?yRpaWpDKSdSJ(f_}R$a7zKfclW
z-f+2C)7E!l^h|)~sH|*qTr|A!@8#+{)kLe3oc1++9c=Gm%%_A7!7h6P{bD$&?G!sp
zf~@Uf&<^#RhGg<BtQiAq>TL&AW!DSHATU7qp4{;!aqHHZo3a}!%x|Uya)chQMjs!@
znp{W<x%P0c?aeP?{M(CHk4*%QwPeg5x6;!deHxIO`WLPSLDH0yA0%d&r)kRthx&wZ
zH6=_z7h#2Yk8&);SqKSDs9EAG{^RkyvsNr+n48gY$MX_*>*#HJg!@ZOt3U5A(fb)-
zm0EV`3~EHSk$;LVzEC+?I8>0QK5I&P1T2KD{l9XL2crP)u>_;64V)$i>-_63l}0l%
z^8<eFm%^k8ZEGqfl?hZs-6Pu2fXgnkMWHS3n|CE#^pYP|zaPAmlOOa{hWM~+tbqPd
zHh85ggT<TA@IP5zq?<EqX$!5)(Dfwq2U*cwgfw(->h98n`~Ax~6O1v=dvx}FD7o`B
zyuv5cz3Y=-%Yqe@_}=QgY0KrN1ZGi{-~PW|4Q7R6JC?RX0z9iCdltI)5o?Hhh7Zi}
zraAqBb+mvIyuJ!$W$Cri9N(RnyhsXVZ*4LLDa2U$r*3ox1F{Zb9-?_yOt4ycs%Y83
z^sr|TucqT~Sdtvd{RVVmQfOyyPA3TcN(2iWAtzB^6KZrPfRO-*NKtcOL6k~4r>kTB
z>qKMtJ2^FSmqF|x)WIdDgq-VEtsv^z+F0*&DYb2@@Fe%LosnjxT6Oh#>3bPbTj;a)
z`@u7}YVC)GN1Sint->r<WiFAl?~s~!J2A5LNzZ+8hiN;9gnaGb0YG>L#=v{UIo%c!
zhFJ=@48hO--u~MQo*!ID-tOndR7TIdLx_0;tYXmL!zCS#&C2N%-(!A(`oTOa)*Kff
z1I{Hq0e6owZRl2EM}3!$yu<9INO8FMeMx>N{I!(-sTTCwR;hK2BV`|m_dnhAAFlFk
z;suop>!Kb1?=oB^s@>YrZ#|&G(HeXvlH4a0`&ASfryUMz#{$X$W4wO3QBV9}tU^Yt
zET-5~G+zfsfh5Eue4Lt${FYn9;362L(ko_=^x5{*z<M)2dS8(~ha0*8iSd_xIIVb0
zH$NfEM{*3Y+X8Dm6WzyO+v*Q?Nqdsl`9Ud}{n|?6zXBnj_(^msanVKoP46pb+@xUQ
zosRz0v?3@br0+VQqhp|vq5iDe`~Exab@g@VBe!IiFV0JMRaC!s$ciFM#L;T+q!RpI
zaq7F58v!yhAYzaF#)JmGWe!eTGP)k=YJsQ)GC|}g=!DeQ(P%e9)k!5g#02m9Vg^k@
zFa8!lExBKA*rumKxD3))g9$5J$(t)>0g)AYm@+HDF0H8WXGr+y=JzY#zcoGw!SJ#U
zQ0w;{Nd}xbg_vA*#zmKjx*?Z|T?oJWOsC<+YMlwnuz|MF{E9p;*EsZudWHBps@LIb
zM}fb-?QluX^)Ss5_g{CC&uC(TU$5u3DWGqhGU(Rh@6BJ+IB%XWrM)ht@{>qnA;y!U
zWp2$Y*=SlhRG#xFyAvL<^=a5%HLTM)yyY#@%hs0G7l33W^s~G?c5+eWUo)iNzBI1F
zydq)hSxuGTK~IX#l5<?4J?O847>8NC5_uZ1XB_Bt0i_SQk*NJ^nO?5hZaW3oah6`S
zi3~t%amM&-+dc@%#Xpql<AC&uNU~e4)go^{U}9(##w7MN2$zB{LDUWrc2d-}K!vhm
z8xU5>J{w8`Eu7bammRM6Yiqm(N21iY$~e<1g=1He=E^)ipk^&o_!e0zKK(A@*L#J`
zdM8rfN3-kL=AkihQqfSdTGikE#zmvN3Ewe(N=S2lSz*{vwb#{oyB@X82FLoeTKRr;
z+Cu4Mh2$20pwSSnIsW7?ie^&}DCET~-~4Jl?lv$CnAv7=ewcNf!qe3S<ix(J*O-bA
z*nDNrZ-yV$j1kXZh;i^<e6ff22a1%odBbKg&bJW<DRU@+>+j`}^Fvv@4g<~n(wz&|
zCp1budL$G|6MwOzz=f*N_o=X-<SP3nDMs7K=Ys#R;gryVCwSRIu(jOs$r|J%0wAS{
z77ru(nv9Up<r!duNia7#I;Y->h#ZNSE5kHIQ#;hYhi-Z(^d~0-X#7kRUlCis3gg=C
zI4<>?RxvS^U6q*J!VNQrWE5U8&C@PwSxL0S7HWPHg|k(N<ESmBg=NW_ph}N{E=;O2
zZjpVea%eDng!*>llB}VqZX@CgE6EhrSdz~<i7)BhXi5EYWmxx=M&ay>Pvm#k>M#B6
z;*Awc3JGVYhtXDzY7q8z1;wq-p~_gXEsKHmp}jOWhObjRnhjs4=G=2*ZOf|ZJnPgt
z#eby8zWuj7Oq0Qb9P_s7HTmG9qt~fbmsbNt0vtc7U4}$4S|h=zHq*OyfQ!mhlNbRg
zDF-+v4q0%ED}cxOJ8sX6+4N>~I$@ScGyBIRLs-$b{#16?5Sd-bN<eR#hhWc3if6H&
zjI=>jTy=;ayTFb49yR++CEyV*>d(Xe;zh^d+b$1Zx2T&=h`G5@%3zSPhqLcznhyrN
zq1A1m<MqXX443ChAcH^&U{`2ob7$6sP*j%;&(<e{ZXE?z`<!#d+G^YGh7!%fJjzjX
z;zgZN-gOSWjZtEKIavN7X*c^tcieJrIUG<;R$-UAqSf^6fsFxQ7>gGJYVFb#6~mkl
zTYNdlH~Vt354*xJcynrIrH&wpoilXKYp|ckMuTtbPh@v|dy>{_{;7wWt1CmWJye=!
zf2dT{eGWMaAATJ+SFV<Mj}*ln(z#6-NN}3&uxwSABVq5H^;ZgK+<I`6e$V;Qa4&ON
zSiSv8>$TFzzQn@Hd!98qeX43sz`-0%Kk$>_@E|Zrz-^q?5j88O&2Pz(S=>Bbp>`pM
zL?TVzCF}4$ev>Z=rYR$m8Yh!~XfxPzo`nG6s~&PEB|q@01F{Rfcz1>B5L?K!*RCl}
zJ>`!I3}nr<y|D{GCrV{x!5Z&imuU|C6v|+hR6>SYPvbi`hwoV*KVnW|b=8iocAS3U
zzwrvE_W|z+9{+>(Z0HDQy>5P|BJm}ply=cDic#zZY_vakVY?Ix)B*=d=ok;HN*x5v
z`r3PnCU&tlA)l_arSe1kA5#1e0ULac0~3rXekH`*Kj9<(6jPW%9at|e^}SJ|oqyvT
zkw11^|FdIEMvuanA;P)h#DI2F`hjm->f92z!FWaJmwN3Bfsob__U+(>meKLYj7;Ux
zLw1BN#m9ZDdxCdW{y&sm$XBa52RCmP6*xUSHh8-yq{BcK{*#-j#Kd^e3)4&vedk=P
zfRy0sdvqdMP0CbP<3cM^4%_TA-s!<5U82VG3}0e+b41l}fut9ypJ%yqFRhNyn&yx#
z>1A$nc?PF%F1bv=`=rQI8pG2Qr>(T%d)b?f9Vm2d=i5bjfA+-qi`SGhqPCZJL62dQ
z?O}$H3S-~5wM;xF_<HJ6z-*i;lxUs0QhSs2L<~I)Cd+}~M*@UGK<N&n2x&<buFvAj
z$&Vf02dCJO>T0}cuZG4F22N@0V#f>+W)mizPq`xc&=aUNpvsolle6^_jIrv-L%I_{
z+57!mOz`u<^wFGwYsY^r9Z{k08;fSmnH_T0l(BZ0{<<H#Ozw^Uc47Pl&LO_=+_DVf
ztuod^bw&2P(^KS{{Uyx~GP3#r%*y=%*YN^d!AZR{*155d=%y`f#=ZkLt?$T${?0o(
zou<F)X<ecxgYTwXNBkkz(*fxL>x3)U1G6eR9Y0aFf7KNwg>Co@buM<`ss46?$%&f0
z=U+v={`=o70C=N({N!f9fxAEN5>&p%>L`0xpr3&@+HOvR=T^N^44)S~GIyKN)@9XG
z`_#i)De^`=&_c<pl`bsxfP`z7wNx&8WS8HxWtS(;K1-`MwWGCZ-o-@Mb=JdKbt15`
zZ~RK4KXk{i8VW@ct9^&=?&sksRil@QdlrWZ)h6oTDN9(FUS8C<k>}-PRwUNY!866)
z9_K_glXl|f&pZ~qWtN&@Veql#1}?od2e<r?d}5GzKgjhE#npH-Cz&H~$;TvoIwIU1
zFR$&E2UkrJNx4ie%EM|`94}#(DAyzxf5u@qi4NSagia%aY<~E;+n!rlzkVXKZDdwT
zP3!MyxSl3#W#aDDb-Ks;KZU)(A@vsut64A!=4d-qRmQwA{9DXV+;zzas<FqVBn<an
zL={AWTk_}2kc{i)cU|+Bw#r<P{9Hq@d*?)2lFfb1P!BCcqnXysAg#uHxo=>7-A=lP
z786r0K58MnT|WN#4pT2W;LF8UxK^`Sddp9j^%(k#A^OKJ)jL=gJEF}YBqycGBxoxj
z;Jc}{kvy_jy5Ei%A;i<RtZJOhI#4gkw|gAtF9!4bd&Fm=5}@Y2`ayF)+P+RF!W%81
zsG8K1H_XY3+M*lFuA~+%Q3n0s^kO7=KycSKFwvN=&aa36S@Skd`jE8gWhFh0i#G`+
zm~V;v?A^dcG&5{-l$`%t@LaRu1n%_0vrjWR(~;r3r;cYLO-@w+87e4fcgEnzn&`V;
zPk%2F8`he-0ZYXALC{%TZr7oeQP^sT8-7n5ex(1eykGeTK-PVq_<_+M*prZ}S*S0|
zn~?W9l#vT*;B~`;5k?EO%6<9wuX+HcQC*iTC$6IW<VJ)>LpVVh*P{4rGV_j-%5nnu
ziR0bt%Hl>_Z%L(9V{9M0fUZ_Qnf>k7wukvhekC3hPZ}g@T}N~z_+Jcns~mbA<Img^
zAB@mD0wd0LjebAJ&yo2o9@}bm?-~r348q5nMwRz0J*|`SW+t4Ou_-nu8l5--PxPe-
zmO?C8OD`_+=>gif_IZ8%yuuPlH7#~dCkbwR5H6WGS>TmFIjEN5oC!f}p%xPM#!Si$
z=>*mp^cfA>PH<&|Q8{9P*F=y3YG@zDK-R*v^8HM)hgY9U&=;dfQzJg$icvkWzo9*}
zv}Ur;p<HNU)%X^&uF$s_<v$%^bZ<P6vN0ySqhQ?L#G7AhjTF?eSrc}i&TOme!B4q|
ziD(DqU_lycR#4}C!NpZF`{Eocz%Xyw<xg{n<WbJa!rov%)Lrg11$tuq0O6XPzOD*P
zJW^z&oR`tMThfeZZ8B#5l~6-r#z}MczzwzFRP<TpDv!h}pPIYYC&21L0Lc^fZrPfm
zXtUojJdQv}4&0=Bcu-QbvZOi5&<ubZ?pS0_i-!uF3Zo35pDZ{@lTTV7<ywFUGac1u
zLrbk>>5z(B!v|~=8l%uzlST7B4!aw#(BBON%O@f=s|Pzf>=#6>jmg-l$!yq)O@cJ2
z3^SIa-7s@5l+_jeFc!kDtLSB_Ign|ikJ#dkJSS>thQU_&I&6=5npFvA1;Ve(p!$f(
zyQWaUnW$tH!|e_Yc#zB!8V@O8eef$|oSI>)D~;pPq=Q&NV(yLt!C2QVWQI%x#<IwE
zMgvG(OGPmnB3YxdgZpZR3Ux5P_$n5H5LkE=|7sLk4(m>oY^(qJ<&FN^7VNbe4JdLB
z^j?B3H_NlGzR{|Tx<)Ky^BeX}e6mW7M>E9{?h02v^-Zt~e0sjPcb(}E#)xyO%2_om
z5SF_q<^i2%8IE;3xGkD_o{;r1<45+0=YO=;vtN-Gmdt>|)rz+nNA$touRZr^Ev);0
zFZTh9RB3lXUt|kTqS|0e93Red_Cz`svQPG@b1llwg^gNCJEVNn@7ZW}Sdi0_arQ(Z
zK{*}~l#~kbG;fx4B-l&C$WWy{F;wb_k&?<N6Sj*^SLox!Hzt&JN44-$;oID#3H2<Q
z23&NargM9U8{rvc79-%`V8A=XbU#XU2Tev%;p%wo${SRT%wNe>8d$y~;zUGcC6}3#
zTyad@QEK?nM4pF&ZEnr3sB)?GaHCI!DXE=(rhb2n*GTSc4azway*s!HUAP?lGB@i8
ze@K02R=?-X#SKzj!0RkNW!PEZtot&LS6bE=X}RvDE>~tx%wzRbV8KEt`l`rOf-lkI
zbVOo|&G?jeHwzrcH}-K7f`8cWVOC<?!$|hA%qo-(B!J8sL9G)o<84dne@v#FNl_M0
zZagl5*(#&wA0lb-1|45o56@{ENU;wPW_P9&1o*$jyrvYz6hBGDrrB%nQ}(<36!{vX
zQfEqA8^^_vA;Avv>3hLO5NWVX<3mbHtbDSg^JM%1`N;sn+xQOgMAlHj-F$^7dj+ZK
zCs}>a3tWnyo8MA8_imFG`qRBkx2J-#fGVHN5xl5lYST{~k5fmd1bwvM;k#2+vHRk1
z*;7I&iGKR_$kB31M?j;5!*B^b^ED39ke5ZhV8oB_$z@AxggKBd4EBhwN}p%)A}$*N
z!hcuh^Knuv6U(*QSRX;|`(&+Dl!Gpw@AB>$vYOefR-zm>373eE^Lw6T3`VQoqm}wM
zN@17J9Cu7@`AM2TU!KlHN`k2?d|g&%;W>#u(ZZo$;8Nh{6wfK7rRTf=tN}wUw@=<o
z4E-l>bDQh>HPv`8kkR$;XM!W9LjpaO?STEPH9(-t*#Bd@|MXT!8p~^UD!5ySbR-Q5
zVgj1R17>q@&i-xh&$*PNMxO0r)w<-xs4tPqtJ{k0Ae_cx*2u^Ek>4l3aUZ_Qnx|^O
z9qyL~kTvO5z{_=oXW`KieKkP<Sb&fE+%xp7?YrVKrs2-Tl+VluG=V*oUfD9r_dDTG
z;)-3Y3D6sbQ`O_arjz6N@=IdD1JU=|4`%Zu=fB1CSajClJKg!Gc(<tGf-^+d%=yil
zLYUnS-6+*6_#NXuhluF9L_ZJYCzo#hXLOgu1PzYUi(R7%PjNZ1P|3s|{@GZ#=FI90
zc~N;&-GdNu(*j;oawiUjeE5CaA<lRDdHF-UYZ|Sl;3m0%=!W{P%1ygDRfOT-l)07n
zGEpT1xGhax4}xqVo+(C)F}ql&UzWc0S%u%k#TWF6%*mk-^mL)T9f=l(sot@|`Mwd+
zeXp=%I?ZnT6hd^uP9~~h`D*Z-0%_l71H&RE7gzH*%jhDCXt6bDZc04=wSJrfR?{wU
zANW$M@chj(P|C0284RbzXXD`LU*c%=X-U8B1PoLK$Iy(e_)@XsE+C~!Ye<j;n;<O7
z<DTL)jHIQM`d`&l{W%`4JX~o5S#ptBLvm;^hxJZmA#}fFk+h=5aSk>w&Q)Z_!LWhZ
zuDIgcGfD$Txe^@d6%g<hib*l02Bbi5_Zi>51z9SGH6)}zuK5tKbly5wyI9{Wo}+H0
zj=ym!Z3g2DEIwy~{<8~MV4hZ4slN2%A#V7&RvEa}W>E{huEV+~^$FG_ZmE0-R+=bt
z`rAK|t4DSRtnOq)FID}GIst@n(wE$(d)f)b5I3guoB@!$HzLcR$pXoHSL{mRc5$VO
z!K6Q_u_z`VJ2ayjFpM=`bmIJcj^T8^PHtCtE}yV`sfVwiDSgk^_2L8JWmszbVqxK1
z?i2@UhR<;T?-v<tXhn(%oaEHxSBvcG0x!l@sey-<s?jO&N0fMAz2GyM6#}Og*0&L1
ztl$u!6(m~7-@ESO*#$pw&+|ShB1*%LP`II|(IRW2xo+KzeW$v*Wz+?@RSXsCZg>by
zQV6W~Z#1)`vU}b7Um76u#-Sm^aIyHDFjMf16K2D|;${?uhrfE7s-^Igw<_J%of`wQ
zg!dE}y2i*KY_Ks&Fw#&^w<{HEo~hc}RC{hbIx|(|U00z(1<CLB6~55bDR;fv9jOr|
zpe!9q)XT-3%Buggyqm)%vqnGsWH#$XVn^_YFj#F9>f{gjJIN<i_OehEQ_6wHeEoTP
zZDADk%FL5R(U6ahG4(*r0rlF;7(1Mkzm2MS>W+ZB9EX`62(@7J40gn8ETEZweB6ce
zSIPj=-%^0fjcFfk+jrkZcx1+!=<ppBMmc%%xE3vw!^?B9)-lqkkxC!0F|@QGEiA6s
zZx7+nE!T^t4W>jV;B$8YUp?bLzWRji$3hcY?ut)>HT*By0-IYv{BFR;uLPr%bor&b
z8&-p-^pP7$t~u~+VYMn=uJ+HWo&dq3yfZ@K8X#Cyj>Z7dmNx;xqSXqE7y{UJ;fT_S
z-Uy}%RV&1MymC-9Vx!RGPm9Num2ge~Kj`srWAKCu-MrSMQh4UAWRg)qg*2s2?t8%B
zyq2%}<&3l@SXWkUrBt4^_0{hXlt2FLPkh8yEp$jb(sJE>$oFtl-)dN&L$WSv#Nr?G
z@_eX2E5<AI#}6qab#lP9HJOxe@Jt)^D`?jm$=_l=>9wEm%Bn$qV%JImigY4%BY}lH
z*#TcoQZ`c-C?KD^0aN7(-Mr=i7MceUza;GexyFOasCGONvcrjIzys8b1~8y)0C^ki
zT=@sGzw#lK{{D(AydJ!1@#j8IaU3ikSfmLy`jt^T3FO26liA$9PW<W$Hf=RZ;TLF(
z1uv|oF^eAjUg%%VYo0Fk^&r(%vs$agIYJPyg$2JdOtG*_s_55?z)gchRvFlAAh-@w
zkcS7>;*&hCpn+uAkY$y&%hY>q-ooi;>c0XSLr$rURQ0{@nI?{QP9_YW44BDIiva?g
z!j^R_ckZqC#~(noNiS|^?*am6k0EQ`WN6iz{urxyxV!(*goP6acUG9;Hns;&enZ%f
zUoyOm4PBYqc6dRp?4Zv#@WR%c>xrX#{tiK`rsBQedB%rgwuCg-Mfd0>X3GO_sDm%Q
zAKz)+6aDGl1Xpuul6}m*U>MUGO*>Lc2nJnmVNb7>=z^wWv&y{Pnn{2wy>gptrsSAw
zx&4hAzu!J}(`^fgm1cGGiuZZ+Q`{?KJB0BDvIF5h&ty?A>r?>!5m<qRZ3l58WsMb)
z)aJcsN%b4li?JK<f*(poqZg}2!Jk7CCa9KZZ6Xj`4&(ugJN8f!v64M;ZWkTgesU(4
zAus&T;68^uzz0mI<Xur>#181y)hDaI7d2!o9XQH%qoXqc^OK}iv3|jC0Sv4*BLD~o
z0@ieGwL5<c6b2EGh_~m5%ibu5YSne8C?@MHtNSSf#Pk*rZ)dp4FC!Ko86Nma)1g7A
z1@*m=6a_?xtcEtAVxv)K4JR{F8nP#DvW_B8!Y~hw)L|UPdmv_`L3p0&{OJaF>P-&4
zzO!8`-T@?ZA)yQNptE5lOFDtG00N$E3tk&hu>~%T1;T;&s%`G8ep({uEaTTqkruk)
z4ek2y<^gjc(lYJ15Z50KtXn^ouR8j|Wa%-G5}fq0(KM1$KY<n)*IJK{M^u^rieN2_
zMHF6_1w6E?R@#-1#`7k2hcak6v-;Vbcc51c%<0sz{?1*-PPVWjS%wLT>em$n#a>}S
z+1Ayhtah5u%!2lx``Tpw+{2I`W$U_@EA6Z~`S0iHIqc5LD>8$ZN957BMtJDT%KU$=
zeR({T>-&GAa7v>(r3FJ;PciNG8Ku&xq*AFYQ^}E(U1OPrRFX0rMY0S@NYO&}p;TkZ
zzD(H$W6YSr7&Bv5<983$=X1_?JD=C<=a2F7czB-YzOU<jy|3%K@Ava%AYN=WIJ3g{
z^8zemgQm^8fhZs(4m5S}vA5a{A1D9&Y8$*|>M&UQc>Ue<5}-N1q!Jb2RK;DDLRM<T
zx#OH@8Ox=+B4x~7i->r(9a9o`*WH$UC=XVGAXx>rrD!~%hXJWxbo$IzQy1~ZaYSPo
zH%?G~#TMM(HH*{)xxmV9^@Z`@b$~1@dxcvb*+u)Qb~w(LmE=BFCii-zO&!v-W0qY-
zSxAx`lg9b{+r)boP0F&c=|6FgQ*apQZi8PZb<xJPRqvNhxCtvaXu=qJ&y@%Mr3}2D
zWmyp=TR&C*OkfzOJ*ZUT4Yp|u-O0ioYpf`syFGft;FMy!_^37*=VpUFDKu==R@H!_
zn>YN0mC6_;PBca6<*uDmkvsGfv7ER_b{nWTSc7FB;O5b+Ti=DE!WWNIu5LG<?<n<0
z?K(pqoxH982Dy^7f6~SX23#my?n1MgHPW^$Y4^X$*fSMBFZAb7LnY5QLR{70^=)#!
z$AQDSoSi$yz8H!r;cR0iwD#bqjrb&H)yYKZpY_tcrI+419{D1KUq0=}A@3N7e0Egs
z`00*sJ~!s!?e^fz^+s9baIyRk^KEAK;Z{e(%bsn@LUv$Gohp7h7e{!#V>KfY?87Z|
z$}*qb=B%#J3LU3p8Jgc5FOenBycS>vQmq~?Hfwru1_k7m#T*>aB}wwy_ysBUzS#Q#
zafJ&hda}8F4v~8ExUMpIgMkkG7wU~N){5KjqwBE0JF)JMO}sSi#82AJE#_PE>`zuS
z9OyJG6?eR=alzdx0`Cr&O$CQ_l0`mK8(73^%m`v&3Y8SbSF?Wt^dE(f+AYhz6vOky
zHKU1>#pSYl*9^(>*BIn0D>(0{XU1>4Tx`Cx>eQ^&E33cKQu56nx_=?lFS1V!Tk3JR
zC+`XMP;&g}qO%Z7T_7WGrJ4#Mhe#9Dy4zcb`=#oLk2ZYS;=4O0ux;ULtI*$;sSuA;
ztiat7E6CJm_DXMm2_bhBL)(?`9=>30uOO*91Ib*qVyfk;I6mH~8g{l0D8+#)Vuyio
zjXT&)YHK6*=dnIatxb;@HvwAJAvO=JQur4-x1YdqLk$91u+oAdq>4qVmdegn+=~3}
zMR)sG%}Ufbt9)IpF@66;xsNZ^=@n>^7>63T5W=VWZ#mu3Xt#LM*ara$%+Xpnouiyh
zOYuM@`X0=c6dz$V@H&Q*MSq4n+N;Ml-5tiJDhtzU4E>p?M_Fqs+VGifaV6s~$brnK
zu_cZg{B64AakD>&=>{fO&j%-%bk4)LRFuET-N1~0Z`NTkT^$^3&)$*2#)(nAxtq~i
zQZ*ndlxXpGDjdi;bSx+cmzQiq7wJWV?qGS$wvE!!&h&%QZYqsUDzTiS&A1id4ZZm&
zL<cCl4d{k*EP693&eE>o_C6}u(X=9PA>wi{VpgABE)j36#1OO>Qe0D8@U`a=cY!X~
zuH8AKl%bgraU+jfHJHYvCJSqj(lg+uC|Kh!l73d7Cy+*<C_PRN2jT*r<;Q|&$`FjL
zbNdr^e96enP1L^iZEX3l<aLj3bnRmJ`0=@nDm5kPM`}n#39)Ygh&Vh6f6=DsSj5>A
z+_&^lWvl}HcQbX!N6V?H5Kub4lOrZQO#f|cI#AaCOPa03+i8V5@+?<zg4ntyc~yLY
z*vDz0GjBtX75h*~07~ykhmanCPq)7`DN3>{PsJMZ_x#i@*#VL3ss#NIAqrEu3A`&l
zxnykHHqSpEuk%N|t5U|OLy!Ji<mr=$;4IKkkqvu$EudTDxEsXdMVIt(Ek_qA40N<^
z2(o~HtLbPjRG4^|8TNuUdX7bPTJG(%*(wV4VDN&44G=xq7<v@13@h(b1~;2`fk7$N
zF)=^7xm-50O`A8SuG8zNd-6GIQcx7A(-#BL_RzPSI>rtw6NUWTusn>AZ_Ic4A<(5W
zcc^~7Z~EC0wX?3Jq_t(pv!rE#VX@S@zC{SDz~4RlfRfeHNj<#>KTKV&&VH~hTy#uh
zpq83CuOx!0Fe}pj?_2lR^DeB~uQ5R+?TI{+zo1buX?}lTNM>EMc9Uyc-a=hzU2DYh
zvn}EFn>#o7ig~Nn`|^JgC1tPS`>w7%ubZ15w9yJ`U~X>UEHz6=XCEtb{hgAJUu`VR
zBk5+!`a9r*xL)PJD|W$Za`m&|?^NesAQ7&<)pPeZWy7IA>lNp|6}of+`HY^b<dr+0
zo4`n>O3ytsgzs%sQwhIe?t|cXhu}A@!?q(MKiG{gL$B+xo6!NO_5hppY9#C7FKvJt
z23P?OsGVS5sWw-cO%1WT8XVgAs(hDhE_f}9O+?}g(*7BP5g(xZcKb$At($b2gEII*
zRctVfGj6(HJ|9SZq?)S;MLDYS$THcq&`x2N<L=dw{t;VzY1;ZCTWnhxY`S~|30m={
zN+*gxD8moU!4!ptR6O;n#5oeYI1dPgBeL<FC}{U{>g_QH4~Fv8Mj%CgYbNxhZ#B?7
zl|N1lDOzg~Q8)6*B?lAAMqw0ie#U3aKh~{)ditu{ydLfStxKPDn&Z|kcqc9qVZ$vl
z8q>_LCgANWQW#y=Tp=n%){Svvuy80%32pw7x;9fhZlE`X`kdqt|HFjPgljhdxBQ#c
zU)?@y^*f6G-RiS!X6i1{NQ6#QkMI*|d>eX81^j??NySG`5r>s^OJ*v7<*J)W2C-3Q
zd$o1(4+vH#20k5z34i~E5GQ&`-a2Tmv9GRE*S%!pTlmaYent;?BSYz4onG@rE}u=y
zCTi+l`ZG}I|HI0&J$Gl65C1xy<Zq?#;(Jr0?7^HMZ|isG*UMkY1Mq?h@p!bnq1qy8
zN#;kl>jMu0)@lRTZH~Bcb7jJ2et1xFW((T|hh7M+B8@}I%AIYH@*x^=yZh+j?gIbr
zKp*!r-L!SNQ$bHqyj&%r)(5ql2PBGgfl;9myR-njpJo^nU1;=EDQw3K){+<ePzu{u
ziL>n}{iDNC-76$aS1v?pqVvD$Q*|plw4cOkat@R&_WX7~5$MM`F(WAbD52x^DT6%D
zHv^gLPXQzGCb^D<#t&hyJ0a6UIjH&<r8<3clr86Ir7HSaX#UTdm&b}BMbERPMg#W)
z^m^Z{Hk?%}s;FX*myU=Xov3derHw!3w|KU4(H+<iIXZQP>H76_NSDh-^xO6|9DxAN
z_|03hOD)R}yjKAt)`6Ru>L-0$jr)YKe}rhtI2?ktxu;0H2`gxdXBZ|1Jf#eloamqW
zO`K&7_3~GZ7C38GOMX$Je1cx|?pM%duTakzs0z!NCu6=DH_rcxyjCaVbKn-_`TI6G
zqQuv8QbtGxFSGNw%Sl>b8(Tjtd5lnBDl3})MCJ}ezU!S;P81TUj)(Ll`~L=tle^vC
zi>j`#ywT-a+Oy_03ww5;=mg!RR5!5!h~Dl2dN4B9l5uX7vJ&p<3&aysKUWoX)Hbaq
z_9>k~7rSNP*G*2ckX+}{VTH5`H;X<=iY7zjThXg^Q)>p&pCZ08(kKrKu(8(?UbIJ+
zxu09l3M4<@Ao0HD&SWK(JygWFI8L|a>ExC{#yu6+n2PTd+M>;2#LFz}83Di$wrOw1
z&h4ImbHcA(8xIvW_y415Er%2_vt<E*E9=SLXdq^%l~6?=FCGy&^itpaWm-@Dbz0?8
zIc4s2UkxSAzVj-;fI=4C`CnxIY6S{*`ZTtUJPWd$q^_IMP@8%GRXm1LXP*T0u6{}j
zCdkVbQr4~SvW!u>=Sx*4tvi4;ey!~*j~KsCa1`a<FO$xty2}RoLl(TOg1{M75x;OD
zvI`sgAh&Ovt%ly-dl2%+uCm@iX+OGLW?A~N^S#2-E1ByH7Z6vvLxh{7qqUn|f6CV|
z^gdL@gv%^@4cCsJLP8p#y4pa)Q3rlCVB9Qy3vS#y2DyER@Xn=La(my#M&t8)Su5QQ
zGfn!%@19~$n}1^)mh4h1*f5%-wAbw16CiDLKwaj3@FuS>MD=BQ<71(bktMo^KO(tq
zW^lD!u7)jLdWVG4lN9{L-d4=@h_7_W4K`hI4h2`~(Esz+S9(Sict{Peo5*|NdRv4>
zD|k>4h1OvApf@T=-^YZ?TCd8*pj$k*4mO*MeN}gwjzu5_Ak)JR)1OcrN6U~h=Z!bf
zl`n3SllRqJSB{ifRw!T|L_u<vOV_!}uGp`4=YO!9=-UjQ0q<V;Z17sw#gBH{1Dl`P
ziIY3e>uN_uTe8MC)so&X8=&X9QVOY4OYA*o1*--)J=Iv%zky15eY)Rjtwmm2l>m1A
z@3NEal8~GfCVm4DPa1#)b7JF*8i3TKF?tc9E~SxXZqW5<`iI0+(-9=lsgUtMEc;IX
z7kg1Iz1i{f*oUfRh<{*wS)Y|1uFR-|pInMK+ivYNU;^WRxngPyL+2!;b6R=be?dx6
ztNS;kyd5&S=Bwe^R<iyQfpr#d>Z`}W_sZo(N`Uq%0A))qGd%F6Au*CYP%1Q#(Uw#~
zI8}$F(M7r*3l-2+$8_+ke)(e$<o4X4t-pRbabG(Q!ZRVI5RL5HIpdy5vZUMDZyep?
zKNlR{<=ydR(g<_mb4=9z(Jf?h2Zy)6u;JOj*<2Vu9n+K<aif7x4l0=5_c2p3<#z5_
zCf|JQ+p1vVm`CBe$x^wzA9~5F*WE|t^$K{w-j}oW3O!Y&WUOFv9j0esQvtL~E!!_@
z7IVjK<L6)>T|?~4WVEU4995e)5tnv;Iq&?&RAtNeTNv+;U51)J%GtJH^vcG3o6?q)
z{0%|tQ>=e|l(7u!#h<{^O9eI#S84?5(|%K?YOQM=n+%3WTkaaYd}==Fwk6Sp%ea{N
z#RsD}op7CbMONd3$%c-G!L5HCBtze}V4pR*EGL7<Xb2bEoMxUqiV=&u<0&IVITpiJ
zzn<}s7p;s5=h8Z6n)*#?N+Z_}m*pGPPIZsPU)Su?Us;%MHjvS?Syt@mYARi*kP{vd
zA#dyJzz2xu$vOP+EBG9KuyOC7sKa%7PMzfggf9PgRgLPeg6_o6=phX#BJYUj5Lf(A
z$@=lKp#xC6V8zwbE^N2RaBQ~Kn#~;N)$5(0r485PLuiX(ruQ2WqX}LHfsq<rXNj^`
z(;vI)b6tyN?>wI6^Y6!BCkW}+lSd5{z(oOXyKUj1aos#m{0e>zY4DotTxaHJhlGX2
zT?;<GSEo^F;Purh#<V9J8<cFt-X29a-qG5;F!{Rr)Z4kobvG_q5TLN-jE=?CZwh%g
z1kGA7g?F!<!#~bFdHR~2PTHYmC-awF%ZN*GYfsn&5saE5NQFx`7;o@Kn~E;&B;iMm
zyop3CneQ8gA#irWsR4ms5U%Bsaba<r=Bns~%$d7c=h)cQyQW)EtzY>ZaW;)(###{C
zw=HEL%x3-8j{RR+l`&1>Vim*+oA`<Fj9x={g#e~>gA{NV0#B$sqp{5f%G(2F>PgR=
zB~OHB(_WYJZ&{45u;IMluyh4$&CqZdT-zFoo3O7a3*0f~#?G52D<^tlrqhqkIS!#_
zi_biRdm(QJGjP_@X?`j6Dv?u;-|bn!xx%%o5Mf7x4DUDYNckN5xy~8ez_*+h4c(mn
zB9d`B16L7HX7}m$fJXCQF9<yjwIs->FKv|Zk8&gGO4)J8r<@7ai!IJ$l$^?g3RaSR
zgv|k~2p(l-Lxi`z`|I}9{i>j(ZZRjcL$$1TKc?8$Z71Rk6q*s-dtQ`1`l500S@A#^
z1d|08uc}nXYigtio!N?D{AsX5!9PJ~=gD~S=NGjxHYV_uhXkqkd!g{Vt5Vn$SWna#
z<7f{@OLkm^k+?McIC7HKNGuT5Q6v|Y8Sc|k3K#@-Rdn6;OP2hl79KAN8NGIt=$bqm
z0p(zUgp8ba+K}kbiWHBymf$Go3LBdn<6GgUW!x!<=qReKBeTMzuoX|&oG!Dj6X)Zi
z8VmTM`r6Ej{2Fbek-9fS6Vy(&sjDMVG_*Rgv0UKs%^Lwm;Gt4)Fgw{gmnJRBm@X5K
zr{hstjlVU2bCW;6f|7PvrR}QG4~jFx@!x%fx-S*x;DilB2(0k!n9FqEW&%Yj%foqa
zyO05{T$!nCL{M-x*jy=hf1ffG^F}m@$G#KAPfO2pZ78DO1#ghn{*nU3RBb`;!1}x@
zoX3rCi8>*bbCt$EW#ZF<lRfT8z)S7QM1!qJ&EUuWDmqO%p@l7<YLUVZl0>u4iI-4=
zbHrWV?C?2q+pS!nIv5$}o3pj7>+%)smB6wBKHd9cj(Vy_kTD6>78z8dB>c1;8!Fk}
zEz+h?gVBWP3CcS0rIPg0b$*%bW&tBuJDn{OYUCN>xG$%_NvA5NE^~2~Z&jCW-9IPv
znd+dor)&g;b>Y%0BpLPgo=MY^r@~{0Clf$lK-4vez>#nRUXRv<RBA0zA;=;JTRqnk
zqO63TM@V(#tpu2ZtS^k<0heZV&(V-vy*p>_=n~-wto&^t?EZrk*cqn}IEVc1+}$H9
zXB}~wf}Xye(HFT-&N$}ZKO7P&E2jH06LHc>ydh<(hBQ1)@RSMY2kJ|=UxbBMwyU7W
zMh$mYh((2l6_c{AM4&s>=t&fRLgh_%9xhX#K6|4?uy0PNv1)gs4dEi6Ln2(oir*4E
z;ZwZU`b>g!O^*uwXp!xg7gl|zl~P(h)p!#5pNHxVDcxm~hOWd$^w3NDa{haPck{%a
zEz8%;+-H+^C|clBQlH)RdhBRs_n^%eQZFGWh3|IrnVu%+eK`CX<^XUVe)CaG_0-70
zu9(I_@g-b!p=dY7gH+g_9#r;Jn?~#=3mB5YJDSC7tr)J3;uwh!a;y$REH|KBFVoCB
zEZ$iR6M(aDPc^-peTs<Rk?a1_tt~!O<?1or|7pnn%UD*f4b80Cb^7~p3ty$$saw>Z
zLwdKbLHTm*yUGgNSFay8uypOX>XNEW7$r5a%D=u3JBS~#{GBP~*yvQ2&bFi$tEN=^
zU%v-{<to7|3%~wSp~Erj`E*)1PgQ#3qt_wmo-p|AcWR)xa@3{!;%0E1>!)Ggud#M~
z!N0Bnu6dt6tXLTD9r+R*Z)|nEdJ7p{2|KtjliVI26BmAUYV|B!-Bw-UR@@)vOrG)G
zfArC}5!e{?lk>V+3sYMhU|!-oT#X*_M=5`ep`Rrj>|g2wUK3%S70$(+F3*aOW3IcG
zWH9_@onwohc}qHRFMQct@}#8$y+3G_I>>MFp1>S_ki)j$t{RjYuCE{ymIbNw_krD8
z0sZSxN%)Dzy&=%tI>>OG2SCe29V6V9PhRvOFm1R;Q?oD=`cD2Bqf}@1KY9XyQtB4x
zABV)mWqvyoHsdK4iAwWPaSye+d$#q|3s{-pmG5uh2iv+YZi4TbOW2p1my@~|y5|O*
zVTrjXJ-_2|MFMUMpV&XY7jbZWKe1ZF3j692?7*q0N%|kek*Ng=QcKky-W73`zjiL?
zxp002i@Dor8AT`5bB)(7<ih8?WosF%6yAQapSez@q4L%VM7!0zoABQ>d1>(9_Plro
z*DUncF8t~a)*1V?wzoNs6i_wRdU#9k<vTR*{(i@$O84@+$6mj7{kxC<7lZwY1zt(u
znep7$%V#J5y2`?_eZda}OfY%8Z2DPTk{(>BnX^Nj3K4(p@qVEl_cEL})>Gwua77f)
zO4w%!MVA)Q{-}Zo-#?xTiCUoG|00U)K;j*);N`%~4I3LV+Q|OR=v#T?kzmRus&+}z
zOiq&$=0FdtOH(p`tx9ISKUg<)VG=SMDLU7me@c6Y$Cq2qOvpd^2z8r#;9SZd&T6x^
zcWudv?z0`EeQnaV3E{~O<%sQ{6!E$WK`UCa#x9SZ?h9*-o@2hyZHpZ&%5pVHck%;A
zWr@pOWo^s3ysb}PJ9vC_GSc4j<OunLv%X}d->7HwnfQi_d0G`Z{X&<yJPXLodE1bf
zKJ@AajzPe`{r^Xe0;=Qqq9ve5Wu{H@{oKqC4EyLjYz8l&Lf2|f2v@rm!$B)n9uU<p
z$AM8#G~aoB;molAqmQHNTU#bnEl%sr0_4I_J=Ej!T2o^u!g4JKct8qYxu`$3z0I7V
zcVPu1Eo}QEk}^~r(DQKrv?YeOaXAOfTVz=tl{n%}f==rz@Cg<RnQ2w>(+H)lRwhsV
ztjVZMcVf>cJ6RgBy-+-fvGi2w!i~=(R%!_M(iVuHX)EIf@hCceIJ#w*BPBVP7T4Xm
zWQ8~}CNB7_Q2G1#%fYjYMC$zyz;h=+51Y5I=g*qpJC%?32g6L8OSJBZW{6|<3)tGv
z-Q(YUzTJ4AIkX453nI=6Y_h5kgJ041Wm)EW272yM#upa{PwAsDmdZES?Lo(Wo<uDc
z-$@D{yIzF+tc8$nSKt@6?@8d9y?Z-lhU@hCMP1M7wGr<ovVH+!F<xKY;fewC+21a~
zJI+0G4%!SgF}S7`pW)v><!+vZe@r^Wzwnf1<n?UU)pj1OJXm)hs#7{kA%42o{}w@F
zfw!7PeEwzD^jGPrqfUSJNPdhE1ZFys#5!l61@vuO3oLF`>EcW|=sY>XsdPTr*BNw&
zOq^r|mFw95JVQJO;G}M7F<+g%OCSlD(sBIzuiRO>PLj?%7XQZ8gn>}fj1yD`{*Qn4
zmalN&T<*5SSwBoY3w+FDvgzx#*?avbkZQCCjL3#LXYbE~sjt#N1L#Ix=XKLKWq|%d
zw!5q{``jAP0TKs$JaWBy&<Y#C>E&RG(H%lEA+VmY7C`|f8rBMuhR<&SQSS|sZVzp$
z3OF>A8HB;w;FTKg+F*K8@sE`;ZDx#g`OM)@^P8F2Ti6lg%k;h_w&?L1rM(d9CQOqu
z;0wfKk~zp1Ka6LyJn&go|9_jp&NbsEW6^heR@Jj#QsADRa+(kM(DQ2rc^MwNc8>T7
zexC&<3ty`<NKzr)=fB3F`~#iG{3>3IaY#6e5U_qMRP(yt&TAUI$?!40F9*nBxARr1
zFE1x7j&9xp*V9Qqi#}j+;H~gp$h|*2zqm@qP~^tyDHs1+2$|wsDeW^cS2mx?4SrTG
z?rQmFf7H-#hmHjl9jp`Hj)h!#N@H$(yk`bdQyt~=Dfs$z$A2)NatkMk&P2}6r>WAw
zqC>4dN4zR^m!>M3q$>JXDhua8`xMb3kZ}e0|NX=HWpIG?K98jPW^XA_eoHd-Z+rgv
zEj`i!|3P)@^6!YaDwOPP_4PVQEF!z?K|oF6ugh>Le68#hQi6koP7Oz{X<~(9ugJak
zySaF;!(8=BzU9v53I`HZctJ%cdM5L%ki7j!W}OH-s)&9))LgITqXI=Q2_@oF@#i4S
zSsQ!EtP)`tZ>Mzqa>kLe-%$|clnwhfZR920w3NX=<~1^;*t(+;B_RhljnarEC+yG}
zg7>C^Q+oQIkXNd+K>1P*lq{=i*?$0(zsi9!=C$T5P<E(%OwLMo!)3N7)V1p8_H0P(
zYzRWXv0$WE+$uE+6+bruHt%<1Mf)x3ncaxCjFOY_5p$5wCrkpym1ULCu|{ZHLCI;d
zz>e$_{EfRw%4sBaULn3KK{5~Y<U1Jhekbt0dE{m{Qu&(%3kXd$^3?nrg;a7UP<$pH
z4wy#vw;y491DJ?Oe2n?*T>hi5T?Nn&{U|cyJAPW7N4cK)R$$9blpT03Bn5UQ2RX7h
zBM*LEAzrLDym{#{sP4j`RAs)GJ0e<w4rh-i+e@MZtpdM>)hm)Tu7)vo2d))(RwXp<
z52Yrn0;=ivP<_Q<Z^w#vOU?eE=?aFoERD9jPzfS9GZflg2(8Az8|flxy09!JE|MaO
zn6+xIoIpu+--P{h0<~3+b4$-}IWTL+#&f$CZ@!K?{m}IH%%RM<O#6va{2!R^h)ApD
zO6E;f9V>)kL4C?oD#uy1%J2q~D8RMP=SWn|>xV;+xNUU4)=Y*{+-OLkCkFIC#Q44x
z6?aUXMln6={jDkhtzy;J7m)M1VY0WA)XUSfJDSGHdI!!m{KlE#6&B~`fhQ=t5q3#q
z@$7+rFc*C~a`yi5qVB9=jxPS%bN1}yHA4i^_F5@BSnoGNVNW)>0LxrtgWjPaPQ~Xg
z5jHNjWTYjYg2w7024Ynmm;?!Gj2fht8?UX=6%L6Tj#9?7&}qcN)}@&CpcBYlcu8A$
zcSR$$mR#$d;VI6=IOMj=0h_Zz+!yILeW!%1F&t?UE(pG@f4iy5d9XK~T+tmb@xckp
zw^4HVUPyVgec}m<4e|%NoKpEdCe9Z*!K}=+(Z^?=!#!FJzcmNbMAAhb2SuZ$eUNM7
zFlx(?cYh)}*0WYk_Ju%a<P6`<9cp?=+)sJp*<4s1znlBX+l^aPZC$*{khUH-)aaWO
z-@MGRK5a85l9<s<{B*GHc+&Uakbm^NpOrT%)9s1_q}SV|zzp*_z3VLAreo!lX6|Nw
z8oW&zl*ys?JuqU8p=dp2&_-N48hCYX%!vyq8MBOcgKOZQk=u5Pz5#tJuXb7SDoP~9
zAE_$<*=M|D-MGmjNPqBfY;QrH1Rdo$$<Ia;&H?!LJz@xoU^8LLmJ>8f;$O|5t88`7
zsVb_=>YpQJKmb5jY=G*V89wrA`CM;h|B_QLx@bLUky5GX4R&elD7Uf4Ltqk)B#Y-n
z+N^)oS`}E*Z4O098LoB^W@fIk>=@U`2I@obaC(xM4CxOiIP|tx1rkexiQ?mk!aQhk
z-dJ1DC@YE`j~+xw!>7A@ac#*Zwy459Q;=qx(p48?8&@50c*Qfj=nbhA@9R4;9WC*D
zs5;_zlId=Uhrk8t5Iz0)pvk4P@HV9Cr>9RR?woRaB-^$NQDC+^UuG5+uxu`GFN`jX
z3OWu;m{W1)GYpjZOyyM=Je!M@mF^=PLHQNl9OIdbwJ~_2m268aq6k*yI96j`yg?v@
zO*;;hMUF8%RC|Vld0?lU`GIp$13UK5I<NO!Ape$q{J!aMR0Ba$#!J8xqxix>(`UoO
zWhJ&S=Kk{W$PB4ZwtyzT9LHRiZqpt0YOrkLHr<+ev?sf??UooG$?k1J4c7-Y{z*5V
z^=4T3VAG$*`*4Nr1i4Kk#}Lu%Rc^(xrO;WJ$+t-b$-z`le)vC!osddx;I(Ys*Ru{D
zx*LpE)}Uh@Zq<65cc{(`+`XaFZ_=A#bvD;rF_0A%`_5;EKgsDa!?>(5)fWCBOL8Xd
zU<D=>I7Yhxef*Oh<!w$lOE@{kZ;KZPVKFrr|8$QOq#?SnO>MdlDs{%l(mdK<mN+7N
zn5I0fVh@qwG&Ta)s@7As&(Oze>{8E*dIZ2wtzC%knGV6iu*GMru!V4Y7;4M4t#h_y
zHB#@`=~}>eK2hu}4gR01<B=}XxdN9Wt~rq;5W=Tv6^D5>epaZ%jH8tFnR?n_<91OP
zsJGElx?_WV@bY?FLn$L_EUqb;XhnH@jN<&1wh?YS>kz9pH1+7luWB!{9b-s~8xIpi
z4AvREjrQxrl!hEr{u8IR1r=v%Vevso`Q<<b4<Y{8j})ebcQF*`U0xk@hA+=ptck7j
zv}gD-q8HgWr4bJzpTb%+YSOy~7dI64Zy^spc5q)qzL%f$rTTllVV61s<e{C-oaA^w
zaA_SHbA^6tZq*k&LDU>x@MjGucPnF##F2XMv{GFgP9c2DJw__Xb^<2+`32l_cw4ym
zYhL7;C-9+c2q=RbDg<!W9PhBe@GIdtg#UUUrb(+uKdscuLY$5eM_!pZy3GpHB*&{9
zudU)Ic?WndU=R-d9E4-{UnNcM8frz9eEx07*`%Ob+#P|M1M#T>Y2h)bl<So{PI@;L
z<1u`l4b$_x-uuo&beEdWZb8-L#nUuAVAS=f!Km&SQ)w(Nms1u2&bwdIjv6lIIf@NL
z{5R4MpxQKZ0;^6-PapN1|9v1PXZ#lH8$fTJNx~m>5J-#j_J%kyXquGcFy^|YeHwMb
zd1G~6^cgS0$m($MjM(8HvnikPYJ$szGO&m`xzi46%Pk@a)hr(YQ{dFDX+#phX7o?u
zo?2?Tb=Pz6%)VxkFCiYzZ6?3gCRpkPwvq$=v%vCY@i6hc$>zegIv4(jc#+TKYJb18
zS^&Yi<GS2yS_?)tAZa=1hj|m5>6;pCC)_$+0#l>fVoXZPq6}VIb|HtHh5huhJ}GxD
z05X8sxYX{QEj}Aie=+fqp=?wAMoe!u`8ClrW?|9+b?db)s=m{y5Hm&^Oj#Cvtf|T;
z=niVA&M#|G`l@>>AHmD%5k*ME9h+wj?ZqbeE71~Z2y{G5!VeQ(Vmc(}aI@wYH~!a?
zP$S9*&h^%GSA2J{$CYmnJU>GCs8X99c35rdZBZcHY3%$cIvO_)krls@MoYxndT|U1
z@3r_0W`xRn{T-BMV~?D!hmtr7{M_Dl3AL@1i=j&z1j%f~u`z&2k%s^Nj1#@dCq*Ah
z+KNBwb)eKnLupgo_3z#i)hpSrav5Q8kX)z17tt2s&U8R$*k=FUO_?nS<!i6HTLe%u
z<S(DbZDhp<rk~oEIHr4uJakjB?RjD~!=^$)aPJ30;e1Np>OFl96b6AUnL|-tNYqIu
zJlJqt(`}ZOhBnBC5A)U?S8H(1jovIDf|`E~L4S-5@}cRX))YIIZB+pJ<^>j~CVB9n
z;gs2I;wL*syTX!f6!6VO3#d++UE)zXt;8V{!q+9+J!EA{?Ll3*m~gFJru~8dipC%`
zFsTjFJ+nux$50x-co_4{W`as%k0?wI<B0fzZd`OXK)1hJ!XI!*J?dsurmehaI0=y8
zy|dXTWx|p3FCrghLO>~vzZknU#efDmT<(d+vXLrEc+Rg-^!Cu#1{YJ{U?khDgzp1P
zXb^yw!T*1|X3pN26>i4+E`zQCh&2{erA58lk_;T+W*6HM>YOFKZ#m=$+O`61LcbO!
zE%H$dKrJhjUd<lpDJau9LY!(^V!sz9zVXDApDAl25I0J_%#!P%LqR=Xae0ko;VR?;
z(9jbp;`$(k0%iZq8Af0*VKbGD0DtfS^0~EGdLfs5e@Y-m-_PR|jE8Y}^JO4;Q2O>0
zMyo;8Uoha5flzBj96;UR%Lnl`u(!*2szdJ7{9$NS)p-fmF9NBXDr<vGs~8#~$QKvz
zeT%SO#$RrE3?5yd3edD$&G12~z^C`K{HCbx_H(BMA$x8j#+7C2?Oq5B9wa_Yv5aW~
zj}f1yFioHLV|`5F&4*c%j4nqp@m<b)N#dM2OHcg1Z_i1X(m1^iZQR|ro_O^sO}h{`
zOT?OXhYI)aOBu2<w7%c!1xGfa{p1Nh3C40iWCv&)sM`vw`nw%Fp<3~~@pUaF<1!z6
zkGg9jFM_DAsF&{juxsXLSp(%Q<SMsPAl-nS)-|L(>wb{vW9y+^TVFs|bZq6DGlNF`
z-KJexruXxcKGH&GX0CFT%3w^KBxYdXD57;Na;3wcH)74aDnl2wDf|aH_)Mza^c(_A
z!mah^1Y{jJ7G<h$%`z<=uXHy0FxMPpQzHkuk3pDw%(ImLL2CcK0<e4%FqFLh-*!pv
z%v#%;XsdH$;@fQ&pY@Q{Nz*4Cx^*?c>=HT~#CzvdRFyn|h^v)AAT)YlD!p(PcPyTH
z!f{Mcg?2lO`~aOkVgav@wJB<-dg#f~Cw?jvZN^>Wl-&hgg#C`pM4q*HJth|Ycmu&J
zIXtKPPkW!7`tI#5K1H!VyE+>;{FaecUAk(6LEz)*r&V4U*&0^Ugl*SZs3s?!FjaB_
z%1jq-0j4_&9NaFR`KG+2&5*I0r$*DTmJW+$YXu;eFTpz2Tr1Wuq+QPubuzIW>lwa}
z0}FY}2F3Js%tMaZIV|!+VnGkF{b1eMWbIi>_aekX+s*jENo^bFn>62e68G7=w{X=b
zrRrwZEjt75WeWQ(frE`K*wzRYRxOcP%y3v?3h_84sX|CYNa>T9Z9Unh{wPUF>kK@J
zQ!*w{|01H)vZ_GRXrpP{cgBrjk4l{M^fwIsxPEBmctgp={^n5A`geK;Byo2W@seqm
zhKH~jFa9PvBHVkVJsi-2(e`jqCXhe+gG4dYAzqq*XzXwF+i&N~IOI{IU%al6b~sTq
zP?R6&FgRnVu?Q~RxS@{mBeiNdN4fZvw#y;o59n;Jc2H^JU|mK`wcVP`d0h+s<Pz>i
zSiQgx2grQ|(Xb4Pj%wGEWAsPWX{<puK9FTO7LTY&*oeZXkRq@V21|4Grq;rRP2mo#
zsr;|3Z}fDjv(vPf!=NmU9op7Y<{u6tiq~M8Pl!s}Boi|XQhVCFx4(=!SwTOB0<^q`
zIL0fl<Ch;ecXY&jHfWwv3^h7l)7r0bpa(6UQ^hY%GtZZ{UGE@kzBRb*z*)(u42PG*
zC>COO6pi1X9^Aanihsk#5e9g(0e}{=VBC?o88w*8jhl#k*#LokY42#149ZivAF<V*
zZ8t)x&O}45x3k|fB8ks6Pa>JDD69<)O%W00K^E^v^n6M~=l{4Pg;2AWiLs-3emy>q
zlOGe#^*XZAmrPlBUl2K*{jKCR&(`9n@S&HGVnROIF?Bc0)#P)0BR5daQ>#~-Jgr*p
zmjyWLa3pX41gM7G<X$tX+f}@tJh-ZYR;Zuk+N`VfF4YnfLu8!B#KgqK(gS}cls(D*
zJ@bqM*GBkk@ON_%&}V&;>cDwVH}*dW0}0n~6k~_);c|!5Fe44DpI<`Mc$E#Xhrl;c
zX5L91-bsVc9UkWRJOpnL9#M=RQqXE{-sR_)z35tAUNf2DKG=M1LIqIkICmfG+=3YQ
z10a7rb!Bq#Y@)YM2cPdiOs%yG$(T2F3t&4P&TeC!!6ogGx1KEJt*1M%N0YvXFb;+A
zL9D2?($C+~u|FbHGuC+`qaN+;&}n7>5VO|0xP~C|mBo&c8x%{P<QV(;UrP=$$3(*q
zLf7Wy#@ZP<g{M3GdDzEItN7AW+R2=szG0D+H8}jL*<>f7qS|D}5ZJ4Xq(@ozoEYoK
zsulf(QlG$zli|!`S_a5)U~DlU9|*`XBeqM%cM;_groua=-^^LWUFe^+sJ(x}KMU5O
z!HVR6Dy*g2mqS4O0nx6Y&+xxKcUkF<t&W9Bu3W*cp8TDsCEwvtKJ>1ry`@N$Jdi9#
z24vxX?K|bvI12GW;F|ZM3OjnbOD4rWr*dmgiLM(_K;+x+QLR?2Ybeyim65o6OP;ZU
z+X{%*lxLo;g*Am$qT6*B416p-s_zHas_E&ME?hJ__7Byo)vCuDNSCWGnrM6XwfV5p
z(}GvpNyj%MS2Q&q2BOkgP=0KMS0V{96y)fi<Iz5f_Rk@L<nRO%R?m+2AfbedDE+2V
z=M?TXSuK*zvjZn#AQCAB&v7A|Wx`rDF!kB6S>lXOT4}>3K|zJ;&jsxx>u2jtHln$i
zJf!SXt%uV4_vpR9vZ(uBe_tbG^J;sqUuZz%$_giWL}i8{#!0)m@Bd!4v1|EJwUL*0
zVqn*XBIUK87<m}2wU&X}j}a_=bID^%JMnVN;T%jPu>RdY{7x~ne_l=1=QV^%KW;Yl
z%l)fKO`7MhS4>$bWPV>^-ezEavNzmsui5f6>=I_5tktEZKNWf+p6OFl@)QBmF-)t2
z$c)UIkOw8<a@@*$XJ}<lrc=(sw<JP91RFw+F{5FejPi=^XYw*pks<DZWQP3&a|@j5
zv41m)zTr)V%wb9P`-7FGqBGblt13bgz`_UGO?ASPx7(CK`7I67Y~{FtX^Gi#7D^4e
z7g+MNZk_+{IGz=*mF^A>JDh;VaH*Rdo7>lwJb{YSpvC454<FGXbz)1+a88@|*~y|l
zd<9?`&d8`hStZnf6W-JuaLCTjKO&bAj_qv2$HY0#|GpOHkjjI_p3E4n>l#~06Sl40
z(Sx7;n1LNs5U#=ynv)8$fJcWJ^9U}YkKQY6wBlXx3uHo84)4@||Gybll<oiVz1aDr
zJ?@#UEcb1~D5~Qo%%;+VkJQJ1-i%B@OTo>=sva4>Geew}an&0pM(NqzNRs!TIWzuI
zTnj+Rt{P)fayyE*PP_yYLEMJ~xD_K|86BNH<2O4Ie^*26AY9AQ(h8hWb56WOPhaDu
z_-9#o;HDwr)zuPK<{>KfGTbmfe1^63XlxcHcdRULs`EuhI5BQHJ@b{ch~)_vs36i#
zKwp<9#kF#2yaLu?c_sl9<c)52vVo>TE*C<gXJdu2ekRSY)EF}=elT-j%3X4(F3<HT
zZ3uS!?e{YDuXAl|ijUinH`5oyg}3Ghp+1<L0rjwVg|e-N=(|LaFf0k3m{(J22e{Kl
zibfWGIV;Sw)g`jz!D`_0gX~+PrMMC-(%KHN6UT~No<48`P~mJxU-PdJf?6f0ks^#?
z-cCMK+$H{?O4-h59intzqJWmsCE>q7lK3{);g#9r$@{E?I;uY)FhsA<uEBe^wk!il
z0{pctATXv+rr-KR;J&b+!0?~f@jfLIZ^7uR&8$rN@KTQUR7~!$SleGqW=-K)QzTRO
z#0UL3l@u$Ee7%I|;$US!EmWw8D?;Fok(uWlDM&{vY!3T5@qT{U?VPp|y;;DBsI>Js
zCONSFKKgOoC$!i~a7Q!|DIQDgZkCfdT+(KF*f5<58=9Ss>-gI|F@p<uEv6%U#iGVK
zEhJh5r_d`VTqC3zv+2xCp^&17i>rZl$M+iu2IW;IY5cT-cklim#l#dBkVWgqyO;f|
zU&WcX2jO$3Wcwz=u|PQTy+a=1oD;$mXUYoK<Ye=Y<%XMr*XoFb?PlXSKRS+}S!o0U
zIIal#+_>dbJvBd<NvGOzEA#%X=S=m%RAY*9jNsIBuFTva@4%k+yl~HYMaqw^6$dRp
z0VW_I4dXkKN2gN0u-`w!O~07o1~UbUJj`TDW2U^7vF^%s^;x9f3xI`?)rKnZ=ZbF7
z#%vBPBxlmK9JDudc2Io}8uE@4?|{;|C1!;F3+{3kRJfcnV2^h1YaQlY5G?o=z=W`B
zN)+}zZ3>E}5*tm&%{RcW5%4B(t~PWQ;Gx17Tnq)pQ#@A_F8QKN;=}Q*N>Vc0n9^06
zOZNsvd>6Y9vkk9TOXkud6Z+?=6o;<FUMNUrA3c*97jL>Vv+ymE-fei#GFRB=`(g|j
zH^Y*+<zdC)au|g=Q!pY7C@LaGaG_c7Hj)E>8=1ApZv<U5U3WS;s@;EPRlr|*!rpQ4
zK_b?aV7E}5|JH9u0I{SBtRB>;UWYh^@HZb1e{8iBxGW%Utl;?=ho!`wUkRJ(w`1b|
z0z0_ZO@`}-kJjD16a-(@Y1{Z#W@LpPH$LqukI&nZEt%AJd|iPg=4I5Rm0zH}<G}sG
zqzADRZYk&wV7-seVZfD&KOsf#vRi2PK#O?4Z%+*DbCycd@vWp`>exCMo8~+2Li`dh
zns7txXnEt__noJzhB`XODq_Dfv>rpdIc-P=nlZCFfbLCNkaxMVy~~YoLSC1CfGl&Y
zf(>F31Fwm6p^7dTyQ??X$$j9Fc4$tv`~jy|O{H_U(VZJexhVLvl(yC+zC5Gp7MQ<H
zirL{iv=CE}@jXuCG?BYoCJq^#e499%zL=TQmOkVpM`U|jPmdnWnlI1EVNYHnzNir<
zB7;Col6|-rng`b7#Z2=cxXZ0jO_1^~kRyw&$GEG^%nE>y->&c<(6gVIp8$(GoJiU)
zCvBSyMLTdQ)UtcIj4O*AhwXX#YLog0&Rtj2ob~t3x?aMD5B>A%(oNao+t>5W4A&NK
zE09$mydrEOy*pYGw35<%aE2f2oyf+2Vp`_b@r484Y?x10-6!S=$|%T<;<*jQ6M?y8
znmsxaq>r+JvJZj#i&N7wxWD;l8??Iw`)7N07_t)i^}aN&LtY&S<iP&#ivU&lH#^Wl
z>cqj4w`knGZv|I_zlJ}f(lP-I9{UXQJN;`uHMDVj?jQX9(1Z}NN<|;!u(;}IIKaV)
z3`g_vjCGirz<E>6l(E|pe>RZ0^yJ1G;N|9yoNL7TLOS;vKZ9rhcoLLiDsN1PQ<9<M
z?T68)3|ejK#NXPB0V4T$+Ck7cE|j3aT+lr*DkuC*EqDGAXma&Ptu)vBCBY7cC`jg)
zB9CbffXXv7NBYD9<0pvWX>8HZmU9L>sN32ekEb`g8`?;r2JV0D1$<vsQ`jy~axP5`
zOFZmRqMo=H!E8JNtga!J`%QtnhJiAg7>+^qC^I6jXbUnR;0Q1zT#~#P2JiS0F+wVB
znN1~2o9nMXrXwL^4tHriepdpMs?Sm=F?QZn8xG`Fx=I$PiUV%50m<~;63=jU!c_Yg
zuPb~GH=dAOuJ{r^#9xQzv}+t8<RQ;NXLBn8daXG55i>XnZ4;Eu?sP)Fy@b@0UtXSk
zQDS{IQY<prn>EKu*bn7SZHFZZ#ySP^rf6i_$eLM;O0XcO(w4sFAw^G&Y#>|M9X9%n
z$XD83pncA8F3AO9^cbiG{3Sl}>7L%&8n$#7s|HsZi6cE`$NY`%{ycU(_R+*L;&zd_
zF4BA~N7&ao5g6G`sWUCM6VH(kiwukS0u@@qZO#=SYB9xZG)16==VIg(OZg|o8l10B
zc>Z8PoO7nUXZ*b$!u2}<<Nc{B?~qie3@X=&Lrp*m5)I+>yI@w}q&q_GX`Gk6;UJ>M
zl{_;HN-yl9-3hX{E3f%p!R3zni{4Rb0WNcAh`JTZ4;3*6_+4BxxOn>Hksqy8dGh1d
z`^}jvihSXlf@1oEw0xyJE!UN&<qwcsYSLSaG1<s!3<htKSkYkc(zc7WfHzNk!=1)2
za0-WU))7C(3nREH^u?nDt1Mgp=SREpY%vAIbI6x@#M4elmcMWba^NsJ8-ozxtXYm_
Vn)?h*=76u?_aEJtyZ8K!{|8MN@UH*>

literal 0
HcmV?d00001

diff --git a/assets/img/rancher/backup_restore/backup/encryption.png b/assets/img/rancher/backup_restore/backup/encryption.png
new file mode 100644
index 0000000000000000000000000000000000000000..f11f5a179bfbea25433758f5561812255905bd24
GIT binary patch
literal 85790
zcma%i2Q=JY*RB#FA%;lQ#3&KHw_q40AtFi$q6a|)qjv@oC2B;A=tOVP>nPEC@1yt5
zFqkp8Bmeh)-}~P0-nFj1erwJA=Jd1AK6~%y@l{Pl;oe=^yEr&F_Y_|~SI5D*RgQy$
z>qc}N`=%tez6=M4gvwG*PEAoxjzP`A*4)zC3<u}s*H~@Bw;GC6Dcb5pifn#rzrM`h
ziZc8)`7)MNME3qmHvU_mLttDSH7=!Txtn)`ZMc28IG9|hTIQ*UIeO~e{Z2=y-rcP8
z5xbVOn7^1$_B`-9YfKOm#L2C-Yg^WT``8!sCjAKy*SFa3KRcKtZxf~A(+=SpK7#l?
zV-OL!FHPfdZ7^>TG@({J)oXHDe%%yuJJP6`0OxDKGk@*oe*beaoEj-@F7{i#L%2wD
z4dQkI45bP8ohL*%QCzJ$cdZ#(Y3}Z_RVxM)e||=dBM{pf^#NBpzTM)Xefj%Gb<`#b
z<f?3+-8kDC^>Kp;?Wx+Bj}h6@h4KMY;w$yfbbLY+_#Z{LcGGr*=&#C>Qc?yxij7_m
zI$&(Odt*t%jqlQFGTe!bUL)DjiWX#%4P<ovr4vK`7{Bysn?(Sq7Dlo_`LdNF_7n#H
z%<xXI`4$cVNX70}+wV9wji1rfX>BTxzQU<yGKc@jx_rKG@iM!OeI@fn27L3SSyDTm
zlqZokf>?Gr$XXyE-8y*bwH)9f@%`@)LBmx{#_B?CPQem)9hRA68qY!rWQOHL?pr2>
zm5a663bLfz-=%vkTJoNax6iLPDl&_>)F+*RQGY2k>yTKTDd^eZc?;uRQtC+FS8p9!
z7kBT5X`thR9Zh3T-?4y2xm4a*So_Gl!F)SdlYQ3mz`2>;+_9sB<J|P1Eui$yUC1+1
zCK)oK+guC*-1x6?r=_RnXNQQJ9!RG9;y+;^KJ<gB3$8|S9gw$JfY@&P$hHv@v_kz5
zhEi;w(Y&p??W6P`dOSl{>BScBw7J(v?T31<L>+Dc5-IlmJV{ZdV}bH4fn@$)m)g`a
z`uPAnACid^ZxLOG^WZh2_#|kkhSf+HmdR7d#P0y^OcEJ<(POv+ic@%_t4ui%k7-UK
z$dINAqs;H)!SC3mDQn?ow9*EVo%vxHU6a1<;CsRe%<ubNw7~V#Pdx)ij3Eo3P%CZ%
z6AK%eW1}`(#jhx7T78~=oZ9YWlUW!KCR`u~>zag?`cKj9-f|(e>Y&9TmWU8Gp(@Q3
z0D&mzdoBJ9eYAIgi19_(b#;^uly)8+gXK5aXkM;f(>*}sJnW%-KJ?(o=_{X-TGw4)
z34zphO8dw1Wl4{c7x&p_7aq=b(q(%s$p6@A+Cu2z9C8Kp6xxbM(BLSf;556PDO;S<
z@{~Npd9=6qisi-K$2^{7I0U&ZvFU_izBIoB#l&z$7w=(Yh^UE8r14%7M86*=U;vb*
z+%^B~o^~t7@8NsyDWWRhy|mlAxP;R9A8)fZTiW3|`C2WKCeh6;5^UlhG~;|`c=9EX
zk4&<Sx>S0XjI|B_=!NXJmrqC)UyMX?J^%7DDxnMS7l}@Q_46vm%C3?w^3_`oq+8D+
zjDT<StHOvo?P?tP0kj!$n`~qF_oSJJZaFdi3|P->-;{NtsiQBFb<IR>-Z{bZxVI;3
zly*to{FeWz`R8d<`gdfM{#nKeKW-(4$C|9Ydsszf_4yiocOn330<>ouXx6EbOiEpH
zV;X2bKAJvP_hL5mpIosye~7`I5AtCdBD#G`;xm<>@=L}K<k|OM5v_em{?htI!*0)s
zVxIi#^QXfho1~NG9Q=vT{A*%r5^5r+WOtuPF`Y)gd?NY%ad*%Ix#e$n6<L1W`!)A#
z<yY@7$OvH>$Mlcg=cFt-Q7=|es}2Yr1V6$Ip@HxXsS61RiGLM#SJkYp$07DHhcZX}
z+d9qLY_tzJLjWv(-<1;-bX2F6#9q`Yxo76*f6Cv^6Iap971wr#Z9~V)^8s(c>cV+d
zV+`B3@?+}4bd_z==QA49hd;&%`RLLXeX9!7Qj$=tSG|z77<#;EEgmTqWGGXTW0c+W
zR^v^%8nIg9FRenYVi&c&@46**A$3_E-^3NXt2_eG<Vd>hOInifVOoA#cUmQ37t5qk
zw`|3ciZPPmRZE^Rc(J?sF*&~J5B|^8`W<*3q#f+?)s$~~UxgOM7HMWzDijzLsOo9V
zzK~G#{OJ;K`eu*kX-CC}vV_{cwLbj5ojz6ZKyh4guVfZ+PiLN;hRMh2J0-o7+~adO
zp2}y@^h&(Xc@=E44E^UNz4aHge3Gu-UcS22K*N|T<lQ0{BiJ6>zi+d_A8Vdq7<eDp
z;^H5A`!Y~I&^XYf^<E(BJ<sqT@>lZH@>XFHG)QW}Fz@hy4y&+8I<SRhIo`Y4LS&(c
zR_a$j#hR~U9}*SoyM6OwEi<;fM!mDo`q<3r%@fS6`gHrzec}C?eHK3_6Beq}N)LaN
zy(=t#W_mO~(jzeK5M}1SCdg^PS*2O3nLKV_^|Lb7xzRZmsY#a+9;6)6Z=Oi1H#RY@
z^<K}|vzxTiv7BPYrfTPrBK4M-x=`7t)q9@#-oD;Z-pQBvgxPYxTD^j92gPUhDP)D~
zif#AhmP8as)J8}=ItZJ1B<XU38CK3Tl9(2^Pv%G}79UNLOWt@UD&FK!>bO+@whr!O
zRwG}_<6z@_xxBvr)P8nnVg<6FvftQ!85k6&P}r#+S)OuhP<l`-r9TA-gE!oTk-A;3
z*&HOVz<MvHsSEfq{1P1?1V3`=-1>M6VTQ`SfFSn}f=4UonkdN=(c=x&!HEy;dx~$5
ze@iTyrJ1HZIka26U?@q`k>PH6XZOy|(#|v3{G~}($G400>~x)U=X7u5Vq?KSx_|C0
zkuPz!+Wx*bt?$BJZ(DdVrDHnFluLd@PRC3yKO_H&DKTRxxAaXx=Dxh%^Uw@B6KN6&
zbLT$TyMigq)ItY&XM02e_1P1M6TGiR@F?uO`>1|-f#udyF4daokI8Jx*2?NiKfk?A
zJdqN6=C0|W-IE)m!%n4+)CkB6xBOM{t0LL*az(DA<ne-Ji?eL^mmP|trz(kVkndN&
z;ED>Y1<LEMrGBWqR8?7sy-J{H&09XP_$?@6c4F^evs1(CcGV!<K;H=Pd3bG^t-7Ay
zXQ3mdQ&8@43;NkXriAZh&6{%$36Q7K=|$3yr0t{@_$u7neYN4FftgA9O+>Cu$Z(9M
zhIqTn@_l>lM(wK^jFjS+4;HxUe5GlnYQ*%;Jg<tfz>2^JC`!!--amc{As2<hEi){s
za%NSG1THP@KOXT49@4;RiUgI-2NF^5wVDfU%A=-f%JnvW^y@s!@q|plf4axGiycE#
z51#pqW2%Y2Qwebk=|6K_%1r$O&F4&yfB6c+g)poz<8ORdQ{(;h`1?Jj#yG^Q!FaK_
z*m!Tl9s`f7jbU)fwY#0pdfDk3q?c2hOgmUh-)O74%sjRue_1n9OQERPs8v^^Zhdd2
z+iEbjKE_r@L5I~~vQo;yd*$}=Jx&p?dA2FHBBtLa3s3!(l|*0*eY0M*BTWtml&#!m
zdQvtIA+TC*Yd!B+GfkAs@@dANs>_qTXUCzPyp<A2*SI~5I(Pnl{?`J_0_T#VIkVqZ
z?vHg@i*}|Zja@ra7A3<y_s$@*op9|c;BNfB&y^LrWD@ZF(MQQmd%FY1P`N}>LDKjM
zX5{G31?{bS2H|<($qF6xmNp28I3}^xcD(;-|3ih!NFK1fSk>Xw;?eTTCHHdNJcSM`
zeWeNn<|weXI$mXOvzNo9k}Uby1HGEyE7&=RPO_2OaNh57k37Cd1?L$va)P;?yG||u
zs_QE!jU1ZBrk19M$HcOar_7pqS&MHOiFwC*BmY!xS|v|Xlq@vxFUe0T&-YtYJJ`bN
z44ga{2jKNz>a)(q4q_KXYmAUV{lJSlcwK}P5!CL;7}F{dSrcgp;&H>&dM;7SL?d!K
zRIO6QB(3)E>}|P8UAdnTABFnOe+LU+!B0leYw1mx>$<7<k;%(fh);*e5m67@{Dry(
zo4v@rrfZ&qx#o)zfCuoCl!q7Sm>o4b>X(<Qm^$fGiW)f)Uf!8&X=st*SNIbJB;cDG
z>U)i2sEseJ6ktK<7MVHp@Qk;XAw(kck>B-~hps}kHMnYf0O@6Y9Hu3jtotIw!Fh+=
z5>VE2{IO~G8ul!P(P>5U(7U$$UjY98wj{U=!nlVo1fD(n?QVD2OZxJZ5{DZV;+gt7
z_%N(#TqaPw&ge66&B*$R4fI&abO;+Sj9b2a=k!kbwYaIR4Uh2$TN5)LHyb-_2!VqG
zaudgXv@vrsW^l8yhB%75NizK{A&&ig^O~25;cpQqD@mqz%4!U9whm?t!aPDed`wbz
z85kHq4j;_L)t}4%t2*|ZB-2MHCp&RoURPIF9#=sgTL%kXelamIUOoX{0Re7o32sMs
zh?B7!H^h<opGN+7JI~D=O&u)loGfi23^(l>o7g%#Nis3rbo5_;|BTbg()_=Bf;j$b
zTG$El-u%ML&%?+2Uu|Qnf^Oc5%h}r4IhZ**V%wME2mLMiAMgIVpMT1$I#`-vM|v}!
z|0@6Q@BYv7Y9DQ#Y_Y56U}>rdaWZqjcJ{B@0{`mm|6Sr=ZGm`iCjM^=@y{y%eT!XY
zsk<QF|JpLCyLeN+1UNX-IEv3@-n!xL8W1KKzNk$7pya^{`}R#uR%!Dwt|bRs8Usg~
zx|eV8T+RXe-H=xr`R@q{Bvi@NJct<#Jct!v9>6SIqg}5o_G?}DFZZjbtxsn!8|SW9
z<C72OEiJAb2NG&GQW9n@<qTS%-YM3|Q5jI=0zW}aQd%4wi-%JjG0>;OzX7`dt3e;=
z(?M_JKz8$kMu4bD&d^9P!$-UWtw}**slql=%qq&QUyon84{#=nSbrqzsp1Qs>lM}t
z*=h^IywT5P1I7S)2-h;H@ob8KJ+Z}A9RYh9wi>onqofEX{qMnmBlbWXRA$4P|4LjW
z4yvjFB|@7zAdYK%`#W7?#yfU}K&CU}7MsFHqhA3ie}vp+REc&TFb~+P16GHySG(`X
zY;$iHIZWuSsv=lX<*32ONoQgQ+K2|;6dmMYk%m+twOe3^@NJQU#=+Rtl}ZI)w<sev
z-rqhN^u9PqT%-)kHa>zIRdpXF^3x^PwHC7B7|H{#AzcwK+}cqaxJWwV^qi*}<Z8+h
zFa0=M+5T1bw<vJlKXfZFh@GVVsgxl<EqxnnI3bGpKOO~3l>f2#2KOP|r1zLaQJ$->
zOP%C$YKQ;%uOkMZUq@5oSBnjU?m*1j+GFVPK%cA+O)w5Q1Kx9AA~IYi>0AH#MVga&
zs6nv&<lbF2WE{wrd|mj60lc~|mfdiR(&we(`EB3HHh;{w268J;_eD^Ld)V>2*<QvC
zf&t<+A>MDmSy8aV{6>RO_p#Jq-~B5jZkYbGr@SJ#6X3#x5F|?jX#mxL*0oY;a5V^<
zs2-2#a7C|s(9TCGg-t~0&d@8}pug3pkD=RrT(<7juyV>-Iu66xlo=tFwjj6juf7=E
zM{Ix?!XA7|`Pe)FM=WIfF;<d$#wB8mdU)5W_g3SNp=QOCxuVLph(0dQ^o}3@w|V|u
zfwW!n#RQ#F);k>>CtOQ6Gkubxb<_4*I&&93D#>e}{2bmiyw)J^p3|T)&q$C05YGoW
zjX_;c>}`23&n(PkqT6xt?h!|})t+%PkA799U-$+F;r-Ra)(Sr(He<t5iI_-43?M?u
zJ%V^G@R)-v%}ZUXwwTYR%Q;}vf0xFl-vg3km~NP74O<@U3*j1>m$mS;U>Se`kV^!?
zTg{Bk__v!6f1YO@F-Td0x`6-ry!r!7I;$=2E;MCxEn;wO5ifh<(2qvJ|7?gzMu#9`
zCoJ+8#10(iOLpDC&jgjkzn5+P+^e7R&i1?&tSW^aY!^`47a@ZpS~&k<`1=RuO$w&P
zo_)|h9qx9kD|J<MfHV8vUDKOWC5Dh`WLyvmvVDzT`S|*lg}E7bIfDvOt9F8VoV90b
ztJAXFRhpL?SPd)-cyj!CN#^oh0y=6%D`7>x_ShpBqja@a7q%lX8Z`X_&1eKBi}%tG
z^9fdUUy1fHkMsC=XNg^v+mIr1$V3Us0R9GiKXT@WkaqtFKuAkH1y&PEWgD(H+`5%J
zcq6arDB}rx?yUVPTYGZdSEwIZSeTVMX<mxt$J!DB#$YK1FwV^``XSWZ(Y_8!wOMej
z6u84&i!;@vfxfGV>lFkdcB3_jA&GwMvJmBTYME@VCjt>Sb;y{dFS}6b-xus?n4=@R
zJ7fDgSB((7sL2X<`^ZPVGVWVb2wAB^A~jMDO;T}F97pcZ_Wi_8g3)7pW+{3q1R+X}
zj18R~hLO2q@QF$FQsZHdkLg83D;0CX^wq&{uu|Co&Cq{S%%NW_UbLXrl&2A4afd|T
z{VZTZm@oPK8#ts1mFcA>bz{*IdCP4(dNsi@oCbl+TbYJgSP}MCWA_-}%(}|B;!wDJ
z(fGtDj@bzEb$%D#J%8SXAqo^x4KX=0K2z`DRgbu_j*KBu2=cAy3d3}08dlhhE~R1P
z=hKXBLFebr0vp1SazBA=Sk>Bf580tF_Uv(=le<|nbVG+=`TOS9*A#??6aa)A7ikQ@
z?=wak%6Dt#0yFdmJw4wUb(uN8-e5LElKlXIkMhI3C;G6KK6Pm=WvCGulS9uA5>#^2
z<#wV>47yVy$%C~W>BO0Ri8@%7!uOK7l)hB!M*De${gtF+>W$J@DV<$SdL2zkXOf1i
ziQFrR0)Gk?`?#C~9;n_54d@g;6o=)+xsgTMMe<{NlZL*WpHide(4c<?i4}wB=h!FT
zy~WlPV^l0xLpnWz^7Zid$Q(h+w<PFPxlSybc)}7==1rAA!Guq5^(a-OiG;!mIh`_A
zE0?9O7{D>*AUpb%zgF$p2K#`<8b~z?tQQCVdxB2fQ!UI}aB%yn|34NZ@@kb3yBsZK
zT|IK87t>x1+4StHl79rt`%IsInAUsBOw3*Km5@?;6);HnkHNXz!S4}UOLCaMT1(oY
z<=q%_y%8n?udB6VA2aX))|Ne7=`s^MY*wSvGgR0l!z$}pj5a#OVI;NTO$KPASJ1w@
zv;C>;vYc10LY_h%0E9Odv?m92cr@Gj%;f_tCMki1jZIF$)_Pg8BH`lq!50*c;r7oh
zOHi;XEdZhLKb}a+b-=)d<=`$g0AZkrirDGt6R!(c`+0tUVa$;h#aT2cUIUHX5JM24
zWXXb2>7Q3+2m11ZY!iUeeQx%Lo~D|(>+sI8p?6~06hMT6eQm}+Djn&NY}6aev#tCu
z$*Exdy7eOTE8ysk<jZhgE}jlx`@U`Qqfs&5YGebKh4~8#Qx|}D>4kkG)7p>Xz?O`f
z`@m%i+RvuYW+#Tb{EgXOTWz!}GG1N4n8@!tgaa4(K`Wxsh@J=sg<8&9c>D3A4ex;q
zKZ{#P0Mgb9L}iD)p?HbjBI<&$ZKr$`_Y0BMTXaVE-^N;xr9}F_YCLqcPTV8B_S0eR
zYW3%iZX^zp4l8=;&`f<b9u5PZDoh_&0!7Txil}14Q~C^|E&vDBJAo*y7ZXExU@YyP
z%jGTI$g*H^l>yg^gF7@lGt_r=n45;9>TB0>U2|P~UL33@B?JVJa8*lb$+|0pZW@Ro
z^z@gxB(r77hW>(Dv!bJprI55p-HP!@k7N&6@}_gKUM&QfB8obu+qm@7XA_NO78SEF
zpHA%lC>tpWaVrW_27T}V+)8yL!=6@?&0iqw(RfF1B6l10!%M%#E6I)4Zm!4KYO_@C
zuaPbL+k<S@4nax+OJq8c_&4;^h@1Oe+Woia{V~EZ!p90gwSD%pSg6bGEnW~s=b*`B
zg~-w-{c5|p5hwQztY6VIve7@Vi9;<$iP;Rd{?{g@uzdsRV>h()t3T#VuIpdVEXe3x
zWdL-sA+?D<!|+BvNx+_?GBIziUa|Vzcv98v9_1`ZkKF{b5Ihb+7qKuBt@kG;XQJ8>
zTjodoow4U+z#b|jF_IH$I^Qrmag2}p?xhpqH9g_ba#{;nsSDq!Iu!?3O+w$;RvW<{
zdzzb_4gJijT7-5uhHjY;BTJWLFe7el#3l&UhAhp8R#D}aUEoz9BItEPOk|g%I5&W0
z6mW_cT2sxlpF}0bdl!!-+6qC13dOuYafmcg)vLl}U~d>bm{0pY*HeAg;o&}YjlO6&
zB_acsAKnKrNMqM@QKk(KYnIf$Vs3U{i)lgqz~iqy>fxO<*2@RviROxO7}&O@=)8xT
zZt@MxZ#dJkF3W(}c%e)<r2kj~hc#Sc+8%x+HS!r&+}5`3v3`xK64tMgnv{%f+~0X5
z(7-RW@=+<M)=*$T*y+1!7wZ_X`*S?@zD&dJcrM}pDY^;(Y>zG?irB#Kw66p8BSqwd
z46w{dq$b5gApf@#hXQaal&*(+EzUtt%t6ULt3ln6y`(?6DN!%NBgiA?^@)m|xz?4o
z=VBoZaGsmQwuNipwXM&2p?+<Taw>l-a(B2joL(|y#Wo}bW4jFGwCnM?i1r~7K-P=C
zbQQW<uW{|O7i}Ln+Bjc%p|3FNx#|;%v({wV1MY;GMtFLTc$Qjdef%xZA)f?`91xrn
zgnG7Fw1>p*FNgZ9LXUSA>a9v(-I9mRnF&Yh=h4@*yw@5{ZyF`ayb=}IH!drzKuA2K
ztilBGst*E;YPu};6g#*;rR=2i7@QsUaq*A;U=ZA2rR3FF7J<NnD?<aRjJ#;d-Fnhq
zB#q#yf`S!lhM2K#M;9PTJMVw2->U+`d{f`jGiMFb)`#`BdL^&EN$tV5_N$vvu$|$|
zoawg?E8_*)wUN-1Th$j|3_|FBy^=P1#a~&D_H;Uk`{Qx48O5hXVYG5)4Ik(LPY_P1
zp7I*;-Ur$)KJ}?ky;`iP8nn-v&zQe|>m&@`fRsY{W1WZ18bphG>M=B6fEasy%?Cya
zjCHk{GkPu*D@9#3Uq;q=9(XtBLxiM``$p%A>-TqA84`p2r|#0hrfZn9nh=Pc{i_S0
z6EPK!0~PehOVs3?ZwGp}sd_$X*U%d&Jei|vd)9dNc)8AH@B1sjJ$fw}O6_{{I)&!L
zt`4kYfaAwyG$o83$uK2GrjdD}l3?M@0g9?82HXQ&i`-$tdU7>y(dloIw3meo%<tVk
zm@bccdEFl@Y{rQpsHrTm`jl_|dR$h@?NGWj?rET~QenX?!@Qnkh!jzk$lTie{CAen
zIe6{y!^T)nty<+)N6^t1fD3ICj1CMXT;?G95?Jp5G#cqVVrq(;h)p=ZZ?vt072JOl
zKg1CJ_}VkFx)ScPclT(8y1XxUjI6y1^k`_7d&pHaY8Z<(HIprK85f4$EBdn_asIC&
z-M-~lcG5RO(aCJ8<?Wq3TVt77u>E%Y32vf<MT%aNv425cu}iB0$tbS-aewuko-J%e
zWD%+yp2%nKD(X@{oLFQ#k0IC(pImSXrQ~+e)YL5YjNFI7r%EBaHN(Y@IRkkJL5n_z
zdk%IU2Zk{HYuw96pwtv7TBq7+OJK6d)75pz@1pi0r}kaR0p#}F=)FxagXTPm3ex!=
z<TObP&o8Nt=OVuJ;qUyq9&V#5ICt!I^4fgY8|I43?&zGF>IG<Lks(a}qH0A&qQ?7l
ze$-|=rYdH@h;PBhdTN!D>m7CaHoPyPyb_Fbc2@VPq!Tl7dp)=-=4g=oKEPIolwL?}
z^FS-6bl7&W{`E&WoW}aSs`6Rrg}uGE4*tT3nNk**v%+UKf;R7D;J$|;bWOP0WBgN*
z1?yHXr2atNw|uGXhwbw+ulAh^I0ax?Mp6+g(*GethDd2IbFEQ{%}dXajRo|H0?-{k
z=RDaomdpQM+UE>>eJorwMr^WzG;*09hg@M$#Z^@u$*%L$`|(W;(?vSvT03{IcPl69
z_oGumV!4wKk{x#@iyWI^C=pRqvTG~T(ZMHv9`Aj}ROgkBa83XIy2_oovqsmvf`S4n
zxd9%BfianV^o|etMrY*Z*@8lt-ryFDQSNqqiTC9neYt)*+lD<TvLI2|NLjh^q9u#!
zt8uaXK%K|S0dh~Z1D|aTplc)u@gtEru-<x;@piSX*Gg}(MG5^U-=Bi6DfNgDtFmeJ
zNrO74D3`{SeDT)zoA5RAz^;>NK~=~4y*j1$KM?1w(k`RnP0qdXp3GYLvbDYnbEu6}
zmcV*L8o3{i0Qj|?*Hc<Muia8blNipnI-hIkKBv*;=biZ?J(-KFRWS7<ou+O%5s3a(
zGq^1hBZunl2{(wZ_o7aou7Pho^&YFg5gnM><QU*a+L8X<iXz$AP@6*zB5qroRaF`x
zLsljASojMgw=Y&*3*xWwmILoO@Bg%dgx%A5)&?TsZ8!v;VTgInNw`Of-JV~rvQAP7
ze@Kr&qi>&`H7yj;n>Lp?YO*5XvNHuGjfU^LJ|9^PO0qKP;Ddf?73n8i@wubcw7C*z
zZLht@zXe>iu5|ygslF5w`LI+VWb7M1kri*aPy0naX7)GK`$y76z0Y-{pK*U4W1oPQ
z_V|ZQr)9>fF#~&4CA%Eu<|e$h{2>MJZ-V{rN<5BAl)T(*z?842p+*=Hkq>4&@5(;p
zT^y%Ec-d0dg9@`?_E#V8Tz$BhzQfz_^lCNo8;~v463XU^>WYXrh?kiA#oKQo0->Y;
zF3Z96G44Uwuy?ZyVSM~tB>TpvljG^R>f>@_eVFQ7_IabkG&BU`n=^vVT&)G(18#4(
zJ8owuLf5jD6Vr9*p&!5d2Wi!q9U33G{i%{ACVcd}<l-<0yqO;m5kO2?TYpeH2|GUh
zkayhoR%|sWXcXP-c5-zFT)z#VVM{Tjga6p8a)z}lSz>QENT#)dmj&WO^_gKAi`tdW
zHSM-&-K3dbW&rH$Cv}co))(BsOveFK;jD3IX<2|>=EVx|dfU+J$gCevZr*XQX_J)9
zl)6e6dNI2|X8NwO{&>LWRZ6_jV0TW^rpvTDtG2dLNs6lM^Vfu%in6k)!|t<1KI2jh
z01~xSR9_CfxU7<Fi}x%4zH2q+O=xCn)Ac2Aj%uy<>(YdR?T)Ih^y8e=qdTJZe;_jp
zKJ$*Lo}1~NLimTiOM{?(*@iIs4wQqmelYP`mYUBS9yY2N;vRzkFtgHYJAP$gL94YM
z&HeF7LstiDE$b=Vl@?z?^ZGZ%Mhnoq3$@pj@0(E*)s0Urq?|S7h)L8tf!8vwdzGS=
zlu4Z|0j6@q12Z0nEeeG-kb5B1D#Z$#5J0m!Ahk0J@lO)e<V;ad$4Mh2(c$~JWL@ky
zC^;KG3k|EXLY>ap+MX@qH(p%_FWm{OP>UK!kPtn6vNK&CM7zi(DTLE9O036wak7`W
zCedrWpOfs8Z(X9lXg-)yaME=CM+pM91n51u_`30Mn@0GPn|0szY>w>!W%HMGQ?g%4
z!;#b$ddkV-+$sa7j>})>4EClg%QO*`{r=^(cDJbpuF5=QTOX0=q&6)&LhAW5S5BBC
z#o>}iZKI{ecF`n_OU=(D>D&C>e(3Y7oKUS{QL7tQ4Djz#VJrC!(f7IKiEVS}oG8KY
z$X5E&?b&t6)t*i1(G!gQdO}WpqxVHmk<eV+#>pr+J+P1umSZjVMVq1_P$+k=H$Ih9
zKHhl;Qw3TTJDtjW5cwN)$S(AO<+c!Y#qTUWp$|GJ$<;-7L37x}{#)eK_DH2j_O-GY
zZ||Qr$)`2j`P(&@LpV-djD+ohTtlYFrUP%ndN5|GM7RB9OAwB=u_uQvO15P9@9*F5
zsB)rHZBu-?-FYcG@5ZU}XWHl)30Mz`Ie*+vTvY9rUi8f%F%e!q*ti&&`t0p1&!ngY
zJQ9d$$CE&=6T-{lJ#{*|a&a@#*=i52fhyZGZgUS^DH5uiz_5GtVm0!)k@It}T&i3u
zai#^017~YkC)SyiJ8&LDm1LeKIv7nmq>2j?-=?4&;^T2ypcLm$jzIssziW47eW68Z
z#PA&a=VTt{v9oj-$ND-|WKXhw4~^W}@i^HvRFi6B+4a#^gEmW3te2lIO$QVO5<TO(
zf}Le|A~SoRb@u+Dr?`xh$OPQ&z^l5wJ`VnP$k5BwQK#%s6+dXP$E+e-rdI8=6REu#
zCm6o4+O5GYL*ioUTwqoOdMT;aIR7zSw=wQV*5n9A=e=d4f6nxKF=?qgTPNRCT3HKI
zw=5gVR^+^bRoQq~BZa_fQXu+OV#JGFRyHb2XqwkQY22Gs?#;udeZ{6-7v}TQ=w~E$
zaU?jT*ar(cD0yzbwQ9ra2EF>ic}IL3Ni==)4399W-dfq2ee##K_tC4wuxP&BM12d?
zMlZ|lOn%d<@W%akh-e<G_rgpYWwUW>;3sb#kiCd@&G=!gwxOfMeg%xygOXe4QR;XA
zFMq@%;f!3|uEh9}J^y0AS?g%=YR;YE2g`Ntfz|X`vs+KrRf#2n`3tD&mlzK;+K6p3
ztshpDcgu?N>FOly&dkU}nCu-wJ-mVmkN8l=uVFIY(%%2+B1lW#I0-$11>IphdY!Zc
zA2>&iKbG=+9Fnf?Z^qru6SNx=k)p3reuKRkUdc)&D|*a)yI(b1pk1<jJ0|H$C;2dV
zrlvHVO={}XN8F&&m0jM&E6Cze#X;jmn;yx%jTqdQi`ZNYwGAud-1TptaN6KsK8kEf
zI9%L2jFiWbajG50{Xd0gDzbu{R%zFnyow&Lsv-pmeX<Exo_md8WUmxgWUgLfpO23K
ztwCO+&#)Qkb0WN|0ruc-;3@z?xYoKpY7L)2Gb%+IR0|ter+Sp%@hEqEwnQmt_u)VZ
z_GkU8UwZo}1!tgjXSCdm;NxlQ3w!sb-)wBaoD1kXaTDV6jC7ipT#}6gTTQX$HPqOd
z1n)%=oo_D|PCKq@v!2PG#LB=^YZS`b$&hY!c=#GB7hTmZ{kri|RGc?+O7~+c@kwhX
zT!7YrrOaSSyyhoaBLR&Z(;OeuOCG%id^E*y$(Sq@oZykUd&A=R!IF8ATRIqxNxYBS
zbwt-~ZUU0wR7XmG=Q%uZ&OCv?S7<bn>>>%-1$K%G4{AV15h^Ive|~Sl;tq{IDm|X`
z*@oQdu$+KZp0$L4EMI;nYKw!`HnnXhLDTbR%Gw$;fZnxXTVy8CUR)}HIzY^U+DmTL
z_+gI1IfGKwwbsD0b)A7}!JHrAuGKVL&$f|Uz6gnqm4>%bw!W#=BayMVUntckkM%=)
zqy6{nMbUTDval!4WbwBX#ncl3lm*G`9qpE)^Ml_sd-<C-biRQguK!-FO?*}R&?p_N
z<(~W6D5}Z}b9{K`qVuGqGxeM-^|>LNkEJ`?*!3QJ^2$C6Hr4RlD;ThvjA?OCm)!C$
z>>0gWI?q1(xNvS~xYD52ef-nIT;_RrRBO$YH^rfPR_6R$vJ1tRlj}38J(N4z-<b<t
z`+o4-|M||MH1{VU)M2*Y3e1xW_Ns3`oc2C5SlK-nXQ-lH<_spf*sXVMXy@Ys+~OMR
z^4m_6c-@KIDS;X5WZ>_5ero(?*sHdnws~ZZB4cHgOy4W(jj+F8r8pt_3y?|p*m>Fh
zbVRA74OJC=+-bM4O*lvC#VaDJ(mry05VZGYZ^k>c{CwIwG(p9y8~hdiQ~%v-)W=jr
zi@i<i%Bx!B%B!oVK8}VP4G=URo$K4np*I&cD}z_srwwT-I!AQbee+}3e9H^etJo9)
z_}EzPTr0K8N`HlI;CGV~maX?jG|jn<<jg_!`*Zb{0{e3g$G~<z4PcHbo<7gK>LBR2
zA&z(luv2kCsdp*jM;cc`I-`BhVjyV`dbzXE-hKu*J*$EJ2C-Eh?v@YMYjSG$nh7!9
zDJuV!q8Oc0#sx9r4{@FtRz?S5DDBuh-${j*tZCpz9^zhl?(#FL{1NF6qW2QYo<zG2
zN}km^ml2TT5-!{F61E2+gPhW|b-Z?UIfuXrUqv%=_|e1kqZC&}N2-Trb<6h;UEP$g
z7=6BA-lL0Py#Q2-*8(}J5!Newv9b0O9gY=lcb*F8d)O=ZO}9f7`X^(`b$Ds(GtUL*
zS9*uKAcK44^D(9GTV!2#ihRC@w*6Sqz%0;9*40y}iW~AeG2r=!)0)^NZ)v|Xyr4l6
z(yIc`7l-#xo96O#)(2A$8ZY-k=Ln_jVhYGJXHK@t;l#Wch0!{vB4-NL;3f8aaN+1o
z_*Qqtf@0&4+afj+#0K_!nthEXKZ1DWJO0d6?!eoruDc#P_C=wE+s?9;U0vb!)hwap
z1?980O|W0H(4@j^#z0ljQ3aj2Q*P_z9b+%?t8>%2dCxr>Bx{>^xDin7`cnz)G}yl8
zpfL!ZBz6oR?rc~X??suPVU8Qej8B2*&BMj@VQ)fGrPUr(Xw!HVUdIvI=X>R$B9Rt{
zSa-VVV+Pd#AF6LVezmUc7=Nw&7a}2yc`e03wN`c2&x4yA8*uzLHr0~|zAxEnU+~L*
z#RJ}}S;=q55tt*p?k6)EIv1bitduPm!(|Pxc~eyg`xH-LUt%aZcZZdJWAMX$^dG@w
zHC36W)rb$F_#@<DSN^2%h5i)bPRYv?M~|k)#ujYU2t!L?9Iw3r64q30I%?0HBnw9e
z^6wJ-*%sAjRe={Z|EL_4>ZWXcFc%V(LlMaFek4nY>a4_PuH;&-?(m{wRQ2It$-Fwp
z+%@d<XKo;8Oy@QD8g*K;X>^Tnt?nI=sE5qe-3?r#A|E~Xy^2ir_}+?(8qFCTLX<S3
z>sqg^sU=)0BzAwxow!V4gSM7HB4hDQl}J-#56V<)_v{>2m1X=|-i*oDDnC+6&c3Sp
zLATY=0S+>?U3vg@UMFi<GuCq<#?#lX9Cc>7$xS~LI=~|2EX-`955h>c2u<p3iBUI3
zCOh!4D|}wlxfpSBcMj%(9LnHBpX^7AY`USdPIJ-Q+qB$NXRO<2>^VuR1Lr5KZFB{?
zJD+ho@wO$g&K`WS5t=?Ws?$3;G1lQ;s$6O{2}wzjKb$pR6e+e{Xw)j|peSuuyJ|nV
zwbqYwi+RjtHr#&pYdRa<@2msN@gR95|Fv-2?)k}m{K*a8^Ca3oWoEAP*nna-OKUdB
zkF3RXiZh+{PflI_jKO)k<D7yNBHdcp9-9W+W!`T%2It7poUw8&WCoQ06M{${tE+(#
zlP*WIN~M}3=wV$9)hOL!34&~R@T6)S(3W~$y@nZ^M-86Xz*V<l8OH(}1UjtWu>j?Z
ziJ}`o6)CqaR`)uU^Vxw#$Jb-s7yVX$SpXMSAEepMzxK}`NKZPN5kIcFmKmZGnW&e+
zCv3URj23&3F<<64+ZJ+dMK%qgJx+I*c+mTzmrDm?NJ;eOlOwW=_;pF_R?Y>1F}T%E
z)9R8E#Ci-nA3_%n$y-eTmHop(CBl$z0+s4jMomx;t#@yvy3#whZOI0Oy=s3q8j{9P
zz4k!vZlTW(CYjEKg6O?*tiBj#6EEBcA}okEd3!9P+{;JS3Z^{LMlN2U^UiY5z7sz9
z3r=FQ?5KH@ZG!E9yJN%&g5`Ml;rvx?0%Zu%L+bk$2`A1M%0O{zqSx98@Me=C!DN54
z#mdv^^|PE0i3>|Xz@J|2e1t~FeV>JijmU0YU7}Az8|np4)?!p6;~iTAd);-0>F`c?
z6H^*_QVdz<-}7Zu3P~y308!!sK4sUBd=NhNm(NjC4yfRb0P{Ypv01%p9tLPzBw_<8
zwjn%VW$8U-pCU19GA9d@gN;&p5gxzN9Z1YMJMnaV(d2+f%&q%9J7##r>Ie8&%lQqC
zMB7QYp?tZTzk`IcQ|BzAoQGsC2;C^-I+OW+%`#tEg6<xfda#wWvGxOEQibTTzApXa
zQ1G*oi=*|r9MdDo3GK%^`_n!VU=&!N)s^eA6Px{%T5VFFl-y3xJipzh*AX%w#K<|x
z{IqWHMBmHMXNCKWO3cZ7Jb(P1Xxma@xzx(1jH0j*D^lqD-+W}(ph$d#5&zX46oFFJ
zp)M7lA4u>9TowNfWk2l7z~ZRwXn&6=k5c@d7YOiVc#C-LTv4Lf0jE!Oz5O18hmvIZ
zU2gk!u9)G=40@f{+P&uFUU6K8Ndh01noo&&L6hNhqViMRrNJSgTHCag$8~j!#QtJi
ziJXHc9Y-uuZJj6YQ!r6j1%4a|{-8(*9c;|Y(tj|}J4QT4{8*mXZcgVnPYy=oYBn6>
zIKNSs^Lf%cdBQe#;TN&?yQIwbf9WwZ%)hhF`>@vU@+3#JCb{Ea@u>=YZjbTWemy3j
zW83pMyn3!*bYWXQjC%ic)(2R9(CF#j(o0jFJr)ECuk5@*<@q8X@V>!@nQnmO(|*9J
zBf?!_(UG@3X@mVB#<j<D>DX3b6flNAhX1gL@Wd+6ZRLI)^-N`Zdb<cOaFimH=ZG9a
zG{1Y3*TX``WVgmfgV1RhB<{u~21$kmDQ@H$k{N00so(jnq<ivV-{f{efUAaG?1$Hn
zx(H+N|1Dwr@5$Sn&wdUQ_<4fmWfmsBb~W^r@E`(F0bl-`O=1I#5kfOErG7~jx_NiG
zr($90i<<p4@zg;vuK^8(NYc{cl^gWw^M-dyLKeLx)K%z#){6rgmdi(AL^+i?QZNgo
zk-8L~4;VX8jwW0l6H4mRj^SjGc294xOIZWyZ5`uc2mX#_hacJZs!{iWa^Emrg2~xY
zLtz-OskU1mt18XE<*(GFf~gt;3D^9w*`hQkpZ9w}o6B4W7P6iN+0+&*79G$0;H};7
zJ2Xw$x)%ZHWX<C3O5JjXB<!f(5PBG!h}gw=92+a$S;YmFwkCOgojs?lKd2si$5EHU
zV=)=mT3pUQDv76~zxxvlZ!x^bd<*|qEWunrwOdz<POn|7sxpW>+hJQiAm@YrXJ%gJ
z3VV8Qs5BhfkPN}{=2HRksYGLb=K#vO&;OvMDwt-~`wpm(zgz@0sa#->2G~Kr$5H>8
zt;76kL$`Z0Isr}N!H@#T*g&4wB@7y@aw0U@&p%nA%D%2S4)%R!TfCQE_p>F4lk}?5
zKtK}KIbnxoIpAVh4$N?WWmMV~iKOb^X6<g8ttnot!^6T#?5X<NN3~<?{&Bk68YOBa
zZ_5l7QxhKUg$sq+HUx<{E}XIn%yBJ4{fukKQ$MztQEDP0d8E66mhS0)L#&%H>*Wge
zl8}MV-gYgftAPv=zA8@4K;EAmUksWUxflaK*1Ns|au1NoX4`X{eO$-Xzo)DlU2N=2
zFJ1#ANt^FpiPKSlBc&;+u-vIOLLzGL2UF~*v3Ld=Ayb<Pf3vS^v~PWN13<F*#DGT$
z{|B5=&T@V(SiUSO6J@6U>17l7RG&Ae5tbe%nbO9ZTGEA$`DAbywGVDcG^>$S(SRNn
z<o(sb6FZToJ~!`TA`1<FTWtsRi~$~1_dKd5<#44L<XSSkmsn0_etaYzPKU*trJGlS
zu`C7#FcztO0epKmd92`HqK%S}%f-^qs-J_^BiIz$2QxU&+@G!_5I6*+_m@$1PG2;r
ztUSjeS8Sqxxdx003T%K_7C?CF;}&}ssgzXq$yk=jN4ybKlPpP1A^k?}`x>@twlPif
z!JzUoN-xGoIk+7y#pR`DUGvpeSV9m<r1fiT5Jc962r!7gnG>KVXv^PPpW{+3-y<A4
zfz>}y8UGQZlr%#xm5VZ#+=4x(z-&O7y(3c2u~+8;`wu{WOR%#@MOjdeeZ~QLnmjBY
z!UiRwv782IG!hBfD$|54{aJ$yz*!*cg#id3zeG`=JiXs`d3se|l?AhEKx7VbOKGL+
zbkvR7=pA-Eswwk~K5mUzYLV28tW=llYJJtB#J2ag_u*qKoDV>%E*-n&A(_`A9JFg4
zwD~Q}iww&LxQ!Y+goT8DxR(#t<mdMww?<o$oAWGPtoX4z_U1Z2RJ;(N``ti#Tr3U6
zA7MO$qttZT4cMzR5^>lyx>(hVC{ggmC||9EY-Z9f2Sz7a<G!E8<>zE=nRwIVMyQ&4
zz;*}w@=L79N(xvY-QQzBb>-)8@7B5G*~2_s9ATc$u9p|ck?Zqt&zExa)UY@%opgG=
zd&qk<gXM(;KPN3ig|J(n@yt|J`5&@@{c8FY-TS|W(k~*DknOKw?u>FBxG<d0JL7nB
z@K8*!mn)qzRMrYVG8>z<f@ie%&UJ(*j!BPKDi!T8b>wH?iZQ5$`cqem)D4)F&6-Q6
zrdiLPu%;*ORTF^8edK&G3Rf$MdeOJJ47vb}U}}N3055VZb>oIZ!?)Mv?vGCM-ojt8
zj<C9*os8g5N!DcS#l%#$VewAXtK^9CQc5oU?7+gAnNO2Sppu`Tx<0>T;_XS}3Ny|n
zzFj<#(KL4c8%jR(sB!HakBaLVmO_cIzldt-?8ZWfh$vRzO-75}=m$OH-?PyT>TwtT
zCuHCV0RQFgB*pVXuH37msl(f<)gbQ!L*!x@4;t4-5n^k)3^0`{%4I%R>h!u`{(OZ<
z2)|iBs?-CiTWv@h5EL}=t>v<<x1h(hIvkzj&Bh3|(Yy|$DTimg2!$UmwZa!={GWs4
z0>Lx+KKX}wzD<fv48I95O%Cm^&JevNb<R5?!S;0>HiCA(bb=mwSU~P9m+8gZt6P|=
z1hjUM{u(wPyrEU1vvxXV`uR6Uj|dDCH)K1uHV$^)783Qj!i!CKlPUj7i;Vt-4I8*O
zjwc#m)o0JCUF>vm&=k3;;(joE`@GGKjjaeQ^|;uZi)7~8f$pnfYj}$Ly8GH}x*TCW
zw*L9-Uak)ZWsH(vI_Sh)>6o{Zib(Asx`}-upBP7ueZ9m*<bYFaj1Et(Gb-^DsLkfS
zJWr0>(fy`MvUyF(I#;Au?L!}9lG)XXx_c%=x-}mI=mc^Xw2-dtArDO|bauD5w*&H3
zuzvqM<Zw~OEXdR<Vh20*xk1QzfQi8W#^9nd5z7S=ZJ9}{dEYNC;f}m@;L9yrf)OJP
zjXj>aO+Ay%{dun1i?gOw$Funh--%h6o~tMn6Vab<Vb$T@|Fd$R3Va>j^ZF*Db8Wid
z7N(7Db(1`U`<Qs4&vquCp2y&m>IpXfYT83yk1}ltn)f~6-Al>fZOr2>d&Xk}=7}jl
z=(%d#00~N1dy0dUX4&@JR{jm|4g~;18FGq6U7OZMwY%}@LFIPAp4E`0cp~Byi|S2z
zSN;%Tp~7Lp&T*?rcjjsHi{$-<Wfmp)fzO$OsN?$X=c=VzyAcKOF6p!P3plD96UBNP
zT1C2Rhlg`Hs;MHKu2vnc?L7}6;a-{!hl_rV*SOH+0`V<>JQA<*ap4)&heT^RCSI`}
zqDyl1w)Pk7O<wH?>ei|bi#as%Pa<c4s8xWdXU@4uKdX)Zb=g|4dSGD`Hdlg1dx*O3
zdsT0wP#CxhtIPR39I00S06}h#7aKJ-F87aTN$-F9)FvTF8nC99d968~jCCdEVG24+
zMx^IY&}lXuL3`C)`(GRLhHLp$A$q#|pW31+a1rB*pmM#sD<^LeBb_9h!F|0xr)8?*
zCM<vIpWCM!WbI(gzm_S4kkME2=R{4c=+a*0pQ@^TWw}rM+HLHeHD%pIonfO_IFFS5
zl&6Jr&RB2Jm4BVu#wY%cv~c=4vmKK~v5ML&Zrz491NZjvPb9s}=2&QT-_{4#db!aa
zKj*%Y%uQ@D9mkBk#$+#SCK|hOdhh5Ng-h~^Od8f^HHmr$*6+_GR_tsf9n(}tyOsSq
zYz?CbK%>P`S#dmDfqW1;goaq<^?b$Fe%%g9>tJ27%S@y45elW;L^+?d79-joP0IXE
z#ZB4AHm)@0Vp9RUObW6CX948%w`tv9Y6@$186CQzTh4ejbR<{5;luB+J~GN3#Dk89
z#267H-&-C9*R#rtM<p;_T2i3ciM@0^K~pJ2?{rJ57oBr$#~ddGy}D;KYQLUOtro;w
zT2YAEv>Y*B+Enjz?}6lC@?OM~idYx9zCVakLxqhsHlHfr_!|y$BFjiI_rN^wn(#p7
zr;mq*I(iOMo`{!I=e%QEO?Fd@+rNrv#UcyxE^9aTJx%2(LC>X*zDCbA%iy>7numMt
z6jhIZBPjW0;6hVk>w6FEDM(_Q1xiYsX&j%_LKTPyrEq<Aq+hsoXnTLfkX0<PuxPVC
zi#KRcFS;>*o2=EV)=JsqQ=91>8Fz{m_S;hv);^Ai-%eZVSpbUNk7CTd2-o<c0NIaT
zMS}&nU_6VYP(t@Y_1fqLnL3}w7X&h0+0`S?(ta*^)`!}k@V0gDM3!y&5boLfB~>tx
z3RhP4sHJZ}*k}EdY-gsv@$nZTxu;SK=dtW)7N72hnT{Q<Dx-5yr~5-M#ml#^!4K<I
zv9#c~A#m%X1f3sj&FAJV{T+JI5!}{9Q{T1o)tCWw_wLcP%UKoe=#7@A0oyl?xKeb8
z()O_Vg{Tsio(YzgbnU?u$N}us2@8`KBnp`2&+3HfG+RuUndzR1PmctvX;-&!M+Z5|
z3~2UJzM6CR(PEFK2SCta(<UGFcv-}2)8&F{_NwTL_NWIKz1^ld<vdFaVXI2vbZ{(0
z&9m{@#*SH@#B~-TA;3eZ8i!>|Ocoi`%Y&pv#Hm-xkn7`-S49S)HmS}7B*dG&WoEs|
z_aCW=?I;z)-MZ5n2;P6Oi6{OA*2r#Pb+UGn^gMNtIA}0keG@$hPCMpKcQjyj3cMur
zmalF%MmM+<k8zStx$e#M17CxmlV%UHSKBSgp3Qp-R+fBkxko4R_8yy7NxRlHVy(B*
zCXD&e{cO$>^3_`I1+}1gMGWx!AE5jU3ps#s5V6Jyznh2O5bT&5mRbm1yjo8@=t|$%
zak6?$$}8fp5(ljSKzC-VOP1?DE-`KOk}L%v`S+=r%WHTainoY1)8L+`fzKCZE5i(I
zmsodrm)(!ocP4blw7K=}2a(bgf?~2-w+HKOk^Mi!di(EIZAH*kC(}KVH&#-(_EWOp
zPbt=~)!mYtk#}b!nERHRf@`Qn%5T?v`UmNt)<9Bv`w@L)>wHVWGf-ntSApv5^GaPO
zyq+dRkJZRJ2Ya>Rs%aP<(<RBy;HfS8B*7sV^C%CJNqehhL6V@p108v#Q<u{^nkVoC
zob&Z;9xmp%rp-EszO(Y|^Duc_=d}0nI``Y@wo|3Btxf*SlNI7PFkL3bV<|6BBS)#0
z<(2C~qxTn!YE7{!^kt7~BF{&l_&v-W(CaIEnAW~2r?yeloi6Z5k@sTA(H1*8Lu7<1
zj((fJ!P?CgQ4a|SqeI`46gFu)tf9{w-0tsqDO&qS3t5=*Lj0U)?HlFD9dumCBP4~`
zA2+VPDCPt5A19pFK!K|P35~aaMc3=A%eD&#!pBs-R3m`oQRM+Ee+*XN<eg4F#JYy9
z3`iXOn$i^uZAED0H0G4ux$@ry0Hwx|QB&u{=f%2}y2xf<Tzn^xq35M?J0YqwjOKBr
zc5rkhAq)@ZYfr#a6B&tzQvh{{qb+9bb>n_lGc_JcPb2j4_pE)VJ-dE7l|(_KPC>&j
zwEQ~RSZFQYvGx@2kfg>*Ti;7n96*=MU`m;$+Kgc19n+Xp4##`zYKz9`daKFBT)aZ1
z(s8~;r2^jB#<}VrTVLmypaBR~tQ#L}LN1a9O^33r`a4VlR`q&pvU+V;j{-yJFPxI6
z+rVyQ)`jnmN2s{;pUNkQ^OHG`zJO4CozAd!%QdL|R74H<1W)rTI~=@ci7vHkT3rT)
zQcdW3Qy&uwGpj=1)w{sz&pqR}@tq7wsd=DwTdqzmkxn4%YxHE(D7Vox#_jz%hQMOS
zU+()vH|%`b2X0e+^}=3!??hv+sOee*K0jq|+P>%#XYO;Jt}uu7B~l-RLziTBh^emP
zcjoj4UU3j9UIS~cjm3!2EuSB`tdv`%th>xPTL@<uU|_)R)?tsVhX5f}@MV(OD7CzQ
z33N}^eUaQ>J<z8rY~V}dTm0d64*t)WZEev`fSfUXh4;jCPQ6VPO<HyJBTv?;Ca$S#
zoz8<*4HYL>%q3(=kD4Lct}C6e=d^0&L|%ixVgvv_`4Kkl?LyPp{R0{0X?S%wL^9td
zw*$S{D*_CtN+MtD-v-}@6Xv%pEgxL+t;fEVuRUyVk2)!eMy!o%FZ>YrpbMqORY9FA
zLQ=g?EA(XapGol*UoLMnaW~%yaGABCa_z_gllQi+#T#S-vSb4CQa6&A^@KWYQ|p3=
zD~$DwiSMu7KE&<k8v~)cO!u*Dz;SCrphKGHRV`JFYpcT&b>NwCA2!>aIEF(#-+2(}
zwJNtiboQ95Nu&g5>?V?cn=%{zm^m<sJ&(h9^L%EK_jUJH#tS95YH=M8mC}QGOAP6L
zpP;I?;Y-b@RH~Awiu%h_pAWV>$RH`FFbT~6qU$}Qnuxo8Z2>9LA}Ada5fPNGBAo~*
zh=717MM`Lb^ezw}p%<x2Q#yhakuDuV??~?*Lhpf45=ipK`@GLO=XusSYd(a0V9iYU
zXPDXhcU?PN>BGW=R7mWSZe!3!fXnG9$SAx1ro^D^uDkdX*4P}7<i`d*Coy(qv(`ZJ
zg9;F&SkDBqcehziUIcORbw?~gW~ZQifeavfS2-qH_pODm2FijjGYdd1pB>lSM%o1y
zP4hc%Sc<|>duRBak)LmZ7fQ~F_oK}ruf=j-PCt@*I1V`sXTTG)Vs-wX(7W?)L#`Ix
z(IcO(GG8A6YH*!RM{V%8EI{X$#e+c^0$c87rnN6N-mxv%nC3v@zFNZ}qUiFX5OfRa
zS8UkmRerhhQ_lvY3EQ#sB(@oL!_=I~lyiwei-=aoY;#moBta$G*33fmI$YCTniRb*
z@geo<E3ayL7#FO-u_%mNmUg(Dn7K3(8~1Sdfheyli)UR={%ntH47cavtMD+LPQZ6X
z=5dq|J}9uUo;xFe7Y`O+(M>*JXWtZXT3%>0VktI3$DsURz<<$sJ%s(T@P8^${OP{8
zi@yJhwZrS;gVKYwLk3@K+yAQ+UfQ_}HqTGyw%bvW0IvO{E_=qaT<mPpe6m$qSi&F@
z&HbLfD;ADBfi(s{c#n8ROL8RmfSFh|`~`^m*lZGIr)T7%Vc+uz`&+P)`RG|7<yP>b
zh9jneDTTbNZVA6Jnc!lc>-EUgHv@Y7J%O8MQO+w|LBHbqsmb<a8wb6gYBZnY1u7&=
z(IOiVWu|NLsEw60<!_w0?Rbxu?Cvhdd@0O3a*m&ZwFu-T5%T(UHvZFb7oQ_!lp{E-
zB(C!BUa|bgFoj`K;O`~ISibSMHQ6OL(;~)s7&^lGYO%k6*gaX+_P7vA319p|TW)ve
z=%;6;W{x&9wVooZx8)WIu$>v=QC%2#b5x42cA8<zjhSWr{fCBAxdjB1mxY1PSJ#In
zo#@GUcf=?V9r}0uMOH>Ak<_GE*yYlJmPo-(LL<sR6du6-ePEdqc!Nxq8h(|NNd@Vd
ze2WPyjb)}8ri%mZHah|8*2%6%_i(xvP_jbv+agV{M;*EO<8dKk!4gU2;L!M6cxF85
zqMot0!_{)sqc{N?V#6fXXRB3ZZ8X;UWhP2<9x)zvP1c`})}V#WB$0W!{3Hit!fW#C
z?&GhZ(^F<14c6rk7RbQMWhe2N=NJdy48M&K;;ESknAK4Nz4TAD)gjX_$3Z<JQCKP!
zE|1_jkL2{k5-m+Hrc^W>CoKgKq@H*uxl7A+zMa=SOt?JodFgU3Pjvphzi{29qu4<g
zPPK1yg$4i&2D)x}T8j-B5Ey)BP~v2E0<j_sPmN<nv33V(n1jvZcdyVSB)(Q%uJe~O
zL$E@iCpS**UA`oxpJk|E0?lPK%WVO@@ccXV94l4Mt!)W{*???VkZ1P!wGc6OXj>R~
z{%mSGE=1<&)nlda$BPZb2gqy5z47ZNw__w%{j#1#ZK$Tl${*MEk$m(=l>5sY!xx4=
zL@wPIFK{$jx^S7kW8zKx7>$*yzd{ciPaMA#cazG;VRX>As;PO_<QwbOXM1(1Z~P7<
zOEa|`CHQ(51T`jUz3GY(97~3wl+=Qa9$za~!c%QFJ^6=Cs?7CjrqIWzvBy?(unY=l
zWa{-15yM6<m6o%(H{@Q0cea8e1=~{V`MhG~J|!1Rjs4kc2Y@&5xI^ptFDk&5`v>Jk
zj;P@X*<Yo)^eN42UkMXJ5D6oK+k^8A1Y1|C16n)!)<aPGyx%J3dMSHwYY=5o&28WY
z``XHBk|BQCB-w%6Yx-grf<G9<%v)PPe-^%NQQCe0A{4N`tM4Vl+&TS)=>{K+$ZnmG
zv!v}R?<k$$KYiI6L?!CwI~srR&0_J8<*t+$Cl(PjZx#kx&C^I<DQU*vFV<`l`vg2>
z4=(Zg?aqxfcVZYmSuZuZ19<QEGhNyf^FgnOgbv^`{raP!TA7gGi%pi`*J3HAq>XBW
z4<1YN$qBmyeJtk*H=X?Y6fYGCN&q=V<ae(}r;}msvbTp)#OJsK!vb@zaI55ByMT+=
zjoqUh>!eytqMmN1;n<2nSAmpyqP|;7Dh=&`<S;q0Ki|4JN0+=#98SLm<PVyKaqZ+q
zY!07}kQ^PQ&3u?j|0&cgM~nW=*iH_dzUe+dOH+r~1qF8Izy|Kip%P>^KC(T|CWCyT
z?Ik&YV2?2+@Me6;>uMWg*o-FG{8T~r0PhmZ;_qLdB<7FQ)@{6md{0s#Ur-&@AQ2GF
zhTu!HlMjVsnckJE)sufc;8*RCd6#a#VGjntO*#g=_py7CSGj>d%lHjG-<P54jiMbn
zWTD)wD$B;GJz}YYm<ygu_r%ZG2Ky%uHl537b!iPxY0`0~Ho82?mpeLV(!)R74a#Qj
zdi=+8HKMz4g%RD24rmR`vheCK`~1`U@D3(gV(Hk#RNLn~vb8%(N-_=z5hVw=m{N*7
z{c|JdCc<{MNhLP7i4*FuJkZ0^2W~VMZoaa0unS@}&ZK<$hHonjhN<m=Hsk#!E<*R?
zx9H_Zor#T0EkD$;T4_P@x4!(cUE2{c&-oQ^8XUD;&&CjhKeSh7;YMJ5Ix3&(ZVq`i
zfnIFfjN=|@_0Z2XhU>xHb4!wRt`AwXp*;;fq(f3(!`afTR!+^h*Fu=wBiShHBT4H1
zZshkdAU#gGzRxZp<3R5R0Y!Q@x3hm_bE0<q8(t9y$Db@EC|?Coj+^-GXa8-y>f0s8
zMd$Nu2sihHuU0X~bLZf3?hCrZ8ZL63T%{=`J%z)eZ&EsPOSGkP9Xb7^vg}}w*=`T{
z0Erzi!8>#A6PjPbzP8cp3;xsKK#u73_I3x38Q1Xr?BONAua$|yu!-Os4K`BO0$@!S
znaO`1B+R+wyL@h7r;NT9u_Asx5}SVK(Tu7bPc*^Zu3~Fen@6Qq4MA|2uzsnwp*SL8
z-dIwYlq{g_1E3Njuiy=8de+!og5MsxI|J?Ea?a|}^%V1>0ck*e-~7(cI&3~p6sdLm
z8d@AxgU1gYR81|uETFq6;a{@EgioO^o~Ry#v!Fh&eZRW<D~!n46kPMZlWA_8^qVq5
zWqpMkgo$SY-WIk3{#=5vG-Upr`Z3j8QRx9&M>puh>7_ry!)nHuo#h9NJ#k}xgs=Ul
z;OeO5VK;%&4C*)V{2s&WVT<NM`-f`6t$snW7xI{n=Bih$BJu=`+c;~8OF_~LJe#%e
zsK_jDH}SbsfZ|u83vM<h2^|{yFM+<wE4CP&Sp14u|MMII6Mjfct7hoDmg@D1eU6iR
zU482`rh2OJNOp@Jc=5<L%V{D6_}Dc|)vLuH|IoXq9RINSjy5Uwc%l@hFw_roQTQ(x
zfWCsX?3{ll`P#&lA^<r0mxt6nCLs)jR2sIK^RKvgk16w8CX6>{PFNjXqmcDEPZIKe
z1&@}wSSFh<bae)op#0g*;jQGEZVPB%ro)w!ZB6*YR+H+Rg(LkJozi#3qIgv}UG(iu
zXFR5i$HyoPOv_p!veyDlyj~a-Fj_FK4R(K38_k3tU|4Bb1qRyb(LnfB`QkNxCewi@
zmRrOt1H-&okD{NKmO3)#O;*nPF(#!tvc>BrlA83}z)ZTH-`RSlK-a|tR)!yE#74L|
zgn&&(+eIZob{|25O&UVOIHMp`qLZe(yv_>JgSyg$lgzOvSKe3UeCs48z&4&n#f+eH
zM#M|otB<GFb1L=V_y;Arm$yb^@iuk*{VNs5JGetIr`*)#t@Z51#%^C31US2~?Q*l@
zR%|lNYY2qizdhsn`5G)k%;HlN%dCKMDRUfH^rhdn+Ggi5Q2=7y?$1u{wGe{+u-dUO
zuC;u*z6)yF=dZaum~P_(zBIpM#G`DnpZ^E!FzZvE%|;P^9uY9n<yPi(T|qarm(4E;
zV)6D~wyyl`YdP0w`=~_O(>x~G#7qoizwpgL=1*Er^d8E+!t|)f^N0TSb8n2Jx8NQW
zR=So)q)-wdQtNI<6N*?qB6UZlOf{Nwnb(XhQn5y2X|AFPRHDNByqkQpUYc>`We&BK
zR(~0Ses~$I|2dx-%E;?d;P?km=<T*={u&&<1=LKd`&e<E3{702cQZ6i(*p6ds1qck
z9`6;}Mx&ck%<Jfm#B+Qq%#T>}@{q4^Y1PHp95Ygwb%dL(_D)FrP;%M^u|65eBkVZy
zQQ|L`DPv<EH$Lo=9p5|!S}r!{1|nLWw)pG-6ozBn4-NSuzOWK<ud)Kja`s!l*!LQE
zv@nSH0{zf88~_;nZu1~o+7PW3owk4eeaQFWS=^Yql&|@IeiyGwte9Nft<{_>YgZfB
ze!J5Aa1|?)>_#n<Ht%LyOu)&V4T(Mn-cmPd79S;pJp^QARYW)RM^4MNinyrKoJ-Ux
zb1pJV?|Ngo(7WM%={I%q{7&3Bkn{no+=<O^&i7mtoL?`A@sW3f)^+3HvaNcN7L`Z4
z`K==+{(#1>rf(IdVPP(=k{;)8p;cbJTkT)wI}M?-Hx0a_*Qw18o6Zv|8!hcLw7~Qt
z%Kl$SJ-U(H&CXQ9z}pPYi#Mttg>0J~QlNJ)Y|kz<)4-fd{7i=S(DN_FZX^iqrXH*H
zG545>+jby#V8V}EfXxhH0nqW1EGi~Ig{JM>zH$R%m5Dho?Be&$cGGY_PkRTNqoQ92
zduNPB46<j(Ew<axDMA2=SU-U@8K6M0fFdgld?k7@;*sJ^7Ec|0R?4$vVIX&{M^;5g
zruN&~=`Br~!9JrIf8wdxuI~Mn)nCP{HW_y+{cUTgAm0Y8Mu<bI0pg)>{l!^GZOaMw
zj<lBS!`mE%OQWb~4u%!XpD9D-j|}S>vRs1oc#xoK5X*~mH+1|NPv0M8j7$ewpRg)M
z+gJL9>?GRy6H}@5sqc*o_@?ov&(WswOX**uG+$p%!gDG!S?@IIy?rFFw9Z4i6L9zY
z@?X}op}tb49Hy=hgY({w<(z*OB&OeRh-l^FHve9G=&{e&B`5$<m!}1dqmBhi>kXZ7
z@n5M+M@3*L*(FaTn4IPrFSjw=b?GR2Oe{m2l^CPDdPOW#z5ccw?bfp@=Q+0BxgGnE
zu8Xfr<kcv@dhCHy1pa-+v{U<w5xKK@V|?DW%<?sn%3*HF<_C$wdZKC3z{k>Tu?3Cy
zUXYw(FiaU41(YkxLFXdN&9(6RVAf1xsk915-+5Xj(K7gX`x_7FX$vNdYMF)0yjbFw
z)(>v;EA{A{+`}iZZpn6v?{gK~FURXdJB<5?B$Tv};YZOO32aELz_$SJ3de}~+>8%r
zcdt`S;>obQ`>MF3gnb^6M0n8nt+99;u(<HoQdUTL<EGPUe9woH`7h0Hj@2-)hG-H%
zeVUTZRaL(KGOl?i`s71~N2sX~4&Zy|l%|sRL6Sbr2~!j1&sxZ6nD<a;RbITakHCLo
z-@MyeVL0<~!v*Q}VK&qECnJd94l1clm*01UmP9$5!|AFD%4^0QeS_w-Q(;BJxoh&K
zk7R&#*zZ5$@RyoP2uaNcH@pn@FXP5(V*U3dg~Ow$3J8-+gb|<c7wt5qBEC{IBpIR?
zSe@!dltNV420g*@qN{Z4Nf5l{8FV=F&cf7cfByDWd<@MrU<S1zuaUp}fS~AWj=gT3
z2DaixANBPEG>ce$Fr<1Wgv&Ejn9`+mJYJt8eBy|`Pi=arjId0G7NA%4Q(hvK0#LTb
z&SZX|S|0gne=n52b+y=e;GV_XX6CQp7OsnrGP<I<D#y8~%CF&L=;b2IFizLF)O&MU
z45qZL@Z~0AWw$mbM!t=1>rk#G3WhvCl9uIUU%az@hD%aNTdMr{MPluHe*7mR!)mY%
zmiC+TRWa_Sb&LNcIk7!jHu0E~V7{I#V#szf@Q*)pyqYO3elLEr-L1cxc2&*ysXRB(
z23qWN<_~yu3m+ObQ)bq_ruJQ@am2ujdCpCHNqwd*q}Xn{dP2Vpo0WRgRJOG?1V?NZ
zv{Bkf>d+cywnD7aPi-*2I0yIIyu5IE>twPcufG9Tw-0${lBewc9!9@2zz>UfDQ{oY
zZ+eL(t&MU_gyBQ?F}s#m?PprWE4LPx7;zsUqA!fk7cR@%zk8ZWv;-iQccILpHJvym
ziW|S+>uTxm@3cM6T{<8WIZ6&87ULZl;L*vYJioeg{&1{@)wRnXp>~R#!WoQdO%y3*
zQ8!KXmu$NC$?Bs?R}3a<V4QR+tbd)EIcUw|*ZX5yNaYshYk%u!Bo(JRVm+u;d<D6a
zgtnww$uh#MjJl>kIOd)wa){G#E3Ra9Xp025@FZxNUePOkgX2FOb#J30k)nB9A?uuh
zl!a{Xrd1H35GNc;yj^-m-ZadFPi->^6H?FMu9hhHHu8P02a}0xQ<1&TtOkO!D%GC1
zHK70ED^r^hDy}8y{vdTg;4oJF1%A4!hmMs`c5F><h9W^jk31e)abrt$;rujYU99f?
zw?{8_7LBIW;gx^4<CXKkh4-~GWvMzZtOUYmgU%B}{*JMs!O12?51_++qbx?3l%Pxk
zap{bqs8D107l1VRWJqmpm(DF`2rL+VK?(&QH0K$Tu4W+$8XZ($>?AxGyD82Xc&s4&
zC*J}zlC$5j9dgmB+5?J7HbT<=9I;TYYbGp#SKVwx&A@zyN+^)^pZ%I8lMo!>h>B>(
z*kkcJjJqS(#m9ZGu#^?=y`F=&+Ko5iJtaqGcD*=$lI_c1Dxmw@`2r$1-rMd;0uI?%
z+5g$MnQI5X7cU_lw4(uynJR^!Hq;idb6WPZxNr1}G&3)$bkhOGD9cgOb4z<w3AAL@
z?|4k-C)%waV<J}yYblY*z_4Hw0VivI8|0foti|?=(klO<B}?z{zK_B9kmI=4_F2u7
z^Q#2Z!{7AHyPe+>e@F~y`RDUebA{^N0oeKrb%`W_%E@W1U*lU{5qD)rOx0oA>w5G5
zf|}oxf359-;U-CrVhI4+d+vrI1)6y4tuF3^=||yNz|7-EKjX()lBW{dTt<??+Ot+4
z)CSuX{rZzi!=wBAilxx}e%ejmXshi_@rz<DdL*hpN&<D)WR0bd=9CQWul|JT7f2w{
z@!0soiLqJ?M4TC${etb*E!Ku<+?zaNe@&xExA-048jHPKMb$^O4t#NgTNAXey5c2j
zt<!K6p2p?6SFW;cHj%{u8Ti~!3AlquZ?RCj7;gLI8l(C$EOF{_qF}t>@;i&bgEEs`
z6{J;pOyPW2&_OR>Cch!;2M+ULND(||es}g=Sx-U@dQF~PRnbiPi8o^$usZqYR3EZY
zI9M<}$#LIDy5ZGe*M&~eDA<;k4r_O+PkSu5RVT{^9f8fth;GF)jkBJwhb02KUo<c$
zoES&H3Onaj=yQ4lpo=9R{DBJNWZ7t+y3^nhFI4F5n{|;@|FT30N{Uyg7jat4ohv`S
z#dmPv9D1AH4vsvnSsT6zLl&pOFL##~YF#WE^J6DiI(1FD1#C$(44^{p-P<YPzB^w&
zsjl3FCYY%8=Zkd7O&}5@%$GA>O>u0i7oy$YJR-U;QAkg%A#qmzH@?EBroKljL3_BP
z`fKpF#aAg?ls%$RWK;|5rtl-Oih1vDIVb?`9Cyj>>X_;sD9>$ugu@+rzS!0V|J3>c
z=#Y3Rhd(}rMd@@%WZl9d4;lzRH=S4Z>h~>aMCfZZ|8hK#r@7E{iSA7Vv3B2)dncSd
zb&>O`@v#tX9ND2CMv(9^gk({dwA@K#P9&4ZMsqC49Cg78$=w>r2T_hY32Z7m+?INZ
zEna}mNP}(Hj>0o~mO1}eV|>$IX*Hr@cL1L@OzMpSgYv-zDxD9~V^CxwEn|#}1{W_|
zRy!ltGkkAo!+7@iHa)XH1~!;nfT=-88apAt?z*_6AAx%1sGs?d`3*&dRoOSjh?N(~
z*_6x@(3AG~TWIuGDZ2gE_$uJsX<`&7qWaetVG+$YzII5C&KZ~f)qeL?6};+N`tg@Z
z&3~+KVgab9W^L}(nqexurFp`ppH<iITfxy(H!M44zGnALuIKg}9*W?H3$|1MA)^}0
zXX(?-p--KGi4?}+NWJ=I!&$H|xd?6H@mGH(r_;hawt(%4RaLW<h29EYCA<gYBgHER
z4h9Muh{)rsL=%DEE-Cm~D&qR8&QaM3Xin1DF00V?Nj+?4x_KO&^p+3|sX%{({GhzP
z1Y~~|m^dX;-n;*8P{I6Y82h79%<t3wrOmpMtfFkb`uCK!$8*g`+-!5TWfP3J3al1k
zyl|{aJGM#oS%7d9<e?Yz&8cDix{Baw2u@MQ#ZOxr@g`sDXSDWQ%#lUt#uMZCKPhOB
zP~dPFWp!;+ntP#$YOI&e36H{Y*!GAAM9OF5nN%f>b@77liNnE!9%L%4$J>?uW;Jss
zu0LUltdD0jzklkiy8CHf7M@}z#@evl^mps0YDu|=n>?C&V%Um(Lv7Aahp1P{Q&&l<
zNPB1ke@(G(52UsU`FifsHW%y?exl-eSGEEja=~Mr0n_K5E7<s(n$P6%h3sO5t@<?)
zj4tU=Sbgns9x8bA=18n0t@h>FglZa_B&51>2jlx*kUzOex%driIm=;wX4ALJ*ynHb
z`^N~;@W<N}0AM(+nEcBQy?xV`@Jp6_J8cZ|q<fpB$pAxkaQJ*KTN`@QUFj{vNWKL8
zg9i~K+F3Phxo^u+Frb(QIVLAL4MTs#s7r6PS8LE*Xpu&xWk7y36fpla44>7(?q_s`
zpfA_95W_+HE6jPXQ||*^=Q_Rg3DigBq~S~y5J>n^a74o|F&Yb8j6K~Gz;o8mpFR`0
zl=0NJTkG5!60-3QGRs;scZ;C(FU-?Ux?il1|6-OV(kVt15~>5s;qAMBou3jJnCKtv
z6Ue7q*0%F&uxTd<Bn6h2kK*ssLwV($+-fG)XGQ+I(#{S=>EgsO?_m7=ss;#mAsc2g
z`QzMeI|?z}V?p=g-ayXxd4SIuCnHoy8(rQ%%n}}t7|xfVe?N5SS&m=uJ8wD&xCBie
z<1qpcVoM*&-G`VfJ@fXB7})71BW<&lT7HVLy>s9`TB^FzuR(QjcQOz|ql5HsA6W7|
z5z+`t))J8_y8j|GZ#pv=I4ogCO3%amj(?wk9EA6kx=WY1Sn2(eKZ<83J{F~d&V7j;
z&f=?{ync^|PlUKKz*NfCCYM={Yno`Af+!q$HZk|S22-T+v%t{TNeLW}ES(>gX6P}E
z*SL26dUEEf%i#PDn_zy4y!`%S=&N9JN0Ote-BfRNu{t(*!E?;Aa~1T+>btwq?u?3p
zp8>Su!lq%8zksT13eGhI5-zb%v2k*7k71e>$7;g{zBwS-_wAz0px;0y%*^+DXVfGm
z_|?1HE4>3u_s{_gvz3ADn@2jKCgXOv$d1=LNdQuPKZW|yxsNz`24@5Bqhzk0n3I01
z!EanO);JYHV~yF^mN;XQu<;Lw^<%8|l0e0WVOdo(tu}8p(F}eK?N(9nZ2FV!rIa7a
zKYPe%(1$=2Gb0Fk#DGc7(*#FpUk7=GwIa8|dFbO^@#;01xV>a@^j*4BLBo0@BDV)d
zFXz1c9N6r%&93s`qCjCflkWI<r7%BZ^6mT~U)WsO_KKIG-%AOENrh$kQs{l0qBLy)
z0DPrCo)Y`!^rsH>x(FW^2vFuPr8wmLdG;}OxsYSj`pR<MH*I-+Oh~-dE{v<gi#>$s
znlNfQQ^ZR2MW!4{8^_)rh;ee4b50FFsjz1F9<!ahqhCy;^=PB%b6S2PO6>OKkGGI6
zp<j-fI?9%w3S-5{)~KBW&7LF_8&tdltE=E7a|Fh9E?x;ER>R9Id*4WS(hu^fIU6;8
zj7a6CKuccVXKOOU+xs+9xZcPhChv(R0>CiYc;-`3H2{`nR1@p6*W>!2bokxl2$-T^
zyobAk%NeY&w88W6u9M+PdX;u{)rH&pvf$}i|9UOHor4jjM(}5}OetIwe3Is~w$gpN
ze|p{wuk*o&uq-gn#FSfZKN9n5+!t;_zcN-2QkJ!Me5@t=?gw^Xz2M!d2I?2*uSm-3
zFd%eXC{ZM~HE5-W2QXIB>W_-gG}_E-l2}*~(5hVT4*}y*nyX<3_Ga6QIVz7{vzCfl
zVk=X99sVNl=t;xF+Elntkt35~gJW^3m|GI32~O?2=@2*kH{-E{_<=X>-1p0qv#p%?
zH3h3gPIbAzMABVH6?0E*o=}Upi$16~Oc`8ynBKqEIyQ!><d92uvkDq)LGq75mg$^|
zf&lW*3a@2MnfT<uBIp2`I_tE*>^dsf;DmGYPL|)WwJ%}a-f-6mj{`aHBLfj@E|Pc<
z;ez-TTDa0x-`AWTiki<IeFqM8O}yRFzD2BVhN!g0YknqC-0EbrM}6y+vOn^FUvFQ?
zYBtrYG^6f`)My?Rv0Cl-=z<iU<ziV6sX+6pitJ#S92!~7jzDQ)_MU>6d)D8n5Iy)s
zd(r%dWZYXDqXuQf8lTDA<#S?Rjlbj(p4xKUq}tEdYyg43ku%{jwUB#?6y2RNfsf(-
z#R)w8)T=8Wlzs<}(x_3y*kCytl76$BK)0DBJQsayULp=6V#S}B3gqX7)V`b)#A#Qi
z2>hVD^4Q9zw0YG7iJM}opu1&wg~0qhtT%MTD4F@qV38;k-AY<^QAxdtO-NWT4blIw
zO!8snTTX1$W$X_sH6C0LzD3Keovt|?Fd9}uj8>Zs06NhmU07|gXIJME2xJCq10xAf
zamp35K?i}P-#6xTaHx^45eRF7;v9#=O4~D=Cc_R8yY-t#OSpsBozDCaG@wfx)`8RP
zT8V{UrS_4!k5~LuOVryN`2D5gg;N}>>~A@NOwWZE^mkPJxo<+upZl;91WFr)pQhPT
zsJ=`*m%uHBBP5Mo^Ar>4d5{I#uJS*wN3DEFHZI1JS?B#r7~*g-4GW%#6EdeeeaBAv
zW(qz@-<HK+R&R$o7{f5)j!C}0*N-np;U=G!@Mq^-XzRez32w2Tp=yw^MNFHnQZV`P
zhk=>lD#o)}J3#S6<Ja+MfIJmys`)AtN?pR>hl5u%ooZl2NlB}{52HkyC~%`fVP7er
z5N{@|RTaB#a^IBy3LSGFv%C0lOWbFXq1P$s+)JX8V$+c!{Uh4n(RYG@<k)M$L*lc7
zT?XQMP)7ag=OPQPlJBI5$Zqj0kyfF0mKV+zFmibyk(7~D^yd4IPU>58KU{uA@?Dpt
z%fi>+VU@1$qB**H))@hu!`*)k%iaR%cNTVD?;6D(nETFtE_+XFP(ZUtO;*#YD_3Yw
zgKgR`(6+T~Ig9vEafC;L@JVWP)gOFU+D?odG#rcwc-M`d1kZe1{L%`y1hrG7%D;ll
zI(?EzSJTyTk>l(iww(#*g(?YyB+0I)B|M98eQ28d&zsf}bCodS9lv3I23DJ3Dl}6j
zL`$e7v0kR-zy<^!>&ABSteG)pJQjV~61mr~)bympcCF{j@%K-@45CzQzNi6H5&%%w
zNkWWKJYtX~WYA1$)m2xXgNzS-3t)NFR=>V+-OY}$5(aeZhAs1p`+D!?OT^$94%KSx
zm~3b<UqIS$4)*5@`VjHgYjzz+W;V1USOudoqR{9xha?}iYJm^Xc=I{tyX<rN%OgrT
zuqEc&6p5Ue&>P6b#H-;30?dcT>9sbyse9Sc+1w!(-$Up1d!^spo5VyfC-~s+cJ$-d
z;0fH8irzNMV2cd+0?$M~!6mpUAI;WOJg<3FA(Dt0=*9i5qQuO7NKWVS;>b|cGjY+F
z2UhcPeVT4Xq+bXN$74BmB<@>;%aUYhtdvf5zN~@%eLrHjcx{%yiG)t{o{<Y?qLqtq
zD>PJl4w`0X*H9ZoFa1n53iu9>pD1;VXa=${2S?%dLLr~iU~1ka53tKbAeb9y)KGgM
zI&Xz}b+moY13y(~U9Sdr4yneW$A;>-*3>+2bx_f04$E|s-F`&mCRgFGYl8*yZ89Gz
zpDe*H!DzTXGxT&^GmUdyy{nM5gp#WkZvVD!f3jKfYKX?b`{lYA_J^d9%4onH+@G=6
z(R6%jom7<VUQb(i?7?4Z#@XJO<z>lx>GN_&Pub+d6}{H-ZF76=XrwK661E*1%5&rf
zb-%pTp%t0WyaTK_d#7}pWTWBWVON2_Fl6x|TFmPjfhc>5mtV#3^EVS<m)G6Q-Y=yQ
zdsQ7Lhkid!7Kcm8SjH9}8a|?&VT+^uEGUZ}Mw)9G7Jf7G{&08KASL0jZ2fi++i<7d
zKbp+wf2&U3<^hRVisei`jjSMH_{%cX?OZL+g#7Tn*hlW=w4!%KQ%~*sxvQCf2<|*%
zeNvWL^z{Wc>C9=Xto4908P@IhjP{QH+GYq!=5PzY32)vB1#qPNf)B}kVhKt-XQu9_
zOOn8rRgmt`Ae>8Nu;0$ZdQnb|#dxd)A~&@5_Co!m*vj76HkUcSwvvM)NRz0vsKkH(
z<*WXnGaGYDNxUR$MVzj_ygk5<;5H;9bH-UQyZl94#}L`CB5`^JLPqi*@K_6Tn>O6*
zlGu<?)st?nW|NMM-5MC@n7TC*i^BEkH80c4?8Swr+zX`HDDMV7&<ADjBmd&bS+4Y4
z_Llgj;l^bwDLNPT-rYaXIkW5J$qwV3j2@;_*3Z!!9a*f~WNy`p5^V7~U-;w#aiFE~
zc9u6mNHR}FVsqjm8-Ph^v6mS>8sTy?zv(-skKHm@g<i|AKR+#_8av{6<V@^>_ej0U
ze7zNp&HO>*%ZoluD1Nq7x7FO)au3k`-M?P`)A5ai=NMP>9w&ZliZ`s;KYs+G-{RG=
zs(f4`hRBX<x35RR4;L$hZcK2)AKp7fHr9F3HuSN+hedE8MczudtU8WPIXw>*tYe6R
ze_p&m@R6E`hCMfd;A03r9SmU++?y7zUxv@Kkul78`El#G=G_i5Y7*;L#;(1D&nuUH
zP=~NC4qRNNh~M@Jy*1qjGTBT7dVNTRf+}|dIi`29jeh((I+Bp-727&joV*Mjl*)WC
z9E-a=AA>qvilARohh=g3z7x4*GK?ZyGZ@-bG-wy%puBj-0)N@qQ(+c}CJ+<Hy6m{8
z>V?BQH@12bbCl6j{tnoNNW`TE>iO)0x!h{<^pj`;{%aq69ypu0?9I{q6}A7s+G$2M
z2k5lrnIQk{=(!=X%ONba@LD>a*wcJNYcNNFJ2r5?bmY09`-&+j^{pBXBz)#}|D>1<
zlIUMKz1Ag2n{`Q>ZPx5}{;HP_yYLOs%KUtQ27>7$KPYRb@sOC+n!(2O=xUCXj?|jT
zV>W6KM*ftRxcE$I-pPIGJa3%H7I7+!x@Lb-Z)7J?II`BugvohE__-lR6uky|FKko>
z))u4f46D@YvW%YS2or_E%f_l@7c_EK1B&TQODR*kA0k_cxX`*ovpskG3p+ijI}L?l
zZSDRck1NU+C;+r`v|GFN<82H=3qu=5B4308Jyua88r7A{3XA}IXjUzic{%aMx?EA7
zm;SwT9<wZOR&CqW#oaOUnUo*6#1J{4(a}xD7`1O;Lqxfqy?5ak>6OAj%C1FGSIb$a
zol{~a8eL}0`HHTzJSl7Ff)3YB#(5NCMg=Lcb;M0WtBk7QD*;~VUK4a%OArv_$xgf8
zHnWhCV61xTlc8(gFN0Qo)Oi`gKPPr`&mXmHJ(SIbAlh|cR<dQ{)Rb!$myGmbheDg5
zn2Ma-_QjLvon-9STfeJIZgD*c!K{!33R!$xs{d3x5oU5CI`alv=0H1#G`+KT*N;Qg
z^jT%MM5NxLco)bp3Y9hg_4vAPR5P@<c3EAP73#d~2ZV=sJxz*fU)bHb@(y5ivX>D`
z0`0f!yq#7Ce-v}(kkS(vbz&V04TW+QH6CZnZ{2O2(3$OPAKI~di2Fzb=_n#!FwgQ2
zxL4{|1TaiGtlx#$0x(yb1hqj64qni8eSX7V4Ruv*0+Mqj<;T$@HOkfHE3}UXc&2|W
z7|RO}>*JHQz+C`q>NezU<TS)RCX^GiID4jBqMv;N=mJ30_Cz4V^C@^a!aNPVp&Wxe
zrZ?UrH9I<fLPlq>q8^(s@i8MO7S=4IOzUy-L4Hd(^pZ(Hw~z$t2E7H*2<Btbb@1v9
z@E+f(ITN)SzSVSzPAU~F89y0qR3IkG*kkhYf4!)AR$8D?cD>fn=kK~&l4hw7QQ*_l
z2QIC_ONC%>h}{1?#L~gn8YcNg^PwN`;1A4C&gzYUKD7nUozJ(Q9pLN{j1c5}e5YDc
ze~?1ZSIQjbC^69i)3z~*sjs9wbP2bj?(mcGFq01Uu-9sU#MHwjv`oNi>Tr@0d(G|_
zX3Jhw%xrZ?aSR#NH=yI@)zKDDY=qdZ3D?PgjA%AjXPktmtZ>dGSfYJwhc0xWG})Ih
zXZ!8%F}FO_`E+9OTS##$U&giAzO+*%nN7nThe5+%1=8Ue_nYIFdJhAi`6PNaGOWu2
z>6~SNo1YqmgLWgR3SND@ThKM_eZC@KN4h}0t*;MY8;2}9pEDl{!bPv@Jviq3-mPx`
zagF9|L%bm%B@VdhLIv0MmxwzTy9s>yg}aDpiz#~e*F~A!>O#u#OBhdcm1OhwLpHeU
z2KUa`*FnCMO%Z28<0cF<-A;rD+xXL*+fe2`jE4jB-ax4zajEo}Wyv?1Z!|ah0qa57
z0PGiR`2gBNOy=4Y<i(`IIC4F&yF5(e^i^HAT)oE^w~zI;M9ji5(H<Od&O{#}9xLQ!
zYG$YqZQoB+ouxt@73lk$Ai1TFE@F`#E<fZS1jtYD$ydfCWZ|j5FU=}8+s8S?O&R%F
z*mtz?o9-^-Dfh;D8rh<lHm8)Ge;{%Zx$<^2P0B<G=$AuDf)>DCQ0}I;m1_RPqXrDC
z;pJC}*C80SbQ6J1lhfTX9e`U{_hb)4(0tDd*#wzgoNwXHMg8eO{oml9d9kN8LhzgL
z)ukkC#8u6QD{B!Re~!WDcVUL1kWU$Nj8{h!L&W6VgAJMJrB**w<mN7$zW1@k>1r9A
z20PLJQO<PR0J@j5T`W-&9i17i@^s_E+4uOO>mv9{ftX~!Eq_?ef+>SpTJ*`SBi^jZ
zOF!;U%4dvJn0oAPIa777p_EN9lXtd?R(4E||1%3Jg5eIqtL~qdnmC~$s3%AVVCb){
z6J6@<ivPHexdj}Y?mNUV&`6l6(*}h^Eq190m=6DHozi1?w7q86n#*uS94f&Lf9CQ$
z02_1y-1K9hpi;bD)p=F^ov1EIiqbHQQZqbxL0*;VWo4FYZ?4@HQ&M@ZGZlwWuNxQt
zH)eu|S1%#<*^n04-5qx==cRp5TcZ-@<2#I2&N%bHW%|0{E3VRUNtgManiW~iri=~B
zzW?s&j@4a`?P;%{nA0fckv!-C8>!f{E%9X-XiE{6h15Ik)&*AYG~T&-!5L15@pt{7
zzODayuSE~NgBp0$FNj2^x)2{;#>+U~M~MZXW(7o7pAp9`5KYiTJ;49mii;>2hXif(
zlqPwKrv3W6(Z2KHvFBTNiGZiSKhab9zc{pYKF~jsZ@uDbZFEDkk8eHxSQYccFD^Q@
z2$W(tIBV@4>%a0PIzqGeh)A?83ly|iubQ9#eH^llsbv7g(hz~|FZp`^4AMvBr%K*C
zl>eEeaC-mWwn?{Ry|ek|cTun2TG5-McLKi+iAS{WKfn;>t(-9ZxR(;v^qhF=8=l7`
z7=PbqQdz+Nx$%SK;=HWBum8SLPS|?e6(qpl?M^F-LIs)-KQW?(7sH=G6VLK*0D{nZ
z`-Lb+yhv}dLvQjL_!xwV-3{Gqv?R(l4f8>?-S+B6HS~I`Q_>eBk0UcaqMyf~2IwtE
zMUdSV`L}QREYAOZxBFi|B~$`GCRryPYM~^qtB0-f$ghzdldStg|6g0y&(mvim0RCm
zXx<(XFezibMJf2Chw}gNOId0Ev8hcj4(|DxD3$Xjy(9i<|M|&Fw`8Pt$aaEWO%nfq
z4mBrO^ttf%i(!)gGo#^8;fc4-i8hhhPslOJwq_>oE<#b06Pl;}-^7Ifbq4=l-$nro
z&X}LFiJd+<M%@={`b1qaG4ZS<a>3~@dTOK8LsJ8CkSAokxl#Pv?L^Pv=Ho&)i%U-r
zIa`^AeF}FsmFRsw7d?iKywm>UL?yzpGoN4d2``Z|ABH3>`8E+91HSgrzFH;xdPd1T
z@eWpUHdFr@ut5a3v3EH1e!&Xf*3-d9m&(zuonBUQqTb&d_J4+yqh1N=M_;kcS5Br^
zcR%x7n?^8M7_4PjvT1oA+@tRZ_`fcP|Ft~$^C;H_1aHOd8HjWq7$PQBGwa=(8kPq=
z7c?`z6^H&VnMgNwU<w}u5b16&dt-5%>V{>I&YGw3n)m$=<3VKQS9<Lcr<6|2M9@46
zM4Z{-{eN2g3f|(0M_gEgGq}&${D<?62ywK>|1bCZ_qxST9Kmt;4Y>%L)cAWcz=)W-
z<9fh$=ho$Ti|KeHT5q$|C0X`Kd-3e>a{Yw+C%fIJ@BeCiE><6!edsxIsZzHP>VA%X
zzs)$7$vTiS1y34UwnBEIPN-OcGvEF>CgRp<8vcDX*^vNbyuCW2P!jPSeWBxcwkLIv
z1Cnc<7=NqBi7Pzi#grOHFD;zU@3QZ3%&WY<xH+}%^~I69$a6ns8%Wa5!*MIKxScOD
z-}u&4aeLxL6*UYiu0&AQl$2QiZpqxxcKOO+Z{=+YT5sL{x6_qf3VX$}P1R4LMl$>n
zKaB<J4)nt!`{{r!9rhL=e{{JWJC_8GfS;fsRkn$#ya4^(seW(IA1W2lu;T|*3Hr^S
za<Tc5o`-vh9B6*>bqP^cl*SQ%j&~+<)VC>RB9&%C#QC2V%jckug^QMQ#(ifY3V7|=
zIL(VwMYZFhTvfuSSlO#upDPsK0#VS2llH%eC-B3I@51ZpR~t2(c#bE(Lgivh-xuLG
zysfec52=1elvf=!^C;<RY`!jW<YBjil}RsWd$g-`)ho!^y?O=Ljtyr->Td4~8zKh&
zrislJ-?r$+U+yD`Qy_&?T~egi<s{&(q!PZ<q7t@q3?G#A9;}z$zWQT|SM;3u0Dfl{
zn%}~k>^nE{sgO5=cRc?mYxk>_1_4m!J}{+19kcItN$<jUAp4A2)K#@HHM;$zQm?Lt
zxx`~taKFB%|HnSo(@h4jv+=7Oms$IiV=8H_U!%ebi;9J>G7G)`4K!deMr%wpsjPi}
zjXxarC92gTMH=^r0@}5%sKx4BUy`9BqIS&{hduS+QKt7K!=CG5T5xK@m~z7^+p41C
zVwWWX-qT22ma-7srwDiEw2Xcxr|O+6|BF@XrQhG-OuQ3~pP>4OdlPSBbWrh^Go{xp
z`yCvx@8YeV`q*V_8Qe6beGDLum1{g`xA+M*Tx|BRn~I3(P8~z*k+$JIiCW_k^z|Vj
zrzK6%=o(1xDfoOZ@?g=2n9$l?Ds7&#$={y~CR89Btp2_~Cn|rtCMG5tGMb?Ehp=<Q
z5;tqs*;!?IV$<zP?*Q3swLhyb&%yrmm#40VgHTV*{lT;TCBwVT)7r**B5?MRX5(LJ
ztT&}qu%Q?0D>8N=gju0)j>52RucT7Eu~0_G<K$9LI|)-mKfb9N!$gjS=E&V#nxfHu
z6|ttLKAq5Wa;cz4Lu%|IQI2vSRHhm@fG^dGSf;4tA79TD4+M-WLu}kEmxNz;D1_Gd
zc2|j?p54;CGNdygjgTSQYCBCwct&p>yE-eS7dd_8ALe-XL(TRDOEUCIA8xa5;dUWx
zSl_nbHsohYcm5w;^g)GNFM2h!UfN(xF3T?8?|g2~?+OWehyV4f<P*`xtLljyf^9#g
z0^`*t{kpk41=o|Yk=Xo>6KgS?)*j4m(6AS)o}eR8>^a@MdKP6V+Xpv(x6j5JMfNya
zEUtNyL+ad5UcCpiUVR@I(5tpE&byoHq0HPP!aUg<#638iQem0ybF}c`pupuUvAqq(
zl0(=eQvIo77P{s4(fEI%{unTR`XzUNv2K@$P3aTlSOQkBM1N)Sw*j9Mo??gWTenWx
zOOzV7AL={sv!xk!qc8a(7e&yoUk{Drh$arDR1*5_v!_eV?)Vr3gx(NPy8a?4EMIsv
zapEn0>*d7)en;`Vfgl)O-ghaMt5<w^syZiA&hz{h*nG^IE2ufCwAizMN<6&Ap=y^}
zFI%0Uf-doJ5=q!!XAJE-w1>J1u|3Vne3gz+jC#`SWo5Fbn)h4<{`~E{)FrJ82nfFO
zHF-4JsXi0PB6xwn%p5Z(Dn(~Jv^*soW}r2SN1)-HuG3(Ts$gijg2^l5^*zbQefIcf
z%EkGORgd$TCW?kxTehBW09jnG$F}nc^!NG><Y8lzt6vbu1R!)Eum5yM+^$1^rG|-~
zb$DsNd^7l3tj58J3MdxB-nsk&eDu|d82fZq0eXMq5PjCj`cuXR_OTA{-KY<@LmIxL
zt1JafyfgO|&R#5HgjH1OI7G9(`suK;>0;4cTW(R~rjw`c5eq&GmO1kG3)yVk)V*8!
zwI&$-r8z<b)8B8wPI>%-9Wdx)Bik1X9w&-J;x(ehMuM3e?CXkEo5i92{XUlhM-K1G
zq@8?hvSn;9VTyTzH-jWjKN&~i+10yJZ#d^q#_1ex>^K3o$MPdL=c*(gT({0VVf$x#
zAeUrmXW8Aj*Fr{OpX7D-51afA?Gl6uA}S(INiTIIc?J37LK!pr$gkz;Tu)M<Qv=a!
zzdac=D{LH`_J^~Y*DoZ4%b^`!RmN<8pLR!E2pH&~1d%!-JoFw0BTJnc=;%`CQRZt>
zPR-oEL=^Fu*=(Nq-UfiXu_evCsl5nG9o<;JVlx#%<h{<}AOgp=ueMkgc`K(umDX5v
zKE1p<>+4SDZ`oDo%q&HXy<gMU>hq(FgVh}6{@Jen{iqMSYc%cYP1;q@q1vI-e%l8R
zjvv|j0cD|wF%rxTa70rFZe={(2q5+5&Rnc3=Xo4K5xbb+kOpb8{&lwdHK*F+GHPqW
z65)3?vw7M{L!Ie9suH~ZBKf*+>0I5PjW#fcgrobA{AC~>yq*w054$|Pg=8IN8Fi3+
z+~mHynv|a0=F)vda>gHR@)n^co}5woT6WvZbDe2Q@@N5hTuy4l0sdfdtoQRs4=QJk
z>_G_}qAFebx;Sf&ff6yXAkgVRn=Hk%Rn~Y-FNf_B+_a+gxzJ)CdTMPqghqF2JL#F%
zo5Z`O4J%jgIOfMYcjrHm)#qN;v0<Y#@VLvm$|3xp-`CRS!rxV&E#(ter${~hkv+Gs
zR<yMds2llC`Bcy2^&*z7Ni1C>8|3{Yfeoh2Y~C)z!K0xUDj##{fcaK(vAmabu&{o`
z+}^p$xJu^KYMtS|xGw^*o_;vXjHO$!e+1tWut1r_Zw`aF9(SGYzF#*_Ebx+=QaSjE
zE$2P034ksAz)J+kOR~O=6a#eqelMoWR0N+x98q19WbD(DSGbT^k9vtF%TD%^^xF*A
zc5F;jszNx%`#>kDJ@@0?jLuUYdiFWa-R_G%4%$+??HGVx-!2Y$B+{N0TIN6~dHuAe
z%ROp`=Y&6S<V*CINh)KJ9yX)MT)c&6LS1D~E%@%@xK&SEQdeYWOHk=8vdrGdsrpPg
zIlUUI1Nq!AsA>MrjQXWeh@snM=9E14BezJCKH+JE_VP9yod3dwd4w2!qQ>0)#cHCz
znMshEs&NwG%D}jqUiqENZCMSb6-(jIYGmfWiOtn31W`Pdh8ZeCK0Ds-@XD!Dz6jdp
zZK3>T$1jAJ<Pe~Lx~L#)c|@r6WLkzYsrcNwd)~Eh+C@%9&+zBvjn^&?*)Jk>3l!7}
zTOqS|U%by1ItU0})tx5|2(G=QI3Le}Tk<>`kn$Nk_tX2Dx^{m+cBn~Z(rPI^(P?nc
zUf@fql-q`405)LH_6SiKcnW$fikaR*O<-etHD6#g5#G&rw|}`VT6l|rCJ!Cvi#lon
z{eqv|uM`5`@}yEZBhJ}Nwd$h*aGzO5OKNfkfwJ!}Phc*iik>EwPrY}HDF_Uje}-)*
z*bTR+Oz0iA(UHs|$_eZxF32uNp({%DG|5gO{jzIP4lRo1MRs!~8WiX5*q>#lY+$pm
z0>)LZ2CBCIRO;l%n15lYp1Z=F7;7)w#bnDnEy||de0&4aXIF1>B-2@HVmdDFI6ge0
z7vN-Vrf>nd0WlTW?x(6f34`s=R(*K(UBWY?Xelc|;Ne5pNbT6(_`KS8MX$8?D5gpw
zPE)yJHMUUL_l(njjnLq)Zo~l{q2z;aFt6rsVkQ+3?4VxPb>Y|B9S<&kCH{0Ax6b(j
z6aP9v)I7Mm3B9lGS;;&#pak843}x`Fm+B)(hwR8tOqzVC9qS;#_+x9H1)>GLg<z{!
zQ!riSv@}@N%G`T>$zSX~@=%g}@HwulhVQ3YkR3H;{+jjnC~uEbx}><nbQ$-BN(gUu
zx82Cy<zTc%$}uIU8EOUnq3!CUqh{yw?^3IV?-wrG@846CYn9Kr<l|i~KVoK`rg-+B
zj0e4*G$3G4Ii4ZjHzWyh7kxiISq0#kh2LNI4v3YqClmp|0xwxtjLAM59#uPkk-Y6l
zw5%Gzh2RXcu;Ya7xSvcV%xh7DCNdretf<s+_>J3Yc2gxDopD9x{8dlnP$O6!vjL%-
zC&asHo%@<0w7(f(*we#XRn~#cd3<mkGd4-jLD{4Id0W$`PV!!DPeTnVt<-p!v;8RP
z7E>qsR>1b4GrkQann&-EV#Y&2-V(DMWrpT$bpJ}vr_-G`Q?!O|Jws7!j~Dd#<6UPM
z!4y8vKDA%<3qZa_<2^zvvhE_nw=C=iKZ}=qXqv5<ux0jr9-UD+S{%sv^g+q~*?~WT
z?gOG*;4gUHg15TPFGk1GT13F3%BJ^ibIk5oeTKex$Z>ltiTl|?V?mN(`KKTs>sj*}
z#wnnd>mOUK?!+I1^RAQE`jWL^`UDRS+uFLG%+pdD4KB=Gu$$TUU_oQIqt}_*IaVT`
zC)vwcq@{rB%2QhdPGk+chz;-a%r|?1xi6-_R(+g!pU_0|x_8Bzx=~E49|<_uJ+1wz
zyv`Q!O%e(OJN--z2jl-(fEUY+$)+Oa7?BsI^u9YMf@v{5Sn<&2`;H!*m<iV!T3LoA
zIn%oFs1M|ru!|2UxXqPf_tnedfF*}+_sH9iv?eEtx9J6KRw+K&3i>i-57<NBD@Ui+
zP=DsaJO5s(H#d9_=7&-z5<v>TO26ZYM-tXE?7cOh1O?+2_^VyjE0z)?BtqGcUr5nV
zC@^ID;g#0k$w)&C#}u8*S?ynil#!2PZ$5TR{)lF7{pCn4&)-D(f-BMTs>j{5=Kct?
zg09kBZ+<5EcOLET6L?s1ZAKjBsut*i_M_p_Ld1Tx5qNK+ocp#zmO4~EHnp-%!^r=s
zazk1A*>m_uYD_$fi*GL7tOEshSl`z&=SMkkXOe5(YW?oqVOJJFBUB~`>S0^oYRoQU
zWDZl5vN)eEvf$~l9o0-yJe$h;J@XO3`w+`~?Qo(c72o=~U?m2l(Z4?L?Pfs~9tqgG
z4AQMJ_rB@yQ1=@U7$|+vH81byQwN{-F6EH<)cBhNk%Ftzv+7*umOA<#gNi<3jF{^o
z`u>BeNUN706RtID$zRFJ7*F2lm8B7A7lgkATOSxnIPB1}oqso*`{ZEEA}Jt}0IwLd
zU6Ulh<)OcSb9|0;kyOZBEGej^>a>rmv)N<0RTg6qBGy#0O9R(V+hvr!h2IPeTU~{g
zkjNvPf$U(%!0S)j8@oKncYCoe=})}-o;)a3jqiG6LKh{0$jqAyyBbQBS<?6}ZM;EK
zVppH&&Sbqe1N*zFk*@a*cI7o$bK4NRTfgWBt*<9uTy^f<G!+!g++B0A;HwS!b~t5*
zM>bAYT6=!Kq^T0|gG7VCi$VsC*LMeIOVpBM^t+#7O76J^gb|CIV<poRYLG&8Fu7!(
z5!*?8B;=tS$zL9@s?Yn{6&@~e-lhAX*`+GDCHCj30Eb?6xeHSY9hKPHcQT*|Y#GS}
z_g=DV`~}F23c0V^tkti?L>O!2L)slEPXMlZbRVzsP}6k=k=<YHl$1V4^=QuH&gJe7
zwrvL|c3bK^U>J?#CR-5e=44nd!APC=@MwmMtFmUEUzwdX9j0^BXeJRybi~%j%Cm1v
zf3iP3n|Jd(zd*LH-V37GM=nBlxx5#h2(1SNJb>6)w$i(>%n*1qQR1Vyng+*9RebYW
zhGkm&39b?4Y@Vn}2J6rNA5CZB)%5$ne^Gb?5|c(nhDg_xkY>^;Eg&@s1q5lN#-^mS
zG*Xii47yvo8$oFXqidr!7~6NB-#Nek;B{W-KF|By*YmorM>anvd_FgTvHsy#g*PXx
z9AiID-p5~T7aGW2l)^6${nwm*HD&J69ZzDu*ly@EAup$5E1F3hrB@%f8|s}WCi0^i
zZvhs8Xfz)Z&hCkdmc<G5-ClSg)eah8<H>z}h#=z4@w{?+D?eTc`;Rr1w6I#lY2&#J
zrzKY59<96wL$8ExR&;(h5;-|vIP`+Ruj^cIyk3=>v!+0?!9Q>@?h?uBy%g}r>x@Uc
zKjFKj`^YQ5y}70p4Su}m+5jlkp;7?weN#2DMHkdI;kP{@HkSBL|BJ%tl2<?2=h%Lp
z?|D|E#JEDQUmvns1aEHtk;tF(L4D*Rw8pI7gApEfH4f+WF4PF&oEt<u-9eqT6BV{K
z5;$0@@2vm>Rtbj_s({qXU+T-G@VYtH)M{tG{@p=&D~1uL{J9J~yp_n4raStJb;K)E
z;}-?DLg3wN9J@d1xuO|k6`vb?y<M2N^i?_d;f?R1ry_{)M_|ItlK+Zo6Lq09DI0TV
z*ZYnqsYzk!ra(K4cm>vtD@;^c3_0%Xufpg_yj^OpYr)6Rpda0fv2UlHx^jZR;u`pR
zUYI^*fO`e-U0XVnk3oG~1$^oE{xQc)+;i`-5E^AFsOw+x%5tT&oN}B35bfJrSY}0W
z+bu11-u(Mo5v4vANXOrME181nhTx@+!mDXl2_(81zGvTmU}UQQ30$$hHckVLI=gb-
zH1;3Woi55;w|ng?2IXjb8d$Y4xUyaHN_RD^@N1kp=ff)f4BEH+?O}W>)ZVC?l<rq(
ziQ*Dg@x$U<A;bW(g)#Rar}Un-wc~Q+*5FB)dE?z%>b)RH&b_P9+Y%3Env$;m!5;L=
z>7&Btz{GLH=f4axu=}%W{_RIB#dh<ETiFk7z8^oI0|%a?PH;)%`Ox@JtS@^FYaJI#
zGGSi}D869~P)ikFUk7Dg<rSM9+xc}*lpC&oZw<svoj;n*pm#fR4?g;t(+s3rG1*$*
z&`g&gyWL)0IhHQ`w=lOhFLn6m<nkjY(Q%FEiqnkQF?j^TJe|(Fi{IA69T*=v8v}+A
zdNK&g_gykVNyi{61P#Rzs=K5S*Z5{fVdf+gc1l-#5Y8^(z`z_}-XTM02Kia7&9QKu
z6(-koZuma(`VdPHRb#l~NKMhP$zqPCz*-Beivg1oqh9I<+}P~NzCH#&+Is8VM55CS
zfQZk`Rh7<n_P1#I_*Wj<u0ba&JdScalZ3y;I^WvNd92udvEWfDP{STkf<0{YA+jUX
z4c!-grypRvbWbMsCN%+mSBLTfDJzjWqcy|F=+*KTLhhWjiwP9lv|Zq%zLQ=%7fH&!
zG8xe7j)s}akZfYT2|y#6m8hPk%NSw!_I$mI=ws)O;8lXA<MUp>-<-kwjPiPOwRB$_
zuX;hSecK*66bW=PH|LFt$|QLS#bt{@Za|nDZmxsVvrrSB6f++6z<;0L$G1`c?@S;n
zVhi$~gvav!A!6U@XRqRdv%Bt3L~Ik#iNQXb#`e8ucG4DC5m=^1FGCok6>&{+u&t;l
zR$vM#JpdN<z*2?QC6qq^_bV(HIyL0rQ!w7sB_}n<lAKKku4|u@0$Qb^tqK+$Rj{ge
z7qMB^54;t5%&m>bBbJ@kUre6t7dOQ|f72%GEZebbUJYAQ`K&#xYcR~i$R8jCDjg8&
zV^bk~GB04<q!A%EZhZ7PmeW1fxIiT|mYVS-nCZ5VD5NaEQIX5k@rnBdCoe`l;Q|4F
zs_|=ipe4Qk${_zMmzR}_xrh=r0kWYrj803TchENFGHfb79q2Y_^jhcBfm-^csmH$>
zEW}5mN;bp>UU9UC8h=-beJVzurV$s=*>)vXZ$$3B&`1rF)adEG$JVCPvrCF&+|vF2
z`a1^qXd?*wc0!aT4)`rw!YSeECdAW$AgOAdM$~31>5CDOs~}D$ig`)pf3TBbvEr$7
zzm2nL=f>IfgKDxME<0HP3}Y0<gvV=03Ad|kkM`#YwPp&qKiG6D_rz&&_l5d*NXgh&
z@6^?WM9Yzv<X9J+o+brjG(YWI!o7CpAu!|KMu);W8Ez5q`fcd|67ZpN)HV<$RrS~b
z=K3nB*MwFZ&p6yFMXV&GhP-g}+nwozGiWT<RqB6Mmk>80@aboXy!%D7vy6Q^b`TzO
zcUbQH@1rFT*a?k48Zge5*L^;L`2vYe$J*V$^O}1k3QVuGm6&v+<MnWBm>1vur~5CB
z9F6E*(!QznZXP@3ftcWBiN}v5ej1Fvp&6#ZrCm@(=EqvJJ*I%`{p9{>J{(jKfDF#t
zz5JQ+t=p0sKt=@VTcjF0PTnkLC{yPSI-U-+N2?LG7ovL-Z+1j*tApu}Z7R~wY_v@*
z0zYhuLE^!2TOv`Q0?hKK9RKOA&DF#0k^qC(x1#O6fcU!@OW>wRt+BCv?&0OCYqWv7
z&C8kgCsXREvadTvYDkGEt1nDH9{v9=04KSe3=^Zmc4n6s%u`mCr?MA=)UaTuRNzVR
zYo=&^`XAh}x4S;CfZLvQi*lJM2Yx?~#}um1o9ng}MBe^gUg=JQ7D~-K2qBoH*sGhd
zGP=(ZmmSvazBfEgL(~JGw4+Bs#fLr3uG0mLyWOk7yWOA+T{+9u7m>Tq7}#b{w#NBm
zMAB7zjV?B|U)By>@~7q{=FZNYF{zso&a@yFTS)^KN48(YFt!XiX3F}Ydrt+;9Fr)k
zFtI{@l*~zhklQGu3H{U^nh)<v2MW9mqYnsZkrDm?hVz#G{8U<&m!|CX&*X;Y)MY4)
z(_HeR965ObfW$0*+@JV9h^TPzyGXnWG{Qr?0I#|JU;nS!cQY6Ts>F4dv8Dh}gp`4v
zGfcFCdHoDQg!=p%Kw3tcA$7VV<2^wg_#h61+lx1Os6l_}SNgN6?`0w*Ywx6Y;GMZ#
znaU{3|M{`b(Z#<~*42H&D4O8jir%zHVkvi!aas&JBNI(h37k3u%#j6QAXn$_)|+14
zeSAr3;dvlj?L1m`(i2KSv*ZcoqCIiAB2`_5RB^}p?ah|)lrK9~KI=F*hwI$y4K~?K
zyFe@RnmSgE<)lPMAopkt8o;9HfQh8BV!gS72m}-E@CZ(fg383A=+0KpXGr}L{QB#2
zjh_`KNE;H=J)$bK41w%EyIIz!Rm(FHxghc3p*y(%02Z0JX2Oe6CX<k@fz`(+NGv<C
ze(C>2C3|ijGV6MN{U&JhCRCTfKq|G^xIKui6f$tXFg2t7+l{QEf)|ryl>3zG&*(1D
znw9fibKog9NSsf|@h$6<^_w49AM=QP9s?7D(OprSMAARZlHVJdMq-;kC6i+{O)w!*
zw8;lHrsSz4DXpDdf_`C+b!b*FPh8+2zR~*EBy+AB%`Z!9y|5(DhuW^}m$Ta(*D@s(
zv}}-~3<#|EZ2!;m_JP9=;+@QB1Ge7V-Oh@A2b8rkF(EE#QPNBrzPsP~8<*ZMsAJb$
zq)nMWN7CJ=xAi}ZVcTfvKWu3Z`b$5-X2sJpM2(*|?<S?SHkBfa>DcV>_jD+thH%25
zj(c<2v8_PDvBJw6K35B*PO&4B8ib0ZUFJ^!R`IYs6>gZhUI+SXj!TgvA}hP5@PWLO
zF(8kQWJ7}P<pYD~wCa(utu$iTyh3hIS!TXD2$9Xm-Y8#{$VkcA*pVuI9$PigKfT&{
zYfbHp>W%Q(H#ZXI<FWtj%aT{I^z0P^1g*rs-?5AJI+*n6jr)Wc9dp&4ry9#9`Y=q&
zu+0gpOcK=&ju*dEf=DaN$d!BlS;kZ?+|ThYhPJ)>tOR*lJuKG48ui9I2Y*(%T|j#h
z)#oiRJ5%tk=Xi_9gTVBq+e|GTj$MmtCItn??J1r@v2eS(#`_z0{9fhve54i+s10L0
z4rfaAvuW||<mR+eEF>JCTOFww;U!HP0ch2H@P_4dY(!Q#7QPR6LilB!g3l}NyEh8H
zjjcM|_KQ+oqvpI#8Z6zn)zmr+QN1hq8m0&Vx-=uWd_hlL(mVM5#XtjnW?tGfJ>6H6
z)65HL14Kr*q?Uv09&X_((@wL3-k(b=E4ZoL27h_CcggcX5bYuMa*?em<pUel{V%(5
z2QKgK&%S3`M$f){v_=!1E;rxqny(iOOn=GauDQ>iE0$S0$}?c|v@uscHAZa0(<0-0
z?_Y^ZOIg3IbVCj1rZuN?pW#a0y%x_b{num$xWZdlV>ka_R`S1ve;d8MQ+sh%F@8*e
z1W(r-hG$txfg*2)^AC>pop)qZ@?JmYU@zGD2i1uqT46orSr!<zYYXyK!gSay?;R`|
zjadl(h51zF#(8Pik~95zN+YDH#EEsJ&*=>AwdY@jJ*r<e(pHIsU+mIe9L5zVAB}p1
z?7)Jxwq!cA{KQabgvC<lJ$mH2ZM?_^mT-Mnck%GSZcCn_!u7>I%$>IW=Z}cl-}>>Z
z(?1K%W4LYp(uZ4l6^L)wR9r7k)u<=6csWb|(;318!;o9$fQ~*hb!<RZd(VRvz(Uec
z=|$dy`;BneKx&U)n*3q=B=VGKSWDCJqVJk7Y$41rq56TgYOs_K+aX;9`B1*f?$nxX
z5{@hNWz-`*=0+`|fXFSEGmU~!%y^}zYXU*#^)cLTM|1f1qhN<PRi%Hheo6kW7%yoz
zDb&+$jlcf|j%)g0PAbV26xIU+R;OhT7uvF$9rE|(+u<k7%e6Nb?l17qg*I5q1ytt+
z9v2MXDE{v(-(qZ)0sM#&khsb|=Ee-ZTnsw+Gba^0)4V}Kj;2+me!N9_h)R$r2o#k)
zbp6ypID3k-xIo5&T1Zm9DwI39V`!wN*1I72lbY@<(AGQ8O?}JkU7a)1n((*Kpougn
z_ZtcS{ARuSA5iZtgmA^&Uxc`~_J-hIi?>Ic1Y2B-8<1>Wo1+GsOpSJi&@R&OHn%4F
zitdC50@J_G5k>1Oo&NG>SaZ$lpR93yFzYw{7T??2vX+_ujM7JLw_7wOCw9HruFc50
zVqh|@i$uOXAhAXtnt9e%iV32x{T#N^UVQ#ok_XioLW0XA?yk*t)>6C(;)Jrh@)esH
zbYHrf|LS;#fL;EtoE!N0sszFL&~H;NJ)lZ4wb51{m3s8adNiyTvqHGMuy{lMNddz?
zb|vx6AVc8`L<u*0ZWLIz<$HCPGm^4DJAM~<KRbb9b7$`UXcWpRz&%_6_a$8=?#r#6
z*B|>dzXWV#g>-yD6d#LXK_$zm8Njd6DBh8}Il`cg{}LVHs6o1s)VxbSW&#=Oeez@I
zl^egp@$YMgSXTF@=?bIj9MTm&uo_juAeam58#L5N>p7Ubzkm{J-KIPiWC;=6j2nL+
z`ziLf&zP((^mSUQZxYC6F-Qw(E-O~r^`7$<Z^qOIGI`YTxcZVh8{(*;^a-haMqvk=
z=`Yr0W<Q)M*7|mmK}*e+;RA{zw~O+OW_UcQMc{z6f8!Lah6eA)mH~bNqFEJB>3GRu
z+jAtaxPKz^OC_a5gwlRxSO^E6`1X8XMoBbv8MYM?m>#jKzQPv40689B<q`<j?+ewV
z!qIdPw3(Uph;toFtX3+y-b2)tUFe}K=-J?Rk5qHhXFn7rKbd)xE}e(iw<2q2_h-Ti
zHudQGSU(vY=XG%88+Nh1D}GveIgPPsfL&iT|EwCV(%wyd-Xk`{nPo)LJ-5~$fmD5&
zzrrGlfb<)H*O>*<=(W>I)CXRm|6mH93H6mXB9Q}>ETX*=V%3ThniIhLKhfPE#~idz
zC1%-l_(Tyym0|Srkgn1jInscI!)ny)yd4vF5(4bQ3)Nw*Bov7igAZ7rWt{r;60)WX
zEBZKb%7}!ASLF_XzO!69%$3`CQvO4-s@6th_(4)_vk(ODgjGS#<*|jpJHE!6%6LNp
z=iQ_7AlU7IXFTy0JLs4NY7f~T*#gz<`dizY$S7~Uxcj|CT3Gmuc(m1K!bf9e+#Wei
z2^iMW<HrEh$&wTNgj)2{12h0&&PRXi^8{|4hXc4?oVSYKoy{eKn|Lzj3bE4fkm;JN
z-NL?|Z6v%JuRpv~^%nz5{E)0&pSPC8Dq-sQ8NAEBb6<FqulYO8o)Btf>rVeC&X8dJ
z-~F_H0{X8f0u93j!Kbq4B_94~Xf$zf@}%mI1b3OiDfVZWT#HTVKunBmj!wcSHR|u^
zwD=JpXPg>D`=M>}b3Uc+f41Xsxu8zBu>16TLhXgvP%th0{WDE3?(wap<EXkjw{=mV
zMh1%IX!%Je2JX;~kjm!<Wz$$ysh%erDYF_IVF4^}DI*gTm|t$J$JsDLlw|wg|EX45
zW9?Bmqa8l_bPxpAY)cims^x0&{Hx~Q)1lcy`So)_ouBnMt^R5LdxCB4FSP9A4&6o;
z7Um(Ag}@$}j_04fq1S6RYDuI@iabp_`Bj#%g)NM*tg_dQUM`k!`OZXhX^Velq2G)b
zemn_i<TC#Dq=P<wSA`+x`1e7<5ad(C&?LPU(=4b*6I}@B;eG1biKQxt5Gk{C$yIRJ
z%s9+#Sm~c_a$Ogl$_dkH_DkEB>7Piu5xu@z)&C$uejEU99!U3X&F9t>f&X@Wz4`Ak
zJmH$n27e3vXOO!wL52xPxh;{b_Vcw+oAFu3ovp}M*^gLW_JrZlw<4!HDS-le<Vrp{
zEBAGzd8<ArTz+g#IaNB{uQ3SY{#ldSA6TnOSqoR&%DqtRcn3i5=>Bv#os4v7Lw1*f
zI_=|o0{3!!#y)VzDy^&vmp7KXfi|q4U;55CdH*>-1*B!0Ypky)H`lD5tGoZ3!*8pm
z0ioVh(B}wx*$*P0Gu_RFs;M41Z;{D2FQLhjdH^A{fBA_gY$J(f70%TDQ-l554_?~(
zVE<hX8i>V~{qW04(z}yaaZNJQgkB8D+;<;$X{7~pKa#L5zBDODsRk9Fwdky;-|ZK<
zHrvY}sEYE7oRWWOs156x+rJvU;K;&g+PK!(=wz+Ax-SQ1m~?!4WSKj$Z$p%6n$`}w
z-Txuj(%W%3Y>}UN?Kwilfg5pqu{qts?crN8Sc;x=y!T_6BbWUIjMVHFn`VH3V!j`j
zt|6e}I>|n3^WP;{UGh1&94UWoXR9jbqwm@R7HCYXdMJcDy!l8`utva%@b8Y_&tSLS
zlAgx;A-(>Z%u%e$xMPb?6@@h&mzFtSD?XS6y<nG<$(zOcGI#h!H{98ouZwk!5zV0{
zQp|&eG9Zyhkp_V0;}jV87P<k1k`B`x=og&1FZ}!QcF6R%(N-0n--%Ha+o5^jdyWp|
zUH5-awoEZ40>V0~%opw5z37H%HXgpP{oLWiGxXgMDk^ZhA|6PQ%D@;%%7-oV+O_1^
zn|_6ks+3a<ZOumZd49`IMwqH7a1s3~i&R-vswtkP0O9OOjn8Z=?+pFY3wSxM>lHwj
z+c?~L(~}3Jf0UFVP;3!k0T!ef8_IWM-K)6KAs|rYydKMy^KV1p#73=lF+bvtsQH=4
ze3t?S*y}+VTe9ivmKz1updJpUDCrS=FwYc|i8*G_2#N7feyG0n#||dChHd4UuYSrp
zt5AD$`q=-~focJxqoGr+=&f1>YA^fOg=i_LR)&U=z^|K=MB}x4##G}UAkp{IE_mzN
zg&vTpBeXn!16TqMDi0D*c}1MJH*9c87<67tQM+i23BEMJgb{<7t+)e+Rxqa`9s!ht
zFx7J6TlXf)VU9-OdIhI`zvq-azv<i8YM)*e?c7o*Z5_gt_&G>6&H1(pq1H{hk=Xm5
z$2VT6=Eazz*~495N~}5No@h0<E^a-nv<^PruyuF-`q=UC*E(Ed%!^+UO9B1b3AgA0
zvXsOyUF+FtI)vVukC@f3QlZlU^JV|HVqJjm4uQM9D;j??T0!ap*F`>-N#z&UK%G=O
zzUb<HcFgr(f-=_j0VAhU@57s3@(}?NC*G)m_1-Y))S>kZ2V}?E*lGp5?a%cYsG%$L
z;=2WPSJml{pXHzE-+6idXy;hJx;IFo(SG)fXV_d}ThAM-W8%|ig$YZHdn^6H@2E!W
z?{wq87cIS$uFzZKP+%Hrkg*ny`-!D?coxnkTBdEvItg|O_27Xp4#Ar+eGNI_=2bP#
zQILM(W0=B@#%qWnXPP}v)xaj*eA0>J950Xiq{n>RUVM>41=oqrXfzX_4qnFE_=US|
zKFE-_N&|p>1m3-=ye>ebu{--!J1i#8i`CenJgmteXChX3KBj|ISmasUJQRQBbV@eT
zpd6S=?PtRkEjXtvgF{njJD+w^GTelcKExA{jdTiN=iFDhFA6XMOUjDN&hyCXY}Sb?
zx({<wiM_@4I=e!w9Abyk=imPQny_E_%e3wF*Jr9G`HxROc?9RP^(L8b*Sh_=$>j6l
zQ3N+PjDljsD=;pjK)`0(r1WLY=CVHnclsZtEC8FE0$Q`L<^v#a!(?jIL#k*{F$6gI
zHuAQtROgD{9GQhLPl=%*9G~>iOh6fynsT_L+cTugnm$lt0E7=^Q}+6(DP<Z&pmc;o
zU0Ff19VT02UbJGFfdzL~d^#`Ze-cw1dIt?`F?)}q4dT+|?C-x}t>Aza4p?VS-qsTR
z*f@GH(cPXV-G=NhlEt~Mc~dAgUY<X{*~rcs*a<K}MZpH=>s`0_p66^dXgvF<!-?%p
zwK8aW9eP$G@q#ev-wV5<^QyhQ(Y9%V%}O1APm4;!Qy1P-pJ#~;5wJFpLCai#+!T2y
zjgLqv^VHxWDl};p>6(IPQgPuu(Bqu44uL&(#ZvG(ubMUXbqf`{<Y%B=ZDxV-Kg17|
z*VXCtWO8^&80@(PZ0+*O>ocLFG3^CQy7m`>e*H_0Gq(0HDp#)<M`IuYa%X?Ip9Zqh
zwJv6_C2qQsTW95}`7@zZnd@lJ=1CtYzf|dAxxysK%3w6ng}h%N*HXvm$@J6eMnM|H
zV?;>hl86=ko}WNHtA4<i@V|7a|7Q7u*Jfn;f^RMS)mpUI0-AWqVrGe|f4q+iL1M*#
zO1~tl#%fHmf$bOgfQN<0<qzZC33jC%ZiTM*E=C<@(4nvC{Br^iNpY6iB;$h9v<Jj4
ztdRz_*eZBK6KzRFLCqplq;JR(iE_oWns%u%&&v0NEo@Gm%`!J?EZLk0XOHX24c15Q
z-NW|Tw@mV<Z%R`Pshv61OZ>`gL_Oa#pG_-)*plykqd9-O)t*_is2E>XLd@PxE9%+!
zvGuL-N`IGv0wRhn4TZN;m0Xm7{LDr3c7Fm0&Q#r)KSD_sclbMbe&}DY9=oP#im4FT
z%V!u%;Pt;D>`K6xerAB~H;tROI6r?b`Ov38e*Ls38=BT1g|v*~KT$V*oU0+=xpZq*
zj~{`5@I5NMg?)%G*UDuyWZ}TS_w1{sD+z&9#T^IS$SfB>*%ucWmL$%Wt(r&z4&$?*
z;qEbQP+S-vVQmhZ$(|r5a{Tl-y0W>zV6=AWFL>iODr{1yR9R~xmTKyW1<tC;K5ax7
z+F;*%+rR(dBA}k<riTlQR7xjCS*zL({#lv;dA-S!x2iiOJ6^+b4nmX=$1n2WmM;Yr
ziFo1Tm(+WHUHzWN-HG8k)k@vB43bP4`wz(U_bGcs)xUUx8nkK0%6f8u16{Bp%)7bD
z2Pflz$m})y>z>O&>31BZW=b{9Qo`>MqqYwh>{a@^22C4w{1?5uTXicbo_%|%*C@V%
z8QLEXn4P-c+0bQcaqRW`4pQBm^WSL}6+<<yUpaX>DoQD0LsR0UTSWzHAL>R3IKS)a
z{t38If)3o}x_;x;DMJP!ZqwKy!w1nflOc*UXtoZ(5F~CrBW-H!@~OQrpaX}E-DBe)
z@6{cO?wWh`^C4nqJq#vPI$(q})4i0p{7{h(*}17_XACPCunx!=G~jDb@7(hi`R&p)
zT^^F%dQj-)gPFV0^k!a|D%LA4CP-mZ!)h05Y<e4yj#?duy)PE1ES;GGQk)_%BrH_S
zBa6Jv8Txb^A;6PmOR#NN^=q=>EiMJx^P{AjYw`y(fc7#m??k0bwO<^s7o(Z@TcR5l
zciyjru;ILTt|`zaJ$O|d{mqj<U}}AA@oSC-theyP>zG`>^PTdC^$H3^yskGl-*m0p
zzbUE6o6^4w+DSqFWPXQs7B<ylkEjI0(2oaC9Qyi>x-WIF-cq4RxG!61|K-qg=7&}g
zB`4$+UO|7+QVjw=s|pe0iw1766(@EFGHnW@uJG&|Kt;IJjtKPzi$o(}`U%$+2f$ZZ
z$q1Kqlvf$>kE~<^t%<+?_idvz{=sOZ-?WHDMiTvQf@owG;3T8r62z9savaaXWTCfK
zOa>jlx{bM?k;o&#TISvIEI%0>V*E_V8dAt92vf*m%!;Wv8#!)BxLy2Nd`<RDIbiz+
zk;V<Bn*l@@V!4kp0fPL3AlUeQltJLbytONyFNsMg3BCT{@Qcp1TeZ-F>P-f0K6glq
z6O%OTQ0QVy`a03S{XT8%Pw1Im2BPmv`;W_p@BCJVE_GUzd#3tEch8VL5y&v%o@gCj
z0!zW4iGoW^GJC;aW9#ZOy1W$TMw(@bjsbV0g4E$#@_N>`$*#-qZx7qeY&TIVam8KR
zw~kPozTv?Yqa7F{_gtD!MFWY~fRnmxrFY-f2ZQrHz-Ji)o-p!t$V1DT|E{fZvD|6W
z<B>RnTsbLi;5r$>gkp2HpHdTz#4vTndpW9&N{>mT0K3wVzOB^Dx{aw}H=4e6zksPC
z40E#ikq)L0g^GJ+hbQoo+_o;TA%oj@`Vu!ML3VZDdL-|G(`+Ak;*p9|QSJQ!uc(Q)
z8Rou?csv!UP3>6`!mZMvfODDbpZOK4(J9V~LBA{VhTe5zjg(kzZy0p*r*`~OnD-&W
zy#ml)maRDkxanfJY(L1Z@MKv(<sxtm;#Pk4)$Ddt+8bRl<6mL5r83Do^<N}yhCJrz
z*O7YiD432<=NN?C%DL3kn|P~s-036ct_=%xy_2@(gcnd1oXZ#oN{eLhz}R?{hC5?#
z;s=AZJK-WL{Q%rig8EI-*lpdl^+Y8WxalKJn9z5mXk_x@2@u1-?>IDf;QkBlr3mZP
zuwOH%PK7Jkglaw{IN(!?ye{uRE{BYFN&T><XdbN>j+04O5y$Y}6kzmRmek&2MMcvX
zknTA_iy@EDX~imN8-Y8iinh_#HlHi;Fp###o)kznuP3xDg5YN+M{Fv)2ug5k#uDYd
z@`zz6mx>uz1?;v9K1<p|2+V^;RnyN;&-H_P0AVaMb}LGMNBg4H+!oANOTuEE2uo!A
zHRfRkm$!{bfwVig+jno+%AztDma9yHv5lAcR`f)d6n+CQ-@oHwv|2!z3}Y0z@5Pv7
z4TbtaQpl+9>vUi^5IUf2IH8}6asG04F(4in_<7fEcqDKOAqrkrX(b8HJ}V8LIs(z)
z)3NSOnx!grbM)m^8PPXo)j>lbA`#BgLAm}baTCNcDWDu8Wqpz;B!Y7B75dWnB4(_u
z`}i^Z8{o=ygwnm1=nQLRH1Bh&K3jy*6r8AeeHFk51`Z8F3_p+aiz0r>l!Z1+gVIyZ
zmp`hHytP2YZLkWZhan@?tZ3KqylO<=Yvt}<Cqw2DCL;c-lv7(Ap0Ng|%oMOrLF*8;
zjYZ7_^nhyiUsM=5$+_||>kItU!r_Va($jTeD?Hb~yHYqi0Q{$m?6LL*P#<)BpmHnW
z-95*l3$&_w!q%;%_50%v^l(BQ5tsoiKCw^kq4LzRMJDV7C<hca%Qspj9Bz&Ux`hhV
zl};EJr+<?Td8XSSFLFRy;@(QLLf(1(DQGi8cc_PC#YUEMtX*y9yj~U;=yCD4pyZ^3
zlZpl+aTUG&W$BfysaR!2m$FQAv6}=QYvFEJL!w)UqheszqmaS~R1IvKd&+}H@zCew
z`Njw6n`vQ~F<-Jt74dApsdC^jCl-i{`-J=azL)YNTa{uiNuIQy5OSJWZTs>r)wW;|
zoJYdewujjT7Dr{TN^w{3)BSZ?XnayXIp~ud$=aId;h2#@<PqDl7zGIe*O?yF_V!?S
zEb$s1$M*&m!Iuf<?dDM4obe~TxF?WwM1erZ{$68lZ7bK8W44g6&k9Ko4f+)c@|wdr
zzc3s_(hUdG751zh;YZ|PNd6~X!IhdNM*cfLirGY)!*3EOq6A(-?E>&0Qr-Y$4fTIG
z21nu_X8rmZU<}%uQIOmDtli59STjB<ZDj{)+_9cs8}Xpf_n)oH&3W^wbRI@Ko(|mf
zSc^;?jPhkaZNZ;7^d1i$WU%ON^}jq<-OG6D{%+LkzA!DA%$QNuBY^DO9Bkyc!ax4v
zLHncj+9{9O&BeC^(<v4j)CSLzqs6})oXdJ#e`1Jk^vX{Tvr0y+3MLi8|6#f+oeQ?i
z1qIpcXkMMSF}~S3D;0_9>c*sYJif0n^M1xtiH(h=$+j(MKrkAwJO(^8DbY_UTC}&&
zt!GC*`DKt=waJF;o+i^~Ufx9B3MIW-5Dd}C$0G(^Cns#*9K0`IQsJDiSZXFoSM1CO
zUJ49NhYDx>bXX6O#o=MQNROoY2OwLVPRjS38;M=emw0vR#$&lx#E>N?k`+EQDZv>S
zh^6+Qcj4DKGuZ9tS?*wT55;s>Owhin@{&1HP8RD1G}up=Q$@3?nyP%87miu^<|lk{
z&`sYr_(gRQ=$R@TXidfoXpr%=DoD@houkw`=LWovNLhhm3?TgST_v}PB>7bFLPp=1
z2kqLCqbF!_CB6Yhg;5A9DI4nJl-WI`a?Hqexq;4$`h#Wlzg!RG{1y*oY@*Zcj5Yo<
zcwP}85?YsUSvTqRxIue!^{0a49<Y5&vAYl>sa5{JfiQe=&7T~_Wwd<EMU+v{N|{zt
z&g^r-sVm?BYQm{Im3g~B?C+srgk<XY$W}@cWERk=5dWFJOm<oSW6hbrr~LzM{U_lL
zxI4h{kL0&%c)+5>^_S6r%ml5y;rQdT!5;XF+u&aQRr3N3JPSp-yTexbo#9`P6<Ii@
z*#dQ|BmLes{pUB;{;I&<OB;K(lk&Oxc=A%Z&&9vTkxzeaojM57<v;E2D^P*g#Op|9
zKFs@$H@1g<6+){LG~sP31%|-sdsZvRQ}1<?EtG-88(eF@lvPD#j*Nm{e>lTR%1#B1
z+MY<Bvjr_s&GoA_=p)N{Qd@S5{`22fcMv$2mXcuu&oMSz5&Ehk0Z2EkKC~&=7wJg2
z#MT!4#xxxIShPLN=74z*B_f9-&|!YcnZWMicg5|>1;?^tAnNh-j1YP>le%%L@8-x|
zf@7;lyY?(W?Dp1dSGIfe^JT@85h`gC6;vj;q=4asVUAKK;4mVQ>529wRvXFGsB+?_
zMCiu5G^xez&9r{N2TTE@kFuY>6Zvx<{~(nlqeNjHg?R!K(4&!CL*|)J#{fGfcTZ%U
zk3IuM6L0ePY0RL8GnzORb-a&hr?m+$34_viZ)3L{^y0=<?kv+s{f36$7<*0Xt4~f0
zen>p+&EkF&cWM_rS^Whz5zeEa#h}pOMmBek0Zpzsc4a*GiI^p&LczoRA70|V(#bJd
zu78t0-L!;4gl66;t3C$_FGtdCXb~7x*!tUh{3+RzoRJ3i5_kE41+two0!;sbQk{vv
z%)fX{9hsniJjI{dtbxdi5?-S6V+byJB}bvXaO?4y6A+VdKvM5B^{Eo9nSvK8c;~Ki
zxB&RFb^BjU6#2x>{{dqX)?Hf$cKnoa%3>ojOyKW`JdN&(dJ=m~1a@4JT7<Na8Utxp
z;K~`D_Na+9m3|(ituviyZA?t8Nx)k<xmP8>T|?4{r#^SeslBc*_nMM8E{{nzl)$Sp
zf8PJt-o@XW)-<1CHENbKwAE_C-1Q3ZUjOl8d9ns}cQg3%>2%7DMdDqVT+OMZC&&-F
zP#pwjTtOK*Ol_XW{ynxU5lrX_3Gb+cT}I^G9;`F0cP9LNwRA=*MAx;w1Vw0`CX;|h
z#Z>6~5$jdGLU+98>%zjI|7qaS?E96_bn^yx27T1Yb@abJ)bYo&)JwjjomlPVhXLnv
zH70A;p8C-uWtj?k20*veK{s5koL_S34)&Ey(I=uz2bah&;usjkk3aF{ts9fS%deZ~
zbNKQwSr_EHg@7k4IE>pw%*hZ-LsGVi2;RGIQo#m~XonGit;Xq+=NX1V_k5;=A^$EN
ze+cieO9Kdk_`j80RhcS_Jnb3d8?tK<#_bL_f)R{10d+%KwfQ$guo_@ptx*JS>K%b*
zP%hLwn#Q?Ywyhb^^o6NhgosndkX2Z(v8tN!M-c_))Q>4y(n))DjkuGsl<%1?>cb*^
z@w@yN0oLK7j)M4Ff>C>G&yHt@)m0C1tnvxX*H_9ij~+h|d*oDh2gT^VR^dh|kg?Ov
zOT86bECZpQYp~3-ePQdfa5R%^)fZhJ64;#GMyn%<0{XqFKSfK~i+KJH&TAi-#%VEa
zmYwP}$iV0tZdkN}r-7cG?|wXw`Ti+(2vl*+V~&p<il43;O)Uuewp(VW#}*DgC&9R$
z?|r`?^}c&2(`JeIz!oVsUm_}kEI?Z#w~&mRL_QHb;rNo45^?w)p9a1hBMA<f*VCOK
zt6Z$9rjT0y8joIl#hF8kYR`4BwcJfBv_Vv`y*$}aqiM@6P57?kRJmojHOm$icysO!
z>suboV<pmoH5l%t)9cq#4pK_)sj$gA_Jtza`IRhoT2KFNIq-~&5R=E8;)zMtTyV>U
z{aO<^_1ZnVzm-l7Fv~jkyFevz_kD7sXO6=qujyA@t}+zIFE95LhD`!?_CEK>298;e
z5TT!rEt-ArZu)eLW}6Mt-S6Z!>JE(8-eX!Dj!Y0p7|$*Zk<{~CRprF5`x-TZWOVNK
z8_a`lN8<`BbZw?5Z|;beJJjO2LIm*%5h&fJte5&wIx6g{D8@C?ggk9I@Zy>S7a}2-
zHq~#``nHjCvN`1_3IHD~#-Y#Fv-B4-@Kp~S<%JKym(E4M{JK1czLs}pdgx#OK5|0D
zM~A+B)xIp624@6!N{_5`rJTo-(6q7`d+c2$+!f-;KuB}2mAS*|D6U_S#$Y(<?58BB
zm4T9DM1q%r%!gLwk9)AT7>=#Lj=(O!;Ve7k-QG~fV!^7b@XJMJdt1ERNGqw!<wsE-
zO9dhw>@=o;EoR^1i$iSpC1$hR@DH@8%dAbT-(4$=uB_E=%ShtBJ+j)q0t;I=wKi<O
z9CCHPt8bQla>j8%T2nV8i2HNytU2XZ_&YD$CAI5wieS7pEdyq%LY7Jq_TdZk>!Oje
z2V&epkP*UBWJf^)6UVjb^QbV7Jc|-Z&(&pYepGKzj;(4=@O2&W;}Oc!Lg{XQP)Du_
z90lg}H^T5Ep!3&9@eLdXqK-=*ZK!h#oLQ(t^@56a%8#d0ZRkrYcNV-F`r28fAiy{!
z8T+1V6I<vJ)fsk?#AWX#(XNqrc`6}W<$@^^Jp9&iy>yLX>qxrvRu{s%Xf%q$g}TS&
z_G+;QssN=;){*|iQL3osq(`<w2&JoipFl7W)<*j3>_u-2oru&5LhZNavvm0l9>vR&
zfTJbA;=0Ut!{`MC<_?BOc}z4Sa&|<<m<RRKIs!t`;41#X`kr|#njM{C&4l9;vz&|m
zTQAK77P26s*ZFRwEFddNlI>CfqIj79(%JumSYNGPCl-}qU*tj+upcfuyRgr_#Phf2
zhSN4W;V~5$7RrDeny8;Ss%wRoOhs*5hs57e^D9Mk|H`FTd|R+|!#f$4wjVKI!ZwpM
zd|6@5<8V>-un)Y#EX>%}yD`KL@71$#g0)g(E<ikz0f=M7Tln+-n6Og4pa%=%8px<)
z{+jfbB+sI<x#&qjzbqx8PKYG143Y}GrAqiuWv57o07$y<tI+fJ34F`VEMx#x8h>zh
z^yCmn?J4jJhuTOPFv#>U5iq>$a$=0edG8mCzlFFxp<UO$(h(sZ^$|yzi$|-c>bm+_
zy7{kwCsc<YQ*Oy4i~1h7Ek25~I{k*^X?|HL7EGnn<hMA)vN62y*e3hGx}~v7az4>W
z^_jFseA<COE2VHY0{Z1JmmlHi6#!+uk5nxoC|<SZ%-|+8@So>9|28@Q8=I}}3N~zN
z@PsX;C!O&hyd!nK@5t0)ATr;NMl}1HtX56oGRxDC_lj~`)yY|&fT2O$`e>^)o&31X
z!H5;jpflOP+x2LvQ1SAvgOdH9i_Rf!GH(Si!!x?7*u0B-oP#vimbuv9Y=@Y&ltmBQ
ztV8#p;PfjxW`7TZSSY9$#nV`7J^l8;|MRf)HxaM?74W>`e@!`Llo+4%iuX+Up3RrN
zE{9F%L2b8d%fR9K`5U_yZlXL4CBlf@jpdwX3(o={tkVZn)kXaK4!EC29Dv@&SM$P!
zwWR5$H<~rTy7g_mfFtM@kzeVtnf_Z-0#7v|c5e-B2YU#}0vZHa-)IUB8d30Hymlyp
zaW)hYvQR07TZ1lHB*9Qjq2xGz_+;naD_yAujg)WtU&PkE<W>aWqZ|iJk-(7CwJPsW
zpbM5PY^|1k#eYRPImU-?>(-cS4kDuqKAU|kG2lnN#f3`T3++1DpP5k@mZXHc5@m?@
ziBJi8rY~YRpR$vFFhQ0R9vJG`X3xp@VcQa}JqWi%Xem9yIegj@rrH|LJZ-aG|DY#F
zWvpch^Zc{=xx@4Mh2*SnMJqnbin@0~Twtfs40k5g(Z6z3)E<K<nj1mFSdRG_3aONF
zZNX>0>gq6sd}6JWroz#7jhn2J+|mVta;fF0wW1061NY9etV*$piN5Ed(N14r>Iv2o
zTAD>l?cG10p}P19A(+i_ho|ACTo(WO9n4b*;-lK-Js;mF``z?k{!g;>jDk!9L>{L5
zGR3m)Eh<Z@x1U}~4cC8gzr+Mqcs?3PddeXN$NMgTd**8-+ZKUc=?@E{RjKANct8zR
zG4t0x^fy&gabAT|X-$jsU$qA4Sx`U4cPKTAydkMap>Zh!=2VU|V>>^I|B;vz8CEM9
zO(2Ec(=zUJ&OupnyoPu5zOc7jCzimHQUw@4uP!v{@=KG`XbSmgJ<@39f@AJnw-5<Y
zi)rBI8IZykCB6#5u{m1>-1CNe;&LI+(A#g|F?PmE3kwwj&~K&#q(tzN7j;lK=sP7x
zBZP-dDI_Z407WCr@)X|{M91o^^FZ#sZ*K3L3R&RPr%AuRl?+%p1@5zS2pP%YBL8<t
znZwSGtp7}*DN$jHagWVV#p~zYTtt-Q`~8568I$fM(wd$Z16@_VvU{Rr$&p^8NMsRc
zms}FA{8|7IN@rpOMtgW<uDQxTNt8cqw3^RLcOa!~MDdT8{ukMS+i?bsw^F#DgF^1w
zl&psr?yW5<>9*J{aD?PPez12vws54)JR1eaZBym6zs#VqJ~k@_Pv3JHZ+p*H%+)b+
zGH@QsjK0EcL3+UAoG>i9b<#!fvFC(sJB(b6XN`Y1aV>Z;IEM)~M@iQy=S<?j?9bPw
zWQPJhihixnli1EJ8Me?rxmVXUUb}B9LeD%_@*l9yi1vEWhIm}B0i-w6c<uGwpx{K2
z_eGBQSWi2tkd|33L9)8|?qldd{y+5Pg@4Cw;Ck@x@u7TGg9UxW^$YGEXaN4z2gZ~J
zH8lQD)Sm%V*uoX?^iwDB5Kps{?*B&iQo_xGQYYyv*Z0_32!Q~7rp<Km(lMzQzrn0(
z@uL!Dd<MAv$fKd49ZwVO*9P^ZEYjV`7gI7kR_o2+7iBD7iO7^l-F+78X$=;FG6oJ~
zuBNZ$n|*)?u7qxvk3O@7>r#PG#oI%l+snS5-kvvEn9$?~QzdjgY7wU%N-x2Du4se9
zoy{+n`uk`=k^`+2XIqeTK2Uh^9a~Pi6<v>KPfmJs(u^;J5obDkkCn>u^%tvN=qwL+
z-7+cK5Dn}(JM&Kd!FHEw{$rx?-1cr*h<t9HuImL!CE)HsaLTY+8K?$%^cnwy1*}gT
z8oqzCaq|O7NtNlWlx8kmq}OpfBpkcqXig@B^Lz&YW<x8~hL>$p@2awEznV@F5@LSR
zw#nb3AJv`f4juA96UP$tYRFy8SoBV)nBO|lI<s```0%<n(x7U&anyiH9XE2`$EYHC
z=7!okg#~^JB18JH0V|T(gHz^pmH#l(v?UVdrH`~8klhJ^zLGiqdToMtwhD}##y|Zi
zzV>Wn2h?`@gPa5|FFY(Uw|Tfgkew^p90^WIRL^2t0&GWDr=E~}dSU+odNk|D9XYn}
z-2jG{$jcb0^Oa7=u$uifbK+yI-3P-`eXnmmVDJc$vp&=44xrmm3_1XPIj6U|k2S&J
zu@l9vPSTE4v%ZFxNtm)7ENs5kr93$CkbwwgGO|wCN<4G85^{O|iE<0Q-r++#%Rz8p
zoO^;7R%>r=@5m#W*1W&cZ#70>9|y0;OK<Tw*aq7zY5lg~4Eb=qLI-DpZS$Y({;U|*
zX6ksQ$dd~?I+=_{&9-0B$Ibc8!$!by9^;WwgR0`~FKpnCo5Y*uIlNK*xF0FgUAVz~
zeUVQR|AFL`dH-i4AuiriDl3;Qtr>xvI=+jEV4eOUzJKYF(P(z224|b8L7utH+<`!c
zAG#~Yc#ZVXd6k>A)c;JZDCH4?R0jZkP7VEcUHE$-+TFkYqy0N+<JozkZntS}tCV_M
z@(ptaC~;?tWPg+x(ZRE`#8fco>NIb^gBFAHAp{J6IXyFrUC=Vblh9;;#-iCr*D>`b
zL?I$T>$;HK)FRh+3XPsqAB{>_+Hq{9V6BZYSFIf+SuJ_mze?r_Rg-EBWMol^tj<Nr
z?lzyt)~i%UA1smpniB^k|1~uY(d(hQ({2<;&?^o|x5+{55NF8D8X@(WS|(ulSEAip
z1KLu_yK<*@p0h&ymzz3Tj=Ow{ZT{Kzd_dPJd8sY>9vLwz4JpE%b8fEi-9uoByXNLi
z$HN|(pE7ep&RsAO3Z(X>oSh3zTE&sGy*d67l|x)Fp>aJSHTYj2qo^Yebsb7G*1MCm
zY|NAGNg}>R<lvdTZ^mYoD#WXb)S#m5?m^IYHd?jfG$B7Gr5AchKErnZvAYS7gEJ4}
zt@G!Dy&Z>bp!!7<d>7^)XNGOi$BQ(UCk54N#Yaalc%6X5T{T<=;Tu*Ry>q3GdqK!v
ze|3}bO1`^#4VQQS&nQ+ZiDQb`NRbr!bw|n+Dx`i;c;-r7vd`l#&lI(*jJ+f9!(FaA
z+cl=@iSDV-X~U!D77as3?GP$!wf4m#XjuhDqLN1cJB^mXlbK^vynwB|z$+DmA@uoh
zfmOo(p`4FZ7V-fa-f8;|6%}F_XYoNQ>}HVyESq)Co2Zn}rf=oO&X*A^H13?_N5)aj
zhLny454+w*aZM-hPK66~d*nOG>B3hxmJd^NE&F!<*e3)|j<0(F4)?|WQJUEYL@rY<
zoa-#Qn3itjJA4gqS^s<Je57}kIte>PeDj|B`relw67ECus`y~)C(G7P-}X=j?Di*7
zm|e@^RC)W=MYQ75#e0tf{iUWf;;r#oDpS&;D`|XlqyH{S`a|*#NVTOIp^6)LYGRy&
z8!5|x%hblo7x>qh;_7~nh-&(0Ow&o(1S~bUK02PGIXf@Y4#1-K(hHkW&$|WB^%@0b
z9{456J!&^@hnd^L^n?|j(YH}NU`t)JZB^c78oIGQMQLu675w@bfCxU{=hF%7gRezo
zpzWO0g<#j0FnI(7gvE57Qiiy81n558lC%_-$VqR>fnP*{`k+02gB7qdCg@04Gas@-
z{Nz`{I_VS}w(s|f@Are-_4?qW2&|4gxu6PedhXZH`iw~F{KBBm2!rJFInPMm9mc@9
zo7ecXzQm}B&)cxhE86E>i60FNE@x-n1u{Ol>`#Pd*t<djMviO6^&ZT&{{mmn*}Q*G
zs@QmI5xzK$*_|2|(<>{hZSN@wta)>|>ssy|a&<nYt=rxtMl!B}n5dY?Xa9y?t^*;-
zLn+bGourdX+40VXr^52|#n8FE%8bVY=5zxkbZxlTJFS&;yT;85^ud=#UM$J_tNCXz
zY%nce0%pDZra#SiU-K9e^J4wQ@{7%fdRh_47dBXd%s-GTjAYdWvLM0gg^+5NhDbI2
zZm2_R>}&2`g=Tf^c%m!n*p5@du9S@RtM83v+Ob*JSo>G&$6Iazbb9kHvg*S>T+4A^
zM9P!TPw}L%h0WiBr`oB89fVO(<@w*$?S@bqaNj%n4qDV74^k!Bry5S3Uvi&TL}DQ5
z%Zjjy?}2}JUyzr4Jq7+r<=ftNiJ12g(_5SC@}TV4_5P?1VX*|+|E+#a^D^hnw256+
z0NUQ@X=-};&Aw5J6wI!9lBYYb#Vv^t*v>D?75lT@lh_~_uCREqt^*f_&2$cXmugPf
zW|VFEEK{lPJ2aGnyIt(m8bQPMD)zTrXLRgf-{1c}Z`M49Ddhq9IZYd<H2+J}vi=mg
z7ULR#N~gXY=Z2fwKJA=UslV<^1#ViI1*JE6PTHfHR7Ws_{cRVE{Hzq#aVG+o|M`YO
z#;~Y870QXqZSu{YXM14(L+I+f053!v#?mbvjX3DHlD;<oYdZiO;dmR1F8pHl<n<cD
zDp8UMhlWJD0SXyc$JT=y&;RmermgfVW$zt^*3s=mcDFPyS1RDVT?9p3{5^$V<qGSs
zte@*_RiLIzX1rxgL+ShKB2~}k*-NIN!eh8;P{eC`0B2_dz=*Z>9TkoE;~zNwIsDE~
z@tj#rNLa>ynJ29I`lhv#f>ZAYMB!3;KmNK)&iws*$&VM-|L5x7<O22XZlX&!3wSWG
znG;)cpu}lK4hngbTq`fSI#z;w?7r270$Eh`iT1M3(Z-ZT2w$h&u5csiz0Ny|0GI4e
zqzm<wbd=i(*9{;j1KtjyhMO&VFOc8<^IB`A{fSbXTd1`&Y&73`bGA4AEHJB>_|WJR
z(dDnPwr$J=aKY42EYNTOLPUzXx~Th*kj&|^2KktiHItYFJDRHAob}b}*SfFW(*cUF
zYgdNSiaQmoVgl=5J|6#u-m>oVV)fwFk7bS1jR-OmJC)5<lD0jgp7VRIDl-R(@nf%e
zT}FdhgG^pli8S|qHBJCN_nEsDfwl@gC_MG=6^-@vn<&zr{@Ny)Ypd99?c`NvW@@Ub
z@2-a(=|#lMZrQycu{28CL$2J|4)zvwy(V4Vucy%>t>Wtj+~$!--{JsGGD3MlQcaRg
zBgEjkw;ScV8@gk<=UFn>7}I4Imi7HG)-iZl^Kq`_oX;H43`xLm(n{Z5AlIs`4ZRet
zuTReC1jAkwpOH1N{74kB3`7st-(jI{{dW_;1uF4I`Bbj$`11H!iUIBqf=3trI8A@7
zw9W^``NF8-Py>^|OTAUW0Mou6(~p>iXZg$~9N@tY1?Yg4E7nNM=<dOsxD211K2w@5
z{0=FK#^z9EX1y`I)-~1t^B#_M#JDld1P*By_$^R)s-0AzfEP~a`Kf*q7hxLLGFy^^
zDa6-V%W9|4_TZTH4RCsc&O$b*A%mf5-=OCi22S;hjH<3xd*v;bsqQgRwpNA2@CDFW
z2;t{Af)$RB6)c78j3F;@xZyI*EaEQfGJVWf=65RB%l)k4m$KXkpQ>6Ff0Z9END{I4
zS#%&OrUHK7raly@>W^p=PHP+e@?XE?fGnt2;7Ai-Mxc5%)m!+Bl1o1xXU>=NpUuJQ
zbgWveXnrPQ5%0plypD39yneA)Hn(_+yZYES=Nh;(wPq?}`xIK>Hr?{7;^|?j(x}gT
zF6-Y78+<TJa;(DHH^x{vPsbUHG>aAl81wTo$@;s=IcC0?lUd8=)tUO+n_-fDY%#bW
z97=XDx;-`VG1}qP4haLI>5!l_9QQ!JHnE{@a)n#eZ>pr`tz6r;1yCn1Jb(eJQvYs!
zYb2;v#9Sz>qk8L~FOK9v#Y?$1r6<AvdFPCEv|hd&JNC3m8L7yQ0wV{e=^TEL!{RG9
z*C8=O+Q5n$Nh1!hO-IF>(FB&4wf0Ap>gk3YkpJWBtHYw|*0)~~rBo0JB}GaY8Ubk)
zY3Ue-M!KcDL_k15x}-aX9EJ|*?yiv-x?$+}w&$GRcg}kb?|bb(W^?K6S?j6wJkMV1
zzLB!U>qm(II!I4=bP6T0Ib~Q6oP}~abZQf>&AN1xIBeYpSC28iTx^>{=aSPY->uxT
zlRSJ8cj@E=eqhRq&A^yvKa-krHGK1|{k5{T7JF5FEozP8^gNLAzD+%x>E?74Hny)>
zZ5Ewjjdp&ffWUgSNg-hH{1Zd3&Nrq-_sIR3^ed|S<UF6<7LL0R){T&T(w6h!_dS*T
zJ9RTM$sB#m?Zil0>DbrjWNv6PPe*TXpxB$u-PXZy<7ZdqZWfIIPRrMfEkq-C%N5C^
z21!_V%_rRp%oDT&2KKY!H>W(#m-A%@`G+^z6(Zy>LpO##Jg{HID7Sfme8+P)bau4`
zg8<sEomkVV^#`T#Ms5RPl#>QLIZ?H-Y^85wxHy2qM(xtZhlta^_yMb7m<V^j#bfuC
zgHMEb!tat?H?RzgL<*$6%C7aVj4!UpmAMYD;cTqx!t+8GHq7prdN*Ha3dF{5{8^5)
zmn_%!d~3PFl`!cCSRGhpH8EEUL8Vupv@A+RbBZ787V8WbKHX2KDRS-y7em{G!I+~m
z79j_Smi^uVfkQG4$XA@Nls`|<8>bnBA=j5dbW%<2^Ffyvj<c?(mO}^BoyZqeITu;*
ziI^R)v5G6Fc7+3K{~It|<U{f+6<O~GR1bFLgplY{d|gidI@dN{N=S2jc<9w>qteI8
zyv}q(3wjH#$UD!P#9MS--9wcKFe~?sgL^4e##n!O;`Fa-bRH{MB`#B;`F)*v=ki%s
zySl^?vF2DD0-Xn-B=1&Y&rI+;9OaCvs9bEkR?u3#w^Zy}OzJpYnsTu&$J#;lzM#$F
zGd#9ybtOLbp^gSPimOq*vD{PqY|!ST#*c{wN<y8NR9(ujuWvdAko5?@1=#5M+w#Fm
zF{*~jM_yRTV>y=*R&&cv??<v_kWuv>C!{owU_E9|=PoaX2GEi$mEO2tZjJ2?Agl>;
zf|kmOi2QnkN6{^5lge}(3*E10^e={{_5ea({gbV7)+#x150;M4Zs=ED=NFTP6L&&G
zuh%P?!J(jep&4pVzmBVr$YNQUQbS@@-XBj-IxxPD+=toAEM&YSKB2i$R2zxNJ<S)<
z0awYjE10L`ljtzgHztN&>|bg8Lhq^B30KhRG5tK;`BRvJ<&)-3j1}9X=aY9rQdX=-
zdJue7rh@qxH_(!{gsPR}#*Lpk!vlmo^(0<1wU_WOn;7O^(I;DD%U*7=HyaS)$l8r5
z7Cs@h3j(tglB}$~Pi8PJ>L%(R>zGlGhCouYaM7H!^v-;f7r~WXnDT*Y@s88WXqDv;
zl*iZEQp!N|CRWA{g*#&lQ7`C=RK6=%aV?>%#J?i!olaMwMt@0czTg|)3Xf6ZDtPSG
z9z>;!`4r9H`=1|8aKASdC-Jm81c409%FEafvjoA|VI-d(Xp;(+G5YFk^HpfdRCIFG
zf&5OgJB=-quZ^9pU(H8Nsmo6jO@Q#@EBEz#!eSj#b8~y0`$YIRKI*6&w&!#&TVG+_
zmGWC1=;IksWZ7sL@~r3MDs7w7_@(lLH9D-XBc)5yaJhB5Ww~v+t(}!LtTN0YxMJye
zC=@a4Qr*tz&eF!mL&yCx1(kp2c*}-eKmd&nmk#%={oy9%xbRo+5ZsxSQ{8R2B|I^t
zmV0Nq%KR`i1i|fT-CHxe+`eq2znskn<u~h2cCh`D@b%3I4?bmv`Ek8qjtz&v1Kdqk
zZtY3u`0E$Irm#e3wOY%>ZKF**jetqM)^RFs&zaLco7A#HpRN$#+-9eYA=1LGy%;vY
z6wfvV!T#>o^IGwbB$J;iY@^LGo*z7$S<$D8J|5@+SNJwz*J1W?7){R6T=t6jIuxPa
zD07mx*L5C%!ri3Q3zI--+)UP8QHMAl7*ttn&pt%tw^Y)##dxor#xU#&jsH@2)}DQk
zBGF<AJnhc2&QQ>}aG_VHyZ(|$1sUa};UN^G5O`*VXV1LeRZBYt=G(L+5FI5qz>YcD
zzU<4S(KvrR-8XL7RnzNkR7&hS8Q#K5eQe<zCm=EL-D{k(P*}}t^7_ITWw*IHK2Uk%
zSp+oet*++IYmfb{cXr>9Vpxz(j(6NS?Nto17!9Wmu}wSaO75WQ|F-{sSOAynOqw>Y
z++V+;JHRuQr*`2y<2YkGE4kKN^6e)c(|3p2Otl-5##(B^ZK_>EdL-Q@PYsro#=_*d
zcQqQP$1ha2ID-kXxa^z>x*IB2U&;Ch08G-Pkr=<PB*An_^sWp@6I$>F6Xmorcc{v)
zW7%=(abEw@*RGu3SAX`H7kTE7-!iC$9?wh~tM<=JOH^WVE5qv|ww`^q0_J+UqkDDd
zwVGGS{?H1B@N)~?Lu&If!O@m>TGChx&1uhe+RcIS6sWLu!?nd>1Jn(Ua!5JrJy`P9
zX%auN>42|3z4Q3!lwsran2cKYbdos45*2*kZ*qBJIrhNZR@YW{NlgH%;q?c>Z<7r2
z?!%oi_9}6l6PiIKj#@8pf`(7^+wpxui_Z}BZk5bGoN1k%FC&awI`-JlB+h+NVfMht
zs6qm|#7V-S)RcbXcO`}A`P?CAHA0-1BUi2MA+IRtC`|=E2n{>Oxo7UPojs@cExgI`
z3(?R4rpFeHrZ0w9x5k<U(IA>fQ+w?0U%k6Uj?MmIf_hif{48sS<0O=D)oP8}c~#GA
z){&rKZ5bf}v>@?gv(u+S@1KK+&n<xetw4@!Ssq?4<LfpwZ0{pWfxKccx=+*fvTSzv
zr1bto^Fzu`?{42N@tQ`p8_6ZWyxUurssA-@T1t%q%_Q-{OBk72qr{*75jQgIpA%3P
zdJubAHCaPbrsnId?BwzNtoI}9eZt{C&gF4<+z-5}xzF}6<J{xiKj~!}9F$mg`&P`r
zr>w?z0cUTdYvjgVH_>g>un@?dbk=>X@_>FD;txi(;0TppdUuFL+*gz?MB9CWAUqp^
zR4tmE$|p;tX~w(11Y}1C#0U%b!TnV40e@xzPa<{P$tvi!!4f=VhTCeU3cB<b^|aE`
zef+p&-$lROIPpZrid)Pof28V(hEeH@%XB?(%g^PebDxmA+>a(->n?fUexp2LlWNo(
zr*2?Ks6KUa{6qC01#~VZw+kC^NeF!doDF{N+kZ1|HKSS!af7%`)#?9^Q=Vic`z5wZ
zX+VH^xEf|zg=md|<OayA9wvBL519S{j+psknl!Ti<1r=ICD2fe8AilEqTEsu5biu(
zdLEPFS_%~QI-6Xzp95&AQE*Y0&LvJz0-ge=>Q@@Va^sekVBfC0pS;m#mVYk4#RFX7
zyycjK!h#j0+X3@5y&7Jg8fQ4>Z)Y8~5P<EM3_7c=)%Rt<Lnl?+Lnb+-pN`*4)w+5&
z`H79}`Q1@9jT<(y5045d|56xZ`ebY=5P8X*`!sIc0`Km{09^#%E|K)Xit7@O6AYDE
z4Ss9Hw#Byjw)tT~pE>vZh0U)-A&LaDII>Sdll~WPvzW`}b<(2HFs+Yxu|rc(_1es{
z)Tzz}#Q@NR2zr@q+Q4tM{#LBLK&Lj3gL~&n&Ol;9an=du%jBto1^rVzpF+*G@~(j2
z7Ydggw`@X&oU-g}{qT1r7DNj&28>^sTqw|x=zt(qk2Ch3fcro?vp|@s;g`e({R1GL
zo{NXBmxkbSSWlj+)pv+T&V0B~`yFfF;usv(^lfqr8385{Hq&-$Vryxelz@Q$^wcu#
zDOC2uk=Z*Ix&h7)uxmcQ%ljmt%kTGv!ucIeOKh6j@BG(IYV*>YkMYrSpgeMhi}~ac
z^4>i*f#y3MfU15jQ^k813R`Gg{ao=tXwy~B#LTMy!*a|Ii~4j(dAy!kkp?98@sAnJ
zv-cE!LK}T#IRWz~q3{ntMH-};T>S(h48|tzZH8+xW|OMwFn0jcySiU#)<;rVV;=%A
zIVNd@tv)2J>Kf|AV?%#%N2KYtk5mD4=Z_1I_(xk2kBY34)QcRqr>!uyhGxdKBvkl&
z3IX`C+Gr5CI=Vnr#6?BBT&?O)dB(rejemW-5ykVi>LDZ?b3g@c)+BJ5Ta^<z`V16)
z<MB#;o>0?S;9>DIx?KEKq}7vVX>hRv4l%0(NcDaY6A>AHI4;BC8k4~L4mVO<#8V+E
z68|t%$~OUnKe_~_Pb2Qo9GaZ|zE^c~hw)gLyU)~RGp`npdp;B3@HU_*@MwH>)(<m2
zADU*R9*h@np}#A!vQHWo=1AWn8ooDS-Bcx=kroY-o@*ABo&yk^M~KvOy}Cc*9E5uo
z2`!Ks#%Dogs^wIeT<7EVkRVmw>u1mYe=hasIsX33!V`UC0%VKY%Q+`!R!AwI*ud9j
zb~l2m*V7dPM_9|op&G1e(2iq~8OPj@`rz9o|63j1V&3gWv$7J?dI2PCQb#8VL1Lmu
zc`B7wNor})D!M8itLkS=1#p^-EH-nEGK1>Hm*CI!j(x5+m&w>A7=QiT2R_(TZ!(^9
z;WtmY7O677tT20<CTb}EUOE<v=LZI`RpHP4#>Gy1yDgZ%EHY%_6)Yd-t7HYGG`_gn
z7~A|19xc|E{8tv!gf~fpK3=4?I^LvHjd#RKgUS$XNtYSgwdgwH(ifwKYF>WBF4eB7
zVD(H1sl*zX<x^9y@t<saAI#Li!||7f*o2p>jy_%-rpYIIPPU?reImC>%_Em6a-%eM
zo(0|DG_Nqbo8h=GRHl1EBwz39pcUDU(jt$mwV})j|2vaB!~7IXCC97@GpW|_QF;(<
zk|qjPPs3&2FxeooByA|i?_nC1cx9-uSCemFvG{VL0<aCpZ}Wvi6Kg(tn+6pUC?Ef4
zYW-((coUB)ANwvzYKB{e+<}P-szDrQMCBcDXlYtM*d7ym+KaYS%J6Il$LOm!$CAp6
z9|=umxu%ilhW9k${%+Lw@H#its`yzlxy&b2;~VIU=X3GT(+`Gon99`x-LVvRGiv<z
zxw!>!G{?cJNqnEmtquMo`~UM0y{SqhG5282-#KcSD(^JFBvjIN74GIKd#dEhNkNQC
z@tE1_j1b^4&O?S^Guyj=E6yf5s_zbnC@!|)-pVgR5`;!fcKY2<dYI_Ozcrhuov6#J
zeBs2U{yW2j2ES3+aC>(Zu~GmYw^eFx;|Pv7@n5JIbYm`IY>p53J7qSFi>5N71k*ev
z563{})eH;KC-H;}`49G_rsIrLhObHg#%Gl=(7DALGlCcn8fk~Y<|&Y|w8tTT<3bG#
zn7JQ=z={s;{hOS@y;ebO(W=Ua44d&b-~QS&*wEoDXol<7@GosDqCEq^7YEtzMi@o8
zwx5OMt-jPIYs6ppp#Qh3a(Mg;D?lY{ck0J^X2@Z@N`}~!+jG#<28YB>DW1Rap0AH{
zQ-#C{RX)U)O-{dC?=x1N{phIwmqyXVLwZL=IodSs-dDI00P5cRu{;K;RKT(D&HQhN
zhkBgL=phG0&N1vmLuMXYfo)DuIZs4<uo%mQ(BY3crFF)~{TzQUA`Z0Z!Bq<@4+Y3s
zj)#%qF}Kva#W)uol>v?Fz(VK0F`hf3x}57?`Ra`ZLglcZTk0%m1>j;EP9yhqA{I?e
zE6w1)^wSv%w0!5qXl3#gbL339gi+<FTa2Od)#Kj;-?b|V!c~SnF*xO5ZI{x`;VgZW
zaUF?Wl`WEy$86Mu$9mo!T%gK4QKIKDQEev<;Adz&72YUO2m$F9-nvRyIAK~acnoF(
zG!3IAfx89YB;&u>4H%p@1SMB02N!ErM_AQ$XD%+jP<kHag9j}Gs1=@csFfK=y6Yra
z6R~P9uJk8i%um$(CM@N$oNleKm~t;D7qDG^>2xx8vWm>GoEhKAFJQ6bG9T|H)sAKr
zagVbuH<Hl=MhRtArtOT0y(PBHV56yI?xtZI*=<A)$3W7W8PU}3-%Onhab{SUIV<-X
z)ylth+Jrh)n~oSoLE7J9Y;T708kxk~z*pZa!T>7lO7}DDiENnyGEu1{z6vd1711(X
zH}gqT$PgPN31w~kfdufk*r$l%4Pn~#ADxb;a%zM;T#bC;ot%UcC-WD&nyO3fA*lxD
zTiJ3q!%&^ZdDQj{2;=6pE#X{m5<dc<$+&XaPs88-@+8y|*t$}o^|At3Nml`shAk7V
z$r^_O#&?5d?EmWny8Q1`u~CAF`K*kf`pVvS5B3uIh=$AuvFpU$R76i>%p4g%c2lcw
zxks9IN15)hdR5Cje|>YgTjP1<n)B-ychzRmg&zQ2SX7|X*kC@ItH)T!C+L2CM!XZs
zzr)-)97G73L)>`A)-FdJYKBqJ-dnOP@?IY?4jK+RqjXu;+xaf?=zDsuya7MVa>mGx
zkol}Xo^#*|plf+-Ug3UEA?<jtMGgSLJ#W3*3lN^%3aW4yP)61gYden#UTg&`h5@|C
zt7Gbp1!eQMYL3+Rjmnza-XV8mGS&kX(d&5*9NxfoocQb_zj^aInTLp{$~;sufC0>%
z0Vl9{<!$g30kop#4(nOLXcgq+%5_UCQE3-}DB=d)pYKipnrHsd@p?C~Q#S)59O?%X
zxIo;@+YAWb1kG4h-YL?kWU;AZb~!{%*exxtQA-DExcuHbpr2Jdi+#RROWCxlN;*;R
zrbj!+IdI9NYT&RnIiF<H9#~fKU8(^%xA`_4_2tXSF2X4hZ1DKKIsv0)AT&`uM(g4K
zW}uTqkMS(KvNzng?ar;g3@{NU^EqsEa%Tixre-OA*-v<7`i=6~eD-udk_-`^`^f~+
z05wWH>4q9Sq5EK~jJMZezd6pV70Z&O*nNj_bZsE7s_JQfBWdSVmCX}c+1+`;U#mT!
z*{X-kDP@6=TET^CR7f5ZdBhl013b(oCp1w2mUB*iWtyLXU{k!g_V`7dmp6NeI6(G@
z+PtM-mI@|jbzDxFDSM^kZ|b6K_Bhu4y&v|bOkt;&f`ZmWt<%8gakf^+pPxk+3j$vc
znVB3c=UD+KpFd-rJ&b;Q);;RPwA)1=(4i^^z*DWu3Y}Fs7m(QqEPfT4`%ZNsF%RL@
zb+r;l28Pt-*ak{botJcre|rK)3}^Ms0^?ugUUhsMlb5Mx2g(@+AoP74KtI(H>s+nc
zh<!f0l|pB?)I}b<mDrbV>F+m3a)=2Ww3b{0OuG&NQqE-+z&U5LVw34@TZp56)&sqx
zZJ3fUz~pLBxfJTrlDRLqx!*>-l$AW&Jdvk_vHrx67iwH>G4UJmU8prnzvEF^JxBjj
z9_80%+bY$UQ^xuR!OxK)WvQ0!wjH5K&u!t3+kCCoj5A^)5Ir(@SD9hY;tLaqnz}mU
z0IYrVauM^krKgGK8GysgR`GaHysa^$V8%{61!BQdEEZUFs?b=S3>l9}uP}dtv0@l~
z_7j78uJPvT`{ke@GHPi~KkQ+!hp1`I)iLQZKu^<2=6A;nCcM|AU-BK`(`yG`f4aUt
z8Hl1pemhCI5!g~AioSEPRUTlmJ=`hczx5E5?u6WLx*JfXA13(DcX6{sZ=j}f-c>G{
zwPsBdu!57<0|0(_b^Xcw96+v3YU4gHaK6Uow2_AhKRCT?C*AENVwwjDp8k5`3c6IR
ze(M>CRk=5oU*T)PyX@HV-2`<6AYc0xFJ5GX^7VRbYFy;(rI&4O6kK5i779ljSU0S1
z7Ggn&lG4Df6ORe0GQ`88GnGf(SNX-Wx<>>=?nO3ar2A>$j?u?8tU9bFUDN_RNXiRx
zh=6TzQCdP{IU(M6zDt`Y4NeKaNv)Tw1qzqm4?Q&Wn*=G?IF86Ty{T4$1BW-B)Z<5U
ze5WnGJdm17PfxFtQl#+zE*IX$*Lb>Uz7ubp++zg79`0dnd|n(;&SZh{U=7zr;12fO
z3xx;TZrcwdPM#V6SWb4^p{+ZVQiZRkTpyXQM=EE|d0q&X4lBm%-PD{e+Lb!M5<55R
zPlSF6oh{ovj5)1|jtQzXFTR3kdoH2huJ(sMeYrP}>lF!+I*|$7X8FrOGoyBCCsWR(
z7vJnP5>9>V1k%e*@I5f*ylyhmfBg!xv_dGlUZE-tq+^5*yX$rvE*hd<fMD0Up2{XK
zabXfKh63<C2>e<pmjP_daBzlLh$D;xE6~N`Jntq=Hbu9_Q1&nr6~<WR%%_z*nOYVy
z(<PBcD;?K39}qfk8ZWBe=y{hZaQIT*1uPNX_6j(|^8;WH%W)x9a(=hSzw3?%Dyu?;
zcH`jpq%FSCxOpA<%m4Mk=sWyqY2=tpWPh@t_@!Uo3u&8)PmAtz4mYtaz90K6ee*kC
zjHe+<$?HeDLzERfVVaC5QMtJnBPrKJpt9UI84;Yz(L|8Oi#gUg%Ii-u`So15+Fia@
zgjr+5dkd_~Fa4TN7X%4&(q4cp=+zgs+_q7+-f!aQf|;WwsDzZc`%-q9+hUkCDCo1&
z!GsWZ$sVS~ePpao;BfeX+>3c;jq?$Pvz_e39s5W+neY-n91r1`fL>un$*G)>TT|9y
z%*>;AnE9atXC6jAN(yIdguT`=tFN>*mh%ds^4)K^A0^p)0oEL-@>SiEeJ74xUnz8$
zUiJsR#^*t)FXM`WZmytk)`q96+Rh7HPW`+&!4-If>Rk1V3c=AzTgM2ml9#q7&^Bf(
z*sBC#uQZEBoXT1o{^aY^oO?vk1XBWMzDctEwT|0NdQNi=I)#6@?YDtTuZjcse|i55
zrRVj3^lR+J*BGUR<M!_eJZeUD3KtrM_9T~;E-PSHSGX$xia#{xeki=093+tZJ*PX0
z+%Y%4>_>X@wzzQ3WQEC)COqM4$BCz#n}ab#ZNi;M1%S;;OBczrM$EfvtVG9MZR&J&
zeZJV{86<a_4Ids?9+dZKg{IFYoB&j1?<C>iA38)~zcD*49Q2c6R&D@zm8e21G#FN*
zSh!wp-uji8CS^oUSOI>l01=PJnxSIB<k@Y!v9aKS-(1761*AT^psiX~&iPt;EiH!y
zai0HVd~Z=X=R}DIa@TfU=TbYV-+Ux^^rrMV4xx-5g|fTgek<oekgdZRk~m0|YEug5
zEu(Cng!^^{&l~_<FCpMRlpq&KWEJ(0Q70ZTA_u%5q<35!lua+WrrM96d9ML8p_@_e
z;*ai;g3V9c4QL^4mOB;XX%MU@z*}#dHosr{XbRqfC$l}Dc@8g-tX?!4>d)AfiKO0L
z7~fVXl(-xTs}$-4c?r78kY1u2lCWH8r*I_*ne%xRnN+pU;DZ@yfc|TO`SsHqEr&5{
zTlkb;oqYArk(Hx>V_AMw2vqN#-=h)vsWkg>2z~I2;DK-A$ZjBlQRa*}yIPK9SMcxF
zm5V-mM@w|&rXVSruIL?9{=I5W&NNobaeU^qn}fA>3r)dbpEjksUY^+{TQ-Ts6L#vG
ztha#cR*y>vv1xa)$~934e#zLb9Nv~I=;r7|pJZQ{`BBhb!+@KVQ33!*m3|-I#x|bP
z0FCO@cOf|FDPw$h6edckOau2}EIa+s_9)s%s<`1?HPj)-Kgn(9*|4KKU9m3)y%cMk
zQt6|!OdX~Oe^X5WDqmk~tvuvCFF<?mn~tY5KA48lF)%v}rcg-hWKNNSRk>~C8E46r
zc-5WEi}Q}FyXRPb2sl@UN2pC?gq}NYJ=t!-6>m2sX3-=7J<a>Rs461}iMp<q<=_6|
zTw8E}uRTRsbp;a-vnuP0vTPH^C)CgHT;!~@9Yzob+T>m;Gl|qO+_)F(MKoRCT68$0
ze?|=FBZhRA&I{$&563aXq9OAKjQb&3y@rTQI~6~3A&m{G9zylmHOk7Rb$GM8z~1{x
zCZtl~UVu=NN@SI2kxpX}<i6=Vz+Gli$Ts4njGlL}z7!_jCWXexBXoVL6exy#v)Zp+
zn!4_sH5SP?G=4IxDk}Pn0ipUf1Uv=u;0^!Uvs3F9T*!udt}|>2?6>c!G%PXfA<}5`
zdQAQqq;MxoO4>u*{PkRWdzIP4oP|2Y$KVKFzmoKB81TMxXKY9q`m@ZnULKP1XuPL8
zc-#JH2;nGvwVowU;NmiPs{96^BcR>^w(vvM<ksCR^%q6VTfU#l5{7L_2R*JV+i-m2
z4;J%zk0kbJ^2?lgd}cMFRZm&Q=02EOj|?|dMGs(u&fVH0_`~NHM$U%Ua?o=R)gMPL
z=3g#G9;A^i;A(Qb2_Yf0Sxyn|JZvmZ_;gQKT5EF*L<EYE*Lxc<X~;`FkmKCd!Fo7U
z)tAT<Yw2~ih;$S8bRO1=Q9gTr4-Xnp#TBfvT?Lh^993|M8X$fWt&%S>=spz#P&@1O
zme)bu65xZ;9Pd&TXcz|%l58c!my`|U7l3-xGCa@1v(?&Mehti!LWajVE_ubX&ntaa
z(%(K6WgIhAVNTC$8ZOidAc-<)D00bJu`72odLMZ-fGSUh4!+TAg_81g0T?(vrO_nO
zb(OORxC+jt?w0!94=WA*J-!}@13OYbrUlgjgi1>vXDZA|5#VM2?q7um(sFtR=Qr0U
z$f#&amrG!;^HO02Ydh;!`>pL`cXar7ArmE(O!z=y>kH{uW&kF2(5cT$@N70>^N`Lz
z7FR#IJ$2E4CZ?HkQAOp=+D%@14qXhG+bh+sfGQfI{Nfuaj{;m(CXS6kRe8HK;N+RI
zwl+yoe<!M%v1o%oC@3aNI+kyaFLoKK_&#7KQO;D9QU^FJQ25>$c|@&BZrVY9@sn~)
zqj?$#;+xLhbkO{@7MUySp?4pccNvuc&X$iIO80<6C51;nMbjNdj@EU8kSTC>#0Zb3
zVIE_Y^g8@}x-U8DWpUZ1vZ%|H!1mPtPSj_c!iPBvcly0Yq%g-L=+Bg+j|z`3tBk1)
z5nvQ&&!i%Z7wQGns+1a;gXg*V5|tzenf18Bm+zw>lpe~*L@j0A<4O<np62QxF3cH0
zo}$erAtLD<Sqd5cE)nu(_=-JA%Q9oL`}Tsg$)NzqW3uHmY<T%zabobv=X+vzW~ap|
zmF&G`+l<yQlN2VCg-?G@-P>bjJ)!y0Ft^sEMQG3yd-3FcMMxfI_6r&0OUd=!-1q6W
zOwtfgfrYbS3NHWF^OsY6?H(*2<g$!j;^@WQ?gmjl-d1BGQTgLH%7&h$9MYqYpNSF`
z#CqtA4H&+ulDW6vQKKH(n<A_Ow^H#d`>OHq;%J>Aher0tYe{#HyvW^m8V_*ph>P~-
zDrC^c)p47T(^xA*#pjy@Sc8K$x;4~|JWyj~Y8VbOZR#+S@DXO??U~9MrWhNh?=vfF
ziNQ0^#KW%N!Sz?bMYLNCyY3=6r;r{dMq~R6lFGaTYjeDr(97^iAy|{5G_1kH?dQVf
zybIGJcc_vTP9Hw`L1ZU}2W&ksYRY-RZmq|BIFo^Q(%%MTOSv+U`u6TbqgP50P5JBp
z+ad9%9x0*d^FbVyit8N4LtlPVJkQkgf{8lXe-JcSF58LzEKGMkbC*_87+=iQBBWBz
z-aD#ff@;_EUF6RiGqN1dj-(8W84g9tg?<957Dm}4E!i`<z!J0E**QO>v*OZlvx4x?
zW;{;r*c?r0yKy#5B=R8K!PYh(bqmzii5m;kNt3_x=z2RnkS(ktXGJ)2T8)g3P`RO`
z;Dim==Nj@~vMS$(lJiqJn)F{5OgHDItE>k43NU<cg_gx?9^7?mBP8yoghts`I<5@F
zcfU;5JVo3z5Ll}`)K`3aya7PKfh{zw`j9H*Mdq&B<?mChr~pg@-HUFJb=B~2YXH$w
zspSFk$;#vTfHT3XqjKIeb{6KY?rzSR2EA)X>;Fv+ns_MgT#kY?<dg-QM}*3oO3k{5
zfg=r!uJg@`@94(`^q332{|egxUL`dt=B?A&*f-q~Y5g1&FTV~H&>q_R7{{B%job5{
z7ap%i8(N3>@;F9;l3XE1ffv<9pVB4hRkF(8CVz-jg$Z9Sh)ubUSC|{C5%&=V%#+AU
zCl3ybA`Z{HK{qXd4s)~*nSt#B*1AuB*vWax!ak*=#&S|TcPL!fu$)>SU)zf@ij7V@
zfo6XlTFKN8Bgg(G7U(bzFuNg@8vvr6XK^=PZq{hUQz~PoDK!qDXys1L=u8e=8VRu{
zZ|K-z=!tI)ZP7?D<ew$HeRDN6xfl5M5;G+Q{&M;S<2xSM=ef?D&-nMl6~w~Xv7S9Y
z6qs<{)VQfQ<}*%ls#<c(+1tu@J((Jrb`xHmO{}{?OmA9P6Kq|HP@d-^sIgu(UiPqB
z0p+Y(n4rUY7Q%LD!^!I;EMZk}SGf9h=2Js!mmVE>&s7(2Ft^Mlx+3yhwfqP82iH)7
zPgmbX7A02wA1WQ=`&#y8P+sjBjRvFJ{;&<HUycZKjSl^|A+eB`lf3*n`lEmSrq*t0
zrQ7`aHXnC_wXMMF56(oV#*2Eo=i3J<X_XBq@;;zMX>rW_<c0g_rqb)eGdK$coj>$g
z4xhQKLa2Z}YJt_p>F|8w#_I4;_=b$Qljdc^VbU(UHFPAYa;HPn^oQWKmihH$htR^n
zG-t}$(TYNt>*;sis}Js5`Y9F^H>WqhlHD*U-S;Bu+x+R$(9rO_|3H8K#~sW!e*m{l
zu5@gfI5HA9rMvEFoHFg&WSmh4+4p*8(ytYH)3tSYXFR1Xb<#+G?0X&=s?PIe439$t
zcz~_?#k~xwqot+yw}04nOZMqgUaYCsxgaj)5o<b0^T%)}uEt~Y#^uGgTEa699;5PC
zG%p1<6c9WI%>EVRE?=(}D6dVmkP`=s)qBky#~ZX8xz{_jyQQfJDl|ikHp&E<*E4l4
zjVsjyS8{!ch)Y$<1E8f>bCO*RJ1iHzC@d|FDU(Z@px{P1%o*>g&nvOIFW4m_Zmxv)
z>0C;$_9<`9ba}k|tsBl_R)ChKIjks{#Wf??=0Niz1mWBw?}g=xPq><RR2Tv@=j69D
z1Uke*fFCT!@c|IYY3JR6Zd~GPC$||?5U9vZ2$eT*?%~m`lsq|(t1YoLd^OCOxxee&
zq4UsjzwD!a{UwsMtik4sa<cn?=ds)?uVdrgJ;%V9bDlV%!+6$La&GEhEAVqYSB#U_
z)AN(tG_32P)u)Sy-G|{JKu5rK&BUx&iJ`Y6x#oIA*rWCR@{TC(YO<T^;rz*Uy+-wN
zgcmpaZpxMV;)eCjvH7&1D=p=pbod8)Ln2lt3rxA*IKCsGRy?Z?wKMhARYQ*6nYp5#
zXX=2E=2LHU`#sCz3c;yK>qZ&NUq=c)MJfB=C@qr@f25Ex1Od3{ynWKz2f-qisKiAv
zsFKbihM)|^amk^W!}eGRz7CKpD?c&!?7J6IQ{Ea(+;~dtzky83V7+o6snBjiouhQT
zvfMDoJRCeG^#Z0#t5$gqcAmwG?F(;}h}6~AMZiMO=(hJOim$l%ZJizYGd+E?=Fv{`
z!S%DD{YjhKK?SJ9#xtFS@&TcY?G$1X`Y@)s2^&)a+&24eUW_xtRF?|t8F+;;w_sEh
zZu><9@fb+wY;h$}uC8QgsQHq9p!Ngh<uCE+Np%Q#^+4XOh19b}u*}xOp|*(d^$l0?
z8R3a~!Aw8@uEk-UE5vRs4P#==letv7c}ywgJX1SSpq8a(O=acE(X3eeUPw5mYrc#B
z!)zOEUsG%4I;L&$Z`!DQFl@^ZtiPPZ69@F>YgMLL+42AFNB?vwbRUAZG5IG<ho=wu
zop#uBVxxNbaG5>gDRdAhoY<lwvZa~>i*26yS(liv)BQ<T&Y}SF{85d^k7XM>;K*C`
zUY5Q;Uvr!`OYl^bfQRSRgwATR(m`s(8@5wFos&%&>+?u4@fDiux@%PNah1dYd|2UC
zAd5yN1^ebvS=y4(#c|)MYsC(Mni07gSNC0U_T(eZ-$lR^;dfE_HHDK|i&5*&3vV&V
zCueOslI-R&N+UWV&|lpX6khz=LR@zvX)W8qgJN12lK4hK`;I|%%5DBoDCPVf>uI%1
zeV4+C`iWHXN9^+kph=0?{bk2xCd@PMY)5LLgSP9wQ+jIts4t7R&5<Dwo};Gbsw!UE
z#XGv1ooIEO-rD}Ql<gv1<afyVcl4=h#IL#x+H}(ZTu-UEZu_gqRqdti=3D6sM0@YS
z7`S`tHEv<<ZvX303Z8*uin0svTbt^G5bMa(;md{-kJN|nJs13lA7DXzkL+QJHbDeU
zZdBGPQMzRw7Ye>BM9SJ`Tc!78xW$dJ6oc|IY4j|MXwu|w#uaOhr#DI34iqEAAwpmj
z39T*jt99*(&k@PdXW7(YTW(Q(#y_@L4MM9eSVohz|9CvFW(Ub8|I^UDo17SYq=;?N
zR9w<szt`zR5t(|~_cB4{9hqaV6oMeHm`b&9=tF2zE3rKf6JvP*%%p(nO1y5ImCra7
zf{q{NO60@xU704#1Kw;8owzlgbo2qiTffhy!_sMh-Q~*TYBP3<6#J$~Ywulak0T!O
zf6DD2BJ_Doe?pgj^Fd7qo4r7>`LbWKQ;|f0Qc82ZWb`=BZ-5<L2%r;z`4o(amc|m`
znh13?jUq%Pw7!pX-KjTK+8<zPybKb%vyC_(uMC?Tpr$<Y=#!);7ltR@|L4;1Z#{W8
zsi9E|WY_H~qEfKJQev36x(}ta1v572^EyNP#C@O0r`pnz&$#vKQ!H4QkL<TiMT8PD
zu0Q;WgOwnZC^M}Z>+MOTb6mE{b8{L-X(hBDIN<!Fz*W=?Jb2t8xbxYip0I?XhwHz+
z=}jsvn;vdHl5f9KFW{cHHF142G0$As-6lD-tk0dBDT_jVJd(YNsV8Ty)_oH!SL2U-
z+*yvdrZ$5kK6Ql;SJ-)}Vg31;J{3~B{eSFf;A#~}??Qv)AcAD(1<zRvs|8B$gA3!-
zGcS06M-Zjj%s2X!@c*|M;vV=oJmHk~gi!ahbQ4-A*Vo#tKS0t<)BBQu{zpB)`l>66
zHS4_8N0e-uJq5QcNcx_Tur`Z*VLu{MS#?DnHVe1Sv7yU4`8F6&mq#ztp@Gw904Xts
z;`4y7@Mq{<3)t`fYmxpBP5gl#6YKpYyRr_+n#k&PRv<JK!;JB&@w|Z5GW7N0Uf>7!
z)g)l;J>>VAY?l^V__CA$u3Hqv5vs1pZ7YnT80}YD&V~QrQ(DQG5#fvaob@X6N1sY#
z>v3GP+<#B^x0RK!U}^%rQ0Vupdz;Y1Vz;@QrDSF4xh9|)FrsNcM5;k0eO%OV&fk|6
z>uH{sy~@)t77&wr0&`r{P2ra}y=QqfycG~f`%_vh>x&CTym-=yEm(NcS`x|e@Y$bL
z^UtZO;i5YNfF7_9^{Jbv;+rH|EOq=c?TcxiSNx6-W)KzT6N5i`6cyIrNe{b;t$m1u
z@o*7bNYz9ey{zt0Q|yn)sAF1Y$G%l;0p6icLW9C92;Q1=Q%PGFgEfl?C3~`N2p|k1
znkd=(Ebpunuot>%3-)?#sd~EOgJV*(n9gW=%0xf^N&f#zoi@KTQ3a6A)@>OMP*zV9
zz^tl~<Kf#GjE5!*FT<EnH-0*&>p(ot5PO*9K4-fw4DFaOILh{kgD93TJxtQm%s!6`
zxn1N|nEyzrq;>eT2NfSc&oI>)3>bFCb7`nHx5@{ej==;RKv@{fHp$#ZF-j)UWzCtd
zEyhY=n&TuJvB_FXAFV@7btsP1{B9d{kJK;Nh%EctO=9tWDqLnPb>LOZOsAttzj!Af
zkehad>csd<t_$`Q(pRvTlf84`=Fm5IIDX-};kh9nO+32Oe)b>X``@>lVNIqvNi{Fu
zn#*8AnswIsJ$dpEJ|899HWkBpy7up~m%~0?(9^QmLA5!LyPufFTK><{`8yj`%Rx7K
z0(0D*=Uh(Xiv5n7T@|W@*n|}tG%C8vZ{LAq*5?JsM}LmyevV{5v_VChgh5Wf+&0b4
zm?n30DA3_7P_QWco%yY1aD%8e>kj*$jlnp6i%*3@r=iqUTcvlXL9e4<@WM42jPfQZ
z(~RfzF>gjDS~b)=aRQb&2TE~07^>&EcdK)#VrjarBl~u5u2Y!ITtHL?S^yhXeTC(G
zT^@Mev6ae$$~68cHETl}Co~>eTX>IEg$X_@B6jD`E6G16P^g1;FzDJPEr#KjVhIMG
z)yM5M16T9NA=}e{0d@CpA@-uA?)&#ksG_D9GN(1vHUE*p|JVF|P;$SHM&vBDkJ4BB
z+^B_5>;}~5GW<|d^jRmJp~D<gq+jDzGT9hxq@XV<KOp1$ZZ*PBjZ}NTFj9nA-%7t5
z2i|PgIv&?6x(?!_vhm9Oqsp3Xl<U{kFWMO`xUHzR%~u^u@oy6l8#|gEmb$rYXIYZm
zhh2z~U|wr4$x+?#qb<bu7sMy_Eo%2HeYS^^{$dE!Y_fyr>nYb=707Uv&VN0ju1}u5
zbT-RO)NbC$x$%P6P~?`-`v9+M!Jjly&SS%_@93y~1>m=^0E)dy9}1AtkDHkXU~&4O
zry6#fN+VE=aS1u5XKbk=LFy`vQOD8M;9j)b;)iNTlY%(;lmL=JPP5`{RnW!*-<rWy
z&Qd&b0trhzdokTJ^T5z~bgFX*<>^0s9x%uyU^Tz3&W3fHvft>AVfAVZ*ie~a0YdGF
zjf4CwaN;g|sw!RF0H$CEWXk^IR-ydiqe3^hE?oM(h$$>vol<@7crl(9*{w)!IWJf&
zHi~<!AqCNwyhS2_sT9bij{Ct9xYT#%jn<OY_{>d$leU?bXlB4S+@)x@>F<v_kJT6i
zO#%<?lOe;U>TNQlC0<zqYKUl=DH3*Ic4)VUMm#kKw8L?`7!B5h7SGjq!_J!W@2V2G
zg+I@=Awd&ORoX70j+A{Ex5a<&CbK7N_G!FFWG<?Zjq{G~+Jgglt#J&<I-wHPn=epw
zf3x7A(+0-`48ApjcsG$emv?(_%3C3;937jF!R%1yW`v3=KkAG~=IVIXo&_)VnQ6uU
z|K;zWoacS&+8gOHw-~p}xH!l{d^GkCkkJ8N0bz|~l#BB1Ul~XDF&y!tE2Iwzj5m~0
zaW#3?pPbI!b&yb{!t`I2_P>5gcj_o5?Wu+@dj*jy#WPM&bk$GJZ;>pAakn}19n8YV
zXcZXIF)*<nYJH<D{MfT9&Pbpjr>+b#y!{K`0^=)`uZ)M60^{2<Ze0nV>xQa<2t?|S
zPu1Ula6Ifim>_cfR@k7(ojq@5b(Hvq9~b*})g(M;W3M-k3W(kQq<GxNY2NY_Y5AdE
zhC*s?cxIwC>Eq+u?e58lo0zNfGlb;2<cO=e9)h|6G@#PBe9W-jdR;C3Ozz?Bzb5r~
zk}b6-vp=$$EY)o8<tC>N^mrXFVzD!opiE7kf{IKFNF??RYXyPTQO96dQu0=VIJKgA
z-e;;H=_-}g!=#OXSY72>BLvIOrPS>)!x(15iKCrR8H81BFw$3~MqY_VVw4#pmu-xd
zuck38Zkx_8PtoVfh1K?vHXp$o?CWV<y!FN|C>pQCv?v}1n{cPnk`=J<L=|LOrpflx
zIp%dyyeTiL(Yb%rw8-nEfIgz{Hm&(UFnhBibL)#sGw1Oi9y18$u5o&hODtKq6PkNK
zVJ9Drvd}6OUC`{Pq<?)bW#b=VVQu5(&^aOVF!BGB1^>%PPcYC}So*5NN7Y8zi;<nm
zQhW@?pU3ZmilZoCqb>qQG2E;o@fV@_2bw4x%anMALt3_<%7dju`9%REuS*$4OL_yu
zjb!FwOp*Upu>G^}sE|q}(<iO1Gof_*_Nh=F|NJY%+oF!G#8MDvv}=fc+S%HBoH5_B
z8(ksUfNoFU?UnfGw+Q}wvMdHmo3xY6by_UuRuczLg-0ynI7}AlkJD9Y-xjoi_9+`M
zNIu+}Y@LXs9gYa{)n^t%tI(8GvfhkENL}Tuan7r>7dDL9z|ePB$LWfQ{a6e*&8J;9
zWLDzGTnw@nxw<r^r(%=U?$f-^@-_-4WMFpAXVu2CaN>M#WtvxB@rwW3t?~nj0@S6K
zBPE{rt`f$Xj${$e%MGF=Mq0;HDR_0gce>J>r73OaI_;AfMl9*_h_g!Iaqd$ejmEH(
zeL4Q{y!*rViR~TfcQK()`?tnKv+Mc=HZRUhe9SJN>WCxIX>W_PC3IL40whomlj@{5
z(ZQ6g?pdl4F5i;amy}2{2j#{I&Sh3S$c@!jyF5WDVc!4`&te`>^Cx#v%PJ$Trsffq
zOGPgl8WO37RhLCqrly=&C!dRv5aoVg=xz6@v(`@ye{q|WsY#=^=PI>usG6`Q?F^xw
zTE2*S!tip%9$C{n+Ws^n(vFk!pjS$+aMXcMj+wzi%k5aBx{i{w$D=#wmogEZp~+hB
z$6}p{A`pYakTAD)SV{s%-oO@CQ9*F_M_$HoOMRnzb!!>)63WzBpA130jFn?VM)hl3
zz0)CLw+ev>vnp!H^m%n=IJS6}Iudh2d%7P#kzg?ozK9*_Vib=Nr_5|V5jSdGXIy|w
z$R+kU<O|EXaM5aJXq4;VK`cEHr?m7V+(Nv3Ge6nH2}sYlzVwS2>q$)P^d@zd-0;u#
ze{k1A5{a`kPsUKXcGa|5PSY%+9JdZ76!T@aN|LLTctM`>xdbMtLi)QYYguZzA&euW
zqH!e$=_<3qlaC`vzaerGew|UaF2LfRMFF!td;ifWntVnK{SB!D8Z?4lHf?e}U1^Oh
zDoQwnQ&i4Z3;hs#H@};acmH_YPc7?bcum0?y<7aEkzpX&ZJ9!$2byTufuCcIxRc86
z^R^;*1*RsHPccwqr-F9wz3aD!le!*C16Up%(_8OcWjFI^TeK~SMG-djIbR|++6%N=
zV(E2kdzrSKqr_vl^UrOzwROHQ5oZxtF!7kirWu>M(@SRML{Ew`ZigEpCk3oGsveno
zY4W3Pi+#F^=qnjY-yHkbai~~?rqb^_guqhxf>wD)@4I-3e&O&iLfk*>DXY5~Z(j6K
z*_bnyI9JAo05S4a(Q8n}6`e+M|Glb@boWek(|?{bRk9f0r_!~j04t4!zpKot{oy!w
zw+EfAy6DWD94gr~B1=VTQIB_AANw=pKEy(4o=oMzd=-3z$&y#-(DlK@tpnu6>diL%
zmROmi2NQq5KlC0A49)KhZU3@2*0;tNyv~`|bA+NO|MgkL*`!)@bJA7Q)c=J^mx%N>
zd%#Apn9@-yQ`krv(XbHoUS`_aN_FX)^=6Ns=@bP@=vV8r?tag2BP)d|SlVcGUmNs%
z7f2mPvBu15E`BYIc67vQa5yJzXC<DHqZWQii}Z8nQ##x_#w<(;{dlhU(DYZbJ!|&i
z!|V<OpmF^=oySHr29mfVjSNrBj<`jhI9tTv6}g_vDQ#%obg8K?{6t<^#Eb^UfWqP+
z`2H4mp=B%BN>j_Z=WwlyAe%?;jbJ)GZQYybVx)PR!<uYSA9Ls`_%TqSJ``GwuOLQq
z7LTk!+|o&5;D892=T-RBu;7+)03)&dt*fRQF}kKjV6>E=0?9CUAr&feZOD|7#W#-N
z1($(uT>;IHxaY{4Z+rs;GHrZoty<q;auXG!a!X~6NYw?Z><_zL=M6<sDBhxOu1e-y
zgx8&Ie#f2C`T(D^Wus}mw)37=_&w(5g2iV1LtgDXxi3#xxX;{W><*z$)2~e-p9iz_
z;gs`)Rktn$cyUjC%!_L)jHO*eh93uz8*s?BzM1H%C8!yl4a=ex%srfqppUgr8}$8n
z`RT?&$5kl0ITB<6l^=Unv`PCx6mo$@1+uS|?d-nBhmY!TM0X4-dQnn(k6OECSk7Kx
zJ^PD<9f`HY8Df+n1EP{@j?&tApH#pn+IjHAu|nIRIh4FUQYgxr{{cq!3yZFdp6g7{
zDAysHZbt%+2ethMG37s8#?7%3<RAaMoYdj!7c9~&QK~&+m>SB48pq5Hev2I=y6H8t
zS2n&?8Qx9UPxd~^v5Zc3)hxy%&%^AWkJxFhvU}0g_sSs$1H_`0z_zpnYa$Le7Pwa?
z@;V9DQ#3rxEu*wZb!ROK2<4N46l?j-ay?$z(o**uk^--JZ6Yh|lplkmU;*ykN(L5X
z@!LhMb`S01Lq<Gz2;C8BSUl}+=BQhlr&LhPdvfy<Ci~2n1)JZCMn~fL1WjR&xNaPA
z!L-O82M}}T#K^!^XX-?NEs{kqNPYLp(*7ASQg`RVY^J5Ha7s5BGM#Z97cg;j1Z%wd
zM7V>m^zP4n;eRz2p56(RA4%kn7glstmh51+kt7Kf3KCa!Hi`dbXgHQlL15SgiBZ>L
zIC`<0GtVtPp@Ve2Y@S~I7LQcewDf<?xef|?s%8mu?W4rW7c3hVkzR}jxlUIRupq#b
zQ?D&cE<a?05AWPo>^(1OM(2*_rp^H+<=A1+5hrVUMXVUuhT4+_YAj3=u$L9iZoEx9
zgw=$dIMp+vGeK;w7*QEn(W~T~(u_&godRXc5JIH<mU1YqzcwN1gb*`kTst8Zh_GSJ
zdYkSmx%00W!UoX~7`OiRcl1Z@O?NzbmwqBdZo<W5+&)5rCFMkOIKr4OA}Q39iR*Ji
zOLy8ei>0nQqYI_v)YYp);-kA0?ehd`bEC7_xYVp4&dY5#Kzl_HigwPQx+<g{x5C7G
z6;C(<R)!KO{;E6_c@ruzZ1#fNbxn{l(PHU5v=Z``xd?+0mzi>fPySn_oSi1NR^CW_
zkmu-TtgBKeX@Bj0l5DiA3MnT@u-IKoJ!_^EOT!Op@eU_4N5yo)kMeC)M+^az(vD`;
z@axUhpd?#R4`+`?k6L*;btKJg%PvsfzIZ;@eZ+8B#gWynpBb>D{~~lOpr4vcf+X~u
z!9NB^x`v5D6Dq6R%@_2PFI>!#PwBV-mF))~c*fa7$dhO)|9G>TPwF)xixGZ_g-6ly
zRJ&OilatCw(00mp&pAKkZgG9&?WLTmk9QZ>uvzBRRw8?v)E(HePiCfTpju2oK6SM?
zp_y`s2jk(f&H0e#ww@dsB!{Q#eC=Q|4nm>`GEp2|g!-p-R_8>2Zjvr7C#-!DYYYnh
zPAgY<)Om2vBw(DUUzvoMbax|h;#Pap8<DU0KP&*C=Q@n8m}2A6O&6O=iwhm~qfthE
zG|9`z(;1@p9Fw29|D{8vZhNpbT@kKYyVEh5e<AM1<9Tc=Y!t(Eu@ydJ{PJT~gGy^5
znelV!TKC=$>5-Yp`^~Gp`UchFF|n4gDWd0=ABrGU-cxvg5pMGF*o2uP9WrMm2qN0`
zy^v{!^!sMG&_O>wA1TJ~(-}gtYo-=a{B!g(g4P$f@PWqJuy{hw>70SBY8*NBq+MD8
zXqlD+oO74Ho^h_bOmLam94x$PxalBQq`dPk2Y99U{Ozp{U&wankcY7*>=lWU9nGG^
zE(1F(bE&E$x<V2sVoC8!9HU{u$x}$y9P0VzYPCS!mYkqx9`b8Ep;WYoS(+glQpICa
zA?slRAM!0?Y$qsTn|2(r==igHvo{Edw)7Fa-x*;Zf4p`xt#E7S3@El~?hq$v4spcO
z3Bod`B<MMCnThk&1v|)+GBG4m%Q#*5Y9`jjvu~n2)6VSqBD*(MYa)^LW#}3AVB)=n
zPxVrwzat%I6^n&daN7C=3#5cCXYVnB+!#@1c~^;e#ut(GUrSY7&*FRP=mKu5+wjyN
zXgej#HL}i3lG(NnT|!#B3J;hI6fKT`{zX_sUF>ojtxvZc5|R>5p|-)K)!9BUuWir3
zAUWSSlDA>I8PBEoOi7Lw+DRAlnFu>k09v?(Qv7vkpH-Pdjs@n^$U|+k*fqkii<PLR
zw<6JRjXoue=s_4U>-?NS(X>;N2_du-PIY3_DytCM3EDide5IX7A2xC_0xgBddVWft
z%dbiKR>RV!_05I0p~k9=`e~dFQjl?T!v=Y!S^FfEO(;ie{_(aSAHS)!@X<q)C}loq
ze<a*QGQOWO;xGI##9N&AWKwm(g_cU1e(MrFS*uDUQWZ=?KH)4?Yw#jkiN1Rh0x3de
zu7Sxi6+t9VQ<gX=DXdvk@|-2jN%Fq<(L)MSr~HbAqIlO8M145#Djm~rOLhfosn@of
z#Gx!BC-OAMDnkCs2GH*a+t5Gjc$FYvTV<X7qvbHtDZkRFi{CTc_4|+5?m)qUSg}!T
zopBy}I!-3RT;_m)am8+69e<UjE*Xio!l$IN8>Fd1k(X;~O~U90-FoHxQZ**sB6_Z;
zN}wDYor?M|Y@f*ouf#&u^i|PnoTq+*%uuDehj>u`ec`|y&opX3Oarq4Z|%$m!K5z1
zMn2pkGU5Ka=5U~UGkhuPToyl4o?kTJh?G*Ce)mP{o@{qwR29d(MK`Ssj_t%N%O;lP
zY9t{^v4O|C*`OCGx22_jpn;^{xQ1@>*;+(=ChS%o^7_bpkfUg(Z$h|ALtI!#<=RU~
z4MJtRZ|dcU_;sklaVMOB!k+N6BBP#GGAcgc6B0W~`6cP<%=bTxya;-Gcv$@Uxzoy{
z6V#r3ZMhHrwZ&*x5L`)BLui@!7lzl2u9*^^iVO;Ul``nDoJ315f&G1yl6E4Tk%68p
z{(}jJmIQXhv|-1E3x(@&$vlCpA~*%99uSdKI53-;CA-cj&3T7WurRarA>&7NH+aBX
zg!JYRG8wFj1QHJat*%hU%&qw3tcQ-tn(WDPm`wgn$jaFX_pKoQ1d#PiY23m$pZ{@6
z_lYL}$ZDPh57blXh^$NEykOZiEa+J7|JC)K;cWh4+Z|d}MN83|Rkc^u-Yr#o&)9p^
zsx2b4MqAY0)D}DT-nC~DBlakQ5J5z2ulIe%@jm@O|KmRLB_ERex6kXm&hz@MX)edy
zV^g&BWZr&PU4uJfM#Isj^=i#8n0^h!bCbZVtDEH#fclL?dTc|%9PX7KlzA`vlUxSU
zS{1_U(?jkQK=lEN87!!}86gnJlV5{Y;jup67c~=4Ta2mHCu^}ood3}zVmFt>ama`>
zy#tEdbC$%Qnp1bsb5o9U!c#O2_QfIx6_;szQFE|eA+D+Pe{||j`dd2Qc<D7_1w`o6
z%F35XlKhZ3uQK|^8q1AO+AxLI#}#4xRv)DG-lP`^aUW$quF1pSwldw)Fc(6NrmOV@
zLoC%8;xh7m(>ku?ff&XhgNDn>`;<8gp2{e0Ga_ZX@HvOeL#}UgiG+svyY@zODn@9b
zbZj~Cm!V;f64lIxL)Gq5s(#WkENE3t5)8)ZU3*RFbMSzVct^B;FNppxd1ifjJfqD6
zh?j2!;X9b?aIPZT5hDTMAW_Eqd+cUnZKMCX9^z<4RP&(`EL5@ih`~GWVY<SxcG>)5
zq|On>*>8GYScOK*cC1YIdG(p2Ub!&l+2usskj?%94F1Ybc7Pdn2l@)~du<scWmut-
zaIAG&?fmKiXL5%*zA~=2-|##C^E;%KHe^-&L(_MKRBYaq{>|2P6q7zME}U?XUan+1
zRS?t5eRY(aVd)mTEyisHa7W7XX?}icFnESmN*{11&`U4|u%e1MMy4~4CCYniGXRGz
zZXrVy>doI37$yS$$Y;k3U<tplKjn3(*M)K$jmJBrYI3hlu~=9GoISUnFh_Bd;(fd$
zc0A1A?l~|uQt#YaE&|?3L`+d;tbBA@l!L2XWpt&r9$y&wV!$KM<!EQbk$FM*&FUt2
zUyMPvsowsTn10`r1AGA<&~W7l!?~JJ{c?T5X)rDN0#@rS6eWCnDZFFo@n2BPA?mXS
zmElx;sF=UBn%pfFaW^g{-$;)aJFl542R%xT3J=M=VKGK5FdrpuOn+qFOLvc|@GVof
zdU)+OGo1uz08%A`<hcIWWSEmOnH|C*QSdS`@sUz=SjcIh)foH5_iXWs(nT9iInp$C
z=ESL;a+JQAjg^dz^7pZ?@{bD%c4wQ*PXj}laHzyUQ0Dcmtwt(k-(z8fpuF|=#tjK2
z01E4G8E<Gm3|vcPtP7@`9>+()#V<>tS1#Lp=Ksj9O+UO1MkRhrP@UNhZxDN_fOBo_
zd&+rE><m-gl1v0V;M#FQ9Tyz`th!C=SE?JS4vTn$K7%a1qGb!=#?81bvSAAjPCMow
z)h_9OC)75G-qFf_W%s2n@^OV?yQ4S5kYH{Vp{^!!Hwrb(J`$PsJ@?z*FG%E)lpD|f
z?c0nM%QaH=zop@M2~6r3`0&ITQSGB`G4EZ+rHcWFG?wexB$bAR=0|*Hq<_;t2&EU1
z#Hs#kzlmhqV_rk5-lroo+n9>yLP{0sA0Ehws%<GO4z#nDNO%^k`pqn5U2={hQ^?D#
z>uv+JXYbeWZUgG>npSXlK}_y<1t~$NRl<x}4HFAqvRIdB?d7d3n!@1DE%m2K9D8<q
zGnECi))}(%BS9Mn1@zN2-u;Le!xj*H2~lk5?KAKC&H0$oNN9$7P4W;rpN3wj9GcyR
zx~f&>df@NXyXHldKHcOo4RFD1m!OYMv5Aej^cAL<=ry{rpT6C<XGbv9drMObemG}>
z;*p>_Cs!t&zFtXBtnqPO6VV8;PdrQH*R(tCcdJuogk|>+2jw4Qm3)w(<7K<GW8BWr
z?#!~P7&|MdV4kMws^OmPHIfL&FDhMl6htCkBXT_xbRjA=srGKsJ6TTG_x|=-nvEK0
zaxK1;|AVJ#`?e(R(WE=@Z2Im+1jxSpx2LJ3wI6rwl|j(nxc&6CYh7elI9y}V6kdDT
zRi`Y}N7K^S*teIqhY@mAX&#OgPxSBK!&F-CxjSJ7=e_td-%P_78i(%X$o!aXoTnfA
z2^#)V_8tz#7>rJ}&&}hx)STz%fzB_zern<rq%3n`7MWZq9Ch!eU~>VE3a4z^c$I-r
z4_9NplCh`Qt18$$3`badV<ei>>_K#UbCvbud?%jsNsEDkVC+{A3W$;-abo<3_@|;2
z@92_CydwS^aZM$*5H_i6>OrS~cjjMMo+qh_g?THs(xl~40t4s^#<3?A%d;GJ^eQv4
z)f?1%^Of@+l`r3)9<Ki(?@WMpvD8F8uFT7t4P3vI7?w_GU{FY?3n*v&TBnYBA9U&R
z?0{$vXSJ+9yWNUI)%Y8W+MKT%n@5-`yaG;18Lj3F7D6P~cA+DLbd_NF(&)GQu=du4
zZ{pXh^TsW}opuu`E9t(LrK3swrhWcNJ9530w}&MG0U_b{a_5+oFOSL8oIS*qw|S(z
zWiW#01>evkYGTmwpQK7}(gSwyrUum4D(q@BohYzGJ$>$R9e@n*gEnp~J+8jO<VGIk
z+TIj^#_hSxHF*i1&;AL(2Ck)rOP!&nO@8NI@UqY^w4AxJ2$Bx*@4=S?tTEdkxjdI!
z{81$7b{4-GOyXCL*U%@$^V9xI*j@bkzSXMs-K!p37rUi{5bElWtO4VU^+Kb<pm}w$
z({(oUBgv_y1>DWyyrC|oGkk0#6{=KzSx}NXYU+;buS|11xUP4-G9fE`GqTy%b}&%z
z<56eZjO`BCv=wsN8qmm`^t#-S23O*;Jbtlx4F;$^O&eKJ`&kVIwq5>={u>FKoe~&<
z7NM;Qbu?zb+2~#<iAJW^V3JN#B(0iM9%vx4nOx-*qdX5xyq+|Ecz;OMGZjmj1R0C!
zd^d>N!ZZD8`luOF>N+mjzR(tq==?x3Mr!>Ub6jdEz&$G8#PbcR*NDfPgq$qjEi+E$
zS_leC8O!=?u_J)0dpj$24PV|R02m6Y2#{vIY26$W5^6vFRbo^+Ai7aoKM`<!<jKu$
zeg5Tqn<4a-$~HN=xn<laNMT8|-K;aF#iSQ<)5O`9YwAUrrbe3iII$JND+DYfnu(f3
z(k&eL&@*R{WhBl{yJ@MVAI70{-ntV1IC&DMPWZI!)w^9!`lcrGs_uMM`sP2s5jjet
zf^f>4ax0@N*k5VQLeHG}-GO+j{T#cf3Za0*CI*HQL`ftPlOIJAE^L2&%MfSV?(VJD
zPgQe(pV=@ijy%gLbyPY6#kkV3SQU*rH$SH;Z&N%pqG~B8jX-WH;;?{gjKfH+H}PoW
zjI9zKfKVm3Vc8eGhd4zy*05NC%Ym8cy!&+n?sfDx6$T6FCR@%$Z28+y_H!vk1uhx>
zOGEu%nO$kTJa|8oLecSex7GrfcTTv-8(?2_y=W`z5#zS<m9a*ox^u0tB%pCBM7urs
z(1R+rVVv8{l;F4Z1P(a`*(>n!w4-Fb9Hem4sY*MJZ|=6%X^Z)@3JEFStbg9Nqa-9y
zPjUOLbeGFjU)%+e%i;al?^wCaCe?1LP(e{*mTbGaqX`m`Vj!Y%{(^P3ue>D}I3i`T
zvFNS;c8|vhq=o?>>ozK<u3_oVywHWy904m0h=T%Jr03!9#*^G-UNy)zLS&OZq3Z*p
zZ~jT6ZALw`aipd6=tBn?$^1f?5&hLP?ae|5DsxalZin&#m3N1404i~{rCpH1ogZ{0
zz;DJ@jvnip(tY9Aqt?tb!M6(5zUigBc8{ekYB^CTX!tgljzAqtV~`r6XIUyE=!^ZL
zvhcYz7!CIGgZGlc@WQHR7bES<3xX2ECznarpZv~s+u*a*WaM@x+t+>@6lCkfPOmB+
zG2hD>eMQ~w_73lTk`Gpztk~m~+WAFu`J(8$@sZx~k1c)ke0u-=)d=we!Fktr1eyV7
zDLbj7DeA``FvEjc-tESVdc5(t)Rvie$&a|TmxlGRCp*xn!-a{NS(sl2wBRQ&m_B9F
z-}G>4Nc>iN#?CcPPSum7BB%EBV0^QEGi?OrW%Wrrmc_{Tn6?FIiIG#2f?^*{KDnWj
zU3J|r<~?!zdNUgHa+GS#8g+$1e?=8vHdwOIptGx@SFH?Ks_P77XB<`DUhoU@Wz*JX
zAs<JNW=+t~bv`uN^ICMV=xUOS%<dd?DOKR5CmUK)oeu7dN&3>ZrTDzMin_*VIc`c#
zV9=<L9jLv-nKxbJReMJ46rE7p;D$Foo!4GR6nfX7p_YZK1fZsHyM#&G%6DW<&4WS7
zy7G)yOb}a&i5x~C0>IlJmR$^aKV|2Bm$I}-w0OxTf$R=SL(fk4G?SKyvPDiNsgw>J
zA^Xx-4r&Ec#Kx~|WDdS9VN22WR~^BTb6PCtw%i8@sFc4ihF(po<+KPb0b4VX=(YfC
zf6s~yhHxl3meb_c`fXLsSI>yAzWWyORO{8gc>nQ!BE48^1a1C_HmNDB?aZ$ej|&3D
zcXk_J^9gTFFfk$p*8wh%gK(HSAL99<J`=kLms4eLM=j2PA-r0dFnF@XTjPuMxHNpa
zC$4Q)TLJ#A$Dmid2Us=XB8fp(*F6?xzhV9@36@`o0PQ~NOvi&!ldI&lR4$6UD!BFa
zE}V=14grf0`f`>ptxIu%yQj1mU4qv}|GHcVWq3^oLS~QbIMSya(HQwFb(;(|{qk!Y
zO`O>hF2?I_I5*$+A!F1j2W172%9D>eX~Qz4{D3&e7DOi**zp*g)x!p=q*WL>k|eu@
zpNVp0{G0RnlEAQ%8krw^Y-aiZE8#SVO&#;R0HqzV5ok@%Vqe-zB_3Ul4|$D$jgNh{
zZpvxRvTP&#x~-=ExRk~V0V`6bng}!kq;Vu6%_J;;$$r-q=>s%RoA=23n+sgQ<3*^S
zD;j%utJ9Lx_)Fxwq<oHkSB0z31(B4u<hw~7b`Ip4CoQ(*`ZQWQBys3pOpMOW>C7ZJ
zBM2<<?s{G*lN&0o(Yw2O5AzTW^g7as8KkxRxZlHlk6G`tE7RifFJWD8gHrZTR>i7=
zF~A*fDYUs93DA?x&KJyi5If}TaD0Z@U`8?0zZ5IBGqDd>FvtxYu=Op2T7Js3!0ci~
z%WFpiHp`|bxcjWjz*kk3RO`SWp<-*WddDlj5ByiQbaNv*Q88voMQ!CQDc=@Y)hfSb
zeu^ekq+)cWFN}=IPamelIBv`gpW~Pv`Zmspo+wmys1|j1(qzBAOlh-RvTrraBwGKQ
z>Zqu~Q_gg??rWQD>{vIQmc}oZQIH)z8Ve9iKAu2I7m+lQpOcnWsUoZ|@!Zdw07e}K
z)?5_GJ4qC;%S@ybFBL*mOb;)WN;k?rZg)`>OFsa}W@G$i2RNt!v(0=dvsa5t!%5qY
zAjZWk^_;r9LLvB(W#n+hUw`Bvmx?qczv|{33Y{l{vU2THUOE3rm74F{IE)n;T=Er8
z_886F&*FY?oi&puv^#KDPQe9_#<Tmi6T*<7`e$QH>>HF(o>{`0+=l3#WQX`@?NL3P
zUI(bBTNB3TXxx{t;Ut<P!aX(GAJZ#h85*%ues0h=9h)VLZ2Ool<<|QI`W(0xp+pF-
z>zz$;0n^T@ltFU$0+y0a=kn<P)&_9$+};)=t@4;tRe(f${;^8;NPi4c#)m20)qy2h
zUDG*Ho;kpK!ZyQVOp@^Dt4rVREV*P{Vn<pdQl{9gZ8}Ha%)ut#g&A`4Q_#)B!q$qZ
zZFP!uYPsIa5!O<3$&aIP6rk1b5HA92#K$@pj|JLU1D<Vn#5g8c>e7u`MsX)m$OPq@
z!*l%3(MNBsCF%pgZIQXwOT|^ka6oOc$KJCis&(s6@^U|ifnTAYhq}t$C<9{u2wMBb
z(xy`%=?>P-9#%&hETr021L~b>=mV8WV~M%@2&=i>x8KfceVM^he4q{a=~9e7aJ2j_
z>N_NF{_&GC*mS3!n)rCgGPU>`=1I{$Oz}qX#9+8uKo~APXt=v^PxK}GFGb$gqp#hW
zU^~hM<8~foZW75tQ~Px(rxo$p-#M%fD}siv5cD`HcWFg-7^F;b`#r-)kIpy`Vv#7j
z?;e>y639iPkLb1)pT{kpHL_|F80p5KuBN+VP@Vy(#x3Qd;B7*%8bQfZUR<f0>szvc
zrVWV1qeclA0`rbDtAOUCh<Lu(z#Q6c!$%w00!t;`rDfr--Z2JcZw791xLI98*6{(+
zsGhuE&(vxo&I+@Sj{#)6@m?uADs8LkBq&DCI=BUF$tR4G&*PV+vrtrn5BDZr@g<j>
z=<erJLMxH>?%LBlu|7PD%+VPITujBO){V^b&(hT?HA*D{&hLxKZ`nA~3_6=ZYW<!;
zwkt8W67T*^ZFXD`^s}&8y#$j?5j21L1WU3P5e0r{y|yqudO?}vaffF;b1Z^C(}NL!
zr1_ag60)Q{S8a3#X<L62+l!kkaTB=q*aVOhM!2!tHQr9Jlxe%QEYJPA?Ndpk)}O&n
zr<@w}!}Rfi6?FP$qF{AfT;NYB)G&0!=ug)diW86s4D0RbGL#k%mJk>HnB3Wg&$ZIr
zQt^~ympfbz;&E2TRZYkH(}_zcr9dy=Rc^HkTy$!qwb%>f-tMbXefYbLX1l4`t9MlT
z!sE9?7|1&UXYjMksG)9_nvT-U%fy`rGBGi_G`C>wa6L4-xMFjKYhQ+KEt~n4^*k0E
zjRgLK-!}6kIJvpfH0PDJf_jw^3)X;E{!UV61)+pI$F$JLQ}h1HcY$#2gKjr9j(SR8
z%?B2;a<SlT#VJ2tf4}n;pYZ8dUk2{Sha5k$0jp+(*amF4J?D!m`NR}=#VpG$n8g*M
z1gPX;aFB6SUOR5wwZ*WTepC2koSzP|N$pGb+RBNXheU)RY9}I>KI7K$c_up-F8MOz
zBY%KVUqNZ<h#YKrkBm}orZ9r*tGl6dssnl#ui>U&tZYf8le+8Y_vR<);!5EK^#aH%
zwt<P=8Ni(;_!`39Sc>uV&aDw%!&EeQ%C%p)z~G{?hXy-*FcdRdr$TEE9%qa?@NpR8
z6%zahWH!HvV{4~E1__#o5bsxs6=A?ULUP(ZEFDMlE$fM`b5joGqRgWg=a%;^Tap-q
zb%ezgUc|jlM9IE(7_x2y3~Hf*xqr`)Ubs9jBv1k$g%h}~wsjn$3>Wzor4y(tcOE^|
z#d)s|QLLBQ3d&2*`6}D$xE7byC2OA5Ybpp`F!XuSaXlPsD|zrH&gf>+TyOoXQUj)M
z7p}6DwM-Nwqn~uCFiuiSv|JyJ%+En2EfQ}XR}&aRzdWI2nM=Dx-mFk0$t*I1Wn6A*
zm3ZkJ-7`f+Y3T52!EX@D=N3d;eSS<c`h9PQQBAy10D3NpWZeQc;{@s3E{^M#Q-){)
zO4IE!DC^Tco&4rm+G@oL_K;j$%#JKe;Ytzc-R1L4Z(U5YlpDMBv^W4p^gsEbj={&T
zrwX=2p5V2W<2U|hWRuI$7<WBdG#S9YIREZez!HMd)VpCu*M`1DIeWL-Cwh^=+{`!`
z24xwlnNAH7C~vdp43pH%-|q~o(-G92Cx2Wr-MN@?NGijzdwvC<>f83Jd2OkqFnT^h
zVj`gFa{_l+p7L9vu2=PQq5SD4@8JHem1v(t($xw0X%30tfG<z@t)}ilzZnl*lzEKq
z)KguVQlPhP+}4{xo4(=ZzxQwW-)j1Up{he17&VPZ9pu}=R~4yoK6VJOK`B-y?qzH=
zERJ<(x_)j|I6PO|dlovXVpF0Twt7UF8Ik*`_&Nrkerd7~hinUPr1Sm2-B=9nvY3nO
z$C8+~*S2~`LG`!VrhmZ%K1j*9T*7zKKtuDdgi<v9{h1u|7pI2HdCPoVKgaH+XUIVH
z=={CWsrJsz-njnEgefCF_rG+GC(g`SE}vlTMrW=Yy&m)>9wh7zN^-2mjeQ9oFK;_w
zUnJ<{deKV6%QBU?V6*MuH0CZw=d9_))jXgZnXWzJafZkHF~KapsJ6GywHqBq@2!i@
z6Dh79+>^VW`A)I-jml|5*QLy1@qTS6Htx6@z9Ml0pM=_RJn)ko&)prls|${iA$oU5
z_XUQuG!EzaRTsDBVGCt8T1(Gx@J<%>vlHQ^U5Sg6pt)q-0NcQR>zhP|_*G3;OTm)x
zi8a}i^=DX0snaY(a*z;-ezGZV6jgD3_jhFsFg&|cRACs@JKsLnvj1d0EpAu%XE1dr
zAZ5ML9id@ZB^<9r2JHIQz9^0@g^t{WkX@}^SASUOCLLi84>sjTMXvi1^x^o)-3hks
zn4J+0|C<o<Q5sqazBJLYy#}u_0r-loL}gYx5r-2x&|!awqnu3b{rAk}1k#)?O`Eru
z5J5>_zfIjn$R5vVkzjM9Dd%FQO7(7GIh+^A#Wyc<#ZTITOL^wz_$1&Nzhrt_ig?dU
zJ^V{0(oUI`X%GB*u5r+8rmfkAv5curDL;_=*6j%yl=eSp`a#k$HfivL*JS}|mbPG2
zp1QlZw)O+1*b>L@N2R(In!}vwGg{mO>{v#ua;yCDpI4?39-`sRHJj&BPx&|kJw5MC
zMhDsuMt5uw))=AuJ;svksgwE=+MjS!6la-&rph^u?j(5?yV1x`PQz`_%rWaR1+e9`
zx4C(_K9m7RVvIt$j5cvktGh1+qNFNMd%Odxv2L2XoR=kW-C4MRwYm>EeP*yAA-%!e
zug@QtTrx#VOa|A?#&$p4PEjP~|KJ*v9-isvR;`g<@~WIY)Ea$yIAT)LxN}Obe8KX2
z(T2|SY<x=-3^gF|p}ZUm9Vr>fRaW3!5=LAZU94-R{<?MPKI@(9?)Ss@!`1o(oFu~c
zeAC5_&N9Qw;$Vom!Pvd84B;TOv~zjY6X}IqHq+cKvemD^Zm0$s379U;Yq%@@^v&++
zK68=XqMedkW8(LpG2z_bWL9;~G%Kyrz-atKx>EflS}_+rb9P@pnDrj0Ug~2^C!-w8
zHHC?G`Af8ZYizBd>@m)0E&PhHk98JRZy4Y*dRk?)+ixP)Hp8>AJ*_T6J(~#5u1v@X
zw86GkJ*p*JPg;0JIZrg8=p|8PXE*{EFM}ro+6d=y94bCO-&<o)MD(X#pqfD(K+?Yh
zFKjbS4>peYqRj&QW97S|dvE`@W|GSr^VbvK5jNM`MF=N^CnVPmeInh>8oPLu1>=<m
zh8e5V8ke;CsPd{6HOB5imsIt_6+|r>P#r4O#443CIg^{5)6+!W-Yz_o9c09d3oYY#
zc~HyU{x~HU%sD>UA7q|Hy4(9w!(Xe|{Lb^?8f1O)1HoiEPZ-1Rt$OapCW)5-oCq9`
z0q8K0=KOl3&mX+}0T>>-yuz2mJ0KUh<WA?NjVVP-RFPw?HdWL_YJv5kz<`UQo%=}}
z7JroJz@_&tr55h)5qTwdS0@PeV6&dM_=sCwn@Mo*UqofNzQ=6E5qpic_?<&C%n91)
zD}7A2D+><;_(&R;{W}$|K(98L{uy;Ls;@Jqy^f~|Np@Sze_*hB^7JP8q>%hZqCXCd
zp2A6x%Z#yS0G8+y7s*PTghn~f<9Oi^%F}t0MWeD;!JH#ANNvw^V#47Gpl-@-GIbjp
z(NRt?0P8gbwyx`#=2Mcpw^)%_zJj)%7hGbgxtl0znG%>VFYqF}-`<?pxi8Y6GxtW|
zSN7F2!Gp|mazBG~dHWV&2KVR-0#%Nfr?;-$#3H>W?+OakFEsZ>W;i)U`n@%MYq%>~
zQ@@#luiy3#4W|S7VNNF2gx9iEuwV!+$2rW?_32&&0_b^Fi7$|pf}a-nOUW*7#_f-}
zJE46QIJ`%%$>gAR_dsk|+~0#!Ly9I`L1>|N=zXm*^L?lN+J5S-tPu|HZWTxFddq^j
zcDl>f<Gb!Hp}uQ)3@8m8mK}q{+`1++t9a&2_&irg<}9j~C>1q(O-+Wp+K+=b*)M8^
zRt3@d5~d`z{T*_?4!8q1frng=7ml2xDFb6YXs#_2&i0%FAY=+18ij?A-L#9Chfvfj
z@j%C|^Rgrzo!D=sRmUg9F3V3h#&vd+vZoDp+3TgCpLCL(Xziuu7jIO~g_h>B08<4q
znJ`y!ZgVy>>^zedFkt?(n-gm<r8(!lvO39m==|l2Z3HXx<VVP*GCycP=E=<kzFgHH
z6)um6Yrh`a8&jvg{BpqIFN|QNq3t=R#8^usMO<V>>(=rsm<Ds|*78Rt2}Z(=taEm?
z25j`v&_>eLu^aAlT;Hsz)aH-MgBCj9mevSN+>W{4jZNi$w7bI_|BJf4^k__ZJmJl~
zM!A8q6|rTxzGV3=NdYL5%R(Xro!({v%FZeYPi7I|Q*hBowRa`cxktv;dUY}RnLW~2
zSut{ME}x2}d&N0f*t1h%7i>gbSXvq?xV(nNy1cv)>@EIu$2AG0ob89!bFLE-Fj?fj
zrsOiKw=jr#@ml_^)Opw%<P{O7{2Il44WQqxpAU>_y>xfw^s0z>^LM~oN^!eL;#iJO
z8y0fk^QFB$^`BQJ@FjTAeQb`#nI=+3<`{o74I*wkT&msSp|8$u@nnY`^Eh9cVZzp!
zn+|ZlW8SHY+M~OopwQkhulB=Ri!KM1j<a>0%dEBKYSiZsmC^E#pUJ)LW9DncgbN7-
zoKG2Y<}bYSTKA0eaFnt+J$2ao&7E=mqvz4ucXJYgzukr$iZ9kn#yq8q*ysQ{k9`Pq
zkWcRD_&Um>bxEpt{E@30lR=z%%B7FYnZ$A}ZOAYC=L|t!33mWc7Ec#GM==lSgq&rc
z$J|54(TYJ#^$ZN^38=yV&IWYMl&aBg!)qI6t<mb$Jc0Keopb`GO?5oNH&{X@&9rgl
z1Q<#jmiGQ^@72B);mP$)fn*dZNGTg8(QHFSt3{jSKe(g_%$6|xhnP=a;!gb{H&I70
z)n&r;T7Yz6?D3jgBoEI~wl8FMH$!)0BXB%}%Vv~&Cx45>u<Q8a{8|}^w_3A;D&gDF
zWV*fbjW<<C1RP)_uQSfh#04oSjS{zTiZG<Zmb^0yh!Y+aJ?lV-61Mnfv=(XH>G89a
z*#08E+`Hg0>I|}6y|P@^ZJ;{0_<h5)o?jQ!i)RD>1QEMPI=XOOAR};sLIz`CCIUl4
z#r<n~zm@C}OEr<a6c4}pjb#SDzo10J^%MP{dHjmI2G0elzb@I>aa;LH<Y)^wey(-l
zoAeDUq`0F4$U^B?#i!FxE(>cFnV~foiy1>STeK;%z*lwMG;n?~@3QOq=M+>{|6_^#
zSJps<?3rKMs(%{F=_}07sJ4>N*GmGz`1RqTNhH<TfJBdG{R$f9cVU%LfBrV0B>U(U
zEkpd-+S&rG(k0}6k?GGZj-(|u2IyqQl7Z_V9<?i-MlQvs*tr7!cV6+UO-As|U<SFO
z__dnZnKGQWY>9K!J=*}imX`M3KH&(KzXSIFc&SqHFKv<&+rmMjG3CmgTH{gL&erVS
zc2wo~Azc$zbC*tEp<|N|wHG^UI*bh9YV!)KL-m@zJ;GBy6*vpEwd(c{zRgjiv3dvp
zDz4Rx4zriRSCnAI((shz?uaB@SqkvBO@pdhCxSXNJ``k3j_?_{P%ZCe02-rb4~<fp
zw{R05a%xSbW_Sj{Vj|p*`vm{HeC-e~Z%!V*y(7pVKIN;{-a6s=6`M2OH1_JO(Ka!k
zIK<H}gPLk@vl)xxUQpF1BJ}&4xB1U5xc_Cp1W6O~6`QHLg*?hsg+GS}h#>JTZ0tqA
zlojg3!IdRyvZ{m+H&mg;(5KDWeDUe((-BdwC9ZMFWdCzB{Lhhofmbx<E&7Wcn`OXq
z*uO6UX2rhP$bN)9qh9cD6tj4CNeP#H%vVB|r<wflo=SaPn!1)J%5~ndS+;_Ge8c@0
zZxdNl)4^>{&VOq<3{UzitQ43)tN>2$pT|wzsPja5+2gZSc{G7O7dLeZDEK&ZX9#q&
zD~OWFlnXje<t6`4JpP9)Q#bT8UXej+suui!448drx886yq|x4x4CuiqDkc0*yv|u*
zbIlzjV3ufey#0^0{~snXotG8AYMv+ADx+`4Vmo^(y?du#Xe7S8(SfAZ*33v`^+x`k
z_vCC`d|uAi1~QaHk^Io$p%y!u538a8`r);KOuwv_97;K71t$}Y`WYD={L6UXG+MU`
zu(-zhG$X~PmtA_)9-E=wGUp5B!)B#``6x6Uf+CQ;5mcF?TIulPoio?9oBy-VdStJV
z0>57~QyOKo@wlSNZBiMM?w0??7jeQl@bX_Q01$%U7YWt6zGKk^@n_m7CpK*EjUb)|
zSiq-}56-hqR3>3JFRRrF)NYrEZ}2sech_P>$rlYpJb3mmKPW&TpZA86Nh(69lyEzE
z@hezV`x#7cOS;Qfy@YaGc=-Xi$O%3BoOhWM1s*MB=z(g%{yeo}BRQ_d_9Q}$@wtYA
z2N$)JE|tJO&I!KDiQs=ElK*o&BR)^kM6qlrsv-ru8aduF`v6NzbMUc8^m^aJq9Mly
zBvi1t`@5snt>_eM4tni=4}`|f))YznRK7L)lpfVHr&$@h!LRYnwDi6IV%ueZvOj}}
zbrL66W8-M%);>zNQ!?&TT*}y(1m^6XMeRuD695u+WFbF&HMXR4`$nhR(J31{uZILf
z#0%FAC^EED^Go1=z6}*~VUeOa0ovyUY(6ms;D~=y3iE$ax794F#02NhcY_|{W9iAl
z9bIAJFJ&c5=|i|Dx8<}X%Qy<?`0WBDH`;6yxq1?K3_q;{GB~_jN4#Ugj3-&cz>cga
zYjC_y?45tJKhWOMv}KPf)}?>AsyL{+NSC2o2~+oMI&R9$E8+BR?2RZc7q3Cs38iq6
z3k;Q1hpr(Z(Lm0MCE*>3tO|vq37E7-Tx~K-Sxv_Ss(gcgQClOQJi9Tpai-hJYzg^y
z{=Szz8B;S&qjN+LPsnMX`<Tv#0)mmU3B<M0UTN8yZTxC%QBZiN@t5M>S##NhvjI*3
zWFB)h{qar`4s)r`$?bxU%K3*F@c*4WH_4A<!0-{6)J+*T&d>!;9CBsz%n=SP5Kw4<
zg-R;Hyw?}30`&^6yM-yilY0{3v>c#TqT#D>`y0;@lvLL-bwImY(^9K#l$dDRn(M_=
zQPXzx%eh)nsQx@IA<<QXB8?{d_z0;9jqM6olKh+O`;WQE{N7C6J%)KLVBxM(>W>8W
zbXJ3KRV#<+Xr@*<tl|M1m~|-8uvtlJsqCz&eOrl-@dz?)@&mm~5_R(u$jynT*29l}
zX!lo1V%~5Me<Vz&<yye$QE<wRu8YQX4Koh)ax}D97gssZ&-w2zRoAy7{>6s<2JgNA
zCEO}+RKEQn(0D*hsY#VhsYAiIU?LoeeYB%cwYBzP!@8}fF6}3Uq9(h8MkGNkr`}4<
zZM0r|O&w?Jpk7v4r7MrzHIXK!xXNfM=L2fB8ZtZ4tRxt}*9MX^`j=h$rY1sAs?x_d
zmvNpqW&@nI?^qi<MPhmH+@zy|rmosGTP+nD%Q%-C@FOw%*TJP*JDAl*xAZ-!7Uv8c
z^5?tT&zKsz={@5~B|5!1)8qR4K-2AA>-nMcp{n$vnzL<t`mA>uUb{0>3%>J<BV~)A
z(nY;!m4D>H{zJMz_~M0=ELC_7g*|u5D}AR0R{Q=-sPw$6T;BIDkh%TtSZA%H=i8Ek
zs!ZMsZkDp-hss=#03Bj6<St|QVo!q5?o4Ihas1am!#QCL9kQ+MZR%n17B;ib2L-p1
zQn~EkX%5@iaMnA=Lj9b2qR$-4`E)4?pVrxUe1HuWXU>XE><U)=_vwLPR=*+>_m=bh
zF924tN6<i5vFH8k{`AW)5fjvDD#tvrjhv0;8se^dDNL;e-7q&bHUeYz<~GY*<p~X!
zZAC3X{cK2nXV-uV@)}T(cb;s*zrjONbI?;cfX#-L9cbt_d*sdzG1(+O6;RP|GgM%;
z(P^DzRl4*yZpLGy-qZEi)~hqyXnWi|91<d@Tl;!P$Xe0t4$SUfmhR!>=ns5c3`%nm
z4ubh74UBOko4%2U`xS>dJJN3QZz!2}c(&zk+@EsnCCr{oJ6TmkH1H*~l(>JLm!XdG
zia~0LIy*<gz4M2b?@VZI??b(^7KP};jJ8b1_dvYOOBVU$a!MJ1ajj~@cJ=nuZ58US
z))AIJcmG#(VFttVsQEOJZx2ti662?m9eGHgAR5ul-8!WXC56T}OK$i^CrGb`omns*
zy}%A#rDv?W7qW`kunq>H02!^|F0h!F;iyrvVeLJ(L>(i!GH!z(`LJ52-)RD>VL#ot
z`eQdlrptxm^#RkrS_T!r#ij|+3e*fcQCjW!*Lg?%v6gM0t_%C`;XKOJ|L;y)X2Ls4
zNWuF8dHiW{;F0|2IbjKu+?CbnJtj8wd|daFu0l_u{;Mc0IlQ&GH<u)KyzA1sz}KyV
zbBbEesd($9(c^E^d)@CYW%x!#u&)_CgRL`-m}GbX2chrfmcJ+DN?I5w{2cUmyV1e}
zrc0@c0-!gx=&3Y6Yp~PZ#+9dSrLuGYIwhsfl(UrE0vrR=HNSLV3zdrvx+US(NHm>E
zk7|*gDbsAf17M7FAu<ZXy}@{#FMV8Y7@jj-lJl3!=VlkvXS>7LUQ#x>KFlX_r|4Ll
z0%FYSIVcx@S^a=oQu(*6=nQi}mRpC)NEsygj>T%B!HA4+_>OS#4+FS-XI$|QHm}K*
z;>h0SyK%eU_DGu|htxm*_#$ZwFMGZ|3eg9kTIyI6KrB~|wAqXUKYAT*Q#qwv9$<Z2
zu^hmf&4w})R1Y7=^oB0~yPXtrsW*)XVKKH<1v8sc+nT<>+A;mlyEicW^%jWYE!Qvi
z9ps(FxshNb4mEE$XF1lU-dp-x?0v>sYq7q2HrMnTCh5vqG+)azg=M;g+f^%P*TB#t
zbO4lTty~^?=kGB2|1M4a2VWk$AfEsj`xqcky^Q);HzxVx3;b8%BArNxkvw&*rp3c>
z2fC$QYoT~OZe7_l#Ds7J!5Z%p(&&L!vv0piaI7ZC{^RCY3-Y;Wlz4?>aPX^$x<Ij)
z2?yKR<R~gQ&@sVS-x%7}eNm-TpLVXLZTBVp4MkkB<)q=Po*r^2XR?eH>#D83Hnse5
zY7uGqawxBVwo^#{RvbY+M-(SdJP@)`G*HLGF!WG^B3l2O-U)3a)%DZILP)-}+rPrR
zra(^0xrujl$YcjKJR8%*KN@0m9Z}nXZ^U<>ubi?<J-86x$8?N#HC=(t>PN}0)7NmK
z*T&WK_pYR(mhm@uS2n+7emmbm-@Rto6fr%x4oE`AwCjDm?B0mGaE+sRc_|x!5<Q1s
zM<GNbcGyfD7&+ec-*?={1d6_VMrY8pTub-IeV*n<zPghva~A4BomS&x<230*PlIXr
zo$E!O;Fo1x<s3dmW5SZo>`8;3ND#;*<b!}KH*RW2wNX{iJLwblH+F86`j`R0yKhmI
z&rB_ozl$z^KTAufVwnwZ?<pgSWn!wgw5<A&quW<_RP`{xJqL%=fWDc9@^RJ(3Fmtl
z7J1dhA@Ix<Gyi+N{{MkM#Rc96ds4{n9!|qAlqx=oweL5?c{e+g5^xH)__7&?NUMy7
z58BMtiwCtw*Vt8;0JXD%JEVDjbUUWA6QX|P=FAAYa_B&J^3g(A#-iUFGJ^=DRlg0p
zC$eN+3jnSGC498yniqtHxe4v?0i$_FwovxD@z5Cuz1g##`%ts5-38dADu-HyRm`b2
z_a&~;qJWnPkQVy}y~ETTxp+z?P=6&qA1(>0XD|IQ;9_)d5bmH-NsRs@2p(xe7h+bC
z1vzyk@hCtY`&>}?euwP}@bxQk`U9h_gO$@~K6H-=M&-mQeZ_qw?`Po4R2hu+eH_^t
z{l&hQb{cdGw=BGVy?JmAzFd~M@H+<X`yKtiPigLE(DHf71!&pj?dfgy(Fg}}S)83G
zA%~J7fke0H9NFgFS1DkAdHi=2X>4A7Ffok(u#oC$mE)(9lJ28a{g;X}T+>rfJ0{uo
zgE)7C_pVehNUvSP89Tfw-2bVedbp7Ok8+EGkKVKe@m;DyOPfg>B6IUM{=#V9O1}!|
z3vo!NHiz=8Z;tV$(mO+q{W3fIop~Fy4K)s{|LeL}e|APalDMfa;du8L=I<!JIVgUd
zC>Z<(K`GBz^a~|=aUb}D$25y*>Xj>F3-j>%wT?|rmAevb|6BC?WgO3F@7dz3=iL)o
zCacy-ucgyJk+2fbpY2#$y#FpAEAuskGgL)3>|yp`Ur2-pUM%$Sh}Gzv<B!22cwwpb
z8yAeMym@FotSrvoHK$yj$8v7bz`F07!~JtxOufAa@P&;or!Zw+rR1;<+o{Qb*+aRa
z6+l8gob0K(F8MPH#$p{n_S!vt>Z4@C9_L#XCVZgQ#ilb&qy4I0QFyfaHGk`D+{+@*
znxTpmzfcW^Br)8hi54nHZ+6`x+1@t4Hzhh?DowVX0Wt1@Z$CGKG70^;Pb50fxBW@>
zL7$iJUeK-JZnfk8=U1G&xVK?S0`<B9uNONL2!+^ad%B4vEJ#(tB&%Iyw%BTE3ADCv
zJ?)JD8hmJ;yErtoL43Y{>{#uJB*!>pu%6o@nFMP~n9ACNKmI|Lb=lQcX6R>9P_vwL
z+AC~Sk(dS~a^Vh)XW`}GMC=cadfw{EaVLX4C6BZ>kLlFRmnj@6D;*s$l1OweiVu&e
zoWODe`gN(Y@T)-ycHiquWc|yJ%+G&RQRajj`v$l~oKB^Bw#`)$M{QeYE&AQw7(cQM
zwUL}&T^o{|SFl=kP6p_@E6mxqi_fS&mprXGA;B9}`X<x<V&!&J;;qrHvlHNoBsA(g
zUP^y~XOHrlK2eJ3BH&p&$qBe3c^O|^h~si0I5D=pF)-jG^%ZD1gweQY<f_QX87j7Q
zqOPM)LZHFyFOT@{K))(sRH(^=WxL-biq=G^XC_Mrrj)f>QD#T!D?>lcx^XZqB$6DK
zK?2J3-mS=-jF(nXo+-~@fAePUyfYTjn{=M$m^2ZT%Av^syjd4}{QYUNqnR;JG-Sc|
zN8@6l+P$%o!TASW=S7@vUpq25OQ$<#_z_w(nzpHD2K3_9?3S0MHvgz4R0C@Hl_r);
z87OY2?YQ2Xz-ydI8p%A5-)DYJTCpI%E0fsLwl0D*lh}}C@#)CDYFq`b+&uf&W7sQD
z=jc5t$_t}?_h0{GYILliZ{vz$u3l8;Z9NTY3bA@LK<NgJ^@~Aic}Y8E9+4>_bE3vx
zYky~;D#${Y^~gsY0!x!#J=x)UH;mHfmXKZ2b?)CiBM?p-3#s^#zOh#OY=?=_Yy0d6
z5=z666}I%!P<PpZ$2Y1M(DfDsFfGc2g5M8w0w&u(zH56<pkeUyM@g+=beJwRYTP2T
z>4Dgj@S(Em-JS5dIz#&*N#l!BuVf*6-`0(aR(#2bS@yJqsfGH8BS`*>4ZgaGX{R<{
zt{$x#D+OSCt8=KsT#v6`Ac>!k<jLtXxzEca4j9~BoVC+Z(uK&Mt4{$Z=#N+Yk2Wv-
z_A$Rk`}Rj=r+=KEKD()4Bs>??@#n-dM@z`WAXqW`-Fw}g=d+2a-;$Jm-D4rDRNPjD
zekKoUF-gQuNd)#M{Z8e*$ANx9E$DE?+K6PjEO0s^6yacNT#Kgpe$*!#Qjp?kkb6@j
z#itfry(ow5>f=P<5<>wX$9s2dDoZu(F}WcI-vNS2Z%CFl!mIeA>z-hTB3MUVfgd#K
z^iXXRWhH7)#D)^OUhg?1Mv`9+i4J3j;JFK%Iu2Pd+aniz`xr>;<UpOLCe%6BY_KX)
zdHOtlC~a`bWO{8QQ3h^eR&&XA-gP_b@M2$lUwjLvekJ*Tr-FXesLZJpafYRT`S~^F
z0qDoF<<0@_*)?q>THxa15F?hEX?oS%em^5lG3o&Wdz)Hb8*H20t3Iz_21jJi&~%uI
z(Huid)+SKYCSDa+3Q~U1cA(5hH}L0DI1DbQ9q4wCfncEnOr#OG_{$-xVfmVG0P;UK
z{->%u{GKN=nTBghw%dF_>CuwKHbHVwKX$laAv}f2^3Rijw}Z079641H3J_vQCgM@0
z{L0#Q3;rY(%AlAc_l6Gp5e-|?WaI7}%e*vhPd;wD9-6%>iXcD7-;2)rT}ok|h76)W
zr`Zslgxc9sC#mIV<WR5Q`}pS6anw>RQcZ-Q!(kE=?{QQTbi7wUNGDEmAzm7iiJu{p
z(N()og9u;)(*55DQ}E?l?GNtP;f3Vqox@KfnG2Gp+Z1b?T4`9j#q3hsQ}RLzwS>BH
zd#YKhxv!T5wlAu+?*rSX6<9+!sV!;UBqV!#2VE6*!g;G4J{X9x8?t{DNTUKPP_4m>
z@NWoX1($)^<dPU;rAI@{DA|3tF6RZwDyKa+ADe;X^3HmfH9ngJ7YG;HJqq$uK}k!>
z@Dm83u~rMwm!3CWGB!yetTytz>N}gi;C4ODFU{ScTNn=E!D>0&&h<2K&2+B1Ci)~<
zov?<O?Rks*43L2xo!%EUaP>L*ME~*sM?C+9@jEOY$iIA^@?ndd`!$hASuF|BSs}oc
zq%0@Ap~}3@Eu$Y&9_;+*V@k8VCvWw7HWQecpKK#6l<D2z2T-eyy<h0m2Awe^;CF6L
zb3mi2)iHl=6kHgpB^tXcE3%t^dAiw}46s-u({oe3bw~l$Zx(!MuE0?<aM_iY$Lec5
z7d@=4^T%@5;MT2M5QX>ew2#j0Hn`u~J6L~0$etp56EA(5l|ORN`yE9+Op$MMo*#52
zt}#g?dDOhYH$6t->-6-0ZBx|~)~e85Z<yBaY5Qj|vB@sAx`ds{w^b?z@(<J!%&a1o
z_VW4FuS-`1Im3T3C536-bJ0V?czAO35tUw$3UpP1qHZFw7A{m^l1lXmvwD}_8hp3b
dn0M|vAf1>7#u?t=d-KA#6l7K3mr0ui{vRJ0g=qi)

literal 0
HcmV?d00001

diff --git a/assets/img/rancher/backup_restore/backup/schedule.png b/assets/img/rancher/backup_restore/backup/schedule.png
new file mode 100644
index 0000000000000000000000000000000000000000..9f1f340116c0e3474778d8e894e43babdd276a28
GIT binary patch
literal 69112
zcmb5V2UL?y*DeeKqM$@XM5F{oic|sVB`DHFM2Z4ZqEwOIOGpADAYHn2q*~}mF9AU!
zMS5?cN++Qvq`(RKyzlp&|6k{v?`5)9!erlb&poqem+RUId-7QQBHeX53JQvgni>!E
zC@9WfrJ$fxK6jSf(`H;TM?rCc#ZE=#iKdDQ*Aq8q8#@PU3JQ&|L_=BweNC23L%nmF
z{DDvM-p*3Tn&*vaBr-_dzpTM8M*SwdNl2j9t33PDD&0Fr;Q%3ln_eufvn=!iUG+v~
zA9r==R_o!iCyKVSgxL%T+8^7TA}c}hsm`T+!PI~wKtcE8EfJyjiE*hNHx<vG%ci>C
zPifBX6ez<bC3RVu)$hb?)+}`NNy&J(1*!4`5q>rX+(JVU7AzBF*zzj~cZs4_$x!Gv
zbwEGmfsH=>4{_pE3*qy(&QZh)wHebnaJ8}0ZSvP>zN3F5bB#hgu`Sk$QaSmDEwgLo
z3-<bJ7V3;T{BL{&+nY@(Lup-E+PU|33zUo0g2&|+8)S^(5h-Hq@ok;gJHkzu?lWAy
z`p#W;=%mk$=-k<z$Po3Cj_oPe`Iz|S3mebkC3x<K-0;pbPGIDqD(7vt4OXaYx`4W>
z(Z-Z`*fjly%SfVynu12*u?uy3SrWf~YW%hA_Q&jD(=3y@1K;m^y}4|wQP6&SF;_Kb
zdR4<Z{l^(4$T`DZ`uhu^4&uQd9p249QUNg2Uyfr|7^uGaQtxiN$2)mCw*~HmW^4q_
zy#W=e%XaCJm9p*55<DMW>DV4gm%iW^?FsCTjmf7khkxX{VLBg?kD=GQ87hOpwcem(
zxE3S&(7>&2Zj&xjAD{Hj-7@jehzBGs^jO!{0e(-H_#VA{U#9hnXA7r|dq;-=&Jx`o
zTz;O;NrvI(y-VlL3ULJsQ$3=bP#&M1>ZeCsQT!M{b&HE06WF9Du@ozWW^A=p;6Dq$
z-%d-@1`FIZSK@zz7j1j~V~EqL3lg!!DLZ$*-M3b0I|8y8i&+DtF>MDz7>>$^L)3Ue
zE(L|nw?E1Gbq63~l|i3IeeNVm<V^F?9eGxkfhP>81;)%va_0f($Ih9(HQ_q1kfg5r
zT>ENoGO;C{CP$ei^6Hl!5vq<&){0i)8}^0@m#~4v8{X+*8&r^K8k@@jgw|=(kB5+u
z!Iw^`*GG#!;-jdQ+~Fa|wUUQdS=->eug2Gr{P$2J?`Tnspyw75<w4`Do77$m_8r$L
z=;fm&Em+EP#T68oIJ<4X_rG#=bCSIi?eepuytf>=vj<XJ;b+xYI$^uATgcpX^+ErY
z9gna(T2Fq`1;~qM{kZDNp;nR3o-w!0KZRnRLb4V3qtrgEAl7zGC@@07T}94v(X15e
znG`KPSZ&+G>msGh6zp4b4|!DSI7A?qC}=*lCVr%i3}7t_k(H&Cp1VlAckUX!h4L8<
zn)nwZG+cm+Ogfu4zS-0Xfy^(2$In#<Y-OL_q@-1*dUcks#m<G&Bfx%+A)Rezj%Jk#
z-9qt(>(<+lJC_vOuazrrUgB$~+EKm#UgH*nrs`m<(1W)cu_-^#<Xtchc6d;Iqv~hr
zPsSx`H-@zbPB#GWIhQ1N&;NKL@Fn<qPSPs>Fx5q6?tW^Io2kLSbAPPf_h7B(EWYoZ
zd$4+b|BT<ot^43?(zO-?F<zTD6PBDtm#zlozfAc+ofeg7v24U#&0_!N1Wz{_d|&}|
zz1iDhT&tL#HScq?_s8DO1WwPN+dOD&(GkZ?q?`?f^YouPOD+F~B~V-Ah81JM<%j2%
z-)6jRd#mrV<-s(|81{g7Abgc!%tk;gO(v)|p*E#9X8iu<Ev1`>@fx=j<2X7)uc$1%
zr_<!gyO=kVx0u(R=QK!LAu#b_^8o`-VXW%X(URM)$gbF~^{)PIKzMz4aCq{=NID(s
z`YyLb4gqa}WP|#rXZf#R5ex_L1jcEns2l4{XvwP9Y5C@U`SSY9`e(VvPd~{SdN!@Y
zMk>Dm3_yC4pR0$t)~UZF)JHzocKkS-)BJJZRnlGf^XtX$t0SLj$!j*~5R`5EIaVFy
zVw6J7@0AvU3lIkSx|L7ppQPnID|%Mq^<*pVd1-xkeZJp&Idy2YUof8WfNh<0{X*2h
zb+PNd*R>?Q?9zvP3N#154PO{ovJ)AeF7egdW2CbDAok{(X~&rkhK}26HCJ`JA4U`>
z7C$YhQvYi9RmVhsN>yGHlIj(FsJkV?+wsk+BBicpxreG}qen+BM2=F<KZ8dO;wiGx
zIL7gDqqKWWcx0v!qK%E`)DnFls_vX`9yF^6HAOvxrym=T9+LF&P2Atqd}8LJ`8ix)
zv^!D_w~TW2z6fdc3W_*O3Q-Gr8Di0PF@*0TB<h3OvD$>1ePlH2!8M6UXjE{AePj$9
z$kwj%j8R?DL6Ow6tgt}M+OT1(G|h(2fX|6`Icxqy&;o1^zYV8Nij95G^I!O$s9(7~
zwy9$&sOl%>n6gVoMU^s^JF|mb;uCJM)<Me>f@Xr%Ps^WXjF{P{R%LlMdnO({Wy^^Q
z)sFsUlg3~&JUa61g~>}uCqtEcCDWv1^#;4<wKZA2yA`jOE<(OQ1E8_c3=$P>fl6MR
zf9ToJ<lG+h{HW)$>ph=Jqf4UeqUG7qk)!O2Ui-uW?Od?@gq&-JKzfPXP`XOSij1@z
z!mZqWzQLe=+QYh5txm+v(UY|Bdz;sFYGZWKX*+YfxswzUnxtNY)QhRir0!Ghlg<2<
z32d5fq-$dEAuT(iGZve=2@}`8iV?-+I}~=s4(4$VduzMaM+F3@gRNbOokiT!BgK8`
zy_F;MKK%L%ruQ6W@^jYNmf5#3E^`E~(rn{<!mUOwMlN<Pkasp37C$@Q6FwGvH2&!M
z5&E*^rNsB=-_Or8&I`6VmtCAN^%8DyE+UK@TTb2l#JI!A#?7fVsrK+@T2B9`a^0`F
z+iE5cB68R)lrPBJc=j|IeH|x`qdFLoKcc^0!`^c8nC_{S*onk-?ldf*c&K@WbZX;Y
zW$<e|XzOXEzBfqQSCW<Sed=b|^(n#lHjCbYe(>igyS#6C-!kk-iz*$Z94N(B&-<Nk
zH<*ffAE)^^#U1BOYpU~o)&BiR>BD0UoyVxe;}oX0&kOsuWfD@>`>sK?8?~Z7$BmMW
zoXr3@^NC%7&hIZhw#G`vUn~8nVQ<{-mEO^))x`<OD?qdk3F#lw*V9|4m!_e<OO5-D
z+&8s#qdz%@4<y*>%l+_Lxa?}!Y<N6LRMLEFWlO1dr#!p-2|cH$$iw1%kS6fT(bcC{
zpdV829?ad1vdgh!DV%x?7AM)czS<F$z_3oU7E5T`^rjuXc-B(nSQ$IPT4}QK;g_*Y
zA;f8XI@LG9S9TAUg_ePj5Nqh;SndknHI?z6&&~P{`y%);S>vIT(60G6Yq4gd+FEGX
zUfe~k=A_++eaW&(iOEp&E;GO5l>t!ciLZ<C?~21^r*1*RONQ^BnS$49Dr^!vzAQYA
zd8S@m0&aV*U;le+veUjVu_3|PSlyV<Y^+Mj4Z3)C@1mfT|1AHwPw~w%3lwjVww6>A
zs%Of-ZV=&yzS<^iZKCAJ?9@~z>|g>-w0?TzwQ!iTrQ>yLOJ*+uDOx3e;GMKZ)D!-)
z{Uz+H-B-`j;u-5QdtZ*{e8n3RiZ8v9nRAL!kS(m!6mr_I8n~If4L`QWmyQ7*u)k7V
zb#+1Ch)_vmkYGq2<vtkNAY7-uXcqN3Dnq@4)6Q|%NsgG-<~;I?_ZPEzRg4HoO|}{{
zKDV>5ND^L1nq@NP<E(n@)Z{L{yfjkn>bO;S^KphEhaY|^B|rk%hfjA@TJhZe=^L|m
zk!4zB80^vHgYzCk0cskm#=vff;qm#2fnnK#y>V+qH(v=gSQeTHJ@{U=YM(L2REla8
zn^zmtp8aK8<L2B{Z{`7+>z!_R+mMePMkk`AYrzMhzkr1L>H27;b1;{km&7*tnA#X~
z1rZ-&9b}$qGJdzPL&rW#R?&X@{MMR}(y=d=ekUSuHV!0tJiR}NU;c<7p45*g4~~%@
z?!Lwx3`+Yse?iqZI&Q^mAx=clGcANcfFJO+lApiA-tD8Ip}@~snptD;@}t3h$%T!X
z*2dO*V(Q;xfi!o<`+FWym>W_lYX#fV`o!e+Gh;>TxWeUg*#l4BGJD^xtEGIh1yEiv
zrMNlIntxe}{@rJcusn<pM>Ra*TYEd7YiL4~F@nxn>@6TD$oT>#mn0=dRa{1<%-03e
z&7g63l|uL^9Fq0u9VQYnaxX-#9{dKl40gEX2;0-L>?h|7BX$Nx9!A=a<Sd;XMP6Dt
zTUd+uIJ%Hi2nq@XA35?zM{AFlTt1EtPVRC(iZ}mA$dNyvc8lKR`Xl0DuXxi)`w5qd
zvzs-Sq{v;7J2#c+xVX3!+^lTm^d6}Fb2<4x#hb4@JY3{NMZLYfMZ6_MoZW0i#bjk=
zMem4<ii-=AC4}95ojhLp2s^oR{~hFC<2<l-w{){}@vw7t;yNAorG>MnhvLnfr#Jfd
z-`{z9*xCHoot)hNc`Wh+ik^NWDkgGA^xtEXFI710l~ZwcbaAtGcPEdpB&P63@_+05
zulxL!*KxD6CeQSAKL3{g?|uJY`6sWOJ)Fs_=4NN9>EvPUM!wlUSBw91xBs)mKVvC~
zo<8`0TZq4_{HK?^%t~|$qW|79CAu@?0W=g8$`qOp?iu({ZZ@3{;CPyN0{7GLPI_#s
z!$p7I#ORCwS6a?0{~i_NbW5=AmE@P~W32FFc2BF}dnfDf<haAn2nfh=ab*Wo(4DIY
zDLbnXaLZ~duX4ZnxUcTOsp*SfseDH76hZ%eiJ|9Lrx`*MYEQAyJgd3p3j*%)>B~c_
zSFbd_><4XoI3r=8Y2PmOj*I>+wznGI05Mds3uy1Mn1xAN7zm<3EgI3Sg`tHLd0|W^
z3BVKTlA~5;L@?^R^L$Oe;lAV)cJs#}0CU+q>85CeBa1>-Z4|i`>ya$;59w#rY6i9}
z*1SeqTC$ff1*iSKk{=&VG|sZhLnZ|2eDF96IzwF+!^O%7RR$(ft*Quo5@vz6JC&Pk
zUY!YV7kgZP6WLC}NfP~1jt*ufL}5Tg3<`->_c()aJ{vpgyTG}S86E+_5O7eU5)8Dk
za{6f@lP-qvPZxp$hM2UzYi#fm5E1tnRj?`JA@z9?!xQ0#2?UOZvfSRMB(=lyf|A^J
zV<Js_qtnj5Qi5@dXhCm3dF+M6wSpIT7YZznP!@_TGb-4AMGpXJzKMH>#E6ncqAYiJ
z%|mBidXJmEwq}6!{Xic*x<sGd(1^v%>i1wdPiOSeeU-Bw*z1s}0{yf;#u_oW^f0gp
z;F89713CBdTuZ2n4X64!3<UsUd~TSM(8Ad@#Cfe|mtER}PnqKQJD7OK^_*X=t=~JR
zoU~Qm`Y@;M6sI>VKCEY!*FoJ?GvgdyhP__2@Oe?9Fc@LHeHejSfo5T$vsn6U%aQr+
zSe6U}HS10PVOG7&51%#S%Uk$3gj!;#fpfHnAI}6fpS{O{f8vLK(aO81=eKy@G|*{5
z8pF0KaeNzi%xd2H)gKdH8~mryoam(<2fN<><=X1JAia}@)81!=_97vyjc*K(=9pdS
zUA1mHeZJn$8nJI$HbKjrg-M?KJTx!1JVym81Bl*SRS5_{Qb8X8yA6Olgm%T3>7gaL
z8zB@h;RBvR3*CZx&PVQA1Xjd5#SQfu#!`#1)#sCas+(tK42=3|_bH*DG@x9ZdgWNO
z^eXIhq#1SW0Cc}~gA#8fhJS||`}lUO6`MNl`D5JkGZd_wk^Y(MZhd5rlv#w-b%!V0
zcjZD@aCxe1uoghPBf32bFs{xHz=SPQf);$Pya$TO3(vWm5nF3n9H(1>h_~R!?YCFK
zrZN31GMvoq0AlkogXU2Nk&_zn4%{xfz%rn|Uw)ZH)fh6C_|twt>Te^Oc%7UTnIJFF
z9C;Dz_Sl}1<ScccJLsv|g3~8|$Det_9o@<eDc~layA%M#w81n36<+{Cl<QXS)qP`X
z_+HZ0Su!W+A6&Y;NQ+EsTEO~(=b^#as+|JJzO*t037CcNtBvV%RVS;V3Izdq97aHb
zr(<R;vEw9MCE;c}bmZmx*i_wH8{lo#pjZcqfhU;^qb+>y1)MlakpGh)=nLTLJ-f9)
znzV5quQ0QuBr|c&NLp8YjP<4C+t}mt2%YI5v*p<m%oNU%C<SXUAlZMerk{BrJ)rHu
z1YKx)i;bH`B)>2mXZA{jG~9Ih_0FV?HG+Ne`tZdXK*6s(cK-w_W1lmiD@j7NKFt9D
zTnm60Iu^9lJdS_w5CanNYVc7at8h-5c}yIHyr;^*juL<-WEV*uFxV_=rlbtGNlR#j
zHG;IaBZ>i?hqy(HnuwL$Q_WvH;IC5$l2zg5CjR|5K6s?rOT+Pz@hv(+*i=lf(G{>s
zU*C%ag)Gyc_q#Gqb4*AoSo=-@&{biMywNzuKmY!e24M)T;$@hUvc_)d($65JOpJUq
zE%DtSH87APe~W_>^e!|2!Cv6CdbN`U|BmKGpGa@m9Cqi_u5c31z;5&hDg%%W;G+HG
z#Xr47SThMGV;LL!OMG<N+|`?ne6Sk>0OLV70ywj2SMM#a-SCPsvm8sb9cy>|(~8@U
zu=BmSY^!JM1D&z~jVu`RC%$N!aY?eAVWt^V&EE!CL50f4IAx#8#i~HbM{6PFi-@Jf
zL-DkMpB%I)O$iW%o3(*4*LjHN;`Zj$vsuQ~)Bh+o`FV5S5z9nV?t}Vj6MAYdkz?0O
zhBOFj<t#n)%T)<H`@tB5QF;y=2I+t5k%%T3JlXk*8(}{h(Stj;q5pX<C0JH1-wtWe
zyiteT^A-1$C;)r<oxI^}!<}V@7g{Jejl3=>1khqA<dtdrDLp7S{^xJkkaF1)S7}&N
zk43!(2}{1wTcUm~>d=rjN~IRsO-e;&fPe~s71?!7ohS}tMMQ$t`Uc#G0%wk>e9q{o
zwZ+fuymMP%IBi5tUmR1%XN8XQh;Z<a(gni-`+YeUv>oOg=kgo%cAj>gHYCq{r0Ur?
z7;Or4YhL4bV#DJN_cTPN8_i?J9iP0p^D(Wo{$zs~s5A%e=}XFnx0ELT{<CJmu2$#Q
z&l2BeVJiJmX=D{3=|!sV2$GSJhevqk&6;mpEPvclq4_5gw&LtL)R26e@~M)3+})>a
z=qM@Q=&Ib%i!dQCT8JKeV)ZZtvM+PpVd9AHHmct9Ymw<uI`N<s+nw~wBou64sX+o)
zy{?*eMb1oi*jn3fRHxUJHZ>`3o-7Jx_V|)|!}5Kuz%&i+5kJCtnRa?ccJhFcphfU)
zBGO5aujF2GfBwS(o`sHKQI@bY!QV}l3Hz+%>6Ip+-5++AU`%ku?_-#Ep?2e0H=)3;
zJ$I~m5ZRS3Vv$I6UH`A?HC|T^SF=|-*4M`7|E1V_5c1UhJM?dF($b#IZ^~7{`w{Z1
zOVqCO-F*mE$xx$x_-<IsQREO+i)pBEUF3BK?0($qjco(S-z_{qJ3^f6j-=|=3P25q
z9FWZcx5EkNK089r0nmF|%x%=zx!aBenSyVReeAn|YGqQGk9Xrj!rtP`1UKm#?*ETf
z>XQ}6r;FmrUmTKC%RA7Ll{)$oLo0jmMo;^+>7vfN01)xh1qKFzy}_w(cEY>(u`GVR
zbeHtu;qeDr5L9MoJYR5_YL#S_DjI$njmJ-33c%y*(`!VZ!_Car4nSeF$lxk<%vtpP
zb&$UxFDiTm%Zjy#Cd?vrBY}&dS<0X`#F8Ke!i}$###1@Z7oS9IH_bD;Qp-`p-vwd#
zmgjY@74BZ+BOe}SvWBXb4s4h<7PfNxB+zp*CSOXv08FlRi2F7)s&F;q#*b*>2p$FJ
zHQ~>T{)r&OI?WLpXlkL;Rqr@8%8MY(Ty!HHNOu-0c{XoWq8rn{iTWFjqZjt!GX8Cc
zw=u1?OV!Y$5>!~N;;la7$73QUXh$Csgcx_`*)V*4w$K6x^<bOnRW}X#6T5{q?1*yX
zScuIXRdvv;4)mNiMjppO>^%nyMeBzXpmgM5OJ`a?0p&i=f}!_ES?}CHo6(#!b07fd
zGI?V2P+$vSWrHA)fk!qi@{cD47Q6v&bFXZv-cdl8cANRCLqdr-_2dct?^^*>Nk3U_
z(*^jlh|g1G-Ti!;OH0A9qi$4J|BL?UrPSCpujmr!%OAJd5BHCopvT+WfT=>N#F(8<
zZ&Jesa9OTI>YVR4(RErdE)hs7I!6+SL#ZeC^LU&$>ryv0VXS{-s$rVmhdo1ty#?nI
znkmfYp^3GBTb0A&v(rc{QZNkC6CJkk?oShtEBR~aJ}b~IWcqg~%2~!%N`_XriBtf$
z{SPA-J$Mf@lR-p`Tlw1?Q(wM*T^`C(0{<2rH)MOU#VAYKKj9W_#N-fh$mH&pmH^@&
z2>$5H7m|C(R7?eF`*W*%_{a&)9SYam!fxqvEsRA~z`HVW(BoR=1N8P$LX3ja9F>xo
z+2e6hVgOKfSv{Ia*Z4MBcA2N1rQLPh_R!}ltR=<)?V8B~iy>Ln09`tx=^O7E_9xCG
z_}Z1q0Gqk~TU6xJEloI(%baclkUe}^Or8kNa{r^kL7=N(pKIIp8`mI2eh=z7Vaw3J
zScb)NeQoK8$Wdxe%25+(^%{Q}`tyvoz(XZCf^@ZO3~|h(Ep$C0Bm^Jn1}Bx6aqPA;
z>2!6AI=gf})YguwaGCcvuHRQ~Ds8Q|7rVa>J28lzOug=X9IO89XJwyK>2i>sp`mE0
z&ku3q3af##zP*E{{lV+T<qNm%#wL=5G+%c_UX{hK8m__omV5*G^Rj^K&a;iin{`t)
zXqSu6zrAW^cklVyKAAat;iTmQkwhX<RXELbZ^s!|+Wc$}V`3tGjY~FvE*KOPq-SEn
zy|=<vGC?Snv>gU6s~Q^C2!WgLyUu(fZ4B8m$UaIImN$)WEdm}bhN7LnDJlRO=T*EE
zTg@NwmB%Pn#(V+?7`lSabIt`q=L|7|xRHkug8h;n7tK`01hmIi`!btO0>^OQ>Hiq_
zMeG1+C!Y|B#c?{5_2@JK=_>`2z404xYW~T>ca1_{Zq}9fvE^-_sp_ql$B&>*JQuCu
zFm3JP)swa)Fr1|AHs$CY?8yU4_x)|>Hn{OP5|vfIx_rR4G--drwc!bz*={D3x((}=
zCSaS<8Tc2%nmkw^f4K&^Wpx&?i2Z0$)a-91lw0@Kt{imM1m*YIDkR^BP};cr`e+Kp
z89oC!ApyG3@DuelG{DA{j!t5yd9woCrLUv77!LB7m370t4DFa4o0t#=;aX$Na)y>V
z<CoshH*<|h*5l2tpfH^&2ee~h)843{-82+Yq;U{ldvY9l_vp(rrM;Ax?rC3ly@L)y
za(jd&CTvIar4BhmYymtSKZ6IC?#-EBm=47@MA9zm`fvoqtbUx}aQ%tv2Y2}TM@rO3
zlcRi`<UVJU`d@oKM__IS&o{mBZ(_+NtSZ&VY_Aw%&62{bF~-j{$`5IQ{sB^4<4L0M
zM^etS709i+!&El4M*<a-&b9NrYn!W)Sc!w_jhmXPOuTpVde1h5a{4{s^uxsBpy6Y4
za{>N~-_ad$;hW|ry}z8jXMJN#VMnDEhbuLRCSLB(pUPd|G>q7s+wE?n@wATC(b0*4
zNA}h(xwTvLeJ(Cex}Fi%DV6r?r_I%_Yb#|TJ@_a90Q60P`}5D50jDY{*oFxz`9QR^
zucgq)f1yt9j_NmCa$bx}Hq&XPG3{61XZ#;WK-tqCT;i6oeJ=!v$Js#)??I$BFYB09
zAw{a)tdk=S*|j{T83&N?P{H+rSXOrNDeOXo{ZdK8wkLK9V6wY04QMtjsQUJ^x?1XJ
zqY3b{xMubSkhDshZ)c(3*o+a;YPO5p>jUW=PS|F8*bnyp05uvUUp84RsoknZ)TTsy
znXUl)JuD{m!JGBHwx^f7gi}@<_m1x|$nL+;UcXegR{~k8w|Dli7JR1gu~U7+Bdq4=
zB}mF)JWqmBajt6%>2G$tWjWa#7N44@ZR>)c=z|N3+93u_Y!F|+44!|K0uPL>S9*F6
z4$s=~{zhUL!%(IiOhu}n5D;S_hC*h3?;B63(6Q(1^QMzVi^KbLtf#7_YKAABVUS{f
zy#9*1jSZQd^Ip`byI<URhSnv3cAQc!fFYY|mEwQ=rhI!<*{b8F#6wb{rr6Gfx_#H?
zE-VTT(!M2U4$Pe09&Asi7r})Pku<1b>dYx?NSa8p)FXmZ<4zK$gH@tnZP0YZUT?r)
z44@_A*KIN@ggQPnTn?a0wmKB`w1q-5h*K;lBRtH;CwzB@yHjj4ua9nAcE6B*MX4#(
z#{<a$Ki}P_h;4eQ7dvxOAOHBhbko{W8FADE9a#mcx0>2t6W;x-1M49VKpMK6vObiB
zS1*5%xo-m)%^ltoCbUPzBb57MjGV@zJP==vO2dZXCnPu%NHA_5KOfVG;$fa}w_V?{
z1rc2B`fqVhjlNzO{{1V>65DX7y55cV?^1zKWyze(>HItWxh4qe@B;@R&igcSL~8vz
z{cVYn;lyzNI}M6V1X?zUwg3?Tm@B76^8c1Vo#s=!KVtkxv`k+ts+&?H7Q7-$e*E_|
zi`$S$F-DwwIBi*b8T$fkNBB}*6vEYZTgGmV8o9Q&J<hx;=_>%*>ls>xq9KM3tYXmA
zG{zMG92f7uEQorq1tUsKl)Kv&LCt1noTRuKMyn-y6|@`jB#s{7t+z^xi`_LvS+@XA
z@$S8{CaKriEJ<m1?c9nKpL)4}IoTL<PT1alaa&yLq1@8@7X>%LPJN*5TFdW*u~HP5
zN>Jd=!NJ9!WV0CWSMie#h4VA3D3Z#BY9(`CGiOpT0>tCgOUm-H%acuh>=1y^{jjn_
z>Bf0ay)75*y|yGn`SnkRwe}%bmK^1V^g8yS5VL!Y#{ssV@%())K>wTmfj|uRN1btX
zr%mq9gt=5UQ;z7>tM$Q7j4XH=nH}@X6ifqbU2Rz1eSP0p^^-spa+|#=9WJnmRXkdf
ztd9lHP=GN%U=j#XPp|pKMg{y<Qx)is$H~GsQK3y5omCN8w_nc8n#`;m?{L)oD@w;?
z#-Y%Vn-W*IY=l*w@<g>xf3lic$tJGmf^VaUziD<ev5hKZ)v!0`sx}tyrAdA9&2yu=
zjHB43`fcU<xSJKd2kSS**WmT@RaH(;Ys<_ds#DYWB6uzy2|q`#kBH)jDy%v!w7CYq
z<x(p}MKRrd$!}ERKse+W92l5iN3X3V1qR;pMpVgaaCNnNzsLsphs=J^ML^7#!k6~2
zMGEF{L)&DB$vlZmYtQnTw<`P6i~6#}t=-1oJpF3^Zl1-y&t=OnJ;<vg%Ngg6xWC~_
zfsg?zh`<0!bMgJ)eM`W8+mx<b%xS{^bP`|*bcHAb7kvIvTlLR7+!LJep4!C2S}~<a
zfGewO%GkydCmCE&8w|Y#CW<u%N^|d=CHpJfz3F+9s#}awLbcK@WH(U4DPPek60oSR
z1{<>;`c!Rns3G89S4)u7UXuO&A$RG6A&`e-D`R&&9JxGc@ASU8nXA*r#pQ`eGp=wq
z7*1drSW7CJ$BT|Xf1YYRxTFag1;8tx#fJq^#?KZtK4g0LW@B(A%lEgj+11Sm3&*`Q
zp2cw?B^cZAMEGXb{PbkK<fD)ZH))dr7aW1^TUN>zJw3+-?xc<UXPHj$FU@7)J|xL1
z$-o;8gpezH-FaWX$~R6bjf=m6eZDKdy|v{|>Yj|A$0Lt67wJUiEOsdYbCe1#4F6Fg
zp8Za4&PK?sPPT**AK@?~$fs}2|3fiT=CfurXnSOL%NeenBrI>h#^g|3JY_XA={flX
z&O1IfGPdz~zvo^vnEMcEC}w&Bt=r-d;mq;~<hi68A6|4T)!>SGN<GTvcDPgS>nyfw
zU&lcxr3bGk77zKh`<}t`@K$=U%w);U+L{{aN@(Yyo2mFA^NM>ofV>@x9&}2PEQD*K
zB=&*690(acHN5N!^2=+z>-Uy(**K<5V)H_VrhnF(?VJYRQL|Z<N8U%Uk4DEeMt#9p
z3}*uw9s|zG`=I%W5L&NObT+uAVdollw0`qSlxO4W`0Ov4MJ4JLt$7?2Ew9zQpI;i<
zDa65Hw%zUR__DSN{W>|Ym6Bxfph0r-Fw}b^^a?}yF>kjdA3whiOV8Ny*kidhpEWd4
zV{tWNCizP1y~VfZOQw^|_R@quUWJ%nhQsGwNawo`+BmCFoL8D;J=vkKFXJ{~zr8dR
zm$0z@!PTbQep%+|7~8%~)|TzA%3<4;+ynOuoS2tZ1X>`bvoceT6k>}J>Qi77>kWis
z0LS@ftQM?hnf9v$`VIq7$lkI_;*@do)(8AZbSME9Su2i)Q6DF=ocsfM17}1;XKWg;
zl{SUBpTbsT6N0z|Yag`wj(D=0^3*9y0lc*6XLi%^chA~y<L|#FWj}>IfNgAU#+k``
z(~wvlA*5gReUm3IyK*HiA7HVaU(G%9*uAF*+=@ize;*<X4r47hf|{25K8Ts|K6>RM
z3Ak|Kp{;Ep>~Uleh#?Enu<Nj87;tmyCn;hKbmz`{{Qd8#3b(Y9gyJl#bhr<kcNSDj
z;Q2qZUha%E514an`V(c(#uWJlHW?I{-ziCyEm`$DtYv6!^Jd{(T-n*XdK^834cM7<
zCf<Y%>;sRPXfM%XNPRwgv}Dx?-Tnw!)W)ugx}Nw%6aINxP#>&pvglD&hjsoHd(_kv
zADgrjXF10fM@9vVq~`eQwf<t+VQ;FU$@S}RZgH4IZ>A*nMH%U+!I=&&nv{&G?ie@v
zfZ&Dpgx|l4%XcIF;$#Z9tMf9DK)ATzaZ?j%USj`EBp%}Du~t6(Oy4A4_jua<YhFVG
z5*(+yjb}>g*l>1uoiI^p8=UWrg2E38@uY=o>ET6uy7Du{9N!Ibbl^%na8qLjh!0T8
z2K>)M8@(-~IdPe-<X3ndc-p6GMyr9mUSy2BiPBw}TP$Fr{!xc?v*4IHBxv6*PM7H0
zTJ*q>xbQF|<JA*3UOh82VRxZ5)hXNV2o8Tt;C3SkH#34r{*_kKKItq$H-jCc&C|iM
zlJ>mi#8>ZCoHS1#GW!4SL#e0UJ?fCsVyGwXg6piu<FKH;{mR|BAb|R$L|)hvPp1%W
z@5<xa<)o?UM_L1Tun{R|+G8k-#B-Q1zPBYyj_8$*j*EB=RMDt1SP*f)5OJ=1CRBs4
zb=-XHv7lGX%d3j6*=2g{@9A?A&aCru7s*Kuup7RrALEc9%|c!n4;m1C;IUqpAebI*
z|2J$=`gd4ji9QMx$?eARc<_wXUoHjsFZygYIUzTwP%@lzY)I~S;9q8FNW{xlI)T<J
z2$l_8RX<vz^@^CWs9CnHY3FF?u&G&<#w%VWg-By;gc@7PNXX$Zdf5M{8+;W0J<07^
z^_b8ltqNCxE3!b&m1<&d!*(nI4e96P7j63X%&F<%v7O@#ue{gh6|EBA-zh71cUHv}
zYevj0LD7nbuVl$l!&&4cyOwx8c9t-+lg%qI<F148ovA-KO|iRql8KM7I+}zM2H8!F
z%J*YMObd5~qe)r=`ctm?4GG(xcL%5>s)ohrhI|CPg@>`}P?AsMsb@c2%PBQmQ(H&z
zAhH3`)TH8s*b+&Z6d&PHS1dlSim2Q5_B#Q4sO1zcohBGbpY_}Dj<Vk%+jXKNzwgx%
zwh>*;gzd#l>ubcrnz35(6U+JUG!-6e_vT4bN=eGgStsA=?X3pe!^B+&Z)sck4f8Oo
zCfiru`t*vh1#7cBa?`##_zUCY;E-UpwIyy@FDz@wQ)&ClqxSHC=Ddd2)@ZS#xZU6b
zsMptNQZiv_Pz!$J>$4^<(dJsUXj%Nz8%kb?DF>EC{Q%%8MRbL7lM2dD0~IPmg<^54
z3upEMlo+@~!uKc%f6@6<cW=2w<|7&5-@m3~=nw@D1}_r6H(Q{+yTZnIu6eQ%+<pf`
zqhdj;dfyq!wLCg+scv;{b-Xg12EZ_(wKe}mX8Z~t`1LxXMB83md?Idz8yR@^);62v
z(FWK%C*6NnGf=nA=7OC?5BF{Z%1m_33`<*g^xLE@C44i7N9!=&yLsb6gSZ2>(bs(`
z-MzQMqQ>}s)QtCxr}XQbK@Rfbxj(U0R~PVN9~7aL;5s5GFbo_UzbQk-E%Rmi6rGyU
z=5Zbx65i0TQ<cSR^Ky_m%ol1@Z8wxu*7WRTb3$U-(OF(tsAh>rD**pnS~N}`-N>hq
zb^Lz2)EOmcUjAr({q+pb=*m~m>Vnc^r1WyCeTfe0Dj_dphqW&pMLgR3uBTOoKPWAY
z1Cw^)*8TJ1w+;?GcRO{CEpZnb#yfsPP=r`sh?#)5o!$pjwKJ-OG)A4LLE;pxiHS^h
z1}%qYF3>1-<UE3rQKdlW6%Anj)*TUL?|u%CLgo4(R7?}ggGH`|`wQRsfxEl2Z^;;P
z11disg&+&?p~(VBbYZi1Zv;39%)R#)LYZRW_?U4CdkOpCC;<F-Pj!=sEq{pyk^)ju
z5`65PQT{W|w#UBq)^%k4emMw@4NU$0ZQ5q9{1&U0(?mu7$gsR+np~CfEPhm9l6A%7
zbIG7TKPqz=Hml@rJyD^uJYj37X<I1Loj4vnI^m&oSPtlVkTHUE^g|8l6emQnNjKz=
zJXSiY68GJ;5`Kt<XTzVw`yVe{4k>t)a+3@R7b!`ZIr&Un&~X3V6UUe3FZbw0xDx&+
zHy}C2f5}vKu7!scH!1W$!d5$(IYyDS=?7G4OSteSIrF>P+y0FlB1>=ReuH{?db-sr
zoy>;<Jsl&TSyZw?kN2`-lfkodcQOVQR39tM*BTMhuBYXdG(XEUJM#DW%0p`mV&lDA
zd-yn2K^HAQI-lU^;J};b-MDzcw-18iksPT{e@>0KR!a2I<$STVqp?lqD=q}y5+#a}
zvBRS|+QvT=Y<(glmXYQ5fPyHIlXMT>pY^EWXASg)_bEs0)6iXGrVny8jBW0V`cZ>R
z9^4m=)Uu1Fua9!doqC<NgR0zt1}?m8B(oQxO#`%>bO`5jJ{+3c^R&dDl%Ovj1?gPY
zQ`X|CdlhX0GoSrr2bm9ROKZl2D@Vr0>^GAqC$HPt*$uqSF3_#9-57No92w!!PffE9
z?ah<0?RCiTEOZ*i##Ei8NjZA;Re4F16XwViiM*0(uNt4pIQxy!rp+X=jkWEhI`@@Y
zt3t(A)VA|r-tDwlJN&+#Q%d!~taEp5RdqEPi7f8<Af}xRweONU=EyJ`thbKPeNbBL
zg_F`rX`DKaV(uHL&ca97mi`!}&jcGm&!W59*fNA+WM=berr9areq}?EPVt_OS0U)s
zGsp!#-h9l*&li0o`gSjN{;1#f6e|Wce%G1f!!RW-@|CT0Rh;$#5q$*M4G%M>h_fS1
z_3W7jYDF-H-r6CNz^FwEdcx;PY9%|F7AmC|fN_;~6nLY|<3A|uUI-E=25VoNz5Z@!
zfNKB6T|Ww)xz1NU3yI9lEiAZ&;y@WHMSdN{7t>wt(~Y}#V39!BxCs^P8kqu9%caFo
zXGVtbnH$g3`?FGkJ+#HT=k%`DrG&p}(z+U!zA|1U6vgBdK<nSa+31u*CL3ipC>5lz
zB?Iw4?%|H^a8d(s0g9Ja=70i2pg*D2A7Ymc5!IZFo|v_tr)m7zLBDYJZzHN$<7qpp
z#F5O1D3pjK!fXUY=IB%<;v6C!xb=T^2s8!K`jFYVR_;?`Gck`ABd1J3X1N4AOXel~
zL;7YLcFfa;sbU`ODj>;}<$N*Kj545~YCqd;zXeNuN{87yU&Q(DQ=GDUh5-M*GWSh(
zdF*Has;`{WKwV<2(_bPpw)~OJ*8%0HW04n??gRxhnUNpBpn&u5<XzoSt5SziP$uNA
zdGbE(>Y4fgk!*TRv$+qov9)z>D7Jq^z@V5cWS?P4md>Q~KNTZ<o;QHVrzA2XAM2=O
z*@>R%{OKD_Mcsn@cKg3QRze}?9j9ekr*X3Y3Suy#{f7C)LA3kvg~LFoRVBcOQnX^{
z%nVn_9qK<d37FSLvWEd=YIodod7=u<NS>J`YWBJS(wV>+HPVdqL(M8B6Ua9KnsL(B
zn>yyQcN<-w7i|m@Wxc{I5xoRWa$JZE`BR9Ze&3KhB;!eT#gm-la)YVhQ`%Q;ZT;+F
z7}O$b***(LYJojPTA+fm?N_hYKWnZJAz2{C(HL^Y2NInIJvFX89&xC}6yt<d?6-Ew
zcFFUQnOy8MpD6P8OxPva?XT;np!IO5jl<(c@!kTRCr)BV7&cr0fY_oGqC!DVm>=o_
z=Xe^0RL%W3g0nD8FhBdB)0V(-q|qkTY)e`>rbF-&F%X17nyCEdB(x|!98mg4oaX-`
z&W$OQOHGlVek3o#J!soy)9H~jU8JomWl5D4iJ&0YK~NFMMh7{#5BOt{U`&WGRJ(Id
z->SRPtl&IzV;61dJCnZ+BbvVkzLq@5&T?9cM3#GyHL&8}nA|GplL#<pthrQkYcc7|
zF^ud<q_P5kW4EoA6p)l><`!j^)-LUKWKjSy=daK}#Hh<?H$Sp(Qf7W1a+|yDdX`Mg
zJv0qObVVV~AgAZvfxnB+Cu6i$Z~HxGK<i?zWF}GRgnfPYr(q21b`0k}u(9uG;dqFH
zWw6ha#wko}QR2A}5S5OVwpv%B<{Tr28umhTmBufC^H~U|cyyvzG|u`jkDZyjQb5(P
z_s_X*SY%v2jX&EtaPhkszDRxFNTxq5;g8asu~koz*`YZ`g)W+ycUteX)ZS?gN?e`r
ze(%6VappgMWuMEl720KeWqjBvxj)^b8oR+SEs}5J-&H|QImv}k>Uz>7F>*F?MIWdD
zh==%`7meuD!qJ}00bTV6MUO1^U!wP07e7n~ZOqQo!RA8A1R{^;2rw70sv>sKx_758
zG#OLzq4Di$y2>ccLy7~b0S_Mo6{0&8YqvQ{=4fHK;#$<hKBJ{VNjd}MhszGzjiCOt
z+t?QYF*hhc=>^nQElT~g67PP7kgHU9>74|hLitC$66Kt}m45U6g}b8^LV;H^RWtoP
z(!XV98gBN2Wn8tu3@0&8=Ix<A_8NqX@UsMd9l{?wTGl{8iKB<_bemtCo^9$oI+cq3
zr8M`)+<9;-QxJY8Ldgr_W-nUM7{8eLW|Ki5BFzL?W=*jxmlPzs*PO!~HyV)MbL-j{
zK=Q?mOTP<T_|HRIM9Q@`EA}@B&Al;c?H9?F6zKqHh#^LR>@b|?Yr@Ei`u|qa_Qj<A
zNY##uQkN(w|KryaYO)s8AtI$7U1oJ;SGO^x1d@Zab{ntLx&y7Zq2y`|&KI=*2~4iK
zuKc>=rgqY~QAMpS&lM?nrX}VM^_<E>8ojfWoOAOz+_<?*|1M0cN!XlAW<KXJUKuEJ
zQL&A)KWJuy((6se3%-ULCOFOEo2D0{WM3!I{S?quHIwQ44alJu+9a9Xwn|Ap4x8qH
zGNw&x`H7|soM2gU`J@*4*4$}tjFz!yg^+WUz%%kKoMe}ANwLU4v1l0facWiSG(>T3
zFE60N1=WIDM9Szl&zLE*EY_dnoYU<@U;LBakx99%w!WtoSwSdQ*uTnhjy=UBEn^km
zU8Gi~_>W&_sP)LF?cUvZ;XR*E@0MqpnkqaAA``WB+M~tJi7aCdZYSomwNIs-UdKC5
zP36~=ite&}&L4qwzZc|%DFBJ{;I(x&vhlt;r4+h%^23RxPrYUk{!-aA`J4VG71?@<
zd$vxUKNPEg`lQD}T-aEpF_b_LmKp8!0`k%657ir`?HgL+oc%tf_gk3wHVYG9E4Wre
z6vN-CQ2K9I5PMfikI8Gu6Q%MCU3_LL95OvSz%%9Tp#eWp?oXc~78MuAe*VQ|J=oqc
zocO~LUcR$<6bToYVt}}uYoW!x7z)H+R7%J}A)Q;bJm@lZ1)}~GEh+6&{3-wI5|k#s
z0b{yNs9Z1jJ-P1JB9qV|<753o;TnLLS96wli@d2zDuB5^cDm86O%%tB5hSlV2mkFa
z#MyUxjf>6AFkj!cXLd97Lp;nQ!v@`NL*!BvKI;}da*DGPj-LS$99D{YO3JBkH6U%o
z*U@Ovl;b>!nTJ&1NqtjT5D3Sj51t1SBlZA@D|3{h3yl;24F4>I0!Bw@JKnW}llQ-Q
zhd$$;?e1p@3_Yy1RPPAZ<S`jY4h&Y$9R7ryL*Hl&T{=;`Am8=}IAe8nB(E1$&fV(m
zO!J9G>jrXdNS)Qk^A`^Wv%^$!C;a^I?c2a>*Amv(1yUs4zwmO5#Qc6%LiwK`)puM^
zwniB|_;OMllEw;=v3s48XZLhxXQl+%q^s)ka`5=)DMb>Oqoh9nOnp5zspwV8!)t7o
z^va6$b?_^=98-x5Zh7OV*rcWlf00cu{hUu+%ub&nffbI6A+dl_<<5J0`Jc1$Cq*`|
zHmFKJG?XsW*<>OJfeG#CWE+K$lAN!ruaDLR4kJiO6{H1nNl%APp+0Zr06O2nB4V|i
zLoMcZ%p&D~K`EydbNpN&3pw+amCFDoK(d>{1(17p-*BYr^UrLa2=DM*5S_O}cb4P$
zw_iNelCLcK+ry%o87(KhJv=mZoDpetuV&NN$n3m+|1oux2s`Y^Z<b7&m6`f3kCfm~
zljj&Xkz3BaFycasyXa<av13D#S;J$mt=Gwm(ei4(U%p=6R)rp2KN(gyx_9tR#}zXz
zt<i;QUIQ$ik14k#7no_t`Vz0h%w)+iVYA{Kc23sI{K#t?@~+7eJ>F0gvO}1S_)8Mb
zG5!fXTTE1zJ7~sby`nP=n==TUSNmoq)9wMcFRSK2?2TT=NY`wiiwpM{{n(@}P%&!4
z0sEb!T|DJJnk8)Ve0gFeGd@u;D}KeWc(nb!+3jKhA#;eF5)=v@9GT%ZGc&74Ki&!j
zab8>XZX9ohhPJL%bI5!B?C*bJyg!CvWxw7vi6TSETRN`DjX+w?q;3&HzNzPkXT|Qs
zO89K1#bWDTM7KHy*oQMIvm;5T0Q+S6;T^!^LKH1IK%s<uGKI8|L$^y<M(hF^2gMzA
z9qefmI{wL;^F&-8u`9DbsdJ_HC&XPr^%dF(RnRg!+mB5IKd;$NNKJiRlVI#A!`(Yu
z)p=RVYim7$Ox2`_LBk(SMi{@(^jWxl^vfB>x3$H=8uh%^B`_U&IAygxEz4@1@3xR+
z;uN3egx~v=wl_J(De4TFTHD36#dI+n5=Uoh$Vky{Y>dA$sf2KG|I>!RXs~EAF3!|r
z;D<2~^zwcXndB{N+==4rR3h|r`)Mob%)$s}r{zm^>i+w=E3Zu$x>goHvHfR;`S4oc
z`uO#R?L)3yVK4JNja}bHsQUXNiH{%6-4YF~%*yMF9#2i`^<h{eAcI-<rA@jp{1DiR
zyt(yYKf5UZy)>52A)V6U-0zFFtUe7JF;(t5)tR&A-bbexH<4hdB${;s&w9wiytbyR
z;OxD1`+=`^lrTIQx-mMD#tGdQI~uKN7L}fM8FJd`_Jmj#3ot1JNhR|l+!d9E3l}$~
zIvPy(oq863$OxXnG%ol?X9@eH2LXS?L{EsmEIq0+BxjOYwS^ANeah+=DHl8z_GjQI
z&1u>D(`#?3<-bRlaeG)$XUvfV5oqunee>16t6e~rby>`HbC$R<Oz{#fDYg7(yS6$q
zw)GIUx3cFwJu^gxx2x(V!cz+$?E|{jV8~tuY5M^s_d-pwiso(4V9}j?S+QBfrImTb
z!t`CW)7pZ(@^anD$;qWI!O~dU8NFwzKMl-;SxhlB8J>1}>-d>5;N14tKGXp@Ur!nx
zEhZo74NjX%6*K6;!D*SFnN*49?8z~9RowQ_U$^M&^rn`u@Gn0DBc-KXU;D9=M6~}3
z+%#);C%UHVMkxC&D3q$g66r;T*nsbsyMf-;hl@;ExDP_+jZZ+#1&9e-p)M4TmLvc8
zew3&W+Zjx;0<J?Q5h+9S<&9aZA@2DHnTw!kV5w=7s``Mg$FTa-MEjNI&~f?0=q8B$
zHN;``|MSpyKL9#unHcMZZ41}sb@8#P_O5(wtgM{+_{5OqR-=!GTV3hbV%IR$hRKHf
z{Cuxr(#9Cia7p9tdf9ED47SOwoiQ{RTl2_1cCYUw`xG$kf?^f9$hAmrWZ<t$b|t+S
zo9F5{)!g<gb6BCun8^gcbhPrUyV}vw@5g%~<3^3&y=n3{k4>J}bkctXC(JgRV>d}y
zuu!FKUu4wOb_cQ~OVRe3gFm0~nFQXe+L;Q*3^Fgu4eTros&{G*0RmU`B?o@S73L6M
z4Z#dHdX#_Z^J>`|CMz^A+#W-AbewlveHltEp>{h)PF`+l%{DW>q*p|{Yp_Bkxr=&+
z;6-SH!)$Hwc$l`wb8<vG;k*Mgo{|=VSLMUf#4PI{r78WIaW-Q2nLBnH18*nVm(~rK
zRlFXdukh*2F(S!(S9Nz>Ov`g5c&%-0#XnzO%~9R6?sYKP6;W*NT)`ghhmX`~Gxfc;
zf1PhVX)xhDaOSh~t9Qd_lLE+C&o|P62lip;g7v}U%;BZ&4a3>Z@ri9rMSB(APy2nu
zxUIKg&E}vr-XW}}GhV1%c&3^Eq<+7CCCeng^Qrs~7qgsBgFTiW?}O)1&XZNrz{(SI
zBj_+?Sd;`V2yOs({{ir!Dcx-q?9;)~Am);3{9NJD(7Z)+oURWnyL(mq6#Y^m|5%{e
zd7kk9`z1#ZHu^il`(Gd#o3m@F%^v^H>l=8eMt%E{e<F6DVZ7}}9DKLRcrfl)<nYi`
zY16~l*H=g;2gG%kqsn|OKpc0BjKatRDxs*UwZapi?@}x>udq;^6SC>*OPE64)Yg_G
z#F-yr+Pas+1z{VP-FoFV9Nm6NO4n}WK&x2a_bTiOx1!l^Zn3Qb-*=0iBr5E*>ko9#
ztXOw5!~^{26ia5C*g&zz$IWFRO@ArJ$(t<ZIPi9glu0~^{+vD!0JQ(A$k`AK&ERD|
zXt3W>PvreV>_!kPwJhqE;<AEQwt{&0NgD{*_g|3-4kxFjLejH7TAP0IAC#I@ZLi|h
z?VK`;)a{7zSi+&I;GNLdW2yvi%stvQo_iLtJbp*Jr_OK+b$qWw<_Mo8qWGj&9!-+#
zPI8r+jfSA>z_xGjO^CbIpsjEEOBbDGG@S=R9!Ps%8y?El`bI*+{q^M}DZ8updI_|$
zkC?uV7MqB&n0b`TV?P2ixI=-kSN+;h7^3(45?c0fJa>7s5>+rpbD(;JEs)L-g5!s_
zL@0ZoCg5Gkb<sZ?W<3jLKAvnAO7ho&>I&KY=hT-cX#Z7SKMS`+jZ2eJ7>FVU;z3Ey
z68dRMX*(7FuxyEifPWR(LrzYC8nWcpK?{0-=8t3}=PhjAU?|zUREi8J->XT{GIa~g
zD6=Hk1-&$J>UNwEo)Q|k1y19s9k-F7+tMUt!SKf3StOa`w}ypEwugvvyEh`0p4o!v
zF{^A(QRj0zlO>g;ahtyCi5Q`ypEjE*@?$nl=c^mG>kTvg{H)jc%}(-@%^7)_je&<K
zco;(US&`5E;}tk8C(LECu<3eMcGrAIO@q9KOZnF~R>>ZOIA~>F&hOv1#qIRU@-le#
z{K?g5ELjFt5;PMP_SLMM$>w<anGKx!Bpls@MaG3+CI7k|CiS)0WNOJCOgQnd$=kk!
zn%Nst6tQylAm*MoS=+f5_xrQ{n>0O;$@7Act!n*_2zyVPFE1n%ibikzsVpQH8ExKc
zMtE&y9ebqlnjfqmPy+Rt-(shBV&MM19}M<?OC#>ZhbPtVzBa4xb(V71^Jv816?0Iw
zO{n<QXSLLwYw5A~t43}*3Z9g=ES=`KfoF4i$WeflmWka4<7-{;WrUr4XeK<8i~_*1
z<8b+ffGN(!t2-tbhT|6C!Wp198P-Wo^fwJb@tNN;_d+kOR<C=0qW#^JgTx(>DZaly
z^x$`ez4hv?O&qD+fl|TFBiO_A`$hK!uNNlOqJ*o-86h(z!JKYJS-L-}B{o%Y$z0mr
zlJ%j;D_5NX+qGs2WYRlJ6YX2B-!p#B$4m}8XtX-W<)Trq&0sxJT7J*Jxdg(*#cdGq
zV<L2UKpj}qZJoy3V!&}}ZY4g|H1Jqv>znjOkz}d9;}9#Hlfi~qUQw9!{C4Q-Bbnx7
zTXIZs%F!`*rps0?$7d1MwKZP9cQWJMScni!Bv-U9CQbRx2TN8MCF`?I`P8k?#LRD(
zmPGg7Vn)L&oSor>wcXS)_R`MBDo!0)$zXG!(j57Wh#)y330eVU#`jpO+F{~LcdO$V
z>qj~3aFJY_K4)iVZ>`P=Z7CbF+eca*6OT%wH%bwjP6(2SH1{C*E~B8Fd)ywgl!!4B
zIU^#)^qxn|_)M>e*}|qM{OIen@5)R`f2QZKu6hV|Y;2^v0Yzd+kt#MW&tki^@#=q3
z_U7?W_y7NI%N4DZ7Fnkal`Vv<Q@JD*l_XiF5>wf-8)m6g5)sOTn6e~<?E6fTbujk9
zU@#aAh8fI^+0I+n_4%IP`JMB-o$t5TUujZ|_iK4R?~nUyHc}mXk}MP`sOdpD>B^IB
zT2{8BBDp&P1N|!pzdg^2_~g_0h*3pM`5bOr^r*+JaxRCACyfT?^!M#O+XHzR3MJY4
zE|lsv?^3UswD5TK-Np(QhU`aXwmLoIZ;uIE{&pSt)$c<Zkye75-4YafM$D|5z#8_0
zeB2&D7(so|rA1xZuQ<T)U+W!TiXwu%A)WGzqF}bor8O53nI5U=x~(ZqG2=~3F0PYJ
zuN_z_UK<tAy{u(y<iGK`M6ZNgp$ak31xW7ck>q$UaZBZJzFQ?p9SMZzdN96JjRkcW
zIH%|Hz{yNaHqW_TJ<vF&DSvK@;5BqkK}(X-w7O?CHo^2s>+>dHf4i%|35N_risg%2
z&xI4QYk$G&WguvawZn1sXt~pS_9Q(_OU4Udj|r(@a-u$DDq*B3<5=~#dlwNQJI>Zl
zbWJG_2MA!H-C#*d#^NZSA9zm|Gs7?YL~?h|H8)+yC=}PM_Z94PFG~zk$!-R^_4I*m
zhjBML)k`K$R33iL(V|`A?ljHA6btr-;gg-V#5t{Zn#5$dJ+>%Q@{xTsMgX$moHnT7
zDjLF#bI@s1IymTY8N!>O`U5d1qOq{%c#PqdLk~6WooW@uDm^bBS}4C9eeNRqNKd<)
z_gp7Rux^`sE8H^6Ug&t^`eQ=?T~PoD*)UCOy@`UL4;jeAq8=irlPg<wlCJ_BX-Dko
ztA{Nh1@JeX=Efo~3u&vIu7xNq>koFMa}}PKt>EoGN$<-r21Oaw+U~>#4Eiw+H`=If
z4{ky_#!>1t;HUP7*5!9;n{G<c{j1Z{zxs+lNlFF&vcP3h`OjHL{FgirInNcJI0B?9
z0-}(my%fzqEt(jzdO%7V;>{+X?LL>IC-(m5gHIuS-*;R!K0`h@V!#0Qe#--Hk%jh=
z9*T+Z_B)eM)1nh`M*Llq2X+PMYRc=-tl+!yV^WJ<^E6Wn(AylUkPf5Y^E{IcJn?S^
z+w{7q<t1nFK=b@KKxTiSraDc<d8lYiT0+)CJ`Ts_oE=60=bJa}&*S09;JVlRNN3kQ
zw|-^hvlPPRb1Va4^0VOr0n+Y4u~F@<{n0$2ddhbS)NvvMA)xwDVAm(Sjj*-t^Zm7>
zsr9NZ-`)eJo;>@IF=<}NO(z5qEWvIA){Squbkw!cjN;Xsb`I{{3x(@d)gce49Si!F
zu`_WVtKHq2s^66>^eY5k!V|)&F$NuRK`ZdTV%jKUzLvl4<hR@_lTGw&?6OA8@t!DV
z+zx&2a048_Dw^d&B%LuWgZWY2RtOT`ZWSQwoU}jRK0&9R>i`OiG2aBXe}OLbW@mIf
zF)Ydt6KDUXNCO{!v$X%x<Va)b3}kS?0C<ArilOt;081alMC?K4dGMq|bc#~{p%o|O
z{e2&#`~_Od&Zs#2FJ8ZEjQH5IF?Ikwx^@lk(L4417ZYZfpS?pOQbgPDI3&WfUy`KK
zqQG9e>(BSo%|t$EYm55{WhV5`Oub2KQb&Z`{h5HUq$H~q7GIEAunDp*u>4fWh>o^$
zTAyc(Vc(y;9rqSk$ok1-$td(F)Dp3$eDKPJIvpM}T#kM_bC6CCLKN=`W6Y?Ay|I-R
zSB^>eN&})ok;-S(coUL#bHRg}9(VF}d;9vDwFrjj(?slJhV73`x^)>i;29|;pr16k
zR4?B5R~d44cHsjw6?w}GVAXX^y4!Wha|sFDX0s0MIRnEzWLiGo<)i=pJY|7iFfueW
z+`u!!w+GsGc||wg8!JZns*3L)I9FFXRS!bquJoTM-Ocqom$B$e_JJX{5m>7*UJonF
zGLENJvqmB$uy>VZ9gNQ`lZD7H7!@PxV<5hUdOE((C3$VV@g=n}&p@YeTk`c956ZQ#
zxI|PuDhS?%9ovPuSsStIb>tHF4|EiDLG*R{#%Q#bHLYo8J%q<JvxfguQQbIH{bYAN
z+cFU9$#(sO8vId<(7pbdBI5Ko$87(jb^o#h$$1K(<UUUalUjwGC@iWr>FGrI$arC?
z_D9dAe6lz0<vt#K4-x}MJ~6(7daHPTcA&aF&LcH+5r*<>9Q`39E!&ONZst%?m-ok3
zY33Kc$WicWQI;FHE$l&G!eBH6<F3a?yd^X7^$s_(;#afqJ;8rPKrXc8*s5o!w=hoG
zlb4$6+HJCQ@EPV;L-uYmaG$;cYfw&T0VZKjU3^dL2Le9dsoKA?^b}(fU~R0C4CYdH
zzgqG_OI$J#GB{=kS}5@5evWSV+=11GhdvivI_(3huBsXl02P}LTg46Ue&pH&ooZ`Y
z?^(@U-aUj?+hN>*H!ujJinz`$TlNzQCk~D420t}xSlaBI>)8|#>$24RI;@E8#M^}Y
ze4n?8*YP@6c?i2frcKBzkq>%OXV%%>0gcJaI!>StoOqD@=*gx-k^gZ4{7jAw-U=QQ
z<sEjmD+EG5?}3mHfs0+<pK>va@!ck=#YM%EpNS=N!!JdTL}|rR1`r|q+jyB|=?Bz&
zD_w`kvpV0#smNm2UmnTdBNUbs{kpXdJa89IG(--!olh8M@^bpr_PJKzexL-LzI*k_
z$)2-Cn}|yph$lKJh_6ziSdeJ-&HdX)bUg1w)-Y3`uiLk0ELAhtT4!|l*KBNPZug70
zte(j)<3o~pV4j5P_vSmf3*CwDG#ASQUphSgWP*ILt<F{hnSr0TxrTZgRPwu2*>(|n
zwCIFf^1X*?Z_#xVt#XEo!Izur-Pp^)_NcVgaK2xVh_zqs>r(IL_T4LQ?9}1`y6PG<
zRQmm@j85wbC+CGKn%C~+;6|yeR&%A48R>iY1pZWhD1g3rZEwvp<`Yt(ERq{Odz<;C
z{-w{jK@v6hn=hhPunq>eM6}^b=W&2wKBl)=k*>8UzPJSLS><Y#v4V$`%sxK+vSpS;
z!@K*xQovnJ9t8kC&bx!;eO$B`WKCdWtO@=p3cu7HBg;5`zsXth2lqU&%P4YJx8Vzr
zUP<-%M8ft_pyPE9H50>X((5C??wBlb_E!y#*+Ook@4tbPih$G?j1!mKVax7pOe|j<
z*qfeh+r8~S?Lf#axlZBfx!QlGLLmE#9^*zU9;);R+vLGbiIAhYo6pzCS2JNJy*<83
zIvD3bpa<t>XX9VJ(#KHW#n<-feb#Co(CXGY_BJ0?rqY`dG`cY4)3gwTk2RBBM7AXS
z&Z@0-f*!mxm0t{POV%|5i&ix1$8G~d<eTj1W%oMU=ZwdmHVg?)s%5W<qGt$&F);<l
z1iTZ*f}ATzwghqbwh$h%5WirFhG7S>U$CPGZ(l2Z*ac5C3Jsk5)g}mmr?X@{`Gv~X
z;Kob!dmO$S))-g(xU)Yuq$<>v+7TFZzcK2OTK37qk+DsFzg`?U)e&6ts7KM>L+kIC
zt4dsN{tg`)?Yn)?R65AW4$B<@RmIym1*DAPE_1=k^VXe<WAYBhXGVo%HT)}U>P`~x
z74Vq8#3Y_h=&g0w@_KP8_-8$lx)v+&1+$~tP)nzz;6F&aNB$=E8h`ja6XKY)<o;i%
z;Gg>TsXtlnH%~*amm*$>4|vMP#1%PAXijv$sQpE#s7-_T7~bc-o`KIBRz1)EtXz0*
zJNGqhdzJKm<;gAHfPh{+juh$ji%>_Bm{#?9G}w^Ym+(d2BevF6=MsU+37+eX$lozi
z^_}=x@y_Jq;*Fx@R~=Ep_O!;XRc|3*lE$#FLu_mws{PB7JXjE)2JbK_bjeBuB|3J8
zezKJ`7=TNA1Px2OTf2$k=Cz6ra{is0^FNoDTQ63!1eX!B+_21{?k4QlV1BhSD`+;r
z3-61_IS~pA)(NnEf|^gbjmk5;lY|_NHIrZ5sWLcSMHB4JB~V-<Zn?}tLfleUm_tKl
z)l$#rFX-SqfrCka$jJbW`VzuW0BZyluwc<~#UChnWezDbHnyx9&Imptn{fpm;vXfc
z@=4trPN9ux>u|eJLY6|(UZ^EIlSBjE)l!BTe&=0Cnfg{;t#k`jHB3HuBHNVaH(W(E
z4tmD_@Vq_xpsM)d6=Mv=hyn_JMx5bY?V4{lIt(=8C8&=s$zBNULCSL*kcFc27Xt2<
z2;e2eFV%%CReuqnzq1Ay+r(E)_8l&TJXhyT?LtEKjUgh=y#j^^U~JI&tMM85$yOt=
zb#vZFGJ7Aqj=19cmr>WtWR=KYYH#MRhVBeD%+Bs=SA3wgD<CjXbfLY@Iu}1zV*f(%
zs>c<U-+O*;c6I^~D>3khP>o&1L!1?WgoFi<>8rXjBwe}mi{1(>CzbB=dRZxf7Gvob
zdA~?DpaawaW>}AT4Mez3e4*<cv;dkcbD-b!&<_wvw}QbN;u&;^z?w55i920eTh-?9
z9s7WPTrNE3Fs!B?zjC3!U<r2b87)uw@`o(T6`Nqhy1*Y+g#}7KeNws46H%!^m7#LJ
zNI4_VGu%HY06(Nnn?wny5}a-{R*eQ3J>whdLfDnM(p(=Cp=wut13Cj^f0<$^%QXSn
zrb{39mJy7ZXCuCwtM{Y#xPSE``A6l+^&^v8X1HWwtVdU2d3$gvjH$>!P=XpPsz2rl
zIfaI-DSL({y9*b}M-+tX>X10@V(5{Y(YfvAH$#DgEZsjLEpc%r-)X^jwU0PU{Vb?z
zj<W3+IO*qh0|7jsN@L{PCmaeuT2iE<!oli{T!@nbaC*b}&&Iiv4iY2P*1tF)+w(ty
zQIHh9N3W0;qXZuvf#Sjkm#K)&+fYSwPUg%opRn=)PtKs{X|MA^%LZ(xiC&{<n}6|c
z%(;tsPg!;o%{~%l8*QzB_bb-J>DWy;Yn~+!>@~j$hYrHoxl7>{PkVVMK1{ORC(i|J
zU`>octz=hzqo>;Sujx4siaJ-X)q%MEU(8Jt{9Uy0ZK-+zZG3~J&-|(PHlrtX$?#nF
zHWPh=D88ka4y9emcv&MmS3E(5S<#s9M@D2V%N_2_ZOfW<BUa;%Tpq_g>Dp4ho9GlY
zLTUA`Sw2*VYFT(G33(qTW_b4szc|r{cPI)K(7((g4ydccagL!q+xpjUbB~)Yx?Ds3
zRHu9-i-bSdxeZHK{8-C1qQAp936$+>F7E#}5AhA1`C>Munnh@teDoZ%h*r%`rsISc
z3Q>bP$=TF;5Da&dCgBpGA6)=zU-qTt1wEYT`0VK0LinAaXGz$8p!Y6<T_=t_2B{nq
zw!CkN4@k%n*?<ejCEm=xIjEfaM3_b>R_I8O^ZDjWBBXv$3t-O_gVzCsl89YbWz7RW
z1J}fQ6LXz?CN&d{pb2fC^hOkP@__CgmN!+9<sA)YP$uSVUZf?La^`YTbb%>BCMa*g
zwn{yLU%jT-sBRK|5(>YuKEshC)yEVrZyj!YmCOnUxR99}K(7)JbxKWXF#-o2@JRZd
zIm>GNw7k`E{2+1{Zi?>@Bz8UnoXOPe*8iVEA3|*PDA0S(yj$@deYXG-UhUFuynQX(
z1&`<ws_aoDPL-CHYFh4p>OljR(6#7%4b@0DJZ7-=R=B4h)H;4>Xzp{Zi-+)3R?P)t
zP7CTla-Sk8uuY@jy^tM)@+-!kSdMVQ1S4w|k8UfTe0^4XF3KW;0UQagLa*rKReKKR
znu#A$b3B6Kw1I*4?h``^7Rjh^?L@1Le~UKhae$6&kW<=lEAN~rv9FO<9G~5u`Qz_J
z7FD%Sc@Udz6XsJU^<~a~IDN`Y-lqb-=!bciZIg^RIF2>nA0rqCjjCp01gv}2m*yY{
zL?`aY^JY=YL;CYSOeQzh&Uk-gYFwD1AS-1}QI9hj|0@@9qicS!c%$|gr)GcX{nbxE
zc=Mip+_k&nW-11b#@xXe{QFb!^`U&x<bBPp&oho~J6#ClWdW&DU~X9au@aQD{p^{~
zJA8q&sDK0N_}LKm-1uwDWgV9|&$_ltkGQ*)yTubeJ}7={s!OZK320#ar@`Vp87Yc^
z1ooErR3dK;z6r#>erWC4NK?RWr^r8&mH#bl_<kpNgXco`a!=4*B3R)!3S}CVe#oqB
z<zM@YjXlms$k4g1qW_d~O+iZg${SWUA)@|#rpZVUCx=MVTWxCE=iKxsgLpa-gy3&A
z5x6#E8_hdpC2AB-2=1Sa8+=b=<fl5Pd~mJq7|=YC5UhD29s)!^?4SC}UK&<O{N_L}
zcg<1x(jf6caiBJKZP8PxuWyjyga&j*gB~goE<+{RH_}@)3US}w8mddOZx?L@EwwqW
zZ{~+fE%)1fz3f7H@h+oso;*4ckLNm+d-VMMQTlpx)r*hW?d{v9vQ$z1{bg76?4~Nt
z0gL_;#~^4i?!weyZ?;Vl!yP|;%hNAKt+YR@Sn6u$UqumKHNMZR-Dx_7CvrQYtr9g{
z?o3}X*(VtJw|%NtT_{z0NG(adU&r0XI;dQ&R!7;LYlQKuBU?;Cza{Uh@zcO|;W|Z8
zk(YK-QH@jV4^PQ}W1^l`(|8rYGG{4=S4>fygIzKcJ12IA7SsVmjsMXFr7lzd*a{6#
zad!C574eP3is>dCreE(*1qD+k%0q6OJN~EmqO^GGC+jDGQYO`<KPXn0>Ip@MUn|+*
zJO+oWOyV`yolJ(?bo6^HoIKwiH_co0q!C~2=Qcc3NF69mxb`5qz4bou&|NXTfE#|q
zALq9CJlzxwxOafsr24)4vF#ltKxa9XH?TG2v+S7>mQ2VQ<K?@<P1Fh(*5)lsAOS_R
zR(dJ*tn<p<nw1`{WI-BprlwrPUmk!;8`I@~h6aP>VRR!9FI>1p2B?*>;I6RcZfk<a
zdSpjBb5wd~HnT4w@$qCNJ#R-B^QBSQ@6Ry5td^)*o3nb~8Wna2(B?IOCZK;~s?}hB
z8J=HE2<&JDif;L(p=*f-PSAZj<K8?+9w_7MyleO!Lk+`GF+NAD?umbOU#e$rHU1f1
zB5YFo5joL-n9*Dd=ifuIj|+`cy^T)x`Y}et=gj`Nl#D2dR2F9hXLe6%U`Jq4sKL?v
z6Mx3{11S4b{PXB8SO3cQ0eZk>_VRYwwy+PQqR^hEhEwHJ8G)rimH=v@7OQi(<H3U+
zm;3tqy01Zw$17=9x)$%A_Ybv9=g+Pk5Cx}Vevg3cjKOJ^UoxR8(qO*$r2&?1WdUzF
zOZe)%?=WA3f=L05#mPwq@BeKF1o{te8I_L<Wp4(LnQ?%g%D?fLQ6Yetssjv3h|%T6
z@SgDT4lehU_}-=96D&Yr@#=h>q~I_T$W{Un9`J(5O!0=0d^(u$|9nM-KPMLGTPMk%
z?O*WRqZ9N=A0(gE5#IFjR6%Y*d_sb`W>8>ca?8W6UxP(Y>Qr>Kx;_osxDK678T{6f
zV5V%v9Ul6w5CvLb!sSuCCH#(|kRf0yf951PfE*{Yry#?aC@@z!Qb5t|GL3{R?b<Bv
zcoNjGb>t20_Pq(gSx_B_m%g?g&^aAWNBl?SG+{hp+_QON^ac2EI%Lm6_TTg-x>93e
zu%^=TgKTE%S|-miVorim&px?@C$DS07V(F(eW`CbY%;um%4E@BN!#W6k?BiX`&U;Q
zHG+SJ`<8`cv70>w?>eS!scTD8#%L|fxVJGo5)%#>(mvQpvp3q4<szfSonhUbTN}Te
zZLCw?N~sGTQ>xV-Qv%@dBcPB?1!K0x!BZb(kag<pDF6-^F*>=&=&r1Vi)@YN8TlwP
z*Yy^F$H~5;fa&^H6O`yEoAqRqID7B8XPd$q<6-TSuI8pu5Lh&%a{29=G@%txW^MDY
zdmcJpCc98J?Eh*lt$fCFc1E=-hFnko0I7)v(1Zyy%chuwWTSugQpn2LLkkLvM;E0+
zhyM`-Eps`n^!m2j2VR#Ojs6{F1Yqv-{}b8M|E-03ww$>Y_(YRhGB(^NSFyigLiFN$
zCASymV}Ai*UyJTY=qDG5nD`$+&QZeq`br&lc~ZXmw^|{7Vo>4F^E3eIR_9V``$Qqu
zzPR#LUoa4`{^DTnwA?habpv3v2Gz(Zvi=Cp4iVG}!Smt(Cl-es1kv-1*&%V<+B`J3
zOVxkZ$eS4pkH%x%Ot%jL^eFtR)02NlY|(Xq9Rh`2dB6)hdM#g2=txQ_yZ8s*onJW0
zm%LafH7^6O(w*TM#v6ngK%k!psM`Qxx2|7<t^bDx*G3wg--IwBca~p4)Ne40$9mM3
zk}Fxsg;J4G{))zB+qi6vDIddm^xXBDpGwi9?Ekl|OcKnnEr>b(4Qw2}r2k*}{QqSI
z)wqLvN*Z`_Jl|ZY%M2$xtV#!jYf-v0;_G3^0|IW~yjXSp;!f|N-$s81qJe>H2vPed
zGik{J_{PLp(lm5zi96;o4QpMnELoWb!X^BJElj~j#-`0NX1+iK+hzL+*mw+(19=Ln
zEEfmFOuzDdz3tel6K<n2H9>XQjmD|`mq{4vQvn0smrM_|0av}r522ab)&A#CuD}3e
z-|<ROOzZD(pS(7o)ipd@6Z`5Z)x=l)Ppu0D>=FL4*oD%COsFthDsuPG*u7=`6KXh~
z&7$&Cxs>1#N1i<Vr&97rUCdL-KiF@EP-2+&oJ_?VGi<%Fq^tayud~~D4S;@cCtbIb
z%;<;s@Bd@3E1>-Mo4_taQC*i<DKtj0eS@&k6WhBf=Bd)sX5+(K2DYv}#hpZ<BII0}
z27EXq4Ipg3F=ij~IS&g=>^cwnZ*#h!9&9~k^o2*>|HEbeuz?!NKv7NU&j96tK??yh
zJO30GLenL^8jtPLL@1QS#N`Y$g_(qPkBlgL8jxJMYhsT)Nk?UL%PUc&p}>~1h3W?Y
z)HB=d{(ZK=OP!#uD%h9_PR&ZeU&LfKn$d-pc}^uta>HqWDQ@kl(MPe*M1i{dSpDeI
zX8F3~8_WE}PG0jUdmr1znOFA@KZfwHuJKP^zF)JZX!Wo0jen875BSnsO0SCAT5wZG
zk+bvjhe-66{%a7WctxGd08V7Sn$^3MX_VOz)EKsWQi1<6W@(>sg0tfbr~BxQNAAC8
z=xFHN4E#H>>dg;i?tu>+p8Y|b`c_k3U_IpTmR7c~5c=sRu&^1`B8p1$M%o|r5_R7#
z+C>kc=>i+!8ABJ|`;mrnYxWLsF=H=R#hZIYK@vKkOSv;jY28TL?3raf&FHuX#1?|f
zVls@_F7sQe4-*163&+7cB`=2HOr?4d;__M(2px)h2nOKdTy3V2HrWQsLF`*Uhh5$0
z)NCvmFb#AxgaD<#wIlhyT8HfSPGp%E*AkvEsH-nX-A%Kf6)KE%r^e&lvZ+(|bqljE
zC|W;0eVNOAE56DtEo9b%m$s4b&w+ShsD?36O;}LFSV|0i?9cB*>AwVxS$vH}ir?^Z
z^`9-x{-C`<2WZ^I`?J=CsgdM5`r$20;<!k113g+7=ing>2a@hHYE=%~NAl)qpu?I)
zu&z^$qj3{MfhCsoGx$`ak)h);UUPBiz!h_MJDkU?>=WtQAC*=~k8>N=l;#b(7HWgd
zSY?KH{QTl?+Sy8$Vj3C~sgh{wn7E*!(=J$)KIXJ^W3$-UQ~9*;|1LT{Uny206$uxK
zCx^N)npzNQc+XdPo}?fP2>I?=$z}u=>J;u+?F;>Q`MuADiQjEsrS+JfPx+=PN-30A
zRY@o61jOAmjf;%qGny*rF;|;rXse-f;=fxdvBN-P>ElPG|F2mmZ*q5hU13uLy$iG=
z%0E>j_z$^LPv0lWp1Sh`JWrrq@WrSLKNW-^xY?MBEkGY?V~YA`ac~CxFaTyn<(d(g
zP*;AwAmk)|2zIF|iWy7uwfE9Gs1X0g!!1pn?;7vOc$jQ?`f;ay#GHFheC5UQ!ViPm
zI`Of<JmobzFOFX@fsmhikh>C73r}`~SiT^=4p(8+-@PE}es<&kYDC$nIyUbB_gX)5
zmw%#=zkLG4eu+4^RQtRlnHBws-C#lV_Lp+Hgx<A=kOZp3FCcGl(B)C7rt~BK6_9M^
zUcKP2#4z;7ZLbm+P`KR7|MoRw*w5f>1n?{oJ~KjXoy#+0;!*bRlNoXb1{t~4x~nC3
zq4-n;{mZS{d6~E!rMBH8-UNC6H2qOdZk)Bewn;+A!`CCjy#q&V6m={8IE$dwCM^@7
z#bOd?+#!zp2I4JDDQMXo5J+tS=G$@SMH_XQXSP290KfVtFv&*9yvC1M2EANwD#09=
zSCm&=v?Oh<vTLadhlB$`B=Vz_e<qekq30!=iq#|}e+n(8QFs0*dU?np`OaELnsceB
zZdHtQN=ginVYiC+{XSKTK-kB>QLFKe1it;>2ALVh+{+b?4b}oj%>etf8~(KUxvs&;
z^?FE7OesGQBh2(LUOE-NP6`TW9txmkl$WbNqmDAuW!J%@O&9?UB0Gbk^a-Sdt%rpx
z=h8@Qxrw9_qrcWtj2kyBYR5eRVdk)Wt0kzLa@%=9akO!<b#QS^o%a&gb#A9{Kh*>Y
zbYMVZ?l{SlCl+UrNZ20im`piz{vU6s29^zIT<9{wh|os#h~#lKV6u>ETYG|IO(YX2
z3nYUKv;8-CK#{>InCyn$dowHI0%Gg4&1{Cz2v^@@I;{X3Sk~r|vnTgkLBWSdHcB)f
z!&6TwU6ewYO|E0`c#!PZfPhlQY5~fAjz(KKCs*?n8faKuRXz2xPrWrkHP3f47XQG4
z`2d|E;yk!~`h~oG=QhC@SblZaXgzniIh1FygqNEK0j}64a_FwW4Oc9Muow~gI+Trd
z;UUTY+28%%yfG+BV*knHUS#v<zD(Y6Px7E>${eTqA%;mLkmc#3`S%zV@^suAX<80T
zKf8IZ`1c90Ul$8B^f>ERd#ZQw{NHa?-k6l&oJO3w^NMAGI;%N)p}H!=nhyK|_3@E=
z!*g+tKm*O-qM@jW$id{rxcc;JgTn<g?A5i^=@jyH!2=ocRT<rujaYns?b@Zv)iMKs
zmL4fZ`vzQs^_pzVtPJ<F$TP{&bq>J}S4Mw<*`mS;NWxRm;HZ8~%$mOcp%hbKEnc}8
z@OcwCW@E!^yn4u>F}kaeCrsTXXV%071kk&X3p;TCaYXM$rkCZMzVDHZcEfu_rIzoG
zV=s?>2znT2<zEd<W8Vh{mG(c*&B*mWbEm`(6MD9?d9Gye-Mp02qJhTug4$w-JO0zh
zwhoq!uLmuQtH*1*_rGG9f=f!Sd~k^|x&sJ9{!Tpe<tVTFD4G4?B0pY<6lGm^%f?0(
zkm*?D2or9uOsS*VRYR$yS(Z*eAj(J}rux^Y81SwIg;Xq)<-m<Myn;D-7S9PU;mA`<
zN~7fQ1#cC0H?Fn^x+DW(bMD6bfFKkv<CFRIE8zcqFPUD#c}BLwR<TgQ4pub^UZ*^r
z?!gaZDpEfe_!z#yivx2B;CcO+o$-EN0%z~&^cQL=hIYZVLG|CdD&#epX&YL&gVmC#
zch>25nd1j>F|j$13tRK8gp{NY1|v<2f-!pmTx|{8;ci1%3K;rs+OJJRd)BWOV6mg*
zxI%AtlA7+w3Y7CpQtcg@SP%rc;r8I&;#a|l5$+~Fi||oV$iYAogj|kwrEBM$ztq|N
zc{gTJrD|DrHa77ZZh^ms*gR(LWRYdTJAf?4HJsBMW>a^e$UoqHptY=v95dnbBRd39
z-^pXep>PZH@<R9dq2+zJsf#Z<<r%VQw8ikDHS{u+r+SMhT(aiC3bp`_s>iQ(c>|j9
zUEE{&MJ(&7XDmvU87Ptl`eT*6i0*XdNg!c7IQb3mfNw;KUM_L<G1jNU0JPH7?Mx97
zq;#o^@0`G@P-q^m&g3rpyT_CSid{DGEL~ZldX=TE?El?YYl^w2C8_F>zbmpTG$d0)
zv*(>(QG|dKnPu%Ai(1bTr``LY7S^w%Ui0Hpe&w{t?Ch*h#3{h!a)Z;lO=t}OwFmPy
zmBYu-vDax$?ezT%gjKdFhTPkG^6J&A_fW;-Xd2af;Ky}<9lSBR@-;rwLWwI?DY(1h
zyqa@-O4XYas(Wi>WTa?fS!oJrOZdJ7;Ouw@faT-yPoX4N($BMD&ToeW!z745?{o@g
zMO<(fvW%wQTfm*Kf>NGs?CPdYE);F|k^7TFrTjKt=8kif|2abZ&3c`?a~&Z`M<}d~
zZp2WPw+y&O3@QMt*n_|b<8%TLrVjpt=JIa+RG!C=Uvro8xUMuEe_yjhsX&HOsKETY
z+)QU1K5dVf2&zRw72gMCHI3d$R1Git0egHqul>&1dlzeW<%a|8T18oz^PM|)RN@<)
zz<$$L?91lQRE|C0)sQeU*E=;5xZr`#R&6g_7ZDMi90Z#F0C=7Bu2;S1t95*)C}_s5
zCt^JHr{C(F<b(QGSG@vLfXb>X1~EO$%zBkJ(AD*Yu+Ud1<GWy?xH>;jXoJx`60fLh
zZc?k(b0`}XN)pqZzU7Tp95P&H+o;XD)jdbJVg<$Mw<!ievzqr2L!*a+JX#Eavfg{Q
zTIvrIbXDN|P~ReuX-eO*U-5VF`x*fC?5_|U76EYYH~{;Wtu`LQsx@>=lmq&O#WDKa
zT*3xp3vl`gYinXbivUjI^D*kT9XPPPy}f(bPys&r>*X$hG7*c7RI3_rV(|QOU6-zg
z0ZtdW33p1REB?@6ca?33KRgeyAumwq_u{J$jZQ8{s@I$Vq-g%c!_G|Bh|(Hw%vJ57
zQxU%rz2K=6Mtpbn?Ahku=2sVCq%zN*^_&ds7b`{UqywRXcSBaR{=ECe?pGhB%DR&~
zob;oU+H^gWqSN1u788ur9dyd8e2RU}&5Ui$xT954v<d}$U`3BtBfCfX6gJB2PL<Vn
z$FWjyi!}@-ma`c+-M5ckVu-?U&Z{EMzwk9o6^Zblx@-}$1RXM9b~r0td|Rg|&)6sC
z*i*6edQ*h(Cw-iC4APoz2J1imXS)N)$$=g5L{OhhbUYo`WC`xtFm@^@<@YsWuUw9Z
z=HhFcKTk4lFBp~Ob=kl0py6HaU#Fixvp)`%;C&va=re#O9$zIu49;{?MY8YsC&|{E
zFDG^m905qms14-Nt3PdzjBe#52qI`}rB23yAd9VVqq6e95;jzd@i*7-!2(P5{8#{g
zY*SeOn_fsTllA#n!yTdfw_Mxka5=ncpIdJQcu$+JS9X|}0DbO_u3;4kyz<5Gcia=+
zIWS|%w{qeQ*}};w?-Ns;o}i5M$y7|7DSA=`+)X0E0faXyd3kw^(gFl21<-ViDwGfV
zCMynl1T+PbUrGw9k@*Qg?-l2Gv2VE2Z_*FLeZc0;@S&f4atr}$Owz;Rx)D06Em6zC
zm^p}wTi17Ztj3o>;M>bvHdrKenLy!WJfXP;G3_=cDQAr;Za*`{rQ=y6L6C;RI)#@D
z1BLZYkLwyf`%Z00LcZG<_mkyG)}IDW06mQ+r?|J`m*8AT@UkhVs{t*p6&Q{mq$8_4
z-f3T;S;{=~j`1dEf@?3PhRjK^+9=k+r8Tq^s0CVa4cN+{Dt+|-#k&vD2n3`+88%<2
z^Z?-6l4jOk-c?kZg8It>c8(JOKR=c9{oqPpP-|SI@oF~eePd(e6W(`(o#V1htv~~1
z?;!*<M^;vPQ*UqBIA|Rcn8VMBJ+~uB0wh`nUy^cI{#X6|B{8`xO-5s2Us*BZu`uV!
zTk0EYz5hWcQ#-%h+_4?00&dNX-i<U4?f`5<NuT*W8A!Y*Xo3IfC(?oG-lfmkV;J)K
zVbaqDPpi}!j-$M|SR>ki)P3+o>2FO*hJR<G<KwHqZcMQL^{;OaCVINM7S*r!cCY4<
ze_V*aqP8dgjaz%_DJ`f~5K&r0$S0#;w|neI2&S((46Epu)g*aN|MvJQg|lZg-%3er
zY^;}n^KQ9nb<Cg?rEfvJA5>OKJ0+>=BaI7x$3>`Bue><}Y`BV~BIgAF+XgA+G0;L8
z#e;+9$^53d`32gCXE%S{!XV{krFUaMwL+ldKNk1qySk3eJF?DWiT<~`!xA*qS)h^)
z7O?HAGftvn7Qo99F_pi+;zE09^;A=?WP=t0qKF~pJJ0}ys&q0UCugWL*Vi1P!;B%T
za8Bxr^p{7f3$h2=F3Nj{Vio)l^fb^*bJIi@Rz=C|cUvq1i$r-)pnR6ODU(W9rU!E!
zMpm`8wY^>`S7+sSBrqabP-6bwLs=2~mA>ZeX-%g*;VuMK0$Y6I^KDEUVnkVJv1P`a
zXtFvAW(ySE<6=BcoyU!Y&{7zT_0>Xw83*kFYFb|20z^O+LL=sGpDNvDP-ivf0?3@@
z|77NxKj1oSjb<dOUZ{PsoQaq_pNa!#3V2Ack^EAFRbkKaPrr#9{|uhf82#sFfI+14
zzwGt7p0{7d(xU6dR_Y7>sFM05y8;|L+%u#%#yrTtqE2ZW#G$T1FpA;xUr~agsv-UG
z7zdr!rEXzaX=w{%DyG`fWBQ10m{kr|8O1k1<<{6i`FiW$?5emR2f+*8JQU~aN_6Im
za#pek;!lX{DiKZIWo<*;4n0fgN_IS;P-2A3c*mMX9(sXCacCYO5$pc^UM8Ya-t9eC
zlSJBW2u<M!CJywTC=SS0uO`QNq$RH|IMMZOz7jsF*(h4;I9uc?R^J{eOU!;%@t_hl
z+r4!v3}k5bSX-(!E(^<Pk97Ri7jJE(s*@hu2gL`B0G9cD?46VyR3=9F-B|tht9G|7
zMHzCW4eJ&jjNlp8y0YK_Krzwsc~RnP6{&CKS=K=H-5j8~Y4E}t!6dP9&R{{++ZR8i
z>Rg1WZ&)gIT~w=@3HLIu1~La3w$LX<4>V%R6)0@a4Li>#ztKE?UTpN5RpoeN@&lad
zF4x5xy>UNYsX&nBFQN#xu|WV%RluWt;!0o<mD>&hE#Th9cp@Sa6XO7>mycPs)Vukb
z_NY}pT{!SIOaYeXz%6nRAxLxpIYx6kh_7rJt<8!k6vT9=wRr84RM{S!NlAH&>RP*=
zx^wYhwg*Mjc+AE>v@W_!qbKV++cwK?X&c~Rncr5s-T$-W>JLZK9(rqX5MXtOE^l4m
zzqBdzr~J-G;($K~3O5PrOu0BG1`qRI$_w^UM}mKV{kO|q3}<{bDNU$LSoZb4gf_&a
zyPylNT?GGv%!&7a$v2ZvJzPi%P}|{l8SNPgc)=#EQB_8tVrM!{#1p1_eIF!b6b9xw
z=O!y8R%E2z<eSODK5jU${b4`CT}P_WPTlVmXdXR-9)KaLwi*h6R15(NM{2*}vXE@}
zDDG3hEjULx=-ym-sNUrgGFp@an_XU^dU{737qXa`z?O?G%hArPjf|$4{>;;J)+;b%
zG4EJ4_=?&M0o$`o4YoEej`}&`zEJYuQ$r*xo{E7eBz$*855X+GmbJ9yP`pB~SF*zH
zVse`4VrpM5q*I}_zv9G+<VvMR(%-^7BV@G@E7~A%B^hsk0?$NMB9;+dzg`x)xQDB1
z1<qxA2U@<cA4%3Nf73qcLMg8GG&>jA6EJVQ^o;e2p8`lGM-giV&(}-j3A*G%4pxLk
z+)ZdqQG47AV^*bgbz%fu=t<W_;Y#aRWb~lzEie3PC8HUUFdVRE?=6n;E;dUEnM<C0
zCF2!XPV%^|6MtQJ9ycn}`*0Nq>h<5*BDm5wnA5=tFRphH!XX_#0INpXYW#@b(g;~P
zwHba>>TtNk;qce_TEHbJ$P;o@z}&NS?VZb?&~3&jJs4$!XxNxlj#9YlJg;cJS0S0%
zspl`2VnThBXJQEE8Htg-m-v@PDJuWgV+h6MytjzNNz<ma*tScScAX~t?9k(x23DvY
z#Y$5FNp0OkOls!COEzy0Jnm21X5%51y>iRJVPReC2AAKb6ORwVaZON%Ne<nOl~k<m
z?<`wr$udb90(*gsq6G1FG*$dQ<{;rod37~uK+8N88RGge!+#>837CUl1u>BIU~B^|
zCPDPnsaeJh!c30edRHXvZ*CgPA+G0{s9KA@psOm5x8xcw@B2d$&%X5+Z`sxBRmx4F
zNPx~!oVL!@<}nQBLl&g6r*A~H%rTKNeujM*WmasoR3837fMq`D&WN~&$ak(K4?)er
z{HpS)<}|HM_BRqxSXIb0njQK!I>kwHsO8K8)00$jub4L`TGw_Va1r2{QRi&p3&@RR
z?|ZdFSbx~H$94*MKEjXMv7>;+cL-^|aPR(g2n3^CP>@T+esw#4qXQ)j1t*kaR}Yj&
zIhEe~EaY%|2-eI$*EYF{U+1cLa+d-D>npLsHF8&LL{JH?B;eWdJ-A9#Blx8F=`)M2
zj>>+HU7o;&2aVoe=rf^Z72BMDMtam7@%m@{1mFCMy1VhBWfFVg29s3!Wq`d~5l1YD
zcUqc_iRWr0xMvo6y197PNkl64Z`-jSyE);zgxhPe9x!U*3D=K+z{vXizIVZBZK}Ax
z_$pMFLAt6tq6j$tp2~miHZBqB7yzs0^~UZCJP)Hl<Y-OhtU5D(!9tG94XZV>bH5%~
zDfs(*8S@s74qd?>_pj7O8JEQj<NUJ~L>@_8Et1Oz&koJ&_1UL-?@;cdIv63fPXD!f
z%hD2mR@Wg$Va9NE(gFrZMfbKn%^(H^v1aD2>ULi%^G|LcJFDW2FgU(oV1fQ(z+b@y
z5rBJ{U>m_ZBJGM%9&pm=GP7%rw>DOV@aH5mzkI24Dt5Q4RvaEaA#Tim?ftlMG-Q0?
zxPBn;{_N?XF%htHYCGUjC_n~&6wt0$tV5VdlqtXf*;YYLozx9S%bNkaNW;`Yx9FnZ
z6}Ll6UP<+2RYPU4%69p_2TC*2iUS_iY^2|F*D}!_EhU!2)UEz*SsSq*75k!dYrH6d
zJ$My2z~oi1ji$z24A<b77st(f*qav{>PDC#ULDBkxB5nZxl45AC}{oPCh00*dr)Va
zI#O1TRGNX_q>GO^%MKd}foAV=B-`}g;NPSP=wCSnpoZ{iR|h5|%PmVSn~>faTE1+`
zBr<BMRG((<@6ajRcI+lPsZa4vLM{R8B~*cUzf}yJ&qoRFBv(=mgsTCSGilz<K%?y!
zCeSif!KX-{4_NyYVT+a2Rr2X_)Y>2wAYPrYw^h0t7Gu2lTeogLW%d&sf?#mE*1w<X
zVz3cOMRBsk-a?#Lg|DUba<XNSc`pTDG(yLxv9xuqV-ahK)Hfbdl^92c-(ba~bTvfT
zE$nI@y>jxHvLSGFLId<K3qxJFa|S|ZYd65|xB`{GL><p0*?fEtpCoCl3~ah+sYF0{
znrnxfc`}4WGzkf#$(t_Ucn{-hjPwN&R)*^}hR@W$J(kscbm!~gBd6cIQ41c=XD!YN
zhyf#f0cP>d&a~hkMZc=P9g*MuT=YmQqIu7+C%eyVZ95YbWKCu^s23eG(5%kMt*Xwc
z%Hi&qX?b(}_%TdW@Nrt6F8K@)DH2{id~l%%Z#7+7FhZ1)uiQTm?s%;fih?IaGioM-
zNfJj{6_Cvk`qbrDMmuAS)+*%0D+xi{=D|Kj7x>2Nle1AF9^&xV1ZK@V2dD*KBIcht
zH{kuMY<J~)1GNVuxD5xx<)rHYu{EnL2D!2y`r_=+Dre2CM5ctm$wU`u(C@-0C$9*;
zG5v<3A&uK8za(Byy+#uS&Fs7IGsYi5&hi;C&EZ4u#fQs>YP^vGA7KURJN`TV&&Ne4
zP1HC)EABc@N=rH;&ln#DMTw^>*BD*~#fq1n0#$gI!pJ-x1^7!j!A>2&<&XE8gKr14
zL1EMQw_3O_8ZPBUbIh`xZbDPl=|-r2Ub%Gg*#k=Gl`zs9_lJ?N`iZi?Yu}csFPgEg
z=Myn^)pZ%4T?pr<-tTV*vIZWL+ok~%dU{tNbm(!b@GzCowLCzH)-hQ8QL8=tuIp8C
z(~rEt^gQcJCrF;SfyVH+{{GQX1v{7R^gzQ1%Mo!5HR|ef8go{^u~Fj!mO75-1m_Fb
znq8|N5u6vqcpC3FECJX@TCbw!Y^cd7UX!{${pygk73$tV0MV&!hmyQ|sKYROg*vU`
zO)>%;*!KyB*2bKYL6?}!=^z|VZ?xY7LhG6xfnpvdNgubq#5lY9p#WZQo6Dunm9D-x
zI;y4;0Pg1T^vrOx+lxc`q?v#)B1t=NS1n#0*9{-rN|*8xA~=OhSB6Db&4%Yuso{n)
z+Go$68<mrji{O?AFPBXhWB3L=gMF^4rI+k<$vmh#eDyo6(TK%s@QNu<)@BTWuVX+$
zEONqpbm^(tIbqIY!@qpL<gDACkN!G!dim$c%M5wsvY!-9g7S>>6n+=6E4BVMi$XVv
zioEN%H2l-g<lApI!!z=S#cj;U4ON7y8004YcA7pg)_d)VyV{}sh(CjW(f9syP9Q7i
zeB$KG=;+xMi3Y$pU;Flj!J-DPrOi7}w|1-f*0+Cu*>NdE^p&HG!Gqf4oVlbV>0?K=
zT36SL))=1I%_r0IYWuu)1VrJx#Sfw(0?Le^4miGr-7{R~6gpqoJ6}vlbt|Z4o#D=>
z7!9$J1%srvG7-5PT|+7m<5z7a>mEtZmRh$Q0bxKg;;u|YRrIk%q=yZTnTnAEWdjNI
zy1w{U7OZlP1)E(Xez&I?3QnTB(zdzHc009;^`E3^C-iWr821k0K;>6wQqk0mca^Y3
z@U{l~t%e?<@%HVW{835B?OBP^tAkSB26~#OcMdV3GYo$4c6v(GlQ*-#HF&jKp*ZS7
zp>76n+eYuOADs`Qo0%xiL4#|t`Dd+H>qVvZas=ywJoxNX@GfJjYOAx&I<mC9G_iK!
zHoqFjeW%B4vq1#Zr&i5NVX^-F-^XE_F>t21@hnH@k<YY-Z=1w+;=##7fK@1)ZkA1T
zWdF?iit)2&Z4B7rJ*UXYO^m&;b8?eMDW80d<r?*9cg}Vs(%XWj4G5g(&6AsaH|brQ
zrl#q$L<(NKRe68<$$Qu5hTC3_uVfZGmSkS=inNe{r(~%{3@w!c@<}uKJ3AfA)x9GX
z*c(gu*V57kSA2YXElZ%#0jctj0Jl4aE_h$Tjd-1IFUN;G-vLv1s&asLwCj${?Kb`e
zhw1L5V3&X!EeG$G(|6K@e7az!*fXSv?DL9$r04TejpHg6Z&xK=Ikya}>;T>vrhLfE
zKI%4$OGdyg9kA)+AUz^{Vn0ZO`pK^>wmj_zs&eisl^gg;!)neLuxWoJj|Ru9Pwf8a
zk948@7<c$O8d9>egUiG$M&XI}Tb0Pp!8q@#*_h*ttV1+a<?m)x&gZ=5$$hhYI+&!C
zs4QeXX3pihPppTF1R&q@yDillW^>FO8jP52#cEpZS{~4zuWuumy`Z;RphN1TiXHUf
zUhVt5Y+kg17d^6Cz@|}e>v0n0&3-Evd(}yGH0w>u0^i}MvggH)h`!tU?>GGa{M(=Y
zAGX%ZN7ih!*%rOv*<SeUx$(ouq6Mh-$9BHS*KFj#%(3eaW%u=E>f5r$Nebl`l3i=X
z6h@l~ej`}><dl=-&UYI0V5*cc3D89oKjtrbL3flt>4F#Y*GQFyQqdb`W?f}F?1S}n
z?)SRpJAUni0&U@nwa{&`g0eW^>(!O^GQzK9sy|Zs*2j(xH9sLl{wzkwL(i8v+5Mg}
zQP&F^4JaVp$_r(>QH{(+^o=vP3q1kv^DKCc0dwn!N;t=Yb=1ztSe?i*R!5{-gQTT3
zH`X?72zRKw%~TT6#G63lbO5<g=5)V<clj%`{>yj)I(O8+s(@Z63eqGPl@A*(6SLZY
z2GBiZz{2V@P^?R{FFeMudf(EUyii8!@5?Pa=wHKMs~(2-h1T!E#ZWAI`6~-k)npl6
z&mxCuqX(pQJHJ6!@Ebf05Q+uNW4T__&FQ0KaeZqFXvfDQ;omh9ryT7d(3mbM0L(9e
z30_J%u2ZZHA7Pi@T2ADVx((|COAv!GD27(?Bb%(QbCuIc?sB{Oatdq8S2Hphw7l3M
zG<L<6NUff)=w{o1{cC|DTl}~EYh*n?H>Lb0h^Sfh$06a^Ceg;t%>TjrzwtOemHoKW
z_XtHLr{;RZs=Y*0UU*#aJE{fdJTiSG!CXFUoh#~M@-hZ=j=*E)<z6Y*{;TzNlW8EU
zXvem`E_b8ak~`{`a}0JfKAv!qfL=d&{OR?4f=to?UhcXV4#6rDITbllb`7{BYMMwK
zy*nyc>ya&IVOc5D$`DQ!^Jj73f<92#fL$Nh#^Q*hDjH<r&6^9U8Nf?aLOX~Pe%N&k
z`O2qs&!UZlMKNB@AQAZ40^U_gqF#C&*gi~#Kee-C;6w%XN0f){@DVXa?aLH(v=)S7
zdcLTx&xI18HJ7&RLSr5!a#FJ`_IOHZu4>J%xvlZGiVcv5AJ%SPU0bWFs98Q~$es5M
zdVjsWwEyG`@IQ)5G^%##T|Q-Pg^dJYU@gGqA!lc{4uYBK3wh#6Yil||C}3CgkeNc~
zp_KyxyG#<TK$z#=#2Um1flLatZ0PZqK}3wgV$DUCL!&dnxOjNJq(>~jra)=ZZ|;=R
zM>7y?7^Zv!Q-GaAPcP8VwTGO2e0JkrB@PATtyPs@;IyQQ3Yj=Jgt%5`K(A=xD_9l9
zYIU4zC@DExjWpsdrF-$R+dkMir>M<MX#Ncl=3!2pA3`hV+cOa^&o~X7bUcXt6I!wg
zR8+!XGA-pLhD;y!&nAh(%QbE6!>g4l(+#|Pf-|TbYvdXAM06W|E*WiTx8$gil$x+y
z$NmUx#73Zh28(ui{Wbi&@e$D1RQO$It%5|Njkhy*H8gIT^`q(79<_j9D81z-k1C`0
zXCd-ozkYnyb}>etf3WF9dRj!VT6g8>nOVPZwKIQyP7Xkz&uGcoxg#mSHGtPD*){xy
ztVUZha87e8UKL6AWl{-R5FU|`Si3fKyn_XL(B{iqZu*E~H(6h5JXco3?nnkV@c>WC
z=zJNe1N#u(Tjox!5sq|xySy6Y-=+!Tb#mX%?W_mH-)&jO2&~ro>s7UNKs8nH($ytB
z-Ge*6%JKD*DU{_*P)!hD>oyKF)b`{BD^E{POGn`q{5o047i!Uin`WmgD5DRejTRpU
z8BTU?rO@7QM%M^WR;)3G!Jdy4w|;cIfFR!sUufUZop54=?6^T6rRoN|Kses7bC3=*
z8%{-TkG~$fyX*HVe@*`6w`kM;AI&mZ?a5%`2z?}w<ob8KV058`DYjg}e0dQ&S04`M
z>H6U4HB9;9xetAd`quiKV4Cg2$=mv?z5Bo4>ukxdimDZ#v&-jx_R&OL=>BQ-i28}?
z1s$F)fH?3FD?DZ!P@qLf?r#bc3rXSp!tv4{J$@|x0W~b{P`FN^#q=P+E#cx6mu{*k
zQ}dK=t)rROhqX#|d1y0Y(%2W(J!Q=B48fP*mS-9+PHNDM$wW4A8&g1k!)&dZ)hd@z
zMPTu-S-1I#6O0U5OT$`y#M)UT;yZU^JWGi@xcz&m>unYgs8h8X2;P;oQ(iZ~tBj<%
zs<>NH9#u+o45mv{E59{_$aLRwbJ-z~rDiuvpI*?wo$?8Bw~SBJ?(qt{)j}&FS+|UR
z%gk&D37gdd4z~da>9^chdt|O!TNh}LJuD%8+B4|qW_Ia#HWKJ@OT+$t{Nt7NPR(=D
zd7~E2tlR6$fG_K?rwnm)RNk}rLzUGsw;aV4?-{8bl=f^dbqGKV^%BieqZ_-e3W@6Z
z1=#f*mxA?D+mzit{@5CkJP58snyk{S7hN*)ah)_g?12~i2xCr9tLUa8Y0kR3x{3Mu
zYP!+AS@6{w_QX!Vx^0rxK1WSdrHX5L3}r7_uOd>3XYJ~(#Uw@wxv$St$7^_I&dvb%
zLJCE0CDtrV<%auL2WK{FEzeJgNlwQjdmqT25j!l}w)M{j>HoZ5|1)3zv$)$Ti@NRJ
zy?gM~W7K5(9WUGU3NHkp+mU+GC@#QE$*i}tK)2mf$piGbBu%aF#KSJ@;on_tqdTwZ
z)=OU=$RmiP@qmTCVu8?|`bJus)?PDMEa9zqYdz$Vy1Pb_v^Rvq(EZef2ktVvzp*9N
zYf6uL;2b<|N*jEX&rzzD8`=$|k`j}%Dhz=O2$stpG5+=+npOIRm-u)E))f2_Oz~!<
z>V8DEfu})C@&Cb=WMJxi3iH5c5Xp7(VZqEIWj0;+qD2;$eV7R)Jl5J1n4EoPzO(DD
zfZuF79afOyGF{$p5cUOr$yDDOrg{3tAah<%U)S^I`|NUgJAF4XnS*S>*BF<1R9ic-
zp3`-XVc6Yd2%n5Kzc*Nv)vk^dxEJ4VuqgJaSENZj41>+JxK2+*;^<LtZn_1Ug^N{^
zT5M2o%vXEtR##zSJ`n^d2Zi^{3;g(l0dKkB_4SUL=GxRVUY9_+OV45y_M$ip%2CAM
z*dvg$R^60eO;VtEE#om`y<sWVzMw`Bg&=X)=`zCF6qriSs<$eD@V4rd1RsYEA3Xa$
zTm#!$u673Zb&Yp_BxbPyM4dejA4^|VFj9kmTE5=P{@4XRGc(LP5%osJ5Cjj=qnJ3n
zYOC6l@)hUZsT+T;HLME*nb#zcT+k!Z?V*}+&@`QDr=hj}y|a5FNm0Awe7C_)C-rnK
zI)>X$gsixBiVj6$WhEz;hyC#FFUjm^^#s;8)k<R_$J)NYl<6qNo~A0(tsvE74$(d1
zW;LUqkn85L*Y3g_DUr+ZDBgAn_*YTTB6FpJ;JoC6t0Ws{F+N2bzTSSt4tCC|AlV08
z+hoMTaMiaogHyw@D1K)ssXk!2CL@~h#vmB=1n`sdiEoF^7LT)(l~}X~E@Lm=mN&P`
z_smX35!+wa>?kce%i&<owcec>32oQGgz~pg-_9`N56SRbv|_v8qY2+G2mD{ey>(QS
zYuh)hpr9b4q9ToiAT5o;3`mJcx3qx75YiF@A_7W>NOwy&L(Cv3-QB1#LktZ=49xIe
z?0etO`|K^>AMan^y4J#3%PY<}`Z&(tVRI~CX!bS**+^e4jq7yO`q&=+WX%MGTZu@J
z*w=kkTU~iPmD2*`VS5zV=p69<r$_G-z`h`Fja^~N`3$KBUlZY~nkqg#_eF<Ki6N9b
z7eT|W-Y>?{a@RxcQUWO(b=maT^mv)bDXMwMVG$Y&pfRjyb|C~K`d=)7(=(;{&G|A~
z&0>sMR3}gXP5qy1=dK5*7~drN;zFdOF4@AHilvL|aR)Hlw&vzYA=cmr`a-nCSmNHc
zl8wf>kj4y|3^OycwyIj8q_#jJFV|6L=*ImRyo?-A)|&y*iC2L=Kbs>9`bQ>@C#)7`
z+RH=JzGX-;FJ!)u&Sl&zAL)jg(DECt#aS%gboz12gqD#!D(L?~pybxm=I`DO9d+t4
zUrh<hfK^V1h5ENqQ&X=UIlrzi?oU=z>!Q%8Hekbbki>}}$S+8?$@KOrMX9N!I=$)X
zFNc@Rne*#qF&)av-FWlPKUC@-aVX*cyEUr%nf8pztwgj)W|(?Ea*;GiMbs8KIocsK
ze|e*?H`{KkSJH<P^)&xXcV@LbUaOBOPqnSG({92+%H*E)hLQ2`gh(<xXgIB62+dQt
z2i^+u<s!f5dnazb2SFY0>#6&7tG=%;-_P+^T2^FI5BZ}1?u)jA;Exw}yhu76#-NLj
zo#<d2X}d*M@+B%4VH=xl{p%eE20JOPX^v4414fZdUXczZ6!EVA(kou_ye?-zM>>(g
z0u2h^85C;JC@1^`A`trsnfeHbs<x=Hif8c{q_-%cc#L9@OJLlSdCKM&ZKc&WTLEAD
zpxqZEj|zLM1cl_}WbbSkzi(&R%D|a4wjh4*#%#AAhK!S<jP3fs8~S#0wF=%m(g2r4
z9Zzm5bf_#^a{FwW&+ywr9A|cBC{~u@5k1DJ(paL=tkRNCo3b5bi$qR@Fu$3i#Cb8u
ztJ$rE08EzfIQiMDL{N0|?oH*+VdAyD_wL=RFbwly`6S_W>24x+NDkzEA{v<y_dX&o
zLXGFhng?_}?c=+pC{PPAh$)hu64ZCd-hcQG;!($M?=RBK{i>fCYJTzvFT?nki24RZ
z?mqkY@Ri2v^b`*DbB=MR9uMTbw0kRjcoYeWX1Mvxd3)Pw`=L$~azg~etP@q(p|v=^
zSVYq?KlKICLxT#ta_Er^;s>I6IrkV`=hVj-hEs#R>%q}!DWCPaANBuW_(jOTRz$@x
z_&fG@^NEQMA9yV;W~6azyEBm?W^}{cSY(|z)xGHZzW9)Q8?h4&toP(u_hklo&`7TL
zPxvSbYBsk$lZlBx>OMijLYMdvK#cKdQ5x>z3p(n!vq<9fquYP)CJ>F11dRZe?i{~E
zLT$B(0}iXtx$7=>+MF(MA??11^*&f+dBp4TrcY<P-L0dWYyj+eJcBm9IWjPbyn}c#
zi}eOV?K@UYVAtO@#j(2)35#2LnF{eJNdfg&|HoGPzkijlPx!v&`3ZZsM374QpC9iF
zb`6^A`~JF&He8!{j0Dx`Zx5~TlrV%<B0Ktdgzu9BpKRG~PR;GyZa#UoW8%%?!3T;K
z=MV+yj{A%J<m^aU`dV}=$#wWSqKKHF%~<_<1<!wOxyPVDZ+4I2uK_$MYFOSKSc1iU
zZ&`XXHtJYfIErrycTM|W7Z}s9f7@rn^lwjq_n@A^gKNiueOWQ*bF_^Rjo_7qI;98T
zpTA%pMq8%de7=Fm%e$@5`z4JS86wF?*%@>XsNzONc|1yjQ(N>z;?sImQaPK%xkjCZ
z0M5A#dvEZt+F%>AJ@ejM3a**v4SdLmpSRG#sKP#T^Tx&0q{x0`WPj0dXrWUmKu}}F
zBlUNH0o+ZbcDV)G2iMjexiGLX01X9EL2<+#LD}Mxpa*{~#aCBvO$eefIm5Tp@q6R*
z|5>85`G-cZM65gp<)U484IZ5=T%KQAx00L>fRpzpY_R65(wBi)(kODfoGA`mZRT_k
z;f}sAL<Vgdhf~OQuXBS){VVV3NxrsC?jq76(w?O9ej0FpJXp3rjf#*^+AUwtn)~hC
zPS20VJhHTn2!5q5pQ|d#@}LvJ@XVi|Z-<hTw)T_yeu%ij2Z}81bPYOs1Va-$U4?xx
zcy0I!xJVG>6+9{%^#=C%|4SujzlP<F+kr6X|GtdvB?vJpb`rM^;*Ou#o~ntgWw58^
zF#(^Q3>uu+>CHQ4KH4z71L}MGJ+Uq)Je0gG2*)q*%HYtk<*z6^2N)dh-tz=yh+LvW
zr=n792NKRKwzN3n6*Cx09=3|X<@qd90}>8}l=|BR<ltra?=vaJr+-^`{Q%#T8|-8l
zV6b=%FmS){EOIIo?<Zwh_N2AJV`$JLv3&nTeV-zTc;UWhQ_#^naY=e6^1MXx&ru8u
ziH;JZZ9?O%&LLN}W&*t}p)@df`Gx>*JSFqe<$f}8k+X2{uqM>r{BJT`5(`?QO?A%g
zcfS4~V*>4Sc?|csI*N}YdTZO^2IR&q;6tW|zx<Dyy-h%T3@xseW9@`!@qV!)ND-u(
zr+pcW-qCy+*DaCypXjCDK{vN$ewu57tA}nsXmZ!@ZyxZiK;Bpf*wI-EnM$hrSD;hx
zfU|7lWrVD>cGdK${0EbMaSQ#7&s>z>&pa#tqo_#cjv!qlCWfepQ7#4w2zd94M-r4?
z#{PcoS3UbjAgZ*`{%zk)lUZ_LvaM&Hl>O7Pk_zAo_cbiuKcXn|bW0~UwyZu#!rzaJ
zRBYWH?KMO3_7~p@6=nopn$_8E_1XMX)}B!$lE$8&QACkPq_{n^SvsoL+^L<>u*F73
zY)86ZdFyH$;R2hOaXk1hf+ug2k0xGV?#!B5Xx;u2{HVGwuEB6sWzO=D?Js`$n=k%*
z8?yw+AlWr-i9YrC7M5nQZP|$sv?ax0tE1A{OKkv#RL^(NEnauZb3<O=jRVAKO5;&?
zy>U`Mq(f=(by%koy4>nb$gz_-aq0B_3wcW{wO(_*-OxvQ?Nscos|;<#yM9NE1RaEn
zzch8p_Xhayln}x~4di$#dCGa1`}O)sd{xY5EmQeaNct&KIXy}iVbM!n1v>_v|0REC
zvVI})@fT@J)c?%_kQ5z{nW>HGwvp1&HCbd4-FJM;M<2)liYM<OMiK7bHxPk9#moA3
zlUwWC>b22Mq4-K3l^j>t%tFH7dySZJ3dHKg>BVI+RDYG4tJtXA&}kJlH#7mR{8U%J
zBhl(5=D+9-9_ys1lGPJb(Mt?Ww1a1T|CEp2CZm1j`>$_rO+atO`~dQ1B+m^OFVg{f
zq$PUvHr8lJQQY@>Cx7>n_)M7zkk`l!_AYZDx_mbL#l#d~^d0_dd}p+p`&Il+OtNF&
zZX+Eb5Ye5{jCJ-dHT7Yh4@4&6772FWdwgpw)9~9oMn)3@Gya*uUbgr=8*(EM`LWf1
zJF?8%+~<<hrT-|gaBq`Y_x|{)>(|A?Y02lU&OUsPyw%|l_{;$Cf0nbg^+Ks$Z#Se%
zRPF;I@O$v~uw38&Nc$yNkn4NbS5>a>w;xrv5&sXPE!Jan1?yOAX2zM!Xu@t)5E-t@
zm`uuoyzem_anmI*^pFGg5px>r8?7$lG3eRL7hoc9`)VoPFX7+GYjxRSm%iwk{=|na
zz>)y7s<qzX2l2d)&Fb;<H;BmNg~;Qrq`7{w|H{5^kDCvmdvqs#PfjFEo`ZDGcIE8S
zF`2EU4|y*#Cb-PvEmv;Ka;5~De%<RyGJ*4f<IhGRuhjX!1`w{`#rG2yxI~=_$(?W}
z`+GWoBZ8&f)7y~Gv)-QR{x5a?{Vzku#Xaxkqk&zeM-uZaJq~~EHTPe8jqv{d|Ho#V
zWKik~vknPeX>~dywX#Z9gaz|1Yb0j}>Eh*`Oi$!xrydEjE*$rn?Ni_990qr0B99Ex
z@RT^)Yx%zWOCB3YSlZ^&=rOKwWH;u&lt1DWfPEYOQ!LXnjrspdIc5C_S^vSiyOV8P
zu3WG(bLT+Y>x4kI?o6hBd<SJWg~q=}XW{repegSU?!dxk<m@Z$%k3-SNGv^|s_Hs~
zc;4Fog!wHIrP92$k55DsqVXe*rA5>Ky#UjC9t~Isl(4qH<oxGD*f&qEA%kvs!fJ%B
zaD7lrJgNB4n|&03DD&IqYqaNMu<-(wZA>2r<<W~{mc>Nh(#w^6^WScM4AvTNFYq+%
zuv-)c<{sv~-~|Brt=Yt5janN`jQDuv`a<@^@Ao;g^hb%yE5~A-z8VlaQ2|1y#0F+7
zahGgT-~2R!`^y@!Eb9lS+!*pR8AS*%QBSpf8E9l5+uZmX2z(ab?gkO(Mf^qLfT;gM
z3Nk9($<RJFM9-}F+JSkUfh4utwRGNI<x60OA^EYmRd0I~TyqJ!y&H7g3cx7jrjQNt
zZ4KWCVaXTe`%SH{Z%O$8CCs6uZL%efzmUWW{@ai6+olqCbLL0-587%}4%)q!qSB^^
zqn3V0Y$?JO7GQ@!RKSc<gmXIc=<{F3a%jX*KRN2oZm@?I)&n`ti=x~OIr?$3v%?5Y
z<~rijTgRgFpo>gSH(|^Fqs5;CT3n}x6Q#AX6l;u#H|{xmsvFSajunfo=GExZwEd`%
zjvoaalz?ve#$7LZ&=w}dPkn?6YdR{C1Styd{GxbS^9T?op~RfrS*CoymE-`n&+0+}
zf}&rdqoAl+&c1z~`0d6xN8jTTB*{@E-4zWh@v;qplE0$ImG;wKiA}|!n?U{FmI0*w
z9g6UbC4oV9IKQVOoHT9r?s)&M{WDbgzm&^SwgJ#%B4jWw?68AAaHIXwTl4nI0A1YZ
zI#YFj(Z?9pdkgJbY)p)k=eZx38*cClB#@TSk4yqgNH?FH`DB(<@0eTkTaona0~8fJ
zfV@<N11exQ<ctxP=$~}!j_Zzll>Bn<v)*~a_CF#o)r%lPc1}GuOJKPILMGpR;d&@x
zq0B45$&UPgakBp>CC7(bl#~-Oyj!T>m?WrIWdTIF0B0B96%Ta5wXCoAR5Ct&x3ak@
zA}w8E!zg)y;KsWPml!Wxyz;+(-eywO5orYu2E+%xXi5;O{NdC0Y+J((8oql)iwLR~
zF-qb3QbG;vnfbIf)%$-x_}_O#GDa$@EUv$6%j6{yzbpIvf$vUPPKLXl*|dAAqBo3j
zga3V<fI7)<SyZY1xV5nTY7N`1e~sbqS3P*1o|QG)lR8RIL#Y%9w`{~_yP`!B!e|C5
zlw7X80sVXEXOG?R3lA3-n8w5Sh>p{!a5#VcM%f{AdL4M<*d7KWPuYw(XU@QbtoH{d
zCQNFK1l!??cRh+q0+>BBqh~xh{Qg)V;O46Y3xgD+D@xT?G*z8XO7!PHsj2<ezIE=s
zIrq~kVPg(!i7q&maxB}POb%>wgy0`b{`Yi;F12N`b+OE<$xkOAiHx7rSRq3XF#8E)
z+ORu;fq|jc_V$86C(qnIxRU&z`*!vc_7^4{_9|deQFBjE&oGQSU0Ru`beuKBPM9nK
z`&PfoY1OOfj>g)3Yc6b#(Von<!~)@YYZ!mUZ*WhhSX%`srIh)x9F*M7^w6s@T3-H?
zC_#nS(%Z~Z<-N4DbW_6Q-0$0l_wKL`+&FjYS+^p2WZR?#ruD;IxJ)PN%BNR-ZJ%qC
zYbrzg-(nPLo`?h)x{bd}W%v7V<-BpQ2RB=JW-2MGXeL8dQ^fCf5-2>+S#%UN>`IS9
zK92zpfFtXEenI8RB%k~EyXJ|j*{)nT!ZClfbYhM?csmVmz`Cqw-XKPS&@YbF&=E`B
zrtBwhKJg7b{_+eU;}3G<<DwC=c(Q8m_GeTq)6CXsa`bG`^KtxKL;IGO&SQWJexGjU
z7b>pm5)rL+8~PbpGGUWV`{kK2GDg0FsaSw`*HWE@&zo?EY<gs>l_0=tx{LFwyTE$u
zvHmV`{-y=1@fT&d|4&B!n`+vW(@XkZ-n?x3=1qqO*Vhkl%L$FBb;%Zr{bk2JnQvqZ
z%;$ZH{idI{XXdLl|K#?}WitMQu9x8=;}u?C3o0K1lWo*p5lB6`C6!Kn{`?3onL`%$
zL@dS*bj>myS3*c!(rnMa^VZFKza}5og4#W}g1I6C50n8-le^xZDKg`v&!NPJkQrAL
zI-emgUlA1w_k|UOVpEH@qdf&4K-K*=V#v;897a_p0&Nw|P-rBuZgY$@rk}DYC$jA-
z?jZMMG&4_b8S;+)y;%R+>f4Nbdf2pA7{$x=D(7y<JIPO1ZWoj~p4Bo$gHb*)J#H^j
zLw<`)Kfld8h*2jyZ)x92UL;_ilc_{@XKYfH;`1dBIs?xWA~%3NV8V#FmcTw(X3lu!
zlEra4`g|&hv-#H`{~mfU;|<STZAVJpa(KI!9JLBg)__3v{97M9YlhpR-1s$wvX(=b
zS~I^VS@*F#w2?^Km@}w+7{!)#Ye}AaoA>;|vtH4BI&U^Azc9w8_5PyWc?;*aqRe<)
zk<iK)4A1Wit*}h2eYPWSS#bOF!3tiq<YdJstIp><a!`FpAh!2-VQA?R=JVdkbH{YL
z^X}rCy?O~t=WwtPkpa)^I~3`7Z?>4waqGofehv-q`g!&ehV#^xW^l9limz>h>`D^H
z4?nl_7N*&SO*I?-V2Y%-L4?|(U$DKB_GlO<=ZHIx0Mnx{Rd_NUpc1CIgW&D(BH;}z
zXXpEx^WV#AB5{`$=xl@$i!zPceX;l=YEAD;{BIIdPul+6_U$zfNAJ+1#}Vi9FQY0I
zLF~YRd05=cW!U~&-Ybk!Y=$J~d1Es1q+lNc<@aSDyr8IAOR^D*$mvU)tNm0MbRK=h
zGDnUP9@TlODnKJ0#u=c;vCLA6=e_m<f$XyX>ML?tKh~jquQ~l9*4`yysdJ43&A@l#
zr=r9oV_)0b?a-{F2cfn2F4gqdcapxo2tC*iYo%#x8)Iz5zdyrAcg6cx8p3=}J|2E4
zc#znFHudvmbtiJ6rm_dzF=UfYtYPv(<1>gPVb??*BcC5GuI@?D{mJf;QQ3wrrM3W|
zh{72atD~K8w7Zl5fZSTQKnHPJDG(z=vnk7(B#HeAC_hh#@HrBao!HN5+1)%#lLMzF
zR+8}8`PMz!dxAjj>FMz3==u)$Faz-@gwi3YlIzpI2Mui3i$?^qtIkZVOts@pUa?#d
z@x{KeLK|d6T*7g#Qc_Q%5Tv)c`5mMnE31|2r)Xi})hg(G(?L>_ef^KofuSMWFI<y$
z1l3AwBglS<O>8Cv+hYkfechKVmO<j>>DhZ~;Fx2!Ur)H-US{=FP>kvi!dA7o#F4S-
z*rvEJz!`g0OGPEZ%b2GK4u|)RjE^Q^UqIu<i$Mo^4zf60RNo8A63P{u`_J5~Jux=J
z)6?ksC&Tc2wQqj4bfC4l4K6@G{6Qv~gcmnE>)+9{nH7bzjTL3jaVci!b;t4>5t#rd
zg@wSl&i-W1B^S&Nk4wv^_9Vih!JfBdq5Nb~O4{`soga_kGUJ&v0_BV#^^(rJoG}Hd
z=;R44$MZxf^PXhR$fhXkXAAM0ICU!fDDj85tspQzr;$Na<$id$9ttSPnx}PI{+0`a
zJ+w?HXSsg;dLq!Y8%9}kmn$CpMWb82rm(QvlVz2kj;>NkL&GdH49I5<o46VP9ocvc
zi5`#A))y~r0foV}sBgsd)PqVZmEm69k5G})*Qsma4l+4+o(&v+mKq1Z`-&Y$-Y2el
zUEUhF^lvHnIZ5&+HaYZR3xNU=XJ3kIs>sxX&&EVofMT6T^Yw=f<#CxV6oB=Enld)D
zr1x3Axr--njN@Iimi&GW`Nbz*B9IvPuqURyqWNXFTgH$`@Tdi-I7nez*0+a^dLJ?`
zB^K9AaTpI~4xPH7?MgsY_1;*49WDuvw#P{#2l1qE&y3+HI`1vN4cUe*rp4kFfizq;
zX1}Ses-^}g7wSYqCQ1#`#!Kf-c<Q(GvsRCNoN-~f)As27ToJ@0ojY0y`z@rriHZo{
z1oZUerWi!MDN~1)@$uz<Yf>a@WCdYY&gQ3?!4G$ziOp#`%gL_V=<<A2VMkoM;&afD
z^oq4rc-q!Z8N6^?z+q0DxprIy1nZ%?V-2awY2f{qpMUM7;MN~Be8G?7LFDM>i)U$O
z7<r2)h|uNN{i*9l{2CPg{)DKbC1b&HV|V}Ei7d)NpTqf6Gth2=in5iL;HKV7yN)_5
ze*fu>;&(c$SgdDl*o66hrRp>_<P<u2ryO3IlQWr&DRGZqzsoB;)wf=%ax!|-1(#uu
zcoD?lsGG6+mBaYt>K|<Fr*L028>(uq`?*50VoX?%Ig^A|@r8VFU^QeM_Od!`{206i
zpXhbg*H7|Tha3oat(7+bRsP7=?hxJ2oL0X3OQ~LSMaGCZ^R>9+@JYJY4eK=_Xoa+x
zg4*yj+lB}*{)4k2*Z%Y-fS2EDr&e#pgwKRBTO$>D8=ObSSry$l5ARNY)hZ0@L)QkX
zRle@!SB%?uO}z$#y~k$P!q$4L?2BpE^)2l_y>jX;hS-)ltQVA&6T#AqYSygLUt#SW
z3q-v&)AnXH^FB{PtJ_GTcmAB?^IQ4ZbM31S+OjP<1cCzFh#FWYiY9(q0=;0ARrab$
z;ijHm$I0Pl8cPqD3A6d0ZEo)k_lrt&r;m2_qzbgJ)u4GE2r{Wt)voJW>Uggv>WqJ%
z4(+YMvNmBT1Iw2Kvs<GwqFqD@fdae)%e1gP&=<#-<T)owDJdm(vjhRkG~>nyq3>5Q
zG7=I^`}GZB*9>-6f?WD4`$0=nG4O(d^1-!NrQkG?2h|9lR!@Oxd&C2|osWAbJCw;c
zBlnyecnzaXC^3Ae2;ZY_f9?6&u{#4zM-%ft6M|D9_A1>{#nLFaL;tLutz7a3f8}YB
z5jS*-WE>uyUD=)28Vy&hml};lr`k>3wsRhzni77hBl^WF+imanLcMDgy#{XRt|vBT
zP`?DL75JxCW~cINuEbbjlR|Ofv{W|>EK02h9vRp3>U4RJ>SYc%+@Yi?%9PD0DCjgV
za=K5Kn3S|beP<RrE`b_H;FYkqDZxPLd@s#)u<eIi%Z|s|Be6R8?+?>kD5~?0w;d$x
zWjv^k4X`){QCTTnqqKRalX4WM6wH!hOGHf6tK#Dn>+$;&8-<6bH0S)ZgZee-Zl=Q%
z)*tv%uVOLGNX&2NoJ;kqUm-wgDaby1;Am~$m)}8RTVay?@d0qau=ixnGw?a_L-#(3
z&E&@5d>4=3e^AH8E1Hp#4>4jH^a^pRBvADPwT_>xblLior>@6IPwWxH9grxaRT8q0
zJ@wHu9o0?R9}7Z3my+$=rmW=;hT_L75Ba~Mfx2R6HLBZCtN=p<hShA8OycloE6P&m
zbY{g~8HD^k(H-re*se-my^|C7d%fD5YBU3Uxs)wBe92PB*bI*y&r3Fq+LNBT#eL0v
z9$I>YsU8nf*j_TI=U*w~DGPjQ=%&bDt>GXx3)Jv!i(wg=b0bnu?^l|9JCX4$`G`HV
zECetQiz@qiti@R*Odi`#jacIke0^VOH`XzwAVUN9p8if2Q(&%W*sK?s=-OBqdu#LB
zyX4wuxW^zXkIz`c+(zh-H%fOi%Aq~2bfMJe2rZge0`B|yr&FB%`BLz}(ukg=@L-ae
z%>+USIcK2wqdTFrUhy{dn!YM2C67z>3U_%D{!NI+#%&E8?f@JK<cy9N$Hu-Kj_BJT
z#XyG(!Qsc`?z0}X0vyrbh5$eZ?+Vy(E*LXXAzDHX=rB~YgRh7%$B@`G&zvxibE|_7
z#2&Yh_PY-B%+D!SYv+TU?9^{1qwq!UXTgaEQY1XEM(s$QOqb;@xYYR67tMP)-8l;f
zFD+E9G_&!Ayd<6iXc}Y0gp0d_a+)0NIdZx4L8J<KwvX0JhTE$d-p4WD<>$<t0^*E)
zei-0e8GgtChq(LyDwC775OtX(=Mm|S18@GO5w`8o3Q&x>59r{^V{!V~fwnNUS({x-
z@M-KYuR>mxm0C8T#*Ym8=WXIy0hjk5dk=(IlMI17(dze-OSmG`qPlQ>a2GeA6=-0d
zXsM*<w#qO3G5!|Kod7IzbxgM|r<$5DQ_0+uBU<!B8?}q%zu?zbw&1wp&F^xu)(&d?
z8}(Z>lur!5faTi<NVWD*$T#+B7#pOtCuwE*T$cG0_}DKqs{z5}F1A113&~GcZ)cDP
z7fC%O&E89bAj9KM5-sDQ2eVJKS34^EBo1aE;o>`QD#z!%V6{<BLJt>`(WMRd`=Xc9
zrO72GJZOfJY{vC?<=PRLiJLs(xT_8|bD`J!Jq4nN7AX;RV-^xei~O}e5_k{fA;~Oe
zi~)q#y;H=tzc0*AzxG^MX_!Ca&AS(UF=pq4=9N<jcmGoo{=1Ji8xNkCu{`wN@wo03
zKzgzuL5K9z=bbO$AH#+T`KU({APq1-?EP}#C;M&lNz?WXtsc+ncl#Q8fL3G{iZ{=3
zN%A=eGU%Vt71q3^GF=I%G9Y>o0osX&Xw^pp-T%6vUrMCq#6ihEZ3QTy(#dgIhH|7Y
zHl}cPiN^jg<>)6d*aTP!+B{Ae@{9g#i2YaeCJ3*#gnQ=dA^mxKIdBNT*;bv?2!FhQ
zQRV-A6vvB?0dQ*`8J|vxq`+59(0a$k4ibI#0m3E{_-lxFD2(*Rt7OvM<(Nj?ht%M{
zx6{_I5x9NFgnseeqNC03k~e8c+;KDEL4@(126XQAi_3dMbHrem5}}Snv*SSr9z2S*
zFW#~>kjx%k_moJGe<DgMwk6fAq0-#f(5cTCZ?);~OXc7Py}32xJnyiW!m&qE;#rCt
zbw#ZmG(x`Db?B|Ie==*5-_iA%FbztiO!a-VZ|e%MziAUAw=1-$|5pI?Gph6bAJ%bb
zie%Kj<RDrx<FY!ox7w+_-N*WJf23M?sJHh(l8(sBthiFcHyN;>h4Xw<afT!*eBuW)
zPI=~PQ)r+F+)f^KhhXRF9$+4hZy@L&ereg=J1P@toCA)W(7d|*;adC&XcK-t7G3Qi
zG;0ydO=35uIB=D%kySg8OSh~!*=h9?kIHc&;$EE<d?CESpdK%_on6~TAFf$DCGnkF
zQj6nb3O4Ue@a#(^Ia!j`?nmwL&Z^qlhC_dHaavBO0m11xzPl>jrKb{+o|<;s{OZw5
zG%E&sx5jt-5hnKVqlmHH9T79b_UN33AN66eoW}fEjYz2w5e{{4prN2(smHnx*2<{D
z;&HK#m4oPF(__xkjEun*AMd%huF_w-iK(sxc;*90B8eL0Il=-7MDAWV*w8#6v_KN$
z+rXKKU|7e6HkvyHYe4%*bLEQ19G6!nfU}c62V%Gg?AEUc?*Xbi4^`|KT(&MsJ+kJL
zC(k&@@%t>F<82w3JQ_qk!QF4Jna${*Qj1uyb39qeOLINoH8xyO;6>5P66p%8)lu#9
zAi-vug7mA&g#R{f%^s*`OQ`Pkj?zrN7<25=5y4)a>p(Iy;L@j;KwR7honQni4mdl2
zw<!{gBv{M{%9KE9?Yp|29+ZCo@ccbw99I^HOm|Tmy7w!O=^NTf*o^Hvqgl(DmM1M!
zojX^Pd>fvV1m$Rdi@jd?nrsu3+Q;eY-J4il@*HEal;ZwEvsAE@c4*ohKL6>d%sCtz
zZ$J=}bNaAmmVaolTYdg?j=bk!Z9Zon(KF*c%&<V2<u+|cx!dQSN`(-uv7g1(v3YG)
z>YPmaiVnahav4iS3bl)OI<x58vuK{{)E#dq4k=t+$heuX@M7yR<I3cIuO|md;nb|>
z*tVRe3LaAsZ>IYiIFXzi?a4XsrlVt7<Uef@my$frl9rc+ZJLKLwerm(;*5f?b+qtP
z92pdN2}XgOc>e7xNjBePe`-u&7l4|3QJMR!uQy6UD17>o)~f~nH)<8zcNHi1t}exG
z8+E!?i<5P(?*dr)kVP9T(D%}f+s)lU7<{tH*(2Y7s(QOtKjYyt_k;Cu(3i+LU(h@(
zN!UI(mP@_vZQLLSFRK#J(Qr+u6XD0Y!5^r;yu4hN8a_3%)Ojcm^>D=$mRLVDEP<~s
zmAA99zFwm-?*1aNu%jhR&BfCNKF|0e^^@Gp+T64lJb1=y!b$Ipi}}8sVwqyybZb4z
z3OZZw>Ue@mau7NoGV;i7_dv#)nq@kz2L4ty2j8C7#x|CJm!^v}Vo3sU-aZZ|B_<}<
z(uvjdO>m=}F55K-Q)P5}Mn-QumojQ`MGR#m6RE`3$*-XAU;j5v-nd735o+1D>Ui>~
zxc?Iz)9|$Bs-<9d7RWrJFTR5#!C(d-6UIrcMNQY9vdO`*2?oHRl*L#sN9`w`rg7rO
zh1f3-0KFS#-Hg<u*{?+Eh}V6%g<qIfjRm?kJNX`c1rYb#^_*sBCMQ=wOBzFqg;}&K
zzl5xgMG5}c#|s2Pa*Shyv1;=%qYPn+#+q`;o(XFUX`=H~i3Vm8FTsb+(k0b*cuQza
zb#GH=6&Y1eE%O?)k43VK6y7eR=^B3x8-^OY+U;Bz85>Kq8Y(1@6;+iZ%-mjH@tz+Q
zvGX`DVZli3SA=gvhGz0U_u#6qgtgoeM=g7a#Q;H*QCeJXR*w>JZbxW%md=A?=Q+v4
zu%}3A7`6h?e~Hr9B{~+>#mTN;Pne_|Ofm^0BeVCag2O?1*-^iS&58OILeK2an<d%M
zc^5MNWv25ap~WSq#!uRgP*o64BS2N*boWawtr<OZ@lmbCSlX#~18@p=$0vo8)^+6O
z>**iUb(BLxM}&m_`#IHi!=0BGeyj$PXlv#Y7!k8<&aJPnGrt_<`zjL;snr-BvzThz
zhzeqO<RG?jPs5?<H6@MPjAKx;EE<5zNA<AW{KFOl;$xyq(gExKff9GG28+Bb*eh=l
z$)2pYQ4Y$@m5XDMX0SUL9jk%XcYIjDXkX>0t-1Fwk|dxW`#1}?jI6c-lw)7_S-S^{
zJd2|Dd8+KWFESo~o}ZZb8Qj@yU9OeSZBSPhKg|AzT)gp4vie4T)tqI~y4J^-nj|oG
znYkC}IZABFw^v!{YY+0o2mPk(dukZmh~YA<H*b-kiLke7346_Xr8F=8v9#gjs#a+t
zo!g7mE@9gVt3_*lQ*<#Ua>l+W-i;*I+Rjd>($YO%$Jo$Jg3UF_G8I~ruFSo7(o@+F
zJErkWk2ZpMjKxF^Y56{0^gb%<8Phan7{;B$D(s|wOnbtveWzi*t?Zz_Hw~Gx$7z!#
zlf1p1PORZ^TdO(u>b3#vNZ%eVw4`tDzt3GU?SSa6&gVr7SoXODM@Sq@32gi*uEl$N
zhvmFkX*9um4-eh)*am>)s49Q|xZ{|F_n*4jbgLlZtk?9Ur^Z^jJi~$PtlGHqJdT`Y
z$Xf=9yQf=iqm?;#rW(&I;SiKW;Bz*N1#o)T$%1Z)#wRU*SZ8Q-6bW|vGtwrR9(?7q
z7D9snr<S8e2ZXuGOJ2v$uC8SS(SK?v1CB#{PqXk|472(zb1aowCM}^HpVz-rK@kYp
zTP?foyOZd^$L;B*QP-{Jar>W=8WzHzEcD}B0fTi3oOqe^?&sdJXHc=#F!}FxhDQjn
z5CGm5vVd>JVrY6K+~?67?SQ)hoCwq|(Y4ktRkk<FqdZJKL2GPidLa9dQ3|{a_Eo$`
zN9o5WY=r_`mdh(E4=phxe<oY*DWqS4DyLMkI&Fll9c?=*nrmo&Is|f#>`1uRrbw;c
z!KlcrOUTjGWy(av2~z6p7+&6+w>zDAJ>v+UC_RKv6GXZsd8sc24caVk->~m~B%A7K
zlW^1-QR;-$)ZQpV?B$%!&p^<r&mxmh(#F0Y3!ip<-1I%=-(Aj%pt5tWaa@pdUZQhP
z09sG+Hq=PxjQA0+F^F(x704GQ*(1Akm!lQomPQ^&v7+D;Rfi_J$wxn10KH>r{vtaa
zeT+ZwF=<qU#N9iI5q$R2PR#aWtR+m$j!)gY@vtQXRlxvMM=o$03-BUNoK%_5OS$C}
z5hzHgUdDiJCRX`Ls*SDXre2{JHI##saHG7wc3}a+4TmR3yKDQFgLf@)I2=l!()hOv
zClrc%-J2+c!lE4njqwO$p@Z3jxWkhz|2<CkdDn=-&5MO;o>OphVWU}9-A!Gv*X#f@
zIoJjxR9Xk0cj_*d3lzu-0IVyU#_>!5u&(7}m^hK$+>Dt$wv}5sB4_u<0J=f0(1FS0
zc&)N_lA}Q>CA6C7q^-7RcI@Lbtl&z!&uK$aGX2&Rq!hp`y!-g~N0GV*InoV_)AJ(z
z`sA`h-<r%ZW|W49#S_bl(=(l%(d54r-43RYbK@?!_5wZG!fpmR1p>l%n16%+%yNgJ
z`x?3@Z@WtWktisNxlfvL1*%jf62}#(shddT<ub-TX$E&Ow$D7uf$N0S>aSh<kj);c
zh)Ofw?M_yD_U+A_$7aMGmK~O}vp)J+sfC6f4@ri)-W%&9zXRPOQ&oi*zlsa?C@eAH
z16vK6coBOQ0&Cmr0mw7xr#zSFB)fp(+R3T4gG6XAVE!&{46FFw!aNdZ8((T`ldC+%
zmkPP-`m;U^fgh(RI^Us*8Us!k^FLRQycvD13INU&No0<AJk#_;=VMHt*H6EoUj4a>
zSkQT83Hc8QvX=dx=WJ5d!t-Aw?=%_Ypt8}EZL3CmPrrm}`y5QqCut~4bgpy)ecc6}
zw?z;OLzv&A?mS2MkM#JJvFRc_QfT|G&DYJ^{U3Y*XWkrcrSjSv{4WNuSz8v((9uzg
zl_xtDQK#fGU^KhcXE^wx8ytnmYQUx7wE@voJY&<)lR1xE*hvuBNzd~a&$yzyB^-CH
zkQ1VimMT(G{)o1vzqMdRWk?Uc3AIden4ly=iaj6al1RZ1NwsN^?8ssAF(=&qOe;Tl
zs(BA{T9d_`duXovLYX`ONhT;Vv-M;=Fx2b0=}&<viRd|%$C6Zboee`eaBry@2C5qF
zKI+;ZpS=GpK=>T|4*rGM?dj2;SQO@CXz)nc=_>}>-JAxWa3`bkqY{Iwr;|2?vcN&;
z(;|TnQQN8|W#*kFsD-q{c!7zly9X818PMg{C6tSABM{w;Cx<RO?A*H}_S{hmQ16bg
zFDNUtKw5#wFlZ-gcZb7%zosih1&UoLZ+M-;hU^6VfmheNGuFfoBmH|C`a#`Vo7Y;s
zr6(84+u@TOkzcaa!-TM6ZOLz1^bP8-eQIHp9Z#@Kz4;&k=s?f1|As}G;b@t-w@6Qb
z!s2$6-`I4Y_$;maOp^R!)SvOecanE*u=|1Xim;jdj5ZDq&egBgAKzeop5`>v$@aY%
zWMaHFbk~w(#|4+r@6!UPP5tCe@Uu;qy`*q{-{V?_Phr6)VwR2Tg2r4Ro{GnuE33f9
z2Xi_y1dmG>90DjD;1*HY@fnan!FXqm&eW(q@j<Qc!A$|*ZztxIwnbTHUyhoI=PdUp
z%vL^%r$vU;_G#Pzdr<HScO0TBeNU~O7o&pO8!b*2Th}J(04F%v0su>tiOWVGB{}yi
z*k+-+SKsCfiDQ9q>RTCx*Dra#vK8wjOL)}`(_kqtI&V{#AP#|G>709?*DIA(`1SIr
z@bG`Ff=N9^WO?@vvY$rGYO<=pxqg8ihoLlO5X>s|eG~GTx^+5zvS0Xqh0M+hGKAOH
zN9%XXQlA2c(5(cs&}Hg9;e<J1h&^zg(G`;j+gD<F_=e;%tZFRIJ!N`i<n!=EzA9b7
z&S)B$TdCVauKI?Cq73CAEhfQG&%`;SA^Zjvq>&{@S5eW?;e)lJ$V2_bKCf`C54T$-
zaWPCv3ua?IdSd-o#e^n6y@_`o2FW#D;XfxelYhmp8ZFE^HR;n3u;JyCP0W!7lo(-n
zeL=8UuZI|!t2Y)t+D=t<u6)ThTdkco>rD`tu6RKm`C-(Cv>51HU6)-`Q<GeubEct%
z+jjKoGv?-uAbc9eRX$ur#!H2Wdh?a62O7jI<dT3kcE&BQtvT@?dMuQe_2Zpgc*mxe
zzhssg8-)X!de3_3k*7bqv1LJojTvTDr&!soV`a;{LvZSl!}WNC_#d9b3l#$6!zErA
z>FE#xnqhO%igV}5I*$@b#jiskyO^+*+yJEi&J-_zzhYCF<jN29>&*Px^rdq{_oYge
z|0u;uh|m4w^iU07(F3{tTa5>%$Fjl+^xs``a(Z}~#h^!DqT7k7wr<k^c`_Z_LC3fl
zrmwKcId+<0SE}OL%#$QFGi%+hkNGLTBo;_h7%-*QBd=nA3fd5NoM-h|5!@L*$j?yq
z&883B7C(|T?qIq7*~pr!p49{WFuR8quqGShHe97+T=8$GdtFl-Pu`|zLLjDwIxf6S
zbOt3@r<_i+fs-TTI61Z^r`@3LjbFr{=9Qu(5if7!)~lYU;ilR}x~71)tP_`e0`w@i
zvDD1|aG8|y?g<aQPFv7NAi0;=kyc_PR1x5;$8_Z4`$C@s_)F^y5+VJ=EI%Xqbf>cn
zUL8hEPeQ%3zm)d!%Rd7}lIbm%%vG4kWmLrRAFQjM$RkN{P@J3Bju=W}6ABby(arr(
z;7#OuW;Z@--*l<8=Jeq+q!fGVyIrY8BYedY-~t6-3(3BwUMAlzwq>w5j4S6lDsjS}
zTUB*~{fVC>`QlU}7gTj1;sd;3?Sj=GI+*c-UngTacg<$Qfe&-PbU+J`xU;COED>;c
zvU_cJ2|W9{zP`R^?s(1O!D>{kYQykDa7M({J;89Pblxr&?nqlV;rr_z`L^3DE;@DE
zf5cINP#NE+OVOU`RQq%S$I%H@&tk`jk=72k1_uPsaV{+$FiK}&v5z6Tw}nOq9{~Vn
zB1!ihMxyO}(|wz58`g!jEg!X_L=r?8oLv&Ugu@DJLrGVH_!UUAxr&;1I&wZg0flYe
zjQi7r2DA`|EMoyN^$N_hVwdy$!jE`w0-$4O@T5mv$^!)RFpOAsf>2gJ<Hy}+bGJIb
zMw#Edo2MWANu=|695`i@eEj^cD5n!(Q)e9N?_{Wa6}?7%4yl_|T)B4b?%b{7yu9|J
zm(^3Qk2H*d@bGKMQm2(T)TqI&*kf(59k2l*DRHSUr2Qu?H=BB{Kd}efxZ0eqSf~Ku
zgz<!L-=u~|M$7?Fma(<Q-EaVz#&yKGP)vZIkfW&d)3uOSq%5boiORM2l_N4+w}+6H
z5Y)dU^WUVPdX?bLz=3Y8=3aE-lW?_p&8tLJ7yltg{_=?>m2O0;^`FI=FxADyz25tq
zV6oS&OidSD0py8zAaP>(U5L}Joz9&PKmg(zo|uU5*hHg6PLHz~0B_DiIEr5Gy4WJ4
zb5FSgKiSx`g0ZLBh=;bP8cV@-L*H0edxd17^%2KRAfvC|#=P?9(a{CJiktcQ@OE^>
z$>`xBJC?=x^SKpkH~g^m_4i~T(}#_OhR(gb6mqfxMd6u1u|UZIZ0So<sqZ?|@c1}o
zUgy0PATdQ_s(Cv#uf=`NqgL;A6V<3K5U7fAtWPewsP3I{SCwhD9eR=BVCm@a?JmxP
z_8j#9kXDymdL}m2aXF;R?U&}Ya~7|c;@&cEqw7m7Q<^dUy~mbc(C<YN#8DV(i+S#6
zBYh{uAQF5MMFoJz7#hx^!lyU+<>_7PIFGwH3wyeGn`qPA0R)Of|LczjMl4r*QN0qV
zPi%Ob5+HQ_x^G4dKyYGpge4yT#E4`~oXY5D0QHXn3t3H?DYx6Z<BXkESNP81wHx^s
zXFJb=d0|v)o^fYLWRzbAdk#%E$6o<5L&6dg60c26_#BO(&?akZYvt@PHYVJ62K*am
z@71#?Hm#$%xoGxxpysAC*}2cFhumjNS_i<qIkmn1WKA{3x+DIZpDFVLyKin~vpYpR
zXbA<V*ICm1c&#aps!C1)Bw?Q~2QnWOyo?cwGF7wn``oUfMzst1z&3jh4_zS8@Nd2%
zp@PInMJ=(+mw=VY8VxR=Gs_=0>rj@64!t+0<4t49o~sICyKT`E!^03j`mZQQWu*Y=
znz!Fqo~+e1B|LF2(F3@Tik4O|$xApXflMIfTO{wy?5tgtVdAx@7DmGCj^zh0ic|W<
zB=jQ&Xs9&UNV9KBIg|u^LWT#~ZU0%8^Os)Wy2SBylPU;Qz(uK)b54|T<hEbn3+o=&
zu@XHqEEYRc-A$@4FE6irox7Nu$521B7?2UrQ~}HIPV?jY{qkoe4Jfa99PeL{X?=Zt
z$(RxIS2uwqbfx5T<CI!Sz>*3-b`yPij;z0U<#U+iQ*upvXus$x?{t91qjQ!_OWx#L
z%VpHZR&oKtF^x#_9qOuaBQLB~XE>o7q>>blb#1`B+{}0V3Jm}(on8P7Z1iNYU8fys
z?Clr;Tg?MIZ=aRv9M;lX?$0<!h$0?<Z)YGnWxR5anl^BQ_8G4Q7D=9e(b-q6d8_n3
zXZV~YkxVDL%7T$Z4j+W-q-pv;Tj4)voC_>(b`;p|*~w}bsCMK(!)*o1Vz~(OB7A>)
z?<N7>Gf;E#LcwvO%rxt0J60zFfIAs&JYI881QeQRsWwQ)GqVMo(P0)<D;XRymj6uW
zrQh4)3pr`$4rlDD=JR=qY5_N#dhu?~={fh@R!OgQaM_glF|G+1d{4d5R~;T<#x6V~
z5`wivVzjG9we?vm087cT&!@j(?TZcWHL@!fbruW(pfukYpbGN7B%Ec`Y4-!i+pVj2
zGIViDi{<QfU%w|oK(k&v726ey{~x<*&)02w;Q}~LK}JgRY=_?sqYtOLi#Ms{ad61F
zBCA>E>NPU5A6gv^J0L){1BD3-Rps7RwzhmvHtPJ3hwoa=!xq&meQ=&SKW5$MEw4jy
z_l1_K^L3BY9$Wg|9(djeLk%}AG12fU!X1JZsu%}=BlGnQUOlK(Q0=IZ5YXCwubdh-
z_(x(j-=5&AgenXpv5=3bUm1LIj-a>s)O>Q8^o5yO7P=xdl-^^pJlX|OT|JuY-F20<
z0K(7ta15WPeD|50Lu7#bvDnSpYS!PZJvx;iR;1H?O`3t^zMZG%F(4$Hax0y8<9Xo-
z@K@<Jg{GQR^&s`VN5*L^MV>`cT5;=MmgA_eLPcHUzC-f2A}tErGVnyiLEJ|2U$}T=
zT@SIE2QvPski!0Y6sIhdVx4^HpAn20MaGQzhgono8_P9pc4v+>`W&hlq4pc#RLcd$
zEc*aGwI*F_4S!dmeQ-3Do|r<%8DHJX*I}?D6gaVr2Up`csx=<JlxnyU!WteSfqhHc
zFUT?-Ch+yd|5T_x63!k|CfRlHAfcF5t<T7t3FLRev7{?7JA5Hd>V2hjnMhtAb;#&s
z(?zu0VRqt-BK5sz)JE4PBuIqrTTbBb(h#k=c4bB4Lsx3=1|~d8G0smpTMU{eC}CfE
z*HUdYR)rQ4D`}|{5w#uu)LFyd+Kw&_EuK;eD;uPq^B_#GufIFY=O=45&=sKMw{5hr
z<|ZWlPv1WGk)QgCbEc;{_I|f(CPrmJzcuHdOZL|S@yQWX2*e{y;Ck>A4|kMZ?X2n8
z<a(#ugsGQ+FJ9bI{>_M*{5^+Df>!GkXDMA&n1lGxT4T5J*u&>}K-2P|UH~fXS6^J%
zkF%cjKBc(rh*JKD>AfHZ&+oRCy<@1K(%1R*9hzcSR@eAz=Y8@#Rtqc~9S&wKHxs9c
zlu{0~sRQ=JsPyOyRDZLR%jq#Q#~HQNJyyKO;MY;8kQSAp1ZVV0d67G}K`~)Yz2;aU
zJvE>};midTxgi*4Hk|K09Q+ZR8F5sv9=L&md_@hhIt%7n@S%_@O>~vqy<ukb%qt<h
z?z64yT9b4&FaBLt_Vlm(oi^h3esyx1PVq|%<CDoXxC4(-<6BK+S{Kk#&g?aiSlUNM
z5CQ%e6Ocsoir;rLnqyy*$h7~1T_hh}s+qShhi%Rs8>&$qFFVXb4}<~J-6gJOR6C>x
zkj=d(YpZDubv{qvE4lhJ#`SoeVi9H}xpiDZ>YS(-vMa8qzx2q0mK<EA=fD&M$N%Ij
zcnzW~Ed3;Ycd~m29Mq6?S*ze}?~UTja2w9z-hCCqdR5gZybpRd4>A3)b80#<B||M^
zw<~sjWa6hdXJ>23wcx1-KWAm3Tm;|Zd2>dfw9dqGVp0bN^j78y1(417(bqtaDmk$%
z;R-C4XlCrq%3N2+vjxL8S#EBnm9@;@IVJjLI{HV|Q}~Zf;v{6En|fm(OYif~X;Ag5
zg>61Pkk==;KABX26=c%{mGDBYu@k+@IMVO9p`yQLv1;*RVj0!g1(_MK3_IM@vwQCO
z!UccFm5}|?Kg=@CJAThsyxIzlIYfXeS&;J&WL#3IH<Hs)1Kfb328z#)zdN3qHrp@Z
zM@xN1Pktis-E6GkltwO5V)(-a3Tv5jQnT#g?~)^XQYC<XCT+QGbv<MHywuxXD-ffG
zG>?-{h(tE}Q;5Mv0Ht=FUGGR>i_h`88PEm%XN_>ow(4WshPV38GmZ`bhHIUFcQj$B
z^V})@?qW=Lk3$LKTajL+Ff{m>dp}=<-gNHG1bTh*do}FN%Ry`s9RH0QAGCC66}2qC
z^!$4q`1JX2qMj51ftzgnFC>XBPCZc2PtEafToY~eTN|^Kme#M(&stG_;D1ffJYTI)
zO78CL7+*_}n41?{*yzhE6zdIb%~&$Sa<$2x{ZDqWT4X)uGFgs>>>XQjZTx0ek@@<8
zhWxZZKr|9%Xe?Y(JW%u^>|oBeCd2>&@$t{!!`W7mhS%`!IvW7^!ko-4%U?-n9a0*;
zg_AQR+WIbDelEqIc|Yb+6I9K>x?0eE#Q2{{Mm{$J$hh6}<SLvSDQD*9-~k;}gQ3vJ
z`iQjf7LGe7b$QNfQ|NSy+}FYAEj~bo26ioE<dheOMkE4&nev}1RyuxA8ruSpX>~6A
zj(@U?(v8Cwux}@3SMhW|AaQxqD#ZX0!7Hn)!eL=yufLrf$+bzrT09%HrrN@y;4;@~
zUiT-M`3~E4Y6&W%S6BIg9yxEWOJ;9cK^z2}*F36U<^AMk$xH2ceRpVHhCZaCiyr5>
z-YYOuPT=T!Q3J{TBgUs=v%KvB$qu_l@V9JF5&J4R*|9f_*LF&nr8D;S4dJ2JI2Ti7
z=9Ilv8~dn#cPzhCr6)jA6R*sDd1ae}E;2VrUNmL9#-AH?GwPZNa5C>V7gdaP&t0!x
zU?*Hx!?YO8FD!<=`}{yf&U8R1^tG;_`BLTT-ZvWdqq=K@E$LX~{fEYp?zwz#vzT%^
zC-?+8)DwU6`}`}>IUFRJvnR1I${V|&Tx8fVW?&*gZs<CyC9C7xzFx}~8Vq;*70~x2
zsz&9wD-K~>(zx?nXB=_Tjff|_E<Vtc@}zdT{^6B>aM*vm#+9o*Nh1BrrK*u}*{{S|
z129$9)l@j8YSkkAg9WaLwNbY4$zo?sh5OyvpHMmkjXufa<og@M-qXLR#+-x1Lj+%D
zC2wD%BFyi*2+{l*Mqo};W)bqcliI>1veWEp9G95qi#Ey(wJ7nNp2W$Q107H8`m2zO
zrn0Hp-pi{S<wPWyK8ZM$U3n_mmB)*hp2-o{&z0CW7;22=D{QnZZg&{R-RoFxb(m*q
zB}Xm^yxYPQHW5vOje!O=3@K`#k+iiCbnM`#jd?4no+iJ*Qe#ICpD4$G_a)yPEMf~w
zUSV~=Iu2NdJu&C|-L75&f5<C%Ya2QS`<-3*wbr0bAXiJiROs1uvX*;Ob&svxr<$Q1
zy8!w5v@$~kE^g=b#HqPz%;p@n-lg<JLM;)Mvk~$>6m|RQ0@G~V7t{&;yP2z#zFlhW
zf;CAqhw3<dYQXwxWtRoN>pm~yW@Oij5jxT0kPV;c4tsx%*n)d{Levx5w-7b^z~N0Z
zwYbF+qy)<X)=a}+`G;ZByvLMYN(Y=IsdHO%&su)+Y8#uQJ|9MD>^(?}YZH0!RpOx0
zxi?H?PPD~2iZ>hN)p|b%`i+{r2~+IgItg?gLZu<LE~80s3eJGC(bHLm^Z><THp&th
zP2b1odhV(emx4#n*kg_L$8%Q0RDo+BONJBPm@gO|X?C6D$L^eP`jb)(haPUvKgO+8
zc~C*Bn6i>yNu=k;@pp7u{EXTpF&|LxsAHOkfehC%)9bO`k!tV6?*~Z9UER_CT{6nC
zQ6&*Gg-H!HU(B-m46Gkic|2<uIoLs;X%g|P#_aiLsesUD=Aul5pOwUF%GGD*c3;#y
zaDO(A_(83;_<PtIIOr^e_rAGYyAtreZ&--^n(o3wz1a`+NuNs~6X}qS@+R#^P_7@M
z19j*sdXJNum#cA4OW>V#4|=67q{+poDa{^nsXs}2+&~d1@l`|0gI_e-FJAmrj(=Mc
z10}T?2V$}>kMEi;VVuE%FjvfedW^kdo2*3A@hfJku<ci5AzfOvZPobO=38<5w?<x(
zRRphRwMjxC&Y|YGz`mOY(nKEuM6o1-L{rmDB2emf^q4!A%e|@>C~By#bT!G`{iize
zi@x#3lU`rr%*-xEuuxKIR;<@dCjw>Ltp>Z5X|US6h~uWs1fZI6+|#K<V7@ZVIlvV?
zMrD_jn=V49@^~d%=24T(PNxdAD;c-p-mpjGvrD5R_xRR7MfKnDr2IPs8F)G9^@R+m
z>SB2ZeyWHeL#xBG{w$AIa_MN*K<s^Ex^0i?)~y=W2x%H&w>wRS3D+JD$;tA6op?2U
zi<e=MHLueXTTmF$7<#z3P3vl0FGB7>%-VW^iuy3!n`-;5gA{0%!NO|bH5sLOJmUfr
zmCaj#VEmUGqvS|^SV9Fkb}*|Gc1`!f?k<ih&}++i%2Jhpp9oTnc382+-BijPV81!K
zA#D|j9B#?lC<t|Iyg2s82oL&VL%Tee6BZme9WikXC!4GYXwkj4II=JIWS?}D!|Z-_
z@uSbzT0aYo17qcQvIA#>JTpeL*_1#!bQj9L%~_F3hUulm6&mPziJ|w`mlKEOWV@zq
z$ubr{b$A)<AW7+VsXP?IJMUR7-s?5aDlx9$rn9Yx39<HXaS{7xt#$JVYx<@iRv8J`
zpX}#J1u4JsDd<GM1llgC#7kcXO(a{9eQ30t?3HM(|Kjq0I{OZ=rj{*S6^__2DmH3V
zR8&y9^aKb+j|igDn@AM|qzfcOMBxY$Kv6_GND~Nx)Bp*J5_;%CTIhiwEdfFT32);m
z_j(TZy?bAFzLcHWlbKciwPyC3HSr+mQWQ<&-4c+9mH-6uWre>1BG0;c1siPIgFz5S
zMJ1){+S>TvJWg*B&9W`X=}c7H-iS0%k-g;QsZi$kSEo^o4wrBG1b$dx>9-f)@vEoz
z^>sMUCB)gceqZ@=)Iuuk3jf}xWCr18dBcr5E>?X3W+`|>z|752<HWrDYd^KxJyt|V
z?d9ur+aSfIGI*^clr_ME@QVoZLeZ6ZlHIEJJxzV%Y{c-HnZ2@JmG%0=e#GmMXH?c@
zLkKi><SC)ayKCk8G=zb%+oxY|e8wp8*O!Z3-%+Jge0j0&Bpd_s@4^)7)OyP@l@UBf
zereIf9Etkc$hin=Rn}VxD9M30{g>JcO<5|KP=&fHklGS27UpQnFD?ydV5#aS1^R`#
z2hu)HAVl|#C|LV5J&n;_-c9m^fUh?zUx<(NAgL0vZ`+MA1^Nu@0$WU0>SE0ECo(Hx
zyDx~?oNnL(tJ`QaJW<z*Wh<k8hS4tJ8y66|>PTD3Govd3S5HAg);$i8oO1J<bFvbT
z@*g?kBrKz-xEcjZD4SeT0CKw;f@MT>=jP^6P}=sb?jUsS2ztV{KMaITY)mV-$DFyj
za$&IW`JzY7Qqn{CU`vlNtl#JS6yBfL;Yr9&DY5fQ>4?5wO)Y^D(1wdki|d*s$-Z3k
zl^#Dqzh9qm!X~qAL8I=LHO{W>BrFSMl7BvZKU5%X22^0tZ*XLf)KqlpZ;wms_7s@i
zlX|?s>X2N@OAC;Eo#ImPxy`kLiLuL;YO*v7E|uelMSThdoD@whwL1A{&I`fSzbRf*
z+24V9xm_QPola7i*IPM0*`)LuV2Ju$I<V%tnw**%MM14<jA>{|Njse7e&gYH`q#45
z!c>2mV;v!q(?u1dBi>ILBM%KQOlZ#y3I-M^b*gK{!R35#-d#L)@_{^Pu)37q)g)$-
z+xR3zJ>3F#(JADypNNerG;rOouklihASChU*<Xp}-KzyP6Fr+N4V@}ExVal*U&1%|
z`1xC~J@L_xtBzJPDY=mFpD+3o!glZYN^t{LuOE4RH3-^gl^}XloU3K&vS~}pRdE%k
zTUrMohu4Cu#l>Nd&4-LBJ3tqiBY|mZ-j0=*!By^&qxZ%R@Pg`7V0CAfmzUG|;!e--
z4%Vn@nN*;==?wu{i|)J+o=o6BtA*?bHv7O{@a68?BPPg4JGb010XMI^YJCG7F8g^m
z;TrPNSNZyHat7wM4|uBUi?GIh;kWymVj5*_UkHVcBOGL4hy9Mc_|)@6Jt>^m`moGS
zh&%FE^Rg<(d)V_2VY0mFd)RaJ4<(a*#f?s^Y7<4qRNPd_Wr>{wjmB}ON~x%$t+~TX
z2f?zX4*gW>Tn53iC&#iRgCWlG<)FECm&VWVE^%bH&TBRv(Ropwbep?*Z7tM_+6XKU
z&3ZvR^>fKTsb~OD(OGKfjbjmNVw-Z5lx~AvXw+q~=<ShJxbeNI7LS!5kMBw6wH&`-
zb?)MzZh7}jH`0ggC?H)o=<s{##N_bnX*xkWq!aF$jy~V5`Pq3tcgp8q@t+l}=ysep
z^R(kM`qfT<caBnizg^e(k{c;c@>%H<QKMbeW7!e#ouZ>SKMCrIR|N&wNa`Dzo)f{?
z!hxp3E~{1y0&2UOj*}=h9TQ|lh{)SybX9!J`_%sM@!<jL+>xCb4XV%n=)xZp8ai%&
z1lc;3D}j_3RAs$_AzNZ;(V=sORy^@f<*%LY&oI}vit{(8tQXz<@T#fi&LC6wqt9UG
z7g9*XU_&O&<eBZY2G1+UJIr7W2Tl(Nolh>*GS*Hd+~bIPa4q}8Mc#(z#I-9yO{f9m
zh#q}z)S;&b`=yT**`H4vTqnw5QL!EZF&H<^;p6%mV=|=P-JRXU_I-uw>178a#;-=X
zTlH!s-K|v@aSMv(oyZHYb$<7^24@TINVUvLU<#E;Coyw_#)G(ojJXF>KtF-nACc`T
zc|h=YG+$#Dp<%4hF~oq)*`I2{0rES_i+<<Du*<mdxzVmm*yb0Ui>aPoGE3RE4C3Uq
zQ*$srfG7VvBF#EnHjH}G#fGQun)R3Q{+#z?3lm1y%g)*e#4L~EYaYtXtJ`Fs-I#co
z^Xh`+;rm=uMN~7}jMjZ=6M0IGA%9;J{66s!7Wb8zC`Ab{R|2LD`&MNyPxj1T5n1YJ
zeAV4!!Q3KNaT{mY*#pzh_VjPq-nDy?-zOTobY7>-P_yCTZdy1t&HZSM_F<Rl)3BU&
z^^;=)-JRBDXH0RaqC?mmf~$5W&a17|Hq|%PD==q_YAo|w;_z|%!xNJBVz2a4zW;_D
zm)ser%EJRGd5iz_@RBa=GcR}FqROdvFMh3_wZN#HxAS~job_(8Ip3ovF_-Y}ZwsWe
z4R^fipqCfKjJ1gvaFnsx>~ek}OzGyj!g>m@8vs4w+FLodB$KMyQtQjfTitF_?dJJS
zXUEMIRfQ!5Kjov`{JefP=^lbjdLH3G807`mri|S_T6I^Qa!<aDyK}vLIyLqBoxL(?
zb3tr18`BpJ&#31)q95>=Fn8Zie|_J5RMMh=UFDDfuRFoxmQy7g<1Y~Nv22LL2z_}c
z*NYGcpJ>KD43WCyvixygRz^R~<>{DgEbFECF`*_C-`@RyZy_+>=`rp5tAU&B!oX#T
zLl_#mvRRvJ=l8v~S1kyX?%b9lyC!pAem*`Om=Hm$`+>^RmZot0)Q!B&R1i0R8CucM
zMiv3dM9f`c6t8^i6u05$x4k1=pnm;2x2BwM?NPt0(LulMI}Go=Uk0UVi8sFF5_Vfp
z^RPBSqM(zxon*42Js*XqLF$9!hoRWRpG$Y<XC3RF?_5%lsXH$4+<2<W%MxZ&#QiF+
z`NROmVGkyB#9K3`eRU~WWK2HV{RV{{MlcTE2khn3Rsn1xkXb0H0KM&&e4U<ZzSEI<
zw$$$fK{nl83?{<M&qxVe>UW=qWnv*hWXMHQVS+c=`K8z2CLy|YYmj3dg$c~0#U3l}
z_19u1cT4*Nm1v)7;&1R^<Usvzjx+gXx?Z!u?B=sEV5`4(_ne)>$F_*00u;PNH3hg$
zkSKR;S7eXI*&%tcn^LdDE%(2<9??)%kCCIx2S4>P1Jv?5Fx9O=wT~|aQgnYS&*>Mm
z^BRFU<_UBBHZ&AyQ~(jxLssll(aP-vHusVIe$Dfi4Lq#x``lc_n1zMPq5~r8;In-h
zw{?j}LNYJ-r|X93OYK}#W4$`4cl?X7vWWC^UxAo(g0)pxKGemQXouJJA8>Mga*sPl
z!Qj5x(?;3Mee4dJ<X~j+b|6tq?8mwGzB8boJs?$Co;PBfd2ceD?f_ZST~UgZ2(+k0
zV&Y`{F^j`E<IFGK&cwGH>x7NpD*e9~;*YWp>A(+xx0r={RCAgK0Oc_tqtMe@x$c_*
z*(TEI?=o&qk4_BVb|}05A}EYres}g(Gm|^9NAy~q|H=1dT9<<h<pfG_6<9*CjGQ7Y
zOvqX6@J`;+hvI5LKAc{jsOOh3n3p@1*;UUk%6+W<dj8dI*J4GMLIsL?NSJU%YR}EK
z<zoB2?;|7%$_hvmp>-#|rOkb?wlRW(5SV>B>hls1gj8h93gk(Zzu3mf0G8DKXmU<l
zxl<8SA<6v)8XFclSE20C@F=f3-|q=M)vI4>*r`Y;Ove7O7xww|7fTy-Ss7uUEk1#2
zU`b0CP@BCc7Qk^{&~80*W#COIeSj;%pk)N`l4mZJf?|SyUY~Tsg|jh(q+i`3cD<PG
zG_s8T*eYdY9tebGb{ko_yfrgz_9G`cT+Xv{12)msQ*hI2jB!W@ZZ&6{Vy;8CBCu*Z
zFq|g?xo%QBw6(PMq!#KcjG+sq);sOF#cUt)?Bva??~g#GZr3e0Fg6BuZdARm5pqn*
z^ul3Vfx<wTQCh?o1+~OyO9Iht!IAVA<KZoDzrB^%x2NDL5#r!eDNaFIf0TOd<m{q5
zZUobSo0+~nWC1MXs**4W){j;+EOL)3ZyY@}bncwkMS@A7^GEZc(9cC|PiN<s(o>7>
zf_Cpt+f=k=Uzr}dqMIBFlYe{vy{s;u+ZAE~<71BJ$M`Jk#90%YYKi<dvPX|awhQ%d
z7<*fIJ0gJQe`2|yZ?yaK{a6cM*$qZ_LERuDSrjdyE#&@0fieDa6URoE<^$;ghI%&;
z%va^XTPvvFu2m}r5TcR?iaPg18~MVcswl^t@on;2VAOUkeBR}kLo4U+UlF=to7Xnf
zGy1|?7Y0KZf04P&9dJdT{T+4LIjVD9`Ba0vHd2ZmO?)L$U!T><R||McK*Xv8Z{ZWQ
z5b)5Wa}>RR@AtIoG?>o!?s*Z>aNc7%kr=}bq7%2T?Sp9X-p<h*MqrK6u3^}x@6o^P
z=@xgBm4Y`M@#3~7)necb-o@<8yK6<0!Gghozkm^OABJRt7oP{04;@;%eqTLU+Nul{
zr(<0!_o`F2UgDw(HiitVL!F7BFZCK?TS2hIi%LT&7#X9^kVja^py#rzO?5<sY|O{G
z!j-3gUvU0D=+VaIESodS(66O(yw5vG?g%gtb9k6$1zin_0}P*DSR@c=S<V2qr*;E2
zH6hAJZ0(`E-gP*)Ag-MVEk7gn{nf7xWBYRN|BCr|$$(8gW_YH&b#nq-TvH=No_bRz
zX8HY12X0<l)fmEBRKI$QWy(IjD*dOWZ>c9qeooqEsD_VGkN2Iil~~;9t9*I6ELwDL
zEf9b7?m`29tlZ#6arFmezMP7&$E#~Osbf1Is-3uE@4>lyaxe7K>1{8zK@&V(B@XYa
zE1H#^2~uJ6NH?q-+M70>2^^gUR>%$<ABe`!+X*U<kv}+bS*h_U(*n(BRFd8Yds_Og
zYgjgq9(J0M8RR~pv?S2aavyLO^q*T<{3KUZ1TPc|WSP#>B{{<Sh!L~buq&msZ=u_E
z>^kx2&zFH6K^yF3P<qoUVPlmxe9bm?X8sxBy?Eos{#m`ZX~~Y9wuA`e`WQGIiC8ax
z$e?tO4p#bx)8|R^3>^?`+jh<as{eW!_SwC@jAI*$&$%HtW@atli7N32;n$u~uQ|rE
z6beeYFNEdt%>kLY%Lu;f_c?|9Qjfo(_BLzI-s=B$XEdvWJ)ewQ28EkEDn-O!T=`lP
zd;Ck+rCH}vJh&faVt4n0=DNmhF{{Sm@Z&X0w0^K}E0x+i(=uVau+FYre14r+wc<H7
zoInI~<Xd8u6A7tod2)cGmFUh{3rdm|wWObJ&Hqz_%MEsnu@jq?>0kU%(|Q;KR~(x;
zbNApz*}n+%*C$`~lo_0#|2m;)ZKnxJnbPy=PWi@*e$Qb+jzf*dV*?ooiGUlpkLw3N
z;_vg{mVq}HBJl*|R~^lYFL_ra%cqhjHj*3jAd)jWm0i3@_Cw=!TCH0+sZlT6L|6F1
zUPbv?!H1Xsoi!&O)p&|X7$EglZVLEg$$`i!<WI!@LH0WrcC4+Cx_HA!(?UqbO}fbz
zYXm>|g%epxBKF=5pOiK(1$&Q*U@$>v2ieD`UgBxy(3rT8){-xbF){%HUqvidG^fNg
zk*S`>;Eir>zA*gww(NC<Qn-0@DXkVna!I^*9&E#s338qpo)%r&_4gL|@YK&=cbVZ*
zbU+dc3vg?Vf@=Q~hrd3_iv(G3T(6pYptSbvZgulB*AS(qg&3(TnUx8P?1Y9XIKJ}Z
zzzWhv;_CYM-UquOR*fl1tA0hsWx-*iS;V0#KNWam1Cl(PmK?~$?sEz=Q?wlAyQ`|N
zlzmR<2$4THN(|3aene1UW4|)bPYhNauHbp|9!KtFzx&SwwAg6r979@u-6!Ybp!c13
zE;3vQrK3n*%z2dHpA;(|8xE~Tng!nc9{IJFOfch`|8fV&fns&>Zf4q>mZ_UfzIHV?
z*P%OQS^D;R?}Ov9uKW4If+QAc_X@0VdBF*zD#ieRuL1l`{3m};Z}K-#kkSUU@1b6m
z!{5n!Ky{dp6T^<r!gEzSaUHo{jo_BYCrR(5e7UbyR#fG`>;VX?&b8qlFNxVo-^)K=
z9;CqY216pZ(OTm2owfgB#$Wn6sd0xC7|#qgU4yJ1ij3#EO$_@J7XFg@UCnVd4|b+r
zTcRZ}nV$ADeFy)#{7=OXQaIRK1}1lxb%e_#?5v!>%{LoKy3MbLlnESK#FII@OHTa-
zH-FXZdG-OCoq*n$T4kqL5R#?Mh^W8)cg?`A_1Sr3V*i=SA?ZWCzVJ4WnUpk-leMgH
zP3i2Z=Xk<uQuX1V73N13HNu>kl=)|FRf3(#OZ6E_PySZ%=GO;WJ6O*(Cn5!Gi}Rrl
zaa?QOjC7<&MM^KYDFfwOFo*j$i2SR~v1i-p^Le^mZn4nJ@1QVRT}KkGf95|Fz2Q)L
zNo0D>!BFITSrfS3s`$QAL<q@z25c_W3q`LNdLxs**No-P6siA{F$c;eg0RS}1cxr1
z=N)8g-AuwX<5=LDrO?l^{o}$rns-QxYE3S}QBLGGr*VB!gIB7H@4l@{^6lVfsUD-u
zE0jX-@$G4Syaio8xNWp}kaxXXiMK!2=ac&<i~qg0%#$D5L0+lsBxXhl_4R%glFZ?R
zU;e$o9~a#rvEwJ|cD;Ls%b7Gh`A-Shr31T@4$e*}^*MEY09@=m`R?91`Mq256U~k*
z-Egds+>!Hr3Vd5$h}lvE1JD0o>s;a3tTT7R@jvx57nwN=HFbTidf_`I_%b$UCBGjz
zIp%s~tN)kbyvz)0L}5Q>n}05e)PsF8*@`aAtD#B9!Nmi|gKqb_tYw<&SajhW{dCr<
zY$7WSwi2h#1M)^l-ThjMrBFvAEh}|cY^ze=ptRe__9C!YjBu2P#qpkFCN5kZBR-qe
z;%Qr65i7E(S_$9Ip;r@Fnz16o`?jiA?ZldI5=Hz636z*3uZ}rspG^$tpWR9v--Og?
zL2oFy%yPXghdLT<bo?il8*S+HBa7D!LryF!?JWzup<js;IIc3MgSWz(qvm>u1@6Bb
z{TZWv2u{$gUBw8ocCL@V3zqjrhc)Xe^O<hNSW@^uh4jA2hmz!M<zf_v|J`+hROV@l
zQULX;dy+k}s&B!atjL~R&XqUA!CB0bjehV}ea9bkTr(c3I**XxS*DN2b^@+Who09!
z^@`X(8#gSuqo4V#hb1@W4s${3GTxh_RQU=3KWqEol?+z|daUG@^TJ%<1|1xH5xE7>
z?Gk_u(@A)Qn42XIP2%HUo{u>u<RZt?a34A!IU}MtsT;8WpF+1FALPQ)uuDtpo2PZH
zCfjYq-^+;2ZoN|MY=Is*ghvLh!QdunD<L7Q7_i@o%i;p#T4GWqbQtu{4r~k3-u<Px
zr#<ThLX<H)72vnFvew5XO(C5J9d{{Xsq=t|dNIDueE(Eo`G}fNERApCw{?{$;>@M#
zrn0~X`a;jW{kj~H>zStC^poL}V_?X7>1y%@%h<AeD?oYRx?`S%v#45Q;IFO)j0V_}
zP*ZwgYWmD)t@+yue)dIw0Ie725N_?>;#_R<iqOW#=YA2)PwEr0PFZ?Yh999?yxf4(
zHwKMG<;%G>dJSwTOdk)eqL(VV)HE00^Q_P{pdFH%!n9*6kdlW6O^Gn=<g?G|E@~j#
zrL^{Tf6{2d3?ipzaqA4daI3~`!dpU;->#~)3H(>9K-Mj}Tl!Vwuhx(&D!9Nj+5oa(
z3o@Jz`YzH}hRkGlnD|k{Lqo+EedWr}S-E_$;1c96rJbB*4?vbz!O22LH<+vQfSVx>
z6bjV@G6QUdti$(qG);tmogo$+E3m3IuR^S`PGO&3{%+F1j`v9{7?>l>Ity;xW<G;Z
zM1EcG`KJcd3~~A_^9T-*Xw#i!H}SX03c2DpL--?B`s-}6dHhqj{Ie5j)FSwZiBPi=
z=-19*)byLkl7NymF6dewx}_3bfs7<Uy{#&<990L6=-mi!+{TL>4CCQof)d!<3OH2~
zFqve7-oVbptOX3M<<8}<QLq@~h&f_0r`h<nS5KVF2Na_4J6}$hptnG>Vz_@}kma6d
zE+o$Ds!NYSh<E&5k!B6SW)-O0Av4i0J){Oth)e`2M{$t}9N1A&tRk*}dV~><TNNEl
z5eyLZdmu`TZhWBPaZ@*wfBYR#jyk;VS7QYKYDA_RU{4{v*`}qqM8lm@-Jed*2KMLH
z2|<<)o-gXyj;jwpcXsIn*g5@f=CT^9K~mu?zFX4!eyjKMKu~7^rr<}*2b9I+7C$?;
z&Yu3!IiSBfg7Kb$>7?4FKf5+P0AIXeFLq($D5kLMu5_<+{}p_y?o^P_l(k^gdJV{P
z1$H40HT|$vG1H2fLDHcaWOe#?K2Ll43t}H<A@i1N$1hfSh)*D(=z0|A+(ppbGGeeF
zK@IFW>3y!Vk!<330;Jmz>~%=6z5Tpm8kp&)18s7%GuHp@^lQweNOao06?&wnKyunE
zOOWW`QvZ?~c<B?EqHUz-@FH^NVDs3@BXg_88^kVI@9P$~i1r4=t^)i_ET#YlLq@Wn
zLqr^?ei=B+Sr6c#2KP?@?Aq)*LePMY_r6_uw>cP6r)>Wo^g97q*NCiR$&Jr7Gwi)m
z6^!v%<M+ENp)O-;AWe>L2~oWTE}^9lQo-;97f9nKNym*30X$I^ddELU_moJcDI}9{
z1ezdK2}cXSj0Dd3V{0t}NhKROWQC!FHF~JVcAa2yeEL;Yq55Ej@$HEn(*j->jL3tn
z=4fpRG#?iuVjvC6r=Gjabf1+wQHfVbs#@4Rn76D7wh>yAoK*YQTWq^F^s&hxaqby4
zf6&PLgDc*=&ezhaQh{p0rV`6r^*ZNLl`xedb6qOldV{y<-N`du;DLf#3*htSDRv{t
z89tZxqeyW;l2Il3D=e-sd!4_d?j}E!KY*wtARdt}i;BQ4d<unJzTZAS3}O#Q4(;bh
znm2)oif%g|1Xi3l*1;X`%m#kxUDBKzi5y!G>USTQLJO-xm(nlU@!dx=f}yVMV6UsO
zW!X(SH<<7Am^yMl&Y~8%2HRRBF%6u5@Z5)U3>|H^cx2_k%dvj#q!Ac+{Umri9iA6~
z&a@l~L_8o(`jNUUyp0A8d?(7*FM$alSKl`7L4kDs+5NvC%Qi{NwTO5!;+AjsX2Dk^
z>e?HEix*4|Kc!U(tF+nh!H4VF)umAv=E%^UGrh;I$y(F1T$HC$9q-8BjD#+vgn9=J
zhx#!;ZPs#)T!EZRR*Z37sL%xXg`hstow5Zd+7@-}t!@L7<0-*}nx#PlWqw0tIzn^;
z>sDwdH{}DMq-y|Y+ZrH>4YnD_{1vpsn|#LI)-Rd<mNSSO@(}<tjn`5I8ydjtpTO&d
z%n$v|Cm!T3FB=v(=L=U{Fq)wBf%*h(p!K1WAm(veN~C0@E|>zbxZn8|(>fd+=|k)T
zQ7FA2s&%uC5c39o+6RTPAb(gRv+u>`u_PifAF-C~>JVf%Vw3x;*v>)EMJuR{{`vN;
zjLJWa<L|?ultbsFk49)?ChLn@ShHjILE7vQP0-Q}sf^^s=R$z`PmYBOG!V+*O=Yyj
zi#Vz%jyhAgyw*!@5UddP9Y?KCd8i6C)+$V#BvD<a3|t%X6(){WcZgOCZB)R1K<jK$
zQ%`$fU7CcMPG=Wuzo|*VYYbFQ0H2lVu_vweU{Us7L>m_Xm=x2%o<e)-$z20ZkRgh<
z_xlP9S9Ad&VSpwl-@8Es-oS;%v1ToJvud;%d6MaBMx2XW<KY~S_sQ|OmuYQ5^f_;}
z@Qc-b<|+CD7ji)xV{IYl0YWx+g6H~`=lMzAoKwD+nHQyxdJ|2NYc9(<={;Q|?DG7=
z*@q(%LemBnf5~Ek4I;%1lbG&WQd#`t=qeba9CO9H-|_|UUVAV)nd*s3j-Pt%O3pT$
zz4ZIBJX6km3aG`85(?RKOVUT5`flmq{?nlSa1vDyZ1TckxPkZiWqMiUM?ntNMbnnn
zl2l=43WyCXLP>23G9$p~_k`%vJ>KKYF2p97=}qeE4P^NZh<F=V7#MXM_+2az=F-jQ
z^3u>Ix3%XeF2QH{Hjib;xBgFPG6~(X-m{FJ64$yksg}-Dx1(mL4i@(dZXO5upW|E&
z0y~w&0LBMJRYf<*R+R2pR-$@ih1rvCY+X4=yo1oVVngq19*<LiJsaP&XY^PucncAZ
zKw?{czmV2jNYguKSDS;)MR@x?)OFwSkALB%r2rPQ>d0uAo9ejY4G_J*E?8(42Juoj
z51JTJnK)@hTVCM*u%rq|9nN{gvu&7`>O(-31dLZD#L_%0(Ig{uW%3-^hQ;#-rc<6M
zE*dAMM6Pv&{%+scoE1YY#)n0U{u=522MYhYFD|+R0ElI`?L7#|$Fl6>-w7`G;JuKX
zP}gbzegV_t3|+wg(7rLlr4j7FB%(oahFuP&yvMu+%(b_0fi|Q?I(ZWn<gnpuhKhIZ
zwu94gXv&?z$OiDpUiL1N`p_01=}TUpj>Thd$bCLW34zB%(%(dST_@7BoxPR35N6($
z@rCEm=jU|MP08Mc)lP^}HPF*-&;?ljUBK83=nK`$R-7dorUq*NC-Oe|;VZDIj|v!X
z3+4$#25L1P$4~;iie$g2nbS6Ay7kYzf)nIzgkpHZ!^+gn?Y`W??eD5(dH1`+4HZ*2
z<?6a+qc%gn6W+`eCr)6@V`tKp0Xtg~*HdCjnDWgE)P{hUIEFK!8ps=+`-dalQT5$_
zK^8y215&pyOOUCw<SR2PP=WYZG3yyeu*-s90*n!>Ez&2_hw!vtW$?M?$>Nclx_vor
z<(>;=W2;?We2#ZlMK+axpP(c=9=bYql%*Ey<rj`=UIOgLJAzm3<XhnEapVv5kJmZD
zOa(Kq{%%(O8)Ksm1vq@;s)=Fl2r!9>!`2PEE2I$@QT&ik*7?Fr$A?e!7k2MSk4|Ix
z4C+BuB6r24S}yR?Y8;x!G!Sh-c8}sC)08|+$E7_MInGo~Y(23*R~+6D3-=4acDe4c
za*}IsV8EZjGet3&C+M#HwpW-lR^#FDifY1<KZ;f1eQwFw=odd79h|_NjdD>o#H56x
zwjsR~)IduII9Ep?>%)*CJR+va!{k!#HL7_MaVX3{tv4goVy*k2w}zm;_IR*jk)EKw
z_@sgO>e~W_;;n0mv74^Q08(f{A(_Ttttpd6j<75p#2Vcw^qKMxQdIvc3uWFkAR+4*
z3>*Olbgf={**aud--3v4M|YyT(L~@tLT3H{^aeLQ-fq@g4yNR?4F%s7sZblJ!!YQR
zq?!fJ*SjUt5kqu85}9QxBCdqZ0z_6<#vCo*kz*M`i|zR|95NilrIN?}!}lZ8VAw-e
zi$|<7_?<)|e0uppc`1ALvW@quSHCF}qUvHIY1qiQ<h86zc5m;MHE{SX7z@3-HT6VS
zsB`zGDA<}h8Px~-k<~7ILnP1<UK;~A{(>g&y0o`)Cwq(=6}91goA99~q_ID5$4$t4
zkbc+v6%eILv7j}VMp;KpVAiGsAw9bKn@&B@Es?HgcnT+CAQtjFTGA(&f0jW3^0`?i
zIZf9~`si0&91$sIk?*|2`|J|;;FBQjCx=wpV0w>)R!8czTN`tS@+)!fwRm_l-Z_1N
z0}4D(2L-eQ2OzBIfut%NY8&f)C&erC(;UH<u`6&Sc44nzThKuB?Qt%^^Bw=hB5(i8
zZM1Bk2PAW}glTQVig#Ydgsj=%hvmuzK|&m^t8HA!C52PqalrZ1M;Lb_u@h$4#AvtL
z4}F4tg49Z;DogQ0U_1BV{Ww2q+f?)vs3}mb!v7AM8o6FR;ZyMg5lix>=i5lpvjVe2
zj$}uArjV2BKqrp&esd60Fvk_Nmuw11Whf@;dwX1X<5&5i!I*q$>tPtU<Y584sL3dY
z2d}iFA>CpuSnq(NcXa=fJ1=6`pBL@bUjmv6$39kNrdo7zA=>au>|rJBSmiV#b{W`u
z9e9e<QY@@4fG;g${8*Ma;V9)kS;#79km0e4>tMj8Uyt@{Lr1oR+9b!4>FX#}sv~iA
zn1|EUVthq#CcWAC@O+UN!@kL%_*;v>?eT{Trk*o?c{^V%^^2lerDFyTDj;~B@|4XF
zXa0{jR97g*^2xiw^g$z5y2Y_VMQUwyMMoJ;8QIK3`hin#u7D|lFFkqOW5YkG@R_eh
zQp8vho>9Pf;EyU+x<UsG0L#A7+Fb^tH%G7+J?Pm3U&TF)DmP4*>89k201SDJ{3-wd
zu|>D@xpnFm+A!hQ10<Jkb?KeERlGO>N9mNDXDXNfn{=Vyy@HDVgTq$r36c&+@-2Ex
zFajKFt76$&9|wSO^rreYi-T5QyD@wMu`QyLn+3gseO9r4ALhqi<l&om6<)eVNpp>>
zB^I93K0JweAtrpy<=7!sv&O?V4wVJiJLfEpz$y7*NjH@?Nx>%Xic5HM;uxS;#}u$`
zDkQqQm!?tZRG8(|Q_B^CH6V@WS!r{={$onm_zvGCEw`mi3$J`;Kt8Qer9y<BWHjfJ
z4E)hq6JOz@?lmX1TsyW4wrvM?UQ;;1HU3B-io-*7|NrYtjdWv>qD}jhLtA6~y!K^u
z^PNh5_csX(HNskVI$(0WVPL?!n2hK0&_R7oF;TdLpIC)^CLkH~0~^1~<zTvNHh*Xr
zw|`uj<)6yBTID&w^4!>euPo<x+11mRTZu2sUM;+oK~Sl^S8OS`za6zgE*%pL8gEB0
zeiGSLjH!14{3YgaWOJ|&!U<Ab5Zj-HMU#CwUpQ3OaV4K<qns+64u(txL#04{%Q=iT
ztfgx*6O%+bcqM6;4-9{-nj1cl3EK3z>XjXdS(C6e{|W?U#y?Q|gkPyMd|~&F{7WA3
zKn0LhVL;rI--2dmCRTC^W*9&tzWv#VS*0%R#6m~q$2nE~inrP)-9AsS&FO^PwjP3~
zvc?lI!b>r`qMh)dcx5+awd)}H<N@Z?42s!4ZCwO6?hY6bnQWzd=*=}D7)p&n4U{2I
zf)yscQjIlIiDn%u9H#YRl0TCl>w?w`slOnbmB3xBcGj3Pwg+TJsWt~sJoeFx-AgST
zlL$a&uL&bNmlLNHpDRq^qxuCSohbo0-te>*eOLou=z)s>s|6Q={yQ%JDGWgY1c2N6
zYiHM@b#p&ylnU>o@tfN{?{*yD9A*VW$6-AO{Ui#MACN|Y2r{^mI0<7l7wZ%2L;Pv<
zuu$=doXJ4Aj+<d8`WXzvO0yrwS}zmvoi>gdh*t6-N3BcPM8~~pR=q7HeBEXcF;%yn
zOE`Dp@&DA|efDCF2Tgh`<VPRD4)0b>;ZPjr_#cG(k-)<wg*$bpq>ln)=Z84a$35~I
zHjnmCJ=(we|JIB@X|`SAfP%!E!gJT#Q6HR;;XRA3$_?9-7u_D5jWq|5_K6GS4^)+9
zNunL5^|0gDuvMAj(~;~c@frO}!(`nSE^nk6wyiq{LtS^lG_I$K15!Hsc2m$9@Ei0p
z#yoXkV(9W*4ssok@UE}G4;R7zxXM3?DP<GQ8{XV@Qz}Ii19T-CphpS^<iFDMKYF9F
z{|8A8dlD5M)SOg*{6Ev;1Xq&7{x^m7&o%8G&kxOqrO57YKmPyIj?Fq`a@AxBp0<ex
zU(E#=?E@f;?-wssF0UG{{{pyvbm-0-4si&AdGoiJjKqqpxq%`mnEVjX_u_x*yOk&y
z?L7qFXaxX6XbZroq*@c%aO{6Vq<naJj~|VtgxtFJ`9{F?qcKnbTxtIWSIHHS*UP@h
z3(xJp7&JQ+yC7SqhUFnkg#jTvo0Brbk$JJROhej;VSy;40<t-|;54aL`5Hu3g9s#n
z;I(pa&vLgS_5ui4HMn6bR6JwW5(<o>$H~m`_vWv1<G5x`A@y902M-|&+@yt;5o`mq
z78=PUf6WS&ve9ogxvgm*0c+o;vJkBNKdMa>2LZyx29MfEx1Fy^&)5b$u4?LPpw;g@
F{yz}Km5BfV

literal 0
HcmV?d00001

diff --git a/assets/img/rancher/backup_restore/backup/storageLocation.png b/assets/img/rancher/backup_restore/backup/storageLocation.png
new file mode 100644
index 0000000000000000000000000000000000000000..dbb7e809c8c2b02b50123b2f9fb73efb98fd26f5
GIT binary patch
literal 136628
zcmb@tcT`i|w>AobA|OOiKtu^5y(%C`OH`C1(t8aZk={W{Ktw>Abg2;qlwPE_(2*um
zq=pun^Z){ZkmTF=zQ1$M9rylm{KjR#*kNa_UDjOlneCYo>Z%GfRM)9UNJwau6d!An
zkWdPckevH+@d9wh+xxa93CSfUJ2^RZB{?}ZbvI`lI|pkL62*ulJqm3tC8jJr&5KGr
z!Rk4$XUXGCbH){uXvH7VEAreWfAzLWfUnl8{KJ=DRN;<-K>~d2UQDgCOw@e6_4;Mm
zdumj_>fw?^S=(9MY^L9i|50<Qq$tUkI+qT#vG&a%8I5cXA%S;E@o8P`vKKCXAiMs9
z)bxf^@O?IMary_$FNr3zCShahB@=xX_^(9d+Y7O<mh&VLq4z`dS_VR}mq}_NdIG%U
zK|e?jY_zC5MNSzl1SvT#lEewL8&Em0wKG#~^3*7WQ@^@@jYK4=J<f{sK}x4BgX>qb
z8}-*L6zJ4=Uit8MG#itKQMfX7+}_{Idr%}FIw7^#aNhtPnR@p|LVM5kuD8ZZk7yYg
z!`&rEh=XpY&OLoew9)2NEIMqIu?fqUHgpq2IUl{b<(*@YNOzO0oU6k&RHm-!(j22=
z`<0}_Ce$l7ebE+jlJhdEF613$$vj$V3D-V!sNRS`F-?6MYJ24Mir!W+uY-5-)02;=
zUy9Zlo#!Ba7xnh2AECn>L_)J2!WW*&ff%Ui;~8Xzs@cso#X3B~rK#M|w-cL>BF{e@
zk`t%5%ZU0a+2Jh8ne9r&@=T)Cj7PXXxGyd?m%1FD&34OpAu<<3t;rsCAA@bZMMZlp
zR`{v5Tl@SbRg~6Aa=5!?(xE;lR6;;i!`1=*P~-I7&hn%Ctyeu;SZ&<9y7;h`I~}3r
zlvGalY1toMzIZ`^EmV-~8R_JMiP`BN)X1x{*+FC+Y}A<GCQZ?$IDs9yR$CdK3-CuB
z6zAImgZE4!Jg-iK+YLKMSgm^fB9~Yt=P5gUYa!c_ev5IKHBkDM?O;FJ<MPor@|<rj
zheRxNsDB)|0}`^zq)sQlNQ@Rb*L-|Onwe=xopugQmvvc+5=1$E(d4xe8>LLLf`*|A
z<M)))mW=ZsA23BR7W4~|b!{?Nv<lv`*OR$?6nuKiJ0oI)%nx<mhCT?_iZaeV^m{XG
z?lkw}c+p2>Y;N__=!oN5$x}w=b~xAbiS=%thjTx}Ddy;)h8B_KArs7-<X*J)UDrvd
zrDN_{FqMB2k&(H=+GpGL<GHJwljNNkmv3F=-^;sq_o4EuJj{wqM3$?2pBZ`?AOE<z
z>k)BBS^XPTkhBP*lhO62d_~5M%=vAe={bh!Zk9a%Ir;ai$hAEq5{y7-Z;`W93^R#B
z7D<cGk&5l%b)ixQk{es|PdT4Z-4yb>OmhB9Yf?5vR1kC78%ar0iFumShZnC=TRb?Y
zcs{}G=Xo|zMHZFKE8h>~iNOqJf)f|3gSI|g*d(QRK=%9scZ;11sYj6gJZ%Qc%>4OZ
zWIHV+uh=+VzqxZ+w&Pm)gU!p_9b~&t9=%iKpjCP@94GMjwPIZAw{tm{3_=|qSKq4o
zR{D)@iQJ8L?XlA>&^y+pdwZ0f>U;&E*FPrz;u$5Qd2ss&xd(e%=*p+gUynSP>sgB*
zd4D?iMfv;OOPZ}mun+iaE!uavY+g-Tvg%)E49PW5eNUbqon*1B&rr=||B84*H5Phc
z0d{5o-eOQIn}JyHVgKH_zdMQ5^uKKyGQQ}DWjH0B4TE$3xOjnF`V~{KisCIRx;*-)
z7nfgWzHWc5<+9~*WtJ}DG1t)BU$o;ke0S6Dhtww4rq;$zJlf=dupcHUa>&Nt><POn
zhki$;#F;~rGn2EJ)0g8kOi{r%`F`^;E$8RBCrigmZhJy|clWIKwDyAD*1rvXoANY@
zO3k{y*DdKLp9)`!cD>F8p6gfn--0-U<5f}>4Adr-C7;wO`+h1Ycu}yPFQuyUMM}@J
zX+7}g*8-3>RP$bb^(fmqc|l@*l%a}a_Uy;z?4jq$VsOLj#qX-4bd{x*8q{zPY=7MR
z<scOc2{V0I`Wcpo)Yj7Ys!pw*o}*i&TjHg@6>nHt|F%B&<vS^bfa;f_Cv*oa>-g)J
zqKB^Ez3zKm`JR_u#)waz(s1SIrJ*G|p;1(cujW1-ndSStudW$)o$I3Q;+3yq)aZK}
zS)5d?lUJosXi}(Vq&59STFEcXEA&ufONgth(yAi0u7A0otbe0lP3nylsg!>vr<9+k
z&_?6<&FqcRzHz~yGoSrbjuKdvg&zwmIOm#%%*qBB&*{Q52-^6kc&(GB+m-S@vGXxJ
zH(kv-9LYvo#@N1_y=nCdiM)V+Bmc(yjYT`n8*UoE==bsj`AK>Es2JvhYobvB(V<=T
zQL!vgTf494^y`Waio|sh5y48e5u;Y=N)0_h`AK#k*ZfBU@{am>Y*=klZS4CE2TuB<
z2R`-Nrj4i0RjZd{$}Z~{eZ6nFJ3HJfGU*m)9kMLSZ^B=#Q?8Tw)5Jcl3gOx8nRKAT
z@-aG0C1$`Toz`e{?5D1ok-1+FZI%1iD^rfu8#k1$tx0N%RlHcD@hb=j3Wy8H#FJ6v
z$>p^Bhg}Fu`P8qF8*M1L-v6aErX;2=M*7B1)YuJKuivLbDxYA|lTxmkd>JKDBN=j;
ztM?_OkZ$Gf3k}-!C=cse`8pvtM^8L@Wt+=&dSh(SX*+AXxd;CyELowbTQl}+7Wv?V
zLCLIvEN~O5k*bN-2fysNleyT`hnu`sc=z<KbeGKD-Gc?J!~WWy^>H4~>0oP5baxS}
zb1eH?Vt@5`=QsSi*_C%U%cSS6KUjX?z_`rg*h)VbJQQrzchPsTbMXteQMCBh^$wSv
zmu-;knH^wWVlLWd*haZPx4_@-Tt+i#>?PRXT!fo2u$*T9LbprDa+_6tO8zN(`o|w%
z$~6i<ZOa=yj{L}C@!*oQjc0$8e&NLF#9S9$cV|rDwIdEE4^)4x=x!9YXSV@8$4Sm5
zpjMmkJd;PoK}AzJ?VWb|Z;0f5UmZ8S-Y<y;yiA%0TA}&Tb~%+fm6>+<MY*ohn{%?Q
zo{xH7Z(J$nQcd@9iYMftloYrNRaTxs-m5CAsm>)4Qm?e<qkr3$iHckQb`7cBs1^1h
zG~R1uZ3e*^h<15uD+T?w1`vb7uP@01U%5Rjy`xyGf#s8y@l!s;WxUT=&uB$0p#prD
z8h<z5W>?XO`QrF?DA7(!s?!Ti@2c0VN0>T=D806_CDpuB{-Io*n$=V2X>l%834HaK
zQRiyF`!unGd9i4_k9JI-r&VDhcstkUyTYOvW)yR=sEW<^^kXyKmLkWmag)qnjaJ_e
z7~KEt=QM#z^G)=X+z&+T+=u@>t)Y%*5)%|NzVE&83DFi<z@MF>_|!>Y&$QC|ZnJ)E
zZ9v3+JdJX5^4`<I6v^bIlmOFSlb3|mA!sSl*TrC^;&9oik6-VyUbwC?Y^|okCaJ3c
ztrM%OP+S6QH`J<M*_!IHA53aUbT&{h;5Herg17}NUf8GM7x$m#neZuQFSD5A3Q<uO
zZ<_0$_OBa8y6rHw3tAgN92uON>I5B(0+OtCj=j)_AGg%JIJWNZM|KNWNgsG8Z=Gri
z7Hk(p6xtPfmKM)gm)ZN?G~_Pcn3Og5?#`N*jrQ9*a+>Z&=~aU_Q?}s*`;*df(Bm7=
zWq-N4?A(f!OQ#j3O&Pm=FtUNWPEKPIogba4(8X%!xaTBwn%?gGbAW4rL7^&E2r4gG
zjhUF=MK9t7(aEz{47gdVRGpgKMV6O-R=YZGeP&n9l)d@#WGOXBw0rO*!x6ITx&6&I
zcAtg`B{T~2X!5~&kI#W>8mh)&ZphJzg~_2&$-MmuYh)jH2{}wMASvLWt?HM3=J=J;
zxyHK-^5ZJA1GY78&Q0|u9)9!RQ4Oyfa*sxLlIA38VFzIYU|c<_J_d3z&}G;Bv|T#3
zHr7-|$mg`qZ{f;R!rtdDHG71lto=6S)|wB5;Cn>98yP$s54}e~{T@D9&PJXR>nBo%
z$MH}1USJM}C0;rg%+)tKZpCgPi9$OwEx2LOOYjTGOMjVt-s6#x;CzG<VjNz6JpB6}
zdSj-wvGw6yg|;~G`8yLo`k#@Q>XAKA4z;E5iT(70;YhfS?XC2u8^Ofa4BldOwWR7>
zpa*DU67~h=TzYZp@O+G*bRajDY;@AMmN%DeWKxMPlFIq+Yfwmt^CeQYd!(2rBKPl?
z`MO~GXcZ3`Nd%AI`XQc$W1^5hAHI>QhrI$X!yGsq1NW6Je*lpJrHi70I|&IR=h+{r
zk|qa+goHH9PFvqYU*(yUrL&`uxs|hpwUCda3ox35M8-!7_~>ZuVb12`=-}io<s-}f
zXM_~+`RueXJKLWj9`>^A`YP&da?WnnZ1;r3gzm6IsMy%pWZbN5q%<GP|2rM{PnP|;
zhlh)lu&}qcw~)7}kh7bu@LfqsN#Q#p!XhGqzz9KiUndW9A3-Pg+y7kTKi7F|?QZF2
z=i*`K?8J6<U2_X(PY+pk_Ol!P*UvxCY3*b8-*<9y|M#_k7Zg7GM)<DK9pV4FHZWD@
z?5vc!osYGH{$o2wYbST$9uN^xvHLQACj7s?`tMu*kEsU#Jyrbvo&P!We|+=rOc~*`
zH~1fK^v`nrISZ^8gi1#Ezt$c?#q1EC4v6E1-D5Rv;CSv#Hh|>LKJ)x@1U{3BcPic<
z14R3PMCtKEZ6DIjOp2fzo#g~vqPu+XrE`?#EsxVVNV#m^WyOJe<R8b~H3*`A_y(#-
z9_-i>YZgxfx-+j3BmSPlO`h~tFj|QRA*4tw$SR(kt()olJl%kc9vJxk+e7VWTn9Gr
z;ssKOhgZ<ZXr2l+Rb_ATFnDtrZV>C9Sz5%p%&<rWnb(S&GY3yl9L7ltEr1U;z#aI_
zLAePN{M1eCD`D5zT7^@)_gJ!Rnh@!;e^9r#TalPjHuW`R-?(RE%XV4Ao3e)bYRjob
z$+xRKS)amfbs}x&weMww^LH?ypN4cMy&4|AXP=2OmB4Q#Bt<pyP3q~!?!9$A560ww
z+bIKWlHtM|*^G?apzGsM^wM&NJ4x-h@b)})GX~OFYWe_09r!rmtsKS@zjxaej12Lf
z&*T8LG#vCb07GbwQHbB((p^I3eQzq2H$k{|0=w{hUB;?gWM6fuAk<L0C%|z!7t%=M
z+&;a2-jlKB>C?yNN}^o??mrF><A-A$5gRhglcFFRrs)uv4OiiUg&&3#{P4pKusIl`
zT-|T;m3q1ze9#V_H-y$&)L^bRa&5+|d)-5p$u46+gP|LQx@*Yx9ZZAgj(3M_7PYU?
zQe9a#+F5RfX*T3&Ue*UhSn#8mlODq#(Vo%*BgdNNc2P#TtEQ!8SCImDDlEWpjQ4{=
z;w8L-ZkkbGNo7btEo2yyzc{FS%cyJeQ7Nx$*NHU7o9TJo1YW4~k^+Vl;ecdog|KV3
zLouLJxe2!H`@`zpG@dXY64oG!y)X)l!YLix0YXqjt>P4Q2qxjR4~*G_#1OSXNC`(c
z_x6>e2wV~p6he_M4iZ83JG;Lu;rw&511}Tn$0LxRaNXc*tRl;e7E)vo(>&>)>;Bc@
zL$l9^oX1y_#S%tE3MUj&JLgGgvF98AdJX<ec#yeILZy6=L@D23l@@RJG>`W$R`Gw_
za@qGoj`r2$QAsyz^6Srg_Ka7zq<U|c(ZnvX`nP=M3bgfljW>f%s2waa60TS`k0(N3
z7=lptVba)O1i^xgc>B*9F@oZ8C+M(~7vm>tIAGsgC}jq79AU^#NuWi3fh{{2=~Jf}
zTxKWq6hv$%VxWs5OU=#L?B=N|!UzNy-D=-O(Gx%$7|xJv{9?aH*~^vTFzM$fnMZ6)
zCG%vEw<L#jjZri{6vP%NCicxDg%73a+XSom<@>5vQo@xxa^FNMV`2Ccuq&cg4FzNA
z_S>iM`5fp=;oqu9cL%P#T^@T<70WT}b!qz`QX2cJl--PwjIumKf?zm@Z)=QwA81U~
z4L0qS55D!T<7Z4Oh5uF3uVG89IK>GCr3fB@@-frxXEjzUOx;B)5y*MrzuL6_wcMlc
zDJ(*Bt!$XOC*kIlLi6!kDW50Kdj*>$5}$|!2E*o=u;>3uj8@CRZdA(En+hUV?u`33
z#Ox`K^<fmZfyXBgu2O0!vjhOA1%d&ct#>vyJA2!Hag~5!Z@egc{Xg;<m4(jhVHpB-
zjsmTBsfle!jPPk6maWd2C-C_f+!VGB3XE=x1mq(NNV5gxIS2wqhr)g~!3<8@kn0^t
z;FXpPeS0kXe3Y|R?>{2({}}aPlhjY097A#XP}It?o%Q->**nhB?z5PNi=>-OI8Iu+
zu!Z*Z-CK>6&TZ)!u0{jdS#n{FCi!*yQ->ma7l1Hbo8A+`hmm;k+1kkod`j)$Q9$#~
zegJgNx9CGgTfFt_a@*o3V}|{it`YEgFqVQq`nO0z0vZhmq`}!&W(Br3d_{Kuc^B{h
zJuG$01hvKAXJC%Cl8N692md9i{kuWRRDIZV_4n+@d*}lpz6y!f4*Sd&;><n!UKxd~
z%XCrm2{R>t4UwY*v;Y+FOB8ZBp{(C(hiyWkeS*RjY3?EcZP{)Gn{o(U17BwH6}n80
zUd=gq3+f0!)4FnR*<yqm8-#qu(f$FuQd>B<s`|AGg0#1LcUWz#$>pQa^RL-7S%|cC
zw9U@fW-%hCWW*vr!maH^Z|qF{ku=)03K`4rq3m@VJ(bp;y3@n-fUAwIq&I%wx***`
zTL!2)fV2O5JX{YxQ-!E!Zasb#mebs#-?tjKcw;Z$k%>RENl)19n7pC_%m57~nESs&
zNnC}BjRrWLqM(mj{@LGGgL6zK?j8mMW3XYn58V)vV7JVglSGA!*I0XGu|cuy?<%RK
zyC7#amv{%FxXtnwe0{xHJa8L)%gl%4=nPdJ3=3^u1N5T|blMK=_`yz4-FKsa-rMAt
z{-B=%o#IsJO-rz+6_`gL`|QP^itw!cUy8QmOtepJf{qu>R3@XImCyTIAMnIpCV{%X
z7;}h<A|*yF?e(*gGXSd|1b%(ZqwjWLi}0@UsR;2@gq;e_bxICxRr4HF`;YF?)!ZgO
zgNwi(XkhEV1LIdOWU*W&#WDw$fC9Tp$_h`)_|c56g+hzEq*TgQit)F2Ti@Q3FmV6M
zI)>^f`J?use<3qKx*udfR(t|V7IhT7`TiC?H~!t58ZU2Rt!nrIv;njpFuw_%QJ@Zv
zZ&(oKIS-L-docye*+?#|Flg7oiLPL~4E-#oZ7dEiD#e{y-41*uq8*0`bf3qc#PC;w
zWfjKsP$h!Rz_x_|fbJ~Q<_;Q^l{v~eW`iwOAKR<o6i{dOdL&R4)i+%m))pUk4;Nku
z>_ssjbBYO4ub{uzztJn8tBHvvagEQ8kxSZ7{3d&nb!)$D$^dTT1<3p-0)yi+p6Z{i
zavOGh3x+%Y4{}jLdC$q{rR~Lao}ab^-}?%3DP(q<xH-rvlk#};p)tGAm6Y30<Rhu8
z2gk8#rTAWN)USVxR2Y<jG|TV$v^&Tvat2+4(aqY|RZ^NX9P3R`D)=0AXUbae=_xhw
z)!&KdUmau{AUmJ?vFs}T+~YlJ&WEUw1mi0s@xJk^k}<=Y?h9vcbkPhv>3jZ<Jw08f
zKtmdH_ewBgGBj$d!fJ~MtgXoj_a9@rS{GLP$T+{R_Lb~%jV#@nxB#)pWX{P9oZf+Y
z9vjR5kwpY9nyuvOhqA{Pz|8(@mmngByA-FS@V`NXf3agdg@Wqo(>_gQ2iua?qC(~q
z#8rj5qSm?jMxjamRNvI`^WBLdAi!?xujJX%VQ;M{W9b6>Z3BN3UcfO%r@EBN;y%=~
zy|%M$kaD$6(I=x><;!aK&^0={xEG^<^D2F++Q@Z~@tSz?97e$bgt>kCe(?0yaW7%M
z2J6Td(`tm#h3qpPMg&+O=xeq7x8!_)$)Ts~V}ItBtOSM;wWs0g`XZ7thj9X|fICZm
zOXSIhgw|F6)|4oJp9_BlgK46`zDq8NyPBkJleZ~zt;bT?LJ6><y($BtEN3Vd6kxS_
z1_~|Ey%cab4wKAP+BO0RDibLa4M!t9*AV}x$to+F$~9MLk?JsU?(p%yGQoHR?u+fW
zpN=lOGyjn$_qN2V+E@SoDNOPc=m)0Tk>f4et+|-{y|&SB+xL4m?tkx~kx64<<?PIL
zTCZFyc@oK30w=1N6ebs^{lo^m;yQhouCPFMntk_}!WH_61lj4#k}zjcI>CR~>#mQ9
z%#YgHPue8|p1Aa)whedU729x8UWHcJJau_+*CuE<0NJ_`?Z=u5T`9f0e;M!+ERghX
zf6{3-oOIl-r=B~Szv=TCg1>|-s0zp~(^gA0;~5nzt>PLlGFaq#R@)<}ul}o@*u~<!
zBvd>9j94dGDj5M56NZ{Kr#fS4L#6)8v;RT`3U3>}-h+E;>vr<AwVc=)&UwHwNYQPu
z@zd3JGEJn$|Cmb8P;=d|`o;28jq~bMrQKEoQfM2jq+vbivrKqY-|Ei|w;LVZ<>fQn
z>Wayn*DW>ON=VeUw%e@jGg<wfS*Dhqk_RD1mHOh~2^mD02;6{ViI`FYRo0bj;Km5}
zXC(Yy&8p2Q6of|rjuOLh?ybg4!Z>)p`Zao_OlZw62%8=8XF1hSt99JiBW85qO0THQ
z5e7A~l;s!xN26VlbRBqkV7c^bCuE7I%1*tBu^D`muZ?0^XJ%&ocGeCjEcM1Ktd+-T
zE9bw`9y&Mf=J{<^!5h$Mi<;G}hPn{YEOHVJV^{LfGx4k%>EN6Z)38I;YCtZZgrPj|
zfKdvpd99K!vF9jUeuSxSk^oKvhU|a6)WI^#q#F8sk@WJNigLM}yHmf*ZOncpFQ@1-
zkN=cA9<>uiZ6)kPZNpmU#)^&V_P?{NiBGtMXe(s$^9s2h%@M=XMQvlIpMRo3MR2oj
zP(428TD`xKO+1KJldFc>p>J;Ec5IIgm}RWIC4T>E@59rV-ookW9i9v+AnKX2;0DQl
zM)Tj1^8z)k7x3)L&nEgB>-J~Totrkc?7z*=n3S5zrgN}jV^tdwHY*ZQS193M_=)Ya
z*T2oO^E<z*ox6&@;5GfgiyA}+#4Gs}SF^NyXz5tK#6T|}-6jve{qrje=3MDI=F;J-
zCNtrDiptTFTf1z4jbkA7VK#MAWNjmqK{th;bZi90ChdFvfg+*hi&#0x-a}J<fnxn~
zP3;$4_jO9k9s2|&yp5b?zX_Vu_XiwKuEsyseEy`wc@DB2ul(J;{zeL)^6Ng2gU!iy
z6W7isdpp(V3D89D7f2iQR?Xa2o@(aGE?9t4s{PH)Ar8?iuz&-aqfxEF6W1)SDJ2Uy
zS^Cm_jpvWzE|?a{3ZoSO=zR@t{fiJjX+MZZpg6AasY-F8px&EY4x;u3Q(E0r{w5@1
z58e}R84D#;?xb<u%7nKnYCN5~^9dnp<G;Fny5Ce%RMa1x#91rl@f@6zlH4m|q9+f$
zNSsxkvaswRH~;btTQngF9dA1>3~NROU|YN6jrZZ(ujUY2V=!cCcS&=XA8x5(m{M8p
z&_yncRk!rW{>!n?L6S$?@HbI4SF-BOIX1!%^~F+QoViRA#wlx;djDttN?|Y>;x*R4
zc`3_2eo#e5;#=ijBqu2;WS_R=j@Si1wrz<R-?q|5BRbpbl%-~+6NT(Q^wDPSU-ba*
z1$kEnAufTmYV1%!a}ClQ9H9PzW-Zt=Y+(H0+~A&}`C2oM)eVq~)3oD}sDwoar9qOT
zn1K?}e!99?SXfZd9eRoh;TIC}@}BWT=sjN_`qY4%*@^MAA1m73Dy}gV9xu1-cH0uv
zFZ&U&+o@L(g_411+CZGjJ6D`=TQ#1=Mm0j-P06LEO@<|ijfCtX6B9m1K)W-!RDjuP
z5|8O$imeso<aEHK?Z-e)LmxXeYbIcy@YCjDh&~YuS%2v|5uw$A^ws8*b)!;&TxMUX
zE<~Uq+Gdc@n$Mo(h}&*Rkp>=7^u!3jj)2qM&rS<%k7DK0#T`#;PmbmU7V8UaPJZf|
z+by&`d3BKDR3ea@xBu~I#(#eR6(jAmYFO=HaEtbB?Dzc?SfHSi)(HMarQ@`GeC0`9
zarO22dao_blIB_Gm3{*eLa5X69s}#q;nsA7qvN9ZjK`we_#gt=GX0aqxp8?m5GM=T
zG7r1Cbb;pjysMtygjvYJ;!7zI6#qK`x;>ho0HYTgm-(J?-1HmIQsd+55m2aGj2eU!
zM9ZrPu6{kf-)wAO$bkcXN2EjH**mbg=BAmF2Err%Y?bd`@mp@jzBaZczDqKxLs$@j
z?C(O(2M4|nt|s@6$usN3@63zdcZ9t=G3%}#^laYl<5p>Gw?oG|N$)g<NN?9#R#-in
z3UGwYZ`bd$D!o27EL=v(XZXLG_DV0#m92Z+Wx}DP06IOOJ33y4Sr>omk-x2wg|2?b
zxyJrMQ#zkG6P3E1Y(!Yvxaqf9I#XfYH#4H9pd7x|bB2xfB{#PqCzvZonD*G?4LAIx
z;}NVLMm$kOIM9DrP_m0?z?I-;B<7wC=-gXu)Ju$C-lZ~Bq_FlU;;>rVbHo$1u6te|
zD3w2F2FBapro8WFDOvpH-PELcV-4v03`A0&-s#)6)32d0z5GB84UJ{}$oL_~Vc~Sd
zZ%92+0UWSGcu8z`J!d$&@O#e0Yf{5SW~$0*q;~)zF=qnD3rd#$G%P^fb6e^uY2x$f
z!QLa?x{$9mlt<|{u5xY5@M<Ln@4s-Yhx$6${HyTPZ9H?v`3;DF9Io=}WD!h6C-hfT
z%`~Vvd#|K&<6alK5Ij$_GjF<f+!DzWIqDZ3OtI(Ey*;fy`puyp-4yWd1v9~^J5lc^
zp;gVHtDkdrn&Ru{rL4U!J6ONbVur*%bS3t<aLWCrYjmx=vBYd;fcx^`iq!TBWG4#x
zHe>>N1_+cak8RAhFYj!TEvszQrTT{cNrjp^8#X%aQvzAgN$kyr7NLsC^Np=Yif|h3
z+t3^c+6I7ayS;8|;YM~I$?*amW$)e2)rQ$7Kb?Xb?)U?V$QNok@0R#&kKMmZewNl^
z97fxhHVyHELQ@J(z8B~`S>QdIo@3>HsyJ=KL!Vziq#~j6y;ex(7k}T7344#+PSerD
zTuNm_wFHgBNm~~gRax)F=$eQZqp>GL&S_?!`sM=g2Q^;3-0~(atp=u&1(w~kuMGI-
z2E$lij?PUBjrKQtZB5xk6>EKtar*tM&!0tS;IuHJEuN28<-JRSUU&uJ7ldUDiJNi#
zC{?Kv6>^}=P^K+eSh0n2A9P7~td7tF5Bup>=gVezj^&$DDyLkp<ft@0I62th7xyhe
znu^-M0`4_=pypc}8qC{czLj0kF{?jWXAz<Q?D6ab!3$q&5?gpa`h~iWS4_vsR_PS*
zn*{I29yl^PZ5ASil(@uFe_&|>|5gWQ{;@wE^>;oArJD10$4A{VV2FRJ(c|f93~`+D
zkT|ZE7TtUDX0s}6+OJgB#M|JJpdLK=v~rX?s7SxAZN|egQE~LEtv4ddLT+vLlY%i+
zyK5-@rq6t{6Ok;CvoF31qx5Jh?BmCuhD%pocEvQIJl`!ZZ4$mVBeu9y8)vw~^wAMq
znKwK~vkAuIB_=cC(@uiQ)x|DHGq?}a)+w2%!?u|X9&Ty+73#^^xIP$bctVkw@AJ)C
z4Fciipc;gLnsFZ_I~n4x$p}2TDB)5lxct2Mcj31guZ_&@ZtyC0uaz?Q6Z1!chy7E$
zlJNcCKgcqLnDp52xWj3?ZMBbwmI08ZcVt#5+~f9wHvc)uv5-NGqv3k9Uv0J=XdltU
zyz~V|yAeXZfj@K=<g9y|vdbTKaKE)aAZ&sl7VL0Z3+>p?j&QKeaIM%7?mOgdMg*LM
z;&5{a7u*&yRvJ5xM-yZ)Ept|NwardH#>h+tS!GRF3`87{_Y^5NX1w#T8;NED8eg=N
zuNl`{<@1PDc@cf~5EYGc3WT(U_ORY~7c%So+It_nMs?|nAIB-pJX&u)>D}1Q|IBV(
z+*(0yMjt!vg#Vfj36S?Moy+vdfUT=<z&Vr;X1sUgnx7FJ8h7QlPpRckj;jxC2hx_g
zW<C7;qXX}&W2T+wnoRgLx=%L03Zr1#%}^mIK8mhFCTl{e06s*)yK=vp8^q`nq(IyJ
zV(ieob@<AKMpEauH1piN3N2tDok<GOKbni&z)NP;s%6~%er45nn~6m+m6Y)A+&P)F
zO?P1+W&sVhx_1PW2PZPmgLv6mLTXEed&@$&>?tsi!^~Ae<~Wsd+Jn7X0qa8`1bOo2
z>gm=kO67*_`bZAq=C6A1o#bpQ%Tz~B&fJgJJ)+f|)<!<ZHf&bx2T<#l;F9?D>RjVV
zz8WUK9#Kh1qJ{VnqYgbHY6?r6XYKszX>PuJ%_8F?fq3>YH8FcHnr|jCIk~>Dq<++M
zZCLVCCZ@UPQa=!lHQ1LN!y&$k37K6{b^XHBdE=o^<tY@|leic|52&e`j_ao+RD$YP
z(h51s3#xYJme}&2*USVi#7M6Es-2rc<ZE&AI=CfX&GRfx%H61Rng}cj48!;4@gx>~
zR)Se}tA>|Detp2p%r1B;b13~vvv>N|@-m#m+yHJ0$Iop?aAyr=uV}OLC0Kn*7BsSn
z8d>K)QtJGipavOo<nOUw@C2d@8~?!(Rp}l_K_xZwx&tJ8D5uGkdcu^0^nSnAOb{tv
zbn1AouXHBUdv-&3NL;x7*A1nLb*9+cm7-0*zTF0S`t3B?8kczfX047wuT}KV=^D{|
z;~5-t-hkrj2QQv?7AfB4Kc)JsV0}J#Plk<3+1mb7)We=2%+uS)HE?1R2(S4fk36U6
z`a&KhM|b$1%D9lp5)-{<{B?!hbql4_y6@Zq2b(|JP42F<YcR%Bzj9Sghuqe6)vRLG
z5nrEp$Ph5R_3I!Oa+u?{G2ngb=y#Y{U6NS+oBbHcD`0?#k>0*mvo9oVh2owx-P7kb
zA6;Jbhut%`E8?N{+#c<zDW!Tkl8dO1mf625Vb(`r#`Bw+urD@>mlXD>n$&xF73wl}
z_UOMjO)-7hyfISaEsy-&JZ|Eb0HYn`ej1%rpDAry2}Uy<;tqSfDX5ei8nP9@rshp{
zTIV;k-4eTB7MaZ`mC>%qO~ZfhygD%AExNKVZZ~|>^-&C$63tDnqi3U~+q*Yw<~Uzy
zjmS2CR*D~FQ`)2KK3?Zv%bl%An#Q+n3_sNyF8aL#I4fR*vPbdAFc>>#cz=m84zG`|
zV)x4HaZjtvHFERM&disMtv`J<{z$u}sCgS4h}AgSZUAFX(v0stw`W!s+|6!o;ng}%
zJ0Em&p5iZSFrzdeD;|M}tC5X~!idS_jYjLB;>f*tH2u*+7`R~^1{XCYJYx%&P^o6-
zq*SW^oqkZ5b5^eV_?T5iq<*hA5`O?_AmE}7$l`yy6a0l$&c%sW7T;;t=#~&vXWygb
zPRU?`N!TBPDzx<~e`j!^qrmV`7+?Q(LWcrFP@Wp``#`GbI746URj(Q3?_vA$ws;|F
zTPhXvcvbQ9A9Ow%iwWf#FC}E=H~~SwNFu_p#)+Yj+W_eRu7<iT@jA`72=+!p(@nH>
z%zL_sZv|3q^uzYem&d@JE7jA4&DF<A<w6YB0s~A+d}67u)GL~+EOBMVI&W>hXDlaG
z{k~9a#Ve&FZ&>e<iiC-u&sCS?HL9xun=<jK+WFSrKwUNv+Wz$klrW-kA^YdJrHaGL
z!%3z9Sl~fn6AD-%jvkRX*c&S4Y>W3v_IUN+0xs-pFGMjsag`ftv#+*N+6XsC>eS4=
z(`zYSuU+uQW}Z+J67V>3LNHLFIqm~t7#ll}BK8LTIs}2FG(Q|DC>lr;IsU1!1}qLO
zu?7Z#=fm>4LD+kN(J%>FWHojs@zm&Q^5e12&m>P{Ui(+H=8Cql+kSu9T=DWiyV>IS
z=}`|iqDRC;ty?+F?oAk1YgGLsZCk3xp7QY$ZzJ^@?tXIT73itWfoJo@2;G%9m5>{`
zPmTvA#ETs(B)tbB$<mqub^Y}bJ$eU@)cgnWS@E^WSD6}^U@w0*VcQCuO-rDVHN~kN
zRNW^ehxUyrAb&7(o+%@Bh=8=}Y3v5Wr(pJd^;PlKGd2V9*590-3d`m7{VX=rN!+L=
z_!~atY3oMxn={o=^bOD?b7W-4zfLfhAPtlPmp*M9)>4z*NJr@;e`bN4{`w*uaVW=m
zE4GTm%=6d85JO)@K;C->&MzjvwC%plaV3o=Y!G&uh}k?6vRUTBLj$5j8y5KU+mpRp
zgaxb&tK50ejFrE++juw~cdcU$&OrMep9GOAA?wtbXu4uZ!MT{uAi%%M&|Y#mNf_#6
z$8nEP*1WU9rll_eRh`i-RqKzvP;87fz$JztCZ!KQbudiGY3(D}*3Kb8E6lUMZNU2v
zw7&YSq#Wyz(+}qEo>gANtZ{7H-E*IPwkdrs0|bCHksb5732*mmXCU&09_)ORIl4$U
zaRf!5bIq3QKEH{yn}+_$LZ<i(;&%Mu+kNW#6;VZ9l|%&bxR66Qfc5;<<H8=9bcc%a
ziCIG>)qG=fB^|gxgw5wnFBf33qtwm~o!p|Gqv&Bz6Zq6u;<+`|ImfNtOqmqYb}}{F
z5mBQ|KeSm}YS`S#m|n*!`?8jSU$<7c87o!Tra959yFCXNJ=%bQdHGatqJU6qhp<C5
z4WE{o4}#Un(Mo<WMxv?tjz9E>O)H70xSdYMv~y&rYw$=qNz*3Sc}>~*dACs_dtM@3
z8nZ35?;{GV?m3|tAa?yzgH?K+ADK*jI4zgbE>+IHlnr2wnNm|y$`>BY`*8J8+Nf?u
zqERTKdx@=XqXsEE=7_{sGap)G-yD8<3rp#%a27PG7LY*HZ3+}QQz?%@4~K+*w2<ED
zpPR7llEjdJ&eAOZ>q3CO-oHi)sI84-n3tpNVaA%9@-WX#Bf)j)`dkJVtJJEWo#pJY
zdO2~+vs8v(hNFz%)4!)ocqXQ?nnTxZn>g+H6^?BMeBH`TqoT4=)2qojnd)>r;{nYC
zn*!Vj5N6@Nz-eWk!)l0uxZ31+pHFz+Bx`g@{oV`Yra?{_M_;|?`qd+MAo;7x5Y0Cw
z7Pr>_RaJ@inf0Oa75_K1vh1pXJ!3IKIueRkeF2w;b#A;1;Rpw^Gc%+4BmP<;VVgo!
z%3*r?!rFX$`UnpF^dD+v2wCMaRl#y5UV(@-o$f>C{d^AJwcJ%nol2@z(aG70<-VDp
zi>0ww;ywJkZ%Uv%H%D)kFvZ-i1lvn&dROl`jC1Z@OlWum0<U|`IHq6;y0D|OBqmRo
z?Bd;@$1)q6TGoo^R2jAeDs5Ftu2)v^3MeH6&v3h<ulbjO%7cT#TF7L|D17Mt!e#gZ
zW&NhEzvm_zT=DMa^sLC*-WC>c`pz;spFVI<Dnpb2Lai-OP&-%~=>}rqV?tUPF`GS_
zcdGL86P99djCU^%Tt~s`(=lF?!=WND++X2RcVDNu4&56m>l}K3fNygiWt@JV9y4-Y
zR+T-dVcz0Sk!IoV`vCZRlQpII%#$rK16={XHqEm%Zkz(^dLUun5xr4GETFmv7;!?@
z)c8gT%hpu2Bfs$Sa<RXK|2;|C1eZrovW>UGdc;_{jfMq=5WHajO;)Tu)dtBR5ZE|v
zPEfkKO##R|Up;BFLDenlx$Yt1yO+rt;!@Y>(ztN{5w8508kbp&>S8fX=~%2bB5vlX
zAr^28DeclL&+{3rZ43is1DE26p3X>o7SbtP;H!5f%tkn^RNa?PTc2tp?9hQq*}QIw
zzuVK2IJpAyFE7nQ!&IzqVC|0Ylc}|8VI>Ah7u@e02FZSrH3MpXjqi?kp!1}x{;~6Z
zkF^N1f6{EL;qD!hXk)Dy_X+R3fIp?i0Cb?`{1Xj*!`oEKC$Wj~w{J<`F5T;n(@KHD
z44TqXQULUCdlG33Qxfm}S-M=2IQ4#L{5W@XNj11lGni+u=)1c9b<RHfs^^pJmKk4d
z2EDF0*P9gf3R0oIXfV~AHoZ)4fW05B=o6BzwS1D>?b26LmUE=ESP&tX_8?~(g1h9Z
zaKl$o-nU!`=KZq@!pyA+T#rimW-eIsVOlCCEW(M<cwV)yB=Pl^l9~GY3QdEqXT3%>
zFHB01Z^sLg3aut9p&gWv)LuvxLQTj2DZjwhEkIQ|@dM(pudl2REQ+iRs&i&S-zu<f
zSjI+lGofn_#>i&!KjTY`@ny0mRH`YjM~X|o+%;h@cot`&@$xi*D{qyn_(P%)h#^^C
zF@CiAVSM61Y|PP5GvC(Mc!#TKIxbN=^r+{RuKHw=6m$F!fC#{yg`IN>yIB(nT;Ep7
z-LA9j3vwYqgdur&k#d)E2Rvn8ef&vgYj8e9_8tgsmX+Ququi2@IgWM1(6PK*y>S}6
zN|MErE(J!fVs6M#4Bqq1vh<f3-!o1REcu6u1yr@zUE^xs$3&{k0ClfFMJ_1P_dCA;
zGq2Gb9i5}3pM@&NY4_|=jy3qnf%kVuwyMTiw|~fi+|qt!ry|FYB6TYz(mSp&xU7!4
zm#auDAMKiF561@}R2ugD^#f8;iZ|kS{PJROI2XunusBv`H_X2h#ose5;W*swM%4N3
z1pG+ZK!^^?bUM~q6S2!GI*HC6siosEVvVz0%83+ia|C@Nm8EW=kPv?sMtQCQ)(EQ2
zIBXB(u&>n-87mr160hd!SJ{uNjwVc5&40opkFqHIi3eTv0;o==K9LszFL4_V{?trD
zZd!T%zi4G#U~|y+@!qZbb)bY=G0F`^r8cTnZUYz#SahZSQqdq3Zq@iKvzoXNhN#DF
zD_hF`>lUKD=6qKJ{v`AQ*TE*UDhX+AxWKba>|(Tp$Bf@^7a07Y7&n6Wn2YuBt=nBJ
z_1KyQga=*5gPurkIJ^4Ymd}{?sFQLWJOOi&(hTM9SlKm|p<F0SwL){V+hZ{MpO+&U
z1(W??;5h{#wwuQ<x;gIjaQ~E_{XPE6IGP0>y1~{*Ylu^lR_60v^UQ9G=Y$#Hmu9<C
zWSqMb6$sA%P%a*km&3*H;S^)KW6J$Dn|Y^Y52FJt=Tsz07UmdmHJ!&xtSG)N8vmBC
z+J`8`y}X<4AdDPjKV;I*Eq2DD=GdWTf*UB!?xB*RjJz&EwfjMDwA?^We~R>SD1#bT
z1t7x;a30+_Iu7^jh*S1NFCw-Zx=0S<904LlQ+f??H*0HaCmoGAzuizhOKZ+1mvIws
z*LJw580%TMCSf?5q8m9J?^N*ZQ?CRfaIcO-GGI}NsWUe@{+h^gfWa$)Dpb1ZXG%3-
z3LtV+Pm>^}NU1W+VZ`dw*Y8p~@u8yz%SD?N`~tas2T~?08_sY)R9al%=E~u;H<(#D
z-wzPWj4dL7Ib|)(#Cy8)=DxjwxPT{EOTV|4$F;17i=_bucF&nM!yhajXNY>2G%TDL
zq4^oQLujW4X|7Go37S-(xcLIueSUd;yG2op2TgFZrbG*mL$n_ado_6PFwSwGmU*mc
zYBXP8s76`1GYK8#jr$aZQIDCN-ymKb%g+%K+}B44>hpiwgKsJ1_u~PGt55pKYCZj3
zdS_mI>N(j$OjUf@{u{M$&GYO!qlUFE+39!8<4xALRwpdO>S8i~2kz9t3H!&j&!E5Q
z81nW9rQ53#a=2K$zm(<lSapAMbE=20q^_bC6mD#K&Dv4SAu;u>X%im57hI85L=Xhy
zebmgMIGGorLBU#C3RLKJ@z}%ZHQl9{`{>IW=<698NIow{E){ElYBJ*cYgN2-GZnn4
z<-peIzWJBDg6Hcp^9;!XUqw>yKJTtB-K?({f}gCdHd;izH_tW7P~?aZHHRa7&};ft
zT$74Yyg4nh`@g?#FQ>rNOygaPsAMg>O}C{y5_6}{Sw|aug}<|2=EB(nG5X_Fejzu(
z9PlmHdjE93&G+$I^6iqes?uBDPCq^b2g=mnm>7^C-o5>hU*Vqj9xr#jW1u)sGcgea
zaRZ&+D`rnDoCTKqSB&f-(qcKUjJV)KGpBCOtC#L&nqVtt{w(2bRvbrm3hd>;+lp<5
z4cA5ai0hiTsN>O-{Z(NPiCLdWe%?6FUA~EDlpC!S;H1adAii3Wug}MUJk1+r&G=~e
zTE((c#uu0TcpbO>0u?>j@>E2<&U*ndAB>aJMA>b;4~=j!e4`ldC2AXpaNt^;a4<;t
z=+UT)1PFE$sfR<o2ku|WJWkfQ&&n|GG+3)`7pXV2vbtFOMaHEr#IA%=G_s+tclZJh
z>gFwcBo)B-XaT2XLFdPT0B+{@Y1)qSzy^+Gf52aFb#DJ(3`YQp{Y4ekVtT!%>GD5p
z62Kz6{$r8(n&PKAyhTM1*lmRnbxBfyNj6L#OqZCGJs2g{0gn8XVef?Z#@J6`>%%@1
z?_{B;2sGg{?sH%9nx@4<o^pGp54t?C?k?O^h`1N&Y$aI{X7MBsbJBE}Y`sP+`J)Or
zu=@{h4I-dW-Cd2J840RV5LNn!>34mRx(vt5-4NnwA+|D5T~1Op*>~Emd#h=9B#{@4
zTb>p(|11|qJ5;5K%&8p>IQ}{AR4yRQh)DeY3_-{gP2!L(RT3LFmhP&GYjT8sPhH$@
zIHFTJOm+T@ZYt2d={wr$v_Bx;_ZERv-$qnMPIJ#K1Ep5RnuLuI7}}{wz;(RN9Ysii
zQH~w0v>2w4$ZWEW*Xz_1*L<T-%H4kQ9sLM_d%ww@ZKr?Bo}2&av0VWSm1~Re8*0Lw
z^6!=hTw{N01k_gE`)w3^qdvt#*3=O0-`AYnHHNA1=!R6$83e&cO>%l75a)=Z<UXyj
zAF2rTJIdtUb@OZw10B4Dc_GS(1rrBL33dl}8sxk0JWGz7R-w;xsDtv4oa}cpJrjJ<
zuvJYbEiEKeeK_Z{DEL|FWxa1`?!)-99HZo8>TZQPv&8HNoIyIFOtQ7}k$5o;T(HFa
zd7r!Ch>r7U3x;OlUE|BQ9-KbU*bVWu&)C1P(<1$rgb+#GL$P8>2e))yI)wq<r#@t}
z;l3oZMfA>lr~!9x%fRgzyvc=yV=%IN=h$2IlV`IUi||CVIkuHwKquKe6_l#i+1cqt
zcoiC7skM2<A1EfS)qC!2OL=b2$MW}GG_A18H>&h0uW3-tlxoP5ZRnG;BY)}UpEkOf
zawB1{+HtBD0+?aW7B>?_5o~f-L}QazKp<)dIV8^_bu+fAbXhrBz?G%<_+ABh8W;K(
z)=(Li`1os8X@P74*USRGkNaYD9C>z$Nv}z1k81tn^y={fPy2DXJDWV$bl<=Nk_Hnv
zH{QP0#o=lk$G;z#mZosnR~5Lylc{w9gX-4w^1zMyyw*)MTZ3L<BY31$M9cC1%5lZ;
zu*kU4N|pQPn7diJC6va2eHLJ7c$#kh7i&AP-|x+}sTzBh@tWg4acB=AF)^{$cc00}
zZ|r!Tr@%zk??6BTHavN~3egDeruYBa&yBT!>FkcL{DRI8*TN;+Pw&D9;%dV8Cz0bV
z6qtuPSQ6=0)dCA{jDSqvk!>^dig22IqZw;@mkfPML|=zBTEw3gp||XJ!|PS1cBiUO
z$$Z_%Yy|&f^ZaL5lR0GNR$c`V7BFqprL}-z8(JNVy5U>Fa>pgIXg?>xXPH3{_n041
zmZ&af5m@egDos3PL3W%`7U};YlnSCqyAARQ&FvKt=qa+V?Uypy+bn6=X4vs?iWEHQ
z6M-QI3MzkhZ4i@lTe5b??b?PX%2OJIOr(?_-RKpWaBiOzJ`5u+z@tZq?`ygwos(n-
zHNFeK2nXH{doytGFp_ukT*EgTCK(9~s>PjbkftLnj~V=aJWsN;!x1g+nqEtDR?2H0
zH)oo7BHl1x7rgq$-_J>rU*K4q={UhqyoYuq)gOo>q@B6l&Y0^T-e7<2d0gRoCUVvK
zB^8IOo%?tV%o$K>`x+PXY#dO5z*o3>4XH{y?!-XNeR4Xixb1!5g;^s)o9CvE`s$c(
zl+R620$f-X)=HIMqqg6=x-o?iu}&83QdmHX5r#34d4%58<io}1X{(Qb2b6XR&)Y*i
z`j`3j=7H8im5&VY=w4T%rmL#XQZfLQ(lpW3x8wUC!nFBp5L_&2)xw7cXoQ}>C&#Ad
zJHRh6sT^h{Z(_a58%r3v&E(`6I%wqFw8$FpTS+vR>Ijc>UQvZwzUC0EdYdq~-T<#e
zq(<27I{}nk#2u}ln{9_@y*06i!6p_d$InwREA_tH9mHMuDa`c66m*62P~|5yZN1ik
zl^G0>{_jCe+ljtT{fEkKK;wzTIQEBe_Y7(^bGJPbgEn*}%Zl_Bata*moRAHSos)nf
zoudW=>_RzxZR}(0(VfWmgZsOM!^41|{wq%<ePLw~HqVfxTg<lyGHCKU@|wo`+t-Z5
zOgBIR{6u5hWTUN3*SH(WcF?7NnKy1B8;GW8Y||8J7xB&Dzryc(vpY344Tv?(SNMSV
z(+srs%;xkK5+7WPz^8amI0jA&0+hSUwh>=DO4B-p&j_I%Hvs~6SS=a64KaCDc~2H%
zRx{yfSvl>0#DCK5erqsPhH1s#e_%YY^^6Tq>HOxDgG$+cY+dd}V~=RVAnNOt@=Jj+
z`@5crww*No?Bs5f4FBN<ngHCu=ZZvtE8I7~`-7D=I(gpl;W>W`_ZG<OJB51zy_Z8^
zy9oa!&?bFDze2-niQD8DwbLs^F>yuV=@+(`*tBDc+MkysHe+gYF3v--AlJ!>ceM^X
zgEVpe%VGXodd-XSM0WBrFnU%h+|SgUH?YTSsn;}0?FR*g%U@Br{vRDP>xmTqqK8t6
z@tcf{!rtTFbq&^q_x&AW#tv$}uY(riP$3{J&$<8VVpyMrVt|SbvcM0??zC&1u^V~S
zwE}}<Jj+Dp1pMnuG<RnIf8~**;fr%v34)`)nV%1-DbT)i9_WaGsQob_)w(&nG&(>d
zQITX%TEbrPtt5j;=sXBZM);wB{Gt4iWj54%!NiA&5bvD1M-9eah7{3)(Gpl1pfpG?
z5zg{6f@MN^v6|_RhN+>#x>+P*MdAH0&#dYHQ0wk?L{|bED1^^f0I~%q&5#*%eNBP|
z7`TCS(Li$iEeX(BAtoQ#;#5A}^}MFT1TEy6vPz5A8$dIi$>z`IkwXPT7Y4hqO_U9t
zPAs2h_E4SfOoJve-gL+pjL4Q^n_4>WaOsXrPe$)Xpg}^vf@#cV;Ne{eAfzQDelHSm
zOW5BxTs@G*JV-3lPP%kggtCXD=xye^eE!znj3<Y{_MecOx`herS_X-`16+wTiIvD>
z_U&tayEiU?TPS`mknP{tywH#zGh-$^L49bk+2c;(|DzV$B9P*1Z@k~-e;3waVkwLk
z@+Sdnhk^Rt%UCw^q`X1^`rF12Q~x$ix2^gDzCvxFeXhSsJE8U!2>aT8zyeH<f7NgN
zhY!1C$EJ|y7JyTbo2hB;euBeLH4eKpz5*~F3nKunK+t`^@C8!mGeR$6kC6}oux0NZ
zsYSZ?$O7Ff3wrmC_)jT_t#Ay&%D8Ir%?ibag4^5=pmzO_1~zJ|YZ_KpKYe@0YB)}b
zyZMUq1R0?19os?i$q#~M#bo`0R?F>A>(`E}qAwD=kh{+N7Xnl5fej}2#?t3p)*a^{
z?s+mS3FP@p{~*}nIM#Dy-=2kzaJCayXk@xsz!S6Y7OrIlard*#N60LMJXfl{K}BnB
zqxHqV%{R5_0p$gm7Batgzb?eKP-EBw|Eq`Sf7^ecex5a)K6%*JYE7*tijTj?Gi&c6
zDTZ$Ep5?a+3NWS>QgL5?{VGtLS^5MwOPR2SOy%C?{X=_Rp;<lxI%+ho5L=we($glQ
z?_NF(0h+-6Js%fK_!r;1KKzNs(<Bn-7Qt8rl~b~YR;L#h5?v1_K!;kfhaqkBsR34p
zI=8-p&U2dIa)~!1r=19vNiwIvkox~!lS~yl_*MLHMHTbg`#qN=rK<x<o=Np~GSl3c
z459Eb1KEZBDbHu`9+L$|&Y^3f2c3(%vBH3NnI?g0Dk|_-|G9C=pd`$8o_YU*&jm;j
zXg;K?n*u8cj24F=t5_G2z-ar~7Iz<=;|~Sn%oWC<!4}aK8ce?wIz+y>Ok3L+ty^Ne
z_4KWBCWmQVMTLm-1AtiPCTLXYQaoMll__26Sv+0I=tj50-cEPpuiIh%(>N1+VL6z`
zoHvtuj0aMzZ?MEjtYlYJFDM!TDg+)g^<EyCQq_f<n!OK6$RGUW?>b$uzPVkoRgB%a
zY}i<lF_(GC{&{v|ZH=aSK|O}t^VBJ|@$s4<rM~2kA4dyvwVvdjTXW|>E;7nD{)`{q
zU|-I?M`$!1w{0pZu`bkg&6}^^go}rAZzH!iDNZ|EuP}d{03W8LA8jNfcadEyaC&i_
z!>_1)5--v}tr7sl(Sy@W{X0r`|ESHq!7Z7Zebje%zY=WLh716vEi9M|r!7b4nwi9!
zcFzB&2<Y^3aO-^hkFR6Wg%gEy0(QK<85{n4^)IEymgg7+{tsjC8PwDpwsG1KQBf37
zQLs>y7U`X+2okFF5+F+NReFgHkRnKcL~5khfb^ay(yP?akzPZuseAap`(<}__uZL%
zV1|JYIrE&mT-Wt`j@mIsWy5yq+I5vqCQzdt4Da~r5Lc0{XUSt>jGKV*&FXzWPY=S_
zim=;r!UcBp9JPz?;JcUdf3xbHDUK}#@-?ud54fEDU-Z!<s_oSM_VS(Uva9TjuFXYT
z1+|BK4%h$7#O+>~^}%jE$L{^%|3v*2yOrsCR+b)k(QQ4S+&%r@3&nHOVE7?bkB7?4
z$IlgSu(M(q8^72MUC+U)C+Qa{gnAVPYkEsK<OblB;;i&LwB4JVW2AM^Q<GeFd0*c@
zHp_P^p`%+r1%6Lw&i<I+gfqZsop`XeHqFo&+eANWN%Va?y2I?;t_iN03iPWJ$8epN
z?wzHhLTS{K1q~kyS1;E5?0Es>Yv3@nZ|m9P7S+8Rs&ANNO4Psz+d&9W(*EBYAJMBP
zFALt@L%W}R?~JNyc3J(cvMLdUgC!Ou<9(~<a6RV=PJz7seqx~i7h|3BNE6H*C-Zn5
zEeM%w#9VttVtt9Yw-SrW@Lx(f48#F0uQ~B4pA6}>xoB{Y8!YJf>lWS^V(YL5IC0VA
zma$)l6H@ri$gw0UY4pS`TGh&qi<2)eC@blEO}W2Cs2XU7u~he@$kaJiP1XiEmqtMY
z4=0~&06O%pHvy3GyoZf)Iy_QjM}F$DonFwXh!JxbZrjPioEWhu7n58bhE?6mpVYS~
ze(Je;S;D5r1YdXP=lttE)ze&OpP7NT(T_?#@7(w~jLKwce~{=<<nA=4eCA!Mqxuk>
zZ+0xaW7Wbqk+)_41GCe|Qy1U=e}A3{o;%4v-sw(g)i!1NDSAU_H-N%Hlg#;R*N+gS
z4Qs{4ubM*zA*%W1nV>r)NIwG32<zTv#_%#JU*g=(Q!E!XjUw_H6zveI@J+E7eihg5
zW>N0REE-4q_L|9^C=18)MInha6AD^%`zmBTfeZ35Wn#n)6)}s<WgBDyoKpwY{!4_z
zj)d>rFH_)D<>DXT3cx`3zT1miPxU`gbTP1KG23W0xIro`pbj4Tu=$hHaO<_>pb4SY
zyQYui+pCWK{&Q8Dht~SCSD#og5Hf6}08A$p6^E=n*;iQikg<1jmcwFf0ITVQcC6R@
z{a0i|6h)vH?Kur9<5LgPnc8>=30l~MHY|lhVm}(*Pp%PMf7cSZIf1DnLvs2&_B}`K
z05-t?umF~YP&GxSR{Xxg(JZgZ;j1`Q1Z`Ej_P8IHIO3_L6~iVX?I%9!i8r0tn!fzC
zb>NyTd6wbytAjY3EWXc=*8WLlR#Kl)R=4SVJ{YJUJ%-PDIW6gYR7!0UT2!RQKX5@a
zIyl%2wqk*iGs!2GV;kw)7VUdqkcl-cqDk@SmOKmFwO6??`KF$qWu9+s_MKYGVK~{o
zts|DWI3#AjhxcGrg49|v?^XmPT2{Awn!_Jf{dCQP_YK#0gxZ77+L%H%JbkOJI`wNy
zOT~%|dIhx}>WZ~gsUYH8G7)~{h_acTS$<Ut9mi3fKaIku)6RoZ1leFjjEai;We1;A
zxKxp~dWr=m=&91kFgS0Vk`ASh>j$7D^e{7H4pvnFzmC~E^|J?fMkzPixC?GvJw;kz
z@|9Ls{*@qf0I{ZS3C{lX9aqd7k1E?fa|6J8{q>d`U=fzl>gj_wRSEQQ{OJvM@FTAl
zxK!t)`VEhFjp#NaTtqy<VDAFU4PwW{aZ=`nVJpQ5YaR?O38+~E+^3m$wOa}Jo9MAw
zD1Ki7ep}YZTjJgFOrOBc-C{8Ze4D$zYJhoq{v_v;MF$-qO;U*xVC3^p7piqMNu~{B
z&>gD!%uyc>yfWptmNGIgy6x5+zL2UT+9#F-Z)IJIpbWZ!JGP-Hjf%ygaUQyof5Kq~
zQ$E_t!)~;0K?Vi}MZFazc<kliEWcWqC&9eq=Jqt*8Je6P*}#G#y*}-3B<#|x682zH
zTj(X7Rs_jrVNBQGsMFpT9C*PP8<5~IlwYwnjByY>|D0B4Zqm8*ZS3Ei%&om>i|40g
z?YoQDW@{we1sC~T)|qj?U50-jnv&&%Pf<f~GcH2+=GE_(vx~9P90lhbop(EY9-aH?
zGRyBaJn|mS@qzK7{3$^EHT%qZ1<0a&`Z$Xyt)MC*Ik#=Ob28nn*E1q9`RFQQ&8l9G
z$xytCYG=TU7+(INg-SoquzEGV9o0am>gUD0(NGeg#?Qi6ib3T8h{m6fN{7(_<0;O>
zz1u7Ev4Z)(uFXJMj|MHLus5u}K(#xrow%&o%7@-Z9t)Z^NNX5sTZNqLU7nd0L2*vg
zuPIfe0{1X({{5R)pZJREM`$D^Tig&~dYb(hc37Fq_avLu>|GS>k_H%r%*=A0tQ)Eg
zT&p5@>~9Vkm}&Cxe`Q;c_Flc!+v}Y^=-$~4-*a|dwF4HuRqTe&X1oqK-i3muqSi=k
z3s2c)_WC3?>Gd}E!}cLsetGfkpzdlYRoJJE{lx5jeB5!kop2^XGZ`|H(A}$v_^VrA
z+qRFidLR}w)Pn00bVP3+4OYTy$>X2tC2E38%d@%5O+1IPiaf$;D9FRs+2)9hEdCqY
z;?vuC0)oXCadJ-d2~z7twQk)AgMsk(3v+sb|7x|FUZGTWTo}WiJ6Yy|cav5Ra9Fav
z8w(9XAnR37dA01zGdF%KaK`M~Lgov(HVyVB;v+(xrkr3y)V2L=z^*~ZwYIkV+znE)
z)-dJw;f%%c(n8_{xSU~CV%<aJ=o8%OxIhT6xs!VQiSPsuYx+a7W^9)OX3T#;uYh1(
zzZKM`8T7_%$HQ!k4I3@GxOwBhociLX|I?EJaMK|GRwkKp5?Fqz+Bjsz{rX;o9w)ux
z?ji^{(x!FF{Yr9<s>q@(Ue&eEQdgpOO+K^-w##$pCu`oqpePd_)A`4!%(^b@hRb1<
ztUAI>SB`6<vBXaJZ?0Bp7x17LM!lfCx4U@wO&>t?h|$dzBZUp(PR4Z(#rFjAFX>f<
z8c$T347p$8ES*nritkP_H5d<cE8(0E`}m!Eo>10%&AaJ39lo;tLNRRtHC+w7ge3J|
z7IX^ip@2hITMv;dXC50p+BT?;x+gRE$28F;)}A%v6>Ldg^^EN_HgJLql^M6XdJ4e-
zPo9&f>@if)sHAx=2?NolzZ=3gvw8D%Aqj5Yrp+H!obf-JzglgqJqpons$h;Ede^vq
zjEUxSY*C37bBgr4f9lNt`Z2l=bS1MeY^NCFD5)o)!eSh%WJ}=y8JBknK(QTwvfAQl
zJFV|*csQ=2W!T@8+mkY0$3FRzlB<0;eH+yVT5WCXTrO`!<kDIG?l$vjrdLh>dEF|z
z-Ef}hySoJJ#ck@Cd}}6+Z{8tdrtwZce-n3@j73QEi7(;0eKVaPYz(Prr$dL$r8I5)
z-GKUDX(2vz-=N5F#qt;|VL|lX0J1wfZ?2-U)`7suV+ho$DE9Gjx!w3M?hQwhF_Q+Y
z9L5hCV-+;KZ?7a0FfHS?K3_TN#fQ(&;@smT+O#@Y)#Mf95?A$Js;H<oT<X_9TlEfO
z898%AAa)SJ3c6{FJqb%|yh=$f*u1*69{)*JSU`%lA>uRF(0j;U4zJJ3PEdiO;^Ic#
zhWCl7B-iSlw+-4ee?m2h&(+lG$*q*=euQ>H@%bXxnTJ&>i)p$oSypGQOyoxegka&`
zT3RKdrTR!co#5;)DxfR!YcsA5{;qHu=T60Co(b#e%-0k4211-I-XfEMhZj7m_VuwG
zDKecC6-aTWIZgI8?Jv_1Hikve-oCWg>O9c)33RUR9~^?1WejWI<qe>45}L$}s^Ao_
zso(c}=O4J!m|Qp#N0@q0*zc+0PPGQ<{WVSl*_d(rzsU5<Tw(fBL>-`)J@WL&Ll7k_
z9ZN2_gvA@63m1{Kdm2UwZ{)nOd^h*Q<I@MVvJJfnyo9S;;kGjr1%KoEBOWc$q$d`9
z+jBZxY=OUN$2Kr&z4|`OatF@a0?EY*>Bjqi);SuS>=0x3f0suH=)`BxW+-A0n#qdH
z$S9WJte+FaD#sP~!|tkqdP3p#WdFTotreg02c~CSR|i*$lpQrl__|&{=K*zz9(zrX
zrEXR<3F27M1gl%IW~-YD8f_H?=N5xdSyVGPK|QDaQHQz>+9PpoxFUi{!*R0%oc}ky
z+H-BVxx%qecrBnONuoCpbT?Z(Bk9;ioZ7#g`w$X=6fgnI!^vag62gbzu(5Bm<-WA;
z0C!DsvU`QiQ4w;!)~?a1Hqyf3cOJCL*}1G+V!J-kQ8UncwaUEA9kw4<+34S)ng8CB
z5PYcPKN#eVl5!X=&2oK~mLz16&EX*~ubcGOK{Q4Qe0Wnss?#I9iSZcS?^(|LlD_7n
ziw~FpSYf<HY>tly*Wz<nl#|f#gW#^|OEA-#8W;}yglwWu8$2GyIs|B8FSX_z0q0QJ
zv7~Nk_x5xc=ptRE%XE)Z6+yhnlWpecX7NyyCa}~bIU^re#QV@FqvFsS2^yu6G))Wa
z7@q{1SA(`2?Y;wZD+8P?T`5aTPM@w2YrDnc4PEhpObl3e2-n>di3OvIwJ7>jy}R$6
zks#>CScS{xje|y#fGIDT-_4AoOE?(Nls}xvmE9|Iy5LJj2@E)>n3Ap%f_ulTjsi=u
zvpGU)PQ_JQ1Qw`cs#~BW=uVY&*O3|0k=#Dr+DrKuya9B`kxSI{h~9Xc;Gk{t=lzPe
za#YA_v1yt3!hnGAhJg;)<Wc8x4><^#B;oR5$*O|3kKdddj<w=q1~*$IyfNk+$-nc%
zyneSwruGllik@$tdXjkRAqH14f7=l&3(I9nFe_N{tQnwEI_GryJW#`!$WTu#aI!bu
zv?{n4!qg=ul{fGbe?V~xVh7WK-g|04sQ%eU#l(+9`0}d=R{9oqtSY{zv8FNR3A|)`
zWjnyv`88~KNp^A=<y){^qwZT3Jb^3N`Z#-x*~0B4PALP449qkr11CPM&9z2(0`s1R
zmUe@I;?_oY?83NpF^FIM{^=~YQ2~k-b`RCJ#Y#R8*F)pB*~k}gdD!W#iQgV{z4v6j
z#fFbY4M|rv8|${5J!U7*K+OBRb893>JLvj{0B)uTx!|!x;{^Q-UkJ7)J^uY`4D%;2
z3~Lgb`B?qd%6J{rx|4Yir-EBV5vw$@;~*#t4}aF6`(E%=x5V`IhR+@K1@IVB()4AI
zI<k4|@`6r28PMH5dS!P5X6=_?A%KK=d*_AWjjJC8`e=Z?vRRI_9`XBp0>`UJ$=^<O
zgkdTd`8&|lV%ylCzG1-W8v9gWzt<hj?sDEXZ`dlQk@xXBCjo)E8}}MtG{2c|)0tN!
zSof{Gq%}HFY@Xoff3(ML#<51K3Wtm3IrJpgP}ysA#dw=LahLf$=33Ohz|PoAyu9i-
zW#+e{cL*5wxFRSeW*$53JW8Eq=M8R68OvLDSs~6nqIb(vhs|q#f7;G*dqW?o{-J5C
z)B!=VWW&mSDCRaKZ%2ERtfmnAVri>YIEo7`dZ5ze&CVS;>H^5y%RVV6_F&p?_uk=h
zhNe<$7%udl*SB%+=>{g76#uQ?xH=%c{MV_xFC^Wo+(U_yrVzbFucp^1eGAQPHQ~F|
zfFKK3Oi&O!JyJ{WX#L(L^<6kUq>|bg(hNSR6<X79F!ksU4M8|6yfM?AY;tXH^SY7q
z7Vxcr@Sn#*@{_OJtyZiNcA~|Edf;V_Z<a_w#7!PU_yL1K5_}Yfy}raeI4HlbSm%5=
zMfyQHn(Hk!<((d2sK@Z4K8ySP`#`D%j47au9$|=IKPPUJ%lARe6PM(`gFHkoUM|BH
z2%1iuWh8f#;<;7jsYe3~M7fv9Xz4K!2bW&KE!0%NuG8U&1+A?bbuafGb=5$DJhC?d
zb<yjy*4fRe6!UUyx^7Pk&#1ia{D5PXDVy0%#ZVLMjr{&YMZun-Qtog<RRgtN;3xw`
znkG{HH&{Ro@q3!hy^Auw=u$D^BB8!&T}7vbj`-W+e%oA2wfm&~U3#6WDdP|5b*>;L
z=a0~YH$M(3YE0+<U_NmkEK7>bs2mzGBhTRI*H~Eeg;-1yRLtT#5|ix$SUfEA15<eP
zVg^39aXKeDdUcCQ5XU*ZCxn6o2YcTQShfOA%17uygLGn|s8<Q+HQ#u!9k}r1A=G+L
zQ-1Mi5HD!Mbt{${8G3iZEN70FQc*SVB6|-U?y+P1xb|G<3Qk*ofntC3*7Xx_^EIJb
zs54dPHQ(+WD0mkx67XFUf!!Yl+bl3*(!xq`z#COQp~twby~6#uqSeq$o1UU#Pz@|l
zysOgAea;jA_23|hdG03F*Z{pNx{_yn_xM9sH>{v7W>ost1Q=S<j48D8LlE_%WQ>H)
zfwu}~JybJFIo9vgIfr{WX?y`(StC`x3deHPK3U2qUzgNf=gYsyBD5yO-H;vs6VWLg
zSOZ(&)%%LR{w~>6vYQ6t3{*cEsI{-v(pmvIltb@)wpyH|v>)@Ova;F<2a+lZvj=)W
zYA<zto1OTz^WZIa22~o~wQSqYkGnkh^U-{1ml_zu%FF*X2GyTGkq+`8oUe{jgt<Fc
z&s;EDF%QnQU(N<8wnpQ$<2c5`v@imPh(N&KhWMN!<+c-M2DV;*?Awl)7k+V1*<Rks
zr9+N-!HAj+|DE6*t1j-|jNr@$0+FVA42}c-J*gCh<S+B6h}f(VUHV_^)*BNw8zE~h
zCA?-=l$dX?TNSe;`){nI2b3DsP`S2stUhct<7P7hUuT88?$WCon5}Et8SHTd3O{+k
zW@d4|_>8ZeyawWWqnma4WI<@1`Jm!P1)jQ)>bE*ND0ive9AO}<Y+4AKex<6dZJ=ee
z1!3urF@X6_;<rJItzUO8=?~+KKF&2Iag)Y^jIbEGOH(nFdSVCL?S1J8z)B|+9LNBM
zZIQ|X&U~xbydw3T*4Ws*bA}pH9ex1Oi(d?T7|px9oPFyGsrb)iW|(&qo(p^z$h?-m
zoOlDC-c&i$^M?_Ptmm9FWDX4ppZzu(dazju-Mq=1dHXhg^f!=xzh05S!P`7WLU7aU
zJ_&0;nN-HLJio(~&BJ(?bB!aN^9$d_aE|0L>D5&dOiIRvN7e#LKO!Ac_J^UMx#pd;
zQ1<16fzR)6Mu~&Pab8%%fF>sL1=Z5-*J#HZ`>G`GO*zJSwQK$UYuW9uz@*Xp;JXfB
zqv9macmd`Lt|X9Y$9DO^t1q~sC=~lZrRcF5Y>ExFTq8%PiVI=i7{?!XADl5Q)?u#!
zB5C#7y=styYNMOl?^JnT<=KxNxxv5OpbSbdqg{2_>UQ!~O}w@C``8?6h)n~UU{<rm
z5(6<#^=IXT@&T*74$Ot7U59<o+AAD?z;>a8v5I|&qIggWslZAt|LNXToepo6QM1a?
z#2Ac=USQ6$5E7;AuF@3BT04}Uk0ki9LESe|Nww<%aO2jTcHYFFnMt$xs<-Sv_U532
zHhNdk9=&WU#PEK7($#xpvVkSM3Zngm2z|$4gwzmW%A7Qr>p$?^c$e^NI6Xus0e$yj
zP$`Y-Z`0M;kbdS6@SWQ01P#o;{Cedrld`zkV9@Q2N`tz-OrZrk9c0IC2JHY$ebIi|
zc3}lu6nLd7|Ngt(%yrq30s~D6m07cx$7Z9l1*HSIomMNl>X+h3)&*!xF9g@mSrJ(?
zO<+arm39SkchW|^Hfn6Du@qwULHe?849t?~!VNmM`M^t@(Vq>K7D$v0=oX{(*3LL_
zI$XZZEyPLZWjxw?4RT*MdHq<qw_w`qn*Y_g{8_)6e`DG=M+Z0g{5DFLSc?4;zR2Wv
zi4yZ|eU%yv^rPaMaBpdzmQwOVYkx4f++Qi42X^wsJjpixS4BzMVp)I>wfE;};oT>_
zf|LHrrS<(erzqi^*#=>cJf)`p)%;!^r#KZK4gyZ%M!ai@93Yq;z48UHSX&I_^m^De
ziTUS>m(Tv+Lqm%-!AmTu<37&a%+nqz|EHy>jWr0EB<GL$rz;c67D<Bp%c=U=dC~HM
z#)Yaal2z?W4FwYcinv8awh~r%>OvtWe_ls0_B(DS<Z&KPUg-~d7DoA_+!M+{gK&6d
z7RatOn)V4kTA;#CY}AIGTFZurCU&Jm#hGscq5h1pt7D9Mkk`$ZCv|<T*o>x>U>B3l
zs7i`AD8*kDtlx4hMy9KhOyCsG9QvnY`r1;qvrXfZg+^r+i8@x{DOOTKlk&u65u=ce
z=QJbO9vWEZ&O8f@K>9Pl@>dc3KqFM7>HJroyk8vM#z0=?a@KyESL?IFBv(6#<Z3u-
z`lQ9$a&N#bU;Cq=RA%Q=f;PhZ0Lc2+KGBgsz~`Gsa<h(DLzHGFpb6%ghAWFVketU&
zm5%%Q(%!>L?zCcf!@`i`UOl{ox1F!nuCBIl$|72Br6-p2Vqi?clCI}Vn1%x)#I(5D
zp+D3)ymiO`#=&#{E}ZOIHJ~w0Ds|z~S_U$UJ7~`+P{W=qntw*KjboQyX1FQofx<yt
zX1cz-oeBz^e|7i)a+TE{8eZdEth|E<00m*zZl&?b23f*-|N5N{C*dnpRWn@&n4XYD
zI_KVUwV3ZK<~Ms>eu~g#P)NLKvAqSHH~=H35sP?3a_>Yqrv*A_cUP3^ri`UI4`g?5
zb(j;4T7?0QKoI>CIqFWQ%Y-VZVNnB>$&SfMA{s=qn_5X#V7I08P+CdD$AebqJ^5GX
ztW~qevIx;k{`eYv_fG~l^(ek3O{sODx!=O($zSJPJIdtsEpbj7t-QzKHS!@ns2tTg
zHHa!#)B6-+*Z-O;iJQw5K&H3}#~8GzJfYeOpL}^-_Ub^YS&w4xST;kp_kOs5DkE#Z
ztvPzSq9CoA-(iuQb1O8!Bbf7-ZNij8Ilox`LC%5us1@!|)oe9Tq2h-?<uXXMD<wUL
zPZ!zezFWnq$=#ZT&wrT6ool<(7J_)m*5jc^d3i%cpijLuk7~QktJ^S8T6jryET)Nt
zsN!k<-1ZM7^-3$ceDi0jmm<lpOXyXn$=)8MHJ|_1u%>xZVR4XaKcv;4svA{fhVUCw
z;vcppi6xNEsof5J%Ym3H2;&&`yxiB5kKvEc5*DLZ9;$jbkhSMrvk)!s_9UER>6I!{
z#psK#yBc%6T^-PinDm~rLIhykepiM+y&9PFK&qeE!T!H1mOIRVMENA)dAu+Gq$cGI
zFb5oWmDTd1j|0zg^0%wb<?rEM29<!7%=k&LU4O-^kW=j+qZ|06U_BkBZ>Y^4Dm9j!
z0wfu|_?U5PO!0ZDm6OWkQuSPPOw+e}vupcE3&krC*v>I3n?CD7!&51CJ%a?xc45Tc
zn@g95;ekd)POBq(S;vpHZgspq^*a9MN;HSgkGrC4q<2g`fS;%f_v6YYZA&4VnB|u4
zho~QVqTL2L(2T~P>ttS0RaMV@ZN=cA`MY*wEUDgIM|5LQ_*uoTPUPkQDgtGO)PLAM
z46gZ#E`D8OyY+AKWx_(+txdJ8%&zU8Q~|@un_T=Uy!7{=E&}wbPk{K0#%#gD=uHLQ
zRrCxq?>O1mtbP+q0?m@F3SbF=IBtl0B7aVjAdhEL44qB+A^Odz0L|P;SHdv>n6x@U
zvALe4J;Iz|&Ae<0*J;rRnjwvO^Yx6y*0tY6TZnDU$CDI;|4x`qxs=x3j&d8l`CEZN
z8s&7;&9Fi2khkaN4d12^_1_BPq^(cUlaxbnaz(>W@bL6s7$W@1B5iDBB|W4(o>TC%
z&$K5#P+m&4Qy~lUiu1Y#DyE<CKMA)#mGQF{6#8+zTfor_&y+!+dm8_~^#b!~&g?y+
zNA9y5vpM7+9nLAz5N!i{s;;7qqkSHK#akWZz|K>xhouqa!YRC&hNT)l;I-lk4tDs%
ze1$`D?^$*pb(Xt=oy;K%GXbMM`?G;BXBI9(E?w#TvvB1PDRdWlPyRA9Y_JDdK^ZJ?
ztf9Bn+hA#Mp6$MEC?eM2Yb{Zw_%rhX$PO+ozguM)aFLYr-L|y<?Z>cvP;&I@Q9I>O
zj#Hd9kFOb$+|TH67}ko8SrD66YmQbk)2#ylO1a9nT0idlH4`wVk4oNrZ2EXUScBPD
z_j<2u(H9%OMuB9y=EXe`rMA+qP~K!WS|icyEo8$%mSq_4;~vK8WIv6;ZojZ)eQVMq
z9-SSxuq2;#%bH;KC!~1BK+9ijTLJBe)VAuM$CxTo^3qA6N0w}wrMQ{xn=}9DIG-3v
zpmhaQhwOb7-SV;zMf|^3t00{T6H<%8GS1P+y>8~57o<ybCbzufL|UTi8hI>ln`I%6
zM6LJ4<b@<}FDay6@@;EzQPG;Aly<|v@GLA)&ISm>Ay?V|y(QlSF(hymz2O;wjA{JS
z`%fS5pN;?wKI@EK8G-PYD7LbDyCxq2)|xEpT5mo}@2@<2$?FCH`8qx%lFzr`=iZ;>
zM$cN#31TUyiC$GlP`3+VBmzRy=FR$<d5HlqLYAsd2-dCtgR!hdbUThupGcM@!XcSq
zsxJc+Z`E3BX=1JNglO)#x7=ADuG4Zp?9*%J`+3r7s1S>_B$dZ~C`{#OXOF9zF-!jA
zW6lTySNp?}7Ykow9s%s83ww+zB4B$Ce&6S?a)(C56lmfyl=e_Q>vj5qSTmo2|BT%J
zE+8=k3ZwFemQ}SeIsUXWLRlu6_=QGDCvW1X#Nh!i52wuws&Ah}(Xm$-lbS(Z?vw9o
ziuj?nXWQLY7D7tKniW}7=9nEDtwld*pneR@$Ip{*_xMr%i`*_)y(_}-8YWR3*p`w#
zYR3b1)#nz&Bdk`GAgO)xGHb0&M*8YQ8M-q~JT+g0^{ay`mtsqzzBM5)Rhk&)jr~0b
z$^4rst}c9$Ij&Gjuc~&f$e)rnQ`o6%kJek@HA`1VF6MV+uj;Cz1Y=4t@&1)=F4*I!
zsy~^<_E6^01Z1eVec-@uaB##+fo1OK>ETk&zPuc&hNg|9rt+Bt?yO}N_sB_|ULL9Y
ztWkbWMFe&u=gnBn^sIitZ(IU;4FY(5oun%yJ>c}LaY?C=Y=f>LgLzd}GwAM>!&+Pm
zqk3}k#)A*(m)d!aQ?}%dS%wD=iUzatw0WV%Sf6c8v7H-ru#s0zz2apb9L4SMpZy6o
z>J~uVNxNrHnmLNC4&INHD96pP0Of{lxVPm&h?Ze7w+F`o&#~0Hf_s2CopDZnkRe`(
zbG?}N4rOmZvm|_eebl2Ll2N;7r1IfuldM#Bct@kZUg)E;Zk-W*!N}dPM}Me0xBq`s
zmFpk=lj{~lvN@kC2KA*<ttzcpxO+RlX?NVwS~Q)E?@g&PWO^R17?u;*B7E1AKAl^a
z|3qJK8gJQOnN$yfR#4YK%dL@7Ob^HrB1YK9<3|KmB6R`7$$z}ibPmsxO3v|Dh<n?p
zzS#gI|7y=(9eEY^u>TTM)udkzz$ppA>7q2k%#u~W=Y7;|j{rqBaOYV7qmh@OoC~$|
zU-h#%9qTOAqZ^8e&r8p}Ci)p6m6>g|FR4PBFA*~G_j7Bbrd-ym%U>wv{`wJq&a|8(
z5A)+kaFUF7k-^7)9SB$Q7S-N60&YB86qA)In#akC9gSDGl>9_%Ik01H$ass${fiHi
z`>jFF?&W%&8gUx{XVfjB{oC<Fm9a_t17z+xZEZ_f+L>3mg*w-<_OLP=+Wii-SPCY#
zLv3`umuzghSL@)i7q0sjHx3{S52pNovX$afr|7z<d}S^=e%q_p(|-<VA@4G5!uW%-
zE-@uO&J6QGnR#Jxm`WE(9zyFXs=d>}w1ZF+{*%2llz-pzd*W9TxvY3%(tCPoeA*k=
zF!?r={nq&I;dJMYZY*`VQ|*IIHh;Xes=nP0T5yw-c^=%I>@*YGD_WybmDw0P6I*Ej
z3Ah#|4A<g{N$Up*;6G<<&r$!454=Q0G$7(Q<=SM8DLa?$y{gvJb}`8}%l&13^m*SY
zXec!`U=}T;dDKG(H+Q}kEKvZ93ACq`@|EALzJ}XTQH%);rN5pQ7}{Y1Az>0<s0?Cf
zB#e;tNrDr(Ubmjec}BLf&T!q&-R|^>WG#J?YFpECM=xYYJV|9xw>jB0sB<@sGbjv`
zee4?7#JBRv1%%N>>HmZD;*LLP8bhAUt!PKgwP<YJ&FIWE-6DxJ3tM&dr;ZH_m5Syb
zXrfqv!>)IMfy6q7{tDJ<Uom%C(OZG#o->@%d|2Nf#55Y%CL-U*6R&)SsBYzDL#gzI
z*4w%zOUA3_waz-;v8jj+XI|lL6i9+4P8$N%2U3??7<5dnbXDbw(WaPLq@w*HzeKVg
zr|fReaW{DsyHy3d#`jnZqSbKU2Izy!ML{e33l!Hk>k^}s*Bg&0!dwOKjmg^I<U=kV
zR>b-suAm*g@^;H~*G*CD0kj5XbwNkG{43e(`^D+iH|47==bQpJe0SPu1>YXEUI>pF
z!%4n<k~Wcb#7*d&#YKT5Wn#|EJP^W$L~n;g>7YZ`rMk#}dR|@n-bdCKrDg)pfwz>g
z<2N0ttsC7v4*tb8yRzd};X5Ae%Iy|hZT#DV=is-;`CjI)VnO1=K{rtUOnq3Vf^kPv
z>6>mxQ~C{X#wM37V2eG~2A}GJ24^WoppGrm0g_eqRl<13fbFCUp8*DmdatFe8@;h3
zj0=YzIZz#e?k}=oYlr@<1*eqKjSJdIf=Rnab2QgZRPj%pZK_0Rc^?Q~QwFXSpKZL$
zQ9Ai(JS&a&nYQPPV#Zb$-e-nTWaPga8ru0<#@0)O+VF$;Cu^VWZ%`HA{4lX3+!1V-
zAM>pf#LI`FhEywaKBzHUu?X@<CiQbB?+>rd40$YeC9L)GknDUo-TEW=PD)XPjKS~F
zlPE<4fC*VZ6qQE<L!Vb++|99P?j~dPZ?n*#SWC|4M-#vUmc=-Wo7jJ>AV%|YuS9rF
z9!z?>80|Q-N_Z?X0)8plhMvq`{ixrUhSXwP9S&Vsp)Et}9dqVXd{ZO+jTV)Ukj}{L
zMy%oFPcx>v$d0^Ey<klq$CW3|dd!f$)O<hdrIriW{3YH}5rN*}s`+C;tY`w3$G82Y
zEy^nQGiQp>9x3=z*NKo|;Qtr2ArbrQ#&WQGKrM-Pl6O>t_!kwX?(>W;zBDS*DZ#5R
zZ3Aqc?J(XGA}5ryU8Xizh^Jmte8PQ_rx3ONY3fljT&~Dg1gy26C^@QegIPy4E!fjz
zhS}^!P?0+S#nx+MX_XvN;4r8m$jCa7VU1_IpfIRNDsN)~3M(b>t$ynMFkEm|&@a%m
z`P=K?s^dfIHzMoat#Ec)2Hn{89l>4Oov+u`)z^vY64TUj5eej6*ZdNw;E}l>FZaK>
zyiQ%5=R2d-h@hBv_}R50To*(RJyNRHR@3TpbDO%8a3clE?+6d`nfHGR7}Yk$$79@T
z?<QmaY1-s=b~nP9#u{|y1fE>iiwE-LtnIaz`;M2QBTN0RMBj8iXe_8_Qm+lv`*w7K
zGy)W<yL{JHIybd4f;QukYPVnZUO_DsNWWXYPbnwnHLU9<y!|^2^{u$RqSQkT?RZks
zA7ip1k#~!izbTv<`@H7GLH4PCu)j$UKimukJ!h2MGH{OlD&gfYTm%`3_Q>M0I#CY2
zOzYbEz4}vo9lvg{bAWjH<2cj8g4AwzdX4T2V=pgUgEDD!l+7|%fjG$Zm&}AWh0NT?
z7CUeO*qwC4(fQq8Y$S7l-@*DukL;Q*KI4`5v_@XJ+fe*m!@VO`WJy2r-*w(%!&2pZ
zTH2XVgKx?LzCdY_{+!&QW}FLsuc>$-1E<PLEKs5w?BmA1I%kii@7@{nK6*Gj#u)FU
z8=syrmg$^FLY=#08E#XbiH=JuRqGEbCoaL1ce+gvS6&%4V(Mhp3I|LijIvd_jZi9e
ztN8_w3ITG2ic)CnAzz$jse|J4e5dis?Fi>-<<)3GOqQyn9qk2)L)7+1?qkA??ohi+
z$@I&EzJ^y4RWl)MFY`tHp0flf!0DOa=wsA)T$)tF=qt6jtID~&BuSwhlj;&vi!O2}
z@yX?%k3`}Ubl<Kp=~)9eUkJFt#TH&mt>tE1-JjF4y6;4T(fm{q57AMBe+Mscz3txs
zYRoFZIuI<QZyw?F?9vOeZr|!_t#Xxp!ImXh>D^>Oh8(Ev^n+JNFV7ii_mIJlX6_5&
z+7IOJ3S%c!VD1*@TelF=GZk|!(Fjh%g+5W5B|pdGaNZ0-l+|OMPWh-SH<y&Y)+%pB
zZVeHQj$en1-1KRpD|#JuX%Wl{&jUx*2AJr}Am3I4tAtIZRH=vhBkfjj@u1zRFL=RW
z?(*^Y15h$;M6;twQ?{u8%ZAkeH4$BCq{FT93{R3o?ve7xQufE!)1OA3uOrNca6D3#
zys(=c_@zcB?Xw7!2`5UgT($bxFIYBd-g6E1#s4mkj+d4Zr5Z<H_xd#mSBR+Lc;W%_
zvO7BZeVcvt@sm16is(F-K<`Q@eceUM)MD?LL30yhwq@7@#P`Wky@JT4FY^>nDm#UA
zV*^t)wLLlQT<0`V(n=XCAls2V7JED-OyFf82H$i}pN()*wgJR{CZOps_94ML_j1<V
zyzr0ML~{GTwr4`xYw-q+Oz*Xi?0s!vF)7Mwh#gnz;iNandt`>LwccSL#v0tsqjUE*
zI25wm(g_qSBR(-4^H;DGm}<z@ClC?%S`ha*{O@Uw^^9b=xC4;1d3X+3K)#r*|Nb0c
zpF3w>Jo6t#J^RneJqy@}r;7iqZTSt%c<$Pq1j|}BfeSujx&{AzU6wjUYh$CeL4&yz
zmqVq3<+ai*LcMl`3n~)SQ`QZN1>N{K^Pa_qi7(^JjGaPMm~MltKk4sr)VFr*$OCPE
z?0m!^gTsUO;g$XyzP|!@+Lx$^|A=X2-S@o#+pY480g0V0-G9t{2zznn3KWK)yiZ%n
ziFSoLRamuHy`6nl88qIhfp#?ylkET4a5T^o0-5arG&5wMv**=v#tg0pYOoiJja3t>
z(>E*s8=64%Tj2)rf2ln2X^otrk*vAyn3<bA1)geL`^rX=bla+sh7XSVps-?O@P27`
zikVIdCO5Z@hnTApGv%VDa-P5Z!|U$mF)T35D4w5lfcpR}%Q`^&9SkQ20sh<c$D)1k
zDd#$L%}EYdP$IePYjL(AoV;zbG3C#(cldW94!Fi?Ek0g+<OiDnNwq`BnK)kaN!LFD
zRAarLT4aZ^V8dYX9}ws&tu_wDtq{cl&)PKbDfXUDdC2=Z`dBA1GPm6~P2EmTPiY4d
z{<e8=iIed-^ZR>?E}pWtrZFjYyJ?u<xl7xf%EOn5IUZ>qh<X0H9J9o7l8NMnZY0St
z;a&(cZ=E=*JA{&dl|x^@mwbQJ`t8g^Z_0jbJ!REBc(Tqrp0mMx)cg9vPt!>x^nfum
zKJ8{)w}HoGPAN5b*W@0!r0Hoz4WCtB-3G$-mNWCHrB6!WaL}+Q%V%-f6Mn<5_o7~D
z=->m);gvP6&c>io?QiW;h5whTreI2Zt8USj3GqIfZ+*HkBKcyR!S`YL=zRS=Z^4yU
zW3nqE2I3VzO>Tu!Tx_F6)kZ)4e;by8-#)`WeEr%)yHXzp?9$>|{8yZ}RCnI_7VYZe
zoI4FvUi39KW|>*#c`RME%Zf2huTesT0jR!}p?KhxKP&C&h?dKcZ^<AZafi8o%D=VD
zLVYpiN>WA!)NNuPhnWL{o7YlDKP0;=4a8j+p%RTPWN?F109-hnJcq`1D_=MNabgvp
ze3X|Na@6dW4&&1=e0PuQfs)43_o{a^g@wo)aMJV%zj!z7ycU?LgDqclmRYe7ZFl|@
z`rO+~s_t{XyNh+;OoZ+UP`w2fm}O8;-&$oq)S+e-+ay^?v-iusn^EaKqquam&{0_b
z)3v025WNgrC83&k%uOT&;D;&in7;6SO7<Ju6mH4cEt75ObcOKIEGtp^ulo*Or2-Mw
zp9?J8px5%pFPW@1!WKt(81DMIM&h0n+crc9%1dO>4wdg=3X;0ZW?U{Y$oJVzFe3{4
z<u~BDUGHYYXauj3?WNlX7Dtb-J=h4J`FNhe@^+n>8?A8SrXe|EuB6oQ?NU#XA;Jkj
zGhsAujr*eRO}MpQ>D`L{AKcE`BP?xP<pqM<-H66K{XZk-P0n}Ya9ZHRgY-s=g>3%V
zat;AFVMt=)1SPhXBD7;E;rb7`Eh$f39*}%uhlUXru7b%wZlRKNKsddX`Aa4Ea)de)
z9gn?=72=c|Mw3(91b~{W<$&Tb@G)9{sqkhJgw_?}lDl5gTO3mT=%xCfE%;H|t4Sbb
z`LER@l9Q9beMzW=F<&hs?8)wufb!SFo41QOb=xQaaP|S@=y(tf*1q{17!X~RXeuwS
z=j#>do71?`_q;F$DdFqln9JD&&F}YBZwo%&gCtnAM7aa|zy9R%Vu}c9P{`gq%%Jqr
z(IeE0&M`3uxuC@P>?6~Mok9DAafyxTey&c-Ff3cWi;_71C6jwH#2wcl5rTZ^i|}%e
z?g&EGW*&9z`0(RrQ190q)g7bPX572Eom+O`oO)V}|Gy7y)_Q#l-aPk~dZ8rEFHA#h
z>6f#{sdVIydjVTitZeeM;{o%mr1)!F$gnD}NW!$$jyg9k3c~f-o~A&Gi)ya6eK7$j
zja%5nNJd~j{x>Kw$bvY~GNP$8w+vR62R6{o&+@P}2Qf{;w)IFQ)!7u{_#@id36eTG
zBX6|L4h*vDj}DVi_X1NTTk$%cl|Uffz9Q0BHM;88;pDnuFU<^Dq&p;%Bw?Dr8>0Ks
zz<A|xxPf#~1KRo3J<sps4x4gwe!$YF(to{=Cvf!N=X3+ZUY?fA5pf<bCSs3*>vfDM
zCLMA}<;?F<$oak^)4KU&Z#KAKUEAKYnquuvkmUUq@LhvK-MB=K=31NL)G78x(zs7!
zkb_MAi#(DkXUJXubs-_ps%#>~A!XYDc0F&e-Ph?*D*;8z97Oeednq!f_*J#VTdQ7<
zvxP@jlwnRmGBq=Bd4AkOsnW+m<zv2lZdgW1sa`&MVd?ndG>4P-o*w>aA;_~3SOui6
z4M36V>O;^<$C|pu)isN#%gob}n&n^TJ**_DZGssjNZB?yco%W-sN+xdx0Ys~n*qOG
zIo@ADkI)6h@D*9_@cmClD0|z=oe{W*>T3+gPw0B3&=_X><ff>Tz2twFjwyHrokFcw
zf2X`>Ji2CZN4RLdq7m^ugygpIkY=6(WO3w6lzWG~pjh+x$2xI-3pY%!7IBZ?G`iYs
z_TGW==c-H_AQT_$G}?b9^}?q-0P2MO#JXGSy*aNbUphEBfnVqVg`3#am9zNHf4ZVi
zX^k}hDNn~n`Qv~B^*q`v7xYCe=ArJzzq|Q{86eonzC@RKKEWo{!}u^=S3BBFr;jE7
zOzxd-JH%fRn;uz+Wa5%u%!{luG{iU(sw#E|t2>19Aqw}3>!|;=Fco)d`Z7n6MDZK(
zUQ(kS(}4RElke&6w{BWPOCjQ;x@SI5F`s^(dGVrh4DXM0!=LZ9<IJe(OwzojHx**i
ze`ue}yr@ifUhCPj2k(?m_m@4X8%-ql)@-Ku9(FrGr^W;8j<0eE%XrvqOdL;n1bI&Z
zO4t7B(@025PkY7iztc(jDk9y<096C=#O9+vfRLWNB0-)S|D4L^Vxj44Bp&P&=!Nsc
zbX#63a0!?zkk^UY&)C2#emWl|y91r=Bof~GwLGD?Z@)h)zd0U2B6!!($V<%dNa_vi
zZ-1TYQin6FV!74#U?vVmY1jdaQUSna^!{9~?1GbxCVk5-a8UiZHBaKNkNz9S1z@hO
zGdIWH2gUgJL%`Qyd0rruAN@;~cb=xC0zCVdKO$4>DF@@kyx)7BOFXGQV|Lk`rcAd#
zS`r25YfGCY*Gk+-CH{Dex<At8GTlX)w}nI{Z8FcnfMi`4U?vlnhbHW+e{YA3r~QWA
znWzjncIQy`syb(4=T-JpB(4ICy-HAb`lkw$Zlhxy9vqaUydWVge|=6pj4!@BOL|sT
zM}Gb>;l$4bGnHj%C2eYY8<+@*)eZ)c2n(BOH8t&W$MYiC>A~q%$kux+bRX$&p<@Ro
zD{IKc8er9~V6Qf8a!|MYohLo<+v7ydHe(za9~8Jhgl`^JQsGX#((fpc+ReGAUJ-3!
zmDmKxu9I}llvM-#(b}3A!1&hW_?Zn~V=@zQK1}OwE=Ebp>`s4cKqiW>P6Ik@IAf4V
z1HH(qt*?QTxTApyTRD4OPPH7XG|<tQ<qYL`I^gn@4D_$MITXu{2Hw}X=!`vXoy-9@
zROpcUx#~fLh`A`44)iW@%|)u4H|w`bZBwyMZlIrrCYiI`*NG;9^ZkCVIcOppBr$dL
zN&=b<{8dlqX4kf+t;^(XhDJ4sj_ogxuq$UX0Z&ZA<EMt8+f`MsZRV_on*zv}QecJH
zs!B`fl7oV+h3Wnu^XLa1|A5Wlt~%b1%X3w<0tGPeB=3OBw|<=!dm|zg3|-!I!*uIq
zd+zBz!l28e0DFsCwuMQr!zMt&dyw$w&V|oP_TxtPPo2K_?9`cS?@yikfBNy6)D7ix
z{OzoYRMe;8{v)p<%J!VfPfP;4JmN<dGh$RBCwO3G#;<Hy)K&UkvURXwU`5GJ!SMsZ
z>*fzDyvite6ORlvJo5V;K7*upi9D4436M6<ilxo7eghAh+lzSV(98Eb&Y-4e+!LQN
zae8OLY$_;jZH;v#G3%K~W)td$rpmeVDPjvBUk<Z${^VRbRveC&Cw{KmoT8(!_Gn%B
zW~umgF~euFGUcGTW)M}-aOX8Zg9jh#td7=<4v(&`(SwpY9-E;rKvU3Nw=D4ZH$s$;
zqFCGPD8Q08JszuZ-lx)1zU2LfqmoL3NVhVar0DbccEvmNg$KzgUFDhW7W^Kc!170}
zbkz{<V#(g&VR3K$YbH075eG{EQs`ef#fvIXHL;iqr-JQTms_ZG>vLW=paZ{3@^s)y
zTI?G~MdvOCtXm{yAEQQbjD|li^R>q!&n55_rY0A9k4@d<KMfz7lBoO3a>ekkqY5$W
z=u(Nm75DyA-%KJZHOoF9UpDZ1&EoImvbhx?cH^sn){m&Ww7&|`wR8)rM<x+wJc-hL
zxv)?B{BxR>9tKdSbV~{8-;?lZg()7wtt%t_@3W4WmM}&q9HsQ5xAJX(Odqr=l5NUs
zH2*H_qd0<aV|k;4uh@&_TD(@+`fITCqucAY#Kh~5AN<y{c6s~jIoZz(yYjaBp7m76
zFmU`lxIRT_6dZ<}`=U-!Kb@qm(Y&&TAay6EDIP$51?4Vpww6iG&FhA+NJ$MQiIl62
z<sIhudCZ(gz5GxR#*jrTcrF7b_O;8aqIXE0lZTM|(1$X*#F#vRVh3cHhL_Ei>KJiD
z_;N!2Z@KLoS6a%t%=1_>X$yqDGiI?~%m)s}GL~Ka{Mz|>$4KS6*uyk0zYjkLyPh2*
zAIHAl`H}G4n%gBpxY=%mosbjYrL|0s#G?4$7}K<Cz)r=(DGu9#AftJuX!iK*g6)GW
z8^bZJmMlv8T-{ozQ@Wc@k1VL5=rdu@;>&XB@d}4~<O904Tf%nxkd4(h<kzMLW676)
zGOSgoDJ0(0JZmLVuK&?>cV#Q^kk&0nROWpzTdb6?J{-MA**52YJULeW`@&kCMU-4)
zccN6Mm2D<F=VAIBwYWAtM#!{nnJrLUnfNL~)?-;Dc<fbXO#50h2~CKPX<);d5MTIi
zEV;VuLP(#`IoFTpek{b)tCP>*-rRkA_jb8-Yc+Da<^miROi6JAKR;#qjCDTn^4t{f
z4p4hrrwy#&HWM}z24|M<OB*gq8y?(74n`XT#)+N@MPiO6G8X|thkE(@Nv2%T$ocNz
zu(q{tYt2R3DXxmR@SS|z3l9^f8V266Ey1ZVW+lkZMrb5>0Aq+{at3U6qi!=*LnL(>
z<vo)=ux#Q_P%kQRbE_Vw)4l87#yY_RJ`O9V9E*$Yezta{$K9$>lO|?u###PCSm#Tb
zW(QmvH&4ilOR;Y2d-mSd&e{23)It=hTD{x=a0xe@B@)C7^79=gpvJ}%`*_+^!~Src
zmfjdkikUT)d@O&96Uw&#Z)2yHP+7+*GK>rGN<EU}E6&p??mcQW5m_w6QENA5BZ~L<
z#Tfn|q0a0TdY}A?Y8FGve`J+dumx0JxZ*YNqhu3KlQ}UvM)vfvDs8{{mSJU_{8b#W
z(rDR^_m1VpungUxrk&<zl-v7a306@XU_pwBMjqU*6O~b~eoV^Kad92U>HXrx=ikke
zozV0y0T7rh8S0vgGd|5TVsxT)#J8JE^>Z6id>3h1R?Gbs{vCdO=}PS;`=xsd(07pT
z#U0?dDUEC0*K&`xM)?7xy9{@dMFB<})x}OyOu#t8iz=+kYKW_A8Ri^n?~FTK%#iQ@
zK%HyE{!9y~e%a}$wEZ>0VI|$>^Eat-^WP`Ny;1W$*%T#B-11cv{SEG;LY2hrRp3gd
zz2qTS;2X7_U#w<8#@6|Y=C0ACs0G5>qzp7i*;7S4;K#}y{d+V;H%IawwR+W8(jc-Y
zwuahnj}?<t%AxlEc-4I-Tc_01v(Hf&Z+cjFnKpR8LV;1P4O7yxs--tsG5Yi;Ptx#w
zzrwx+12QbTDcpFbUQjLRz?xT5?D0SzwcKSe+o|tO3cUTMk2S+veL<^}`!yuHi7bNB
zTuB;XhfCn;M*|0t_s}=7!5e&qIXpp#Zf>!*lgW4|0quSa_nF+<OpQ9<v4z4VCyG1g
zGv4)`uX?!&l-O%kn@?r5>bu6`qG4&fw5`x_&L3;wDZGZ{%yRj5MO~l^A*^_}B8?}=
zFkI-RlgX#?uIzpGK|xW~k;dS!Q`w$f$19qeyB6WdrGc>ktI_omzB_rnc8T|dO}s{C
z1~wvKvVU#<vOT_YyAq9i@V}MF>$$cLn<jZBLOYav+H4oCk=sJ%SoKdNCAf#r?05$$
zPOohj2ddI1K5-8j9zKdxHT^Kkds<U~sqOD*O{0ze9dJ;20VWSg5-=kzb|>+`{u+>e
zoJ%RnF$>Cq<x*Q(l+byvaB&4O2g{=N{S3au-|gk93<$j4;nE-;za%FQ!>ytYJ1lJp
zuiJ-(YTx)XOlleyCA=`^TF&xXevN-(RH~%<I>fr71E0D@{(DtSSv6-Z9|;m+Yl+-G
z4cr~D(^+AvX2!s&^D61wjb+xtxz^|#q=K-GSD!4nHSVJO;2qw5jf&V_{f=`#GL#_J
zk+K9a`8(gT4l+GLq7aUEwn+nPD|?^B#46;I)azx(E7^+^Jm0BE2yn>PYpjdnDEtUe
z6qGaL6L1x$hOqOM+u8|zL2DcYT<u#=qwyq+Tn!O=+?6B&8ynpi&(}H4%OGQx^Fo(u
zuUTdtxV)*DV|bbLr%1x0h2J~D>Qd=tL+zM&5NwLq$ccrtGMAWygp9vp&><Kc2dhi$
zJr`N!M?D$e^Oj1ay!37Em4FWj57Bi`SyEEg{OrN@41Yea?JTHkdw-g+aZ)1f5x;(o
z2nZZvx+bY{G_o)DRB+~#{i_w};sl83*{^1>9PhhA=AV;Mvp2x<Sj<v^dY+~(#I@@d
zy-y)xZK)Q0blf}vWPTh90`Xs5hVjvD)v&r$qNS=s1c*aEzz4NA=HnF_ZCcDHyBNm4
zCYdEKWgkbhA|4I$666k(VMmum<Q)d0HIWvBJxr9Wxv;Sf_x6J<zk=T!lQltPKmFp3
z%`mhrcQSA%Ma`Y<$?N9OI}>BfR}%=zZa;$to)wl@a4DFxfIGdgQD?_`)o16V<IU6D
zD!nJP34~Qj4}jCx+?3EJyS!7#M(4xP-p-|)ilJhEkiyIMl;&EFD^UQRBQ5gNy{V1W
zkSjO33ws@G4w7~BjJSw@zgeS<r^&~=^HMMOD;qUQ_PzA0t@(EO`)^5Ne{1vdAaVNd
zbhCe6Cdi_%Iy_x_VOKX6S~~EaYpx2gj1|8fC2M^8x$n!JHokA(sxUAX+db8I;N|6Y
zv?Ly=KP2t`H6sldyu_N1-q|3r1q`6i{yQBVM}0>*W&{{1+FqZo&Ycj3ejU9<^Ibr)
z|8+TAHhs&R4vFrA?XmVkWO?E{eV~GbXRLjS@2;D6VP2hm_y-Zxmk|*pCGYYZ@mL3v
zrM8rv5G49dQN{>Y-QRphcx-_IB=-uphgXbFkqnBXm3D0Y<GA?j%`c|Epd9#4tOtd)
zn~tL%hvw!961h`&(n;=0e-r<zL4H>G;BW7_po6l`Kx@7f_f^9Lci!>z+oq!aQH+MA
zdGn?B+OVe;-(xvmPbymcFE5N!=fYp!zy6c+w>%YfUOSKT-_~z%r4zor7Wdbeix;0a
zd52Zv_!p-G4Euj@_TJ%aM*rV<TSZmTYE@BmP*t;LYo)46QL3u8P`g&Gm`RGFYSrGO
zRaDj9Ge%J}cC45sR_qXoB+sp%@qDk}_5D51=lfjekGQUg+|GUObKc`Muo>|#|Iz}e
zq!Ei?mz<8cR>bza4Efwx^N^436tj9LUK`{m?|<3}%*p)m!BX#@Uk6*CvCE0<DNb5n
zODuR)?V?Ve?-nU}Q^a$Y^*IZq`82Txxml+(R@=2h5v&6>W0iFBlV+GckQ+5~kNvQf
zzh0%ts!Nq<IUn*%%RO9LcIax}``xBhQ#}jotluPvp%+R)c+=L1rP-KiaQ+&n8HriB
z!FO_3i*6ELsKH5?w0Fh}YzXSya{~BByA5K~&dBIqBPNPa<5pC(9Y=_*te@LU$fnj^
zMPhH%_gO0L7j;9d2Vv0d+5jYrDW|%a!hSxy%TcswTdudJ#Z5PJjS*QWr*~%-DMsFJ
z!?)ES-J&R7JvE&*ofrcJBx4M+TuyHpUStV`JvP(Ga9>5~-SwxSZMGL|2{COp6+;`(
z)DwjgSD(p16Ijq=%HsTXr<9(1<ZwKElQbKtxxfUhfPsr%8>M;EjfV;^wqYIJubxOn
zyle@4c<K!4(H!Y8uU?=i$#A<{rYhZ~;~7k?B7oMd`TdPYvrHeIzDEE5<xc<3sFd%#
zxY?p0!23e&R{jutF#3Q#(Kz}QHB#V}$kI`58?D08F*ET6(Q7q_Qm4Z0-3r}q31QoP
z;JusTghE4HjT}n7t)DXQ7rfuJ07DBw;+A#QwA^058h1L36wXOYtlYO?pJoJH;vjJp
zdwY9{L9I}t2u{6zALIWLP|*GfAN$EPO$8^V?vtk2ptCoi6t>kvtS7#LL+WSMFH+On
z-6%1&xas1#DOBAj7&S6_T$;eocxg3V&hi_PcCm@ns*p}!7vY52<M`{9?iwWkfXsn+
z6c%B(${CUJ{*im$p-6RakjVX__`{l~ls{YC9nh1(wrsK0G7xcGH+bkr;~t!|-D6A+
z2Igg8W@b}HR+dEjGbQD%o`C_~m2($V&xD5i3y?<gWD4y(JaF$DnAp+KGyBlPWEYzM
zHaGqE{9b(D+<g0UZ%N$k)|Z=|Dw9((dbzya!?*Y5P6Mj+X$Xn7e|TKqJ>0pH{y1-d
z-~Gq52S5vX4@m&4ewkhI)Y|6&wj7@~(kr4ey$}9~!Scg0zUEOWYL)72xZfD(N3zM;
zY^Sxj(Jbn^bO=1S8ghG)85l30b@GY{hU%C99}?*Qa*_Z35vp_}+Wc8jyp)ZLU+Qng
zTeP9q1?~RaKz!y?I)&&J6lHAh<gMC^nrd7E*81NuYs5K!JhUd^H!mRdq9VK~ocPZn
z5H8SuU9Ti>w~Fr{Gu{DpuWRr~A%B5?Ix_C~=f^>(I#|R6pYfIczg%ekiw`*!yv{Ut
zy60~LUk=8<(Hg&e@Bzfao_JRTD?&A3?tYE)X~^Kj(3+s%ypbm2oyFe=5qKDl-x%M^
zbD{GUER+}96#qN2%X3Bz@U7Kp83or4+5QgN=9;(!^DbK6(D{x;V<PrJH?MxDnWX{n
zV2rC=?Nr@t1-#skvyYFdPBbxlcK6inFa6ajTV_bMKhCxxpRUeu5vTvaeLP^b7u+lP
z*G(lEX6{Sq0TI^gNYGhhkm7r?O5&iEPT=3SFFd6*7nQEJ*rIah#t-L8x1I#^t{SY5
zRCvfObVv47X6|l8r*yQBZL3F>NC{U3Gx@cib1$bivH;B15291tP{*xfIlECWM~&7X
zIv^zP8!9%o8-2nK5m50W(V~4)O#mgnS|K}Z<yPHC;S|kI)Cv{hy}|_rX!D7(lg~CF
zh<2j2cOrC_OI!7nb%5Iaw27$v$6}&3_YiQS>h=G-TFk%K&wsPw#Dzb))%H^E&Ald}
z#KYvo1tQVKH|WW!s!ETVgfXdV*LJn)H%sSHgQcy3KYp+;1i!lA5+AQ*?BP+#VQ7>C
zDn=d$K|xiBX|JISLAGlpQTwVEUd^||8#=gXs^#P6Ymg7xAH+xV({Zv-%RHeBA>=&2
z!FF`t!p){d>JK?jd~(~|w5S(vESk+m1m<wr^c2EQ)??}E4z`Zu_;7Jx&=z!fJpvW8
zlZ>5^sTCo}a<pH+YEQ`@@TX9(i8oVKky~3)*s&@IYI=HYa#D6<*TfL@O0V`(TZq~z
z9o@%i0p;DR<O+id6$Obw(52HGr+u5bZ+SlArd9@zQ`HSir}dT1Gi)_&+iwUdo`Sc{
zZcFO~j$kx_yt!FKjMRGYPf5?u?9vWQ<olweKp007DR`FmoEc(VWU(y&^rD#0fTa9;
z9n^zln-+T0a6sD(D%;NksHs-=(e-!~o>qJQTnNqhO3nQFv6a8NE_2Pdr+P()>h;WD
z&(S`Z%Uii3^PVw_YUR}b;6=2?z1aqUa7WM{UYQhjH!bZ>6m*327)_p+%rjbQTYrn*
zo^Klx)BPoI_cd`5Hz|eVOX~u>F1G!n6x{z9mM{T3^6w?i{E$&&l`FfM85w%tO#$(k
zW2r<>+>G;%2;h(2ig3Mj_ZySEeDRCMxNP;6m%>|brd7BHX!pNR_HUx%PgG_Ry-S?o
zQ~y|{#?arRuE*?%j$$`&+C><AMG070e!_}$iw69Z{8Gbg=Jj#%V+^j$_<2sLi$VWS
zwc+LJI#!IJr})+C`lBA%>4s%ZXA}FV9}o{+rL-bXW49VGF<=}dDLLx&3YyOG6&qLf
z2@gFiBeA(D>cHzvTBM<j>cBs8@l5pQ0zhDT&}k1|4-5|t50hivHXf-)Hp)q#-y)C5
zcbMRdyAL{n0Dx&r>5pBi3kWNJWAWDF!VfuNMhNlb_&*t#S{3*AhueNk(SDRZU<>^H
zcZ_c>enpn>G_A1GYkmSurnx~yNmIMl%|Z^wYcevg^(zMntI5wdH>DGwoL19Tj0AO{
zbn8SMUTr~A<m47V-lKDPdrf|bR>;5{KJ9$1>o;!rw$c1)rsKAet^n0>sWU4|cKfG`
za^^pw@0>FOkFze;0ZU58=LMI~BT$?QC`oL9d!Kd@5Jg+$@p;b`_n4_fVB^OXh*ft4
z)EqpX=uL&ZzoO{9a+>sli)7aQ2tL3a9=pu2x@ZZ6wQ<R@aXmiT3B78=ys<+bA|mc}
zV>zz_B6y0rDm|=eB<;MPFJ0toDJ_y@+yBOv7&&GAlLM@m(?0l8$7Bhpcir4^Tk8B`
zObCSVJh{U7?h)U>Gxt-Rk7x%@{|{cWJZ0v@1=*g2&4vDB`t+yN6Qt^wgd8CTh_Th#
zA}?5zy%Tsf__c0L0%M~gid8nRsIHY0(f6QwwPvy+c0G8s?$Yhxqby#5yJMsm;DA$d
zm-{~f@~~>B09o|?n_~&C<sq()fPddtdA!R*;{Cr`i&7~&)4Hlm;jg|d-c`{XVA;Fs
zPA&h4X&}(QfOgFF_!_7qs*mFuYLIIGl>D^@A2ZM3%tZ{o7MN$4!J49xFQ)qwe%g<1
zYRsEu)otABI*PbkbpXkmh;LO6j28yVNVB>|2J?opELMk!+tb{RAcfnucHtTfdb%d7
zfeFm%qeSAfRQl?(4c|dY_Sc$t50S<PRhFw_)s{QV(y-PCdPX|27dl$tt~&(VgX?;_
z2CE$r+#xd`<Fcy>CB{zV#|X2;CELWMWxfhN)PoSp9B2vfawt9`#k+8$A6E|uxr-q*
zTWJ*nS4p>lkm?_UeR0x^9aVxkKIr}D84f1PtcnX7tZ22`IrcmetgMPL?qtc9Q(#Hc
zq(J7&-JsSvZ|Ppg;P2IIM2)=;u{M<P#Dv-nx2=x6V-S-x=HJrdcuu+(nNQ6{mD-tB
zyEly#ZW!^jt;7%1Vn`#jLaUJp39k?P>$mEu0ofO!s`2RvcHLPkA|QY7iEi-ToBkbr
z`$RVGDw{^_cuxp7?2iJ$HnQO7Pgf(SqaESutzZskm*R$F5d8S0Fs@KOe1KPa!UPp$
zB?>1(lI#XD{N*(V;QQQ2Xs&g*8?e;ZPLp0{08l|i$^a-ldzm3Td*!sxiwpA2ktNx0
z#-sVg4?f77YXM52d0Dhe`Lz4$-hc!(ElG(Y8hNMT%dKd0e#xX1xBbq#!a}s9u#*@F
zx1K5Yu(MBpXfs%s$)#sX?^`_1y-iH0Q2xgxtxyoowmF7In5B-gBqYQ&d9f?zrIAkh
z9)5XANa33KO34?P$@dxELcg7u9EBw1je$Kjv}pJ9G*JaUq;3TAQO)e?Kl)Xp^@E>p
zDow}nQ!r0Ys=Y@UaU?N=s@Sv3*LhCM+-nNjR3|O}<j2$>957a+A(^gVh5b3<biMC0
zZxSfSHi`8Q-IgCTV#Jp+RJ!CnbI4#5?+D*R^r4(cW3|%KOr5K#UX8Za!aNP*yJqnD
zbwOA_<{TfM?ms(J_VXC=7u2mkT&=l0+g}NS89P_AN(slG3ev1k^YyWgtv|?7cCytC
zvR@sT46D{pS8<w{JK5iU)EMS|7|x$}@A3fk@Fu-cyQuNyH0?wr;wWKinjT5%q?P!f
zc%3{ahbun6M1NJ#T^hZw0^nx_>(RD_r*D9d7yN;2uNtR#@3p9JzwzO|4zdQ&N9ZXu
zt{ocvJz|mSR2MyEm&a+W)V7jFvch22w7M^!b=@&21%%Zayh`n3=Wa6GDQ}Mimzenj
zzGGn|r@j*R3`_l?roml<Aw;4n!5*ATa^G$tPOW+q3knOL`)!=b{L<B5zHUHGY9y_L
z!59EYz_~SRla9MB{pQa{3E#faCJx@Vp`NY_>TfZCXLLFu$GDS~2ul>QcYXf6XL=<#
z`0nKd)9i5+Sa_l`B|*qTS9cV!^3_%@MvP-~ntrt<O{5mi$MjQkZ4ZP%j7n&MphML8
zF4^rYd9<2rB~N$Qw8ZG_B_5eX5RJ^DT~P$D`FnFgLeRJzw7D}NDQUgd<HqDOQ0-%u
zK>N?%-ApF9yG*NF>VHC-B+5*r-6Pfwc$<iTZ=SvjC}3$;ngY-HVAS;S@~cxihUU>y
zC#R4)Bs1>y)CZUBU$O2_+cvPy$jcg+T+1}>DXfQ|l^9Wfq@<rw0Fzw!<uXwW8t7r|
z1<%2D!g`<wX%gF|5jYeW#p$*Yea0dO@F%DT+=u14Wp7n_@84Ici;yyAY6|!^ez3DW
z%jL!-xBc$cws2ph&cVdU^hSbO)z9Gjp*OCT&$5Zz)b#|s&k5u)%NM}fvvA7_oYPkW
z70Vqj{<vXgr^cSxiXEP-Pg!H1mz0?^$4tnyOPfghm~vSc4LvH^F!nWtkN5Y8)OVlQ
z5JhmxcBBI;MAH`sM@sy3M-fHih$Ah+^zfKSm2eaE+hLRmUz0G-BOd`La+0^f6M2g-
z>o(2cC*r9-nk(x&(lGg{juUzOGRiSCrH!%;I!1OZ;_Ipj7mJZqzD6RLY@?N{byhyi
z;A|!!su_S2E*`4<myd)IGm#~h=G+H4ihi;vGTx<e!pY9g4LHt>Sez!0Uwh7%?-@Ie
zUPMi5r{&Lm?T&@(qcNLugRA@Rs=}`uVAg`i#;x~x>#@ICG|ZPe1Ty@szMU0ZeY3Q)
zs27jr;A!g>=(->t%U8V0NStIvf7n?xaocm1cAVtcJeb<rZPED4pW3hiEn2H4aMAk=
z&K08}Qxg#!(qp7WZlp3>%8wuS&=WS9^J{Bsuf3bvtBO0h;N56nB$a~MYML8tV=WkU
zBqCn_rZ`1WAj2HECp}lMjK{C9-Z#ky)7~`l@$p-kO;Ic~1)l1hJRGh{-sB-T4?VK+
zPAG<C3;6j!Xs>S{#Z;p38fgy((_w@iW~!7d(|*71Mhc+}x_=pQ>Ta+mL^+W#RAi?W
zaOxkq3e6H}dMuIfQ8<f!<xHK~*@2TYSJe4h1CkE^5Ehxq1Orve{+iwKJVrN|Z%3{}
zLTZoYQ9!V$opIw7$o&eZq~zVg$k#wfog@6FAB9@)Xzww$H&Ss&Nh2m#$OoHZdh*{|
zD~kuluE6v2uP;o>=+!iiam+UzlnxG32R|!`p%KczWWD%VDCyReOORMeZ@PHr^UNLp
zVZx6e1?aWdJ9Uy{#<$h)#5|ErP`{dLH#`$#7PwT@m_1zBIL7Xj?t$u>=r_i0ZLGXY
znYWq`P%iR5a?P8{ej4ElSSo%g`1zyTaQ3Tmgo0TP>{TO(+*dv05fOIvVPAM9*=N0G
z^iE*{uED`rxE8N=2%K^<=?WXh$qGNE9zv5Ut91kTXS^};how=D%sU7QIb?boIA*1p
zK)t$Z12Ll~z9V&jCD3fsR?}glbNzG6PY(+6>ep*q|BzP2O;mjA3ko^c?r52!pC>)I
zX%7V;ydL7YNaj?>y`|XK;J!jWs5$miaiXBf9bDD3r|I{}cnbMY5~#H@BYoQ##@sA;
z=p(ACb#lSJdjJR}Ac)?ia=-m4hvR1{w2A&!z|kJBmu*b}hg7c}rGdCfbn;dYE4C@`
zlj`y|4b!mujs=Utzu4P3vMd^|Zs|;28biFCEPFLc`V&ie7o|QBLleeH4BV;>9>kGr
zf(IAG6)q>ch4I$MOb!m1D?xpKW{8e!Q1u;5QT8_Bu3KSCGdLJup~AD8!gPoUI#b~8
zz*;3vu4@cO_8lheq_o(`cXd~$>?g;2ddi!Koq>w3D><Wr*2F1eX0>kpq)>aOx30zN
zv;4@E6vOJH<<#2AFO_74HpqAGb$7d4j!to+y}fdAWr0Bp7Tq4<<Ifc+6@<}Zn~x0D
zp$tqc9Hu%B`rZ}loIMG`@nk1AJ!3Kl>K>`750Kab?4UZQd@J#Dzc01b|0*1unshH#
z`oU_E<7i*lX#J=22R#dm(zFMP)K5GbFJ<V`u<O@-{rb}w&xQ(dViIivKaW$zJtpNB
z7V2(#G7PqNX*Z@Et$PgiE`3c-|C$`DEWUS?Um4=Da1#i%&ylY9HglDPjMN1ELoxsV
znj${h@&Ho8?j?;~Xc>56srF#XMV=o#QuC^8?OQIqemmLQY4QwR?n<E5aB1bHifnjP
z(JK>^)sAp3Ht4G3q18IjZc2`^sk>M3TP)l*tJ6TtYUEs3$+xEkiZ=jj-gu*$chQ{e
zg}Cuzzom<Z`C3phEFnt%1XIxz@^x{8iGc<`&lIIbf2Kst-npiUSmcWau#*-c-wJV)
zv!qRFv~{ZE#^IDVfP9XrKUy||Hg^NsCL5a#d#2pm7c)*ozG_6S$0cp{984X}8wUFK
z%d9`neEv*alRxo%t<y^HQ9o+YVbI40E@70LSl_xO^YToBRP1|Rqt^B10&rkxQT;*g
zU8C6a;&q^(S#vw`IG6+El(rRR<@59Go0V63JIZ-V#CfL3xJO@Tz?P^?1Q0P$fQUh%
zj~#c204-isEzz&Ji;9q*86X{F5^YLIlPJdcxfr3_z5{yzAz$k7c#q=J#yd4wHRZHO
z^{JJxzopb3Sw-BJ8uaE&Pv7hYo2FM{eHz9*02I~dxuhq=HVu74F5wg*mGbj;+o3eb
zbY25r38gU}I%8Sf$fBPVXCuWxT!$^8gHFk0Sv^a)#^D|m^6OHF3M9+Qg<DoXH%2_e
zaEAZzE7lhWA9fdaJo?3_unYiCOTH_}BF7*lj_W=I;xJ(CDQ#JTvXD+BG_j1>U{c}h
zRi=CKdZv}P5U=4fYu~r(7%YFZ4v@)LHB0#}sHj=zmK-zC`2aTL9Mk9NuF<m=ZmncT
zz2k5wDVpW10%Lb4<)j)8XX@*L8y98nVF!mBZal#%PnoOhBPzF+XDNe?_yqxo>ZH#h
z8ng}p`oNx>wIJj}w1uN%;fdK_V}dQoWG8QMK??#kN#(L@UX*Uy(LMCF)A9AaHSQ6}
zFy`6G<@>=Ib^B}bA!bm6q3ObUC9yKK42$>C6$0ySO%XDQS{FsRb|n4gvd=C+%%^}7
znm_b{9HrSAs8c}Zj)WGS7I+^Lf?!|3Xp{&buh!yRw<R53A6`!|ow!;af=}5!>;Hgt
zDp-rM?e9x@*SX0ieN9>e>MG}H1?2N?m}dzWL!W(w9(}e)aH95hslyU#BF)ySW4TDb
z`<ykYMRT08@$gmmcQQh0Lb_rM=%io=ur=Riv5DByhtul$W}o(n)fWWWZAF#OxUH!~
z#`$i1&hHU+?@5q6>am;aOo`F8`(im__f}0KG!OhM6WXseE!x%p_13|LII>H^&eLdb
z+Av1(4`3<vsp%VPF)z&{n4@U;ixsx|6-Dk~JoW^s|FKBE&b-3t%2~~$s*ZrWT!$FB
zYbIdIwL8h~Pt_qwQ9Ne9uV&8MUhaAqXD*$;ZchX}rR{k*27JjC0LZHyTfb%c^%V=V
z+~<C+bkq~M(tbhsd{829(wbINQIRRgA(Lh*?ec!e>u;xJ%|$2vm4L;B=C-A~^&^J}
znp=FvakE-5*B?4XV`R2r8`bxd&aG{J%^e@;7SSgx;)C_zGEU*-*k$#D8zw(B89tPe
z8+W^}D8WA;XX7NFC2*JDMpGKM;GK^5lFP$qi{a2hfSc}l%&*km6dc<3fdqOjCJ(en
zx)jDSyFEqSY}4PQJTojihkE5wN>?|^;md*0);%0qs4ZqDka}*#184epYA`En%a6!0
zNCNI;+#1EcxN)%YV3LEZFcLBbhBvM>xnl@1cB|tSQ5uu+6WVLX14YZvs`BYY8hTMV
z6x$aO);G>4{(`12P?h$=Mi79-qsgqb?CZP-Y4X01KdF;dfV$Dm<a_}a5`cE>M#rYT
z5&1%Y`z!ef5PO+cX5~GzU7?B9S+cImA_9Ue#FGFabVFU7HYnw5r|q`!c(DvA)fzab
zY;$waf3B4me~y~i;dZJu3HW0g{$s$bDY74uncoNDa_c>u23!nvXg~r?MCCwM<U<Sw
zy`6U!(aEjHppLp-Fq>OT46$A2q?Xtd9PBmsXuB0DKbYyRIf3oLGfWd`*P%<OApcqC
z>C6b<BX`F+0xwCOvKHdE&qnD#@NTRoyf-n|%PA?CndHTYZ{7!nxI(<OUx2+`jhNH@
zzvD~siv2@aQLAuik86c`Myi*Snw<2}1@!|f=QE!ilcT?ly^dM0nTbQDqipktIO(nQ
z_$rgNh*>PcdXo1}q}KCGtccl-mMi(gSg)SuuPy8;&s4?F+kFnUI-Byq<*V$`9}ANE
zJHpa;%~(j-S?ZMvg9Lt6s#FQpr{W)1MszwkJ>xWdD{?6@CV^an=gf;6A)Y|n@!{;b
z`liae(_<T&#Z3owBZ$(1#9rY#+vRi+X$R6}yjwO)F0&*~!0NS*5V*`vo`HGO+5{ou
zW_98ewA#dPJJ?Egung&E?du8jG@mFwh4^_v(X32&22Q2RAB^`o)-EmE4JR$h%&rX!
zs<0n_bC7udlnrG!kdXFW&atbS^cO70?e~lO?Zgj<$$A^WfhbjSoeF@Y!n#m-Y(-r0
zKZWXSXF1`=+6pzQM`)f27&)=`Ae${v!mIl#{bVUt%VB5dNe365b?sIYZB9R5;cu;B
z+-O_VpFFygd@8L<k+shcw-e>OMj0cPnms^&f$UHv|8N9QO}k5|*>~kcXR)a$nvd6S
z`^(B;lZ1zPz20`kSSe)XX$DBT53WwbyxX1qJ}1zOr`<U%B@>ZE)BPQ*z{BRx<u_+e
zsiqM(5KTx}WhMkNZ5-|J58|w8*b?@~vA>F%_Ll<vjsV?r3~VoT{n$gW#O95wOtr(X
z@Y+$`N`<|i7O9Y8M4W%H8X{Br<!Um!!`jF?N&f9T6C4k%&d|_HDyHCS!eVu<tj)?|
zza_UG>|uxPI)$6?i3)CU33gWn9TB58<U*@STE4V*;YJn_qtGJ;0Gg$xlWP@f_Op0B
z6LudiW>V5?ZwNFm5s_k0DApc)aFB)aJ<6ff0!e>+X7TAT;KLP%AoNbw__or0j<H@n
z_Uriv;yMm^(Nc4)R$qX}j5q7i`&*5A3{@kmi*GH})QmRBt=NMq2;Gp}toWEO2|<zV
zvIDP|dF?RMHP?atJj187DirfFhgUBMeeVw#m$4!|$LSOx^2nCQKcOjX8-U5}rCILf
z*8n0ivwv&)kvRNrN^OE|uJDA!@T3K<G<`tpfjjiN_LM(sLmgq-zj01vh1y3u(&xmt
z1*q1^W%8Yy%f$1M?cO%KS(ff+>ErZ~FSuobG?S&XbbvY)P{GaQnoGp<!VF+AJE2yP
z4%r}DzU}4Oe79M=k9=P5nS?v4%`q}ARmA?Q8qwGX^!Emv&-Q%VZ8{rn9Nk-0{zZeu
z1IWOa8zN0X$F8PS*Q#c$3s$_Ih1^n<VO2ZT{gPX5+k)=OGs}D3Gn>YT*+h(p{@vjO
zlRr>PzOFm&pDkI+7BfG;=Oujwv(mek5J%18`E5)uQa=K!P!}PlO&)SDI`xDpwxYcX
znX_%Pc{CH_9u9>qEZrWfWjWf`tPBAU=6_kB*TguJIZ^Q*zqN>WGuZeY;9i;RC12PI
zpQ>hkFyTwPDzxD&#FVEzd@6NVGnRk&kB=cGgt-}_?W!i**YDOE+KD$y#(PVl(@l^8
zRuTi4Cl5OV#w+A{y}mih6CL_^bP}t<ts1)Q*KzmhBFl)?<fz%i_z-ed3;!3+;1)yn
z-#Lfom{r1HXNKz`uQ<$Z0By?bo=0rEaksK|ps2Tae+GFmm75PGA<S<1?es(Tw96oo
zh9XYxD&%3`YNyIE4qpPVIDWNSueK^H4{``ONTq4lZ~W5u9r}YpykP5UDxC2pUH^0J
zXr4X8y<-%@bl=}1mrvjcRlnxj_Y>~|@h`kgy=ISUf;-!h&Iy8s7@l(5Rgy8jy!<v}
zZNIp}L`|??-MUtX)@S^qQgP%l!nW?Yqo+O>4b)Cn$<+Lv$uVp~Q;w(kG-K^?DhUnm
zZ_V811A-XE|D?7)bQ0;`qrFSd+8y^U#=kA0DUI2wknq-XM))#zsOX35M-JKCCKQ-p
z^dgjo+4g|D?;CR_Y)vO~vKxD6_-o;vmWvaFc|fMn9iR*#pr2a-4#lQ~o0`{jTMTLW
zbQdfeOrX4Kswqyi|FCrQ#CiU!a*=M?(1rY;?v7&A2~~P|t)FOlgA{cDU(63v@3L{(
zS+Sz}yfD)*5WgG4U^Em(veWT4;Ikcz8|Dq`0rI8cO`Dl%Z!st;2a*J~Kh++}TvCy8
zR&atuzSk3H2Z^Z^zwmUzED*<gdGONU(d(!}R)8K$&1$?rWiB=4VBz^EdREOok;@Z6
z6xQZt5JC{)nHidA+}+{Vu4L=H#=@I1+3Oz^@9kuL+ioaPSbE!XV<JGl;<)ZloZVYr
zo9-*{Y@XED<J{>n)Hd1{*_q2lFC8#}2HdqL@of`!2cl02fjAhubJDc@3VhT`EMKi_
zh4eCtMH(P%y@l(CZj|r!BYx8s*ma2E1n9|SJ|gOxR(TT;z?0TXTkiSeROq(v{iK&K
z0{0;aX7U9pC?9#OXL`)@Ex4Mf$=9Rm1Ak4C*L+eOrk%NkVQxL`dpS44h5*Nv<*Lu&
z7Uod%lI$b%-&&4%{nGgo()>{!h!ur**>OyVXo?Hk1>Z4|NJRk%aqL)h<(kT|7g|bT
z=Z2J{it}+7-cD9xG2Z$EeKFi#LtN6rP~VBItzveeMRVTe=z*&-1Rg+dyq&rq;^5Ux
zW%7h|@IPqW_{+(B{#_DhwW;>y&g`BI>?pkoKo|j~#_^h0xd&?_TUjL6dGWpJ3hKft
zgCSh5g*`e7a*f+0yRL3XGMtMa>}mtVH1(D&DX#vRT>KZxw%=UdF3n=*Ub*4VqL8H8
zz11YkGX92j)ZspR!#AC5pn4_M)%ZA9w{EhLxamt4O`lO;FUv8^b@3tLq@fp|U(vY#
za*`8gWKERi*?yE4J#051LI1o;d5b@K@Qw@lveq{-K|lk&`Xs}=QmI9i)-NN_zK|8j
z)AllBUHw?)skgm-nD1Vn=kzQOUM;V^91s@1k?z{<;))z%oUro)Lp@TMega=sJq-v1
z*oO4Dd(V2V|16Izo(*{YwRMiE=Z2*HGOZXjs@U(@6^+;&s1L}zMD^av-E`-q3EoTl
z<)y#sf5zD@Ss&#$?LS^UcsXy~o3sijGNGCn6z<wxrgK%>rJrJ@zQj9a({f|S?Ajs+
zjmL);%`jFG4?wOVi+G68nLch0gum>}JA}7({EA!`x+|>BMNsm2r$!)o*MFK&u?4Z4
zxv%BN%&QV)F9fJfWXHZ|>)O9P3|;k}<idr%(+2tM^;MIEx#c{9HMCgExfct_g*wM}
zRU#&S7YBlw!xR5Fli{PfsH3bpJPEVwEDNd#$>tewwxHV|Cf|pDLLK5QwCa4fo>wTB
zGxO#;yz0@*%zsyIgWQ=Iai7`{sNi-^6ifeRGCP?$nJ`y2R@Dslbf@jw_cX7ah%%Lg
zHED`_1!_oN154<nS$7!18$C!Q184`I&_^LV#02SCN2+D5Dd-RDBw}Y6@@-vv!7u%e
zShe-*Q0pcZyIdN<2zHjUd(^0?SwxbuA&~~|ElO_V-HvrfgK--HL}b$Xb$|^12FW1B
z_?4+(vgY9cF4_g02|8(7AIpj1GY@I&oCaYT>UuQDFDrV7`(ZAbE}0mv4B|lF=IWgj
z&Fu?+FpU31yO4Id523-lqy@di-*!vRv)<HWK9Rz;{pxX$Lci4^>*|J_K24YEhRGE!
zAJ6211hc>c7N4L6k=KVA>k;q3l<}37GfE+2HQKk=zhd#EARzpmi|-{~2vlqB6*Qbx
zryLd616u~*VUzN8eVjW4wsf%?omah+`Z^?j$<TgVNiH^$(;kaj{Vc3u9abvF5PnS>
z7LL^4i?*yEY!7(5k!0K=VmOnl)4FtSrfd&O*zu^^MddZF0?2e4f!*Qs=ce|quYE@X
zXS^02r9IZ1NjvOw!1Cw}-Fc1Ic<qJ}{<u~Ol2EnBdW`L|g;@7%F!7wv<J2KmD^GD+
zpEtBguSD;3a$B`WlR6)+Ua_tFkQ~!G$00;Nb&=ZYH>?q+pK$(`+ITW`AU=zgK3F{?
z4@(L=+b(}(d21?mltVM|P6%F^3ied()KCR#W?%79-EgGV_2`s@7sXb|t&bJHfIhVF
z`@p=Ito5vE4Y?+@ZZ)r1X5Q!5yOZ?}k&)@#74OgA&_uI^cGG%Or-Y@X^XiKTq6mGo
zi-(!^h;;5TPR()~2y-#=08`H=K<xKynwOgOD-ZC)dD%x5DZzHg=c4F|($j#tB2XU9
zp}uOES{41ir>%*=y9M`Y+8Kl~<k5`~%8qorIOR_k9sD={v@>SPqtK*wY{oMn+yK&4
zh?Sd)ET;AKK888^mdr{YCf+b3ae@K(klGC=)~X1o8TWW+GmdF*5r2Ye*je{qNBuRv
zTR`l%G!97B`8#ECtUMJ?e{=$hFrQnaf~CvPoHkKH4OEH^S3U{O$<qF6YKORxz%?uq
zHGDfVa53!FOhZGTkjdE3gZV_eJtK4wvfr&zH^wnXiMJB34s;IkeS>6y2CNfSdvuU`
zjaUC!V8Su9X9iCS0TYUOTO>|mV$i+*z5uo33KO0FcekI8Sow8jEAkBIHqLYTtPI}u
z{RE39XNzmPE_Ou5Ur-NqxLLRLBAM{LNSH;HMN*$U@F)#Xni<#a+PAgCGEPz^?ThQz
zi|V^FrK}wSi7llnb%P8HWUoFa55Q;ssX=z@T>8&s%@|y8%RO^Z&5j#MJw*WrY@pO-
zO^&xM;<X!EfhGM4>yMF|RJUR79bH8)^*xpd<^xaS%)2Hp8zGbK3v_>|sMnaU-h%n&
zxh2p8)+V6iig$L{gotgKog2}jN&H-Xmoiw9JQj*<+5<fwFWJHDhfVFQxhj!ev3&JF
z18z!wuh(r-uKEZlel?LRMe5g5KBU9(^A4Va%6j-RFWH|I=zEofx$gtq3oZQfB&+hM
z9Oe>FGLRma@%M=y07=(It@XIBn0V}Frt2~_8GizOya_%IFd9tm?p=1iaipcI8$ab0
z%W#<#*G6ugV@<Ud+5|0k`cTYYnAO0$<3#sfJ?7@dug^{cgt$#{#dOFdozudvof+Zs
z-ME9G<iLYzH)#;ouu9N2h1U`7!MmcFD?@*@OrIe^>6*KzXy^hBn}t{HT0QUEZ1kK>
zl%mLYTYnoz+>xpTYRgAN35C!{75f@`=JkyrtN@vZ^*rgoF4<H&&tQbN0=|ejglma4
zJu}NfXJ$ALE4~HlQZ8+Kw##?ECQE)zo<B0FrIe&k;4h@O)<%0FzU_Ruu5cgGu5gC4
z?F0jN+tFBso94Yj)=76O$f*mHFVR@#xPKb@h?^!;;jgK@JpMSvrCw#LR+(`)6F#7_
z?;^T(8xmo{^t4`z)X_v61SMWjXA3OzaOEz-aV!Ehc0DXQJ<p<Gf0m_fn4YR~j@BbO
zMuC>2C(v^2!n<ToUpz{XVoh9L5)&Go2(`<1rS4iGrLmkH`XwIzQOa@z-l$RiZCH5q
z4Vytxyo1s(&-!PYj5G*g$4Rp5V_bnr(1Fp#u(4t`Lj_?r!=Id3M{ErL>hWE(RWmxv
z5<+WMq?f4rwV%vP9i@Bq^{};7n`slznSws|opl3W$HFubRqF_~vrl=%_VvA+a3L|;
zYhS@U0qzpp8(wr9U87s&OXJ|PorD{btFa|y4yT6p#@$_tA2?kYDyc|N>uH+{_ZrYN
zd=Wzp{{3)gZ{fP&H6Fc-gI0;;Nt;=^9>)|pgh+zHod(2RRly0yb-27pZ;2&|ou&n^
zfG<6p$3x<4KsYFxZ#9rIEEj5@7R7aM<lvUe3I;Uo-~K=!VKP_m@rv?q(Aw+ijUm-e
zp|I7n*kZ~N^uXPBv((=5(5Hz;DWBW^P6dE_35z-gyUWwF55NCa-Y?TO%22Fs-<f01
zeYU}E=K_}eS&8wTEX<l%K`29OjXP^^TlNaK?L97<AY}7hr`)`-r7BjjdKK{D%r=-F
z;dcL3L8u?vGzJphis1#=7o2^t)Nt<rlM>??<5=?IMWE8f|0}oT^2S+2Gt++x^SSHK
z_=GLtLy=!*8lg;~$q_u+e#q+LtG)O#FB#_G{V)80KJH?512hOL+&#G_=h{P4J^W{0
zJAHIC-l=yby7nQ@7AgR=|EofzFLnvw)q*^SpI763P^P{@o@p94mjfSs^P6v_E;8>;
zvYn~{@lU9ccN2-EhgT(br`<$qK%`YhgjU|QVU63623F<#;{5zBhD5XTQ;~^Nkfh{4
z-?I_xQZu%JcguhGFx$FipPgQbNyt}TV-iPvNY>o<DJ*nk{^_E4WySr4*yYHygmQTR
zTk*aizYy1Q(<iP{Ykhd*J|M5o>(mmUT!v^(_uFMcv)gO90=@5&DZt+g{kEVm0dh>-
zLcY^8-r;yS{E*w-z2Pipmqfr(ku!=uP<!7HC?<v*x%Ej7ub~cXAAPcRO>td5Qh3KJ
z<fS3}4JTw;_DYPJ^mwDXjT=5TVT11#c1=l@6o9VPie3}!o&JNhjg9!a9@3&<&19Hq
ziVRSc__%VR>z?G(GIf5CP^P>ri*b&k6uYIwx3ZxiMNON`Jqzi_XB>VuO*z%~00tij
zxy}j=rI(pFgsD2!mPC2<Mr09cCL`tQ3#x?HxrS|W*~AtOrT%#aep%6nmfP<=F`Q=g
zcf<$97cRc95HEd4mzt>#Ju*ofHbavZ7}VIvlS9@jy&gwj@^KLJzI$}By1@y5t@dqS
z&28T}OhIweO@l6{{Uv~<rk#6TPN7U>aTU9NrF3|dPZ^kyd5MxWIl7-eiqtH3>AZuJ
zlb8F_F@T8oOSq6cX4(yY%Q5<bzM^j`Px;_Gtn@>*sk{U4gNe}h_Z&Ov_^#iEl~}(j
zBGtc9&f9{^o04?%-Z?lrdMIR%>hWglzCcU_j&eJR7}fQTo*SMtoKI<JN&rrbkQ1t3
zocyYyO~R^b-g4?KsTJ|et{tDo8GP){@OnE=b!u-5j+i6kJL9Z>fP=83>-N^g(L=NI
zB!2Fy%cRRY%y-_k2ycfafq6UxcQ04f%SC4Kt<d?rT=r=_!51Ri{J7?7gE8#hW{VF!
zS&pv%3y1X&KsI7c?ojlfkmkgr8n6^ll2Z?tqC3zZsnH;-34y#_BU4Mip+{eLkGxAK
zl-3@GjaI&HJj=WxcE7OoezwY=jMvX2_rX=a3GJ+=5b4?Dyp?H^<)@Ou>Y0}pU_obL
z$5UF=RzdR;&x*;;DMYL@9CJtG+7_e2pGVbWe@3AlSNkN~hM&W?{m=Sj&>%Gueu9Kz
z`c^kArTEYky5#P4dhj@sfkSGfFZxsnam#n0Q3#W9>-6PV9<$cTL`P2RI};A&5oi=*
zM_1axwvY%edv1sj4sDKcK9XKD)bcVle3uXx#AZ|%W4>AoCr_aPvqIP0*wvM%^-u*w
zh><hN;~SdA=^)J;Ks0Q+M?{2b7_mQao$&^FR3FbD+;tmdZ7M0AaxD;=enIEu190@A
z+~XAnMDCKPDMwWLOC~ng2#4!m6GdKfX@c@jKb$>Y*2|G!uk&`psBMo^Dc}K#Soqpo
z-uHi=C4XJp{BuQ@{g->VMt*h2T0wp7-f}INvc}F`k#op`9MS2%pzb5T<PJ34>MKzO
zQ+?59IR!-oM@to7Y-K&53WD@zlxob%DBo)GtwmeDm1X!kY*vCGVeg}{iBvr2Y*9DP
z-Q9pQa7~ijGChjvhy?B1&;g@s#&IHTF|Uh;gRs>Uj7j=9AmE~KV|Yb=y*U3+RJrU5
zLovrPQKZ7RvQq@QdLy$%HSqI{FT9Sp#G*s;CLo&tRRhR4dALX?R~Zn3T!pRGCtU3c
zNZ6<@L6lDfQp4>`P7oqZIBXkFl6}oz=?H-MYU)W`3h9K-7FKV{L_>ox`B*<ag4trk
zm?yU%KAMSfIO~SV!KE?ZbK>?PJ0orjYz4xIje7t&P6KWlcs3Y%C=2#nR2E1OG+i)|
z=au?CoaTr?=Y1u#_S#vut%ornFL5;S*|lNLhrKPG9{`UAYsswAe)SyP1c@|l5GB{$
zKMkckO|IK*r5ABYPZv1GNyp}oNMy%ZtJNJXPXUfqcq#513V4GZ#ii@J50AIorU@KB
zF(VXEE$*sQxQ6nC4qOc8(^A8=>d|(=%O_kD?)BMr`9<kNhV%6z`N@1npOdf0_6h$)
z=(o`l&oxyvg9qqKPXiRLC#*YE|93d5|JRjAMn;%!VXN`a1s<yph++jHog(2@1}UiN
zc^F~D7$wM-@FQ6DX|(Ab!!nsQ9{b^1S*>@A>p#A=hbor~NUB13w~S3}DV3-@xm;y?
z<%QL;%>hch&CM|F>#)#FtQVRU`6PQd+~6SF7_)It@eI4*MK<Mx0}+$DS7+Wc8@&I?
z#o%Wstf&q2p&>)z(uUxqWd4j*z6*@1shfg5xKWtIUN}vvzNpG^T~(n!D_^?%Pa|l=
zsL2Dz#Q07WdzQ=3vlsKDA(fO0c}}sVM4C`PfbX+&FB{+kPWNFO54p-3hfKVeMmOc@
zK6O<-86MKT5PHnp8+V1;gZJn|i-uhb>q`ZTjtibgOQ9RuI~rmprMLU8?Z;+jYz7vN
zkWchAPBO{tT>Gb7q}ek~U(X!fZkTDMrf+v*Hu%_TA@O^~nC`C5OiE=QAg!UymS9=D
z%djOPCrz%V`Q%tR%6E%6s$p-F?g5~AO}RMhqBJHB9wwJPFZN748)>(#*|cQab*t)&
z<)z`pKFV38jw)-$y19U`?Dypk9#2VE(@u&L&r0TGCm5p+jy4{PaZZ1}86Pd51j>)F
zU;g6L^~e&ND)JM)v)AL7Tl76<oSTj#*6uJS`Im%FlC__JWm{(A+@nScXxcT^mwZI|
z_141_Bsl(i(xM^5M=jT`LE!##i;mDPPHU!wi8W=qfb)Se*aikE{aH@8-b-Z@;=uAV
z1RF>FY&7q9Q19edn3As;8MI*$FU*>?*4ZKH#OeSnyk^iqNH6A-uFv%6mINY_GHo#C
zckR%7bG|kTW9pvfqT%o!>0R&}Blj;_&EHp&E~Yl*q#gkbL~kdlth?kJ*vDNpAt$I*
zQ2hi4PoJ62ms6ydoFG^pGv>D0e;GXq$P*)N?LKd)Niu)<g54I0tuG;?+>rGk%8>}$
zX&Ux(-;ymM<FKi4LPoscZBMkfR>wp3<`Q7DQVWhrzdYPdjiRWQRT;ZspF6pT5kE`T
zX^IW~lW?DW{@^zX*7s4&V-4pNs$qUr7<|-yQ=xo-SFAFY=Ca+>I3dgPQcIsjvO{Uq
zjc+9DUG2W&#6E7Jc<BglcPFir3pykZu)qxhtt5!UtO&0xOS88h3FdW{qqU2XzG4Al
zaT8pw=*B;APM2L1Y3@Ydt)l{8fV8f}^U@^f>^-RP?Y;0SB7pyRF8f;g1V6BfXcQN7
z4^ou18&2(dXfCRA#qTB&ry$|A)JiYB6CU|+S+%+)cwPC>W;nXb+zBB0djP8a8Dusg
zj_%S~`30j;Gu{b%V^hC*-b30heHI#iyWDg@SVb-Op2NPsi_a_&AKEEUz4kgWNMj!@
zhOb=lW9O-QNtP90E0J(nc;X2dnLDP8d}(MS4);D6LF|L2p@i`7Tv$XKBeBeqZ|YW?
zR&FCX;Y465+rmSwYFJZNVGYAtHXX+GQ%97`ZyTndlw64zsM8e_Lks%LrJNQru7HMo
z6tdp4pl44NH4gxQtk@^Cn{-+@|B%_wg4QV$d<{)Uv16Rbl5d@olG61cHEuha(szT4
zk``k{_1Lr|Q_b^jK3iSpZ7JsJ;&Qsbk9>|@Yf%MxGoQzpCNU{={WhUtqxP`9Wuq-M
znu_{qfOOkteT1k+AH;t3B=Y1M(D&=5mkSy~h8Si2CW+NY_MRl5W(>7cgtd6!6eNd7
zJ-#L<ls=C_wM)1O4EBD`MDwk?*9XwbZO7iY`%L02*Y>0TXm>sBo~0@?Fec2F@P|Gr
ze)lpvX-LLZ_((}gXX=3WxgY$?p3jS>pLVqx>#<3iU4~hT>UwgBW*bBHI}_0f>K!?o
zf{;k-*D|owQm0{;%C6zdo^lTQg$3L<hqZCr<mIkJ{HU(jQp{On02Hi_%U-(-e!El)
zPq%(n&cTmKnPdk&kEw&OAC4dGEembyysz~9?O}N@kKogFF1~p74Q7f2sK`DFXqz-q
zQOQev;L@PMsvGN2?B-^5k3T)Qn>PK=1CU}NJw#{jIEbE=AT`3sxh7$2*_(7<lgie0
zbarH9gX+gU0RbzYAB?Ch#pm)h6bD?jT5y)~5MN62_ngZ12oBk?Db*@MJmrje&6{?$
z*_rzmIq0D~i>Za=51H-9KTc&D!|Ynby4Qfnb|Fv6-f)aZFt|o7S)o+%!Sb$sdew`(
zQX_sx)PZIS&+x7DO7cyGg-QVv?0}u)qFDb{oNtD#XA{?2aMZQv-V3iDNtaE}22j6k
z8+8@x`z`TWjGBRtAe$aV=-gfEduclVG)yZf`BOz>I<sirX^GoUBi&Q@?S6fXcEWG}
zs&K8{1W#oaz!QY*Az`f2gt?3_3$f@@k;+WKv(}69^NNtFrDpe^Jpk-*WQX5x0$c;#
zrPVeCMl(i8BJo+ROFfA_`%!JizAC<n`{uPPxm5_w+zR{49IxTs?Wlbf$M3QSQzIjP
z5>%_CmI^$gqVw0?4QtPCy&^^+th)>ajbCZ4t*bn19vGN|UG{S&>fAy2krMkTS5@c0
zKpAF5Bc!_CeWtM(l&bKJ;PxIR0!=Fb)8e2ugN2)uoPN7<TCLT#NFjWlLWp&wES{U3
z$R1J}<rD!9C(0duWXLL5d0Oorh>^)y|78X+zgIBU|JaN(eDQKv1V%N&g6dda7-=P!
zxa2GRFVdmN9$=qc!c(=zN?8gy9v$`Atw`%Utnkxzc>AExhOhwf#H!Py!+Ehylau$-
z`@3r)bPd0&UiHL1+lAKIV^!mdb-~z3%E)+y-5emSaUKY1s9ELHek;_&3s6;y_5f^s
z!PtRAA!pu#Ex~UfOyi-H+8I>IY}{-@0jW~;)YwDJajzCAPv?932~ud_OJ($oe!XJ^
zC9VTLmwIkez!KcS-z4nLwKQJH{BbJ6@h_>+AD+bZ3$>y|SyO5NIi$i?XJP)J<M{VS
z7Jh&0m$c+dDC#NUZ%hzlKa&-?lZ%)JE@E5zj5X7aBmk&7F@7>;b*LX9n4v<8)uAS9
zS{FaMRXgIFRp^rBf1wJ}pcR$Rf_cAOq?Y~7ZBXrol}=I?M)gXvSBwlMCqG*~;XV~f
zC)OPGrH_HVQHyK$(25+R_33w*kPnJ}ycGK&5x(ykjcbBFs{*qx&;8n=0~D|2Ey+V}
zqsz{02@+;qS^{_2qDp3kSM)&yOmDI{dQ@+APGa%1Fma<ik2uX$zaY|jh9ayZuhcm>
zS|rE)iHR6uw?XaOVtO8)(Fz_2bA@dxb`H9@U+1(*dy{q#<8q!TSOonybF`p+RM)Gu
zJS{W(U(C@SzqC&P0k<$$riUGkTxZ!8f-EjriS-#CH1qV;>>nCDcMATQ3gB#e8onjR
z1^0|N$ExVor;lCV982)1QWh7G3}>H5@C$bm6Yulf|6Lv&IR40%$)vC3gGrv-x(Jtm
z<yxIMQVw+f^`!f7#I$GBgK1s0W`pr!(x^g_5f|h!Xn<+uG*bRQr~DO!Ggefp2lFxn
zUo6l<4lt*dj|N!(X+Hl@)HUWYhUJT&!LTc;p+VO$E6n6!Y5b8hsyl?Czyo(Xc<{_d
z^uM$KSemwORe(hF){xGg+g;t5vYsMWaqC|9wh&aUc>jY5hJph1rzMAt@Heykx`xRr
z+!XS@_$Hv<;|Zn^zBu(1Dnu``((Z%7Q6l5cT*Ua(QagU{0pJ6aI2{6B-cip8D^p;l
zyV{{^{$hLY`avM+cXP&W;y9k`NZSDf2}J)X|0ffC{T@KJjVp(XZtgX;!C`Z?QHSyk
zThE{h_qIuQ7iAWG9!9MPZN&bKm%uZryVE-TNO|pG-cnt}$7KT3R9D}J%RNv3ii%aD
z2WRFJ)aG6mIjBR>kL~+@NW8&|>gkxo;}o#R<R)-YCYo_I^XzF{$fuhuMP+3}Tg|2=
ztfY5V^at<due5QM+}`+p4e~*l_uQNo{xaF}?EocHV5f6~d@garxYu=_iram<;WVcT
zz#MDIq8+~vk-N4r{`AfUn{P)(ABUHw5>wgwY2z}t`$&H#ziTSJ90cd<`L_147t|Lb
zCfR2AmzWUfQI9WspNwb5#^w_wJwflDQN=%1%X+D+t4koU)ItYEQX{x=m}&vwp>w#=
z=DeLbE^^g%MT{Isi5r6VGA-I~FxCqI)DVCjc+l>q?KfTOxc{YsV3xLMUz3<1>o<QQ
zYQTyznR?1S5b|;@aKgYZ0&VV@Qz5%SPi$@S+6;}7t%^{Hd(9p0=Erb2<QgL4$97mJ
zw+RICf&uTce&QGttE*)DB!&kkR$mwC^RKfE;rexT8AHpEws&$SC*Mjx`C9TM>~en#
zJL4OwaVoOti~UH*Lh%aF6#E}hR|C~(CntH^VrZPNq|_q={QhhXi;LaIfFB}{^h&_=
zIN7B)TZ$zd2T_zTv!{WlfK_tA8frGJMWKH5D-grgp`1bga`8qcJ>K}2n|3!h4IY0n
z!VND8ivTmRBbN8>W$MxHVRSd@Jr4i^CkEgVyWF1H+s#NkoQ~#V+(x>Ehc$Ar(#j%!
z_YXo9w)VU;k;Jc5<cB2<9gTO}Vk-IoTk@)#_ES}rET!r1-g@zzGh-SL{L~;cP6aHM
zB<XJ*+Ed~$jxDk(+_GG98tKjebj`DiAM#t8Ir%miw=pgA$o<8+6_w){%mv=}phcvd
zO)~oeQ|<l@6zsOjLz#fcB<ZZ%e_=ou{N$UXb}Wv)=7^=}7Bd{?Q<YR#36CeM@<`Zd
z83WVCY0&?WXZdep=G~x^a;&SeCCj8%?Z?=l%C1R(`U_F@LpbVW+%S_{us_+|e_>mz
zN>6yecbnjIdUzI?t{>vf^g?Yi&|<Bd1LxB2R9^bDRgHZapZH_uWpyfHP}hC5fz?D3
z;G0Lh_%DC!f~La$`rL-z9+;3w*8SfHOF;&F?hr2zL#!P&Mo_3aC{rhQz5<f-;g_ze
zYFyJsS6#Y25E<S@B3Tr+yD*-A5x#%861Ss<2mpil0CRJrr~*O@#*3XG7s>lbJk=q2
zzW+qP0~jIXuZTBP)U!RTz75TrCH3Tz`ZrVeaXZ)B-L4?D!);7BkaHuFn&E)dLAU@(
zstA~pC&kAv?=JipaEZfU&T-@K`WwT7Pr7`xWNl%>i+^jvJc%l^d7;QX*!gDdHY_;P
zs^`^*{w(qK5w;CF-`0$7Ol`*BjcN92&hF0t))c_o{D0wI?L&e8xT%%T=CYpjmj+Wo
z-gEyCiQfN){l{t2-g8%b5J4qy<+K&Rev8aDmgzC`@E2&93u^p!od#gSZinpd(Av|%
zLct4(%M3x8i909m(=Fie=10SU{*#;j9mxk`nxdLXliS8YTv@cFeA?yE@tctGOvp!)
zIea`b|2|TAMbQq|EXdHGvvdKN_@d;=eKTV~n`i3@GrRuHFXs8@TK-gxq~A@fJdSqL
zbX=wGo)3inBISMtYiEEx=cqFM7MTyU4T)yPn3F1KhJB0-2bAlPr+PvCc91h%;osFy
z@lB%3M@+^aU$YE#nnO3be^Xc$7MuLYe`;-5yf@ANNz4}6azT7GIg?PwyrXQH^`QL1
zOjR=#*La|Jpxnmq%<cCfmzud~LO=sif!W+UJ!ek?d-L+c_L27(sr?)ET+O_)tb5n-
z%^@zo8vI?(0vuqPKrXZYMcP|OMb&ow<0hzpsHjMz(y4TVN(cxDqBMw<NDiGdA_CIg
zB@H5tbV*7}4vjFt&_fRc416!V@ArM)N4W3bAHQ|2#X{HNoOA7K_u2ciTZYzO=j)M0
z=No~mc`SbM6A1sv#kFkhY7)W~S<@wdXfa<4Nlng?1C9c(q5i9oiG>lUAlqR(*{Fp{
zTOTZ1Pt%luYWHJpCQoJlU!GJJqzwQ(>`ECQod4a=osLbWMK}_Pto3x$&J*qdq=QLO
z^e=mWT@Ob?TR^T@_!s~Iu7j|EX%UY<LH`uCA;eBu<0cC39a`f;y(XvZT~YQzXgg$i
z>En!#vQ2Vnhdxp_)unT>Vf2^kq(p3@9{xAnMWEFd;qr}27O6@u+9r_#h2_4gyVm}&
zUsS^Dgv&UU3*O^V=X6Df2zT@*g36mk*Z$A-7yspY1?d&~a9u`9U6RSJTbFN(2CQs7
zl{?0H&}^av&5d_&wfc#Mm5M%CH3~e_V%|P#zCg9-1&M$}tY;e`h{v3o{UKhz7cN#@
zbhaH2^3g5LYlziO@Y;&qXAH>-g=)o9SdWf7=5NV@{Swa0Q%5LCRO+i<xt~0J-KxZF
zNi*0cEJJGW`*}*Ob>;&`fYtC_XN~y9dCVF$EaH5im9bZFlJKl9@s`wwGdrJzBi!W?
zfx9U;7$PWdWm6s#C0*+`0*SIvd`se5#?Qn%XpB$;lH`Si&F$ZP;otLc|I>{|o_VO<
zGdNhlA#C-EvUkSZ>gaJ>8zNY%WO6VJ?Z<pjC{;m9tf8kfq;hB7+)mfzH^Pk)q737a
z<Ge@(Kod&gvo6gNu53+*KW%NQcPj#FlJhWIx5g#xd$ere&EC7D;Opy8ukRUzf0-|l
z+LCp$qvqOmi-Xavx<Sw<_a3y%0WEBMH2*{*R$sL+lX>tI1do4(W|5H=<6yCs@k}$V
z{n~Ns(XGjDJ0}`Cp<mY})87yRn-=7w+)RZNA*!m+jpfPT^9L&Rj{P0`pQv2d8VUBk
z?Hd5zreZ_;Qmr(a%%RR5$(B%wv$)IueAIt6xpJPZ!WX(;?$ON}9X*fdAGk{Zb)U4E
zw77z~HQVIEmh(0eUslnF7W;(06z{euTq_rAM?O1T{+<5Onf*GE!i6iqx-*>JN)p<3
zgEDqQAMy6c*@QyQyGka?u50@Lu3KkL&~PxHIvzXQ9JxWRGatFJOx!H@*V-Zh#6@x}
zU#VpB&{`j>x0Ve~)c63ruA(=^(bo+<c3vbTlDYf}?auoP?Lv6<7ZrAiYW)&qiBRK3
z0_7v~zXkY!>wg7U2Pal%i1cWl>gfINj*)$|Bk|!Ha+5EyMP*>!;$^jk4b`|5y2o`Z
zuv<8LdjHNcWu?xol>}ss+t!#$4;^r)t_5)af1wWj0m$N}bmI~SOVfQ8#Ax}wp6Ql?
zc*?BHgbp8rvwwRXsT@qd2xnIa{q~3N|122YDACySI@FCbh%-1?9NxVMFl_Y3bbqf$
zqCMTFBpPk5E_LPwqi%0YXIE8<1Cfst@EqA#;OpNsM?K7wW9R8AqJL&=;mfX<vzUzz
z-WF&o`N?^w&=XfE-z)6NuVd`A2W!}~03Kl-;f89l!`<aP^b?KcT`Omeq?{SCm|>8T
z`gwg5$L3g*0yG66H4mYFRD>>~C4zN{>qZB|Rc^>FO()P+6P!X$@d$XtKZBwD=Uemp
z3kprHyNC<e`G>xZ<+GpDtXp%Z3QiXHNhX{}h>=p=DgDpF=`Hi9-s#f*3+jgi-P1F%
zz;N)3Hz*<Yf1)@NaQUB?wQETAak8Yn`LT=lkJ!Y2kpFKSW3isgPd(G*Tl2#{rOKt^
zwE5+4^d(A@G6=F!dPgk@2_{%w#1}2XU8WZfxdjT*K*dkN*j6xvO6zgt&orw(S`)%<
zxp|^JWf#{sV=Z}L===UH#H&NJA3$6&Oh=aI!kVd?v4>Lut4YrDloj2;ec5S2vNgLd
z=ZY=|fHF1biv6+B1YPL_k}3x^%`mf3fttjX3ukxrOOIow=jV2D5ASw=?D-&!kMI0B
z5l2!qTJIRpPQYZM&Keh#m2Zg?=94X_)7$B_`C?y-4g~^Wkh}BW>wcc!Gk(1l%7}-R
zfIaMr;eF7R3>wZAw$A*8T$Nr0tU;gD&V7;y0h)#oLze=67Bf~?YXAAY<NjO9ZkB%G
z)irk=CqugB3@}p)z)<WeY@HwUTdxU%%{WmqfP}=cL9?!HfUQv-;2tgHt(Vs3`u?>|
zuS0zpp|41CU|PS_!PVOK9V}sm`)ZhyeLg#gOcraAztMi0u^nZ^&1qJ5B6~SmW__ZV
zixWZXmP2Y1q=0*tgOt>d1vso=aM|>oRxLn=9;!n(5Zz#P?bAPk)^0CsG_QW{IzW25
zdFb|+)_C#YcihuK#sUBD>)-#&^^0k)(tk5Rrf+xByU}%iHZ$O!`lwBejI4rgQjqWR
zGO<8eGQY~){s-u;oA(~*KlRAY&9xhN8E!uFDQUw#yh^!`_;KsYtrwGS1>-lW=@-M$
z;wx43O!{ZSo}2=p?MCCaCfsw$Q9=1W%Fl;nvTpz_w?GmxeciIe%w(xXWWwB3b1s6#
ztR%bW7!mCx#_0S-H^psRb7kzOEuC{a>-&_hj^PpB<-Vg;^otTL)=a1U&8O>YC~wJD
z=X+WeyHGlaB`N^uZi*1lA8zeALJnQGU5vE%cJk3U?1_`e&B+n2P&qsu_<LU14Is0X
zj(qIdz!Pv~R~|$2E7qs`Ijsl?J11`S#CdEaWTv2b6$nnZWY^sqos&Ho`jm94*k$xp
znQq=SkYlmY3~nc8H@EVQ<Qg7OJB?;%FWn5T%iNm^F*bGx<e-q~WZ2mMtXVsQ5LOhA
z6Fr4S?}4=MqQz5YgoD{!*J`AG8%f&oS6h9h{p@2ml3w&)V}v)~6v&O5HOpBs-x-te
zxvTyqI~%0sxN{3Zd3`dmp4+L^XL$PBqYAyStU0BwuCC?mY&5bS`iczkC7UUf9lE!J
zRZyAa{kD<7kkdVMDg}jUgHXaf?*N(7zkE@ccE3RqvCL*A@pN`XXTC~1j9s;?k(;|z
zl^_=sTl<qM5}R$}o_3(`#n6{ov<BmD7awOscnv##h+t;pjuhj#%gIo&w^@D(2kYt)
zoCe|UBSDRHzE>&6J2AQYq5@K-ueun7FMCU*AtZ;jD8%3yQ*rIh*&-y1O^z9bXWc;H
zSL>I1CZe}b1%r2^B$}U}w*l}7QlMO9u*@4FB~=?&gcd64+D^!1Z%1~h(V)CXQg}8K
z7#@G8I*lhjw_GT!r6&y!_8y%$KU{GK<qIgnQqNdZqOrIL{BgMBI71@8iT0bA3Vkht
z6saFr4uZHOgHyNW^!Rm?Pk1h5y>Pz2t?jP4|3HhxsDNB-_s5$$qu1B5C0g|x(Nt>*
zKh_FQ6|JUwL7T#gR8^>8eA)OAUFkw-URX9pG$i}=sJ7CrV`kwr?2<zWraw{&{RaiH
z6;oF)A=|g8YSOvRKZ$p1(=`z1$#!bZLKVHt5<AbStXgnMzlJ{MClDLVbU<M>ArOqh
zN`{+vU(T1^i|CG$s0*3WKXt!8($olv{+Y`gCOqYjqsA)yN-(+_51kV$PJN7z*dSW`
zm1aHq36Og|0}d{kSGOLe(~idvmDnaBeAK$wkzdiLil5u`jUNuzX-OjX5LgAEDYDSd
zhbP#t=PQpLX7HTG7_ToBR@1lbKqb%l`0O1r1naimOKy8B=Sj;+aH@;@x$FXmwzvmL
zMB6+zsC$=YWlC5PvY$9|+CJW2pU*>!gDqGal$1{^)mnzqy%Vr><X4_AdlRwQ&i}8E
z00yAZH?hX`=veFOPqUdHy&yYHydIp3MtRe1NxM7;AY0#(D{DV9+i0`50TKKD4^kxy
zjzT#~x0Nk?Nmx-dY%}4<=hO9f6KxP$IJlasP<F)5W!&8gxJ^l+9nv_oS*#_wK`YAX
zY08eklZHM#e%dyj$!YX`u6d4xJsGq=Je)x4I|nNJp(XxxGs6=^w-BxY&39*=C&PZ^
z-wbqNayNtW8>N3IJ<W@{87bE6oB5zYiKL3yYGYI&o~>&T7_@&T7Ir(~DNwPw&uCtS
zl!_e^$`*%>lte!92w*nkuZ`pEdwn|l9@8vLU$t#pJ2ML9%ylV?emmH^vJ9(WcABQB
z`(H81>KN5>K6>IwyL9$cc6xp5ZqWKYAAH&Dr`^`Er`?M>UJO=E9|CNkfN@;vZ~%1L
zFi9R;LD!&E;g)~#AJir|;4s~+stLm3eI`KAY-AShY1B(4I%ZIPRT&g+$!QE+_nH2$
zw{x%QE`M~|@do+-{dV!pM3*D1upi`Om@h{y6PsmyqkY}xs-5Jt8NS(GZfdBMuz#CH
zb$(=YbiC19ATWs(5APIio_%)Ao8Z-pQO=rMq>OtFY*Ct{hEDt_@3!HXx2Flf`Dn3K
zwD=B`Zht>!qM0yQH|tr>Ts3;a9!y-dMKt@{F6ETwl5yxiRV&$QBG$38pR^6M7!_Fh
zx>AFUx7cBNn^gcQ*as-|V~;O?*y}GDElYah6*24D$8ci5bz*dXk;4EU&#aPb17P$m
zH|IK!G56;NHLd*%P3{wXIBAMs|N2elV^x+W9;M&<Ssx7PEn3ai>0(vQuj6J@XAxb~
zSa|pD-B{E^0`taC*Rke`3POjViNAo}Wv!brBjJ~10QoS=tZnc;eL|2O7#_m@?(JL4
zmPAX_ybsySHQZuLGcN*AJFZ?>HU89Ie-goF0DP91v#{)b;%&Yb9_ufVY~Mo)KVKwv
z9M04Ef);0GWj*Xox~u%^RmI}s7i}yx^Vhr#7{Di=X4`8@%S}mXAfOT%i+39Fu69E9
z_Sww{DsY<H+t}<qVPf{$wKo|K&;fZs6EibwOhBt0<^Czm#31Z;=%i5GW~ds&vqFFd
zU{+RUW@aSSm3ySwl}`w<$tG{_#48S}2p%4yjm9P^of>OD31Ds#s4gZ_f9dLy2Ou#@
zM^>f>yAYDnqmA~XZSrrg8wlXwb5OHxwNnzjZyyRydOQbKao+^?uCDj47x~Pfn*EC3
z4q+n&D{GGVaG}A*MsdvRuWmzb#U%eN4q_zNfZ6zV#Za{uUlI&_sosA*h^ywTfADeL
zd{n_~rDS3+G*{+a)Sgq%nM7aqihkU^w;BP$JNvYkRhhO{=_g&iMD??SsKhDv-BZRc
z7@L&6tqaG|Ha;^rIO@_%;qVKp`w(`Dy9fZe_m+fvn4)zT02;v$?B+0X!>-(Lmw#m|
zR8vb!YXTwja;UE^{!J;pFhX&sE(-wZQ!#Ks4|cULG8>ONTTSNG?8OkiVzNPj=|Wzk
zx-Bbs6t4znr`r49=od3B#il|2)G5z7jurB&@A$HNB>T-|P}Bryaj%NwM)a=JAJq9%
z3NxV~O>Fq*BV;gFKQp7CR^zeNEdVHH-R))KZez<hajlKz$P{U&O>0x+zP(i9gt<m3
zsPoAPFFJct8HpX;IMy)b0CSNrnpNIV*1Bu3e22K)rTJ^Q9c?XT-}5-e9&H#_4(+9J
zcypi{VPt11xKiv6z|m|0MB7$he)Y~Gm;Eo|ok*RZX16HdaM%!DVq^c?;qxAQ$#S}a
z^1>@L(vP%9&g8B+X|=KpFdDbO)_r9U^0vaf4wWnbc-^|2VGPM)6Y(J;!DYjk>go14
z3fi9YZAV|&w2lqXN$Ie{s_tC!)Sq<vNqa7uJ(-TCs|YQ){%wGC(qfdBjlIb^d5v>t
zz9(gTYH}|oky4)X>T#psYL66UAP0Y5!5rzT^W?sK9xT%!s-kc;`+eG))-(G_>`=L#
z=pN-#86ps(*X&oIB@)!iA#pwbrtTDg?*1e65*r50sGuKRmgBK=NMEyRfMEg|&u5Qv
z#;)?u;F<ffit1iU`DTdUOZ>9Lrr5r$xv9{i|83$qm*%bL)s*3)@t;Xgj{6U%Gv*5Q
zj5_0HMGoGURQ*z4`10k;7ywgJwG=2Vw?^^{=V>YF!{PAC-!L=#I^C7~DA)s3m}O^Y
z=PKv|SpP1t$6-bg-DaNijn2r`F@2@y{a4)vPnn-RmT*v00g$4!VCKp3WKRWOJknK9
zq}&8(BIRK8quOKu$^~i3TPOnYJN)weh3iu9P?_qgy+<~c8j2~KiNHf=$(EQ+bAGN{
zhq^C{8<REbDPuY0w3HWXCoI^iZDY&*Tz1r<wMhlk+^ZRxp;u5YobMtB_$?+}9Qg+q
z2g4$Lha*-ki#Na3peGaWq9^9R%tS_{d~BI%4W(VnX}-E{!U}ipfevJiX(#Sfz=pvv
zlF+f3P`F<JYd_9xX56=24Vqu(B|}jonG<=EHy87Sw?T>IpHYxo?r*K&1E7p{Qm8xe
zZ7>G4eiQL=R*T*n=d*Mv^PmB6`}2EvwQCgK1v(WrSuhnv6<#5PmKz084Pmc6ZRm{F
zBffa`r1xM%IceIL#yos7QYBPD@!?|>$yU^A)qW46h;@fjs(nj1xTf|e)tN=Yvu2l3
z_ciK5YV2cqEfO>s(0#qV)8z|-0R+6NqDW<zsr}p4Dp<ES&d!xEmD2TQvet@09g&&O
zsP%dd6P>bGbbB?=CcoRXIUl!9IgVaWXrDZ}FE^RbwG%|MUBJEaTSTlV9aycJU0%hE
z%auBiso9U)j+NG6{r!GLl$|xk0qU;i*$4ZW@c@qaAuC5nvYN9g|6UZTTsrjCCOZc}
zI&#WTbDeIVNSy3j$#1Y*AK#cx=>xUaD~D+^s+o@@NTZVB9k<I;*kK9KJ*w4UFDg8R
zO_<5G_UlqmW>yD@z}n4j`^re2!#pxxXxylzHaRHgYal^FF+bTW0%0zkM^+1i8Ys&c
zV=%6O{j<EttOJa|HOXd{9fly>U(OYjwM*&V1Hc<9+L**j#ExLf$}UyqYK3o~HOrcG
z`-+50$$mg$-Y94vg{WZn-sz-%HzNHwIFMFJo-+XxMqAiVx)Kf<jyMGh+gT?L8%x0y
z+V;Ec$7avNxhN_Me}3lI8q~6<pfc?r;F*{0^@T!=ZE6OuvvG5Culi9X&aKdnb)Q0G
z(_=e3%#PgK#VUmLRMy$bt|vSd4IK@$98TBl+t4sSOaXnsrJ*RJfIz5AxQM^{yV}C5
zli@Dg`RtXTD~=`yFM>^LZV3xYpN^4jYD)Q+^Ph~DLG=1Kh?+*x%SGMgxQBZ|qB^iB
zyG3LAJs!JlVRuUSfW0V*Kfc|NGdcFGO63L09MyvQQp86h*d4i~Naoklqo2`h-LOOE
z%!k_<HDpRqQvI83J2evRgnX8w_LJ2xIcJ?@RCIvA;-ymY56$M~{NV=Jqv1*-QNb_o
zdJvU;<9A=sFVK9v_W06;YZq=_zOpFsNb>Ai2{-DZ3y;dK8BS8IO(2C0B!eGZAklx0
z^GNZmVlJO%-W^F2{Yx|yKg1qCHCn{1d{f9<blu4kcmXG=*kl$-Tz+94Z}D<PpnAv|
zG++(#qpKVZM~cl3<SM#v@KzyL_s8tljM@Y;5+Odmv%7s5zcc49QNRDsk2=finJ?oQ
zK+)8rb8ySXh#mKp&o4FA-d0;7+0|kWnWv!JLx?%5quq>3!?}@P-K&+b<X_wO2_$lB
z7AqJomeqc^z(VuV&e}RuLoy=#krPBNfuo7VMB_Fq6hO8_v%6y6ztz;NuM5&251z0c
z$&|Pq;rcO8GIUwCw($EM3K~|-l~GG6c&MK=G*5IGUO$TBLRFWFt3c8&)K-|KFfN4C
zJu%cFj)owbqczOcqHGV$-40>;`zp{Q4)_zxg^;wlV-~lr*S6Zg60?*EtG{$2mvLvi
zti5n80hhq0$<;!ug`IYumcS9r92lP=QrJr$)(ceF^QD2Z4Jh&yzwN=BiwqRHZT8}v
zRmk{TM6;Z^y0vvt`E;9XygwI{^I~g8iUF3ecXws&{#D!PVjup<Lc$~Gz0r_v>EX2c
z**j8a&R)1C_MabO7p%@HKJrYnLhzF+$T(wV8og)keEY7X<e6rYThql&9#V_WJ2*^}
z6u@r{Vuwz(Jdx+O&26t)c~yAybXjuxS+BGlu6N{9Nh*o}p~Xu@M~8{Brukc|)98+R
z5BrKHT1o45T4KrJYF~fbr$*&(^hBLBA!!0X?1#W?LM>cDwXVSHwA`v8vo@|67D(%5
zqGlttw_n@3uTT<O1Y@eJLs(tvUY0PrH`dbhg*2PjH|rGoP2QD<FRXOx6GTEtYOHri
z4814}4JCJp|9fX=+;nN4Gsr7vIdqG8(l+%|noT+MZdsOxHTSLZ(?4P$XuLUkN3zC;
zO1US`?tSOyq9Qq2R{xhYTBZ5|A+Nph_n~$H{Co3x70sf(DdyihODmhXq9w&Q%@)@l
zn)BBt1(J7HIU11~JJ7T+j)K7*Qw4i@Vxf{OM(s{JFD(lvLKO}ss%zxzei;dFoVVmq
zI472o;8Zy57&&ZS-9m}|hB1N-GMI_cFy<TVgK|guO)tRqlgN7C8l?6Uy3tTaj@?Im
zqIYOFY25n(M!;*sk=I=_(xGEZ)B58_1q8X2sP5-9dHsUMtCtJQ$he;0f?C8=MHE)&
zPepD?3a!<#M{6yk$%F+$zX)sQkxN~6(sJ%3P((1a#%*J|QAnY*q-d9nJW9u?l{8+~
zrONplTC;<PEznNCf)*OL=hCCOc}2`~nle5%j<X3oBB5tu<A{vU(7_{3EHedD#Q(!V
zzkj0+6f>uO_s(#EsRfn{T3o(f-d7Nmr>WdT&~EUS==Vf8eB^Rb8{DaJ{9%}_T??%i
z<nZQnnf-Ns+z3Ojb5I``{*fR8bU+<(zz!N<<tw{tg|ili$b|h2$H|&=hf6x5%~*d_
zOKNejzs-fpsXeMnPlX$}QTAPGhMxZPt<T?mO&J;r1oLl27pWossCZaFd8ggG(5tQ-
z(AKmN$9I~qOj-RX03H|YXkTtL)5HkwCSMcU7)lA9QQX{+%`2;xxt->U9;X*LH=ZHS
z*T%CJvLfR$13;uX+jEkxwv5;!hinaE!8lB!BE!y@%!UM>4<Sph-Lw=qwOtzwQ4^zv
z>k(4`{*GG|_UjQ^ZQ2g0YB9|o;12u0!Ujm?87w9r_mmT|WdH0Fe17>2LU3vWRGE>b
zF)|h@r9~=KBIBq&GL<~^dyV;imn5=T#*5M}-^Iqg1Kz=_*Af7U_Ah=I$g;N4o)@Ka
zAhfB@CHj>1`_;=%Kd#|u>yKE_(3Z%dC@8b3!q(3-6b4){%-x%^Ws6F8V^NztS}ly@
zkqPPMVA0sA!Rz>8bacl+6HQF%)e-ugu-@ZQM#qivqc(_7G}oDpz!woL#kFHOB%|*$
z+jl-ywHG^*<k;}H3elXEV8lK`-|zFWJ&1Ibm^hC<syCDTpmk%bjdyo{?YwP8fN1TI
z-deYTCQ4zPhxWhq_nC8;zx9nwi>u5ybOds*VEw4M%V^gAO5g03#a@|%Hx=_bf(1Gz
zIT#CDznH5RWzNZhjp|n(U6&?RmTsXp6Su80Q{7xR^yDtgr3`gp<LUa9M~v3eht@no
zGcG}oU|NP`TC7$Si~1CuY%8$9H+oXN`STSfuo=7RNoXRs)Nq%Zz`Tfo3v4ua`Nw@i
zxEfmo-9v5?A2a=u4qsmniY0wPLeYav$0-c4^&1<Gz_Wkql_~1y*?c`>o@uGK6+O~b
z-a<!&kq6YujA!qNX5Juv76Q+bJ|po#9^$WhfFnnm*(!W{0Wuh3OJTA`D>NuYOBO<K
z_+v|!t@@`Qm8gh`aObBP-k^0fec!Atq_<4QD^)C}LqQ;*%y#o)JjkPH?U{`-byYt`
z9qv=v2v5{Y@_OuK?E5q8IIj?FHlh-&s%PslmBa9(c$?nRxY!Qn0mxWc!5nl{b>W+e
zj(w~MvU1Yf>4E2dF9gfRL1}Lm=7itN+#?#PtH(ahe&T>Ujt^+WS{@;!zUXNq#FEV=
zy22MsUUI}+0`)Jms_4vh?RY2^y};A(?dl#c>`rMgMjCSa=$oG4DqnjXWG>6GXnXe|
zqhn5V<5|$(!#eDN*>J;+awin|;W`Lw^XB|ffvNE|7tF$khvWYQ)<fHs{$XZ&UfEED
zT#5TQckYYVO3P2XJgRQz6%{o!o0DqUEeYP9m~FG97|$T@TLAU8hTRj40z&ch$k`2M
zwpJe)W|OVj6uLz!Eb7~PnV!-D^u-6hb>7fj=;g6qV#OOTwuGtSaeVlX8}a+Mx@)(7
zcoTJA;((|yP~J394XJxCYdn@{%t#JTu$bDC@y{5ymJis>upcwK%?>S1rBsAkGUU2_
zI(o-zY*YNrl_L7;^l(qlb%Vp6GrnBr6;pe$nhh~!W^H?*r5AH`PvC)?WFe098A&g?
z{fhk338xnBgtiME90W;MT+!f+O?g-OY+y=zON;0}Org%@y@SCW)4mCqfI|D)KJiFm
zZe(8A8Te9O?UZ&le0Z3I^^5RQ8-$$KTvMM4KF>Vjjeb<?`)tEmxy^yUg&H0SV|yYv
z%y#}yfor<-(Jgbu%rngeau?%V9I@FKK;#_^PO~au<tr-gc9YuRSImzC%y8`xJlufv
zQtJjXp10f7gp9rQGi=jnn*F@Lj()<iP@X-sS?Q;1rzao{E!@hT3Sgsuc*XeAOqbMA
zqZI<b(5VKMy#I^|G3W}Mkj|n(c~5sj{vQU+N1{jjxCQ=!GcU~w2^?Q0G`3HBKA1?|
z4>NGpA%QzWkhI1L<k{p!_`L<WO?!*f&CIX9`c11(9oq2A{Fke8tUU|G?$E~!Cwf=*
zu77sJm;I8#no_@>x-ezMczj%4gk!t@j$4+YG6YwpN#J6QggmrnPcl%PNY1%3M2#Vj
z*@)>22OZ=&Ze7p2T0Cr@rg3|1%2Ruf0uG%ZXUUEPKe|PhA=c0fd1N?2Ti@&|s<_Ic
zMO<UZToL}fS|l;IM-t7mqm*jUoUnsXJg3%;-gZ<QO2<$#z%+m~@773wfXsvZejJNE
zEq$t_Y?!={Fb*lpt&le&|9vQ81?S4$GCw2Z%ro28sbiytOK5uIM+;#>K+u-IAB_qz
ziX3B?>d2+THY0BswGuyBuYqhS>M7~E(+(rck@05fa_x<(^{5+W)Kl)w0yJIJPijyh
z`QC4>#wtP#_D4+2ZPX%SVq-f!h+VtKwh$NDDCb%N8jtptpmE`h8eI)D(m8V}frAyE
zj|=a^C`jP0ZO8``$(z$%vb{p_Y@^Iv9m1FkMf<Cjx77VG|K))L(ZOeQi{lG6oF23Y
zzLwWBOj^rmE7X>+pTfm+Ngu65Z$RtRg?W^o2SccCMt8diY{=|={+{%Plx3x`z02^Z
z8`ib8wKZd!n~?#37WZJnlvhviesxQ3&7KonP?mK0=`YE`on3bv*@H8_7p%A%LY|4v
z4W$4q_7v<ua(7{^mi_o}4K#<J`3%xRfq3V<VcG>JeOH*4=zAKq01%}%GmQ2vWF)?^
z8#9hr?R~0l(Q5ay6-Ty^^Pz_2rr8`8Ejr)*)i!v&i1yYJgMWO#$O^t}6Xg>JwkMUB
zA_@Q8>&<IFE{kuY<FX^mo;#3-e<H#VM1&kR?;yyaDd}Zp{vrDXH$=Op71%+UX=AG0
zkZ$_$Hc_Q`^!w%j3O%-Jn;PSH=2n%gyoNN)$bGiG_>i_#TPo*e$mW>n;lis>)ZVcn
zw_O@3BBiQ6+^g-Z7Ok9Qy-$+cCA7pvMjtcZJR5FxggVl`wNJ`Fp20G|-&WS;>kFgp
z>{}?T(ML|0H`@>^gg{{PCF@nuoTa>o79&z8%;xTi!0GvI5IFtdQC)1^(qQhtCu57p
z8rgdwvlZt&TEn&iW-db}8woiURD7B7xK-6_Ts)R&>6TUt+fA((jVA*}pA8m2_{4QI
zjpuj4@L;O;Xvh9Oi4QoTulC*J=osEfm(et=$k7K>OxBBiXR$qI+(hh|xLRSY4#KGL
z8}q^2SX(TPtZW1ecj>s3*Jx9mEBax}Nb^g9-4-I83*1j{+Q(Hu8PjU>I(Rq<B4ljC
zRt}aE_LG&@CNW*Wy;tMhr1XIjt1;MwuY^0{7g8MU-*hHucf$YkxOUI+yJa$M$N2^%
zHSQ|XPKzH-4(Yl)4(zkY=Nd3P!c1T$Z3{@Tv7)&z`U(wDm0d3i2}CJ>wFIR;8RbXD
zg>S3#j%P$bpUI$Iv;Dt4Ws&q$aDAt+*=gb0;L66^Ma{fq&q#kev^W<vcQyZrO4M$v
z1N3mh9QH_f={q$0hlh=!yY41mdS6THSz1v`QP_SoQJ%f(^QRMdZRqg@t7&o0FQMLo
zAeMC_aAdFCd5zZ+n(oz}#;xt0U>!0%|0O$@n~cZQCUSuI2!S`Z)<D==(KxfK<FsxN
zdD*xvtd;G7)c_&q*^shd;ij9oqGcm#-)@Uu=8^u{N>x!=A*c63@6|OhUKeI|h#9+A
zI&@u%{9Vm!=hy}6(JII9W`-VS__uI;Z?igmKiCLv8A}f7kv^xhTD8ztGM2CFP9kV$
z$|X_rq6Qv~@eeov=BkcRNQ>*}LuN*-`IruzPyo{haKx<Vo|3Kg=yt|%&q?u4EGxNt
z`J3CoAZJCjCfS=7DMy2z?o<OPh`pjQBbZJ|(mc?X?{qHn_J$!;-%{{*j}$4|<xWb7
zc;#~B{M-SlQ0uJdgc))jJIq1cvSuOW32TPAP%qZM!_%NtQ}$eaJ;4egdn}XdH;k{@
z99~4uHL5~Q1Vgc%c1)pnSHmqiuvMFL(PkMI%v4%ZDY&ag9*&^9f4q!}a1Bhvdq|@u
z`Q|CdE<pqr9qq#$lf3fpP0ISw7UZzFVP}*=YfIrYeqlm0I}Oe);{9NQ5FFUJEPJel
zx_YyOugKO<_D)~+s+l($)z#JJ6;y(~wg#U1a|zX(@;wztd+_WzH{h-zba|Ly!jmeu
z2OV{VSSPDqW{Ys~PFRMHMm7fImTf2%4ZONPUUpanK}d2sZOz9mJwd*>_kZ#o$BxQ_
zu#5G4JspS7#=-+|xozx*@nxgQWd{{>@Q{iXlorx`w&hz$m1JZb`HF@`wb^RLrjgSx
z!@;i<9V)d>Q6z%qUopSjZ_RnrCvZ@Wh<Q}KTS>+oEqq|Ykg~LT9#HDuxP}?LJefZn
zVaEefkvw^aOWd24lftv4eQ^%GrO9>8`z590ojWfLIGzSAYS5Eg><sDI7rh%`+T6sY
z<N)8ttTyY<w5Q9(b`Gd$8Kq`K<0l@>n9qI6qcoTFA8DgNzfiz_uL8;QxhhmAXJ5LU
zb^GqwGE3*e_mgD|j6d(UOTV9g&yMxNpvjI(&Su^we!2nQc9%c2DG+j=P?IEm--@m@
z_`bq6Pd6H-lA~pZY3j*d;mW6>I}WF#D?0ldl}9(KX>51NEUFk|IgZ`Xr}v9<N)uR8
zb~J1CD37)+#!VLVH91~`&nt|hY%LF=@eTTYbH~A&g2=ivI;O_eOp=jgtMUi(=gaga
zi@aTH#!-Mcidf+mYG>I)-YbG<?6es_r)z)ke{)gCXLIe!3{LX2Q&$=l>Y-Y6xX&aM
z=p5ZD{nb|b5&1{=$p<zFBVv&W&J$0i7$~~<HkFG&3vY#@D05)rldGc3*ZK@}^mej!
zgw3@bF*+48@<P;Xp2ZDU1*1R!^0PS=Y5_W9NNh`dO!8?U6yEMnZ@(qcKL8m5BRaVl
z<yUc!N~T)ar{9PcKI{Dq22{izc#2ij{AR_8+{#tcA_)rAv_@X_j%PV)0@vmivEKd;
zBYioFi3q!0@8H|zE0~b#Xhkt*)n3nFJ<#Y))FExHkPrFFm|pD~kJ+D0<g}^@EEsO!
zo+F|lr}`t1y><uZ96uzvD!R-!5Gl@edHpj(gOU<q>Ek|T?%Er|$eV~^QS9*3h6ES)
z3p}Yt<Gbq!xg;Ff-hH$0tfgd^4QUAqtAW?wXedI8xE=iZ2f(;mbc&(Px!;F4#{y+9
zO0}ic3)MFdxr<-tAv_T=0xy-8fsoXT1zwl~R$j_H;V6)ct72n6a#&I+yW`yG8EG8R
zd7AyO31cc~nSi<+=}WVTvFrXzxGS^_lLOrXG@G=2A!X7j8D&!vu>?y=xK!S;;oNd#
zNF5j5SA^wC6b9}dgTW}vrf{n&y$zh7TfeTDDMV~`r}@=x^|sG_*O`GLDeU76XdIXb
z3h(?$j34wtM4uK>{235R)>)J@+CH6i#fyQ{{u@%|o;=N@T+tn5QHZ0|P?x#RZvA1;
zo0XN7k|)F4iu74;CD-oy72PCyviEnG#J~ew2@3sP|IPy%|F`-<Wj<W$A$Mf>A)b#5
z5+95PjT#?`O8dXpFWD7Yt8>rgOw2_9-);>!eSU=!tsK$?DXGh^k}PTv0J)|%DkH(A
zLUhnBc*!rLW!7kZ&{%h&C9mGm@BV38Mls4;10klKev7@3Ai~s>mZVUftI4m@<4roT
zdR_-6e4al;=TRFiij_N1^iU)AC1Yi9@P(<lA$)!>3cGxQ5Wlu7S3UCBH%sa1#hvQ0
z+w8DS`pRzSRg84xMdO3rh_8-?0s6BT+5CVD7IqVkB}=UI-_vE;!l~QDWXy&?k(X|z
zYn0{+o5ZF_1#(DHxTX$+Bw?~Ab0L*0t>)Mc4TE*VHg7p~?4-tXUUE3YQ*CGabTjgz
zHp36SII_Av=B*EGC#ywyeTi$cW36W6_!A#`jW#QXEPTl^iv|;FsyiVdkJK5eSB))6
zjG-;L9)2|=QMd0yH|0~j+`ez77CIKtqyD}*3{uA?bcVdmPCux7L#E=%Rjf~N@x;_~
zpOoCn4#SqcVPSOa_7Z%FMn!(oyn=rxDkYg~jg%%dI%HVd39p$TjndtvbW-S0aI^tM
zr4~DiF0$@`*VyUXOcWWO2t(h~U&Bc@oLk{HQeok&AzHBtS~_MKn9k7{PbMa^Gk}8k
zDf#>h=N03f=py@9h}&AP3LPe`(XML#5p?o#Z{>v+V(s>-ceqhxomm<2%N!RL1eDsK
zh&NAfH1N$c>+t9l4(Fulh9v4T`boDk4?;IWH9CD}na9#=5B>EzjYKw$(dGSo?q9>$
zcQ~!|cb0m_<oAwx0*oN*bZYwL!ZoqbDr)sv0QtqCv$t`!r>rA#_xT+?{++VCXtg54
zn8Y!g>~;<|l63T#HDRfC&2POzxpF3=bw_y8mdE#MBQywJBm72?_#K@Eh}oy>+-vj?
z5xzPP<T~X9qHp|}T+zKBL_{BRJ<@v=I{v8HzJ5CeU-kw|aNW}+kZg&NHGzWgqDhPO
zh94;NdvL=gSjFbsNSzXJcE*w=<U;WuQ^5`j@bt~b%Dx-Ejd@)fKl;3RGU`J9;IM6s
zse24a%*XVkAc`(ymgbQI*(#OrFSet_h+b+bj>j+G%&#u;WW)6fX~Ed1K}sXL^Iu%{
z!zit%$NKtAIG_1*6Vc(5r;s0&L0HwI1NAksRq_fZ>4`2d?FhC$%*D*#ugu9=HW*t1
z&?^i!aNC;mHv7!uJ*APZ5pQnT^BwMhWW3e*R~>eOLDDhD$mVw^+}E4;0WZ`iSQ|Il
zhfF_9Gp|*LB)?fcFmQ5m>X4$!v4zlL<e?o6I&7;&%|SHG#V!d#j!KFT{mRUm<e0g;
z9z+c(j2+5G)3q=au(pbE57+p}6$yA}RjHc;cd>_gN@m!czg>o0w#!T3d9kn{eQ<F4
zjqL2QukD}eEECu5fjn1{D3N{EdaP2U#r$$1Nd!mh+pq5F=vOx=;2d$<<?FO&**1vW
zxc-><cm@-?`+xf4$F@=e57@_4q~<n4w8SG|)NHOU6s_ZpFDs!}K>gn_@o!JZ?;`Mu
z)uPKn5!@sp8%SOo8$0xD``1*~&&AKOjWm;1228rkbzKNH2L60uvDbLlL8SIF3#pmp
z@VwV$T3q9YM=Si#H1!#`FL)mz$?puNOY%Mz0XUgUliVsSkCL|A;uN~e-zc1Ezx#(?
z1piFC3^FLuoS;;lH;km)yCi61uhILSn#iBd0Jt>k%1u9_g$bnq^bn5hxN8VhFbg-<
zP`S78r<HMM1~M)Iaw4U1O^jO0?ZLH|ISJOY&5@so(wq;6Nl((|^EutPw}#;y5Z?ds
z0C!YFCRii6v<OA97}=3m3(Z>mpcu;}?)sle6F@7sjSE)i6+?6xvAY2_A<X3Vy{Mon
z7zaz%^%MEOOVmNRAVvMwnT)<rH>M+qJdb4g!1HRXZr1nq{IIaQSwFXmk$u+k3L^jT
zr_@ZqOaL?3(D772t6ip>UOsFUV`OrYJ>FjdN0It$j1;%mDu11NUxp7n<SMRH*T9tY
zRM3eNrj~lWy*Q9wTH5_Anq!#mW+91(5;@J8VvvsSFQo!Hv<nmsZwp?d|1xRa5Paes
z>wf-E1iTu$H6{&MN+K-cSfPjrBRzL6cJ`dGh+`LNaI7X>MS1gTcRcsM9NQ#h0&jP5
zNlE&~06b5}!d%U=Qmt}Fue5q$RE~FZF5Z}wj10FL``}u5zjf{iKnBNNrzhQFG&+BB
z^I~6*Gg&11)ABxW{1VsaPmCfv^KZ_o$~d7ldu_063*9=sB{ICLZPGccY6!nmc<tLw
zRS>3^FSOtlUVTJLghhHFqoqUX4CL5t^&33>=PFDr9#Bxkt7RuZn;8vvmg5W4!#P99
zK7kU$g%<nNP|c~bP^kM1HdI&IpW*ud`6T$)ryVz&V__T}<qIb0)AyWl=zI<2aR^^F
zBv(^IWI$HBn_n0cc4A-81JC^(<x6!X5tQ^OrCBteIdg_bS6cj$vXUO{aL-t%!UHhB
zNux_dHXdj@t_G#*Mvr;~wY>5oiJ{|3-u=wyrrzYe%sgf4nI=F!&#&S|@A2gEU+?%I
z+u`=~b9ME&rt82qU=ZGzbgDM9;;_7e5F0+hqYu`d{aG4I=51^ZV*MQ?pgs?ZJ1xHL
zY|h7V;&FFI&VBPC8vZT32^!A1wAIdR#!f&#!~^}1<od{Z>(4ElUOp$S7BN#Po05jd
zzL#KZX2$CCn3Q?k5*ye7f+D?0QOqcP%(&gY_;QsJy{8*PXTI{vu0p~7{eRgpP`=il
zD=aGFg2`5+=Z%FjlZx66Reh{jTD@>kpH|9*FO^y@+h}naS8pKMjWyDkE3K4FWC!_9
zQNm)vm#Qjvg^Mhw;tRZ#OjFVx`-jgZxFoyY(iHFypAoY@)(g@IvAvhQfoOeTbu1FW
z3`$AwV}<<Rx-gab8Wnx7t1_E*|4&^`7T}JXVU*cvg^^n`CxX`ZV%2yo+6TGidQ(~j
zUX1<`Y%wsmXg<i}<%4&;uR`1}omY&}&C;HJJO#N%?^A6P_37mE@YO%Rg53M978s2#
zIsaTZC*9YVsL;*Nopw^MCs7CGff2$lLS2Q&F#P@z?|M|FS^hq6M&nFvA%??Cd-&01
z2!kk}Qy%q-T0~wM<M3SGlh##5b10P6xPmQm$Hl3OU?=2_>j^f=ED-~Hy2AZRV5-p~
zMi_mdFH!UO&L^3+{4l#JDa2Ft+m)`<;<w82hZs(fk@{L+ftiWkMpahMkV8N-tX>ID
z$id>lnrfpdEBqpy3YZD?lk}{6euJU^?ZUJy8&?Qq;aIj~dCUT^@4`*L(g@;{u^4c$
zycC(xOVOG@vqE9|(>p`Er;s$2;rIwCZc^2@epNi!;3tWwkC6LDdTg0oPFkir@6KUJ
zS#RyJg`0n+*(W@&C`}Ua?iTSCv}|1F&zB7@C&(i9S?E|;_c&Q@y_-ta`SR0h;n?cM
zoVJ~tss~+_b6}Ja)56bea9CFv@WsI<7LwA5CtFP+YoqsxN)yOVzSOa~+~w=}h2Zz#
zFf#%J$&JhR0U+X3<$Or`lGUv!Ag4C$4@x{w9P$9M11KEr)UrSPnn?j$`iSV%c3x5J
zFLc)ePi`_){UTOH&up!9d6ZtBYlyRJ?@#upelJ!frU*&CQcSoAMnLg1z*Spud~rOV
z`DUdqRA|!90i$TkctVlBX284I_cklWKfICS_YMs}Hd(x?1*N9aw$s`u9ELg*K=B_%
z_V;g#YJeeAr8LVO6zx1|&91-1{RcU#drtfV{x)mmuiGDQ!+kf%Q2(AhS3kHh)yW&b
z1VWX3h%Y<Ln(XJw8aIhBJHraRIS63&%+1RuuJ^2|)36wUH;jj4oj_HiXqSr<O5r88
z-NP;OnJ2BVUt5zihckogzW(%}^^<>68cf2_(DAO!wY_1`TD0^_Q^0)XQ3gWYvyYii
z-aYN~<N8Ld`fc&aX8k66Omn(q(Y`r|edQ-h=x}f0Bx`!6kv78KAf7*5r{iE5nBmaP
zIB{C}7cVt7d%v0HWFxZkSx*5wCebCPDI|kGYWaqrp<?A?Jjyg)#Z3RLMBktD&u@dr
z%=0`!?9Q>V{PyXHtFbX@iwx89q=n~Y(h1#j_CoKiPrgJ8ln1+h&t$EI1RFw1g1)$i
zBv?D`o#clzz_8Yfg|+7^<E~S~U$D>d{fo~BY|%CtyRx;)C*1M4J&iXp!TO#2=~Tu6
z%@@6OLE0|#MV;R*EG|cv;mQ*xp75g1xZS)sjSzPaMBZU9Dw#37(o)39LR)RZW?Zr3
zkX`3O%97?_TflfywCjj~&Sq;+x;QP!Cg*Tv{XPeaBYj}t3A(=*^Ep=lNxnJF&lYNz
z;P3+GnbyH8?F2veY7WDrYQqw&+hkAM0u%5CK>rBsv>*WwLt4Y@5(Pl*)PJTn4pDco
z*^Gv$AV@pmWr4KQ13;aBrFiOkd_KN&{lIGxf{0$>BU6GC+<xu3+Yq1Pt?5Tt0FtW(
ziRLh!N=1dp#%OzEE+lXDem?bW09`_KjbAgc$t!z1JfFK`g;t<jbt`J1KS@MtIkz%C
z#g`+vwji?Me%oD^?-3SYqV~4@CbAE}#<%;Lo$y=FoI8I`m%7bB^~<A!mW#DMpXh_V
zoqvt3pA^+=PhU{;$SaFirRU{!ONNqi<he5IVF2St=iMj?>V>dw<EiMyC0KuvJB|Fz
zf03ViTKGm|Z&Dbxr$BDtbhmJNTD-zbX_~iCp0S;`3}4nmT`0Wg#=CshEa3QOB>oxE
z10p|Fp~e?4$Cu^)baazUH2J$y1u`+`l$|nNBco^P4`A@Xur>6G;bn+83t<;xOc~7*
z^)=f8|MSD7N0}-o-E@^q+UqWz!rW&swB7!F99g&56U+FNHC?=)jTt1qdv(geZCq(=
z@}8dNjP4j-U-4;EpD<8m>UWnXdw5HotqHRg*X~^XfaoNLFlhYmUdmp-y1q`s0f}_|
zqIUh{l|Pt|w{s7Scb!{K-3@HdPnF{NInBr^(ejO@STkmGfj=YWqzC<8tOA_33{Y$L
z4nr5BBQfTf9fg(>n{H8!Cx3dqXD=vIv&pA!ZZw(bM}P0Iuq25n#??~wWKFk$_HF^5
z0%4ly>0#QPPgVeX_8O{n(J=!;!@9Ygh$Fj@06WEQUdj|Rjm!Mx;BWFZj6UJT+ZwPD
z)`WVck;f#$m-3#)<Su1AJU*9iklED1h_4XIlR5_+%dz$V@u$Coye2vLc|E$UU9kJB
z#|bNa>E;cfOVh4*x9SfDSlG{$ppJc`gnEeC*PHTrzxafaSF|`f{;XmIg!%mhpq~h)
zMcMdXiXR{RY`oFniAdq>g)5hVVet6`*Ei^8({qf}l_oU*?4fMv^IH(Pj)}(ok7`?A
z^^3#-eP18j=J>`+Vu0B{l1wx1DRR~q{)59kdh!<si!ot^0Mljhg@ue$II;H@AdVVI
z#3F-8>Ld1P@qfH&&a^li0J4HDW`SgcHt9bxPg{4svcme^);gM&Cvgnpo85z_9LcRr
zwYVRE<+s@QSJYH~YanZRc7oF#E)daz)`X_r0F#5T`ke?Ct>}vn{w>+?1|iPaXuY?$
zXKIr2%&6EiY6VEY(~l8%`3Vjq8`?bl3}SVQ2gefN^e>x8b(ZlV8hCRUQu4AwL#6jM
zqp$lZ$&JsZ$2ygJ1eY7=BJC6!0?C02U`K}GH<<tYlm_A%M__!FUwMMhG>$7#r|3a^
z`eP3kI2h`@@;;-YBoUr{vz_*j{**j7ryJnRpq^=Ed~#tmm6HC^pNIzf1{w<fh?%J0
z*IC{Glm<zCrQKCN0!doAygC;S7J`iSSky_cW19wO;SJ!#y%Az4DF_=s3Q1!w+I67S
zyp4NWXg7RpX_*?`-*B=llwNWdKmHc@?+mP5gD+cQ<bU+hfP1d5KrZ}rM*pqhA6!jE
z7<X8F>da3i34Nz}<5O?nsdoF=a2&s~uFF&R*Nxu)XjlPR!Fw7%$czAOyZ>TKF+lZk
zi1h!QRQ2Ig{3k>4yom2QxXaDwryQ|{Cve>EHS|V6CNL4F_$LgYdQTDNNvpS?P4dDi
zu>A2-xF~QPrfBQ=P6lg10pMnBUHQsTA^OnkjM!~&qBQG?;VUPv1m6M!iMEG##0g4-
z75CN?aDd{<_y9TS1iW^@`{>31cmM_Z0#4ECAs61=q6Z;HDr@p$21uUvrq$b=au-Wr
zCYXTpgKhNU5Z>Lxha`WGw-}WClT*)L0Qb91f3HEQmr+;X<ZC|=0upf(@Hx_PPU94t
z>~Z`yG9CG;7Kwccrs{NZ3eF&7_K!;V2Z6ZUH!_*7ugW<NLCul%A$*FC$mnk;6_DFw
zkkJH%uqpzS{m=7AB1S}Ze{St;NtzSU`*Gfv<Pt}?oXAN58_S^e8Ds#zVjWzI-{>JO
zak`GS(wWjID<D7$RI-JcitgY1`JvZY>d|FHoGb$Z4BKE9UaVZK;Qh{ZR=sC0Ug&Xk
z;hv=O8Moex6_w5%6+8YtJ}HucTrcPqiZS6K$G4CN<Cf-a*8eOIJ@$8AQkw#)iD056
z1fZYW!=II(JX!dj1sIJVwo<WeI9}oQOU>Fk#h8Sb?xhXS$yoK0sqwj$k^-ejv*Of-
zkL!A!yX$&|oGjrW{Y)yHRwWW$wr#3-3hOUi4h!=ZoOMtL)0M6bC<&5rBG%%o{^>N^
z6$$@dUF-6#V3L<KwWl{zQ6riz_KPN|%EJ>13z+1aw}XDYP_W1wt}1V^u_fSo6|&Y=
z(nlBF+)P&)49e~*no{``zajGqqsw?hy)}kU(;~_jHVme7ZT3HV0+d7Iu-@0oIqf?;
za)v7{OD`T7o}$gpoEttzL_f4F!>T9SU8Xh5cO$y2sGCgh6bU9hCjsvLoE$WQr22=}
z-&O)uxK4*Y;U;oMMk=ITrsq#OV`86mUS|i(87}rq+nG`qg)}=BKl34a=?q9&Zh9hU
z2SM5ena;)>2sP^qUt-WjTW{a#fgr8AlA)q|fUqSy=7)tJMYm2e%xgU2JChvEpt7w?
z(s_@J`Q_c3zSonYyiwS1dGti++tA^S?Gumt{NWsbbQv=_JKz=%*3Vml@9-E|8x}kU
z!RIa`qtfAg-J*rXRUR#^aY=QTe>kx_50k%h@$yE`rPFcREi-^mc|}^rV58=`)Q5e~
zBR5+cbBugW^UW2g*@#NbtCiN1Jp%$(YrayNYv;GEaG5?#+YC+ToSd<3z@=jT*@D$;
z`(j@PJ6`WpV9zZSEife4i$w-QmfXQ=m>@WR)TeXgfIyvtqOT55V*8i+mu$830DCle
zoMPkaeqFTUfOxI1UTMN36A*AV{gUkV%gJ0a^;uv=>H?{s5p-xXX#Gttb8g}@0hd*(
zRpQmi`tG}nzKesz{jz_r%7GmF^=1vy>VZX!MmE-J+<KgFu7c`E<G3Ct#2&;+YX#CJ
z|DD7<W_OKGVpGq?UhW;~Q^W(itl8|7dRuAArn$&jdm6x`6NQ7ZYi>*55A#Y7j~2SI
z4~kcDyEI%RIdc(7wiMPid^$p2j#oE@m{%P=UqIxAR2*{GG^ffRyGpwngH179{f0ab
ze+XZ<EDP`&acx=O5Db|NJ_z_auvz+QKW!rA_hK$QG@dU8AJv3MIOLi_ocQSE;5ddI
z3X3Gslea`&#NY3G?bFv7Jw)T8rB)Vk7iqytD|<%Y-`?N;EjyA^g=!y(QI19u<%UCM
zYi7$^twWKwx0$z1gb%fvY+G&B0^zi^vAg4qC^{(by33c2&CBq%vJC*X*<{UJjePY)
z$_pf-pW*SUKkmIz7`2r8Bf{!Q4gC%D`Qydv?&a(%CH&Xo9b4kBp%QLiP!kEd`vED^
z?V12UuN~PoG-t~B)-=gi(dYmEuT?^{Qvj+3MGA%EALLGzcUvcd%drA5HlE{82hEhJ
z#cmtz`AunE3Nc*=yY{<Tz7e|yrTQ<4S=Ya}pr%sb9ub;U$E&=1NoJC2%>H-{)S{SN
zb&6b}rR|fh{iuEvWLpq^5iT)i``y|diPKGx5GzFGiQIJC6cFlW?lwyp6)JT!e^L9Q
zwgs!zV*B0py1mv~rQ0Nd?RsTWN}r)BQ+iq!&NpLkY1wD$Z$>JUj-=TC+BUkuGKbJ}
z37tHV{?~%GbG=FyNd;h|Pge0(ecwz!?kDRfgI0gvt^@0V4NPTo3<<Ugqu#vqzqdHj
zlKq=<D#&fkCmEgjVaAHYH6{<7T|Unm>}+*J71#Dfcy|z=6)L0jDbFi|WwIZyrEN#W
zycUUS>Ax1X5oHQBlASB<2pYr&4chgJu$4rvIyMt2T>k|{^0!%YVUhFCvvsm?Gk-5n
z_3EZ|!wZ?US+(t1wdLkz=56KXnf6)s5}(z#rT#wez$gI=$AOmho}%oirKpI;=r)i2
z<JB~Xqc3AE$`i8ap1M$`7^r?0YCpW^?iA(}wimQ#$v5C7gwBFH=B{fZ%A2jt_=MqQ
z37b0IfDKlUDWD)6U7OH|n>e*q`RRWcWa*%M@c27HYvn?!|4rJfnz&=Q{pbJxt?;k7
zrtY-hGhtLjvhBo%&odJJD~yW*>9h}7y^W=x$-YT2YT6F^p2bI>!2Fk7Ce@_Yu*{(r
zoM76P6xI}kUSO^~iZdW^(*MAG#$K;l$YN=hFOxXyuNAl}__6j0Q(|kvz8_d$H_#-t
zCb-*`B}vC@GdJ!r;3O4aMW}$Y(;~?2Th7L*f(OS#A1~ix%WnKJ!i6zHzI4P7+g4Y`
zb7Kl)3PKr<^6>r5_f9^)*O!SU#sK#FVy<$o@sh5cwvD!7&9>sz&#GC@_0u1(?IZgO
zXhyJ%v6C4Zd#Ep-0pQcCw0faQJ3DK`?MRPwPSKj#sEW7IGi@#h(@tUYwn?;bg}FfL
z?Mt#QYX#@{yE&`n%S75LMJ$=S{g(oe0^PP6&KF3;wrhTdVEWmGN|#XfcxYO%46x&o
zLcAEQR+J1><<%laGiyZ&sP*5gcFq1GOr?Kv^43`7@!Gc6*{B@GnuE{gO9h>6sRq$C
z&K92uR3LqLIV}f%dLhgryZFV+<Yk206+c6k=<k1~)b%D5xpz&QSfFcLabnv|!_i#R
zUI?&|$;zYZuiKAQzdYyDYKd0BGM{r2{%DYv8z^I@5}3GRbfNz~%ldbz3-wEnTgpYs
zj+bb$$fb6xB`+&@AGQc8DJEQhgUUsmx{A#v?zi=E-+!{?p8r)D`#fu9alHuZ_ulCv
zt;p^tF$b-AKDbxk!m*}hQ3?ybXR4cpP^bI0^`_<}Oa1lQT}nDlQBBb?QI93vMZ*8b
z+IL4anRWfn*suXA0!md;=^#aVb5M}prFZE9(mN4RkZz$9igXYO(jh<`X;MQ+x`1>-
zsG%mgCpz=qZwPbOyViHt`3E%QInO@3@88~MF{+ZmHYQ(^z09!Cyl~pqsM)}gu*wC<
zc@23w(JPe`V+Pa))J}sZk!mR!VzOS5>%Lb~kR+W;t70&M(%BfDty01&V;QzR=>Jkt
z=u`fJeck9&-1X|&C$)FD6ztbx`2Etx;_M5|@w8Wp^@Bc1NEk4VGWL<PNnz)$OeS|#
zQ^8j%_@%@J=)IVp_Be@P-}LW7XuCr9!uA68-f!*&><59By}2JWr!4bqFAyyA`F_UH
z3c`{`*Ufm4AVlv!+e_MmL-&%Ff|jzOOF?sF$Yfgy4;m2>fb6olm&Lij!pFJz^mD-e
zbMFA}Xa9?JZOi+!rOx7tqjKR@$uG`nq=vVdf(R<!SJLIHRFtDz_a($XkA!59WKebs
zO}-)u7JP96Oq|^@q#xYShMnWgOU+AVSCe!xbTZVMs!kuD0t!dTPTODG*6%_r+hyfJ
zr`ex8(zeCwAwDL#q&-{ny$x8u>;Wz@!7_={3Y2GamV`F)QXfdcNI0vwD!HZ#&lQsU
zd-Sb%1ltw;==t+j+3E8W_IYi$l&t)-Ev`!>Y(@hX1Pr4S(9rJi%K&Y8K%N>qgEcVW
zmxq8=N>=?`;QRl>h!R_uz<N7CVk(D~0!tOLb^JeqwRi9X_iOd-UE^r`$k=MAvW?vP
z<+$iEzOYEx3bZfkGfz@zEQ^=7HNC2ACC2o+Z~X#b>}N|EmEJ)=^>UW~;<-i6#gAtG
zjOvaWU=6C&c3{6^h2r<${8F@fVd^jqMpdxR<M*EJL&5UhnV8!nt(qXLEr)N;kU0%<
z)t@U@%5Q*#l%9UfkF>^)yXuy~H{NikaitdQ7wjM6QvZvk>Ms7>LPy?KP0LzjV_M%b
zKP=X??QU}6tqs0oix*?Ty*<Y!!AP%Pv|Rv}U7N5LCbY#WcE;!iGvo*d56Oerso|Z+
zoW}a6sx!u?tG>FZ*%|wL96I=SzM#^#*UpWkluWS`8!W|qugWIUCsl*8RZ9yvUCBe5
zsC|p)F)xSx$~-Tvpo4(n*jV<54<nnHJxSc=W8yL;h=pDp1Howg?5t()XrFac1igi%
zAn5|b>xPgoeC<c%3sj*}wGAOPAlvo*rJgTHC1ZE(B*#sLM+6sxjtG-}KXK~%9sh$X
ze5MCF@RylFuN`V|voNfuxYG@B@uS@4YbQ^E^!xk8hQLLM`kwU|J4Fy6<R6s=Ih}d!
z4hRB<ESEy0*?KR5l8mxg(h(u`u>ie>5CE=N!Fhb3w7s4st8ZPkISZ+A$k45D2waIj
zB4&`f_8?$QpsnXblD!SfW4*m^O|L)^%X59`GI4(4`<e3%A+BcLC<w29`?wKEy^Umb
z#@E$BQ{3cwX_wdi+;`>M(ev}X?2r61&lWy$aNy05iQtcjU}`@t{OA;Mg!Nm%^JBFF
z{=EQ`C*Zhp$Iwt*w@qcl@~w@7Z9$ml>xP7>DW!&xV&$tx#F$b;$94gz<(p9V*LWc{
zgPNwO>1e(Qpu0YCM((}ikej4AwiN}3#o07m76oB*U_8Q72|iTh<Z@zkbktg}NiItA
z$Q?PK93FIRw=Ly&ShnsR7Ab_d7^zfb3Uyzb64y<D%72q^N_R#IEFF<vX*ss$luiZz
zqs!r8v%;&n^UHT7#-n3Q<@Ck+rK`+lXv~eZsp;`Mu{_x=<x^%y9Nz^N<1{$DxxjAX
zioMB)k20VG=l1=Ch{fw%moZ&T%9oS5js&Wm>El&?%*Wxj-;rL!JyZ5{J==2YMO$Ja
zliX5_0K$GKIAO433pOC)1U&~`cyvS|==T%y)bl75pPi%;<42)%rx!yGBdqRX*YE#`
zRb(EgK=IE><4_dLt-qTeBW8*_)`S}V4;*SX3ZS2`s(>rDhb!vpa%Gbv?efHz^Lgq@
z?JcO5GatzbHxdVMpeaHp;4WjCmA%<Ms=S=%HtmbhkaJpm4AG_dTj1<FsgF8)y<<)Q
z`qvN$c%5OyuMk0!eEAaeY_ok4o4a?VLFlwX+{f19tUuNNE!PTKi>{V~$p{84jh-r1
zYgt+L4I!-(Lj_0REPh=48bP5{ra)~i8~w#M&XjfeUJhs0*_f9DwCw;?GE=1&e?;ly
z{2$ktFIa#aDV_D5HK+t?bJoJP2W6|<i3y<~oqAltMoh@pve%5E;L~&=6f^n+MqY8G
znz4A)>XKGfa`vP4IN@RPd?$(XArGa&vp^!YIB0!J_;}Jo4}e!WUhI2BxuoYZ3mtP$
zZ5A!s>1ym-J${=gK~B&-HhYj|&%Q+qf2;k)!s!liD*JRaCxFBQ*r@GAJdc<6FsPmf
zWfiO3Jvu25GR`*Tc)3tK2ouFYOdjBYv=KprlAjP{p;$}TgkPt1%H#y`Yk+Fp&)2vq
z*7toY`a^~jFGtM3RpVZRhC16g?yg_;#kUjYO5@k5BegSTG%Jk(nQD!Wst5d!w>UF>
zPi`6vHQd)MxpBlvXoFJR<#O8mhRTkjzOf08R?)g5lH^YLM56#uP1Mjly0QY5>N^jc
zGpPK)))e@~5bgwr@H#cO-Z`S2c%@Xz0m^cl!lN?o^3(%R>3YxL8e`2Gvl%IZl9NSN
ztv=z4Brd0A0yy<wr@(rdv1b<m4(Do)N?cvL4C-!_wzAPpz97D8F86txt>S)KUuvPU
z?sj39GiztgoWX4LD)$j@UM{74%~nPcDI9Sw>k8T_BE9t+LqcV5-LY>BM|_$f8eSmV
zb%haBAm4g-Q6?I->^|0+8aP6^u@QE^4xmlE<4jlIwGIJ2+G;@Zgz^YRxUH<IEY=)#
zyz!$WP;1*&k@lqHa!)xkYn-rGeiaTcCm&(TKxz6X1G(m!)HI{g!%-k%r9yUe%@mYD
z!*?QD23J@teF*gTXlpEUeH*Jvkm>`@vboX4emg~N?YJS!q`XeSv9|D|YTQjfPNW0(
zATVT3lg+3!)81mhCaG`u?cL7P#I$-Q<@HNv1^?7pk#dQ=Lw}Z8zrC&UXJz&hS&sHo
zUxj7iiob@!%qlk)=!(YkAw?o&6qJc3PXM5?QUFv6Ot+K|J*RaCH!ada`3d_zF$9im
z>H{6_g9W&!WmgAzJD2PB9Ui30=sJSQwUz)lZkdzp4(@XcXYn?qI-+_RO8HaQeK>^*
zV!N}#%Te|HwSav7yJGdLu>y|c%SP|!QsbMNE@nI3&#-x7yUDDL-QYtWv>Z%=`_ujP
z_4PX*Y#^DhXl<2zCOe!My@CV%oGjd+l*7P$7K!^h3kIFZ0Nk5^<iVeJv*GZO_8|{O
zm*r2g!AUA~kl82!<;`F#1FP~ju2j&b_mwT?RpWUg2ZBYP04oGM4oBX7(bFLBpJ&{>
zRaC-6C~Y_qx(noB<zRM?b!-`Duj6Yi<@h_}?Fl7OL->vT1htIv)<o@yH`K<yLt>lX
znH;p?%e*6CP*@8Wi&lhR2|3ZzzBv=-DFB2eNd)?Z1u19;qVRYx^u~Y8F_m}FcZvc&
zZ!Kp5ZV0Se3?96~x;+9qDswX;S-i2}%1zj83$s63q{PrWfnSG4d$XG32vc*JfHLT*
zeC=?*x!(E0hG9_FALx|c6gL2EcJaT(%OQ7d5sWZEsXKkpHDF~eM~b7L@YxTSRt`}n
zm%F3%dO^=>`M9?o4ZD_RV#Hw#bkWS&U+ikr<Z-jZjb=o@r<`}`v63ylZ~1#r<jsMK
z3@%r*lg1V+|3++b?>sp{(CZB@H!*KvwQqo0G>?0ITh;w3=X?Ifw}OSVtfdB_8|?iq
z%CsCxP@!(9*MQB6-S(zy(k+GIc1H$$vK_}wie^G5HGFxhSi>JqO1+cw;X@mT-sW?H
zkP*5Z&vJA;A)>m}HTwUsIzc7f%jYfE&Ql!qht5Z9s5n=0#Z&PJ#<RX-j-zJ;m9Y~o
z#HF8Hjet?1ZcU%elfxIY?o3$d^iU~nX+9FE?-|gj5SUBF8^%4-hlMC52_z8)C1owd
zawu$Y*L{9ie;YEtu)yPpz(x|l;k~_M_P5K+6Aj%{>=P4{4jPLkAgg~mZ~VE>SlQce
zKlsKiZp5aT{_4RXqNS#;&WNwh!q@E1lm2|IZ2JY?UK?7mmOJ*t0+zGwDAdBcCd;b8
z$M$d0eEtWXy<`3M<GMB9=mR&Mp;h&Y75*!Fio})bNw!})v|q#bp&7NaSlKIzTgg5P
z&&oa5;9TW5B9h8!gnQb{KfSNiE~gwZv6+z%*(y!oq7{6*6H)Vgg%Q62^%`|A1ea*`
zfDV!njh0V^Mzu}h4C1ZseY8swh>cD&zAt;NYbsEo>kI6B#8}3lPf`H50F1gvs-0X$
zNX%kpfoo9Kqmi!p^xZitF#Bm~sRH5GbAW>3QCwwrX10H}u~zL%^p1=qxv|QBpWozD
z<^g@3>~_^B0#<Z9b94z!V%|bMeSMF);0I<UruE(~)1;D4CFElB3bX9S!d+n0$neNu
zk`LPNGZ^oc{VrYoxx7`1TeXdShl9!1R2X+sFoSP{AJRNhT!cL=y08Y!t>QBlUteuF
zrBY2ttp3lF1AYPnYg_y!<81QkT0t@UO9@u8{9-o@vX%6-m{xML3l@(T`W~jc7V`&b
ztar6f`*HGvFEya4zoeWsBJ}2XscC&v!zqQVhP=#AJ@w?+o`+EDJ@?)Ys2@fEv0m5w
zMwZ_6rbGj=x2vB*pdT<eJ1bRYK0TBK<OKVe3s>HsJ<^wIye4mXoZKUgjpa5rb=X^b
zKHm!EwJ5f)?6Vpu(4|n??;Ns<r+?CP<LUtDSRiyxcC*iBKM`+Su5Rm`t(v2H(0j9_
z2lT}aJSppc$k&5u(yxA;SG6@DI=Z(%bgf%WKqph$$||l3lelD<CZGMFy!sjEt=E*6
zFTMY2FC5lyjR$&>m*TeK9d<CfBYS`1ZsJ#Bfw~g=OPQ-*c6qJXS^i$(3Uhwr0U+eT
zJH+1>Or>>~uE}K`@Py2La<SDkuPtNPgAp)-L!W6V_NH_N8E`@6BQ#p-sK)(sywJ6`
zs)q{HMW#AZYBdJ<iGfEZZ5O^$1LdfCYw8~0zo-Z?xj|vkhm#1c_6WPDt(<RmWeGr(
z3j}gH<kwtUdG2CZ&xo~L7b&ML#D6+>*5dg+>LJ&0P62^IE2>f7BruF>Kq=_&4)H1^
ztY$rbw~CajrD!Z1)ea^I%#`oWN#gs(b{o)Rn^;Lis&J3xowxVO-Toev5RvLJE>`l9
zRHo%x!aFLC$}vB(;|4wR4`~=%uE9z~_m}w$&!UT%Q}Euxx&xAAS0x)T7|}FDMXIIo
z+lAB-bjj>|27-<8Dp5h*B>o&w)nN8kqW8$Ln~fo-E&{bz$U9&>T+X%>u4rrDLc?u!
z-;7_fcG_XvyP{I)4MM5K+YfbD@IGlsBz|_VBS*3}PX9-;2NfLk_0<V<C*nICluPp*
zjOtD)_&47Tk?u(H$PVLdagsYfzYTi2?U|kw-P}-!(Ab^mx9`K1grRh{y=Y5pZ5?>|
z%11h5M52iOt#Ud5uzcf>JzGu=yg!4Yuct&8^9o#%!d|2!30BFo!&Y0vXdGq)9gp{(
z9h!G@grjh0_&iq5aCMbF8QSN%aC2_@UFv8D^l{F9J!l!WHS)wYvOL%Z;}SDu<SuDe
zAA~BjfBR&fu5}P3=ih1%sh%*Ad#+FL7r6K|%*``={J>a>1vlmmLHl7kdTE6=p$bXF
zpKlRL2@8&bP-=P(qCRISlW%8!8Nn^!K%ZBMiKLJ_u#_B0_>fZ}C^9H6E<Wp$nmjF%
zxVsj^?Z37$3nuSH#J(fP7r{b%wF`E6Vtq+tGmk@EU%Z=)H;)nkQ&pn&3-AZCf-3QN
z+{lEBnRr%H-c6ay0y=LypArm9h5Z;Ku?l*U@Uu1LJm@P^ixNf&Ym-=HfxAoK?Kc&=
zD^wC_Pud@F$TLGdYld8q;>C}Qt4ljZz1#i}R8qG_m-a@^Qi*brzRnEjp3ydV(iDEx
zy68s^D#bidt$8>t`n()z?2j@RK?BG;JH@i4LQ%N+I|d(I+C7ehS;Tk;dG5=F+KrPP
z2lg9RiCpiXIN<)XfdMcGEBc0)2IPEbA%GZ3^jSY+xjp8=7bUT0w}G6a0uK3{eEG6{
zj)ma`(ETiMyf=dDxQ3nGhbn8_E>~gnWuG<L3l_XA7RA2%wEgkQ@uqowLj6zn^93Q0
zVsfkz4o5W91XOaf393;ac*mJ-%b8UZ#k$e%$V5(?%9)raybsAsW1SL~AMkRK20tp$
zu>lH@J44O<I^y?kLZfWY6ZpwxNl5vKPcg*D|9EaD;PTMbN+aK5LsGMrIq)maRhNs^
z`t}A<x3`qZ4#6+_TJ)pX7QU>G&GFmFR+<H~#d&)xk{tflO@-#e7IDVV7&(0^^m6;-
z=2)Gu)LIr+OphI(u-qK~LguXC({-3o#1<HR*BYV$Cd+(5?e72JBZ>o_co9y%(Mm@h
z0%J~E8j9sNj8ky(&+_TCx$}^Qu7!P!a0j`^CJEi@1DAPIk|jZ>tW&RwZ{H5LCNFD5
z*VwI8PIFa6pLl+=Y#TIOm>7AlQEqJZLR@=q?f2Y@lP9lM{Q3I0O;kmy>1?vgqt0=x
z`6lh{TS{@HH&1pr3v`|!a<Q&FBFtLx1t6>>y8~v94|gC0Kz-ORKz$tFl;BhX8|)$c
zyTKq2=V&Yf+7ACNiM*?kquim_9`(t(U2f_g&K0laL~!S|jop&%=6?Wk2<G!77X`dg
z-i}k+D{x{16PZR7^x_tXFd#)11a$xAhhV2`^eUz}JT+)C!{eR1cHw_tJi9y=l6q6t
z@7i8&LP|GXB1Oc7jEkp_Ppw+nb0tZGA0*BPojiZeDDv*k^?^&Xt0UXEz_L4EN4HH&
zuDDzsc|~c`&Szp0@#%MS+VG2M3HN$V^YqXyrYt1*U(}`V*V5H89P3Ze>K~h!3QS+`
z+_QZAcq!+Vv4Ewe<=h_`7r%@e#AmJt1qudZkmKT_!_2{Z64a3C{fX`7$-O1WWz6yr
zMPbciXb~8*{B)`zWOeTY>`X~X$(yu`{&V;})YCY)L6=BV9OA%ZvSiS&F5bT{gW)Qd
zSdpaj16YrhJ4Uf`$&mZ3sD}V@D{0~&XLT<1Ago8Pqs0|UUAMYBnX+9iYq$G8F!+n;
z_*#nD-gR<p|7vuO*r%Ow34C!I7ipBw!OTbd^*9)AZ14-{0Ut73KgsQDRQcnr59P!N
zvewUEPl(Tj%>YXR(TPSivkPpJA3JgS!ZoR9zy1E}2a}Goqk9|X^axb?xoss)gIu~C
z8VhLd@!QIoSGs&AHUd_s8Syutj8^j0VBBD5N5FM@I;g%pjY)Ex6<<>igUcedk1&P#
zLl^{mcM=STco4qm0rP$E35`jfjaLpetlhh-{gPg^lap$0*TyW*DIXKB;{`!AZzlh}
zgTJ<-135MwN^#dxxsgmE53RIZ!Y?;N8XW1`_gqAjBkQ=|u7dHIRP3@bb+Z`$z;BXL
zyQXHoJ=)S2^}(2Y(8$N|6NlRk`DC9{e(Klex$#rIle7~%mfdF-r^3)wols$o6IJR~
z=_L5pz%Lk7@}D0uk#Z>dR}M96*{cH;H5o!bUXpN~=k^&=2=$wFdDy)7RaSxuHv`A(
zwIiltxXI^IA^x8##b0IBt5a!Q`XBUr_FKRfXBXuwkqe?6N+!N6%^zgwnQdY8tSjs9
zC3m0h;I<*E?fwf2#+O&z*9=Fr&&WoOUK-z&b>y4{lg+o!Ah8`*)I5p)^szk>F3h=o
z0rUCVwY<yYwQ%!PVFs-gljymem^g}@*1(<C{UxE?Gl$P_>`XYja^KghvFd3zEwHRn
zCbazG)^O9fDDNKzt%cDtU&fr8UDb9|b_=Xt>`&n1LeZdU2ZTE>2eG&h^}=&cR&q0$
zRZ`CDS2)<a-IU+=!uC6!w|OxZ$Z+s^bu&k@%p7Y(ffeCM7WXL^s-R$2c6WOyzc1{*
ztm9eFSeN(pf)>L<PQ5y}&Bj0Y>e=T#s`<0`V*oyq7TMyInP0)^2F*1Pt;3?wFQWW5
z-!(4xU0)DP-G)YL^+;9py<ze5M-6hFi<883H*RCd6yl8bidJ7ROBBYZ;@0w1uv$C8
zLS3AGDOcts#ki2E(E$r6w5LZUE14O)#~qs6$}xq(WD2_4a{uA%Uq6(dI}gCel;}66
ztdVAIspzKj4;XiQqp03#XlP8{g(<PtRmkjDt#*3U31*T#SSaz?F1&Ha4a`b!?EIr5
z7;rW11J%Vr^PEhQ=1#eVcgNK8j%zL!MN7clQQ>*;Bv_~deLV&x3e(yC{D35MW`Plq
zD$4=|^9A?(7#+NwI7@BtbZ)go-=AuHf1Lbsv%-?0|87P-Onk9;vutO+DEe0PKLzrc
z6oGCnMVASR<xx3mIl2v_U6<v>igVdDXVfT2H4`vCn3|yaP~QBmCmi#;{dV=Bczv%w
zmbLL&1^<PW)%W$2C`X9LC&N%m@qJ<BS;S7*cEnI(<O|9Dug&!xf`TPcaiScg6gfSn
zc_x^{`XDX%bLG_ikLMMtWcxCs-6EiE3+3C(L%o!*<o`_aXprijte52E>JDVse73r2
zCH8TLaE(KdAYuXafGUGw5EidBJ_mGH<7y+q=2XF+y~~hATu`$(ZryCn4DfhW?c5le
zTynRC6zfjevj*92)qc_Uo)tp1RMf}7ZwEPPIR5DH5f&%~6iR8b*7syK1h0dUC(4?2
z>ykTvLSB&jf0v#aqVGle;9Tncz?BLEHO?~V(re@b3ZGI`e5W)f_3@jifxX(gXrMye
zVrdDl99Q6VnBbSLXhW^XEOhotqI@|r73KFkC#VZ6r)CV9=Exem?eluo_o9tqu}1rt
zmMahU#<y{`Iw|-!$7G|tH<{|0xcofhhxucysAv9+k6D;N-~+E1C)su2C&^*xdC$$_
zxZ0bUiV7(D*jAe_y-hZZkPSh+F;ZET+~=G07jwq#_}50dgSds|qRoS+Ew{Fxa4Ih}
z!m4IDC&9G^lWI}kk3HLGqHH-gULIDM@MDGnxo(N3HmX3dj;mub$RRr!ld(({t{n0S
zWvN>Q6Q`*sunzPay$$3zad+3f?|;bVY?v!9Qf~0%U0&K<c1tBU-fh(uEmt_+w&I2K
zc|neC2@c!oL)Y%L##il+M!LmP<j6O-z+Nb<6&md?eXAnYKBo!V2lUGxqh`grGE_ZE
zSrJ6k7-{vog+o8&3($+Yb114HUvTPop2<-`Hnq#ZliW8*;u8|iR5WOp-9o}gXP!q|
z?9$ck^}~XZ20n&7yU(d5xZQ77Ya8(wK_i+EblZ0>b3a;sTE?>+kq{%G%=uW0rt&!Z
z|FmHQNng@SqXSBqkAstnI-hNv?}@KX4@g?AYKM|$sSXc()UWSM7N!2EVl&qFC(B2K
zOLJ$TP-h4Qb3LkJjEdxo{n@z`c<r~jbkQgJLM+Pt<@vBfT=H80SAa7V<T?~b-I@aj
zw1Tp@wh}Ef2g_^s4bkivTq_<YI(e{xM2qxn4dPj9(6x*lv)mQ+>Vuu_|F9PX!^<I^
z#(trU4D2?rEuZK?ciHb03aOcUTe=teoiJorh;4I@%DcDmK~KVlX)ab{<3CpG+vBAH
z&dCL&r(Wgv=jXo6b|i&%yW-aZ8H1M0s?lJAKGjmq@(edA37J79R9YwQ5C>hmQ!1r>
zEg$){if*pO0wJU})~4+OwVn@qEPcqzJo|k5#9m{_V&wMMBF*|nr9a`@b#uojn<a5A
zpKB%O?~${J@RJ&JpCx*g&=b|i)Ij3@rkx<s|MlPc`I@&ab<Re}EML*Oe7*fa<$x=b
za`V+s^Wu;$_j+z)6w}<>xd|L9u3pl2nz6n+Lsrz*yw%zb2+H{=&xWi?2kMD3^Mu2E
z`All;*o;(P0Ej-sk8e*orB6<aCo^qK!IrNEFOK7FqbU0Q#8Ih4^eB)LR(4fO1*p>I
zFe+Y-89qlh<xsxRwC-olUGCCch{>)uH5O_sV<j2p-glKUwGkbiDQB!Yp{&Y2ZLuzi
z_dfS;GC|q@a;^ThL`9YaBFvmu*p0)4QABv|>V;BRh}=5#DJhdnCr&kmIQz1sK1tz<
zYcm*+kGvXNE!)*tOO+6_{;K?Cu^6HdFu;0@=06<}@J0EQz-DlYI2Vd4Yif(-3ai8R
zJ*V#X8$o=S{;#X|Yd?<x7w3B1URm+%ke`-52kwWgi;GsXxxaK(IPOEx+ruPL{U{}T
z!A(uLzUS4Hq-jX=Mdp0W-U#jC&0jl5&;#)y;Oq8V%$jpF8(7q2Ewenm8|^0dkc_2c
zMQx5kmF`Ao;<$^6o^j_4I4n(<9|mG2yFy(>YtZWQI8&QTwh=Ce1!o}r=K;yyUfBt=
z3#H}+SA6ArJ=XWCo;X<drc|O8j=LU1#AmiAy-%h0T$iE4>n^S}gyh%aFfxCi&EM4d
zdd$!%9U3AEQ`M-+<)H_qC#y$#Un`?!`?lCc`FPzN1(%%(q}M)z^eiOliC1H(rbOzS
zT$~Sb7g3G>_Kd)(`)-Xsi9nxPz45sp)8-qbkeoWWR55lb4s8ARqqg1}kQ=rKtgsW*
zV7B*b?@V#_%+&p>L^kq5?xQqEC`+^7`sBK66`iwJNxeE#R9cwN!tP3y{|1S@-~nO(
zlv+pc-#I9&v;E;(y!iC}`evV?F`x^|1}Db<>Cpk!&`qObuAcwm$FraoiEkK}bK#Nd
zON`Xly3B3c4oysEcaKHh+<w8PvYljX1WO0Z%9}}a+JK{wQko(Sucjpx#8dwDL4cjO
zDLls0(szDo!tTX0WnI#2h(HH}tT!&Z^6Y00n}Gha(Z>mlS~(>Z7|E`ziQ1|VJgmp0
zsDQ1{-IcF&r3&<xn&G1_HG0qn$opNM=#ymx4f24AMtE?KvMro3gre++@Abd=<!{E+
zWa|QLHQ+!~Et(u-;r@W^?DgtmCe85KbyqHzQ`vhtjzXR{86HoTcpxKRo|zyb>4_k!
zUko(0;@$L8hMIiQ14QFNb$tRi4?m29O*N9jFj|CzbXm4^-BZncwr|<s;`!E`L0GUR
zVmGjy*1779%T?vW4iteotgf-qn>DPZW-+KhbBC849f`z*1H1{1+U=F5&Gu!3jD9}0
z?PoL)n;!;+G)L1$ldryKXZoIti;L55#@k-6Ko<rU6>(U9ygu1P$!uG9i7UA=?V{_h
zBFRVXZorAWl}GUf&@|nzWID_I8+oT?r|xqK8xxT$=B#UD2&iE6SS73_%@j^77xmFp
zQT;*pbwJ=PXNnY5SrjEM8RhxGf0vXbDl>IrZy6}-tugAu$NO8r<Vhe~mZ0?yaf3|L
zxW?)mwylW&psbu&G4lkBJEgzeA!sJc+bGW;5^LE_?Ri60W~LHwfAP${4xry&6S(N<
z(UkhhMHQoO+`aq&as`H{z4$l#{LR9}QosYfpHNBL%U9wO@hB+kC4+kM)tFNqFn@5O
zRkkcgGkeE*1>rgkuC|0SS%ksum4Eqaw2&HhEp3*4a$UDHZYEsbOBb<A$t~#2707n<
z*HXvGcE*qkrhBUH7J2DGSrm?XJUE6uizzNf_m^ww;Fb|*@;tHRHnHc0I3V?{+Qa;Z
zEkqhkfb+Hd1k*g6r;3#fI*So>*V`7tYyT#}e@?pfSnV{J)lB|VqnvZG&(T=<JtoH`
zLHncE@YkyIABn_5lU<eUzG0u^4}*@i)S?D#*uQaN_0;_t#ZiUui62<byW@PRrg>uN
zoZHbfnq<QcJ2QaqxU#s3#6tcrHlZV-kx1dA)?m47cHslxJN0o#t~i7NG`FYC(TeDg
zVn6@%IfOfe)bJ=;K0coMo)iAz(4@~{Q_=r<(O*9V+`SIAU&hO!G!Fw4^SaJWmmdCv
z7B_H|x_yJP{KXU3UsV{8>A|XJ1nI<joYb~ghPrv|pC6VwDHEYz)VA4NOYKxt#72SY
z`_sXpM?^clN1%597Jh*mZ_^G9y&5~~!jW~O*1K@}U9YD{dpLzXIu{tIG%Q#7=+`RV
zN}I!iBz2cyyn)i|SW7XTmIGdgfrk%~o{T=Z*A%iIdbcr59^7TP^_qqsu?HwV!wx(8
zIPZd#_>OWFhm`~k);Xc_!_hXIz$nduH2+`dtHxTdUKOmF(rLkPPa9wQ#^pnu^8W9K
z==J#p!Nvfw+iLciohqu5G2dOgl~BoCdPA7=5MfOE&uvCha7y~~Q6HD&S*D1k!7qF*
zidN^$(nijxfX8_GC-;(&)3?C6TWfvXT@{lKD}~b+t|)_`1`w?2B7T7~xD}C$^#vXe
z+fiDkcIy7_Y1CQ*Kdg0O7vNI7h59F4@<)4HzgGF~{)=M)lwWr<q;)OLzZcw|aJ2UJ
zZVoxM#iX~p4(jVwB$^U=_h!<-r9prf?(M}=9Nuye1+Zm68yx7$i7}%xB7rNk-mi9q
z&!NMi937=8TVn;#uLq~AJu|1Stz|jWGY#)`AeZ`!z}Nc@{rj$azE*mEO>s)60p@4z
zSp>s=TnPMMY#MNg7X|y6jC#9a)~{wBfcq0J%`m8WiNpmCd~n|VQ(AU?CDa+6LQmg&
z`;gcH1@`yrI5j|M>~j#`)+}^v1J`2?OPlI@DVUJjIM!?}v9wb@76~q(W14TZsA|?U
z8h7+}BUpww<D-l+-78zraV<ICE4<Ft{Kk0*zw`e*hh{qwUW;Zmn~nwNA<1!#$2v59
z)2yjK(zfyq9DW!)`WN4na2$EOb?-2`jkw2Co!YWT?F2YQp`M+e+lPM|Ab<4RFa%HP
zeKnwIzRZYlXzBmCe1v5O_7iZ0fzaX(Qay^9!lTalD9!{vB_)QSUsypvm8uS=PnabD
zbxs{&2Gn`Mzo_%9^9mWSw$Ib)4r2I5kj<aV1+Ewq87s=Oo1qjlV-?L-JvD4Ov_LGK
za-3iv6%`E8u}gU6s>TZ1(g_?0JUnmWap|LQE7|5!qDT=q0w;dHNY9A|FjzEu#q*62
zxG?cZRjCk0;RX(2TByy~2;6Qyc-*$@KqL;h4Y{p4%7;UWpTcVkW;j^YFk9%*SmLMd
z*Be^t6WRV#XE<&t^DBzwh?DiX>;swHJukn;5f;;mPG2JAQeO6|`;q7K{)@1IyNI2%
z#i#$EYyxgOo|MFKW#>JwlgHEe!=icmJZBf5GXHZ=Rgelzbwe^JIhhiCM*SAxjuodI
z?T+=Qn6fh3(5<EMuX90$qa0229~~vl^OVf3ver?^OfM~EK@bZ~DNh@jljK<@kiYd&
zBuzA~C&V5z|H7Z(4Q7N?N!L=Ut~|4COpW~np^yES7!9zJlWDhbUX!O9c!}+2iJ5@8
z4elP!p#BzMOEB7)^9t`SGlu#lhJFVq@uTAzlP6B;faEgm1(#(j8%q}EuM=DiALR%W
zz?`p^r4Ju!?meK9*?2h`r#HjTMciTNLj#c=R6VmyM869sy_-U0E|7x{&#=Fi?TX3S
z@8E`M&j8D!t8tVF0%ZW^kwx)GdaBYW#z~@@1&cU89OZctn4YQhFQx|?t)}-1WoSt3
zFfV5Z2)rb%;glSR$?tC}x4u{b#deOOj)>&|F94r|5*U^X_=T&%p@{s`{$<HgWD3&8
zwzNdrnu>D%Ds!lQ^faHA3iZ|4(B#=brH3FLo4(cf$04Kl>~j~v8}JFb<&^$j*Z$#Q
z^69u8GY9b0tFfoRKt^W)ANjjxr?RWc&ns?$*u7$Lv54aKp`hnc2*^KZJ=O`GllZA-
zJnH{U5`AnjwetPWy~E#rMK8??YON}nel`~Db6uC)<HQ)jSb;Gh1vy9i8D&6M%Pvwg
z(=<Cfr56+)@u4Ce5LO4TU)%s;wXGLmI|toyU7oR58`E(*u3TtANtpJZ>$GGHEr=YJ
z2<Xz$+xp2fS{INDS7k%3s;r?lXWA^L81~dhULUq4MY&Q)A+=GntTpJp5dyVi*8jYn
z$?xpYy=Qj)uupAbP4M!>>)#4>cNGxFiv=P9pBh7ed<BkkQVS=Er_%6D_l*A0lyz_9
zqX~#BJ`|FPnjShqlbF-M!vS37xsnly=h*TTq^qftesp_<jEv%tGxS@)djgL?>YA|1
zTVo)^tdEb_gEH8nd{9=u7k%<wqWx$6#ST+L)Z)<FxzVOJSz4_aqUVegm`WCeY9T^u
zj)E>khQLnA#K7ss)z|?&rF9=7GkzTCcNV~M&vX?JbBs>LUmK_%7pIo(X?*V*@oJ1G
zovU*`{-+#CZuX|W1bNhQuI&}Wxgb*7o~ye=0n6$0>`yVv214E=YXh^i0uHD5xhs4B
zptC-?2E7rfS&s=O3!^CGiYE>&Kyq~IKCKyao{I-4X52kcb=j?ObyE*LCnCZblMRwK
z%i!YCDo#Ztv^6O>S+x9RUS7mU8{(k&L@f6mQJ>qR{>zW;>N)iVg8e*(`!C{K&h0mb
z$kZA@S;CIUmJrNN^tAMDu2;1Im(NemF4M`$T)!v7<2Qn07I|(3YWn9zJI7)nsYKdM
z%H(u_`KOYeg>N>j5cidD4DKtV<*!Xyxh^obiV%4LpNA>0SV41ROl>YFzmBC?7V()?
z+*wenpn|2f#Ywp74HwTq?@(&Q2&&^)84oceD6j?`W3AmzD6y*F+*B0u^L}5VeijC*
zYPCEA#ZFTqtYyt_8bVGPnGw|lPQ>24!{d|=e3bLb9gSdKOs~3^2rl!+L(LT9jm@=b
z=KAgtWsWm_@`oAj_hW4o-^$o6wTD01uT`pou(Hp_w!5<L04RwWLw!3Uzc-diwIO6G
z2`SSr3Eq-5^>O&`lqB50(qM}VNs$L)P>H)q9v_JG%Y|Gila1NDr*nQj-c14PE6tQ3
z|8tOJ4gjt~YO}<)mhIw0r}PbTD2tyACAlq__cHbSNbi%mKoxl}{q|y44om%YqS)(#
zPL)(^eyQCYCM1$%D@-AT;^V>I$nnF%_$!6mTGYpVnxA!}cfN{(Ij4Sk`H7I5w?KQc
zl3{@_kz}1Xb>_*puG1Px*<WV!@{0UMVqeR2D6M}lySK*TlzvZp)cNpXN;w9Egb)mX
z*=1`knY>dc1FK`nhdb9B4R=>{m+Len`^dL4@GdP_H8l1j-hE-05mq_4)ENhJH-^Ko
zTL&R-*Cfb9=okGZqNCz+mLv+XJ}X`;ZWHJggynvYUzdb6<Dwm-v#18wn8%9fwxQp4
z@_rk32ImZkNrih=uVAh-<`@k48SD?P*ld^j%(yeFY+Ezx0Xm8_G8bx`Aem)`-)Y-W
z5<IzAwKn<gL|@c6Ds;adJBf=Q#oU8ujfLWsyZ3U*7X$aYs_735sagAi%d{CwHx|qG
zy-{O>yVO;Pv56J5ub|=z0y4)(*N+v+pAO&i5H`~Iywwk2(JpprV}lIV<mx_Y47nsJ
z=Tgq;ny8Ni$^grfV&Rh!qw=WbL9LEwJe+Zqe1&8?&|OM2jlPS_nxypj@b9Q+|K+cb
z#>q-~IV{?p$v@oN;B+*4;qTzPlNqdq`?06W#p!r9+HjqpQ9|z8V6bzZf1ieA<-l~}
z61Q>PU;mQJxEQ>jG0OF0p?WyD8l%7MHG+UlV9+DGEBy|$m^1^+_v;5@_Ffv-e4-U3
z?0TEs43h@$P9O?lOGzi3{aE4_gZJM17a;aQS+>q&0*2U^ki=_uU_tjZUOtgK+j&NO
zdh?DJa#VJO>A!xbLj+J4?P@L3Trt&3>5P!^s$0nZE!8q3Um}-W?lbng|3k>*A5nWn
zBA~InTm+W1U&xw<%SWV0SKVFpNWhrbpnlKE5}pwaqvl2?_zHS<T9cQOeE1};>exTh
zuj9D!P8O>L>7Vcw+!0muDJsQ0>+ONACpU)0%_-K=%4|bzz7~}}OQyYUQNlCz`TE_~
z#Q^U#hD!27Tl}wnO>1>e12}*^xtZiy35}Tr|Bbe#1P1~2n#5y(%U(0+?Ph?NT9mG%
zJtgVU?1%WlN5AbQROc=Ye}isnaTFYdt!QsAE!G-uB*3G_npdX5>#W#<*BK5h8)5ii
zJS*Xm3P)~?eXoLvcLBy5aPWBzN!TCtTaiF|1kT|a%1D6WadCOyZT&)1cSDXVkFGR%
zCJeqlS@O*<#~-kQEPn3oe#ZEI#>B+&(IvOJHf=a;Y!HXRZL6WoYf%~AIpd8YU6ka`
z6a79DYcosex)pb3$*57rt#QVoDg$TOU^1xW)wv@^S7vQcftdH5nCpWj&Uxc`9&Q7o
zTMAe`8LVx4dwUaG$!be-^g0w|64!lum427-&gPnta7I)bzkP=J!{-yt@VPBbaYNFr
zK9_#NnxIV4?iYgzJ(`}c`tfsRiub1!20^0KRlpcGRTZq^44Mt1y$f&M$WNT3Y__En
zj}rrH(T9r?_M$B!rg+HO>HBM3mXf$CdEfEvfd5jw4jpX1BS|QkLY20OPr|2>xhynx
zc5aKq(I|6Sjca#Rj=aR5aZ4JjD!DgCpCUPJ%h=>LYCu6}49_)e_mK8jz&(XjN>-!8
z#G0`@qX3U9B)CQ3)?CRHg{r&rTw{zYQF1kseF|I7mzFFX?)9r|X<+~U!}BhXT*1YT
zJ6pFaq!y$0H0-bmk+2u+Y`VLK&u12NnBq!}yhMAG(JVjy%)ll`0ESAF;HZI*V(;i~
z2hP<Ye9Y+MU5u3n{1&_`8E_7(9@2)$xoXUZu^tDTic<YyYP`|p1p96D#D~$i6@~4Y
zA7gPi2aHDvA_+TYFt|}wh_xkrj1%?f0ZPIAw!4lk`l8m#^|&0Dt5N#CiXNEE=|9a`
zx8Ll`?!P%vN<AFb-({4Wv$$ZJo0IZ^uyBQ|HTkn%jh|>_k+*&=R366l?txFVcRn~u
z@5R3ka6;>!XRSHmk_RU0ITS>9$b=ma-sHCbU&x@8sH&f+s;f?G?J=UP(_uULmk*h%
zVRF5`C(T2tsf5KloKz3#j4s&hlt&lz8Ci3i)5mX!>5L(dZ-3hV=2t-98wp!+AKh}n
z#%`c3QuhB^v?;W0UJkk3AK-PKD?UG$U9+}_=*nJ|f7>p+!)4;<f_zD(jYvos@(jgF
z3V+n{ityjq@QxMiHMNLxZV5)-*)}Yc1!tdu`vHFscZKx1K%RbVzB_1A=UcY4>+q9-
z$hT#;{oc&=xk38MCaRGmxTIr+sqPx^1pUC39$?%62XeO_8$OA8?*86an?n&UISRP$
z<^KBv`?7Jy4_h@Qh>bxmo4EC{F2llsee>(}>IX`VQLnUx-P;YmUf{E?0}5kpl440}
zk@DL{ojSpc*JF9|Q1zK9ao{<5V|@;`sRxEbOB34SjE^wBPmQZ!quOImcTlaZ!<7C9
z2V)XdkcwY4@L8FgbFJzFro5Eg4(9h1SpKm=J9J$q5`EVhLQNk#<#>dXLzM3z_~}xp
zW1zx)sus?bBES5MS~jS?G38an%M@#-#1!GXw8|+^vK(b((9qD(Q_PcP-dUn}|JohZ
zYmLqVjwxpec(GA?{V&-{w9S_$<hr43Qwn@J%FROEib9m;_e*#l-Bji;I;#_KIHFTM
z%`ea()SZ2WdAO1X3iq@7cG+A;tHCaIB-I)Ow$-R|ipg(l@AAor7)|QrF;R~v=R`dm
zU?wUV6EB6j=R4@%9QuA8_)pwqc8=BD)HQf{xSUg_K5SuKbXA7mulG%Aum%tOEjjU5
zyB%Yl?%AC~EzpyM2HQjyEKxAi^aA&Gu@E6nlrJcjy2w0C4U#W1zTLwQryfuwn=W8R
zRDwpLlD|q2dHcTwoIObh3HUheKRk`vLdipOCG>p`2ll7KMU*vNb!;)O6VW#)VfRuT
z8Z;H09F{avQggxzwZuVUYCR!dYhgCtFb`Y8S|{z;7TaMu-9&0CEq{FGsDt|cgpS5z
zwteW1xHyG!szmQ6TrzTkRzS)A)nu|Io%O9X=w;b_^ZkT`-pN`0NOx$3kQzxaQ9khV
z+Y?k_6v>R!_mc$epEP<bhEpp6V7flUp93l;JoaVu@;!GbTtw!eOnI27s`&ZE89Gt_
z;*8!N3`)N~Wo%CQo349Gq>x%pFe{NOOnGcNoZ>Fw;M9xL2Sn$m;yM}BH_+KjqKK3k
z!Lfslr;D3U+C1hW?M-cM&FzSv_FKTrxpn|RsbCZx8eWCE2)y*0L!~eZ$4!e>ErXl}
zYCXw}YDI&G)&uv7!r}~ZVbe1JB+*4ti@lDy!=7CYmO3J?JF(wFY$sp3+GH9pK0J!d
zHJ^t{Tqfu3oApJ%6`4wZgT#rJWizjZ33cBzqMW;bD8epq4{!ogdI6-DR<&E$x=vcv
zOXPUm+@P@EYS$azZ~w2PY!Cauup|j4b&&1`wbj5?v|KZtC0_6qMVT?z1W^Vc<_xGu
za*YaV9$0?zm#v+;M*+qy1!uJ`#?ljUv&aeWlj$Ol;)~8WrJsRcQw}~XQG9<%lnOFS
z`(suGEbD|qUb6-ocxE6Z9|gJ00mU(l^r2`d;0y)8;Gm+I=BOghky1}AFk0!2;~GM4
z7aS9&KXmpc9j9HJLpqmw9j(1Uo(KE-v5p>})>m?((2YY0;KV33{8ZLK_Cu~tr1NkV
zUZ;bwS4#R=k#WkwSev{ndU0Al?VuhlAA9b;g(uOGr|AJKWgl)MQToS}>7z?XIV;^}
z48Ug{UHqw@zJCr}=81SOG9^w(W2O<suLTs~`=ZY)Ed6NRPdFS#2Pg+PHHOgi_U6pd
zM95e}JPf*}^EorrUA$7d!8PZ#75X|5VNe}eD!7(?h?>72(>mjNG9AMm4%OF#T331^
z4bDrEmOwx$uzDRsB>nT3=OZaPtfo50UIc~Dz4(2kt*Fn7UXkeN2WkM|4P>M4LOQTg
zhYsbL6gOeJW<gm)@usW|00C>Kv3<HqwI;j}w9x#jc^UOLh#mg3&#fl`ylWp0YUX?v
zQ7(G7S7MA^e2C1^<|VL2&c{=Qd<<Z$G3<jW!(pXtLV6CoGGK*z?GY6s+}0*FK(4R=
z5fvBAmDOa*me=Dr-Yd_`T81bo#EOMOmyC5ei1?@AJ^^P4;b)o)ir{W(sD1mvUjOj^
zr62(-LfzK9PJm|kM4dklN$>@ocK~M!@@E4-+%OqL#}s%1;5$Is*mCZa#ly1^o_j9u
z6MnPdg5-IC1o}O#?CO~ul~ghU=)K%=g25d%tUDHo3OOWk@ehA;Wp_A~R-o=C#rAwY
zsKLw^&>#Ao;&Ukvs5O5=r6?aqW8K3CbD6~t5xZWsG_kNPGKE27e8$sWCBfj0PPoR-
zOXEr(f_@sHv+=S7eHMF*f-eAgovPVysLhy$jIQ!&=G=FaLmd0rnsAi0U~=&V^ukU|
z+c$uN3O2B(n7UuqJ<RjZ^NQCAxCN@4L)=U$?*tcEM#`hE#wsH_a+F(H-_5p(T^)4D
zHlevA35(N4_Rculv@OvH3yO==tG~@{l+Z7SQb3&L*|jF-!XO(Jljn?g%$%TuHJJP&
z^XAAsvhuGf=t^^u8r-5_5NNfbv=c|~B1yMv(Y4e=Uv3;aK$9{8+hF2kJ4vaL33e8<
zh3@;+A{-$UZUaC1FEH;7A^oW$aR=q`1$JCd#%qL^$KcFRpOva)$xQwje{I~8vFck8
zB3zhSn&?jeR@qug=XnJRSJuVT_p{Q5L??E~pU!`O{{XU(6(_+VHW?D7@0uLLb+8_X
z=kmo=BdHT&jIfD)rZ#JzTjiq$9rvqcI+Xwdc)B?%7<3(Ybr?wcZv0bye~u^MBLUST
z7Dm14A3<~D<hM3%3oCEJ@O!nZYf*m1cjpVSgJ{H4i06t6-sM|~mB;?_)V?Hcy5bA7
z<XYaqL0sMDgP%~)yQp*jJSH79K|wa2S157mI3ZuftSNk4y@sE4NY!YRhIO!ZJPpfX
z<pprm+X!@&v^V{TSt_&SOvvPW&}q~7NO!GRZlNgJ|7!xD)gLs;<@O`x0Zcuy>-8g|
zL8ze;W&^K&N^_r?G4;+tk$<w1N$pSdwM{Fm?RWsv<Jls-PB}X-h15JcQh_sAHfTg$
zhv|oTq&^velF|yi0L>U^%C(PTa4bzu_@d3TF=?}QG%F8g?y#!kKM9mFK(TB!1d9ME
zP?iHy;Hw3&W^EgGPzleShvPm3eCoP(b{Pq)J9?bnX!Xkk2WZBrfPmj9I)$xV_6u4O
zD(b;m`49v6M%~8tOZGy~Dl!EvrV++Nv<m>*k`2@@r4Mqf=-BXu<r{fECP_kSGO#)W
z8|Xa1<?c^H{N`2kncWwd7#Ki%|0IvQhcewW54)W&)OA+~4Ky?<xbU2pB;xbGf86Sc
z10wih(AZBYJ~^3lHb?ub{V+eJ(MF>7%Lolx(Sf^%N;(4{2*r>l>oDZy5;iD+!zv?R
zS}tac-m<;XT76utZQ-HI=6rX0eFwmH*Do&&t=2EW$YrC(sg8TOOcr{;?EoxVbWWka
zq-J-PY4STMN&UhVI=THyAW4)s9Nw47cdr)@p95$zp2%@`{^bz*9QD;7pn;a>U~^Ta
zzP(-X8%@czvF*BT-BM|-vnR3!$LS+Svd|Hpe%y6C4wDDpymAMbBe>wxk?(+O8qv60
z278CJ*e)D1Wjp1nemgt$U?&K8aSKI$`<SPxKE~?pDkGWZx8nHIQPMoGUCqV(&+gRj
z+(N{}Vn!kRpM04QRlj7IKx>h$g-)m%vs3y5?&m_?-FNbZ)E2EbN$?xw=A*XNmA8@J
z1AJe&L1#~Op-S~_)>B$IUqScBdtX!iOJ7BxhRaH>BE#5g|AK+*7>yl5X6eKc1jNl!
zC-K@|wI~PYmX^iD-hjuKW=Tv-Iz=Z;5}P+U{H<jk^nB5)FKjufc&}50ewW>U&R1gf
zMOI?H`?bvTGDx|@nEEohA>^GQXz~D!fY>0RW6O^#o5lUFD}siuiT!azg`?4v4MI1>
zG7#kE1O7G80DM7WCxF~7*<8;Zu|LKv2HI8FM98uhHszATdsxa`!~0AZ%3wZP>~8M+
zRbqD{RY$If-oRof@X{{zyO3;qql<hjs1XmNi(>NkGR15^nl}o)k@*B>ZlIS!H@La^
zln&XlaAjZ)K}(X-sw~vnuPMZTH4x7-Wsqk(j$NS+rmo$2X}DHVS}@4mSR=8?%t$tY
z$B~EL^T5v_!~|<LlF^)xYL|-@>ZchXUa*e#LneAj85E(?<4tYc3x%I@0qiX%Vh6v&
zy~T6v^`+@{l{shApI(Ho`Y|=*y&ml^a}xW5Yt7ugJ)&q2)G(z(^}_5xJ9W*f*W_D;
zmHtHKdvBtAf0#dzUlen}<KQo%?el7-Ra#{>7Y7X}-Is+bbT}if_<&}u<;ADbBFtIg
z53G<WoC6B<Fa6Q|+U4a6d{K15KReCXV{;&xWPi+bYUO1NppAAzALV4Zrl9?hBwwN+
z2k&+}HEdEl2GLuhap$H_mnJ#X<ZX#M&%t_m_&}$Vri7)$`{)@~3w`;ksfQ~70c!*;
z2eRkR&$C|cs0b^UzV%cI<s&Vr6;hk~UbS_Jd9Mwz<7&4$x{-n(jdwd3SE#cYp4Qur
z(oOK6PEd(*`XKnzGC2D_X%Q{EaY+3H9vgE?7b^PL=V%@8sqBNuFdFf&)M-tA$NTgr
zekuasrx;s&2>7YQWNQ&iE|(i_onH8ToR9$o8x{JwAx7Jf=gtW7KmC_(navU_Jl7+>
z$R|5EW3ozDwHephC-YSN)a`0%&9XB*YM1;PT^FM_M-bSl*CKnFE)SE_B=A+-rLkom
zI*AFwl!drJ$#59N?o@hbSVEZ5W;%6~b{UGLn5%YI$&s_Q)JY@`$i&4){~rGdOt}YT
za$-+-aAtvuins6DzPjFWMeSDd$IT&DjlMv}gU<u*Lz$yq`MzABtulhO1h4-M?xC_A
z?J80OzAY@TGzr$`vt^e^pWMU#qsMO9nK_s4H+lMx+1c5ykJ$RKf&X-)!nJ>Kcf@s^
z#t8&(<BjIjXflPV`{#H*0Gq)&5W{<eUc}Sd|Ml3HX9xoeDs~NlwP;gTKWD2PJ6J6j
zp_7t(N<+J5-Q&ydoQk{Ur$+x&i+`H6G&VxSShMk9>TV+&yAA^%M{-IM<8W+nWk;OT
zAia3@lv*g43U*c-Ub7;l`CK94g@D88>pH5`=&SSB$#?r#=bI1oQYeRytL0I2X{4+-
z3>5dhXSTY`#=Tz>Z@7?(-!%?(8xcJ{6XEjg@h9a!Kn3zFY#*x~?9w>|6+DNcf3L23
zt2UAoHQfc;+~^5yZsT=A_|V;5uX<W@naqm18G6IE5m6^jcP`e9-k4vll<eqY3ytwY
zztq~!tg_>W%clXKPXFaU%?PP*P1|6?DIzSZgu3&J#;5M104i<ShE-50vLh>gz|MF(
zzX&)1W*4US$M^p<+h~@+bWgrPxDTnjTO11Vin0lodM+XpqG}bCrATM4M9(w|0KKNW
zEXUM#OGnyBB<6pgyb5}E>>l|9XW{qKsbBbvPE+f(4f9<9+_p%T%TZ&==?LA{C#x()
zmuOq1_T{nF@^WRBb;8UP_IEH92nz6c6)HHyd0BI->swVm_Fd;fqF~*vQSYUX8yP)`
zbA5h==Q8?-ky*7an&Xa$iLN>%#-)9P^`8#dZvks(0SN$>#y`~`953#4>|k<;C_dVm
zRhhp|NX^GLk4}=^IA`58G&Sp95No;HTBFA~ZvPfXO5GTBF%-EmzRAoVR;lkLnf=di
z{_K4LU`J@~)i4A55^**5hSPFak7%H}!6Odj48X1F8hHd~ebldb(Ja2Q-t{WkZ{5n>
zU0_)hU9);_yV576zx776WzF}O$a8U^j4)7)Arl9UbUjN*+<amMRdV2-+qZ?mp&W3s
z<tXX`IT$EwSmCRMDx911`Aa6;v9me$r;-(ZzPAzLI%?!_sDC9DcsRBY#2c42y12`N
z`L`MRyg3b7m2WA#=9_=lD-=fY#AB4j?XD~Lp(|!4>U6xYTassm-}UgNZiPR^@8i|&
zwtx;r)>q&bMjD^hP1LSanxe;RKU&oN6DAO_#nMI3%w{ze$#(ab=k`tA>9z04zZ|zh
zAJD9OC3;+I;vuX`|HnJgnM|$NVQ|mVfV}SO9_vE?jIwqAkwCeHD}f?svP?SqA*)SK
zm%n|ARFw0A*f6U2uTy-HX2iVSEZbV3{;?n^X)iQyu+Gzlc<+}g!coQ*a0q;0Vn%Se
z0fy(wl%)8ys%{?2cX6fYrgC3<W*<W@YqJk%VwRs<AK&)9cCgbdx$r7rX7Q8G?yojn
zN8b{i8Hw$x%&*1Kr`Q}M=Af&BAb@#OCC0fNljZvflym-RcR|+<aN}_A?bi~_9=+@Z
zVCV%9VY?68L>Pqmq&`~!uABnuA$aMVJ6Y~JB78o#Yj9hG1j9g`(FJE8{CgI_M342y
z2wK6}Hr;41L>nnC)1<>^9E)2eI1)f7enI0WU}xr_B~?rmeLcJ!oamURwKaR#Ak6ni
zFqFtO#eW{j@5h*^LB@uFyp|!fy<cKpOf|LPYz|QeYLS!8k6@t4$vr=Flh<ggH)n2&
zRPv`i?XtqZ+^=sl!n{qF?n`syJmj$1X%Tz?04TdBo>sh<w#8;pmv~%l=Awyq?P84S
z_R5&<Cl&<o`-6ePb?|?o<8oPFuS-JjqqciC@QfRll?Gp2_O(Hu-`vK}(N1#X*N4p}
z;*4?gt9DV<1v{YWR7B0tZ;SQ|p>Yv|8u{|U*iQ>IpZ0HSIoZH5E;f>n#^=;UIJWjk
zy?hSme(o?3+Gs(mrX*#PN2uYWB1AQx({`xO<46o|^B+AmS!7QD{`?#oGQk+UnOHv4
z6oQ*3kvz}1^Evf$oJrou_yv;P+9lBISUyx{XZ5YvLP03$lx-(OpdlcU5Z`yEi0e1Z
z6nghVqMYD{UY`zOMhZj;rsM3Ca3HT;GYH3c>ec0oqAzi7wU%CnJ@B^E(>|3wdvI@r
z6qpV&1-I-y<+2L#txby5oyyf!1;$uQ>eN23`JX-C3r$H>sG?{Qs@mDRu(Px|RK<K{
z9*Wfy*cA%@4KE}s#_MNKa@}MHp_5#$gX#Z}_TEuVcHOtA9Se$zh=_oSh}0+`9U>}N
zKu|hT0@9>Qmy$$9K}3iM(u;!h-g~0bK?oh`z4sDANIN_F{mwlv_<rY(d&kH>qK4;L
zd+oL7Dsyh{<%%V;$7V~cXK|P{bzx>}{Bx^Ap3KB~eYdiFY*elXabp3H!7EbvD%E8n
zI}GPeGaQZ96ADyGz5Vgy-OU279`<o+)w}X>r@1XTUW6`wRODD$27Gnt!ZGiA&NF>O
zTgt`D-`<RruPvUET?@y0(<B<+Ije4b-OJ22tqpxJ9;UfPnNvYpK413Y2t#lE(>Y%{
z^Rz&fPk9J1k>6faJi0>jDW$>x(0p{iua@3vPEZ!55uc6kL>wjX`>p;A7ajpDc1J4{
z4Ub*MDV$Sn0mnEb&ka&GT$zbVY~N$ZQRZ)8q-tW#3B5Z%V&UUsBa@M+Q;iML@ZP+$
z2~4Wl6Jm%lixtm}*Gry6Dfv6ePbxQ2|2we`Q~Dm>zjCGN7ltZ0Qi37O)6T)=N)F0Z
z&rKv*C&yr`R*|aPzi2zq2hQFKg|lXnt1c6cZq1IdOoHgm(d8!OrrD+nW<B<aS#q<r
zS_b0|Lh~8l|0mr%b14+La<Mk6j5gag{s*Za1c=GULBRJ~V%ZyRnVA(MVo6`63esJz
zc(D}wM)yh0SMW&QS`@t2>!NakjlA~?P3C~Q0yWSzIb&xdO`WI_f4iJv=XU4Xrw#mQ
zC`r@tyt$iv`#&L$A=|<A_ly%m6?e-MwN3Xo8ha<S^AxC}=<nNS8AriDLTpZ{FRW<T
zXqG5ZQ+}M)Z!{Ail{hxnGk8WhT9S!<wFP!m#jSx+w@fkGMRvtk<&7P=y-0V>9nRyr
z!2{0qf(H@!Mm#lP`KP&T1!tJU{I8YeJKg0a&p+v67TlxF7pL=omE=c`!;wHW;!rGc
z9)>mdEfoUMo)dC-C?GnGcIX!-u7#Ejkw=%~m@(O7<!eGaoc8P=r)_&aCO5!>j-29D
zcCu`Jm(w+N8@AO4@xj6ukNBPaTHJ+1YzU9t_>N+l;|emDnPZVDvcUG|+mF>Odt@ow
zXE=IfT3z0T%jbUA#{olwU1dTj4dRS2$Qp8K)HVRN*)M=54j`M%f93VNQqa$;nII6!
zQ70E|cLYt7q_FVbcYmu)H$`#x^{3BiS}5#}g!speZJ`|&Ge96k)^manwh$I8d30bc
z27kq%RrA<8K;0jpWoL6))JL@&q53Ws&*#V3+w<D7>+4RNRkc)UQXdA6F^)Wy@7ACe
ztNyiE(10w4$(LbmdotB#`_VN@itE9H2TWOT#h$2D?gf0W3Uz52mqmrgXaqA*KGD5N
zl3A#i!B!Z{Zy#{HVMAls1Bi@tASLPr*t_Y67gzhT|2h#LJ}%y>g7Cbx2?R12^LPis
zte!kd6z}#L<r`q9ZZ=jzscV?mn9U9t)0&zYjyQ-PWSc8g(eqev9<hRv-LIv|u(}Z?
z(f^zydx<*_CbWacZnB(L32kKJw*yM-yM5z08%fQ~iDU0CwyR3tN4d5Mq-!m#N=ovZ
zCOrz}R*s@C8gkK9lB?i}Vr|#38z?PU;>mZ_mV`P-xlb&;?i(#M$2PwK4bCUTjQ}~a
zOE9YB0(#Z9J+Z0U>Q}E6FRm|hmM|k7zyUq&+ILXOb@4q0uGs054c%U43<ooq9dAI?
z78dMyzZWQK)UyPKlp#SBl#5E%saJ`SX36uzzHW*X^9d$<ViyOD#yV<D2X||3J0kbx
z(kQ%!$aB9$!N?<+*(dNjs3fmCVF(jA-l$CDaXs0JdxCvZ{5bcceV1a(9Ji&}`!s$2
zcbMSbk9iy`AAkt~7zeR*68)A@V0S(5Klk&CZ}0YjDb-bWX5a2pY3YV;Ads_<i1H-d
z=tv1;vQQ~rP33#1)jm=Bm*$2#t@|R(e_hzR_KI4dg-7mv`-}E*pSs-o{<(6y_f-6*
zIfCR=CWbb~dhdKHKI4htKljb~Y*pHx^zcqN^p1gvC2W-NmJ!V2<u~`m{4<d|J}p3F
z#{bL~ktzyy#ZLSL(>eCICtvkR7p|l8Y%2nyK*4DShz$+>4mpbmyk8{}-g*R365!Y{
z#eagYgY-N!dfXXde*cSuK`^PJ<FI!Xfls0=j3g<a*;g*p-snPFY16jK{>$BaCd6A`
z0<{CL(d&HrgFmx_RX|aL@6Sx*j~Se#gW!o6NoPrG06*wYnW=3LKsP>L{LkBZzQ0!G
z_3r(BnE;G|6hGHt`#8M|+eh|qu<ZfE{e&CWYkWWhrk%%Bb-MZUDOBle8mrZX;C}4(
z#N5v5?2ZedJQhJ~c#4<ko#E*QsRj=8uq7>D!goxu-@H=mdm7B@voZkAO@mC_<zzi9
zOGy9mZQio$r6i3zuy=ta<nk3+brZdJAabgk+hp5q-w-mtDeqtejs2PyP`z--q{&_=
zG-pipeYe~0^RuS_FRFoaD)rrxI+Myt?$kWdUt-(6BW8btecax)@Zz}u2EczaB>*<1
z^ne}0t>SPJpb&-aXtdubpv5OZb09o4eoM#1^2z-i%qQV}+>S1tIv*{tFg!B$Ot!CG
zpD9s@KXJhSd0N?&x*HWFqqBdR4yGl93L*}fG}3(jzp*C(8~m)s<wbx^`Z+CM0iv2i
z=ffR_Ph|q{ek|WyJL2=^!$5nU7}URg9Su9zIQ`5%1zbRmv-g0hVXFIoqrb+3mWnm$
z?!WPw0a=>u3?MXv$MZbxXkYhu#l2XZ6U`-<uh4-D|2^LgNU&quli}TaI%zN83(mJ&
zIH1>HR00a#f8(xbizo*Zk51guJOi=pKLNr-FSsPIF<;~<qLW7X($f7K%Y*N@#@XKu
zdVX_-hBZeWJn+|l;q6NNZomZWop4B4`TRdN=A8P!+PHZaxWfA1$?r6EgM{vHxVhb*
zJZ?`ow76>s05fPE-MN7u)7S+=btR8#y|&o?l{QW@^A$kIV9wI9pnl#BMrl8k{tD-D
z@=u==gHoc3-DP_g7edga;St^32Y<9PdiQPf{TtwZRhln@QEl={%%FYZChLK!AV6?i
zl<a%AEjXUPdiS$y)D_$7=MD1OCj6y<vnc2S58P|n4}<}{Qr}PP*wVilUQtFC{ebFN
z3kD<p{;f3kqdmR_vrM7_4EWZ+vbrQ60zwM$tlGJ!EudrUUDjN9aa-a3AU#b~=(mzY
zf>S?PA$y{`>{BQ{GPYZH1`H4!&|qo&XQc$ZWaXhh`UUsLB%Ey^$|C*Fg-qM+Wcc9*
z=t*jjkz3U?ff6Qj@jtYMoau8tU3LhHPA84n-S;oVZhgQfsnp<DvZ#&>DFH|K-yQGU
zH}OZ!b^6v1^~;m(@BGZ}&;||b#cS7R+v-aGm23s9+wou31!xrJo4*6a&HMkwiAzB`
ze%JGgxd{l8|0*;Bo(H{WM>zZ@c>+Wl&_Cy99>ng5fx)y!^<yAk6ZNpKY*I3j*o4Kz
zZB5WI41IJp2=>6wPlt(aYd?V_@oE%J{=|@qE{>lallpQ(?RxcqD7113=AB@jyyJI(
zILpLcdbP%v_wAGjHWw*<*E_*7D}E>6|FQv~k%8OhM<L;iJHDmk;(u%<KAbUq;ra#O
z)dd~GQe4|z?6t%B*&FN<Vi)YcJd|XxzxXL+`%Za?qKSEdcDAF;!VcEz)f|B6z~}~}
zM@rP0?SA%IlQs(hJghoajG5Z~wCaL&f@^D26E5brUdjCs4rxzCx=kR8D4F=+pQ$VD
ztLV7_=3x7Ufh=A*@Va;OrgIfdRD@pfUkH$3cE{oJ;*-j)QF)*jSNa#OV^<hh2d>Jt
zvt{29I|k(peQ5~^5QBN=`^iD!YrqL-ugUIwz#-=9I+wO%1|)=rhuG?X4@Pl^RwMcp
z+9n7k=UM^FJk;%F#ts^%b{x=VNCwg{wJ#lX=3OUN0M97o`OEZeHLiolwfX+o(`uq&
zi)}{;nxM(_<pYLH%#t1n7Js7bc6GqRnV_VpNp~!b7P$VUvPeYb2_^Qwd*b;3AO-W8
zcTB2cRH<?vc6o6mGcRKsblbhhi$*MxV07)zZhjsJ=wF$CiHX-Q12fcT=hp~k$8K*j
zAJ>kfIgbC#Oi!3f%EEvH;kDGDOsIKHt}*CgdBXtPII<*b$2%VWjht*ic&qjGM&U(}
zKURyFxl@-%`*y^!&tR}g`IN9db8G~Wu0FfN<%H)B|4yg-Lmk6C>m(~|Ltig$6#aR^
za8OA+W~~^DSc-{^j64E_q$IB!R`7;$NO~%+eVwG10NIrQi|v`+|3q85(Yg|Z{TJRb
znaY~be?M-37EOq6+5cZ#0x_y}9{h&}KVnmsF~BuC8h--_K*g*@)FIRJ>!TX4hFazJ
z89*?_f4qj;zPGa-UV<C}rPMzWuYM9zYP_|scfU3oMik|l0IYUNM3&YM=fARme=oa;
zNW#$_2T<DM-w14731l9z#wq=Kc~z#Am1snH8d<PZR?2PLDj2@{z2Y)J$f5Y*r<E9y
zr?z3_`YM_4pXyV#@4K|eV8wr%aq}U#LPkU1E=qcP)G_S&vxOQj=kMO}cMpC`&4tCp
zMDw}dek1<FhNAXIZ0-|4-KNfehc94yp&=G*7mHYpc_29A>AXGhpmBxWfnXB|*r#WF
z)aOB9w}gECOT^ay6S3Q}!q&EDqz5}VY55uuY!h|X<CT^1xO@Gqk>I4^>@4Bb6hp5q
z7l4ClNpU^fg~4w8QFnMpW0=L%d;ls2y3sp!K?i3GA5AO4ygV69U7Km{z}H<qe?sF{
z@gicU5%~W+nY-wuilx~@-cZ7&P)TT3w_Vu;KL84R{{j?%76xT}^8wI>17R@_y{(jc
z{5;Tb$`XGRaAbmWV#c8)ZURt^WOw{-LpY5}D#V|Gnp@n7pBrc~8xX-(>&Igr{$agn
zNZ5?)b^T4<44mtrJ4KUW_|m#%<i`dA-|3)jJq<t<yiZ%o)!nE4y1zPW=9d3|wik_D
z{yf6Z{8LQ<AYWF`C`18OLo|5HPib%eMF0h4^>2z>rpM%(#MNEP??oj?%-QaIz}#;@
zlyG1rqFKE8c%!K{FYNHP>LYlG0vb0P1m?o5BG{d6x%}~IZrXZ+=ZozaKH(J2Id{OO
z=pztPF_qb2elY6!n;fhvtBMhC6%PRs@e)VjmH(m`GiV=oVx0lNlHwy~eA~AAi*J^+
zJPx3%46Qb|?d6YsnwS4PmxWQ49wJFkP|8C|AidiToE9Nya1ejexT3q`|7_9lE+_y2
zEtRt?uTPIEN+<_6Qfh&g$IvH{9ol@^LNpbo?<)}sPpiaLs6eb@!Vg^L>cXxPcY;Bv
zTXO?o>oh}xTnbuCGv0dp<j3)8PGD8wZUC8`iVk$}OxDXZq|!0Cap}b>T8QolHuAJ`
zghXcEtLMtC*r$ODQ{dKi4{5;R$3^jGX$=4pKVPbf=#H88b()QU0D=Msbw;KwQwj_-
zx(+E?><nh|G})bjmGI`DJxu&Ck>B{*8{liEPHxtnhN6ki07~|?Dx{>4JH)}$J`Nq)
zwr9r*y`w=~uzd2NO*K0X=S~_V18%jI`9*lgbE{uy0YWKq2NIq;IIbY!!qzI5-U*dZ
zvW~dNhIOM0KGU(%`zX)%;GIN*Z`pfj1;+RyHai<MO$Iyk$c8t#rXnCD;!sK^&P3Z%
zUvPWJefOSEhe27_pO+C2M2-66EgTwvvh&7O8OPK&<&L$5SFac3>=@(&1GV2)_nVnx
zUjx>GwN0^U<K(l!L46y}!OPsT9p_$(F&|??Cpe>L8vhF@UCizX_bsate+0&<!``Oc
ztpx&q6Ek`tQ{Ce5zMQd<UpZ2bBmP5s?uyvhF1dRCh9O~3?Gy8a_MCQA%6xy045-RG
z%gVUY-|RfIG{fTh_{Rzm=+RRA+ri#%l)_o5>Q8<%3DgBK9+`x-2APCaRP%3fzSTVQ
zW^YzI^!1-j6UN>jBn51G9F)U)i@zL<5#V3hKJ|V6#^=}@?nnFo!HJ&dJGJOZ8O*jf
zZm`rxmM4W@vmmU*-SR;>kwjQRB*k~MKWWNyuG+L}SXmmxpko@S6Wz&waMz7g#Wqsd
zr);u+M@V^b<ISEjm&Ez|eWNdO&Ui+Ac>XYJ?SoOu4?kP29S$e@(!nPofL`%>jURYp
zAi5I-?y(zxdX6C0r!cYOD17nl{(e!rh{ID$eT-|o4-BM}!+kAA%4uslHU&t@-;H*N
zTmkjc5>Sq=Y`dwKcrGc$x)hif;|i42V?9(m%SkkXigB&VF@LKaYNoqh?tjT9Rp_lR
z)okOUdG?WK64TGKqt8LhSWjwb2b$KPIjggYc4`i^1^6pTEu`<3Ws6Iv02IEZBz^*R
z!qt642^6*xc=0<1u#cbN|6l-ajxkg36}ip?Mxa$a8Q{Wv6J%Ot2~k3?*rWF^zTyh1
zRzDAq$+H2yEdOV$B15YmBp*8apZY0S!jG43TywN=o2qM`|EMVIsd`oBH;<P_)x_a_
zhz;-wbSeeifQ8^gf3u$(7UW9KX%Vkxj!h0NZT430UKssedB;IL{Yu5jOs~ov)fk$t
zgipf7%C>`}&TA|oy^?+7Uc8atZyr0R+M@nnn3897rOsEjwOqUNHxUuwYqQZtDc%T1
z@JbHL1=2rqXsVrw9_EinyXh^{z{6)LnSi_J?`)xDdwuFHIet?P6I||<N$V`+&W*Tt
z5M1-8&{Gs%w?z)=OF)1mQ2xjc5POTZS|HFX91pcM)joXfE{p1i)PtInu)rk89-69b
z2xPIr2m1sc4H(MF95GOGOrvuV!<eM)0H%>rkk+fQkh+m^f|>zAI>7Hb<}=Kd018?$
zMDteJvpT*Jhq1pX7V$m=fdy2^86LsTl{_-h=9T2B_FA92&`CQ0`NdQnKfUjWN^`8r
zCDy)uj^mR(+J@ZscwEAmU_yBMhdvqN;+ETM+FglDUR%0?g=5JYtNqaAO4WdqI}zIN
z;Q8kb1K2{$#%`3pVSkiCO_oM3HwP9TnFAZ3sHhzNdi51+tXa~2Ks`N^IABjLMye)p
zFVsHoWmp`u|3iQ8g)d}nxSm6brMb=yh|dmu#(2;+9Ov<(|B^LHfqn?Tz`A3KfPpqh
znMC3o_Q@of48CRdXmJL@UELZ&tDWR|L|06;^64}J0@oi}AK$FRJ{!7~fFP6&VY-#N
zh7R?bF0Aregfg&8ww<tVH%j^MPFU<u8yNA|wM87jf0&(@xc*eCk=b>klKaql*%F`{
z-XcFkzE6Xn>9#NM=#^QBaZw?*OI5zzctq4TCr+ashj0x~#oZP_Fd{_!O;HDU43Ot_
z#xuOjdMzar>gA|U6Ys(VhPojHi8khLOM#I+T%jb%JLk+p^;SpPV@fV}`{|_ulKj?*
zCGSb3(=4w~1=M>$FxF>bAat>Dc1aN*ib?Y@y<LyH7}^V4Sh~89<sLssuV$yvvUpCK
zzf!f}%iW#YydwJ>*g}9_3+G#W)iE$4@m&>j;u8;Em6L+}@{_tEj1?QOx^xkOi+39;
z1`N#^+;gB1P^lV|7u02tTr|62nO+p+!Xd$dq}!DGHYAre;a2*%S*@%T-KW7460!R>
zbw{m9U7%&a$O0x^HH^5;7tjs7s)6%LV>{Vh`BS&>fW*llI@CsB%5U0mRnomRXs$><
zLl7KVth}O<y?H0hU9tz)fwPB8YsqNIWTm<p*r(UDI;Lz)wSB(@SVe5_^SAdAU)(r3
zy_oGZc$XrjV=QT={kWlSh{O@@Umk34bV+7r(ra=yaw`$-|9L8vn6Zgc?~QEUsBuKX
z&96Qq>r)d*#Fs94c?09$jjvM&QU|&hv%Fnk-dwxYw}YV@GJ7VDDbj5$vDPD@{(qJ=
zsDbd4!|ioSu0&h#UY{$Ufn3BX7IQ$9-@EW~<KaJL77XbZzJ0F*r8CBl`C8k)+_2&Z
z@EHAKsG0UzITE*vc0}~t^^+o~<Lv5_LGwj16VaU48<jmb^HC-m&<M`8Jg?sh5^qt{
zo3%IGl|vg#mr$!Kt4;&81xS1a5luw6QgO}wLHZ6U<QBwJsJ9(-6|OEgptYEGuQUrl
z?xinknC*Z#S@CmOWgGf=^5S#j&XpgaKcGPWqnf#LA{tWiuLOP=%3={$x;BvpEN6xE
zFc)l-?dp?Fb)D5eHT`bygJC##rK<jgd&KQoXjj<{FsKJKek|WIUrz)h5tDCACb{b5
zQl)c+RHkyJp)m1AsXGRO&-oV{P%0<2lOYrIdptLj0f~4;8di*|t>~F8Tk3@3vSi|G
zZ^D;d12KO2s3Z7W1=PWZ-3XcPd|iz~T|hCDy8rj%aON8YUVR>ODsaKmSa+>hqna_2
zb}lB1VDNVp1@+whZ)iX|j^Hj1?r);jWsZN4WKE_6eDGn}|3f+BbE?Y?klpVM{G0qU
za2Do8a7#prH}%*#DgLG!W-I_{g7{!nQIGfb!^5(z%Ks+8VJN-u0tm6b{%bw>_wKqu
zw!gs=V)Ej{?s)H*7aIQO3phC2{O^ig)c>c`{gL_*c}1_-dEnyTv~<CMzW<fVHqavr
zeiiHX+VI$`3C70u5`Lht9X-($=tGL22Fj5w4)b@=;W%+W^_GW&_MMgn5z^QbUwc!=
z304XzP&@)eMRdxf(Jnn0trF^NIrVg}1ntPFhc5yOSUHp&w7u5!umB*fwwGk$D6(3G
z{5B%?&8AU-J(&CMl~gn_NjULS;VOhwD~|Ufeh1PU|A)!{N4unE;21!cw_fk4*@G75
zZ_9H$@=l<2azs>xQNJ`qJzfKoqgw?3)#O6Gpi`52^mgxGl*pZ2wR@SFJ2{y3>atJ4
z=)0fNUwiVb#f1srHFweeYch;xX39S8d3huAJ+JfDRg7<OTE_t38I{LlJ&?<#WYgQ?
zxu7aP)$RKA3mIaNwYjX5KJbXfXy>Hxv~b7Y8o<{U2k7FLa*+$~TueQIJ`9#TMTzVu
zVjVHK$CCj{s=XP$mPKISy3_xR*nx{D4uS`q4Khj@ef~QF-ltx38flks5Tu)H;5^Jc
zIVC`}DO#Q2R#x%>Sru05v3<z}7lYmsV~<~GxMClAR*E_)H;<{H8@w{dK)v*tl7c)U
zV+e+BnoF7rzmr=r@D|&rV)?8DN{g+fSm?%*BB4Hx+=0lf*-)#{u;a!If*HVA;lC}#
z0N{}d^LOHg?t#ibj`fkmBmr86D-6?_QU6jg)}L{Kj09pu+4f`Jrur|1LB^t%WLB9o
z=6Z^%!fH2=OQV+M;qNwFqb{OZu1AH=G41a_$+DOOEdd6+&xYJ~XV1Re2UanJ=|G;)
zjs(1Z4|td@0J_B&Pt&%ek<$^*nbo_i_pYc!701`52Mb-)e@2PPcAlH$@)9f@Wpj->
zEH+458!d1sbB&gYwMcQiJ#&dfxmO|BY$deB++FS5YHLwjutP-WWkE0S&3x^zjY1&I
zlc)>PbT2Mx6i~3%%@UP@WmQ}}Z{uX^SwfPZXwoO|lRJdG@oLZIVVR#V2#4;Ud?a_8
z>ER7}1~|h*2LsVuiKU;5Kj$gflFp>E(nNQ6mqd?J_erfIj%Bl&#kc`Sv}4-VoTJ>X
zeK-F3kwo3l{jO>cf>VVZFSyvZ`Fg0HYl6Ci$EU8yNL`bawokiTd4g)xmD0!cP2v*X
zWMv&^yyed!^>_=n#7N$ga~~gseVfNLWoKdgiAyo04)7jLtLpSFCufMuew}!Nw0Qc~
z^it{`b^(DL#Mv)o^@%y>Zh{s+>;kKpXybT2<6f$visc=R?AXOwl`Ryd&yu(>Sv(Xj
z?yGOyt!vZ0{2axSG)&!uQnFa?@Dcju`mz1QUC%QGuz^PPLr)*Q+I8^7&d&|g6HocH
z8%(uRSMj_#^oodE6u*vf_mqWtGH)K*EJJyq&;=g0$M(l&AfoMEh+;_QvG&TN9J03+
z=s8lS3Sm#SR0%{lu2ai&Wi%nTDY#z9xmUg7;mlmmDHmAjDz6R(0e{-kV;=jZ)_Tmp
zJ$H4%DoaKW!nV}arMZxlW=wV}-Doeg*)kt2-@n@C2eH!3YHGtEkt|ZS>DCys2-E1%
zdYr`;;RxGc1&&IZGG6uTTcQsgLJ(&hdS_xgAh!=^d}l8$f_`Hyx2nVr8?g3ATYcvs
zDWVvCk8ILWULv38C!gaO*4otAAOq00A3MePH#_V)sDAQg;VUj|_PAC`GqLifHy2gj
zRH1>ZQL{erL6fTg{QYAo<~nDue#X4#5EI&xpU@nnMif|?5OSGvQ%WSxK^;2ohKn1O
z$H*gBQmN(E*4Dv%S)>T<$z)J(sb@w%4_vpH4$8ul%k#+?(u9>rWm8Q{KMFB_E4OyB
z>{I^`YEG#n$HKVooZ9oAg_;n9W9-u6`ISO93i3s)h-Xb&hF{9#`wXP$vzYj_risG`
zX4<uc_54}2>dq&a2aJWd#3U+In)tng$GHUe4lP-Id$HR+TJJ!{u_#Ojp{+1<F6lv2
z<hX|zNqe$6ddf^o9WmR^5gP5<du=$}g_2KP3Lr0Hs4A;IQ0e2nk}mUSN``+pezl85
zhg+FvERU2<kn^SHgAt!Ovh#k3??ry&Sf(TGW`999y!-j*q_th3XKlcpy=Tw)U4Qv7
z-TIti$P)@m5L@rYiD}y22~PI+@5u9i8nkPjYrM|dbUIwt=GD4J&b{lW8=r`nFP^k$
zu^35II-3-l4LjvR?=#V;)qq7J(tdXTl&DWoiIsI|lR||SRV)Y)*1|Vu6?wHSRqb1<
zd>O~f*PxM&+ChklHkOb!{L<61AY%CDR0AL8>}&OU;$7V$kFxnA%&F6s#nK-b3vTxb
z9#-q-!g9cn6aw?Ox!6Divr#n`YT0qcjY_B7m3~Xu$#Dizj0=G^7^7s^kI4XzSp9pJ
zcAR4$nOWfRMHps7_c8ZsR}org5WXs<hW9IiEJ#nxHsac|7Rz-h6#SiAQu8QN*kg=s
zMY?v5Y7(aif8$tJxXUN2B0|?}XWA`{N|<3G%vuWtr9et1CSk8#uu&y>o+QSke5<Vb
zF&#(^qx84<vxxWlMq0l#`ZiIpVdl;Kh}{g|_AcMRPV5%qe{;u)@|Ud*Hv5fg+U{Nj
zNCiHmU6=jU5i9@hbw5PS*s+zMIJE57^veYXan{qCC5Jjn{R~sL&mQCUBy@IH&Wftt
z$9@kj#{kRM74UlJSl?R^FyhT<SJseI=V&@za7}5&>=jp|w&RHWlmdVl-{F4m?uYQ}
z@ZRz{di2Tp+B~_b$p$`buf!l;r4WknlwMQwz>hl1nK*_Y4)JCP^5Jm5y;w4Zml$b!
zBMBc`{*c0hpa_&~$PkveCoVJbebNnpQqD*WzaZZq92%l*B$H;fT;H^xb86WwWYraz
z;zDe>g*;}H#|9;h;2T*7i|+)Nq#WKT)4`TF&8V`7IwjM0QpuDDcbsvZ-3>xbS2{6B
zXvz4;Bda*8?u<_weBE`RdUnqSnXuKpQWUyj%g`l@{d|h~LG|3iR+?7Eu{~vnc(e0n
zhCkxagE8<=rHFzh)Ee_vB*phta$g!TDa%VmQnuhNaZ>={2b<l@^c#~5fRLrV;6|{`
zI~LUQi%BS-VgLCRZw&V;{;;tE10EIp*UbTbsDA_OkCd^k@JvtY*~aYg43t3^Ap%p*
zA8epziD~E{LZ(Vpvd0hStS*R+GzC!+yz|8i9X8|OHm#!f98iO^tYUTG9#V)aWi|7>
zndG84)6luifNYp_W!tZuc#Ui)#JWrgOfYt&MogU<wuA-apN&T#<zM6C(e5Jx7a}`J
zZbvlc*UDNxR33wByY$=B<tW{3g=okF_6MDf2L}_seB9^a>1y4jsUjQ*+$E#$vhIy}
z*F3agK?O+9K4V&<Z{>$tjkn&R@*q8jFUXjCX?J~{X-}F#%-}JWoxFrzt*p*@-AIki
z>yMLo)kZ=O|M*Bm&gpjh%xjUia7Wvhj<QRu<6A@530!0nVfJMAP=q^UioRR5#)bHf
zulE?o``4O};m<_JZ*|)(A;zBMK@2EvEJ9z2D;8PsdWuO!;l>_H1rv49eW-c8A1Xai
zF?L}2fSozVs31v~RdyG?cX%;|fx`BEXoyk5@?glhL-&vG+WnW$^w~W&`xV)`vA4Ar
z`-vG~7UuSW5YI#}hrTrRB}~+u==U}gjkhU=iB0gN{vk2UioQ;^;iI|;M*>r5-M8I)
z{e+I#SodCnU{>GFqx(Sl*rq?3B?RrHQKzj2W|UnKkr(;-dr`&;sAIJ~Ze4c2&XYBq
zggrNxMHh6@)^5ki^z72NH8b^i94E^!v!0E7)nV2>;1bvxAGfv%xh3U}%$jqu43TRH
zQHkBK@3E+5^IL>Ospy_zuFy-=2~GF6*tF5c$e~FSX<ly|bCsj*Ym$2Bi=MBvou3bv
zv|+VD-iKBRal&=0@2)xV$};kX8(Kt}rRTzwh~y02GUXh!<l6|BUq&7h<aIT_*~qi3
z6Fugz7WC7PAt9RKiS79|MFaVym6bWMA`z?0Up1bnb>WtVU<MlRnFaJNc^zN~mcjp0
z1AvF`OYAy3ac*jaGe34679ZpBMw#_Fpk*DzUpM<X-E!<fL_$Gpnl?lcmlbW^)O#JA
z{aLAJGOzvWd+j@BT4upJ-R3p6pqFRnf5w|nqouR0pC3-d1<kmt6e52?d{pKpyRLE#
zR3a%>)6mM6E#ub(x>yN^j=C#rp&K870DR{G)LDs(h6|fDS!K`bPlk)Rq6fzkpOMCS
zf=p`GXKc2*iRKfjpW3vl?Y-5~o=`^>A#|QL?<6CSJ!>;*n*2)b{S{a^l<VIVEe4Aa
zvr+9QHjdv5GKsX|o)Z3)Pyj*3gu#O)p|wfFnKCDeVx?oy1B%NJCQ#A_xOXZQg{);&
zb^-y07@45ZWjhipHIp6lJ#yKMZpf!&)vaNO@l7bx7Tx!coN|Z$a$M3P!mZE#h8BG5
z!uoEoQ;peQE%%d8e$L)34K)~>tIy5FQ5s8Z8Tn^|pS6B0hrm#lHfO~d*>ws()3Amq
ztoUyAxk3~KjkGVhCx04N+O}VDg<kRKY8@vssBEc}JL<gT)EoC^^y(0_<X(*1qy&%2
zp|f$s+fx<)Ip{LO?Y--CHwL)hs+8|Hh#|$eHlT@U9j(4OExRO+&d=e#lYXXGawiy*
z5b9>l{q=kW>txpT2=GfJA4H9w$a2+bj+4)7?9L*)h}X&z=LMELsAXy!M>=`>$nI~p
z0RFLa=(f99t}MPH-eZR;ax)dDtklMQ(6uGV|JtB1MDg3Xw;K?)=&0-2{or1Cf-}|d
zRh%%?_(ybLY5lTg%g=|s-C70$bKO~?dl`CRL{BdgxB+#_r><lwhASvZNqN0}N<&-Z
z20Hx}k5ne7;uq{#c--0X09e0{lMFP}_r2^^4nt#R+2XmxNa5Ylheq2%!i8PC;Lxw(
zdHh}>uPq4DQrZqk#(BNeAHs}~aPetq7QyV-1h{TGkTXDBq{yR#W3DSBG&UI?q0LkB
zUi16FjCmAq{2f$V>P@N)rFf&U$#vgKdzp$X&$?0W0C9=R;Xpc+_oViEon*A^5?~$~
z9G~FIGSv=?#t@o3rcz1n^=&96TfFlu=e~0&lS8r<j2v4Pt{Y`UC|QNdy2qBG{v`36
zY&I%pievLSA{vg_z~8pb_`ig*eTr-ySSOr}#f8d`lsKWUcYVnYJ>BGsF&33YT8{AV
zKN5DgE}r6dUPokNC_byRX^uCE$7DBmNo<92?!C0YX4me;v`^94>ArY$gHn=)2Vp{M
z!kZOwrup}Ax;aYat`t!V^fk-G2$lx;3JF%s?_s&-d3#enLw|m24)MY6mbf-mDeS62
zHQSu2*I_G9361@C%95W}H+LHlM{#RY5cThE&LgK{H>-Gr9J}>ZQILl0_5DrRB1&NX
z^;hfVrcK8L<wH}W!GLDJH+PEFW$Bs6$Bjb0yhr-D0_x#~y!Q{1qAB$kNp@R0BBro!
z3vEY4BC&5<C{zLwI^Ha`bhx&MqcPp&2`}T9o+q0ymmYZ`ZFxiQJ8EM!A6Odt*jyUO
zIgT&{p<3wqvSCx)sX6WngX8=b3Mu(xqf^URK==z@Ylia0^3>T*CPv!Ut4KX1>UeWE
z#+j&%^gOwFX->DS<`eJhHLD)P<p96FZ{QAK7m1ax#(M`Z-;PXrm7ia|NL_7&1n%BT
z*U(?$I3YDeG5BSJAyaNCi`#3WF%i0t$N6CB%aFRm;lAlZ#(pD?E7entb%DIQ+KJbs
zIoy}ALLM6&Pdt1_#qKWIeBG!VCAl!yhgTF%7x3$b_+jQB_gPDEnPjbc<hvk8{Cb(a
z4kYx(!Z7h0Sjr>hOReB92}QlP1V$0k$8ehcD`kTVuIo^8tZ0BY152pW9nVXP#^wV?
z=AYg=9)ZDPke3VT>K<|Wa3OAlAk)Y9{ykTEaf9wecFzaR41>_2KJ;9yw1tuZ$HOLk
z2Q7mnPn$+(5gHqB&RkE}NK>kyI%E=oAI5quE%AC1G?X@<#QEJ~kkKA2?q-+MK6&Bc
zdo0MXc(u14+ukn*bu$2p$0O1(C-w<nt`eV1Z#PMO_ms4`G_cIcBvNrws7?EF5(smW
z#j6#ph;y^nUZ#eU`bjvU-2nn(gU|h>apUbHj+dq-G;Hc}@m2C%)eC<3CC_Nvj1NZl
z_AAOQceqeT=@r3GW3gu)+8+eIy&`g-=Av@Pprqjs6&4@fAwCjAb&KYqA^Vd*z#FoA
z;+{nBY4%Pqviz0V&C`ee7#Y$WAhGtd-J~x??WQ9Q#S-W>-dNu}>Yn+kj(<KGc}#YE
z7r0S1+N9;%cOyxmzD2lEfJgY@B7WnK63)hB2WW8U=##kJd$$@t!Akk_s{?ZA9}7yd
zN{PnUD~^BCnyfp@`|91s9B1s-daa2Mn@dZlz-qrEq%M}SnH{xNkE(yMoBTtTO6gV;
zdMteVL6o>$5ssnHz{AEs9CIkj`xx6<p_jOYKJN1V0vFk5RIlGzopobkr(f;`n?rLh
zuLx_0;|j<d9%Y9^0@^bI$=cq$jq0X;`fI|mgnZ>dF>#ZxTj3jP?J7{#*`Kzu_Om=A
zdAOuLMO&|Pjz3R0d^k)=N3tVHun0I$!#iAnYx#rynzeJby01Re=Q;Ki$P!D0)sLIu
zf1N+V%pcrmTXriT+&Q@S(WTTi$Iv{E*}knjyxr>yxM3qo0GlBl8>`qiR_|SuSD0bQ
z3Fcu2TqE7`8R-x>yDr+(Uu4E<9R2=`?4@$XW#@lEZM$A(-1(f4pwX2saH*O_<mrp|
zY-7S|1VZW>CHqTGj+@`11BKI2YPIfcsoBGO0|tx5%3au{MS8`0iOq)orTHFADBX2q
zC5Ie(u{#{_u=xtSfgEY1`0;^rk@quGEaH_SMC6(!rudr%9sSew%S59_$xBcj>r#=S
zA%qdRVo5&k>-pEMDW%?4lU!Mt3*2V8vJ%93VH4dZ$uTk`mfmDE3W8W!6MEV*><KR;
zr)$0S(@=VroAypFT?T=GQbv3@PB0R`7C=fcrsN!AxRk5GNug_xIv?F(%ba*mB6Fcs
zGNGHpl>}><5R1Cox4Y01SrwOu$j$i5>&ohZO;S#!;#NzyN@nKLNB4pw7>61{8Hkwh
z<f5;xw8%3@a|GBG{(LAA7;Ymz{$cO+$gUGMq)R;7t4eAsV-KtyDTLUgLoji~AjY`X
zvPOXEC`&*W1~Ar=NJ~`N)4j_h3>cNc%^I<<qe~0;HLh+uG(psD)R()`4bu5jg;S(G
zxDPdE)J=NzZbYf$6m&56YROYD=-Xz|n~sQoSDaaXv0>Vz(DY{Mms{SGedax(N?}EE
zNlNrCCmPEqHlB!?UA!{KVW%RkrcQFtsuq%2C?4BbooSbCJwR2(b6{e>lCuZ9V!x;D
zwSOp3sMVu;c*&Uim+zXW^kLKwy5-%TEtNI<tH^Ov7e@6&$NFar=GNKn8$Z`9gp!H)
zP9<!}h4B5`i+TU4?S0NWn68ndn)fcm6P#PgXvdji^jE&2SZ|(@xFcm3d3D_LBufYI
ze9n5cvsR#hVZ4x6rklU)Tr!v0Lr}VdsMS2yYEdm%yzI!kk0sHnIvjaf=?u4V&HF<=
z4%S1JBJC}Kci7oC{HPa;v=5H4ypP*(i}q9SPJVi6Oa7@kHHc&A5>}Szc}cT%X54$u
z$zjD^zg_@=dE<akN*`@^Wa^zD-mAMG%nU9$y}>jae`M2LU6#D==zz5|Z_G92E8k6U
zK*_iSp`uph;E$q)zH+=n;c=k2SdTPV^UsbyR56(J3Q~sgSgL^KQKe5U64#hxlUTA8
zd=@a}V`8h*@l^UgNXa^N|BAA>xGMrHZt~n9Zj`<8qsc|S*cxn=*vguGZST;5rtILD
zLwpF&<6JW$FIJSa27Lh56A*~hxP;TNQ2(wH7Ps(D(NQPpqxkcm=7y~QqXlr}a34q^
zOmPtf7yQ~@?A|-RghYz0Ke}{|w=j0x2~p`Ji7AFx<ylvQUNsD@n)eDWqi3uY&AU7%
zX=+FkuN+$}TLcCq=sq><M~t$B$l_*DjmlCwUCGJhm7m(JxPYUzx~Byi6DRy|1*RoJ
zyS4LAEn<q<5c_b|#p3M4UgR@0;FKE-5AI#8RpYoY{QQ#Q@@|e>=Pj7g0dPZ(Uv!ia
z&ky`o)eHrtnM2TS)bVH1A5E94k_w#j_ziMzBCn3&IebG796fu5EE1pXYoW8PDEz<w
z*uZHhtWYp({UGF7Qc1~q&D?H2M(+24XgG29-aOZPOz5iPmV55J9{f0e$taKNyHg0B
z*}1{D4n&Pygq$njT?r|F>4M$wi_BX7m?m&6VK!34qfHTlzQiEC{Fz@nyUye0WtEsS
zLOj=#f0?S;x?hv3Fb!I%&b_P?a<<H5l_dD|o>^*6bo*_gm9eqW<IMh5b4|tfGqAC+
zuw(O#ym!M>egx-}gW{O6{2eDqni-FIRG_#h(xNM#X~h1Q5$|A|wW3A0Uy&<Kz*Vxs
zv@wKE4)vg@ODjpIY-`ra>r6wgcC>4ZnMkhu%IZwFb*GSIPp~yQ?CLaO3ieYa)WxFC
z?7C8fv%3T~`xLf3xEzWNKDBiZ#g+)ST!6Ti<Fow2x2E&q{=Aa8KXuJG0kG=u5Lf((
z=&h{Wnp-S0Z%oT-UeV>{ZJ)1Q;1o1_H^$1G@#g&<ZcA@2GQQV}hMWin;#4_0w)1&r
zY&|uw(eU8Wjj@d<bhW~+EHR553U62D!l8q3d<E}|Evr_U9>1pmxmUbr6Vsf#-{+W%
z(MG+xQ;zx0K)l!MC4XstPubnx{d3W*+$UX!88=VKHc28+;zv^4M^l{V7JMY<{9+h%
zcK@wL015}m^m{n((07gthP0M?49=w*rpR-NB)(tea@U!%qO9gVbbpXS=2e50(JSg(
zQ5~@r=b@BVf5ge?%mpWqhwCz#i1?)BetgBn_}+8F(Yzs;CkPidinz<jMex<1AAJ&h
z(>v-Z>ip`a<E7QB_H|0pT>@?t)wz{<$<`dHxf~m!)PwcW1;sv02X3)!3FSbABM<v1
z=)4hpbfWEB?m`6&m1k^|!?WQ{&vpq$SVel{K>70VG3lq6<sOQ-0pTc@?3tL*Ng>s0
zc@aTgUec4i7e29NEzBVrY1*%YT*~ow(v_<Anu)CrpuRVQk8;WQfs0GLGl!L4iz4Aw
z5Fr>=tID6@Qi@O}BQg=D@@C;t8TcRhX?{M3Z2;Ht5#00fw<}|<_K%I)_Y2mkFcl5B
zw2up$!zCrpcgaGFG^!SA7r1&Uk8GxtON_aeI06l4793tFGcy;3B4t*BNn72njaxVy
zm{RP2lFyQ-RMqDbkTX_x`2uXP4cC3&xNT7twdiU5V9(N~jQ#iH->56p(W#Tm(?_2V
z<A1r4e-S<=q^*Y{1!SLo+4pbjxNFZ|b>piDQgVNI=@i`Pma*~LX~x^yml+{Jn0=6<
zinF-2GO5b8ar><SrG2H;JzYzUjR9T6^(S3HAx1Tc&AIO-fKHgkg@i6p6*dKL8Q7CY
zH7uLXx4$)^8tt79qf$yWAEth4=r>*{yC8bBhgsxSP&DTt8f1h)q!9*&>BIvPbNoyX
z9t<QV%MK3J6aD-&%E=btNzy^e$1AFYjyNB{*df*=!=XsIu-pY9sZizm$%R!R1hOlp
z8wR@w@~Dg#Uk(K;ygzfHsNcauyg8RoCxi=woy#Q3)!i_$ks*u+nJf?YNBJEp8_F%w
zcq1ZQo#<_4E7+Xv1Qyrl@};G$<XH5xFU?cp(t1VxD+s;g!urYW)fRo$kBdyaxvU(|
zQe4Jj9yQ2vAW7G9hbYtwAu076)HxVc5ag~h`;{ESW7EkDGVA6mGo-e8a|7$g-#)BN
zzt;JV7!40SCNX|PVr!anl{`*fV~#%7oOnN<%NA-2sbA>A*i)D1+%O&%Q$;`ZurkC~
zhdU{kthzIgc3<@rEFO*$4G$rSLn=UpFJ4y0`0dyz*QUm0*^WqZ>rzGD(2B?NYc~BO
zE+br|UC^pn-G0IHD%sg~+3BLK`J%yDSF0}D4+V3gug!1%OL=_PL8qfHM=B3A)}5$a
z-FmmU6>~nsh{s(*tN17k-)7}0qoY}fCJOVX81nGf6IXEoLqjl1+^eHZ?|zN8=Tr+%
zg?*URW9smnk`k*cFIlTZcwj6bgm0j6fJIb{=i3Fot(|Mn+xnFfH-^Dw%-s@=I)7R9
zg#V!zaS6{T)68GdF=<_6V{xbKFx^{(jP>^t)!oZ$T#C?J4j%dJ7!K?+^;9@|An{Gv
z=xWxRbg917^H!hDOx-~eUL|x||JjHeZ%2;fovEU9tq^j9!DNgprN^lBI#fly&<1Aj
z&4qP2^#D6LRnR8PB`^N`a=eLmLSZe@9yIZ<1hpkT5Qy-dOOyL$){|&mdV^7mDP#}A
z-d=6w+?$OOwnQAtT#h$0FYWde%C9SqUa{8uGXLZJ+vpfZU!BRTjFmiJa}wl$8s2HQ
z)ghIMY)bkQ8QBivb(;i3tybJ9<pg$me1S*r^D`>Q$?|A9*_YXP4&sM-G%<6l<RL5*
znNkFMC}j|koyDyPDjpw;H{DgLladCtRF=dRv()u`@FVb1cCfBrO<TSTX8Uc-U+mk+
zNh#3~ojzsXB#?1oO!ax-<Sp%gO$a_7472^QevnMWwU3MM#W@D+C6x`ury1T8=AQ}e
zvN+5`eUl)T+K>2@4qM+6>M3{gQ;HRp+uFE(LSZ7btE)-KeDULX>u_m{^tcw;V+K&-
zAT(Lr?8P~kU*8|azk0&i@V=w1?P9my+EJaHC#J`(qa2&fO>&j-n*0cscr|!*8l+3K
zP7CeuK=xC~p^%M156BxScb+rMD|)9J`;BpeF4w--?~jPC-N!eGmXC0&ljjO?tG^BL
z{?bh(D1u`f^Dv2AD%c-sS{I(e5;xCf3q<ulYm3G~3=lc=>>}cw0guJ(j<t_3Wc48V
z`_xyr8ky3psB@9KeLz|{S0dQSGqP1sVz9bZXdCXy?sh3+t65+?yOJT06D6HLy@{l(
zQOB8!hFDy3c-pN~bH@qkP;dHH!WqX+u{jZhmI0yQJiCx5q>WzD$QM^c@HfAIcr;c!
zF~y<QgSzEpAHy<}7&~xwAJj#lF(RM3TeLubH`T1*8YgO_+3rcERVKxoU$;=&#7~Iz
zjHJm^G;;Jwo}Vl-<~_Si>OoX7NDrhX?KP8!(&28^Oo4a#-(s58R=U6X5;ih)@)Xb;
zptb|Ia53tMJTT{+LAHgIo?IT%NaArC^d;UQxocuPs}HjXn>ook2IH}@9F#QDMiIVu
zrZ)-_5V{mQZ`UPN<2uZ|VsDoh`nU>CD*U##slT*dHdrIv53&DM`*In%K!`0?>Hp4P
zwd7MJKYG#rQFV|n-X>j(TlNG#&5KX^7^-q?S={~zqG{BT$)2O^XPmx}?UVlCb7Iw?
z<F-V`sf?GSHMJoH1Nd}na+_(I#&|ow+GYP%df~mKi%bHntYY;)y0wzU6G6k++;Js=
zoZA9n85oL3QL;#@0Wcr`cm@BD@d2{xW<SHe%pJ`&sXv)P^iMaaknD&|9$)1XY+YkG
zh+j<z+pJDv_Soo|n&5__dFDBoIeG}AahDjQ=vmEvpq|?2_+|7s%WkZo>RkFB1XcSn
zH{vn)psUp(ootAz3l3E$d}fmZ@L15|QO|a&U}JxM{_^rYsX=+jWj%@M;l1kFB3Dj+
ze$5#V703{{;1_HvmTT(6R@e>4haO_Q{2Iq>@ca>ioK~h0RVa~O7ItO9-Ga<$XC?lU
zaxL&zuubB0(oLl3b=!`VuFU4K+}fD3#zWlaIKA?l6hj4rJe=Lpp)iDota+_+_}ALY
z!k6SP3YT?1<r$uVpV+5Ju-2SF;VJ&Pobv5WJtZ&?n@mr<)DTwx&Ulz{z=xuF;^c>W
z4T-wKtfYPk^ZH`@_=yI-%)@w-?n3@smk(N5_9pMiiEW6IaIBO_Z!(V}@Py04A5)_2
zS6W`uEkJzO-9JdL{mhfh7<|@ak;HbrQBy8oGiv4TCE1Bc-;c^tWc6@qw|D%yrRqt%
zB%@-q{&aHuvCvx#QdeA?ZYl`&Jp`jk8j)FL$f_*-dONm3g-V>Vgp5s81qB49^eG3T
zQ&&9+6B4VAOfEg@4uw(V9^p6(hWPfGp_|m(k=iKY-c3UWwmiCLvuBi*rHA($ys@W~
z_Ja;HY<k`C*&5kPI*qBeo5R{wRBu8ke$-O24wZh~>Fx%kmGi*kAu*7Re5U%cRvk6p
zJ9@ygMQZZ}Vv&tJ|5E|kK7?bQVm-?miAypGTsh6tE0X7Xh)ro^-1HZuguRiZTEEq4
z)z#SR%vv?s5P22x)k8<VkxNl)?)q8Ns^u>ul57^#xHnmi&fRb*B=}0_dBzW(8+qob
z&&)pF=RW&`LW49V)-t?^*7UnaOHmR{1Fi#+*psKK_#~sljbb87xP7Qc#Yk6_keahw
zg#)>K`kwXFBR!v2?-v|fhduJ<YPx+2`#S!>iC(iQkIj)g<1rqHAp^!A>Q1#B$ozhX
zMz)2;P`f2i=lu2(Xlc08$EvzmkWE=K(4>Skudv!?BefwNO^!<J>{u-{rQN5;$#g-0
zj=ebcoNNEJk*&yxBNrpelkYMJuF~1S0%<WFjHF1Pv-@#@`CiY8QG}#T5C;-;n}W4q
z(eXVwHFf)$qd4JP8=aF1n}g2XGM0=;z8>{h&1F|inF>3py^=r%DP9;e{e;-8&t0X2
zII)65WfYKLkEf<l_|S@*)}uvynZ@dF>=aky3Vvgo6EVHAx<Bdkjx&i~qKq$TB~7eR
z{Q4Ay9JP#%<DWP`SPt66>2-V(hqqcDFR{3s-7<8INIz#f&uz<bE{n1U@g2JA+2glR
z>vkCP4Kn=ZN3l<_s&wWnj$yjZFH_5V?V%fuqBWK8eQ<8!Q@i1dD&;B{78&ur#47mn
zms1x8<9QjTF(mPq_MBr1HU9gN)749@dF&i+gFZ#Rx+PP(qb`YKE@3AHw>F?>otT4n
z)jMb1v(0LDS9DC{*Ufos-CJmBqO&@GUsMC!cfy$fLo)fjP9Tx32m4bm20|O*c=EMa
zmb%uQw%q=x_2#ik5#6njJ4M#5^oo%pUP_m=BgE}rMFG6={c8GP;?mZn7@F^h2EAz`
zagZtqrhUXF-dqi-p8Ti?Ir!upG}h0=n#v-aNH^jK-!QFZD`L<I<u41;$7Ba%F#Fe-
z>%=hOktY{BPz@lZU^<2!K-p|gK{*;#@=o`CnH~dk9XJE*;a3+MpP1DC`pEFH1WR0?
zy3jzSu_LGVK)NQ?4nuaWt&*W*cY1NoV?Ge^EOHDqB>AC~6@LQ1HhOIMg4aYeHygxb
zfm}nvwGsJGh7;_&WSKi}lbwuY8AJB(jt#Mig>Q5r;I5B65Ttn4Y9SS--1|K`NASd7
z#;C@HB66y~e}#RP%*3T8QIl69eN^Dn%!#^r@$j7Yw?XW=$MlJO{a}ProoV~wjTvJX
z_7TG7m`a_181s?(MCCqBWvK;qos*3GItLO#F2?IRdz1K+vV>VuLDYMeP<K-U=Nb{E
z8QDnbw4ev|%-H_U-rlp>xhba@q)3L*ZA;lC96NkH7PQR}k+G7k5R;4P@hDlnbhw#H
zt7<X(ocFHh#TCX3(K$W`ug@QZ{y_C|_`G1)6xaO`x@-zxd#Ni#)*d3?rM4ogOwENy
zg*<n0<k!+I^87mF(iRg<tAuQfSl1WtkxjOfeWsYmF;~Vh1KrA+s+l;i&8zC27IvXz
z@w<3QMep2Pw^)5@=bXAp>-nI|?=ydOJiDyv4zIt@^vXIAbPiIMjk9x|`-qEm<nV8C
zI(Z~|_VjQYr{0`v#tJ?>X_6l3^0pi$kI{?a0Lu8ji+OB1(0i1(e>y(g{p?LC$u>%W
zL6$1MJzd8yBuhI%EeFR?-qu?xU-NY1%l&9fJU-95$ART@&udW|OVCsy`lPhvz70L(
z7GkN}q#%}V7yKw*!P0}S@OxUyJ-F$_?B}OqD+8M=W2=aATe3S7r64&2Wf}jxh@zd^
z6GBftQQ5?-zVFk9V#CRer?n7Ww9wndEer2t%U<fNMw)4*cVY|rWv{uhLgc`7F4Mw7
zGTf<1#-XBl1wu~o3gYd-#ArwRA?ly#eOpX3$FIB2GvC=nBF<?D#8eMv7xAx1*vHy4
zjLFtiRB?@}hK!!v(AM|3^gkQ9uvGd8dN?w{p2?mDMz|NdZ|SLiSM@`zwV#mJ9Pf}j
zf1Kik-FnAl^)<&rtvK!hgE^JqOp6M?a9bBY$ib?3ME6IL?HY&W_Np6RyXYFRSQ6V`
zoj=`+ldk+|8eX!Vd&KFiP#G#<J-+C(Rriu5QG%V6qebfMIVfAl%VAQWZ!3|{!2agW
z0PFCh&0VrD7)qPzHcud4b2ty6Nc5YGl-JM_v8&2W|1bWn+I3P2D7EV(m>$klhJE5+
zYj@$ARkXp6@#$j>@>0|Fi!LZJOii|YYO7MN^f~G)#Aj0t*P5e{$_-rhVOVW91ItOP
zd=c<elrqjakbdo_c)i4#xpm6wVUyk=BTWBU;_jhBPddb-bJGW@hR_NuBHQm5#OtkM
zRl-@6pNxT<FLE@tYGRN%G;M*pe7Jm1);GRp;rf$^7aYSrF|`b!XX+2bOJg=R{gGos
zn_`p&&tb0eU65}_mS3&O<)(8%U-OK#RYUK+30u;z^l+ZjjnFl{)vnM}oTKyD>9A;I
zvyIj1NX<+b1|jrpco$1t_$TY$^z{T$yw+32+RP!*%C_Zx9!VF^5%+qPbFg&!eX&pW
zWi!mj%Pdxd8}i^SSu%OB=z$s77PEn?-BaCBj?FuE>kRYkWlR1pODA>_YbiNMymuiN
zrB#^hg;)qD&$25~+b~tvfB*0$a$SM?Z83*9_!Q5+JDbYihdj>zDYC4&T{)x=wG}3$
zmSmoGnH@|@;e_lKJz0cI-s-Ir98H&pziU*)u-IQ;@>%nOY;?j&FEJx_6D0p)j-v*R
zBe!MBKT+imk6i-S|LofM43XjA%R+hRO1aTrYrCQw!*HhiWGzeWdW=2&e?0Wh5i~0M
zzY6>EcqrSq{e*;=BB^XiDtl4LHkA-U2+1<ZmOWyuGqxy8l(lSAB#G?HScmL{vhRi=
z*~dD=41U+>d7kg{exK)kfBxZ9^O>3ZzRv47&+9mj^StE_0RLIlbGo_OalO2rRQc4s
z>G;RrQ((RQU$m>@P3ydxo@6nbwkJ5NSqDZ}Bjk0D?`XH};-4dy9s2TB7V`O=8{`jp
zw|uPnE;hKpPCkG00I6OfM55zRxa>q=E1pVP|Bwpd4xUD9GRB+QnE`}mK{MR|Km4sy
z#d@<p;t^^f!<!m+k@yY(Sww8@4|!I(+Gy$NvAdblz2650vZGwwazq$J`K2Gy5vlgS
zEdIbhepw{ZrNGK>Ecx2Relsf8HZ`i!?sK#ksg%G0kLY!cqbC*ea_yyD-reE2dY5_F
zrf5MNesm?qLrt#TLvGrex0)U2eWRKuh~j}fK(RvlKUlpEa;{f^hTuWjZDXS)>A8)}
zY_3bSbUt~JUCaT#Sg`1e<g}jH6?HNTMtGWQ+aX-vA3}@)mtO-d_y!qpkU2<nII&Yw
z<`zaKhw!gvWyH7r+#C_C(j8<tc;>st;dN~WL_arfs?J;ERdoV?wTC~<t}VBrO8b5q
z%yw7|3)x*{vIlWTO}bd0HFbfUhS<A3IX#c<Q*gvmE8ueqm4*unc0uv2^t7L!ZEr%I
zz3Or6rc0AHPa-udIn-A>9UcUT@vUn*D-bf@ZkQtR{ZI1ATkJ%BWC-j;BL=V2?iupC
z>e!At*U`qEAylJPj~H|B=_aKZ7&t^_ai<8a893RJs>4NqljZHLhosBY(<AQoLK2OS
zOVSzYMH+)lIM`W0Ewgc)P)B4R!+IJY!+Pd<bq3b=rZ~Xr5t9ne&{|ZukodKny8sS1
zV|L?VJ)XM#08XegwVIfG&hGClKDj_37zQ8kdCgS)j;G)U1b?>juow$F)|`lzZTvBC
z3f{*B@7r*0*Wxic>n>OJP3so0+uXfyIH__*dh1u>`Nwu4QiCs~))ghUYq{R+zJt!0
zbDl61-VCjJl-n`3A(2z-v|>aq*(LWGjmVNqDe$H{`m23g?25qEMnAgEcT+F90DkZy
zDVyQH;_Lc(59}a6$5g;LruE8`-LWVZnz_SNiQG%WO^X*Ll$n}oQ24QELP{lJngsbB
zK7T|JmB$$lxuYMSsry#z@quaeQ{J&dnuuoyh#!WTHvJJN4+2~B``X;80E7kLy5j9O
z!(>@@6!&VfmY5vW$<%u_(4p-hCxL06^pbeli0#8v_^k8G#soq?07rdvKE(*$bLwEz
zg4}}+AJP=dmtbgC3o3oQ$=}=IiM!MRU;K<`L)CkSko{;i!r(=cHzGT@`+MhIe888e
zv%@D8-Y7U%$AXEOiq{}NdSL!6>YTJ6HQbNqpEp6-6FV}P+q~9xI(oVIJ{=&=S!p(t
zq;KWOxX3uiNvkKdKTew7xwPE0g}mNCL%iUeApP?9+k9V?dv_}Cf$O;w2Cn>U$m*qZ
zC~e``<&hepn+LpWO=Z4H5E*wL9j;*?#4>L4a_k%s`x=Hn>rAB(99dz``7+szVrnqq
z=&zjVo3YsW*p6fYRFS`o;=`VINS8Hl_aFM!C?|&Rn?1w<-Q_m#2of-lpCTMe$(W#~
zWWwKjx_KK7nuad&U)2{d45a>FvE;h4=fl32TI^%_EA%wi--#Z3v-5iNMPa?+q`fju
zcpUO8{w?vsE=W*xe+J3*(ltM;`?e8nt#hkp@ydb!H0JOB%epa*)hO{!XVtZ(BQ#$0
z2Me{dYgrio#gj30wAuRpP-<vxu;#_aRxT9;2^|0-7R|VWvd$k7({bRr@4bGg+D-xU
zNLH9EF+i*mvRsFm#n=b)WVJ;OaKYo_w9nWfRf74)ECa6Z@L^BI6*P*qNDp)m$5+B&
z%d>>`9X)qB`f6+&>ByM1hn#90UeRHTcaW!A6Vp=ytKlJsBnF`~!HTW78;iC?v7LXg
zx`F339w=*vkLUI{_oz6r)La<N0mxK$v<8ZgEJ9O5d%%FI#Y}?YV-0&BzwyaZqJyZP
zQqJc?+V`8FcnCQS3#nDYN0Ohq>Tmg@Ax^#YPN0>ci7V#JUCiNc3YP8;m9+K7+84;I
zR|j@C{hXOVj*1+gKHMx{K}Wn=dD_iNA65E`XS?a>r&t69Z|ZlFsFm;a@HMW<U&@)1
z5H3rN(n$-xmK!b2@9_{qr2a>O*bnHty4+{#qA(BBY5cd9Y9xeL#$pMbmA*41y8qg?
z2e>bBe?Ow$9!m3XOZ3~JZNUl*+m?l}$83k~nZSAuI@rOjVgE3q`g2EISE$o*$*G?z
z7aEBgHWW)SKPFehr!aGF(@*{(gf>We_bv>i>ByMH0SCmO$c~clG53&)`rM8Nu_yDK
zj`hh)FJ-}~(Fv!EWmTsBe%AK`pcV1ZXb(yP-&EiHV3KEQgrNbO9dT$`;xij6%gxk-
zaV($|`$cU9jO?)eajbmTI*cvur$X71O=tA5p;V6=?vMgD5P{`M_h18M6-Zb0JL@Y)
zkzwOjgHHKc3#=rIk-<Ud3t$;go7@)zor8c7^a&?+xJQC=r6!56pYm5WwAtMybK>hF
zLBX3FjppHe{{VTnL+ewnD8yfkc={mGolws=i6mf;<ks5ZAH;jeqs&^^?#7(vclf?^
zPLrN{fO_{|;Fglydt&GSVN*r@bN>@l%t8n`mA*fBWXGZZ04Bc`%J$PgcmFT__P_r)
zlXw`+0ZZJunRWf4-O)FQR!5^kS<*k7Xx5+5tb%^r_N%iDr7k4x&ZO9HhK6_RCqX#v
z`ayf_$l3kyx(d8#CFAl}*blL%SViI!JK|AHt<wU#gW(JlXyL+3#f+HdUI(FNne61{
zMS1}O)$0XGeiTv$P3bTB>B$5Dul$kN@5D%2mi3bDv<pr@v2kyw^Mug4Yy_F5Z$~|n
z+&6+OF@KBu6nR}JNQmec$?J#su*M8pV6Z&JxaXHfRV@N0awF;Rl-eUZ88+!l<k@|`
zr#D~bkM3N%J>>oFNF$fHu+sZi7<q`l{CVcrJ67Q_Y#a}!;<ZF$+Zze;u5S^oOJ3Gx
z9NGHDIP&X_n6L4Ftm2Vt1DD4YYZL2V20(8ehf(%#r1<U)aHL@+FxI!AZ|?9WI`g5-
zGGo3LjKJr5%XN_<ztA3U?=^10#WKb8Z_A3B0>G+gn{s3~eMC8oz7Gt?<A0PaWc#{q
zN;}at;o^ywM!xmXlTvFV-#6Jcme@^Mpth{gnkq@OIl+jX9SjZh=zK7%#dl~kHjFt%
zuubohgu7ledGqZw3vwJC%YItsU8K*$T>64FVr^Hsp@o}n*f&^}Hj=c!VAwlQ5Nkcp
zRk3`{=93Q&z3BGhp;&~{uKVtTGW?jqn$)<86so96`mLOgpS{E*zY#nXbjC{loS$C|
z1UqZ5Bw~*<*J5yxI68<UZ*z8{{bvv<gk(q*MVYFB4C3g(Ew2|VoQda#u5>m-uh!`l
zD)9237*0j>TL~18x_?mMlEQ}^rT9CqnAQUDQ#^odJ`de5jy+h%o=Jsp;3de$FP*Q#
zgG}`5as;Iv-@0{6ASGKF`0_@7`LEWwFA5{{xXi^svY27pBBX8@xy71WMZE4@EY*-!
zS*>aJ>X7i=iK@)YzHHb#->-$NlfJg-pt~xaJv<<|T($MK@}YhCW;>*OKx!-68e6xZ
z3%46)nACEZgrNHmxf2fH>Gr}SD|9eC^+-M%Jd9k*y~AG7;5h%oF+{fN{1Sjuem3Kl
z4IQ=IDP%Ug(A8RMxye?&1uE|vZr6J;Z8XoI7Q;NhE+9hHTi(4GwHkJu<=K7?Dgb_@
zn<&!XXyysulB?55rdx1&n)@k{3=AUlej`U4w}tw+!jBoN<hra(&qBEhi@=fHT>jOr
z)sK&#%WTQoc=(pBR7s@6H1pQWDqwLLC!Bsgna4F{a24qk3RUg>v~GAZH>;kI{9$y>
z56R>*&#G?eZ}qO6_{wI>#ME%?BC2w&f$YU;giHFem`Dy0U#*o8u0@Tup;Rj=T-%s?
zQ9C(dowd)dO&65bmE)NsBrZ^%QjY7LUdAFFc^1n|G1O~ex!$vE*%>$*g<}Un@V;*3
z14WwI;Tp(BEo5C6vCdk_koz^Oo{f0AI;S4ZA^SB#&`f3YlIUAEa|a1wlc(Q~3|bFQ
zATt)@B1P^CvF|x*jvjU`7Yr@K);LTzn>5ngd7u}wUgs+u<&84pt<d5WY+9Do-_7h!
z8r@i5g<qZ*h~+9~^)~bARa~3$XE$icBxyz=GMMA9YJ6F3$9(IzS(lui_+>jjr4{oU
zqI4?m1++K>O6isxr32k^^A;m)cTRXWnC2T;FK;9Ep7G$Ch|W8t{P7!*&6!}Pm+eL}
zsrTB;S3@`7qnBQArJd84<THPfKm{y&zb?MKqqVq7g*>QL!-}VoYe9!Nn=fzCo&Yxq
z264vpf%XTN9#_xdqGLY@?%TroK8otQgDz9=s=LO!L>l5UU@$RjyN{_}_rdjUeSWmo
z$0^xq6PGFByQU*Q0@oXQQxv_C=rW6DF(|xaGDF^+E*M0Y4@rfz_4#b1L@s=+V{9BO
z=C-CJHX^UwJv;8n?Mf#sLXlAAbmlkHvXk93da+LDno=CJ1Duw<ViM-owrD|M<~^^J
zePww2eGT_q6L)1gUK$=Y4p{hQu}m^E-kN;M7w%MpiuS=apDQh7cCrYUvKqZNd_>)u
zx3&D`m(?Ydyl%`5o4#+C&05j5JA4ySh|Abht|RRQ4;-bu-jT5;vhH4L=r+i><|gX0
z_=u@IeevfXJktvncDaMyH0r!{EGy|HD-ADSAwM}l{h&l^`=kbMqYEk`D_Z2j3tJh9
zlJJ)%gmV>*Dc(u)QdhvVr-+M&g*la}h`D5o4sD6+0%1D(X`*kRVyTIFZ9Xq}jv1UX
za2*#*#!HczeCx(-cQ~mbwTc@xiiTh~&%lV_g*~#NjlF0`%38#ta&xSTCLx!0s^mi4
zul2{dGyOYtJ+G;!>qvKAITSBAWx`!OZC4I$?d}Q3d^}Oy6w?47cG|w}xmHqV(fYz)
z+~PXwNp|r>Ztj=Y!+XV7raw(;C~mybT9P${pO(6RXx-uPqAxyHZxySaHMI#@Ea?qM
zS9Is(rzUN@)~d9O3O_v}W^7+O_tGV6jF9J#pe`OEd{r|{JD6*ecF6X`$H!__P3+l>
zZ-X>P5ZRn1-H(5KY%bVnUyX&fi<IwiH8DrIFJ0Cw;gG*rRGJ&`aHiDzYGv1ny4m{C
zrV#$h2SrxVWXp~Ozd<@e%9*-D>rBr9@@ZGE_0w+I84fFK{!}e!Z>E|cJxGjNtnf8D
zTJSjCB(2K9xmHI&R+Zc7k<`4F5husEwH=K*d^w}a!R1Y8=XO6np~5zeOwMnxl(@FF
z@!6!K4-7`Dkt&X8>#e4MLL|>BS=%9Hg6yN!K)5G!sjZoC&(MZ$pJp1I2+H0vk1=aO
zDK93!coYls8CB1HD9?4_Pu%DJ1NT2cknd1)X(+6o2b(E>PE9}FjlXep;28WKz3g1D
zb4xZyVYFGxvx~s0ARsC}(ayy)rlHInS}*I1v@AAWsj-XDya@Hh_nhex7<yx5Gg_%s
zz0&NnHM%Ag_F3bkMN<%arP9@)*j^10mmJN@lGf9WUmFK9qQ@_ZzKFe3A7#97->I+)
zO-|CZG*CM_)x=%Z_W0UfO=fk%gQ2nx)J~{e{*$VK4K45Cn7nZw)BC(>$N5mo9g;&;
zzQmFli<NS#{PVjr*^8FBU_N1|9mk%Gb+OMx^&@)+(z<cU#fr{`dC6I%UBIuFxk>e>
z^Hy6mBAqStf(hH-6VEqheYLjhY{2;Hfz(?r>9*)_n<1`i;T*DZbUqha;C<9%a8nj#
zEZDz?&_>2bFvQ&<yEP7H(7e{!#g5R;(-mgg?a4t6dl%<HzXL3msGCTnUMjBTs)#&V
zvzvz@UZSCFdb&vFUT;hgYQmamxUuss*AL@1G=5t0aWKF4#DtolSafKc%W$TafwGLK
zY24RXFTA>LT)Bxy$j-&#3_KeV3nfNI$gpAto?!3=g&WE8Ia&SF9^})QoD>)iMr7X&
z@{J8$PA{qBz$>5d;Ijjbs9>>re;Op*uzIq0F}ia(#fW#0jWr~xVoy@su0MZQMgly_
zD14Tk_1IesV&^rjOD^|(Tdiz(j5=hr!$3W*P3lS;o!+zV?3r*er?)c3)$pG6v$eWo
zxj5N5>*29uwK~RrG15xN-doTMBShEcDc2|lTZOd<hgG*0$coKowfAI1!Td8`rHXUT
z1+6pjj;|z;J32p*qWFBms;aYoruQc6x!nBE`ATE%YlRN@^_}k4j>B<|J2g4tj*s`A
zlw0VFVt5K)>mUlp*N?e09P18Ch^}PMBIDGBrn7t#42odxxg%-2W<HaM3I3G~$>oaQ
zWm$Mu!KIw9dn>-x);6--v$N#zaU6k&SY9J}O%z|Oi`sq+W&{ZDWEQ6lBQQEm+Nd1i
zr^b~un8Q>}e1@PNJb6&H0`CU6tQrNuWga3MG6<$OmixjeJZv%X9&Cg=ihtwSK~-ZP
zE}zeV5VSs>!9qz}C3OCyJ$NWbA`8f_7ey69tamT-6)r&8A8+y|A{YEl@l6K=e*FAh
zAmN0tKurEO4XBLg%%z4wzTBL+CReqqZMTZrh_wmRkBtVA->?r$H^o<5>3+7N+<0Jj
z7&i(D?J=r#bW?;f(%b3PMT}?+uUD1Co_Q!|aofpp6HL>uHxF&XHK|I&LPLdRyKS6$
zZJN(BG0nUwED*3*%@5bmkTDs>F{T|+620Gwxzt;=Sg0{rVyK?T(jm@RHN%9P?w0xT
zRxG%CIzhGNqjO>=!R{+3J7GWpy4`d(IUwf}m#HxpH{+o(yuNpQK34F0`Oi0tmdg&I
z5>ju!&v%V?()Yixu9>@d0?8$W1NK6*D#Fi_x9CZd(VnYPo<+$DV{%7l##G@qZ3Fo$
zTHIcq#RENo2Ha)InoUv{jk{<pcrduFhfh}|U1w%qnYC<PGW1f68b%}o8VM{3`~<3l
zd!~PeIJeG7gnN#BU%GP^%UFFHx)wI9Sg_9ZpH~KGNv^zy6%2|kLDwNW=7-Vp=i0dK
zd6-@%m<i;3QWq3PjJA=(Xc2F}zs3zfci5@1Av;(oEx!;rG+`lwYkw8Y;aR5)GIm(l
ztAlfeYWshq;AePJE0{FuA$i8vnm8sE5g&=M)KM_f(cxraFBph%QLT**iL8G5HG)^@
zm6>O|;@WgIdss&Bnq5QN?q`quY)!>Ow+xe!Tg&M#b$iD@9#^*-SG7VEJZ(_A315r=
z6RJyjkxp8eYSWHBf$69)#yI;5%f0+%`pzE$3n`|RyqK&IcSjO7M;v}T#-aI{5l`jD
zU}`2|0qL~&J!eZ`;m-H<_eLn)AG)pyA0FDQ3~9KuE_Tioo-^FhSWbT1S#5#XqN-}#
z)<~?QS7w^ani&^aPcvKjf)Rc-u3*#*k9D#SfjA3iqdF^Q*peqjcfUM#eP{W+K+;_=
z?|4)1koU^+Of&T7m-bT8YZ_)>3WeMCjlR%TUl#UWMTddHv<c!lwmd7>w6n1wt-R-G
zvbWEDASRK0o)WEjQ<3>|g^PlnZHp?1XV(Qd0XcnyYJo4=8Za)@d(F(y8eRN7vMk$v
z<?a&`#g(#oVgg09<|niMQMT5o7dn2^1ZX)}>Z2GoUL4+Muh=r%v~+jkJHh4ady5lE
zI;pRhtDasMv@wnm5lBfE@O{t1<7n_Y(wa+++r5Rid+HUJN)VsMElb_OFWRp)ecnpn
zQIbmt%B-?!nj~F-HYv$;iVU8y-u>v2AUO;b&CcJrGSSoFwJgb%WbWC$Clbf8u{X7P
zs-3~DiyQaVYCi0#-tqNirTIE9<Gh&cLawL{n^T!XZ63!(yE;(PC(_|zrCC`4>2?us
zc}e!Na>llx?pQs>X3ZZjZJNG)!ShaWpJFgS^csM!6}l0-Kv_5suiuWDubcSNkwamC
z4VJGp%{N~_Ul_QI`@{{6upI#0WY<sT(&yGC?8n`){_?=n@xReW9Nf)1!Ti3k1bxY3
z`?$T`nfcYW3-Qxgr5y5ik;I(jwZZ5d66xmFhHl&1#xAd@f~SrIo8iYa;-kqpLy4wl
zQ{CW}@5aht5=Bv@rnBTb*p*~soxJszxRQ9OI}snRd#h&Xk=Aof!%^ZsnxP)$QQ(w)
z=Dg_r0s*XMKfJQ2GV_zj^4Qa)q}@#cv&1dKOn7}pf8o>QG->(Rww`-Srmem4tVh|d
zN?WF<1@L1^UHZXu@8I@we7)m8v*X%aw=1VyRyi75Y@EWLEH+<pYrzSXAtSBspN(Kq
z2}vssNy9QP;l;>||KY$5r~Co93keJGrSnVs1qx{9Q!gBlt%3Zhll(<=AK-4LfqW|$
zFgg{dFI61ee@HUuO%=Y-GCDL?vwU_oRp6Vwx3TM^`Saoh_R7HQ&f{stJIu|#JCHNO
zmG_0Sy8BluVzP-egMKI=@Hhn3O(+!~Q}Fg*e3U>`SVTmGxvH7)iQX6FPY78y@6H5J
z`1PK{%6!wX-LME_w553gziB*NY<iBVP|fPT7co|^YsA+7+=Feq@-MVmQZ12sJyz;v
z^TqvRQ~5UVY1r*s2JEVd5#Q&_(~f`>R93xS8kBNf%y{bm$plXO2P?Pd-Fs7U_j3Nr
z?Nt7~>l~7x0fD5Air^sLf<FWLicKX&4dNxoypSDGaag1t3oe~lEWw$1WR_IY>|#67
zwd+TFL$rEj!~ngf-{({a3P&0#$>Ilvq2US}eX6TtQku<n@{<9)<0sjZi6t)6LTwz=
z(eBEFuO<zn$Y{NnA~MBBS42i7`40UIy0bEGt(Rw!da5orv!VL^MPcXKD0;Ledc}rq
zz+QCW6)C1(0@=ADvsU|o_}LhtLvtMJo*4YW{zX`6cH~$_s!(CH&YyQ8J?GfCV`{m(
z;HC|_k&x9lGninON%np`sp5vCbH>Qv1Qtrl;Xv0m8g#aNX1z-#L_l05ABJw$6W$M8
zg^#i>COF^F;$XjZDvm7BlY%N$ZqWxq86S<>1cL(B{P07b*~&n0Z-7!pq%sYN?`jOh
zi&q{I>yL<Efs%6*c2y`sx#~zKB?H8r)_B8*A%1rhw|#=C(K}z{85s%&@Jy=fxULev
zx)t~!!e%AaM00Z<M-A^5-`jj6eXANd!t8mYYtk)o$|ZSoo;G=`J$@L9&I;!kf@U|;
zN}hiV7=?=F<7`(3SBo?y+~JQBt_`Qy!*r(1NkyggN-|tv68^E;u8)1~tGh-iLSKIj
zUvj?hTQ-Z3STp>LB>qbEi|viCh<DjgJ$9E<3xo8w<P6gxoPt)5Yz)~stqxqXmFN^6
zJVX8MqPp<BRB<blFRUl$#pn9>Y=fNQ!dq|uI-2K`4pS{aNQFmZi>LuKU!sYEPs|Uf
z^e@yo--*KxT{W(SkdOF(fNjZa=J#&?$h!d^HSc?4sr8YXu6@PLNET4*;{VA}{~p<*
zFZU|_h`K6o>yL`?xHU-9TrU4KJ=?it_fDa$jYVZh3{SP)Oy#fUk79*3-((7Wo-EU^
zu9V(ksQ4K2J}Nc#L(O^7cZPXhX+Be%GsDIu^4fP2lXWHQbF~F(qXq{XFetvgH>D-*
zY=mS`u6p&Xlf5g@HJ?YSVzR`ZTPHT2ldR9bJ*4`mKkvbk*J5#hM3qK^t@-m?kBW6b
z%j|rg?XY};S%~ya&P+YdiSlss2_7Qd?_o2)h1P|Y>tI8$!D40^+@DazUzvu&{Y@US
zr?b@q-i1PV{wcKl7Jb>K{IfwxsA;o_b6*zjZaTssbJUw2xwVtq0{fXwKi?vJC;geC
z&Dp3wGsL}yjMO!RMv;q(aGkDBp6k}caLcZQa`31IetktYC4MVQYHQ+sQcl2Uo+%o=
zzD@LjPmh~egq&Y%8qlaaJ4cwzMT&ii$=$UvP0VV{wbo6lBF%I*Z)^PMab9`)VN|_r
z+vQ-Y<V#ii7o}f@0{AOjM-+sGdcA#jvo+ZU5+3Wp^}+OghSjh7?Z<1}PQ_mmH8Vc=
zAAH@vIEx6nR*U;OiM^V3SyzOLN7)Q}G5|sU+Jy~N%UvF{KnJ`t$ON^B=AmeWjFt3G
zUlZ$@h^N4aG4$z*uQ{L13`}@REw0r?wcOZDx^gc^9!~N(kv`3lFdZn9Zde%l%)Si&
zF4LvHBdyMw^t8XbZED!p<PEG8qN~Cj^K^4uxtdfOv>K|pY}wW{E~l+P{1`IvGy(go
zlDdS#JkoD$&U9ReZ{3iYju-38apEjRc$8WXM-8Ix+}V&wHg%Z9Q%$_O@;VZgb?+4W
zETuY~*?Y}^v6^}YgJaltmh?RBYs<;$kh?3r>CZLWa7mRYmw*p08-}dH4TVn~^j)^=
zxx|`B^f=Z$I4c7u@=cJVc<6ji{5fm5S;c6y+2*%Nru|Gy_|ouvQ$qNdFR=Yl&L!^h
zqN{S>)-H9{;n~Tt?K5%qYZA!7ajcYsn^<_8ZM%`h{hO+pKU87be*dTDcV_++IDndU
z$5gouy{KfKir+I8lp<@L<4(9#gc(_{Hu>N?uCTRzO;D|TuOU_(?TdP)WYbTtcr!U9
zS;1xaX;)8y67#5YjImF15&3e~X`?BUS4UY^!c>}5$~mVWvp*)oEX~AgL&F~2$$k{@
zLG{{=s6|p&fpVE*kVZu~4@<pf;5OUPJ-ga2WVcE)o64Qe@u=dNU3P=no+oxwT*EJ8
z0`I*u7klHN%K9Xh^;~RLXTn1pKfzXHdiN)$rE#f|HQn6Y`1JY2X*yeK^`blT<A4)b
zt(eho-u~HMFjLQ4Te3YD5!`<bgD_0dpV0XN=FJJL{-tVSQTXVg1G}n8XEkxZg-usk
zNK8xKRH%6CZNo#%*qV`)^w^Al-H;%H?{aZBKL}2bcANX6%=WB4UORBR)q!W^s+gL%
zf3rX-R4lAdSvQZXpzdPXFKp)4!u1t%9LhoPa@&VO50i7Zx87?=Ny#KQidMriJI~+V
z1_jVJgJn6#JfE3*u5?tUQLC^OX7n<@@oD5(QTLdnp(e7<114g)i~phIGK`5k(c2`!
zGFX-5-6^yRD#taFYw5$xDpHZMVf>r+aIP+B(dBFDC<pSaH~e*G+M!^ty|rO$a1!4u
zIFp@la;fRUvM@MBq@EwYV0fAv=4;_UlJ)501Cd4R`)83yp`U>;!Df64RhRpBAhL)D
z0@X7emh^LKEsh3itLn6ft1m{)-0OMB`>^)6y6D#>h=l+!aVc+4C5s)`sF*(Zs&M?W
zlI8#+DYtc0P<TsU^Zp|acTU-h7Dq#^<yMmujilNF#d72Jd^}8llsOEQ*jYJ<d25{d
zS@E;Y+KnNv@M>BYe?rjg8Ma%4t7(8pHbPxI0UCg7+xjDiZzw~S;-P&C+2cKe2J+Hc
z3SZ8?cW_gaNrW#XQCRhovy56kYUqrs)ZYiad|X1TLmyDEf1SOPebn5=H*tIMsf_$s
z^NohZ;+;4ftM~J+LzPfWxs2zVH;)(e*$yy$zoVacyfgCi!*9=E)%CRMHU!&)sYcMe
ztZ?09uS7}}@^7v9j6%eW8uK4_YLaiktM>G7M436kQhgL@l?qt{Qb(_<M`=i%?CjVe
zcQLs%=E7FHZ+lBVnnCE0rrUgzgxaKvrXn*N=s<+d;gQchQH19MjJv6lHERbeRY(3R
zJ-wtM=fs6GJF|Y2>b;2_T2d39>vpC_-OdmFt0w#SE10LC1+uO#NumY9%Y??{A@UKZ
zfw}QZFo3H!FRL}u$QDe<?wVw7^I8vXQLK~DemZ~RZDE0G%KiJzG%@h1OhMax0j$0L
zHP$J)>L<x^tgI&tcdEOC+ZL?jpU+Npb>#1b9}{=zIWss=U}&m6(QD4wm%bSH)`2v)
zlhB-HSg7aFBd~hMW9@TEMXAVndl{>rZ!RI;(U))|E!{q2?ZO$l#@=_&F?HD-dO3XJ
z%ixFZ*)L2)OR7RJ*PtFXRL}DymuV?BGVI4%KB`}RJAU^|q%+rMV%#jvUW0Ge1ZIE@
zuE$jIXrz{KJa#7~70g9IJqWxmru3feTH*4mi-@b!=qESl)F&AfY&j`Poa958g7Woq
zYOr)}pRVIm11i15Kr}?GwoUU=NS8r~I<PiIv82o1%31H7g2OVZZJlM4(2T@=hYt(E
zF4;_VG#oTwzY9AIM50+wwW{Y!w#GQ(r)aeabxJL#J~HE37b0%3{TT}5SDy<JvZW@L
z%HB*}@BJ`N^n&DESi-U617tl?*Y#%nEmRSujlH*m`3>r|KMGaW(i(TgEDz9v^k3Be
z?fKtkqy1&~x_gcLm(8iT^_>fhhu39jLM4RtB6wbu)*DTV?9%*KQti0_IW8{DA8VeS
zvFE~RT*JS}zOn!2pYEBA7YF=HI=If}0W2a_n!{h22-hi6@C(-Z5W#x-G4&PG2tt%C
zHC~9!fceY$;nqkUazuTu&bFSGHWi3Qt#W<c&IeJq%U)0dP>yma__z?nGZ)D7D`WfD
z1;79Y8H5PoulksTI7`8wap`@H_zV>V&rE^b%YC9=#q9t0HSdj#mg8CT`L=eMd<fIq
z^i+eedKKvp?#X^)E02HPiZcOI;3AuEJedj28t|I>R>qXSIB}p)ee%$sYyAqv$F{GG
zl;i0p6)I_+W)7Zk4nr%Ad=5i5JdHp7Su{Omrfov;_rifm#8dNRT7NI)Gbl4vr_@5{
zEMwy|g@RW)e=dJ}l=|Rh<XAN-5CWJ}{PQ)6JphPjOcz~fJuFxwDJuyc-PkJr<iPXo
zr1{s#v~h+|Gmj(t69)gsvC4mY26!h14YY*M+#NrB-1`1!U(-iEwZwoGTI7-cT1VHH
zbPT8B<O*3VHNCRL4g}D|vT*hs!ZVVo6#l}3zn?}woq~WTBvc0p7ID)Y@%IVlpA-N_
zzXydLt=^9Oe4q&DW1jerdB@7*%xg1M2VL2WcQos6VkW#zUNV|kR)NF$kOjV%Du76-
zJ6?iUMBu4+?(yu<0Ob!a=uAstur4n(M&zZb4QOvP@q;P@fAHW&<aN-h_ovQEm}^o^
ziS$(Xxpfj$By+g3kKS9SL4yE3tfZX1(Q>p+ae776;=YSnnGl2d{A-CB$@&rr_M8AJ
z?jH~qorOc7^ut5AjtCz97Lvf%YD~pF*c1pnF_RgC1l>l%A(b-6uclA0`_bV<i~T!@
z)Xtcv=-N8lC*`g)Ys{zO&VJisJh%}KoF`FZx7=5sn>B8vdQgsA?pBq}=nIcbJ!tl7
zeO;(x(GR3>4ExbhYqW7GLLCg#Pk$m<n!N4GpMaZ8SKyrgRPt_WZL#mzE9(OXj^?S}
zx^d4`2cj_WyWM^Q^f;U#`+>|?oF_X21-G|u_ayr@o^$HN_cG)IIlZ;Li|jrXq08AE
zsE}%rDKX&296ftC$&4PEy-2c{)G@%ZG_6%Ot|hE_6g-20mI+>OvL9>`SOhl7UAPOo
zhQJIUsHj=C*ptPkv`im*d@~{}zMOGGIhgqtK#{qp!IOSdYA{+JJpHZ7L;i>wj4kyw
ziBHlP{rSoc^CXnB|Iqb@#S^4Q#;s^$`LG%0lnR;J+yN$MLx(f-&RYYCM}<!{75ZJ5
z=X=$eSC6hL!NISdZB!qO^fruaE9&GD(BA&MW?b-rdsmyI#&_fxOM344oyPvm<)l47
zpmf(Q*~*&I?u`ZQ1vmZ_p;dZ2R-y2v$V9BTDrPlor`wq(cOAxTCN`jcdKoK5WPI8=
zTxaJ%e6Qc%u)N|;u7)Ec_a=Oau;mTtB+{YL2*1>~x&&@jpTVLqa9n}~{98o1Pww_L
zA~t8XvIz>PT6Ur@{|;sU&5-&*M0rTs$r%Ae(5g_vWWV^L(vdWLbeNm@VbwWDY+9o~
zfFxV$%_siQH&QV_4e?Yc;XyiQ9$*rB`i#j*A_80+5B_<If+pV*Zf4`_(?al0&%S|>
zez_k(%9(`k^72c4+q?UQmJm`S98Uwhl|MPDeElFjhh%WTKh!ayKfiLi-ypC*$ocwm
z{&+ATj^O2+UN_8swidWpmf=1*@fd(l-Xt^cPrvGNrr-ON;~NvYhcz`Bsb%+>KzQ)%
zzC=z$*Ha<0MWN?cHr<}&iY{R*iiuI6m)E8ZcJz}q4d`ISkN2&@R*0Xnh@MGWaVGL&
zP5mV>pnZFyYDmw{<&tE`-z&Ci7ta_zVy_w&{pGt2HNpi4D<`w$B;9Q1c?RgxDz}_e
z%j;7NeUu%fcDI;{3@(JH_mGR#D@)%O4^9OY3YSJZ(^ZBdejZL|_Mr7`fUWc|YzsL<
zZyrc#RnX#659W6Vn%XBL8Y^E5sj*0#<z5%#sYb<-tbO^nKZ-7ovKhJ`KaO}M<R#Ai
z!(=suXDpE5Re&NKCPjz~mlf!!sxN<jcWcv4jKbgc{UoQ!$0p6Qks4F-E-=o`Iv?Eo
zWw?6-YCdCwyFsqB-nzD<>MNdOW{g`IQ}>`UZI%=RtUku^9mUIbrZw+YWu`+V@6uXj
z=NfW&8G}t9T4f;y`j(&+=PG=`vh7=ONzNtj^D{lwukqVVecQe?qJBI>{$_~s#|sN=
zzD!PdyfsI7&3Jw8uOPU}jz2(~8V>yV$}+b~dQ+_BVb?1iR_&&LL;#48<F7@0Z@h~*
zMsZYC=4P#sWPqIlV>(%_ZBiAHTPQh}A+L?CPr+iwntkgL3)NCX^3J)tlctJb@Ujj=
z*1j+|0ED@@Ge#;(wEQS1LX;Q27NFitpanhf+7x5y7MLrtf<~|HnfVUzY&M~rx6T-T
zh4fC)J^8|%<A}iy>-j)ENQ?!aGx@#N8iDuDzkJ^ny1GVKNLn>Lj$9Cg!k0XrECUyv
zTQ!|(8x0P$m;+UBMIn%Is)MejK%aa!Ykqs@DZ=BJ=`(g<^GP34Ha9Qadf{;}!e^GJ
zDCbjk4}3gw`|zdTGS(YK{>88TAUOab3z`Ipviw5X%p0Vc?S03x3<db8fTK>Z69P1@
zSToG_B=ytjy%RZ%@J=4^{k9b!q6F%uTI)WtVXXUxFAdqOwK<J1@vmgctk4^SZdG^~
z4ES<oK%rr^QpQkGFIxCGK0NWH)F3)j8mMfaPuty?n4UK+pA6Y>O{%%D!+v6baWkq>
z2v}&NHp9*l&vN+OfLf&SU{yU>Qi{ZK@hXkl4k)dOrq)$H<e|<Ux=!-?-ibCYEs<^m
z!+nf-QPbib5v{wK@@jSLE!uPtZOW`gSx5z7-P=~WhIyZ|i`_Z0Y&~}s*=JWVVdB9)
zwy04#{C%LOlK*z;x~kL$yU3Opy^Cy7A*^ieE>D%_#UP2_p0xqRr_6`(HQYUi@}4gd
zp8uLQA;99LKfRfG*tA61dCu1z4uI<51!NzygP}(W6K`z?^sbWO6GK+la5?cGJPYNo
z76QLz59`4|65+KIPetIJQ$L_yE9oz1b_{@{$r&SwHsBLIO@~!kx2_7u<r$FKsy{Qq
zju8O&?>v5=vgu@&e8H1{Y_Ehqn1$t}THI=R5e4QEEt2Rru-)8|z@w%j573Z;rNHD?
z`od`AcxhgL&Y%#*_5yX@i%&3{&4?5U8AGnJgWA{eC~?Z@d`n2h%U*)*Mx9jpcyvDr
z4RSNr<a4>@e%Z($yE*cE{;=h*6k{aCHdok5VtV<qy|I0gUgKhMcMY}oU5*-NEG_XU
z^bdFP-+!HvmHYmg*|TH8U}~C8!;P=!-TO1&hmQ>)*ROBISs4_FF<`qF@B%oFg=4<;
zJQIIAY5LKL*HUxb%e%MB&NpN@G_*>3-*YQ7M29u~ybl$OMQjdgI@v_Lj5OXuenTfY
zU&FaHPIJAS;TnaQ`WqC~3MD=$X%^WtJ@2kieD4icPN}*XdQX_|y9#E<Bg0B>`}-Jc
zI*iA=`plRG?pidmSs8jM=aF&jOJ}y-8j{$U?}n?w`K7w2cuu)^M2g*Gd)u+7B=yVE
zxe6<Xl=ODZ#8qtb7pEiA6ucbnKI0=!FEW5MaD<A?x7j5cOriREx}d2y<eZ_`xW9_6
zv_077-+T^)n{bY-tB&WFB)B`n4#zwm>6qhPlEY+c|5vBS%K%zmFz4MixCZZ!u&j7Z
zZ8`Ue%4HxT&GIL)_DAHyVx^6Gu|w}lOEctu_bZ$xco)F>>d=g2Z%5;r-EZaIj(>=2
z8%|sUGZLy>&$$-}ZY}d*#)7dme}k%RLxY+-@IS-n_*Usqt`)Tkc@Pdx3b{>YztzDA
ztd4_4kZu0Noq+M91|eDDLRf2J*=d~M0z<{;V3W&^W+PwGLC%aT{D~_;$QCQiQK^u`
zdX35RloKhg?8t8#FWl&4sjI_C*Y{7lUxQ%b=%{e<ZCWNEybSp<iU?dC0G$d4#Qr*g
z{GE{ahcEW8Llebf8;b=pj*gD@TVt{GaP_4ouY7SZikdIyUIXw@EbyX`1sWek$b3e?
z=c#2-Z=Nw&pt~KodnSj)AjBXx!~lE$6zBfokj0r^AxNtmX_!<@^h<t}vGFj&aE)WA
zPCC+=8&~P|616ep2=F1u-J5k;@`|KQaC-d+B6D8BBuQxczLUg^nV=(<O@J|<eIfmK
z%g4w1AhCj4c1qs{6#(D~rOAUnM|j+uq)*G%b(Gh2ob0~@QeGW8*dzL-hav^oUWDy8
z`5&Wn2jH$9`OnK{ThZrR^X{pc89K^t%wn3K7+2mAyn(2Q?_n2G;$jyA>gc4}gHlGZ
zee`Y)t0YhG!Qg#R8E;Nx3;N7rd;-O=3d2iQns|;iVzA>mcrhSW)V1LYnqKcGB)noL
zuz#M$H0FAzz`V(gm=(%EShxb7#ng`-OY2b!(v#J5p3|o}uGU2fq!@20pAx{<P;ufJ
zJ^q-l{@>it-}n8${GWg88X(67GT*7?R7?t%C2u^kJn!MBVw@QYjN=1}H_F1HJ@EiF
zyCvKnHf>lot+Veaah_*p?UXsuS(9lleazs6P(9lugAYCIqve(CQlcN1d6Rr?#C-em
zV=>(A#@FF|c5I+U-NXX|U=mvuv8JVH9&L5M;JA8Oy2eL-l)mzOnE2)C-`ywvI+RX?
zlfV^8K8R@~`w>}w-pg_G@r%dud(fM<t{tdMqBqTPGsbQoJLrk|-dhtbUk~+~LztDy
z1B)nZyZ@*k#=~)<jQ=Mc7iT<HipYd4+(6c$1D)w`5pTvXo|K>UL}!qs_K`Sp#elA<
zO+J}j+}#&+p}Xl9_XTvd^+z)_Q|gAjpkUmjrGRlJ9du1`A??2B0&;?%=%;1;b`d1_
zO>HjHf&Mvc=qQD_2=@k$47eJGJH5d2=jexeU~FXlE9LH=iO)LL=Hl&6ptADR7sSKh
zE$GbB$i&|(+4^bdqOcpsa4l`czn(b%Ka2Pqpaom00g`-36)($qH?KD=m>NyWH_iS=
z1Hr!#(#xj<68%Ms)jFPnMMyoOQ9hh>lJK>A@Tbl8^WDrTbkrY-Bt)n_R;`h3L11|E
z)_!IQA>mz1JQH@``wCtY<@>`TxzH2~9-B91?AGFD(8^z0$jy5|;q>~*$s+J!HQWr$
z{=k;8@e48_0ym0;&wmTsd4w6r1ub|k#CPUC2Q<0rTI3lkYr>>)W7m`XA=p5#De8q2
z6<<^;Hkt$feC?%wy!Jc7`6F*@-iOAFU+m(rJm&wy-T!}M6@^gt<OWSJE)8eW1G2wf
zesX|r;lRIT%7580|05d$THqan+)?mI;&zjao5=?X)apWi9u_GcC8X_}v=<J84AgT-
zt>YMlGaOLaBvS)x_e$Hs7C%m{F?O3Zhpc|Aly3CsPC?eUwWMVTrf%7W90AlR8#tBI
zQTG?J^(K>wo#BvmyUqoJNlE8Kw8lvA_ynP7MuswztdOyhDV#%G(h*#YjyF>nhDIwV
zekf%masza7h1NR_P;Wjw4D1GhA!dkL?zuYdeWHjg2->0=O!qq|E3knbD^zGVW+{Rk
zo*Fv&3Up8&1|5`h{*XM~g(B{S9zMqX9=9c?@WOw*R&itUu40Ut>Pw9u`Zu`#?*_{M
z&zfBC^`Ou~mziyT81sSpGY<5zk<g&u@$r#1F)){}%l-D>1|9?L_Z+26j_equqkQ>=
z2oS*Tn||?>0-G;pWNE&q4ioGLj7HgUh<o#uW5|yGb)cVY8zfo2Be!$q*ue;u0vaCt
z<=^5dr5g&%L#g2(knet3^CDgIeddRIEle@N_<t}V%4{Cv#qUwU%HCQjf0S}Q0De@J
MG;ihHd>HWm0BL}g_W%F@

literal 0
HcmV?d00001

diff --git a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
index 56e76f1f599..7f135ee9041 100644
--- a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
@@ -22,31 +22,33 @@ To perform a backup, a custom resource of type Backup must be created.
 
 1. In the **Cluster Explorer,** go to the dropdown menu in the upper left corner and click **Rancher Backups.**
 1. Click **Backup.**
-1. Create the Backup with the form, or with YAML. For this example, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3:
+1. Create the Backup with the form, or with YAML editor.
+1. For configuring the Backup details using the form, click **Create** and refer to the [configuration reference](../configuration/backup-config) and to the [examples.](../examples/#backup)
+1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Backup YAML. This example Backup custom resource would create encrypted recurring backups in S3:
 
     ```yaml
     apiVersion: resources.cattle.io/v1
     kind: Backup
     metadata:
-      name: test-s3-recurring-backup
+      name: s3-recurring-backup
     spec:
       storageLocation:
         s3:
           credentialSecretName: s3-creds
           credentialSecretNamespace: default
-          bucketName: rajashree-backup-test
-          folder: ecm1
+          bucketName: rancher-backups
+          folder: rancher
           region: us-west-2
           endpoint: s3.us-west-2.amazonaws.com
       resourceSetName: rancher-resource-set
-      encryptionConfigSecretName: test-encryptionconfig
-      schedule: "@every 2m"
-      retentionCount: 3
+      encryptionConfigSecretName: encryptionconfig
+      schedule: "@every 1h"
+      retentionCount: 10
       ```
 
-    For help configuring the Backup, refer to the [configuration reference](../configuration/backup-config) and to the [examples.](../examples/#backup)
+    > **Note:** When creating the Backup resource using YAML editor, the `resourceSetName` must be set to `rancher-resource-set`
 
-    Recurring backups are scheduled by editing the `Schedule` and `RetentionCount` fields. For more information, refer to the [Backup configuration reference.](../configuration/backup-config/#schedule)
+    For help configuring the Backup, refer to the [configuration reference](../configuration/backup-config) and to the [examples.](../examples/#backup)    
 
     > **Important:** The `rancher-backup` operator doesn't save the EncryptionConfiguration file. The contents of the EncryptionConfiguration file must be saved when an encrypted backup is created, and the same file must be used when restoring from this backup.
 1. Click **Create.**
@@ -58,6 +60,7 @@ To perform a backup, a custom resource of type Backup must be created.
 
 Rancher Backup & Restore is a cluster-admin only feature and available only for the local cluster.
 Which means only the rancher admins, and local cluster’s cluster-owner can:
+
 * Install the Chart
 * See the navigation links for Backup and Restore CRDs (there is no overview page for this feature, after the chart is installed there’s a separate navigation link for its CRDs)
 * Perform a backup or restore by creating a Backup CR and Restore CR respectively, list backups/restores performed so far
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
index 682b741cf27..796d69ab114 100644
--- a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
@@ -4,56 +4,94 @@ shortTitle: Backup
 weight: 1
 ---
 
-The Backup custom resource accepts the following fields:
+The Backup Create page lets you configure a schedule, encryption and storage location for your backups.
 
-- [EncryptionConfigName](#encryptionconfigname)
-- [StorageLocation](#storagelocation)
+{{< img "/img/rancher/backup_restore/backup/backup.png" "">}}
+
+- [Schedule](#schedule)
+- [Encryption](#encryptionconfigname)
+- [Storage Location](#storagelocation)
   - [S3](#s3)
-  - [Example S3 Compatible Storage Configuration](#example-s3-compatible-storage-configuration)
+  - [Example S3 Storage Configuration](#example-s3-storage-configuration)
+  - [Example MinIO Configuration](#example-minio-configuration)
   - [Example credentialSecret](#example-credentialsecret)
   - [IAM Permissions for EC2 Nodes to Access S3](#iam-permissions-for-ec2-nodes-to-access-s3)
-- [Schedule](#schedule)
 - [RetentionCount](#retentioncount)
 - [Examples](#examples)
 
-# EncryptionConfigName
 
-This field is optional.
+# Schedule
+
+Select the first option to perform a one-time backup, or select the second option to schedule recurring backups. Selecting **Recurring Backups** lets you configure following two fields:
+
+1. **Schedule**: This field accepts
+  - Standard [cron expressions](https://en.wikipedia.org/wiki/Cron), such as `"0 * * * *"`
+  - Descriptors, such as `"@midnight"` or `"@every 1h30m"`
+
+1. **Retention Count**: This value specifies how many backup files must be retained. If files exceed the given retentionCount,  the oldest files will be deleted. The default value is 10.
+
+{{< img "/img/rancher/backup_restore/backup/schedule.png" "">}}
+
+| YAML Directive Name | Description |
+| ---------------- | ---------------- |
+| `schedule` |  Provide the cron string for scheduling recurring backups.  |
+| `retentionCount` |  Provide the number of backup files to be retained.  |
+
+# Encryption
 
 The rancher-backup gathers resources by making calls to the kube-apiserver. Objects returned by apiserver are decrypted, so even if [encryption At rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) is enabled, even the encrypted objects gathered by the backup will be in plaintext.
 
 To avoid storing them in plaintext, you can use the same encryptionConfig file that was used for at-rest encryption, to encrypt certain resources in your backup.
 
 > **Important:** You must save the encryptionConfig file, because it won’t be saved by the rancher-backup operator.
-
 The same encryptionFile needs to be used when performing a restore.
 
-The operator consumes this encryptionConfig as a secret, and the secret must be in the operator’s namespace. Rancher installs the `rancher-backup` operator in the `cattle-resources-system` namespace, so create this encryptionConfig secret in that namespace.
+The operator consumes this encryptionConfig as a Kubernetes Secret, and the Secret must be in the operator’s namespace. Rancher installs the `rancher-backup` operator in the `cattle-resources-system` namespace, so create this encryptionConfig secret in that namespace.
 
 For the `EncryptionConfiguration`, you can use the [sample file provided in the Kubernetes documentation.](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#understanding-the-encryption-at-rest-configuration)
 
-To create the secret, the encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret.
+To create the Secret, the encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret.
 
 Save the `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command:
 
 ```
-kubectl create secret generic test-encryptionconfig \
+kubectl create secret generic encryptionconfig \
   --from-file=./encryption-provider-config.yaml \
   -n cattle-resources-system
 ```
 
 This will ensure that the secret contains a key named `encryption-provider-config.yaml`, and the operator will use this key to get the encryption configuration.
 
-In the example command above, the name `test-encryptionconfig` can be changed to anything.
+The `Encryption Config Secret` dropdown will filter out and list only those Secrets that have this exact key
 
-# StorageLocation
+{{< img "/img/rancher/backup_restore/backup/encryption.png" "">}}
 
-[Optional]. It can be set if you want to provide a specific S3 bucket details for the current backup CR. To set that, you must set the `StorageLocation.s3` field.
+In the example command above, the name `encryptionconfig` can be changed to anything.
+
+
+| YAML Directive Name | Description |
+| ---------------- | ---------------- |
+| `encryptionConfigSecretName` |  Provide the name of the Secret from `cattle-resources-system` namespace, that contains the encryption config file.  |
+
+# Storage Location
+
+{{< img "/img/rancher/backup_restore/backup/storageLocation.png" "">}}
+
+Selecting the first option stores this backup in the storage location configured while installing the rancher-backup chart. The second option lets you configure a different S3 compatible storage provider for storing the backup.
 
 ### S3
 
 The S3 storage location contains the following configuration fields:
 
+1. **Credential Secret** (optional): If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3)
+1. **Bucket Name**: The name of the S3 bucket where backup files will be stored.
+1. **Region** (optional): The AWS [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/) where the S3 bucket is located. This field isn't needed for configuring MinIO.
+1. **Folder** (optional): The name of the folder in the S3 bucket where backup files will be stored.
+1. **Endpoint**: The [endpoint](https://docs.aws.amazon.com/general/latest/gr/s3.html)  that is used to access S3 in the region of your bucket.
+1. **Endpoint CA** (optional): This should be the Base64 encoded CA cert. For an example, refer to the [example S3 compatible configuration.](#example-s3-compatible-storage-configuration)
+1. **Skip TLS Verifications** (optional): Set to true if you are not using TLS.
+
+
 | YAML Directive Name | Description | Required |
 | ---------------- | ---------------- | ------------ |
 | `credentialSecretName` |  If you need to use the AWS Access keys Secret keys to access s3 bucket, create a secret with your credentials with keys and the directives `accessKey` and `secretKey`. It can be in any namespace as long as you provide that namespace in `credentialSecretNamespace`. An example secret is [here.](#example-credentialsecret) This directive is unnecessary if the nodes running your operator are in EC2 and set up with IAM permissions that allow them to access S3, as described in [this section.](#iam-permissions-for-ec2-nodes-to-access-s3)  |  |
@@ -65,7 +103,19 @@ The S3 storage location contains the following configuration fields:
 | `endpointCA` | This should be the Base64 encoded CA cert. For an example, refer to the [example S3 compatible configuration.](#example-s3-compatible-storage-configuration) |  |
 | `insecureTLSSkipVerify` | Set to true if you are not using TLS. | |
 
-### Example S3 Compatible Storage Configuration
+### Example S3 Storage Configuration
+
+```yaml
+s3:
+  credentialSecretName: s3-creds
+  credentialSecretNamespace: default
+  bucketName: rajashree-backup-test
+  folder: ecm1
+  region: us-west-2
+  endpoint: s3.us-west-2.amazonaws.com
+```
+
+### Example MinIO Configuration
 
 ```yaml
 s3:
@@ -107,7 +157,7 @@ To allow a node to access S3, follow the instructions in the [AWS documentation]
         "s3:ListBucket"
       ],
      "Resource": [
-        "arn:aws:s3:::backup-test"
+        "arn:aws:s3:::rancher-backups"
       ]
     },
     {
@@ -119,7 +169,7 @@ To allow a node to access S3, follow the instructions in the [AWS documentation]
         "s3:PutObjectAcl"
       ],
       "Resource": [
-         "arn:aws:s3:::backup-test/*"
+         "arn:aws:s3:::rancher-backups/*"
       ]
     }
   ]
@@ -128,21 +178,6 @@ To allow a node to access S3, follow the instructions in the [AWS documentation]
 
 After the role is created, and you have attached the corresponding instance profile to your EC2 instance(s), the `credentialSecretName` directive can be left empty in the Backup custom resource. 
 
-# Schedule
-
-This field is optional.
-
-Recurring backups can be enabled by setting this field. It accepts:
-
-- Standard [cron expressions](https://en.wikipedia.org/wiki/Cron)
-- Descriptors, such as "@midnight" or "@every 1h30m"
-
-# RetentionCount
-
-This field is optional and applicable only for recurring backups. The default is 10.
-
-This value specifies how many backup files for a particular app must be retained. If files exceed the given retentionCount,  the oldest files will be deleted.
-
 # Examples
 
 For example Backup custom resources, refer to [this page.](../../examples/#backup)
\ No newline at end of file

From a423a989d32d68973d27a2f521db72f01e4ecb5e Mon Sep 17 00:00:00 2001
From: rajashree <rajashree.28m@gmail.com>
Date: Sat, 3 Oct 2020 16:00:28 -0700
Subject: [PATCH 234/265] Update restore docs, remove migration steps from
 regular restore

---
 .../configuration/restore-config/_index.md    | 72 ++++++++++++------
 .../en/backups/restoring-rancher/_index.md    | 74 ++++++++-----------
 2 files changed, 79 insertions(+), 67 deletions(-)

diff --git a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
index fe0054e693e..ba007bc362c 100644
--- a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
@@ -6,36 +6,60 @@ weight: 2
 
 The Restore custom resource accepts the following fields:
 
-- [BackupFilename](#backupfilename)
-- [EncryptionConfigName](#encryptionconfigname)
+- [Backup Source](#backup-source)
+	- [Getting the Backup Filename from S3](#getting-the-backup-filename-from-s3)
+- [Encryption](#encryption)
 - [StorageLocation](#storagelocation)
+- [Prune during restore](#prune-during-restore)
 
-### BackupFilename
+
+### Backup Source
+Provide details of the backup file and its storage location, which the operator will then use to perform the restore. Select from the following options to provide these details
+
+* **An existing backup config**: Selecting this option will populate the **Target Backup** dropdown with the Backups available in this cluster. Select the Backup from the dropdown, and that will fill out the **Backup Filename** field for you, and will also pass the backup source information from the selected Backup to the operator.
+
+If the Backup custom resource does not exist in the cluster, you need to get the exact filename and provide the backup source details with either of the following options:
+
+* **The default storage target**: Select this option if you are restoring from a backup file that exists in the default storage location configured at the operator-level. The operator-level configuration is the storage location that was configured when the `rancher-backup` operator was installed or upgraded. Provide the exact filename in the **Backup Filename** field. 
+* **An S3-compatible object store**: Select this option if no default storage location is configured at the operator-level, OR if the backup file exists in a different S3 bucket than the one configured as the default storage location. Provide the exact filename in the **Backup Filename** field. Refer [this section](#getting-the-backup-filename-from-s3) for exact steps on getting the backup filename from s3. Fill in all the details for the S3 compatible object store. Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../configuration/backup-config/#storagelocation)
+
+### Encryption
+
+If the backup was created with encryption enabled, its file will have `.enc` suffix. Choosing such a Backup, or providing a backup filename with `.enc` suffix will display another dropdown named **Encryption Config Secret**.
+
+The Secret selected from this dropdown must have the same contents as the one used for the Backup custom resource while performing the backup. If the encryption configuration doesn't match, the restore will fail
+
+The `Encryption Config Secret` dropdown will filter out and list only those Secrets that have this exact key
+
+| YAML Directive Name | Description |
+| ---------------- | ---------------- |
+| `encryptionConfigSecretName` |  Provide the name of the Secret from `cattle-resources-system` namespace, that contains the encryption config file.  |
+
+> **Important**
+This field should only be set if the backup was created with encryption enabled. Providing the incorrect encryption config will cause the restore to fail.
+
+### Prune during restore
+
+* **Prune**:  In order to fully restore Rancher from a backup, and to go back to the exact state it was at when the backup was performed, we need to delete any additional resources that were created by Rancher after the backup was taken. The operator does so if the **Prune** flag is enabled. Prune is enabled by default and it is recommended to keep it enabled.
+* **Delete Timeout**: This is the amount of time the operator will wait while deleting a resource before editing the resource to remove finalizers and attempt deletion again.
+
+| YAML Directive Name | Description |
+| ---------------- | ---------------- |
+| `prune` |  Delete the resources managed by Rancher that are not present in the backup (Recommended).  |
+| `deleteTimeoutSeconds` |  Amount of time the operator will wait while deleting a resource before editing the resource to remove finalizers and attempt deletion again.  |
+
+### Getting the Backup Filename from S3
 
 This is the name of the backup file that the `rancher-backup` operator will use to perform the restore.
 
-This field is required.
-
 To obtain this file name from S3, go to your S3 bucket (and folder if it was specified while performing backup).
 
-Copy the filename and store it in your Restore custom resource. So for instance,
+Copy the filename and store it in your Restore custom resource. So assuming the name of your backup file is `backupfile`,
 
-- If your bucket name is `s3bucket` and no folder was specified, the `backupFilename` to use will be the `Key` value from S3.
-- If your bucket name is `s3bucket` and the base folder is`s3folder`, the `Key` will be `s3Folder/backupfile`, so the `backupFilename` to use is only `backupfile` . 
-- If there is a subfolder inside `s3Folder` called `s3sub`, and that has your backup file named `backupfileSub`, then the `backupFilename` to use is `s3sub/backupfileSub`.
+- If your bucket name is `s3bucket` and no folder was specified, then the `backupFilename` to use will be `backupfile`.
+- If your bucket name is `s3bucket` and the base folder is`s3folder`, the `backupFilename` to use is only `backupfile` .
+- If there is a subfolder inside `s3Folder` called `s3sub`, and that has your backup file, then the `backupFilename` to use is `s3sub/backupfile`.
 
-### EncryptionConfigName
-
-This is encryption configuration secret. It must be the same secret as the one used for the Backup custom resource while performing the backup. If the encryption configuration doesn't match, the restore will fail.
-
-This field is optional.
-
-### StorageLocation
-
-This field is optional.
-
-Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../configuration/backup-config/#storagelocation)
-
-If the StorageLocation is specified, the operator will retrieve the backup location from that particular S3 bucket. If not specified, operator will try to find this file in the operator-level S3 store, and in the operator-level PVC store.
-
-The operator-level configuration is the storage location that was configured when the `rancher-backup` operator was installed or upgraded.
\ No newline at end of file
+| YAML Directive Name | Description |
+| ---------------- | ---------------- |
+| `backupFilename` |  This is the name of the backup file that the `rancher-backup` operator will use to perform the restore.  |
diff --git a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
index 13ba992265f..05a83055676 100644
--- a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
@@ -3,56 +3,44 @@ title: Restoring Rancher
 weight: 2
 ---
 
-A restore is performed by creating a Restore custom resource.
+A restore is performed by creating a Restore custom resource. 
+
+> **Important**
+* Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.](../migrating-rancher)  
+* While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore.
 
 ### 1. Create the Restore Custom Resource
 
 1. In the **Cluster Explorer,** go to the dropdown menu in the upper left corner and click **Rancher Backups.**
 1. Click **Restore.**
-1. Create the Restore with the form, or with YAML. For this example, we can use **Create > Create from YAML.**
+1. Create the Restore with the form, or with YAML.  For creating the Restore resource using form, refer to the [configuration reference](../configuration/restore-config) and to the [examples.](../examples/#restore)
+1. For using the YAML editor, we can click **Create > Create from YAML.** Enter the Restore YAML.
 
-Create a Restore custom resource such as the following. 
+    ```yaml
+    apiVersion: resources.cattle.io/v1
+	kind: Restore
+	metadata:
+	  name: restore-migration
+	spec:
+	  backupFilename: backup-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07-27-09Z.tar.gz
+	  encryptionConfigSecretName: encryptionconfig
+	  storageLocation:
+	    s3:
+	      credentialSecretName: s3-creds
+	      credentialSecretNamespace: default
+	      bucketName: rancher-backups
+	      folder: rancher
+	      region: us-west-2
+	      endpoint: s3.us-west-2.amazonaws.com
+      ```
 
-The `prune` directive needs to be set to false so that the secret associated with the operator's service account will not get deleted.
+      For help configuring the Restore, refer to the [configuration reference](../configuration/restore-config) and to the [examples.](../examples/#restore)
 
-Replace the `backupFilename` and `storageLocation` with your own information.
+1. Click **Create.**
+
+**Result:** The rancher-operator scales down the rancher deployment during restore. Once the restore completes, the operator scales back up the rancher deployment. So rancher will be unavailable for the duration of restore. To check how the restore is progressing, you can check the logs of the operator. Follow these steps to get the logs:
 
 ```yaml
-apiVersion: resources.cattle.io/v1
-kind: Restore
-metadata:
-  name: restore-migration
-spec:
-  backupFilename: b-eks-2-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07#27#09Z.tar.gz
-  prune: false
-  storageLocation:
-    s3:
-      credentialSecretName: s3-creds
-      credentialSecretNamespace: default
-      bucketName: backup-test
-      folder: ecm1
-      region: us-west-2
-      endpoint: s3.us-west-2.amazonaws.com
-```
-
-**Result:** Helm 3 stores the chart release as a Kubernetes [Secret.](https://kubernetes.io/docs/concepts/configuration/secret/) When the restore is performed, the Rancher chart release in the backup is created in the cluster where the restore is performed. Now Rancher does not need to be reinstalled. It just needs to be upgraded.
-
-### 2. Install cert-manager
-
-Follow the steps to [install cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/install-rancher-on-k8s/install/#5-install-cert-manager) in the documentation about installing cert-manager on Kubernetes.
-
-### 3. Upgrade the Rancher Release
-
-If Rancher was scaled down when the backup was created, you can set the size of the deployment through the `helm upgrade` command.
-
-```
-helm upgrade rancher rancher-alpha/rancher \
-  --version 2.5.0-alpha1 \
-  --namespace cattle-system \
-  -set hostname=<same hostname as first rancher server> \
-  --set rancherImageTag=master-head
-```
-
-For more information about Rancher image tags, see [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/resources/choosing-version/)
-
-**Result:** Rancher is restored.
\ No newline at end of file
+kubectl get pods -n cattle-resources-system
+kubectl logs <pod name from above command> -n cattle-resources-system -f
+```
\ No newline at end of file

From 5e63742480eeefd82c8cabaf1bc74af01cafecb0 Mon Sep 17 00:00:00 2001
From: rajashree <rajashree.28m@gmail.com>
Date: Sat, 3 Oct 2020 17:07:48 -0700
Subject: [PATCH 235/265] Update migration docs

---
 .../backup_restore/restore/default.png        | Bin 0 -> 192892 bytes
 .../backup_restore/restore/encryption.png     | Bin 0 -> 91823 bytes
 .../backup_restore/restore/existing.png       | Bin 0 -> 253430 bytes
 .../backup_restore/restore/restore.png        | Bin 0 -> 245224 bytes
 .../backup_restore/restore/s3store.png        | Bin 0 -> 287490 bytes
 .../v2.x/en/backups/back-up-rancher/_index.md |   8 ++-
 .../configuration/backup-config/_index.md     |   6 +-
 .../configuration/restore-config/_index.md    |  17 ++++-
 .../v2.x/en/backups/examples/_index.md        |  62 +++++++++---------
 .../en/backups/migrating-rancher/_index.md    |  20 ++++--
 .../en/backups/restoring-rancher/_index.md    |   8 ++-
 11 files changed, 78 insertions(+), 43 deletions(-)
 create mode 100644 assets/img/rancher/backup_restore/restore/default.png
 create mode 100644 assets/img/rancher/backup_restore/restore/encryption.png
 create mode 100644 assets/img/rancher/backup_restore/restore/existing.png
 create mode 100644 assets/img/rancher/backup_restore/restore/restore.png
 create mode 100644 assets/img/rancher/backup_restore/restore/s3store.png

diff --git a/assets/img/rancher/backup_restore/restore/default.png b/assets/img/rancher/backup_restore/restore/default.png
new file mode 100644
index 0000000000000000000000000000000000000000..eabf5015ae35b5da1301d234f66c2e897f71c0fb
GIT binary patch
literal 192892
zcmb@t2UHVpw>}CYqM#rkAW9Pilq#Uo6I6N&Ql&<eDiV4P5K#f?(xpba^d`Loq<87P
z_uffD+Kv9c|M|{Ycm3Br-&&V7kTCPkOy=G1-p{l5eiE#usdR(#4kZZ*$qf}{d2JGs
zYXA}wGRV~{#63^8KNpaYTxYU<@j^@G#S0ECX9p|W_m(6i%E5646uLSpOlbz%S5+SP
zYh`_&zZ_+jHK80w{q#AV@&l2}A43`i_-fqCzW>;y{9-ToL4c3bovCG>iHfhM?p0~}
zF^F=r4kk&EwVub!r$P^WkWGn_VkAFm9ov>obXh;hyiC6@B=9vZI;n$G_R7`oWOsg(
znz2CqB{-fwrITa!CYa8f290YKPxijSRS*y%S0cg9<RrlX5}yp3`#+&>lGFeU1Rh@g
z@SF6^N{6al6wCNV@Y?;WBvAsbhLrC)TA3+#A5^P+q53Fsn?y9OHOhiiE}`9;!Kvak
zOWo}^O0=K{A3gconoLN8D4dwuxK569<O&r7CZ$&DB@AJqi6Sg9t=)GzLQGblQ!_Gt
zagiJ$3_4>Sx_jfO!_6u0>Tz6)j9I(BqaP#2{XFoVN0wnMEh||WPn&gsOl{-!1xDpo
z`ndDP*^eBr#F{UYkjrQ~UT!Omf1r~TbNhRnCQI-v({$$0ujlR`>8zD=+8(ZCDrC%V
zDqE(sUjjg{8XQwSUk-XN8j$|}%aZyF8U`x5Xa<>~Do%6l$8D}(q$!=3xni4;q2$ko
zUOc6<O$n=zY;zFfPIscbt1e#h`hjqte{WP|HdPrco#UR#QfT%el{ROP#38EX9wqhd
zNMTi7=hnqt$}pXa_%AMR<IZ1k1H}b2Us}J1J$s4$da(9fqUDxbGn<u5M+YD3?Lk{W
z*)>Xt1U2Wgn^&(0a0CdFsgq90P0r8!rb673P5(f4pM&bqzfoIkHA>)sw#8cJ!4=r^
zHVX1qKmTJhz=Mw$!mUQ_BWxBu(9l&j$;E4JUNwOIQ0Pk3;TBCY{k}hx8eKLTsK_07
z^HcCrn^s2uBN`!#RI235R|(-lmzvOzq?wt9w5S)BY13{>U8A`+an<y*F~>ETc%_#{
z8jJ%8*ya@S3^}GS#{51ZvW{Km@)p5+b_Oyxk^b0w9x1^)WYAf1E4mMumRXbZb7<hO
zIb`7-dc{+8d|@MVbi{tESe22v6~<#Tx!w8T*}~WtiUnGr(VNh+Pm|2Mm))uDI_{8A
zNk=?+!&H_jDkDSB)@%Liw~doCMDkIDV^>GnKw0O}2~ct40kiTd;qI;DT!tP-`QNvW
zT!SB}X?0P4kQRlvGdi&<mZz|!F77{=Szwsyyqn{*p!jVAv2|=rawrhcQ|KTS!Azo*
zM$+tw)UZCkBUHjb!m_uh%B?`jDg?brLjI#AE}bIm19NGhq$H{M;tlMxtGB7%$X!w<
zk9j>t&OuY2MrrlY>-*(ce}>nBlUJ)g?0vtoOG+U}W^;wN+18QN^@H6ab;{kjMe<Fu
zgJzPC9QQv5KDsH}cDqb&_a<)}*^$EYugdqSRTPG!1mr&}M<sS$%DQeC@Ls;^US(HF
z7wzh0XX-6^$UT~`Y^zU>ueEFO<p<o!h~IoLN_Inz>-S|>&ZL0#%=XRauFQ38MbAAl
z&o-}}Uh=-N_Z<8kce`0vgvaXR)LXV!HyJ-=n<sv|oE#qaX6+S26_edZ!Ug4cz}Xvi
zC(eOp!y4HX_>w2*K>Nwj6iVBN%k0y{iam+}OFAC}<Nkg1%4O+~O#T|m_bh00=v1$+
zeNO${`dP<u&y{|jHdvl#C}fj*!irBMS>jVoY)xWK<mB_+`vA`K80Gu2(X8D;w_YrN
zrBvb0x{)=PwUX7F1sSF&=bQSrD^Jax8>O&{UUfbeIu<#$Jk~k>5K<Qs5R#x8MhUX4
z>v4`_<<sCx(5=(E^5D)b{ty~&|7eXwB}34ZnxsOlnpb9i{=59`JSk1RA5sQxjoW@>
z75Ox}K<y`aRihl+m-A!m!i+TR)8{jq(uZu~AH$696n(7<(^r#LsRv=?tbem^zL$yw
z1erZ6$pz;ibah@<Xi;e;XXzK}7rSfiMH`jWh16wxf0a`5t?~}Ipgp_0jk|L_eCUqI
z9j`lTPuy)&Mm%#=hJTJ;A6m5)8l5fn(mtUjd;3k~<870UOC8i54;8B!U-qho7R43m
z<y0yam==JHb!HT#RiH`k0p~CGgm^lBT9hZ&_O11i_3iY5qynW#rF>GkrJ!y?I}H=8
z={qI86M|!Nxlj#c44ay;ys(l(w%Mn7SznU{eOL-!7pIETxoG72spuKG81aDB>2;eu
z*=X}P$H42r7WYq~S8#!ff#!j4T5kmM-hhUGQ^YGyDcXfaFrVEP3-b*R=&%cmybH9p
zt+@26w(zX*sXjc|U!^8^)FN4>zWYO7oNdOI&xmghvhRTvn^mHfU7u0^MPGP-W}kJ^
zMB+k~R@q_c%~ypL5^s;@hkHb)oTDs1t%>oQ@>l7V>7|aD+9g%O-J0Cu&h+kPga>Iv
z^jjrU8;_2U>AyBMhjvp}x>V3l+gI(dsNCL?)P7w4ZuJH<-}i%Wly54Ij3VbnR;y3Y
zm7s*oKBeq%BgyT)A0-jR5w#K0EC*rZEVAyW*ddKfu=JFaQz~CdvD8S)i_{GXaVdmz
znafhWZr!Y_WsPF3kh8rTZh3v5$7yC~d<C+fw%^o^3k-@^D(uvbtVp{&C^smX)}O}S
zINLzkNbQMRvp+~(Y3#*J-7XNpib!|J9E+SSq28Zt9b2MvFp#soW3i(Zlpb34RQzNE
zeQ*l9^P2uEYpL|2<@dMW?;koYVmL~^8$J_kdFA-Z(bf_A#Y*{2SI1XOdQQ4wx?8%h
zd9k_JFQZ@AmS~swTOCSoOqsX~);knpCJo=taQ>h@qP@$-rZ}yr%9)(;`$yT!g3NtI
zWBJgGyKm&KOIx}1HNGmC#7-`B&~~;*6x>GMhq%u6)rcL1p}LRimlwD%^9X=yVr)_$
zXuQ|ZR!jP-n|un8l<?AXHt6{gYxs~!`%EVwFWffkXV%YDTinWvjuO@d*%r6w-Jf^p
zi+D7XJt5KftXUN$-U5wvb-*`GWsv4V96pi0HE;RUx>W3`<*C!Bnw=V9Pkh6Z2DT;|
z7z4pJ2eh8wXKe^DEU56l?Dx_6S;-^inwKa(X&I>6IVR;>%63Z2?CPwq*J{IQ0~e>p
z%ZMNLAw#jYI#TWK%XCf#O$PXBEI{S6g*B=6qq6U1T2yRqLaIgCKo#~|XhywTzTc7_
zpDjKPx6QC+%AL^!i{fmZY>tG*4w+|}i^Mdn29nXQ^_vUrE25^DD~vb3^&3j$LLrm0
zNnWvDk|%!f0}0p|wwfxM>9OEr6A6!{O!zOqeE#$VWmSm4vDr^ck)~HQHNL?o(KpnZ
z;*V7a6C~r~5`4{iOug|NL%<S(m!si&`S}{8m*3!~!54iK@K$xXRa{5@vR<UVQc*Fu
z)kvpqeQ&zkZZNJs*1=H8kk@pg65#B+a^>U(|5Km&2a}#foTYCTcs^;UJ#Ad*oAId~
zMmQfZwhCGr1MC?fjkSXBjeX-R_0aCi=NWq-_xpPiC!w9fmC|P(@q1Wp!TkOF-~!tM
zx00ec%ThZpRwLe`ohey!kIuA3*>LC{5;D^{Yf#0$o3IbV+g+4Q(8#mc$Zk409^4Ck
zkxVT{oiNUIHnM}cbNPm8cwTs_QU{x@{V_xeo80O!*3Z+=pi~(t1XPr)I-FcQT3*2k
zF2~Q)8}hPMYC;-aMAufws+{ciayd0qWm&y1Rueynbq-#n*aJ4)_Pe|yPi`>H3XOtY
z8$D4T6ALue^_3G~XT<2_($vtXWX{Q?C8C$N_%c}1H_rF$SLLQ%>I8ksLW9VX;)KS0
zzjd{<Lt~w(D|B&Sw*GT{HgfbJZb7^Td=}Ktj;WiiivV2pb38J~wn|6VM4HJ6d17m!
zOZ3w*$GIIKJGi8*-Tt+`El&X63rTep>OUV1e1e}n9llsgM_>tclL^BUIMw5KhiAj$
z-VXT-bq)4=k$VV&(7{|YW|+pC{T;yDN9N=qdSt{u53T~AfR&+#PoFIB%(XPMJQGp+
z6~#{eX!3WTI*FM9nVedHHHBwn=5Ge1a4koObS8^G;WLBB<JuZhtvwpKWfKz4CFX3p
zr&M3^4h5zCcu{1dQ(iR>vpGhlRA@sf9Yj9UeEQ^Yos{DV>7jzCghZ*A<6$qg@;M`k
zAUXsJSO0Pth8TMmC{+jk$i4=Cf8XBkMD6WwVy1A-QQ6RigoKg%&o8Np_WeT=64EqV
z-B+%!G}NWuI@k-DTR6P26!NrpB#tH_k@1uwzO}b>HRtfOe-Cky@|5NLJ3@;1{?Be<
zPL97rT<v5zUukG@yl`-~<ai?VSm+TafRclQL&n*{N=jQ^@n5GC|C8mkadmZ+5*GIG
z@DTD46LN6278a3|loWm>Dl950NE{*P;stRv_Y{P<aQ$<U|8pIAOP9CKwvMj04iJt%
z*EN6R;N~jJ$@%9-|Mm0F=d|>+{r8<9F8_Kg;sXl*IU+0~^ho%>u1!2u=FeU!En82^
z_pjt_?JXfL#Crfl#hyNu`Fq0u>(IY%`QJ`8{P(F6;u8P;%>Q=eUuVh)|9OJ{_C)_o
z*WbOw`2tYN2>;jI11PDm0r!aJV6l}4=@MTr{jm+va@E8?5B_;2z9;n*J(0OZObz8o
zROFxOdXny@Qhn1Mi#sqlu`wcj`6c|O{bf?{*LyLyH9p(Crz4vc=DDL1d+L*Mq?!>d
zvZ~OK`HeZVmNq<Cv0-RYT)yAtaR*dHgiLWnf@_F5^+U$vOLOwE`d@?OhHjji=4uw@
zpA_c%=}u(A)_8LVpm2iOPPMyUiBbLb@AQa>e7>lN2<p6H@w(rZRcAhty>6`M))UOW
zzj>3{->^?ooJYZCe}U^Zgxhe~4y8#$<nDFc@5mZO6R!DK#fEft)lBv;p=}DwoKCcC
ztt&oFxd)Jj=7G|R`O=F0>4zI)LT^mkYQA`mi5*e0LKT&Wkw3UbH{U5w_3rvljYeGp
zh*vgo#46qivr<*BxNx@P+_ds|GsxGiU-*a}OX1f%`246sYa+ndkqXixi27Ai!Vgyp
zW)BEwM{)ZFgRPpF#O5dI2+hDl8f>fQO_O+j_MXbQ9N=D1uOqY2U7C+-C=&L?7vE@5
z<bM9(&$wU96!@1pcqe5wfSXY3P}qmQ-ve8LW}EH8HYvb&_0Py)&FqIk$43-cMu;R#
zH)zK3E+m1b`p5uVDUDa1<=v-8G9zy)ec_r5=9&a~P0={PYe2-^t$WAIPjLz`H|rF|
zzoUXNajZ)DDS7*kt@-1^78_i^#V0dHR<K!j>1Z7FWA*SbNENy7ZwkyKhi2d+smuck
zw%56nwvv;13XHo9&~~%_ySJ@dJ{2F4%+=*2d$C=lvpaP)_)A=-S$rmWNFv>?+1sKi
zSpK?XlK=eOe6s`<n`=15=J=DjzLVcHxGyi(Z)D#MiVg-9R~Q8vINF8}depNrd9YzJ
z#iBKsj5EL!yL7nHk{@9n6;#H{U{r#bvKaKLP+6o6MlQj|w9oH1h3_Jz$rHBA35TSB
zST6Qb<J~Hjy>V11?hRs6ctv#Ond3F~4D<(~p}KFl?=%-gjO6e5v`7bN4su>4a}S-1
z&z!phD+BL}&-)d)HZO-6j;fv#P9N*iG8^aNsyZ2-5Ke|WbA`T|4W2Y@tw;j%<cw%e
zdwU@x-sZr`NWQOC6j%yEH`jjlUUuX$*V!a0{5V5wCA$eCE(7Z^yLceJ3A+FuGiim@
z_q>@^nDt;#cDY_JNL8<aWO5S!bFp0}%-RWL-9^CX%jyf&_%KaJGDvfH7_d298Isk>
zy!i=`FE`Ehh24@Cs0~p=<TW14B37C&fKI>_nuiqrc9#3>L9WI1o0KAqKR+_NI?a6Q
zESr}!9inQ?;A2>FfP8KFyXct1m^#@*+`w2iMCU>11`@@N4<ekI61eu6tQ*KZmV{>a
z>Sx;tM}#-TOT%jpuufFeE$MHZuVPy9rHJ{v6!geoOq*|qY#ggcjLw{-%KPGq+~KM6
z!VPGOY4D0pqSM1?zsY1%o`p4*QtXmKA31aZsi&AxpaT?*6f$C9va*2WJg||LDf~*C
zf~OV>+jppwtN5T2?39-}N&F_o5~<AQ4Yt?TlZFnHiBYW3*7;KLlPevPhu<Y+<dDmo
zkhDnrCWz&+!vhnR(Kg-!lm)Yyz}$5^S2+sa5f<rY>QXW+33W561PR3=3CjmE$N%qt
z<Q_VI-~ReG(U9-=Buiu>OW|n!=xk(_?6<tzGLbmEy5i}}-mTAbf9xzy&q!#2Ee0tp
zI9j=aFiIDiZNAHlPSPvXPnjC*|C!;2d%7w$xhr&VDoRW($4Jx#b^SmWDe_F|nXRNN
zNr>+vJ2Uh{Z@`-9MTWyYbn>}H%|J~j{l*gY?8EyWrNX;Z7*(YOGlEH6lh|Kx9jqZ+
zK<bVnWz#}H=bbveTA{{~Gif_A=k<vWn;X=SGK$@n?k^qehZGyFY%&k**%otA5B(@}
z7hP>#lJMy;Z)X#YfBASD!?G%<gJC!C=U(vNI6#kF`uC`RM*@S#N8SA;ZmF`Vi;Nf9
z#e3D+tlf2F*K}GxUfIbZIrk?%!}^UwQnpxLn$7CtU2!fNoDzXHsQ>Pl)<Y7u)mF0I
z%hKJQnqh^LROcTXzllE@_&~ANO?FWvgX!;jK^TIynV(!)ekAjO0!@q!Et<z=^j!SJ
zk+GSLo_qkqKqfWuPq$frw{&N95be230{mau@!#gw3Ss#%{1L>uocGEi(Pzu@b@5=z
z%-)BZlgR_V4}c^-+m4%M^6aNA08SRJ%4@`M9J0hd$?9%!y<Uv&4Q!JA+<N||*)lsy
z=^mD>{#P-jxq;#%qFsJ9_1*oYh9x6B2!y@%m^2mH9k}`hXAYZ$d%f@shApxO9MbGk
z*7JQfWo{uFvf#`4S{}+`jYIH-AVd}dEhgUHswo|A%tixkW=jdP!IHv$i^$cL-#OPx
zI+sJlS|M&K1!uOs?4Uhl1~9#02{1J`2q@+65DYWEUHu4huPN5bCmpO>0sfNQrm@W9
zL=R})c<v+AT3lN2e3D^>u|qIh3^LTlYkk$cw8FIk<;Fx=8(G06G4KB+kG7<M)!%G0
zfM|_HVWN>@FVU2~*e$)a`<s*O{EO_H$n_gxF^kX4JwFr&42{V!`3@yWSk23^e4;q~
ze#`R%>zknL*FlWTrAoWB(8mt1Q!dj`wvxFDh83^ZZiY6siJSy3w~K(<d3(FwZdt9T
zlSxT1hfI>Xe_&mt_+Pl-zfDI%p&CWD6$08~DKv2r&Y`*9(Cx;Cc`_#QJ<)^V4*(r{
ze<sM{{fV>f2R|%km<Bc=kDG)~eQN=Jkqc1S0Rr1!ctwCbCk`X`(Ln}k2T<3&wBpSm
zKgSuhTLdW4e$7BEV9AvKC(QF;%@@3harPyKL!@`gf4lG!``iglN&Gx=b6VDPhz7S<
zmGA(MY}{ohdZE5MpAgZcL~yL9#>^eN=O{S_12!{7?p2lFB09%w;=*|Zne;A0X%%7^
zF}1ab<Q5QtKH-a68~2Ji5r_C<Xin`c&kNAPI5h&@MDWgEBs$dq{66rlSm-Bg!7kuV
zq$`*Hg4X{SeBM}-R*YJ8Z{oei|J6Tkp1pcb(-L766>P56T}XBDo#s5s{mWy6_f&r;
zX#Iw^DBd5uoPe_2LT6WACA0yLKqrC2!O7zp&S!(p_8zr6nix~^QsD9(r+ynb6CJiq
zhs$EZD6QLo?{?;{PkI%=r)Q3Z7EK$i08{cq5Vk`2g4aEA4yjPjyMLBfvq4<m%pU~Q
zoHT!-)Lkw@@o$6-v1I>Q^d({0gt90b_>_MZkALvt(to^ZZBtqhKgP&Ua<NM*RWnYz
z9=-8NY%Sau-y`*PM!n~T5_5>O@K4Cf?x3i-oUlk|!uLeT5V}b3^ARLF$cv>!{3`LD
zFZp7;k7Pe2Z)#2$UZEm#wdI8DjfAkfx5XtGq!z_|gf7F&_;>Sfx+~0bLgF-Mdvtv$
z`}Q6>?KsT{wuj<WZ_vL;*z{+ce9>|5kb>yg4}h>{ha+Qb6&5>g6h>G^ph~>R;JwFd
z&zd?D%UNiw7sI^BQv50YxFS2vp)r;bAqYfNGOi#{!gxC(Ly`frtwK{C_8vK28TcmN
zoG7~VEItGjpWZ22CrVTIU2P%xt{9%_5sD1|0l3KiANkntdX_F-pPtpiBWiLjlK*&9
zH6kTCdeLyUWqwLu#pqpAPqCv@$!N>MkBNrvo>;Hi;$Hl2T_(+i#fjQ38KxQV1?c2d
zU+=@Q&r6}0ex&8$w&qiFqk73bz2*jZQOyJOoCr@lOwYrhx3VJGYZro!e3_gAYKBv5
zKH_4la5w)Fj!<OPeIjigUVn;vL2$J;`3I~7=Vzj8z`;)3I!7wLW~UA}%Svi+PBVMY
zcMp<^H#hh`;9dhwm+0`H2ojXdk-rYfOsO*YXFvX-=dA`PqmUJ|UAlS!g?fwGwwhok
z`W2pK9rI=SIz~kUBC3bhD9nB=Ijp<|G%!z?w0t<ty~5L>F?U<s>kmfVRfA>opUTl3
z2m^=+ObYG7Ub^##jT4RkzjgrsWhV}uqi)g7R~aOf-~ZE1E|~voA?p7AeZM+KvC`%7
zm8uP?NZgd00{f|x=!YZWqJliBMH=D)(UOw+pyqf@h!}!;+boxzx7ya8W4Qj63NR&!
znZTXMS3-uF4gQ(xWq?y+jk<|YYK@5v>^?DtAQC>@bC;Z3#h~_Fx<U0!um9LdKU^{=
zk7j@ikcDO^FNITYE?U&RrT7C6?Eeu{BVl=9O09MDFy(p&<1IPT|8VoCGvF{hdic0H
zche*xx_hz$M^`Z?Iy1>$boZhr5k`y>wCxN;bZ``1U3y`A?C<xm-_JkUksd-P{wDym
z)!g}q3;ct|=CjXz9`>W2|AlSw;J=9M6F3-vG70=QY^&PO(h&`Og{kFdQO%w^3ubQ7
z-1~9@k<4p4hC|K&B&@U>tOMV#V;%(hewY4-fxQ0zkAXbi<u@d*uj7wu1*fqG?$Sd0
zGUvIXg#4c;mA`_wXiYNMFaDs_SE?#%V%jN!`Y>ni(OxQD(^(^e4yEnr_kk?B=#;=9
z|EvNZwo0d0MEqJL^Z6kISe!sT@iX=Evp>2^=s+AfU}rpEtJRP&EnYHtM9jnDnuEUm
zjaPK!THj4>Deq1_#L(xBQ{QBM{QB$Y^?cePWW#?Je7+CgQr7oz?sc#fo&B@gjTK)x
z>@MJYc8*6EsC%0I5{s2_H)R^{)y^Z}*Yoyy$1VuJTgF7o-Alvnh^R+)<5C*YGCzax
zn{|zQ3F`@I3A}8+>V6fdXNIZgB!uLx8wS1P@T7+$gGmCd?|#?sc-!$vV1IvJ_$Fyb
z?#nj>@a8Hu$bg`(rF==5xuZ#^#H{ov;=z&AEhqSqz=|k9SS-SlrB`A+XX}R#+h0$@
z^&nlAiFN;)d5>jpA=sa6{EsV{r2P1d%L@Trfx&*sTm9t`(iIy>aUibTWZd;P<oDKE
zz}ujnT%e3<2TNX@<7p&~(C&&*tKX^9NAuYN&+{_KnuFyM+MwsSCa3*9*s*ivIBtra
zvGbyguzUuek)364isb>9&+z_}*VgH4%(lXgz}N|!Kdg2L@Bb$YCQqliXx2LkJp5aZ
zh%5z9#%rHNYTFy+?I>bQ$V=I4XprGombi&bA~pl|`fmWtroDw}1Jql=yNLwtda>?S
zR?S(>UW+7wvbJe!&~CNdfF^Ox!%NcbRIB!4w#<2y#4U|w(DWSR(e#i8*r-#*OWhp`
zrS9?Wzncu5#;mEav!v^Io%?T;WZ~zkHT?j{_l7kYy*a|7wrK*Gv+6Z2E}Be&%M?Mn
zU~MB5{&jp$V;HqeU+x{=^)Uz>Z8sogRQC0vU735zKuC5Hj6ULgJvb@pHz48fq&*e+
ziOgih>-0rthYN~&Arlp0`kLvbJE`~*53xI-;`5^qC5O<rLeNzQ&$QVuKlKSZcnRMr
zrP}4}5xOn@2=e2n(~JCN9r5S~-ssVF#Uj+{y9s^(I(Y`n2zJd6V_#k{vbD2M9`Egg
z&Fnx6M|i_x?+&tU&2*>|!?I0ufSYyqAT%TK%tLkO6MQF_U+?q@ogI5@UBx;k&FLb;
zdeuMhT9bX@e-!mkn=TP&9#Sg+;`wP4n5;>bFhHVFv;j3aY)CV4fLu55xdU8wtX<A}
z#+m2yBcBwPRk!kWcYa7{XJMLOt;#a*rk+a;7SG<%E0-Is(&vJ-z+}1#o}SH!JH#@>
zJO`~!b)FpAnu{JioE;2+&`f|V89jRD-Mes1shksSy532E1IF4M^E!1l=ueiMxEtr(
z?p?)#$!loq`0k<wLSEtd8D7S4>NrxgjAwdq3$9MMpTrhdCsuNthXg`=75&iJM-07G
z7r+rh`=VRk7C6tTY}7SJ7G-+OB%XSQNq4`7;crE287=MvA5;p1q5VEfsI%};GYL~8
zs|d7zslc+IgG&%bWZ-qm%Lb<_|AH}OfCLLM(k|{`poro&`|1@+1fupRPOCjPk2gFz
zU?d{K0sJPRkZ@4F8js+yXnZnOk>WD#B<j)g@@OMBQV@Gm+rsPH+MHZGhp<1nlE|El
zT5VLAD2CTw+F;5cu=q~MJ_hHQoxN7vKCSomT1=F-xae+mRSUyYxT~)C0>4r<9i)JT
zBMS}rM&6Au9X13@0)6EdX5cm#MLYo0MEzzjF*SaGU~nO76nT1djouoz_33x6mX9O1
zP;65`T`}{O31LwEcLL>(2Qi_FxO7MhkOKF#H&R-%6OYPLOmr59nomr^3rO%mge92b
zr^E7+3nj2Gq=F=kUFes>|L|nzv&jF>?o|)k;w;*8T>}&JL!8!+D<oOxG!HGBr|^ry
z!}i1~R1E?>xI|o7XPo`3U2X*XWXt(X>0jL-qqD8xK>94H3AAM$LW3Wmzzvu?433(f
zOT!C|Y^Wij*;O!1g*I$>S8j}lSJy<4U))cLhq`;v!K3M-5L-zIvY7tddOCX*QLKyG
zt$jar4X|g-L`-0K0O5nWZ52Dy<@6JsghkNQAys`~a@&oX5~m0v>*7nUX|L(SnJkQ<
z=EhEbH$v+&*)J6IIK}Hrx$)gKDNd3r&TG#iBYKx8P5k*CvvX^I)dV;Rt{8<24zQ!u
z4i6l&r-f=r#TON~oHN6)VmZq(?~F4_);khf8Q{YsRcnyb<N~v(Km^-WmdStlGu>p0
z{gb1#_b_PW`vqUQ>F7>9m9wQW=RQne*VlVbrUv>Pz|iOOGfl?x!&?{A)Z6Tar+RY;
z#B~|xuVHtds^{BXta-3*JSajvmVI^f(3G2>&@0b6bv`fTb&}dxZtYON?>@b{`A91;
z@-}B{kkqxO<ld~)yfX`v4;}X0H^d8znK@b`*@}@Y--w-G-HB?w348lIKOIxMd`pz0
z{XrD@dxvv<%ei`N-H`Lq^5Q+F?vU_Mi{r(`^GhWMQxA8ZR&@=u`85u4<T1;rZ}W_H
zmy$~ECr>^sN;bCK8Ay#*W=oQ)F4hmcu}=z<{Q5Oj+M_#SPug-K?el$V8w_1t>>Xw_
zUMf$zSbtPriZC1ks%!}XdDyh)PSH!jikg|FtMk~Bt9vwai!Sn+A1O!tD2j=yY^@s~
zZ$2|r_}_Cef7QP%EY|BzA4>gC?5g{y+viqSfv6QRIkHV6`U<Q{%)@}=)6;jp#%dO0
zxo9{G5n6#JB}?7S;Svb@ndI^}Ywm`l+dQ-Kca$|?iLhhGJi_6FyaA`iMO>A`v;YV<
zA!OJf*n4)CvqC}hl?ucxGy-^}edP=}aH9dFkB2m3-z9X3;8NwYsBM9s%KEiaJc;Y)
zOo{n>>hoZD1(%!2+_lcG1~I!iFtvgVVrCv!zE$GT#cnpuMMF`NT>I%umEHblbI}tn
zH|J3fUN8PgywmCS<UNqgskmVtvn5$&umks%o{xd_mVI&?*r&GW!SLf&!ZdsF>=Vx)
z0tghUPxx^Iat2vk=nW|luzg1bPk>a6%%_W<WOjNKH=c)HJ-}s%>eQFRj59~mumP@A
zd;K4kz)^NNY<UG!dzCtvYFw^~%hF!C+bV~K?Yk%(ebYSzw&l8HpI6g4YdLlw79Hwv
z6;v(0(X_EzmDp)({0o<CV=5SlUv@`#?15g5wDw+vu2!iDMNti;7TT(!fgrn)J6`x&
zYfChJWDkyi{Bz09jHpVnp=+v%`%t2&_TB?@Z;cid*;{^BIKlW#+wBtt_uxDtS0SFF
zMAkOC?~Xx2Q{BnvHCf1VfJe`-6WO@$&nG-0W_j)KsBZ#wUQGhM!>f`DjS51In?8v$
z-daCpk+HsR&kug!_hNk&wxeJ$7eXoQED*nG#xhqgrn!Bi{=2V}(`9H2{)^pVdIMT+
zHfY6>C8G7{cwK^6a8!UTFt9Fs!3@<cDxqFlW3NJ6%t{k9v2!I~VM;3pERuu>d17XH
z;sqbX_?pi~=c6oIy7BSs)oj(W6JD~_fAB$o0e)-)#z>cMHi@qx$FoMA@w~h?%P~4$
z9scmfh6%N<(B6sOYH_ymR4)OFu4O7v^pTR08_&U6%82Yvkb8GX=hJSDnd6$mgRgvv
zu#N|bB52>doxKDGn!=dma};$Cbj|K;WwpUc|DtE4X_Y~0wNazrxfih)9p?oel6Ay0
zcfPwDIUFb9o4TTnRC^y6pjLgcU-o*uTN_wssxMOq(9ay<Wf2rllkI6VKL#VcXADXb
zrUv)U-Vfs3TRI~XF6e`{{cEQSlHSh=%}h&W)zuj(hO?~KdcH!;PMj>1pobi~ZBIUS
zE1s;P1t+?{k<KBSs%3*KX_V&-7mj}tC>saQM6F;k0xZyY>}*9R=DaHRX;+F$#DV8b
z%-0TRaU4|>`}=xi-y(+JqJ4VD^7!h^eq&mNU}ckKz$nP}%eRZcf!?Z=`yRL>^V-)T
zBcPU@gBYbIpN~FkNAEW}59-l*2CKs=nxaXK*a^^k+gNg)CJyAxzDzv0aYe;Y0_wc2
zOgQ_sXN{Oh8_LbyP0uZUdu8yfR0o#wg68y*RI@$mDvhc?#pFHrSCsBHQKZl|wlXDR
zQ$XeL`y&~-iC>%V(n6ay)mX$FI3ileJhdognyJfLwM$=wUZ3PTe{~z`$`2r4UmqFO
zVh#N^v^6|#pO`-zH9sG^(+{II@JUKa+1BI-tc^5P>1+6S^K%}l@B_lfLO?GE1u@x2
zLvGG5a$}-dD2k)m!Jhd(hstA*t9<L%Jk-Ry2g~(9qKs{Vc9CD#;Id{j2oOCysV)We
zb8&<|3ol{aBMw63UU*=(-IC;1HG3H*!rspa%ecjw9EtEg>lIl)JR7<ADee1nY(k03
zO5>}J*#gInk`9Akb#JyMY7Z@}_pAHP7JMK@n)aLOtrO@82A#-}9m!yU#2xhRTf$Q>
zRJx#Zb@hVlbXE2SDE8$O!!+T2?|Ya@;YgFGLa|@O&=<Ux?Qt>XlRE0q7ZVdJGUsWp
z2;WA1cU2>`n7Vre2?7NhmTFh>6D&2<)_$7LZ;bV*OoYeOhRP=NVC)-Z%H8wS?=Cf(
zEqYNGCfF&$$MP;`Ebbk6ue;SQ-l}vNJW<p8Ip5;4GJbG@yy4v9nX9e)y|FHBvPOMd
z6CtxdS~!ynCe+9{t_68FAV%<vL-U3B?xSh2;cmt7X?M$w-LAox#2O0B<QdKBZ_k&u
zPW~HtyG|rdz(X`iM5~j8CW{XBY4#wj4c#=hKy0-%9Y9}p$c900BOmRX&*}`V0Eop3
zc+DX4r|;s4S^jd&xm#jG(p~U?_R+)0pvf}Bby+OLrmlj#g6EyWz1(*is4?t;_h3RM
zJ;Z8LQYYfhcd^n+wUt0zx#)4}J45d&7116_AUUMW5B)B&dWiW|Ab23wT};tH?acp0
zxo^V!i`-^oc7XbNihE&Ss;CL_zD2us5o%SVBUl39trI5z`6jTEX)#%+k^?M0*=TRb
ziTDwpF6|1b<HD%vsNYT1*+_Fw=}TPJ_3Jr)w{S<*CkZyKWq5{#fEj))GC;6>-Od+X
z{#*U_$>Lpoz=i}fWRoQB%e%zwO}?Nk%M-I&V9s;>!=ywz8-+~Rm_^M46-67mX>_MG
z_1<>9Y=Pzeq>H8DA~w15*Kl?>rJ6tMoQcL`oc{K}DG#7Oh9Z8vr~L-7%XzK9vOoSn
zwW#hx<G8F8I43Y)w-&nLgH%kE(vRsre;-GvUZoHjX*4a0%V{cLDB2BKvRugkb&~^)
z=qE)~a$r{F>MX{*t?%fDkAH=r9v<?T@@jzk=^cE9Iz8BGmFfHSFAF74ylX79G31NM
z^x2Tp@yXD~$<%tSTQKLKy^SY?Vgf{TF8R4_sg)m^XzZ^B{3n&)ulmhJsMwxE%7Hzm
ze3P3o*Wz~?(q<QCZx^E;+y7Fo#lPo$$RWiw1tlQ$OX3CrOob$);C*`ug^p4A6ofH-
zwjZlzY%~{jLUu(*_m6ved@=o&K5|LmNsffZ+r=S|&$6P*9jBG;GkGMu#OypAqU>O}
zh(c8lmF@n;XU+$GBBJYE&(e0J_oN>jG}h|fA(WdkR_5f)Nx%6aK=^f3Cp?BHqsY<_
z6E8?T!{aPKCyJ5|==srrx%SbrgP4E~mZF5-KHDkxQq_FB$1`m+0DA|$F^Jc$S&=eB
z)aVl=*+I+{JF_5Jfehm6=A>{xVU9CFmOajQ48#bQQR$!=V1W+}PM0vi<5BzoZsR#H
zL8Cey-beUg6}l^ZpDR#bWn_W6J1lX<5+yg{kt>7kwW^i&ZIJZ?qK^m?&j1oV-C9lu
z8?!KvUY^=D8d@FH4K@J;+~wo->sG(^sX(399$G_B{C96@aP*oiNKd%D0$0FCPjXK|
zg=3WJ)?V~cDbjth40jKrx~ER5&WKHd#=(Q1!b4fe6K+6unsTUG@Y-$Pb!q1b^xOMU
zKjNc?`3kBd6CBI{8nBx&+k>g$+Q22MCELwAkf;rqV_BHf^q%cP9WPVw=$E#9Lk}52
zH7n5QUF+SE>75k#tD=$P)DuDUHqj7UBcPb>PIms*zySU@?y8~~3O~;{ABQ|yx$Q*P
zvc;i<)ucS7oi&*Y7A;oSMxHYnX|S&x&!%rfi6PKOJKkjZOZ3))?;fi*eLIakfyyI|
zU(Dg^0%2VV9-~&7|Lp)TJ<&b50T-lVN6rs<m5fyzF?P3oQGL^Na^`2|yK;Jh{}_BC
zi;MKThY^wPEFN75cM&mp1LLFq9tq!Z<R&&)shxObA#Fg_0pJ%5e(-G$#h-FBzu3Tv
z3n`omH5+pj<Qz%ExN&HQy@M!bK?r#W4f%D<h1HA6Y;U2|XE#p#9svChj?ioi7~~Np
zI_;_6QTOY2u=kOFyS@!+GYhjQRbnSVa@u2)wH7lkcwG9VGahHRTBgR^b2C>bru%x;
z%J&9TeZtyIQB|4|n}~cG>X(Fu043W&akc%h>I=fT*<u!H`Dt{F<)|D*@%i@GDvgqz
zGJMv3+Kow_)5*=9nJIhYGsCob?%Y8s;&OAUQe<b>LqCv}{eIw;Ik<rTRUnE{C|bYe
z>ATk_;ynLwK1mXPGG|Sdpe^P5zGzkg_igfARlc3~pa{h7`&r<dn~yxqavy=?wm&&(
zc}k<qT{AT%+R0npP_4J`=V;djD2BV0tKZ$zjXq|9cg3Mx^LYSX5uo|+E<3@MNwY5T
zz%50KG)<sKs=B)Vi|yGnpS?&MP{!6v4WBx`THb9qxf(p)Zon-%YL}r2wi3S4Ltaf0
z?Q>^8HeLZ9bEm|wTdih;cl=#;p4P_+nWBr+NTaiEV&R@JdY`+y3g`<gT0LDmjP<Wz
zv~|{dalR3(dL_AXlUdf`Bj6bd?Yrl4UJc-{jIm07y|rdKxcSqQcjl*O)l_lr-dNrx
z1l>12$AM_V*BPtuvQKWdoijY+FD^D(#C2$7S9W<J^$$D!c7>>Nmtv(TFK!Di3N*B_
z_Ym34Lw6%;_jgg`MDa|S0g=rZ9)7ozk*hA=vPui`+f-r^b>N`>!)B;unl;NtoJ(~=
z1&HFA=_gP(et@lFf_TLO!$_EF!XGITFQF@DtpTzdnU7ipEeG2oAsRMlMA9VPKx<U3
zHH)wd4~?FKv;1ia;>1DpApLbEZz}aZXDT&B`FtZZscAn%tg|~H*Cvj$K5~0vJR=wc
zyZX3?PvY!r6A_03b9~g^onI@GTg!VL1xd*D9X=|aC4}~ux4nunN-Ji_gkV=UQ#Qm2
zk|ycBD!X+CG0h#ios*{Z`aX5S8Ot&AP@lc1a#VwqZ-NG4?)XsnY4@D}Q`p`LkrmV9
zE-2uLy-GLHlR><y-pbBAZ|ERvw!z7yk_nyZaoX7NZ%f{uL%hhK^+fj&Vu!8CB*zT>
zneY(c67+M{r72lHb_M$i5nc<^jgFl2X?Y>s^TaxrFTOoRcqT3GBF35`Uv}%3<6SpO
z2~a@(&xo}1lBV2e+lT}BTgcMEM2`W`^)uL`1m-<}MBB?_=<MQc0)E)-In7#%-rK3j
z&&~ytO@Ioict6z!gI3N&oRJ47)jq0L<T<O!#0O_XmFtJ~xHoCKc$R6p)XdH-tB7x(
z`Xp?g`sAHkNdpUDj(+Zb-$DAmrP6VoVw#U&KZ$Kgn)4wpC+Y5cC;WeuOicJO3_f6C
z$pdA2fMIn4JsCXrrGZZn8{J(OzS<txpnvH!>{;kceo+wBVSJG^#JYPp*dPsTjNNa=
zr{<%weD9*mf&1hh9e?UxfAX3&V%=+GN3knh^NnhKzuo#g!k*wabv~f!wYA1tZWFp!
z@iZs?Nl@?G8!MIGUy*BR2;VV&QA`O%gS7nPBP+C5=hoAW-uRk?G(?eM4zRA*qZu`w
z`PjBoQalr+`-EqRQWs=Hp8sxPYCf(HJztcF#N%Ef9b?*4<l}!NY+wcNT3(dT`G3k^
z%>}0j<Vw`Oi4q<}2UlAx4eJ{+OYBo>Jg+;HM{IAsc*75n)ag>t(^iFVHBIH)`^ijN
zX(-lV?=z>#{2FO$&U3b@7pO%#I3pbDktWtbP(N3_hf%e;th_EcENk^2VcfmA7>YW~
zzshsp38UUcX{X=0cTgUd<Hz-W>z+u{3>AK11r0X?gz|w`6wlQu{)>yEUO$eQ^(#HM
zOmSa-nn{mosta-rIGCo#Mcwh~)EIX$_&nf79W1fnVbz9jdzWbJQ7mx6mM}V;C(qzx
zIS@H~-{c|RI+jeZ-0_t8*kxf~<+v+}*V4$I+V2549xQGobl$y{f>Dwc9|0_6kMQpf
zc5j$qtzgqhq7J3}yL{r+qUUrzLB#IlB<MH4=nje~^9#ZIo4!fNwn<Rb+@&X$+57*|
znrw!^UW-p^80>aj{rqQq<iE5g*_-T>-0p@U?zWfP0cC^xQ@O@R57A0yPjX&gdF3d(
zu<~)^Y|&e{o!2EuQy62=J4`G_=$0O9l{eZCqe@D8Zs2FR(bJusJzl)F9YkT1=rP*8
z_aFfht1!R(EXm?bzV({+o@A5#$i<hueR(07Gn?Awx0-S3G8gSGjXzf2@&gRX;Q|{7
z^nqR0(%K6@TZ$cB7*pg}n?NVZxl-7ubEK24Xk@NkW`VQ__47Wlwu9ZIE%%JqPwW{s
z%axrWl<Qj&s)6Q$hUxF>(vmA0S<C&}`9&Q*iNDmOFBXzgDDVk@dtmHJdZQ7$aXIJI
z%rC{{2GGAB<N;M;(wwJ*TBOYoZZy9Cq-!`Me!yAtnW?AMKD)t@t-romU5ByPLq&q+
z$%3#;!iC1#I<Sc|!SAq3=5+ENvY=z4@Gu3gUUQK#+BPdZi7(vQ+gVK-vc}L)3j_=F
zo@M3`lHCe4-H_ZwqS=eD#+tp$^_e=6yBN=#KFzHa6^O*E71j#tW^b?OnkA_5vd0Id
z)$Z|IV_am}F_kaG@H%DQ!-Kw=@CwIL(4^!b$fTP~$UtDD47R&qM<8Z0e&E{+zhrAR
z*4WNJ$evn4IsP_>E<`|xgM(g{Mf4VI7yR}a>cH>a?YPdMrsEXH8^tY^O|6wzVIV!9
za$s};W4FPq_w2dJ#@Q@>y~E%+1AKQo)ljoY`gzk?w}@yKoPKn7%?ps)^S-;$7#mD?
z=QcJjLZ*{fc*zvh6+$uIt<hw-dtuw2p&|+}eWMuZ08`3!gX;J>XdDVXiCXW79POb1
z`GE5;VvrXD{^+7k1E2gcyEYkEIV<LrIqA|Mhv;9Poa8ZGvD#9$7hD*oo7t^%BVL9<
z0+_Qr@)4x@^<w4878fqW8&6igJyhwuS9SWVTihVUt3gxDW`udV>BmXI{rvn%pGIWZ
zN@_%Jj=|~KE(Cp^z{(Cj>dwD)wu{S%_K_EgjuQ;Ecr$EOF$*fVJC`*U4yowiO*ktr
zw9QL-+V|8-5=?j8mC)I3z*hY>bxqxH$T?E|{6Y<IVLUKHGKizoFgn^QlxyeJ;Dr88
zeEQogZ6zjI>OLQHU+OmGBO5JX-j2Pf7xJ6(mB&nbOz+kNP>99^y);_2yP<TZv_3z;
zT@D}gJ3X3yJF!Pflm&Oj&a71P$se>270<}x*7!aU-j<*WhQ1#hUM7kvk1$Oe$n!Q7
z5FbfM7Qczqxb~+h`qAsf!qP`s5#r7j!upN46~h0C;xqJ13+oH`5KuQzF;ODBb{Eo~
z%bZEk>t)>l?ufjdHNGg})#vi=xc?WX>Pn7{OODY<5AccMfEw7LMBm5gpagXvw`L{_
zQ(wf28x+L_F2;IW738f2WZGHuOmbQLa%#0eY4M_YbLMDgT=acH#>`>z$MIi)*B(T=
zzaP)rz#p0|24CrUk&r6Ticv^eC}x1`LSdqlB!=GI4@KX-ZaZo^SK_tnC#-sEm`KS8
z&n3alxDuX7BD));T>SLwLpI?xf5HKGjGOb;Z#3?u3Sjt<%GUI;T0oamBiW8cvA*uH
z26uwG$wdH<(AtVH=I8RrHRAJn<9p)4Hp6-mC&&iD0yy|#_#l9v-=Hvl&2HR6N@zy9
z0JU1dPH^eqWhW{w+EduaU?WVjf;5lS`-*b6Q(s~1@}%vW4z7ug?4oB9D`3uN>=?Zb
z7WWQ(!!9Fh8JFi}_|ktDmi^!Lpx!ZL#D45~wHy7y_=)MdRLRD<lHN*pb)0h>Z8?^z
zQ;CIbsA<ljs}eEKQ@|PFuFW>C^d1Qb0d%PNNa@kT8<eCDklmrZ<Gt0@5_?@M*>T?)
z)tT>&@I;2?U0y>d&a6*ZuCx1O=UQxEE}D)_*&dL5x{OZk51Nm|9Lxx)HB>ZhS&1J#
zG+yK0SncEA#%HL!4%MTozR+95zhr<%kL-l2$vUi0?@J$`>sS94o*Hzn=TNgRfH8uH
z0xkTu74n=B*MJpB^#fev%%1PWc?op0S88mI-ksJ1ohY5X#zs`i*4MfFO3z#Xhfa<2
zq)&SKtbE0Hs8h%7tGLl9cQ5@@yfi^aDD9BhaDVEZ1Mg1qSQTAG*q>*tQ=*5zNpmoc
znMI(Kocs4k!{6-FPN%5*IR6Z*ZA!bD*UdSW)k0KZm293EEKG5niF<DBtFZ!Yqm>6%
z1!NU}T{9utd+NXeS_Bi@Y4I4^8)Rws6MtZR>j+Wc>Wc*>8y1{ytfMcg=0*soh?8vj
zSt_D#h;Ir|im@R-gkqbbacr25rm_Q@b7^D#IpA_y!!SH~;}g_TcmTr>hZ3D_Apr**
zI60!iW(Z@*&%w6mM90W-S#sN)4bsz};*=0K`x`44@jpU9nskF_))N=gjkxwoQ4IS0
zW;c_~8vLTn2+jMb^X*~n%+un8L_(Fgs~_@d79W5$=VovX!C3f-O6v(NvvisGp0K!I
zou+2V-K5F|XQE5(z~u`BOzsqVb33;i(y#tnowcUE&Oqt3k-N*ijpxKYzV<$v$6p}@
zCP(Z5Ueoo-XD-xPN&OxS+CO@E!M*o1J+6*(nuXsyO}Z)1U2KF;aqFaG9%z7(Dnp!Y
z!F#f%fRsNEcaE{i3o#<N8y&P4Ze_lhWHu^ZfNekqH{p>;fv+SEaS%sg(Py|o`LnXV
zfViBug`W{ja3$i(I6b`Ws+6yI0V=lLkBc8LmmdrQms^xd;E>&1MlIX?v|gZ8NbbgG
zi+0|<$oW#B_++~*cyI>%eztoUh(6?Hf)gdN!f@X>x!G#J^Gd4vt4_4Oi*&OC4knaH
z7f1G{bNePbq}%FV1T46qO>ddcY0UE`7I29ut`Auv`%|B*QJSmuXxb>b4LS5GbAXv;
z5qj$he{|%;@*RRE46028uNMWl0NH<ZvfdDw%L>2qQ~^F(CUIL~{=AVFfmyqPP9$jA
zcX4>_9@ASYm#fULq~1t8tLne|Q&rp1yJ}Ts4wVbnmrRPycV0!np)VU@Z-N?7J_Xnu
zTSOscrR>GHm}Y()dL&{fHSs*RB)3Ii+t8%{-Pxm!UI8fiKxBSHR?vW~OG=+)`^!g;
zK7HP!xYQ6(qAlSPGP2I0|E7k|oq}MH;q=Zd&^bw_-ftoSzlGbCLdzmpQ%lU;eRPMz
z@8`l?@;M}xh`^P(zftn&77X#DNBNw^lvqY&Fgmhzu6v#YCAdZ6<#Gm$S)fyr24G&D
zT=lQh=3|@`+ULU;#<h$26u6Dig?obCwq*7$D0D^+q1T2E09XNC^IGj)S>=zMsf1c3
z)>gYTzDHUEFHU29Pe<MQC~C|C>501U5a1$>WJhIfN8@hwVul(v&l-E}&o^1bG*0C~
z5)ShuxkQEi0|mB!2|5(0|HU<LE46$|TOyS@4~tk&+zd`@dw3G49isCGmV^iU4b@zj
ziL@%6D8ES+7}>AVxLf&7N5adtBQMhu->LXH0-3f@^{{wZC$8`IEXX|<VKO*72=&W}
z5yLD<{m>aT^~}(hbWXWfA-msD#X4hwyGT7=-ho<n3vHlK6SHC+T`AqIryma8GWmo8
zV%mRgsHnH+lEYIToORL+L)XwO$(8KSRV?B!GdeB&SmkzT&wY>V*FLh{rj?4EYx#n)
ztWVpXO56PElA>zfDLI01!()BiC|M^i3P(XntlxMb(K6-dk)rnUgVkJ8-Aep`CpH1;
zEQ3T0`7o-W?~|V(31_}9eM*_?Te+La;US2Q;PLX>Ep)3L)w~G$qBhoRPh-l<q|Pe*
zgiNN>xSr;5?~_a*9}+tFGX!LK0R%Aj=^Q;g#-c(%BX_NOzNgLyuA==wq3YOS*7Dc-
z`}nRg@a};Z;TqZ@%hVC<8nPJU6q5bxrthLyN*m4p9hd&=i2r~Shu+b{eVPOJvPC>m
zNoKNiE-v1blD({Rh~FDVZ5q{@C)-zB#tGn;Etr9$<Db;*3H#z}(_jQwflvKU)gjB=
zo^O5uPyo`Mb^^2;eP(C0W+1#D7uWQ3O0`nPm00+0fLH7Tf%(hYJV)IFNTEHfZ~3x6
zPpxgF2fXVe2&BwSimtXE-^GqH7NtFr{f5$YsgW6f1km&1cd<G)ecztzWOUT+MP3Y_
zwIbMLmt-4l@jrUI_z?szv}gM!^<V})a4)+YmW#!v#8@uffj;$+G|h!WITFKG7t#!O
zj4+w`Ptp9>r&u|Q5iXS`GD{|gkf8esf4UT*7Rw|Hil%?kF=Z@%4Eb0Yhx~NXIc6t1
zsjYFPB2+#F_FaV@J`kepbCHror8>2hcCKLeru+34{UwK4Oi9y5@ANpY55{UPePp%2
zD(m5b(4eY3MiyG135PNlA5b&;W_auW<~3q>4IXb-r||vViN48*`~@hb+2tCLzC97k
z$F5pwYNhg%ruf(YkW4XRxu$`?xs8~1JM>8YC|&u9x{N=9s-7X>zrKQWHH`Qbq^Z5?
z?ZxyLta@qSNsmo-+{jLgr14(Om%ZA7ojjZq1H5=51QfM5Kg4;$Hh*uYpZC4wva+F{
zUuto!Cfz&mjDGD>Q&IZ;%pL30`y=z<J$SF)0gDu(HS=xc{sMnE!dO`R=kzCw_^qwU
zOSl-KOmp-6V4^M8ExnC5_szI?<r{sY1C~ML{Px6Z#bBl7o$UrHUB}}&f?R=sQMsPq
zfov<(XA#Z9JD9?rT6l)035)m2MSx0v;8M@9!_x#TvGiZaPA&>xl`@?34hS3Fh^Sl;
znq0u=bY|`M@i*r83TTu&^8qYR!-qDSrD|PIr^@?0s=A`}9J&h2=JCOj;DfJKxs!M=
zV@N?Nr#Sh(Q~z+nDs+P_73X8WAYSQ9oPy;v;qv8?qQNd<#AAR9(3i>0Z{$Tn?`Q!w
z7$kZC&N_qVFh#M?4FN43%5bfC=M}Xk?2plnkmH%hL2s~0INAS)vp0{2y8r)wD@CP9
zD#<dHP`0U&>@%d2h+MX0EnCPk)@(DCP>AfwG9<ewJA<)g-}l{MF!r&VF^lsaUDxmX
zJLmk)_xridf0*}eyqDMOxj*i2F83bK+Vj(QIT}QVSm7~5?Jsa1`Y3M$56OGN*A`GZ
z>8WG&_*bGjABSO?QX4ZZl32&y$~r1z24^=jdIAYvA8cFdARi38a~CJ@LI<5Cjj_Bf
zxCYQz;_8Etj?$;SSK4X`4))&ss=!Sq=b2PJo3nG-A(?Et?&Whff>wv;<zeMcU1Pl=
z5kP<GQ36hWVz|#>iO^Dq853~_ZQVA)cH|A>IXMuCfVH?IpJXHmq;KgugtY2UAs2;O
zF*omY;^i-A7cLGIz0ER65B(9vl^)t>E9GnBmAVQtShvmr0uHGOb&Um3KNe>j8eWg*
z$yT0&!hFh%mo(63PxpU+C4XOyw_SO&wehEuduKe!js=B{#eY)U(Eolu@RGoH`_C(T
zva>N92_jhLb7s%hx>TJWJ6(E&KRevfX@-1}(Ds8_P;b1*#@F!XK;~%V>|WS;)avJG
zrp{ep?i~e^r=qOSLMO6!J7S`n-fJ8qucGtQwr${YU|X-@Q0VY-ncfN?I>D@Q9(R!7
znzGJHbbQCm=goYsmCSu(2FM%Pc9=)sAtyn^01pNn?a`ECs$77+Kqo``R3R`J?@u3$
zfA8_eWRin;e+Uc+8Z>Xvl0Rw$6iV`#m8grZSQyr)`!&x5e!)L{c`P~g?a8|;1_KLI
zVlYjAW$3=52Yk47V@1?*D>GHSd*{7+cbWvsMX8N?vP!=EYy>R!dT*6CkW*|UNBvzP
z&i73xq!z$IT<T%#5*~6$?XwX=F)BSRh2lS~&^s}@qk%vXKndG)Qp>YrI>^Pd?h4y(
zE4<PL9q2Ts`@?Cg=1CM^tV=?UhfShD*VfqPJweh?p?w*lw{+gH?DEruEZT*~V&zXG
zf}Bt&Ej+_gU2p%#$LTS+Js={m|9Mr1nlMt_X)`*#A_X{-wCq+VtX=0LYIA{w>!B->
zwml=M3*U=G@K)A(@tAxbdFMSgw^ZJb38sSUV~tQiNXoGPKg*+@7;`@a$_AJ=103#P
zP#j2c{&pbV<YLTEU=Z?kHOoV=RlLljIb>Vxk#@MTSJ{f)XrZwsZPa-5i!tJ{uy6v0
zrv42dg}u-$px>N`t$Y!uuDEOS@??3L)k}%2W_1aned@>^jF|ZT&&Ep;hU)Uxks|SK
zE;e!dud$?ni7+%_{3<KC;{x2Z)rYpDlh?G2VRR)3?ixc>8cr1kF|LB5M0CXOv3E3B
z*T!z1<OUgPRNP>Wsp9#X*7f+5tiUd*X34?;yIy>|YAd&*2&0t6q|+LCqp{@+AJe>i
z?aoZ$n9uA><Rn5?k9JQWejl?k)0VHu?ta0iBSPC8J)Miux)f7+SuoKnq>trz3AlS}
z6ew=RFFuH#iJ<NQBN30r^*2|Nwl;vG&fq;%UC)v<8N5bWz_A}x5V~AE-4|RuIp$qF
zWA%unxEN|g{2h1r+!_41l{UsJe~BZrndj@NJ6_-L&!)&_RMcl>u}gv`C$wwAT_9hK
zuC99Tpid@gXlz_t(Xcdz)1oIF9OeV2cNq3kkULTV(0Q}MRXO|=GYz*5D!8_M1idzL
z45$v7vI0V65xEQz-Y*utc~Sj&TY^-Tu{-5#B|s>*woxs|fUXv+aC-|J7-hk#!&Ee_
zwai`hwPGqxykG0a)zZq60h|!j2xu4P!y3^W)!;j=XU)7k_4#4cX>)0h3@iJ-EoVY>
z0P>g0syfKlVXt)`ihM_*9v3{_=y!K(Q*fp}U9wrVziu`>w7!Utlw(56YO`HP*ZTD-
zYMpOvq4irH{vv9^!M32y%R45gWbS+PCQMp0eU%x7Ew)Y(aID0`Jn4xv1?Or|yo25~
z$m<<%XI6Jlw=#y=epBP(sX{S)G$)tX54f!!FLGXd9~NGO*~lP9>VPWuTU%*DdQ91_
z)^QlOIXKX4QZ8HR#eG9zl!|jEF0<OtgH2=!#F;Hm&0X8j9-X{WVDw@p9v3fj7e2^J
z*6G_8#}i^qtdF!y`kuJ$2`06D+Mw__r{)T@AjEgE-F??#Wz)<Xn-ZQK6<*&-OyV;?
z705f1@)yF0GrHa_6Hu>2qm9jx2#e%iF|2JG#j+hdgDZ;Nxo6^lxh+Qhn8WS;)|)_C
zXWLuY?(ANY?VR*zFT-(`xw`eOuTsAW>GNyknS4Kws``>cJU5;wq>|&K9Z{CMG4>eS
zVIX9HbX31buI=QADZH~35ZW3JMm_~ckME!5;+iey+E?wsP?wyhC)c)}6FO<jd*3t=
zdr4XdnR@t9Y8O~u?BwrpwfGXLllXNG$}!{(DC?RM<qS-u3Ixe*qfr@wUIT7EkvyjG
zkNlIKnib)vZ8FL1e~-<^$fTE#RsmJw!C`UaIK9VcZ*>7d&%X2lcaA}h+RE6CqI`Rc
ztw$MD6n1W_pP5}a3~&PeumC<J-f5SgwoT{Z!#~b!=T3a|;`7d~IknZHIWG|#mn%ab
zgGr@HNvd3Tz8g?cwkTmuv^DVT4enN&*|Z7{zr`1SQo05&eSOr#HtarfLNvR_YABBO
z?Eb>JAKzw<T6?8-V1Y>r+i%)yMM;R9zEG~O6Jy0@*|)2HDnnlnNO30SG(^hmSC-6-
zFd6WzW~x9zFx^EB?!<EcqTSE0uw5cSy7!8l--z_Pg=`qZ#^3dkew{}(2t<7D2?*Hw
zMP6c)eP%vUH}zc@KgMYm8Y$e76>)_@zEM_|rKox5u|qQ<arDY=`bqP8y<$(j)ljwX
zy-Qo5YoSJ--%d3TK=Fu#VT_%{OrdpiYtyx|mE`+QHGL|7;eO1xn4${rREl8A@Z@KQ
zTT!C7t=7ez;siLP6+4XAd&?g`<T=|V{EZ4&DeY`6YLnQ4!33qN*J)vxEh?O4IkI0E
z)isk!TCh=fmq#m#eL1rg;{((;H9qIbt)g>s`&t>Y5m$N}8AA!52V!_5f}pMzFUzIT
zwG3dpu!R&m(P>h#9DkA4rR6t$PT^zQeRWPX-}zj|`@z3{s6<oUiqz0E-apbT0%Qlh
z4AO<-&n9MdNq?Vupzkqm7%SE0RpC{cV4&N&Z{UPBbSAT}c9^?@<D$Xd6=?o%)I?xd
zuaY0!w4H+_7gqrip3fiI9giLepSb+0eILy#rb1)%#X6Z9r%F8-xC7{Z{BMm9?uZuf
zvu{;3!!oxlf!U2^(CFA+F2;7c_ll2a<Iv-y?woBI`G9=O%N9xZ?(}pbWO-#YPwV#&
z=ErRKi#6T}RrdbsCLB;?USa`sgBvf0PjqhN6=>u(=C|`2O)V=jLKHN1-z4@djEjA}
z=BfnYoFP>9TtoTXxysfmU4(?iZqjTrxn!PXk%KBqWUpjD8?l(JnRFfB=1dP!S0CoE
z$Mi;*w&+~dvSn&s@Rgm3k{q4c%}i61xBjl~i(j;+mQ(o?gw{wq^KrWbuwLKk&(U@~
zP8&@^q*j0Gua$~LoY`!FpiHwa!mD80oLr#oeJKO)A>OqjXW)r~38{3D4{?O#hOH}a
z#}pU)ZVc?)(Jxwgk|7i2O!-qUx7|u;tU7BT5&P0s=2yFy(Tbe@m}6jYUNbiD+X!f@
zbs);U_4_7r5~E{kw`V059`^NNffBn_^p7<`SrTi)HQ{Hp>k&nNMUD$*L3(oT1GQxD
z5&U9-2Ja^|^?dYT>pM_KWcifuwO>93x8--=Q7G#ff9V2A7BEWuZ6vLzQ-8Jhq?*~g
z^I!goNpz+rKz6l25oU~p@E=RJ;q!WW&34JxZrBEhg2R<{jRboe%2m{i$#4Q%Df?-{
zS<U)K<^%nM&0Aq7Jf7FHJ0Tw}>AMfzejV!u^xpY@6yz3i`A7HSee^6J%c$Gz5MrXE
zT{kF!XbX>fgZFic^AW!+N~y7KrPK(_{%cqKUT%nw4z_A<Y{&;&?6rrY3EF!$R1P<+
z$Uw!BC&WI2W~EoZVOt8YZTs`EJusG_O03`rF(I<jdO4^}=*Cs@w{da%=}jnVmsEk(
z!<hiX@_?vi3W1$M01-V^bV35*t6<4l0<%XOrQ>&%`3t19(naOGzE8BR+O~cm1DCAX
zA9~OBguDysBV=rM)@PBTG&(ay#(qYdIYlmu4aYE;uXAWbt}96d-RSQq78Tv7vygoe
zZk2D+UQ&Ymq<it}eCEw_2-*s`LZHB;O*?uc0rU)>wlAxr&N%`uYOI{tYmk5t`jwJX
zHpg!&v1iR`Z0<xPSg$-51xoe#II|9oQAKnGaVC3X<pQ3Vi@D(K9jsgA)Uq+;;~M+2
zJ)HQx_re{up5KD#bbQ5i@`kZwBW+F)DU>d8Pft4^JzHS-bBnWV&Jf9;4x}5poI*ry
zxAf{A27_7rX;7q}CP~fhQOB&Dez!}4n!2vih6$47nld|GFAY8;GntL0mfxn$r?d5=
zazEos48dlMM1mQ|OP>wP*uFI_gZ5uJz~JEi)%4TORriWwbQ4?ntlL9E3_8kiDrI&%
z=HqrNg?x7MrRJDyg(n;a%Bb80Uwfn8(`e`YQh%VA8FFNfwTAydF`bJ4Lr95EG<im$
z%akeX`?moVnbEA0US|Q>xhne&U9QHuCw21ZO6|ZeR=Thh7R*#*kxYD&0aOpl{+~yL
z=8h=$*Z2m=WMx4xE+;L$-CX9uAUX06_IIPs34>bXxPvwZDZ(NCcluJ%bi^*l$>EXR
zmi+#WZBfhHv8l2@hRH6zmQ}|R(YP*kkHue>W!46BL~m@nwDo&KIlIDB8`p}y=j9Fh
ztY=EjjB>Hgcu8a7;*0(*W6ljNnlg3<J9w<HhJ033_QtDy<%ZBm5aMdYcXR6QoT`ij
zc9ZO5*JL#t$jZydff&lXIxAzhN3t`DS=h14Bx>6=GLaj-s`B<(TJ{<SZ$Ho8+)Ff;
zy_egwa7g*|39GwqF3Zu4$RbU|g{V_{&ZQ#co)eHJoMf7baVNnR`3T&($zM!KA9EeI
znn{cA55DSY*>irQsS+EN*_bWCI8uU95oS+V$Wt>vkCGXu?eJ{O!`h?sL_)3`o$D4M
zq}i^%HmrhA1<-?`o*lSpjNC>-#H=u8BQc6fm5i1X#iArMbq^~2MDhGIll|{w$l33~
zRKG1OFnTJfj^ZcFzanhi?`)!)TmtpD4}NW&p*T;cj~8qzweDrlO2R1R-iE@h+wZCO
zHrmZhmP03zpg|^dE1$hzDcgBT3NBOKS%Of?5yAzu$r4=0{HXqoRG)bATJvVvch)_o
zgQD_VI0KHcVWox;)Prr@swsWCfV=v4*8WFpN80zP7;8LsP-aGznk>L!z%Z5TP8(>9
zo&=4?`e8v5^6|0~1_COL&&<xS{=n=;i+KN(_}0^-;4z;cVNrTsrU&LJb*8C8#+>YL
zNg8)X&(fL}mLbYA_;z{gFKxuhUl8vPMmN1Hx3=9ee4nx>qREoQ%IYO^mHC^r+VU$K
z3%$zCU-%Ntk9%2^AvQkW(Z|@Nw2^J2fAc34+taWZ4NJA=Z}`;`i+T)3RI+GBUEr(u
z)I(`PunZ91AR@DUGO3#9QH-o%f?~Ycu4NQz*Z`R1y*}tLx)YuAloTRjvn|*j>ohS-
zkE$wIL&Mkk#uru~<RgRFV*Om7EhGIXX$7oKb7&__1uFF-sfv{wTetMXmTOj$l?Ku;
z9YQtXY}IWnJnP(Nd;B|Fwr-fop{XlDIYgI6@qF`Q3`BeG2yHVZvBb4q%ZZ?|+Is`<
zRHT_+jm9Bc;`MvKyZs!$Lf#(y;jM5XabFZD+9`{qOBxCe8oGXrzca9)iuWYXk^<~w
z^!3IQp?kSjl1<0hUm+`eei#=&UBp|)+Bo*8m93N$TH*@|=A&L4M8haaW4HH}*`m^W
z9zUvzomk@`wTuN>j9e3Z-sNF2=u4fC0JF+kY0N*nXf$qI?eGh{EDT)*a2>!9#i{-3
z)t~4WLp-=|9iKV@_zm~5Nr{Tp6UJuBLz)^xYyi&bp5aw7c8wOk#4e55ZjFO>MUgBV
z=;E>5Sh-#Icz=`nPS6sVpUBZX@8$iXq=FPp+wVXOrz}XNusFob@$fkHh54HIHSwAE
z9T)WCLmKsZ^4LVkI}jqH2YmAFb`M*tB4aiAm00qk&1_g>G#k13`>A7>`}uuFcOP#0
zujE(hu*dAl4lW2P`Lp!df^N9-G2tzkns<0dz-a6Qf1Ck(zMTWQkjDio;`&n7wr7Pq
zW2LPzx2F?i<}P21@j+E&+aXl9eViR&nX+k*o=w;c;`Qu`Izy!A9&+||`h-;Mf!A|$
zj0%({UddkT@0Wng5+1a6y-kq92qsGYQhg>_(q!xKDtcf=$zr29pn0)h6p~Y{YlDR;
zHgHS+<=^j8XI#jH{sFX4Zaa*Lw2O-78$5V4{(&byH}!EyuB>`PUw`wL5x(*{a29s-
zvF%Ke>*Jns<<ZRE{{B;!(mH+O)#7hzhFs(}Lyjc6=H-U<FP()@DGLx0iFPA(q|8sH
zuLDx}qQy#XqbwaOpF}v$VtSshNaEIR?~0<=$nfHPw@93Uo9fDMoH@RHJNzOA+HV%z
z_eoxzoWo3+|4sE>dCpUbTb8u<Dk(cN#R2F7K2*+vl-KA<P>spSb!q0mh1y(oD5j6N
z-|*MW4ytcU{^$pq0CDIM+|`Erzf&eYD$kF}%CHZ9u>D;$U0(!D2n=4_25)7?{1}DU
z%aVEcIx5scCwoGU+n2Zksr#2dScw#cF0ofUK(+U0XyPvGfAJ%N<49ws-N*JJfZs}c
z;)wpiVS`N0HJEpE_9;E7*X}iywSKwuw%@x^y98?PkppN*R3<C+SuE9trn=vQ2{~f<
zk300~gaKVoUJStt;joS&5Rv_gz?6CGGNCKDQ3$Wfrx$F>_;PIL5sLjYzSW)s(320B
z(!nD`%HD>euKSl)l|us_RbpR)#{AH;twt1%ebKc2vw(Us45QYzF3$$cq}I<|*a-mO
zHAbLa`Uk(M9|DgCd*#!7K9{PF@vpkcuU;5Me)!X(gMHc6dL_2KMP)dTddF!}1At|U
z`!6?_-*^M<#@xOS(mM>eV@JmNom$?X0Zst->71-6ldNBM?h&FeEf90*G%<cehu39W
zPAhS9>I^X1_(qAI7Wnqy4<iCm)9I;%^ntsS^T>J=I!4Sripfa6GZODDbu^%jYx2p$
zh61oTt(PF2_R$L#s!MVPB^G0DJGKq(P9w4<y^ljD&r-Y6g%MV62Ln<Xc-#eAZzb`l
z`y>lc-fifnQ@)spPdvP<^VV%C<r|cdX-V2ABo0d~S+9<EJS<jytkhKQxY!hf_Z!xz
zMkZh|w;@lsGfxz;>$<NFRL!_028SO<wn6?Tz8D<?7R6bhNuYW8B}Z`x{kAjFo&#SH
zR3GqSd@vD3{y!|0KfJew^(*%1gieIs;a<K{fItL4cYMU}hZ&s%@D_QI^<C?W_2j3!
zMR+{z?*%fCyMCsS*`Sf$ieT8M>+0d&A4cu*1z4Txt>a?dOg`Ml-nl(r8dCnXoU%As
zqr_7st?%o6k!j!uyOQ(ju@Ez)X|BoEdgtj+yz`o~k@sDE4^_P3NcgBUq)HfJ1~5_K
zm_t|W*#QwW9cz$zdLCRW6d!Ofp!9R|(XLryo;wVjEa@4uxy$*dUAxh^`}@YUwshl-
z<r1rvn7`)}g%jvK=iCDHuwDn|piZu~Biq$f0kFV+GEr*Iy#Y8v+#YYnUzE(gEO8vv
zIkaC7NYYajDR=|fBS<*)7|$f**iE78)2|N!$hg_fL$Joq^-VxP?{$~LgKWgMbM384
zf&P#+)ZVttD)!eX0SV$}t4<ul%|bP5z64?At6cw&B`4^fYopjN&@vNQMeo{iI2X{3
zDaV1}xWfRNX)(m;Ic$h^M`=u;>Y8wC)L7{!I_2RCfOw!29Ehh-MOSS@L%Dz%JplDm
z4~R;c=~$)TF+IWHEmi9sW_U!Y%Gk2g*ePxA{8Qj)`#C|GB;Sa`K|H1a&I0kDGsh0m
z(PT+|Qcqmhl61X$)DYt8aid^rP?&aul_&CY@6Ag2FPxX?_^~$4EtSQ$)Y2zy3+_N_
zgQEhBiZ`HykE7$WOmOTjGXp>>Y2|EVFDc3whN~>h=Q%P1D2MxNhtUG7Uenx$zP9IU
zidGT4)7}j}QF5#N2Xkf%ox6WTG*jf<!2PPwe;y)*(E2t|qik-+nF;0=d74pQ@>o|R
zC%2_B9c{xvGd)@DyD@W^s+&ml$CjNmrK9!Eq#Q<#PAVeg6w)a!kj}f{t*Zd9=8V-O
z&}LTVH7yyklOFkTpBKQ})gyr29Z=&-dHqJ6v|yg-XFPvD{+7e_bSW*@wa>cV8|K7g
z$TIF{p`=u;`BH_s>trhCxH9Y3d?a>Cqe|@+0NATRP9xv;;%JIvp%g#o(4|xODQ~L=
z+yQ3nJ2LrLsMl-5hd{MUS^G{+r{_@T2f+AGOTjC&r|mKe832`Z>2Z!JHk1;P`&;+V
zYLx7nIOP;fxB_*4B(w}M0C!HBj<C3y?;_6GeV8XcSbh1BY&FXogVeu!uBi=gvwZ1Q
zSStvn>00Yo72UO9!!2bb;&2_<w5d%{93u|kaCYvFU0FTj{y}zp_Bfus#8ce<xx;vY
z<lpgYK*~7o`d+e$^e3;sZ7_<ii%u`~t90u${%3NcR{Bx~(Y#<=-~X8-02o`78ZbK6
z)!M#Q$NQ5>`7l5sa)eB-_{m2G$RETy#3+Eh7g%}LDwr`CJ*hbO`VEkcwac*rgiI-O
zfc5o`zDHlbNqCVyYnpyR|EC^6c9Z~EU&mO>8yH-czS_@u02Hm?SAfZY5T)2a4LGN9
zvHT$9%Z*ENi2x_>uPwNE#A7DF6|7laiZdEId*C9~1j<Q%qRcBGH`HW)*Y4~dQ66C;
zhiTkjgHiGbdnPw0Mr91&Fgqp_oDT0d0^q@xZDi194L?Bh!tF*a?Gov>de>;5rNPS}
zfElpXTSj8qU-p>*22aCPRY_+yIwx-O_y0dmoDCg>bkfqL{zs!-XzQuj*T}T%o=E|c
z&KCee+s^<s0SVfZue1X++s)O*iTEAh`gL?3m9S9a;Ky;FFSD*Q(}(-+erC=Qw|_CF
zU50z`PXf}xj{mqB#fA5!{X^eV6w@B^1Xh@=EQ-o@`Aa58$@tus8HU^#kz_v~F`f%B
zEP-g1iIUNy$U!+}`GF&b^?({$%U^2v%+M|6$p3~Xq7;|n^no>{e3;0HB^t8R41ND@
zmC@N1reoEmnSbHTQlT7U{&Xg&7fIK3tt*+u>htJxPNN!&n+$zBjdoT@7yr_Q7phyE
zRs&zfiUEJLa5Cm6h{(Rpd>-Iz*2d(n9|LfnTy9J;li@ve)RepFFo#JPV1=~g_G=tI
zlD&DCD7)srMFA6({Tj}^zm)h7qM-_YyYxNl+F__RFX)fdMGjL;9B-t`0{9+ckmZ1?
zo&DVr_HETu%jbaZMSQ&Rzus$mXPL5Cc>4gECg$Nu%lE_OqBuz75TWzjeb%it%Z?YU
zLkv5g0fHc?r4BTozA-P@V9||nY(V@nnHGa{K;1$@0klu;<I)q7vW<_o?&fuP=Na1o
zyYf%!nA*TUqGTwFFMYPSqx#R^Ix_8x!2nPv4fQiPkB&Ym>oCK_X$B%_Wxd@D@)gd_
zW`F*x9QZu)dX(GE5L50c3gnpAHT5%skHG5H_?Bt$c)tS23mvuFEz>eo6{IDZ`~Kfw
z|NF%By<(}iKHAYfe}kA1CX=23yTIbfFBkDFx=Ctt`q#JVV1|Uh`7JQq)w=d#!E)^z
zgUn65wZP^9Y2)9}styBo5P<Um8^5MZ-Z$2Ut~?nfE$?=6+LRB`<00AftYJUVgWAl8
zPVPonAPz*Aa(`rA1t0$jTMjLKXn32KF=j3KruTtrcZaUpHRQ|X{KLHstYKPaK@0nj
zbM6C2vy#mW&FN8@(sSYglW>{NBrF|Rf{OwWCv2JgrhEsaLMl;ODOUV;#QI0rAJmoo
zIvYUVEj?D!^2wlZkXp}4@y8lXNxJ!tyVToHijBD<7MNkcCcBR5JWUiu1Yx65Sjg&&
zvHH>=xRoBxU9Zzu){$woI>BjLnSSdp=ZiE;pOBsB*z=P%!-*@c)BCLe0{6gy|Ichu
z`e8mH3;?wy`WL4mqj>2nfEu`?Y=xljH`qSdMh&3bvhKY`!p+^D|DmNpFb~BsKP{3e
zDNhDPUC?DvTzH1b_b+sNDv*0d&l8qAiA-&`qI<HdhPTz3=)~LVfEFABAPT_^M&So9
z&|yq;CetUT;`elmS$zy33F@<XOTAuuqI{kc5NYB*o&4+4*iWzJ#9)VijY}PNqGPna
z)SL%|^y84)|8~ng?~c;?X|fyx<P?6P2{^v7_jI6EZF>ity|PO<tM*md?_MWsL4-dl
zssQyIh$nUo_<zUs5aU%~kq=;JI6g4{_N#616B2^nSZ*2<9&M8s(t8fD^cYV-x~8Py
zr~U;QG>P@#ys@Y1yhHh%Bil3)H(J2=r;f$8nu~GVaW0eGst;YqP5cyZ_!P{=DG9N^
z_J2Y~PY}8N6P{aDKDP?Cy*PL?_qm}`#f?v|mHwRW$DrT!M;h-7K{F$^Yl0<(es>Xu
z<fFp>&1!K37S&s)IfeY`2w2^dO{m0rw?~F4V+N;}BO1+%<RvEnj`m}L@Ie7|lEM2!
z2)cfb501G_P91Wqp?*Ao8NtyI90ME!AxD)y9uqhS@7EFtr0vizdnR)nJM=Z-cU|nJ
zz4=&E=`SZ718R2)I>w5xJhLkVUe(cD|JWwa<aS}}Dcy+D{$2C~oPQ((699V~3%=tz
z(gy~;Ydt{ndGE-^IwcIAr=H{81MT=yCt+)KuP++b228IV9uG=E55x9SVDPZgmwz&`
z>qkL<f^Z8;Z504h4T66Hvgh}#^-~Px9LnwmNWl346z^^Tq7BHRo*ajo>J8~!S#BZv
z`8+qdUjP<@h9&E<aC(}Dzepd-L=byr`sUxT{L2{KQ99{7ibeX_wf!%vmXiyZTT24Z
za&bch^NsqY572pE04fQO_hVg4jwC9Kbvk&z$4-}|&XfSqfe-SKj^#zE2q3U_uM*)8
zp)<IDhvhb~5jBk|f3zOKUXyMf@HpBxOu4xFKWwn7Gs;;R#CrnQW0TC^jU)x|%K?eg
ze`aRr3x{r^Tl^S+#K<~J<_E3uEYH8kAs<+_BoQf~8sZlf?F^1llNeD!KF=cx({q-8
zcP_W(37-u%Zp2d9<3~H&$9jIqxMpeOnEPe40lJl6SlI5XCwg0oAi`M1PynOg`QN3!
z^obzl29ReQ>p~3#4ic-enEq>V^Uxn6p|PP@ArN6`VZG?`|GLruI4dr(qDoNA#c+Dh
zkH?)}$Y{nKumS%55PEC%%0b5SmAkPteWOuc+xsd*S4>~pus}`(XFTuG=Kvt_{Q6cM
z*zlUz8IJ!v)&~&7U4a@Q);9QgWO6F?mt-l>MdE2hNb1-A$;;!-!;_4LWd87A1Aw(F
za)Hj>_Cl<(9vE&Ql|L}tiFgKtpUIS-JVEaQW(`bX-mk^b`x*!I*pW?VB;C+|J6QX`
z@mq4BHDRFSwCI7!C;B1JV==&Ld0>3QawhCXARr$z53ZxHfq!FghNXZ-9?p-F<9sUP
z>uIAtIB6JQZT84A*FrjkS|xo}NrvvA<~kan=X&PZI*nex^*PrI^X6RqO&wZi1L`*y
zdNqC>_-pR-yQInjfb)spt$b+ZI{RAcbo!Kw2K-WDbwuLK37}?=$|Y9s%6nt^04ilt
z$|;(<RyQ*J>S~>|6cc{$2!NBlXK7g6R_c-;ckF(&z2iM57e~eu{~ja!_8T0Sw3kMf
zyF)zWk-rbd8r0ip6qkEo4o@Ii3}<x*iiP!@*Q$f2*Ny<zM|RBD%aL`p&V*<X42QS{
zjGwPt{ll05))7%Fp6I(;-<?pZJjS=mwmS)?h&JHG{=_P`fQ8sQisKc60#-9nBk?=T
z_ogaG17K^^pVa=_q$KGm-QWPvVyvS(xN}C>e$_*K+T1b&xr)!h&z6gk3zkBl^pX%h
z=5MC0-!uapCJ#N?v7UHTBiSWj$&n|w&XsrsnE+<p!We&o{q|YTz3A3>uvK{J=!`&i
zpsM#@7xTeut>hvK{eeu!S%=W~(**DC6Z)lSdw=_O`n=D-SxSGb!xMY@)=-b=_o#H1
z6%dC>tdGQayh`9INub)}Q#1<4fr43p_(S?j5Z28HxHw*Y^odOK=>n$?gNdi%QKc=V
zN9bVd;Ozgt3UkfA){1EOq0?gMyqnH(^oz0D($x12qT1e0GIjCcsY~&|Gaw!_{MR<?
zQ5*v>Lp2j2UjL#;pKtD&nmY6)S>ik-59eeQKuwnB@sR=8wo)g*V4u^2{Wq|4K}>WY
zzPghX{Dagz?yD^4g;{D)6SIF_wqP~J;O-TJp8qsa&uw)8fTW8aK1gY|Nxi3T=TiS+
z+JPqR&!0y<k`@2drnnby>ILM(e<)u1-yYDJIfbYT-cH6}7v^I}#g{y*8i(7ZjAvcM
zRSFgZjS~u#=xL54^8qJ`g7fY&q1Q(mZpE^)0s9fa2(#8m>02*3vUJo)OX*ny^h6@`
z4S``A!}`Z#0rkIY@Ng+kkf3loKsWeP4(utt@ETbC(u(8vo-eR$bRFhd19IYjWr2WY
z6L|+n=4_e;tsY^%7ck;?RMVh~w^NEu2HP|53*SpEp_6TCWzT%e4_d&lDW~=~=IIP@
zqVhW6dacGH9<d0Du>t7jbJGyOR~S|R>{{TR2K4(q?ftR&kEf8s{NFqU{rqvf4L+0v
z$xTvKPb1I41))l@Ow$P9Q9zmvqx<?JS`!TJG!Lv0TINJYXTM;`rSX5sUOqjTSi#Ea
z@3*47b>D;%rDp#xZEkA)TOm>6OvP<ZWp)FcP{->XGJ-TWY~Rt2=mg_rc3KEk&c1R*
zSnAu3!tC6bP7OJc2t`B1y%m7SwDa58I*<2yz;<3(jc;~DYy@fK{0@$hiPE?PBRQWS
z*C67h{P)i_AiIigme<l#p~*Ymet8RlSNXTf&Y*vbsdkHTO5Os>6#(-X7?LKw2Z--c
zKy~S=JzL47u(xP^r_LW`aWlX~)(Q=YYe}8%O`O9tCG65P-I|~8p{f`^E(5G17Ovac
zjJ)tK!55*=)Jf>(jkght=4*!rAGYZSmZ&vFNQy;T7$h(T#XI-km3FxMcvjn6X04b)
z-uL+{@wMlt9o5NH>V`W=R@oA<m;$kJ%-mvHah%kYLn<J*8fj~=e|1ymrCGFj`oc9P
zPQgqX(hKT5q)&`wmVqK#4~FblX|AE;LhiK8emji;BvTV-0XQZoEo8k2jou}UkjOKk
zu!<`Q#H|wm=d<i%K(^;|BeWY;4YRdJLK{bc_VdUy4*KNUVQB>@ym@f80BI7p5c=pf
z0^co%=w8}$rk`*R{KWp|TE-!7QQfh06Xwx8faACTS33-JW}cf2=`A`x<J{wbn_ynu
zs6+Uo9XVE`!R`Q+wd4zpUSJSk&3uFDz5bw=`-JXqE5oG>Unqs=Er#zLi9il^m*;-h
zsv^Q(68HtHIR*cfWhex-d+LU!%ruMUDoO1RBwS{9{iWyDIuNaE-MOq%B|AIq&{84(
zAT7;csZ8xxhlR1OO?~?AOvxa%fMOk>ycH(cB%PjcEue@H{>j!PT<@8ims?1*!`Ox^
zr=C#`VzMfsz+mex7?KlVLesn=N=-f^KY7*geb9dx0H!wmy}*mqHnpcANO>}luJabB
zhhVpUYs}tJ^}a;9q3>c>dFo+Fwo$PILZ6p7oR?~inH`P4jIG*sl6F%-boTeIxaO5e
zYOgO8u)BV%l5-JL^V%TbU+p?LARbi}&4&sU#;>P3wA6#(5p6k`T|1;vv?$5%cJT*q
zn%7`!qq1#kwhOY}9Fh-nfVB<4X6;Q1LHpHJ<BA3Ag+rc^k7NUXFzkXw(cfY7tPN4}
z;<;8p9YDBAYZ`G21FOyhqMA^kU3{{Ee}GwbHGuxeYK^1}o_2f#??w0Q>iummOxEF<
zBEnD}kB~8!x^(lOC2}Z%cI`?M2(mwiP0fP!x9CWA#+(QsiLZ|AEQb$B7B~4zPJCW*
zAPktXHoe_B45?VXM_LO|kDhu9r~=I&n6@%_O+?3-7>Yi2s1jcBT&=DP{k$70tuF95
z@v;)|hObVeb!&X|<NV6@)3ko&;K*IpJe7$&JG`z3Zv4Ff^LC8cVn|foo=0AGBVkw|
zZUO<0RhyCT96{p~e)Q}mIwL-DOS*j*_*m3DFlZdjVQd{ePG)H`etbsOt>;{<=g5iY
zJig_O10_%|6lE=0PvWjrUhfPFx#z)oDOpRW|L|~Gfs+5}Z1v*atxZwZ<*3JbRU+U#
zFTP<hYL*@&uf8yd*cCAQ+icAI26jD@y!9R0m;nvQgvJ?rDsFdYy<q6)Ri|b2Y3%5o
z8l}!HZS;KAvsfBEVLfQZ0+KTfK{<Ylm+9`7?1D9Kzkfx{>)#mMHZXS}AI`L4=aiw{
zBh3d0;4Q2)JME~gkVg)Kp<SnW=yULY@}K|BAO3&4p)N_F_3{LGtCB!n=VaGtY%&*6
zulLMC^TDo2QYQ_i$4H9iLN^456B*h!a1ImvNL7KEzLqFSA1!t6WtjqP02;Pmridt*
zQ*d$^gY{P3Hi05Xx;>xEUwust@!3GJ?mwbg%r3#xTa~SlI#sVNjTR|B$$=WExG$OB
zh3+d6`IEV@)I8T^e3bx}^!ry&_l_iKy#x{M8FF}!dtZc|i9A|RVjU||nsUoywK~%z
z+Q2e&x5$0mOtK{b>69K9=i1C+F=~d1##d<d4jVB&4tEftga@BCgzb@xDowmx!p2B0
zwu>i0QE~P#4VKV8;V#%=dF);*q-<92Q?m8RAJ%*tFpb>U&0CKjIjQ&ka6^PHiYw5j
z$R;s%m~x$HYuBtT+n!@i<k|GHog%!$#*mSFGwRv&E2~0pTAZ`R$d_bmudz`IXd}V^
zDQM8ku~o%+8TEziN?MK_*;=o{Gef~kG#b#qS=%_|b-h%cIGqE(IL@3a3s=Mm>@-N#
z$aXXWeTwBPB(w0ljZD*3K1c;1cv=GD@U4^XC)*`*Svx27<vJ(1;aC#i<@omzj*!F%
z`jCeT(Ep()%$&R0o`%_3-vc$6zV2V!bny9$@7Lx@U2mI+23eXWqIYJseTRU@>~=!z
z`rd5C7+yF<+pGTML=cjUy-uTaZzSB;YbEc)ya-2lb)wSttKMqgJ@WD4{JEIhF%567
z%6B0HG(A5swB6b|j5_@6i;`EDGN-lw1qVZJh9gJrzC7{TcZb-RA~znq5<Ju*=P%x1
zRn3;xoo46ipZ4~R;aAnO4?iExx~x-8+Ob%vbW0VI{OkMKiE&Z1O<v^y@KUoXf|2an
ztbyfRx+eshKmv(8D?ZWhrd0J@>zCyoYfjt48l|V}ZH%%n1)R8b?@jpC?T5VMD2Xeg
zrdXNQ{63sWLugU*xvtMG<owz-F+bGlc&@@5<T--OOmE;?;vU1C@1#s?q5I8)NehN*
zrBut#O|HOrxy^v~r^WD+bgPF^RYrmHaWK|SaK&JprckbTju?rM;O9r8nnQ)wJ9@#U
zF$I3#N?JQ4_oapr>kc_>8s{;MIN>|8_Zyf{!J_AG6(^rHmo$2}`~p7by2SsUyD9mK
z{BzPLw#;^qIXP$fNlyiyB$g*k84P`g7Z16<k@@d`J(J0x628_f72kw7zmVF|^0Lp}
zHN;ikcs4OugXVn#LNX9<x+f1_!{`01n&**K4ZrtwMqQzMnQd)2Rxy}-gsE61?c1f`
zW-fnPCAH}x;o9t#NS-0T?L52wcc0T#&h+fcV}>tWk6Kn+%2D7G|CZW$Tuzz~M0I$i
zG}(5-`<I#U9S7L^b?4~I7>BPsZD%tg)~%<jZ-11{s*ZCWn6@prLQ;C?6%FPNRf}bG
zmMdc7$MtgUJk4p-5yC}Wa#(wLB2gdR{;CGH$R<Mk6}7Gs1qwT*4@O)YEtXckBhZOB
z?!ka=-pu|<Z7(7!v?3&2MtaY_=d-v4$;?=qE3*V$5FMLegYZs)!UH~<DVsW)Sl8W5
z|9}nN>ccpm5oVrnEVz=&QrqUCbxX=%$S|{pgHXw@Uo=*QA0uC!!|&c1l^FfV401m6
z#k=#&<fxGOI9!s^UA5uxRH-rUi@1}Jr8>8NoQyv_jdI+rqJ(W!wP1ZFtFhapJoNkJ
zKo0Qzk1e_UoJG9Ubn?xg=yS#y3e7MFg>~NZa*~HOP2%6ivpkR|X|yAiC{K+sK4Gk+
zzI0e&sO6|~Wx0B8`&`x*%KJx*OFiF)8g!;N9;Fw_(~WouD+HM(@6ales~R^#pAK?m
zH97@}lQi8kWFHUmEHZ7U)L=AbIuqdJvWTS%gQB?xh9!M6+#YGrC!h@06%Ek*;Fj&4
zD|yql2!UOrjSGlFuP`VPD$Xy=VNV=|Q<|XMU`fca;o;zNmPYRrcSyOF?FnCJ_ByN(
zyTT%)g~}tJQ<lcB8_KXGB%FFU(f0TO$>|2B`9{e-$PE!I@!klke6xW=+cN&<m0h9Y
zJcB^i_%<zuwZ5;YZzyB1_i=FB_~cP&yRigEne{|ddzyv!qMx#!T!<oPmPtd|rMQ@!
zYL@d!d~aXa@{*IIeqDDm)T~17ja#0x4{RDT|EbzuJvjyYJs*brs8|X4aY~nMJM@*2
zu%f<AcExpE3>mYB$FHYF7}*{_IiRl8X^!3(?NHuJkY&l{C386&$TzCjHk$JyrjGWK
zl%c`Lv>2t4%}J}wtrdc!o9UfFVXm*{0;NmG>*U{vsz$$vYxkKilqLpXHk4<-kKpx7
z4Dvu1fxG>gb>$7>zu$ZR$4~9mcy5-Ii%;uB9`E~jT>Rwhli9^rMy`31+JtAV@|>u?
zI(aL1=8}aVz2`5Zb>_DuArWClgEwGBr!{hfe&y~dr#RL;75~{Hf_bvo{N%Rhz*)75
z{)dF#E}}26rEz$%nrbT7+H`<WoF*f$AyH(t$&HV>9p4|_&_?{e$0c=@Gow$}{aJ&c
zPVVMLXoBA{9NAO+mI}7jt;(;~eK!tw$aAXsTjP4=In`4uK^+y!ahU3`@u&MiyN+@L
zcN}Souh-t9CPN5rXP@+ZyQOx5(F?imJY>&An+c|J&V??eM2&Xl(N1n&sPz3j9@bsp
z=aHMBlI=%QII@ri!<<nPFC<0c86O4lw+^zPnRMrVD7xKD@cG4p>R}ytG43Xup^B~Q
z;z6G6c-S=rk$tIVr<D=I^&*Ew0wuz6HH~_E0(#ni#%j}v5=xmjc|6F`82akDQ&n$n
zhH9UMdqOhu%h3#0L-%&q=q05%V-PniEmw2!{TnmZt))9FgB0@7Tb5NN<uo;)^eWrE
z)p@y<cW%kU#|BTot#S2T@~5^^isj1Xh{kIBFYETIT~Yhc1|*1`shG79l(Dq(Xt2Fn
zP@?RkH!Y25QSseQdM={vuELp{)1g(TWe-E3B%7nHGa)|5_oZmX8Jxkj9O}3@24%<T
zHjgsB;4!??{7lSs(iqFbMVSW>=&UR!YRhgmSOnS)xykuLGX^Dz)9UzqSgH#Dd8<RF
zfwHWxcCjzjzVbrH%kS@OuaY^US2pHGMrS4L3<su7i}Zrnk(5g)`~7pMs4Nk6oA*0X
zNFiLsIIorYnb@PZA7A>y%a03_6#t8+rRwN_Bv)OS^M#seO1T$`V*?`u#dQX|pB61E
zPXs?<i_Hm6%4OA)3kY|z9rN8sh*{FM-51*&e!2)J>hET{M!Xs=eN=3x7GwjH!N1(8
z-<U@zi_P3cYRWW-Z@=+WkpCABNrC5Or_5&;QcG0!gXPe`8I8Vz#G2y|9;Eq&hp8;N
zZ)f@r?Mys)1(qnTC<qz5;e1mTJQ}Pm-f&*V`Aj{AB>4)<F0Y{6?|ZcDoS5?{E4N#L
zaPrde;W_&wkd@=rdmfp=8uoXDOtQA>nm$K*fs7O7<z#k8d~b<EGx5hl9-#*8CDF@+
z5NM`Tf?lE1W)(A2k(#dVgOs-ksVbkcZSpknBbQk~#FPB{<;T4GFL+wArmpBX-|Ra6
z7jx^-T-DSooTT$C_o+LH`T^-b4St=gcRQomQCV<vKe1}SN3>nJ^+W0|&T(B>{io4f
z0_$@UwdBD<dWULziS*0i9gR6^xNYcw&ftYMg8vWE^9I@Ch)N?;+s53eh4V`6_DlCI
z**%{B(W(Ex49mlpJTK!oQCA_5vM}rL=b7`;=RgH_)snD!n}Q<GO4<6|!aTxrG|Ni1
z@9*~Aj?W$ms7#g6%{114tiOgpC2lB%O5!4DFE4Yl<K=_8^H0Z*B4v9D{lqWTw-6)G
z$-TEi4V#KvKN86H=X<dmQ}J;dlx4SdtwZ%)7jNq(F3T#e+`P?jUCzGq!+>#h!Q&*h
zilVi~GF{7zrQi6b0ll?v2^MWbVvbWpgeF95AuM^jy~KSd!6DP*Y0;jsrT2@5>~fhW
zf+<gL!@5^OXM?rV<@@wC7L-rt81$W9WOVf{SNu<79);0?!{Ter$7`Q-EFU#*f?a6A
zL|dDPn#FLXnCQ7TWEyswnp*<7>&(3ccZFg$;ipy(eE!B?D(6nj2$<AQxa&=BC%Boi
zLvA7lPR(Gyu7r?>?#TU0`+do;rPizjIkkpKnXF&Y)n5bxLr0M3Q|#E@jyo9Sz?igN
zz^k~OhplE2<m$OBN1b-rTAg&dv*h*8cUeuX!Sqwz9GBFzWimuu=5cwwR_<n?uKk2z
z71yS2m6Zc~1_WBvM`6^gFu(C=`In5(=cLqrXUQQ>6l85O+zPH-@?kyB4Q~-6yKt+G
zw}14~zUy>~_}1yTz;6Ko(iG95Fa&PJxg&veF=F&|kzQ~+M}P8N#UBKfOvKo&9M)jb
zOYMB>w3M%UJ1JF?BZTpjKc@E=*O!s1r1bldn+|!lE!FeLZfcz2H|ON>>sPLzUJ_ah
zSw{jC-|VUQybRh?K&Oru-$&1ux4OnGiD6|+5fTp6t0i-ATzQ>qz!D1(bqH=3h|<RH
z{e7Sp2NwNxZKA&e0_9KMnMax?o-}=TzD+!1^L_<}DE+F$*U^6h#?eclgis9LbCu1X
zun%k_YCn5tHDFg@B+MYL2NfPIkPw(|k2`!F+0l8cs+F+zJAXGa?ue3rX}bpUgE<>l
zI_y)^%kQD$&mN>Z1e&-NTL<ad-xFcnb*LA|JW+fh8n@p3(uDPnGvtm+S5J$FL-j-r
zi$_7UX^Y*0CgiV3T)Q9;fX4OB53Am^PV&LJPHUCBiVpagI|L2sK*U9DuZ#EI_b#25
zjvVsc45e~j2wuW<WLr7}U+iB_F#I+IBT0EaBq#aIFY&Fs-BIwG^g8x$cJ7-r29=n+
z5BHn)lg|P#OdsWZaLLE$s!s4x=*H){BCg7+M4!esV&Ss#!_Xc=9SHL-1}bOm*ZS~h
z%Z3Fm%wy`Z?uF8tJ0uO!8X_(Hu1YrOx@feTrfiNUt^2xRMiEF8IbWE5i<*}&x4pC>
z-ar`7Z9hH{D|Pd<h3v%LDfH?cM_&TUH`d*vmC7hd>fEd_eqA^ZKcyD7lx5iAg*6i9
z%*jdO7LV%*<;O+n=59iYtqpEg<)x2(K~?Tk<bZdn+7SfJ?&QCe-ZaEg{GPaN8Enmy
z6Fisa<Ph@v9^P)vcfU&Sv5BCr`>2KIJQR-pHpIfRK{dS;$b0Fp^n|YNvuy@TjB$^V
zh%5e<zdwe)N-4Sg4pk%QIH@!!U~XHR8H8&5uxi8mZBu%!=2;Hbo=H{3?Pq;9K`HtU
zI5**5UgyRhDV&w`R7QEfdk{Pbp0)$cOvsGk<nvyk%CFw(swJ!pYQ((66q<}UP$)4=
z&_N%PqHdeQz8B-J?27M>BH598rAK2Pv=v%B4=OYmu`?(%NTnYRUWp;_KVrSw*%vUs
zry$l{cAb0$v@uoQqdOQ?9J}5OyKtZR0pERESVMC>JIiDfs2ErOSjac*xHfA2`qwzY
z-GqAdCNhM_?Mz2C1{I{d|E!hhGJBhbwHlbTMROYwqAw@G=a&mX4e5E%p!U?BG>@%X
zU{J#Bsrw44D2h1k-q=OReLkO<lj|i8{S-^(7MO7h$HY~A*uU<{Vi1zKb1lQNW|R1w
zRfkYvp5Zys{3Hs7mkuV__7${fPzD7m*7CfxE$+3>f4B0!yZGbvMp?jGWk(kEnxPa0
z^^`KL>lG(^S-Cje%hM&KRqI`C-{#fM)U#s+>hHX~%gokhd{frP<Nmt3=(pa8r5wpa
zzF<mH(b#TNpG7&;wv>$1LOH}p0vu>01mplV^6l)4egnb!L9nadg(9ez6g70Y)7d=e
z_Q`nbUF@fK$V&l<9h67@zr<6C%cf^HR=G{rWk?2czifiUC8bk%YkOf;qVGEIQ{ZIe
zRjEk_$42*Yk54mggxpFQgmI`*IEP2K`irGIR9~9neiHIOPJQWKvQU}lCIhPN`swYs
z2_bX7fn9pG<o;>alacQ-gKxmLpT>xq>ai>h9aF+B+13!x5c7GDC+`AQKTlpW{81kw
z5%g1^`SvBBeWi<=)QRId2;X)fw)N8KiZFr^lBK^;7@BL%LnU37wTACHWcSK^r=nNe
z1F(XXQeMXmV8dpNY!)Hj7hBU$<r5;79|(^xKhSLul<n1?ysWEwAq$svznMjQt=4D$
zIW+IW=y#00sWw<GQU1KIxG!-JR&3gew^s<$9B(7uR>{A?88B{=5L0vGTHD4dPpGVY
z`-AOdqt~0%@wt@&&_MK?{D^oh?2X_rgf0|6yH;4sZ}ailPM#37zYkN5O_IT$$MV?T
zjgTd|Pi+RO{F~8mbhmLScV4G{P-TbGo8(>f`!tiSyYp>VUeT}yhGI^g@2#TE)HKY_
zIsJaCaT_sE_XdZ0RlT^&nwjUc>PJzj`y9Qj<ho%0YQN=cPz5LREsqc1zdt%@X3$+Q
zGNuv*ty`ZYV(yiMT;YaoC@&KoV=DWxm*vWAWcJckW-?^1zRo6T*Hi43p9x={;oo~e
z)|^w={}6%f>YTUg<5afH5Qq10-v8pMRGB<+-QndLKEHH<jrtk!5cbLkrY)ZY>j5o<
zws1XjFw&NPnMWHkZtS1Hf5H_U??RNRJ0)n_RJ(?Ic1g)!PH%w!m3ZHHrrz~|hf<ur
z)re(-Acu3X#_-wew;9}7+g!v~BB?AIIo{v~YPXn`=}wkan6Tmvp=nWwmS*9z2c~UW
zwuuTD^OT9deZgpX87C^|VUMXbP@2FqvXKxsb&7qsETM#2lzCjy;PQ{%Z?LAaOQL3B
zEkyHU^36ZaUS^cP*qnJ9s2LS}arEM_inpow)gcJQzT=pfNG*DTZB(p<mj|Q_+Yj%X
z&bEX(2iE+<0(k6p=*jY)FF$)f>_PKA*A?%9$<)vs)3Ua1adR%HtXaf|FYaT9y^G<Z
z2x@92ziCeH-sUfxDeTqu3=s5V2}i~Bt4)sVK(^}L$#?1NG4fZ%EpPRF32O**Ya$q9
zuCZ<;ssAOI`Ja`N{#Vrb_S!Y0DyLbY!uMBh?JjF|b8Q4o%uyG)mpqwcmN<j^__hlG
zq!-nm%byL#9fG+SdD<ir&lH02lN_w{?P)rc)OYv`)Pd38P5Q$i%B!x0HUknIT^P5s
zjDn!dN;rrGh3o!>$;HomWx|~CQgSyJ?6)391kF*eEI%#LE^cCO^*c4(VSnYp*5^=0
z2XrL^0rPHqB-$~8LrmGY_`R?SX}z=9)HU)@N{tz)rVW((d|WH<>*&wf-~>MsknN82
zdyt%zC&iX)LVB7ed77_n_nn&Aj$j$3W;#dbepNOn`JH?<T7JyHo!6<jRjcF~{?sWR
zSzh)A7A0Nfva|YFqOrl-@K141Dg+@0F_Er3?=yP^Oz+uCW|v*x&hyh4MppXOBF7zy
z<y}U&)%Jy(S5w=AdQFxVq^i&t^BhJFtJv@>=TofOGU4VA=kmxmuk7o7_gZ9HuXmWJ
z0mFVJJ|EAf6%MIgxD(6Bh5G=hvfWVaPwbZ&)sws0Ib+85Vdh&^1S{#{(Mb6WaUg$X
zYZrS78t^)LU>`Hk_D?_~#n2~%8Mb{Ai(h-zo5Z)@?kV`ZMD8hI(oA~uMo}i&+i|qV
z`)SBtOcZa1xa-?;1*0Uf>+&DuN;G|5igTi#LH_!cHhsI}=#lVY!QgBaNgUdz;B$_}
zUZ%9`S^Qr!p1UrRW|2U!)n;^EHY9Mw#T<L?ZhhG`^Ial~O#1ID-wKN_391|4YiQTg
z<m)Uei;)v7o5E)VYxo=OHPTKoH*72ZT)f@VVN(CNDoBcb@jYRC+pA$b=V7&@XqJ!$
z&hWCi#iK`yAL8sg?v@0rv&BZdP=4kQj=w*=VDsK@sXuMNK>#&3taZ^UB(b_)3}OCW
zNHfBPJ-+~bxqjaLy^j>umf<>B_EWWm83pRH82)y3Ts$wqD+j;snX;0rzoT9?V}Qc+
zLSKRkLx+~G{9DIzhUvhmB#BxZR;blGl(E?_1`6r1nS>1{5H=KTA6Wi?1A4^!Nq)pd
zP821Dx8|KnN#RSfO}P}Nknmu^AM)iwzC%CvO6ZO<x%a}@Ym#2Yh)zh`4r$_h>@C-X
za&@CY?st0+efrv_$`|-nLfi%~xi#+I4LU>(r77=g*<40~+jpmzHjLHAlUJVrRlmSP
zu6kPv&c_$|wl&2A+%}ExqSK5@l+kVjw@B6NH!evocWOzRH>7i2=?xOZ_0DrXy$OGl
z)4pvk@WPy*)CHZfiW`b;o`?0ZjxbSu|A&h5|1tyrRert}&2nH7vLug)L9U8TqXW-p
zvvXd8gIf8nGUtI&GMp%c2q#J|EM%|*mL&ffwxW?~6&dWgrMwtn%X=a{Cd;-Dz9{8t
z=)vF`PcJ9%7MjRE;Y&gFb}rysxJp;GSTmUVe0Q>$Y|OWu_oS)7frCDahk@Ed7h+rC
zQ!qjumW~p3m@LP3Y*mjecKlzQeRoh(UDvNtMJWOndQ?CZq=QID>AeX^@4a_v2}J>=
zNtYU=_bwd*BE3oPy$3?*frNw`eBST=b!YDPyfbI`BXgKJ`<%7+UTgizRxzh$<5AB$
zig*>{X}H+qR+Z$-)B8Jq1hZV)fmCHx>KRIiR2|5%@c+7f5_LzmZrS%l6;msY1fV$?
z_Q+sgy&jS^ulePirE#BfA|IpK&Yka!itF`=_qKXAxEpRX^@6uAPejg=k@Gb0&$YsH
zhW0b`%YGM2od||DgbUg><1B1JAL|4nTJC3nSZhAe4N{f)7<thkupYX3YPAt*G~5at
zGRYS*nD~shs(ES2eOCa84+1-EEQ#Kx471i3Rr-c`X%JN>tQCZIraUjmk2qmtlIqL|
zIafsS2fv#fo$;J*6z^`LgS*YK!|K@Q99z)AFnw(6Yl09Oq7l-4EmCI3RD8{32cgKI
zMOl+)p<N7DnzAOc(53h6q)y@IyUXd*=Ykcd`fbTncst9d&TYvr`8WJhkluHoIDc0J
zHM|6lH_Q6F%K-h0ORJUmuUs3mU-_5_-MF4{*b>&_&fP};|G<a;N2uInZ(mAqow`|A
zvK7Q^h+a-?5{$&gn#Ml-U?i?{{1lA5ipFN<SpibztOwpmS$}jVGYl<taI}e?w2F%e
zyJ$?*-!yQCVHNFPhFNtSLVK0Ls>RSrz&)hq1`84!!5H%0hyUF__jsO>u^slQI2Syd
zcuzCf3$H4dUFv~r=hFIo5wK5*?+p>LA#-BlLkD60Jh}?<QV@2$=hcr;Y4fIm*h;r%
z8>v^6qebI^QsUVF!)Cxy>nAv~Kj*5SuD-77yn=X9$%Gb^)icqz3#@tJ-v9GD{T=qk
z(U|hZm<yxS3wWMWcR}|7?B(1_-<`=BU)EnyXML(MSGnl#9j5)F64>nbk2syT8t3{j
zK2jFzZ{Ju?>TQWVodRR<I6>e|hcfo(o8hlENJg{@j8^REoR%aZ*e0K$BQVm}8cXen
zCaFu58kEBGOOuqL1|EfUayq7$aIPS`!!!Q;B_>Ny%6%HXHKm!<i=1E{BG%uB|FAKB
zbQ`G?agj`Yk^5}o*+{<)t)JoI;}V8}9NAwlIiO0wwMD)B7hTdBePRAK04Iy;<9nX@
z*ymhZ1=O<5X^HHAZR$e&vVk;~?7zz>5}yD-N6tX-oaIsYj`#F3yy4)eH5@K|T=C*u
z+>R9#E>a^Rwny369ad6pe9UazrgPM)u={o+<z@>b3CLO;J<#hsNWhF@Y(PhKklX>C
za)UD|m6Bc|&m_TcJ%&AB$+Hhm<WC?wUeeeo!p1h>luXpkU^iH3TuiS=>}Cd!AF$)p
ziq8S2@$(2gM^4F*vLaU@Uee89!wg^I=LC$l*%<fJLNj-<h2hj8*&IEroPS^C<&(eb
zwdRr<LJ9jFes_x7=+u^coJrK+ntKc@c?cVrgL141*ga!BxPjOnru4WSS+Q%9`+OsW
zb)ch2k+?T8bAA;BRD|R$*NH+l{d`X&$tQTB)MurpqB-C{syi$sD57cI@|sZ|UUl&z
zu%o)TZGG*0olU(#SR<)BeG*97X#=u7X1v4M1o`9CaNxeUJ%SSW)ntM%My>vF?Id$h
zrK+u`iGeLH1|bm5cBzYJ!&&=Slp+D!oyZa`ocwXLS6e))ff?6;)p|f?GNl7gBr|eV
zSov*4Gych`=R?HDqHTL%9nnPt{;GU;)J6)eCwTKhtI$Efcj7<5eETd=Qsh1KXH0g>
z)AOe6gDePBKE%a{!rf>`;L+_l7FZ4blrHaKQ5CsSRBKFZ&RWLc6_ZtaxSeQrDt7AB
z66*fEpnd6R7m($oUSFs`!47@Bym#q76m>#tYJh0G8B)`TC-|mVFGu}FI9IwyZzF}#
z85rRDg)nFdJK`%JusD4A&R$#Ek-YSSV<j9WiGO_&skGnqx3eIKrhQ5gNj@x~@`)Fg
z0vVM66+lh|=%Lrjgit2WI3aoL>zS&E-;fl8?FwxDedB*0k7oMkd2RV<=3c#ZIqIM1
zF8IGUwub-n_y!2)Po6_V7ffPgea8<^!nGLon(V?iht?H<*jGgcD-djwy8dxZg;xkT
z8YOd!BGZ9B@{DMbUd(UPFs3|eP4<#+R+4Jo@S|K#yIA^-cwVl0qzmrl7c*#da$Q_&
z>hg?0Dg-G12A9|**A7V4Dz*t6weHd^r46<h^xolocv&=D)o*U-T*xqB$=|3aP_5>w
zZhd?vlfZ_ZwqhGOvI}g@YSwdv*j~s}=Q1yuo?dr%bWY>h#EC8#C=YS)f#iaYT2sY!
z4!4UxmQ@_tC1am0`{uiGUNr`aKW17Q!9P_*GNXBpuHxWB{?1!|yvu3pKgD`V4F59{
zJLLdZZ0G%sP^Nq!p4`8^o^%j>2vYTu3GcmAid~AI@iW4kmzFt=?ymm&98pN}nVgjN
z+K{`dAeSj8B$AzfGHf_QxKEJTE<bN?(O7H*Ma#GGmI3MfV3gq|@(==pdh-AZ&qZfP
z4u3JvuR@7$grq^a*h*4=7|?hidp)ECCH4#z8g~<t1Z9hlf+>2yH(xv^DK<z*IU`?%
zC0b=1TXnMU#{BceE7HDv5t_$%)G1s07YhP@*KZFC2dR+Yr!cd4OH8LVJ;_njldP{!
z|1Sm}M1<|j7ln^Vi5tfas#vRld3i;s9fUo00v{O5UikNooiQ=7c=N@EbtW?h9<jc2
z13B*SlpDD6zO@7ul=wi%SHJJ9TV9vS8Mr+mM6#WI{r5@TKYf-wTt|*|%|kPGRuvH2
zTP2;Lz=B$pms{FiQA8ZgO!{loXHmBbN$KNE@WiRle7@Zx`nOjtI}R4N95xC)r%H#%
zN%uu2e05!H<Q(3V`J<tGseAJBW!&P+R(BQ;F67jw^{*Bm?;14hSVTZqA=JCJMLZ&3
z!fVN_Ma~;C-~u0gvRZJo;`mBrImP3CD(SKhv-mR<sAS?go#)7gCU!-fNTPB<dU$l8
z9I=$WxXyKg>Ftk~vMqC)Ewg?s<4(#r(V{nX(=l*&1{b@HKE<Q+%Mvqq98kF!z0kEZ
z2o|^Xp6)uJ6E8T>L=>SWjG=H(Lr}wkK3=-#-zkp~ftE|wN&FGNaK8=WaO2&5gZU$a
z4!KzkLITZu{Nby9s=@(qTWpENF&R3T#lkqQX{W#=<gKD9v{-ub`QBTDVv@8Ju<zMm
z@W>KFg>Ka1twiimNH@T&KI2eEVD>EIN<>csCl;j;w6B_W@;l}oh@Ix;P_?syhrBWJ
z#o62}h@G;gB0x007Iv^=$=1I2KC?a6yg=RO2ju~k58GJIQdh(f^Zgg%Un{OX?r7cq
zK5t>=F(h;SHei&I*VQ4b(cD~=;>qp*?PU{zCqfNoniz?6QT%=Kh0=QPm2%NbF(O~+
z#Iw>7Fj=Z&zT6WnXCh$JmTMU2Gc|kZTPO`7c`mKBV?N%G{HASWS5_obAPrMjxUaz7
z<Y-A>N~i$R=dnUn^$JPCJg>-Kd|Ub5$68{|X%W@wG3VXoXS>EfM<MT558tJ~;WKX`
z6#Ec#HgB)wmScUdK8Wad8TGpDq|f=OKqM#T?BSJLf#Y?ZW3lG&4A>OYAU0hNm^Mq!
z#MA*6<*6Vn#&ZH_Ue_s8BqKT&BL~X;-x6yi#)DqR9u>*pBn-dTR`kjz?HyEdK0fzi
zm3VsW;NYiYNZ+2wrt?RXjgs21{HeR5RQ|J5>agra?;aL5jSY$NPDJ$xmgzF@)m`uu
z@x!M3&?<)ArHx>c|81`Khzu5>D!3C(lzjBk<9^9@YtTA@`?bvj4yrV+ltfbJ0DR5>
zkFi<;-ouv&n*B?mnfLlWQk%(e)7kDt6>na2>$fj7be#3UgU8Ih4kEh3{ue?2Vg)LH
zeA^kD?1xu_5BATfM$?4;X_$hN98^~iEj?7=pC%@H<x;|j`H%MU6rUR0F_3a|BlNFF
zcn{7EQ5&!P1CVKm>tgN=fM!3|x{yZZ3af0<T-wkL*)9+In`t@!L<aTWeLwv?$FJfQ
z6D@fH)TaN6fK-S&o<~+Rcr)IqXkfcvI-Rv5lylw6!ZY^LNdYxh&~QA73vN<a8P_24
zSNMkMBEI?CxMc>9f*Dmli-W;kGayzoJ=4w=?P*}zw<>+#4=3JTIbM6X%2r*gk&pt4
zWQN=6F8DxlwHTI!YrYV1l(Y4r9s9LS*|tVKh2G=c<g)!_Y%)l=EWAJYau|*lSo6C#
z9T0zOd3%0p#Qr9Wmw$E@kfQg!5HLY@0*^2Vk=sXT-)#S%Z(+CX$$XCp5Fl=5@9s8B
z)ppoFDS$tmJi`gT*Cue-_oz)u2%mE*yY#9w1y;1DoUuOk(|N>@t48b$I!n^6?K>n$
z+QK#;39IF4FGPBap7H^YL!6*&BLqQz)cd}lrlxTBiJz0dqGAbB{o*2be_-hv$v%A6
zOv{LzjDPu3Z$<OjsWI|CHY(mCr(ZXdOC9y+z2HU|?SE#8V357ul9$R@4J%e%smVaa
z^4bwIC4D9QH;c6d<;`BqN+EE2B(b{7&{Mg6@YDiZK=+V;i&TBgd=g(3Wi&NJ?G*Y$
z=HyM30Khn;B5K%kC=fnR^C@zqk@E0(pIm+ZUPg(O<r{p_CePSou6|O$Z&RYfyNX>(
z*X&fOY_kP4Xn&NzRV1qOHr*0}q<>gjG3iyWms_jL{0dMG{)E~t{rp#<m}b;Be}rcf
zbxOuh<T33=P-@McDLq7i{8ZlQgAx%n=IJ~U*j8!ydFggifID$mN%2ObSZ;xL5X76*
ztvc#R-pBD)B7gE~v&a2C?N(gIXr`0lqVLz<xc7@mI+MrnQ>b5ROL-hVW5vDwM0$%+
za%*9?eo|$2HllYh4#>>%RLu)7PgW&I=)pU;WCvn2=GIBmB`wHTbX{P5({FQBgHG^_
z-Og1D=|evGQ0onF?f!X^HWe=camv?Z5E8cppbpKcdp{3#diC{Dq>SY*K%JGk_{pLo
zq=?K31tcAVZA+gsx|Gvx77S-Y=k4$!i4;^qAlGG7-|4xBdy$WeT~`jDCV)wB!~oS!
zNK!Ya-LOFmZ=*dtG3wp!_re;G<7^Stwt_{b6YGiiBb`jjVIGx$O!}pclfu&S&lQUK
zGvO9I;~(*c6Bxh8*$$~5z9QWh{(3BNpNFKE`Y?d_s$3Kfy^IngRMTelde7mNz~tqj
zsdIWTPbSLKGE(1di5en0qNOH{8~fDv<P`oRYW~E4+BwC7Vs9<^$Uu7Mmu<p<Xs|++
zIFt1g?_R{HWO<1z4e)*&jYMCnPSv`8=bLJ7&jZPZRz-?;nO>G_70(%K{PGho<<~7P
z)?JSx#C5&|$USdx;R^2`w{~qgRji`+DW}6?l@Tf4ug917PCH=`8p4t8t8e#UfnE~g
z|B8F^7ZH-Xh*T};FCNUwjpVSUfIsaZbA9vf2bbM2;i!Dw=pNRTj5_sQk62d=zy46>
z;@Kbb9RzCnaF~Iy@W*3@L}G4SM&92E@L!Z{_1_WO%8g_{VwO9ttxP_@egk57bUpsj
z!gHdW|FFt!ME1o(<>K9@<At=SKGmUjnHhbBZV3Gkb+!;sS?HZtAX6NkN%S_tbo5sg
z*Dt<EbLg5DRV?$DRFys|9bNOmMg;dDq@dn2<Vx4DiKJvY@r`FX&bs6@mVyPyU#nA`
zSF3aiE0DWhqrJTIHJ@r0{BEYoiu^TzSAmgd-=MsG&wa|QBH=<-rQPs{;mmO(eWk^M
z6GJOkz|lGtYrs^D+9g9vn-!%3=dMmp07KxVH19V`L2IbC=z2WfFXCYmg+B=b<Bv7M
zR{FZe{}`KrCdgTrqbAvwd2!n&_|fTtOaRqks*rG}w0gP=3(6@7L>97mDdI84_|as7
zovTTo<?!Y7u))JOUp?_Feqdk8-@TllBxuacTIG0S&Z2RPE?L!NF<oa!=wRVPo+TLa
z`Byy&s;_;=FU({+tQk6!4$8&*sZ4EkK44oDL^hcRHd|~eQ>VTRi|QP-^=2H%Ohz6I
zCHQTN``6o#Z@Ej({4|Zd$n!snX`cX0tz^7Vk{$U-Lm5UzbN@G?DreU@0Zf{NRkE(m
zz{b(h)|eGlO(jk1Jz<(-_hwscU5yWM@Vv?mdW`!o*2RT(ycX=TsQCql;!<?#tQVzs
zhyureWiE~%E+ouS(+hj4iQ0_1zww_PWKDb)q}A#tzavkH0<DDn`~X?J)85yvL<H=;
zTz~#*&H}%9W9UP8-*R&0GsgAs06YanrWK1cq#ZaucD#T#8sLuWbCqMk)*w$oJQ0rh
z6pabPGfsTth`efDfp}2#{0uB6a!)o_0(_y97s8%~D;@*$N{M%sv4hVYmeSWU6O}v{
z4V}$lYM0Lhyg7uAZNsckm{HzJleJrWx)gs-KH;4<$P&0+*}mYcaKRNrM)n+|a6X)7
zYc01<qZ5QJNv&cAlkOp>%w{Q+cnEQ|WQyD0mcII!qhb;XQRT#o$?(9fXo`NjI_598
z1lTJS{FFH2<O03CsyEwkq@F?bIc?K~E`)W7QwP^h@Ue6z79Xru;D9yqCWyWk346Ey
z!?dP~qB>zo$<`irM;*iun%H*Gycc$qBY2ep-y}aVtkVpRT;dOo+-KyM#PL1#l~g-i
z!`*pG-I`4(Hn|d#$X2<yP^?_dy@<NAwY{BsPW9$EcH-xj#i;{Ps78>642V+><T#ai
zndC$_!+MU1wJ)$5(WqHfEqQlYul<N|J+&s$)O;VY;mlk)e3yW4KEy%|%KFw*&rkEQ
z-2KeuJHN2b)sOV+sX@M5zuFe~$p(_6>x03A+l003dke*(U=K?1m)=)W4o;H>#7YrB
zh(7Oeykkk|Xx~Zk_36_`ty=`h%P``emEp;m%S&JnC&9A#J+g&N5@TN>e;JwAo_xW{
z<tz*+zB!YCn5DQdblSb4pA}nEIrL+sKM@SbRet1C^cRd2NTY;&*?p~y@T*4)xbwUS
zi}Y+dV$q(z4RK%JtV|{GT)-GvqJWEGK7$&zcMj7bo9Nxy#`ew|j|s|AFf}r4&>p;J
z87%0OEenrw>VD+mDpEYGr|XAAB=&xNPOo)wHqN=i%NQsf%zl@7=2@#R*%tep1;Lw(
zP-W@S&Q1|_=xr96Am`pU50sJ}USmr%54*>AnQlpW5xdXxicR~;xeQPcIaP%S95bYb
z^oer?hX+<K>Z>)_CTr=Bykfkqc*11T=TFKsFgg&oxr60c{Rl2-icYGE^b8I=6%)R#
zI|e<9G46npsiwmArd<WY*RNaeL9Wi8DjA93;zsSuCT~Kr@Hp9PaRMjM-RCyderW-C
z>eX&9zYf_>2g^rlJoLzQQl|eT3(g1)O3@JXz;WjAe`uT*B(>xl#;mr@EUd;N8yvAk
z+abNB&N%<QOrk2q@b33lLHs@>${-5>6R%Fk)zOaWDMYXCNdGi6Uf1@9P7~0O_ICg9
zVDSzTm2EuYkUPK5&-0i){*~;ONG@s5+T#QF8nFy-UFt=8A<IYkG5hxCA})4-B_BV+
zP?fYG;e9dLd;Uly?BT}~_kp?qiUqAV<_+<>a$rr>mG~n($8@{QLBat5(mm4NXPlvP
zW3_c?4Hw+PJX`cWD`{p@uZpc|4@uTnUMp42HhZ2X=zy~&{st!{R6M<+J=)vSUTQY@
zkfoC(t-Qmk%F}*NkZ6O3pCm?w#%#{E&<$W@T&KP+E_<O5G{Ku_^s+pCPEBbw((&EE
z9LPjFq0hOJQSnNJl`+Y-g5I9V#13CU$xo^KbaTYq#yY2sZVZA8SG+&NB6I({lRHHV
z%lgZz9$w$6cYT$Xd&z^lLRHrqH9>D*d_Zye^7Zz#q=5caCqU|cB@Xz#l+FhAF)j3)
z5>r%b`9XwM1@&fFOhSrbTU(GScQ<|6wI#%}u56$YVO@=H0NAatc(0eu!zzE+6Co}g
z9Xr}p4#4u8!A7;bVwbY!m%ji{$HOc625_AMLyfVY>D!<*v=K_zA>dJqcQU01y9`y1
zmnebzZNcvKt(_{m?}<K4H;sZ<;<2|{5VCJZ(uHC2^s72a4?n8$yjvVy99DZWLPD1m
zsp{qR<oZS51)pu;>@sebefqw5<9KG*{;JF;P0=f+lTo`qe-DELHy)xQ*A#2VE7tE)
zmi~7Ezo3n@gH2nngW15}9Mrz1Wghi16zHnX=`#ksw{nR$;EW^I5UU3v8x{t2oP07w
zReoY{;~Z^ae5Z0#Z){Vlo}`q2-P-Ed#?pobf=9|d<19-idJ{G>!2OG97K-oK+&|<y
z;5S^s-C=SYJLqxTxNb$S3gQ0iuA-Q7#>$VgQWhz(E!yb78RZ~H0jrg933;8|e#xqB
zdC;&)-vs}7_@nXt`VTnMr4mn{To*A@EiXIixQ0`S7XxE_6a|DkfCI@(Y$>S=K3YKY
zbV;+YllNPdFEHdnNbqo7{9(eL7ykDS<@!eS*gU-`O0W+&SyV1AGZ-@p?(E`JRLda0
zU~#v$`Wgoei~bUI{i|A&G0<f;=G(y`_x^kQHD+^Y@HTgLn7ugZHPyPckKy$wEX04U
zmu1X3QM`nAK$<Xn?-7hA+DjhgKJ7RMZgrA9l7v#8eZh=+TxTu+ao!P7M$on;AGS)N
z1MZ^3Fgd4Bj?)YG?6c1mkIb(xjNTdMm9t_YZcVHNVj?Vm4;LK@l!VweEf=1JVd4+5
z7Z&%nED=tr>t^sh{PW4$f~_%An-w7XhKVOFI@7jC-0KmR0azlcGN42m>nV>Fom45|
zSlrDhJ4-S-{>G>3Q&>xNG6mzRNC|p@e(&?}wPIZ{y;TxZ{nwhV3_qewu@d%++!lvz
zg4wUIZvoZ>2Tk5MGRuOuM0qB8Yh@y1&MYXZ4<@?dc&RgvHlC{^$yt@$Dl)9=q{)qU
zpYW7JXTARt^GBD5>nsvNnFbQ)p8X-_NX@Q(OP!}qstRB#v<ymnIM5>O@nCPO)ynep
z3peP81PSX1ep$C>Am#k))nsAD8iLQ2j*HJ6sx)v-t7o(`9re|HEsflIz>z<4fPtOW
ziN-&5c_iwH6H4_dwsQc;beTDufRhce9#RLl{XRSNMGr00z3-Nko^zAJCLl4)mxb##
zPYAV~rIQcUrcC4e^TrwEyf)X&3W|9Ls**S=zgS^uaxxR+q|?fD>%f&LP}6gz%Gnuw
z=G$bb>uLB%FQtt+C)08Wn4ZbZ?woY7SH|t%1!EA8{Wpz7si!L>{%+5v_JtWCB?QkZ
zdX7*<)vN|B58lZn^Uad7>z-vvkNi-h;@=M0Nq|a@FjSvu<@Dq@awiMn3>bfZl47^P
z1x-c|&ngUiZ+E_E0(~2|79EdnjGBqjdJb5B#Qx_U{xIJkFmBvitJc;;{d~}^D=U_X
z^*C~oIzSI><vDL*XWu>};$vM)Je()`*Cb^bF@G_UPg^E+U*Cj9l1{HS$iA!$gWaeE
z`Dwiuc?m9aLZ7mA4cnL-Oyh*5vrmYuk9Sw#=)CV{DdTuRo1@$eoOtr!<y5^N_LvLm
z@Y*B54DxGbO&xR~tx7Gp+d`2?6|`_3CA*9EMy@m(!y$Mx4-^8U7O$a<#-=BJX-8+=
zjLn+0ourvnyjqPZ@y~EPMMmPippnaV^U17>i9P_)Z6BrmlFR4-&|o`Dj=_M#W`?t9
zyVBgFOiKRD?)bfW=X!`XXVm$7g4}Robtr*jOH-NfTYtUA9+1d+j<x?-a6+WDT)<*m
zMx^T2$=T(^c2BQKcFmtTC7}r8k?TenC69Lr6R&P6HaNn!Eq?d64?eud{YLVHEJuCh
z<3)yu-mDmL8XxIg9-4Ol5$UmwWpl3R7{gHH-Ba24TQ^8q9LA*i;k016yLPt%^p&Uf
z9hZz%q4BsqV%W>7{V#iM(t%znAH4c5SNvTT)uDq3F6i3<Xi)VlH%Hy_4f#xi`h+H?
z-%Xp?z-Uh50<)IbsTopA6yq^_swBe-)?BcCtKZB-<^6+lvf2Vf{<iz-jkG68t=5jC
zpNThA;~a;W!tct-9ABbmj=%JO;*+a;;727Yq(`!Mn?>a?=0ph_6J!Uj{d+(cTp%<_
z+NdbrH2;|GmEL)D2DRLQ3Vn1J=R#O%_}4Q;BY|-Xgc^defDFB>NRJ|XED|bw<>gDy
z{;}v_Cdzm2LTlw~|NGoY&*11<*+#lr?1!&d(utI=(50?0862;*ZP@d(eRJ%?4ZIu$
zHscG+$%`u5PoGo;iT#Fx{?qo;)1>aDAG_DK!F3MI+n0i4mF>0Kr!fZ?XC)F_8JbmB
z7}KSQV`Z?Wa}wjriEe5^Riry~f_HB5gyHV%59U#&`URA3KYpB_3L#q?5#mv^-U?aS
z+u>d8Q=TPm4v)^J-BCFs^e!s_L^4;ud)Js{p-)6EYL0f2wWCHbFk`jqg6<}cd4s7w
zDyzgp)&Fht_@>PqBy+Rzr-w^j4#@;K_k8esC}R|}jxaf-=<grNmJB1^@zvaxAuigj
z_xC%%DK}^gHfpW@W@nXX7Z@UH6cAA!nkfW4px8hp7SepVx<~i&ZAZlXAgi`XxP`x4
zgMEtaKNZRBa2W>E(DAr^#jn83V}$Qh#(AU?uQpokf~VT4kzUa7z2Ejx$J%xkTHhIt
z&apD-$i1y+k!kT;@c5=s@&fNA>7&VVjyK5n(fhna$hmcbxAKpQy5dOK1}bX`Q$D>1
zZTM@^LMSgRlEcVM&lX7DIGz5wb65YIQJ6PT>%grtMD2b43u@5pFn={Om_B@szT982
z`(pN9EZl-)47GmD3mRA76VD!2<rn)<{mZPlo22j7X>I>4JmL%<T(U^ITVR;?!IU-Y
z$L^27Tb?{(f+;oGh!J{FHJ-O}`>HZrSN}lXUa~+mY8S-3>R`1|q-8uZxG}WAwE07$
zG!qfpCp5;eu#Hs|xJB7;uUf>gR64WWHA1~F|01dq3)_)Fif;BZOrm}Lv>&lJ`ytU`
z5z{No!p*vv^ldEbo1D1lB-~P5z1;r%$9#SKQ6HUZg75CZ3F%|VD>OGxXx~Cvs=c*W
zb-(v3AA&SSe?_NSQld~_k3Nq+f=8ytb5}3KmX3~q$1X5c#CF4M1Z;W(n9=Cx5d~C5
z<)C-r)U||jxUh}@xRWbrr3rrN^U?{fW3atxo&9Ex`!bFbrkF(NW4yA=8P0jwT4dCk
zm+?onkaB_u%5(#bdaSnyxc&z?#*kDVu=sbgRK2^pys-VmX^d6=P^W<Pj=6Y5sj0zn
z!d~s(?rr0r@<a4Y6nL&M4n-x-rqA^w42vZ$>!*GW#>SXjCg=~IpY8K_@~+uXThU+%
z-z4d=5|n+xyfrG1(sw$?aO>S<H#_S~@cdxxN6*D;=zK&Cr_K<93aFr*kF6{G`}`5_
zC1U(Xd5NL|@a}c%DlI&!Jrc$unMK<5FR8&BKQ7kF9v===L@EjQ_4dIcY8Bu1u_uON
zK-_eU*S=J~R8_B|1W(1J24>uWHv(20%Rd??kKcqR;yY(8*g)(v@oJ)yO<p5hwpG`e
zTIcJmUe?jo9MFn;3m&5yPFAP9#C>qWBT<}*CQCvB<C7r~kJm`q6O+XXhU;958~>;i
z`TGu$`p5aCZVbn73wBQhHQE*@`G_4J+$~+UwdDVrMBeXS<L}x-ws9kZT^<)ceze`}
zR3jL_v7}CpF#6kB((_`O9k|Qnr%P7jCF;ezDRj>nyjQVZ{byT+CINWW)V_qHQ5P^c
zG$c_e^kNp=WV(~#ZMt!&FY<bY_#5C~LBTZ2?X(w6<X|1<wULVesuP!I5|f{){=p^q
zA9Jh?rnv9C&;|4GjE{Eg=-i{zu_)!AylsF*EEa2cuvG!+N;sW&Ee4Fjs=;gf?z;44
z1SVU>6b>i{TWBjx(ebWG&%aX{sWm4ML%-2kFUQv_Y)`Qn5n$wXyi?${`bA5BpHq^F
zcN}+Tw4?XFDL@0FU3X7uw8wi(aW)@L&&C#i>KKa`o;%>>fNv*Uht0M9ckwJ}l;zOv
zrtItEHrPTzo#$PO?0w6J@`u*mU#URs3fdg+sst|_u1Z}<38+WKXyONj0dedzPW<!U
zFcn(JUH`a25vxW9kK7rmfXYj{S>)HW0NG4yCKsNVm8YftRw069R=4Js6+_uGj3xcg
z+*--*PjRYBl9d^d4R(Ah`sfqt!2LM3s926i>oR>?F>r9)E0EZtxi!0o`_J(H`??eM
zJ`GF9u5DU3z*j5c`fkP%UKHT&Z84(IYA`(7*wRd)bIE&p?JVP=wrFBde|ZHV>O)FO
z<cg?Z?$zPBz|k0Lss_!ojL);&zqeolSSb(7>{i9-B-ukKxPGeO<SPt?#vNr@JZR4G
z!)+S-hBk`5vZRkI+fIgeQ(_y4`T}*9e7I@*N3`gYN3=${4m04GY<%;<K|LMj_?aHI
zWTEqmLMMQRalJFkdi-U=&UxW}kL3?6%>_n(AEaBq=<pP7J+j*NHWssbraFzu`#PZm
zOCzya*Id?B0p_z)fqu`6O@!DapDJ1}Hj#Qgc5b#p9W*)a-I;z^&Zcm%-d6tSnqvMs
z;i=2tWy9D<@@l!hDB??5L^@zNX6FYIRq2I5@GI>8L;0v^3BuwzST-NbXR&z{rvH-u
zhMr=8z;;*`ox_@Tuvtcd(5hI*8{IE+YE&<)9~wS>*zO+HDgqMQsh!oYYqalIKX1g#
zYjMO6C2ljWJ82pxr8(lGh$|J1NG}zoWQrK0>dVe0Os|#dW|8yCT4PpJ&#s$<3gPiy
zyW+StvoL<p3R(tXImup`39#WU6QoNH`0Z@8V-dEtNL!T|G20w!qih{{>W@CS_ffMN
zbrBZTy#XMRRY5o%elD&=K<d_p$PhDp1g4m|u-I|+HeZ}DU(>B%>YXsknaeKS1%9Un
zJUwY5KK0v5zJ{WQeLw|l2AZP;6})Y8JUPuzi&5(9wPdjEh0YRsM_oN7K=f5sOuCPu
zOcu5P(X!X3bOd+zIw98rEvM&B1=Xp}@DpAx)2UaHjX%?Jsf*hQIm^1dc;5^bCPfmt
zKQ>bW2;Wj2dBB{P(%Egg70@}#{ysz;ZAu8dTy=6(x$S-Bv_h%&c}Nu!NbmK$VlbA%
z;k9(|(8eA5`A{Ewg~5@X_^{xV^-)Il@YeaIjy-^0o#O+Uxk3zG&WH~}{FCc4oXyJf
zfxeLsF8HPJJ};@XJ6s0sQyj@6RkQ56!!quArHW0I^C{l{RnReq51IpxwUFqINbbXX
z)y1OomA*OsF8HP|F<TaW#XaS@)QfF~pl>)MC$%fjbL2>qKi4Zck2G+OFW*Zk>SkG&
zlN@%G{3dYB85=*#MPEXC&Gf$p(6KpCI1`q?B}ksx4X>nv9F-2A!#w}8c8pF2Bv-jq
z6b|EK^IkGb2ZM#?JDz&!r1}bh-Uesdby}Sl8nrfcCNI2AwQ;yUee#u9$r$r0)JkSs
zyKY^X#Xbg9YN0?Q&`xP#ik~P)@GQ))eeqqz9@Xq4cH_F=8fXn`zglEV0_cl0+j13;
zT34`Xz0O%5K`HS1n`g2`32Q1^l1QZr1%lS=oxcz^S53006wJ2tr?GSncqA4&=?*e=
z3VXB{+kMu77)fmBGN*l8a^3t|B*go@Qi3+OcfY|P!>lxqw6xV$RS&%o(|m<vWu`Tr
znEY0*2QSYgt9T_=YzMNi5U37OW716cw39Znh{DjcV7_Er%K7DExMjDj+XiFYcl;lM
z)rwA6qX>E&tZI-DXLs=R!AYD?-yCMhL0k)`0(;OOV{w7qZNB5H>Safn)#n1=6&5!$
zYmO{N4Neh;lff?g?JSI&iQJg}iiLe64Q}V|cS;P;)TQOEkM=Ibd#t_G66W&}@t}km
z7*j|@*DT5T(b6_LDTpvxBtp1p7ic<?)1<yVe+NY`j_{d1P;JnHcS5CU_cCx3<&}pZ
zpI%S?WE&F0$#V*Q&T`nd58jIDFMt0eGXcN>)E(e?ty3LIz0M!a>R)+`&t5pxM0074
z+5cRvl@+U_ylt_ZcVgNoQPczM-4;6hVVH`ylRVrcgQZz%CO2~E3bmj82q-7}%hknl
z<&uy-TCdXKKm98vF=A10Pk|;ex4#Qm&|db=lWF`;@(poJK+HhLd)YRDx@LscaEW}@
z;!w#L=P>8C&Ygw!^F=EjG3rp7mJbot$2IvwG%4UQVQ(JX<iUGUSDkm#@Agjl$eh1e
z-<hnT)zD1+?zwqP)FQU6wa-s;sCa8QxQZhE!Fu7+y3-eH>vkggOS!t7c_;0|n8YX9
zuJtyFHvmi#9)bMz2IgJgcgh;avZTwSD|P=$SIW9%yW6j=-u`WSJddP)=9tkgwA=ji
zp>7?X<4|lCyR)P*q!q^*==5{7*`4O=0bq?}Y7F&CH^S?IbH`SO*OSDh_tUq(b6Mha
z6MyLqefTD5h_m%8{U&m#j|%-~{rg1-F}s9x9gr=dZ27@0(Rqyr2bN&xxK{=;Qj@oc
z2vVPRNcf^CuH7xj+GhNI%`J_*x~nLIg~j{^NhI8=`Fu*6mTSc>;B;Zl{>CY@wF|UN
zf9&`9M7V}c$^dWuj}8c~G<ckSNU!fa5J`zSUYlle*T#P`Kgtg3STg(5#_eJuFm=5q
zN*8lS?f8s3dKVGXxss`UKa1g8g1FxoyorX6Aj{@ucih5S$H(f8WP89i^1RHt8g8HS
z>(75=D@+w_sbXIjixbK`&pD1?3T&Qu`(4nRh5*I*yq)*(h4F8o0Hp1<aP1`*Tmkm^
zh)hMg%}Lfwvdh^?N}gVSq<aSi@BA%{k`a+0(~hiUTUWvA(J~!=u%r>1U1=(QTOP68
zz6f!+Zun3KnsD!=$9%*!LaJeBPo3zi1V^%{QmbL|U#py;nAU>g47LUj20w4u)RtSI
zg=CtkrKCH2jpbj~baHo%+uSC@arwx;+-hbGddm$FIByG`YYcT`yeL{bt#81}hlIR#
z0#!0JzNOAJ+=@_4e%J8gjMKQ$j6liK+FLqxLg3jll-`?`jcg*lyHSE=A>q+G&)%@o
zgA}=PXCr+x|J7T?!xK+Dy13$)n7j{y4^q4i<s#2R5+4?pC(a8azomHcj%odoi$s~v
zSq2~o?Oa-_Wwr#UMUfWz^X1YDaJ&jRok0h23fsvCeq27&Uhfp%gx5OF%BdFhVEsld
zw>kRZBoohyBn3{n&TVQ?l;!0T%uX^fX&TvLko*>$pjzTwW09D-)AF6At~ylsQQ<kw
z2wNnt<)qxm;SasF#cJOPXHMUh@sG1A9OBzNDv3Hd?$&)J9&g_a)Ws^VKAtt628NhH
zsCPz1&;36Q>-;$0w=__Gw5T928S{!UUQ6^!`6SZ0arC;sh6mE7v~e0a1&)|Ghq_a|
zxAKtT@h?k_Sg7^&s88$}pA)&fx|p*M@h9QsC!Jg6-=(?ySxr9<w1pf2$*fRSAYktG
zPxk8?ZEVtl<r7=hr*jTJo;EG-G=RLqQJ$1^vuCK!ciTc66f~%~W@ImEIFsO%wKDu6
zwGI1X5>^Hy^anPBIPEp5!3iA3#U!hPDRwOOnuJ7w3P+xwRI4SJzl=U-(I@9yt;Cb+
zjj)uf7M={{P^?U#PGm$p@4VxCJc}su@^J#;;pFLKG3#W($|9`2$*0Wn9tI~9@WM%|
zXH3nIE=qFLjByMX+*`sig$pll_jT9reEZ_#rRiy*-@O}Z3=a);+q3$S2scj7f7c&m
zF(DM|b6y*`PABHxVln5`_bhZ<kG7d!M3r0n3|&TCoX^w9O|eb}`Hu9_3uoI;5BKh5
z*Hvk(YfMtu`%~a7^!k`yv*UPfSDep)%rL2C+OE)BN<c0^V|A;kFYEnc!H7<j_j(4x
zTX=q18E7SV>|0E1wgFInY=*@pHvwgB)l=to%RS<=fs=53eQ~7Q2^V^4_0U@}-oae{
z&ih1DxO2VPz_#6hBvG^;TZg(;>GMm&k+YoEIpYD;V_2M5${TpVjaFkJ9R85KVy{>l
zDtsoI+BVK%^LTVWxXG0KMj5aJP$0Q5S~6N1xIqM=G@i=jHk?gc(P3Dzm-bXU;?d@^
z0ix*M1U@wQS(Zl!ddcW2N7>3>V?1kEhM@3-0#A$0+WcONUf-bwos3lhmeu(!ZcQ?o
zBjX#ZHG=?65Y2-MgP^$M(4Gvz<EO8{ZuXr5ODo>LN&TBTIto|8;^C9`mfKy=S~K03
zA`7^E<m!D7OvwKQmi|rR6^?uy`))D$wk-n*%yDK0MPnDX2?LTzn@4oW%xf*cRz-lu
zSL6y}*A$z}dT(9(6M`%@h^eFf4*EJPfnK*17Ep|_2}E55wrIh_Acyg~#hH9|>UFSQ
z_!VZ?(O1NER=;uUP8~*{NDKwNU(DG!Wd&5Yu@my?1@O|LYnV`Uu&DF+Uf-<2WURJB
z*+MukU`)&wOmw=mSc_0-BV?xHEJr=MUCw5p(@^eW_=7=%j06W3AexmiKJ1Jq><kAE
z9v!tN!pr=f9rt~gW>AG}6Az(xJ@ZKRq?>y$axYGla7ZW`Ug<9w5<RuB!dH~>6{-p3
z?|pR~`t2}2YTjS!vHWu+V&Ipe*E*l0O7)*SN&^p-7KMMoZ&zme8||t6*k~6$eu>0N
zo+mYR88T=uKj7U6-nw^)vGjej`&mXzp++tY6y^+t5fjqTXVdsl?z0Qu7TNJ(8|&%L
z;R~Zq1WnuYVQc7~vRSDB_V}vrgyj(ij~hAM409PYV=8(^Olx`PX3r{lZ|=(XT(<vy
zB!Bs2<iB9!JBCVVTpTBssN@%fo*%sLwA&F&awk(exDB;Z%Mt$r*daR&t7`(*O#(H&
zi<&14p&Vxe&m=^18D2}1?FyXIhTOt>gp58|%xe8(WW(u*XifVc`rWF~uxI+-$9cn^
zG$`bM1P06R7i~fiyzB84e*X<GeUA9H@Ve%Ht7t{PTHFR`YAG2?d|7U+vu@cq$C!W>
z!IUrm5r2hqBgOg|#&uT3zRQSJCn-Ysd2%%B=i;1>S|i|w1h>nLhx8%6Wj+gq!V~mR
zQqN?hJlY{bTwv76w%&2n>2j$H!O`Z8y?IaPWQr5JMhlb+8+bPy)aH4HVOL_SqyIwq
z@W<*7wgtG4kvW(wK<AfwOF3B-`n3M=eT6u9NY|I>-z&SUm~w7v{oOv7V-&O_ehN@0
z@vJ>WmZs)$s3&86l&o)FzUTBAAy#WxCA!Nv9grq*52EV2xY5+-8Nc`ZED>o(Ay;|!
z`TwI`NL1T<#49FfHbVB_gv;l^jH5nuRD8*p`?>(Kb^F6+Re1>#I|%CHhC-}2S4>-S
zQ#DqG6z~VD@${T#M27tot4|WEopKk1mkGnMf~oEi!c))<T)5Hg$N6J<9KMSX$Xq^Y
zje!UF!<$`~{r*RaV%$n7m05J7tCK{H6C(N1slY|dm0sDhKsktaT~nV(-CX>?&^FNF
zcy+U!Ek@m{DVG8|?+3)5T^LG7%WNx%ZJ0|>jfoNCoDyOsLmlCK_0d!3VN$!Y_U<bu
zMT!%7zekz>vX!aCK^skAD!B24Ae7FN1BkW3$Oer<46fI(3YFz25{9`P8jlSPbFtHB
zu15TyJ_i^s3Ik=BceCW3iNyaKi0vONzm^(DrJKc`%<m_{cwXolQFL+v8?~b=ZV9hW
z)k^@ArBHG`DWPo2_4wr4#)7a~h)WEu6H#G2PRDX-x%+~=B!sg7|H{7M|K7YJGad9g
z<7hVr*Scz#Z1Y78ZU)U=fxXeLFhWc+;1bu_X-7NhzZek{*KKTrX;OA}9$vg}%K9`&
zTk6Ax5vZzM;C+SVK-8d$G#E2GcxZ7d%r8i!liT@YK&E1kp)Fc|=ZSgKgS!4GVl_of
zOxsRMtl9EHHCpj&oq$)X!Q~Ya7VY0#AZD2THv+4sVfJS+zds-v%lk$8uOpXdDx>W)
zbfyZNGz8WQ(y$s+9sP6c#xi=%@Cm34aT)+Bqw>&Wz{@3j8$a6r@d9{k9}t682ftm+
za#9m0B)e*C?@ediyL~NIO^*(Eg^f#PNPhWGkfF0XHMlLw5tfO%criR}^j6P}5U*2b
z0)q1zS_<`$-woV8*p2uh+RRtX;QZ|0G%Eg)1<29e1OeNay0riEtxE{=j;+y=X?$kv
zro5$#9qX`)1|mBHZF_csp?cn->S%hkkjBdmi#z${^8@GtxA<RJR{lR!qXr=Q8(li7
zHUT%}f)?vASP|l2KV2)O>S>nqo>pe7VEXxHc32I}Fhd{fuUy!K6Q-)2Rh>^6N(#Z>
zWuNmM;Coao5)K2sApwoRpKSZpKPmYvL|rTvbdBi*CVUR$Gp4C-LcF_%pGjNY`?-9$
z6Y{1F{-S>*T`Ftu{su{(Q^Q^O|6UaFpZ6q(Bfol>Sdu9kQ6aOxx_?>ztR{Q^4Axk&
zIbe<1y46<HG*b$LnZ@d)fC(%-f7w&IkA5VTFC@Xc??t1{?FW6g;SCrYiyJyeKp;4f
zi`?!O*VBFG@88m_V2QNWK+p5%727@?V`VQsAc|&tVsDI%%64rO0^DN;!_Ti<)^%RY
zwaDHc8^+~=>=f)|7=RaleiOwfGgI%NElet~#+)&Jz#!^pQrh$i15&)$f|Fr}C9Rbh
z&qKmFHndhPSE`X8I;Kg+&^a>0W$^?_f>kn3ALU;eNc+h%`K|ty!2vtrJqFuF^Ivjr
zTp`zg&S3Y0|LEc9SB2cz_wK+79B0Y?=f`@`q7x-GSWL*}ku;dWc{GdVp-+6$!tIX3
zhl9<+gyw`xr5pk-q}d<)G!p#h+a2|)$T#@ZgVX;<^YBW2x^|vo&3vU-_Qgk6zk#!=
zV>XeheR^w$lmLP!CmQ(C$<yru$K(%`8@pac?1lY#i$%T&q6Z}Z5#f`Mkl-;>>X5v%
z708jz=L8xy(n+1w^WXV2{-+a64%w~^OPUufX}_d-KaCf=Buab4*LZGnm+s%tL8U0L
zl`obd<Tm-$Luv2?7rrlf=`#ypj}C)Gkfr4>&B>9z^*=n-aDYr)km{zyj~zzgiM5vE
zi|JB>DI)y1u=<9dGqRTl$}biyEd7uXsO=TN!QgAbFy<Y`gw!C9FWgN@=d_LxbsX@*
zHbIpZevK!6)UQ1AA;&w5Zj2OlmPlPzUC30LE`;Z>=GSK`CVh0*x*+@H@{~i*(6^)@
z+0R<#m3Bjz+8q)6T4D=|@OlHBBfVPmqv~m|&NLAlV>8@Z>vDk!UF7Zmy_Z$cc^)ni
z_-J=ebDO*3f=eSl-sPpkcjEy-F>IRYa3!g<Rz@_d^z=zF2W}tqV1@h2&iu>IsJU<c
zB3#8}Pd2;BlSGf)2o}w(JQ~S)#psusw5tuY?tHOOGCUNKxln#JeI4^6NY#lY_=Rrc
zgRV`tF3up;d!_9x^(~uXjjz8&$wq9Mn9#*5{xqmCuYVul0Pxyx3?E$&P3bVJf;;%i
zKdZS>A4Mw=R8N-@TbMKB&NhS-TPXK*(fo_t!$p!@?rs>?3hNV}9=T(zAF9vurOUu%
zKr9xAn!Y+V-WU3Uxc)$7+{5&Vqle{C{-@~f`Kv*i(SiOutJL0%NPt*yb|Y)J>7%=t
zkv1BE`nJrYm)Av`RMYTh3Xp{uo<5tzgoMcb+mc*`)_Qo}^=)snZj4wlC%T{F-!(u7
zy4&ZSLm)M6kDb@I3+kG1Kyx7CZH~~DJr7>wB9P5Db3T+sJMnw8iDOSP2l|VRINk5q
zfH1Y^`gPPnhPJw`TpwMGb3JPrar1IIQdvI<UAP=x&j%VG@Zo@~kJ@?3Oik{pu`Q4B
zHa}Gk2FBg*Zmf1o01HO+-+TK>(v+!SArcef{23CVen1cTfHSPs@17TB(MRQ}nf$={
z+QP4vw;)7LK~=JTkgp!taG>q2lUJ77f6|aj*WP1q+(l}R`c=-z<vdK48%EM*yOT+6
zd8NL818Q_G(@9S<?}FTDocfWZzKFf3G=Hz_3OrYpZtugKDAJfBcfc=LM*Jt)>IJYV
z!B`4;w-;(#g}w_bYI7~0swB(OAHKD)q{?F@?bD{tP*^JQCppN8n&-d-A9Eo-23DhJ
z3h=(~1Wz+X`lxNS>{~n>&MfJ`H_c!&A3PAg6XF}b*mrogt-qXi&7b%})R#DMnI>iW
z*Bydlb<Zs(QvaWTO|Pw*qI=q_97J}SXCV(|U03Ar?KY@&D)LvGaS4Bbm%qoz%oNP%
zL^+6ll=y(|ucHr{Tp8{j59r-V3VMJ=OpG;Qviop@hsD3dE<XEEaF|^uqtu?d$4~tv
z3nkr+vgktiKU9e6Z5Ziqh__gHOO4p=b-kwZwrs|bze;umB)LYI8+?uwMrfZ79Be?}
z%I(((MJCKieyE4iQ&oATc&l_>L1+W#6rbjXD_eV<HzE|t_AbCsu%PiP7Qi%yX46=?
z8n9^{bvXb0ry|y$uY26d*0`2)E_r)f0Lr^ul8)F4J&oOKYfxMV8vQUHt)PMFkX+Ia
zTrT}WJZh`2okGs*jpQAuBMSW{M4@D$gOw3O_G`oiNm<2>TP6Aci87P~_8lhyIipjL
z<OLyD8Q|@3tnbEynB&H-<rRpkp;}D%-X*86S9j{sa>Qk%Z;y`i>!&61IT-R;=mE1|
zNpnZeu^PIMly^M>^Cw-M%oLNWf2O##U6P2Z#B9^5(^y8d{?N2qU5yPGg5;KIj<&79
zKzIC>m&2#U1s}Nj@whSRP9B-dd?3d{DZ09q@6r9DfFCZMUPRPiMXI?ki*$SUtQVFK
zy#i(Cy|o;rSLd4<Y2Dh$+7RS}Ej|68ax%#rBe<4(W!3nkImt|Wnxtn8Se0|PejI*2
zQhAhJ!XqnvvQ){l-#cY?kEt_xDd|LQB#iupzfZ9Bys&E3WgY=Dt<l?~%+w}nH_O8r
z+m9yuPp&XOr9Y1B=u9wDi?jPP)DLJoZK(&`hZrFU#CWsKp2d_)9_}pIQhncLe{*)J
z|KaQ$*!bqwxHa*wEfW19Vv8-qMuh3vgDjg(KdY>$`usC?O`b$iL3842k<U;4*}aaf
z=!K6KEP#C}r&L=pQ1+BzR<)}+wihpdI><qI-DmI~h=}}3p==#YF|K-LO?pO~KGOI7
zWhueElIoFV`zG{%6f9+%;(R2Nkfl!}bYPlK!N~v_vRz5do&c@x)}Q3-qzR95OcqJ4
z`C<VcX;T9RVn{6n??74d>*R0*<t1MXStEZ;TD90QqxgDQ(T5u)`CC-@CjEhNcUMyg
zh7xf7bo#<Y%S-9TyF=$c)(L;ap~%lo6r9)LI?YE10`v8ETrh=c6UzTFW560%0LkS8
z|9TQh`F=*VieAcUTvS{5$5j=*6|}xw`680+H;6JbjM2QT^*;Y$Q2o>}##}<1rR6oZ
z0J4FW##l;CIS6l3Y8|P3#P+dqBiH*)(QNOo-skmAr>yY1Z``&d>$>zf=gkCNd1dH9
zYB&iCCTRvlB0i_iz5>P91zt|=#omiqEMUmvCPSewZj9@(UQ*{d=R2<ljqNQ%c$|2l
zmw8LBWlNtL2e_M5sq`)P8scn%gso83L;9<98}I!;VJ+o_RR{M|gR(4Q$E^KNOPRmB
zlq9`;VYl_%68zSIy%t>JsB7&ONs(@aC;3o;>;0h9)?e3kPabZ;lV_sW4xPLotz&rc
zERZ#^UPTHYnoa~)Q}FL##M#udUES=dz)UMvu+Bs8Z?2zISI&GY%qrX^tNq>Pt2wOA
zZ``Yg2E#2cor@e^HY_b@{3+V;KfJMeMtrK&pe<4TP=If*2E#+kZ9OHrqt8)S(p`Uz
z{&~^G^3Y4TkLqfg@tcp6xY&G7`EAW@v8W%5<KH-_>&lHt%usWAGj2+vdN{joHQ3{y
zYkW+b^u8;sac&DjeYBsKJP|XfegK&6gi@PMYF0<!NAoQLg9-D7n_$HuOYYPD4>;&U
z#AT!XawAdmzTNCW!1-xDvxS&wiHpMektNbwjhb64qp`E<XPs%gY>yx>rZ=CK{a7Au
zIlgpEgD6={AZ`!a&u8ik1GZHi0{8BoMIna~&)X_y;eG#fr8fL-gAP_l0*)WEcusYl
zw~75Zutf-DFV=fQwk|G=1`v8})7^T@=7t3~1r+T>lvg&HI<MH50G2`55!!2aL)7sR
z<FfP8Nj5fm>~|`Yj{05zM0UxQ0G<&JOU$}SUQWND-eq@a9tLL5&7cnMwzQ4kb?c`V
z#8T|3&8&uq(vf#LXXh=cQ-GPTQiCuu=4bRlAs=*C2v7_Bj-)^yk@-^f=d<ZwYaLWr
z5Bu!O2>`EjgJ50~3QLmiT$hAit^X(_JoUk@)v)EoL&KyBigY)LV7aNZ4ql4V8vp1<
z!xW#KgjKhPZ8M(4i*AHZ3j9JHY;6)gxva!1f4FXoZIufy300OH?UWoG*#ewZlV(fd
zlz)wq%P-Gi4!0~#Gkl>f%Glqp6S9`bRw_|e?(?C|Lxe|CW5xbfK3;BFQef@6RgZ7q
z1w)UCFr{V|63+`W09lcMLpt|e;|z<rMRMr_%2!7u|B53#BtJZa)J+ZL@>#GNWpWSt
zS0BmdI{qKZ-ZQAl?Qa)Wu`99_m5nqDMQQ{=q$MgMO*#>&QE5^my(c0HA|*m7QX^e@
z?<FF=D;+`)Awm*5A&_?B{_pdibLRc<JkJLvGt51i$-UP4t>0DFx^8&=l?(h5R%9$7
z6R@ww(ev5Uci;6mJ?K}d{k>sQ1~?J+$(B%K)@qmER!;dqEh^Ic(Z?S5>2LG=tIC2?
z*{mCzXNc;1>5|W@T5H&vH-gVP!yF{NCokGzh3-qC^;DdBdI}WCoZJ#8Y_7wngStt{
z5*PsaiEb_DmO!m^%hyfI*9WX=^I-gM<lTom9RCyL>Zqm^C#!q+w?T_!iucaFJ0_{g
zm>3RN_k&|+T$ui+fbkj&MwOi=;+Ss(Cak{)tjLJD`M=BSVYh<y02uRGTx8Jk9l`6J
zJ?%G>B8|U>pMC$?QDc}*U+|9Y!8v5ijqjsP;GmW>eRDO(a*H11?E2&L0`X5Sw=@pP
z!mk)-@01>Ft4K`0b^+xbLq)pZG8#};QbHOHRh<&I{w^@*dlfxnZ6n;<IV6}ea{Ww|
z^x=l<MqWwdj#ISW`Y#l83(&=cxfjRpX&j3=i$Y2g;?hDdXqNptIh5e#O1}<_zC^J}
zkpC>YX5Dky_T<xpuCHa+=Yy<98B;VSoIH1;|I=D8)rx(VJxVt5N#oIa-;9ojue!Oy
zDJPz8a&K{OvMVm|Jk@x@D;*+e_19?U(G!_}w_Xs=ME-t^)`&ZZGgx6?K8okOHAs--
ze)`ko#ECfb+TqizOM9qC=BL5cg=?b<dC*<l?xG3M(6ZWTVvdTQI4lj)EoDG;Zkk)z
zA-h9+AI%CE+p{rZBGq5h6eog@f#LNIs{=B|J0Y|!K8#SGJ$=}SQQ_Nw!!ZAH&bmDe
zxl-+#V3@`>-y#8HaovZvm=fY?#jBB*CP;>6ZyvoWSO=3mOlHMf`O^;Nf-4fvCpPjY
zi_zV!D|E{t1VMRR?_LB<jLY%TmwDJ2MkZiUOr%w8D=1@2bo?dr9IXR<+M~<Eoy>`8
zvFh5Zs9EO6diHf}sTv#fw~5pQg(Q@EoTbAGG8%9Nw^ziIR_pq_X40~-EqYQC=V^EC
zA)YfiCGgzpuFgonE{v29WgYGL8@<a=3sRbI2^z-=<SDmIUV-JDt{Q9Lm^<5{<J&`x
z2q1DWt!IaG30MC~Js)aN2OX&v-Jqaq50v}xe&azdE$jaYVfz!6MBryqMPNgp_t2;Q
z&6A@`AgIwxNV*WxJ>4U_QP&5Z;V)vu2)Q@2ww{_<vR#M<RL}0=qDWExU8QHlwLN*H
zvuIcm?cYNyiEHFLdm-6eF@4ZR^%CX6?^h$Hyj>iA^LaNapApjC{kzya#xiT|p+ANG
z%OCb5Zfe+>w$Sd57xM+OkQHajkBxKUOYi&ko0=c-KVKAn9+d<`JiWH=3c@#AIo1}%
zC?K3YrMgxpI|-Bhlo0aFa{P`gcNZ^=Ijfzo@LcE=N27TI4%fAegD4A^a(jtF`xHas
zLhR2L4T#U|=a>X)MU>_jnX}FcE2SI8&8Hi=&Tm-$?s3rLjN#wnjPWe2dw9!sJ6qaN
zQNOm)Xs_TmP5z_$2jQNX4dGL`{LGQz&zZ;$!mRx|a=vM`0R90lqH$>$_AO1qSV?oN
zh5MnUPIaK$^_2udx<{jx)eUq|v7z=mg@RuP5<4p%-{V0sQ;CFopK>ca-fwQN#d#OT
ziEP|X^cfiUvy_VI;LtrkTC<ywYuIBp`(towz4UQyTuOjxwla6=cgQ<IKrMaw;B^uG
zJ<0s3VOl`|H?oTIq)SD;%OzTnx?NrnH=q4?Z4j!wSWdLl60I^#PR&&%dAM9Wz3H{_
zCXEORM&FxH|6c9&rXzaGJmd)D1HAgUUK<N&YO@>~#{sR{3E=RN&7*-w1Z+S83wVkG
zES(N>RsV>_ZcrNcLXCXVI5@tuZ5~m6ak1MD*c~ol)FHy>@JiT8W#ZG5Lo}@*FTLhh
zws#XA%A|{ICpL$XEUMNHe!%j2hPUvt&_IXSgv>fv#gi+j@eS|Jm$A=;L*wisD~t@c
z<Cgd^*QTEpnUu$+8~pv_hRO2pt_qxy{L9<Po>yGvEtoh_ozy9tOZM+<E;%jdD(Cj<
z+NM{GOeXDjgYj4Hqf;>z&uWXz?PINF%X614M7L@@JzO<P+JSU^@8oPQ73W9Mevq$^
z;|iJ;rx=5M+cXazTEjZeBW7q#kw+);nP}G}N(^X<6E@ngnqAXnAL52w3$zR<Q5WqU
zpO8`@sh1SanF^gVsXJ?$VWq9Ps=+P)vdF^IJBHae5W4y8K%*Se((0!ZE?gc@pIs0P
zIKOF}s=C7|ct&VRfIPv5xz|$whg;3<5rt+T`}ofl!>u|p0drbD=b9cSfAgf;W<Jt)
zg&VIrIwYn1wvSD{>KJRJ*UaUd@%(m9&icKNHBrj>3H!BmWb4`+yYqP*IZI*RAx$uc
zduG1MBD$;==?6J&7*e2$<^P6FFUHo;BciGHimsKmX|D_x&sW7@?`;%L@Ec)cdKs6t
zJ}$M%QG986_a>aF<uEAyE#WlBqCLg*9EF<^@6PwrdG46rrgBo9PXUI*E&aa0L6df>
z$e_67UnU>L2bjv?bekIHU#$4XcKZ7blIecg`pen22Ef=xe#Ht^^q+F0H#4+7WY4M}
z(Z3X&^=l`hR9ML*HoXEtLA6brbHE-#>MgIX{uDDt*+$FZJD~fB5FL5#wK3C3P<oQ<
z1L4$~ddBkQpr6N$G<Twpf4D{+mc=WB4^7uZA5E$MAc=e%qG+jDQLR3_3D9+a=3rdk
z)1pB4>yHeu***}qd@QJc^X%w*=K&wofjt=Dj;u)y5H5Fm0PR82w;3z#g4|iXSl)}N
zfwmHPcTBf>gp0G=COSmw(_H`;L8TlSNKu5#yr3Rvr>O~Y@mj?G)1D3^o5B4jzrW1f
zDht++jWM~}X?0R3CJZXDh%DRJ(0JHaoe?g&(j}apq*%kGdY)_hFn2X{y-`-v-WT4}
z7u82i0g|l*(z6`>w$iCKAqKO<SzWB7{dAuvS`Udvru5%he)HPy;=d$$@M{TCF9T<<
z?a?r5@d^A-jm@<7JTHqEUbREHMAP3(-wW3ZCtJ_WRJn!4r#PdB(^at-u(q6KhGUgG
zi3R;LS;{f!%=^JZJ&T+jBUT}Vp2f4U1$+^;NL6j{pIq9<sW&~t;Z-H@_g{4>7iY}5
zd^S%&d_lqPm!$sWv@tc_gujnK?jhbMevr~7H;;Bfw=kbo)nM(cNLbpfrOO%Gv@9?B
zt>a!l5DRk+bs+%C59*mX<eOjD7%`lP!X;$pdP`GA^C-!~fBbAz>BP@~kwoaUhsH|L
zl(40{$MWl$-3lBBb-k;E|0bU7h73$rZkd*>@YF3Evz!7q3_L$;5hD2Y&G09AhOE|;
zauNX?ylQK|pc0BeI(6+%xNI3N2q3iaKz#4dhXp_5ykTq0QC(c!y#vAz^PamlK@%)~
zs$67Fl0PpY3k)s6(>n7$H?wC1Wt@Lp=Ek54vrfikIhZf1{Kk5@iC&YjI9YHfKB@dc
z`0Z?p&7nz7ui`lswHu;wJ+%X$f7xF-fS=hLUTU<7iutwbl_Vw~Rj6K{FFOho!{r`s
zc~K!qD^W2SpsL~OX0eK~5T-WpHV+dmx1BijPVk$-#O#d;*Z>%&)p_eXAT{ppgDWUI
zLd^$*z*_X~Ia4zAft<t`?S1^$nM0}#E{&s?$EsrZ0}}dKAeuW<(Ng&La<@G}AR))8
zUn#3sE53q~;I22I5phf1YSq`2f`#T^8a>lvK&>{H(kfltZgW!CG^y@+&GZnIs;=*l
zS)whS^b^@kY!{S1#k8B&n{1hVpH)WxTe+XMRtI%?J(Jj=rSBy`s1xv!uE0JM&>%B^
z)<x0tw)PK+eH2dIDxD+HtPN<v-?d)W=;_9Rc49}L8$Ypdu7#C@jj5q&&xH9bTKaO$
zxtPz{&T=t;7nx2@|E9Wb>YDFda6{DPq16q$Lg1JXcq?C{6Gvmn{vy2w7o@(`qu4m$
zpy89Y4pZIJtqEM~<;Y(8Y<F0-WH79vm!9t4f;4`S;xO!cOYE_ST(}sRetlI)KX4l}
z;v<p9r<FeJ^QFUQHV@E83>$Amu$x@@x_T=WWz;;c3`Kb2FrIx4wsQ$yFKvaXfpyJg
z?mz95-&Brj*Kw1Zm6kgrW(9LXF(Z%DydD}xfl2vO6;FEkr+yo6WN3lUf%C<F!_$fy
z;ps(Qmr$%PI$=V=L<!x-y>|a;p>shd48v43E!~@WFIt;kIumyil2_4Q)qKJ=K*$X0
z`b}j&IBth~ccNxPr6^C&%FmD$52cEK!U4W&_Itoy@ye|cCMB<Q&7#x`BJ;XQqM2?8
z5$%nJVsGs%A4smmSR~0X^V~HB_P4HU-cB{fCusWeG*}hXRK0lgHV;@~g!c}=TN}KD
z9I@)a$ZRmc?)s=6@l`;M%Gu?GUtca?W=}B40>nf-!c3)o!(@=DUx=Q`yiz_YtitIx
zkb=Z87oJ#`u))v7t`K>Woj{Ar6=lPQkKk+E`$CHArGz><-fKqt5msu%ZQrHew~hR*
zz|^)N8H`dnAo(46Ly{UUQhBRRSU6fz93t*bxcQcqoZ7C^cXGg7Bv^oAdfe=jp81-J
z<SbwgfAc%-FZsowzLV`blq0O`S%Kf9%d!&6ZuRv~a+2Sxm_lEq9TTt-7PtdQQUD|<
zd=Xd)yYJY%xV-dQm-a;rxY|fVzc$=(mvJST_8BJRHO}id+r^d6S3nY48jQ|vD{2<4
z``+2UO6h6wAb&aP-tlwp=mi}<NU^ZwhbyQi!Nl7osG@@p%1uChLel-mS8^}Ez}Fj}
zy>qe@8^7IM<nHEfDLZAmZ3&A1m241u2T&~?j_1;Fy|r2FZ~sBUqI^ni<DKUAX4I_^
zx5Btl6v|&8)|fvnx*s3XAF$sdRjXV!tr}Dp7q1r|tLr~ch747YN%sJZJM#a6vG9Z-
zaJI@f;r!TBL8J6<O<8B2ns8h=%m^3RX@1Wm9j;+(Quj$OS3nwkRV?5Kcrtt!ZHFn8
zflryKhimyeGzX~e{h;`tF>0l?+mMz{RLlvQdDTC@3cPRNzlM0|w{*V^8)0Iir8Dtr
zHA%pKE)o)7>3VQ*lCIe<Jo#n+gzx3vD%70htw@;!?!*x59GY2t=$wz^iEtg*LGXYK
zoN-p<qGmRFrefJnq033$7y8*4KXGm<uhlkOIMzX~bXLoc9PO^hUV!em@UM(pYYFUZ
z0h$_>kj?TzYOGS_&ZO%y3Cm!eUNhXag7b}b2{V*|rQ_858RRPw_<TTK0hF4>I{xS~
zf2f^d0iU0BUv%)FU&zJ{RHG)NAN-O~2E0^aJVvq!c*nBc!q)68@3BsweR4yLyAkdl
z1<uuhU-gke>YS*eN6!!urAW1TC6F(0k-oV9eodrlz7bUcALUp%N(-bqMblp-UPO0p
z{AhCUQ|g&t$a%|(9rIZ@1)FOSakD(i{0_?4vvlgfkNX3fPL{ShG4Ph-Ix)T{LEkwx
zRjFHSZm1z@pcQ*dV)a&c`qrPV?>k6B;PDV&ynv!3T9UCVU=^CUXxn!xrZS6?O<v?R
zTe%<MvkITAm>|#m^e8p}V&`kSyTIyZo_$J<9kU8*mN*kQ#4#*UcKu0|I`Z#?_oK;?
zOGuR;du-JxefLkm*RZ6RuQu6dACmcU83|mywg=+EM>}{w$h<uC<Sq_3yMzG<&=0&!
zw|)?A-pcJBcDQwI9sW)Rp|N^pqG!(}72p>pZrg@dk#f4%sHvALltqy(ADw0B@gU{)
zSp_OF_c6!pI6<8$YY>{6F0Ni6hD$Rs>06ud?)zY5-vf%4@J9WDvk7IklX`#jDh=D#
z^*8M_x?7=?^QS6J6F_A@j4sHOa*KH+=pv6MOISxgw#{H{hcxE)snO5cY^)^Ou3`zZ
z*&;h%H3QFzt9>v=Y=`Q_P0jO(shs`PB$)a|Oil7ld}h_!<Z7kOjOopdmIl*LPawjo
z0bjTp)O~>jvP;5;b2>K-%Og_``MCGw?X?UZmKc)`^`9{bXZ<GH3XG9&VMRT6R!(pJ
z#r<`1h(=DT*eQi-tNqg8HZr@7`gS<nmR^yd>3Y~oGO~S+eiXjprw7~nsU?tj)P(tX
z<+UXSWn5!B?a`~Md9M>DJox2CVj4uy&`1;@C7#GGyx6DUZo5SC>9cLH%vAWX_TtIQ
z0vr8uG5sr=s|t?D#x<MCkJ>i79e8a$sOt~0r@0K1(iUCeAgo1?66~>94Xsw0Ni>`C
z^UM|=(1~qH8{o8J&Ilk&+N>*{2jxBoi#>x3QRf>@ET62k<0OhW`v`C4_iGzgS>Ew=
z;mFU-;o1M2&xeDr)(?2q5O8-x8k=5(9UODp7;`H<8`b!@i*L{8?hq(h$#O8(vSLe*
zii_R4)sdWf7rv4+*Xl)gI~!<rRe(6CcBIkKw2{@JdoEpf8+dpG{#`((N8nH9d&m(M
zhO@l{c!`+2MSh*-(YI3>bQcziTC^YMF`FA=?cC>>KUij6(!i;tVFbA|n7nA~J5}*8
zp(J3*4IDUZS~IxL>`02nJcSK=HBb-V2{-434{azs7r$#Yb2H2dp<PmNzC+KDRd}&g
zG~I20NurkKJ`G7gi>*mK>kvVLmIRF~axl+wzRRWVUeXnFe{(^U`#?+f>V|Jlk(sd+
zkIQh(oF33qsVt}9n@z0rweLPdJmSm2_9|m}%UlOO#AiMXs@T2!OCwr(ZryN+t+2A;
z*o5Pn=B?hg>r~baY)brb6VWHfb{dwoW`Fs<X=7a0eC5B91W$mVla>^yO$q^C{m*=K
z1G;?j-NykcIEnp-AU}<*0$+lrDJ`;5F3o(6Zmy`AFu<GS4s63Pg+?{&{uc95k<~fO
zpGMrfrBGn!6;WU+Byea^51gpivT9<s>dP2zBQr5$lEb7mV~O7Vk>eeC|DaAGF(@5{
z-#|i|uL@Q>T+PrBE0PQEGg(oj1WTmv#}$^uXY#BUd*E_Wx``Q2>b0OWToQFz9vV8W
zX#gb_Popb2sfoQ1-P_M<b6X3F0yCW@Sc;0Em|Fdr(3T)42;ZF2S8V$HN4NPr?E3oj
z1SH+1y$(9!hRVT`X*+ve8?o`CGi9C?!o5*vYDOxDl*m~@%MD&wcFL2@YS`kGr1#&O
zu3B@)03fMg1lRte%hFX^k~^P{a?elSN4&S9FV=oEZ<kzp_G#m8IEMRLt=>3<h3Qyq
zkQ>v+@BLvB&vSWM#y){W0{ok%JwK;B+DlUUq&FRkCHlKZdrqvbvn)<Iz49alL631~
z4=ekzWMX5A`-O?1r(;&3yKZAHx{iSbnN>Dq>*#BGJy(*SO2a-15S{1yskNomn3iyh
z5=SkQg5+2gU0xOu($|Z#)H#0b4eoqW(7{4?Q~Poh{#keL1h587+j)BtYtt*2*z-W=
zN13`Rc4~+0==b7-nA(Tvria!xD{>*YgD{JZ9JlGNGgboheZJ`%0ATf_d(Pp)wU>Lp
ziHr2M_l0W9gR9GjHUa|TU5oc?YBDk3BwI`e?<Q&Z-^a-{E+2I9Bco8l!qV}P={IYw
z#vtQTzia>l!hJkJX%h7-v?B;>@HVxp7ndU$zSrVEz%HZMVvvCTdgiGR)@Ey_uia_T
zq118bnkj|yq?T=E{^wm0<6mo0_Wa0rsF|(ge)-X?yx!u8^Crz%qp*tokO^?l>uP7s
zn7C*DTfRwwV>!bnN-wwWKxYqD98I^M%8)CeX$zt^I&4PHiQ{@qVmZr0g92hLsA(~V
zuj4~zT!n9ICi(Gfh<nv@eA%KO)OX=(3wq<<#97?5t&K)DJMkk$AS303XYdHmLQsma
zkQaD+JtYNK86qvfYykN5IYD86e{*8L2GDjzk4^!HngZ}CPBv3_c|zPvTlqtt^e#Jf
z_L+bU#3I8)b$!w<6k@Iv!qi!*)n`8GrI+S9L%Qf(eEYh5wUUUuzxNIKYA-g)(C5KJ
zbt0>E>b_cL<RFDkMk0N<+|6T1#od<ZCEwRxT93g^HLh-E%%~j+G~5~KnLbrlbD=~;
z2{78V!G4S)!f=SKCIzd!;E;UDF?rE@^pf{+K>g_jJqjnoX6mh%Q||V|Tyme;1$v13
zq5*+@^EQjE`hH4e=oIB5?7cu*lfabxf?g6qPoZTAIT*W>c)$&ttD=6Mp`w&n*CD=Z
z(!EsZl)Q^9wvJ1``uf$c4?&GSAKj>D1?^z3#wzfAUv`P$>!&V^YYqV$EK}@ovQ7*~
zYs2!=>7F<J8&<c~J~R}kRX`pEIFwkA#k+saec<n1h-CBfbN5F*>T$`XkMe$t3z3_4
zbxB*^l}d>Hp^O$7i;s7Iw6WK(w{9}fq7}|{S&P)_xa$3+{PMSJ&qL_)6bC8omR#KB
zU5QxNC*h)_8<a({gQXWUetL-Xj^P18$q&6F&7j=93%+~0%ggta0b5^)2TjusBDDcf
z1<S6~(dfG%us>w$cdEFGXGs=aX988VuR`tV$wzW3s127wzdkT7+|iF8!L*|NH>4Ew
z3pMRy4mRg`FgFl!Dl1~IP1Q>7=yrJpUKw*Y1Eiq<g+gc(sHnv0l`**9HLBKa4vYh0
z&d}3rDS!nWG<}_z80(qNXz-{mUX`?Reh=R{>1O@r+|a2Z5h@o&wm)%_-8%%eAj0Aa
zkNk%&{I5Q^``K7i%CWE|Gor_=a)Qh|U{kqIsxR)XU61G)2Cc^-3Zw7qTsx76oepoX
z&K2oVx5D$TW+UIot|y?3M#nV$#Y9I*q}{EWb+ik>zeWWyS342cc>1|=rv0XaX5g#s
zCBAbuAq9wV*S-Bsgu0n;5M27KVd2Iv`^aIiuld8~^VIk>5$dr3J{9{Xe%o~}pb$n5
zzmNW0OqalB24AhpT_D%d2=(36Vu}r+j!2VkF&ZgJVjfOV7ubMyeD)kp9KY`3q>dR_
z5WUnp^0LT{Sy){r3n5QbaG=yBS$*ZzjNd^4I`t86J8t=(M2%A3YCBpK(cf}V{ytu$
z@_6VUa%Mrmz^ZH_sh1;Zy7XyR6l2RTZHSPdqIi0P$||~05z~i4`tHV#LYikf02BD#
zhv*qJ3mYW>AZS~(G97<5|GqKTSF0gCq1m0~QxNeO@lf*MM~2e<np?0c0r%mPq!t`W
zzH+M+$&TBx*~=?YjfYV;Y=3;K%>I^QaJ&!+@P>;)OZ=?n%FHh(z|<2M6sGPo+S(g3
zAK$(p-~J0e9}_+w<&HX$wK~8rH<TlJu_O3`JUWRJErVfZ?VNKR3|!4ijh2IM8qx`-
zn@3THz>OCIlU@1F0<0|rW*0c$))28FP6Tl4Zu*&n!cu$P!o5rhgCI9lo!-pEowj|I
zmHnW=Ax!r?;!>iSyi_ohu%!J@pnN!Ws(D>gKhWKX_nn&V?z9vvb00&UzWtz>`5K*d
z#EbG<8gi!hwvyMzu<78~PTh`wUwx3QL!0-rp(I6qjM`z|pndC$mgyNQr<x*Uh5Ehs
zcGqVS9q#l@Q}>q$;+N9gXlkLNtH(m=lr(eQSq3$pPU5z(IR2dtWN-Ou>PY%~j)f5C
zWj5lq#=$3zH8JO?oh{{10(%j5fi02a`%$a+T#ITENB*fr<2)5UY41^3JjIVpt>;_J
zCvN;HMwy>KuXfA%-adDjgqUm-b>NU=vBGO|fId`>v6iukWT^?fo`Om2vCRt8HgNUc
z>dIGirKvO$zZ}>AO()8ugHJ6S^*zG>_P_q<_U6~n53JyRks42vmAt_F{ixFEgNK%B
z?Ry{<O)IP5<(0IXWVeE7bA`XC98)0Q7aT?Bo^!SSA@={PmHO`^NnLDPlyXkd{quWQ
zV8g`x0@0TPg?Z?wK5_5AaljPzZfm_1U`^>5;LcSRu9|KGl_?QRREW`Dw+MDSiTD4Z
z8ms6Hf1%qpHXCd9mBv+y0-m#&WT#RJ#)|YKV3WV;)J7{PaDBl;9RpwgzOku9D<RRN
zy`bhr0i2gnveE+zMZ*TWinH|J9u|$K-zF-S%bipSImP-d!Kw=!6jk-jQ^d<kq|@Gx
zNml|otjbMTW7W7Ava)rwPL4yK;KxFW?KcSQ?KfBy#qZOBZ_{4o@wMu@*tD`9C64*C
z5hN&I{Q{4;4zvyU^HYKa+`9c$?Yc5jeQ9-KKnIaACxs9;@3#W~s3HH&m-c_ZUeDwI
z8KQ{PF<&`1_CG`Po#VedzW?tO=+@`gcoyjR8mcE}mo~86-x9iJFqob}<W45akE8y1
z)&GIEqydg!j7b7{or~0#vMJo;aB$l{RAAv0CF6kh*Pci~6lBqa0^XsYWwydM1!!HJ
zBfsmL4{l5g1kBFSGlP6N=ibXp3aAZjveAx!WKjZ{44cv|aoSn5V+&*vl(hV(E%5dM
z!rk|tJnBr&y`!k97ei$q%bHQU&R4>!lP8Z7*<isC<lXm+U1XfP?-{Fii3>TuA$MB)
zNPT?^9E_8}<DZ6#_pFFl8(nl7J6g&B#KOI$V~qG&hT05%2Z-7~Xd1!?;g06`N3gj8
z8nJWvK=eP&DQF?UcRmVk+7r>kYE5<sMM}Egxp@u60$&PH)PMKM`5sGuEAkHVXo-Wu
z#&`?*pNyKzk3W0UC%;FbcPADyEQt0^)*O>;<p0^1{O_TE(7E|Q8Ag1(G#Buz`E=HV
zqTe)?vmj!k%3qnoYEk7;`6=SjfK8m*qR~?L$?^W`Q-8GC@t~pr)7o;^zUBKLf@+F_
zF8$G7SbciabVbwI^o67z!tH-m7ZKfyc`^#RFHw?CsDGPw)NIolYr=}9V~NkUL}yvJ
z?$3yThmWB<r?|=Qn!mAAG_U{pJt|cw&|fS_AUws#9~!o}NXEXTaWI{<|7CTH0zN9W
zr`1F%O`21udHyNbBI|8!q`o%Rz`4|~-(2VXM-no+vEGjD0&j`N*}UjMRBFFlIC6oa
zzS#$)9c3Za%~Suq3if|yc<}kfqb6HDcD`=jcOzSm@{XPyRcC#avF6}^rxgC5FZxqE
zyN&rjb|LbYjEu-{2AWhJAb5-8lap^5n)7h+A=(jqCUt7tJMK9~dAvPCL&)_!uNW!I
zZB=fcspha70md?DogJsmW2L$6M~S%6ip2g1DzU>QPI0TvsE;EFx{`9A1PwXQT!mb!
z$yNDl-_*Wr@I_ijLzb7{)xg$TIjpY{DT1}niLl;ON-vMH9&cav{ZN&A1N{HOE>NT2
z2sp4}+eo+JGlR3?nOB8=#b@<T{(wamQErys)SxH~;aAS?(RIy4x(LrI)Ov`ljukd~
zZdiT3NZ&^{)$-|vDY2T61#GX7*tMhu_$2guSak3!)MQ@FPX9e-dr3LLxys2090P0C
zu8%mvKrpe)DXs~gC3zY@x@$vE1r7bkb=%(3=CA8O8~eZ)R+S!Bi!Q!AbHc8z8=C<I
zLtc|7ykmN$p39fHcGq}?2(#xeAxln3tRCQBcP8#@GqTZT)%zp`%jN{}(&C6dE(q^s
zk9+EQx@m%d(#ot&n+kIe4<)7js6%AWOyLOLkr3Upg$=%Byv5y|su(5U)3*nbW}9f4
zNH-S%O>@|1o6nHAY2_TmTS;77h*9{N7jETvXB@(r&!lFE2dh*~PheexFo0L0q<Fb_
zj90Vz&Jo_m8|#1hu;!}el6qI9K)-ocs{E3aTVkE|%m?)1#!8@Tn`>Fh$|O7C!Z;tF
z{p=!ZaU_3U0iJ+Q*_FCnifgXHd+uXcw&@tNd>Tz#=au53pz;;ZfeA_Cb`>rZk)=)$
z%-z#D7B_WlND!2CsF>QmRg0yh`hBIh_nWVrq8jsT(l4_%y&p-do2r;iHdxsFqR&I#
zcRtghJ`#if+4)qM3qBM+*aR7-KI1XL_5c5;$a*0=1s>>3y5Y~_Z}8&__QbP|j_i#U
zv=1!ao#X;3_>}!gZ}B|(b*KHVqNN>Vw>|+4%na8K5GNN>KW43ulB!CEd$OnG7Vno7
zh9|eF2UdS;>1fXR`T&WFW!!AQQRih-9hh;Qh2*cs#Nq@_m53b3kTS9IC{wwt_ECY}
zYZ>eLS3UCC)8BXE+5ma7XxS;yG+_O%o{lMMabofuIdgXfR_81;v<RYbFgPh3u((6O
z!NM6<r9JI??9WmUBW|(Emm6xs;2`}=ovwvQiM^f$v>WyBY)9Wn|2>IQ*s>N&vw>^A
z;QTmj`4829^>%5o7cxC^*a!wI@dOorZ>cuLtA<&#7O77h>TsWcbwx}>V?9njq{4)k
zMWedPwGQ@*-2LV&iJCr=vC?$ovHo(zm%tj^L}TMXsS|AK-6ulMrJ^+)&RbEvo#QRz
zQGIh+_T7`eR0RQTM9CUxBJ1K4kAtN*CiSm(4-9{HGe~|UH@}5?gk@EzUaakidILzl
zq6OHwbMolsJ9yJm=dK$?DwCB2p~*A83nKZn<IFb~zyHxkvwjh_BQ1RvyC~AInJxMk
zuQP;8Ax8o)pyWe`$~lSI(%z3OZj`WO^uqQC;zzE2Yw!MBZb@}dElT92@c&dzP1LWr
z@%DbZlmmyM)!va==r^m8ULVpN{+p~<&k%CNcr{-rS~X1eAYW?zn|ji+2-hhLAi(tp
zWl1_e-y<L)1#&$Z<#nm<URKaugxpy2jNuJ2M_l)Z74q%479k<SpFJ%Af7au?N*S=s
zw5nsU@?v-R6sO@L_rWChes_DuiISjk=lBCN@1JpA+_xg&_pBNm!rn#hdhT!{$9$wd
zv#Yx_pD`=tBaTRw&^+GGCva^baizveS^P>n{Pk<fI%|%{0WN-9c(c;se39nM$P=9J
zvh$yeLismLQ$rXc(<g9J{0qo5az~RLzUhbg<}<tEa~})sfJKn$yDWb4p4}{zB;@Z}
zLYJ*gcR?Lax&%y0lDis0y>zTw^nzKaay;dp)#P2mRo|ml8Y?GgAzoJq1w>1ei~An~
z+Etd)qjr9IbS;OaS{G2V=kpuG=<b%KvLZJr6|>^^^5XVc!OgL_umbCCwXug_`!zuo
ze@`b?<Vwc62<`O~*yf8UUJ%SecVk4g!DnLmQqT{1cdDoLA-u^DcExZt<{{R$hm`nf
zZTI&%73*IDDRfxzw^B_A1OwSmxl-X>nRw*YG&^5gi;8A$pndi(k@wns28+ublV2Xt
zQTij(2@hY^&_rj*kSnyon&0l=Ac{3+OqSdDS^R`%QG?k9-e_$Utm90t_JtM}Bio>o
zP4UFvtgk}5`sD2-8P$Rl`eBc}lj|k9#Ut=m7X=T#xYI$^^iG>u`Z=58p4_#Zy{oTP
z=)V-Ee*k%;;iw`yO9peT9my#NjoXwOmWHwKLN_`^aKU(x=Nc}5X(X2CN$$XmE<%ru
z0fsQ;7RwJGRP#o2X`nCdrRc-WFV9;~4<=6QrqzsaF=ZJ)Gbw9*W*xvs<exX@Iiw~(
zOg|{xx<>v}k|-v(bqf^kpOe9B+tSNbI|qLHD%vnv!tY(zzbmYp+X1S+o*L*}CS#wi
zUx2}mUOm*}d+5*#+B`=)hW<!7;WmOlLpch2D^L+BAbW_Npvb|}Y+(ZpLVmNC5G<Qf
z-kT>7*${Dm688sx^^r9>=0RE`kZU$pPnR$bZt!$745x9t7NNHN%JOorTlu)`y)MXh
zD)nMu&qVvyn6tTvZQs4uKE^AWONa3CehX#or|VDFA~#pCF}pw=e}C7P^-W}3)z|0a
zr#N(w!P6Za@<2%hkZCo2Hiwg;2~%D#vctxt9-V!Ml@l0FxerR(4Rj`46AiG*3JEf^
z&GL;h4uomAH|{5loReGaiLUi7lt{x00h5mB29#=K&0Owid}3wRq(45{o)^%i7MGbh
zR7>9@gJ^~cQ|)<4JK(K+^DI)S9pnRVBwka~&455PZ)Y6KDR@-xur(`FWlosHvsT*v
z<?^RW9@S~No8Fiqd-IMkL11J*2Tt-O!sV~7FST#+q*r6xzzLT@!sZk0&693n_q!F<
z9GXJ5P1H&9O>7(AmG}~UHX$@FrVEHEw7zqI7=knQ*ZI8Zy1YWsm(($UXm8nn`@MF0
zbf>uv0U9lQIqeR7ZSj7iPKf5entdj%`<L02dHK9Sz}nc3EH(G43fym@EbDL-4UIuQ
z&uQ~S2uJQ`;n$Js5Rcl`iZOLdpD+t*b>;%VA$b#s=Zgx24LKqD*oK0Lau`T1&G%Cv
zJ@wT^uv-Dmv$Dv~JHDw@)4-4GY1{{StD7eZuE|2cA*rO{s%NVm);L0rS_O26ustkn
z;?~tf+&15c5g!^SbvDV%PwV>5sa+qSjk!WZJYXzCmT+1{jM0|@m~uA77~yW@PXAJb
z5Ci7;qcwqV0ybzrZ(F_2z}FTVbmZ;b=*YV<M}|r6GR7<BALMHx`4Sx~vIYj6Uk0)T
ze!>a6;FWb=IQJbmNYbYJ=Kj{ZMaug?`g?{aJRo$3A4bsmi}8@xvCE4y@GPpPSMe{a
zkckC3)zbA~5DSg6F+P(5j|{bXZ1O56l9anB&nK=O|LEh|#P-h)SqDGc-tiw~nRFhs
z(Pz!%9r#*-TV1c!J!mO#RCsQQ6%^#|$Q!@!XuP%hQ4F+qn<%W-+$etV;chmmj;Jt3
z5ywHGqKW7)gL`6e%Cpf0gER|8gM@)5LFsR|f3DE0PZebM-X6VtWz8#%I7KdZE}a2*
zRf}ZX&);xg{Jf;myi0=mF@UD)f|j^mL3{J6*G%i}Mfk>N7(@wjwwa8k5FBUuC8XpB
z(gpFCPwt@cQF*vvdrP5jvC#SJwkGW1ySK(DA%|y@V#^&5HnE7D?FUbFmsfgMn?K?D
zJx*#4(OxsFU@q0p%-3PWS-AevNhWR1eXeXL=ds7^CDMo!`kwF=s`YS|UX16+@y{v(
zE(yi)V~$;EIU5T%3>ANhF+Um;DGzFbY9R9|;%aPRYxiI(hLepNMFobA?u~t`Dqx3i
zxmq=WlzgJfWut28n7c##QmO-FI6v$RBhx&MG-WADEhP5^XUSbc;58l&F=U)4Ux@y`
zybFRoudP+`eiR*8^)R8xclP<m$U}yn&C<aM!>p4d#p*Gam;JGY;hNz7g=b&szn1S3
z5?^-Y#ky5w6J_$J8%%-I=A;GVpB|sjQ+tzI$v!o6;Vc(}<Y`f$Y0kH=@C$<lveonu
zJx~6EG&io@@aU{FJEcwTFZM4?F-&uKzeOq0#T9pW>lcWzFO*@-$2H7Fu9l?{T;<iC
zcza@^4*cMG0r&x_J^UE=edlkf;8E~AXSqNJGa^J<J-6~}S*@qGEo3^{=@i)Ulv_vj
z^FbafM35i7KtX?X633;!6q^XSuGT?c<|UzZk;}Y@o}<->Vgf35zQwNQi$sEGCF7yg
z?-E9FiUpZy^c$G?y;O8F0-TQ`CWy^SmFkje?Kf_U^51`cxF@RxS)H!e#l&1D)oqlH
z!JuHc41Lgm%Dy74Mx92#MVx2y8MILJ#W=b~qfhmijHRb;CA(FX1yQ_7i)q8?Yd;X%
zpFuh4^GEP23G%h+IIcC3t*hRclim^ZdV&ZGZAKKOEC^8YTD`cMjzYilv>r~Ch!DA1
z%`~gIYTJIeJ7aK=kwwNV=`mT#CAU>g;9n|j94tEGb3X^=1dCb_q<)BE0seaw^+9Qt
zpt%8@ZDU?C2JC5X87Gykt~a7BG$Ez+xPbj<3YwZ9X3q%%hMaFrY^z&ZS`^3yXB4_-
zO_+dDhEa_zj0uu2cqOjXOYz=X1FG8;3KC{rIf<FwGqFubVY9u;R@LgYL2xH5jScQ(
zl_m*pB|hun`Q@^v)!E&oB%*;DJbd1~V<^JIpCnRP`(@%vZxwYtp>*2jM&5_eHT7P^
z#^;<$eq@?IMl-O%UxSULz82tJi9?9n9Gpw3zH?BwS-`U#W*v4v<yi7C;$Bg#IwVl(
z;9;}J;+TB*-u&6vQeN6p{5Ap8hYOMfaH|-!z<%4BHi{a!h(p^i*E7TDwtGXK=N?ox
zoBzIjuwtA<1%-*&ct2|zo$J8=@4Eo@vL#?EszC+%ow|QZl@|NW>R4%ilUK824qc43
z$E%_!BX`kpdGoTGfc)r3+#swSxBRGJ?JD^l;G5W_csTw1#5ENxe^QaAzI&#wl{iXd
z2=1sw?UU4YP4L*>t0@-%2bvW)TH3*$W)74Me`!JsZ4XMd;l>Y)a1uI^ZWr><(xzPC
z!0k`PK|xy+UfbU}d15<Vrjr6O=eboTiI{Kkw5<R@*+ee9rpdohncB^{{p5H+-jmWr
znH_Sz;q<L?h6t-_$1bW0)f}io;`;*(LoHQQU1{SlPU(%LD!dX{9S`oCEoS38ANC|J
zlN@xt4^EDAR#*cHF!p~q*|A>a?i|-TT(`Q3wv4UtH!7%?ObEZ5tF;bK=o9PO_yMf~
z;d`SZ;9_l_7$t$y_xnn<xU9tVICVIbD0T2#I<RQQmt<Q(%J*Zh@d&QLPKJ>Kvd978
z1{l+~A(C%tI;#WFubv2z2N$3$Z$K%}+2b1%bdWH`Qb|XFLm)bco&kgvbAV3Ct<@^R
zS|E3!lf^k=w30FU1*<AIov6WS9y0#si>;q`X^}xyq3{<blVGRGD{fJBD=@1L^d?|q
z2c7)RqpZYXf9OhkQ1xS{uyoVIiK5zrrk7~^3iS^5>iSFii9hQHae*83k*Z~z(6u1v
zJA3^FDYz~{#Z8hQl=~kT`NVv8n)<n5-b}XGYA2oPjK>!!dsz6B@9QY~JUd8zcK<S)
zI#>+CS@;Kl1^spogx5Abm+FH^pSkoQnfRvmd?55gzxkptJ+fudwSGlBT<c+ZF(I26
z!yXf}-23*STE))D^<Os)+(d)mHOvf)c=slMwys_prsQ*`?kdU$?fKNGWy2+@@=ZLF
zHmrIDb@lL*o<sV+=8fB>6oAf6f2p|sUpe~zAH{qQdM>x&O2S$IbaxM%p-vI7pV+SR
z@hcvyOK)6XK>q`1V!s$6#f3u7W-pCsT>88N?C^dOOr%NN=25b4vG8gUQ}UxT-{{mU
zHvqrS<&Wn)*E(B}y`+t7U*Q+Rx_++b41KNQ(}a5697gxAAI>rf<~8mpUHC~Fx=JA1
zpJ0i)zwxcgCpah|offB<$n}&wY-G=doaU;K{o98@UGqgtMqI@!SclHM8kTpn)h#AY
zMcGt~c975NGd{3ptlO~U@_x0F)%bGr9&E2EmSO1bSxY=Gw5-z<6cfq!`Y^BjE0BrU
zh=mL=a*$tET7C*jocz0C{}WDqe;^iJuIYc+LV{CrN-4`e*@<LTZvrpHXStB&@~Mg#
z+$7zoQKk2|^4<RjkY#<wO<9vJm;&+ATRTWk-BWSxqeJf$#F`I9WOmHy^nLCVH70UN
zcTz{=^0ZuE#m_u7k)jC5xK1!*_cCB7RAfQy@fF(+hD+kG6O5Nzg}ww)z|>%2{-@VM
zmc~6rH-BT^7P`j0ETuJEBz@WMLLR0~itIZQBO7g(em<Czk`tH$Mj<=SNg-zvst}>X
zu<h@#Af`?Ys^%kl?MXTs;}NhQLdJN{wemEjY#$s6XtgR!yzc7l3BSIM*;9l?LF^F_
zA5W`H=H|t~QUAclEc#4-Qw1<TV!N>K*{-&9)2)1O=~WGt>mN#T9}Xun8R8f^WAqv%
zTKG!Z=G|!`w1;G)UOF<108YG{z<|6)%s=@%Ej<+H2RBqFDh%=$Vctx6Uz3{?W0~Jh
zS$>GKvX<3+@$NG3jD*KZ@tfGN$nBr84!36H{Wl7y_yrxmylYy-;z|gBcwn;NMH9Ji
z6{nsx7ATQ}*mv{15n{S33u3zUh?U+lC;|zE(B!zMA;^+z-!>8jCdKp;KsPr0dw8+-
zv$ssX^&%kad+0erTXLMI&*!*ZFnBcSo`2a$$mBYQ4X%<0_alD<M-cKSd_TqV?isZd
z3{4X3dcY8I?`h0_tD@=d<jGQey^JkG&z2Q<tMD*is>nYZ;mIvpxsfKwcJ^_>z2bxq
zdi9uYh4=u=n?AD&28Z588O62Fdf3n&@i~`b8+Kb=oZvS&N-?Br5gGqAJ)3Pcdqq+Z
z<x|0S(+gzfVEhzr#P%(C$<Q{-gsEqt1^8PcNN*=DG#cC!Iv>}!HsD$@^ucK3GeO-E
zzh~%!K_*KU=<j|k)L$0NNQK<?YTz?X*NKh!QdGP4w4lZlDXg28N0<M;{B3FE5@btr
zBVT6H(nI*;ineIFx$OZ>geHhOhlYpIu=1ap4$d`KPCTz35r0S8lofT^Q`zr137u0X
zC_f$dyK_Z+&Qvm@+2z1y!55s;Flw^qerOG(nT<YW?y~N3T1P^Z%mGghxk_WJnTAq?
zT3=0luBR-^KJVhh{8ht1nNnGLU1wz&!ph$wJ_blOyC%BBpDq~GME=2$C3mry5JS1+
z9<L9Wzg(`vaeKCJ#exQma{xxyFqN7KDrLjk=}IQ9rizw><Mq<?(t`(hytEJOsSGw7
z<C-9CpG3b-$X;rW+TLw&O!6<Bj&pzz0x9o=2Nc2)$^F&cIxFte`}mQ1_e1PtsRuWb
zU7M?WZD^*V{O<Zs8$oEmlUcj1S*DqI;T#EITM0lOt7bO{pxz!GjGB%%K)TQ6*{<CG
zhA|n0|Colslb+qPe6lOYFc%Rh4$|VcwBH(OZwt$7pvz;UHe<MVa7H4U4nr0S#rPz5
zJIy9FlIlwj4k)8;@Qv~pk%^%)bK3azw=9q%I<C?#jkvyrAZ~K3NGq-U^3YyN*!Mf5
zY;k-ON=xyI%uu7XUVm}$JzeEFjrvD(<7heq{gJYHBk=WK-3h**C9&TDTYb*k+Qj+}
zl7a|7sN|Dg?`-l-Ox@GfP9Q$0XY}`eE)0f=uF(lpbkcXb<+gd)xDO}Pcrh2B_P-Uk
z?<S)8viCT8B49Ur>I<^(S`Joe{`E=Sxyv7t@kFb$H?!VEBZFO0<WaA(SxudUL6XR<
zGRe=WT6k|V`xHTR#o~5WN$T}PxYPU8b?3yZX=pP)Y(6}OJ)nRy&W<LSEj&2S1yzxZ
zfbFM`1oLNsr5)Wh@<m_Szht@5Vq@=#H!>)75`L{Z<97=5JiIU}_Ova8Y7dBRyAmX?
zoe#cHFe{~vr$y9WnW;~f^$a;rTCx4^H2jmEENdenwivW_WYJ|j)bg&jD=oL2jliY;
z=<L&*Sl34NPNzrD_0w;*0jttpK8gj~FuDefaiRl`GFbLGAHm54T~3rm$L-P?F`&Zf
zQ@y4&umSaC<J!OwBe9UqzF1RhK?o#p>G4z6p7{PUszkp-#3#_Lx@#)^mEqjSjlN+A
zi01Dh6zYoz+AFs1>7{X(qv=3k#+DQF>QH$&v|$Vzi|YPK)2}ahD2b*gTDd=4qW+69
z%6cl7)vaaE=$=~HHhenn$ed{Oybd$83i1tI!3cIq`oD=iObS8?_cT{Ox(dXKRYtLk
zs-3`&Ef?~v6uvU|ggwIk+CQNM4#%EZxw~~>j7_T8JX)WfS6yp76j5Wn<%V1gbzCy~
zTL8|wXb3Q|Wx@TdWjMQ-y&-66P0w=VG(tWYQRSN|jEEArH0cvDt$vz$xOIlA>Ztrp
zAe}khDZa_`2C6+{9$@7MB1fv6a=ZKwul$|mc8sE09iMwEzYz6Se)AMdTKZkbc);2k
zcA8UQmfVL{{L0_i0$x}m2ME{xP|)|)Q~TEM<HdnOL{ff)O2F)7CC~Yh2`ATsK}(mW
zF-s=!+E{E?ObHXiFp7T%+YmdU(_~b8j8HnPWCl+W7JYsq<9g5cAgFVSaGnI_D_8Pc
zkB;-A)W+7irRlhdtbSxB#2c2%;F}a8Occdev&>#xd1p2Rz$Hm?+MTa|=>DKYoAhp*
z;##ymQ{R+CqF|MgjSs+Z+4>G;0YS_6^Q&~C_-P0C4tJfBP4bnLY~RSOO^pxpsC1gW
zpFh%oX`q%@U+_D7V2Yf&6Fg9Gy7~wBy^PCDp_p1O%gB$qH2bNLC<6#r?_(L;^YcC~
zJICbp80Io{sTuz3WIwZnSAmK1{)ngdl`iI4GV?W`r!Rd@8VXM~zSQ~48R7k69+scK
z*QwuVo*vi@zI-;eXr^M5rgT;f78`D2f{Yt?iXAc&=@Cg?j=c{=%GN$du6S}ae}^qK
zRAZc>PV#W8r+yL|xo2nPvGavz9&peGG0AR+Dl!Mh_)@|m6efbIo~%gtT=^_DkzIPG
zGxQM-*wP6U_bP0s&K6(VG5+NcE~Y3H=hW<js@F>o905N+hXADpUUli}pJyF`Nz8Gw
zz|`zL1sN``?gE-zvXJk&`fH8&wT3HTx4Yz|of35VuZj7rdV2-Yv(=P9;rIvny=mgs
z*BrLC+zOFVi=^F#-Ndbl=tKk6Fb#z49$R26rpExpn5b|+h^VB${QBF5`f^igbH31q
zVN|kYI>~6Ggc~F^nt%y3SWQ{b`?-|gAV=X&*loRqD-r5q3}<bcGbj`PM@PrXZ=P)8
z#t8+m|Kls)IcPmJ*p2*ub##$yCM2(boe+}x?#%zEqh~eQlrElPF`lo1py!}Z>Hn9G
zjsq1?JXxzfId(A*oiYy5tsR3@5U0$A)T75WU+y34=^F{kF<bmr7@@tF@x_xAD-xvL
zM9LlQ<LMO2CXU+1iS=4sxh+o$(q55Z`1mw7vW)aX6BqX8xiA-<y|@HBCdtF%JF+tZ
zP<}+0%}|#)ZUEFG$aBvm^e+OSR-)c?F#I+M>_UG~vr6G`h3k#CR7}m<={dz)(K(Y2
zBz+od^{ndj_+cG7&(1Xer2o>?lIb;mX)6eRWmcf|RM9q{l=I|D;8p*#K+(A1^NcM$
z@YJfbNwa9`a#oKH!y5{_gb0ItS{6prKN}jqZN#9j=Ra=ODOg<_O3a6F>OM2t%daR@
z780LrAq^2GdMgRXW-=*tn!>@`U|&W^_I)L0E+|7#2(l&W7r3;*e_Otue6d2nz=CVO
z=&VjBL{;k*Be0&#I%S5d2uyPlQPCQVkL6#yxU5AS;jqm^>Ss;9kBc#!vVQK?E6jO7
zA#e!$h9ZBnP94V~Sy3ul&tKYR#=0>DJw#G*O#r_1^5TLba`(xhClNWjk(=I0j$hP4
z36iJ=%=!UYKkF0NHvLt6R^8PO`Kk1ft@p^$A3I5*fWo<WzjG#s<|<~RJDwM$m@J%L
z0ZkRE|CHDP_}*2;X)vetyH@igZz1DLH{m5t7~XWqxC3jYe`QKK2-q=5zJ^mAxFps|
z5wduh5mAhN=&|n+wDz*v<`Isi3p8Dt#uZT6IpWQD%d+)Xv)>znz1X&HC}G)llGApy
zW`tciYr`=t$4vT~2cLJaWp>56arPpf3j5gwaiGGWD}2WluE5u<>jOHpIA>)-DoqF(
zlN(k;#<IBdv6gzZp)jZDZUdc?HG@f=!^>9`A6?UBV~>*0zHMC-*GLnaeI~&_aabSg
z^IO%F{t0ZQWgMM9mHvfdY-b$azgWek<zKF;;+k)=o;st%zNgoRjTh*yprW>GU?Vod
zvz;z0uWuD+s}~%O33StU(%ox9ICWC%!N|lx!;9hy#-bb0{8(O-pS}661fTW0&j$&4
zGIEQgQQ4RH+>XkbY@Yp9jer}r;*uyC=233&@(D|7;O%hH8$Eea`d;qq0R6FBMqQC2
zahGu-ZrQ#lQSnB{k16jnaG3GX%MG4|rQtbt$`9eMQcN_bus5oC)in#Wp3NP6ZCVsM
zk!1ID>F3+KXS3IL1}buXxJ){TXDeSxhl}*|R@q)aH{ZFJ-hdDWsC6aY@kYbCVa~&G
z`QjNqW{um^R6$wq9h;!8FDwx)dnb#&=lGlYLsM4f%_n8$fcL940okts%8UmJJ;EqI
zOtIfsTkqpV65Gfk%bV(bV^%@$N=CxdX91_D^c(}z95n9oL(LzZf(EtoKs{+^Cc=EW
zH&B*B03pHK{>?<M@HqO;V^L{Fp88vaJ*Of&5E>TrXfWQ7LoX2+LvHhZPXa}vpoO^)
zOJUm6Ve|7pshpd4G^=y_d1DwJe90R%?O}eWX+@H5@-9hiv{nHtL8&@tmWMXXr7dh>
z=H7kmgw(M~9&)E*nAe5C$(F#=9Bplzca+a_)B-p{Kop+i(_;L!V5Lbp@7V<JsOFc@
zivcWs2FudhW(q`qy0VxABE3Q`UwJmj9BtccU7l4@yRE%CDyr_kM|9PxQyYTt-<Rk@
z2qZG-p9CS`97B8Zl-pEgcL`{XY!8@R&OL0Dg^dT+zj`Bo3V$5O3hqfN)RaETSdH^@
z{$I4c2UJsAyEdw#qNv1%Sb*5*0*Zy6h^PpN5kXN}P(eg`ClC@55$Q+~sZnXt1?epy
zy+~C$0TM!_r%)0I$-jbr-#zEsp8xKB?zm&kF~p1sD{H><t@C}JRlYpzj(lv`mq86K
zzZ;`rZ9k+1XLrE9MT{yMcKSw{0~6viP!jc`Ysf_b;9G42DydRhsE?X@B1xT)w1qyK
zA!NPimu-DpMqac=`bEYuCk`6QM4lmvxZO`lsq@&(YwHPg5Serbui#=qy*CCPOTVhU
zfS7HtJEZj^^=^LWkRtGElhfzzFk&gbiR({CqjB>YcdxDOOJrXjXbKsM58XP{Juo3W
z($SvR+DVVk8?}lo`dT6w`C|nqbF50wbJo$nZEe79!Z}U(nZ9?p&im6GY^s|}`E~8#
z{J`UZnTdA=Zw0(EI?lCA*Bn*0zDx4)o=zJ93--wS(<TEf3^vjnw;VQ3@mt$>??rya
z!L{3S{c%3Oz^2(^&6pP}!XgisN=)O8JT1`*AGoxrc7pn(k4|QvC>>jgr$;nDp9!#Y
zTz^0M5UoK3k0Syi`+9HGhrlKh`b^$NUn(`UIC{OgoW7R7=m~ddi0KcB)_Y14{V+N{
z2ev`Guw1Rf2B7eTy-^whh7*)q{X$&W9jp8Wp48<xW24^!lw6fn*;!tv6UFUJjO=#6
z?QH~&j(ts_p2ppJ?Fn>%P4x-a2?9_n`6Fx&&qN$eWgl=X6~BAI6xt73PJ+{ZuH2ie
z!Os1VMum<NR^~`6bTG@0olwS79|qp{c&K96!q@WbZ{<~ZU1wOw%`#jm&B-6EG%p4@
zLQH$B9Mm15gKU`_*4Q48c$HsSWehdDgbZnpUE^=k3dw-wL`ELw6LuRqQ;dEhnXQ>l
z@2>1q<1;^$@i7QtCqayQU-`X7SrzekjbB;6m|z~GD|A}<j9yC8DsClBl>H!a`2glg
zGvfMKnodcbnHpougZ1>lYWjmfvtd)%Nr`k+g7tkx*gf>5if1`Q={9B$w0O;>bjcz!
zftz~$<{RO@VEfjHaI_w!xmUM7G35)!{$Ni0%TqARW`y0R#JHe?W1r_h-azHQEMaKt
z`JZ8e$VH|X^{3VRJ+z3p#mBek#Ve)CtC}f2*shG17Z9J`jCE=0cASPFh88zAVC!Au
zXJ5l^tE5#8J{R%L&OV!aOAi^|Nk3h%jv1XF2br-(fLcJBZ)C#N;ts>y<>`v^<5f-V
zOW3d!t6{Uahoj{{>Gahb9JQgV&S}IVw<X@MH#Q`2w?MAHRkWtb4t1cPJUFy1;;vyE
zS82xLlCJtxYXQI5QGX*;99~v_Uvwx7p5Vi#PF8<%M3neaoQuVsXME>OUcug&%egN{
zbb{xu(-kk+eQePvK9eAAktx~dr{1}6*+0FCbYM`++s^tI64I?zBZBOfE5Z~Wi};v8
zmwo_Qi^f-HtS1^njJG>$&aU8sVJ%!8XrNRr9j~aBgT0}kHF~T;W|}{>LU@i~W^cJe
zuH^vf7?1*>b&u_!dGb`H2taFK<O6@F_v}4^_FMuY2-pt2BTrV99M*+(sBq1+a*VVt
zWdZ|rmKTA~Dv2d1xrBce8cB|ry1z@H@nUw?D$qHgTbS145?Fp^WLjFG=ZrQR#JoG%
z!A^)Xy~8<*6NtK^G5NR@9$_EPjFRSWW^#*ay<zQ_t`K~uap8s@GN4&2b}_#}Pj;uo
z%JvrJsmXMF!Vl`=B+hXiBolQ~+x13#u_BPra+?!H<Q|&!7XrCkQUEa`*viam<&7ib
zHNK8i+j36C`%$y=k$0FD-a8#DiNUIl*KlNw{E1g@{1<YwBjTCLjX4rH56weRg2<zZ
zV0zA(gyq7mOg43Pof;=Mf{MOL7mZPxKU1vy!_`dDffphk9*0!EqN%faUfSegy=aoi
z1@o(RD_)B5>xk)n+K(I~G#!b4u~{_q)YVr}_6;~ic#fjdXN-!SiVTQ3FW9K5rN{Wx
zrVr7KXY0rfOZB0y73&wQ%gtGacPqvv>tXN_0GrNR?I_d<=(=?+A%F22%(qQz*`W~(
zRB3kVR)xPQDqe9ZC2p3hxw)8NPSj0F*2Ob>r(Gi$!PHQo^(UK1tvc^0mp2s-IkBej
z`N8@V-x;~GC_HcsaW6%tSUHIF*~(5=Nowb8&FSS~+XJ49mF9sH;Z@RhzU$(u;?r~z
z2NaCPiHt7k9vSINumdj)zN@3{IxY8-ZPmIEP8w-``!M1Myy2i|Tj=}~@zT=GkfDo~
zwgZY0^7q7gP#(oWV!MO;VmdDLQPlF&QZpB4rdE9xMjPFl*1rfjA!=cFb`8Z@TI3W(
zG!5A)pM%}Abv+;@!(`b|Lq~UvyFJ2Wl{xuaFBX|s7|ktdc9_%xM_K!Va?R&Xy+C`>
zKaF3C4OOF&)|8eE_d+N4lxx;L2B<n#AG~%`a}X4Ii3SeL8sWu717$n^-AuiiMS9q)
zx^om-txndNq3v@3Lu)$>Mmt{9>JU}Hxj^<!|KgZ#ko!JP*Lr>L_$fH0*?3}RVP5;z
zoAo<CG)#6F_c?J0e+;WUJ0R)Vfl7v5E(<vU(o*&UiU(<<16XWxJNa_aLQ$Vb$TE5%
zE_RF{JonD*<FSh|Vx?6XN24+`-lRRhKxx0`_<#-IORH|R0H^Vm!Wo~#!xr(PDyNGV
z^m<YCD^(I-z~qCj7buU~ejJ#<V~?EPmT^bd?b99B3_3e3*l>$*Mza$*?1W*#LPzON
zb*}5MNb%_4uyCPLM|+ZIJ~b~Yzg{b3ul7$5dSkRa_IqH+Xc5Ltj&lYO6Fr*(S~`5r
z#Fn}Crd!lRYJqK;q+B^^qi^#h8Gko3<A&4l+*sS%cBE5)5t?{g@R|`0zLKoW2*|u*
z7U}jRliI#X5CGd7zn?aXs0Awex5UIHZs0qkkCoqwJDBoJ?F66<S1+u3_BFrE-F@kS
zX8tNatm)X38F{DOcleTq?$+Nx4;Q5x37ITNK$Z?eOl%o`T101U`~Yp#YQj5h*oJa5
zs$!Q&%hzKvT{f%3EI$%_dvH|w6C(-g)DuPzsgl@ou59kZ%kMEKfg>79jGI>Tjnb)A
ziX-kwY5v?CJIoK`HB@TD%3FTY)FTFA@R%FFYSnfNiLPS!c7N$SJ@Ry*GQ;FaW4~3&
zFdbHA1IHLC<YVvP7=&jJ*5T#EuL~XBzzYVq<V(2|97c2HDraCOcb3lBNh)<sq=MUG
zC2CjsHAm)GCi;kyf)}M}0h{&LuTBQ3^c3d;ajcE$_laX>_)jOo4Zo<}lS1Fb*~{)I
zygBFSKbWEuF1x%JXVRgAlvtvxwr(60soa&0cz1z=bXF-SZl6Ihe!_BF1Nh<m=bk<4
z(c9BfWfy2`_0wjLrHAAA-M;3DH$ExzW6}(oB>RLFE-M_|ww{hO*6uF=--<nEU+*GI
z8?tDzKzkWVc!Wl3b)46*Sq&G<70Qex@xN`g3SjsWQk&>HYALXeE&kws;bUyVsM(xI
zUru~p`}e$O>t`WF2?>MkCN>s9MY_e>Q6q0lTWnKDldw=Vk==c_dha%`iV8*S!FVW}
z+VqFG#ZkNR_oN2MBhB=>+s31c3%m}?$Je5<Cf6wEfEP?q6E<fhP#oO*+WZyXMF+)1
zFBk0^1TlOF0v~2}lMN?DFM!)Z12-}Epl3Wz63f2dztIGFy~Zm**RGR(EqMa!kbSDg
zu9_Q(6sm_9ZN1{KjooCu5g&bP)F)NjF)BKnI(CuEJc5?^JG_`ygxhmW73sP2&?=SG
z&#;Zo?*)ZdL<e`J8T`E)6mjEMDV3w05AqxisZS*;l~T*f9zP1l1Zn>2r<|Jreh$#H
zu^HA0mDPZiCMd~$V5?sVQ1%6|Fy+K6cM%#FSt`f4wk3y4+TJE&oGwN`@w$SK$OM2-
zeNBV)yUZ&!sP+dj4H|M@d5mzyA8WAhv*CAJQR2sJ?!4afM7$lojyn^x9DKfDJy@1a
z!re0vPjs@|6Q!V))*N%fJT7w1s_|n?I^P1b{0z{-Hg;N0CrcAroZbx!5unc;jbUF6
zI~~c)YU)4Y)>`+$w}!6PqRo4Kmvg34AncA~PpK;VipB%gJCQ?dd#Yvzq-2GM$W0@)
zT=Qx}KCPTyF~ccmnoL06^j)Lfw8r26c}+!c!0L@iWC>c8TFRV0lo@c);|4n3nRKPJ
zfSniS#n;+a|D|q%Do^)oh`xWGlF?YtJ|0-LB4^^6iglq5QW1a)q7`U7kGXiA8tgSU
za+=1UyBPUy|0oeI+@F--=E*xmLLn$DZgVxSOX-FsQU+&LdDNB<h>0?!Qt36TaW?ur
zbyrvyTvH|N5-cK%E2!?iSq6(v15YE$?o@OQ+_G;zb7Wc^cEl66*ycq|PP_CrU$a^M
zf#Qm+zIX;zu$0KUD=u^lKq)&XEVgPdj}CS&M~F+T7K=ost1N!&qli^S+4c3bU$9Z1
zsO3j}7?K%$smi|i0sQ;4P(kV<N(W1Ju+~{4GaLI85=3XPESFBK7`CJ@QWU>;8GAP8
zP+Ejk@q&LM3}F0ma~CXM!CzSZQG^O+kE2)3Iot@Rvl>4t3sk<68{6Z~g$ts-sQd*S
zAy9pm2tSWt8*(W#Av1k+8CD=0kL@bKbza=);2>XDO#FGD3Dg}1ZjRlAfc<~8;9Az(
zWhgYD&3?$zIIdzYK_fmx0a>TxAuBUIntS7JvL3dvwa)fC@Pf|OLfi7CDunkJn|C6(
z<V<+Bq36KFJMY-1vTJwz{rK+1n~B}MPnntNb;g<;mmJk~Ipl@PgV=?8yl`Ass9!2_
zGkJTrBRe_)Nau7;XY{bYz0sF75-~onbA8Xbfd?M7-*a&inffe0YxfS_x930}jU0^e
zw3|#sRjf4uYBzI{DlkMTI)iqO8U?S-R{*?lgN1~<n{UA9gHIKCMkudmMp0206jJ(b
z$H>~`2OSldF1CcmGY{0m`7m#%mtQC?<%K)MKE0%xSLj|ZNtAPHCCUVJ{XXfK4V6))
zq$gt+KlLZP+xp%7)9};Cz*UL-WiO8quT%o^G$KAJtv!4vms_i>wumePnv^yw6(O^u
z;o-ED=hLY2gqUsWKi;H%OE>|S3TgEinYYi5kpB+1H9&rODjhmx>yG3Pjn+ZLnJroQ
z`%Bk0Xh(r>9!|8DTZ4q9?7~p_qT^p;Qoc+mYrk`tEH(I%&BE~IKMX9dd_O96SM#U~
z@oJ3xy-~}=J;BgQueym5{(BkE`uu9FDli-j@=Zqjjj0bqvae>i1FqN0I!s@qrtw*+
zdHt~XA(T3D;TlC}Xy?GgGZU~7d{0=Nqt3NVxkUI0NjR-&)9$6F{?*9l=;locu|G?S
zD)S74yp~-?L#+!pXFR&JR30rtZ)`8V*V=8Nry}7zu}9!k@#rPh)$0wGL;iCk5>|<9
zIfT?syStjY(3t&{1G>5A=4QRD5|mfV_xLYou1`DE9FDnU{vzI{A$B`dPC?g8M9+3j
z5@@&>^t(Q=uftpSW918O_v8st`ss^yKD$bi14sa>!Q1#VukZgIS?7I*;0@49wP*86
zH$Bw?S|O{xZM7Pqz7v7oMX^$nnBPlvMW+TY!poe`Swi-J)kAxm-<&FRoTWR6KFla7
zi3TdQqfHLQ-{==)W|CKRo!)Em_SU7ScjP#dtM{q!YsqQHYAEFvo=YDDN4x-%h#Z5N
zCGl|E*x~SHhRE_lHBQstMKbb5tk3=hlhfDIh$({btZAo#G!2a>hPlJGBgDnT>!qX#
z@>A>e&-k8~L;TIeb>JA1rgrCjfBiGZlw>=*Ik$YrP%pN3CEtFfH>X?*PpYi(YkkO#
zyeoRwb45#a^!yz$w|ZjW$eOS%QyN>oIMY)>X~>WyUN+Wm4h6q?fm0kkK|DDGMMDVZ
z()-hBHmmxb>O9&Zx9b)XR(?1~C63@%amosnun(EmdL8uj6?Kx<T;?NqRQuzc3FmgJ
zST8~7Nl%FkV!?c=<Nd~HUQB<lsa09t`30ae;>GvnV@jtztAaE-Otv|WnPxA}_B3it
z1cX4x2LXEG!h_BW(s^or1?;7<Ogezv)m|T-ubf!C0!tTvVfS@yk4fIU<(c<(@U*4r
zY}!ZnDIX1*MPeUhjxp>70g%!*jn?{yiD?Ff<uWO~aiK2~Eq)?X5pcEjz{uiHURURQ
zXHKJU=0`Un3$zikumbIJo$^UVDVc&m<Fnv4_0~E*dNQ$hM7(bgSuMb2Kl3gWy>De)
z*j=1K<Ezkt+5t%3&(gCcGiUz=#R@sl=uZ%o3z7SQ{ukmQy`n2GafJ^fU{PGEw%SVi
z3IASh7B<O2_mouJJMgZm->p;MW;%K2Z3ZGi7<Tu4+eu-$;x9dqlu>PrkL5YiIUPa~
zgjli}Z_*+2@I>a^TzvT|tjs}o{$yA^-P&+%7s5RuGu|xRLgX1WD9`UYW7~39$nw63
z(NXMWlMMUvvy_}`vb~=ir(_uKptJmJm)cl@;5XvJWUrHPcnJ>*0<LYX6UNH|poHNq
z4yA<zNr%7^qF2btjf!%e4c?Xe^^j<}^e>Xoouh^|o@tvF63*D&8NK$L-gS<^P3t{J
z+Jp0U+r5Qum$a_WhY7*hA9AUB^!nRyzJ-_mS2&NHGj^^8BpA{h4HpWhpOgF0yoxS!
zvL)T>&Lmmhx&Kb{LF4jJVoz`!_4^U>A%4&K`*eWTY1Y*;eXi<ph)k2|w?tNBhHKNR
zC^&i#W~wM`@^G@DM*GoI3`K|LBde~%%forI=Z}#<?CwI%2!gHWkPOOa#Pw>qjUD#G
zy0wv<2u+T;1N!6?^if~G%ca4Kz{9q!Y(v7YAhiTXtA#I0*X_Y?ckn6M4E-89Krh`<
z-jMU9D`x|M*JT_LA_#pWq1(ptg{#XS+xAJ#FZ70uO+toZ0y*kEz+{<rOCcPC5gjR?
zxo3*--hWg5u)aDbI^;Xs27M!&{xad|6`g>a-8ZX=!RqtjQHJr6qHm<th;Kd9ng_}*
zK1^MXMokT0WrYV>&GKQZW&RN$bj-{h;Ft>m&}|uQOHUipI7p@#r%2H!0WZ|ms|mII
zEyON;i70JH^RG5;twf)4#UT+9_BAeAj5zHG+uElM^|TVX)RHbsw37+5)yAKrXIfT(
zOwulykWEs_xO5vo@?P3#WQQaG{&`V(f$g*#Xt@EiT44ZWv07+LiaKx%+jJdW{R?FV
z0Z|cQ9X<eG<ZHHB@h`qeFUY95T!)1(zNgs?^+w^w<om}^iekFb8&L#f%p01%=l#v(
zOt5`5@0i*@MEA+YabF35U8)WI64$khcg&O}yGf~<_kRfzyef2=veTSD()f0f>iCX-
zjxq!=hu*x6TtI?2SFV`X-06hgkuwsMeYvU)VzDqZ<Gdu63)bhL<C(l`)sWAjiw-;4
zPmS51^AiqP;Hwx~A*Nn+WsPS9xRgJGX1Ulqm>gV$;z{WKmAs*lr^T)bJPVJo{dS*u
z9~!rpRh*k~1fZatP7GJUYs1HFFNoOQ_k1`q0w|*c_Hp|$R9_jEy=8Q^R_*~sgBBOB
zrciwbC3WPIyQ@_SI?<8e+qvWghlSvC==TaAPBlRtV8;T8gi;JZUt7tt6~m~CARrFR
zo<jdZ+Qy6mv<Af&5&Uaks|I_jIK)GM$%D3V0fys_XM^x;uFIUv^uqGd-{g`$&zFjS
z9$9;;vj%iT=kb4t8{h>5B+Ja>ngwL^zrZ|u-<<R|t518HdZaI%P31DG7XAURGv((%
z6CqB&n}xalk<<*rxCQFdekNv3<z(;HFH-^a{2(9-AD|<Qh-Y0M<@^W`JPx!IRD;L3
z=*M*#VI_83E;$6qUyDC^>%qzA058DoBp1i(yMUBI9TsvO=do>e?#91>o`C7!hQA^&
zZ3-H&0sV&Lq9w=`A`rnoJL=MHjNJ7F@KjFENHL$doj}MK@#OPLQ<>m#LFP8}xgFI2
zQk#Da2Pvujg@~`klI=XRBJzHN=|KQC7y!<{hRz*8S66!3i_ZT-LDBhHHlZEH{erH2
zLavQvelD<MIiA21-oyoVm<jYimv`6mlDYm)HS`Y{Tko@=i8=s78_`Vu5|bD|5(Kl~
z#Le7d^52oRfA@dKA0w)DkaskM8*dy~S>7dEXI&a65QPMaPmz)p8Ae3>4%8)D`yk)4
zx7QdL==6Syx1X%%2Dl{JcR56qXbhjW-7g2=Bk#-YUCGPr{Vdrlm1TIp__OW9k?<Ib
zZwV%bc4cFZe;hzYSb7l>z3=~-Cu=kE(I1vU{~lSn6nRX*S1c`@ReRCB<j{n{Rsaue
z3VJIzu1-I$M1PKG3qcgL)gfgub(R2UfF-~gaHF347Z~=8(<2Vm!NW>#m#s*kXkV@T
zq*2-6$s<S%3}3Lc9e)Afgh<A7&2A~bVb1?nfrDn<HCwBL%;!<=a=P%PA0Rk{m2#q9
zF{M|LT3N>Z=jqQu%lpLE?qfe&0I65gRd%&>UhB;QE%yi)iwvw-p6kO7GC#0CE_#jl
zkB-UFwR_fImDHBKbn!=N&9j<|6OBAyCyIBp(Z5!hO;+4zKSaF)_nK$5a_H@VCF~SH
zRc}CGgNfi-?zLv;wdM^X=ZKmVrzrc7C-ecT^NKhuVdqnaJPWeZzR&JgJ2>cl?@z}4
zR<m4y$r{8#fzxGPtd%GB)O=pfttI|Tz0$Ks0ID%VA55O)Y{tb|9^A>CeSK%j^K%M-
zCVj(~A6Mos0?_0`p+8GY>A#?T+2>`(v;g54xSp^zfV@tWy3)0_9P3CQ0J@WF67x2W
zw@txWO8HMm#>F7l&M$HRq8RC(P*RlCl@|4}%|iWZWd5TYfPS+o=vW$E92LtzwJ0hV
ze%%TzPYqm~B*WZ}t+9)pm#ce-x0gr}r5}XM?LY?nB75-vQuhF##k!>U@l(@9=7<2R
z;TJO4;hp?&7yh#d1aPJDwH@EwcFU?J^|kB?k=0v-0EeSvK3>T!K^#V0pG^Q0g7Z~i
zJvS^ffH?+`#xC5HOax`uaID`k2fq@v;S=-K7_x;rbNJ=Rqhi4>+XrrWz@dG8Ss?vK
z1$`SpFcG{l$@yIgK@4*7(&OB`jyC{bI9H13MK0MBN(LgQ*MGp)nA^4i&$Pze6MCTW
z^)A4uoSgB1^u;Ukoc(Q8{$+1As0QK{m7jA+yVueQ3rO5=>IAez-FiHo1B@tL1_duI
znGA6s^9Z4?I&1}#Edxd$$^ef2Q4-9r`OLD?aMyYtZ*o$o534qb{AuZl`#}iD(k&uQ
zwa5pUTcLTl%fkRA3SbaD8Py@Xp^Y6BCqOg20L^#~%8v%kHj$l}0?=Y$T8AtIs23fL
z8~@QyY7!83ifq#fJ}SmNg&+Uk{LZ54qN42Rv+V=*Y~VmS7=EBJKe+EO%(Y&8@{2hs
z;x}A={Ks43UGmnBn=Dl1?~nX->(XzA==NK*4vPL}Bf#)fWN`G^jCYCQ5tV3Ns-hGX
zdpne5ytO*l!SxkjSGR8l*6;*vIRD`qg9~6H!~4xG_!V)}PqAJ@4eXv`OP+d$WwYL8
z6IzxLkCDJJxQs)%yyd`i`JLbkA)xAX2l)pbTV%*5+wa>QZ?EPitEvNxFo(+LUb|YI
z0xbuwU;2s?1U%EL=x@vdk~09{k^@j@OYH|+#DG9{`)FOzlfXa~9}xW|`((|augYVN
z;rNib35Jjc5U=Q8YC#u94Ny`3!0RI?ovu;g)(-$PfQQlWAP#TIEbj&@CBTI>`x@i<
z*>JY#)S%Ribgyw%`F*#2*jRpSbvB}89|!-Q&=#TupsO?J2iwE)W1N<=F2(07kE{da
zAoC|Tq0;Ag07V9(bZ%Bxe92aHfi!w78o0IP0})2hMih__?^mL$H!gxEvpG=&>E!eE
zN7y>^*6qz4t8{}1{%!tz0EQoq`8%=kdxBliU*9U*+;o<IExVDkAkIeureq;WE2X#E
zc5efbcd&hTZ`jwPzRJWC%ny$lT(s28p9gt@`yCqdA5R7{PVye`^S1~Nv>5v?AOBji
zjt|e{u&wH)%$ISeldeI67CwSsq#qkMlm)pQp=3EwcE=y}JK*43a>Zz>-{IN;3~<CM
zFiqRpa*N|w-AuY)u8=DNH@RPGpa0B1TYvmHc1*^$?kjk(8@yr0oD|Ze*4v9-15pkg
zv$Va}+oqn|=0`}vgFzqCm;yjCCa^*4V*^l(2?A*T!phNsLlh_gSNejhRxHV;zt0}b
zJFn#lVEZg8Hz!)1f^3lQVB-0_?z(T{2Ey6@t*@1h;NDW7cAON1xx8uXKOV=E_5oic
zVBUD3Kd2rMdt!;`lY^YNlbraWU;R<)S(Y~-=&AE*hC|SgNV8nSa%0?ooVr^Okc+!z
zs&|pUrnl~*Ljl4Fi(Ixkp|Y}Jf#S)8c&-bv8?clG-9D^Md}!kMHUN_??}9jSY#n+V
z*=@wtRq6tw`IPQcj0Zf*oKs|4!ycs3Rv@T7#g_{NntrOAP)#>crY5pZCS%$Fz07Ib
z>JGA#RaWLN9}?iQYvvHgp}&@iIRbwd-4@S}7uoRoFFBkDbfZ_s5B0Mj>T^84S#O!J
zDn&eYs<|+{dgq?)3h_1n9~gB`3+*_FvA!c@v3Jwve>|G(x86ox>DqZs@?hodOFsYi
zqSF7s==8pp@;r^6ENk@9(VF#UUJ>Y}c|&a&-(dpSq+QG1hjBG<GCx2q&;>zmo}cqk
z;;<!ok|6+qzNk_0NO|r2VC_7IPl?0K??>-}P`HPOxZUtV04=xrun&5CbeTTvJMz$N
z?x7opc&T8njJsY`_EOYL)NJ+tmR#jIx8h!qJCKDDLeB4azUdziGsqT=0GQ|nCz-S(
zF@^w3O$ExRh8sCeQ`!hRx+QzY!Pzt5se_wqDqS47;bh;HaWA^QdA}}F+81mX4F<wu
zUaVFKlzeN3%1eJCGlMh3<xxrs*K3Oos1&=FSAYSMlcA1<4c%38S(iDwFn6(H6R^M2
zq-D(F*q#Bf;E|y(c^v~mGKqb5Gg5~=wu8t(YU>BES#UE?(AGCY>tU3hwiVqWH6|ar
z9-b{nF3l`Ob`E<SLQL1Hk;9g@yYJX=lx-v~=0RZg`B9h+h@ub7E(DB4`G3q6b7CCV
z;E>xm_G)NR_#4Ky0HFHqa?8%X;4$@om;wW}g7*oCYF#9c<9GVbe{L=|ZIu=DjxPgP
zy%gGAt#iU*&N5JvqMmJ($wz=SK^=h?`Y@K}{&JS%H@<o{;lXrnrm30QG5%=7IH>>H
z2gGq(^C07*q7fRZS2#;+i!ZF#Jgv7Z2=Lc(JdO1AbmGb{jxPn5K9yfFiwkH5((8o;
zVH8Gdi<isdf4lZCD)WFSrf1t_Xx54M%4VE7_XqfD=oj1D|82l0)%;XG`z_~j+uMPM
z^E~-C&w|!Y@!r2=YP=O(um}9yX=uz^<yb{coV-P)w>&pM5jj`G{VOA~hykzFvOYrr
zMlhc-pQ3Rtd)s62*%m%>?gvO&as}q`J#}f1Ct+~~+Adex$DRw0asP|H>2LF+{r&~P
z=iJI110L|dGvGb@n$m$rlw=j71e*n;ZJ%CNvbsn5cIUn%m23xnV_Fv&Z^UdbuzTUo
zm0>66i{zlP98UE)8~y^=uQpK7z!C7fzS($v{3VCD67AtvqvI=jqjEsHd`+U<^jGWX
z%yzt*YXkS>MI}-cFh#^xw9W=bNze1tzO<}B1d+xNKUBV${yf6zsox>+i`%7bh5N7j
zo0Kz2Rdt$qFp&-d)u{Cz8{?3xJqO8RKxAED_BSN7P^AtIXak2|ZT3IrerO|d0l<*d
zZsliLvHK1|)cNAA5oK$U<#cb@$L@&2U7p*)<eie<56VAVY#4+#{JC>N#l^qkmKX$T
z09SE&Eo<!?>H5DPhY$Cvc!T$r7n`<f<Y#QkpFaD-g==Ozryut9e_tCx&O?hg>1Z)E
zf`wJ{n%<@Yc^R<jl8cT3w>!IoQyGyzKTLfAgl#dF;5IEF1w|169{fj`I=<gg(bEvL
zsa(Id(`<w6-esS4Q)ut8@D3ovdgIUXHhvTx^ECRcY94I%z*+$=4A}snGTE5QHSafH
zsuq-4hF@G~^IgxH?}3CY&YoiGc1sp~@O>+?<HJiWq?D$?(_MS?xL;&k@4NB-m99~g
z=GBvm623cbJ4y_{v5J-4r{EA3xc9{c9;2qHdpk9IP8SZ9eSh^WZ>y5~!^Y+HM8u>V
zt?kQsrSdOIXxGV$`;}3XF&2|C9klfdES531!hnp>)rMck+2Td^-C(}PjE7+S8U2*>
z`vdSCy0w8DsPpIS)9FL{@^VvVYcC|Lr+SPuZh}0{#FV?g5cR20&#jPI0Qjv}n$@VC
z$7x~o89Qe48np`elwgZ4)w1&dImQbwv~GL^YF6`UQ^V(CDWbnVfo>npc0o$$|131L
zTR~1-TYBi}tiAt~^pq-y(s_0(l*|RqQh}1CMyYdyG#kZ7EFzqxZA&h<PFKD^Jrka9
z5_(=fV)*%a_vhU1pO@XMi;=CxRvpDtuNl#3hFoclJn}y#TKRG3k*DrkS9X`I7%xq5
zZd;+*b$E@E+>?goYgtS!mfU~R>q`wcYiwaZjqXU;X5nzi!ojt4nCyWVC^4I3Nk^^_
zy%2C*bR*FLft;J95Lfka(VWlFoJoYOgqMX%x59o+0{bYN%+L?gT$Z}hA6cd6&MZQT
z8fV|t1!;M7swrRCT?1lPgK7zW&Zm*h(a4x#)8SX#z_TQ^`Ye8<$9FK4OI2}=T*}ox
zT}0K@C&+dZGI99$0%5bzSj|uBaj)|bk`n}G8@8ez%6)*AN9YMxdKIK9eE(w8-Kq@a
zT}B3#Z{g8=s0Iks80Uwq=9Yi%L#=ivZ6={B+OdFy0I5Lc0fOj+1qx(zLuSAy|1p7e
z*dE(Uu}tSP*77o*P+uBf>bj;8RFcfCQm0nC7x?<jvrN>OE`-=KzGA6(1x3_HaU_&!
zDCArYzk_4Rzf^19Bma`~ShXEo5TY(b5QRxSHKC6p_DyUj%-SM4=TI7mHNswAVY#tR
zGWGZ&h@g_r>`#Z2he$UIGU?A&kZ0x}I75e~zT7wR2T@Ky2A!gz^v7YWu$3Vb#^d2H
zP44@O?XALw_oMMJrVBI&kkI<2gwSBmAkV?}11;s$oQfeYoL~WZf+M(4={DBuV{CVQ
zvX4V3aKV_KGLRr4Fi(7~%5e0`(fEiJb;*T3MM%og!drX>z*DEK<QbcPYU!L1iTc3V
zX=f{xZ>Tq<AzRX#_fRhh0p*AwX;8Nu!3jd5O>9SiK|rtm^=R&?IEn&>hH&($2>pvt
z!74&G+Zsb)*%CvUqUA=L2S0A9BF?m|J+L!8p^bei!Ffs})oL))8x-6^^QNofLLZw#
zCTcgYb;>sbS2{83Eq&OBc^Z&mgUY06kP_!=uoyn^Th)I36Urt3oQqKFeU9vzP0)?M
zkj?7%51dXKft^kGylIo%SB<NxdLHE@r8$c=d|9_2BxVb<@B%Mo7nZEWcK6mQncxYF
zbXg^pFZweZ(ah-KYV<l@6$=qfc!2S9l8+vK?!;M-PP7nNaFk-q_5#|_+4N9$_^}|L
zwR#_v*Db{_5D>{;x^y#Xwb93;F>P99_hX7K!{n8gM^z81NG3<p>*oPJF`QCavm0Iw
z`5MF$(|fcM1@c)n8V1BstHMl&JM`+$6BgWQ(F^n(*A&tDx>1t9pJg)`Xkg#vRRgy2
z9DZ(9^2(~@t-Of|o(nQo`;+3G%ZSZY@8}ap)7(Zz3qxS(lUcg;KkmT$ro626r_#I6
zmujSlawNA~2GsqAB95V20&)uei=6(Z@-2nHenc4N?2yb#14!YixlH84k>$yD6|L?l
z)RLw$<rFF)A(t*H0@Mio9topP2(98n5AhMa7{gyzBKaq_Ax^lOWjj1)Ph2Cscm<yD
z6Pn;gpjAn{!}Z3)^&=N}BiuZ~+?ey3p)~IOa6nPPd}Pn^H>997&UF-Z_=btB^v}7H
z%NvG>khsM{-DOx8Fg)BB_jv@XmoK??q^a1zV?!2O`1Z=+&Bceu`BBXWs{?DuFXnx^
z1Xt`qEB0VC#ceOa%t3U1`#!e@m0uUN!;}gd;Z7>A5M5~YqzbX{3&&Az{z?vVuS?F)
zpPQdrC`rRn(hX|j0NxW?3rw-|MCNloZv15d@@8Iu|M72*-GbcD1TigqZt2wXQbRU?
zFGyRrwljVZ>#U)*I>~cdrA2GCQ&ji80KcU%ut_L+tE@4}DtzXTm8c4Hqv7d*%!B-v
z{#d%w4pzX%cdJ!F=$PDGyf}YTSxhG43X#-PHdneuBb1t-0GUgKtqtK4auy@{CJL{D
z5K@%)6*qaJFtC{-f?ew606%K}5dEhsc9F5%!FR(WGJ5d?EcLR2baxs3=UwClH>AYy
zP%aYGml|?A!NkII$TP3#dz8tdqR!7V!a{XE?oagsXtk#6VG_Lwel>~Qt37a&Fn+Q;
z_Qej6XRDfnNc+bv2avsnn6Bum2A2kx+HgBRqP+b+eusVhl%|EfSTzr}QcwpysKaC7
zJYmo~)XGW_GkEu1VWzw!)UL8rHdtt}>EQj0+`2&beKJhhtct_Egs<Aeb-+mL)xSkJ
z1<83CimcbqR@^_vlauvQ60gqj>w?7_P8gH_oxFNM@C24Bi4~C}TNNt<kD6Su?y$oz
z{FwbycSPqfMI4~-n2f?WzgN4rS(3NTTYiiSpsD@4<FF!cBw#&xq*^N+BY2&gB<|OH
z%kSkzKIa&tzd33fyeC6oL{E@(;hk*2P{@t;e9i)Fg>FT3Dg9~AULuG!7J9?i{|P*K
z$z<)6*Db`rOve%n*|E~)!bMeKQ^4%tT(-T%S%MTthXmpCR45zN&EC+R`{eQi(e{>M
zMjH-8YQnLlPjX4!14DI8S+GJ^5r=S$x7fFHxpx}VnDZ}1pZVaZl{`Z#7(m#p$0w$`
zJ~<m1^(}g=cFC;e4Y((3>QExY0aINAUMF#lQUphrM%^q0s?i%J)4elyG^)f$2^i~>
zw^o&bS<ERYnjQieGj>(PisLpiH=3NrW{xXW5z1L>w{Qz+oZUQKFK4m9M5gG5MvW|t
z7ZAkT)Bki4&x-MWSA<-A)^0Ewm^-rU+9BtbVQKUsHW8+^M*6Et)qwrEiRQWV&de3<
z#)WmKZQ(*hVXvPN;<rNr3#1`+e)O@>Iv;AjAq4R2tH}R9{=}jL<W&`+2g>Yeotibg
z^L)#}_nWqfUEa)d`)~ZHmQxL@cx+e^s<)u@@U9Xh#Z^}$!gXdYaiL&TvxrTAR))J4
zC;$Dw$GP__BX2Y<q-RFGzttn@!va0Bsv^bn#d6aA+wuPA9eURS3?YQ`!1#Nb;r(Om
zav?!?&2x9E=N^Ms{iwiO|I|(b=5#kV_aRrL;y%e1k+M%`W(zQLfis%m)iaYyK+I65
z{?w524P3dTu2*HAa&g2nQ^{*8aIGX1ONHr~*3i@X7^=hm<*IeYxrD*BWBNz*rP@UO
zSD5E;tQ!uuO#%WbA-hPUjA%LHH%F5jGxX0zjIj2{h^dO4IodQ+0ZnyHHek86J!?!W
z2)E7YyWb(X*zIAE+EU-(QDyPC5`n$7V5PJ!yR8mptI7Hrnk8E@&JDP{8cN<iKOn*_
z`A+7NCQ!#p;?*%7c61$-!8hhreQaa?BR8zNgZahMlXgTNz_9b4g4d^%2sD&L%1s2{
z+>HDxiZoasH3w`OvT(IZ*7iu1L+jTNSYg1Yt*Wg8uQ=*)5U^7J)W+0!0}tYS4UUMp
z)qMv8%e5-T%n>EIX-mmk2Hi4p>fK2d$sn(M)vFt}e=ivScxk;xANUrT3zCS|l9JM-
zSEJivgqry+#o4<>*qvTy%K|+SswPiwz7>T=M$=!yP|;@uWP~x!GoiLChEt?LI4)vk
zLWTLJkGS-sV<v$r`P*D1AT8G<LIO#o(1dqlxV2oQOcT{(ddFQ9&V#0MdP+5vNY|`*
z%}?q6`KbX^OXNmCS>lje*Zo_^1GGrBj4(N(HX~h*;h$64br%<2JRybH1*f<iM(YP?
zIVc1<SPq+QT&JN+BG9fvxv~~R>f4Ho7Z90)lysx<f%|q<a`18z|GkeF7c4wW?*s#Z
zV6gi~7>!RF2+GLZkPC1`XJ--?dH6f&s9aMZ^%13|gSDE-iS-)#&{Wh>^mxwbV^rux
z_v11xfrL1IbuXh~a_L6Uum{@YNlmQiBl|GVYBFjNOP<h$#k#(vi5VSsW%sw0xOcgA
zA+QJL=#0gJHc80TW$vo#ZGTUr{^gPm8}RBWL8P+YN$3}mW`KxY;v;pnSFv04Zf|!Q
zgNMhXGfC%V0ET&XH)^jR-u^JYv!uBs-F*Q;IWAOJd$mG7TaJ;gztGA_A1i56XbL}?
zqF>A?A6mEPb^``ENe<gc=7W1S>sJvCX-pPN@etw(3gU`1Xs_hf6;ATJS7t$U#9!Z#
z(WmD`Zq$7(RM-kl@-Y3aU0=9eeWp8KZiDg2<bv%=t>ADCFhJO2`H~o-Phk`Yn8P?!
zZ0~8~FvM`Ix<@V7`kheL(QW_+Bk8LZ#Z&2$iGEIy5fY2Ex(6G~dDO>>*|N9~oGn?#
z@PU#ygSl(f%Rtvx;#ZL}tU8Q?PNt-P@UGxpp3z`?em4hxxAR{wz;~WmXi}<dRYEu;
z*s8=)Rj(XcNM=cZC!OHtH!8T!9;tCdHoC2^Bskcy8!HdcqWUS~ndD49;UCe&fZT%0
z5n54k&Oz<6Wa0H#$@~auOAYYqLCIcSqvRAipdF{mPJokT?k~51D?LURRVtuxnhV?O
z8@gdGJBO_4@a8RDIT7iKYot}sDl3l5oT;G7F-}TR_JP$YZh<9-`jQU!mDm_P2Ch@s
z!gf1n%k0346Lw9<PDRLN0KuWYa}@jCpsi;)sfSf02N#d##D<+|?!x8)fdvP_z(y?)
zYsuboh4J_->;0Okb2PsJ{7nQfi6RamY9r1AQC^+jJpFR<yt5WX9lF}AMZJSpMfij0
zXM>P?qw$W139=MjWB`m}X%yvt+XS!XhJ0`6R+d6f0<TY`ocN|i15#|=ynL(?<$;Nv
zKI1+rVQI2O$D{MH0_1=U{#r$yweE~{9mr?Nht|0o!0n*WUy=-6Cu$(>pr*A^AFb@1
zqd2Omh5M?H4CaYHT!cI>T~9pQK>W<8qa1EL0$jnGRRU29-mN7;ttG>+EPjN*rb1hZ
zJoVJoJ8*qmhldmKl*&(?tgU<?ysGjA2_MG866W!R;`s}wZ}~~yN&u16grd}mnLnEK
zos9$qiNXjClkjNrL73>HbIqSgTn-Yq`mV(DmWK*p95~mgL35fFQQm=19~k;yGyNHw
zv-E=a7F1NEg!tV%8OheV8Vb((IpcgL<3Cyu_3Fqvb;*@C6;qniL?&)OkV=G6PX5j~
z|5DruEng=}S5B!kIlTQ<Yhb-5eMkjzu@^0}SiBFf^QS}GM0VVt^Z`g7PaKN}c>Ry_
z(t%U6zcWlb1>Rvo1u<`R$D?1|<0R+Ax?mt2#;2V7IsPy0tC0ZeMh4VuK=<%JN-~F-
zBXg)<p%{JKP3=;%6gVpzxluDJ@g1@X9BPlI6^4%*|1N}_N>q<kgb-KSZ@P6Fd8mip
zS{q0liTF~Pv-lwth=rK#mAgs<fz5LRQZO?s3<&Z#;SSRuO0fV;?LlgD*#*l7hB=X;
zRFs{w@f0Et`#Xbz6i?s4b^}5S%rvR{p-Jdw{VUh1Y=&_rZ|o7PCTcHI*cB;pkDj8L
zTW~WX-BLwrNX5=`CV;^4PPwJ|m!`ts0-1@N(S9hsXF9--lL5($P<(AirbOoLcSfI7
zc~%U&g%XpoY2+tVHSk%~;z3mtT2%rNxCn$Sil&O9MT8=wN2ni$*1JhV;Ar4?_Jdlq
zfI1QKFa$ythEs`ThAa`rGI|4zQ-u6ri@mv8*jAsyC76Hu_&?7Igm~LJI2Dhat1!`Y
zqldlo4C+i)@x1+ItTMgckA9!mZ6l#M=NYM(x@c7i$JCO5f|n0XffLMA;4Leb{<}(^
z1A}`qHy?^`;!a8cacX1&BzshW!U9tfTR-aZZ`tuXBU^4Jn%c#vVR)U#b{YNs^aYrC
z*p>G?5JB?Dv{r0+$H`zm{L|q3IhR`VW<kuWO4)Ce^!ImFGhZC~dmH;-oBxpGdmKgF
zzbEHPHYaumN>D2NDpNWpK#}HwqeSC11AdOhBdY@zOhF8?d)ldIWrb1lI<Vv&$8>S3
zAk#GOTzWw6y-|Jf4Tr{$76!!agRgxLk@G@hLIZ)>K*%o)0XlrLAYfoB{n?UN6qO&n
zrw+bL5#l@e_~fo-=R0pdbArs$EpyH(ATJ=aQ@5Juq%4hNz>ADZzCTlb%`sL!1X(~v
zGV2?4U6%hgY%Ab%Je!Rv!d2Uka4Hs@Vxu{4lNPo6I4zt$W5bMEPwbt-8IDY8jo$R0
zD5l;)W;r4^R{cWjhYHb$Lm`&|eI%OX&q+E0E{^U4{ac0sSU*!Uh0pH^x~1K19y5~A
zpI4&q>DRs9<#0m!kcoIbKeC1&>HYW8(9Q$A1#|RBTRZ(6r1c8YBVi6vo}a9a0Nmcy
zZG*1l{l7$@V3)k4N_lu2qx5rOjz*J&#-lgP?tW0K7V@w*L_RkOVG@B(fRpr1qWcbT
zRO~PeBELXD;3C)wXwqm&b;<D!@6<KnLsN_;U1anzTu{WNv*+Lnt{>g)YN(Z4TW8X@
z<T5Lkj5e=M@C5+I-;4(+j+^n7Pn{6zeWEOHXGN=^80S2v^I@rB%0YgugcCqTpEIOG
z;}$>ar&b$$!&ohqFhUl3^B3xJfq7PPb~!HWmNnGETIIqD%Ybx0jevPN1Z4j^49faa
zJdKNTnIs_32C@Eu@_2jOn|{2bAe7=J(+s@SK1RQy+ncxKdEnp7`+rSS`v&OF$z(l~
zj0!zOGf=kvd-D1<?Q^O;XW{Nuet4MCnTb0l1JRY*9+2?9JE=@1VVFv@tQ<iVkz~8m
zTsYO_H=NA<&7PA7K#y*m5tm8n3&h~+LMuj(8P{iXEcP1pP!%tsL><Q;U3)mXLHl3V
ze>K)xK*&wzMBB}4oG79j2rez78nq8tr4w`~9N&4;zL9$kqi(0`ea#~{?2b~IQvG8}
z+gZ3}V4J;YLP5^zXhU%}=vZ%VE=wuStxH_VBw3Z)A#6SGvcPLD2TmRTzc0vHXMuO0
z^g`6Fq$@<tW5u-u<+}4nXqCez3aB#`l%!I7=lN_gQ^hS>f6S!4O~m$+$X`=~?RJS`
zD$ZpY^6Nhfy};Hr8BCPC-7B2k!>J343$<tg3Fh{FVEnD&Jtyb)v+FSQ1L%fr8zyA&
z707umI7b|{q0I+D#1#5ZUF2@h#<WtoQJ!2d>XZO92QMD;HT+LG{i2$8)=$gU$%xva
zOE=3t_V6XBxm`=+y{VW#btCP-k-roXtLu=&`@LjwOoiskouKm;>HD)4{qObT<{1|T
zieiUC1!8tVJswL}77G8ddQiRT;JbhXO#VFVhx)@rF~OE+?c7opi7g}&Pbc&iH5H*v
zDV;!=u#VWV$F|#!J-K;!Kn)irmych*5c2wjcjz`1`eQTZiJW?u1Sh15Y*kLk<B4n!
zT;k#05SWvb-K#zm^r?j0RoTq`EWMDsxo3N}Wk?62|5U^9<`WNdacjv5kB?VQFFS)B
z5Vz}4gl2b$?j$gSBqazF3W9asw@m+7IpZQ;1{_4YnG{gWPRJ6{hk!#dwCUNIyy_`;
zuMjCdWkIE0_nfLO=${KH_q4quZW$E6-}H={>~BAvZkTc4fmW=#CQUs@?3*Y%T!?a}
ztAnpErzFI*Nr-;-Fl5m(5i3NZ=n;hGe-OMExCv_)ct1ebzu<!og6PUZ3=JH~v#PQ3
z+!*V&E3(Db&TT^dTX6}n_ZiQkOqV_Tef}i*+wY5c%mfo~%SB7tU`J}G&F;9gOQqrG
z*D2Mq>{D9=e~$6E8P)wO&HJ|*I=q)#<dJ>~y=#E)(g6w<FN^7WX5<gh1$d%diu50;
zr|H90jP|@{MqGJ^$=#Ze7=HBapGryZp*&{Am8~pE2#Wdr8>O_F{{7D6n|l^jVqUDT
z2#Ey@#?R=)YBKM3ap~@GKnDPadx0(ZT!y}dA1K$xl|CIdHHulUY6d4Y`su8j0Lf$0
ztRbZ`i=K#qx}Ge5AyXbTeD(|otZ+0Rh~piYbPC4~6c`xiz@bMj*$(f`FPfRb=Xw5V
zYi#Cm&b{pVz{s_0V0bu=vZdg$wq3!)TC@Abw#MtF=@D|TvS>YL+fMCiMZP5*4nbTa
z)gY=<#$!k%b<~79>c6hpPkwHZNy)~HZQp*p*IHQ)^mUNx({<2G>&rG>1Hsuk?*fYp
zwL%?>)0Spn0a8EEXKaf8TqnDKZ5uBbk(5psFDIWV-yx-PsXnj^S4EtVU(+qm&mU0^
zpDQ(6v{dO30}4^8o6x%(z+Uf2c8ry6Rh+${G7R3mLUF5LNG{Nfd$)3PH^gy0wr7dH
z$|m%%J(v6*RyitzD(Gyv$NTi|ZF?(Zc!}Nr;?Rs`-2b4)Ee8Rc=i3Lu>YyWBW<<We
z+A}jV^I+fi^t7AAh(^o(BjG}7-*u|s`jM*w`k%{RjPT9=#c;aw0=0+6$9HwIKZ_aa
z*$MWEU1*u78jYG@@GUGIci@bwwV&0}28!cJn4H8tTm7D0=wFyBn*C>yWd&?$B<OWn
zL6y4~O^!W|PFrjeSuE1Vs$irItc5I(&{U@?Jui+<tVe9AjOox?m}hnsLqglwUA(^T
zpJJ0gL!NpaO$}xr{YW?plw8pzgkFXN>Qzi8UKh#hglt*cwk^mrsPDXKBe!j+K(SvA
zq347C6Pjt}I@XBpJl*?Ed+2}qVmVuK+l6dBY9Ed37L6}X={m~?poi_vb0s~E2U`E)
zPXPCF_Ws7oWE4AR#pZP~(up3=3~^H~lKm`dn-$>NcrdXOpRfGMk9p)=PWzg6zQ`u{
z3p7|#*s%T7Kq4kh?0^^kbcy?35OBnJRzUe@tul0eTxkB7=-mV0c@XzXaBYL9fXD*v
zp=%c}Z;%{!!x(dh9_d%Y*8OAc_xr)0dh}#Mk7=%%v#|Jj<~8A|(ED#0;4eQfb0^T9
zPyW~aU+tYYae0>RtlVoTC()6_;}DSf%_El8dP!!vjL#a);1k4zxBbyTnC|6qK7$-|
z)r5F`PhxzSb~CAAhOZ}WS)3VQrqK7pt#I%k$6bZ`n20(=yc}<)_wEkznTAc!f)%yl
zJ6=u4@GoH>`D9OhKeYI1=eeUEKk1R%in#yilP(*3hxo#J(t?P5FBPSx3X*&7RA|4F
z{6vvqy}2PUc0!2yUyswOKieM%YQS$tyYuwA?(OMztT$ZMF+^2;#yMimt<i|<jcKcA
zlK$*+Hj8!Uku8UM-Sq(B=qrNF*zykyI=>+66}^6*f*h?F51mxH<XrCuX`{Kh7;WPn
z1anRYGt|azzDi-P?}t+1yLDukbsgK7kt>Xok_IyN`}Or7DjRnmaPvD=1!P@*TUf9^
z?F+Hny6+#4M})u_6NuGQFN9T`tGhPu_(N8-{i}CBWy(E^Z39;j0$7z1KZ??(u-1ii
zrbG^w84v=~c=E?U=IoAbiiaRJO2QcF=`QB&C8b<EGGZl=r}K*iEe5ZJ%vM0(_31?z
zI+6A?It-U&ZkJ|$%{|P;{Ok;^)4vC%zAhP$d+OV^qi~zbvnxTbgcKp>-gAEr)o$zm
zdK9kG7nGNh>Qh3Zr23kjochIO$iKbRuOB`+{T9`^fbP7nQn8}fVWht7_jl%rM+7m`
zUxHYFyu<eQmm9yP*%%UZO7G-*JTp=lp)tOibf|l<aqTPJZabFdYL&4x$V-wju3cS^
zT2wJYz&hc9*XxWdoJIf=>tNO&4&rhFq*3<&A`Ob2f#SkX<z(7k@E;CqtKTc^Re}hH
zF3r_TF5-9V7vfc<TBAx665#``f|!pep+EUm)91g{#*!r_WZlZkGsP&dmg_K6T7R_r
zOv!$Q`fCOOnE6SEsYZApBQTeq5r+kh^W>aq;Nu)&G?GKCHacuVUuJxRM@BRA-mZTj
z=w8fUx7*7jkPx#oR}l1Yb#dyf!fP&a%pdMwp!Z8SijXOHzU^MuGCSPND<x-)A8d3(
z{8txn-~^yWt{+{94y7NZa#qHL-YY`B`TDH!zKQ`ek6SC#M#kgM%N4~xH=2R9E3-w%
zs~WKwbg-bluL^c4(Sy>{HQ+N|t>yQ%MqhILg%<8WYG3Y>-3(p)FK1R(S{(fzDr%6?
ztGH884|qz3hTXu<Koh(lI%E5I=%Ix6)oPB;$;>);`7H<oh1!@cC9;Qe$UyC5luT8}
zHP&xSa0zZ@3JF$@COsaaq&qrGw~=bYR@r^9Td$gzxaL)yozW$vdG)VvW<Omr+7Ds*
zOV*~Y?&D=c4W<T>-y<IOq&9!HTUZ|-w?K#44erO1=7JYW?G`E>3{$K1O2*qmeG{xS
zo=?hH1^*>h`z*ru^FCm30rdrzm41-@da~t_;CAQ3|9LX(t?Kl?6NpP|?@Eqym(Rk0
z41oMSZGI;lQMois_`VoI?t!lC8t=vo?7Nh0wH}+OqJ)Ji+xMLsH(lP`6YU#1>dF`t
zM@k&BDdZEAc{0c>2HKh)105Wsc^=Q4^3OQRRJAT<55{xyHqx)>(Rh!YB=T8i%AUXM
z18>|fLnp3wF7#lxZ^qm9#=UJ;0gX+kNGDtmzW0%TeeO6f(5S=sSH%S=FRV6rzZJw}
z*gQ2f%IleD=+zV-9fG6Gi!2*#ZRfL7mvoD5Z4DM|&83mVo|TtrPXNC3>m}nWw!BKP
z`Nguk!zO^U*uM*73s>`n)jzhA)JO^hwn&WqM0WG%rN!)}k7?F&zA&5mFW!Gy;7)#y
z@#0g2WH%shTPGYCO<m#($3ffQ_NW6@o>pE%dZ!@xXK#Y7IIJraMa_3G{8R0^<3~Wp
zmBuu&XAGeVhdU__=2xUWc&bu?2A|@fx%Fwfo(yu(@nOjnly&7@hTat--AJCkGP)B!
zux9kB?`i_Vyx*x+Sld@YCE?+jL!j*OuW9LluD-`cS8~;!<{0jJIFfo+MWyi5OCHRj
zsK)Dm$tEv%aCS+7jg|7N+3xzmlZVXBBJNhk%1kdIBUjv5bu#P_K5RzCq-ParEst91
z5a*ET;K`zy3!sae)+lZn8~s=vpF%wiT#=f5u0HpLrrjFT?iEJ_7F&DLft_77efH<9
z{Y)YpG}K3W{BfF1B7JR>Jpa&jxzL`TUAosQ^=qn>#Y?wDr~kv(dqy>(En&kp!~+U8
zKxsh`k*+Ac*#M~#2t9x_k=}a%8zNo0)JX3{YN(0QJ5obU=z-8%NJt1@y!XCex#!$(
zEmnT;BUyXznLYE&^XwV@PLo9rdAS=5<P*ivNw|Q8ySvqdOrWxFr_o4MOEE(TFx1xe
zIk}E7akJKW*6;*1)LLaB65uYT0GAFfZ^*(UA<#pM{qdp>EC}8oGMUn9;chSEh`!lE
z^?8d^Ma~|i?l(HwK}AJJjGPgqr2W)X3cq$Vd&`@uSIUMdvLbuIkoFF^i_@@EQ3&u6
zErNxzHs_!nLs;em(#sA8+J18$$q-x@5tpo&M)74L&j%wFoA!=l>#)|}C}I1p10yUr
zeR+b&fERCO%w*5;1CB$6UAC=&U6<BAw#kQDAwC-u*J@D%CSO9lX%VF69Z{GHlciA8
zVg|=SIRfE5v%4vg(NO)(<lyea%fH3rw^@JU3)NJf_5m`!#2+cZy+VZ=euq%0q`yVv
z*XdHPRtYz4>n*cPa)uoqte<QXMseQmi90p4+YG>_gnn`cvvb`(ymi3v)=kTlK1l${
z(f1$(U@a)jsXHGYgJwquc$Y*gtF)jH1WfA<(b}n_>K#f9#h5^>S{#cDS;%^YBY4h<
z0{(&qxCc|}*+l*VoVF!aknKds?Ev(R%zhccF{lIkRNsEgClco%-fqTH1Y`VH@FB6W
z_4K&W5n0vBr05|ecj&m;%+?qhp$Ksx{03^WWEw3&L#&{PgX15hVh$&BuphDB6=j=Q
z>Wm3m)|?+VpD_z|qHe_Gc1Wn=e#j5ljHUphm8Q}8GRkZQ>?*$B0;T>QDQL#um@r4>
z$TCldN1~$5YJjsrYp@U#n7{4Gtp)|uBg~}$g=YA%0?XzU(@LhV9Hh}Ro#lll>?92E
ziL`Z6MbqiFE3UomBRm>_mj#BBD4hmX*I~mvK?P~Sg5(V&Cpx$qtXA!B$7C3Oj)NXr
zn;~{{|K-Qb&OPG8)X%RKhWuPP+bkmAPjtOw@cb{*`$05&A=P;{XLZ^Q{^-7Zrd*__
zsqGe`fs9n7Lz~0*OiFZv^3nXt$a=Bh{7>DZ&_Vh5@Z@`~qe)ToFE`jneQ(m|4Ob=Z
z94aDY$$nYoZ{5{}qKm!Ri<?(wOy|qjMI22Co(Cl0XCMWRwHHNSi>N4vF<JG896OPW
zJz@6jF2uT(7F{TU50V!IM3T$+tZ0j)6y<J4-wgLc2P|^Thi9nYFEvu09~lY+h5{81
z#&DrY5xLC5kW|I1oQU--W6AP5(&v#D{F-k>OEN3=HC9hDgiXZhrp{&rc4Pinx<vKc
z<`KRQqhW<qUpyi|nGcYt?!_BT)r$ndruf?1K|zs^=zEijJCVCJt~-a-!kGn_h!F3P
z0lmaz1nZXn&f4*`4fgGE|8qC!vF`i{eCBo#rO(C_Yrlar|9c>z`IF5EctUWU5bg1#
zVCj8zGoa{hoca6!l<1_{_S{46PjwmC6JIycr{w>eXFc*!G0_c#WTCQ8_euH?QAGqj
z2XyaOP|mp@vsAU^BD>Kc9W2plJGiqzy=9wHAlSN6nyl4iJKLv@p);qnpk06H6RJ*n
z*sLV8pV4Nul3GzngD`62T|u;dnf_%@hy-L4$ax7!HZ^N<{}t*J>JTj8?NThC8j+N5
z8Jd}96`ENp2qHIa%dv0<uDm34^&2d=>ruUoD!`m{2?^K=6k6hyiJ$+7^iUy8j_Ag!
zXYCY?-Vq=X@JcU2PKrDIlnGtJ$lF1CeH*gvTcBX_+D;qA_~AfwNlPZiAGjvrH<pol
zY9NKzf;Y(eQw6($-oy|fCXkHYA!0pvYt6}m^Pf$zo#h6*5`m&r3r7vg>92pU=9#I+
z9=qyq;y+!vvezn)EnaV}N!}_9f~K%gY&R|*X5c;-P2}OCEt89#2fXG3Y+Pgx%S|ng
z#98!XcBf-70LlRo^q2*1>ghERc-UAnjUcuMwC0GeVAh9YI?k0=>1IvF?yx``B;`y5
z-37cqr4rMc=MkcTJf}LgX1DP(?y6Xi1mx7|-xIV5fj_XwB>kw6;>LyO7wDtS>n05B
z>nOyaA6~qtFLC-d_;}u6F{ZIj5Y{EQ7v6NADs(V1V?Ts&4YU)b+K7dui6axo8RJdD
zXt|}3JjO2NqSB@rJbg3tcy^b+L#45EKoG_#NnVKdPD_J|&McIIpX~Shs@JPHC~32t
zc5uu;$L3`xt-uS*nZiR`4wfwjov<M)in~v!Gt}}}%&TP4bY<EgriHRC90#;P1kw{;
zv=!M73R#qHP@G|DG+VxsHSi_mg(QkTj1Fc`v7MjbD;Q*8X?}#R6lRXkQ^^x!3Zgtu
z4p}q&I;uCX3ppii6?2Syrf=PZPB77rv&KvswjHR{aOYbd<x|T9^^G8JhhGPo^tIyX
z2BLXH`uf5VT^<8iGb3%FNe)6z>Md3RPNuOO333MTGV9Fh30_TupkSZmQRx^@p{NM~
zp96dU6sEuB2tO-tQgeixRJn#Ng0Jy<m7I(9DLIDG#&nnpK;uu`?zKPn<ENqkwS^pZ
zpq(i=tR%55k#J3MK?SWv%%xKJzxJ{q3d0TiViWt%f{%OCO41~$?zKQRIHYU-B|<{)
z+Qr%-yB`hG1L}_zKhbNs=oNzgq6Yg`@c3<k#w%!(&=#n|Hy?I;f$!2m59G)sXvu8q
z=7#TdlQ|3{0b5pK`Lq3g^9x1Wp;(8E<l4?>)ROp3%QEVXb$kA^;Y4-S_#J-5ay7!#
zN1sqWv!3xJLy)c<KFQo!0G+*UHD+?aL?4)X5Ka=OOH_l(l2G&I0RSp>A5s)y<&$qJ
zo2r;c-Dw0{>z3f2mT43<8*Y~DoW^J9Nl{~!2tZ}AKiRi@kwFtv;(B>9fC<hNk;XhN
zu`gM{GnTv;4Jr#?5g=t=_K{D(oOAo-(~JIx((3P!f5naVmV!IqRP4bi9LU^7esGZ%
z<L*@}E{gE`zlDuI6(8K6$RS{Gv-ZzhjK-ed&St0XNLd9ZKVaQqQg17$CjE^9dy4c;
z3NEF&V&Xn>)3EvpA#Zx?vZB0cV-2{eY*rE)BnBa-Y=e%vYLfw)G>_W{RPz{~ET0sw
z7hSb|4lbE>h8>eX_qJpL!RQ73HznExkidgt4#SGqh2TQn0M&hNjsW~d(xVod?Jx1)
z4^?>k`dzMUBUg%lH1|dWRgT)H7pcqU6m^sq-XQN<A`9ZP%}%f4n-hG#31og$LaNMv
ziy(m*1M0CdTOc840i?N`iP50<G+y2-*q4w(#{24y$hOpOFoYd;s?M*fV_=x13UcOQ
zGV$+anb#?Q?)`8MsJ@3np>Lj*<i0B21<bFCToDYVzE6P|cF`i{=n;mi^oyxsx0olL
zzEU|#g4L++Pt+eZx`aL0;V_Vn1L{74!v0#Y_gFS}`lDTm7MwvJMFX9}V-Y06$^8Bx
zicU);YBr>N>Kbz1k+26qvzXn#dDo`>{wZ!09@0~S`HQqiY6;2zko?R-^R1g;!(EfW
z6f<)XNO+zRpnlV8o^Nq>F%{4(2sz%e@(CS8er35XTvT|EBS7xwnhrc?#mcPdNuhS(
zDEO<M5Ce5f`~t<iKTYYbUmEj8US)>FEIg!2avJ?Jt9;fMz@5$Eof9`{^PH9!?{68*
z=*!_Z3Yi1I<RM?S_A2_>Qs#gPr@x0tr9VDR&HK|OdyIv~I0e%gjeVCbAkVj<qfSHh
zp$ZEhPjMH2LC5zAs^7hjs{{UM|EX*Xtg-Hf;sT%UyI?{=k*>q#ON*2jooM36ZK^z$
zj?$8$z2r>QKb3?R>L<>s2hOSqs4yNjFOJyEFT%|^CB${qD6mPF_UU5zBp<J0CYAnX
zf-fOQl;VX5><yX!Y*J1qD_NlRinirE^7NI|Ew}_zlP8tlBqeZAac26-;QSEZ5f)lM
z-|~ZWqw$%?rtUT!6u%iY`#G~e9C@#mHW(YdQ&oUMI0QYWKgHC3c{{Hj5kegr+@35E
z9yrCKpqUZiM_7i+@>DxE>J@$JE|YB;c(l*`y@Mp&ykl3J=D`sYSh1})qc7y#GinDf
z^WDIL{k-Ztr#mFf>#x^tNhvxiN(V?X{{4>Z`Oh6$W=$y=Yl=VW<ufNeJXJoGT8HH*
z9mYg1ILXPT|BFF(17`M9y1GxvF6>f4i%<R(+5w7~n8i966@_bkY4<?<7;Zog9yKrO
zHi~Fyh5(a8sSw*p%24zIoyAk145A^y(;%Xypk@Eg#wE$kdWCc*m&0+q_I*yek>pT$
zcrzblS@-A@tSNK*q2CbodN+WYPc*+GjAjRn{VGsk<MgEh@j#Dj+LuC3m>ql3K_X-&
z@{DZ>)C3LR*=-MIj&26`fgncsZObemu_nqAx-wYSbTH<M`Uu3jcx{bQQ%baH&~(yz
z)RBq*yl&2_!)<Is>ybbZHjnxch}`Q-$?O|2zk~%h%YuEho3h9MP9*)d`d8sEA_VyS
zLCoV-KOrdKyf*t~h=Lw__;ZEGhd;i@htyqVS@<CO|40a4gQZ?=5~@eTVR;B=-ozZy
zqsB$un!44>iIGC$?q=r}WAO2_{j#l8y0^{<9>`p2hg16-%F3=QCV7wA9Cf-W@FZrN
zE*PO0eCpvn%Ua%8S8uCpqkspgwZEcfTE}I(48fu^9)m0`u~T=<Jo~qHdbibR9(c?b
z0Xtg?aZdOFhQ`w!6dOlYH0LEKl9aVGiwo*kdeI*O)SaJ_RbUpGnECyEZ`h-vYqgsk
zHerYJu_`D!2#YdEr07ZE-5=_%C8`TSWO!zNU{`)Tvh#r4qlPlZPl02Sy$!EsZ#TY5
zMEeDafW}=MWuTha%?@9*x5R+STaP|XlF%ZUB_ged^(I`nW{1Ct9Q6bHD8RvdujvPg
zF-Tkk=0F)p1oVe=$J1kq{HnzNZl0BYU_Ld3Q_WMQ^DGBTTa4hKsUK&_McPq6$5+ta
zBdQMn<Np6q;V%VpoRTScQUH6$S-*K*iIc?gFE4d1Y5=BoH3+Jxa4qEDSE7Xgc~}Kj
z&U6TB*+7z?`%=~iLq66ps86CAxS0`6lFZT^zBtNGy{&!wE3DaV=Z2NIAL7i*eN6=G
zy6uQTUYeGrdV`Q@SOD+@@27Gke_Mh0%8Eo|a6-jyNLfKpH2Y-?#M{Le7lLY0ac+D>
zw$^9VyWdvCqR?Kzh^&)@;36=EfgPYa5oUo5U13lvy?MY+=1!YBF<%{4FAkYA9hqP4
zJ8DVhBtIi;nbepvdwK~_xlXex9`bM$;1WxEjd&l&@%j#NaO=vLadDjuDN!=SB-ky$
zKL_92Qjr`H)FaCj@vaBvv?_NS9lWTio!oD+ztZ%hU?Pma&BLeN1q=|Oz$@-LI7@7t
zj-OtM*@|LqUdR2wrYcJo=5y!svM6}@l{3n5C=e%M`bcMD026XQjvi`>Ei0hoK(-|9
zw|F6m+pPn-e62&MH!YH<gXo>M{m>Q~074v0((R}5vgt4TJEM|R{HGc)y35}@Plx?D
zYz^^mJeC9bw~!26)RUIJ13}!B&0@+Qi6<ISL@~t4`Ak`W7j41FqdKS$M$zC2xtDEE
zIs4b}sX{t_4qCGYz&bf)N+ROnk7x)!suU+2A>oCf0mREcNE{Bp>2?+<C+EJ19Pg#~
zp1oDxOelpc&Lg8Tk}0KVKmGuB_ve=q{oS+|<?}_F6=vMVqK|K2f;P|-PX!Jgixp=H
zDmXd4`<w#I3O1sS{xQPIpQc@qV%9alP;-bJv(oZxKC6o%1!YOqjKYLVJDq`zr~BnJ
zrl09xZ^`?s6j#h_42V9zM@cb?W%*Qq`D~)O>^_-?TH8Hh@s{S9VU<;MqO$Pq<-k)C
zQtoP|=*@g4GeeRsxjZ1K5zTKu)KcKxIkQ}Ewn5F!gzrP9Sm^UPd#GPH-O>kdk%tDA
z@^3Liu-<S-@Xj;f--$vQK`PSVr%H$WiQgBPR@VYYsLW~NW<>)JWhh#qpMzZooJ)Op
z@liC2fvQwW+xy(aPlXzL3oT7jIAZKJF>||f@F-`XMjx|%N`L0enbT7u@6*QrGud~e
z`AW6kSRz(d`y7F02+Mnq#!0VyYTK+PvvBs>=4hTcjRokHnT~;fg7Wz#?{hl*vDcnw
zJsi5Pl=A+r-HQ=I?9~zsPwvPiQO2z6Y%*nE4FsY;fRzO$$MAW@u~rdg+4JBhXm9|u
zX3&_l5jdb=eiVUm>!N@GBqWwR=!HrR7|`yFhD!1CDOo2_6fe}ete}UYZw9Nx;8_?w
zx0^f$ccUF-r9_baI1A#WB0Eqh$h#NtlEh@t#aG?{HXhh>A<impB?07Wj40H$x5Q+q
z36~@p{nT$E;8fM!c*z{?o(x$DR-6``A@wl(9V?z>w3(c&+5`&)`!9m*q@TMe;u-fQ
z&MU^9+EIss>rnOtPmTN5c9P?xFhLq-YxFTwSaLl%t#{xGgBhtk_^WO0w&)Ctv$04T
zfAFzrbk9`5X;rP?dx*s(GBHLakt2}<6JQu*Aya}(QmlL8e(L%_?mjsH4}j>b1kIbP
z_u8S?4n8tc3gq^qYW7mmLt>lzdss>GQ(QB0{bX>@;FOa5>u@-LvDX7b^4YV@a#_ib
z4i13NJn#c&A#(QiR<7)AoE|ZTEH13%B%e5>oTLDIR5FgnNfE)K4)D;y@rMTM#JVz-
z-oUT%r=+aTToVjd<<z%ah>+8*ZBx^<?moC|Cb*{J442z!?tkw%^L=pYn!H1n?Dk=g
z$2wK5f4VbW7(72P>AnmYOt^hotU1tioM|cUdg&b3ng9NCyMR`Jw8@G)&)nK3@Z3<8
zySozmxd+00@@n_ix&81aTJ(AMLa_%gR)}k~$6pk(WB$MW5ze=t&xz)s`nUEm>bGju
z?L4-OyqD5ivgSo#aTG?*(-0H1i(>CAuso^R;^<ypTBYUg9E(`n2orW62zAu#T;53w
zwV6>dW)I~J(1Zin6Tw?wB4tVJ(#O+0?sz|cbI^D_ENS+Lp?98f;Omfzm;2s^$8!23
z<>aDvFG$0ahOJY$7||z`_XyD?<%N`%IcB$$M!8)T(ABLH;pi?Bddm_m7>CV_|DB9E
z(RU9-##ePh?;uY$A4-#2u@VgG*ev@Xlom(S)X8jYIvKxu+Z|tLwKu&8i1QefH|c3!
zR<2Q(|NFKTFrTBc$i@m_H_oC|;&-8aol%1zGy~*k!Az6L-g`*h-ovZ=<Q@OzL*|3)
z&7OzX{hn}s4LvxtJIGNu`MG7g|MAHHF8<NZdE~EJtE|QNltw`*S)~zQeDBqO7BiqM
zV75SZg<h0YwVZ7=%kL5Rnp<IVAic)~wYvt1x>)l&?4p;zVoTM>e`>t~@`R)oUMuYH
z^uVK*h}o<3zY3dO_og`AO=DfnR95^H=()BT$zK5_S0=IDPGR%Kimf%6Rt}$I0QWnx
zh0hP!q$^q+jaJZGCjj;n+M{2;IO;pM*e?7=o*hyYUC@2ZZ<&#J(Lxr?tzeYNiZEe^
ze%@}(!Tx=ZxPF5#2*@bdwH0JNh`A|cex-%Xw28Clty^Cbmg1sq2!GE`?W=Xi{|w{L
z^Z#$Fx-7sLDdP>+oxMG1zi#&i?oH|AoOYTbUNq%fh^MKWr2b-R)Puu+So=>`rSI8`
zBQLxl?%4Q^k5j}fLel!3b8g^`hlF=APk;72heSZQ0R3MXm+0#4KZA`Z&k$clm*^Xv
ziCl;fz{OC&&p=mK_#RaQ>2meQ-c<}Y;7Tkbb<KG*5qSDcwWBeQj4wd_%Cu&A0VDz6
zTA2f!zU>j~DSYxMg`D*Uu6pthyKv@Q>)H2I5}S3mD3b`daVKOi=jLb2HZCd^wRAS{
z))%6W<TEDfXr!OAI|EO486f8|KP5kQO0L%Xr|cZ@1qVC45b=Gx<NKDY<Ln<pajVL-
z@x}{pN^L^&+;78f>~^0MKQnFBxlCBgu{p3i|C?F!9~<&qX8Us(lV5=Nuv9to1V3~*
z<<q4dg_bYYUFY{+Uws0IJ3I@Hb9?{qw(p++^D2i|z69|oaVqzCOt7@>e=p$C2F7k*
zeb0J09YL^`SD^J!Z{rgja(w!a{i<HOUM*ZD<X(eb^q_P_89r0=)c+mEPQy9(UhXE+
zS{d-0_TX&be|L^lR`_%B<Th1pqnM!MKAV`$sKl+3U72f8p`ZWzce<7c)(!fLWZ(fP
zK~#~ER$)%Jze#xSLlcNcH0et$+fqJj{Zs0T+@<zPzQxys*S@>&6T#@|9e<Z5Q8bG;
zs?tEIaa{=#jvepC5%vFETww$d#AoCEKRMUCpRc*Tw(nA%J~LO;kzY~GV#ugZTP7{z
z2Mu87slxA=H@nZPa3SzHVPAUm2lHE~hvmY{?|;?Ctn&JYnK8&WvpbsI3fl~g2EMr{
zT+;b^oU~C2PCWW^jGfH?+{x!6?H}{GAwHHdz@dy3zy^yAKA*f;2xy9x{NuuIPJbQH
zo~RB3md@3`jHCDEd2#0CiQ;d@-iwj4%5;Fp1niHv?){%5JJn+seH(t#nza=?jv0I}
z2W%_Ij;y5p?||@c3;y{2iBe|)vlm1y4AkbA;idj%?t;kN2k<KHLep8rpE0Xv<^J1k
zAAh4&=8z3q$UO=%gGdN(J+y-rWWe_S9NxSC-@{87t-06FqNJ&f)QVPqo3Qnck-!DW
z^S2oM4(L8UE7D!ZC3)vu7wz7A(+bB|4N8i?W9AD1UBd3N?91a~5B4I+NwMbCyGY4`
z{-4*vb(QOD_imWzW3ORt+gYke<Lmi@e`t34r#;uL$DEfqpnVDYGtWh+9@dm`tMp$B
z`1-#WK(+G6+Pbs#=2K(RfCN9Yo|dNp)W;%5PF)Hx2lelYt1&}>r8Cm+RD=by8F$W7
z+sj2l6rKzYc^p8N*6RaXbU~Off;G)M;s4P@>&d(SoWz2<a)umg(uxXcm(Ixlx9iOP
zySv!MDBAFA(9d0MoPRzezO((~g;XGPE`=ScW#sAW`afEpz0dmaM76CT9vAkOedvSh
zGB2l{9ad$H)_J+d21!}T@{x0l=G;7r9+W*|-~M*~e|<{_H+AP#u~DqzfCM>4rIWeo
zZ$#xKbz+uvCd-LT&7rzYORnrw5jDh1#hT@FW^*T2K39ZWVkSakZ2_?k2dvGUe*XP+
z!V1oU%8<$q@Uj9SkArGdAdy8c>WP1!`0&pzI>+^DXxA<~zu{5D%AXj>ofWjBj4rJ$
zstVtt4g@f~V4oOj+&eZcvi$tQPXOn~PGPp!sJZim*Ia}%($5DjJ{u6K;&JJk=ISz0
zZR0xuiSDY$yq7s$$!gW-{opjht#G)Uiv@VN7s6GJ75$?;skO}-*}IINt)QWIzfQ^|
zuCFD{&dSH3raLpe5Y^SyFV{Oo<92OrsGyna!S72;9;D^OS<+J3ledGh`+Qmns;8xT
z_n?xs7N)nqNU)Ai3JBn);kw=j;niB1T*3gm#3ZRVJ1$Ib-PeDpa6#j@lFec>)0JoC
z0wdEgV%qnDs`ZRT*%dbcQMCVe54*1D|Kq@4Zi>CySE+tfx9>w$_OBw#S1#|#$!z9?
zuHNy#^k1R(liaIFLPFqHNs$i&sI4IL&{S+6z4@!k6A~Cv+Ps;auVBC<0EiBBZu4OD
z<shEyjdDD)X^&n?GEjgUys42Gh`n3SH1Oex_@yNq>=ds%snz5Lz2+&N*+{<8ESl|$
z#Pvo+E<V#Br_<xA%H3LTnCa26YsGE!dDk=NZeLpsq^Q=<s|&_$XA-|`5Ya-v&fRNm
zHTsWn-Lku6?G9nJW9;Am#{ftD=VjRo%7*}1x8Z&xw!siAV12)+HDQ<iU{G?4(Eohf
zmrFu$L3gmjMr^-??L%$8VxiVq51bd>PQz@%$N33t{+ZaC;iJcv?dzoFC)*}*idoue
z9Z=DDW6?M~eXr6{Pwxs0d{4bLS6s|IsKTX4gL4xsxw%2CIbfH&p8j~Vy4GBvjOFni
zF=frcyO!App4)4&=L1=rp9hcOhh89YTWhh1qnaPer{6ra8>``(&OHl0%}&b<_?{uI
zg`o>6GhcnaCeN^iF1>vR&I|77Zo@dlR+K|P0&$)vzFM_T#F}a^jri`{ZC%Tsb8-5o
zWUrJUi(R#?DCbGch@i`DzXwC$d%&a!5$EJ2v7x?Vr<@66V)KlHfXS(Rg77~2p4r4b
z6gW^@=5y!%Fv%ajF&)hHd;R+<5+jgYYxlTT#?=QZ+I<hyU`FA0Ku-C%BFV-)gEZR$
zFr5kaSnz%rzYRujvrN3udY<D%8KVt#ho$>PYoyKyY_bU2g8WrjjRfaL;E6!s>V77g
zd-K$?c+bwm)Twe|rhvRxKA(IU>4w!1iek@Sc8579ZjDTf4=*iUu30_lL6Q=KF?0k2
zYe<CUWcji2dp3Li<n2kJ<ly7-(V+f-13x1fc@yORJvC$aR7bjB@_B2Yy};r9)LJ6u
zd83Op?C?l55wG4ed9tuL?hqU<o`@;w(7FPGYQ#9$3-a(`F%tq26f&O}{-|o*of3GZ
z6;*4fFPg#}C25~nVtkNAHt{SMxLA)lcu`xLZfbuaR7%)(y5FmJMV^}@c+_lMi`9{l
zqg-xkw_aFuT3;kiob=*ehSB^i0-Ai@){MsikRmFa==ijjZ&BpxnfGU(aK$g`-oS>Y
z%AdYC5qQyr%<p&MHt$0HMu`ThXl7yyf(~A<u0LHIulee;#Nnp`O|5Z8-wOJ*C3#V0
z3G%jAdK(K0R&4(QWTg>$<v)7?S-n`jpV(v5r11J0)D=?cVtv7xWZgMsGn{z+MA`at
zDP__<B}lcU*v+{S?CxZ6Hs0HBRiz|vAJ-j+Y9Box;H?G+^H-Hu&=>kmHoHaj5pk*3
zm#3L~IsigR`29Fh1E1OsTYu_UaQ`JyoA%?arIj}#iNe9+=EfuJX6}tP?c}s&e$(Fq
zCz|nNgJnr;QQ<*)E+#8RNWb{fFX`j?-AT<3dFU-Y_X|62cF9oz&_q0)LvT>aaL&xW
z;8KIA{B7_m#5zLm@p|@f+Qx0KIO8$zGC6&zEr@FdWYa^}hWyv!kHhedW0yti<5K=#
z*=`8iMj@hSvSXEv)%2QAdE&B<M*Q{u!t5x+#G=qZl0<JD+jiX2PkR9qMH8d!oZ0Ej
z1RI~ySMnMZ;ULclp>JjvOO`BuO{zs}CYC1`HPosL493g`#+RyHe2McLpOQ%^1H~xQ
zr=~Cqzbr8%2L`I3_?mJS11pJ*z1H1}-P*k}TVP?q?QhxwX_F0!K?ZtKSew?U<Zk&e
zh~d-=ouvo6o^}XFZI!9<o3!r`fhNl^WbI3d+-lncuRNSXy0bm?iOFkhPsB35v(?rP
zS_P)e&Pw(yJyJSG;}T6}@v76<H^gXUUQAhLZF8l?@_F~ck?HvI;-hxU$-UW-E48w$
zvCby~^(WM)DC%q?R!9B)hf~nui}8aXtAdNgKrgvq@pN#8u-DxB@B3E3w+R)j%f+05
zuKuwN(~S-v<#vcR{Iwd=gH`HR=Dv<*=9*7bkS*8zWtz-H?2FhYA2dsNv~!s29lz!>
z8@bHES5_{kB~z!XFLcVbHd(1xPW}~9IVU5Fk4AMqy!7r#)wTa5Iw?vXB!@jn>?=iI
z9vA)TQ9DhaU+3k7&eilhFI&brCGXuiH^&(BYcc7{4+m<x^WZAvUHTo{^LK2MCSxU+
zoUSejdqTnyJ39Ot-I|>KUlOTc*JZs3f1DP|V3K&L_60<s<>4Itc6)y4P-c){(6&wG
z+vaJTsM4W(l~&Mgk=SZNe6VJYDOvT-REVjgM@cxoCS!SOU}PxlQ-+pTlaU#GF{+#!
zb)XR#Akj4jHBI^rBNT<Ow%fa{S>gj`D_6tQbTX`4jHhfiMWKn&^b214eqaL=JBGKn
zSx^F=;-^y=6T^h0Qo~t?-e_?)5{!-XR#C%Os4qhW)xfdg&Euny5h7_uzQ9MLv6f!h
zJW9ja9s!+?^&&SBJVWfJ)<F-FdIYT4+O-lfz1zAPE~Sxcfr^1f&doD&0Z>OmkDfbl
zX*9{~^uxBIXao$J9`w8?QH^Z8=C4*$lQEFX$UP#?i@_PHA*NUzHHtF(1+7<15sRt;
zDvh4oJN59<6ktZ?!AZW#l;8o(s=n#qh3#TGw78?bfrgUXWf9moPF=L<Tc2skr94ge
zJq6&=v5goB{XoEG628Aotyd|xRv?XgLzYjl0WU`yy!F?mi=*Wu6tugYzm1QsIlyEB
z+nZ~}n&ZFCY8TXB@v&J99Xr<G9cZYjwmUo6R5q-2<t3CZ16EXqlb)R7iekAvnU0r;
zBCvRDIJk_g57j%{K^yfYg8VEs-SwafprCrAb!fo=Q2l%X*t}Dq=4;!X#GV9ja6myH
zrOk<^ub}%l8P$`Ja3{n8tA^Xv5=u-qgPPBY1m*|0B=O2@Iio7PyIr!|9G}#>#mRDR
z|L$sX2z_dej<dyHxD<Kyf`GJwrX%r3(1e)`5VQ{YDr^fM8{nIC_f{vyHvyKaaDHY7
zDz@15Z+w6)!mqTQd)^stQOgwsX6l@cxzN~7##M3uD6<&3=2|=nG`4NoR&Yn`p-Nl9
z0n5C|%g5Fa?=}}%1mw94KEiEy1dpEPDNb<jmkYjN@e4pIUr05Iyp&MAO73`5zobjk
zS&)J|v)BCX{L8GB8Tu0HrB@m@m2$KR=v^56r0qp@`=qkqD&;*?;B)7w?B_~w{bt?u
zNA(fPVzx!4&;YBiD=wunv7Rn|%5N|>rVgX;7p7CU+-d<K?NL`>BevkzeD`R5de1|f
zjIw!&ciBrIJ;u|x0H;PFQhfC#W!!~aZ5lP^@sf?SmA?`)F-;}>@auG$<!=$L&3(kA
z=Gs?gulOqcb?OM)0ToR<$ItlLuycf<`U0mn^MSe23Wwc~B+YmkC)$@%Fkgik(E??^
z7HrM@GlM%KhO0mv(JM3zDk0dO(a-JQTgFS&x5rjR*~D>%0TKRB4vM1Dc`^;H;}*M*
z=}S^SRL=dbI~W2uEQxC#=Gl2gB2N07ovm{pUv|vsp8l7uyO-6ZN6E@)#V4jE^_EH`
zp7Yw7*gfGLKFrwEZg((;n9B6fz4UbO@HzHYN9jqbXan;x&00x=V_jDFQe)SSMx1Xd
z1n)Nc?2FaUmw(ZI{H&)+Z2K6`C2Tgh?*NjB0E=&vM0<wU*>-=5FO;q+2T)YR0Fl!2
ze8CjE_19cFQwHXYET=DXzU59_LWPy?Z;gq$)aH|9eVUdqsK?(Fhr0};FV|@`)g)E5
zR1nb-Jn|mvH7G$R$zbhXm19{=&f&t)N9AwF3PFB;%cn+*O4jzs{m#nWXnwQAnu!nS
zsEDP{FlL^R{*gkT{Zm2@7l-xWmS*LPoLx_qvN{H~`EKK>$l~4~x)B-n-q0Cm)VO|*
z)TGY^|5aO@qmSwgn^vxVeX#)moUVqS-OV<0gf@bc2Gj18VN0qVs@ugQTs*REYI_-j
z4@)(~uRU2`_!?&hk{fC+SAP@i5a4P~N=9{e@apRJ)_Iq=x)QLS;0dT}V|1Xg!17de
zd-Rb#sAoN=Fd;k8w@d@z_;9E?E&1lK^SvnT9Mb2#XvF%gsAD2&dxFb6KpPXxqk(!A
zWOgiJd984XaB$5FvhY8O22`y1G3sX_#fncWmGOJ!a&4c#`KI(ujNCzVX!kqn%`O#q
zurVb-g^c(6c4LxjgT*!TQ`=XnF>di{#Rhof5Rc2U`<}BIigwRW8vDVUI?qxt@33jO
zJuR--^J$&!w%}e52Jn@~*t>6HSFGYtC&j&91lNh^@@BbvodbI8`Bb8SzH&v<KfBt@
zu<&Q~Zb#OfXK!wVHAEGDAnorz#&J(y<h})k-wfcfr6e{fH1pO()@L&=^W(PK=`~?L
ziuGDuP(w8<Hsm5@ul{7Or+juw%bZ}=p_Rao^6E<XZIzRo$7y;d!^rT==IGJ!tG*PK
z$CXc$l^@cfY&H$BAy_u~r^nv2q8?kqLf=_KBVmJa9tZMiUeHUjrfo)95mG=VV`xE9
zS5lI?lKyaS%U@ModnKlO>*qs3&K*79c5mb!LgC$c$!oG=1Ls1_od$0*Zv}W&k#pgC
zEB*HHF(ng&%)6Y+Sa~nYy6n}qo!|FNBON`c0Buu@6mL3Yxz_{TPBdbXLFMR+ZH!Ln
zZ%cS3{cgW|1fLrq?oIeOwxxJ>7Buy2zn8?T4+aOTGjQl<XwR-2%sOO<DV5igv*Sj!
zo!NFzGGe^DH);4j9kXD`N^^cO3NUSMoop5w|C91azu@GVt4eqs+8Rys_}Yi_#>?M4
z_(~AC0BzeGB^-N=@G8XpZsnF&gs0o%gp>OX&%~YD-m6LvH2+Y}xLC&13yG4b9gUI5
z4>ZjRtT|><Y8t+2k%nwkHO3alC(Lslv3TSQV1L9a)|q?XFJSMw-7(TWjTf{z_SzgS
z*z+`fni)qJ8)G45mek&MhK}HySJ}Bsf+-Ce$lpl6w0z;pp%s}eN=51BUWUrX?ATs`
zFpJ~ZJd6}#x~KLNxYB26cfx||5;wTJ9*TXNvii7KOVJ#JZTz6C5vxnSWUDHMX><y~
z`9FolvkN;^v|nkHZs{+n0u9PVK3>oc+fZQ&k!?i5V$TQrmdG@>Up#LgZ>sXs_d=O*
z&$2&$y>9-?%xO_t&i&wyvzx$EqV#Y9!QU#}P_g;BrV75#0G3Q!E0iD%6A@9hMdien
zzL|QdzgrkCK6UPq@?^bp*i1ROMu)@pO*^|S`I5)@7K^{BM;cnUfOFKkAa#ZhR&`iC
zc2x`SWR|)ZuL?CR0gq)faw^*}xHo3Tt}6s1??#{BpLHL!kyO%JC>mTDH-G<p#^lka
z1Ay5M@N61}UrM$I_PkitsPssg;`bQYsxcMA&Todus`(9x8nee>sVUROhmjIhFMkYn
zD(_T&nY%_QUL>7es$;6MCVFkpW!><1<XM{!8um_qbp*-7oRc$xQ91pQiD9~Lx(<4K
z$sC2e{ofW6kr)=Ty!G)2tf&Ih&q19q_P%iPX^#1hWVh`-br@y#+mbr-?5&Lig`D6F
zo~ySEFNjGiD8*`5yWESE?mT{<M|8g>_mx^9RwxV%g1kPU&1Aim9@@bETX92Tk-5WZ
z;-hXW=T0Ut>L}8*vm83*-F$1eTdU{(5ie!9ydVRf2=WVjz^za-c=CCMKsl+*zN*>g
zJ?l7)Rp4Gv>K9N|8X=JdsFenX854E9EE1u`+2CZ~?H9mZ5Wiq*cK2KW?~FIPSsx+c
zW4v@>QTXNCsn9X!sZihIIO&q*8d}>6Oim-07$gp-193myOV)o{Zv7646*0XvX@Q?k
z>dn;5__c(Tz8tjW)oyh%)+~l)Sg(8SLI;mPB9)lIF!L{{liuFw8rI3B`QO)g%rg8$
z9kw&|t{Zhmfq&?5T%?}<#lCZEE3mgq--Po!K3GLIZ1;_0MU_8&firWOY&3zCQvK~>
z^393|mOF)p%ZHVW*T3sdp>^8b%+7YEX7a0t&b+0mpm}?GTYPWqMqVt;ySz!&Iauz6
z)A7etcL%K^552Yc#LS}lGKIwH5;}KTk0M8MzT20z!~hWl;?~K1&fV@8oP<(kPFLm}
zwSZB6Me?$Hit!t_2Lg-2tR!v6?117)H%wT9IhW_5Oj($>W=QQ&?y~@^5@j)yo9KKk
zewf|eD#D=Vnk`3gu|1EOMUUH{zn7Mf6pQ!U)A4(`_8u8O9L;r#BeYy7;mWCh9T?yB
zdtVQ%m2Y^#9B3N=x;JH)c87yh%bdg1PSkVpB*K}~uGQ#SbOtiUwTNc&sA%}K;v5!%
z(>0k`=mGb;$^Ch6L}{>Fkw#b<P2+&-_`^QYf?G1%3jQkS7Dyj|yZ+o1SMM}UbjcXA
z<VD-*U#`<-^yDgfdh#ajYweK7%Y7b=Jc}jNx1c5E?w(?v{MuZ1)dA@|;o#@^rXUAz
z6CbdHE4y#bar%9c*efDUy{S&`%j6EieyFsUVF_#d&u5*OO;ph(zqG`gfm*<{NqrkF
z2@bbTYf7VAgV9Xc)AH~T^`p3htb=ko+u<b<yra=UwOlA@Ri(w|h<JDC&Y0-ZRK3v2
zp?Wgs<iTfr&jO&iRC{Y7Ivro^oVYF+(>ZOkh_=m}-BHf4YM@r-WH=|wne1Mavp~PX
z5dls&ceQ|OldB*c0Y0B*o)9o@aJ+t}Q1voJR9Hs9z*a3|L(VEoitXwxjXxZa=I9q-
z$0Yxz!7}8Ps(1pe`BKRX;p`i$w8ul2Po9*2EqT+G$Sbl$Pke?bl}K<NVmz>VaB#l<
z`PRkfTSDi#gS*UcEQxwT#6<d!m5g^(jV;)YzEn}C5=-L#1>#~EYtLWX?RNN~nQ;N%
zey;*so+RJ<#+N=wno8J~e^`t!f<GS9oG`|e0DHzV1e@~X8Nk?#1Dd}S<33jlC$a>|
zAm?r-SZH@gCB;=gu!O<w7_At1HvP+Gz01MJnYp$aGFX|hPpIj<=CWy*-hhD}5mA{q
zWlR72oMGK2XM}|+9sINPoKVaou6Mm&vM5O)is^-I!|I}6(m&oDUJw`&A(|ukB=Y%W
z#aX-dxUOqy4krBCElS`2w7zp)=`_qs9InoD1VPN5NnV9q6a4CK2sEiTO|wY`XW0$X
zX~*uR;y1<kHci47b(4IYWbAcI^E?||r^ZxM8uiUgB+4M~=?r}A??R`c3@&OObab$l
zf0qp&&PEs@4+;XrZ8GRS@*VBlL?|2CM@jS6xicg7yT@v-xybEGod?)Si;6|dxNT|k
z4eW83`9idJC$34bN{>keP7n)aaDkmz{9THeQXDg+*=KW9@V3)uliV4^I(x!s%=gkB
zB6s5cgK(8KQfZ>1=4{Z5@*f3xQko-53pHj_oG$NWIiHGbR4;lOd%EtRy#!*Y{mzxY
z{c(zO*sB>W$Z;)Z26gU|rP^Lzls8kkmTo|$#1B3*4n6j|f%kUo86Z=g`h|sHov<A+
zX%_clQZLP;#H56eucr$6d-QueJs1=t>^gma@`x}P<3Ca@k)Z{0D7csntPSXQC=ufe
z4czgP4Qq5V?{(_!)~k0{J$|)C!IcvSlki7RK(@RLVa|PZInmNv6L^HC=z1ulO?q^-
zF=`-h3L4p8A|Bf*g3!+%yqnG_rc?5zpk2L5JEO%5!X9a1Irz;tz*Wpo1FPVoGr4x`
z(}p8puKkLtpw6`gcd~mS6sv%o0aH;gWXvTHb+7K(9Te`Srb?csU2*rj*I96rZ!TBM
zo#Dd8Gk=J-dt(`oprac^Zrl-arh4Din_gjVQMvSoy9Jy|LdD(%bkVrS-euWQuG9J)
z^c}DoO8I5MoOk8wZB)!=;OgM-Q2@I4H$-&xink=cPI)4Iqf&6yn#;q5kuw^pHg=ZO
zxD;|Sd|y=2TtHXTUn=7zhP=aK(>>Czv=`U@?Fip%6<lLvtoZ18K3Gh(BL)D-HSNMS
zEEgf0RP~vd=b~;5tEa7yuI0#KFOM|To}|}04a1vJe6z?YfnG$lhDen3R^5$*tq-4&
zU1jmhuySu^&`C&g9QHwfV}!6O{ovN&hy4-HDCHWmM3izK`cfdwDRG)&9ed-UDwKFQ
z@hHt(jMDUy-T2M>{AnXOd9Z8$=CqKhB$}yatf=TGr@PMk!%aWsa>~Yuwz~7uT@Ux8
zDWz2RoU2Mbrk{pD3W3|$<=HJw_mBC)e+6-1zM9Lq=V&~*cJV-xB3Jc#No460{f#nO
z?;c&?X_Vs$si|6HbmLYk&b7n#P4|I=n(i~d2y*_gG!=sS_^6efO9^f?@IKkZyhJqv
z!_$gOR&2!%3r;{C08**QOD1+(8GtssEmL}^r8eC#b8k~f$6aZl!?f&nukEZ;eI;we
zWvjH!$tGn94(G(%snPDkxw`_b9S`q|&ay7QslCxHq*n2Uz5`xC1Aj3ap3LvFkykgg
zdLHSopP!oGoa!ucl=L}4%5<bsnkc#-7#Js6IeF?}gzuiF(|YhIp);vB5Bup#l<-cR
zeNplojXwob#sPzRLC^beU1n2<^{W-pykj-mg(WQ=%Ytl5Ww~G2hyr2pmNXFC3>_6N
zxAjLhV-K-3npSpV9xE6$Oq=bEy?wc5o(OWPO62r2wz&FsZ8n|Bk&#XY#?l?3%|ZUK
z%3|yzPqxc;s<VroLN*zXpR`AE;l5WmIjmqnkx46i1%CHLqY7nWX8*wD3|1wfYW}R2
zP9Jn^585%Y`R7#ri#jnIFzpo}%D%e&aDiPxW!HT0tl-l(J|&B@=^qwNNg1qHaM2Is
zEui_`{m@s9ZqDk@Sf?yc(CDY_8eZt=SEUI5qq`iri6d?*&@kgi$EK5>$@xWsk>*L1
zRloYYz-L{LQt3RKWGLgL{d9zUI;$i7Of=pOH(uh1)0d>NzcKAO9kbne;1hxUF8ejm
z-pr&tC@kMg!@c&3#V%=X&6^!A*16`cm;WkNA%S0KHc!D1*HL1vWRb47HYwot(#xr2
z%m8~(Qs&Vhwdk&Sm=<8}AnVbTKZ-XEH<d+|vm?CqBR00XY3!Oh)1|dV#O&%G?Y&zE
z3+O1l(9mQ;6|6x$M9YS{K018p-1?0uC0D7B{al-W>&5MUY&!UDAP{{ClM-RG3FTMB
zqT`a*-z4UbkFf<hPTL#~2HhPI<-c6`Sa?y_2P`T`Cx=sdF?JI*3&VQKvD7ecL~_gu
zK5`LyvHaL}lo^pbWW9N{ADKqYaDD$|xK|+Xx7Yre<EKvilKT&LbqJ0Qh$MCz*Urta
zLtVfFU6PE=i(al&1<)ExJxs(aJw$^AqVgUu3X6|Y&-V{hm)~K(rG}iM+PTIXbWPSP
zFbr85F}^#w`N@-W>q4{XH=hyu6gq=b2#gAnOuM>%6fTLh_|eCPh%}%ML0C96G4u^7
z7O*fN%{wGQr>BP|oM;*oj<}h+E&b*XLv;EYmXaB#9M%&O%|}Mf8Z+Z~V_ZZ%EwUUZ
z8x4(33;UQPuK;xp1Vx9{8infib^JDD@utkhwQOGL{`0#g8J>^|M4qr?LKDeQS~pmH
z5VRWORx0Ca$kBwJ5C#@o%}PXB=Iu5-KKU&212Sm(dUsmgv~+)1Fsa8cYmzSQB7C{K
zxbdfH7F$TKGw8dTHs~1tcC>bIs?cd5+p;!aZ3|~sU{{H#k(b+k5z}+@_R~9{DE&Yq
zgPS(Zt}Pnga5pu+9^SU5HRy#t`2taHpDPlbVaoGMJ6dI?a!N_%VpeS0(4Gz7*u2N#
zeN&(Ai<w<Wy{k1mHi*tNTiaITo;}@;FGiV&bAxXMZXuxdporeUXS4M>Ja+PCs|mPe
zb>IxE$t#d_lY#E*a>nfnGEU)hFY?VDWR^s$U6;@OQG|2&k)DfwN?k73ji81H=FsA0
z;P&nK^sjOmKI!{(Cr3TB*eRPeo`}57Hs|`2lKFGBs{GZ*^?+Vab%cOP#FXQKfGIob
z<xAZG_cIS0{ej77T|*TuRhwIaRt&up3&*a}@VrGDFIV61b91la2KZNQ*5Z?4>MCE=
zbTP@w&L);Uyghyu83-!s7r}_qHo(=Ae^p+!b8N_u0B3v^8BQuKPZw1znsE_?`L7p{
z_D9aXah#6-<>*~tyHCgA!KBmcuhr1+P$l%(O+k2(kZ{ak|1+x^7zLr=r0OS<BLnX<
zznl={GoWmat$j4Fo#KhHN;n!vl1nvqHRE+{Xc*kK`fArtuPiF32}~Jq@U(Z(=dqhj
zP05|Gy|&wMc^B8nVE?HRICaT~^+aD$#}Eg}edQiJ{FkkqnS=drHLHd=tmc;;lPPiY
zH?mfMq6<d>*C+?u34zBxYC=8vCa_a@y7C2x5zo2&o^X@6z^k`z{qeT7PdZgA{~_R1
zniQ7|c%-bMEXo)aW(+^=W4}!3@x0N-<tFJ$-}s|$68pg7y$yxM>m9t2>dFWXo`rav
z-_$4nEgDVRBbr9T^#bc5OPio(_rZ3Q`YOW>AH?s!JT$wj@2;uOiHWDGQ~fOLw+9A*
z5J(Qjl^25C!=-~iD7angH~pk;4Do`c-Iu8diTi%OVpS6T?45Gy8hZN1i_$O|w#_A8
zMgKSrJHa{;ziTRLEaR<~TLuTJ^w5Smj|!1zDo$-a;dV<422CNw?uIwH&6#?E@qRuy
zmW4)xZe4FLYR7m?5rc=%P4<;0+Yt~j4X<WvGP7T7n1eJRJ(~2Nd2DY<f*wTTKsx+R
zhOcbFA{z^3VVTti9L0~HX%CAAbBkil<&^Hx4qWl7Wpd#v1MZS^qCId4zNWwUA9fS-
z4Es<ezDpHcA3$#|SL+XEY4M22Q>lI?_UAKQ=a>#9d3zE!eS$EL+=)>~)2(rvo~Bez
zs#?nEFDjQZ;{zT|utN?f*xjqtn@7QIKguM8M4SC8x_kSOnaN4DebY94n)hM-$f&g7
zRC#g%9XwGg@8-Y}t`V8l*XTop+ox$qY56i-;Z_em$nI;*U!CH2*-i>jaP#<u_%<NR
zzUrn?LtdNCf1K{EIF%P0QA=CM+ii8!kT&`rc&NCH&3C!tvZjlu7f{oka65__yDbv=
z`6k$4x^lkUVVRSU+d!wWyFam_{cw)mp|6S!ck_r|lh<wpo?>EZtGLT<@4<R)W$FR9
zMqK)|w<UfobBjP#GRVrV<h~V6bsAfSn5nna+YUN=(F4-H`47J+w{I?$58qq%Zr^AG
zzhR#nr|eCBIRCAF>b1%1;>U`EL`|NTlqVx2X10e#0}>@e>pvvtkv2q6E)vMrWb2V$
zYqzs>;C31^+iKxM5MOt?Pe994zj}8%P!3}aV!BXz%t>?qjcJZxpqzHtbB&s@)y(bH
zjoi;8{@wzi7*5wZD_Ob|d|k1th~1*BaL4veM!Cj8wmfU|{WmF#A!^a48a*+cYT?R!
z0#R$=#!PvEMA51(UtxQx{6%L_$7*IvG%0-r)c!VSmrm;9zbWjIGY22<{m*HX-`USm
z`?TO#%yP14%Ch)ihZiECsC!MKFYNzFgj&slX}K44ai1FYYbxM%8~9f&D*oo%Ntgr9
zOS<h{w_<P5E_K7o@8@QPNh`FovlkmJx$&*at_USmtfOuYn-uMje`Gzhhz5l4Z{#aJ
zg-&G3K802jaArWS(w%9yhh=qNhw~%2(^{0S1)qJL6~x;tH7{uA)a%9>Au6+EHY?OC
z6LHOP2F0}LBa|c@BO(+=SgL`3YX4Ps%+wek{Y>z25rNrWK%ud4Q7QR%`z!!wK+!$y
zb%HsgjPBq-$6E4(H^*^E06Z_cKBjB0QG7G`gmpFmgZrL0a5uxv_PXwSA1DtN2O093
z)YSH5h6^_W@}%~0g;~NTS+o9!(t(wz3?~JY;4JL0>peW?f~{sp<N4F&zl<srJf~c3
zCit1R{3Dtgd{^_5M@@=<J#jfg;A4cZH>_D+$0&{4jw@mMF{Udo<OThT=h_ywU1Dia
zo$34n)!I?fq&05M_)T|A4kn=psi@y@>K!FS9MFeZh0%BHj(TZ_*;Vcp^xBLsk5@bu
z^<@zGYrFW>_%bTj$9&EIm1b&xp$_Ma=evCL01TF7Ql3&;Bn5X^%GC?uoYs7p`f2c?
z-d=%i+JY8;t*|M?9QpDMnhlXdC0G5ryqcuzO!Q|1s^n^Oe1q4}kBvw(_G>?`K@Tos
z+@A72(|s4TnB-u+F-@|LQs$Xn(aTOh&UP=}5C7OZHf1Rc5*#q|(U9*I&z=~WpNzY2
zQY<U@*f`OvX`kK9v@d=m%BgEaF+gl4DGH(EC5_Q)BX%T<A_4QU$^w%mv1+9cJzaJW
zUY!T8eX}W(eG_&lj`jv6`k4DgOUBBY7BpO^y$ma7-2f)~XRO`6SP49=Ws?881)};@
zy*~$3pgVC|f5UH9o!1|<-Y5*3YIcs5d1q{r<m}@J=yCso29<5q7d<^eGJ-io$DlLi
z{d;}A&0<>9>7x>Q<@Lt8(;3qGe^@-I5K>iNilNXh*0gyy^7eVY-I~B1F_WW|ct`i9
zx58F3sPeR%bpf2|Oi{~=hb%EC$ft5zaLM`^Gv_9NM;~4x>4#SZ&HFp=p73@Sgb4$*
zzTDI$LB3}A3}2PA;l8G=NYy{CnG56qR#n80hsb_GzOyebJ{2A6wLj3Iediw#i;V>=
z(GvM_=a01kim#7uCqEFe088w3GQEK4n54*LmD2+vM&I**J)?xLzWo%Rak{HYl@W*=
zKd(1$nhB~`VR_p6_EqY*%E;~90>sXG&5eVQ3pU!tY}ZWZf=oF+k*DcZwzyS#S~44N
zCH&jtAbTurrWz4;;@4#h2V++Vx%6`(2YURxAOA1L-U6)Yw(lEPQ9%(VBB0b1R0IU1
zdx(@sNlSw?NOuho5u_#}AUQ(1L%M5pcXz{R*v7{Hhxhe7?{nYJb-nNZ@bGXu9Bez!
zZ^!2|w0q5b*DZALIBii-Bg?$N#C$Sm+EQ?ZAxFJEn<ZIU=Dps4LBlALwe(3kZIBe~
ztWFYE0ST*t?(F^&E+%<)UKKHDHKBVp<ql`emZQN#&-UdsE9tuHPChxEGe|f*3ggdl
zYBZHJXk_r~{`q!j`E_5lc~;6vLIP$uW^=S5CcC#RUchgr6vBUcob^HowP!^Z&)K>6
zX>_DkZD>%qMmUpufIWlhj(zc4dNCoj^(Cdq2{-v{o}ANF`{@q0=ie7%Bq+wz%!lcx
zzG%#QY{Zoqon!bXQ0F&MmQLw*+|8XIlVvuLRkmW>0@gvxbK}_qo1XYhnR(-3T~Bw@
zJoVtLF_t>`9!7^%Hj>1atF#mhA_o#7u!P$>@ez}`j>4HtJtitoL7EY>NP#ZCnImUB
zt$Eur1iQPb>iI@TIO7!S3`RSv|F+eyiq~vH@gK56KfWEV^P4GN5`m-=TP2SW2Dec(
zbE}RVbQui{`3DX0h+>Ld-siCJSPcVpx7xZH4or3&Av(41nAxe*p6;hxIQ^12xlVWO
zn|Hc|3!=Ixt&6^T?>Eji(6{8m+ATxDg%8*?RVxoX<GtmEtZ`pSLs@2{fDSN!c%JM-
zIo{KzbW{<$45}<OUAwz8M5-HG9htFq-&ONz)$+`952Ik7AEW7seb!qk44DlXcoP`{
zQ}(nS+a@bU_3zstXa2XPG?tmvUgkiC(bm5!r}G(Bs`{qhE6{Zeyib6t&fj$~Rjpd%
zH$hzV+U}pwi}DM<o#^Q>6i_S5FQ>hjx>v+*ujwf6;Zd1q*>`V>>3+Vc?AnBr)3VNv
zz(Lf;^sbc6V0*v~%+L9kBRLz~HiaA9GD`Lo%qIypG8fMnXFF&K?yz2qq=rLM!W7Q`
z(RJw;k~|pk-frpmuDx5PzW?T(`Pz;bQ3cLqmqtsbkOrubng{FbKfflbFqP)8%M~-6
zlI(?cH`-dF`c4mVb5bi`pO^3Vc(l<dB&YbBi%~)~%3ru#p_k5m_=`tv_iMvb0jHa&
z(UYW~)o;SR1sU*(!IA7dDeqK@COWz*9G=N^xfui!xFk1M=XHzT7k*QJj;u;~VE&v@
zRe5)W$X>_PZejG-9Z$2-<xJ-SY|#64y4Ed1!{BlQ)!ph%*LOoCJ(cYjAL<9`%6Am;
z5<ApXi&drkC*a#b)Ve{vbh}OO-=beC$CNj$WXNs^jx+Ngza2O;eOixOS~42+XW`)a
z7J!~Qpv-)f<K>Y!z-4jjAu%Z^kY?EVBqk|A7)Y&SvtMd=+Z&HF&wF(s1t%&_jawhl
z?yLr|)xC&Lw6;*XA_a@ov(bK5PC+O2qTfvRu;Aw-jxvch{H$xoWw-l2TG%^r4s5(i
z6-8~dtXjV9N*lCrDtk>evR<(PL#>QFUbRuXNLwp3QtA;p@@wTN@(6VluHmjgLY%Hw
zkJw!&lz(<!Vz?qVc<gHMcyNGCA){+AI;TV$SvPo`Bx7vb$pjimUEzK`Mw;`1Sgi9H
zlpjH*Rb_k<-Q@4Y+w|=sS5eN`g${Rw)-8MEScKi`>uj3}!9;>J7}zZ&<du(fwtlTE
zn|6&2PZXaG-H(Zbha0=_6UVq08SdI^2wB$TqPA1|Z&k`ANb=4wS(qQMl~ctl;YZ7s
z@zrSDC~}XtQY>*=X;LsW&2OXT+&wR<IYOy*fYr%(qG9KnQC^#6pB#QmK0c3xM5hN^
zvM&YR7MXj@gL$9g$q$F=WGp5Lq97Z>d-(@SN^3s~fbMb!MGGe1X*MUTdvuC}b9lkS
z=~Hw0ob!jtx5^R^s|~eYY9VXa?Koh=b0#D1Rsw4qn%&`SJSI6e0=B)fFHk*8zp#UR
z6ZLaQv9H}IUO_2M)(CBWiF?jn8)DAX!DN`QvQE9ua7(<f7qg^uhejhsI<sD?>$CDs
zos}~JD}e$J>vBm{RfYZLHjtg^)j*Td`6qqo_USaKFKd|aSXf8X)F94@9v68~bHPfA
zpfo3Ah<Dl1_%6pIu}L#jIiB%5yr0`!sDQULCqZ+9TkIKQe}T|Nh@^=&DVdCeY!A@-
z9m>+;<ro--7YJsFq%LmzG<^FrA&Ix<_bH(4cq1TimZFE8B;Rr#?=X!OaDPmAYT$m@
z-K)X)=<rYxV27jak<Y9?KwtDSzscI9Brb|AAO}mGkEPwM7`o{1rSpD#O^tSbCViik
z1g<iy#8B-ZXngX!T!L7Z>NKBNsiK8pl0qmYtJlOLo3r}Cduzq6>Ztp^4Hn)TqX|jy
z3@c}9-85p7sZ^?nA^9^xlCQyUt>H`pm==nSl+{+9kJ7EBt{#ht)&0r05{*_sCLO4+
zF68o?A9`DIGT!Fo|901Fu@wIr&6OhVd295Cy<JE~-TtIPQ<H<cG@{800AU?Tc(9*x
zBucd}oA!H>)4X^At`Mv?FRbuFIL<2hpsW!nR%$OUFG?+bFY_<n@9-a-RqE~<u6B!o
zrhz4uijXY0JF~B|);^Qeb50difBTvDd3L4KWWtn(dzE`;$k@IwtnlPXK*M}c=ZSFi
zgqdT}x-Hoh!B+mp-0SPaOSd_oHFbo26AJY0W-2u&Pb9*4SJPu0_6OFLqQwW&hDD8#
z2jA~Ur)NJ&aEi-x6t3WHHK{mOskNd1%?L5%Ug;kna0`9z5+hW|mfI0}cXh)k@_a+k
zu(WGXD(Y<<X=P^V+-9kJV<gAZM|!*hi(H|(C8NRaMqOy^VZzfLVG~PwL<o(buI%l%
zyiJ;jnawx-Wa&<MUF6k7u~;VCu%PVb`RuX}rDgZlDEoB9)0lRJj^fiPoRqFUBM;p8
zMFW2_yOsDtt9NawW&e|w`WLT0R4bq6xe|hv;tAQ&R6b(&$YL2m72ggcyhqO&3*pM|
z`Ni;7n8E{J%kiUz=M3PZo|Q+ob<n<qf{Qz~fw>Y&X5qlv;BI#n&4_l<xfmgKN~0QW
zp#LzZw?B?3S={lb65yH~n7lI(R<p10ahk$qnNeWKbjRNtZpro?VR#JN;Fxf#*BVfq
zt0S^M4s8W7rV#G-YKNv*bxSHcvAPn+uRwI|ItvM}`31fLIt-%QV7b59SNqrYf{*AU
zU?ftgI|yKvsecr_JM_IsyP1dA1Z7`_J36qT75IoI!`|dvj97C_32t|8tnt9o#dz5~
z2z_E_KwtK4k;S5w{B^1s)c|P*(v|c`^zD~hx<R>*R%Re_Zl*MapR&&-zO_g^Ew9gS
z_Sp&YsBMX9nOzoCf5N6T?lDx38#~y1U#dWHy>?BSZA<Xmi>PQWO68RL7OJ=rlEwT&
zI=0q0R=>^HGb?abZJEZDpP!f#^Rvcz%h|{YFD8bQmsFkB3l%+rBx;4rY2|(@4RN}W
zx#MpXF9;M>hTXK@pS6nZTnb}oRyJ3>J$;Q4Lu8c`pX+Yk{(UYX!;mt|^0(yXfw$Me
zk92lzMOy(z>04`a@f(?@OLQ@)k#7ndWG{L7Hy(QhL|!+od9e24Y@n<7ELOayANa&w
z-&qXUgz}#USgy*ORt`k})qrD>5k1ycsx7P9>P#Iwbu=A%3%CuZp$@LN@SUs0Gb<<b
zy(kDm1p&Vo5fRx}%UYsYa@=8~z8t_-&#D|D-t9qgt2nk_yT+QANm8ebFPY_3g+G4B
z%c}swsO~cPLoL>x$J+bYjl$ew>ZMLTi>h0kx%NA}DA6wCE);sr?$wHQ^z=eTEHkNa
z;k#mzvLvKx=;oN4_i(fu>|=OZ$)XUg&Ixr{oYhu}T2~$3!+r?&wZrwwMM3lU?HTpj
zZdGP=U59<Y+ekX7$7Yd0v7^@_591kyC3;?p%WE(9HF|znNhw@xFgRUXQD|hqO?o)|
z$JB?6-~r4BiVp$8o79k!dFow>3gv(m2}-*Wd!1O;)@){v^)SQ^-z0Ot4|_t_;a4kH
zA~gOAHGEQVwX3QAC)*GkETf6XsfD`igLlALp6&H(VtBr9|16!&WSS*r9(XF$9!mUB
z2t2xu^M6Cr4o3SzpVJKU>FHVW9}(AzAuYxPfh9Ci?|yh=alPLNYYjfK(PK~d5ET%p
z5VU{P@HNxXpgWX9F@FA(g6v+`=Igh1MVxgNThR)R@q>`3*n14?APcSt1y-h6+=|n|
z<oB#rL(+i;jqB3rYg1a!W$jLYti`68kB^bj3GLjqonsv~m@Zr@O|Mo;M!&&F!&JY;
zVw9N!6EJ`A#%?fB{fCD^WP0fHU(x+<ggm%tl$1aRvAf&$al0>0YIa`-Q>Y@$KW3y4
zSJi$~vYbt2vj}QDYx;tuCT00Bw)fFVWXOZ^-d66D``vivrQd^t2i{J*M9pP9m@%V(
zMNsFf<kzJHTi#%ZIZ_EGwq>jaM7o>K<g0QgB=nrrA=`nb=R0|$Cqu}6oi}d1!$Szn
zuQlF)?`&H+9xGa$sb+G7v|eh~AGvQ`XLw_2DZ1M!<nS&_@`tNz>frcirf{LC(#&8x
zy_)QA*G#X_LnfeRBD~&*!Lj#pzU9lOHlOdQ_qm7raq+3#z1mK0SAKSNMCZS-021>n
z!k-Iy${P7UNl>k4bTUiOur-r&Kc&4;Gv=Ju9W9@$we#=BSu{?(%h9Y_FphEYUoud^
zL)`aRo(dY|l57=}IkBhQSk{c=DG5=|py**1UW~{SDK{<AKArePpPl$|OvR20`BSN4
z`?TC$>!TLqj9Lr-^F;^!4;Xj7xkjvgQo*-L*4bf9wNbj$pt;ryDs{Q&A}rm~#RM=X
zEnnoef-EvW-!a%V)Ud2{z5dIc8eTQVri{ODJFHKOc`T<f;Z{kXWB1~yLRagqi}+96
ze92}Fr6j(L87rTvO`Q30lrYjx$us1=2(j^0m`?5~%5u@D08~e-`n@uCIa^Zrph{ym
zsX%MDax=Z@frgC=Vk)|hmw94;HV5H-0uUVs8S$@oN%x6ZyzP8soUf<fy}^&#QkXi5
z9Wq)`s80|780pw+6{*I6PSeYFE!~+7HdcIWWgM_MHu(v<^B!8{C~Sq)dS3sIp}(VO
zKeAS{c*M-Zm%6p0mj=d=cIRWu&)$-)uf4n3uyluvIJ02uKAp9vD|712feiyRv$X>g
z`WYSxP$A_vdLQYgCSexm)qK}{ll?F20I<v@Qjveyqq}<d!N<S4L!Ni<oez(^*yEEG
z{Ig|GHa6E?Yp8YW&&-9aP{GBBeT=<s(MC<WRBY--`1ZY;t?>nZ@u%WXCQxS4)3}5k
z|IYIp(heM_=eH|&Wm<t<C&zuXn#;Z>a%1ARvbtOIeQW<9C1rNEaF?UiRuNZ4a&2|T
zHamt1L8nICW8Q>Tsw#afW3_&szhT%b(WzOwg!WHT<?V|b6cg4PJZw`@b1#Au%glPl
zBw%S16vFYb-TC!CgN#(iGo^yaw&{pIr>-)J*~pEO4Dy7y5Ayob6|tGma<~%44Abu&
z2J;7160&@KZ${E*_tw~SDQ8lI!9D`M+pISnD59mkE1sb5jEmOmO7rGYZHx1d5J+U4
zD^X2VXHhcs{aw5pX8ttTHeWkXHsUx|>0^*ibXe`7d}!?cH&X6Yn`lV^R86R((q__!
zq@Ht2BQ0H>q8r9ey<19aLR19FPq>#w<*ZQBag$1_3tLs0E^+l{yLI)>a+SY}zS%P$
zmW<k_#zEOS?210LFjx)g<o*b=X$N{gnslJrDK6n*8p{;ge6M|{jY2LZ;;~He9l^Fn
z;~0U8aTi02gCXVPj<QJgjub>j$K;yY+W_f;Rov_>OE6H%wkZ8N1Dk!~P^Y|{!Qv4u
zkd-#fzw*1s{uq9r<|8oPu4>6Soj+O(7pc%ntU5K(Sh;q8iB+qBIW-*~gHmP=oJtor
zjr0W8!=|5F!Q)hy&z5S7Q+C|lvirYo=v@@$*7XQHpGaIWMs&ud<;-(g(2ds?+8Dfe
zZLlzVI(%z)-?(^rf2XX_S_WA#MlKkMUp+GaaZpp|pd<e^89OdSJ>GeHGg3gNCcXFG
z$yh3yPx;tx|FpdQ)0U1$j!S05{FmzdNRQiL8H>NBbAM}(=OY6ZJ8rd}aMuA1$=9h(
z<LvU)x#trw<I$()#1-=96d+-p(3$-NrIAKOgn-OUQP@yOxt3I%uJ8!8t5w_fk1RyB
zE)DUBBYj2rYT4$}@&}QUE^U^}WrF)2F;%CtPz}4*?m*1s<uG5gYS_{J;V}YY>7Dmz
z|3%kV#(lxrlMGaK_L0+vI3-l8%UYL_skWs>SMA;}sJ1@BOJdCoxpb@6W~J}MWXPqq
z+y*{5OGQ|wJ_NEs)sxFuCeNI?p8sYDIyXbp6FnG;bn)Db=sAT#?AvscmgZZXskiwb
zG9#?|?K)Z`QtPD-7=|af-^fuNaiI}wj4Y?qB{B5Ol97dY*Zh1g13#u!k55wbxPwD$
zfOL!DSjH>|39Q@q%euYleSN*3^C&mQ{fp;gy>^PF*yIm30dGa-C0t2#KU2iDONo0H
z&s#W#r@^4gIM>c6{Kcj@-MB&Q09iPyiZ6+9#h=a9A$D;~AZ}3xxe07hO`~F%jXmqs
z%Y^I1qr{0{8IU~<ZYYxY;Gn)X18YAblzT#<Bdb{}%d<VC6RLSINSYAt_Zoe@mX&%Y
zXTasQo<R=c2L)rRONd1@2D+ziZ>SYa?P?y;U6)!BXn+o1-(F%3`JF}IUT3}W6GIep
z>a9y3AumGbU5z%;Frd(vBSViIO@6;`Ai6VwQ_Lul8Q#b}8*({pSK2VM2|o|VJLqJC
z(t(8PxGRJd5(=Xv<=;cAgdLiX1i|6{-qX(vkGoFKsj7`fqNCh;$?Vpm&t7-Y>X<R=
z<c|;tP%?H%_LIn6l%q3TI=Sn4MWNVoh0dMR$s2lJ1y93Fr2ER=JqsOCBX;SE^-#aj
z>nxEGM+x6J#}1|`Rs})taW2<MS%))|H5VasmYOD~j3N(vCy}FXm~`q=KT%yp=<_3|
zwv2Gc(QkLth_b<9)4%xie{yJe6Ipgej<{;J-K&jb6FHyotUPGiw>O*PK^^v1(@7x;
z=Qxe9!8yi3PPnfU+z!gt#$LUeyAH>Y0g~itP72Cy<Wv$#O%#8ROJ^r|nrTdXkWLB&
z{-zT*)-IeMAw8YUDMlr~GU3eKDb_c;Q*3Zd=a&6EQ*^@BJv%W}CzjaOL&XLW9qFB}
z#~9H|O^<)_F=DD-bGVJ~;)eeR;?LPJ#m+<5%td(Fs>`v!<YZ1}$ttchOkp*Do2PkN
z=NMVR%EfGIrBg3S>*`*uKK&xUV5s%@Cq~^>q31lSRmSm2sa&~s0rjM}c-4h9ux+Q-
z$Zx%CF;VhSvIS;6S(!x7NznzOkd6NOZ1WAy=OfxWT4=Rq&27$GH%eE8f7@YU&eOVn
zdt3<(5vOS3-TYLsrEd{5Y!xi`lzVYIZ7OIhIE%NdZ-jYlV_c5JWOL*FbLO?)Zzs}*
z_dC6cR|#Dt<e{tf_fa{c_UYf}qi1flMm?XX$}%FPpz!v}s>_9h+tqOkyO%0F)8W+<
zC@6ZeC8f*R$~i$pfp{I4;KCXyz4=4uKrl8sm1V4baVlLhn$pBOg_3#O6)R`!Ik*Vq
zeVUWmaS`-^9G!p#87a>Bi5o7BR)wY1sZQ==Xs3lui(X(e1KYH|+v)Dt)Oa|4@4g7`
zZJ#K4OuhI!e5GNhgv~=DAhR&>hMpb^XTG^=7&6+LhW-U(NVQ*%qJTzT-&ZEf{NH`s
zDl^Jn3Md-adQ~+@HnF_nOx<T*7sx@4z(jy^BNc3G<%Yn`gyao%mpr}4f^6sMxd{Lw
zx~(NnEyqGO!>MX1r(y<HZnMb-9bS<1eCzg3c!u3H>xH&sj%?+tO18$j-fE95*>&Z_
zgU_w)Z-b`~D9Xtbf`{VfZxh@hxLoDG`HO+;+CQKlT)DPE@R<aj8?f?R?gmuJNM+NG
z9p4m%VH$~mVtd2_YG--a79-NR(VJ=od8K|BE{U!@>!7Ijo0+BdyC}>N;kwpLAU>r|
zx=d;p-&Vu!&Oja2LYk>zQQy;EiP<rPW{p)=&E61d;aYIC?(=K`H-wJoZ<le2s!u}^
z!U+`#SpXk7vw-E(*@y+B^R9zZIvSUPh~GM`H)OwhdBN3s<Mq&~6vl}q^A^2sgf!Cc
zf5vt9VU$FKR1c8xQbv7#X<^Dx@yzc^{-pAhzbWC2r<*q`^M{<ArOlaF_0?-+>TzSk
zrl&v12APy&?=!=8xHDOpb3}J=DT(|mX=1_0kM;|#D$`}R@5BpMjX9aSf8SZK8c5Om
zko6_e@wiS6!7%h#L{l<`)%m%LknTLOht>`49jln~r@j0J9Vfsb+Dg^SX<CI!QkboB
zdUDGf8+Y%%Rbxv3^q=lIvSf^53KBRL^-*o+qKA>UTMC$GnTPELB;N(GmS;7O>aj%;
zJ883==ER7|r9HHY_|g9LYnWZ+l26=h^S#+ot)<{y19K-<3{J0uWvpC^SWP$YcydwG
zE^K00y!J>S);@`ZfWrKGlhvwy_w4qlik(BeiX9_&yJM(q`Q%qwb<4^^=p0FM)Y`#E
zGtG>I!!)a5eL`*OgsLHDnKp&ZU+lJJ@*a_274VA{xJyT_$P>>g@WkY(=5G!KaNR0i
z!`4le0Cl+=mZ^MCeixMzTEnsIO1hQaUvWD3_7pYu=WC#M?n%fwZZT`MSDMi$TTJ{M
z`T^hVQ=r;Wxw{<;qDVjDW6WRTeL^E>DBv(bqu1)z2<tW4EyMC)R*^SC@8l|~TD|Dl
z`*={#%v<}S1Om-$KkX>zH{~|op8XyBrJui*mEaEDWwrj9MYdo9B>N?-<=CVLeuHGH
z5sYFMgazZ0z5N9HKnmv9d0i<Jzhrdf@_xuDR9@M>e=zVKWrjmToWa$775K9jFKkp{
zYm8L;jHfm7QQjTm`TZ(*acZ5Yi(^3mhJalvlLzbWI`TS(QX$9a87+6!(3eP1yRd={
zuT*b=4(;ULXGe?8Dl29ntxw-^@3H$}x636jKvjnsQ>1y86_xOcSML_vXu;>H9`z=F
zy`sL@BdG*u@|FZ=F5{LJ9^=nZcFGbfbK{I4&rP1MY#0|$6p2QqQPg(b>4yytlGN|i
z0yPo>p%0FC<R|t=Ff#FFz(SjvnzNjYZc-UYv32ywt*6}jFy-_3A`My<TT@y7te#5e
z+tfZdF<g~0re)E*E5-_;jlG5;2mUtEm7P?TS44gGuT?C6#xfYYGWP>f)}mz|-3s$m
zUhRqf9^~&<ri%W!|Asdm-CM2Rl~CSu7XXnPy<G9;5wc1_wHOJyhM7}JTP9B{rNf^c
z&xU2FzZq+`>rkXtb>7wbwUPhU;EqKB8ZKE1%wN^NF~$u2St@oDIf$+tg}7Aa)@mi3
z3^O8FP2|Sb@p1?UfVm=JMoYDVZ&s9{R{JnrHLOfXxnZ37_-N>O)X&$?nmMO>mrtys
zO=-0vAC;_zaU8sppeoBNo_fFR*UQEht%XyepENtlv#;M><86;cz95_xJ%_Lrzdrx4
zP;u&Sy8MN0TF>68NHVN?1q5mz@gFwEEn2#IgnL_-K75)NB~sLEUpzaS?^*8J`(mSF
z8um>k|4S@tNCllZS&n=*!CRZ&tIizV6QMEIGFU(+FoZqlM2GDvcuEbj>#4C;Ntoy;
zqN#O{o>?s=3))0J^d6>7KYuZtP?0r6KK8lfU{e`Z5Kg8*rK|ITt+wtZKU(cWKte=5
z?UV61$jBJO&=GfoeccC*&Fkux{J$-VQOuOW#dnEbhTFvNGVDGRUzM(5<C|awc9n7^
zt3zfK^H|<N-#Xq8QMClk47Z+4H%wMx?O_5uU(~oK<ZocJ$ph96EXK2n^4$6POS(rM
ztN-2-drHmSQzEIQb6-L$&$gcGVZI`@QgX+yF2Sg|Cpw}=lh-Gd`NvUU_>cNJUi0&5
zR>Hcv_tw}FbH!n%LtJ)KgJb(bRf-Nb1()Vda9^iN^dK4-H+Jbc8mfsEG-Zv91ocuJ
zu4&{M3Jj%8K|AJDJNt6D{I?8OC9%KfD&=`**|~)ZFPL;^JiJ-(i6;ouO<sA56PqvV
zQ^oMqI3?E<uBo9qdMH`c5Z}nWv%pVOUUU#W>c4-vqw6J313&wFKqa6E+MrK=7XWyv
zEeuaQdQUSDoH%~sK8bp}lKrP4m%$xwBH?*JS%mM!zu~24)U+Yx#N_>{wDgDGXWrHW
z&DB@EPkz6wzs0ffTJEXZo3Ez5*T+Dx$WePjG!npRNoxNkZMf3!>tft=Bf|JxBi(Vy
zyOP&kqBkMQeB^-R<P-Trc&qu--J?RA%2KA+qB<<3E9;G79J`-_pWtb83%|ozwVv4q
z?*AMhy$=t;j*g;Bx2rYF^iC1++@jACk@fIcf&0uqybBbFYt!yIgr)OtfOD)uPK_Qp
zSG)Y|JMQ#7Rkh|?8NEv6%(HRIbXt&ZI#~L_%jUSF8p%kWis(FZc=oo-O+y!&T&)Q?
zg$0QBDo*e#`ER=_#O>=pnq(>+$k5_{%z-=afY3G`>yCs6zjgejpv)7hYEW>kHUtFm
zDbMO&opo3Lw8nd2o8Kw+jKfSD?2$P40>9TXf-#!0jo8%0{PElvgID%g`h~A9JjXra
z*xxKhccszp3qEYUx-ZEg%PYIl<ku)!b^qz4^MsxLCvAu0A5|5<X>s=>BXn0>n&Bz-
zgDC)8N^1O17svI&s1X(Wt2WH1QNJy#8fsA}yg_JB<e<B#@f4L`j)|5wMX%dPYR%$z
zk_cBgCz#4hIOPDB*jZiVYhl<1j})D^WQndcl&fQ(U$|N<c%pbSRc^|8(ixb9GSqUi
zv!8U}MW4SL4)9(4W>KUvyDONxv<BgXj<PqoV&m4eS5}y;oT5xZLkGiut~W4^NFHsx
z=QmYqdMM~vH<`?LLAG2L#jY~}iFH3lK0OS^JyZFZqW4g!2E@p9e9%^#^L76IRYb3?
z*d<5@*`e^)L)jl=ZyunH3vc6}J?R#s1GfXaFhWotmwBB?-{*$`G`||E_gHJDgk~k`
z`wJR}*|z`Xb`V8kjs1Q6w2X%&86R611fxvju3qii?@$O0Pv$EBPn4R5LdhgkujuX?
z7mvL=AYh74Kx-)eoriI2>llU7=;9eyuAV?bv}~Bd{Plkf<@`ck0jqBAj;#*zmTN*F
zHV?fH)cdenf&6;6H_fwr^;bjBmP@<x{jP*55I@-d4|t?_3xcCsbcpuM!}M+|I3_T+
z+C%NbaA#sq4uCOWd3$efpgrpu1O1L0Gq6-Ytl}ad_e;+jLqdP<_9WjAbg&?)A}T`d
z<|A@5MnvkV)a-oiodb_X>kqs%iNlRgotqo+pr7Dp)y={0m1%&f6jJ(~Cg#1{HA?se
zcWUjJN#K%`-A0^=_=pUXq_+wGflJkV!`Dx1<+}o_z55hvf`jRssbAzVNsVxOe0QUv
zC55-;9*7x{s8Ai{c+Txl4STPXzAp_)4ex&i{{w0kfCa>J&7g&0$A9f%taH3Ggyo(J
z(P@2*hm;JNH?WEPf!)jlg)Lq$jwxnYzp_Djb4R%U<-h-~hNQ>+C330!GX|;rkx0qP
z%y%m?_GH(;5MRbCO@RuGdc<3XMzN+A^Pcy1_(@0_z$oR1Z$i2J0fa$G$Tz&@D~Ub~
z4+EY`)%k%J5aI2xc5Zv&dn=TJUucHjCGXC01H(EJYwEXrArpI%eK|`*X@l+yDlr!n
zCBKXv(>S#8ul{>A&^O%w6;8i=d%Q?lccMhg9apDrk9M8G$i`<lZ~S!2lC6bSIcoE&
zYHD%axi50}!771@y(it`&`a+|NATZIol6n`XOxjkYo~!!wza?x?gHt6uo*BX*VuUV
z-w)%zaJIN;F53d4z`;u79f~j*>aE&sduI{Q&M!bKgM=P|h@u0o{#*lc?Wr$aEK9^~
zI!t)tTu&C6PSS2-KFu(25PN%jg!|5iQ@R>G2x$&H`^EN;SNMwL@~tlKs+IQdKa5Yq
z{A0jx44!a$B}X6E2?$96wa}$x;M0MKiT{4|BWdIERBqEjM%XVR%xQzrD2^Dm2o#6L
z1aY0&>(8XN68S1O1LMV(sp)h>x&tZ3<<9ax&lO?Dy@281L}h*GQ}#t={rjp{7wbz8
zPwFJKMLsV@_(%K$c-x)Zm$EV)s1W)S#Ia#J2puj6<~5&RciX!PUZ&R(?S~m*uS6SZ
z=RWZToi*gBQN1k(w(xwRKQ{e^IaQ7gGfyltmn1J<U;hSn^{&{1KG<j6T}ZS4=+8Hv
zt^?qvbdA{pc$86+6aS&;e_5Ue00*sOpAk4^ox@ewwjI%-sIKsjQ+i<y?HzK@21Mv*
z<CP}saL{rpIqH@5w>Zt^o3qkkk3QHHX&n(_U)KkbyvWlXXF;>`p|9@x`3c&?W>f$P
zZ~x*s%mV&O0>3{didi`0GV34u57qfEX}NxR*!J|0s}KL-0s%E8zf@BzVfJF>ScK`h
zCmzhslk$aPlFq*i|9|NM!6gR4eQ{4f>E5NgF-{)V%iaX-+0wsx1Zo%KK1fmlA)k5L
z!Dy4EM%GCH2*^ilt#9PloBK!cf%~J4^!@%uY<;JHRBKjY1j!J1X4L#OKv}Ex<;wn2
z?rCe6s)OhA)393Maa!R?Bn{kUmw%QW|356%e?JYC0E|!s)xP<o)nG|}n3RWrIT0<%
zHK4rb0}<c6%eqMhQicss9o?*DWV(&^fh2*}{Ur2%9W=i2$`8lQy4Kyjx=bOMFd~lu
zMi!vCdv`{ofV*t_zhK(^b(d7RDEdhv29d_A)ZI^B+WSyH!v7mM#`sR5yFdw1*-Y)>
zw%w>zn*E42VxN(DbNU~^8+t@9zYc(W+2g68#Ks7g?|f!p*bB(zPwA~vFaT*gOb>2X
z<+!#^=B^6UeJs)rI*91bTYZ6MuRw>Nn7Fd}VRQjz^&%?sZI!s0J$gv1!wrl1?Fcmd
z>I{=!MJRyUmmjpn2T7~f&;L))_%C^Bc=eaKs<e74l&nQ$&dE~p+SCzyHd3G{4bW*{
zuGdNy3~Z64kA-wCFH5@!N1SfuA?d&wWuCwc<Z0#|{nH{s`We>iB=9B?`=B8cbA<Vt
zRR^G>KRgg>6dz&#zW@sXjp+c+tzNPlzfw;?2_Ex<71w}wxsBdP*Z&-1rXn1=OL6Q^
zum_#@a-A#obsAhAr@JE30Q$X$XYV&XOvk$?A9w}L>3M{Jo&7@g)zvgk-rMgOB+&YM
ziGDzR86V#uftOnPaeIqbFD%pZ`S@wHydu7IA^#ia(N{SJ|5KoX^X(ocu}Ql>QF3M2
zQiMdzKiQx^{z|qb!(!E=TiMo|@0R7<b61~$m>*>#%U9hVym5QA3zVV-kE|aZ6T4mV
zo?CjIRqH3A8t6p&cLr&JPOip|-|5ZIAT%t2&-^p%#}`pk@9-==Dsdch6l~Gh3cwWy
zFvPQDB&=pjE9#Hq{g<x(Hx}W)9%O=iK@dJhWDQ2E;Je*Yn>Zp>GW2`YA;WsE;t4A8
z<DvZUT3@p-zH9uQLE01%lK}!Rvs{Rg4(Q5h+aht|{H+30J(##&KgCg+9s1LZsZft=
zY(0ZyoemMOQQ1k`qn8HtjXs8GDYKkj6qL_Jk}}A4?2XNN%XWW`!-k5i$vzZDJ9@PL
z1IX&DBwqq*5$J1lSPgi@4DyPKb5(3$e<K6-{je|YF3lLn#S(N-(yi{gBrToO+l1)f
zE=g?bGW16`_+N)nK9<^30`B}XBv~PfDA$1qLGGK}1QJUFixE+vN$Gq%^%0UmG*l~6
zo=lWanV0cux%KX^VqjYN;f9E?9QtAWf&Bo8V^zGvNz4Gd;D1|~|9B88HXkS;OryNU
zfZ+ruRf3a4X*e~XnTcC-^7Hf`N|sW{cYea-OY+_W{V#0RKLE>j4_@5`U=oZp-VKHg
z^{O+e_Z**kyQqYnpJZCSl}{96M4cC{k8eL%%K&btbA3pGlvFq2p8~8`I|M(?rWhb+
zufk}1wxrA?G8mMX#*4rQt9os4uP^a-ZR7159c7w5=P<@*?7}kjnLhzwqx}TC01P;F
z+IbpR#3P?XZuPzf3eO_T(MbUFxCj44?vAsF85rn)<nc5G%PruEEGi3?>ybE4xgL}$
zRc?>L%pEhz=XROvoMt#5kM>;r<ACQ)Vqe!%hM@!0T4?l8H^K}(Cynis)#dT13q&_d
z+k^4<q;UNrXBld^yx-LS0$(ORUw|QA(C*Qn^Zh^#beekxPt%o)X;_CVESCtN?f`hB
z^i~-?e;wV<adYf${+zUnX=hxf!ZY+gwr+h_>Ge}S#+fPX_Q^Sz_JM{yNp}1Re0cTV
z9;THV`z<ae2>U^ehCsHRUr6o!XV?h<u_6R8i65h1YNPZkPNv?{Vgmve404F}Z22J%
zE=A~*F(Fag$!AF~v|drBLfb}%xEIIRKPJ~)Am1VGl!&h<M)C0JIn>3JD?he$C`F>7
z@h2~baLSDB0Tp!v0L2XY3qkhZ|B-j1B><quZ{>2m{DZ7<JnVp7AE-H^K_%qTO+xn?
z@qG^?>^`IC@rLgGQ}^1}orG_POHMZ<OulVngUiV}=%NkokRH!&E$cYhd(l#U^5x9U
zqx%?`_LK4imaPr%26p)i10gibq#fVhUz=Mje?HHagcgWM`q|pJqd-ejjf(+|7Gn^R
zodAOOLW^2JIOX>WSZ!iIP?UtAF$(cqV5COjdETnL3V!O~7T^VhLo0E!7^&9tKG5HX
z!msrA?(%JQ+u5IJnEvV}<#vW-Is)NgGpeesyWF=RGUJTgGh)q`MSh->V}GGGtot-*
z_5*L|5E(iY%8-X_0%h=sG!X7xt7({P9wlxmZ-#>bD?K{VArJo-WNm)p78Z-(IvB!;
zyA(evzVWwK()a4?260~jDSF{hs>9^W*2bS;4g<^%>?DHzjgLa$6~GNQP(%?01wT9q
z839#?!q@o3uXxUrxV99F3c$t%0pobXt7!72<M9n)359{7<bsT{fOX3qv_SU7Pf1Uu
zCoF+tc9_PmpyhU(xoFP|J529C#Ew@8xJZ193?;iJOyP{F+{ZKT;@K!S4>gW#%=&l_
zpspf&niZK>i07|>n*#nPczXk0a{_)%pn@3I;D8dlF<wM!e|~1iZ@2h4Q$*$NhuW_W
zo+?CtpWf2b`YKW)0pXPDSRay)7)X`sy0nTR1J4y?p&Tgw;Wfeya4^^2eW4rw0b2{0
zw+6;uJS>)SUpnp46Ti>XUhc`RGqV|5NB|^Vo2}#FZD^SGV{p6Fi;NdQd~H-FvnS<%
z!mBQDyw7^lD6@C3=EpwrhHGVI&7HdWsct*YKUHOhpHGaZ5fv~y@KW78vLPI@+q7$V
zdYKH2qTa7Lj(JN}%?OUbLDjGs1n?hHbu*`cuJlpRuapOSk(EVu+6jw4B2vGU&MOCs
zFROwi^gVBD`Gul<VX)v<dU1Tu7qt5<XP*gL?1~VPdqt<M<-pGX3@DAD^E=n<YD*B8
zsMnrJ;3&}IlsoFNE?hXjT(|R5=9m75%=-cf=X$`3-&vV1G;qumwv~4Y!bsi+NNfY*
z(cNf5j}YJ$KuN;@K)KJ01}`2@EV*x`c?SBla@GN;<?IA4D^0ZYV7YHFoFU~t<1I&t
zTKiuapQ9ty<fon=|4OYP+chJEcGw4;Cy9K?=m#B%5lOd1M^S8(qs+oQeJmYpC9I1q
z$GNu!&TrQfx7rcef7K?Is5F{xsrYI~3hY%XJ8Y9y@ZhU&lRFbu`_FvRTNq0|b0Pab
zFU#^>dImJ1>~#rPwQOI${sM%w?N|R7F~Gmm1pLD@u}FM0hI=t$Yk}hQECj4&5C&fx
zKfQkgw3jJa0D!>XaAPDU9|%ZJ1C3*C?*?lVvs5m7?Li9T#^wIzbE;pa46A-t;BPX^
z_Rl+4^tW#8a9SHqw^dmEnnZ-7wfA^xh-{jtZa{&J(TCGo#imraB7EX`A6>v0T={!H
z{GY(-|MQEy9Ck~()Krdy?oE=IV+iy4G%Vw3Vw8ko;AH}VhkiM|O<!}vrcrBe)OLvl
zO@$*N_HLg0y~q1k?8#b_!|}~cm&6S~ypK*!WxGsVo#FMTMP1{@+XwwcT|J{xf2voo
z85^FyJN8&{PY%hMy6a^Nk3fJQsP&=vcL(tQ@0ot);VbWYNzVhJbNOt<QfA6QoA9f=
zcZj~N3?1VxI~vc<4l+QJfwiWZU;s12FAEGD{>!ckspEb-@_^|1w8rJ9%OI2(E|%B2
z1yH4)C*(`CZNecK>O|wZ2-Gac;c~N=cF-R+dwBYC*AP%k<nY5&gFo81jUy<>JO#3-
zRX_M-72U)ZG;OI+1?{B`B6-tHa;XG9o=*;m0mTR28UX^d{g>gwJ<N5s=B_>aEZz5Y
z;+L56xnQ-hC9P%3O4?rg&~v)_cDALc3Y`)}hJeU>>cuH#8j3^_@kgu_Cl4-vqyEa{
zItd6sBw@I|DW$Eq!|onDn^G>OZZpuwbX;<Ig@YVvdPf^Fql5z=qK~hXXt5}(^6%mo
zSS;W9b2r;HA$3V?J;M~+&;wTjV1zO@%cY&-z~7UdnDPZi@cmAc$KGY|-6(QC6V3$+
z^)k!%dW8hy^n6Dw;jB3;(ueJgV;5XwCj!{2O9KS671X}B&uD8>4C>*b{_KOtmw9LX
z=M~^m`Ct9LbN|2IEfB#11{I;87MU}18)@5TAb&AZ;&gp2a}9d{4M#5O=d?szJOM7%
zC>pd4<uhx|Z=l+fbe?V4&8*{-KitDVXOBO_13npVgz6r74R^e2upRzoMW~mrwi8AB
zR|Pcyu&t0buP~ZW)7RO9`NYR|jQ{<0szo|~RVnj>B4@VmLwOFA&jHGdb4VBf+0Lwe
zBue`Y-|q^LR$srF@rt0mdG8zk?9iU8!j0dbOvwmb+uq_iQ{Y~M=lwQOS87FV`r|f_
z+oE21_k)iR7I;hj3r+aVX>hgTbv7ZwK20kh(*?Y<E0D}YQ2%AZo~3K^@z#;4>v~@%
z4o3<&6~UZA+K<OXH`)4VO=r}Y5XT1<pFn4scf{Qvj0rB|p<V&R4}5InOD2bYRt$Ak
z&eg-9Kl88gF5B$qm&swz5`K>9K8t(6Y_dzwkl>&4N`FDc%x^@`D*lwb=hU`y7I@b0
zbiS4kIc|7%6+kDAMS#@$7PbD2*T!bJtdIF@j%5P&S(=~q;|~_T2litBkRkqy3E=;6
zxxILb0DDJnq&-IB6mUhMh1waTOWf|di8l8up}~?ws6dH8F+eR8*QJcuB!7BQXZ5L?
z*EBn=xE%@D-@J5pa-XLIK@U$GK=ePs^!#9hrH9)Bm*A>~h<+Q9MPX-}YRIP@_otYE
z84yLmnFp-?^vt90A%i|eQE*0~POcGe0LBTB0zKnbtq%Y(0T(%Ys{kfMi6163++Byd
zv9a5vg9JDjY9qH6QV3i>U#1UYuU_8p2bgs5mm4($90e_r517y#Droj$+hmbTj))rK
z0xg~gkQ!@`5L`;VG&)%O5rs6+r+B%`PS60_!#mfXuw7oq0}x+R$LJLbc1V-w)_KuZ
zzYUhhtuW%hH(mY@gfU<oqKIM<U8yO+1heyAE2)<4yOU5MNH{)_HNOJ?Uyt`6Za|;l
zpyAIA8gruUWiSsumls3SPsXi>dL3$oE(gRU`?mW4j+(CHyS{v^|I^OI(u3zGskQUY
zKe3%rUe6V3xr8FRj125_3lTkw0VX3;+fZc@Z=1u@vJqX^p#xD*OOhaXIRY?&g|02-
z{~fei97msaVYmt2y9L?+g+DwL-|-P%trT(qqpX0;!-^Om)z@E~NsE|T2?f|}zYo9l
zimAhxvKqFvxv{niu*&VdqNQVy`6HiQ%l$MTPObsncPZofCx5(Pb3plk`q6J%uhu_t
zQiw+({dl<hHo*aB%`*O9QPRTBLhBSjyrM3=#PydW0xvil{p;%grR$MG4NNl#;1IZ|
z8}U8wTx*v)i0=4P7`;OS^~spe`bBVik4uP10YsB12_8U5ZqolT8s)jS`<n4DL8lK;
zSA?bd1`fju)=q8>xE#@Vl~3Akh8-^a>t<eDqmKkh9-qSd0~NBjnRc2DJmwojItsjN
z6;6;Bq325?xQO#z7pWb=&Qjr}5W549`crmuD{O@})Gf|)+Yn4e-Y2X*3&K*<y0>^N
z3KQYiNy&#RFFT%v^!2MBk$Fkz{q;`&4>8ey>8d}>9(tw{8UR0LrM#n1xFd+m5vtxd
zEhBWYL1d8*XNX`KQK=$TVeNuJCfxQfA0Xj4G6~xAaCLw`r;vav4s<g+!9)cAxH)bw
zeZ&NtD)TQm?sh!%{J~Xw5;`B<B#L}pKz9I^pFF&!_V70Rlb*2BwMDmiE7vIt-Wnn>
zz``UN4%()5_XS?7MpYO=9|l5WV3sWzij9j>d$yZ5$*6ON0}|i+8%Fx>{prkZR^yf<
zwv3RoUcOK29Ci^aI@pW#3Wt@J4a1<p7z5-HDVAe*-5|#HjQ79*J9o}nU!$|yTl>4o
zVQlOog3K-rcVG_?^`r_#cFOz_WiADgORK`W!0k$;Ye`#>thY{qj?C8^$1c0wb;X<Y
z;T?3tyX3WjE#!cKpr(!$mwg3aD1Gb6#ApCei387q>uO-Q#7T7UUr|EHw%uGNH1y0U
z-n-b{(YUs6*c=*KF(>Jco<9OfBmHR(W;MXKm<tZ)N@hKjpVb$M$qU-aTE}7;1_$;F
zC<pa~o(8j}lOVxDjYD)kLJMDs!SAiiLcDrDF#u-VIGmI@rkxNdF~7HZz?WFYlH$Ft
zM}GwRU*(_&6hx|!2ie%-?_wA8imt;JctW@ToH*9g2PjjoD`MS^EMLLDq(eeCks`@J
z9ngVk2gkFEvIOXJY<iFJ@Nv>=`R6Xa)V2Hj3f$cr9k<i%pjCUkA`}rP)&n#;2SqS1
zE^<@{BzgwjcY(V&6Vy07ntKZeP}grZX56s~`F@J=&On&9pTVHoxV<3e<<2hFADmKD
z@z{e2I|b_tmFM2u@9Q01E_f$O*2WH2;{ujvTwvD=Y??khEYpKyGD)ggBg@LXS%G5J
zRRAoI2`fx?#6VR5uR6a5$;T>`D44H>$Gw9#ATE?TJAv>XbXKAFNwcz0>yKxAi%9j$
z1OE^Dqa?33Y`1CHG)ns~{V#Wh0PI`y_-6*o`~Pj5^RSZjp-`AWItg4GB(inasN4?r
z`|TQ)m)DkqNOYc-_v2@^Ga_=a7C8lOm=hT-<83#Jb`9`_NQwZ&S>N>AiFI2Dl~G%U
z2wA*>hqYF_uD90`liNqcV~?tC=Thxco4V(4OpCwj2wW}M%KMkzTsgA712%S{l8}HN
zq~+!lF=%qFbn7+6!+-9usM5$lbU#s#VP&uZ;CKQ>UcKzz44%>NoCAcLl?~F032qn=
zF>k`d8xODBiQiTHO3B82^Bx{+O3LGw2dV7$*mCk8a5I0+e3J4(oStfij4s!twnZys
zpIk-7DDr`gS---q6nn)ln7fKMe;TCwBUM!4yV;w&F^Ms|iMtyahruJN8JojdYc<G=
z`=+x{Sl(Cr?c4Rmv)?LOMfO1F^aE_$B<J)ZSU+e-AGFa%=-N2LNk@gn$RoR8?|CrG
zK4|-9wfWbX_cxlLh2U+3yVxT6MT5w}fJmXtHV1fTkm>o!SFf^8$krD9v!w`;CN^pk
z@>vBkesTyKCx+8xI?cFC?K$a0Vti7Ds>19px_3SYtR}4iI<4+OmtNqo$3t-4`#qkK
zx)^mKULBWi9nxb2$1%;gOm*ikXQfbxPL(9lz`g1XkAqfpYbI2hgEY;h-u1}`48(h?
zOcT4p*0+&YK5IAN#QCuDWTspRvpu998R?}1%~3B<R2{L%)7D6voD?{%c`SyL$VhY#
z>c9;@{ejBxI(&P+^0048NXL(&CYF<!Jg#=xd73TCj(CQZM`Y3Mq3HwD{?peF6$sN3
z)|sk;@>6owRS#rU*6GpX)Lt#HJ^DigH)qm3Z_hrJs{z|MAu`!t07`CAJ)q-AF(ctJ
zG*m!*44eol`@OIvncwiu3M!|;5cff0??G<f%=~<LFcCyYZ)Y+8sVSS)=qUJTS-awt
z@ghI5S>9=Dd?m-7rs9m9zmZ!xLzklc`rz;(l*hCRhiNsNS1urR+~P)58Yt*4QI;;G
z@;V`N*Ggvv^>JD$B?YyLQts^P<__i2yd#Mx?{F)tJ?Mfd<S>Pv=LY2D+hZy7?bEuY
z6NTcnDU(l$iO|i5EbsSRPS1r;#&s_2TAwnpu>}-7UWA3nw!!STbT+n<YOf`ZtFxbh
zoWl|*{1Q^PXs@2rcq8WWDDNXZ9t-#oC*iI8JoTYX!e942{&IrR^?@&~ow;F79WbBI
z1aV>YS~h0&OI2P?D!9Z=SLHFqT@oL#Kv0+_ce@_V&O5z}$c{6k5bnptb6k_c*5wO<
zo#|nw>E}Vr`F4z~kRya$Y|lA4vAaDh(tB5qNpL>%y_}zjYdaP?WyPC;nw~wp!2#K^
zi?@#T{NzmJFtr!<Z1zC>1!kzxR5zJ0;K&|XVz**CS=_vbe4mcPob>miDZTbisL-y)
zp#qLfL!!-fX$3pAIUC>zF^d^fbcXcDVS{Ln<D6|0E7KaiO&+WMDmKfRrL<af)>?ie
z6kD^&X@%?b_R3Rxq511HI#<z3Oq}CX@GR4NU<?!I{1d}%LNO()HLG_7%FE7=tQ>4{
zh&10DxJVJh0OQ(FFT>*t<ONRj;tUbM#LPVO&@?`~z-vce&*NjQGnF?EB%+-ng4@3}
zGCW){rfu7(plLAn^%x)Pd(gI>T7)CA4>{G_<MUjg0!B%i7YwjX)>EC{lbdx`*y(Ao
z&g*DR9P-9F{zaqr?J@5Mr+)RhrS2x>d%m!X=!{X;ZE{Qlq!8BPjaUSuu)2ZP$y)2=
zRmM)hgyAKvUNUwA4;resG`7=MuydvpkE7{2yB~a|vxJRQ^WoW#7wa9jT<x#H&*AUq
zhjw@|AYK$!Ibwf<IBvh=mS@%ObtjpMY&8d)#1ww2noq?G6zgA*J2uYU_SWhO1I$wi
zOBX3Q`NG<u*)xy46M2V=t((#`Lo!6ndLydkB5RS3{A#>2_V!I)5I2i#limWmKGbS!
zgwv!iF6s<<%pF?4Xj|)u5kt4Quwj0GY=4Lzff1`Scswf18=0exNn;=v2S0mf@*(3U
zZN@DMcv7wNEwW#gn3E~O<Mw7)Oi~VU)%HQ~?>Q(Y-7U>!G6N1x-*7pHQSBY2mdK9{
zNP#DExA-4kyX$l1`lBmX30__Ke?3fkN$@j7fh1zT13W+xc7+g`5p<sr9vy=nHS&B*
zel$E{^qTUh<U)Eq;r+bwizQ|E9fgGb4nS~pk8VJAjIY7-DFqv@pAO#$W8mtfe&E$=
zlu&5HYo)dS3F?Mmo@K0+^%)sSl{LxIulG7R4;e4^pl{R5De|k4Rb1sFB`B3+o3T$#
zlp!w|P7|NpU9}40UMPg0zh0v$%3x~_JQcFR;WUNOpo_|<o5N32Zt}V^ySq`4wj6IE
zb6lhgz2qh)R(rV7JvP?rc^Xx_dKbr2l$<7xP1uC?E|CkA^ywMM+tp(5z%(%?^#W60
zUnR377w_tSGM+jezlMYv)$?W4WZ{x)+)nPWxwg``66)yL3+|SKt^H?_rC=H<!~p#f
zz+$UXwDB0L8;{lf=-hjFkl5@&jN}h-nRUg-Z}VF1KviEwO4Ly70~7>Ei4e@c{_J>6
z!;C#Sir6{WpUxssi`08w(+4Vu9XE~VHs);^tJj73dtf&p{u~hQ))h`b0PCqb&X#rH
z0!u?O&mL`75<S~%*LvCev~p|#VLm)oy#=?VN270vjdU3)WMhvcum|;e&Rr{AFIH^k
zGWueG+TB>iT1bUaah=C2-g2r0YrA3@REc~g02`i3=<WQ4c-N3ajQeB19`4Y&_5)sO
z{Cu`$cd^&1IMQ9Y8PT^9&8g?a=7e+D8z*#}4aBaLLa|b8TV)z-ZBd6?f+rkU&z9Lb
zOk6~4A&er?Tbixrr9!Q{>N<tGZvOZ0-#>3{mD!9HK>1rMYoT64MowFkPe&nI-cRlg
zc*|FdQSqp3wUA0}wnT)v^p&s7hMnq(h;$N>;s+w};1yUyaNEm55ZuL;FBej#g)w_w
zKDFa8mAH!9_i*fU_p4s1^*R0IEV8Q+%%+BA8(m{Pfv%y1uZ@c!y=qQ1xNXa8PRSZQ
zz*Pae$sX&8uq#!1*Q;zWR9H57Y{p!0$=tpN?8=EA*NF`W#LJii5+gd}=x$3Dc2>NS
z6=s@I^YkG+mg;Evz1NGqjk2s=4$H4X-$nF3v}M>nd*(3nrJQ>|is6H(Xh4EPS})ce
z<N)@5_MGi(!>5R1>pKbd9@=o~HtCroqASr)z*iwc?wwNR9K-`c`<eU0xlzP^R$M`%
zCZJ!piVw2C5fAs-2&;SbSXtGNv3SWx?1tRriSdx-?mBS_osif=7aLHRb#7oVo6(!H
z`oq68cwTN=R-sQyMwp#zYZWXoF+4l<znymkXuQt}5<CyS7CBFxxJ@N!mVNa1n8PD}
zaJQnK#f9z&?samb_GplKb10+ynf!SSvS#@7R1a=_!H_70ZPa@+4lUO@1L9S}dzKW=
z!CuQ5Uj1yS3AQt$rLsd@nD-()B<Cw~Y29$^h(t$Jy`Rjnb<@l>7y?va#V|wo=l>sP
z?*Y~1)@=<-QB)41q98RY0-_Y9*TjxU2}%=?rWB=07m^SW5fvmV2vP$gVnBKc5JD)@
zrS}eo-a=>z2?_s$p7Y-Ky!YJujr)&17|F=UAjy8#UVE-N=U$Hhp)O|#Z9PO5+^Hjw
z-M5G4gGN4a&a#$0mAR|A-+d?){9O(_@c1KqNJ*J!sPil-!7<{`P$&MGYcYKXXf2BM
zm`Kv64Rm=52WdOZq&{M!lZr8IIP*XbZNMvDaBW!DT~!ZO*ZKyj{edhQ_+rvMtc7|^
zmV0y|o)6mlh@<SyOLRWd)zY4=5N?(>%;OX@ryLoWv$3rIs<mSChVX!BAcnH!r5UiH
zfS;0q%^+J>{9n<zHn_^>GaB8hN@o~%Lxp{B{?zUeUDLf3xyJv9_46IXC=&T@8AmyV
zr79C*Kj|kj@bBl(MO^)Vrqcg<!?A-bkz~pHa^Nk|?dl_z69_>TUT{((!-yXpJ;LBr
zgqvjr2YMjGeRP785)R%Ef?`L6S`?y2*VyI27+nsytGnNvvTII9Mw+t`k8>hrYFs|2
z{d)cSYvvV#zHD6D^7OTW3mckK_Ze_I!e`1@@z1?L0y&;@6qs$5f^Pl)%Cyb^te9{1
zE^M)bmtBk|OXdx0xZ9;My?#o`-gHJC5hr%N$_s}E(c@iio9d}+;dQEg4bvUnKYog-
zScy}ecZ^glLz}s^wdnS!w7n4oZtdVkgHo!Ua}vKUk5Df3g)ESgvn-r_vJRAa$_Wim
zO8N9j`!ja7XJ%*{Iq9VvjCoVj3@y~M_ClDJuhMA6_wa)W=x@mJSPR5+<?^nMzTO4C
z1h1M{j}Q+rGM*z*3phY;7u(X_yf`lw7&<oLmxV;$NYBqSTnUjSwZzi>Sc%|2$2sCT
zqSJI;51b-Vhxj!Z@IFj$QCl<BE?PA5fc`7Qouza&H`yOoww@p8D=Cr%VA!Ti#@53i
zlkKYJL*1oxE4LLxXCOFVKL~;{!=aBf+R`2TOYhdD-{p)%NOqASrI#c?9p|k|y6kM_
zn%f2{(}}X^Z;^C*{)Me&v;r|QXBe~IHKS`Wo$ayUClBUQ@TsLKe%zhqdnN>30)C#-
zQ7PfBig)W+V52Cf`_7+MEQw7V9ui}q3Wi7hT0CKS(69K_r5v*YlO5HiLzHfdK(Amm
zzh#&1zQwvh_lkH%i=tu~vkbHB-)9Zcp2EeHj*aY4fwpxyeLbd@Ga?nhEl)6Qqxi^P
zzHBr@rPXeGf(?Cw1x+Ze?}xT$`cBBMJJT0U7aG=O8G-?APJCq{2pIc{`!-ID`DVmM
zSvpS;0Qx@rfj-`VKGu`_c$<Y#>rNi3Ub7gwzs<K(i_B6!)>`6hF>JydGNHIG%uF*y
zSZHXE)SGo&K+K&75?eTz_-93Y!?bssyi)hKfJii2ir7`xhwhGZ+^KK+;5%oMk>iB@
zzL_X%3ESvOM%T6-I3_;uYA<+1Nm1{R6)cz^ty^o^q&u2!-lIyH?Y&Ch5KgXnA(Ac1
zLFvjqpy9;Ek1n_QoUKhFxYmXNA=_-#JQ5C-IMYpuJy1;}&E~`O+dJ;^cptlK`i=5e
zF91>>kaQotmL(dN3~NB`VjHQ)xZ!aDBL{$Trf)2W4$FGDN*I%Co<krFR%Z@q8T56#
zbWAoXm-;Xl9r-e?34z*6GtIKf3$z7y-!|OD3vB@C>NPpnzHalb7cLlHb1Nsu47w`M
zlu!5jd&0ukJ_{xF^Du!UE4fQg_?o>wEzGKwjrytu?@S=6)=Vmh7#Og28UU&xZc`|?
z2^3Y7+3$(88+II)=+dE*jxEY(%K@Vpey_!E#};@Q7zu5DiB6XE@^Gl$i`>GI13cL`
ze^A$Zid$&)dJx@#uhaW9Rgc#KSe74sXY`cS%AAmOorJ{6Mt06EPoY|<E=^jS_Y2#5
zYvG2HsGneFami()pt8;q(_jE;aKcw1I^)bii_|s^6Ie#owrs7$=_Q}piNTz5!`D2|
zLKFF3Y4_dBSsGf{V33feV`{z+SDw#~PPbHqL&aAx<-;-LM!(uIE5uc(2AR)iuG7rW
zy<(IrV)gji@&6a<{I67bDY^2%ZvZNJVqzw(PCNXoXAI%OT>G8t8tG-NNn`I<?fB6`
z(?!nF^O0kgaZd?im!bM%d6nryZf?E1Wm8(i_bA%d!h1XTeDpdHq~$hpVEj+b92okx
zIMFb7%%mkgWhm*5jE^#NHzG`dh~4Z{D)=_~CeME3#+j&i9?@n*5L8rQql`zdPJ%>p
z1;x|b!bh#~-dlw`20QP^85W%c^5#-Eh`I7|6h>kb_UWFWkx|Hp89LvPYcb+0a{=xc
zbs*Br!ee%r++Zr8noua-)QQmf1g}<4dF!p_$m=eK%b&mJZ@xdV#Ra0;fNEzzt{0c-
z^?SWJMlSokhWgzhC`(lE-3RrD7RA`@xK)DV+(7`6#8LIu7<Kc9Nm*2GX7J8k&9hOI
zqjd;x&XFtFgL+sOm_G@yh2%^x@Dag*!D9+z?kD`p|9Bdrup9s^tK8u80akb42yVai
zhK#JmWu)^@@ra*sfak}A2BVt}soY|;ZA9x7%zVbZ*$dv12d9zC(Q#8#%P(bQ0r2xh
zJV)8=<BwG@FQq40-qGpwY_lYpO|qpmz0r#{m6#K79S;C|XI%$L>(cd75rS=;75%h%
zpV*h|pf571Q=<~vb?KK%RWnC{&F5T2_lRC(i{|1+QS*AdHldI9&^44ny_E<v;<jdd
zIoX~xO_HVA<Sm!Zu=p(Y-;S|#i^dIM<x-dprbjH1iP-LujXvwt_xfTTytO3CfTMAo
zTXgAA-h<Fq2r}W2s&}rR{`sN4!5Lye7gujmf=CKvJV^7&U{o9PDf(wR^%0YfaXrO+
zP57D9EBK_%1tU_puBMZ;&~eJUA%IQo`EKQZnYq9c_!@Zk7Ad_rgnAx$x4HYcCN3?Y
zy>mgzKU*ub{nP^2tbxcvP$PAHx8kQYe7?I9`0nVafVIAP(tHUXEI-wE&ntL-etx}U
zylbOJCXsmKIAdB0hMmLv&)><*NvKSZhWl=1SaHY%>RRG_d%7`^sY0F3NC0kr*VV<8
z_KG)ByA`(>&e5}Fjg-tfL?vF4sT}j@ZPmnvMWPjhVWdgsE~vP-PGrCRM)9%{IdJ4l
zjBZ`}4E(Z5m1mbbkROq>=(2dH=%odLg0KL*?~G3X9D}bJEn69E_I~U)G&brxR3;WM
zHKO)LW$tn0yQbo{t&qSK4de}O2pUJKunyysy`5uqoK`C<W2mjI{minr+vVbhHjZQ!
zZQzbT-~;JH{DZkE=GOGV%QP&Ku3fz`VQsZV0=YW|FhCFpekKeJWi<NKdOinIZVrfQ
zTFl@ee3vCRm$cqR7FcYv0p!~XcP7V#Ys&o9l;WY)bjGY)S-6Y^03JJl+a4iqc5`gA
z5-MenGO8m$R1Rhkz~Y&3R}Wq33BBTqor2Ok?7jIdivtc115xfGrSn8EqW>3|Pucd9
zU+&DeKfgZklvw10#V-oWm5sPA1Z-F^-*1i)2!R1}*Xt~FH<%5zD<kkJbgTAza-*pT
z5S^$G5{=c~Pa8Xrou^nbdIVawYrPRiHM=pZf@R}c^%>>1!B+mWf%xNG5A#jKAIpJN
zeQLpy%g4_vTMOvcNm!3}>4~p2T3@YcGWF?MYTL>_3-sMg`0`+%uW1dR^Ey-AeZC0!
zgiF<Cu~q=`2~D~;)@RqoC(T@KZi(|<Kt2M9KrTVw@CxLh-^d>Z6`7H17bR5qlaiin
z%LXtuu!RfRBMRh<9Rq)V|M5G1>F?-<Zu=`GTz8-fGE`eg-M&sC$ib$-_K?kioZkI&
z)-<f<Jn!bxkxBxY6irq31zLoDcWbxw?mP7~aQChq#x>tvD`;93#mz@QBW4el-N&E$
zMV3;vK3VsRQnfsHp6YnY^uN*C1F$Uz;rA}`qfhIfjZ#;&6=gSE!XbYs-WcolkCj4B
zY{jfsbFQslr?8k8v>BY&<R4ka&vPy1Ju21L@c6v7Lv9JEfTHDtpk94XmIjD-M-;Xu
z?|w-&5+cIq*N0mS*Wb5PAG1u7u@YH~fhI9!TM|I8AK$us|2x&WCEp)Mqxr-q$@8P{
zQ*NDA76t$<qmCV1+B~py@d`k-e!?Xr5i}RZ0`3vEi0YEd0+4%3lc4~s5@C?e+uuC4
z!^{>5n1#C8GiXbh1+BE8bLRqXaLJZ3vaAW0Q5vfyV7f~hY{bklF&n8$yE(Qt^x_O*
z^i{Y^8Q~eDYHQ`OxDSI_1=bjh*DS0pL4hW;mRe9xMAp>mV7#Q*Y|&)*t!$2P`ZoOq
z<%0LQF`w6)WUE?OTH;G5yw$~Jd0=2iQ72+{hn%v^1ax5IUvTw)yO}I8l0W`lM}fzA
z%%-8R`+S*6RE|}_4MMyJ7B_6Eln)+ofws!|K^Su(^SHLr;v$Eri`H*=>%iKZ5Ck}h
zjB#l|`P85ey-FNi-{7JRB^s`OzvK9-OfJ!*=ZtWddZ7Q$jUsa@z&wpRcU;Qs$KbuU
zYxy1;4ZzBr;$q&-QPFz6jSSt2FL&uJ_`n%lU(d7^UUzSv=Ng_V&)Cc`GhgZ+T2LAB
zE&>pPEDDTVYND)<<5BZ9vI#uF==`P}fQYT1Z(uZa{^Tnmph(-M%r7%Zu-jZ*TmWBx
zO;jtQJ^3<Q50*4K-(4CB>v}=kr@BcdYw0MukDi|%eyNI$)CX^|bAiZNCL?3`pd8Ib
zLDrT1G)|52ch^9cS&x}rR*R{4jnJhNNgM>}eT3RkP1fIptm4fbJUgMveFeB3%o{u_
zKo+im7P#h6>YE3*(_ObYmR)Ovag_Zw$bJy<i!ocB-ug-9fITzAkBgJI+@Hv|nz=X3
zsmwUQ=WVW(Cp6f(JG*pv-++&axH}DX`$)^~ELdB28A3HPbA0E%88a#p^TbF1{f_|C
zGk4SXgZiXTN5t=nZ+KzL8FL<b1m;b>qFzLvA<l0uS=P_j*q-FswY;9gy@_4wo3^&b
zHWm__&HJo;fmRSWQ*TqVzV}~+2LhIgw>C^o-4)CdnBSm~jeHeVk<PpaT1!QyA@p*9
zHNiCxnY9hL6A(Vrv5=S1L-aw{H4<p@`^K9ER`_^Ve@PJHSTW+RFwp0{uX@>(hGJgD
za!%kORIroJ2>`tp%n^E9t1T7};hMjU*jo4VZPvoHpA6^GXRrEhRCyk9pGdM?28t`9
z2+``U-x3%wl-L=9z9oiW`-OdD^l&v5xjDlFF#y!N5utEA=;N}#UQgGvRoJrsr7&J;
zUyE@m7$t2BY1y~zb|K2uM9o5?0pmO(zT_5N>=ljm0*4C8-JRJPDxpqEKeW#HaosJg
z+tElm0;?Kp;JetLLcr5rjKbGkvn*z0s%J7A=z}<l6|Js4btB82%ZDvB&Je<Qu-^tP
zT?}31pg*E8i2|yO;bnTP$5W5w5YnUYU_i-u=#s3tg<9zDSM(ieU5uk7Y^E8mOE3nK
z>PCu-9qSONOBNJ1idJ8{V&;wQL{`m9-1!)e-mYBvMX7k-7YJKxR~KuyItkg@$T`lg
z6B3<jJr(L0=P*Il987?@Ie5%2FkoWKe>vaJB-Nt8CmO3x{{Ajc7m7*3r7fj_>yzV(
zGrhM=+_%$vbB2;z;+1jyXx}mXu$|w0niW1k$q75x3q{%&6UGm;>CzyZ-AbF?y+kl$
zREg1AGC-wY*u9Q~m|X6~)VE8)9%zpk3gt(O^@>OsWCBVxtRV2oEvFjJ9#i{3QoBy4
zQhZMB(ACBkV}N(=4#=3dq~H=6z`=q+G0Xl+0+O6FyE!BbeD_<LPK@)$d{N7xXP(az
zX`4%_L2Mi)u}QS$0<3G6f7k`<H=DKK#Tqu)%ThL`t$_`9f3TQ=6!B`FhGX8w`L=~4
zl@<JbC;GAkR!Aq;E4u)5ec0^jvWEu%ti%#vgHK^pNKDL7RRc$vjA8I8KqVoPdIbkb
zC2r^o9|-AcquoAHF!u4#h)<~|T&w0<dUfeJzJo6_4o!#gTz1AzSbtUYN$^BjpL1IY
zg68k{+2x`bA3JKwuPK<ujE5p8tb0A=NRZj1WzS_CM{`bKcSpXm+k|!2n(UuNKZ2?0
z_C*Z7mKuIOOVD&YW^DTea2DpT;ZJ(CV_A+TU@!bi#XvHi@fZULf(L~z-|s((&(P@c
zfN4&Nur!O7hj7D%SZ#5+^nQ-bAjEIDQQR3?T$Y0fTqYgK)u`TO%uXFH=ER{8HlThE
zrtQYba=kQeOvKQFBxV0ykqK$|IPviQp^%Y!FmN^5c5(v_j~0Ib7xo~Q*1V9Yr&C8p
zt2w}jf^sbZ0iO-nR)1rlbBLQh!&cBzt;*H??h|aF&`bR?i{Q-;hfP~K@bv@(6RelZ
zbJGk&?;bsrp`nnZ^0Y&sYD`n>I2#D~kV~M|2j#ZIZKyz-dv<@0YpBG=C>Ip4FZG+r
zEJ_Xe>N3ie$)k20;fp9is)a3G@HdH~_9}v}IHC)=ZtXP+`)kg^Y=>6>jugp*`@|P<
z2@nKeR#df3P1Y5iw$@y}#oAL(3FETUmI|9yB7=1z<D*K$SrauN=4|rDzERG0w)K;I
z0Z$Wc9ZPfNGZ*^>H(%h*01VBc`A|^vDQxI5Hi;Wal|N+eZX<M!yFK{cEQ{}p#Hs4m
zZ}|`0`z-_q;^WDZB@U0^(p|IATP<}KVZ&}U^+4|eN4XPK^#lh^ja-h!Qz9NH$T)Y%
z9QV3~?WQ2fzC4C()l?D|m^voy&t2=58z0@zMG`LeTN$l_aS*kDdno*RBT?q}04(d+
z$uZY{F5j-BxCwkPCE^N<v>&L7jy!R}-_%g4ta@lJwRU*(siqA#mF>4Uxaa@y@K#xE
z+yTCNdQ&$(+^bHMd6Z(t*3A;tkS6ICrR-)31p9-s;N2Js6@KCgVeZD}+Gr$<@L+g%
zIO9BW`WdJ{mp7r`=k3gl=C_ZdHUAaZCn&EU4WIXg{UQkfqCj?^@E;EFgE{z*ZqLns
ziIX>LdB7_k`)xoD-P+Yv1&4r&vtP@C%HbP2QWP?hLI>ne?wy*QqhmYmp^NiuWx>nI
z>a+THIod}S=Vjm%3y1g96Gz&L5&iV%*ntY!4H$d%@Dg}8zH>JZj{;RHut<>4eX5p~
z)3`UwSBfzUXDR!imkuCy*NDy1sq$K|ryIzvE`4P%$+zVOPS5zaZ0hE~<0qbd-KDf&
z8XoMNZ7$=>38H>SzO%W(BWt8sT)Vq)05$&`y09B!9$@KAYThVUUK#xk6Q$LZw3Z}o
zdEhbR<AfU03T~KgX&9)jN~$gATeC{YBCA?#eA*QPL)=niw{g#qrjuiY^D8>rM+rY5
zgh_nq2C1bg9Qp+n>2PmC<z9GJTKL`Xzt`y{j&>IBJ;MK|hajPar+{J@c2a(^rG<DT
z@D*L@YzAiStb2kekk3D&ZFi^0cJ#$Pt(!ujE2v=_2eD%9{&V4<ex)1gPio>Rd(M~7
zx@T`Z-M!8f5pRjUvKqz{(gZ$zX%zOaD;>%Yj3GCn)}o!?U{Zd0#@ui4XP_Ni&U{7%
zcN|f?QYo^+@qhjHzklwkH3u9hpX|<C;9i`zkYMG7RUXP^+x|b!#Gn5Q%FzJS!_W8Q
zw^8k)?|Id0p=87VKVNHQ;VHnRJaMgg{5i=d={vDXk(O^!fzP(G!1iELCeABfJ3W|J
zGmPT?M}hNF*a7dw{>zDKAHEtk$_%<<-R3(>4c9rsC;UZlW9u4sWM;ySB0Y5I<D@fk
z*iC`mP}cGo3Z-bB-abv$L3p!Ro^`WK-kC#=##a+RjmU13gFGN+4sq2aQ*XhM8`vy;
z*wC{^YGK!NX9T&{q{n5T_oudo%=3TLTOY<<@*l_^#KV<+F0kBYTDOzKZq>B@z*Mmu
z>IW>YyQYKxo>wMA4^id7dqqDTMN0M+Pc8H!vS}|~rqpr#BdK<Bh+WN3<~GS{WC?0J
z5CFl1un8rgc^`1}v-my*{lf>ml~6M{%#W_1-VamidpjpN#1q%e{ZC5qHhWXEUysOC
znuA=QkXY9dq5my3R&_a6!Nji3r44h!1m{jdyqeFs+kM%IMa?q8Jsq!3PqO{fN1SZG
z&#L}IcD;h;6god&oS8C_c}Wvbna^%@kh!t_zDw6Fe!x<tl106e`=3{6P<aOn4?xB6
zpd7<Hw;^VBNfsYJ1Dm=9^hMK7>7#;Tx2%Gq*yMCeBa<>`7qsj@>*BGZ1_kyOC#e{3
zZ1#Ld>TtYrJ~nR+G9f)B5_EwN#|@&Yuz%Bhjs;e92k&Okh^?Qit)IzGE@Y9LPQ+Kv
zUk0QxJ1x+7oN#t;-~^|2=+mOm6<&Hn24WIXm+rFwF-0K0#|1St`x<LE%H$y`{#ll{
zi@0=V^@CEMOPFzgnvTShab9R_xqN}|_NU|jOSmMn`F~~;o)-itAiLP4>LU+b3$2UF
z27h4uwJ{0&*kxE$oWD}~MfgA40p#>->LU_qKbxiVoYZ|6lMytNkJ^@AU*AlJmgLxS
zBNu^P;(wZZcHx^1)Jb;!(xB@t;qA`zWzo?&-v$rIKlG|tpS9xccl;kBwtyWxX2kRL
z@fbpP-0;2iYLRzEy+g!LTHVaVI2*cd`cWPLg%vk#eN@V8vvV_h`;Tu1Gi)H@0;g)n
zOv&8asnQHKoWkwX+c2fe=yox0jI@tr*QO&Y8em~&9*D9n6`Eu)jOyddvO}iMn;xOs
zb>xNo)AB4m`Svi?XrP&XJq_<4F%#OEg#Cm7#0?JEh66m0BXke*?J#KkeL~obVm}vv
z2`@z4RlEdXmdzB7^#}A>txR2@%4k$^#h+5rmjK)n$H@aG^?=MklCQY@Zv^*WPlN6q
zzPTTM>m3=BH62!x6Fa558fIToxfgc<x%bw)N5RBjJlB7&*d;>_wQgmAA)g+&Pk>)6
zUS1wDQ^2`n0pS{x5Dw*4vG^yG$6G<xS3yuf=~&y1<1Eu#{vX3eLQ(&LFy9H&pE~=N
z+{eDzK^y?!0#oD>q*tWcqDhn0R>l{!3n1>o_PZMnXk`#L1AtefwVnXmwF-N+FL3Y#
zRi2AFG_)Y9&TyuL^mTHQhW3}NkX@Dlem&se|MIPlJG{>cj^!PEq~zc$8+SVd@njce
z1&lN9m$k3I4LtuN@VtV0D!yD|C8-j|O4JJsS6;swxXwmA4UGGnb=M2J69F~?{zLP<
zLx3kIVrnjluOd5yZU^)W?Z5KZZ2w!j2^!v=_zVR=MdCk`!=jo5x&<3;`k8`Q=i79`
zpJMo1!}c-_g_u_%d|D7<p9ssMFl+{2nZZKZTbsdAOB?Q8^$)CLsbg8-TJjaT5ClCU
zQP_F{H@BoQ{GKf777P#mAET=f6+@P^o<Th{4QyTLkX_dSw<<q~=@;{jB_O%0A!O(_
z&(5`fp^u>G*-N3ceZU0fh9Sab70cYAF7xGod;nfxb>#fFU-Yl1o>xy^Txqm}dxH7n
zNaS;=;3oot4_nL6Y;wphiixAMdburl0z<4POm{i&%iI7uPiD*qA>_7&AoXoo$`_Wg
z@|v@`BX)47R`X{{)iS2e2Eb2RhW(E}=>&Ds9^TXgH^`nrm!M-AO0nZ}))E&hVi|87
z>Owg*1`9N8W@bgo+DhtG>Q(xZ>QxujACCRY6JyEOa>s8sEDv1s_HRW~!!iL!Oq9iR
zGr*+}<p1+3J+-?^AIX9J<!@TCb;fDsyS8k@ZwIX19Uc?igLHfkq8Bl3im5qmBCmTO
zuQy7wKr7p`r-`h@Pd#jP*GD<Sxjx!f(F^;?DR{6cjHH~DgP@Bs;^&x(yH|3u>t)$-
zP4~adAeq3L>YW|<AHrxq2iSPo(Dn=J=nN`f5oEVeG<2^`Yk)o|O@T7QJg5p_)Inf<
ztSxV4fVKu@w)YVl9SK$7Jm{i4vR-k!z+=a5cxFs~8<w>7M`q-NE36~*&;}PUA05^G
z_3Qqr^v&;ITAK}2`O#93i~nh_I;qTF9R#HVRvxe_`i~aMlMlB+8gIB19IcMhgZVa(
zMz)zOgk~KeROhUmU*IaA`BkX52X0h?`2!;WM`N$x3Cd8ch<Cr+e|QtJ5OUyJL{57}
zkBR9*nDCuitK;V+3+uY9{v*5ai(l9plyrMz=$4Q$5r;X%8Y}Vk1l7n^d@m1jA~9<#
z`Cc2u10qk?+Yyl8&peudc%tAqTHe06cjPLi9Wm+*NLCMJiJmZ#m;%>-g~dQ`Y;pFO
zl#e6us~}mPT_1*C<r~p45z0Q6&CRCS8O40KA(4@0R(eRjA?{IDhDlD>V4J9b#`;5J
z?{iVn*l&qFoFcvJ13LIHI;wYa4JA&+*q<#u_&31xP=b9w+(|;%><sGN?|_PZbcz&7
z-%44Z&Uy%95D!;^$$V>F_Uq@)y~J#v>LJhCQ*Xy1WrJe0_Q0<Aby(I3uU{Z+98SEE
z-tox0jImI70RCF#RQ02sPm+D_%m<pN$1quj!AsUSY02AI{eeckLU^ld8EHd$T0c$A
zuali?*1<h)X6VIBC((C>f&&;G(+}QJ(QTz&8l)SfvelHb>89J~qO|nswrh*m>XjE3
z1iRC8W;C4nTY~<UV1!uN!L}SB*G>vijY^>*v0zVe9lZA1y*6$SNZ<sDF@c<gI&AP+
zUN`M9_C9Xe@-4fXC#hu%2FqRw`Ln8o^p!;}(67sbx4w+(qU%LR;q~#fL4fv@vMzPH
zI^GJX<woiLU2Z+wEkPOh#MU$c?}j4+N-kgbE%qoj9*|ZyQY6WYFq+i7JfMK}NqZl#
z`ChuC_omn->?@2n<~=9-g*5VPT20-fpR>#itA}!6P5u_D_xK4tFnvEjF4*AoES!$b
z4O$+zk3EoUQS4G0Ee$j}&g^^G5~t`kZiv!^eRUthkL(~B3!zSZmVSDvGb(%kc0C)E
zSXj~ddLL=>+Q38<lE8r2n-Arjf!#OuKoHj+18&hR!TU|zz{Xuz2foA4>l<QORF@6d
zzd7jIY1!hD36jsa;dhQS6e9qFrhsv;8<m}$i7Cg;)+HVq0;sC#Yt$(<x%2A$=y`>m
z2n$8olGj$xZbz+yGC12#q=9i_#}w(8zObR4V%mCIC>0aM5BmLid^(^0*!yS;B$I?`
zLMm)f-k%~W`0FAm&j<B-2JcwkXDuk>SwCZ)Yq^yt&erRZ)%3K;)gmhi;Tr*dg1r4r
z-gn5=bjid#<4uoX(S!O!lqZko+yvG}484I)1GTM0&c78s?Mk~LEx0^fWY2z-4SjCd
z9!X8RKse^ss&RVr8Qw;AI>*C5PEyu-D8wyUaP|gsejoD{VD1W8K!?-C)xPkbx2fW^
z>er#2ubT=ZT$2a;*9oE&^mlFEiPxIpTTRAQv!8YC;jj0CKY&s=+ZfSh%P+rXJETS<
zsoB%AcQdFz-Pn8vxEwLnQe(YwP+&4n8_PO3S>}}KH93qMF42x>44#QK-h+qMt4TlE
zz9{XRZ|?)X>Byu$tdTKyi2lCNizU$P&c@#^?Dfqj?;SG!Sef2zAwn(mo|DrgQ@aN9
z?ZY+~OVe*eXy^le_#*l;4)^V}gMYQpLLct(ZTE`O%7-ob!VYqfH^OvbA3$<QT$#N1
z?@-s^2{1?J%E9NSc_rAv#&O|LhrxQfT_CeQ*64E}^}h8XmTgYWh7ghaj=Nl0xW}7c
zBati)sS~7~g3y9I-T~ucJn_@7<=*7>_&E>8S+sabNhqbKo2(n-s0jq#$*4G}!dkCZ
zp;86}aU(IEJeFPPbgbXR6!GbUGvPwe9dV<K&*}Swo;*GG-tOfs<rNHucG?2_wT@k&
zM;c}<4?+&PHor@^{K`WiWvF#M&rTcZkv=wb$HFr0xUrz|1J=kN{DZh1mW*!?AHDec
zvN2k*r#afbUr&ieLrMJHp1Q?uw?VsAp;+~0x4~lvg}m}F_k4)Lz+xZO_c}>4XAQf+
z!MO#t)FS4*8@ehAvE6viH3M}fI>dc;k>2Vjg8k$P;mS}T+;Uy)%DryfoKa}I#w$CX
zwI(9)_|j@%lxnI&q*-=rw`pgou01X!DKONmbs1eWor3dk<JGhl6JL4MJ7PZ09{vH8
zMdkx#X208K_)0S;Z(m(=1@)&6!>vxL;Ik#Zg8b%`T3|OpN#IA}YQZ^8^7k&<_F9{w
z_v}Rh#Of<@6LsIepv~?@oQ&EN1XZnVX))hj<G+*Lt?iJ4M2`F+qqUn+5^aZV048a>
z9Mbfge(iei@8Yc05A~!6?TVLNL|&3+IVA-(`v3+fRc7ZcY(DHO$C5{<%dtT6EAmv5
z3X93PS9Hn%HZ2bpv-bVwi!r;k9Oy2oiowbxz~7y7y%5p$Ne?|+!H;_Ak4W}kZXLfk
zGxy_E)g_EL8@lsb4km5pMS}e8G5!-=PJ_3z{3#<@TjvulB#x)AzwIbn3{SPl9gdUr
zx-F_xe7%>DA}K#zro1FSe}zY-SEBdnd<eHQEmEf?5Sr*Ym=d=`Z5}*&-lrn!;o=mJ
zq7CET2=go7@NwB?jJz!2X7KqdEL!4~vqXQ?Y?Z0WcWBXA!Z)j!@Z0w9pB7H#wDlsq
zMvENx6$fjfx?*c+91$4b5Vu6y(;=&!{J>G|BY2-SBh3Yclr;lOucfm-Yl)z54a>q=
z&Tc}9zK~($STNusEscOMRS+<0Uh(@I*r8(AuJE~nLZ1bbL?lyn9y?a?CJB1#Z#n3#
zFt8ihhn_ET2)(4T@(8Hu>LkGb1YH1N-XPB^TpS+`Z9Lsqa|F;x+zhX`+Lvi80PdxI
zB$rM@W&OS@%DI^I)(YBDuKXZ*F5@!yCcL?udY7H#yy5NiqD<n1I@=BFuU?_G!3Y5^
zxYG@U@!E3tNRCUPpMHOm=iC|Lf*77-M(KSHBN==qLx#7y(~;0D%e+>Rx3pi#KtDE5
zGVs%mML-a=sM)%=g%Y4cHvU5}z4=Bx+so*9#}e7?Kc+N|Z)0!wXtOrnIv0?+5VKHN
z8!a|hP?Q5nj`jL^8G0N6%k(WO74KaS5`b(;ZIJio7|UK@xm%F9=UX@W@la3h75Q|H
zaR)Y?v+_S?Mm#d7P2*`U;upP`-d+`6XXn!S5i1lw-ubz7G;sec*g|z!t7&~im4Z2`
zg1$36wbZJz<_*}XR3GESbikc8+?p98nq>=}&2{l<oHaoYg1QF&jtBBDJ*`Zax|G)R
z?a0kP;Bo^|h}dd*&7G@=Dr=D%HW8`?+@5v&lsa=y-{Rwzo-w^y2o2@&%!3uLoixFY
z(9K3Y)^6PksYb=|NCe|2vH0DMpmka56zP|N5)g5uWvxrkosfH<84lGCgCrs1MedD<
zwEm&){z+e8-2Togh$KJhov1!-qx=B6MB`qk^Fwb0-=oD#-6q~Q`y{{#cQQfXKE8;3
z5;Hg@F4}{)x{+Z!quZ{{rgQwF&iIFG4{V*He{>Xvj&4?({?TJk)WTFBpkcCl<^9^a
zpPlV}#|Q0Psc1RyOj~{h)5H!Q`Jk~P*;?&9I&LW29jm2w`TiHzF5RJosqs%}QK(=J
zN!U%?RBtmQ-7Suv^P0L}r<g#ybU<e>)O$f1buBm{V1Xlsc`bBlYTY<-6pcVJ%PTpL
zaoQ!xHS>=;Mavfk-L7dpkrR1{9Q}Q$aNT|+kkIF=Oz(cKt(E~>x6)$=w<rfe*My3h
z<5C5m64hKUUcQa>zkGY@s?XGiRHI%SIS-#(Xa<4;PM&HuoqdmH;sPk6=LeIi(_1q$
z^NH9Uz^PfE2Dk~|@LeNlt~Q|8Cw_|2u$-;Ngg`sQtv%oWmILi#fgEVIPj`b~?9W0-
zQPtfp{w;k=bOwbi<Ob}Ri`>Xd+;P2Ex7i_8(6~*WI^#Oy&^-aKtcp4C-y`yfn>O{~
z&Ed^&P|bkXSLurMSg~siS$maZ_WQ1N5UvJFIiDk(D!1V1fO|B7_NGVb42$MD|FA00
zPCCfGRG3>~Zf)~!2W({suhJGrcg6BZJbIk`j^xzjTF~<IvG~Q?X9Xku5D#`XdX~7C
z4_N+mx2B4C@ZJG=?T{;644iiYVjNmG^6zZ$`y`p2maVX}*)BVI70LTewC!UuN%$u>
z4buzCNyOCZ)8R`S)`l0W?LG?(Kvvk9f7}V$#GYAc%o?a~aR@#*oJSU}mvv7H$n+gZ
zyJl+1So<tN>d(8XsAy40U!Kx#=97A&)%GJ$U*Zk;a?J~b=$xw1--+3LEnulE=A}*l
z;Q6zbn|@6sd~3r39R-Pu)uV?VS3)}^|B1E^y5AM_urB=v^sRkH-G@vi_KYU`y7VW>
zZ;o-w3?AbaI43Np&r{FN=8%xqzS!w-T(ni5MbT<pzdYNfJ;MAh8j^dqxA=r4&!SiA
zflZI-7Yp#h>{8#t_;=?_7Nr`MTBI7M?MyOM^!x4wx_s3Lboi-ky$2=x_AES!fC#EQ
z<#j(HL}B~WD*>}P`%cgKmofbMk$NT)W1ZeXa@KX}6i{LYMAoyq<d)Co=K}(E@|RVQ
z$F;4hIy}PnC4PhA_1XunyM6geRTL9|l{U^!iorbF{B{i2QX2Pfe2h8Lw386KAHLeh
zM|hArrsTGrzDy;J%{^t?=QIp$y%n(R)dmJS$^~jc07t>s!fw#^RAPlwkJHEoWGC|~
zxB9hoG?Ve!=kejc19XvHfL<RRClCD#p!0zKqn!L}qnP9m0&LgbeVe)z4Z+L3gKKNj
zM8hS|g6Bi{4*T{dm{VmE)999ia2X9+1TW%w&hz6-)VYW0X&YN?VMkffPI@an-5j5E
zmOnUM+OaW$zH(Y8ACx%U0FM)X9tqgC9}gLNc*ez*|6uosotm1~idoK_9fQ0L(n(AM
z0L$Y73vH#@AILWcUc|XPOM$bPwBoxB(qe&I(VEZTAXg0q_kyL(R^N#P&fZ2mn7ydB
zHOZ4`A_f-;q~4a^S`mFim^{5P*QK6PUR>PTA}|%DI<xZk4DG1{gx&D!v|E-aP%Ya{
z^8&Jqx%ybm#;7MxY#bz5LWA5!l`SKOu5YvG&v{%)$A|Oxb8c3v)TjiD@D_`FBF?I)
zMMPlzgi(O5n4p>aCGUqhDi0;CJoLGK=~e7*eirCBioY%+53Vg>t(E85VvATbOdpK?
z7;X@m%AfL{W9g=JRvXe%<w--Mnxa<|n^n7hM%@50F*GjRAaxKp*j2KGQBiHtvzq4o
zp5GSbY2hRX*1N!ue%2SBc)?7|hud<}ahChgnlQIx{`<zyiev1yEnd34$Tt=~5A0K5
z5(9b?L_@<MD8PfVMqmBwy6zI)4X1!O@Z2A7Q51LS{&*yW7?~)Mk8RwBzm=C9TGu#E
zq3o}O^sRm9mtdMvY0rU5rIE?3DQPO1KYVHTJYQ8t$^!S&&oMEoB5<q^3n3IkpCc`H
zBJ2UZ)@rNRwICd-p0P3RBfpX7EU#o}aKQkxUP)ZXyMO$lX7x<M*>Y6r=xuEZQ=q-i
zqE6bsUB7w3`P@pQ3^si=cs<w<Wn$Wu^c{Nb-TNc~jSC--oFi-Oyjy2|vc1H~vA@=g
z8hto?^t2VPqZ=uy{0AD3F#@)jR51C&+G5(W(oxCVQ#O%DGE#TqM$6jm;2AE!OqL!v
zgp(5x>b(&Jjj$fo*f3ej*Ljs)Mw<zm$ye6{V(IQmL{cmxL0<sz>;)J71wLH*?~qCq
zfK*fa6|jx_gC36?PJxe$_lhz(8{zSgPnx5$?Gt-AwvQ!V`4?@-@?ZJttdj6c2ly>T
z3Eqgq1v6=CNn5KxuIj%v;+ic7b`2mw%NS&_Q9L3@_FYeoQ`5H?Jdq<QL(&l>0Jw7!
zCoijuJ7k3HE~*!3<=dhh)K7@*=EAv?mcB&po`m)<Ms4H5ZG_77tpeTXv>yG1TME9_
zpT95a9pFCJ;au=#elJDf(PV9;Lb<#4%C`-7=hbl4<-GS-^?N4eKQR`$;Q}5>GJ<Av
zI2qt*jGn6+F%mhaG1jApz>`Kf3gKG^Emymcrle7rSOW8<+5Ga=g6<J92)-doLdJ*E
zAd2h^4U3r_lTk4RynOMGHG$5w|F%;GEgn6&B8h`zGz)%nWJEi7(+J#PHGP7)856#u
zePh?ixJ|I*9@@Y8ZWz2v>=%Kkl^m9N|9*`89ee`?cQvi>N(H2VMUIg+_Yr6;S+cx0
z{mp(I9}SBsvo@;TGXrt!z=Q*_uaFrr<=<kt@d7%N-jn=1>-ej;@I1QWU+KW#)Uwqp
z{ZjAu5eMp%6}lxmG0w@YPsR=16P@M$;L7EHvAZd(%r$`GH-(S6qKC3yj+QxQBw0=<
z`nP{1tHExntV@0xd~wvLU};5Pk4V_!rJgaCeR8SG5yoxd`HM+;`F!T<h`?>^$WQz|
z{EDp}(h~!-I+-gOF!fWyy$i(W=0Q1kBX&=^yB1r5lj%cRH^-z*<-=vgTECpZ3}uC-
z?9!x>GiLK{NoM=pE4*xHQhlb1QjK}>re*O2LV*Dk!U(5rj#%(nc~_|UE}kgy&O6`~
zu*2Z?rp=8h$ENrmi25rnZp?OA##kv?iHUje2J!qSKD_~Czi%mNKcx=u;?uQ*Z-6Va
z0e_bmns2e}E}k+6da$n%Iq(K>L{PPU%8rsb0q^h4bx!q&@!#Ix-7{sJ#-M{mBhip0
ztr)=jI{;{I&KsxV$c-vt+egfI&68Mpm)$(r#C0)G*`Q7y{EKJkm)h&Ne0ZSvHs_9#
zX_zTJIwWjgC$;7pz`7Yy@D&#a#S6*@QT2}+m?LRrdgkORb=q12Rty<^(#xTzT-}Fq
zzEx37ja<&@bN6~|Q&YK=o;0QnMEzV*KcDaQ;#MZ4n~o->yt_&RJc0K{;3UBgrCY&T
zJ2%sXI;_Ri=L<b*IRd5|OU*5i&t-77;pd)_<@221BO3{o5?jIVbW?S>`P0_)!B<A~
z(p?8juDEN`Kl6TE)Q6P7KTU`%HC{52!nD0L^qD4ee6;!e5*#>X%OG#~bkvh_$dUCJ
z6xU(Sdwmv=l646+mz?YjtJRDH(J)nBsq`}dK-C-XD*vj=O(#F$QqD698@u;u`D#SZ
zQ-##zWdiB4v_<i~dJr<9LUX%+((;&End^{J%SW(|1=g)+YX+SfNPo8^`TV8jzi-%+
z&v(o5svmlC*LGzGfU}3hqIb02tzOdsn->cISsoPzc!LfF83nwXR{<Qy3J%J<MiIp4
zUSq)X-Qc)m1JK{x+w`go1+~$@jgtU^di>eQV#)D5(NK!6KitGq!6l-o51|$x;5``g
zQA)3E+xH8v%OO501s3;1Kjyof`c}bFf5#0a7DYaP7Def=ZIh~<!F{dW^-PN!1en>^
zTa#_(QIiUk_S`V>`Omk;<oq%E;leqF;g(k(Ll@6%u@#(q@utf@m0o|4IFR$%)*-ec
z65hOC+x!PX`-L^O-`?EqS^ctCaQ)HdjIsEvITS$<qS}bPQ=l+%4FFq;I@3;rSIOhK
zXJQ`qtMYhvUP3BK&k-fk=c__0#!Kw@#BGUfa>q+P6B>nl0`Es>RH}9)%2rVC5aKWD
zY;0`M>Xcv1Qg82M=qI`unfyF{9+KI~1J%fCgY4Y98Y+_7A%Xt*<fzu)6I;SzAhAh&
zEY*Io|2e?&Q7{)Exw;I_n&LR+pB0VrLREWZsOJMh{>e>XAf<M=g=*(m8~1wU7Nz{l
zyfy(omBF?7WmySuR41g3yD92aiS5gYGFk5(uL+(1n0m;#)-A{))OUWJGJu+!+k5^>
zz20W>)rc-ih1WM4d-mAp8Pdn>zEpl>LfDJ=<kWY0$*I%55<S_0rUbO&kcF>w@9R;u
zwbeC6mAHY2OVy=i^hV{Mu`fT(eAv{yGR7}|E10e%G22+$ZwHUFm*b25<Ca`AyVZl}
z1M9Wo*PWGJGXu<&$2Kx>))%YU!Eba$s0zcoj{?A{KK2CQZ{64mzXEmeFBALH$^`aY
z+l)VI=_(o`c*o-CzWTTc#N4ojC{#FgB6R)0@sGaQJC{&96WR!&L-)^vzUDawnra#E
z3r-q7=<Cv1PIqt$YzW+kx)@71?LJ$f>Tm%6n)pZjgR3sOAc#LI$?9Q2h=0o*P~BRp
zOpkxxgL~c^z!5ED`9(qmX%4W~9Z8y$?uK{unEd=4-!X(A<@wF4*A{wn`Z!3ko$>B6
z7Y0Ur=W}yF8F>!~T@T+Hy&m#7@pp`T7{Eqy?C+gCul&Zy`gQ5+GhXF4Ji!F1>6luN
z&|1(+D14Q}Id)exg!;bHypQTnHFg}ubp-#I4=R!>afm*zG0|9J-y;U9%bMgz|H$`K
zZ`nC|dJm8i3Do8*{=R^+gG=ribHaWN@XET?jElV#weQ1nhvmo>7F8y!+sOTWLAKTR
z=ij|iGCni1rt%A3PJ@Mkk$nB#rMkyQBH86)r<O7@ox6*Mr6!9@Z-`Be823t_LK!FX
zhm;!{T4t4H+s~VuroJ2ypArhF1c+{0HM_2=(Jfy<1WIQ%@YeXY9rV%hYOHMN)f+6V
z<t#fdt=zZu40omFRw?dJ_FHh+4hpz+EQ>52VU$eVyCa0vhilT(aF2fYK|88AKz7gv
ze-}Utj{q|_xF5dH9rtJs7cjOB&V=S@b|c!rjXPXPRrDfz<B7`j8}eX#TkzSHuxs;B
zFf^uiONC0GzMcnJlpWCUPoaZ+-&kU`a5CP6&x~bMiFz`0mWLKarEK-iv;C4yV=0-v
zG_gKM_%Hyx58gOab{Tquoe0X=^^IC7HJN6wrrnfNZUQ*3q5H*$&$_TSM@#qRr!^M^
zYzSnT71T)u^(BkIHVpup2e-3R*0>Iw;=u84UhNF{_q<xj!|EzPEfoDUnB|iZrttOi
z=g3=S(Mq(`MBir`L{#3NGLjo!>}uVk)sIYmf>wpmi9_&J;E;81nlkDbWQhIUnOMh9
z!=i8BY$@!>x?@0ez}z=e8fJ-X-wSw}F7bUk^g>?YR|m~@<~j?ZE{D9ZIn(DWR8Jr>
z6E%pDZ!R<kyN)`-^G#}bSzUE2w-mqdP<QnwCAS0E(7)+V?~gnTt4zPSaj<2FP#WOc
zQTAM{U8f1=+^}+60Q?#GFm~B4Yv$wCWT#QfGWrJ}nef-P4rY`N#*p+!0M4fJqgQR1
zXWyp0+<Zbvc+MvD<KFEnH;{|0xJsE7&i{h4f4cD=I{wOFGjq=f{hV3>Lj^}sf69V#
zs*?y1AY<CB{I}zV2VY#u285aDif@l7gt&cZrrKI(m*SJ0Gdk(%9zGWn@B9dYTGgdT
zw~?OsR&OwMbxRYhg9%sn&}*1?b~<s?#TvtqpD?#yU*;QyxC6MI4Rix+G(ouf<*>%(
zJj(q7zh5S`wq2QW=w+o;6c5#oL-fCCwgwICp1_se;28;M7G34FU;Apj4!II4+->+y
zR(YOyo#eFS0BU(nRM=X5VEj}4d*3zIS|RGO25MBu7D!nW#yb=9bu4BplqrA8VCAL#
zvucsoT_UrTpNoEVX0iorn<&Pb$l*5cV92phNPAmtM_c$>_?rH{^wXPuz)|ogON3wF
z4^!z9Wtx>y+=H_KjAf5=|C<+U@0F7=LC`;mnrOSo0H?*YnT4+gH`4W*$9h4e#MB~z
zujI(KJ81pAtodB=X20f7f;&)Y8kx|jN>2%N&p#^CAAfZZvJ#Y^g6co+`+*C0fB5%s
zfH$_0Lv}ke*$&$Q<Husj+-~vq)W5{itoDwd3H86(HZDyZZLl0SyyiaQm6>FDglr?c
zDypYSd^$NUFmIHZJ>Pq?-O$zN123}Vn)8mC1h($|9WJ%)$6VQqN#*)G9WSKKnH{0D
zC$%?vuAe?9IhV1FpmZg((K0_tT@S<v`()7iOC1uO=F1(=N|G>Dp~5LF$1yR)p~A9T
z7QP?j{iKZTt<zn<B#D9MLFjK@q%4O*oG;^`^u0o(p7;e_O|kh=_v9DAt$>Ql17p6l
zky)GmL=|*&FMS!jCSiWNNWZ8<X13VTeS?HW?<-llRelD9f>&U~+rM3^OV>z%49;!m
zzw`AcJO&JVD;(?pXu3>(>0JplJU}-(Ib~giIT+5^XD6gBOL_fcobml7+0Nea71N67
znly}LpH(<epzp2;Y-N@u7w2MubLTx&FO=c+`p>l)f$rH3VCD-xsSlG;V6BMWfd?p)
zSQ70^Hs%7*vS+?yKH9)KF^NDn!CR4z34QjG1sfp~H$Fy7BuIP^@y`%X2zdC~o>4qo
zq($oF4BHN4zj1zU*f4EF@If<&I43;AO2M=Xgb;1CbQNYOZVnsz7}-CX_gejYM(CG^
zWEhU3eC(F6{&Ic>8?jg~kE~*Y0l_oJ?VDTGnp@y9$iEo^oXs$C_0PG?J!r!HO{|mK
zb%=W<6hi!Doaz!D1}tFjKAH|d7^y}FtpVbkA7t!rzzHZ0lOG?Llv&X>2h;UOu$B9y
zHhKqmWIB@-jw)=;F&R~u09xw9rqkHuYhsC_uS=?~cgU-QQknx*#ZOTmb$uErV|4g2
zdc+vu)t}k|qkYZWQR{K7U%riw?K9M?HL&#GI{RU-)3>f|b+?}K`O3@g657JSZ6&&n
zBJcN4GPKg?+rpkv&d+@tm)CMXatNMbCa2XU5}@9_XJ+8phW1sTmN%*I+1*2AT!|w<
zVmwJS+&2vyp5m2LL0&^tgqyCTuo^;}Q;ce1Sf$7xL3eLxICJ}kp~ofk#rH3=B;NeO
z1N1|F3N8d8uFZ7#dxOb{j~>}0Z@d84^=~FkT{-5}TBgZfM`@Thx4!Ej>>qq^lk!3L
z_JM(Os+sX5ZU+$o1((7bfeQv3k~;W%2~(!H;d@B;ZQAA3`neyrj1ejA9v$nRA9U-8
zkhOJwL`og^!UNe4Ky5kQ%~7c2`x#qj<sBVAbvEB8(u7GA)>NT$8HcMui3H2JMEmSm
zx9nFfd%Q)y7RWLy_NnR&E%kq*pb>YGR^!qaXYRE-MwQNB5fp{yK{0mVbmcv}`Tpka
z4uh;2$JXwJ&3(t~=i{1Doa~_MCWH*h0;`B3a|Ei#e&%Dii8$V9>C5prN+p}QO^&kT
zUO<SB>^5-xs~13kYp)SLS1rK5_K2F_@L8_e<wD3OJ%`dt>@*nD2O0b{F{9Vrz%u<L
z2?^M1tm-6kI$}SPJeUnmknR~q2fs*v%&*ku38XfD-)K(t2lsvt$MQxL`9)yEUxzP#
zESJpgrZ(3JR~6Ro=ybKDkkt>yg5M66Sg@j5Rr>!<3!dB)#Cqy&bESktb2}Y6ngWs4
zy_cW$xf~mz;qWy=^{0(-l>b2Vv;D!BucZMy|Id%iAj4-t#vF6`g2=D0XZekhcpbmC
zqRY25eKx=AD4g9E{IV}{FUD|t^tUS3|A#TdXJXPLWARu?8ZX2@o_PW$;?*YjL-RrN
z<lZ4Eu5N0hBL<Zdap{6-DbV{$?gVw6!jb;*57Q1<G$`wQwosOh{#h@SnRup=LWv~6
zTt@RL@TX5}v8DdjJU^ZoHnK2GcYDO1v=?3Ox(Q4k5PU+d982DTwr(@Ai_vrrB<7dd
zf1J1@hAra60S<qZ-DZ%b4PWCT>&VR{mMYIYi(jq2j*j(_QQN)TzmB%IOJ{aXxT?2v
z0NWV+U`w|2oNLXIWZx{jQGLPf);oUW(Fwu7k!AoDbWA2_cpun5A%nNI0}rhbZf-sH
z#nfXwk5+}L$F#XsyuY-Wc9daLeMXo!e2<)j`)|R~ZvdABxO2n=Y~(~6?X2RITiExw
zZq9S=<M6LPx?_<()1sK8l`|(_ZTC!ozlD7YQaa71SGv*IU+{-~Y^45cd;Np^z+zk)
z8G)vT%O964L5JXjc_tJ~KWwxXNtvopaBOtq0C!fA_*Z8Kg|FwSE>$x!s*ek^HR!XK
zZb<H=9;>E29*+dt#l);#7D-*7#^hfF)iQ)xS7Ktfi-dA_#$~6Z`EVgn+trk@g9T$N
zxVoLdy@1J#s7!lNu_ZrbW|=#5zX)|7v3#H8mxT7ndstVywDB%6f{MHED2m(dfdWW)
zS!X3y8snXagnwsdcbkM6^s^71UTGBT&Akpnt`uAC3<;WBxynh4!JnDMI%Qh*w)o)%
zG@X+hzj;T?7QDx+oS2p0K3xE}NNaq2Y=7MQXI0vpgY8O7&d*rx<iW~%fTj0-6q|BO
zK7DvWx{42&4BD$NW2-m4F`6|*r^vJ>&>y_6o;@0oE%V1^<Bcz@Xw#l-x&}NBg4CE`
z_Mucvt{xKj3PzM=T1crI&u*=GD+Akw1Kg>0Ti+bGLk@bI@2BepkQOo)!n<1uMfzvs
zY1S}=%r-B<wJk6V@nEdqk1iZjumrfv=4vn7;Xq$^+jtdZ5P`^i{M>QZ8N4K9snnEd
za((T)mV5Obzi6fZ=2ks>hSimqIvIRypiH}Yhx{cej#0dQO6?rTDLPPa%Hb?<$+g82
zTdMut93-r-r{v^aN_}x$ykwR|w&Z4-n%7Tuu0yh3d}Ss<&UZM3RR=y#$4^a8Ur#?k
z3zv&csc@CQy0`iM5_zl{i8cUiGM+q(J~>>QtB$#=rY9A7sh@>=0;aL@MJMA*&pk;~
zuxU7(=(%lRToRjCowkJq0t~nf<p31GUfYC*FU)b-^$8a4?V85&Da1<X4=S6Ge9aNu
zcUfUpDi8C!N{dP&iO8ZBqMu?oYgDmdBtF<z)k2MOdv04cV}HTZ+rDQXJz+VzGJVe>
z-~YCKUfMr-b=**>hZpbLCLCaUU4yOrRg8Y8GUeQDl@-ZAy?OV%w5jc?>+@M&64swt
z67N{gM6+j0UL1%P7i%d#b_jmZ;hvK{u(vfEbF!g_Lor>eeb&7NYojJUoi=$#6Q6Xj
zBf1(RKFpwjH2|Fa3SQGx-%5L6f}GoLO+pDSgZu|=z&y+qKW0f(-)5-wTj1R1M-P?V
zW7bm?l`A{POm_Y{*~b^;hT}&c?eqO3$7gm4IJBnWso<~KB54gYq0m4dO!NQG$bWk%
zX!{^sPFjgY>;I$ey~CQ!wzhGqsFa8e5FsicDoT(dN=a}KQ7KUn5h+pW(t8ge0xC^F
zh$s*crS~G8P^9;cbPP&|&;x|z+hOLM_sooQzTfv=*YA=)6dxte-fOSD*1hg^uWl8`
zvmcDV8Qli^y585I?w?wE=Gm?FH)kDF`>Xs@bJM?Oh=FG78~TFEUH3-Rbvb2u0ja1L
za#p$H$?dEI`y^R8J>uJV`UD@{&TfG#jkl3^UVzrU2Y~O9_wy!Fl2$uhx$;3+i*gXi
zB8OYjw+l@(9=I3XT1C0Zo6&2<sa=9{rp5(1)p#QT0PwSAszEh1%0jzE(1v2t!AQzM
z;ERd$<U@T{_FOnQjt<{!;cP3h>Oa)D>O6oRm!&7VwJ645*ij7rtuZ<A47^(wbg#a@
zS7CdM3p?nX89ww^{VKVA`zLkB!?orYqf85HBaQN^ew#2H6E2%Ltl_A9L@wh%;`<Yj
z#Mg$;pUtn_rFk%GmbzYVX8g=1UwBB*s?fn3`7BvfX>EjC_hZ&q29(O36Yjmym4XyL
z%}d1a#n^Iw$8!T40~2N2hk?0@!6o$J^)WB-?r5zRSU{`!Gy5<ekSeS+LbIEzn|iK$
zcB1^`nCjT;Lfua&X4hBeDuUlre|4VeumD$p%$b%C`g{7LF;UGoUBEkC)cbo7TuDu~
zda`euA(j&1ZW6hl2KyiqKO*aug$0+6FxMSmgt5XGL}Of>yN)W~c1=)SO&m$x>SR$A
z05y<CW9a)y8A|-)4z<S9NoFftOgl(xoMMZuz51f7glpM-W7X)mD#MNZ$2>X4IkjzH
zLIaUim4c>~)5~W+-1ntC+uT{X<}_Q;FIh6?qqHCpeM0K-^A=0->qebFmcqWk>=m?^
z{OGZOUc3<=v;`Hs`W2l#Mz-zbqk}k)L#O2v*Z)vj6X-7a&7-XF8UrV4#m+q*wUUSG
zP_aKU0<xw~aBz<X6LLebj?~uG<-|<0n_Ep6MB!Q!e?dn;-OX3&l#@5|!y1XFd%Z-f
z#<DV7-C^*Rf9l2P98<-DpCc0LtD4%eAadx%m~>dSp+T-CrqQ06ZCLKG@ghL{+|ix;
z+PkmxJaMWuH+e5mQmp~UwqxyEPJqN@VDnmxJc&awpHvR{v>VdlWiqa|UX3u_4qpzu
z#n=8Jd4k^kx^`kYau=Ytg97*q!QB!V=v=9l5IwdfK^SeHN-k>f^In&19tmQ;=%krP
z(oiYgG-Or)hz%GB-j|1+kIzXu8QM^~O+VsVAAYtza`XJxN<m-<Vn6L1w>?8Gv+{;c
zg5%+7WjjU=<;(W<Byeo^2`?On6VBh<tzOL8d7AHLk8s&{w7J%DPf<i<^bqQ7nr@jU
zz8};PN64hX+57A}g}~>OeKD5HXZ>^^XaNq*iQTIR3q<DJ*7#eG4mBm!81Ei*aeDSs
zNbkX!kO!~!opi}(TO87G2vv*dL4S0~y7<b_)wb>Y9u;6Mq$(&KEw66W8nmD!AZ6Rb
z$<ylzk#H|o4H$FNW`?gUUVgmha#mW+kTlF=<}l{qWadJ8xqZ?lJ=i`EY0+8jVr7yM
zzLo5roLOf3c6dPW$iUiOk#p&NRf1|S!N*N#r5(B6B5(Jxxx+;;+IfcG!!GOa*tZOb
z`|EVcc9|MVOSwbSHGO642QhFxf@FF2Dc+VJ!vj#_eeLyB%ZlcG3K1rRY`p!X_fCo%
z=4BuH%PnN9%TRqOu5L_3)uXz~q#~)&KdVs`ZfIMf=%^;#c;(3I?H=s+5V4?^)lS?7
zW?VXmxw?H&-Z{YY3vwq8HDru?MEUGFgQ}CLa{%%#m$vUlZ_D90jB(nOB+3lMaYqj{
z#^zGqK@`1wH@jtF?z%!7nwd?2ZM)FhJD8o(rfhDnk%c}s+tqLpzcKsy5wS|tV%Xg1
znNz6igT<^Y9+`(ff^>Usc^v&~hmG8h;G48c!4%b{cCrt-?6I!v-JOswi7CjsA#z1H
zP4DWE!4ucQMyWd?G8#uzWqV%StVM*bFU@}8%G2ix{w`2uRRepU92(KtqS_06w#^gL
z$e;RbP0VD?SIX@nw&R-7t8(d<!)~1c;YRmGl}1#sD_)wOTRDKUjXxagvV~ge^04d1
z|Ae>?<{M;MdQJ!3{Sdaq2Dd2Fk`l4uDxWki9O>M<<5G^TN-y#Y^)q>Du|S-Oo~A*d
z%eXk-|H`{5<C7v)5ulwuRtZr*nk_ls8tB*=SNL?3=_-G_wdTBI)vB0kex6M=@B$%(
z)w4Z&`gTbZx%c!U76Or>&&r7i$>}bNYZctj($z6k75bL{bz`*j&NlPfsv<{y+q!4*
zcPBe>@(XXWy!)RqJ?hP0#9+%ooTSatwGx$<mDXf_K+HpINhOpO`h}d#m{5GM?|G!V
zakAq&lPhULa6L!&X`AN5!Oc@K_Dzja>A5{lJ(~_@5wV_Ym&+@vwZ~fz1m-d~?t%W&
z4sZ7rYsI<ui{Ce^C^pg)|L`{JtHH|?$vH_uefQ`|%|E}1MgQ2clxSYP=5(%ipjmJ_
z+1mV`e1wr|aewnkjVE+iVI+&Y?KACC>tG}J)|ZT{UwC9(qgB6oCM34L!}F$bURK2f
z1sXT1Srq8G&1}7Bx%-7~DhelN^mgBe7Hwa`0VeoDDKhI}UfyL2o^-Do_+BI4m6w%(
z9mll&#?<2mRpXLTw=qBSE_BI)jkXR$I*FRbkmfmn=e;2*CT(fIAM_WoV_ouFjp~w8
zC5_FRiVnQDiV!GK0c>ThJQ(5*V)Lh@yyjP@dP@6T$#+yuUfQzl-x|T>Yz{X#jH?IQ
z%EzQinyZbl!RC`c>1$Hqc*D{yJMr2!)$PxY>IGMTd@KJ4g{9~@w|8@;pPf7m%nJI@
zmbn6(^NFx4eecYK-j_KU%$?Qntf*yvJNxis*UI9oUSy5e=^FEel4lWb-@93g#ozb1
z&~s_z^NeGUX*a?w|8u5cS(u|7_emBecrk!sO)45xNAuRtE>F<-KfFm#65mkN+>>2W
zgDv?2#U*M(+W%CQ7H%`qfq&Flloz%<v--JYYP+*UK;e*jZe`LerBq>zv`Gn4k*Ld+
zw#e$!*JSI4={p2<s4tCVRF&4M{`fO<om#k;0}(cZ+x~nnz#9d%#J3@<Hy2F9*eaBz
z^xH|x2Y%g-ZQ{)aG%_U$A`^CN?*cq5TL#aCg}Yt%3C4+w{BWwS)il{jAJUJ)0zUke
zxvC}J&*!18m>9xbk_0}mYFVn~uyY|)Mp-ODQ5Cm9vG0D@<b3V#sL}KR&>^yR_U>Jp
z-!od4w#}k&=boe(X^(Ihf)~@qV<T*W=Olou<{;J^&s}oz<_EdlCz^}uit3!hp?KEa
zH_+Y6q6YBmU9ZjMH_MG}mEZP@8f(aEU0$=Op|&PU{D^7?h7+P|{T4lwY320Mh-8?m
zdbLOgMxLe7-A?ZBdQq9wKGv}ry!GmMX|3RFih`JUQGmw<EA8FEh3%ikPOj25R^3cE
zXhO&ND&~Q|_MmxxJR>)*e$T<F3Ss{H`ZjN!5+qik)mqi5;^iS6GJYQWrffhzWzFd~
zcc5xK^*}eFZhjviNo0rgl)MJ}zcmj9%0_NgJDU;|JwknX+|UBDP#UcN*7FbP`@gJT
z0c#%(*V**rbyweB-1JKwUg%zU@3D1y+r_@P1VCE70fi=$$b{zM&j+6!WK?XuTy<~f
z$kwC_3*~REUXdj=`wqUQngU2p{8w*U$XeCzdT^y>hdg|9z|mXxtElD#2hsPmmu$8U
zE1vF8&C_y@4yWEMpNBp%h65_TOI;m3Hd59h<tA$Dx!VN64BIz?SiWRuoEC7g_cK#S
zU%(=H{|KdT<iudj@xS$)c|R2d`0Ud{uWDEF?|C_ND(Ibz(F$j2%i`o^_lbbEk9mLV
z+J3Vs)dARngh$~U92Y=qX1t6L$VGmh_;Aquy#XDT*DgzHqTfy&ALxBR;?_{>VORef
zn2zvjt%NY0%G3W@3ZfFG&Yc1LpJVro3w;z>_YSJ<Rp?uLwTK<FskWPEwShv&JfDLR
z4~ehXvr^z1<{~M^$L3Na(RcTWXP|bV_5-UL?X}a=+f=%5!3HymD4JO?Q`BctCn$~N
zK%YlC498*`SIQcQYso;xP6*U7fc$CDC5&-Y_Fs3!`#V1{BAX4jc(}u!5g8yH$%18{
zhxrcue7Z@MD*3(Bxe`8D4bPUI&%89>HVfVG2cM*jgUZ_I^q-%m*U78t9fVOuC4SeA
z_*NLg1`?rM_SY6g7CRt}HowaN*D5slbAb=6MC)nr)9p-bEVZd@P2jNxt<mRXOdHT)
zEnI8JrrSpIjBbrPhFk;`ssB)=s@Bby%Lftvsp1f4xVJ6tUhg@$u(5Z5NTVpcU_Jlh
z=3g$qH#pEF(lk~PZ}^JJ9RfL+`#Zs>hu__PJfCeCUTN*az5NRP@vqJLa;3erpkpoE
zttwqrQnvI~5@h!9hjncb1H8YYC{`gU^58f{EyJxsTDj1Dn&&`2J0isDuSw|LKx%tR
zogQr1n2iY@y8NoK(^2}`okX7JCmQqR6HouG9wx_h@DbB*Tv!9%v+ILCDSR}*m;CtQ
z61qIosU)$j2`kEr@S)%#uCqz<M~sE}lpJQN5`Zp-?Z;SGE5Ch9k<KUn%r2mU<X5Tg
z4v3p4BYD`|?|?-2$EvK}A=Z9LID`pG6u*KD0Mwj}oRIrf(V()^d!lr2ibm2Ua&VJd
zL3kC@uBi@C=?|y8q%Soc26LRSblm-*Ls$9wmDpv|)elaysJfBGRt;YFn9;4~Zx=Q<
zzEgJR8Cj*sUDM>5_p1~47f^>`KmU&BNrDpZ>rx8y!VE}^0kLqso-P<<m~=Yh)uLxo
zD8!(@-BEi7(?E^7Kr0YSxPg0DUu_A2kn?`2O^vN@*Ge`cUiP_qB>4xyzHVfj*w6P|
zFq;W1!JoQ@6;uFU>Ej~#xf>Dqu$4gMmSo7=#@k|NpUj}<Um@!L+M@l3H(-pT2aUKt
zdAZw(M}_;j3TJ#!A@?|>Ew;9}O9=0<H|P^S3Got3>pb~R3%-^8@Mq2+6~3hMBwuHD
zGZRDiUiX66ZTMxbRs(UzCg|s1${)N&G6CKXrRk!_`$6KuY|s-t5E6>Tq)-pH!PyIi
zo}_ndvW9BrO|}G=!kI!2HqEU%N&6ZnSZ_d1n9|yyzh?4t!^NjJh;)Blg2Ud(hu2TD
zgH!h{5E=D;DQ8u2;?la4h*1~GMXH${O{hT=pj7?FKeUUkl|0Xk69Nj2+CaQf4tfv?
zC1?Xg?vf0y01qP%6;a+-CN-!s3qcEoG%fbGFmF)x0oq$s)j>~o=|%LKn#YnROx(4Z
z3wEjN!0yxHxD&FN-~O^KhtBa*{UQ=o=r0KTV(9Yu^+^+WThcPK@iuem#R}9_{3cNr
z9Ws{ir-OPljm<t;64=Am#LyXhw-r|R(`BD9CfKDN9HqCNvU~gzTl-Ts+>K2NXgXPl
zA(aqj=KqG3*sz}>q!ewJc3`iZBpQgpFTZNye+F;ody1tFnt|^8Vtda0MwLe}sE(7e
zH}Mt|chF^SwgY1DTiu}_($X}_x0F&o1zafERCBpTi)>A5IQAFM@Y)}6t!lgb7bb24
zYd8;@m8>fSuN-Jx4{EQeVuA;?c2kv0%;x!ebKn2Rp{!3fdyTk)2ShsUZ6?Q*PgQq`
z0_bm%=vTXjJ>(WOC)C1P)(;cGsr1#PM?xa*Whrxy9>s!|oG%XMr>Q~NpANz|s{eH?
zQZsX;5|7O5l5|>`YNtMzO$97Di7<WlRL(^ri#PdhZZqvvB0Btwc&}t)msbhgpzrzB
zjyxV+<HiIuwQSt3BRbowJCXB|p0I1zqeyP-BbMzY7IfG%(isCk@K;cv-z3Y4#PKI)
z3>BMxLuHV6;lFBaT?g!#x1#uP*#7g-sR%Xl_gKezvWX(D;MA%t5QpHTn^q!)luz&9
z@B+F}f4-e9Qh+)JNH7g<at0Igf|RKoPQX75Ie>gb`_~uF-~%r_N3?OUJirf-KvC9P
zvac|6TW6#phK0ijVzUN76Tq!U;@Hh~eO$PwcOS?6Z>t}~!pHvwE(DJeoqBMER>1H`
zW*mO~hgp_}Zf6pfF9Lal^Myw~472|AZFA*;*O|Be+&52UNv0A+%M47(f*T1kvzmE7
zXT}+`ezwd#g$)FZ>DkJ(hqNhD2K=Dk{n3c8yi`T3*z4?`M9O^mfqY)Wh^2C5;*qc;
zVbO1*CcpB(IDPJMje}g))%?pQM+6U@IH8SjdzG1HTe_2*S<{t<ttk;M<^G^|$s;RZ
zKwSJ*kEOZ5QzdyPpVx#}j@;F6PTf95@2@<`e{FTkk#)x-Z8k${$$B(Cc9V3c(JnQ%
zFg11?u|pX{YAg&Q^|!pnrqF%O4-dAVXci+_oUb6?cN*o(O@Ark=5Dn9;B28FU*oI>
zvQAJw>@b5I&7Z$24Z&S#TfBJ|H5BfR6hfjVac@QVU$^^zN42RzPtm}uz!*?hz5NyA
zbBvvjQAfJR&V+Paf_R_dJyLV5lmTaQGssJKfP++Rg)h`bSe{=wgbNv~haKChEczT%
zcL_ZnK33egUp#=6FPa87b1UAxkS>T1XAL@k{VyMchCv5VRs}I`Rx1UvT*UnEYa)1c
z-*&q@75oLe>E?u0{<f?rg^yeeEKWjIQ1@(zp?sY^M|cD@e7&TVtq5(;u6u(+1rjDe
zt<EOEANLP9NDmgwNN&iUUnteLw!TpcztknpHE}#0gU)$FE}g$sJc~xwB{gnZM+oiv
z%V2D8#~Z*f9OrvC$`iXPlN4NYYEO9^A)w#gdu5UIFv9b!X^rBk)oBJPZ`HUXKkT1x
zrz@)fG53jB^!Vn)r80+*LgK`QT|#9g;o&@UwgH2V?Fg@}K%t~bOdxV$=TL+Y{a=3K
z-X9wT={|cSpVTGolck(D(3>DG!^EoSWj>;w>O%(PWf$Tb+qXKm2!`A;e)a2<mp5L>
zK0(g5c4#85evIbzQWwdvxE7tP2s+S>9W;_kxI68Uo%;*Ny|o`OX!SX|DQhmdio&^a
z-=3oR)hz6elMG?MTL6M|VOQ;{39=l^bS$KPS(f3oGe7SBJ}99IKCak@>A=s?7xnsS
zdtE52L1$yvq73T#d5H9IUb<;Tvo-o*Z6E0p>QIo@ZVy)Xu0Z6hQQd{0$LVWM$CV|j
z#(=H{f9T)saL*dv`^bqBOlxghiC-}xZRo9s%XT;^*>=49cIbI`Z<xzeHv@L4#?Cpo
zjS<$F=8B7S(v9;lc#-nc<MPJ$$nx<`F07sB$5aKsB1hgrdzNQ)NhStgIP88HdgY38
z(LS<tE1v^8&(TcpqZ$8v3jSq_EZ$+2f&l4h=j8Q7-(Q-#?pS6JwI1DsR`eh#8P(L@
zA<$wU#nS5|8kNl!K6~ytqoZT~QKMQ15aUcFFK8lDW0!`9b-{?=zev+-r?ebdSU{fg
z><sDs$peaYf^L(y4*Y5ZK<s@zPMmOC48F|h{DZ6e1Buk)MpU9qE74RKOet+Vi?u^K
zx?Pv-P$5a7^>gP=^|u#25e?!d><~Rja5S!UHx|(wv)Pc&d74W`uK7{>pk>I&tS<H7
zNB-9Z{|pKw73nN(sHG{y$@Yq2Mihj0p4Lsysti`_^ZA~;NskTph-L8D!%`X)VI4Gx
z5Ne1MbvqMAbC=5e`Uxew&LieLjXPVUN<q~8g&;!env=uplLGkgs6zt#y=Z>%CC=n+
zFy8(8$NObdQ4jW!$tje<g|0x20Sr{<VXxhwl&ohh`E1H=yxlZgNx<TF#pkDBYlmc`
zSzKSn=ud@LwJn>44`!K;cfa&2bYZugu?sJB1(E^pSLMR<e);pfyiVUeO#B1_5)vu7
zw>|5sCmbu(1zTe-i5QzA6ON#(k;GU3gSvpr>@JLFnv;{0H*Gc`^{ir3=yD_PHMQrz
zdKWJ_yF=&p41F6RTBF?6BBFxkomQ#wDzB1UORRFGZ|~qDN#Re3R=%P2V-cBU6>KcB
z%heGq@ym=i3s>wv?7o>)vdSB^1vzqbpLT9v-WSYJRv-1G+Wz;GDuEB*RI7~Kb4w=}
z=*dRtV~F~E9;(;^`R%M^nHLA)<69155Do2Kd^m`Nj!S_3TBtXxyR>W*03}Wa#3<Yl
zQ1VC)dxR|**~n6t1x!|hUwCHfr4e^+KR-S8!Nq<svje3%Xm?6zZcQfn%}i~unLs_#
zQ<VumAV|9J(BK@*im01nDvD2gO@o$f$u@F*A^;8sf!;$z_Eu!(tWVm)6_P2UBv3e^
zIg#m=8a?)=cv)+JwNl$@Q%Ki^5ldY2VAdDv>&O1{>))Zns-ie!2V$4_mCQ74OEc7=
zrye`=D}kx^5bsaA15$whE)KF|q4`vH(2vcyG&IgZdX5S-Q-*{arme+mOcl&ck!b1s
z6muD%gyloG27NR1p%DX$^;C~N%i-4e^0szi*O}xKW#r*e4nuqU9#{3BtqWo2)yq_k
zXn*CqX=o26OVTAI=-W=3peC}_6O}`MG#{VlE4p>_<vs-DLgR4tRwZ;t2>p#2Ixa6u
z^x}D<xSpMGwp{S3&YK1kCeH~N$x!Eh2KgiR^u7{r%lm2E!Mmf_Sz+g}V<DVMZR@7&
zMp{D)rVq>K+)y$Xc6WUoov%5xU5vV7@$5+q;;;AmzdYKke<gwNvdn(|#)OxcaoZb(
zq}Fc5A9{7x+85k{?~@AlspR0Q;suBbVo!T^T+RS(h5^lcS$V{Wf{_=mT}j8$r44+f
zgJ?#a+9W->N`)eaEB<B`*i6TejhZhEvoXDl2U8Y)q|3NZzB@T5ZCVyN)1A~5ovG#P
zKn5%F%dcc8UA_3U=`A0u`7->s4{o#O%VK_0^TnN<3-KtawbLSwUObPP2)`ibdEZW>
z2QK4AjeS69No|8e!1$LgUZ-y*5n4lY>PsGmMU=|Z3#X(*h*d~2W5=fa6m|EN<7PzW
zUpsrbxJL|SGYdCwDoV_4c(Je^^NC%Hiod8eobjzNY36jfzu3CVsJc0p2c|U$3mdYC
z*`}eb;nM<>MxFQbFI4vd#WcQFcsBF=nO5PBpjYJxdITY$Z1^iIt>MO!;JBjMmiJiw
z5`ME7CCZ~3X*nwo)=G*Sq4Mwnzrh2KK1XR)o>`RZ%!`vAGexJB|KUnF)xp3}ri>i*
z6yS20C6py4PTh5IAN{&j-}v?hrEeqp=nhMTNIiNuAG+Pzik5fk;DO~al6-Nm<r<xN
zKvr1S&16qMA_p#w)gz5v_dGfRku^_>aujU8spqAyr!V~2`0#Mon}e-+d_0@y#XnpV
za&g}KTi#t(ISzXdjg6OR_j!$}-|EKgmwZvl1V+x^c?_kcBk;ul-L_!nGH*#<Is!d<
zTvLU0LcVnRdZ~`T*4cg^)r9W4efClvK49j80l#KjpQ6ObcBj7J<U4Xb-LJ31Qyo_s
ze%i;JS^ep_B{)r}INJ8j?#y69)X)sa{9(On`d{EQASaX)$Af#J#)aMHIG5>XS(!Ws
zp}a4WN$AIqZv|tgF%$9ZTqk%VJ3CFpu?0c@_`+%oiOMr?X1Ws_^JmlzH|C?duIc+N
zp778!P|Te|G=^={c=HQ?VS|t3Pe0yxbCIf^cWh6kFe6*Ko2pS*L+0do$IGv@7Jqr0
zCNrq2cb>z&s$afx{<PLpXlphE=q@b_Kv65p0(_`}zrkF8SE&3Y0P>Cv1Qrt_hG7b^
z0(@;@a}i|WV(1(#-FSU;Lgz)p0eT>(`_Ady&EJNO6GI{B4#?ItlXKP8CV3iowPGD>
zq8}mto@+-k{!zP)yFCk!*p)baK)d$h&DVpBpO$&ypD`6*Kz)>GV*WUK_?#?=1Tv<s
z!lnFzxwt!W`le~Qu<usGuEC;K!-}msX@9*Tzc|SM@uamX)82-SX&mu3&Uu#cswX$^
z$ayAm@3%|N-kK6p{y<V^K&f+V5JjNVt7O)v$KPF}0dnGlnvnUX@oO^vQ+4}DaPXPq
zm=@BQ91RI4V{7d6>CsT|43G`%r7snAW^11)&Y{JP>AAjnzkFMs_;&TP-ET$~g~dlw
zkoBzY&x-}9XIVuPgm8qPdJ52$6bMj_+hGJ%s7@8qzU@G`<Wrp>-6xts*+O-f0<}2{
zMJ%gulifHlz-^v`bQXOC_iF40wsY#{Fy@KofCk_EYa3>KWLc0lc(v?c{xXHzR#Dip
zOL~Oxj5!p#ygXXfvT!|pH+hqN?a8g0WA2sp@-*a6b8OU$GQnZnYfKTtS@?oY>djM6
znLt!EYy$IW3Nwz<-}2w{C=vP-e4<#3(5a`xSv3$MEn-jwO4yk`0YZv`51HTAMJ(mV
zIttZ1YL;r4o$oa<ll-0@uI@U!5ej<u&a9pDxg~2&!vuTEE=`r5b^ZrQ)L$ChAK#o*
z+}pG|gd)y_`FZJU%FPOEA<G_I?w6sE<SbTA0`s9tkQzL)KR~X8LTJ|#E^pI<GjI&d
z&*`{i&kaVEuU=iO70zjv0ZfInbt-`$I3*{rC-B(Hg3CqU3kll9OQhr5uPc5oR~#(;
zD!gifp+2GFK0Imcey43Asvx#t<jl8ZO=I>(76x80bLJ?Y2jD+=K^B*3N2|4+=XkBS
zFifa-anym{8s+FJZfAO{)G1ap2X4+|A_)BvD?BUc7%);|Qb^P#38OJKOysmH6h_N}
z3BR$brE#a>6=`tMIJY2)M`KFcnb$yz-UpZFLlNuJvp#V$gxiIDKuer(2y7Q$YkM4I
ztBZ*Qm+?)Cuc@}0DD2%gPVa8AX>$+_jZLtd)+wDk*`IWU_x&|@i1)j%&f}ZQJ5;y?
zb)S2GD-HaGoR>c`z%d{E4`>|E!U@Drm&>Dtir-mDfk-X(fG_1bQGrKQ$g$hb{O5@b
z>>vH;L2z>eCn8#!eR!{K^c^!*$1KF%3Xw+Uny<NBgO~YlX5eK>KAr@tl@-{`k_8Xw
zMd|QuOk*ZM$u*RXAGob8g9A$wvSn7N(HbivD^3uG3n!2EbyC|_-j$Vf1d|}3X<_;C
z1n!P)z?%RISfQFFVz$1XYN^b(TOLuB)^{47`uokA9V3dfVbl41q#c=-atFMH;~{_`
zJ)Q|SC^)HCW9A%F%SNIOIEaHR&dNV%o}fmcTJx1l34edALVJ50Z0}8b!wh4K_SY;w
zHlMM)haYl(NB{PkT(7CC>Cp*#*EmNS=<o!6nL=TQMV(Ec{<1dF!iltTW9#+a$ynYw
z(#yVKJX~2+6=MUO02Pc_!WS+N{rxG94e*XBUv@qkbBX2lMbYPrMmJ5|@;G!g%FuY6
zn#~R{xz<G2oMwO2K;2xbGdztyv*44>on3!uKjCq7@|BML@bOJ<A0esCeQC^_P6L{J
z_RQ!i*xF}DkJ_b#=4soja!;bGuc}zkz$^V7p_<<}C$35Pw-uDO&8%;6VJ`%AfK=&5
z@ZoEBCeMW?Of#Ya3AHaPMwa)5yQ)uIfa+Kj&J}f|3ti+Xou0yT@D1tW1rA(0F=n}R
z2k&I>Zaa5%7fI0+W2*&G#xgYv+=os$f%7gevViTSgisuU%U(we9%O=?qjVp)vJ<E4
zK!+Dl0~uh#-2Y?3S-^z*n4FodCM>2amDA7s9<ihEyCEzNhiUFMn3b*sb1zU2H6ehg
z@Z-7Si?@vEN-)WV{`b>)HXcB-uRJbrb85ch|9WRF{)z`p;h?n`9)v_Supfi4y|<+%
zhQGgUvMT~fI@z}N+s+JPzJEknW&OKVd2mgUmklkRu8wi~0RCXzu`Q@(rMmM$<Z8Qm
zU2k9-m!?=|CI*+;Zv*6K4}f{a9Y+@Vib5JF9t_~*5yUAnhB~s#HU&oRCwPS#D?jQ>
zpcpQN4S<~$=fUu+rZeSa8A*=Q@`8<}-)0YbQO7%+%|xo;-hF|sZU1h}WjwCgIp-Rf
zN7xy-Cp-Vr<^cY1oj{-xC#GluN!YPmJAyujdyT5i`c8dpIB8-tC&6`qo%+x<C}@&}
z8!EU*4yk&$eoCHrYACAK{zdz?hfG+zb<Sb;O2KW$&~LsGdwsdny4jM>1s~qs(h@>E
z8)+Y`A`=el^<goD02`-4jz>lu4?g0ituAc`fJuP`1FR)J!2d^}ubG!+AEx@v<Sc4a
zqGIU{NiI#1%*Q(3p3ee3>H6!&Uyo6J&&rR&=Yh!U?vFUHSqMGa4*eSHup?F+<KXel
zeEie+KKQtg$I%0HP~f1f{ULp7)Gg1*iMMxWLG0ldeqM8~9m4$+u80ma2>WY$UfO`k
z0=(jCkU&$w!tc8!4Th7z=9_yWZCG799?6O*eS$t3f{a7RL<RK(KVmIV6fyW}Y%42d
zdwEN`4<DKUR=g8t0^m|ww~kKTcTxM{lOG^!;laO2*d2F#ZzT;-6e#He`k1E%)RQrI
zy^0<8V(-H1P+#lu-MKY?RNA3Rl}qz-=2M;8qJw{a>c<d_kqet2R52a#;X`L)>-kOK
zo=pnw*f7EfD~BreE_9zJ(xJwcR@dloA;On8ou=cKy93pG{_xM|{<r=)=Vv+0o@VJ`
zonQd*6U!My7469~7%H27o<`b>>CZ^`|Cc|>k?l`45RZQK@nwH<oa^}cyxF`jX&C`}
zW>0d~4NMWYEDIfG=^0o;3=UAk%{TeX+P}}bK!f<Q`O$iO-|jqV{_hF!V}R2D^y$hS
z=m`fMGekY)kcdo}0MRSNU#?5ooQHaMK!{IV-&{27^?$UPx0>ha<uws{v5LuEh9S)H
z$=sf`RzkXc48EQ7phkYXClPX$gj<n&-tl&6w!?ga(auXl_Y0DepA|AAc6ioXY#L8u
zQdRW^<ytuzsYd1n$(;30Teu07Jng}3dmN{~C|ed8&M;cZ?W`^f#^#AG8VolUb!$*&
zo|XRoj8i9UQM<@0g<Qe-@25&67g<E%GY=a%WD)r-XIkzvgw0)9(6p7F3vI|dIt;Q9
z8HNi#xc2lH2?8)z@3Aa%_ZOB4L(^AEVmL-_hIAynnq~*r0hnFv6CB5Pq>~*eQdXgd
zxj26JoEjIGZVF$l<YS<danGyd&GvT$6L;ZgsIGkfph~}5reGw9oZ#nu8j#e;iSGFS
zK5{}bodHDJun(dyr}r^g-{rpB_MHCeuhZTCh?4)a!2a)ex&g}u{EooXg>-SXjA3+7
z{gj;Y_k-~9BQYON?z~idSxpTMbNQyYTSGqaesfJ|Z(gR}`8-P#P!Jr1V?2LOg$sc3
z!EwytnjGT@l0Rjknequ&=->=ln()|J;YEYsK-Oi;0u9&Nn=~xq;t<cX1qB)eDHdng
zUAL2PCRmPIk>Q`mzKl?6`chz^UU1$n@pwlSnmSp>KvkD`PmTsX=>sL(V}13m7v?m(
z4+!AfyxvyGR=3m90pLwEQ%%bG#(w6djnT+EAYs<z<uZBn;PucA8)FKMJ=BT-JLR=I
z(N8doKjhE2t@FmeWJ{2`F?zjN&A>T2Wv>2s*t8OPjS&ZdO&F4$8;jx>@qWMyJ+%&h
zgo8bQJ06#Cf9VPH1`XQ)t;{c%@&EEo?~^lf{P^&F8e05UKA$)bgtMQ~573r)@%~c+
z`tSYu#eaMXBPCZSc!pgg`fbek|N0}*`rAJS(P34K>z&yfKR=`|Y)JpJgLp6_pVns9
z-@f&aF65#|!=UBPFCer(Jjj<j&_@n>rRcVQ^f5*=@_mj&*uMfKA(2B&T-cZQ`PDk(
zZz+h{rEJFGdQzU#JIW=(|6kLNN+K8bE#F5@!<(7+An*Yu(l1u`zpebg{|>O(-Ws@{
z=vF?%BVlm=d?9olj|YcFjCW}-s_nR^b~90k*!d9cRT|u;R;MtatG~eJUd4g)AFH9{
z*HOIO%&hB|CN>FfMA<ctU5i=|LF#~)>P5~?k;Ny&HAPI6?h_RH#f&N*>OWbMXkQ9l
zzMXS6;aF68gZaLH5cdDSopoy^raOBvMy{;v;iEd00t?NYd+pn~e9jY0B#?;E|C+q_
z56d(g4~P?Lmrg$of2nfj$^`BI!=#=6$QLbV<P<3YF}1g>n$!tzbO<O?vNV>3D+)M!
zDN2-8>w(clpE*0(pewaZB=jNE5Z#~6!ZVO<dXO%EMM%^kyv_8jYeCdPP59O%I{ND&
zCo$N0nKN#|EDe^sOP{^jJ;K@mI`l@7L3JVeg3y#h)4|=P4C59|o~pD$8EjdXr{7$2
zcguK9FeLHj2LOUTyHROB*gZR@5d&9ua4p+m>#t83Lfz#VtGb$d)9#7nA(L}-iHf5|
z%TE1mm^_XzM#H!21VsU{;SRR^P)-V`7ro<uJK4#3Y%D>+jTtzZQ)5Gpch``|0mfN>
z=-tQn)?3ZU@U(Vq{_doi*Yaq(U7MBx6XE?{aw_|a(z}0*wzCBXHd%zMH#rrSH(bp<
zJNH=dkclu|EN}VLaQEaO^YO;~lvW-|M{21k|CR@}V9M2qvXowz+D2~CRa@tXGHcFO
zL3YmXK5uXakoqgnYZgThK}2w5x4LG&y6MqELf`ILSG|pT*msWQfN2OigB{IE5v}m_
zb|SEix<F>=V)>Pbw1{!VAEY8O*0CuZ7Q2Qm!kM<}xGXfO|Cm?E`?T}cl)S1=Jk}re
zU`7dejotRG)z4}Esw_=M%6C`B^AvxOjf1yI>$$IniNU?9%U4nm9BJg}h>wT?RK<L|
zebt?9fAW)I4XMS{`$>7k@B&$6+0McQdaH@vZL&DQr!{DJ+#Hl2kKBChu&KNi-hT<x
z%PhX5{=N84!kRxQ6$<HW{}!(^DYU*OxRHK^CaY7z!{{YXod5LcU-|C10x9b`%I5Ro
zWoWr5$|u^=xyJUI=WUM7Ihn%m#S!}L8R#u{toy<k7E>eW|6_KQqe)^4X8XK;8fmr;
zr7)8NYd%P_IcX#{&wRZU!u#eDW$PndBe1veGjw`&9T0Nc_rxG>>1_$Ty13evm)UC5
zq$;PC=9N8%+igRSU0yf{GUA=5w7YVMo_%VfKdM3=tkCOKD>=Us{&rP`$AM_LuVna+
z?iaEg6&;!ubM)1fsLt%T1TZ5zQN)sS>gEg5CKQfGDy<YKq0Ua3L`F1W<rAPmy$~uK
zAcdo(O@%ZHdX_1b%_v!xm<OfDBE<UJmtz-Y&-W{?8JEu@m&v?4_2jfX&scwkr~}+{
z7{bnx+Re+oGe`ydZNt>=S{sa8$tKYozk>Kej+|M@pL-}*slo7G*771yscAU&{E)r8
z0P57+p%8#+UewtO|FT2u%e{e1LFcPNLAG_?;^a$Eu9>!-v*#jL;cl)#_VQ}XtTd?3
zT~Tuy8m=IJubTQ%FCE-aCpOhwkIG{~3+$Sw?I6DKYFjy!UIn4$x?-;RX}D*+7FI?T
zl^RVRFpKEE#w$sxl^^U&QeR8*C2l#}kcS5)clGO14Aq>>N6=5_{spv-GPs-1OJu5Q
zyQQ1|R!UMI*a|bO+p^mJrdK@GSo1&$py%V~=<u_ly6S2i=H*S>!L+T!`+@fT312HF
zg>@lkRFw)bLm{r^%ndCDbg>|`rA5pK>;p(*1BQ2ev;4{7vKN@G?*hBmJw+^^4)>g+
z3@79NJ=rRJwc<OD@;FH*UQ3faHntGTjKr#M6pN8R7L)1pR8{p<Ul`+@7vGVxu=9}^
zSgZiW4c~0LTlRHrDj*esOW5`)*I$wu!*Bh(vDSWU$K~qBZj?q$@Th-rqEG+a)s@>k
zin*X}Srk;+jA@Ca?0(Tu;gXCra#tI}oJeVRwC;3UYPn?v()CLCIMaXe)N;x6OBEKS
z(I<H$mUKKKTVmnIbUGB*I&C~;oZW9_7SElJlC(=5w&~R>UPP|>Z@QOFO?r$PxMOF+
zR55edP4ceeHTcz3zZU8d5T#p1MxFKa{1F8{jN_Uas9^tmAENm6LJRq^>|C?NY?Y$L
zDY0&VdIO>&fu0gd{;YsrW5;FD$2^BNBXN@>mL{k{%-aD7p0`d`LAJLLougbs;DeFk
zP=p<Y*y`poLYU1ld}<d9{UX5*|8vYlU*QXR!gVpt)*1B*;5Pl=H+3fp3RZc0vCl?5
zC!Cf`g?Du4Id<0PC6y>Tt2^A1R;%@)Bzo{+;dHGfP?p4!RYERIm8JCe%0>cQj)wI7
z@imZo0;mo`sA7&SV03FplHG%CosXRI@_33Rva8eAX-r@DSfe>P=aX>xh)mTHgrRvQ
zQbkR6fS57v+uH{*89(CQ0EM1S(LFBpd@k!1CX-Oop$a2(X-_Y`-<GC<kg}l#v?OP5
zHkU$w<y|{vrUj|jm8%^4y}Z))i_f7&T8M8WY!Zq_&iLjvIe#*lLHEoh#}N!6ME-^S
z)J;`P5#~gK1l&Xb(ZUuk;P^`SOP4TE%z^Ca55HMc`VtIRR)(_F8yv_4tQ%4#1m`<;
zXErsXuoV7PjP32<^-`4QXjc2Yh}O^Yk^HOzbnh`e<ANhQrWw0l2%?y<Fb^aOn#qC4
zU2AU(zc}YGI%#83-iIG@C^`Y^Gk}TndOri#Ri*W;2ObSwm|*X!iJYEWy5I`x8Z?@F
zU}TX5m!%s7Kn98K?^$TV7Rifx!AM}8h_ZFP+vfS%?_~LvcCLTlH2(50Er9>1(B7_R
z(&@6fyhBT^yNbBoirh;xUwWjVh}HehbcmHk$hH7>H%x4_sCq8U@#)w=p}*Jic~CSN
zP~`rmSi6m}D=nPMHlh~eivr~G7MYm2u;1A=4n}WU%ZA0DO9r$D_D4NQ_<iu}lRQ)%
zw3&k-JQ^JynwE#Jd!xZ{khl-iXG>m<?YZQ@w4A*nacz+=6|!%XvCM(37rLseM93K5
zgg#1x03Z!*fgU@iXEl6Mxxkcb-vu{{uW-QwOeK`WCE2Gx{4UdTam!;>a?o}!7GO8&
z+kISL=>;@HkGsv7S5m=D7zi>!Q3gY<g@X^|yuT7c42|rh^DxPPS1LIlfT{Qr)PJwL
z;CL(ToY~rkuv3n{1fB{>@1>2;)ah39Fu7AOQnQkDc7Xdgg($MMZ@;gjt2bu!c{zUb
z{rD!Ge$D9khe0{!g-hy`lik-#gXyw}^bB&9S`6<U5Dx*maO1G{4G95f=g?m2kTRai
zf2f}Ag~{Ht4wV%>g@HnZ{k&BPvo3EX!Dg6g4n`G{Kg&*wO9iP;DKIJ5#{{j#O@P~+
zk@_<RE{h~{VN+kp6r7bh&UNQSj-!smt}^90$HvoV^&Hoyt0w#C_30c%iWj`dNfa)Q
zcPB)JK@~?E($Y0EwXtZt4OS=X!{9_ecRJI?=L$rDx4)}Td;Rh;{4=73avUnP#v%;=
z<6su^0tu{bsvk#qnP+F`1&5<<-l%Im7;x%ZmWCW2=27Vj!wPX)n?6tK1R0x-O#SAE
zrMiRTv`QX^SD$Mhx*P~9O3&yG9hfRAIhK^T*FH+P(o&;!>a-MDd+4r$r}kyly2b3$
z2Ln7**A?hC=rXL2n%#kvxRCj_zDolf0rg?b$+sUkpl;@)2Siz>p~uQ8Pj$jzF&`1r
zkh)g|fk(R6+huw3=Lq>!u2H4MA4?PmxVN=>7q~68=Cp>I7Zg3bXo&2zu{Hax6O3!6
z9!o!N9}wFxH%}f88RX3*)JHg$_z5kr9;&P$@Bv5Vv$4(x>|%tqq8kYS$+D*>Cr;C#
zCerBf=XTUQg}5|VOtYqM!FL3v(4)unI0m=;LBU5m+i8A;7RSXYv~dvCyYKAdtf=j&
zcWi?WN1dwx!H=%(Oh@`ol?bTgtE%r~?*Un<9{;s}EW!Vgr+7cIuN19e;L;ptmwB#O
zKsaaRh(DO6Yic~YjoFA(Ux-r=9|;~(pv+4}|H?>C{$V89|GyatKmO!~Zji95EgG+w
zww7?M;2$l-j_k`KS&}+e+n|>Qd<Sa&E;g7O6k7U#V+u_a0zr^7ste%bJxo-;^xX0z
z@E&M-kDFNT%b8%bN!rbUWBB9Ls^HnxqS}g{5YGv-_NY#Os+!q<*ok@$`++s4k(Bve
zXvy#+-F=>ftoEX7x|HG79Y>yucdHO^S9DYFifsMIa)6tw^f@#og4{MfwK=Q85_rM-
zi*6<LmeH60A!P_8dx-R&fvg3qOuSWm&f+$_-`K$o^&DB}H@F+dLkpMiLyiw}>f{X3
z(9SdOR72jMP(Fb$LCsnT;P1e<LWHOCP|D|R2NBe3tPP>le)X&TsiX~qpQ<}Y57gae
zw5#MjYXsS|k^zUKtUfr9SLyugNCoh#M$Ve`emgFP&;lfe*>1itRt}*m*hpq2nDG)|
zA_>Y;<VvhK?uCc=1H?E_nUB+F{1f}6oD%wq@#dmzaru|a)lE0Irf%{Sb}sxR0<ue|
z)QFcS0T$!A+#*86xQ}XffwC%wG@B|^7F^g(P>vixY_zWm$2ti(RP~MY`Y*4y$IRu<
zSxa>IIQr1+KgyoX5*@_rWY4n4_~W<9VXZ<n?!OCmQ+1bE<W1#kR6==lxwzB-e-HHW
z_;OApK3GoBn3CYXiU9Z*C-<G-6QlDmb7oR<5On+jx8;DY7Y$%Jk7JZs?=;`8gMb5O
z_Mk3;|F>`!?BtKad6&~g2}2swUxdnp^TncUgm25tLwB;O$>Be{MMu8)J;n`Kz21%N
zMJUeKW!ALB0HQ&qF4YNeQp38q?+*j#TLD8a_84vRk`TDlyKsS2GUXj=#T1(lQ|b)a
zo@Tn*$E0X~Fy^<UJ7Ra^VAIU_vX#xT)(t2q7*sctmUF*JRc>(>_BjndL(MXw0C#6A
z7e-ARuHcpqW=UF({>1Spw~Kh~>Qf57c~;n;#NF}y6f)EWJkv<toV8?+Pb64APHN~h
z&&dgxA){e|gcd4q@KTaqxxe>4#>_9wL~rPZzIn0^#vB5SZagF>9!>JrBpjpyaE>>K
zjJR<O_!hc3ct7qLo&)egxg9wGWcL_Blu)N9JxT`7oZM$ncWmtp)b%=IG6AZ5?c@wZ
z(^=QV_(9z@MZ%TUWa4hjLgjjuRh?m--)%|Z<{m`7eN|?{Kq!e3gmxG9LOY--sIYHn
z!}fFV>7G}|ae+$YSl2y1DhT(fJeLlC(yY(2xE3h>GFz=SYZDJ3CIm^!+ZNieB*;do
zfflG=cJkOWjohB~%SeEP>q6(1c8MGn1B$MG2Wx7ZZm!mY(1_bZFL<d$7(^aTqUuj5
z-n?9Fgl-3P7kW{tY$wcqS1eYrnY1#RS<?%yE>^lzcW+QHn%Y2QtsOPm`z1Z_U*GHr
z^zul-^@?Wpxbr(Q&>m`FrpqJ@MmYZbj51{cIKj@T4&iO%{!X}TO@vqF<R9lP$>4@@
zpKG6Ez@g7@-g~UP<Lp5q^;GtGJW)X0-P#9~Qn+`&UcI;*U<xAR+NJMKo%OS8?0d`w
z&_)ZIq^i<R>VY7F#Ec@Tz)7G>G6ZdnRMeSpkP$n!5nL|TW*9veI~vJtY}lJLhjo)O
z>A&nEuTW%r$OO6<JG2mwMh$g;*zVO1x>QmHJz0BY_73CD?W-8`KARMX93$4gv<6fX
zAhbkUL>KAscE>}H%B31<XAbLh0t`P|c^Z%5!X&fCK^P79lTGNsU+V91Mq78)I+A3N
zCNUM?Fxvts;ur5R`xq2)w{N*x{Vc|z@t7WJJHw*l$hm0<n9^IOD5I<M6S|N@xsWp^
zzH8UH^Z~d0su=+;Fjc<0oFU&d#7%ULg9f)-{RSzjH#G7&516lO4W%GMvL$rV8F2Qc
zbkKQY<@J4_Y$=ZOf#*MfjthXCkLsIJ3Q8Er<LyN`Hh3c{whWS6NyLYXK*Ati%HyT6
zUln@A6hS3~)UHW-?t*&`zaTCXZb&AuF0Q7><U`O8rkrx1OV?;gTqw$L=dn_@fbcl5
z!`2+$Kwk{Mp7d_HQ8(S>+J7|=x!^<Duyv&hLhC(l(}Tbs9QN<UTv|Naq!UyETNB@&
zecU6z-eLrQJ-QcYzFR)e^&|q&A!LP~M~>C=by4Z!?Av?99|KQsTEt2fWcxJei@ho&
zo5u=DwBHq%6Q=b&fbhj1lgcu(GM^`Tq(I##n0f!~KG+gVl>X{H46Bdd?ni9ew`cM#
z(emU&054RAdOp{{B%dh;sz<ZL$d|K4vannNpCsG=%;~)%(ErdfGHMAN<Z6^Y{ib2W
z?Dfw$F@r5xDW5h@?hY<$GTueMqlVb_g>8gE+~T1tosgfmb!LIL@R%ulUMYz5)T!>z
zJ20r-)Q;bAHKcU1N9CAgrcc9tH?7a|4lujl<GvMK)3w&Fpqn%I@}0CN$Puo-rsfDW
zfyjuP`!u(ud7@KZuY5k~%x)9IYr~2FQupj0_VUmfLCNh`HXM5;UWF`bf!FD=;-Bik
zugPC4dIa%zc-IRCkPE5W^?K70^ostI9aXe5aJ;=%x2(#T=6KTC!7=KoZn=MCA>_+|
z=X^5hJBPnvU38QvrAJk(<fC@toG%wD1W_z6O!+1^p|NB<>X=yOc)<ONJEv1V4w1G2
zmjF>gO=D()9GXg@v_9@_Gy>V?!m@le_?lz^(~JZ#hR3uR+e=V}8&JG*9i)w3&<wm{
zU(^KEpta^Z{HGr=!pFmXX#mKvk`5WLkfI|TAN?6s2#WMkPCNOq^#m00{oqraL;hGN
z;EG>9<-_-Su_r||Ax}LKi4|S+c(pE{YmP;8y>X*h`VUV(`Pi&DR`dv+HFb2c|7gIg
zSwEq&On$KltCOLggY{%Sj$>P5h5h|wLfG<EMi+kbITg)JOo3Pc>)7tn(2p8vMP_bc
zy~11Y)j?lhhaJAcevT_|HdJ&x&!(cn4JqQlt@1a^41LyB%xz8Yhj=f#h<!HhvzHxz
zcar-=*hsllZ2H*5wZr?59-`(}z~q-d`&_BvkY?oyRtN($uCaT25u4)+07N{ak3yY#
z45h|y2=rcZwOX%K7ZE5_4nuVsuNAXz2ma3E0@PM!oJ7j*mp$A6;M^7nSJr_Bmz{!;
z<`uSP$xr3H?iAzFqhwVwWjy1{76TXUDT%l{9^|nryP~Hy#|q>tT+dYEw<R+o3p0CW
zat42HKkD}cd$0E{$%xa$ZO6*XV~yvHHjeUfK3Yn_h#~*r$A=f6ow>;5ulRXqjdA5w
zKkWR9iq&KNsFW}wWV0!#u>92Kc74nlPrD!Aa(|=824?v~M}##giOF`*@=uDRIjL!P
zv+{W<M7G`~=jj8*HvKQ1n`9Gq?r*L69dnJ*>X$qlGDdkpTCccF*<>8%Bl42g!&iz?
zkmj&9Hr8OCh-0z=lOf_J<}$ko@>kU@YzRw3SX4>KMpCqtBAl`jp-{$G59PkbKStir
zbJ6J$PJG3(5z@##R&-PNT6rGPEo+x?XXcGOefOlNPKBzg>JyzqZWKL5%G*@WPIQ35
zeX&?m$sjY1jO0QVpF#1+k~1PIndq83#ZOf*_UEm_o8w0@lV6ye8b``w)v~?hJgD0l
zhh1*015=&;1F`weJ_1MsqmLVp1K_5TH;{Eg<))29(Tquz6tHhX?kyQ24Yjr`!Z4@-
z8C)+JEFUYX0Ff>SA_#j$qM?2FQ~w#a<>R~692I^3S*1|)9e9~X^1!l|XKU0Y?a_ie
zC5a3O5mH9}$e@*n9Pdj8xW{i|@NyNP;?#xi*M^p+GC(z*d0LefJdwk2KSx=<4~q!X
zv!a$RovGcE%$SS9q{NG4`SO+Zp#X2Bq}jMSk{{pw4pj62gp7jrdd2xBH3?)r<ZRZt
za>f23y37G5W9xo@-&A{eJI=zTOi%lJ)76O%PZ<GCN^bH3_FJ~9Ua7sS>rMz9Mp=Lc
zH?$p^3DFzo!#Um5oV>Pjo0Y~R@es`{#r#>)@H&&3p=!L-oqE<%@tQt|P!{cv*H!dH
z2Ai^xPj`!#w7xknEjM)D=vupCiBO+BD;sOL{+b6F@^$;`f`kf1=WA~!pV8xVWfpJW
zfXOc^N(QD^g-<R$9wOrlSC+9*?j^zElsWjS{niJ~_K3{36kF?h-r}Dqwy8u5aeleq
zlj<Y`gA6GSjjFI)PkDIme;Gk*&e?oJ9H&J+mj>K|dL;2!$V*8*YGpz_nz>@SJv-#p
zj9}SwO+xB@WJkoSnS&sr#1E2!=k^#&aP%0-KKBNQ-<sB{DteHuMb)cqU+o<6S}tfF
z(vNW4)~o<nU3vcj?&EE5nK3Gu_=H_sN}jy$`GgyZ%@+Nc;f(6dJUEieNUmEeacu!q
zPb2_y&uG%af8vQ@sV+_z6R}<j2m5Jdyqk$A@)Xm_FbBQb^II8ZtAe#Om;fVFKPc>d
z!^iXKCwapQj4y?5>UQu<Xmh!TabYt-`%+9q8J1-kIvoLqBs`ayeD!3?ym)6*vvKY9
zsMXILN^s*Q*|N}GEILvBr+s7JW~Q3wy;&!0k<$m#GJNTyL)7Q~-HNXcn+xIX=&8G3
zp$v%K>Y@HdUuKDSspJ0m-MpzJse*C!S{Ch5J!r8(fzF0#jIg+0T0^G4_^k`eL)@eJ
z4}`%0BKHg5xeKx9zcUq@UcAsQe_~bUljv^1rdtkfr5hIcL?l~>93w*4J=JUheRx_a
zf$0QKD40-$*_Br}Sg6*@y$|L%ct|^%(R8wFw>o@VZR)jc_SHpmGePDtK~A_ga~rC4
zbrN&v4lrqhW@v!lOqSZLm#jHuIBt4ik70R$mU`$KV9<0!!qM1jb-={E3a;#5FmaXd
zL*|t{mH=v%qPp=3mP`3i(eQ-@dZv3avH3ys`$dzRZ%%((9}q59^+~XF%`)ok*p$0X
zQke-G8Zwr>+#6%$J_vA<!Kv-%yyms*)F?<)UFE*<hXTsDU3*jFZ{y)cG$oIG!V~*%
z_isC-mP!WzMn&n}+6~$5kHgM$-j7pdU^LUOHOThv$CjW6pX#B<HrLpSN%6Gdrdxsg
zF6gFv-^tlnH~o^dbTm(Pgm9eo%1R<eXkNhfZl0p<kw#ua4eq{6k#i`wM<nM*Tqiy6
zqt_DzC&PEj3%=(X)zTHuv`TqAu?Z)WKN<BY8NBV<&c|a0LR5@7rS)Rw&&wFGz(%e_
z^>wec$2lHgDrGa1{_*t?k?7VQp)yiinJDk(_M-+dAn1R_f1z(i1n1azSj+m8=9LkP
z(1=jz<XZb8CM)t%)&V-~_Qqm_3c~qv(xsTP)@Osek3p^V-Bh}JPWKyCgzeQo_6Q2q
z1ZgeoDHN@dC{JLlsKor7VJvweoWgokH1sh9#DX+XPXB_<t1K~!RLxr67%Qt7tLv0O
z%ytz=g<-68VVnmZ&eU$`c5|{HF)WOo*QnaSm`d$-MCJaL1WhGYSeVGM@jBn$Sc`pA
z<5AO<q@}P=vF=lvSz@$9-)}Qfl43qgC1ZB=lSSV}%hQx1+ZNvDko9v{XM9$ORqR|{
z`pO7Hzi1pfD*c^w#=KnszPx;eC{{lyhgDUPD3C8PQVu`XjEt~*;9wl<*?**b<tv%i
zBCn#c<Avr(fN`_J)Wz^`F{bSrO7z&#RBz-l{3qgrwF-WWW0;@fZf5;4y&+~hl;?E&
zfuU8eeeh#qa9{O^7`4xtA?wYV^^k@m<?<C9Eq6z;<&HV&y6$T9m<>j6rHTA!Ho8Ky
z?e8jDbxP7fSXR0dJb}+ul8Cn}LXx+=^{*Qxw9VLd3nVqphu-5-L${$sP(NFu)wb5L
z_jRQ@1WVm^H24$^<Tg*9n0d2kiL{C|npSDZs;EgdOU?Q}l${4uQ(L#FMHJ2v5jz4x
zR8&NSsE8mCqQ`=Y5)}oJrqV>DcSsRYQCdJLQiC9d9+BPx$f5UMC6rJD1ky=;8$9QK
z_uYH`d+!^255^#4!`|6ztvTnK<(q+TJ)q!sx*Y^WQ1;S%bX{g_6bXjm&V`v#Jc1Dm
zN%Bn7qO(PUDJDb(^}WGB(d?X3FN8e*z7K6DCdW#$sRS4smjdCFi~4Id4E~{KMby2e
zq|Cmv3J<E-mOZb1{cv3Z&*zNl5vcRmR<uqGboCW{HFxY#Pc*aExzxMu$Qq60q4}e6
z^&?{s&>^WCd8FYorh&=HU}Jex(vF_8HYSmU@~17^whggo)&Lr|uOrSB2}`TFBumM3
z+uwMzP41+;@b_t#M82bE44kVLOib|UaUc1{U09u+o>916P|@SwJdHCsiW>;|Vy4-?
z=O?qXMrVjJXYS*jaP%IeWu}Q_=-I?xmg>&w>3_ehWodQAldN?z9>q^tJZXB#IV=>6
zkvDq;wH<m|>Pz2V<+(Da=SszeHHDm3o&YCloG71sf6pFp$I-Iyzgaioc_A?T;MKU8
z_1tgIv@w}K_DZg7l2{bd0SeKDe8*Gd9v2Vh1bYTAi~Lq?!4gB=7XK0GSJyZG1Vq}p
z<rX-*U|WCJF84nNUxp=%&Rxp!eGJa70K*+>l8!%y@kEKiUigRJP4H=@n3h7^C!<yB
z91jgS2D*ML!j|`R`t1WMk*yaU6Ba`o#q_vACwa~j2TOf^rkgVFxC|?e5R{;_W^2l_
zQ7g>JNN~868OR}CL)b>+Z$*GBtlyY=`x-qF)XaLe7@=IVoqsm*a#3_wACmEngS0e(
zSzX4m&Sxpi*jIm8(c{3vk<UsMp2t+9Y(J_DPIbDy4}rzy>Dr=cF*k>y1@<xURX+ZM
z-9Uw~sW$eqoaT&doyiZo&L5V3CiN-oRFb+`sd<0<!4H9WP9*${fnEjVs!pasL8WDs
z2t*`{Up2qfr}zho6$vle`A~Z3FlAO3{OCCOA*Q$Zu+OBwETy5N9vc|EcwEwMQ*Yo{
z!A(QYH<unpG#4<oLpUKXe8;UOjK*m0l6L(HPEtLsC`|CJC(L<q64661K(oqRFt35P
z&?%pO{LTyeqLh7ZZF#AqC2>r`eXY5?J(@Zz5^FIzixv$PsoKHk{jeSuX;XPtMfUT>
z+I(GLDph7kfG+GZ71WXTH`$t(fBTlj<h&n-t?`u-ayxZKo-QTcBH6KLkL>W2?e_vE
zurvKDol;XLeVqsnpiB#>uSbnmCp4$QQ1`Fd%wwq*cu(@(Qpeh-zf+X9ioVwmE@n(a
zD7Ls*nJjeD^O33Y=_!fhDHt1Y_(<*}6}{l!Gg8W5qtJ~I0s9Mg=wodSyQ0pOurJsE
zDM@hWm<bLSU(q)*;7kTu<%n!J^e1fL_i(#f)1F%&urpa@xN`1-#^c{80d~-iYsyb6
zUwdr?x2n;GYiL6t4{;;FAi-Nz-FaH&)+lxoBuxSV9@3ueyMQ{^RHv&qmo@>etmi#}
zq4C9Q=(+$fybZ0Ox0rR0Bh6aU_n8&0(VO|h`K7gK#>FZL{yi+@<Q^8$W3ar#<T#4f
ze46?}*6SfQrR+8~g)$av7o9%${aW$TtrwhTzm5oM**U`dC2~vy(GOK@f{$f6&>r#$
z`DIolj^Wl=%npcxOcm-J<6{A}Qc!g&hMAaJ1A9ZAZ{ave3S)9nJ<okeH^EaMhd`c2
z89%p9!D?^+xzD^o)nMNUVQ{q|5zAY&e+<)}G6>IW$W=E!o-0V#Z(&H(*$q8?tzz6|
zN6XdJHS~@h4Z(ed@||+{uemI8QiM#)T$8x;URu4iboL$@!qMSbjO}$f9$rM}>MZ=E
zoyoTeF(;^jifMZ6(htTGeB5PiFyH*)4XYbH%@444=QHcdEQZ%or@%P=Ywd4Wu@U*K
z?&Z?&9zFAXkHy{>Fi`#rSe*EC($}bC173^ju;zW}EsFa6r<S7Q&!6fG@gLbHB}_mp
z-&;!!)=oqx4Uih-GkZEjHFJz}9Uq-J0TScYi~OA3Bk3tQEO=csh30wQijZk1MUwe!
ztMI$e886lvT8wUB>6qv}-!Y9Y<4)EcdOdX9?(*Oj715ITs`saZq4s|y>+vZ8S=N=u
zZ7I<U*jJ=TT&3VvX|n1dbcxU)2fxRstqR?+iKd`PbytpWj$=SdO>)-;uAl3st+|ef
z8a8$p1T++hHxHbL9yWpa#OK!B19d*mc!+SdzT${S#J~8xuwaI9OrpiNZzI+WWU9Kg
zWm><f>(43JW&(@u75xoxiF*Jhf`m|hpw)X|lMH0fU0-;WQ@oznH)d#|J_|x=1EmbA
zW4z59(fk?6Pnm&-Eujs6r(gWXIycMj!-0qlGGZd0_$H?o-Mp4Jiv>3Mus2dyZQ7#C
zaSxBxe39F?(6MS>I;9(EJ#FkZz1U-`H;`?7*6ic!?Xtd?@P6b=rF}LhVl#&>@gL_1
z((v@2!8<rO&r=-!eMgUL+m9j2nx0|vt04oc@lKt!dZt>u!9yo0=r#_C@sQ*3vqgn2
zFs-;hb4xbDQdFV|hGGDA-}M0LZLwDR%{;HUV8I{d?%T3je64cyrH=7*iF^*D*~qU_
z)w|`~5PT{2`$LQDty5jz{kvOOR!hG#GIpx-@|J9;t;T>judb?rah36fSPrhAQ}`hS
zVuVpvx(}_GlFBu#UzPnJs;1f#b0jv_vBbNyVl~9)?0L;Yen@HpoE5XbbAHLVcaxU6
zDJqCAjA-E6&DHB4{GhZf4(q&Na9)sPbEHf0jN0qVGp$P}d+<*=qMi^X0;}zv>33vq
zHpHQ*HEG&9NcuxSIkR~HbiyX<QT`Vb{(^&Ez|;=e4+1}q&YHP*mn80!{D1|#%-yGl
zG~b&Nh#^Oz*h6<q-7aE9E4VL=wMIG>lZu@aAMIPhuxQRlFjX%qxiRg}jw`f{x(^Mx
znlmFGLcQJmb$0(g$$n>3S#~SmT-NVtpy?|0&YiwMZYp~xIP9<|pKsoFiuFhM6Ij5V
z;uoKe3wmDlKSj>I8(qzroi-%9YTCBU3<Sf+6`ol6=MoToCle3io`H@rQZ>mi+fUk6
zUKP&o3-yYJG=a!BP-abg4w%DNM_UOGM-=U^JRUnDtE!@C_1JgOR{9GKbG{^#_-WoB
zhS22@2}z(2Y1FTc{eE6eh|8+e_8?OQ$=5=LXEje03#d-h(PqB6K2)N;3@k=$=HZs!
zaPIWXlB<{1wz4cRMDM&Oqorz5<0N|N!r_syIb^<Vvl`Cim=SaEosoNUFQHi!wEY~a
zzCxw+asRh$ZQCeQTZ5mnnny9+$(d65_wNRZOixsL=IpVzICgzC{>7F!Pw1R2yxWsC
z`7EOTub^$^wVQsm+1p%1z$-t@$Hjc_##;OVmdT14JnWf%{tj!mIN-JTCdztAaL6V&
zsNv_dHPP*<)SUjq?F3Kc@g$c+t><1=WegD(edk<C+c#rQrC!VNKF$obw(63kvG4hY
z>Z?5{0rgg6W#oYdG45sM@niV!4{;46bikWdmN;==*M5H!)}rd$L+F=Fw~Ik1M6TsL
zI)uSn-N+joR?YT2tLz;nhnfe8h(Ft(G3mzmNU;<TDLVtlcr0CQna*^Z4WzGDV@bfy
zsd(YO*BeqE^|RJ4ZFwGKht9hHip!A_sV_}Rfjsc!eWWv8bUYiyaS1r%*efFRx~Hp^
z1D|d|>GzGx&uu?XVR<;CO{JTL8J~@qjehMxy(GWz!{Qpl?p0~$w{4E+CLfrxy@l#t
zkZ11}nPpv4FG9((1%pM{ZBmh6sC(BMvJCC7$yee(f*WH_-MJo7GT-dxE{!MpRUek>
zY#}Yi-91JSA=Z!=PizS_E110R!wk_`vr5mmk8U5hrQdRd705myZoW;p39c<_9u6Ms
zlF^qLK8)gz(OnIVCM&1M#p(_ji9arz&FncR+?#vaz+zm6OX_(6@5f1IjG_3GJJz~$
zM1Q=@IGuj-6>1duV}84`<r7&pHibD7!6@L64d@-05|%Uz=1=Xp^q67i%Is@dkY>3*
z8!#{Bj!9bPEcmQFFP&C9FEsY<#af_)tJ@29XKb9$bF;(L`#1WrgI$wKC<@-FG0iQ&
zAwZPTQeSTIj+boGQF%<;i!jFfJ}<iJOKu2#VUc|%`^%A?R`8&(DH+w}AZz&dXjY1o
z(xc(BD8oA6)9J!!z{4fv_YN8H5<u4u2KWS~fC`m!S8D%5iohP$?*_tNyw_$za7PK9
z9`sTd8pyDE8@LJnw!=rtc1TPK*pr)l>v*)}w!WiXqBQY@J~V~g?3*+hmIx%02*Z*h
z$KQa{=+l+TO(9C=k0Y6sk^N-vK*5w^DLbYH%aJ4nuXH>c|EMfno)qCVhB|AijMpw^
zcQc;7Jt6*u{jGA`;w(%x`&2PT(mmH{1lV&&9HJ=twx5v-7hOK7?_n#2S=?kd+al&v
zaek&00nE0uZ?33r?-U4aE*vz{wnQH`ew3RxKl&r{GFnH`NMNI38n0r)cTV)afqn|_
zscytcZkBH$p`mT&_faWQ^XDGUg49OtxL^DFC|A8-2Ul6y(OeIDTVveSs+)I6K0>L(
z?9_m{_aiR*!+=SfFIffRgjv2@2EQsC(>`z@fJm1GEKk$bJD;xF>&J{zlajtcR$q21
zS(KWN3AVLWqy?&&;zVkYhN{|-$wd9U(aeX--jB=mrzN)(BIhRMe3(*ZuB<bC9OrEn
zGGmjs6};~|0?XEqXY<@S&Ss0r{8h~Sq%71CT9<8RXrX~(`SnArULEU)mSudPpW|g&
zRaHzl4m^2yr~hqrNYcLV9<^NO*<Gd6xel&=R?(#t-P=H-`ce!GK~?n8$eZem?{5*6
z^rONTTxsDIYa<<7QM!CYpG<#KOvm;u6)@pX=Z|gvbOaj8D_!lTQ?OXk2K^DRbZ?{~
zSvEUjDOfE!>i*wm>-XzM57flJ^@Bk_?#0gpKl#1^XG)h?*$RZp0CI)|3<U%h?#P^g
z``ea1KE~*h=4@j2kB9x70+NeE#5yf##rvj?Ebb_`fAjOqM%p`8xd8$s#28%Nb)&81
zX+`lpR1EuI9QzLFEzt-Hzo{dIyntFQtE0>hEVR%ctw?Df7EOX4DYrNnJ|%B1F@NdW
zTVgp(yiwn&uVtrel>X%}5yFr5&|1FPz{}czNK^)M3<NmsOr`Zbh+7W>^@KlomOZ0B
zJ%@OB{eW{SWcpTKaj?IhQBv`(+{(wuRo_~YT=&b&+xzcKZ<VhAYdh+~1tdbjwXrf+
zn<oAnk{(|08ybdC1e;BGWGB*a3-4?gXUdDZS!O~y!p&r_;rlja7X6fEx0q&-S+CiF
zfhz$vKo_I*4vX(4gF7JaaGYscS{yrwcC|w*iJzcxM9Y)e<eyr5cFt_>{?^60-`5tB
zoHM(wJNJE}HA$S4@3!DPl1@465j5(&tbM_cu5GNX{=u%@xwtzQWy%dCb~P4wOh^$^
z_K6Y2oXkH=s_RY<Kzk1jbsDj1ZqL4nU7=Nof_(1f=3OkfAbpe}C%!v40X05!Jv`I8
z$k#jo&%f{+n}S^%DS3!oO<bZ}Kz+@yqo@xg98-Fm8jB06$(b3LVi;_9%xAwJR^T+O
zL2~&Iti0B|p_Wo2ZOe-Gmmk;1LcY_*pOhW#s>Y6}ttf^}WiP%16a{{k(frkKawzHC
zy?b~DUv>J`=>>O!svj{9b5P|1yhCZAQCZS=0#~-3)+8!mNDb}F-p4m9xA8X}?m4Dp
zE8?#okcrdV?{x!qU?pz<;C-Ey4CIp1xkzZ{AL}0FJYZk{vCHP(HOGZ&VZS>voo5bf
z09p8({+mLH^gE(J^!{1>z9g*yeu7I!ZJdyuA8XPq-+MI2SerYaaB>kH_Suq>g(3IY
zeR!39tIVYSgSTQ%)lDEk9HP|453!+rThueGB4IVf%{6Xgm_PVb_75a?HfJ^D_GBd|
zNM!$)Lhbz_I|&2;^zV1VzWB0{_tH(RhS^I?y!+&-Yimng<hSZ7F=DgNj)QpRjaa+y
z$yy2Z?F6~mC-)?`ajvSKw;Q*9kH2pK>hV9hsx_<xMc%=-k;Fav%R7N~jJe&nu5aZ*
zXch2zj_wad;s-7FM%{L^Lr&$+E~`xT$4s`u*&I`6+T(=|HEFFot_gz$DVH{VfI4I>
z&rSU-hUst;FJHQ*P{;n-;_;}b(ItfkkI=ut-kSKq{RJ%?PVGlfAOd2d>qyj3N~KmU
zefffGhqdNXhR92V0PsPHLxn8DyP7cOU~MN_3DP;oMm(fH#x$@n=Ijq#B)`2HYewtH
zy$t?nedM>J*fPJB8*4ocwLY(uG##~{&E;X{`GVL{C|_pP%Kc_+fCRHC(8=eT=WD26
zpOR5yLpuhnhYhW=fB;S6?Fg)#l%j*1Z<nvfi0$m*Slfuozmwl~-jzT`4Xu~$d0Qk`
zOR`eV-)ZE&h7{DxRadH&Oo^@rurAdL&4Jk?K`uN0W06fy|CAi(9zg(vcwnE%<@_a=
zQk4YuZ5#WqVJ!i`@cZTxTuhNPW=HeD9&*Nccc2SpKK8n<AY3~g%mMO67t;#p@gj1g
z-hM{`c(FO6vD&R;|JfgV&+5G4=mObSLzz0MLz(qXUhtd8A@DWp1w~h8q5Zj!kxbJw
zcmdtXRM~0iy_I=aYA6c1kiX*cX5joWi|22J*j3LtXv&CRJR)D;x?lCOYGo*?VJdcD
zTUq#@RSD~}LHy=f-pwSi1CNDV8;uTlaxt7=ZE~)sr(9D1<MO=07cwh()Thz%jmm!0
zeGq=<E+5)wVM=kwjzCRmZovw<cb=kdl#mfid+tNtg<0qoyUwl<IhqDh2mNvooX<&b
zEVQ-n-@D`hb&EPVMT-zx>o%wxAFu~MQZ&lJ7<>z~9Kl2@A>}lJo}%X0#Eida6507$
z)0iSAXTUf?1r{(`^eh^GI=EHb$ymv$xAAyBdN<(K=ytmav>Y5;Y3ZKIX5Z%-SY|Uc
za`=^Iy8gP{yE2=p`<s3mo!XTs)ng&oqj+6Fi+L|JQKB0rs^;KFQ(R+#Yv<32aq3V8
zgW6-D)Q0I=!sxuHj@inBD$yRNag0xz*foUBxKSAbbJI^e{PW4h`(~RlleRZ4f(yVr
z(HA))>p}2(U@ZzG&gAb?cKCTS>nY^jx2?adqLo)sFKX74VrmBO&{B))_908U^#`2O
zDup%=N+LHypFAJW#e7qG*|Ah(%g%$acbT7U2QtDtRxW_2PWe5VMoid?F^tO*3`pf=
z6;z}7eY<Po;@S^CE9#z{C*!d|hmpFN`$kEKI8%?Vr?I<`q0sZ}6gaP6*cC^(TNk4A
z2HDbBaxZ-Vnj!@`l^@&(Orad(voJ^B5z5)6Fx#M^Z%>O%zh41+{+XW~VqJghf&l1W
z*L+4C?mM0f7`4ETo$==mrTqAF6{Zt~*4y6O9JpRC=On|pGbWe9Eee5X`hBUgno>V1
zF@Mg%LVGWFdD0{J+?>l3#j$lA<STY_o4)Z^L=C!vLH^|<8M7GcKCEu~{nl8?^Q5X7
z3xZDK^3vGpOoi>aaT5c_7j50IhskOjfh}sB5_}n=%l(d;l8lqJ%d*jJu2*8YJVKoE
zzK`9_Yb8nU4?D=?F+dI<p<@>5Ck48PEe%$BehPA9x7Kbl>2V>m8Z7y`>MUcHCQ*qD
z(QWT}7F6)KM_l^Fg7O%@a0p%Hcia2Hq+~#<0vr4SN8(`TEqe7U?7g1+%&lbyeK*`P
z)7S>`jZN4Uw$_c!lpznUCVvI!UhEz8rYic5n^^S+&-%}L-*fCg<rjGFC}~C_N2LIE
zO>~;UK`9k47M#H~e$^XjX@E(5#b@b`8+a_Wlx-?93Rrg-YXK#a&%LBSEfHR@p02x%
z&2TS9dFi4+s=oM3Tx&Z}oVL}^A3S$ehxP&4s0$qjEF0EU?h)S*IV0C9ox3Ri#3#0G
z-}2uND{@p-o|+PSOBy#Hos=^2)_K_F#yVHoqZp)P^eN@Ks*iW9W_#Z)*?n_NeMBrT
zZ^fDs_l8Qujpb?M3Eyno%alKK&7Ty{TnMQEpD@Brz4M1C0tO7}9ljt&zpa(V$x>4_
zAhM24g<tu4plvtZu5EW3H0zG&6vskvyp2_GPgUnZ1=KUn+9-F$cWTCAc;v_>K-j2e
zL8IR8TZ=kT1^C9z>*d7Z0Dky+r{xFohG}A~DgKk=E?wqAKV~PPpe8@2`X<DiEJ&QD
z;A1+1=dUiZ<!c^HSqN^d)uE9}m=Q9s+2mEmZ2xoZJB7SF(&tI{&vmzM{m%8cStc;~
z^g%_#at)>S?tBWfi(kgy-PiWO{Hr#kqe+;OrezTVo5emt4m`-R4kKVvDI}0X4D9VC
zBV;|cM@x*ctG1)%fZ=Ce2-<0qO@F$EsGhyg)1$Qedz6P!JX^udhn;@{(Xp0thvm{s
zYrO)WKjc)34L;-FR%0vuta~KPPaS+R3Y}5z54j&KCY7;VPKHjmXx&y1fPhgAzNL=F
zvci~5J3>h)_WQkc1NT4+i>S5L;jlIFtC;pT(Ly0v;g|nIk+uJ}^^|wCjp;-w^-7Xz
zJ=SSYtV*$IrGE7DBVX>D>grm*2-3GyP?+XxB}L%gg4+EI+Uj1ttKj#BoV4i9Sd{Co
z(t9QSgN@VuS{7Vcz*wLIXjJsGuRF=53)Q){#6+ef)`Hz!-rut3raCMu=L9=SeRpdq
zQW^El(8k`(y2GwVRVQt7ZxZhNl%X%5!Ak^U0BMQ2gJzM0{nh!`gfY#9g6i6lY2gvw
zDC@Dax6fPneLdChMb6`~Q!lB#Pd@Oor3dRmS9pZ0(GaB9Xh;{w<_6o1Sk6km-@5d=
z3Up6=#7cT*tC88~ng@?0%fkxjQygNx$&NR%m{--<o6dT2>eAYAy+%ESEO*zQ=@}-Y
zv3mzyIM4HTS8|p-C6ruoz=pMFt+5W`IwWPrCnuGVUDl=`V{%8L6~Tk3i*np$U^9KD
zs#%~g6!xsM_iespi-P%s?S?sh$PXId%wx@pgZV=qdvn67o?lI#oz9w$9vHOpI>PaU
zfConXPE(y#?~jX!<v%st%{uD(%ddaQ`9lb!1&d$1f3@ZT1ZOH=Y&sXZQt`LnbI;<|
zk;w*?m{q%P%$F~?fx<=hpR)@QZ-iGGUhjN1yq;TfBYr^(H<wUQmSYt*coSu`tkFvv
zPl+ytD=jLlY_(X-^6uFPYo{kluz1b&x^vrsWVGH~)fG`74VSwj3Zw$U{C2zs;AL~}
zNcZ7OI*y}UnFsq@O1gzG3pH3oxqDff4#-G=$zZ#3%<R)_+j|e-1HBeM$bc3<?weJK
zmN4^<TkMS)0*P7J=((32Bjk#x88r07WypIE$%;KcUEWjuYTeC)N*&TP^u8ovhzos>
zcL!S?&0|{~|6q)5bRe54i@9%${NYAPt)$F3Mu=J9Pmi0C9ZP9}b;XM^{ini70#f%R
znVujkEBt*b0?}Oz&qydPQ0-3g4j%-xxI#>V4&+{k8zX2;)L5X{&+s$yPE3kD`P2!|
z`({3FA*G$dWdz9M`a)oL`8G?a#S3eLUSW;;Im~ErTkr>x#Xfzn*%2TsbiBNrn6)+2
zUL@rUKC%atBY1k$IsdfyvmoAA3-XyYK4B@^DP)TSoaxg-ye!!YUZ|UUQaZ(`bhUp-
zw$7mjWO1j^jqRA_@P_iT>F-op*=|kLiaM-C4L#_7`+ah5(1^lr@slUJj2wy@I?~&5
z#@))OLKov3ey<pz%{XNGP^@nNX<yrB?~V}<c2^j(R6zFH|H=x7>XB}XRL?)XLz6pb
z;7Z4dMeKB~CFe%zMQ1I)ody5i&c+3An+4~A5;F^JMYwvydX@bKbnqfJop9a^H{e4;
zXqSg|-cvmOx*F&ST{zpA<-Tasf;Zz#2Qcx60*Y#sX4^i3oixnM)ds{a4$Fxgda$2$
zZmLyoh%FNOTp|W9T<N;@lQY>c@U540{#4A6Us4RzPrJ9?y2Xm5rN1X$hc<!Y!Pa^|
zCaG=JW5z03waCnjWPaItzHW2*TMm(8lGLS0o78Jt3I@F`l-~8*S?BZSOiL+Db`D-+
z{$`prkcc6%v+>8C4Ne&6y5Nt^NT7tMOA~Q1rt_Ge_b%lwYj-I#$3&G{C~M$4e*%C3
z-9<SuUM?qVh4#uWX7QF<%pay9CiDaYV*)KuryVJ&aQn#`mt0ddlXjD{W+LbvjX2B&
zMM6Gv@e!i-tp_D&787BQRDJQS<*l0A^stdi<WOw`5i9V$h>!Eua$n7KTx&fhZS}>E
z#Xk%<=`P%k;Ma4^&ZX*}-Sf@}HQuE#EgW&)yJnAif|j1mvz0&dgd3(woB(@vx(&!D
z&;~Rgez@&4<^HMKcdhf0IBvUkEaA)%@FMx6UokV#IP<Ihw?8$zylDKh$5-uQR32%V
zj8#4ja;Kk)Ds;n2;`C6mbX3h)2vdxg^a`z1QFQC@UEXJu@RoX#1zFOLei!LiHT2E7
z%=<m0o27ah5SA4lg{S&M4$GlYpSAg>hriumnyDG(!mq|`uW-JP<X*?XJ2nSZ2xI5<
zF7Ue8PwO=!f}_Yrxfn%1Pq}Cu{`6(6rHQ;7*HTmvX-){&&UE0u_!2r$<r-1p`7@*2
zg%u8GDg+YSAIe<SVJ}Qm!t!UDk^(W25>66@9t(R*`HKeA+0)qTvyI`4gDzL_v=?{1
zto37FAYibQc)75m$RgO6qv><>Co7+p_j38)xJ$*1=ER9hI+;Dam9_C-bMH9mN+40(
z_p+{Q9c_1?9na0`h&<LaC6sF6GcXhv3sb!^pNr(M87+h{w}(6ItC)80e&~)BUfchS
zp^`-ab+N2$YQFHY=NH45pME@o3T^r<l|S7<Fo?U`f&|#Y>p>##k}vZ>O9+z=RUkc}
z|623!N4_~{yg&^6_~T^+s$k-h&*G5Ikb*&)?Zhc#oaL7v-GUFMNK(G^#rwwNA7lE!
zQl`gvJl77!<?nu0nb{VunWoNc#feDI09UFRtT9^Nw`g9>szo$f_uP}~%YN>dQU0x}
z1l01`HP(f?TMsUcTq7=Xk|L`{je7?kj(_AoBaGEjz?wZ{r2e*;GzIg>P{L4_iTw);
z=X?CbLz}x+A6}+6bg;gd>j_6#>UZid#25ql-t@_apJ?BeyE2_G8N-V^0L05T5Gw##
za1C0szN6fLHgM(G!TkPp3s2zx^NCl^xAOPH${bao>^CyY<>S`tET9sxLzCimQI0pE
zzxD#h+=6eNw0`Z&)SSO?RW*7vQ%bLytNn-<p`IJv;;aArFeF*(!SV_HH(noYtlr-q
z_%ij@AJWmRh1%VE`(ESq6wy<7h0f$`&{Bw1bWoBq#mikf<FL49i5mv4y32j%ng`1^
z5I+4~mB?LwdZ(wRAt}-xX$DuE;W@VjZFTL5kBP*KJ{dJwEderJ8isEO3`eVUETWY1
z&eo8_-KX}-y7olPHa-%+LPNX#p<4fw{>PK&g)W}GnE=?pjLO7aM0s+p;%y4`pst4l
zJ_0aPUxv%dg;E+vw?`tpOs(Xa&lTajUiHFv4N$o<Rj%t1qGEO4GetbWELiq^R&L6?
z@0@fF5xU@XW94BS4@3ZCMqE!Pyn<m1doE@a=SWABpU-4nbdu+V7gd>Gp3uzZm)cre
z&IwzE>5D$A(R&1Pve^H}1fzW@?ymg<m$E;!kh|4Qu=v-6ee)RM5{J=>oRGXbX3Co(
zv$RHKoRW>Tw37f)&RB5wmWJGS0j7dGV{_?r=5%-JrHCnTs%r-V)`)piqvwR|F{We`
zMpNy$5Z-Xt6s5*#InwM6rai($hxWads>8*h?e{Cn?&%-I|FC1F+Wci2?v-hM)?<v;
za9XLB>lJZ7wQ0xre_s#TJO@;6U>I+}9f=D3gjH7VEU{by6r}}wrh8PfO`Fn{Kigsg
zHoXV;8AV-3(x!M6`eixx>hzwtN}_{p;t`4G7yDwkFHa)oa}0Lntf&^vQST&XF87--
zw+>zT>e=jIgbTH1uW(c;-5g+NM^we#wmJHHQkL8xBZNzrR}ce_1}o2pOC<hOu3}~$
zo1B(8p%VyEtYR}El%~Ww#po1H1?s1%Pk9ka|0wnPV+(|<fa$R<=h=BB#AjqN{tg<1
znXT+w>Dp&r-rb&(I6JcAqm*CJ!CPy3YLg7;L#44lue>3VP<QbHo-if!i+Nl3c&lDa
zlbGPUo({=P?Tl=KT<Q^C*TE|i{AXymV(USpXHm~5umaLHA2XQIkjqFles;PabMS^$
za<}~L#N#MFLzS3qEIQq<4Bj$?vGHhv7|~b*>Ye2lNN)aR%7EhVLZM~twziA(g{be|
zo;N!`_8a}E0;oNE5uvv)OD49Tqq0^P^<~=4Phm=)Wx`FcG>!?h^IRH;_V5k=)&)m*
z&2lxd*~Z&W7RD@u8slU18RrVB;VXjGNY#etsx34v>9^J-1&nXYZXfC-?P4l^kAgKx
zz8uJ13O1hL52(#Hl5BlK4@7a6M~+*J&7T3=$10+}+eMki`Eu{J)w^HeFOJO;^Zxwi
z*dx>5=waI)X8VPr?=o2eUmMY~ZZOUwMh_$`U<$~kv(`NjQA_bpc`qVHDMiP=yFYr7
zf6biHqAcJRjN%7|O-(qvb*&3;{vAuKUu*w7n(#e}pF8T3KJeRU-m4xjJN>?(#n=2a
zRGt$nv?{$7H)95#Z(z(dRE$V1Spqmie-~l?aS$J9d;YJD>QkBd)%v!ouB=_FRV!Bs
z(paYk4sj*#k`yUUMYiFs)r)q;?~mKFTdCqS*$83Xw|(S!>U@~pckg-ld_nTzC9J<?
zAh9~n?)%gEgE{0z?e;&D_DD44A#|rpL?l|}E*x&4s|`##CXP8)P{k7?Yeiv=c~8it
z?7guN+qb7asbgPo!eq5i1j0g^Y3+93#|zfZRtC&c-W+<lx?;Hel^zI`?^$bi*~fmW
z{En(zk-4KIr*ZzIrF8f?+p!n1gg#@VDyZ|KbGnl+ysu`>&DPL|yXyjSF8!ePnG^=@
z<OS=mwDkS^aTX*$bmN)CFo*eySQlPb3`tZXBPn!_p3&yv*&ew@E&F01uN=%th3@GB
zjb$0yKr`60$v}B4u*RidRi7(;+;-6Tg2OF_1T5-U&o!$NH(l!n7g*lHx7H*@8MV0r
zJ!}K*{x@=(kdL<!Mn6%#{cNSdSay%B7wKH%Sws*`7Jj2>c>%nfOqc2SBp=AYpOEnD
zAx52&^}YS`yJz$=^z3mU6_7Y#E;fFXTN2GUwxj0x^m-;ncnEA*fu9_(`(Urgwg8ol
zWcG34e~)iaBLQNDPyjUTQi8w1sZk5NXD8QdNjwdMw5p~ca^y2UD5H!W1?$_WbbDKX
zLhgLf|LcZZO!1ipEWtLd{Uf19lD4_>-!OkR8s=Q@5!&#a#>}>Bdl|`G&)-9<RW=3u
zPD)FE@_&9u0lLw(23@#*6Ad}?B`Q!(y?5RD_F?r#jm@_okL%vlZ1W6Ce2Se@`*&ZZ
zBt;k~IP1Z$OkV(Zl=g|3PGnc#IkaihN$QO&m+l8<ExErL$Svr3pq2bHL{|zuGeG#K
z?-bQKpWSX!Y1DM+n);sr6CcfHnO2Pl@~-%7g^mYqdw$6lD9}0#V<!hF3Xbnz=TKV3
zux<ljm5;zu$vDH8G6l$-K#j*6fQxwhDdK0znz}E2LJ~h}G(*C>?jD&wP^Nv@%=67a
zwBpg|Cof&3rp~gUhxw@($BKp<eNa&z-Yif(+G_nZ%Lt*g`(JZvfG)Kn@k!;G;497R
zrP~+x=K?i208di4Y#Fe}g`khH5_7xDh@w@Bzo#DCAl&ElShGY0(oIk<a+Dw?x6VoU
z;58`8=xb+KTP)ZjCW3jz{rt9$V|whgLf!{2E)b0})S`xgmjY07n{SvEc>vUp^gnd~
za>L>Y<C(tPMa^u)Iv0QWNM`}31|SgDDY5S<DI&82Bp4Bpx!3E^mTHNA4`SXd3sjj|
z0zNE$E7hw|$i3Svabq<0p#0^M1D6+`n6Hhjmmy9#ri&_z3hg|-t~4KhSp8ig_+wjE
z{#UcnEy=LCJ^ya#lZ72OlqLNQm^XI~+6|)_^peZg*#W;-jT=Q;0LjRAB>bL9^72XF
zs(-%;z>~ao0Xy}_r=~voK1iG_V%1%BHCv@!RWD7Xueu0>R;18I8##1V99dS^BP7t`
zgPAVwUR~Qy*~zWJxNM$!ZL>CIlPC&+`a0Fz#VcdaF{Rea^2heC3q=7nO|atJz2ZE|
zgs81_?=v^~8vgLDzjSW#7|W%?WenO4U8C%w1?KZ2GEqC&i1Hmyr#ARM=QoOCS2km`
z(|ZHg0uTYpe<fQ>?A%n<ytv)3#$0>LxEOp@_Wp_A1~1z$3IT0T{GKu9k~jPB_@p*2
z*(J{cu$cfxTS_~?Hgq;NQ3zjC+*GX&tUdfn9bb40<%gi6K)Ady#w?Nq6u3Do(aZ~c
z#28_O#O=u9gQyINozJ|0dN}An?nrL!;(7y*U-iRtqB^mIcSQoA0Ep0OX9z&b|8Kc=
z$>;wXa9XU4cmG?35`PmpZp4OfX+_$6)_-8|iQmwZ@;QuIVEJdcf`h<qHma-|0La3R
zjKUa$ROmcRq(%G6Wzm1=xAm8xd6u?gFoq2nNQ`$7fXJU$#U8|L++xrgvAFwS%`U;c
z3bNgQ9`t1OKC>rxl2L!o95CdbblpGANJYZe`9qP<o{P-G*NaLQ0Rqtme9m2BBYBb*
z=<<2^ViW6tp!1<%6B)>zyzKQs^X2k+LoWp({Ce~`YxfP_53k*(f|8CQ69n%De#AFx
zq;Aa(r?ru6@Fz`_(_D#|ex#lUT5O1zjmlu#0(8Tf!CWB8qv;f|u)^eb%An^9(-Us$
z3ey@e3+=Tx(My;=IU^gbIYj-e$s5py2R62YVvI=uzc3y=%LSqjk1Qp|$D~K|I6$5T
zK!2C`Bz;=t4~e)`(ecrP386#d;$y4}0G2%0j1Kr2i^1?5Af3n8tXzjJ1ic>&a(y$<
zuTQ=jU;LOn=%>tBj?3*C+vMNW&OF6)6PGOCk#GOkS^+AiKrE}Lx>DQu)c|$$(!Xz(
z@HeSp*d4ebjQ7I`Q|WK-Q1VKqq_7)Yy0IiN6K+atA-qB?Z$sXf$ShoH0p$Jmb$Rc(
zeeS-OU3;7K2lq0d?}QhyLp&hY1h8xyE+4X!EDHOTM!4S7Bd0siFmWIkL;bf`7_-BH
z{vueN|3nWJ=6niaJh50%P|ZC6&VCKbnGh{07V#Qb0^k)UTFSLACmfG4&^*82)`2pB
z9CRL9mxF5MMWk<@2EXtxJ<FmTAXGiyYdjmATJTuo7ZT6uEs(qL?~!;X7S<JQHlS$N
zIha@ZYC#ekdiH!KMnlE-o!ohI32Jk`XBV`5hu3Audfo2J!vG`W5-L-R{AFfKj?mxn
zO90-nH9-7dc%kwO-~K=FLWU4P5-U#y8UJZjC+{=>gN|dLuNnXkG924_I$T|@I|*pq
z@*5=cDta8IiCX{SNkbkFp?`hx^@R9pg*{r$kDY~fjE{?d{~zhIy<gY0az1_~4fC9&
z;4EDHoSX1V4oL7H)Ixz+NXDP$!|TY7QE__mG_VxjZbVT;+%vU0jEA45tW(!30nDhV
z#QSRS#Z5qxTV|Im@MksVt$ur*mS5<lu61Qo&#^Uu1_7_a4#daf<X0s4HBc{>t@4{<
zpaNA|W+fg-)jz#!{hK$H?0$B0jAeB*rr5J92~G+F+&G@+m1;M^o3ZVm71sLqu(4-&
zAJb5|^O0tOh4Ft0Ku_o(&L1{o%Dq>ctf{H_XL&{_fY&kqn@(=4J@#ay_;V>{T-S0f
zVp>pBnO713W~FfEblCAoXpqi%Lr|X9qP{~i(Pw9c{V8&_Bz(ks)E3aj$Y0tRs7vEX
zbMZ<Q?JpF{dLI200yyeZE*%f`7qtMk&N{DS_{G0aKgmGLrNF4I7o`3p(M9d}D=E$o
zJfI;Yxp9p#>4UH`-b+1A6_zY_2U4^uSSJO&q_JF`n@932u&;Lr897i~=s0R)vGCF5
z7>2*K3e$mXDkrSVg!Zr22Rg$n4_fz+XjWM&UnG2MXliW$ghHsKr)>Ry6$&C7LSfhc
zh;P{t3LV@ZF|$tEsQWT6Eecn&9+YfIg`rF&vBGgRjGt1KSqj>a+W!d^(V4NVjg2k*
z^yxS$zi5P<F5x)*3r=hxMs5vT??1#jb3QV9CG`w<69A@uzJEJ@JUCb8KTtOGQdwQ;
zQ|HTm0z~1L{L4U>1%rU@-N<t>AYh6DlnpD1E@;~ls1^ih)$%M>`44-0+p~Ym169Yf
z>;Jv>HZrmYYQ*l#P3=89v`#FOUe7XEBm-IX@7gos5(3VZ=3Zx~d>U={g*%$BY(hWx
zezVa`VpR;v3J2@_vLzy0?@GX^bq4GJ{^Nr+8Y$-dGV_K@fM0c;F%Bz1-;n_(E6~t)
z5=5B>jVo$DkV$8(<DdY#4&RMZr{x~bf1J>&QCh=SHxNj}&B5=!C9Mj3%KAS1f9J@9
zvp-Y;8=`#THbQ&z0qtsecHJhRJI7;*8Re5qts+sboj7Ve>%o!<1g(K~zJzmX)lMm*
zZC%37jyu}xU#y5YaTD@{0DHjq@rKAOAkpKlmb)SVOIpozq_T2Dazs7Z#IZeCuhH5Y
z<npk5{!%o*)HBgj_Nv}A7_haB)|ml+>kr1pR003*rV1b{Td3!g)HB7avBRuL$<d7s
zL#tj@_l{zp8vvfZixagWFpY#E&(r}t!LD^3vi~g5I<(CK5GDWJc}HtA0DJ<98hF<i
z0ghj|<d*;Y&v$O}XIx5N-_oZdeBUYw`8RDKzqHt#z<SNhSOY`OpXh_uDo<yQ<kmZG
z1auXVT_T|I06lm$S#|lY%z?{5$B7tsF~2(Vyn*3{#0@S!#zg|T7y3vS3UE^-0dovb
zv9?&}e2M?3flW`vO#A#iz=(VbTc_a=ib<U|>kY;<!qz1tkVkS#+<d>|y5Dh0qgQm^
zPy836JMD1W-yITk&mbK7!Q(JXmheUom;(Sv_NV&#^aadx^gZ*z=xeK~cN-ks%P$~b
zZsG+3bfK>zX~($Fc0hp)C!!>NoN$n<r;LIFjhBe|7TF+bH$d&t9BQu^x8=p2vIB7~
zN29H-y2v8$H=u9Q!Q>Kv>!j@ee~CRn1IG6z+4sR&{wa0ftNU(L>DX)0$5YQIgHC-J
z5&w(bhj2Ck&8w?(#H)e{8we36n${8$pMa_c+LJ$8{F-2Px1;2>OVbzG7{JbBR-hp4
zI9;H{fn|)^VA?tWhbr*^r46;3+NG3-TC5V`fCqO0>>T1C@+`gMOnD*c&d_?(EMU9(
zYf@YYlWYU_769GgKb|bXNO}B2qviatsi~vKMo-=_cqXl=s2KEU+vL@w1v2;dCr69_
zcIor|3U~k4WskS+9=U$;nBn!`@}68(pMQ1j(Ei0okNtP<PTAUf=tMzO+?_AS6>ndT
z_j7E&Ez!}M&;Xu_wd9zNP$$t>V+Sok=qjoozJq{A2|_n*{_W7q^&h8qZeF|1n^A|0
zx_a*r7TS_~>G3HKNc2=iz2eHwEjurc-`s4lYJm?^vdB&ZuHLq}!56BbrKMH%sgNr&
z_jJZ}O8uU&h1%sYr(F#pGeeW{o4v;mODy<<=z)#ZM5KvX?zC@E>3K)hjiZM!%#l%9
zGNp+lfNm}7tkp+I?lhERx>^`t9E^q1Aa!12-nFzbFuD@jNH27Sly)FI8&?O+Az<Y6
z9)WSiT0Nw$0ZPlgM2+XnO4dT1whJ0L$sIA&DS{cVoQmX|eLm>b29f2Pta&X)_?(8w
z1unhXv|0YRbE`}0KFqa)djrG%_1!mKz`uTMkEk}laPO_ogHfrhN+!gxg5$uHSlubR
zXY+517so*uLDi%epItf$aVp2LeljZ&fx2>nT&^2@CTW+@7Pi9a<1nX`C^>>Vl(XyN
z<H0RRVizX}jTdN4)jyv!fP6e}vllElZg(rsv2x7A@AS`katYKt!k_iW4Zn8cWgX&W
z#7gaH?wt1aDebvnb_zZnOgRH`q9S?voHq$gLuXt)u@~sxQ%9y!x<Z0=81uNj7}la*
z9a_f|wb~2QE-IJ|>JT=8dO?c_Gz0?GfEV;)7n(w<XqP4Sfsm6q0W-`z)HZ>3IT7Ro
zqODQLSJ;z>*pqpj6`>@sg4ly3<XP=XZAZCSQNcNF{w?p(twLMsZ;uB+S<#aNNpRMQ
zshvtXp;}5|azenw*z{k2960EYgHIJs%A;1-Cb=e(bz}i?Bp8Gw;%j76h5y*(zw{fo
z)(y88#EYK|_9G|lLs8twC*<(tks`mxFy<sCsoL++mYs8<)q~oVzxT#ils@3rTOdD6
z>pGU<c);wtwOM_+G>bKb@u~18`um|>U*_lMQ-h-jtk#UaRT}+PXYeO~wJdzZN8R2E
z2+qi$@R6J?iZ_zYioEf#BMRQwP`7U^LSii(-GX~c8}GO|4AI7w88H{|Rb@t~1sE^U
zkvGpt6RNam(+S52PkUf&8w1(nfwY=jr1#7aZvS*M%n9!TTOA=IzIao*I5CDu&7b&q
zZ4Sl0k4CF3L<#0N72D}+P%4ygia$=~mwT@*(kBN9Jm*z^khk8x&)Q>VmCo6t&^=1+
zZ9J+adOxh5s7LnlW<Fe#@kMCh*;LGDw*3H=8q2bqu!afX-eoj1JU)-Xv(@1|_2$0O
zhMR2Jc|gh^T`@Z`X<H@mp1KB%%Be#;B>(GxYz)!?F@FL(3%noWH*e!n0_C&fgP2IB
za2*putDmg-w0#;_AGJqUCe=HF1wmyz4!H6j7ihU+E=w$zE4#~`fI)Oxg_ku>^5-{A
z*#NhO_-A;tGxx0eW=pf<&xCP*2$IY^)HypZK7P4HP7vk<=Fee4;AMPPLbFeTp4w_g
z(gkUPX^^1tjZw7itK4Oa)}3aR5Ren9J-N>I0*rEZAO=X7rf>5F7@xsNEq5qoztgHA
z97LhSR~zF>AAlAvBht|sYyJb?p#$Cy&&^dGWq!=w#r@<PuF|S19&*>JD)0YUWl?(Q
zWp(3kkpgqN*s2510x_9W2XV3f&3vBE%z8ksVz95S(x6q<Q2CaG+N+!VfBu&3TSj|4
z!YOmX6RP%2HKGOfA@Uftuu<iG%b^#cTW*37hw4Lth4Xn*-0P=D@4Eb8Uzi2xW&b?;
zHKaBR_&>7husQ<QRqlY(zK%+GmiKf&Nr5_Cd1p)gwQ+wxvWlGF%GhN2B#Mk`2&iM$
zpLDRquXKFsNV3%3<bQs%0o8rP-W0zCHHR0ntS*FwocZEHJS!y#y(ri+qvLB3B10G=
zl(=|$dYbF6X20uI3jcG!Q8QPe=r%LIitjL}62=<uVVF!(?ipU2Q{V@}iUU_8(3btW
z4<Z*n#CRK9G#^`Fy_8@*?$&wNV`3Jf9;%MMFczuq^HH5FK*$-!t*|hG4`9Q!REiFn
z3Y<vj*es!kfy3jLo42o2+xd;}ZLivg>1GuDr9b{9K7Xl`fBN;b^ya+Do+V(JTHzC%
z&D$$*NMZLS-+?9iA9sJE^HJ*U-V+Zxv>kAl*TN;%I-SD$&}h1LMZG<6!YxPDgZD+z
z0+1Yk&HI51;ep;I77|lv!5M<&Jco_P<H#f}cKaDlSOq;^9brKjVA6SZeuF`<)Y#OS
zi@W|wO#S0$hkpMv2sS&tw_}0b?8H$<^qglJc|9*h^h_<{Y;PGIT+KQ|jBNf5kRiII
zKi;t4-MqfN2@u$qt&%&~oy@*tU}d~e#MG0iXk_JUC?CP7%b10&KMVo^t@3vqHIOFE
zJ}@BrVfk!8Hvf9eH0A&s-!UOCY{0L$^y^x|UN(Lo=Hv(m_5bmDkN<kT2@`!>hnAUb
zr|5js4_0SX9m^Y(mkE5Yr4H)Lj)hi}wMV?R2Y~3CjvWG46mjzt2g3Csm<|mwHf=U$
z7Sh9<imD?RSS;uvloy^Hpr?_kyTPm7ofQQda`X(HzS$HxhN@#H)8~zmw>81sm<yq&
z;d=*wPkV|bQDk4>4=m6liLOj<Drnd!Qs%AX*C-eune5`?EU*59viQeQ*yJB{F`MO%
z>`Isz^r+-V3@pc5n4w8=O|$$gRs3qTrH@F3c4L6{oH~LDLtp~E-vzQ6;j>PHYvC?O
zpr9WeY`m%L5hLyPDF>yV1xt9XI<Kk&7@p6Xi&Z;9KZXEDztN$y`r1H!7E_`&s=+6r
zA#mD7Nhek)@ZXpP|1hsp<pD+b6F=yA?J3VBpf;}5`gkJsiAYIoGyXGC=H>|F41Tap
zl8tvdbpU9wv^wKB_NN%`3|bGE3>zbV2Jxa5aSQ3y0xT;siNn@$TAsOGu_8^?xbd%P
z@Ch(h)Q#GN<o{_!{o`jFFD`FsJGe^d`8Db%+jCCwZb}WG)?Uoy$9BN)GPO2to|A5C
zY6Tqbno~!9J<VSag^&XPL>jUZ>0b2QF&K8NlE6d~I0!Nm_L*FaW9`kw9UV+K(C^_l
z*1`95Wc6+VOqQoFx_ma&X*=bFXj%^90>~wu7sxIT)Nw>r9Ute?4b&+LsAEEOEWchO
zH^QV;*3yw~hA<+iEq4M<t*V^M<<t?n1R&`}mQU<BgLnF{aY<--NV(@hueu;uG1$=7
z`weeFMy1%tV`PMiG(+cCA&x~5KbUZHWAwO0r82Mj@uz%{@tv5Fisyn%@<&k}?jGv`
zLm==k=}<Z@{_AF-uS1}O0lOq4gbAU)nC^g_Wfn0#HZD2s`0MEWf3F!af;UUK|9?oi
zm(`m#M2O^)>Uf;0&eWV`${>6DES;0n9$5fFPdkMG^R}_}=`mS)vfNuU2{v+MyN^ef
zW1v}aJDO^l&_x$l=Z_IZfk9#VNWflDUi0du>ZN+5Z0G)xb0l^dUMCTc&q(@fBB}d4
z1*(JhVSX${(Ohi|2k5yY>X3GR+$QA6^euB@+R<e5UcHd3vywh@3KAvET1WsI%GdtX
z_t+F@9^||o)EJu}D{pJ(2}pmRmglG2CjyZ0mwwREe9CHr1*r9Tr|8;CiLeRb3m@|>
ziKp6BoGASUW6_52puPPDr7v9G)qK@X5B&Dw;L2f8rttdo`Cpy>{=UiPtBSVcLr4B`
z9{=+?lt1*XVA4SUPHPl$a<0WXeMYs2;_E2M%u-+|=c<EjQSWzQe77E3y9>%PpAbck
zH%u@Bhm9)QMk*?`<@$?h$_V=sgdSqd7_q>a4l1sP{5pblu((lUiyEgvE+Cf)B@HDV
z8wc6F9`Q@NaIl?B;2l$HD>Y{O(nx^XikGt$^qH>KV2>u_7n-6ME<w@*Cs;3IyfYHE
zU?hFQMSU8d9|*%z-}PeIqq>OZh=WV=x)t~L+<`6JfTW3s#J^n#_$+61ykT|q1lmSz
z<pc<*Qy(pr=#9|4r|V^|yC&J&^O&S)2ronAY1S&W8}gzOS{xGUz8{!T+CR<D9a(a+
z7&=i(++W2oosfqfPI%`JFYqw}j3gb>Wi!fda1J`qCpLyd`_6459HwH|MGPK~L3}Np
z23}0y{Mse6EPD?~Wm!8v2j5rBHYCgkj8Zm(S2lycNW_h}a6SXWV}6-*%-sF~w=L1E
zc$T;5H2W5I`=Sm}o*(*^dIUr{3`(3ngV{Uifxg_=@tN<4-+{9DnZ?O|OV0s}xdqEg
z70Q0P%O`d<{j}+H(eXnTlr&tLcz-dVd1!Y*t_ofVqKfzl6d)ap#Yrag&pJDRPmdV|
zHa?KPg(qgs!hyv<n>T52@akI^{C9&d1==NrB(vfM(BQ_dshp^9PP}Sf#4PZ=3+7}?
zBB~JDU)p<zbV#?7h&Pf#+}?IO1-c%rXbc8UI1zE(>hY4B9q&mM?^0rhsz<$QMVSR|
z^8IW$q2aI91uKX3De2VNX9q#f|JPwIqJ{%ETA236j~_D+VlGgF*R@b<OHGOLoyJ-k
zrJCxRlZ!PPSPSZ1f1k$U4SvwX4vk*6%z}$}V*FIr?~Q1D3hs+IZJ*A8K#2sbO9J*>
zFm)O}pKmO#MITDrhe-*_+!qfls^@X2)SGg|OLD!!5&-Mve|uK1Xy3uHBHg|oNi{;c
zd5v%!*jfyWHYpJN$G(3(?KT<z$xlAlDcbI)%idFnR?Qf|@+)5S)ItQL`*!v&DBQTU
z<lzI+Zg4aHsofw7uND;p5m6ap9-mddOVe)X0FmEMxe}D93^$M5_Izm??|1fNyE?2!
z$1X<j!+G2OGKxVZ3L!G(i5{VOEmg&7>99;6!~m0pa#!u!oMnp%&n_O1ZvwHAA$(%y
z!9(V*cZ@jcS+_lGtMIuvFw>2n!Rd72majmT8;I?kiVonc8uD`WOTc?A@T1CGO&q7&
zIX~M3I-Uz-E9_8{P?H8N$3A90Vb*ZN^2?ypee1C4t7k{4dh6nl>d$a$*oBLGS<%>X
zehe7Fw4>FMJl19=vV<x}UX>$L!2-q^{b;RHlDya7GJy?)@<f3vNPg@jJeIr)T(XMS
zTPEhBN2Qntm<N4E^8r!x(8>C$@WASCV(muWz>*IarB@4U|L@P!2PJxybkuA|uU^aA
zm+U%HSVdyoURQ25cCJmzcr|}w*XU#b>_&2IaD~eHdgI_EJkoM|`}m}rgtIDP%(qm%
zna`zdTIZZPNQ{9kA9US<JLs%&Pl#hIl)IwzyOms=$+|s#2Xq@uq~p1r15^gD3{u6k
z979{vsjlqg(%XNujZn*YzwV`aOQ*f%bcbF)nmWae+;Uc;EeGyCW9dm<<UU<fH<qlL
zmPBV9f2M}YFXF8~DfGhRK(rEIPYz!O7WEY{I%>vqUN4x_(s7vbF(7N}>;db#Z4tqw
z63{Cx{JhZG2QcEvgfPDkwS#~H^w);gPdpg7P|jYS;4G(%vFD*|By^OcLr#K1$Xpp9
z=&cNYJnFV>N)CZx`e2yYWgalLb9UB)voX1VESMEuB817Cs|oo;#5h!>0;=xDOE7zN
z>+=8U?A(Kr%-1-+<rd@AiJf*$J!@h$U1s%2EhU=5J6pD%v{lm<EI{lgdrql|i(+xn
zT$f4{>m2i%th;$Z3!2r$8`4xt-per7^@0Y9LW+W<g5ddK+aLR%d-y$nzVpt!@B2K@
z_w#+`H~cJ@)R<wgOJ7a4PMt0CNTSLErZca+UvoT`2@bB1&(C3)Aqpk9M9It@Y$GA+
zQPcaTee`vd#4YaF9Mnn6`tuP8n9sGGXcaI_p<7p5h@fO2&tM)lya_*7dup+53+MSX
zBi+HK3Zd}7kROlj><o|JM&Do9UxhnZxf>H>ijfq(tgBNbatVV_rCV`a{E*U87CrZ4
z#J~96C5#F<D?(-m>CY~+Wb?+I%%kMqTxwAzQrlsfA3K6^ErTY_oYBh@hH+ha`CUlq
zrL0YdXA&|AUR(lDKHD^I?xstCrqDD#-dtai8~+Z@WEZJp-qt59^;1+jCuMgZXi_44
zZWP(8esQNz?UhtF+-=V*NCB3pFhIsJ?XjPE>b*4LcT?#%`-M<n+5AM#5Od>2E^RNd
z)N{l$E9+-o<}W<&5T$pBsj|6JsHtLf$<1`$t^jHc*Tp&4DR(1-_@!@#1Fzi~=kp3B
z>T;$R#)_bZ*7iW0(WtsT;3;^g+zoXo9v+7p>G{xtGTZt>grle^;;}6V#vT0qPNE72
zhH2Q>3Q8sSG?zfn5P|4@)%6c(#tu5x1J|4)RcR;tXz${TEBY6VP~CB)r#jNNF<%S@
zx4^4_4p1KU1%}jm`%m@Y&)xbzs(UZIGq&|cNC#@E0M$?+PgoyeNR;C#H{PU5J!w0U
z`t8V<Tajn}EBlpNY?=^ZiyZ4u<Z9hF>%%0GPY`Tn+0&baAAI6TCXR<8^0uC0{$Y6G
zT|rq=?`PhsOUh5)BfNz_-w(cyhP;c|8G11izWapxp#yPA;$10R#<RS0EZY-sl6^Yy
z*&PI#)LZj3`R~%?Fgz%o96S>p^TNXN)Rlk&B8Z=-6Klq<qBBu}Yr!~XDch?k7*lb9
z_GfW>H94?&LqJf-nS*z+LaF@Y8TI+d;LlxT9o5wlVDGv!E1YLPZp=R(`*ref@^;^s
zKXfgP9maYv_rRz>AvGDT>t-iEMrdIBu-J77jk!F&IQg#JctDr1P^=Rx)PN&X!|Cj^
zgBQSRoJg|CfDTB*d<%F+YHLXh#_$QurQJD?>IUw&iJk&mZA4vi%^S*e;3ejdqK)}c
zk>nHnxSD{Col8S48|ZBrP0#iu{p?=)jgdABMo_Q67nj=bsF}sonup<Lzo^-p-vM@)
zrCrW5)!kOpv()rhO|ikmz>XMFThw-c@M5?w17y&cP)o8Zr%Zw9N1wfpRm^#tFRUf4
zK%*O?@18H~y2rDK@4HJnzqT2uYe)G8qQ9?z8kVk1S<GHhBXDH0g#2l!LPKC8B*INY
zP}AcLAQrJZM2F|^C{Y4;`w6mKORghvKiAD{(#?3X^=c;ty6wSW);>`ysg>lL)fi0y
zlNbF)Nzr7^0K<?cPZ*#zTBcAH{|Snnt=j!^CwCmwj6hl1d28u8cgZ7KKq0B#H5lWE
zq(hU2%T4h|2GG@CI@afe467}cD`e)~S~f@-5Y_PgB3pv&#Xuj@qhGSZk{VxTHX(9k
zUF1mm+*b*{iO_w)!e@_~f9<`drF#hdcEI&+aINAaoTKItsba(GEW;Yti59!+LcoIq
z=*dD<10er|^?BOU!U)$*+;?&Q9UNQ#8<EDFZ`m9@2<cS38l2<C;z^TJV2QIp|H0Rl
zgb}SSoigp{iAc4q=NGwjpow{K7^l-%f;A+?ypN=3k%`@J#8T_ugp=MLx%fMtq4`}w
zyJFpH4!Zuf+d*=Wqu&8(I8ZMKG?O_cY|uPfyeLJmna9b;5GyZ)Gm}Pa>)S@nvED`k
z$x{}9chCX1EUW=ML9qf`MV2|fg4tTp(``#`cq;80u~ec8YBsgW87<{Sqvr`dPOWP=
z)bSdZ=cz6gt9MmvT%F2bo;K4;ubpy_9K9NJ&TUu4o0PP_c#|Jt;{Z$81Jyp^4=%9f
zQ;T%7c5Ki_7jWztHK~iJqP?ez$+YoWBs6DiS~OuGTSF^@7Z6w@FxGDpge<2a3~v@z
zy|qn~_()?8_PbcK{xG?xP^d5%wj=dt0DY{O5sUdN65pNnXt|-?TH0*l3yluEGly`G
zYQ8zv8o?`xK&VVpeQ5%Ek>$XerNHa$A@{cJy??1<EwCUZSe$0N)}JYRGSR|odKLtt
z<fpm#*yQ>EBz^|NKA9(;YvCKD-wHq{h5T|YSW%7%{0}cU{+AUh2O<z66qH+8E!ryk
z88n+LRZw@J<!yh{>0^&Z`C0P-Oru_0<SZ8c(4Ap;gFf3x8Lor_qXM>qtP%x^ieazu
zj2rgs2dJT;te|5P1oJqL2s-TQ)81yNQ(gU{TFN(|T)XIgVrOpj!Ky1X;WS9=Rd&7B
z>D2!I{;9k;hh=mIKWVJ9O4Caduh8c5zXb~;;hRIr1IhmsS2!A}e&m_W$QTq>bv|-@
zOqqOA%oiPgUAQu(Duf)Br(Lo4IAcN0S^3Bhv!eioPqgBeh-D~yZ!;k#d>Qg<{+5`P
TA9dg(@H=`W*k5oc>gxXhZr%nw

literal 0
HcmV?d00001

diff --git a/assets/img/rancher/backup_restore/restore/encryption.png b/assets/img/rancher/backup_restore/restore/encryption.png
new file mode 100644
index 0000000000000000000000000000000000000000..4949e8d1f3724f987126f65ae22dcb2dc2dad7aa
GIT binary patch
literal 91823
zcmbsP1z1%3+CL5>pdtu}lypnC)Bpo2-5pZWAYDT<BHhv=3?0(lsYrK7Hw-;A49$OV
z@83D+*?T|N^*-mF`+`}s*80Y}<8#*vQBsh^L?=c^LPElnmJ(AzLV5x~LVBQr_6Tui
z>g5p|64Fyb%eQZpq~E@!RC2U4v$QrvLXrxJ*L<v|DovQGse&fW;H#AFzknL8pFJrR
zkH!1uxfBB@>Zj0V7N$B-dHT0a^k5s-k1R~oAj0npgcwY{4O(RxM~dj14Pb#gVe^Hn
z1&HUq7rZ4&fE(#sz5UM>T{W_gLdqGmY%HJSW4?A$3qL|jM<E`5pigS+%TLM6`&^XB
z<4$iuFK9xkWU9~Trt+>e^ih;S+e4&~0DeEswgJEMXGnEGO%_JfkHZg6%~UZuxULC|
zSf9|MAw{#aYol9JwiBW6GSo^3V|?O&fy5Qx9&PeKG_k`R-=Xq7X~PR6NgPFnPj1XV
zTXY`;J$4}cNppOZD_SHGFa=m`<ktp=C2^9*w)YTshU%`p!6G0Cb`lu78*;q1>*<Tf
ziZDbcQKx(o6$^d3qY=wZ_a>0aHCsClhYY3s<xlefq59^hiv&{bxbbJrbDt=+xZ6;X
z9ttVgqy8*QU{L)U`y&0P0%^z`;Y`-Zk2j!C&&{QBe=@FSiD%AjN|~l~AOk(oG><Ue
ztOQwe1!PzUFU!5f#>aRbgD*5vLv5(?>ZfzCAiCoUO<W5+?BVN?x4h3SQ^G3+e%f)<
zWjLUd$nllFXJGI5?Te1e!6*l3P*UkGhvgh#s89#-ADn-uLdSX$#V(`f*uJ!j9<F+s
z5bR_ef2Ktz!pEYZY;FyHt$h7?ANq#>JDy7$xtUXEC)2s{{?CB&C+N2PSk$kdp*>=u
z3}8i(doV3JwJ<x3(TXRW@ezfV663(PS%rHonq?p7ySWg<Bk-G_j~}-C_#Wv489rUI
zx4-KcBRA>w3|k`?SbFl)y$-k+=D8Yuu!WtByXWhPbx}SZC_xwa%r9j5r&8ts2R54t
z1S1(0?Jj~1x#faGkce<Z32Si$C-oWN3HFmoG(CSE$|phzlFIMo2?i6d+fp88iV}ts
z6!f#9bnX&Wd}pPy(iD0I_r0caO$pgS@tk{T_Wa}3_c`5+Gta<LL)*m<7prbu6N?*J
z<6|~kB{Bp=?ckRdQ`=n(uNQv>KVHNUd1n+>?l(oWiweTB>Lf<O5RBw8A}r715)#5C
z?=$}~Y~kQ&E5H$H-`!b0Sl)GbEF!VNKqR$xM}l{hhu=#eHjH=Z9Ks>1)Q$d8kSnc&
zz=2GnB83#Pw8t>Jh(Fs!lIyi7@nxfR>qrObfF+=}$PN%mgd~}Y)aC}4H$Nk0E5%15
zg)Pa@iKCOTc|JpW`0aaq#^dmhL}h^j0uT6>Ft1;uy}&RMMV5LP`~KHMO6-bMbhA(H
z>8NqO`0rV#&}u%y(jV<Ucr1!y@rb_7(*A+-N2?{Q6q5O+hnpz-ZAhOeY5fB^o(cba
zQ7*dsjQ%Ieq4=B6QnXmo;-k?lV*XOmN!`fVPqhQA#cHUkyGy%q)=(X>w#00yus@Tp
z@f<zrP+}?wAkIwKWEe-m6r~wPb*BCru%6Yi`No;3fxP&QYu4%JlM`eQOxPQP^qUuL
zYMd|4K1~~wYds_I%P~y)f|?u=Zv@rCuOYPhba#n95pZfm;Xpmurd=nTlD6zdJ=k%4
zIDM|-MWgRGxoUHcfBj$~2uwGO_6Sw*6QQrX6qN~1?sFM5s6WKN-Cxxn=8U_56C(C<
zBy<yN(u|2SncuH2t}dxAYU<4{Es**wR*F_QhO8$D@9oNGbZNS5%<TE>)$G1(+tJ4r
zOw(U>#jxn|qQ%!P)*O%6jyR7@k5rF7hBkx-geJ;_qbr&=^g70qG08I}sx_!TVj#w2
z4#lSPjge21)K;996%enNb<Zj&_)xH&4^UA52GDeA-uC%bS%9r3qQaA3GfugUS`gO|
z{!ZQ|V<EF8W5goi75E)-@#mUw4Ov0yM#U>p^I@`0Yd{n*NdI+do<VM_nyPZ85{6Q8
zwnmXg2}lVR^RBcZv?0giGeFY2#v|Yo=agjohWKg32r(zIJFzSe$TDTjEmwN9YW(TQ
znkC!#T#38NF%F9H7tT*FbUTqdu{s$gY6+D4WWtK$i`8?hB@6Wm6?If+#Ra83zk&kJ
zlwoWyJF848lIr`R{V4rA{fdA<zyp96gbv{8!nV^iNtUrw+BeDiYd+6Y9v(|B%Pz()
zX_uq#w;=4TyQl$9xmCN7xlz4rrm2!}i&~0gAai*C(*|X{ZGv*}ec*SHU)ZCYK#4%Z
zK%;idKzdBih%XYi64Me^;gLkAFSx_KBLX_D!lOt;%q=UCwd#vbi+DBCLVTs`LdH#!
zr5k%b=EqxRZh4J)=fe9L%*f4>%&hv~4P5p|3}p42f1ONPtWhdID0`+=RLO6AxG>tw
zHSHK}>Ida!)?=<wFIR{B(zE(no#xWw5`U^rk{J;sA30!_jHNR^@k`^qj-h7{R<%<l
z?u<>%4yp8uEdiBR6(80xJqx@)dPjRhZcrZQzRhm;3VIZjnAI<t6Y)-9yZ>8hWJzRw
zq#)^j_ynmi=;V4tKFdIG8sGq7N+|)1rM!h~@bdv$9m}1T8`T=-oK5Q_>e(D^Ty9p@
z_g*^8?o6!O?xpUv^xOmnB}f)^sYF$#q7I1;38W6BQZ&ysp*Lf>-9T;jA*;=OSJN*F
zIj=bdJB5xoPnXZFkGGCYFLJMJPhm&ghpXr67s4le#~T;>Ct%|DxSz?&1eZ+Hjniol
z?3b=6OVhPqvwqjI*Rr>?_Y5|ZGV1R9e3g-#p`GE9;cZxA$o=Epk0;AG%gpU|Wth{t
zAl62^qN^!w<5}u&IEOeSG~^O95;D}unZw`8l?$`>By_~WGD(a?p9-3}^fzl2PF+te
zcH(q(L>9h))7m=E_1AG9hM)HwHm)qvp}u5Mtc$gPFvwfWtH^%+td@KN6ySGPchv0t
z7N^ZfsB)?rkRM^0U6ox0vAkJ*+gVDsDE!^!O^^Q$Zt+WnWH;NG+w3`MN%}(hbvfV{
z1t~>^#rWGK-1hvH6Z0}|Uegl?zq*||cDLImo+k1ZY%u<vWv=3SLBF{+P`j|w1J&n~
z<LgomsXFCzCP5)j*|V#ZFDct8-{;omyxrHDPMT<_<&`79*@TY7S*ij$Kr7E3G+Q)p
zXRd+L{wC%RR5;4h%at(5UD#xbb3~*m@Gc0{@w~r$eRaC@D#9|;k}z*p!GP<=(!t`8
zo%?`jj;NSh-fS@W;=M*&kxgavG*P9_#+LzY{yb0HskyK2aqa@gK56^>;9u9Z7%_ye
zSYPS#yDn#?{qQMZ&PbG!v1K{ZuQKIq(W<NS4mpm&lx;~kk{L=ANQh7L*6-ExxZM~L
zDZO*I*IutUgWC2nYd+Hq*3dQBs;w}K?<`nRkJ6AVE-`3-r`oU%o9VF{if@dw)0Whx
z*PE;cI(n}@I>uz?^;%$<ax11TGg^G<Cojv}yx2eMRX^J5xKGf|YN`XY!MAO$XSLSx
zjyF}m0Ii&5!W2QYF#hAPF7|4{Q`ZF8wF+y&UO`BqWuZ%H@w{o7l{?ux`r@5wVMEuh
z)Ft5vPZ->GwrftahGI8y4}5ENSvrX=Mrt9v>0rN474|k6iyJF(g64E==ZY8=Q!gSv
z0wUQ-ZfSF53%E{hxBE5lasXelI*Lt1LZIegYUyxg^@epNVF6d0p1fMYw%Lgby7sHa
z!3LH`tpE`w^SE3~`pDfibeUoU+;G|Jc8@y7B%EU#H*jutJ9nL2#I9|uo-}Z59iLjB
z9vK(NJ)Sac?V~S2H4yNQ_dfkmy=euR#4TNH;#`)PlwTMyuXVI*ZqRe~TpFBf^l!|8
zkMGAX^3@rf1`SYLHOw_c0?~Zz4-K!|1*7Vs^o7{muIoLQac5$W@;Vi*(gcL9_MX7D
z+<>?4aE!w+--Q?vp4+*T(MxDX>-Am3RO0C5jm*)9gVRwy54(cJh9(<W6s+}*ZGXP)
zY82ap;sembOX!&KVr<MeKTSGq5?p>Udcw1^GylEm`)f|gAJG&KIi`mD<&g9>QAA|}
z%pbc&WewxQ+3P7o1+z$f@BHyyU)9$=P=aBLuIM6BFB9cF=fw!lKVTK~p+83%pLVZf
z%%L2cmc|J~x8wB3_VcrQ`hb$>!GSmzKYy9K{Xrj=)ENO1>qV$%nq2Tfc<Zm%fq({s
zPZUrCYg!whV_D;2M5ge>UP{{u35kI2{_lab3he<RiAc3n({k35mjf8v*{~U!*cq9!
zx!Kqw?nXiqaswa^ZA_gFDcx+WZJhva!qmU-03eR<PqR}~{=UW8N|;(pUWxLpouerw
z58Ep?4r(AeB_*Yhqlp<nMNHz);fP<t)E3Up_5gNvS65dyS8g^tM{{;g0RaJa4lZ^s
zE>^@HtWNH>&W3KRwoWvEO!EKc5i@l%cC@s2wzRXQyr0+5$j-%Cn40>2p?`h;*r%zR
z<-b?5b^7zM5D&<He}$csjf4GPb0dZd-Jb<0S-P28Yl&IfnA$oa)&O#G^KuFO9`LtI
z|6cMxhHC$NC^t9%e~$c*D}Rm@V!wZa|9GN5*!BA?f?q&%A@+aq9*Ewa^dTN04pK`o
zMK#1X^1W;jpM1n0!=K-X<KcIQ)IMM&BvB-3vDa#D4|ba|ywras-Q6Gs(TY9~e$LjB
zt{eZ2Y$WuP@d%d%QCMQWT3(j=?vfO93%+E~XlQ)RMB?qQd=&>7$znha!Btnnnf$MJ
zrk9LvmLpM#O1>Xo;GCp?r~QmU<(}3IpWZ0)7D!A<iN)}WqL?<{Z=RU30>j@8&A1QR
z2^Siy-cDd~0s{h2veRxSGw#X*P+%W@K9aRzy?<PWGWB2=34|p0fBHF0vMVamI-LKF
zBeQ~D_9|{OyXP#H%$0<1gL@T?z3auWz6E>I6xk)lO$V`1IiavI`_cmUT)F3z@Gd!s
z;wtP076Lb!A%m6B&yej4H^C1U+C8yX6^Ft_?DvWG!ae_>DT7@*#p`+T#;o~MvBuTr
zAb4s@EBrh_A>bkLNWQ_FwegXRVO3aTblPans@I3e17F1gABn4U?_uEc=to=F!m|`F
z;E>?Ns`gZypo1WhRcZt&!^0)*_s9pst^S}Xo!#Q+QaeFIaJScj*<@#dpfCF%g^MQF
z!-Wn{!c_?O!gpVXG>6uW#a4Irtx->D3$Z-^%t7rjw(@;-{+EJ#YZWKyJ#m)#eRLvT
zEXY+9mx^^2vA3`9+JGl<-n;obfacT<EO4iIXGd95Y7^mse%txy(nBf(C|8MbZJEv#
z>n_HAb<^Zo3;f+B-A#<o^wlNZ{y-Do@j}0+Q%mQDSA5v~4_iaTt@D-!$Zzs~youN}
zVLUgY&N-hbWpEmz7aY8>r~B5|G5=$zaNMcBPUpO>E5&fR2E$eMH!rIA_y_CScnxl7
z44@70*B2*Nmo9L))g{F~Y+@07&*U#RIeNovKV}}TKKe~BSKF5bfCswRLmRzy1HUQ4
zyQ?MWMo+RaUC+N7V}ZoYZu9Lv=7S7XWkazJ&~kM09EEZ$L=hyU2OJC<df{-t4YNtM
zWyve_<mk2gz1(GjldPUM!hXz;0)Nat*8NdGZ2Q9Xh3hA7!+D=&+j5F2?9TbmJ>s0^
zDt0i6=4$;Z{7$`l+Qr?+Z_-@5ZT{pV-kNCuZ811p==EgYFK((mn>ehloxo@eng3~P
z#HTuw*LhPsq2qb2s+Eodk$aeCFtW9%n7ezNXWZ(fyZo?p@Z{|b1}xw#Gb{RdlrUK8
z^<B5k-AAXo%rsEKEa;J<8&?Tu3FpE|<YC~(uwW|6Z;e4{&DjgjBGjY3{dCC4U_%z<
zP`}+1bDyValH)J88cnPkS%}fYyNp`j^tPs10>HqtX6`pj53rpApTd04L_MYYzhsJ>
zl-#z}Q2_lufo2+K7>E2ezVr9;_qxR=AEHOrFL&4d{7wGC9jSo>V*56$D6lxt4B?EW
z-45S)5L{^C*llR1aMj$Pm=8qQ7&hOr_w|gK(wT{6JXisuyqEP#%rbbC!z#yc!Q5y>
zWGn4N@zT7+-0Zz(8S@nWu1pCG9qO{T&+hiUkQ-d;THVaC$BiH>c1NG<^?g^UsAszH
zFa_2={8^{>E-8pyFbX2l1QQxc+_1XDeE}!>O;_i2&z=GB@g<&P|7sSf8C-h&m|u(i
zK^4l(gZ~;^eD`WmBCd3b`OOa%4Sgk?x5GaTd0Q}u2zFuWA8gBsWHsO8N=PE@<=dgN
z$DQ6ArV*g2O4zg819M#yT@#`0)I+qv`Sv7-h~I?i8P=?hEKDvC36c`r#e{u^Q!j+M
zv9B}-AAa-fq~UkPHt*y?P<2y;6(bEmz)G)yS>KGj=Osdg1!uU-=>{k@5vHU<J_;;~
z*Vv-CMKhXuy!%#h<}ujQ8E%<a)t73WSS2z;0gHl5EF>QvFYHDh-?IKG5+m1RW7qQ1
zsmau;(%Zv@`8>T*HqQ#Z(OU~}mB@mi`+onBXP)5TRqd4CE*oOZY~HRdWu|I|gmcBu
zhb2FTTThvV=8t<Koq)Ren~n~(2Yn^;-=og(bNyXr0~&L{BdrxglNKWRFpQf}gk5Z3
zUvYuxs`Y%az1&L2Myj)1BiZk52y^!lC<{J=c}ag0dpqrVMZfB^??usGVx(DK=sj67
z3f^jMuD|0#$bWUCYiK`G_11>H78}8i4oK0Se3?r)8R^n{BJX>tf<#6BJC7j>pY|0M
z%R`RX#LH!Ip$IKpbA-<q-|=5T5YEEQC3kTIA=WBFGH)*&>?v1$@*^9Hr8(i0;~P@O
zGzWhKp?XFNYa$;?4ff2utym4G`Gck&cSg%~;&g_!@aPYhZcU!-oa}c^RkxT<y6FqC
z-`Yywx?-#Xf0GXd1%1e-iHp(Xmr9p#0O^uwYa82t?fhnUMMr}bN<M`ZXSoHUkg`De
z?wKQ)PVwK(m@c`Cgah$NJ_^4~4;IG>qbB&jIphEE+@ix+v=N(YKV))6WkJAchg#A>
zLG16)<;5S5ffMhcc7%ICnBUp!t8{SPSz9ZN@oHFg(q%tw$C$7@Y)X8R{Ja*S;V5TR
z@H5~4hqd*qgg0Tg;t2Gv|Gx}jX1`&!5u*?BzSNGG^+qGI9)qqny`?0&w<v1SE3{g{
z6YR^!H(49ID4-{ecxS+1y-qgcM9)FCvAa$1#V$Df>Ym7aTl>lzr{=w8^kxWQh4iz8
ze@e7v5sQP3lkIe^PVB1B?&=us>PoS90mU*ne}_7EyS_LI1WW^CB%B@b&8$65<iBU*
zc)O7cVNZC-mwd|s4~uM4oM8Xo;~x8|8Q&@#$h8dDS-Ux??ID{Xx4s2o6~>IX{Y$)?
zPd=|((+&R5N}xUM8%_hL@B4KTAJr4txW&KkPvPW#UVGph^<0Yhd)U3ayoW`uR|6Xt
zRnIc=N@mC41E-KA3L$VO-91f`U)D|qwU7PbvA53*QrU+R9Uu<#)sJsk&z8HZu!Z0>
z$MuajX&Xbw8_gf#$iF51ml1HZ7n3MB5Oj>kQ(=qsy#jadKHlEQja?j<??3yPmZg*}
zJWS4leDe6xFK5a{q$+4(n%s@8`M7@Ajug2{afW^sZI$7SqxS4sW2j!oZ+xk*E<Eth
z6Hl*=EJZ-k3CX3r-5%flt*}aXq}9pL_)V-sS}Xj*6Y=k=0rC_bg8ryXgT{*IrDjQ^
zj8e@B?&Xsk)c?{Ld~K^x{s>Q2Ez1b93r$RS7~U--J>EqI;rzE#l2_mRCtQd6S3q?t
z9Ej44OV(%!iYYxT;w<n7$$vZR(_K*n@Ea~8c?tkEea-j3;T5E*f4SZ8**&(UIi_%h
z$0AI}4+ppm3q`0x8QQ(_8m?lUWthWIR)L6!F<+w_4&2@2wjKGc)|2F$7Lbv}G26?9
z4<aw%<yKQXyI-yHum~I17ZmNP8^=q{?-qndFYcW__g*3X(!O`sGm4ksp}L`12a2me
zZ;TnfPVdWyH`G(?FZeF!7L8wL;Nn0?SJ#Q%YYxi7h5!FVJD8~GrkdJ|a(wH(r)sV{
znvMuJc<~ucOJ)MPVjJrK6}tXm_POppPV^x~X2ZTC03MX1og<u{;#GHvcN?pqZIxiB
zOXulQzgDe5oz5=CSqJq}&Eva-vk`6>%ARohyv^M~P^);G4fZYTpKx~$`_!0L?A^_4
zpjj&GbF06;Z+ffWdCQNg>$!Okjsy?DjrQ<L8;a@moo$yM1S=4f#(gzb*UIx+RhE@D
zQ#FcdD3~<chy$;T;k|O(DE5DsIejEM`0WgT{CHr*`r0B)ey$o#9SN$eMZ6J924^nc
z^`@cNAVWUjjw`H+Lg3#`(5*2}o6mcZm0q}QRa%wcjGiLm@r8ercV}8E5%@l}B7(p8
zO=Yc9i>c?0VIaxIoe)r$C-$G&)%h6rD)yXbpx`Pwg7o(~o70E$qr{y7Ze{Ys#L3y!
zr|DJO@H5a&bs{z@CDH>lQ6%JNACdljC^~_93E!uGi1N5s^b{A9m53VU(TVvZMsBI3
z*W1ajWlTWSmAFazVA^a04j>osZ|rH9#zGBH&=8})G09$YW=?*+Mn74Zpj>b3&Pc7M
z1r~+P)*5V+VAY9N2K>jW|32(S@y*EbGu<4fsyVLVj&7STSnH)QNlg4<@Y9_RiDE<Y
z(PZm4DGPAF7QKqRwWB@P)v%wB&n_=0*+I68ai`0$lXaF<>yE>g1V)uK51Pf;*b<pW
zWE|cz^1QG|jjQ3RQ}g;`;7@PzfX_#^ZiFc;@$zcU!>|qhi5W<!N0RC3l+;<0<WT-<
z-3@*nHx8%7q{ja}m3Gb|LqmgvqSJ6f-9%2q^J(R)#|9@H;^^YWw<0(8uUot^kEDg8
zQ&Q-EwEhpi|H*-LPqe43WYq0}m>~u%oAkYDA`ILj_>+pTE<bE97I5it#$5vr_Z%XR
zic$kgZhKQ~4MDEVb>Hg-V}?o4GXA!cEb))<z;;-(FG#*I*T8u4vQE!xZt<&I*a*4a
zR38n1hp)Cb6?=zthvdq2sVx`}AHVzKgPWYzf}iJq)rLQIWulm_XKq9e7-t(8V0AoL
zqEdXFB}qp2a67C#QG3gnn>Ts;?q$S?h|G>JJi9tyV`i3E2;PbHZ>9RTct476pq)g;
zNqt{JC*uG1Mn<wf=EsV(`zgsoY5+a~R@uYdR32Y-bo_>WKxIsE&leU0!cp*vL-VUW
zyGT_se*2Gcc-WEq#}EIf(*8L=r7J2iF}B-Jg^stOCg&q>jd8x80^ASo{4X;amK0+m
zc`r8S@1hkK?jkhmgk9|!p8Vr1ZIr_Xff4m$y^-~Dm)H#5VRsA+&f8EN2x$L8>fO89
zmCrJ=k7Q{xS6G1mBtax(0s7$ykQ746fA+C5kuuOo#z9@o^n(QJ*(7J-`gg9DmUCu{
zZ<otj6Mu}3nJz6!kAj!V&b<%+`JvK}QD?CCV*MW1$jILGjaKXrfgWh6<#E!N{;@Nr
z@J(^!!f9<1PsX~b7Co~4uT^JMcZbdw4feP5GvBlZ+2E?YMN^Mf_x?AFBlA5w!<vRm
z8#lGx-dss{a6-$y+ZD$jf}`}bQjfqz(J5!mwGx+-fzr|)lR4?<KhK*F{&}wm0lXtw
z_#6n|OFXMl%r08tir95_|1hsiaGQ?6p+re%kBxb3A^#{Q=EL1el)s}7LXe+zkSQj4
z+|Y$;jKuWK)}VkGRi}2|>C;ZucW@99?=3G8|C-y7ciI0sx;VnFmtJsh_{~)xC)hO+
z?<tTi&nFwPyi%gCYKNLg#M-!_7zlmdwLK_LHnII!&`RXwnZ)MW_wWCxvE2d>T8Fpl
z%4x=~A{;ld(NASfm3*9MWh~DR1Q-F^PAXjM22O(k$W;FTrbwutP>C0=*ey$R*y(77
z5|5rtnwGrnZCk{}1K^A>o}=<3{}T@)-y{2Es2YT9o-FLtO3AJg5P8f!XJoiI!MR4Q
zcljG+BbYYqjrwkzPx@x?jz&C(zBf<dTEB$`Abv7fBz|B-60sZSyr>ZO8gTd3LvL#F
zf(-|vyKDVV8y0nahJdfmNc%bQ{A&rlgS#nsoZq#e{-ybrg<V1xGnnb-@zXslHC>c{
zG9A)GR4lTh*r>ZR7a|V(Z={}=LvcaS%@CW0O-1U=SiczXKdp&`8gsuWlf;_yOMOX6
zN&Vi!Y5Q_-NhrNY>e?Xx(|_U+<!5Z<5xy2{LP4L)nUqU!1f2hPkimU)nV(tEURve|
zQMz62^s#7ROIg&G70dH_#nJ2kA0YIv!yYt5m9Z;=EPnyA#(n4r!&b5TqQUCWEZ4W#
zvi$ri;TeF=vw}3}U-$oq!Cz24BLoa+Sv9(Foo-B3KM6U3tz+LuwrgtA@jFEB`%PEA
zK?lmFbgAB;fA%eovTf|nfP`R$`iF9s|1tBw4wpD+5Nkk1GF8P!=*+q=%=_KX^t!2J
zm=qgGQ~!SvBU%JnDm(bIca-*dVvQXlwsEb(E_v`z482BOd6P$^xRw9ZMT+Pg9K5+k
zKLGqk0RI?-2<ybe=&>pOm&a<lpXyrDnfUWXcoSB<%IQuX&j93zNzYx-Dr9rbhIse&
zUt*4X_WE8w|E+oB7$AhtgS0YCU%*I$H{%u)UT^)2A^$OsGDTE(^Odp9Iw1S$wY-=!
z`o@6rKUoHn?+f3L!y&;6Rha*L8Sl^ShFb9S6S<e`@!6|Vev0*6kYC!ns;w7jJ=UWJ
zFlzrJ)Ths)q53NrOVTEV<f&K8$&`>V<Wuy>Z@hGd-^`Xk7F(i&6=dT6G0xfqAv<KK
z3T4J>d_N;`8CZNPmS+o&)8!!Y&9zWFs}75cVj+~Z?RxxoGxJ?|O-boYovFI-#xaik
z_v;VPPE_vazNG<RN@b=WF&8+uzRl6_O>(E&62i%B0Qs21q6tRwwLx}^tRu~yITrmr
zT<&tp>^7Ntg&HT&E@+F(Y|5L?foRjo6mmjAo?ozp89h%Ec$bZez>PB_#Z<LbG|AuB
z^&Q0dLx9Nr!Ap9_@U_0yDsM!d34muyWB!xMIliT2a}Jes?v1z$4pu1N7@HVpdF(y(
z;XN&Nw68F!&Ns`TqPkUO%c^Y+4!sul9c!YsLUX$X%+>8;JF!QYq1|T%SI}ilPl#%c
zM;agfo|EUVd5=MAB^FI~J(kt0=Scel6_5Y6@MbJ3@*8?;z-iCMlogYAnQ|rtZ*W|K
zth+S!)q)2m9@F0unZF6`XMn;y;fVBu8LQRP5*r_C08gKjh%VL6PCJRb!v((ptiLsp
zD2<5T?=mQ_XLiI-(B#*Vq-m{-?@=W*nJ;D5)n6f3ikXp8vPrE%n+8xEfr!X`N?00=
zJ_u#1!kk2+f3fe5JP#}!-m*f2#8j-I{>}6#MG*VWE2r_uS(KU!@hyj)MTj}~Du!*o
z$%iSs@7AbS&}sa9ILRK*EkO<1Mpll_{boJgB>!ROD@-~$dc}~-qo1Ehq@qr?BZla2
z!W+i_QyUW!P{>pya3H$}%MEgRB6_(c?Nf->M{Zx&h3mpiTl?X+iswT<Ai;r(+Xeh1
z-B)^h%8sWoR;JgVowpp_7VrS^1;bnGKw4+6om4z&Y8h2kJvCw-8Wr9O7B<I<3MywA
z^eEiFnX|7g6{5zRgRpjNuu{$Kx38FlvtGT5K0<scST)kBIy$`-j|d2)vm5DqbBdJN
z1@m!N_r^A%B_y_;>b2b)^aQ6BGJ$G&`O2XE2pQEdCtIZ+4o3Jz*&9dbjnYXqQ~kbX
zslP$qwJzk9I|wfK_2iI9ONFJqudfk2YQg^`^38wX%Kf1z_OoCN$g50Mwj1%+8LG=4
zzkKS2Am_PSA#BM&Tp=XMVXvi;XLOn<+#8H=F+-YSd3D42&IK&zldXwHF7K+V`TF+0
zw)R{WL^y1Og(tE0l_c-stgKZFe=*7cvN$sVT}t{zHeN()P!!+#Wj6_(?sEAn0L^y)
zx)CJQh9m^qz5<yH|BlCCyS;C3btRo=^j%tonhfneTzU_HV=rwh_zR870v}ll4d=#A
z_xb^=S_nog?`+-oYOPFfk`0HNwQ>iV#egC<x(C2Y%E>JjOuOzQd@DM(W@a+BEEfd}
z=Slr5tqTFo-c0RPfSz?8*XFVA-8r%Q9*hG>9c$hnA2yiAL>Clr&MrT@hsXc??f>K$
z|Me4ug&ZP0*$Cmo0ELGr<F#uMbK}Wp$K)f7*6#ce%d@h<SF^UYl_3@O(}|`hqFEzk
z)(M+I%K3$}^q9p1M)JEPY5<v+@+DG&R{8l<Ow~O5(t1|OV$|X)8bFy&jTZ{(uioSZ
zHZ*+UHvSwJFHpJom3TXQ`p91FL`&LUA|=*5JuVLaDurV}h0x}+ltX>o)6s8}E{&#L
zgTjNt(&gc4T;dQq2pXO3c=L72#kN*HNBYB7-mT_WJIk3FrsTFs=#b269q9c0Rb0@5
zmq}f?h)+x$eMpO`c+`i;IDW5_i(eDFpRspHc+ACmqac|X&3<#c#O8-ZvnTH3)tGUP
zP*#ti*~K{)WtTHX3nD?=l<-JlK4n8aSVHlUPqWH!4F^btcmZ^&)m+T$s%B=xCY4I_
zcS{(*w{kp0l{l7yaS{je92kn%)Hx6jos^T0UOE8&s=Cp>`2LmzmYl+Aki`>$eOUfY
zk><lydT+M16up=Hd_;+DWl^1H#H-wT+Y9ScPjBApMP_*%ZAgiy6J+lAXCY{z$7#I}
zpL-5aCGG54EXLF+owU{7zs<zRmEXNp>slO>xTBg~u9z=!3Oda@b0}Apun{CfAN;Gt
zKiy*@@d#t$ZD#r~Bl(E**7|#!CNb1+b8(4x!3u_b?bSVL6m@S?7fh?`mK{$=OMBe#
zkwbco^bM|X-5piW!|9YAhKmYI;*)S$eZ%g?7{ER&IPL&v-YI*5y8>`R<;#SS7e-Wv
z187Azi;||Nm4YdsFmn6&>>$M%-;$y5MLjB#qHgI!;}9!J10S_L9doEO3(-c3O>8R=
z6m)%Q!@MY#bei<`Xf9A|I%Jm%7KQ=E$crP9RPo~3)(5^d|2!ZK^eck-MO1h}D?x@?
z=IoyX(#Xiz`Ip6BO?N4VjoZWrY2NDATxE${#`M-7Lys&=V!L{9=TGY9YC*|+PZKd(
z+$x%`3pa3a8jU(4QxAtK><6=_QmcE8v?UFqP2n2T&=i1c$t#g&g#z!>BDLH^ibl;n
z)vhFxn)&8~s=he5^y>u|u&4gsRho!)4BMjQ{??4uT6pL)`b>7Z#=mQa+>_t&#)(X8
z^dffrPO!og3h{DXXIMPf#N~10ykvQu9KHUj(P3n1L;ZqHp|^g*-I^k(TslCZzQqC&
zSI6eHc&1r9-ta$MT^lWIrHnToH<%n{*tcC^P%N2eh<K=KI#RnX<BlEd_93m&K%;f(
zoX%XoQO!(!?b|$=bsTGH6E!CO7_<rxnCqW5;(?U4mU)rby-1elQ$&DY0h?hND%PXd
zQA5QS@QIxB>e!mE^w-y)`J}qJJXUjz7Lxgw`2WRy?Bym#FPwyMJ4&0`h>E+_D&4Fi
zXinV-x_Uk6D#B3~OsbxH_@(jMGU0sGMVcB=jA+R;!gf+9!))(V=G+Ydcqc<3MmE+M
ziHN6h=l&s1Giy1I_dhQZ0WziXLo;@R-;}3x?d-NPJD;Ud5pV@4$j>^1=7v(H9jI5;
zyj)D>yy7qQpP!yi7HX$9x&{=%8EvSE4GT77g-165E>#}fF1!mxWz%jU$)FY@7e#vK
z4>Pw-gJ(`D?{BM~&}X&|dL;Q(9~~S88I9C9w~D@XPTYy{YkWTR{yOEM<7v3R{f9<?
zFL|VZ?}~cO5#}$i5iwvZH{18Y-uUTC-hE~tR{W%Cm+(iXGN7BVvz|Q<c*?@@bNmUS
z==>SbjdX&@fmaj%4pDsV?ugLgTgO`$S!fZbfTJy4D3s){K>}&UeQZOMsS3On86C;!
z0N`{rs`%Ve1GW}-`cC#wpJqbcXoRh@Av0u0wrVsgJ88Fc?NPD4hu@zlm~qRJV9qI!
zhK&kqWjPmOXD~Lrt=XGmmM;$;>9D~(Ghqbd!OmU266cg$q&MqizbSrw=Iz3E<T`sR
zVW~8t=`@gL@~c$8ybo|1hOu`2L>#nsC|2)LAl+wcs{)sCd*vut8EW&v>Vq*(-Ko@f
z4k8go_Y>RlO#6MSn3XJu)Uy1@yJ_V{O=3J}lLPzwBGQczN?QY(4iR!3#jUN1&0GNo
z@Oz<TN2}rBc{(as`m*1<{9klyMLRla6(e0eCJ`&CyJJb4t86>->_XJ7Zqqn`q@tV2
zgEBsa3D^u(HN`IOPETz$kL;@CcI-^^+Zv16a*-~B%-f#W2-1bp*~xiU>{jcGQEJEU
zr?SwedLyG(<<!ZOG8fXZwBvrs>Q#>3gT%$#^UWG+@L-8w6fd*7)THX!(VJ@*wNIxC
za3+#@Za7uke^?9<U7097PIQ&9nPp96{i}$ibnmsiVP$bkNhCT+gyB8_M%N}88Z1(5
z*U+lpK(tHUe9n$3Ml2iV&LgHTyJ`Vc<2X3;r-4GJ$4t{?xR>D*O5+#<O5>P<YdOU>
z4RT*^UklR`i03sc++LqExnJ6JMJr!)h&x^|0%n=d4nyNYd60*yiG3vl6g&nt7ZLc1
z5#hL1&AAamMG%Ss*<Khfo3=7GtYnq^!MZJFe<#G}uh4>~Gy#nb3k>%H2}}0mOnQq0
zg*zMQBY>w%%||C#8$Kp;q}rf?ttUYrA;2|?ti7#-606Z^ACcgJvz_o^%P@c%c_kSW
zbynU$Y~hANxp@$e_d(#bGjvAFKii?={dBwvjuU|H1;0zG(1uLCS113KPiC@D{z&Sr
zSsKFxgIetu<!=@46P@1L0R(BUGzs*0f0Y=YHe9U^GF;8&Cw6DbD%1=$-~OCGT1$@H
z{LraRyzZSzl98|MbJyNz`c`h-M8YeyMS~9BK^nqkR>RV0>v3srvdDP%_X4L1?tR))
zkV!SJm<@HimJn`CYYkSQiY@=~j5s<q&oX<X=5)s-mQ%TBP^F~h+m5-cHYK%E;7HrA
zG`y%$;dR~mmGSwbDL_}PVZ6v~KV!vB$G}-m=#a8OSJC^Qux<K;KK6yG*zSHSmruzO
zk3tiZ4A=Hy>P#NfpTCH%$0eM*e!b*td4I*{jGQi^a5vAkGskc`txE!*uFJ2r)1t@L
z6p*c`@0znQ?T=dBo7K^K11q1^=pmSAOyiYQu<;a6#S(i@L6^whqQQjA22jLVfJj`x
zT=x?ajc?m9Y_(pR(@rwDR~FoD<_D3-%eVCSgEB{P*S2?BXji=p(gr0c6uV}0sG?Cl
zH{^7jD}~P5h@XT-?hObk5ELldI0t|3J2Jl2rgsE3xA!WuB(iI>#CM7b+X;Mcw$6;_
zvtDGt7CEt|q;636xR9=dhJwHDvHUVWX-rBShz+c^dLCVGlF4$pm)PNvk~Bd@W+$?^
zH1CM|KQoZFXzBl#3br6>tq6ecG3&4I8ncn7i_a-K%G>X~a6KX$VHCe27P*qCzpQ+1
zu4F;5iv6MW{kn@D^<K{xv=1|_-(ojVHGe)=iJ>BhIdU?c#-#6#tu2Y!)*7`;WF5^J
zki(9k(&~M;iN}ReXc;t@r(8@*Azz2fq~w{k7kw1sxJ~Oq_0z0e+j4d$6k5cd!V2AH
z>5<vYhA!3$Y0zWh`WzQK30Jmnt5rEG%2k<2m?M0Nk8(Wz>poU)dp3K&aumkYYIlQ`
zFoN}v{_MzZJAGG>kbiB`P*EchwV>mukTz%<PqFy94fETeLV7;Izq@yP<OdnCI3qo$
zSI!-at7%Dz%wQFL8UX9BU<JP)?)8%GG{TavkOw#-B*?<PW`+0xgB8S35)T;WZOP1h
zpkXRE-KC^y3R}+g7iLzU(k_&vKVN=jiT)hS)_$g^7sx7|lur%zq%ll}3NAu|MJB|A
zD_dUQiT|1Me|q>r61hppr%>$25ocDmWugR=D|Wzn@0@CCu>zNFN$gV?BRFZj9G(9g
zbtSaWn57tH;->Q@*1N_t^E%y(kw$uw%=ACBsX3;R$6Ge@P0^J`9S~TYak-l-&lFuu
zqA!mY{A%<%B2g|n^HZjlGkY!V{)B22r+Ht*WGV^u)bV=xnGle3eu(y+`|RV=?xT2h
z2}6x47f32mR4AKcH2SE5D%{wuHO!P%onmglysu3`Ob(8aBnsRr)22~!>aY3JM{$H+
z-M_+d*WEhMnTCf4=%4{?sl$lenyr%I!3qR0+O+O3xND=bY;nEOhCi}-Ex#4Unpx#0
z@}QKuL|v~upwIl=burqaL*8QJVx7+edF|XdNQvG*#m)3SI3W8PHA$mMUO!S?gShxd
zVZeiBbvA#6tXJ2U)h!1*09je{Sz()@8Vo>2I5B<8R~JQ6o)-L_7|$@9ymZFh!-LWB
zCx$Wm4KAexW0nvY8&hg7_w$WQF^gP_t(1!j3ylD8n3#LR(==h(5w}zc$jzygnozrW
zF_945bo@J0pU{Q_e-1yPw>*u)O>a^>(aRXC+1nx(aJTj-hrQi|_{HDBu7VPgXh)EZ
zFyBaI;-bidH4y4$TILM7sBH}pcD%OMJ~52|WVKMr);R>B^O156IO7}iE69DEIV-we
zG9O%oYgDDgjkKxrSKa6TDLAjcou5}iSGc2MrS7PSymjlXFGF_5Lb`Lp5_|I^1e|Or
ztkoX$RDuen<R*?2lU}dc>D3G#h4AFttvu#j{25+IU=_D*WI5&(U3b^VGP|*3ImN`R
zaV^9q_tjzg&Be8}0z*!N%}}4P$W^SKBC9;x=oSA!Gj@BLG5s)unkKkCG$s2D4L-%q
z%HS^*8%gscJ$8++VB>|i^%CFT;XQxYm)14IM-vq$vHh;fzDD@F;;YLmC+yOgQ`;)%
z#TfhC(q1Ndo0G#AJ1}*)6&|Z3hh}~(6?^T=w}HYz7sRYyO{;fY;(}Q`UoU>Ry*ifA
zzH6I5N`YPB_RxmLPlJj)bcRfi!ktVz^XdD}qcu)0%M^J>dXss6T!gy$AFsr&cmHtD
zlMVS5btVbTSuDWTNYeKT9n-kJ8Qgx$-O8`o8NaRKN|$Bo?5?vxog2i7X)|jG@8kSS
zp;D5~x9)d}rM)H^gwSD2G5S^`rfHvw)e>Z8iVfFw!Aw;|h;-24bUI|vH{h&9oaMPz
z%C44Q#{h)Onm^8`$q}kiO93$HgKxFnw*y)quAA2n{G$27Y5wJc`nqmQSZ7jMHC@tp
zxdL|l(7dlgX9!dKYrj1~KtI1MzruAS8BN;xkN}U&8vY@MlaLF@b*@3@Dkm%3ahC%g
zZabTO@jfX9JWVQiUA^`3;9xW^WXEF%ngme?=yp=r3`&lJ<}M?x7oq)Mx%=ee2puUT
zAOk|64#BG;9@T;?uAvL}mxAVl2h3~~^fW@itOo#D2OX~@ad6U^@WJ1Ur<53fpd=&3
zErpeKlkR!q5#dPBCoL8zv2rfsV5RogD4?coi<!rpG7~n-QlIo>JO0VwT$6JnFJPwF
zPcuCbi{2~y*5Mw_1odVBgx^KcdS(2)9s{~<8A<sQV16lWrdO+G7U_`5M)y+{5_S#g
z&ok8PyLbVI9luVZPT}w!*~5(LEnxC2er1Qpf>1@)AlK99kT!EMIhnbv$=bDv?pB_C
zswIjedJw!C%Qnuw5$jgkKeZ=n!Gm_2@cDcn!=wQrciJMh$->)}lnSt@xWk^9M4Hx6
zKlepUK*Lj`Oh{er)}n+#;i$BG={fd}Pk9Q!v!*}Ar=l`NmqlD-q&K1`@;PyQzo+{#
zu!x&meUpdz<w?a^Wr5#1cb_~*wanVzx?_fjREs`hGfwtSS!ok5Y7<X~WC+nIlSt8d
zawk`Rj_4Ow2&Ew)k!p~#us~;Go;|90xBs(DzwIAMV|i!e?UT}#SVb~*1{;by`I;`X
zQTLQ*xvO+y!D~h#cJn7b8L<Eiwr0a}FTj!=M~XNVl%AAQKPVKRS7^EID9!0Zr74W;
zXzHaTf7}SgvF$vMXFdB@<?CA`135|Gpu|)~4Rh|OR-ro|lbQGm7J@@YWqosh1#Ka#
zVt;MPJMW~8YoS;O_s(9c<lSvmp|keS5Q!=#F!I@7Qc48o5#4tZkZ~YfCp7hwvg_u(
zhZoo4&W_C6vji3<xjGTua)HB)n<SiGoVnOtG{HTT#C2VHSwFsUfIkWx+J>{uyUb5>
zawZVzZJ_Ga?8!D*Lryuj&7K5ZXOcnM5?GF0xzZ#)#c9_}K0dv~b?uI|d)GoAF=e9o
zN^Y&9mB)G_SkWpaSn(xy`(rw&2bix8zOklwuG%zt98bQ;v;Td6D1`n99P(l9&=b<V
ziW9+BwHq3H!<g*>n?DMZA2g8}BaHiIu#p*+e9?bYgpmyY%%9iy=z~f2>8VDja)oG`
zRfp(K<1uGq97aUy-pdm^5>Vfz$o1>g*|p%|raT_%X%~Z7?oNJS0U|(4My~B)8gKmZ
zY}>sQx|;;IeUjC0VW|;nz5O2gTU7=ReE-tj^5sA#&xnnul)UfRN+bLOz?f~!x#XOY
zaBH#0Q!KCYG-}alm3w~$J8KV9@1;#KZZ+e}zz;ru)Rz=uM)Ms{U7S)rPfbLhz0-D?
zeOsZ^>Oo4KYs?t(t(TGGtaR%ek!y`E;8588X!^@o`uhTw1{d4@2heq{6!F}4dJte4
z=}-_9?$t8wY}*rJKQ$rOqO%qrUH(nO7Wr=CTVs%~2xKog5*a*W;=+53M*%JgG@&qk
z7>e#QGefJwtI*j+$`o?MMF{w1dR#O%m#7VHb)uaXsN9P+H=yR0z@w{&@-mX}iA#`F
z68gRWhZbyiIHKr^NYfm*_P2)76fPL-t^&hgBrGBqhyAv%<O_Z-LUEFKC9~9$kHg0A
zhBY{36a;gq$$e+9uNL<A4}wGFC=|@SCCQaz78h3+l%5;Lpa&%s+IKtVxdpIp-H1IQ
z(7y|HAMybQsV1A47NSWeF6r1Ql0L=NwA}OCw$s@=pZ$4KNCafy)b6wuQJysMGJ0Z6
za!medXdroFo|`7>vAB&wftYYpe+*fz6A^s9RJOotUHHq;cRZa78ZsO39{te)hUadd
z!c}6&Q2?$`#?N^j`4$_ygiS%gwNjGQL`*wDTnWg}C(7ywe>EUwz+L)lQx4y(3qzx;
z$yJ1#*@f4o>?jHPRj$~{>#xmAN~tzH0Q3#}+GW(I-_@I9|I06*LJLxbQ-9;fvnvNT
ze}%#RvUzoQUpq;P$P7v)^l4Yv2KI;5x^8}mfJ=_~dYm`wF-3cl;eeD5sC}yf2t1bA
zsD%I&6ZE(`x()fm<bo7gI&59EiYmwme7Yi|+0{13i>xL~KVzPSvxD_lkJdG__Q)TZ
zeVuY0Q(jU`wx4k;wHoBYg)r6%ndItr=Y*pv>*vKlc%>n@)TN)3qC2@yCxw6A!^mK?
z$p+}I6xeD`7BsddOJIq1SW%|4_TsOpx+rDdeKA&4jJ{cy{e%X}o*9eIXFF-Zf1_&5
zd)ETLdK!ZcdAca}#e&|g!x>0MA5`x(pP$GY6Q;-%yP1pVqgBuDqK2666wRNQz6`sz
zS*ToGTpp*@o?dr|4kKWX9lN%TGO>;!b7iwQ|J2lyGqu&$N%QWjLk`PVZnn>z;I<|^
zqAZ_+olp05V75|4rfG*O;?CxaS)~FmGw=S5;WC)^#qtnuXMq6=BAQTC5U!E>z$eVC
z*s@gh&~vLfr{Q{$@=njJWszW>sc`?MUiis)FO)6GVnRUAvZVD_zwv@>#r1mgRg$)Q
z|4~f*GP&!{dss5mOa;64Y0Y2KlSnm0i)ierUISZ@Pu8Ef;D^A4dNngxzpEI%j+`^d
zYaKGXR4}<vnvv5iJDCK=8ycP#OXD-c6*thy+ZhuaNxiPD)Az8izqSohb=0bZ*7z~K
zcWjp+84Ry;Dl{w%+`6sD&D9BWfT${jtncz++TG5x(^CU^e)Sr=3eoE9`Xf|fOO7d_
z&km7=(kX;YwAwWC_8vV>b-}Wr%_rfBiCdhElOnq^8yD`+f1k@o_7G8{8*G{OLbS-v
z5iPQLw(d}_YPBr6q?~QI-@qtuS@*FJF4P?&0~(}tIa}NMS*hS+ur7eWi>-QW{b*C>
zLL<I>DyZG$=ObX=huK@Rkf+kZl>?F?dVh)05KSYQ`?y5Hxi_a(645#W_7?W&AObZ5
zI?}WYcr!xsIJil;`$x}5q<72{JQ2Mp4qkPA4^eNm#-fJgz6tHC+%$%3ecad|P0_6b
zo@ZBrMKQ67HkVb;aXzL9m4hRC%u?xko`MzTz-A_L=Pp0?JEXR~=1W^@1&v#3pWeJ*
z_l^RZx3HwB<1o}{(3cfQ%D?BHrrl1gN5r^7>cC3idUcW4NaB9t)kG3bVo}x}J$2<e
zdqUD`<DL$pq=|^{sU+2)HQ>s@Bnf7|<2A$!8`}E0E@hk9M%$yt7=LY~KDk#1XMDiv
zn9Gji+T9aEfcB)zWT(^4v&L_YBqC|Mb;%rE8;JgobSN~lkS!#{Z6<r~#&r#v$lGfx
z7!&QJTB)|lr7A9OHnq00YToy$FIP4RJucG@$P5==9t>9*89j7bTW3~?Vh=LEjkb%|
z64*$CerhfJT+=y!bQ#E`H{_G1>(Q=q;as08xAM)>ty0G4{3o+QK-Hk;HxA1RR=E!e
zA|hpPQfnY;+obi@8D6*9j+Ud^YONki8x=V`33Sh@dz{~ETXyz{AB(WZ<C~5)ZK%8N
z(yJRuVoh@Y*$#ja#Cchb&%2n>%31@^uPt#?XdG{^ANJ;m$;gnJ%l^nWi`QkTyoJgn
z@xG?h8gQvtjcDzTRqx%*mNl6+4bgVa<!;~K<aAFyl^TCtI+|pzchz*gL=Ud8n`IdS
zykDqnCGQ!^9~%nZq|2f2#y7Z-Bm%36eLWM0o)Q+WZ6(5`poE0I&^#^7;J=5$={vuB
z!ho^vceaB!Cfkysd9Eosd$w~!YvkS0B8*@}420YN1-y85gG~NCiqV;?Luflqngmk_
zMLEW=T3+AdAaZK05z&+DnLav!U{B+AHz71JUtUCcs`+KqJz{|^U*(ba^ztT7;vPzT
zadZsje86IK>G_mGO~GFQ(0ow4*sP-;c`@>1pGG5Zs*_vVzTa9KH19n0QxGCyaS&zk
zvmoa%Sbh4upr|jm*Btn`bTMCEAH1UPel#G#N=2R3rQV%B@zPRd$W$E4=-9bMFY8W7
zEzn^<MZ!(&SuWApAWma!id#I_9~)vY+5~^!8e6pee*Uwz?Ms^<Cf{BEVuq5`52A*9
zkU!Ia73+q3ScPg%hrT(nr|!A|hc=iq$DH6LpHE9-=*2M#Qv?mz(g>2Hf0b#|Fc*hN
zYE)E+qmSF*5aQCIJKlY9jZ!OZ)}ay8#tNXN;HywWmyE~@AKh|19;oaX1@JW0D~Ky8
zyvnD|*)eR5?RDm&8=?b**&v!Hk228$);Y}30|oH=g>tjn(s(bAvH*Q71jv1ZuVe_=
z8Z{(zluKU~jM?qKqhlv|^QuyJqj6!U0?{60ZuU_T@a><DNcAweC{mqIbRXQYSLx~j
z;Y$gxp=Doh&|U@>)wveu%?r4iU0VU9BHF$F{t~UpTg2-jziS>{t*|HHXx0YwLt~pE
z9kD!GoFFgzfz}&gpGSg_<*>sWvc-IhB};MX5Sd^3L!0EY=6KOP^y=LSd}Lr*B{h?A
zdHMvGmq)ekLwUD-M)l|ZD`F3?5m}I8lI)hdzg+oqIRmYW-HVFNN=^zr^t+^Zo@I=q
zt9GM@LDu~Z!QrumcJ(TqBqKw`EH*Cp#cFDEd6GO&#LEg3>g7_~`c$!cO<lEXHX<RH
zE^o!?+YJcu>ZW-H&eJxn)Q{F?+t-fV0T*M04s*{zH|h`7TWcPwQ^&GvGiat1#2!5@
z|4Js!5^Dk7I;yG-If?qYV^j0}ee0OXR__?CA<o!<WBV+q3Ek_j!R-UO_vnbYjvXEG
zrk2YV!0Jt^AZ}@*%`xss&sXK@H|AAa6dhD)D@P70?xBMg0D1FQn1?SdW=;!)u9pDQ
zFkC+Qv0y-D=WcXb0cFRiqP%L?AfZ<zWJX^7Xn02RWXNaV`~*=39mU8Ktjv>>l)soh
z8Xy^rkPNIKWl+4akGBpD@nT}vp-oI%V_~R;)^|b632WTZ*+eWObv-;Pi+ncSn{(Mv
zYERw~QKV&<0?NdCyCPyXBZX71J5~o1E;Q4Ule&9)rx6vYMw@Eb5~Ik5jP|QO$4h^(
zoaAc`8_4zT!j*|1mDq7$zHLHli4IMx&otg!fk`6o(R#;2!oh@*PA6`Nr0=vQQ_5ur
zTvNIlI5e`&p|c6-ud1_7b-7Q-A8zA#t0ycr4%(8~qH<!_-&7x6(NA;-lKGVD-lw9G
zDR*#H6Q#EAYmB~Rf3ZM>BkcT*N=(k%9k(=-rSXVrI(44DV~$tDc$8AJke@`~IcH>D
z*Y&IjLmh_~Con@bFVolc|D)?G!`fVzXzK!PDFsUL7A;=9Xo|ZA*Wysz9a>u4Effh9
z4Nh@~7I#l@QX~+(NU#uc(|yjl&pmse`!hfCJo)mzGqYyRTJuRDEmVG2+f@*q=0iK|
z!5+Ou8Q?d^{qPOZp|3TT6IxT!o(`ZH05xNcy?DG{y{h+mgjGR%nr&)70{cdu>9lSD
zL`t1%V(%QFwdVe8F=dqgZE0X3cDQd+2>ko*MTIq3>2jh-1u$Ktaya18!@ZWMxE?Lf
z0uxkYGT_I^2R8gXY||<U-*hE8{Hiz=ak<RV=9r~Ko>PZ){=<pu&r!9&kb>mw0W!4u
zzPW)*FWoh?&)9=_shdPKgbW824HL#+GE?|OXA14Pr%~E<4g9XfiHks${`{WJIQ2yu
zJ49JXCbG7u{<a^Y05a1*6k3T2rT`6)dHz1c^=V;<G<K5t5l^Q8VBlHlX2EFqZ_7Uy
zx~7Cu+xRkk%c^O`L70p^_U~hO?mxl{9`~(g%F6^C8oxy%6f*n~-++~K%019hTjvya
zv5R+NN?wttY<OZMjWK#Xbb|%-&qe#w+ceL_!Nf6a0(TU8QS%uL<PPz<tIup5?c-PT
zc#T9V6F4#|(L4DS0r67l6tx<b8r=OJ`d>(_gwou#=k{h4q=8^5f^gz3QC?Yv{MKPT
z4h}XiFG{;`m|n`ne9;s`y*qfbSvlrexl`imr1<2lw_0Ra3L>_^C8sRAPF<#=ou5yt
zpvotnn3O8HxBiocw)QT5R8}dg`ae{-lmmapnlZ>}60FMCY-Sn+bX_EO3R8U<(q@}3
zA)#cBM;9E7Ph!wW*elsBXmyf1j^8}-Lo_$PyH4`BNQa@yADl!hQWCetgvU7`MoxaQ
z5N*Fc;`e9H7oFfxZG3<h^pi07-u^hqPdo4&K+#4P;Kx&;&z7BSBNeGY=RSYEh&lR>
zSqz>zCfQqB>X6i4y09_)wl11B%bI;UR&BFSFZwjIELDyKeOgC3@t<7)R#KK;V+F)Q
zWQ1R@9BlkjmS^rkL`NI9pIavWUP^Nqqha@t+VEoojg@~664qy8=TPFZRZsUEa?+^;
zrN%@=Tyrl5=seiiw<akU`TSth(SrMU88h6hd0%z9!dw276yg9mYV)0{`J2Y=m)uL7
zXjEAz2N)`puXH83BEb}8vrFsJ=xD)o_R&vl?$BEZW5!&w7?;7>UTGraA_gD?FAh=;
z7)*VF%0tEyqGSC2DR`y4`R5D-a+CZHj84uhcEch~R68twsSbKbL6AdnLjgOjgtbd7
z4D}JO=c#{6znrh**h9_YU7!|(>>P*fFE%`;ZYQmCN8Z~f6k@0V7sZ_!birZ8@kr?T
zPraEXTAn`oJKUoWr&Ome`r+D|yV+vjIjH&incb2N1H1S%^c?ZPojVIBKPiq%WnqIL
zZ{7l34@IUy=~R=~5WO7#VH~)@laiYGip&UPJ}bv$Y`kE?=Y6IrZOuqVU6#~woiiA_
zoUf|T9UF`=6wwe;8SPj<cI}lC)=Y3y%a-+kVxdUjPfu>2Uc)BjRk6luRHp+T_?CJH
zP>QC~PdSzLDh0(Bg_!J#LQJWA^J<}Xs0&I&0DO!)cDQ{77HJ_Ve$sC}>c}nahNx58
zo3i<1VoxIN=ThFfw&P8Wl5dS{7J4?+RpRnY%l?ITtsiThfdp=P(DVx*`x+8+Cd$d`
zhHJ$6#++yZG>!SUZD#V`Cl9B4MGTAl^m$T@27|jUn4*O89T$rA$aFSX|GQQFL>K%~
z7HP5M5_=+zJM9@kD1Jj5UoH^t6jFE_KL-d8%38en-(SI@d7M`Nuc#s>WkN|{6G*rQ
zOW>!JI5{TOgi3PqvCS`;ZibkC_qB4jp7FkJ7OTsM>X@rNDZvJ5&bxEccuplzgYDXi
zC3#o^j)!r-mmVe?Da<c3KBlp)b%_~V)`q_%Wc9s_C+-A&Chx(RD?35kgQOzkVEt=i
zpMa^`Ny=6+q3vk%n5zm878;<V8;TT&?uZ-Qw)UD0!z6sWvK_$`h6>>nZ5vYh4RjTD
z)0g5_k-rb-q*ztgZ6_aW&egHk@Z(sXn6JyIdI#fdoOkiRc&sNnI2H@|1S5+R@a1qA
zS&xLfrD*QM7<Tqs7A*RX-Lt|~IDQ*CDc^rC0Wq8^5cy{rGhuwn;$H38kHVfe?2lZ=
zwV;>W#c-Oe#Sdo)2iz<gLCPsS1dhpWQLD(ZlA&`wcmzmLTy>u3cc@IH5jlwrP$XqH
zW`x`&ah$AGp1K;ApCZedTIr7P`x_>SkABye!)R-_%pAsh>EyQ{hLhS)G_gw-V1ICv
zslAb)4arsjp~6L||H#dEqK3=g3gsytT_pW0-S;GGZo%4zc#WD}h1_rtb@2f^a<oXG
z)9=el@BLFs@B8`?7=I01`9YoIA6MYUEm4)1O2}!lpjZ;qVy4L%$|pF|>+mFF+rn>z
z-{&GuOM}V-f7(U`{y1vG0xXMM*AU9A|4+;9So}WI@XY}wPF1QD=`Pq_-z!vH?xUPl
z;>*{5vUs=IeTmE#R3V&s?#%hOv*~=GYgPzSHJ-+rB*1zFG{3pMVM`0J|Hx5pq~_a9
z{5a!Pf_NXJvR8g4PKH@nI?gOfrNMZe=bV!y4TXd&G~@OyoXLA|iQ;Sw@jkQE_DS_O
z2_sJ2U+jr2l1u-628g>A@uD~hxNX^=ThQtTz~wJ`l(0vYKdq494ZDBIoTOY_W0jIi
zoi3`QIbCj|8y<kKq@KiKWPJ9QTPy<%cR^Pbkq}JHBDa^u(Vfh{9ia19A|%o#b)%Vd
z{m1=|Nu)Atavh8&ej+Lv8r`aNk2rSQu(#`V-JcNEiM^6tk$_NE#8{8ax~1qf&EiaG
zZ$3a5@&3o*1O)#vQ07QLjCTR981)65vAv<PaDEeUA8?T*r64;{Yz=0wu~JG9XEvZt
z=m4&6O)*g*P@7q)sEp-!n}Cc16<Y4g^I~qdjWi8C!s-ezC*R*iWw<bLU_VgAjM5C`
zfaZU&pHirqMWz1n`gB}}umoR9%@YKc*}`XPH_G0y?%W^~S$&2MV%3;PI6Zs-c16nm
z8%HMv2uY`)=_d<@CVXgxntsgvk5jnuY5&!qh~fa_y0a?|S3_z-u$jdIU*y@Vm{rj?
zDnb}i+8~Ja^bD|eC($Epe*Jw0gLh>AH}Qn_K-p=U|CS8AOMO_&-^ziiJCpCr!5mg!
zqG;%)Wdl_3JoK9Te?<tLu{J7!7`#6?cq^v^0>z(DdkbgHTxzHZDJ!s608KR$HodJq
z_0OC@r?8?&l-$zyh?Bh-?PP2XC`z@y*XiIX6e?ilCZCRzr63q_Dj6%}qz8E7Rly;_
zA9*W_dn9x5l^y(#L}3cCGx+C`m4pAG_4zY?MN;3&kzj%=wN{+_l|4|p=vS43?Ay{9
z{?k9@{PwBM#X3oG(3z|+s}N83^+}SrY__$m#WoFd43%PsZ84l4eI`O3b+n!z_b7|L
zt2e-)M+KY~vc8V7*fg5d$Ii@#)TwlB${iwECw1sQ6H`%z<vR{_4CTNG%!<*9TUAk7
z(;gr0H369-{tBysO<C8on#21c_~5eUe08~=G3)fvwhoR$rrad_#Q)#p+{~HM{lfzC
z9Igg3o_RJS0j@)IxGyCCuP+oosO4*8Mc2a_srJ}CxmhED1GCZ^x~>W(_VQyMlpjEs
zXMy$)lBMv%Fl{oPm->?;rc6(8j?B0QHf_N0tFbL{+0xl9ppI{>hiBh2!GNn%0p7$Z
z*{m|{=_1oLCluw7RUe&uHC}&02a_Q(SxO$kQsV21bNtw+6Zrg{xc*Dpefp<4!Nc)Z
zX1JR7YOsWc5L_L!vHnkY5GC^+p(lI;eFmvTznDJ2T{~{}u$<^ICghqofB7bfA&NNw
z<PXhZUKy(#B1?H`r!EdL?k4l;@TBH)__T#FZh}(DY6h{OWhz~io2b&@-?|T*;Rq1H
z1^-`2UBak&G&5ndvfjiLk%e2Q)3=H9#@w>}2ha8=bvB2+D;ghYb{Dw#oVaY6zC$#@
z%q*z#&*}clr*z-3pZQ#WNg5fCTtAA>Sp&(5A4XJRDjbA_<`GF=+WkL!XZC_|!NMj>
zh0UG>Xk@DYq@r>-Qb%>z<`)-^pUj1WH6k+0qKH!hv=w5TI8J=Qf=HZ{j%@1OZSo@H
zUo{7zCXX2XHU!04mo}z0h5twDdfE^8q?QBZJf&$0d`&Ba=x}hp`@bsec%XAO$73&Z
z|AFRLbeyR_={S`96z`v22Tj6GVhh`(XhZUVg-(E4lkNJemfD5@GYAFm)h%Xf3@7vP
zS0(~}htvQ*_{2A9hmDo<Gx090`cMmPd-iq|oolmtp3dH5<>zD~dV`GqOecoc1ioKX
z1W)Mx-1hkk63xFBSsmawO5Fb*{Qv#mapHUJ)CwND;LTZVQkBVI8-{-7Pk4m?uiI{V
zhujNmn0{JOql%*OuBGI=;Mkh!c*$maHTx6eG}OM=uz<cDrJ88E2I?JSKu?}b)SPmA
zo?ZmrMj)Bb6tOoY6B!67y}DHziUEv`U%)AEiK>A52~*!9H27V7e$CHO|9${2lSn*w
zT18lUi{UQ3BtweuXAT_$TA>~quK#Iae%J7qxehlziNeTM&_sr-EKQ0uKKRF(eH(jr
zj@)yS^V<o-2~qp}weC^zvF^3i@*N~Lmt%9b<_nyWkC>_a0_H_v&)jJ`+TK#j7q5Q}
zX_i`?vpr6G*o<?XI3^@%ImL}LhXv;2YPEbxY5-F%kkjv_=Kr!Wb!Fi$buqyrA0hbi
zhh%Q#-!KBs5k^h>o?TR@VI-z^+9Z!n^d*L_hYZ>qxjhX#$|8O&s(AVM_26sOwS8GW
zU(FP7{kIcdGT&WgG6WA%0f}&m$?Kjx4uKk^|98pLNuMx%z;8+~FIvIa^>xq=p-|I(
zx9^Whg~$|2Vq>591!qykF23C#j-DddH66U&hu+%Kyr>4?ay6xhN92D4%YSDT@Jn1R
z+m;E6$Egl$t{G{CJXT*N5&w6Q!a)z`FNANOV#;^n$Bh9qx5JbYa9L~Q>pOJLZSsdK
zEI62Bl?kb<(#LgWqQU{VlFNP79mYLs$0*Vm6t%l>xU@brOJ)W+p@kea8-jsM$K*}t
z`*`49Ws?jEuW28Q8jj^GaS649TV{?H#M?H>PvVHIyIs%!@jGzlRCj{^pdjVIzfcg)
zp@sADo!z7oTY$waC%`r^lR^D1+}^YCU7Nj)M1PN0oMjD{^JtZ6Fw5=x-&U}=|F^Qg
z=n1HQYpnrGv-P&t<X&8>W@z*|B>D)K+7sKLCNU7vX4kqCn)oGny|z?w0LVrmk1r(P
zUaCpHM+PJz(=l;9A@hjIwR(FU_fVzd1J~>QLBt&HcxefnqnSHf?1bRV&9M$Jomz)a
zURfncni`kppsY&#Q68SK&O1&es`6rxPN`kK^p5shi^k;C)S)kjL<PLU!n61X@hnu1
zcl2`?ET&2`EGw666fMrf30;S0A8I6YUC&a@AR{&tVWCjj0xKO&v9j_6*o5`qaMF-p
zZn`1SttE+H&U>3nx8kDyon@Qf;aJs@f2Xu-R@`x~<eYVuv9|;=qi6smm3luR)Sw($
z((bd1#M`&-pAB6Tz!N{Sqif>`rm^@I?^a$gzwpf@eljY4LHsuZ<~LHpB3#j*JQ`5+
zj0ugttbW9Sm5`~k!_|9~Fg6a%&ux<_BXt=lb5SPc2T$ju+Jg}k(pn~I%jF|qp#Au<
z`9#76EIiz=J7}49=KpGX<Zu{M(`%t?GaNbHMer@oxP2qyF8AgF=WJbND{AIwT89OV
z1l!aZ)DL_%$)@wFAm|8b3B(o-gU8Q83|GARCfen{N%L2<%U9?hy4#?}(55M6t=?wH
zreOllK0fYB<qBY7jp@ckT7&k$cBOlYb;ZHQqnGjcx5B&tV|QN-{ySvWlW;N4oJ~5c
zK8G`_5%wEv3}2@&tpE5_emH+Z;TracCdkk~o70GH{A3w8se3lG9zyId87mf;exjNc
z%=5RDa7p|rV4;Ka{#l3ROq0cMore3gAQ`ly;F^=gy?H@}f>}uWt|FlSb#@9euY*1D
z^fS%eR#=P)<L$7_c$ekxUvRapS#sS13Z-+$EA<EU;ebGJ@Xf5cLm?p{jolrs@;8W*
zRs}GJ*QQrHI%iY+-!65W9)eGmJw;HUvPu<vCQ71Z2*a1UfzH!t^T=q`Y0=T=O*b^%
zau&4elqweC*P;hK*YoO<cLi$A8tM17vy3?y(~=}~`v@QPQ1DeZv};*>l(W6KQ(QJ(
zq+QTNDp@CGSKzA{(@N^#T;Vaz#U1EcpqUJ52Wj<vC|~o_rb3xleO2?xReGV7-k3lP
zFGFfW`S>(~-Vr^19dFL4t$;|zlMjFr-z|I#EwHPrlXIU5n=C_+ro{A*@Ys~5&KqUt
z7gf2GI2UPJ^iTJbT+KgEu`XFoWab%5h<rqyFoz8ei7313(iS|Joh7r>Y^l?)ck)x+
zE`J^MS#kX<o<mL2i4XbSyom~=Vr4AT-eeADAE@|Y+2yhbwHRA00xVQjnUFO{!OKt$
zmvvC;Fd6}ImCW1;n8q|fk7RLe0~0d$-F<V()wQi0UZcD`+3#8(V5=^HAVLiD6e{>Q
z#j>SZQq;`Zu9s~K)GGUz@$bhkAAEEz771vcFY(vS=$?vnRHrzLHD62D`UO~>Wp>@L
zX1sSPg~`&t=uW#4-=Dc|pdK;*E#BtC#7q`w`(_F`Ng1uY%7N(+qazUAGE?8N{{mQi
zI+8J3lWGazT4;i_&c^nEzA(Irt<zN>FG1<)uce$qRbqtovFRfjtM%gdcD{OCMF<5#
znr)%XUWj!4GmaQQZyN+n4)wIC;~98AjI0pS^BCRMhqb^c7V@pej5q5&l+xaaXG8B)
zQdI_QQ0vuJ>&FUm9JenXsg!FPcW5|@a8Bq{2lVQp=r&^~u?xB8bD(ZrtC&)vSm3=^
z=6W3Va+i2MK#LD<Z1prSJvx`|xW4*2ha|s>7WtC<kRT>|K{eJ8U~2zhrK)Pc%~6S8
z519T{fpCsVoS&7-_;JG)m}GMHxBgWjEuyr*UeoFNHoY;_7+c_Qz@yQCUP(sn3Y>eA
ziJ58)@@D=G@Q$ZGu%MY>_R9fs;8s+X3DbF2f6?pWy`|L=c#++^ip$PhlOEddAodvH
zKv4}`TUsQ+gkCf5W=OIJ%>5-EQ<Y*OHKds<d1*Eh>1TmC<(uS25$Y{T0;s<NVnZYD
zG^bj%m6^0@KBtdxq;qXAyIP`hU0#o;QOe`&Unj#igO(>B0Gc&60tzMcPh`u^mS<l>
zT}y^Vc}~}i6g6SxhAaZ2za@}+Bbh-BiylLZ91)zWcMoP>1L4!JfdhAR-9U0sf_4_7
ztM<OQQpC@e4rVVgbt=xmV+K7j0reBDrsGnR#QOp*_lNfctB=lD5v_*O4cn`Axf$7@
z1<qFEESJ)^$BsU05Vsb#-V&c}Uy?)7Jy5!@Fye{Nn!s_h{|J)iAi3sxuVc?{q@_in
z9Uu_mtmg1T6lm37qC2t?a6otw$ElJ!Damp<-z0DB-y%1fAq=emj?iEYHm(-H@&_xu
z*pkGMZ2Tr|riz4GXL!W6$JtO%)WIQD%-(3LdddEEy3%itiEZm^15hAFWiM<cn<A(T
z1>nrTUKtRTo%$0<q9F(~S@eF10Y{=AEQ}PE;`f-7OF*{9$sAR^FAEZVd|=1ZQKhke
zd3mvF_spom9kb!#Iu#PdKv^^22w$>{CSkAM=uBES$T@wZn=+0J&1yf<D%M!p{X&1M
z&9}}Ldk|#EX_sht(CSpC&A54IR~d%s1_~r-*3)}8^d^Ax_1tD$FJO|KFYd=wYGbbx
zPMxscB#O@h9AenMHt@D)GYu{D*eQ_q(X8!j1l9Gf9~fFhBR1ur8Kn$3h6Wcme4`us
zESg5xaqwkD9pixLP7Cay4%_Wm0W>dGUsWO*tE}%n))QN^M<=L<5S#GbnkPEz*MfWY
z?!1@4qOG3T%l)P;j`P0s_>f^P!=YqUG~uX)bjKtMMtD_DlSy;?3q-Xy%3L2GqK>q+
zqOSTvq1;QQ8H!#cqmtiL|1x{TI%fj+jXY|C<hWaLB*fzV>4k>!$?tonwzdJXU1!;}
zJ-~MQ&t@D7P9tZEYr;Vw80_|B2a*^Ee<>$IT0d4V+NG%So3NKVRPAC$lf=z827ax6
znp}2$m+IoJm=2g@ktV7Dy-Ks|swu;t`&%38PV=evj3%KlF3`!udHi=!^6G?+h5MmB
zozQ<klgS!#5IPz3E|G>|wU`^77%^KcEUltlZj>|SO(Hax{RktdVulfrzjV$4`paZ(
z;D){RwSx^F#K51pJ(4X5chn!}TsS-l6%wvOP1)uoo2u7xoj*(Pi0s-sJ}v|4N%(Fu
z!zRJHJs{B#`z7riowX97UdJ43+yjH)3d<oO!HeJ?l?_di6f}4cBYw<%ec+~P<K{FI
z!VlB%{bZ*+5w38_<6O6S-x+grM;S9AvhlPu$UMe>BO7#SM^cUDi_!4NV^T-~+XU4a
z1`SHv2DX+YLxV2shABxj?5&@8AoS68S}&^%9gna@S=$#LxsGYr-;j`v^>lSTKHJd7
zXWtm?u32U>6D5{S=Wmc4YB?B_v1AtMc|nHtb}?M_u7&lvsO3OHma@U$<Y{K*fvdhv
z=L;*rAStrVAz+XZbINJ?%uqUoN|KWn!zd%V{&&aqYk|ND+PSU#zQ4jK>3QZzMD*q7
zexGI~<e+h_lFg}ulC;XDf0FEElz663*cAeD?8@l*VXjq1rTtA?jNxezmPIGip0C@T
z5Zg*1taM_4UBw)wv6{E}4LTg9!VL+10Z>&os92)XJ2S)0W@t5{(9P_A^Q@}t#F$pU
z8-{GF_i<_S@*#`o?aAEEnj|f6(4|}6mCx}^{vt`Z$6<P+deF|c?hI|Em`8`9=P{<;
z04RJ`I4_7L&|A`g=xS9rX}5`OPI3E;<{mt7+7_0`nJ$~^&yJcwwnU*$b7=xNOQ+Ac
z4<1-ZM-i_r73x=99MV`0Sd&+O(3wNg!RZw0OC>7#qIf7$wYL-dVt<wH@YCygBvOq{
zZ|Gi(xNzwCj2<!^rIwp`*r(!w_ce2-KA-y8>T<waO6Cs*reo0=tpEsfH2V5rIoT&^
z3h_JjhuED<4qR7JZ1$zkWLhgowfzV;Z>+3s(w;lpfVz%HQgS9){9a!moOa*I171T1
zvGHyb{rzDD_EO>vu#ZuHTLgl9c<X*{M+(M|x`9*Fxt|!f?FSZJl2ATg{O=YCO^&%F
z9sEs1Gl=v}V^m=HSIcRQlYHQ9CFkt-E2j>d;M#}5WDSCRoDGuT-N7IO>VBxx7Qv&_
zv7Dx7Fbj2><GzING+s5Yxl7qlP9lY?Sqp1EsUn69GnoYmH_FEP$Vs+@Wi<1@)1-M-
zBn@Dnq7(S;j>UK>Czet>M?$l=*DLq{DNPWhyPJ_CQ?o~sNc{(J<^@>T;!@o)eYXKx
zO4{GUY8+1D+<vutrtio$t&9PYT5R3LUp31gGzer@WiP6o@|7}3Wlvz*FtOoW(0Ps0
zFhYH0N+0zBOe5}b#=1lr*<z@YEW{Ua8m)}lT^}t_HiiK*qG#Lnws)}KJ!!8_Lndw@
z0x4JUxY_W%vXSC>oa<%FLT}Jlx}hZsaAof2g3U%hJ%=_2-Jo%J2>=OU8K}KE@I?hx
zIT$?EP8_H2w#**aPj$?<oy0)=J<s(k;rM6*({;0cVfuWDQbj^Z?1o@X+?ETg#u$}O
zwi9QMRo!Mrt!Sm!)L4*|kIIZF#zpsTv_Q|DXvM%Q#h9`}MX$#&SZjm+_2z=rdfvJj
zXT$7w2O$d3zQ1nT9My3Y-&jIRpj+55*ldn8=G&2pz(6q8|CRB{_G1G}tHFEERMX*{
zMmFYkEFZrX+<I{4wiXw}KI308Y0O`-5r=bTaO<2hxsC)m#4}_M{e0{<Uu&#KcUQDP
z{g9>H^4*R{nQoc6bnB}?<q$prp-yt6!qN>Rqd{(q4Zoisi`Xu&bXGfK-W%;8s_<2l
z5L}<OW8xg+Lma=nJKHcf0P^x5fKpsXdYb)B^onaK$1T}up#3^B6msF7Ewid3O4U2E
zJJ%kGi^Q9rvHsW<3d9wVu?S<Ipxn_0C%Py+qUgZEbum7d&8&VNU++knK;PkrT`OrH
zA;mnArtCD9BLga;3y-aI{rB~2aR#aG2H3ZI%9WW~$aTErCAW);BtI&<3}_wi;5r!6
zXm;RJ?K;BeT3F|gyb*AJ{wkUc!$hZ`Us9#p;{n&0Xq-YPg}2wn&WWw<UM9#hU7YF1
zoW30jKlP500bXtI0{5!QHlXl+Wu0{Ofk&olsrGV5mtV367XJ!y$3j%rZ|ML|`^U^a
z?{bnMhQd?*HJi3+{->zJ+xRrgF9otvmP0c<<YybbxdPUr#CCMBWfL+T?J{{9nDipe
zfVE;&q<$zK*jIW)Lnk;~rTF3`tEO;VCPam)Xx#SwLGjXx2~ko<|BnfRq3<hAq(XIj
z3k>KpF@|zw$^6EnZF=>VCqeUzul|dE8u$Cd64QAs7}5j<3HlD+{=-Yw2hZVw$-Mw9
z%6?$v!@C8LfpK#u1;6r9#_v5U3muR-vl_h<1J&@%GGD(hDzHzK0l0SV7LJ%ct~;!K
z4pS=izEgB{fO~hE<XHJ8E*I1m>Kk7TF-E`|W}ln{a}ilwTBBrJ^Ad+)P|L0l%Wm6R
zfzj9TxdZx|wbff=83k5jVf6&<SF=FNjm<)<S|wfgq0*z(Qm45Y&ev?oIeCn72#9Jj
zPEBueT5czWXcNMS149S7hz1>UBuDHx`+IdhNb$nMi#LbT5F^i)D$h*w4{t>8>6%5H
zm7$@k;<h20x`4uMNZ=-aMEzE3|ARE=GGmjV{)+1%86P`EP4bg=1I<<E!C^OxOAC11
zt@H}3O(u<TeYzpe=!dt<Xg)ZBSs7UBs{&J<_4H=A0N@QL3&*({Wmv~~Nh@jjOx~rW
zETY(TSuaHcJFFq7NOb{YN|k_sio~qjj7PG3Hyc2mgxsjIG;U}|VM>7Ij%<22xB0PV
z>v2G~cVFb<_jh^3f*oDWfRZf&H@-Rz8Zs6X=Q2lXQ-W3E;R(hj2}SS*M(~oe?X{Eb
zf};cTv?rG)BPBpuMMQp~k>OnxV0jMfwN-Z7)ULP3&ay8wN8)v1H8|5zuaZ>;emOJj
z(XHxO41-+}%5zL1fpDH&)jb{4VdjUX!)HNxHCvDu7`HKe*TXsdRR9u>x?et1)$4OC
zvDI$vQ*PZZIzZaA<KJ}H{Jg2pNa0OSTq!$hzM<{_+FGL{R(t6kb(+?xk@m);B-7`p
z+gTlm46r#Vz~{TvP-=X7>Mv2lAc_oF_N0$GX6XdB@c;S|#m!3Hq<Gi1<ANY9w_Rfh
zHw`K-S8v%SYzx6VKj|9}(z+?5^zCWTGPqI3o8hypz_Ld|<egG5(XmcR{Fc8{F8DGJ
z31|dFlIOCLh?k)!oGd#1N%GF`exd#pDpw+wR{od=9mV>n%;(T{?!4D8)?sq?Iq=%p
zp^iardvJ3t#`TcwVb$;;z&_<T7WMobw*jIuF5;>6@{yum+mEMFFXVAc>SD^~nQ}ES
zo1~UW4%uZqA>1n`JcwanCt4Qfpwvn@+&S;R$Ky3vR*7u@w!JYeV0g2n$GYGN>tD9f
z6st03uT@QrE=dNC3GtmQ(Ozz%5oM)DH=#OwB}>noG=&|2p2>+Xl4}#7W$szl0;+e}
zyu9zQQOl4|ymlU$ty>%^RbAvf2)M)}Y4U+9pR9O)3CenHKX;O3c<N?kyjzt4U>YiI
zXVj`(dZC+DAw#D%;zFl&VPC7WUc7c}N4{kft|)0TjrES>*zyV5{dlxg=3ib_jX#sj
z)|V|+t`SrU^~%$$@}d(!bUOKKX=AL*L=9FoJI0yEJY087omyPW<4jVt070tP2zapK
zN&U2qMa5X3)S8(H>sXIRpLvU<ZsS(V@93Is*?kY7qsLsctYcznJG%Bu3}!jpWgl%d
zcx!4tp10{XMA*))v$yG84p`_HiM~7%9oF!}7bCnzMCDYE{orFbZ5Ls}DcUZz4Tbe#
zjk&8W(JH9}aGy<Zrms@NGBbahBS!QCrp+cs6m=wjB3cY9ID_>qKQ3Q8h0~i9#p_d*
zcGj9}r*}itVg>6vpQ9OL3$9^X9ech=r=4l9pL(f(cy9`f_}pdo5!uARGY85dKjkM>
zi%vSKmjp?lx(ek7ew%Xe!|S!cY3iHWc!QQ|#n&#=)vDwGZ>=Zwfw_wHbqXE*FPJF<
zn;+GW7F^lr(Kx1nLdz!u<&IID<E`0=pCnb2Us?7>MS>=BW^6vpI;HY|lNy=<#2K8m
zGu%J5H5Q!*aLeC&%$X`Va$nSTmkJKpyDyf!aa%=bOF-=&jcBLJ#L)zYpauFt7?P_k
z$g&#yc_zP3@1P+dd)cjt_>r)Yg3Q}3q8=foeE3b<`G5>yC?(Tfgh}eHfb8lhcfGl^
zXOGI4f~&cnJtVwbkSEwny-m~3P=0^8flRNDt^KYnm{u~>hiq=k9D8S9ntlD#Ql<RR
z_1T_v^0gq7LXG#H4$Pta`TYQy+o6LWb6qreB@VbE;)fh{(94OE<<A9nfG=;~vjfZ0
zq@EaeWw{u%)sMy1W`0%?#New;BakY|5^xWLos+pOo_Xx`nfc5Vzq)J7BMvfq)o;p+
z%BvX*vCm`|om5)v9sFhI7iz&LPARdH_fN1?myhb3BX%9yyEU_-{=Q=J<?UNEZJ5Wl
zP97)JJ?8B!pJUTg_;vUtAhEd3qUU=(lY!2aMu7ud_yt9~yR|cejN%4EXfyU9CSPU6
zb<L|{)*9x*As@q>skgW?<wm6e!1&eDSzhAcvs#GCDJ1)P=ZcTY_`(9WAlOTBYxSa4
z#(k3P7eU}uc+nb6u)b}>uLH!8diO3FyMen;8a`zTyc5SK9PeZ&M>%;0(R1TZ*a!sa
zGfyS4<w2{h^A_Fqbk@bY4(&HUf(`P}vx=uWl1aMNB^rVCE0F3lS)Nrw>0N*Pc2*u8
zIC-2{;#D8Y*T;F%))nHHEtKICA)3)74Kwsk^dG7in_0KEV?q4%nduwi+2KE?D78e)
zj78wT38p3BsXGoxiv(7@>0#D8@=_>GwGQ-8GQ?(c-r?j$_@^~pY<ai2(Yb#}K$Y^j
z4n#se&rH#!93Oz74a3T8MnsC1GK`IicW=4Hp{xZ$=&NX;niXz`@}xb|!q=4h?L#;y
zs8w{B4LvpGDfyDYfq`AR>{4S~*vcLYH>KJLcWk&3p=5vPW2!K2RSZXoSGu#giv2d2
z?5b+3-*g(SfmRk&Sc1`wBZYQ1$3WnB*R0c}lve>W${8Pa^t20zX1Ifh0jhLai(FWL
z=A}}?rqNhTBe^!{sC6@2jHxtn?nX=Q@pP=sbQ!&8cPnYl6K-ib{wv1%<fybF9{7m0
z8RqRSk-}GLOS9W7eA@#+a#S~QWFswA4cm@i3<r|{6XTIvYQ)ws-xVU{zz&Pni5ae4
z7Nj86^m$flG|dZlow8`O7-^>9O;pk<TO1cL!m;WEKT?jJlJE%@IlOvlmC~RM_EU6<
zsIZ{p_e|{>YvA)QQI1?$G~-?KO?al&RoRXg%yb3C?=~YID_WEsG{Ef_zJ5Jbl%~lU
z^0rOC`(Z7UafL*3y5!ta+wf|2`IDFM0ZeusZIZSxXj6Y?;n{jgXk?}?{RqaC<T4W7
zu2X!g79w(s*D1fk0y7RAAQrYFE>qgxcuoRSb%l?iKGc6)Xe+7Gx;ebwc%v81)@B|l
zL)NO)_in6@H4=X|j;$hX?|iLTyM)SU)!`Gzp;g0@pyGP*fv&`e{sk<5tS9fqMTm+|
zWs*9))o6(6J>K4owy6Ks6<c(PkV%bq?<el)+jFOMc@Gr5Y_{HgrfF-~;ae@iI2Kwj
zx$u2`<3eBeSU!Jf*I?5jR&dm#w}QSjuEj9N%@_;vmCqx;2pP1p8WWE9>AVWeXstrw
z-S;7dZ%tl<y}&XltpmcI-FCUTlYH<CoeLPzDE#)}+CV!JePL4J1RCqU&Qb;q3mO-j
zuT*|k)DN{BJaQ5~Hp&ym)<0>v8+-TR7d-H=1;(9;0+47RlXbMol#6?_?Q+XITdmBk
zPA7QICr3x+){o!r(3WT3osgGOxz{_)Yx=A<3Co*FGW{|?>A~<9m`Uhuna_lwzX-kx
zezekms?MV*U#%7!)=z)W>fU(tJ?$Tiw}ap1(T<=#JD#T(qJ!)XjQn(<%jlM%fS;S@
z6KIVY%(Q_Mw8Hlk%|F?MQB0F6A`)27Q@iHf=4%aZPP;=H3;&LF5!V07wyi#B@hxd*
z(PCTPcx!6<>|PSFMW2nSE40a6kv$Rj@?g=i45c1{D|QspHmN{grB&QoEMN|AbPvtz
z5mk{_*t_KDo{Jro5yy66MtLB8z-esZPKxuv$yHE528X<r#Wf`h#UaBJ`$8VSLcJ-r
z+{5Ye19tbV6Bf<{U+uS1m;R<~4^<k^jYL|LIWl#2%-}QEo+fgZ*)&#g4X*s<-Bm}A
zZ&58#eaqkQt#_?qN3I;Mkyh#lE5@R&Z?|hS)eb#^#8bcCpnqW6ZZcuGE#Oa#xV+UJ
zV<m(YXE$nY6n&$)ILsOldAaB;`f#ElaDvEvV?3_708!RzP8p`YQs-7&+mW4LQ0KB`
z#`3}EGY9{@6w&C&dmP^q#p>;Av*uMGVoz*Y^W0I~9c7?P!@QZi6vPqlkR==6w~d4;
zbFQJer>N(npKd(8aqHcU2RClMym9B_pAS^QKSETmLjX$i7AatZ@wm$;CRPDz#HHN9
za_&}GterG7i=`@`z?BhhRx{fJ#15|KZSHwr9jbK@mNE;d1~o)x$dg9Bj8GBanqdB&
zy6UU;W<p-A_*TH0%fzaK)<c0b&4|LJ!$jqvbtGi|*m^jZi1Pt}Czw6Es44C><S4*{
z{Aa%ZsIRAGE+@;5NoXnAn-$AD>R=gtwMEGy^^2k7K~7cJpvGr}5A>+PW+Go4R?z&5
zvkPk8b2MYqDSXzr4pFO?y={PO1nMKz1YETyW72uDdHB0$ivR=^DK86p$H(|`Rmsnz
z47FV2*m~mHs1hSa2tB%{MpG;;?+iuG!<5+Ou6M}D=j3aUwVCWf%G~@4bumm3_SvOz
zJkW^s`scgUK2xR*v+m<-g{%A@NLz9<s@?70GcS*@)Sp&;WsgR3Ka(p23dG))Corzq
z)?=&w(tIeoKQN-Xv*2vCL#`A`?w384m-Jev{PSB?NEw(y;Axd*9akqgIhNOmP?Kr@
z{^5fDdVXWcv(!(3His+6l3PSQtxZYnDE~e(zpj2#&wCMDAALHO6{lpYrJ113p|)*9
zgK9y~{Ukxev{v4AmSihj$xl6jyctWxa}*sV9Ga`Yi<jd>!ML}I;*9QjlTg!~HSv!X
zjP;szVeDFW_X0}mo(SnYe4Ep(+2wN2pgzsopx%XBNh>IFy}5u+ShAynW^5g<Kk``h
z1Gkkf1^#x8Hi`R%CVT&ucHr*iJq#2L$ufCyQ@kdWJ7nQx;Dtj8A%D2`wXnge#z5j@
z1KV>jR0Z05?5$C%$BI|tR_4d@kX1<*J#`<I#CGBq^mCs|Sw(m3I@ajclV`%t<i!G+
z#JQ(y<JT)7tL!hJfuCE^02!_voVC{}x51XUWubNxWYK8HGa$OB&ZIY2mSP!C#3SRL
zNFoqhH9s3(VpIr=t7Yrtti7=MsPYEbJN3%y%6o<xN$HWPSQ`|gEm`B-_dF)~tn@oC
z%LOCb6J-m<cr5SFCn|2ZxN%bRA-STin)HwRPK#U5+EeZV{MxNcnPZ)`=~Il(5U21O
z&i`aTS@6YZPlmvUX1`JWmTKpwto{k_^4^J99wHs;W!FY;81m}<GqB?e-goF~m5Sqj
z^XeT@Zm@_I3nqsOUQ1nUzs}i7&Ax?B0F33oHW)YzY`f5Gd;ThAy41f~#k1M}tID-c
z-~+<$;XDD478gDgcR50K_SSiVwDH6%YeCVpGWR@X?GJ)YA*24)9Q2Iv(bB@zeXP7P
zspo==YoSKALC1b#LhBbM<TUm5Aham~E6CXL=qY}6^8ycN`&*vuC?}H9f@_l(mW2M~
z1f!6`!Y*1fq-wzP$u}0HUR`rN;6qm;3{opHbJ=E{R4uNxSX2MnqdqnNI?)fb*j`!;
zN6|WAyaKWQ&BUT*@Drn$+$@2yg8jR+zwUso>?_Y#&z;uKtQRYxq@8Q^RUq89qv%Zg
zHlmU{%<Kx8_?3I$a8g|k94E-l6eNPEt+Ir$hP5poS*xqov!tY&DBbO`Um3*zN%r^r
z^zK{NQyYZW)fC!p_F3h*Z*o!J<~0)uL8Gu^00($Ug`Jc@{VXs@(I*6B*6U<h+7<i)
zI&Wt1{$LrqGkrW?%r#~B_!Dlm;}7me!~2PSQZt`}BUHdIs_gaLH3Xb`W~^CFOk_wv
z!l2hs2Yuxff^tuFE`bN1pPSQIBu)%RAV7N9&?O2Rd#Jxa8$9GodoeSu*y*ZO^O>i3
zaD)ct6Zqr^pgA><Eo?c!GrW<lD_IAp9%=c>RBX>?Ks*m=?0D!}+{M8AeF0oGxi@;d
zZnwl%1Wp2|Gww_zA<FooRZOEZSK&!ZGal*3!~(N!t<1?I^t5AYw+CQln=zH(ktvtB
zsRIyPxnNZct8nSdFFpA)dziB<?R6E{X#L@VUuVd#P#RSW0Y1;PRj1|*x(%7W&%4#R
zg`M>$(C<z}T5wFfqHd{v5B-Clx>PIEu$@(X8P}4AQcwP*=;hi<?=@e5lc52?GmOwS
za<Zv;W~=m!z4qYlN^v5L(vG#S-sxLirG3sBK~2k#n^L!BqVt@T%#LEV9OK=f{G-y$
zz{a*sSHBuSFLKM*7j0rvxGg(lQ_-*u)2Y!)D5vGeGOF!4J)e4O>lrN|Xngq-TrtE&
zL?EpE!=y^^h<yx^-hQ)Skl`$425vs|K8tN&u{JQRnlEn{Q~+iE!s`-`8riW9oxI~|
z%jf+5VN0il_{M3apWS1v(W9cTE=F3m8Q~8d736;h$Icgio0$m_9tuqoL2g!+_H$QK
z8B&d3iH%?fF&sX~5I9Gnf$!X1;*{js3RT|Jm_^ym3Tu4bVSi7tLkDj(17o?M>)3NY
zdKboG?%=F}R*1tOmsO}83z?`MD}|6?UunlMCy~%FfciV45<XfZ?|EgI0SZi|4qT>#
zgeF)o3Wa1AjXhKFoZ|2Hm{XJu+J>ckmAm?!QhOa{&m4oGpI4JDwO(9{kuA9<9!t!P
zR{yBNcdEvguPG54%5G5Oy+I=|G47=FZKCVGMg-k)Zo3_JMzq!}<92OMo+kI#TG(dy
z$&>9_(p*&wix_8;r(UE6w=!3CZ?R=}!LqClMS_C}J?lsjU{J1@CCI=y&19I)08+Lt
z##x}u5ZI#t8GLS8ligP&WpPH{+%{O{RJ@v>aMtPZd7eOv(wta6$MS>Qcl$UGg~u`1
zr9@zEVMdmMdzn_1W#H11xg&&jixN<$h%X`{gq-Wt$D5*0F4YVWnUF_KY)bm0L7wzS
zGm2X@H-JPn>`p<12PX+Q55<|qG_AstNAQGSx8fas)cx^ISr9O-9ZsQf*QoyWI;KBW
zcep1c!-@Kir>Gx=7Qn9W>)EOSZ(Zwj;KA0b4F}^v_YL>$<7Pqf10OM+CQ9|1FEWVQ
zqZra+vqm0(xj>Yi^^&w=W|b`ZL8y`T43*8Vi%f%b4~=9KRiXnBhu_8X4wF{2p_buL
z{8sCN?Xe|9Xz$Rm93WWH`SeYM%I7qk2P-hG9%=DR@=H{um}ID)b^r$zRut@1<Y79n
z)nk$OD$<fZCVx$ewWu&l;EKe9b3+H<spDC{>_)TE;5{X0y;HJP-5EM?a7>(HJf!_e
zpJHpWcxih2d!&9^<22-|(lA%!%|ojfElp^~8T6w%lIX%jYV_860tBq^*fbGpMl(=?
zdSrmh)aBUdf-FQ$QA>farfa<9>u1^p_o}s+J%7&hIu5G@y@fN#Jv;(7{8U;sBZ1CO
z%cais=oxbu3|#&uWO`yi)m#zU%ym=F-zjY-uVJ%Vx$DhGWcTxIm1-zk!svAjWdC!a
z`q;9P^{O=Dn5M#vRk6kLr7b<nPQ@h~H~A))GYg8C<0fYfwBWW|k#xQIGH-8lXODiq
zjo{DjYSoztAi7WY<UPJYkG-j4W0IZyZ2$gAebRPw`QfiMrE{T|KsCp)yPCdT>@YV0
zw-y;OZFYv30&0P=T(e%;>)?6ak+oG>`<3mJA#NcOe@7}5^^dRLqkbZLhOP>@4M>Hr
z9@M@4fv7S}`R>=j`lOUS4Bo;)ohCmrnw}-^E`&AVnVX!^W5OP4`mdeM=6(&BbKNFz
zKV5??@jtA-htPh+^k0DX&xcP>B)%O^J>I=G)TbKEo21xOHytzJ*2t)@*A~Lz08W$h
zq!besM=lhmb81&%`Kp<juE(Q93AgFsp4|qW5J~k;b2kpaDtF^M-#8w$(6`*a?4KZ-
zU$gGcO{!0L#h>&j^@CyVrB<DFQ-4Kd(+l*kF?eoz%ROe)`dtqw)g*;q@rT9+JjcSI
z-5I6D7h8n)lA~*Z@LS&TDNh{SQU@Li&$55sn3Ofyt(^N!E&5ggR31i16uulV>Fks5
zko;8Hq{s1qCHa=7eb*wW*ya3TQcut(cRlx-J^$0BpyhylWAj6B_L{n<ETYjxAr6^u
z{;YPQQja#5d_M3!qfa<;tNb37y7bVs>9dIiyR8-L1|bKLq@`f!xSFccF1o}c|Aq)(
z?z2q;w?1^O#4CZfX$D~~W=Tc9(XK;92D37uy3?)?UTd3ys^;=2XWUgB5x@=g5rI&R
zB{%4@Okli!NdZs7_AJ@5lu&gP%s)ts$eg|@RzUMweo1X&r#JyG`RY#9&(c(tdbPYB
zu`zo+eG?sl33Hv!$6Dnf-8G51O<&c+@g1$?vuwWbhdd<{?SFow-HJ%?HoLDaCPM&t
zRz6*Z?*DLpLe_w7Mey;i4su+M(v^a3T20R~bc#E7Upxf88o~o??}^5F9G=`TYTa`5
zl-$&H!iO;_sfp^Uj*M&;?_(=g0x^YlpI*v!SWAR$omZuVE*(FL5@`+zbM^G8;TlFL
zzkSz?D*rxW3W`{XReErgC!0KesH`3IVeG{^zv|909@&@=HG7)}=S?#6xuZql7>Lg7
z<b;hI9e7Q%2LJVd9v)Plv4Y%3ZAQHW`rXCN#N5as$rj2c(jen6P$;%i-+|`$?M#?U
zC-uqfkc>Uf)Xrdf3aze#xXgqnHnz<Mlr!vb9dE{<=xEd=Ytv$(ZSv6E4k1uC%d99u
z!Bds&O0gpQd@(!(nfR;vSyO4t<m4hcO~{IKhs(`>gSPe%ASV+54OcG|cgIU%Ro?dy
zJR(W$kNG-Qa<;MyWBzO@P3Qi*|6wFQRi1;Lk8$U^mtQE?Cu1LLhL|UAI?susq<#>)
znAKHf$$r4djnPe%e$D`mcZb1dCm!b(0OH;Xb!Wdk1rvM3nuMXF(yobH$SNOA33~d+
z)b=zC6X;$wT^<xU9!Q`+0n$8~mNQ4sT3t3KJU4thit(zcO9@vlL@jALAVtT%<)Hi~
z(&sd{9sJ|iubCyo376WZFIA2XJm>w>-0Um8c79m@RHnK0Nebd=NTA?>*&2^k*wN!Q
zpBQ-gvxoyq*{vU2lhJrj{&n#;V>*bsKt!R;<VwbFdj)*NoINo)I`^5eYvf$r%=jzr
zaDA2QEOs6rsgjpNVx7$ztP8IPJ%C(?z19=9BB&SFqGoxHgK-^fO9p$-j9eA73j;%U
zS_>r=i`AQ3Sq<M=n#AL`-{bI^n$^$<abzC&ex9@tbxf0+h?o}n`oo>a;DbiEh@&*$
zBa9TJP%_SqiovvB^}(|XBn-sz^*i6lEBgqwI_gzl5d)*kEOQTeLws7IhN?BZc-OB;
z_fiFS?#UXDGL8D!0)v=U#Pm>WCQEi4I{<8fua=mZG6ZY96ofVIKD(%l$es|hqS&l9
zXbs$bK8AK_J5|XWQhCLwKH$Ia&nST+lzNSrIeFF4VUAK%47#AJ*E|h32uk_EkYplq
zIp)5ysEw|E{{+=>q4<4+{^w7^|EJ~uD?_S$dbf}g<$n1?<U`xydnglAB@?QBi)-+J
z|4sSj!>nj$9j~nurzL-1V>H$Fa!{~e0AIFT?o`ZfGlvVc#uEzf4^d=rS$7t*T%h%}
zWmj&Jqbcoh9i_qR^J?>)AG5!wo|{YZ*K6)P+6Znu?Xi=){Kh{)`orfoh%`$U{X7fx
z7_?<?YLjJV`kJ3i%7l%8p3Avs+L|uOKaazmqH(}l0Y9h<9PM;_hMB(b?(=#%V8hur
z%LEzNfUpd6Iv`#q&bdfoci-Z)JaKvrF4r(6ZNu)w!db<i@|mB?r_1JrlaOD?3+qYt
zOqUE!4?S~ylQHGVB~?MG*M7HE<pHtss(C}mIMqr|fi-EHktkvBE@9-{EFS^Ub%~5k
zX_i80FSC=r7WZ87Xycx7NrlK_#%09z^O#u#-NUO}mW=&v>hDCg=BE0e@A}%0aYVjx
zy;;n*!yxIz?p5}%zyx%e?6RO5L+QNy-Bv6nz~(c_Go|k?&uqs=GrT)21++e=JPHXZ
zYFpH|4`D`<wmmDj?vj~$DUTd4ON+OfP^_bTzs=9;RL;S&)nnqibm=!Mq+3Lsu(7Y9
zOkEjGf9bu%T2p+a-d93S#MHp!GD*k6y@g7-pmc2bR3!0oMQK6mgk`&7qt7&L+%z*r
zh+0#mXWyO$a6qz~$!BjOZVoB;tk7&Ql<)s6Q}Vvly-c!Dk&4#UN}vpX_Hk)geD3Y3
z$!rm7<}WL6j5?y&>y&(aOHt9{M_*f`rER*robv8IiLzZ>)Jb!<Fc7ZBGquyBpl(ij
zZeL#^F@%zU*7)kb+2y#;+U8{Qg=|^ZXNAhM2NKUk>&HL72R~wyzPF>$!lr!iy&xZ6
z#VS5Tl>sD4(JY8tc`O22vW>I+)I2-zk?VnLlVB|3JO8^UMt2gom}u2o14q@L&Fnd{
zFA`~`J|tJ#>*&~c+Wt0@@yyqtiR^boXq_O92A$9**N{c<@I8<Zv!D2py(Q7@)a2jc
z3E40A^0grOy;;0N8oyy4*^gd~(GSnR>r9VM2p?{8kyJ5js7idD7MM&Nt3Y<7NvFph
zVX^e2gse2yojW&RdR^#U*n^?ihhuqyLz*73AeG8o&w>Qvx~J{G+6_mJwd9qcY~*P!
z=7y!_jyCY<1minB8B@iU;g3&$or%=M-&tOY7Ng#7PN;z`WcB%9zqD#bi%09#dx2ps
zU_HnFma5BZ+j{Ym1K2XrFWhbwTo%-QC?u~d!!BeC3l=Gry3DI?LW}ZHky_lt!997|
zb+;{~kWi3gR7!!oyN0|P@wTx_WlSTt{2QMDyW#`XQOH<SP(lP7X+FAHgwZsml%5Uz
zpn%Zmk*nI%3F+kArYoK@l`ScX+X9u5_MhZDu-3g(J71?hvwv91PYlS6J}09%*F$i^
zYVPRKd=N(87t+JVY&JFjXBR*%c#&Snmb()kky4e>WOt=IRNbS_)E8rxIJ5XJG1ZE1
z;I)q3+S9qWV;rQMf*hnM>*saj5B0B|X;YAeA$AVW46!g^2Lwnn6B+z<g=B+#;z=*g
z?(;7`^8aGFce1a>T@PP_5d=2*_$`@>`_nt29eKINc^V}e3n_}krbGQB31^EZ(rsAb
zlt<}X#wL4AiAZ-MT<>y$&nOfUn2_3)O?e0bI5t{nq@6WIuHwI9$jahC{ic%zK(hcu
z&%w1J7WJ-Gfd0X|PUG4<KYNT{RIZLB^z3hh*FT`Ft|GZcRJOmQYP78ot@6r&W|Xt<
znc69e*WPtV>M6?Jz_}CKB`Y(U!rAO{p<RoQv`D8$-Z0%}52!w;$cQtoD4gb23YJ@p
zNg|B09ox}*UaxO3rF4zg%=nAdCO~qTKAdlNS?aiy+EqZ0K6c*4@Ueq2-&6`0Sz!vz
zN61A=^Xv<~(@V2-`UricgSpysv7V3=+1;rlD>JpS7y>;S^os%`3Y{t9neA9=mdf6d
z;)0Z#-ur_^vm#3;XZC_pukahUsC8AMHmg}BF6x?CfRxNi99{gcQJcvHMY7lWU;)68
zw6#JF8=sC#MGDn;;D;+4Nm1w?K(0?EyTK73=Z(1D6VyM7RKCNF&{ZxS5FfvnP&hW7
zyxjCbuRLqXAW*Bhf%ga~kaTN7qU%lO%XfWV|A)1=0ID-v)`qd*1b6q~?(Po3-QC?S
zkOX&k2=4Cg?(QV$#yvRvJDEA>);Tj%->qAJttzTs_TEdopVh1T>GjTpNl?zQINi;Z
zg*mZj>5^8OEQJIWhAWFR`(}86dvL~UZES^L*I$LUSsH9|t*Uu<nZooV?8J8?7%dc}
z;Aq|q={x)5mDqeR7Yq(1F*@XIf-M!}Y>1|$LOj~f9d0|4ps_r{|GeC=uh!VP*P>oO
zc3UoHag|;EIzQ|N2{Yg;I2aIWg^Hi6g^p^AQ6id-W-5y-(o*i^cKC2V&r=Mz;n(6j
zB_5*7D;JH~6Mb)NB>WP<&8^}e@#TONWy@KgOWc}3a~nx?qO<3WC%EQGK9vsDo<RH7
z7>6Z4<mlCvjqkZ$WYD?SSQDTmmCsM3weFr&%~skV&yUliI>4LMIs2HcZFo#p=$dHq
z7&<IRGt@seUFF4=K_k|b{zFRu4MMyzmu;X9HgBx5%O*7wg8{>gL?{FJ(zS^z4N5{m
zJmVkbU&-|;fB4O&%ancfIyhU7x6{;1%8%PfT(j}Cp|I6a7TF7vUhHk){?gQzB;FCS
zG-#z$LCf~3q99EzEUrg!Dy+)os?b5CF?b^eJFhf}y72vv6sgFX=Zuo0jG!it8JY71
zZ45=oC@c~8^~uVkWq7Gw6Z{vaOTK#1RNx`lQfVWCd1I@(wUp0o9L{wdA>#?FL^&0R
zXV7J>hUcDMijO=Yg>$B&s!e6ipxE@$kjQKG7PNWq@EckwpX`RPty<?j+!OaqcQ&;4
zBaLk!WOIQhu~vEspRl3|R7V0$EkxMYI0nCm)OtXEtdxh}R$T_&%Y7%N$(@r8wv^W7
zjHCb#aX;DN@_ke7LZNc@@)x8`Kt8HsNCjUa0zOLHOvcBK&AjE)6`hIG)bV_}UI>CE
zUwl-xAeJBE@6po4h!<=#B`cQXNPC9IABs^-jkJYf2M0%~F@l0j^NGqt-CSLS6Bflg
z%`dgtNfrVXqwHp+hPVfvKQyymk$A<|3!Cm1iO#_&dg@eeGb_+6LC1T3(K4we>9-eY
zc&TS!bU^eo+knLgk*}3=fB^e9Uj2@&<XjUY@!e&kaXqqBYLqFr;2mvN1%^RYKi&Cc
zFQiUGg^0gOMh^K4spk^5IbMYaE1u&Ln%@1G?XSXhS;(>wErP!a{_UR}w9#;x#W40{
zsmW-<cTFcL^u^1B$fX+$vau;K1;A}{_mB=(C~7ztdj@G<RL@?Chu_^Y+uzh2XF44i
zGrRV!+7kn@NzcAYZB@N(|GEs9!z?BK>my!om@xCbb>%928J`}4aXbj?oq!dICxNuf
z_G<0kH*Q1E4}%H=a-=y9X{IMQ*0aMXR?A)Sel1Qg@gG!1uA#x0pFC<YJiQS%{I*ai
zy`ZrL<Du-8^`>}+-{q8l^;>T|At?1zTTItA>*%AelfFNGb#Hu-1gT-)d526i+Yb-I
zPvCRss>LaT0@BP&@#ECfDX<PXIYlSPcG2ppR3OZ`z%HmrJt?&#%JGvJy*!ekrbgY(
zE9V!&T!-9vE5(SW%Vnj$&xHk$XUU~ybah$Vk2M_2UyJsP;wu^$e{5q@#vM+|opw=_
zOiAY+eX8d7@}WU^lWtH3LpAqMc1Lc@3dO6+v+eQ<mBP>RCHh9{L(jRB5GzZFnK&Jy
zYgZA0I&_q>+O>c+Bl+dfyIs@$naEb_%{V!SV!N2rR5&=4cfk!h5n&VWj&_zR{ioCj
zIOgExLZp?V-}Dp?7kWq4hybOew7-=t?d+9gjlvOrkxP-Bi7qSNY#dW#MDx8`+DrR5
z*RDlk)pzRLnu7SuE-jHQPZw8763;csp{6{E&HPw@K5g+3&-pCX$dNNs8vFE<am!~l
zXf_#+!ee#x>zGKhrs5CB_OFDt+(K>a6$L9Y9sIZe?h&aJ3xS&4vRjyG@{vQgrhT7W
zjY^cJmB^)^OXe0y>%D`hY?#M7<fw!Fv;oWrU=AsjFlE}K9{v4X6HKw!@;)b0b+mbo
zHk#o|ecuFTSBK2zAl=Uf2^mgyqA|%*wd62S;n<9(JxOeB@@47?$-n054OVJ3dNsL}
zInPz0-Yol|O9Y49k3`g9&vA8z9qmpNWfuFc_Z)&(&^}%vbbgC!`Q{rRU&vCVJQnhh
zWv=45RO-E4`;CPk5-I;^#rB7K!CEht3BxV^49V94N5>*Hk&3pICh}`L%Bz`uxKUn`
za`+AemyOu*wuUr;$v))&@!<W25fmSfNF<c-{GHvRB;;@a+DRjQvyxR-LJ_LT4H`G7
zB%MeDt616^cdUp{TtrAgysk@NOqK+rruZ)MTyA`T{oOaX67!nG(fhn5j$qw^TX)@o
zLqn~n5uJG_c%!%=*GUsMZS_NEZOXb>i9|tB&@&`cUOM~PjVnt-@k|r12D~@t0spg$
zn^JU^*E7{V<%G>~!a><Q;FXVZum?(S3=x6H+$)U0>v{jv&Y3<$vfzKC44Z$mw`!XO
zEXrxPA1&U|Q&T^{jWWFQ`adTg2aUupCOOah_;IwAtVt)QzshVjMgjK-BN=%CgShzP
z?|N`uS`5EjSA?^`^O(t!>-J~fQ#fADoUv-B-oCRj4^3zRr<*V13*2Vwx$#Nf%U`9x
z44)X4w}KL=wYFE$lR(h{#yqx*{d!JN(&`ypU9XZd)$~6sV#ao?=RN7=#=0}q+oy!j
z98tt#@0)z%4^Fl&XF>G0CFV8QQQpr@GBiTx+YlU@)XDA5k)z+VI9aqtO1y0lFq|KY
zZyDlmU4&r`jCH`hBWR19)67O_<CtEip2AoBGn#7$s`Vh`L7iUyBR}`M+rm{;i_o!J
zu*;ov53X6;^1>3@z`|1P)>(nn=RL}AdU~BK6cj4V4`NE#?VaD21YGi@ohNdK-C2ci
zhbC)YJoH0-K9^95fm=+o)#}dDj(rgB<IH&>@zyhPSCQ9unoX)(>v7D3Qli2I-i|$)
zUhkG38A3Hw`=J6JcB?xQuc`>rPiJ!R&f4x!92_cH5!u*8tIpGK$lE3Sc7U03k|Fnw
zW3uS{c~_1m8p^*j)hvSA6n?B&RBK<|RnUNNp+W{i3*N%O-NK#vY+Cl%*>O~|Fj|HY
z=ci3>5hicGO_1|&Gxkj{BIR^vwp=0kny73hC-odKIbAqsw(I8SRlKf=UX4pi2r9$+
zC?%wP=;-HiL@`{8IcFMp6dY{=Pba<&-N8!QE_+mZRXE|tx>l|MUdP)awYwCl_3kUe
z4sqObOqVkFVXWhzRyl^5=U_B2iUZ!WfB_Yjk}qoh){V9+mJsox`d!I32)W7D>g5@w
z1Xv2-W1Ql<L>&(&kP<`hntT&R{1~d9^>GyChc|Lv*;sSz*i;!Bp7fT*E2%MCwYe2>
zKZh_KsCwOXenYeUK~Ebv)unL#_UJccgszS46Pz8+K`|=2vGeSrWZz7{TnBSZsm3b@
z33eeZ-82@bIV3Q;2%#Ulgu2W(FWrS}P+_xCS|m#qg|osbIJD-7N;^lyZR%dGoF(k7
zhI()_)Zgza_h?F`P>_A~>^>0ErUPdG0h@sW!z<}gHP^Phh`Gw>Hm~3D#%bXObnE>b
zt{$wf&E+u?kJ+}d%}<x8;!vxZDUM_V8gV$gOhBvZ?bkBI%<h&j)8!|{R%h;ph-xnV
zkE#<jjTu8FrVFSR28s!<_lq(%o{kOaw6Z^O8>`IJo3iA3R{aIOw_Ld>2WJ<%B1RVk
zd7Qg#SN?=2ZdIWZu?H7%e-7H>k(J4@n&DKy2@uQ$a>k@w@TCTm3&xIV3#YQgC?Ak&
zqSKC<6NyB6Ob8OIQNjWF+QebHP;3fa<m7y(1AS$H-iOnlauoRqOvD2ur6<O@uv6#*
z3f>gQ^1mQ!(aDE2)6!!>`bSl8ngk=eTCWC{m0?H8)AT|pa^^C(+S@mg6EAY%Ri&|!
z85nJxMgBV<dE`MMawNqWFlt=CaOA$u`78Ea2{@J`G8W~r5!#v13RmCeFdPO>r@nXl
z7<FvbQwVwMNp<r#Bh;<yP8w>T<6?C=kmY~VME=9fIgJp6(>4mLUf7|TG470WzVcGk
zn_;v0QNn?m3@e3{p~aBxSk3{XymZ7cRSQW@E3BDRvyd~@-9pB_F<g1ve-(W@*6kG&
z4N&P9Et-5DYZNQGqPhkUcJ|=rUD4!$Fs7|o_5v893sHhU#EuLsr(v!<j^Z2gv)+sr
z!?j;xbhFj=f;ZIrzk2v0d%|vcJGJY5su?L{An{gg7;rEJ-wOL?heBTcF_ZPx=F+Iy
z`jW)wnhCqSo$@-{(sqI@&h(f<(cho-{Jpaf<T`&)&{b!(nQj1`c>5RzX<%dcLTehm
zSp60FMFgguy6hH6%xP%>LaoIQzC`ard+H8pT=Ph`zIIgKJ_g6Th@M+C6S9Q~U5)IS
zEK1NNT0P%|I$-c}X`~*2_AU9WGcqeije<6rn`NaSN&;4S<NV9*gDueTYcTc{Cr>R_
zNE~lj9fT=THdS5#6%wVK7@hX;`jM%HGq<E47leP1*P<4o9wgBA<y;hZg&7riS-Pi~
zN<TktuB<pN)rbX73Aua{EKID54|9H>N(V9p?tFDT^?Cai`Jx5ZV2Phab$$Qfd<uyh
zu}T7=DOcx0qVWP)%4X2Wp~8lh9M^<4f3!HnaHzThMTy?E7>+HK{z9B;81ufV>@2LJ
zq9P1Ta-6FTalvd&46_}58*drLE;U65R{sE0a+f#@Ws)|8FpV&?)3JsZGFpBd3cU*H
z<Q3$lw@t|m-bbxvoHghvob>4VoEC;!tAy!nv35%xbo;qwkH#;ibmiG0Y1p22n{BfP
zn{3~pK9X4WQ#W!cJ)Kv*v){MYco**_)>sNx#rTr$kb26!NR<P$RO*a#m8`lg-NvLP
z%?JBQaz-aB`qwyl5o!8A2>kFvi?MytrU8^~-9ghMzWP8dtfL?Jl4iY!`9Qf(S3x)s
zQSy!=-<k8PI6TX~Z>wuAw#|UGUNt&H#qI^1s^2cJR&?fThCCgqi_Q|9YZb{8&|T&3
zO(@?CdNcxVL+9FApHvEAK?utj;JKj9TGjgm5DvxmDqZ9|bmy5=O=l=}rYI0?02(PM
zbNJF~oN_2Y7*LM$bP>Hd(R9HPdsl#-Fw~Fb45REj`P_K|R#|i%8Y&&b6hh4$DXkGI
z<}!ME&3cQ=DM%6Ssd9aT8WE8nyD{%zQsO-4IJM;UiyhK=ol&^PjjT#e#e{t1+%Rwc
z>G^SBOur5`(OfG@>3SGq#uC~Uw>`xx_1dJ2+e%Y*^zat#7T2jmS&@(SLUZ1YRZ<LR
zQAMglT)t7K%Im}ZlnNNiK($+bD;rrOVE%evbAIE}Eho`>UMi_LX~)0vehQz5ud5I*
zLqSe1*wisV0{^)CLo>{OIch+V0IbmU4GpseEZQZ9bNWoFhqAM`)YLD`{t(OqBx2;5
z_ta8<62#)W407Ygaz?*3HnN9nnh~~G)OhW{A+|BhnbSWH&nR%QoF`+4%hy?MlQybC
zTsB<2`ls!p$8>8_U>f(a4+fTgqrVu`1z8$~P`zmb4=;H@_dAm~J$PSBZ-OFyBW6-1
zj)UB*6QRaoDT|U2|FxAVh4t0ywYOk_r|MlCSzPa^H|tjF)WkghriClCedq8X0s^HQ
z`sG<bYJeyucWvm1HsVSNTe2+-?Q@x>$c7>S7o=AA)?B7vDKZQ3<-6+Yn*-8JsBVC5
z+LRr$jk>s@el)JbWkFU~c~MAH{DzaykmJ}l6u5a_);nY3+M+>3o+%SeCfBcv5}HZw
z)wH<YF^+p0&P*aIZJ)ckIj*3+C##>d-r&PcHr3bp21zLaP7*i0-cS~@)57(OO9(Wi
zHNE4l1<n(;_1_o0b;6P6Jo7yC+9QoLv!uU&+*2&`KH{dWv~l2Ltu3hj*^s=!=E=*g
zIaeQL#TQ~W`_q?Ag+i+5iDPECil<dBW;1R&+r%b@;b{W2aXLmrm4(EZSS;1EOpW2l
zBcj4(a9I$}TWbxM8DA;OS9>XPHzs+4tTmmYgRZ<;=k){`6+c|g?C8RJX;jT4VO~ng
z@I^Esky)<?eL>e_z}dJ!J693L$Lg%~c08wszJ+<sz1%sQ^!;Qi9_j|Oh<vT)qEJ?{
ztjj+6H)jB+281fl3j6!fzK&$!2Rp4jvfA_tF*Q1ub6Ne))P1?fc5i$)6!qXQ<nV1%
zQ}Jw>eWs<hrCQmu711bPZ?~$gpf=QpxLy5@1}D0IsjQ0l2H0)9hG>yfqdeDjFiWwK
z$uz_akp=cSu@}`3_0{znxDM@L0c2s7KfMuA$-%;lq0C(b`Be(!S#Q4?T6sW**8Gsv
zVf$V`2KV(LH{~hgkz!{|Sp0+DNAlr(DVMOl?Qx%GQAtKUoDE;y9@j2|u`K)P5(WLn
zyk@nmcC=8GOdLf1NzoK=H(^3-3G!8wKmeMFr}W|jMCK|>uvX^S^HhbgQBu8o`6B6;
z`hv#1OT5+yc*8QKaFKH9k=AOqd|()=#<A)1n97m!@e+9CM{7~0y7hS4^z3rytLX~a
zk+^xMS`ineRdo#N=!eAlm$WM7DSkh&jEF$ezY?eFNTwHY3IHwc_iu#754{9>a4mRR
z3+=tu#W5ReuE)NVd+vmIIOlaJK;=vlqf9pMS0Ehbk@o4JOaaV?DozB6QTkqU_~dcH
zC#CGZql|6Uu%!=4he$b<{RE@s#XhEfEo%a*v++s$=c8F`y$uQ7GKCXcd0z9o!}O9K
z+%aUWF*S=MPBjbaET2d<`I-t%jg{hb*1@HP+LZbW_3H!pqAH_pp|6B|=sTj-ajw_+
z4Uypncg~%xlaWEEG|LEIuG#ps16TUaA_F-g(+03Ub7JT(;s8<&-Q!%?YvOd}RCJ8z
zB}w}n*3R{$_KY&AzM3m{#YBtEmT6C6DEQSbl!gTPlcu*D(Qx$$G>Z35T}7Za16&(P
zn0uqjT4dnKA`ffRN0$J#@~N~mYEOqRM9T}xyj<)YNk17aS>Saad>o_ckhwhoq7JN+
z&(Q+0US9w`s#P-^A_LnFR0#M-HzF0$kTG01%VIw=XT=QR12fHf2B$SIN1-cyo!nP^
zH&NWOo74(nt49aL-D%+jn8Up0AG=E78d{4g`|2;hmrT^x&US@XXb~uJ1T1(JI_ot#
z!l?4s4o(<t2Hjaae)!su6d2{mg4#cHUK`G2Jx(G$dis&VWV|fIn_?X|>LrQHE|j}O
z?eykR4Wa?2siWzTaGGO1E&;W%y7q8r%T(Rkb#kJbE4&gMeCz;^WJn;#7<ouFQz^oA
z^@d$8VK)Sst=>`W9XcCo;`)Ur^$rv1=%cm<7u>UD%JB<ZfgcI%%%gOm$2+yC3Wpk*
z1?ho;qg?$i2~|>bO$14xT^wp1l|Cu>Fn1(j64h0bkUDZn`8_t!-g4^4Pz&F2f|{m{
zZ4~)@U5*)V1-rke6U&19<?*<QDSZLEd<`LXG^&>+ik{E)&2&QOVa)U{G3X&6BZhWk
z?Z|tQ(~qzO{hTx{-7X487~YkIN#P4#XwAm7>ro1>=<E1+M%0K$^fDogg|m4<l%gV+
zq2nwu+L{ox=1A&6S*ccdnaN;LX;z*n%#03HSrwHjV2Y4k{?N2cy=H%mIcpU%)vGDV
za|a6-G#<d35-P9zBUvh39*s|s@=oAP%VG4iF0F$4Rvr&Bktm*ZMoME`F_aA5hR#Au
z$66@YX#_blMCHzviw{$&X)zg)EAsKGtpb%Cu$yDBWD@D(rO;q4$XDb++!l^Yfx;ue
z7Huetq=hAm6c+j|4a!`5*zS9$LpW_WUn4UWAc5>1vbJAqES<n@LXQ`LpD@yp^05I@
zlu|5mg>Ny(l6iwt_IIyT`m=i8ac(Y6lSIJ$4L=*6j!AL?OQLjYxvIlTjoY9do>M$A
z#HhsJf5&-2iKbzYE!v!7wdnB;)m_aGVYNL`$copWl}70RBA#EtKXd_F<u#6@%Hqhl
zO*e9tiQ6hs33oLGMv7tE-nS7l=;HiXA>w|(=y@2Mb5A8Qu=8X)@r>WJqb-th2kbx1
z=|&Xn0O`K!rQ~TUmwD=zdoQh~8N;ucH~bsI#zEc<N|+vf7~LDP52DWcMUWRutxwq*
zIh&4?w{lTegys3_1dF<Oc<Z%+6q8QFJQ-Fi_A8@7(z2`^PM>K#Qqqy6w!6YBo@5=%
zpO9*J!a7c(gf(rVtI=cEbZJOLLk-YDg1lv15h&O}**oh}MxR=H7NzRHMK#(8NT4Sg
z^X85?y4Bq!uGsYtr9e1TNrNE~+ccOARG{iQA-)*!X-nbk6iSIMswl-0v82?NYe_PW
zyx*_u=$&HM@@1#!IC<ts>hHocZn2v$r(iNXOLSK|x*Q;_v96>#(fepOCeR$UQ4m3A
z+=OO7J6ttk<|Ig0k<GTbv~@F)ba?~YW`;vIpuZNfr)F>r5sr2Y5!<vheR@ad=pf_w
zdElK+hDmjK%IOe9{m~jleBaK6ZQPur8_!SlL$`=w30juN*l3enK9zlX6>HtG<$?vW
zhU<rmYx}hHM-Iui8nl^4)A*7{O)4=q8>$ePZ%%dc)_I?pXT8?{B(i#XMN!cOg_l9w
zYP#W0__^^eyqaN0qMpspZyoBgK8?lej&T*D*UADIU3rnbMo!wy1Z0Dsi}=$xqY1Xe
ztO+w^Y4R_^(u2-Wn);{anP83;<kv11QE;Aoqb1QL<wM!0lOpZsLf*_#5S;e%vXUa2
z$H+?x$c)uaGX)}L*}dHO`JPYI_9}_v@p6&Jz}T1ED@)DBT$m9v;qy&SvS5uCd??gP
z7=v50XZO*AUR|6coO6HD5Xh)lCp(=~Jv^9sT~tmTV>4k}_ldaA22M=cE)5uay@)Oi
zl-ykdc`DW9gj5oH^(T?)ma`6~vpE8h?gd)u+iiuNYa{gVT|3Q;COGwG4NQB?3+&&S
z>$n$3C>KWIyEWmaoHCW@%3=?c@;vAVAUY=AnB#+BnVYUy=<vR3-Or37b_<WNB(lp_
z5K?^|<YJ?nlr!($YX?EGF<?)fCJw+JYA)Hf1>pIGe?##1$ECAKljwR{fyXhax9t1L
z_RJKJafd9m9d2hx!zB|G>-+rb&?I7J>fW3FRxp@I4veSxR7twa4>1nVlM1I3bWD+V
z@DE>q$KgU;lpHAEVZUfMSth#k?ROfoZb@5M6HdmIze``*){<9&ncO>pJx4!;ol1#^
z?1&DT<ymWMh=K;P8KKFz3u-!z6X)I^BAyo4hmC#_qZ9&gHQD2^HAyCjE8g`umlR#X
zPCNbdZFP8LzHPTmuuGKy+BAYLRy=i?@&wxCa77tsaK&2(_Lqy7oMc``97|4Ew@Nxg
z<idfDEa;SJPuy%|!?u~wOCv%mjNy;#ylUP*3;W(=BM+KdQ_*#rqP*_n)e@dPclF2A
zk{-)`$j@?OS*b;HN`bb`99I|!smo6v`Z@!`?wwSguS!c49`vbP7qZDMbCo|uxENy}
z7K}nO1ZBVNGNS7Vgl*)9O9L<ppIwcvR%+A_ds8DxYHwLaOhW4&*+b>&C^rqP%^7$a
zaAh_sD{{{UHgo98&G#^GL4J$~K|}qggB1kgQ@8m$P$`#MTJDkH$!;$sT5c|bqb~@K
zbzw;z9t?@e=t{f8{Hv{(#9o6d_1X_>9V$%AYiQw8dJb3Wm}Pt0ZKx*r^Hnhekw6!P
z#l9|hMfGR<ibC|HTgXjl-{^{S&Tvwztbp(nHLJa7oqK|wJ3Kg964qtlTq%ai_e!J2
z!;6pSm|mY3DlTEncG4-#ofO!Ih5VeV<~P~cm4llydKVwzSDj(@dis(3o{(Xt?>u3y
zZEC|BSqDh;h6jtaXj@$(%)jDSTy5A(W__Y`5}B(s6V~90M)NS(o^+r%^XPI)Yw{t8
zq%psmd@#Nl+Ior0@>m=+eWc!0DUC_*R$T4Ikg}oCayts+iWu68sK#i_m2jI0JD*x&
zuaOH!3LVDDG!q_A<`agO%aFh&>`aHm$jswd;+KWXN;W}$6Q_H}za}d`cI8(Xr6$nY
zOG4X1hTB-n;yuqtA0UDxXqA;Ff$r{;C7pXve0D0Q@=`2~lq%I_tgiMM0A6aAEVUW*
z0^w!zpz=s!tTEp&`gQfm^6NU8dGRRl%|!`Tna@R994Hp@{#JYw&Bqv49`4|(ep_oN
zu%tT6bTP|YvWe(*FXM8=6sH{*gYb{r-%+@0?BQN?7ewea$1B-T$J`ie#+fn_95Go!
zh4O6s-yJrJ4#Sj&Gn6fdvfcE4MrReIy%&$3ITk1@H0L$^b|~N<t~*HeMcLI^rCD@s
zjGmkiJ@b1!)=bKHt@TrSz1O0!n7kOCP=rTpDDo!tZBOKajjLf<dQUSUulyWMrzChd
z+~IN--A$%Mek2=D$JBrsq)Q4n!7{pGNBz;z4M!f-tS1F9O~(J5wm>*iYc$NaIOzN@
zWIn6CxC!NTn?9y&e3#E^bea#~W0o&I0-DQVXvM}TGuaudOA;DuQ@ZlX=SKLeK3PYv
z&NO__s1jQjLB|9wKSrhIl9(n*S1&+q*G>qPLpXrvN62PV>?tqFCxt!?3bTo;!R%7X
zrMV1ypIBF8K3mV9hF%&ozymlDXm~{^-g;XidwGVObs|5}_K=f6f$bSoOu6V|vp|D>
z$xfTl{WnJz%N20cVjlxy_a)zYuT_!Jly19RyfHn?JJbgLlAq2K9c7V%6VdxMj1nQO
zhtfN<1<(k1JfBO?91_Y?P^r`gXmu}0P@#j8XDjvT@~uqy^O2`#spCi9hou`T?$|`R
zVvxXmU(a%t?xd~DTweVioiz7_M?>MF(0HS(vM@MXZNCz9@xf-~dl!s>;ecF0<k)86
z4}E7zR+4y#r&v`z694+vHJH-<@w@=qq0X&>54zNCpRLXacOXqggPU8(J#rT{7q~Lk
zeH6SdBxqXXf>&)vO?HDbJ)2Zf;`3?4lY+*Sk=2+A!Z^-ax}aW{nP=GEKC5XN2S2_y
zk*L&q#fU#TZ3#9Lioczy#Z3L^zDLyYJQr*MK((2;SaineQHy9B89x*aJ!-b=Y_qtQ
zD)VCT@Z*~zzAwedJZXh`!Kd70GvAWQt1{fcWbBmB=82XjrDXu}!4<jPOCkziFZ8VG
zt2%c=HIASdelgOg%!dQZBf}J?pXU-%MK>!<H#rBziDCd~JW@r_6UAbbez}XvYlrhg
zWeMiTa-Mu$5*uELirP1fY}s4Fbjh}NHZ2`lxqc#*ciV%+han-<hU7&aOxk=n+Xa|p
zY1|ZAx{7vts!E0mZ4pUu49dreb$G)Vv34fml2M5yYznY7Kl65ni&~$!IcTSWaHTpT
z)Z3d_+^0be=u;DF!~A$%a!`_5Vc62u&0Xy2Fpej`W=}g)po`XV!LQAwWueU#7EFwq
zD!<@qcPN_L!grwLn0;J)x(#Z@-7?xROx_C%Rhc)-PyJ20O5#eih!Hzg+LKG?dm{M!
zdc7E$T)$`oGev3WRzcpI?7@_6!(@fP^YaGeGXgr=McZ&ma>>KC9RsaD#w{*Wl2Zpy
z+WMD<U+AB&<)U;{ko~i8J(rrA;8}fMH{0)c#^K#xoKhfQ>Ih(QfO&q5OtQ~m`rT{y
zz&&o-dP+j?#N+ZxiuaehsX_d7tti<o^HD6ptun1bLmhg`ax<LAqP6XE0PcPJA%~Kk
zS}}cS0_`^4VA#9;hOO2ySI{D|1$mnL@QuVt%(f$vr)I_`TrI0N@qoQX`Br+C?W_2i
z!Y*@lp>+JXcm|!0Z}HXhF|DiK#ZDy>m5P0ZZyCB18|3WB%0v3Q?hdGJ?j9DO(_8^9
zEt*I;OyZv&_B=G^9i5kyZ5x^#MQuzCV6?FvHuS%e?>-e~gci4!Uy4sU_f(GHY#MQR
zZmGkFzXq1xkG+b4>i^`h(Vx&CDC>v!*Ak*wYqzfvOPKBgK@6igk1WD;o1ev+S%0=(
z?g$uEn`mM%dfDT@J#$v&4_8=RdfD2mdWxLz=c5VMNPPdTZ#0Gu#w4fQ<Fu%SV~&vQ
z-m2foEkI)c*VpTXnRut?-Q#(w*9VI{s+ve6!_@EWjj}-cd;89@GD%=7R~j{_Fx7Au
zmpPQ$L`4A?V#FP-)Cg<gJ6unJ?^qTikvj!tee-TWa(UY=R@-5#d%nc{EEsBwL3=Wz
z;!M$yIOE7o5gV)Bm$?y<D``#tu;=AkO*U=z@Rd`scE@Xrr#hB|Mrnn?aRg<>FGQ{5
zPY(jjGo|Yd35HwlueCb7EWOU;rC-15@ctasYgO06yo&8T5#3WJC>jtbHzIKxp8T}G
zKT~IeqGWP!n@DD0!+LJCWUq|2WN(<N@*J|UvdOTI^eoeqZIY91&AnWyI^M;fiDBq;
zZcE+5LBxeR_H&%@d{lJR6z7pIN3=7sq$a9P8rs}<e8etO=|i|~B)x%p-lh51o}>>O
z2U5^*#&-J@?*(F=5|spCr_>M?pQ;E@JPJA_Or(P$lF)Vvwai5hL^baO##^^mP@-Z(
zjaCxZrpUJYB`u(&;u4~lhsmfG-j(b_u8uEI;JbQDIBMF8!?d~`xVYtTS6ZL;^}Mz;
z*;Pnu$Yu7bDSzJTyy;EucqNc)J%pGr3$MMrM7La-xY*Pp0L9iPjkG(Yzjf!4vv1r1
z+KupkWWjJ$A9L%`ht=85U;YSo^O^I?AJ=fHooVq%s5s78!-7n7@3Nr3#pNF*&1XbD
z+I@X^KVyc4j;If~-mi>{dlsdfe7uryd7O%FrvKjFdsCN@rJ(qRiw}m@X2o+o!p#HL
zhJM^<H?ZA7QFeB0GTCEyELuzk99z6Bvdg@bhE>FVv|fR8k%&X$ZWaWijd8eE(GjNQ
z7m5Zv&ok0oP0%aN6O9t2OwrMBiKUu|{<+G$;-LxIUL)rC?u%!rZ~#htjnUhnbJ{tV
zWqV5L`bSAz^F%<uDpQ4<X9LTWxZ-7`b4jpBKZ}SX!rvhTA`l@=G+ki#@X5RUAj0K?
zBIdg~0<xMFno3FYRBCQB5AWni=4fJ%yefe?%B!3*#EqPxs>v8*9;7VGa<B~0UA2Lo
z*Tu%5!VT^HxWi)@3)A_rn~=5AW+jGK3!h;hq!(9s#eY`IRM}H4+6iwgh9&?TJYas2
z2rmI7Ums!*;3S~;Vti(Q+ks!o{EV;tGInOAHc_;4gn2`fl5M&7HnixEHuiz)$2pp6
z*9-aMQT<n|o<&atZPm2Lt*DvPC~raAyk1P6OWYY!9?M&WvnASz;rX4y`RN;|vjQf5
z!yj1fD{ZHk3^TBeyeRdcOlP34y<XJ*h7}qJ@efvTZ)au^@C(tvsQip@BiOFC8g7q%
zmcS*a9M0ZITvnWRR<`XsfpkkD(f+cuwz&Oufq;5GH@AhmS+B;ETtCHgGcEbK1Ha@#
zzjR$GPqner={eW>9}f%lM2s6AjR|b=h4MJ3c35qiqo{5LO{Wj!Hd1|EnOsp7!F=rL
zWAHz~hG|jw&2q{`R~gC?69lSLtPYregpVLPU6%${z?GvdzH7GA#u{3XS<+y>{p}dX
z;Z6F&^dp3t>cht-OWc7+@eED*4Q+;*qaw^%4CSGake%hU^^+3Xrbf1Rbhap_7Kgp`
ztZ*_m1t%jokAwY}tRLPNy4u@*f1E-r?=s^e&R=(NN#P)<9w=E#R(yN&NZYXJC`s<e
zc+k^eV$onYWZKcQ^>)Eh<>{|?T6AYqrkH7t1+_(uQyzU(-d)mA!1enHp<T3gG^HDn
zcwJN%u4yTy5FJ+<VY!&v93kd>RsiF#Y1eWwFT+^5>@^o;D&$I6B!-)nNA0HHYPw?M
z=G~l#>II=hgW1<BzJQ1^H~-d?6u&&GJx+MM&@fe5NIn(*b4j;&K-L_xbPp<mBi2{j
za)O0sdDXOA((HB#J77n4^o0!dg}3`E>S1})m8;_U)Y_(JuFW`8j6bJA#$Q@SZ^a6t
zdM}4kzaUjPf{6yz)Xd=dQkDHgJeRY{I#UVjcxSw!5YE~`=o$q*S+qtnFH-qb!io)i
zs^u);%Y65+4V4YLwsg6Ji$|f0q@?DzrX2tt)6&XA8QYC=Bihjt_nu8lS<u-_qp-L<
z3b-PW!_$MSE(YBuw0W5(vxw<V^0bxzpr3u3ZmwP}vp-O0lRQo}aVWa~tUPwtaloWT
zvrK->;-=yTj(_nw;<0e*n;n%IgHhi9<(@awfF}CU$Ctu(%bDTDi5b=T^S-`3_L<NF
zh~ZkTH*Zs~4ZiJDm1<y3CJ8(^^6JWF#fEvml<Y4rzX1ie>sS3kI_?p3JFbTGN#EK8
ztpYe!Y@#U7UK|DV+avpS2>pkU3Ismk3bl3VBUS#?R?W(>_WlY=e}y9ck_Nlo8-s9p
z4ungvjXH5|e+PVBtJSm3OL=icp*PF<C#@=9t(CnEs>7?O3g+9l-VYNSnaOHg#x&9h
zg!D>w)oZQk=E%4fu=j_%IqPT2sfT@w1>-3;zNJGkBPu#JkRD5s!Apv$+5@xxHf&`}
zI!7!f(0gQ`z9s&=g5madK-YCEx3+xPV`TE}HlfBQ3entGXr|2QJA;{W>PDi*sZWs}
zw~%G$88KlgJG?HeIc^IR+}5DQ9-&GT<AaR8)nsqIA2~0%G_fU;qG|GYe~WiTKD3dk
zcP_fxeAuTt@6nTloh>7fTuyO?FT4TCu()x0shjw`uVBAablWR2@A1gkP#U?lC`pIO
z!M!+m;-SJA{J8a8aPI^V9RmHYY!Xo5p}UphU)Gj*oZ`UJ_TEOr30Ys?*^o@K_<ign
zsx;6@tOMkm%Ea#6&QD`C*kSy{5(Ixt{;1eKwQ)nM)Mcd3h9GfN0!R}=;~SY;GY3gb
zGzqKdIh#8(yR)1WZginS)zQoZ)SqxbS<HUaTNbzi&7>g^+#sO@D2;&Ns9>1SEsXHu
zSmqcb9Nd?NNcXecBKQ|3T$-O8VYk`&N)Kr9C+bX9PS>v6&CEUPnD;x^j9fn}QFjzZ
zpx9PI7x4{Qri-l-6wsQdR#g>m!O-U<U@GKA_-Y28l4nt_epDDrleQ#k1LbuKvM}J~
z#eRbxE8lQ$&XkcZDMuWWXlJjU6$9vy8plo@dJQBYDsr4sK8{PQt9ymI9TdstBGmh!
zv{*#fW-ycZpk*H>-4N#AVbbUTpxuy*-AFqLxljw@$W}RHCG5^Q72Rl@x5r`hG~6E1
z?!r-w{fWw4QE>0y%yAPFwuJJ6gHgfyj);y3fB4a@P8}`zHtUz2q9uJ?KVZe4Gc0#L
zP8Z$k>i5llGJ@PAsr9F^<x!J%U*}I7D$+ni<DtcWk%~kv6_|7)2{Y(W9Ndu(T_o-u
zlh+zdS+6~;Fjny!!n6dijR;h8yoPeu$m5qEd(k}0A|tR#%0g|eiVi(S<;*lW=|>ky
zObkVe7ZZ;*lZAw)^8T>43l6%bJ?AyA9Td!BNW2MQxUjs9|3Z^I5F-34?=)r9mwTWA
zUB~42WMzN&>V|Xd^EG(gVv4&!2_u>mdGYIkhIqR6iKi6IluRuj2fPr?vs>892i`vT
zFZIdqr5a0f<)$3c#rvPRLR-vg_Z)nf#5L_diy2-cJ!R5ukE=soJkN1#@;Ig6WYFvR
zigofHpbEJA9C$T%VHpRBx0}nP;I8c1d-^n-npI?l-1P=w5G(~<)s=w`dXApEiStwG
z!j{+m1ln<ttu7?-026H&CtBYzN*Uvhp-~dJ-=4MF$$TJ_r+It1*P3)<BDq4Fi|gIV
zU?m4SMoH!L{4zFw*SaL;RA#~Y_U1`aWGI(dM~U{-cn2?=A7geJJwYRl?y%irr-RHe
zI6$;0(0WPn{Pkq@eqLfeZRxX93hR85zW9bWrAE^SfhAA*zJfi6M=&#-z3Vh_>aNAY
zIy76W`cM(BaUtUlz4^M#)u9rHv6blM4Fklaa5J|bL+35+NlAo~Sn&$WvWf)fS{{6#
z$}-p?nU`$v*XTLg`pee?9c)x{RZ|v9Y!;9o{+o*kbd?DX5&aPhtQ00X|M2yeNW<kQ
z<>yJY67Hs+i1B$mM&>=-rY~EVHDR3=_l#8QDx>iaoWH>W?)L$ot5oLtC7QI*HEz;7
zRM=P}yi^oqf;RS=bL64{^NtGPaXhfV;LD9>6JTEPbXsq(F>^zX@;JG50R8>ryTr7l
z$n}qz05rhaL}Yk;8C-xkcU@DO7VWj#Nz|p8+YpxUww3Xi5oLjC4PN6HSL<r>@-jF=
zUWC6yLBH2Uej?*;h!&$9N!gwXTD=!jZP?9cDmUS^!+r5<cPR-b<a#WjfLW;p<fA*W
z>0Bh2_nIo~(MmZPVbUDCeVka<Sd<oYX~jt+m;%nwf83wby$~sAawp^By&!x{JVvM?
ze|#VhTMy~sFbA7<KWzmS0aKq!$NkkQx6*F-!i9<mcs~ejxO|3!cLh|#B^Ww`$be?i
zRj~P(t1c{(TPj&{lzkB#LYWQ?-{nR`0ASt}hXW41quQTeH-eziY4Wrt=5dpC{5<Y#
zRFm7?fS*m@Y|MBYDmOk7{PnMES?L5pHZxKSND%TvrsdY%3lyP4s5d+m*1C93e~g#c
zl=9BXK$;u)<lxeHcy3=1%&{hAI3pE|r2ZdFuU`)V@&VnK9KaBd8I3AcQ7II~bVz`y
z%IIJwP85FrQns#$t5rlx)$HKW%qV^aSimxLiYTRqOIW1(5}a+}HPq5fL1BgX!jRJC
zg(lh>4^xOdq(yegSa`7d%-8F+L~{c1mak18?K&Aj7ey;3+KL<YKA}v~Lp)U$b}j{{
zLC<Y(gZ+(!wbK8&+h9?ihPPKAS3eobmc#c8DES9EU;0%8b`6m|7Oz0*u$W@mKLnsV
zFU{2+F*!=glYpXTc8-Y_*}54aWuhTD!v5Ei0?90*(0J>;i)m(3)^as87-L7uCkfCm
zw4{G5o+gmkXQ4|SaP`a4o>l>*4DgRlBzM;xn~>88>5<=Jai@m$wHvm!IIVWf0ctH+
zUwd3LBm2w`>{&9OuJNX{lrx~FPHR3@@NaB4J)%+K2mbX+Cc&Iz;y=~UuW-@Z0Ql0|
z5#cyCv)b9bcuTomj5LQQEF5)3p}nPk-EY4Vwgs}O-{^!@ITGhMO3i0eG_uatRX9Px
z{<@Ms#fiMyqZ)13r2N<G!r#A^WZ^V}xjuctFLJ`+xWvG5R(}_X%M%ooME)wjygBvh
zikkt9Vg?2yliOaqK&!40QC)H8E2>STIV*a?rc_5Ib_^r-UN02ze!l|o(UG>;u*w(q
z+aui+E4G-*a1w{hd%IS&2XI|WE?L`?(#h9QWBa6V#e^+qTGwNLI9HmpT*MG7aL~Va
z>;-3`C3BUZG+d;=hc^S6LZecw1Oj%2DVh>dex(6W;qo|m%^-gr-tUS82Y*q+fpi9X
za^+*bMQ&w`E1vr6bPSAYK!RheV9;MC<<I6rLV+-$iIK@X%n&G6lu}KK^fyxXhx&Ju
zarfk+n*5zu{_zDOj6a35nF7W)Hrb*bp1Ce+K6~0BP>d4cy$;BqO@e^^XJ?3ZeyPqF
zkjcH|jiMDS{jFVuhnkMoV1{akBmn+z<mC4~UP!2aL^mAAWh>suOlC%?X>+^`?@Z@y
zzI+Cd%?$iCA`AlYyPKz<KLI%{rZZHy$3jQS6!8K&OC`fU@cwDor@_Dpf(e%&DL;T%
z_$YS{ye0u-Uoq<8E8YPKs^(DjMfDT2FJx~t-iwMi1u%K#d-uD)fbpLfk1<C9TLuPX
z9I2R=Lb-)FL*%hB-<d%F(XIcSlVAAr1t|tdjLbzXl6B`B`B%zu4>0f84u2lu@4MTK
z^Ggb9Xt`Yr51?jBSQ;RY!2Z5^pQK;48_rP03lRRo%YJeQ=Hgyj=G4174}@H0igZFx
zP|&|f=<jWSh##mNzaVztHv7wB0m_HBUs>xvM#W!AUPVYC|7rBVcZ&ZpAZ4&)E?ZmM
zguVu7ZNe+$OkmWGrdH|p7nm_yviC+WX2+~(OEg!`{lBJCiH_UU_(g)&Y($^?0ho#{
ziY)Q>JqCfUX8?*O87+4~T_>qkMd2NCCTqC7v`K1lUUW5JzB4d*_CL3{|Jm>Uz(05y
zi7M0q8bVRZVfud>AU7mXB4>fitGZor&<_V}130pW_|QGq+#!#{Ss17psu?vw-hb+%
z2_(=i0J?eO$n)zqNw0>*y^u0Zj=%q-c>EL-L;<!?RIN{aEX1E1Z#FY>6FH=Jv3j3<
z3>R%}glV-NolGC;fRx#rMtJv6Y7~PHJT%7J&Xl|?elEW)LR*Y~e_CD-LWTPfegg7Y
z=bwHC0s)2$lpi2*;_+At*myO-gt@S{5}0;DIV^rZ^N7mqeZ1VHz;KF#`4_?dw^*f$
z0U@OXBeS;Vm6X3WzRTq*Sd221B<i1jVWAJ)+ogc;XznX9uk}k6Eip0^hM5&52n}aS
zeBU7!{FBH6+gZWLY!@qx(qn+7c^ht<I~?6(nLpoONYI|fMffYV69nv!PE5atuD|jc
zFA<o^Z4cyk={vOs=N&5OtlTC2g$Y-bn4!N04Ls|~1GO2&74M(sYnuNT#sSqW^A=z6
z_@|`5&lal7<q17CK65gxccc|z^+(u$k}LilXi?I(4^F#ON1IRVt#18!^f=g>h^^Dh
zv{#P)tzwjY90bngz-4D7q=##Y-hVmKUGjH{)6&-7c>GC!D%H|bD&))o{nzVa{=E>E
zB-5*_;^tGj4$dQE69var=TpZbE81@(^Imf$q{oNrLtTZvaa}pHJ#1$z-y!}Udw^3$
z<PDwi;sB%Dc|m#P>x+Kd@?#Bl>ch)zzF@d~Tt68h)d}|r(Dpq1l5N2$lT6PxMq8Y(
z&a`*ntya7ak^%DX{`|K9<VOn1jG>2R*gIVxE>^_wtM9i29EaQz-^Mp-?CE#91Rl9h
zZ8QATD!v(fP+7iKyW?{B2iOC)5#tE~%<Wl8n{yf+q00}*d*wh!GhJkE23{wl?ZQmQ
z;re`=T8CLb&=45Nd$dr;c|A<}kFWv)$~{F^G$!j7*EJhwL~RPU<`=$&-(^Q8rEqk)
zF40vuC!wFe{=7MFJ^fkM4Tp;G-9J|q08cXQ^QwTx)tJ`B75;InXRi3p^$v?*XI5VT
zh>~Hje8-Ybijw^Cp7?HC5y>OgHPt^yE|upgm|gt>Pv$GMk@pVvl;oox<+39J{z{Ad
za}W9?m<tW<?y9b(y;ACyK(GH(Qr>7~uhsfdbFqP?Ws~$MapIYOl_fbB^Sws2{=7FW
zdZJ${Y*;YULkX**Bog93uRTZr%|uc0-ZpWV_^aSd-C6~f7+>(*EvbK6=4}>S<OHl~
zh-4GM<Z<vCBXf6K`GQHW^`@6JmV(>+Oc=zc`R^iGf5<@$9fVgMIZ$~@NEbglEeEOK
zzQHw-p%ZMbdZkVRU(A>Jbk7!4$fkWk^w(_qKXKe=5P7&@_L#clJm*a+LA(2y^T#pU
z&qt-J9|6G57$u4d{2`gC&~LkQbMx!#Bz3)iF(4X2A09zKkieuwg;f3x;zZ%lXz2TM
zY}v=haTz9x_$~ZoM=`Pw$&+uGnF5y>x}6>oX$*_X)?=OzSbs@_1A+M0u9N>s(9Vy6
z`h-8E!W=PI&(vM9Nv|(ns|s0+qONm?l=~2fUgIW(nS0BloyU`z*7?H^g=hxiDF5!q
zzn1r38&`lR@`poJ*$x?Rq?+?qhj8gkcl?sNa`SHlw8FG5-JqO;@23%Sp#HunEr9dq
zDk~ahwGE;tl|&c>1#cu@)*^4>b;x4kFwE{H(YQP~!8J67&0c_m{kO6LRSX0II4()_
zfc14e>JP(3fzP~0D|tNV=;&YKlufXmUWRx{*2TN~#q_`lzmp=xTp17$6UIbG#UKvj
z?^crT${z^~6Ye5j1$zd}L+v9!67xKQHk(1IQ+0J?-orxV^QK4)OW<5Neyh>^e)tLt
zchx`SNo-JO&)b;4iwGpuUkiCK+I0_|jRPx`h|v>z6MRFGbpr%XmJm+UXV&TFaC`$6
zCObg^5dm{!J%pA(9aE7?M*E)jch?x>+Kinplb7#KXSvqi?NAKLMWkbKe9QipU3aMm
z`9I$*@ZF~a%8t#2?peHySDd>^GjH0Rqb(_j&le<bf$yNaM2G-H6i~qD$`ZtBJKegC
z>2n(hqOKVIagluXm~e#VBxpeah-0YlC=qbGgW@1ppby>6)D576s({aBB7`~kRZ(sU
zX)vduKl?f9yuk-80pNhoM7|&`pL8HbzRqX-8k%}6BH>I)jP6qCs0{Jo42Icv5WH!I
z9L&F8)c@^&x#bb>L*&I|U4)B7f#sxGKJ+#CcY)#q`9Bt<94LBLb~v4NeM3-fm+eiX
z&*<ON<H6e<u%n|_Upx+x&aNL|p3zzYeFXX8v#SAw0795(nQ6k61wyPlP5hN4hHuF^
zz=GnV|4DDMQV+7Tn<M?&EaD04j_JGxBcAEJuO0E4fBdQZuDi^4^Q$A_4*#HU#MAOY
zAAeEnn|DLBclPZ;Uvu>D4_+z-&W7p%WGf1G=E>>aj!~Dh#OvZj@ao^eeIUSM5Y1yu
zY0G;CxnOPj5$^%blDsx9pQ8Kwc)<v9K~XV1@ev8Jr+5ctf-i0yp!~WOhzx%6cp^M}
z0``4cAfKNx`tS&fMZh!Du2a&Ul<1N*x*O^q8bY=uW(l}xP`ltSB1hoYDV2VV*YQh-
z`{6h2U?>XL&_17{1-ldA{+AU+qwV&Y12Zy~O7g*ADkn|UZ~{mnv^=(3?^7M5xxauD
zCIx)_J)1<psl?LfKDZBaJIpu@bVU6_q^GB*r=GzkjSP-Ou2V{V^3&v#qHkixY=+5q
z;jRgiK+7o&`7n-Wu<m@X3C4LC&%4`6ug}3#+zmIsdM+*SocA|}{!tazWcm<&E}@Z@
z%T)($3S#K-cQKRiU^*I*)BeKjn$rTmN)F-wR`&k;drC9l{NeKNY-XfPFH$4uuC*|%
zHiulDIKddcC(3qxZWq)eV%W@yex2@o0p00*nFVdJ)^7pd?8e<8803o(z-M^{xr^$-
z|NZ2Rb(iD+&0iDJCuyvfk6-YN$Q_^9eI?0yH`)_@Uo}PD&<BoS>yr#4Jr)O}oxwVQ
zc?Xh~J9MN?WuJ3Z8lMvc>IM$*4gmUpE&-E;P(B!$uq(Oo#U{BC1EM=pKO}q@iF>}>
zK#JTz{Vu_k?EJ#^LcfbETgTT&iaS53_D`5&pV|mM{Y$E`Fd6BKcffXk93?^hR)I6)
z_28_o)?40H%+s>TV@BZf5Kz{;!lU7;0b~iSHllc^LInT+jbJ%9e(<~X&M{uqbsD?^
z)%?EiD+H?<Q0%fboZkIbgx*{FN2o^$iJyoOPd`mCt_jY9VKwo*V7y95Z&85I4)rj$
z*^c~6NozvBdLr)grQA_@VH{^_oJZEkZ!R1Z02TY!DB7WZX*J{d(+TkJ{|xKNk&e42
zLR)}fjdySI;Ii^m<;NwG9Vt=}=>;f180fG>_2w_s7kmS7zJPQ<bo4vxZ{0(5zyr(4
zIi`|+u78fd%ib&T-ZHOnCGnE3W+gEYnui(o>Gqo`ssxT7g|-a{1df}(KiK|O+}|4f
zd*1=-@70XwQ}BxZ9@`@wu-G1)HUYB5-)=O4N$BD7ctdXk1RT^*&FR{4KggpqC`w#H
z5ZmKoS%%?u-(AHu>xugd`Hz_S|Dx3q3U`TgjhS_Q_7UnN(ocbMoxfjG+!H<*`lGyk
z?;y3n$Jr5a8-lvw`BmOtF>mDEZr@+L>rA<GUvK{t<*@GB?m6+6a^uDH;t)gg_zpqd
zcL$h$Iso~9Z1exEZGU}Ul|j6x<woCS{>%iUzoVql){5vfFVNz4$K<;f!=LI0{tREp
zx=Tsb0rwE_Y$5yPb|!#zcPd4_kML{#yctfhk{Rh;cbg#|#wwo;fkMfEQN(!O16);t
zaqsoZ?)v+!$@9G5Ypv7U9N`JGPo9!&pcm*FdYzTF-#$Koe9d(-McxC~<HOr_?f5+%
ztrLg`Ur$=)pYzEnk4Xkyb1%2|K0Dxoez(+?4&)UifB*vkH(uVtHi2Q0gBYlKkpl~;
z6{cwd3q*j_3NEAlC;m_T!$JI?bc8BviPe>yMSwFO!vOpwI)ER5_Xu)2&9y3I1z8WZ
z3ciznf`CQ&4KW9?_8TIRdQ6$kaN_)W48yRx_i%DHKqbbUrJ&h`Li{PU=gP00RHl}^
z-|!OYy^jXuJvhAX<}MphR6rjD-(rB5%?S&*l>0HRiRk6&ayROJ61W%w0;uwl@ip`d
z$V*I=ALE{so=7E;`r$D8F4PtHLr=R{6eZB~`DT3kd4=E#=XAE_6zn-b;Fmd~M3^oC
zfC2=&+<c}|xWaLI*CH)ZNhA=H?Uq0Yv<E_fszG0e3o7xQ=nJwF2-hdP96~|F|9f$%
zCujy9H9ct0sy=GDZ1XgV6>@fRZFoeP65MgibKfhO$%tQg9>x{li#8EKJ_PvW0F`Ul
z5&H3)@}Y!#hD4i7sasDw>^1c`O~=5y@&Avr_l|37?Y2e*lqd>pL_nkpB1%;dks1&M
zk)~AXBE3tmNkCMjcaRzcq!$6{B_Psk=)D+9=siF}lDly4_r7PpXP@t$?>hg8zqriG
zdNRwHW6WnQ-uoq^e6*+rj-n%qP+VW_#k1JI!{&chSs0cLKYJJ!p->}OgMq2P%+a&N
zgmHf1+&b5q_a*FwGdp<9Fcxy=2tZ*t<%^DSvmjmqc5Mj8a7-IrA!99Fx_Eq!&HvoN
zg@X_59-VB9UtGG#CcnB=UdD!nom-^c3vzm5L)KG}PA!y4?PqH7Hdcz(lT<BKqfGR5
z$~(Y8(4p9K&X;O7LY?m_P<3zv|KqL?+49Q)P$Cl4bYJ*USK1{>f9|%s6HJqiDSNc3
zfI8+txgH|L>`!KEnXr1r%Mb9xf&brC?<@|*WqzYDJ7kbKvZC;ZTUjv|NXe+%bR6=&
zy^RvMJY@f(T33MAlj<<PppbfU=_Uns_N8XY$I@k-Y)v8()z42ZG&bq{^&UH0B=rHc
zhG56K-D;rSQu3xZC#>EP1<}VCp;hvzdorJN)C-o-H~?_vUPRN%+E37?w_9bw2Exkt
zdx?w;aGv)7x?yL7HxT@x5r7dV){mS|5jI%jhc*j0d?3YT=R~J?R8*?3bm7#&TlpWP
zTt<@b*Q-gW=cAOte-`SX2qm=O#HQdGW;0>5k^^@;fXN!07=S8(?-QDJkN1`leEg@e
zEl8c;zBvJ-mIEL<a3B=iQcu6H*JFFXWRnkNZ<z-=;P`ECg0UTz00!n44>G=<*-fGO
zgEq`EyQL!R+|Fgf;58ur{<wJNkGaYQ|IP=YG1s~8tG-D)2e|^7X5GKl!MIo`wRmO!
zMvv{ilID7Hl*-C=#{sI;OqP2BZw!7`e{!P1UdL8T&9<;xMwVkDh0l)bT&{0ZbLHtU
zU1s-ih~FxHE9t&r>P^H$4w^xM=*$S|><|XQPU)C|QlBFSSN!1^a^MTFBQ=T>UAtbq
zezku_YZ7$0aRYyG^S%2T1(wyBLhM6|d+G@zmiJFPIQPFcnTH2{XLl8#PmMO&QGEDP
z;U2ik0Y~j^k76pLux6{fzq)E`jI+gdBbYBM358k+IS<fmMqs@-s84T}oaM`_{&wpD
z7#{Aae*e?6-pJf>Ie}050&9~T$2l(<*o#Aw#UJwL@TB<1n+%bl4zfkraH`J=M)p{l
z%8e0>fhQ~49&JBS_oeDATc%S>LfHEU1kcROvFXvo(m^xeC0fwDZ|tJu47b|L61DB+
zJ;x#3Mpgg?FjlCm=5w@Ferwwfo{VNDB8H2o4Lf-cvhMqr*YoxcZw@l@NV$CS-iPfn
ziIt_Wdd?f+#L6{^53>c9@1?T_Ab-*=G=cW~3CR0cI_xE^XeHr;0eOEQyJ+bWIS?qn
zf7D~7NIUg+{V_Yy(7Nj$_qX0me;|A$EUQRtU5uArJan)fdTbO}>>=mCE}GXtxy<s}
z<Mph+7pN_wSPYszQ)^LYGTmAo;-nK^M?{<h{t$_~M5xHQb28`7*no}H%f6Z;6~u&l
zmrBlGj6SCx%$`1<8LY$ioxb|hr+9UnBJHoz#on#K4THhKB0SpP2iEvsE!dPqVDl@2
z>1pmd$LYO9X28CFB9(nA6K&;pUg-AClWmv24Y7X3+nvhGQQOB+!Yidm6DvNW*v%NJ
z^+L$A5keBVldrRjM3QY_E-Y2zO;P(~ae;ChL1*+-F3rciX4s=AYLl$Ji{Jn`Sk<f8
zsDxErIR>`rJ$l8ffq-R)vf%6$<#DKme8Kno?UsQ%Wfxxyj$g)RjK~Z)e&Arl`1Rci
zET}X%{vpZ;4T0#M-w`~$OdPcNgXnS<8Zb96+Iz%gNJ?ym?XYc9?jA|ho+rfIAo}~*
zRGS{rlWb7qGUtYEWDr5D-@{m&YV04`_J0(uUtRewdaD>N@sj}^JM@z3<?Lv>Rb2w5
z4L;JsZfwak&US*(FFkb^f#2ka`N<uirt&H>M&9<k1SOxBqPWK@pAP;&NNnR9^nS5K
zH6A1lQQCsMjoXM37!(=H9RbSgqKry~-ZsY!jxrt<4mOf!6@F3s@k(FN5-kyO*#UMt
zwxp;iDvSvndo)K(*qAls@j22?swz>4@Le6sc@{2(v0{`yeYQG$m!WZ7r~Fiub^|PJ
z*k?do#-`vMYcbTTlL8yFdu&^3JNrBsf5^^s?;H!-wEKX@fgdFgfVndZfM&pDQRvlK
z@aw8^``eTDwK%#>R88c{<Fv~|6)=@C_b<ul+qFRsZ8>U<GC9Dl;$ws}dP3QqPElcx
zhU?zgs~r&H1RHPh>J-OIT?jB=8IxaM)2~0>+l(8`(=lFsc+7+pr^0Qxt?Ityh`Fs2
zsh9(|afmp=J_P$z@fm5{DB{H=MEb5zD=ihqfF2eQULCehH7W}dn?Y<{aJaAh1<}nA
zx4X+2R;k+Vh`tkl#vL;|D?#5kvI|(Poa>jVF#fPROij{nB%bl%KUElx{e*5%AO>gW
zjeoHng9r;pmm4k+pQ#b&8?#m*&5nGe<J=fUME*z<;wN|~BK{cU9x(I$r^9zr6Yw}S
zCbOaW_xr8~)EigplojfRDS{zy;9-+F;7kpW8u>NHpRpcN+Gbyms(%*Fx%5NI+}0l|
zK6%K^*|A#w)g!r4=ohw~D|W8?w76WH#px&e$*P*5j$|y&i4f|%aepNPediA?2~I+S
zAU^P#qRz{_<ScdR*)k0qPM?DeBBM@+;BBhVI;aFndFQ0ujp$D{vNwikWOr;lsSGL(
z>8d_FETN7pffOOGTpyTQtTJs^ooIvv`eIkz^NOjG+rw@gIttlOCi2v2<XB9);eIid
zKr9O&PWbUUT$q&SgT73A9K;ng+v`QuV)Tt+gNuOB-(fiAl7{(f_@;P5?M_c<q<5Sw
zE;h4%18v-dz+2Eqt4Ak3@0{LXtpQs-*vz5bgdgDkw4l+r%A)=R<Xs(eS0U-yi#4y-
zODmJ(9%QC@M!;QKimp-xF165Db~lGFPrt3TDv$4D=gyoru_WXiunPAUW}=#Jh&iJ)
z-kcxmN%kn`9a7L3!*vEf-K#@9B~1-hjX4nw6>Ui=Y#VvL8tB*&pkx#|GfIBw_)MUB
z^&z8m>#NpYLk7ousfll}?MBGnoW~rm4`xF|&}TT8)_m;<VLJ;?UzbRKmy+g#@zSl@
zf-mn%`CuZ6wad>}XB#AZ>1Zq$P5%I6Y`24rL2j2k-xzN;!@jv})Ju(v)jH5L&Fy-e
z8WzanAOcT710=5JSO(4ykR6<p8kmi2=)Z6*1`UT>BH-)1KYt(SBZtAPV<}8ed<r*J
z;!F`w&q2|5#Pdhk-Nb<#;diZG=M0Fl$=aJ7k1F&=h^i|&j&+Z2B9@bwlx>(Iq~@~6
zdK_ng<vC6daY#7*!YyxmW0zpMd{nnp%h|VHS==9o%v<rSX*hncy0)Z^t?X&sPqcE+
zSy(aRObFu<>enEwa;s~VJo4yBkTu@sq7;eSBj}fOE5Nn8Zi<~a4}W&-Mh3cxY|AaJ
zz&jXtoRBwJ_RZ)0jG};>d$-Vi-8-4Jaq%%i%B;?eRKqX?!73OBj!L{+r@NApX|X{?
z;%jZC>XTH*;~?Vgx$9YzU+P63m5oe7Wh#~$D2dViUHMPrG<Wq+gnnhgVoX76?jlBw
zrC8z-jChBL9Ro$f;esnE!Ybj?-qo2>wMGr!OSS{3A9lhC2ceqU+DYaD4F}xC>mF0(
z2uWNjfePNXfw+%zn~JiBZ*A^;DA9)tcT0b>JxVs3gdbi7T(t30&gNsmQtAyd+&6gU
zcVjdcAu5f~3{mXIy_?%PdUBg6<&S@Z7%y?Df7sAQ_NN<vK<K!FHw`nW(PY?22-eRS
zHFoTVIjPt}ln){B{;E--s>o092RNaEIDb`HSyg$z7#j5A=@YWlt;Uv`n$B&uf>71V
zZt~om1FOqJSs^8w6@|5?#f5h&+!rGnG#&5+8k?so{qA@JuO(hn9HP@rltnON76Y0v
zVX+|Cl0Qu~xK#mf<Qbd6zpKa@y6cQfwLI=CKbi0<^Hllj)l*e`C%!z~weqJ|ai)2j
zNPD-E2l#d}%gUhfzCtP|;&gX6I#aYdeq=9#JHA7Bor3{2ne*oB$It{_os`><!Y3wa
z4Jsv#hojzJzjkvpBS&ru?XU4J?zA9gU2nG2u)$7)`1Fp!7Jfq!{Sx}B;?`NFg2p$`
zkzABHNBW1~x%2G*Uw;+);0GSKn-jpO`9`78i?hCdy_BQ5zMadWL4+~&-MbX=0%e63
zC<fe!qoZ^Uwr~wD!Iuh)ivdnF$Ly~P(M%t5(*W^qnT)v`XAXbt9J|(SZM@9^sw|3S
zVrYEBqMk*XUkuL`QV`?hXIhM5*bY+76m@7*5pw$+cd5%;80}Z@x?;cg_=T@}PGpCU
zg;BN@Z8)w|aPb!{m7AG*S@B93c>0zaq1(&unX~waVi98@-Q8Km3-<Um(4gp|16)FA
zw6oni#&)jp`N?6)cD#)U-3)?=^Dyg*?QGm<a>phh_(ZCRXoVrtBQWul;sp4|I<b+N
zjft^m{b@5JPK14t5mt=oHlg{l(e4rFv8lz0(i8?aPE%jBLhs5^?)nbbivJ~c#|JBj
zy@~yjuFQ*;6p!e$jOau4AD0ioSAlE_<kJ~Hs6VuMLhv>9ggy1Yl4)YmK0zkunLPK{
zbadOTfHv~>_GvcTI%$DRIQ=AKo*3Yc`<ec#X`!krPA5;yU9pCojH!itzydd9k)|8n
z(ejrcJ^%K0r*wNnLeSiuNJ00JPEl1R{--<=>WA&H7$(?JS&cDsVrI%F?)XBSq0NZu
z{%0p0`tGBT?)M!to%BODUiKBLFK4SNbeV%C6h0nlB*JZ!mP!yc`bJ3q7xMQ;C~a;?
zyQOOxjqD&VJEMN-^k%eyTXKwe7$PJdhmLL&cFb#RJLfWn_7CCW8c^x2d+jG9vMS^4
zT@1$2alAT8FJFE+{WV#@b&cYrD-eNw4)sDApbqv5rb50dt*9a~tJw9mwMEg(^v|uW
z6P1%5$lgwc=6lu8Iu^Ymil3Ak-@otoNP4GqlMVOcqd(+Peanw8hxctaGcV2bO|Fl6
zB(1k^Bc(Pem!nrm(=L}a&JEGe866@Tj68f0+Xg^F#;w#utVkD;0|zv^?@R}7eeprF
z)~>MoZB>!Yj2$uI9pTu1h$H-n1yObJHBr};2>c=`;XLJ$Yd=R++yxtG48386o1GJL
z(V?onl+Hqhk~h$<W0Gngc_D`0tBp{YJhx*umsarse<EZ>7|EWF5~$Y}z{(4{v07$x
z^Nw4ihj|yfoX8+YsHTT>=<hq`-8aKza^BFrU#xM2*IR)M!;)VX3W>Wp4Qmt$i8IP-
zY145iboH+o-@=brA3~@dy=0fCnJ$^BuYAtQURY<Yxa@IqdOx9Sx;*0Tu;5i~{}(Rt
zXqnv1C2XBwWQLU&gjE!rGsFLCM`EI4-9_wh*vYw#F(zYkaI-v~@(jD|*UJS`xu+U$
zi*ghv2pZoNY&Zx$SRd1|=qDtis>fG6;yo(6Cud!8cOB6eeP?KhlMV;J^Y6_}ApZ`H
zNDo#RuJ(mtkb;APdj@{c!R?`K9I^O^;7*A0!R54d&tg<f_)4waCZg=HcEH}1X-2*Z
zDN5Ly-=-q4j`fpy2MMHKM!z#=5b6e>{?5SSr(84fy}jt+Xm)N?(qA6Gd;H4WRWDaq
zoG$e?qS2&&@e#!)@IV+z?`>mq1y}v3p3fd(xn@dhsLryiY~Q-wzVgKZbSWm`6=UiK
z=aUqBB=Cyga)GP|zY$x1R!)PtSvMEG?kW?{X&dV$bEtiCm;&x_aN)YeFzuQgx?#>x
z(FnP#W`vNLeUMY?Vw7|Ai0EyvQe@y^SXzV12<cBig-f)-UYK>;&^4L)-p=*QeFZ<7
zonoh!I{sXP8$+b=iq-VhT`jma^?#FJ2mi{i+yPOd8OS<T-m-2VgEyn5=B|_8M8Pa~
z$3*7Ckibkk{TqvBntxEb)~<&?yZz;Oa=QzC>qO`P-O`gcy;$)4#I9R4FSN1`D|9+-
zySNt<!jb6sV^37XZ6^3x{8xgd(M>S?-aTMrR%MYUW2#Xp&wXKWFJT3d4sO9&+EjVR
z>Cj|N`JCc#WqA<rI+ekgdWsu49EI>85*vO}bghZ0n!6@l>qRe$Bf7}lX5L-?>e#_}
zVzoojy{Es@rQ}m+p?a!Ys?3_3-7hSxCel}4e|otFkD2>?!Lio5^4hfn&87N7HV)j8
zPPYnAN0%q(g1hNjtw8f3Y_~OGufUl9-a2kcuq4i?fr50soRfjc5l*DM7*1Ua-m%k%
zycexUA;(778B(S`3gap8!NeL+ssd~Po-SI7>|R{sf(Fhlcoe~)@;T838ap2Z`+I|M
z68=#5Uls?AgNiueZEA6}c<J8;tzFkdZSI4_85vWD58h<Fdzk@0L$d4d6vx4~qm&k#
z06;T_Kji@%a8D7e%!!@+Xj5{DirXEXxsPt37kkjx+7EpTvqM6Fl2>^Tt<;!;jZs<(
zr48OlrR3?3PEu6`iKlwIm8RV9h%)bVA~c1nhU4YGvLVtZ%WQIV5s66aPx-vw#xrLt
ztyP*-v^TX*_~VjmS$6yS)w|o`2=NCwG0%z;YdR$j=fQ0UUUM2lD^I~`81YSql|IA0
z<O`R3<+e``i=va0nXD3UJiJTs$t#KNGtS-2tFxS7y@v9}q@)`)gxcg@$e0mMc-7<8
zTocw#dTl^{(o*{;G*GJfvd_zhe~d6}+_c>!nQ7_Ub=jwBIt9U+*mgjtva}uAQXQk~
zT^L;3q3-!_#%Iky5qYTN7tro1Ny;x&meggVoeVf~Rt6lvnhr|L1&#B&CkMF~_^@s;
z;KIgB&R~P70i(yp#i};WybaVf7q`LDVvxBjk8z!*y8w~Res-`_DUG?XIJlU}Se$_}
z)&yK0;k0?>RS>!Oj7W)YB5ay5RkJm9Ps=FB<`UBidQgdK8~iGq2~r=*eE&r))>E@i
zNL;sBA(gBj_Ihd#aNLBV_+-XZ)%}s9Ac|V7q1g>7&JL@53Zb$S9RS9;urQ|9<3{lL
zQ~5&T6aK3E4$>;-u4P+Q>!;ehNvB6sHs1AYS1vcQI=*)`H;=o<Fy}COQVut~Nd}_2
z@*UpbbJWRSHEqJ`v0mhI3k(*F9ILd4cl`LE)Pr)U+mv4&?R`{yh_TvN4uxnKPpw_5
zU+85L=l7BW)ipcly%9Z#k@VP^Zgm0S6)Z4p(^Wn7jt6yr8d?-P6OEYq#<Y>m<=)}~
z>SsASRF)W(hzA|<3vV;w1pq7F@&FL4ynN0BLQicQ9JxC057{f3f?X>gIjc-O!Q|p%
z!s4xx0Szb=U3jRf{JCffD(A&}Wz<(r=_Adpt=?Me$bY@Q;#ApsCCPb&uD!-aOP*UH
zJ!W6eU?ri&Y_BG#<BNI$A!Ij?cGYEL*V*$Z<vOTZl!;t?<)i*$L5a;G2z;F8i;G2W
zk#X4KFk(XDc``X$Gr+nsa}jpe*7tgZVR5Rd&gQc$RiB$*gwObX_+Mbme}T|vE~ID0
zm#Q)Jk@gxB?0veJO4M^|dR}J%Z83<i5(e-cq3b%^(;Ue#SRA#7(z}$<=NbO09y7?o
zbr*Bj;3(_6n8QFapq5^eB>LO)YRTv56t0W(3%@jXbw)VtPOSMX7B5BRty@fI0S9R@
zrXJwM)3ZD4fG5k&KAMBNy*3Qu9I#I5sq>2NLYu{bccR3JzdBC7J}WlbF&4VBC=FBE
zDw$~{KS8m<BR%FI#;TILo?^sPw!F2|!|ka8(o~1i?Ba4E@g)T>v3?>tQ>_b3JSk>|
zot8Q;d{{|LEK0$-EyDLtH$>HqtbKMB+*?4>;|jR_2+ac=y3F1ZEl?Y>HA(p6z~Ca=
zF&a_+jhZ;8!oN$6g<w<T$HOpkY5L#THUgo#>m+#RH(2vtVO{KVM1(`;6uNSh(N#j&
zRe!F;?C|oiqq%aYcH_TrrrwHh&D_!NWT*Ky;I6awb(M`n&j{Q6G>Z+mNH-j*$Z$k1
zu|zHPlHAZt1(qEV<iSYk>I|ed;2D(KL#_Ow$_(7I%1SEnI=b=0uFkyAi?nYH^+MEC
zL>cgpx^x_&vJUk}TDCe-UCeF)UCc}4f_q;jA?u`G_G($hyjq5GnugEoiqvEPqziS^
z4C_L>rb@ZZY__g3*ZTfdiMO8Fx2M923|!v`D&TDb3#59D=XMD4Ui1D6SpZ%U+P4vb
z%#4AK*GeQ_aaT>-sTg{6^NT*a!+p&<3eu=1Js}V>{N3&F@X)!FYiQ}Sslu!F?`4pp
z2I;PXsr1dxYR+kDPhdaJ!>{Gw`JCgs&?EvhU;h*0SIKb!hCEGJKOe-;pVO(q%JMky
zyJ)%`n#9|WH4DM|5671O=dpK($zbUkstUX^T3=s$<EXAzTB_^v+`RJW3^@kPz*;D)
zo<Cxar&dVe2T3eX%3nLNP&U=s-LhHLJa)TJnyR<A>iJDReEK-nb!%F8xtBNm?Wb+*
zDNq>_<KMUxQFWk)#g0$ok{6eM1%4f@Z)!1XE3xdl_o1a$(8TMIdVety2HcZ@gN@V5
zCZ8gyY<r5tOVQlbyO~CFX|`l5xeI;3)IRLCKm5QqHPihiXUU9Dxn#pr_`<!KjqF6B
zdYL&#Td(<jmAx(r6Gjj0E)Oc!0Zv1+E!~$`+S0i~z_G=LF^MYvM)C~8XGngdtgP($
z2=`#7LSxA+P-RXw9k-(f2ZhA2=*&eh0ma?8H~Z}A%E_jCn+I_dg{qUrd9G29()9vN
zlXW9>-nbLPc6t@@Q_wyYNyttBI6HsXJewYMeYf&Rpt60{vKkI)?#gI5>OKEw=RQ9M
zIweIk37$f~;HXc@h)v)f>LSprdG?xIcBTG)4jwI3J8k4P!G<<7a}7S+l{Z^O0W{?g
z!rYt-+-{~;MViq!e*<_TJ^bdEZU>x4cT;r2;wMh>PPLL+1FyjRS;j=PRI(|totIQd
zTnytAlC+M*ljz2O%;!@^;=>0)9$mkT`J#KHRK&;{?<NqAudN#C^OQ(pzST2cdOgV1
z2Ed5W+6?&hmEbKM<3F?N&?e77r>@*)PDz)W2V(vXO>|7Zq>?JDI(vnWdzX(R;${iH
z+ooe6Pp2c)iHxOPypi0{*z9Pw0cX~HN{lB1<(v0>j#&a(Li&4l7Voh1D6qUXd+WWt
zis+iGaC|;iY-omYBXZ5ud3ex?=-dzk<LF3^e{K??sCR6bOgr{I0%zt1$graimme01
z>&ExW&-`fQCp{J=%v>e5IebfwAEyMe&5iQ|)CXkv0UNY&b^$EQw(f!KWMFYR?<CWy
z((jc9*1T$-t(icQ@LFIz4CttuqzCJbcR}Jyt}jFZGMlj^{9I^-0|9vSsFTXbPzs*c
z*jG`z*nr=Mg1o!0By3bYW?;z#-XI{w``m0W>(UxgBYAP&j@T}kE0d!oQG_{=eCi-5
z&6(7BhhCx1_mxq#X>om4Ip5Rl<np7s?e66jf<Ar8?vn?t?Dqj?z~)AMaX8Lf#^?oO
zYR1amrjDpK&=^-xxC-Uutc$5SAiSc*q|(Zz>gIg)p!l3B)0C0f6!4nDUN;+@U5x)*
z0*tWF;<Zr<PL88wK6Vq^u4j90VzMp2>3X!K?)57uXDLQaTBJMGV|HTCkvq)Q0O9a#
z$bGAR*7Nioif-8|Sm5{#^|;)_6FD9%#Fc^NsR9ydH~4ac(Wmd0PxhP#5kGS<2ka+u
zVd}R(a5->E9PT$Maq#&%m&0~u3Jf!~7pXnX_FX9d1w|hoxDaHxIWuE|N$x*YZO{9u
z7g5oW=Ug<7FkMkS!Al(_4~=ng7R2-|n<?ub4Z)3W;}Pzk9qbJZq@l<@bS!wyx8|_D
z{XwR0(J5-SX0M0dw5!HfY^7Gr+1a?Rn%Jn>jm;slM>Nu3Dhy`TyOm?)l&9PS(<#<}
zZEhfbXxZxACKDH-XkB&qas}IfG8ijxq05s(;@5n7xdBuf-$9irgY>Myd&eO=YrxLL
z0x(2}6|$pv@;bsP9Tx+hw@SnY<O%KVoK_##^lg7D5h*#9GxA(;RM*$%6%)Iec+Vu|
z3e&?U*dwsAv$IQ2%;@NFun8L*r246L3G^w8eolCAlyKi8m9}u4dqJOLS`(6Wl#ax+
z8h?Rx=i-2Z25%^=tW~;fN&Fye!Fy*4Gha1c_w*dB9pGS#$aldB^P<O;&>>$0l52<U
z6huVM{sBW|D$RrQcG;?PK1#Sd(limifw3w@<Oj)U*(o#$&_<MF>^xhNp{hP|k8xtK
z^cbKdeWF+p;?OGkS|)X2&S-2ZS?{4%@e+<mI2v1=uuK3L?V7!brtMpH6cPaQZwo&)
z6lX1r%G2nNb>ew+8{<}0kKc6)LlA1agid_b0uF!=+^|RUkzw6+Hp3D1IOsZV@^o*3
zVkEp_B)h?NW8kUxHTq}JmB{uqJtLT|ZcW$V0mI3$DX&t@0u76}Yos)UqIaF2pI<nq
zU?|P`c)>Wqr5|r%hLA2XdPu}hr`(yV7H9%VhaEDFD_Begj=tQE#wAT0#o^lVa#g|$
zHFJ2$e7EbwR#?m`VzRGZX@jaxDSO7mc$@*#>Jn5nhg?U?IUmZpU<4M@47Px-3D1g8
z)A2YI$NEX%(qQ|Z>Xk6g;+~*f*V6c{<mW^Jc%ZWbods5TdcDoZK;!WHYa$u7BnQ(&
zy9fHOl})R3@N8QKugSry7OmwE-X)0#@@54l<@bFq?mK37>A6_52+p2r)gNell^E3X
zJWnm}b6AyFqUzfE`Vw17qkv=mZoDs{Ml3HalVcrV>mZBCnQGCFFrV*?7e`XCHQ?ZL
zn29&IpU`jc!Xvh!j+%a57<?6k2I(EA$b&ygXGC<7mvzFFbJ~ha*ZInA(_G4wa;o9e
z{dQ{}8utAMIC_80IZ$6j@fTaYu;WxxDH-bMJkaFOH{lJwME8#n6Jy0n!QXyh_VsNr
zUq+t)>H0Ezv5-287rkT66BdNLxx3!UFB_K|5=EUwx;KVKRFWRtOzO-lDhb@bYwP$?
zDlQIovkoj62f<+y8B@Iv(8Xn<bU@W~6sBd6Om3$&+OY{Inh0(V8L7`~n|f>xZCyQ_
z{)B%GK5)sy)lm|=m5G^i{XIB&gmnYsr>)nBGxUZw**}PcvdugZMXI=#d(~bN^khuz
z5IWqZ0wCd;;qB1v0Eq%L1)iK6zob+Z*tiysStLBVJ|2m7#q)EOnYI^OfTS3kRq(i@
zn45Cs$%!dg*yg>N$zw6}RmE!Q^71dxkaNCqYc{4Ylsucre7>=e!mOBJelAmQN8>3S
zJu~+wnLM{-sRsfy(IoDHGhcsfecv;Mjk95L8vIw-57O-q&h^>1==waYUr+%9??I`6
z#Z~_TI&&V1x}mNJyb0`58Te0#bWZDO25ZLSniLn5H>buS;nmcH<8DAinKqZ6xX_EK
z4@N%#L=4~o={t#b@`z*`{F5r=pA?d?QkBMx<6A-xp)T_O?d;)Da16m{sV38{pXFa@
z_s`c|qIBBozu!!p-o}xohK8zQGdb7lyI<i<?Z=iT9BBq5>y?h1+S%tTE;ocjUb6w`
z{&Lt<ryM7pwN{VCiXooL?C%IHkg)~$jR_ox1Cr`%w&TE2vTdPw>7SFu-Q{x}>0X`*
zJN^-}O|}f)EI@VqMtv%`?(dPv14!UrhleiE5WnRGL*Tl|NlFaSZh(BzB>g9R;e!C`
zWrF2@o+Ii3Zs)ALetKU#L1Q=jNwuMmIc@8iTJKYZ#!@Oax#4f1ubYgLI`@wvaDjN6
zn;QKb&qt9Wt}KR67?4l(8FoRZH<R%I{eiIb+CtStK*ON|$vCl%Df_v9tr0pypJ9O{
z!VXH6F_-h(`aeSZ{)A6-CiJ|&dg@Z$LS*Wh7cK|}oWo>z(`{baX=06~d`(>`mlYzN
zr6loyaWVj&P763kxC}KQlCkf4`x!6j9Bci;KOg%9TQELO0D!gW&{OKcuPl>7R@CA_
zsy2=?+{iOM?O8qRyv{KlG|m$-DDunLe%Tl(fk1tc%E^^tu)Zat;tH#8_v$V!9+oq&
z_J_Olc>>^lJOKak9KjEql>>fjJh<PuW6<hC*B=KYbzy8u=*qJVin`|?4R@!1xLoe%
zm#i8<WLXk_oXJCv5sJSpNIJ8>^SJIx-H+mE6CKH_o$0~RetzK0mh#*zPHlt1k^yAQ
zvGPxaH-VFpVf?`9Wax9^epLTAFZS7Fe_l#(bqJs4@|RcZJqvlm&r#OzH6HdjSt+<b
zv}Z6V5xTr_Guz=$casS38PYfl<}@Fne#cdhGZU_wQ>h@HF{@{mqZjxH+<#xP{ril|
zmA_zv^lwVQVd}6h4<q`oWT3hJf}?Mn`mA-^>*LCOU=(7U*`3{0I>+%x2)FON=^stf
z?+(e&;B&<ADp~D&fjk5W1W#KVDv;R?MGSZc0WdsqgKaXrL22VgU7uN98?@ATBVmQ!
z5s^JMRVQslHEZs(^5ande7*aZvENZq3EIAT=JXK<htwsAHMdiGM62V_nB%S*9EK%J
z)s*Mno=)*recBLO0UpJieV0$nhy5ajHE1s18JBDu0q;v}$K#I7xj90-*B;dV1j1*d
zWt(AAO>d2jpMPv}Up;MwJT2MN;Ry^qwmL>TS0Xxs_~miT0v*FZ$6}4k;45#^Lc9c2
zwTUT(-bjAe%QKIw1{es%^V`7(xH?jx%h>Hc*jGwRPKG*QKxYg|p3kJ!@@-6u!o;hd
zPmsUj5zu;N{*-+G_b<;Psg8eNBJX3qvKNUT-xRI0=RWEAVyQs!5Ml&r^d9+M(wHBW
zl%$teAaSRyRyQKC`ngX~Tx*v$<tRVt&dd1hFj@Wu66%d+_lu__FsmN6?_XbYk1LwG
zzdOrCf!a!G!pMN0Q8N3^>Gqz+2>v=)n|=d}#0{cH?DTY`Ygebpn7$B{*498VV*8u%
zVe;C;W;qipGiHFVZ<hZ4;+B!1x>TPUSO&1qo`~$ZEWnhF5Q(dVrwBEK5@5-z;uhcM
z*wC>gjHy(tg$ZOMCYJ(jLzQ!U|3%CET_%iv)^z>J+H_uw>*lDUIP07GTREy0p`G8}
zlezn`{ZD}+!?boLBPJmgD}GQcJumng)tpzBuLl%=MitWsQ7^UR<B(@+`+r+{|A)i=
zR6K2W!HDFpoomkvb~*M{svj`7XBe)EHFiK28naN<qV7S4ZxYtVkX9Dp4HBOw)*aBl
zKk8Ev5RN$y`q1BDuvZwiiv=Xg(*G=c=5Y)Z*;?KwIJR8poekAAt>4kUGVjNdTk5cJ
z4k&25WdHuq-(NEw|F3I8d}iQPSC!k}a;!}`e3x34Vni+AsH{;{vgaqBN61CRd5?^-
z#Rh<wG-XT!unu-8vVYWH2lPl;#F;aUSS6o`yKk_wgleiTx8I1kpK)bxzwUX0YE6`X
z%KR=fj#3j-WhQwA8WzC-6qQk?KD3hUVJkN3#Z-*ZkBSO|yCrG#Z!D~SGy;)CMjXJ0
zc?3z{(q}^-1ql6o?a^5&v6eHZ<ce6Kc75IwswyH<QD(Uf9Xn1T$tdo-=q!}|?SJ@w
zk$j}`-!$$FBd_=luG}N%@i{=>uKB_&!c$n8KX>QV4-$zc>fbXH|Ls>Kab-^wpQk?4
zhxg<MvK=7XjrhGd3U}x5c*vnv(cweC$u7`8>e1{q=R-GCQ^h|FD{kawtJd74+laNS
zPs)7=YGCYkuYS#N4Emq)^DR{n0F12Tk*lxe8hm$KrN^Eb+S{`vrWibV<^NBtWGDA)
zGdCfE2h{s$O@KwSEyt`eZ{<_bFG(A_>#V^f%-_gF<ilCgLFk*%|11gL!7M<<{;DgV
zvqomDxI|dX^%xx+Q&Le$)vE#nEzs(;m`><}HI~pS(8)h5@83VmG;|HP?!0bz-(sw2
zzbUIDRl^ga5lGc`971Ov2_Ms{&2?g&Ro0a3u=~IgIdKL25376@K+*YRB!H+^wO3fm
z<K`^lu;eTEoZ7y%&XA3vz<?IVi_xwnAFiKBads9DzMtOqKP>z1d7c8Q>Nbl|hThPG
zzJvCQzH8R1#yOQ}C)S2x(5l;ZG@hPBkfDK!?fCln?^2!#;~-4b6<kyCw*s^AxKY84
z%eWtn=&=e`&jhrb%>l_)-a_#v8(~NEqLt5%Kxu^hCMWxV;@2B$nHO8i_N11(--=JJ
z0R;0%Esd8sq;|#Q@T>9|?$zUeoKpB6E@L<&JE7ynt``*5+j-GpFw-fJc~F*udNWNM
zrD&$DZfa@$ps^i44}Bf6rgM1~EuS!8e)^y3<=LmR?ClIt;Fjdvj*G9DN)qyAxL3HD
zi=B#}%l1nidXypW{13?@==KZaId&h6c1`}KowC--@ijV(a=~uaXU8X%yVdlYFXW@;
zQK8e+TOdrX-8q&g|NZ>zEpAOf)<yLJl$DwgSx^$A?x<#s=TSnuRy6^;M=pNI)1ia=
zAH3yONK*n`TyegHM<1|PJNMPgZC0DZKZGxPn4+HThJ#wWd>@~*wXe>Tv7M@|s)st+
zon|@_{gSa2g6u7%?nBixK;QU#!v<U81nljc(0(Iwdl0Zmyo1bHFKp&}@G7o?-bZQ{
zm6XrjM#vTtr$J{mm%jhUxVd>2+EGYFxO6A#sZ)eLk~QSqQH!@J6OfCqkRHo@12=Jf
zzFh0?kj{j@jr}BjBhm4ITYuxGelh3N*5xr%nkH%F%p+G(_JPh+<X!D2miqSGnK9ZA
z;{Pd8vx}Su!n&C;b<(E()Bbsc{}qPn^X6I20^crgJjUzMa}F^~?VfRj|200?_g&8x
zyFf_%u6}sqL`HF^!5GTQ+fdNdUTpv>ByQcr_fMj&jLk*BL*AIVJ|FOWalqpSnf)r=
zRA*T7-$1_=9Mk;g5P{?Aks#1d95-mf&cb4&>Y`^2+U+=tn{7+UdzRt!BQy}IP@oY5
zE5VYc0x_8DC$jW3N|d?YMap{&CDo@dFzW`0Q%BK`|9J6qe_i}9mTg6h=hZ`f$3<uG
zjU<sipfMD&G?1LyxB&EuVanta7Gnm~wX<n%EVy<8Q#tHUga{za2Kdee@ulV5P}MeW
z?VsrtW3z1APP5KV#W6_5fH#-^sWPd{0gHDHAgCOSqT54$u~ubB(UWW`>?Ah>QE&1`
z6PS<aM<z}aD|;^W2{%#^m~al<*kG$JneZ}Rty-;`dWm5913fJ3Hu-#J(5%k}Snj9)
zrxT?h?;5tnSOp$_6k?u_R7KT~b7DS8W%q9j9CH#rfqzB(8<R(No|Tm@K*<@F3WLT*
zh}ITU+pSg8Zvp;8-gEVzN=nv80Eu+QAoD!b3QYK!i9tqmOH6Em0o1-p!VVz~uLXNc
z8TfyWQ@Rf^*EOFFOg=5(PJ|Bx^bC^O*8rkjt>d)d76ZOmTW}Xx$3@o{{`y@?9E_<+
zNy&o0qh%EEr>EO=z)tV~zLql2&m8I<Aky8KQ^Xw892Ou|MbbdTj}~FJKQ0^fGJ^Wu
zePk7oFR?UOq}`ZUaRkum&Jpnc60*TVxTnVH8V=!SA!<P5A773WmS~-H&@%ZroG7c|
zEj8<XxJ#+7*QitSx%+K(Tg7Yv`&>mI#Xrt@$-KD)d>Ki`R0<#kiYS{wqQORHSGp!w
zG%UkxnL{v6uq(jiEFl1Td`Js$?>m<f#yitZE@b_blA`9e#Lq=zAI^j)cb~ycKbah=
zWv18S(Hdt1Gb;9K!)HPD(&GQ%PQb7H5+z&O_9b@?`;t_8EA;%N!0#~=3%ddLFA3uc
z-ymmM!(9$R8@u}$AO?PckE!wDG<<mhmeWe7oKpAzTy)yeQyk4vAWjZ3=!*FDrzdE#
zUBl;!-!L2lJ#;g;4CK>oq~*N?Ggs$@*BAcDA#SDq<q%b8i>mjCU`m%Qc^XUkz|!EV
zPXGhvYFxkedSLM-#E+64-c3r$F#rLOct<vPr<Ys-xA*V5Y*HTJ7_&i*fOMHc#Uo>A
z`1ID^DARqkVZ_lR#~RPEPP7?LI~!IYz#AiV$ngO}!4<p8Acy;pg!4UGW>>|f_r~(9
z_H<X$9V-7tS^!d9uyhUfsOO$QDGry&7mOUU9<|_a-;<n2rZ{b5EChimZAFAEVq(@c
zVtuJ5T?))F@K?)d=?z9-cJ1nY2?!H9IX$nrrC!k6N}V-etq8<--xBFp{7ko)i`@!C
z4tP2|iY&XHyR`~TG@@K44$V_TuS24*-9QECp5E0zs^-(HY_0tv8}s!zI_9E#*DqY}
zSJ}VSWffZXfjnz@<|yg2?9>;kN~x~-YTlFf;R)*LZkWC`^gGC?O(}Ie03dCf*xsFz
z)HMmb+aLuJ6(uP!mgy&LHs^8+8U~DJPOOY=ZrAVwA17Bnd;HuzOGn?_HNSu=MB@E(
zM!7q;44tE6d~(fN4fh5ndEBBUYpnYC7^j~y87B$au4mO23v9_RyRPxwG*{>1-O?J<
zcZge;)^n(K&oJxaYKN3syQeQC1AuohFUDm@toMeZ%YO~hf$&Q}nhJM>k{i_mDIyh_
z_sxS^MBDC4yk5X^C#zrvbhfE|c1QH!cBywraYg}}r#86wwzkf~B{j~^w+(S)uJ#PT
zzJsjtx!3Sjb2xy)<mI{B6{MynXzar`RUr2H1}QkD?xX6yYgA*^qqH%|yL<%<JqaQ>
z11){t8ZV)Z&$MPepOHe<YAb$ZdX?6=HQXXWM_T8DPk~GhFYO=bEYe6G-mhyisn>2f
z**wx|QfE#`6Sb)ANt1lmH3|$kC;{Vv;VB%g3@L!pN@t++QtPf;>gB9^;QJ(Q`c?5A
zqrdq;)rlIH97go;`hd|Of@rc#oI7qS9jve&d$h$I_;+;Ld0Qr3qwJCfjN>d-Obd=&
zJKVBP73kYd`)r@-i$c8xc&{7!;U~>N|35mez}NBv0Dz<8beI5u*DM{@;!1r{HxKN&
zJs)k)mM895RuY0m(z%MndsrGGP=I@Ot_~E6?nJZHj6P&c{ZVGI;Hzs$k85P|c^n|$
zZN8!$3!S+E7D#IdqH@g_(B<-wJg)UxyU)-cKLp|yxYO+=<$jxIWpsQ_E;CzcH&%9;
zWQ5LKU5i%T|J8-_VnLkM#kjjXEhER;=GEeF)Aizk(bsK6)lF~VTDNtcnZ3QN`a%Ps
z2kqVT@|rR0I_isEXo(1BZD;t~bSwZkF1kLa^yr%u0>%@#J>+vZ;*de2f<s4Pn`RMn
zFA+CX)KH?B8t^pSbAwi*S@l;bt&m^jNl1?|Pw=}d*^)<Q%`R;2%0R!}KewGoFjzT@
z%lp9ON}s*L)pkJaF{DnafWoX#j0_Veir<b)H5+6AC4?-s7S5hvcwoP3V9dSH<$U*K
zo<+CZA!IzJf-)+xDvkStjd<m#?^PDGW)<E%(Pyr}A|{#<t=Zs{Y*%v6@~~V0A@^!j
z3Lk6tpv+{6m1`vp7X60dW@dKv`XDUwK<Pzg#<L>bvbX2Q=<;Q93iMgg-_5(Vy_Q#3
zvhwqvQ*A<Wl|SDzBENzbl=9A%wK&Yv7@~wW`cyHVKWt-KA1+r4V9pVeP)Wrac6Qz;
z&;Adjn#T@!4o|L2U;I@djRB;K$g`Iw{-|E$XatBcpjahBX|-U%cjt%E4#Pnc$AG$&
zowZnXRk+0IyyYKFM9=UAv5zaCE4QczSX@CfvL2Iq9#>(Felpy2&8SaLMxqS7SHpJf
zY<z5ws=VZL(gDocTjoiiE#v)xnEM%G-sVA$u3ONHx1ZyKZ%t;BW@=h#=2l&icFw&<
zZsr#(I*^x#UBl=oex=}}aD-^lgYoeb@llqBw`0Q5d?q9B`@Aj;w$gU18&(=t+6yK;
zr~8x@9@#=p8AtMgzxSM0PMJw>d6~&w_g0?Q+@rVbM(F5xBBI1isYh<BrGJjvyvy8`
z@XmK69B*E>+Y+ILyY|DNbq6i0o?armiL=_bRDY?lGPhDo8%5W?+qOhc^~m5O<((_y
zgR|QDTvJsJ34;(VZ9jbnHAcw?$I|)tIPwZ#4E5&?ewp^|++ME1dW%TSFpR8a)V&&`
z7c+XyGhp3`FYCMb$2v5+r~22mRfC*&$B(g(>cqkzQ{|Q=r-U>vo8a0TC(EJ=oq4px
z2ITx#HSmN$zvO<3@5xevkoQ5S&`GFbm{z~^-#tI*%=0-6@>L&^0Mdv=rp6bbMAk2q
zwEG_jjXt`H3lM&61@L#^b%pD_Ep_jyef5OGi#9LfE>*HspLc0?Kv%sJVzjOsPy$rB
zFUEUBDL+_N6*NO1O<()L!8#QqFl5L^N_xi1ukPRFpF`OwKQch+srkz1%v=A=ugc9^
zV6DvlNW03LKxZsK=DHJx%n0t?8<0|a7F6eDp|7A^^Qw<!i7M1aXy9%iHYw@3!|;dl
zr8+qdS>;3XGVB+edGA9`zIJ@4ghg48<VqI3GJLs1dAQ@6om-u8Ld{X3klLi<FLRz3
zg~s1W%-7ixo+?%49?m*1>$Z0#<rv53qm58X&$5lA^vSo4xIDnt7hERle7b9Nj0HF;
zq)6m>($SeCY8{y+cIDI~bD@QXI;v45BqUZ`wh5hbyt7D!+IY^}Y6&jwSDfu**6f8~
zvz!(_sY3_4ppnjG>YkV-d0J<MZc0&=Sb=cV4Bcu)%;LwX+wBlGRw(-AL~X?rRVlZ6
zU(1cVwbAkkAS&iaAA0^MK*#CkN-(%XMosk2Y%iz%8>V?iMM9by-4dr4bB5W0F~wWz
z!*!O<s>((G)J_0Z{OuoS?ZBezy}71+d8^j5Y^2~@;SNg%fCpot#?AiO%4eg={>lwY
z@77CVO~hYhyVn8FP?f!le62;F0sUYyQPDy*#wd9rRAUv&GCgFKt|7cO)rd8!A;vjF
zEavul3YI%MA))N)-|8#P8VjetP+tNdON04XW&a_0)Ssy0jfGhmwJS74a3HUC(YyvF
zYirZ+<NlEOvYEu|+$V-Da<jJRS$&F@C3X5g9?|n`@TML?1+=`4o1~^HFf_XLKd78}
zHs*BlJ#vMR+0;>ttt*OPg>QNj;&g8-dM;K6<990!ZK^td)kJ)rX!ONh+aI~S(w!uv
z1@F6-9d4WzF8c5SG|7pYaDwsn+NxRk3L~~GmURn8QL#*0m(6;u5EF++QeCzt0Nmhn
z&U+}EdTF;kEf$znUCd7uzIAPnJorLoc-Y@oScVh;6R|R%HRD|WT{SvSZd=*52i)0)
zmS1PxX+ms>7VQQu9+Mfww1~V!#Jq)7gAd3K$k2*!Ep8o@nqx0k#XGf7@3y30i8$7<
zIqd}YBqp1hxt84+I+%XH%bL?Zl?3xWs~h8XI*$sokDPrcfxUW8T@mp!ToJ|PkImZ*
zB=uF<?987#J8X-t+0|Hey%pwEJKQ>2qCVmaJ6~}{T{k^jp<G6U9z9%$4W0V>OFv&p
zvn>x)6sln=kiwNi-5Db;^40LpRh)W_^#?xB4gL^=1*=3c(~N63OruB4_fGL4=7zWS
zEPl|rnAs7Rfg4#cqQ4tn5T9XSMw^v?OA>uEY3{uBjPs6ig}uK`^8E(=Md7_d#yvc0
zWY~pAVx+uEFq}Ni@WIM+#%V6+0Ya}3v5%WWRt2&YsDpnJzHT~Q@U6aTgXE-JocCT&
zobGcKwMWJ(YPn=z+ERq&RKaaYzlz^<cRL@oXixQSsFyEy1YL-75urhUm%kuh^l)4}
zp!5oDU!J<`3lCk{7c&ao6=SNgr+RVLyxdR>FuMIIHr6hN7lwroRyo3-1#Gm22o^_I
z&0%v+HxR|qr>BxW3X4;;YNxu=<JF1;)L@9&yiA$+$+=RJ{~C9SXE-UEL<92p3@4=s
z4nKJI@(Wf@mlF31z8pck4xW9<3LTG-Jx7!Ul+nOHmC?+(KP`u-s6r$=8h)Ge`wb;C
z1b`3*8B<-Kyva{k1={kTjFGfw<9O&!DcRx%>)=J;*#O<ahp_m%1P7t2C*8Rsb;Yy4
zC<d)fAS2;294lUh*^k~uX*OoNSoTNJ6w5bqx@_xZ-}cc63Y46PFWd{mujfuN_Mq<m
zvV$KnKfD|TT{{(Ko=9`Y<E3@$ySl_j9DlXibV>M7$ke4Ie-Z8;>2R^=Jc@84KZ)&x
zJLvH-g<-@d*ZDLashX!Gy|zpdqH?qN<XnN^0wC`P9yHI5^IyxQ5~onO_ML8t<=%vF
z7CGmcLohX;rm?YLT$~m#ICj*8UmtDY?-%ruRfYQ|g);8<HkpoJ{9DU>D+0L1ai^(L
zZxA=o<vUxt@&L2zp`uJ0QsF;OibU-e&Vf#8q#pm1YSW?30^~Ja#?-4|_R+x`XQ(^)
zV~cmAkgbcpg=-m^?URh=Cv@(SFJ^OBg?xe~WZFJYDywN}KiYajCu4eHZQQLUz%}c`
zp%__EhJ8r1Mzd5^-aIRr;g+Ivi%Lvys0MPT?V9c7;cK??%UM5mom)n7JTX%WScDj<
zJF~ysEGlKw<pM<>nLRy+sUV!6mi$#>S*Z91Bv_-gYjW|kO<zTS6mqqJd!^I(;dK*z
zFX!eIT_I&lZy_E{cr=|&etm_!c1|Nt$A+^oZLHz#TN)+WjLC&&s>{2};5fG2P&GAO
zMtI6t;wM16gkTt%@Y+U%4}7OH+vezjn?iW*l?$x6AA1Z-MOCx$aN;k-Ex~@q4RaR4
zgr&q{Bk{yo3{!2oxKR%K;}wYMZ;hz`A`Sb%T`#*lvE9F#IgY0dKDP;3!+-y6{@o`~
zlNhJR^r5e98@vNj5@&0Yk8iCd0M}n?lu2Dr94+*5Wc1Ay){0KjDPA_cJ7IEurn;P~
z74TMTNS_P`z-ClXR3;rgGoxsbWR&b+X{C*ReqxnObDSyNOI53AmmX8KS^9`kg>p9M
zUFEQ=lP!nFE*;g4#jbB$Hq4kI>Z-(vf+wz#iRGabP#*1OwQxTkl!1DkA$>pOg*)S1
zD&uGMYv}LRLxFq8rfOZH3UEHll>41laohXHD7CI^YUx-;9U}oe_V94C1lUij`y~|8
zcK`3%mwzP}5Z+UJ%XUSae>tK$;D`rAeiowjmM2ZS{*X%3l(*a&-#GvuT^EGDXIoGx
zI^x8dW6e2TD7=HyEZ(KP$r-o4J$@I@gSRoo=L-&W0$56{>ONQf;r+(kJ~1rvY$O3x
z`Bx*L_wd;xgY{Po*4?41?xSoH`;o#;9V6fT;v&0_HJLk)uQ6wF4h~{dmg<`y%WLPg
zy0DeLb0wWznv9juGxtsUTo$T2TiO20?7NsJoO7ou{_dxz|GF1|n~5y17f<F8AE37z
zTC5em5i4zSsgL<0e7&c1CONN5L@KpBRJQ_^(g;a&0Ts3ZTv?tBw~+V+KXcmuN+eB2
z0^w<YF<GM`>5M^1MCQo`Q;e_;w%v<7vBrD8*m-pAuw{(h53;}}iyB7Dtsjv5=1___
zEWoDZ1!(@?bDvg@P2gBovk%hgw&)wRAB(L?6ANq`Ww=w3iV7WHy%T}PaIJe0nat3w
zuq-u}=r`@J=%o;zunp5N?<>9f$a?)-yqnuqp6j;)aQZ`K7eK4u>l?F4Qx6Wj2Jv@J
z7QV-1mD@xRHMrfr%nH5vB!P+{K3a)CCUsBQ+$TRj!N;sYDz9p?U7omJ4%&9Hu<VMt
zWT_Gb#VC8$=GFjruJ81t;X!GDEE5}@6T8q4(n~{CXSD8(S46%3cI|>VBh;(C{$#M!
z^jUEoVWoI|kXHq$I{HVIl8B89Vvs#+A&VYSxBGu5vSpZn5X%dbaY=gr2hbbU06U!W
z0X8<-J&#r4*Xbw|{H-4u;S=kZf0{ioE1)_iO)U&nEp2P6r%A(BznaoN<8vbNe-?w8
zi;;0j-IZNv&D|~d(pHYB?uz^Q+Tl%4tz`kPiAm_<gG8U^(qc@j-X*HRm-p5A3;P+L
zJ;3~$5Hk73S=%nQnZ(Q`?1+ncz#V&cROHpvkl=uIZ}dr-cObGhQaM$m9iH0hA?vm`
z8SPaz$j2$P5G*EC3G09iZ&hU-r_n7}4%{EgI!@_;xRZ;A)xEM%y*__OhufCEFJ`3e
zfp=q}3Y9}&-VXEEWGr?dAmW)~=fj%49O7MIU}~3z@II+_iwxMW6bEiF*gR4*Jo-rs
zi>H3*5KXK;;9z{Tv);I8_a92M5<ojH?tR7lJZmw53EYj{q>Nc9GF7W>>hV>cegZq`
zjtjzi)BHT!@uRsX?b6fdf6o-;^s9OS)5pXAale2tSd)~<bg56sIZPnFqS*N0f_Q5e
zdNH*?Ljl@4nU;&UPeUqRNWEq(W%QwA9A2g(*!`>BDD1Y)4X-}F6T*G3Q4*e^AvvBQ
zji4I(XyKA1PHrDlRht&|grNzo92WGjj(|Gjd-C-wkI&W}{b0{`q%o6YQ+P^?+fn+S
zTD)U<lB8YNm73SFqQiNr`L=R{PpewQAB4kLNF*9xv({CYLppl_JYTs*qx-$5c6=a8
zBkTAb?Z(F^jau6!F#<Cibq19LC*AL^AvI%k9oNL5sKL5Lwe^CYiXTBd>8lb^e%WjG
zWmdDCZ+;2|iH{ky*W_0r1TJssn@@yAgmH#w0>y1pC58*^T<pm}^z~_wJeuA=V~Ct5
zmJ*%?Qn46370qYQKAQD0?vuuWc=k0E#u`<UrDNOKeAK-Uc_Ire`XXO+SS*M~(*3=U
zv_9)2Z|L!;lAiUE_x)a9d9E7}GaIV<n^kLVh`OS;<4=vD!S&joa*l)Nul8`gM7T6D
zGy-GYg@-@up0EuBYNE;h8a^YKz{dZdy1oP)%C>#~4N)m7B<m<i_E2FgLqa7ZJ6T3{
zm3=J3FiB;N5VDSJlWbYCuOa(7mSh>b8T;6`;r~p%@9%r-`~E%0;Yf|c^W67+E$4Zi
z*Y&_IFLp8GEiB=hjvaOUvSR-qZu5#vs@AfG^YZSKClapF<&-l8hoCHrDY~W`4&k*d
z*7|o_g1lxve3=P%%Ov!6qJ>jKubn-q*Ic}fi>}G`P;H1kewU-nd$Y><NI*IE?St|i
zF{#|^u(kCZ!3RQ_fbm=*sfWihhh7*W`c`gRs>fb`@>V-0J3^WhDch?Yel8LvXq|NZ
z?(NOTe7LP@nHqT1;wLEut1+<BsZpX>k60b7SET!1LY>N|9z@fFcfnnf3a9$ivaaE-
zItT+Zv$eM}Kmhi13LCknHy{x1lbX>|hN07`Q*mAE5eRET5BPAF9Vm#UdX#Tqk3G(H
z{wHU~8noW3`t)MTB$T@8CZM_Kmzh0a5z}pi+9Ay&8AHHI)J-g#8>@<8tphnc&hwd5
zGt%bjC##i`a{e1*^2SHfoXh$*w6S5JpaOq6X$6hoA|o51EOZEDyAC($&Xca7Dz8;L
z35;_6pcI*lPa#XFWNlpg>OO60uGFcoG929TqCE5ky2bDcTZCi(Fur?1Kf+M^6p3b*
z@ZNK7c2&;+CNqn<Gv=n%BThT2!<m3U?2JE7qfP;shC+*7uQ3)}*h08V4tiy^tLZ6=
zOGp*c8K`XP9J>)?c<hGINA(%e2o;A%f*>h%mR)<x*i(Vx0vffCXEQ`&$h@IsMpdw@
zDZGMPJY3|d#s-%YwHXh8s#f5s3tr8qFK9iRyH;$xxE@ti@!*0iDYWX+xM5P<6Z>NG
zPi3uYSr&EXZrAnY&#|~n2ugVeh#N*XtEkSkq%LsOIVv2d{4QB|w=C$iX6y%HqV)%7
z4hDmvzxfwUEiG=`!R$3D*U1`HXlUrywV0ia$R(g(s;eai=EIi?<Ry_^@24RFLjPXt
z=koDqfmoq--6ewR9N^?`CiP_IG=)jR{5&s-xn)r8)Y9zNLjI@dqCklT=?m3W=9N7)
zpxvNX*>qD!eUX$t;{_-wNE424<TA@1JW%E}e^Np=4%FxSCXZn(P6swpyA9^)pW_$$
zlA=BzxD08njg;FZE%8fti%!k#<7Acg%3AfBgK3#t9;rC?>oZy0xWsDFH?nu<lY1pM
zO242zPFd(jP_^@Ne@t`0-Psi51-%xMDy&5Oj8bUZ0_p|Qz4Z=DPYt=X{c%)}Z41&M
zN9;;q+|~;9%_TJV*fq_HC&ODYGokw?HwS5()M8>8sFk*duseYvRr;bApOw^&VKR2&
zQ!{p4v`vZ+yPlMnseMXP0Ah2&jamkr`Krg7uchYXEtc?+YO%*Z7+Jg?)Y!0X#LSPb
zv|&+3{2+wiKskMQ=A4f@lzp7eS*)#JuX*18LK|xsDdc^Mm{)(5Fn!KLtx2X(y=PG3
zXN_$S0_EC>XX2UmCrULM)@_zrulFhE;oP!qLWaey;_47y9UUEKn-xXNuP=#Wrt&C4
zPpUt{!q_em32>#AM`P58sW-0tY^Hwf+i%P*=lfP}u`<p`o%zkAp3A==vjwKf+A-RH
z+mx({R$m3?>FAS?DzvNLUosvpaS|9Ip;}O{I{ikX0;Zb}e&0)RZ<p^d5H*S3!CdWr
zBzsp|Hph-;22g^kd2x4fbPQ4g*|jN9+k0c|x7Woy!Thws$4~GWP=gTYBi#%cDKDL-
z0uNp7n|J8f(Jan;v{vq};mi9aVz5xY+=Id~VeX@#)*xomb6)$z0|kqD@SKmWmAA4Q
zQ-wgbe8vcpPw=zf>y*t;g!$H1{&W}jo1(+j_fNWtygd-EmeJ{{7bmG&8pOVoo>QH3
zOz+FI<g)Hk($#y{!pX#C`S7Ico0<>}lyQ`qm(2%wpv$S+auSoKhUM|08CSg-_Bx{^
zt41T)U!?tGYH@<!AC!H^zbN}&|38EYns<QAfYDcd+*Y8tl6xiU6LUh4=l!}5q!&lj
z>f^hb22qgiOkncI$&2)-*!}MVrK(MukoCGjq}1ZsMF|h~i~G&?`?bsY`^h-e>i*)E
z*RsgAUKL}Pi+TvIrf?KO9xX!HCOL@=EpHomcmvt0Kx(A4Su6X2Mv65mn*{U`Po2-N
z$wuboLjNhVUAdYXnRQ>6>uo+&vAs}uj^TZarqIL!mpLfFujFiii()obQ15q-B($$$
za*Zpj7B_nw{~bjw7<}JRgZl^XZ61Dpx$uOCu{HeRT%|Isx8>?`U}ba!lY5Ke)2w#>
zze^#3*>XAaYd_PX4U9sNCo`VuX}6>)`#sRx0OI8-6_$MloMg0I(z+q!i7n^e%x$ui
zXB@Vq4qNp);H+^#`KZ@8oRdH5uG#vC`Y!8+<6KJe5!v69{dJ@`CZb+gW`+}+*(+P$
zhCqL)>fh#Sqzd7i4*}*yB_{ZF@!2zC{C`u6q)=&|!)xmms|_6B_z`yXbJctuilh6j
zAM+V37e6W_*_NcL%?A5FmmMvS%SVR9Wq3P#oq|8PlB#v;TUbbquXk*-t$$SJUv!Ru
z$NQJU?>{;ZU%_577LDq;7dBFc3s|q7NDo_caQI|&KrXv|#C~tWkosJ2F;@Rxz9c(b
zv-36!@|ad3k+v89us1`TUQJw5+n)+8@1UP&b}#wuWSl5kk>{OCXZ5Pg_~@=aSZ>L+
z<uh=GV)e6$RZ;daP9W5smG*luyiem}d#)BxoWj>s7teV$aJsJaZIR51_t975mj+ul
zKcwP6Zf!m5(*W)>7ML0QPz*aj2*@S3o=fQDvH<r9REycTaR07Ll63@Jh9`<_ld-?(
zv4%K{j?4Ozcq*yok7Jr8B}Q^TRznwm%yAh?ngr#^DcufLLvAwI;C!KPEZ|T4h$*Gt
za^ge}?|6rX=#SLwd{fF7S$N~I$RoY@YX3dQ_BrF*F(D5)cEk^}PuvktBzHHxl{IDl
zuJqP;mA%g8&TCl}0CNB&{aBflIeCVg|KXp9`)3Wgkm5J?hRhH&Q&HFfeBi>$cFUv=
zTIKUbbf%v1WnNFQTRQJ5c~G8?uNEUNiKXty5Ud;WS8d<P@6*AZp^;-;N>#Ke+2=($
zEe`HtAbr*(o0IfFUjAG*nLcn(<=_;6BhRnsZ47S=Qy<%4@>WyvZWPXMgBPjpsqJ;l
zZp8x@DV`b``d!t}(iQ*)MdpQnDwlj0FLk^5LS5HpDc3D`i@~&GqLApaxzlH;4cMZe
z5Cn}`Pda}R9u{VUe7{mreInSv{F?e}4pe2xMN^t`D!ts|0o{8o{-9=+;Z`0aJ>Cxw
zt@-e%($j3<yQkL8r^7zcw{3-mh@n+2zn8y$xIHE|S;}DH_;``9$?x_o=98yuCmlj8
zxu)lqPFDu~G%Ow>(IwPj<G#6USKw2Bfp3^uck^YM>G)Zeo6aA#bE?!Y<b0-RKGpOf
zCN`2Llav&O=!mx*-s(yRJJXi4|Inj8BV$AzzqH1V&d7r4YL`D6D02a7!M&z3nROlv
z;cog4X<v^4YB$e6g^NE0yKj}i<Fs%wKz4-An9c1|0dx~>WZi@YZ+@G9{ms3!Szz{w
zFnjiYIG<mRN&fX&n+kc%=WLVfuz@=n8MJQ_gd4FG6wYze7osI%<ha@fV`w;8Sm8nK
zr8bp}ZYM^BELU<P8r5s;kE<MK?{%2AC^MbE7qM~;ryYA+XSUat_Z~CM`!Rx8yjw89
zep~XsaQUSE?tTO&t-(Fv?pU*}*wY{Rq8Ws&h{2>vbzOT$=pJ+Cm6DR_{&y-E%G0Od
z{KKE`Uy$APtTk}u@Uxg#!cI3FL*$3ui<JG9ss3M7E&df%8^SYb$+l~1{q|lJM4vx#
z&uyG}M+v-p98esYg_XMlb7F7FcDvsi&JA8r06I~YMwb*yynUfoK)=o0Y{<4G2g|^V
zsb5xm<$qeOadPC{mI44}xPs*~^Ng-9II~<(p}5MsfRY2NC+%O4h-e-;7xB<Ou}=!8
z(kcs}1Ib3_MeY2@u_L5u>CSnI8ue1M(2ykuOSe;kky%^)lEcZL_}GO8O=LAj7>4~V
zJHGA~lnajEIOZB6X`PYa6#{DZQtyncdFF@~Nt^UC8f2Gx1r$7;v8N1HzZ)h|UmTpx
zRktV_aU5=VZYreS!<Yxi^jTZ*eJ_Y0m%W#|As~&h@VZln12;s!M{a%t16Fs9qUW@G
z{^F$pw}TT9F)@fK2!B@w{K6!e8Lu>p=P3`(O<hoffUtS#-Zis7Pg0|_gmq;TA-^=5
z9j05Y$E?>z4XDaF7B2s99gf&bc|&Tjjsv;Gzt|~w<5{~!?CO$vI?QL0fV<H;e_rQM
zq2l0k3wCBi)URFeuBD+#R3m*2`xzWTVpl9yGy^TnuUVybq08%zn^MU}RAvm?+Di1(
zFzgcgaKR1%A6n3qB$~w%6ORpOd}_a}bCnhIPWp~;=_HL<`}<G1)%V8?4@(a$6K`53
zXe8tAxOT2cc4lT|t^*8@t5NPeK6U=1P$V<6Nc5LIs#loiGkRg}$JzRS5i3$Zo)Az$
z?UfHLvo#5+p9G3q=2bYuUCS%Mtw3p>H%};*SHS&F5OWe2vl{xEA8p9i;JsIIhbtXA
zs+LRsI%2>0mmf*9AOIT!DoPY<+Q$-(YXcEP(3FZc=|kmas+bHg!w>*da#vs=qWHmS
zh-x*uCl8y)M%8V&af@T)f^-8NwvLX#Okg$~76F8X?IBR`?T(5KWsi9v8R0cW{q%yV
z|I-Ub1El?h58Khg?`pEQ)$1<IkLf8V$vlF}JuYROH5__3@@`Z?5s{kFw#esa<X=je
z85$8=Lb`j3Tjkl&zPIxcKgYX1L*e({>8D*VFil?-{x*$J@8zYem8gAK56egD7RyGg
z<@0d)X5vukhVZV|hG(CYgU(zC)N9VZu=#AP1~O^GrElWY*nBQUVy-I<n6%zg#_y*y
z{c==2;%RQ8pxd>ueB(s(z*bhKlUB|&;7kIAj&kPBaQTlK%$?CIbVM3)9lh7-s_ed2
zp>5D1JzyD+VRtmT<2aK60nh%MW~vaHn^aZjau@pBu7s*M`8-|49h|$f4)i@bkn{;N
zDda{LC9b%8_W+eyMwU0w1Kpd*wnXbQ1#{_9U8FT`zhm6sLtJ@wSV3j19Mdz??q!03
z1#PJUQ3gQ2q#hT8N2(4lF`Vr|Uu4hit9FDy%Q>E06kTi&R9EKRHzA(+cd3Y+ZHNWR
z4^x8;EQ<4Bm*|DP1>(G0+Ok%gwWj^C-&AYtLuGRp?_b)T$d+<Wke*cGF#5X+iz?WT
z4xTmQ^V6B-=DujNNx`&Q*!8K4<Ftj{`Vm_+vrg=na52)i%m?ZWmt&I>X!NQ@T;@dH
zn6zDtVj*nUSY2@k;6Sp*khGZlgjiN3;1qmfWZ>&0&GS;YfWp2$x2ApJM{b#1xsBmm
z!rNcU@}%K_hu(S-X~dG65EF3{_jCFP@2?c7$#ZJzZn=?IQ)CF2;JkZHW_H;E4|048
z8EFVCqZw!kD_6R*v|c^6P42U5aN*v=$!((d$K+O|fet30fsK8g{ih)nETs3q7!K2i
z*#Xz9U?TD0T&ABn5Mz}T@=uYzZ}z3PLGru|CU#NCjYGqNEl{57z1Y^Y>HX3|VI2pQ
z!E)(Jf3t?7_H5cZdu$~9vAb#4_qKlcGfHi0ZoRkf0;DhAi`f*M5}u+92ui|ccXHqv
zJ;r`46?iQB4ZQOllgE(aEqfBx?__jp$>i!8d`zf=g<o}m<rL^tnOSB5Cod3Lv?z>#
zCyM*&CWTyd4+;T43D{WB<1$Ve!pIB)u@`7HQ5FM#sq+Yzx`qoPUTw`%@ZM3vQ8jXY
z_IF#M#}`YdQp${fI8o$fJTB!s_cHl`GTz(`&%G@wz03`M11)h$q-)1dzZnnt!uhm<
zGg7tTPz*?9jLjvDvh><5^C%puy$0=d|I7~mqOiTkW$6p0V|CpZNSlT^G#9pwowvRl
z3J2w6ILF&qaglHSrS@es*uB6~<;}pLjj6`cEv5$>0Zb3BAe@&M4a8D1AydYdW;86Z
zT1}aR30;*8{{;yROP{^a&I3mE<j7RJBzesId8U!gWV&T%tB=mGC+5CTP1x10Be(qQ
zV2cdr7)BPECn*Vtc^keP;xNQ^297MFBex8n(d--U^oR-|a#?4v%mbY4X?l-w(6^%4
z0UFfZ5J;`4D0{x@K`+;H$b|X^b^}Wo10`$W8Nsih=@rmMtlZCJnQ!bwEiki0$->6g
zz*!u8h7H^|z0ot<5y!0hZ=6I<QfySHz;2S?XZ5^3SEr^aCP#Wt=&b#qq_v#6C0&nA
z0~84*doLT<@D?$FBq6X)f`APWnYEE+r*EA<c5}-q>SX4#`z{oPd<a1E#uD|21wY+t
z*8f$Wcb&CfvtY~8pn6Y;kM=YjZA)64bxTReqMq#`Fc0B4kZd>Zs4GgN7{V7ye4brL
z!EODB${zK@J5DrST5icCHIa!I#@8q`Dr(8IRsk*))!Z2(Ix@IenMclLm$GqNWNkKF
zTk+{w*-1aL9z68)nOsahDcwq$H!H!Z`i?dHayMUxil!~+ze_P(fB9ZvxT};L>2yzG
z%%cKf>Ea*&U1R!YP<871qqG7MrSn&mFtIK);LWI$SY=h;zCdYQ!4x~c?kAg_d@(M_
zmC2Kj;=oTs6Kr@7ofw^wu2C(Kpw2j+rsL60G~#EHkg-NLGGJ+!x2tVl^EKHT*{xf^
zKMfPh+l>qOor_L&$E8vfQHY5EWMd0Lc(bb9Eaut1sb4l?$#rO^b&c^USYG`&pULLm
zEIliCs+RebbPA1ezh=yohro9#&JK`BL(*jh@D79L`8i1+Eze-O4~l@m^2a;qXY|}H
z0m{>!v1dH*)r4_a`*C1JdPH`A2072w%*=q!pOb8qw_>6JMP;LTYy#)+{#ITW(5K$R
zjqxLV>Wq6b2jGrx-C0Z8?5i}X;oX*T`np-;nFzO4?HgDv^G2CtdiiaCSGl=e30se{
za%kZZKbD@fR?%>4Ex*$K+@DZunl(!WmJ&himqXe}ZMT#p%7!^d6LevK`W5J+V`agK
z(p(zqim$g=)=bT`IDebI_qsWqo9*$1UiF@z*9U+6hs$p_W0(FOJ=^7Ka75Mxl5_BL
zjsx!>WpC;aZ{9V!ycH7*)HQ(YEY0Bae?gc#XKk2$p<kE^7TSb+^VGSu(w2_oXUBHm
zwf0+hr_@O#nWmq!?s(@CM*kq6(NX$qfoC1kfT6{d5$qht2y=W^>(r^X%$43PYOP9?
zs!ybOk6Y;5aCTYox>+Er-kB(?syw|=KjL~PPif^=bZ5H;Fo$wko;SQM()!~wjaQw$
zv)d6&+pUUE+d5X3GuM&+p0_?G7Yu7ZG_U|y)NUc}r+N1O>?rO<Qv-5Gg8Joee%TV=
za#%CfYcfyL18v1*Jg00Wvk-X=1#nk^_RO0+TXOXbNz}&<5`EtJ+#r%{G6({{8ocB)
z2)Ylwex}~M4lm<F7yEuTaRca{dmmUH2e$w60(Yr>7wO@j-ZC=_M|^n#Ew3}rXfcQk
zjY2voXY7d?c;n0r3Kbcag_w;{>8BU0vIl=@vW7RRtDWnz+brL644N%}6do3Qilc3N
zf3hjaCAy@*HLN+svgfPVd_wHnsCmMxg|z9>ZKY621!@(FsMdiag9}1m#5vVUJ&Hp(
z7EknQE_rX21Y1@mQRF&SjyP`eg{~Kib>B1Y`398!(YNrQ^Aw)!l@oFa3;e1kQOD`4
zvp)m?aoG&pR)BO-kM*2A=`&`z(suAlHJx7*EKZpS%%>p`Iab6@PAPdhju~mz?5nBm
zsGu4e<@&-Tfr9Ep`$L92Ia7)6YO0IM!^}U0xUFo9gtG|yFE8$U2&+!biT#?$xO954
z1Yn2(jWW=nn+w%9w)jb0tqBb|07KDcTW_=i<^+D-`nwty@UD0N@_j}R|M6wd#NZ$(
z%C-3`Q$!uNdc*`tTD4SI{dRx6<)%P<N^C-i`I@p?%#aqf5@BG;!+2KMfXSHoWJ`0P
z)^vk{Y`WXZTmf;k#A4KcK#E$uTHg}FY6>!}QROV(_2J7exmy#CX}&97p&gYCBb6_T
ziLtqY0MH|?(XP+S)VzW32%h0qi9N@FY56|koxU6#HnZELdnY5RknTOapM6&s{dNjJ
zKm+by(j7#Gt;g-R#xg@S>hvG)+KfUhX28-OZIb!o-I<>IS<X$~;1m2;xW9$OgsX50
zA5WaO802M}9%6Ek@}Q4kDS^iLjE##o^{3Sjj)y?EJl+6Fdf1Uij1UXG^P%J&L~vnD
zmWe+-^2$ImoEsRR8RioS+CNzUf*-FqQ9ui)9Q`czd>pi+62c{%B;AL$izR?!f7tKw
z09X2VC+VfHkWX8K7eBH6%!EKqV<(_1p5*5Do941WV@ox^Kx8lF<Hqzt#xsKNpc=Oi
zMPN~O;hQTCQET2$EOZ+KH#r?&vdbc0!X2{T*02`;7fL^M!omvxq55NnTPnM4<y}*$
z(l#k0jx9hh`jssGp*>6fwq9wqfp7`uxb`@=>{G7_Ag&d-@QP)F3mv8wD^4gjuia;{
z*SR9fG8ZWgidOkF0za~nPR9d5;d%yo?&3|$vD-H-P0}1qzg+<exG7~}`kP*u+~7Xl
zwe9`s4?09A7XaHmdjtq5x5_bUby?h<aUU`$Hq?Wek?{Fq0DS_7`lfkh6FYp$V>`Zn
z^|}AL+7qCY*GARL#?Q$I4&jQV0S0fEq@&FpzO!v*cvjqftLwE*BdIS!C~}t`-y<-K
zRl-iR<1JJ?3@B~#2LK^Oy?x+!@;QF`z*8AhF19;-G{Ub(+P?3tS?0Y<E#;*z-xmRP
z8xo3X?Lv=SlpWZeiNoc+Wx<?rvY(XxJ+vM>k;dX1O$|2on0PfCC3CP^FI1kw=1@5*
zD6w5Uc_GTd{=@tzzYBIvr@%g5ydp9+dfD4@@nwsc+w@<0ZzHBoWR4N5Wk@@kyLZ)D
z=Dx=c9$k|nwTn-e9z%rYgy!v+v<0in@jNXtU?^tseduXcT6xIZyp2(N_t+|$S0(m`
zm_cf5cBn<L^P&bz^6Tcl!mDk8eu>y|0(S^uYc`9p6(T;}(wAl35;&%x@++Oywfgu~
ztFO;}%Dc{3*{)(B?`@+hu9rzAhAc-F54#p~d^`Jk2~%jiusH8`gU@N@4@|rWO0Zd8
zV_&BZT%wqU^2hc^v8&`EPvE#wF2F~S?lpM4-L%Tk;oc-jxK03FUqA}8QRm?@ymzG)
zbY4e2Wmw5Ou&QhIB}U;d6b6(IQbR)GZ1;kG4NrJ$Th7#H0_1T3Q67qaFi{{R4z@#?
z$F?WRsSem^hFdx&W91CoHUrmOp2}dgzM3QwAx~%GP}`vyKlXR2|0EVOdAcLyc{!%j
z496l&F~xN7Uc0CtpWj94-Yp$FC4R~kFNlz(y;2h|PNTJfuN5J81(;Y`DCkChXPNQJ
zTr-{&fR)rdaP!VAxU{`|*{fARXXxwIF5{A#+pX2v1r({^msj$<d>N-p9zTC;R=lt-
zc5)`uh4bMDEz+rU)k>|7e*g5z;QN`UN<#F;&)lt3MkQ;>D`OZ#L4-Qb=z(Ne_Hok#
z4_^*bn(xQ{t5-Oga_A!^&@42P5Nf-r@);1}#9{jaZmR1lV-|RWM_9OR_^x$lE*>qv
zb0EzfDf?eY9g45!kHqA1a7!pJu<~|Qd)0*CFUY<V`K?k2aP4oEsp8o1(`TG}V|qtS
zG4GCp3Dkuz<;BT8X8?Ws({lyZX;G^eI;}ER0E2R#`mp~!=Ken<I?$`#0Z)E{dLzou
zL@EUg^QJ_qkNC&TsYm%Wz<gq*V;@B@#!hdLU#6FBtawqtwjnmWcw0y4vo$fKd8x9w
zgmZ38PwrP#_=klzh6`EaHc`&|?~ZNx{1@vk|KqF;G+8T~i`QGU<D}c=?t5D1u_wu@
zGa!k2BzkC0$Esz*%F6E7wECQ8D_I%M?MK*AbS53^)cq{%7HuT$CxRpl;s@~#y{R=5
za%oN8$*?rwdZttJ-3F+8c4u%iZpM28U7l6L@%)1cBs*ZOpJ1<)&E>667fp=LIMlH7
z>&e>MZ5{`E@0KHvrqRvHF56cSZuPQaDUsFuPYt$yjIQMbFMrYfHpa7Z^f<_a&WYLd
zzu>&)Z7u*jX1qv%PfeX6KL^9#&v6Khn*skYt86~ub9dGQP(v~A7l;)P9X>;pR(1OH
zK+eZ`z8gZ8=IOrW^9h4lN5a;PqKC@cNmGX`R1y6U-Yk>F3l(Y^qh_%0F@x1Wu+9ah
z$U+8+@Lx6yfW2T6*-1sN?5Czz*mA>K3bMk&(JC3}b!xEP(Qu;J1SZ^e!R)vw;>8Eu
zkES2F1K_=^4S%#m0$UKk+sy~Oguq*aNF@#Q_}b>TQvoGN%<~Ya?e);UfhpaDu5jO=
zeGp0X6wtPn68mwL_TcupTF%~QaST6a`1SDoGZ=wu%C(j(QO1hq2!8_Z&$|dwXl|5G
zl*i<BneasB8QXF~wle0X57CktIoL0KcHvpC)uU@-7pA5sBvxX2sy3j%E2YS1T9_&h
zr~=u)jjYbic#(Jl-kYXx^;1RyNoA<xIC$R?wtMhC?Eg2S<=&w0C(=!2xn4Y`hg`t8
z?3!kny>#+BP8aCdWX9i6IS!V!6q8=k6PQkNd3|Sh2v!||5tdc9H!`;)TD>X=n_~N~
zU=Sg%1;|pLumN8#t5&se0g}KV0MVRp3T{`>nvZ$?TA5lMV3ZcQx8mn_R6e7CHbzwn
zpSfh5CW&e5m3I$-UTkGIg?s$_@RTE3^~S@Hg9-JT@1K0~4FD=cK30N4WWdea=;@Xr
zIraZK@u<p7*o$epVj#Xk>>2)H;oU-t#3Voo>tkyPe<IkOnNL`W8-|AdUTp&q;WQu}
z;FB`Syjk(L1K7io>ncc=uS->Rb&^19GM*^D0!#`KJ>ju*JI@^ST}5n>^4Dw}eDo&!
zOY#gK=B}HM=&Rba35uUOv+~gEhEzA`|NS$U0Z*nZ4knzazh#sGQ|8?+a-#y<O8nX1
z%Oy@OaK~=H(Jc`IaIY3S(7)|?aF>27|1=%HAFWY@oZVlCoa-tl4(N~SkKR|){4omT
zZZ=u>=IjE_=m%K>q6TxfD#gB|GZ7b95|iFI%!2{aWhq&}+V8iDBUkr%vQ*_ItK|<i
zvhXOpr-d``WGlXb%fyU^IDS&yhkc^y+&`!H_wfMo1o{3$R&#Csy-TT)zF!l+5VmI6
zrWYS4ri2uODHAUo9BnO&Xh&>hPkD4mVXUp(-K-K5M;oO@ZuknGFga0P7Ra3P^8I_Z
zmN%>+FB?mlsaM*sPA)4`h!U@!2)veUa@-+>>yiT1$@9mL*B$s8zw%hf9qL$aUv7_;
zvPR-^eW31ot{ntazs@L$@HsOxH+NnRw<lXOms5iF+*@djkvq_`9{zUZ@nxrtzN%zr
zWV_A!Q`5zo&YH9Ge;uRx&zJHm$=#W%dt+XPC;Dg;;c&6CXU;>@1tPJ)d#8Yx$v&qC
zUPlSMJM!;uo{iBwc?HFCB&LM*rcBB>)a;gQ7o=kK&_ZKJBNDG&!qrJ*FecdkC}v?j
zV*4=5V@q~Lq*`iZt*vqJa7wjNOK)Ce{WQf1uIGRK-xv83Dn_tt8?M5E#@F)$Hair$
z-nHGHL{)?u>Z-Kmqyr(HK{xltL50<K^Z~pWl>4K*|5JHUO(pM2%l?{{^zO+)x6)R_
zwdl$(J(cOH*oxQUK_WG4tqtvye$wEoT@jS-!J@-~?e5<8!DFHWYI~vaOJJ4%(E-|l
zapkblTBYmo5pi?n$cY%K($8$5^4s#9#mChmUO_=5yh_Yo05A!^mvVc*4<jc%a(F<C
zMvN~!yOT^$HUA0<26rT}JM8t=u6uOwUrweiPY#|HQEc$vISZQf`}ZQ67SktSdu+F$
z@h^v(LZOX0D@>rHSeVeEtt56wo7h`(Xh+;I$6`YxAr5-T>8{`y*ug6Tv%caV_jTNN
z{Z!(bzfsY5Lgi%)^1&-;?2D%2vmcqk9rO4;l1#)s)5zNRgpxD~&s2%(uK(M@fA$k!
zO9O{Ls!Y|=c;JrYms@L`guo6=o%n#5y|Xkq1=)^Iz5Ov|XBu|oMU;lX7Iqo)itqe!
z4{vK_UO{)KIt&+YsE2FGCEdn6s5AfPAjR5=4O_U;L=GJv?co@0f&6}!OmW`H13k9a
zB_Fsv>zF-TBW!RcDPwNRwatFTQU!Ad-`R%JI@q8&9DgRamWkUlBfbi&$t&IZQ4$Q<
z>n?1R=qg60?98p83Ov4c4J4i;(*NsBpOsHmr<xUlx1x6|%`k}IgtdG|u;nSv;oHe3
z_!}@4jOCo4ZlZbtN{SGC^or3exXY!No-{3TX6vTU*5=BE?MWZ>RMH^<eK<o}^_}l6
zt=)XNz&9AF0}I&9B|TRDfK@0L$#^jDt$(=kG!Jd8ZKYr008;NbCg(<)@7qfe0LJBr
zaU{07?~VbMA$Kq$!MPI++w)&xtl40&u1ezEdBk?^cQd@DZW?|Yb3lj-O1!}5+}fmp
zf5+$Xj21A6$WW;Fdx_y~X-N{PBXW6T2)%0uPS+w{<J|q*D1Yr}t*3XgE*>uG3ZG|~
zmV?9hzT!}ro$(55W&zSR<WPyY--XQGF>$q8^G07Y@gy=dVj*%~HS=vb-2XC0z%1d4
zrai!|@MSeZgD*(Um|ugpGRhRclCSEvtqz4=by1t$vP}x-B!qJg?$1ypd93MFxBmNd
zbqCUqRJtbY6BA{r{qCz^_W2}51f85ahaEbX?A+m=D_C{rysE87#5IAu1X2B2kVEy}
z6XJY4gg+=%wUJ>EEtqSpHC}XDW&ht^;xCH$tDhfy&^ip!SS)%Fu2p_TILT|dupY9x
z%Pdz&fDG+l`g|Q&E-ghBjMSVLD{tN6(Ktd9xr*qP5%TVC;@`8`i&ZI4$<l!<K{ga2
z9UVM?apJ|~rb$CJjy%GRmN8EEP_%?R;84B=gVhcP%-WGkJSJF&B^@-xp$1V>GTK8Z
zfo$bZ8shc_T3<nl+xnM(U%6+@zLvC!y1N3{kyp1dI)D9epCY@4LTPX#&C@uQf~qUe
z)e%~jhU<YllkvfPgoWE?*O#w5CLIN_IdR+XP~(i+CA!vihE*xnR3YoZ>%Cp;UnO>w
zuX4%F1$VK$f<}cx8JHE1xkk1XOM^)*a}XGEMgXRPXY8~M{Et5c{<g^CD|{*ux&pf<
zM;ZxM>;;3DV#kX&x^kGoH{tMk56;Ydt#@6nw+zZ#5VCXTMiwu;qzv9r(jk3C{&5fg
z`2NqI==)A33TK2u3+W!^Ow$o>%GTtP_i?X|-sj;#D~;Sk<Xi=Av^P^3c(?d(Mrg`J
z5ibmH9Zi6)fEdxc8?^OdIo-BVh1NK=b7VKQj4#UFO)j2`XGfKrD<qWYPx^IP@FsUF
z2@=dDHYX~VXAw*#Gcf@hYPhvWE*h_PzIW|7j%}}3vN2y|o(3l;1|G$igs#I}wl1=#
zhe9K3Wc5ixwey}M=k&aN)E0nyY(?$F)EvxA##$#ynU8~h3p;;N>?@jLUqLY#gc%Pr
zSQhd!yW193RNR5Gt?JJFkcy3)_3O0%>QdP_OIZE-G#p{<`61?BRgp|r*Px0L^(1se
z?Hh+|H>GUaVm-*ekvD#ea-=P^Bz|_8v?GUu#jgy4!Dpyx>JcRwLDlcy1ux}i%fWJ}
z4BhriQ?(E;hf7wzeR$p0lnYCI1hbl%o=%gLkukE;`{U4`cqZkmb^)9&mDAUeS$U|9
zFPix}R2T*mfd_>`c>;JrHF62rj|Pzshu76YLGA_7a}Mq1d!4gy%a-bB(Ji4DH}VaM
z;-TxKdll0>)r}?J5|KN%P;FG-e7ZneL!fWqv&@q(L_(%~MeHL*ItAgZNq~;=v9{Z{
z0$VTa`rOjsXKx0M#QU_{M}I8diD#kDZ(}<0x1d=Jz-H=z!J{7Vz0UUcbAdB)bHSa<
z2W|&L?w4s|^e5HPk?wT<!e;kC8=|TpxB_z_yiQ_z^v<{(Y8-fdXW2w)!1bUjx_dsd
zp@TX|*Uf6<qtP*#N#tPht-L|t?9tI_-5o^5=lRSj8uScoAm8tO8g2sI>-N*sRO~#~
zJM?!e<a%Cf24oaM-`cV&cpm;-s2OAjLuM*=BN5dveJN*3{7}rMfA{u&FfXy_(Br(`
z<b9(YNbbO<Z0rsrdQuCSJFLEQ3N|5tv>dH2AWn?}-YhGwlhZHNk8pqb$#HAfs?6T}
zy>gyGS2$Su=ArLzw)fL%!O4+En}FZ&n8)8(fHw2Y`E@S8Ej}_^hkH!i9D3}_iGO@f
z_Sad0Wdy1^mEAS!rLF32`z+<Z5CTlA(cPp$;5M@swmo@Mb*5Sm**b>5ghKuLdTh&I
z<Rw6!eyV-qDQ7jRJDQuS^|t7bxJ(W$<(Gg*k6XrXSj^+K-A;%=aG%x{w$x!(X-EAl
zMc*VClIi!(f)=)EoOp5@`uC<jwf|VVfSM3FNJkxB7H&*0U4$92O1z_*-NXQ%2Uxtz
zOh_TU3<91p;?FeT|9;&kIJ`U@3@)2O>L(O+S3detzkrQ74fODVeR|1DJGc8rl93nr
zLOo%Qp_r{iXpJOVwP7f-R$VEw(zb87jQw&O6Ab(+i{r2nsS9mSj`t(F^2&`>F!ook
zR|))I!uWs7eU|K9fn+r4E=QuX|LS|1AWN)F#1ixC%GKEFNHF}IDst7pDk;uKcb(aZ
zce%mXTc%!5cb(~AHU5z2Lxc+ca`c+I#4gRYeJNHJHXWQAUv1US-N6BpaNwBJ7#=cr
zd<O;#Y1R!or^kdstufyq|H+&G`I|44oHz4xByy^AB#unvh=)tpGso*S(&j16P7DvI
zwyhtOc_=5{g=G|bb8?{bHd^%XK=2f`tVx=!srC`Bt^+(g$~)DXXt034agqHrZ~Hf<
zgqZ^atS5F|bfI{D%Si>Z7Et1Vd!tAn6J}fk{$hXpcR%|xDKo7iFGf#KCKAo7rGhD-
zyi-;^k9<p->NJxPKjxWCb0}7=SC->pvrw8I9B7W*y$E`WYuZt}_Z+txk2rV@#anPD
zuIg0Bo!sabvAO_016izOGFY#+Z)ttVk@)qt;2#MK@ch2^e?Pi?S}1fGcn{l5#5xL`
zkS0xP4BH`qeI6yvG0#mVbVb2FiENMz2dl?Pt|_WiJKLdqC6x{bOMCU3P0@3^!1408
z{g%Be5ilh|y!D0M9nO!+(jag8jsLOfiz4J84~O&5Jtc4Z-VJn7CPH9ED+$H!c=m`C
ztIixYsUZ`j@-NV`>TA4BMixDFW=tVMdY%M)QBCB>L+9Uu6?qZyWB{TCK!~YKK(1Ro
zN?h(-ZJgC1e$7&M?=6w(LZdj9lDb)xtlx7io#w9IjbC`aR6%#PWKws;9yU_$lThxH
z%?v(6_gdVhJ~-6EnP~IK!Sk?^G&?G{jMrZN0GMjw|1i~Cih#3VBs(;em@B*$X4aIt
zw0pTp1a(Ng5&^tglJdx46xA3md0r)}DZElp#G2yZ9opUx-OHC~?+2aHL2N1@T&+G}
zyGK$kXP0N|dVB*&6ul9^GrauF^WRp}edh0{eACy%=YBO1k*r^Q0|wuc3x#;|Iy;8(
z$n88B%j75z-~rMmLGSM4#_hewaqs839B<K`6wYUaOsX98<<T^#)R6ofh(bV6`HIPE
zOWLmwxs9p6VID0om{nuU!eF~D2g-Z;!=ZX9uX^hn{;!z@SNN%<=s&{<;H|Arv;%3v
zigD+l4B$P~x_BGsf_BmKy;~9TQL5Qfe(G1xdVUlp_{sg~rZMi(VJkm%lp?a1B7%@T
zNG_kIAKjr`9(ANAO@*O;ebAiK8!*XGIxD?sU4ddV*=UW4FSDELU@+->Y8WF8&F-|<
z@0sPVd&-WlB@jrHZ$P67;KiA?sZc1hFgs%yt~5FWe-#YQLHJxN>32sWyTCTxejeiz
zQ_@|7O!Nz2s49-3nQ|@J={a!8ulbHBM8Vi-a?IK9sKATpI9RrcGj!{kK=$l-J+3sU
zHQ(7)GT=dmgwMO-_@uDGoO05U&yJOorzfkwKxo)X`X+I%)NONO5`WG8!`km4;g`?R
zm+<x4h6YLCJogtr@4hY!W_J0YB?WQuaC|7U^*z;kVfR&5C(TgJ!Fho~LC|^!_6^ML
z=zwQ@#~0S{)ar6|LsRw+fKT722d`@E0a4(3?g_|6cP>8k1pP39zH`_usU$#gu4^|k
zMvJ)8Vb~NoRCe)>3g%<&f=BGiMVV?Zkw&}2_sl^R1RO8#)K^U1_~+8S=K6Dk|6_0e
zqIh~`RhQqnJU%FKGTcE@`u@5Kk*6tLdjq~SAGHSk7CIN+xxBG0l@Nxs=Huu-#t}gI
zZ_7PK{-(Bb7XTl8Omu2v6AY2Mo0bn88aXubpLzO}Ev;0#U`i1SiG?kNG73&}P+=r1
z#5o^3(-sqyTEAw!{mt-z_J4Ux4T`e(t$XvIf!@MIICiMCnGZDAo1S{(UL0*=YkY66
z3F2evL3d-1VZ(vCtJIGKd$V9tMoe)G)oSd3(kifO%~ZGP`+2;JQt6F`Cs_9ynQ;%e
zHXa)H(s+0K?|j_5on10RZ^u!x)U~uTvl+Rrcm9N|cFfM=W%N()bw5(4zSvrgDO8Po
z2&M!}WpScAdu$FoTQk!JCSw)uafk6q7PN>*e;|yX=e9_Z%iS3a2H&Rvbzw(J4{e+r
z-&==sb}Lxd?Iu6s<=mfAg>|@(2hkIIl#$&`#$P^U@zn5&3E#yHs=1|{C1*IS%&*Y8
zF>QPG1^bQr!)OsAPc@^@L*wFU`pw%Ig=%gQNJ?*x(Nh!jw(A@R2C>iPFebRniQ}kB
zM%Ik<^U>SO{uBTHy|_Pk-`1G6jV83J0LM|3^lUVBFgFeJ0}YDv#ymL~9Rs0T5VwI)
z<axq90f%mUQ+iG!xJhmCl21d}PN2<u$Vvm}Bqn~Ru8M6L4m+O=*)x=N7@$o|N!9w&
z`>B32vQL=gpLcYPAa@77a<<(#5gHsBiFKq>{Vzuj#HI@;*g0pRQ2)$$dAS`ApV@Dl
zS&b7DkJl4}IXZdOT;*1!GNcv8eVZ(-&yw%xZPPy#*FOO0`(+T2*PfxnzSPN0W>tUG
zk$Ww83GqSzVpdfySdv>#+FF{L%!zjx9Gly?!7M!rV(qf!5BT2}n^;??uqRr6qa`Xh
zfsW3ZX0>HEB?T~=sL8dN;HWuslWSv;fh<)3_~{7ehtkW%%Huzjr_t}(D1zWhdUkmJ
zgWzg>aP{=&s^5GB1U^My>RvCq5e7N@^}#U2hK2}y{;>+ClyYUseVMUj%xCTxZxuhq
z0ygrk$GE5zpBnv!Jbj1X3F0L=0QUX^?#RaFha8{q7iJ1GLNs&aEqk~&EnFBSdZJAT
zQ6@7&f7+s3Ee()m_#ypGd>Yd1%LXdtRu(#?JCVaH>^RlLM0=*~u5t;xEmFKx`}XeA
z3Ni|Ip<DIdb58sv6oQf7^E;iar24Q^QiIOD=OzT5q>~bk9AD|9*C|J$r!It-#2*N!
z39IXY5T&JXQLxm~7LE<Y0UA}4m99~!-JRKvY^;K7oCgrg*G-F3U#GK>aheJ|4P0%o
z;^RWI(MA>hUM@3u6M$E6w^oQo4C>qR&T>`SKuhrFvpGD%aM9|Wv-Fb+G66JyK9=sb
zuPQT5W0XILKQxqX^w<KOzI*L*EyriD%qYej9Njf7{`-%7ekBK_*R1TJLH@Hj9`W0*
zqM7B@gCLx&@bZ`}-}0z5AG8;R;XAQ@+;dm|Xg?}4WnupylzEO{+_f6-%lXx~ff9l*
z0lm~r#Q30j=bCoI_3Cq`b$n{+b%}lfSHM41IA-EI=;-Kz>g)X;KgM!(FdMU<j<|+@
z4B9+vKYoCPkn$q*_H)qz8`UT%TAh8_nY~xS8|!YtJ=IxE;<{Txk_+t`+<A0|4Q7}J
z0>Ysc9DbkY86Wk6d+7~XP-4t8bjKMqt);>vzueV2YyHo6LE_$e$bc~6DaC%p0_ng0
zI&t~l9R+QZm_h3|G`r_v^Sv?nutU6v+J!GS?Clpyft)93cxzG@8Ax^>(H*$9<tFzX
zI^2ZxK|S)r?$^ETIq$BppPyO^9<JWM&y3Ck$T!K0Oi}4vphLkCn{ZxrbMKv?UaHqt
z`rdK_*o$3TEF-Hd{5AoPqk((kWf%t?L_$I+J`}yoyuXq=$?dKNH`#MHneGs~TOLGv
zK<uKztNVO!Jh--k-4vdGG!|VlV>fkSs(5HuZ4BL^H1<|v`V2yGY&@*O!}!Y2&-^I0
zTlr=OxHuMo!KP>{s8pn+VP8w+hs)Ezx#<4%0ROU*-<Y<)zj@aA(-!Krm!eeP#dG%4
zDG|#v=IlgHju$56;{AQZjuE+iqFYoCQjL$!#!PA&y>9D^nN$SU*wd&%e9~Ncsva@i
zxqfx|KE;M=&6;zmf;XSse}c2)S#od=u=yy`=)d#*+fK4!`Ka>fYf9{j+(L;79zZ5%
zP|;Q?=4xc1ppj|ibt+d%a#BZktB1BKAjT=Z(Bmw<cL+^+TASQ_uVkwvKaQ^vy~BWd
zbR?;16e!^I<*-!DUi9a+@YH8%VQw-W8R@X5b~s($;M%g6r`ixzdR}iKOkirDBg}9C
zuzGF$JKF85sQ7$a*=p?ox`%3cg;jzA4c2nTz^}BRm{h84kM!SZv?AReV~&}0ewRGW
zhXC8k%LMovgZ!KK0VF^yGv1a$!FqS@&Q5w$nS~*m_t)frGQ*l#Z|z;`$;VU_VUP6}
zQ#hx+5h!L?p|BajVm(~mAZ?<i3MM0{(BrVu^2_<6J<nl`fD(~U;NS%%kfK`fH~~Oz
zLjhnHa&Lr{23QUg&#h<~7n7<(MV1@A-JL`Z8_+w$xSg!oef>FFq_4<go=5<SD01j7
zamd}J7c*%x61+e9#*3WGZXbSgzlm!C!^UZmk5S%_*`{iMwU!2}$!b1SIX=?2K9`eF
zf?lGZ4WgGTOV_~q$>IIv;!?PyCNXL|MNJq&b162l^l1=XbpvRJ67}5#WwSRu`N$}E
zAp`$*dzTV5PCvXruZA`<3V!M|%E+<ylLL9|MfyO91pY-RH$FviY$XN)SS;|&Pa1W}
zyQ>z3HbFyup3nqz&7x9!91xhacf)6U(L1VOz@a@hfatqH5b7gDj_P_yNPUQ6$qM-4
zNRXjZg}2kw5xbvP)w4qrH%N8;PZI^@vKdJ{!@2sEGL=la?N1JrR>&;_u5%_7YWwWg
zjWT>dPtmf3%-j^5Q)RgAYxC8_2_OlV2OWHKpbn$>Q19_}yYYkMq8#0u;9jYViPWC#
zzP0s|qPEFzfd3huXl;r##nx|fcz>BNoK!^;V`fM?V{>gt#0_~-s3=sGm3-5KO;Kyr
zl5;Lddm3c!&*R)-c<$E9!fU@57I7x9yc;e}igBauR`)@Z+yvkZ(fD*bK;AX&GNNa(
z$a0+A(t#vop)xmOd&V098;jAKj&hx4@|-V80?rQb{q`=r#{0*vlh1&ZaOAJg;9gZ~
z{`A=b-+OB^I0*^#NBEDcL2uN$hE2}bS{K^`I|<nACAq5tP4&zGTSe;gCsVMO?EwS5
zhhDoM^osq2I45Aif(#(IqC^}1s$hT*VCb4Rn%f?q)KWd{R!2FS>>*4pdnAD7R7|4u
z-Uxg>hlx3Gl0r4uN!fppJ6Mg3k?v>%91uX{jGf9wz%XLkmLFTY-z^mk5sad)2hb3?
zIE(w~i#J`?IjY;-cZH9{=x)-%D(ee?WNFfhSSq@F<L5Opa8Q<mj$c_bCVwnu;liL$
zFsvkiOe9|jW1H$cd?Wq0&3;o>j0|oa&v31okOE=WC4ZO<RNo?;1|h|c?Tt$S-H;pI
zZ#bt(_N8rpYsoS;>|85EobWe=HMvpO57JYde_u)VYhjhRGwulWvB>RdSwz^8o6{)I
z3f7ppTzpw{*<igC1Gsm9f5=Q(ubi_(8=qt~GBe0I2%a;y-G^J6ItKp4mH7-maV3p+
zTGq6T{+r<Fz?lMK{-O_2YEeYEab|By6UpM<RZb}YkT-{Is2C!w{6oAYyxx792a)Mx
z?bx6sxGR8KO0DVTG2YUML1Ih40@rPyC%lk}A9Q*M)v<_@Tk$18l2VqcCG$F}AwMFz
zfAhPx_n7CNv($L|_-lH(4N<zYz%n<~Z#5_)HJt?P8}05WdLsqpfXwJDNWpZNWU6-<
zY6qd0tEs%4_mYjpok;1^odLR&2D~!*OQtvgJ@-zP+{~Sz8QoL3)`P%r$&829R9>_%
z(l!C`zZx9=Nf)j=7|+j;l~*Wd%o0Sy8R^~(FvZ=9tQ~K_^nw09O@8a|loK<>FC=am
zVmiatx$|1H*7`lym_ipOu8Fj$u0>QfsP7VP8L9jN`ERm9eqPgAo6`d9gY_CF!21c)
z?a8o`&mDdrZENE^N76MrINgZ=oN~5ue2jpJhb6^^7@9tinRwac)*SPi9BgfPG?hw7
zoegv43~<msFHAi|z!KJ_<VqIg=2lc$K`lm=Ve*Tj^nd})Q6l9{9<W|)k(UXP9~V6x
uY~1GuuyiXaxik3*jkmVFAJcmrL4==StXbZmoBjg++*5+y$-Qm*;{O38A%rUc

literal 0
HcmV?d00001

diff --git a/assets/img/rancher/backup_restore/restore/existing.png b/assets/img/rancher/backup_restore/restore/existing.png
new file mode 100644
index 0000000000000000000000000000000000000000..e9bd6db38d37a02ede79aa05f683acf4605a7464
GIT binary patch
literal 253430
zcmbrlcRXBQ`!-5MBqRhubRkLzg6J(Gh^UDcJrOnP=zT&Gy#zt@=+Rp+>gc^h9}J_9
zHoC!>az?(-`@GLN=a2LJ-s7`P*?X<MXRUkP_jTQ6g==f7+#zKkB_JTUqx$m28v=q`
zVgv-&Z`{0rKSLtxwLw5|o6b&AQCn3}kxkpx+1k#*ih$r{c%lJ`u8t~Qroo$=sysp3
zd0!T<$C>5Lyi6n)drtL|N9cNRM9X7dkZ0A;Uz?<1j{Kh<^Rj!=wJ*|<@eVY;t;{~s
zBHe5RO5$W~7B3ew{Pz9NT2mxN2!1uVbgh`^GJleJo&8YY@wdeI)E;)(8#jLvG5jGk
zV{!_TU=tIgdPeVyGhH+doz^ag3|e4naNvj=vF2^W1mRyLJ{z<Re?GrU0FpC!{OJ0p
zKZK{&I%M6#Xj%*YTMus%#69jbBz0ixq$l0wsaFjn3zoP~Ae`74XG!=hx!Z;YQ1gzd
z@xFx$r4~=HH(yt)31KJ+fUb+<_^9Ansq$Bd)M}H2AuuvUh$*47pP?thWbHXQEp3>a
z<OFWi746(Vm`EP|o|I9K?N)5U`t2S41QE{XArHLr48Kz{6IF3_*?g60Xt@oeec4H!
zh-`rdv%M8*yG}qXqv>+Jt1^j4CpF>z&n``-a46ke?pVij&tNK>mjzvqR&$kdpqnqP
z(z~z8`Q0=)B743P>LC0z+aYXOU6F!@j4GZ+W~`3={hOy<?qSlTt}7hhThAhi6~+|B
zsO-|CY9zayML4qoq>Sp~74LWihk^#<V)MzWfZ1#hOqL__56IrIhe{lrw?7~yzaK03
zO4qe>X_qug2bC1&_8}4ZmQ!B*vF2+V2cW`h^tb)>=MwGrJla^S-FkX>&p+&UeXY7h
z>LfwVu5kC}jmK<X`H9pCXP-e9=l_s_@5yF=B6`S1b`aF^Mr1AS@jhj{jSSBX;PWmL
z;?BUJBQrUkV3c5|QTGIk<$z!08jIx8tu7ys++L*LYTUsVMH=;9kRSO))nte=XUN^p
z;mcjxIm1sV1S~Vi(yrgcMGIVOy?7!`PdBDb4qKtjyeoB!;?~Sf(=Wzsw`7u3UK?r9
zjwGYo(us4P(M8b~4+#+U?9x}a^FOdRkhyyngnr<a9==252PL+q`gGY2HOWT$g^a&<
zf_=PL^%kCn!E+}k9Jk6}(b9JUxojcZy*vuAsW1{4rM!_vWYuQ~{qA*7a{C?z0y60s
zQ46}NTwxg*YL-Epjz6{lS0~9QF)n>QRU=ishsW~Da31=XYdFSxM};&4v@ibLJ9H0!
zqNd$P`bk<itD6?UtX!SWl(DqOGY_Mg?`16ThbjMngSU>12@W2A9Vm5{ilHY^$s}m=
zKGU#4G6+=A5HKN@UU4dsG7I?KB_RIQo|sJ%^@+YRL{gGaeCZBa;pTlZi)Ytf5+}Ty
zB4(qg&Lp)C_W61Jdl1b#e#p(bPl%s4b_q$I5!v40ZnJYCbpK?(M4ryLutdB`wBJS$
z%=Yk0$dkLWUH7Y=?cU|?B05xh{_W*Ma#f}AxW_NPyo^ifyOwv`@T<d%x(Bs=6@8Rz
z*ImiCUN}9V_{Op(dUUH>o45EYLr&5r&m_^EXB>a7yR)Z$-N^0UeC|%)$Wr#)EBAEs
z*2y*BJBa7zKQZ^)bcMLAgJ(amyuC~NIsbjikLzjCi5BZ`Y3k_ggK;R*>9402tN`|r
zHbanXde*Wx`$+fk;q3Vve-5+HGpmm0G-$%bP$1`@n>VgY2h#;<ynJ9uSwQvb=K7b6
zFP&d>ToCTmi<IFnxW*zj$!Dy2h0-KGgT8}OK(UbLyAS2qkqIv!%EmMIhu%|M`9`YB
znRh2|A#XKrFwbe6q?&j3$L<Sq&cZmQwTm^^BY`8KBda5wqfZfy5nm&cUqz8>Sv3y0
zCNlGC@Fwdv>fPXBxW^Yk!5I{<k)mR#HLE76)S%{*TU`9Hc)LhSQ}36Qfk(@B;8aa9
zg|7S?(W1IZw(aZ1-y5ThG#s-Rb6T^<Y?Gb>jTp+l)kW#6Nvk$#T|Tq<!@TJr6)P8N
zrchC6UI5nBd0nGTrk$3jU#eg3sf~y?s%VU8%=i5!r4mr*`xQlb%D9bTxE(#lAjIIq
zpeE{Rmp<WLpgR70^7h!8oxmit+~>_PCDDf;Lc#Y<dam`5_dHUrr+q#6DzYrGOs}9;
zrNp#E%UEY#Nm|t})$=RzH9~-^=eK2bO2g3l5Yf=ikd{=46rq%V2B(ythrmwr40HBQ
z#o!G8)Iy=3##sW3n&1mT73X}j&x^7FCNO<qI#w6+3ZsK+;rOlW9lI36!wh)W<w!Ky
zHqAEjE~MS_bL0(7h;qpL5R1+`A>4QTqJJo3m1mXhqhjb!?~6nQM1SqEkBViKx3R0a
z_O_w)v{Xz#D?CUQ6h3L0rrOm1sVLDdXUl&gpx|tX$C|}D#oB(zXc#pVJ)ApalRA?E
ztJAJJsJ#2Ov_|5?;o|s!@T_Z`)#r5)K2yFry(+zoDO3B@+ANP&kHk|w#+>L-jhJEU
zG;-s~=_&np#_#?5$!pzesOKE(c9>M}Z%Mv+TK#eDj$d)Wr+~PC3=9!Tfnr{#f9Q?S
z<lG^Z{AeS|?V(>4G37B0G15%?QPWJao+s!rja+l-St&pUZ+f}ZM7m-ITtZw5>{{iv
z+@#wGb+-a3Hwd^odSF&I_P7A^JJYL9dzpK!{g{x@B$d+MH?cLD*GHd?N@fmcvbI2*
zNn6OhG3$=|8LKUWm$UavgwR6LJu*i^r_1LK$6H5M7X_D2r-&nw!_{-W3)vI#WBA4X
z36S9(^*829=_RY5AAUYOa9O%!tN3ZCz~BDX<*kdIi(i=aON+jqZ<pBx*@oF3*#Ym%
z--~n@b=+E}T;}U^uDmmA;>q9STzUyH{4me{i}H|?k%L8fPWcskTF#$eRj*5O_mqua
zMCLGBJi9Gz?J?BywgiHPz<MZqyJJf3pFMPPhYo>64x`Td51UqCoY%P?Yk?AMGk7!{
zG~TGCe$!1mk&~40(Q`Ez`1RfJ5#5_pov%gFc6q<^erMQWRuy|Hm|?Q*9?$!~>`<3+
zX{LEQ#bfiJsw&(i8XM|zKQv!zX~Gh*Db$@sD<?LUB4So2fX|>Ekf1lVS+tp@l>$hE
zvn$ZrC?2vglrt=;@x2}x?5a@l<R$3!Ij^*gpBnNq{YUzCdOLIt8sM|meA3LpuJJnN
zmt(}(cRL-aZqF4efI+JPb`CA4`o+?Q@XeE|pH<pqEFJ={%JSt^S?^uY>fH<Yk^1y>
z>1niGjvZa$yr#J@#tvY6C@6A352Y^?(Xbv#yLhMHR_a(2H%nh*4F54~C{gI=1c9dd
zeD{$&4$Rt@08XLn$>Qmr@;^0^@LJBz>If|6%T9jz%IWcu*>5YM*0&%~K=^U|9kte^
zqgSKJl1Yil0cHcHzF7E}d<D+O#c-n<x$ZQ`XK>dbOy9(OtG?Pgv8Q-NFIHcrtlYfQ
zNT+cFG1qTDn%MN+*-*uh+jOQ@&NX25#_=6KG5<v#h<6!#r3H-Zvxb^j3v6iKzhNBg
zx=-85Z)Gg!NaNJf!0%ujkZ7fM;kkm$L1=kCL`WP*_6pWYpL!)B&~NyQ_lm<y>`FW;
z$`-6D?R}VyxXX5CW#4=CW-iG_`ytMp=6j(Ab*#I|dqAu`s$z!X1(U7pCctI?L8M|D
zxd?gkG{@=0&LzY3JEqY^(HSZ|EOw4ZPEzQ!PUop%u3;LL+E@X3Wy!h&$kO4;Du#b0
zX_4BHo26FMsl`oreQl}^;D{(>*UXS*_C>9wd=lv$MWs8+!9Di+d}5F9&_M+z&D~qP
z&%I_~6!lHDGv=<~Nyzf-*ra5^F~kZy$X$NjTrwar;IyN5(>`N{x&qcLw5&X%u{dl~
z@9NyrXzK2_Gy-k<(v*KTxt|CV2brIS4zpf1LK|b`ZU(v>zDIXT$AV(bWCXm?4Svhi
za|uU<JzDlzlCt)Dw-8(2a#)`;vct%r#dvv9Ec9d?wVn+|;~F8!<1?67M;{MP$Hje}
zi(!q;j)+(U7$>m5&~`aa;mi6_&evb&_|e70L{L$dYSs*}>SFvvbY*9uy}4aMNTnl=
zmG}wd&yYHSnE}x=wXZfL-m$rVXwC#1*dnBJnSyX%XuO^_fC#k_6wg*n2-uhD^Qpwh
z!io;~r31Ooi6&=#K#%g-CT3MBBT1cwzEFJr?0lP$O_cCJNmxRn(#Pdsko+Z*mVo~v
z!Y@lb>>vs}r4S<3XdcYEZtn2VG4NRJ!ymk-aLeVTp&J1KE$7ugq3WB52LuF!S$4W_
z-QQ}cOMP&56nJmxY+)tf?dXDUO+X;yErtK+XyyK%&D+tz$xX^zmi=!FDg5WF(}L`5
zf19}5%d)@K&}LI~cC}&?6?iJ}gk6r5jg3vl)zVt(%?ss!b;o~`Ww&*Acaahl^z!l&
z@DdSlcC`@{l9ZGbd?G9;EX<E@!SCkd<o@29-^q>RpPT%z`@FDn``~Kl;%?{c#CCPx
z_ZH3`?y~IcR}cF4-#@?8%G>ULKgr4MU&F!=Q1I%Cppd{5!GGTy-&N-7tdzE$x0S=&
z7j}+TPHy;T$O(&xO33`}@c+8>zaRM@T@C+tSD_~&PyVy(e_Z-kR~f;pA^gXX{+X}8
zXYmszM=B%u@5z@VHRB8Tf|m!A-3u*U{QI>l;o#qh@Gm_7yyHI;&i9qBL}?QcJR?wj
zp`hzcxSK)tLw721-{9ERi12k-^j*j6gy!Fb67Fk!v2~y#f(mjmsD3~3&*@Kmar|UW
zso6kCMA?mc<%ew-<DEdo$tdLy&2-cvOSWwd!cw`^+TWFbriG1@9^K_>%)TtwDb%0x
z(bw}b@Q_6r1iEfFpIz+N2HG2(7T4NKNjEiq{P?1=u`y2>w)s4HcKTRWV8#QIWomPx
zkmV2<7VwT0qJjmG0k<;1ch8O)S>M~V)QFrY%C9g0qP=xk4nqQYVguO(sOZ8YyOg|d
z#~xo~w$>kBlkOZrb&UAh7p9Mb!T^-3>??ZjS7@YYl~wSzKOCf64ARXN_uR{PWo@w~
z#Ub_cGZE)5fpi=B0g(g&$r1t6Cn6UD@;1W%?=PII&kB<qw#`CvJZMug7AEer{E0Mg
zvkYd&ev)6JNL;1p3h?@Nqkf4NTFm6MTyf5aopS?n?opp*2-+?4Fn!IHh4WxP<8<S3
zchABvy8?P-yZBf1IlK9HYrT-KpxpSD;g^ZSV+=ODQe(+GLnG2>H1#a?vNJxrqvd?4
zpRu_F*mY~ERf=;WthSuYCpDLT=0_czAYC~V*RnWdo6Wh&ZMhEy5Ivz?QYVoZ3#M++
z*Yh`-hhGC9jRrn&q7n~J>(V&CofUc5aJ#9aJmS4Ul=1!glXVbh3S_P0G3<7ke{4-V
zN$;7!XIjjk*eD-vh-a)0Q>@tt8%-c>NY>`t`^?K!Cc$bh^qCzKukO!$D1_K?LLRO1
z_UJ{G+&7@CAf>MOQ}slODmhH8i*toa=4)Z%fh4JPw<ce^CcS}Bc?7G$)aIv7dbeMR
zo4BntLXp%VVJ9He)8Hi2Joz|7Q&E1m#3nEtw<Lc+6i6GH)!irn4K{Wmb84sS36Q;z
zd4=Y2LbnMXs-cCCTYen&B%PCBgMdq{J)f7V-&|-HA;d6t@+KjJF0<ZuO*%-<30OP)
z+XN5D(CoW(wDJeB!l$vC8Ik3F^bynjmY$wk;wR4qh2Lk$8#O5q0^3**LI(~>(6mmH
zz^9?}E{skF<n@OJ=vr~?Kf<9uyQ>n$(Gt!9(XyJQ0Azu*@G|Q}46KM@lz^w!>B|30
zgv=`OI%9Stdc3o3KJZo(cwOxf7KHG8c*)H3gMog*feiJN0{MRN6R?fQTl<zwn`YI-
zt4f{7#}GbbL`$mplaXK&*;T^EQ+4rUnXC2x&4&nZlcnwRt0h9uhz$MU3?s{Svnqq#
zspcR6t;{Ap#h)^p#uRuqD~d97i18I&XneRvxrkASzKdP-pjQ(!ofpexu1JIiopFx&
z=q?qevf@{iM-7?riurl6$W0Nyn*vp_wwKS6ZB2&)|BwVMk(!9ITu(kAl+$Hrtu)@P
zqe4udM`A3%5W!X9RRxz@tT`8-1jZVFV181d@PvgAKmAm4ZK1E$h&&?~^m7&%fK@Q8
z16Wjw4bb!OBQXl-oBAs(s$?>7el;Qq=d-n{L-(=*?gKkHOwZC~D<eUzTh-gORI=`>
z(7c={!mG#{<=HrLT<apv*8#2UGnR4q23XISDQ_i+`ObJEk72za<LWV`5!z$lYa-2)
z3|Y|svQTgt2}--V88Q-c<RgA8Nh|l_=mDpiGB*hCRV(+fE-610A78zFqQI)h=19>M
z8xh9(s6HPyX?Bqb1H8jzfwB%mzkhD46+Vj{85t?xBo(Cn9!&27nE%{cwJ2*kM%I$U
zduQ3%>2ACH0R_5~-XXb%^_7P?ng!guuLeImXT^r%PR(%~d&$<##9qq+Py`s-jXT7>
zLCNEn%0Bv#l)OFrjqA<JPHZK(m67C1*{^IsBC}V5&X}aCZMjI{_*iu*+%MfUd{rmK
z@sYwGBH46>h?Yu{T|&Pn&VBOav-Ia$uyYEjv*-~>Z3zJ~q=k|$`Uc(@YBR9>^s{pp
zA5{UKaFeHs-z8Zll-VR>d1nJLG>4?bG5d8cR*E0r=#f15`BdiF+4!bYW-NA7i|MKJ
zrVrC(7gq_ylHTa?!fiYEXC&M@OnCEHNre9I%;LYT=d(u=+7nxE&5}rk#d<BcLU~UG
zM9*>@DXbZ8jD7&iQ&R>^x;DP|f>0n=hb_B-2dwAs$HdcTO>A*5Vc~dXVt2BEwr^O}
z^Z(WAAL3tl3F)K+4jX=gvdDy)i}ovbqL^IFfhP$`iX=ZFB-pqr5|D|BK&~K)HUVs>
z6|xiMCj(&FYs;{3CAsWqt*mfAK^%|jZAt%~YD|>$L4cN00Bp4gVhLoby<G!31tA(n
zK7i92LIU@eX#Cn((xa@=gg_U$q4v*58-#%oSu2Guq?*a%g<Gts!f&e|SLFWD`trL5
zr1S=rg-3PV|2h>qu|8~v3dKHJ14aF{3)E+P(&e@m32Cf5Qf^WT{3mM0^UiA0@g5}C
z3POm9r!@$7i7wmZhZvWLWPYi${Bcg4byj9U#bP<g)5PzF;>Fh&N&>m%86TT*->`~q
zm)K9p`CU381#be$iLn(jEiM$Biwo=AxYPCCn}FhInb0#hW9<XCvOd1$BNe|xU5D!1
z{7FtXp5Os5;Z`*BI}!+C;QtKoTz=kT`ZX4;VY*TzVVUB+W%aInIDH=R33LqE=lvv?
zx^3HYx9SD!NxK|76G!bWT$}u>WmX8YrvYh`2$cm8!iuz6ylb|?dafdbCi(|(l%MR9
z;YBmV*rA3d!ts0szVm{ZKH43*8HRZegk<?BdWYl9dG`UuE@=~Qh$(%0rQmK!7;+si
zvULXj&c{x&PJZS1$6J?YXBoGW|662#?q`)pg~)y{l>H;PJ}cPudW8q@9dO-0WVHLf
z%KN{N7y%$#rS0L5G7b}5r#IhBKH8;Q;Q}OpRH0u+4;t=g4Oa5)7T@>8V<tci7H#~r
zs-K?y{?OwLfxrb16ts7il4<{0$7I;dRLnEMlMb^X#sfP1#190KKpuF$CHJ(ABlPQH
zsZzn~nCih#37KazE1MrPBU?Asm_(e}V%qVRo?NDlysFc+QZe#2gaa8Si?{Te!6e<w
zgpIT+2FE5RO6Ds+d=w8?eiT|HSWQ;Bi|qU%WKO@W_<zP$@|T`9TIfiH^3Fg*w}^<G
zT{C(EHS})VZkQ@viL9Ar85oP7>+?_;ce8yrl48H5c|S71ygU}RdS(`T4DS7F=Ju%<
zMbWul*yXA5OBPeVLOxVBD-=o9jbp)!`+x$h<vkODU|sa{fze&Iny}(+VG9fVKW==k
zvXAa8$v=~AL~0t~u?&RZjKBp1VLElH`UjqOTm9%p#Lhd-yayWxj-1>S7$XVzeo>W}
zT}km*JAwh7(`wzJZx-q&M~5*BxBXFBpcf|W0`wH0)y}mu{C}F4)R+$gx6Dz=AWakT
zE6~aY9t8#NXJMSMTDS>Z6xn^c`xL?dkH+<=72igSg!zWdhsDos==tIqh;$<6BPUmg
z0!NL&=4UyG%G`r-ldAt^h+fW~lLUsFuOzR-lc(9y)VMDBVa5S&C!<K-DS5uyg~W1c
zgcnU4Hq5?DG?x&d;qwzrIMlqP2sr;#-aR(;m@Z&!rn9R0B9r3Mou*Cxa1^_l1(EfH
zu_7`-26})|{9Fj1zfH2xY&%zXL4C%)E7wO8{a2Lq-?o>4X%oow(!inmi)a$hr)&S?
zL;E9fHQr>{O$O5g0rLn6WRsPWM(h$*z#o+o=8v+7P4zcd5|KNIbzLR8qJXyq5*d?A
zWe;x2wHJ0A-vW139F%li(f|fASfbW8y7M=I{_R&pts0Gv2N12^D7;2;rHxA>o?lIA
zI?Kb1yUJQ4jZ-2tf*M3Q@oL?aZ(C(v^v+_FO7;(tU!TPFe@Hc);+#J)5~iOCGm1Pk
zN7La%otNAUTV?vrBy^Himv5&FIe!v4Ai$HOfmK3$!<G6(c>S~mzF{|TnDKrneDJe>
ztcaB)%Sapj@eK(bE}6bJ_}Silt86f>K<B;%bTjC|1ruM9Ka&69oRba)sdpEskI?UH
z6A=H8kDqy@-n?RVH2nM=>y|P3i<=#3s)Y#kq!dzX{n_P1_<EzjWz9~E+-AbCVAYj2
zuwlEp5sODbpe&~QUwaf=rV@{r#h@Yc-78}LL4qyIWO!(*Fuy6Z_xhVu;94MS&zWf#
z&B`n16;h<mB2w`$H|1ZPj|WlI52nqZP+%s~0Q7(1tlryMZ6%PiCsDnd>(p)xEY#Jy
zg6wsyC#wS6H0EUCdB$hV$rrVA3hXKmfqX<Kg*$&t`4uVW2i-AWwwH|Yt5VyoW<taR
zs8_jqG@{bNw7SE!HjS7}!;SGC4lRJJwPVH=ZSvLBB6;05IV$bGxD~y)53iVE2!k3h
zpZDY$#lE0e)fLO>L*v)qUs(|T*XuuM1;BQtK}&CQ2uOeaPmgEeG%xiXsJy6TO+oa!
zfE~cRTShN-w=stTB|+bOo;=;6%Zy(dgg_ovmNrh%_2h81E~^z`K!g8^YZWH$UsxYG
zOkX|<3I-@$MDc~;Y29B|pl-q?kgR1QP$y6Im+P$rR!L6K%@kVbgo_M<Wd9F->)Rm9
zZmz+f7F*V~xkOSDDccZ2&ri%tB>!Os{u^)hRWBj0*w=&>NbvuGp|Bv1r%8M6W*;#k
z`Y0tzdR|ayo?j#yGuD_Lo7NDDcj8~0Trp(sPG-69+^m0b7IaH|nF~N9*9o_XDyjN6
z%>KpWuH>UA!4owfB-vjqe(2PJcVnYQtspd>dbgV_pdFz6ie7#pnly)lyXs95^G>~0
zush@hDlXx2o2%DHL3GF<{4)WI%eNaVW8XkX8b5gDS4wjbB17?vV&l#-C*DE4*D3!G
zxLaNCY{fH*!R80eU3ho!%{hr@=t5%0UeqT%Sqa6Yh<{1ObI;eeac$+5B^HoG%G-Fd
zg6e6-kN9z}0O<ECjSHvx)s>MCKwh^BWoZMx?>|`DIZ@dZ$RObLhIc!7m+5;j#Xl72
zvtJZr0{HwLbO?S!PW<!&uKagVjKW_th7w;nS8bu&t3-j(=BqPP@EKb0p);Bh*8`3w
zsry3aLMYHijQ6w*Z~2GesSmy9<JSblyh=e`tqZPC;yxnS;vResdAaaSiZWo7?0;r^
zcr~upP`!*kmm>d_*|l;%?Z##Zg1NM?r<J!^zQswMD(;<xtfATng-bm@O>W~lL#GEe
zQQ5-QlQ(6#&fJje$A4H*xp1VXwvm~?CJS)w^#vlH#L{t&2<>eBG{95<+x0jFu%}D^
zI&@KX##p3bIh1R+XNaC}QzsfZMh9qN@aWW9da(u_cZru6kO&66NQuo2yNt4-Pd@ZX
z0X$xP+fyYLt$cd?>92AbfU~G)!gsn(vD7ne7t;R_@ICm-3(j3FJqKaXB{jRSJ>YV+
zZa(EJ40bfB=4y5PzDc1zIXQ||APc>8pWf@Ye)X8V0O(0<)9uT#-dmo4it*XrkSTD2
z5}heO-%2WNO~5iDwm%u}ug$d6i&dKeI-R)y@u3s{ey1!5zo&7y=Z=vmfC7&xhvvBo
zc#itwlBDs)js@)(xlJO2;eXg{n|w#$d*gvA`GH!~^>Rjp8%<l_k{nc=;h#kngAMw}
z{wZtkQeQ^ZjaqgWxZlt(K6wrGg(8>I{klzHM{p0<b-oPiSy?kpMro7Qz;<s*YkY1n
z23~%SX@Y$V&79+xrp`F(Xzi?iecZ8;abb4RajCMUn~GVwC@BI`ID9i7lGdUv+pXG)
zR8J8c1RgtH{MqE##F-#*NTZAH_}+X+o0?MJWq@ImrscAt;6N>$rR42P%t~(RE?+Xs
zZUxqxveIUkN!}*CO`>R}x1F&3PzIH)y(;M+y8qh0SD-SIr|DCgO9Ds%`cO{S<{t_c
zKHufIA_ib=?L7N6>H#74q_m=oV!SV|I|q88S5-u(N)_P$agetRa`I}FPwXO1T06<a
zw^5yG17_rCk1!S+C<V^$`<2#kMJJ_=Fe2uAUZwDTvrSUE10N719UJPA&O-!^-dlO4
z7ZBZrBFS5Z61Uo<SDo86fbHU)8TtN4Z0D;1n_*Qyzs-8TCGD{Ggx%aYeR|QUe=J$1
zLEmYT-g1NnwF>higACyp4-@xwMQlG!dU^~jnle`(4r8j_Rgy@xJX8i)u}(R+J$d80
zWV{~Cv*z1ZRluq|YKG9OO>#Ra1>qWz_z28$pn#_zD3DhKWQ?p++iN;`+8|c&W+LiB
zKF&VPx^MEZcYx9;W$Bqk^6qS%UZ$UK1N!7rKB2aCF-x$-7+0uX9*J~AaZkvHZ>Z!g
zr`!8)W9qZy_`#@-uHtoKOx70e%|Rpdq+%NM)=6rD1ubw9nc@^pR_q0hkYA!WSKLCU
zfkxpRJz#(N=S*DW)S+s0p_g;Gf58*DqM;LW-{#2(&jLQBeig~0J}Y@Z-m8mODHJxd
zf)CFEK`Z;thNrH-EGB;I^z`Ly_4d>YR;h?#XVQ)mzz;2RMW<@g{Wfk1??-)D8P#Gn
zM#J4ctD!=I#ATa+m(v=;d}3Aoevz4`@@~W<g335al#{nhkb2WbP}Jm>SF|f`qJA(+
zM`bhVK86C3q<4mWCV*{q3(S>ic1lsN&@yj3=Gs7?P-2{cITv235O)tFLin&l8RYlV
zY6~6QL@&2`Iwqgud6vatdm`v9igu^b`o0NR7!i!+D~DwZqNGUMRL(d3w`k9JlLGGT
zG$NTySepdCntlM5U;7)bp}*5Hh}~wzoHh(!^9}^vr2D^VGM?M>{s*_``x?&IAEB{z
zo4@R2Whmdqjkl5APZ;6=JfK^zTS!uZ;<eWWZ&^{_tUs<b;$q5#adD>0Yg}b>C*BjP
zZ_;+qqzkZenzS6MG$%B~7U84?G}t`Ozics@2Orbh$yjOr+>WOvZ51dH2dZ#U430W`
zfsdllR!bz7s637n=uL3BK4!PUVfKz3GvsbLWQ|KqV@UUR&CXmk<4iAZNvr#StSKa|
z>kg;_5Cc+z7XJWsgN86Bu!-}9iQ_*lUX8h|C?!2A@uo^nY(FR+Ai3(guAtDn?m}GN
zMgw|dTmHo9y~!X*|3l=l3R)N~ZPHLj=G1lv^tu(w!-0z`g5=F5Zk1R~so_;*%Wle5
z92G4ps5W6vPE5|kqb4A0%0*7*FjAN5ZQ$8jtL3>T`w-E;`Y{jLXC%2N+i3}@Y;>^M
zsITC7u)hc8bKZ9MMTDNl@}P>DCA4p_%D(7{y8ocogXpL!#_hYlLn>t{<a@bmBF-u&
z#sTOR+kA)&oUI2ddPzIFy5E1yp>ii7t~29$Dtn6*Mc>Gb*I=68!Uc)_&W--Q4=UTT
zBsSpph1;m4?Z#Z$Dd%E))3PY0B7|&X7-D#_xYW<UL|$LOm`Y~tjbVdNl{zy6)NJiE
zpvkIpLw`0y;+HrByN9C6%g($T^g=wn0n|<Tj`nE|uoh#genlO)*yLbXHt|8S;;q>h
zzu4Wm24m!|+RK%1b%NPyMG0g3j^9G4x0N*VE(OaVx~!!T_a^*sM2aqFNYktQLbt0t
znsz<siYpow6xV*CZqS>`=h!&jG0D=q_l)qrJ$||WC1EMK?NP&%zOB9ae9yW~3dJvt
z^}q6oY0PvLFpjuwOp{u+DVOcrMwib0URtHL+6Y(K7L}p@O$o2x_g2&|Uwjlf5B-w*
zlIRyB51A(Oqi9xq6i2e0t{FDMZ@k`*gL0^OS~j#Uy083EaP7C_utHrb4}J?;Z1ADz
z+lD!RH{Yj}bo!ZKJITo$Ds2^=rV($q_bkqCZe$H}D%td=S2W!{eMr7=5wot<b=-uI
z<uS${HKGr@1CF#08dIdhY@0ST7#`HfO|tdg2E^AKZL+FVl$#!%e+DK_r3#6?O*^-?
zsC?`oW!Q7abHq7$8V7kSj~@NJJYcLCIv6piIfU-$@B<U=_odp@4~}mj4}7-7q!G*l
zHFEwIXLI&o+k-_x-kRUsmtLjuC>{A^r|cHP^S(h>#P3`W(WVwpdt40eo4sIzMqMmR
z&Lg!lSC?_|H3Rt{k5nW^XR6fnp{HlAv(d|22OEo*rBJDz>yBz5Aho0YdYt(p7Yu{|
z*!z0VdKW=`FV<ZTiFHKpJi@{4?9I4GWiO*jz0s5n&g+c_9s$M$eYKGl$$WycD#|6y
zoWNPykNXOSffLDVg}y~0*^2Qttk4-=zTlZmVI^xV+n44GKHFbd#4qBdEyt8HUukCV
zNUN}X^8otl(!#2rCE3^=LHDsQ%0VaWDN>#<f6LMhv^HjY>Eb*GTiH+hz~BZT1dMtP
zbQg@?YoX^p{c8HB6(kYd@($P~daga|&$ibIkRb0}_O^0M$43xz!21y~&RrN=(*q9l
zFX_N9E$;*&YU0>EgCTJ4p;t^gP=y_j3>VF#aLmX1^?7)w?Vt)g)mzr<IO<`xjI1y9
zl~n64keQn~tb5#gcIV===%ZSbgG1F+$eL~pV98o=|CH*eBO>|;F`Q8+61&c3=-U5C
z_|Uebe61zZt<k2%Ew<F(Jrdf?5j%(?FN!0!iH%Fqfh9C9Dj53UZZ!C0?f+~xXq}T#
z5J-QQUm}B0Gs{+6To`AUzetv?mfGiQBoUCf^mbeoYNRTxa5LEs3`bPk&U(URX-DMr
z7<xVX22{j)KDtlmeONCz?g5FbV|UD);d9Z#@L5bIq5&p=-V7i2K5~(LV&JEjfRMIQ
z@k^eZo*wuy#vwyTv6Fo1i@mIsIpUXe3w)Ad+bUC!@TC|3bvAQW$6bXDw39e9&P1B$
zpEW4-FgqkEt&S#|dn3JJi>NiO6zT3mW@kUD>g~OqwUvF6`8`>Yb1bi61NKIW)IgnI
z1>8Zc%-Q%+w9Qi`^<f*hm9b`=H16b^iGRq1R{IX?w@|Qmy#Ga&1H5;?X}v#rJ>rpO
zbxI3*M$5sNlWg=n9ct5b{5EhM$!$57UR1<^nIWss!kGCfXFZ=)%r5_MWAwCA2biu%
zaq>i}&GG!^|BqlLM8waXPmFk@XJS&5+5X4tt?_Bcl;Y;N#l_GaejvGlLuyibgeITZ
z`a~;IOvAxfguP0YPb_*SLgV!)KZ(^82jg0g6F0LYxe<qa>zca{ZmihO;SxEppX?Zy
zWm6Jp*~(I1D*sB~AN9f!N2uZOaSvcI(V?Xo-$R}LXjTT3xed#(7q<=mChe$iB2w)L
zUON$Tol;4^{<!yT=Zx0Q#PZ3Qr#UNsx~!_EpJT$)7Ao`p?P5FXwRoM3hFRem;OgwD
z)ag$V4YM<I0}W|~3i!if%W`;4>}Tn<Y?AtZ)5X9EyQw78r-nU~Rz9tuov*vAKV|&a
zzu;?DCmA!pB^qe;TWAR(?wFd#9z*;rR&&P>;!0$noAQ>_V?LK=Wbw}yzD^PsOb}7=
z&NAR*HI-M`;6F6s-LH>6IzU+o2Yf&C4T4MleqGM&=TuMiCAc1Zyfw47GBG(KJ1QtT
z=1VdfZ45q!iS>6=XS~u1LT>w79J|^{?5F_>trz50LweV+CGy$_Sj|i07k)J;?p}MK
zRn_Rn32qYcN)CCIF(O$sfLQjA;;K?@H*scRV=rMBrVUPXrRfp?b;&<jayUx(r2+6N
z71Fw|M1S^V?>)2=6bjJNi@p4Z62d0*+u<#`-CT%4QlHvV-$z$^&0;a5pMv`%oxRmZ
zJCa#S6O>*ovTQI2-jX$s(EOEB1WyMHv1L3cQ`C2q;wj;vC`q(3$YlRe>Y}qm%V<!V
zc#)P7^x=G6T~gf5p=^?6`+J7p35%4{LeIf_;j^Jtt3`Sa53T3=0uvD$i<W6&tGVJ+
zeenfF!a}b?5XP20AEdyhL-upOjObg{;4#v^KcDvg9+UJ~OyTZ>ilh%{7@9H9D~4;3
zjW7w=XU^}GtlVqv(8!X~8)1-@XlV%8;YvB}^_tjO6t`j4<C|bI&DSxi-%Gx<;58wx
zNNEVse~7Zt@QjSN{LYnP>Ta>|C$n|FUVkGR{49xN1gymO&@`^}+datG;M9xb{k&x+
zXNw8{2B2Y!$@IzR#|GHO(s`t5kpW%hOo$3?-*4^2M_&8T{l$k9J@(a*R>To78OvrZ
zRaar3|7-uF5^s}*cf-d+?zI)xGP2zt>>_fadR(#2-zYt9*#!hzq3?O<lqYX+!z1fk
zlUAiE%!|V<`G}H-?Q37_*9jyPy>4~;B`HT)0%(N_+ZRXu@oz@#BoF5Ncy!rXy{lyC
z9>nE*^!&eO5YK`F^FA3@Jxa``NjDbM^<m>m;G6OJ3WZhknpD}L^2S^{eMVR@_^ffu
z8PE&idvQ|JPAW&Vo>?$qX=2)S;U`MDEx!DMM{@h6p_pHA6uo|~@T^HkXx{pThU+@n
za<TG+COv;-LF}~H$7>1VBA)wV4SV9wgQ-8q?l7~T4KZ-9#;~k3v`(~k9_=yCTTOxY
zzjr$p*&W6(2=K{y<?N}|;{H6an;9B3vI$rsn4PIM6fmiRd4<}o!Z;#F<n;xUQ*^2^
zF42?Ic4Fc60dtF~sVzsFvPQ3Y+3oD{8xuI(<euu^nDG`yHIcs>1lA5Djw)Fh-1)|t
ztPvNkDAH?lQiHVbF3875X!Q3`Oadny@3WCD7S6JfNLfuDFxX-33y0E0Un`S~1$YfA
zf<MMJjrY#4QhZ~@)hDcBKBV8icNRE;IjeJu%R&oTM6_fpu2Z;a#kaSsPZKR~9qp3y
zHgbh!6x^~%+3|xLk?+_e6MV7XvEipi3R@=5IdN{GhSjde3&Nslf!Wx|*4DF&3?ygj
zX<%zt!6daEfTxNnM=L;Ouh};JAyuug(VQh>B>ZStP-BMmcOJ^^jMpyxq~YKxKtnzb
z9_W%1<u-?~gN1M>_5BX(Dw?gA=Tw8MPcz!=PR#A3XT2?%*vP=~UkrEw*+s0=AL(ex
zm?=lyG+<EMg|MCB4j3*Lh5bHFifmadbKoNa6ERbRJ|~iSQk%Y}+diIPSFrl{rMGzv
z@chf;7APg>1eipsF;5_Zbq)*P2R*Z1xZjH7kCovwu+@74!+1G=Gk+|hMJv0}l6!1c
zVpA)S)K8h%<`3V&G^2X9;22^mxF3oY^BnoXGsd(C%m}vtbzyaxp0Uc$EWZll>tbHf
z^o522zh?mNo?)_j)hR&4^-KEJ>Amo4a&!j`+^ZCcEUb@5mS@gI15ITEO}9*PFi}nP
zUN+vko9F6K_;DbQe9->k1q<x*?2z;#Q%tX_|D7FBJ=QpOK69tJ199ckCPipS&dprZ
zK|MyreEL#93<h}|ZPFxI{g|-pw<Mkiyfr(=s2w51jJ5b<8MtDBPQhH{#Ias8^Yym*
zKY>2tF5_&5o)<;J)|EtBejciqNi!#Jf#Y#uZo78A4kxFGT_ghaSPKzXW1YoL9V%&@
z8yj0}@;$S4^sIRdzVDBvNjVPI|3KQ@>N_HVm!tDABkp3a=BwI+4AE9Ir&NH6gCA#(
zMZ(#%O|<MQJd+X10SlkOE^_KF8s4Rm<WoU*Kc=iE7%wgec*$1ETC$1{$>|ludhjav
z#AvO(a*#5mPLt{7cK*|H+U2XUC^?g*%OPxD7}{jU#a%-0vG3c8RQb(4h7RKrGfjX}
zpN@7|Y4z9AN%SitNnyY#4Z6PWdg6HR)V*)h-C1!`6@mR~AUO9l-jHcuoAJlHwDPqd
z6JX~4*do=J@s2=Lpi%f%<nkkowczwxQNivgb>gn5-{FMs;=_R8gX7CN_^z{`@^;~n
zQ2Y3xbk?-pj%Kahjzf*9)_jT1MS$d!L>M$5r{$C(J3>C4&+MG`mSQW51g0)~5>=B0
zLKHAvRy93N57F7?+5GVPQ_TSt@Yi*gcYmvoij-(~Y5cm)@W~#V_RpDz1Pi_eX+A9Y
zG$o*~IY{C<#gYQ&0l_~dNc`3BDj@d1TN-K7o^lMPrR+yoDd!G?Fo5|4U{}AZnIKX{
z&*6xBtLwL41y?DWRm0>Ke73K-M(cZnPH0KJ1iQ}&3}cXjdsk_cpgH4Nq&Xw@`0`ju
zL(pqV5>GWIeh++GP&u`Cp6V))zrkQd^Mf?c`Eq(V`_XKCYJfW5OCMhCy!myzEcX_U
zGmLA=W6`8MJfH6_Op}ungI`?nD2OXn{odHa3P7!p=S((D+FtZ8NZwiITj1}<4V4No
zs|jF*%*i0XtHIA<bIj)Th6775wjJ&a^!Pl4ssWErc7>ev#gp}HPRSrClOHBG+my+8
zulEbPz8gB8^>97e4+(93I8h!5#ofzlG&S09?bDzd00fr8dZ6;W;k{0+2kmrgbH{IJ
zdM!qhnMYr)7P(!UN_CH@8<tW^E9}rUQqj7cSzLG+4Lchptly;AS?6Pw7^rBPk(Y&E
zqQ!Co!adY#J0?7k5_`faE~j==;}aD@JKSPl5?Y{L1>vas4VPyPS^m$hNeYJ2vT3sR
za5?(^1D>s#iry)jilC19l}F-RCqBtLCq6|;Yiaospi7`<;7=|6fJ*7aUJ=bFz~7u#
zwNtOZfil*<T_o}!3Zlty+kUu?{R3%q`93BFRG4aW*%~@(zxg@95+he6j{PU|6@Dp3
zeoJ7P$o~_?R4)md0o+qjGFrhOXix<##HZn4O0B!GUhNrwgI-q#;tf9NWq2odjf?v*
zuXBUhZ66kR@N?JOufF+wT)?n-7-`6;GuX(nK2{KJgz3F>9fdV)Sfv~%D=sp#r@pOO
z>7aH`JGOcSRU3tkv5T<Gu1deNzzC&&UrkRN<1S8(w<Rv>tqs;K+jrQ1wc)=%J>-YO
z{_+F$zthZlH96>pts55paIx5?AbM0Ys+BmAZc^Eo3`cjRRofb-m69`gC34Z5x>lQ?
zo;;|cNlSmUn8W)Zf7Bi3Fe4^U>rlhR7_fDZK1HTuqP4APyg?^v@z|hYw0^;_yrxrD
zzLEEPU$cnTw+0)g)uvz|=O8A5r14T*2K21J^!O8QQn@Vf<P+!WxtG=SQB&ZC_nB#q
zAs@GrhSCh^?Y>VD7r`ta3gtKmWYgIo9=IKVQLt-rO3nCTq?`_`d&9>ldJ&UW3@^W(
zvBN|KXx$$Q!-UrgS1eyM+>;e3%GXilJs(JC%~u7D>kM6l8d;4&YS!sm7j)K^J+%5x
zP)um;)>2SlsmVsdgyfl)uTw!lt6HG}Br9RG;d~hTThwat9loB!$;oP$^PK#$J+LzC
zr-9}4Aq6^@2}9J>B``Q95S<R;MurEZ{*%rbqsFy4Ri<S^qA71)wP!sJIiSK<FAR*y
zSN_dgj^B(3u*jN4Oq4;sqdCeM)Si6i17+?5+K)*=EO_u3YMCDls;w^FvZSXjW%};m
z+*FE!8>}e<o#OpZb63|pbe`t+ruE;y@b_D%7!(_{a6V+!$nkC7dRTPI1Z%bW(536n
zo}7*!(<x=)D{U6cN`u+tAzp5!*R+z3VdwQ8<0o$l&F8YEXkb>WqK5-Q<tB*8>BG{)
z-feexp;51wd}91}@IID==l91cWqLW)zh~@5M}X#nZrH)BZ%L(3L={JeXBP!#K}S|8
z;Qq9mg}3yQGYj+@J4Tz1r)Dg-!28J?F#_~@;x9*VZTIbDloC>1=R(^h&A@jk0{Q;>
zY8YicF`6Zm0F%gBYzgGIHXpa?PFecBT-*`yexlDHy1;cX%Pfg+5$Mk1yBmM0yJ~OX
zJEFy<8(_9=u}9|soIZ`Y<BEVBqi@+KJxp3hy`DH8#ujNRoe|?_br4&RQP>_m&w&S>
zl<9bEnZx_TWKe=tdyCqMMaG%_8s$HHU$FRY)K#P-Mo;~BXUK=owWhXJ<<DXRM>^UA
z-@|3(0i3ZQliKuNY!$EqbLGZh-usiCEoCPAL5PrlvJgRkgV;O0GMHAdyxS*uA+8D-
zO}q@gEPAiY%8D9v>ktLqm?=)RFN)AWs<;G9ukrm;O+;D`wwfBuj?nNt-FsXp%ESpn
zolDS*wcRp89?4{Biq@TEI$~ekBnE@u#KF(kIGcBF{f$h_iVs2w$|RmDaTTa_ZQ?!s
zo!|D(eXOOo7W26VpeNbBKDhpURXyh;GnnKP@acJk#;I@g54cv{>L)oxw<Y=)1sTFd
zv>IocYDqE@b+U1Z(c4cYi~Hkqufg$Ac%$<})p73}E{{C(*Q3Cf(=yd&<@0fJJQo|q
zZkm&J1dfdg^K>48(J%CfjenkH`s7RiW=|qoGZ*+_*y`0)J~6|@><)YYEL;U2<XmWc
z%f;;|Hi-ExH8yONv8iwG?>fsfn3mk1!r|~C>6r5Y1rQMIe<372Z8#F2SmrgTTLE6n
z1+V|Ua|9I}E2T*rxufea{;-N9-43(6E-BYgq?Qxk0xjC)+M--uZ9$IJp_R+tc_f?4
zG^7JMKe*ziSk)Z|0|Rw|mU{>j_REW171jz_B$VZ<Jh%YL0@izg5{N-U_qGHL2+^#5
z-R99ZFrnP%vVpO%GkI`5cMt9mh=w%>ft+8p5rYWmh8R&4bi3jBldL##=U*(i-ikwe
zbR!Bqm-!2KUJtg=If~Ul9;`R)I(8SNd<Y%*Y6CXlieboUK}Z0G+&;Pv=lIo=6ll8@
zJf9el^)MV!Gj|5-JIrlXKpqmUv&aHXmeAtUrO5?L-@U9Oi`F?m?5sr{s`TekEBEy+
zYr1NwH*wU#OCk44I@`n69#aD2wOA04Vx3OR;X)hrog|V989in4FbS|CpI8wRYgwUC
zy?ZoaIkXhE8i0t^>@hkx3{U;xZfVw7D^sgk?%=tX;Nt;DmwM8S$pd<O^&MVut*(t{
zUtZ?Md*^K>kJowEk;bk1hKlvcl!dLOZS$x6I8oD3ALunFx9u)SK+~k1pr^{flX=BV
z@O?kEX}NkMec9uvQnLnq{ZixPEs(>0sYSwQAbONO%Vezxa?dSL7dQMC{T&K>Dp{Xd
z>}7#*{+mbR?o<B^ceWY9_D=zK4Kmyy^q0rg#_nA)OO*a0|6OG~&qI<oG-<oeaIW$)
zc+=2TSWrc8qQ5@Tb@FxfiW|2w6U$g@OU0lEc=mxkdyMBB1~FxaGp7i-9@W1@wOK`K
zpQ4X!P<)`iUJ}u_nxB|Xn<@0FK#Q4Kr@tQ<jV!C^FO^5VQtAJ#YUJ@qk|x8=q3c*W
zO&S(=xwpWp)>2cwWi4Ly$awuBd~Jwt8=IqQrlw0)@2j_jeNB@VKLOKtDeJs3w<o=S
z;kR}+Sl2h&qC-$Xo+Y7u$$#*;ozJf31$)db`I<BJeN4+dB48Bh?0pa^MYFK#N$GV_
zB%OEags+cn^7Ramo=3@#p{4C4;M+si0pgdQ8J><YoQLP0KKduvCY+)`+Q}os<=KzU
zh1+ShbyPJ`S7U56rcSfSbXKW>)~~6!A{+^$E%qqq($yVYe@8X6X5KC8x0uT7$LIMg
zHjif(#~wzD`@*NynB}b^UXHBs$tri;GQxYQv-{3|Wk8XgcCRtSC{uT!_@?!}LvV>_
z09q@}umlO;xIon}OyEwy$N7p-GJL64@vL0sr7iJ+AG$Ra!*bcvTD5PBlr}C|kYCAc
zp36#ufA(_`9JwsX@;jHu!m=>(Bgcni=p6Y=Vx+kpa=!wS=ceVk1^q0lpTaIdX9Y!?
zz-e57`1laFDm>(PI{>kG(cznNY@!l2NmlEswd!34rT+0j=p2ej6TeF6vPyxy81V}u
zM*HOpC~lZ8Eq|*aEGiw6M*clbZkEkP^!DhSvm~Eb_o-Hn1}#6Cei>E6HdNJB)zwLu
z#B=)u059C-+{UsKJ?*!T;PO#Q2mZxDU58@EVx5_cyl{=Z!`CQIgjjZB9s3*;-}_AI
z)*?@lL0-A7<DNx%gUiM$Frp}{|GT6->F)#kBPb&*0YG%8juLfR89<W8dWT!g?rU~F
zP+YPkKoSF7TEDb{Ho!=K*VdQdA!1ul0cUbKD*kF!6l=HG7$9B(`Q9DK!6$~%rA}*o
z*KY<u;RCd_*QSy=j#3*JG)HgYlY?`t0q=oMPa^$VJLb(Dp#9_W7YE#QS@_}-!K{Ep
z1!#RBvX-prCV(<vi3&R6Y(jeG=EB;FbZ(_O^H@W~0K-eV^j3HQQ{H#ca@X($BE`!@
z_<Dy?kjg@Xb1S@p!Rf%K3J5gI!|^rYuBylJ6(wNO9@#5I%bvsrv;4DL<m)`FdfTeu
zhz6*dp?><n`EoH4hWnU+h5~<yS>kawKf&s4wd&$(#+{T?WLetpf!8jm-)pKZ=Qf}8
zAEm|@zgYuk`MqudS|m3gn53cWE`FBYs+C1ei)a-k6HmlWWTYSqD+=3rw+&5(w@;tI
z2YLO7M`DZ9^Fl|YZGwknhhIN&@gMS?#AHNhq}W|tJBw{}UU;J6z)%scVK}z~m3L*3
zZVDVt#%`VMN?pi;nKLTPJpFawL_aLFaVx$rsX~LqzCJrPxETR9*R|sCi^&wU>3>xQ
zc`9nUJk){<Q3+(5*boeF*@ae^3r>vuczDY3QHeZ%Hy`2UdMHY9K5Ex&YLqa6n%y|S
zJ7=TGV-NlPd$OpG4(Pc1l38o)>8w*4>fKr#&TQmS_XgxhJ(!OP%afO{U)6i#^X4%C
z$8vz+B|m7B3dkEJpZ(#z`_qXRS|?wQH}1GF;42MX*9bksO_Op>jn>-as<d_|@Y^u%
z$?)8!xB|CSn;dRmszN+o32R>PiE)CN#BCmrTA6egC>d4td*rA$&DT3j7ppC=<)swH
zCK9vK(?~7)1zskBA~ZyW-8Knk)38S}Zu0vVDVjsOz~f5I2VVXCM)`e0$RQ-?c+Ly)
zEt=75kgNicobQ*ux@vwr!ouxV81sjyV<x)z$34v(WLexoG-<Sf{?$)2C0^_&!rdIE
z0&jAL8^#-S1?0vjG}EM2FNouVyLKvDGH#*x4GRe0VjGnlwGl7gfQ%(|@C@eoc<Pb6
z$-Kz8gq7wyhWbbN7`A->$?LDqD(+OV`VJq*NfjhBrLWQ-VWp5s9yfW>7oJ-*jh7!6
z#8vl9P|O-DM-an#(xR**FUsVP-;G(D%>**VUT@#<iK+Kw{TOH88~AqbIMWXQOHP3P
z)yephxV4Kznl$UD!|@NATJH28V_Nl7&|l}RmUp3;xDqhL+#7f6!a2{>#oRq&DFG0X
z-*Go!NhH0C;=kFzC4YraE7(dW5|T4~UE^xR72{Jg<P{^{hdn4^F%%Tvt3=e5#&Kq4
z@luD*`??e%V3#2#XKD3T(ay>G^o>XE^x{9gN8yVCE2wbUYJh1P8ub-ZJvYN;T$G51
zekEmcmuU=KMNfU;q1f!jVtxkjnf@Z|vH1S+9<||lziQD#RvdCDH6v>-XR5;bI(6E1
z%y*SEt^!^gs}c3qNc`GX;1iRqXgf`q-(@YEtX1dpAhtd+KJVA59saCCVkHfe%rimm
zCz+=Miys@=jBW_nY@WEBaVJEh=SA#g?SZ;eoWQSaO^RKoUKNRhT&8S%yWiH1-Wawx
zR;jbB&Hv)VNB_ygVPNDQmmNCLC9qyu18G#yZ{`^nc1$5^Z!yt88Lp8P=dQpby)e;g
ztMPc2FW~u7v>&e43;22-1#*V%&U-L4NhaM}pI<i&w*}icJD<1-cAhS@|J2eQB}Kj1
z`Fyn{XbZn3NP@L`#SB7%FU;%mAz4jzT~}<V8+;s&Y}W&Q{AWV|36>H`HXr=2GOFMO
z5Gj7|9|@q__MhznoG6liZ6pf9ZzOU8i-t-|H+_@=f7>6I-!7c_>{c)bpv2c{8vMcl
zXwsbiL}<hz7N>ZR|1ZwoJF2PeU;9;2P*D&O5h+n=B27VhiHL%TfKo(iq>J=klPHKt
z?;z4adT-K+NN=I{K<GX67DAG{qI>_&d(OS%ynEk2#f*%VwdS1P_B@{j8fRzhUbGTh
zeWzvj%DbRS`O13;&bexP3X{T?$_RAg2GBZdNs1bqOyY>nG$WbA%@_>?`mV^2F>mAO
zm6iT8_z0EejO7E+U{l8BlqQbM*&&hgSq<$?rk=x%am|H+o*!m6S8FNN-|kEjU&it1
zSL+d`r5Zgvr?E_&$aqjf;QrWQP!!gzPQEY;pRj+jGfqU!s<f?x&I!cLyK7B2M+FWq
z1(%~)M$rw6^64}2xpg_6mP)Di_W<8}P~TE7d6nV1TM5eLM_a#8Vdwhx6v0mnvKjg#
zbClqwXq^w1wWdPNjhpay9P)_@<FMoPHt%t>_k^3JAb^_eFL6*8eot=@+f5Bq$k3Zp
zu?)u&*{tB;v`;6?K?E+301W6r^Co0xLB3pCGZLL4c5QBCo!=6ruy#T73#HVJinrh<
zy;(K87AKN`m%(Lz*NwVh27Ux#heD#tG^ItJ!a$KMnXf-c+fr=&WX9{q^rSuKuHU>}
zz(vh{%X+&i$0aHEZ;erZD=9Wv_jb%vHUSgk3c&ybsn!B^-cvMu&c9p$URv5i)J`4<
z=$71m)+4ux?TdmhCb$7XWbW&r7!abApyh;M$-Ufs`w;_`fqjgZ95nI5%#vT>sPVwz
zm=n;<b$h-K+?3_486ef1+x481Es@JL)uYe)<}`fdUS;0$uI{toyC0gXgkrk57NFz*
zWe&3!NqB{qDkj{}vY**@H{RGCh*>Kolu3NvSIMi<yop30sh;uMK<y*C5)21Uk1uXv
zC*7vn*b<wy4YJHtSINf;0K0<IO7>3OqX+3e)b)2qI5Pbl`NA+Kk_Vi^ZMC0mcLozI
zfLY#LLbak+0Z6NO#n~J>eFs=vTiCvV-B=EwW^&(z*=4^tep0kq&%HKY&lkL8V#SZ^
z<BXF!%!V3QIIQ1*)}k6&0P|N$NlWY=JwA#_^{9o;_7dVJKS^i^n9#_G_if&yAiR=U
z(M$I`=iR0s#tYkg82BxRzfTR=9?u}o<9w_d!1tQL4~w(aJUSnku9fZRw`f>uN4`k>
z;uier^(pP^S*Ie)G!p7DikzKoZA)Mtejd0&eO-5;c=;gLAj=5XV3}!z^_MD0UxmD;
z>JBHR$#@L#ODYLA=rS48{7YSH9AqX61Lgw7d?8CA&s9|y1Qg!HI%n*!_Y(TwYXP_2
zewk70_VXSs`)p;fD9<cRtRTi(Qz3YwK*N6ul%vW9%)OjckRxYfe@UqT0Y<4N8Yi85
z9de7FB3Ds}@Fc>QZ(u$JwX`&d?QPj|v^N}>T&S!EL^bqzcZXbke_#g2f4E8ns~nW9
z%maI;Rj}W6l}U^7Q5)~KNav^GT)drFt#P`gLQDCcc-SYsY<WY@Q3c7vV$u!#3I4wa
zkVyL9^$q{#aOEG%7&nR#t-)^sR8{Eugr33}F@B~Jvi?pWo`;<S*=5{yh#%0m_5k91
zq!zIREu0Yp8R~dOFQ+c|9281O%eLY|?bc{oj&RNDUr?eE*|f~(5E{znSU^B<!z0GS
zphGRA@J{p0z_6zSAxc)epiK$Hu2t1qqSa35rX`JL1!`$icekVqtN8Npw0+Nlnlb8a
z%{!pfX@BX|_%OxNiz5<<B-;)9O^kpLLMO%i>||5noP81ygn#Vo*|g`-qr*g~ofR;l
z+G2Bob0(-h?>!a+4}0y6diyf4En+g4_=-bs53xSqRiZ%aa2?(f@zA(t7FhGIdExrX
z_0yi&plj9;K$AxU_!fu!c>FkV`?P>u;j;t%sLaX&uS$J}pQQZv5r+fFG!~HQeJcmT
zOUlZ|#^A~Z-|)(YK;hPI1rO0f%wa0L>o&4RB^%~qHo~tOF(EW&fi&(Z|8?kq1K*~G
zh|AP7Wf`)s81vUWL1EWj=pH3K-eJS2nCjaRqNi+ZmVNsV$d1$C2co{xz+hlQdTEA|
zFt-mXWm`W}vo(J1;Dgj#YQP50Bbmj=^3`OZaA>G-j}xze60WAH033E(J3l4KYJT$7
zI)4N{7-d2&<Xdj2w$4=jEq*4hbWm;Oc4b}R@Z3G&$z&i?0k=xn6ZtDTRE=ERwOGNp
z6Lm4CN;B*JJ%`OGUs%=CjprZ>8}bff^}FyB%w5jz7N_IoC6zWx6{|3M3;B)(ke>zG
zV61YME*35RDDycZKdpS#K)_Q-&jY?X^uhI5;wa15yKV(udQZ<1<$QW+1hmsssn>l3
zzL%9|-29Yt^@k<KWwYW{W?CF5K3KV@*5JT6R$AB-OmU|Dzy_UzLD9WmDpN>fw}3Ca
zD(1?Sb|=O}6Q9<z<o!suBCLvWw)te9?=mj@n+3o;_d_Kl07l>&`{5iRS!AB<x&Mnc
zVgUVgvXJ$;X5B1FezB`!yLzfw54^7VYNRI~{t}jdK>&S;qiwlvUQMLkp`s_^bM;+Z
zHwvz~dk@>1E6s^`leyG|(9wq7R|`I0w)u894ah63n={rirAuS1h%B(ibur9NooTzx
z2wqiMJIP#SZ=b3o$Aow{*H@nhUGvWH6U-gIyMK%nbk%pTfosFWIagf|VXvaH!ZStq
zhW(Y2R9;*9TdM@I4TDqLwMSexGHjOkBQRi5a4K|WDM0ag9KNyDc!eIEMc=sr_v_A`
zAC4oa@l|6i?00&%_8k&>2<ykGDzM{ZHJEs_-C2AuzZBoarpXua6`~iHw&_pK!MUWU
zw`5PQfO+ab0tH<JJUK9Pm|Ok@wZ8S+q7T$v_w1r7wJR&NHwaIDD`)+13&?C;jG~66
zeS+BT2#$14IGb)C{w0rEKeT~sWNP3XY_)}~JZ`nOCboR^+$%HPpn*v30`tGX<F1)(
zwsR}4n!@#a87Ie8_>~+PO0byLO%>aS4+5Ny?Ti-sQ5lG`Op$ITi5Joy2R9f*I<jqP
zJrf&Cc86YToh;Rra6muTF=T0kDi7RyrhEm6cqf2@;xotNa}Y|#R>iqbGb`Pgnjf7x
zONZ^ao`hSh5krxxO9)(s?%^YyCMhAmr8MAE?W}4eMF-9uNG0A9R}*y!igp33r5l_3
z1H8`?Ksv?do&xQ6p{~zBH3*jCT#ZHWHRT+8WP%vs9Z<THGYF45)Rv}|>N#7xslkZr
zd{z7!)A#BHh9vAE#;Ni8X46;P_WXhB^T&bM;Tn>_oXeUiq^K{K(Uwom7afqP6ee!N
zo*_%|Js-=C#Z00{F1{vMCRZsYM(YT<wOueg@K18KQe6%GpihHA*BzT_>#fQ=E1-9x
zDU!mukpWqbj_)e+^zfA&oV?F8jjDHJmF%~_CnK2t5>h=tn>eMv+JNjT#y*gC^^7U2
zJIc~M_REzWXc(j0fZN4&-LSBr>8ZddWP{V%sh;s>wk4=Yv(c-FJs;7-UzPY~g54bM
z*z4r)fB(k0(xI-x@m_=AFSQHez7Hqaato6<BjjB}TnZ~ZCbY2#MVkl<8xPcEY#!2N
zV9_VUrQ%5$dH^w5QZaw7DskV2I7~0`lS;tuOfaC;CL_E}yW;vXUovZWNuYB9J1xp2
zV)J2+6v+RARJ_%Fdl8@o^nzSJBp5B>8;~>AxsUdbYdD0RRtLmdEU8!cycu5o09$)N
zFr@xH&?*t@39ExrI9;r`oWg~QSJqD+=<FU`S@^ZIIpQEJmpB){gmRcVVx6yKwfGK&
z`<9hCwb>ks-6V&I<Hyt0z8k#ZAUm0ii376UCv4hcnN&=-9MC%4mm4V*F^|Gr4mpgK
zEPV5%nQ9Aaq<8m<+qw3CVO++qYPvl)*2Z5Evv?O%dm>kJa(gHe2xY_OtGZJ85SRKa
zHLTPK4RrS-*+R}|nf~fDMP+6^R$~3iTT6*T?6NC%uU%On3O!{hHAdi}iz8oio4RB#
z(GxudWENh#(m#Q|tnusvvh+H9QEgSJ-thYJC5;&SV94)oxnV;6?x?0=4F{!_3TJ^^
zVQvDa;y2|8KPN0sLmlT08~bt07i-@~eNu5Tulr~)T|k@G#M#`iYbT0e%t1_1Gd5XE
zGR}GJUV?j~A^fdw6qsD7;B=u>ZLDGK^3I2HT1Smq{rBy^usK^tEt)08KqRkg_^$#*
z7N8-1JyCWb)=8!<W3F4|rMlYhU{fi(2%TlMNA*gTK)pH0@y9o-gd)$HV2T#fcecK*
znH;-{D70IEH=r)&bU6cea$fp%5svo-j2s^)La>#nn11&IjIfek#w4H_xv+-H#e7a#
z2*jeJ#?+KUtGy}G%bmO>D|Yy_X!@L9MP=tfEE%lf8O+wi`Ax9?WL15x5qziuAuZyJ
zMqm;NnMA+1L_3=wb~V90T@WwDS$UJ-n&pa)b&*{#U^?$S#9fu%^qHdv;0t^5#D<Mx
z9O2zzVB8U)`-Dnw9*!K1K#~|Y8ljaCDHLG4DM6Iiv{)%8YPI~f?{b|GvW)4>-j_aI
z3L1_ZgIY1z!4q0|bKJw;@g`Fs97_WCpkhhl2nSzDNA#M#<_oIuNp_rlC=d3eUBIr=
zlq-FFtUg}@R_Uqv!v4iUF7|*bZ{VU#gcP0EuO7rMR?`GY8Qbx)epi+ox#yYLY2HZj
z{h)GWqVj!07d&0i(XpP<^!=|vuazlSiC}(Rwh0oL=6H5t%_WvY=@VU_)=#c7p?61q
zg#-`es4HtR*A(*6T4`O4bJT9g;QBUde7F}+ZvvTGTO392H1*7PWi0zYbFT1=ri_u|
z9nqgIY`O+1ZoemSE~#<j+9>Q@%}MGCzU1ybNV{@-RXjg;TwzRh`+GUUS|Mq0`Galg
z++zyQg&IhN2KZR($$m!ee3g|*Tcr#EH+pV7vGQrgLwwh32OdTfw_PwWfr;l=z@$f|
z?L2#4nl={=1ii=B34$6fIue*?I@Ek)oA<5^HV^k@njI(W^f)$dpumX+;L(t@4_H}S
zKfwDoDv!nf$DVv0ysh%vpd3WeV4{NU9oStb#Bbhv>wY!{@HGdYk*O(i`eWp!Ci%;F
zqyb;VFs$Hzeu5P#{hkW6v7VFNexl0twRmhO9ih9mE)wSbr|jlc$&cWU!?z158xC9s
z`dT<jZ%d4a8&(@TE-dKZ)t}(JE>$ffIC7?Ea;ORz@RdEao(dC_M!PtuFaQcH5Vx$P
z0{6<=niIrz#|e9|D2vrcx}dr~&j<jZ4EsRk+-N-Zurng$-9onH1Tn=gZNV4R$#z?d
zSht<3oN$PefiUi9RjuM%+u1>mIghH8V_`6z5tC{>P+AU+Z#NLO6F1iojU{$Nx!*#E
zpwONi5XZ=}Bh=`#k03)$^+AUbVu}YG^4vLBLNyvb!^SYX%{ahcxO7+!PLEl_UY#Jw
zZqyRg>>ZHrpU_ANF5GiFO5E%yqaC_QhLIS}i}FEkYhEw$SDLhjxAM8oZ!WdP#5{>)
z@qZWXGEiOt2IS%MWcE*zq2@TzGI<sPGJ9tM;?dJVATTN>g>UvG@>p!X3vXe>GiVB0
zyFT8iaev-Iczg_s^es$E?g_`U{BUWR&0MJGe{pH0#%wapz7M-SFgu1#F_{}#r~sdQ
z^Hk?<r27TCgIz2JL@Qf}q&4r!1)7S-s4xDEgl+YTs&6hR%GS$(&H*XD@e9^CM}Q%r
zNAp<Seri0)?PG@eS@{vLWgko*K3&-~IyTVFJFuhq%Ueept~TLMh|>Bib7%hITNLh9
zCgqIIi#se*uaZo%n6BB)kZ<+f3F5pFpN#S!Jo6n!L)ETJ^<IC)WnKh`PO=61FVd}m
zgqS#cYO9TxGOlCsr5+3QZ7Yic^5RR~5+<LzJc-)^_Fwhxd)DpkAJ+5c4%f0DT5WuZ
zr|R}FS;DhlZk&%W3ktK7muROt=&;An-^P^Kb(_W#V|e@&#Pd;J2xv%`Bx^vT2Rb~8
zco2<3eUs37xA8q~;a4f6v2ls}tAc}clA`CP_zM<<W$p0L&Y`?EVt%(7f`GQhmDul3
zlvH*nT{G)&ixF(4il79G%5elcXC`&7Q|iK7Usr8}xfm-go`Pxun&stdZp5sHV`*E@
zk0TSqh2d!FErdzmRd{M}p;&elgAzK5`<pbcAo9l27{-RwjG0J^PIowoN)VvmN&@ZI
zTCF8UdJwkt6Rz@UGCKKJPY`Rm5~TE2eaD$gAn?XjoJrqPbU2-}Ym>d)z`i|3D5f)Z
zE}`DBz~yD4$Chv`wA*SWZPU{<LRYf=pmkzod_nQMoqlxosm!i$okC(kmlS`1zF&oL
zvn+L6Hzn-aE3tc%-{<3i3k&1#sd<s1Vt4gSf~K?7Xoxg+r^w^r6A4U!Id^g$Fu2an
z@%^SKr32Uvsv2&e$p?I^Q%6j7y`8U4={K%D-nuFAEBK;;JPGLp0JUC7W(T@H25ZQH
zX*7X>#gL_)25p>pl<BvW3?dfxk+u|&PB;(bNJ$rKPPwWP;ke}W0mrxp^3KmX3;4tq
zmv0N0?!6K)jf_YLLll_TiBFiIb!yVfF(1}PJ)VsZKwb~F6|q_@R35XMblJ5&!<-U1
zzyAy!4DBy5&$P50X!`yU=|tXEG~>NLF0a_QoZ>bnQ&N{eVX~>?VQiuE*m-?3^q>*x
zo5E*hrdOTdU7mm))i}l)trxt-Nl>*(j4z64phXU-Lq7xNr2TFxC~W98ZoP6YIQljj
zYN;)kcy+Vw*r{ed=s-C;KR-f{V48OcgbLcF+^+SL>i<!$p$~=TmSLFq)KsJ%4;NTP
z(d_T55~madHa_(Uq!!R0q)Lri;Av~Vo9w<eH@Awa6VSdXhY7!&kFmFGydY4JBGWPi
z8WM!R!cV=|=Pa~-7ySb|uAHD;VBK~ex<PBa^S#}Eu=fUT;K0(=Bq47yG?an9JCr8d
zeA)hZAVsgg7AaP!w7IaXnk&Ax`{L`}h*p;Te7~wBYwGcV4Pp6^>to~9nyZ{iw`xQz
zBb#~;vsmW78=PDiH<Ox{7uf(=Qm-vDn<4BbJi2|(BLE<Y>^d(|)C)1qe?&=84eZhS
z+jxD0Ao+}mGq_R5Rfnp!`470H<w79s4f+RscUbn7Bp)x;_r+Gq>9Q8k@fV!CCtTH%
z0sp8{XE_;dH!-$(!+g;M2s+MBY-{pM(HcMhz&)7Gc{v-b{q7B4n*wifpIk)TtA)^1
z+z{EVYDlFdm`I-IQ%ae3*5Mx}80uAwViu2W=?cCb{?Y)VmHEYU6%*n(y>l-}V2T_y
z&~dpqZs;V2kPc@)*Tv$c_&cy2C&8x=0U-gJcrrB$-#>zP8|079cXn;|2R7eaQoMa=
z;LQ+kH^B{6mL5;4Lj%N-61&sDxU?wbs8VZ%AcG2Fq1JFm^usDISLDV_9ElJn8HpS~
z;l~Qs`a0)vr;^OYy^(pH0+13t7vUq}-TZJgbmwjy8sl-d?BXhwP<(o*jeH^v=@f;|
z!tQToR_Ly*?UK>Oc`@iTIE}1W<;sLQshxtR!nypV3(f#{W9E`O#)s5`cuPIX<*a?d
z`J$%Yxh>5TI=IlyEwS=U$>kNd49TU&+oHx(r+lYROMakO=pj3~25wgAM62Zc0H`^C
z1PL6r!A0%vp2*dMwLMQ2EAlg?fBO-zH}^MUF9~%HmZUoc=T8V&OW=fzB*b_VCbCI3
zdf4&+EkaP@7a)vU&&1hL5?Ay*y(E4&cjw*#tgmS@&n#)_>ECKwD9mb`WKsvb>JzSS
z6#-qw^cmgzB<#xR|7mB>okXYsuKCt3CsU8*Ka{r`s=uFIZ|kdD@92L7ld=~If&uW*
ze^XvY5|eN>7k^vo0odK6UOr1^(u1KsX#{X?E!(%PYZ7{3nx_X?D*@_|-L>=MKKVw#
z7Xapafbr6)x}BnaSiZDGC^+*M9^mekGD@9R;0xA)PAPDecAj4*te5^@t5LpqJ#BGo
z2FZtx&uS3+M7B1pkRrBwrnMM+e}wP&XvtKLdN0ea<9c<dFa1`kgxz_M6&;TTl^OLN
zdZypL=Qsc@BwT(P|5P(-Hx!7jo7B$w7+BZtK4yu1Pj2%$LHduwR+D&?DEc%$XI|6?
ze|;GC_XM}U>KiGvmc~gfoG=0-+)1P{g3PCjk_1Be33_qb^%V8JFp57ubV?UsVf^Nx
z+-!o^m$Posk3f1)12)aHGpG*~K*6XErrvTmVFDMzz!jWL=xvvi$=VcR@b1hhCIAib
z^IDcJ%OKOnpubWgBypU{GsR>zCfm(sWIjt@FJ`x|P{i2}{}w!|Ql0wf%LKqe=wl>)
zVWcK0?rhdC{#MV;3U9M(F%+z~Sp5%bLmr(5rL^@Qasu5S)Y6TLE07Ms`aeu2B>=Z1
zC~Qqm;(lCL6mg(s?rms)+YErl)=z=|3AW<@=+yR(FlC8(zTp-&=cs2$>ducLG|S&J
z608G<a($g*=~};(*b0L$avrno|Agr-FYHO2P!P8Xh8JN!LpGWKii&sTCeG)ST|ni+
zrD4Ab?bxWw?~Z$#Sw7TTDff;(=+PcZ*-;fVl;=!q+kmO<r0442vmE}0c;NSzJX)jz
zJ#HLsK{bcqX!*a|KXin{g-6X9x(;hq-i#6*<Q{o(XO`zK5d`=Fy2<)!`2BO!GA278
zV7Xne#!cOGMUeFvyDxnodaSl?fmukMs93WUdUqPLF2*k;oQ?V&>c7Bycc=lNogrfJ
za$w`M3{3J-=82;~&tv|*JIJphk!tbTVyJAoI7tTg1_+Dqun{c#nmAu5wjD;~uLe9p
z)eA015&RK1i4E|rq$5c0H5B*@E)4OKuM%m?f^;#H4E}BRJEniVRrz!7F_7zlQw1)-
zUcUvi2Gh3s%{6V?`&BITQvufKnLE0l<UOfo9KOgk-hprY?Aa1L$vc9*wghi1jZl+l
zV^5;3Iqr~XV_|;(|7c@{VlN$zie6i;Du31o_nhT+Z{a!Kp`?SQ{Nh({i|2Hxm$0iE
zJ$MZ8pJ)KUWb@*s5zdV$HPqVX!Lz@f0zSc85<C}9c*uAA?@k?yT_L!+j$pm{7nB7u
z!*mI_+OZv;MxIIluIb9OR&Zu{!F1Jtdej>LY<>WXGOQo`V!7AIvYgqm%z4tGaSD)^
z`w7aCwdidnn@K*ZNL(>Z^o1?UGYQz-q9TF4{t?1amTT^1hM}77=V+^*@=K=f<RNAN
z6Ym-n^}=<46n|=Cf0@$%Xd<0ftPu*<FoRA*obM!OCC>r0N*a*G#UMAg!6($jH3We^
z@bCu}>F8ZX=>8-L<q+<8^sJ|?AAs&Ug6<zn5rW`zX#5DmdwXhl=8WzKN_-3@-6HX$
zzf!baTYtCY6ADLLf&0b4#*_H@k0$7%|3!}56QU3xg)%Kt889axAvTq?;>WT))9u+z
z8dlu~U~}NeOz`hLA6SFx2m!RX3QX+5zZ!q-Tq*daQF&2w=Dk6cf8w&1T3TOuuH>8|
zU^GWG*mR896sZ7c3?6jlXSnI1$}G$+xV30v-8ldtz4+At7r(LYdSJl))ttU!a&gcI
zfx9h~#dvI7!3{7S<xd}-2ETWFa{=tlFqOVQ_8Zp)K&oQsV<xkHR{9;O#~+b$UOEIX
z#`QYB5B=&?eS?Vf$S3f~H2u*z7%-1+xlBS<+_%mdK6;bibFKoQD{Vkf1!AbNv4u;9
zH9T{?m6uFy#{rV(dI&OJP|wm2M(BDo&>RgE)>1Q956Iw>u{D#y7NaW8xR0H-416x|
z+Dn=x4(Fh~zLoiXL-;i9u^=4)4q{7Y{WEB1ft=t6pG}HdOKJi-EW2(=J-F+w0M_gj
zXj*oE`!pa>-(FkYwFp3KY@mVP-T+}Mof>f<vqxk>p1<`47#lP5C_@11=llWm^Ys7m
zeE!#e^a7f<-+Rpe_^HzUw9a8Gh8S!!44%R1p6n~KOJX1v`M%(INO;LWctlF^AMgbb
zd?bM*=&Flf%~r98=chPZTI*j*m19!Ysr2qnOCJ07rSyLliTombeJr!@*;|L~D<FUW
z%|&_P9i+rCA_`FvSnwa@;sbvep{f%&qG}zgjHm$xZ)iIYKRx_zjPw2Aw@fo9J7+!E
zl&^4h@GJjZTAdY)_bIi#j{LR1IxCJ>fScl&p8mDtn=Z^g`62odsvZOV1J#{{3E4`K
za8Su_su}v0KTs)~iUN$Jw-iUGNdfTGKgUXi+mb*b0%gGWR07}ArSPp?x0!?qI}QJL
zU!-aa@Ts^&D@^YX@Q`S?5=nT1m;{N&N`36Q^iT)@GW>=ZZO5XI<jqgWCKb~p>>BXr
zP60?F8US|O(g@&HulZ7w2J+poK6<Dhz?lQ`VIVh?<vRK>X+R<#&5-~`2JpauK#B%-
z&%0Eh-g43EZ}?RH<EtYVSw_O?;&u{r1krOmvH^3kr4eEhf(&s$-}yJW_&R9jI*GHJ
z+h6(AV-gbBU~@D{3o{ZKRZ>|e-}t4s6jQxL287NI9O?r=SUa*>!1B)Vwde)b+;BN~
z2s_-91d`%uDijwd%ovF7<hMJ+yDp6SY%C+=^R{E-fHdMGKpOlv_a4^zn{-uq3FvCS
z0lL}}0KZm*bjOm2^baxuc!8|F7I8!1?>iR@iHwDemb@Xn%3Hf$GpU<or!dI>yo=A$
z4@wL0X`vv^EyT{EpzfytTN=Kbng3tA49N3Ihh__z&aZQ%yw+>`R%PCKX(nmZn1-yJ
z4x;m2+T%!a{&kib&NRk<o36b4!303YE}Fh=CaE9-`3`V`QlzyXTL`TD4^qYgDcims
zTNKCH0>^%KZyXnB*XeQW8&_Rsj1G^^1MDmmu<J@aP*3>x{By48aBY{Vj{7Cem_@Cd
zjq(F~bNKvrhNQGvKlMT%b<?@oGj=I1b}66zl`aYjY<39m26w2AauTvbIc1rYX*2%~
z_WJlX1!>`QU+Fp&6#%!N%*Q02^wa8xy1iJm+Y|`tlmVaI0P|5u80)rIhTE~vJ)eDr
zZen%ZU`!w_QGnZhdFt1M{ZYIRv!U<8Ti?I{Qt@c0`$Tdz&h--#nkHx$1Qd|m_PS|?
z5#n0lu6Jo?F5!bG)h=B4$J_L;qwlU66&pYn5<D+tqee@gAV(o6+WpmgVsifopoJQH
zrK-g18IWp?)4-l_MDYrNfQj80fBFx~4HXoJHEo68#1I4M3vOtv@J~h$lyRRoJ$nk_
z-v@~Th-6<9lIw}xM?2Ozxt5?IM$l0$_2CRmbknC&)6K3BxYx#0V)sjvTdo2p=oZC4
zJ&ym5s>w{Ep?Rb8rr)#GGGJ9etwZXn1BFVv<63>ea;9xB5h%_mh#x_}kAle0)XVxe
zC%XxKAUp|${?}3P07zU7G@FaK=jac7pazgYi$6!fWl(S3!|FJE8u*x&bejBuH5+c7
z{)1#~;Rlec_r5`275iPPu?Jc&1GExNRQru_!yn}+9RDRI{X^&J{L#UccVQ<+)p0VJ
z#Fo6ccU8eghzLLWLROM<>m$6$?mAE_+Ru{Nff3s@0J1SU0&N%q08!gSOEc$Q0AT}-
zEr}F;%yc{WioE+x`DuBR?LXy{;Ks*^sAj9<0K#gwXu^M(MZtqFi~U}x2uQW>mC0OI
z1gfR!e|OYJQc{!|MhskYdX5ia7ytK>;`b7Kq-Fa7*m11975aR!re)rQpDf$*|8^am
zqI&19m#I_26^o*c*Xil5?avo?%2vrU_Q~u5<k!V$@S(*^O(5ObL{*OZl5^5EReF;c
zuJSFQ<8Ra}4FYx`z6O(7)z#focCnQ&boulE`XJDWP(yqC?f0jiORTNu<a5@YJ#J=p
zA=NbPi2uL<fd7O&*!Yt>e`9K`%-m^}Qn$R**b`HhF~*h`fsJFCe+!H&=`eeZyt-_B
zSLpxwY4Y+S;9THn-Bb6(^Ou!@7s-E1F-JE!WdADoBY3X<_i{abRyKRXqNfK>sy+T%
zw-iS&U8ScrkLX|;u85K&ANUO9i2irm=sz8V#-~8J0*pV{0k7Xy%9iKPLZHu-vjsER
zrX=30hXd<8uv*o4Fs$7Vh@8fbjengW|2U?Pi2`bnaCV^RQWy7jd#^k+t?O-W^xQPj
zL@XFzFLqH@oD|m=3tFVF^)J)(=(&D`M)rd}85W!HqrigqPm1nWDF&}o<BXW-4zYDL
z0Fq_tu<n_Q(}Jt$<;)q!6w%8n(+aoU9s?;(Cb#ewlp1|_9thOScfAn<>ig*IFF0E&
zWJA^aX-T@cHqXvzY_zgzX>x1-Wf+jAAa9Z0ZSXJQ-7g=Kp3RcVt};i#Qpg@Dv+q_I
zOG*k}UU+=jqd|XXhKk^Y5cNLg`s$`W2{i8OVN1Qy06n6FD?U(e*(j<}9c7+l`BNBQ
zfj_5(la3tP!!I69QnM^4K8W-ql+T|$h4h(=QX46Tv~+P<qw@-@f^8*^1_4yd(`T9g
zHR$;HPvE$T<QbdyFJy>o*F>Q<O~1EyDHBnhT0NakdIx4B%urIV3Hb-1`V;KmOfd^{
z_q-NwBy}OtaD{4QMqJl-ZR;FC9744Whu(yL!I5~>!FJSt|C&e+!j(f(LKadfk7C`R
zIh?lPl6IjvEdKi^`>-4W=a0XVx@GE}%XDtjr~X}<d0O<PH4~s<RgM@Gt8?Jy5EK!z
z8;=pQOrWnwz*{e+s+3IvO)_7>^CaBzws8w1J&@EyW<r10S4Wot9ZE;#8R_3-&Hn;e
z|5LIibt|vBrG1ldrqPNxNIaPgcAEa*UjN5_`{c!<XiNJHQQ&PcO}f7A?L<pNhQOke
zZoyg+_+e(M3h;gppg!A`0QjyzaP(E({s34SS``Q!R5ZR{WSde{n{OWtRGj=db^<-7
zt<m=Mb$vCFbC!SA5S+jVpELLZ*!*(vUw<k*voZX#IJ+#?#P}cu%usK9^y}a5W7}I@
zA8+!G&euLv>l3Un9R?VHrEzw(9V@0@rbBdf)n>lSKKhe0*AD=A5<j*Tn~b;uv_t}p
z1VDFw7Xd#(UUntp!!u0r-VU|}<CQJDThLQziY7Sd(ci_1!YrGefVA@KH~?kvryK0!
z5ClBy-XF@wD^#-p-g}F(^6w<zAD1SP(PV&7%{W3ZUB92f+hL7ejo#^-%0%JXVp%F(
zVm}FB3nS`g%jf}FGSfLp*k`!g9%=QQq&Wg-jo^j?JDe71psd(k{BJ>mbb)sD-;MuZ
zVG_}_^b&k__}O5IzxtF(z^0HU0Pn)`gka{V{(cT#l@M8gf?N{KZbfHb<uP%6tbUhy
ztlBD*=}-g|HLyyNKBLu!3%&gY1$zS7YlgHp{X<vT-{)~}#cv2bQZd5n;RB%p!$32@
z&1#W|S*%?@JSoYyK%5XHL^>iUCPAYw5R2s4^?6nShMyYW(I24~R-UcL1dlh^H~kc6
z5HAys#eOZ+GXV3QY=a7k^F8c96W?z320@L9C<D;iFOuHe;x(~FSD(S{71_7+c>QV(
zk9>_Ws;SbCL^cLQ(X+H9R69U44gdgqUWHrbOkhoem{Ak4arQZYd^~wmMB{mL29%e`
z=Yrbh9AlMVh9BR&V?RB8TFkJ`mcet7M&SMY8!?PcMh8yWJT%2ym-W8c-ARGlDyXt&
z(KaqOdF%;70rS5UoQBkjS9*1JY=}!2+)lEc#`!<S9CV^R=RITh{ir*?rY!V>${Ifc
zjK|aXJ`k>v_^-C@EjZO6({Q-b)FmlMOGas<o7jcn>?-<*&M(0G5Y{k+%OM2yjiV9a
z3MnljGn-itHe6TSD!y>Ct`6RV1mA)m&jhVBWrUbFXY{;~Rvn^T8!ufmJ5KNELGSvX
z9KliC@a}PXBvNLlxD&yVM3^{!0atI_l?Ykf4v-#6!li)^VuBTql6>W#PFrNpO5?Rr
zu&0ncr4S?kpO=5XA3!x};9f7{3+~wD`MCo|luwOqg?&{3aTbxj_q(rPr$Tp<Aot+g
z;<KVusX1+V=DnHC^C!$HO>neX?b^&0U1h`AN{wG9!52dUgrZc7%?EZS=0QoLi#Ka`
zZ5kB>wCHgrg_br}5y4%F^ECr}xQs5ahvR$kvJ=6&i*XEE`E+rBXG)Jqy;E2tnHnOk
zfCTSe6H7G;vD7D~)}pFMN*(e%=Qtq|7s}IDDK>Q8)X1sqv3ZMQ7eI8q{h*6|WPHDX
zEQI18J(ZW2s0QCPa4e-~8+`M<8dJ44mb7U%Jo=a!v9O)go*zB>@R+vbs9KI8(puAZ
z9d#UzBJQG}?aFj!iYe6N2l(5!y>~nc9#@RiO%Yx;XQ-$Q`|a)YR*7QT5lN+!h_nR-
z?C>l&w%7iEzMd-v+NN};lptNSE2LGw7gLg>F<*+Vk&zaE&8?A+<L00Z!@J=Oeh{)9
zajEztiUSOldr)TjaGLJ;tM|;6aJMmbybSz)0Z&(Dq8<HQ!7UX(T>1&&6rzPt1O}$V
zTsLCg@NZOtfTlqurOS+^ofz;21RZ5G<nL)%b8EUkfJEHG+V2J>g{DmHxP7~(w%bCC
zI9G8Ztx=b)Ur=T8@rC%WB$|<Wn~<`)dL`jHLiM_*MInpFGb*P`;bE6KJ1M}nIf0j$
zHqSDz8SAi&A4b>i{n9pv%`va^I#7VzB5Pex7X(aJ*%+kTJUlo2m1-)i!V)mnwuMsf
z%W7SW^>$#Gnu^Y~O}2*&?~<8DY-^bw{PX}&GH9x?o#C2x<J+5V!&6Wjo0uOi3A=0a
zpSIJ4F68O`Kpcll672)lrEH%aSezN%RzrrGn<ZWwevoDH7K#%*?4SmDK4tx|E3QVE
zF-wY?p%EV%WD1|GsWEQ)GHxuP1V-=l!p3$w6nFYRk3?Yl3++v|`u2C~sXbpROCyy&
z?=UA-tK8lfQ{ESQyg#-xyPFg8`W$24f$geqx?K)pc4SIKKZ1Uw?#=}I`7>V@hxy(x
z``Pai3w!Os^&bfe1)RnM@Pa6WC5i(WbSo&;v~BrucKU+v3-L<?xLdD5qF=e!z&=?o
zfB2WpnAPb=-3Gj4g9(?U90>Kubrj$S?^o+%#y_aSQqZ@BA*pYwDTuTmFue~0!FQFh
z76LOF`UUmaIQyNKBU<Shvaj)*j0+WORP2W>ctJcR<$S3bOD_E|tJlb;_$}ggZ{b4H
zYs7VzYEM_B=KSu`!|zD&m7LMN*!I|tr??UDZOYA)k-hR@VwdKE1V}=^dYpI<Oc?G_
z>v`}jX%1w(^AhfHAi^KxQ&IRlQNneceu2}0<9NJgrY~+j819tm9S6lOnY5-M!p!Q_
zTF3N!UxeB49D4;)>w=H5dUX(}aWQIJU1#+oC_2stM_jL?bk!J&B@!<$Ub*`0iI>=E
zHNNH#cX%C{<W{awd_|<dX9XYmVAbHuX@QZcu5+_Du3QOIWS_old@`rvrY)C1liOu<
z6tp7v)`v^`{Sa09qepy~L!Vq_`{;0M=@D$RKCf;>T8#680#()4Wd4{LWO&>HI*fyj
zNY8ZFw6L<@EBvzUH?4JC^Z1(O_$xC8nW2Y7tGVqa;&IAZW`=VMdH2w%o>%SAC-Sd~
z%`abMuZb+ZT*b(*1hO6*sk-V}1e5v!3NVqVdtiP**0vJ2I%+h%%vW1!O4$*Aai7}n
z2L5N-*ZVw;Re&0`jj%H+L710esb=YAnYE@)bbGyWzp6DsV(DD0h`EiYN-uiXoVtu+
z+#B0^XFCxjx|xdx*|N+^@)UXuCUB=pY!3?!t4O6KHV+G~GA%*pK-jE^L4{Rg%Y^Un
zUa)vL+;(cIwg+H1N@1Y-ip$R!;(p0j7$Luf7-tCmXbV&l8ZCCdEljVYxrP&4$zBQ_
z;O@h+M_<K(>&q_@ae~}$?mA<qT<!ObDjT{`>MAW6YD90J9_z<ZdSN!B*YXk%$hb>i
zZC#0$DsQ0j_gnX+d*!mR1;0b|!I+v8msh@m4L)SnLFnt}$-UfeTI6-pGb9T#VfiP6
z^bhzk>Tn~BH?CqfTN7Mtq15y>3E6O@Q?M(ENNH<TgO3K9iEJE{T~g@(K}ln^yEI*O
z&c#jeadTA25F1fXu=rL*QlR{~DYqTBb^B=1J>fC29pJ^`G(=<vN}b>#S#4SB(0()>
zQSWo-SXkX_IYZ%!9uHE|rp`E&Ozh!z&f2L5ck;!8nE+Vrexmpz=47gu6j@}0r&muo
zefVGhc}tbzDw{z>u~-=Po~j}ysxQl^Jj6*_e?*EQ?xgDKlbu7;D}L_!)BF%ay#@*A
zXjVVAc9sw?E!OE$L11ioj><CPh3wFc2*FEun=MwM^Z;Gzl)ayPc{&IUN`Y_pWaQAh
zCnnm-Z%VlH%g^|AeTkB0-8$OS-9rd7d{k@Q#s=q)*5a@1nDWb6qm3oru)pLq8u;|F
z{i>#Vu!w14gQn@z9a%4zXudYtZ<oBslD>I|7q2+g@V{Q<iYivv7jZ2+uaZAzIy?>9
zzqLpl?HK)D01CUL$?wV5nIon{&e2^B5(D1<vCCbI4-z_h)TuAzxEgWQn03U^`0=Zy
zZs@)=k8V-ljEUqgFdGGJOYqO>dR1QoWg7U{G8cT~R`e2L!&LD3%})#tnQv`B7gebT
z^`Je}N(`&4daBoGx;pC`@<#GF`8>On-}WcSez4&VgRL>&K(W$Le3}yvG8%5<`uf1&
zMnN4%pqhz%(Og~7sDAv%R!wPtLcb^5*;keCF8HfE^R$22-vXn9K1wajR@q;}uaRHd
zc-3G>c7M}nrES$XGJ-gGB+?WzvR1*rb35sH&-b9u7?-6v(q7)K8%2mH+z&5seX`N+
z>-lX5`gDv2<9i^Bd%*F2^YF40QzzIk!6u8TP$#}Uq*`{e%5yRW_7Z&a1bPSI(t`2e
zT;fIQ09FN?Y&TJR6=<^bOOSY?bZ_Cx$lhA;(#U(l#uj0cPf++aovcmG1+GOG!ma1Q
z>#_>5VJodjxk0GtqQd=lmvxin!CS)>;QboN?3j|rcdD^!^hY|ymXzFxhPF7j_R4zo
z0?3+f#gqHDc{~KwBB1fpydtK<f;W=%0x%Xa(`1|ugQp~mk29AuV<<ttb{&L8KPr{J
zM#?yshzRWN2ng@DG<LEyC#w(f89{uy17Zw(Fa8XBR5TQF(%T_=ZLIKaD<`~yfm`^g
zv97=<d%EG)7RYd~4bhT3W&WBx=gW@#kAkpd?(#^zNJ1wbLRfQfZEOz~I*YZ)NYzZ8
zBwSx&#UNRHqe4y+s@4;XIA@Fms0zg!><MAiZ-Mg+$xkx~HDEY=;&HNP_n_o+_Zwlx
z3fD@CB9rZ_mZeqH3F3^zJrP1yygDAW=DfB~X0*c&+DT#VrT#}-@V{-)N3DaW9k|3<
zS)PiyC4AwVOSN3B9@jCO+`SxSvEiiB!m)4LGo@!}HJ%!E<D0df<2YliUmM?=F1YG)
zNIp*q@>t%e`J~u%I?@fVTg=(myBr(vV1|QLN<|h=?Jgj^(5)5t5hpV3L#-j4s*b9d
zHb;G%kt6@slgkwxTdYtnV*5nkS$6tzS)kHtHL?@z%(1w%zi+A<{v&3?la_mG(&m6{
zIjEJArP)P7$IvXvu|;b9=v?r6OSL9iRw2)1{KVT9T?cN+N3YyT{w|jmcXfTAkZM*m
zNwwa76L)1XXe~{zA_=n3zR2fEal7Vrn%RY2O9|T7l)E3#b|`sRpZ=WjevYf>@-_PB
z(FM%TlzClR-s^A0aK_Bi&7i!7am?%9==$2^3F6uK@Z=&hO!EEmz+~9u6`k_z?Rlr$
zhT|%8n1Q#?V8Z;Z#I_KE6ZUxaD2(?7@&U%b`iY+N62q~t!iVFZZX@w#V&JkhY{RzE
z>P;u5^P&fj5Y{8GZZzkY2fKAc`(~>W`+5T|@=NCQWt81~qBiF*AsORE*1^LS3w;X>
zhla=U62lZo+{xhs0`9A5QJom!k)DlawKchLc7sJHu8<P)D_}hQt#tdPvu97U)-O*K
z(Vm)%kY&BW;jxZC(wgdiC3wZB2kKo&&D5~1X11XJz%YqAg%*;$EGRLZg}c!{8o6d{
z*&hQHEZKU}nQZ(;Mh`X>sH7!Jo^0H6+dQE>$Zgp?5Hy%?U3DG#?7NrQoeBErh4sbJ
z&M`fG1kZNGYHq_e80w?)1MZ~~pmCjJNVX;k90i*)JQNgo_To%52h|I|@Zz?(vAc(U
z&6T+bD1>rXCaL(%1G6&0DgOx0QuV{WH`w)%T84x>0<RckbU=I_<WEgrBPfV-OkGD4
zYiofvMXub5+BiR_2%g+Z)o6_u!SBK1OYaVv*ZT0mx@|s$RL4M%)zkYQ-2X*D`XJt$
z=yYplHeIn?&N9Tm$tKrBii{>O@Hr)0TKMorP6S0UhIEWt@+g>DjYXIly;lCrU~am{
z?YMgDB77e-TF>czD)=771w*avJRSISQ5^GyN%=Mb$GI?5`K_TIMH5T=QUz@IcV@ZI
zY3nuH{dqHeRU=G+!0MOcw^bi6Gp!jjMno4Y=#98Nt+AeR*+`D|>*#p)uqanO+fHL&
z=skqCX@(4vx{R)PTc|yYv`iVSvlk}6Df7-?Wg>ng!Q{Y{Cn>0*MR0BFnsaA#axc}@
zj%o{z#mTXe>cVvFJBIu{XC^++u?rcBH5eFA-BQL~%%EHLwy*?m=T3Vi#1_*hzBcaV
zW;r^3wYXdyKe86pQ#<8YW0@mW%7h7q$s^MKX>k9qlO;cg3?pcy_C$_dq~wJF8=a*0
zFQeDzFYMuRh=D$o!l@ng#v5#FY6soWK0z)9vwMdIHg@Gs8vLBGj*<*<eB6z}B1RE}
zceiM07o~&xN?ycGz$8@5d<3sHcZ^0}k^GdIH2zkwD*lD~W%;rVes{7pY4uK&0#nS{
zSgG(i`Ft~mswZ7<4w$SJf?h*@mIfx##FtOEj=eU`<ZfDO8;;rbN?`ALgS3&+N8F7~
z-)lo2w@gSJBVVafy)LK@V2Jx#oKrwG*na+cw~8Zf&Pndu0LyAu=3W~4BJV1>lXtbu
z<UdY$lC9Q0FpL_X)w*lubcSypM798FER*g0y3n$`G?ZXhU0`-gK=2-emUU{G#H~)x
zg~IX}>|>iQZTyWAT8rYtNfTGAOy<f@>hs<4!KgR^6bv-+x%D-@R^3Z2$MxeLW`fE*
zqG+-@`XLjx2Oacct&P_P<bib+Jeu$JyrN-)2xe9m244EI<6~Z#645!vvw49~4BYYr
zA>lZi=`V3lJG$B)Zp-yJC1{qdEq0sKJaEB!90<Vf8L24-*<A4nh)HhS$Q>ZR@LXHS
z%sZi&i|&vYcC+H(%QC{;Mc;Xh7SxdUO5_b5@z~SxbG?Du%dMaHeG%s*`fX~hkk!2O
zMkOA}i{ZthspIN*Go9i?=Uej|kAJ>-+=rT-2j{q(fLAN~V4K(9(GfL6%y2p#VBS<F
zxQD(Pxg0TI13iB=ff6Hk;R5!F2P6a9D}CwApvtPO#~{TxFXo5TIPa1kvL@aIJJo>A
zHQ%ML5(;8mVn#~DyNGVS1ZO8<wmoPu(asYrnCMMC&&~d+8u2$R8D|HX@cdmGr=J&j
zIgvX_g&fjLd1IVIyL&wr-;P_2bRvW*!+aB`(}DcH`KjxBjPQh$>H{O}K#8Ze(VgL1
z22Xo4B9q%B%(pcWs#10PzOm$M;-2rbYY*(k2fhS8aR;ZF7#~+}v70fJzZ(hq(l|}X
zcU{$>J3Cy$5Epp7|5ku=F8nMzZxT*?oo+Ey(BT0GI{qqq+7pH;SIf)wB?>`_<u_<4
z#t-#wOE>F`yv4{Ll=w`tm-d%lHhC=`LLDRJeW%8OP)uz=sFdEQe1FjLMWuVHo!uWF
z5t8OxMm_E;4en=o2b4Yan*T5-CvDrx97o^~WM{C$g4F>uzlVhEv$P&XHvg~>@=f2(
z_vQEt&3YaP3QOTwzdtcQoPi($>A{i)K8?@rcl4X>hB}jS*P4chRVqAk`f!Dh-=nC3
zkeZRn{926oF7Hk95a<<bd64q~#-?9tVQok7cvDZg`#duC{(XjYiK!-kmr0Xxa<m|$
zpmk3u?y~hx(vn-<wrxY&jZrOR?pg^Nw{f%mk;%EquVbMw9)`HGHF16;hH|VMRB9w>
zdkk0DGgIC(xZ}}p#!4A2h};i?oKKfWJT*nHtrf?Wx_V4G9PN4eJha;Lej_e3{`Hnt
zP&BVh3iHVvu0b786@FKiN=bYAwWj4VN8ADG%q68DT9DSFHS8?dTV?vEZ-G)<|3|<b
z;!7hnB>H5@VcJ{hO~oYD=kRs?fY*~jj#j$55`OxLBWp{F((^_uOnCVugf8Ms1vJ!S
z%{Jt)vIMs3Kl+FgQ2`OtOU3uY%n{qW5F{@Ca3LV?>qmkI`Qg_C8C){7l5k~(bC3F1
z-eZsY&jQcyhm7-MfZplh)pUw5k5ySm=&hJ#-AH^WHP%+&Ja_jwu4{B26ySwT>(e68
zw6uHDQcbske$4qO-6IP-|1wGPT334*PI+$94ctm4(PlagMm99Ub4@I(_bw9-)pEC^
zpv;q-p|_IkmRAQsEu4jtLEX)&nN|BOWluv4->6`)LUczbF0H+r2L{WrSx65-;h@<4
zOD$$DVQ8tORyc65^R}u(uRatcik;k7i<01G$VhY$c(H(lk-I^I?1%T~h;<iwh&UFF
z8+`%-D-3a=j<hWBMVMzrZVveL5*3j=K!5Z-zbu7uyQ+;!Fw)-bd2fun{(Su#FPGux
zTfzJumsk)s59=MQmcG~<oUCXT&X$K@P6?W4C&p&4mnyv>L{AVTXTmM)izhhewui%q
zj?{U_IOpmfw@fgHL@&?=C7El+C{IUm>VFnoCrE@6d**sO86fRfoO5m@vAlSMv?Alt
z=Y$2czP7e&;jkFQyY94#$Zv^-fUSs^y~qeu6|h$3k!MIrXUx#{E&z|LZ3}R|s#CE7
z0-h8F-ur*8cK<6N{w|G^rB+F?K+YfwG5Gp6LvgSXP%G&Q7OpXT`JjG@Wtd(%TTtvm
zmbg}MUF$lJ*s55#!IJa^s%j0dke52%%(?W2rPrT5JWj+tSo9FNrM@jBjM!0J*N{<i
z#>V5!jQXkB0>UTJy~QfVel_{Zn9ySz1UEe_scd%dwk6&*gn=zmc;_@vf@E90N(n8m
zODU}uL)`j{S0BCKuxovPt{xOV$w|c4gqcehl23fEvz}J7dGSr?ocDm&(JJD{+fFm<
zpP{c%U84_QmE2~Co77K;Y2ae(vft=v%oj09UhU<p-6mM?I<EoKous_I#Yh)Exj>g?
z{&0otM<%Kz8#`vyt(e9F`J#)<VfNQ0Dqvn$6EefZEc}d-0@fm{lrb~qV-`gtZs+gs
z6>zoTVK$$XnSU)3;Q^gbHyDV6s(~vedyjvJZuzzJxZilWbZ|5KZx+DLHhG>qF;qMf
zYBR6Q^m+aXD97K$2p2Q_X8r}_gMutuy87cA6BiSQTa^9x7=m#-gqu<Y7gFZil8WXU
z^$t`$y|<1!%$JjR!jj$xOy{?#=`9vBbLD>sjag>I$j6f5S(OPg;IyPyW=ydu$R-7|
zYX+;A_dmO*)uuFTn%E7n9^b}?!bXo_S=x`_-@*N$D3P+M+AQtfSNP(zgWR+bMw}T<
zGTuIMUNU>|!!Fx?vYq=Q<)FFmk^#VK+6~<KEG*bl))T12*K#9CfbGgV@r@f_7fn03
z@XRba1pPo<T7q(OUX%)}j+e4}leTe2%DeQypD~=T!JlD%a#g!Wwqt^KOJejK1ckN2
zk{f34NR|&@zPf{d>(A3E+~qk{1@07hw}wgIP6fA#G4jrZc8nUI6Kc=DdWu|Xw2kX>
zAa-To23%1jGbsmAe9#J>@LEETrw_eEx61so`{tXbWwSzji``Lj{-CnH<INs1*pq4;
z{$4t1$aR~Q`v#xYo}(5=53-W&&H~2eRFbu>cLky-W<6j?9nSZf@5qCVaiNiOYxpE4
z!Q{x0?!lS8jW{A3L0nK^j*iubfs4u9SMuPP-7S>DDO_CPpSO~Jhpn5Wum$Aqy;osP
zx`HZC&Duck;|_D7dAq!xdOeT6vt(~V6|$FIcJBus&DeUvUy^&i0y=@m>{D-WRQ{}F
zp5f$g$5AUc#xb|_Jr<p~JtE-oJT5N2v2-1t!FrHse%01BRbOomC5tD+R&%zSO%kE8
zJe=J)S)ldj$74VrO`BbULY)b0iwq&Rsi`O1L<BmGhg(Hl=Xt99`4emVez;1-TaCz5
zsSQS;ra%z85r($#Yv*^9paefRAbRbu)_RVy+DaU}mA5mt4L0_2Hx#!&R`A9g42~(P
zb@T2VSJ_)mRG-svVX==cRjbg(sb6A_^W8S`y^X&qMyoX?TEHdW*P?V6MH_3SSl|Tu
z#HH41^u(DuxBBivTw~@Q0^Q^fN81cbIj&m1z%jNX(}MyA^w(DIj_G|F5ypIAOAqIL
zMG$Nm993m^7@540<Uy+{x!`?tqPaOu57Ox=+Ry;=3P*fW`qt1gnz~o01<PJ7eQ$>M
zm!D7c<T(?jJNN(_8Y1&(%zJ!*?;U;Ly4Qh0oqR8N8MGHty-U8I0$n3>3aXaVODo`F
z4ne7bvZx1rgEOi3ERKcn)pOYLZ-^E2p3SicUT5XwxEg&H<>0whuYT_~DC3Z?b3}1A
zJL~1#PDDfYqelX}pI*h;GS?4?F#Bm|B(6qq+Gdo-Z^q7=diEDE(%39LSA3}-;T32h
zdlww>A+T$$uiSy@&SQ%l+mj}@@A{en@7<72bqivCm%;KTmICWY@WJga&<I6Chs{g(
zAJ<2Yk#p)<l=TxMn=396cd);Nvht3|&CcBB9(V=7cMqx^_nu*{hGFkIe>XltnMcCZ
ze2Q%I>rgvN^8*h(F3t`1&55GBLk3@-%b_iJDkmr6C_K(=07BX+oia&B-?HsnMo{Zj
zr>C0rlr1`h>`NxvluZh?PqoK*uI;*vQ((LgXgs7zeP`g-QU722sDDS6Z^>k)ZzC8S
z*?pP=)K8)qQ!<cQYxfMfcWNDYKxOZZ)o*I@cj}zg{!*A&+zwuq=}K}n3K%Z@95APd
zvyQaB>ur7;_j;(0@D5%Ew)zzm18>gNUuerq+En_+pf-}dHt5uSJ1b;RzMHAwt91Xy
zJC}R|7f=4O^S%EMXKx)9Rp0iHDj<l62uPPVsUjdC%>YUY(j|>_cMmYqHFS4LcQ+%V
zGz=X>4Bg!@4EzS~_j%7cXPvdq<5_F|8a8WoUf=8b)V|vUoeJk+9s|wWN%W#G47Q&+
z2cZBzMU29h9IO;k1)8GB6h5b<3j!F|UNar6jx(|s>s)?hvl3oV-UpUd7tJR|0pcTL
z?4X|yl7TzDZ-4bj9cO#>xF${~|K1cH$AkUl;`;9y(bk}nYINIDD&z5G;mBcG{_@*n
zB4iib7&%2pi(c_Ilb<a0zJU~s4ppxQWC5at_vDLA<G^mGlH0MC)Yfurs$+#K<M!K)
z$C%r^_ecU@v(Y2VLqfP9a|{~KW4BO1t$<gEMWv3X0^Qs=b-Zpm#vDS7qoZJltd(t_
zZ8Bt<x16y0!Vh;y`j$`Ki}Z984mG1}=^7Guz@)n~O+^^jc<e*Q4A1jB3$95oZ5w`*
z6eBB5at1?X!Ax7RSJk(Z6rke*<Ou5g9wmXy)N4!JritJbWe}@u&<JExuj=k+(CrBS
z?T7uc&h!)74RP<xjSKf}wzCGV1srqN+Lp;mf%c2Twx9!m=fTp=82<@gQ^PaYAz<1C
z?*W(XLJe9f_>ko2t8LfQ{-VJiQY8NrjLR>6+fI=Q_Bb<??MaovO5))~ugE#o3j0^L
zz=@ySqe1~CBQ6C`Dv^6XZ^!NIJp=sBYHLPNeXPWA0gPPWfd8U9DRIRs-9@IwI?{#0
z7NU<Nez=W(=5w7jo^=E-Pz|Zy7PhX_u}-I$y<Z6JbQfDue_0v8DV97vh}eQtPDSvQ
zpK7%yl45M4szH0=Ypzvb^0n*ZZ8T?}W)U3)j5t=_?y}Q^$iyp8&dN{Xj~#5qpTwZ^
zk>bbJqQf5Uee?b+$mf4I_L&@eh(a0&@fm1p{Ry_6{181o<vnPvy29%B(DzNmpT=Bl
z=*>PmlCJ%BDdyap_TtikN$)ssAIK#sob%^-ZI*Ns=9v<1t!t7*nYq@s8cwyQGHHcJ
z{!~G!3cJWHnxiwk#M%qOrtU<6s~9$CcnRM%KGN^@!`(38C!(q8cByO-U}4ktRvwZE
zZ@ztT6>>Y0bNlrX_srIYihr`SGMPK&j_0bEU_I?bk4&p-zo!`W>Ia}5UGf$l3ZGxZ
zt5t@X11pu=U60$wE@fVC6P<;6Ox#?2M*T{#_qeC<G7uXsbE*6DqWYX8vp&&9Nxi6K
zTy^`+Stwlj5|DQVSKgF7rMp%<K?Wb>mEGxXn^;-w!cvwI8DP0^mIB)GFBvzdJ+iP!
zvYWg)^gpd{r#;qL^<G*Qs5Sz0Kk29k%HOU+-9Nbd5w@<PzP_(y5dyW-Ktg1ww>ZSY
z9iqfFin@bO+17A9D=e8IczLXfiG?!b4B}a3n=xb5S0V_N_q?{FDCqTlklFUl{J29O
zfksC2_vEi(Nb1mYWBe=-S07~H2P4r};wE*8ndy`5_AhI001x`q<(%_XriBt?4<+sK
z49}jR^CbylW{3h1)uPi;-+pMx(fQq3UZ~~C20l-0=wltvxE4ib-)di72whVlBfMSL
zkP#=;@UTl=`a5ZZyWG6vpdLU)x2ZSn)TN#3xlH?N|HYej_1A#lKTB9yHeRg&OviFM
zeN-4mvsck{o@jS8nx`qhS`!LZ27aYH^C(3j=qt`)53a-;m{HZe^QFjL7HBgXE=@9?
zaX!L-{^$91u|+)%Be%S4ueb_Z3Q%Wkd5NZ$8Kx?@EB%^uFYH_#p|qgjDv$cl+Cb3o
zztvazp*gBn!!nNpoB!`e7w0?DZl-5n%VznyIT#Wg0!~uywxD6Ij+pwbRrgsG#go=z
zU9fR%;+<k$iy}_2u33-?-m|wi2?tvvoI(oFLeue@z%#J-N8#+u_q$9e#2PBmUn++D
z?p-g5{60TwGn+f_K)o(F;Qr;dt}*&9Lk5%$*}VPOvUJap!Y>4Vw(39PCR21;9?KZ`
zd_UYo5`}alD7xcs-lEl#z{03|KLN7<!_?!u!<X)w@n)~@%!@oUn{`T|v_For<&>D>
z$!jy@iiwA5wj!xIXw187S0ePg$Bo;W$T3hm$GM%X)H#hZ_GD)c%aflII%6RNZa;z)
z7oG!k6<vq*VEGU`ZP<F_ur2E6<YA_C>l&PuMOFBk;cb!8naf@SbMz)Zg3SQ5DT4R#
zNOJro3B#U+cb1J}L!s6<%QiQB=c;Xe`znm}em3VjaQv72JrUaQ`m-F{oozlqrr*ke
zARagA@QW)i)G=RqLFfh$HeHNF_&osZs0V-jspWXcTv-%N_MZPEJqcY@MaE+z81voo
zH`LE;=+VAEV8buW9ar3b<s8Qk6Qp7gKDLwx;di@d-tQG^H&IMlU4eVpIZP0^c7GNA
z?5x>|Q`}8Y1)z<`{(la^TQaF(4lKJo7WGz}z2VE0VY)iek;hnLOs4oZ6nSSJ$~pqt
z6vlkGE$Mmcr@hh{-z+|#gE}uo72{L&mkTm2-*xK6TULRD@YKtNUl)u+@<+*;JzPTC
ze75!r%dNlN!>*;hti#|XW{I`^^=65lw#z_ez=5oZzOs>jLg<_d;{G@9dBJ`wMJ*l<
z1$#x{@tK4tGpmKX&}y#aFXk2n;GZ7oAKN?^iLM?mWn^yA+W3h^hW96kl{@4+=%_6P
z&V1SSM)$<Bbvy4r*9-?jatQn|i_jH;eAgRgo6XQWZc9EG^t4?EI<~HFxJ}6XIgUcD
zqj3^coe%xCl7S)h?XN$Y$=`^kjZB?_!C9e#5k%%>?(le_+m&9&%Y$4~yTWC`zG6!S
z4{jp^s;GrW^Za^#54U<7Ia>s5c9RLXlt<%j*fKYeIHbof@sMo3_ctHR4?$v3wufi!
zykKk1>M7(L%0J=a6nZO#8XxP^gdG+lZxiFk$+n+5=dU>h-im>8gzKn4%cx5%tSRwm
z`@M4t|GbM+3Tk_+PoUL5SKfR6v-J4Pc|pw{zu}l9mYm@jO<$TwexUC!j+QIC1HG$g
zfy3rNn>A;Gmk<B)<D*8u*gO55mV5U4R)5X?#mzdKNg$)2j*<Zy>!+8_n>jbZ)mP=8
zM3}I<TA$aKQzWNlT!F4>IazuK7RM(M{pT9dwW}h}B*fVFzPX49WYPQuF!?_~yHANI
z7EGrrzd|nKHz!0Ww1z7&Ds39O<1p`4_U9`3B93`}*PooO=f8(_=MCTk%=98?fBPx>
z_#?KeS3_plCe$%aU-J4l@4+0&#*T!-*xb*~b>(KMg!~g1Oh!ai_`;Sk&hfS3mje~-
z)mSNRpyRdS#VlWYUj<fQpW<tKqvSTE)HugREpO(bMw*~KX5&!gz_=K8ZQYbxYv0wF
z5DQuaU|4t%?Dz~1#Si{i`hYOQM`Z0QxIRTYEg`j(oqhHZ1tfY$F1C)*o<yw3pR&b%
z>s)y<lNg@f%+|U!wXb*0=OP8MB7)F^ZiRv&6{`o9D_p|eCA!<h&SCe@Zu=JuN<iyJ
z_(s~s4EiGF$<>Y5qdTNlF98VN0e3yT033l28qv-tY&f{7N*^2OE=`%_GwLyExa=Pj
zaPj5j2^I2#2V{4cOk^I&nmUIdUSUYPwucZM>^GDfMM`#*;vb4PRm>EyCanCyY|70>
zm1UyGm|5j543zy|y%vh7uC|SuGbP2m_+(=MV9|T4U{5I-;pG?VsAIR&lNvR89NAcG
z`81B|w>n73zwg1~2?K2%5c3+3BcawxfZI+L@40~de|-gqmma%uaDOVyA!~vWUkC#a
z9z0XcupK>itdfv5wjoD7lXtWovV;4smx5?qlX~3O{H{Lo)zZ#!TvT{B|F+@TyWUu8
zZ^?q<+@|}R4BkRPRL197;TcV&gf<D!saSj~XI943Tx1Z$(uiX4IRkdk#>%g3Y$V{Y
zgQIj-*E)s*Ak&CzB|4WfoT)}-Di7?uyn*X=vAMv`ZD;dg#^GL%PrA;`+r8g+vjX<^
zc$>#eZZbU0;iu4gPP{SHdUq;$P51vHo%zqmSN?{|jD##zh~JL<QD$7NnL_LnX(_o~
zfBj2>^@ZqwD)b8F0yYp$wE1JNu5A4ws-s>Dr>incmyl5?z2TUaOIQ9suDSZxhm032
zcJ<_{6Cb{x4v1(PapXUaux2$>-h8Px=taeVsfYsZlZ5LBjU@P6&x~6yN3b1B2Y=*S
znGjgiFUdS2(rXPuNsL^IrB5y-$cq(~OddtANk7-1))4T#^!bYls~P%@2i4JY!|DVq
zD<uTWhOPqpxK6IeUC*<3tzP92u>g~127~nEntDrXUn6lS{}5g}eN26zuUBm7coj*w
zbmkGU?h-=eTFTozoQYq4Yn6Fs<xr|}g>23UP=!cfe21}`dZJ^cgC)&#seg@z@Jy~b
zZVAdIsCFcJP>mXE!(IpjDvMe$xLKlq<o9nu-i1wFc0aYUpxbjC{M|C?nMw|SwQ@3{
z)qmJ!D)C&IwoAC`0SGQEKBu@VtP<WSSscan4o7H^W|^yfFJ4cJMz0<^bZAWRg$fbw
zoY8E6WWcye!q}e1MUD6!?jveJmu(kCSi^U)DWGvG=wPw6%U$-df_fqI`h|{b&Jqw8
zZW+g=K(h*z3p&OF8Wka^thBGZ(oTr)wKL<cu@5#Hg0I3|KD0bXI}LjbSp+J#0Bw&k
zxo3V(Cb;OO3x+iX1Vz*LH|spM?0C;IEv0(lfnD9i-e#_0^Q@J*|Jz<IM`L0By!Tz~
zWiOsbq3Av?T6S*Cky%^vQIGKXhXEQUA6e_Ku`lD>P!%I>%N0xFw4@s|=Mi^Zz_|>C
z0Va1{^m!fB1f?eO#10*(!w0S$`AUumbM${96d*3<kC1oWmz*qQkNWc3=C4XHK1M03
zvyYy{yr{T6=Uuo{e&jht|I&$F$Vaw#KSb1HIeQjJ_D`6azh>?Qd@)>7eT5m_=0fGN
zy(}<U?+s8;H-(GV!YiATsPM6?gh`~00{}eQiDloo`~IiWyFn0Lpotz$U0QNeQM*e3
zI&bTNWn4!2$1enud8fPKsaO}H(oA1B;&5`eRfs-1?Cv;FjW&BAC<=wb^~0S()kd<?
zTUI)FDt+!Dm-6kbfE=MFRwxVdn)I2vTA!nr)Tb@XJ6w&PzIWG5Q<i9jh3${w0e)Xv
zj;ToPY0VpCJ6b`c-xOp?+lS_(5@0jS)Pj+rA`dpxd{4(&HCxI&q~$XuHJfW?eCN^f
zBo#bYDO3VJO6?~2WWy=+Ga`Q%Et|1Nq}>p66~?<{NUFLsNJr58Tv&GK=L-DXAtQ|Z
zuzOVTdNLu0;+_doRJ>t&Artso>O`r0&o32{81Q0+jgE4`p+o3d+H297-m$`)`X>(!
zzY)YP9e@ZiO~g()t8bd#Q1W^{HZJh{1`Rs3tdN`xM@A)V3Khud$40Y$o}gP}9_l|?
z<-O7*6V6RLg)D>Z5?r=dc54OPh>29W4xMEPDWX3cX@bxS`kwEmnS{$9zJInW5Lzwr
zoa1Q^`61xxO$1<n`zm}PjEX3XDn5jYA(%>MmWt<eFK9sJ;H1oZ#@kW*Mxxoz-{>pH
zV<cytH!y=4$rArrfBt4PQxoO4^;>R}RQTsS=$DES-W4^+TI+Vf64nyzL8uzUmkLh4
z9_{nmale~oUMx)TjC>_ExHiLFZJjYZc8P>xnFLhy0ulAuW=a1!5j;)e(-DaQ=dtz-
zigLu_w6V;AOqmDGdQaf(>)bis_{>oXpd3m<n<V41|1}PWQeOGgm!ew>8IGm>tT^h9
z-57ZA&F${eyQ2I{`o(;|_vg)Nrlb~+5{><H1kDEsyrNqG2+j&vaQnj1`V>5Hs8o*=
z$pSZ6$mG1T@%Khj3vr<{)k-29D>pMwqP)Xh%6%e<fI>e*ac9f2-ay;Pl1_hpUY$-3
ze&YfOG3D87*q0*r$%95prZnH}-ir+JB}fCSWHo9D=tdbvMn7$>NS8!vxB`6LT^ID{
zUkaCmHhi6c(H4LmJ1&R4p6??HUN>I-<X)|qUuybJb15Md?2CGvX8v=RQr+OeZg2@c
znZy4q_Uh%Ak`di|**eq5$y8BBb2c_@?A9Z>q;ISz8x&@!TkAatL)kV>bG@j)xj!0<
zCgL;MRs$HuVl+P;dM2$9$D>RV6S#OJt~{b=030WNGaIhj59dU09_RDQ<fbQyl&A3v
zHc4%uymTX+Y=cNb=C1^umi-!C$HU*HXfaj3o*fb-;tj34+EKJhBnP0_^SL;%h<!FE
zBcFp!OqyeTSa+4nIkO3wt5s=9US?YekuBMIZ0Lw9ZpRRw>qHgbofNias^EZCqOvJE
ziY5~7fYoW`avbAP1d%Bph%^IO&*oDZFNT1N&!+MRHv%gyJ3k)D@Eu0}h@(+kNq_ZO
zQXWJ=7)Yuy>3g}@%P_r=)mA8%*EbrAQ<}%Lr<|wvB1eBEg5OF7+Z1j}`DA_0UZXUv
z`sQ!CQL3c-1<{yXkt#wk!dd9JomepAdPpcPJ^uYWb$yEaZia(>cF-t0V@3q@%(D`6
zr=H>=cTv(m9k?1Gn14WOsYqPf7S6jZAOW|L(c`KH5&LM2I4k9#b0K^UFORI%B#Ocn
z8U~rV-eWg8qqH~pc_{Y#j-f+UeEZquP1_R04vj(c$M_|m410d0SRj4cZ>+G4P8UQ<
zEW3pC0qn4rD(;byyeCGD#HR<bf^2q+!g+(UgV)I10>fMXhm$q*`Wx)n)AkK2Mpv<l
zYHItKPN%({qb=xPE`3!O+NO|k0C#Sa@PR18>rp*2g0~zL=&BM$KR%#(t~R;FFo?V@
zMr67jdP#F+M<_#6R4ZUo&FgW0=E7p!$(8NTo>b+ki<S8yzNbwTVcr}Vy`OsJ0^g|4
zb?QChX6RLA+RWRZe%Kj(H#*<*{tbJV3<rQEbEkfuDY-4iZ=%p)JL;(#$AS!9SBp~t
z27a3*2L6neQZdHv=33y(y8vMHYqF*sEN;~mzqS6#d2MOg>eurqq3>E~co+aP!js;(
zjGYW1<D0JXGHztSaa1?8&a^d;468o04YUd?nyLQ&^fH!N@w_ZPpoe$kEf?u;U1!j{
zOMkf=HMEUVec>7*Da`Nt1n&zbc#PXIX0F0twop0PW;>@Ijd2p6Z|(DaX{LuhvEj(1
z8BU0E3?ug*6}|aBa70+u6z}-%9p5$5rng7FzKmRg30iV}67;2U0eAHTk1V1?r=;?v
z1{tCEwB3|(zl{OCJ?_ON7;Ir-iBTctEyyTrEJWSLA;&$Hq4ImMENBgI@Nkft<d|N5
zuPx@>=#GKttdCX%CB}U(Npp_^`aN*==O3k{%0>=*n+aQRTO&M*HKkF&<ftu**z|(r
zK}PkqDo)kK7ah*Biq=>!_*ygh#nY7*x-LR_H+^_2d&TEXgyyfV@3c{G*1PUF&{;ou
zb95dHT~VeJ5%+zqCiPBSdV+dDr?K~`{vmFvuP;`h`}R1xG#ID-pOq+K+3FD~m;B*g
zou0%8c${%E6C1Co_C$QuiDeE$snVhy@2oyw`{2`K#O*Km5~aFm1e^}MBZzvhjuulI
z#onuQ8e{aDzaBTTXt8iVH;>IQeeq@6pxlr6an0kM#H#I1LKEb*yY|zZ)yS5^um-%Z
zqd8loW=3qyukIc(@S6J&E#~g?B(TL!Ozg4*=d8&nm|-rPb<lRH5~+N*ktO#J%FGD$
zF<0VsqO^VM_DC<;=i`Dy5X18gae?PdGQL6UWF4aGYApR=7SZfvswYYGKAe06yvhf}
zGnl=l@xp9)$r6YX)PxvNA&?v$DCb2m7DzDzD&0HWpMQLf$kD5K`h6P7#eoN4)(9Q2
zmm-f4hr;(vtoe7UIV?!|-5K-4cP-V3d7JPKTI<k73*@@XTvBr%aeJLja<m>L$1C<R
zb!ai?<GFI6Zy9c5TXAG$ohgUMUg=+D3wQG-a-QLTCinJpzxvT_EA8@{D44;ePGVPj
zxA|7KnvNx5SE?SFk4q8hei1H`vV>>aU$vs6(X5d0_@>vcGry!t!)jiWTn?>HLiTqj
zVNj9_dGU16RK|SaQ6|d`i|{+Nb?p`o&Dh|h8WY3M_3T11gIj|eM?;CkOz|UqwNsYG
z3@<InLO%mP|EkS{el=6iZM7OjQKm9cQ{56#i8hV|X-vr1)d)_Hb+q27cne}5@RnxP
zoxzFO^W!POZv&WDU&OCs|6;T#=SEZ0j}1)<ofEx9Bagw(t=gFIs_Nrfx=yFKbrbLY
z^~5T4<iKo?4Ov!Gsy(TL*GpjS^}Q_y-@K|Xn7)IG?dFAsgamPm=VGvtl}E=AN@^3H
zhvV)4p3ZlqmD&#d-A#<US-TOn5>yrOxcy%VQ8ARqsu)9wtV5%?UDK0QBgy+KYj}Y#
zTj?!TLe_VZy{zx0(JR9cH)faVhm;qeBnq^EFwjFbC@y6JSk}db=I&MR^n3enGYjYe
zCF#3>8Rg8b(j^HDWxx%+<H(y{Z53KqzT|Hzkb$;I5YgKl4(<TFuM=swCK`^(khRE9
z+)NFbsC=e*`I@xx22HfQfkg&By_aNJo;HY6@22FExg8Tm$~G@e#KYc%T9Y>%gj{l(
zCd^X##lC!ehg)ldQmVGdmPzS^QUkiNXjjiSF19fY=w$<X=G7|jQP4m=ombmhyiOAm
z>zH0(s?7LqJx=lh|I6tv#&=67Uhw?ttcxKgH*TDh=(fkJbKWf|+1uoL6Veg=6eO{<
zehSfJj8&m3Qg`H@2T_m|qVNW=&N{P;al)eGkZ7do(5-p~oeui-Y@>KUPw|G%>6B-v
zI_gk+YVXNAzeF3C*}N$Mk4es$wqh9_5SWxE7Z8M_7n8+DS1I2$G;m74_l$~=0yI&L
zsxpT&H2?fwGBlc0@^J}C;<)1j_c-l!FVW=QwX%BB?McqW!%mvth3*RvR?|3y<Eg{S
z1P*?6+MvkT2_WuXzjs9lhp+;?=wRf=4>f27n~<cb^Hn(L5?Ke|B1ktbh+E~5R*~1A
zTJq-WC0o}1!>teu>B*)-ddke_cn|CrmRiRc*VDN(tF}T}#iv9Qau8J*k=kAPSXkj8
z=>(4*<Gke&KVjOMrOjlA8$(lr+s1YnVch@+zD8_qsvwOF!vm9mn$vlM&*U+?P1J8#
zf6dhi3^<x(eG+zVBS>YK9e>8zAFcIE!*>X<rcwVHx~Saj==V0>rKg>fr~%GJooh?+
zZQ%Xc(=vh;LqPJkQh~Z#0Uvr7Dou?`M}|#HaI9iqW2bRBnm@S4<2-G_t#wiHw4sK9
zOkFf4Pnu=P6cbNYZ6*y|qR1^zL2qW<o;uOjD&X|Oa-+O~<M<aTL?Mfu$kbPDE!}5j
zmV1drfUf4&ztVc|qg9m>LO*6&Ey7w$QPViX0g)M;o$LLrvwB=N-re}y+bt%I8u|!H
zxRU_5cI3LN*DHdmadkRY71&$BBSp;C&$vBa!t>)+`?zZEuH6|z_R5&`6X}`+pXzn;
z^tF~+<<ugOzHpm6KKj#qg|WiPbfk@X8^e!1MQl4|<Hagl+tf3MW*rS<9by=lSFadA
zCI!h0=+_wfd^DA6a2Yx)=uP|I<DWhyF{oy&H-xuVLyVePEP7+bO|an5^5$rj?`*Yk
z9|A97R@?BJLWY@~)g~dw628g&>B18~b5@gGB;F2bY!AB5qQ7c1jVi|V$fx9#>Uo^c
zL5Bou)rveJA|*VzQj5o;M<3t^7S+AKdvG}@QP|Bu>t-b^y}QW3Y1Y|0KzHGm@IBUW
zt2<Pcu=FWs@e}v<jG3O^S|eSy#JtPNFEU3(h;T0@OdE*fQwK?0Q4doAx^R14oTm<G
z-vyCl*A-~WDqW0aZ(mU4%C&foza(rbW$R85kl}c2jufsuGyZDIl9$No<%1E>8}l{e
zyzz`8a&-2fw!;y!;EkQ7@z2BeE{Ku{&yc|b>n`<f@b2dkZUNq|q4#ShLZOd;9SO>B
z7ma~RZ1iH@t9N;w?ryxxw#`9^Aa0X<WV@VMIOAPg&mM3TX}QS_yOHA+!Q0mYgU?&Y
zz_c8KMZ}gDJN5e*Tjo=M+m$LB)QmvvZzL$%w{yN{WW|wL5m_K4B(eT7JwVO$r+F*j
zV545XXSytIz@T>$X_A#5JMxBzGlAvDqROB!SQ>y_Vt22t_9Eprx2lz~&S1oYi83P?
zkkPlBp0-)kijkUMBEfv{=|WBvst#VmImJRT_E8?w(Ps*%<|55yA$l+ETo#e<#ay=m
zoS!Ji>LVz3dA2LO@n{G~8W*<Kx`=D#&@yTw)YiO%@h>*f!=XZ=YA4dqEk6M`N^lZ<
zpX0j1TrnNq1Z_8E$qrCim5Vd({wOglO-lgX?@owRWz79hy*h>7)7n+6iTBFh7noLH
z;q$`dFv78IAB!ieV85=1)0yL!if2dwwB6A3Jh~+|&~W6$l@5@jkF+lD+BmT7nx#2t
z(AW&%v_lyv?MmQsk-3kUCiYqs<#r%XJ}V{%)>g|YM4!J(^dmN+ohmseGFb9pHY5Vu
zr|=UsfOyCxg_wV_3Bhcq^s)XaGBrQ*5aJ#V{IXYZxeO3&v2RdQeN!ED8py^DZqs`s
zFfyxyhgC+5%$)@x-$uF2zIfYanso7<64h7?D$$eFc}qmZ-lp-dfjur-gKluu^yvC0
z&HdBN3WeIh-nQoed4ox7z-j+6A92H%jk4t`jd8sp>qsG&A3hfh(}#w1IEhxDQ1%^B
z_svA@0QtKWxI%3KjGwJvVY2tqSZ7K8uULwIP~0OQe&{ht=5<P6)g%loNYlMiA*W(!
zv-FjofpPI8?;jlLEQW7OLL)-1ava*xUe1=y@MwGfc>S$}jb2DfwA7Cu(X=Qz{a`En
z$xRek_L(b7&F2gDFIDvF30fr(fQ{XwcbDa_N#~i#z7`1iC94X(Xb(Q6u>GKh3gy=D
ztlZ?Yx|^JJx+_FkH|@U>7cr4pN8A+Dy0^@)H&2zF2PxVwKR)-qF2Zo$v-eA*#~G*X
zHHo*G))@aRQVgiBn7BT`;GUW4463vk!i*y=d*|Dpfs9Vq=xg40sPy}+lFzgS+8Uau
zHp-wfTiz?DWT3U3L|f%g4mv$=ycvLKPr@P#SCj+rh}mkAioHcSE(MD?E+2?8$#=KW
zVf`>gq_@0JeiFf+K_ik5mX%vC+1ztPWWMUqTCsN<15U=cDa{TS$s54nQjIBOAr|pd
zoXqZ=Y`td+>?lBZ-iXQ^Z{KkjEIT9dKFO{cK{(w&bhRTK?Pw4gYuwZr?G1G{j@<Tc
z6Jo}RZ4g4<b_SFj<)o*-bv@_o*`e5~sM=-fa~~9PLbz~nCnH0YSbwj98V?!FBcqRG
zx@^`c1vq1!y}FkRD*1jkJY`&G?2yA_%V3;orQMaGp!qF%01@(TWligq8R)I+Zal0+
z^6x`KT!p_trbA1{D51Ov+`aH~2@qlOk|0&0JKw_fPx}=F1H5A8&YQ|s*aYc`w*-6)
z7bO?S<T)4Ge&QU^{81-c_YjB%VXD15z&<s+W=A$65$y2(y&sHZef6!fUZymCLxIaM
zF%S<8w`|iEM+W{lnmobMg{hQ=R|vbt_0C7WzV<qlpw9ET3=`aJvcfc|D0M`l|M?io
zI$)y@#)y$3P9<}$o)$YupiYVhydi1V5udhX)8N@E%In!OHr0q(K5O8UM*8Hsv48;Q
zDTyjSA}BYLzjX-(U#+}lw87Q9OaH-$C{{an;Nb2RJ-SMTu8`=FCp!>C$Ip}WlK95V
zGLa!6!jyD(E~FgcUsAfPJScLE=lELia7e6bIrNK;a43Hr-%Kf*jKcwvz7xmvUk2yr
zj>dRD?bMg)`m%JFB2f3fxDAb~;N0jwll-?R`?~<z0i7L_;%3_sw7KHE<<ahOjY(Nm
z68<+nvOD*urXXaW*FD4V?OtMfsdO>|{eZQzIbBUH$BZmpkf+~g7W8tbT=Lz)5CyHR
zeS~xBV9KkDh|tCh13ul<wytV{UZDiGnQo53(X;7z?I{hnS#1zsVt|l~Qg-dio+mIw
zLL-4)K!B*DILpX(+b6qWJ|eo)_H_E&*az>wqAl$nyCvqt1`le6Omp5w%+IAgmUE`<
z`j=Xe{9T}Um`Xs8;QxoT`Nc@mI#n_M#=p!-&6}`Y*V^;UE1I|3jlECwQQl(`)9}K6
zSzrAGnMn%HEOD)6S!f)p$NiN5DzSxFDjUr(2LK0`)*`$eNT{`%ehZP(CdcoKn=sK4
zg4;e_rEEXocdbEJ0N<uxe@qwwcJ~$2TWh^~`0{nNwr0B~YZ>D4TOAH+a|t2`ly@wl
z%DmRdD&-|v`T$Gt=rP76XS3KT1XH}9BxiWn6O&q#ox%@nMjieMW_{65U{3IPeJc|+
z229f@JAW4PP>41#tnFY08SV7joKw1IM1Sj@^9`!JDZ*XnO?qf@_lm6A$vb01>+E-H
zdBek>*Lg)f<9$0mJfs|t*kltK7HK(TiKOyhXP$Use{&yw_RZ&Qkow^(OjvR<iu`-6
zkzbm3>?yi0(Q&$@23mDDL3||G-H6pM;76(_$HkzmN?dN%rcJ7H#!=P%I~{^*CJc1E
z^4v|{ZU_puBd?tqZ?XeVGTS^Hn|FA22&DWn6DZy$JW^2&EoV|%M5XFT!?$NY7OdZJ
zZY82lUJaLt0hKD}oZVE<yIEZUP4>E~LrfN9=0Uk$ss^1n@wf;_#djcZGFgclhY!-@
zilCdCW^(U;y9a`K>Ugilx3xbQbKB9E*(@7UxmE>FpYBt?*rL(Bb3*EcO1Y~-G<+t7
zod<SSO<}%AbPMO%)M72)_4rRFi7H#%X1R7;H>|ZJc`NL66&+|U+yic>>XGtfXn%wk
z7x6s5?z~c)r|X@gS2~aI0V)u@9Xm*cqV)fWGuCkLH6->6J3S{06E<+^E#5zZl8RQJ
z6K{cWaa;XZfjH~^F{rmHSTue^%jpw;9mf0v4exzD`o>L%dK6c;xyr(PXm|*yo}09G
zQ3x)Gi87kk*fg3aW7CN0k|L%DWPNAg;QmmJc)_acOIx?Adht)vQO!}$esZwBF`xHc
zFR|5(`^N;j)Nu38a2HJDrdoy}0w<e5asW;|4^ZxuJLqtt1-gRUJG4T>O&;t0o>Bt<
z{6SLuYvFDolt*aJaE#R7-I7{llFMNe`{{N#*-1ezO@!gbMu9z|afv{Rh#^Ys(W@=v
zGgOUwt?2g|Y^gMa{VrBi@8ap@7=3O+69ZkFI?bHWaS-Vo(}a*ZRL<7VJ{81EeOq8p
z`l=M~?pFA4S*s=er$uWURQ~s6GAH|bK6MOZAtg;~Bj)VjB3tek+AgTZH+HYx2k!x6
zvD&f}+|M}osUxVfEpD#x1P;USTrCZsG$LKmQ@=@Dd84unDmm@*!sGO-d(}*;hpViU
zTAF(-Y%?iWp*^A|4$pxNZGKZiwN|r@q~^KTj$m%oJH&*$yecY^CKRpQube%LcPpX1
zF9w>>&o+`dGM*25cV}llmF&%g{92b4FQnvt^axKXDyds&RRM;)JY_$`sqO>JR$Aot
zDLnf6`gYx@skpoRJNbOO4k!vIW5c{dri)=ln|Q&}!>h~7{B}V~hC_%<i=*0x+BYp4
z6kb{zxb?;O@~;pLp?gGwFx&hFH}r_4-@+EX$PqAkU)GQw=4X#?c98~YB~AXn<YF)i
zl0#BesB{Eee?mS}1`nvv{m81?8}p-AVz)-A{Zok3wYDO7(n<wxt75jy<{rpD4<LGP
zfT3D+{1BCuyl-eUQ?0F0EnO$GmwU*DK*LFd7@{6*wyBw!Gga@_hb0TbMmh;r%8zQi
zUv)5@pUB^;_1_wq&V5RJ`d$*{=FZ*C>;2h{YGg{*9gLkb^3q8?p_JG+&ALNh_TY6(
zuUm5sGHMakOwf+f=z01vWg`=+7I?O3wIB@j(liPESR)~6b~>4|9jyBDj^;@4u9!<y
zh>=IkbKpr65Uv+KB~;HzVh$Y_HtD?_h&{5e=XYT{3kc1_t>Bq9<)oOnYo77CZGnDT
zr?+(HuDPYhE^W?Y(<#g-e$>-*BJ;<)-_)VB&FY%z(~Yy91*uTOsjfm#1;?pM+%dO1
z)i{3YxQEcqgT-(e(z<3(yd&iIvX~m=4w&v<Rn3NAl7!Vz46L+4fpMV-V&QNt;H#F&
zi}Q4TxWu&WLfVEApU{$89bO5sO{wcs6~^~mw*<{9Q|0dwk6*NqC8Ygetno?_e$#>i
zCmfJ=OEQ`Xm3%P_1Dgd^s>^<BP|FXNlQTV;O*O<lO5PH>wV0QO&F`vrp<fGU@vgKV
z3URwTxH_eKqohqJ{Ui%jmQV@?udq|)m5+;T3o+X1&a?HYv<5!g61e&>q{uc03wEHq
zr;*tVb!YpDa+cdIEVh2|s>N2I5l9kp(3VB3-Fap*<!Rfbxu6A;?P3%)Yv*?-cErI;
zP06ihNybXN5@l=gUJh?$pC5`EoAzL(?zXJa>(E{ChG0w&&@gvMvey>__G6q~FjI%4
zBaNCG_e>t%eZeLmcg<Df_1B?DkXnqyXzM{T)33-5G}kGuch^WBb#%#2>y|zmP9jmV
zN9e4udk;J>+Top)o-ND!$wB|hvL3_Oo%wpZ%-C&(v*a1vT3OK!`rP(i!h%UJe{HTE
z4);MVdfsVqGv1HO-W7HeDKYMnANE$>M?|}?#%$$&Z6auX`_p{4c=)RN{p=Hs6xoNv
zH4NfQy4N#|y*b8WpK+t~Gq(tKbEnvj0Fvj6CvDwjYZn7DUwa?d;s7I?9!kh1FxV<y
zNLl*b)!R4DU*sj@_P0GG6?A#CPi0y;+3->b<cjY7PjZc5DhT741}d(x<k9P?`mD#n
zUM904@j<QaQ_7ie=Zf~AnBWKWdYMZ}E>Pa5`^GaB)OK+KmQ@%7jV?OP2mp_Wv=%Ww
z5u);ZgF<n)NB}+71POZVRZFcE+8JD{h~#_6fghiKh&j%H`xDHk%sx%S{vabllJ7ZU
z{sxA*JKWXT%3Q>Ayr1f;Js<Ha@Ckf6IETMJ!)N4TE*!hzEZprIHJJ3PdRKb&uX$~a
zWjW#t(FMY==vk=o#--m|Xroku>E|g6p_?6Cw<FOiB)vw0UBFuzGb0Aa`sdF;N5EZx
z##&lOK+SZEWdnBtI(_Pl6LV@ZkVH88Z={Zoef$r9qx|)hsZF2!4a#nQOAM@ZEleo@
z1{-ZKcvx=F6geH0t1Ae7v-@S{zxR<QrzFhHkca}EIqzum7QA_K+rpP&KhLm=Asxvg
zB-*KzA60vTPBYA<N^P~Zmamo`ypdP!B#*$Lci9WfFn6(&0$=+PtrZsIf1J9EO7Nyq
zQc;isBMf22UKdy>rHUepOM38t5ZPq48UBSp$LrA-oLZ4$N;(mMq*lx3EJxnpRcbP+
zE$v8}Pe5sCTH*}{m(=DsdU6-Jg$wYf>RRCs=bqMj$MFsI#CW=>w9vQ{Q^nX(DnQGO
zk0?G;@r)}&owPu@B#Ks}znDIQ1yJJ+96?V#Hfm~^D-Gk-Pzxy6VPG5OTbdI9SRg27
zsi(aC3?M~4yJSGYkEYCu_Sdu)gyIeSOmv*{Jz}bOpw53*Jm<|ozs<??^vJ6{#4Vxj
zR=_nfY;sO=I<n^b*b)aoGsVVvS1Q(ytq#zN8`SwZJltjatqvW;Wgn{+1Ov6gb2UJ_
z2brf3<{i*vDM~5o;%dAX(b}7O@^a(DkT9_ib6L>p0{>jaDesB<z4X^1BX2?ZARd<#
zIE0f%!pml-tB^AM>?}*i*h(o4PYvU~gQhGNw9Vk)c&8IHkdz&EOxL&G!uT+qzIgfL
zbhA*FB#9v12ifGJ^xU~YWvUR7EH|9vseO)?_r@dA;Nh{oX)4^^Sm31A1#f?pGyP+h
zITAo+NbB}bz~MeeDQ6-TrT<MLwTQ{QmffO`2KPwMFi}&hP8`rZ^lumdH8dCf*c*nn
z8)$E#f%mAN|G4u?gxLmBJ2McOi(YWlFC3S>TUzx^r88BJV{Q(i?hU4LOZTeTPJ9D2
zo@L9f3SS*M*T7%}d0IpuF;CQN>q41ue|$$cM9-ICDaFt~FTZ~O>;N9_x&YsMEC26g
zmzSWhaw#?zFzq9oC@eIxtv<P+i_BeJ!Toa9UiUtiO#o|bpZpmp(x{g>;hTu@>+@R|
z=6cWk1p2te0xp6ZBNJviNd0?AtvbTe{SNicEY{f}APq9+fPw0$Eql#bYeEW{@696)
zG3TjG&7a0~?xq#F%f1^1#gQMjwY9Z2DF3TxPM{sub?UcfLnhvql=>V{g`c5J$K$xD
z00U8cvr?PJiw2@Q^F*@L7ZP<m9K1xIqGF>vw&nuD<QP$Rp7PXpOZ{C(hNP`7C!qOz
z)hI;CHxaHUiEN^Z8l5__6z;+aa_vP+6cxt;23XuWYx*h|Q0iaBk1BG-sHSS5$+z^3
zxLb-)s#dZ8TE!=Vrq1?1g(5A#iK{k2*YLoykXm<xJVV_H7g}@awIuoKdKV|oi$YD!
z>VPns%ZPWsl@qJ;dgdWxE!1Q0<OfzY80La9hKsENsva~UmABjOinVJRt{>OmO5zJ4
zkDnK_iX~|)y}`tTe%Mc1+O);c8eK3GR#(AeAV4@|6bvM~c(~8?gtfAEL(SOkHS4K-
zNw>qzw?EwBv?2mlIs){d<BirH_vn+6_~gi*t3JDRlzc1vgnWZ*o8@fs<uL5z;a-%>
zH1Td_9r7F0_Ts>piq<f8)Nub()(12aW9(*`fBZj6d{d@XQW~#z#7$Vm4Hc2P?EPsW
zl%p)R4cB|2oA_)0Y3fPHAig%T)h+%n?sY5Ft*$&@cWR-yBcasKwDV<;NSIo3LrjSH
zAxc_JmlAPr$UtelMG?bT5y}WsrtLS*@y&hi0Uok#HX#=_F#NqjhTY%;22Zx7dq#sd
zvo`X|e`Q>#E9B(OhU!pBntIXH_)fxQhJ-*4Rh>WTZuCE3C`0J}1k3heH8K77sQQ1l
zG~>h|_({Sx!C1KdzP4Wf-^*=#VM#jaU~R^eOSYGM{uz`d>@<FbveAY$%g*Q9C^r<@
zqP#`_oGDC+UOz(qd?})n#k$!n^2b=fzYpa6cRIUT=ycCG5!|?n5P(Wv^ZffI-+|=z
zM*%^TE=Gp+x!Av1!2T8X*OH;3#FNvOmXp%TgsY%QSgZve-z2o;_OMwqH`ddPrW`&j
z{1$B-Yum3bknOArutkS*Sja%QI8v1wV6iqwZD9vGm=FJ#Bq|gbr$X8060bj@$Rv2G
zSwrpYxmknf!7`8p-g3F{`~MMY0UK@Y1j|atHva!R(<tc91xPzJI(9ocF>An6JthcO
z;M2V*pP=ZC_w13>>rXoWY8q_${f`ykltvM^uI})rwD{hm<NwXjbX;ef)p_a+Yn$$@
zif)T;!z&e)XdrLDu-e+|9(%%g7JqF)U}kuNvlrtsL%bJrAbaltK=}oDg@6C+qFKAQ
z37|&n^oFFWUVO*DgLD4He$1FLP)D(^2OgL12Sa);_6>C+ops|koDWjcL&IRPcvqX2
z$^UC5P;?c_0ev}fwA>Q41SGC3G_T0ruG)GEXWgCL-?-{<AT~0?TOI<rzR5W7@;q1p
z!Y2?5{r~Y+Yy)2YzbBM6-VTCgtr>oS_x=iz`gdcy$J1n~<5d(L#_1t~HoIQYYi^~q
z!nuy90Iw=qLvz&gd5w<rxz!g7)zY#=h-#TjS~@PC6v>R|)#u9Gi-eKv-nTvO5bIWu
z;zpt4c+({+ZzAkg{LTRxc5nVbX*Z&qrF5K}qi;n(n?0z)^~V#^eo=ep9zm8Gm*Du{
z%c}oZv@~q;n3pWIlxuYY2Hdj*-Fo7p`QQ{5VgKWKMEi3|hH-JIUCe1a?%Pnh*XCpy
zPK*&e17R)}QG=8aWZ)ZqW`=c&{x?Fp|0_k%$%)EriY&Dlig~n`TqE~VS#-%DBqV(p
z3A2&fOPCujYn8iSUfk*n+5eLT@K=&k`r%NFG_b51g^_ieriQ4>$LrGI@}9c$`wTnn
ze%*>9?3M8%&O+>fK@->Qacm(t*E^2)3{oqEgca=2piYv(TmRMelwoo0=2a7izMjoz
znO>Rrof;sBd%EZL3C{nxdKXakE!#UYiW6^NcKQB0Fod^~8>Wh=XO5uhjyz%9kR4(h
zf!H?Gqoy&GeW|uy=kV%&esf${zZquVz>2W!rc@uA{r9W<c4c@t=q%yt#|gp-_Gphb
zMdz^1=Kyzar!9Nl*y>4Nwc{Gxllg;mUG;!A6TRye_&a^(b>fi61qrLaejE>48kk|5
zqx`@op`zhATg=}VL2Y|9xh_U#B}H+o`az^Sw)7ho0qc(()tq@wd%kiKmuJRSiS%@;
zi*xQwv&#8*{G5$NfYVG%!+P14)kZt*LK^Lsq`%3`_>bzn5S^t0eUH&_EFdL{Y~0Am
zLV7zbxLhZejV`TdzieaZk^P5+T22n0v;FvT78&)6g#<yu;y2w(glmO``@Y$owqnvU
zY6~Bo1KvC{K+v@NK&H-muJ^;GY_lZ-iz8MdLDP|=&!cu_Bs`!Cn|Jf=QkL1*6#L%K
z84wXUyW`jx&3GS%qQHS+htK|smLhoRqxMhK^JjX+XQh11WZ?!hB|XKjELkVD%C9bH
zgzftVs^i9Im_EqrXktvx)O@IsqeH~v&%J1YJJ0G7K7P4d`|<Z&5n*(<5Iqx9%Gm)3
zM5c>ugtgkAmi{KqOt&g?CO7qVo(wMCaPL?y>(N7m%ydO_k{BM#zHUrAUWb+8pWPXE
zvnf`(N1}b-!_wF7khd2#@N!X41jWJ#1%m^wDsrVWGR_<D47P+9UNH}l<L9!dK%NTh
z(8<FHkwu@b$4$=sQ2zab@_RctmCO`h1|{^m-St1#GNBFZA;Pmk!rI6PW19ci=Hzt_
zzBCUVt-4KKQ2(!4Z4Z=j?^`Hlc(A1+9&e<+?f?GMfn!rY)Lij>Mr2pDld9@N?Pe!z
zz}Q$6tgK2S%lDObD~34SqqyYa$76$(mmfX{HMFC0hxorPlnhO1RT8nHG<p6vB=rs2
z6wK|v4595Sr}Sme2j6vGNq*Ac@}#2?>sX~ox3ot-=MPqO)RPPm{Po8IPkJ;bqQGIU
zN*Cuz#WCi2WZC!oWpR6%#LG1BXOP8B#u&cE{$eSbX^EmLm6$a2>94U>e&5%Xc>jHE
zQKvz5vf{nd^vHTzqS^KK@2eD20wY{`I59Dr+>5I}1D+2(8lq#bB5Zf;JPTia{tHW<
zwc{KooQIV8M3JLC;YWTV3c6-CRGwX?1`|w=QzBl?wqY}KYs{pygP>M7W7cGh8<iN&
z{xM3?w4$)IYYJ<KB3kO)24<D&qY`JDa8w#*N<T*PRJhb+g1Kpx(VnKM$)5CYQD$QO
zsJFjKA~$MPfLb-wJe?YEsEO5Pein1hj^(Vp80HB6lr^t}U28dVt<|F|@YMD=%PRzT
zID-$aV7i6%Uj)4V=Xr%CKC8U~%XXY_y+RcT6U%LHYxOJB-UN6%z;S2*Hr}F+M=CSV
zWx~uN6x<gklGDuR_7pPr#fZfbr2@W)*hcShHpJ;qan|s&dCys`9Zr_|%vOg^qqr|X
zj5dD&^o;I?F@gDxPFg>9Huz;|0^5hL$!SM2`eUBVmA!2X4w>2%JwG}h)v#CEGfp|+
znk}UiN9=V*05;e?=H79VmNJys_Lrv29}Fw@zN}y9d&#ZF5gZ=Y^Kvrgr3T4gxHxM?
z(Xf{)jjUp##F%MW9IOF+Y$S6#+wDE~0h-rmq0)v$`QMU@dV8i{M6$djOC6F~&#xVS
zak?38VeE8x+Je7_NAsbBlIZ(8!mB%5z3@~mUFdWi;+GP5$CdiG-mc`<Ow?RvF!-V9
zyFzsb4A+KMb~$6o^QA*QIl8pxAIsR#(QTW^Zp*J>Md37=Da8&q?sx2Id^Ell{mz@N
z{j!_RCKS|K8b&$w3H>tB=VIeD&z5`IMPJ1;On`rst)4EB3O2IER8-L+zGruAOZ)R*
z*&W_l{a|w;_mL%QyeLAjS8^)QNxn7*M7{k0z<#{)*_^CTE?wex)61XP?+66+f^Pk6
zeIcp#^QeqWf4lsT8O+Y~(p?3XEzall@(FALXR^<+U-xcCC+sHRP3eS|t8EvT^M=8G
zJ@9T@C)$0NK(Z@@=4cxEL3(;I6`WCh^ELfevMLfqU_1kPy@)6IjtuE-<VJeT4If}?
z@6^nKUI%lILi}i~o!mYrI||!urMwg*Si4o>R2Tw3uip`NJbo2HiNG|qc#3%7VTAjG
z1xdf68n;0)g-*2g_*!X%PW77VZFlCaB#cm6B=X?tPZlp_Sz)}sq{NKEUt63LyiBEp
z-y_Mqu)ZqfPp3QSf!dwl?p2hF9E}(jUUJjB`r|)U$vz&(ro40z?%N$OR$j08wMS5!
z--p#7x%?yAL8YJ5!ZP+K-N$bjY73U6+g08z(M-S;d|B#kJ{!?tQTdBIa7ncI(%iJD
z#{#|vi=2ihOREHW9pao|q;=o2oo8!zF*X5do>DoW6A-~`;$I2TB86Cxa#7w`d2qPc
zIbx#`(0LZApL~j_Jk_GiB_2K4O&w;-4J*O=rwUs9j(>{sCoKNpM{pi0jN!>Tvh%@s
z@H1!PRJpxv$Ad&-?yg%w{xX<t1XF)(re$XMv2Y~vm9V8h+@o&<<u4zs5`f{M0)0E(
z(@!ElmxKdtZAPvV=d^+ZHUR%dNGO7eAZZsmREvM6;G7-28!zor5Y|%b2stY5rO9iD
z6V6jaF&^H3cfr1`t2NeEi0V2W`wx@=TBRr3`EJ_68k**qRCz8kfzXXrNu@}uXfG)=
zHdKo@BA(E+6F);|l74nxv0x>l7B6u{SN&o>>|DvoPjW45dxgrRix`=$k-OjB8p5+x
zFaWJXA*cH&<do7FyEQx3blE4`Yf#U7>a|(sVZE?_+kx#bOB$NcMgYD>j8*Y!5<WM^
z7a!T)byL-L1E}Pes;@2n7~(enS}9IB_if#pgmU+1nHvm#YqiiZJ49f?&t96$nHyIt
zLWAo46Kz-hUL}?4;eG9f1x#zdRi$6k|9#>vN1Uxmmh0P8p+)9kv{i9ceVVA7c%lFe
z!vAtK>ISWL%IIJJz!l2f3jPV0aAxaG?l3G^Ua0arM4aIqWsIOg3242Wm-*&sWy+GZ
zCO)*bojZG4h_#8?%m*zlp&;LPgTSR#Q(J>IEyUXDgU_i#k5hT9xHyB8U5(-4s<A%4
zYX`|b?-ybw6;q7Jfu7f--+`=whw;<B6wbT99An+1xQ_4#D4hL_-Y`opT_-B4SfMiX
zOktHrJs^F5PR464Q_tVkY3$>+c0x=BftBQMOQlf`%HzEPD-@sI{=1ar;<l*J14t-@
z+O6ludL9pwM+5u!T+2>@mUP!tuUN%yVN`Oqw8ER*WqOWRo2K*7R-3lCCb8Dco&s~v
zdog6(Sv1WRnO=f{H7cGEg+wH{HbShzQ1*Q$p<B`Nqov~AB+uT&=8D$r{R~thMiyxN
z49A&K_ZGjxV`biE(iVU5Qjw=9RT_7D|9?`~Xk#Ay$pr~MeR9zVxRU&MnS(09^(7Jl
zz^lcOr-{G;gh6`b*cl|w6WyGyTy`havV3b*$p-b>>qBu)W))NHwC#CjfCq$PTTg8G
zb34YM*vhr@Qomc#rhmiPC$gSx-H;d#p66nZUhu8_)2~(*Yh04nNSX^4e)Ukw=ACRk
zMuOmtE6@94B$KPnk3QG=EXGU-kB2s|4+ouLbiH_e?)oP8fR>@LBZm!V-&LM=h?>n!
zS{~^<6S%CpR!gz=2W5@7Mxga?E2DVOeFq~T|9K}PG|R~637;u_qs6)b81kwAl#uHr
zrW*RPzPvKCgyprV1DL?m1Vf-KO1~g!aNtiW`nHjhLzg)0YAdkdaEQ90!~FIsy<Xvq
zgnhRNkcE)%T{WdRIa7oG(I+&ENx=t@B)5;3yt=7~C+GY;qz}DpbSAf+4xrMdc~Z&B
z-rlh!Fx*Wh%iQukO2<QmgtFfaJx{RoI>X*s%`y^m^!1>3jKc6_A(~Z1&feXUw_e*f
z>B!S!-t9g9o<0*Pe^Kc8BaTnrzzk~iT`I5?276gwp@GtvjOQ{aunM3v{7xCf8B_hK
zLg2~=RfN{uqR|E8k+5}C?0h|otK4Ro=|GcYg?syA<qg30ihUNmF0@O(aA1N$b}yv1
zE*j2Gwa~8WD{RCdG}Jzaingh3xDQb5VOJ*|XU=xe1)GY&QJ8}+^(guE9+){3-hS0D
zBH=}|*jRsHzjkSV^9z%=LIGZQfC42DDaecg6o7|{&S^)52jD?2dfDW*2g0blytC%V
z_A4Y>4mQ09Z;#p%4(dEB!nq*b{POczHVQn26nkPcIVM&F2y4#SrChb1Pmw!HE3o{&
zF|}_BckR^)YRdJmK5&i{^Od6FrONR#E??${H!BiP#k~C_!1HyYMa>`l<ej4Pu9qvB
z?yPwoyXC5iprCtj@)@Juu}rHOo2jwUwtK5S|20MYM8l(J2JY<?1CEICnake8r!`_l
zMuu;OtJ#ZwFqSl1cviZR)z3a;;=6!$eW#gTbFu9}y(pw~_8J^(eD!}wdk>(d`mbH|
zRYYun(u;sd2LS=;O{vnQgEVQ<yY!GKNH3AlyV5(-J4h!~>Ai;D36KCG$&J4M@6LR8
z?wNDGIkRS9*t2JtWbd_pYpv&5>pA*-oc&b!1bXW}iJ{HizPB$&#^<)&Ew-ZF2`RZw
zugWcVVkQ4El+<1m7*R5q_yQI-UqUG$81HA&2$ACxKjM>4listYlZ(BhLr(K?BB16@
zQIuyjUJs{@oaR+AZt63IJZwsmKqYB|k(-$kK=>>EbG0sstDc2WY5n=J=A$|R4*X&q
zPoN!5OSE`GoGhqbB`X*bI++6&yb<lsN(xoYq3$epMbikAj(_9uvAceG2JHpEU62`n
zrrO9$unP%)aTwCpAOA=()caWB_X;K2&-z)<(R<xfHXpA;J+9;zb|Ms#p!$SbC7;GG
z@16v3O$P=s(@v^Xhol`A&R63<6rT0^UN8ABW|+6UgGfB^g+}0tJ8H74F19q)LOQnN
z-D^(wg5~Igqwp$;b;ABVHwg?{=$ewO?codQ^9AZ|8cTOpTg?BUx$_0r8<!Emt(7|O
z2WZIY#n<BDD+k^jE0+~{=i#MYD}B(8yVhqKOdr-BOjlFH4M|~>TI+9B6pKxS9Dlue
z{OtZ6wP)}g^6oeGyZS|!<c@1Jr!*(r2>cZb74h{jy4(wbH-r>q?|uYw6z=F`4Coi}
zXYmiT1e>k`*6*ENFA&x3gnhs1H_N{B_8Eb@dMC296^U!q1dJ%DL*lYL+>cE?ZH{Ya
z<{g&yeUEH1x;&0Hu|1(d``eJ&nt{0p=U=t;AIh0q8k9M+<#I`tK4k~#$cChRcplEC
zLZ1-<xC(F0tS|PS!FiaMOngSzWX{-C(QMmY6*EjXze~m|D-2HHy?xrUgT~)qBx5#r
zAYpvSSkVMpW-}Lrj>Jk!BUNsk3$!RWd!4d-U#XJV>0nzAk>_Z+gM!<mi-yi66iV4+
z;{?_!qD}>Cqs%EghAWBgrdU}YNd=2I-Q}<26Z_fcRxEM}QGMf8_m@#tk4#awP)W>{
zdDdb|j#LzbLLY<GE)`$VE1>viG6QuuoQ>SXLzFOJ6y{piKyv%OVxtPoF6kJRQ$Ni3
zjx)lb-m-A$i-Q?WI~Cd=1vRtCsP#<O8gHVNJsV+U-ZQptubXNFAZ({9F5)X+-bP9a
z(V?qlW?#&@R6&xeT+bk(u8qvTjmH&!3?7sf^(2Kiht#m@186nzsF`ChFK!UIag%{>
zo2?D~72y=?*2-9WU>WEbF5(u(9w>T=yOsbS*88!b;Tvnh6Y-&(BqgfZxOa(L<S5k5
zw{1I%x-Sq$Z;!Gu_E)t6D4@o*XQVccDNd8brKZ_{d<S4J`SvQGtd<<uSK1kx@RAK{
zI$>&kDt(J?@^bM-Pn&`o;$9rvq&EO{mP)&Q<r}$AQ|{2>`4Z;mAHYD5MU^vycq|uf
z{#w%O<5P(lNn@nz66{KrrW_}*LH*aXC60_D)ULZAuBo2g%`x8XMSf)*(z7E*V<zwB
z^}S~j7^a13=-QccUnDuT#k+&k9x;MSKsV!|#m6kQ|I932{8QfiQiD>~DYCB9R@TLa
zfQc{rLzE-AS5P6ge+{9y*LYvkey}n;2)#L-fNUu`$RSM{La55qR^Rla94Z~lGF}UM
zZQ&*JcP`V9*wK473tKG5EtC%4=dTOr7ZL;>2Y9&;us|Ghi0ZKj7W<NtcLDRu?%d*R
zUxn#GGz$r0@zr_hG6S6gcc+W*H@99!sJWf$CRlUv33K#m`nj*zB<v$H9*P<s$I0ce
zEy*#>4LJQ~SIyw3kR=%K`jjn2o{nWbE&Rrutaz}I<)~@(-khD^u0;xPYJP(-F=`!5
zXW+g6_L|YF%HV)`8Z~vVvsUnO&#Ip%Npg*-wUVNJ!IXn#`RUXEAW`&8bhXLs!;xUs
z@Q-3gy1S<889yXBPj4hQFW)&iCHa#lN{P*B4?>I}oWW{UJ?XV{X5o%kLLk6*2^!u}
zvleC^6ng9|wh*0+AWV40wr4!REZElJHX7$v!ZgrkT*`U6Kn0sV<XD)evRsT_$N^?u
z*u&5*)AxKX=e>RC4y7~O>lQP^92QoU#q(D<@8H&NRal+8y7~%$s7f*N#wPWvr0P-^
zKnXVR;BT(aZv9<frvZ|lVajcvSlK<Er)@eC%aV9a|BUz>!K>RvLj=^ZewvPu*h_&}
z+Q!5&KkAZb2{tF8k|mK*2GRGy0ybU!#|doBf!20IaehRhOogK4GTw7lC1y&RgT0h&
z92{Z$+qCkPc7x_6SWXV>svl%I@hRDmoIA(A=`9y3mV2oD+8VjDKDZ+U4x~P?-NBD5
z4m{SM0U0ud^NH(NL?yk*jy6aLl}jla()>sxjJjnEQp&slyEF?!6W!Bv;gQTE@y1ak
zHiLrucdH(Y{d`EEs}=cFY)zqdo8x|upBWWO$_KBarDdwjq5i|o%&gW3jfQa^tu;7%
zHa8(jr<K5(ON>v>0pNC0d)W9SkIlra$*NV_)#ReX?}e!Ymoas#0`#|L@=Lp?<qd`X
z=)S@HlR~u4PqWr3`+Pab<N(ImHD1!s=fOztjgQi6;EftcveBDh8oSSR`MZ*`x*f3+
z!mo8fG-UE~WI5aU8}sueN&4p-R!GJ8V!imeZ~$kxT_rOg`GBNLWEbEOoxO{8;Yw^Y
z4WMPAj-gfU`$DD!StPFn$nBbC?&FrvNQOfj?$w~1Ftd+xBaU|)O>o=C;P;`qsO#so
z)PENKyqmh(pz9w!Z|NvuF_*;vekRqzDn*11AFiDR)~q;4uX=tC-LW~ZX1=6Gb8U%z
z?`e^j2)A)qH`T9a==JTr`n7F>`{nxszn8o>ArX|Bi~i({HUAqukO3~Ep2Yu#56b<O
zqVX*h$G@Sc7fpr*eB=;<QkBXQI0a<vH2#erdb&Y-sqZ(G$2CXkmq-t_sx!q+{O{VZ
z_!d8FC%C3aQIho%xPKw700}($YPh1!%Ma1mctif;NdaM2XO#1+5mBRfKRuBM_3I~R
zXsHV-eY-y2cI^&8RsulqRbfl6Q4EM)eE*het4?0fKbeqk1$T2DfS2pM@&Wzo164;w
z-DS4|zD2_>eF~)SD-`V+DE`ByKR3V`rRO-V#Bq93dm3I|u(I7Zx*O!CwfQ4J{G>Co
zVioql^2LY%i@thS3qy1~-(08-o&rg%_D2iwn~9%$N3lFmF)-BwgE~UB7(QvSO4X?`
zv^1;HBOb3hs+t7|bNZ9K{*j1P7+sd=aGHls&<wo~l~ICy;!}L4-nFe`u#D->KSC0<
zL=56ejx1Gq>wr0}vF@4jv3`(;JjbqPyOvgIL6Cu6Eic+p<)E+IfJNx)P_cHg#Vu_>
zrOC`~w6{U6<x`+;sh=OlBB99t1@cV)G28lt7$DGR&tZLD%s8Ckw0b&V{>N>bf58aX
z2QUa`tPW%T`VbY@P|tnTopcF72E@af|6SN8m2_fKGc65>rlu@&O1k*7%CPIlZP57N
zRfeCnsglmYbr-~V_A6Q4txj%iZQV&N$2m_|<W+8%m`I-Vu)dipU!2VRaV;vU65PEn
zIOTi;|D7WCv`i#sXh`*(=U|uCwTeeQT_QRp<Ze8IS4LgkE6QxV`#3AoXvw)WdD}@|
z->cOTj{;Ah7uu()>^2Y1kt3V0mnVx~{uyHQ(&D!BQzOoW>7HNGByZ~5C@p87X&OX`
zOPjZx9Xu~xC?au<aNF<la5dz`Udo^z^{{FtGy!di?T*ubwA^`=^@<Rt+-zhoMID&j
z*awg!`xy}u_3JhCiT0(BvP_6Y+@4tiJM4uQ*_UtNBJbhO<cIQnDtm>P_O^2=M;(5V
z*1kyi_*aGaq!5~8a9+!#NShbd0mdbX-&=s9bO7$F>zc0|nam=vPTgj0Cy;c7l~2UZ
zH~D3YWYM9aSt*|cUX!J54b%m`0U%p3B6^q(ZFGd7bUq}`1WPr&gkoQIgT(S=`8@=R
zd4=sb7JY|&;jJs}jEF8C{?4z(lDMpSRQN>6ZMC0X>`5dDW1{H}X>I5MUL=O?NZyui
zb$itmsdg8Y_2u4PRRkY=e4W*|?~D>el5D-gUBfWZcKG%A1dxn=0Asc2EhKnU;>1#L
zV#9xA;}mt?&_j@Y*hN)eg%!apCkJqVEPPQt474tz(#@<GA@BsQGemJ5!T6i^puw)(
z|IdQj>(ER5D@L_T%`*vfDp0MRwZcwnXD=&M1X%9BiQ@6jz`@;`DBq^&NE`sJX49S*
zFwthWvP+w^FyBs%Y~E@=uBkPt4Cu{6M5`oP#Cd(psD6Abwv5i-tF60<3^J3c8>%Kt
zi+9)NC(fJ9B}=PnvbOm3`K&DW))KI~m-gM0RBRCANYX-+pt!A%5_hIW9I#Ud$d_Q%
zNwEBDv9E3x9Q~L)D}|}7J#9+5=ttHHm(f7kr@DB7goICxS5n$n+Yglr4cC|_A7RHN
z8!nW^??VsUZ+>9hG#Hv%eTv0vn}xFvpia{;{Onh?2J!hV*XE8ut6M^b;c8WRi`foK
zhra;I!jKyQGYDwXyq!0STWeH3tZKh;K!snCYl{YI!>_oEl7Y9$BT&k@%K%t_-hNZS
zc4vUu&Hm^LfWE|Z$y)N=vw_!<8OWY4*$Zj+Rqm91HLsi?R*Rk`{bpqiKfpq!@n?On
z62+>QPHVCa#TDp=q&rru!*kXz>%;fC?Uf=~eSHR)2&|oxj6C)^gba^Md>9_m8-ne9
zS(|goWFNxc1qgj@$?l+%+~PDgcNF&KX)!wqpdl#JkNFi)lAqIl=I2?3I$nCaF@HwM
z%b{NXTMNY(*Qc7tYzCsCM(Xk(xj-A1wyhTjqur9A4Ja0V(+PU{i(*xs3JHHlYSYq+
zvY^XG#O~|y@%_Z<34xC5O4#$$$|v7(%TuW8U(vpFjwKc&z$xyD^-0)%Tm`sFQL)tu
zzf^}1_Y*jE5d2wmX*8Sg(RrQ{x9T#l^~*jL{LS_%-iYjWGQsepbm9>LSS})Ds|Wf>
ziAt>Cmj@`8ec8&oWv@EE=LPsrPRh+L?J4%PB1ShStx#x_^89uF-UpJHyVRf5Jh}Je
z%XV9`Z*Oc9B*dhCQORH)PR2<Wlc+qN85Nd_(KV8&&49{Ur3q8VTo}K=rwrDYWyws}
zCgMtxhZyEBBOmv^?G1A=-IEF1*kI(k1t^g+i0pCjp1)@*gkR!JXFUX>0-2t%1M72o
zIlU7=I?akJy>x>@BK_dkhF72Btp);?K%z5KU%%zJ#ut3TBG8&-AwmoGuj{!pg3KXy
zxdZ3{QONi6pbk@M=1Qv{aqsXFY<0ZK%4Tz~pO9F8uiADDPJfMcK(+-3a|s(NYwd7f
z(7)PCxfHvvxqS2Wr`_&zN6m1ZMt$?soH$K(kl!Z8Efp3ysgqsj&-cJ1YJ2KZ{%SAA
z%q5}ypN!Wz^JgdheNmxDeQ)y|^Lnk<48m>XICd;c5|bJ>60;V=gCEYk4_A22aby4#
zZ`*2_ahOp__1LFI6uBDmgj;A0`?|20HWe&tdT{m}kmJgy4dUV}6u`1^)*<hPT*tj?
za0yX{2|Z0@HYuwoB=2%b4l-)jKBxwJJQt*huwojuTQM_3DvrPvQ0RFxxZ7D566XHI
zsoE6+Pn_4VZ7+EHaU{~NFG~f!!pU{T`_frbLmhj7>7znYQP)erqDQIg-&*ZrY~EVL
z={0aRz*%2hjpZ$$wIPPRqORKz87Mwf-}SP@W9b>pdkg8B!OvzB$EwSdEp(eM8!TX?
z(Ykjx__FAN@ha(N;mOUL=A0$ZuS<MK|C#{ilPXTVn=VKkM*pw<y)CQR7Pm|}=BIeM
zf5VYdXH%aRuJKb#gwFGA+4n)F6(>c(yF$S~)a$$lpd&IBroK&FWnx)k<n9Z&)yA={
zu@pv=W=dKH&V{!)dRPOJ4}I+=72x3#>>l^CNMhM<c7$}$OBIQh7ipXwa&%Y8uRK_L
zAMG>E(e<6~X07zj>#y8ZQ16PMW=cD1*DxfY@;g*(xSCgq4QL`U!fqNmF50mP7726o
z<U?gyu9QuleT^o53m?6|FH;vr`y~qvvw9@T`_QJC^R&Z=_NO_@+*m4r2xG2OdG?LD
z&k?dg##U)p$1DUL@zV3pcPDaJ{D5ec?q&(7*7Ubx)8jSTXU7(P3^8Ahpr%?4^Sny<
zqI?>M`nVo}@fB%0BP{jtip-eIEiUS2)!v1^;~t>rqxJxaJi_;tSBI#*jnAZ*Q`XS(
zTpSWjc4a(SGZNQ)^-&^(yzuT}SNiBlWrjhE0SgVeW#{>^<@t*7=j@gjI&|~FgxD4e
z1~CJ|1m>(Pm8wWF35n0Q0?`M@CZB^q0Sx5wIWN6zrKBh?a&=?)6O~P`p-U5dEg-4q
zic*~}^hVq3{Hp}*za)xEP^5!(lc-X6rf`M1(GA1umzeSA-|I*!%3k#8CH%IgGfV~`
z(Nw$()WuyoNUaB&EI|?SZ;J29wzCTPvPZ2kRdgnE@yh=Y5YCT)6l0?q7Qb?=v{B6w
z+PteowVw>Aq`96Puq#ER1p=2QNuyC|qO8$Vl!3Z=A1=xcuuMj;oNH<ALeR-xHk>(g
zgmdUQo5Iu{TBHHB_m?Q6HCq13J{@uUMQ!UvL;j;2{-cZD1{JHtHz579o9Zh8H%21!
zg{&A@ad^&mHTBVoIq3z4L-7~hC!hX#P7mz~@=}!6zW2KVvajDA=ffYfzas<Obp(93
z$*;bML^HZTgloMa!v7X?@XOcra_!k>V-+>RFGv2w+>M~~O*~2dYf)U0SKj)?O`7HE
z*`J)P(qhRMnS|i47-+~Thb<-DO`TE~$RZBicf0K8V^7FSf2!oXH`lbmns-}QpYn?q
zh%+HKztnl@{R~L6+mJItjZ?Z?IkCaCE+OJeNy?-JE1{tXt+HG>B&t_jEBr!bpi+&E
z9E#qNt=oUk81a^KF8e+J+)_<3XzH$$mQCw^yi>Nbh~V@JgN%zQ^7RJ{VMB}JnORJ=
z66-UPmrTh`+qN|wrT2A5M}}oC9lM)<U>`7Z1e~w)o(?thWloHiRBJ233mqkBh{EAh
zq%rUW^!K!<%s#p;NQuNYTNgT;Brz<V7(SN`I6^dQ3jt^oYl}2*IIg7L;kB29(^!Sk
zOwna4kO%a8Y{HG}Ia?6@ISN&p=W*W-Hxm23+@B*hu8TA(aeA~37?O7PX;3@-C9rx)
z<$chHXafTkNMcE;F8Y2VkAY>0WzSAXz`n&I;<xG}?E!6f7%#6>)JmH}3!6f#o3}ES
z2ae=TY)>aGJ&Fp_HN3KN<ieG2mkF5%cVuST@+v5fGveKNRX;2e4>tJEAuf`VNT`q|
z{6`NZtsCmIT8Z~98rFUnLGB4pFC6g{gVZjCvs@N@CO1!}fNz>3sR>?~QbskUoBYPf
zKk-dBo)fs3P<WWgN_ozdb@yEv|E7i!9L9UiQy)V1iOR(rj^5t*8(lv{=ZRuE8%F=w
zu?Lkfm2fJluq|(q6K@piU*i~o;WD(S4)>3uhKm0Qex?7(>YW7(;?w-j51d(8cM+tb
zCEbPd6E-jMST6u}*ykHtv+e?AG+BkuaB5dIdHLGzWy~t7PuGFF-%)w<D{Oo6h&sn#
zg4rRTG71@YVa5S0nY>(mp^zPc)h5Ga|KZhNEniPY1|2G$Q8rBx{`4>1Z|5()q{m}{
z$}p%!Z}+2Ue>#@2OHwN$zE>s(bbV-nCzmC^dUGuT-OX88E<*b_4Zn9>qEj`6_U-Jm
zTEZ`%>@XI;y1ueJu1G37UQVj-7qU@t>0{xXcuQ2$f_QA|du`_^zN(?cNi9I=ZE6;w
zHpr5qQq@z{xA=8a*m!SE(=1q8!X#$K8?_$*!&M`!RfHvG33u`!_YK5A66rIz3~avf
zNo3a2NAK6@8K13mcCFU4^$7!{bDlmAh>%Kv&U^W#%z1<b3Oc5-Ou>>(I7`R0>$sCZ
z%6D;HGNvK+<MdrL1Hc<Ev7IU!y(rEms;t0x;NwY`2@((+v%f^<ulC|<#x^~SCgFfN
z>u`~8+774F+@?JM1iUi5QP-&jC_;7Fn>}vFI0I-#U6LvX^#CeXTv8dYf?dg_0N!kE
zg+z^)p&Czn5#HXudj_~<^J+=oXknqKj<~J)376U8R)RS13#wNSv|W<JT*98mhlg^;
zc+(M=G~<_GY|>n$rFvNV^ex-WdeM~B$T!sWJm79B<OAw@i^o$~+2|<$h$#QuoUeHc
zgYOXS@cV<kQ<A9u&W1GSz73c8g}L44(-ZT?=zmVbhc(J-iPz_a8tS}E4YGh0kH6z;
z%*|#+<evrM5Od-hrg=^NgSVulhv5i0|MBHtp0rorJ>a*t^E^f(KN5`)Z-=_+_~XIY
zuRa65J(BuPHx>giS4>T@)2JzksVaD+U#V33`+C!nO*&M@v+xG~HE(f}TYz+_dHb30
zjJoPL5&1Cy;Yek}ELz<5qeD52ljkV<s8N)I&sqPz%&<n`T}Ab;?`Fk`*-E<D54aYJ
zl%~}pw<>tPMpz2!g;=Op0LV56>pU!?+mJntL{mEJR!;N}{J*;Kr$?V%Z!whwBeeai
zNTzDx%S|u&ugP+lr56qr)vQ@Ypsk(hJHRRW5;<mG2G1$M9XB8!oS*d9n>DsZPEm+g
zoW8+VdSxZ(j`zkV^0wj_gJWLy7Yf7)@mBGDU2M!3>S7lo)>eX&ys?jC0EU*WY$f^(
z>1>uUeqcdqU3asSoy6eVDf=HlunV@MfIc8Uf2T;2=2r|_0{;hYQ9yB&6a_|5k$BB2
zgE;|ztIJ8ahCw4y(uwPXojf;b!Ch)Ic|t!#;+3doQ2KJfx2)~qk_GjrD0o7e*ZbcD
z@{;Jonn_^xNg~F(yCH#2|KW7vQaUdtJ&cYmFin&JAT{3}1|F=I0x|J)2Ls-;{plI@
z<89o6|Kt1lKP|-n^`AS;606#d5UIw97o4JR&GxI+sm5nIJp2=~5;l@5+KRn&llWOW
zIM|wLtK@q)WHFvXTq?Pa8)0&LJ-<g7pT_i8U)X;8%Ie8p%a$;in@MW+sn3p_W`<6%
zZPoum5M{&k{q$aDxCZ~}{k2+u3iFb}&^LAKMi*zAG^R6V@wX>K2sWtmbgZ3GY)ScM
zyT0RuJNv7R9`TA`Bjm)s*@2t?W|0ICOnlLBkpioJ^4sUm=x&5YQ;f<eL*I<xVd~k+
zrC-+NV}{z8iO{;x)s#)4+i#4|J&V`liqYzxi*q12kFS0;u{79T>RzUxOb6;Z6?Y2_
zcs1p+yEn9<yH|dJ_>@uV!7V4^4guVzSezgn=#K9jGjBcMPAPitprI0U(=sx;pDHPK
z|F}6qZJd{j`VGk!9rt(fkZ>cOQD~5Jqd%@Dg7W^UiAdSh8MR#4Uikj*#c-7vvHDRW
zWZDWzJVP)>B3{pcfcCYoYV!f`!+H-GL+>;kf7bOEBJalvDl7TbwG7$Cy9iT=fzRbX
z%S)FJmdA|l5uv5@Zf>wKdI!p)D597@Uj8$xxj9Ol#BwptdQl(R(3~0|;`VHFtNyIJ
zV&o9pamC_14S*ITPo@gPwP5>(>#_hEREsQ5<?fR;>I1HSc>Ht)2Rrl}bDc{+FJySZ
z&*Qn-(0%1%g!&IO@v`gKf3h8U>c4yk8xZeS<OCx*but3{i%(D^wf&c1+KyG)R4wwV
zC+~Tk1Cip_?>R&=#BiF9?#{L%+nk~t*7-w2k2W@}a`Y>XrbYEWnkXW(j_aT7lp>~d
zw+p<GALAt(b&1<!J@}kW`3aIJ?@`le<m~~3ycbu#;o9rEeGbS>^!7~;!fc&{mhw6}
z`XAhLi6wH&!l;7u?tL3|lwu;<@Ps$TJlMd8-})1XFo4(6e}rNtRz@%G?H-?dUpFH{
z%9}^n{^JPIuQ|`&gp|xO=bTt`!c%?j4K}7k)`ard5!d>Af9UEJJ}FpAxaZL8F*4Vx
z;<kzGwY*7w!aktPi`glL<+m3k(RoOTW*N`8(aHX8$p5ds>A$(&x4l2EHBS9r;$fo_
z{I1(Gq8hv|;!bn94UoHxmlu6iRdZOtrzy9G1mhS&6dO(_qWob4&-4F@_dX-8ktUXV
zez9$FG`Gun-aR*=qt*0YPXklAsCC;SU_EIp>^a%r*E%dqR0YTJ`1JL!paq?|x3RGM
zQYlbL7Q=}Bh8tBgdE1_|GIl(_a@=sV))cx=Uyc&v#CT2mL;W`-;q<=Xo32s1o5e9q
zmiUhMx%jmS3Pm^53N=7plch0N4vE!hX`bL3Nvj?$bx)p|uIJ8EZKz6w5gc}S+{01p
z8Od+Hcqxmk;fqfVDf{QOj+^2%sF&2FY^fO@*C(#!OM)+-NcS=x5=P1XK}0xDZsAg<
z)CXS0Ob-te5X$~jxRZ$D>bo`I_2T=GG=#*u;tf@3jqoSOrvqVfG;)<nVvMFx0k`is
zG4B7vhx0GA^8dM643GGdEbUV-<ETYC#7E(27~UU=oBzo(|8F;c5Au2TzOtyORj|jv
zx-MJbEVa1L{b&v<DV~E?K#~3xqWKQ8#YHCZRE9wG*bLngZ(CN2(lWD)z0`wDDDegX
zTz2q^aYy4i6({AAZC1Nju_JxXa7~O>?3-9^%(-HmWe8XrL$9NtX&Y+r{H>hTl$+PU
zXVNw441t*3ie3G4u4~;vbOdH16N7Wy@n%?K9GftJ+6EG6%OZ$>B&-X@g~L-<7O8GU
z#@DE4?cdCD1OQMl-5_{_1y14{-a>YRPvYBX>6>y%3JQL0)U#b@pY%s?NToS1;E(W$
z6D8%2+3ulP6zZmBboAdJop>@AGz7h^=P~{!0l<G_hh!Vu@xm!Di!a~%N~oK2itb>)
zFDnrrd6O-!tqB_xfZy>AlvqPEG2zBAUgM^Z{s%|cAE$$K;^A_nj>)7SLk{bV#`_;j
zC;qCjUgP~AoPqz%YyayB9`@qJzD0{-m%Te${|TDm7aec*$Tpg3@dIS~r1*dOSL{_E
z69*XZdH$vLY#t9L^#_!3TN?DFopH(#RUeazbIAIyY<^>E1I~HMoSETE*Yj`I-!LlD
zBQli&BRdpmL_q&@Eo;8To=ZrHGh=h;eI>`TXA4Sg%CfQStNaZ~wZQztLwUzvYVbd~
znk_NiHgS|ulo4l2hJ-3TE3x-e;t8C1)!{Da-+yV0e0lWpsK#dTN2_OPE8mg8UyBPB
zPYey0KE**ulrX8k1{CYgc$@o%EG>%pwwklV0<$9SwMTcM`Xv62#JmRm|9(6Fo9yC?
z*ZM7^N+lcHQ%9S7qy+2Fgq}&g{l9UiFEQ(1-sYN;rKMJf+HWreoej;2O-^UNF)_Kr
zPcOGedq@2loA|?&6zYB`RG}iXv441&kAF+cpZLwuE$Ed)<_Zb#`qb0Rg4W-rs{XqG
zw=92it~|AC4)o-?_B`I<7sRTwr7AGq>_J^GJr%NXWK}F^|3x|1`@S4p5381ysJ<Tk
z@;~2Uz3}l#KvY~28Qa9L>Hm8$rp-9^uyPYy=ixy?Q4X5K0+26H$K(9la1YQS2cDYx
zSY0OzV#O*RtJKcAEcz!mKpq8~w!+2au}i!wo}sX{5qH{K>z0Gm4`?zvu(s{=4DatM
zqjCc{8;3ugY2f7C#OMy^O?A7?j;j_GK4Ubn1=s>JW0#1P9pt(Hb->ISD&ObJrZFYQ
z9V&)#0V!A02@g}~!iE!E2u5+0aYMiFL3bGF^<<Ez!FjcbacY_nLdG1SMzSwh)VTej
zH}MR7soDN{3V9)F+PaZ26U=nES7KjSEygb(5Sy_ytYxb;H)3eGREkn=RkB_V-fV1g
zm87AOU@2HX^EdJ&Vep1uACLA=<LIsnus&oO^%{+L04oN^JXCzeJ1%Wu19vb!7d5$J
zGU-b=I_o|4bZXzc@xV-Ni^GLyYPk((#+_}2xhrXV>HeBYFL*MFA-#SwUAWieUxN!@
zHM3+b*y5&d6K4r$=#0HTWqO8|%`)4)hAeEL`PIz!nb`u$Mo*9GWv@~M{#GB%92wOl
zsqm)lehQB{_*Oo++NSHCQb59LZe5`^RIRw}QJ*x1=xLT9F`!-ABk@cYMMmq2j>oYf
zUkVIDi4VJoaVH%edL&YIBLlHU7cFoVdLxUm17UvPj>;YH!(;C#f5del?iwSuMjHDY
zckR3xffWCP$5!4#_Vvuu2im{|t{S;7Q@rGx?H@Le-^in~18Qpn!i!_sg;J>fI--VG
zJzIuaRz0BYQcU4Wid->~{=c+r_QtBk`E^r`1!C?Ra!+PT!HOj>xQ>EaB$S*ZuH`-8
zs1=FyD-2JxzKI}b%=D_UIo~zq#|f#llhHUuu6G{l5ONeblVa>g($VVloAJD>ygAI6
zn_Je|Wcmd)Iu#+~|HQ9aT0$so`|p7Q-j+VknQiZ8()h;KPfD-xn*pa+6?%S3@aK~N
z!2`$P)H8o<f~{P5bM(K0n%b${HqU6-WaN1)M)9AFXJr3ENi08F%16}gwUpIFMGbeR
z1T^aBv(Jhq7$>LXUu@=&V*(Bj_r+WR)6Xt}!f}-<Fio>?o2_`5WnWdnV*MRUR3vAL
zH3K7{67`sqvrTUKS8Ri$Yvx5HMD9ea4n$0(3k=V(8SQJ}ll`^?J>dRy@EAdNNn)09
z6vNeP9MN(I<!yzkHbB5_gx)jdf7l$-M6BGOPU^dCk@@Ts3rbhDA7reN+^IffsUcl|
zBOShp(|)GCg%d0b!o;35wM>*Z@ATpJlDX}n_-0s)li2U{Z*QE*U8Z}<h%0rgQ{gy2
ze~g-UoXOOce!`NTI*B@|*~fU~-#o;kIyd(kw^MB^U#gGmFIqCpCH?6#Ij<@{EiO7U
zdon%>Hp!vn{6O)=1zW<R6%5yt86BoFWBxk-bE&#CUE(c9m&?_u12rWvJ^dE0j4u~I
z0681t>{o1ukZf4*Ap*BQMvYdHP9qnTXjducgA@lcWrHm@U>_wvL%ZOPsM4jNU@g6}
z0rx(O-3r$1&`<q?>|kMOM#l#4Cv}-q7pzLHL_alJecVUsfz4+AR3$5=l?sy1f4gi-
z^U9x-yxI{CMf!GAvMwD~W6Zo9oL{cFVUp3+GoW^ppNqXgm$?N2ZhwP|(MH)wEzbvI
z-LoHPtt@E!#){lDdfqf}8;35a?C&D0r4H+u4iXW4o`f@k;ead|;B#rW)*@K2l*f{c
z=`&urv)kyPea`Zdac`5JhQ7a600W#Xie541;6nX|xCiRDS>|BEhJ=q<zIe|b*%?s#
z;=LiTnDuK#ak0D!2Pr<jWNIrqeJo%l%YI{Os@B%l_LpzK!`~%I%;0{~@+bQRq`M$l
z7NBL}!H3^+FWOP|VIwiGcBq1G=GGB;*{?|3+gd<pE;AMr>TDgdturDaAeRUE0U)vm
z&D1b)&wC5Yegwxyv*5jIMx}VDtP<9oN*H6Wd3ykSrP3p`57LIIl)zug2nve$iUqcz
zBLfDMDB7NAIyNo5b8PayU(S<oxML+H(CPmZaO5FUxK(HMG;ySTT4h~x6ONrl&~|Pq
zQkcgLB;uynDU>9yCdB5uq)3z7M};M0bkm59OlXiEN?SC0=Rd<SbV~?{#MY|8;v{Zd
zhs=eVT=+~(N=ofg-x8hlwKp|RP=pRDizPXw&1qNasW)BrkXa^8M4sn>I6-eY+r|yj
zW<$-1Ip(C?ewc(2)=*dcN#1IBualmz^*k-bPr1meyh(w$O;BklBeEJMj^b%)yj~=o
ztKfm-&m9meXyE5FMJ#JO^ji7p8`}=a9m?~E*Ydx3sf0~3pGkjX=qI-8B_=`d&fpYg
zJyWkd^^NOsWl8p|)yEBdfuDghBe{_m!WE{2S<*f`D*cJRJ99bW?jB`2j7U5K2ds#{
zP}D@N&9^CTQapn6<ACs)q0_0OrKqX|qdf8F6JNt_+Nr9OM!pOThh>Z{xl3fv$K~cH
zQ6^cU!t;Mqg*1YPf4$yaFL&ZyEz*~YFf!lC1$B?I8P8fsWD6w6iI`q6wxpa*q+}8w
z&V^O6)f>+C>9R&lX0H!w_wP*+Y;US)#nHPg(c_2^%tA$X@(3!Tb6Uu{n<*-IO`@X3
zDt9~X-^wdkJv#)o9)mSL<f%KRw!R}v^J8`d)%J0|qk}3axoIw-jDBGx@`?b9b?3lG
z`(r|gMpUihQ+ck7%qw{2)`=Ht)W*LjlwIo45b<D~Ir#8#pNI?n=zdS(R)A@}ctxBr
zq=Pm}JSxbz;9hhAJ1Eb-9V)&-2Up*N6XAAAs9+C8u-1#)+tNUcN4vMi+=V!d9cQ+E
zJ!3j&xOG~84Xp#?27v^a&3DqTi$XSs#D-b^O(GrSuTrW#Mc%tDYB}tg%xc%iPo9Ox
z6>v}Gj|1iP*5e;dNTu>EYnTD4G@R<|$Hu2{i-K_^ijT2KmE?~#Hnp*<XNq;wk=DGR
zt(H2n37{0=%JqA`XPl}D1YQ;}mHpF7W=U%^A?iq%)(5`X*VXTIaLd()a;JZD^{pAn
zM!Gs~FZcw6mL=!VG;fU%xGu?8(Iro~cY1YhJKb3yGFxgJPDbvRO$(gHhnIF5Trh=L
zXfq9{j9tjilIS=_OtmTV{PcH0$3Es|-o0x5Lu8BmG5e}}4#=x?Sf7CQQ`UwIHON4y
zJ&&v*rxzz2y-x5<73MdUlG_DkC;ROFFdvedEanA1H;u<g^%4JbBb&e-hA3IO2IuEl
z5RC;Zy0@lG6|pm9t@8x`sXubX8NO}zdu)ipjhoJ%_Vsy|$$UN?iSh3K;+BOoX~K02
z1?KT*I21;9^vZo!5+(4x1@43NL~kTAloY@5R4Yqx#Stjx*9*ye@&&RNb-u0O$p`q|
zZ%m;c@iV@D>HtW%+!h}=rJQP9zUogr%<kMf{t;K{j?l$?XMA0Z*jLy4q0BLa>vwum
zDI$O&0SSFi%Ed!FfwHbw-_~EZULLQY2f7TLSahw;BWj%te_|OAt}D<x*kP5};}&d5
zyYsih=I0GgM`Qr*l{75Vam#0G-Z^D;mX&6F>lxzv=S<U=t=Da;eeVdp0ua=k8X>Mc
zTo1P|czW^8Xuo!*f57GfO$ZSIO$>@)eWvUa96w7X#4LgYYJIj)aE57m%o!8<?sxq?
zN#+h%e}Q;qL6yQm1MM{-ec%tgT6f}il~~dP^m;>0T5$H4E~~WGKq>^$*J4i1w5f;N
z<Plo$oXEY7#Xjd0$YfL8HFh1l_egu;O!U$h^9&tV)*th<y!*5mCgNL15&QNo{DBG|
z;PS(UwI3Rso_M&uH@Y@dU{nb>To{mfdEM9kYeVJi9oOB7obUI14M#5RWeXp0EW&f8
zA;$UWaUDm_l+T;iFwI&UHYv&XmTU3)BKNx5fnVw+Gs?Yra4B#kj;~a9zHu?yX&9f4
z2!J;Z$wmtvwczNUuPiaa`s(z{-~cmRtJ$P`&uk3etjn4*!3XAsA~-<7VC5DQf*y&h
zO=n=sJ~JuV=zHHY#FIk5bcL>UW*?2K{{r5@Rus!7Mtw8|GMtB5o5AT9h>E+3o(DSc
z@lcP21&E@HB@ON7HuY_u_m4njHQhh}wQJsquTde7)guB9=Bn<tFO=7Pe$iVa3IY%M
zg@XoJ<AVdv4z~d}G<far5-y?UI#4e!^U9S@DS38!5i0b<1TFm*<RbI&n<(V$;fzu{
zGEBM%XcLC^JEMZ3$ECqwGHk|^w%Oo;3C2p;o6C^dI6+gv80LjghZ&+}K6DAkje+x}
z_QBPKtFxW2%Dx@Y9L>I*y;K*pG>$pAAVq^Qlm^1Fpnhq!^5%Zp4MKQGJ#c!T&R(?h
zzjguK56J(kLVHd;Owi#`43{lN7{Nv{aY@j@4Qt#bfvYdLCPmm50dA8>An?f{r5NzH
zv{r{S|DJrMQrkieF;YdnF`l>8(z>d**#!$zy7A-YmiDU|P!=0FP6$14tQ|IjgIz@e
zX_VgW@GLA|kWS?rz?@65YiJj9(<{~z%N&<$d>#PSt`zmwNl~A3fV19zfb)TE@cvl6
z+x9r&^qHk|a$x`d{;9evZ6l=8!1b8<{E!taD8_5<7~p<O=s<6H)3O&wm!K7+?)Q_`
zzQEfgL{(ahOo*`8mv!eeJhEFyf4PoXI>3Ny4bXe)98pp{?HG!iPm7NoCZu$)cc(9W
z_G*zi4DsSg*j0+f8x!8fflgknaGN8ZzCJBe{*U}^o_mCj^K1Hp1N5SV;F}sUS|E$j
zdC}oaRL+L@1RoX@ePaDl?=P0xpprSz*Pz7oGXS>W<(^ux{Avho#uQt&Et`2c5vj2n
z?5(S%Qp&_YYO@q`ze@+6>WD=a7y7mC9v2uo43!eR)P<zG@<bhOK0Fz?rTacYJaHwa
zVzb}LS~`2SMrN{Z@}^KObxl_G(#QMz@ZysOkF`(6?BTrA<`=?Whu`$D78oqd=!2G`
ztVf-qY3lt(C!0T-4}GYu$kuW1JAU=OLKpkVcbLBAe8a<s?Q^Sc4)Wemo4;5H#pOQ8
znO!I$iYnyyh)H>I@)>go_5+18`sl+$jSDf)uTlwRXuSm^lpz(-Lv~3z)SVJg?cL_l
z`O!3N>rIGZ!<D$Y|3|EV{YmfHs6|(dfrn8Pv^t+@e`T<887^KekM^c;Ho1NrGFbPC
z$FvPmws3iVv3)wp5WghP@Q3I*P1|RAoQkj3w$1Mgwq_VVb{apvIK4)nrBDfX*C|G4
zK^12fU(pHjmi379=ykcS4B(*Yvs4|_H^d@xkRkfi!Sd3uuo9RC+rAduj`k`kiU7`R
z0ToRr-PEGg7ibSh6<)&_arNC{4mVD);BS3rVQgt!EnV?PaCu}K#D~AX+LYfVt^e{U
zlEq&9)6jV9mS0+y@HukvMoP6YIKUS4<FBi5P)k!Gg9l!LV`uvJ|9}xu4n?Fh&;M|~
z`324csqH!(wq*+eTw^VM-2NCGQ7^(>74N}AzicDn*mk=h*_S_cez-Hc71w~wwq>o?
z(M#y}qI&H`B+uY1DQmz-H@4gqrL}Q>y^HSB&X-MQyKFT!0t1<gG*n6ycOP+fcHo&l
z4>sfD0D=(cO5=FvbU(a4^EH#1Y<2<686qjdZ2;T~_Kln|f^y^I-kDil$B46*{c}^_
z9*{ER_n<<Rg0s|vX9GsgRo(X%k+a}2X)Zj)I!WFE&ED!;I+J<PT|Jqt!HCt^s_oU$
z6sQdJyM)fud(2k`hxhC7&RkC(RyZz}1~*`|G(Wmuw>wyhX3nphyXX#bD=3+gbE+3I
z3!>OlTpw;}&^*65I0f=t=rvwcz56XrJe57WNmnH~r!|-P;y9h11U;X|c6<w2QH12~
zNCwXFk37aaQ+iurgm=DYgvlpQbI(hSETGAnjbUf<?IUM55+r9ix|xiyn6Qwow7cy`
z1vIP25-N=>tm}>PaL7aFx<qW57uDMQ@Anewph?SJhOkVbCuxluI3|}@5GUhU*Y7s{
zs4Phd0#HueNp5QZ2+*nP=q^5Pbp54^pWuiNV0ry?s9_y2Lob8s$vU3~Rx|v%NMaA>
z>Z9LBSYEUgtZgws(}~#chiCbEygJ7*X%3DPn+`efYwMW}f2+P9pkNWQWf7W67{m~;
zKD}O<wKyN#|8ea=H85cFy<7JHej^LhKV7C_OBpHRi1^6Tm@TKbcH#8vqTb>%ZIt<h
zehSE3yn>OM(}#Ur0z<nbtea*5xu{pSR4Ahr_4p5SI8f$|HtpqDg#``&ZZkKgzLkr{
z98?Fg{<wwIWqm1qlmNGm>)~NfWLnV?aTLn0RlPmmtN?6QAjVsX-C%-iE}TBWwGn}&
zD`#;3CiP26I@oiZSuFJQd_wa6o0TG0z)K*kvUj^i#i{k%@!z7tOlnxJhRh*c;{(;P
z4e@C`{+!XKHK|DQaQ>taQdU3dHuhnTRi&Nn$En_0o<Dspxw;=Xf%&sif5~#V@5AZ$
z&^OAWwpUTHUXkklwWt=kN4no6EuJ4WU)i50Fo%T|iY9O`d??x4L8R_zEIrYT!fCB2
z%z;0eUm{so{q=#QUCJy)#o^b^S5Qfxwi{8v4zq)5`q@9_<O%fki@TtlnF5yG9U$-S
z4sCXrfaTDK5`rIHSs#{E7F@5+Q!e$w7sambQ}7tWis4bsc0}dakChi~mRXLykb-(K
z$<fXloH$HPn4RGpHpgNLC{tt3OJoNJ)i(m2!`aV04hK%lr30-ModHO7g?9Sq@fXW}
zFHo&zk2Y22Ap}Tgzo#Wa3|`9wQ7M>*s;%p{_XC=j$#gUHJ>gS5$wpG7cr}njcGA|1
zl_!r{9baBwe2Nd;EBSd*zd8GJLVc?da4p&38~@3a$68oo@`xh%2b)tcBNudI9Prh;
z`KM#XouJ2cww^4SDotu6IXtl#t`Gcjm3ECda11Fox8LR)_w4Fj;5L1!>1BFax5pLu
zxI-Gy+@B(yGrSDzR<F3ID~ZdkCM1@KDjR75$NDC7o_*)k1N^+DlHqjr(lxtK-sF(e
z$q=o{;4Elg401=04HCns9UQt}W1s8Jo@;E*RxK#GH#ySiEs2enwa>hB)KV)3F0RgY
z6;w!b4Jc%Zy3hpUm*ju1IFp*l>P6q&Ql;k%`A)=vb(zaQ6;?O98>ThmsJW+=_k&6N
zr~8~3o9L0nVx<Ku52R5OU4fR{+P3ot>Qt@AH#_&uKAZwZo9h5-2zedLJI=*>@+VPw
zBjx%m93#q(@m6IlUR8+~KyRrst`g})^!p@6N0Z8Xv~52Jdxx78A<^lFq}H_E#8?l~
zX^=rgRU<5xt?pK3y+$;0k@Hy7{+*t`R(_2AoT>Yo$2>xXFUOHp0ilhd?JY=~UM(7?
zkyd(PEVy*kPUG?!JegdPB84yeu=;oP$!+6zBud2r_Z$&xLktz-qV(x(3!}C;#((fX
zxZ2~f<x-c()?;QgljKd%Su*|EP6G=p@ys{eXZGIj_T3fZKKA#y((HF$G3-?1MfzvW
z2;J@u{R<gEh@qhmzI+NN*ySg>W<m33+&~bEj{g5?Of?v48IulvQa=~nR>}Rk5RJZB
zMjxilep>s!e#g!A+W#EeU+0efcuV>Z2?$jml#AhL*<y__exWQP;Pyq`{jr1$s=ncY
z06TRk%UOkd8xiOBBWpSiqxW0-)8WDzipvYnl*Gk~-uMTKZCjpu#<>oAE3Qj8h*z)P
zOs!=IV!xIt+5?pNoFSS5+s7qH(_fGkkd^264^iw=YJ%~Jx4k}cs^KSm+o%;eXBf4(
zD)HhE(Q-=VU064SfdL<xk?|IYE*u3`4^y-dN`8ic&J`b8C_QMx@A4C&K7f#&hcV-G
zM8a#?h(0(63EhN<He84g5Y?Ea^O41WzV9vhIUI7bnb6n&O}LKsoJA9V3$*B{83QS0
z5j3r66<DrwgUsRxJEEI7a7t!YyKVf!K{_F~amuJn>rrahrbq8{MH;F9suuDc<SU`{
zW^xB^<vBj_lJGtQKG=R6=H{vq|1u*XHxE*J1V8z7%Gb+_HWJfdtApxA4T8Ryiz+l0
zik7vZ?z3GDtSq-lOC50v5oU=INYipDIrG0vOOnCuty!^{xV4zu+<WqB%ZR0&+xJt%
zWs0)~WOdmnvWItmz#jG}kIkh8V(d96qiOtb1k6WoH>#Zq2lu6EV9zRh1)NU#jdcqT
zxu?&*A#DK%R`uq%54H{)sTjft@@MX=ZgMIO%yTZ#I*WWr3lTMCU{E@}qePS@(p`O=
zJ0JQ51iMVeJf<a{7T#_zJB8nbG}N;lIZ0MHW+7Dl5$o)Ki{q0U9Eq{=SpMJazmN8u
z;19y<iT+y|uQWqv5_*yF?jWDv^bO@o+n$7fVWy`rWBWc){Yq$keg2EBbI)uW@!6h=
znQ?ef=)5mi(|8+6ZFb+23amfYBp!(Qz=c+A)34j(B;S2n)UFSCTyy(dlH7-S+IcQ0
z8&~~6F!QXj_(N-u@T{Rk30xuG)8brZ6g<@)7y8p0#_H&&&sA+u;fi4z5b)UgP|Cb<
z**o(te9B|MB!L07_Cht?SDe+DwOA6;lAVc!a1IG&w42~RQ_3{phLVo7nQ7kvR}#@z
zo}ebq+Pfc$$NPcV`G+axS$#8rS)Njj+GH8i^AYNMbi@$@-}b;Mi`vhPtP`TWA)j(p
zA%?h7DTQeYFUX_3YnRrQLK_zsHfz3K@8JyM599K{bRu*!v!Q6j8+$1>mGQ9focXqc
zjY?QynMdzCZ>mx0k6gEXm2|vPM6rpT-_qpPCli=+xgp)vP~~;LID;FQwvw9)3x~Q_
z<Jke*bEAr3&pK0&ZTW=I7Ap=|8x2-d>BJD>Z?oT>Li}ORnqP>3(vt|(^yEx$;eo=;
zTdf&pYgvWH$cm~_<+*{AC;nVrf2J&XB2?Sli;!!P#IP%Gr{Gr}Hy_;%PbBRzZL{zf
zdX6<tMl;&zu;79zX%8cLF6c;_OUdHf&T(MaU8R=P9MX!AHK{rE@~pJ@!tFi~B0m41
zQ7iumB?D#s%es_>rOiZ(^=MK)zuCuR-9^W1r0C2?r!Wu?SD#tw;eAPY)+OTL6)5&S
zIM~6lhkpX2cJp0lot|t;v_4CzjyT7p9UGRyj!RO&`mg9KFRLX_C(t;!yvYn8jSgvf
zv-}7SX=DA{f8^dKI8^KqKu6$^a{ETJG0<ONL*r%n-hRv$!4en;m!o=+al$yHeE1pf
zt^*toSBCy}2mS_<NlaAi=%1G)qR7z&0cb_CG+ZHCBuecEcNv9)M-MMl;+YgnT(=yl
zu3F*WGPqGvwH;506yJGpem!cO+tFWlBw#UJe8m&OuYF{z`L%Ib+f?kDev2Ee?=RlO
z<<beK4Q)IOM)(_z`6}^V2b?B&rXGO>z=VuXuN;Y&(cqa%Pn*0i2LFx$P`q<4o<F;f
z7`QA!27Fa>IjX7eh<h&!I(ayRDQ~4)*shR@(sh}KvMU53vh>DdwG#OgqUDtAg4sEs
z@jZ1(?=@Eq57<w--yt+F6^X+5CnoByAt~KVP?aMuM`uV(kXh6Q3lbeN9v9lYB+YAg
z=V#o<rslJ}y_r;~Z8p8GS8I+O%R&j-caXKEX0D4n44fgi&Y_=jcFfYcd!>)&gM2gY
z$=^Bc=v>k^tvc-b$#Ab+#f37MWwRoLBw5_7uJr(8DXQmEcbNNq!y=w6nW<l9=NHe@
z8j_E9Xl3Wv6D3n4G{p@2d(1HJI>uBX0t;vH;7R}Ngi=-OACUXlu&X$pn)%338(T1Y
zj%4Fh<(S1I$(6+stw(1EHnRc0mMKPSL*Hwrb9#^!yy&TU);5MXi0)IB5!e<WGSdqP
z!;hS4G~%<LthOd9zglp3iCLh0u5vPd>3dm-yc1syK<hz)ux<u)i!&#0BP;=-cGH3~
z#m3n&*kdkyEar#@#c{mNTC>cI@$&T()z1Vw-au1k`tBgN(3_FVCtSeaJhqgT2Z8%M
z<+Oi*)Gw!uk}$k&LCNg|x3qulMjZ&gXpH$IU}sHfjH9`H6WhOw3w-V$(Y*WD3|T=l
zr$+=?D(jw8r!+b<lh5@bF@A`hawGM<t51j2=?NP}fj9I!M)5B9%?)^M?OQ^gN6o_z
zQ}?YGD&ETN*)XCec^rMTx!A4}%<Pd@q-g{3#oxqAk<?1uVs?Ezo&#lZ0R=@ECEr{)
zX(_-ex>_)enF}i9P~FFF$1G|wRdIC({KCM}Y38m{RHHT|j)&|CXL@mWUvtSf^M_i7
zQ=Vw&00P{!;&TB@XK&W~qPWo+OSY+54T5DGc5S7rn&82gP5t+auYH-6ph?}N2%VHt
zRHR((+bK;LA0%^;IhyLQsH$o|bXJK%tIa#^$4?d`H#Pd=UK};D#zS%-Q*hGx1xq1k
zX){u@1;&gnoGI-7ertQ1@n%!~p!}zqW9#6%82;@Q<!r5Etx%K{DXn6LA|x&lb{4%<
z<}wRbkI?couPHhl@Lk#Not=t{rn9t>{LGPb7qvh64Kc(_{U|*|*F&+`c|kD>nF2$`
zgFm^aRMVwuFX>S5*CQiC3$9v@WLiAx*u}WBI1wLaH5>tDc3}eaHVdyGy7+ceySU!8
z?N6XiLzAXqo@TeRCkB`Ge;g#mX=dMO5D_!<v0Bj>FAD|SrnKxRPT8ULX%7#z!?FU)
z%Ze$*E^zOWGbkDn;8U1usGA@28tdyc<n6!S<%`?tD(R+wtVM9jhS`ws#ZM!|4F+@}
z)@0Wgr9>twobK4V)CiY*G>kAZc)ehNghIPE%;7J68!Ua3{}ONfdteAZ;=@$0rA#k1
z|9y7^YlIqM_AK)v2gi_?!uykh8%ui~-xgF8(0xGmN43a%-`hAc#E!|VN}8?KD4Tkw
zf~+i_GK!K>QRjz+&DO5lu7K-~w3UAquCCC6nWT!?FqZ#6q`e1JliRv3tfFEC0Tq-I
zC3FxFq)16nnn;r-(v^-hDWN7oMWlli=~bF^>79u5UM2JzYA6zFLIVGXYp=8S-D~Z0
z&i(J0V=xGVB;S1JoNs@g$vDyYV>C+wd{KCtb)~rxnp7NuEQGL!*jx6psTCAeP;2;K
z-aDK_A8*G2j!v0uLiUxk>D=C;RRE+j&`aKXSItHj!zDafM5O(~k|A(r*J+^MCU=ob
zIQw4l&Gwr*ITOze9V1koCBXof*;L<Cg(D9pioL@xH{ui0Z)Z)8sS1Btv!ZXD4QFt{
zx(29~nMmFg*Yix>zY&AjH@(vBx+YJkpR?1m<r<-MI+8SFmb8OG=56V-A|gyt4?B5-
zw{%Rro^hJRR%)3vdWXKmUMy;z$o)2>J>Ba5+`X?rf|XhI;srX$if?h^7Z&ps*^m~k
zo-Z38zub*}^%9xarCj5cS^V?VsJX+&^wog5&xqrrv(LrGMdIc~4qtISv@*Q3PA%@T
z_;N>if2PI$CU7SzItkjIGgExAa%)vRA>y4Zz9J}BuOH2?gwImNKPe}0U!J2kn8sGD
z@D&jo6SAb-4eoL6d4*7xqu!xiNA&c#<l5^2?{O=wP;Y(*)v9oNXnP)8Q6-tSQP?$o
zlpk}5y?0YByXhM%#b(UjGTsLb-K@*6piK6v;MiE+aw84y%|c6R%^d1D;r;;Cz}WQ-
zp3pg4qX{siiT$YhgM%;7$Y2@lb<(&}f$?O<QMhLb0nMN%7Yt*pnebCN;Dd^^DMeJ)
z^x&p=&*qBP4wPVo-i5Z1LUioIT-$3flf$@z+>z@O8YO}TAc+H3=H06RC_&xs>0)YR
zT%@ta^9rRal{4^HPF4mG8DRv)t9fwXuj-7B2%m83jQ6JY)@J*vwlFRK0GhqJGio1n
zcmnuyCSP=LP8}L^W8D_~_j)~fYmcvXaqm;#z8R>lX0lFN!5ht;6DhKy;8i;#d2yEd
z$1qM7=#!OuIhVj1!#@({7LWt<&fd8EZT9lgXwAatJ6s-qViw5j77D+hG!0GoxF8Z-
z+L;#a33LUbX_^ynI3<@{&&m71EYI2g8vWIRo!(t^4Y)OX#5vfeLRjJI*f(!gBlq8B
zuQ?3`k%$c9pmyihQ2giT$1Q&0{X?&wK9=XzlKeb^u}Py{^L==X_7fXQzbhx1TR-xa
z1!0@>O!@Fe{L3K9mOc1}r>fU`pZ&t33K7A`*gNCnwp5;FV>^@N6n5?m+`?n+4;sCI
zvKpy8yvMPnzsu<$u!4WHNI7Tz`*;8F7#E@9s|;aOE#>UAFG+U0Qc)Z*NmEW(_P%?7
z%y%Kzi@e^XN;u)TgMpYONd8o-v!T0ba7wPPz+y~NPN}g&kKu4@SHAj{A^rAwHAuBd
zvywhb!2}(XAxe@pqa|s-j_-VZYMuS7*$(Bss83v}n~xNhw`XbQCBp!^mi>z_zCA@P
zMfEnlRq{fG+Icc{8jiAxyz9*BZRpm%V4+aMhJ1v2w$NT0Iy^IQ-HvC!S7hrB(~d~d
z>4<5QU-vp!*mr0M7yp;dc4AOUKVywL4&mmGYY|@CQC?>QjxwBT54Qxa>Kzk-RuMQX
z@AjmCV3<)KS!|Apg6M6QdwH4FH+R1bJ15yZissYnm$e9JUO8?@8PEQh9>2&U&2F-=
z)_*_pC8QA?ZfdfSg)w~R6RIK`Mg+%K8ALy2`Nb{l^Q)Sr%trIG=9v!fq+*p?_nd>5
zWQHT7<RZsAudgczczaF#aI@%6dr{G-a^V(oo`GoNd>=AhPUYzl{6h#FNa~I6;NyB^
zj90qS<!?q_v~<`e%;(PR*>s%;WfqAd0hj~F;(IkYZuVCJ02I5fX(;jT^R9zT%41aR
z&IROQ!Q^JR0^s1#@RoL(*wV7mSj^IZ-P@ZRpLyWkRBQ>{h>yJ8R~m*`+cO2&U4|mU
z(@oifO=q*hgSNfeW#XO+&u{4aVfk=tOKqNoFGn|_-||XjA_F`07nqNUq4f*Mi38Z^
z(X)M{I@Rz`!dRB{mh15VkxqU>$kE4SWYMlpo?EvXl~cI;+7>-fx4he-#T>rRh@f}n
zDWPe*V;l8ZRbC;}3yC!qZ%g<<Orr)^f<i*`!^Zs;wReTqmM|(?@nz-HZO?sOc~AzC
z)oYG4y|W@ytS-89qux&^s`S`5p46BrzR`llS15VmI3<PP{_IPUHQU0w^}hU>$&%B&
zQ?R=-j<`=|GbqF^!mT;U=1MZxkwE!~2();drMOrEzNer*(b3Iyp9dt!R1E@e2XE<a
z-&zuLyd?j+Ce15#owC47WUUqKlvM8CsQg%PUAfMpzP7b@d{d(06xL<TKQj9GfS1@<
zah2G^*huh<Hi<8>of9%HL_genJ-3AS5vj+F$)7rI`9;;J91|LhcOoV3M)-k%<o*rc
z)@2KY9YJr`;7S!H7N94(4Z2ZXHaV>Py9KO(L<+&4+TZ3!KdRpZwaH`B%9p?`2*NE=
z-a0ABA;}?W+G+bRzlYjhToKw9h>^uHyBC?k0dqJS=!UOw|16k}dQcWl6NHrmnr;ir
z7JNe)qzy!kZEv7+qdAIMW<_CKm~tK6oMJwPYp`*GZcoDz2%$~wmXOZyna4So<+3cA
zR_lwS8mr^=Ahzk6v-652YBlzP9mu+$9*WQIHb)Q5u?fkbrgL~m0St)CPSFo9Jq&+w
ze~&!k&BFAR$4OtiKB#KVL67%!ZN}F*6_gWESEOAOr;W;K0?r4;23gI^e@VY{`6oH_
zM|BqZRYe5xl){Ma?sjgTSLx*tBNVj5?y={uC$SM-tduu`68!XzmpFEUhi2xXwvCtR
zrz?IM%Uv{teR=($cd9_SOk_rU@Xa=?(eyeMycX{+ah#dYoF3`47~t4*>Q=;V{kN=+
z^axa`vBt-+9Sp10llhK<c{WLZ-A}0_>5(5=h|6qB1j5VDJ|C`zLVaC_hV54ASh!?d
z122UUt6YKT!nWu}{3SW1CPptWp`HkqMDTGLRp;=?_;5DYXtZ+6oL*tL?ata!{C4Q0
z`8U&fx$nrtx3c&SXR3>e@7=uu%Xn)X@euM;_^I4%c|7}E_;$&+eUevWPV`iTUGA}^
zrv~Qh^>}@sBA^zwKIOk09TEBi{#g@jMj1eeVKUjIs@w&c>DATih&t6$gNUu?Z4P=H
zD~YX6EIM-G@E!Vut&#Ok<t4&4T9(u?`kErVb|>N?0GfROnr#Hl#^PX6aZ#_0zwe^H
z*E-Nv?k#YFM)~L@cW){&NuJdyJ1j!(4!X5=T#FPa>Rd36etPlgsCN}9F=OPx&@4IU
z^hsq$JV%#n%W|MAmQFA)v<vG1CuCI=?UhxW&NweDJ(S?=Sz|W-$O0?(GorH)bx}k9
zs$3=E+7WRP^=iIG>!6+J`|IBQSG!0-PJo0=<kj9j?|0f0tS>@tc2!YxAnpM*<|pB4
zZE+>T__^&)cBRH9pwLmlPZ<WJSJtPG&c(ZoxR?dQ%7e64;}4ei86x)?KJN#8-v6*4
zATa(^FIIWivn$l%)xd=n)5=SFNuIa$C`BbwY+r=B7XIq*$j`aN15xL)SbftGVGFuM
zfqgR`oqGqedOB(xo^=ZQ63#QF<@AN3M=>ilI;8w^{q!&L&WAx*m6?hJkO@Q-DtrcG
zkE_UIH!e{8>_fNLP-)-r2z7Df+<d?+dpYcY`0?NxC|ceMBz#6rKh+E1%{jrnXoHOM
zy^)>0moFj>?-T~MT6#H5wAMYR_}MT$k0T|3&`c&H?7tIL_49Obt?lESv=vvHGu>{5
z6ObAfw`$4`{P*>-9gVXdUjaaFab!e<kD;Vq^hCO5%IYd}6d~g2>yFjo{97cb3CAjC
zevuV`+N)Xl3mt*SCC;UVTia7DBn7f+n+Nh0wFAsIyVgZkE5<fz3Jg)kgJ*X>ef$~S
zS2PCI_Pl`AhP<;CTahNurCYKmT2h$958>{|!aT&XlAl^ZOKW<K{PxXP^j~reHo;NO
zJTW@DTMa1V6<xjtHo}eOFGEhz9J{777$XtmStmp4XFDa|D|PlwaNpqe#E-aepMK`i
z0F`-~&$Z4)XefB4L(!x7(4H-;Y1JFS2ZHK|g0y$Ew(st~hWvPcP8ZRJWER)PJ#jXU
z>3{Z)!|7hw2dYEbJ4SONu9jNh`MY?hj=Dexm{r{?qvn`8X9~@N5FgZih?nxQR>Nnn
zP*x~`ehHC-dSzo&_g#y*IO+LC-jht~D7v5VMWu6MS~|wQvko_!mgI^MUf&iq^u(yy
z*mkj*1(vY}vfZ8j22#bhAxwgxrKpwtr?+EfRp-qE9fw(;KJ4TS)qF_`H!_J=84KwD
zQZ_k_dq}s)A<yYKwKdo1Hl=nsP$$Fm%=0dgJ-4J5@~t?N4rspU1biId2jw2~!UnD1
zHPLjoSLUSgT#g3MQ^C2X?J<&q7|HJi+MwulD%j(c@t`gF`^ddt3`FJLkptk)lji%`
zd$R|j#p05xV_uWig<g-4MTI&WtqnU+8tq^W>rR+>gOl~R86psEwXc$pi6|>HI%&zr
znNa|3!}EHf=iEizl&9|4e-dene`MH)2GAX3_`5LtqeF*ZN<dj{uuubCxPsa-BJhz!
z=+N=iY$yLpj|p~@=&w3x(6Skbtxd$k*))CAKDXw3rS}312%$-n@pbnSp9bYfB3jg6
zt6%-R$47mGqkq~#Ae%<4v;0MGTlou6?)g01I+h|fL(=V04@Gv=l}MTJDs8YaSNe-~
zl`o&>hNJW6lXO17K>pPM5-80iZ3S_|Dk9^&$0oV`OH!xan?8jcwSdR3@F=ljMY)$9
zS0nCw_;u8W)8`<&nQUI{+m8^!(ypX2IftAEv%e%zwx%Vs3|97HJuW6mA5OQfW)0Vn
z`fV*JZ~NR5QMrB&WHoV1e)$(g?XP&)foKeTz>_W$;0fvX4o2qg$G1y9A_5IwJ~qd$
z&zQJl@A#WWoYf1~PNzmC8ik-P$dMJq`&4;}k1!^y7G<YjKX=2IqyVXEe3Prrw94ML
zx`$yPJZ{08?ufQ3C3`E7QJQ41T+SvY-51<!9qO!g`0Bw8(zCZ0$!ws4rQO=Ln5A!~
zvI$$iAfn^{D5KJLW&M*r<6+(6K|z9F|ET!4S2fTuvx5&S2kq%p{Vq;xG<h#-TeOsl
zsXd-|HL!+XGwF5;{;ENOS{K18>PX4s_teC01J^byF|pg`SOjmiR)k)Iz+s7B?bdN|
z4oA0->NsNnRuYa+wlv*@BxbeyY^ta;Ub;2y%efNVd;Ig|R_{YcLSFgaZA|8A&b)i%
z=*Rq1yfCl1dcEf+LM}8iUo~EgiOlr%`}wiMp7RpB1LFmtmDgl4J~jl(!aaOz!@ls#
z=D;sUrVOKGt#cbSY^g>s69|&2X`bJ<K6^Fnan#DLC=pF{zpHB2$xJ!z)OEY9?(32E
zxJg`<HazA^@gD+*Ud+!}up0&R(k)b@p5!2&fT)YX5cve+-ct!bc_k!sa?_&i++%&?
zW+&h#jQ1`LFpmGx?f+yf@sdNheL`WWE~wNENPuCL3d-+MDmZE^M6&};;dZgH%Tto%
zRaIQUSu68vqx?My+0qDU@6Xq?^e5;iot&r{Tn~d(aRs_RlgA>oz7_<hq<j<4QB49+
zgdR`Sl_uQtFQ=}$U2w-2-!KRs!s>ls3a_Q!$D8kMV)~zc@W6lz%WsDn%5tp6GP=T3
zbNC#T!b672^>idXW@{g3)DDVCQ0Loo2`g87UM%3ens(9|O0)L3Oow9yEl*&~uT2|=
zx|g0wb-Hx{ecC6Zxy|)+!H=(E9t`fJp3v0V8x7jNq2Mn>-Yi<ezU`=+w9seKTN@z>
zZMQJHVR+$4U+3cqe9(ty4oZu9yL^RwI4z22-#7F30H^kwyv$g4i#uZ5*6fR1%Vs$!
zfv>1Az(h+RRHtn@YEt6xwWv4vhS2gT_vI`z_|~tB>s#d^^Z)^$noUQbEh<$*)RFna
zk12Oi9RuGV^@x0#{Fws;`cfgE^(S;L?c*#Jg=6{#?O#yl-W-BXoyUAFT;7WFZDAq8
zN1KC%l;g6VYq1Ft;Cmk}K_}$3>b^1<#<#vy;;|dH|8@PWH&K(_#q|uV2adUs#J7Db
zt1gp3%b}WsIJ@qHRy(3I<9mm<OvYIzStjqFUynmOxTi|5z29!YKT*-Yo6KTA$>=l*
zbb1x3Fav&?QP3fPDO2BB;>O9%*FJ*#QKEgaYbgF?#k62J8LE?_Q~E%k>mP7bdtQ6z
zf+d4yw$50X-6!I_<1gB+@{-o7Y0Wy8Xtcun0qxctgP$2n3U4~vH$K{^Ij9GI%FDAG
zrU!?4U<23Qh%)yMr#+&M8%iBY(o~PAAtk`Hk7(>Ccq*u#n85db*V@NB<hdT27qhf-
zcs^<4vjj0(g6<M$!(`p+er)`}97erNQ2!b3)ih7+N3Nh;UX;|PWe_I^JjxXX3aFvc
zq3xYPib0(xL&2}pmeJ@|1zkl#uUgRfpM&#Sg<cKsi4S5i0dV)pPGQf~qIIWC5%j13
z3335aGXVbX7)H{*9)G(>Cs0^>OWMM4r9=XIm|?H6KVC>2TDhi@AnNm^F7aDBN&F84
z5$&D~63Ju6Flmnn5wVME?Rkl=Ty}arYr!SFvfgDpj(8o?+bN}-eB_(6XVM8YQDJF|
zZPUcgw?7X(vBPY<VvUBOddV7{kU@u|WuxMoRxT6kmWLVBeRdlCcH(392S?8OB68az
z_%LEj2=Pfxra@MkfgrCS@Alytq|uLqo8t9U(Ib`oc7Kddp!U#}gDOAZLR1y`n#JmT
z?!0mRW;Rk_t)>L`xh##W-jo7fo*bnmeOC62uE^NfcL@nLJFBdEFf-4myxF2XFK)Rr
z__CBXwQ1V$@_HWA=@n&Ht^dMfy5yNf>$fq87ZrMD58A`TueeHxlF_ygzia>ID>K!*
ze_{BYk;_)xo;)hW=>HNp*hbcl0nSnmZFA;}*rkRb<r4^z!1Rla-W?XE?6<82e<Xu`
z@an`kqe+$KZ(ObQ8kdb&-ay1V;d1pO0ac;44I%~cAy!_Vw>%yMwze5{&m-o3mTfU_
z!fsAs$6TH;%@IYGwl4uCpvRt8_$9iNu9)rU_)>BJc-EltIvv^v8t4aEqD!&PrPfF$
z%+ezylMR095kb}Ckn*=r3V}{%2=`|B7;6X!*2O#=krgBdzxvQ?1{Ti>3`y<~r|ve}
z@F)BK34fK!nmsN353C-BntU!r;LwV^lx*xY>3?Pq_*-lsV*{C{jd3Qc;JsL@Q7eIa
z*)cNB{9G1l4}<<kHiEzTya$wY0m|V(cL9W}vFE6<rd+T<qHo8EP+uRS9l8)a{}k@0
zYJ!vpAntvTxmH$!{5Zk4=Ea*~@}R@jXu2taAC}3Cj*01n1E18m{oCcbfe&*?c8L#g
z>Fg!5J#>Eypofs4ROl}^Y^^hXqVYEtGZ~5Ot~?ou^$s;<N8SGbXcoG&e1`VQ02s}q
zaF|~xHyCY-#*7x+IChU3ztGh98Hhc6POXE5H&1T;+X)SsCkIfpoWmZUYLyJx_*@zI
zPCP=}KS7%PM3pJl&2rYw0RW7_Xa#7<KgJ`bm-@!~t8JAsht_(BmkBlXY#X+L;#;is
zmrk$S14IRBI(x4;gdO;##HE8puaR#A=ls7dnpikFkcNLBYg`*b>b!bl+(}=2fC^TM
zK~t~9pWVFwD?W*TS;3TB5-&N0{T~FLi<{Epn<|THf4%xJ>T<#tHyTR$IcebLz8y-O
zw6TLPe6$GOUa2ZBv_HjW-w$A0dvHluII^ecCdY~e&~=7!$H57BA*d>BZHaSEl_<Ww
z@Aapsf;56O{vB+)@;x_vWGDrfVk*3Fyk|6QHi4B%F40q{HGoWuZZ!EGaGYKC^542n
z@;Q3!rNCtL$+b<~KaUc~cN^gBaBk5@GG41syo`UVY&4IOAv@?3z~i*iOAc(iha?FS
zNk8<{k&0Iq%G!Rp8Vmo2T>37gbAVn1C^J^kCUsm`Jgj18|9?V{zm<52laf2ZylQ?-
z>gk#r?HOUAXnKcyWcV*K{=Yn;eXo8miD|gmhoidP+AI79cI;5uY5N?e&U1!pnZ*t)
zNU;)?@f#<U0mmn}9xa9q_|`iIlvB^;dA2_XfM*=O8gy8iTmFr^K(Eqnw%P}Kvp`SG
z0{&`ZGhzEjW&1yd0@5z9*X&>Z(`pkI$Rg}-93j?}b#H+U`y~um8S5NI;P71QZCVQf
zG^E;vKBHwmm!>b!(k$q2M5TDV)7aqV4*l=?MDpJG0<!Ty$}y~@hdCaCV{ljTBy$ge
zOF`~{N}-_tf?$&52q2(WJqzGBoY|Z6-t!1e(y0%XkWU(%l1fsfK3OQ;N9=AC=I5~h
zY(vLx6Q%%f61%!UWlKv?0(_J8MvcXOWNI(KxhZe4LpjE}UMx7q>K=jZd4amn?~>Y!
z;lt75bMaUe!d22o<RBdNYGStf1C|=Eeff}m+_8B5uA900QV?H4bk9S+F)vYQ0;r&~
zl6Me(O(Ft-OWm6#AG^Aq$?B4Z_uZ2|T(LZC2Y{5u5gjoRRlgEp6gpq_cb&FYizHmk
zGh1Yn{gZ>=wt(H(PH_6yN-ranf9t#OO%MR^zd_={BbzImVGemlJXSS*7C1h91^6J^
zMZN}mp$5EppI3nQ_1;3Y#`dFMc~qCC&}hK_Ibl-S`sMFxgtl<+e8Y+ivJSG2lcYmG
z0G;i<ojQX+bUWe-A4`o(|C&%gw6u~WA&38X)9>T+-X*or3Zzg(saV7r^NRKa_vsev
z0XNM1`HYttsFv@|kbb=XjpKJldZi=}sIFusPODZ?gyvs+bj0ixhKlPo+5ylaq)a@r
zQM5~xK{4AO{uH8o4w8{LprX;Ba?9dmuqyJV__bN%Ton)EU8HNQ{3rP-1Swq0MS1*{
z0pe(iEi1*M_G(LvSpQPoYhQrLph@t4O&WmlzJ6whmY|qtBoPK0ivs;7tVlG!)pGZL
z$ro}8U=@*q^i6%L$DaAk+m>{MERc`MJhI~yW{q=*UUuptUbjwFkBB)fcuQQ54SWbz
zi$}e=0}V^2S+u~3&eP4G2L>B@m#9AoyRQEy!TX<R@%9sT9x3$fX@WQ@@n{N0OibR#
zyC<LgfHKY@e;;~N-bra=_cS!2Av4LueO{CrG&jhAI+>g$pBN#1laFoZf_Oa2br=Z~
zP8b2<9=Pk4oO6!@p8JUzq%TQHJd-i2m~jwkg(@}bUeu2cqrAODX3N=>?U3L{x%EoF
z-=?ARF>q+o1wfXnnT&%W8lxdrD1$NNz2;0A!BT2ONNjQ!(R49O<{TH<#VVJ?AlIIX
zJT}p3<MS)c$EDU|LZmnco=Lahd4)pJX1vk{T;Lx7`3UWZ&Rl>f&t-8_{?8fT%A(5>
zb4vJvU_(Rx{M+C=ZPp@%>+wT(A(LO#BY4pkx$1(eTkZf1J~}3`ADHK*(*RMLPwaf$
zRq-CsvhR*G;Z^Hl>c(kO*wGWOp{YIx2eth>2BiD{0F{qk=tJIOzr`*@f5LW3Jx?|l
zNvASa;zzq>oX|h@T~zvHy3C+HJFALp%L*}EA0QlKRFts>zqF!--Kx_GfGZxL=-8^K
z>tMT0i(soi3Nj52gwTNIOpd-tjr%|bA(o(0${P#oZZr}VLr`5^RaElsO7u=A=8%;X
zh<%ML@H=Y$ymuL4PPEb?-nF~e80;bs7=8fzl8ouqBu+@zWK3p$nRJ|NhS8!8^j+^G
z%XpAf00l}*Wg{>KiyYX&>U;sp=77qF4_XxU$1H69gQcU1uiT&?_<ler<fJrK2Y+IJ
zIq?xH-DrSMs8c5S_Z>a*rAEu*JE226ls$T{d+13$a&Pw(56$$4ZLa+W<rw41{~!T)
z;NACoD(hGKEr5>$-ynGdtRBj;H9xN?9j*`TS#t_Eck%~C7u~Auwe~V+2WowbeEOD@
zfYa)o7tXM7hamkLPqw7|y#4<5n^vvaW~~W)J+$-uz|b+?3KC`gNHc%wkAV+|$5JHI
zShbeUJAX4d(Sh^TL0Ey7lBT&^4o|PJ0~F@~$$1Z>Hp@RY!@7offGgu>{m&<YW3$`;
zcBlgxi<T+ZSN;LaUrgBB5&sue|NSqj9{k&OuLHLG1j!GSaa2$MSp7Kd*vfuJtg`MP
zrEV(CB5D)d8@5y`@@Xl&i5%b&Ni1qFN#VY9wdtK`AH_2H|3G%}-w<tyeI%D?X5+I6
z@}fG;EOplJ6xE$GGH)+j`@eW0cKvj+vBsOtHW@(*fd4elvCL{}w8UcJm`aA3YN&Jf
zVO8ub%lYbY&Gxdg{3Ivys(VthaH31<)`>$LDHVUhiUrVGEqClu?T{msfe6Xj43$C}
zJhD307g=$mlgJW-o^4Gl)IjL3dCk=(-i?^b*JCR#76^-vuq7E8Bx^Kfy}ObSv5TM_
z4<!X^&&5AFOgj$qI#ZjAFD@gdj9*OB8|TGFRGhR!akg<2;(jyGI5R*kp;wZCv!O^Z
zYsIsY3h_rvoWd)nckoHN^?Q!>`Q^N8$1i~0ja?ectgWv<ou%q~O-#dr({rUl$HEAO
zVBI^{xxNx~`sx<V*^^TztG7k*2b=mjBLF@=M`9l1+hGJYulG@E-Ccsx@e}3anc9rS
zS}RJM1)`bh8TYEH<<S!HYO|b{q2u62bUm|F6#eqqdiy(&QcB=`jZ!HZzt{ne8yQ1^
z+Hi*&jbGtOR5%*EKQX<oL5#f_`Uiauj`XzR$?<ExV;raOIYA-u#@$;A<~b0p!1JuV
z>Fx0rhn-q;QVb8YaZ1QLC!6gr%xmw2XWl8PUFPIi_TPA@^S-b)h3ed`C>qe1@3s4+
z4-$`((m{V0w7yHnz0Dd)kLVEV$47pBkSK=8q}lZ|xceVAkQ7=vC7MHIcQqEhd%lN?
z=09#RXO1(8&x=;NVoOBT47g+A??bl&8_$nMsn{xK?ZIs<pZQ4q=Y6UhD3xjRF#0Zv
zYdz|-zfu`(;ua!^fXw`sLJrVuu<X*hY96Hipu7?Cbw~C;@+L`{NX&2uUwkrLp+(^S
zc9ISRN}}!y7T6!6$hpV@(?l(14Hk8KRw4W)w@3f+(0tN7TMg@!dH!4kucA<|52M(%
z*!*GGrZqmmx+580FbbJwU#W0Mg%7$OAbX-MT7fkuBR#?cluj;EhC{h$31q*m{1Y!o
z3cww<vb3_f<ndtzyP2q7w9?c*DC#6^;}qmg8Wnt{FrY#E-^gU__PZ-;Z#uf$_YlxQ
zgYY<y{hnwqvdB$K%}ko!rgtt<(EsePr(AXau4eNZTlj<89#x-u+6W07&<1Gro@KZD
zUf}yr>(IA%f#WCJuGcmPr0`m7Y_S$2<$t4H`dTi?a0+v3u_&6?#@>P{|5PlM(DXdd
zuIj^*rY6S=C0c*AmohMDB9{(js$xb=(L5a0c{Z^8-^^GyM5>N(B#V6EGS_4^^s$F<
zyQ97PvH3^%@s}a&!eQJGB2!yuXA#mrW_e$7D>Cr~YHM>A@H(v4JavI1oF=sQ$S@>d
z;t2|%v}!4|gqDKFRN=DP1o>71`3ahcr`Zfp8U)rYd#0lh<A?}Z4AS-n;AA2Uigp*Y
z*j4b<vF~3iOX3{+QAQxr<0Sw8s8_@NzK5l?BHEQ#<;_NM^8yIW(=Qsyk4Hm#Bz2Dw
zpAv;K=uJJFq|N$Qy!TFSv$wQ=<8^gy$}-!lv@{8MA3Mmm5<NyAz7$<8OP~dA{08{a
zk3RE24vt4X>EG0JtUhyHBeJvHWnme;_=)Z)jykeMK42$ihok&S2IbJr@uxq@H8CUP
z9`;gIXOh_K&PirJzLDfX#SK|)u>NVXb%{&&7t;(uLn7noZOp0rr^D-9+b9)A#M_^`
zY|u@Mv=a5K*UR>Lj`XZiG{q=9spsLeQ2qU-+tyuMSJ9$J?fgt0mn0WTPD=`T5K_2|
zH6%m3`?)qZM$`C?Ip2P0Xdt^GS!y=tG7ydzF!@-2qwW0Z3sR@fTzh-!?448p{FQ(0
zECquo3!mNe=MZr#bzh};VWBa*pE84~_~vQ`gM1N)d?&KWVa@xQ3GNQKV35hK?dtY<
z$+t{WlquwWWXq>_PI;XA$4gyhN*1bkb-kZ4o6fsyyb0d7265v73xTEsEK$jwg0Db-
z`F7wzuF#&=i`o#;^Sspf*+>AZFY{pi%pHM$f6PCg82mUT&GDeEpF%D4!R4@Ydymg(
z+-1Ceou}RBPWoNz^7>po#`y5TB5q!B;l%PUPBK#b9RJ5`|D3oK%dfS?f-?a#BatO&
zXWlq;BxAOYXWx_Ycsi)XzEh(fjf)fnmG+vqdkS+^VkWElF1zY41#nhb96W{A$+4@}
z+%OI8Rxn@n#Qw6xe(AOoXdkh0m<_tnD+#<@c2cD-QebzwW~}_<IiFEstr}_(TjR`G
zP5fx0k#zp>?<V&Wb8*Porh~DZuE+|rF55ktPdxh&<Q7YtWZy=Hdn<8Zb3w)G$mF>O
zirh_gk!st|9aC~QUf%Er@g<TU3K!;ww&X(S3YQkb8}X^~{b>;TzO>!lcVfbf_i6Rb
z(t}$b>H3YNXTeemE3Y$B#S0XfQ~up*1f6{s7ou!#tz@H=c-f>WbIVwDPNK!vAhh>g
z?<<Ls=rC!_wTBE))IL8bHndBA5&U0^-$&M%N*?Z~41RTnek{g7viiD#9oSfd;(X2D
zPWSqS-_xz2E8^5{;QiZ0I(7DAn3TLMSQzGZpkpLmZdh;Vo`&@PN*SVjbUww9BSg9J
zz)JA?-@VuJy_9lmW<p)2lUmS-vnKehh^_YR4+xGAAHUSqk6bdsaL2lJkuNsBS@l-?
zww=~GACF&l*f5!Btqe`2?DxHyZK||MKC!<`&+jO@=qNh8{dPVypXv7bBZVfm#I8r#
zRc5(=JWV&+6#%8S+-)w(e(QbZ?;eHD;fxStyrcX*Ih)(=o@!1m+|Wlo<c53Toc~%_
z=qf%mUYW!+BN;2-1zrs6{b<AFesS9y-$48|`khEuNO)PB6s<_H<jW)*O0ba%9Y&L{
zjyTI0ENZ>j2@Zwp?lJ5VJQf<Yrhg{t1*oWErKVHYoQCQKpF7{gnf~i(|8xHXqK*Fk
zHbnV#;fg*TSomtRq-FZLa*$C_%xrRe)~|P}kS~6nK3Q$@o*m@L)}F|MuJHqLT3j&P
z$w-j>-P~sVvaf$Ws4s9?c8A%c=;!8Tg{Dl87CtSUkID^oyFa-AL_}&0>To87l#2a$
z{y6F)PI7O9ztusP&YpL+8JMR93*#>aC)9B;z1y-LUzrJo)16)<-)=<aWmo)+2=!Qi
zQ0%t-e1^G%_dgp0?E)=^T6?cX;_nM@lWmwZPFkEI&h{c2ETmy$Zb)a%2gVvx(uHe9
zI&GdYW3OJ274qBJ)y|BVCTAzs*og|uQV@OqPgVGbaMEN`GEFpk3<s+?<ZN;*rnf{+
zXY<wHx<cvpz}B~WR54cdHOEKa^J8=^c)?39NX*SDvniJ=o3*l(Kb%B2$=U{+!r3<t
z2|{s)0{dngos9&9@s$lQuy3}RJ3Re<cA~jmOU8<RZ<~h40VW!!$#4CwOy<tM7870w
z(FOMJ+Fr`ynmY0f1Epd2$o;VBCvWjT;Mqb(pDts*MCqr9^vBDcA^}{L&`M#OWc+tP
zISCey+Z!I<P)@+-hbYVMXoa##4#nBJUP($en5-dbTo79Xwg^w5XIB0)52pQZ%mN^b
zD}3)xGsX|GRlChflpV!5Xa-xRz2tknD{}ea@vEQ*-nGhk7s%jK;BEItm}#Y>5vJ<x
z5_8h!{=#MS7M;%JDjD9^G=1Delhfdx<aj_a*b!f2`hVKg$juM^-Vv`Ju>N=I;mYzz
zdTS_E{OY*t9H)A3d_(Q61ZC|-vh7zA-Q>|q80snpRY!jb=Fqk@>!m&a>lp1OBGWj&
zd+FN6JH95|zQ25rizb)Exo#I_uZXP4H8}B#3XclK+F$`4jQMW#w=&oLE%P;@#K6UD
z<%0GLGifhXnH?i<4;)Ci(Zq`sX^pc41mO99!QVzqsr1KBh`5E^{lY@UT4k^DY3cmN
z;l#fC#_XXZJskR!Sy%{r7i}XhQgXE(q20^0$)L^<e@V2B<*bKmJx6@SURw`IZ~<oh
zyo0ChZ{*K!^ZQZc00Gp#{Iv&~(kun3!M#DhEy10~&6X?P{bC_r#SD~^zDe7oZ<C}!
zDU^NWX@!(Au3h4blgqv0Q08s>%Ee^B0;ok}x&%pIJ=S0toR0|Y>gU|7rMIN>YSTaK
z#-R&ug2@RKX6}>Xwz3v?p(9Ee6{=jyu5rvI=E}C!uyLV0&GZV#N;e&i&+RN`0#z?0
z#;Ss+D`hu`4fStEL<~v{k1$=aX^2Y<e>Et5<tGPQJ$`x4XM1Q&5Wbh<K}GhlbE@f}
z3{3sq^^`aVPSR%2aB*5R!7J_M(vlO%H(A`{YMpT3rdJy|?j3yS7*YFkiF}__9ma!)
zH0`HWBk$)!HphPvBY+L%YmK=-{I45|amr5_;dm@R-09t%@~kRNYqPv|uqzBQT4RyC
z!<59C7`UWqG;@lT9_0`(M!7p=b00Rv{Lp$A@3;jzN^<Tg7&Vo-ECT(-Sw*TD|8ZaU
zNbt6r`W1?QdQ1P%pL7x@N5i?2t|+@6!Oj#$nDr2(N|HO}{y52PP-6A{Yz!rYdON_q
zxfVD29dRD<79s^IErk5yHc1lfja`D!S8i4$L6*N-Hf3g_pK0|LJU*L6)kfZ$iQ#8^
z(YQXc!-p=6_N6pu9=Eh#H!6(od|qz%Acd#6pP|aUvD<O+&ah3VIOWx*l^>{j9bUtS
zqFLGRTC6j9y#T!?BpoFD7mNFD@way|YAr_Ftr7p`=4p8Px@=IPoV*(vF?bs<1&IN9
z54D0{qAi#NC}VxS6MQGoRfV8@#?h;Y00^TCq61-sx&YR0<kdd0k-<0wk3SHdKI9M*
zd2^!D?1u{Rgn}ev(TrJ`4fV>{LD1S7tpaTfcAU$oa_P}%ZkFi&+U12wdwsSqyX7lS
zZ5%r~2F>ioM598-raK_+xFS%;ly?5-ZS5=FRa{P|bXm|7$i#$)e%9@To-o(Enx{Pp
z;<8-6LT84eEEZ-rCGV)Zi2G;YQdN(F69fV}2hEn)-kU^tQKbKM>a%yB4Hj{VI0ubj
z&VlXuUia8F<7Ljknc6Pf8`lV5fEo*#?e8(sm>nraViPQrxzY3&?@UjSS5a0A&p`Yj
zeuPsLzs+3##nJ-E6R@z45X-Kjq5Hk|%ntfpdKrZFzFpSsfms(Dt}Ax2U_H~u<2@_)
zN3P=2xYJcD`JK6OFCJyMCOgAiJ9`*wGB#hza;@Gjd%5MP16%wOw=PRCwb+NmdQ33K
z<|>x$x<J9IwrgQi*@9-xIu@Or5ACxP^^(K7$6c^7i%J<G(&8@dm-!^PRqdWey%Rs=
z!}RPI_JpK$cG@CWbymhov>AhC%oE+h6JW!Rv7cReidmNpS0aL^@wM>T`}7uJwe#NE
zZ8`HhbRHW{v|a59HN|0<J!7|@-OKt4asM@sT{y}w>dXMu%ksX^-HBVB90yO1yR@t5
zUFxlE+8Gnq&WjYJ6?rqDK1`pCkSi=yJ>;-3*xQI4jG|@eDt5}99Z4s-?%h%ji*;J+
z<dMwpI6@R_Lq(jda$)Orp056|t-VwyT$Zav=#FwC`10ba`~F6FFlve!V3a;{r~wc<
zBvjcrr)e$p1|$BWp}#-5W{DXoeE}BMISX(^KN)J2zvzsa!rU9V6-J36!_(E^8)}uN
zzsd78``tfB0Vt3#nU@@G=k{$k#wRLTH|i02+mv-7hVq42o~LWH3z7JKfo-t=2!`#O
z9FuN$x%C4T65-qRM3CGdm8(sT1ekspAuJ|bw}o&V99QXOG;j^wX^V!s#1lD!RW$RW
zR=5}9jy-(j1UsU&G4jb(I`u@wdwMRZ`XmDFLP4P}n_Vt1N~QCrLdIdVBf1sELQl^d
z>>3AO-pj>YhxLu(1IZVLYd{n#&me|MwC!eC$Q^5G)2sjq$JTCKnR4?@9lHSiy4mMC
zKVRxpcey`dj2E^n%~C&HLhW<n5AAI)H!eo6<vK%oy}UZn8QkJ8U-dGZ<a-{+n?6c?
zU@m+#qv*IKBJdo~wp6>0xUGiWnfdfNQLnuy+cj{)y)nzoWME6VI&vm?S^YiPy>{)<
zJ!zf&BKwa_c<i_L1t2d&ySja=$#}3mVZLOc-=6d}0I@`W^cb?UluIub;6wI{{4W7S
z-<h+w9||}7Deta}Z&7D2b-$dt(vvB^{SMEcwCJtK=IE~<!d@lA6ef@9FB1%l>LYK=
zrPME;5v$doy{NjOS70DFU;kOo<`Ox#XZivTDbOHYqo33XvPQhI5xB)~kTM=4E^LL#
zAh+*tli3(~fC%YI%<liRXZe+7dNKd=Rj>W$?L;I2gIwQE+23+e@R+UMb=-PSyD%IN
zi5ELoGN@G_P7sn$A~eif#U_v}ijQz5W{W$q_gDLdea$9YK}z!R)o$55kV<94w)`pA
z6>=fRf#OEMqU;=0;Yu||bT~y2xJxTt@@`zh7pl74zebrv7^cbDc<{^E#4&GH;-5eC
zauDzn3!Kd9F$NwGHpLJ-YC#oI?A@isUaY66VrmeYL({L_?awh9RE9ZB%wHn)yqOxU
zT40RdYe!8u21+Enf#O4_*+q!2oHaYgw2c%u7s(esj)N%3@9|kzY`q)D^la)j<xU7A
z!kl|1GN>{HZY{$D#hUBNFxR88KmHm@rF{M!Y5}@m$T*_DSRY=(7j56s6KU<0x5q-D
z1%n%mt_HTzZVMipd#EtQfVSjCci21xL29Ay4G8Z;w%#)NDtmJ(gR%9h2JlenIBcQ7
zcj<PLwOc{^hRHfXKU&5nz{p&HOs@`J=eX&<wre0MYoAc$YC}C*vvtuOHv`v!jj6|4
zW8+qyj~)iWH;##UQF?X(wVtGWT=j#qYVEh4>UBvTD&s<?p~{&mah&YQF5%8z`@&U{
z4lxgP65)1F65)F*)b<tWinRtV+vj!Y89okKErC}{BW83w7hsN~tCd#_(WpuG3gn8s
z3-j%}tND(H<miqeaCKpbB0VZK<RO&5H9^*KHy`bjv78tCQ)mp=Bc)x4dj8x>Gbeyy
zI0I)G>AOj)l_(Z+SnD^j>oYMAF<_2AUUyho*XQMq;<==v<C0fL4+`6Lg<JzODMPh~
zz2<t0zbYU8ytUdGD>(Gf{`hUJYd7vqK;3v!6yNlrAF-#VARNuwqcK`#7NUIYuz3$x
z1=_rf$js3g`M94PFQ?WqM%h!uiKYGcxoorcIq%_Q#AEY$N=RXU#srmO+G~V*+H0W(
zp^&D(daK_LSWm2)YxRBO2wH|3Nk0)u_rbvoPP$jSt<g5p^)aBf#$UbUi#Gr-M2NWE
zA#aMjkBTvZ(7P4T^8w*xg0JHFCGR8|RUn*H6)vP4@KbJx=$903<!5wN>^D=_DvQ3S
zk=Y~E9&S;j)?Q?_6>r+uO}oh8Rce^VI0^c~n4Q+WUfrd)6MboNo9e@W8TLU=Uo}fk
z-_Xy^$nipnnl}(AsY@B>V-%OB*6+aX)WsP^D~4`2MPMI%n-k=Xyo#>pbhRZb{h0%r
zbclevYwWsj5G(lF34G10%Zv4o(jJoV-}^&xOD;un*&YUH?SUhKO}NgnYqYtFhQ~x6
zLdaKQ)3GTtFS#wJ0!#hg`ir1WZHKXG!8Lzwo^zu7WUuf3!&&=h!fQTJ3f!963`7Jb
zSJvg{n?su2m*X4S-kneKC38%%e*z|7Cfm8Y{bxGszp`8W%pP|DGqLz!-;XP6cNP2D
z^SA*W+Ulo_yrI4lkyx{*z$zmh$BfWp3LB4jq9E%V^TlLP7v@oIv(V*C*T1k1+%g-L
z(>O5Q7LZ_~!CHYy5XU=b&-dp0&-aeyI@fA1wGKXcN)P%3bA?ccgt>leXK>14^l)U?
zbP~bpm5AL`G2)^%I*N9DMJ<^#Q9Mwi>aww-I2KU*tI#N%PvR!{i9yLD#_Gp0fbDQ@
z?RK2b99b)-oMyI;UVIx#{uAzEr-4ZjDTwN>{xCh&xA6dQBDLBpby`n^XwDdq(??*I
zP_7k3Qbp3$(JxorF022=_DW%?0NZ;VEL=s(N+9e;bxNutSY{+TIN>uUXFD8c-B0ZA
zMZ8qOr`)hl+&j<L{TO<hH5NhJq4-v(P^`D3m^$HAddu#%1@Xyu_ehO{@2wXi7k+HF
z$xGsaIQ#a?dmTUM*@MRzr4fE3rv0sJC4;sSJhIxOHL^@Z0s=QfGd`#A^FYt}b-TE*
zmiWMnePXc{tzn5FFGSEubL`-I7N8beO!Dhi&0)rIV0us=>q2-2c99pNEC$o5w29}c
z(@Tz`{ZZ^TI$-l0`bk=K7`10uzgYu?e@+n6bG|DUHbt7mVbUl&5uviaOxX3X40w87
zeDbG4BngWXG%D!f9(d5p3c_1v%Y7rnKR%mVs%Xb9UhzT{RxRebvWv2syoY0V=POEA
z9fo*Kyco?h(by6!*ci`NyfhWb%NfHEbM~+H^8G&o&b!8g_eZ?mC;A^b?pX2;P)f|a
zlQ6a469CD%K-^ePi-z)89Q>d?@m;1@d+P|bfe;2ggdYR5Z<qAWGy3IO79jmg$zM_H
zUYE6io9zs(@lzI0{shCKm~WtDl*M~Rm2Y+>af&A&WH_@f$Yw>igeZF^Bc<#Jt#q#x
zOhfb!dR#m3S>2J{P^47-ugR<kwV&-4-eP!5&9tuj?5@l(mu;#q#mJu&lCbKmW}o_u
z1zcYLl+gsc$RsIk1ewHJvG3|oRhOs=HyEDYb`uLRn2xnbX3@xcj%jC~xW(lK33gvN
zf4OF~>W1}V{ShB#xKo?<vQTtcFGxgKoUJv}2yS3kDQ?IeqO3K-`Og#khd2N3<{!%L
z-ifjcs;&F#(nJ;ly7(Q0=P#6={zQ&Rz2z>Y@+ra`bGDB9BEL}#Ul%R<yv_$IzE{Z7
z7UGQ4>)>90_htn80>2Tq8*SXgwm-tq_&~-6=bpRrLf(cD>S-6=EBVSHKxVO^UdGOC
zX|rA5h*dc{sAh4V@?&*_n6OS(fxLZ$9_n>x@z1f$wr2DM4=r0*f<P-naL7)p*Ij#E
zfsz@U1+XRsDC(R=!o4g@XV&rG0xOawp@I+h+Motr@kAb(07v#b1Ka{uq%AajS#7D7
zgurbGWd(vgk35qHGRApsYaPKuSd9m-!!Ffm3VW?!i|<!OI!(EI*Y3M6(em1)SU+TI
zWrIDdx$E#uZ+8!iSrrPr)XGZsml)Mj_DnEC{Ntv~`=y{8%z;i!TUSj*zc)-Z$x(bF
z!@PC>n+$$wEE9*UjU(l^BE?qiCN@|lzRkn^O=#?$CCi=kc<CJ$ktffGimWC-F~)P@
z20ew_Xp=^=8kNH$dSCFCQ0yrbc13FRKGYtreO2cCI-PA=!1s>c-un3}!mey9qrJ8Y
zx#Kct#l0o^{d;1<`Gc&O=bA}jdiDo4L8e0X`Em{(xfovQVl0Q4u;k9xuH*Eu+j&~A
zUpK4X#MV6i+{?9C;zU!`HwHRL%Bv9!e7n1`E7FO*X^JS>`>8moB@E@j+IfjS;1&D2
zz}UDWn!!qz-`L_+FS`Nnf;7%izfFA${cCJ^leMp{h!fC1;)g(XC3L>AftlkDdE05n
z?-GAg-{>P-&m#|@itn(-3SryPU#IV^0&>b6ptj0b7(sgU-t#vJ7pu$D<D)H%iH+e_
zBnj(lzwx^i>>)^=Qf2R!JV98>qO@6^*pseWG?`W!OSlJklZgWlt41=4QL34%)b99u
zPRp_2P5ekVPF#T{3m)%rs570hdXT1~$ZC{Uz`hZox4D(EOwG;)vl;ugQG$DaHK%iM
zvH%ExCp{j-4caO^$ok@~hE7XHFKanmtk1SMj-5C<ath4S>Tf=kWezr5ih6im65m_V
zZV<{!^(`}*4-0k3uC&*vCz*-Ze<}+^96;QcL-a89%J;d@QX$GqM!?oHf%T;370Yhu
z@2{|^4_$ZPC+J=7(L|p88#|Hv+fFbGU;QzqA^3xuw6NTNntAOzIiyXVB(fe0Y88gA
zj*@0QZ1iWzp*zAJ^dw#J$Cn5WHoIUTI^cSj(^k;cS(F(43-sVvy(!bu+{r}4+&Pdb
zWVfSk^39Oz{)b;rAQ(D6*=QqXWiV^qIs%s@GFJQ=fdfrf>OuC&^wjU!<xU~<d8J*{
z!>xZ5wKLOalReWOFj=jYEq2?8WD(K0$z#B~REU?<DYH=#GruYMG;lHTp7wFH;zE~?
zM!LOrsKn9n6#KqpxpI&D60G`)UO9vARO%9@LjNwhc8kS*b}3X5O>{C_kA=86`l*L+
zdLAuoMxeU`ukLM(avg6iQ!ZHOnWQswOX5SJcSMM@j$uDw-C>Hy1Tx2lr?B&@>tSA1
zBw_c;aY_MMUeZjrV?%Kh75CDz*}cUAWUfBRVyWXjkQG_=l4LeI7@qgB?o8HO3@TNu
z&+MF$4CnC{*}tm&wQ;25&37L4$RsTNG$&f$v0ScgHH;j!!&!A4-Jjil+uX#*t}27b
z1C<>%MEcb33V9?VfOS<xK1X8as@Hyd$cqV;#$HE{|56sz4Lk9afZB}V=$jGmuC_Sa
zqs)8r^rsKxz!JFGvp|rbywm25zh8<!U6Jb0X?~YfWxqW!w|zJ8$~!~hGXSB|yxUM{
z8>{0(riFn`a2q>rG!K3gEc|nOgrON%<Trw$kV~|OCr|8@8)MSzP?f57)#Cn7ubYot
zhZ#QPxefjLx--Ez?v2gBlqymhe1&w!pI=i*mq!$TZ!>~^DlS1|pT=?Uo>5pGZ0w_P
zaCqsXG?t7`6b#CXp1|$imVEwtD2qGi3uJ-b4mkt(EHz}w$z{nk1nR1lj%meEd^&Hh
zi*~Vu9-V!)m<?lBf^V@2COVB~g-}u0nQ!DFky|jPmmZc@a5*gPH4t(7CaSho?;0sU
zlgqRxd7|rd87udW)Q2Z`GD>S-FQ?x*ykhd`NOYGlBH*)-vAJ52asDr+p8x3L14o-n
zRPl2ChL{$W0n42aWDH#gfea_==C3a2Tc(%`zn#wWLSFM(3B$RC+8ZQtqiLa4s`&Ed
z0jp#R#Vi;QNh)v1V6qBUwxRW^N3&C)&k4p+9lw1V;t%iDAd?VP4a{ojBv<Yab$j<#
zHUmf7#%WF9>;$2lw)qyaRO@2s55Lv^8lqfi&yNN7{gL>I<7q7S3M6()8io6cnDvLx
zJ#)ekq4k=)by8re&rx4XwvRm}kBP#tQC)mrbp^%pNTd-H?=*Vv-j5+2i^8Zf>z-)A
z=$p}~!8dZaL9cqf`V^}4OXG9f3z;z5r|1gEz2p+sdFQH1Jy=y`Rh3*_JSbZHcngbr
zObu(#&Eyr=o^rzLnQ1xZ)i(C~pqB;ST9_|Ad-Ev{S-`8XZ}Cc@IuX^^ySm})ln2{!
zU+NG#UU0?Ch9aIP4cWNo5gkmo)MLl%@|Rx-BQo?!4XALfz!EbYF+t(45kdablrR$w
zATzj^?6|6Jz`HN88}@da1E_$7QgL+pECG2X6BZ0v)#C!W#|3?Q_zO<UuxMY$0DxO1
z#Y@fz%D)Mu+iUuhU6IEoM^|A-R7LG(S!y2Xs@2tLf@-pfF=Ej@y-|#V3j@_I{?5Ei
zZdMgL*Xj;2_-LMu0nHWtat?ZS+dIX0PuI@%X%FGZ$g~SOuQsQcM#n`o7JKsAraClr
zzP(iGb{M$J?QtYNhgVJXe9sdjc_~EHBhkQ<uyg%E{Z9<OgWU;|vy9)2q)B(OTi+fT
zp9I$lF16*=Bh(+-(e<Jst<e<R6%g37xU|;Z9!|5*<A4`!Ky1*%{D`0+e;AWNVN-XQ
z#(;?{x%^i@;_`_f;WyGmpGq?u{A>y?*AwQ%eCIF4e;`_VSA-_JYaF2}S5f;%QrMn<
zcQTE!s9n|W`ruUXe*0C|mJ3feU!WfK7(GM$n#wBchPDWoF~sM1J`<omiwjYPQ-B}E
z-2eA=dMQEuNAS@s2)gPSc8dxz@7DkI3MHoZ0zW8*Qo291?W&{T^{UzWMuhJn#lFD?
zDBt~f#>u+7H~5ejcv;hY$V(Nk&mCl}J4*1&J3JuU@*7l*=$t~N@-7J*nJc45<UC#5
z7mc92Mn^64E8$krE9%bH2+nFX2~~=Wuo9+&$cdxL%5<g><tJzVy~?X}{SOIU51u~)
zpXQWs^LAaEo-zBKNeBG%fA&ZG4k)EOSKnPL%09aNzJ7RmIm3YFj&VdAr0O_I57V&G
zve;K;U-{UMwEa1le!y7f!pz76<`=iF|GPSAdH7B)MESn);PPl7i;T^j+naA~27uf0
zmVux0zrxmk@$kOO43Pb#iVw*l*KWNgfxo?LU0k1Q;o4B@I`cjC@lolGL?1ZTe6L*<
z<o1k-xJ5Hiw)AF2AhWIABAJ`^XjT`Wcw<`;W-1@?y~Tcl&Gjfnp7NnAuc2#+ex>oE
zB~y~gqraGtmJcT;1SrBr>?Kv(D-C$P6lZ|X2!2Yu36vW`WFbQe-^^vmFqf*tZdN@;
zega|G4cN+8@zFrho30bzfJk0qVts4KC3*ZMTJI^Jub(n+lO1O#u79w9JE?j}J1SJN
z1YTs6=CHjxNyBU$VdN0b)X%z1;8xF$@gBS$D`fpT`}F92@U#A2*~|`2NcjE33!?o0
zzH~v5Kjf$(Q8@dJd^8jbwz4;dA21t9SD*#F#_W$$D&|9Vm(T6Im#uDFB<mHDyEFd|
zeh1VQY6B@P|NjX4&Zwr=t!q0f3L+?-C{;SrLI<UH1*LaFFM&`41Vj%ay#(pKccga^
zK_K+r1(87LU_z1pZ9MmV$Gu1H`;GI<G0xDP{XA=}x#pT{Ztu?Gcko_d+-iYKtHij7
z90j<{6^Bl|>Nj<Y>S9u9V<ZLtiI9MqGgs41pcW|5@rOh<c7}vyW`ULF4Uc+lYCbby
z3g661Ku3a={E{V9Q<<C}rh*0t<B(UepS_I4xIpJY_OlT0c^jh-Pg-K#HoxxX#_Fz3
zc9RV)0AdZR6#M?HJePcp=?8{!kyN5nocN^4Pmqkt6zvhCL+NS5ZtD}|?S>VW#y9E2
zsPO(3V_@%u(tVP-VD`NXpMzejU$G4}dhQ-<dopOwqlk8RwEC}h(9<qGk-1{8solD%
z6Q_m48Ys+gq3Qi;a_s(w>F5~{jixHB9I}ffz)`n1dc9(i4RuA2@356HX!X_Oxz&2b
zVx?>;2yk?!7mYs0uJx=em#3VhAO9d#^-~9qGTUoea=h#9b)5g=$lfME^L^V3E3+Bj
z<eDurW9qJR0fnQGOd#AZAW;ECRx5-MMwkDTGAb!>Z<``mpBVnkAUtOECVLP5(sdkd
z0x6*UxO&b>e`$UfHo2ed+Q@MZL>onocU%EvqA((gEAy&&2cK214mCR{^Z%b~CS?n2
z_;bE=`DO)|FR9@S$Js_RqRipCdbUzDCA2{$1I+#;ijcqD=ZqCw?Nk2@P+4g$ACCK+
z7--jGgP%{n;0B%+3n+1pUWlkggTy>vdO3yv47ubL1RXLL2`5CqJBaA@_uYk#g~D4K
zjAtP@<L_|f8Fdime$X!>@UNeGkzv~rsH<3G;3IgZ1%_p~?@r{ZDfs&zOOr^qp`xeM
zA6qF(t*D9^l-jc0)#o|?dG~==U!?rK7UNBKwoQ1ZIVw$6;G`~^!zes(G`r6M@3ql*
zP3`pQ`rq&Lbcr)hXS~ep<#ET=p<kvTs_&nVCB!c(0+)9_zu1-dF!5?5LSt_r@W6cf
z0Cgt|K}wWx!^S34^n#~Y2>;y8x%Khv&`_N5<mBYF1^5*v+cz=Z_Et5a&o7@C2E~V(
z)X?8g!e%mDI^jc)xyDO!M0CPq`sCPp`e{V}uZ&yg!{VWs&g-z3iW~z8%gRTk<i8~m
z6?0DfxOgB+?VI7Ek5i^u9)wKr##Z8;+-)GzDF<W;@A&wJX#SaBA6@eOsgP<g!YFL$
zWM6l%v}V@w_CPtQNs#a4+Z;mA!}G|xs(Cfvt-HVwq0w8{@{s@Ucn(K&hB(WT8{ROh
zen;AH!xSTJz*yA~{3!_}nk)q|N>*Nnw`2M-{Rlw>`CE)fBWG}yh{IeMk?Uah-;#x=
z%PsdxQO%H=2-a>=QL?p<;8k$!p*=0XAjd_iWa`c5Y~_9wu-2Zv^pSUMW~4LEswO%W
zhqOgcK!_5&DDQf{+_-t==N$p>#+$_3Pp_O$)lYLnKYwX3GT`FO$4EEWz~+F11hULV
z4k&iK$7adpsCO;k*UZpM!9t=0*nG2o?Q3}77!JJyQ|(T6HQ2OzcQ_b2QQ<H@v|YP3
zQQ9l+bJ3GM;wrqxZ|9+rl(1PWm@NoKpy@zS2RI&!G_Te{SL-rU@b5RqXSJ1QW0CH&
z0rpP{%DKC4wLJ=A#X`M>z^e0jAhe`~<nc>R<v3CxbftG2w&8!v-C{w-gk4qztNt3I
zP)z?pM$BM0vB7zbSghn5<^%_n<!Tz1%p4JBc~{W!&rd{wKb8^x0c_rUmLnqTthHJl
zVK&yTD{~sw65yNM1s<ymkQSUV=SY^~EgIHk_-x!<?IRc4j?m%E<NvfkD_%J_;>MAz
zGIGH8vcxmpXH!qyBTeHPVGO?NAfbrc_RQd*>zwERzR6pTbH%@<NUcTdKehUp3?mC>
zud!BBnj`~KIWsXcy+5edOV`@tKN}?`Pzdtr!xtCJJa%nl(2>AgEsH4Oz2%u>#<bjI
z44HU9&lilkS2;P&Hd!!r!?#7Vzc!ASjdvUzbnN%xZM%+!^G%V0CtRTReXs9LhQewb
zFyW@f=zjlxCbyKkL<z@=GLw?!iO?$j+Bu{1Y)s@y|L)I5@DY~^P^;{9norNdnbos9
z=T0|ntZZx)z{luTMj&{9U$YygTX_$N-kg2~`^{etJ5Cq|6pLJuSS|`z?;UTvefbk2
z1pOkJ=q*5Y7bNfnC}ekdK{Z?Bp#vR2Uc18!4G;Ut1p1w>P+v&FYd--^$72s~Kth?a
zJ9&Y6&C=$|RY5Rc-F5_Uj~0Lf(`j&^ff6juQrS)w^GkV>FRX<TZELJNzS5JrKCw+9
zz}<3l`e0CZnSIA~$@%=>KSzzGr&Jw?lr3Vflpja0f_%hTq-+&F<{OTXWlGsvLz*%#
z$_cKIJ~=Lw!!Sv1gsW;Yt$8Sw+z3;ov@HdpYvy+}*Nr{a(1at$+oyx@YXlCTV*Den
zqAv*=(fpAn-y0IX0)$CcfQ0w-ad5Z=6ObIu`ZJ$ikQ~{SzH2s5JxMv;!Nk|SWi591
zZ`iBE@Q&_jQSzPtazKy}SL*uLx@4Zyr3IY%PowqdPJHa!28cK<Upyh5Ek-ts*f<1p
zEg9*qLa#QO>g{9iJePhtk&LU^!kv8F+M3|h(F=P>%m20V3gYYMr8zFE5dgMJ*$Qb4
z)1CYii32FllHp3P05~LD9a(DgJIVY${rL~4vhQN241c|vehf5Ct&BHurjQ-URcEv~
zjFA}^3h!u;+)8zmmDx%+94s--Gpya>DLH6D?e~_^SfY;97C*_@c6lz>=0xY5F1F*6
z$5_SNJ!ttSi$d;RkedUfj2>aKfi%Ls36!UYoFgBUACiCFkVp;<Z+s$3us}M;>$;iz
z1y4+}6bA$>-6H`~)oB;+$~BkDBTV})kcGQ}ENsa7JPi;zF1sb;+lZ3Vl6Fe7*GfPg
z46S^R6ds$XPpaFn0f7-OXRcfP;LnG+%=DtWc13^d&`EHAX50h$Qjt=SU%M^4^b_T%
z$8Z!*E?O81VwPJ7d*JZq-HGM9|I+9W9D1ax4SrCr6!~=A%I>*5%F6k7a>y{xKui3=
zSYEyv%yZ@2H&N^Y=!`Rt+pMf%iLU@1rLIDO<N<=Q!aYL9mV06Q-iCNy`Q;OvW^$n~
zd*EM8eMX%iESRj`y&i?{@&1Tx-!a*AO1Z>QbY`3hi)f5EcACR9^&?V_yy--r_N@f~
z>D`L!-sVK9ozfjYsz2I~^Pmg{|K0US(Z`MmcKOgh4iS(3e3@V`g9zwC9^v&|{b%Fz
zd3(i|*97Tl6ym4=2#d|T&|Vh=cdX^Pgn->3mndO9Wcg_oougNXNE_x26`)JP`wzAG
z|Mocp?H+GFC<7;DS*2Y}`sYdc-Z=j&iAn=Lut{agN0%?$otgK%8Uvn!XCxi8c|HGA
z$Zq}nNi~6@S8!fPI>;fSL<tmH5A)t%q!^`B0!W16AJP=1sNj(E%JHrO?{$cz570*R
zl$06#6gf18>|E88ea{M`q+@zy*h#wYvbk1F*v))sY`b%HrsI8mxA?hq)p20|Yd%nX
zNb%d5Q(h@&h8*(g&V4KINO-^V*;mr<*osvM|G>1DjUGTjw3*@;WD7eP;8BpWw%G1s
z3)ytB`)^b?ZfXKG-x#3mOnJn=i}BA4dM=CZ(0G7=eTJe32hN#Wgq_qd@Ix4Q2-f>6
z;`3i|b5_87<Q~;R)CXm;>lbh)_uhP-_$|b7Pm{4-eX+1jHXR|*#Nprm|2w3=mlTQz
zS(r?QC&<_YSuXei_Z-e|m59l(<z$e6$_6-i{z{Av)PRl@Kz3;=DOC-!#H=p|2vj<6
z;jaJt5`qN&vTq$w)zX^RCpAlErm0PV6Px)<?)IN$AE>YI&s$UAO?OxlDujHnH)P2P
z2Ki)iI{g#@#+fQq9E86+7i$zA%vWzD5`P@@Ta4&n=z@5mGDujI2l_RmgLA?ibYOu0
z5ZXd4fT1HFahxY@U2WmNbm3#fr6~D`3kvEb-_pmx&;bQ#ohL&o8bAD8psd&qy#`FN
zS`r^4Bx&9=5;{;)fYAh^w!cNro02pBx*OhaW}idTst0t7va7o=(=Wk5AYBTDDYP-3
zeUQ5#OaJSPUOgzairSEMp&NFf85&HJ@f7%c`J#gKH#3p2>>JwZf3&OC-X9MKAOYn&
z2H6WW(klPDWndrq1<KD3Z(7~U$^juR9ag~Gd*4Wm`}c0Zf5d-BDjuUpTeftN%5DDo
z<YdxsuCf;%4I}S)LoQ{jW=aKZ!Y<h)G#n`W#ks_DsN@4N6>|c*%)bAe%y0o-xw4Df
z5uZ|1J#XG9NQ(Z8lV`EA3&9-&@RudPgr?qYotcb)kV@cHXG&FidARu4olxZth49l0
za%%<U`M*w6$_#u!ed3+<RN4(=)pQ>(-00#bW?_&Q9S6F)ikj@e5_&*(U0B?MywR5E
zme)d46cTS!cm}Yjc3Sc;z<VZ+MjL1DT-`_P5P0A<PT$y1BA^A*4>Q8U=ugQMkV&8X
z{gY|GC_3nDgXDpd!Qk-bD%3q}8r%@j*@g%@iWX9JNckc56%qKqV>|YIJRt(m=D7N}
zzs?C~O5KB!Nf=bK#ISt#n`j0lAlUeUY-M(HYyO_2@_)Q&no?lxC9HL4Z!zjnF16<?
z?wt5^fIrCrF8ouVd$$iyNb3w)1EKK_o_W`B){8yKS@!=4+<(1x4CV*UAApk`H)}+q
z)X{ViVFAG3R*s93NH17}$K1NODM&kK!D&s1BRD^JJwxNu`uu^7{*~5^cz6Cj*C-nS
zEn=IsT7Ruin<1ZdQUE^jR!8<NyPU-z7u@^YXaBmI#dLO@CSH8e_22BTtvhb}abmNG
zyQ^;THplMwcrKl^CG5W(G$VS<7(cskNOyVXtZn4XYm*q~B)gTiA1qPda~A3vGLgBq
z#s_?#yo{}4x(Q*UzF~FkqI9D3Q9@SM$zrw>s4&V65rPy@2zH4R_C9eX%)xs3{Z*>)
zt4o*vZBGWMVxOhPt^&jCsfu{)2$u8Z>3gm6lLiDaw8436LjBVxY5|AbaB)D7-3eZ+
zAu%Xt4t~+Yre7yQVmn=xrS**9&l(4?5O;l-MB-<D<^hB@fL@6Al8wBaj>5U^x(F6G
z$i;>D1PFgU7FT#9$C^)OD=B_QSv>e{5~vYa_h8AN*@ub5R!b&SpHf{C|Fv?}^N{Kd
z;P}js)9XZl8hrsq>d;9Fe-5le3+z+`pr{j~YVA>^6S3q&b4V4B*US4qf||+Ie1!gF
z0f9z(?@_p*IG}IqnY3yTw(?V?Hz9@ws-VHraCM3U+0$KFm$Qf{-czmHcmfk)?f)b(
z0qsrd!uGtkv<<;?^M<aRL4%Kt^51uNyZm#S>Mg=<dy2e2=>^d1mvmG0vEtce1d7VC
zwbbg7(8vW3GeB@{-M^~EHqKPNq5us%(ny*6;4L9N9@otIQqqH3&FMTc@v|QwFOj#t
z05W{}_WRY8mdTcBeeYOOnM;jt3?w+wDVQn!Ek}e1*nBR4G5Pd2Y{Dc5fVZaCn>6#N
z1chj3xmLEqpohQ;TxdLBKzkIRi2PAzsxI1*WxnB(lUPQ3=lB@c&(Oi(dl8x_lKFf`
zBc$46%jY9?3U^1gfceq{N!S7ahdLsD8fnr#zmjqlCYO2dKho>J0i%i>n&n(7vHMg*
zt@Nsi0c?43n$WcP#gN0%Jn<<*vA&lpv!yvke%-?Slcl&&<;tWOZs_zE2^a3}=%k0%
zRrZJ~75u;pBI}JrJyEXfUtPkYai&P}tB7u@1QYoj8CwM#V&O<<dIoth8Hs^CwEt-G
zjs7yxh+~H-n~0KIw5qK@3u4dsVP*o)j`AG$91e6k(cms42A&^=ABh39TQ8#EZt{Xq
zJ3!)!Eyav!j9AP|<(U&D{D|>wFhzc&S4F(GsL_0%gMmPE<@?0IBafHyE(*i;>%jj%
zG@$xKNJMl$q4>+arHLpvXY2>%!DJrh$~7(Tq0F*x{teTOa?`lpmtvY?<KOj`#3>@%
zL4@;{@Q#Qc2uc9Ti2sPx)>J$Iu@+yB!40V8Th}OvguJ^|kmy#gQ9Kh*IKr7%?LT2#
zeo9e>s?s}4rsnM6W*x)6!y{xkm;gK3DkMB`z3ne&gY8hpZw*DPK;B(=+)AmIPRxe#
zl^Yomg7i+dfruQ{l!waVsDYq|G=`rrZ6-E0XX(_8JGNg8&>Q7X?+b@A?5M)Obliks
zKUOoz@Q<|O9mwrk(VfI8Q!G93kT!dBWFLD!Wa;j%NX$>Y_>~|otD3E<;L|%PF=z8m
zHgUj6gkYa~Q`qmQFIU=jRr4%wz4yUua)y2pK&=A>_()7<hG0i_t^;s6w1o>4X_}CZ
zCTr_Zjf9VWjdc&QTp<@-j?eB4Mtdt1x<x<IiC>M;PV_`R1@5kvQK<5u746hRQ4@6^
zAD_P2g$VMpn=0ldsP$(CsybCc5wa?=OaQ(9j~U7T{BdOLDn;pvoYrly(tS4qHH(yZ
zxSNdi2!|$Aro^`B8=4-ri)73z?LGx8(N4x2P2E1l);?wDkR}bW9a|dFWDmV7S>T>r
zW%F&gC|q9AW}WxjCmF-Q3%ZUspWSK01)1-<Yt))I*}N~eT?@x}4;NKE<`iV9B1r;1
z+UGQQY}9|tF0wf8q+>%t-lvGLd$@L22FJIdG9qiV{Y=c+<aK|Jb9xJ&SO*6vzh|(u
zhiB)G2cL-h_KdF>y2)dGfAr_6==&ovTq1n-6zA2jmS!x_OcXLfk{JKCjJH*Du)K>V
zcD-BuA&R+a9s|6%NV=hMO?lS^$t3{zONznKY;az9NyQiu+^<eMOQW_TnEC?p=+S`6
zwIL8IGKfV-GO%`lo*5f&0d{-f(U&M#`Nm=}0GIA4aPYL}4)0)}y7*gl2YZ%D|E@h+
ztn?AN$akVd)mU&q(=(cIyxH%Vrhl6t{e2{{A3P-J_*W<#H&0DZC01=;fwve7Wj4Ni
z5L4my;x2wx)tXns(7`;mzdnI%I<Y7spvrCIEJl^8>e~|~U=#Mn*-!a2StzT=me|XL
zDsO$dAV**Ft$K7%iSxCl+O*1#P*rWaDho-G>MY@4NR~No($iKT?NAE$rTgL1pE8#2
z|0Pse?yPiM^m&R=VV*kZ2Dn~H2Z~2a81_WG6A#ETTwe~kl(^A%1SyRL0qp2R&<_tt
zm!3<9c4*D5&bPidkm1aTabcN|lDqFt|48Ru#|Hp=7KKY$2DWqVli_#wU5BPm?T&HE
z*ajN7GO8nhoYEOH*{{K72>HqZ(}COwJAOzBUaLUAZ#ceraI*RnSGg|v$1Dt}f)Pwy
zdV4`e)%ZEO6*<3t8PvfQRjs`Q^Zj_<0mTRxd(uwJ|60~4o&<;tdw=F8d7VNxPolhO
zlw1(@3ZeTpBmW`Mzc)Pp6C$a2BQ`m(Uvd@tA4P_)P`QC%getoa^R<&J01L;^(0sk;
z2EuUhZ?_h$8aJ=4MW2@LZTe-dgeGz7u2r0VZ;^B~RJ5y6kLk!-9=cJt@D2I?vE#c$
zv-dv|qqb5&F@G*$oR6<Gu7!@azbx=!x5&X%IWvsKS!TqEA>zrkzL-a+_^nQ$6CPOX
zJ?f2RiXxawgXUjP2%~T=^C(hWm(~DPJ#X9{_nFVk^;eDZSMm-g1il1qthHl$Rk#^N
zj_dQmNB}g^fN*QN+uKK95B>sBNM>^jc1B!i&J!T4^h{651Vw`lz^pg+Zus5fs^~(%
zCusS1*8*MV)8D~f-3W-}rO}{SD~FZr!)z>&xw<jwPJ(4gS62ZNxK6u`k-F~FfmBa*
zH+cKdcE-!D3W`BpxEHVED{+{v)reH?p$b`NSoGit`|E=;s>WP1&Nx&#&H^c8D`dcU
z-BYzW-igslf0iRtX4r_dtLx~fNMB>qHErsofjZBLwur&7^Sp<Iczitg-vQpgZ_H0=
z5?Zz~?#jW!QYey3mu#cPm~Ipeh#1nyY`dZybU^W1Q2YUsU@O;4--h-Eb01*Gv_cF-
zg$)Sq7G{x;0YXN;w3TUZ{<ealtYv4D_xIVAs=j}YqWaRU<Zj1G5+j<?@Ra$YF5A-O
zihcOt+6N6Ho>~$%y0r9Y{jc5L8H$6~r<FeBk34=@idyGz6wwc~pa1ErR#6}OO-46i
z!#uK5F7&~T*v!4OSaEB{TnGC!THXSC!%fwuPGXwv4>;zy)U1Q|z<gA>OLpLUz^_b?
zI1!wJ*(JCf;}u}w_Sp+qgBx`E80a+dW&9I=9Y?YM5r03sP-TMGDfHa|Hycqx55+^#
zM-P%H%4Xs^)xtW_i!B2WruMrt<&l|lQ<y_HfSc&X6V^(%VArmLcyo08x$bZte4pir
zC#n#d^Y@k#GR-NqD~yV#d>EyL!^s`*cQ7k5T8TmNx@4X6AJpd6A!@}BXjR=m(@hxy
zD4@KV?n3pSrJHCfFh2iFLRJ|*8}E{jKFGFy&aPuVI^+{=iLf+b$dXfj3f&!hu_kG9
za%8HBD2HM;5vzAx=mo%jGAIx*>EoU7zo`DxsRA4|L?#n;m_BuU(6N>*^P@`rg=c7E
zTDEzc!*jDERo=sUwagTK!7-<-ljEKB2qG~cvzflyd3IO$ESCygtNIAjDTr-HgkjQu
z%>;`{fkFd;degtp+2q4$$cwy2!;V^rrRC3iC^vg^Q1;&Iz|C7^v`<%9y%>oNHX{<E
z)Lzg$^cJbo+{zi?Vyxd^kCFV?YE4*<S8v-|%52&~bJ6`FyL-i~gE6Q<6fyNm(0h}O
z52HnIAJSRGpJ>Sn9?#Br45H&v9#VHc3d?#5#cb@Q$F_H>O4-ANDXm_LeZL&mKyzMV
z&@DdxkEMSvuKpW<RU$cm*K8l$XL$rB5_>F|AL8L<=<L3f>mhqkq*;pa_oFN!&y#-;
zB=~%?Ce2{KH36}70y*m#UKVzj*xM5SV2X4!yAW%c%B4n|4ku3XK-z;>T9Qp&Q;miO
zmuINWcb*DIZmbDTE80a@pJ*9b1<yd<gV#vAi&SUso=EzQW$n)P4RMuiF3TXksA>y5
z{6+uP*NaOWi~F+J!W4+<UXdzF$sONF5g!LZbNez90p@w{^Xq8*e!6q!XwU=q4&L2h
zHd{5@u-IfX2lb}{G^a+~7{<H8#WKV^a(tjXc|<~CBSm>(v$o;eXNoQ>^Q|Xkp8aA}
z315PL5MFo!!dC#{%)>;k@nhuu`q0UDJ;fOqGF$Xsd*PJlj(8Ay#0$;1ku0!SlN7)^
z)&2dFe*pFd$GFuYF<kbaF!%S%Pb~zn?r_9CHu+}0yz4AmX_|CUjeK<XYpy&7_!{Y7
ztO0E#lH6bC-|8#+-=<@VNL+t2j}YB}dLArHbt5>pzH!R3j0sF@1#<lFogrJh#qvL1
z0RLGNf8U>MW_2dij9^C|^%Gr<zF@J(Fl6$JPdnF4!^beRU>BvXYR!ePsTiS(**mYt
z=CDnEjppmG(o6*`hvsh3ru_U1@3$x-_s+;rj$pkQ?l1Tkkvtw%_r9B}mjT^@^{i|x
zsEAJ-7&Lj)JP*}X3_WOIJjU>4eoz)VdN+@1B96P<May?x^3{`mS^@2Pqokqt54~rm
zV(9pGZQ8QQfSA*@rE;l^jN!9Z_Xa{i_1(qQ5PPjFR2jF_8;uH}eo~3Yu$1CU2Zlp(
z(2D|<CvAIiqEDneZo4v83rEB!1%qD$GocH`*XKkCu{I$Zh}5S&w(<c_^9?9^l+%(<
z<)?Iavb2hQkf&A#tr3bJMj+66E0-T=$c7hI8$(u)YQIH3SxMQE9RXH_UAqVozDSXn
zEVVj47Hpw`5XFB{v^C#<svatBQN}eh?^A>iryie$;p<wGM1LyZ8}!b6$Z!`8S*Q_Z
zuBa}=b1&Pp^4yY*|M`{>+X9TvF6L__JlA~Vi4xL@@}?GgyG+px%6vnSg3Mppml{*F
zGYV&CXV&_qt#2E5RnDx6sv)!TOruJxz&Pg_V0nhov;(NE*Qp>E;_?r~xiDLyXF#t`
z1Bv*H4W`~a1s|!EKZ)&`Ax;eMib&{DlxLTo*W1VfhmDZT@s8NH$am4bncj9x)heMr
zc8@<)gdId3qH%8svBtPEdb}ROCE0=TPU&ajT%56_l}mnWs=)4wgjjwG6Ci8#l>2+C
zj4rNR4DAo=?_cL{&GUf~CF~e8Jmr=SYyY+VLxx#Acebx0j-n`XspW$ilUWj5DW|;k
z$ZZ+sZoJ{w&IV=vm)EvbUe24?rgCX;q$8`QmD?EKbzBHE+Jk|!S-BQ60Z~zs9X-u>
zm~4bMR6VYSVGNsrxIUhK%g{+Hcpbyk9cR{Q`>cg5ll^(0%uqXja+c1+Lw_|&`YP2m
zq}RH%s8={)f@)8glus&%`^5UNBJ}hQ_U#N8^p(WWbm`WeN8lN^2LxWLs}F!*YveuB
zycN28{2eG0*PA%E5qWo;IL81PB#rapNHT1J(s6In29l*Gm914A5jzrV2A$otL2x;0
zOEDsN`V->{eTw9i_c~`liD{AG6KB}`1WAhTuRpbez#>O`;Q8H~ZJ2yK<oc^fM36ab
zh9ohf;kkO)Ow`niUTsvc6{;jR?i*@6DQGX-QZ{gpp&A^KpQQZk%VmO#m9gi_e8za1
zPH9`UdNp%h7^Ql=&g;VQ#!P(&z1xdAMpb#=>oWtT&Vn{}MMc;FGv+;+<b9q_N1hnQ
zBKg^MeCRKRvEpx@drWpFU(}rc`^9?#m<Tz1vE^I5W*SB#Jmu0u03nJqL1$ayDdb0f
zm^F7ETY7vS$!Lx@bcHo=!`Tp#U{YII4lAlO-^7s|dU~p16j!m&S6wyLcCLC{M*PuC
zNf1^f(A)%~rt}HUw(z4{1`^I0hi5dwd$+q!JHJmMPf`7eTTb=_uK<sBb6XxtKS52E
z8@MQA`Ja@M)Mgtk4A*0i|4-u?vyN<dM}a9)=;<WPxuwU{B2}2$dJ9Dhj*C$<x46A%
ztr`z;1(nkPMzmyu%mk2VM%L;NvtkYv;s?HEKTSk|4ZL;R`FC&dMA8ut;UD%a(8fl;
zH*Jm)6mSWkf+uIxKnc9&Y+b~b;X5K8G@^5>9zA{Hq@~O%t36HyvEyOFLJU^-|1u2G
zLao9cmzYOo&O{@5G6GNWq1#sJ2O05U5eXGt@l!rys9?^3K^7s|uf?7Qj3&s(|D}XW
zr*@Uf$E4$P<|)UMD2by|jOGIRl+8KSD8tA6W5#=aL6|^5nR1N}an01C;?^k<ZS_eG
z+snyx{Lz3U`}jqm<r7JW5_&%4x!Il^nxPML{W2jsZQe`boQP1~q?`fQLi6uzQwcsx
zPN>=Xdo0>qxpf3ks-lGKoYfU`!D`Pi+SYS{wmgJmzZjFqi`JFvy-$X084FI)$_>CD
z1hn5eDjs=eW@~{$^o`~0%%4~KXDweLIK4pZ226u!U%1)|o&H*Qj%Fx7ip53B+Lz(F
zrz3i#^XLS47T4v>Rk(5C?7BI78J5oicbDD~tt%X26T(dUUM#Jn4`BHZj1ytCm^}Y5
zR9v^DptM+cSO6Pn@!&fg5WAVs_T!^L0Lu!u#~v9A+PR#(Xrk$_K6C*r|Lu16+J>fU
z0e-9oq9Sb$Vad^ed@){Js)_3F=v1CXO@Bp^On?2^lZX29v0xmz7q;<^T+!`_4@4(4
zi3bonB@;x$Az906B<mOcu9uI2-xUwus=3!Porqk|s;o)W`%wtt{2KR-=_!k!mU8s#
z`mh6mubs2;r8noI!NL&~zJ>DZ=|@$8`cJ|(OvOu>lm~=NhNPOlo8bHod@r0SU-C#5
z{Vg`zvt+}JvYBaQ8QF4UvgHqDlBFF2pGP2U#H?xLt>DLEc0@^xc@Mg1dHlH0RqJ|R
zxOaFhn5mzzN#=a(HR}pA@Fwrbz7+W9iV(mw8U^2sqD}}E_l}MaVZ&BU`A70P!G^GH
z00qL>6bC{|yWZZT588=xXH`}cR{L--S;_$mD<_F_e9|Oeh!{S!6la+(>SX;M6*I(h
zM0FtL4J`L@fvi`qqOa8EGLY`lx<BFsG#fwqvqUsg33b##+qIQTn07?m)|t7R@u@iu
z48+sJx<O_kcB{U?UQ&5=PxpX4^B&r)GfE{M9qHWYYOEIMC~m;2v2wIG|A+TFC^7pj
z4^ot@O~@wD6#3lfzoFr&(v=z`iragsZSeMWk$@7l;1Ronw%T?IPc$RXk<`)4;&);5
zd+8M^4`ZpjJaqMSN{-Sd*7%^5ySGTqE~hB<y>$Szu!Je3$?4+U!am;KpBZM|q5|w@
zG;2!QI__;2h-hx>&G%zo3a5i~cTWfMF(EV3SG>GMVz%{Yfrz3D6R%f{b5i3{SlPMN
zCnql!GLyMzp1TUHBT#yHl;cOl-p?|1>I3qXbXS+1NWV=00hLA8WRbzFVq5k#%3Bu#
zW8y2XLzSHX?=qv;J(F%<P*zQ?)E^5a=)4Q&nWU_-;Jdw8<f)czL@e7Eq^Go%4-era
z*43U9+pu2^N}`-B%?)z}mp8ZI!;Jx*koAh{-={PKu7P4_K096A_up#}->$8~V7d?q
zM|)EBPz(UsjPt&)Jiuv?bi1gY5zc>=yp|JN?eQRCpzS-{-I2B0e<76(xwyhhNdX%5
z`c(9nV}*X?_|!nhP|W_GPNcnJOpogR<b~sadt~r)pue7LzE#Q|@8K+d3fg!s-~QI4
zL!Xb{CR;K@W~mjjmp1SXw?~i|-O;jMDL6eUlh(Xch|t;EkfQ?$e12y3NQFX8fZl`n
z_XH!AbnriI`=%5L0RT4Gom<5O3+@DZQ8Fu36KHCQ=A`P5zJHUiMW1}0!$@J+iKJ(x
zj5dTx*uJM@r0^9Dc_5J0%rDMrfbbfK{sN$(zeGZfbnXYfV+hUCAWMuWl<v_TtKx-n
zwrJBch5e!ydNrQ2m(G<OVmNKTxW|l({-F%XLK~QFOVIRe28zVea!c}KUqs^7JOVU;
zJ6HOZXPDqBpXMr=+E0wq^_T#&p!Wtg(8h<<2{T{NW7*+hT{BH*?|Ti(%TJ6-)p9Z+
z_|SnkILoW)RwKRleO(!o%zNd<E7|X|7v4Wx7=Rm312>6;RQQ5nu!IrY%@J4IKns)i
zrj<7t$elE}>t94xn=Oryp(nT15(RlCefF+;-fv;%{p8&;i7Jwv>fU&Py7};#h=o$%
zRZk~j2sT3s=Dd1W#7oT)u-Fk_4oiIQaPnpr-4uBu*NPa%_{|B%0`art-+yCAvVIwF
zhvN6|ak|2uKMt%49V>dzW;_jQbAH8`7r`v!FjSy1->(<5vwET|tXw2AV)Mf__c+1z
zr%hD7loiEsW?=<g2)d%=HQ*(&5y>u0(8+P)W;uHcHVaMqPRs2*tRaH=`P@l0Mq~$)
z(j)Ge-ID^=jpj@iHRub*{d4E`@=Yop-!h<E7UUWA8h%{Gop{zoloWj*Lm#rdK@?Y*
zG}--Dl)02LuJMTwbJn*?gN<ith80YciY}{%Bqy-K#zu&RAh<ndsDYYQfb#`t9oC00
z_7xlhs5}9Cxl=P;KrcD{TI_!m<UgFQV1s6pKX@b@^dA$>W$bwNy+DH+1$phy-K<J`
zgwYni7IOge#}A%l*C}6q5|9REgcGXBEw$uy@H@Q{gA&MFUCR010tvY<%OI?&o7^{>
zJG_(27(FG>qO~ZKZ5baJsI^}-d$=(@Zc*#33y?>3;>m7R$KOd|i`f$LeZnrKUOT-(
z9k`YEPBveiXgFUG+Ih=x9C|}Vl2GMn;VnV^?2s7bg2<m;N{1YPNvt+|j6mE+$~%04
zeTqN1tifva;k68Y9yV4Rk?m<_I$6Rkvm{3e3=B5;X2z9uma^O#kw^Rtk_X|LH+ttI
zXaVbB+~tc2-l-RaBmg-Kx6QA7;^7@1LEq$Pp&~oT#0+=hAWJsMWH5Z+7oyb8N|wh~
zdcu|bo_hT9;gP9zMB;OJ#rr&UbvEc|)^e2yHdF6lC&B^P&eCFAo13^2s?6@*cX?aj
zmy_k16Kv3Jzk^56zRC-ORd=+dz)Qi;0i+54S=n19fgj2oFadE@E8mi;SN-8ma_4y(
zt<-i^r&3EFl8q+@=vhv_d6O6ht`SBgrBk!W*p@LSS1)Kma*ipx%!D7pe?0<O`zkLn
zoXhVA0MPa0BnW8R$t{x~oiimZPSW)=oYRX!1KrDJJJ`0d?!i)KGUN=I8TmIh%IFW}
zO3v2YbZQP3YUX=tNgoSdGs~Ei*%sdYI@UK^8`R57DolSc!GBsQpNn^Uw+=)rM*Z>R
zh)~O=t`g9|KXkrtEp1WwimTl{2Ux3-q)wRiGaV-Lp{M#o>IwKx0!_=_I=MBeW>A>_
zHo=kkWi0#V*Ttpv#Tqtf)njNJhpff7=fphxlQoWsHHk^n$O^90Ej;-o@X(bt(%={J
z0e7P&(x2bj1tvp7EB6^GaC9A#ZcOQbeJIlsW-}7dfMdjoc4@GnTU=*MOUD?elvu#}
zjIhz-+7#rJl$Jls(3*H5EH2?KksNWoK>;CA^z(dGQG&-Y?-wx*`VJnen)R>NE!x?F
zMj#88@;?O3R8=37HjBSsTonS0Mj>!c;o{#Whjc$lJF?T%zm{4puP@*F=ZP--W(NA!
z<64SMHH@9aR^<#{;ToEs<(0Ht_Y98<o~cC@k8LQL-%=P$V9hKQarA*5sX3&VEm%Q?
zlcSMe{=1myl82EAASddYr+cW!tP_pRdni2}^^hXyp4g1ii?JuCqgMBw0$wr;@cHSm
zhQ0ISb$uzDomo;v$p2&wL~vhtvI!F~5%q@3?;7y*lI{Q3)9)pcw~#?x(+NU8(YL%q
zd4;6&s8!ssg8ypPg1*n@RYQ*3pzXs(AdIv)<3L6RQ2%NOa;Z{vJGiW21Eb#izDREq
zzB+GuO^>FF8Q3CFk~)ysj5rE-vR@1sode(*Q`@=wOwdmAWT1F_F$FYEdP^V-b{q7I
z%(qO>y-6CK0SNYkU!0mJkteLLe&Ke^b5tl%i3!1VD(;yZ1P^2?SJv)++Cz@qUW|wX
zAV*li606O<R6obw!z=*h9wks2?(c1F4L47YMG_@wa766dkak9=KqJm3yyXb|y5rb#
zQl1)WqzH-E*I*46->gramf5bXeAGW;DLebn`FK}cSY<9yuhKe#EhR^$O-9$O*>-X#
zQlxexydfQtqnyl!BkhTNox>S*;FSH)1MF-&RjpXHK8E~c*X69;<ZM4vZE72qGW=E=
zAF_9+Tx<#47+Q1$NqMk%l%-sDXyt@KMZ!G{JPMhTr|5L|siP(Fc<aU;htY0^jjy6p
zCVs{5ySa5E``3{i*Ig}P{;o+Z-Kv5H8bwda`#^4?G@2c=)so)Ww(c_ElbG4c35+&<
zJ|BDfL9piJaioWVC(FE3MZd|eU^fKCny~m5`ks}<n7M8TY4(R!YU<rNRZ_D6+;4g{
zb@y8;8zSa-w{LJaqQ85Qtc&W{bE2*bzi?LLJ_@&6A_V;0kj{yxMixVzsx3k!`3sNI
z#Db3PMh|}WG@<vh9bRC!pG@*agxQ`xH5?#aJa{u3+^il|8!ij|<%ADFrGRtKKBO2x
zkpQw-iv3F0niA;_#&XIyJCs+DSGi!ZH-kYeU{wVjvdW_jF7(^*e|2{4n-RQuWm3TL
zySJUiZd#En^mg0?qm)~jmyiFtPu4DVf{G!R<ZPjeg4@QZ4U1h4XDoa5$x0q~{i~*v
z9Mx{a6HjMfme*O6K`NrpihXd*R!t4%Ync8{f1erF{wUVSW9e>8*Qn1nOI*^g$9I<}
zDw-9?d}?KBc1xG~BK%KH{FYd-%bMN{Ye<{=y<Uq>h8$~w!(-P}Mf+ouu;aEa#{S5y
z28?r@Mu`D@#u59tcF&@+<fLnyBcj`|nrlvYT6{aw>!`^NrhB)qbP#f|tQ*}8@4i2E
zfYYgyXsTLG)!REcnRKt)52#LJFHjABQ+15Csx9k-7rn&f$P&`)JKC~v(f?saQFK1!
z;5`!14df`@%Jo<K@HsQaYKdw(y&Sor#g(IFeS>%UZWS$`*mZD@7Kzf!Xu^WtyrL%+
zcdz<sv@AiidD=S$pK}CjR+&bqPFyoM%z<F&2vefoC^Mqzz7j=sOQC&%#Ye{UnWG-r
zQy^&PEUxyC5=(;sM?YuOlE)x!8J=?2E(3!PXhKbghrbs?W|aeecH)v(3t+2%WvUt9
z$iD|iskx|jG2=UV+=dY+#*a*{$lY&|S1fwc$Kv#sn=^l1xj}R4k%>AZdmUK&jNw_>
z5cawgTG*#9{rh^kB6R|X4d5+%!s)qzg6*z#MSS2L8dYzOR-_S*rAeRd3n4wL()+|K
zW1qh@QK8v%@O7?}db5THUgxzDI2U=)GKYC1;=Cnuu*~}N=J-hqIaZccAyoOJ{XrY1
zeo=S~T{DSI>Q-gfD{x2L<<GI1<Y6$-Y&s>WJ?3MI;;<_5+Hh))s8_I44B7d$8t!rs
zsI}fvWR1R#Tuf%wK*7G2pJ7zH8N@jRbw>r}28cTt@%~iC+C2vj$yv|AHjs6|DmVN4
z0wj+dE;J%6&n|M95}jc8WFm++M#}xRD}CjeR{en3j^dQ`+Dk6t>lVyBVC^=hkZUv@
z0S87(3hlc;<>`C`KKmZbyIQO5Tt2+?C--H^Bsu^r7_CLESj5{4b%=tf!Xj@fTZ<{g
z(-X*R*qfC`xDI-8tK94-4OTTUdTjvp)Sx+f|3pO$w&Ofxwl3x2`7MD_qw0s6^Uofp
zZYB-`j)EBLiqtN9`0^RtK&+0Z)<`*@>g}FecjNw6w3$UO@->CA<(^}?l;$g>B&Q2%
zyy+xzW<hHNwVbeZP-N1Ub9Gg2=WAQU6RPLHXYT_wI1|ilj!@Y-o@nB;Syqce9oq4;
z9Ja%kb{*M)B93z<=tCOuaTIJ^SOZ0F^&#(>5dSFb5G72;(D&SiH-2QdxtWd4rrHN*
zUb}g81dGVoi7#O>a5|mYP-2fC9c}iB>`C^L+S{674ig!ptKN7eo8^|55y{Dp>0lRp
zqF)OuPUPFlT^Hh2=Wy50@iq`f7xzPBN(8UO(YiHkywW!7{y{y#sw%SApm(O%mytil
zmyNiffvli8$M9_Wfqlmjw)jt@))$%ha7x@38Q*(JX5ydQSuTVWWxjw`>X`4E6Ltx*
zew{ygWUmUdVBUb3Gt3o|!*kN8<^e0BA8!E0;zlAN2g~x^O}ZIb1iu65@4?+h0pW31
zET+e4skR?*z-7-S1R58>ASI5OrBIeMSn-hDKZvKAo=4xxdU4ec0-f5mv5tsW6Mw>|
zV7B`(0EOlMEBj$0vsXdj*3U_MAHXE~Co*#H!vwE%l5by^;MGYN(u_w*P0QB~da`n~
zq!;Y^aoE$6O%*D{$e>)3OP_-U^+x03nWtK@*ATT`#VKc{w~Ez-f;7ZBcm&M{$E5OE
zuto1e_1LC;uu;dO{RE!G+CD$y%FL}cjktS4l|3?pG&myH#`7g#+E1UYg}_i}&QPET
z#~fD`Y9}T(3(+8+Q-?j5da_ZzG(v24k`S}x!Bp>oifo3s*_N%g)vmNxCo+?=bsMI1
z7BlgBj4jX<<w<V->elSezu(UuCc>a82C&Gb%$HTJ{1bg`oJSm*C_!lC4N^uUzAz$w
zCN)EbCTIY{*{EFBsbs!$i$FO#*Z9d!`Qd4%L4sweT?>a<_aH-`iaGQ)Q4?`}RE+;m
zTPk)!&T)nXkJ_ByTCk;*-u@vGV{fJPgO|~G{dA<nx*Wfb4~}c08grb3VJMt%|2OuN
z#@5A}#Pt2aqh-X7w>GD{x5%ph@&rkt?4hi9y>q$e>(w`zSt~KXw=gG{Q6x-Fb!=8V
z->Mf^oP&@pu04*-(c0qOy83MLQ}6_I&Bnb_tKKe#GH<(w<fzyQ4d>W6#<P<~Rx^36
zS@yB<v!h6_ADeaobgIm^BX&@dhBNdaWv@45iKTMXQGqJYciVdbJAw-9JiU685<Ta$
z(+c<o!}s^orOdjg?4qAGcD5otPgkzjf|(nhklL*dELot_xAqzNMnetcrClQ3Y=@?X
zV>rY6_1x9+^rgMA;@%8k#=%Mz!+Ziu(s2ig>Agg~?}ZMwEKlkGm{Am|oR=n>v0x)w
zZVP%{caBpKcZ(D-d11xp2b~bp3X=czqR_{7+*bC`T+hGhGU=4A4STuHe)EU87xxd{
z5j_)+#sqpJ{LhDxog`OqX|)HJa+U;YAuad@%i1Y-McmQ=U*@7*!f;)5)q};cEs;)6
zYynmma5<Bqt$uVJlNqkLl^vdszLs`tQ?ZUx-P4Jq;aN=31Y{#@$^#}(K?`OGRoc6e
z5?{Q-)ndaUAOIIuJaRD;5mwn^)sCV;PHN}{_GN$$5*3GwR`1~S-Kg>x!qr!h8~t06
zMZyGKr}ys3rBMme8zK&k0Oz|;4e=b3)dn$Xp1gu`qxaobS_<3%;{{A_665e5jY3D>
z)+0WkH9T1SF*M9Z!_?2~Gs{hulOAcRUSz3U=bGYm6x5Hh3m`K%TH--Rs#|1REDHPY
zls9yWcef<IBb4}4Y);m3&03H@?i*tvSB@(c&x1HoCMnyYn~HS>W&xvebl|uoRAS7K
ztGs75lXk7_rRon#=3xL&t9{m>&k{;S@Pp<>rf>5!POi5&SItlFzwR&iRt;VSb_iGH
zqxJ`Qt|IOE`&*-n*-4d@(>l}HrA?7l`1T4*xg^4waLQL_`*O;UZBBZsj53zJ(>Qp!
zT4OZw)L%j8S{&HUhBZQ!@#;oy<uN(Zut*!^uYY8snPwb^Vi^V!B?Q^`*T&2y>yVZz
zl`+b!Vc+3y_k{HElS{uq;QSF**vbNpE-$E-To8dQA9Ws<K&mp)8@uZ<@HRtZQ%l!7
zRdL-eP;q_K$yNw@5P%)Tw_%fvp=A2T4%!cVT?Tx8J&CUnMk1_!YANlQCuH;96#4QG
z^48at;l;)TufCn|V+|yQ+-RREhoU+65WAFxTC3`(M|r*-8Q?6JI^uPCbC80N-?Fmx
zU0|J^+|0%CyODHRGJo*ixVQm{f`ZSN7DclIw%u(2o%5vE^dHB@;@<TmOuRS6jt<WA
z1?Qn{u1Xx>b>Nx^>g0oc3x#b^P#xIY9N6D0mCyQ26+J`Ad{c6ku!}05%|zWRqi@Pj
zPRZQtHc?{X3@wk9EG3iel=!+e#o?~3XH-)JDXp+yMK2xyYu8-jp*;%4t_K;{7(S!Z
zuMa~|wq_G<S~M$yYQiS!Jbgl9M$9f9*=mlR2CjW-wTBJFHm^dGO^366PW<#v^rBKc
zLX~%;PYN7=(3)vf(n`M;<WEXF-x|qBA)o()v$$uedu23K8KveNKo_aqE5yr<j0?UW
z!^lU-Fe@7!Pb5e8)X$@wb22-iQPu*0HdNO=Uv%n{J*lLdbWbx}-Xcn<c(+v4xEr*a
z=^#N9OZaa>mH!xp0}7#g)Cu=9)ONVag5$E*Re#xd3T8w+EWo`?q^g5LF;-&<ItKWB
zDZ6(!TFI71AiKtG;aXy+-Cc$0)zu*}>7G^v4QG^|YIs@oBc)4s?%t?48>d{1Jd4xc
zUo3ctGEACd9`2#B)NK}$I#Fl$e^SIMu=c_0$A(4sDtz|oPVo`b)`at9KJj8hQxXjE
zLk^NOW{90GGk1I~M+aY?4Z#j-{`f>kTAF8=Tyqu!JE?L{1YTnfr|2^=r=QHFFEg62
zYq$XK(jc;4tXa7!I@o0a1Qa&Fs)R^;^`Da8)ZUvTz@oIG5+Y{A)pApw8o8U2@V1am
z0JIWXS&86zX^EH^Ptt-OSTY7Kjxpwy7gx#Xf1<I9L>D0@V6V|1FNvtVJeL41z3Y0j
zW}0wscSo`jwq{DX+v^xy@!hZC5ohl*^^zj}XD{QX;ICfKHpA;n!-aRmJmzlRL7tMI
z0t=sM@^gjw5%E1!5Te)}ukucnr*GBS`0#RLx2kWdx*DT0tt~pTB@<F2f|}-RGz)Z>
zw94gU^y-DQVH-QrtGP~AsFxOx{1eswO0${sdannwcKIvKz30bV17HZ`#Vfs8djziq
z+hr>bHEPCWvi_3iBQ9kojkE4l9Na}!H`mD9D;_tl3i6|ZwXsQVNyR}JzS6sGPd5x2
znph3bSO8@1G^{gc%q+z8?2nwd@tZNsZi-t}QJ^qpj=jxBi=1?NZY>-?e%s~c?ZwAe
zkmOz?Dv&+4>E{$!>&IohE2?dP8w*uK`Zy^wm2=f2!XCWx@{6@<v8f)9f+k2d6jlru
z($t8sdt-WHpmYvD`GsEgRkayH7c13i!Tcs=F_psYhPzM#6){(>N)?{5x{|Hb)848q
z#U+b4#|F&}`if7hwqVg*#R5C|H`HL=CZ~hE)$m~^!n~{fvfq3y7Vm2}SB+>=!^QxM
zCz`u-<^(T)Uix~<N1c)1NB@wd?;!YV*=b0SbRD?+`rJ&+t`@H<O`WrLG-uLQ2z2m+
zO!r7l-1MG!7EvyZB1bMTegircEX*hu!P#|mwv{CB%o?#aV!Rf1-@hpRU95DTM~F;b
zSCT~IH^8#A2~e8sF}`DqWhFdWDae;$OO!0KDO`Pa`HzWEs>}KC&b%)%S%_gW(9!xe
zfj3i&8S_t_cnE(68tiUEge&E?N=HO`$wjIuj&Pt|#Hyy_MWCi-7ip6(-&DGD<ux$X
z&?51QHhGj~`9gt?i#h6hFxp|{N0b2Vt__-j=hXqX3!qahs!mHcX4$L$xL#rGPRA+b
z%-#BtzwG9MY?xN95dUsf6R<gMTDP##%w7Of{6akiEU(u37y=h_Qc!Vm6{qs*676;W
z92VL5Kn~Pi1qUixKx$>8=`a1|LLb)?z~yayj?h!17|~jQjx5K%e9uz0h?$nwNM!5A
zTw61>)EzFBx2ZZqGanSBm@VkTH<@7vtHeV;!6yYWu^yXporamATH_e%(y9}gS)a4n
z9ign~VbzuvIW*QOy7MDuF{zfIGvmxOqi}A;KauwAB(NM3AS}MS26H@%Vkc$l=#4Bn
zSzP(rspeU?$dn-6r(4vg)AS%z*YzGwrjGZ!db37Hp%MY~_#Kb4V4WUG;fX$MJjQcq
zan;(ul%LA;kAaJCG#%h*EWg1|O%cgF5jOIIgeqpIYv!?4q@T^uJ*9I+>N6y7q`G^M
zvhZ>;-<`Y?-k336VZ<7{l>3nP{3YMm%>===P%Gj2&re;1qr;#b8DcOn!FGVF3YxA@
z7?2r19u8w64y5bO0DF0#e>7z;w&mQz1XO-><*<~x$t`t!U~SoD$75}6m(2tzUYMsh
zZ9Zr7rB?w7FnkJMVyKmSc$mo|3b~guYP)(AOOp_nZzhcG<Eds3@ZKR>tq`+H^B+9<
zKALI8Z6FMoVqcOf7PIhen6HQ{I|Fl~M$eL^xNd)}LnjEWx<{q!ugW=V_eCtH^DLo0
zVmKlv{r6EBgmy7u*#u&aXuced@Li}FiZCNpF;q;)X%IVEW}b|w0gTfP_qyDA2<2n!
zj<PwX`Gr@s`%C4eVobYb*@yO0+>a(H9xw|@1G_`TqfU)RU!5mU*Jx@FE#f3!2q*zt
zuc#@7{*8v~JZNs0<kfWn`mhs+oS9t(SY&)+&S0jP^<XAU_kgM=ZoS>f994m$E-P7k
zP-~~_+)%f-uliBZo3-`_BXxrH&k7qor!JDo({+y81q(dx4tC)jo$**<P1k>x3czJX
zCbbI4sY8(HWC9nX+x7~BG0YP|J)w~3o7G3|*O*uxFgXM+Cbz|D{GV1-x_nZ$lS)(O
zmiQze7s8A_shQ%)BSfqd9^4TS0qVt7T+4%PiNi~R&s5?gh>?${!%5NC;Q>y*2XDkI
zUn3^+F&jK#IE+{uqSK=FuhG`?V0{BoQ5=NJAH+Um4w;BzC0u?LWZ8%sd>Qf?0$qb=
zGO9{8hU7%VzJ1!Ivv&4y9u*2~Td~<ZaCN6FDFJU?q8|!W9GrY`x8gyfU7_(AN9}%!
zLAd9Q)mQoT8W}hBBg1G%8eiKVFVP&x=jjV37z%N0O}ttZaZUxexl$(WQx(}b5&b6D
zuh6f#aulV@G9g+c%Ubgj05Y6udE#izl4AO}WH7b~4qpoXI7&Srr;z}QC@hQrVo--p
ziKZD~IBAMyU(pQp`nct0i327z`}>%n)vfWm_QRsQKWE0lp67Unhs`1KI;4zmX~#{)
zNve!AwL)S;Wd3z7eVLjATy0p@;g!O=vUymQYxGpN9lr`i8Zg$03hN=6(oPv@7BW$1
z8`nVn%KYi{<|>tK^5Y9N(dRO(sb_?M%}kG6)N~I`=A5^r{Gn^&$6uJ_*EVs2;OkDW
zCkT_CPfyI9#%H|xB}RR?f_46RskD**)9m9&^<}SD9=ZURt1phwiFqeXQv9PG%o%Zz
z;DJ75e`@{WNrgBvr<3W_D6Y_8=_zuE!le!_-*ocXwbsr85>pVdHtP_0JgCjHIC#X5
zI;1HWHybI|`Y7Y2FughVc+UG1EA@hNkvn6a2z1lA_D4wfV(?d<p``<-ChTtA%#2Oh
z;!@#Y8fK&xW5|O^?l$x+(>tg;NIOfj(_IWb+V6B58vM}*4>Io#iAkna^<LD3Ef}zO
z0~0J=H(LelcyZ!marmLc$BdEqMW@Afd_#ue2E!2NqyCf#VV@b@QO({A*lzxH7|KT{
zes{c6V}JR+>;9AgT(*c}LFZ+ojb6EPvEErq7_!70?nzZJ#y3WeH2EiVeIvno4-ldC
z#`Ec`>fUYL0}DLKLp(2Ufy;NBIA^yxqVnJ3)Gd>%em2=FVw;Sqikzp_r#MO<Px|&$
zwOyz-e8lB=)0rxtN{}M>`4Urx@Z&o*f*d;67!*g{c~M{9`7dHjYRR)~;euNh`s@G*
zDe;P{Th1h*<MMNqY-8Mj+U~0QObj1>QqmW(&&BVs)9+xcZ^*Zsv!9%0<+i{Q3DWaG
zP6PO;;uVqzv{SzMSB|_<`pCf4A7eFN*)g#_(4=36m?P0H?&EW*KB+hBF3u=}4DwD+
zI!P?`h#Q#qC+k!n46w44*-UqP_^x_XY<*Hn5LY$t?@Y37^u-TVUd`M!a2XOBVydqy
zARfIny!c%a&+IS&2RThN@2{mjs@{k|l$&=aww82?nKfqK8rxMV(Xt<}ktI+`;5ZZa
zwD^C7eFspJTi33N3W!n#RHXN=RB4GI9Rkv&NRuKRsnSJ3dJRRoKmh4odPjN<Eg(gu
zgkC}oA#h*L`M!VdfAritWHOK$lI*?Lde*bnUIpisj>kOO{UhqJ-L+Vmjff_J>xjt&
zYhtZT`7+{O>Gini=#dDS#*m3<NXQFolKVG`WI9oO*QZ0jF?^MN0~fS<S|$1RnI5BB
z=`XG#QU-1Ymm4qrH#qq8+?zDNh1?WROY%7%-fu>3%-anAc(Uk)bnj|LHfA7G7kn0w
zsU9nS>CQ*tX^S5F;@xhnu;1^JpUHgYv`v0wqS2GUq*tNw*fMgmk25AwY8RHpB^|rl
zyP*qn*yr!ffSraSU`Hsix|A<ZlDYI{e!hi&)T;0^57H7uXFB=iNUY5mA<v(jbUs4u
zb-XnJMg&@8?&p$=`M+%CF{ZR`_`4cK)*a+Hhdh?Sf+Etohlpy@N*RUBEo1N47#(1m
zJ%YUT3E3rN5-;kU*+aQh%~@37QDQlY%ntT->pC+JmlIWOisEYchqW6&mdvD0J(vVC
ztK||rNLO#Afb80HMWe^X#WElK#>lQ*%L{#~a~bzq+I;g^V^hoTisNIbUC$jRqnOgB
z7lG-^zS*x$tR$paM<aY2anNa1)aRLs0_OJ%@<56nYeEglSxUUTP2ZEN_TJ0MyxVJi
zYYfsH%dCj{tG!#6yJ6fzU})S2w3-FZ@kF*Mk?gW~U(b?v*%)Gtk18QNjnG8HjkJ!j
zH%*3KJJiT&pjQB7Pm*jgH_G%lRxIPLRd4vm0-Gd$SNJE7w3Q;mJ*oVjG*!dLrUEiJ
z8%AJl$(Z!<7&&`&zx9PlycB8IPRalX<M|C|&wnx+V6x^Ze#+9$o3&W9!)68sm{m4*
ze~}`IT@lIk%3z(9o5fV!H)M4wl6JYUNh``54J~T&3Lh^#d)7?(T^-KpSvS)SP0$|R
z_nL~s1)sd0eFUmsd<V2ge0@&+Ih?5L#$wh&t+98fYXI<?vG2jWstN7K?;zu;G8=^8
zre68t+~Jxv?Rqf8iByo{_*vja54D2mRc?r1Oset<by=f9u8ZwTJxLNf%Ajv)IVW`H
z+r_HzX(GKOV(E$;7RO}li(f}7?LUw2wupaoJB#yXE!p@G1eAJG`dTUBx#2mUZY+ni
zAv<q;mciD9)I7r>2`FneK9RgdgZ=o(`+uhq{CA_c@UOk<&b3^zzEJb{HJB<-BHtS*
zw|I-lkU;>A<MN84P2n1ov#9PT$GY^{UbD4wiy1|!eVFe==6a#RW;a>F7V|oIYHAON
zJ>rMA)DQu#tmhM~J9vU0&UnO8@As{6HKCPqnEjtUI9khy0SRUCMcaa1>H_YDDD>a=
zDDF{05qYGta6Tvmnht%PDD7Letnj2k>mN=S62egDA{%2~JnOlesvOJMvlj&nTABwo
z-(f%70MV;WYoj@+336N;4&1<-8hyK)zSrhMejJbJ7_A60I4<8nxNe^Aem@j7g^J5M
zoi53o!(ua8k>W?O%XJy-n3P5Xa~?(YKKs*6xh})OYB$xmI3>dZ!m|v%tl3FY1@yU-
zSUd#Ml&w`=^md`bIweAlepman(1BWcIENozdeJ9++IfdE$J{cqukH=afA{u(cHI9b
z>j<N5a!-5ibDCb^*QYF)5pc2Hp6W0>!9lt?-Yc^Bus~GeVP1|yCrf_zlD7Iw_Xi%3
z1)$RkBPVU`7n?rZU;ea<K&xk<1>`i^e{QM1&DFWg<Z|dJkh&BldHv%A==R2&#2x>|
zZk|_({kE$wqgK!GOrQ@{d87)aT%}p|$=5;}bTwFYC6@IoLRU5M<Czo-=mMYjc0;9A
z*B5^ASy9F#6u!6HF3$x+`eYGIx43>=#bp-e9^L`DP*O^sv~6s+rGYOaCZtD6n?>tg
zfKq5H6Edn(p{_A<Rv@LnI9<+DT{J)yT`uB~cRmq#rT}yScE!F>OXt)e%!tf@?q#Ao
z&e)FdFecg)H?Qx%_qYT_Q%bwrjtf0Li==f9OZCI985^J}tVzrE6i|5IV9Qgn=q9*d
zv@-Svf}vSHggQH^11+*bc{W#C6`7qlnr3p>Hx`Oq*D+%=HgvXq_g?(TdGwcI9MM6T
z$uUL*oD(x4Uz3;j-hk98e>)EqDP2pF`LyKAvVSEoTwzW#G;DGq!IZLkK_Ts}7J1qK
z9OnPJK={AZ2Mg;;ZD&g|Qn;le@dla2ltW(I3wM=f<*Y0yK&me4B3N>mwQo(to~oq_
za<#MMNW?-rRXC!2nQb_Ju`&qVr=<9edH}U*Wx?0$+jE^awOmk)3UN#A%=^pZ?{gm3
zvD20^Jg$TGtlNaR9PuYD$djanF7#%+)d*m9_))@u>A4fnDy+eCY^$2$*Nf>LTykKb
zM*LV@4BGqb(RGH0@%MQ>j0?b*)RfkWjF(|64vhhjbbW7PWARHmr5ja4#GIj`o7X5X
zYvjDwH|!IXu8;JT*I{CO{IUL2f9NrHA(`!;w)ZMts?)WXCS#qQx?fdgR5&hPN-qAw
z4@pCT!8{B?X{gd5>OXBHP?<~Io(t+b3+^#Pma@)m;x|lB>$>Z)w~)6foO4RdfA(9(
zr*p_XQTqDUjKz-a0o3mldZkYXONzF#pA3K)$`um}h1?_fCs1B~)(hopK7kNY!L@D%
z&;Aq*2KI==V8wK*b4K^`o*gsr;)>A&PG1&hQZ(mgV;zHV?~d8BA^$_=NoB85nls5-
zbslo93s#L{f0|F(4?zzsABR6!^xtbcYXyxTl_S)E{O<Q2YQqF`j);qO(EGovz&Mat
z^?3Hkf5Z3eJosgI$*ZZL=@Ot7QOUPID%F*1P1jFvr7#IsfKR{qT@ZZse#IkIL4@58
z42Cp`_x|o({I#lk{^hU6_?;zGAL-J1wnEa`*zXnMK}3uq^GU4~ROj=pJpv6pV(llz
z%1FcDOMSd{Y@X0{#l7vAREALKj@)Q!5o9e$XH<j(^g96piZ`=J0DK-Q*BPz*+?y)G
zW58D$?Jdazv}IJHNn)ohW_Z^yCU1qGE}n)}Ucphn&T=e9-mMvV5?9y&?rm_Qg`Sq3
zSAp5{W*y=)#E%p?cvTqyz3+N!?0x;}O3-(zO}Vd^R3Q-0n6iw(7i{s$A5-873UK{0
zHtWs@k_EU@$%iXb5+z;+#~)`hfB_n&1G;}I=>}S^;JE}s$XIMES`I$(7oEAQwup5z
zIrd#N5-|u>Kac%ArSfw3-cnwdLTIwz?T6Y81}m>XD_GYpEG_4(fC|#{cWH8_e3>O@
zI$z(ya<UABJZex)J&Zv02Ti$xM?#@z=!n@y@R`|n#f|Q4(LrXQE2#FrZXu^_>=y+v
z#i;)LLm5N3=PauFi!vyE59q4s%c`m$GAo7RPhx!CC~aGDkeb6t8h5;kWq(P5PE)M2
ztEE+3i>0-3un=2aNfcN<5^N3H8%+`(h{~}8mxUo@N(g3!<2IhUNBFdYjA><uL61t4
zrUo`fQ>K<rB~JHKf+0uLm4DK;t9S>btH2j?>FuQ7TZrdF-KqcF3pyAE^4$(mOur@k
z{3RX6Cf9*!HN$L<>Rihq%t{_iESw``oSwf_Y`FD$A1}uwNKLM0sM)IyPe)k~6=Yr1
z1k8AK=FSGeMfjlZg;+LID6=A1+LqMr&lvaie=rVP`z0S32~#x-rts+Xz1yM?#=sAt
z92qkpXWBmw2PyByq|g2|6I@nx(osKuu6+V6dd9nh?1uBqUYNPEyFb`{eIjxnNax*r
zc5=*#`80UlK-8d&>ijs#Iu*dUS)DgVy@w2Vw;LpuydFmEyg_u+cMtn~Q<&EQV(j;v
zC;w#hu3Y23gtP$s6y?XS{0Mk2m_^}V{noQjafnG$^w<>syvdCO*GS6q*_H;-u%I7H
zsi<J(SD~Nd;I$Ga!eV0j%Nzb;O7&xk%bsyVQ?V#y6|R|jjL>-Lt-J9GHaT|s8`j{;
z&~-DgNUVmi=~$(Ma-r}ax9*C+5wSl}@srAG)+hv%8q^o)>i1Bgm(f>$>kTI~%F<vt
zl#HiEBYp@#xZ5(o*p6Xcz4I?Gs<fq9a~M=fnw9D%W4`J+@yC1&iX!R)vR}O(`FRCX
zFN=~+>2BV1dv)&iVS@{({NQWc4+M;{PYDLaYup|5J(38hrVD`loLMCMQy-+WtV^ww
zwmp@JvHW8>$CYagz~<cwLj|PdNQ}gCP63FYT58=lMdnUp)tjDP$#bTmC^uH;F#{?}
zx5N0E=SK#<uIMWGx%M!rH^mAZx?&arCn8C?9(v<XpU*|(Us48icVpLsqCE?OA)y6k
z7hT*=P&tdfAhF!&g>Afw_&$kCnR=9ax<U{tuNrf7bF!;`nD%QzOAmB1V`e&!ciJe&
zB@W3N<6Mr(DB@n;HSvBe`WS5HP)7UhsVM+kh#Q*>Q#VQo3@8%^e6F_e?qRYbuKtBs
z*m}9n+*5avuYZEpE7u<Y;?4rhCjL?OTQ2Bd^5@uxFWs4o>Woy-*lHu!*^CcX_H>d|
z9UmMT(neF1<&%smbbpao`WjoMWux@sO708s1L#zltOvDLWAl#Xz|3&6q6#26WWWYL
z{i8%10|AIYpv7A6nfy5;ZVcM#u7|?LoBqQdWj)SfC-a^iSXFU#ZAPz@yWHO*<Fjt`
z=8??dYcf>|S&u_lK64mtp}5EDHv87_EudEM=dgG<m-hqldw}Al5G%R+8dKKVOT#Ei
z2=0iry83Ul$2RjgE{M;x2m_uj!0Q%x_Rm0E4oZ7Ow}1Kor?^RA_Gc@%$~;02bZyH|
zBoX<uX68jc1;F!Mzt3CA>oc>C^*1utN>4a9awDWcGz;pKv!q2d56s<JSe_d#kAG3i
zvZ1LU!KcH(uZ2+)V71XW1tulDTEh9G2t5Eq$ZCDd9aa7b%w{0<lhB$v(_1PbGg?6}
zuIlw1O-yfWUs|=Ys#jA%EM;GgfW_gfki4*dw>3V>iuZr&GC=$Uf`4{;qeWXTwBnVE
z@bi#|)$asIQdGuxKXv@^AHpD4OvX(8a5icG^aXFT`X8s1ts%<+SpkK95oOR&TwGkF
z$h4Y_*X*l#2Z;z)al02<1<M{~be}1!x?vnDL!V?j3iaq45Y+m%p@T`PWZgYjJVcU`
zq&%de{nP#$k6y|NQaN?`oL)x%fyN1wjOhcannixUnB^od)=9;Ff7oqwTAa3z{_L=T
zaLR^^=MbExt+#NMks+wCm_p`+XL-f}rlkb5G?5FZ{2O0Xy@KbKM1M_bm1G+T*V;SI
zeL}iEJ6@c1C)(MeHaM=^cAgXVyXIz#*m^>eVoUt*HVp6|l@Vrs*PQd3&x!ArhL6oS
zAO0kKb||1707);aTIV#1bfx5BCtuq%J@7qvlzPf(PP(<E8K1%bN6!H0ruxJm$OvJb
z)_TqE7@I2ZM6(uBKV7t>(VSje$iQvxuJt6Tky0-Abh6gP7OP*&VpH^By;j<y04NGn
z(QY{af^*$HxPPRe0)PPlI)d^UMTf;P8E{-<{{FD02SSt7>&!^1@#K9`LLWCnt+&j!
zWyQ79j4>XUzL<>0h>0nXcT7u<kfIsevTQQzz_Q#2+(myh@zHy9*%hyM07(C}iHL|B
zh&$MqQ5eGQhFag-$iojic28P_H+iP0OB#wd>=%Hk4WI(>Yz&ObMYF~B$`z`o3eu9A
z39-yAvCLuj4<vKOizar<7VAo8q!~G@MwaM5_URg$`K<V^9B_zM@833*VNL%daW#I7
z4~PerL1<0Y6#m3RoW-b{WEg0QDUx1P{7{-yIdE9PhMQD4K4?qPBW^rnv_i$bhK;hW
zjllay$H|M!h77}vmh-$#9!5i-fQl2#^Tg?q2AT=<;{v2sv*Zv_!^fALm6`4miu;TV
zLP=2h_Y6L3%S+<1u{m**fSy-Y8g7%M6q%A+DUdVCJE_!F=Wt)q;3|0CpNgLXfW9KK
zKx>IL05TL3HI~vkzQGIAxlmPXIpQ6HAk#1W59arWKutuSvVSkkOTGTL`ADMe^@D-<
z{Gz@d4%51E+U(zD|5X!YU4ixLWSOY>hE;a1R5P+d=WOO3kl9b~YLMq>)W#Gwo#*>@
zN5#)6Z)apZ1cgU^%}7M672P^|_1UMh#OdYF`U3s%+NjkMAgcptytAKeL#gQbVymN!
z=D5rmd4l$t>uPPqyy@!3@0J73u8TWBZocuR0cvnwu&+b+m$|l)3Y!Sg0YT+t9l=H?
zDzt~4Lq7)lC9Bj~Y#110@}(@*_d4ND6QiBqt_Zj+KEqFZ4n3-sw;<^x{hN;aXOICa
z%{S^~aXzg*|AGfS2$JO9k3cYW8$OB7qOJQVuH<8u*Ko>-39$qHeyMc%ehJqumBy08
zN9_$oZ<?l@Sq1CnK!|3$FQ<{}tX52dL7vT4C7pr_3wOazLCz}TwC0}5<O>ClJgFtK
zx&(U5c!@7apE%##+{k>3YH>`LOZDK*>l9(FKYjG!M_XRr$2LNsBq3$Psuw}+zQ2Ek
zywtzLm<By&3`{a+e5$G>0ufOW`h92e=~OXE?IdQ^MFk9ky*hwnKcRt5)oysKR0wu>
zb@*%-R<z3+k3!hQ6-umybA`16Em0i1yPm<qal4)^>_u<6?C)Il*)Y*L6a6M`O7j?K
zV$p8sWb}Bv#oci(%II-j>Cfhy7j4fms^X^5g}5X&&M-KrW08?Fs)DWe*2`cs8+Xy^
zwV->wE=mcDCf$`Cz2BbCCmmXnq)6S?axXqDC)fzl86`g}!jOCti8VYq?O2P?*i^V^
zJS|+CR5hF~on#+=hH&X4sl@qbVBkr_B`yPsr=Z6ap+WLwZTC>_ha`|!U2aB5U%C@t
z&5RpcT$~Bk%p;6@b${8UL7hf0+aLoblWX|n>Lty~B)(@xbaOf53-z+(6<>tzrfvDn
z*&q|5GTaVhqI-GaV<z|VmiyY@nl}<YDBTK%2$}X7@5w7BsMoWaLJzeQ^%)3~3MLc2
zUQtfpp?*CU0I`OhSG^$jnZ(lBk`gCKUXP@fZvZ<vd+ILh*eV@6q$yhx7I@v-ClN}M
zs&%>Zzd|Sgea@r4ltS`y1rDbD<GYej@TP^XYbOgje6xic@VXA|@)?B8MWFEIpCUS|
zJ(gx#O<!lsS~RAkP|oC&{<jDnU#n1e;Q(%VtLrtfchs$f#<*oTh^w1d+^ztB-eVX0
z0dNel!<;99acu33c8SDc%wSBMrc%xX)cG5J4xS3fp1jJ;h-qZWTdYBq`i%*=Z=+Cq
z?vGAOzia%saHCmA=hIBZQbCh3ivS2#GUm4gM&c9nrN4YCV;k!r-<*}Z+Y{B={v^WO
z1lnkY;sxS1zAPdivjX!v^zUMObe5V~3x8(iIjYO}xJD<gX2LwD;=*=++yDU-lWPwB
zcy*xsl3ccbo>tq|WTTb7g7L?;`rb~a4s!tCq`tqO05r0p77(KVvI4<gNJ}wOs7FMf
zm=q%ev{}HbDRnuqY@x4oj3a`cwlupx*p9q3sq)S+9O_Qdkspe<i&4wm>8}4&X-X+w
zS82@yfl%8-z$_O&+2;h&zd2wn&7C@5$vK!D-Za=;;N`w}TEFC8BHuqO)^PEYRxFv2
z_PoW=Z5tH^@6=_7T#Wf29P^&riFz-|pIUN?9Q!2ZXz9F6W*J&tkl{aGZKKVbGW7U%
ze4%8S9`B1jBZ85))QNI~FPa9ezeX{x4c5%7?^sRWKzcF3I!eV84KYT3iLupU?uRoj
zy%p|oeT|)}^(xWckTqeV9AUp)&&dNF?OY)5+8}TKNi<NjKEUrQ$ZceT$q-2<#10ay
zjkGaZS)YDM`;K12wm3uTm)iH6><&#130wBGMfVX4IeGRij7?eZIqg;5eSP^L1C3At
zj$4HVkogynE@W}X<OpFpMyGE)_i3Z_N*>p)RvhTJG;uUx&l0N4H)u-hEEb_w9ZND1
z+P43UXkWQ58wNnpIB+F&JX~klGkN4N>wCAnArfJxk0QuV=<Ckv#42ikt^&d+hA7`6
z1Co}xM6(oiVUJgSOhaxY%YBC&cfi^L>@gW^L8{>yzmR6$uS5C3p{yzB%)RHz+>7tu
zkof&HF?5_`yGmF_gpk`#k=<<$+3-Clhhk{9fzE9CCHv1-Rri7+Z(?He*eG&*K6VFf
zuX0hVFqtpI>||^Ahy?>b^>#!e>v=w+hKj(>%7e+F`K{_;df(8r!3bc|V?K`6#Zb!F
z*uqrZA<vYZxA@$Xx`I68(;w+B!*=@O7pJ@uNt0)`sxx)i6p2H1y%c*)CG}ct<jpUd
zsUVb;=SnkJ5o5$Fl6F|_p4V{x_NCr=dJnkqII;@chU6;em^(r|TU!+d$2C{ijII!!
zKhwi*UEIrJ=r_EmriJzMuCfk^CLdkQSFf$j9@N_n=TiCU<DykOe;yUWGcbGJLUUi8
zwPyT~xdkm<>F{+`a2yERYf~^a&~)}=*~)$YMRNT9Q8&%GWc}%{uDwR3^U=A{1JtXO
zv2D3;*_8&3LdCv5My|7XDWcx;|2)9fp8u+Fjobs)sBWh2C~mz7_Da=G7I!Z540TPy
z-oRsH$gfOM-ZyVFJP;*u{S$HSi}CUuANGj%Wio()MjhTOIEw*q_%hz8a}g{C?zO*V
zuk_#GIx>E;b#>vpqp!m^)Gl@p`-VDldIXRQ4|AutOw3B`FXdhrq$#=9WpZWZ!DrwU
z?|Szolu|r@4L!&Qb8E|F00ZqN8G-u)k=UcT-OO?LFM~#oVsGq(i+o;cVtmHAb^Sh6
zCjnNP=T{*-x4$D)gHkkI{>DyijUV3}{S~yIFQCQ|cL>Hl*)piftS(g_H@MiITYy}w
zeBhMW*lp&v!W;!ljTdQrotnkItv|@o=O`b0KxSdL$~d6t&>ZdNi;6-uPvwfWR5BJ<
zebFElYO38TI4Jg&;(Y}ThdAd?3*1l}e6Y23xbXJz%Vq{-+I7Ff-I-T4Fgcp7hpI#v
z1Z8{fKq~n^nQ=JRe^6hwIjJQNFZs+wxWA%Sar@%F16~Ty<hXVbAaRowCuw~h&LuC@
zbL%N4x;os<!F|J8FK{`Yv}TI9-Xj8xHO>_Ne~|wF0)AuI<~uptik<PqUw74|+Or)w
zdV|a&bDuK=(&fL6M!B%54w19Q!AFDKe|>jy8C1Aq9ww~{7s>aXj!OSA20Ck5ZjpeM
zW{EYrLuJ4-NMsUl?cCAv9iAL^xL)H9&)nHk6l-bZOw6hJIc%tG^FS>TxMwU8RvVr1
zYvM?=DoqzV?Mts(9^%%*97erZf)P-~gr4FB11-s*YwHX3J;xU-ZL~Sa7ALux3##vM
zEEQ|v7kMB~JvE<h-}Dn6cfNO#<IJ0(jBIY^w3|M2+{FB97@G{5It(s|1YMAOLG&XZ
z9qt9eBZpr?qpI0$)nOcDgzVPiTf*OL(7v8@68qm$#*B2@xx*eFb}p{P?r&;&gR7^;
z2VX!ln&P&x1Jt7n<nDQcMrS@=<S&_6hYF2~-TBVOsJzB<hXn%6q2J*?M|};)D>~Pj
zcXtQZ@;^QyFwxjW{ub_$O}s=sUQ;NOJe)SZ+JVEWJ-1x8lSM0bwHK>Aod>Jm>l5(^
zVL(B>WlAhjJP$zm2KLj<J^h+n{a+O>b;tSHU%Iom^6Wl)I9XTkUKjr2hrPBFw#nEH
zjw9pREy?@6-ccP`2^63^+~^Hd`PzN=$KT9GpiX=BwZT1ie`U`HLtar>DI7Z4*%TG8
z!|hY{l0|sSybDDvoN_r#HQp%31Cpe!RavHhRlbv5X0`J4G>pn#1w5b=oUQ}YJ<q(T
zXWu%55`!jULb4=v5H8rn<`mzZg5ZL?g35F*r81yXH5kaGJ(rWJJ=Y!+h0WW^EA-2z
zz)Ba+57U^8b-Tkb;F_<bAdj$oov|sfo09LH6hmFh_H6UP=Hy>FaV+k>;Nq7rkLGxk
zSnkbOw-;zv<!78f@xc-aX_k64Y#Vw-%uU>x(1C7Mvkc4_5L6aqzn&}~2t@g9sq(5u
ziN|>H?~P9uzuZem>;BLM4q61l*D;pA1ukUcfWvS(3x+Jx{B3!hD5nAUJ_`n*&Eb~Z
z+U_G=4{>}XO+RU-f(oPSVg*|iG5K79_)H8TXxCUgz$kH#&a2J)$+>r{J)i0)Rs{a$
z(%u#mFfvf_SnF@!99a)On-Yvd+=WhKmCrM)yuyEV$kwm5RFEm?iX^4U-IOd~(r2<j
zT{@Iu8Cg9Kl7f2!AnLL4=g-by32q*?KyO#idx4NK++&!R{r4=g3iFY|Uz@IW8>o$$
zl1KhSlX{=WNLgOK$%vmDr=Zj=Eyd<HacqUW)zZ7PuG#{hn`rfr+1$4EEOUEXL2%5%
zSiaflXG0;i;cc$<y6yR$<lQgy^?X0a?8!h)n}f-vnHsYCh^liN3aj<^7O;GT&i<^r
zPUHApZr55Fo3L#czB5b0oIHmU$C(VV6z|pm-9&N|?dfNV4!#abGe^sB?P%L`lL_?y
z={!A3zKmM?0vQxrqx#4tHka<G%(7yE$+zTblu6GN(AzKg7F1O{^mv4-V}})pzUKqg
z*UlU<?Mfcw;Z8oW6iJ@`xZ?MS27;uFqb2Ue`DMAq;a)v4u`I9r_P~+$qeLss?GF;h
zseCFyCaDRW1dH)|qOThxtAY8w!t^BN3Z4ccP-|B8H#`%|lddEZ<T|lAhxH=MUI{{n
zooRyVetMd)_JRx&Vxj8mQX9?5Zf8H^MSG8&1{i34VA7y^_PN6}4BW|UA}JxEET3~T
zgk!A?-{z~O2}B<;PC-;We_~eeiprW@KPjAiqc4!NVzZvioo6@`zl}BZrGAM#$u&e<
z)E^I(N+0%8TXlC;N91n3vY~Z<S?v1o<sMu-08)HJu)IKSAyLg(Y#SICx@fzNW1@kb
zE5Gqi_Mfc)q}z!4cCtWOlTz4z@lDs$+lB^1ex?^N3I(R-1ERZJz>uLf&!svgqirTs
z5LZxybN}IwkyNQm@Lz1}dfE&tv-oSC)c<h)OH1$(LHM?lMa<Wz57G?Cdnlfgr)Y_^
zxs#;&9^LYqQF>}vSpfa}P*9PaYr(ewh_m|RX@*g#i%Nmf5#z9q2YDK5fu>z&R8WSO
zy;zZRtZ*$l;|=<SITeW=yVFcegkF1YNg1pA=&YPR9k64A$AT{FU#F4D4e82MlZ3?5
z)rNBJkox`nAdWp%{uy<Ls_dik>L{^{PsMs9iS@{q=O$y<(5kevHltsKkRNny-d9q`
z|0n{r6LOM8*?r1;TQrUP{hu-ijFF@VBBF<32qyAa2JZjB?PK=js@LZ6OrB0)s8~3I
z1r+|1IkZO=Mb55d$V4eo$FI1?R%2_VneN4Ecm2m-`4a4{Gy@$pchwPhfGB_Vz|E3u
z1kUEwBV(5>NfG`P5uiP`p#{zqHnR#B@cum2c{-J~n3yrXst?N*jG9%zjE{me0Jq~%
z%t8c*QAk(GMlS%eZh6m0X6i29#MrO5`YeQ}ks%)de`x)dmy__IPt^@6yS<UmQ%#3r
z$rc%`p;8B^4~aUZ*@f4Yi>GR<zv-2?T<%T-C~IvhL;iU7e7R>e{o;Kf#I@x^jrBRV
znywTuG4MX~KR2W-?$Q$`04lZkSn5J;*J#VFW<!xujb=89BE4hDb4sqFjVjD9b@H(<
z>J+S!r{XBVwBEm>?%5Fn$vbi<ZQmEOK7CfBrCk<p*iZvI3`Kdg#33aXGxmm0O8uf<
zSWmTVqZ0(&t~R`T`J&#<<Yc8q&X%L4u`Z7t6E%x-m-Z;7#V03MTwTIv31(+q_FVzV
zinQRCNFOWMh)HdXVdjz^E5c9d`|%uHQ0jO3$>tLL5P=X*)|P1dvmXw*0@?c;Ey{V$
z@W8}NuPGRnP@BuS+51vJM&8c<xxTmny0y}3%N%*U@P@T!8W{qp)zqlZS!UIu^Hh~l
zrm&R<Rq5JhrjPB`Vo4zlHlqQaFo-pBO{8G6)q8Xye3S#pn2saL#fG+?;)Ni_&Dw;1
zV_~5GM1VZJ4kqgu#7W7~eq9ervot<3@Ut&aE3II9*;V^<ET{}&L0jXRVKZ^^KXb&b
zW$Qo+VaiRwomx2V$}{>$Jv6ubz-nTBAFiC0RU)QM@6-}?&=?baY@>OkazC%*kxGAj
z;9lQbY5~LU8IqLsl;}Vi+rF&4UyAEMD--PcoHHOt5us&P8Z*s4Mgt8tH96ENto;vD
zr%sXVwt84}_gFFQMB$D~BbPKHF0v`v&2K5;pu*itW9DqY$I7!b?fAo+d9Ay7llDkf
zThZB7R@cCn5EE#5(*h!WdL~F(j<v02x}~XW`ztGrYGUftv_CUtXF-j~@AnG+nGAr6
zaRb@sb=j!G)l)g!TO!aF`x3mgrMA9wWp@ifny;Mg`Lglq@zo|DlmuNaN$AQmJH;fR
z9t22@zWTo-5XP%pe-Y8q#H@E?dX^L<Ndu2fRhaxB21BK?z91}W$shy)tJ0Ye6)J`T
z`ALQvtZC5GC=SIXpBEo}=hH=3eBz=2_napsZ_D#Pju>k14n_BEQGY0zP||8H`)$RV
zJWM*;)^q1`njngjW74WQ(jMEPn!9%4<b1kMo8RFJ7(w5^j394rKksv2XOZNi1z$VQ
z)59M9%DufRlM4C)>swJJwY+mJhq(ZuQP^`hatLyqYXV%b((Q=16K397tJ;H=uc&^z
zig*-$X$Kd9&_|W5C=<S|cX^r8D_z7=lJ;xfJOVHj?c3PQq1Vi$!hA^q*X0D6JUM*x
z)Js_OvV!Ja<BnDmPvda?+p`-!5_wC17UNM&-g}(9_+iIYphah;cw1mSXLq$kDZ<`Y
zL4)S{t*Gq>pj{IG?OHaguI@Dv(21eS@J^sdhieKZ!8GlrflefKN)qP~LmLMaxMI_t
zX;fHT3Fc6N;o;g_eZR-=8k?%9&YJ&nVuqC7z9NEcRoa%%J$|RPQ$>4wsPJQ%Ld3^C
zEf=em=bon@iSn>R?I5m-5$!N80X4XX&w<~LQYoZZG12I2g_cuAd#=k;UDevcyxL*i
z%6`Mx$0$R+oa)D}yMZoj#VUygFO<?LIBcz(B1@(*ON3r`=4LEZ=Isemv`fCnoMUNA
z?C_z4;0wo@W>=jFH>|MoSyh(e3@4TlHYYrr$|zF|amOx4R*AQ?mln9jo?V=m>%*T#
zH77S<H0w9SjDV0#fv2#W*H}}HT?rqtkQN)_pSceHB$wA`Y0g8sJj$r4zTQl;=1fur
zt64K86fv4=H9Y7{0YG;a8x9~e>KyevII*IrSI=B7ww^-6T`zEf-AoN7C&L|I=++b&
zw8FOI#BO!cGu(T^wwT#q;mtL;*LK`2&~nUofj&o{*YP+RJ>QfB(h=@KFs;X;$qP0~
zE#AOSw$IDsV8}OoCchX8clrrhZr0daSSg1MN6~LgY7Iap#0S~Im$#R(FR}nPw{r8@
zVN;gpgBvE$w3U=$KW4k{r;zU){SYfG&IUZx+%l(z2y5rL++wHVhsCme-;JP!333kc
zkdG-4q!i^@2r#=gI-v;GP8aS3j)2b`b!HlL+Nr~e4z{SRmc29=Up5*RH%4xo+N3ga
z0sI@#3Iz=Wj7{0?Hl-g&@x|;;-ton{?%K%3$*|RN$=moe>*L0cDjwV>8j3cPc1lx5
z82<wzUQkT)A-tf<bwiXgI_>s_i&+MKhme(nM;-gz>8|Bii}+5O%Pv~N>No=sVX==9
zs(PCFVT$IzU&Z>zFaife&1(w8aPi-F%D%c|0_8Kfy&Om{gE|$ln`d@l&d?Co%zOV@
zgXXJ7=^z*+6Y;B)n;kAmN)vcRT)=t#2F)%W!EM}?8*Z7zK>i#Mz%>WD0!S1b8EXy~
zh8qkKiA7TLR+?08ogm7s04s^qWAV||iHR#Jx_{L0ByruzW)4V9Vt5>qu^i;stL=H5
zDyV+(AL>XVq|muP^C|_-7zN5B6W?}P#2L=r;3+h6pQI2v^qbS;uZOeJpe5^3?Rxi?
z#VWtZU@lHNCOGGAQnw~IK;rh>h?gJE*Rb0GG%9O?WwOqd#x$+uUEeo#)ua~%ROx+0
zpYc*EzF3V&did(QOcZ&pey@S0H7H8wScEi*ZYv$F*A{l7=Js`>f?8^r?JiL1Zb%$;
zyp)^o=zl{Y*^ifw&rpDjt&@L@wCoC*wTvyFN36N70n72lfvjyTE(a#5NEXPiJWQlQ
z4x(JrX61PTtabLV0?E;CDs8kpj=>%{xKFB-Io*K9M~&lrG?%bWg=4^4tKzsYApUn~
zA+Lq{<l@?uD_1Tqei*pz{<p98W)p$2_C(qdW;p(OY!A0oYp~fBa$f39JZqV5^+<Ia
z_OTf~wL;~MApQxo^@J5#rFh2qbyW3H_)t~V(ChB+Rn-ZiGjJO7@tJ~E;TcaPTw4C>
zWBKUoWKI$n$d;p-of(YJ0ux<LfF-oit8~K<bG+@&>hX5ckKD!0?f58E-rqOKi^=nl
z7M1hVsG6d0i@9L4j{qjuA3c#B80Z-wAk^<3G$U7faB$+8P<6UG?77W7qOls2mZvlG
zU9^bk0=1f};`fB@===Ezf$n*faNmZAtk_0uj#F1RvbQ!=^XKG3uOQ`1t0XdBw7>US
zds6-_2L1F}t!8Yo7nk493QO}YwT_DQ;LTW9&U2XrEVPi-FH`IMt`;UtwWr<h#4G8s
zo$YMN^0Z$JmBWdS(lEx4CSHWLC+=IkI<B3~c1-C@R~r`hd2XkE@IWt&Os-++TTWh&
zPm61krQx0{JNm*tuKVnh_Z)vof=!D{c{u0s{WYJkM(>LV)Q)?pGR3N(&-P5=azHl6
z;+e!R+UohEc2%>rSch*u=no!7Ue8s;JfYs)o>3~bN0R8-R8gY=3H<0Q|9spQx#r9o
z$5fKv*r+*ngM%FHkVi-^dbO8{NuUg7LGfk&6_wjeE;0V9a!jjP&T9WSJ@?e@_$XT<
zh5YCJjoa6?@Rxgr4_XC0c71;!{fDoDa8DloaDMlPU;OE@4_8-Lw*%9cc;HE4(I11&
zvSPOhv;<KMv6P9Po>c~eiWXXM(ML>ejb>4|C1fQwCXQAWs6JWYqdmVU@QY>Mhu0r>
zu}H*zm9)2Q7c{l`Ua#g>wN<egi?YstsKw4KlQ4VCJJ$d+ACqOL5mT#At_jtQi0=zE
zko_WYzmLabdq*`ULv{tW-;B{0*++zzvrWH(BY-K0l;*O<71Nr$cIFf66_pC2a+>|C
zqv#n{uMOKdj_=9tuU8)3kF*ixx)9uY>}OsBnU2@g3fa8NP9^Mi(d5wEZytJG{@p(x
zg!lZb%JYkgG!N+<teq;@;l%Ebrtk1Y3)7NQ6h!p8(9dOxlYUmVguj=<;&S6z<vq%5
zd0oll^8mQBQIeZ`@nDPJ>a~)dY9acRi#1~a+lu*+K?I^D&A|04K{>Y#-vCo44F{fs
z+7~$AFJzy1|Je5*4$9p3-u0v1a~>QP1W!FfI{U0*=hca2ZBa8ZRw}2Y(+OE(vmx>^
zd}gXoc}0IFO4xb<(?f>@IvIpK5}vs(pt`-5y8I4EQb4>$7t0Gu=7t^GaKwRCgn%Hw
zB`iNvF>Ffa8q?E%K0ZL7&LFD9faIHjpLdg>Wg0gg15Ldn6nl;*Sp@c=>rZdzvV*62
zsLOlFTv=G41p}u`V_fdn#iI_=y@B)r_;H}>{`tL`;~>9`F|X#GXBZzOrvI4oIy}QG
zV+GrW`EcAlg7rQb_V64YmH;20%@WNGW24W!-B;CJMiSsemCDjA!r4P%@;%)F4NtPj
zm>30xGMf%b4?n(B7J>|suMUVyjL5F|J3)$kXH|`DrNGaaP01eJ&WAAGxAQ*AL(Mt7
z)qwWMC4e}PspC^9R{^0r`CjiRpZ#;8OpZOo@>D5(F6^R+Xzy_r>BXa)%+hA>xvuY%
zF40MwR)jx_@ctBECCkzd&9M4%c-a3yF6fa&(l(6xwCA}bxzWS{OJTvFE)63StsfYH
zg?=FDpF;+E&t`Wm5UpXKFY{}b_P6*oHb2{MUcn3_>*sNLgSkX}&-c--NSyP|-QlnU
z-!JpD&kpO)Fx?xA$kXR%2DGNfen9N_gt(h*PR8sS$t-@12m6<$K7M{=BijwKyF&cW
z>Yi;qqs-QzB<sw1O)g4Se&#{vLXU#_*jQkQbwh`q-VRLME=J9^_$c|F?#K5QCb@@s
z@6)cxEAR=&XO*+x2v8uUyZX<^y}Q@pUAc21hycO0TejCy4LPpUPb9VnLwclzP|h;8
z?_p*vY!hM6d8y0UqrYT1xj$HeerPc2@qc)FqN*hBxmnjPA+ihlISly|Xb_$vpUMTv
z+QQYkgbQit(n4TM7Km>^TZGy6_l08lPX`rQxRdDd{qD#%y?(G&tn+<Qp6EHzbp4_1
zcJ6=&Ul+@`1(2Mw_Ss{rBoTKA3oE*H)1@8hM@Q*vZ2`_@5qSP;Y)T~tlkOf-clYI$
zn4sUKn#qxv?DDYt1Wd`o<wu1D9?~kXllkM<si=lB3gu5;hmzhR?(J2L)X49FtC+x@
zTGld^eom|@#N1IFMxNG?+6@bM{P11Gem=emCi14)9NLe`paKc+k|hk^0SUVy>)J4Z
z#{@f+7%|J|=kvW8n6tWJ;Hk+n`r@HwCkvL?nF{Z!AS-q(2h}<BYN>P4qVF*+Pz3i-
z%$Dv>@laQgecaCZ4n>ldSNOomIMTdt^{TMB%s-Fm^5Fb&r0MKzO*?a2rC~cE*u0y^
zOP`P5S$8fyC2S-*5&1J<16Y3a&G~b-1~AKhMNy>6^H;F4y=)pcV;*^o(U&(J9r8*i
zW7K|)-!pbgg!S!*L|t!)N~#i7kqmuMt=y{C@=iBq7d_|*hTM$f{lo48DB{?P2aAB1
zFFz>9zwid~OT4_9{?ev^<(1EvyA+aF;0~}us+i<5^zw3%Z`}68O%O_hiEldmtuXie
znnLr#rq6z|)=mb!AC7VU+Tqdt=wY?<hoiJ~C+L9;#xs%j%clxCu-wVnJ%eG@^I7Du
z5Ad`j@!_m)Fc@-r(~0pnx&B+ydsw1{gdUq}>}Irv0)yT@c{z=E(Fx%KW)47N{|wwe
z$?T=+Gu{E=ii!%DYP4q}Eqcru`0DPvN_-N@+l`6BcY6b4Ub4P#F{vBK7U6ls+O+is
zmYII=L{YJnMaJ?l5GhGH8Fe{cX?IcfH|Y5bb#WsBq}9~UB}vhgM=d<}^k&MDnh5xe
zc`97d1b*7QLN7&ji?}Xdj;N?PR5I|vgNNm<K1-|(dc_4sdmqoeJ$R`5<DcokJ+}oW
z=jGm;)-5W48o?)M$6;1+BSJLtgM<!xcF8$rSO!FiHW)ZdU-c~=grU(tkgxE3Kqt=N
zQ%rP*jc-ZN2vW~4CXmMY%h_xnaQ!<hSi^pmmBR|Y?Fe%T>pgKI&))ssLN21#mp6EO
zIn<WD-q7{&PhiUCm>C1bX=VC{oYiQ1hmA52wm&;X6ia{nXZd(~4dV~2H!czppkTxC
zFewS&OI{vfn|Cw!{cCp7{t+oI4J1dM8xMYetVZUKKooSn=%%!2u&W+P={)B${PmVl
zhRTkv3WzScnb$k{7<VV?8Tx!T<HJFE27xaR;qvf}9l!aD#tXEU#wjvOmFNihp(XOb
zx6FvLdj}7;pp(Hui@JK%4-7m0uzkL|3XFRfT|XEI_{-Xq;N~(F2YaW<Q%dVO;n4|6
znpUvCtq=0(1=PU8R*G@|sTCPA5bmj0{#2%Hz7-MRd#@b-N?puv4D6DVwfZvx(iR_Y
z)5&tC5z`}M{eBK_CVDK2j<2op`dnTa-nD4X58?sx5Cm}@KJ;f<jrXSD79&_UcXG`3
zILmx>IFa#tP9~idXl%&@SSGG7&51ao7)cKnK63t;LFH@jw&C2dAa>$K>9@1AllI{d
zi8Q7b&S>!7M%DEr?GMg?Lo{pYTm!}{^$f;$kUevzXOKZ}lP&e9-3xRBg}*HchJ4+8
z$SCAbC;TUTxk~!CF>vW*Nh!*eirMFC+g#%5cT1iI@~jH;B2Y56C>FNyexUSdS?+?p
z(Dl<zR;M36t(bQiIRB<d?}q*94=x$w`nT|!6UYQk@N+zjT~_Ra<XeK$P;Sn=c03fl
zHX2WbIDX*3j2aP^(^S`6m${oc%I6UI9+=rAmnagIk`{E|^9!Kqq5f3=q`rTX;fGJJ
zS-sNG)eTvf4LrR=28D+BFfk7b-p8va8K({#Sz;8jqES{H`3MlT2iiuQS?MVT$W#7l
z2vLkvseJ|Yrs}FlVr1aHZvN4*(=q4?O`i-=PtY+gnD*`2E;{-x2vygcL3NVfH+;j-
zVZ`VzUkmH*@y+x3&IKy|j3D|WFC4#Zpltx~bet}E?qzf}A!`itB=)1@UAtteZ?7wi
zHtEE5zpaLpD9jyXmRvN3;0w|z(npwLauDllj}uY|7=$w4PlO(y_LI%%emAso*a*J)
z%Pq=&T^W}2yUG6h6-3STig1WXLe__Z>-^AsrTXqnW<h>{o%QX4Wpf|ua*w5%+CVKN
zolz@n7}d9fj@-t%?H&dfF-x5S9@57_bGI64--362N4$*bhUJb8mXTd#bW#3u!b{6|
zyS_iMe9=fQFz;F8yVf>T<C7O%e{ogZG35K>#UJ&w1frt#f~HWi2q{*lC|S)4$6v%y
zO$dr4IlA;}s=!wNT=oc-cuFTFWXdKcZBr*@HBT%Y(i89`Fz+oeziPFcDrF=R=us{g
z;`L`qeDdgWb>=xk!7v6=Ww~_&^(5RG;sJU4u9l=&%?oy}_g9ws=y2=sRP3V^-Xxvc
zSEL+TO4L!hIH<4`6G-$XGA;nBlr#{hpf8aCRdw0eJ$JlFN;o$-5kNnj@jmm3p5JeN
zQnf?SeBpg@NE7TA^<%&7f@A&Y%zJnL@h33t+Hj>RK;L{MKJD1dw*-x2^+)o7K|a&V
zJfeta_obwnp&1O{@DBMxV|d+3lAo8#5%_enXa>sP07LCOjaS%~HfqqRBf2g$crWJ>
z0sDNW(2g#he_8AEOA6)`fw)eN&%$`THO}}c$)K4k|F7dzK=xS)#z{R2<x*Q!8hf5O
z5;YVS#wgTwW_B7|?YLZ$v*YiDYEA3JygR<SgX2s1?~WVhVKAdmQYwtr?Nf}hKzm9_
zR_r{Mq8uNs*Bz$xrjrG*X)}MDwAC_+$nhaqw;CT=xdQ*0$4KB|b~ONeXSM%N;L8E{
z)W=sbahf#kX2Po=;H|y<-g(D$jKIhNy~8OiHGQ7>@uvG%7VhH|nw#t!!WEK9ytj~&
zbyGkSox!R1$}<tXPzw?C?s<<l%?Y}7pR;3;*bCG-Jo;?2{t!7tk8R#RMW5654NF|&
zJ<&2I1ALs_LW}kyx}aHF_>k1%cXMjz+YRam<q8?*+a2LJEml0z%(g7g*ND88e%`pI
z7WeK;K$0`!d54^>RAh)!iTn*NZmk+JX`rW^l;z~B#wjqv8$vN6Mxm=D|ALTDqA%qV
zpgMZQRSaWcT$(juFthhDx4<L5yLW;#fH-)(qyjJ{#Ja9onOQ1h1X`3|n0Y^!SC>Gi
zBxsUU;$-l+r;70@%{Jj8z(B5EKk?|nde9}#8l24jaQ<+~DAC?a`)}CJ)7mh}$A`}w
zOVM86GY`G=C4n2P9SdF>6IwYlxOa*Iu7-MCDcRb4r(-q&2eM8s<u;8qb}>`3K4Sy8
zX)&DY5;#@65CKPP!4NWQS&SF-Uo?%*AN$mJY{f35atWAOUQHZ>UlDb~8vdc30q^NZ
z$mfG6KKQsGzS@Z>xP{^S-Mh9tA>w(gNim8VJweR^(LUcJC*U&&M)2t)%eB`wap@%q
zKW>XN{R<sKyu20&L{9V!IhjvidYlBAzxY;lbxi<g!Wn*eOH|O5tdp6Q%={=Jzdc4l
zF-ASWvl$0ZEw~ouyv$`vwtgsW6|9B;$U4h5eI~BN&{jZhLe%Lt0Vcd0AN#e&^|Myv
zDB^DRkE?&S5u22kHlj|}_Pr-y56FR_$a?gxXCuL>_wl>yZ;+(?aFC)(;|#*_dF<LV
zK>&XwBMIVjj&qF(xf^Nd<C}{+MOOc9Wj`lR<E!92?~eVc>R>hEr}hx#pOu=<ze(Zq
zb6FJwI>xAza1{&Akh>YPo)J@aXY*0*d1IK`#_a4u%Jx_&w95HYjKCcd{5p9`>tGgs
zb}LR^o;KL^Is9Mbvnm!A?Ydc2M(IPMlLpm-Kfkf^1GBC7UkI1b7Jmzd823i}Ghp#|
z2!rt9-(d^s!_QJ<k)LTL*UFn{tV`BF^WFhH$|`tp@3@rcyKBmN#)ph^>=kmle!1LM
zKG;y<Jbn7^wBejg=4BNJZ?x$2ME&Fp5tT>%?Ltvq#gD4-?XfX$GQ|JYCiz^GNc*0%
z-&9>;)9qYggV`zmU_!28-i|Mvk`7fZT~i(I)iE5&BuR0kV7+q#XVM^8QJVr^HK9FB
zTYFAk7?I4!k9<y>bypd}_O(q<LZa(7=u@V^!U`~l1u%~sPMK-d=AA4f%l}5KW1l9J
zD*&~>J<7pDFpj9eb+?!}<wsHpg!dLqI$07!67(qUXJzRPF`09aoCc)F0d8-7F0YlC
zMrP5gDZbcLN0yDLycA(zjDRqRF7O*;PQ}qqPSvj`g&qHX%u1iLm(8uv`^T`njhFXx
z)KX+84T&?Z@I_A9MAzl5y^oBvk3cL*XFD!rZ!;3G5<XV2M4<5?JyTayl8=_R$BEOF
z2iot7Q$Ju3n<may6D1=HSNf92>?k~qa!K-SEXUva|3I&~Er-S{=q>qkst1w$9Btuu
zfy-L#CEX-;VHkHhB_&k0RQK;$m$TyMmHc!|C{a3n40`4fP2|Hq)!ekKTCo<tQ3Z(#
zFT&Kvg+CEp{i7HCm*3)*@>Fhv6J_6_zV-DvOZwZeIKqrnjhfy(<Uyj*rFo>|K@axI
zsL;K4G>eVpkRkq5h9;z!PSRDdIZ1Ms&<1NvC6w-`rG&7rKf|;IfX3bDviPTl1|Z1`
z^OGjXecnr;dbX|bTNLhZp+3U76lw#&$`p`MrP!*c=5S9*bApSmrLpP!h=6cBYWoBr
zg`;tDY{EJ?@nc^AO_?V(OMhEcz?~J=RV91pWl*5FCc&8g6t=QTpg68#ls2I+B*T61
zMDfpl8dI4ne$^Qo7e0Rm(~K0;FW8`9JxH$dt^B?g8Oa0KYe{y}51L$3qGT}&mLpbw
zDQ}u`C(HPUw*i#*;;L}P8mOeWL}k`vyBzs)daKw3_JF#NB>pFv1NXn&E4Rv+SKCbe
zvjX3I3b^_loSbSBUq-4JDJ6T?<X1UJ%JHpg<CH0#>Y++<qEL$0ytz1%?iC8o#L10P
zIYIL1L9@Is;)#*VeKJDLXHgY}t`QI2#&uv-DCvdNe}#V^dE==_O0(`$eOS@@ll-Lf
zJ7bZJhKsJWJ<_@7ul?7=b_uLx{gyAyD*mgQuAefmOTu~rB8yn_WMnMcuRO<b-T(;g
zA^jzx6|0*Vdv#}YyijA?k>+jk^ET^mUaS_Gcg`Q1lF_~SvzP9VBS+VdfB{{z;IY;+
zxs>!wH7l(hX6v!rZ(jETg(3YeB*{h80rWckr~Ze%nk;sBgS}o^sXfaFOhz<my`HU)
zg;I$mn(Njp3&7R=pVlr4lz!fk`!@ql=kKHZxuH_`Yt!Db`U|H|%BO|2)6>9uRh#~o
zuHulX$3@+D1w}L|6~4Y+85?-F+c4<bV*;-^Vxd`5wFjuX9Bs7$k&D5Qbte?|Q-1F)
z>6zNQ)K~r`6yc8}3oKGIw~J-M^-Q>m)>2aum_UdIw6vX+iF4d3CYg>XsRVW!E%P=M
z-c*1~PpVlfnW#P?-;$QT)Zb(nKilwT99-F2{{{5Z_xpa}pQT3L_=5PgCt6BubV(zj
za40)8avf|BPo54K(1}wT4zZQ?=qCWoEYw<FH>H0Z`dQjb=vgey>3?*z(>(b@ojb^`
ze@Z3|6AW1;)ZKl0_!*aTijus3WT;s%gCyl?=)XB&PyTCMr`d#rWB@2olq74Pceo+h
z$#Rl1(p981l5{}3{>r(FO(Tp;os6X)?VEaH{)@!AD<-wbBr@^lgA}LdCKUf-y1lNI
zm#>X4hd?E-qSjTi=oAn1=SN3#NK%YBoU%y5W#o@LW8!AR>jC8(DALeSe>mEk);^%@
zwhH(45Czv8ay`vMK4OGw_eLU?`if|adx9Z#^C~O<LTAta_T%Hf*lWI?i4kV1^Jxx-
z+~W*a=20gL$dn>a_)G;%zT??CWFw0*?a){e&14NkI$OO~Q0Ycl$=dckS|s_Gb*Nsh
zBQ7H)a`EsIM;g}N6Gk8c2;R8Ce#9C}@lCUnMjnJ~lkh%bk-;A**=J!He{R(e2W;UB
zz!p}xK6+-=td}}c=R2)b1;iGOfBu^tB=F~Y1&kSYib*0)Q_xBW>ez2u!tYpN_^`M?
z<8Ni<ta3fu$W9h!t4rpg?skOV8c7|YWnvx|^ihc7?jjQ%xg!>b8O*y6g!+G`|5?<I
zc>NKGyFf(1GlKS8dhXx;AenUb((M}H5QMW!<oM}W=of$haxH8UCNEPV(aA+tBmjag
zGe+RBs{VYUxDt$rdn_cG3`EK<CY@CO48gb`0gIlm907U6mY)#N0~v8lRl~PnS_Q|j
zE8O_p&cGcN4oRS`i@)W%ke%5`P%YuY0BhojuTxwog*HAP&cH<;9liv?*(gmqb8k!1
z{M&&u5mTk8=-P`$Oxf^ZV7%<m9hWq3PatcI-RJS@m0x#-@Z?sn=p)KGiTda)+B#wJ
z&%djzCj)`(qNvpy)xY+?jF@i~*_BoSBviW*^5s4??f$<QF?r(!vK~I6<q*VmjhJt*
zDw?Qt{2wF$anqBO0pc8)Tz;7cq}HMxq}Q1&KcQxzy!**<ymG$H5hN+77!%OHh?PDd
zR_vjOs+u7nrdSU|x|L;!V;T5kY0Q8c$J=56Ab&7lsuBlo%yYc5@%|58ZypHs{>G1X
z%26swwh}4J*ePoWWoHc8!wgvlW8Y;z3Xy#qjj`{$?8aKkHukaaiNO#uwv6q5I_KWs
zz4x5H|Mr(Y^M1dd=Xq@p1SEv;2DW5+iD0s9uXFA`L&Z_7e)4f=T;z7UmwI=>rYj5*
z&1m}jGW_);HSp&rB^Ao(+E}qWskj~ka1n&z*@gB=JujSrg4OGv7Lqgv`N|lPz55F+
z>&CqG)fU}~txUejo|4+{0XYA2$N%W1Cb!AVEk?Ly#hE!X0+u{7gOFX+=uA4)crbY6
zlGk?=$Yb2SVQ$x#&h3x1-$zX>-AY+i;QFp*k0>eVdQn$yOk=Z=vThRd{hFXWyZH!G
z$?#zE#?*&u<7la)D~6Ak?uU!i3U-ZQAOS$!FkYf%C3-l=lF((lbHnYoh3WS4uTc*J
z?B~mWqesZ3Ry3XbL`Vc|qB?I&^+#{m#*M#q%ze8OBzHqyU2<x`V+}hjYLp$~P+r6=
zWUliiSnBtK!Q>$DzocOm`xCf0N;1*~ZNT6^T1JgdwV~be4+hcvf>99PAAJ^}LG+|C
z?%xdRDN!3r<umhT%2GGg8dl&okp13uU5g&8n(GiNpg1x7TyXcELq|t%Y0;7;!EovO
z&!=tQM_g*1;_hzEvuZA~_VQSEaCm6@WD34t<^0`X_G;lDti?*~^<p=uy=Z>v;31o0
z9Evrq2e`hD%kB>pY+paIY>Z!*7cfr%9~R#WR(ZZio`yAkZ%>5kMxUsdTs?4Pikzgq
zwfyLRoKV@nA3l8X?$frNPjP)9+O@|r(jSPA&2>oH_iv)6b1TH82H@-(%UD=0hk>zX
z@p)fn@c8ZA{hY3_$>mv%p%10peHuI7p+HUq<-XAB!~n1o<~<{3G13;g8MJVKZ}3T3
zMh4FD@j555jZW4$huuXRq48q|=;b=uy54VX5++uWkgFA!&-z!c{FmlcdAWV_*R6av
zNhYe&!DAygoSfF2850H>3NCFO-vhvk2M_tP5}qdz@#Eg<48R+IDRk=haQBB8iZ7iY
z1^ej;w37WgE)4RJ?HS*@J{6zX@Z8`lkPx6C_T?r#o+}AuZ%BM;{`yr22R`<ocZ87T
zkn+af+OpkSgknNx<w<!TY53h6UUQu$`<WqD{tiW4CBeb)MD8tYx0E8u72lJDtGsse
zYVJx{rFIHF2$8&B(ZXNhXq%k&qPRlGa_{F=l*fre5m&XNYnyu=mQ*`qIfwK_Y<lYP
z@bp@$ZK|L|vUqH(3zpUs9VjL9JH@8PgT&Qxb88epWBS-p)lZ@?ucK%3YD)ARC-8^*
zS=j@#(1W;2?cp)r%!eyK9{DgEGVn7SqnF2IYr8`?)AXtQIwzR&C!_@~v$>ZVAKx%M
zKM;^&a(h*~gP8lErC&D1JtN}f4iD)|7yYCdVe6FCkM>agSU-bLLke^hFA)S{hb=yO
z$}QN}Rz&j~FOP|PVaXjL%5s{NjcE58H|MH&zD1pQ+nO|i;3m~}#;4`>LnKd5+NAD1
zgay8V?ezFHa`rdB?ANcHvA~4Ht94p9bX|EqcKP6lRcw(lM@6Hq6`Ctt6b&p*$J9Wg
z-#moN-8z`YZhoI6=$HTMqCNPP?1iA07b0v`AWrpRx_V#__|7MBndq?JmBg?9G+|MY
zf|J=Awu*^YbJm(8z-8H;vm~du6rVR+qG%?kk+^;RxzPj35@EIngwG0Q^J)2_atRZe
z0Jae+l@cVh0p6IY<j7XhL{9K-zCmy|9@H-f&Ysqle)ia}<ZoJ5Kry~gk`!y^1_!o$
z=3hkS%q449B*kd3B<WRc)_S;}ZO`{&V}#$m!y_@u*vQYuUV%{KyLe=Vc+(o#<?Z6L
zAityK9pdmEHhd9Fn}GQDE4@`Q6{K!ml&L{Fx6J~mjfBs@OKn?L#VacU!9J2G56dA?
z@zC%GjpQS@iI%lJw&lGtG<^7OP_GI<gv#$s&~h`dRRBD%agd?`^T1LIoqri7*oz_w
zKktq1?7P8SJ}U$liy7{teGIE)m~@~z`GrO6=xghi?sbE_I^oK{xk1i1f7KV@BIYK{
zeo%ulRZ^J8tjl@>0R98_?8oK_dY)10Za4}306j_JM-MJGP^eE|JT5%HtrKhYCI3D4
zlUrt7>-H(>5DpQ^c54Gt4x(}}1pk(24v?yqeGlB^tUw1xhc@()wk=2l+2}&IU1BT-
z`tPe4bSQscObpmEn>q0!W19_lpMSyK2Y1l%y1Y1dDs@$4%oRx3*HMdTp5-Qy^#|Gs
zO?)$UlCC^JcK0&S;q>*nby>Z}MOU+ld0Qkz+!QGUQi|-8q|QAOW>=ptd-KOj2})^z
zk`y|O#k*58oHR$%wArf!@ZpB;YGr&+9$7fr!djG8WT(<?lBFI&_5A{JXPcy!Y^S)u
zXG_cs-rQaVE?ZULeC+h`IMz#hDT-I&GFZm5v=8-Fu+i||&w3?8q;0}RW1F8<n%~}9
z?(LDRUP6Ba@(7&Kg|ihh!hF!zmoDtgZ|*Eo@6Fqd(R<JzLwO{%oYl0DICHVNy7(Pj
zO|@e7P~-8Mx#5AhvP%DlTSd3C$oYhM_PZn6UMZHV-YKpsFSB|7#Cd91L>xX({+s5C
z>C4|}Y0(`kHXEg|S+Y$|FMuG9c~>*b>YIa%=p*y)cITiAy;>`6$(HLYx=Gr7=-1}M
zS~LExb(Wx4&b0Y?&m?AYbc(|PCXiCiV(4QkRI2_Ca#tn!p##}8<MKh?p^8rMQq3TY
zb5)(f>WsPc{j>;UgA$XI+o#WY&91q+F?TsGPsfk#y`^(Kelxh5ukVla+b^Dqmxev`
z+CNM}f78j18|~6J087YT+rGwoH{oB*-p7}qzgxrfAv+wYe=8pb#1vT$Q3tcx3w)`U
z8c4ms(d`z>o~*6Kt(NmefpenI>f3|Y2_<jk{GPpk=c>CV=YKqY@{F#MA~_SBQR_+H
zBULid%i2aem#bB^EN`o}u3fFKRrIpxaeZwMwrK*Z?UXrO1<!b*mLEMzJg_o6+K}zV
z)w4PCB+nin5wtC`pIQs4;lj*ZS1}2ex2E^q)$B&3h%?qH%Tm*xJ+nnZ)>YWsO^?d^
zOH2|X&el34qf$lc^{pVCM1(Z1(jVPS`lgSua(LS(W0gAV-1(SbGnECdA$**l;n`&g
zmt#sw>S?(KQpppTBk$7e=#G>?oGw*hvup3X8ERkZ#3~l7<6MBvT_DjX(zle}@#wQn
z?nP3o`|ft;bNi%*N9(bJHHzbh8z-U4_!lS-_at|b(Ow51X17tm&(qkBimCCNK?fp@
z@7aY%8S8)|<5>LcvkzA4#*^n`j|LmzWN~hvXC+b65{!Yz`rcm)(3XaK>HX<G4YSVU
zKMV7s`NKdVeIYE5q4fQ(_?h($d`V1gr$zc<5QS@hX{C$tz5i<CVn2RT14i#eUUQn!
z`?u5fO!wf)2|yR89}2SEugw=$dUo06^wlOsTJS%ewu6(hJ;1X|9}SNf@1_ml4f>H4
zCcfimj}rEz<1gtJuT&uE5&jimrKpktv9s%SVGt?tUaT^*H=$zLXMxvp#rxWFDk`D6
z!Yy#f$=lGe(Hrw>U!%BF4U(ra(piQyIGteVO>zTm&%~`AA1$9!bz{dcKf~0eHlLsZ
z53Uz6-6Agt*xK|5r?mX%FlMp=hY^S@6?6oa@qhsqNSCa#8x`mLSD2arYXVy9tqSC3
zL9A(E;Cm}pNksmgMBRAY=ZgRd2kcU2wa{qZZ~=jGa{_9r4weSrxGAqroRRB&$^St)
zTqx(3T_`tyftG%0@~%5HAdau;$72-Zku}r=eWDhnxe%@{f+~b;RuNl8tK17pl4|?V
zz51WEni4xf#awO|mW<AgMeiwsoBE5TpvVAri`j4=t;^bI6-C>51M7rY*9oh7KbSe9
zt|5uBw62@d%PBm0PU^gY(eNZ|J@fUwd{!m?CqS1j!d4B1cK0jF@gzwJN+^N6+g?=F
zrxpc!7pdnM!GshUK72-6N@;d^L45p-7e={^1EM7Pe7)3Zy}75v7@DGeU`pGM+Wa!>
zTA(v4Ob>*AGsArS`rw~_pr!D6o0*(zO6<L->%&*nAM%-Pi=?-+GJQ45J}Jz69>TGv
zq;Goo=gpK4ho^>4LlHw_>vG3C_(^$rISEiV=2HF43^kh3;OzO<t8e_`v3?Z^g9&K*
z{%!-w<=vTemL#Y7{Ycm<A{il)-^e5f(QFbCtzC;p<XDb|U1HuXjH%B(^1vL8U(T(K
z;o&My_eDXyl^kSi4+30vd8vB60*TokPaNjquEU6c>oA<|0#`?E0$lfYs-F|pGYBNc
zZ}pg%n%qS^kX0;i*lD-PwwhPF?EmSnt<5)QJddCLd-#|P{Aak*Toa|IEu#80cQ8~^
zu<EeWPjMg^4bSL^v{pDp(>Ui~^Zx1t<ytmstRf6&E-HWI=v!$I6JJ+u$(AZ(sU0O#
z;D#8_-;bQMY>v;*o6-@j8a7<Yj_(tQgo?o1xuO`C6~oli#*_8!_U<!mNRDU<;YJdH
zJrf6-OmuhLgdE(ML-I4#1A9^y8*ZAd4-Bd&sM1|}Z!(5ajDi@a0$NMCemM_A3pGYx
z?Ox)apI`0AB`+64w3Lb~elR|_*dYLY&R#GZ-x~MeBE4w3G;NO#1&ux~wPraLA+*|^
zc$0y#L4gvHT=;-eZ+by{WPGL)v4PZN5foO+$7~M4f6hlD7q3mP+yPbp?r^-k4;&6G
zkmw=GT&iY$02=exy(o0b3Fxoa)Qx(kvizhby8G1LlQEncI)L(Rs?x@ShiLa%b}4Ya
z!1kfeN!<s#f^9F<d4_g4#6&lAS^BKfzPvmP$S&D&!4TeR8g_X{L440^jx)Qgjyl90
zleum-sSqrWM)Oz_2sEOM$L0D{KS;vFYW$#z9pO5L7?{R6h9Fq8L~_l+m$2JK!vl(H
zlDk9>p#o1q)E7x(c>nGo7`$0T{4||-kN$c#0pq)T@b+$Y>W<KP)t|(m9QSYE1Vqan
z{9yV5fiK1j2}M8Gyj?dHIjKloR`RR!H|7=Y#s9nJ$^3#tZdP&+*?mv^KfRCe9n2jk
z$51GUm4;P>&c-tD-u^?gm@68SC8=c9w=~M{URQm{uc*P1=53AP8oG2lrzYrLqfbic
zmE6tG0nckEu38QO3s3vSF_a3bm-^d*_=;guc-NLHp9B4E=W&^XD!y{@h6|;}L41<=
z+8P-`Mz);>Q&o-vvPaYB4I;Nk)<uQRd$`nfNB!n=ucE}u)bht8k+`ZS@A@x9Ld-<C
zRPP|$<3QJ+fAYxDctzP*mm#3%1vM{f{J<jR=zy%fYqVUpB2f9~%Da8?xwCXW7z_W~
z<lD+Pkpp~;dQ!}I9;*&Vwg$XUwZ|nSF14MS<9HB}dbMQt{cn2x8y7DccIH=UkG##~
zc;HI&<=&d&WIQ0|lI6j<COpi%h6($sf(F1`&8)h&8o^gIhTcE}$CFwuNs2etkBCr7
zB(GqsKSL#=6zX%jpgMOUd(pjC1ng!It{c;C$rqJ7GI{@QN*y@4oJC*afD2`k{O)Dc
zwd-|tND$&=BqI-#1AZ6LYpJ{cN}@`v<%@BX2-`*64?sPgC26Gdrqp4Q$HC~lyQoV|
z(IA2!qVGA$#XZQeT2rg$=34*+zeO41Jz-iIbkhZDtPcI?JhM|{9B#PWUr%MOvTMD{
z`VJdpVn83E<zI2Cso8VL;x|u{BqW%|R-b39PwyKEpW14n59Z3XK1TGybtSP4ZJweN
zB4<Tf^Yg>D7Rk6cZE=s{luo~p(N>*)k(rrX^T?*ox_l*s%`6Z9)y7vpU!Y|CUAOEs
zJ(dzEMl{BHT=B`PaCCB_G1w(Uccp>Ks7^#JM}Xq(uEkwFw?y@kL;i*F@mcoGj-=?f
zCg7zE#%w!5<hp8?+FV2Ar|#<clP`0`rPb6*Zp$<o<=6htCz~suG1l8NH1EP-n>f;d
z=TtN1+4x$E#mw-v<@^YZD@N>88!WAQ0eeiK>-4=CQz&b7)rwmk_>?zF+y6v&n2uN_
z9yL4G0BY3e(3SCNR!`HP89dJ2u2#yK{-7r-?=w#<j?)&d)GvPHOU<bku=Oyy7Pn{8
zG%hQb&!UrHDCvB`;z#pkcPDF84!3_#q+eq>fXf9a3)f^{GZYH`^A2-g))&zoyV8pK
z8C*yYfA&^RtxYer3ae7o9bD6x@_{uiT&+C2|BHNUEz#S?tc!FDP}KGvcvfe>@NZUs
zZqfg8QZAwQX(VKQkUHE?%)3HR<m;YDul%7H)<N}LYj*FXQSE4tkN|gAI{r{~))iu#
zMqGCq@7A0DNprY<!zzk9p?Bbkc78O(qZQqm4+YmA>4Yo=tGKShM=W-=v-#jY#7&1b
z|A-Sc>k9wX&47=g&{{KABi$sW^v3&lylr>4O%ozaJiaAr%tRz7fFr@jF1^bfN{LB7
ziBM4u2w<eFvVHXCcQ=U-0IGEWUE1?E07-pan<lDt8VTsjCPuI(@^XsSk*?D>o3-<$
z71Lf(_en;w%1^nJGi+urPW`E`?caWivHk980w9@;Xk=k!QJX9tou0hmWNfyI@}Bp`
z?Js`@qFtuS*LCn<(^TG^s_V*S#N&)v{x)w8Ar!lkl>WfktTkR<N5m&~TI%e0K94wL
zE1miZ33bO=VGb9?zfF4-F!AmWwmK5twY9z|M+-{`>|U-oT?QTP@CtaW;3o{1Ga3eQ
z+(N4rjd1)3Wvfqf#!(ONvPB@FPja7kbeZUWrZ{62uqAmkNo%75tFoQaKEf-x3!Ah$
zpW?OALgZtzryoviLX6G%WenXP`p<W`enJ%44RH)_{hDE;#*5M=G&R<JOagZ0Qf6LZ
zzOMJeC1dxSYO!n!4SMMj%iV4jjV4z3Lv{{dJ4CGMtVc}qP-0)5?${$&!Z*zbtVehm
zA><f;fZq^tDos7^p;^XUW=VG6O&O8lHRwazZjvn0)}S<Z4$5;&2p$-(sY}`!iN+)S
zBGQKC4QJ*>sx7iwg2ZE~WUSNoy299Nt**7|gVvJ0!*08GV|q6arSa-^;jVD!BUV%r
zo3<|aRG664bg$q1&B|EUU{b`{if;X$$q$UwuJ9_jmv~tyuHNz;^eF1upH8b!yM|b{
zMHar`A3pmx_W$-FKrRG_K>~DIK=cuQCJii40o}%Wd!l$l{H%a>%+1F=ik3L@zSK9|
z6k{T$3G|pAjT^(*>uLjimaNEp-x?MvS(8$w7~w~T`5Rrxf{4K!Z=)4;?UuIyH=$gR
zF_FDk_06e(thcGQcUtf6a;w2KzUaw(+T8&ZPjyURp+nXYsD6=0IMiX^39A`c04~5k
z(&RsR8pU^YENxCi41yBT4{$yR?xT2<<D43Xr4>BP_qYY;*3q5?W+Ow_bA3ZP>$PWE
zL8-Fk3Z03xDqy>}z%1>qlTT9FtLV><ydwY}U=kGlJo;n*8$D(vDv~6;-N1-hk=IyM
ztG}k1w*8YQ>WXNasi=sl-O9hmfL~J6v;S`sYxS#%eXjthT8_TUo%+sxdBERc`Ymjf
zY^Tc|G-rIu<#41WFYYiv&}~pV<~1>G-+e$c22rlMlssQRjV6C-Z(9-wZS_tzM)L38
zptB1`#Z?*R9Q`aK)kNU2-U<HNhqh;0Bi({`g$z3+32J_Otd=bP=}IH0tjmm)Cv|9i
zPYn&o)@OwyBXMFYU<mcBSR=`<A`Sg6Jtsf2LP94tOrYd|5~k0unbE<>U;KTpUICx@
zN@`a~RBkLuwSmtFdYh>sOeX9HZM68z{qeoj6u*0+J)Gyrj*_xxj;21E$i+OLZ?6zD
zg-iP|y}#!%{c~`(Xd9pST;nXtk$jqbbxl`i3gY$t6E^ME#0F;vhUtB>013O$Q}dBb
zw*rhk<ucL+0*i5#+HNnJ>>b}J3kD$C&R%r+D_m|(;~0D8aom4Lzhg|ta%EJ_@OUrc
zPJoY-KjKrRw!RU);<no18ZO*LJ(b_I@uZZAyybfx>~2Op8Yz8`;cIL0{65nDhI*j2
zpb0BW%54R*8DjJ7-rxZH8Y4YeF-a+PA#PF1l+uPp*IVFlRX`FpX6QrJhm4=QE&ok&
zNz3|%(4i+N<~LXvYvnI3i^L+RJ|JP-jRbBAgYb}}F5*?~fPQ@}`{4sltXDhrJ5hO>
zfyiL?C)xs02M^_oIxW$t_l;T$jg<_e%F@YU(}w9v_O{n(Y04hyvWb}$)l0l5|5NO!
z&I~VP;Zu$<{~H!4g|)!+O9M3Z*&|hYIELkRA%UIwuWpw~S)PV^Eqe*pV$-DJmy9LP
zUr>rOLl&lC79+u0#5XZxodv2)_Jzq3Z3h=MDrbQ)^MtSR2P2W+IvHAA@f7K|e1&f2
zb&)r^=3F`ZOs5kRnNu5()))A_<x6bUEejra2PbEjQuUXH(a756Wu80Cb5n*6aamS1
z!^#ugxlos0H?fzX-%tunw|{kDP#_^jMa{}dd#>QZt&0b?maa5kb&sAIiL%WR>TRDI
z_2faP#fADQ624~JC;`k`!e%K*GK>@xPDTi|rhjoD6Fw>OSKit*<Jjch=g3N+HO9E&
zLm2gxDhj|+jNq|Cv%2e|O#XV5$^mLdGmXl4^!b^(yDA;yrxn+zmpPrFvbnuZpjqcM
z!s{d-=M7KeRYk?hu17-Xln0TTsji8%3`o^}tubOdm1xy~lDh$4Mx#%7>TMM^m~pz+
z=k6TO@~fgRVAkX%?iovXoe04=8cx=4@k;THyJAtJG<VcMg9#f9X?z_dnFn$P#x2pO
z0^$cFGG4W*!g+FyHKmVzsLbrKk>YTBTSH#)g%g%aYC_E*^ua3Aw#bJSkC<Ms^SNq1
z<dF|E%ihHB)cu7v!o4YbgDgQt_&V-9yj#UKQmcA6rp@DRvlY&K-LEykmc>NARteK6
zq?}lyO9L(+&YRk*&6^S_ifbruHZRwe7Z?fK;0@gK_r?i>`FD`vWGg;t^on_}%L)h~
z8MY#v3_-jBfvn>|?Yp^OBis!+?@Mz1v~!hx;y81q+HKS?lwX7}x_0cZXkTcT#F;$D
z!@DU%eMcp+_{V(Z!2Vf^=d_{gv?}Ks&bz_X&7q9A;k3Y`sSL_Tk?sZZ`NW{lKFB%7
zARi@$yWvS41xnz~T01m)NsO**FoAbK){tjMVtR_b<es4b1iMG0wfA9fRl}X|MOfB5
zUA-Kax4~nVo8M@6*clsv81R*v*cXcVcT;i$1~63=)aZ*Xong%}H2}eF#a?fKQc=vl
z_ded8YF8^O)MlMPc=X5BqxWXX++I%a^hZKTuUi~}Fi|w`kbNS77dQQgRW_^DvqW{-
z*MjD%F0F(@B&6CS>hSJBH{3|*deeT@Szz0P2$SyH?d|vhx!wN1q9C89qyS`J{KQ9@
ziGq7r*~T7QtuRYkXyu8R4{HY}A;^ls?N@YBG!DKyloIDhYmC~RIX@U(@1m!d4ZJFn
zwiU=L6gelb?RQLeTvyjBVp=01I@ovkY{Mn^!Eg_pT8eQUKA$rmsmJaWaP}BQ8{vhr
z`>jmjy4bI)_1K(dkLhG*1B6*@1juQI_p19jto-#V3x)VS4jcJ=;i8ASg_{p(o>{Mt
z)og3}-XM8&ISRp6`~;#rZ(nBT6psc5914RM55^cD<x{?`s|6pwuU?*3EU>z+mQ`8g
zQwQ}OGkjK)`|)cI+;mLH$=*jb8F@TqYt58`d7kVn)rrzRLB$_uve4#|<n(u00(chu
zhfo&l15I)QX{h0JIh}r{sCc)0#U6@dK6-{Ya%n|lRyl1~3Cxggd>HNW%z>HxRfss|
zx*|HGRk^h-`;(8Ff`i&^bZ2j#DF(X!I!py+$CO#g{c7RXYIwziuAt~ePf-JjKveXz
z<jImZMLkZ^XuPs%oBTR|8k4e>AL$@3$Lr72{N8p?#5iW*vcG9^5ye0sSTZzGLeO5=
z;S*hBso9FmPIBBlXP-)V`&9|V7F1$)lxCLbtYw&7)xs@wOve(~3Oz?z(3A-s27D|$
zQjE&ncecOS7cGfglWX628Xm*5Vz)VbyT)bGDW!fJ{a?ve&~>0Oa>o*b0eu#_Po`+q
zl9<+-FzyTe0t&oG_eNa`$IK(?afMlOgu2-9@+6yCg%N#!>Khe!^_B?b99CnCXIlM9
z$y<FH&5f?rVPxTU+suqGIddxFp^|-yo>v3kY4@w^vXy0lP>75jTY~2BL+>@G7=47j
zlYJR+sBNs*L2KeD5^~fzws2+qYz1!EJm2CCKpNiaU<&!T^flyQI+rldi1p~u@?lwA
zo)qki4_4)f_+Sakj!7i+7}d0Khy#q)PmCXU00nZ3R=*m=Ot~={Osi;#6*3Dsalg}i
zEheGp^O(&9Wu_u4hxe>n(XIgQPW&}Z-Moa~X^*bE{@;}#lf3AL<uGbb)A~i+hi95Z
zEfkQ1QgJzrf-%0g#wY&~g3*L~Bz-7c?PeH>tgO4PaFzq=?I&buTN`T4@M32^X3}!b
zsx8rWIj`bRU}xH!K2y{DxIo)CVnN<q&@Dc*zfi0O^RKdWSL5zOt)I!JJlb`$4Ni$4
zm1P%Ug^cDk&<{qd>zeJQTDae7)Z7qqpKO<Ld+$DKPCSOoT-AN~bQpPxmThlMa4;o>
zGd7w8Wr5j*V0qLiTx$w)LNt5il0ddjH=l@@-o`!*UqLnTnoChOQ7ZivI3|9zx}8aI
zQ8c$-L87>+6ePMZyV57#!6>~(iqPmTCQTEK@m+!qJ<eH=K*BPji_miL@fi8Gsj~y2
zGI+E7%=z07Mj?1{En+!`lix@i7aJ<Jc*})OSkx!MgCXw!$pV=0PKcX3AFnb@_xt|H
z@JLQRx{=YverKVFFX8}LvpZ_(<!f2h3!mP=g_(*gQnx*c7#b3TM0qp(+1bp*sSa(*
z&Cbd?OOO0x(^XiJ;=l6wAm~53ha<|WXoiT``pds!9o7@XLa)Hhsmbym$H!j<boJa~
zf{0cSzj;C$6Ki7n)OA&#HMvMTcF_C8hceA;`4S-Yqi5NH#_0kwR0B~?B5TY*O59C7
z8$5@H=V^E{zY{j~tx!bwAX-wtT*6K+`zl#pZHbtw-6k38(E~Qen)34G3^DrN0$IOY
z-CV`;vZ$)%)qWS<Ji);<5KG$k>3qmDiLP4zoY_MKbgGQCb~GFZaO;6~iSRgt?ZKlZ
z5!~owajU3F_s=k6R{1z3zD9L6`VisKQvK@L!_P{X5mUHcNNGc+fXM*m)QpJ{|Eg?L
z??i0PBW{06-b4ok^zLP;(aC))`|pzHxonm@rhg76`PB9Jdz~6?MV3Fqfl3pfA$ka+
zLL1%heljup*ddXW2{^ttIt8UZKRgVH(JYZE*)sm6>dYv=H<ERZ@dYLu$SLd5PJa^p
z?C<7;PbvWSL91;48r6f4yP4?x_l(fa+Aj*bq6A_<QGAObs5jP=w5EwUp^nq3BSjy-
zG!7;I@atCasIWNNYmJ!H<r7}*Pe_SW$SIE%An-5?vYhlz+Z>hVQnNa!slI<Jm!M%I
zho$zXxE^mDkn=p><Q`i*V~C@6&dpK<RW|Us|BCR~p3_<PM16{*yJ`z3|FV{VaMF#c
zYOUndre1ythAN6a*;`eS7c4s)w<94A`;Fhf!W?~I9?0;1N_OEJagkG8A|@QWWqQDQ
z_T@4Sv`OCfztXQqP*K{qy>J|N=i})8`X9DYv~_45LEq^-LO=P@b^%Lrfk6`oaW=_X
zU3Z_?<EWVvYN)txDe=VR9V=p{K|@S=*H}8|VSKW<6ehr}Ep#H?DwN(=h`i?7@xFz;
z%x{kG>_7N<OfY(u1Th*U2yU{9J$vx_B3>NA*4rkRE`-)j+zw`=wF?EM-suTfm1(4z
z{(K$ZBub<6H+U}S5aWZ)A?F4gn^e?L1?8<d!>`5M;jSJ#-+jwa-y4zBX+xGBo-)I&
zdHT}>^I*y0RuLnpzK@AN=UOAa3?gOOQL-7QRj9kwynGv#+iuuCnbX3TV#F;RQ=Itd
zvk%<gqMGm6qN((=ssk_5S5_8g%jyJabQo_K;6uW_oZ>ELkMDx6CreD9|BO?_HNxMP
z`nBra`w@D-%<c1u#eO5}p?3QuyO1&6yAV!fPiSp_l{+~6iF=Pogi6v2s~fA_yh+AZ
zF-fYQec_wEPQCG@uVfa*mUzw>xw2Pas62q-U_FvtVYi%5i9Jipkrq@s6QfeZ5xVVe
z|4-aQJ9-5Z*b_nkrtzV<j^A|Y8$*%_{}a1-CUJr1!s4RcsmeyTJQ!HS)vVSdo1(|l
zh|?))t}`=R%d3HzO7w$jn$Ofl;IIGPtO4NKjjR9vNuUdaF{>Cx&XPUW3y9UHRP`d2
zF~;h<awi`Ex`B4~29?2wY25E<9Yu%#_`?4Els@-v`ji1RdbH4G2>@hLKQAla+?Hok
zsQbkF@Mo}9>c{T*-dtd}3k%ul9(5cSG<qv{5XznLI3Q7^#kp;^b+$+u1z#I-IrlF&
zY}MWJ{{vZ=dxx`mWp*XT&;RWa>uyD>iOd=Yqf|uevPFWRtZnk63zS2Xv?+-=@aLn-
z+=E4r-Y<W;j(qzb20^*7qwu};I%E^b*0&^EhG<Sd7Nc=#o`thR>+E5JZdAq-Qw{B`
z%AF8pytU>l4y`CS*qvLtP0W1V=yLpbTO(et*#nk=;C#xHTVaduk2kuMS+30lPsCUF
zzuH7t+0Yy$S5Reacm3r)x&5?r@%Zb1q@6eP{!jD!3TS=-$YskziGwbYHR0BQw226A
z;F?|-(EL`qE*szeaUXY!e341_vGdZK)gF%7HDJ#*U_NT65TzJaYZ?m>rP};%%qE2x
zekm&Uz;@^oqiDCX*u@a%2+C(^#`vHnaeP@aLg#+{N&h1u3;Xbzaud$oj7X$buWq+@
z&03<7C_{+tbJ-=*4;#aM(-}*}f%$k8z!=A~_?3#qVGhIv2|^y>rH|vnQ%AWgWa^a4
zuTrYJl>K<x4^1vY@zU*cBkUOkcm+`L%ttmG<fz@<O*89LCWh`RutscAoN|$c{2S=e
z2J+*5WZO}E%xF()W1mR1gP`q~qE%t)0%C2dC?b(@HvWV-2LGMxl1T+Pcc8RfOLC4R
z&#Qg@%X{pR)JK!LN<wLcA5>sZZ+gG9#03Hv%t!)3oe|sgd`4cAM<Lhw8gn_m(9t;G
zls#>08SBEBD-W2t8M<4A#VCjFj}&V81>9EL=@IHCQ%WD2tkGl@<F5IzkOMG_0x1tl
zkaO&9vsbbgh1^vxTl88Wi%qlQywa7H)669fBPM!ET{>(YU)WV{ZB3v?w>q~lc4-?u
z{}o95<;Bah9yodLZA0>d)}Db{*WLQF&-~s7lJc#4wY%)PW8dX;1hWWvN^D}VxEG#7
zz(VRWf$+mMW8{^nN2nbRN=^Mo4RtlD1r?r)uiD+R2J=^2IqPM=XM?6BZV7e>tyY!b
z`x;+fG|l$=8ZHLY-$D;pxdwb+d|%KHyI;U;VnzKK*W!sFtI<k`NlKwsWy8&fP1bN)
zeEdl=Pq`;M@?RYg>2S4|fibiP2sYUe^La^nZt8PmFQ*j?`vTIuZB9eWKDYE-j}_d-
z8A;6HDQEps)J;Ygp_bCA{se5S>~noLK4x-xcaQIJh%W`J7{bcem-fx=r6C77$cNnb
zy^^m?jqAGod+WQ?HhUgu+<Byq^z$ng*j*_&tnG=2sYtdP2UU#K^291KZX#NhXw~>6
zCR!osq&Z_(`4;qp<R@>!6lo-vR3sebqPg`?qwSIf0w=h<5X%L6gy=W{UL;4LM?)V<
zMobw|@?^i;2V<tg!>+9rH~V8zRmj)%<pmsm&(T+VV|5L_I2uPJ2)prBzis?<D*)4{
z*V+^fq`%Kyg-HsE(sJ`4XI5C)y7WYP(hdo}!9?n$D%VBJh0#qZWBBH@15rO>`+}EW
zjQz|ky)w*|4vY^PWMRuWohd>+K5U60RQVPi-rKj<OTr!%Fh3A>_m*<}@26&ec>9Xw
z9W<~LnCy|txl*U;@MI?EQK35E-{j^ONmCVl5U~<0V)St*H|cAVki^wA8zdU~_EIiP
zf>cMDqOCi)eK&m$ctXjoVkx3-&QDTD>3aoz;uH}J=`HKAJZj%(u)gajl*WGCV<G1{
z)?_)B2F52-szBm+TZN1RcFUS_O>}zTYtQdR@>^$Y{+jstG>sF#vq$_$83Ctdt)BS5
z?Zt<)v#DT^Rd{dAS;m}5^S332?){ALY}P+lGFr^-wZS9*;Nk3zvlG-&+|wQoeoBr;
z2ZdlrD({4#jHpTc5IpoGLX>qZ{xPebO^qr#ww+6l;9CeB=;PS$)nF4+j{~vVz{ul8
zhqf?AA1gJT3&G}jl1#Cs37WC%OhV@FsHWPD>7R*0-m}xXg_YZl-U;yPl%`e|R8u}b
zux(MYNVfMq`}Anv>1(Kq5+q~kN`-X)b;?7_>oyDrQn9`l9sc8<{g|Z=h|EH$(aix%
zpMJXgEGYkta?^@)(wi|9DT`^{uwsW;D8cMaa96-7*I6Yc{-oGf&ux$3(Uex%pmyiB
z51R}whvje8un0@Rfe5jrX>x+LyJzJAj;+kNzDH`Cuusd-{l55WQDL|6Zc#O)PPA4n
z!aM0|ZdI|mQq1?RlWe=mdPiT)W3Lr7?i*_n6O5Y<PAGCfQDbs~B1@Dd>)Lp?zpvdI
zaeH{C#vBMw-??0{W`jWX_cz>xc3o+S_QR?a2)GoiPU0P7ab}+_)jg6D$w66}Gt!U0
zcsR!VT!ZLC1rk8If1cVLAsui+rE<1P>mK{=?_RO!s0M_F7iwwe4yQ*)<VgRS#@psl
z<=wT_DsD#g<ad(1OParYLXDSLMNtR}pIgEA=9UVdAO7TBux6k~l%Gy*6RC?RzQz8(
z4Xx2<QgyDByn9ODQT9lRBb?Lyb1capNQx;Blap+9z7}<Jiag@u6Iw=e%^N*0TlPHi
ziIJM!^4JI~Q1XXu?Wyd?NZ!{00Jtv1W*dMvJKEAT8I3eYdHR)=dUvF;&nVCy7(QTt
zdey2|^z9`)+{tBS44Lr5wU^*&x^hL!K5XZ5^FSE|&7kizPX8IwKE|?XOCJhhh>=DH
zRTEJV$r6zl`I?qhP@lODZH9**!<$m>T8<gTQT3;m7J)E_b_>a(V%fPaJyk{~$!Mp5
zkBULJVAzKZfg~ZWO%Ds5n;71iAuBfKAK(!d{q8~in8a%XvU*Bz#48wa!8X&U`?@ac
z2>qJBU;KPmkVHRg$lOmvkw)$2^prpc+r_!cHZkd9Y5K-6v)g{JsH_6FYUBb>5lN+w
za!LLEPIer>c`Y6R00iLGl56QajwKQ#PLlvs`X(xq@(420O{|Db=*y?Y%fE01ar6%b
zr;*h@P*OzHyuE|<LWfP#dPI?Syhm@s5xpZ}kT-xWK4Mwy#g)>)6S!f`_*|5!jCG3N
zUiVXVRp=Le!-LNd;$L{YxEM#ue+eSs6?>ET%NbGuP=`T3LS!o{4cHPC;kaB#s80VC
z$vD8;`v0Q8tV?eQ>RP$ZCE+)+&-S|=p7|{BD{{KxUPs`+I1ePI!6@nRqT1raC~uP3
z3o`PI#7b^x`?WcZj6*|-!%MZeu|`7^AD@s?KeHyk^<oa!?4z{T0i;J_9LOB`t~}CQ
zoJr`7Kg}`#;qFm#8rz7Svg)z1Ahtyonk9CxK96lJc!H0{x;H69O3!j>gNUn(6Y9GD
z)NDc3LdU#FVzbq1<s#-Qn@*lK1F!M!ms8?W!NR)%NyG9X6@Ah9*;=Yd$m>GL!gwKs
zKIv*fS?mZsU#y`H9m%)9Y9*v#8PEV%@2DG$4E$+3O_7{JBP!@`yK^M8@63EUQ_<Vf
zi|k#o*%RFrSsy~63gwT-CUZ+2+X(4DPkGB3dB>9GX>|p1I+-7E_CGPqS3GnUSuTZ5
z&__MrAJhuwfeX9MLyx|Wvfca&YXl^MB>}sCJ(>8cC)!c!uy_Nm@7`8EYGbPDQ?A$5
zt(femyRO6lo;d({6Q<~h=+*gnLWXXBAcC^y5-k5=Nk6n`EM{t@wxU~*#SfbD=8DOp
z^!t&?#Ok)Q&R7w3d~5yb*l%n=7l4+O8wesBCL=|`H<hM=kTc<UH+2a&?HGorQ5)UD
z2Pr;2K7BR8ek|m(UqI4#2COv-RG@Ox=rlglJRZQ=uP7{-l?8fWgs89cf^$uDYosVz
zB*=ZOTewowTBo#fK2XLY4p$HHvwjA1rFeQ*wV?F;G{bVZB!KXd6$9iZL9nYq(@r_7
z;s56H0gKPeg<rk_zzC!}@aQmZB+l7$4Lk{b3F;Tbb!&haF%)iLqq<)`Kx2WW{)wUY
z$i!)E*MkCpBt$o9Ng$<S6<4YL7Dw`3nB0@bEQOafl*-ga8WuRc2}u!k)OmB6Nsils
zMv^Lr2LHrx-_Z3`uUhm#n?)(BG<4C`ru?DTX!?i2QVpRyjAaDuxrYhQH;vmEE*(1M
z)c}|9KE??S&2^6o5o_Jhq>3qGXAW`mIDMxl_4pqOfg_A;ET*z30Driwe9#Kd5L~73
zTNxlfI;-Cbr&N`ZYN<#+GQ<#@i&EzJ+FCa~y{DU6addIzl6vJWp5-aELdF@L`S;tk
zr*n1M<SI50Ub5*2n2khLrNpb-Ez8>OtadeXEm}=|T=B}Hf&P`yN7k-F!s@jSNad{t
z`Sgtqqa4!wPdafYA4A7h2XERIo&m_cTv?h+HcM<VA;3INpJ9376dovW+*IH4j8Eno
z)xSUg*Vtd$TtG@;N}}{rXwpds94I!*`BDh$=dt#nG>I5>eIoIeE(Z<j8+`qwXY3>x
z^$HM@8?I_3z8lPG=>%fPG7dbQ?zwCq2d50b-J|>%vCu_UC(@nz*60=|N<3dT|DHY{
zog(YZ{AO&|{MIdT!9hK=5F+yA>-X?*G4<bRO`o#@`muFDYx?DWR1JW;2wB9h5Uc<j
z(?jnxfK`Cz6EwzEMt-O%-s6-WY8~akdvLnn@-DisZ|Lo_@Z<YMDbsz5!<n<wRuO5h
zw%If1Lh|Kxmu6_=vTG5qrqZh-{haP3ikvWkF^}zjK&=pEE9_G4=dn|i4Y_5!bd7hp
z96xB+oV~2?b^<*b?b1xLwYv$FuT_n@?p&k!S1+REUqlZ$xY3((T5I&(HitS+76=@R
zc{huQ{<KjoSL#@va-GVv&Qph!mpUv(5G#7`Mdw_^%<i~;(u=V4@c>u}>G?W-!QMAs
zg2|#X#W5RCA<uLy&;Dddref9AYzXPhU!Nk5l?<qTu=iOka6Kl9*K}CIE^e6@?Z>6J
z%Mh8p#Cii|>)Nx0r;cB0l|%90ihEoSUb|V2)3O*|Ioc#nzss<5FZzCLIgMEDIjOc*
zf!h*lhbG-u;1j@v_VsiP5zlhIu#h~V%UCvyKP>;zyG=l)oM(cs$%GwN$;o)^kGX#1
zN?mY(MQQdxWc{EtjePTZ6Frwp67tb2N>SOhD`j8j*KupggS{zHsHRPO(QJPkXjR(w
z!uH+sABj(hKbEQ_;vKbS4xdB)BU6tnW3ZPuw6_@;x9t;6&zJx3Zv4d0zjpk&HdVwc
zJ=LF7sh$2USS)7NE#?VB<nVM-bh5;%V61SA%eH*`Wa2)iHx;4TIds@ECtmWk??1s9
zLGrJk+S^|Rl)SWw%3XJCT7mReJqq(U&lT$i6cBwwgL|*Fs>r@<r_IKn6?EeQYa$QC
zN)0E^U=C$_gpj(+Vp1BaWZqs0U)MOU#1kGq7#zq!@K^8J<%tO>TF?HhI=@nCx*y6%
zvcNr0-u`}+BZ;^B<o9oFC=lmx+wYfBA4q|DpO^|Fdq$xg(kMQ~i51|(U9z;{_6)Jr
z{^jdS*eVN1tUD=`Ei*ec)SfY9Al*u*LUA2RA~h#utG%Kiw@(8We5Uh?iWIRtJb5j(
ziabgN;G?bEZdK$=3TeY(U{lhx_pP61+0$8-h-SY<fQ_juGfbJM;ntZ^^L5G7jk($<
zZn*kXDOtn`;R#B{1&t1F<(6So>q<l}HL2|UP`jfywIES_JZUE(4Z{&Ns!5LS2n;hn
z;OJ1}QQkANB#a(9pvSw`u6bn7zSo*kN^22o_``E_oCjTR#%fxrt63^mPC!PrwJ2}B
zs`*qk5|@ti`0Q>BuC8gF;GomP;~H}yhdvqkX+CCe)*8z4RE=hO^Ri2IjGELeM+@Jj
zE?q@iP1hjM(oOZQhvGwzn$LZup2)`hTTA+~@D|_(0;X3Aam+rtCVj+I5^&Rw=(wn~
zsoTGfCzI&0SJP^>`V((Nt{kstK%ih9-%_%dbFz(<lRZOIqpx$D9ta0T^E>qvPs}G7
z)VueDrp*zf(*t4kcfXWUD+=X!2KS}PXn>-a|I)6`=o%RLjkWdTJP3G=rqjY8e^cY?
z2ao&#@9YTbW~J)6S#?Xkzrrt`4-5GGit~YY(at}Jk1kvf5V9u7cD$T#JNR+9+%<^7
z_x{7W-BG$rG@xfhd%7KoE&O?SnK`JAL`UpzO0Re6ZzK5}y{yZDOphbd0=+yuyC&U-
zV0@Pq{w?e|{_Cle7uvnHBH1x&Yi6Vt*7C5)U7*)Y`-PC&J2k50Z)P+HpA0WMC0G94
z+MN+EN_TBY)(vVoQlr(`UrY2rJgQq_hH^F7(zFZ;sZ;oB;!#My+s>xUtMbxhPD0Gs
zc%<FY^JI}wnqr0hnrzRv*tKzSIq!;MgTnCvV72D|3=n(#59^tLl?Z@6rVIPZ>q?yj
z#I%v38I#{#g%F2tjroX_k+g$W&;z-om|A7&VDgw*^}=vcO3;l{YRS=>I%U}ur-bj#
z59z+&4Fwjzx9oV@)#Q<6%Mw=4>_VEym!(E+APe1eWfXW3F>f__#6s=P9SmYBXDeQf
zvlp{^UOO6fmjm9|Y+_(nEpkSnB1X^&c7l7-O2EVY>(<<jSzq2x$o>0+Vy=8_uGyHg
z-aqyx*!UZYh7Ul;_$pMAu>xh1hFGO^PzOGNI4-4o)!agdsj`P4HRM6UxsiZcVvmz)
zF%OpKWPH#|@q8%pHIEhsso0A{+5G8(@M05tmf9}izTI}GlEUf2f6?&24O5Suf4vz^
zKt_}(t2IQMLbXK=`R<?v@M{Xe(g1CSt^hG%qbA<tTZ^thnRnb}>^5)(=6Iuc+c>?R
zEM|*fQn_6T9t>)*JTSZsH<{RP$+cXA#m+b;aay<;pV<|^2l|h#=At9s55fONenTJs
zLAHo+3Xq$hA!aIBw`(so)l*8@BO`Ag-r;5x3pixFkv09#A<80f<!!w3=WMADgS`KP
z0TL{1L5&mB(op0O<|XuDCYy7qkq_g_IfaB#LU~dBvAJ^%H<uX0DL@?lmomX-y$bd?
zGL3@Mr(dwC$|FV$r)woOK$^ve|Cwg-E9e2J{MzVSd+dd>RxjmpL1PIbUBHkk(Ly12
zlXwlr#ThX~cG|VRF%Qh_!iPf{_fP@w(*|LMf}T_==ImK_b}46qkCMH%IjcidOs{z0
z&qP{-sN@705#yCq&(cI=)z)NB!=p_=c*SgFBB|K=Bk5XR9lI%Pg-YOJ84-u=!uK$k
zAoH1FMOh5s{$b(eK4Hx`LaoGj5qQih{y*Q6C#W2T1_D3=<F{Z@hRH9U>msc3+P}pW
zn_br#8EL|eU?3ZgxW?yC+RIczSz14~`de;%a4%%(`lS=laXbZ;0Rb?8{VpqD^#|$S
zUD`iB_?J`^0LBDlo=~Z7ty%$3_ZW<?qsc;JeN;?wT8UG{^=>wqdp5$rE7{%i(^p+S
zJibGIPtM!$-*DAK=Znnzf<4ilGkNvC*0Y6~AD~#Jz!#weA-9gt1#8R2-(`_z&g(Wu
zZ)%);<s=u3nd>{AA;#2;ieaTng;fe?TkMjatpd`_5N)AvFSvQi02Ah=;+bJm3S&*3
z8UlZvn{VLmH}9wZM{1Ro2q3=TT|pxXj#ajiyUo#;y0JOj=I24qL`*RI$VQbiUVY`;
zH02Y7v#yzGrmz3l(mnT(i)95mfVu!eKd#zqPa#znj`H4gXsU6wLO&OlO!)dgf+1o*
z%KYO})$_hWos>yMM>x_Osub}IE3{M{3B3C5YL3c$;pQI4nnJ!X;))Z^pE)(x2xa>)
z$jouT15Q+7E-NcGZW}jsOs-^qk^eViJMbMZ-T$yLw+inH4aB9`zN{>JitRdKp?4|z
z(7=P;2&}j3x>mJYcAUedQ68}Kqe#e=cwQvgz11h_>aYMiXC_SUEDVQxs9UV6D)uX$
zQdwRQ_3>@W^X?bL%~f&~!?^Sk%Jpd`R4>`gc_jhK5X$!J#$7!H+qt_`fH=WM^TmLM
zxbgUn%MYb7X*KmDlVt3_GwT9}<?GYG0|uyc+~Ry99^Stlxp&Qz&41V+S>UgRH}b+y
z2tkfwcW#K5zMD>{(GKd3oJO!gEH38yq}w~)1HoDagpUT2(653Wb9RG|0cL;ls93XM
z;lS^~e?6YSzW}6k<Fr`!0jZ*7>uWQ27*5xFIZ3FLDCnlQEnZRI1oJ#OGQB7t-~A!3
zz-~FeZKK}dMV4`nh=Z|P?fShrvpUA|(OHqjZwm8UpqIAOb)-Ps+<dQF5NbMG%ejeL
z-oEib7jP_KPD92C&skw*vQ)^i0Wqtqa1FkjTux+<7|MNnvm%oh4p@+TH}&+c`Xt%-
z0<`%4-k)*kA5^PR#J$K!04VpOnEB1H@k<A4!VXk;Ajp`YdY_%3U%0|%ANGUNffI|A
z3(S<Hs$o&E#VXjZ*SfAf>o)jA!Td8NHuGCR4VYiK3&_JVaP+w~KtnK$oFsek`(J~^
zIy5r}ni&sJq?Cc^mt_{pMM+P9U8bo0MK|iNODb;UH@SN^c71E46U`V216y|y&TceL
zpY!$GwH1%WcY<nsWmoe3@<DsXP%%{{$SLT?!UX+YG!Zb+m#w~nb#162TC6jGNVf2v
zM6S7x6^@PzWfVt|lY6aO6u-0O{`$%Mf7$s&hQa{*Z7^WlV*Zq8c^7cm-ufN?eSw1M
z@kOcnC-=8oTAnaIjbjo!;?*{CnKij{^YvNt@k&2#iWI+Z@cc1UiRJWM&CI3aFVgnr
zX1tflG0S=ZqSr7`vk&5rN^y>_(y~^;Q%AU^J9!CNSd0L~I2nz$Rj9EiVCPSDi%WfY
zNl@p;NW9~^e$|z4R_5<;o*~^sB!8fIywDh*_k1<HThr2&w|1Sy^!E?s*9+9YVyb(=
z9_+Tyg-(^`z>WCm$=ta2eC@Z2rCNFvtz4;7GHJ4ye6+X1AQ~*MIn`oP9TS0Ki*-1F
zW?BO!>E-WBQnzwufm@Tn{sG5+^J7hHm<vPqkI%B{6+Wrw^W&zf1~X_QuOM2glJH$O
z<~{fA#1+vA70rnzeW=U<w5ZVVeTnTr^FW=?)LFq@T`B^wVqNASXL><V0_YV6M)x?P
zG-^d*mV|GMBbKA4v$56oUcwd@I>2H>%zkQ3Yl6mhZ5X7bk(?PY#tJ2HYYdf=14JRK
zM3FVtiC$Zc#=!yThCsjn?SMqxUv?};nLc-xh%do^6rEk#r3QUk%<%sdp2%jNAo$kN
zGGXPVt+q~l@7wfT<sXt5J;JQ_t%MCIW+KgX^KLrqFD=zy19kfU$gaM5%VzF`1y{Fk
z*2}|phb^bTUwQwE`ZBi7V++bZv*A>8m4mLUx4Q>SG>BH4p7$O_=2crh3y+jI@YQ}H
zlD**B`dV1rAGRO&orCb)`u<9O00e^9u^dfApKvc6%7}?EmjaSl^``lI3{w<0c-CIz
z%jL0(ndPU`Z`6<P?8jzl)03V_u!-Gy()vFx_#bS*7a#)ZgjTO3C@SW^=;n5^tx1Jt
z<`zE(LW#KQ8A;i@%QgO;{mc1%S+n~~K5}0Aj|RLD{QIjB2a%J(UctXpO~pQyxwu_=
zmVq1DsiQMcKQZQJk>)fVd)!vypCeLnsth^o{_t5Np_r}hb~0Y-W4!B(zA3Y^TJe)_
zS7Ag4&(?K`-GvwoA`qS8{0C4cD}dL2O&_izUO}tq+Z)Uk%z8WSJ{LyNU`+36mZH_K
zaOq7xQv9~yI#^nRWFj>}!z!5tTZRkqW7BeysnHkGfBQ!QxA*DAsm^?};%h|>Zv;<6
zpO6)Gu?i}Na?oa8522p|avLS2blf9V)Qjl=`a>?mroe>LE+cx9b|22U&q)RR|CfIf
zlm6ZB{JMbm(HD^Mb|%0+Mmk&CJh=7?XdLX3@{MdUk4;i_BJ;rmZZ4i)EjFnVk6md-
zX4??DM1B9~H_&_d?`o&Zdv=b+XAQcMZTE+-sY6~|t!T0Uvo3JHJ9NzjEjZcRt0~(P
z=~!F1z!QXm=FFU&YdqSyjPL^#kiql9df-S!z58&n{ekK;ht~nW@??s%9?D`=)U7<L
zNJ9lLZRPCjeXdW?kVcpR@i&hj$L|Z*CB^$Qle)#Wu^~3D`5fJnD&JU;Id5*{O2%*U
zQ?YsZ#6<Mv;^Y3fO40<G(@bLyik}eLGVe7$^jAHOBEqKk@2(sD?`PkY`c(yidg=&i
z+}djSrBbMB%MMeF@7o{*XtGI*s=6HIrs6R|Qbwi;UU$y~d3m^)Ko&7gyau%ayOLhz
zahsG2&;8j4tK5SyMS(gxX#%pVouk{~Ue$8;_R|~G=)WV#6o=loOIM|;1haN4r7Znl
ze7$8@Tv4_y8YF0dV8J0k(BN8l@Zj$5?(PACTX1)GcM1toxVu9Eg}dve&v~c&+}Hiy
zul;>hf2!8n)5e%%&Q9&la2b4)k>!U$sgGqpO%6p9r>bq&yJ4r0(BC%-zcysu<lB%c
z=2o4qEW0k%`lZUVE|dHRwD`ZbTGWvIgV78Ye;?Sp`XvhS5j8p&^T2@gRz9v~reWf)
zEndzj``tElYb?mIW8Q;NI2qT&>$KPVz$~ngX)6$qouv4aEDfPU!Y2|gLuwuT>VKcN
zrZ0eLzUJKA0KBr|v3gjHk$lgJVDO=&WmZ(*0w2R&htD0d<IqFi#(pi|xHb>XFT8S8
z@t8gmDXKS^`K^!{&bp=)T&AQ4t4%D_W>&|hb*_pR6#1B0{uLb<D01#A`bi~u1b~q-
zdv8F_i^GepxH5jnW->F3gA6Q!sMqq3hOo;HvBXWo$=GrUEx!zpeGO``<qMtt{W>>m
zJTgUEy0K3bo4&lfT$$yUTRRm0@4X)X9foev{vp6>#ZRZ(#`sMLVR3|`B8oZW9SnPi
zq}Gh}9x)DtJqtYKLv!G_KF&2_58Gg59*Xlv-TKzwF1_=X(YsIYbI8!F&5zw|o=cAx
zZzJvvC8?f&q7o?K7kkv;AUK~UWZHGnX12fj-LAv7L>~=fbf||CeRIXo?m>a=@xi7E
z#VQS|GagFPsq1i=D=8j`#{2F$u*O=rUt_kMA6iTG_w>M_|2H8~;XaM5%8H8W(q&P9
z9EC$HwZb>ice#zj2F|a==9rimt~>fv#w*C%{RhGDI6I8zhoq-d;MvYdaw@0Y`a-ai
z6X7dFLG~4EI9*=+LDZ;QPaOd|;Mdo$2><(G4^KMjaB5fD_2N^ga8Y0<uW*x(XR)wR
zo6J4_DlVF?1;9j)@l8?Sp|s?GuHF*Qhj~hvcwyfCB0bh(lVT5m6fptQC+IsGWo76_
zxH;xX4dd%@@Vx#st}Oa2W*Lo~@N1)i-iHHikKx8E;|rAi3DP(6*ClpdJ_y6qF1<Sb
zQ$U#9^5;!jOT}(R+jb>CGX1K^qE#r_LHE6j!FosS^JiFCD8V29{_vMW@}G^Cnf%E`
zY~l4sBU3h!21J$Oaa^>T0zeb~;}UR5#!<^2_Mq;$_`8Ew+*YWyj-d3GyZXMYBk>n-
zNUDz#K7Qgy-O~<QNioEzno6TzAg@frMOPPtGvvov(1xPg5prqjj!!Zzq;eiLqO`O?
z>_7bo6lj}b-=8pRA&H%ZN}Vzvu?bkFfn7#ugz2yGd1Le`g1b&{6Oqfz3L~|C!eRbj
zMD;k11SVUygCkeO(4z-h4_pE4wN>-A7JF$M=5tDmb{)PZ>e*PeVVMz&mI;KlVIw{3
z01^+)#f}A3(iCN{;|F9O5!-20>9lIy;OK{Q65n@$7g1$c@1H>8{_VvbB1wt=eZBwp
zWuJ$A{d2sS0AG(rM%5$Mhbna_%sH+<Gct;DfFNys#k?*iZO18!=-F;Y{s$+QhQ=^H
zda^Ggp*D1vMK8(hSbhsAVqN#skK-0-<}0m}`2-x_Q5BHejTghI+b|+S4EoXW;9?2v
z;G)OZ5S>t*J8reGC{X-Qr-ligAG65j2`Z|6SJl@NhdE*L7$%bbO|Z(Y^&ap%<KY0N
z%==<CK|Uo<grmGq#I&=j<Di<8^&sg{EkIG(#~_HBMfEbV77C_UpjKnQuZ>N!1~~Kw
zj<5$grYJV7jxz{{@Kp=LXH&)`12~|Nm;UoB^pE%I9v1zltMy++=L$3)Du=%S8X7f<
zL^Vp{;bB2IxUb;91^ddZCUS;mlu8r)@2O;8N6KH3U)yZ&<FtW~_tE7k>3M1rlyf!-
zxnW0P-wfjiw#MJ06d++^vm`u$;PwQ`JpqXzE(J|DrG-=?tcV+V*B(WD0ibLiyl4;G
zb{%dbiBGtp!wi!ZCbsMY5_V!_zK9=Mk_kZC=Y&M5=eW28;MX@==>PvR+JD@t8y&Px
z@~gk6)@#Z2_X^M7l9q2OVr|hJhBK4;jO-*2R&rt{;H!j8Rt}P5<Ly;vp3JnC_$;Ft
zO%ZFyWA@=a@Ula~8Yr;8`E1d#o%5T<OYQw1qzju)XCu(J@s&^+jx&OYhKRVNQgS+G
zA2NgGS~rXeX+#lAMQ?@ibjy!h@6BXro><>?BI~i57YJ^dv~R9&Q#;n@WN8<kp$p^C
z|3A$3A7|czjZh=Af0;P{;pndrfTO1>zd~uz=@SL;Q|9^=$WD9WoA$`<*B8;R1OY9X
z>kd1%nG3tLXlBKvi}7__(14W)eZB3$b;+!udToIT*HZm=S3wgh@KJ!-lII!=<s6XH
zs;vB00hnB!&xd=C`S2!4&*rvmN?SeDUWp&d^dFoFKO(GWRhP(`ns2U1%=auglls@@
z$XVP<Bc+NXgvRVwfrQA4WA8G}^E<qukp${Yr<oI1OT*0f@7L0BW|r;#-ezoFs)wVZ
zr@I@i#L1RcNY+ga+FE-nihVmyP{V*+z>i=OWYf_==8|2h&o$E}RmJ9<j47?PtA|?%
z@xBKfJw84r)?*cWl$YVld4L^V#C$*gN2mASAKKDD*ZKq4Io;e@>bBgK<#T$Q)d^6~
zxM(rO%@xNbq{mE3HvK$%i903BvIx4#3NqtUWLH9zv%(C%Dq4sZSzx2ZtBtjGmtG!G
z7{>qIR=NOl&v)0BLPg7f`LV<O#1fn@sPNU=Q-{k2)@y0jU1QtQ{iJHw4QVaBX+@Q*
zCJ+jyQU2`|@0GuPKI0Rvr0O(t9xEDtcuTEwk_w*lX^585Nq&p<OxII+z8a{`L1cY}
z7??yQ{NUouG=$Jx-5@Du|5n00vLQ-0t$H67x30Ko=WMd~E)xl_@BfJxy$U?*C?Kb!
zVf;p+%tL4K@V<Ros=BM77suuPFKTYitS&)aWIiSjb8S+G+D(QyA`cG@-y|w9q92Z$
z_|Bh^dN4oyatj`-K1t@^9nn9}cysS_%hYlZ+Jqr-{OT&<@W@Ee9GogC$EVb&<V2;n
z$TjK_5$(Fzw8ht6mE|QwN>bbL0aBH!6X6Uqervh96D~tcB&<vpN<7a6U+jBD)SG4&
zLrflv>xR?f9)H_HRFmYXmby7*O%>BzgcBnsUEPH;h>FsdJ0SYHSz%$$hwZbK_<~_V
zB2Um|xvB#CLg8BX(K2Xu<AIq1Zi;~i&4y~G1rfQVg%|g)F9M4vPdj#VhT?e$qh`ee
z(@jGzy=1);MA1Nn9px4U);zC|%CkyAFQzEJ!a-SCBY*Hwiy`h&nWY@pWM6>kptCL8
z&}ZK+55=ddsH09rSu_8@XB{7N_%L^UL|~G)B>J)}oAOiTSJkrE7*eyV;o{H12G<;m
zGJFfDN)?c}zoB8c8y(?=%GzK022K9V;)E+q?7qxy_(%}tZ^hJ4L|q)h&0pYxe;FmP
z`a2?-Dhi@Jru=n~iYjmFWy3XEbsx#kAluj0O0KI`00GwhFP5PBVbbJW*P-bcn}1yj
zI~r92TmfQh$-d@02GR-qQlf>Tht8K?;NoMzrIfW~%!v8|o@5`hY@Jc){6^qgvBM|+
zCJ{@&@{D3=p>O2>S90@T(eDQwLWB3Uj$~gI&2SuzpG*+;9omW|TeOU@utVF$R9AlA
zkNRyr?i;_HfJ>L&VSE(9jyH@87BAS;<5^{v2S)MUy`q)-Xc<O)FH{0=eFR5xqA0R#
zY=U2SLIUho6id^;d9PFmw33vUmF?Lt=bQSXmUs(O7CEGQqt25*Fdy}&JNj+|AJLH7
zp9$lIWWUg9m7$7N2tJ>kaRy`BMn+|(OG+Y{6Vl<XCwsR^{{I_322^wf-!HVWwzfxT
zS(#A|5@HN4drd<SxebM3dJOYpjxHBNZ9FD{8z6?w&RTq!!?|p9)+y7`)Nlp;4TejN
zi!fF&EN`LEI%e9#HYzHD$hX+dR{~p&aoS*4Wv|Gut@PzShGw3`dG>s9k6*O#CcWhA
zu|3S=5y&rRXn;?qA9M40ren!!kJ6FyIf1q)B=Z-WDB-yB365_?M%*fgE;mGiHtiJw
zJJ}pka^IL-dUH6T;^NvbSDNF;dgFX{HyC#M4(NcMqFKxDsg&8R!j;abcmy8dJUVS!
zHwq6Q$`$bP=L6*wv}0{@0>VGex`Da6V$+Ac(uN`Iu~9wiUVEU~xr4)PjCAL%dSyPd
zs__<FMZBbnCykvr7a)#qQI+Z%1R**h@r^BU?#c6>%~p>?VQNQZ7CwZ;^@G&%Wp?iH
zV<Dk8ongd#l!la6yNQcrG7P7lW71~x_mgbAER@{LzD1+)tSC05N_jL+O#Uu2F0SZi
z&N?R_j_HyHt|`<(6kli0X6_yNI56mWN_G{)jS_{B8OAGpvxccY-u%?pUhi&kmhECA
zv@iSeh5)W$ppQ~U`VW~m&*%NNXSw^&2WXPYw=I%oC2w8&*+1WU(0NcBiQn{;)1MKo
zES|6ZSS!ka^nL;LQyW&?-gL@bZ)ORZnBGnJNkhev-A>k;5uq}tFh+y_Prh_0-bZQj
z+weOk-Otly7i-mN^pvkbL9_<Ti9_Gz^~Oz%mH@8-sD3#{iX$Oi4NBgv%4#J)Wu)yE
zOI^9QF@Gl1D}5o%!=N=(T4lI>rQy-ftNNeh<J?007voAD;y?dNcQ!oqvo}Nf*FUKK
z4q!)WPMlL3>!&S0UUO;9lZU-20E-0`rR)3tHK~#hwfIH@rwJ$^YJ!V&6IxyA;9JDS
zAon4jwee{O-32YL_+5hWjqp$zB2cIBOK1St&g5sCN0mp0BtiBkZcdbp+&!ZWr9Gyu
zN|_*!1cjc_Yy}H|x(CRh&G$B>NnzMW6)_{;)DlwQeswhK>ER@)IsEVi8~d~<tLi0<
z@+e)o^ZY97Dt6->zmc#{t)l3w8(D^y<>Chd?Sau^h;oY_^{`iP*&e-$QO?uO-Frpw
z3A1Q*wNw6sFr9{448_s4WvK4cYXqY_C~CvgBQtc89FoqKdvO&SvSUkrB<0#aQR0Yn
zg=(7#>Js;PF$)NiXf0HpKL3Or4Gy<*hFN^9J&X?p2CUL<>JqSdqj^OF=QG?h1{gi#
za5)x8X@9Ut4+z`_*C2y0o$a+vcWr;^;KruIP28_KW*1?IL=6wo=Q)Um>hCW6l>GNF
z<}dfjA2#d4j_|GdT;@QH8%ypPAA8Q*K;7qY*;T&d4hvhAUx>>i(c%Czly)>)KFqy6
z?|a1~Z{n;kt4;cZP@#);nbsBAG2eVA=C!b)u>4{ct2VLJRB88A4Js5Rhft{uLFS^_
z(065_sQ9>bJjY4L0t(!+VEse={KTlfK9i*C@XbE@6trb4Px7dPbF+LNha^r{-*@3e
zpy2mMEovExu74Gt_TN7<C4;qkG~NGY6x~F@zdEctdr=38icnX~!o!g_n+r}@hecqC
zR8}cJ5$`trrhQ$M!K=)GD%43+4k{AnDXNWa$L1pl2Owb$CeVbfT>0tN%W7n|0HZO2
zpn*%Yi8Ifs&K2YwK}3S?Lsge;t+bYM8;SI@9xoo{=q8DOTT8~nys_+unT^4nq7*Zn
ziU#Nz(lyWOD;|DaH9MgkYqPF9T06d1$y%?NY4Q;z0%5j?R!eex3)%Uwgo(ohoSxAV
zQ?iUswbpCNId0!kqO`=o5iv?vOWF8^hnvbb`QM7mM84-eY1d5oq?Ht0SkNjflxmxO
z1^?(%$S)$Z#7dea_*-YpDeE`k6l!Qz9DrxPjE|<JC&x(^fb#VcCr>}~l|VSKL@54^
z9=m%BKID&M_{cNGA~dcTfP*woi8asAfd^=l^VdR7K>}|zSzqLo_k}Qz`lLA#%RWu9
z&{mHQ&t3Y3GVvV44<@wi`oaxSaP&Iq3ae&)$6zez!pi<zds}L}C(M`r&>WTD2$~(d
z+IKe_h8`V6I}H8vK9}${9=_IE@~%U77JsilmTfQ-E<{V&ek-7)wRKMmPY_P9#c+w#
zAqL{0_Z$vP@V$a5ZHwyg^#dqip1k1gxk)`2Q@e6opcvr6mb^(v1n+_ctuNlVUK73{
zh7Or%JRB~**F++hmNSVB{^6#+1n9la9P4!v%M35GJd_GkS<=Ew|ME2dL@mz4NGE-6
z^lCD=@{mgDLnud|?-JDN^rf%2Vp^BcYu$5>er+cw>WE-p`Gyy6_3E)kg|+a6hq+j%
zwFcMr3m3DKY0$sd8rF?BjME-ne1z%e2<0hDLO?ZHiB(Ba<88jQx-AJ0o>~p0D#=w@
zQRDZ*kN2U>ld=y^Dxs`dSJE<u@odq!=i7i{KhN%t@qPmC9x9ji?DTS2A*Aj?pK)Y@
zMtfKMe@wJR2H~7tgX3Sh^8MA1Up7eZF4O>aQ5Tbh@He?+0PV0;f)QqVz`IDom1uVq
zmOvqTe1-9%&aojrF3*VkPx$2TpVF(iydE?>Cf9=NM(|bI6C@)ZBXcyKR(6IQVpUt<
z<$86sB!Q;)CS_U1Qw$5ZihFFjC)YLZKh}BEqH+rUrO09gLZnIg<<{m%bS8V;Eymae
zrBzEVP3-;Y&0jC$&H&ihts(hT6rTeTLOr$WW=7y>tKK-UKavq`jZ6t|ToP*4QN71|
zVX3W~j7Mgd6^i4_PPw_O3V+VuQsYXYzZ+<95oxfdsM@ifk5&tBwTbQ3Eq{EY1UZ0?
zMwy~z_=<f$5LE`s*TH<gLKIV4hJ~*zjtu;=(B^6H3zJ9dvm&Ch?M*$b@P#n_OIx%|
z?ro?qJJeKlfI=?QD!e_%;_D5091a=p5~R{vWTlL4s;NQbIrsvZDEpjwe1OF*QGIWG
zBWEGE*t{D7k%uzqDH9n~?C9$4*pxK`c%>{;%X#S*6(M^fkn>wG7~weMyK|eJ>r^oV
z`6QR&s~$P6VGQd2&z1cPZt|DI_0R3mZM(SWD(>rcDU?u^MNAxfL`%?Ox+!8adV*yX
zSa1WQ#K=jU_z4H8pm{t@IR16B_MEyRsk<dxh&DPAn$I%2+5%SoH-_O8X9~NNXMEXB
z=<&Q66I9B}qT9-1>_Bdvqr@-wlf_9rKY>|tj+vx4;V9t;hft4tze3t^(K2%({ol^Q
zM&X+na>3nSX0}z2Y@-~p!2b!#UlCTxV2^k2ztrM1{VyL2Pnwe<b^6suBvFpoA0RaQ
z>94Jk0B<>+cncA${9-|Gx}%g~4E`#BwwR*omk%{^Y*NCMB>F?XRC4Y*lcM*1h#hZg
zB#O}B(U;M{a`}Oq)$s3FM3AvB!!Z_pML*cS3LO5yuDnCg^E>A;m8g{$$u-DuZ1LG>
z9h+TxZ8OAnwRX(RqTY3M&_urDJid-oy5Loj7QD`#oJR&FGPD!wpk`Fz>lBygfR(yy
zDRw?#?JoY!gO<7v%9H#^WF^$n>RHs!RAQvcOlCUfnCbP2{Q83X(X!duCoG(SZMG>Q
zZ6bYN)c{n~jY}GCX}7!VGl^$QlhKwH=6r}GB8oJGLI}n(%Ey$VzD=dT3iL6R2|(2t
zx)G@|(#qktm(IJ9Yp~8ulA1VTD4v|yCiVK4f&TOQ`DtLcfshgulF>zqgStB8Qs>96
z+~?`Sd_@cMni%fS4}kd#{{{Z8V`6-P6CT~y`mA%p^m(#(^b?Xo9CFOryX5xwM&sq3
zt@Qk<5ktj6Sz8*0qOM)NyO|73{sUp!IYj2+a4eOa4?nWe{a!+p3aCU;<JgXeOzt!;
zTqEvi=mzX=>y1RYu3*4wC@ZJL@V*I;f7k;1I~qHCc_R)gstB;z-5_JPGZN;xq3S3<
z*PB)sz(bTvT=}t`e>zY3+jy0TYK&Q0+yJjiLh%fxob?LbTuEk958>L1Ybno72-U8&
zd1Sq!brsldzMthv^cOLA=C`}<5OEg~y_MwoQqWh3K3{xl$|~RVkiII=9ITW}8nNEC
zf$XoLO_)cMzHAfW?63J0JL}kxS5{X~Tig)L(w8*LeVNRM_M~&X#y!jhuiX8aX3;iN
zhh3J_lRh#_dKk4qx+n4UVqBAdkZ5q!0S@@pL_~MgC#R`+VAFRM$4ZiUuW93{bhk|P
zv_KBgH%qwG9sGSH_}1zT<G72$vaDWfiw+u0eTa51+|jJNPrgQ%swUy9t_icd*8F0a
zcZiBUd#4;Q%=gV`56yQ24%Tt&v7sK&-3K(sC&z^$bX>RCvo(2HmY+|x?Hp9`jWGUa
z7C@Wp<p-knNt4U^{Zp^vvOfn<>#%eSP*Ob7C@$9wf<$T)Q?Eu<tH#6OZ9%hue6oYp
z$%LNTy{4*^<sUcomfjg_%pd<MgX5r`Rd89OkS6p6bR;-*{5u(EebCNvTj@roPGRcE
zqq7UaK4kOaI%|AP+yg4ie%-5XVCc-YiWnVt!gd=Na1J!sEta^8SZ34vQW7SN>-%Z$
zkm-kO_Ut^J5XSw-&s|v~0Ke#?E2>L%Sf=Y3;UBnWk39RM7cb7^8JrR~WjO&~sw@kT
zAl{1oy@R+zT(V4;wti|M{>mLvMT+26eA>bAnW!uH{m9hvO5Yir>fAO*FW=PZb*l!S
z<W@>`p+?X{3n9d)R9FDc3AbLB6XZdw|GI2jt#Zo6|Mz0j)svA3U<Ub|C*g!|;iv)C
z-)=kUZ)C>nz^xGC;n>FQ2LtvixH8KNiS7V`MsFw@?8h9-5WID&3R}SrioKF$+56gZ
z;#>pJ3-X~frJ2G`l*tOWKX5X6>__*F+jWE@78s~>cgbqDh>NP*BRn4;5qeN+wtf>I
z<|Bh-W4ZEyT$0TZQ>`{U2a)5O&A<2PQiM%{mS*R?qoXqsb?YVVPqc|$PDDnU;#UrS
z@%cdLii4CSd8>Hkvi`C!D=YDhKS{W5yD`gg>U|s+$Yw7t;-D+mz$Egpz4<wgX^ZnG
zo;Mj5l>B|LD6@6#%aYF~Z(m|PF<|b|6W)Vrq{$lE`G5%w*E{&>)@^4Y`xk?1PdEQZ
z;sbls*(hx){2^_p`nrtH+bv@6<W_jMa0gA9;@ybD!FEw3Wirf3(i;af&a2B_BBK~4
zx{=CIK#W*`(I0F_hc?G^9d6s|##}2;3@)VUancf!DfTZZ(XQiRjXL>KC+cy8EXb0>
zCDuZSyQGg&yz`=JvZsYg<2S7iW1eN<En;jW8?xdIE4tf{&Wu%Z96SL)ud%3(JH!k8
zF}}?2<ZDj4^2+CU-<XQEgxqZ1&OTZL*TDELmQM_4kMfEkN28IUW^7Vt$1rU%*Gs70
z&{t~vOLO6^*c0<fcSJz7rqG<=PL$u3Uta@D#Vx~^lKzf#(Da5G^vn*c1^~muVYR|+
ziyzc&tv3`J?oSR*;MrI7u*AzMa3{2Rrz{Nson!vgs0DrLQGEr+Kg%LdBsX)CQfIuH
z?n)?5l(|;?0CAYv7pqV}2d{C*9ZC~F$IGg<a31vW7?ZxDUsnh=KMF`hE+y&&^;-cV
z{B^Mo(6anc@PEu9nXq{*joS05Uj;!$IbcN6G^LwkZe)dJANjLF^?~EmZWhy~3wd}#
z*N)x&%^XEEcmkecI5N1_kx7T699yVjoDo8=1?J$oX;JR*0kK-i5CiH<1?5@NO4&&$
zTKmYj$2h{)&{YJ{TwmB)*%>tWWLw-ZFYAQT&jKNl(5UiU-4hznj9)pG%{&SsTM7_@
z1%gj6kO{#bPN#fO>9(k&Wp4lchpgiC2khgDn-ZwCE6DUP2=!J&S-mwZ+_EOai(y5G
zW#y6QR`D)TZ&Lq_qFT^)N}D$Qq3ds_f$+VjO7_z4|0>h+>O^UJ6@I@^T2J6H#1y`Z
z&?Ph?8m4}d56+Y0hRoI)^~Q1VI{@sP447L@D=eMyu@ArVD^-u`j{dkXAeJ8al={J9
zF9-vuojLy9jY9b<*{6(yxg;qM%%R^4l~s~LlwRR4TdzW=LDKFJ7o{&LP7&ni%tvt0
zc3$Vnv;J5ct+52Q5K_f)p~aH~EJurvcl4R`C<~W!(B(~A)00j)1vLTvM9gRj4%YiI
z<1;uttBCXOq9}j{H$deh0EZ4=M^v=-%-E4yRX$CjdJBKx*sjJ}OWGG%>DOi1TD;=|
z7<Y%IJeI@;%NN6mhvJ)A+hsr1JDd4B7q<M-#LTa1%{l9x0b!>j4P%{sXm@@k>HN!W
z5wi#QRjhQYzULz=iu!8@_2S`r43CUcVPzI`z~zhInZr#dEQ|Ti3<)7V#3_m2^YOQ;
zaONM?Z?yS;oRQ4zGuce5F8{czs!##3O~H8Fst49IV3Cdn4pXwbIYcyO<PpJ-d$L6V
z)-fGAjMgfhA4U<mUB*rz(w57goimUIW4c+_U9;BL-Tt0~kZ;@76bjjeG)w(2<b|Zt
zRnebJU_BOQ+WM6edgE=9EH?s}ox3AR^DG(;v$&Mw2#TwkzHrySA#k0gmN*Y6YI2qH
zreW`e+<)DJJ@#6zp1ugAdUjy)AYJ3BUd~WUjgoQ%WwCNVgV_}^Gsy3@2^AoBV?#*w
zXoiG*YJJRK#<N%D%%(p{>=6)yIx7H~8&@2eOkl_PY05No*A6HSczfL<OobQ^%kZ>f
zLubzsRBj{K(Vmpdy-|hJ);aeDARDtcbP)ixv-9Uo^W+y$s<|UrGL5q~Vf!U>)^V4N
zh|6V(^bS;^28fJ|%>a+qS3kf4-Of8e{4D-X+3+P^zU|Io?%FzA7%ywiH-8<t9fky&
zbutDFQH@$p9e#3gU}QR*uMj)Qa$oI+4#52OfBiNv!PVT0Zt*deRqo?}z`i(}A6ztZ
zGkwqMkx^M+x{;v@;-<Zl5uM<IoOQl%?<Yj<4kk)MZH?GmK%=e!NX~D)`SIgju4{?(
zwQjKu58B5e#T{rL7mMwa26)*XPwwtkC$v2;h%VQBxYe|8zLtskx*KzKk9XtOhxGx>
zkC0oyD;3;R>C2%9xAU}s85N_t%$4P{Rn-DqnDhkZ+`t?tb%wqxcI>1H`^+eX)y>_B
zGI2b&C~+oW9JP1wwq=XhAOa}<GeQH7g*njJ5siamfx8<1@cH(1CC<K+D^q=8w3?5T
zX5;{a>PB5kzM?pDoJ2q*xx=ejv&~8v2HPYE-=1RzOgzPw?|^NaeBi-GMi?l>Jx-K^
zCfk(qcZZAgXVfZ_6T(c)4nB{mlWbfbGk1hnqEZpBrEH|zCh-G|SB&&*=u<}6`jt9H
zZ^Oq^cFsAU53DVzUfgP8%aD#gMMP$9Gw{WuHx4X&ryf16?PvI>4yY^0_*v{6+ZyD3
zf%T`XWD1w85+az@gL6Iw6RxA*?7KEs#oeL**qgw{2-=_G4%Ih~yp79H$*JmwNtm}I
z6a2`~wND!(S=17z<|uLRpI6;(sFf87M@}wp(wId7QM#&6?<J6KzmG`~ln9%2R57Lm
z&lQYPX;)loBGTiTgfl__J+znN&d2!uw<NBa(<iem&iv%>tO{Rv?eKTFRf!@aX3MK9
zBfMIgO<qG$lzKG4uL7rGW^Zl01H$yY<lG3=fn5nM!H^XFh@9S-@4ZpqMEy<nQ+m&3
znWeFvZCgJ^%aD2_n+Zr!j5niJ1g-}>ni?E5)7l+0>+5XZFYQ%jyo-}R992-&ep&;^
zI#rtVdo37*k|l9AG(fFmX`3?2<4g}Vx$S<tv%2>!wmlQ0=`F?WjxPk2ybLN~5wNB0
z@CmD2C2>Ql=j3nyReb%Eb6>?n=;KC{2R*!n1jDuS1pz#j1p9pw1bne~zl<rkeyX1S
zhEY>Gz<o!q-mi+k|3EFD$?3~Z#{P0w6ORQuEO3N(w8-X!LdH>8yJ1e~?KN)i0pRF2
z5M+`4F-%=RVAYFG5Z2%nXWHk?9T3mLQOfvUdiX7F$%$%iGoA$NSD1CaCc9{tqo_((
zAF&fHs2gDsj3xxe*JU{L6`^)vly2uin<y)>4Spxboe7}w+YQNF$0A`YCH$t2dRKn*
z*LS(@jL_Ub1k4YPacQz>gs)_8LGQHHdD=w6uO=ippYpk*@Vr_JO!Jr{Yx7HW4Ve1)
z*!*;9;EAJ<>u#m(B_MP07YSv07shTnw>-^uYwfQ0fabtSKnL&9#bcgrT}En^`V;B0
zmAGy(TBCbfy&?HnMR)pGt}gfMz>2f#lxzX}9pgntqw`gctsu|`Ds24fdT%_x?d$3r
zsfe;CSVu9h*CjY;1ufgEO_|+Ur^tC1Czbe?E%sE5ByU}zh2^h0h2cAz)U6jPHbnRv
zVnVtLIWWRVz!A;Xp0C;S1q9^0=)<3QSry}~_41&~#=qW1gkC!?eow74Ct{bSy}pEc
zP;iHi5lF37=XRo~6uhq8p?_?FbC>G_=w|Rn_jX`p;y4^vc7iSXfmS7C*RBO8+Xl-%
zeV_Q5)E9p<>n8Nzo^{FcG@o5%q(3{6m%IsO$ThA%?3m-W3-WCB<!<P3gL#;L0D%rJ
zSv<3ph~Kqj`LXxF&+;oW!z|jz48I)uE(p4%nk&!Jorc(GE7OEjFp(?>_tIbIt(==u
zAwOEwiU1H87IUPvmu_g<XxtT;7vOM-c@Z<Y%o&F8lCpY2^>~;+L9u!H6`6hiW0Z2)
zy@4!9Z9X$OdJ>-G0MUAHy4_*`Rv-QoXi4~Z94Z#F|3PQ9IVhUVYN;?Zt=Ux7eD$_@
z3S9){Tx=?V;#wapq6aZBj@%(^mVV-4m>D96KghegBw$x@X)ts}amiX0<^GAim-obk
zv(&jffc~`iPJ(V&_#6*%bp?Q|oSkqZq~2?a!-5`~nTyQ}$!km=BVz6YB5W0Q7+H%(
z526OAH;2UPwC3O>nT7SEo=(q<Y08cV)*P>8N?j8g<7$OEkba~AY3%rS$iaCJcs-*p
zpv;smhb!LkVD^b5?oy5+Q;uL>nw&2XcGt3hU?u@iML7kYY8#NTE~|IFS5k7M2CYyu
zp3N%+Voa;ePf=C^UoItVc%<F>R7?Pa+c~BiE;P%M^8MBvwxW4-R^-gwZ1cgckrTQy
z1VuPtew1Pk%s!rj!DzlVJvR8Mmm&oQ+l))#gMw4o<4KoqK+~CkNtxn=@K#glIHo8L
zE(|(kICRhTJD$@s`f8v@uRB@ga?5XM{&i{mKT)r%F&^xOmxL`2a94%IPgu+#t5Uq-
zz7*tDlJ#k;%zpCK1*UP%Qp`m&{)N>Jx?;7SZ>N58o3D2bG?{h#wyRbT=xw~)-419*
zTMDAzSoj9eWis=eAqsnd$4@X<P~l2r1ilfQjT9cJQwgbhMs{l%y=l&R&wtkW@*sT$
zUWg*C+?Pcj#85Vhz*EVAE{3GitQgzdtntLy!z@P0t@Fkvtc6lhR?E*al!7)36EpB3
z$E(r_mdAHs;m8v&Irrn_$_*?$s1b4m3hgyv6`H!&dLm5N$3KP)F8>G_=BKzl^)5)e
zrzM6P#JMN9S&rktP8TG_;LjZHDNz!DktP&buw(V@;sJ20ht2W<@GWJ&vA(9XpuIRI
zJ%v7kmR52~m(vtNu?y&5_}MTaraLmrvbdf{n3NJ*x0K>4M)kTc-3*gi$BHK=8KC%+
zUCBGjCv3@n{Zfgfp6l7>bzaoEPQ73QK8ehU$dFppIDK!S^ybpEpDoi!iD_8glZeH^
zvzE|vf>&H8lgIfBD)pTG4~1wN@vW2qaf@|mA4Q5@o_;2c=V80jn@8lbk0xuDpduF9
zjF<XR!t~ECWtOg)^WQP4=<fi*kLcap7Oi~bWDQP4!PIY0$~s+NMRMz*)^jf~OOOwY
zQ(GMe=4%nhHHx$IPZ?NkzcRHWOm$L@7aqG45awp*``_c0!$lb%dq#aD{dWet+eYkb
z^iL_GP)puLy9MAm_TVs0|B-w}O1u`Fcp<O1_KIwnzba;C7(Ll(QhpwvLm$<V+xEQg
z{7k3OOoX+40A9#iY;ZH=li3+FdOG2Kq(hk0qIm%)y)?vyw7AmSB+9T*8H;k}@8_Dl
zb<^plNGt0!3qa+icF$-nJ7=?p1p_VhAg3u?Qkh4+fegJ(@j27Dj97(fA(WBtXd`%4
z*Yhf{KHQG$T_Nofa0p#p3c5KIr}zW+ZiMn4qIiTT&RhBm6rL|9XsH+m%1M(&iSdHy
zt8EO#1<hlcOvq<T1w=YnLtk~4;fu-Z^R!<MpUhnqLo>fJraO7aYPUou$wj!+7=^-X
z%1#or^Ut@oVPBs=<5vW1@AILUAY0K{)uSDLnO&he5qFMnb|qMkpL{cseY;TH-z3?X
zAHg;LHFj@-GAkdEyt(K8p!kfX{imd&E@OcCIW+0!u*s*$k+#yyTw&+Zg1l!qIUxf{
zUrfnjsB9=9TY4|K+b}~<SAxQQgBJn5W?_SQigSQ-5=Mq~Y{c$;6L?jXGVn9lB8@W(
z`jY&duu4}doWIJyY4VJJKe@@S;^+Z*-E=WbAmE0=J{A@}0P7LLG%#UxFo#?IeI`;x
zroU^-Gk8QPlhyzAxBa!rr(~o<`}(>7?jT4w6n8rqh1>82XJA5X_RkU<|3<cqCj(J|
z4as4IS((%8<CL1k1m0Tp;Q*y37x~qnPzCcA5TJ~|Zj>nfl<)(n$OVlaEh|3^b@^!-
zb-J3Y+~VftdnwBfA&3Qf(O(YpULB(7%6-0<N{tsQX{rjqC6S+kT3TYK;tYXXnV3F0
zOQUuG6F3l0g!0D3w-|N$upe?Wi#et6*cIRt5aL;ZwAz27)qW0^Kr&NjVncvo@4_D$
z7}G-CHAXQc>^hAC2e*^tq#hp!)4P8X=kSAzxp22spZ)<R9|*%JC{%D2<Vw8S;rU`T
zY9<{BgNr$628krE2oNDEzMYJYakg$d^Z-Ci51ed28116)sQwV}lE54rxS<ENXXEy?
zi1rObMVrHCfNB@?I|6T?Ekba7$`AY#6LuEZX5~O{_g^yE+Bmn>sX@Z=5R;zU&f6xg
zJL|3Ur=TNyG|XM;Lk^V8c>k-pLgZqlOe$%d?Nqkp-ySA^x_rIiPq+?b+8P{<Fjd5T
zsL{JEdG|_-20hA-$g0BNN3D|#U&qu<_wn897qUNXPJXj+AYQRD^vtxatcctjZBQ?m
z=f5(_NDC=L9GbZ24c8wTakY8s9*0YbQC$_kVeehtMd1t)8I;h%0>n%!!qKv(IZft~
z_;`=pGCOZ91UUI5yH!mTxMW-9VDR9;7nmeDfaI>Prp7jAT3Hlz7nDjyWL4~raVfX;
z)>xL={NnB+w`#+;bhl)@s(-LKJpgAn8IBIoi)35cV(ynvtzqtvPx%VTrxVe6;Znzl
zP|M{^rkD8=E>G2)CMLCm8<yUC#+z*1zgbuN1N*I_VHYg&F-`$3>%0jB<)OnjH#hm2
z{wQH(wDlsSI05j@YS%5|+i={~2iSIru(?VTpI*5010NMpGt?RTL4(Gpl4@AAa@0l5
zF5_7vKMb3--Z#F`M5WgtLKH`_&H6o`R*~oqOc(fFhz#Gyh&A~i<;0EG(zHJpD|4}1
zgKD({yppL3?L99vosWx;%>1nDOk06{c$WOPd@~d0EY8wtsYXg)50zvAjtL{=%Lh_4
ziKx9lbcnD=@6i**_%Yh+n7&E*2_?EHVLe4YZVw}F;dQ4G7r!%LinH`Z=tZtoz37Eu
zraKHuKSLMa$$2*HLl8aEAj*NU$-8@At_?GB&VDAoxz4EFCc6`?AeShR{|~GX4;<9%
zeOa~3ce2no{BfyD^7-$6e|7Hn!R5n<mVHqI<S4wLqQ-aJf6*$g4W|zBNiBOW=Dh|g
zF|H6FUNotYu)dx4z>P`49DeyJZ5?^Jqy>(5v=tJChF=r2RU8@f&|AES;5K3dN2dfY
zQz3mUG4)DB6+i_QeR+Zo534Wv`Q9Io;#hSdBWk_fG#byY+MyBr7}(h+KxDR2xZtLv
z{7_-xHkGU<_c2zk_ar57IfH-suLy*~)8t53N3TAExYeqzZYK4M<$}xB2OCjk>h+}6
zCj_$Z#^r2o=iBhrlburBTJ`pPm05TeF3i`j<GUK|?l6@pvF`_z|Iz1s*tM-9O|JNf
zSW7yro@8<!rmeu>M3}93SY4PGU2rYH(@SJ__dM7B?E(YbJ)(6JCmQcR7EW!Q1LCiQ
z_uo^PH1249wt%i&YGAmG*hV)<6m!pm0ePl#%_~b0@OP2z7sM9Xe4t7bN8{t*TqcD^
z@7DDk8BD2-Bi8t2C)ew?_>Q^<MZ%MkKQyXbJD}WF2G0vb+Pj|)|CaDUzRYcvxi%Mm
z=To027>IM4Zx1g7d>-I5Gbr0q7%2xgi2TMt8%3EUjo+u!9sp*0-?CZxl4GW|yhf!u
zu#6^>6S>)w>ZXaiy1Bw@pT7<`4nA@n1A?i}SNv85@$vHJ(D)_UNr_9n@O5TfdbkAg
zCE}#0=yJv9<z~Pf_R-rJ9<Y$ev+|GGn0FaunpdsjG#0dmhzIut<x=yu*AxITc&3=c
z*hrk-a*~1v%=n3#pHMBb9mds|r|zHj`5(Eg7i)VyZ;L{{ukf=S%7ALmlPRKRJ+OkR
zh=1d-qxt$0@1`TtxmUdV(`|aHDg&)C_DJ)kVDVaOD^n!6-Dt<i!q3=yz(=SIr=YYJ
zn1z9pJ$xR6Q%%hUdAuDA!0ix3?9bxZM~GNjV;Zr}pJySf4<n<%+h~Ws$VABfD3=1=
zH%r<+I#3of$O{5OE||wEG#?MlpOOxF4Vd$HQ-%8HG26{S3fN{+3Us}|C9Jb`y48|w
zS(`UZBIbB2a9fDEs>Xd**#5A8viXF@8poj~CrfGz1Q_)Whk$xFy?I>P66@OR_3GwU
zlM6aRh~bdYSgDw&jgHx5WTS<ASujP0EcpUkyWJd9qn>IW@K!@mctS)FrPP97SL?Xo
z9oLM8CopeQ$)}>NHe9_<gm+f4Aa>kyy)LJX<3NF%{ejJYB(IK<p3s3|P}dLa#S^wC
zztfi3+}7#Rl)t#VvHUP=>Jke%jxyfo>f4QHAZl?VJg6taEe7gw1n77NfWEp%5f0V6
zwDGSwxS(?&su&*==(1mOR8}%r|7GSNI>l0>RSJ{cZ=02s(cZ`><G_1DN>fuw3ivoO
zg(@Ci8J5#`Z7nqvK-J=!$MRT%`qdahL$S2qb6plp?(5V?DH5WR`z_W?)P*lDXC}5=
zVf>kk1?x;<+@lH&0%9|qVHZ(qYr_ja=SU7G$S#zI#<22yZbN0}JXlPy9b%Eok}%%B
z-fl)@5a+bLWHf)?9GP{zfu!|CZ0|G=4&ou~tWo*>axmtP9BG?--xEP5rIA^!Fw%2Y
zhW4f9+kZ7c*Xqf_W@g0^{hI9Ni_Z1!gE1;VRmk^EAhS%E`^XWmBv5pE`qK9GzuTp-
zOrjA1!9ly+v7L%s)vb<kPwd`ZGtFp3dR<=JiBAA*+4l~j1aU?sBFf~Bf6>wZR3Eru
zKntr66}$^eo;O5ms{(5TKNTo5QrThb8nm_r)V0$z+lxuI2_z#OEh;zf^*7w6*YKIO
zbc8JyL<tTr7ks|CvZe}fk-&?Hd<nCWPD2`?(oOrxMP9pwSXee(sWw2_#OXl#W=1P8
zAuBhGhjdehw^Fn?g6Ow;ttrK$`L$<EUiJ5G-1WfkvX9|6x~csgER+k}rIs^UH1I33
z)782w`RqewIbL1&Uu9UV*{PCt3nO{`aL(F(FajU^8B$sTh;>-m4~`bbuby~8(S>(>
zVyu$>@k`tjr+Lk{D{2u}2f2*%Xiw}oobPA`129H);^$k^-R0}XR8_s^emKhA)aF#P
zc^4AhFPyTN%A%dS1jM$QC$wvShc-=zHyjJgxU<<0nTwA|L>zGE%Y_6v@MOA6HYM@5
zZ?E*g)wRCDZc{M~j=)T_twEzt0DIZCr!5p^n-hs7xia7g30u9IU-XyxW#%nTN9J+Z
z?_DO;iRQ&Re&>3y6Ly}z56OW{LMMMt+I<sry%y*cSPhu@+6+uFzN}i-oUj2KPJWqw
z#+M81jb<0wzh5I6VlZub%w<%xS*$hLgtPJ4wE;i>9sdZpwPq#|-KZj2lRP6{fcM+Z
zLs1tR<+^QyKWu)Pm0k9f7q3OwoQTzRd~xcr2rw2P64m=;*x(E^PQdyTe#L)EH4uHQ
zSloUbR*xAT#K4n7S3!?dH^IdD?qrF&Ha$K-dKvY@ShI>VY+4*vJ&2u#bXk+72ecb#
zJs2DpO_KV8TI)x29RFGb3%h}HGQ~p=)$DRgEp12gr!jcKxSc*^K%Mn!gQfidqiPmM
zByMRJ0CccJ6md*6ZlVYRDAWEgQ$97o?Bkw40-k|x{?Oe<j&LYHq`y6-<`?l26BW}b
zAO}_aJZu>n(#3-V=S=cK_@#xI4s@fhd3lpVG_qyGSAkwoi%%kJwlYByoZpRDZ45=I
zzn8#cwnx2(8-r&{$8g+tGgu;!yJfq~RJ~j+n~Wd9{H3R>`UD!-G^YKeAdqW7<Xpy-
zAn0S2AC36F&qSN#1}}Z9MHDs>nWR&kB%{$TQ%Q$4&`H0*+njrHL4vR4E}F3E!qn5M
zJ=Kg#KMa_tp5^?<T-$*LdoztW^nr(J?wP2Y*FA>0?CQ4yO2&7*ZIfs*_XS^95}P%@
z@$b4w#YK4N(UQba7$?Q9Tiiu4syp|{`|zOY$s0E|7SQD*_?E(kdosp2!>(AClLC3-
zo4WL3%%3lZ&YQ0v?<TGCPIE(g$ok^MTq4Cih=WXuhn;p>)S8yPtn&(<u9Z<d#$B?Y
z6vs$u(u+%4Qn{!;N>wlVjHk9>-4#6ZvdjvH_`XrSE%SMy_&DU&CsZzQiw1zu_kicx
z5M3u6@T;@wKB=Yk>A|xZs2f<Hf0*+qPt7|Hzt5I6hFUW6yLG~iaQFtMy0=fF?TQfH
z4<SGK)%9mw{G?!})p*di#W&@JQe)MoZ)-1gg$^-2>U>&S>u#6)*XEy<6Qd{==}@#7
z@4JSbGHcEDJM>B|8UoQJ6CH*ci|tcc`lxN~JNFM3q^JHISkjI(*uY078lj(IE1fr(
z43=~6<vJto`5YV<?C=O$h~>C=79M5}ZXVAXD+lKB`xQ3FlZ=GQ%)T*a#Q1H7jWN98
z<xwVD#HRkkLzBB&Bk@FA3$f)Cv(%A9jn;+@>O?b??`Y8ed{#STN0k_QXB|O-vdmLb
zQ7+(z3#}B+>m-$Hx+K4JE5{BekI^9E$@(c&K?`PQk6$LlNiONl-LbjxhybWY?RD#6
z^d$>QG9HiHs;@D|@L$=STn3T2%%cn=VWZI!1+%lc9&y=W?sMoGjCFpAt5fxo0ga~5
zUu0K0Axt^~55n~Cumk312D@#y2y1WMr=`=IL05_Y1Xp__q2uBo7rJj~(D5w<yHQl0
zn;d}3C^4zMw7GV7=HzW(5dvDgk)8w;6Dy5oM%lXrXJ&5+#yGD$-%;rYB~FtJLvZ}f
z@5@_jk@t4<Pew~j+!TMzR<MwAf+fF##m%=F4_eekG1QDz@vIoYs&pX-kxH2F9dr#!
z&+K03Bza$=7yAr92{IF=cTZWDFv0PR=v;|Khb?Y~^DWSTadBvM)uVTDy7KdXIw_Y{
z9JtLSpOxl25HpT-o(+6#BW5f<VDB$WMGvPK7@xA!T`8=OSDi^dP0iY=`5Q~1yWyib
zRpEXv#q^6u?i!eUpvHJsb8J359o66}%Ty;^@q*u|z%`db;ghns%Vp9}smUW<P>f4x
z<=b^qLj{r=)s~X0s3C0zDt?1ISRLP(tU_+9s4$?n(FRaVHb+N<9NgSh5TNMp_?#l9
zoxU%RMwR*iyxTr<R;W!8O7HBL*W;J0|0u&r<bI(t;U82~Rm514Dr>M&)HxsFOs^|8
zQy!@2)=20R*hFZ{x_W3all*1I9e!Q?iR<wtd-MWIg;HH(F7Gy3;2Habi3As8tN@-^
zOK>YD3;t<&e|rvBCRG6pp7TNnJ@CcsPCs@2bfO*b@JQ^&Sr2)aC==Beq8uF{nuT>s
z4`{B05nTtnBt&#y;-4?uUI@J;|7r~SzS<nMucdF&*Y`oEeOb~3(~24mqQpr?-0_&@
z!j~pQK%zxZAT9vc&M=)M&>3=3-W==_GyOO0BfySfyTc=9_zT<A<3pnasQskRYd?gT
z%N<*spewY{k4_s`jYMDjfE7u6t4gN9FpZ><#`Og-(B?skmcRK3BF@=T)vo<Rbpn!C
zT?TVb3Y|UMBI__CRlGc7vK3BF72V+jFD_ltKoU|UIbM4Jxa&!e23&ACKW`_Yt5M=H
z{~HwWv6CO8oa7NhhOse!=qJKv2-l`m3XFE#pLK;Rk_pjdG@D!^&@r{<j~HJMe(dv%
z@fCX(wmE7)_|lVSW>2t>Ulw^}Y0-qhkH+;2yqt&-U-2`d@_r1D^3tYRRAq7usczt1
z2)!xsx3mTXkZqRV@jIF6R1MF|7&NhV?xEgwYak+vJYJX&8w%&8wSNz<wO>QjF-pzm
zrm?=oMG1bu{Pf5`l9TMZ_z)bLX=BzFtwd*B6T^_zE@r}7q*TkvAFz<35XHO#wGMjP
zU#&$mUtm7j$txE!!U(b<F<{_`W+I$A4WnpGn|;>hX@ha9-DM6U?rv4s%OZfXyzaUo
zJn6ao0hN-@luhYTooBGwNyg?Ed|x!$2EnevmfO@c;Pg7tn`{W%ySl7BP1?_&Y1hp|
z8wJ87(&sbsG7&gEk7ZIBxn#Lz2>ht-vI8mLk*(Mi9Gvo{uHbM+c>(p7y!aAAAnjIw
z^_7#0qL0@>RC`_vjS3^qF;K?;fT~ZdewfZ?ywJ3~4mdF0Xst>m(&xw!>`{qkN3H=R
zy8NuNPnhWkv=vFRq*`17biAl7R3!Z^_-h_J2t<@zp-&qdfV-}na*nBO>EvRf2rgsX
zm$)*W4q+$Mb>f+W%&vU2?TCXd_8a9<)Q9nTw;RAatOh*mz3Jh#YTWEt-OfyAbwH~l
zb4S}gN1!sYarbra<rPR61F36nMp4|Q5j<!+)ZaPFQvxHQxbJ#6mR&SAaM(Bb-E)Cx
z#Mb$DzE{DmkZwY^4a+pP&c*fxl0LAVENW78<HFB(n!;VMJ%qTMPX{+qzw_i6%G0Ph
zOK#+Isy!IvDg(Eznc$#aXZgt_KOiE8Z#~P^|02Sy>r-|m@HRUR7PWBsIE&SKS)SmS
zHe;S7zI9hS^v&9>mIK`cO+l1;es@&ZX|ka$c5h}ZTE?1+8C5h98?4gzZFjU_09(^?
zYgpHKw}i!B#gziwQIOOQ!`Sq_6hVfTB_5+n#8en=CD6UvIBig-BD+bh_D7TWl4o!B
z6I5pvpA{WBN9~o&(^N6_7c&`mEy*C(tlYRsdWDV?CYLqboHz}sz*sl!kQ4;~2TJ2<
z&K~lF#nk;6?K8j1xW*=lU&8zT0W^AuB8|10>qy^0|8$v;J{Na0r6nGB6&iQ{WJ_^r
zM=s6eT^6gK_*$kGpDCEquBfh?dq<GCwJ|hL8N2CI?gJApTpqr^_i7)cbhIY`u6ime
ze}f_mb1vzMp4M)4e;<Du=452;c6D%$^!v^t7PA-<lNhwrcF+Bq$HS*x84XF#n+JVZ
z8p&zI=6f97oT~W^+QbK{W8S18X4#_@Ebd?hRGoumP&F{p+*E+`kzGOXM6IM|kR-6?
z@o$SB9jYuG>3{4XhXnj`v93c;uUHdX@rpYEq|T>@%9I++cJe<S=n;gcs6txDmlK@d
zNkE!RHtZRT{CLaUR1YzB)wnlilwud*%=umQBrqIdx-!q6OkcE22aPYSNu*|(bn+$R
zY9f}L?eHyAKXGN`P|SO&kh@{sA4hLKZnCuGbZ`oPSenNaVn|f!d@$<eyu*7q+2cj*
zgP|bt+#GWeU4LD!7TGIFpYi)tCR%dV!4pUKHCqwC>Ty-A=6Bde7Bb`UtJ$)HqDpyo
z-IA0=kFm{%{TAmG)GXuP8)X38n(*#G75Flv?a;t7jfjXI1m<3p<aym?Z|gprX(ZBC
zp<li?vCP0VpbKE_St5E9;+eAZjjhH{9Lr}PIV>roPS<24EFdCT=1eY$KI9>DK6c+y
zsZ&;hR2L2$fJ?!{poS|=E}sWoAfXl~nI^CSO#a2VNu$9OtWC=}TI4^@f#z3b{rIc~
zeXlg(@wj{DwivuPk#~c}uITal^^<S0IY>8|QGOKmdx(}|9p)vWINN~f!Lo_67OGjM
zIw!jxuc%kdA@PKjXG)T6J;>ybtj!b7vdxB3;Ki(Hw~=J3XDid<k~I9rI+6O9k^^MD
z{8HJR+@AkK*;jzIxh-oKFKw~X7ATV9)<SV7rC4!_6eti{+}$lu+}+*XouUPTySoMp
zZo&Dp_de&`bMEcF|8t-9J;_6oFJ#TkdS{l*JI^4m&oy(V-G6ogJI7<ka=X~dZ&iYa
zz-MIp_dUQ%6SAu(gO<(G6gRbxu#pMND!%YG-K4Ln|GXvts-=akLk5{BW69+Y?=u|L
z>^I!)JdWlf%$hPWFuF1S`QkY~$5@seQ?7RB)@-QNsxV7TY*~twa@%_hSrmd$^9(QJ
z1tW-_6j{38rizmS_o&qgsk2=jv(u6$alv;<o^udTw5+vxIWMI(qNPz6Rcq_!UGs!$
zucXUuxk&##0f+)zJ(PuoSnMqv<L74ANOxE|O6jQ9R^0JqUJ{OhH0Y;a5jJ1??mJMr
z;c>f!0zq;R!POz*&o;#3$nzmOB?hepXGbar63zuPfjU=>HgApQDCS1EW1cuAcK26Q
zVbqP|fy+nuxx3%l#f|oUfcU!zj!3;zVH#N_1#quNH$;DLXu82&>`G(fleOr$Jz!Mj
z1EUQleG#Sh*B_s>_N;9Q3y)s<B1TO1K+;|}ybSq<Z4>6DAM8|ML@iUokV}|stp%PB
zdn=-vd$LL!N6nXT{TeInhjL?CQ37I<RoVr3ax;Y0zgd!V6Fc}=r0RrFY=|XcAZ;bw
zHuPJqR%Ptw5eYB%hmvXL(V=GjmIMs(Oug|Yf(9-D$Q$?ax)i1~xt3gcHA=HaFpJL}
z#kHm8O^S_XQjIa?yF`%adU^4ZPuAgg9vLu`zH2TM*duY*>y(5Vy<i<e&1>g~;qxum
z$x>E*SL~B6jlKy_W609w2uYk1Y^SK7X1;I$e&7TJEnAUZ=QMA9H?Ik))?Z?0@S~mm
z=0Hq3d!1?{(^k}i(IS0%^l>+L7+(djfFn9c-C>W7M*-g9CS<$Igi0O9()rfCZNI5(
zcMJ}s<rparnDWAdi`4rbp84`^{s=KKI`QT=77WqDNV&;?*lA^pPO+Wm>Mkvrr2Jw=
zN$%cF<lZ|*Ztv0a3By0&k1fk7;E1Qi^~ryUeZ_}!4aZihjcy4xG3y~!E{a8Z6==!c
zU4Jx}Ka?f?UXdMX(XL1>D0c0>AJSvV-GyOPZb|X35Plc~(Z#kB(T%pXv)>|N#|F}J
zFj@R!AuS8rQ6o{bSuWX-?x<45PwhfKes;oq&-Qp)CPm;Wyo!67l50htJt%Raro#<=
ztg~uLP_k&Ca+x&G3g^0oR9umTpl!z}-%EB690n=tOjg1BS>S>w;|H4V7-sUkk;qx%
zU(jM^!)|7|z6@g?TUwzObNF>t0yP*!vnhz29uBN;8B(u|KG7y*Zjhx6PE&0P-(>nV
zrd}WCkaiqzJh;{Bo8Osuub;Y)eD^d2ttcc&ZsN|saX|OP)XZtQ*ToD8(>Q;RrX4{G
zvK@jyC7=1k%+p?wbvc%vSp4Ixm?>L_X9%CKCp|fICcCG)U%@WtV)Hw3p!Iug=jtjW
z_0j^j76!dbHY^K<qOoH3(-C`O%~Cq)gk}2HP?(~H&g%+H?LX5wBM&t?hadA$FX#Rk
zGk(1b6s{PWrWZ_a_3dN2!&IK)0Yo-nvt(JCYGY(xP|D$@WiG{@azkSbiH=Lt)?Y=^
zB8l)P2Kb9_c2r3xgZSMU@H9e)ih?wJLrpXd(pfju{AgaQv;>?y?fzU0J*4;jB(@a0
z@vM`B2}ieTq_z?hhwLW574|-pP@pJ_5X+C8B<^eIW&Z%n)?TDRe!eR!*15a1z~Hb`
z9{My?W>FfyI3wigM`sb9%WMZzNe;1=f-DJacj=1M=@_aXI$t?R#vNgNh;*0P7Ui5t
zoNF!l(>Ea<A(CK3p3>CM<+6UaM20OcG>S5P>)>%78ojZ@>itE3nU>rPB_h2ouuq`A
zY4)#M`54{b(h&$oJyz|eA+0dlYmEPMkK=I;zlSRhJronQC<4J8@`|QuQYn_^u?jk^
zj_VJnHg#ESsChO`e;hqeWYmxe)bA~M9fs$5r?%5nZ5O0`Q=haVATDqHqN~f1Zvd-&
zM=PsJ|EXqt!eDvd)aSl(pU_4@**JKsD0so;v$ExMF`jIVKCh`p?OHo+zEz~#s83u9
zslj%d`$H&Ad}VA)i&ZV0Rhd8=Gisb~C&!^?YfLlDJ!R87_HB9w6Yurzp`k^Q8D4Xm
z@AfkotU62jW~Z+GG?^mVbvmosD%37Lz`Q?aYx#l447fTam*>~o7|MVwW}=>!&Svp|
zzt64W`GdF?;ptsdQPcdngt<bSB+Cwh%z@wzt&tP@TVJ4%3bt7u7ZCNn!?Yi8`7{x5
z^yE>CfkzpPDAu=|{acM7O7U2E`Vyn~P8SzEm-4e+RGh#EV&XdjQEzDV#r+AjMM1so
zv&`#Wo&B_ja$&Bd1re=z)j0O4`bzkk-`U!fa3WLJ;oeU`4hLIQxAb9*@b<hP{ny#G
z*|Tk~a$UlqpmzK1v&hljFX9JzBX{5mPZ}b>(520&vo#YwN_rHZsOb?EOW7-Ps@hlm
zZ_J%Mms)jCKi~MAby>X4cy4nq_F4A}CugNEpL?^4<-(FQcmer3wk)Ge;Mb{)d}{^a
zIuef&>jD1@fx7RQ4O&gQv7QOCVeV$6)EMGK>1>CsANY`M6st$FZ326JStIZUnG367
zx1j6Ai!2G{syMT3>Qh=1KgK%y{4m+3Qxj(`xo&eA1?Nd&IWZ<Jrz)Fx7m`SC-zQ%L
zo{?tKz;HGD-X1Ll=_Go~UzyI;+tbVVdTBSBO`OuQ?KeoO;|5Ud8x7k=#f`_|6^Qb5
zTaj(`3<g(hn9!aUr$dRS<ON6=yqH)t{IJ&7Mws1YItFtSRUb-!-3c`}13mC(hQY0i
zC0}+<c!~@MBYBh}`fTvN%hlbUyu``sIb{tn5kX2uu6;O_%663&o=$?PP92@Y&jn;e
zq{<BE5L~Hu{M_v)_ElTGgvnc;JgO!!7hITp+^6Q?)t4a>g|S$~J0^@YE;?(udcK=*
z!wMa{5)^o_B{s;$yhJuDd~#ZvZ`D@d_Hl}AQmU%>WC5s9&)dfx`{-aWv;A@OoE1mm
zDP0@A3`77t9zI*xX49!UNFM8y>!PwXlFa7c0LIvK=K$nDxd3pY{&P3<&}Dm#B43O3
z_sO9yFgsU^5QFr0j_B4*oa2_uO-oB$IPBw$%uQmWVP>aRhYiWrrJ)z8vaof~G)gzd
zWG{TFp84VRLH}TvVfi|L^M&6&{h7^mknT98oWkNI8Mp=Ki}*(FNQc(E2V=TT$a^K3
zFgMbsN*VLBVS7&}{9z=mc}JJj5=!2i9lFY4o~h0Duk)<T?J;y4KpnF0&rOJrdz1vG
zSFFG7^5jS<A=x>=jnqQ|W|YvnX+YRR@nO|bJ{1kRHiqw&bXWUX&6Zc2Dkwck#f>Ym
z8kRy9I%@$hM+5c+16wzB=1rVTQ#^CUQfrw-x4JpC@uRz^T(C!N=D<a4JMO1{ruw&_
zJRwO-3<Jx39~crBJs(!E+Wxx1o3H!w?s0$3BpUTIjcnrXdzwB?jt_ClC-{YlMkJ}_
zXJ28^!A7!v?--qg@=t8x9qpQ-L$Ab{g}ZB}=zDoNW?y~2Ngt1q!uxrNT(kViv&e3<
z_fZGA$bd1=gRoZ>BYC{6HNWCyEpwthf@fl(6271xjJMvFttNW=>$o0CR;4fYRn`zb
zFk6sYD`%NAeXvf3IBkrSD|(GE&rbRzG-H!!^6+f`xc*gOAJl|E_FYb9!mxY=@v(q3
zh0|}6)lfZ$QIV%AdJ%MP`$9W=JX2b9FPs0|NNGW98?HhM2vP5A>=I+ZCLS6RH`Y1D
zw|MVH&Vrg%&Z?b}`cNSxJz2z?J3e9G?NqnKB-iaz%zc=oKKByqR5HCdyOW#HsLPi0
znL2|mPf-Tp>!H08Z)B!1yyR-^WCQoxajPA|=9{s3Tcqkh5}(_!IwwZXkzWus@37Mf
zB1rOH!-pg-M=wRChCOoUx77>J;_6c7gj*L&NncHYkC~0WG*s~0<kWp{$XUPHu5k#_
z@q)=IeU^hAg2bu{UHuBlM7$i^xzpc1ET|Y&teZkBo>5;X;fw>DtLK?ZmOsfY3Umx(
zDEPmxJ_i`x5NX!0l+yHFIbx7LzM-2e$?Q&gC68G6MJ0@v4jyv%&v|o^g7qa+j(EBx
zn`kJ`D#d@}>>l8Nnkg_NW)rt4^>lNXidH_bMBzr3<fm3^>K<K{>-su-S!2+BFG&^=
zj4UstYIernX8v2Z-nHeliS5cq*0h52{^OUnD3iPG&#6A0jroLyj<&#o*|Fb3`eZcA
z178iBq`&5hjLaZ51<E{JCYkZ7I56KqeG``Y$KMyF!t!?R;_5y>wrdJX6M{{bW~fcx
zt3IiNw(N^8V~d}e9rT4%o8CWL!)a<RfuoZOT$4A0-$=av#9-9k=QHu%g2qQ>JF|t@
z_O{3G%v|?p0U~YUxpBO5N@ZBI|ELe8%XWxBw}7&#_U@X?PAPTx&aM%ocohIeErFy}
zY3l=Z?A}jsmqwqsuD^<Vm1sx`5iBh|r0N@{x4A(WNji!PcEO2X%khiJLMLN(Qc^YI
zP<uG+ozZ5k2=V@<-*P19;MDj!*vX*}TKlzpW8Tw^Z^zUz^m|M$Q}($Ou0Rg&uM-|*
zBBJxst+$(J?|iExV|5Nv)VN}B`5E`8tnYQUTPYPD3eLI9;?|n5levZLx!C-!roAM;
zKKR%vIbu#n3S^vCXp;-r9<FUW(dYM-H#|Kw&*d60QVF;+SG#*F;upxxNzWbPe6Q<{
zqG{{;AnVL!{A0}ox+|8*LGK(2*e8UwbA#K1ZGHs*jN=#yrhge72DdWe5;5Ry;gXz|
zY$Wa{no`*soo!Y(3~CHtxxHje2E@`*81CKsX^noT{C2QLV;s-s#n6qzhRae$CU{A{
zFF4Q*=5f0#=z8I-68lB3Y%B&~)x0B4Ro;PdG3v>Nr^0I2!sOpH6nxE36m;6O&Ti&z
zl{DRT79cry3GK$6d@u6SB&);aV&q`Gm!PN10h}5;;a94rLvHh|6qo_Z9?}myHJdbg
zF@630pypL^6W4W1rznl$Tk|!-unT_c$zW+=_+tIV+!bXcgkGck7?b%m-f~h%FUi``
zFdff8atE9@PL3p3;81K4s4}K4^2{tAA#tTI7L=VH#0|rb@9knt7<Mws1UKIb1@#b>
z80=`iB`0Yd8++zDVF`~cFkT{^6d(=i*zA*Y9zyxzV&%r2E|HZ6^i+|OdTMvx`RwH~
zE{?ohf5OP!^>gPFX5#J6{?_c~&v32Wn!2Pp5iRf|cotoKIUMH<f@Fi0uPQ1h*x1&+
z%>Ky-NhQy<_QpH4B%}|K()cB^bZS$(nAkWk|6AiXn2&kJJ_*R1Mu)P36KAN>$uAD9
z2%%*3VJx?^J2&>D%x=golmydd1<Ol&d|dvaog7iGVHQ}SAZEjMK{aEjMEnBV%H`Y(
z-SUUFOB6>lopJ(>gP6qD#e)B76ZtA0+Nlm{g+xGyT$3KKM(e)f*Fdb(4M}M2=}QJt
z)X6qZN4!z*d-N&RCB%^-2yMZevw=iI$mtSv>!s)y#GZuyWP$BbUJ|dId2UN;epqnq
zSbbq$esL|tB(m+f{X2V1J`v5r#5$#nZ9EZbT<V?c9RM$fs&DD4(Z@%*{_nP*MQdKl
zI9|MQR*HW<niB|1&8DDbwTsWb8PMMqnkZWF%~#DCmUq%5)zkCHFy^xinUfV1N1<{4
z;-NK#-dE-n385_1If3+Jxf6Weos(A<zZ!QJS?|!bWHRx!NqFtfqZ(LhrI?+i+Q<@#
zV83}eY$zG1G2!C$)Q$^yh+`(+zL$BZAhBp%<(i`CsY}yczjbCav6#~>J@(uUsXLdK
zA^tdP<-{p`mG>ug-Sjn8Ba;F=gsr@v_ZrJiu?b#BlNe7AfNK^Ss|wt5+s=IY4X+=P
z(8{<UVsUK@FG*qE!giRo3{JtRhLeA^Bxb6eM>*{1(=DI0^-20RCneX*sJEwf|G8mY
z2=hg}tXZH(>&p0Ted-kr`Z<V)-P6)PMBTBtb!nlL%(;PMz9c9Rm*_{4qv9*Hs7E;F
zMKdljbf<!!MJP+fN%?pRz7#g=k4;Ys37~lOF~zc#etPHB&B<YLs_R6p6W2Dz)=Zib
zt*8;0W8v(767+5Rv09_pJF{>>=i|d2Qk{Cxolk3~C`SP(5__zd>mju^b?O%<|M4>3
z4N4d9Tt2YQ-&#lD#V}*$Sf<jxmn8NDT%ML0j?5Kvi+o0J+HBLKvzYP(%%puA^yGBH
z+6-I5_W6t*^3Mh2ZPd?B)S?MBL7TCkcfJ9xC-bykZ|H7)cDKTV>N(bH8_tK-l86c#
zXpmj=TwGVW3*d%_eHVPJsQ%rzJBSZBGcJ*G?8-10rf2{p-@AE#jr2eWd7H+!%e@6%
z=U!K>-@<0YwkXsDp5r`v`qm{b%qqs*)jR3bTBcc(TjdSTlz1{<0>Fz3)bVlwTTM(1
zcwve;#LR%Tma*#;O7}FBBf9$<o!$bq+p+$@{rS1q9m{UJt7reCA+2OZZsrq;kgd8;
zd`-{z!6*E&0{J<Kf$Xo~FV@r^RDlq-P(R)>mSw0eH|>!sSrt$4)&h6hjVcJE?2Wkf
zLEd(v3dv8a)FB7x_(lMSgs)>5omc1JK$`beW)<<eH}u;Q-LD!}<_;66f43@_IE8;&
zA|{GfLCs2kn!oPm{ya?T^ytSM?zqD1dku!CJnw2!_#{%$V%RI5Y+YNP<}-$mt72Dk
zrLy_LalRwbgsqPduU`?bYo?T4aclVjj=1bnv*n?+uTC#vA?wa)7#PofsaxI2?uI4a
zSd7;&NjL`nm@gPN)LrF$-f?FPj0F%&AKjrrXb+^g{d-7jLQeP_bKL4RZF)ZOwRcA!
zrd`FKu!-iv6Dea*oLj^SOr&KCZ*cDhrYsIr0xcgBY@4~(?K|PN9XtK5R>R#%4sL#A
zOR@UFIJGI+gROJgpJ3a^;JZi4*g!Lv;zd*-!3CA2CZq83VxYY9#IQZNU{)XNm%6=K
zXQkI6GL$ALNL<XA#Ax$CN1X?<W+QPLS-+Ho`V4Cdg)ewBk{>$uo0y?*4f>y=3JAFM
zefIGq99L11J)&T68j=shyre_=g3e}eXRAxIp_H0n_%qV}$Cy2Nzvkxx=L3S%x`<Yu
z!@BWWz>wd*3MZHmv6!-dX3@0%x|9orAu5IgyMJtTDa7Krc{k^XO!K~3w5F1;-qebJ
zl$ID8HMv1y(n!`#CxRXc9=sXur#HU2qc<L@hEAFUnKaL3eJj4OY#s5Orz;wbHX~!f
znBi@|e4YDQ5x&_Qx~Kcy?NxNu)|Qn|=p~;Elz%_BWd!kK+nf~9w{CEf0<sjF_9<d<
z-a_hE3`F_yg3B@%s)y@YxJN;>#f1F~%k1d%=|oj)<O}^r6>IN^YfF?6ldu?uLZ!l5
z1*ZRbV&3D;(T+$PFXybk%oNC`$_2lIUVv^+H5Z^(bL_uk2O^G_#umLU5;FT{J?{S0
z+!!#7Ic@MyE&y;tbd~#3E)Oq0F{D(}F9Sk26>scnl@W-Te6WcY;V0s_msm-0SYNVw
z+M6hdq+$<5xusP{1Q#?h$QHOx$n7T5?aGxFZ;kn#;j|*k<d*-q-<>atYAHUi2^#MP
zJEt!37f2nrov5<|od<ba1G0b1PHN7GTq3TOp=Hijq`P#(!Cx1X^HsOdYw2bf$R(9C
zlu6rij;ow=D%n`ljQhO+_dQMci^;}V8FG7_d4DX|>^>5{0Bi0_?<N(j*@_-+^jY3<
z$egRAQGMtE$RzahW<;Vf_xK86+UQHm^HP~ErQMY4NlpS2N(I)oZW~`@tR#zP>KpPX
zQ&WPvr@oWrKh<AW7^$|WS^vnWy_;~o?*=iS<lg<DS<$K6ez!gIq9$0)mXH4KjB-S#
z#IHrvN{_JXBoIp##NsnPg-hYbG2ioD&EK}>J@43L9sqymcZ8-tJVX&1+wqsFJ==tX
zI%!NqwL2nMKM@s0a#B@@Vy1cjs_fKf<OI(8OBt*2mWnkLD%<jYjDoK7B4Jq}GRHF%
zuwHPz(!<i|d*i1t<u_lU6Gf0nauvCTOf5e7Bg|l1;bS$`y|ORsrf2XZN|&dM)O*ol
ze2axQ+CfYqZ<-VXk8*a;$1%3kwA{PL4JX&ZGA6lsL1L_*y0z|znscYaGjCe2NR3JM
zx0+IweowL+OpSb}f<3a_TrN{l3_01>GA<0$V68!%qCV5onl}>}&IO;Ri0AXi;7q78
z&^19`AnBBR+9dkkJ@O?9x1b{BeM3#mC4YnbxcWTi={FY%6^FD^4<YZY@6&GzvjekH
ze`1Os3~Ap4s6j$0?W*)J&}ObKC_$hhv1?BB*IkMQr9I?N?K9t28x(w^V||I&Hxm|3
zSo18UM6Om{ZL#651W{f==*sl&LUUF~b2?2?T>jj2Mz5o@VyB7&S!^n)bbUE%>7K3d
zv;A?E5{pS`ikPdIm)XSqF`SOm1Lunqem6~s*X@6?cKsJC6Os5o1{>K6sNcq%jc*Yb
zqSl~QPu;h2yIw9E`YrMyhCD!geQ<_ENkZq2Hz$J;E#-V@N}y{Cg6~Hs7j%3AHKe69
z?+}l~QezNODXX*g+*(ljs$h7TiJL~XYoA<O`BqMI9aiXM1F9L@YaqAj27?v*r)P`B
z4W1qxxn(9{n}LJwtEU}l)$9la#2(hYY{r?0+MdRdy6jl&Os+SMdV$Y@qaUx5rzz-u
zNBDB^43!s{`*3pw<Zhf8`31EpaQ?`0{A6X3lxusYRKRvHM-^^&y;=A*Pb4yp7nNk(
z2lQoV-_v5=V^(+;G*kM^sMaZ;b*PBu_NlXGK0NV>QFKw^+uglgWg`>H1Xayab;evv
zu^;1+naUb&S6}mM@zp?qBirrQgyg)??OwaD@3ykIl{b%6zS2>1s3)l`_#^0qk*T}@
zZ);qv+0M^Ru|_#Rf4&=63XWM;v{;*oew{SzE_0Z$m0x7zH$K`Bol@sfX~Wa0f<vu+
zLx+bmM{UF4F7{GU!S|7kqr~4tYr%g-Ypiu!+k$zua7TpF+NJnj7#X}V^R9$qLYq*N
z@Se%u>ZK+bbVLQNcv};<2ZX3JIqe^Jk%8O0wRUG^>`-o%T+G|RrXn4=ffcRxC0Jdi
zu3oE8m2+||P1n3LMwidXarz1R6|hRIWIyi!%-iqQWKO3-Ws~cMWZg;g#>~FD^9ITl
zGmU-(--bQ-U~@m2u()IpXmm!$diZXh9D2J89F@wmT_3)ydkB4{g0<X-M=kN&MUZ)q
z5B=R1<KU}77b1zo`dyam-R9E*53k*x3wogs^UP!PCekE*+L?RgZ>IF-c>L!XlBDAU
zY7)Mc?NPmtEFYw9PYzZca<KnZA(5bM>t=V3s)wU}gEQ}gpnbI`)2k8^rk09<Ia9}8
z(MN@ps$5X%APQ-anPq*(OH{>SK8YG#+{oHfl1z<(?NMthUV7y9VWdR8P##)W;=hq#
zkc3TiMjN_p)4zVd$)Xm>^b(Rbd4eE-z9|KS7{#0G6MzAqQ(hg}QY8K6Fzt^v0}>?I
zj4mZ-PUUiN^@510q))0fhC<8~kw2U1_G<*R>7^*tOs#bKGBADHqOOg<9un5*>)U~7
zSdc_qR=gULmb6lbIEhAzs+86gVrZEi^-&<;z_CJaVCubkl>WVBXeKN0D}7k1R7|4A
zuN0P~d2w}pIN4Km%kG19+sl}Tu%*K!5v=iDL;DW?MAgIwo3Y77=J5xY!mwB+*-SK(
zL_@J&()rJyrGJw&0W?8H=PMftz&F_b1r3_8ZU|}gfJ_#t9Pwce|A@*rKj2Rks0w9}
zVg=LOR-vC^?>FhxJ~rwJm2i)!@wpUDW}U)`!_Aq>2q>ZNTgrTG<ZPxz{<5NXPCLFo
z`?ZMaj|xc81ZryIyE!7_h*w_xwBJ5inK22ytUl;_^`cnb%v4LY^&5xDFX!AjU)+kF
z{=!P<QDy}^i3XwcKW9O9Sflo_qxF~$iaXhf)!U72b}5%E=NER0UxuXn%I?r(VxbL_
zk@svL(&2sXyRaEiuVXfL@0_hO$PH_7P)@Y^m<XEk)BN=9;YZJQGJmH&kB@)(wpY=s
z`#c@9E((Yl5y}hou;K^_aYOBn7yP08MbD=@@_qQH=b86Z4UwUoAMvLdvtG=ne(2uE
zpK9yEOP(NbpRsxQNtK<r+wo^11?P@+DIKYnDW+0Ju1>S5q?LS$on!^(efc8`9fqZa
zN+s$>jsJyBwtn%k>QgcK(sy=yuTvKxdDWcHWz3Qz>%Wff=1Zrtpy{QME*6G1SSJPe
z&veSlAn08#$Xq8NE@dH5A7?#`k3NChx+jt?pD7rLG4+y0(fW{{{HRZ+bTi?59^?Q^
zXsc6HbBS4GbkC3TmvMcgi~qNL;42rD-$;{85e~ns;v(rtaNHTcqBpU?v^(;2^|8!c
zPp9pDZc6e@PnVuM>DHu*t43h8nTckEG|Hr}`th{q0(t0$?G*!}@N6veo|IIOQi_%@
z`V2oPS%I})zE06ehh691_|)GN>B2onk?yy^@fQvB0Tt@ZlIP%_EqZHciLi17C9dFm
z#d{&?VhVkoJjMnjNlhBaDkf@5ia=qiPx)Yuy|zzf5?vB@a$==YwmIeO(RxblRk=;1
zT5c%yhtiO}!CUS!<(f)60a(tSP~V5FY1xTJ>*gH2go0B9>23h#Cj@Ib;l{tX0{_K4
z_Rnb0bKdt~bLr}j3DbFqV!s#Bh=VJp-ZZ7dkT~bYh1aPw<d_h~`ya!EL&Y+K7Q=m4
zG<4_GWZUijC0Y=VoS*IXg^bhcFIkexRP}c*DfIfZ$CKt>@C`<tnwsilksJ;Js(kiC
z`=6oF)=R4oNEggeKUiY?N~$gNk)me)U0D4mw?W$=<$Gjx?~2e%&X@5l)w3UezQt0b
zrI-pdBZuf`nv@h4e$)#VMMIP^iCz>@6O|XJXdDQe$WBhIep6b<Yv_VY!IRJ<+joF$
z5^Qa)fY(}5g+K4Ovg;i-QhgVY5+6+!wPk&PVY7J=YkrBSIH2J7+5MkF`4?mNzbZo1
z@Bgt0NnAm{=fFOP$R5zWSx?NWe;Yq-&%rbfoh$FOwUlJle_QgHPN|wIcY^6tsf@Y*
zPD3h|QvNpsI#8&rT1kA0fo(scfaR+&uIaF?ob4AXqWSZ5g2{fM(7u+aD6Q_vCM*2q
zS&6tE2=D$bOl|vZ!mJ63dcJ(+Z%7~hk^c~kj8t17VlK-v&vrXFY}v=lV%1#80xXoB
zHBj=@;S&NWfAr8UHsjWq`5v1&UWuqGNX@<dNxJVs+b2JF0OKLX%}+Bop56jd&>KZ+
zt8nsC=&AY8esiq`gtV@Sy>;~jVM7U+2>$kuLjRj^-2U33?d>CNaHBPS2nd})&5E#o
z@<X}zJYL&?N^=N8V-`GC_@2~{d^ppap)QwRacH%BmfPn7^R{11@cXtIfzk#IbRjzh
zQ3m4KSzOuD2<t4~lNPykDa4449hlo@s@NIa&Aw>l9nq2*6kWiPN`Ef-T~q%gBc<}t
zr;m#9@2#jr<V{Q&e!mhEuyi@B(oxkUpcd@dNQ4qN$8$ke8y?Tl6)|holJ!(-lwJ{A
zU8B-)tkatNb;cC!g{li)0<LFo5k^XAPxiUeAooXn3VSvI{5hP>%66660RHBg(9Vco
zAte|mH3EGb0*xEa0f^EVul|bKj~=SvG>@#6Chs2-bR(rB6M8?=Fp^VMihYToqeBPz
z6TYNm2z*-knBnnu2L`g_NKfWb8=TG15)FV{dgSPj$0BDb6#V!eiTuN>H+=Y2GLf^q
zQ4bC9sr}Nz($t+l+trI~i{(ZWH(2sviJ;A{2JR!I|GYdwqHTPCOi$5fY$#d;mk#ia
z0V1Y>Uvr8pJ~8THtC-7ZLfU)27DyMcd?eC|x;dCnXbRN}ku@@)<IA@(mz=hFRheGd
z$Vy~D3tQOO8Yd^_-2Gy^<G=B`qF@M7;lT~3((O8#D>}h*U%JF|KzcI7fVe?2S7Oid
z9V>0fD3j}q)U&h|zQ-Pqese_=dgj|vl-GDef)PQJsHagE^;{4~93d^Wz=YwthEG#M
z=lR(8J^oVPJ;OOYhQ=qxLka9w#r?#>K|7sPkV~Bq8Az(mS9I)8_Ky{N!`61^^lMX+
zV!o8yNpF~sYh9MRVbC^_(kqggAMOk0Iz&u{rRk6Rb{y8y1KvDB{_WN5<>6q;ikI}H
zVyk`@S_`KVH?0(-f7sMu-`_rRGN`t;7%@VnaRG%$O!fCRvE)T0pkJLH4D#U@^!mNz
zl9djKNUCn;0PPUFy4aBsbD8&Qcp<hNxhQn@Dqpd@lXX$p@!918H_R!HOf|gA3DN%A
z&c}+z!KxE)5fN4DFZZ9y`=>7Ho}vb?c94+Yh;BxwJ{y{^TQn7L`1O-$Hkl)Jo6ACx
zg_bQPUneSPX5;1rQ3;)Gx>RyskP}%k^pi|&38&=+;dBEL6KMdw|AKCAyb~L<;&OF=
zGW;TcND+}*#?JHM5$bQQbU5Bos0^pJBG(>o!`=r(#RRa>6hD+L5pr7EWBW?bR?yh+
ziF(_FS<jYcM#+J*jjSA`Z&RRppw@<_GRmo6j@Wl7NX&Gu*i2^G*%0GAYv7A5lSN9@
z?F$Z$E9n=s(`_%3D7S@7E-jqLLiK`BD3fl;t`JPUvXMyt?Du~dvnNR8jqcFnuw66u
z+L;;UA04Wi1FM6tOQ}v1LWgu^6C@LT_uui=7U@J4nKMc!a?4gNMe6LDWVBT4k6C8Z
z%m<~~aL9CD$0m|?3{u^VCB(*e@G&<e7o{}>f733N2mTx?bH8<~<-|)GOFu^YokSj?
zI-?;WSa~Tp^+HScd4?P})ODvF5Ve|&`Uq1eW@*jB1Gl`Ka}`yF<D(antnDA$$+F5y
z8f8V>eHjyy0n%hfePQ*jvfZG0cR2De7LjD?#-(NwKb}j>iEv@nDMSuRh`rPos#8DS
z?GBKbRu~zF=#}EE*XwRQ*Ogg{HCZ~_3`^%qlgTrO?7Y?bjm8jaOdrO5|0OP)(sgQ%
z`!=9WxF=DvSca<HV+LPH?s}1zJ;7!-PZwwLwfPM;;%w@A11F7kRKS4Q9)}TMXxPL?
z654u0aYe78+ud-J_tf_}qr2e6UQzSi5&uOZzUaec4Wn=4qxK0WmNy&L6r5;WUZ{T~
zC!#;(M9Enon)mY}CHSsq7K}jg`2_pjFpaAtCmkFcr|CW(+=QrHfPoMjbQ652v4QT8
zGeifa;J9*kbDPhyE8Gn~*JtF_>8ylQH1E!^D+JvUCeD$kMD$k&U3_=3M!9B{nG_^A
zi(`7iaDDxi++BAiATAu^_og%UCj48be3sah>V0rU^Ci5!xFfP4f$3SI(NdgRlJvDG
z8(VyVDM^z3>|rjDZ7Dk7W@ci>Z~zQx=q1_w$%8)2!{ZghqyAFFn6=r?P?uI~d4l7e
zhT9$4nE?#uG#-+o=se~FRROvu5`FZa(fz)H@;7q9`pbUKJ6m*UNX!o@I146wcu8M|
z+s8kau63vR80BQc?7jp=NtSk-A0n(t#xpI$R4;`T9$iB0^>!2Pr%JfgM-wEH!kSr~
zZA)bCcy!*__|>=;95Y$|u(s!Lsi@`enLkVr6Y3Ts$mk^A{FpbU6{7P3<2T@oK;&p-
zq{H~=i8_Z*eGL72u*XAr^F*fsb1H=tL()V1kq005x#ny4t3hJ-3mX!<GueI>2yD(N
zC+!y19{Z>`d$v!>VFcu)h(grBvZop^DKTt(dLG4dxF^%%{+%8#>20y=Z(-l#LmB1D
zpON@FKzCn6K+dc)cVLn*jMSo%)nMI8YdmF|2i4C;mX*lD^@N&+BZ|ZC9h=sVCRkT+
z9`OX)7rre!J%*jG9WZRNf__nUIP`T6q7-CTl5s@K0H%#$TKht9R+NBFuzovFl$@=`
zlbCt22Ekvr(83O<-{b2xHnKpuTsCR^Kt1Heni=bodfy!T!lO+#vo-mjhz(#E48A`v
z^G8+JA(>QurhM2QhtPhTL@y$#+n9=Wzvo<UPqYzF(-{}xPTB22?&zf-V`^5j8BNr+
zO11V!?cC4T534v3WBY>`^53`}@4ws*tN8Rqa=4FVlHMP{GO?gb8aPp@8>|fBj)|A!
zwxD3<F`x-qcoCgP$u&!^*$}dzt8c!is8535An^c0fQrSnQN-b}FTKk8bR$;MqK55(
ze)8umcI~L<@RjkfGJ`Bx*(F?kra2O!C4)r?;?>^R*F|41{U@Ii9FzXuWUo;@>#u(C
zJ}#K-;A6Uy$bmVb`0;(;7uezTbcx&%-ly21xi-7GNSPAbK;}~p2$|7kh%d~|4T;~U
z;L>ZfxuCMstDGNB=#k0wEI8bgX0o{MnMwI|XC#0qcRbC^|FDa{)t7ovQaMb%94jO&
zc2f}X<9DILAJ&TNiCxouYjS0vdlb&XdL9or>uJHS!$AZ$L-{c*TF^e)6qVuhl`)wD
zHo*jZ2xc!Yy^qJS6Tq`q4w6u%A!<VT)YLq;^_=)V=AeB;e0sW&GMdFdfii!))h8v{
zw1M7#syBXzb<0gT?iv=5iiP!(@y*lU>x=s18@~h!Q~ZF?z1Q5tGWk?zALFW;^EIi~
z26T6MivlW^P3J4vdKv_CrC-PG3~+Po^c%WA)A?TUu106P&Pi=B`i5LnAdai{O`O9i
z`#b5S8RuKPcMe~&f(7zUZy{R*lBXAWx)b+t{UeQ8u5sDFja3jYQj4V9bt_h`$0X@q
zZtLi-k!uCcf_dw<;*IR|ajX#*<fxkxyk_)G!x}GP!Vuc8vsHrE$NO^U8_ndy-ow{r
zG2=1Qdhq(QnrRW^*X(qb?$+x`oL|4qCt05ka&!8GfX?kGsU25`zrbY`Hb0u_z`Ja9
z&}(=UyY=@CwkhdwQY653@5a?y{$`w~QLelt;mO6D0lF5Hnd~uKj97!2xL0Lic~#BZ
z1d2j3tn*3sIardAQdXn2nX@2$8VgFZB2UPi3%U^{o9~U*zJL{<B8_#Fo%7g5t>%cJ
zrWQt>Sg~zG89}yFw1v~T>}<<Di0CW0I5_d*@Z$RNKO%;I^96M8kmtXEW#$|N-(}?`
zGiBwubLW90&W}IyDew+<Ea^~k>g8HI(}ethj@64R8EnDl5C)r4@RFNr#{o#Bj=MW8
z>imSpWXNyM!O%VY-XL^Py;j1;=4VRGRX(X2<>cgK>Cct%V1s)uwz~BksYTZ@wY%p$
z>sT&AKP?3w1QeFjsL=lH=ls{tL_{@hGyIXE)#H)$N`7y^x-D01G<F7q1~U=#2M5uT
zIl5b=uS`T(>?2k?{CesuvL<uaim5U{d+}4G5<${N+$Rc_VtG05%$y*gjm@>akENiM
zi5CN(e~xvW85)?3mpAuD)5PR`CDz*q3TBDY6LH)z5PfxtFY2THy-)D?Ac1SRc<e1^
z(kSZn0xQNX>^4^kCn<fM`=_knMRL9wLp#~TT&zM|W}D;2vVVWfu$`dc76l7YR<!J>
zqbl0DnQkt26qlld7^8_}RYa18n;+;1J#~Lr)O4;zCvI<Hmc-+yN=hPnk<Iwyq+#^7
zbHIza;{k{Dy$u``Pd?V=TOx(uqjbJ0YBCm;4yG07Ya5xV=g(h=V2OD))0AiLEi|Yr
zxLg=MRcR=-_nw%<K|p6UzRBTd1M2n8iP6<sL~Xjny&fqhg(xC!Q=F6e8NF$oy^p*f
ztKGj}?ZXbDN=y!-g(kCd%y-dt7i=B%mKF4Ien0N@0zasak5}sK*PWAAk+SNyRw3vV
zTqy593KB-b0lTt@0|<e9kD+~AyobkZP^Obe9v$nUhTe^V4PImeT19<qtpj9Qwf=av
z(1wrdEwnY_oE+w(wL_Nrfxgd(s5*SHqS_l{G$)Mc*-{G#1osvOFu80S=}fmzX*=Am
zZT<!Z<gp)%WU`~-2gdV#goM_kM5VRX^<KLAy#@_%T9uTPj4hdiIBo2StNIr%eOXwu
zo&Af9Z|pA!xNrnAWMx;a1~jCXnhf-JMY^qJC0Bc7M^A#Ad$4AjZ+#6~-<0raRcbyX
zzI#Q)xhun}+v&Nx$KK~4_2l>Rc{75AdQp8Rr7&2OZP(3ew0L1K-%&p2rF-&SOAh`;
z+C?rVWF|Y7M#qp<jCS6s)V1`q!ahaRyi$yrxIkigJLueC0OT_1&zWx=p5j;Gv9H|m
zRdL*WHsc|gzJC>$Gk*5eo{?`{*b-H1;5?r4D=<Gwd~JT~a}2}p5mNp+s<ZL*r#c+|
z^d`#aSsEr?8LNx<vjm2MG5|RO+xDH@n%`=ggA~|?BxdcY1j?4=hwkyYsdM&$Lrd%Z
zgUOZiMQ#k5tv66ompR?}xwM{(b2x00Tf8K4fsprahBQ)0+Z!T|t7caHT_R)c!rB&|
zu3GqvzYJtRH(0gSM#ctelOkulMZv|xrdHq7$M;T6JbTZY4ToU1cfm<#;C1$9Uh~P<
zbxtD-86Q)#Tos4x5F4STK}8^n0j&-1{!w%cOO2b{4t8aWZdin}5B}eDT?w^Ouj+9E
z&qu9E$eIlvqr@E3+7P<lSG%5a<An6l#Nw_`r$a3|nFdMjYxdb~MiMEJrh~R_aVie9
z^Gl+}lE#3;GVZIXTmn6V^#=);)2~J*AWG7L+{`5aFUs%1%+t3meV3Pr*R}B3D7XfT
zRzha6{fQ9fz5u6o6qlIYxtK=F`44y2h@=U^oQU{e7HbK_CMQz?y;EVa1{8cmTQoi&
zw9wc;C)u-es3-K)b`gb>DA5e=`)}+f@NPcl12(YDrg=&*|MXz{n?7r!X2u3@w6n@e
zweZg-u9D`k=Cs#+!+i)<b<+$9E-b6Lh-WyAej%d$WZpq~gT}<`vv5d2^~5M%-C?~o
zo4Exdz`w}azU}c6U!fwHVQfd?FOJ&$5Qm{BX=w?21w)5X!H``a0e<;)`4g&7!7yQh
z!vcXHTH{VV?_Gh9N|(h<D}!ny6M@zU6(1I-1TAbB?@i7~ZIX`ya)DL*$vna21LucQ
zZXiHmla<VTozX<@X6!2?i^K2>CCQ8JFLs+f_O`4BUcM0)o2~|-a;3?Cvm}tujv8!6
z?W$Y+e$$k0%j{h{{kkoCb>r7RV1%Q?PhxN+BjFliL_aY#YmqD<Ze}o*icdBblN74C
zMRQ2Ok-($7C%_~w=oKgI?HbvH_9O6C)vbR@{0LF)b{)qNJ=IfuMaHq}{Sqqk5$j{6
z-D|aiQ?bL5pORC28+Df_>Uxx%T>|wJM;j7DxeW*w1o*x%)ZB$<+~RgnU~6HcJ80r*
z4ID}{DDq>hZ1-F@Im@+Swswd=`o^_WnA3G>qUz3XGfI^V#=HOyy~^p%<9DoLvjw&>
zQ>OJ`oZz`f5#IM6*(av0E}uCoFr6S-w5uO|(I;glXg)jr034M&!@oOo#g+TnkF#jD
z)t%=CIEr)$=${j|UbPs)7@p^CuU^`wcMw$3r2%W16|NfsbA7;|!Rq0&vc-ApQ<}uG
zI9Z#);fu0!`a_f}%thKGj0ap`_W7$jTmD(C^Q=}7f%SYVH1?+dP8rqFd}7OD%1jUC
z9y{UwXZ`5YF!9oJf$6K#xzE^#zkU|;x%B`L=FK8TWTQy2vvZ{ZZ5X<7UxO0mQ41Gt
z_K;2U(KmdOLzv@LPhA)s)~%v(-lL(iu+v*tcg``@Xt6c^$tfSux0v}@5F{v!gGtVV
z1USMx4co#>qX6`XQ}<z52Q7TbT=?~qzm7-;`xXt{t~J~0@N-T4EceG5gfQl;wfdO1
z(`8f8ci3U?JfeE=To3d-h!3E*49*fYCn0c>5T9ULTW@R%*w{D<g2P}p)@fmR(JJA$
zXx6LHj_d{C0RU#s$?THKsB%X)?G(djJ`lE?RP0iGb3{8V5OcZUwLno9Ls!S|aJ&Ge
z;B=xCS?FL$9j*g4X}-0Hq23oN7OPQha5){Gum&QZ766VvP2Ka_2JtQnj<;qQ3oLgz
zN<feAdudmRZw=+z2%6d$)d3N48m`_g>CAdr%%Wf6YAP{@W5WWy!{pIfaJ?)ze|JXN
zk@By@9;B0nzQ(k1ko*D6R$P2ruly~U%2rN1h`9fgJ1q38&X4<Gwy1}@NSCIK>*M3z
ztsvlV2<ZMKO63Td+1=q~XIb&hj$O%{g~}<l4eVRhX|+7I;ofbOYx&yiw#MN`i@itu
z-MX{lEBk$GW{9Qz_0?Qv<ym;)f@r<Q%Cij#IYscsJd=tWz^FGSX(_UsBM{-iOF0|l
zm)yA0S{BlJxd8iRj?;06mp(&r*Vsr$GE)Q_C|B<vrvtYAuJE8?2Ytd0^XIl2b9|_6
z00AanvMjmnD4|D!o^mIv_#4@k&`xo&U82LJPg3o8rhu)ggimq@(n_Eoz|HMbgKsUK
z4lg`i&xY2CyYQFLaW*jScCHSuN-xm_goj6}#$akH&Yv2D9|`^lTge(b#dG#e%`nKB
zW}7-6D}#;t%NW}qZ%ic>%-S>Yf*}6*0*AX-`@6x<6HoRoHeI(vx&#}UfWWcKJL)v5
z=^jjLPmOv%Da%I~m$-u77%NDQkH|d!cuJ4v4-W|6w~`gtm7G`Ot?O6vsjXnUer<7h
zL;Viw=1m*Uyb-j8_Ro+1<E}rSJU!b{BK&2bmg7|^(T%LRJbEE~d`{2%56ak}5Td?y
zvAKlgXV0wZFa$qfM+k4=ws`*A|NY||c-K8mX>&9jq1J+xhe12yrS=J@jU}4-pwfHR
zbG{@8!SzwWV6J)!oF0@WB%C&sqeuLY{^RNWH>dQPcR9zA$j`TpExKG`c9U|cP@}x;
zPi}UCfg8$>r#(q4Do$DkWOo%?+WzcqK>|E>K=Ct1IWkeLkvPe*I1mWFis#sQPv=Fu
z+AFyxvGLMrU+$!@@i5u`Is@cj>kV3C*uI_!eO?4K3>PdrqiqP&)Vg)<wP}rT*b}(B
zaA1JBw`#&y-#Hd7pS&72<M%t|%f12o=`0#7axv4lXB`>(oElPTD_$&t8wZnUf65zc
z)A<ZLOqQxbNs(rH*OP!g4SrJ_C(;|VeK(u;R^V{C)2t_V!VlNlcOKxzZs5w4z(U~p
z0?Pf$aAU6x%CHPS*ZHOmK5Xa%$N_n4*L&H-7+#HW!V(Tead~|bb_?&`vfg;za1dr4
zBH+8l>GkLqy|vw9_JaKkx%mTg<@t{--#!=f{6G=YCp^qfk&N&OK0YYd@PM$4`#Bp#
zV3%(U1H<xt5Ww1l<PF9)(tne<JSIQxqF^aob4;ORJ=qy{v#>1RxDH}ad=ONn{V%Kf
zr*Q#KJ|OxIesOYUZ_ll>68v1`Y&Xn$3D6sG)0r8hae9RHANqWR^CAobJ)!*cmgx%&
zm-`Jy*Er(_rrXD~5!&AvptC0iZ^+DxWs^~2uysn_0ug3AZKHTj+|#rlIG5h=qciJO
z#Xo<U60tQu>P3wE*<?K#2E>nG#ph%l?JR1`eVqge2$yr;Y`GY|d1BEqf5ZuUb&K6f
zdsq6ADLja(VWq)y3q6(C(fpg+b{Y%?UISiInKGN&N2)Y;cwIr?QkM>A@3%{}-U>h$
z92FpH*0_A(+SdJM1xlWZ0C$X&&+gZrpv<^!y{nxZt-l<b2v7jfIeu`00FJ9;qeI*y
z$4<o~B!Jfk4JKDIgcQSZ&N@zo_}{$*Mi*)U!PgFt9r@SjFFnG9-Y^jehPl2$eDC$@
z)tglNI6&k4P?(&HpGP-kDx$}PsB6}%r#<4s(5%97f0?C@F!nrL=kHYeK1bR;<ktC*
zH-dG&{<{CSgXuqq*1!Mtp>@qumXdR|*b5&`mWrp=OPfU((e_k=$YG>^wf|-&|9<y>
zAGGqm{2w}VS)1s&2Upm=#-GWu{f}||zuo?i_ujWTy?Iq3p+s$cco#R%R#Idi?GVa%
z=^<y}?DuCUVRB5g3ks*gS|RGYuuQPyOOTJsYTX9c@JhGmVAwXAbHte#P1E~wC(oPV
zyRC+X2SKi?gFl)9j0;AFXrNlq<vH?QzUkc&oF&y-i}9w#`k@|-V!BA7t(e@|OZ$+I
zLSQLzT@j@5hM-6E0N}EXaqa1z4){NG=YyOhq8FI&U65(|{BPd?-}e0<ZvHpHz6ikZ
zpYdkRkQP;-x!}~Z7)NTUqsK8Qrv0P+pT1IFnk?VgY`$uGuO+TXv6WA!iGSKjE6lpC
zDC;jXvlTyVA|VI%;G8I4Hu~Jx`)wbbh&#-Cx(r)l0FT&!_ane5w?A4dS?9RIv2ell
z`Dq^55ewus%@62QyhL*M063=sM)(lm0ds3Ug#oVp?lZvKX<J^7Um4u#lv~~J&v44x
zO^y-~ugodB%XjBaEIH<F9H)1Bv2yJoeD5D({*5>I|5;7WmS-Vn$c%SohAEx;P7Kx`
zZkFxr*<XI}-yPe(oa5iTNaul3iCEiDQdCyv^3MP7mgi><iPo_a21*tIR#KZZnXOg6
zHlS!7=`HFk>fG%lontKApgT+n{M9ZA?v+t1_sDWUfN;KzQs#})32T`LewAa5nC4W+
z76emLt-B+Se_l^lTkO*VAiVX*l+0qF`S8*a$nQDHlJNU!ki+q*W=+-tdH7S6KY--X
z$!ak7k(4bC2qEfiDR+;!6>1#~zqnQCM|b9O^9u8GXrs^Vx%9m%Tn*8j4ptk&wggje
zSecd2;agAs(%ruv@9yuLI?m4rWKrE$3~=e<ma%qcqUT_=!n^JR9w^+p&EzlP-)Pck
zSkBPggtS<J?jsmyNNyhh|HBphjVKW@i09hz2jwI&Q%Qxw`n*~UfoZ3{MH!^De7~Rn
zK=S2BNB=}}Yv9KDpE!PmJp6L=>cy3g<~L2cRy!p3gXP<2h<N>osR`yJnEDIn2<3L<
z;S#A?tZWo^pEvD(C)PS@aYlT1;ku&ehy?N=SV0@cIIh;d%&1XDRCk3B1s&!P4&Qv@
zI6iHT*7|9la(g-pt<>&fP-}H>X6LG_C;aB*jtu}&D&|VZPB)u3lGx8kC-Cb<2Jw$e
zoyze=uz+lbC66A3eRO>6Bm@d4&<yeND_4LCTZAa?!qUNxC`;P{OCOd;xXwzf&qM40
zHy#w_1Y~~QtH*s%t22VTcOu|F^znyAzAt`Tq|;se0Af%F{iP)}IAe16{uf&aZI6q7
zmq2AxYdAC9=+;$bKk)OtpZEh6eEA_A(AaGh!pqaV9vubst|KjT6BXca+e(1t@bC3v
z3SuK|P+o=D{Ud(869%%v@fyTRM`6K&M;bjg-#4)U-Jyt~)!vB1-1d}+Y^5P$OKhqO
z@$N#;wR{UqSWI@+%#nC$Xd9&o%OZ~1f>;K6ZwY2~Ri3$CT(s{Yb;dYs<AeSJAQDJr
zX$~@=0$gs1Mf`uvq+Y7tcL46|_;2=3V{__463FMzwWJ0KXW1O{bq@G}7>7ntiLoWD
z#xMq=l81rs6kI7b2i;>}Z#Y+;c>N1Ux1Ap1mJ~S`OfAT8_;dL3-DmVG6_SzGZQ{qN
zajs7UQSbo=H*HOa+s!VrBKHvwM@hjTX4gQ37r6T@7;duB2<+o%8ng+aXghSP@yb~4
zL!UvZ@Y2SRfgugM9Z|rL5pAvQnvbOk=dk1E$ld4IU0HpeET^=2cL^WPEj_fQKKww(
zAm#=rD9|~=Rbw-&-FwZ`&P#QErn6Bh!+IVgt~Ziup8$N&JgJ?v=q2{k25C)<vk*Bz
zY=Epm<Z>%1EOQ>T*S>=3IGQEQN2vTra&7pU$EZ;LyjLeK&z<NkoW3LC#Xp)~UVl<v
z18^ZtThO86Pj`fHNu}kbFKjf0Qv1|X|78xTdFtwlE|eDAodWFZPKOOIfm)fjb9S(e
z*d&V@LFuvq?gm3ynI-x@ZY~-1b3T^&F}KZMr+O#R61^6s(E64|lY5#V3$UvFUP%OA
z2MK***LMe#s!czs#cU$$&Is{dV(fW2F{PiPgHL2a?+1iYp@E8z(=KZ5oemlZ*tMsD
zdgHm%x;GazE;nK!g;ALJ5R=Z5>HZ8qvOm^270=pmt^)dS96iM2<-+~U5dnN(WAWp3
z@oQH+cQ5L*WaP3pf8h9N*`=pl+8=F;EY-&GV7<X%WrpCdaqwS{tA7A8AveGL>UF95
z=>Djsj3=9a?tM8pyW%PzL#Gshe=zea3&2+foE>1*-NLn7*y*Az-{MK9FstdF2ocYE
zk1Zf-`o7Ct3Vxxu*~2HxGyBA%cB`<6to8mS{2}hG`&o^xRzs^&zxoij+!D~_tI(YR
zM2f7nHI5m4FM2gQe4uQQOWKez8TmPD7kY-1O2dXDfa;2WHsuu;5tk2AJivVfxLapG
z$@=Bt?w$5@<mnkQ=u@C+U*mUN55Nk>WyZrXigO4kYx+*EY*FzkjPtLk{MHwgPOvRn
z3o19~MMZq<|55hdQB7s<{;-OQ4I-i<9YH~)ji4YkC{?Noh;*e&mrm%22qL`-p-Pi3
zoj_>P2~|qyH6e6D0)#+---+|R_q{WBX1(jKy_SEBSx&Og*-!bDX9E%2m*fY0Y}w^x
zXw83b>RY%fAjP@bPcqy?9gJ2t@bG9C#~aI93#zGFZykQB?+_}f(aT?JpV*SJ8d@_H
zG2kEmt{Mn;sPpJz*V(}yNZYNNcAs7}`>0u9Egb_dGp?`j{Cw#b_ZF$b>lkG@3Q1?1
zs%(?aZ>)pq921U>5M^fSuTh_@Ws8pXp!W|q#dS_L3NU-!6P0Vbvtp3lkw?F#ri|Bm
zlUzdKg!--cw~t!RUpF*=z@Uh0-gN|;BJT@ZMY}cC?fxBe4sz*86az$NCQ@W4Y?qJd
zCQx%{@n>!G?{ymdGva7l)%DL-rPqlO=$)#!r`iwV;SK)Eg8YSy<aMLmPO}oYD)vWE
zYJ}#z#$ktvmQ@<TvKZgSf3l!;IXgRB&hRUwcAZ{gSggbu!vT!hoKW{c=9*4z=Z+Vj
z2Lek#+9B)~Cega2PQE{o<F#2;f)HjANx((x35BaJV!DyV`y%wwcC(yN!~Fu%vUp>>
zs_Py63qIDPUr$BNZH9%032Q?$Kaml1>W7XbX7MV-$ze%bneC+Omn4T*9{nV@wIli*
zqWhh=`z}_3YR^IWw8OKuM}wIPT^K31jNuVv_S&JV)COXWN4A0FwaATE@U3l`Gz^bq
zMdga)0;bqRrlT0$xej4>NfH;O=31QI9yiv(8(K9+bAJ^AL-!c;>q#F3_Hp`gr6rJh
zEcfpcv%Z9Nnb{*~X18Icbn`8!iN#Mcy<~K@fq`x&fG{WNUeZAtn#c!qPTM^MHSv1X
zIAkSTTh}5ELw)jHwGL0?W+mvY0zMSW6UTmab`wg2A$%H%@oSfHDxtDA4BpZDb#IF0
zZGN%Jy!8^6yq(~CWcch{CbLI-BLZ+lzV09BwKj}O@zji?9O>RU+KZ~+5Jx4NMIe-|
zlZGkt)u_D@dS**mG*yi`VI|#-x^V}T$gT?S4pT^cm5ps|n0Qjrn)=56k?GV0LT1mU
z&wUn%32n2W@Hop^_JR{)p#+}fVX3yV?hKciaSvsJHTH2xob2zu^C7frqY^DnxUEG*
z>elj$<78&t3z-@k`*<>Zw2uN2zWV{<=(H0r!`0PQQ~;}(sv#IZz>hJR0H2U9<A%~^
zcvMwY1)Y{|JI+8X@+!{X8Eo7A*s--jvSf`pVd<uD|G;&SC-JIN%)q80K*1AU+-!oq
zB{A9|@yf<9tFgf#p{cQApWGtg5BUTRWzwY5S^~1sPq61^8%Rgflei85b0V+VNqCEU
zVL63m3ZDq%&$w<eEg)ie|GktekJzHU$;om~))JtV(Z|$TA*XTuMjmmt69yeQcXBxw
z2TYluKZD$CYSHnGz{qw7tgR6M_RQ|+4Ted*DAs!)GHhBo%hz}a>{yp|vDWmudS?Qr
zQB9~9*A!<Ir!cJZ3>D@`ObCyyD?aisbQ)RDb@`Aq!nR?3d{5iU<TDTb-YeMNC%5kR
zy@6XD%7j_AYRP=+7anl5hBo4mnuX;)^1Hm)Xr^l+5|MjybdNYKvKf7&%5^8xZj=)J
z#eyk2D)-wFR9EX4yYE4lG0aWJq~b*+qhr%E+*Vo=5AFFn+IeE4kO4Yve^SG-UlLpm
za-%aMagY0+SO!i<BpAiXeQ7ZHyaE&ieoUV056)F?S@{5ikYRJKZV+(uW%wnaY0s8G
z2OhpmC7fe%y}*{%$+f0(+^9D|w{w@(`-xg)j2G%7=4z_Ul{46LUZ;&TkDYFLgtBCI
z#FcbNBy8)qJJI)N6N@p#(E#na8}8=}xwRX9gsZwb5<O(mdg{~9F0G0v9Hj!*2S=-X
zdax?>!MdA-K(5Btm@~c?2)3sp<_m*WwXIuo3itSMSmezdW+-QmlsbPJSZ4cks=7Mo
zj@b;RI39Kw7C9{dzGHN-#8GStm;Y4DE-t7!)@8MKP8&g@Fv#L^lYD{6AGpfik}s$0
zEy1nrxZeTXzASoQ+;M1ewo%t-Prt^l@(O)?wCma*H+IBSQYwnQ(^QxW!PJ){6PPEV
zsCLH23_V0;=d+VNVbR@b{I$uG1-cUxO0lDzp=$_MFRTd8_k=)MS2<^v;H}m(>b#_&
z`v6rMx%L+Ra}(_DPj{e|L!)|W&SB@4q<jQIGXg@rAo`pJz}WlYKA5siI#ZBz$v^>o
zC&c9|d0`?Q4U7;jhFDJcMf;ynEN!E5*>PXKE7fRFY7uDphDV@bGslg-%+;|9h3Q{m
z7PXU;rBlB)<!$b_=5@JuWidk^8f)BkhZoX7Zw9gp8x+t$KUvJvyW9t~3e*D*B!~;I
zlD#IE;Cv@78pYAk9Z$tAO4{hK+{vu}MZ&eLj_r6B<p#-rQewcM?|%8^l<3`j2GZ~U
zNOyb|c{7Y5&Y`&M=!*F3zB-hQ<MN#%<jlPjPrL|fkS#y<Y@Y__QcOoCF`E*t{N=<H
zniL^}@qOBt<n1T#I>7@qbeFXw_Sp|<KQKFPb6i<}rpq%lLx|z=Ue1{9B9{(}9T748
zCmj~qwG$t`L#pg8En^BAD+aCz7}f7t<>fs<-in*m%r~$*?w7+&Scl=rg#`D3zzm3Z
zuXye>i-ROPEBXfZ6v+Kr>i@)7|Gn?|v&-~Iqs-R@D!I!ZEh;IB9zyIgZtTK0R)<ZK
zO$Euh|JezG(2D?G$jfCM+*-CCPx(&{>Me8AIHY_MlU-1^cCSz=*f{p7Qudrw=s)(<
z9o+{Y*~~}A8c$8XYx~5E-xOdj<@RnI{=B-DxPg_Wj#qB<sZybjhNbcG#COusoeVbJ
z7F4PpscW|_z+i)`O2m(8ad9A~^!lKQ#_t=Av=s?R1f3o6YbYqr?XJZMF>N-Micz?`
zi!1FOeyLtE7qi}dqkvC}l4ZZPbASFAcqwn|)b7wEKD7L%?>cT#j_n~Fe<~4}0&hTs
z=pb`cpHH`d&S4*W_#0liRX<0So7`_1D51b1kcfG=PkYSE=>29|pp)gfFd@w4v&&}@
zd#8z@AG2>7=S2%*FuXutdUWQP`ll19adyAH#H-s$q<=b&G}Ze%?t&t;_r=VszX|#9
z?q$e6>t%)EV0{48T89plw^<F>h)IM3aaE2(I5EiC*V(0heq+{@q)$A!al$#0u~$;R
zQ$up!KIs;l&8R)_I;idM@^9(=Y##RQx})$fzNrTHmP0d}@Aa&WMD(nA)wgmQ=uB}`
z#y0{VlVtZ};d%wi?Ttl~`ak0+b%M3Us-H`s*qcgd-Z_)dKkis84Z&a9krqIvG2BBu
zr0?>o9xY?b`|Nrs3+>}v(ukchG95|WavZ>>*W1#SqyYp{HR6U*P5Y?W+ImDcjRJhe
zr@v>`<qfV;Bj~PEPoj{xv-h5+*vZb&Ni6HMLxLo+vcy*oU<i#HxpuWXk8-?y2t(6h
zJx6!9u1fnvrYWHqQ8!^lvM{shx6=<UG#O#(NO31yx+MZqfeQ04++$tNO1)t=W9IW>
zE~?n2l~m{-#2=Sn;@Xvakhf2PTl%x-EKrwV_XG8tC$Uve(yRB|0B3YFJm{5#R&IPN
zP9Nia$R39Y8LPl~p4{G;WJE`v>_;K#SBf=aRsfayv{yOM<l|~~k?5hh19lo{mKya}
zQJqg;m#vFb%Us($ES38EyhV3p(qizl51;5U>bKB9Wpm*8A;*>EqiY@gA!FAgt^ii$
z&@mLIPK3dMn|YAipcwzG{=SIsyfEftcDO2XrOM;c6Nsr-*q$>{)uOAlx%R@xN$a!u
zM!selB)hu0(HH?8Hhj)V&D!T-r!NYxi-qlv6ZCzLd?!8`9sEKIny)X*!X_)Nt9f6)
zFJdN4SkrZ4=ev$htPwY1n-fqQUnA0jnV@Uo=g1pL_E9JykE5Nmb_y?AG@Vzh#icpq
zLqh|s!YfHs$wM4vadz_vLS+9#343IlMJFXdFXxn*gwJL!D_HJQOz9-N29{)h`=5~5
z0V_Bix%|ju`ebLKWOiBPAj~IoHWlP`324T#XW(-H;u|jt{%$hF;-V~)y0Tq=HN{Ek
z7}#?Cjau#0>!o=sfo5d~jdWxFpTZO0q(D6uhE2tkfL(X=et+7hVf*1dYV0M2XSlmv
zmMO`kZS_ugW_!?qwngUi)|?mtnC{Ysy^N@3%5qJw02m10K3fwL@04=iwdO2)dqRHq
z5*~UMd*?0#0bccc+D&Hb3|>gDOO!$JVr5CBUIR9usq|TOod$-RcBrdU!PHAqLsI3A
z8HW(;I9keJ_&ZIN_mYQK@A7VuQR54{(W2!ZhZbZ5uT0SDsnRteBC~iBipQv-d9-c`
zp{?ZY?OmA47hP553d4n1+bn_k>tw65px1|;(1}D@%)Byp#Nq;;<u;k;6hFIAvoAr$
z$D0r`5`5Z3fZ~LZzNX1EEz+nrQ+i!F;{d}#e$xO0pngiJKmhmw@E<I|FVFw2-?DB5
zw*2?bdrD!s;it$u|ACB3(vzN#Oe9S}Z#|JoQT$2c^2@$^No-59HbfuTcuTwqq3eLM
zagipzxy9N{9pC3X<CO>06<(^hn*VDS0QG@Qj#}0qw`pB%l;E38NIF0!!wf1Is!{Dd
zNXu`>mI~T-UlCpC1=?=&O)ieInVN8U8?hHDQEFNiSy|g0G%@l8LxUqu<p;{4W3dga
zqQGUY2-VgcEr!yS!@g3>Sb3XTc@E)o=%{U4tg_f{ygJ{&#%6R07jqQba$}xluD(;R
zOBGa^pID&+jc0;c9fmVocH{{767S~~l&H2^@2+Z_4t|@o@x4sv^FltHDUl@aw0}^(
zsqSi;SHXgcr0jOWo_D|PyPQy_8n~*E-N!iN?>3jxjb;X*D>>goH2}P#^)+huZHz`@
zbayJYc4A$w5oJyW8jXvPZL5@q9{?EA{i4*o+eZL~$r3zC`I!1GcbQv4YrcO2D2g$$
z3zFqteWETk$wX)L=!$%ofD;PYhZLyre%YEMS?AUXE;&r!66E0<&g*gp<i&O{^!dZ9
zNh=ljwJ)+ZxXEgCn7R|dHF<c}eBA35IC;e(ED6lX;}EVl$mCAs5NgEg>sQ>-Xi2b$
z*iEHqLF-m}o82=W`pi(;6*@nm(4NpGxD{I6{rcIny2Pi;*v!Na7lT;250RjeU!ibR
z?a7iq=8LwsoUYy^s)CSm-`;!8;YrB~i*18thZ+%=V4zv_4p0zJ6Hao$M{=8WgwyoG
zHsAH#jvnoGWarHz3~b#v(}=`_3iYLPSceM$ixcEv*v<6fIA4?aeHe0h*hCsc9Dh&f
ztd==NhAOufz;5Z<K*goyRc}0PJ}rEqsRU~+isNzotRJ7LUuH*MxT&TC&7|Fn`pN-3
zfPCfV+N-T1y+nZektyi;l@+WiFP(%eiA-p4i5iL@uy9LGQgQlS<Ra@tcyX<_ua$B$
zJ>xFfyGSn1E+{Nf1-(90Y|Ua?EY$NTn8H~%-k2T{JZYlI@Nopl!ibpbrQG*skABJE
zvfCogDn=xHu_q;~l=P)qc+CW&w%~XcVh1=i$|PJ=NeUMQ;#~OQT_<mI5HcCkCvQV$
zq%OK2?RS9VxY9^LOc2z(<ERen#rdo5DnTXU8Q!<?Y7A+6bD{dz6Ih#QCFZr<Z~PyC
z`CIN1=`_&2<+XRu?6Zi9v{F=Fy1!`rYQ>C_all6Sa5`XeYAGV3RxIi^dc0D+hAK>A
zfGKzGD3O!*v3E+N0CD3zh4cMh69wgi$cFpMz_1VJ7xD6U!e>dpuDS3YWEMO&%;Ywh
z?{LVKt?I77Y#$A_$9wZd5|*o66Eo#HbZ;^67#8Dgjc7u~vL>hbzB0-N{xVF`?g}#^
zHP~DdlOS;<bdB3H#jHqq*B{q<uNLfkN%Y2o57)uyJ=Wvb=cyR(&>7fNWlkdLtX3zo
zUwS(8h|!kjDHRiOH(nYTFb{X_9Cq`RbQgVT;9zEE22_WvF)h^4M7yoSuB<0`_8#zk
z5g)0Yzw?Rr)QNKqu^8_s_8xl@mwo1tF|#rNb2F5N4gx^8S++R{|DQ~yzfUWq88aW$
zjiTJtGn*0F37_RSA`&j(!n`<UeO&mDopQIv*K{PZlQC!ho2&FNk^;O`!}J}WG7vYq
zIJF_g_=Yr=c%$sen97QZ&dWmT36cT5Rpx^&Hp<nztjcDuTYQX}ptVj{W`;N^!33wg
zyu7HjV!f+jr-s`|b)jR!mWLAT!o)rC1VjQINik{toLaoP?*_Z*yYC(g<G7o|Awo%l
zXPR=h02p4BQda_mLE>@mky6N5EWdpWSfD|E(_lX6D=)@-#aPtYM$^vKUY|cgVuYQm
zVNsDjs-n6IpcHZr-BPn>PmUu{FibpRf13(N>^I^ak;yMdl>w15tm&bZW_?w7`0VH?
zXZ4h00enw4vnLr6?6m-ou&9i1f8Rb~0oi{^?Gqv$uaAnHE%YGoC@Y#0K+_L1^;_09
ziFCi&hSWm|)`RQ6sRs9EfYS~9I}mvEJIMnXXM@<33nY1R#z_S&SSI2EfJ*7yW-&}+
z9nSIPH_~s3n>`*Sn4-H!aNVIXW`Lr@C-PekhnsD*Wq}V@iRZL43@em2+z=z-cN96e
z)(=$uFrW7F!B`PD;GB>8^n2)djTbE(h2-Zp==6y%7QIZfidEP;h$1}-K0xWgmepGx
ztzn=KU)AUrRFzzjv-$P?`Q@2n8mN~ipCMiWw!o-Nx|;L~0i7ZGB)T-+vYf3lOeG!~
zq54m3D$u{Xk3T%YN2!)u46doO4fW6LYF8SwAa3PMZX{mF?BSC2S+1dWR@fx;f+}I=
z(2s;JZS2O<w4iYaFb{A+WX0QKLiqskC75vZ-YwJ-1v<j7Yr(wyfxdp(0lik*cxH#*
zTRyE`SaY*>y(C@pKtJC{S<)Wh$KRjKLELA`PfLJUn<$Cc(~cjKQ5;;UI#G0}bCB(c
zCa3dW&lA0xybF2`mlA^xJC0140c&H3r*Yh~W06K;3Tdxe*=+JFeVNbfB7E=WqZIg_
zfS||PeNl9*C~mL1|1;1#oCyLdAzIW#0S2ZhXHel3WuS{f)=ExooypCj6?n~-%kn(N
ziFD)S(5P&G@GGST^_^dU(F{Mvr`&Knvh#Wz&2Kz}Y`khCBC;wA+f35P;+&q5)125x
z8g++(z1cgyCl0xkOWiXPTYQ%nUfCb=F6Q|$q47j!v*FO9s@!rYr#lGjRr~N^DB|;%
z&rKDUL)N&MG}6l+Vdtg&P6f3Dk%nz5m?R%<dzh@_H@F5I4~v)^f0o6Cx=a+L*@&b-
zof4G>{a-jaHHb8a@Wu-Q|KdDa^2p2TNaoVxS*^OwxDvhUCo037<;(`$--L<pRLvP{
zFN2*@RT2e7Yu<xr-5J{MGL`1pjVhoK7VrkYz1sT8>c;%Zx<oz{fXNxvyqt-pR=UB8
zM7bei8u$IDcE>!xpV@39W56yA$@(X;`VKK)zB}XYUN)UMex$p3_-y6%Wf>ELY?HQ4
z&qE%d+!5BX@L=|h*7t0idfv)88_}MqiwD8h_R_lWlON_~o=p!U5uR$E5%9Ms9+He}
z;0KP;Tgcqvas}3-a$e%DeRh5Qw4H*8Mc-$~fhUy9M~Qc2K3y49($XE}l$SE}atP!#
zI0(*~(5SMR5yy0|k8|z3BVDocF_dz_XHJo8%8uJtJK8Y6OG`tR1xr}B0;~_Q*g;}C
z!xG_sNovmIYA_<OpM$Lb@b_{5OC@;;+yuhPoGeoAFaX5lVVdFLF5{oX<Rso-eV$yH
z`q2R_`B3*<P+0_EMbstDgM8x;w|t-PU17Ozom*e@PVX0eZjQGRF@PLI@t8*Cl(#dw
zG^u`hIr8Hbwk5-$f@o$>Ytz}!yWWCZ@kL=}4hrQ*8alh_40-mqcw8Qhq<H+gaV;aO
z)S-OJsbApNi?5+dR16Ol+av6MOzZ;4hH+IIzT^0Ci_0Q;`?Q{6=VRHM?2cD(3+!e7
z6px#Nu($sYT8~qpSXvNpbYd?SWCjs>9AQ($-y*HI=;{-!8f0%AW6M#_H|=_ad@0l}
zCQeMnJqx4NP({3=&(`Zt+`#lWjJ*x&7R98}Kiq<@T|STexZUDu>gv262R>SPKwMi?
z?`#i)3jPt;pbCur1T2&y-FmYg$zoDeqtVh?w#?YGAk^(len1j9!0at;7YW_$46|TC
zQ4*i{z=g5NAXd%utnbtAFG@ko=Y1R+Ut81*|LFTkiGAX>e+u@*u9ib26%xe?e4ZRf
zE_gks2jWP6=piaG@UZR3IAwQY4mlnIT+%Aptb)o3V$rp#&PM1f5*mT8t|n@x)+TF(
zdwgZs8NcMKgUJD!oOM;!NBJ}I7J@X%*jsHT&grY?kYODXB+8TK|E+HOcRho&FZy&C
z8H208w7riDm-SxcuCbf;V1!wsL$u25rayg1Ne&enisg<$xls1}h)T*)No3N0KC2(0
zFyxsOMY!-Dd}&A-d#2>6I}<=wUy7o0AHVH4lP(gtOojUZXA|(*opV#m-u7>FiW9b9
zx(pEOhMw~V`=_M*KsXGA5pDew`vJxhs=`d{X+ST%V<d&u{*;=DS%x9cj~;a|1hfXL
zzRad86`9O@fP`!j6(E9kbBhujQ6Ln@XYBz%;^a=<0z!9zrV?;)f!}CjnO##q)`>f{
zAc_Z-f8DXo>2g1xL^XEm=fTU=wabKTiLJ|PoPRFT6>!3W8@*$oe%#Yyce{C5c6FK_
z(3dKuUGK?I+TajL6at)`m|Z9z!PhH1jX>1jxL18a_f|Auy~jSdkPhyG2LLjiWrf*o
ziZv;CtCR8%Y4Q72{Vj#c<mFw>pW&N5@*fq;NNJO-c_p7I-6BEkH}!H9#`>Bt{|FGY
ztl7htN`f%L`&2%NC6Q5YKw#H7dU=$p?T%meQxwMo;~2sZ4wqEdxl`2bi&sUZsUs<N
z{{P^>e~8h`k}Lzks-DBXq9pkwr@n5lPczRE$;0-54p}MI4Wx~Ay1)kRRCjZ~c=W^<
zz{C|S_bJF70sI_US1nAs)EK|$B=Be7fSYP{q9scROQqt>z0V+j%>e_Qf3I_mKTFX2
zb(dhW{D>F)5W59f-WrBH52K;lob2P6p$&61xbig0yNN;~GAJ~c|G*ERv*U6>%X}VR
zW?rSv;Pf|VuKG953G5fVKYj|l9y>Yj>)%eBO+T`K*OG>{xQpZZQ|Vl`NnW_A=7W*?
z-OE$8L5yqEz*2)0i36ItO5}N)OIs-xOuNyz<Br-0Y-|Awx-XB~D;j+PkjGs)1F*(X
z6@5)0bQ`GfaGBeKf%kQxUg6|@3i2VJP1ATy7<6){PF>rQ=-AB*r8Ew2pp?GyMuJS7
z13a>y%L_BMs}wu8Po0q{)ZI~lya7n}tq8|nG4ofYr*{diz%Ned$N<l3F%Wh_k+~A9
z7cWWmwG1u#0dj(Qk&kdd;zw5LMf5-y0g-{O)e&|PkU2#tpDasy%({6*kfltsO(Tu_
z9$Wa|CEXQ$L+O)2-<`&j)kY)CBDY7xOeWz-d+WCvg{9_z*=Wm~g<K>C`XesKeLvwh
zj=^ItNojqq57I+<X(s|g^cm6OISMJxk1vYJI?Koi{fUg?J>9cX*)3e!{d3_{8E&u&
z3d0Y-%S%V%ZDh}&HIQKXvY7#iHwEbw7#NL#N)r7|Kf@{lTv!1G)?83GI!Iqgp#=D-
zSc2=1%>+6y;9+ryC?vB|P7v3ZM)p;o2o$V)bEY6QgX^kaWp++WJr|W`y|2JJpyz&h
zW=S+0^LmtTbfa6R+A|+eV*j}$(KHkIsU{~Gw1miy{}M3Rl><w=uXb9)+w4C=hb``i
zSQ$^c(r2*A=%fhuD4u?nWa9krjqq6Ujt+gt^W;1#Ej7ouN20o(0owI<VU?5x9U6il
z{J%V}PMt?R03M*bnkN0dKq=tMpVxNRKlcjcGke=8dya4C^3eyQ+J4|WVFlq#66x6F
zpH4~Lr+_zhhk#K64k}Y>0OsIyKVU5-db~#Kf%?@Yz}uu&JZ-~V7znuCrE%tKklfMW
z^Sp!SdH7=IsYGA1H7Y{Hp>`KMf<$dYG@Hf{Q!s>XU!R~3O5q5n6WB?hL{Qm(|J)yT
z*URkK1mgGv{%c!~{5u{Q53$t89Qgivs}>}=@0FsD;dZ;=r(QNi1_Pd)I+6xQkKWkN
zfD=#G%h?Z3zB!FIy`eM++Mxjc=F*Ym26vV|F;gF-wOR839CQlTQrlVkz4p!Z+w;=k
zfe6Q85b7F?R{^$jJ;aMWtuxn(qW?zfHFj>&fTYi<>dpD3KoF@Z!X-}~c^7!ajX*_S
zYxBg<7_QW`+FE+Yf;mOLp0vXt(kr{HY~vOC(t~-JALdNzWp{o*b@$>q*f&xd&w$3x
zbxA&7Ni-}8W0hI}Ddr#bFevmP<2qz`ht@{{EB=k-tB?-hIv%>m9^FnZ$o>)XnHJ&s
z5F+(OCmNsHBn3R@u9{W{_AM{%`YAt3_giNpDfc<nyFw*2KS})9)Nc1SPB8-(S~S4r
zMgxDl)6F$0M@;}6gMGwYOI3E~pNC}$j?w~YrbfN6;J+5u<$+Ib=_ZFlTO<ehLo17z
zXvNkXeHN%e%2qEfepGn8vQF;hhG&*!Ty!{fdA`#>ds<IjaHjKr5|D4I=u)Yv4T_Jd
zY%v>)w6Y*+ak!IupV(94xY2_mmnHe7fLwA>;o<h5%CzOnMCr}Qx`s$`cL7o3;EuN3
zWv+wIKC83dVYHvz+An4=D-d=lfLI4jkik-b-C+{$<G=;%uLRbJYvhp|4flK+=y05c
z!+RTbS(X;%Y3I2A&A)l^>h}W1+nGB?abgnL5r#ib6yMeG)?Hs*V}<;3<CwIgl$s0h
zGQED*ds&}V;^o}1s2UJEu=y63Q^n_i>pi21P1b^rp-kFkOdO3AhCUoL&;^#DZ7=@*
zR`>dsC=t5}cH0eZ_4<D?Ba%JIZ<YtF5(oZ}53{g3QVE{YymY9(uc~+u(LjHhWzOGc
z*+^(E^BeZT<Few?Vhe>V)8CKNEM=o)&BV8!ACQoJs;0bYUkA)oZRxF9P84_&U4i@t
zA|SQu*%Rz%8#G)WZn!!v(*CnyT{>O+>UWVS=&FL4#Rv9D&)N!^2dQ-(#EFfj%kV2_
zIxl<0nIa?bGOXjo`6K@0<7<uTsCgIn6qhiU6c@=fm->R;4=${t_dhYY+_i|sPrY2g
z#4EOPZk6h&Sz22|;iEOZ7oTE9O%*GLhp)sn2T*pg6$D2a3;wes?bMlbYy%nXo06Vl
zS=rfI6O#m4UA0?a`A_+LImzpCoWIWE9cUDqPBRTq?*C)zPY2`ufWa=kS{@~GE;C}o
zfkS^9j6$9_m?5ZvcXot8?oZ-tCumkA{$(o2sk0$L(nEdIG?<(y4lC33v0A|32|{mx
zw__cHq?zc_D9L4yI|NXXQsM^baKNlHH}BhSsV9+O6o|M8Yx<2%D7Aq8TWrE`7B11M
zfy$i3(R>~o9x;raX(=f1XycvTnYd|btxVM8<vi=*vODLTD)4Xn(k8<eH^CvE<eDqa
zBy1BL$||DU`&8@T%y(V1%8rd{R{$l>PpXMBt}AG&x*Kj^Soi0`ijbyLX5V&FISw(y
z=3xPta7WM0_rNWCxnJ+QXnV4HENW@*hP-ZYJu<g=c)7>YL>_tnBnjsDZ>RY>qknjK
zeVOfHpL2D<d9AM4E~+Gv^I2@ARrI(ye~H(X(yV8mNVD9RXE|u<vp@OXEoPh$77|6f
zNk>4iMQ+W4exnH7M&56y-2^aA8rbU+S`89$K|b<;Q!1j@Q3+Y--OH_m6?F~$B!&6^
zjNgAXP~M|IqgN#?caSP3#|-_TsG7AIW&~Jq@JmAf?6M$N{@G}MpueruUU~gZP+M&!
z$t8?Nh9O*)=5gmg|5oWinodWX32kO*_kbOMeDN-2ehW^HP4T_~lyrm2asGmbb(Hug
z0)xss*Zv2x>Q92O0RT~hwsAvhAfTgrCQ1X{G5?qSlonu*M32Q@EzRTFW5IKBY!qDo
zG-dw~FdqPFJ_Y_mFLh#u=Fy(BVMP#Gg#_|Z3U@yP2)!id6?QJwD}~%SThhcMIUm;$
znFjo}lkN|?T_mX1%o}sO;mXl7BY_ClDjB23AA11YJm04M&pz?xb7#w#pen$;B6sl@
zpmoX78a2<Lcl_c^WDe*Q@qLtQ^24+4v7;=KZ2MheS{~2qll=>5|A?U6&!TxVt<CZj
zJOIkP;PHdMoS#t)tB{T50P>68XGg@=+m45Y;+98YvNql5((wcgFzZWO;a}Y9%gp3&
zagAMgH@p7cN|?q{=IE*#yR<)fCl0hvFDCn?`cXLgvHV@8exr>d1F&x0!m}8e#a=7T
zbGs5B`Y%I6Sp0cAH~|bebY0GP=CPTS)yK1xC~31(qJE$`nSW>`4jzE6mUii_D?a(h
zflsH-@}AKNR|V$aalmvxLo#WZ{=FSp)?!(f06e`*ZIX44DFooaskL%~IR7Ol?NF2d
zVPMn{7=FZ+`f~GXFu=|MN$31&0nj$NT0VFx^{2SK56_AVBHi|tpmUcB&c(`D?w<xa
zm4XB#>^Y+Vzl0$75U-urQb0c)7<~O-!haL_4U}!oG4!U5>U?f>Zi(vMj34mFKWqrl
zOG!i0@jz9pUMAH^TYB-!{eMoXJN$qC01ei$Kv_3m6aBVR<jny|{&vXyJ#ODhmxu(W
zSeJOfwOm^8r3J3jd`9JamBDDc^{=&xsaO8_|KTU?Kt7+{G^KfUdn~L`!Fwr_^G%dq
zV&y}CRY*Y{)q;O7Ay*t(klJ|z7XVm64v<SsQF1`9oGGwN0n@ZkKYK#CbFF?|xnB18
zQVbXni6A!>?Eg9ZKHt7zDk@A<`dK6ZBJ@=xfN~kyEUPkfm+DA?+=~457o~$BY&^yq
z{1LqkV(P6q-IamDBEsEO)KQ-<QoS^QB{cW^{e?=ucY(LYBV)s2UYqWEHdySm|I6QT
zfx}qCX#C49?V`^Y?U@2D*RatYAmf>$1RqC`+il9f;YQCB$v&W$x~FBlMeL{9tVeBQ
zsq|h7;%iK@-zt9p!RlkH?^@04@g}gYYz1%H4C`2!8U}3%C7k{1Y=TJena9HDh#QX%
ze;*ij;cfGr38~NenYVxgnC^S|DK${`T>W2<(jx-U-RNp~ws=yu6L4QJ^^|%fuRL5f
zKqXk&MY*<#I%;You(z{6^Ho@N@i}&wh`ZG2iXP@Go3&#*JJC=}^=D4^;|QcrR|=w5
zpRgCid+C+9m0N53ChJ4S_48tt`woo}h2I970Tvse0^cR}hOYcAaNj!n-sUOw{fodk
z&tWsx$Xf^3+u9pT5I%7doJtygq(DsQC7Mjwx+o+rfRci5U|HZIk?tUf!VF~@{7<VA
zeoA9yZSGXq*f6`YeeDaD>8Lj^nRIz5nO!TGd`S+1CQntL25zS4mhaTz>J@~o79Cc{
zoZr$gL5JtR=RI@XRO|YB&2IOm!}IRNU)B*|4gNF{1BSHWU{wMzvW!|v>!#QGJHY57
zG(DQ48l6wiLFLlskgf-Fj4RYHRT?eQ6Ier*R0D&z3G_UGEu!iqTmtu={(-S9i(B~L
zCpKiupX$hY$)R%6Cd-B>{T!?+`|kEjny8Rq&9gwV`v;5C&S{WlrB!Rr9gyS}Y-Om1
zQd=AIMawWLSd|Y4OvQ`M4oiWO@^e|aFuw1KRT#!0^<GL}HpYhGt8ZcRdyQim5nzlX
zq$6}e^le}X7p>)eFJS^<RmY<HgGTP;rCvQoGYh>+F~hLtyk}4QoOik2oh^v*xZZ3<
z*ffV=oA2U!hWc~t+dHE;OigWzZ0x3Z0orZP%XULibXRgKS_UL}#~|YG)sJ_;sc=>A
z0P##$(0?9k>AECrU1g_awE5!&1{S)s4@M6c{DAfV2#@o@R}A?9o5CFgC7_G`F!h7K
zl;1+32J11eu}^XQW?D-CG_BQ!l><Z#WZyO*YG8$*DKW)&Nh2dp13lcvn5J(<vhSW=
zb`Hl~K2@mM2wuG_6Y)yX9A8O+S}5_7WpMVaOl4{VGzUe*dS22d>qe~73a~?#m4)N?
zzt!!)OrC$?Jw*4TMQJyzmTx<@D@16me-NB5v)hkd5zJE@4E|tv`0Scvjy2%HQm)+^
zt1xa;f)Nr3h`tnYvowdp&SX)puHifl)8X$gZWhGavDP>Yajxy`>@Ol>7x%hp7+{vi
zBsWClZJC3Msru*t5*amFfOD%gBgxn))aPi!ZcJ-$y4TE@_^nF+t^Ujf1?m9`K=l9j
z0DS%-@KOMH@{bNE-fu@fpoYs8;2aIN5y~v3++AH+D|dCg7A4D`2y`&TETwYL!EN&q
ztx}9g_?;5Fv7GSdtCzGS)y$c^(jVTDb?-)&<`o>jtaDY05xZ7dNXq0rM$fL>%wUi4
z=vd^4;up1y9M{k*5yaw$BE?Z7*22m$Vl0+ai4sTBi4z0U7u31KTwUtFxMq*>J*Q;e
z!e0-NPpY;Xc`PTka4$up=RuFGlT}`E%mWv(2!k-()MbG+()FJiA@ggwh+Do?x_b-C
z)@Igv_v?72(z}9Ip$OZrwT(;<D{tqSFX<nu>6AN$!K+Mio!&8u>6$Zr^<tH?erP+g
zfvRxX9T3Z7q^~=mp0?XG>h&0GnXWvyo2?6oA`Vk|g{a@|c66UhlX_zHa%19iNkXEU
z#cY-BB>!yfE}#Y~R-GX&={Vx1eAk9`Rz|c(JL?HE0(w<8QH$Z8F+H9b?i3ew`oBCW
zKk17!O{IAs=YF~Tt}!pM3%AWCZ%l=2ig~`+QI)IrvPSJK=2Z&0n<NnvMZB9SiO=a3
zgU^2Qxng=mHd+C+1`75WGx1LLR_f&gywmA5so%>7U2-^11Jx|vh!XaA$IlAtOxNiX
z$*a|AFgI{+tSL2F^-`Bqlo@n#w7EPAe_HKv7&W=7YWgj?aV|!1M11mVRCU80w<(W^
zLMudSdyhtcl#sa`b4IPRO?P=?an&cN%P1PRNpU7OJ6vAJql17N9BHTG@)%|jR_8w+
zD4iaoF0x+lQOr~IjS8%mvY||QNbqvG0*y_TUW{==d^>#g&L<hZb`*rjY$VmMt0W`|
z0D6dMgjst|5SkI}(x;cW;NaMPH!U`i>Ol~@3!8_-iX?7P;gv=Hfj#GaWMFRh@Y$ep
ztq4grH(p3LGBisFlfrGm1eSDEOVUP!A!jWyj5DtNT1s6;zV7uB?{fawc?`p?!UQEW
z!4pya%skpYE`~FNc?CDp>sQ74ce&DlVIH=77aL;KhNkP>5Jg|?VhrkByI`2qyF+`k
zB|`_-|2ADM_WWrks8Rq=ef)WHK+*>W>0x2(ihydWiEF$e7{D~opWex|2cQYSljsg2
zn+LoBOQPyQoo61B5=9MLyA0#0)E{b;dE>Y2rd1$s)4h?Ab5C~WJp$boXCN?BTt|#n
zu<4#3%Su(ofsG9AsOxrQJK#!r_+ta$CMt&vFq8R>vTmL)^7Ki=1MG~WW>Ze)J>o`v
zQc{aOLwP0|r;mzs4s3}t9MGdqos~NNTBVtX&5w^NI@9dyUa;t53N#T}D~qNrt6|3<
zJ9i*ub5kZx^7`GHSAe@`OY<NjTj)=d)2|>@9ckQj{m|4+(>TKx=56cmtXx!l(Ci1z
zFA8hlejB!#y(jLi^HXvXJC;)B{;WMO?`^lNrD3k^uS^y;I^O+Yl}n<zkN7nx3n)Va
zv^F`U+$@dwzR=BBW<t#3xR;b0A(;|ZUfW)G{wQixT!U(SRya+V+ftX{27GrsiGpTj
z$tPV-W&`Q(ZWZRH9-OT2IkAc@I+OFhX$=}-6j`@*kQd4<F3(@Pe`Z?ukIh>*^VH7&
zwZct5dtq)&^UU*=GSdsK%+S4&VAXM&Mr8|-l21VDcCED$MSoWC*-lzqmhW^IeOLYo
zf)Wr6{3s^)N(Nylh5N}M<UEGyKhDh~B_p~r4&fEaUY@5K0wZe$z<eUX{RN8Z&WHq2
z<k!W1nEuRz7P+UF($XHTIg1_+%h<N2EUET)671^*-Ww+tzew#<QGl%Wl;))$pI>Vo
zPRoYG$;Z}C%f*Tv7b>HfDTkGms=pUddl@9f3q(OT51_CsE@h%>{0(o4AKuDMU6Ln`
z5N;yMnug5#a!aDeH7+?gb`6yR21Q|Sk?~UQfWVZL9*GSvV2WD%MHP%|Okb}J@+OnL
z`^h=nOr|rBXqeP47|Ew5o|NJ}5-4cm{@fC&?6`>ByqNrzvzwCtpoZx|^Hjl2$bmm=
zw?Mq8!Vg8%y=gnF{IuPGxD@kA#$^<95R7lFs(8QNYf-^&Q`loTTf6Il$%oR~_ck7y
z%+PoSo0dN9+QsB6<9TZ8)sJ&?4;E2nh$SV1I{9A=(cnF|DWBXz-AY}4QctewLhHrm
zkAhwHKKLIJ+trN-3$R<%@W_byr4ROmDZCKm7>34u#`ncr4h2udp1aERmjSNnt>kBG
z?6=bJo&0QbmO{pcmG?4|X$)>P7OuNbacRjMF)}><$Bq#wjh;&Yo@~Gba$u~4%@o&`
z%~632$M85wjSrP$(AJ~!Ceu5kubjo4E{e|q68xVu?w?rr5)8caKZ<lr9-#VBj08TB
z-n-MBzmShVKSn#3H!ejkK6hsl{~@-M#ccDCWr#k(=&le)jF-~Q8JwTpOpcU#={u!j
zZ;P~yhL%3@QqFl|TgQb(v1c8PY}b1&TUZ--zOcH!$mZ;oRH*)euvtm4q-*<wscn^t
zwN`V+^YvI>?h7BsU1LaJkHEv(_s~zYkG>5juSD@&Q1A=sX%r7vt-@TjlS<MsZS511
zZ?vm9mZz7f(QSC&hN0zgb9PqL7*eBulrL54HD1Pr(gu-qXC7>AIFh#Q)e2jl{S_AQ
z|8?8XL}TSgHfDhX=nS)Hpn~?KRrgUyrnUIXymh(I5(1k=7X2m&=kJxyYJhjLpCpnY
zkot990f?Pa$oHR4RHTc(Hv_;rgcch3pN5h1B|CdgUnWD;whSgr2E0Uq+*}=DDpE+I
zdp$e)P|#STJ&F^RRq<%?x~BM=3XC-TT_$uqzsFv3^!<Y9>K}_tPJ-TYDUMmtqd?}M
zGG^#-BBo%q$E3=R(W6iwvMa&(qI>olZP&XM)mpQp&!NNbqxB(O7fW#}z3cY3DN`ad
zpTiB^eP}w^ioP~KHQnP9ND$R9xWhZ7kfY+DoBks4sa}U%_fr~Z>ha1h?u$hj^i`49
zdcHE6jkT-G`FltH-P+x06HcokS(p2VSz$Y|mKuC`fx%!E{?{=@_TZ#cWUw08jV9$M
zQs+uX&U@cP8u6nl2)+>oJ=xN8ob#vbOk_P#G@dpB?=uo7XHz2qUj!zrN_c$=onK;5
zr`B+o!rD2nz{HuGcHGb^_4wjnJF@3uKx1>CxoSt>iwu%@wQ_<r1tx<WC-S~V$oL)3
zCvQYjqMF(Kq)@q_xmZ>;>?NSCZ7RUt^|CZv1rV8Tne4v0Uk(<>fMprP!gnU(JPp(l
z5@ONk8Bw5bIXom(XW)h)<8B3T)k8634gCFS<Bh#H(6R%d<4Jpe@6I$=@rIdBW#8j*
z+05H$$L<w7-?tqZK>jm#DXu;4d!r23O?)7^TB*UOid(Q+T+UQzRugV>u?gvyq*F7`
z?=oA>%ARbLWH`HL^;Jsp+7snZA@GBrR*Wf1t>STkli$mS&bYW<5`CUnn&lnFYv^8Q
z^T%upP5eP;sU;CdhuW<3xo<DEsfz1!OEor+bD8ocsGAY-0-fjRd|q;@CVkbK0X&qM
zQi*~ZL4TVhobE=hwA{AMD^hP?bpy~m4q>f8_Op<~=WZL473v|1&m}w=07dzr_KpzA
zT<QP~$tbuE2o-+XV>{62ev^aiyRB;%0j3(be9T=mEVq--QLoSO3&07zB^FxQDsNQI
zx5MiZo;_`UBF%e}yjzH1)x_^oiJed12C@5E!hTtWEmyDwFUPLOa{QV;{<*Qx_k`1G
zcp=bDEH_ynU?+oEa%obQ_H<fv_NScYO>?07HytZ*$XKBwAZaB4J=;4dF@ZnQq`j3P
z@WB;v-@v{Oju(lFuUGg^wb<GqQ{vj%)jF2|Xp5(VlU?}kDFpXl&h)Yz@cyjI{h-h9
z_#G_|f>q_p2w7aqhhK6Vo|54GfZO)(V^gA06fkN2Xw;b*#qb|<4%^%Z0mtcJ2{$s%
zgzg5R#RMW)@lJo4r829I<^WW3tJ^u+1=Mfeg6?UjuE7b<`F$X1ayF~)Vp)yKUmFf9
zcgr4p7Gob_0ZK1IF9UtYxp!rchFJ4rH6s%Fg>q_aN2605YiEtL!&QC6CGx<sQtu~9
zUuNRFq+Uknvv3K4g5{mNi|M3d(gM`neH<v$uiVVwJN|H6&`hfKrTIFl?EOx*ZX*6z
z!|bKGMV*StQM{5CVmOgu(DHdrudJvMhp_4fudznGn6JUj$G*E!CNbOT4f6+#X4p9^
z;?Emt5&8-J&giiUn{irP0i_S$)>ne7=<&YDq50n#ocfPIb6S7)VaxS%KrP4_HWq8k
zbw5S&9$5UwVx36wZamk-HULPepzfn6j-JzBkegcL5eLIrd=^>iWd&k(qFtcmg^7Pz
z1j=5eoB2>Z2TVO8>}ThbCnzMgoOD(us^N&EYx!vsh{OBFL!-VVm4<Bu+AjWfNBl70
z!v8txv(?AymBdRLn?F_(Q;kV+93Id49VE@uoM1hPG`OXU_L-bPooz-(>DL!(hgSlf
z8RG5@2}(4+6c?8Cm<%g(PNA>UT{7~}a^1=9srX>eO~l(G5i(U_oyqD(cgu4%6|8L!
zpu9CMpCz@u$1Ka{WSYIH#f4Mc!}TRBtiBs4aR?g-DEC&mr^wk{vbUwPnjS%l+cj#u
zD$?bn^I6gmbXfRUxJp=l<=nsa${F}CF}kVsH>M>CB$ZTOI~X7WEjOE}I4YZPI`g;s
zt%986b-h;VYslam5l|g}HLL=mZL5uas84UIJAS14&+G+%p)BM1V?jS)Y|QdG_$k(=
zAUi%k(4he9PbVys1Z6+u?EP2}pdU<D$RHH*rd6N-jcu1{^IfhyWtF9O`p2F+UP#s<
z|F1LH3}tkE&`9kihOQOrFjPhNQa;*%&fu<n$l=$DYDFu6Xy^|$8Il#%<2c)krTI`h
zZZzhwOvO4vWWLtZ-^X*;_h^0>H)kb+4p6I?mJ;UKoQREH+OwkH#LVX}ZR^+p{u_pb
zY3?s9@9Ffsv3X^4CJGh?3i#sKE3AnyM40*v-<M6jw`+1t2_NG7r`^7gP+cj)$Un51
zzs}rz{Kun`csb-Oce~p&=fc2@(j+8F&hB8dMa}LS6ExljFAo`h$OPm=*IkLc@_Nk4
zHi0WO_HgSY4$u<n^qrt!g6{^>6&EqXmMbf{X;DM!zG?EV3{2d54Wx6h!{W5=u~HM%
zw=V*btE*RTMunLErQ$kuR_PP)y59|m4_Ee+o+`C83LDeB5wicH*!9km+00iy);bnK
zz@fjyw}^kho|-5m(f;|Pz_1w2;Gk5I_}yqO?Jf>sDoNSC{qJ@oImoz)dYx3#Pz!FV
zcA(1EKT~Cl%5)^!9>E-8OC33|(J$qZ)8jFHD=NOI>>!Z~MW=ksc`Y25`3T8-ROPir
zGnAvNCW`SA{g$D&x~d<Wy}3i@Y7@=P)!Amj%vH7tfp{R^B??*BJ}mKgZC7(7(99%f
z-go!|zP7yba(a**stx97tlfG$KHyrRPm0sXzP-vCV;4ipCNV+ptlMP86ieC^C*%7v
z%|d4?ilEvEBUZS2yrpvvNZ%2*z%tdPsL2!ctXwTdNKNW_O4v)>0*4zyon`Wt{;@Oc
zO>?4Pm$;wYgla5Ef5$=8_-WWf{*z3xmLsW+D@e;$&JE&zgdtn`i1sS1BLVSMhpRJG
zqCVNjxg)|1-L2(_>*DH~G*654`eJP1wl%|7&0nkPx-oGVlj<3-GMV;H^+9mwU%FK3
z5;mZMD{1OslY7dxIrebGM$RJKu#6Jcd<z8EI)ABDk3DTJ5T3PCu6&GrG|0GfzMibc
zqXvX$O_WCoAW~cgW?9r@v(n$C@#j8U@K_e1|ANCoSTR}2QXizV4b%#ir4AJ)ZlTOE
zxs<{7kzcD6#XQuEVdA1rn~6C8>O7(6Z~!4V80r0DHXiQ&<S|%{L&)H3c+d6l`zR|_
z&7eeev7kh|om__yREM@eJY9>-`B{VOc~%z{n3cYpt23W;A<)bkGLvKI{I621Klyp?
zzo?D=$XpUqd1Ly%3w2$KSP*xWHg{Ev(Bh-x#nU=Fh+ILgYYii-qYeo{RpHjU$3Lc=
zwcCk28K0SaN3(I^6h8-l$Qr`8Jc!#dw=vaOpDvDl%#@W&QbBgAW6Tv2LxwL3PFC3_
z*iU;vD=I6yptBOnYN?0zf~LWQ+HSk;RUT{9jOSJYpI%j`Lr49yrFwkqx>EAruHIO_
zK~A(czS3tYUbrJB>|!Z$KgIhVxQ?6;*t9O-%JBYl?ujBDQ3?Ke0#gKk$n3ngJ1a0+
zKH!9s^TcVEa><+QZr?Im^U<;fumQoK6B=uw6coM)sRf3_CjgYtc>ad`bUxptXm-`x
zZ#@#Lk0C=3f|Oen!ChGua>vI_{pe$}g7QmT%&tIso#yJyQamieLGAgYJD&RJmXGAU
zQ=7>9K5#6Xgp|BH+qiMMnorl`CM`Ntxi2p9iRm{gbt&H2x-Ef3#ivi|C%6?5b?PZR
zLb=xg^BV(T;GVRL&1N|L%$c!~$Az&m()YzcU7u|)02yo@4=ypPNoeq=3P~EokH@Q<
z?umvphxRZDn$?=kYSo$<eaE+R`Q}V^@F9J25JUz!ORJu=j=Ak2Rw=fEiC;1>0U56D
z<RP`V@gUWZ8_N<Rk{pestwU5>O^oi*X~C0FLgxdGOf}W2fbgQSo$xl?I~5=E)cmNr
zm%dTr@yj>esJOU=xmte=dV0-*(8pZf6#^nDz>!SAt4ltd^yjy(+H4KE!GoSLnh_9p
z+l=*Y-{5dsO1`6!s}}VlQ-1tX-d?QDRK>GY$bk-ov~6arco@t9N+9BAr}Jnv!{;AU
z{jDayL$1lMMLG}hkh9YU;LJ`w*A+I4*vo)#ykcQq>Nt98STBsSC+zYKr1@unr!f8w
zX@k~)&?p>^*Pk2r!+h}Xrli=dtw%W>6;c#Z7&6{>WxhaW!Rv9#KsC-sQRc&=)|#W3
zAc=Um72D3-`%(|A&#XF;?YeV|p2ex=B4}W^Mysd6joSr6PirGb$DeTKP)O2tx?)6>
zpQ<S4(*t_04Clt$BYhK-nBn0yd28{ctXiMYVXFQRnYd!Z6{92u#_a4IH7nhuJK2`(
zeWhP)W+v`U4&Uxhe<{g+BAjzFtk&k5cAh>J6YrB}pl7zGhSAj4E7^G3r&nr;?%AA~
z<^@UBw2BE3l{gf_Bcm!S%U}-W&d$zbLzR^r=wSj}nObt^s!`bA$j9`Et3XvA;U}>0
zLr+`cu6jYD@vr?sLG!d{U5(9O9vd3D-XPcN)!zz!X-`cvMr6&snIXvna!=H$|HV7~
z7I@y11YqncV6MqiiD9@_QGx`cGH_X)(OK>bn!;y*2`|xcJg>THUDnKw4t8th4C+Fs
zEee6GIDRbtlH*a>tq0%A1fs_S{^vys(%>iQ>da8Fm%rcza=I@!UK&Ws=385ddvoWe
zNgM7UURMI%-^J3Ds@eZgAavfLjw^ov;Z}<ox<079m;R7Cv;$fhIL7x|@$hWOA|Yzi
zOBD#VPwe5snl@(xcFv{uFAE(czY5|<Hv8uYuq67sPU{Q6F9>*Sl<Z@Y*^FZhBVc(e
zB1I1ih@lpV0{t#Co^Nh6di72W%-D*Bm3<k@a#}d$?<n2mPQlob^S0$ve2eo}ioapa
zSNt2^+bBIMj#oI@dP~HYGnQA~D=AL9S8m=PH(s98Q8gH@nry@1-?O(;OF`VO-8g`+
ztdt$^-Q66!4!A0{p$W`+&U@_bNY8<6W)Nu_I@DIJ&F<T2gkEFyh$0a{?zA%xX}ADl
zm1AWq6VOLK?;@QdkDJr2n!OA+w1gXukSC|~M3r<HH|*Nvp4)+DO3^?i{`h-64N$Lf
zq0;u^!jFpf>!)@y!AqydokbVF4Vf){{8-eBe<vB4f5o&TC-2azmDA#hV>LWsLk2Qg
z1eX>BZ_?pbD{uSOmDu|qU%7HLF9ixc3^f!#8|j8h!JO$oFF|)jQ|i`t<i_2!H4El9
z%-D(NrEAgvz3-XTrV-~*-$f4+HcDOdBImZ>Cl8=r&r<(`Na@B0=@K#F4UcDbqzTCd
zVO6J7k5s_A;g3y|v#RXl>C(KFgx4>eM!t{ctwEj5qfS|{7Cu8UUfKn8K$4!3o=yXk
ziC*3NU9Mu-XFfy2iwhcn7XDe86Udn;EdUHTVn5t6qDY~u@k!;0W~YU~u-t13X2q<(
zB|Xc`@GAn);3TagTR;Q2o^i8!vQ6@qH((Nz<L5Gtp^W|8DI?!+6iu_N+L1%$yI;)f
z<8E>a`8d&c5ay`D%RV%!<r|YW)gUX}dD^l0LquoR?YL08tsZYSabeYzZ@}{c-eES8
z*FU)y*Nix>z2D9STA4^t3Dr3FK~y2@Ty*G{1U6tip8JTkjBChm^*1oyQ3##SiWVzz
z><A-@o{eO6Zv;WW<oZFHD{5P%pM3X0LhhUXwGy4l<-DIcfN7}d$=^_0@|S*kby>0_
zCziAuB+?yFph2D3BE@?d?EFShX@l<<?;}AtZEns|`y<>G9%0tfsN1^t+5n(vU1EEZ
z#W-R8*zvuTveiHgx@`oSeK#(8b(Mi$$jn!CxoPFs^8^klO@%Lokim-ad#Ze!4Ebvv
zT|FG(@$^)%YQ$u%UD*2iKr=9eXPDdEZleFBe+Jq#{^AwnBsWG)Oqt8n=t4@0^fiY&
z3@LX6FA6;6Y`zeD_4-xkfzw9uG?Y>Rig5FWcXL>4;~%Sj7w+A@|A+q@>5t#vx}0f=
z{uufHD0}mGsNe1nxKb%(6q3Z0LMTG^Wt60>6;UBsB1>dn$0TK6ldZ{?kYp#z*vgiD
z3u76}*ctmWm@)HQqweqT{#N(%yq>>ee45X-oaKGad7tZg^?@<ZVLB}MVFW4RQ)yfI
zUB`^=p@j;S?(*Tl)Y6SlHgT)cZSaNk)z1bzHf4oPazzd!rEE?%;iB0#Z%V0x-QFp)
zN|?U)aOhvQo9;_!dR-s)GB-&?Fe+m**nT*3wFus3(-76K-x=nzznnTW%+|QB(S=aj
z>Fkevy$z?9jh@i5YBV5gIPKhd2isKZ&cauIg&{p};~)fDH%+N55=-w~9b~!s&WZw#
z)x9o0ljc-`0&NHVD-kE{L(*rnj`psw_42)aTVNEizHEkm)#7_m9HTG!P@|TcDvEdi
z={<W7$?w_6@O;nik2SIKqsNdZC(;M3Bk%erP4cDbUl^7$)8lCuZKQ=@xI#1g*oti?
ziZ#arR5T)!F#B{=F#H;g?3IYtn?5vXlkoyqyN>%^DG8QjRRUc%TtM2abWL6QVKQ-f
zpr|pwr6+)KqO(ckb>(1*s#w}no;$Mhr%E>7MO^j4NT17yCh2KcEO68a+J?m|d?<Cb
zv2&?RtVu2HO?bnll0YkwAz3FOIoD}FUM<=^I&jS-7?ztpDUpdD_Y@JV-vOCR6;`=-
z2~%FOCvCo081&-2$Rn^Q@*`^WUMUN$qX>COJJnj^+WH<?ecSSCC*I!Pmuq&>KS0fp
z)xp#?HQmBXO5qbW0zqia&c;;K%j|PkuH}Z%oBp;&@~64?(?p}s<+*OPjq3=$efi<2
zT}Poo)Xn=$_w14Z`mqjI8d808Do;mC`Ei@Jd0~X_G2IQB`&rv{FABy};n{-GP(gSf
zytt}T1LYCk%rT*5O*5F5mSyQ=;LTw=O;@ro3s!K-FF4O)IdkPr(R6;kVwF(pg)(J<
zO?jy>o#-LXN_UKVMPod+e5%HE$6t-Q7bZ}IA-|sb^w~nAw8*B9Zfm<p19GEv<*D}g
zeS}d&kx|49e#Qf#0S*P6EH-UiUhN(}NKO>L8H|bL-SFL+NUM}SNixF?!fF?C33tA@
z<Jbsw6|2kA)|as-Ntg-*VXQpXSC=q2LIuTMe}ldL$w)I?y7`;BMs4aP;S0V$rRN_(
z@{%}u-o!|=x{hbU9q+<Vt@c(@L!GdBGgDAG?muS%2<I7WKC|{Qt2V`u7k-c;CiO3{
zG@mj{oB8pSm@#PE*45w;7rt6?PN(^lxf8QFn$vmEE*o5}#CpaIzGd$e`M#%`U^2jl
zh$ckAcoa0qFZ7l*L|e5>+m2y)Vxxc9zt?lvN_+fTbZxLhVP)31GJLpvnr^Sz{G}BK
z*(q2_YkGBS3YXaZ`prBJ<6@5F6m^nIJ^RXM$*=92<8wL*vo{4SFv~h6TdipkIv11G
z!!rar0<<1*d@>w9?m9c<KB1UjX+5E4Wf9r!JjBWGe9j5#mZ#^oJR|Ix=(v-ar{TNm
zKHA_r-X{)ezzOOJrUmy-93^iuA}y|)*K*7KN8$civY%>r{*u?VT5d$0A=(4IlGEIp
zWn+NCbX$IW_7Sc1h<4QB_x~2gxbKy!Ro<ul<=gE>TbQ?NXS(?ap<(7w<Qb^6YaZSF
zl$Od0XlT0maXXo%X`QytRcx7CJ?^{?oZum3E?9`zDj{NTM!dXyO`w#-FWjK}@Frt$
zLBQ?MA0?Iv+p$C}tEQpFJC7M%78Nx}8}H+J1=wrq*ZAbAvYTzOr|MeWTR0gf0&L*w
z*Gof2Z}!Y)`>XZ3G9pQY3S{BcyV!R-X-zuWNS>j$>TV&@g?w6^t_?`^hibBU?Z><R
z0zsh<?aDpujNDf4RDZob6Q^ht3l1O^nbH81aI0B2L@2&RBZL})N9LfZHlE9V7z%2Q
zhK<h^ZxQ15R8|SDEV7_&o`Itm_JNKcY&L9D$TJ99KO71UKIaoFsq4@8xmRE+3)O!l
zU2c}tYLc69uFi^1+S+|C9X(FnD)Wc!3zs)!M4q}@Xvq<cg1YhE*KcThI(<0pyIHH`
z-Rm2Unaf%lpWd|Tp>D`cw=8u8;~T1nA97ma3}<}4rvz4TjuqyGKbiQDX5F<vfvR=6
ztO3@Vw}xPw2rX^P_lI9^?NC-v<KmMn5trM1JLoZ|(BK}M9vMoKyubAwiDrtqr-jcO
zEORNzuY~2!Osj8oAE^v$@n2Pw)bag9xYe)Lq^{OqdN#aZqFj6tt`mPrBMbGUG>!8O
zK^wbN1k2^kG}4SGc&}iFYnHodQ0)fPuuVf)$ZO}+N@*IBW{@Z8{GhlKn+<AWYngaq
zpKZ53j)ibBb>|q~dzE8Jg_sxP>A&MRNIJ%hRP~8Q%(jhOo~w?U@`TTC$hPWpkx~Fu
zp%(dF{umhd)!wkm>nJ$&`bc*9xi-?gWS?GI<m*nkp-;+33N@PWo}}IyZN@_3&MCdf
z@aEQ`Yw>*sJ)_+g1y{p)c$I6A9wr;>YWYL;$UTuVX>bV}Bh3+4U5kkj<f4<$_f;M-
zc2AWk4|0)z($brHatEL0f=PA_SFc=3_s4kKPq%@rT@$-N4j;t7M_tt}RE@O<)X5ru
zVY_kpnYhma6DYD@>oz0uU4YuFIfxzK!5B|&kqP3Ec<>Pxkyj9pK^r4B)Fn+E72!}G
z1h)@$D38|RY_VPVs8Q-Bgyc>Bz?XQU@{%U;>|4@Td;dxMuQq<Dr*{kk=w_g6zV~E^
zr!G&5i57AXwFQ`JoMcA6-_k4Q`)_wj(eCLJUhlcYN(A!Pm*o10b*n2&E73J^FV60m
zO}AU64KVwZ`Kxh8$~r!hMhQpE$ydN4{I6Zqz3e*ukjM4Lr->JH*^#^?!)XsffLX%Q
z2hNO>Kls=e=F@AQ*__qrZB!?l@JYM&a%I=U1@NvO{%S{%qOo(<5zP}>@)L5;Z@Bxb
z*%hdB?2NLn7`<P4<E#<B43*VyCDzcfTIhUP$qpVW`zbqX0<rurelz30Y|@o|z(<nk
zT5`5>Cb*6H@N<?$JZ={lm(tN%FSNg3yz+nWfimCoRQqn<uu?XZJD0Ke-~xZq2R@0G
za=Y;6lMi`GHK{-3MiE@Tp7uPDhC?N5x&~3pvfuFey)GN+KP+wr?#tlXVnmiPN0i2(
z$J6h0H`H(wOiw;u&DUr$)+j&c=+*EjQW)RV+jt?P^llA|RKuNSq)FOFl-aaSRv`Sx
zQ2aDiEbdhtcWm}VXTaXf!5Qmc@N+(b)EvO>v)v27@DzS+s>9WRBQCVEb$}U3H171F
z;32r}*1bwNwZEE=pyuz}=O^g(giDN9N$vcD_uY}rMb?@VKwU3iRhKsNp?jlkepn&9
z<aRZ8!Z~o|*t~HnpV-~T`@I6MArQI&q1?d;wARIhl8pyjk4EH%##5GoKZ|ZX6)WNA
z99P297K@o$zH0^C%)3F4sR;iT(KD9e+$IOKv@L+Yo-&c*8?K1UdyJXOvsky!>(Z>{
zwQ_+C?+uWd)3CDBv1(KzhidC<cuG__N%5FZhcax7ukxN=s^VDk%_2~FzJ!h{>EqAZ
z?+0bwZwW!-?bgAcIIgXi22DJJPoI~vDBH{aR09IkJ+Gy`(Fry9*t5raIKu7qHVZRS
zMk2=RH(BtCVer#4ilD!apMDBcrjIjy?M1B4gU_U9-%u;Ma7O$|-j9pvCg~<zX&X*>
zu6wT*HF+S!VQG`6*n5+1aeY}_VmDPX>64tDjSiJ7t7Sc4iqY#1ui?gD?5)^LBpPjP
zk8>^-@~|k)LI7OR%;k07kxkjT?l4Md8|mX_?q_R7qPLU%UQ}`9_%@TC$Bpo8-ZX`s
z$zss)&nVzm=6V>_2v2O97B1CmEw$3I5|%Y1(Vfqi>AKwIsej)<r8ZS{^FHKXP#4Im
z(CJ(4HK|eXy!?uypi@JwVP?L)4K2e4sf97`G=%%=qTgMf7|a-d0XYzLizadCyavW8
z<Fm5X`A;&Vr?z?&c@9`jJsek4{zR;DUCDeEfnh@<ie{hLij#@i{uAAHU)OsZ-*}pe
zEDF8G8)@ryIq`{6>{VSG>T1T7BaVwt$>m$i2@Tot7)$azJB{E|&Eb7&oP;mj;aomx
zv}JO`9JTT5JYpsMVzHKU%7{=$x($3qtYz_AUXPJ6Py0Uft5_o_T1f|2jSfcy=o{+j
z=knvI312;lpWeQ$hb@H~Z7Ve%D@PbcqaO>+A0t$gq%06Xl`H6!x<v<Kh&G!qFNzOL
z7{ceBG?|8v>hg(6p4w#jCl>exO|XiI&-~R0<Dr4k-}AQ}-H6Th<AWtUH(`j{lw`-1
zA8m_acctm7&)9X4w*pjWEnA8jX`L~gp-+Y8u76kT^}Nr$WrsXDJM`Mj;OU##w77E%
zw+Ch)mgz)Y&{((t)pv>XSfN^o(|x?kpY5+Ialek|Sj23P%y|_K<-3=q=4pGIaLZXA
zE|d@XB3yhw3n`Qyk-b~txz3xl>LiqV)5dYWQ+M2}SM6=D1bfJWQQI>IYH{*iYZSqp
zN|6YL-2=NAS}rQzDz!T9FyxrskQoT=JbAyBC&XV(y*4#W9KQZ#A0d1NZ7}Yt8M#_*
z@bvUr%U$3Ps^mI%r~t-T3UsJU#9+0E3Q%yQd(zt4-pab{<+;w)Ibo|JG&2&{$|L$@
z^)M2m8*g5j^?6vmmfJh@&#)>+KIs_JNp4-FWQ;ZKQ<!(gojMJqK!noz>$)C`bSoE?
zcsEmc-kpd-wRI)Is5zD(mCmQX%tC`}xN@x1_P(v9;=P@Di0IGo2`<-VwW(8M;5?fQ
zw(bvKWJ@(Y9jgUR>@EC*-Z=%R=4U9ezZTVy<&n;8RNOK9?${eA;A9=aEr4;ZX3zUt
z*!HHYExa#6>Bbz&rYRW@i$B5L+V^N7GSH-FNx8R2Ujvw=OgvE&FB=*rB6vTsK_@tG
zw6?OLk)^1(l_$O?)u+F*5jb`SBY28xtm`LLX~WNSpDiNebPb|?p@@cB_jh`>UA4lU
z309MmZp&u<8ECB_(iuF`<J~a9lt*U73-RGHBjS52bmR>?kMaGb7c5eiWoOE<+$1l=
z2($waAu_>gHIf(8CTW&?pCQz=tX3**&G;l@&C%OA6R{gjyQpMRvcJm%n9olc5weTo
zvyyHNIYJ64jrQ7$s+ySV_gDM5``qQ-jZlGf>9MCZc{IXF^Yi1f`|W?nFt<$i(?p`r
zb)L@_AQuuBYW4e$ayXZI>;#JFb%(yg%=TR9<x>_klexZLU_ah(uip71?MIp;zG)>n
zK|n+MymIC;NtDpk+hi{4->B+1XVQRujLjUtVTRr!FE6Utbu@=pFiY(pGGgB+m}~z?
z@f>@AbwdkYs(uj>;IUJx*|p%hYTzkQ=_V{~y%0c=SYB8KS#ntPK%2TGo`$_&5FUdX
z$qX#|k$@ftxqu2-nwkpV4DHM9$x0{X6t&gigqp3<1Z(Fyj$9a#ihKhs-##F@ojWgz
zN7KV%d*Zzz9-p1$me0m7druv2oAOzBkDACtIn{D^sYUTpT^N`bW=}giXSu4Mn_j3M
zzZr@gZ%p`nxrk>Nj&qc>xg#I-+8RZyYZ|vy>E$kRBrkW97i~+hLH-Mh#3R3(REC_x
zOai$Ldxvs#`9)+mK9m*L>X$dHU)l~0>q~2i=<BkOxp_0|;s?We%N4?~%sIAZhG$uk
z-O1{25OVev9yzJ~g+JD(MjvdAbv|Cf9XHz}#=qP^x27#SYa&T_*Y)_der-dchDzM$
zPI$bsmbYDI2aN{f#Ao}d2H$#=Z=s0pz3M5<r|PNuW*?*SvnsUZaBb`s>EN=jih*?E
zWi3Wzmb!*jUdR{wmNC0}1;JP<o-|Dmd77!C`HObeY~B0XC0Uy8rUk2HMf*tI-${d|
z-gOdYyN4$>97t<o%6!M{8w!#Rrax|_c~s6}r8_H)=j%2`Z8*MB6RKcKkQUY(o-0ow
zlh?N7AocZGwC25Nwhf<hR>w5`R~#<uRre0+mFbP_g<ySd`^MA+*QNG|%_a4<S_)fM
zPgX~n^=H%0t;V9Y2t>P*Ev)6^yR)%<hywrwhfU}p?o~{#8EkLdXnD8{ZEMsaM_1x6
z7sglqo}EaPIm{%L%X_mV<@W3bE}|}3{lV?WMGx=DK1y7ho6E|5Gbptb>H~Mo!-w6S
zxJR9mzXAO~z_(hHd#WAt@*iffLuM{6&dYuz(6_iOfEfEj7AY*^P<Q5?PXx#tuN|5g
zh7Zk73!fqyEo7$%Z}~*+KCZPoO&2Ez=PhEq?LOw(m+gbfA3gpPb^D9Eue;^VD$QO+
zFx2;|n{Jxd3TB>uQ9f#8LA9w6vd#jITUg?Ec;$3(p05A?L|5y%1x7r$6lv#}AHk_M
z)k@@8K1Lm0O&T{M%x{4hxbpTwscpOm?A%S>^SS8@ZNt&`$=eB&J?HMnrKhV$>5FSt
zgv<1ta@~wH`2MD%L2ZlbcXxLBw4#dD3)%frSE>@wCU>ob6ZF>bOQs)^SR=&GYDUiy
z&sTZ8-b1QF4%z+?!5v2hCu2^I)_Ud|;CfxC=5MT>mX>|4>GUqh>?`fV8rHER9RVWD
zK$YN9tuZf6Pl|mpMX#t594Q8>lu2^Ovc1YPev7`%N}o4E&NjuYNJN1A=`v<(%w!^U
zttOSqZa7Wuf_S#Qlk}K$=ywek^_%Ppz8?w8<FR&1Mh&j8?R*dCD{2<9h~Gf=bNN2T
z)4Az5wbR;rfSUter>k--;dn*md6ee``#8M>{jKwvWQbe{yCD?qt9_7Pnp_1EJ9Y)`
zSPoka#Ak74{zi3tE_vk(0xM^mP;B5izth<T2icq)x*FA{)e<>8Gm`#$UK6M*-g~^x
z(;AsT>b+=JH%?lq5f6>#kCuW5nft4)w>9)Z31y!Pb=o3*4an)L>2_a4$vv5*+~(3X
zvsN4q+F)6!ce+BYIaT${zcY>UiFAj<&{{qa*}5VeP)R<qSQ3={V=xs_5^GkjP_?wA
zF-ipud_FADEVJPSAFr0n;m7eoonBcV&?&y8*UUt&CNIJIWv@esT^=(E6(N>c31iax
z=^$h#xux7goAckAjiKy05R_4bm$`7{Kk8+<D#V1zni{W|Qj~MtpqsJDw|EVdOTHrN
zgnDZNP`w)bL;*SOgpa@l^M+{RS}`|F?R0)aY7^{tzj2yQ(f4Rgz;jq`Lpu76OP9`K
z&BDvMs|W}I#dolZ(ftnF4ec-rUcHK@a`K5|{?_`0XZi;3gELf!>ft5ve#zP%1&2fI
zSAE-)jOK39w=SlmKZrd=2tW3F+%FJ4XK#?(pcm)f?`hPP>YM$>wKucCIc5g|4L9%@
z5~YiiRGqtCVz(mW`Yk@;EWT`sHdg5SXA_#=?eT>A^8mF8>%GgR2!N~a<~DeI+YY|B
z$nad_SuG8~IXQ=b!(D>JD_oAJD)ke1A6Rn$9FqOzHME7tU?VJhY?4qaS)uTJ%2%D~
zDi3zVh9c_`XHvA@30-H@ET<Z{PXt*4<c@uDg%g3Jx+9+cB)Ux`0U4|6uNHVY*E|;f
zNu*-6nCLKC^Sn!JhQS$ngU*%*o4w7HLlyXk<qA3kB;q;*wcolM=%$WUCxHgX)2M(5
z(;uxm)vGEABX%Er9T^;?AHxeo;t`Y`xH`(MZc+>4HSAN)*LKf{z@|YrFM0+J*R|Q0
zJD(e1j}K7e9urjVx}jzD;1e^lVn)l#LNGVId=#g}v-u0-{xcGJR*G5$K|SegFuUd<
z02Hb>=51vg_t2yFdip~XsiyZxJ*WToKX1zD0Tfg<3rlZi5`%t`0Wrrt15~nl+uLoX
z3Xpt#%jmC`ZuZsScL@rU-Fpm~XI2|k%QFI0fM3ip2~odb@)!Z{%DEUBv>)Q~2(szj
z2*16Sdv8h+-!AI_!6+aCk_po`u5*H(zQgH9&hZZ$LC^}S^ItV{Z!Uf%#RSQbJ<xV!
zr;>M}*J@LJ^VtGI0@NlOL|*+C&+UbQcN4G0gbMHdB^Uu6Fq3lECvxwGT^X4<==b9G
zy30d@PJZBHj^Q#S9i>d`v-6=U2<D1&&`FbQX;TR0ye34DI8!TPNgCW2$6q!aD}qIo
ztX9$ht$UEq-G~ydRhR@8JmJkwm|YIAiAFkB$NI+AtxD%@w`TengD;k*I@<N7nKt5k
zB?Bu6=sCNg4}86Dq?f;q*2|7t-bhmtwzG*r0e#Cte<%viAjN;)PLhC@bssFKl6TsP
zLep-%C^uOY++;3&-LiOPny)k<%QQP<la_SsG2+awV~JgT)V}<Et~kvo0wejD<H5Dm
z@Q>(%HRV`*OQiBOlg7%O2OOkf5nQD#xxo4jKTlf(5AK!y#HfxZpXRpPmq!PGcPEW8
zd;HZN6PJu#=0G+g!$^~f5L^%%KX>Qgvnu)}4dNbldFuAP4*&iq(ZsPT3vD9hB^;dl
zcHSvAq|0l)P&&XMccy9;77?mPG%k1FQLVT_A{nsUM3@PzFZM(V&oJt6PqszW_hL91
z`7|@OX#W@r5)5TxhdAbh2SY&_X;N?7<65=8^on~A+_|Z=^qhL*Iqb<Lzn5~?C#2dH
z9ggZ>W9dkK0u;WuVEqI**!ssozNOX9ja6Zn3ZOI=T^ni1u^zD-bB){QwX9xOTTZAz
zrBt;0#Dx_XTt|-rdovg*;t0{<p+%fws}QM2?fny4_w2u6#Wz<EMIrG#Vh4b?6=&`V
zt#R|+<MCoRrdBQo61azS`xN=PyKQl@`!q+X??Q6rw9PH9NRN7I96gHP2Qx8{1q@K)
zXW{_Z^q$ZD%jwO}CPus%zQ|dX^uee>E{dhnDB?!Mh01NJmBM;PfxIQ9m44^rH|`o~
z&n83&!f~tqH9X<jLxf?wT3BkggRt%&y5J>z4oDZP+}erZyr0sAH^#F}Bvz(r?%a9@
zC0S5yb6QMo3*|yVczqZTCDQ26G%qUb3YgCvABbA6^}+lIHE^tF{i;#>`un+3AYeSP
z4KnXIHO}77y~%p{={;_qxRM)WJ2}mYrL$Y3(WWZo^0o%Ggwi|lm-xr|^V~2xkIz@P
zbNMe(|DKrk3q!wTuJH$shW8^yz`_echi0sdX{ZZ<jw0mKmZ*M{FN(A&%Twb5)Kc?#
zy3p=@*3mN(?7$?QrC~;{)vf0{%|zO5i0ep+oFS9eG_spmjb9hOyZXgQ==WE@VFOm8
zao)e4;0el10FlwJO`+p_tg>zP6{Wnk1V|Q)puL^pFg&QyF)?tOlj1{^I{av-ZO!L|
zJbe<<k7$idrOZz~Uh)9$Ed&R(Snv%k7og=nz{B%&dlk{xOIj!7^$fMGx8btC%MNb^
zG@m$HmSCy!rwRDiCV@0Y*=QqM7T1zbhQ+bA@TnWM`~ISAMrl+)l#deabYlY4*cZ)Z
zZt3tiQf~xmX*aZcRewMrj=hyq510MN{{J*PZy=OePu-9H76)J~SVlKv2hYweR#dA7
z?s(;0wkqom8!U_G?{1(*hZ;asn)2X5s^8b~T0GFraKtse#6Yl(VDQWH#N^fZR(Gkz
zWrM%$Uc1-5x#u9a*^hSLezv~Q8KlSJ@-sY0evsSH-CLjVyD!<}6$Esx(a-M)=QRql
z)v@Axgb2g*^}HgT+vp|9Y?_lF>wYp|BwW0Q5FoKok-J>RWYWH^uNt!m<<Mde+Ikn?
zM0suAdb=Dx_26w=WU<<yKz?zYc5cI3QVN#{YX@ztX@7S9T+!l35mbNI6)J-3WbE%r
z!o7!Tyud_lU6l2b&j6Q3lYut*0+~}XDhK!X`k$kzHRKULmx`v|Fg#iXEAupT86SW(
zy8-~05Dl;!xW7QgW5oFArHzpUkl3Q$@Iq`ler-1Eq|T2+yfugQP#$UiuSX=mKtLH=
z_6y4XE2Q$os+N^7cN^31W)Z9Uye3rwR=$FA0*+2U_omRb%wfN|!;9B0UWakCc~5y^
zk|O@%)Dx*ndb|n()NYFi^NB?ofK#gI{td1YnJ54@K%>xMu^|D?q@Bxav2#NY5|>u8
zAT!}YJnx;A$p4q`Wx7u-1GLb5`j$t!-F=ele0F|ZPo+#K7(O3H{mug2zb7Csc@!X$
zckxcd#h;+4(U`1}L_kU;Y><~_1{SG783SBI7>a^FiMdMMaRn>yGhB^bn9_sUett7{
zVgn;Y;9lrjxXpGNIKY7xssOJn?R)-e+Rn&_8S_7ShI@FdfF;e>+4PLl2aBl?@@MiY
zma?UuZWGS)z^`cLHiVsbATvxgWetZ+jWJX`%wa)QOOG<36>?;&xMFCf0zw|_UxE<5
zC5(PBAkH((o{uD4ifY(N?3ylE_F3sLm(FdFKrp3gSt+w}{Sntt6wvD`!xE2JA6TRs
z?I}YhLTIr-Jgt*I;{D&SS0YtPIu*0pgIwN5NHi$(OlOUs`a?Is#+_EAXa%2G$4ylp
z+c$)xxf(b|!i5&7kV}?~&Kf&h>A&1`VzXn_$p8WK{oB4~R<iSLjmqbQ=X+nRgCRTe
zt+4#A+`Cne{QyR3KB`R>Si_@t)NsR|uu~o*$szAe83tj20ITZfLU1&dASUQyaX6qq
z6Oi=?hK6iJWMyy<9S2I_xS3X4A<!CXoygYF9eijzO_nKc_TI6#>qYAwmW6EijUY>~
zO$d};3uOcT#QBsd(<uC$Vr)K3DZ+2{0KRKk=F~o*M@g0b=U`|Br;R;nI0@G37c6D%
zAaWh8gucB9F26W{5E^1&M|>4rRv`+zd75V(A~(0f=4-gA_yaWg#8@Lt|A;F7c^lKc
z+?#^6v!{ZM5XX9J?Y{~vYy8cc?R7}J?2!2Wrtf=Nx0qC9^CHf$sl};;LPAk^^M}Cg
zt|y&WVh#6Pb1JzWCaN=GU_E(%k>QdIQFF7Zo^zy#RwNXx=~fO{Q&gj`ev)o$Xgz4y
zeTC@A5^|ePIIaQ>aC~S_em8vPk;`V<l2@o=l?{t22jK=<DVbZ0_5AI3cXAtI`2MK&
zP-rl>PVBqluXY<JPUChzbZ$IY564-id5TO)?+~f}fOFVXs*PI?+R-sW54&WK|3v@)
zOOt+1j3Ov4ACoq6>?d)r7NA%U^)!AW`#w<Oe&qNK3E60ubbqcpRcz=CAUHMQif`~q
z6Efjb9~Hpb0i!T9yORzbN&){w{QiEs6qu7ygycPnG6@U(Y5FK`jmZZ%oEZr<s{o_Q
z@NUT_N6EOgXV0lf&pG}b!~FW~&3k&S%QLqeqHK|&B@L8{9{_+jHy{SsKO%Ta-A~@|
z(0;(8Fk7%9hm=@sI7{`7jxtb!-jFpFW5JR_77*d)9U9RoS?7287Ex^ao_70~sO%*T
zZj0X9^+e=!>ax0nNHWJ|3&4^79&hnhQ&I7i{=>oi!S3%z^gv2oJqvij#+X0R?(W=P
z$ln4NEfKswx3+xVPM7KfweQhD_)O^eO%1}%NJ?w{^k>9_S$xY*WD#bS=t`R3A^8Kj
zNwI>GTx=$D-EkFf<~axgyo4{l?=|Ner9_4ujP4WeC3v&}EgNmF{F@<3ytN->Ttuaq
z*lq5lPEVm=L1U|v!X%$c)_q%@-X84Y!@Vub?E7S3*!{NOK3*Xq(rSj6ita3l<4#Bm
z9FP`k43&*elO6C^n;ccLEj6A(*{x0AHck^BiLsdJX(_$)Kd2!k+|SmYAj^u#w^nj6
zrH&ECO7!X#gU4%0XEP$A=Io@zNB2+@_saey+StQ>o{RnClg^~+3(53^80303MA!OD
zQ}=ecJ6^?DGhg!a+G4K~A3us`>M!XsO4jDI^Zp0Aq2Il{7kMD)3>^(t;ms57aymP*
z4c-LO$fo)f3Zi0nTyAMb6_zD*nu3w@puei=)n}fAl>VmgZSOT+(oqfaNJ;H#2`gkA
zkPsTB1VqKY6x=PYS6>Siolekc%Z;n6l+jr2VS7Oh5j}y3<d7{@shpK-a3%esr~MYL
ze`ojde*5Fc`v$d1<8qUpO2qJs4eI-Gj<0YCtjAK_(3;W<ne|1i!O?X=hbW0;vFF1@
zH+?;!3Ou9T;lrA_EI2OZjjMw^z%iQRYh(oa6gtw`rCY6b!Z$ZXNX=yc@CfM4g+5X0
z&%&%@Tjla!Bi+_Ny>48<;1Zv-*8YJsc2Q*F*#6I>Qz55h`GSMhIy+x0TXa^qu*zA5
zt+mhgEmXu_#Y1f67Ln;793#baN)nUoNqdS~ZAGF0Un8lyjxCQ2@7N`-ZH6xUeA|M6
zD1X%X6<*r@I#E!ZWX2=L8go1Dfep<9>=|0dJ@s!AN;!@1S&+5`$f@0rOT0ZVjxBws
zepRAsFHAA*k63g!R=7?5ni)yc&eD^jiR;VPc&qyW<v{1;^IH)96aIV;k#CES6t<eK
z!ikyk|6VTtwNc|<@`}dBD!RUP3_XE4B4so(2ZwK8^!1eI7iX9G5k^gS>e#<w&aYQh
zF-+@VbU$0D^`t56TtBcNXffs?17#N!+PW?b7(kC8eFX26#chN`!4Z)6$-}c@=}0fY
zVY{}$3AW|d4lEc&=MKzEPcBe0wbLq<Sz@GwiIO+6dc{SHz7u=_Z+_jc;LDfBj%4lL
z1JJ(?-mCT4bWi40K7RfbrN_=Q14YqV>o`N__*d+Ly*sj`)n^`NoBLrbA`s|iLGRfB
zU{2zIYd?sZ3BoW$pW3&}8#y6*BLNHT02idHTuumFJ{=Ef^DQ<iJ0n`ihzzoKNmW*1
z9J#~#s5G=(&PsA_G+8XsKmV(fH~20zHOWh^Mic64z3gFKqmLD^jV=xZ_wigAo)W30
z{`ne{JpP_8fh7H_sF$0^S~kB?m?>whkBR#uYt+E)0Il_S;h%1?!#W9br^-ns&nO~3
z0`fQ5@^`)3{nYCQ!^bC9R^}Pg-_bAK`rfvuv33Q?V$N7Eb*iERv<_TysiJbPg8K0+
z`=!aGxybNf`D`PLmGu<CP1AZF8ucML$$IFc^T+zR3RIp%GiYFsYPhH`yQtUP-F+|s
z-0oVk8Slexs8o`3mhw;lS|G_NLQ3fG+wyPhO>sTHMCSB^{W!n_*%zU0WEYw_4YllQ
zMy3xb`ED4yyQCj^!fEE@<Wv4g5KT*Z@$j00peucc3w@0umeV%8*bm&Q(C1;WXi-+x
znv;JOeP3t(&5k)shroONYh{gUWiO1aC5}b=snl>`kGTcJ*NwU}IR(VkeN{Kt>BzE3
z(^stJepOBVe?$4NQT@*!{f>JD)YV0Op&7pC;?(&5VH)>>d8#9_RU2)Leyf5P6kjzY
z<PMD<f;JuNoTmYG=nHXQ0rFTo<F@@IP^>hrhlA7lXpx_8&C~vi1-i<)n5%>JSt=b_
z=0zRW$(ZY?U?<&Y9%mP*fkZHf`?1v=!5-Yc7cd;?M?gFB_KVJcS+Oj-o!jtH@~_zE
zw;cU{&Em8$Wtn-BTX<uPXwvS*&ZORnaE7Dp@?mq{C0~_j5w3jCUFT`!mcGh;b7TQ%
zDPRU#<A^QQEQu(7x|P&nEK*AWPzsoD(i`rb8cU%r+th6r<J*FZYw)j(JPoQyIWU}H
z#f~J%qR0)KZOT>SCAU%2i+l+rx!n?l#$c%PAOHg<cFn~Mf7RUoDI!(7lAL?z^1LgL
zh~#oWroeI=k8>yNMcv8P4GGeiFhm2#JGe-}ca(uM8~78V_N5j1wm)`Y)xRDcn9?*2
z*^bcIq2v(F@$Cy|TN%t&Sj}>>pY*YS;)w=uA<0c0osZ+G+s-D;U-~s%!B-LrwcN>*
zf5lCIHLXAO?mI(!fLi9$_}mdj!AH8WNgMYf%vTMYM7z{9%fI1`Wj%7hICl>9++8~g
z56Y9n7HwvRlmofAR@9z(e(v~&KinuGjy!bbmt$j4@=vbmXsz!k-h%uZY`t1h@xy-J
z0!^u5^`CjsnjM$=+k9e*-1R}Ue+Koxx!wP0-cRYE+nb60VU+Tue>FaLUC(9`xxR6I
zZ<EM;y&I1=n%6wC@ui3!sO0chpCsJUxO9RJ!py$A%t6LXa-IzM4lZzGi>K1y*@dI{
z02X{BhP<0dld~Px+LKt>7;tD!>5aSIg>?eOO@qoH99xk=_9|{$yktR@G6+@Jouxk^
zg#n+AHp!4A|G$p)w>%Gc_BLlCGxEWJs!tTc>L%g<s~LQot)Opys_CVOZ%5+=+#-9I
zaEvrDDDGQ5@_rEDlc!eQZD%_Gf~pQj!lk{^%)X#3^=Zy2GLHu<WsBLVW7vLCktkT(
zqXeYDzxbM-@(hD*Y_Y1I`j&!u9W~a|T(0*{k?un1@XZ(ebM3%DUqx|6$Q=Vy^BA5Y
zcq;Q?Pl%_ZnNlu`WF7ebXIXL%KdDVUo?-GjRU%Ee;M-)}6>Sk4mM9?(C%rF_)=R!R
zPEP(ik6>3K1D2pf9%QkPXF)c!22MN#dyffJ|B@ZC<fXw|sIa@nl$zjmJ^qwpAK4<C
zHi}Au4?_QW2w0Qd&nlU)fcE(PnfLz|=f5c>r;<FsSmBq)$fSv&LNjIQ@V=;v;(YaC
zhgG;QfD18~e3VWNFP&a6F0w7q?bk0rJ#p?>c#r8W*;E`{JSC2$xAiSn7(BC(m|#mB
zx;9vEJ@%yNKMyIQGVGTFi-#qxYuLeqJP&Mr1JuHsM8{tIx%dCLkpD7s|NIDqx-;r&
z-5KL&uVZhR8WjjLx^l=shHjnil1s2bAEk&QE0)gIM<Sw4!W*vGRPk#`p!y+E0;@7E
z99vetyH8Qp?vJM`nH(gGjUqzC%mUxRmia*{J7oRq;0Q>kfSmYK>6e}$vIV46M@U8o
z>xt+Vj;#j?|5uCCIaT=;SWA#P_a)cn>U(31C=0a<6;x2(n_!&|07Q9qfx+2Nx`us?
zaVKaD&;7HM-3iul!qVBi77!0?e4;)f^G^$j=JyGR54@VM-yWg4?-LmN4V0q~!*D9e
z`9j`b#-Vjd$23Kn+_Hz*IF_y;egt<CsZmt|FL3)Xrx%Vnn>#Z=l||&1^i)<$jurV2
z)I7zCZG*c8;MvszIf189i5Pj5mlM_eK`cf5<1NkQbg*K!sI@VtXP}U{xBl-S`k!6+
z!_LbeJp`mY>dOe77@{uqVH~$xirM)zo2eED6Iq!-8;?g25J!i7dg%=tfplyDeY@o&
z4T^!+2W(vBWT5@5hBhCQhGW;ffYDB?q>lUkf$?)%+!g6$hkn*yQm&!Llf~Gp!jomT
zV)o0Dw|!u=y|<`kb!YyIVvC73rH7`i06NFMZ>g!ZHHQUP%lRB&(Ec7(&m3PYnrbkx
z8goL9I2uZS(k4+K1lrWE+Np4K()=&uSRdC9<%r{20F~g>TB3y89z6D$csvBL$w(b6
z&OqG(`coL(p2r!Qy~+_u#sTg~6py?8U8_6%_IGk)zFlF9KvR(tKY6n!`c9wuBmex@
zfd0QfymgNK8K|?<N&Szo;eRUxr+gKt9iKb#R$11~Q9JgdNnK>Dc-Idnb)$zCLzU3E
zi$P1ae5Vazo4z_afG4*X9%SwDY>ftUy{O}<vwKXj;vlEBqPX>Fg8r%ow&HGXloMp0
zqhGeb{f=!&ac5!izRD-7XMcIuWQ-Cj)X8A0fbf4-rUJy{4ns2{g)l?l3W0Ok-YEG-
zEq8n`vFT=N4Rnc`ct*<Yxj>SN_G{GEt_(aXJ0m6a6y&mMVD_U4=%Y?=Xr-@G@Hr#t
zC5%-x5yNy>)^FC4wP|#_{kFpo7b>X$uu;=jdO>^8x6q~JEJC>CK9bgDL?^`=57AwO
zpKRq9^-q`MYC=aa`!)k2+Gj|Xs!4GSFYyJyJ?K!Hkhgm`j($LGQj>10lB)!PXX7oG
z4H8Ihs{Qd8v}-k`?ffzb75*Y5-rb8sQqmxsqMpG9(eVbz&0xgX@TNHF=~|U)#{q}E
z`tmG69Ght!J=CC>^w4-jX|dMHn%tN(VJh82ZSNhbum_;SHSw5s$Zjz_X(3#7n|6TH
zfE1BE_LeZRxhd;uQ+5U(K#9MVN)2MTHkCYyR9Rc20T`+MIfA&rV$&a|cmG_w1o>HP
zV?9tqfnjYf3foKo39XDm(acVf5R@>D58Tke^@|{|itj;Q_Cg){b!6-hn#_napbNcJ
z4$~4=kn9jNJ1D?D66~A141%)pP6I!}*ZDKxnwqAR1Varp<Hj{<9=>HUzFsfDGoX};
zIF@CvJw2Ui@OCq7VDovxsM#i~ly}yow$A9`w)2S4|AQvHU<HP}=bNQ+|JZ+iY4&fF
zD|}O)xp{&8-`1De`pS_*jXN_#UogOQVB?nC#`9L=-c84ut-_MCL^g6=Ww1EY0--?C
zSZhb{Q!lflwO#^PN(z-Y=p=(qySK~q-Zoy2wubYxZGlsY??i`2{PVK{)MmMyYPnLM
z-Lkn^ar704M1dy$UI6-UUHhMZd)2!a%%;Kh4x1IeWx%Sa$>CH_Q5&n=((Q{kJi);C
zy5A_JVismnJTw0_Ov#s~iG65E;6sA34X_5L@8hP9oOU-X+44Pe+ZyDx-g{3cE_*sK
z$jU<+Z$g5mjPYo=WS{ItNV)Oi^&NA3B$6YB$6)tK!gR$l>2*6?r<S{15MKQBL3$cz
zj$K5)oGg_PYDbtodVSvB7t|6~Rd(sGxIL-1&9Yo_j~RPKW~glqDt8{~Xj2J&-CNoC
z%HZ*ebPr>%|J;I02uZ^B<E3q6r+YEWYw6O^1wc-a+qT4p#2)8fh(wW$oa=^~nNVW{
z>&fBzMt$*OM1N+1?%04e*8<YTCUw{5!mMpE>F5t~R;)HFj39$Li2J^cllazj<~c=}
zrs;t&-P_+Dh@CzFEGs)kfkK3Ug4<RDJJjnIa!^KS_Mf)o37!EFz=#-mcxs_W7Vw-x
zi+xG&D{D80USSNKYjdP2_Qq~-!4}xlyQ^B~9&vDdvTL9@vfEoU0{Kg+=AZqH>+*6$
zL7Ec8=A-*})bi%bxh2~jYKVhhf&211;YGTOdA#<VFI_TKSsmv2{GG%H=g$b(RRpK$
zBR%^4r`sRzOG)jD?eCq#pNirU?+n4^jXv9R2;@kT*1iMOYAs(G(I1H<cIB*tv^WWn
zEKYEc0LR<-=+eNe*m{5na8%?=ZX^FYtxZ7<#Oi4;#K~01-@hVMI6pKh`RU4>C~6|9
za4~??0OD3ZRxj(fZQHRBx^P;uVa(dcg4eq12OVC&drMdbfvBRM&0Jg4CzwqlY*OeF
zAdo1B%70Wx>WaEqr5ZM!Ew0#_zFo37A+=S_=5DU^cB+nP-%;*IGaV)U)@7Rt)gSWQ
ztp|dcj|5+Qx*&90(|CsW=$zhz-1_pN%i23lnyX(yocrvhMwmW@qLwTI%w{-;bGt8g
zmdX~Ye>J*2<qf^%qK~$VTFV%e^2Zh5&Ls#|uGA+h$ucF?GM(_XGH_;?yfJOsms4~F
z`r<neH+>kZ=#I%sj+~up_JY5sS-gf&Jj51?vTR$J9kvNycRZ5kHn-Q+ZPl|0KCwTu
ze=S+0zP8bZJl~=A2^PGuj#@X9&u*+5uJmK8o%ekSBW}f=kK7-&;yXg}xfDlQjvb>~
zzZhbRSgqjRB8e2{?a1e6juELq+0(ab^Gf-6Mt(@-Vei6OGfs2ih^)sC0A^4=b-|yL
zQex{1Uw6v6B+;y3BzJ{kxeL^yh(FPagYWk`+W(?F>kyd{qC;WCymxxf5hhd6XN@5d
zLKj@V(qcr1o-e$oo}c}i-HQvSewZ2Y70x#?tRbmRGQ2kIR1}KC8yhdDtdyxt$SKd4
zTwC+(!AYEh5eMk|dfWL}JfD2jFKJK?Q1;}s&@kT?xwBrseQnJxE^utyMb3gsXh{$!
zdgU~yTizsl_e^D}!vp>lG}In$YQdqWI=M(%#N^=$%O^j@UIm>KXP*t-R2Zl2@|n7j
zb@#GGE%#i@oT{---ov{b>S%xMOV#wCEuI1P*L3vmhly}@7t2M$N_YJibhQuh(U3%}
zu<CG63L=tpcU#AJhB|vXbTTj=&DXQU8OWj<woH}535QN=5Vlo`FCfdsYyG*lT{Egu
z1x|Rw5>lv*2vM*3*!^O?L&b;3OEJ@#=nuJrt@}-BsDo!3nq7cZ1${Bpf3HpLl5@Q1
zr>jDB7Q=YND|lA9kG#n+JrxMTy-f{jB2PeN7x7+(7#G|vb=%?PBK6KFKJNU08Pg8i
z!<1!$%R2|D2<Qb@61yw01-|`=LMpT6euQ9YzKzO#e+96*Oq%aRT!}q7rha=iI`2o>
z7t{3?<PVv-QE&JM;$E^mw7vcfi~)*efcg=p#Y%&%lLxfDbmwRxw*2(A{ExGzoz2#e
z#i1C7I_o8AMxGof&ezFU8S>7lt1$Fw6cFl_d5xeb2(&kpWR$7Jl;Xr?3&kvaw64tA
zNgQ1JA+}YuBxg4V3k_adl)sL!*529jn}rNdZOS#_?|Y`H6lyB#kPQYs&!=~hH5~gf
z3x2wT<k@88L`(S*zK0&59xK5pVSWv|g|M%m{6JY+laC)$b+5>639Xu1XkUUhAC?29
zDiE%89tDwo&Y?ueayxarrc68|AYi@Es9~nu!lj5}ll~TBXQ)KU2DXFjB{qO(YN$y4
z<b%-0ytcUWaCfJA*!yv4)|3hC#H2a3Ne8_Pe&=|}=GP;_i8{_(EeCj{<k-1TVmco-
zJQj8Yc4m^cBWibIF*8M4$Ci}eQW`{S8lXe6pQXy1Q@Xe-km<R&6U_<u0Y|&yt&b%}
z0Q1VL9;U<H<;5F3yE;3IN`x^712RQpvv}-V)7dt?mV$Td+e|W%pWeAv*Q!<*=W%$V
zLkTU{iD_p`gTPS<TR$M!DA(lUz&7RC2qrg8+sQey624Wem>U2$R<U|r@TVJ6EfdvT
z%eCK@AnVwm+0mi;!ipF^OxB3*pwkg2j3i3H85JC8fSl7y+E&oh=rtfh$vgsS1jY1e
z_ZU)b%VG=sL*AK9K=1P7_tJwy*R-uV7w<St@@h&vQPnVgZ%m1Bp2Pm}O@HxQ4)WBK
z!(->fGK(Gf2BoTkNv_)|$%BGWmdcPON9^LJ`<oqhLQon!Du5JAXa`3`fOkn!-u3wj
zNIfky>w(Y;A$P&JyOMo%D9Fa8D*3GEZVokYBdW+e+d!U6hM1fKS|Y3Hm#fzTUQFLI
zbUZY)l&Y^)>~!>3j)~FPA5{{BnpAVw6gof%h=NnFZ=65DcG=QCjzqI}`c{F1-_+OD
z?~hSb?shm{RWkNCz6D+*li=M1+R5L@XH`Jl_{CTY`csQUY<B?a-x&}Byj7i?T}rd!
z9)M3ji^E%}-ThK!m-ImE<r16k9+3PxrWACtJ?kpOE}8mS^AV-7*rk^|wv8@Swx5F5
ztB9u`S0-6rcpv17KJ?y>e7l4m_w5Wr^3+k5O0h^e8RmUCMd&^x{HxFkBunS;Qds~=
z_WUif(WYKAT;f|Ts0YfwJ3Ky1c%+yN8kBFC%CTmf+={rOUo4)wEKWQEc)bBT+y|sy
z(kCfQ-^z9LTeVzdWTxw;YahEhE%YuIq?lPtLqK%dm?j)^^Le6?^5rpFTiDw+u31}Q
z0nevdB09|b0G55_B)nsMyVuMfZn(`N&MtyKI%Pti#lDZ>*&*=qM9>`AfHs*m`SEQp
zeZRJfY0UqpNQ6bw$B56%GHZg&4>h@=5rI1@$~i4)yF6E{XQq`P(p$TDl_-!Z#?a+*
zmv7r_q55XvhykekweGiDhv)3tuyb8#6OX!!`4Mwm$rWdvLMSQqz%TuU!uxDGquP)K
zhHcVTl2ZQa?<1zqZOgy=5O>RMen0Uf=$2Ax%Qi3SvKBN&Vam)kYTrDmW5Ie}PUuNI
zf9yYJ0jT_Nl>Ybp=f^+J<(E`k+6hF4#1j1Mg{gb#_a2g<jHg{Ux1n8)7!wyCK6m+H
zC!j@zuG4#6%A!>H_YiU-p0u+R9>62_gg8F}fsZYbYN2*CWLSDX2y8Tb4U+ZcQO}*i
z`=5IrDUy_!jj41xQyK_5Vt5h!Z-yrZvH{s}51jvPMJ)8gzTx&-xj@T=O~nr4H_s)Z
zNuWUSh_(l8g-VF_IP5Gvan$ChUoNQ+a_L|%^dmy3*qYz<QXe^Kxc(!0{Ki4@)kLO4
zF8#*((>Cc(egMT%HIC>oPv!m|<0^7Qw{?3&{3{)3Lr!>*d62id8U~0w6cm?DYsvvX
zA0k&(E-{$v-hcNB0REsynaD`~fVqZh03fgbK71PIIZ4EYf`DiGbq5uh34UG>e(5lS
zA+u%<WQq_ndg}uDe2;4&eE40Z{czD3ws%r$hk0MKy|^Z>vJCs$b-}c8b!sabi;q&>
zW??~z<8Ra4WCygh#<*X4XHK_TcC<-GW-!utHzrv!2}+JWDbh}fORFG%ts?Gos46pu
zZu(ePZLH<Dw_Sy4t|1cq0}bjYq&g_f<-m%C+7=BJMRGIz<Etf*Wj0bjtusu`f3m<x
zvmH4?3Q`lXNi}3``P^$Wk)?c%!dDG*(_}_eL6>|tx2QlC2V1nfs@p&F)rKS4Y?{?A
z>VDf2BXK{h0moBwA8VzweY*+suo<~Q3gE3lKB-}&klGan9XNL->+{t;8=*U03n>^j
z@tu|px9T-P>r%6Yvy)q=^yK!RPNYcIB~TbKuX$;9&^HsJo2B!lGQHL<!}f=5)>5_S
zkAvUp%I+4upllLW#THAu8;kIOthJx}wBWXG&|>6IYDO|f0p;riGO6xhC_~~7{(>Dr
zf-=!h<f5l*Yl}Av@lv@qIHc3XO3jn9>l!K=(7dk7>0vz4y=S%>3!vnieH2Tqs%<44
z8?Rb!jI5^O=s~)m_c}diAEEw>vH#@=OtPtd+FC#pSxUg|@O&a2+qL)C*Cp-sr$yb^
z4ax<WcSQcZ)7*Swyy|NA=-bebf7TWL;J5sHtMj_{+SKj=WypqB>k+1>>bn*MT!Qt~
zeQImT1B+e|q`V?Y`}?j-0nc)m$Er_qQR=b6^@g!%LrS;6Sk4gdl-W;S&fSAOyTqJ-
zBA5pk;6QR)cI-WO3Ch7B0|IU|1&1U*gf8)eOI#bv4PrN6Aw~@*Mhw7&$!w))#O3*f
zsbeiu#|n#q9p5nE*$9S5D-4RdjV2h8CmxggW(|JKe;ZV4UX?8NI3zE>Yr)-Wx!JPM
zuFS-K1ObzXVR^TN^3*{n@E~6B5$Lq{CodRd@9{%xXWnjCQR=Hn`d3ijIG-c12?ZHX
zbkdo|3-n)6_<b~`uPya+`!DoR!+CY!LN@)r6-j|`rViLrlij+?z<g<96Ii1y{O3X&
zQ8i#SIA=qQ;RUqq25aJ#!>AYQf}T!h*x=jr6m;To_(Ng6Dk2rG(l@6GYPK-%XxF;-
z$8?w_agpVpwW)va#()2IsCVybYB~9c{%%Law;k?T5?Bo2@2~H;+QTXP5Bs_QM~AiO
zvrg?}xU?(r<-nJO8J*N~JuL97qvmUYcycZ+pl(zN{`YtP8^zz4eeT*Nw+7yH0P)q}
zHR)J1X|j0JQ7=nGpe=6h$MDPc4D`(1lK!XZ(+MSzh!eX(vLHpMKNxAUvG$ti)eDZj
z73W&gB_6L-{4d(wE)L)O6Qg^bpQF4*$7b4S5$*nFzFZF{BH+m$J$HcxH7W-#jYT~h
z)>Wq1k{a<yZ+?In=zaniE30l9;~j%n6`aP8PYopeWH1@S36vTX$e2gQ(T@s(j(|H7
z<?<lJwCeW-J>x+FEb7s~fnQ7@UEi%IiQog1s;8gHITo+sn##-*JQR8>6tQZTu}9j@
zoNPPe>G>Z|un?e<I?Lo<KV&}D*&3WMB&9QGyF=4c83Ij1ml`fq%Sis*Sm3r#Gb2BO
zpd|fS>^GCih}clj1NXnR`Ar4IVcW0!2$XsON?>ho@a_sT>MQiN7h>lgq;DBgRyTAr
z)$Z8@!}I57!ZH@UnS%ih@+PBbljG;x3%UuiZBRll%kdm4kRGb}yU7Ndd|F2;OuO$D
ziD!Fw+BXCabI>D73G~MDmrqC(3_q#t@D!1{MS%ng2^T<N{`BO2z!WLngog!yuH5%V
zjLaDyeh7D#K!+Sg)mVlcuKayF12TYdBIuPTHLYG)SOsx)X7S0NU{q(5dH!yH2B6yB
z>44coh1#Y@RzRm1*U$M-@VW9t_x1F+jtuG|Wr_P=e>5Z4uj}nJwRoUGH;UD9xvx&I
z0Br&!f~m-d0;H!EY}dVtLk+OeGxLTH>BXh{5u3XEpNLQL$Q{M6Rx@L+7PVh=K)oA_
z0>ZWBlXdZM-?~C_!dABiNcC6d595KWG#kqAaeB`jt=i378qu<dn6~zGWT{vxJjC=~
z|HKD`Z4hCVQEK5HJsHHow%n9~{#*&Lz2NMg|CbOGEOwgIqoIPfZnn}%CCOCvJM^bU
z9&zz7_tRssy|yK-S7ESLUuz}>@f_5*e*N7Imf*2}HV-yf;is!af@8e6KO=L+BQyyz
zS*lJVllo}8o&kSy>)7FugV4=;o~DQ#$UK)l?(62O*l$XQ0i#5zhDcReBiNCm^;nZJ
z8#K=CG8vP9^cPN_{7*8aU?89$8vPlE&5kjO4~#wbpFEmS5djF^ij-h?fSPt?*{F3Y
z8u1xNZqJhHD<}J{op1^Y;y@30x~(OzO7E*Y`!VsrwC+bztt!45e(qHK;r*u>jQ5!{
zUsiK(R-JcmI@S9TU4y(Q31<v!p8IC{u$pbC%<%T6c-L<GQ1#+pY|i)3za%FR(4g3t
zQQqzwjqy7dR~Are!Y-ZXSz$S^J(o^txdi;g8KT{VUv^fofr~fqRz4KYL1?hv7P;Y8
z>{%pDoaB}yZ>5g6l?=y7-!u)WN|1i<i@xt#+qNrsH>ai`K)k>F1iZPqcaeueJ`Tjj
z1)Q@Q+Fz+UkUNx{aVg{{#Qd)A3_$t;1aJI9P`~EQh}h45-M3>DJ97yX<d{2u6|m<y
zDD}r)+xjx|%5Pe#9gOYJC|{SZ9=;Y|<cBT4mH8pHPj2h4<0COv-t=So+qRXr<BM$~
z2D4N@w=vt-HN41$Z+cqZ-DuZ{(KlhF1`<LM%nF^1tMWPvMHyvi7_GbI;8}5j%!p_l
z4|kr+C{rw2x?5miqu0@HYckotkW(ZS$~XK@ln&AA1v5^#k51#eF<8NKV8-CoSVc+b
zht*Z3*28os+g0k;W|HckMtEPmn3t(O5FrVprGEMR1_;0aNj7pz&BuOHJX3Yac=odC
z$R273D$KwA!GHgDTAv!Ao)R|&7TD@mpS!zB_v&I}Ch87s6A4x4UQ2&NtIolh9|FBF
z(U5sR-t$@V;6{bQ_*>2TCe~#4+myzL$Fq=`?Lk9*i2~gP{R$m1^A!^f$BgG4*|-kU
z+t5>ySL%;MWx(WQ+!2--epm@2RK^fxDPFSrqT!BaWG4zvE`KQCCYxff)69A{;Z&D6
zVQi{uLAp63qEgygZzpxIV&0GL&No@=jR-}1%l?u!vHOHIq+NZMm^<P0!g{uK7#k_=
zu8+>$8-a4jw;c)-!fG^@i=OnACHE^xcOrt?;h(2?cL)u^s|s0TH_9)-pQU|fEDT)W
zY*Bk^H=E9Avhgu~XimLf<JFJ<hpz8{YAS2j9(6{>20B)xjSUnORC-IsK|!f1O{7Ez
zAs{6J2`x=T#Y#j31}PC~QbP{}NK~Yk&_fFW0)&7NN+6K>ADr*r|CaBrv)7_!g>$ms
z{p{y`-m-P=TM&4CH&dVG+eq4_>f9BSd8Wu?p{~sD@97tRWV+}f%aXxqw{z8ca88hr
zKNbYT4q+MUF~*7H9TvZL-rZWo2i@u#=)Hd`Uj@XEnrlZP)1bbFr770N|33hhqr10T
zBn_yEML4_U<KhE4;@^0&KYQ^`G9H&oyoj||fw<ddw$QcJNu+!J1dwra?RN(t=f+~>
z6cD_Pojq7pX~?j@P)|1JYC{=$6}3f|)FF(C@bzQZwK+AJRAYzSg00qy;=+03R*O@G
zTFsiRIxPjt#oisEiH2FkQFzV>WGNK_>=~a*4p1p8Ym6F1X|l*NvUTyRBpKxSY(xuM
zS$au_-|eD8lz8Iu%XmP?l_#-RR`$9Ibepm$oOsC~VF$R5-<llzRM}znn*nA8<h0S~
zy3DIH%M2U)smgodG$*{)kJYmw(C8Jf5^7H!F1Y4ht^Iv8f1iW)!8vBNSY$Yv8^wsV
z>M*bRtN)1815~+Mht?-)f9u%~wN5<Mu*HwhKRWB<AF@j4HAZ(jeY|GTp}Ca8F!)+X
z^bohyJ&)9n^?4hfxAL5coX<`=+XXfH65g<dmF>#<I(QBAg-=^$D&snv=VoWb)1bG4
zB{SNN-3rRQ6zxAv4W1Ye8;{Bn{A2R);DH658&3K&kC~HT@zRl;!dZ2We}3FcagBy*
zLIdLDueT0r&D$JajeKF1(w3|os~2~{W*W}Y%q~9h{a1jt{~P%Gv9>-OKmeW<K2I0E
zw7=12mgf8BrJI##(NA>se2ACEMpKhwci@K`shH|h`WdlTWvVz6Opoilz#b=69pKQV
zf3_Bsakh&RF=x$BpOs^`wUrAx7MB!V*8FY1S<_dUJ-s6<XAvqU^;xePy@%8oVRvvw
zKF{ykL&DZe-80R6u{^`yW$2D-6wBS|XGFOk^;Pa$)#M5wRSx8eR+6`f+a&-oLKsmY
z&3h<$A@$p!JxLwOCzWJx%JNb7@y;3vu&ee>C2OR=Dx_KZg*HP7U+02r*I{AAT5<35
zi^wuS(4b-RFX!wB>Zl8_@V}~mKyvidGAv;S_sD4;I?dFSBm?I@t0|u=`hK6SygzC!
zCMI`&x-^KXW3@M&+GZMV;5igpHFv_g#dBrB^&%(6IEFkLSX22!)B-r+UJmNa#l)h!
zD_Ixbc^mc{D$6$P+pH76qcq6g3^0vp)c5R~02z276anUU-oV93p+T}p`IE2oL(j^l
zZzh~f8Y}>;%+VzmHlwWS*{RfD9~v~HP{rp7-X1i#tm@I6-O&0t!upC#6fDozxzt{r
zHkn<|N<F<_kU8hfZWNh1mHXP3+-%kc;C-YRT~sH(e%D3Fw{)!6gJ-`arEeWAanDN@
zsl*OsJU?^zzJ2Dmy{4|y!<A--Gzx$$fWWtICDC$byp{=Mh@rse5!HnCIwtoB52`S-
z9)H$_{$0zQ%Ye1fa;@s@m~=66U7>0=B<H>r4g1%}Hd%WQj(chpP&r=BkJTTOZInsC
zCTV{|0!IR-FSoR;mRyY@24R(ZcgLTS_&jE<cOSaG&z$(H0p`7E=0Rk7N^9TnED61A
z+#tt_<Z46*Fh-(=4{cPh{9Gt*lbX!Gl=Cf<A2K@$QKFw&Ei{ons%eQi4}H8FL$K}$
zznAS}RVI;#cZWLZ)Lrv6;C2`W_NOD$(O*155dh3xt<M_p^f&x6`tymb#isS?M>^KU
z`@jEe_~rj(tsnOO2ay_>-xr3c58nt++0f3oxll9qb573eLt~<jg{V+;vzmBmR;Hrm
z*txQ<k#M_Q!D@W7%I=u1ZQ)P2O0$@9si`;O;GuNVZPVMs+VXGOVSTMbA-JopT{`Tp
zyli2el&QIuWYPThh6QO3UCl>V;T^rd^9EfNXb5YbqhEoylr=of6%O}vVi48ur{1{1
zuJ}CJE#GgJWux!F-#!XHn6y0gFO`j)YFmh#BUF~&Qd_Y6PXDrI=bY~AoQ-jzeZ-6?
z8|Q^LP41|>H}TALqnQxWvcICtyZfDTZ7AYgCb-+-*a_1;@rnm?kp)p6!-dN1u*ss4
zrM64i7h@EInv;)pn;|}4S-n3t7ST-z;q7(ZQ7L|EQi7x&8?4B_v8Dhz-tHHkoKC+t
z_L-ckd*V;7azJt&r+KJdDx-pI&+AF*Vz_VLGka=(!|wQTQSHH3Ls(Fh#}tg%GH<n`
zK&jV8(fK+vr>Jbr#%GE_RC$Xl%k6Q;E6zJHvhp28mtqa)Z)B)WzTclW*|qxG`lhcv
z%qjef9{cb*GDi1IFX_<^zQoF5m13dN{0EPd!{Nkm&JNGnwV1o)YA0q=;a!bUp@oew
zu$}MhA0yHz>v<03hX(24CLFxB)mWvsiJ85}a>11%QqYH8sb~ftTn5ff^MHrYML^lF
zbKci(;_brJ3zk{CJ9pDg6fCz4DFm{TOw00n?3%-rl$5i*u5{fmII2p5iK?US4Kf%p
zhlkE=)t(;Mvb@yQcM);jMmD3a<@v(!O4Gi<iXh5}Na!~BzGfRse#LrLrH@2r6xU6C
zT{508Zx_fkr4Z!br5dl+yw}^9;D>nR5j%6#IU}osDr0!-eNBD5FE1LD{Vs*Z!eS3k
zQr~H-eT^?2J@%85%BSGoLLhR}c>Ey{RdP@{%)fh}%kW%0_P|`t^nyN^^icf+(0d{M
z+2|SmGtjh&641&E=yu`Jy9<ag6cLv1(@v>XyIhPDE1v4~5Wt2`Fwl1h`PR>7f9Wx8
zX4xFQL-j}}R71in$m?Kl%J(DBE3$(ccfawOer2w1p-8+-94UemV)f3K;Yak@pIpd8
zcCc&y{*r*fGWV$-6@75(DV{C`tkvJza?o%pSkM^E!F0IjR<X;DCSsCT`fJOvt<kru
z=53^6dGn09_gMK;K{gNcGWxYQ839RE=XFArdw8~kirBmw#5k01Lmd9$H@F^TqHu>@
zXCJC-!?4aB*3ws?droCFo7HyD*R>DKgWH{nEg^XQcRFX^my6C8s1o@f_U&K|q$8^^
zDi7vx{*-&;c8Q&NR~#gFBT>3`7RhQ=e|3a9?Hv>J-{!48pV^zLrqi^i`P&UBRzh*K
z1UnqET$*!!nUC~LNBQN2T-D)`d!$z5vHFPoSB2L07E7s&+H&P&a;;N`Ti+X(&{zk*
z_n_XKHkGL0mOT`kJr{VdHOoH6N?)1X7^v&4O&W7OC4=#QCLGr_oQ(Kp$}mKhpcemr
z@vw5T&zg4ucKZYE{AomLq@1p|M~*3SzmM0~gwc=%Z2wZ-q?~3{_<C?3W`uTE?2p5j
zTj>*EHj;^N^&?SX)0T!dV_!?NS`J4!CtmB%cJklY2oGyXY@T4KI-v%4T<nV{m~MP&
z5e06Hj8ByHCe!J4{Z>ZauY?a8E~Kt5#MTrCC%K4pA;GqcFM$lGS##67%cPKNLiA;a
z{BT>$x@Vpy_)et}LcI8JzUJiucG1476+yCg#q-{@As&5x0c?xDUcTO?WV>?wv9|Da
zz1Ma?eMs#eGF|`DU;f>fi|l_%GM)yI90F{p<XVT*l<?WvzeMYt-L!Y}Xd0pG?sIr3
z$r5jaeURaz)9$FBgCGbe#m38zSCa<zarP<Clvt5H7=l+~uTk1Ymk|OjHJK*3Kb1iC
zt2OJX0`-+l2rqPS4hn*sgpwi7;K>;j9uG1<WUb#|f9&xKt1}B#uO0shTl@gj;mj9?
zQt*MYsGD_JVe$rk${+rU?NUNImx|G06XbJ&$nC~e*0C6C;|jAw6l_HkBf;mdSfpiE
znNQH65%~1Ujixtt9;EiX{$_hv(zpC?)|YPU2R}QTYTTA-J70ccls2wKJQ=I$aUJWl
zlyg)7(vdh(9f8_ghoIX_IbGhokj2+~N)}I<aa3L%Ir)+m-T4CR6MIksGDbXh(Lp~L
z!ua`da;!NI;NjOHPAHdBmy~C6LFLC8eM*Xd*N9gEQMQzjp5(&&qPkI+x5xU*Y1)H_
z4bs*3z(S0|V)77e^#>C=R@gL=zr(I|LL)jM=lQsaA;``-PB`{<|K#Mi#h6Rk=nWXG
zg+l1t8BT7wzE<JTk*;yqo0T*?`O&`6H(hbt6j`IUsp&%`GG4n?X2DGZ=e*o+5}QW;
z(0o00Rh)PtkR^gOm0VWGWD}^^ThoS?|A-B8&gG#WPCWXNbfx^O$51qoA@o=Vb$07r
z%+r5LRrVc3|GogFf&K*2{NQr*=okL!W-~V&xzB*~O5$6)&VBF<HG@Z@J7A0ekVXj)
z>@Cyiy&IvW^Mink>iqo0@BF%@I@asHFA)Y0YU&WnpIgv3gC;Iq46}peEDW24&*EI#
zSCNx4HZ^J#ofFUCgtwW8t%{<~nDY^>icZ2L11I+1RU*#gH1t%~V7kY3hJUx6BzmL@
z1ql?jF{4^^p?g-o#SO9gTc_l19<-W{R`^|VF(^a&M&M;>va<$tcJB!y&9LuwvibSf
z%WW{-)`I4_?qgYpUd8Naw7cfaM3&4_IZXu!<-`v+7x=;*7ymR#T=m}1d0<X!lT`_7
zTw8LH2_OUofYmYRX=5Kh=U;R8K9olMq3eq+QO)*?E0x^KEz7~X={cFIU{1pD&~T5;
zInUQ`ZE-YJAA^jp3f+p<DId$PS*uNF_dIy36S=BVPTm;1<PG}Re2GJA{i^a?W>Ri=
zGZqtA$?X}xP;hrH7njptcQ1s}4x^k4sR_93>GO8-avyPa)FF;|D2K5YJwjHs_q+e~
zSwzVs9*5v&WV&HCl2VqX=DJrk=PEIQ<)e6QVTzXSHBq#IlURsx8tS!*_xj3uOz!u0
za<eI@Hji(z+LhJ9&2<f|<5-?jj^Ui^JlTC|w8es7W_0bgW1FJNu7=eZlR4d%4XVn|
z+WSoMBa)10J-1XCPNYUzH|tnSC8PA4WbuRJXWI9NthH{V3>~9X_>*!8BZwDGhhL*-
zgmriYHDgzbZuTHfT362?=H$3OMH2ou4}?D(_A{VQP&i3~&f)2vgIl*fZ9c)mU3It~
zzM*gRXL!3-VTt~O2Y>aXiJ~So3~$3jC;XS!TMCx#EHpO099C&=em?NKSrTxR46(`8
zdDUgx_9mHW1r-&ZrmXe3lJy0|@-sDt`0IvBOHHon#!7=|IdERE+<+uO7;b@Gjg2i&
z+>`H4=jYK$!7ouuu;^)?{PlAxJny(J+lH1Y&(kD+xKqY8TVsKjVRojITWI5m53Nu`
z?xyele}Y*+;7{xLt52Fwq+s$DysXV|!X2e=JN_?K@IU1(=LHPWuUxm7owm|&)xJ>G
zDO5FgMrM(pzOt^GfJdrkJ+tf_pE*P&Tyt0`65bt#aQQkaPmjMpZ+Qrfx_TcySABcQ
zn`jiXUhCdJ@TJ6SZLv2zNU7kyV_Zj==pg72cKUMSt@#SWf`R3S4!+lfZXWi2q&u?@
zFMI6zpI#zu4tFq+Ubf{T3Hn6K>6!r_pOX9$NV6hbyVQ99Vobbk5p%M-JaBq>TQkH!
zGNshmRHZ`dp9?-WtmQrH?b!Wp*2e0S*b8W05uQN4)vU|%>CV>2MrSSTyn3_GS&?)n
zIi0cxIT@dcc%F7q?Ow5Tmu@l9Is2@1K{x#B3O2ViM?P-M6B1IIFBUaSK0x;P@SF9G
zrCUEf?yx>`;SaS73Q2|OR>&zsnUim0^Dkehvxw3ZMN32Z`64aV$tZl{ag{X$-iA;;
z822rAhdIvm{AD#gKP$VTxh!6`fiE3DS7q&3O9}9NG7`w~kBS6s!=jdlY*h8nd8_D$
zTgy|!QZqkd0Y`u9SEZB_ogvSR0>_K>t$cGC{ODw2Ab}O$kgVml@c!=hPlm@^6~j#y
zxVt%n7HVcz<_^*3c|()>??a}2c7ac?-~!^cIisgm6bG4uciyBTohC-2Mh8zpjb~k9
ze#z9i6_?$b5kErOKsTU{F)h$<1nrqWC8&zw4W7GO<a03;^iS8G4^q-wxaWt$pQZej
z4M^QuLztG8@r};H4A;cG(3Cvp2aB2CNRQRiRDhQiSpf=M^NTZF+)>`lH(vgU<=K|i
z<yF^?W8Ys~)hs`LbE4-4(t<&7^QS<eA1B_frk6VO%uMk?12;D%8k<1TZ?51kwQe%E
zB=4mW#D=g{O#k}b<=3`Pl{uwhbDsKw#HZi9wF7|mB0iY{P=!c4?zD&KA?4n}X==ES
zAkv4?Js$tQ09<dt`e>__*iuod9OgOLFnQh@z)X#xMy~ZR0}Yxx(gyW!{8mqhjmuO|
zyl;G4P`A=9MAZ!iv=7(zMeeqhz`y=|tmIzD;z<q~>*yMqu3hXT6SnyFTC)-@mYRMg
zuUzCAauafqZBsp0aR1U_ukzoG-Iv#&mxg$g7yJ?_$74`ag)Y67j^w<9(GDsd0bhE@
zmp5>`i&-Q%C`g1D=GMGFcyO_5YUIrFF{?E#r6972oNn_*-hTTcKD#p&ujme&AlxH9
z7&=`wd9olmZhb(&!J7GZ?zGZyYJE4g)1!(ltHAfqi!BQu%)hYAe%^Oe5_sRMXU-<+
zWKc9+1Kb6a%Z1syH?g$z3(Q(ZYu1?Gj#OV%n%^1;&R#p30j$Ud>xuKQg*q3to{oJp
z`dOxmc*FC>EBmVEzUWS3Xr~_};%4&(;AJ-si2@^Q#)g;v#Tc0nW}(>H<O+E83UQ8s
zYfn8%O#ZOvsz|>3=gd;n4)a1QV{Atf*j_BsV+~vqRK><W>UWlEWvzy($0z==RbK!&
z+{$|jr(f^Q%CQW;m{Gh-2(%IU_mP_)n$%3jzoJq8VUB-!#W^Yt|Ninf7@7KB%jHn}
zkr93LeGDX+QVOZ)({2{<oe@dWG`oPZD;P@JHJw55l^I+|*4L;dEYMx>;c9=dfp2%B
z4baPtx@_;eyxSz<NY*FO3)RsV7Kep(#eqvv+cW5}){1kt*{5R8Pv!JZ&?P_g;rBW9
zoS($z7ZvchA6h^2qtECI!w8Dg&@S-5=+;Gle^hviOUl(3iJ;(TBYMbNBqh)8gy?*#
zIppGiNFeZVpTD#jxX_w=aQ|Q&NrdFI`VH?l@t)OJBz?APGdzjAe<j^8y7F&0N10~T
zcMPnu``x&xI@fUY?o^vomXhu*fBv^;Ct2?lynp+?)9R7cx1EMz?8vOQu1|U?Tu;@m
zeEevXvT>D~M7tJnF)m#Dlyxyq+C&e0p)FZ+H{;i^CEnbmDe~kebA|ZDpL4tsj)j5t
z!RBR3HEZstboA@?WECbcyn|%%KO&n)s-Z*rTa9gwoWN17-x>a9<x7I>PqK`u$(LqZ
z`5Ke~{;<yz;_X<^KU-wf^)Fdl@4iqK6jb2C%|?5hDQWsW8d;4YcLbjE;MF5_S{)b;
z`&D+wZ@A}be;K`Y@4f?C;X=*r2EC2z5j$=q?oSE~L6ciObSyS?XD>(J5>2hu)~Kw<
zL-^0HtX57n;4dZBV-llVfx?SApztE%JmuRziOEd~paF>bb3t^|5rr&zY;o;Xm*eXD
zfU4Pz7Zx)XnAInh`0#YS9Csi`4)YXq5q^e3`kAr5q755zhRwXk(XIc07-kZN-8y%g
z&g}>1`y7mpT9xuv7`RF)7pMk5Uh>mFO)#R^MqLQZRZWDx1z8DaMp_XghiHqJ`#Vkh
zaor05jXuX`@&=zPQJ~R4#KY*6{f+y>r8#%G`AU;8Bde%1A0A20qp!rO`Gv(_qKYYN
z`KuJKYSPu*n=eBofQuYk<t~7~s79!M@4seH1lL!`q&PUKwrPZtod$`+lymq>OvmYs
ztKfavZtvBLCO;P3+`gy#?lc$NNU4qM5yp+=GjHK5Ecx9rtIF(8uILN21U(9(HXdE$
zsG{cRv-*kjxWgc?M^gSa`#1Zv{5Zc=!^!w5&Z#_|u#iu0)Uu@Gt9qg=s2vq*bG3CF
z&+jk3rF!+%T=suxhA-py*_83)a+2@aH_9>8rYM14*&~aB@a*HZ6MD@3bzNt+2RJ&s
z2bsoZPkSx*c7;rVIrLN5B3Qopg0tRrago*q@F%=c#pk2(+@iCR0_D&_lgQf_zUJ_u
zD_z@=^D5}tc1kI#ZN(ic*x|Ic7l>~P$p9wJ*|s76euzCyqST&|ko$xC&&o_$?F2X&
zU7{@!kNSOk+vP7S%?Q6LUM*}dxllaVnAO*0uXObE3AJH{#;4=9X8V&2g3$AjgFc!+
zWRaafckxRpZFlr0FP=Dx{F+*ny&FcJNw@;!?|iZO_Z`d}{}oFjj;#JQ47q7i`rJV!
ze8vct`Fd?bK0XfMM)PDw+O+iSu{r@zplel7avR&m0nY3Rxe~pms?%<SsYC_!zu7JN
z69AV)%-LdE2<My(#K<k#{Q9T}(3%ZX{z*?7<_(V+6AM!t=NbKkz7ULctQ^vl1R^N$
z5yxaDhBsrH4MLCyrwp8n*`4ZDOCcQP-!Q+u=&Ah^WNa5(9uAL<j7swGMjsDqIB8QQ
zASN+lDd1{nj40UWPcw9GUv1P#*yu?>mb9!USh;O54V=na^{2VT@8u1gV@>ER-ME+v
zulh`T&jFhlD*o0v?Sp>SQ)lR8GoM%#ufQ&Fj+ISo`o&hDvbsJNt}wc?@oh1+xdj<6
zZsZDs4}RKN<rx@fL@MkeQ|+#thFxSMvaR0O`h=gtC3ym(+D;V4b=9^M`y(3zuX|zm
z#(!{X>23UFhV}*T*Mv(03m0myS-@uYraKa@?G8yCp;lW31|YHW#%Cq`R;%E@dYUDn
zHNvsT+FEC#VoXX@d0?t?1#gaFyZzK}sex|?CXH<uljr!4bnkeZ{YX-DEpAR8xOY>K
z{UhZ^^l!TN0Id%0azBI5#e+6AFtI-6e>Hst^7o>E>^3b+rLRDb(SP$6Q-3J|IY4uJ
zT)#uGZEKEuyEZd-hkK&xe(dD!GB+Il`f@LaJua`?BbGuip5)nr|2$_D@C@ak_KZ6d
zUs;%bJ9BcBUeZneDewJL+n6(9Bk=}RB3<NH+8k!VTqz6aO2cq1_Wt^8OG)TLv5rhB
zNJOp$zoi-%653>QR&%1|SHH6cDNv1#u^k3R`1ZbP2_Wvbj$Eki2}Q2aUY=hOd-GR4
z8tL-c@792QtC~>yZryOrHB=BJAf^mt91OdkZ~g}#zi|X<W92+KI3+h(z1nd|6Gt=m
z*Nn>CNW8bXed%5^tB}4&BKPvGsQGbu70SOQz!`H;CAHE<#aI$01=cE5`ORJTl&a1z
z4sC`*s!}1G*i|`3tXa9isKxeZ?Y>!4wL`D0DUxqGXZ+bzT0t5Ht({%82B8ENpw7ko
z<PlFav~r0pe_f89htOK5l2TsSPaE}<0768Xz^NDI&Db~bI#P~HuKW3QowU&yK25BJ
ziO&7yy&!Ag|E?I<F=#WpajVf6Co@-zD(M2hOk90_(b4u;XVp#dyio)ukmbRgT)+HF
z=2+U~kReIe`%KceER$8hfkU+4%-r!Y4L`lTY6XVObh9m7sPRQD^C!JZM<m=sRX#xJ
z`-^04Y_1DBSyRhZ{kJ58V02o@=NHm@n+AE8RCT-`>~8YaNi47glIib-uRL0v`Pm@C
z`u|Ffe)yk|@_j=QW#%swktcy;N6qEtmj;Ez)xbVwR^#jr6RD=Rnr5feyaxn`^1oiJ
z5vtV!*VRgULD}GV*wx(}yUe&akdLa`6ZTU=cWcIYiPux*a~^aYhmHr%5=%BD8~w;s
z@}<H`iM(iVV{|HQo?#6nZh+T1P@{f%wsqH)V~>h3Ble;I4x#V6A_(jIG0=H>E=W)7
z{*~(X<`=<uypH*y)QoFZg>&2y%C*$M0-5Q-(;DJ{mm`&}CoK`N5=w2gO#Jskj-jOb
zt*2@CE5%DQTQaunh<GJ`$lWElNa5`flQ+NL`BmpjN$ty0=OTNblDONB=K|{Q>7KS<
zD>)bow)E3C|2(#J*COfH>jMr&x=-A97ds(6cD%Vax8ZamEygn=v5U@N_b@Pe=ngo8
zOea#=0@8JZAU?N_P2E6^G9V#XDhG8^_ca;5ot{h8&2^6>M2bd?-eH(b9#2D7caG4`
z)V%YW-0?v_Clqg{Xi3BJW0qRyJ>s!^SB-1XRk&V^c%qe<B`Igvc{F4#EnQy?RY#&-
z*AH{t9dxT9rCT{7Ge**A7{*0zVUQaknd|44Pggruv~>-@8EAHaWGSX)MJqoQc{laO
z?AI@^ZtBvx32gpwWYU!T=*Dzj4^qSFj(d;88sRRHUZefXq1CV=U3Xjfy#{ry0$n<2
zKA<9DXQ#&D6(MCkUCMa<lH%eA`s$YKfTNpZxZS(4ap}x~TXwZ>y(^2SAnM%-!f!Uh
zGQAGMahrfFbih-8VUF(bMzTKWgsC~Qn}X!Uu_ui8;GI*E>VBy=QMrci#f!Ef84xyp
zU0k<u^MO*RpMGiASfxDjw5!BfhKDUv>=@7@iB5ze5vJK+){Ktp2UAnne!6j*?_YIr
zZ;Y@K4OgaO#1BHlGUga-FSxluN7oD)l*Q(mwqxwxS~ihT9k`fIgDcrXeZ#M%7PH$1
z=uckbCw63WsKL?5YQ4@l7hK1!lB8&x@n(-2Mi=VvYb%KkbpT$^_SkB@7A}LDkLRX3
z3#?wV%iwj?8Y9;un)R#O%EI7f-k#Fpdzd}z?~?p5D!Rkphg&$;-3j=cgfpxwB3&A7
zWgrEcGJ0sY+WYL$jfpbdHL%*~x@gdrmkklOxr?6m-Xylld6H(quJcRP0$fngOo%e{
zrmEt8K92h0od%j09m)Rq+C{2ijq`4#mmkWXfhw_Aj52wm#V_3WgtaVJbK=N5D2kNr
zd-@2T4Ol=Ql^ze`-uv!h4n}S4>IO@?c5SDE4f1;B2&D715-B{RI%tW%!iRE2^=dc@
zeq2DTwfoSS9gTJEJvVA5@7%g^P;Z^6Zlf!lzsRaD9l^3{*(43{(E4K}Z!%F&%CR6h
zv-nIV9y8a+Ha;BRZpN-kXK$k{%_qLkmL~IG!0UY0c)Y30{23LPweFfq(@O<;^n$mh
zj<H}dl5Is<xnl$`l1E1ud}oa95V||>JUhEG_Ea`$`Gfm?=xTlneS!Gh+MP-zEWgmy
zd${f2j82U7x5TxV1}2URK?_QiYOX6&b#+RItlPnEl=&C%L8t8K_RsK{it26xdi4Q`
zi`1|LOGH$Q5Mj1+w*(#{`Ocf@Hj$i%NPBDQ1)imrEu|Rsm?kUWu_!E!m(j|rU#pQ%
z*>_4;8>I!Kz~M+S1`RijeJ*<?SMzytm?{68q1)RIYQkyR?~P2EOxQ?yjN1w^6@r0C
zI$haA8q(M+*t#jIg@ns-(W=41BzP+#S|sN7zErm+)Oc~4ctWP8j%Z>I67R<Q+GARQ
zt6BIXDuy@5d-S5iq?Yt{uJAkSv*a9a+>49^UTB$G?5#zy5=bU%*@r=bP*SZ;fvyYU
z5<eUKPQy&MQZmjp!&hsHT7I9^MkO}jYeW$AavHa>mez!mu-meGD&Df{*ejGUNB-*m
zDQmKbQgu=!%<E8CKCZhJJsZo*#PNvPUa7NGJ9s0u%2?DFvC`x0wjqq+*^|ZYx>yxg
z-YQhUAv4O#Gh~xY^|AF=SeaOXjC$e#{wA-T+paP47PR;POI$vSfmA9(6yZ!SzIkfZ
ztfRoHs4sCr8m&o5kc4!y-(Z$jHQHSi0z=@QWVfI>hO8oMhor_(0Oh<<GXeWfRfeHr
z{pY??LY2_jw|y-ldb(G^f*0J#y43cO5$+%1)C48-OP@x2@JN4>__c;PIMll94%~wB
z#jBzrt5yU2H<?Qc+Kvoc{}R<>h~<fwSX94k4w|{EM_kRZQWEEZeATN?qS@_KC9Rj3
zd7Stndd&HPa=YUaY9o`~KuggL9VInn7B>_yfj59vo`6jF3t<Z)IqXrNAl0Hz)JS(t
zohyx=cM~R1&&R{nl{c{M#9?bC@f)17|JXLrm`TXS??5ulF_$`RmpLH2!4We>)Thjn
zNf4g#UjGSYf1My(P}bCmjxvpo&J<y4BBqDyGlXeWnr>~O%W8gjM^P8{ei5<l4|A?j
zjl`DxmlV)j5KU6>X@LI{7U~o}RU48q=MQol)tB)0B;aE)Ykh|^M2&b$$&@7QyvTft
zhNmeSfkoYn+R)GuQ|RS0N0XL)&m{mVq$zH0=9N65T{BGB-DIg)FH#gX5POiOYiVB5
z>ySc_=6rkmz9^+|RngG4DWs~WOjuB=@x2oYt(uQfNZ+S#;Qgaq0tD@50ApSbUyP_@
zw-OcSbu}lq6Y$|qq%!dS7SC{XT_5_z%Cp@vE=Ay4QMYZkxK-U+!x(BaD#uI>YczIk
zUM*Luu43`R#d>0AV{!V1`eQWn7vxRLwyyo*lVEDH-nrVPMh%<83upAOMk4QyB`K-b
z7Kvaf>NQUIR0Q{XolOQqz#r#Uc^#QGHroTqT7vpERK0UcS`p(Q0pX;%H50a@(rA)K
zLU5Qt9#7zDOV^Jl$MBXC%+{7f1k9!I`M8Z6QPP>zQSL21cK|f)6pfjA!fw|9tI$Q|
zux#Gw5OgjlJA(&71oKl5r^c+M>c#t0=9jo>hEXF{P=%`yl;BI%x+ciI=Oje8o5^-p
zs@6c0u=1lkQfp5V1Qm{<)$6H`hMctxpLHf?;)SuN4}>Wfgs>9J)?QKJA)?{J7R@;z
zAQLJam+FRL*w@3)+B7ZO`CkfU46EC)SWa8q1tP|}1Aha=G=pwGTj3}QswcmOi=RQC
zN=7Vk^K?8&xQ5dI5=wubDYR~d8B0jn&b>)#V4;umPL~G({B9eU^IpHt8q=1bJ$Om`
zI2>!Btxz-821h8K*dva{=+>?<v9WTGJ$-!5!yL%>SL_VJwa`oPjoq#))>e)Xcrc%Q
zIHe1ZUK!+eG058V^-xT?G1Wp>9HJqA_iHh{M|Z&nU&HhY@8h|>#f%@UOU!CP8^&OG
zS+Gpp2xxNdmb)#vN5oSwmz;s@;F!4uyOGw}X5C4kAP5=JAyR|%Vu?9_h(djDC1eHo
z713W=IcY)fXu<timzqBWrCOuD$}Im|_y>M@UQTMlQg9_D&4Sk{^5Qof=3J!+A9ST^
zP7(g@VyhHdCZr@n<u^i81MaoZ&2%Xo4*6v5R6R7FAp?$uUf$?^VEXR4Y|1ikE?qOw
zvTdMOAQpM~>yX^<d4B40l-mdiNX*8!f$tw?SSV4ge!-K#qH1&7FHN-q$;ee2WeN!W
zu%_@|1q>*74azX5iRu^42ouqcF8ms93<aCU*jBNGyy_T8j}z^tRG{_WbDD+ru)(WJ
z&Fwgi*NM-UaV?VRhNy0iJ;$LsRW2!4^K1KO{IGazn!AhF3%dLM?}(fZ32ro{P$UeQ
z!+%)oe{EDsSL>d}j{=`{^pa`MP&G?VvI-Waa$8mc^KQ`RY&H}Y3JIeZD-XCTKpJt>
z-I^v-%9%2l=`Qi9<(uJ>x#cMXNZ@g_4%Nkexnf$+a+rhUSki=-B>Wptk7!CdbxByc
zB=WiW2`eCrHUb|>^^m;@P{D^$`;B6C;Y;3y`U^U+OA(O-y}$j}W5)B%Rgg2HkkJGU
z$As!gPk-N*5W1uWUI)h9H3)5KPOTbPbKy@|5wn29Nn<hJIgmKeVt3_dR$1dA8LVn8
zOV{5fM0z3Ifi#Y<$yh>A*37VR(1;fIulhXL;zjWV;?|dZBRw5=+wWHJ0UdnR`O!iB
zA6!(6ZLY*WuyfH&T=Fqw`xf$U1DjICrA8%T@e9<V0;Aw-NTs9d@7QG(?1tHjycF}}
zIP0;;%D#{XQk$bM<qD1N)8J{D#`(BvjA9wHOR@aRd~VML^CM2vi6)~VePQf9gsSrr
z`99WgS7UbqRuaMW!CC2Ct_4#;%MA(m7&5;e@Swx@*lw83hp<}pr}p!Z0?|l1TNk?$
z!OfXCWlc{2EiI_=H4(4mX~<>VkZv6KK4q<CSGPv34&>=+MlGMLw4P_!O~8tp#-vuq
z-C!Bmz`hN3J2<qf$x@-7iOYbAS=BvK3rF0xdUG#;kyHBYAtlnulsKsLb4sAgiXFd&
z#j&Iq7|7X+zX&B5+KlDzu>wb<sDK+Qm7mnAq7y-;&|i=6qDYVgs<OlpI<n)OPeS&B
z6~1zz#m+^~>y0EGmqo>jzi{X5-BJ>hG#Kz};frb^S&#*fa>lzLe$!Io6L6Sx8UeGh
zz)cgk!6HR1XN4?qxHo@1vQ8HKep&Qg#LL1lxS<}~bA*=Jsqr9GdmJ0tfzm<?HDxkw
z4!(|uDqe+zvc8N8kkbItaYW7TY?{x&?eC3pZe`%wxhQpu!}A(gHY{8;L9U0;*NSD6
z?yrZ>P**%A#2=|m6M^Zl<^;KRs&*%ZM;Ptl;lYr?m4@MN!WypeUxe1$3ePX7oOBD2
zZ-7p#DY;Ux^{i)5&PEcq0<))b;!$b0Sz(p$BHww*hI26(d>aCOf&SE!9V%KcMQipg
z5nhtM37)z8RQ>+T8a@fM$bZ?5bG^m53SVcRU|T>aYG|%=of91t3M@Zds#A?Ph@F+>
zZ%t!>^yB3h=xjE=cD0`Ueu#xtr)F_O`HKmhYgjkg{@PW9V+N0mlB~bFSsx1$*^$IO
z#O&e1@Bq>{3{OWU*6~J?M)~z-Q5uPoa^Bm+8FJz;SJ)Fh4gS{b#B}ykhQyjbi7uwD
z%tNM}3jA+G1R4dGkhE^{G}&@h{ta1YqdP_$I!5nj6A+k~gx$0=(CY*0DuKsU{x@T;
zPT3ZaCHmOWNuLkbAxr9_deT(zR_s5-r&td_a-z>{wy>11d9Dw|5w*qQvZe4%yy3Re
zSH6?2*IZHlLkSvEhp7_aFPTy@oNEbg?=++wSJo>TYw?Xeu{`6L)FBEOBF$lQdmG5`
z@i2jnIGhSfkv8VTIp?xo+jd86L-uU26pwrl=@A=k%%rnBW7^B09B+0Q6|6fycpYC6
z<Wjv!dZDo}+UgoKP*KS!8SB#V`k7RR;hT<O3U9KCF~M6jAy2Wuf;RZ*;6|XY^Tfb&
zZf_bVt1-2OZjpG9{SM78vFK17w;UBW?PoU|L$h8|jnR{9ZE-^8hC9x~)Hp#YK|<ki
z(d?Qa=?pY73gt>;&Z5in3iEeKCeXgc*spY`!&n&??U)>=Zs@0J{6N?X@A6jZZs!@r
z_#;)f`R>CCY;0gHR+&=EQ);_TD~cC1**+nP9SIeN&5TquyRp#dO$U|PUB-F`U+>~%
zY0$&q>kn&0RvQ=7aCF{P{_OzS>gSZ#!qg5M4P#B<cver++;|<^N5(ADVX9;0J7nri
zen;Wwk06;fsP9qEo1?-0o<~@cgNGF7zbp8|Na!J^FSx3Zn?`L81R(E=Qaj=rC_YIB
zLBSY(3u#?dK(q4}a*(ss`?Ekga(Xo>d-JDJ{-SP2nNrGy`X#?PU|@1y`sKX@sMtDY
znHVrXV+sBecWYS+o1XyoWI_aJtRHroI_Ru261(+)SKiiL0;7SX;v8DdyO*K1tiYbN
ztYK!DFV*U9(2O~yq$dRnv`wn$@DP5+O;~1mECo4HTZyP@OUCkH>=JEx_7SQegxrh9
zH=-0*!p`bJTqm}H+M1&DdNAL2yNbQDvGNJQiV0(|m(ezkfyNd1bKQhsPdR}KR<qw;
zoU>7Dk5OLM+%GZs;OxRLD|mf$?d8@3f4fFpK`VZz4jceKaxm1&n=2h9@b%`H3RLcg
zMlUHn@ZvVG7WL=TN_p)70%AQ+LJIp6xY-m^j(@IAYmN=vHM(#%o|NgI<6NCU0CbA5
zr|OCoFQcky3G)Wh^wulDoq*hTP~=$s?au~lh2seUt7n<B;bH_XatY)KOL<_k^ZJK^
zooBzV+<`S@%?OESsg;@A6e>dJr-!V=KociG_d#_|ph*+Z<Tj}XKmE7S|9+dh=JuxQ
znpVN>$y&9lg%%9o^_Z^nCz;tueo?3V4|6Olzfp&|@o;OY+Ib!K9-UdTY*Kj7JiD!*
zUC@J!w}wH3^-A3}X=iE%tZHUP6Xo@u*y=s$neFw@wH1<YQSt;0`!=si(yhYoQZ>!$
z@7CfxLG?-{3~%AujA-ND=-B(2BlJ)9Nv=kV5gy66sFa0(^P`R53-&Ku+p@FFev76K
zd(72KilDhI@CL&)>UYshBY30km^$;<=$0+gV?X`(@dy527_(X%$zh-*6?_ikhbOC2
zIDWLSAk}9sz78=Cslip~+#k@`dHqiC52@**yRG77uIKrZ43n-e9a5;zQi1;$=_^8P
zy8TSeEMHOBq>XrzU|hvEFRU)XuRn#Y_bZYMEEH)^u>WIr#$wVNb)<@-HFG~!<&Z|<
zNFY|<s#!W?uVc2f4SWDP+Z<_hp#5!V=Q+iuf{~VU{^P;K%K1=zw_(|kJOSXh5f<`J
z%r*tjUVV)PC}*)Iye}!ZSFSNlp)pNaw>Ht_HVOqirVl7Mh(oMZ#NN(_4&#WTmFlMq
z1iw8*VFGbZV$k#@RLRe;w+M3J!{_fm^o|DLwpKFj)AelJ+{;EX2NYWey2is-hdwfK
zNozF~J%k72oi;+-)8~65!RscVr(vuB*R-F0(j;HIe97)}RLbNwdaDd4bM8Udj1=OU
z>&=9xVb>FaOVl?;DqY0O<s=BoTM26dK1&M;w1O~m5sHqk!?3fbsh#x+HzO(*5tT~w
zLmG&*c|_U|sz6>0a)iE=5se0;=kWnw3~;;Fkx-#4m2ym~`X-NwekYit9Qg1@!ogd;
ztS=)2@1VXftZiGD+s+zvrs<iymRWx&Gx^_b{69^8dg71yHudF`Hp^O$so|Qevfsgg
z{W-3co@?yGtQ$9R?rxmKY3JDdaQa>Sr;9kiKg#($@XBiV2-RP{T~lX|;lp(Ip1||9
ze_2wYiBzAlUE~MtKKh@x$p72%cSnR?5822hgfE&hFPzL3>HlLTl~Kq_8fF1;F8jy7
zI%;zIkB9}eq9ST!t!&aqZxw@#_x(x!_%*%ZR%-}9uKkAav&<D%wNaBv*V*S%^V1Q@
zEjh^(2ds%nJ<&L3X;VP?rfqDR$j8F7C589E^@(fl(3xD_`A@phCWg@_QdProE|4C|
z0Z$xQ*uiP2YN%3}^n-2B(O<W3rRb+-)8NEE=@V!;C9}@(!%zRQ9DX(IhVLyhWCsFJ
zuW`_;I}XG>b6^a2skG+^Y!go05vb3nTyhPAq!R*U6C4{oHex9r(>8QRUZ1F0b2{K~
zNJ2Axl}9TVH9X>L!f6r_(GU#WB^W~Im>0Td;R3{C*40&$>w2IkTW5QM=WI8fN1qzp
z?~$i|Io;{{OGBgkm-J9@v72kZFQ<LrfI>o_ht}b?aO4Pq9Z*5TZyY3jdy8R0_dZrH
z&X7UB_~N&oMw*lnkKyWBCWVvcg@^EYpCHSpHpiF9*+6^Lt-iSi0gqq#>}BN<qfhEf
zX+fwXNrUxEKCGo6m!UA1N7!>lAYeNhz&uUu^VqdI-`@F~z*{n@sWuk!X5_I`+iBUV
zXPGFiX=a9S?v4Kv=wtbpw_6X)6mBio^x95!*WZR$)zq;!Ov|T*G;}{vM?lLKe}OF4
zPs(-#9y<(-|4E68<n;GKhiLe;m%Az-?sA>{^M|YUZHxTOajEqRI@$HGxLz>huNGyT
z{nIahMmzzwn)U&^`G@y!!$`F`u`QxTLr?Z4T$eNwGbV*OlInd-X1*<w+1<hXYs4PB
zO_{QsN6IanV6Lq{OV@j`Ifj|1MatZln)68LOgHpT{OIljdAXFla95C5g3Pp@BJlLu
zB8$8I04hrwYB#T-MOY>Rxl7>ON|6rK7&X%}y>;{9R=WM28+a*QpnE=9KfJyB-MEg6
zOhhiU({glEsmHrG@;h1gs+gOz@yTS?Cg+ct7>o6Hq+0s?l&l_{;Y}wZM~vL)*L5Go
zu0Mf1**YFIMQblyainW>)Vu}*Z5NBH7kmUT7p?ql%dV<LK`7vsTQ%WqN)O+Li3cp6
zs<{BHCwDLffDG2mygV;!sw0^BHchFozM`)l(G1-$Avpk$arx%iGr$7-p_x?`vj?Wf
zhBA5#bcmh%hLS*CB17zUQ=qPT;~Z8mRyRzoP}}%5vw}sqIO*Z(Hny`67`bw@Pf1nC
zhQWV8cypmq#z;!gp`;6$PZ+dMf?07gg0i`Lw%sIWbB*WQ7(GX`WwYD$tn;QIQgfIZ
z+(Jd*K+w+XzaQ9yt=H*c4OxFJYK=ZOSiYMFIh$0WOIHLJ4uggwK-Gm@HNuTnuu#(|
z@)G9JuHttx8@H~2)}uKN<Ax)e>O&o@gW_=|@lqIA@4D+z+7aNg#B@X_H$|b&9#{Io
z9~L@c!ai%PzWTh8x*s#pG0>H6BcA45=`C+^M>Io(eahJO7D|Oc=f6zlUAz<^@U{=J
z4d+A#0~_9+AIB4R8GKv8frC<uCw9O5eqw{Aw9(vGBHUNC5_T(r7hzHP*kZ2kR9HMT
z%*`#e4-Nf^8oIrR+DZmHB~c9<4q7NV0-IzlFk`jwTH-e-0z$`^E`*$-xh6W@x2US`
z3J&O9dSG;$FS-nDOt*lEf)nHFQf(h@P1|Ih(-vI{)NEKo!o?+S@hHlZ6{-Sw?1OHq
zof&HA8QasJm6oPXlV7EdKa^Q7G6#+Qrry`iePmHtX0E=ZBw1oCgLHw30l-GTE{T-B
z@X2sE$B>5kKArkxVz(=USH>17Zr%}L^Nud`G#<t*%(kU1BAxo4&h;@U0N(vtJCp8T
zp5x!l%HPOmL3n`*oD<PC{{RyZnmVtmqcEKO_l@HQy6#T%MybKo^I@NoUtW&&=cdVE
zo1{Rm@Ll^{UY$Y@<={4#<8j@FgPYg-D{4CQg{kYasT%R$yntb}E6$PDtBu%$?awL%
zfE)P0mTKv!gzEBUS5C<DCg-z<Ls5WFQY>;A6F@4+sn`M3zV;{#wAJca>v|3GXV4<d
zP-qCS($DpOA1kUZkY7vQdf?Yh41d7%N-fSgt;0-dYzJtm#&(4T@KD!CzFO^U$KJFA
zVUx{@?B(TSN`|pA2Ao$N4O<$vILqQzc2O2z26UFpu9T!6CO+5&3`j7G^#WkYsD=Y!
zUKWZ&B}xrD=touHr)b6aRn4Er-UvAzq*p}x#C%O--gB&LE4l{f^{Oc2r(Z~UpT7bg
zgs1QQ**3q~f&5W_bdCFaMedRL4=gFnSd@!Li_D(=(19ki>Xq@zKKzYV;`~|xlezw>
zdbW_S4H11DMv-z1XQP2B9D|+!Gc5(9vZT;Kb+=`|bXcRO>G<#tM(`<`yJq~NAqDyi
zN+X4W*Y&3#WcJ?{Bi;ZEnKayTmkO-^>zin`k~tI2TH}s$LjeF_HnP2WrLK)U2UNX=
z@T*2?&@Hz~50#aV3!G@pum`_52ESDkHo%1aqXC<6ljPLATY9$4pti|C;m6WXS-nDs
zu>!meqk!odpgw8e+X>t0C0HuP&aNMy(*q-VY^;QHx9K?EzSsNW0WJ~pFVX_{)x6{B
zg!wydo5Bl?pbfx)|B(Jqmh#`exdYlHnt(~TXZ_R~IDG&hIq3}W<{BEbS@j_E|I{VP
z;&pM<A8hl#J*kwYjy7VnVZJB+#^v`5P^8nn8QWkzN5q(n_%!I19eUp!;IaveNvO-x
zc@|agEUH{w)u#X|Ya`A@==T#_qe4?>1FNZXOO;QYEA6Mu^O<$wE5|y@aI&@&m5tp?
zkohGX^SY~ndY-Ym9}NIM{~>C{oR4IZS~*x*bvwZw?EunR(n!rFC9j6%;a;wK7=!)`
z+yHaY2=&c%(+uy|G|MvXSX=U;IUq7+(53{xHYFz1w>b*cWR~^kMjGa?s_&@$Sww<}
zYy>VGYniP)zNx6qw*ykBSpOvV^SP0)1#5v8AZI+)M_kul3uE|DI}t($r0`>heL{5W
zeVm09_aDA-K@9(cVa1eYMyn>cr(l=DOhLWN8Yny0iUG&}YAL=(hveT!f+J;<CK|g#
zBgXmb+L!+!WEQ{7=#B<}dm{nHVq)A7<e2Mjh@OOUU&W;<ExIQPkIcTZVA4LZsy+CH
zc8>H|Fv5l|mztyBwoR-aOEF35LnE-EVY?8rA@R)$;@dDRu;L-Ysyt+SdMtE}z!Si#
zDSc?X?({}YSDZ^DreXIM6AIHh?eldRCI+~~cNP01Wvqm9WUBup@PUTe2@?SNQSw8g
z1OdVFt4{s+oNI?k_kQ`f?i{ZqX8#d2VX+qk1ccsf`(G?I;>M<Vl|yIvseQbBvd!!y
z&-(`@wx!$Yn$0PL7we7-i#8?Kt|?Dxf%TT1?|%3UcN((v+#5>1+W~&&3v2ZM@$NrZ
z@qodmKK}QGE76lzqbpL=E2gr3xS196>qAP(4c^KAyQCg5|APVpQ7up3K+mfx)ZJZG
zg+b_jDRZcAW~j+mf&c5?x5(d;mcsCflsIVx{Z!CWtcC>(U);F+3OQ=c7~Tj~HRN)a
z;PlrFYgS6YZ4H`VA%4A7zA!HV?iaMM5u}ND-qRCJv%&KF;WIPO7ee5nQU?a6b|!~}
zE9#1STMsSkf1nN6&B)fDHn<QqmpN3d*s8a^ZnY#ftP&)y^rre4ie6Yh5TBt~zS9t%
zK5%4ui_+p<1WKNNU47~|zzO>7;o_!{fcAe2P-0k<KCss~@}j~%r+5UKxjMtJqL<)G
zH4zOdlP#HVRJUMAK5p{}XqLng*2S>$Mr^2jFJLJZE@HMZ!%C@!y};e3Vf02kH7B$7
z{@{rL6L3L4?S|tcu;k(jOFI$lH%u89H{pft@sy7{P72$>H_WE8-{T3m2mD9^C12(G
z`l<NL`|~_HWnE+xUBh|sy>N3QyYY(~x>?L6V1)I%WOd&cduJpnfAD8p)_SLWt&qXC
z#U2iekqY~_zRjn=F@}UD)%{w+NN1NPq{Ly^9M^uq#Uz{cjM@Ej^c<z76D!qjVVC%c
zoa#HBXL}o5m^LA(K2yoqZxVQ4g6jmgESdhMF$Ukvyov?Dk$5na#RGvwM26(ilUH&<
z?mbH*(}v%<ucIM=d$-k~^Ac!r%YPFu{wq>eG(<?rC|OAAI3w}VU}7SO`!o`WTpljf
zS=y)M*KWqWALWJ(q{Xtak`}r*BS(&%4y!(13l!Npuw=1A<8m7a`Cd_q91s4wr)T{E
zCj@ULVRA-C<;;Ss3+hH~@9<O~G<auc;A*Cp;mw0DWp%AP2Fel*19YeLg6{n<DGVCi
z(ipfB6Gt#Md9u*jmqO;&qemJct14>e1GY0u=C(1G=&C59F9eBUsxot%!+)z`M4%2p
zha>_p@_b52gEt#5YC6U4OGwrp!7GG{VlmX(VF(y?-E|?@wMO!sw8Y{W$BA(glufvB
z<~etTfxR1U23o=Vm3$O*KL&%}Xgw+}^OB$#6_2Qf(UQyLM$}b&$E;=pn|99{g8t1~
zir_vt0U!zl^j2Jl2f8g+|5+2X6Ydfr0j<oaSU04fTZW!@w>>~e12I#+)y-QG8&CKt
z&Hte|Yl^?Q1t9fzqe!TCN~4dY`=k;4&g}KKUh70vOyMkonSw+kOz6+}AJjkXn*X$G
z-9@#iaMjzDahOp^gaIKT;`N^>L&B<YtoSP=8wL){fc8;BHuTwM(y1whq_J0UfB#@r
zi9DrG9!w&b^2qbf9R*Q%gH-ZLQx6-rVrd1bVm=?WrU*Bn8IqNu1h^`(T{sxah~mh7
z#PG>qczeh&uR7kMbDm6lGPx!KM$Z#8;*shH<td`#^kdPRroZnOb+ClXg)LVu_1f-S
zJNpzI3xw07vOMA|<=bv`r!DP1pdYh8x#^78-(8LK07+Vo_@4<N)v4R4siErVi6oh9
zDqVQB#W8cmY|Bo#WyA#UQ;3VG22RgYx6DqtE!65uVeDGWcK0l;26Pvfo$$n-9t<RW
z`rC7^GXr%J-LDs@4h!A;OYrT8M`ke2YdOf9wMmO38i6Bve;4Nro$)}|1ib=ClW}CE
z(t3o_Q>Yf86*WZ~{ZHlVCuvLO=W{X&*RT%+X>i_tYF4!pRvFDp+;1o{uBN5`^oyt6
z*mrbxmIalbpl%3-@Rt%&W8E-c#KNY9KxwR}(c*$B@C2q22qw2IV6s4l6)@?C%dSoh
zZO|*xR4-4jz7jFkl_?5f+FKme^_SNV^bPuco7v|xXisBWR?p7&Hxg>iWx{=5C0Biw
z0c49hO}nWy=dkO%*62X;d^}7+qtSwHAJRwIm_1CN?y;iZ2<cToNP(9$)rtno!#@*I
z!&ex==b&pey)NJ?KDSzNP7v{O(_hz9!G$M$RI9F^Xe*gf@B#eaO$nOuzJvSGG3{Z^
z|Lg49<DpLX|CW_KDYIQg%&2x#gi5(HWU;#<MIk1|y5$m+aUHju(qWJ+lhBZIk3^Uu
zm&9OXh-ut4#<+|OGj8Mld%k0L&z?PJ&+F{3XZ{%Tdd$rC`+T0y^ZvZw?~f9lw?a3i
zp6wr|uV#@NFA)kpe)VftD`~s~Y~&&wA8%AWobSlrUjC!-h;j9Zyvubd+J1PcBl4}p
zf{3j5=?`HE{$V2iFa6<7iMGwO;oJMD$LuuYi>^6z9xn1wox1v{>{gQVo$q8Hf2$p(
z>;Q<SKZR}ok$}3669Uzzzb92*WA14}>qGde4D63=z@HJ0zrLQ&s%?xvLRL|gqn~aS
z_iK$YT}!@eScs7j$ycrKY?>+_oCBnhTR~^`pe4X}Dao=RaxoYY#1)DN#!iuiMr+}W
z^I5ysCT{gtRC$+d@<t(DJ=Qg{xRn*HI0U~#J0xcXEnhxBc|n?-eMzmStY}qnmM$#<
z=wdejYr`zfhD=}bVbL~P%*csf2%!_8(gHrQE_~u%=v=x8vPu6KxQ*??@R{QT-@5FI
zt8y|$Jh>vhh*4^ZH!L8RDvDxb7zZ&~X1aisPTMKjQcs$>jv6#l>s+aGO^rSC=?whS
z7WjFduHwi!#iO@(l{XoQ^E%wz*%+6G9VW#EZB1vUe8E+&o}Dm6EdL}N6}wz)+B9Qu
z!XukHz9WzkEf5giBCuq?{26JEgeo-hkombtAG;V1`-wn_;78Zw^ZOh8u;tr_Bo+?{
zM$W&?Q7GWB8nc*0?V|DaXwy=wE1F$d1D-*_vNq$pDMwKr*><RGcmCm|Rdczo11<1#
z85c5iY2w9gh}oqG&)JDaKQ@U3pQ~kk(!)q>zkDkW)5k40lUX%GDN+!Wz`^cNs@)%c
z5v&+*7ht8vSoKwL(ey?BrSSGl5+Js=3+Gke$E*YF{vZy#9r1+DiOB$m4ed}ss$4{U
zhy-BtvfVq4(AMF&m?K89`^=k0R>X=Fx=Z2q<g<JT{;$0bnK+w5<wu6H3->7?dCJCV
zZ{r$x`U7}PVv3GVV_E|`^2yv8u~w6K<q#b^pKAbqK!`>B{XS}TVg6)({$wXFdy`~D
z#_TD}XR`f+Ciz!pb2neBx$IfWU4LWT5#y(OS@Uh)q$8jCF)U-=EKEmOD)OIkF)$L&
z{P>=E)bIJ$RZ30cAw3~N-^_Itc)P1g+F|Rtr+AG$u4c|NU%*IBLe;E3#bp&a*alB&
z!%z}e|HpYQ#%U90fdz`zIDR%UpWcg`w~B3@In&APM_y38;_KfjKM68`3@m}Zw}Gyu
zw?(HkHV)g2N4xgh_d9`67S!nRPeun~P@(PkGDuBknx{BjDLbt*y;3zjTTNY&E?N<6
zUDf<awP@3KR)!a@6p&v{`1X}&%dd@>r`hsg8#5OyvTw+Gj~q_&j<YIK^ibNDZrq&E
z9<Ia=)<a;72L7gzqX{_3(|hv<;ge<M2}QBSnsL$npw9Jd|6yP!+yb9rHost1E<GeF
z{1#R`B3hj@D;#>j?||Qz(z3+k2wn#Z`}dN1GVS@)^R1Ur_Gu6q`xVjxzgoN_)E#8v
z6LuCa_i8%ry?He*LU}5rta72yZF;n>6-RssV4Qe>tGrUzT2G^qS}YShJXmTvjLs|k
zXW+6M;&xYrAGBd?tC<n4@$r)?5Ui<poJL`6K6Bs&)8>8AW};ZXLhJzasiJ}E;Hk?~
zGWmsgMx2e%y^s1^mb?61I<qapko+UCBoQd}qGp5$JXdk7<aHKsp3%RLpt|~>M8L*X
z2%hm;%N-Y_qt4{$gM^Fvv}JQ%;$6F?M7tw98?FC1uOLrsUNYq=^JZp6nZ2!pvQoY?
zoD8HtkD}=rF_ireHM`es=B3y8`J5ehKpJ2fS4Y+DtH#l1r$z-VFev54DYPkc4>Kkj
zudaAyGnGLsb;opMjONFn{*28i7O?0cqqVr2IPx0lDzcI^grX0u7cKhtatDaal!Ga;
zV`5oP>kFjb!SEfo&rVKx*JJ@sihZ7NDSSpB^8;iD`K`8|U3#ENOsGtwrjeZcZT+^H
zfn)*LAIc|XJ1*@s_O1>4F=@Zg*}@&at^FGdnK`iiY0iV>hRL8+bgXDF%><)7{?v0D
zERSNA6Bty`7fXexQY)UYUDwhbBu<m0%;{D`k63j?Jx<g5eE!x|*jI)kew}OXMbqaq
z>FzpA#Coo#5GrKEIZ5L#BAOLRQu0Hq24iuW(JV3T30J8{HRm63XP2G=-b0`v)VLJ-
z>tIkQI~0nLgcM`}+L~+XOO&)FxzC1N{`kT#uf0HL#w<>wqCBhgi)}@l8hX9n?AREY
z@{XPomim{YzyLm@Fyz}&UST6AQ^S+5(TiY=^;8(>uxIt~fhfKq>iFIVuq89gh<m)3
zidukM+|@Q0;w71VWT#q;2ndk`tp}pS2hq*8?-Y0)cd>JTO(HGWO`q?0-(Ppd&!Z#0
z&y9NQb#VH@;2#g*FbiCf&^h8^1n=TrW9$KSp&SD&Zh45}8oeN@>LsM=Wj^5IJWxC4
zIcq(D&##l{X$+QdJ`yq$&@lG8APhT#(2J4~=HBq&pKMeoV?1Krl(IMF*}mjSc9}P2
zyuxHa^~qwuHgS4};)n!@h$G1xNWOdxPP$-Jubscped*1>a)l{Sf3KhgywXKf>cuV<
z_`7)5zK|Y7|GW3!%X$uPfq$wS_WzptjV1b9%lK`W{V<U9KH^2VZ6mgAEUgde940hn
znI|)toJt|48cBAod2-W%AKpVY^mR!Mebu6xSgicajpMxX{g`ZUBlSVLh_)g100W}c
z7!uzpwCe9*cVRHWUWP`Z!7YT<W>6E{x8Ekbbf&O(wBpAB{1K_#*8BJKD@Z1VlG&2k
zWdW&qzib23Tyu{?^Hri%Xx^sqSR`aQi!&iFdjvS<Wc%g353KP&x~O#h)as@W|J)X>
z+6cv&unSA2qB;$<OIrdGEdzE+zQg-|)DO2_Iyt#kwp_)rlhd_JZJbEoVhS#;G+YGR
z6zMT@!(v;=h*1dc%mG<O9ok=)&Kj3&ey$WuEB?Oz7266Z+U(b7nUX=p?!ALPD}Vrg
z!npFrcd6;@tqFa^dQ)0Sz-V}#gb**@O*c8(>O&;*N<6HZS$UZ+wup;{Mi+tBg#cxQ
zA7En47rV4q8-^}pIm4ROHg~6SL7U@W=agA4^1#L3Ug>rb>3NCITeVcNo`ReP+%o#4
zAt7NU3QE1;XnB;a$RMMa4&l+q@p{S4&%p&@&yODVjF0mit@oZB^-ib+l@iMiqwaE&
z2zdM)iiq8eL7LJX8Hjt^<@(6BB@*j%3W24RqvkxmeiZ6g5(-H8d5te`&weO%n=~k?
zD_!Z)`7og#Q8@RM{t0&=B)R1fl*^kV+U&O#Nq@Ras!`TpN)|GD+q_K%M@$AE&t`!&
z)I3%F?uJw&!%2)1iT(VOj^HpStOp%XWb#bW$wPdP<Ph`CENB<0k>KpEk%YV`9_pAw
z2_?7(e_Ux$CWdZ_W+1f3>tMXEw*xfh1D2~L8#QyhFll>JepQQG`}GBCIrpoj<FooA
zQg!j^TVug25U;bkZ7kb1I&zFF#zGCUv_HHIA}?*i+zegSfRm}kuF5IIM_b-L6vN7h
z{8jubKU&*_Gcl3A>b+9x__`!NFto3vFaIg7pfgfu_0;bBEl3v7B{O$N#nT+e97diu
zt`k4g=U356iw^MzZQ@}|58{fy$GvDGFYrzs9c|i<5**->eMfY2SIr@dgj~h}Ym~2!
z;kBEe36u~NRcR58+)pgtw*(T@f#`SLQCN2+goAx-K|3ah^dT;!LVN4aElBZ{I0nvy
zIN|iUH;@*af6d%9g!{NJ8_=5ZZuK8-Rb^tf4RK)`I|>y}0O-}bD;8lsx!}8$yfd4_
z6ytnqdmvO%>BI5F_rY)VSET`1eyg9k@?_QV88~*y{GkeRg{=I`G*a(^ck<>zT<uN$
zN<^@#h!C-pa7Co}@K(hFb@ATyfajhYhEDD+23nCme0nLc8EAc2=<#`Gnfpb}4CO>W
z2p$l-(X^R6ocs>yMK9Q*7b2AFw~zUgVAr&P&w_^0nzhLq_+vjlmSD?(ol|eOifR~B
z{B4f2H}eU&<c@IHWU_?>$0uC~(e&?5j6WDN{`JQKoDh(~0KUFes;{ImW^X<9DHVt)
z&$pV8Iv_;5dJ5qOGQ)^7W)*O}kDaUT_f^F7<ul7xn}>Wiv1o{y4;mn&Lx=?8eVdWY
zlqIizQb7Mmp+#8ek|jz^^1LDl2R5%x9D8vrTIQ?J8Ka=J8;wWP5;f#8SDXx;zwZeD
zYf-2$tP8q!tZJt6dcy@b*Ibsc;>^CQ7VrZsaHjs`*E|^*uYFysDL1vnb>+5X&@rg=
ziQh)39A(v2#fh@C;gMd)K7>KQ$G<%U{>ORD&jA4^r<vyh;>d@jqRxD3zv+J+eBXQO
zK|R>Nevfsd)lQyv=zK|TtvRN<WxH9}*1bU7|DT=~Tnhh(M2gDov4KXZG|Nu7^GY+s
z&YLD_LRE;%6Khl8^@_`qSR1dl9RTLUesb{Y`%W7=R<VK1;>Az%O*uy=VVo0q&AI1A
z-qYXsJ%uZ2BDfkf)+;;uEagpqk>Vm?@p<Jzvz9Lwi(?`2yAm&oqHKWuy_EiZ{q?SB
z1Mauzg2k&vhGI7XFuoO-I;AZfbh>NPblY@6+wT_-!hKi6Bazywu{anIt8i}1!d2g4
zRNi@^p#6L=VBFw4oo$4oz7`P-0#dVZD?$76SK~;uWzxP74>y#@%6jhRAt#a@co#Y&
zqV7E2=%URRz}V}7aQdf;evRtNpKMi60e0Qxs?+wpN5AT}`4E8^`Exe%_sryP&wX)1
zN0e0(-&d>~|FyL+yH4Bgt`$7eJv#n+Pd@!aej#~>A+7I4oLxi$e6IV)LLi^>9o6)o
zXqC#t*dgi>N9@Wd_}EBhhG$+1yA#dcgTiO#3mj(b{nf*6-i~2qG@<GdipugU5A|YX
zqc=1rFDcPk!JkfpBZ9+1s{=Ds{i0&!M<0d8Zg^*|NhM**vHt3~AuJFWp6lIHK^}?6
zFU*`9AiuDeylmU(XzK~XvjEMKY$Sk(x8Fv=IBUY%%jeoNokam8!7w90?gD4ki-Ytk
z!sm(V7pzL9FSWNZt-yS;u&q^u2GRQ)YIm30&FwkXNnV*k(%YM60jVA?_3t#-pT1K2
zqncS;_s>CHtH7}KKSw*XGhCv#9=tFnky3_Mc>AcX@$3myJzBn+As)iOGj?1D`x?~}
zK_Vy_J*3t?upv%e@&v`o60O2*a9Mkrx#{ShsUO=$NFgl}FM6`Bcvj+Vn4W^c37A~0
zimR9IuaoX~6-Bmy4zmN*e(I!Rx5=2fYYhv7rB~0EUkFN_dhVhvJ)vqQgKa>pUOXm)
zNUo3YnVUc6dF<~KO72Rp4~**(p09wK-MGIl&8)V<ql{|I_MJGuBzb-WzRMKyPCu_~
zvoHKu^oln>)ycrBl^!hzhm+zCg6b|KjJlF6!fxy$F>V_rKPrr^6!1B5dGw7{+zM)B
zy)j<P!Mw<2F+B-pA8I{S3*}<sV_NI@*Q9r^ez5GDAcKB|rtcK(k0Y6Bj11!w6Z(XX
zwk1$+jm?v*;`%s~fmNg&#k^>KW}!l6VXl&FkrG-Klp3qoPWbOKh7M2xdC_xO#|KlR
zAG#7pslZV{MZ6m^vjuT<Nd|JqfIPl@2r<xPqz=-Sk;kgtk|woS;yZh{&MBz(GkZ`K
zAg8-qLB<dG+|DN>rsg6cZGE>M8Y_jcjX5Jo_#+Od#l4Nqbsh^WR6wzd)U4QZMgX>&
z$Ui9#CtYSaTrR3)FHX%H3rmICHnP&|MlJz6lk{vI9s4G>TI|m3V(&^2b3)6Z(<SoS
z>mx5ngI&ZcZwT|;HkH732YGcS6c$>fn~(I&bbM71vHI|x^wy@PNX<$8z)l;Kg*YuU
zE!W6rP$G?X7Gr`kr_b!a)i<M_09$&wQ|FB0X~DP@=bHuZ2yphf0_p!A0hkx5#mAik
z+?}$r=Ck@zG#LG%DyRudxmu;wht{fmCIsyDq>egi^yOkdcTK+2oDT%RCjMTtgcyW+
z^mWdKJ94jEQ!78OEv!D@8cWc~F#U2TE)x_MPK+&tndTEZe|yCP>b~)_IyE5}sac5p
zB89Bb#N?}ou)UOa9y9{5*Jh%X?wZqSmVF~DGWjR;uAZjTfM{;2CjnsREjH%mIiNna
z#=2#Mo5Z=TFatMB!C=fq)EUKY?IFKkQt2;#MJ71$YdH*E`s_8(IO|3pDp;iKc;ve6
z7}ZivS1F{Kkg-j`(w@9u-{K?}rQJOh@Jv6q)^jm@u}Cr3SWn;CX}B(MRwk9BR<!8t
zi<P#+XuD(=GV3^_df$Y@e9K`{q2!?o85bAZFp<gk5nd!_)gZZti^0;X3U6tpIlK4%
z=o~`VBz_LfdaV4aWM^u8Nn(Fzv>pH3xNW`@=RGRtgPCv+W01povP#+TY^xzn&%T-#
zP0h^}%ZsQaig8pnez}xs6;41+qk3gPYUXB<G&HYa1u{*ER_6}mlEDjO&beQ_ahlx+
z?k*ssn<$U{c2g~!`x^BjZ5?NkXD;BD*R>wpR>#lIQv<5>1Mq$Uac4dcdg}=6tGW<t
z8YU8dZ(drwiI_@RS{~CHWJrz$GrtE-mk>mH{VPP8m!^XKm*Vp}Ed(RYg!s-2S-hrJ
z2f?O9tRL`wVx(xVeoJRGxZl@~&ZHS&PKB}yS`UZ=>)I6HKg;=~^1j)-@)dXFD|Sm2
zC~_g`a*Z!TM=Q`L@sl}2JO$`c7hwfZ<)^KRUjp)>Y&IhmND+03$^$9Zhm%bDHudmH
zO?`d5)rWEcaRD;Ix$rzC`!pm!0=b_6BR-TTUd0x6DKLjg%2{v4i{AkhDIB`A>18q(
zr!}M(c{|UflXl$AD<_ix^vf{9^gO%JImPww8|zFAfe4a0Gx{A7n&UBxH`*UP$V2BK
zo<+R~IT~zRRZYfk|2v%aEo28Wn>Q$!CHJp)`)g3UE&PsRUmubG=pZ3&`>{mS$SF1h
z^o!r<o{)oqL_R=`kfIbz`60=TQ}fCM#=&Yv-#0^mYaX#bEzZu-ASF(lEZwyujfnpm
z-Npm#O9R97sin)1w=oz~GbyFu?A~I{dEag^^>uzBHL!-wEC31WmI{F@TC;b1Q*>2V
zTF2jEniLWBpY_#uuyc(6-|G)VI3E}5B<Uibbp4Lp|87kFRVVm;U6s$M<pZQ%=V<Ng
z`5|1)Ktvu&xPJ+)e^wLOrmPZUXQLc+3W4j0t>@j#>dRE7E(8t$SBWC<>vwq@fVyk^
zb3>#rug=?b%)8E{|D6d&h`<eyVBQo6FD(@ff?*Ks>KyD1nJv3aFp$xJD?z|>iMS&E
zO^NE$o~Jx}db}y%8`IpT-}kzz{L*P9pw?!L3iHlt{LD#*h0c)Wcy$8yo)MB82FQ(7
zlh}=!8$@ia;F!%tf8mFxpq4+Bo25Ulw6ZHh4rB5tjx~j2O8auy@JRt%|BG1^6z1qd
zAG5iKIF=|==oH?1dEoc-s#oX^CwDo`mZv3c58(!p(tr8(eX6~wb`qE~UMI8$u1Tc$
zWEc-57hpkE($SxM0xDnrU0eM90{-*)O9Qbv5O+PzqpqBj5Frxe!|u@`0L!4J^ipK#
zDB~gUbafoZAt($HfcfM-8T&mMDgg2wB)<X7x5wOb?}W{<T$;N49pGB>K-&SJx9%44
zdmE{jf1A_UOg3?H@3oh;LT}hk@xI+Pp)2yA3?zSIe1;qY;oqXuksx$yt&`HcpwQjb
z^j|&o|1orj!@%tlV@uiEkEJKS;C;R}N6UyQ`BPv1zrV*x5fMpH4PPCVP5E5mM$*>k
zbT6XE=s1qSK`|(82@cIDF+Z$}ECTBM5C<XKZ=pH^;_+1BsC@O+dqp^#&Cvy@EOGMl
zG_nB*Sis5dfdZRA;YSrEG31&1nMrBV<>%YF_wFg^@@YxTh|{!4D!w{fF^E$r!|$QD
z%UV+1@8yX>;6>qADaYyuz{}XaWgXK^bSyAT%Tx5QEPo|3B74Woy7A^&)nd<;7G5TY
zqTneUCP%T_X?hu72ENW4@hs$8iO7t+U|OP00BT_DAn_kz(B~x_#K=bLBQUB#Umy>E
z1>Uvn0fMbF)Z+1F=_?#<|LDhxBZ$-%uIr=X;~Jk&P)s#}oorlf1oVmv{i%ojKbSwl
z(}rtDAQr~evxwk&U(qKwB|J)re@6)|iY@(cH7T3d9xm1+gwD{(f&DK_rF<I-l!f#A
zJ-ROnifW&yJvu3|b8?!Cpt5md#8x#KcW`6H^BKaRkw}xn04KK2`tY<|W3xcwOY@G~
z9Lpt-m-QEE<AqSC(GyZ+4Zkvqiu!F1)t;<<&?r_){*_kM(VORw?UKH8WYTebMHSb7
zEhq-rNBPI`n}8@$5dopGpvygE2#-4R^Xc|XP^Db02i0S?*Wd766Q9GYcaCI0ubF3y
zr$JmeSv}R}jHQ;{g2m7k9!>lX{Dp)Ou%7BDG9GHAX}6b$Yt7wFH*#aoJr$^BYLU02
zM_c5c6hXVA73_}N(C*Ot|LhJR27{gw%Kk2whS$%)cW!;=&_npq2+~cx{z`S~`%nnv
zC8sxKqXmo6re_zGvKKRrdWdA$s@eI)V=$hXPbpJR)&G+khN;GoD;&-v-J$!xx$mul
z;C39w{$y(}7*C)0WIj<d9Z)l6=K;@oUcP?}J({1|XoM~O3L$|%fG_a1edRsURD787
z29X>jeYwMGzw$h;0G}~EbP_G#b{n2r_Pn%Y$^(*NsVSo6#5wLE6ZlAm2`~@<Q<axB
zXfNrt!1KL{Ar_nTCAo)%PO6?$*y}=Bgjx%VIEz9(Pi^z|2!GpG{{y+6YbA>maM(ji
zC)wxSbmCggomU{E2MUucvTLdHqu0H}?m?f*srj@(2tHX(%P-GdKxI1vt%i35iNX8>
znM8pR6M#x81!K0MiTZZSlH&XAG+tz_15+aF8iy5vA>xss^I;$bi3vT+ROoL&^$)!1
zPYhkMb6f{t0sMD?)njoQz+^~(f$)R(ov<l+YVab%;f3qb_zLYL?itYE(5o}}HzPvo
zL-(lma3nwTrT(vt3~AKJ{^qp)DJ<vdIymIOLl~ejNA3-4>cN%iCGVYdF9m-ysFCec
zecP-aXT+4_tK)ZZ18PgUunv$D>lOcH!C1`N;%db`w~GBhUKW2Bxq<LVziscyt>5|u
P`1gZ>>34<auHX4T1~D9A

literal 0
HcmV?d00001

diff --git a/assets/img/rancher/backup_restore/restore/restore.png b/assets/img/rancher/backup_restore/restore/restore.png
new file mode 100644
index 0000000000000000000000000000000000000000..dc6541b7810fb0b9209be8facedd8806066c27ee
GIT binary patch
literal 245224
zcmb5V1z6Nww?0gFh;*k&r*ujqf^>K1(B0i2A~`hD-QA^hGjxN}-SG|Td*c7S=ef?|
zx?qMqzg_o=d+oLMgv-lGq9PF>K|nyDN=u0;LO>vMLO{T<A;5uKI-4WYARth1Eks4-
zrA0-_<Q;5HEv!u-Af&<*)Zmqsq;WIU6cMCp{N=v|t-!?Tew&j@K;sm7Ek(l$6A;nH
zK-cI}l~wo?Da?k^kAaTD1-EMj7nyFbS-mp*>=V+@W?!CX0kf6+m2}Tzuj}>{9(IVr
zCcEAZZDnFVeuZo*CWg-mUsC%i1mF;|pb5qyb%_A}++>`buZ8hFo^@7qLTBa6K|_X*
zHP0OpaIt!wun^(F+<|JHBY`)sAQ}bL7-(Vq#vw0Fm5}?`9&ij95vdR$;uv}~kgUmi
z@R1H^8l=OJ1Gw=Z*b;i;j3I@S`pmHHYxIel@eCy~KG6iY(f77%Lx#fJ<MvXXpXCde
zN(6&=H(R(hd?Qm>iQ;>H5cEfAZ;7Dc;DkByOg)b|JlOsiN<fP?Kq6EjLyV2zM%h=5
zXMZCSLhkxa<0}R+bQN{4SulT78_Ft<R1aptRohYknL2wX3<NB{oE=PWWg?AIYCK+6
zuN+bM67E9oM7M}bz-u$9{9fA4T=ATxpHe1ieNcj)2x@1@A{(LBY{A*qVe217(Xo+V
zf5GOTsHZSceAnv~#)ssvLHV`)IuiE%ged20i?pa3o?ct_H`(?`gde#o^l6xf{fFXW
z^N_22v&qP{*CX>zkQFIHxleAo$dS<SVwpcEJM^p_AVn$NC5AZ~C0wb$5#nNyQ!umk
zeXsEF`FLA|y9>*?lf=}qzn|{L=(sny3K0pwjYjeQ6#^UsSui8?N62|$(8}UCatD?`
zwjVSV8S;sLn<D#G9K$h2ml;0|oUcePJZz7T|Cz2JO~4&<k7nN#iSeLk<Q56f8e*?|
zqu^1b=Vsi=FLWU0k-sO}ZPj#$#G8;;f#K`D@;M_c=uF1x$Uqo`=V&IV_FEP{eB23n
zwABraj90vf=!kO&Izd`wi2R9?3YxMwqe%~)X|OrMxKTL8!%Wcq2l&-pjO12o{I9P4
zAIM$P!uO#)mtaj_``vdfX=h(~hD;g&RxNKg-PmSVcXOwwY<`u0z`^hFr8Woc4bZ$_
zoe6_q#SqdojI0U-;UB=bpjq`3Kp^wQa2VoN<+AbfW0DM+b&s3dI{<iCV(h;6SB+K;
zoSq9w?9$*%Z9NlWofTjY;)so7ojQfH$jE<3^5bL6?8C7qmZ(l6N?$voSzN_l93ag1
zT9ruN?f7-31#!X<JXmVW8-ouanE}!1b}egmMZi>n4MB9c_Th~<5;2qKD+t)au7qs(
zC_ntl5FQ>#t~Jz$_Xv2%hQd%%u<`mcuw>}f8Azr9?pZKj{jv2KK?wDJhgon3knqCL
z=5TL2E$kqj{H)f{(g>H=V1Gg%cR~b^Q3Zvtyb|ces}eqV^|lxKR9xh<6cw7Z_+%V|
zSddg)%6F)5C>p`mV)f*8-z&ajY{597{SpI^qkksZ;y6R>lcy^VCdf(rNiz+NDoi;J
z<3y1fyp!AaQ^X0snWRj_HTUu-;sulk>Y<2U)+1i0GAp%dz`PNO`YW8kJcE>E7+`dQ
z;kG(<J+4*2^BvM`@TDQCJ;i9JMx#Jl=DHijXy5ti{Eea)rEcKdrp*oZ1LR7m@0)Q1
zI2gVFTz^?9a$}7A*B=nJgVKX~f|TqIoiJB0!o{d3B7UOHnbNTWxdR)&Hl{Sjf<z9e
z1SziKrKkkH5dR3p65aTWB>m<a>bK=@o8N}M0Vd(A>E@FU#L(Up#EEa+ZaJJWow1&o
zoGG38MKnhQM<jiSLi%LVJm`=>Oeag1q};3mM?-)`AA$bH|BGyjq{gRt86NQ_8TZ`c
zV$0&aB3?O_LS8lJwmqMjnqqWiAw`a&`f0K~nBuR^QJS(g*(*8i*%Ri8?|d~0%0Aae
zsmkz4w|u%6HXA4YY0Voe7^?feqChXdLs?0oMjlxn_)WD`wcJJi@QY?eb3}8V$7fzi
z?|P5mJB&-hy+;C+=m`Q=0(Sx#4i}5GDYty-$=Yd@i7gAJ>7{aa#d8d3qh!_qJnep{
zezbmCi3S{np%0N|31uqzb&@4IC7-mE7RC9bJyTtRuM`fMsQYV;t5ceWw}+vJ_lH06
zhVVl2dZoYN^>k+1Z=EB~-me&%W1Lwo@RYrdCy`+mW0thd(+yk^@YY^c^-X(He*EyL
zbk{~%E8!Nq7DGd9uit9}J>5A=HmV=e<q{YP_ZT7(Vi023gBtP{)iXL-;z?p&!YV2T
z{}PWq$~!u^-zqAWP{_=p21>oD^s<ywH8b2_x-op(7%1KH!>=g8BIlRalz0C1FpVjR
zX^N@Uu;$3!aP&y-uvzL{%4)rQ)k)<m_0k${qtlhiLAH5^IFrC_c6uH9dX*}b^cfwi
z)VfUPcISjk6~dh8P}!IfQy`kw^z4kPzLtUK541YR8q5Wo`h6m4yk9(u@2V}gP(6#i
z{k-G6(;uPX^F_b)c!k1+Cgl!G=0$7r><t%I#FWQ0#qbdwN6iumxLiC;$mZ(t&GXu)
z)1{U3PNj*a?{ahTb~scyuD2*RFFBbsN;EM!*f>9K>>N?sFYeE70**3{+J8KTgeFRs
z4k*UfWWbCGkMU%TWRSKkwIa2lxjk;%9H(!#4c*V<m9Rdr^7Zqdv0kp<SfBqoGr7&b
z2V5SWv7c_<sN4!%aGmeo9$)wp=wp5+uH;)Y$ui2KI<Z^3C#%TPc+c3SZl`W%VdoiU
zDrNY+|MPuzezr!obGElZxdD5(W;fzG#yWkEZ6)fwwhLp6ZRtHo!)TGB5aSeskdj1V
zLE-}iFlW55N}(k8NJ2|2GKbJm7=_Q&dALoz1oQw}?Z+7Ciz&gorUE!E4L7o%M&0~4
zZP{3T14GU5sWIL>okrGLR#7JPvoi2PkcZn{#X)Vb@T&$buHvOqa8b0yx7u&D=@yTh
zqWu-bs{&olB0qxmG0UjsfNp><Pv4fLCEu3F?tBzXmXrD<x0>*jg4t8FabZ@;&S`RC
zAK19x$n5si%F#;Fj_!;7Y?1$Ir+C;*Lr|ln#skJDz~Oxbi&Ue+4ILl9r_9xTT5{T6
zTG!InlDGR->qRRig{(qMp-sfZR|_THK9`Nx_G;~FPYVx%(m}>%kcuo-Syl4LB+g79
z%JPJyNwIEmRIt30Q{P>#y^FTUvA``@l+$B-w6HfnWoAFYU&1eAmo*&)-s-D%mfF<B
z&EwZ-?Iw?Ca2I$2Kuf9aU)_1meKL=^eP<pTkiX!*V|=I0?Yf?u+3izIpPeN20l;vk
zTWiAFuHM+_9e(}=Ri-`h?88_RPhvunx9*^h$J6eFP{p&moyJb})iz*=UhS1yn5wqk
zuZC*Vg#O|Ul~`5DvU0s1O{M0Y!-XGKV+k!^Z8an{-s;TN2|9Rh!kweib9$}NfZWO`
zDh*eu17&46+g67cy_zOF9FB2%7)`VUZLk4tO^nuB-U%iuw=Nr3IftKIs1CW$BL|r4
z_%2-&4<8g6i;s%KODsy9E6SElDy`g!HQ$!)&kGp14rHteM0*}y0~QCC)apqOl8$_z
ztnMo2(8Y+%1%BGw9g|0j0@2vfl4dC{r}pm&U{H0Ui=xvd`$;Tp&H%g*z#iL~5$X|a
z$+}o3Aqk%P6VTe}#^xjAM&b&l##@p)IY65u+xFH>y}iw00fk(;0I|p2R*E0{z}Q`y
zjo_~H(RcUQb5z_VrfEH=Hn$tsxmEOrmby7ThmL8``uxN+PyRW`q+{r9IgB2UcY^n2
zcim5`^f}Cm)mGMZi8<Mo5wivd+qPyMC(pIfrIw(UyzA-XgjKFaz01%M();G6<`_W)
zAG=e7haSGz##mi`Cbx$s&vnd&__KokPga>c0#-+ehriqepWLsJPb2+Tz6fzVEnQ6B
zZD)5pJU4@qCg&bMoLQb+PI7tJ7Oyt9+8o9nc04m3FL&NgqI-~93VL|)pVQt>P5BpP
zN@vdbR^3isaBS=^ceQrCXO--ZBZXxFjSqi>&{cyLmI*e4cZ<y($G&E6B8%Y5CGvj`
z!ghVv)Cehmh%UUL4MDMvpZA&*Ijrb}k<aJt4fOQ9dn0Wg+0?u=MkJCgYY=*1pe+g{
z83*KvI2$*2rMun95Sr8#4g}+EglFc*u#>2cnfD>Q&3XZ(+j`biHa_PvM&sa<0-~Li
zh9d+7&YPECNNGi?69@>%ObcaoCw1A6yhgS*Oa{ibh9*pIHg@2rAt3nOc)@RNOq>kJ
z+-$4?j=XLH6u+O~1;2l3W~Lzf{fLv50EN1&JejDig9#Z2(>o>>3PB_?GBSP#V^dy5
zF^Rw3!T$+Rm^(Sy@iH^Jy1FvCvNPE_m@%{R@bECRuraf-F@m39baV$e8MrY594Y?{
z@~?5kOdO3IEbN>tYyo61;~E&+Iy(taP`pg^A3uNAY2s$_pECg*|85JsLFSiFm|2-v
znEzvJa9949R$h4vHxp}hF$)_LfFpPgK{jqK7XIHI{(m3+=am1YtHytJWo6-d_g}mI
zmyiB-<!64`!hhM)AH06If&mjm;%EL3@CA{wpCZD*@*uJh`=kthg?bSV_yr&Qhvv^K
z_&pR|)@%`yD+GivgtXXuWjDx!WkfGblP95*PcrB+^;jabUrS)K)p>$6Yjd<IawrBV
z=&B=BlKPC=aIOo4bRK^V>bW}GcM&>cxMG}&&?8X<XsZ@sXZzI>F{)(?XTSTpa`>F`
zF(yTNl4`0pr9Sh(%7)E-C&g@K%y{z4m>1^PvuQKuwP+};EC^T{VSiKdan5qz8oamg
z(vV2<et(<)H*Y)D{K?>e-fxUN|MU}HgTb>#OA~1L_`m7>pEJEHhX@>r-XB__75?4P
z2V1{#z9Q`)>i@77Kd5GyLFB8Snz8ghppG2mQ8>>LvS0QGiS&*V($)6oh&e8|^8aan
z?>r&lfP|dEzenR5POwt?v*c9e&SgT6c(ee*+&>fi??4l#$E}0~c6b|W3sXH^y09kZ
zCG9O-aj4Y}=#lPyvsw-*ciL{POJrKw&cd?>6tc_}{9S&wUkld-H4zk-`2Ph~e^usA
z{hD@Bzb;d6fOg~`DD|blTSDbwB*OZQ%>Q=bnEI6(t3m9b(y?eOg+Cym(1J%NF9;6I
z`9EM_ZUTkExev61170@SGyV~VA2}?ZHRo2Xo%|nt{I`2t%N4dU!M7YuQBc#NeeS65
zA0PpxL1CFQLA~#?d4=^lME~@e^Dy@n*6b{^=&pM&bJRhv3?#{bu1FRBZyl#tt2pNk
z9J!-T`#;0sMlY`xYUzkkJeG0gf?5xjxn{Dkl-S!Ku~fe-GH=iR^DsfK@@+NnbUxe0
zW-q&dV#>O19R;IbbgotDF5D1vGr)+uxpK{!opqDeKJji{GtNfzw4XR>eOqPz`=HQ#
zkk(HAi>iVJ68*MQ-*I!k+Uy^6)!fT}5EEWOOT}Pb-cFqlCUUS$@r_zoM0qP%I*iJ~
z%En2>HFK(ok<UpQE^OSjjNOJFzZMKKB%P}4^FokLxB-P^ztu~h0a7S^4&Qo~tIP+P
zQ-*wfD+tf)W>a@qE2Yf#oowUmh0NXhdP!*3niDPHW^RvqiS1unXwLs)9b<_Cf34#0
z^8cF<g*TDZ={SI&$Z5FoY<QhS<jvhS0iWBzJwh-GF>yJkzh+42*pwA6ENPT49rVz+
zlbk|E$`Z=@4cO;SR2#h@0EuD#-8~&FG^L#+eMfC4Pp_vFl|+mOiel0+-CBiJ^HjSs
z+ycFT3FsEB`kQ;MS&C~=3iT52e=L*eWtjsBZHoWtZ~kAk2QPD4B_VgCmwZS<B&Yei
zN-Cji{6RVt7E7TY7ReW=!AVB`{DwJPo)dn<aYUQEo(=n@4{tMCWFe7i)gjw<ox%D{
z{MrYRbFr9oF@$B~*LHnN$m6Z)!ZsesY9CvBL&r0!ZN;JusLDbAFFv+lrN2^*IQ)00
z{WYjgDJYe`;6fg?fVGpW98JgCxRCy;7erna(lSce^zj7M9*2GYS*{!Hw~JAc3@Su~
zbtB>;=ls3%EJT=#wBLed1+Pm;z=XTJtuoddW`rE{usUzVn$_|EZ|_*dW&^)N{MQZ%
z!9Xo{+OhtFXTa0UI@=<jR!yX&n%r`BRuw&d1uqG9uu{Us?b<ei!E2Q+2>X*$CGBn`
zrxD@Nsq$b!Vj4Osy=*#FSa|HWATc+S^lR9t7*KP0V1Nz$?0rn8OeMY8%w8tG!+d|>
z@!z2X8-ZgwPYm#XqyXW4oI>tqbZ6%}gu`i61SG&R-V&IHAPUR;mHl~W8d1AjE-ya>
z{egz|1)4n0h8GW-bqeeB2O36_z!9NiA>D$5JM&YX)>b;goin<7LlY@=&Ey2v?k8=f
zrMUi!(d!lkG9M4mshHb{UA4liAB#Sqn7{6n3XECwJ3=Dle*n#mUjM#RsMay9p`?-+
zmS(&gwpb2Z{c3!1tiz4OVjW(LeOZ8HV8m&I+xkTk0GNx6IWSA40Z9m5Pdiqa`l~M#
zbqJewBCc-sMbn+i7RM9#;eh+SvMq5-xqUZ}z<q{Dc&Gia=M_vmr^Ch!os3}Y4w7jm
zms@p0>vppV3FGZdr};$WzvMb1-nr-tvS7OJvHvHN*ng!@R^>d*e*Fci9pNV`+9?#G
z-q-p1suv*ZS?*uBX}lK7V{9LV^PcllbHK<Xwe|b8ts5pc%0q|M`h~DETen-n*aYBa
z&f?~IXoX_*#&*JD)y05!v5D6oPlsg=0Mh|i1OBGl-?jZW=keDJgkS4drVK#B(qv(e
z6A~F#YS8}}@W)!SCzA38yl98tGb|V|eCsP4CMS3xsm>kc?6F{kP!w^PP!!K<Lm8*x
zeua;KpIPFw;xUeP^lcC6wc*O(fydlt{NL$vky$|27x)`D|745_;1H!;xiJc=OiS3-
zF05;3)_V!h=GdKx&_;rr<VA3(nB$(h#~DIW*CEeWNpe4@*p=t*o;_Odh9+g4%REQ0
z4^QVpd4FkMiz%Q!J$#HScg{<Q=|8S4-DiTwR(=a8_h?YD_VF0B)AlqVRg;CPX1F$I
z^?BamZCK23GO*?6cr*X&R`2YS;Z;tw+)&eBcQ&2|v(%Q&Rp7m*{tqB#T_Uo8mhN`a
zJU>Eyg7OFyMd9@PvVAT~+qv0DTi5iPildpqq~+tHlXKL?m_Zr{>D}X0Mp~$UKGALY
zaC9W1W0a^Gfd@3wnA1TUw5fctg-&hVV6G{qfs-4iX83VD`WQElCZz`Zi9`GIH;*g=
zm;430-(YvDKWLwJt1)G6iu`dj!j2er*C8v~{bT>EfLQvKP0piy*QrpKh+qX|1!-r}
zWm;K+X;zkT^zbDNG1va%e7%9VI$b+86yyAIFu=UUM6>*x`aWuNMp$6HIOq-)qxot(
z@ospxu*g{>Yas~$O8jHJuUNp=3oS8*`cDi74Gw7m5F~1O!pML0uPK=1)reCA*bJt^
zH!EK-Z^Qr#-mG#SwGh|`HiV9?%-#cWLX3G%tW^QQAF^})TBTed{-<DU8rl-1rOqak
zzc@gHIRHRLruH|^`+r&KMgRT%5LiG&uUr6Mp+azetN;A?)WROzz-Hr&ERSn47=!h{
zM(Cpd6N%IJ4|k8~*VxWlgX!sIOmn9f224*T{2lK9+we-*U*Z)QZ4CMOH?XNqek*IQ
z0!K!?Hncz|?nDihh}%ctamsXsk6--vDjG2u>?Ae7z$EFlM*T%!k6N~;lPB2Zzn5Jq
zTMKIG2HTHSm~X{Z{p(b)i3HZY#`YIN{U4V=AnDh&({FE5fn`4WM?blCHEi9DcI}tW
zcD{OwfteQYSJ-?2Cs^RIMlFWM?OR4I0)a|C-87$YTP>TdS&x8`F{ZKZ2t9Ppv+p2*
zKTbKz{sm`ky(_tYzxUs*(UdPyS7Wsr(mONAwk~owAn?4jp|$Fq`^sBRR=|j*$dykf
zd*pk~+mqf9id8<=X@czJcMNc+6YF@dhy$=!kGl41LI}v<MIn)H$o@os=-+cJ0s}`T
zcfM@4tbv0leQ+SCYx4-E8nJp*@t_-Dqa`my&Rr5d=pv{(#=>R1O@qw8{Fe`QdQC;&
zn*MV0Usw3wBbbu{uuFQHHrB&3$NvLaL)5J;ttZCM&6~*^^QZ&D=(Q{|WQ(p8q=(&I
zsG-M>C>g)n#&PZN>w2OphWm4nTM!I<c3~~j@q-(v`k;NtgOZ{(dfUfDmQnSXse9BY
zI%zoFT?xt58NJ@RBIo2)zc)?nTy+-DQ-RW_(zZ7EZbqYuzKv`4suL&2C5)I9D6G#f
z<OTM{hc^@0)=ztL&~B!;%<VSP6PidIzSlQYeXpNa5&}kAIne!kyS(i!tUalmj{I6}
zIt&%$#Lw~EWbjOsQB0#gmm}<lHLkI{?d9s2AI&w^1zD^M%4cQ2(1r5n{eQAoGMH4G
zN*)TNsra06fnwr~p23shxzO7bEiyDRK#e%kZ%?xHE;O*H01<OTOl5iW@RiFRj4nuV
z=^bHW{l@8%RT@&0KYvV%WbkG#U&w;!$m?`0sf;@70w-J`2_AXC$a|1u4wkD|Wly#B
zp*Jl8I%2=Sl1byG&?4iIV22f+Aw@UCb>8#WuWFkit_?Xk&9m*pnXdWIO!(K=NL5Z2
zf*uH%LY6ySJ7L_V%_X=LjGoHT!N+C>tYB&K8-s9RQ<eW(TE4VerN%-pzrywnn6+-}
zIVO0SngyQhhx+iw1r~Ol+jRW9Ol|X^mYH533v!SIZbvqMuCZqXXgN}k2U>D0e!>$#
z8tPBkdMu;uwiyEm%azP~9?`&Rz8tq1T>(wM&no|(^fasePQg13J0?I>f>&UzF2>oJ
zWZTLpcSsGm!H`z}LMNFZZzZun-|~5XIszFyhQJ>c+@FB!rs#zwn8;=chRdxketjFf
zE5GHnP~%!&S{&I;iFcc=y*#&)g>mf0e@##*0w9asl(}>26|%((TWIDj9T6}|iR&>N
zJaq}-S9|8FA`R$$j!B_E>E97e+|5iI$Ib5Q;?~d%SK}n9WdO2slEkf(o72Zc58b&`
zGXU#<s$qS7CwD3W2W0GhK!>H#m;V<-$S-%9E}B-K$$^eM9_Dp|Qa5>>PeA3_sHsMk
zJmlLHt&S>0-SUBhmL<YrQV*(g5F1bhgM&y1LS87OULDZDPn^o%Y4#;I>IV8L^V0b<
z4(hDz=k9j!tYdm>u4B4;M{V?R&atVP2;z6f&uXewhjmbq<kGtr$~-Hn7P;?}K6~IN
z%0|VVmdLH`>~fNi(S*VcyoW^ki32`ba}le3`?n_k+g<uYAmLGih%llDs4u#LbZyG?
z@GFFi$|L|!i2Tpn?>*gkd_cks_%jLsWp6lk-Nk6HKDyTZXyI2RO(xv=sR0J%MdIq_
z2oY!JtcOD)N%X)kcSb+3(=k+4qCdb;vemw>cyc97tiH>Wsn}_ie~E2OS53XU!+dUf
zg3~eP<g~wMH>rG0pfr+%%(&^|A;kKAQZ(RL;ZL^(cg9^03oPkta=s`@Nu9rZ%vOfH
zi?2myq-O&i1ZMijNRmp7<by*r!aq`2_G{KyTGOuq`am}~^1uP7j@ogqFC4sVM7{ka
zuMWGGkB`kE^$ey(0!DPcRGxkcAAPP|w|p%V$@<)}U)c+>`lU<1rUY?=4e6aPnA3pI
zL=NcxUVUF$Yb78lVSw?HD7^v7R#HtX(uMt#7kVd_y2Sh;`+J847@1LFU0Mwn5~K<S
z><0(-AGOlV*2a<+4Z6HVKQkan&D&yAP(9`Ef4-Tf{o(elq1v7Urz0~s7=?53R&$UT
zOcIo^z(p9yDW-!ECJcj{>raw)a##}Vql^eO0D_p5<%Ej2T)FgofxAL0(by4l_<<vU
z(sz;2?nK~3N=lTlfN>>{{Mix{EP?pH>^%?+eJerPWfWg|Um#+=z9Z`J4xPPo(FL*%
z4aGtzxi*%q>dLTti(Q{5&!G6oi4QU&r{tTB7NNIYcd$x{?lf#kk(pfxR)o~$uV&?B
zX)}N=1ium%wq@^=yLR#~cV=nEm0x^l!n+1APyM@q<9F*57J^fyMln>HkBQkOQ}~BG
z4au==ws%C(&8~jZagSPUmdF`DSnVpCl!#Q9S7e@0l$5{7VJ3WYobfcvlB59fYrz0}
z`abtI;77)4^vMPdB$=+yY)*P_k2o&|Q-E64F&dT2yY5HSz>)NKsji)&dzWtHIn>IJ
z-7&eQ{15Ii2HhjjOvFLrw0pKX%)Ay70BJ@Fag&uNo#}-A5%_af`=;D4;B3xHTRoIJ
z(LlI6(NqWf-rip2MUv49YGZ~fhJg)>yPcX$<i)`z_oCE$@64F8@vG#F1>&ORg)S^Q
zHR1|}lFn;BbOZa*CXcKBD`gt$=%4<Grx=Ns^y1D|ju!aUSLvM_I&bPFt};&rWbu}{
zkOF1bS;8Yj$0dvdEsNvy?2v42xp(fg2=T1z?@!TSH3R%sUQ$f$BZA;R?i`v{DwRzK
zFy%f5@f#8I`r2RF@IGlT;|d%=?h<&Nb|DRq#64A8l{X~fTaRjAavTj6R(^^ol3_SX
zdq*_&dSM|6d)vBahV-C82(6bG9H(ZF+9-mLuHaC{%Lw5A524fp^DB_P<GaK#Tl46o
zbNR&dp@n8#bZZ*LL-W0`CpX?Yb~NipRNp1C&~y~7DxO+G)#XJ=G|oAtNA<cuNKgIO
zPrKy03+;wzXARFG`1|j&tK|g5^;_U64k69m$2AD+H~q^@&H`0WSIJPMqWVe=D28#h
zB6syxL$FmCZ3iylLZh&(NnYdn&)I$yk^fAy%mA2&HRV4G#^@f&cC(nZ`&M5=!ZnlU
z_7q5595F1+H{6;}YI=#gzWYTfxz#+DVgTv}ORx^muP4Nx;fabxWrH|S)v+_O=+i1t
zPaXZKdlQ#t=v8rpzMwl2I>Y?tRd>eCHyDP-9QuzD*CZ<F*m>%W6!4Mgk(kzE41#iz
zl4&jViP$Bl+YO7S-Ap5h^TGqUmd`ifU~2r$pFqua34Dm%nK3U@>DnpAY&>j|wJRRr
zzcI9KVjUF>0egD8IggshDyO&P*>C%)`t_ye(0)#;enmpF2&~-uutmzy2`ssy_%yR{
zN=9CV&UDC-fK%R$jt|dpD3OoWU54A671_9fl;h#_)FpZ|5Ybkwr%WuseU!3sw>CQD
zVIbwC6%;(3Rb7qbJ|IWtEsEx&`nX(##yRA_#`0~M1z~f8w^OmBxtU1F?6@luKc?h~
zNK0`AxnHG7I@y}AqLHS!x;IJ%zon8&(#BYeUK=LH_JH|0Ail$lnKKiH=>u^@ZCCn)
z_&Z+rD;V9^9gQvQHJ8w`eLLWd^|hu|2{EoB_Sc~6#D=GDN$!Z|Y+Ugz;G+$Q2YTuo
zci^Ffp-FzVL&rQ<)1XChIqLF?g;QKzPv-X^D}SxFBz>-`p%eI}#`NJ~5t3oSLu94#
zvICq|QD9BB_dhJD@3oJ66N4<1U{MvVe7kovs1$qy`oV=qsdPuN;?U<&rf%EeEU>tP
zJ*Eb%qEZ?z1I-@T?~><PX^8~|MKmQ{xeM)-3t4OZ==<cZH$d%FOOk6i8a#8<D&qAe
zdpSRHrYQ`Z?gXD4aCobh{^pba9g#9>lYQ>mLBtH*_$4M8N1-QDP156RxbhJk*ON=!
z4cDRJ^C87m{NM|Aj_99ubH7jMGdr=!i1Y)9VVUOllJVpdQ<P=X$%y}WpkNqb!dZp0
zZVPvrx^ECQX`xw4n$+;}paE>K&-LX*7%ND9-ew0qJct;lmDiLRJkFy{4fGp)wB{2F
z+lzmdd5N7)(={38HK95+ea9k54p%gBX7&SrqvpHUsZB5VQ6rHwsSgnmN#d}<$u;jE
z@$-f<tY`8#3{0>{2fp|1eX@erPNkw7<_!h87#nZKYNgRTrt*r1TjovRkt~wv@CJoF
z;wEq`hE=5}UL9sFdMk}e`#iDAwA=&%lHCp7ZS-+5$z+<~CWHyjB4*YwT@O~vtC@WA
zbalX<U=>*GnU))tj>hwJdqp80EU&~j6k2taI67bru{$ML9I`q=NW`XCsiD~TUb!)y
zopVKfeP<lc%ga^|^qK~CLnOdr0U5DW$$XChmWbJYFru)#AQVl1!)$=XKnyDXDjI7S
z!(v-gq3?=nrwntK)JpHjr}u5doSLH9>D?FIf(=!r@X|D+<c2!XHXX@W8ywOXaD;J0
zHHsa$Ng>{6s=w(o_x4=s6#FdBW@Z;F>8GK=;%9yBCCSma2d6cZ!IJbyR-6RY?Cw4X
zSMO%ca^CtFlJ4GEq_ot$7~+7W5YU&~*@C)b%E=8Rb`m#7-0E5Zs$Qe>E%igif`O|K
z+o^L=N}~4x4!e=EC{Fwfp+CUcNWYg;=Vi-X^myAye1WCBPTAw*a?4TuQK8t8&j=~m
zN?F8>E_tI{@-{OP^PJr~t0`&(R_Y;Un3!O}B~RB?92qNDo<g!yXP7%NFT9`*;7g9A
zqs98-skUneC|;@Y_%`)j5Z=S?kD<>r+p&FzQZCf_UWTYX5|@2vp&@j1yhAqA&t<*1
znH612WigiB^}AC?8Bv}dKj0^u>*m86-B{kOa#L`Xv28ZNT751@qFM9^@5QWP>bVpk
z^1WEhsCpb;Oo?6;T0nM(+0%E7xgiLvglzk)zbv%KJ2@87?X`4rr#jbh(4QV^(ts`z
zuyc*QcqbluwRU}cV5iAta6!XBXjc7>@5?RnWD82S0AiwETv<utMunr=CgFVt6v$)x
z;erl?^0DPnlYimUkshHnCu$2Gy=~>=kE~y-SCzF0V{J`c(QOEI=!7A26_KHf=kGOG
zSJbbdakhWlUBUzTUSewUK7eKn?sL;?(n$AAml9B{SjkizQIvY)5U0rgm{jZiv>Qr&
zM$*&cphGLI$Yu=i>{ih$&Z58fE8tA1n43W3NCgXf?Fd$gC-^}&FmyeaaC4h}m}CDt
zy4C0OHsos`L%vyU&J7VHH!Qp)tkBPE`la_}5Gos_YY*<oIJhRUJbFjIBcnZqms2fe
zEnH5%G3nlaD_#FS!hB$S)u`|2+3LKik5X;Y{6Q?)CGPxf-O<&YV<Qtz$&rIsdEL!p
zW~F>QV<c%@(3_&!O29fs)Wi54ex-9RW<T}%FY-|X-TP!q`YMkpL4Ha)oD#aq1;WDP
zEmKp<LwHF9x6aBZb(Z3q#jzC^>(xl1a>tlAqph^CHO)h``^@5TWsMWN<nvFrIUv&?
z(gsbR+U(V0Da4$AwUo}}sf_W3_8fJ*ft@niwn?S86#uT)o|!;S$7!no*DcD*Wy9Sc
z#&7D~psip{YZL8wqsj9Y))URZdr|%4aoz*N{Hzs+YUEzp7`Mu<wXn&ji8^Uz3>^m(
zwFXDS#pc6;+s_D3-m3cUcqg~DsDtQ2FPx8Kok)X%3#iwT*H15aD4S2N>ay28F}+h>
zpXycuVURE~xqQ}(FTN}pI(gVQR9`=%@ViRp+w_Y1WyptEG7IxzY%Qg)rAjk?;LPhN
z8gm!BNgvqQ42`@x)@?Y_q*jwB;feQs^X4^%$kQ$=v;w2xKFOnH{*<8H>ptk+sA$PT
zr}vSWfH&JS$&|%kj`?>Sy4w~a_COBU*7YjK4VS7~F?l79r<O5pqzKX7MoRaa&FTZJ
zCg^V$7jgw~hDoA~#Z{SIcOi#0d{K5zt{MSS=))h6P~tD5;gMY<kzKbIhiOGwX<La_
zchW>upEQg!aTX)ZWBK~828P>XN|m3kh)$!SBjmxspNsoSwx6p0uzR{V(_4i7>-5)6
zL_)A;rG#+~Jh^v29xIlWwi>i!R?hDlVxz!kpt)FE-!<;5EsGVDHeEgz)D~x(!0ls~
zskT%4-Lkru^ze*1IK8>8684!6iL1M88xH7cc&kKvb>g7AgWl*ap3Q(a3qO>J7ehiK
zAak0Au%B<$-CV3+S0EU1Wz-vBld9U~cCjLzjI&Q`qDKo=t)~H1{mM6_?F!^3?xs3n
z65UwwYcCA6N?ZR}$KhPJ$}}skAjqUwIYUsGsHO_*Y4b?yo0#4?!))z<Bt{QZKk~!|
zAA5&<@nhqNx9aG{`gVq}v4K6}mF~F(`Zcx1O%Q4w7xCxGuR{%o%DlHn_iroQS2?v$
zpL}GHXPzSI)(2T0bFbx8hfPr1Z;WAgOoy`NwySbb&4+-hqgHQL+_vc%CSicyDXs-g
zGI$Zut{2YuL9<8Aj)j_w0kO1enpx2|hdY}>(UN1M7>RHy8xfNOf_I37eJWi~ji|q7
z@GF)CUmtdF3FXTrsp{_q*pjz#abD~kp|)i|I(Yxj=N_yqVIw3M2GCL+*R0$z;Q8Q3
z)0xeq=OL?h0TOyM+8pgYixrgik6bu|E|&e!s7tiIsM_1xoAXRDsYOviMyo?+H!`iK
zj}#15q_eVL+s9Px;{|c1FBB>rne)pOLV*cg?0pMYEjxiZ0s9VPnPow5sPvb&$`dam
z&`88xoLoK0G<a0W2xOkVhPhc-Q_$Q#PH^HGp%MbiW(*Grac6ROR~Q3EbjQ7)!83_q
zepDR|&;7J7@HUfeIHiLae=r2K=wM!nC|-$p;M;UrQ!P<Kmx05!>7vVr$kPYcU~W1=
zvq3>!)1n2NAh6wzk^Z(@JnKaMC~Uy2_OyZvoFmSmL<l;mng=g@VT}KVh=RX>UL68L
z_ml-C%X?4AfGZAFtq`-7rE(;$65ZSx3a`6VN-xX#F#mvW;FOsFED(3a3zF$4wJ&vf
zN*bKNgYhD3>%$}DGB|O_czB;PU3BJty1e3cxm>1R{6j&AjS^O=1++3ejXPKvLpq^%
zG`sq_{=L>ZD;D)>+4Y{Q;C0IdXgJbdr}n`s*o~RApp?xfYjfg}<OCn-U76q4Aq|hk
zR~KQ4%t)UjPz7&iNUR5yw6Vth$Wf0-{F4e$#9HKe{M_!eu>l&bsAlwe`UX9KKP9Uj
zlF$0*Y8@oP?@xIi42Eypqi2U^8OcFjz(P=3?!2DT2Rc<bhi{;ox$-WZ{gEqGi-u2~
zTlJ=1@j8B)*J&bG(x=+WlHX*T@m#5SpA3~?bIPpfdy4DP*x7x$C`-`7SnQ}s(m9Z(
zJV52b&S)jnQSBd<g<`78=*m;+`yXO``@gg*Qc?GBjt*h6)~jh5mum*zvsoLd!s(Zl
z%zicektAgBG|MiWBzO~hW5hn;qEdlCu*wk7Ke(R@b{VS5srAt%a6qo7pwKxfgJY@T
zb^&bHE60QDow1Joo(RjCV*Lv5t%UDO8e~4Kzx+<V2;5|<%&s*)y5qXO>)IJs(Tns}
zR_;UF4|{v`nNDM|AJJNuy#Gs)IkW=#ZMF=C^8=o0_+X{b0lkE-H0(!v?~|=)QC3BT
zklV=X_Rb}K9%F`B2`wG`?-*)If)|&%X*P=(FR7OFr2Z~triZ8X6Q#or1kS~nrXO5#
zo$-OhfO$f$b*4U*!9k-w+b+|h)QhvsDw=_)lOQoKH?1!Moy>=uxTIm;qjA^n3uS7N
z5fk<F%XC$M!!b8Y?`&?lz&Ns)y4s<!o?cyI{n5o>`jx5n2<>4~T!qfy&aL&0I@d?L
z8TPuIZ)eX8_lWzhq$-TpmtD8^6K>Z>69^O9mv`VgZk64#ZM)0vbViry+t*D0V=?08
zQWV*%LVd^98wML`OUaVY2qYc!#U7U33YVuv-3q)t&Vz!}kmd5uusacK3=gL0IJ?r=
zw4!kfLO8D4OT=LNj!TGRq{GSV@ynQC362<>p)fq1Y#cosFOgwAjtrzhNPyC<`#wlt
z6{JtDQi?TG9B(7eDBd^JNAFN2zt<6uhz$4{X*|*3Rnp6UirSJ%Clb4-pHinG&eOh1
z-)#`L&V9Ep*t#cf!m~{zW$@FzuPR5R?!i5au95+299RZvem;?_u4&p`+J0tMY02fz
z0NuO9)JO)ix|`N}7x?BoBmY}Lc(lH6U)$ZN-Yk%qhDLVgImnfIhCpF7`xy4U-$DwM
z&WX6%jG$W>#m<HFP7nw@0S#kZ*%9@oF=)3FN1_j5qrjsag~Dz&gXnpVzdxY*K6K&q
zv-f)~v_70Ff%7_rU8X;JrPg;e8mNr&bBfE9=iLS}L|T*VVektC)JB|~(Y`M<lR9#y
zz1mH7aXUz)5}(oDMdpJGv%HM7p4khQ?Ruh2e%v;Y`Rvr42Yu=kak#|L{dj-QdMYF7
zBYH_N<9>8Gz`7?(3U)l6PACHj;W}aolf12&8f)*Ct^veBPpl4tTgl%G-HH<lFjnBw
z7ly<cB8Q6gnOtFD62|h5xnnwf3qD?R+cdAh4jK*JK9r+vm#n<~+IEF?jIXpEY5J{?
zulIh7wD10#6VP3$`lcUpAE;N?$nvvJ=X)K0?z2#QKGo*wibJNHk!hud5W}2x6_jG%
z&A`C5%3-Ec`Q0kEXQjPw&xZr_g9S+2<*!>{e|0fs(0aa!F~fPu|EFlkbx4iQDKkS;
z;d@KC^kpHo%d}6MwkOA~7>g(>E;n>@-oC!#$7fZBfk;QS4I|lY6Y-?tmQVaFuyepI
z@deASNyV9~KBI!QGP+i+aNkI}R@;S=6HBN;74gRFCe#~^m9)o>^^Mq-h}R}$YBeMu
z#5s0nW-Uk0ED>`h!#iu8*CI~Jwl!vw#gbh&HJ9ooU~;e<=4;CP((8q*@-1uVKvqR(
z+7Y)ErTwq(eQ0@$kIPMouy+)((&De#85oEJcr~C$W<N|yx&V5<#$L_M<?b}8GkESP
zQmNCcn?*jh%2Z_*KfbcsF}CiuDUmb3L%>!0qEc8+rBr5C2GY(!9K-#c<|-U0=2v}q
zZOtU$?<u~f>D+2w%!a%DK+#XGH&U?V(-%ji-ENm;s@JE+-WM)phcsGvHCKdzE1yN;
zkDrtg3SU8RFrAaVZt9wCY9T7aezgI<SS7c3;S34R#YI&8tpxt}`q^Le$9qpE-(@;g
z=`TfUf;@)L2wFlzHbsB$(8w>^lrk@M{~pbRc9)^ujBkq+$G~`-F$bJ4n~_B8R1LGt
zx3w%ziKs8u&q8>|q>~z~7E8~k5IRt+^1}2(nmIQ!D5qt0w}VWrjTLFo=j0f=+H+_?
z+t`FTWtdUwk3<m#Ww4)J!YFin=`d&V2Yxu32|9smLyl;NO^aT8H`#8#psZNm^l@4r
z&Twwz4hY;PU)516BVsIQ+hrybS~1DtC)ZpmtbS@p5J)(u=CxCK?={IGdg|u850a5H
zJjn4*%xd-+_6LsLT`kV-UVwviBI`sH6ifh4LSNGG5xv^`xsP(<8ayrsLjHY1IAlX3
zeIyHxo!2=8516x-Cy7Vz3`YCFm8oojl6=7q6)cjjMs)NN3Dz}53@^FxS|<7d_VWgV
zy34pdH?vBO?VTZLlgitxXTU%^#fWD(db;d~*W`Wl+n)_{;eaZuL1eIr4UwJICH5t&
zJw&@oBUJ@u<p+I&=-?#cw;-C{hWJ4Kgc;%MBjP?IcM~{Zo3L@bDl?0>8`qMrJL%id
zkPzT<aB3bZ<Dv%^GAEJKLVgAE#gk7rxYj)>OJe<WGSHUXz((kc$M^Y<5v5KV)@XPo
zL~Y;di;0Esl;hNu$I}-7Tq!8bvC=uX8rWK_=!<_WRVyKRonYNZ`gIWKaL?3}W8hu+
z5WfD?Kto!os!8T`JEq>P(Y>=GVXF#2(p!(%+6DU~8mSis=L$$hcZ8t5PG>3)NuVbx
zG*dTlWDgZ0yr*(|)@^RTAcAfRlUODHoQ-RJ2YW%dvR)K7mZQrQmyswk<^bdU5;2A0
z!4M-Jvyh8`gr+a#pe}vD$UZS7KxM`fgRVn1XmF-x-$Scd-*KLG>0y+%^}K-Uo?iqL
zrr|ONY$_Pms%oe8HgE981f2w^U8)6DmG@N-D+*5pp3^zh6|+!=7w^`<-wMTTtc*pp
z&C`j=$|5U}y9fd9BXi7!myA9g*D#bW`FywVY-a-BwpC-T|A%V`kdz28bRhosFxr{*
zu-eNoe*5RAl8tinp}Z)0MV(p>NEVS-ZfYuu_%u$~cbI&6#p)VfM3lITg5k~w_Io$v
z6c7x)@<k+sS!f)y8&jXySwE%AI5{bgwM|zU5{g<ca{GmoCaf_kNPB#K^Uivo3&HW2
z#Gf^>JI4XSTijQirtM=;11@i9!?F!0g9X{Fjs<FMOS0>BTBrC4{;Pz9DKV368h7M&
z@clK_E9Frj0<fi+3_!qewMg(&HD-k7{MV@Vm;<<AlM4@ggRHi`1D|v(A?~c?d$mmR
zY1KiHx{!{m#H?g(+@AkbBV(#b(jCnX`(p@#oG&=F)vM7wrEGmPjadRXHW+*BmC_E&
zyfstA6=lwVq4CvCX8p#JCU9bJuF&nVBj5eeN>7GDxeY{8JZqgFM+(kg#Q<;v{Hut`
z1Y`O?!4vUdE;8K{Sfhc9#+4Zkyyp7`HG6J0)%rE2fOO`;s>5{NP6ltv&fe{T-uS)k
zCM{pl1vss3&&B3)-~5=LZ|R;~-=|&X;LMeY?Z^b>z4iIl2$Epm35Mh+S&mK_q8*=x
z65SL7ob;dT>^eB90?L`E8MYms>ODx?=XIvnbY^~ERN=Y<b56(Oqph3gG5`+9asCY@
z(lSF)sFZF1ch$Ok>0^yY(}u#vT6=ODUZC6loRE|nT;FBX`+$c-3_ENI6~OAu`9@2?
z$%4^loZ+pfBC)k9tg$$emd=O<D@#GkprAiEwJfHuR->n|yWS#%p6Hu00|QJj>i;F$
zc&8`Cr}h&&dp~*uSLc>u=WamYIaALd+_j^m@LG(}8YdxzzIT;iy=(S0m{*1>1;u1}
z5*f52Z+Xf$M%EkY@<=79oq~$WHV4becl*dD7h-uqrJPPG(OLrP1C%qZDk?dJyeQOG
zZkojeKF7$Zbc3@h2}kWD^bWXttR>e2tb*GvWIIpwyPO(Oi@35xk#kD9#Hf7&j_Zh}
z3mSeG>9^l`=BIss7KL=fGfH*p%$Qo>=GmR+l0Jn+^GuQoX4ong-ln%mP%1xU@9tf7
zp?jWG*t#@&4DOnMiwGb4vHyL#=yz);1e8A#X9@UQDF}@oIe#pO6UF(Nkv5s6<iRT&
z2R1aK%5V&^bX6znfsTt(Iiye<4mi_Q9w2ZpE^fF>A%9BwrIKn!bK}EiE(%BYfPR(3
z^q?>xxXvNJ`ZyrH!(buR?wb%u%}b`NF#+4?teZ%TZh-oVRThTOF@ad?7}%W3av5L_
z&glo|VX4<i-H3~mHAQly>~u@=yd6Jiu)&-vpxS&|aUi{f1$q}B6cvjVqd6?pm!x8P
z{#@Wbw;(JK^4UX0;|SHS*>YSIUuN|*w&j~yvb|p4*J=0ZtM$HwTV}nC>U*R#j9bVh
zrbs9t(yG8V<v-bBGM*=i%p9C6x>|a}r9_gnr(d(jLET>Ua68vv5IlAJ(c3;WccVOi
zqcw7l<?F8SFA9GMIB9UPRBy6?^2xnNSb1*R5L{-Cn2$fcBd|Uq!H)Sf$y8g)Z!=Lr
zLu0?C3x#Qovl`WU@phyE738Ai{y^K)zqdWOIar@xlKJP%Zgny^o7GGJYgR(OT}_d@
z*lp~sW$z(?_tUKwHC>2S9|qD@1(;VQod6_#X2S)ZMYItVV_Eu~=TimM+h0<{dEE>t
zv{s*Hsd>9we*1mF`>n?1ISOZq0MwNf_6AliOVZ$FDka}{l|)A9658&OF@WE>bM;xJ
zWK27PBhzs(N%rM&NC``^!+m+iH7`h8CCW2XD>QSTG~iN$8LE76+|Ikpw4%NMO{XNF
zEh3^**E!Gn8&R%$IjVW6Yxw(x<oAt^m26R35xYC(63zT0hGll&mffn%jU0+c%a*=6
z=@G-I68;Ib(w@8CFNR)#+Mnw?>vATV(Gxd)m%e%fzE@G$iU^oqK5@fk7k@8Hy|?4{
zIClFOsnW_xRFd7T9rdaG7XQ44gWO%5a3#;L0m>rxwfz{jG!xL15O9TMshe7b%Um(&
z(u69248Av>+wc4j3QsovqVT{F+Ty1O3b~5*7HpX@kBV%h-Cro+WQrY<XmDz!`K&wM
zT0XC_f&r`UBQ<<UU4j%iQK_~$sazVQ%=g_Ht=FIYP9Y>zCA(iV=k<=+3U-ja6V0m9
zl~GBW#fJ}KcL}p&YLUosS4P}8vR_GY!(Uw)(*`ZqfKxb!Oup@V6kgUJ!g`(wr@+Uu
zrL}pujTc?FJ8i8kc33J87`dbKj6kYG2mj7i@z6zS;)c0<TFk!swt%D>{$bHbJn!%W
z^hkltx2KyTF79cffRS|Z>}Iw6jM$seGvg0kQ$h@j;Y*mi5AWx)1mUQhdWIv7SgGsF
ziZdf}C0UMgd#+3d=lrIch9*DYlc|J8s#LHRmErD^ZSQ}qYcH8AJR|z9?}!YpzHSU%
zWa=p2C!*19pTc7ujty)vBc~_g9xTx_Wt=K^aUexLISImnR^D0-Rk=Ac;p}{sCahk{
zkBHPEsnR{zxbR>ZKQ$+0_EqepfnrzMVA-G4WeVN2X`ELobf2HiRj=$40*A&~9=<{b
zmGj&0T6Dha*J!2YdyC-XBouG!G8S)tum$4E62#6am8x|{3>=AMl^26Vl-C6m6-}Dh
zXo?--lS}>0)VfTzuXF^Coh#=H{3>xF)lAIQu>r7OjjjOomSP;goLVi~IwwdD5>#g|
z4t0EIRR>uk#E*7p3@%L6Ihp!b>ewIzJZFuU=6h5ZGysYUnlbU)hEKg6WW6c8An38Z
zr<stHlG(L(lw+v2;>U*AL5~416t#}8>)Mc7{AEtpm+EnzYOxw^LNWeSQKXS3Nm|cU
z-F*+*98ZS)PSR<QjV`6Mt9)PLqiIPGW|(%2kZu_43J|!)%HJ+MjQjd_#@@%Y95fV(
zj!cr_S-bFHYfJsZJqS2l1m#K%l}A;{n-S7=UK3I|1Dc`Mx}MVgyLH!7Vr?}=Y#TOC
zW1~@3aWX~x90%;XDVX+FUVh6FDNmE6HoEFv`CP6xxb--ETmws79>#h~Bfh6baioZp
zlheRma=ASbnD5ncFqHF}H|EZFIQ;Q%i<#)J6^55fj!k()e(8w+bZ_RkuqKqSVT|}d
zXMh9Fu`UEtmIrcV|905m+m7IbACLDSivr?;!dB7GpZ2YHqT~_0Vg~s%PKnlp4IpO8
zJOyXJvHGFQC+n}brLK{JLSQvEz5rjNkw4c{JL(JZUZBVFqCP)H64*RB{i+*Q6U@Vr
zkRXr={dFJ@?B#JO$3})F7SPY!M>nmM9evEpuz{Z8blr1Q&hMjdBsN@q_&2^CSoQ6E
zKjCcTXllvJM6ZtN)+Se(jJNeK29@$NSsTUq(yd7LLJizUo;6~ve%Gaex+mp@y5AEl
zjpe=UEnf8ezRJmrQ>Oc7CDft!{_}?F@qQP$MsN7NRR*#LVTqLj%~#5q6!3Ju%L8&a
zi5fcPbS~5&2wGYF^diDw0515pQDVMDrhJHa-seM`F`EEwmIg{)PX{8!1C?Z%)42k0
zscPoL@FcT<Ni>HMS4%0vmwBuc7!gr71?a$uy^4RnvHu&^=)wc7hHv(3tln)Zp{kyC
zM*5Yoy(>j*pc{x%WLMpepm7UBeP4yYzig*WF5pebsZ~M+cGaov>2u{~;SNzbDJ@y$
z3-Zd_qeK1J$Kh)>-DK9Sxg7$HQBwmabI(sfwsIems6I64w_brRrK)tDOOEtx+>EWj
zHNT^ET&5-^$v)FxRS0YyRSnQb_&W#_xQ9z2B|;0fHitLaf3#oWxAq@uJ8!}~*i>Fx
z@$VrH12+s=-QDy)%0;}7Mccd8yS|;f$t=T;k#moQ;)UHq=92M+5j>z+A_|kQsr3YZ
z1uM<CT;d-T9}*j^`1k^w;xnu2_h!y9S%t1dPY5qAo7lQO`V9i~>t@4AGEC}=7_o1~
zuk3j;e7y-(l{FUWM3tEWS{6Pe?!=p&cpJcWiyk0KEJ_dy(SJDIYc{&tkh%<MB(idE
zoFhR#B8)QLZ>OQJUJ;^%ohtJ;^L$%pl6*esVl0Ks+ZUdt!E7~NN)QPy|A<&IT|8;^
zHdobq7m2Ix_zd4>OJOB^u{8*UH(YLvIfKR(9OO9_04;S6W*92h06ugLAJv~~!I#}C
z)IR$a3R;$YDMQ<X1qgBkTCa(|+}nZ&0%Z&5d0iJGg}zp>kL^Ni+iU1mHW6s>6v&fR
zW2_&=;Ga5tU-o$=gFf_@C$>Uin@4^?oc<^z+pH-r)<`dK<nqur9u`=KyAxLYM2Wl0
zhbsFRjZ$}WG4*k{rr*MJ<!hA2vW;!dwwvh_XQ|6xSC#NRue^?wkxl-=)UUQBuzDL+
zxWz*Czb<560!QdOUh6~vG_gVr#i`#BdV^8SpQ~VXYz)O^B-S6K`v#?#4;DF(G5tZ;
z*a_w>RN%n+%|Zo==H(AuH@Zcfhy*pIt7E#Ty<hImG!3t9ThFj@=IKaF=rHE=e`x(m
z*3%~i2)MQ)G}4Loq@LI>5YKI7!0?ool{)DBf5g3YSd?woE-sBA3?W?#BGRFhq@W-o
zB9cmjgw)VIgh)#$B1lVjcMUOs(#_B%L(LG<Fu=YMp6}hiFP{BA``E|v`@;i);hOte
z*IMU_YprwoaMhIsA;qFP*k6iD@V;;oqgs|Wf8DY}-$O6kM>$y)zF*%H%}LG^`Rvz4
zwebp-Rfjim3VriomC4hb;I6ZM{yYaY@<>Z%BkLGIXN`z)-C|Lc4L`IYe}@w>L%Q$s
zQQ3o+f6u7?K7a37M|hsGZXGd`YLhmGeoIf1Ob-)yJc0^3fk0(KEIJIzly$8BZhRD%
z6kn^DW?*4`iJU>7SKm_yJN<XP1`td4-jS(X9gQqdrOr+I^c-q>Z)0<IbVi1TKtuh0
zp@<(1ctftSA;VFgM&zbbBr!u1tk3H9YjxQwka!^NbYZTmj3_bb3q6jOpQF5;^nA?M
zLtioYe@l;6ix!l9BG@~gnp?(to_9m3vO}AhOX5e|YtA3zq3`k@f8uKE8LD@4*IRp5
zbIx%Rpt1ir5?=^J)oiN0@`B&it}3<sM)GMfRnf*PwH2Xm&)klQetBR3LyicTe0f=B
za;7%Y7hQCJ&$4N+M)CAmLqjQ?iJwIARRI;%Q;IQtDvB{{DpOaxIakjx+IvrFe=LeH
z=Mx<}e$87!i93%fjE)&NXvN>!jrc@3j1pA|>7<n(G4ck=Ew>G+HkHZm61NQnhaW)m
zKU#?wKe2mpBdq!JYX~V=EX-mCuN7znosLdKF(O)Io}cl}dTod9K3)sL{zw_~yS_LB
zdm=PNpmF-WXdV5D&9k+@UCuiAiE4wUf}$YR!l8Tpq!=(dR&INBipe&du=>p%x+l*s
zrvx&udKoVim`F&G!Xp{7;{If=9G3|i6HZm&t<3h3(cfgzsu}*Q`+Qkbi+M&fTG-_2
zusU3|2BO(FMr9RnR}1oX9h7Qe``v!WX2XNjwtx+uaBu%aYX20s@z6jN(P>gRZKd3x
zMTcy7jqTBJ&PMP=ABZ>FHs06vmv@a<U#}_<#aNoECN?L`V(Xa9b2cl|^{X3=M`67z
z0BJUxd#H{u#GEjVQUQ0TA&mQ9GhA&pEYc@=bSb-{C(ASwE32qn$O0DX#E#$i?I-#5
ze9LQWhtN#qcJgc8&5dN!BIJt)EzO0v)Dv1sxo*Dg4vN-vgm7`<b)DSYQfgAIcH2)S
z0%ks1yv-tHv*SZ>lY?IFNYSznbD@YX`UKgv|E7`MhaVf0%8GKnp8aPvw2J!_`)&Ry
zjzj4*EAl-_z(bG2pT^ZM$W7lI+E7wjmYN*Qe&)(0?3#38Aa)d%U+ZkjwJi`B*0h$J
zu&j&BTa}}s_bVkU%}lHd>@+9>FKX;(-}ss*8x^z?pzg9)LUs6g^c5=YZntGoWx;jI
z$rw%`No~xzUa!z2-kWEhHs!rktp-u_RpMV(6m%#ocPUlHRcM=%xP{;mV^(v{&X)NU
zFRMCkHiuC4MF!SgX!i{vI{slG@P1@5qL43w#5cFd;&wxla8Vnby1%m%Kglz?|Db5-
zeWGY=Wu{i0TUCTaqg?cIlZH;o(Pv49?LIo()Y?qSH2ogO-@AhFDG3hx<aAy0RkMjy
zeU+CBKim)R!^I8j@p<$Oh<G$(7Ecl!_>#qZsl19AS(vNQ+YJ!XEO^>`zmDzsLb4BS
z&h6cXiRzmSG_xTGd%B%bX7}{s1nF}sWwqC`@^8=tE}gCp-KVwtx}00GI|Q@{8)~M{
z(t)%E2p6h+MriO#T$O1)^CH9K1K={pl^E)aL+X?Kyd9NFcDH+zt*92R;RL=gly?)<
z@Qx3>p-n!Si&pT};F)8e@;uL~GvFy|PSwV{T^_a$t~#{xxP4Z`10A@tcUieqZ81pP
z);Il&3!n_F7dHBahRc~)D6}V}ctwtsvcek`aCxDQ7L<xx7V<vBVVqgZhFj4(lWNTL
zcS$;HszaiIlgCvLh^#Oiu|-3A1*t8eT9sr>-o<3R2$6Q5Y%THI9IIaEM;ca@fp4QB
zwb!vZTbtrSdPr_hMKgb}Ja7As#Afs|Bo~@IP-}D;fvG*W(GEJ1oGo&1H!0Q}Y3afP
z>`Gk+$BCS*uQh56)NXLpBB<E$jq`Dea2e)R8Kr=Zvn`bQDY|4DKh|>*TRcaL-)!*>
zX^^Bblg?prXvsEiN0B9h<;1S1#o88qjQ^2d;)by;wZm9)anZ8Pc?Cs_%9n^PDyxcv
zEZQPI=<C=?ta%k?>eEPkIc=<;gS-x%Ycs#wM|Q%8I&3GQ0+Gf{G<=Jr*IoGrd`-$e
z$9-TUZVS|Od3;PIWvG&5&zoW95hCpv!a|Z*MW|Vyg?w$%N{2&x_oY6N6ZM5LSbVMQ
zGbqb?J-72ePbJ+mc<d{U8=rB_x)#5GLdxYaw}5~>pM36Mc6A%uetYO*9ZO*<^?jId
z86tF9O<n$pv~y|p$NWMfde&ULWN;B<KGFCK3iTK!6*b+_03B6%A{dLEy6gN9<j3HL
z<Q6jWVhbb96SE&;0+m23U*|7UOIZjH=Ew^Q&Irb~UlGI;vXl1mDBE)<2+1e!YrJo@
zPrfF<#PO(DtQ6Wt%aWrt0`A`Cpz3Szz;1_22@MB)h#oPB{%&TXMSE|ej42B0?D>L#
zokUn0d%@~8HB~b>;=4kL*#?j{6d-d5<i<1>x|Hy?$4TQMLHO(HEa$tTSw3aA5kos4
zPljcHD?IaNQ<i|ZR`-3m<Kd03Tg%~zM~Ab5{&5ae2G3T)SfiGNz6KA~YkVof7z08m
zAU&AJlxbV{s9xJ^c%X~@bZ7Xs<!b%O4;*X0%`$QI5x0nCy`CD@ND6zPtRsBkxKgvT
z#Y@VLJyo<r@bt!gxz-1ZVXo=QAJuVUM>u~(5bQ4-PsH$q+?RtHDZCM1u-?Qe)S&F@
z#%mL%<&wg+jy4zWVF<PCiQVqxS+}G6kkxiFj(u|SZHmi#9UNQo=(H{%4QnP%dYuA@
zvXBZHB|zG@zxQWA>4C@EvbIjK=mDGteHK=+)?kGj@uk@)rrERv^v*>m)Pt-A=@G?^
zS?HpGp=sSjwWL)cL>KBDXE(s=w{8CHBZT279G}s<6qnajOy+wh>V(mX655}cZnTtc
zlZ*O=5({{5L26?&OUmN$bF-I1et+(_zgRwM7(+8AIz0Njp>^@=T>;c+-gfrFI&1nZ
zYs9EH`lXg%wH|+UIrxUVR#EXpy%7;(ucO*SXDXyR>Vq)oi}6hq=QBmSQk^#{1kQLY
z9JyG`vKbvA@yuLSw0Ds<FX7RY^I_4@`IA(GDG|eanXKksW$c_S`uejzU?g<%!{QQD
z$L~|8X@;p)FK>kvpJXGQyH-*j?DK(!kyp|Ko=?%r4L7>(zKI|TLwyA9M*L3cJ0?CA
zd`l%bFzj;A{L%%}5esME`6L?)JtJWzKVIk^wu#fHZNL{&Y#9B*;&6iD>79-nlbI0s
zsU+N5u_$ozv7oi0c#R^n#u@w1vxsMiROb91?#DKU6we_Gwx^NQvB>Wh20P38p^?x<
zkt*c1b6E^2{3*eQq~7!~zf_f#NG-nN!hn!)sHOeyjFiOJ2RGjT(eLa>T71useB%$N
ziqdb=1U^%tp$vay_bF(7?y1zbCoe5h@t^s#?zYzctSm|{lGAv>-+iyOUL9vNGNqE^
ztzaXSI-_R7JHH&NJ!uOn`3&=S9AD;}Fj{eq2JXpI{CJ<%rj@M!5nX!gM#$#-^<$0>
z?O?Yea9dX87H~_-b<8d5N0GX)bWP>EplB_ogWja?4N@*g^^)IR3>|hU53&8+AG6d{
z9p(?&fBdpIa!_Ts`mPJB%NvM38LX#gRKr!(!n_dCD6InX1g`hf4pA_#XH0fqlUhEq
zx`k|IxTC}StMQ+QJWDXX87<=Si@v2L`2|b985biB`8vL!c2#s8gm-XMlzEkiKq#<X
zD8DqT)TpdQ#-nQG7Y!HMU04IY{1|2Uj+Y}+Xw}mKZ@j7F!c7wh$$zM5))v<H0m@kz
z?CQOz>zxho;yy_`BDKLX_j{C6!t_5ohm;HOyQz|%c&U@Lv<VLfw1td$mzQEha>~TM
z3n9r|c8~_jmY?p^Bn0i+RWjTD_WBi?TgUmki-d+Dc=+(%jiApRFU!xb-Su|sZY)dc
zYiQ4jr2DZ5r?e`}DQKmO2faauJj*M7C@(o{?X_i8w~9KS4u?E3sa|cdi3~~k8WfVP
zk9uh6b{5dAJHVs%OMfC@ZvPA8SCg>UC9i9XO-46)VBLBl$e_H=Nm70-z5?OT1s%Z<
zvvjf4!JV~kU<NU?qO)vGVbX8k6`A>1XKcEbK@`Cv#jZ#GdXjj-m#EaY+;;8o&Xmie
z^wamu+Pow*iDs0cU^(h9L9A)Nj3+!_qLYesNV7M_Rdt^Cw<fuK8Z8iU$6u7>D0XSR
zXcCs43n!J>3LH)f$I+Xz40&1h;Km<Th=$n5PojK)G2}L;H{f*LLh2Cj4X?`)T~u;!
zTrrhNF}3;=<{veW)SE{IZf0F`U{4|+febxyn$3HxJ_}{fJ$9#eS0c6Xa`tN&EVMtN
z2y~vexAQMK&b)EEjv()$CZ$FZ*h4M&=p0R;$n{;vB>5qSkaq1ySQ+SJ+hdcskxKTS
zK5^3ChH={7=%iP89@DXw$F@f=$*r8n<x2W>)O^lgZ;^Xd@)C9c699g}iAX~6nH&*j
zg!y-)@W&ayOj2Ljzh@p^&n4e!v;rFV^tx2{HofJ6>V-%;{2X4?OqHD9G-b6~RUPhn
z@Y9YupUARqA_YJ0{3N<)3!$(SwdSTNx#+3S&`zvO|DgzsD!Q&LR%G%z6+fcxU31$_
z^T;Nk;eWAr0IOkbaj07y4QVUVtFSg_0Vb9?e(e3tMEflgOkZLl#gqJkB%Ng0_5iEy
zad+acYtVy`HE3>o#X{ct{p~eFw|O7MsN#E1!twIrYFtxp2xWyoYf)^i*Df+x)_bnK
zh>v)tJ1ezl^t{TXP;jzTlYhU|DB}y)nf*wS>+O!O2^yMQqYS-kG!Yf5#!Hd0*{%|@
zYW2NiA1fLIa}6>oax;e|xm2)w*=on#Vi-n^wokrknfJuy`t_KmH{8XvjNAJ%IrHfg
zcdkk3VzaxYmWi^V$Mnl7fR&)2&fQDHcsmPfFmGrXJt^I1Cc!eY^JQi(^3(gCvAb<^
z-bF~uaR~b``U}2b5y%{<R*>r&m#nyKQ<H2=ci#*i8+)r#q2Z?5h^v!~wFb11K$PM{
zup`(e{H}Lys2^~?VC;CX<WKZ!Y0v#HgFCF}L6x|+8$>Vl8k_N3j=$&<&}>Fj9Aw-Q
zzeA1pB6@!G+^VYl1YKwt6m0w9Bj=M(t?M&qIA)xdNQg37$MNE*v4pP9tsS5<eD>5D
zytvMw3S^kDAlqk7ME0QM$D{9@o`AKzGYbc(htjyYSn><W)lrI(c5sc=nbF*&WKtA=
zj`z)w@GrLnH0n2#gpBtLJ4AIWOwGlfQ&Z!pK8-wNxJ8X1Z`1meWzLzD{Gga6gqTS-
zU}%r<dn_OP&L{;HeWDl}CW18%tnku07<8|H4JX~8?56ELqSDjjw%(hVO{F2+s)4IJ
zPQdOm3>!sG$v!f|r>jWEhK{Y=qBGt&JStfrN=w?8bALv`#WNMLT?Cf(55>@P^26uj
zEWFwK6aHaR<EJK`Qk~&VMru?0Mu8t(9B3Z6&(tq9mG7E`H>_r=l(2OUCad_4GOxS-
z#<a`Gt7gyJnV<{0w`vLW#NJdS9|IcPtc^PP(CfLbu{t00di*>1&eLwBPs$d~AD$#w
z@{RtkawXCTo<pjBoy#}Q3wj8eJ#{Olf6FcA8?O(43o_<>(~N2il|!VGA0EVf)B2o6
zDM(bOrS`1yj9gY$rdSU<p0l$P7(%<j1fKGD>=F5Ox&n0aHQpRMus>TYU+MRn+UgaW
za$Uz3kG<EYf(R+H)6aDGPH!s71+5;)Yxmd4sg=%@VjUDbG%(w#KDSdi+=vJcC)r+=
zrQYVXq_0!dM=$q&FDCAoVat71^7bd~uM9nZHty(hT?S5Ij9}ms^B0%<-vh1lD`z^p
zW6#fMx$J613RoEHokVP&e{_}{&2Y+lytl0Hu=OM4lt*8-a^olp^NeKc?$p#5;2t6w
zV87|;E(QHfFRr=8#rS3hM2HnOe;&3P{-`ilDr7m7AhcvFp8iR+jtc5%&{r#RP~}M`
zQSFOF5&Q@dNHy+F`iJjn^fl(AJlf3iQ}K3gZ$}>_v$yyq8f^`#OMJ>jx2v{&<#_yL
zhJq&bP_r_x??>9!VE5V65j9=^Y?*J{LyX<yMkgU!IYuVlDkXzQWzX3Ab!=De=p71x
zUWY#~Gr^83qzUOb=~}NQ(BKSM-7n<unF6Q-nv+gr_xG-!R4(AL88pWh@`(~yclC{E
zEDVi6jb^qt4i66+ey#OTw8f%L!y9PJ*>j`@i;!GZyprK1p*smJW<yywT2C96QuM##
z3rVE_Ar+@kc4?N@?44Z2KKh&fBBTjX;8c9|r*yl)s2~v&>WW`?+Ic3jsP*R%Ll0j<
zPXTfWU^GWmNZ<x|+R-;-5OrQa;Fw{G8pbvp%*Kcn6qz6^AC}~l_*zQ5?(L+zH@YJ#
zjU8`B^r)1zO6Sk~d5LO2IrS~QJO_EFCkeIE<t8G7`<kK5uXwF05{u~5c3n3FpZZTp
zGj+VWxAnU*kxM<6wE@D`wN*88!W9YJqyZgnZ?6kcCFC@ndsTD{ZY<G}4dgV?W9R1Q
z$huc%=UW#btlr%^8=?kEW3y<0Ypz@m1KiT1L}T&QRA$pn;$<^p=OmE%dsQf37FFQL
z{Cf+lb0xLu5xe!#3Zk!2PBV3<{BWRg;rz2VSs9ge`A5N0>ulC3aUC_V%?c_T|Grf1
zuKX`Xv7!FLxPxQEPt_LYH)@0OvTijF!aR}GgAO<EE*$-oHCFjjMHP?2Fh1Y32U;Ae
zv#r^^L})@3+jh?q9H<v$(&QTbjeiw027x)x4K-iewD+A5d>UJs+?%!WcL{D*KNWk^
z0yA6y&*^M;93U`ro|Sq=B_&TmCA@k?<^<-f-%*T^M)3wc8t^3#TDg68wD^{^@uw<1
zR%I`GOEqr!_Ci<rGnvN^8xB9f!^cDQMlPChnbQ+h{6DcTJagtZV<jC3dgwvGWF~et
z(Cn1e{Pg+9*2vz<ybX&_-oLShJOpvaB<$I7cJYU)Y;4wmP{RvgpXz2FyCS>$?}mDP
zr3tB7;Z`mrBXn#)$zDqdhoiNHRO5BP$5YmOgC9H?P-%SXp5ash4{s*kBaLR%RSWqT
zIq`wz{4w`JTUCuIibtlg?hFYu5CjoK=0I3TX7vgw)!1`25llRkBb*X0B)lAYna?PA
z+u+@8sRS9>T&n^}x772W2g#(f>fEcKIN_4C;vNjocr8IJV{b%tqqsV_?^E6r|8AsF
zn`H2ER4sF3K6WyqCbleKBQGLaqLo<&<)0POTbrzHl1)2O$oVV{r#tJ?IS$?)zAN&B
z>?Q-e0;^CGN+<(c448WMBzo!`t>Yt8)}>imSg1|`egcZ7So$I9id$o*tNCN3f)vC_
z^fc&^eR;&PNS9khqXT%3^B3)rh}Y)mqZK9=DtO%~bh4!A>A4%wJqE%PNzS~6<4AZV
z<8pGKYaF=AmU4BGpR$L1;5jcE{jyMV)K)ucy=&m0F>^fvn&B8>16n<wnejSrf1`d)
z^fh*TAlnK^m`MUc474NrzgDwC0Gx|_wLTBw2@THN8*gSsnk~~5Z9Tc==aM)-M+$MM
zRLJV1KS$K)Td8wfhTs8%+WrDn07<}qccy=SdPd2oQ#?K^_T%i{oJxwsOf8rX_x1aw
z)LK*>@bC2)r#~yJ(RB2{@2C+ozQu~^A1>47uX#rRsCZNSIu4t?v;L2>kIeHFb~I|F
z9I;>aT0i`{5wPE}N2lEMqXVF%2ov5!0>mC$MNLe+sNhLe_w0wK_RDtl#dnn}^4S?z
zB#Q3Ck&{T*e0TytD+!E#4&KeM{T({Q`{+Y<3vyM%w)W;hW7Tz>)J_2~FkfK_Pzlyl
z^tf7%&*tGCz|>US>T@$GXHnuG`@DKVKML<(vEBU7=^pJp0B*4`YTQFfs=eh1GF?7F
zzgMsHlTICu8!oR+d>?RKJqUgpR=OeJ*Rx+EeC+nCApSF7cHN=STdAqD(?!GjlOa;6
zT^J87K;(3-kR9_Fkn=vW%$wk4Q!=LJ-8eoITdrJ7%M#~4cF!cpRPwaPbj+X0Zas2s
z+GB1w*PhU7%Z#hVvr<hKz8LidfSThr=lLBk((`5De9gIm0sE@2-w<B7a=>6}Q?*0h
z|Gbxb{d^c{cw}^yE;{j;GuNNj+E6oY=4G#FYlo$N=C~Q``Gi%bUzCI1j)99c5ygN2
z_cecXI&Ng1nhAci2{4%mKDng^daX7|a$}RmKhhw_tL$uYywl<>qlh1EQRmIIS>mzX
z2p{0a3OD}reh1PYcs$*|=z<as1>yAUxqoO`X65FdSh63Adko0&zA3#9@Md^okXm`!
zi@(Zmn+8T8+H}|ZsJ-Fzw{hZv0q&5Vx2Yn}|7Wed`4S+T%3qlC)8OnUb{GmU_*g(&
zh8LJBEB{1&*{@eUQ6hg#CutPWLW|;>nrerHGYY=ncKJ7iz+$i7J49F1x-?q8r9O6g
z2YxLD>99ke)`?F;?4De_p&aF9*L2nEJxhQZW%q*WNeGko4WNTKWbrRk#__Qin_p`h
z%l+Y|s+i61m_mk_-ghVdf+<G@v^lQahi(7OSf39kKr5k}WBYpjCVor0;-a0d%+2GV
z6oa?s#of0~NxsQCJP`#V-R6*Fkip*eSKU(0ODeFVPX0ALx+9UZgWX3@krU0Ej$Kt$
z3mHyFUYjut7c6Uh|3MA_SV*H=iQpwQQByylEOhSfA|ihyO<RDPsEm%9CsUg9k^-uR
zg6RS7loJb6hs(zmU#ax{-Mlx}x(sKZlR`hDjiCEoy%#Mx)PJ!`m;!({TMv)Bqzo`H
z2ewEgAwf_7H<WeNq=2l5ZcwSFP!L`c=7fM~u{LT4A{KXQ%L8*{vuA%1Cvdd#J7mlr
z8_QoP_{Y0fv-J0W0u8x(f00k|l>_<`ki<xQ#h3>?*ndT{DS+e(i5n2g-XDSkbSVQA
z2W@y^7%qt&B^Ye}vZ=sCcmK639v4}FXG@s35&-8vdwc`1o60JKE=UOf>#|pkNj3n3
zmoru?kZiVH(IhSSwfofdF2a4HT5kX05%amCZuk!9Q9RHeaM>t+gBuY1_pCs_zoU5-
z22QZfcixDg+~|@wN_+c}ag*+{omG><eB{L=JdnPk_vojw+V2T1xJqgR0Ol8f%&WEe
z@AUCMI2qrRT(WW%9H#Kk74C=#&86Euy^uTY71<Pc<$}YYZS)FkWG^`FR#xZdu7vR4
zVNg>Ta5gpu)v=fbT9=%58lL^swqpRNo$V`;I~NiqBDtDUa0GaMcZ@7ArR?(^prH`j
z-L<v-@0PvlvY!Ls&s3OC=ee&2SBkI*%)o(D()>pCx_CH|2s=F)aDKkH_?Pa3?t(Vs
z|BX>FcHk!5Bn}32T^j3xi)uER|Ji{ClUpYKQDCl9!TH=YgI(7iY3=B##RWZze!k^2
zwJP7tvB$>?IzAiy(&o~_I(oI2ovO(rM}sF9_%b+^S9!(h)?m>kce!QXQLZ^)o=`B}
zcJ^<I6itU0_U#=mB17<?;_?8MBvhyLAeiFe>qGMn7i+~O1Il+i?i7qMJ}!+DPgh$;
zYV5$JTix}DA3pWcuu%C@wasNNNQ{+4ux&#AhWq2*Tp4htl2LXz1m&(*`iTBMknbGX
zVOJK%Lwvz}=Oce<OA>>*w1*P#`u%N%AalChiKntmSJbc5{WjH-m++9%1}M_hLRPHU
z|J*2*^5lZxjX5h??1?Y#B~{<lE$2d{*##pmu8GUVE-|^T;DLPkz+i_(6V%QfldwE_
zPrUq!p>nrBMES4l&?bZX5r1RQH_gK_DLVGk3M+BH50psT#v`f;>F?v*n^VTHlg#Ge
zc^oOi^uc9)UA<2{!nF-1_n%n~7wc{6e4+qQ%<R}~Mm$w1I06~t84dbFXmx5XE(Gcu
zHiYwMA;VP-e<{2)C%{Nu6a7Nm<!|^%?^9)SJbWJ);(#BF{Fu^T+2aWo@dW5bzhgS7
zFJ%iQ%fweQ%vs}@Cdt$0_U@f>H!Z?vQ;`uDs%n69Mb>KO1rl1P!yUW8ybGvoVgeNC
zMD`Qpe?&LnuT=@vViF$jjSt}yTZRgeCdRw(OfdpJoX?lmfz%?8gNsTG;3}@CW$0tk
z<1bMmzu^CsvHGJ&(&YFnqCf<f4>qE<8eML$xPprSfP8U0a;W9e-+>dJZ*3fh8okuD
z;gR55X$orA#0SN=7jg5OTxs2m>`~ACoA2MhCmF2(y`T8tUXgco8g~HB$>5Y4nhPvZ
zx^t-(jn@HU&t$s4_D%ij0@q&<;{6@twI2R(&@E$i1=9EL{RT2+*#hDl_>9R3${+YX
zRLQ8x+<mZSVM$6m@<h#c^Vbm1Z}A0kDmvlM*CH0>-kVhY(aAggk(Z><VgH;In*F8Q
z0*OUlCwGBg>%^mD@0UT@qqI})U5s#mwcOkpvqCUCukdj}_OOojYf~C8TP^JmPOBM~
zny!okZSB#t9DoqMzt>5=u*VW?v?IVD`Fgfo;2$$=gK^f@URv|W0H;4w*z62w10gv+
zsd}6&vy$}7$VQ1px5t23f9G9`FoxQf-oKDJ2Gt)-e?2?Q|Bv5}2`4?bKybPHD@Wlg
z*0F~w{9(d?hMN#z2ZtaZ-8RIhJO>X+5<E(MQzm629&rdLt}7>?=i2NSwAuIi#j(*&
ze|GBm|09?9e+fYfo&(wjAqV)n0UqxwjpIwdh+7gUiT@UD|I<<_(HDU)xCQ8o{%59i
zW$jm<6Iiue0Ep7|ltci=@~LXdODvc>FLU8Bc=g4s@w}Cf3O6#|C*?-feCAwSm|WPs
zyMFvluLbq^vJ;5n#6PPG8;;*mEX511Yk#X86#tmq)Bd){%kBkMm;)dG`#cQIu)DO6
zRB&tLY)No&O=FX2sCzYaPn|S1HJuJ_4BeNw5A7t+TmKE&8!4JOIQN>a-+Q4)cB@2`
zmx<8t{Wa`c*D&y<uVIq-{Ga~2Vv22L<RDy!5~`an7SCp+;&S`_HeT01{I3;$u=^JK
zBn^cQivIhHUc77MV;>me4n6k_ewQC}Nln|mcUO<JB7$j%(Xc27i@yEuKIGLd%84+@
z;wJ-G8m@LW;eRc-2lf72=)bkoe~E%Y8hA8fpI+9h2Pj~bHgd51IY9hx$m?ILko<7L
zyd$)HLT==FC1w!tcoKYv`2VKpua<IT2bOWk>G;|6XB*O*Y{1iKdbdn5{Ud?b@&fN(
zw^_E_`)5}v<bXERkV`%Yxbe>(=j{_fIQe{bWS8%LOA0>{p1{=StMU(pY^@BeQ)%`r
z;!-%i38a8_nwhUs|1%-47+gqa3v2H8)jD5EfPJx+i%|W;b)I8Cwc2>D99klCVHVO=
z7gDYg#sEIy;~y-P(nYqSqCMtX+BL%<jC(2A6(j6t9tW=?7$qDBAA`#T)}v@D%OrSJ
zrRc#lF0RdatX?4v2E1^^eLEs=g-u@ADH0(MS8*465AqCBgt0CtEC;cPXZ3C;1m(fh
z7dY%F8sv(~ju@m=>zl%h(<+P8o;$bOA-KD>W2;EOzgcFs=zlMYl28SQ!rH>aLjmEG
zd=R$5`?HB!Az#T1|D<%&lZ=3hlO<eYTU)QGHsWF|<TWX2ynYPFYYhM7%fkZVmnAip
zY)y79e}vy(f&XQnr@Qo38N{!@5cM|9dWP#)PYWzY7>(iG#IzMyNXaxH=t!h1J60Q4
zXeYH1(Yqpc%$U9j$8jcoOSN*hb`_l_aqJ_R0@B^|!0-ywUmVlzEBaQ&4>q1@uNUNM
z3`EHb_Y*l{O|R%3OSd5kqc_{9FRg-#O}fo=Ci^+s)eKr+>I{XoU=Xih9s3ZcV69wx
z_)oq#x-+C0IZ*ZaEbjloxD-Xwd#LFyH7lE+@kh?3qYX1t3rZ46E?sDBy)BF2LL=bp
zBqs^&W=}uiO0_BPj4PKYBgs#mqtgh^Y%R{Dr`R^c&Yy-dCB`u|gS=oS3-)HgS&1eI
zD;%{Ug{gTf6tk*_N%m{ALt89pe5r>{Qbu|c6o?F9VDZ(e&D4!QX6ERGc^1;M?=}6i
z;q-HqTVf7Fhc2d}&O8=V;I(~HbmsjtU++04hAhwuS?!m@j<OF7sa-1qwFz5z&=(6#
zhw^6oAgIKoHIlY&quV*`)Cdaa-JzuGL$7ZXg1i`=>*^fl&vY?I8PS%9O&z!AstD`C
zAO=iu`LpA|J=JqsXd8HY61}I5zAt~K&}M4+CjSZ<kCao&T?~=(K~}STUHjr<*MFf4
zw-9fbbAp$D?xf4$p7}J^Nu4<Xl!-hC!MZNIbqKee`ka?C{$vZ<TL-k&*bcXCNQ8sv
zU_`s55M&56&~Oayq*-o>u<o9W1&*Di5vN1=KVCJ>ZS%53^xOeXeftW0UNq^Kj3?Gl
zD2Q9SibS~~uZcAgZ(;pIHU6XbE9nmbg>o&VX1a20ZWmkQ1?GoY!H7u(4zP3ON4omC
z5i+S(y<#dP>vkH+S$_#|x-Q-cEyQA@#PcBU1!lWXuEUbs_`RssZ`E=-EQO?F{o1>u
z3YaS^u09M#fky^`3@ALEWH*`}0ffmkE2DGF$>XsBCr1Wd<sug~tKO5FLbzA%;VH>I
zlrHtOtv5^&37RCH1Z&$*LGBYV@?an_JZu}q$8kKG7>n`NiS`wp&cKURhumKA=Ux`_
zLC}Sw!@RwKUUD;3&`z88jtTuyyZ?4Ib}?w-hFyCuh8?cN3axvS1Cq9HfP=g*YFQzn
zaz;8q4%F{=OQMOVIP_Lsac3}a{L`J1K#!tsvf!1l&##LF_iVfsoD`-mlju8hZ91x_
z`5FJIH^%qt5zTUI*AZEmS8DQ6N;3Smb1caDsm>i9GOBM>BoPyAjLkI=5%RGhOPJsS
zt$XMUqV<3aNg~#bC-znkRv+X>y2HGnasp!!sREfT(AtGnf8DeT3+XvZZf(cEQZ+kF
z$TLEv-wESL!!su3#`35Q*h8c%+{<Nf;@Iom=5zP?KuAR|?=}+}?^IgKAtSkFjcQt^
zs-N4D5Mnqp7PpxOi<oK$p~;{yUUF#Y>xL3bG}d{O)D|cY@65?;B(V3PO;_@E+J)U%
z?KMH=nELT{Z>uwH5u!1nPxlDvq_!doQA~G);+MNHuaKSV0@($k-)jFhZA|>NZEDt4
z-At&*y?q~v<I${_a7X??9vl7L_|$jVhvA`u!=Yiv@on^cU%ijpBagPl{aWJMfWq&V
zz-hD|+-Nj&L?3XWNu*#Pu^G@es{6dAdfoNa4GVT2x_AI$_6s_4L-zt;h~CdX+eNN~
z5+MC<v*jM%fqXso=VDaxX(eliF-4h?^c)6gxhqt+7!S~u;u!<zaH;k6UwM+h)~kOf
z(k(h%H;{r!EF`I8Eik(Gi|+a?4~r&6sZ%CV^@WO9Hu#E!GN#}a3}7K~>)wS;Yb~{T
z6*D0_+_82@c2gWyF#2*F#M$z=#Cemb>_**Xi5IM_b<@}&EOxggA6+@iNN?-}n5m1s
z)ojXc5$f&j$<zJ%VrP1gm+FvxiREEMFAs29I1SgWP%VYqyy&hY71)HIcNheF5>MxS
zjn;`T$g`iqab(TcI}C6Ji7HIR+Q`cL69pssNUD=IuWvE0CANwN0u3NOihNX-Qd_<t
zJO65<%To*N%?81_ohNBfqiekTp{Gf;r>_9iupgx+y;9^a(#eA|QBx+w2YlzkmM#Kc
zL?jv+#B3rC4?3!h*<e*=NMSEYR2uez_*_i1Zo8YI6g=WKNfjO%@BAloVH*nP6n{8^
zniAc)qM(RSgsXp~@}gMLgyZd#YT5a@5$=2y2VC)iE~Z^#JMVUv_*Pf7gg}vzo(Vn-
zg#nRCo{&y9Dt)iJ4N0CA`zU2{vT1C`5H9-ClTKGIW>Pw4asLD43GkV}bNbc``ut_g
z8{`MUC$Li+sm<FZ<8s)eS8>h@=?i??VZEE(l5<)zb&jh8_d0j8s`|+J2c=*aDAlGw
z;NU$4W3pcd*|zs~gO}Uq?JdoALHZXq<{HJc9k3h;gl^TBraEA}TP@KTXlMq1?E$CR
zp+yLGTgHz4_c6u$J3;|hKvfJF0hOFoZIoNxm{*O$bnm|S<ma74COqyi+rs@DuFZrV
zB{M$I6ugy3k}DX_K@12#hKV0O5=Ig5v^`ve!pb9?-D`z4^A-|Rja#hYufey%zyI5>
zUBR}?uPhvhYK)>5N&b(NL<%z)@Rmf6MmOT$+xqzJwBK>|VKBfu#P~;nz@NyW|C^H!
z07Nlm?Lk+|f5(2NsMKcK$Ek28Ofb^=V2?fmpq5JpTyoT`+OC5?$g>`7Z^ZPo)(>#W
zhw|dbahi#fV^Ry6Hp}Y^2Zs_~Ob3n52Oen9dFy#?(RtfuLN)lqtrxN@%(X#0chTP)
zpb>N4hfHTNV&|a;&w=RS{-#2;-!`5jTe#mWOTYYX3E`^oR9T57vX*dMaF*&@Rk`Vm
zoRNb#^A^Tss2X{WO-2!qO7<@X$NF0bqWXrz7dPT9w;Z5v4M1?e9l85wK2jq3wF7?W
zQ7rULAZQt2cYFwSid$~odDrD8XqQ~A47@M7W)P<}jb?Ecx{_@{^3M<Dvv#zz+$6=5
zD-&W!FVqqO{Gu(G6UcMCiRoBATxOH7>tFVTDB^n-ULY3hWUByYu@5`yjlouA@#w9@
zLC*!AYJr=)`>}RYSaz?~wQf9Y*~tHG><wqyH*4^9BXRGSbicN|KW`;LH?wuO7f^`a
z3x$velqYc7>BIEvrH(Uz)~XKxq+7cwklky5yB&8Is-IU%D4U54v@5()h<pD<A-G33
z=$bAR;_ie0=L&&vEV{GDr{otNh^o?DaOD#|yl}ZlmZzFqAav_(AIV=?l3O~zcWP4N
zfk0PbN;-L9S*JU%gcHd@<=j^958wtRf*Tft{>UpHgZAWsDJ|T!i>eNmOzW#T)C<rx
z)T}Ayya@9j4%GX@OxKJ5iop_nq*IN`j>4KezbVukQdKfk&NhB)-$shGbU~s(fFCLy
zU_j$|+s*jM^FEa0otxpG8jx@VP0Jn(=<imsAb!FboX1F=JL&`7Ks$^G30QJCK+m&D
zy#crgM!SgWz_U~+!*&DV<w3<B@NNEtx`Bdw5^n{E-Tsp-UBl+`9h}Jos9L6e)=$$l
zCZgOb*?L_X?`YA^>!4`1-c#)xHDGu@0wN60eymHsU;YWh1IAb)zfRO0)$cd8f}!Kk
zI^xdbIj=}xHX}_h`)|Lt|N4T~AOFL~Z~MRdp9>41bI6|-UY@&#w@f7Se;pg9++V*&
z5x>K07DjsI-ej)BLwdH!-D8yt+@7$jiiKw_6EGd7?}#C>PMRba3^|st&OT|MKgD32
z#5kC;59IY6IOW^pXJzWXeb~hI@!Gzf#Tmw!0VaGTXPg2(CqG3zN@>Omgz%2(-XC7y
zbq>~bPS-WMum`Hl-fp`7K-Hl@zOMJ{Id=X`=pb#wwa-;{p)kajd^_o75l4E4^r@Pa
zkOSfUBVzAXo{O;PB$Kv7yMw}OBi;)R+8?6TZSme>S`KsDWf4Bc7@M+v@+UHymeU^?
z^GrA}ih-L*PO$FWMJRR0#|o1s+mk2H#nBbQxECnxLaY57Q;Uuc8wl!PJUatC--P+W
zou~D|FhsrLYh&pve`JeUX;dcWc95{_(aPr~ZUwdOwA<lsYAMzyAfG&Y#${KyfAg>z
zbW$=y;xW$L_>R8QGeDUh|9Bp~Le}96`PC@}bZkN#cOwej(9{?4juU6NX_#bc1jF};
zOAR&40G+e~mcLGfW;ELMaWkBvw-@Gp>@uM1D7;~gX7t@4b6MDktgANWeS}_(J;XW)
zpAVm|!v?T|HyM#w;S`oMuf=OZbXD(=mLvm&Rtat@ai0C)hee+tj9CIC!eULJf1C*S
z`}XEz0pWW`zF<4{<?{Hq4LF4Y=}m<%V~&5jh~WD|5vYs2I9Z_<`SX{K@|g1gl<Lz7
zcvIfl3#%(W-S2r2j_2SPae`pn_l01u5&()L0<KO29p!-jAO`?1!8T;V{bswOR67<(
zg1SzBU4F3POv?qxY_m!&685o5B@+VRqA+#GCbe(Hfu}LXP!q1sgABQdUV4SWw@Yfo
zOxx`GF4OvV*I}GO@pnwWrI#L(UEqt*FIQ*!`6aR@z2X=vM?CLleR|B5Cmky|Q(^&P
zwSgPoJys--L(iOH;xzw44a1q%`oO~>{%yPshStPt`6-qS(u4jB2x@dObb;&2!x=8%
z$4%rS&Utv(@=CSYZjtDfj5iu~OhAT+fr7=12<-p9U=c+e37@+D8BWc7c`Qw2L7G;T
zVp_8Q_W4{z{>&HEB4*I%$v;Ip-;GDNR7%Ftdu%&q<_W@UMoitECjsB*Nl)(!o(cCN
zSLaazdtKYRQ}bBKj$RkJ6&!DyjmsuESCZr)jXdqkQGbqohD2?cP1<D5p!F^eM3e$@
z8wmV*Kr-DPA0r=n{W@c8-_(UsEOh3;D3EMWRNx;MJ?RP_gFzg{pic3C?-q@Aqxs{e
ztF~tfgHNVK3xVBA{GO{;{3FX1X6yw(l@j#scHDBjF2-0n>kQi-wewF_ymr#;^(Ia6
z5OlUkA}wW~#$?+=r0Ga_kv>`PQb2k-+;{;{LZs;mfQ@Eg^}%lB+w8*I*MXqz*%Y%4
zX;qN+3g>ZL#B5%%B2s_}_1TSlC(}7r_!HcUA?zx9Od%)vV{O?bFACL&K(4NwLWUqX
z)_!ERL4ed8=n(7dpVVklu#SqbfYR3gCkzEPha$cTkFRX}|5V)uPOldKqAvQw@0ZYJ
zwa0_RmP05n@W|sn8#%cDB7CX>C)tUMg>Tu<4g<OWmBJ?oPYr~I4-i(n+;I8hO#30b
zRHvvQH-XC_g@5ypzPo|8vy2x&7j^--(hHsc4qXAudv3OD6xW3piy<VsJ$^gQ$Qn5u
z{P0`kxh&0wl3Wy^+#;uN{~35h$^g)D^A7T=aQurGBg?1^VjNy^f}p3Lo2!2m1O&lw
z46lDC=|AN&M=u7TJnQW+Mon}1Ot<_2r>GiPjP(zyqkxeCI{2Rqrzr<+^=#-_5<!J&
zV9gPX&Sn3?dzsR9_|-IbKpa4TM}6;z10?Df5)VWV<0UD2Nm4nIPd^q8rdzpxoDk|J
z=<Kh%)KVB*#dnEvho6(T{g*!{_xb-pI5OdZ3n-lJD*lgHOVKQ`>Ob4YdrqNACJ<Vf
zrgAo^!|tH#`_jCAE1qO;%yKaf@DRlje4Dmjj?Iz}TO{Yg|HPrJO_y<~>>4fbeD?E9
za0=&W!n#s|0EnSJJZ3LoSn$HBfABW=18<4y(#Q)BmM@%MxD7(HP@VZ+Ms;}xaH{>0
z8e}LC*46zhtn*O?a8G4ffAU$+_(s*Tf5oCJvPVMS->R#vaNg`LG>Ks0Yp5>ph;aGT
z)W$u+x^|#Mp>v3LDUE(^g#SPYad+sq1A$Fp!_g6}^V+lpu)OZrjMSLfOmn^8riTUy
zZMlm9k!G6EW7^_G6F@CIprzY{=Pl4JASnm3?`f6eewDF`gTB3iCyu1L<?eI(Rauh%
z8AI_4;Z_l)0oSk}68b*X4Wnf)8QA|E;z5y@Uj0}g`So9E*_B%UO+j7S<>IEr1@e39
z(rr3E!+g<ZdeCQlXNH9Eq6RjbZ4t3J0)}QSpV`a!OORI^`_C+hrB32Vj8tW3g>;{v
z?6D6Pe}_EqwDop)fjF`1J24a&j~JcQ_H%C7&Q0>N4`b9n%NA;rxOLR}(M^BQDLF2K
zW+*Gy`+B{0-(<Z)m{%;7sWF8dPQ-=*2t_(phb523oet8tD<>SB*3A+t|LaIRq`D9N
z)s1F0=3A8j*ks1y{G;>O7}lQ*X?E{4q56dmTcJyGb<)q-s{~0Z>V;$0;vFHj<<G@9
zm&o+P64R#5^kj+0D%-H5b$`-p;_R?+d3Mk`nhlBbroPeexfJ9WJx?pxq*f~U6K5l)
zrr1V=m}$Ao20m!FU*fb_RK7bQR?cH(e*1(<YU@j*$g-#CXvC?@)Q$raXiQ%Jx2pc&
zB%5>Sw6k2DQ$bvH;Q0ddut?nxP)SlGlkIhc5jVc%)+5b=OJ&452TELZZ2G4x`W?}m
zQ`8qe;nBeWBo8;|qD=Nf{=A8&q|38hF)szqw*O80<W9->G3~#6^qiViIMkPd6GDFx
zA2=G=KM@DlF4=l4Zwjwhy2L4eLza`C?q+aym>clk7ww&QO#?r6aXc41*@f>2=7v95
z->W5`F#X-KtZ$oXbM(Vt2VUEJ>hj>cvfk@d<JA0Y=}qm~O&x<y%!1P;&D|2i2Dh_s
z$n&PVr{+gP6Z*P2L`6~sO7R(O5e?t{hXUUg#OvzmPYgERmjH!VdDM3T-ZFvtMOqq4
zxUYS7OBh|?aYAP&r7;k8WL<aKC_8m~gT$rQWorJ&1-Szxz6ZgrFhj>`V<+mfEpU;y
zrps>9Wk!4uEEZfXYqZ1u>s$ZLOXTaH!JZ1~K|w}F^}%DfswGE>qncJP8tr|*_DRSu
zL81<vD+<~ZCm*bj8!J>f%^w=p9{e^`ID!9g!2I-#n>)UcsiKXKlX3V=UTTO^!f92K
zS({OPeD{gMfr#-q;Tu7)=b+@JYx;L$lpp%Qb=dM|nc>^3u>9tw1-*8ifq!u`R>+wg
zPonbPxu2e_D%xl%Yte@I-JDSic~x?=%VlFAFDvAQ(E7^!UF(y%SPlB;s`EAJYS5$P
zB@RapUxY#ZBYNefGwmV$p(KX5qsfVMGpU|CLcC#jg|Z}<_ZgYSLL1l<M$d@XKh>C7
z8a~ZH&=5A}`R|yTuf^V8v*!2+aIUWZn2~Vb^RGCb8S_q2Qc(8x71}t{k9$dmTo#Xj
z?F6Yw=9DUKJWoB4YCL%F<)!ErGeVf;y>L_|2d<-q7SdAHO*kxgZB3fDg_Z9F6^iw>
zot1bap(u2Gb>9IC0*aQD(P0HX)@G8Y5K$*}Rif}}T)(+!tk+VXjzX~hDOmso4jm<!
zI$3<wD<=3~?o!xy4yYP+efCBgo}k=nq#7+-C)p|Dvy^BHGh&GO{qSqNeg##Y9$`Ta
zdV(s)zq^kL>+`+Z>7%2bk@T_w+RnY|?fRUz$B63w;sWR)P_haKHFnK-FA$3@?>MwW
zo%WcO>UIWT1u!Xf^ASRjdHb(3Q{^A03`GM0`crA^jT_}f{p9hQYlGjniN%>@COZ07
zygFE-p#s4@F0kt&Os4T6J)D@FLM~F03I;7mUN17wDJIaOv?tT=XywN6t_5Sy#Gyi0
zFW{Ph>cr_xh1IGVa9!a*C4#ta9lx&ZVbH0eH$3^uH~ngnx^#*r6gN&<8jE??iT>F8
z3jTT1Wq^|B1Eirb`up-mWqV5hsyzZ;o8DWtOU*r6wFX{z8a*q30tYVEc_qIo8848u
z5)izvdp^g=?fTo+!oDnL0=-*r$I&_57{v&FKoRdp77slNHbmHYB)PCPKo1=@a~F%e
zR4Aelhq*jr3%^;dr?%CVR^k(9N9%V|XSfctc^GCV%lGQPS=5X>#m>64F79coathT2
z_bhRb_1OFXK~`msLwHi+VMLCzFn-4d!qta6WCtF++uS0J&8)G6UVgLKry0DKRL)`N
zb5h;$--PKTR@8P(FJs(--c0T8y4aZeyuu}23S?Go(4C4(2Cu-`d6$9%F*MsIIuK@R
z+{<-kQoS;_s*N1Z!o9`<s$OvlMKEP%#DKai`cL%Sw0CC2H^i!>yOxvEem6EwuL`kL
z<enA37?F?2<9F8sQAAU&ejGZ<1<!tV<Sr8%y{TforvkC9RtRHzPUinQgn&RzBt@(B
z<UmtJp$~a%*DF8~Z+6Hj)RCuSHmlVCEv!Pme6xvvguzlEFp*!Bo<PvtR-b5X`A$E=
z{9U2u-ihGx+)D5YPRKL&cm0u%5OMyiyl|^(FY{_ftB(@Gtrh7{{cyi+6aScZ9g5&U
z4LB*vtz<5psUj>+!%gBQI-pV=lTLyYwZ>Hz%tQ#8HjdRHeUrtmVW?)nx|~J1cb}K~
z$nZTf3Bl1ytL)>0cUaz{j4Db!qzr|H1D|Sxm^*q7nN17Gh{VdCo3I3S#y;($QY~@I
zh8pc)Wg6`yY;$jRjin+|=1a1k3HECByc*2Y$|B+(D*k?|Ev%t`Zgo{o`aeeub3pe3
zjpCK%Ix+(whxj5ab_%v?zqni1!+7{FfKya5+L?|4%w}9?b8e$4w<oml-dOiQMkc6_
zt`Or?kZ~$&k1nsm3L5{C?l4=CpxpfTE%gK`ohLNMJNiZL%Zw5SSuAh7_>|5OsY?*|
z)qpa*)j@~Aoa$Q|*Y7->akobA2}yW9ewfyz@IW#rlf1{ht>>=NjVkFl({`GM#&<3P
z&U)k3_si!#f44FD<a6TEF`1GGZY-K@RLSZ<pWZFJ_06t_X;!~XQX|v1?S*~iCecDM
zDk^YqcMWQu_LG|Tfh_vgtL(O&yB2EShZ<Gt&Z}i-k5y$YmQa$X<r|p;!32aeXX~KV
z=$O3n)KdNmUC-`b*OPanZE4y<dfEd`9t|nNn%WNNIb5PdPh-yy`>hLXv!gBVu)0m%
zJ*)?|{k(@;=o*W14cqRTxK+`%d%u=~nq|6+9gI0@tur1|P4D)|qevFk<Gr^_H<ASh
zt+FI%f1D|~|7M#Vi-DdyqS0SK6b?@3%aU2^g$Wjek!8^2)9CoUwJu(Z=^^E{PkZsI
zwMsMmPY7eU2do`<2l$NT2RcRB7p?mzJfJC?-wHdAZ_39D52HpOde5q6n(xC)T@QM7
z<-6U;ZCqa}7VW9ozgV3WEz^tlu9E9&Y<OxpbmIt71ktSOZO~Aazlk^Lpgpch=!z#X
zOF6E2D*~A;Jf^%?v_A&|DnMQwJL&tygzZ$6^1zKqM0J3qqYdQNM%v<v$iwh(7aNA<
zqiyti?@fYmFznQT=aAHEm`tkW;`Ss1=X@ik%UgbNR#f0jj10)E`wk$DoA<#A-P%vB
z!m~vGw|YAe0_=BXF@WLD@U!QriH*ZTB5+m?JfZC{j@W#hcYjsb`Dw{sDrb8<%rwhB
ze`l$kXXcFA9WpHhF_ABmh;6Hl`8vy|u!LphWCHen;n3&2Lt3C;rh358ojRGW>TW*p
zq*c&iZMEc#w%lt(V_GxD@zp4ui~7fr5o7CBi@w8Di3BxNukP_inS43_I^#4sm9FDg
znnmd{()KY?Ugw6V(O(PmpVhW6j7O>Srz)%`Pf>QRv~0^dZZ5S>6Uv>h?`t-^i$~OZ
zc9%)*bhO2UX|%z-5U}Tqg3ohvor<^9Lqb9xcxrhoFXx~I4q`kTbd}H2c(mq}@9L#!
z9`Fog>t)SAUBo|e=cx&uGD$2#r*)QX!Ys0f2l<EgSo%meJ5G`(3*)my8W$OqAJcgq
z6X_l}ox>ZrPm{r8$J{QKYX)_*lgVYgl?^Tp9KC?o-7lvs$Xe-udOROXToz~ZKHqa+
z*je0d%X%|xi2enZI;gZsT(}cI$y#&%V}|IB=S-M8jIr0~)CDA-mf?`u-urxm*9lF3
zFmc~=qLXnVm&tN#H!$&Thp1~)Yc5tTP+G)0O2NClt2SrB+7AM5q(<pt*}mh|3}96w
z0`m5B4qIYGOo98*0N_6KKfTsDU*a>|3i9b+<&7W>D<N=a99gDmdGDQ;{MO3WeKU)(
zfDV^a$qJ*L2LKM{sFsMvZwqb+2lp^x0~g65J;u-55Yog%6I;JDAZ2X|9pM<e{pXGI
z^pLkchI9`b(~kE#6ORpR*E(Kku73TV^=?`)t><uE$;iPZk362r+r6GcZeK|AS%u%4
zlD5)&TiIHbbP4BH(N?FEjznza4d>Bc;%T|*X63H?u8F5J&OIJ%^`G}pL+xt;KOvuw
zXAgc;_IQ-BqpDkoXC$rDSNjyyh-kpAk0dJHix_`PR!OqHaYJDf@hU7)ouOrqHwRMK
zZ0O=Yn~Uvjn3bP}v%f>K=S!7I^*2uMuuP6-BNts<ZM#R>8_si;2nShDG|a7+p6T|_
zdO$OOZ+|X{gH8>pk1}!Y!oEh=Iu=(+&7RWFX8N;aR^599_da5RZY33pO~T#CA`E8E
zDh(&4&NflCg;P1ZNV=l&aHLjVDIt_(^a1LO#ziVa-Nm!KC)uS7#out+uTQl^PFwW~
zC4SGwfJ%3m2h%ZpIr*+la~DkXFePxs@OS-vWjB%o$Smmht|%#Rtp!tWWJ()baT?rw
zUGPy8PU<{N=?ts?;C6k742Te;dP$XCUnDL9FAdIvjW`GA-4UYGH1@r$COJ|9sT-nK
z;LSV0{|^FH-vvqH&4KqF#P8xahug~7Vndo<jEoPPjCsdfHc}+K6dNiR1sm|@lqk?u
z3Y#0xy?gS;ZSoFLm47@W23~0sMTz9Q&V-@pmaG>in)>ufN4z=&rn5K~{G~*!$EI<P
zt49hPd31B&I2yQM5gr#xnVr*>DEFLEi^em|p2(q5X1H!+y8nVsC*3QME&~H6_XbVc
zkn0%^i_?zVizUPZMOF1@Mmwp5$E(qr5qH(?_77|~)uWu|i(3vi+9f6h*Q+YFtv3S+
zl{p6=1m?w6c=Yj0kiD9pm^DiUseU??QY!Tz`P_W>CwgKaSXKKZ$0iC9QS-_Yf`VFe
z+?k~<h(wCnhQxpB)XzbZfsJ-B3*LyT3HQ{oDfQ_OA{z9EUM^xfk01YHR#MCnKruEP
zSsqwSP)Bj;X=a>PEie{LTWPzE=?g@sLQOedc^t5M&lDq7Yd6Hs+EpJc=H|rlWj;Su
zWS%&kaF-~Z@qUq?%&w?*G==H5ZYkEd1Jj9m+9-MSX53oc{B$Eaj`o*W2WKmJ2`A;s
zWLah|^k+xWM5%@%;G^c2&TN+G-neJDx%uJzyCo}MO7fLr7y^MX6^u(y#oh5XgDgBQ
zBOq{(lOoj1HUhq%E;D;7rxFS-BNWP($d|yQb6hca9CnJgg0}ma!>GFzUc>sQ^vVZ(
zCP%z6_}V@n*edDyL8jM_`1ju?Dwei&>3|4Q|DjjxhBJqd8Gqx1lD1<{*BL=0&hdDC
znP4tVt$GW3-DUWW%(;Ld>6@%*izQ?U?Mzi5dy{Dm!&u>1<$C3qY96g}{M+1T`VYBM
z&Kr)~c|j`_4tL(Is{Sw9-ZQAF^$Yt}5ji$c5IIV-P>xtQN)tkeii$ysQWb<KRl2lL
z0*Q)>fPeym)F4%Aq<4bSL`vuc0t5*XAcPPCNgyP7H~!Bv@0a((^W~kv8HZ#t?45hx
z_gdHbt!ovddr#)x7l;INK_t-UiBR*2)o|B~1md!~W(j(9>gq&DOf+Des+K~2Fz23H
zcW<gxx;}X7GHVi#%8%BxxeL*3^9#5#jUq+JC@EbY&uP{OK&)RaRD-C9=L*DClhKI!
z`4IP42M|{y#>*&Z_x@4{ZPWv^&(V@Kyq22xrO|kHdoKip1opmLKJD`hUk~=6NcIZ_
zx5z2({aa3lSH^TdqFhFM9{xUQ_VoOo(S<TJZBUoau-7Qf*dp@n({!#(c3tzwkRS0E
zR?@dtykc_{j981=#7S+V*GTLa%;4Zh^8#|`zWPbLX;4pw$%^u8Ocff>?Tpc@{&e8y
zP*X&Q5xJrg*=ek%CXKzoVNGL6tPlFWO*w7z3%z&pu2#AuSIuD~u^8#xJ2`h+D`BaH
z-5VmXTGh{zYLaG`dAB_x)uJ);p_Z6w-}u{_B<4FWib}WI#Z%tFOaYu*d)ofIpzk`=
zz;xyZ!y+?g7iyRoN^MBFOxj~89h$hsGA>b-(X2HuYWC0Px#TvzV85+ocWG2Un|NQ#
z)#E@suYTg)wZk>cr<<SjDka%Cp(rOx*l7atPaqqHisqs@vQFC=aA2-esLI9`5xM3#
z<y!bsaa^w#&_o7)TWuw<BKw?8!2pD0_}7=c8N<^U*y-&?aRC?EWz;k|_0lD{KQb|F
z%&T=<v_W5NOuJqP``D%vz<G)^Y-}v+AhVu2xbwxbqO4wRB7-XeaDI$&um9nTJ=qbk
zi&3yP?i}&SMG-%7n_HFx=0!qn9~0Zf*Hy3^Vhsua*Ldj#05EM&|L*gh0GEwJAD3#H
zNE$jZ^LMdpqM{D^Pq>5{#)$0iL#iWeL-YccpUGtTA;*tgtXuZupL73Hb-5-XHv@Ru
zK`ii+hX9EWU0_3yCRY8T0(qj!JIv;DnXPeKuv57Gn4r9sFJ<qBzrx0V!!5+jD_j1C
z_0~^hgS2&OUE7dGj9Nr1k1<8<NY67_t*C0g-Bh{e8?V;bzq#g+6z@8@nW3qnx%j}R
z4@^jtoWy!eJ#bw4y?M6&8B^{f%b&RqEo)X6m;&7gJ88VH2E4BZgQQCL22GjSGcN|%
zT+z2gQ$vp`)ioi!3Uc2oOR1Q#`mVOFCx#$HK$&(GtU-yGtA<g|vBH725xhd;zxK!x
z$h>XYUO2&ec6%XXLJ7S7)I2hD5{xLnB>l_mB{NO7D*+!819b=f*L1DB`mD9V+RFM|
zj+G0bh}dN9A8_rsNKtm#-c5=y({T|^rM;8czlEFqh;#e((Wt!4#sq`?HGSTHiWLfN
zWXKG!IHK=IB*7{V)`U7l6&y>CYiVjR^WeeqTz$*2a+~?k8y58>Iwe`Z2d(k(Q)t)s
zilpSZ#h^u+;y>dEX1Rnx1ASiDga&a5>7#R%T^ABGk3R_Ek|e4r^<C{wpaot}VA3c0
zrC78K_ZcHH$&bH$KO_C&Bgj`2L691@+1e@pnA%$UE3QXSX7$-$GqMX$?@8&&_J{Ws
zi!7W3D7S~=ihbEa3%i5+H#T-bI&pMHDUHk&rUz_GqiUx6L&=-}QM!q{g8NG&dJi9t
z9>@VUUZD`XGQkhaTHZH-D-kgrD1lW*Rs^7`(UOorn25*KLS2RXEl}?d1u}StLh0kj
z*Y6Q$Gfs}?-;2M^9Ll*IW<DITmd^ru<X7<X7RbiHo+B5VU$xD<d%R@qB$<9rdj^0~
z{_{lxSE@rtg)mSQgQOTZPmpH<@3qg*$xXfYmQ~wd#2=F@&6^*0<=x8mXAC3fr$bpV
zhQ!4ORLtn4Za3LTEuw9a=0&JCv^s)#@?)Ztn)Ghuuyd+XD^u%@G08I?zimy-bQhdg
zpB<}p4zIiIljWZ<u4o|WVk}?CuGJ<Db?FArDIzMrPv3M8{anBfp^2ZpQcc|83?CpE
z%`$NYajY+AT0sk2hCmjryhlkr)h$UxI`g+>QnK+PTXw`AGF}iKV&6<DFRKr>y8?vD
zlEkUPhgjoMRU2D)eIiVAa(%um_N(0Hf?8DNR&~Tlhxs==UN)(k>k!y%Ez5bCH%0eb
zvw5`f9L`_2(tuvo<s@#w?ulZW*s~)Tw_m@@B1un35O$W50*-F(R{F1ao~45Mrx@S$
zcc>vCC77j9sK2u)x!Cb6EN8)Gz9PKA60J>*ubp6kJI|(Cema07-dTbTyrQ@r>R#oY
zwKk1!nrfT(Q7P`hu|{Y}{R(V++5))MEW~yr$ds;W!>Ko{cj@_PMV6)~Aj~%>$-~4L
z4I54+?`Q*T0v(6S3q{%_L*QXkd)qzyy1w|=2koyvD7&0Z=;-Y$js2tXVGWyOZ<8`d
z1R6Sa${7dw<v{f!AVJ4(*q_Sv4F$>>Hzi7B*ke1CxK3r0&Wt5n967>7I+7%KA6dK+
z&xqcts!lU&ORskq%Z^FZi6=`+roSR<9hT}hZVKKQ{M@SNw;i}fJVPVo*K9E_8mjiK
z4P{6e?pck&qmj7&`OyMh|6bVPzGoIlDTOjkNQOZ6j$rXW!T5=#8vifZ^jDj)K!K6`
z`%l6MFyGBz-M_B*iyEi87YAU7`2Nf=A=mW|>+mXf4A`mjZ|kH4*WN}SQ|?$pEwu<1
zWbF&+P2f|>Z4>^Mv8tRjxsPAlD<QRaRWh{W{BCUazfd?g=8`%iW@h*>@8$YX-b=sx
zCT_IbSxo_6v%YKeOt;#u8KW%M{#h4nK)6#ecnMSxj$9ot&?0mRiagS$o|S#N_>()a
z0HVR;9YR{$9G2*&H_od|Jl$-})c-+GTnSfFna|(0SMTb8eag8$prTD;sG0j#S!^#W
z2g|u&Yf5}uJY*k<Tcx1B-I)rRZpo2}(-?dN3C==<P?m0`z{%NNhUX17NO~SuJl8(A
zS-`mfI0U(+WcYjT?#e1HQ7JLmtxs)#3w-|yia&u+b!^7;tR`8w@ip?s-<0`Z<8Ud4
zj-((c*-*`6EWgs<X#Z36@RgZBhxqv<n}VuoM%ION{Xw4mfX-W}YcBacvopYL@om(4
zc22A5dfU9S-(vrvEnu?2RNT?}bNlm$m;renb|FxkPK~P>_t7eg8l9xk1om^FPM7R|
z{)sZr7=UTQxa_7gWzhiLx49sTmxm|E!d*U!aoTjsjQ^8QpGKn|Yv2vtmOGS=0B?T`
z8I?2{V+-*<!~!KhyQIyhNfy_EQ??>>xxz*?Rq|x2-@-kg^7p0@o9o{M3~tS56k=lA
z#8RW8qOzd9Lc%iD(??(;Cj(O=4X*gzJ?^#VS)~ouw!S0ei)qC)Xrh?f+&7=5@u<e&
z#0()7l{(GI0^~`s?Cl*C<&@=4=$Q?D<W#<Z3hTiFY!(mhQ7dg$RyX2)AhObD`sQJl
zrEpA4&3#E8LpoF?sQz=qCCTg}#pHLkwA6PmSOI3(hjqH$jqNBy(TyQSN5KzYB&p9M
zWn;N4!MgTW+Ua^O$>`(Eg^Z|tY$ih&sG=TdbeW)WXuT<{MB3|8ozRVSLwkeSDwVn(
z)#k@B5-C_=Z`!-}9FV7yI_3^ALQco-Ya&kFJZtFP*a_ne+3Kf#=y<WgZ1FtjPt_+n
z5hjFDY>6PDDPmRObMVS|o_@d**8<DQu-N|fNh#IH^%+z-bS=Bp{BoC^nscQH=l6v)
z;^+wf@Ar6jC3QZKp?QY!rj+#}DB<Srw(d%b%Ig+J!oRTaf#ekImGJ~Dx1q+LqSvE+
zl@usKIocZdE7+Lx^u~s>xu_4A&mQvB@EG}iG)Ymhm>@@2<?1O3D5;}pf+e->K<?+j
zN1(DllS8L{b?389{Wr1mMX1{{isIwjQ3*;zMC1y1N~<d1xV8$xvV-ni4~a<?N?Ao;
z>W(K*f-`(iN-rOW_i@E6%ing}Sdf8A2GNZVY+lHKPsA+5LWU&^Ah<t+2m*ho4h<Ni
zhsK?HC{&BefH1x6t}kIZCt4SRxB6{X#CC|Os+DZF{27|2vAd4Tp#i9gj`w%N@^ebd
zxgB|=C3~fRS?B!SN^hNs*7B(|5-@0YBG*<(frAY;KJ5FLaI8yn<$|CfIJ>JKoF>`l
zLs!^URB2{x1Nu3%R_h93-z(x%zK*sro&+x{YDABH&Bz#9Tg_%Q-*NA26>59GbC}M(
zeQsSguJCO<>eV0Uw3He{n^=YGw>uFKcSnbQ8Vx~gFYAZ)M%|BS_eJ#z8T_7Z>WX+j
z9|iNtwZm-=7&Q_A&8y0sH6kCJ6r2*-YHB8<eAKPaODoe6i_a$p8dsnVvzD7=B@1H>
zw80il;{>d)37i1%QQ;{%H&!58Z-RYAJ~kuX=NX;^G<mI&jEV;2V@Hx`yc8Ixpr@yt
zxS*V4$Cy3eQDj#MU3#Z{eGF1+nK7B=CG`${jQflupY5+(+2&Wz@#h>YJkb2(5n}!+
z`J1CBy4I(kUG60dfJhc6bgFn<obo>rmMKNi4M{FHhMk5U;mj19cm6@V8S|#EM=eT+
z1-aBdRjT-a7+SVSS;rCQKMJHFEMv71it_ksjV858do0Qfux}m;6;CycV`nQswUJQZ
zCWI=~)%qCfi&MtC4eS_=^!azgj3#CoimG8KNC}^90?9f}auY13ypis(E#`IHS#OX0
zsCBBQuq*~#JuNeXSC_K)j3u5tGT!-ZlyI@pW)EAL`3Cz??V54<NSHgW!a-9u{kn6p
zMy3i7jXjs~(*d`5(XF?u8Ji{2mw8b@nHUhk!kvqR#xtC|d~~$J`W|>)bFR;jnbR)Y
zd`i7MGBTp*zHkhpxqpDWmFP4TrLp@#J78}5=6(T6iPwr<=*CG!n|rMka4_gE-VwzS
z32thmqhAV_KJiSZzAOdDf1R2v&dU(gqVyoO0w!mMd8WauD_2W(8$=d*!5dn`!^JmD
zztwvY&qPaWUOOAUPS5zXK8}FB0FLAEs(gjS5}SL)ADs7YZ?f~WsN=N6JgKXJnOlkM
ziaH?s=30$tSqf9msuy;ov;x9qsb%H|XDx9|Zzy%^o)=GEv`N{t(z>;82@|DAaKJoh
zRV|tj5qZjyQR%P>FVigh>YUJpFTcLq-f-w>_@4;z^d2a%e|7;w65`Ml(-OS4?@d{o
z(1Bzn*+=dfSt{p5>Wt$bHLOdRPkdT0HvByul;`6GO@Y&SG0Bm=gg5}4`@~ckLMC9i
z&6d?qr&HA>RTf{;qa|-AEHqxuciH~IJ2{Mlt{grQ(87Bso~o;<x>wHmZWpxq;X8Yr
za4*|Kb*q!sx%Wv)vq$;9jYCg~4od2h%&xBKo&3hxE$~UpCX^&%)M4v)s}5=apGPE5
zpodGzK-pcN+}Ji4$8@18MNtUM&pTI9n@nqE##6O`)yqI;al4%)kDMqC2q~IRjr`#z
z_M=Bp@$#mk!evcKRDp(gYNx!VyE;`Pg(-HW3d6aVYCHAiuyXU4Xo`l*)O;^A`>(05
z;;He=ikmvE@ljylZ=VnXV^4Hvj1>ln^}LV6h*e6DuigD<2uo1i9?#=OULZJgCN-5M
zIX&BrGk<lSf^=N^dT@CU_vZg)>)|Pg->LkFUZbk{Lhi@_Y9^rY0%#<OLXk9k92XE3
zd62|kMa{PDS5ud<EE^vilB$R*8FnvH2XQsK`%j1U1jUFs+BWWQ`5e*PE40yS&e?FU
zY{&@ims5{Dr0?!oINBO(>Ehp5@7uqDSb|}s@_oZ=Kjw$^edU~lOy-A=1r^;QoGq&=
zc*>p0zwPQk9Byu8eT>6Ds)4b%OPRLiQyY|`{8Aa08aoOpcyTPRkaRzQ!Mxk~l=%<Q
zP>)H;=oDE}BPYC^4h~sa=+B{om7B9c@LHVnK<B=NezXXMe7Njxkfq@3;8m61-$JNC
zhT$8_L!9+iJbu{|n3xuSL7hCSV))yLW~;N4IzL72i5?MJADnLuX0+^=*77!aEeKW(
zdLV1FZFyGpg3y`YKwiyqQ51uN2>y9+j{xm2DW28Y!!Cf19Gxv-B=R?LfVB|~lNmn0
z+Zl8&ny`n72oOXApbFYvG_}cD3r*SBn()~AY3nTY@Iqc3W0tXxGFZ@hLrGJSHBd_i
z_ilNZEIu`q^eVgrTQReNCj!MSxQ6WDSu8$Vyg4W`6`xk>Q$BRHY_AP5$lImv$uA2G
z(+2Xz&R5p-*JfVXX~sS;&e=a2_h(Lqx!sX@)1VhYp3MlT*0=G0$^Xox4I`M<>$b!O
zBGPk;UQz_XxCH2UfV{^n!C$5zRRHhzd33|enn0E<*fw|dpA|CjpVf>}%THBIrHpOg
z*NDdIQ$*7{Acksa_4b;Vki9z>#~+qc51%A{(+8JtgRI!0ve`3tb5;O|0dzrkOXK36
zWB_(0TnZz21wYGBYOb5kNO)kJe8$nBS)Kfk+I3K!T?O?DdyDxcv^m0quQ=gcNi$#)
zb7MKwc29dC=zCM!pUd6D=>)h0$-_X@r$=VS4l6FL{HlYmkbg2rn@4ND4@c9w7j#*p
z;s4@VF4foAtZoPKdL+LOe+UxT>aW{4-BTV^n$D?P+YUswQUCS7D^cT{f|rU=U3eC4
zO~(Y#W}oK%=E};LxX?u7ixR%vegu=f-}_-FGr`GeNVL<kxB8E&sj1x(OOBN)iBh-)
z5)xXcxy9wA|BOzS0K&(ob_`B~-v~-N%0DsB&X@57+~|t7aBg(}%p>Lb95zVuvu3<#
z-bRVE7v2mH01Q~3)KgwwKc^T-JFi(*XW=GG$PRZm@xK0nN9yq2ZST^5(AaaV9PdH&
zAOG9t{(SeOt5&8gj~wp#J)ocf9_n$eih}>qNP?bl|0%2j)Y?CpFhQUYQf#`)sN5wF
zmi#3_1$!Z8m(h+^T6e0ym}QGJK3MbGa>d4>(!U;NZS4IIunG6x)$O|r0cUmn<8;Nn
zx>wj&(Ai|}A&2#+$`Yoe4uaMPz;skyCPy${18J6qK`3H5-fX4hZ+j(HFzx)~kZ4e~
z%V>pqB1g+*!>QQL*GqN`zX1u%HeuKv{_*2*lkJNYu3z${3zQ^gontXx>KXsO&iw0~
z-1A)XqFh3L?AT$kw7+F5qP{ZANY}@J5Jir5PN9oXRUy~#Czf3`cfYilollNdiRj%8
zUu;6QnN0})?fcL73nJTLWvLIVXDjM#6*w+YBo3PYBClsN#_JUdW69#i-xinS*o$H<
zVlbb53|;LiOi!~>Mt9s`F-F7KCjIO@ezsR}e*K9ey!&=L3YE%Zq!!jPKASc?FTpQY
z$)ZCAE!=q-P-b(x0zwGym4Ir>_*eW3_V4#&AxdE}KwS!#eR27`HQzr2gNBTGA@~QQ
z8>D-Q*$i!#=lUdQVx?B6K6Qoj7r>K0mW2`#1XUe?JvN(4C)S+%9|!D{Z_SqAy+&0{
zW8VT@Kl9)MKJV6})1^l&tz<1%(c4Vf|2l*;v^-w@WZ!^qO51D_!+~WRGAws?Oxjlr
zxo@2&QBuAvcb-KV(+f3Fvuk)IuMX<!=``S+&KFVL-`8mvS84ry%!RW4p*Jq!nOmGM
z`bt;bbS^zCH28;^A-qT}^{fDAv0&Ue$QZiSNFMPB{@naPB9@Z>Bn(l6iGMtGYygqU
z%X;mlC|d5x#ow_}`RrvvXuI7eCr*2-C=TLy@fYs(W?aRaNx%EzO50t+rDa=@<iudo
zX$H$pn45MC@1{+HK9{i@As?T^O^!Gz@wV`FL~py(1&zJ2?R6;u+AAXn*DgorrR^)N
znROP*T+i5*sMx#pzq8M(Is5EFi!c`o{XMTV4&h2n!=H{051G%&Md-P1Ojip8&qW6}
zC7vFbkQU&-24sNupgrcOU`tqFgC_EYTi;TNuMo2zWF6~L6<XIO7dDNG9{9DZE=t4w
zmr#veMS2^);|bvjN2SWGfz+VhSVEYFB30z?hvGraR@^NzVWV}<wD($M)%-!R-)Gh{
zXzwnUP1QO#6!@gQm1PPWc}xwNoy!m{GD!;o*T8(aKb|!4mXKiE@k~pT4w;aR<oGwP
z1G&zh!XoIM9F_Q?OoVsxVYPhCc*_R%gpj$BdVU|)q1aQ0aC!j*aR8JkBbPaJFNh$g
zF7ybpP%jVYQjM1Zkz*zV6hhuIR5-UK(VVlurjMeY0lTS#C&3ub^1}5cCV?UU6j+p-
zze}%}U~XL>yIXoh3fYwTvxBK)h0Vy_06u4!eT>+|8&#wYR0?+MHZ*PCy{k%Xq@SE1
zHckd=J1KKexs;U<)jGp=feG$H6;KtkF`+4oep>brO(jQbM4RA@*`_y*Ly*PI>;!6q
z$LP3@2+MV`gPit_-o|*TR||fuh=;zZO+9zXck<)h0*bD<y&t82buaHdn%Cmng(KU6
z!vUK9bj$;<zxX^mTnlVfV!J(9w-!62$li~P8#i7)!9K`)i3MJdJ<mL}Ef3-T!Hos6
z-uoY;@y?u%@igE#iTLs1j{R`;U3~+<&dYGRzdt7{>&AxCGakIQK?>r1BRbk}z_nKp
zEan)K8Y3I4pbGLxZzm+h|C8Pum-dXHTa#w~H(zBHQJ9)wHaTDx#p@!z8~S>)<EDDj
zTQp<7!g?KNzB0dQ|K@3ze12za5JWZQz`$7N`J1UZ^HJTZAbAeHVAn)9;lg4Cs~IqH
z89^%<#@S@~EX<y;_ottD^0CA>884M^&&F8^N;5Kx6Na8LwlnRwj>So*Z#gd;o(al^
zx?Of^+v#@BZ2e0WS!>*#p;?^t&VtC-uvaa`jx6tMs)RSJfaZiRJ|I~`mUAL|2j;{;
zK|MJC2krB@z*hrWy!)=fn=EYVuc@XPG_QHKa)C7e8?DMB)T#hGut@Lnkf|OC`XYjo
zOTlfH^S?#dS^+xKgDYP1@aS+6S3>p4Cf@YrlB=_6vdul%rwN`J6U4Ol6JGb)=Y}0t
zhv5eb@Qv)q{e^#1dxX-UPS-$0UM2-3o;oE*d(ONLgvpV;&Aj-I55U5z9O`*QzuB@e
zxZ%8lIp<@7_EQRtT}~h2Dnu(D)cH)Nq3(;D&OeQ>bG1v(Qmo!KN)q<m41Hy*2<Lx;
zHUb}@ZF>4@Yv|4DVv~oD+vg8Vg_xHKD|()y7&lNlD4pk<3-=GqvGCj#SpH{Ip7S+X
z@p{yTsEtO+Bl)I1%WLdQ7p1(*Wa!nE;;BR0{8a}p<M#O$CXl^4_oU{|o}^tX-+okM
zE#?_?Ey~#$DU+Nb(Mgy_UD=fA6xhBJR{A&}e-7Z-{_p)PDnAO(sg`Z_|H@YQFmCAH
zcSZ12(NLt}p0$?UB~W)GA{Wc;y=l0FzEf<3f-eo|Vw#Jvp<^Y}F7eT(xGN*kun^0D
z<+tXW7u35NH1^8T_NlEeGZfTem%TrE$_AN@VL-<rq{P^mf5ktfzbg1D9}v+ikt8xQ
z8<n=Va_)COx@OT!W4v$_yfG6krZ$+AHd%|vFXe}ZHvXD5PFS2(5x8sAiTfo0^b@=g
zK6|9Vv}Ehk61Vy2Cy588kxeaeE4L(IMaAk<k-bmyC!pngpe+DlyRsuGSO9r54@g2<
z<E__w!{AsOR{t8#$UNxjf(8jvZ%kzW-rZ!EdUGuA=c)(!sTpo^3XQ0H&O57D>A^sP
zx3?~P7@Uls`e$&7px|=PZ{owG&KEnMGiBq|tWpn7a0$%3fV0%tnbVGzk-fWSIE}`a
zQ|%E38<Z2gr7`(jD;12kg(hg=%GS9`I|iQJ?XZ$00c%*uD;RDXG+To6TlBVHwWBlK
zJKPobH`Cj3<+5wP1EZ1aU0qi7<1yVfxChKei(B#0@hrt^D-B*|VRx7KORD&uEzEdM
zY6q;qpP8@_Tnbcy^7b>OquFK8nRNTU@KsVOQp;Ez21EN*n>~qZvP^OCY5-+&>H6__
zZSbkGO_hwu-U4b^GTy-p(Tt+n0>V7Rt7FS=@Y}e^Cs&-WyNTc6Y257=Hdt?n?roeM
zTB~#Q)y$BV&NDY@4NBu`7@Co7kAJz-oTT?D;7AQfUsh|WepD2Q4c=a|^15R~lHHLo
zmn7gKya6r#b8AZNlK=oS72=$}^ib{3%X&InLjP+NvJ!09DZ??#aKJ`5CRJb_8mc>7
zn10j2^y@<-aq`gC#)p#c%Tj(ymt{4r6!Q=G-oJk)HLJAL*1z-2N!2e{BXx~#XaYQO
zx+!XeugZ!Y)C<VjjMdnU*Yt3IAuxKVt?u243Al6q!;Ta_2#q->n`5nfa(-FALDj<2
zjWcauSQx-x3HfkN=|L6w6LLlP{;!DMuKn#LhJlRfu}$s)^T5h3v%~&LQJsfIXYZ!z
ze_BkO^Pc=KdhK!hU-TM0x|mlxEcZB8za&Gd;Z=b4XVwaI-B$@RjpE*nX4sfinb$iT
zR@pKRakr7TQXJzd71PI!LpiU^GnuM0XaB5gg_#l^RD0WJAbt+qM?4o>96+<pn|^vB
zF?j>Zz_Q^Y6&^1=LI@cWUm>Oq)mkzZWt*M=C8T3SV++$p0jR_+6+Jw&+bX~#d7NSt
zXWB9LAlHkRr6eE0UKx+~TTEVoMZbmN9%<$_#aa`jA$f<f(|KMiEaLmhg-Cje=EU9`
zG;Zn#L30D6ova7tw|!WlEXYkC2r=nfvIgxGcN!Kx)KEX~NQ`o6KF|XViJ^^^i<@sn
zvyL~BIV-s2ImHPfMSB=(<*$pi{hQqq^T?rU9EOCs#7S^Mbta7$%THAD;fGaN(yrK&
zuh=&~)s!0Mgq8h!)uF=xmARLAM5nW6Y4m84n}>;;OZ$168}n}(W50`6>5-cJelp|p
zifnMk3d6?!*H4XgV@qKuarzxiwuk*)Nj-cD2JEx6rc5-^B%?NC^Vo2+&xV95wQsJ?
z=^`64!B<u>@l*Q}nx=P$FXd&;iDewB!s0jTf6@E$QauWy@V8i12tUo#+IOLuvH4dp
zt;n?z<eL8@z~Q5(@zB&w^xKB?MONdNCiqLD@1OpcD_BbPY=Gaqe9zr}<Mj%arT;o8
zezQ&?MSiw7p5Kul?A8XXY9gOuk-18jl!jk~sVQhy?G%8b^EHRZ^vry7E?K=EFX(Vj
zN;w(-x3o+Dj`pCHm91wVnp_=fAUl3x`jz#^l(|W_rmni)LhkBw+pX5?+|_$oHEwyr
zV<jlHQ)R7;0yv9f#rS!&1kR`e>%~FdD6mr8mn1SKOC48A7MQ^Kj(F64UX;Ko-#>mO
zVkC0@fy5HTV6CHN?$=&-`Pgiru5gy)Pb3N1@5ck@Fw|XU(b!%6EV$A!oX3o99*kxR
zM<QJ4Fp-gV(x7>EwPFR(zjLbp^4>xNLB4XE5*x_n9x!I_5SkKx0SQEW5X0WhZvP)2
znt7mA<qzE`6~gtPsJna<CO=p!Ux@UH|10ei1TULDRq^sXzYqI32cQdXx6e@IOXG@2
zz#wxRYvDA@<_r7xaq~}{6RE+FKgw<OBAQc5K1|amzBZ!d`)kBp_Nb`Cl7idKdU<a!
zuFTi=Z<eM{^hLpTkBI>CTSwy&@n^`i=b(&CvW<>kW+E)qVs#^gN=kh=1)Ha*>7zdM
zV(*PBVm~aLVJ`B>)s*>jF~XHo8v^lxNy!IV86BOaDJwx^3uIqK3VKvg#Gk&TQQ6<<
zH*;xm0_5y)Rc5?!)3Kmy2!eEMD3v4`>>8>RDaLO<heLu(^6h+GId>kH*Eq%nH?x9<
z8_RBxAiq&?*w8!|7I#-JlvBwP6Vyj2dj<afDdRKZHT-sna}h3#_N$NC*;vENUR0+F
ziRwiJl!CwQ#@?{ZGCeeZqDSSE^S`)-<BSXcB~dkd0ds_1;IGsD{wUdRIJ)n4BZX7f
zq`M7{$C7~~olPeV+;k#)A3M&Bv~b|9wwxB1kXTYRZvXujY737`1hW028}ZxjNxI=N
zU&hT`W!wu@Wz<JfQd45|L=MYL!d^Ft0#idbue+u0k^&#M^2f_<@+RaYI}0y{n=6)v
zdWCxipVRyWclS0<hh$z0?fqH=aUV>1@ZGmMqBlzCvc(Y2J?OjjVCbgjc1lI~;wV;T
zjzA$Ue`=dY7}!-<M{8=Ajh}F_-#~&ngQvlMU&bM;3rzeFXOXBAYVlNXvE}yij#os#
z%-%D36I@c6D{EeFgac85mIR{Y{c?69N6AU5oFaDYiFj(#?Rdp>Xiy8gH|pPRi!G&H
zdJ)H5HY5~W@2z*bq8h}4L#Y4=Vk=u8X95OeCfg43H>q{fkD!{G53gR%0BS%&J}Qq+
z)_9E+Z*=*JC)c18aUkp8@~0b{w8P>O4iDZGh1;chgWRv+y3M+UfsC38nbF*9@mAd<
z5tm-L*1UVHyC0ZREA3<ZvA|^eLxNI!O8L!HwDn_A2f_;SWqjaHh{F6eg?%#qvAz#x
zQ$O3F5X4r9*Ph%*(rz|9sAphYT3=i@Q5%q~u>P|jTY%Rlnz<Vl{$oSWJV8)%a{mRF
z%2>AXEWX-klhFN5!u)bjjQXbB96{k6cQnu>_>FgsV2uH3t~Tg~cKAEyyY$D3Y^c*z
zr}3&7Kv!M=zY$N@EQEYg@a`)Ua_X|9bW-!r7k$8Z%cfxQ1;6-(G-_PJE-Bz;QI`PP
z@CFtW>+crl>7_dIN=$Rq36(yoQxCfDQI>g+1=BPk?URp-YZBM0Fm!JQvR+kZpY9?N
z1dWms5$1>Fp5`(<$+DYMj`WWtfBJjBE~4~%{3C92^Y;2tk67W$p>`EbB5JqHs%T%Q
zLuzhAiuH|rj4U65rZYr#nkyzgUaOeirZ#Mm1y*ihK3z2nu=%&vP;ZA1vYD7G-ElYq
zsJSVCnw!=KPRWpv5sb$`+Srst%JRd$;Cao~ss&Phs<BaAmdzwxePuH5A+Ccb_Y&+d
z8j$?+hoz9&ZKJe7IE%tuq+#w;ESs`9OQM#3I=$E*X7L$IX7NTkSZ^F6WrHvm|6kWn
zg#Y^xqzPwUAb7zUvGHKppuwlk(G$k~Nl0Pjp%KR1WnWWOB^~888^}K=>T@vAe`F;Q
zySoCKX-M(${M_@9;oBfQe!_5Dr`6r@DKU-|4jF!<A-ov&CSK_ZN`9`9(Fe?SVLI*x
zJvVKz?d?E~vEBH+@Wcl=m591-9TN0pb@=yE%k0B$u%Wi|kb=)mCRDJ==J}5{KH*fk
z`V8q3ynB2g_45qCRQzchW9G282)HI^(V!;O3HjR4#_NCc@8kkY4y>s;uDV4(PXn;y
z0v3ttH8z175M(4N!Zp#QSGJKU8L(6FLI&lmwEY>)-&Yi~6z5|`Btp%L#f_QOHm|D4
zwRd;vT&H(g>7_0`tTcsqA>{eUY7n!oMV7Znk_nly9|5tv_kfqIcup6?$rDu>=Xbot
z9#t;gesoi$UjQTX01!LB9>mxH9y9{X$0LB)8QfpB-eRSWt8xQdW+>v~YduCv<h?=U
zh~DVDpFaNnh9T}ocIEL4j~tX#K<M=LaZh*mD<9LM%<lE8)Z+^JmbZxo>+a{(KtlTt
zYZ=~pP47urs9WTb40j0^wMlvKzg@Da>Qm6&80L-{4__r?90=`Zv5h!0N#wa|E~Y|Z
zY4ZBY1M0bHH^)?b2y*=K#kw9|mlwfw-hZ&_XSgf<R@3@wE22tky7C_1+q7<<g2-j0
z*-wSC%}gX4od-zUN`@x2zE@qefgGGJZ#4LDZLqdmF4pUgTx|ZoMmk_%HhiW9qzWcN
z(B3>`uTOmr-dW{7cW3^W9I4ewocm{>u+DzCCR%x%066~r3bJ3$fhrl)cqj@c_jQlZ
zzee^30AJW*N2p17<r07hop}ut;m%Z;s@1{zL;oXxOeT&k5KE;oSeZu-F}1LhFKHTC
zV`yT5M&!Olpc_<@xZlH?6?1%frQo+^?ETHhWWjuyys=FB)p%3ira~L5)#0NajA*w3
zaWPe2KUYpiI>_K9++%G#%y_8YO|OCLSUX)!CXT+;m%Jc01t4rMFG+t0Zep{Gn4i35
zj82d%>8%OOAjkV<nipk#Azme+rm!_jg1Ro268E8gYx%|EW=b|f!(%L)aL{jTB-`+c
z|0?6@fmzqmGWHN@qw9l_^bDSHzy-~v?*qGwI`F@tPf@fZi&jR8M0zYALQf(tk3k;Q
zUFRb?(OUyfLr&j}t0)=COH@gi?(dZ6ZB8|Iz6#ST^s`$7{asc|@6Nj<=XPrFZzdh?
zZOgtcX~AnyXVw|<{XFVUr1L|D_=<-7K5$@Ss%+qOVyc*5GePHzsDEWp`xT&hvjV`u
zp0Fgw*K(kv%|pIw4DWCH=2MKW=k(1^g6<ROVg+_1!6JkgGW1Z3yYTr(%;9?eG-Ppt
z#&1$!La7i_1Yibp5WUQ9IR`R&qO}LYZYSS5=Y80w6EK?FKFdbjUed1RuI~X%=;+<s
zjJxy6izwQ2kr1sbo^Uwl?0;TgeWmvA&_TNx&zDikr~dc5(Ahjm4c`p>vcqvHO_O~4
zjTQ7Q+Cb~yM5w7ePELJ?4)J}kG5;W1(|P7Oa$wGh%myM;E$`Wzsso#C`)f?RTwEfI
zC}WBf3Iu+jnCFl@c_nDWW{U1veCC<AS4sU7Ka(p~^O1cDb*x)Mox(M-t8Mdh47vE{
zAyLq4eats@<RIF4WQhoCq0re?44e*Z7+dSf5!4*xqfM)L;frq10xoT}Jurj}LE-ur
zs;mPR@*uUii_)O{TZ4gF5u*j-`a}dz`r>w!*z=yjpE+|Ktm&Z*Wwi_wSx<Z3!5xjs
zWB+iovnnI^lT%?nkD5YH8P-^*##z87fiu}?UMzhFE2z2XiwXh2`yt>2MR7X<YFtNY
z7fnG<6-@a}g&3d*CNIFhx4Z1>hpR`peq(~p3rmbfWwG{BqFIrLS7>H94164OvXMO`
zW_EedaF3CnuL;n$XUUj0ScmxDgxR15o<*NrHmltr;`W<k8?3vLC^L+lRz#@Mzvk}&
zM&*6Fav40L3Il-m3P&ff7fS!mjx6KOHb{zCy0p6aZ~a&=J9#XWe15c<DG*8;;O-t%
zg*GOo=N@1r$xOD#)I1y^1h|ZEWqLCQ^;P<QP4h@+-&XB}wF)T?QV{U#*rsMp(yHgh
zzzb>x6D}a%o?TNqO$MO{!DNt7illiHLx8*WyERzOVn(a+%EoE1=%;_Yw$A-CnqsY(
z5`@O^O~-X=fksO5(|DD>1jon~Sd+n+VQQABm;5|wV*<9BD8pYI14x27_nFirY$nHW
z?JGlm^wJ0Y_%;O8M-*dS78J6a(8DsVpbO>IuLrm%K`CAsq-~9@%)Lc+V6?hN$b_7t
za-^j_j~+$vp9;ichba-b*dYnD{?e$s+0&8pkb!rXc?@G$zNDKf%QWECvv`Z9GE0@)
zc;22BFPiVk;Aw5d4R`P@2y*4JjYj+C^slujsp8=Yn8#o)x?$9;wK^Zf4gJCi&&cO2
zU!nz1H%-(!G%K|6`}JqH)DRkr{1SHaaU|cR=2oQ^OKm`I`KCk!V=C00K;A79e$9GZ
z*Ls7b^RZe|f?KyYP=_6QCWZvt@fU&M7x2O0mRP`NbzzwMgZUit%a|R%@n*DBo*=+W
zkVL(7^Q^V20VIusoHN2!YNv#O4x!IN+Tq)Q!WJh2Wwb?Rb2i?@yp5;E;U_1T<&<PC
ze0?u?UxjxHY_ZItP;Y%ZUmKgIn9+%)u9Yq$dGe5u$ou%er{daEpA`+7fc>do=H`13
zPcT+=rs#UsP`uR2n5D4|_{yesyqq5{MK}0jbpZXNm_Pl9@%M>v8U-LJ2AFty<;PEu
zZQvo)IZ5NsmcLLKSa`>-W_*UTbcV)Uv}!I~{Xjs#=xt6zrAx*ix4si1Ag58?K|pAx
zuPtzP@g$AQv$;4))rmiEaAnO#A}H<ygdNq~2skDougIT4bY{Q20cI!rB+rJ^bLm|0
z))H!@gVQj(4AlHE9(Ly2s*KMT%G*qV!)aQN$Qg@RmQ&N_vIW=oquA9Ry9_dEK1gdr
z<B!RMpWKTMR>0yGU%#zH-ZExvQ+IaU$3v^q1TeBl*Peh@HZZYej*8+>I0Q=Ie*&?u
z>|*Cw=0;KVQuBksLW#MoNS|IQ>y!PwPc9V~zeW?9!{=icOH}j`U+53w;Z(0dl7Ct4
zY}0e75r2I0oDwB9Fsz<Q)wf~TUCXK(>gzG})Ty}R2q-)byi>QR18;4|r*fhTUdLx!
zCI|KXb#aTmxSJHvA!-q1m7-qxK!T}RP{UGN(kT0Ekg95MSJ^*kf^5a@INlqiW&zd?
zzJ)^_IN*nPs7%!fGyz&N`(>*&Ud1r_x;qw9B8;y1mp6@57Z`T|m)QPFM)L~~!gv*H
zQ%L?B;&urDczg+Y{9^OGtm680|7=@Le42^PgeHnEPBOndk^Cxf`Mil^-0Py*2+B0F
zw{>VO$hoMoE!kdym>&>wkq*j7b0uX56WnOf<^(Ud4s&0%9)ls_)HZw-B|bhm-Z(vL
zqXCs)kT+N%t#{9nG~T__f~a#P7Hey~PeGPYWcid{<5b{&uk6eS!fbQRZEL{vdhQpp
zD+y@yee6CIgL^oZdf;dFws?ZQ4KaijmclQHrM%P8Gpibr+Xo5BUonQhtR{V>)CJFe
zl&|-Dmzt9nj0!gtU#h4Y&RBVf;|+@T{(XGF4alL-ULLKG{kL)cY8N5G8)&@H#}Cm~
zD-C#8?Z1twB7WZasH*yuwNeu7&(*b(SY3FjWQxF$R-w`;J1MDfV>fDc6}32YP={0d
zdj!O;+j<QEljD7yRdjWFz!k5BX2w20iK$xwrW*-6zPYn@tmr74DgJ-n8pNfvKOUhA
zx?@8^+b6Ldn1&1(fgO#i>A@1@ftCcJXN8w!OEnAg@@@{6#OFLRF*#N;1Ju$BD+9b$
zOEQ~vEN)*-)VpVfzsu#YqAa|Oj4u9Y{0NjEMgN*VL=iW9r6!ndZtZ)cC{{ty8U*H1
zhz7%TTrjk|uMg;&4l(~YdKI00SD8z3)K%+}`&)X#CYQr|b|IsZBBOy?Z>RkqFMts(
z=jfrF>(?VZIyVL}=lx-4Y988i#1}gTJR?^!(yM~61{deAXoy2P1<khCr;{|w9=i4)
z#7>twW;6@XIu8w^_l9zU!qleB@{5CM&yP2!f4P0434KUBv59oT?WDU#u@@Q-Bd73|
zm@<Qw@mne^{~eW5PN$*gOt1@8cq-t>)JeCvR?oD4V|!y|^)Ba);GN3<G0=S4(F`eS
zH5vOS1$+HG=;80~c}H=MUH6&zzqFbz+?tti{|9g@A=vncrllVm&yMgwWPt5zxRh#$
zOhU1iM<cYYDdbb#gX3eE3GoL_4-`@`yze&;U!f}u7`tx+tPTDwjq>@ulmjAZajdCw
zyF$!-8s~7XvtztApr*Ns`RtC5`_^<^%<+Uz2fm4Ei@&@mgcyaIW0|G%jVn>@%x6FA
zcc^4vKR5&w;LRaaKdCt07_Wtcy2zB<=RrT&`W3J=$Hl0D_7s4iqHdn1lHmP0W9T3~
z*f=$fxaCN9%r-E0CFfp3*i^(U8^_}(hvd|aFGut;Q!?P!nZKzTt#ljQ_BDx~gQaiX
zF^Rpw^q&%dCiL&GODpW}=hc%^hZ>PjXq~oQo}HteMeEr?vIB#eA&vw&Qt*pW%S!`h
zLJhIFdik?{Lu>D(bJA7=U>t-8yH8|Kp$4(kk~Lj&zbS-ul=6hHLL5y9g4|hD4%7oM
zL7pto9r?>KX*q6?I{t(LM5MP_xMWvhg7<_9wHnpyo%9?XHTA}r!fq+?pZp5ah<OZH
z(dxEr?Re$x==8izA!Gz>HffWbq>h|LvlV#}C@a7k*Sbig#KRe5j7WO^KNln6-B=sE
z#~**f{}~>auAjE#PSA(2cU#t0F*`=$&xx0o)tMjMI8SSU<|um|7v9arf{tY~hd%h?
z4&nZZUsGvPK_#X>b7Q^6AY3Ch#i-<PGpJ5wP%4iZ{eCI@diwG8QIfBokmWIerb+>B
z6yv>qOm#z)qVUM<LG6zT_Ck#;f8M9lRz6*e)lk(Sax;KL$v5O@-r;+bt{$%3G=ih1
zkW-AJFuKw(JYYtvyUj_XV0?XM?#1g#f{jGdVx%|EwP${N-U`e?u@=HJa+X`lu7X-u
z&Q<Of`oo|;zqX+>#aMsRbbP4sR#LPYw6|Te_Fh)^w0x7@<$?4Io5Tez7rPQk6{>?0
zJi`kGa8dptV~kXPYeyfSl6ZVbO#yy6bf_QVN!uXWHb7BWjc+Z;l%T%Vrz51N^2hmH
zwXuadwFW=pbp)JANmV>NYM2yruS`)>RYzxtM!_{<Fw1uuzkCeE4fd2HQ}|t%Pd@mx
ztzgy2$LFwfVixNZ4Sz3Q=;W8JJ=q#n6ovjsBsObIk2G4w!~X7eYOF!c9h!R9Y$~XA
zkOKwI&BkV@t$#n-ZR0wZMUXtjN{`kCh0_hcLzJZ^ECVdw4Xid7d~`9&&@RlEnf@%h
zPrd=@5TITpnMrYrPL<K$#9)4Ro<;D#$ST+AvmA?WORYNOO_nMmnQDfT9>oJ1&2RKg
zAF|`-etrks8$)>y!4UGMs`O|)|B4>$k<7i|tB)T{+Z>b))Q2_y%HGMiwl`%US&GeC
z4`CsAf)bakj0v=bp~2TvWzzB^y%d}u;c7W2z&@P`M>yUY#$g!`u8dCJ-EzZct0XpM
z>Uo|s{)KR0oV4L|f%b?Nd33+`Z%<lh*YIqUl7Fr~WZ)(sR-UMf49HgOnyW6K_7@Lt
z(-T84I%X3^@rjzfQV+O7e{N^&0i2lkr;dG=y~ws5(%FInX0-urA@Q}MOvG&t8@vrz
zZ0pdkpqN+<_+h@>p9JdSX26@$U#$P!Ux-ulpamJgsn8!bb&$b_8@gBXw~6>+x%?Zx
z_PX&g=sUegsw3}a@O|&k!AZx8`pw*QKDGm5=`areQbvolE}9N`^1M%4?bJd-PN=yx
zeCab}G+$02RvK>|fRifG;V>79_~w!&lR@;hCkp3+?wN4rqTf!3c*pX_74(AQU-Y6Y
zVStZOiq54#gK(aET(L$SbhIYK@726POyZBI0Aj6MQYrD-g=Vnx(zB^G%Yslf<YOhP
zQc#vN$+=#(57K1DUtLt$h$*-b8XN!gkyT+QMp`^A$3qyQ87uuD>%4(Umu`5P^5N-r
zxfqmPLLWrMR&)UIFK@FSfmknsjJO&;ma!0-((-=p6uN#$d{eB71pZ@aa1C_ii`vN6
zn3<yOnMKP&4#ZA$JVkV3%x^Yl>yT9D2i-x6?cLiH3wJmw0b2RTmdkpc7f2<1te<b6
zb02ic6I~sw{P;YSRK&e@S9VJF-nqJaMP8}J*Xe=pgCRfyv^b_LJ95^)ugveRNH2OA
zrULOv+}F-Gx#5cHiwz(6y|CLO@V73wJR3?F^p^y|bsxe)x4!R~VL{=QcT;%T`Kqpj
z^PtL^-j?SJaJzYfDBhM|ueS1sVRu9g1Ws89x8f6Jmzt-N<6nEpK(1NB%<}lSX~eEO
z_Z>NW*!Nw!Mty%DxfyWnnB}nJQOhGv;@eS2#c<)A7O5lR_vGHb-BTXd_EjMvUz?GY
zwQ34XEg#Clt>3(VFD_G5zIT_3z_yqFM#)O)V#cK3C*y{@{<+pQ&HjDl$rMeN0podB
z;wW~8_f$MpQgwK{dm_bK_a5e2{!e^{X7ytRW{WJ8s_LlgU=p%0eS^ru>Pjv(LZq^Y
zj-d2Qzk*XygI_eUF5U~nEp!$OY^7NFFY4#nPp^Qmg2}5VCxmRj$)!;~k^yo}@2r@=
z?%2Ul5O?iY{p=dUKR93gb96KBRtbK)AG^LT|KVf0?%{+<2$`pGA;?lCA2(Q8m%Bm7
zouv1xZQ*pL5`OoZpReOO%4+AAg@!Mt-wTi2`LN6N{{6fBJt^9E^P9k1>$yV1&iw+@
zWhl<G*Oz+AIQ9@4h72x*h)9vsEtl_hR;YUPJmWgYimp#I-KRBfH!29Ho4LMZEG7|4
zDMGe+p3>?2clYHxfbp?9@@s|PnPH{$fsqZ@?c;#qkX@(E9}|92z&lSGp7d9P{i8Xh
z=lowNHad4VsYReYOu%27<4`A)7UnxDIU}Y0TxfNsg|Q3UN?UCZpan1^*|73W*bULt
z63wgKO$b&&X67{xlWN(UqGq0N^u{$gXF7+sOvnZ-OI`Az58^jbtqO-nilL_jeo*0$
z`9_Ya9-rSlNwuFg{k3upal%mY%d>FkZO;d=-k*MUJ;%H2vhQHI^;3^(Vk#?stT&V`
z25e?r547_gBPJ^iDc0QkR$XF+EqaqOa)nAODQOjnF=)P25-%78+91S$mHwJ*9=q52
z#y`5xmTBOUUm+`aZ<pX~;k9om=JikSpWyAe4jti~?{D2o?t6v)N8H6w)U54L^-OSC
zvf<^J3P>81KnkGsD`QjmUK82c@t%k~+#4m+^|0QQ(UH^R(f)T1DmEwBSQ=wO1%DE1
z4c*k22j``4DXqp07)%zz^n{#8#!d@qsKk3uUVrv_{bJA1lDPGH>%RC;kGfs*^G>S&
z{MSRnoU**{KDuEHyGr)xPz0%aju}hB-F%UsBQSk;Kb+_s#*jBuTGv%lq;Gj(&IG?^
z<zFC6tPFbP;jkw|QC*mVQK7N^6xhLDuB1n=3Wz<ES7<%d6nh1Xox-{-#+7X4K1QGL
z9W~7-iI``<^GSnE^YlPS7TkmF65R}A#jCr!<dC!+mMEC9FHj3$wt4sc)YgiT99#M2
z_64g&auuS;0<#S*8Y><Ub}aIbDzU20yCzhn^T@-h#v--2L!2Rz-P!T`?mD;p_r!bW
zt%nHg(ujxM3g=lBaFHE{?eOSDTsbXqf#TTUA50t?X-l)rBimG(cPCvXd;B}*<5yts
zr_S=7qYbb0=jCZ!E_JTv5Qx>^2JEYlRu#GrslsE`j*zDTVTre6)m^8U&lo*QEwMh2
zh(y`Z0Z<~hW5U+u(oOn7z}LEM`lpN@0E-C%j<~b*jMqTh82#({j_7uxPz0&XJMf@a
z{EM0$$B{$uA6H*^?;)M(xYd>|AQs!d*|K2pXI@Agq*NX#o;e&|g$f9s0mfO$<Qzr0
zChrSqznHn}K;|`f!2_eoKiLO$Kho`G#*079GhM`e1A+o>0{gL0>Sy)kdYcI_d<yG;
zEqV@<Xo%5SApP^0`VHHr16Y6w@K=4ml`2MxMAUm`(NZZONXWs^Vi{g8_&av0w1Q~f
zvh)j<C9-w(02>(0U=IYCXO;yTT31A$1U!rNmLM73g>?uf3h{EyfBe7i?-*1Zg(Gx0
z=kv~Q9R)^wB+9g@bqnwZmF9?^W8)$yX~AMJJ4w7MHZsE*gWD|KV<Ey94ejr|-{K_!
zm*(72=bS1VpOEX;KL>a}=FX8Ej$PY*?4OD~$pD$$*0arZ>aaUZ4p&}z+zkm+8D(;F
z(>i%^{<mb;&vnsuu8H$jI%zeQy(Q!g*$VutAqq3~S$Rv8^%l{FZfleEGk*7fjLd~l
zzr2QjdV2GMK!8W9{P&f=S^us)nQW~MXUBhHhpj{m{LhtG9yWQltgffPLFz#q;HH<9
zBg_FF+k2Ty$KDp>-3k6eEO>A8@~cF+aWM%`Q+lp5a9(w%wwt{RaQnQfT)_+j%jJVt
zAH^~1W;9Co0Dg&3sWR2aj|4>u-v}){P}8!)-85d8GXjk5jlKy4zJI5^<E`jWc~?^N
z>(1n$%ITJ?2V?+~-2O6Gzsih=j0I>~`Sklp@5r|K{vndJ{4w@oE6tzuGxWuAUO)3x
z^rmUIeq~3&KhO67KV`?hcmXVQn6Y*8IJPqEL%C;7XS-G`*U8Cl2G`J_4Bol@-2VJC
zNEhl~fbZ{D^jfFdcK#fDujR~vM=#DN#`EMuo{OxW=CYpy^OxBETbotUM79Pm8bu-|
z3c>eF%<Ose{2;Ij{=eQ9FutAIHvb^m-d#Cq4=AZ*aKRW(`Et9;&#xiO?{;|JZ!L7#
zec)#968xFB(=8@L*@plv?7wJFjjfuhZbe$|E(%9Q>@3=yAw+*_=0dzDz$^@fokd&P
zges*eJ>FPV9uNwZ65NJA87tda0WA=Ku<m{k^0sO!1NZ;SXUH{#0_}tz3GxSap2A%R
za-Q!=-f%6teVB}MtPLySatzx$L`S=WAGuJ!Vja?fKTm&6_fNX@Q>JD$>F4G_Z>&4%
z>~gUW{0(wJZ|70>irbmh75Cq)u3NKbwBK~T&=1btPHQfw?*X;;3BO7=A2rfMdmsI?
zPZSkKSnjMI(Ij9jSnhD_T{-pqYod}iH+SzmFxPe$?c7i49)bt+cOE<VVQhu7Pa~uC
zTfY#vUjWe}TfAp=mrTwck*}u9s^ZJXO6w2IVA$t*t}aJ7p`$V{us2x}ei5Yy;ks$w
z$9AUT%ogXK=Dok9eJ6?YHL;7^;&RoaX}3|UK;SNsNZ<f&QC^LjMLwySksaxU+;Ok2
z#)<BHtH6)RwHG}GK<2XT?ELqN2DW&AF(>KUfurrr&IwPPGb(cr{PI+Pz7IScxnOz1
z^9cm#sMVdUky=$gQS-0oWmMfOZ);7WP_gVU2;fH@kKAs-(B1wY&fWv6$?f|VJr?9x
zfTM^=jTICGl-|JxB2DQ%2-15AokT>XgGeVpC<4-()X=N+PAH*E4GEn<Ldg3-&+q@c
z@7?k4Id=@laERXkzU;l%nrrR3<~$T79mZF56CbWO(ZN7UuH<8J?BfnlrwI9qWIg5n
zXQ<cT&yBa*9U`BR0Wvbhm(k^0zZXo4;ub(eX0UiL8E3Klj=JZP#&1Ia;Xf#6{$PH0
z#{LiL`cwbse`Iw4a?v&!*X4hG=vQByqTs~<lU}AWNi1I1a?s2P{R>!p_s&)s(F}Uf
zYYh9@^>F7tViI^y<^8TVK;d#<8T}p<H4lWV)KsQ<R=gi1J(PYE*>S)^NCC~W(t5v-
zYGS~%j5>g-Xz@)PmApWVnm_#V#Q_l@d+Z)o)!OD<!!wmRa}E7zVj~0}U+C~)U7!Ka
z2>2A$^Hk$?D_+&WrXCwPUAR-!|NQr_S$F|R5M{cP4Z->)zR11-TmXcbs87+?mYC%y
zVMr5t8fcKuD5MsF)@}-{`7A{;_MWeEq^mb5(wqwhkQleyt4FNKx-HHnNx-tnG8Y3D
z4eu#8ZqT{COEk*NGRzb#HY^zB+_S9lakwV_?K(|go>7%{?^CIr+tk{2FZ_g`896Om
zY*GE*B3}$nwup%Jr=&VwjiTM_bTol1OYnpCqaT6B%Ra0NTVjV<UI|Zlb~u#vnhai+
z(a%ALUdlE*%n3V)yHLoUU`CZuDPR<VbdQdDR#eXqbH58R<th)I&chM@I@uaePtA!t
zBng8sJkB#9i&o0t+!`}9t((-HB9Rr<(d8SzH^+yQ$Zp15>}<xGdPY>3@8NGJfPb?y
zfDQDOgYtzn^+Mq0f4`^)kjLCjmmft0y#&deGPQ@tjW296nLbIQ-)mG@RtrI7joVdR
zbe-i!e*{;TZ%nBi;RO%R)iv04tP2H;F}U*L-lF5OH~G|wR3{H1H-hljrgS^VQ}3r|
zg!UB=NS_?cbV9`dN-yE6ps4?G5&-_(JlXJAmrrppi4hmFLoV_{a*UWN4d5EaOtC?E
z*bvuXD>eGma`a5^eSsue=mN*P8l!?{2Kh6s`Wwkc;?m`TE2a`Oq`olWw}1rNS(=&0
z92<X#wJ51JDA~Mi0CvXOu*aGC2mha)@tNAe|2R?oWcvN--l;il(6Xq-*R!@a5PcMv
zbTmH(5~027jb?yqPy#XXPsDw|2a5Y7lK<I#ryTkwW^<3mlZDJXg-Z86WUW(9n4Uj&
z#L@I7^@7&1qConwPa!y-BDaw@$ve9+rX`X*@L1dWAZmTn?vRO`UwecN!@IC>*Hcuy
z@~(WPNJ2C(epP;x=KJfjx%ZdKjbdP^!r{k2qPsu!@=RC#Z&QJP90z`di_h82fGm0>
zXRFZP;lP8U8XzY#Xcvtb+k^>}M9kkd^GK!i_|WUs0=TuU-Q=fbguPIL%~al5a(aVa
zI9i|tGX9;=E3&h1hPVF8Z&a_ipgC(f>_{ikUm`<AtB+?l^O75Z&H@X~OQhNh@HRrU
zGodzmzmOs-5DD{-*2>-@0W1{o6n*!9v!~Z=%cZP$d%p(($+Z=V_Zxx&q4zEF324XR
z>O0Uz+NXn}D~CJ18%hsA8}fiP+6Q@ik;;lS8H!fL=FI(OcIS|={Cyjvwvy$rqtMeE
zRJEH1s)se_en<a?3Ll3v^XFO>R~SKqyR|cdKtQrb-txL#G&T_N-<dM5^tRc(@i;q|
z6-0yfxXYd_Lc|PG)Tvcf3?ij=i+^`{6EmvZQt=TA%or_@RA6<xlw{s(U?ZFIr4kS~
z14W08<|vKcr%t*h-XmXf^B~M0(+rstoo8e+JCxu512prLuz3n-{cmD+wyl`zPWC`+
z9T&~omE#@o2mLWRuxzBf0#^k*Yq(QSGI;Vk_2WHIcZ&hT>+5Nj&m`}B>>c=j&H%qw
z{(rK@S61NAm&F-9_=Rg;-JrPoBiD>WP&Q}hCnDSgg&pXbF_LgJW%o#y-B-{A9NFqw
zpYS0z{f2fZlXNX5g<35Zn5I+dJ))Mp{{-xM2F47IN35p6Zm^p@mzM@adfrTj?<oR3
zuH%$v|L98)5FuB@sec=TdC%$H=m{T9I4x)GeED~L%{|sbB{jq_h^0Lk@yNxdC$>Rd
zGZ+b2nreO{zyXTSmjUqOw7f3%j<UV`mjl%7)dVG5rEM=aNp+EYw!b+C7aY<#<}d6;
zqW7Nt{qsdDMY^|V57ZVag8$aU=6vH|VrJk|(n|UJ=O2Ft8yrBo)p;<<(0-h5yR853
z((V23Qyl+qm;+#oo<5_Mo}nj{&i1BHi~&mnmv^9llDz+G>0WpPRv^}VEn2^KgY<=a
zGwRmSL^CZTjc*~PQX?*6sv#t{=Vc!{>Xv;0iT$;>8i4-p1G|HO&BW~Ag~oY7+bbsW
z{yK%2q4mo4keof1k5S)+K1Z|JiqTEYaC#}q)E@il@Q&X-v08bHmi7u%_IiTaU;gEq
z@kP@1f3t3;#3pC4rvF*CMMgqp`!>Lsn&~oc1#M884N!`|uw|Xe+`kXKkU8V*=yYt`
zmDS<!-?m-q$F^NR|6|+bH`v~7kwnv*$<b!=AN}j|L7bIg-V3?zh<*tj_vwT8zZ1v3
z&w3XU_K>EyE)g-`&v!k9`Og2}Wy5+O{uya1Kx3QpO~}+Q*qkgacVXv;g{=#cFY-{H
zd`Srje9(J--8&a@o>@YQ<adG+7_5%}evH_NYZ~ERyK>^Z(AVXNp?6{6A^U40H*rE(
zKJEaGvF7oQ`bN{omMA`9ocmzMZ3gbf=M{g_b7hkLX-rsc24aGI2dgpY?^G3c8t_r#
zd1UdhB=|z7xa?Z&%lZG>H2*L=-0J}_V#I?tA-Ml}YhgM#iLcNo4*<bt&PCIgLYp`Q
z(kML)X;R_}PRI#glcZ)&OgufHofYC9clF%P_0DLoh&LV6Jij_i-R!wymPUI1*Zz4a
z)o=u0a0m}{k!NP3ru9>Fj6R?to1hI0SdE1CsnGA378Yc5KnUWfX3w_{Vlb}1gV;m=
zJ3&eN{8Rx9?G{Zw1$G;?vH=I@DxxR=JVU=v0X_9EkT7t5058_ct>I;=-=AINH^8u>
zGM6vE!-JVmsyjKUquZp6^VkU!9D85EORgu7Q#|J9e~it}BW9h%Iiikzhs4(c9WKsa
zYvl^o_2+440K0LwAL#kRPaM!_C7YJqs!!~Remxeg#sXM(=ot~Ni~SvNE3X0)Yz)pS
zMF0*b7M(e~v1=B~tI90Z8n$WtFXFkh0}v7t^bRa{&i#&KFV&89&PCFCx+eH(=@TD^
z!p>!~91_Zrn4(_eIz9ly7>&^ZL$foWjZ>1(!jJ)rw;iNJ5b~+m_ZZspfQe?CITsHA
zc|tuTHRl8!;1!BMaA<Oc_Sk)4=z^sLI@+J&uK#GRXNdk$5$<42Xr-LO&q|_slJHN^
zIjs&n_@V+d()AYN;CKy5jdj1#%e&KZnSlFBT-H)`*JzARG!Pu#N&U<C_wLL}GZ0$Y
z^*b0@p8TpHeMT<;yL6Jl!t@nuuHFo|bsS`clt7Sr^a{2xfzZW;`a?h9YJQ*Quuy!5
zXZESl{yU&&GC3|qNRx61uP_Iy^hV14zi1>4Pu8?!>*9%|e5=4oui(WcP@lx3DqW&1
zY=<2%hUKC;N!@b|lz>B3pr5`r6!1*ZES{hb=q_?<8}<Dijefo9n;0d&wb)0262`rY
ze)Ws%asWy<1pFNTdEI7TzW|uQ%f%GS`28wVU)?A>E#Vj+cSo4dF8fp7XRF2j7Oiq$
z7S{~@HK482)%+Bp<?;czW!<L)+94)Ez~bI@kP=8zO~rn|(4qp45r~IJ^F?5B#bxJs
z9pWk!^w_wYoS;24$H(a2Mat_!ytZ%ATHbRM>%?Y?xhE^`51U&ouhKh#h#fV$>{sG@
zms#`BJcmL53B1l1UKPbL#P@UtduN#h0Cm~^nSb$yCk5<hC1$`pXdpee|K{%#@1G|f
zmasT(ca-zy$T)x+@c;QA?DEey&1a3{@4NQ%(ca%Nt@u9RxV_E$q{Rr(qpR!nV~LI7
z1t8SS&42m*En1KFp>8W9>GAJ<c;)JH_+Zzi)~nYeJBO@YBwZ#G-Ra6~DY<+u^rjqx
zng6x__t3zw>&C-_cl*XiwNGAzxotPV*WTeM)$ndon&a%ii24)e-MaM|(7r5Wk7iDC
zUa@te?6m4VrN8L?FAj@v8<JOSjzyP_9WHx`g{nSL4hT}E*s<i2-VN@PhuFAPipCCJ
zQ-c0R`BW6&MitVh>N~R)b<EnkbWNvtx3B%9{=t7`lNYy-L#V*k=<?rK`RwtFqlex&
zn<kIN`M;4Dd$GF?^u<^K^k#4MtLv4}PzT)8i=IsC@B1zIz~b&n-dU~MJF1k_`w(Q`
zzg1uNfd+_1Y7)O3eX>3N%h3n;Plc<XD-eB8vL5I-TmC+?e}J-+XaM-~5v*PV9^3y2
zOAm#;E{anS`TKoYj^DS%6j<mx#>C==0q+%Q0DD0ze0~{9{qqea&1er~pR9;Z8Rg&6
zTl)AAKCVDN)-sfdGb)&9u(W6^njWg-ek{B57_@d<&<r5X0`@el<Qupc8?UqFK;Ppf
ztL<#q{_P_z2iWoLZX#Hz;kEDuS<ar<Kz~K<?(gnUu&2LnbDmnD?x@wmTGVf_I&1Eq
z7LYw!?L-vxCe@Kg$lipaT0!!3l}Sl_nR(Xyk$o|Ax-v&JY3O-KJiowf9L?|a2Gk3{
zZ?0yYVZ;|@k=1qaU*yVPu))W9q5f3C=;1_0h{sOtBZB3o-*~wlqI-~|ELXcELrFXx
znO`$+D_}8_Itms1`;<Y{l4X^)XD*c%HfS5RYDDg8P24v1kP!(Zz2SS@-^O&-SlQI{
z#@;)LvoPWJQZqE|KhCUOK`O`~-|Dqj4CFj)6b^K_I{&SnCoY@AKvP}Jo>8gEVqWo+
za&Vf$g0ZlEdV-AdzD|_aM^*cH;pYjrfa8+Qn{TMxZlnDBOweRLO_2Od2Ty#v=!av-
zvZ=EP{qa0Umq*ppWnHC)uv;o7C1r$AZ8^wzgs0#TkzKnt|FU7c#lw;Sv&vb$cbm^`
zApi9Jl2Ar|>)dmSVQLe!$mI{yuCIKnOspfD{tm{EfzT(iFMmxe)_8?_weJ*50?6{s
z{{^y_4s@D%r)~{hSgBiChzmP=sde#v;!ftEb2rv_cbFZt8orqZS=wQD)|yCjo-Sni
zZh7Fk_fTXQ&QodmnQ(*>m?|rVY7617O^U80^0G|Xt#z(?%J}iJ!25jnYzL4uy?yjn
zi{Caz<Eo4eV?Ma}1*M&olgz>t9zXf{iqvp7&|RaKyc$QWVyUK}VlU2jtzDWh7<XUe
z(bfbuw5*R7)bE(P1B}w%1Kj^=HeWZp{mI>AQgJDUw#8)s3~a9bSW9F2U;&tTb)b=2
z--1%VK;OhQ^WhA^0i`^@;#7s718ClWHsCrwY7;-7C29M2Lv#*$4+ruO?3S0*&2{iC
za0V0JlLakCo(v`-az2H`FV`FtxCeB%L2%h%RDOS7XRqd)$37QxZ&a*%Y}{vYda~s2
z@={kDKXQH2qc>sZ&1974O1PzAwvashJ8oNq;N|}IqCPGmC&i4Fq4Lq#$X;$=B-*KT
zbVU;-7cWt%JQMmQ55DuO4oqI9OE%)8gP(z28>}5F4!+K*Qgj_KO8bVU`ge!tMybeO
z_`q%o&%Na`@@ftks>AXFC%V_%Ls;BahRnXRg7lc2IWr-7*d{LFK$fWT9`H4o+sa+R
zQ(Q?x;w5E+rl7a&(Kr3d`$=R8S;*=Lms5ro(2>O5sc}|D_&aTnK(mBo@F-@UhDu~>
zm*+DUxD0c&9;c_~azAcqRX<a6G07C}>8MhA@atH9tviMelxE)!C{x1uAXc#=3b-3w
zKqZqF#^>K6sbK3i+64wG7T_Yo*ZVAVnKqWen$*a>8TNCBCQ05=lK$`$aGS>6nz+Fr
z*=DR4@cW(+z`xgl9{A1LJ7!+9#|@&JfQ@GWfP?ohA?7zvJb;g{6M@H6?9o@&1G{;|
zC7(JS5jQzH`H?d`ni#44n#wNh^E-lV*|yd0;oKtla|PX)B$7g<Y;=OSexduvXz!!+
z5gT;=>7_1F$}I0CTT4_%5lYDdT$aDDGR>o#k|%~gOWkem_F1P?Oh@*+MY?EdYC?@G
zawKmuKlnYJhh;q#0WI<sW2jiQ@IYWxH~C4)_>Q4!c-7B*E6i#-0lK1MGg>@Z<G<nw
z9Q1GV;arouDo5SAR)lI4vsz9%wUr4DwPQ8bwr;f$A99Li93rJ}Q(^=GycfKUah@v|
z7U*J$f@G`cK{<A3oSJ1_jV*TctI4!?R%wpVIh=NOPKHgW+C&0%hb1GXYHG~u7&Q1q
zY5=jh$FP&SO1sL}&RLrB@HF>7$2Pyy*Ghv=g@*N14JTN0cZDs}(uwpb#Ces$Yz5&&
z&R?W7S^1DZS>0TWK;;g6>Ai-b$=rKLEUv+VYPZR!huIRhCHLFB7S_=z!J-g;rzy&8
z&AM7wJvnek<Y+F|!*le0{6W!#%Jj;57I;ZZuGVv>#i>bPbJjK0pbVQH!9Uk3Y01d-
zXe_D7y$G<Jd09SJJbA5XEgzFXqiVZ!`*s<3($H(wMHy?3GRKA7-XSq|4@bL(Pc0ss
zdz`zUG!w^NJ#Y^dnI1{|Mco5*_QhuINHCfk$Fd?&&v|w#h35>6Rx}Ge!da`=&T;MO
zkLY8QF|1^`V^~N!(sQU-v(<d(yU1%@d%+~P6=8kJ!UAfmtJ{CM9PfAOD2^Eg=YzMi
zVme#H<>OU3(hPB2!};4Qs{<v-;<@_NK_G+Qk56In@PP-E+Gg;cJBRH#-@`uQuqF!v
z?wo<k#DO^eC*m)#Zqn$s<C^STn<{)>Tq+6dKGk{L>pF>PkJ0y((e(x@6DRF2;7g#;
zOu;sHsCeC0@Wg+fx*W)~nF~mMfY;4Ce(0X2$3Ou8vY#DHkm0dO$l`N=A*d@`mH3cc
zD?}EM;Dvt2B^-SS#h`~LBppU~341~0VZL>*)Hqe#@Ow@0r8Oo|XnfU<aFba6R~{32
z>#46Iz@*<t!^ZW6FxXe8&=3Q6_jY4?D>R>c6Zcqy+69B`sM+>L5w=;^#dpi?-D0&v
z-e!BQIb43FDu-5-iXM2A(p|^MCfdLtkWKj|s6&8~jR~qTT9@9+4Z&H;YaQ{Hz&(if
zx5=~`&>b8WH07OQ^|oJ<i{G?umb=X93qI`HX~0w<d+#`bjlNViNhy6?i0W)AjU-6y
zClQjaOH{fqa0;34e}6u!_(H@~K+hA9(HV&mSV^T0Z!7wATu3;)GF;G&5I9WIex%E4
zeRR4$EB%n-T`YUs=;M~fomlPGOOKOo^L>oFf9c-^VW7J3nPc|1YFRV`CFKewInmbI
z!uQ`X3R$Iy6<`WDKLroP(HktLTerNlhAuV`cNZ^`^JKxqOsHPfGkjQuh<%Sp3{~HP
z5cPHs&x(B96*#IkO`aP<TbNju&lg}``T9!#1&yxP<jyv?7>wAg$*x$pV)A5_R}vfb
zb==+aOG<9?s6-9%Cby<KHmklL+6{tAD1WoIl@GTk@2tMhvnsXjXAXhyR8*lwG@tec
z=Z@+X8Y3^@<5gXuSw1mSGiCjdNY<*HFh=2t?##!7=I6(b-u|R!6yLTJ-8C2Tacf%Y
zwdzxxpFEcU>rKp$`GjEA3EMZFaKwp4Mxqz8<yJ{;(c^?cR)}~Sk|%2-fv@Y%Q%X)F
zPP0NbMKVvRjpY{v-g<ztq}9BYPw<WVJ60Wj1?{6ilqYI+3}?0)VhFB6@B8N?3z3Y%
z2ZNq?b4(!5?ufCbWltO1BO-|H5wbaZ@Ul?zg=4^}_QHpX%xLV!ntcP-6EZ(k1kv{<
zkJ~rhns{pw@qEp}1ibgdf_2~OoM~#3_Bl==N>kfb9iUX8zAy?FWa;npjsq-=Vv6mL
zy_pk0lJ!B&8>c5})5Orep7u1jCh$Jo-+}l4mj!VdKf`mV*z8IFKTpXuIw*^C3QF<Y
zez;bH%}7le&k1u`TEf7jw7x0nAANmFE!EgLr&I3n@o0T8Y_|;u(+JA-t-*5El4Yi0
z0CB@9v6u4VB1QD1CnD{!G26M?m_6m+c{pq$T7t)}#Yn>QAnF3$jnHr{PIw<C$vrje
zf|p+bhkb)%#J+evn<UN1Jjfs|WA91BLRGnKe;&S?Rx4;k#!&W%HLEtFh-tpW^&=}5
znm=LYq+HT1F&yCVt)$X$SA4h5y27=2W=VmfUoafI<h@;e&cHYVE@s}0j)6S6xE@)^
zGb>ur-o2y{o71Trq|it$*5FDq4`|C^ES2+u^2h#pz0`6$i7x(&XZ|%xMx1T7w$v4k
zZc*pb_g-1la@{u{?*qs0FCmHxf)7S~>Gdos_@yHjsrVuU*3$RPH-nGjw^GFp<~!m*
zS@`~bw#3o-&hoEDC48~PzLwFr8Ag`AQ+2?#)=3TjJ0Jane@J`S-^izfvxik{BMvc$
zh0alqrhb?>wwF<G)`yq*J^%%Bd>whPspow7%B?1YoOUV;q8dsh2eL$7U+LR>AP`VW
zPf2SfX5LjDGu$t4R1#v1VmhPLU(%TfiKr*$XE8I!N##PE01LG{LPcX)fFyXhm9v&R
ztwR$n92wud*nXE?uz(-MY+Jy<cX@n=q@1zdpu570RtuIC(kXUyGb#}gHj7P461efr
zV&m=ft;3`V0|C{Db1s`KHy6Am<<Ho~Gmo<Fj$aPwRslySOcs22yJ|#lc;@&FG(Yu`
zn25@3wcXv{*z5lAMgBeQOC^5sn%f-8P0II(_+M$Kfx)APe#sbhMwR|H3Y)B-;h5p7
zXR%Z?{aWB_4EPvw11ZSAMIX2(y3$TbTi{Q`(O|CQuRr~s@Lt~jez;!av57BF^L#e6
z;0}%tcV3BLiZ+&Rs%YD#oa1(gsbHFWtll>Hj7WbX!c22`SG83l*z*K<HwA?1>eV^U
ztDGb-WwdfRKCYwrqnm~`bneJ=Ck$n9N!oL0sO`HMo?DUCJt&`<_a#hp{sH~s;xrBU
z5tuJCRH(gU5Ylx%u?AZ}?p5{h-cwL?n{!{lj^=MZ&8J!un?IC??Ao|`v_<XQ<t?iG
za2rY87prTl(xy?X@N?#VxO!MY|9sH791AX(C))~2jWy|Vt~hfk@0M!@?^aY9Z?Pv7
z7ZMTaxwR=eSE!LqOWF#j=g>5AdV9-p=<BQ@X7>CKeH?#4w^?-3Xo8qae!kf4afh<b
zaMZfkio~v1Y5L>}*F}w3OH>SHj=rp7?Nolb;=q2F^nlyO_k>zTFLf}W?f6(*vGZ1f
zt4Qq$T+pNYGmIhKsn|<D#mMQNMJJn``hw#`Z_amUryXHsiA!{UA1BI|Q-<GCi$cBm
zWax#sO-SWA>QJ!$7tPvZ%0^cEF<?s~q6gzi8<EnjBlWtn%M}qyBcG3!Rt9p;tu*?e
z+~f4tyJ3o9!Js^`OsSN4QP<rvDPCyg6r5a@bkN4GBTQD8kgzc_1e2NkR?(g3{{EzW
zs}d#})aa-3qnxJuUwRt#2zMt9YeLpMB2C=B#Frp#LcjBhw+nWNpd^TKj$sdy?2&7g
zy8MJ$!(r2DcXk8OmoZ0X;8L5{hvMsfFYgF~EjU#0p&H@i{H!U%l^IudHq4`vZ_`Gl
z-L>;1UGfSLHxOa@x*&g>=26u5^g^4W>{oUMx%Zb07;@vWR!=4&3m@P^+uy10O3IS8
zbB}9IY4NM08)1(a`CXKfSG0<fQ&HIPLGg!AyA_7`I%m4{$iaE_3QDf9=1Y5pSeK0+
z==L3PmhD{v))g};fg4;AT;>L>viPj)_(nP5xc2<@{OU;#bYelHC__iCx-u2x(ES+w
zyF^mI6n^0<nHs;ovk6{fBDz5LuXNTK+qBsh!oRGYJGq}3)oTH)r{A7**GPT6d~VZn
zF$mOOuKr@}%&vvK&ExF9&JIa3xB|gimw7Ayj$nQ=%n_sf`&Kb}a2SfF?G5af$~%1g
zl!&nNzpbi{ccZFw1qzwM@{`^O160!xx!o&E_Tv2feQj;MZ{?01abLHfzihf}xuC?L
zpX7RJr1&nFVo%Y1Pn`w&wfzBi6Z<V~l-g<NN|K~c$yRM#x(`ZWPv;)jW*1^~Em5m6
zhSSX3^oxHQ`#n4T+81`>d&yJ#!Vgk}a`S3w7qh1=9&y~%yj66t6^B?!NK3=tf0Cos
z-V&&w#;quH5K4n=83oI~<ex^$fvZL3c@*GuFBNF)?wb{6NVtSh2SI~oWw%(4uM+0c
z>XYa^`0;u*Oy)I6Hq!j%(mXIE=4Di1w|kCMe-j^lY}T{5MXBvadQ+ulF}xT-6`6U3
zQgi6HP>~~H($VsW<*NyA_e)egS4wMj?ZQAg?wHA?C^7Tgp3bZoNji9t;A)!C)W{(|
zI(BJ}7`x<nc)wCKM^lq!;Kpl$lm1eSW&r+7(wW{<V$C$O$4BQM<d&1iZa5r6K2vrR
z)BXCOQb+BbpZegJig6lYKP>F7B$5p>j1zs0*fH^EC*QDJw6>LHHFz90Sq%;46QaWd
zy1fP5JP@&M=adA7S>Y_x&;10p1b%|Mr}H7el<=I;((=d3pj&&PZjb<_AAzGk^VMz@
zRZjb^XRQZtrSV&S=cSXeqtduOoIbcaFf*9OtXbK-h-PA68A|Kk#miWX+h)T)i?TA^
z&YEB~?&&3(99OrYQ%U?!5fj*+tpQnuX{4Xstk`ibVSY#vE$&j(Dly+$gD!G{OfsZz
z<R(anab;>hqnPz)fcFeZEX`kK=2I=Ne(VwnG?_KWNSy}oY(IKid!p)GT`6SiE>K`A
z+0gc{cNo+eEv*l{Kkw=p&@G|ZvUqWPSZI|FRceIwOX@r&1tYpv!FC?xacyb~i&^C?
zy=xF9KjZtO$R!duMd<h%5G-94*ZZ2%yO4&*mf2qN4NQF%=Ce<OI<4hPJkRVpgHm5b
z*^5{woSvRx@(P%_=rDbVK66ZE_^W}Um8$i|8c_ncllaYPatJ%+6@MV$Fd_bGu8ip9
z-paLK9%lEur~>_w77{TmQg<_n4$cw|+uySasoj$*wVSSew`c=JDdoVlGL+a6*-hgW
z?FJYP(l;J@*tZDJgp_MzerH2<kGeH|E_BO+V5zml4n^HOpihZ&cP?`bC3(-p79Y}z
z6^$j-?6K%Ou5cOf-MyPkmm8aT6hlM9>RFY+6`$W^>7J?49`k-Uh<~@3srt?&chi#P
zGJy2w8foFcDCt<n1xRA7gulWw$<2`%NZWIkRMwiG77@Ytukc{{?QuYmY$0zHy`bcz
zY$j8g`AvcY(<(ujThSHRY=7QBtAzUMnwi6;4)5f+(Ut;$=J3<HQn7E2ZZ*u?T8X6X
z?BtSP`EpoJ2u5(w!8N-)r3a^v#$0qQy(7otO1-ds1i<3!`Z(>rOP9%0=gIc5l(%ai
z)bbTkf!$)etFfM?_ExdWW3u<lxBELDp!1{T>xRm$Ts~mM)yfrEb8lll+-+n3>2B|B
z=XjdnDOc_TT1*CrKFU)KCq$oydG<Mh&G<l;VC8?nBJ;^!kVbO~ifQvIE5pB$@g3x|
zS4<fNZBr8`%8&aF{6<^Trze1<70=2brQ@mudjhoZ828iBeMd_c*lfBE(eF`$hifDB
z;+QW-jP~0sK29A3<$!?hjPQ+)coo-4;>c}F`n-;<q;vqm7G0y{L9aK2DJ;ylnqXz(
z!gLSNRE$T3@MI>wN@4M$N(_+f(B&VRO~J#KRD**c>U&A%^ivrt*abeR0TEeQWZjQv
zD+9Ff?%k!SR9*I(dCSkn`BI!6yPdhOg3oN%0afu14co_vQRb(21%YJM{Mx5_JqcCM
z*+yAlUlqVUnAR5YaxVqwY)dBu$F|#isXDnCrySlKud_V5q*xNrJyyeSGK5f{z?h|!
z9qxoAd2Uc}3BhLTNzCaJ83uV8rQJHYab{Bok2wC)@PI*!0=t*WI~5FJMpCFP@w&$0
zb<5F63Jvo_G|Zoym<E4liy-H7Nm)(}Dld}+2A;d3({X<BFNdQ>N-PNoVb5gph-8Pc
zop^!U=6TO%*3N67{w!<J1_8WZ(CEdzC&%};O+$+}nf>PNnM0d4hZco<!<ICY5Or5h
z$c6v_^sRWERN+(ewXEhB|8P!{*;NE8eFg5iu+%Q6Hue2T^C_aw>_?3%#Ie_4i(Rm8
z^YDQLvF~S}&!X<gO+SmRl7eglQ<6V6JufnPG?#_#=AHulFDo77&gB~Z3eO?ay4e2L
zwBYYZg5^N9gXP3fKC<(DxBPB<=EQCrAM%;9;1nT!vAW`kJ~t+(De&$qy8$Mkn=!Uv
ztNSR234Z72{mEV`Htm=ckDZa0s;|9K2C}^jVwy1shp**0FKweM*=-cG+3B?zw{|P8
z(`9ucMsulxoZBgc+)$k?N5%PKD6oJ>n8p!?Wq}1!C0Z6}VClY~8)l^)G&qcOdOMx?
zsT?XPk3zq-X*CD#1VPto7z#kY`g7ST$%ds_tFXAd)#=B#4ZOA4->R!)!m(f9wk&2;
z#=E)l2yAGo9WEGC)vWIt?k+x{s<Qj$$a~w&p6;g&>JvoDs-+4tUhLo}QugBc$I{_y
zh$m_GE43v~Omh5EMQU{jVKJzn^e|>x&Ag}k+w|z+uz%C=W(BiAHVd?7fK$+p=pI#e
zwZiwCXh;b}Yum%;WgNxCh}EPWQjyo5iv?X3#cTDc+$ywpB3GTs_1u?_O}!<g?uqXP
zOfI5JsKHsA62&WSJ|i%4$Ps>Gc)Td*#R1!?YV|fH(bDbLEs!0|sxFv3`#{lc1(|#k
zGE&3Gt#Ui!yESD~ib;5x%|rp4;_6uf!#FE5zbN+Fg4M9=^fKH8bDG4P72RPTpFWM)
zp)8dGwBtiv4AfVh3j5gymrGVV$pVDf>=}kuR#E3+L|9Pne$71nHvQvhFTk+cHK&hR
zweGPKOZcEcTba{Nhzl86I=5Z03zIs`J#4%+eD5<ODZi#F$yqOM?ZLSB#8M}3{L~v4
zx?T4|5VFB`=EA=~0m-6{Gw<#QipBBk3g)ANi<)-x<en5Ex(HM|nS4D1IQ;{HVT1TC
zZbI1;j~i|j0t<BB@{A3YC@Qh7vicHV{s0!Ol@-vv$bp&SrTe&kUgN4D2Gvbas1$i!
zY;@8Fs%gQ*3_XqsW67YMVEOt!(W-RKS0w%*c%nyyR$*(yqV_CWf^)|jSLtzk^a)OV
z-q{kR)M05L>uyyyK*{$B6Jn@R;`F0WGv=H8ciqqz*3ngmCSM4PtXU9*WB~)hwQn$j
zoTl}B@opGosKV@tzSL&6TvfF)y})Sc>mcy;v^b|253%03og{9l()4oHgY?rt==5oc
z5Vh<;7e@E6WIXal=4j_hjBm`xc(|_Z8>a3F0Aro@MPGkH$g#P)Z9R@mKUQ)u=k{I`
z)2LNjr&x3jR>T$KuA!Hh9dOPy{D*OWfT;e~0&vD_9X&tpTf1=@ve{h{iV)H`SHQPF
z*6X|){@UmT-R}JN1k;7=8`hLUlpdx_fYzCN6_5wNXR?K2@(4-|{e}ZJ$x_dAAmq<=
z?Ih$S?J9@4ze??9Y5^~RlquMuZB6kVepY|BH|0l9A+MKw6`D*7>PRHy&RA#3ZWpDL
zjF>=S9_Fslw`qh9W$(0luF*CH_DNLGc1&&FWti@A>G0}%xU*-k#yGf815e}m&<#}D
z?TyZHp}IwksPjsa5#NE%po3Kl27byz>HDWm3PMm#7hTWp;Tigr;b70l<f&DCj-7N{
z*-75Ax^cpI7?hkpHQgJR>Nh>{mvveWo1}fxs_bwl-pkA5h|n&sm_&j;yeu(vm&k?e
zbg$Z#Qhp@Y))QcwBT@HqH!H6$m^rt*B-3(=(bJ@4%`JtsqN>CS>~6I?K7Ew&(aLD7
zC#A~#hcv`$@JC78;V{UGFoY_V%x&*OjjxK>7xt`2F0g<cU`Ip~iLC>Gb@gHU4^Mxj
z#It7Y&Nt3sNL(`otw51b>-pJvuM>La>4@j^EFgd4-V$Z=&ACDbTtniS#zZ%#kiA(3
z@t|%#VOg~6m$;cb2_GVgL;_$lpp~DXUx3Sj#)0cP$`N3AXgyu#tCG#>dr1eIF#8e>
zhOS<&A#~9KSH9q^JXEf_JUvad0sSFLAX~e{G^<Tk>;`X<dxEJlPPh8Y)>NrS88ObF
zv4~$QjHgOQ(TdK_0h5`*yTMh)Yrjcy=?oC+8Dfcn6y@L?F)9+{OGY(Jl>)0e6FH`q
z1Jct6Z)Eema7I)x;mBa-GWplE5qR5y31d%lQww?_x*Rij;4q|-DR|$YsM(YuWV&KY
zp@0$cEaEcfq<|^z_Uh;@qcn{kmbBT3#b>s`RU-`vWXGcIG}aE8V?MyQ+|zJ+Os!MF
z(2_{Tg_^in-u<yL2SrPlD!39*iD>W)^<~*nBHq^-Ir&V%mX&I*2+p#P%vUXkdJbbh
zk5BOwt#wY3C4>z4=#lM>MLki}!&p_@kvBda-FMZjr*=wl%tE>ozEmd8tC{yT6J|67
zr*_j?r#GKHygvd1;kp{CqwFl2zkl>8De*MO3ts}!^-t4nv;KMay{vOtnf5mOvdf4+
zCHK(H2JrY8F{Bi|OY)lB{E=#yQyS&j{VLJby2Kw7BiQ6LxKv<{&Q-qckx`Xl=jr9$
ziOcYmO=Qu&ESgWK(C?5WdW5V(KDe{OcN?*=;kJxMNC0B31VAMgwhN0?<eY|iaDcFQ
z6IwTAeJWH)Zbvir4na$_WRi6AjA-&x3-LEnd>ylA6aIOzm3)Vq84!G%9lO<8ckmKK
z+UD}!ZI{(S7Q4~4XxM}etc$s-mm8R2zEQI@DRbfRfI=6oU4qS*5V7Yr#+aorOg!Aw
zjhLTs5bgn*9Mz>Es}#BvEh^NhI7w1ZuR^6Z(G8+VuoT3amZTSP>T47^K8;>B6t&c%
z98*QzH{(NcUM)($8*7J}%WO06h**DCW|Yl9!@{Sa9~$i9?SzFLmVXMPnlxMfIS85D
zY3RUuy){=2wgY!nXwib5zhtMe-)s}^ww_A6>jWCCkPDL)`HCb=9)MT9KV{uwxtoF(
zNil3v;qsb&-0juRX7*e#!ZR&P&l?Id84g4DFrM`Mp8K%K3oLX6`3^63)Ab~Nm7{0+
zbnQdFMulq_BlFN>KNEF*iX~Q&?%N!Nqj5Se7QVIm<(*m+^QBUN>75Ht#52N@^p&g{
zgCk||>TEmD*&Jr3ZpWU%pO5vUF6XYTFvrxb>8o0}`8gsXDick`!{4A1C3UarxQSXc
zWE-f~7Y7(%bg1`%`=C=1vfzh)Hdjw;F{xgzHz{uef6D<I6!qRa@~SD`klkf)jPWRK
zzr>caNS_0!2O<?BG^-ygQ^jQ$tfdLGBk{qjX{|j&4>Rj1q+$cRmCvoW<cZq=Gf2eA
zQV$<o>}n5p2hJf%W)A{<jg+JC5o1x-2$>Ppt}+M4udPsMJy_5+NdfhOkLm@IwPY+?
z`^Z|*>+{35G!I<8GR0)Ow{{%kdvT+ROL$zi@p!CYmv^K&$X&|3(VzY4a4=vCUD`xg
ziG7gPUCTmPTUUl>k4jN`U=IgZ*Wk{&1x=^1=kh`H-lv69f_fg#H|OaN&3(m*X1LpM
z@rg<@XBg+G5?98z#j@n`ZrSM6y<8`IM_=Ra9pJ)KY3L4m509q18{<Y!>#|I!HP<@q
zf3!pmtaVK!Q;@emEOHgKZ_2KeS!m{{D=vv|!-$9SgJGn*6ZC}Su!3U7BXt3<`{9^<
z7O3C!^I)b~rD6NF)jwfqu#A?(Awc~FEyV~xk%gF(kx|VtjAL!5@=ja9{45F>4^Ut2
z#kdvZl&wRWS>~u6GFRIMoArS{ZF%H0EidlHXoc@@q7PQMr7oA->%|Lz8p`O7;DQS-
zW0a*vfM(G*xsq$5`P=Q5Q@ouMh%WGjGTVVxn~5{}UEhXB?-Z1(`8xj07g@3sSfUr@
z8p=+~P^4Dzm02*aPtYiA+IbT+=qGAv*kd>T{n8Tr88WXfS9Qu@sj<gBq}#p!N=hQh
zVP9>J;Hf|svgIeamQeEX>SkL6wPw@az9~xWDjji5;!J)|=QKp#dX&x?ZhWLupL-9+
zmAu23#v1;G4nF*%%~eFFr#gZ(o?e<$J2<|pls;`JFqe@Cfy=Q;RQnJejVRyT<r4DV
z%5Cj7n6n)Ej%1tij%IYD3%<?C)45jHwq`enr7_6-@!(8UJQi}hx08imV`*Ux)#!&C
zu`*a#PIJaYS~)-4cYiLmTJRLHaRp8}DWoP67tV+2&@4K5H7N`&92Y7kIYv+HcIeOV
z)+*Ku1k9+~ininluhkXY!_;|g1+w+*sq486<xIS2bC!HAp-l1}2aOAV{yC5G9zM)s
zTk-JCDNRM!RZhi_oeGk+vW;Db{If`q7g$4bjvi<*Dxt)AS~2tf;2jD#5|@r~QqygN
zVz0fdGXh(4dnu&H`hi_e1uS0B+1}?J1EuqR%cFlz0^Lh}pnI8&Yr}(5Imxjs>g)xe
z*E_BTqGKT2-en(vF=>D5U(xVVoo)cq@C^?buKniLepb0~H8%-pVo>qa^u|c0#+-BI
zAyx3Q&I0fkBvw(%S5m!eDCRQB?F;YpGO)l#mjQvNq{gk8H+Be6seQC4$uiwIxw4A_
za)VobIXT7^vh95loi`>S;P7@`dd}GpHnrt{p-G~kPJRi5ja=eVEZ4tG2Pa;tk;m4;
zo(xWXANFTj;YpLhe9i6as;}R@5Zwlh9TVYo9crJG${zOlZ3K3^z$y&JY6?(4ByDbS
z-iPzSNHZ3SUI#>Jrh$|ylPyCQ?KYO5ltR(_UfY`9*?yn{<Or@vmKZ&T-HquaKV@ez
z=*_vIk=ANkBWjv^?HsMA?r!bl^2A|LYuE;1qHd^A3~bMC6=&*6%^SaTmh+8fktA=x
zmL^*4Wt-3i&!olpgU+Qmj>&aOyN<ksNy*p;cI!i{HdxmKE7je;CqfotX{u7H2gDEl
z7eaeB;R-7I6^1HqF1<MdTZd_Z)3A-xM|(ApJ<6*aJNLTl#=u=<mQ(#aKbY3io)I_J
z&f@A>DozRcM&zwkP)bI6qu2gu9t^5bH9|Mk1{Vnz_>D|6&p!g$N%ZW^>$lacokDW=
zPX3uxzZ81397g)+aP0_~KAC%*Fi(9b_W)MC6g+8+mpRqTy5ZSs5-k7p=nv4WG2>?c
zytqq<erCA-w&WXDHV5RPgBU=!4z^A?X5~KN^m_V>jC$(o3l0jE5~GsHHymd=)vTf;
zz}2Nc<ll8a%;^Dh|5%ZbM(wWrReIXt^^{DWR@qC8AeO%^{*AoMrwg#7Cl{|#(uTqp
z0l$hGU@Q!&!PCd0IxUbVig@rmCz;v1RTrp#HCVz1#_vj1b;rV-?5^i+j|=Ub)7?ui
zmZ8(UQ`TN$Kx_bip^qan>ZA}IBZSd=7rx`*1>enQZ;?DJ0TYEuqZxUez@lUr)l{aG
z9Qw`!a9=(&GO#5)D#UZrBc{ieNjyJr_cdlJUidrUgq^2!IVv5#H{?Cv6P&xuJk-y+
ze#fRx1e$vduqGhK%70oNmts*{JHY8kf?dVG|B$$cjKMMOE~$)Dp~MJXjmvv&?#u6M
zJ{-~l6GXrm;XgiZYMRGvSKb&ufxk(mmJ~{zj{sibeYu9X{r0L$1=0^PQ@8G^z81-y
zo`4-ZUOzfcIXqiCJ(X_$=OCS1xB~k@ns_0z{A=6+N$)U;=3lhfLob#h>Uh;yv=x!7
zNyuK+dEONhPC>tHIkO>w0F=_l`GkwR^~pW`5T5;;rY)vKuPsfuq@w=yWk<IbQ>2t$
zfjRL^+XCq?jezmI7wCK+3tk1y34^$33gmaku^63=0SrM<D|~Et=)3pyU!_i8`hvP@
zsJvCI&WIH|V?W#!ZLKtYBoX2=zdllJ_{Bb_qyS}O_T3>Y$I`ozL&pzqyim;$e^drv
zo2uyiW727?|24safLk#^xXvtoty-*HKR=d+6nJ~l2huiz6D-qMJ8GH`m>vUV@ByPC
z`?CIGC$k|lH2<_;pUi(e)@1$RZ`SJ9z|;4&i^eoxi}0uQsl7-N*VrC8J4_>G+om!p
zVi{fLCv{zQS0wW(Q)w<d%SN|$u)Nc?!n3J&q7DoMrB3xXLd8Z-`|0W9qOei(UGZvz
zqQF|pY$K--eJRTw7Ui=7_m%Ii4wyZJ*3I0PI9$X}af!(-3PCzYj@~c4k((%mVD~*C
z)@kP01*?V+uZ&6}5+t(iLUqR~133Ybnt9D}v+p9Cpc(w<(rfQfe-&*}FBv<z-ie4?
zTk?~(RqID3S%Bx+gP(2vYd)l9Uwt)H+#p)$&=<Br^UvaZa`EwmCa?a-|Jrs5&8ADn
zls*P#R<T!#*v9&x)uf^_Kk8tp!Ckzc=8fn)N2~E20-d!K?7%C;&HS}J_7zpUV~L~X
zI;xx}3}p;DOB*x%!aKiCrzW)LLSo&b{-n5xk7rT=>33;@tF1~Dm@A-PotdFKL<v!S
znuNWjn3hC=)3Lo$S@;^uRxE`0ozq#X`*V-a_U$h)->688C;g@Gh&m3n=c2E|58h8#
zQl2dU<!gQ?`S_w>*>7l%@*C>|^G2Dc$a4glDX<*T)nZED)#~wvL5*bW*Plc`$;-K;
z=ohd`tM5vdI3)Sq<a5gyrv^pFq4|eP?*~o|u<JDiE0Or!4cYO8{=-|zZ{8wwAuH+V
zghh_gB@SjUY17M9(~OW3h)U*2hrMg`K&{BV#@YmR{6b4o&rx<USo8HxOKn1o@w%!$
zsi11A+<OBJ8?E?M@$?r>K1fjfE4Bh&A&b7qL_X2qkeD+VZ<Fx!9TqrJM-lUJy@^Cu
zy80sqJTI=4e+IAciE`KoeGxyy3b0ZhQ)H8RJ%PfRW6cK4IGGk@#(dH`Jc+_DxG4s5
zjGU<Ga*r}Ujh!{AY_GyHt&QXuw_3h=*uJ;l`Drzfo6?;J(=)?$%Y6)7<bH5^a<dQF
zK#6*RQo5dJ%ou4R^A=bFgQsj+0C~W9yQ0o7IC<VZ-m&|Bwv7SX+Ku7|bnvEiKAo0X
zpqA`&*0rfv8fJ7qdY!W8%d>*4MHGm!7Rk-10}=}dH>KTpD>WU)?%Y+rzV~&6l5W|B
zq+eC>lyooZGYXRh&s@!!agd;#Ouslz5yttnWih+Y?BFoVV;M_jOA{a8(J}urC%0PH
zE)<kQ(E#tndHc#F4OhkDrktoHDMuzjj48kfI=Y^^@XXpDQvafQ%odSuS$vg!W%_SU
z^$MMEw^}5XnyKJNr86Jj266e)z3Qx<EThF#2V!Xol9;}YisKZ9T}`hM2&G#fK7LX+
zLVr?`cU5AZ@XcY0CjQ~ANQDW^2y!Sh@4gSS3-oBqJ!4>-h;u(iGiqAI+U>A)7&3p~
zILLpSM0z;pZVIctrcj}~{XQUH$q{#e<=w>)m96GFr;#XLGON?rU;3Vo8ZXHH7?x}%
zb{Y+&=%TdQs@4Xy&f7gZOB%~Ic`o}VUI18$JwHs;Bv62_4YC>44c6I_mkcDzgtc16
zHL~`0oC#n(FrM&{0NK@GK`-7YkSYVGEGS99CTa+HR=gk+zWOCT!H%HSq$a=$8n`q6
z;V51_*|^B%f+kO2VOGl9ElwOu`aBcGdR_MJ3Q&U)cAR$F!F#4Z*wl1Mt>~P5F07M(
zes3`<V|Dgp15o5ndUlcMv!9PTonN6PdF{pI@&Khwr^q3@Ac94yRUYA18l-QG+Wf8y
zNC!98&e79v6zuHr%t4J>b@$ahh;+R%OPv)T9OQ~yQE##I=nrsvTH8kUDS0DO(iKUy
zgkQ54AEDFMZE%+Wm>MM+ki;1k`_H%u9fb-IhF$CwS;tf%3R}@aPjl{pb0opvEJ|!B
zjJD6};QN23Om;Z{l=lg?6_Vi>8zhj(Tctj#TThk0=39?VEqG5H{<}=T(p&WVrtNk(
z64hvi>5R|isCE`&=&eW05V`%A*<DpS$6Y)DT!MaV3^7oW*v_xiB`1h$6ciL;<GzlC
z<5wenvF>7uA6GnUE)3Ru3RXu5_PFDYAfTQRFj&V(S;K-3u8udK<aK!$YHc{-%ArP<
zH_qtRd{Y>uL681A;aPTJMf=IZ&;pw~{$@lqJUk*t_h>-XPbh0%tl-6Tm;1A@8hV9?
zLa09rx~id@){1W2Lu5&r7=u&#?@4^U^OeZV<>`hC6TH2isqRxLORq}_&jxu6HHpv>
z-}0W%_|X!iRr5xPvp?QT@#BVK=k7Yl@|$jq;qx_w)Ic}B1}6d6kT|!zSIgo>SQ`<#
zNKV(6P0Wa(rjgJjdTD=J8`@sKvUa(q@1oe7R>^<SB>#gtvKg5BtWmpmLW4PGXl!xL
z00xPYWsPZA$6R1?Ltd=l3$cmwFZmE>h0J61Ez^;xGIH_b>HPB=?WL$kbS`A0FTTpW
z?QP@WWPBz%OSADxfTw|=bY&Y$Mq@YUPKR&rsxEwpS-fuI-OZ}yv#QTU-0D7BU9%XC
zJTSoUVi8_0JSJwb28VlTi*@C9KHov_5BXFr&FwYJ1J<}kba3CO)NNQFDI;)4XCgHV
zCw7vgfEr^bf5q<J=D{m{{%?p-i)wi=X&X{gD;)W7ErIphsFzRHr!}wlBq~&Ae^#IQ
z2zE_UbY=O04SCa8Vs|yur)d&a>^$Fm)6%TUv={F}NOGN3&iJzRR#$FJf<r8`L<#5o
z*~KO%9yOgsv&b_rZZDD8G3E;I80(o;@_dfj9sQg|7(x0wAC8fRFnGUg`@t}eg-z7c
zs#xP5<UH#F>m2&yLGxpTIiZq1Vx$)T0SDWaMOsGtWuqt(BelhzPQ<{nKZ2`zQzwSg
zoL|eTs#M8@PbG?ru8qa1>bQ=835Sont>`SV*>*cea8M`L+@wJ{+V$hOsp#EAUl3v{
zU4mwh(yS*Hk@LsiyheN*YxW3hA?F$(+d~bgIRS<hzPq1P+PZ@WuV==Mg=CrW*t7Oz
zrcUZ8H$jWQYbZbm<Eq;$LDpo|G3Vl>j|R)n6N;v!6MT*pQrzE78kJ|6mkVwg){WZH
zjq?O_j}-ma)cI$i<d+{7=)7|poQK0Q`f)5A5dv(JHt;IFmst8<_~MxIm?NAm&72Q7
zsr*8z$S&V(6CF!JzhM)~f29!HYdKGVvCX(I$Y`Lvp!xXa1E11zX8RdYiu{=J9mSCS
z3F0hO+aYV-+(w`~jX7aLit<a{8TB~D(-n;oAx%1+HKyNt#L7}!5qnT$E)*A3ALfml
zFTD1WFg~^H_WVPrj|+^XL(A4h&9>hvNxrTsN2t0N^_8=r_i9=g{L(a#D65tZ4O>k3
z?uAybdyzax)Fj9)p`(e;dvEar-f2g<3QLEnh+Xs#27>FQnx|9(17Mk{d@1I&0=I4j
z9n%2<_VezGx@R;y?;`B4{4-Q{Ohzttde^-8s_eplr#r4THEU|lJ9kyJI16#$ak2Xt
z7f-$1?T$*R>eEFwyk2py%fmyL`{eYMS8}JzdsSp2_qH`*S(&UJk2^`{Ga+FEbWQmq
zn^dqqV`GGKj*uB5z5O<l@`~>n)cLX)a)iaa++gd-Mh<dX7a}4b1MbtOG>hM@-~8x7
zPC@Q=Y~3nJ2`7Xwr{`0`3qq$F_M&S<pVHLPXV-i6fAbvT>QrMFB%+RpkV(*8pZ(Y=
z&6ROJzTLh&8p}$HZ1r^vL>D1=8T$zn6+WoWZWS;E#wqs*L?zqR=uCz_WTD>693A)$
z+TX`7+4Lc|!KgzT=q0u6GQW?}A<kawlA;B!?4{pK$_Tx#BNqkD8*<0u%bUSA6KhuE
z1|$L^Ghd{8k}WL(%-{_rZ2;|p6{7USNh9URJln}ng1(>*H(a_m=<Z>?N928;)ty;(
zP`9m+sC-+slK3PMg)tuv6Nbe|!nfZix%bw5^2{Znh8J(8DH_W%EzvF<aV*4?Nt8pz
z%RTmEmghNUP%Zgs$5L`yo`v#jr;+}q^rL=ap~uovhiPu;cQjeulojVtGmLsA%y^#J
zGXSAwrR|r3_h4^<&0*^=8ILmYLU};JW9GD8q4);RU;@n@!3oN)|I(UL%No^-;-hl4
z9{r|xaFD@k7ruuw&uE(X{t8?8vPKMgpgpk~i{--jaY*`MT}`VONL3n47gjlQ<WdB!
zb5e4BX;gegO%Ufb7K!&q^C42}8fm7)(k8vkv6My8Qu(@2z<eUs&}E&8e=B!nywoHO
zI#~%;<aM!9eIvm##wIpb%gG;6@J(7*&~B*g@JacALx_&$K<>wQq3op`FJ{k-x38z{
z2#|RfItG1w4F2%Ks;VjJc9LhfV4gwdBvr}qH~SKoA@kJS+)vr_J7RMcg}d*)^2m_1
zExafmk>Wwclx5P{8ikS=*&Q`7Mdp02N#h|z|6CuX1ZF^+L;X%fDP}<bpg@#9EdnU)
z{jaJ}!U5erVGQE2ufI<+$ETQ<kCI$kqhZK$+u9ET#xf=*Rx#W96xlDPfu7TtME<~!
zi%`vU>_l73c1vw%GnLgt^|#YyB5O3nrlZEww$+E623Q^04DVLOH>Q_Rv!Z%5PJizI
z32N$^eYbh}myTfYMSY45sY4oa3I9W>7*jnj>DCr|%HxiYG2J`lC(1X}r-1fMtjO2y
zinGYp{K5YG8e!8~dzc2$-gwD?`aH_aOIHhUeNLFB1Dvl|I0ZHRUgiPC>aWWnlc|~}
zj`Mu9S0oB4w@W%kqnbDA-Hs>p|G@|JH!;p<XXbcT9MLF4`M1Qt*Ln+)V?Dx4f+YoC
zA)b~+afyHq;pSb8P7C2`&L|qC23UVrYHaR4_goIC(bkd4dPl=E`}&9Ym!z1o9DA1h
zCJ2Vgo`tpkjN9j0@j};6i20@c%H4BwlH%`xEaB~LxPD2h4RCtHP&IqI{Q-zA5w_~5
z7@(oRb0bXt#NkLvz`s%No!#GU%AMm`eJr9sKw$9U$dT5Bjo6w{TEi8N##U9t`jSF_
z)4I){qhMpe(kAI19em#1+pP5#mK}GHCbj1W=&Nq}OO4XG(9s}`(90TC^>rIOhny}g
zfJ4orBcBr?#20!$y_4|n`xjxfkGPw0h5rv{?*Y|RyS0ldAfPB!nluFw1nIq_AgCyy
z^xlL>C-j;Kh;&eqCS6o|?+}P|rHTj%H9&;WLr+K`++aEXzUSU^_P6(#Yh+|(tPs{(
z?`+SU^Lbm;;T%ZL-<{92V0s4d=`cUTDa&H(&#0j5(tIHo*f{=B(S^Pu3GH$KjK$6K
z2tI2L4@BQ<fojBU9H<^pyh$%(w;vzN*1d~!CD>-)7{Wc7D64rpdaRg*kn3-~!&v9u
zl2M39;%=WSwKBc!-*$f<d;px|(m21Huo_Z1{G(Rq7iZ3zKXH60M`B_C#3DnR+A+{h
zpznW2fn>@j!}%xaRmJ9#crXzA={c#R*p3u`+z;GS-V#&7e!;&FNPtU$IP}kyf24qw
z-tLsak|WAwUVu&#Pbo0&0-=>=TZvAKT-T+|Iswst2J>&`K2L(X04Ry{U>APTgWdS=
z2vI&L6PbdvL$6CW|0U@%JX>K~Gc%Wy?$(f6e``bWKy%0+vql^nWH7wi<<8kHuzX1K
z8C1!&-iv0;^Et}*B+xw(-(hPu)Hd2vQ)%S*`gTj|7a3ZI68BCJ<d|p2DX-4oD)nGH
z=t%jeJHh>zb-=cA*Cv4Vhg9x7&;Y5y`c`5<%M=Yf>GW+ciM4C2W}~J$D6s*oZYfmD
zgkJlu3`#^q9u1ycI=L4Geg$8bQ6K-S2GNX^#DMk$@-oZD;RN#GFSD4$*th<;o=yR-
zKa3^=MAYil1;QV0xKk1{`Q#^ajF2#+WG=vhCYBDQAE07u-a$->&LgY!qYH|@>zwjl
z37AJ1K?=6ApB!Q?A5p4wBnqH4<FrNr=ER*<==mx}{$e;=f<&$!>Kiga_(2w{d5Pt9
zq5^D0uP2tX;TkUxXKOVj%Zb-TB;*Xfr>*>pi1YKK#`7}KY`^C%<Nup^%R9C;KISQZ
z)sN%?(Q=-0s}UKk95KC<Lxg3Cu~K2*XwcGzT<M#dv2I}^2V`a9w*i~eIZ)zlj^3hK
zr*6@DG1IQplRP5eWztfqg(b_G(;G`<+ZH^!03}Z9bGwO^+nC!`^9O^)zTqM)s#V0c
zDNe_Be1B6B{C_8M>VY)TgEwDwX)ynJM4tsbOtoviu*UdCTD%hjsV^>luO||_UQKZ$
zvKS?hz%{*3Zw+zy7!v&4%tH|JK76sx!j?FWd|=a>hovWu=RO%xsWe-cX51L3XTf(9
z<J+}M-KoTH&<(0oQmu2pvoH=j9bf)GonP`9bl;_(y8C}z^w|R28t_Yp(*($Fuomer
z(M(<PFpiU0u6ZF~HBaQYAiO#vJkMDuz&h^WZz8vr8AaxpkHV}LQOv~suIFSHF>DK>
zKv~npoBkJc^g;{ZH+|n-@O_ZUOJu}(bdZ7;;jE;F3U;`!leZK_&Co_hcdlHCB(mZC
zzZ5N0)wZU_wr7tnIo<A*goo`Zc*0v<#ON%Mpyqsz$tl?eJUpJ-KC%BG&i_ycG8yj&
zbwn6EM^PBf7k|9H<1uzXdD5klG@??awJy%OLGLDB?sfUO&enNllPiW<DszA6pX|-L
zPK{}QpxRis&=fbpK<wlWkxB36Ow$G8-VHiex~1qdgy8=Y{}VIBRG%ITlSI3v0@fM5
zqNV}gh*oP6ELCzlkqk#}Hv{!1b2y@ri0l)Gf#)TH6EwRo|7J`PbF-Q5Xp8_-ZS%?@
zsfKywa;Sb0O<i~E0ASe@G2;Jo+M8k|)BnzX_PGS^B2)R7J@gMK|BFfV-@Ol&e4N`e
z1PR+B`QhkkHckG^8522C3r;yvGgL_R>sjsXl{Qs}j;5jRIS1=Ezn3eWb9e#=ZAh%$
zy&FVIQ{t;3G$wg6R&1c>BkojU>5%o=s$B8avDR3+)4;T3=Y%-!+(Fkv0Fg-fzLDjJ
zwUBn##!C(J(!qjLcrHk(C8SGaiwXp~9iiH2)!I0`TRuCS@t2H@bWDMI>!<{_`<pMV
zE2NP)P9HtEl8))I_#HQVC^~gdsM&!uOWsG1VotffN{liO(6f4lM@LEm{I_b21V*d1
zHC|qkE-aAud3dK`H(Kvxy2p_#B>s|qS4HVro1EpyV`F#zwk{QVB-e5_%S;(Xt_qHU
zxm4z|)xxQIJ)Ra>Pl>^4-W@Jk_mM*woH?E+2D*}`-#Cqb8?E3%jQd1J<X`3Ok~6qY
zsYVA!-QZJ0fz>?qLISH?j7k;Nu*G1bvwM-w9)sU=vEoAnBCRLz>%?EGuKOiK$F!c4
zXAf|jv@a!s*r~pj_6N*qFP5?nTMTq{+g>=Fkb2N(vPli-zbsmH!6U71ED$nTlj^z5
zRV2NH&6)Sa@&oMnh}ukN3H(8{I7CaJsYv8}?kHcdG4hCQ9BO<C<oNgN>;G>VDvAP=
zx*Whum)HIp&8`dnj2TIdiS^D?^(aT!CP|AaZ$J4yae4rSGx*LFe;U*MhsX6)B11DD
zY&Tct&yVQ7CqCSzD<go<-S4Va5S(Zq6nXtoz23QqkrGLfnOe=9lV+`w21cjRa&FfF
z1Y09Y`jNOk)c28GzaCA6dy3C{r^gN2FW*T!=3bF<)+l?yhQ{X~e@U+*lJ3nj-XT&r
zo(+n!_^L8Xpewnf3aQW{?l%F-k%ji25Tn`(9FB{~^Q*!fO3Y-n4Xv~nPOxD4Llxrm
z3s)KU)y#0Ol`gq;)}WqjHKgyanK3H}y(sWKuID^`M*gRVReuTm-spust$?pX{M`ty
zkufpTPZvEHnajS8I``KHMGws5--oCaf`lx-wN*89%;v&3C+nPx?$&55%?v@NxBk%R
z{H<U96P3P4b&eRB#P)u9^!owmGoK@Fdo#tF@wIlk+FrBj!65OLEk}!hsq~-uX6wzE
zO4SZOR21?iMDKhpG*MduPu9R@(E1*2O<q(S#Jkxw;`4BEY3UK0K>8*k{q}wEbb2k3
z1`tcC_|Ng|KckR+{X|fW=g9}-zwAIi4X>sXJ9?+G3oKfwxXH|$9TPu+o9`b+;0-E#
zFKq~mlOA{mugmRAI4!3P36161&qUR%0mcoG8v8u;Rex3I&vN-imHKbqzj}9p$P4yv
zINtI%)rY>`>CJ%^KJI+@>;mtFpf!ge>rZ;RJSV>Htrsxp3B5ugGe31jM!uqe4ox=F
zsZ4>vdJ?a$+xEuiRs4S5q+rx?a~mnG5*K$0NPdF^g3o4!H-CD7KU|Y})~~!Wr&eR2
zQ2NF@83TP*06GlF_;JgOLZ;aDhG~jR>bhpmo5qM!`Vh_aM$30#_^VZpR9j#yq2<EX
zQ5bs{h!hzx%o#?#P)1C>)3#dyG;mGTvpR`R3ta8JoWxO6PsFTO&t}QTncbrRtDhlN
z3+Py^juV~+NaTL6vFlNS&}=JT4y3U*A83U0pWzx^Lq*?iSR!_4=fpsBP=`$yKJ%_O
z6d$E_IcPEdOE7euI2JAh-O#^nlUFde>Uu8pgG0d+uZ?$4Uf-`Q8|bZ{*LQ2f)VdIt
zMm@|tEAFC{`}j9ARP5dw#qa9Clb@LdU&EUPcsPj#?cCm%562qX>qVN8oIVQIg^h}>
z(SD8_J3gjRP`<dC-*>Sx2|>8_SWXHwAj`09qHr)^-}`%!W^6Okpae+3jp3YD5+~n?
zNNnfTUy&MoGIikU?ScGR6<XYCXZpX&`u|=nLicou2-BW_!t}Y{>88}<s}S3o^kUYu
z^ql3z%`k4)eFJCC{n@~>3CqI3I_GD8j|<=3v*%1Io1Xr3U*l?%9Hfk>14Y^vNxE!?
z>5cjpF}{M(&wGQ*X^#uC#UEPr`+(job8RT64*u$loqO=(H%7nOn-2}>m$K<fGUW<p
z`PC}oCwjAaF@Sn|IkmNI1(Ed$Je5TllafD@(w2v>CEGQv*KG&-=b0@+P*?NKTCRUD
zW5>`966o<qv3nC*5_<y_xA8QSpDb!uL&Dt@O6rW}l@4(^%IptHIdXY$E!!N#`QxEZ
zwSP2#`J3?6g!*3yPw(}_3}%3*@;W-Wbz1K_@9cG@LJb_B)VNOHcwjYClujJgww9p~
zsIGrD{>4mWKepm~r700wQ)}rhC<Yc~72!xh7Q~IZRhWq-%<Vgm+M2y0&_ZAowJV}Z
zYv0VFs0zwbqtpAL1a3~`>E|LA-Q?*3m>*rQTa$=Wu6>8Z%GE{=DUAwIP1Shki??13
zS{+#+9YR*6#$@rjQsdNR7U&zVG2-`shJ2eGjTHGe3jeQ0;g!p&^1JA~ApCJns^>4L
z6EUa<4edzhwEbi4j|K?T2>|Vyn_s+Bi{R5u7P%L7{?nP!=katI+6{XfHg6p(LxUm$
z+Q*j9NYpZ0tlq;<egkdIJLiUyzkt&}c5x{WH?pACO6N7VH;nZAydP5`8h>%7>_D`Z
zHks!38&#6)y61{6G@XPDO`z6`^?9#dzs{IFDk0}HqzuSu1>>P7`0I-M@Snk27z>T2
zK+DCi5|4F)ca9lk8J(i!VY3u4z(LpQNeNiLE_BW7r<U)IP>o@&ivKb~_o#!q3Bh+#
zp+0e#W*|<{C)pr{F+(iB)fyXr9bEB&VC}=`v=*|gaFs?`LfEvucf)Fn3brj9G|*`b
z8h-TX(7gFMLvq~~z#<Yd`#!iW6Q}Tw$mKjlXS4f+PTKGF0q^D0*CM!{nNhrZi_fDe
z%!HZX)+8sd?Sais64f?%Hq8;$?ZH9KQGU05@Z1*L?zIUV?BkLVeUD}X3ia?}kIw*}
zcDMN0>WOu*F`2B2tjc?kl`Y5`bZ-fBXUS*D=h|nV__ZrADI_}A9M)9Mx7$4X<j8Xd
z)jaHzgI0RO*SP65<ChX%zK`}8(Amhz$qZdW2Mq)b;7_IcXO=<*fo*;I-gC0w$D2^q
zx0Ov)lCmt#{BFdKC|<Cf51k+wOkbp=r;GR|R>9J|2>@j#-VS*(0{{T*xg~f8mE1Nv
z+x-mZ7A@+-OWHOMD6%_rz^_VZnvBRgG`qI_vlji?)3!vJ9$vQbGJ>mrXg)!J6KlfJ
zpTD#Z%5wBFNc%+`XtB{>$Y{BTe^bMH?QNNP%tmtYKIxYFie01FxIHAEg9^sk+uK5&
zYds(vW%!Qm{Hrtn_)w*w%dKn*|6FZKfA#F?u}n#lQfZ<f>m7Q$GV0T4%;nqCY=dBR
z!LPC(DLtWW`ytlhV1aqzj_HYe&yJa3U2$Aa5{l_$YRc?#PE<-9{*fhTvXxU5J{I2b
z)mS3v=`_9*Q1Y1L{$1$w>=Vx0-FYG&g*%emo_4--H>OSfL#FY!h?|5?GMr!dhO)|A
z@D}2>WzU-MJJTlNA}St4seoytbkZ5)zST?ETYEL5WnPp_8m-4!su2GQm;H_%5asOY
zP;9|j`g+&XqQ@sdZ2x|fV#7j7zO23;&+tBvM2!rI%;nsxR{J`AYvG0E&d*O4n2qu4
z8vI$$4qQjYPWaSl%M(B6OtMXwa0?i1P+F+^=yq)srGM#v;5YSgtw=WH>_otKVXF&a
zjFFE)*y~Q6HrPNEavXiBYAEA)<oF4Gm1j{lc;Vve2>%A;`DF1Gb_D|OL8{RN(o&Mc
z8FUcN&$)CuH)(TFk|N3$dY<1xlxb}7B*GJz_R?FTW>_^C6?E>4r2jh%#jxS~oi4{8
znMHSXFTD~W4P|q0A3PL0j%z&$7NX|F(I*$EJx3%$lwtXEpW4411R%%N;ic;xK1!b8
z{c{1??0~)3+j^M$CndudP-#HlDK`1Y)yY6?5I`#~ilOO>W<lFr(SsMnP5QRaXZ5rX
zC+3Q?gk2=P@G_W22Hel;cYI`s=1u71O%UKscyc`f_jB&$?eGy1LENFQLS}%M`BJ<$
z#ZA_Zr~Gc~fIWrPrtgRgKoT^^D}p3<FyVS1hD)Qai!0cK{}zrD_cdTfM~a3!{<aI4
zAOm+y|AMl^O;c>m%)W_zziMC}{ADx4RY8U=^9Mxs#_qz}m1r8EXX1-Hg~|a}dizvf
zr@cn?Nw3c~`Twk!9>Uz%*qW@sx3@Ak$b*^ynI4uNmZCKOshFDuJnwMOdjFa0I?-kl
zk5}wu&F}2I>L@chZOpa`D9f>!BrF8CU=SLhWqE~(aF6We&=Lm!%FiN2`C%gs*D>X8
zHo_?xLHH~pilter1m>)Eo*AHzgk{)qSPJ?fx0B6E*EDr9!nW`k+f}@olALrb@!cnO
z^gDr9P^MVpR(G}s<LJt}V~=4=cB@H=wzWug^Hz+{ttpSsZQQQcQ&ePFCvZ5g9J`SY
zncSyoP8n@jlehtf{6&WEy?_m6rs;jE0q8C{p5)NPjBwVlY-V#7$y7)qrv^Mx(eCvV
z20dS>Q^=1QAU!FJd@TQ{NhY#t_wX*<TR*u+_NTP|e6n0gmDK~1{2R!FEjO15B;}j2
z#c}B~G(w<@4G%H~h0L31Dion-7lmGaryUT<iVlN|jV7lj41VdY?06ORK0mAZwc!gs
zrs2==?>ENG8a+h}%cfn<H}A`N<yc5^>I|?)ra73UvLAVnT7vv?0-ErL<3XG~A$D$I
zPHqe~UU^7G4#lv#?ls-bX{mz|-bQ@NMY8_>X)#tI)Tcf<KWEv5Ixmpj3^G36!n6wI
z^A_@Pfse`#EznVp*l?rw3VqCNnj<~!lxhZ`;&SR&>6olDLyBLxm=mSxFdeE0Fn`w~
zZC0LjGRI;0&}{gU9R_z-Tx9X8DE;WkCu%mND2KxC&1s7d=HqJq=%SDC5nITzw!Mwv
z*E{?|O|t^ZH`P|y6f!DD7B@k2>Ticyk=4dcm>tr8Y)FYFS2dQ5-^GoNPUN>Gy&77s
zcJ%?gG)u#0*EW$ME3tL+LV`|ojpOz2xj8TR5GtX1*U)gG<>xfvIPCU7BB|S;vX#!>
zAmdkes$)6qtP=#HcHX6CD=LbOir`Gj<XRa~m=6%{`hmXB(PuI?5w<vWR~Hwm?0uko
z`Qku#RerXvjOdchtwznRHX%i;<jBM$5jrDxzqLII@~a-(Z0r(bqe&>?-p0`P7az$*
zVwhCIIkeN)SOophmM2=8Z!cY*-K84f<RNh=Qt{tHd>B+H#gW<pY};ql)&bGh7$Dtx
zpc&Hz64t`f(jBraQa+o*w^x~3tr2L8wGe?!X^I-n#r|m8K11PdU;C9?9rGr<Uc}<n
zTWU~fa(9I^T^l($wd(S+Om?L_fc-&ALS%_p8J=Dc+%(%d%++`<zbz@^m}}E#IPcj7
zrjuGqR!7!ywYn+!Bq)<~!Tln^Kv#L+&y<%d(!)T-^gd8orHac1fD$v$K9QkW);#$i
z%|21#b#a)TwC!>@FZY7q+bH<N_iFV@=UJl{3(T8pD!`u!A}-~fL4rosk-KwYEu1|^
z+YyF}<TUO{K^tPM3T9nHrj%uqL6(zil?hke9edi#=+RRU**epdltfjHO9I3GRu3p2
zzQSg~`>@AL81Br5Zi25)_gOhj^<9mSQRb*GmY)FFF72lJfwSB#g;gHfsJNb;k4Y}T
z8Y$3io^puUnBv#ufF~<M4AD&h)WT9678c~!1M;*rIG3eZaUcTieD9O}N<~+aq%&~L
z7M4xA31RU?=QpBT4z~afF+8oQT&4bEJLeL!++&=7j{Cn!?HQTh&f`+we7xo#>BZ;1
zvm~EelX%Q|m-A=dc~KQ#7tnP;#u;R(9WpNXYwB9_P<`;Qjq>tza4yel<hLfID&gm_
z&tm{jdF%ki00l=n&E7-1OtB$(@gWwgxQgr1A{R3D-+xy6qXgH_hVt8ZF+X#^JGN42
zIE|_3eV?F!o67+|q1}%H9m4K%$S4)IPw6N{CMK&IbiL)}{xncJ6B!UIZA_v;+>Vkz
z#KZrG>!)0OMr`bj_t<N|d`7>et>_tkrci(}<1+3C%0Y&%LYQv5m}iLn_%r*%<52qZ
zq>MogxlcRY@NT25hGbuN)nB<NQ7k-xXqd+&f}Z!*$;tyt_w2(2simjZFO+{Aw?ji;
z7(nqo#R$d3m$V7T0W!0}c&&#PiVQM>7~79JG|{pFc|u!bu*i>epx$Vs^BE1Xl}!Ve
zrJW<HnHbG<lDHhz#MV+JJiO|s*_9JuOa$^AlRGwQPX$sr=&x<YCeSvhc6IJ1`@<(!
zD~}Hu`D>>0LW{UFIW|@%vz%>xt6XUT8w-a?-*oDr2UMjNd&O&U!E12^Ti+-b3C`}3
z2b*{KMJdDaD4x-k3QtbU8^Yb=vLE6<FQ7j8mk**84U1oz6)43-YFw%opvuOwvmqv<
z%>V;kG+ENbU=VyTegRV7>-+W~*1zTH5+#fk&OXX-Qxh0AqNAie9=;fP$nN8|7iVR?
z8pT$+5YE*my!qWUN(fkIy6|A3`S8*7>(nTPY6j>;C!ZbRnCErbQfHIEdN6=TAodfo
zfJgr!%qFP|r;VBn6O#~K%jOo;?i|ZOCfmES9HA(|L7eKn$xiV!Nr2(@#ye8V3rj~h
zFF3Yn@V<hn+4f|OHra?EdtNIIjS!f;;ou3T|Hg&_wmb@=qR;Ivv80|Uay+qF3tZ2q
z>b^Dw1f_~u2yR=s8Hir)F5yy#G94N-?^66n2AA!;E__<U0}}ryK$j1H&g(Lc$c>#*
z%M`yhlvbuxQK98+CD<n@;QU_H`@Bt!Tf=O|aS66nmT5}6=A7R#`!1TDe}h@`C+{Sk
zNmrK0(ZzFpug98H{EgW&tUTB=NbRbE=MmgyA>o4pG=Uwn&t+*uXi+xD=B+Y0BAAFo
zmtM%2ZwO&tLjB%xYatMy-zW-g(ve$n+Wx3i9;yEJ=snK^VHPPmnH2YKZ7tpP&f|sU
zqt3Pjy<$Zf|9k8i9Daz;EI^kwK-Ac5xczX;W^055D0+hDZJ6Bc>B56puWbRKu%V|9
z?7T6if0FGOwlS74_*$gOX)|!m()x@;S+MzZrj*QR6?~<@C+7zSLitf>yE;>Zk>VK?
zrd(r{?Nw*wCg+;5Au&l4Wwx`*x{OL%%i5O6D!ZmV_R&kT(|y)GL{F@lFyq|K+X7j^
z>Z50#+b8V$9q<E*+@W_+8QCM4wMOxCy-8hJ_{ijwh1tZ+*T#@_x1X%TG!LdPD*)}z
zXSg$+YZ9j6<K)|w>+EvG(|siO!zK1SD?o1R2)BP=%L<f=gkuX2Ntc9Xe#RW8inMBF
zrnCabj`i@BUGs_?M;rjqi^L;$pfEyU<Ri&Iriz34*%bdn1<RI!z}_K3a-&g!Oje>i
zr-TwAvTr=<ndNyrZ~d(TfTJI_unX(HA!}eoYkbh~#rv>OcI-|N*C!EwavprZHgZSj
z8#sju0mqI2KVoh%Yiy&28M|qkd@maHlr?O6t53fXIb6kD=}FzSWB`O%g8-mJ85I`h
zxLAK+yHE0(0L<X)rC9_i1RBn=CfJ{@k|YKecVlh%%F+-lG9Ppvp@p^V*e`KiV{WR8
zXM=H+E13H=k2R~=)Li6~`IAuHV<NE_tUA>95#qkoHwl}~4n85%j)2&OwDBB}b|3n6
zvk*H;VKscXC3_h>zaG2d;mRTl3{k%z)tyu2*7!-!&AKDsSQPkb`(kI6Y>(7LBmb&h
z1f{hW``Pv7bS=?3ex71QbIX?j&VHt-TX`$i7M9_U7NlE8J>?GEZbDGZX-Yl5b7O$~
z$y?>URO~QhjK$jHouSkrdy~fF@~<pGQ?z^i<HO&iWbqD}&o>0)2rYNMf5LE!TB;+E
z=9-Q^5xwSAjbkRGN`7au`9m(s$h&<lmb@iAw#%OCq@}3%s70>iyKKe?=&^$qo1zhs
z=5>p%G^=6A_va%~(7ZKA@$k#_KD|&Rm&@mj7F!E&C)Rp{+oh^3M9jd}xt75UXlkFe
zgF|<g*@2#`ac$l$GY}`MdC(<g<_%eLNN{wCs~@kDlh0nCOl*Z(nnO0yo;|6UID^`)
zqFKcGZLA69?eT9^Pwy?nDABLEZ`53PIV1Rfb;`Cviv36aLT{WPUAGqdv`g1*Tc)KD
z2lENn-844)+rUZTdW)|%%^%hXSA<ddT*-%lT47D!Yw?O|zmkLBDZ;;f{YFl5S-Rou
z758hua_6g|L)^5yF1}FUa_x-+V;S*-U<FR2oN_hU(rM=n*KTM|7ivtb&&&cogg4vy
zUb&?SYpKH>EB~}eU6jjQp>KftEDS(MOpTt9|K$Qu7`k_R^4=}5Tea+9-={u70_m=y
zTfO<S;|8Uu??I8PEjIFt<Ztg`(X|W}&0VxloNP+*iUl!g$nb?T_#J89xO3H{YP3<`
zZSl17foFQzUyKYvJk=I08?p?~eNTL2;5S8GGk*T?+OR|xaoowi1aiS$rS1w>FZE+n
zWjCl7dru;30z|*}wV{POWq4VeV5qk~IF8_KQ|#*^y&2(<zv{i2C@7x1Fg$A-3Oo2w
zBq#=|m!)hO>iXPXCURb3v5_h+yGd7lelWhl{Bp&m^HU-ulk{}o<Tommj&4f3&b}B<
z2;6p6f*;RE*>M!CR3~dywLW3&p#<h<^L0PMxf?C(BrWwd#%1kZ+~oXOqf?wSw12)E
zQatVPDS^{nPgU55YPjW6b}?=VITh5_Z0MRDUKN+PvgN|uvSASEP}=f-m7g<uq1W3*
zTK!A$lO{x*JFLniIek}5n)9Qi+rY=no~d2%#=v>j7C^U&q8fW<>7y41n~e_huNkSt
zZuO^et-dQHY^5p6%PE&O+OvyOE67o&GjnKO1l)N;5nxPxEsi4g3`z|@M8Q|uxCxx8
zInm-8kQk7-^E{wFWcOCU8-P(@BC^??VGi;Wvi@NA&Gr}nr;4j%(dfL5EE>s)gYwjU
zF?TWdm5FXhvic!0M-_27jQ-=#niYRXTpJUUyOb7%erDDG3dMZr4s`>z1b_3<!TP!n
z@b>}N2JY$H%~`kH1SZjpabK`>h)oT>6$b@K9;NV4Q6QQ~;X8T0;+!!HV>IurbXv&u
zbXQ}7X8JDKe7ZU7)1Lv_>PmjpZ#ygrj4C5sj!kj(&J0;xt)(+Qn!fzAdm0{`v9{Ig
zCo{i6Lt}hrbJ=VccoJqc7kRdq6Glrev(eH#x(sD{<5XaSoF#@NyQ+z5wH|c`yW+P@
z0Sbm@NJ%?#w-aA-YV^&{j45haKLzfm$G1=}NfuPD_kIvob)@Yk*n;9$t96Yf&w#AR
z@G4_K+xiw(Y7L<!&5DyH6S@|JG)F(0gEQnw!ho3TLaEE1gm2~mO0r33ti@d-1~wHE
z-`a4W=cl^XemW)%#x#q+?0`sdX6i?&Pt#{Lxa$nOKg2^0((L$1*8LXy$+;%2q*W(%
zr%!h8vt&MwO+4ARstm~ys!k*hACIzezWL`U+L`m_a%V4ORAgRr{+s)iXndxZZb9VI
z1GuC7Wk-PTcc0C-_4Ct^i{#b|FCUzU6bRccqII~-02hR%z2hq73|7lin{y6<%H;d^
zeR8sd-Y-3*lc9RmXr2(#$XPNw_Ff-T-^g`i&?0O*TwO{KVSbTwHerETxw5<_B4+`<
z?kSUL@70s{bjAPa4gWSyJ{|M(7h9a=dk%(GyUKLLYNognB(I`Bq2K2=Y!1so8nCQW
zz{zJm)&mc3H3IJGvy;)BWYh*kjxK##^u_ZO5|%^{z(-Y4&6ogg05H_@mfLuM0BAw}
z?ApPXwvlD1po?!GkCpA%^uFvT(>!%VKVcl0Qs1vco$y6pK}qXG&{rw(jURhn(TEW~
zpC-vcq{|-`0C!339bRy)<pTB+8{E66R%N={F*i5nsHWvzZ)~zjk%0ip96=|%rMN85
z`0)kf{iEFZ^)*@PmLb^o6lxz4xh-)6`R(N(zaK8}S4?dcYd(WpDh+|Il(KI?ZY|Dx
zmcGLjcgst2LQt{^gAord31?;!$W#z93qD*XI-Jt3)SRr0Q39~-!U~zS8jH02HHiup
z{R2fy@9D3-!-tGFE<H$Xenhkwd_w^|$^%$mj*K!wSChzS&}?3{)OSw6dUn>Dti;r!
zLaJi?qrO3<*&DVf6D>}98FU&}yhn34dXuYyk4A(ra5!zVy)fYH3GJKC-?@TPLMCnl
z+5n=QEHrTx=+>4Q6e;Yu5RodsejKv~IePgc6!@_1XFvAM;_X>xEaqG~Rj|90G(uck
zRws?`R1RmmFrS=Jt<h`Bu#j@RIi_i|WlcF^Ff8mZ;Cr1aw0sFZ%`Y;Z%$Gm*T&E38
zQgG)IM@+4|h7QC7a8d{$D<6IhrqTtIB{oD{oG+pYRc$lBEGE2nmbpYXphr1XY1QUd
zj&G8ITXUzhPpuTYt=S5E{k+{>_$}f3L`h(k)I0lN$%u&vyPi&Hkivmgtw<Vf&ogcl
z-FU0NXlcqtzgUGlaV~km2ky?{++NO}ru~_LvnMQCnjyr@ws&SZNTj#Qgfm8^jle#8
zq%XIK)76!wWMx)c*vJTFgQ}3^gCyCH-=@?{WsDFS6IxKpz3(I3;neUzV!w~I{dP&A
z{yr*>sS0<Ut|TZ!21L&1I72Zk(w&lj;FGi@+=~sJ_4oG+%6U)Lv5JeG5_2y@>4%&w
zL}2r5x?K~Bg!qTH1gN-(^#^%P_${P&qKx+A;q+Frqzm!*4==;frJws-T#Od{6NYBh
z)^#jTLc>}>p@)96v_a89E<G;oN}d~OY0hlLTYZ^hzSGfo|Ek7BOwFeBQnKJxzmoVE
z^s=-JIH$LRU7^Tma@%*?DY$e=&s6yWRSj+NrLQRS>A<NC7UHCSA<LF&ht3}u^54c7
zzfRbA^t@x~;6@+rPc0&s^t}4{jJsVWFS^U$!j8!S4@qr@8@v(rDMmR(YK^lD=fU24
zisRtGD=Tf6&7=5H9S2k1SrU;}kqYDoo`MJXkS{I5{lxT^P;(M}H&z->GT!mkA9(QP
z)3iES%M){Vq1z=<x0qwUJXv}0sK8tce&iQH?x%LID57dR+dZV_yW?i`jQ`Pu(9rGI
zvVw?6kkUnMPjG9ab-{rzS)pf~UXJx_b$oqEb*<~`TA|&fL4J^3g@w-0y<1lDtP`vE
z%4s;o*)w`$>~?1smR(%0>Fa;I`YMNW^d!*5s)^Fx5VgC#`$mqX_y>eMX?=?G^G=X^
z)hcFTi0EK)V`|C`gfULc^F$}piP{=ZRm7MFWQ$wZXJB~^m0M@8P-s~bFbl6-cf2-r
zSTGJv6XcX@QWD>W`DG#+_}?W+NkqoZDor{z>t}vC-rT)=2LG1l`Q2IxukLbKw>|Fp
z*g5dX<+nrZHW<xpK%ELZ`4P9TZ#H`0O5rBJ`b42*yRTdTuRJPemhFBa!xdo9JCyop
zRiPFs1;LgduRo9TtBPw_LPiIKPI38PP&roFfnXVL@0rr6Pic=3ckfD=Q(2$7W9fJk
zBock%Pm^<e)Ys}Cyy(!9W!mVnRguhM`N2+Bl=CB1kI4``eu0cY==<oVI3$i#+mu00
z`MA_))2nd$9Qoh6Xj4;+&K*dtQz*TnadKpoCNAj<QXke4A-EEnK_w*lU|ibbPe6AV
zZe)ZA5?vp*nHJmhmi6|Z_VG5a0i_QOLeNPxhoZ{U7|UdIdC|TOAI`Z9K`eg}1?D!3
zJVG5oQ&1|fkc=~kpz<<|#Zt)9v9lanf>5!6J*}Zx(ai<XAcCH9csDrvTjW+w#FK#j
z`oD4=BKA3b_nny)*X{VIj6v7=$YfblHVxC^%jPbkmdyjP!n-x)&eru@f<0vKH-`ql
z-f=2!6y}2q97HYe37KK#)@S7w-mFL6$uFmgUEAb_`S?{gUQJ|ReyXQC$(b<Nx7g_N
z^@$5i115LZ|0h&O!^Vp1j+6nmQ`4-{9wyW1)5ESPd8ba|1?DG?V`x8Ht!(8E$3`|A
zbkHXFV93k=(R2W5XRqxlB0=>w!W`Qv1wTO(F%0y9oa9Se!Yak%Z+g`EFWO1BzJ#T-
z#3AAPy`zmG3zT$Edg<Ocg;obtFom!|kTDMpnx;`iBFb+$Nr|fUoKqKn?sG*=X&zsC
zdCB|5x<=L`<#(>S5utQx`-u#|no8xpNN{(oyIhCI&F@H#<D**-L3@wmT6m2vZyNZc
zyT{-*(NF_><%iiVv`BJ!67SI!lLs}CI$b<^8dqh^BcVr*e6vS0mUa)%R-9y4vKF>~
zD#-5CUSuy_W#P5mapb;{Dipj&IuHbE*=Hry%*VdIznn_fL7<UdNJdOlm0hs2`w^Vr
zw7VR{^|=du=}o14n2<<oOrj4vb!OD}CcoT(9LN0^{@V(4;r6l#$BTL{la(A&odx-O
zx9OrayCc~jwB)48QJ=kSSc4`l4OCOmrvd}ZI8n{!G7Lsf;#m>1!LPy!QLGF02G=us
zxtj+{bu3ajSe~y-?%#K1<;QB%X(ZwVFW=jo*Z7a}tSTb1zG>W6n)N3zo=heJJ-*Pq
z0!5SLXU6C(P2!}vciTt2sg-4jsd+|cw)5^+Ycl9%pqDOtMu<`u8RpICOX*E-j`RhR
z<G84I6~jO77}<xdHA=~>G`K-;z8UCH>jy`h)gZk};D_(ln%UB>YWFfksz>v?jua9T
zn(1(U2EfF|gY|b3)Vx}~Jfj>m$H4`o4tN2T_V>wbt`sZk4>NI2%I1j%Xpo~7uiNOy
zniGw#0&Tp`(X0p9m)&o-EA*gp9<F$b(4%g!zQ{M0!ZgUHEC&o7+F*tl=P~=9PaD7(
zTtU@i=j`|(s)E7p^~bH<D{|u|uoXY!%tTaKLr%eq!G+*V$B>$D!YYkEQkJuyrlUDt
z7s)F18&#H}Ho=$x$W9*8+(mKp$oMK!!m6it=3(1AoyKXecwZ40T)SsJ0SZMbon!&J
z<R)m>3hqNJ_7<i}+G)S^?Ftg?7#>Lb+d87<k8g76ydCO}CupcWU8BrMwy#?S?-yh%
zG)zkeF5P)3L_g-y=Lk_cfnnivN^4i_Fri}f4H$l5X@JfEThPaV%m{qy5xvTQ6e>a@
z0Vkg1F1X<LeVWJvkn2%$%wEFOI^r_z$mgv@;I?qPVx$pF)~^(4Zv=O#8%|4<FR%S(
z*+-LHCT8A&iqUFZt(bJ$n(aef9BB@bK0sk7sKknN58r2GW|lluzQxQx*hO<_eoi?~
zi<pKH_sBZUr6feWEUI_Uz#=!Bls(K_P>tfJ2^PYLx8u;VA7hF{I|f&@jPLUNildkt
zg&%PKY|gzAcBFDLiv(6y^B~w-W`ZPo$GE?3^cbK-5=459C`H@Mf-CYWC%!UHzy6&V
zsEX4r$0Q8Km?^@Rpqb54$xszXn=!Y3R~wgE{6ONaSfP%SzLZdtRQ|lIW%@4Lx{=>G
zb?X-Eu&6`^mpXjqvk`JLk9Ar2OB#2zZ7PLQHWCK)>xz%nJ2shmHutseVg=tDHMOa;
zyEBY$%p!wj{m9U*Rc96YE}bnicpEW=ei!!@8S|kWX)Nd}(lCUI<qt}Ts?Hb0t(P(S
zyCzyhp47AQw>I#b#<|v;m`D1hxVC??NYI@u6#!7)(8-7c-W78jZ%4xS7ThcKq8nxg
zBdcf>U$%f>*;DFLSQ~z|<7V;^7N2>8^r(Q>+%~UGwhfGm3IW8xVP(@e-4K5+LgR^S
z$L30uED5@Yke~e-?qlLx5q)S~d(C4?eR}ichi9jB#T98A^39Aw;|w!Oa4<k=_A+X{
zP)L-%TPIG_enKADR!;I=!}icCsk>=%Dl8JSu!wN$sbV=>4W6S^^hT>+Todu_u1*g_
zZr7wnS&u7M^a&ie9gux@<f+6q-Tb0=ZY;-cqXMBCpg(h%CXeT$ovo)f>*I-vf4nQF
ztKF51P^VfQeYx<uNka4%t;CttfI(M!XojUpVpfm8acaS(&mZswb`VxgdNuos*3gYd
zwn|)f=&Z07cecyB*LV9V#eg5nOQ&N41ZB*s#8$rYvZ%oAP(zWY2&i}U;9$}5H~iZ6
z0{Z&FXpFA8IO*|Q!KRi7;Bu0R^+~iT=Av+RCt)TizKWgOZArpa#tSU~;{J^k{j=9+
zny2^@&qKqzf2<|PqpM0YfDoFAz=YuNlE-c7Wo<BKjO@r^%BHhjfQ1EZ`>V3XABZHw
zg(c<_<lDvROkuZv=C1ZbPw9|EPbbhq1%5#xWVCe3=Qy3!@ypQWm|~>#0pB&4Z@GxE
zA3Y#^WjTpX!xf$gX`9%Rk}2QVKDtLMRnTQW<@sGZw8F@JZ_u|Z@BAu_fl*$)<rZd-
zM*%JW)amiFu(hc!5#va^F(2`4<vq4Ek)a>e-9OMVdLO@dt}*iZ)a+he0>%1;$Uot^
z_Vnixk3?O1!1awH*`V8P7^}p$oK4Hjv>MtWuO|ick@9;Cc_9!K%)szk+Utk`DwJ+c
zdU#ta$GpeGAn%Ye6k~f)jOkN{!^eVw2N2L;Z|qH%Y)L=49%jiob$g+}eR`{(yBz_l
zmeU6f^-7jUFRz1YzE!v{Y*Xfx+}>Xym&9Fn|LBlwmF@Z7?Ik#K+a0}TfG^SM$Kq-p
ze^apx5}pf396eA+7K<%>J6<=x>>!!sr_iLbF&Me;;}&cw4QBl0WXEp#*pdf&JvOLE
z0oj_5$S?sfAY|lD<oyT}CB*!!#|G7N?J!9NcE3EyJkf=OBa7zi;i|{xGVtlKxlEIr
z=gd=OfU*&psVNN$UtH37*L^KumuH)wcM^vBf3LZfufj`5404#NT;N_m3{Z)gWxXmP
zo>w%TUC|bcpM&qe{c5w%Gqi+$O>(GW?o!!L;efyUBQtVMBIL0V{uEr~yQA(l^HQ}k
zm?{RgS&x$l*{)%6oVcv%CxUG<uNi9Vp_gXU?j14Oxko1&G5B*#@&<KV4T%W)Ndijk
zF=XlXo^#-N;wPr%bdhenF2d=^rZ>G!DFy$lE$W}VDUUl7F=*72=$G`{cz!nEwWiAG
zzOO?-$rqdEJbYa#Y-H4>P?0fBSWLYllK1Ho_3M}9$FzPYBO|;17*!$dh<7PX%&c5E
zhrKQ(wHjcrYE_Dl^cdTilhttcm;OORD<>)G8TXLlV?0cLGq~;1+|D74>ll%Ca%6}<
zsJ)gJc;bKgVEFDQ7N5v9ZREGmRycOk5>6jry*k=2)(l0yxb?by+wmPUJynJXIJlVy
zVaHY8TkHp|wH>mOy+Si1MG`uF5lE$TyYdqW9t>qPI|xQTbfQzKVA`%(G}Hze1%<36
zY@^6h)+YtQV#2JcMwr&b-RhO*DZ;KP?91UGQOW>n__B=Vo~Kz>Une)8qJ|Ep$XLMU
zsg1%bE}wmhT0uEu>giSsC}z*-;Rs--j|tt}5mADohh7GYtO%od2b_P)J5|50&X!<d
zKad{0bONaJ$2{Cu%`H)o7JL!ElT%kH=T#o<Rnt?#p6LhTxXgzV4V%|0Ppa{B7}~>p
z&Q%7*5ez@A>+K6Y4qE(?nK5dnKDf%P;5HMh%F$<7{`sIUB`8^G^(+w&(CTNlL>gUZ
zlD0xxdt-(}LJg>_y2V1K2S9rR1;qM8L%N```hOD6d3+>>b8Sz;AUS`+xpMB%J@1_T
zW3RQ>-0KG1wnnpTL8ViSK?DH~*w{I`ix#z}d2L3^^?J$;`?3-|mnJ4!-=Q%Et2t9#
z$`x6?NOpp5{iP{Pa9E!N9Y^=jY-HGby2jn15f)`QUD_LP%@Ivo!xa&9Aw5X>VW8)=
z9z@#2`hFjI>jdOGNB<hN-5S)bw>JkAZK_}&08CAZu;J0LJ8GnB6cbUSpOE@e(B$({
zv3Wdr<aIxA#T41GJ?Af)7zm~CP(GDfMDQFD-?g^1A&Mgu(s9^Dlpj7QhST^W=FF}n
zQM_S;qnSCGIU8~+O~j@{V)lgLEEn8tzGG8kdAX7APx;{b)mIl225<D>aFnY<k@U?n
z88B&#Ns}aCzfaYvxT2}wczlLZ^31%J4Ie1@%fOyr1E+5=xTAvxgpDruDP?;B<Be{q
zj9TSIKczQcYupz2Q-k`Gl>J|w&NIGKU&C<E@NWggDEzsQ3sbM|Va^)Mt(*leKKTl>
z!2Q0u&rOzHVU{gszHSLjl2)w;lP|CkEYN2k8HvoJ6y;=1Ec=Sj%z^o~S!bWh)~tja
zm+UWT#s|^uvi}luzhSR+MBOo7s8=QM=+7<j$q5jX7a_vx{3J6zA?xMG3y?*~#?Wrc
z_RQn$M>aJHLYw!0_hMc>PkBAV&g<59jYFO77s5Zx+zMa6)OrT_5p^#dzSFm~Ho<UH
z>B&=s+O&PhmwP(NC(Z9LsA71t|HJ=eo&LsVzO_;ktIVxENv*%DJj+XD-$z5TkyTNk
zWL<bNp@-9%sR|V^tthi|EoW(o5gESSj=cxj^Z<Ep9{pMw?7nX7Z&VJwvVO{c-CtfU
z)%+RkBkN^>Z0<R2Pu&&TE#v++v33^u3J7OhsH{Pq%^Ajsx20~kuA7?BR3wAMD<pnN
z12^I^y!6_?sQc9kj*O%;Vj1`Ti_5xynp0ih3cmHH<X#)`d;@+<dvHeuR%D{Qg48II
z>{inDwp2-9+-`cE_~<$DvMP5UdRxvDZIUio8dtLeXs*$F5NI>|lqf%&+m8m0rs>dQ
zae_Stnq7<tGwf^!hN-Q=BV^^>8ddK{=L9O)qw<VX|0k{@q2kwtw*Qw?-(;eNh{WGb
z{r}T$a#miNul;IO^nV1E{XW^1Th+!ZqjLMk-?mnEl6t$E-Sx|dJr4QD@k;nO%%!2_
z@$O9b73CC};pAYVk_Yr+t%F6CyM|5N&B3)b&+mT7-wp3^lXbF6M)`U}ja7C9eo2Pf
z^R-n23!@est}~!Lz=qD+(%Mp#APgVdWg=201h&B%j$5;T!?bsvqm_cu^FfJtKfg93
zA2debH*`xh0mRR&N((9{EG}b1|JHkyiI?nmEM`mfXPy7;JpLyxc2a|g5!M5d7JqKn
zx0_@xy$<M%mH6)$_AkvWhrHiWN9`Zqf+749m+mV|)AUdvJAKvXjv6x|{YULbc?%zF
zb^rjSRN!zUdY}<-Bt~EXXEkhk5PUX|kj=vg7#43j3QZIf@o}@{2JfJPOnO^Wfxo+{
z*V-%rc9;R0Q<)J_@v!tFiXSwf4CX$BPFa$P7|i0<LaP0_tXx;JW%#tT8zlD6h5wW5
z`*Tk28UwLoc`cF7?C+u%K08%q!WD>^s~+y+Y&d9!<NZsatV}tAhp!Tk2aS6oxj!GC
zN^aXtH}@<huI2{{@)@K#!;mh>51$=+6c17CdIvSj@fOJA*nkA0lp}Z8QOrb1m4Ti%
zi5ronF{cxy74n7nhrVSI!TVnr{NZe;k9LI@aotLV2K_DglaP43XoualW%zF%qB`**
zO4}eG{e6gXWVLo)`HGey5^}5<X5k+^ERZN1PL%u7r6_e_6H&cm<-O(CVL$X$0x{Z}
z@79y5z+dHsUHm+U_!8K9;{(J4U}{5Fzh&v{e<-1!h&{7QLn9xzi~jyQH%Pv&!_EDK
zUq}Fko9-;7oWTYwy&5f$sSX6xdf)8-FRr-xEU|Ld(tfp?>i2KJsLyV|T`;oe;^X7*
zy{>SZK+GlC9p>O}q|PqnxUaMw2vt-h&iyE=DWuUXb=Y4XAq9bT_#>AtJ3@wGqw-wQ
zlE%m9`+fH3$<3R8%E_TnsLyEgg0>P^Fw{g_d2o=5xa`BXU;EF@9o^eJe7zj<9Qke<
z*|&|v0%sPQyN_lWK^2c4LnAeg+h!&X(}C@cx?qkKC*Z`yZrCs?hyjs-o&8|}>)o6b
zS#td&G6c&`g!4OsWiQblv<HlMTW+;(n})c5s5B9T{;PL)Nf^wd+Aow3&`|G-*9}{W
z+tdH>@zCrpZlPQB$MJ)?>3q!#I~BuKo9<(Skf{G$Ij*h{eO0EnS`Yc}INQ9RxO{4k
zAKg8UA1rTzUVZ;Frf+oI<EG!zfaS_^UK<F+I>ih8K%EVpYgWQgnFFFTlJZW93tS3t
z8aL%csaYs8DF#UYdnxNDy)13@vN0z0Pc>B)z;KVLcPVz?M(amu=DX1+A<JWe$e3?g
zDqJ1ixTwWx#auAwQCqf=zLm2(HOz4Sn~XtWxmIr(kJ}vwXLm>pETRPZIYA{$J@;gv
zAA9iVi*td-OXo!7Fj)S1jOeTRVO2}S*~aau@K-b1`wemYFYI!-ZZ8(O(+=G1Sbl$$
z;y%y#XD$D;$_w%2`=`a151h)<*}ophoGH(%?4@vVrFv+4a+n5CQagBha?P|DwbP#n
z_UiLA(bn3JEtG4uc)2p&^va;X6HLs;yN=x^XK~iFbPbF+g;zNB^(rn_R%sL|y8N@d
zN@<NSyF$?U8_W(-q`*;J23KT4tFnF@W4E(P^`z|T2ydFNmID=V#51UE_HdYgrdEek
z{6I|<x(8@%hnY{;nS)FGBicT{Uod(ss549$=`<!_Wa`8>r&bQjvH`)CB|S-stWfdP
z7E{7HXk!IJjI-thN@EA|PsLob8IHa-<IeG@9uruOFT=OotBx0(>c>22GqM~);8{fC
zQl0rMPpu#dF^0ucAQ=9HYl@$V;<54b?2w-l;--uA2l=DFCfOoORa{mY7JY`;_f*y>
zh*7PF;}3M*(>5wC=;{1iU1?K=E$$#7E>HK}%BZ|4?X^;D@#*6-ccRnKOmw?>Wg_$4
zt_Wk9Rj;y&#Z_}wMaZRYk@aU#X+v;KZ>p;|TaJ<kWwnUmys<sUQ9h@}N^Qn;HT5wq
zfuv-qHO6k|)#tRxs=4em6uH{M2a8CL9-rmZ4Rqrt$rrjopQzjKk>k!)%Wulf<Sn@k
z3HX;&*ZEv~dN8P|`O@5v^4!5+Z~RZ3(&U3vr~3vO^4CC~CkBVz_l>ii6)t-Z9#`4%
z(K$B0uuNaMr{!$bzS13QlSyOwd>BTGXr9LzdQ#4}7Npqrc8}AfZ3JhAR;a@vJ+#tO
z34<1~LHr4ohYuF=J<;TET`FhZLBVMDBc$sg6Dlf7zSGg<%iC+MZ*XQDP~eNfSuZts
zardg6-Q#L+5^;rRmTzO7G5smdeoP?CYFf3$+m;G%^~e*YXolw%scK#r<W;Up2Zy~3
zZ=~Evjs0ec$-uiw4rLC<IY)=OB{i@N#{qgIP!hXm{;{aOSt43-`?<!y*l0EF^6GC}
zSE%UPB!${r8M|gYoT=pABu%rN6I=UZ{Ct66A5`@b>D;K$1&(eNXcb4DXC`rw029wj
zd9P`bn=aRS`B4hbTHP`{_}Q8hu&A7#UiqQb)<q5STepl(G}&!xU{SR773MM359AnV
zZFWh_;Oof^2tE<=9kCK`YBx8FFLhR=lTDu{^K<M_ZB#4@z(!tj_u<tR@e;vJKWvn2
zR7DL(7hhC3wu^;g`+)3g^FMjwf6ke^azoW-S4t7PF8?cjR^6eyr^C?eP(@$MaYyeP
z9R7^GKj7w8-@Z>3%B;C!V{uH%r?8C5RC}<ms)?sQS614J7PYiq`tawH!vvx-Zq-k4
zl1nb`dz0x0EPu?&)Yb3|Kj;cvk??gfO%_Yiry}<}#>=K@HuC7&U6x4|o|i3t&?^Of
zojJ&FumZaK=krH$5;LH94zfTg8MhIP+0bk4lU3)EtyEG?;K3ah;`Ed#wxuEWWP)Z3
zTQeo}!ww+QK4Y6SbzPYI8av@gOFy%y=EW3i0I8@8{OZ#^@64MY3Az@SI+TvE3*hqJ
zjFz{Ra$Fdt<1=pB=T;Z_B@~!hxmO?ECIbixJPufuEFO-eJ+C>Z)k-Zx-EuB;wpg+L
z*e0_q1@(YK85q1dsvy-Ia_L&8JnNkY4&<IS5)eF(Rn)6J1G9Sq)J;^kBBw=Hi-+?@
zn7i;L;P5QKhwquM(_{eb;yf|#<T!`k6>uh&a!h~zn~|oj*W*caziJL-4cIxy_N^CP
zd-8-5@DXg~64bdU7P3i-b*s2MKcBQ#b1M%brwq_xZ=cWS1J+x1Q@k=0B|~uBN`L{g
zEBeC63@8t4US;qeQya`f33`(Z+P60wUM{qRSC<BGz7eayej+az9-oI)YQI)qqPY^2
zcYJ;G1Ab|D!_E<GA=Q`2es@2;(wy!#zj5q4J;dBx0fp|0Y^sjc)-5;Yk>)lPeIGIk
z8lybz>=AfcsQZlK<#19bMbp<R*V|UZuCZS>JX!Bbu$6k)HbooCMcmj;?<03hNGh8O
zJs9Au%dpLJbwJPKEQRtRyMeegs~joNdE^ptqa&1)F31=cVv5V+KBm48)#*9F!y1(k
z8Q{DJE0}954Z-<&bl=e(W}>nxGyN1c(ZiFJPu8GalK`1Jjw?0p83~6ftYLv))r#mx
zO<Ip;_rG`C*wtwmz9N#6l*kM&duNr(s1lf6XFF?Y*cxZn<Eq&sgpA$p#>U`|;}6r(
z2Ae@%T8FRK+8(BkAGdV`bO(&B28?}&*vb9Q_ELsS!3t|lziY_ESCymIaHwD131ZvK
z)JhI5OO$c~#M#lZ8d5V$#BEblo_q5A0Y9EzqaCg?fll`xTpI}pvCw>*Q&?D~-fPk-
zF^6d(e8IimsHTbCs@^oGTyX^Lp;I#|haB**QnpHqkIg5<Hh`{HEZbUFrC9!B{Jgf-
zGiT*m>jBa<@UYO*%{4E(eU$$p%sqFS?#(;qY59%Ein30x_7f|Y0(QN;@tyFKO*a3<
zPLV;apEWe+Y^6ii3*THKt*?~p#Fe5eW*aW?uKB6nH_vYfei*XzIF7TloaUG1*37J5
z4bq=!fVtfLY8JF#bOUeWrxd5TS)1juze{&S5*uSxH(hmn>Y^lT6yvg-nQio%^pmBp
z@D4xnw0Oa0ANRoS#h`=5BTlz0mgqN9NoDfWD4C{8>M0oXMRkbJqX$2tZ5SNp+Rm$O
zNBYE8n$!tyE_Dt+$Zq$O$m*CB**cgs+OB%i+T-^BQ1;&8Y`5?KaCK>KZM76tt9Dzf
zr8d!_)z<2=YD6h&M(kM8qP7%8&9oG?i`qoZSh4pCLShF&M207N-}mSDdyeDtJjeHY
zoPXpv;vM7~=XGAM^L4&X#fM*HJx@FJL`y2ri>Fk`BMgd)Cz(;);o7T}uOkcc|H?5R
zzVp>>(OUB{mtT(G_tdtdL@wlc@Eczd@b>FCg|M1-rR!C6y09AdH27xm{qdT_pY>DG
z{DjW6xwz+)*~gw*-O{k)+aIx~Hf;EKFX=Z2>9wY#68Y5PYq$10CG;IJd|%#ARLaj<
z%Ikz=c%cH9MEm`!sZO8$L5>d_0vD~Wo7E1kYp*fNWTT{EFvtkG+l361=8aj>T^N)D
zER4uGDIK)KC_{Xjtd5aKw^PCXwM|-yL_b@q8jlRLz1*^DML`6(Z8bAm_H8+x5J<Po
z<+?r_B|Cq&SM@y8P9t=h<^FAuG-$=4&#jl#cw~@EngNjabmRBX_d<@&Q|LSeF6h5`
znD>&p*HlfpQ?lX@vRbFRLVkdvyJSb)!+JcQkw%d^0t3!x{Yrhl+4S=AG|8~o{xtda
z@}Yw2SEw1qzjCPIO20!%6$27;pf|2*ST@ZrSDW^vOXHr-`Di`w`_Ck<dmsgUPfGO~
zGa7K@Z=4NM4_FJcWqN3+w2GAfl}8ozC`6Xwy)vw!=Eq#5`~#mZ8ag<Xtp8BkX22F#
zOs5W8tsnxXJiDtv+f$2Ily7|~6ic-5QF&9O2L)Kici+1=EO)u#XS1J$hYtJw`Qtnu
zy`fbH^kC69Vs3|P6k>$5Ib*DuiaXtw@wV}#?q_Zd-=dZtVF3@FvF@gh>uIW`VR5C(
zk^?=kQMITja@}bg#_bqz$s<E=j3R0I)ETOpSjqJ4!t^&l*jJC;z%!3SbJU|T@sNf_
zf8ufBCE`k{E)EmJ=DNw#)jyHmuxM<6S#;FfFvW)a4$>%@?YX6Y)o+(+HS&`}Ms0=}
z_yW7=>S97%Ig0SRHh*i9**y(#j@<wFEnGDKMqGCNy;H3_H-g}7zZ|mG)^^dOz${!s
zV|Vc3b>J76<>I4mra`@?SCO@>3uzbqE8pIj0eu`EY|3k>3S?vk`cr}spL|BVZ|4}>
zt-H2mzFk)E<(b4kAHd6?c8r54%ITno4K`8g3y<AWGSj6Pg9owZBR?orB*BSX<x33;
zxU89;b~ILHj$mbS^6`{=c|J_Hw4yfO)r$NjQRsB6oYXCU&W1?zhBCBzLlj58N|2_T
z3lY_oicUrIC^j4g#EEKSPp*s+#65cdphya87K9G~YyZbRl;2>@9x$d3gFnG?g5nvp
zM<we0l_LD(|B97Dabr{Q6aGt~5{jsL$@~W?dae`fXV41Q`zmlPmr!l_OP}V(3OYlk
z3AcE!y0TKXNn=Il4R@mpKMfy$X^N!L>&xR!J-C=2p?(+GK1?u|_nLoMx4-sC<BKwV
z;(J=6@=CE4vmAy-Yhe%&{5GQ+PYh`KIX|8L{E@4SU2bxCc&=Vp>}T_()M$V63)!^a
z)gV0kXNNIIpq#V7Q``&#G>|)df9GqcI<TUpM4-(Sz}W0Po|r3rXJ{5y3lpexKJ(Xs
zbz^Z)SOIA^glluVw$snBWw6=i>rSJ<YT0h4(Fnf-$36F?zf!m_$w`$5qfj$BuZCz!
z^lJ7uOeL<5EJ*`T+AnCnZ#eZuKmjQHfnYgu;`HM~-sW4#CyItX+_khtp!4QOxcQzs
zINs?zb1stG{^X-fFPhNKOVmYut5tm;o%V-=CDvHy)s7Vn2M2z~>)B|vtB`s1bid|n
zJFFp?2R=lB%U6OLsf3tix55gFpty1EFne6ipVF(bB2?2j>wV--;nYRO2(F#valrzQ
zp^eE84_DI^ZcXwQG-Y!bSmtD2gA2_Qw@#$InS8467zQ`Iedkl~mQ427TgZ^^HLho$
zeCjad!UGN#1k*a?%Ef!6<Ci{HiY$otQSSY30NOsgBPjkVo0QN$M`MrZr*x5M6jr`C
z6H$^RfIem)DVZpe(|(vt$1f3b2|&j;1oKOBmATMe;8!<Ve!_3rTh=1scwQD1YWdJW
zz`?8x<xwm_*BQWu&C*k}Y@!wtLc{kps?XoZ{{1Q_rwg7EE^cXJx99M?w9?_;FA4P?
z2M^zyp7rlzJpq*;bR#~ZKnKHqrJNBnWA^d(Z^~{O=#&w-J*|iUG2S)MU$o_6;5^E&
z(@23&jYA&$P2juUy4qTJ^)6|oMOT=%95!5GUvef&(_i*%l9Em{F#L;Gee(o+koP+C
z995yoI=}8z4vyHmJkFxd*!JzaR~=DhInV&AMTvM^*TNRY+*&HjoT1A^$h^Uv>Cb83
zd(ZorzuCc+kKwdYKmTTMoeEAq+O-mEo5)9lOU*qLtq5S452arD%j(?J{s3kE7l=3k
zw6LsJ^(cFa&A63$i64xU^l$XQMTcvw(!Sy%qXbl_lyf`8;Gf!Kpz@Y3fXXilr!P=_
zW`khAXE9TXN(fM@0c1k;RUlh)D2~aw$qkr+6AD&^iBs^uA5y8=0Qgk9=15r+{^Av<
z@Il%4eu(E|l3aeDV~$F@B!`CcXqd@C{p*8inF_SnCRJPzq>tRI?MsKB#gxcWWmXas
zYPR^{lb;)=Xj}f<5v<Tiu^uroybONHy~%Vm*~lO%akr+!J$UtLs(Ub=XT!%PF_QUj
zAbGN(xO!Cuik|m5kG8KPnis7atm5aw4rhjY8vYMBE52ivjyvM&?ayFPAx`^r*b@FP
zkGPP?OTW6^oBfxO)p7r>qTH%l!it=zlFkvSs^~jqtRyb<j>&y`ZNbubSx8ZyDKX~p
z3A@z~k9Wz=%>gQv8(k~KXI>bf2Aixk9K>XAY(>nx@=O20Rz>I#uCjOjDETOJ=(*j{
zbMXsBBh-&{VTYk+LxA=a)XH^Ilvw>?=`75mvE^R>;z*2V{qkCVaF?}Tc4ncGzXkrZ
zN^K+iGgx}{$(P~k=T?RaJ$4tZzBG8`xLeolIA-i<$NTh_wdTr4jOjZ%k=Gxbw6}le
zV-{xLdR<XAh}rCQh-oK}(zTv0CXu@_rRf|Y<u%A6sS-=q`-m0mEAy|A%j16OdPS?A
z7v9>a>ISvhn|{0fN!9sewhm`h6KGNJ!Bmbmpr!$}{p0ebwWr3ERSpg8i{=<3^x@xH
zC6o1&+<dwx#n(S67>R&c@T5FOdd-tg+WGOt+}~Twa<eE?y%+OQ&!4rGjdAuK5sD$6
zGv-4!n=TtSx(k|Cbqm{UII@y|#axFtl`h^aO3#std1|>Dn>FSXwd}<?2)@0j4S^6^
zS;3R#vOKU6dOZ&MSq21*)9246we9&Jc8nc8sxJX0^KaI%=b&o<Y{pjLgK1xt6`T=F
zF1^=M`!~iOJ_jBo#l546Srje~Ppm3PMmBeaiM26dg0}_^RJut`Bo|p6(<n6>0-smG
zsvwdHU$)x3EbF#Z^UGHu_QjTeQk(SjCSn$Uc74m!x=1vwHr<)mm2RuzE$(TgyW5S`
zgx&BH{}#PndrwbgN;X;VN^?=Q7p$YL;)#foiEj57IIH25*#lNK*(&GTkp(lHn-QB;
zf)&mRA8K6rzvqzpr9Mqo(1b4vBVDL@THGm>bSUKMXQgrHaJ`;x?Uw!~<(*c!OJC@M
zv*~fLrq!}@=b9Gg6R)e;F?}!%F{&20bg0(A-!!Hhe`|y_A}>+i&+l<+QUs3;wxld!
zb|Xbb{E`W2WY`Om!qO1#EO+Z90~oU_$9G?YdG-rSd1v;i%Dlt$IOjTCFnFJt&wNl>
zdCF(~Y9u_mZ;S>0)bGaGG$%ckaLY0eGkqe}?gOqaHK3TM7p0)ebR|yLfig;YBa`6x
zlcy+3U+|g2ag1nGD{%S?mpjx|<pX0dwM)6c?zq4UDH<p+xh2!H!C9^i$;zNXke~F~
z>&qFV96C1H=+u2#FIVI0X)lLc%w$9*G)tcjzX;h-2#qP5<^|_TN>l_>p0?C!sdxJ=
zOg&Y!;gl0(3JxYcA0|H!p)Pt*?nWTp{amu5)ynE;e8CgKcCKZ0C0pAVWF)?dkkzw9
zto)89d`H*#l~8HrJIX^J{qql!qmcV57KF1fOU!#@KOr;C>(?z^&XDyMBOK>;bO&K!
zlAn;g#ZIgbBt;UU2!$AE15O1)H+veMY2g82d-WLlWe~$?ME);2B}kV>8*f6_S4)CT
z=WANr6=xbIozoCcSKWLXIR2L2QCmT;lG0t*5x8e#;!NlMT{HAT$<7iZ&;ji7K~*_9
zVWT#7dnH+^OIuM}9a%3uXgvA7t7gM@^SETVmy)s=E2KL6-B?k!-a1V1#Zc5OJaNkV
z{8p~X51K;2Nq2R{?v<ykYt;E6;}r#^Rn2akMm4fVr?!WX#?_58nqO@)#95iT&Qq5(
z63tg6o?iINOQ$KF>nDOxR_T9Zqq*Yxq*6}M<f+j{*x*=$)a#S^L8uY-<_`CYioecl
zm`bF_6Hr^_q&xMxYEsGY>63(<o6J14%ZHQ^k+tGG2lFPEs~nZEXl0Xww;;1~R|G6_
zy5GXy)8ms3XJVo_j-{DlGWuHwxJ`qpYgo00It&jzMn3;CKw=(~!LUgd7&}}})Y-*e
z`8zCopeWvzV0wq0nfmsm^nHzz#Y(Oc^raF;k<bSub?_zmwpK)D65MwFGsWcBOP9KQ
zOC#G#ke{RRJo0Tp5UPJG(+*MRpVHG+V|teOs6pH8wK)$Spz6QXIi#4Nfh#uDS#Y)T
zwScTxy3|V-Eok_U_=KfDyY2HQPjX4-M&yGYSacfS>6IU_g_)A6jzr%iV&)5-AqE^H
z-86<ihbmPKkS^&Zft|B<xBYvJdyFmbxB4y|F;^&|NtfIBaT>@T<`eEi8ZLOljRj3a
zH~IMu(Uq?<IL2Vq^9PM5{>{-&(6Q5&5~G>CwZxFi;FfoHq8IBfdo3Q+j1eTJNB6e-
zg1uk8N`D07JxVzlg#1=<-BXb?tqEeFy2d20z%Y>m;d`TrnQn-6bNeu1JfdS3JB<(X
z)qbA$GW~ZLo%vp?a2;yCt6KX`#h+dc+47^pmKt-$8+*R7@BREwZds=p0#_@Ph}qRF
z0mE5lu^1aM>}+j4%0+lUmOG_Y?_i@zOH5KLXZB58w&hxYTNg_HVQ3PV^%CRSR7&`!
zM1N?0)plyod8G9);wre!6svGNq8UFV%Gdg%asG=0@yA{RaQjZ@XDX;i0c^&LjwHBz
z+oE{&bfF04lYClhJKTe6(*Tf}7qwW;Ah3Cn@h1TqKi3QN5y1UjOYnYuYU*={XTyye
ziHk@qgtfIq5lad|L(fXldR(c|@__8PGC!!S91VusED?M}qYZ_C50_HDB1XP;Hq0PS
zXIbU-7}_k{{H%hQ0KZ9?|AGQ4T<WquG)zqu20f+}rQ#IiaF^$3@R?}0u#U04oNFJv
zfq;+bShU5=7FP4unW=ER+|dzK@pUYcuk}GIe1{yCaNrlRzQ9d;aZo>F{hch~`qkF=
z3RQm#ZjO-W0NMdcC@Y0(av+euSqf!crKierO4z^H+-&~O`uL=BjrIL%c4tTjZRRU7
zhLC(@5N%xG+g^Kz1`<&TQR(6rVTRsO5lwt2+0E6>g`$$L{GnKE&cs#w3ymH$x*twZ
zh&)BcCY4oAt;Utt9ilJ!ZhrbVr7q2|I933}x+}Bth$^86{0v^xcK<{(rQ9j;uC6{#
zow-Jea%AtlyZ0J*6W%==g&I+1r|infc6DUc=lQs?HGuBQb+$K4w-w)nW#TV^fB9bE
zqaLG+0XYHng(ML&A;xgbaB<P7amMxo`W?8{v4X2~xuBp}9&V#_=r8eM;)TXD<+Yid
z&9X^{OD<i#to$2tx_9zTJ^z73YE+F=vlGJxe~r>^RTP>86(;<Ih(Arx`T6ksid|fJ
zD3l{~-@ws>4pK=H$3MIy14bc=48T?EpaqELI_}g0;#3=9jp?<jZfe)oa7eKws+O^!
z*#Ugo3>#@9z+o{=Yww4>EvTH(JNJj;U!~Jq163ZCY|3_V4`UwWPz#KK>@B9B8M};{
zv^o>MRAm?u-6{cD7J}uNxM;O`#LHHsTbAwCb=DjHa*?rHyh=wa{wkAs=5sqJa_U}{
z-_T=<-Wvqr*c=}~V5_z#9QgH&ZgJ9kno}+>A3kUrj)m2e=ELT9c^sqoUaAz~^73Tz
zR8c!V-*?C%10bUJGVx|6x^)2WU$Wb(EQfh+QXJ8`I}vgCWv`_c*t6yRe%4{bYjaGX
z&rD?^pEo*AJ3u9=@=K+=+^iDP_qT5!8-W263m#{~yeQ_5)NK>RyzD)V(74U_OBZkr
zxi|O2Mg$ToI(kEut4ilK-z`43R^Q)MZ%sT}tA@lFF>zavVGLo4<jv;!f62TB+^sp2
zGTilnjCx_zS_qO{uK(OB@u$9E;+g-3@0pxD`~H_EDP^TH{SRb+@>FOJEZ0n2yV_D%
z4RVqzEwxCCmI~CY4~^AET5Ggi?b^*RP5fzHi>pv3WuJq2sxTU~uD)O!=`lL5*>%%m
zBv)50@Oj3SsH=$w7X@-TH_JbOP<(Rc;~)Lx8u2=f$?&LKZEBHf^;`6sxnDguJ=36i
z^=x#=t<0Ev`{8vn)f4Y|UCgd#kd1&G_w(kj8!YcZbb8Yj^x`#?ap8AK>GzyeqXfiF
z*Us2|3u<d+rE@}tqd)NvMA<?&`!ozG^ZH#+t}42qizCTei0EstD{D(`2NeoymYAN+
z9eiXl?i$yx0q|bzr`{oR<mTVMrOM~`B5GCdu$6SM#o^H|YWxFn*W&&#ZmYd1uvfgr
zdC{TpzzST@q!#va(|=V`w`wf`J{{5;A#Zr!()<`NaQ6ygU1c<XloeG=<lM@wDq#6m
zHHB5FJSse&0K4)A7-hk}JwvE{ZNul64zm<LJ;}Ga;E-6mYrM{k5xisysyM;coQ-Pi
z_5aMr#usHF%NxEQGdINN*Wd(OTMXMH?D}>zJrHA`CtFN7fn&ET+H{vfagU3FQ6=m9
zPg@S{#kZhZ4Z8}8>t*<eK{`kTs&304U9L2IySkSXN|(Mfu|e-0OF;Y3*~+h|)~apP
z=ex={Oa+YSgSqSPL@5{czmj;H?xuRoDiw;0-kIG7`K($PZ?lkM;NDQ|!O-nh)+2!l
zti&I4#2R2ni}q)_{$6woe-j8=h$2P0JY|3wd!+MXO{;svs{TNMv719eaKQhm<~(v-
z?YFzQ|J4GJr^1@TqFK|9ND$W#u_<;#A%gS^SYNH@N2gA<_1-k5YWJC2zf0=luTBn`
zUAj>uJ(Un2st2<6OE)g&2gEZin#xav8FKr(^Q_ReJ?U^Avty#wHKsW0o|YfqM#E|d
zcP`Lu<>l&Xxvl_svY0P`s;SR=YVOVjF>dw+8PBQ#gLw{1d9BC}&&%v$T^!O)uFu=M
zUn^>}(p0DTv?(2P3Eymo!Xr}-4xGPb{{`KD$5gR)a2ibqoamJTuG_n*K|C=(46o-O
zXyHu0v%MKP+-ICh#c6D|0O}}fr;#KBRr~AML_p|qWP$Por`NF!A8!#_9`y9hJ->i~
z-ATviWi{GoQ?zqzn#;$4cQ^^OH`hyLTzFy}AE%}#PU!Tytd1qQ-txb-Ij%weq-@9i
z(K`RHbrg56^DaQ#I6J6~bVUs#T18cszb4-tl8j;exp+7o(95kKEU=v>VPQ}XQ3*Ky
zM$Nwayuu#b=XsLy@l2+&&G;(OVsL6nycY>UuOcXbvI~gPnCL=j{fjT0d!=pxH-^{4
zIE+^y`qlgydRsE2evR832_~FDH|vP=c5BZ*IN1~4Y)=JWk?%{l%&x6;3B7Qxn}c!L
z<g&l9#kSX#=8v$JACpe^_-q`sIIQ%h3yCTLH=wE~X__3*jA&=&>g(B%lF=8RQ!ekU
z+NwRTL<7Rpq1Ny_`Si};@jnl~9TKm51Yr_c)vTwIdX}&RX09S^*nuiNK_o%dUuWjr
zz~u1`<8uc<@SWQG2leAio_7y;l+nWqYNh5Pr!fj1w5>ajbhsIKTu@ujdo8M)Up9V<
zQkh5$(T+FaG+5^{Sa_1Y=aZH8=BRGDEzrzS8CpLqF-I3OSg0E+`$oVC|KU#w;xa}0
zW=LN%R~+#kr2y<b>^)Uul35eoL(_fqp6^%ug33JI2Fl*Au9T-TUw7EUGN}EVEl&I!
z-`Zx+2b!7KXxdhLS3A0-F4etqHrh48?#?-%Kqx*xzgU`@d~+UaW+39EFWI-dd+9n6
z#~@(0x4Q<hqD%Npv49=)51wg?Lx|eoRhfr{^!vfQgTkd+ozi5_?|-Ev7Psk0+)N;7
z%Y)S=(*nOebr?U6X5|C@E(0kSp|r(ZdVk2xNHkejB06<jpFlD(SJuqfsf}(=6IgUV
zJ1WQ-uje-^)5Wb!IqD~=EU>wVOZXt#Wx*G;;!6K8=maZH$*+DwnHU;9;dGdVnfIk~
zAxRU6J~l>8pPPpmx}Kf;Z^>IwcAdtEvPUgEy~PiMOjg1_p;EegA8hRqm@^uDL+<hh
zUIu6Sn@s&kp_d5QRTtTupD`w-^2<4S3%mRQNd=zoVQoKK62v(xQ!>-a4ohuMnT;=o
zjqn#-f|ZB<f|?0{g=VkXt7&v($QM*a5B`N4x=5iUC0)r&%~|Y*qmNWNuJnevV#Y+j
z`^i75lyah7)Yla<*Q@iE_F$(Y>FUa=lfY}v7~=`M#rm=VdRzJ>;$O?2AY}xN;vsfG
z{l4S#Qy%V7486*Q(Q0nW6$s)>Lm$*RphQIx-<h=!nzyS6qsg#^VVAlkNTY%Uw`mVq
zfDSY?dCe*H><ZHGgQlu#E>p3tQ#IZuC4RnAvpx)HrYeLRYBv}&Ad3uM75SSangmaR
z3!k2#q9IodBJ-m|#SoR7^}=V-#@8JZ-v0hq@hLVqz{MfKQ)ku6tWxnvWr2QCFk3w0
zSkZY0dO4{nGCo<xO>a%1_IppS@Tfo=UF`Hn|1c0<O*-v`ABak}=VJ@Yrrb`js*5Xb
zWmlOngZ$1)Ig#7!R?-BnA~e;Tz3m--G_AJgZzY}aW7_b(OxWPQEF;P9OX)f7FtwY7
zXr1Ob#|K*;Y@0I{C>=7^q$-wpGNn&n)9G!)@+n*`%Rb+fjdMgUYz?$M(czjt=;3Mf
z0Xh7R-ZtE_V|Qw>mllDE-OsKXSXs>{I<=La_gTDg;#U5`?Wuy#ZKXzw^b)OKPCOpG
zQS3JuA88|5J(+)x=m}ui%d4P6Ck$oR*<l(F&ihw7$<9c@5cm;WX3JM^Ma}#TPIkWE
zx^8sqLJy_@H@qg+T)L~ge)<QzO*U%&F?GwBE?}t}Zy*W(i=H!J9Sm<NR-mcm?)z3M
zTms#LaQ8#z99eJgZYcNZh6P2DVe8``^gyy!YWT1x(Q)82a768;V(8ebcd8EEmnl1<
zf}gU|plKt?84y_~R?{3u^6}vYwfZt%P<Xz_5c?InnnGJ<h69foTG&sQD{Qe>+vDNj
znbFxYRr030WBVc>fN<VpU2(SBk~uY0&lP_+@8wpBs+HGPVVYUBE5K*=j8>Z5rOI%@
zUmXwF=%8eaUD3}KC>_-h?JOBj$_K-xsI;;j@|PXsM2-2K+E)jK(xG;TTh<4v4-ZtQ
zz)d5&SwHrnTk`sm`L27|<}pUz<^{fm+PYzqx^HTVq2#p%Pa99c;=Q?h(d*668IJ-+
z!sqn!CZk`NzcANW0L)FKC2K8AR^kJ<I`-fCu8jXCUdIORbuccB0l0U&g><(Ul(KA2
zjNZVWzy=n5VZM?W*;RBU(R<O{R~k_4?VGL)ES``4_hA2Ym*t`}Pm0xU1^3I^eZb{B
zjo}WN1XtHy`n5JaJ^a@l<1bSz8xb7MRoCX1K58b4-*fZ#zc4WPA}#~HA@4f8AGG2;
zuXV=HMcTPSE)oE#ZofF}n9^1Z2<lu>T1{!lt*5gZ;`>*;@4M?MaCP5>ci-yyNL@-v
zJO$*!h<a80Req0@Y2bI|#^|Epr$x`n=LUMgj}%8WUX?xPUXYMCG!1_Ih<(L=^%KMo
zAnpC@L*TsV>)}^1)7Cp353^lf$W8Dl0s~)`Us@%N`)$YMs&_ns2=wq*;|pAYmf^*V
z;IJU)`L}7i+(7(lpTWV@g5t>jP&;I<e=x*>b9HP_#7?(~phNloJ*fXnYy^#}!Z_#6
z8It^YRh;I|hNSZ})E94K=0>=bj<iA@7#-GsIJ(pbQS%EP6mxUJW!xX5sxKIE&Q#Ux
zwkyajR~o@?%46=3l@|8Gi*gFLSn<_q{UA1EdDBFA%BmHhQY6~ASt3CYHeKgpw58#+
z&_)_@NvEg!{@5E{^Z&6eH9-QRQ4+a%hC2V`a!f-5mdC{LU%)(4#!ArgE~)VS-J#sq
zqwduqXHs8MRp&T3aF?IwlYA|##EgXot~Ds!5#Ww)FF#);^ufCPMx~7~-4}Hz>)p?J
zIW1LR=_FS)irY<Jlw&{%dguZ=T1110>950i=6R!=ZqTKagLna+i0h0?5}FHF7hkQP
zNqKm}>GLE>9r?cKE+2BE_7P;zf7Qc#Jpv6XR;fX2<87*wJUeno?v-VvTSbn?y}2!j
zbhIw~u7k;v<sWdTk@SslZw--;4Jn$CM8Vd}&c5R<@!96*dw5Mwa_9D+TlOrak8~HG
z#PQ{ixdB3_Wz=rb&8>m*8-k+SG!<KJ)}Yuhd5cb0Dro-rFAaL>;G_xC+BQ#Ej+Or>
z3!^+(+P!O0iNK}5aa62$xb2F2px}z-7C2vFUM)O<NI$}K<V#!P$JT+O73lePT&48J
zgqnXldSAGxqmJ1Ux$<z#Whh-Q*phZ3&WSH_N^5aR0w}(Zy}tL^u?eXm*mFwl-tt<5
z?FzlO<Q6^sdt(59ZvgMM>?x$vAgbA*@w9;xjw<F_h@0}Q>8a_hn>Ly8XuGkzEs4p`
zuQPD<2m3Fpeax5oC_=1h-2;yA-<Fb*(gb`C`tAOH_4w$iB*twglzYtTN_=6yX&T>u
z_}@eTg1B8zoPgjLk7ULF&Z^vG?kgEj@Z1#rS32_)!(fS#yx}1WhfnH~@0z;-*-%jd
zuI$OMTiW23+wbn8-_xz?{r#HkFl?rNu(19><7~bAFzu(G978m$&T!TI6LlDSNgVx=
zuJIemE_Cn(7Lw50NGwyXtY2@%xsd(x>4|{#UEf-{5sh?HO8}U=rcL3N)Y!=@ut;Q&
zuapIy&0iF}Z<#97Qyi>-^I=2hUuM86A6d_dziHuA{gyw`nzO{hi8e(H<#niQed+BP
zPP{~$GEd5`+uYyu*MO5X00z2-*35PWBDbB+wX6gXQz9Zm?4@}>gaBF-N|`s2+c$$O
z2a?omjyZA3T);eH;~yQZ-$s^CfO?1<Y)Ee1Xi@a)K5z3M0_hQn^nYsRIC^~qG8EwT
zAD(FveG3*eG`7{(4YhxbIYFl^M?x-M5EM9!<Dt;b?Nde{`<moa6S&*=<>%olSD26D
zjZ6PyTI0V2$h+HE`XAQZ`43k~i2qai$jj7sFO$JoN3Cb+OLd`h;yJ*C$|y0?ZT}(p
zM~YAd=tOK{lG+zFC28m_soQiD_PFz>oR31^Q}{O}<hLm1jtM6eeBH*(nr<VcYaYFn
z-*oG{Loc8>vO8%U-qinmhW>MS0g2yevXE3p?e01<CBBvo<3zrtu~eb^a&mG1U|yGx
z78`57PHPD=tOsd^v`je$>FD}?;q-VMBjgru-PuNZ5yPi*g!kZ11?`Ut!%6X5onBUT
zN9URoHn3vxgo{0wyefgt#i_cmJpS7~loUX^#<|Ua`3z1z2hKBKZxh4BZ{^vXK$m@C
zo=9MBFLa#R=@wMm#wdNac_42TvNX1K{`!BSdjooOk9FlvSj>7g)5!vDj#yl1-k+uX
z&t30-fAVpW%3UP3sL0%s{0}Gd_ce1Rxm6Iii<A_wDU`eYJ@_}||8Hq+9+r7ZI=^^j
zKvTQh%Vh1<dF~qXZ50-wHiwLUb*)=WPQS$u5*;3Y;OYR5f87dxchVs8V&nOscfMA`
z(1nKNC8xLX+P~F)p1rDdCpqLvpWfYcfm`jaAD7=`zdx+j^Q+CvueI^!Ri%Cbkz<m*
zr}B)^K0WxUB1QMpJa-xU7~GEi_m_58p05^VQpS;d{Kpv1+&y+&QRiBT1>r{F)KnH*
zd`gNvl9pZF#0bzP@z9%mn)BtNz1q~ISNRS;J%tYlZHM?+S2uGYmi#j|3{{(s8cGSe
z(%w+Tt6K1z$`nag{}AXLaG!(57Fp||I(T4S%xYqNP?O3x{eak4|8--`eTTvCE}wJ`
z^GNRpP0EFaX1p}cbKgMnfP*c?Rpouu#=T?5F9sYtNjXWO_n6!pThNwosRw5lUsLMP
ze!q??w`|b7#%8ep8+q|JppRomcI!NF=XUKusN^@zC6=1Y1$RG4+889xF+(3*d%30f
z64&ZfGO0Bou@~(32ACAVv~Tc+%mIeu$-ZbD8Gt70F}_-nV4OF5gRJiXAX@zBjgioU
zK5pnJXxeLz+%bm`xbVqqN8@yjcveW?AzEj{T_30AV${TMo29dM;&79?eJ<^;Xx~|>
zjx*5Te4C6EhW|e7|8+{*Z_ww$bp!Xa|H08rTnxAy8PH%+){{Fw^URuu_rO$auT5z$
zfZiW&|AbP&g|8=;j{UD*7Sb*}D^W}kYhykd(rd@wr;0v%J)n*Lv@-AWa^scEs*>X1
zc*hNDt*nGSa%<BrEbWcd7}FjLnP9#ov6cN0TvNXrSJhh=0^uXf?2WMXAXQ)xvyC1?
zDEZG&!4<SqMRagZsZO9np$%4I7`cV|_hTO*>Ki?R|9Q-D{tkV50l`rh?*Bc#D#vwN
zt^MMAlDb!|aZ!1%R&y)lN296QuEET{L#Hj6mH#xm`pxGeJcE6z*7wlulBqgJf94LN
z_*>$VmGKUXT61r==GxL3r2%%H#-lEkqEPJm-~SYZ8Jtq3J=FuRn%0L3|MPEEtUTr~
zr#AzP7UBD6sM9ZAmpEG;2O(#D6jtd@<XStX{QJV@iT|&C^Is?MpEs``JDSIIq0)Zs
zzkhiE|LiM=k*uD3b@Ic8A&h$gYX9rG`{x6fKhUSpNF#>%pJk|f=5vDEpnO-&{>&|v
z;qDrdd&(dSSx*z>da>HfHFx*jfxe3|j~9Z}byD4yI5>j8+mA}VFfkEYRDJsW`}e9-
z#BngSS2leI`KrL0Vw}yi`N2SQ{>)x1a4*&e3|DxVDxi~@Ny^HM<iN!15`^XfgmYNV
zZkbTymO|ff<1zcmwfKL!-SziZEMKS0Ch8JI{<IU*of36Qs(RRpReAC@Gv)6E$ME1c
zeG?rzgg%@%_PnV$>0Ud8nWxXR<O8z3U6afHyFw9}+OY0D>D+{GPNrF&c$XVeQe9y*
z`;CGWAt&WE<K9z<9oQBav0w?8WT41o8!W{^_6MKrG<w1#eMGN%y75iRpWKAbr~lQE
z%z#dbRNkjFR%tXIgx~>T<g|BFJeiW_wOE?T@qKx4T2)Woqv30kh)kxX<23=2C*9ve
zSP3Ez0`{MM*?JF_=mtNm?00mlbq7a;qx4k`|5>Uo@VmB8+S9rxrDRL2HlqsPu_V&;
z<!R?lYNsV-8XCUc7U1)Be$_qTTjQ~Q^WnqkmRIlO{Fs7k6eqQJtqEAuOy1ExulqXb
zJ2w>#_VDY!!l<z|<K&Gha+e&i2oG(Zh^{rYo<YnpAF7)+(PA5(fU3uYX-S;a0DJ2y
zi^~1-C&|t9wvJfUZXXAgGm>Rl%;Pmh_0S@iWJbhN#&F;)3*Djih3t(o(i?d;6;Ggx
z9VksleIS_*OT90eSZnf?x|{kOn(!U%pojU4jaJB&6KpAIuWr)bA2|hvGYgDIZ8ANE
zbH^^4OuR+ARZe1Fl-q|;cX!Xfs6YHEas%$dlHBz)BJ2D2$GuY&-2T?1v-Uo5vs2~v
z9Jf1A+4UasG@8uVVO8gq#?=Y;BECax!J<Xt=6hH}Mrb)xZ42Nh^P1r8qVi$2&7*Fk
zcF+d9eBb~8F`v44$s_}~#Bng}LTv(Va#6Au{Vg%fw7|nzwS5@<yGa}D@*9w?Nd0PV
zY^Dzl3VBZ^E}b|C0Q@rHqd$GR!M2(%zZ`gYIr@;kOA3?!-@D{V=;8V5S+3`e?&Q;Y
z&OX@DRoUARJmSFxqnBybKCl<dcAeDnS=Sf9;Cy9$zWhCvucffh@wP5yP9RRk=nw-<
zN_Ozxfb*-p^}?8!^*61|iv`xoI1g1yJ>f&C1Bq;>Up*}$y_o6VS_6GkZ7PdHhOD*v
z&1;>;ob#XVpe8E>Aihf749q*x&BaRZG}I`$8KK^AjowK!ETsi?KMEG?4P26|iE_%E
zT;f98@0-Q#*Pm|qEp_yi`OFw6F6xzo(>)iqkbl-;srJ`jcfOa6EhTbJCjIR&i+J|r
z?^HcOWxsF*gCBSLd>${Wuru-z7e9agQjQDZ>wBuu<&^{gqfe{&wsXzz-RZYM_qkxK
z!`n-1R@?eJh@vXLZ;@O-^g7bEE_4;4YOT-+>I=CAZbf^;B!acA(w?(9l6~B?9=OMg
zm%>PK^FLIyR+~FfYenv%Za0>^AT0#*C6wMFSK=0t3p4Qg)q$%%!Bd{7>WyC8iqU3;
znTr7iZ&scR)fuZI#!h)$Dx9S=Vg8(Fw!O8l3u_&R9Vco}_T`T(vrWB5o~H)`=NKrA
zhi}qbRBoW>8ES%^z8Np+BbM2z?q|QEmptuvxM~}nUR%m9N!Hk(xt!tutYq9<Uh^M^
zzQOv(p_76-{q|7WwdW8eBU5{O(+y<m37z=G*m;5FZ}G{Kn3u-+9jK^Fw};`{E@kBG
z?Db01>>9ifS@2D+y_*mFO-WW%gU$=Zk&3b|_Efa*^3OQrm~<ba=uw;jF^oOSgQnv7
z!zTFLkG$B@qCM|MtFL}*b$beX$cEf^)nitt_k$|iGpb=-h#xU9xO<`&rzv*AW|}>z
zm>iw#CyaT!)u0u-VOJIAacK=`sP9j9GJ;N3q!g@|n!~lnMzJ`2Oo&+lc*C3G?%83L
zdB;}yyy*mm!u-p$d{D<*EUs46=SjcqFZ||K6ajN?j2TBHo$!^hL_4F-jed2S+?{2i
zZR(0{Fs`>1S*ndO?+sGw#t$@|$Bn2tWiypL&<(z6b@_g6x*HItZ==f@0Q1o?cm9d;
zVbB^ExebvtYNUEbQaK;sHbSnz^io+lLYdNJCF$d=oj(iwXQ0h4ULOocCEG9gI}Cg)
zvUN&L<Yu3CWPegAKUx$;wzqHEZfwkaZCahbvo>y8lYDN$V?T9he4;<o-DP{>iDDs8
z_lDHy!gE!S1B*>Dy^=^*zpLROZ>_WMN$EmDg!<~*%Gpd{><&^N4&+*~eNj2OT1?t{
zS?X<hr*Y6^l*mb_7JEB^hKto}y|J5wPfVB2jTU#}XU6z7U?H;4E41=XM<;A?0Kdlv
zhz(RS`2gz8+BS--$-Vj1D3+q!7(t}K0La|RWbthXP+d$8J)b{DSr2yU|0>`~;i_zp
zRfKi<SUcpmb<IN(y`I!*Z!>o#KlJRfi<6i(o}4aR?^f&<)o25)uJCnI?Pok|?$C^r
zyH%wpnyn8iJ)2ow@MU;~_3&R7gxLIEZ4%b~(b`MkyB~@#=zrHr`sY(>+bA&SC1O|3
z^f1T__tPxrd9lo~!&e0xIraN1;}drP!4rsQc&6I0Wg!oI3P*KbtPHq+i5t_r|JK3m
zz26+r?!?)>U{iCBj<pX*=U3XNTT*Y#+Uo8+nd<iR`#TH^Bh2{{?GJkEq99y^kyl%)
z!yaxYrtix4Md|!t7Lr^2O8D3HGrb>(byBh=HpH;|KDb>~#7sa589<pPN<9kIX!X-%
zVVC*uJ4<Fag@twUoNMP){p+4b4-aepFgD<nu4*9O$`2+QR60g=*MsW!G`sF-svj1A
zUS;oPk4s4cn<WoX%1(7HEH<Owa7wr$)E<0%$AKQ-{H{V-OS!=nnM%>7Q+Q=wqcR28
z1u?#p<1@|1`W;h@@(OD&^+lqGIuO)ymYaCN9KClh%F2-+B}#Wj-dU7Ac}D9IzHw8E
zky@xTB4Ktd-@$_5DRTOzDkBWPzq>A_a*a6Nf?dVZ`$BHmP6DUj`?=hCA*2`YCxZtu
z_-x+PHfS%8z<=tWmdS*rz=4+w-#He^=oSyMOmFOOt^L^l1fs#=)b#)b_RW0CLJ)k8
zxa1=KWT3}*O-jQM{}ZphWMhqelctFdCGTJIzf7iSbFXgVNB8+?A&2fe#HaIsn!t^(
z$~=Y2CdICP4R7mQ?d#}~@zLFa&s45P%fhwuGQY>4c>mZ*7uelgeFwSX48=IeWc@#G
z{XBUUCf`2e7m{j+s`uIbX=69KI46iq%|ivA-f?Hi*_E5tW!mr@?A?e70Tz`=q%D#R
zrbU1xFCb1^&E^49&uA=$SV#FXMK1Hq9OV@nM969bz}8uz`frM6s-Nqt*598Q_>Rjc
z%cjduay(Abr=}I_L1B-KBPl~(q?UGsi#bNDbmM%bMbWtITz2ikz?>B)9%}EUY}$LV
zSBseQhJ3YpmvJ@C__1D+!XovdFI!5=kGj+`fVh1iJ<yLtSLnSiffN>75Y7~Sb&BOl
zOX-KY6f{(*nPu7fCB4Z-bep5=-{EN9zBd<N*Y{kH-|(G{Tg7M`W?V?<G<)gT3vPI8
zlEP`w)+-#~$EvYyp8h`lo6Uvy(F6I>H5b643UAMtgIeCqJNKyJ&3ReQ8wTeY(2vvp
zH-bHzQ=f3z)rTf&3NL5Dr&T@9E<CM6#rvCcR9kUGGGgAGaeL(VLv`e0N{FGF`Pn}=
zVEVnwiRI|*XwWK&OBj>hZ`03{S6ug~)fz5xCo^*w#AM34>ok?*j-`g_rs+Erjnbu=
z#cDLsfW^*cAh>sLQZjBDSWba+C3XO{aNY)w`{%CO-cf_43J^^_?*$Z3BIerfDZabe
zy;s;rjViU7tSzlS_;iO}*f<(+$z?CJ^KR|XD4MdSy8S8c6;G@fqW+oW)yr#8!x_@x
z1<w5~X3dAcEM^#?rZ<QHt{8iq3BQg0QmU-dhL4%wiw(bt!UdDv>U^sWE5YN`#~z1f
z<SKcdX4&nYTKv=9n4hVC1uy)XiFY|jdXQxR{t2Bxe0x*@n&9_g=7|rT15Rl?iX#1d
zWh+@rxG4QD@%)={&+Fo<<lXp<<k@PQ!AIjSOf!l7+NaNP@e78Gb=C`zJ?bPTJ$MEP
zAHUOgk;}->^b&G8(J^5zaQFqs&BQ@(+pO7|z*16LT4|+R!En<<9X^2mBj)@*k0%>y
zED5T3gRXCZAq(wWN@40XkBy4&Nn3Z{y0N;ltL9ShC^}U^csFIFD>ldMHoE{0y6&B{
zJtv*}GH`jOtoU<q2CkT?tMTWYem1p#!Nup07LL+mwd$CPSe#9WDzybgHRl$LKI0_x
z4`y}q@)>_Dw;)U-!ci3iWus~#W%}VWv^{;EkgGUE*TE^gU<Xw>UVj}jPvnC@Lmbe0
z5*k+pbPf;F{j*bL>pE-UhKK4E4V%q|t=O|=9GzKI<_<0>#K7*?v4h-~R?=^~-zjE-
za??f4)jAIYGvDBPH4^l8Vm3O~G>b74jrYm}LtP3#KetTzS^TbHCHj@J2kD-ldU$x(
zchKTp#h2vbW+79ZkBgxb$b|B)MYLJbNPod++p-2pn|RNd(>G$xs5hrD$+MV9`~9y6
z9b}iy(3Ou9pkjbumP`9B&atjnD?09J`8!In3rdoQr`L(>yP|`5NxOy_g*F(hTuc`h
zNgK{Ls}meXHrXK`ELz&>_E3|_?`+6FM~Mj?WF&2Ywg~Rn@oy8p=b20|MIgKJk{kVx
zgSifWt7Q-hz7y=$1R2*(Oh2mZUvGhUWaB1N(S93&w6AJQy2w>#{}A+?ClB6}?${6{
zKgNRyn)L%{iSn8xmxsob;KriaRHj8)Ty~S%KiC81+Our7lwHrR4beSKYtv!iO;Mi*
zV#6MuFA{1@?TPqlpS~wbMc1X`G6YcOsNXpyw*_RAzZ$-NA#~!GoogxCDeo{!*<Yek
z(s+GmjgnuKC}RdyPlvoLyKVJJU%$RFzrgM;SCJ1eCWXD&ExKV-)8O&j>AxU)VmFa~
zd2JnO=yY*v&GLu{GVA$>npaN2l*4O-_DG+NPq6W~<~~g#lZ-u3mk{wZYG_?fN?HrH
zOXH3!^)C6xw1fZh4aib;R0Sirt4xY6a{#8CDaow1rTzukCyipFOT=t|{^h=yGBcO*
zW~mnvu$fY=nSsDO$y5RO4{CgYzaZkZN5A6W+kUkRvGIqcT4pmgy;#Y7fQ%`Y+B~LE
zizZI6mhR`^ml)Wj{kIJvkYO<=mzrYRVVmrZRH%YRxVWzBJhPhL-E>OY6Fcp_+)q!+
zoIZtRYH!!HEBD&!;W;qmWsv(^LG9Z-5yh_DM-a$(+V+}Gndhges)f^vWrp%x<o<A!
zX8A+~CtuuSW$U+wGZWkjHXVl5wlp`z2duy}*dY36!C5-OwNbIR+Xx(OuZI=uR)Jj8
za^-ttnL=#QFP83qfDSpt<nZ~Ln4SOWDLL*_VB*>3#yKuC@&0;mA$^zWS!!r{VU$bq
z<}30oCE>y{YRcVnw$5L4y#{Y4k^4^LY(nOi?q=amfVv(WmYT@%d0q%3<JP25u^?X&
zZ-8sl7<IV4INeK29}(l=AZFEBu*`CRw<>Mgs;zqY$l$)T>z1dLmZxdd3|z*)grJ;a
zHCQ9MFbBL+t4Z16RyMQtU$hvnp!8T5yC#?+RiRN1eg4Idhw&g&L5xP#-a8U$_g$0T
zU>0^cXJPnCem_02A@la@Uajf+gI<nWe^y`an`@ry)5n;`bTzg*M%-E5PSrMo3SMO}
z8I7Kz47QodKDCF9<!JuiZnv0f0!&)NTl^?jO$Tk|2|C!c7WerY{=TzV*%m*vLajdf
zMq3)mWfI%983-)JQKEy~K2*J@;wq^}Fj)yng20=2tY+F4+I!ccjEy1TpG~52?FgU~
zm7vM*d;mF|9?fi6=m+5?>_=-bp7oVLF=YB@GgY6*l}@i|awp)S2@A4%-y&qe-hIFQ
z`=6K`P^T#rX~@#UxMN1&IwC#WKgq*mmEkUN-cof37f1sd7%}R{%7U0`<|5{)Cy!4v
zuZ!W=cUW#<#6)s7diOXIY_lfc)$(JkXsE=;=%QShCm-PZ7<AUX+P(2F(dzOXeFw9P
z`D3Z``(xkHlMQ(JWFd+Su+;iV@XqDJIv&jgZm~+}p}q92p@(}8UiZZ`$kFGY-OiT`
zVTSCn&j>_d0g_vaW&F8UUyG1EPRIJD5pGQKTW!xsg3$X$gvC;3dn@d_L$p!37O&ZA
ziDz>BtEYP7_r^WPgmP=)d0_@!bsd5hpdrw(2N5|D{M`mGt(eDFTd$jCQt4F@ImFUA
z3EY1#uQS6?0?(d7Jd@;p_MOO?0DQ-?t%N&WzZcyw9*z>85N{itf=@*2KiUJpKUWiV
z<MYP$hiqH1r|3(VHLJE4&*edR8b=syOXko!ADf54cljWK$Tup*KW{zII_z%d0@bmO
z2-YqFaVoPy>9wMFZmjV>@HEb%462qb3d)@Y_Eu7Z87<i8tvi<ssh^1M=PZmDEC+46
zB6as*;}5(-4hES`pjV;OrY_^xU(P8_G<@XQ?kj{n7C$sZx;g6^QoFe_V-kT<qkbOG
z)_k)+92D<bF+c}gV)QLIjKikg77L_0Tc*_#%Mtz%)jMiY3DsTJkM#;HJOzsViX~to
zgBr$m4+(iJh3bgj)ydf|>&`D6eA*Z#EF~t$A4%*m<x*R{kR&~kuLY;ehr&fV=WC@B
zp7~5@xb8Lk_xfAXQr@ZYT!Iz?yt^ETfvcWtRn1&85+whCdUL5U&AFDYXet7zFx7X@
z?IKSLyuUXH_rSNIw-HZl^a`G~s6?sYT499Wut0y565$0lt6TGBEAiE2|M@>x5T!%_
zy{WZ$V1VO4OP*W!Ssq);OT;%DGPh<?xQ^Y2Ntr5yUrq{Qq7o*;ZoTQc`6)$9!PhXp
zan66uPrlm!Svq3f$0>Ml26N}EbLnTE>Fbp<q|b5O4mTO4lE6Asq?HPvurJmc{bNsD
z$nui0{>djf`|WyM@utiAsB)bB_JP28pI;U`^-itth<%?TNmJ^isT_c0CZp{OcbRod
zGRz@HG(lAo8ZBb4lkAshlA-5qNgkX7YsE$5H)EsKvf02kCJNol_x7oki%B{1?c;;R
zF}kmovjst26jGO^9s~)LHI^iMWx3X$02Rjs!wO(~Dnf%;s6o%D#Y9gt_7Qa0LiPKC
zNfIGV?5%TBd!xL5=ZD2&^~vQ7;wcw$Wlnp*#_Q|kayA#d?o?+V_{pUASjDi~XYyzr
zpS|bY&Z^alsIF%bu_xlS9#JvHm&%`1wsw`%LCn_PY94r~tNtimR_pXmsQzC7@UxLa
zucU&hB@sfpDpiiuRy_eRUC-FiuQU=nr?#Yj#UoZr&4fQnbm)QuOF@uTVPR3haBT5#
z%hK}+=!xtI`krUWA1j#rRZ3j1)L}=3=%*Vmd?Ue-v0lBj3CHb*-c>FhHMF7+%s{zb
z{m$sbV(t^17`{ehL<32^&l8fXbRl~VfiC{ss{0UfA?f>YhE%xTgvWs;uamJ|KcSvf
z=CjbBnAuTHqdmOPxxyzASDupjq{l`(j%<_8YTtk|C>c*3*uiK%_Zj=Oal6og;<WP=
z*O^8H@>4TL3FN_j(6sQ&M|u2TU>k>U8+;5jYR~GY{t7}z%sr)kP8HPdM+C5HM<3D;
z!=0;~MV6Lp`5TTraE+<0+frgCV8VInjdR0%h2QJ(sPo$k$yby7<0d{=BPt*`MeT4;
zGl#yn>%mT?6|U4VFC}{&C^y+%zq!<ZdAigku@*!rn7lJyRjkbG&bZjyU?d?%Q+bT-
zsW$8!l2c!IjKeF*>?&nn{pAXnwgG4y*1W)~IXOZ<b${`RN|pJ&56X0SU2no`W=UF(
zI7QU;B!f2OziMF9MYS64Kid223Ct{~YgsSGqnx=F>z{!^dPft?Q!|v3Fqq5h>HVs@
zHg1Ben~zy?`b{b0`~iTk%pE%nwZA1}$4?Q?B_5-_htBe0S5MK*&s+}Yz1-=ijw&^8
z3nqiln!{U6=Ow`$st!O^b%TDrKj5mWX`$-K*V1;zKM6Q`w#b)$7_qpB5)N*@_67-M
z`<UFR7Fj2VsQFJuM{7F(EZ<orb7xSe$;Q>TTTsOZs`~>*(l}6v9r-l`kZ}Egzc7gY
zEuG@H<2AgH6NbS?xmTr_aHaxmdzy<kfL5l{m0nK1R?~*U6JuK&UTYA?ERpqz?~fW5
z_1Z~^Itgdtsv0_CBR2T6nEq?Ul7}$`=$EVpH{=rDraJo$Vh$Vabvv8jb<1vFalx;*
zAbG_DrKEucWq8AY+fSBKUXfa$w^o7*PQ)@f4@HoK=|7FGTh-j)5gMI#4UGI159O-p
z8Zd?m;T2W)KZ%?IN@Uh*pzjQSpM98o*+Kl~hHvtzis8gp%2>@ZE38c<&lqileDivQ
zRvk$)>HAsq3{41BYWLwlJHnub`*?gY6{AK|D&#IS>caZh6NbC40ximnw-js8`VJmF
zYkG)^^;J3B0m_5bw0dc`Sn(uPo$y_{fPe5m7nH<zt=2@EfE~;=gAEqZLrNA;+v=~P
zQMR^}7tyIgj&X1O%8)W`NYBHGhSti7mc4r}>#?g=ZY7`weOLdb1jdYx(JkC0t%=!^
zEd{BSCUJO2CvM7ek0oJv;;_7k`?2`488K&JnF|z0L2UXM{D4FDd^XE--Ztt^cdpQ$
z_Rdi4Ty}>E<@4UozP`jv9O0%m5)G42-$K?ZaY5Av*{8%fc1rgW*1Y;x4FOK2<agQ*
zdxWs4;%M5*LKDB-2A6UXt74!BJ+59({&?t5rF74PC36F8gKW_2c6<PuHerkWz=ii0
z5eChMK>SY-qZiVb!HbkJnZ32v=M)Bd_EZIWZ6k+ha`FhMI<G5#luU)T1L<$F5+NJe
zFfqU0#W@D%wf7Kh{$Be(xkYYpw1Uk%H(ScIF9R+3pKQh{2ICT=JE6#%TuaT|wdorJ
z)Y6or8%9H=PXj$I_D=wn%#-?FSIFgl^vKW?@bkx~&#&N|&&+t{(LiKS;SQOpasdAs
zB=vbK@RwWB_GI>x(2C<f6V;ct&w>UQ2FX(kgL#_P9aB>0A^<8f<dh!;lPy&WROM3R
zk)qcU`A{3NvV%9ai{s;ER;eNjO2tBtkj6UtT@T6<Tk|M268EK-leyl`8@(=<_fAcG
zwX9~dgEKs3uAT1tI8Ic)cCz>xFD64Jc8lE1dMK`oc#}u8dx(X+jxmz5DaMJz9EQSs
zbgS9YP_l?jy^q>ZN=LmOt1O8;|1P#@WAN=rR)2V#2n13j@&LIuG1@cknY5wl^8fJm
zo?%UG>l&zv%EAH)3t38uC`Ca*K|pG-AR+=Tl^%#R=^&j@5)lDW=|ZGNMMQcpp#=o#
zReDS4p#%a15+EeG6VSc(+IydU&$&PDA0LFtBy)^!eD!_biQsT3Qx{?j!xvI9QcZFO
zR|nqWf7dv(?n3yH@@FW|bpf~IUEWrn(4>tj!;=H*pWG>%4Y;%`JnH8{ihBj7isI_Z
zhtww4h4bohD7DwnOtqD~=9YS;bMjLkWdW}GX>P7cjiL;_{6fcaG@~+Z%o~VY2XRMp
z(CS~3QYfdUO=Cjhb(*r+(423DtsYX$&2ClEu2#)#_2#r>z0oP{Z7w=TV$W*iDS-~t
zHd85$92gf-IVur{g78&@=An#iK~X6gkm2IR`{2kG*DViaYJT<Nn|O0#NJ#+>`O=>D
zK+|So-7el!(ZB&Jed}<Y@x9zh4$PW}M!A{A{qusTKT7TlE{`SVpPLtbC~;TF*CH|j
z?DcZ(eiwE!$}>@HzJX!6B(d4zR9WoF8EX$dhB=Qg;3px=Ia_FCB3}5*y={-ed7n(w
zq8+G;R8I|yQ*+s>rynd|4RaLQ99%evY;sL>THgjKZMX^1*s0&Da>cbAg8?Tcqh*t!
zbPzVQUYvv^&z=It8v2SXVqMGt6rwRn=^(8udlI=J2#;07)G?O9+iZ-2mFuN;z^`;z
z_78g*4<#D{zhtp4P}-{Pdp1wsKIYe$3%WZD{@f5#@i7&x9hcDeXY>U!LGi+R19!@&
ziu<pxtz73o)z`o3=?P3J{CxND<8}KQ+NOvkG9ic4M4TidPW07qFxo~ryuhbsM+!nu
z^G@<$KL)pT9YGua$nbq6?Pf7r*f3|VN3JMWfm43S>0|PSg6#IHO34T4&9Rsgi+C)f
zYtgZJo=Zl~S32a5F}xB&8SLieGeniEE+M)!?yM(v(z?{-q@z=4(IG{Vs}Hk2XWoh#
zF`h3xKzw0!2rCfnyKeXZ*{GS-y8X(~cMw&V(bS^;si}os{YS{EdSnGpc~#Djf`-vW
z6!MzLgiu>deSJ$|4oNsU{^eZDr|7TenWw{Sbz8b^6&!9TIk2bcqKCkA;~(X`h;9&+
zJ^%4*!#vp)dV+VqxuYR$un2f7(ko{pAAcP^Y5IJ|K|XHrexeK}_dcJ&<d9lNI-8od
z7K8VtKm~~x)}i)ZTRN`CS05rcwz0CV`?k30+g19O|EBYTRwM=0k>O*P9i`Va1l2FK
znUJx-PDv(^QYKDgKSg(eAfTeId#496-#pB0-Z$W)+vGJ&D|23WB<dt2ac5m$e0-m6
zH3Wm(psomiq&7$f81roxjG)I(%Q)fs3(oQSvmoSeh$#_|v0M~y>6kRj=J=Yx+wT}f
z02?o!Gw!EFBX_J4Z%^66C6P@$2dQd?9dcK&otVdyQ8wk4!f$PlfY~<q-9b6(%g>q1
z-c+%Jov*^5AO|eOh6I6nRiicjz066J1P5v??sRtD<%v^HZ%PBIKINb{Dvy-ciMe!%
z#mZcDoZo<P1h-Yy9fZI9>0adk_c|EcI@~@qRWRn2zF0Fk<U||$cqTQ@Iar97GHYzp
zF_PV4=C<w(iAwd>aYe#?MH61=wjYWsheB2KB96p98@zro^md`|-Pbm_h-mSl=BAZs
z=t6OWu(Z5(K-;0jh0RC<`ybhr!!uh^=7`T*_Grg0XBk<&4#`#Zg6XoO8rJ4C0of|`
zw&DEQ_UZf%*(c#6pPQO2txnpcWyO?8gWicb+_16CvBzcMuAG*7(9&v?GVW$z?HS!Y
zfSj7+<1J0fktkY1Ni&RPF^+5MMT%JDXC7qT@T|5)sGxMb^bFibts_sMO#tr_6{1?I
z7E^{8wt)sLI$EpDM9jb|=r3im!_i@z>7#PdAK02DarC5$Ga6e`$g9CM{#2yeBt0a5
zFyKOakxz6oZIUSPXS{8!7QqWH-8Ekkm%vkjDfJF3q6~&<yq32A?xAU`+qGc7K3XoD
zpVm>T@6p5wVkOHA-R!_?MMm>?Ptj%Z?;Xlf0{tW$Mt5^S2#Ne&-;huZ*j%a*QoQr^
z@ST!}D{COo;*DmNt^nPZ$TTk{6iooXaLnI3=_NH-=%akadiX4TjMk6^8s^7%dIe;@
z@!ror)Q07196=<V)2?T%O|AqFy=1+0zl5g54~mp0V(x4m$|mB+OAuhp`>eR5cZN$+
zee1Rs<Pkh<QFV6YSgj9?Olp1k`OPb=Nhmh~50}d%Kk#;!%EXI|!?XLn2CjPjh7TQo
z3oSpGD?<o@v66V!u9SPdVok1{y(0IP)lxTT2c-2OdBRE6h`GEzTmDCOo(v(Yh^*tC
zdBfrt-euo`P2~@T0#izL-MU{#Wxl;=v69gKMt?kPPbCk6SV73j-k=l!;_{<h7j`F{
zPs#bdW|G21|HI^H)2t(j+ilmqq3##+sVNQSO)k<f^jx+^oFY{0bl+&2E3Yn0hvORF
z`bUQDetB&RBX6Vf`zS}x7Mm<cdClAhHHd2tvWx~o;x01CfobLoImc{sY>`bv!WqDe
zCfUSl4e~aZfX*;C5|R`Bxs4k}zOINc57Ny;Q?Bd#P|Pn%QhlS5W=*NZiQ=b+G_Zxy
zk(0wPo{<GXpvflGd#A&YLI%2GuUekH6$<LuzMsP5V-|2pZ%IgAov799R&qZgg7Z&m
zSCx3>_bh2%LJ(rRvbm02)s}DEcd5)!M?Sc#P1{a7I-fQY+T2XM6uBPcwsB7^T%Iva
zoW5p>=*+ITS7$8vB;slm=F%jywP~?$qX~Lmf?by1S2aQKmPll!>>L>f9rRijEHH29
z3KW`cCNtp5OVsbwP{l1G4#$QNw9HT+_vi^tHhV_bE@{$L!phX3DoEdj^(hLrpM0i2
z-Eh9=c&P@nURAcP_~;Hd<86kIg0U!wc~hvEvb9J-n$yQYsnzsAxxo^%jBP+=si{l`
zB7OKlS8A1zI%exnywYTjq`X0}{1B=X9{;+Hi&+G=u(7Bo?gG#48+Tx@<+|h6;24$!
z^`w!qhux{KNRFfy4wUbplja|&>r~At5H6G!JB=SaG(w}l9ku9N8as;XA+d^we$Z-f
zxmDNu5++RVKE<fXSr(mHFiyxLoh+~0!7MT{asg<}Ooq~wE#@*}D@-i8Wj6mGP@3Dm
z01D&i_PH)`yX|VQoIe5>f2(ng{Q{1`PvmmOt3<UX==Qig+r)bB&PX5S4L){o=m<;e
zu@jLFDszjjNu~4;+LZBp%fA<;)i2wW%Ab}lp&hOvkxP4dJ5;x&s&=V3$>5~BpUz7u
zyq1n^Z@I&2a~T${h=B!MT7<v8wzLsFQr4<&buHQ<-i8q*OxI6(D=6I&^XC_3M}z*O
zEn5~IEzOBy{%XKzqRym?y@O?u+k*B(-eNj?Hm_th@79_g!-<GFCqrwwhkyRb<x5j!
zM!OS*8i@p&+eFAYi{eC`5hFRgQ|is4s0Tb*?+6L~{p}jk<m-0cH5mg6<7MUM`Dkkp
zUZVqho(%(;T>CCCs@X-0Pcjr@!{{yAl|K+Yt;L&VZ%XT|n~|-mdkO__Pl9h`+|uG3
zx5XFga(8}qj34k>H0AXNs+*Nj)MM+3MTJTaD0q5cSb`Bc?cB50tQ)Ie_PIEN(no&~
zlkFU3-Qcq>9Scjkn3%Ol!)v%yI`!vF_Yrg4-#3P<#l43|{Qf;L^-pO9pnpGL$I4=z
zvP6`NE^Aw_cwKjn10e3zPN40!*m(VMw;QS-_l7!?NUkEvswLD#<9f{~YIf+576fsC
zV$J>|c~Zz=bE7_`zww#d^cPQ08d>C`jGK=Oq;?p7nM5?a9C8?VyB#A`XsuyI%{j5r
z0cO?CH1VVt-l6Xva%|}gj#$Z^6z+}kZAj2=Pf{|hT2br0q?m((c8a&s$%SFX&#Xha
zsgn)de9P6ip2KlJynAKHlfoM;@c$K#)0K}G$n+Zi0chII^wcw-r01Ag*NBg1%YyQn
zq3)w%k1El9bgFGwz_dS;YKmch_QS4%a#tx{+n^4$%91z$ad9(43e{I~Q$*yx%JelV
zVk$=hK?f4^9}$nHsutR{roKi8a9Kw#Ds}fqYBg^YHKMD$=*yu}5)@#(E59uA*&xY8
zKUFO&<No=m_vvcoqfw#$ipJ(RqHc2(H?>iQzH)9Zqv`F+WZwm#Mo&^81;(F{n-MLT
zMz!a>%i`8)idl8B_$C{@(m)l(#2suB>~9R8Fn1p_!XYXZxhtlcKIQ2)0zionFydCS
z>qRkVf(_2L#bQNk^mfZ9m#RzZmOcuh3}}+E0GOUQOiXXWy@PRdJfqk;6C<rw^N|(Y
zi&~LW(|Qb_=p@A@F>%EAr;m<%4$1mftn`@oGfNHjYMeRV1h$b_!p$mgi4KNhtg9f>
zBLyhM97RzIeTuU5hwbzPI<NWr$|Qo`>(QvIWH7$GEYcj%oiT99Y?@5{0?5Jo5)2sc
zFZn7Ns3^p>E?_Y^01Dw%sP?%&DvtVk#4{&eS<I^)-SS0UyMJTF{%cy)MB#R_0biwc
zY{m2lI=<BB1{g)-8T<+-y<3oxxa$CM_Sczrr%+*`o6T)DsoF`3@9Rbl?IyC5JeF>v
zpFGca1V_BiSo3klC|vi}w;TC_r5mB2DOZEfd}F^T78S0AH-^u;!}@sbPD^UjEFcym
z8@Jbt0v<F@78pfM5Dm@PYemiLJ&55hB0iMicS*NxEVPW$juED}ZrN>XErqKTfSlaU
z$0RJ3$haiJyb?VV;p;%BAvR>`&F_|o#iyG%{N_fY+*x1}eOsEx<M17!ua(AUigdx?
z4)F@AEtLA(vg7NpGY&&u1a8cGOm`LU=2eFQ?YOc)Tv0M^({+Fg-=(tlo8rwdb_}Yd
z#CXhd<1{=52DWv?O#9>!yIbQYlAs?fXZ1;5cSahtmZN59FR!a7Ov_4jBp(qpKGp2|
zp=DO0?5$XdM#o({chaE^uDzyIIM+ctpi{!1<gSlkd4j#`(znPv;8uP=zY^_kKgysd
zG5zTLBVyuH_&cPnV88oDPhX%Jp66PlIrK{v@d<-M*W~a_RznNvdwvl*DqP&3Ue{76
z;#BxzWvAAE!_28RO5UiOL027VHY&_tI+Jy9@$o{4pwxWZmp_n=SZGUvcQU85RG#z5
zbky`C&}k711B>FkVgopdlxkl4G$(Sc2S#ar)iy*yp;^BBizl4x7E@A9_X?bv^>%EQ
z3{yBCpWGDoiDj6ASU4c8CfvKuK@h4?In@>-<YHUmog}IDl%C^~0{wgkyH$G_=G?pB
zP&D8Yt?RGTP}!ShV;AVM49o;&#CWqjPDYgUDe!Am%<7z!j&{LYO^?)gX|=DPsZ4K`
z-W=AkTbfY!B1c|J-hL>gXj}9I3Y-hIjc+-|f>B_(R&)NAW{{Ft4xhAQPsf9-n?7%J
zmQ(-u_Dc(ZzYkQBWgtY!aTArM@W`t<Y;UPJ#|h0XZFY;GJvI;HpOLh>^dFhmv>r`p
zZvMicuOL58PLuVyf(auR5Cb?>F<zOQZH>A{`k#7X$(->t3Lf%d9)c!wN0~ongxh)3
zFjMqYXqZv|Q2eH|nTT|Q$Xn#wXj_b;+Tq`I@8%qddYnP6O73k~R3!6>N@8SH?vRhF
z(LUO2($qyQrX8`!0*tg_l!a7Nzj4jh8yEQKA4a$`%?v2xTj=Onv@_ZDwB*;DXK;u|
zd`9HAk2Ho8OqVVCTe2p#!UmB*3SC*f`6wsmB0enq!6>W#O6U32bW-5+rAOtEPwv(t
zH{=yc(!ir7SnH|Bc6_IMnMX03n-;4N3e$_#6q0<}q@2fRmE^L6%)3Fx5vfTCmAc1F
zsE@q~i<{Cpk!UurNe{AxZc~p-klJL|=xPHOLtTfq^Z_DEEMH}jGI8-mJlq~r&yHMB
z@+c#0EiB~cbfBHPE<_b(8y(#u2HU{gYb0R$u_#5SxchR5!nFl$p@{S47PSakc_zHJ
zNEC0J)9u|$hAWZfh;we_dAIsGw=*Ty7G&y3GvRQ305o1Os=-E>o2_}M0Ti(=pDg#p
zegK;jhFXb5e<>^7yiF-7@%@9RUDzFNbaeG9b1tq|p6ODH56`HSnJMt5%l5bG#fvW%
zsM|G8tT->$jmwjh+-&s?g3sZ}I62f^IdQ2|69sG&RsKvEmVrY~-|@oPZgrc-ea1Mt
z|0L83j=d4xP<5a(JE2M)tE%Kc+cCtW)^MnDf3I04=Ju#?u>+4tONSF$X_BL$L4d3_
zA`G<ml0!}0ct)2hoHEFIw^~7&#`!<1P35yPES|u0sB+w@M5d$%9Y$I{-|J*Qj2rO0
zdEdDpEgu5OY-&>+iW#v>SC+YUJ7K;<C{4Df?QwRWxRe*1qR}w+1IO?Z-_(l|#N;ir
z${J=A3fW>T{dH?f=h-#RY<~;7rt5AW2|z@A6Elq~l>6cYG*eAUx3dNk2yL}ijCuE#
z*Hpgn<I-~lERxg#U0{kw+FDqbY1{^7#?%Xia-Ied35oovRFQ6>a&Q=Ok#RBWEDe>v
zaZ$WRdPO4IAdT`gt7ljxblWYu6)~cIPD4S*d^=O#ym|IWSWeDrzHXkZ7wzTLG@DAp
zBOp1;uKa9?Oa{wJ>4Qe>Ii07sVXIB>rwWBeZSl_d#Nw@7@7sR{&qNH>J;Mci*?gP5
zsqu#!Y!Qj5?9!1U^L_>!uPhz{po|<!)bu?ZUdF;QWfbbuvQd<T+A6!WJ+JCR2HxTh
zcD2l8&vPkMdzJ{aqC<QaeQ(W(!-WjgWa*H+qU+vv&0y9h(wi#bh4}m??4<elXjIC%
z8OKkYx%ShO1DsLYPiSrBRX9{VG&Q<FHMV)Mix%OVZ#vFq?yoVV>3rvE)1>;-7AuW=
zC5zaNImOl6g$ABKgaEA0T*aHwdmX(PBsW*qUFQKSG>xj;RQ=!+Lz>VjFlAxP?i^X)
z{zY^qUGdn3KKR^*E(TlY_H@?mHWs!NwEBz?@Z8)o>m8!Zve@Udsx$lsCRbsoU+EKl
zayD*JwWn&aRPfRuDw{41!Wh)zLLWVADmC|jjIkla9lo#0eL)Q{1FR;2t$+}-4b^VC
ziR>ZdGut?BpE3WXPvtj83l{)%d3ej#lf`SLbpUe+Qfx@zpw=nHdK{XJF;WG^^)a_x
zEPZL%Ju=1wn$Z0ComWI!xP|`-_fK|)D$Bs@HnIj5V%!(RZSJ_vAM`nGWTa9xEec>=
z7Ybc1Thgn1lr~t%eJwXf$FFazyh|pn+u)9SOLB?AS;tt8$05k?F5)K*uU`M?+jb|`
zF$x-Fb#5-<jle`s_`HC;Z9vb!I`?$1Dlx_q+cTf;wQZ_c)k>-V;E`ZFT;e-SL<ow)
zi*>MXgnHv%f0K4Xf3?YktfX9YrvDb@%WJP&prWHhg67lPtSt0K?ZEyWu@|~AK6%GF
z&4Ce2u~A&ha%lhb#~|IhEwc`zYip3$m1s4C8eJ{EMZ^Y8W~vF{dk1?&2u0?*-2L=^
zG%09v%RZZ^wRC*79{`u&6_y?!%8vUQJQWq4HT`>945-6U2=V6~fAK^?7rMJ1fj%K3
zt$RE&iHZ%=TD^SwvZMyk&cD}}q=g(e@<Oo*VetXLkbH`t*y0;^$!^tKykdqm)+@#X
z^kvi+2OTFA*!7&TsISmp&1-&@X~dH?lr@|UwDGL6v%QTNG+&#@1n62|rq7^`s(Z(^
zrxUJd=hcDR<+97gmyB{1bgmAn%^JxW-m$)!DcLS%khsNA5?qk!_cU^br-zfo6VE-W
zUyyCftD<VzgG@F_E*)0AiyjB??EgR;E0)iTp%h`9!2mF2O{*D{WU#o9!Iwe4GC5@3
ztZLuTFGe5<1FqxM2JI7P8q}A35jHdJ!Lem(=R4H%#v+$hW4Wrhvg{!rd@K4rXt3VD
z=*Z@pIP`Zsh*(+tFoym(158y?xmDkESw<^nzaO=*pM^MjE+dKN0h9GB(UH>y$DUf|
z=oU*{Ao$vcC~QZquaGln^RT|_u~+T$kI7KtUZAL}0no5DJ$WoJa;YK>kqX{&BmeLy
zt^SVB8BnQ!*D&$XJp%zc*#Hws^#7gc<oCt(dEL_@Hl?4FdLRBVZM(h^evPCRZ0WtC
zB%5;ITFC-xZQKY1pou&}qj%~L1A|L~f<hrBn;k2YArGOrv%;E5uI!&gMZMLn)ture
zqgN@Zuzve_t<ea7=R&b_ir&%9UFX-!GT$x5{T}ZO;r`~l{6Mc+<fe1so#FKb(NQUw
z)bz?_0xqJmmwm~Y-@;8*@F7-ri+tf83^DFcoqjIF%az6(ScYt|uDm}zTD)?%q!MFF
znle1q{PIRfz9S;*-No`}Mt9Q>uXVwNb+AQvFhJmVspS??e>lR}UnJ$6&Rp4_tV@al
z7ED{hX%)N?Y*?_s$w`mz(-OJRg(VrtBLEkuo^t)6xP`B4g>Q6_J;QYJG)qerlN|O7
z!h-hs+tfbhZLBQRC~a+?uZwi5$r?cJHP-<Ow1n-Nm50<JkFgJ-W_Qb6MQvh%D1%g_
z+I&`p-3^_irA%;O^Y6_l&Fawj06d669{LiR7HDhHF`m0NZzQA|Dt$KxPD{AGxYN7i
zHm2Hs&a8lZD=Hdd2yKWk6umO7K_bM<soJ+iFEek{C*qcm1QkJ5&B(pU9w1(>=@e$6
zw<uX-YM~{@+vjTqFipPDM3eqH%6p3B;o7?1?6uy%a^DG<!Eg=WvdJe4x%v`U?#*fG
zPey&^U~%Wk<sg?pc{I|QmNh?lZ(h|hQ|RJYJL%h6c^%ZFwf#HzyOs-1%OBq2)lBSY
zjgOUCILJe_nunbLLO(zTTS|_q3;r^3ko>0}`NnRP52ntRb-A&}$9H5*{PvSe(7w}5
zNo=ZEj26;5gfn*$rd|a2VcCfk8LJno%*>(n>0%ze2k{f193FnwPG~a+2rV;^tL(Dl
z3e}EwZ)fv_r#=f^iw{d9+eOCR8ZASsnYZiEgnNApaDor2eTuW_A4f3tSw41=W~o-r
znR!8l+XtwPpL}0VbG=!Laifli-A4l)7#Z!NbtLjFi2R08X41A2+BffEJB$`ng9JeD
zhjm#@usg+;-iJ5@l_tz>+#5OPpn_37SrR;4XFnnBB+oYCZiqj$i|+<6p*hR?SzL3n
z%GA7(`&Q0_Cz&T>P?LcG9z1X#eV9%+^lt4rJjwJ6cdP`E5U(~>%L%{M&dqhS8BA&C
zj9k(x0;-wC5)4^Sj}??1-N+(if|kYZ66A9D9{w4TDUrR1G<wRQN4lgUnsDL85JJAi
zByhwP04BnK!lz3Cqa{n*!SvpIdKcEYL_O=X@3Wvx--)aG7}1F`IzY29Ctts))1a35
z%6fQEaJviHS6A8Y0Nywb_s0p;Pqt?t9YF}qqy)PM(m!DaJD~*D@|M8Sle(`&eNcGV
z;T2)|73QVEaZLc`d6M$VdsciaK7?pA!0V1YUT%i1tq}H@Q3S|KVi~V#zd%0co`^~h
zzgE~Ry~def8`i6S>sGRkg%W4Rl%0sA$KsI6>o;#cS5!O}mGX{;kXDqUDkB<vze)<i
z9_6J#iYvn_OkLDFYF8E|`R1Patk(=r$F}`>6^J1+aLd4BM66T4BU`yTUI`r<YW?BG
zv4sIyxF7WYM7dN}-}QA|fBCu{Af9NqkoPT-jruP}B`uE~`|`ka4K2?prZA7a9$1zG
zcVv?cj-Mkiy0}w(IVfiC?l4TnJqsy|gNlO6UCZuMhYLP?zj4i6>?h7rr@bx*KYHs(
z9XjfC2{iFucRYH<v|^i6W|!-#3^J4xzX=S!0hE+gn!__6DxC2`SV4Yub0?MFIZqrO
zujF}8d*qf7hPZznvD!O9YIg0&`_fxKq3jP11U$$?3pzeosZV0{l7D<%?0RU#9cu+`
z0hRB|HA+2)zn*xj`5|g!|Nn_d{DJ9EGLwL`t=Pd|P0*?n%OcXlGKG3&j;-JJv(9L^
z{eR}qo<+Gmubc5{GEYYBS<8Mw<?l}es=3_{kpg+6-SaHB_3fX_G<3O5ocZ5%&;HtZ
z<@?Nc?fM`G{@T`^5T=(MWk3o{r23aERXL@2{GPZrG)ZtTPfF*d#?Kr9ZCso7*v%6^
zhpKO=KBf7WIttwhCh-%*3f!5Y8|;+K<qu#TwhgSc$bJ|(JdHTIbNESo9UYyCp<TQg
zq}U%)?Hv`7u#`k)f%(0?(poz@aoEYfG(yf{479lj+I1H|iR6}m=QVoyFOMG%G@KuH
z$yUWq4T;OQi2<B^I8s?88z5BjKlc^r=LP!L)!_V8Hh}T|&Q9soPWO7J=4I3}B<2u%
zj_6NZmyxSXRM{JV_dZxC{*$50Howm)xb$6H=}VeLAN>X0p?^F{e`z@&hyMxfa%r7X
zz9~pR+OXE_r!h4$9Weer^T^=r_s8ZYEX;&`;Qz*g{%=3Ka17{Y%Cbcc%%0mzm8;qB
zejVWPdGvODDw=!j0MeZEa_&*Wf%3bwnX9|Fr48o)lZBe!05-Zf*7VX(RRfrEHNe1r
z*w+5JN#E-G%;N=ehxs)R9xA6L2hTVYh;Y8BeGIh0OplPK-x$$ygumRS8ZOPAqQ3%9
zgk@1wffa*hZZ0dFpLV%Aam*?3x>>-vd7)Vq?EInK!>8KtzW+*&iE%e<2l4xJeJK-4
z!ELbcx;tDyKSs<BcbN7ke(mW)Zt7<Pt)fwBbA%Vq_%wU9aW2x;l^Ib3J+^=CoV?e5
z3gMY5rBl(BZB!M}g|lmo+QZT}0PK4<65ots9g0u~DzyxfcM2=r0oZ@U%sNU}d6;+%
z7)cXCfoqa@5-8yVcDzx)Bn#Mnd;hx4XpQqS>8Y6d^(V~#=R^NXZa|rTZr{H>*A8vT
zaduEfO8*;^cQxpLR-E{6cA?CC<o5rtapoiXR?|;CM!iX`OCC`u4uD-4N_$<x0vrQ2
za)g1$?ii;r32}nbw*3kg=F5R=XYR6aJ#EyUBsPiIfC|yV0JmuggrhJR$}l(t=IGTC
z9E+TyRJ`1Cr#o^5zC>yYt>{XJ{6iXC0f$%ouR9qGJTWM-TRu8IF<PjvTQM6=%Ebxp
z>sTYOde;~O)YU_XF3XHOHge}x@;+erX?L6(yL<<qDRY9-#k6*o+w1wLiN|2Be8%<w
zh#W-IcYMP4lF#)mUp3n7x?xA4OhvFuANMO4V0s#UT(KIEp|=}I)P@t-s4e`|^Lc}E
zLcf@<d?&5|;uzcpH5SWlkITWm?qqLAuT7j!A%wsV-&*{xyT98xPkp1BnYxVSDTbRM
zcMSbFWAB!{WepWSGI(x73h5^xpE_n;gw{@%f6JCI(bd7^iW81fO^wag&z9Z><tMW}
z>tOY;Wh@7QogzxDcE8yfbbpq~J;2D~TXrVg1UjHwHNf?sP2=tyMAX5W?XE|;qL{Wk
zSs205vGbwO2QP(<u`4ZKJ@~@iq(6_1z(ln|FsgwG-F7;S_PX?Y#dZCFBeq=b!T+3l
zeDtnUnfRm)ok`STd!ep=p>#AG$nc)P4kFVwJ`Xtz7hv2V<EoJJ+4}2evv(-0mp_iV
zm$$>$`cLGNPe6+MlnjR3jZtK={VnH9U$Xfe^ZQ^l;6^x~O7O3HY8(DHufbY%18Jk!
zOMdJ);Z)JC;~O2kgF36psD2I}W81j3L}h}%MopxmiK(r%QM$!<FrDIS8Pi(<xG|Xx
zjTTzq_4_=UWG<o3M{CzWYro5X*Cf?w1{c)nPh>uA^0<-HnNf_;stH{_zx{O)URUw?
z*^HooH2wxVx6#j@m)?OCL4&+OA6HG{V>@@9I6W;&=}dbq9Jx=SyFi|B$ouNSWv*>O
z{qG!W`~_Rj0T#|iqW0;D6JF2xJ}?L5FmK4hLs48+sA2g!+=|EcsMjrgB0hOfJ4EjQ
zU|rAo^c*jY!1e=|P2vNHcrxn>MTnLNEX0MsErcfJc!6u!WSdsv<%emq_T}G<bGfzy
zWCDW4(VJf+CnMu0Z;lA;^4Vu4w-SPzEe1H<qgl#LvEM2JU`I)(Ce$73x#|UF8Ujky
zb}#I*T$AO%wd9HtL^#~P0~e`RwHw~GYxftBF8ggSCC)u~PrV38_OP7=$KA5~KDqO-
z<-`n}Ccgl%=Q{RBOKv`|ytS=ZLQ8aVW_gl|woiS_Hd$LylP*O%y!OG~>&a!7Q2WW>
zz#Au#nQ<qOoxrg}u2*}BxW7)E$xk#z4G5F1d*fi7UY*j4xiJSDik)79wqL31Xsk+$
zMGO#*^Milt&p0PN2k3rF+-`Gx4e_Xo&8B$NR@Rp{@bVPr64PCw7k=paStvDR=|efd
zMt=jp%4WfbUA<?yn?x6mIKKCgAev*FDkPzkmQ`f#Q56p$Aal_sypQ4x4d|7JFg1?L
z@iElnr1o!#9+3kHq>Fa0C-#OMV<#_M2Ix97$u3)kB3Dwq6I_0rN<dB;9az@rV9nzq
zd_PeQUFPzQ0a2f@#pW@WJ`K!}f^2-_;w```LsZ#1{UM!9gcI_uhvW+*_Iuay<*6<l
zZ;k5oZ=Kx_k*w|Y67v~X=K-$ex%KbY7FdM=8Gx$!Um3s`Q<vosN$SiOqc1}!8*i7z
zft-SMfoPx0T;(qvx8tA3yfFggg6Kzh`@{(B)M`NM!B^x&77qwGbl|;12VmO<>41vq
z)tnh`71QsW3taAM+tx<geufLBCLX(Uo@CUlr4pQ21N7W{3JqtBTFc*iTqT}^7Xfe5
z$#NTcC11xop=nab%N|cU8yq6`Qxf5l-;ak`0|dnR=A~Tq#AKn-z0XHve-3pn{|0=L
zTl;`S$$$gd8P+<_3=f7*AayL*cf6q=0_XvbzCcW+BCa@W$~tT$s_&zIhX=Rl9N+zU
zL@O9bN6y6>=^d)sQLm`=x;4QL+-tQ9oNGvs1}*l9Tp_=q75md7fr$J1ZxJ^Qd*%Lm
z{nKai3oDN9-+-3O5v~CyK=oj@q}6Kr$u>V`+s~;x)m)AK?SOj%)V<a7sxd%iy|Qwt
z((`cY+V!0>tB!Nxh*z-jsc)3qgg@lP4$40T2;OgDr%4hM`d%x?H0PYoWuE}9OFW+q
zkSUne>|9Uona&fIcQL@Qozx}k3$XyQp0r|lVe1;$b?m={DPqt6FJWp~*RI&nF2856
zNXP0W6HhMF_Wz(t_1|-ZPQUHG{r|f4df%Ux`~6(_JyD@up{D=-rQZR5Wm6ZwV*(}n
zcl}MGKOnf|0=zGH?NC7s#-tY_PnK!pR9d!fCIY+8M7_(4Tn=m9QcZ7Wde(8t12|-(
zs+2C=R5Y}+p>_Ved(fz0#`Tvti$3DmQRs|sD>a`JQQ&3-ByoV=mEu|uk=KWKx5w{(
zgX*r<l^m8RvDlx0Str@B$IGko@p$Z=vqLw}>g4I;*FL$(QOw|1xP3sDi1bB3RYDkl
z7=+xn)3Wa71hW1s2RnmCdYE^7>Y-g7hl#^mZ<Q=fjYEt~bYpWxXD+uIzAw4r$X_+}
z)W-zk>;iceU#Br4<iz272PL^ud2BDx?_4y6uL!7nx={X49v_+~+shqq*WUye716If
z?l2IdbgAp!^0Vhm?$1Gg)l~mW4JvbWAhG+qYX>+{i-&(w-F|jJ_CSR{$?*Sq1CP7}
zlFvgD;UkB4O9xlh1DiT|=&Gt4Hb5W2%&cycF{S34{1;;EXA$|c!IZ(`y3<~Gee)rt
zN29r=TwTrS6{fltdUitm$_m%W|CF|VcmnhTW^}-EpZWI+mJgFGrJV5^&bf5-n*rfo
z0QgvJGDAlF5I+{g+TYw2C+B_je|WOfXFD@2J?2I;APl)onDIL_UeTdn7U9(~O;D~q
zYCNaV@ZGqR>(<$5<Ih8(qfcZs29E<94k)j=aRMI4c@X@H>Vp`g`fFRe@+h9o8zdcu
zzxav8RPggj8`$2RdY@>5CH)E@d%|wN*5UU9ex_MN3RcQc8gDM0{oN7mXa7y;s?iK6
z)zBxB^qlup!#b^h10LLk>aLM8b6z!U+Ff{#cW+7le$*~pIZ)|E4p*vdIZDVb<=tEU
zf7xEY_B+6;wo6Zpi0|HFO3LpEP+)EaCXy`g7;bzqa#=JeXL$Ph695u=sMDW+-o2;(
zCdIHM`$uoZ@%mrHl)szKhu(vl^DZAagf;K^(wwaA6i#|1`56?UZ)eB|XN-&t;T4My
zTw9EXvoZsP{d&SFAVdwBf^>rX)d@$+ZQdA}?8u}<ZHXrW^`NRW?ff6aMLG9iqo>_s
zd0>J#H(AxxW#l|q=cjF=HL9})eD2B5X`RsA>3~-@ka3I}zvPGBnOI}x*RRXeRA7_=
zIq-kB=t7WR+)!ER)XeJYL)k1xaonLH#-^56M~WR+sZzxcSZHu%>27iti+RE|pdwMO
z3~067+P5R{#GDZrFv+$d1rLF8B|(SfzhMmLaX_dZHu)=5*8sz(<82WAr9l_vP?_7N
z0z2^A2VV{C5<&m@Xbpua?@=JWYwi-Q)3;`cuh)<tFK-`(^5kI5Uvj(q<HneO)q#IM
z`O1AeeVc(vCHStm9H1kmw7&$9vm?7SWZTeq-^03FX=`&v*%-D}jJ6de_t!}G?`C5q
z>K7%f)ii#-D6bnhsoH_8OCUo$^M5oS;7@Sx!~y%d***JlwK*UtIQsbwJvHZ!tYc%W
zfT^(4^{x631xv$@qKgN21Zj$>CBzXf86{up<GQSZ1An)jpC6^O>L4p$da(TX>06?e
z_&Zhj+gZNYs3n&R?YK1;xsB@7G<+%05bAp8>$>IwcLi7CFk>Yf_K)CifMYrkMBy^$
zL5z6^!!6att4>gS6LRAV7XwRgja;lNy#-j$q|)E4Co>9W$?iyv+o>^ThKk?}a$;|B
zUV%WKEGx6<uS5IK_VZzsML<YecQd<dr6cHvw}VCbUB=in!`5*(t<ZCGjYQc=Xc=JG
zaxbr(-~J7pj~&~L0FoQPpo7*AZ=cs)KMQDRT@IpuOrHI^e%SRI$qOJITiS0Q+*^%C
z*nt#-Jbm?R3p{GVEV88|RsOHrWF2q+CwJoa;#~Oq0fLTQdoNyfO;iT8a8>NBx|ot<
zy;z<)LBaz8dWo1oZ3xqY|B@?=?EyCJ==_SH%wFF+KodAa3FRJWU*X_3w7lHfv7d~y
zf7%?sn*uw3Cuaci%A-~BXHxzzM*O?P&V6C7XqjDWxp4geP&c99&`2%-Hus&5gC;s@
z$*C<d^$=CfPV9QrWZ=L2{>~aVIvofOZgcoPBZT5E8iR$A@Y=FfbNFY=ep-(@tby`0
z`7${o0KYw3We5wqK2%3UbxOHrT`mixJpm7BY0}_3y;&Jfk66kTqFSuSI~6L>=V}1m
z{h_#L!Ov080XC9we|zoy^4+M>R%A<~FUn`wn^_K)XsL|I{l_iecVJQd?A5$MXdZeJ
z#g;-DX_okaSpEUV@c=nLu<a*YnDgjQknU^?0HV;evPP|5eSu<8d}voWt&e*d1?lyN
zEFz0|wt_-GCHHZ6cC{|-4{l2;TH)C9-DmME?`(iXu|A<nf~(|M)eTEZ>QGV|ZP<hG
z#_X=C3lHlroBf+bDwlKoCM3<qZE#w5f2$I6eoH9a*c^aGL%>z+?|y2&J&f7ae3MJ{
zy|R?(GP2@Lp*$G?leHk%)LyP&xbA?C7=m{DTtJHCtBY5&bD*fcO88m(gv%ZPHsdkA
ze~gdvv`kT~mrTZCcI+fZ<Y)Ke?;)l0<iQugZI;KRIOFA)U=LQkr?#3<-TDSQ;&VS@
z_r&MI%*lScdPxUHpRw$A{Y-k#ItBkD`R`*o4XzI>HLv7%imgHb3H9Bu%X?4lmmv7y
z6M$cGoIQjacx&hpnc(*D1834?vE?%WM4KSRD|h&xZ1(4u%6{y3@7rY)I`KD(BOj<L
zA|||esTFM4<)ub^%YY%fcgr^ycs+m9b@OG4$a0{J+^`d-p$@lPl0cD}sDj%zXu4oE
zW4YY)=o*$3X28PNZU~he+P!&z8gOy||AAKzsciTu7PJmHxXj{^L<^h}r_(~_KRb@U
zJZ+)4UtQf(0Hh3;qi;U&>d2Z!sXt$-G2V`@0HzQ8v5I@)=4>dt>hb-%60MnMPKAQU
z`hkFB<O#PY{>E@fLqrYO*$4eq>i`BcQ;6$q`4;cIV>ZeE3$sbfsf&jO&WpF@FZ;Y|
zZc7~tqm3hGwWxFAa+)d?kLoyQq*@o=_e<muui^G6eoDC1O(kBcl7^{EIr!$(%by$5
zdh!`CP$J1t?&y{^NO>f!Q5<n<rUfbO?Emgd_W$O3(C>*U>GUm)?=x#Ce5vo$MvM;Y
zgr`U_j2^-mV~bs5wzVEO?H;2hUkk9d2rcQCNmgrT%Yk-6gj3_v^=c5kP9@{c;M+F>
z(%#9{TEC1#c*i)p;gX6+9i1b95?<&w^UuETKOY((F#=pn^p<?1*yFNKKeV?xPUdj|
zy}~9VL=#{MBFQ!q9A&QnHAi&D8^CeuH`3Kc`W+YQOlJ5MI>y9J(1<)>KybkOdDG(V
z<|><T0MDLE4SZ78p#Rh!45zl+cuV~9CW%qX8=ZWEMN}r)$GRexD4B=Na>9p~&ivc5
zgrD5`SYJ#FXoWNwTXfvl9`me=@zHT3N>4gA%q-Vb34G<mx9*PT*~nouGe#fx`yjVd
zinEs})|ca{D)=tg!tq(3PkiA61bybex+XhnR%Faak9#;hLgakg)Z^iGjSivVA`=Fg
zmpbuBu~eQcdp5GZR8qQ#Ju*N4!6WA1$yN2QUY?KG@IH1i%AxtQ?e<Kl@$l9+34Qvo
z0X`p<<P^U>8k@p9dMKOu-wxXay#qCMGbXo0qjUyZdPrvt)n1WgRuZz0cMOj$=-2=p
zyqtF(HAhD=`OAO?@ePkwC@av28P&`v9{|&FJw%+OJ*bZMj<YFPy-slA;rzY6fO%j9
z!bM2F@30q@jzj<sd=RTY!L7dHxR&A#alxx0fRMcyI{*>KKvorDb6+dNW{@z{HSc_5
zo6w%SzMt=JQN$hTfxfDCzT+kueDvy)@6@Y3q-&?8$dJu#75qI0AC?@tW!*0hif%9-
zS%8QU8@?ugaQgS8Svl?>?yVb<G-(_-If=>uU>uKGNdmti8neLz5l?vX<ym)Hv^D7`
zN%z<GDK>uQ)6=SL&n>t=bQ;h-o(}Sj7_c)t@K^Kr!cKEZ1BU;2gTv9zi;dIu;n0ZF
zVkxGQBc6f#Mr?BA{sDSVs)ENu<jx^7_IpQ%v`nYN3Z`50*NCGig^|Y@9dO@bANcK-
z$S?77P&w+h@A*7gUQ?c5W9`3O^j(y)si})akP_Ry1zBx*rGN8<>J-ZUS-a*VVFTLi
zI}JwUBL@p-pwd0to|^qUj+1eAX@SdRn;p}76=RNlSF}S$n*(!C-QA0>%6&UUnVSUB
zCoOMO4amoV_LKnz0UU_o0e$k~qmw1rAJH_!lBSPQ=lF+n>54Eiu3tSX8yUtY{s^q7
zcbgKgC2&q+`BrVpr$!^<GJ@OIqI)4ny)FFc6vr(CBxF%=A4*8K4WrX;S5xU}-(u0+
zDmvY|8ZOawq_e!F#Su}dDZN;7`*34sxn*;8w!0!pJ;(8!fV5?jjPB2@_#Y10uU%y)
zq(8PRMuj4j-eFxtxA5#wd~%W7U*82(o;fhM+HYsn&$~_-mFf3jxk9gFnRuzq1fZyA
zdAzExdxSa_H`jYgV(Wl|*EFFJ+{VZIR~-m&@;2Wo-IfAI6Dh>wd4)R|isRH_ARUh!
zzm8VtLoculCYNs^90DPXO@1}j9|HJiSp>!t43FG1y>G`)23y&<qPh>ae3hgMD;j?`
zW?jsQctD{)?7AgTfrz)mlKo!ZN|A7#QZ;{~a;eCGbrCC6PUeldqZp;elih1e7%b3`
zo?B_RT$|2+vZY$NkdTQqiZ51M?=leHEXySBJ1uMT>fI*CoAvi`W+sE=iSAW`?TkWd
z(>q7F${n|U+q)5u*Dg{b%PS=tXj6i0!s@THkx2NO;^wqNNs}NhP8gN8y3}NMyq|z%
zTdQKV2G<IyLx`1(@CfIpjHi)>(d&J@!{&@GFZ<*K?<66npyR>nS14OC0(ttwpmdpQ
zD)(BbcVmTIR6~33Y4{JuY-4Msf<7CUTZMU?QDv}zhQ!xD9+`Xek;V#&%pz6^Qy1n(
z>nJ9m2uUsCfK4yGYDMzjYTmOPJ7=>tP{*qygy6zget(@Om<H(Y`Lp@FQ|8(h)=3jx
zlD$Tc(BB=rSXmftw^O{Yx(XMRF+n#Zh)vjvodK2blI`!WXKD^2H&jzeZ0zxpE5Ap$
z{OoT^+y=tEofdY4+h>lie+2dehgzwdskdKkd?7qqH=_l;*pDzNtyJ@X0Ym}D*!k54
zJ-3OC(T55*v&-f(oS#DY=U#1(r>W$x@+y+oRwQVS<i<x}gnZw#p6LQtLqsrv0fNn|
zf}^sI=NVmu{~=Z|1HH&3b%WA5yfE#Dvg@3h8pB_URUmP%UQEq*xecdGs^r@kF8@)^
z7dc0oY5FQrp5!wp$YyIwQph6nT!(k$fTC6V7TwOEDC@&hKTbM)b2ew7rXoOe$U}a~
z=)9a*CCx1XG@%bi54wb?F`EXPw{m6oydJ7ed}){C=vOzhET&&I%QASze#3gPA7_mz
zuFAb1!{|$E$)ZTeFBzYs8Y2&}RfRtTJ*}mK>5ut59p2C%i=mR1Pr~d+7gz{Xln1(X
zYeF?%<983S>Yv(U{}eX-6waQw4`^3>1-kom5)b8+Y|_0yAHQB5;ROT;oSQ(I7N$EC
z*+D__D@D^Voy1s=Wah;T=Dz%~p(@BYi`GPpHWCoR-pK>%|H=aZaEp9Y$QZYEm7Dx&
z79Cg3j6|ZsWqZ_m-P5d!?H_DK5_xSuE{h=n?sK|N57J<SbRgDy;o!<Dd|?_nG$S}H
z^yCmK5f<-LMd5>ud27{2B5u)C8)4@~%}I`o--m^gF&AW@^ph7ai@9a660v8G!V8t$
ziytud|6ptw54v0{RukL&qNAy#cn$;k)K9UegkAxMgf9^3>1z~S&roo+J}ELNN>F-1
z5y;t)39sAuW1VXiHeX&g&T5)qv&t{6q&?_xzL=F0Z2&#sffkCuow|Dt$A}X;$ruqh
zsR|A(+8FlLqte(kF_l%D9Pzf(4BE5UZE3G@KaT8o`dr67G-r5Gp5o(13l=NM+zFFP
zinlmEcC3lqbEHkz=5K$unkMLBG^6M#K}DYmEtzQGRJ9e9M~(&CFRZ~odCNv!AgDhD
zB&ms;nqN@NPH>taI?O{Im0H6F9|+SiC+U76ZF11Zg~mUKu5fne9d+dZnxVnmRYzv(
z+5r61*$Mxw2Q8(i`bxLzqhP!wIR^BA$Zw;~AAF+*5^}Ue=45uyvg<vd)OboU`NDj5
zx1DDJhz(Q~3?+>Kk%L3`jI0ARLnjVUz7ftE+|nKF=`_4^ocjW&1wURQBF=ub)mLlY
zz2Hn_S^>UkFps^?&)iD!lh4|9G+|p(pr`2Z;iRh%l=K+63a2#Q^L|yUDlk>6Dq8&!
z7Skl2_|hbzNv0L4CCgG9S6F^K%00QM8Se{=fyni>31AuZM^~#~_b0-e<~YphGUDN#
zYDT?v(^=wHrb~_*rc2fmv|?L}$83}<1v%(2@M+I2LaanOq|m_Wwhil21WticSWzq=
zH;~bvkkP-!UasO^xgyL$0bRN!LX}q=oH39xghqfA^4haJA=^&q&317w?f5WjiM2{&
ziM99Q?cvt=<4$FNU`zCMlql(M(G&M%<>M3<*W1+X;0tJr)mD&(_EX-I8b?qvw8=b?
zX6(vkbvyEqY-%(qyY!BjqUDEz{PhxW@B9zxlZF{KxGe3W?y>o#V8p-Y#%T4kyUm1R
znmq##e(d$>M^up*9+?~GGwz!!v(4mfg+Tlo4L2v9WbEjg1GB6JXB9T*6i}bUESp@g
zrh%ifu)HzbT|07S80u$<FRN7z2(MtL3LNcbIwhz8gMe+E4z>vx$B)$YX(5b6X`#8%
zaHilkT0_$acRiII;fB$XcaK6!b-B}voS#N`@FEV4|B38~oI`X&&lzZY-Y86eW<>xf
ztw`{MR40nQ+H(#@=8dxAL6t5D&eS`G*(R8Nw~e3JR{-1ajHQM+Re9S^=#8!ify5)D
zhuNvH*$_rJDARM;8Ujz!aiLEv3u#Rehw(-C)(5E!$v$JRBvBdM)**3ggN`X)RAWtt
zyk6d*t+2%W8@W^X!Tg>t-Ye1Q#Cs#RGLK&y^mYFkBL1nR;T)%YC2tV$YqvVyIIqi|
zqOEFg)fyl4uI4KnW8Uy%uVyV|zXHr))=vBrjK`0s6KJBiY&i)e`tPM}bvxC?usu2C
z>zG9EF4MZ0*pUW=9WPne(mUrgrKZArh;VJbH-Ms!)~gULJ0-2CB=HbIMQ)+E6XjFh
ztC5d<Vb39wh%d)h1f^Bo9m5ZS4T#kRYE@LJ6^ftL1Q7=9Ciz}h@{`VYOT6Sc!I>HY
zuIW>6)wn<F#_BKu%CYBQ=41=+fWpx}(guohp5_7&(V)=4(YEjByp8Fx3e-5m8(ZnH
zxX#6Qu+T=wYvZssX-aO>PL`1FENaFK$YxYl1(>&{f<@#JRADDuDK=!rjL~U;@>k}|
z9#4ZT#!|Mo)L`a`!z-TLxvKx6GdTqU3dRD%JTxtdQhJ-P`9i%#bO&<)f(Je?3L4v;
zbB4uGnE}A$n9OAgH#cG#1Spr+ATj}kdUQG)dPuw_jQ%fJhp?Glw88nmMlNTwO<lNr
zUFh#}UMN2st-8TEl2o$}xoa2NLx@D`V9tu$kHkCQo{Tb}1-CVEyvBJs0Kr&QhLcht
z=@8X{niCWO+-q|FwhF}n?`vNybQRgs2UW@(zJD|KE{rk$P=ASdPlknvJ?DL9#GYQ|
z$x_`!9S5r~TOx+ja9gUU2aW1_46<{E#p8{=_4_J{FZb2y#1wPexYM+CvbN9_MZ<-6
z$t#owKw9{@PHxg^-5NQ4+Z@LwY`Bny>KYxa=#sQO8eaF=is;F38!es#YCo4E-_?>u
z#+>N%miRRz>!ITR<lrs#9K6e66ytg{k1V3QV|t7U^(AT86f~f!PB?$GW3vlJt2_z-
zEsE>3fRXnh?-h~w2{wBY^F)>5#nbXO@w`AVIK++wMoiPG5o^cy%G(oX$8_v8*AF8V
z2bM}&#>lN%jyQdLt))v;a@s3HN7B7XX_$FURKBX#yK7h1JE0ae`S^sF#@<=<+8}il
zpP;kV<ZwQ??5fgS(PrID+~o!HCWf2nCEN6TAM$JQCfqU6Xd?tfxTC66&<nr}B&MoW
z8T1aQw-#02tz6T6MII6qTKl5pUoM=z=#!OA$Plp){R*QV(qE10ANBVRjY5}%ay@#!
z*;$WjVWZQumfZ0;XIYoEeJq@b;Tqib5``FW8)-GMb+c>1a64%ggN8ViZzr#CyS2$<
z5k{0N2xsT*>s!OtKMI9DFcQW0j~23GXfFEO92DcIp)hZjUm8gNs5yX+Ip>}w4`OdN
zfI;juiwes4)^au9GPC+VMXN-<YGAycD-X;V{b?tHvd(yNN-mxP>aRu>MzvU83#3rp
zH3}BZ-?_4N+q7U^@h_dq6M!sRRbK3^7CT)aEa14BB)Lb^Yp2aHXA9{4=!Yg8J|2$Y
zo50C`>+JKx)+@M-3ia0G+dvxz$aX!xxw?6}V7j2|wt@InUGtuoEz{l6DNap&#l8aU
z5lXe-b4=c)h86C?ES1F?=@uk=N{i%CP((?>y)J1MYPbSsdH<$ap%)OWj4wXw;1(+m
zTup+4MZz*Ad%x0X*6QD9!i545H{7!}&~_o%#`mJxNNfCBaCz33r4)_ewzv;f*W*4Y
z&A%xy--6L5vs;e*du|V6Imi*82(-c1DjL(a)es}iX3w7cv(LWZeZoAj|8FqVYKA3|
zZYC(dKn(>iRATkxjV2d7`;8Mu4+Z@Zf97?X-H}462n+t8Pls2!>x7nrA~deNi+=G?
zT`yg<h}}A|?n`*x#lw#xJ5QW!isrd}GUd;a#=Gz1etUIwVBxqy?ePImV*bKtivvp1
zGHKIkskPE$Y5O|9wW5Ai(HjmXDdC8CSyC&-Cy=#sznn62U(f!4HaDJ>o~H*-DDU$_
z3wACHBqY5`Z!d&2%;-I%%7czWeWj0v@pdV0Dt9Z&9%{LF$*#(*JD^Q;JfdTiQ;Ffx
zvhwVxNyi&<V1Xvj(S}d>6)dvqT*Z7dGQcR7=Csgz@wd=`Hpeolk>zIWx6wi)r!t)z
zj!wf9+gnufDQTQ5)w>oO-B3HqSdm0Wt;^<winaGk8zpq-$rF=HayK36W69%hz>Otk
zGc&{Adbv^_&K6n{3%iR?WVaV1mPE%xz2#X49A%%Kt*AKqrzKVIIq&e`qEe;vg(a#g
zVpQRVqn}rf8L77`Z!_+N8Hqx~NczlwB%C38xH@DnGw<Jd?!W%=i#vJYlr%oHt@pHe
zGjB;Db5JYnKF=#Ar?YIcz-xP$T%Yf)+unbk`0_p&fE4V%*QT;_kN1uT6hqq#i(dk7
z4;)|4!@|#JiudQC$0~fNRIekZpv{rQtZ!3#5Gq!0t<1w)^!*X)=qbvA$U_GQ*UU%z
zDkjspYlCnbpNg1Pf}lrB5Cp$IX=I=wgEssvThhxzU)D?El7e^<KeYei?C44C$}sac
zbwkbeN^df1f#7Xob?UNk>U`gfI)b8HN_By@;2)kOH8s=<FKyhvo^V+a4-FhfEa(ES
zdE<|fXIQv;wvQ%wAAO7D+lrbsrs<LNj*7#~N@;<jtCL?a!pXMe*hEvj=CItM?_pTR
z$}$dQBm2a$T*7Dee1E{>;gL!jx6(6jPwip7P0x*ZE$r#44bP?KN*xoDC=PDBQPk3X
z(yUgK?+B`F5*zbq?WSjo->}!~v`5_<C;xfHfpz=J?PqG@0&SQ%S??Ve+CqkU^RR+^
z`p%?sf+oz~ZTvAcC7fN?d%;N%UKh4;nsDMGcuF;P^CON(91|6vwupsYq~Ci32JD#o
zV~_Ek9SiN)aq?X-esF&jc<`DPY{-FqLEXcyN>ol-d>WADTyQu>^lW=$`f+JxIg5Ge
zD1topXf7*A9qak1bUa-#YxDT;(hUd3%FXsaTj(?yPaxH1C#F54WafI-hzIH#yIGV@
zed1j-b00~b{Ny5bT&7~-|Do+Yz?#asHc&+r6(tG+DkWGD5djsYlfW>F3{6Eur3t85
zXps&f5mBiUJ4$GRfPyqpItfULf^?)qAV@DE1PG*YcL+1%jDGk3zx(`m&hv}`k4es6
zYrX4T?^<Uc^YY4J`MdV@2k+^z=L4oIgJL%-`cvimB{Hv>Pu`!p)2o$P1S@77^ZV5A
z0vCT?R|0~B<UTRqHL|Ej!(}3yAM_6ne@}~yV+Bp82jN6;bAjD&RV@mKJ85?<*x!23
zPjs<xo_E`ps{B6Pv=I*rz{uaj7Y+;cm(AYaQ`tsDN)^v1oZIDT{>sa<SR&F!%$fO3
z?o)xB-X|~oVqQPh#y5Ys#3L`=G@R+a5VzDnHQf+0v7WNs+zQHHg)UemN0_=hj^FIv
z*~_BWe7aCCe=n0=snuVDjuSoRAm$nItvfx)X6T*&H*5x^%~FIoOwsKRLo;7a&n08M
zy5|#amQSkS3)6x%h(w!z2Gwfbv6J!V+oLs<Q@kFFyUr}?hw}{@n?}TKEmcvm{hYW<
zW;g7J%zLIZtb*|T{JRz(C&ReP2l*X_-LF-J;3Pffrp%%l85wPObt9y^reA?P=zl_+
zZKk-iO<Bg{$a3gu$FJk{702>vWnUo8Tvt_2;Tf>XEI8clYnACX^N6gu1vQ)_Z%!JT
zvkb0GlcV6jWg4HJSho>7Fol6_k+=_aRNIsZvvm6s+t#z)xghyla+1q^Oz+&i23eV@
z98-6FwpXKcfzy_fS=W4427}?aKpLSl>&!Chd&DH^GlX)jCBMn}D_!J#W})kNSEgee
zwUI#%ulr(^-YvqPYcjjX6Xop{iJfawnSyvNRhIV{?PoHWBjPMvmWsL_P0=v|3uo23
z5@Kww*~F!xSlSD1kySiXdx!#F$l3a?8h$?Kde017+#81G<b!i8dp-A?u+nrNVNw2n
zz!zBQKfp?N1JtRYB+L%RUuR425>UN-{3=NspqP&~XwLr=#kRj&vk^P4e&%h@da2v1
zc--`*yc~^PwA9qMr3AJ@F2>G7{aN4nv5<Qv-3S*|acrTS$W~%hXs~JX!0dDzbUh8(
zZyV~IziQQiP5Qs<oV|H3p`E|nqIW4HYk1n+?y&Q@h2kyF3zJ=+r0Z)uClnlUheXIY
z70d37qjjxb)+SK8r}y{9l){J-K>;-FW`85pePe*l61(fuO~q>kYEZ3h>@hdAq$IL9
z%{AXAU!wn6o3*I*l461oWk<|_!%}tUQb;>{s_oP9Oo6;&TIVr-EC<hAX)KHfxs~lT
zbjbfpk|MwPar4nI@P-O`ZITd7H`-<a>HcuaXR`1}w{LUi-K3?tFVhZ?$~&V@=J$#8
z&mOi8Z6^o<TH>&|w~X@s=i|37espaV?w4>WRJLqVH}@)|d?PQq<`0pK#e6ru&a>JI
zn|-8me`JS5EZeyFTpVj$p%u}uW`5TTKRz?vM}P@QKFF!G_lT33C_FTA-ZwQb3)vM`
zzF7q?Z~0yhjHQZTcZ0=Ww!q5&PTBBOej4h|_CXG4sl9YBCLKk{DVR`O2O_tgq@0Ql
zg-~|E?$<+n_PBhno%VS`hc50xf5$NOeNRQ7GlQmfW>lCkZt;ZZAwnUr9RYThuYD-l
z*2w*i#)s`fmp@5+^ZKtP_S6%Zjc*5RuaBN|8-I4bqImpH<wD+^dV%=!*pPdTMF~pN
zC#(t2%lqRl6G90E*UX1itr(JYc-#gWa+EUkI3dh6ce?#iQWlc=F3X<rC9C+>)$^9!
zjWpFs-PrI+msq7(4}#r!q;=8Uq)`<cvjB^X)e?b-g?*?$AC6S7B*<m6ObE9ItTY&T
z1D~7DsN(z`+EL7t=hgheCu=hXFy_1S?6b9f95m4>Myy`6mo4>}3Q;7ZH>W8)aMFP=
zGZ#0AXmEko{3{B!yio!vMTu}V!bCi7odyi?`xEGlE^3+b{38NVGdb?BdGYNe*ZuXR
z+#HQnI!0?DQP2;_64r?e=;<%eq#kTDRiudJ?|1Io)uDD8bp6t3Z@11OQ9NIZne){+
ze_DP1eD_fEqB3hEmLH3a*%C1I>1vzpZx1Cz{^k~(SMj%aL+{lV*t_+9JyI3)UXic4
zW|68GM%jYdv3gMos+@=+o#=Ml=RB)HmtaMp%$H8rv&%iwhCQ0eV_tJbLStT$nAp$E
z^pcee2C%29Y_haFo!Pf^UxVFeuo#k8vcI@LJ(FKlk8fnMD<O|E)7;-c!);~H1OzF?
z4GfKMCgbIc$L_G}s?v=N_x-MIOTAmFe()dOcUwDY!!~}bnlj)FDG94gHB}L2#1Mnn
zYEz#BCZqp?kdfBa5w*`GBU)6su<yI!azt%Mj`6Eeq-n{hkkUxIICyy9jFs2@Ooch?
zFqE4{Mj;Hj@BrWK^6ZMKRD71t#)mOH|6!fxsve}O$0k|5EYJ1c%16?c{Mm*h+8*xO
zwr+#>rH-v%ewTnU-g9coaS<ktP8}6b{KhBqzRa0uE|$ku#pUJaIN)$fHT{ni(bCAd
zapER}`h6}#v(6%)Vk0fLX5i>?L6K8dhWthbQqwFxm?Uhj4_>9Dc=u+npOj^Zm*0kT
z*FXN9-I5Ie=4v)%`#c%Yaw6<yWNHZnL0~r@G=nHT{0Fik2vQgW?zsvJDt>I9`2E?!
zRyav!UV$F@$9!f+7$f%NB{S4m-mHaNyNj%2?9@U+&aP!JI3yVGHCwHxB6*F+5V%*o
z2^p0vQ>{*2jE!0BWwmNdT^xthy|#DrC8UqO-Et0v6Ex1ayta<N|6R@zQK!s5wx|{e
zo+BN*pqe9?-njm!@BAAlPfWIV?^ybRZF&hMdY?MC>7g~a6(GpaO;Z3(ky*NGK^!??
zRqJ7mk5RkkIb)kkjm;>+?FcX~u37S_Mz>kvGl^u?6J9eq_(OTDPcw}|7ZgYCt-#nZ
zsjTX3HPpLWXXj=ktB&Rl56280*K51~>1N>MuhJk=so?3kp%3;v(~1~me%op8u4Rci
z@W3rhkFsAfjau>q`4lsA8rH-qSU~i?Fp=nM*NiNW?mfzRH*G79zkQ)3sT!%ciCM+w
zihUqnZG|6(MAUk0mYh8C1H0#XhsOry0s$_NVjLqd9Jj<@8>eRF6|_rPRRXO(F9Tov
z(vGn?=vXI?C8+g2QG1<)NI2@jWExafB&t^O#l2fd*e-hA8X1hKtq98Bs)7v>D>QX4
ztQ{7LJo?OL#sF2|!olF@NsucsDkbRQlrZ;43j4J78>hU5Y{Uj_cmE*EU4kn@*BrY#
znP=pC4qmnicIs%FyK9YrsZq8?np}&uck9?nV*Z#9mOUbC2T#ZLnmG38(t6_JJW<69
zKK^d9f5^glV^~-iR;@eL|9NC&ITQ>@@Yicnn}-TTEobkzHXD&QSmZfdeVokV2jJsG
z7~1e)$<f=gda+G1ubeOLW0gl`(85RrMixVDUMzlby@zb`{jKI?ohe01vO<^9{|CLG
zjz$|Fy@!G?RgTT6UNG?*o%%YS@oC6bZ@m+Sn@&P_j}V5AzIhQFKK6BZvjO#bR8-eX
zMcAv}BBC$B>LyDkqIN^x%C-M+VJ*R>rY5XING6_bYZ8`|Fkk_9HBcoNQ+=O9G~8xK
z>OYZLQ&#;2!^X1{bTKk+7qdyxsyoL~NeQG!5FRDThb3DkzqhE_^xmmsey>W5#t-cM
z*8c!~BEDRgd8KY#LXwndOzAI_Cj5@DNXfSv_uI?LMOh&86%jT^7I22ZiR&5qG_5H=
zWUSLzKgWwRNB{QXhHJlr2RrMG%=RZAFpa1^wtlzK?>~8z8E-6d=G4M~-;~uyWD99X
z=Xh;LNCtYi>(iA;tHQD9as^OS=1E}fci2B8JW4$hn<PQ{J=Q(+=J!D4L&!|Pk2NJI
zFar*ZtRnohw%<&Sh{jFS4yzPe70OBw=1p836%MOM@BAllg72nm(D(V#o_;)Ym<Rz*
ze$gYiRzxM!tfg3*eR<3Uw=|UHN6Ro97W34}&Qf!8lpOXp$xOVsgxEh^gP#>AEbQ!!
z+0COlh((SJPaIIFSR3O`?8ohq%e@sB4}Vd~*0u~AzYu;CETUfyEB9YMu(K<{-i=9;
z>tV*gBwX&aMw!%UjytI&&xvCVHVLHs9E^|FZ@T4FClDp9g6<0>^8-H?Q`bA!f@~wB
z4~lDe7L(`6%(=WE14Vy*qDQ&H!R2)%9PQ2N2jADiFM7F9BybAF^o18Qs_>rrFq2jm
z`*?44*T<Q2$Y2O1n?lYRG;qO<(5N<&f}$me06s~#_RRf`lAd=P=DDu;^du+m2Zp}g
z0kBnOJD<Fb3;uK~^m}{s^vi!Uv)kI6H)v88%BH`VpbA}TR4#TGTc4)Rk&%A+6YnY8
zjyY_W7g2VIs7;H(&E%b}@;*KFb%418JgHL6ECjGN_`1>Z_(7l6zWWfXN%E>UHjSAL
zdi3)q{_Z_vK0V!$qkpIQ)cE4R)BMf{AdfB?KyP$5lZ1Q&W4{~LG`lx|sf+sTf^|Bt
zLw<-U4v}9km9;N`07dWaW_)4Lou7d9ohIVo(SB1@Mn;_HX}8v30K4pxBEOjMCRLND
z2p`QiTCl+dR!pT}<k3nSq^E{cQvOL(Kr`u;LHS$2y-0VQN4#>#{G)69;~}RvQ|;Q#
znhS^Yth!<{0_U5h3y=C0o;`zdbDYwcy|#;sao_enR8w}SSHFj<tWC#;=#2Bpn?Pr(
zve_Gez_Lj^{kNYY>DBsoX5GbESzBP!WkgG}Zp#y=-R6@4YQ40lsuKK^l>`Qvte7hB
z6(tDX(c{eoUb`5?8D^yeJg9A(==F==nD1^BrPdiSzWc{et(l=Vlp<-=SVuQ)z@t9S
z$DindckVRF8=d!dx3Hz2(tWAS^~iWjo(E2i*#(RZc_blB<zlN8J5?q(tn0yb0L2BA
z{)wMf_YjPye49$9c?&Z)4=-(rS~MWE<!9^>=Eu^=VG*?~ac0#~_7mLem{#v6)Ipn#
z0}^VRloSs1QlgT)Uvm63sc32sU3J&E`K(+{OJ?x!4MGlzID8>)*nDaC>YmhGXQL7N
ze#fbuOsWYtcc&V2eY8^MXc$$jCnKM@pUS7EY_4_p1LP+RxG$Auji3ezAf+w~)ZuAG
zUia(?5j3rty<t%~LL&TFCBo3@DlfVkznXQXuDGPPyT+9;KFXml-uvyNZQxm*w#KnF
zRQ;iX1wk898kJw18VjMb*v5FOq-ZZ5W#`NY8BCOUpGN){P};^eU>lyC9@RB#l)Z27
zw)xIUp?`}#+L!k8+!R*H^orL9y27xch%%WdCV^F}{#d&@bijN_4O)XSraVNx(T5rO
zMB7-l>{U?p6`=X=u=d_eWu<y=RlHIa#$74@*fz*9#;%Ck@dxS`SJKeE_3j$Vd0}DA
zMn-Fs#j$eR4o2Nsp(KCX(0<SK0xfPmt=Eruihu<!)*254sG)YtN<`vNIbC==z9}Lj
z;auAu#m=(TLGQfvf29Bd)_L2WdTQX|pFVVU*@t{y$jmkwwLOiU_}*@L!&_C28w!7a
z_<F;KrS=$q#ctYYz4OQ>7ymA7d5!hFiSmcZH)4PKPe)|7=}yQE(KYHs*8xxO{$pQN
zGreDumtDsS6H!Y)P21}3h4W~e^J3K$n>3ThgL;DUA&uPiNQ~It3FVR<S-}xcM*)hi
z(R?*qVBly@FDmifaC>+0UN#pcekeOj!v)(<BB)2hqLjXZ<cf-@O$?`99xz_f<KA0}
zA2pT(63u=}qrws6<HqT4^99WlE0+1J9)1#+v_u=fGM<RSN3|tQ<h!C+^WF1Z;@BL6
z6)(}&T7Pusa*&nGzCIU~TvmHDE;;Zy#z%`V<XiFR+)qGTI<x_xf#zhw(1aDJMrh;*
zoWQDTQau%Ae7*S1q<BmnHn|R8fPgV8@|Y20r(Ii&d>$p|6r#=%+uqrzkTK59lZ)S+
z78RHDzMxsSdIRiR{#P3A4%>R(o@cr`_A=X(w7CBHLOsBlFf`xiL_cL3AWIl}8+2Fb
zr|+Y^fmf0-Mf>DW^Uodr>Vl$X-b2$vBWVY*RfgGF1#$Ln!h}cn7uOz{bP-0JyTq*b
z=n~AlGrmipB0%%s((!Ep!?S##bhAI-sKy2P?T~<~+>!Qf@`kjdFRYPwZZyo0Jnf@~
z+cjgyC-(o~KU~9|^5-!ySlW)GOfT_Ui00m}QSjGqr{2*@I$C(Xy%=rd?l|S?88x$T
zieZp`_<@R=^?1!K%^)$+O8!jSs>U=)MR!YlvJGU?<~Cp;I<U_{skE-dTufb~n!4Wb
ziEoc~bb#xTEe|*5$_1rE>%oGFtN3wilONn>6;BRFbNZV7(*8`*c1_{qFNP|&s`fn;
z4&lh=0^e8vQ*e5N6L58m{r1X`%+K-AOClRSNMM_V&Ix00ImTALp~n8Zl-G{0=G4p#
z+6ltY*S8<+22OMe#Y9?(B4iZ@|MlM7MGo-rxNYzDOmEM}&D<E^0rlxxsjELB(W(G7
znNtTHhuXhBdbY>u;O^nls(=S;u)nZXi#f1W{bF!R-ZIRblH&m^+MRlAL?5@D)CfBe
zz=<#3ds6k2)0A%70?1$HEk{X2af;PmY!xQdlu(b~d+?S%b)oNxu<2{>{l<WQw;LjZ
z#Sl3!^Y!U_I68Nuq70}SMs<(Pm3h1!^3Y!#py$Kr-$Lfn#IX*S8k#JYMf4X?p5ug}
z*}5PPsS7Un+6?%@cT7`8?Wj+fhTl-_PazJFFg#K_JIm*xy_@=YJYw&-8_&Y5SFs3`
zv}cbLy!s1AUp1zUNcJQ$W+U0T&>6$ZG(?p3lTeJlgjds~Co}r?xSmRN!-JQ#@QB*c
zrYP?90%rsZGRu3Z5@2o`RQF==Pner?95_jFb#{T>fZm#zn;(@NI|T8(Rjc{_Lu;iD
z7?JAuz{Xc)+4Yr-<44*xM?&!LpSwB6QdZ5*|LiBr+Df1}wq~c|tzLG7S$<zr{TBnv
zV15L`H(n{9`S4#F(4`1~;BJFef9VDRyzA7JQ{wQlu<T=;mciF?HDyS#`?+7NqtGtk
zIlXunFY9g3tI(m%hcSHVx3+sCnR^1v5RXWwILz}f67^XOD0KJh#aPBu?tj2X_*ie^
zP@gS)<Xpxh^QJWR-6ED{`|K_c7FY?g%K#xQuzbcQyOVP^aTO@#B0xcQJ8)0<$Eq3z
z0ZXc>DW~L^_#r<p-r|#Iy77>7G%rWo7?qY(7KP+HMPTz2%Ym}A2R*Ax?=PI=a}RTF
zlrJ<>>4`e;r=~3PA(@LSXX8pi1wPAr{tKvazF~IB|6JpA>|VZL6?J8o5Sw+8n#SLm
zlwn&dKE!^=e+a`@|F+;IKl@#Diwec#@8h6v`<~iU!};R#g8p$$oRxmI2YixoM6H<w
zyeZ>G#CU;1hJi2vTbY!<E%F-+b`n)>vM3AxON9yu83WZ)^#h$7Tezuq%?4LT$>6Gu
z|CT%e*eGySErMdC+OEx$cPnfyx<6yjKP}bApvK@oA=O<DQq|ZRyDZmO@fo~3AEehN
zr^pbalu~q2rduVVo6`zlJ&wYWDT_Lc2U);Sg*+=O`lHK~x~~W6>j?-s#{H^CC$>Xw
zF}q*A{o=<n;Iu%(s$B}nJbB5Qnsyg~D%ABF5$O3w{))g4;1YMRlX|>HXpA<k;F?<l
zf@r1^&lRNPKzlSH7SFX?O8~fZbxUcdpX{}oH(8I1%2b76tGc4-puZMuMMhZ$%a#kA
zB;?}Q_;Mu)y)2!t`VG0|Krga#sW4@<^iM&h4b(@!|J1nyE#uKG=gr!SUA(9j*O4iz
zM(GDQD)lh0AcnLJiaf$onSYW>(nT8XhE+VvkNVxRF`enByeN(T9?6J$9aMS!0{v90
zPcy@d9j#3|9Zd=}IT63CuY{|?Ko{rXpWPigkU7nlc3xj8EPl*}hm3gAHezX0b!eOl
zD?D3P(n9qa;=sV!a}Fs-C~~OEOjP)f_4TD*4sAQCCmOSye^v!--2h@v_rr}keE1i3
zqwk#N>ei2_hMBqft_gZz5bCL?lX1O8cZZV8x}R7!@Tg)=Zc^;_(xFD;q8vtd%KYIF
zGw*$xTGO^U-2S?aap_!$&AAlst#~m>zUT0q7`S_YLPKRM&6d8F_1k>bxk8iRCKG6p
z_h-z@FA#)$Mwhxwro+BWf9tOA!^a|OW!(+AY3mIPB(ZP!6Td*#^@dM4kPasdF>6eW
zzp1*W3Q&he23fa`e80RstZWudhqK~-NNQKLIW~85Z!B1``6KP-Y&A)HU6UKh*l)71
z0_3!QMC~4HyP`e+Nb}2!uFL6<(^QoSdz`L`%RYc2?pEWOhMLnt@JFi%ANFtR2!lOM
zgh+=|$5p;-^(6Ya+u&1(#0ACuDpYCq4uhq)M8#p0oIl$QABH}+DVk(!=@SzngS(GW
zjHrDZc6g<k_y2D0%1>7#YQ+uIp5Hn+*#5^)EiK^K@pbB@**;N;VRhUBr8Jl~S4HHa
zNw8ChUUlqtlV)aVjEqj31?(jdCiIF+J@x)wiLU0ozc(v2%ZE5MwDlZD$mpu(8zoR4
zFM3;{R#Py?d9?;2fm?qNKV={K8DmQg%(%>3QJaO(^%_;^sr~i@)lgqJnu4;yo8*n0
z>v6w%gch?A+Z+?VB7hx}Dg{-$sQ%B@(W(GhK~6w<d9kUnqYmLll+P$*^Iz2;%PM^Q
zK6Rj<hX#fjuUzPxWsu_giiL|dx@(5$g+nZ9F(xW|fCy7H#|L4(8J3Ubh~T}OeyU5P
zZkKv<@X;opd`Gpj`PPWoQRmD4sIAkZ@QnSi3cVBBsIz<Ee{3HnGyK<B#q$GC9urM%
zRBRaNXtihIG;2a51{WQN3&x8m<3-5X--}t(D+PXl`j)<S%b>K^4}J_>u5*>na=?-1
z=2(Z{WO96UvbXErfs-eGY1DHZqx#y1)!kjr8Ks}Wwchg%Z&lLo*xQTD8^-D>)~SeI
z74yusaKUeFg(4q=%<25A%o$jk`f13&$RZ`C&ifSg@}6*+4!B^c%Ot`WIep=#II?vh
zF==G+Zblv+@^Wr`iq%-+)2c;LWDl#c=NMMJ-L!o27xlXfO^RQg@bOt{CacjaQMwjH
z>BoG-ogqJEwe^M%z=s0I{dh}Cz4mbRTxg{Rsqcg87QPv6^uPPE+7^7<luewjHHNH&
zXpDAZ_Q%EFJD*QnO|B^@AR`M$tz3!@XTZIK?WrT?9b125L#qNF2!T+=yAs!qW5gaH
zG~bZ(pAHO*9#S{x&j~;nQg&M(;h9OoTR%Ni2b{FEkO*&dDm2QQv!GA1S@Un`Z-{Z5
z+D>PNvF7~fCAa7$px{4J?yR_yRo|=zS9&b}WYo`0Z@uB8zwl`K?6ymxe1x>z0bz%0
zbq%!%R|-#xj_$U4{o^Ffn|w~9CG{nkt~5Rl1e~znC7Cd1ct$xy1-oXr`Ach;bNDy}
z_9a`*R)vcZ{|MM*ol9o6R9w%ZYvaX%6ZYbe8#p}zR~`Ir|1|XA){8=#7p0U-_t-x#
z8Cfs!NG1LEhmcvRs@p(*&GEI_n(0VQB1R6oD<t2khfp*4He#s?Wh+w*H*^3=lvj9i
z;wNgqipO*hz=)UjO2g?3(y9*Db;Z#>za&E~X1}s$rjjo8>W77ji}a3Q(oDu84sZx|
z-!4#h+g#E6*NhD3M`dG>(V3t8MJpO(%IZ!GNJ0*%52>M;P1}|<Z!=VDm*vI#EyIFU
zi=)0|#Vbwng~#*mx1?t<q&VH-`iF~&#CqtN$)>F|=_!N480?%J^&1dEdl%Z{<+%>L
zKL!wrCdGhtKk}CqUw*dC0PC~WmX2r&uYEx(D~k$L`DbyrQh;3?z5QwEkInEKD<E@I
z=-N>c(z?L7iEyu7F>|A*I)-{`WK_|dJhP$b=ca(vq0P%VeR7HsX4AYAdILASAp)+3
z+IySaQl(Le^_J5jM(K>GKSfE5DD=cM(H!X#zItT4O<&z`$Bt`DehyTtUqiE^rUzQJ
z+1R>`ZTmBct`11mP=?ZjlBTJqDV=-k{n-(&RXZ+Ze-!-{8s=|^R`*Z`jg-N8+q_uB
ziG|9rI?Tsalwp0ft^Ge&w%m(ft$s=uOoeqzPEjE%!ktNcV|yV&@42_zPI4UyTP=D0
zhS5IFrSc?)Pm}?f8EPedctTU-;K2&zUsc!Z!(&RTtLw{i^iZv^sS90s_j-y%2bi-}
zfyr9z@5p8eGI++c@0s_p&kxlpk_StQ71hW+gh5(v$CVe;w5SLZ@_`gDy1$PJE!-g=
za*fEh-?8rWLfEoVwdL2J?a5YSj5bdxHrHvo-E1!yn7Ekr?c~qgIo_E!q9S4FNp`+k
zNi4dK`l+BEZT+sX4;23N52_FOqDNJm8-Jvh+(xaoya(vb?wnNmYfJ}Vc6;@dOr=H6
zXh5g8X)l@;KX`qK@~$3tQUkd_pj4?!=FL@yV)I;F?%qpxIO_7e>6Yow-)B`o|FU_Q
z%$BzcX&376J(1A>ZI`SDeg)>etStn)sB*nEgb<P%L%lC)@Va^|C1FUzF;-DR#Yh6b
zq$&v`DOKHOI!XUl9Yk`sp0l?mdKI#PwrQ_K#DqXuH^Nu5Zpdvt1KXA|`!R|>R(O_L
z_?n6Ew}jH94~xwlIyu@9n~V<6wYGJ8k_BI3<AK`WB(O>{(GGE}3*PjUnz>b}&wi2d
z!ndf>7B!-rYokNegxw~F&Kv(K-Q5-d<b0cQ{pZ_Bc>x@29fE><rxT%3DHBUVUd0xV
zZTJrBItKj~!HlX?8@Pa8cpG<DNaozoK!SJV&!4LOg?DF{$ftXvu_~>Um?4Xu1Ky7Y
zj`MgwSGJaASJ*gFGb<1%P^{j-s?^>uLS@*52Rz2fB*o3RG%uzQBlFzTq@~<1H>)4f
zrRi+MV!gJl2#BX3JRYu&b+HTT!f1iHmvNGt>m?U2XqDcO{yC&hner@qdTdc*2VGr*
z;`*4hR~n^O{R_Y0u$z|x`yDezwUe$c^U$v{0TK3Y$R(qo$Qvec8i*qY6`}kx<|s+y
zSj&*L^%oNVoQe2HW&q8waHZV4O7)h(OD>x=>R@t5bK@?AArc;<_J3`eOD)S!_I|K&
zQ2jVTTf9Oid^JKFGV<yNvOH4S0vwonRZn1&Td4vOkglezf<7V3K4?VwQmIqZ?Ab~%
zf%@n7KY_140ILXMo=;Dk4S-!X2{t!_rgbWSMNN%XA(<jW>&NDA&bUo7TgZ&!A!=0p
zO?{a#Q@S>Eq<msDu=sh~jPLx6`W$h_0#)O(7&9wnG|I!_S-VDc5b79ud{)8Tgrh0k
zQtwg@uX;o+B^h`9SwmDsob6}lTN-t%ufvRr0QrHBQ)`-$Bmuk`0?gELh}(xS3qN;r
z)Mv~QYGT^RMN7}or^QbruM8zE2%$;!{sXV4uyc$l0^`A&QLp9Mle*V*3Hq4~&^4Q5
z&{^Mz=*Fa59vjfi9xvl5oGECUwvoqaSoJOUl>Kqo0hGC|8>*&Xk!$jgQVpOfweb4+
zVt2<zKJg=bFrWig{7M7;#W2S*tzDk7Jq6`V*M=QYe!#tCDVYX@V+6HU=7S+3`0$no
zNr+M%@y~0xLjiw+@4uPU-*5Nl-^5P=%B)tEwF3DbyFiahkH2%M-sQE-mvyy}i@07?
z>#)h2{=95eAw`n3-}?)=&yfv-4;3V<L->F`mH};njPdpGHQ3NCs{9}33wd3sh+#-_
zTFBkB5p?w^+Ep>A2xS5apJs9+=cHi;gv?ZRum<OpR9|9ZR)NAZ$4)Ls)ZPoOs?KFh
z!{q#Cp!jG?9*od`4bdBi66U=_L>GTEd0)os`xgGj6D?&jC>xW|>|WTZJ_)qI0j6cr
zvK4@Vgjv<93}MRIN$)0L7Vryybt|VBPk+leL~rEi@-J98l=Qec7;05rVde1(oQ}PY
z$=9U8aU)a2Q2gY(diX)o6Zp&X-=%=pD8D!r9(Gg_IP?N|0LU3hk(8M;*3~s&FCz9A
z_@c~GDC<@f)C}5$2yH%%xrqi;W8~av^CnIIc*yK4P5+ZV=cB6)e8A&KYYf2I-{Y8a
z^EKB|XZ=qSWR3N-GFYP`JqZ@at@Np8t$bj1_wD6oV=l_?=EQk)h{=AB*t1HQAn%6|
z_kT=X|L=a7YXy_-6uJ+WQl1j!d1>!P33;nS4SWvqovEHLF}Xns(4##`Bk5=c2h~0K
zI`b-Ov5y1u`Q&Q!>fex|CagE8r;-uokkJEHNonrSG9t{)DHT+A=Dqi+^O<H&k;RWx
z%<9A_vam`A55}>@0#DQ!&A*rCLmc*3?`YKj`Jzy!#QTB{esQXf>A=#H*Zk4W3*ULc
z0*@f>yNrecfpW)c`Y9uSSF2PXtC4*@ud(#abi+6qgpE8HfZj{0_77u-(B!8qW);6p
z*jPs1uoh({qfGH{iLdKteFWobxEf1=3xas2oFQ_rRu-`$*}Pc|W{G?fO|Ch)YnY&_
zOoAF8t;wu=;^H05w<rZwy;yNNQGRX=`aQk)S>9YtSK(;*d~2GGYspoH?~41tV&a@)
zy!@?*Q<Mw9muxr?pg1C0$XH7`)J2J3@kDoAB6Z1T75Hyy$up*c_s?fUP4w_*UH0-I
zGL|&!9`P!DN_4%u?do^AwbWBtnY(lZ_EwxbU6^b4^zIRX_WP?cw0D{RE}g-@q5Hk%
zxdZvT%}-i==h=AXzTYmC<-jLdY4d$g6}Cj~y3d<(2#oEVdGTm>!>&!&PJE45``W!U
z<$n(DNrR=B#Gxj7SRDsy@iad&*?K&W%_4tnQ*)iC$S6n)t>mT;cS^5BO8oIQxSMZg
z>7sc1YWV*iNB(xh^SdQf!6s<JK8^~4+>V1lKuxQg9W|g^ti)Ybh40oAKj~vsj~cJ8
zdU{L&DX`ucMS!*QG2UPdnD)8sT~nAgxLr`rM_nXEn6FZYat%gVKfLHF(pGT{VPu(@
zH|rUVShzso_xvn?y%dy_>qclJH-STtT<skcn6EfRj^#@vW~sB*h13cTa!bK$TLX;k
z+z=%NCd9Yx;%&H?Zt<L+Igc89-Ej?lQb1yjyhvZ531vpxaDZ;*#hBCyo<g!4yz;k4
z2Y;J@K<69h?oSzL^hh&ZG+A5nD&!Gqa$=;^`~w;D-8y(Tea0XO2R@i~w~ls?f>Y!@
zOxJ;r=y{hf3`}Gb5||FBhplG)HPHH{)RZoFjh1+=LJ9M)=tc5gc8zm;?Osn^uUYIy
z9)o14AhtaFBbTmxxUG$@92$9gmUyzusbFpp)9KMYUFOh&&9W73d>>b)q7!KFVWF?t
z#&*xd?u+w>#Tca?%9b7Jr~p)%>%H*luxq0b)>fL|vyYz?6JnmBzmDbS;G7Af=9OlM
zXQ)w?5tWG&VyVl*W_(8xal~tE`N%zn%AG3&s!dXnyO#)EI=f&k*#BuO*N#%I9an;8
z#6o=(Xb(QBX01W}nMD3J{{QSSS%&Ihm#40r4czz4-7*69sq!Cqt8PQPdf7vR8Ym2%
zE=|Pqtn<4BnRsQs^&b3a7uaT`QFv>+Q_f^7m4d9efH=pDI*9652G4ue>)z^BAwk!N
z>zO^i>5IISH<A0mv&$WS%b$Laa~M6yG%8Uj)K?kZ*JF7X1~yDG*oPfoNufd`V7rpN
z0#5^dtoHllQiseA1_Pfc>iRa};IF?5-{@HhYuD4cjh@CZC2$(YyF=Da*dLw`VA$p7
zFdnaB*rQ3my(wEDw%I}0<>-ABsAswJzHG6=MB<q(@zB{o)ZLxADa0z5MR~ka9I;B6
zYQwHUmy2}@c@2b$4&uYq$qD4HMFXB#eEu%yyF2%W)LLzWaZAkxBo9j%TlA&&kzsOe
zOm}xp`D#AT(qG+m^FOS8!ygh4+q;?K%H~{YLOYTZ<JB>Bnqn?v$HgovkRLp1(iPQ6
zrh@DJ-sCRynQnR0dHib*WWEd*H4J4wwwb9JT1?7+OVm1LyGLWx8dskUozHo~3T7<3
zyk7L1TtM#{f(D!UP_>zhb2Ez`6)x;r{G!T|fL8Exg@(0-+M>TfQYS-411pBS`z~_R
z+C}Yn@SvFh=GFcroJvh9^>jggVK=jm<KZ%RJLp89|M!WgNtLce-5h3_+m}R*0-Fj2
z?3Kvapy6H4p;%J0BS|PDr~iO+hz03+{&Abpn?iW=_XeIFzZbQ*G%X*3aaV=nTw^wy
zBMiC)^E!9r?N!c`3aORmDi>RL)kA744X2vD4)|Aw7A_VJ7ELZ&oiY(#k`;Mp6}n$>
zQ3K&+2MNpO>lQ87+5|;2M=yB?qE>6g^HCetcvjU7**d(Mn0Qc<oj1LXCGMNGU8~gp
zaCbSCLa-6v<g$ftbhXxtAjvExPi2S({}l(9iS)Ahec5W_W-Ik3|N2>T#|RbWj|F)>
z<^?+;n(eym`E0Ax<~7iTHR%62mVSu80Oe7zp`gg#?1JC93%rcwon2z~+4fV37_<J4
zdFj=~?FMY)=9u<1AhxW$PQBDfy!KwJ;z@!<Ey_3+Gu(Vx!ZvQ=iT{bCPAKX3`DZx1
z+sRv(%6g8UF=toX1eRLQU20;@`$~2-%c=|aCfn#hMpkQ`kCv=>xws4dJ*a;(X(n_G
z>_idEzra-`wFfqUON2d?dv6^Te}>}BxPVtOM^1NqAp^j_1oe5Elx(NE^dcSI7pv!S
zVm7S3$8l1?23e_vFkxOWWR`*D<h<?{qKzoBtSV^6o`fk8TQ9m6_aN2VkswoH{R&ed
zek5z9fmm>>bxKx&Hg^epmrd+A)r>Jae5-qsv@I8kk+YUwJ^#si#w&WNLJ};*NMU(9
zLVf<l^CiP^)n=RmL2iRL%>A+P{hi@U{`=<p;LM<<yDGEHAe(7^)Zq!y?7Qe`2zzU9
zLzozN`JoxEndb>pL759)!cUl63LM)KIa=oJd%M{?`cuyICxhq>F6RqX_kagmU-Re6
zzws1ax}0)bN%nOg_WY3qyFCi|Sz*ldjO51|gUmqi=KmFgzjjC9q@yzu%-M4xEncth
zeT~3o9HPy_3{~wv5%5P{HqN<VPQwk1w%%E_v?E=P^C6g_u{Avj7Cv9oJ(pvxr7#F(
zbD|v9=>T<)>6z)8Uv#oOyflbssubJi4?+`JYa$yhKi!!w3(B~!vMF!*Eo||@(nfQb
zWNY*0f&v_X!&eN0c!nTWx8cK|3G8-gZ2>Kb<T!PApj2Qc@3bc<CwKjKq#{7N8SK3$
z54J~Jnd#%@B=W<i{^c3YIA<U626}hF=IwrcJB#{)po|SJ+ifD3(RjhcyPRV+iX7^g
zKR$HNj3T=d|4A%aG>;U_ym@5llhYCBiHyCaU{j2IksDGOje(vc0mCg3!`rG!K0ekY
zNAEyY1IS3(Uf<H?3@ub$gKDoA?7&nExjM>o36s23JlL}Ho=@{3uPVePzC{aJjd;G<
zhv0Dz|Ah@pAOAaWwZYCq2OEB&uX3057h0sjZ`yX$$C@X(%1G8u-c(_%;-E@Ks3`di
zWq9xX-qJJ+l$5A%&vp1X#TGh;s)R4_E%iZvOpdQj67iXhdh~p#|95ldfv(a9)h$-9
z<QR>@^W~^^6F0`>GTx8VHZ85y1BiOVxw|Q|I}RPn%>!W!N@SX}vV+zkZi&$#!qXF4
z`{=8<sI`hs9x{*hPH{t@`M%m5zWGyI`XJ0#-XZ(;%{LhOO<P7SS}qvr-}ZlRg4o-l
zjSrPH)PuN23lOFaH7VOtK8aPx`f5X>-tbL4wo-0X*mEn(Wc~}RTx>RRq|AMG6=BqM
zQ+<Vy3F1KUD-XmUc5dXx#lNuUtei3d`$uQDn8fL~>qRZwkF#@Q<vtADUZc^+_g|G!
z4eK~*bYYva=t>&JaIEC=$mBoT<mbOAJ+tLud+|0*qtUVn-)#(-o70UEO*w-Kc(>px
zYi=jMQ5X}OX@ToPwUWOILy?{{8Xya|>-k%fpgD681lk=P+*8{+HC<^A0I?#jvH}Vc
zlNIN+76QX=B08?=*gBLJG!fAw|7mK-X}C_s#;Q!rh1EGUf3wmbVFS#Cwy<=(VfnN@
zdaiV3l`Ph~%PH#}akKR9LH5k_%;(_t-nMypv|h4ZSLZf-I*61M^`c!@X|l}i`jA_{
z3V_cqu*yfL*02uv9+J>1MW~CHD^V&;qc^&2Ndej5T7qQOavBc*Tn6iqVQg|~z$EZB
zH?9#+DL<?!WTIL5cKUv6rEExTiQe!^<?%qKLEmxe+}+P5)0Wu<rtb@yp1YjgoSA7M
zNyx@|>-xM9gC)g)P1nodBf2BDACn-pEqwJ!FYBe51P&iGLmZop?`-0u9}0nGiFqo8
z^xS1<L4n)O8UW%U?|&^B=B-eRROp9;B)2CcH0>4Nx95Pe=+6f9WMTCu_RR*dvf`Ax
zKy3dbdlU*|{lbtxjphEL@%^XB_WTY=!b#rY&dWFOTryk#E)zPo?V53AT+PTi=ejt(
zx;A<ELz@P<Uc(&JQ59r6-xAOV9>K1PwI8cfmbcEb@a#HK<P-%hkYs6tqcpdoIoDE#
zTW~kY5lxXM9ZL&5aFQPL+7jxuP3rQ|`P{qn`S@#2QQq{eWBggg(AV~V828Mro_lTS
z+~qVBgh+l9fg(dA*N^R6cCQ$(?|b`;H^wbe%VK&cMT-op=toNwI9s&$Q1=X`V}TFw
zteqm^ia2+z<!rzVL~mjoKlt*ml0tEVH_H8q^ZlLN%m6{1mev*>;jwz-d)x)}g$1_p
zC7)*e6_f6Q*f4Yat;#{;FN2f0^b?ofWm-7<e}RCCMz&lb0o+x>RxtuEt}K&4XWhdu
z-UsDt-dyUB1Y}gXUeRHa7LjQKPrY@a{rCq``K>CxdJnZYIegN%yMO+S#lrCqvlw<d
zi6-e;KV{xHHHt$$0!L$N72d4GrO<>n3hT)ni~Ik@)Ca83j-LyDhs!>y3ZL>UcR_8I
zB=~Bsle6m!AS|f=4qxC$zl_5NGfwMZiD01@V^j&m1u?Y6S*BHs&nOr(^K-|r7kVE#
zNonwCMW;y4XrKt>5rH0Iub~}Y?Ok@0M%|(`5Xf-?K>`Mjb-tHYD1|&Pcw$`5lUp%A
zgU-*LS8o2uGUpM*(*F3mGV*`$p|(tRLGJDo3WLbeGd7js-cQmBHHq52?`X+baO?H7
zEtDAuYp9<wI!}3JMG5G6-<5ESAMX@N<kpR2UdB7|GCi2728lv2wG%|%j8pkQ_7lPn
z<}q{qQE9~V<wNT_Gu9o>IYXf50*nQ=i)D5G<*9GlyPwMps{cHg_@4sqQYP<SW%9EZ
zliYuDUWx;#m0?!{g(C-iQ=dhTKPPy$M)KYv<XhVNF{kC$-_^>Bqqxg@Q=sf}baEz?
z2`1vxMj6lYpYdNBuD&#T57!VmG|G?v9?5*~gL+Gh2ghroYTANk+Q4%Aa74skcEeps
zdJKWA$wE`SPqVY%Q13%k;a2;>n>QRU%)eyyv|T*m-AaFFEyplry0?D5AK~X&k`>z>
z+6wrNkZsNiG=}ZsKqGFKSNyyE4Kej?ElX7`88!Axg{*hvvv1OHA?<_Up4NgpyBKd8
zCD>)~1p;YS#}e8DO)zi|QII!|T!1bOpmV5jfd2K$4>!MSd3mD-*3QT1gPK_d`_LPV
z{inM-7rPf?$htU4?G$6n63M1!!UiOJG9#Mowskmla%==tZp?Q^+;8~d9-wtjK4&t7
z{*zt)M8m(k@biBFf?^%gA;~TJ*9xAufj<r9$&QgdFw;`oCQo#NkJtR6xA2U&9qeB6
zl;}MS7=jeY`ssYkr*Si;>c>;C>CFJWm1<ERfzT4hAsxFj43#pnQm%GA;r<2|<D6^k
z2aByg%DA%3Rlr$)sAPa0f#T!;FYN&YB$sQ0f~kvZ8!WY{+KW|94cx?ua>!Wd%XvcN
zWGdL$fFP%?31&nd>Fbv7OhR8~IZkc?rHu~alxCEP<|iLmbR|d75^5WfFLC-rGvw-7
z^yA!v)QBW)t)uoI%m}$jx+q49su-&Lo}?znrJh1tPk~WMN3fIC|JDcrB7l8#-wFCI
z$c>iuJYa{G!$QxZs7QtG?zC?4@$u*6+_<?bYaN*<x`Y{*po_x2mRp|rUtZUva)CNr
zR{?x$H*1er|7Z59qRWwC9}MOR?Dja+lZB($h4695{7_CMF74cCPLFbmM+|6j`Pv+I
zcKN7C>8OygbSO6iwRlDPxhnaPTDAQzR@6EE)xy}Wnb(#wD@x=qIPSlpZQ>b7wIzZ%
zTHJrazqf&7mu*9j-!4|Z57;QU=GjjBB4kP6Pcq|3rsH1rY)5$p!VgbJT$&Z5DZ$C8
z%r3TjPQA&j#avg;X7_>htj<A(B+Jr?wT-5DWzFX!Ix3^d`CA9jq~!d90o81jZV_WM
zaI#EdA~A({GrGh3%UHN*$e&yoj1(vj2f$Zi*l8E26D(q%j&p0Y|BcB4N(2E{G`Gv;
zj$&O3;8hpKQWpm{Cp~gGSVg~<c&kQy2!Cs=5h?Pgdi%dvvkw8K9x@qItSj%3VE;(z
z+Cxx%J2$a+RmZr+MwU_hs4!MqS;>rBKmQ%S|M69)Zl9l<o!gUrA+<)nJ2TdD<J)Sz
z`vGMPqpCT-YtT)BZX`Es^1zo`OP$sfXuy21KaNCB7r4txT)W7;969km#Ixfl9HB*L
zb*!6p6KJTp(qMpylTZwl2&*Bz&wppLJNAKSz3WcQ6A<yia-@wVuOn-wwL&Cv2Cih;
zvyQOd%g)t+U1J~a<9_ST-#Ay%^{LV0e_ujrQ`dtsx>pHtoa<&Sf+J@g>uwTK-)KyE
z_A+OOQdHnrbDw8R5h-r7VW`H;SXATY!beWp(ifjyV^s#MJJ*r|dJZD=uNm#%4o+0l
z<cOI_{FpzU1aM5BEwv0-6aj?3<&86zc9@)xdH{|&sa(D5+l7$Y3tJ5T#MaU`p|vr4
zhqtPn%F|T-2$Naj4c{scTgbv}jmRzu=4cO%V7Jm0Dl`zf!09FRZ!VW#dhr$RiVe3o
zFNIoY9Gt%2|D1C!N3giOoTL=!xETE2zQyJ%h2l2=uY<6&!`WpS9dk!IJ@%_It`hw|
zx`fpBYyB<HnPwNz@1Mg>jqrMQ7ILI=^mq|qG}9Fhv)Jr1>5KE_D7xIbyH>w1r;`yg
z_C|cL=Q;M_w1GN$p@dC$t@5F>KI$B4S{|5<ijiYxcF+x%$DP7nHFF3!A3Y06FU?#$
zhPQ^{BNmo5!y)1;zQ(4tg@8c*Hlp*<YPCNg3DCm7)Z*=C*#+`#Q~w1^SQQWhjN2O$
z;lW+wqv6^qc5b-jN6%i4_kK=QP=PO8m67zG#gA4?g6uO=viKF+IS3h;hiJBWYMIy9
zPz56^r0K9;8quuTz_U!@{pL-qdx2)uHMF$2*WmbYfZ}R4^(3R&qtLi*G={8(8|Eqi
zw<)nW@>)S`j_zML7m#4*CiAv{d}n+Ju#=3|Vd&~LC!8szfm*ZTci_`}>;@RRFOT`0
zm|O2M5W1+iG>GrtjEj7b#y8+BdfCauVZ_jTP0TC4+1rvIOdt#L_`$qMYFEA;y9T}J
z0<_76eBVP;o;t1b?)U5Nsx-VzY6;B2z)yEaau;wl??vrP0E}?GBhlAt6y;U>P9c5l
z`6g~lO#io?<H;6)*%l8ghW^SY$18_kBv6H^1GyX}wc~BtKnMg@8A&V*@y~+HpB|Pd
z(RorRzfjL+^0hVcwtr(!Y=ko_J~noqIXDPq+CO5Sc6bSLhC-7<2b5ut_85Cd)P~Nd
zKs=t`8)xT}g5vVcQWQuc{_&8omLT<d03Ej;d46HH6B8y(?A)x*W{GprXPw~oH|@wi
z?Lzm_GY8bSUU4{5KfL5iJ@#`Z2-AI*Uje^54)tKI?slk=ut9?2AO)X@$21W-#`YB1
zdv&Z6_`bBRDqx|<kp*<gImRqQL>MjVVO^+4<J=bl$9XOE9$q3_F(WvPo)Lp`v1gP3
zlS}=><Z}=5ISMl(vlW875X2|Ra@qNwZ@yG=_r(f>BSV4OrgN{}wtWLzaAg8T3Ka8-
zE!y2+@7#tp^=~EWWuI13XNoI2rq>~!OEv`R&)()%txqFapvo2MjfegQ>3qc(YpM}z
zx<71q&?h9Pf3s3(jsp~(Fs<}wdiZd=RJ(ErS<-l+^?A%yao7Dg&8#(^r2-4Tyldz`
zD_8-ZV}SqtLy!YLZP>V&isecdkumDbKX@hrw6@vI+uK3F3!tB_3$Xi=z)F;D%f2R1
zXOc2<_KgnJJrq4-!dBB-3g1JKLse!1rAG@WJtJi^V>;bC;KRdA&0?MI6ppVS%#^H%
zp}3*y>dVC{SZ1wY^HDAM^a?0c32lGZj+8P_E_oVi?9}n{Ehw@xogGjP5gaxax5CD@
zEWOACY%GzXJK>7+3|8qSCFJjytd)`M*M!!QqVo3vo;CZtS496<SOnk1LkZ<F0ntgm
zx=fp7aOD0N;$CeUA+--oY~2F5fC5H#g|Rg{#l7!2HqK6&>zzHQUUN8`W8hC>B!j1m
zQrghYR}hYYgzyJ8WSP&W61U!nC+a}<HLvO3Hy{!l1Vxcf0mbom$cT>E?CqHM&C2c9
ze;1jrw(htIqFO}jg&~B4?%tB9g%I8T%?5%&bujkt{cS5bZ_BmS0pI~fC3Pp=n?7D~
zkl+&!Rg?!&o%LV$=;E!^0Y30QZns?7oI)r5O}jYQ(_st%)-peI5WqiP<#!2E8OeMB
z@bVI*e{)G$-1+y{mabKM9E=L2a(V+d8Z=`_am*)Z<9hhO$>ll=xGzSsVU2HAvF{eI
zs`^DWIK*WO4YWw&`D)Vm5Dv`fI4TvKgnl-sZRb`GSrJ}<UcOFF8TwiHx?)m-saVWQ
zN+-~$enqug=J;IW<h_uTB!+t&JAy6w2h<@A1H`ar@EL(yeO@_p8c48HQ8W3U_4cOu
zyg)wx*O;6ZLRQX=nyL1lgOd^d*_l^6BmX55gof5qq}89dt`sZ=JPSTTx!XU4hiGN-
z&2Q;#5Hk#uW`g@v`qhpOs7;4~Rl1BJU40XfuMfGJ$d_Mt|E9MBZXwhjv`Myut2P2X
zq~#X&)*bD8z^VP4>H4#mlzndlE`5KP6qczf(%bM@)f4pSH{y?RW!2l-{OdQJbDZ)}
zP7unF*BIacxUB8}Hvn(?6@ZVaTX}#=fPescEidLq7zDO9Al0fulW_^iG3dLJXS<G%
zmM7GS(a22cfWFgCl(H15Qy;@#IB?XOX-q@l4GVzS9I{}*Q<m5XZeh`hzae_Ko?CJP
z;mz|jJ?jm%iUqpiQr>4Rkkhj3&ra?h>fi&Pz}y3Lyw*|Oo|$$c{jv7+5B*5YP*+gJ
zP}Z5hr1vbG=YEOLnSv)AZf0pcRIn;MYUkfGqZ%=nSkQ0UDGJ^#(fuCibdVlc(;E!^
zmu2SVArjI$|K$3d5%U~5&tv>WO)ibg$5xxD9X6VgS7D+E)9!65l}2>KI0s5exK(!A
zh4yEtFqA<NU0(2~g!ev2*dT$brU~Sp?3BqcV@sD$YasKb&^xPuft`SXtBt!ZrMQ3G
zTWYf?hu(bb%@Rz^Vmh*seW&J{!o-Pa+4a*9_O817J7<EfGzMNNz+@THbW=v%L6T4A
z0N<wZ)%ZS9rd_+D-G-&}I!mgI1))kemA{?g-EhTFf|6K_vQvi-=n<oIL`PQrY6^L^
z`VY;*fBn#ak~sCxMt_4%_5}w^a1?`w#iG7q77xRd*Zg;adCHmt%6h3UxH~=t3<;gL
zsR2*IbIG0fDt;0?Gja?Ih*fAWy*;Cl(;Ohal!GlyeD?xQl!XaUJ-Q`wf#Ar}?IsJ%
zXBFYtQh01Su|F&m6#9w>*a~CC?wF}YtwKFClHAUI)IrNoLy<{dAP0LqE*_~9_t3-J
zfCG(Sp}0Jo^==JaD+YxLt*x!Mb-TyKZFf#<GU8rOoxk;=Ix*yO`!_xUe2;Cs?SyM3
z{ZM8g`k*m%M9^yIH^}Q6_m>Ka#*vHAC2Z2ta-j!*M|O{#sypM=A<DS;+JB|^GxyN8
z6pR$v5!p_3oXi{}AI2~o3kJembflQ+o$oPgJA*=NZBZ*UJIdsezm~aUUF3yH!_Bzt
zZ+S2m)#(%0d%Z59$0=Xd9lmU0E5lh5&~fxV<ut0RG`Fn6Z&;!rHK7PI%gtKL-FL$T
z$i)2~LpzmM@QENm3RsUp92!8Q-a=vxl;R8)FvA0j!D*x$fKVqvW^D!iFR4si6)f7o
zvV~7LgiPpF4o$TGT|I$^dQLqN*e8o6?CDxn)F--Fv{55I=)di2X=``@zTsG~^1c^;
zyW}r#?l^@mPo-B`dBBL~GGDSm$G=yVbg#{t8BvlYI^V>&^%Xia4gn8xGRX~ih5ud#
z86FSv9!Q7ALl0$oYi3d#juoD08`)Vx(JH5fSEB1lLCl9xg<i;9821<!#teH%E}vs{
zGr#u@C><XDRXUu?z98Mnl*kdU_(po@bX#jWNOP!EU}Trp_y3|7bPyu|-Zi~rMYS{l
z3jc6u?czm3M#Zp^fy+hT=J&M02OK639*MB2$5h;@Yu-JAb02w|a?h=j8i`0vVh7CT
z&+<>hBBoLl^lj`h<@KG`6`UT8D9s^VDME4TnCw(~q1H-!EwfO-nTQXq-EsHF%em6T
zw8|B?Z2a?ba?Ab?E@v>bc8$x3RW+5*H>P<^EP4^AuJ7_~u%M+Pf^h*;Z_F8r0mE8t
zR_rpk$S9O+tb@885QepHyn*}mM}-yab|?dDg+IMq;<6-JFqSoojZ-c9KG5^0Fvl5}
z3S(4tgy-yV7;j#U4}ABDtbIUvSaJ2=j(9O!Eu-j3akN8~6K7WJv9^Q>CtYM=aIXts
zl1UzY<)AsnPPaWNb9E95@;qpIU3F@Uuo3JdGO_4-c!shSdW45FGyE!bjZvF?TZ)Z2
zm~L_UnuCd%+@oq{(d{{Oe>uSs|B>Lvb?1ETP>pSaAjNqvH%m71m=y*4%pZQ`56Dn*
z;)<HM$lKcH1~~Q0@@EUTWMnf(*l(V}-G>ru857sxT>~FQHS859?v;dR)-dnkzc$%`
zDJIq~6oGto6g=_EKU<L%f4q`-JSK7(%4j1PvP5FltID8`Dn4-1LeDhW#@!*eFi;Uk
zXN8T^mNieXXyq}g@9f-^dH)iZPNlbZ>z}I=&73qCs|wV*EcThWh$s#C?@KzTX21xj
zLP{$gTtS}kn|xHUP~ZnsuT+#3H)qt-zUlkcNypMY5S<AhaWl#LaT7Nos4wV+`ciD`
zY#_?;G`zx}73;Vra+WdcN1O52!T%19*JOrA4V^2>j?+eHqu`jUq-YA@zOr_%gu==n
z1Ku?~L@H8?c!dp9dgY(i9*yVyyOiQIObu%Nqv|5_@~8gO%+B@y<C&etdGHwT{L~*Z
znZ{Y%+vk3wfx`Q9hwT@gop9fbWj;C=$)>~6?B9HuUBgZH_=!fMxw%c1VT*VF<mf-%
z!xRv*L0r>YDm`7o_+}6!X^#nRcY0>#0~O<^^{N<3yyYoZSLT7C80eDY8bG_;t3K+A
zCL}>L#&um&bMq&^ZiXT&BoKM2*uy5!5#1+qyCyz#z6ZU-%SBh>CfwG|zqNC_f8(#_
zkOIiORIeBBO<VeMx67)r(h1Ekm59##7u$YuW8R0yrO))@p2p5Rl}QO?p<~sF`e&`1
zo(sQlEq%3lAa&wt%zINxm;hJdSoIgxc*sHfa}lP6*ElL%fUtA}cuXZ3-~6(6Lj@ll
z{h_)93uaMzCJ%rr+$C-tx;UoNBqW-9ZdSIy>1Va^5)OnGB;{rXESIX<2qX9bNq`tr
zwQHFrmL%-`hM=?PdIGY8<keJ(;S@#@ll`7Jd;<;U{2WrS%rNxF4m{TpFI2q;_o&dC
zjup0EwfcWJ`x1C4*Y^KPrPWlD$}(+oqD-aiX4)m;v`A$ck+j&2b(qO%5yC-|EK>=U
zY}waQwvctQ8)F}1Fc^&4|M#Fyb<TNz@B9Ds`4k#6&-2{Zb=}wU{eJJrdW?)xovU?2
z+k8W_Ror_T44j|!t}Rr#JU{&gafU!ri<Cy6jT<z3Gw<j>HEaiuc2~*co)nSyXq8JV
z``x)(I(zP%`)|9+FzoyC*j>e-hvc>5@DNv|7&f~Mzj?<0@+ZWsFn@*JP+0)@vYi5r
zF;d4#;N@4QB4^Z_a)2+N_Wy2ML*Q`GLho7$kF|H|u;gQ`_SgjBBgw!@!jVNWB2sFt
z%+NPN^8YAhG2&ZXW=t8(Clx-c#qss>?0fQs*rxOhi(6hcNx^-mh<+E=O4K=;)JR%Q
z8Eb^^4#cMGxKt`QeF#)Z#)YLfw=ULv?Za7s6W&My=^JDXGvesn&A(_{I%h=B&Sg*P
z5hd*M_u-mYd}csJV_y)CcFfpF{Yjv-`+3(c;lHmXAjPj&ahmB6s;tq9@pR7{ekZRk
z`)C4pTf!<uA;|r2bwb77k$ZDlw-~Xi@^p`J?po<4C8f9j@X}Kq!V0musS*H<BI0~`
zy9sCwf>SXU%$@=)NMum?BV;Nhk}m(ddM#OE7&YnIVS5G`Upp{9eQW0frtVYPl<}V9
zM0e;vwYcN8%<fS0DQSwNG3oIS)y<8BWVlkx#EUVV*$Z2djs?s>a!&w5qavuS<NnN3
zgDxjIx!%!9^rLBYzUh4k9L@9!7UVStd9(?_jJN|5FWYe!6NDiJx*s7lM?aL-FB=@Q
z$3YhQlDJ}z<W}Re&UU-XrAk>h6RWKbV~1bX=*g-FVn@({sG`}5f?otw=N8AzW2u5^
z!IL6pQaVvc8bp<7H&*%QRrk{x3M%}g>`<2b>VRE>tulB-QWU+}29oo5@RKcQ(cJT@
zZ}|P*1QrpXISb+6dc~gyZUCIU$ujR;YN%gLkH-&*>gex!8*8JPosl-??63<#B1Z~_
zTN}LH73VMi=kWtUW;}pkwOquFIFTr!YWwx;#NL*sFAk^b%A9WX&MM~%`u@3i{Rw?u
zC4wot5JkKP1SP5PL-v>XH><Z^5)QHvwEJ<`*bP%Vy=X96{k(vV{_*3AjaRIZQNrcq
zId!=Q2$$)qfzzH;&H6V9@RW7iXG?gT?WcQl5P`EjTH(iar!EWul*$L``w1T|xU^qa
z7eq|ynLTN$JN{U3!%gchBh{bDk4X-3PB&8a4jR^~(Q{jVFY?aO#L?o6=ip4cjZ#3H
z<niYPH0clH+~V`=H=hA$7VG3dQC+333!KY`yHuX^(KPgc463_vwu@vqsBxl4EQ<O#
zC?o*yIDKeL#^V9qxG>Zf;BM2P>~#z+vgWuvCKHM`N7!UQeQR_Mds1%9ndsB#c{7PV
z8dnsV1bS}L`FiL=znY_$=0T-D4gA0O966lEM1v${$DV!hw}SX8F;!<r<O}X_9NJs&
z@yBu69G|&n;={2gOMwmaAYLwK?XzjPmt|~q`6)Fn9i>#@U8`pT5p<jIUel)+U>u8<
z1ndL__|5!-PGcJfOh5kqAV{*Q!brNqfOOV>pkd4gTu^}G7V-Hk`NvDr(R=Z{)sr|8
zpaK7ito*Iq{S~ppP2Y}F$rB1Id05^v{xM;5$^df8Y7?t^ZkBRJFfZKaVB~r0hUbI;
zD^{utD)cDV&Wma8mBNRJ(t`P4vE%xjy@u9Zlz`X662ChzoU0QGP0I$iz5AyCe%$Q0
zG*v@ug?L~rO~g1l8LCO`c7u;7b}VAQab3qc&<?lXQX{i>CDe21wp)pPwIF^A0(s*_
z{>@?M!_kpc5WJyz_%(U3G}Vo|-@&}^Q>5Ns?0j34b|pFm?Ub5FL=75P+j_762Fd*)
z#9WqJa@@D3BBhJxZ%WugqZnAb6nw0@=GNVSJQ}8%>T{*N#Iu4)fp^8qA8b@rQ`U*L
zK!Ticx;I5-m&m~D&X@S5$7Lz~!<5$mZ?v@tHSdJgdS;-SREQszaB&6%i+hBOmc&-c
z>;L33o+~bjM&gx0MV9hKadZM&A@QDbUs#%xl;F&{ro@};K@If!!=xZ~oB50ifw4e&
zqFwtn`8|dlKcp@x1>h(XEqTtMJH_H|kBR*jnYNxb^BVnKw=CMtNwIxc0u8o`S`V>E
ziJONMzRe*1dJa#Y3+yuwoLWqI%vfXS=ht`2NLj>^J9NeZOqe*!<?WV*-vlit{6PWO
zC-F8k(Swx8>m=fHo`(iMlyiG%azY0R48kdA(xHQU4@tj+DfGk;T}+<WO((V%d@YHv
z6%h;t%-U9*C>xCL3iqqg^*We5uXXa{<osz^@$cqN$*tD^I8c9)1b`;l)0MflbIDEE
zE@1on1;y;n6xPEV&P8LoZ--q75r%2*GBu65f71ymUa}IzCs%nTeXD{5!!4B)GfE0R
z;-=^=6_&6OOIdUT4JaU1pi!3B)lMe3H13%JpudW#-UP7J0q^SdttcbIl=r2B%S4pa
z4$n`!(K74AA|d@!u(H}RAM>N6uUC-S8d;Ga!Gjh`{<ac-J?3@KAl@%a2hWrZrj-Zx
zp10a>+Rw3g+}DHLV1|vYaBr))-60IxOtBdL%hicVt7GtF<hpgxr;2d5<Z7ldMTr>S
z5n7fc7$kju^=%QsAPKB<a%+?YCa~+C&Gg#B%OEf+QRggP*Ugu#q)bqT#b-=p1fbkL
zS+vfpkNx<}<Mn|fGG|W>z%XShzh}^;U|X@0)zbmVXEzzYng)ySys-Eog2lJV49YTf
z?a0l?IJ}+J4CMRDS8p~PGD@Eg7z3CiMUB8C+0T=V(%s>5O8VF}4eRGo4$roDziHJ-
z7agG&CmN<PJw5upwHgOo@G%Nl79+t5&YkqyU_Ce%iDOQq>I$)!OgpEu<JGY<%ZUAh
zP6<%$1Zm!FkA4XwO1XH^Hk<c{>C#ud3`p*KlcL+t3X1@aBrjav$V*;f9@z5z?#x(A
zA8v@07mG~5p3?fqslS;EFsZu0q@DBDvfo)yY{`qczO%EwM5cB<erKy3&Aeh@-KFLV
zH+fTUtnR5IWol$U+U*31&nNLdqOx+brp4p4d7t)C{HmOl++8-de57hdCFk_odvq7M
z#z8!XsRQri>0U*-t~f|1Bd{QOoBgiB85;!7_NM6FkC8SbogWcgL(1oUuFlDJR6g62
zHKV9-XCyOk|IbOBH&YaBXmHH*43hP{7RckC59wQbNu)$5h<E1ph_~jKM(IKIT7AZZ
zw8{EEYa4Q}3`?@jkt2!X*s|>oH@_m+ya+`(PNUA7(>WEJqZhbDzAFJl09lm}9a29b
z$h=#fms9oOQ#U0G38u~?L&coyiev&8@94_vw}@rHKR9@?bg%;{apK$oDnU$G%T6&p
zPF(sdt%!P$65P8~0;Xr@MW`7CSSkIg<YgCk%R{*-x#o1OEO{jaH48;fjA=<~^&I9g
z;u&7OiOd!HHNG_n0C{^l0Keqfhj=ZI9X}i`WIS7f&?P4mE7C@O5lTr#309OXuT*Eo
zv3l?D_QeRNFQBi-V1pTO;V1{10bLyP5jK0$&8v2@3OZ4|b498!FZHoU@!W|0Fi~OU
zI8BqC4bbD#Ken)M1_5jzd$7w|P6?-v^CS}~yc(i({b5Qbe|9b9p)4(nxUq#HtAvaY
zjU;uxDjnqANjce=_{no@>V_J-v<EeEt0GUkrp$Ij<ei?;J7w)OZaS)rAJGW37!@fT
zBuCF<lEDo??dMvn@dvO^6u1<;PB=GKz0n)b;KwT>Cd6l)rPY54Ss6GG4e1jBn!K_U
zW+2q0D(>^et5*xp=oGF(#UR*Ld^AHCQ(`w;)5YCQuI=yN&lO<_2yg7Edjh(42OQr-
zdv+49WA4PR*h^eIw?nU54<Hq`<J=gH!;yY9-~?8AT(~Kp!Mm#VAu}vXAx1xlla0{E
z70?K8Bk7zeqsC}E&z>W_qh}qaWred<(wLv=b~-8S;J!VY=UzIG`(>m#y#8Qsf61J_
zEr{|(^J$DHb#>!Q{)dhR-ci;}We1_zHuB264C?p%BlYXTBEqJl^HqPg@;Tr2w%oNX
z&3y~*9eQpbxO`RMl|FLqPg0^F_{GgkCu3&am9K?c46>2dh)PxjNI5<m1d}el_46G2
zIOUy<-LF~iK3sP?o5Ung+B4yzIreZHcwU4aj(0<iUdnvp^ok&6Xc}5Xi;!&;6J}>g
zOiXk})S!m(nosl)X<;JJA`PjIoZTj_=CR=_g*xW+2tq=3s9wtHia?Vt)skGr1Oju1
z=(N45ONMbXcGwY@iJEE+?s8X?h|*6`u6tdgrPSCUe_qX%6+G2#Sah}Pf?9~JTdh-L
zrWS+&y-lw3YAKr7nWE!b&|ezZfvaXX!tETG7XsJXODLzg)4zrjDz%Ct-1{RDoUf>o
z^dgwe*NZI*?~daTo*Dh2IMQ4GjG4z&TDp5($*n##F4WeoeSdasng00u>`A&xVdhh%
zgS02Kac>x>C4)KIyEW)FH5m^#$>(;S*L#haj)NueCoaeTY15NO>v-U5#U7<9SdYD%
zuugV@8bwn4AQ%-XUMXHj7|tuJef1J+i*e7J{e%yx<rj7|HcLyh>mBy~*hT@1c2iTZ
zwe=a+IcvPZhcxc$)1ILPka`TCG>=TYxpW)QUJNpVPCf>*B{3omQhDiqdFeRPN{TSo
z3}G2JtKH`V8j+9GHKnG#>{A^Xuk#vjm^^LmWNp_`p3CV|&&(mOx-n!O-OdGsd`AT<
z6jGCC?xbgpags?>O~~hcM0dr&S@sS+`noAz9d&UMj=gqO)d+qtBOZbsqn3SnL^<tI
zd8g}7%<Ps}xeYj7?6?u%l{F-OYLxwTDmI1rcFGXvus5!#zx(1_5T{7k{e?6O$WyWj
z_L>J3))|ug**6`}&>z#o$;s_>4WCx9p({eqGCGY$oOY2a>g-5bX&8BK0;EurOGVT`
zTX4aqli~QtG5*(?H2<a!f-b@V?LmRqmX6fgkTUHGhMFjWMky&o4D}99&y_n|p+-$9
z9GIre;4z@tY9bn`k5%>RHpK4K{5@%TbdY_YO^QxR!L9u-J?KvOm@(#O+(4$jE`ldY
z!olh4P?|x17o3_2W4%SOlSnOv4}EddgI0uST0x3a6q)2=q{eSR6U60P+%0afs%Tt~
zJhBvC6D6fwxPy)v+fO54Cnr#KcovuQ_1%S{1Z9pj>!s*n-?pY2f2JMR2Q|RJ-!Q9r
zz@JT^bT$e3FBFL1tFHI^1xCR0s|i2&jMHK7dN4>BFuRTiA1X$8sEpryqnUaEb0!;o
ztPDCUgzbhLHM=rxc7=AQ4F@7R=)*X8R5@HVcY5@#4>MN)UMzYPhICgT{hpYWoAN|`
zb@;>PmVH6ogmla~u}D%h*jF0eF?D*boJNwiL`T>&eIh@3s!0EY<75x2zp9$hX3Wf1
zo|ZjU(U>&lgP)n1vV%Tm8oyvvMR7XcZZ0Ssxsn~1Z#rGjUOMQ6ok^Rj=C>qdD;L3K
z_uxI$wV9r*es!82!*0-E=R18ya<+#F*bm+D`kUC(x;{?JDAoAsCR7$|3&RJ=csdm#
zQGPm#c-)+xD-4gpFu8b=s?*_>9u=j7s}mZ9$2|Bhher$8tP6xp2{K_Pgc0*`ZFUj7
zaOPy;35xKfBKrs<!iHp>M!GPGi7e!rKB3VoSYzoG$*ooeRzxha!>Xz#cyg<<4<SUo
z1<O<>><lW)<3#Zs^j^~vH43N4X$kpV^og+^KdX$1=#)XPJpaa^q6r&H3fwE|V0BQO
zEPikq<#(F>z)@Z=;xu`zP}5{Hd0ioa^-G1A`dSd7gY2w>By_<?yG7l~>(dT|Y9uC+
zl|7;qReJ8#y>S?~%!atkf&0UWDMV!E4ssWUUkbs0^oy^yM9fVXBw&wJ3~daLLw6~`
zC`aNu=EJ$30Q2gceaTBmAuG`ces5Y<AGk4nH37j9&VC(xa$jdsQU-Gznn2<Pup4)F
z_!hQwP39Tv=A<kcj}Rt6G4Arj@%N&)`YJmri^TO45VO;+2|>JD5m6p}`kle1%zL@4
z$(cjXo_OvuZ1p;xoN9E@xt7ch)lYz6d#yc~61Mw76WAg56v#)Uzi9#Fi$&`59rD;x
zP;JXqV?9%SSpGhWPt2w*Z@heK!dBIlQK+H!*)vpQ@?pw=9Vee69AnyfAz6WYhjtd~
zWv|{g!!ja7BiMgLwdYrVbsd#JOy;2~bXYkCE}E`#vPyVYnr{s<k0C`lj@zScj3(&E
zw{*=!8E2}+IU(77Q!woG&JM9ZQ}k2t^d?H_Rrf~edyc$_>>{<o$&)RvV^(x0zJBr`
zM>bka%Q1|SJ!KdX(|?6QG<2xnSy#A^IN?WjPM+{*6v=Z3t#<5zr=WS&jZ!c+uQsoa
z->lx~ga5s&#oshk^gV99Z@(3R#;sCsOvnm-#+FyJ<B{2ons|EKWPA)pCyyQg>zv+V
z;?R=b*pA=pnmZeb(<KLbs%SFf`0tI!`xvhkX*`nJ160*A-Y<pyWdlJy4G?Imfx-d(
zV;rVodGPhB2eV*AG%R%=`*;Roe9CF1&L?4L-c|vv1;YD?c*x!H^iUJxxrd1^d5{JA
zVLoFp-!UC)k#mH3<Y@g8u>I$5bRajCj_x+RksL|mxNS&uZB^((y;rX_ZLZTubN8`A
zmF!E=OW{&mXsIVj?`rDe)k*G1tD}dH&d{MAXx6w(BV89ke>&A@rPX+w#G6QisjAp?
zMvZwA(g{A;9wNoRgKFndCPj&>8<o*b_!|B~!@=AscrQ0AYOj=da0f{E(T+{SA70Q8
ztDc)(OFYq2l(ZZ%W5VtUuzF3#l1|B9(NJn{R}0|{>mZ|)96wE*@U3CaGCDK8bg6YZ
zcDx52j>kOg)S^S5@XK669I?{_ywbtj&O={azr1uVJPyIM_grC+3^V_jIWjPiK#J;O
zm5aNEJomrHptWE}ja1LEl1G=0m(+19QDpfTMf-i49q%snOSisPcbdg_M#iA1{1`Ir
zY!HqUF-4q;o_gKFIikjykRUYU-R)R2kbbKhzf{$i-RHX>3O??Ghomp=I!CkQe4cSj
z3;!_LeyH4nNtk34c9b*QnkGBMq~c3XE<5Y+o0ZqH<)ELZwOKrc-wVgT*70W?=e{1C
z3f-lY!ueBn(OehOW(PolN8ztSE_%Kdw8oS*fR96;JCqIP%&Z^nNkFI<axAfm#Mz8<
zzMqXKUnm5M=eagj^1}q#qURX8re#^T_tG~1pw|#iFS}7Fx(~6FIH7|uxpYI?p{Vv1
z*qt*bMo@%cgbuDPIm**UFQdrow+4@`zBMhcTLw!9B(mfs!^5+}c-@+I0uiKV60loY
zr#E0+^)xWAHHsf$gI>23jgkp#b4wkuJ7|ki3JhWEa~-<~*e7Ei6@@2lMp6Co#wN_H
zGmY-p5JzO$P}jtHR*!OlOkw{C5`83paM*du*6fQ_wCm=al%hMo1vcT65$^5@&XIgo
z!zaAx53i=)yq--GhCc-{Kf(X_8j_I}<q=kzboLIZ?X-AuyD1|{12@UJaLW45`uSeM
zxAtxEnGK-KQ;<`tICO6UmsTDZh2M3T@7DJWj4(GYovpr!{b+eeJnyLT&~oDIps54o
zVwVKVG#`Ljaoa!UgHwpbeV~ODOLC0Noi;~)@1*`F2e4ZykHqZGhue&;7KbUg2qtEu
zwrt%jo_xZMs8-K`)s3Te1*%e%*VU${t(5W4c?8+9>dI29e0`c-A;pFQvyoIF!(#Ms
z{Mm{|8m3oY4UJMBX7B%VTL(B>xvz|pWS5s~6qjum-c@lr!=%pN?=|IFGcsz7^B|Hi
zV^G@IsRszyAx8?lrg-<eZ||@rEt`UuXNv127wjgw5gAj>mRHFzNgV{s&xnvIddV8j
zD6SyD@O(zKg((xH!8mG4i|2227LDTV<DWr(!oqzFWHh+eaM>u44=rFVhV@O8rBkpb
zVOGRE;W4Zst5~+ED>rJVL`y<q5DIR~cls?FJzEEM6qoawH~3HCztmgXfc%o69jGkV
zr*%N@P#b87c2@G#gG#`5r`MM;a?fj|0)DI_abLc<Av;ZerUVdjQ*b&+#td7L`z#4_
zarD5T!yNQYOgwUvxQr6b5>=lyzp#6s3E<AgCAM})0`iHr6>TM~&~!cPWNjs0V<GJf
zl=a2s7{%Ywx!cHpxHy48<AtId$*c{5{?`czY?I|JssuJfx^?g3wYxHAWNPE(fsjk2
z>{;vDw=FPm^mGEW^^woI(UA?2_^IIR1c+Di*^Scjx3Xxa%5qJ9eYayr_4}o|!<2_)
zc0hI;Giag}Z|^|JezmT)hNv+qSlmnY5PpyoMH|u}_r4L;pcWYN4_~4sVoj#ihMT96
zXkuacWTfd_^qew?4HR1#NBq^=nmG-cNV#uX3w$P`YAMz@Y}uGlkg)W~OY%C-wKU#3
z{ZCGpN1TeGScmOjPa{GBe)h`nQMaw?7FOvQiZf+JSIv<dB6t3FbG}^!V3YvNdgYaS
zer4Em>YzHJymVM9%U_u`9GD(Ht*CFEtfK_yR#1{%Jzu}CDv0KI@>VnAu@gqvi|{5v
zLCY>TBCOSl4WYlC8bf+wJ$9u?oxT~J0i<W1Qjt-nyvII`K8P7J_u6T4oI0i_>(H|f
zjr`I<;j!wbKM)4HT%mdh9)lEu8M;+6{i=F(2QOPm+s!Po_UwGL$O`{rglqNezoMLg
z=Ncw!@2tLIXA@Uak*u$*QFwN8RLYK1I!FlBpn8s~6Ak%!+8ZKq?$y<e{>eoJgHN*?
z)2O)6WUtBncXa-Gg7aUs%FmZk;UyYQTOo2GZx{zL*U>;Q;>t?vt$k^nTTJe)^?jU?
z+ssiv5kk+a9kD7;(({%GfhWE5v40EJ0f%giD`UUJoOfb@Pi3ebyNRAJus5B4aUo3=
zTPdCR$CsRrGVa-H>`;j2RxN6Vp_IDXeni`s+REZ+3z1z)f~_ZBJV7hZw`k8=gNnjG
zMI&ijgIhbZHR7lQD$UbbEiJ3WfFUEC5CGJJ?L3aM`cpci;mpgqbv<PM^*p*|9Yy^J
zsqpa|IQKJ`rc2|M8q#O(X@A-?J*u3MtioYVp_v7^;i&99I}(Kr_E7ZUE4kS8UMFmb
zopXojj>&HKY-t`B)q;kbN)KOw>9`gSvlD%!R7vVxvw*PtdQ4M;YBH9{kEzhL#`KfO
zWJX#qGj8fjI5F6Cnqv`N$D5y*{xvZ+dn!n1{Q=cV_gVpH9Q{U?U)inMl_P_`23xk6
zcQ6LueMnk1@0j7xDwDYIsSh$@r`7*3u}X2SE>m^TixMSY`W@u3KC^ee8|ZZAapEc!
z;mJhvGKr>!OQiQ*Hq5=v*nzK)MI+TKOJKE!eT5TXn0^zAGQ#kpydLGVziD)rBX!y<
z?7q_<BNAO9n2{4#*5|a|pd(0;W6bCe&*|ks1q#H85Ye*UT2QOF7_zb<PjNW+j!}w%
z^4ezOuDn0*?9lq)gmkp`yWMD26g5`FR&Hz??bGCoxxU78J5Sqd;>NI6dY)Z-FTuf<
z3C@BtY+!c2oqCy#M|izWCz*weo0-#tr>e3!o_T37D^F^VK6zJfP?*)1uvh$R$s47t
z_KFA2X4BdeE32B4*rA?@9Wxt(Q?yeG>7Wm0=H#I0)h$knmL8IP|7Hg_%lKrTWB+P0
zp}BoPs4m^LU_vxfc&4o+y^B)BY6*yJjVhXHLy=Ruvb{pTm1w!2J@^^ZvrN=%rKZsc
zlC1di_P1zB=sH20Gp6F8oLGgq<ZoB0!t&k=9q98{K?fRy;k}>Wty1|$_lXUKlddYf
z3jQo<rp3RA6h|qsp7s_rqK~`2azqW;WF)?ZY>1TIB9j4`|CrT+%tVqLsQlrb4Uq+4
z;{1)xxF~0HCy=)_-!aXK&d3kb;|K9$;B+6HUXZonX$9LJ8P&9DAEyoUw`@{a7sGe-
zI@yXCV#@aukGD{zxX@Qabr_uHgg#qBj}`HG7w4V$Yx%73D0H_4C7eVu!uBO0!Y~}H
zW^h(5JOs{v%WmZ2*f%_wkzG$QFFw1D>4=Q&Rw9>K71<+MVI<bb%=)0$h65-1tz0$)
z*Cim_>WGwBNO+>@lwSuSNYiy^bO*<g70uwBVl|3(<gYQX90Sr#)=pk5qZD=;s?XPg
z!ZGCk<~3Bvh|^0(nL3T`OVQ8fPv7Y~G7WkThM{4J>eI5!OWC6i@F>ibb4s0YV0^4r
zbt#c|rb=}{qp;t~G}@N6T6KWMp-go{`4v+=?1Qo7qP;|>pXp(;_pX7Kf%{VutdP5R
zl5<_xGWVk0n-c`(ZXuqOOC0u^Ced4cYjPcDxL#uUgs?ij6jnZVC(*vC2Q?NMNul$5
zil!RsJP#9RMY9tOdEI88Ji~I`e{BPn%j|#BYJ3q$FuUoK)q35UloUSXX$&U)4G$d)
za0;pZ=Uk2|pE7*6R-s`M$}7Q6sRPLYn>jv*7{?g-Gsd|hd1iZ>>f;kXObiDmQ^Nez
zo$1jC(dX(XCw3bWT?odA#L_|2u)b($V?cJHLg8fm=y0_a?@n?QrvqRj%3^$4F0>Et
zhA;xf3}P%Q#SxQ%#*5W%D^xTVDamOuWZGwBmBfuiB>Sqw<CXEurx*K`aLiAIs+8RK
zn~1KZRTa^4N`^|KxSFQtv{{6$#Jdfhcx?t~9S}6__-3-(^PYe0Al_gfpNon$b)Nf)
zPPBVo`NpBPbzzYy`{b0#?`rsiIJ~-7JZz%Cu4FWbX-ebd+QyNkL?fxm?w_m*30~7F
z5@)P2+hkAR@n;_;C+kFFqsA~~t>q)OLou;=jQUl-p4GgrRsF|K-dBxsT$Ei=pO;&o
zX3d1fOol7^YN-mIoWUTM>O0ozCHKFB?!SC(BSd3pk0$YsC!i86C%%wCHw9RBnVQqP
zDprin>BQbG{v=={wiJF8GZdr7CMn>0IF&xq0kN*_iGj{l8zFl;*k3NON|5>L+z#RF
zQ)3?2`&g(x2+xf55<kTSwf?=xDD-SlqcCQ)YwEO21T)_F07FKff14Gqx;XO<%9BvX
z@${gi2dx?L9Cl*FF|hsVZ#|mt;LtiAOp@od_TSEEfDXQ0flA@DuCl8<g4|wDam5Z0
zDNY^Qg~~;}fm2oF!P{l-tVS+A20rDBpn3*km159$JeaF%6Bvd3K4ugsFN#J%ApC7-
zwESZ1WVCAnJG=UzoiSFo-E%xK?M{NGBiElmHAU0iz%)Qw9I6dvl`-OA13{o4Fbw(u
z$uvo;uL!PoQAtOP9-dK)1~qs}QY+ubsc9s<|6SVv3eHVHW7WCTI*lAn(w$_lu^NgU
zeyWVpUPNxjwQ@?pG(`s}7m-g;NSp+k9`Z{az1_$(T>gTcY#RBv-sF4NycC}E@s>2E
z7RZmfI?@8(tn128<WMFqP#73$HX%X!{q72=b{&48c`6n=stP0?1ONCoPW+aSc;6C4
zVL=s=ad+ZnZO}w5azinKFDF(0r;*0E8AQ`(a|^Vbs1Rt4#+26q%8--?pbQ;lPu*RZ
zJOs!O;x90ezBSj3|Kc(NKG-(AV-uRrJwM9H=?JrX+yb?NQSpwqH~H4EvHPvSu#)MY
zd)2A-Jlt{ml-kvcqGM-`C{rzZ3Dvl)hVVZnsgCFg&-PA@Pz8kJp=bnpw^Xj2T?;YW
zE?*lC$EZaYxt&z=<ee>gV?h}b^Kn%<gEglgrcC3f9-?|XDWDhrM4^t7NrpgmB`S6V
zyZMxSv2Ti~A(WN%C+6+|c~I}w+GyR#plBVf<boa1n&|CP%oq!TMVl*96hSSrI7{uz
zRg9#JFy$MAt6{IxjqXrd({|oUNYF^4tBL%)lNH|<08rpX!Pv7^_=kg4zW$q`Tdg{)
zrrqHqq1eWR!9Y4;A}VZ0;IP(^7DX$NiQZdSpAvloe~EvyfVUps=SrATpZRKx4rwj8
z+7~%CSIfN^Sh^f6iUe})Z7aYG9e~)#g_D3;d^N6Nl3DLm^#_)U{QYRTeG9SFw%+X=
zN7d3sX@6bZ`|kTfBFt<j-k)2#1@P-%^`Le-1Nx7Su$+mK;I@iyZvZ7^xZPtLWoE!c
z9&_`?eXCc0wNtK{mX)}gmdkD40sgA1m--P8B$)T?mskK;D5xC5O}yBl>hQczC(uV0
zU4^HN?H}{6yFGEGR0RRL3#c2JsB-#D!L)ks>YCnZAd}D*J)tt?lfBk)!ex)%BT;`p
z(G8JSih)CK<}0c%_XSKkmE&Wb72#27fQ{5qA(*>&Wf=L^5Oxo{eJiNHjh*(c7Q{8s
zH14}WEe{sxASrr81p^Ea(Br!N7~5U6c?>m2XVAw|Xm3`%OAmzn3}!~p2&lOlznJre
z7W7Uz2ByleKW`zUIMj><9k4A|8ki{ld}0jeuoN4q{0aR8(L0K2VI_ZKL?1~MK&POj
zR_Caj&-;#sKE9xeJ?A@ezI=b13KTP&hHILJ<{ecoBleKWN>4hRGd3pX<c#nZ6d0gt
zpvQU?<fqxU-5Sg0-u%6qw>Rjq+M)K@=lazsX4J1Xx<#$;LCtorsq3l#_0eprR}(B#
zteg_ezToD2{Qg1KDMN)%%fiozb+j(aHxr)@yUrBmcSAY%en6b+yc7aV9OV;~KjxC+
zOA$xTrR92x-T_6M$?#yGR_uotPF%2!V$YWi8Yt;A0>7=qcOzN74earroZ-=9aQYU=
z8HeXm<!|Fvfqr~`(CXf3Y>8!1W?%V8tjSE;BL|F{juquZKI#)7VNRiYS8KDUjew23
znNXP~Pm|RbCv!3T^z@|@WRzfLe>Uuy&(ohh0VK)LkaXzJt|_>X)F?qkU|>DQ*(|NS
zxZRqes=7#6vUTyVejuRRcxMd(l>_U<zcBHJ;8@Og<^`{sA6+UN%(@&x{TsT#+j6_$
z<~(E9_npYSo=p8sN3rMb@pG^I02}ZhB_u6|!Dm=*$wfiumPh_5u<kIoFShgQt=};X
zf|_P?Bp3{*1HOaSr^hh9n8iMkk-PsacXks8gz0MQzI<1AnF7(n-_tn^J}KplDR`Sq
z^1@Fp%N@oXz|(nhO4(&0{~-P_?>R61YSe?s8xdopRvMpqz$RaHUup^dv@NUSStiEl
z=8_d~sfv}7({pQ;SHyODi3aY}Lfs@V8w*GNI)>99CBNgZ8pkK1oDG}}%;_H<8|TfP
zM&KO=6x`@%G;S#W0}%SLF6b;=DI4S@T9qf5EB^bP#(_JPM&GP|IB(s1V~zl5;Fwo<
z%HZL525IgSO1-PT?QY*6rdg)I?;rpyGpN#NFQd@XRyqN%^ELTU9kuMhMb$q|Qdhft
zgbgkFj;{vnt>V2PGSY7c*yR}sa#ruBqJXtE0I47NwVMRSVi$G;8vxK^dHMBk_eV?Z
z<nMkg^e=ZHFfgI-1_stXOJmPJ0mHxe%&&a_Yqgc!<+o;st5;o`qcMbSp!{^5i=-}}
z0%~a*IERx~^X0IaoB)g)R#E9i54L+#cIBObVd!$<Dt7XvR^RF9nRgai!vB0e-`Q{h
zF6*LoAfa?tKQpsv*Y5)xz(Ii*)(ON)e=Nuz@X`=76}+j{bBbTj0^r?h63N%_v%N<1
zFO6L<NWIsb`<{9OwV}VnP=1^#d#eiipqB(oFT^x#(~-Nh&!SAOF3cqT4(r#Gc#7o&
z{;4XWpe8o&=xmwPq8N}Q!LN=+TI53TpQq)NXpEH|^XHF#Uw(lvwMq!K1<<+bc6b#Z
zh|Ep4My{1cP61-qOoYu{3}DgL{H*tS$ygZ39ocx+H!m34lOvht^f+Vpf#RiNmt8vS
z8o@kEQ>~c%e?3m!vO(<%^s5a|xUSMZU_c&SehUEWTZ6prix?WYlqJtt7>)oM87^wy
zCAzr6tT6xbYiw$DRE_!$zBh8R`Xoz+ZS<I{Z5=Z<`!aT(EVBQCU{nHx8OtKC3>b4k
zjy38MbwGeVe6gSg`91c6i!b&RSU;ehsc@qze9EP>9lc~0*Co6!EuR;idpsiy#x*Y`
zQ1@)>by=sO{(e~p_W5h>t@hg6;pBh-5_H<G<Tv?1Ytrqz)+BfqPDF`F|EtOW5tp0%
zwzc5R#168QiNhLk<5LE&EW}6tFzL6Bc)sf0Q@UU*^n=r-ssXKH_qPvW#JQteia!7r
zV;x{IA~TJ0cQCG~(H;5@Ky8SVTapaZRPQddXnwLK=DN*#)<t<54v+a4J96F+Pd>|*
z#{Y4o^?2r-yxA8LVpa+yTy#eMBP=I~KLJ$N0MXAX4w9~BYmDy$;#FFiKoRYaBTWkC
zF<xJq;Gh@u@z(cVP-f;m=CX{=JMGDr?e}D>*8~YVyjxrW`gY&`9pQgJj7aCCnM#`b
zPW}qlZIIQY8n)Lp;pzeMA0RUy;pI>tTqgbtI*P=sI`b$UlN<<uht^K0r-;dl-ON~(
zy&`P5oyKuvxxSEJAg2OepF(_|@~5iI!s$L+L!#X$caRT7{VNVp6d1~cINtm@eYU=}
z?-CF_=w_xG^0wZtmuLwD4C*O}<j~US6$URvr|yD=?LdnVApSF%lWh0S?O0L+Nk+-%
z<zEe30fWQsIIQcd_0`1xxb$$-OV+mSIl<IQyq>a~aUGBjY_)Q#ATk9SDxA<C5)71C
z6AFad^J|fLTjoNorR;)Rqg|`KvZcrtCB&@AMnTq>^UrtLQ#vRhmc$?Gx*+{!V*HCz
zYPf^;jE^{)QbjJB-Wgb$GAo8(WmjJ}C*|?8yn$Gg5Rf+z|4ZKBGT`q(rVLziQIy6&
z`b2rNZHMk10m52&`+^+hj|q;>DX_-5?^`vJCSu%!V5&&ov|13~9itwE23qT;<&_<_
zFjTOD-|AlT4(Bh^{vC-Mvl(}23&cEjQ?O+l5~zu;HOrHlyZ3?JsYOramBb0f5?3tA
zm>lyn#L3BZ(T0-h+KmSgV-6PVo<88`*8l3~xX*xol&b5x^^WA8ENN-l7CXr*p3Gv7
zAGD_pIeXleiNtA+2UT)}vMX~QKm|G<yA*t+A62tt+Lk+B{w*QC+-E^#_C`l0V6tvp
zI+JV%gwkEV`~DmvUgX%xdRWJ>grT#YWBKGw>P#f+Klp(Fh2A@RN*XQ~;<mgZ$Q;w&
zchsTtrW7`H2h!db=p)X`daVNNT4xpz;+e^gNv;>m+aTcJ3VFSNi~_A|fi^OmqtpxI
zM<?^oSew4<(NVrPm*0(m%?=>$IguBEvE=<1#&X-7?py(W!~A)po4))0iW0?+V$*V&
zHmK=HoIH-*9Hg=V-wQNZ3yvau{;r^4coDKoiD6tUJKxCKs&6*Ovpt@|DmMhs<eF3f
zO@0p2#);kiOXdT|4-v|&a>W|Zn?Uh;TQbVggPKMCp3D}iu|o%4;{6oBgQK^IBbCrE
z{ZZ$P*NKPgwsZ#N6jeERDYNHv2$7v6UD->Pg{6Zs62&O>xoxRhcaG?*a3&VTi@Mo)
zM*!|5&O~~0D}9tK$a?6ev{)hfJeA>>tSDYbfCoMSAjLips&4W6j`sx^<-+R{wiUyf
zItrSnQnHq%)k24#+R@5`$~lEgQ-Hw2t9+DU=S!cO=HqI*36w+8@r0KIU>ci#HVxEZ
zg_qEs&e8bk!GwPgjenU0X3akAMjT`IPx{;93f?S~8<EUwG{`$+NRcy%PEPLiC7WXG
zaM^_m8t8RKuFpN-Ka(_$TuIBNDLCPh8Rb_=lSKGf7U{kK;5t+sVPGv?eC;2O&jhD#
zf3t*hg!_G(#N%yPvV)4}c%|yGOi{KOl${o&R$^{AavR}NhG~Vc-(F}jzAl&YNf@WL
zBt0wWWVCBDV_+8bAi3E+JLf_yXh2hS%eO9=g_gi9x~e5S=$Lc>1TT+xy!w}^JV+^J
zWcNq47NjNMXAjdRc9N^{gJV6g4?PdW(OdYi%?gS5y;QHar{C@vFvZZ!1>DyD_b_a*
zr3|YfCY^^D{K4qA(SlnG`h}j`LImlKS?-D_Kpmyllcw7vAZ&iT&H|4iV~a2?0}#x*
z_s_Y^cO2JTl5jR!fIjs#PE&=jpAe=huzt`hQc&cK!Mbkbl$o^0=i1gbjghlJI1d~M
zVN!7GRKbMg^9jkh^3?hm(6*Jl`g(z(yKHGQ@T*sfP`jH3AT&e)Eo`QM6VbV3=RasN
zre0k7&bLN3(5}BHw#U!*fXK$tf^z>}&!%Q(_3H<6;m<0BaoXkHZFNI_@gHT{vsi{k
zDfy$FCVWSB7?}zfjqI-aue0r6sjnh|9BN~YJ0<kzt@6eD*3Qm+4Q73;ka&VQeUZpN
zaHopDt^~}C6m^hAM*iX;^WWawBM`*)vR9Cpd%lNPz6Tts*si;YMeD`r4b6qBs-qz3
zOo=ziyEDJ^KfKFjNpG+-1$cw?o#%Y)dJM#f!ou2w(9a%drp_s1Ja3_$8VToqAax;o
z2Oykll2|j@k?WG`>npSjYX=e41BeZg;>yiKU*@yWkqCjQk34?e`Q*YczMlB+w+PZd
z!M5NkrR-Pzj6ZvBVrLSy1i!18H!GysY64-dMD)n!vwgt<8=IC6$rKtdFT7qc;<jbv
zvhk+y1krGi0l@ysf&eGmuKREjp#Lp9^-bRJ#~Alkz;)4=Bz?v&W5|^pw&8r9ei9aE
zU+j%*+@tnSvKX;~LhHxf|96l%jG4rE4mEiDUr2Lb<TIBR{FKfgF&h?GPm2^t5Eqm(
ze@uD7&XDm0)Cy1GD&YZh+r;ywVAPy<k+<c!n^PjtGG_uzL>?e5HD&0y&b{I%ukha~
z@XTO81WBDTTU$^O8f91D0Iy4b-(70jS}iv$k#EIFyvgW|$uYdRKMp%(CpH~KOlKQp
zpaHQODhBijVYcrZBIY-MRz>d*=1y%9`nh`&dXMuQNznrBlvexy#x?EDoxrgqn`Qk7
zdRUD&vklG+2RSn6X(2o$L+5*1n@6F5VR%e{6L}E{#Ek=4UIn8Q-X`f(%M5B3JB|ul
z`2~psiR|dlOZfi3S;E|Mu&L`xARIL<Wp+#2cPF6yeoWjJ=&M7;H$eqjaIqxZb}rDG
zwXFnEh&uLx_3)y#VYa8>Mgi9#gYd3Z<8H}69R3RU7)_;v)If2uNV2l@A=bkvY-;1>
zunq9pDMND$=)I-06*u|CmWRSqr9H=ACeA7F3EB-nr$ze$H})?vuOXh}P*Le%{h{xu
z|KCBaU{V!LSRdv#{1h})38w#vNvLPtwOLi~P~yZ3726Dgv>jkbQD<W-7EkPv*8s{^
z2X03djDFMc>)<v{`{$p0V88;}H81N%{7h;-B@51~32*>N@?Y#3Fgd^S9~uZ;_QfGC
zKuNVfzUO)s&@b(u{W`-2)oQ$+AgKh7CWy!765)=#kVQNJ@xhq)3At*Cv&XsYC_p5P
z9(f4FN@mWbBy#Ry548a?020&_yCN*UZ%Ux)B=MJ~)3BhK?BZ_=Iv@orza7}{W28DL
zSOC!qWk>G>q1<}IE5WDzh0xvqa`@GeNI|~-W6laZHW1x8x;DunyJJ+PF9iXDu0x~V
ze+Wr)QP=dMwKP^Ep<r7_;+pt_m+MrSLfD%ji2Ig;qeXV*Uk@4y)_kZ&btT-R3?IF`
zDVZ?f2hJb7^hPJL_i5>1*9H25JO|JuyOO3lpuC!nJ#KfYX<v|^rs8F=&V9O{m;J2?
zTO6|f&2A;y<uv!@eMg1FaFW<572=wTzHyp_xFvSP?yHJ>2RG;k|KT58;q^*?>eeiS
z$sHCF<c7Cdm`o%-ga4@)7~7A@7}#<&W=~y{eG3p66x{*A<e9j)8RvOZQG|5sKV~9M
z;0E**yHw8GQKNRLnMYN!LW=j66Ik+As&IB6wxq8!F?sI%?qzxF)GjBbo`wzyd0mEk
zb+>SyBVjnCmL!>kW`NH1wZB9q&90XXx*dPNIO#uTVFeatgUcU7*IwN0qG>s>Q_?=?
z3AW$zUqr5sXo0Q>tZ6(ha?WfoyDYH;Xus-@e(FuinHGsX;8+)BCcx`!wyWFlUjO@!
z1eU)Vv}}WDPsDHX!9bcWi7dfyE9SK#z2dT((u2;6U7{7uHM)AZ92_W14I1x_dkSF4
zm1Aw{Xs8Vh;D~nrRhH_33V?h>9UH%+>uch?G#>jh>_2W%!k`Uq=6UnIL!#GXaK0<j
z5?SY3;BbEC(j^TG*l31$T~c%%V7o=XYTUsez(*Wmzzzc8vHgLXsiH0i1EYtmhOFM7
zMgS1_Pp*Cubei2l@n1_X&L6}ulg|5kJTeWP0D6=EVIu=iaq<wD9D(}C+>v+i?MleZ
zWx>G>Kt1UCoO+Pp+$C`Qk{F_W%lsiI4u+j#u2vge>i}2yTwTXEWcR*pbIQEkhf_7(
zhZ`3AZTQy^0}^lz(9-no(+c;iI+mRHe*Xg@5stU?uUZpxTlQuFS3CiJf9URf9`Yqn
zFa=N+qwSuS>)uE^vbMJ3Y12S@B!USvDqkf3f)^H~2ZKk!2O3|pjv>zKyXyxcR78L>
zqj~@Vv_sOM>_?|R1-3R|MjmkmB8#`xIA}ROI5A@~DD|RCr9vbium@`@luLs)*4c%#
zIsjZa+OI}6BA0G;vo|1VUY;a7Xd28a%uXzvq4i_R@YD~GU)^7r)0dR{lyA*$ub2((
zV;B_7cveWrTH09-$j>zDp(h05+(RP7J#u!FNM7Vh6#x86v>BwYRY?7sY+tJ{<{_rs
zZ%XkO7XV|R+8|}7j_z3j4;UzJAgKD98C&uNGjA!WXY+;XPx%Fyn3)J7F31bq15ZAN
zh-qsaP{l@ky)TU3yJB3J2aZ<wFn6@VBlX_EoSkES(9y?pN*0kh@?(DaihlV5xyd);
zwhKiCkedd4uR!JTcYqpNE1-rhr$Rkusg&L_f0Gar{mD*B_s6cFD@3t{6R&>0nvuxj
zGXL;KWxR71I_jP<BtC)9M1*VIlfzEPmwUg;#H4PxJXfY4^tOFamg;{KG%zpU_excF
z$zG8ki;k5)wmkeMQ_$F9=?X;W&U-yW;Z^Wl$_A5HI^YLcCs{z|&^4!SL9pVvK9D)=
zjP!F2^?Tj(A*twNZpY-6_t+^a=`6Vp(NI__9|Yec1@FYx5DotMf<ud&n_USORz*b3
zs)6v7ghU)mb08=u+96iJ|8Lw|?q4Nu&vPiB7$><$i9$VBA>K&{BVE{+o7ko^<YC@W
zyBu{Z+loJeFGB7dgIux|DSQOl5G?+ylLG9Kh5HCNN8vH$uapS{n9T(N%8B#Bj3jt7
zj@KN48vK&0P?;I^$ZP6zXde9^FZFCtaYWQt&+W3x6&DMx^PVJV<QhiYT-<j&8oHiw
zpy)ck=*-6$WJGCI%qhb)me9m&&=~q{4J$P*vO<{lY1UEJQ6hfxQNG~?z9yr|bBwiE
z@aGCw4(tB@vLm2_`?cI%kTc!}TmqQlu*4048TKhzrSbBO#0fi*Y+P>N7Ax(yr)`Tk
zlhutq$A#4q@1~m<4vqS;n+4`&hD*d@re{cnZU^{H?`f}Bi+gC-Fth7XHH73dKs?74
zqUt|^<5iswL|k6E5~4AyH6gyd+81%Q0t!x%(Q>JTtzN?MMfehWQG~w5(XTF`{PYf+
zBn*0ZZHN@go^Rg)eL7&R(u{yYhir+7!3$&^!hL`bY|SQQOQQ>z`%Sk0FvsH~(6lAc
zlU`$dM6vCPKbPKH`e^-uN6N!QzhefkADuBeV{<3&5;g92+0LwrOYbhnzIs*WN0!aH
zY*Q#{*K|o$`b@+5!1IZhGTQNm7gyZQ@!7iFyY#v@-}S~!zPh4%=*aH;wul<ESA^Z*
z4B$_Z-QjhvvUM6q7A;wKchS;qzaLrp_)LvZ_43~-kIrbtgazhJ7Szr5sZ}KI^4EjI
z9zbUZGW?HYkM5Kn?%nF}%>B`hVvQ3uvL1g(Z(yLyy-u|>IHNR^a!!>EF7dco88`Q~
zM|wo}%PC3Fp7_U%ylb{=vnyn-%Z%>(kmf}gTz<<YK#aGxXVvyai&uQRh;LsWSp>9C
zPhM~R^XTne6iwx-aym3IWFuLJtSVLDJaBkq8QND?l?*U<+bN=XfwnIshL+P;46c8$
zu_cu}Ga8Yj-zhsL%4n#3tryZNc~>}a&Eol+{8M3Zx_P?Z?XjVN8We;22B&9DisPw%
zO?v0(WYHIhf(3B5eY*zmO#b>(?dXe)4BW_p)KZO*s?-U@A1=M_mxA6b3a=nP7|-OX
z+~EapWxw8l+$|<MVI;>o*8ofM!<266T|+k;{J88u-41X$zU)%3BG~RCSV(K9ug`tS
zCG+?FS$uJ<xzps@eRnousxj2*)_e;zm3*MBDE3NwyUQ7)y}R>Ww%A>n^#19BzFphU
zUhl3#wDzG5!EZeDzG9E0Z4?)i$r}zNYhEf-p+1SyH{9@t&(THbV(EI}KIG*Lc-y3p
z^>pZ{Lj%%<rl`?#Yh5wPH@384q@p2}BCmE=<b}}Ckyey^LZ3~0*O`aGyU(tkzswaX
zf=9<*yN^2<Z_CYMC((vfvWy_1-QjMEdf2xv8ROnTg^iD!*AmU4t->=e3$`=stepKZ
zy{@xTm=-Q3fh)-`;g2IY`c&`ynlO0(JESItrPWe@7^Mq-auQlEJoS=2y%=9Y8_yqO
zs7nc63jx29A)V7<OgWy+YU)eCqSl%mZxQ@t(U1`6lE)O6k1sq4mnEmlZuCXlIOxk+
zS7SQ3&D4ImEZ0DJ&QxUjIQ22o9MKvyJ$RURk3YLhGjX=7ZML(muU-bV(qy=R)PtCX
zfdA>2=M7Q|hNSa+#$KX_AS5yqj^onkQe}o55pZ33B%0c!PL?9<hUu3A6~hTtL+&f1
zp-p)YY#$s&p0>`i@}E$jH=1qTOTYNlsQI>WA3i~=61km#`0c4EDm|Wxf9t1d25G(L
zr!aw#?uLAv6dv<u;8X8LFR#|ig?2)Ee{*=^78dQctYXA|m%{q+M>?f4QyVo6mU=AH
zlr~Ffy|sDd&=96{_8H><&7w>EsoU144zCi2<nsKIUGA9%w@QvLReC5qzhtQb?~^6H
z$jF-A$4+YDrkUV<+u&MmA1k)q#dpJ+BdceHc<YQck0jLZK~=p;HS-!5<}Ah*LsywV
z>Qzx9(Z|WFOvpL#!OZ20d!xl@-ACr!%Gba2WUqN$g!sBSlkSB(kTx+Qv$D7HO;<y|
zx$?0i#plwl;1{2abo-oyA8Am7dXxxBmxr5;EK)BP85cq=k~$(>zxcoY$NL3!kyzyM
zKTFHkEd-3`cMHv(>Seb)4uT!`+|paUZr*qo{jdKVIi+@_>_)WQsc(i3UkoOQrnei@
zJCvBtFzTwLvFW|pb!*|{x9U<-AtOTU-y39jaT3@SPZ9RW_f=D^mZ>8l?2p`Swi}dv
z^>cmo?Q7N=_HJ_U&pFw74B23K@`Yi2?_w8UljRKx_XcGj`?yQeRR$d%Y=EsEP^-5@
zZ813&p8mq>qO}M{L}KUtc{ks+qE%jr8paCPeGZa+LSMu>3GJm-kw)CnT_FY^Kd{0K
z+N>is<bT1nL3nCAj&)bzrB1ny@X*0LYd-vl@eYLnMTKkF+)M;m9b8UbfsZ?s4j=TY
zJY)3$PTRH+jOPANzY{ja6ln?XAfFz8kaBd}6O#O!*7wBlP4f|Ro#&E3znZLmOU;!p
zGo>9rEf(?h`!K8BtFsE@jqDb$^uYlex{K%rBjx}4!5`W03{Wf|>#kYcpWAvCc`sdz
zF1xYY@MDy*12PBZ$sDML{nzjI)8|HiT?|a#v21qP!sWXy83nS&al3``HFrP2P@QFr
zvd~WVf($6)>|%HUY8k&6vC-Rf==lC=Z}x^S>_2Q@MGozD5b`>Ob2^Yxo}8L!+$u)j
zG`R1J(X;Gz$UnA#%llXWE7k4Y?GT#d3y-bKoi%-Ea?LO|RbKF-V@h@}&7Hb0v~J$E
z5DBzjfX0#sj3I#qu^nTbz2c_y*e1aW=8PVLSqMU<H}<BceKxbv$1~axi6H;$D=@6?
zY*T2Ri~rrh9@`!v=)Jog3R4GXyuHkzvp&s2u8}aW&n@oL(@vOwdj&NC0xn|WZx^xs
z14K^gj#J!&dD~lxI|A6F(-JNjMWGipuf$Ei83`boDf=zruhEm`Z;|8(^FLziA^)}S
z&U^WXS3<v<c!ptG#C4O9gW6|g_K5v&@!)&p*!C5;@8F5#&G>~RVu?O5E>C86wJ;KX
zj5}~o`HB1S2<0c~lMfH76?@)gE~0<`-TyNNc^_*6_9P5{5U}{ze4Z4tG)gS;q>Prf
zY)HSFTHxrY(*uZSJ6#=wg<?1duh9q1ord6jT<z=jxz2tPCu%VokTgWhi=f;ltr3xY
zIxAKR6K;gR2lI>o5xm-vQ`6$!poxMIk2C6_MXuw8I}L;#rJxh)V8@|i@YR_}0ycr%
zbkSOGxBrC1f=vxAebYL^une5;LQZxs5l?~PTbH?bo4kf^{0JLg%~^u~Uqb62F9hr2
zv0S3>-u&{nu27LzQjA#j>AIh`rpqI#$pPvAueI^sO93I<rp=tQ>U#<yr=+;@#)hak
z?bLb*@?C@I)YAX`tyer3`8`dwd!_Xn$h?!A$*v2SIp@y{y?w6oxv605uiVp7nESEf
zc>!=RpYY^v;2;wNo4i)U!|joOxFhRzQKH0MwlC_2oD>F|TE$$#R_B{{eJXh1zM8(N
zS7(3UYKF`+#)BN~&Rrm;H&{)nij%5S<wxYiUCO|Vblwc^yJ(%2@Yi<VDp(NQ*Cg4V
zjOOc-BKG@>o|p-@E_S&K1?kjJ0qXz!?!LA#Xorq)4xd`s#qHPqc3vzp!unv_8p3r^
zbeU<Ip>)Xq{I-I$u3fOvX%%f=y%2Seh@J+h6(d~_4`=hqjs^#7JDj{{Hz9^}O%RrP
z_!~rc!AAV?#IGWZPDdY@XM-0C%AMwgAFHqE9Ny{TL)^1u4|Yu{&5`Ol{s2ZVx=3u8
zSi%3CguPiiwrMPPKm<Aaiak_h<T`zjbr;@$9-0xIYXqF2I*xb^*=o3G6wsHv^^g|!
z^VhRj*89!7*1cJ<10IQ(SnaRS%n`7bt|-ZleM`pEd8dc7<bjv%Um;k{;1k|(mA>RS
z5hfkN*?=#FHOQb;FXu(ka*CPzmOR)BT|J$b+VLsNXbi?^*>)E*QTTwiF9K`#(QaIV
zv)c)Ot?OgKJ$GSxa%y>9YM=!1q-%o-N}0+!S$1PzQpUpb=@vX6YaPet(4|+Y+hrxY
z%``^JL{f!D79su@2V2N;KE?hm{%w5gS7RD#<7%m-xrJ_2=W^%6a;ViwbsO<K5L61}
ziY=f+KI?tzeawc11O~Z`ctW{Bw|6<~F`R5}8t~Vy^DKM6-S(oTihytftou=<V0$_s
zB(wFK7J!4OU_YBET$BGP+3}j8U@yDx*mdleu(@q3WnZDkl~4tz$y}qtb1hvTk}r2O
zU{u?ST!?D!<k7GXw+)isBk`usBaIH4ccviIE*gx=utyE|`A8nTI`i&bhTQnz&4Tjl
z3j30y@Lu`%Kwu=u%mu~}*dEIc=p&0#hm&TmS)+cudK;9wYhD1h2Wc_^`<A1q9FwG+
zk^G4HWC<Glb3Y8S_0h@BMRukne<3^q<&)rtD(2<u<&><Rn3mNptP^L$qf_Wep>cGq
zUXY$$OA@+}ty^bo&F`4RR}=JM%_gq7`z~qMCPaIDh_dfhX$q(7>Jr^2J=$!sp`!3j
zi$_Y>x)&Er>p>5+lKsfUqGi^(5&BI0AnYuU?)Ox!7dk8K05v%x9->xU5bVCw;Q$5l
zMZy>IF#w{ieloiO+ztgYq?9LROjObcW0!EXhYfB_<fm6$1LaTNy|Il^nBUXdR&C=f
zq<8nd?*_M8>z(SfyGc=2cBW<%?Lc~GnZqq&^NhMMY)w&$)xb{6L>4|S$Jk|NPt^)1
zTy)a;&c<y*61OcO)A)%4a>_XD$2Q+x8k(xq4dH82VCUMdKodG_d#jnD$TK<oOXru*
zq^NXbYgetf8jf0xi>dTscPY};F{Di9K~8tViv217kG1cNYI57wwxHMm1rd>^(i9N3
zARsj=DosFvfOMrwjdVf@DqE4>M1%lQibyx~9+loZgc_vRPyz`d?R!By`|NY~9rxZb
zzCSvK<2A{<)?BkZ^Lgfah;#I@y0pSp!Cylc!?b5&s7raL_1|XCOY9_uKv_Lro6P*k
z+cmGJyY6wDxo!K0-|<<$OS`EqTqXhz+-7y9Iyh-RB`5MfJiC(mxv8@M;wXgETP&jz
zp~=|ZK&{Zm<taYO<hX8H!gM}?_1WPPNc2x0vAA)$5zEEC{Fb08)H|s_2U7%2Lm7fi
z?94xOq3SEbQrlZ<^JwzgT}YC5h}jvNu6u50OxzYP%TGi#6Xw1Sodh!5-9kT5qx8I(
zb9v;HOWq26zw~#_mDtou6wu6|5eUYl-%rjN+WhDN0rz657N@ZMs#I<fPQSgcTW?K*
zZ)2rzjJ3ibCn^Z7JsZRBOP1p+p7DPuazkAPq7x)dc*~)8SIpAO%#h^9bhc(waO^nb
z(2j9uc!j>zcZ#~z2-bW7Gq|H|=_@n34lOjq3Z}>M&U~$nh)iW1Qr=O{2|PcW){z04
zQdb;d734sa3`ju<V+3$L*3+{0b9;fieJYf6lu;!1lTzT9;1RRP04Bv-JNOlQfrZ-6
zW+tF^B(dOMC|Ei$)$vajT#iJJp(k%v90n~bx35YNYhKg72_x`#_A0b^!s)=bO2kkl
zv>9QTXMdSeE61`c*WP$4&Kc~VE-g;+snbF2vO2-Pll?=79)XcV#5c*3&m@lD^J{iS
zeP1XwHM1)zrOgakZRG6G3OAw(V5`WT8%a(ezZHW8xo00vorij*L{tydi1^&-Yq^@C
z`L0(}!NA0Q(S0dtY_N23ffjwFReGs?rRWT?r|9I2k;Q$>KK~70y}@QH0zCb7x!;Tr
zPZMy1Z+dimX>qNd<-|8}nJKx9*7*RYSCFH4cu~fWBAz@g{@!@}H;UvjzLifvM`FXf
z(t{R5`F1Ua7=4ecvKCgvI0f2{sJ^T+=*I5%5^?(?a9?0H3~97173UG+w;OP<lZU8a
zH1*!-9LZ3?pI&uX{VC~4MdRK_Ce6vncV11LlR--Y>xF<(m3z$Ih8$sM+bwJdzR~~6
zG!DEx4VVkK-g?VyIJU2XsF7zzS>!gT_71a5H7tzktMd5CHEY7|*PqIKmCKTvmo2qg
zYF2EVl_h1P{m8LBnkeqSu(O>c8k_Y<DGha3SLkV~Z<SqjQMtp%Md7$6EzOc>xWr_h
z_p&N!^_kOqn%_=mfqA{Xz;{?y3SN<PDz2I^u1-Of8kQOj<eB7C%>)s?+Jf!v*JfcB
z4V>37+YN(h5N8Z`ee1UPaLjVR(hSUEmA!5yZ&69Qky13rYf>#5F6eaS5E>pVNX$7K
zQ1gw4q|<%n2~Kt|iU!QZ-R?c!P%EDRb^GZX@vlNr);X!n^rmw)ufM>r+L03OmJ;ZY
zVO}WwGU(p^Ns2ta8_ybebizC%!z>?p+6zQjeKqA-^)&uGk{>T=WN2tOP3g92>QKCw
zbl+CXPD*xYDI4_e`;?|MX{oRf%;-yCGUw|Ycf+~cnUEt|xd&IcY0BzYH32E6c)n88
zEvq1ba7e7iD(W&5b+)shSw3c+_cDe=bdd3m#I-*h%XccQ*CNb01&q>49F1mZl)*#9
z<-%M6NnQiuk`C%KR?Dn-8KzVdr)DP={gEx3Z{9zFw2ExJMO=>%i|r}ssiW@P96L(f
zkwAj{6tM3B=7?<S(s1}!p5?|?*w>TGKUzh*!up`90yx|4?-5Y59ZY2rs?2Co$7zzq
z*tHfsBIf(EwMuA<$V>fR^%nYwI(rW|tIW<pWoc7i_aUye&4Z|h{Pm?DID0PC`syYb
zUS}<l{)T5imObBdN3##cyLweC$2P6!SoMt^U-=TcR^2ark;@#K|FTmBPj{oGviOC=
zmd@Y^BXjM|^9+svWT7C?q#+pt_%cb`0^HDMLL0eWhdBhXGGR-*%Eqnp)CHqWK;Br<
zjllZEscb3wv|vjdHwJ?Jn*!a#gy<`D8L2(%;uQs`A+xClt!WG*JJS}S&5rbhw)olG
zeu)bkNoeoGL|-B`O;87>+Y{@u)_p7REJL3=V&!Y@4OHPus<y_xZNoFWGjUv-^{F#!
ze*HI>r##If49Ah{7SN>?Ps^3})=L$a`CZo7BBGQC;HeEXDwVoCvPv3L+USs5RkgLv
z^qp(#ojIAxgncgGu)bPNsF9~`>-3<}S5lRE_}EOn@(KoCfNxpIo0LT44YM^?Zf1s1
zPjqsBV;Q?s+7(nZdx^b0L+*pk(A>Rw2c|BA<x4X@4Af~d_h7F4?+l{su5rt>%ym4o
zlh37nD8x;ERJMaMMYR%#@cu?e-mpunIB2G+te@O3ySC|4y2ocPwx=E6O26+<e!rWX
z8rzi8rh^S;KP726-~qd0P6(^BCMgR_b;3PEQo63w10y!F%yCKTgGM1fiG0$7i9+>P
z8&@My<KC$vLk=r?vQ&B(N*|@~PN7J}&V8sUzi^1}BWo)8Idu9nrdifr8kZ4Ir||jC
z@S<sCHukZ(<AP7ss9URk8p5yu6TyV2xra5)V@~OxQwLS))j*$sMm)g%kCW`np?P9W
z{50sF<gIXJ%h>W#obtkl)h5Z_@Q1M(NfZvBt>|+^(kfe%j__g<eSKU?sz8%J^?CHE
z6^q=j5uJ~FyEp9fYc547;OSkpWh@$)tT2AcmL4F*ox8K0v@l}*bR~vT!s*)9&CZ4C
z-bOp|8`MEO0|_jqYb|%Rka16j_ll?^TqVbzAkc!&0+iKj+b5~f;ixBqXjNH{AM$@f
z-`+k@eM_t>WUaGy&4PR$#E9aN5VJ6Cs0xMJR;<g9QMy>&j+ormKVd4CP*N&j^U`qZ
z+3$A2F}{Pm$f3l<G}0Tr3R0$9Pw39p5DFNLS`CaC3Ji@r4BLdi^ZCRAhoDTr4jmH=
zgYSad2eX3PuQrx8^%&U*GQ$JIQ4g&(xiYtJ4rZKE%l$x}vbX9{q*yg7ceZq{`i>7<
zz0Er12ez|%<`ccOy)f9)N6A&|9N4-Ulg%}^$Z>{fJQ!0_!ns31v=Eik^qi=Tko;J|
z@#0mEsArfDMe)ab*G)-Td@JyptF=2{0&CgPttGi(;+|Npp3%|EEH%C<4~WB-om0U4
z8QOI%w+8kMA1AY_ZFVAxMuKlH>5J%_5-o--B3@d%xJoTwk6HTZ8$agn_5CDG+gXAi
z_SoODHQV3v;}n!Dqf`D+<%usQ&Zq)$t%e%p>a7L_vfL<DW0Yyu_Y~?xshKma%s==5
zPHNWiWn$?W0Jy#F%Xn|Eyp5MWjc{Q>OeAmsoE`wS6n1k4>ay?$m(J}Y>)!=Vhh0c_
z5A%%nK2osaP(S-1Iw4H%or;4VD_r8|dKAEQ!ssE10sv3W?1Yw$HWDBJypxSE&1Vkb
zj~9{OT#K2WuBC6z;4pWYziI*Ani}gNcWcL@$%(^Se!5oA@^QXJmN0XXsf@v<L4uf`
z+!ARxCF{OmOm;hLhx-bfDeN<+aVFkAJC0UOVKm^*7rM4SZJRn<INMGBX-*`*Lcs$s
zfEbf^4$F9wuYiZ3r4HUSXgmRq;>%01TRc^6?wdX=46VX8=KJA?P%UQ3CIU)tPQ6Ev
zH<g)#&X+96*QBR|^C(1zsZEzDjX^bMq;r@iDXe~Y8gJGS*A8Erd8Z@TlDX*b2@;Vj
z|8bbx31mK$DZKWAUN%TG<^NFN|Li}=3=ez2p}6ntBY!*lHhtB!F@q?i1hAqSc2Z7Y
zaU?LKSC5u%q{^Re?y6zOKVu3vjfqEj2}N!Cpb7c!T$#l5M^{+kxzn?cbi|_68zWR?
zP^soP?kw{{WvlrJM7cUPRM0>WKtr){YAMwEu%N8&%k(X*sGC|@Db1vz0=ppN!igiT
zF7(NK(q^7nXGxr9vRHbT+EV4r+>$BK!$z6_tjhN`OlsAE-F##`Dv7cY=h^axfn#Pm
zMk~5GMr*yewLg2{gD)QA4{9W?P{d5hIU+{*DqTHB9WdPg-4BT|l08b%hsLRu&b55$
zK<u9qU2Ir=HY{7BL;~As>1f;`a^6Xp@)1@H^oan@jeN$x&a{VS3SVOb>O4@u+@<4{
zmz>U&ibM0>RzDF#hpgh-oczaC_EKD8<w588vIoYDn#LW)Am(442w0xG03Rg=%^7`H
z>do<Apwl16?xt32oSx<J>yNuYSvSHPVY;1@#*%FTDg&P+hedBtI}V7MQxUE^z1>@|
z93iPCOLKN{RhV;s9KX373>Qd?3}hqc=k#)A>0;EKsK{kZ=i~02tSckYVI<h2yz&_%
z@g|QdMSq;KKOn|MlzLwmmO`WmDRHa@7^+G%9QE0H#)~8_E%G(5bh!F01P-=HGZjJf
zxxUaXXX_sFfOi{^IVtY6_G~MxBq~OuLCXC#Mh6@daba2>)s(SO*N=LquPBYrd^ku%
zxZFZbZ-*8)ub)?Mo+&AjDqpl2j9=<dSoLv1KQ(*qAk8*OqJjBEI1oWBjU+r_7QWgP
zz$9;u^;{Bjdg#F|=}(YDl|Q09@$n{{GzCiEBR<W1rhoRE{*ZNYJCP)Q><Mb#O{>dx
zld-z>^Y|wK3$KW$;x3Yp_<uKBi~HJH+jZUT6qi!tk35S|%;gu!sdEeSG9Isz(kujl
z9+chbD_+&lhQ|{UkJx2r?4!xIE=JOY)>*r{q+mX}lnONuxK?7k{e0h-kiZV6eydvP
zj`r1@o4xcb#&YmJ2e*&=9vkniWMCHOG&MN)1uc>;ZntU5EJ@vp?c}gp$=d4qa6W0P
z^}7xAv8b%a7un$nyL_~W_ExO=bZ`*KD;bn-URWt!bRo{B-dbUNtRuKRD7YhN#ZDfn
zHH}A%Ir2XR24TSMb?axhJsOGN;<@<JBw@fsi@n58fsZVLFn<_PEBY%2V#M;Jnt6kB
zmz<Yv{Gdf6{qL{Q-pjbcY`M2_h|YH#w|%?-nf8iY+UHpTT$S{gE-z&VN}#Q3fnwp1
ziuUEz1pB;qw*x{?43(@~H!CI$YSE5!uWc2XZC^=hzGcQzCEFG8j`9^Xisso%AEkYN
zW*<wNXUE?jz33$5zDZOJ_MaXAO=toQoilO89Ti5K2mNmGoY3M~vnO9biOQn});VYm
zsC5Y0Xz8U>_Yt>)07S9d9_3D90uV|U==T08ICkXav!aL#8S9$SQDOFwt+ig0d;(4`
z&vm3)NJ_c}b!UL=83s*B+4uy+8hyaOhcg4`Vzy4~R>a^~gETP9J)3Xo+PGt8BALR|
zG|l@4y`$gUP!ilOXa>uDFg_?UlY@6oE+wX>1Ido-0Mc4=Mh7U9NR-8NA*s$dqWU15
z6pAnf1lepOJGPJJ60WIB8JVOx>Cf34@#A3lN-uL9UAZd17KdaKL*?^Cv)rIf)}Z*<
z_*`lg%n+PPf;S50E3Yn8)od+Ex2&M5dPlula|hKQMajNg+6kR;9Jw&_W(jhgP>J2i
zPS43{D@K&78XApEFJ|XSu)(}%X0#0q*fE{M$(#|coZiACW5$~W0%>t$*8p(QNz|Kt
zw<Gh+=XvSv;)svo>NpGEa|hdN$9~W&9z9rUGH<nqVy!Xd(pTJL>)KuBF7F8^p!Igp
z?~1(NxBPW`a>W|iun|K3wH<$d&gZ>iBsynR`r3XTNk^A*1}L+$nLnsqF4phU&~4c;
z%E!#NY<T1cw;P!nURh$J3EVE#LNN~wjlO#<1-r^Eeur`Ukqb}b{fHwz=7n?aBx3~7
zjbAK-WM++w=1_HXreFb<cl%XjmdkjjzjTvSXlFYBvlq;?oW3f=KD0y*4{rAPk~U>8
zn7%m&5HOuVzCdIs;b4W^gX?E8hC%IzfxnmbPlUoYG<T<m$$lD6?`@`)a`|Z$t)W4n
z99sczcM?UBnc1)ZsC3yHa2x@QWY7$xuGXq156v~eA=?oCr9+tIp~0pX2M>!Ex*|wP
zYlll}CF&76!ci7tiq3Sj<8d_f6rD%@vnPY5xU-(dHU>k-sjpBU*^+T?o0lebUW}QS
z1|NW3cn+E&oyCdF#<xinvgQ}|GgbTv^f>34y?+pn)hN@^e9ppx5tA9;2|Ba=W8(P&
z$RXjvK==K?`eGLmY*hY?X)8F_p2oVxFGxfJl!ZZ(l~1L9{cMt4Nwb`^zcNBRz5NDI
zQ{DQNt`koS4cU^6Ia%Rg{u#J^j^)H=IK)HOK}v{IYYc^&Bf>#DAz5g0Re!Dll6V%Z
zF|^IsXu}f%zBYtbf@moW4iZWs`jsWQC13|dRj`9p$5XD=o2X^}m<-_Bc|HNhhSLr_
zeo_{-T}n)GeyzcM18H2up}_UPUVH1YiwOU5p$vc5U`~HB+ABYZyM3m?QNx9@r3ZEd
z+?c)R7!5<C7Kr%TMQyGa@kw`<cO=qr_{^^ij1MHZHDnOxyo90pIF;eJ;-i2uM=Qqg
zWYElceikudjc%^O@k&@80+We=sI9`2@rEkCq*aAFhRLJO0cE#GyXf9>EYyYZUE7oh
z-BBHFbgF$;Iv;-T0IlAC-E4Nnkg3;iJYbJxQxTQvG*3CH0a9@o@O=LlY7`XQzQgeK
zMX@O>oFS)uNxwM|RUz{Fxeee*G~LW`E2W*taXR&wfK>Cs>S!0kMjwC_l`h1|!OCdd
zC?_O9O0*d(sI(kM48k8UtM&xJ_KY(-_%85yQzM?f+c{+4?>KABWhKjoQ66=7KKDed
zvrPfHODUomMcsPO>9={tWxxQlKK<1_I}7bwdu{e6z`p=|Q6YUka0jxnsXxWcW&3Af
zOZi-K><@_;XXsYv`uYhy57K%W)ALs>)EJYbKLzEx!EXPTHe{1Ay^2G42Dxj$^Z4V|
z#S1H`Zx*)RB;-9vG4hl2HYkMw$i`T<d7)yeTzNTAwx<K-`_^pe@Llu5EVRSA3WSUo
zYBtx?Rs@4(q`W@6R;fwVY~42~7`l)JwkqGVIpY-O5VNlyoGDpX&C)w9a+z%-GpsQJ
zVzAGotf>4|vmEKHl6y(^B`e0*6}u|OYzJ1j;1_^$JPH2P|FgYVoRENN`Ro-DnCzaO
zNT_!)qV0H(<&M`^n~DjRq9}Md7n&cF`s#S~OaXgb)7vvXOJP~X_=tLs76xm82jMcd
zrLW4z9JHEBTH@#NCkKs6(xeOQ2SsIQuL@@(mF^3M4^sGy{DP;~<467d+zLRRAa5pu
zcXiu;Hmaj|NH2U~WflYzc>WJ2m<h2a02r38Fa+DJ%L85v-1ZCsTG?oN>d%2A)uD=i
z>hP37epW%YxiI>`Wdp3sJfudd`(}r)X;wrZY}#q4qw3qmiIS7mp}_z8Sq!MsifKLj
zUD`XhE&}Wm{;337=$~ds^iV56=O1J;s%SsJ(9_d%c{M^&2>{jAE>*ZTO4)7?iZ2);
zBhCl4ClNP?hJ@&ANc2}lMc>0AdCqzVuusTbfJ%q3eFMl0r{H=mTarv_snC}`&HSaN
z0`zAyrMuczu5A!79Z?zMVf>;X;EQ=sBfxA-^U4YuV8ARRMl<zC2Ag%VH?QKOPx>n=
zF>+5A!MQl}TX2w~Ce;isQA*f}nxHAa@egi}v=s=?J5P+sRi!t&O<FK<rOVwa!6s5t
zQt_-G=ov-S7f{8;;Mw*{bty<*Tz4u{G>`E%<=qq)M6{v<v0*Jd@-yRD8v5S*&1*U|
z6?S@jkl$>rB2sQyl*c0wYlzd?qf~u}vsG{_E$<05-pX#&qRn5Zc#~%fa1iDX1ARI-
zl;Xs1&ejwUHIVkxe;ct&FA(-?0;9ain-O`R?B^49|Ha1dBGO=v)b-b@Us&PdNyl(_
z>|EaT7^@hZvnCFrD)ja8O?i1D<P8AyKT9jR-{TuzLp%kaUx0!2yDaz{=j`CUYxNO5
zPzn_&-w9eZL(d!_P5`*Lw4JnM^*z=zs6#mX6i8Dv(WB~J{h}3-m#IZ~J*#u)O7@N`
zsQ63clDjC$qu74L&ZyoR%vv#f77Xk`J}{f>qW&22F5*t{85z7VCi;46OZrOT*2VzH
z>^&PMQ@S)F!8_;y4=Q3u0b1q$gw$$OD%IjxN{PF%`s_V&s-a05B?AUOmkRIZp-qLI
zXxCCGRxyPwur3Uu5N(M>-mAhKUl<?IVAisxcmj%NfXhM-A4s#^I+1TW(YSpb#t8!r
z=)V9>b#52p->fxQ`5h_Wm^0pjFFE(3?!6!dcBJAA8M>gG2NYD4nZB|t^Kr>_w*>E%
zI{2fr?DMy8ZoMF#>mYrO4J0*Ecp2>>^LCs9NEy{=%zkP9QZN!|Ji~N^F1B{c<MfHG
zX78JK`$m*;3)dg6`Nd+b+ziDoi<vAy1uGycEamy_I}o|($`^*4_0lI9!wZG-OPUan
zq-*|Rg8YaZ)%QP#3gH!KSu~26!Pn8)@5@SjkB~Cg!?_Bk*`x(JVk^dg@E3xh=t;5r
zG0Lkt)nIk6YH~ur#^c*9G2(>vLEnx9V-wj~xec7HvRa+HuUfr9#0rf(hnntIM*Jbi
zaoxPkmr!Y=a<Bf0ndto^vl?)z)>VI6nlE`>aMsx-$^DJ*dWbR+b$r3uRGHtVq_kBo
ziFB;fLrB5G3?28Vn;RgHeLYP6ABh|PM)8<G$8`}Y6W?14*-s9>vAn%c`f~jO#A`vC
z;+7ql7YFp;6s1Q7b4M=T@1K4D{(YjZ<3N8xNJt2{c=lv^mR<h#k;NtF(vGE4U?Kq*
zPN5t&%qD)b25d^+3ft(*`XKvRw+2_3J%hgc$c_LFo8j8n;qe!Ys46mLx;(De)C{Up
z(G>Mj%ByJ4`r^AWBPkBWm=~K6SajwR9OVW@+(ifdAf(4&hZ>^+_G-rXi_#{N&A^}#
zLh9m!L5ezeIqf)fwQzgEQDb3EtO+P0DmaTF@rFx_m_nBVtbVDUO=}$LiaM3dW@~RB
zqjKXii(oPzJ?9^4V+ggN`>A#rrglcz=ke>`>9Z||3g-9+&PkMNP+R!eLDWA*lR(WH
z5$dG_+vq%KnbG!Rx>4gzao-7x(_Q!prvN*i+gx$8joTuJ5&|oMru3;pPL*A)yQC$*
z2_8cxw-C{fC+81UeBAmrmcj(MkB446FU+QZ=IKvjaX4mMni}Rmh57q)c#&PNfq@wA
zw+)URqpLPAeAK-G@%MR@4D&`VFYEBxD<@tVq30{`ue^&^u^T5%p;UqXr?~r~K3IHt
z{gW5V9|MoY;EE&Hto(eMOUCL82ww}TLMzihnMyg?OX*l$t`14hF^_zAPPqUtVB$wP
z2VF*j1hW3%kgoJx9T&G$c@4!#10K|*(u3dO3C52QW!qch=#;^n1%ArG`23@bRBTlD
zzZud0s^9Nj!5E27RLTFzw*P8t#{ukNDxeQyy>OibP%u~L%kmsiw3@)_l~Rm^95Kf?
z%>hg+JsSsa?x>h^Gvo~_FH66DRI0Cqd(nT&wdoRlE0Hac1tbp|WCNAk-9&*GhAsoK
z*NI5Nm__ST*ApB@%dQ4B<43+eRhmIh)m&-h0qOB8E}fY6ruQ0#nwy~y<Dck85ArNu
zQt)}9<DK|bIOG8SRrSY0LxvBYpXh(~9p1|h^|*oTFydxT^~;-~+#l%|<`4d==?x8#
zYyd>iJ^oGpu)?tn?&p{vP)yOra{x@Nd%D745?0G6C8)abo0qgk_XD^L8zu8h*9nFn
zvI0VFG;3acef_QnQqsvZaGlRw0ZM487<j3p{f$-Hx0hDd?$)WVT($fQBbVkFmXfnh
z8cRdor~1$H{Ga%LZfS@4q-^;6gEjXZ<CxOL3++Wea=G<k<EM;EovIDWp<7vo2Bl6)
z4XPdY#a+SR^kr$gG=t3Yz2iMI=Y69+ug0KZeH1jVJEH;KyvuTnsUVyFdGWC)`a{LS
zUO!^Wa{FVU^4_OK6uRCw`yC(f`w4pvdJ8v9dJCUF=pCt{(3Sie;A9LH2`?Y_`H@^y
zAr86C^eUZxSiD^9dxh926PDgtCtJs}UV|APQ%7X@)lxj|bqGij(&G~Du4?+Fc0#IQ
zxUiM+(Fu!c_P0P{V_Nabe}bn0UiklwqWD7=0!%DgyXtW2^siqK$p_G<!o|L*R(}aR
z+R*qcblSSwA&14jXSLjPb<UG>MB`PB@h;!+0Cg%?ZkwL^(tlcu$E~Lvuhe_N5qH?_
z<k&`nn4QmeMSva4tN6X}PC3!<1nujSk4)eD=qF)+te&iR>2#j1OM@H(1&^K)QGH?>
z`+9Yz&TkLg-<0otHy|<}jE#Vv+<8?)r)Bn*w9OA=mq+nAB}hd2%CBBT4&CY0+CNiQ
zj(LF{1|aBeL&)&=gNzLvfxA2_t_k}8ky-U$I8(Q_-2mnE!!+b|m0utJ;@)lo54&#q
z2~R?g_jxQ&mYS~C;X9mPBkmm_eTT`WsslW6i_^D2E~z}bEMMT&fv%I|CaWLAWEERw
zooK+bxHk9)>FW^l@w>h)8osaWoywR?-x}>A>pQ_UN7sE=e-VM>foB$Lpe#Y{!<gSa
zjY}7w=sM`7KkMgIB;HTL6kxn50vASlr;dp&wJQL}P*vG;jg4IIHN{ok6k+;J0W`YL
z9PBpRl;*)%?oz7)$F8qF9j^rlzf9|bpmlmI@u%h}FZK-Kt<SvJ4m@Jj1kL3U$5d$n
zJR|r8#|_Ln`gczCts7a)@cu$NoO)Q^=yGXJOsnj0#L78SP&h#EzkPtDqP6=Ij`%kt
zOivTKuTITKyPfB{ABfAS-R7YVCQ+65z}eVFcC)@I2KmX06HgP40HlSp35vU9aUjvu
zdsfk~bp;*{m!xvhAB?Dze-AJ=lmSd-GOgfX>nVUm|8R|E|74ulrSzkuXE%4k4GHjM
zEM*Am%W_t6fFn5JFc5&yn6m>OpNxJHjA$vZ@F&M+he4arQOCSab=tN93;{wl?y3m#
z=XMZs<4ab1=$Ln&=mc#WL^Ug;=1)~s)~~MnkZYb(xOZW+)#N1%)+;}54@jFYujq=Q
zApXNZzU82oUwjf+-wC_cxD$TvUlh>E*iZ5%3;+l8E0fmXANrHKG*HmSZx$#)hX-ta
z&+!$LFBxENo8Xwryji~GRaon<1@JhJ7#W2Y1IH>#i?&wyV41nHEyKjzAI*cG%jjt1
z=nBkR2tZhUFSa-SNe`NQkEo!Nbc#YR`!}NZ1tiBf0Rc%NDNF=qh1!BaJPJ@d;;B?9
z&-P>11SI|PLH}D!UA4~_E>(m%rH<@!ltjm7Va_OzC4bWr7L3xaEM<>Z^}l0ZMThe8
zNzsd1g&n;8ixEpc{(%)9#@6hesal=qJ6oDVQyK0Ch|Vua&VTME3}|KViU2@vu&qwr
zd{q{qnJxjko6&9SChIR72GkZqo4+{f`SLB>Dcq2WGxP_UdPTm{FMsOVe7S2IgI&dU
zdL{FehulVU)>m&H^WvLD?*8J67ow*HV;LS>-!d<J{R*+4+&w%EXdW{5dV=e-f)Loo
z?jI>^&C<YGAYaO%o*r<PV0y~^3Y$_n&xVW4(-mLL#P{mt!=Z<9M`sy;^#;u{C^(P5
z7_%TKbYpi(x)$S&RrwhWsATW4dButdY%0lgN7>x<N)P%x-!DY(+vQyXDymMnr|eUi
zaLXc4ZVow}c@cqY*Z;-kTZSC9uk5<E$JK7(IHkO{J>3f0a5oKmflEC(|7zpSi-ki}
zK!S(p%DB@fxO|~f^lqg9(E2!aXr5!|O-()5_h>qt;2z^X6ZXl34q&aXF_BZdk{f|i
zY`1!2O~`XMAHQ#2_~u_ShJ(AZq6&z}=Sl!p(b7He5OXd}?BpVX^pc77`mWGJ;TBWv
zX{N6_%QsGWv{VH{S#d(M;JWPPI^mnvfxG}|;Vu9>f6AD*Jzt~zbWeHm?$<MI*>ClS
zg7lxaF)Hto8+6Y*2i47<=0je;yYEMVj$u}vwIuy@RNuUG5&1n>+sTmR-p4d@jSNfN
z3nloM<7iA`1NYZJU-V&To;}CKWX@eD{}y@?mrSnXnS{a0SOBk8r!dLw%tUE#B#2Hb
z{`Opecf)bdDiDJ}brkY*!9Dl(GSr7p$|$e-uRsAPC`i@Fq3#{*==cUS+X2&k8CjCl
zb1tMg&!nOB$$l5^SDR>80{2VqmBimw=_wX;|1xvXX4FA`N*d&bIb~g+a%R*dUJXRw
zb8RFkHv0zKE;fvBF&!3l+eIyiK<L}^zMp)?S(PN&#wHQlg49eZ*1pR3Q;f6YHEOpE
z?S;`?nXTNPJmjvKA3avga5>U+<kbGRLN7kia~PPD#JuZ2nFXj$G_YG^U#pB5td|B>
zdeD72%D4CBDS!RYJ&TV#d?-DgV)bzc6{qH<>09xW7=hM|+b|BsW%EVUjj8xK(erFS
z;Zddk&NED)*EpfM;tF`7E^zL-Ho30Dn-|->KPs@xHH6nXG@`}uaDEa$(t!TRU%5H3
zhLxC`ZepbB`1x@$wpI>lKcQSl<muB^Z-1S*zc1fKGF@=+W$~gEW6Jsi%2rdVi>qid
z4J~}B8&xQNPJZI0{}+d&n^%OrPbmW`LWM1}w2K|gHbI4TLwCX=UVEDW?rGOcC3Q;!
z)0Sve(ZYML`;z-E;CCHrep**eT9TO|p@DT+D@rG&Y;evCx-=j#G*DK{c>%P)l>hO&
zDgtlCKPoSGcoF;H!_*w;YUih$2=|y?U}40(*y+BqZMH0x*BJ3^Y$oy~txl|pVM%r3
z72$a-gKwAWw%jJYmDd5U#bs3+E?Xc`A^|zxT=lxnx>c9>ug=P@c7<|ZCvvzG1c`0m
zLdZP6pLzxWkfIg+ywxGDm$B%!L%)sdZ@=x<Q96%IkjLt1xw@gDVq8f{QaEoQ<JGv!
zTOtA~ogtxWF`<oFH&4*t1k^PL|2ZG-LINenve$Iu{x@7i?+VYn-`eE~3Jt);`i6{t
zVP6Jl>O#hdB`LhqU5hykAJr304YGp$v!t+z`(?vtuJGyEgOm`fu8%#_xXXS*6msKO
z0iZsbO^Mr+o|Mq<p>_YVds|8^^($yO0{RjFhC&pl@AK>u3Wi}nPnre1*n4<-Oc6kh
z@2mWlSset{ZPqkvXWhxDo`X;Tt8J}TjBABU`3vRdBI#785Vyka?(n@Q?kjoz(qisy
z^F<#zb7WFMuCsDVZH-^5xaAu6BJv@rGYrj$z$Xj;(jXRG2=(`SsNmmO3Zk>(B+h;#
z0yOcfH!J=GO-5{6V98Nsz}0zdvVk3+T+4gQACN=pX6vRDe=iFi;)Mayp#4&tnB;7>
z#iA$5Drs}H8)h(C<3TwmJR}=l;2Xh=0~qDa;&*=ey?^<Ty=^|Nc&O52<$Y&~6#vn2
zz@=mkXWzNT!4x_f7M0jo5L8=tfC&iB-*`?Pf_3%>So1)=IuHXGo>vV)>l1@dH|&>L
z0kVHBOJL=QSrBPq=C&Kb@24+tK$6(TfNqD20_->JcKe$tP<0{M(@LCHtmzwX&nzMo
zXAb}UVD77YBP9+Yq;AOWaGRzx!>3~J+vWzFJ%17K2+H=~0xK_{&mRbC4{!7XZphqA
z%wB0+1lA=?r(N=HyG%geKyJ3@0Y2o=%YY;Qv<i{#hpq;-`v48s1B%iohFwJ(QXia=
zJ3fj71DQ^pSS$nG@+x;IJwV}KSO0fKQH2=*uIsfCe`D)+fR`+f%c?4@WQn~mE1M@g
z0^ECXPTf55Z%69a4xByl@?D*EL~y$ablgH$d~zF)sQpf_xT26zulO}04;^TB@AmSE
z%Ee%lryw*Fe#$J98HlJG3p{mxt7<=h;v-%QRY%>h@#m9bYl%_MJG}Sa-gGZ5>#a=+
zZkd$i<)j?{(CXcjufIs?x!JM&a1}AM4m4cXC-whn4Z0ZUv;pD=&?HGku(<z(Mi3j_
z!%N@pC<Fo=c_2dy1ltZ4ytx@Msu+PivtxNqy8B^q()WJxKiUr~9zRs)m#ze)hfi<5
z+BqE;)cS^VUhDB@R9VE>n{FqfqQg}NXTc?^x_Kd^`ETLE>C<2J9q>LD5{M;Wkq+^i
z|C6sidv<@3h`y$ly1ujI#r)pq-xxzJ<^Fq#rfeTTU^%(C&d>JCyk2YWnu19tY)bgn
zHCFh^u|wsG|F8hB?qB3b4gs>3k8}6Tbra3y7b8l5uX@MugdV7z-~N+Grt1^n*f@&>
zBSZJ8w_S{Y607uZpvFJ!_pOig%qpr5pUn$*ratTlUuXR~@!wa3x30JYRUh|uWQ_Wo
zU2}Q4#{8_*ys$=u05{o{=oyS^)>|{g>^Ham?snXmcGnEZwyE=TAnf~<a|fl_s!#E3
zpQkHQDBG<>ngacvc%n@dmo=Ao@PU-4{%t3LcD&K%CFz|5gQL&;@h8o;FZ_C#_YeGS
z^Fpcnf5lor)kG&9bZP%s|1FxmbmEJQMn9;ZeW-Ui<wwzuy?AWjm$du*lK%{a-dX^T
z?AZ46D4qQzy+ZBdSa3U5x_RR(@F98QPs0QM?yP>jXZ#sp8Ks1z=6;q(ZfZ}>RxL(E
z{7)NYy9=)t&IK$p{PH+W!UsL;XU7&bicOQeERd;FvX#}lehG1VCOzEhH>vDDcCkQx
z*Fu1%i4B4<ul9ozLv_8m{Vk(<t_Z*yyIDzHvdd0L;pHr0kJmuY2p!QPwV8P=7(hmd
zn@r2vRxiD$K@)M?R*Dp6QfmYy3Y|DM7r1$J{|8+KENAYlSd!Ad6a4o*ec849%Ad_8
zSU-I^*1r(^P}fk8`7Q7ry65Vc{);~OVy7%HZ)%?Vk@%B6GoNp!8)b!4#?ftq-a=A=
zgR=0YrI|vL%dASme9YsmPp1F#HSc_!9Uig<6+&{F)%@KKy)@pnTRd>LVE){_M16`R
zI(72A@x&_=;L2f=Zi}S?fVE8U{0Fjet8)N2g|5UKQ8oKyNCN>t0x5EMYay@vX+U4@
z$Q2I7u;zJWqsqNLo5n*1CaB3r@u+99?vnj6>9emaRGdU3eOj&dJ?p-mCGi4pHdp4X
z3p<v^C#8doZ!uhiAauF)P621>i}C5@13<m7{-3(-i@v~u6js>y?tjYDOQ(Z2^~3}O
zFl{5bLWV`9IhZF)&rlAIodCVyv1>?CIYgW9G9{%v^O|v`WwQL5c8sh=P@?qG3HG5*
zzl|57rS)kt=hS_kch}UXJW#WXBO98mo?9v_K)P(j#_);6CF1LkIw;r90o;x>2qxu4
zSm@8czsFHvZIA(f?Cxr~zC*_VE*T4}sUzkDKNv;f5k5fHzM{Y;c7t?_t@~c8xz(p3
z$-#hd0v}i7IFj&SIcZNnBC&eO>9KP_-RvI<NtQW#d)PH~d=tp5t`#holo$BI8&|}H
zq7F04Xg7p$2=fM>^I7gH2fMdoqkIsUFO1wd%y6;xJLZLIH=P{bedfA;mB%ou(5@+*
zZsvw)wdJUcxT{NXA1V)+%M_~bp!htvFVWAkqv1ot*H_38wa<`ecJCfLm+QW>7JLcY
zS~N7M&e9vmH4<AI%$El4qgs(s$;!fu(?H}krF4H9^?MoY{=t8X_Aj|LcO9J5flHNS
zz*`AP>3oV+tJf9!tbP5TlgQKNyGPiP=?c5(UY@$?aOhELRbC^UxYMpNR)LvVeCAhD
zGWXfsHADpEnkSMCp^YnNHMZQd(Tr|6xUw48G2kF5B|Rt_YlQV5lHV%B*|ga57RLSQ
zh)T9hw<Q_UFuWEWQ3+T3XBpcWwtD(5JPI0|;gbxx7GJYW2mbDTCr;?`D!N-FgiS1}
zblg|YS>ouad9lN4YL@Dhb3?`Uapg5>mM<O<cl2i_0+`g68^!*1u5Q7O0k}I4HnG@s
zH_lG6!V9;m8dqglDA_1RkDoGJ<cUB^nx1(t?32-Eqrp#R(fOkQBKa|7yyC55O2q4&
z2mmaC<ZtJ0X_f-+=1~*im|f?RSzONkO4~1r(RteeVmV;6VU$ZZv{8LM??cfIr>J4V
zc;t+*o~nqm^!?^gj*jRPv9z&Rtr8Zvg?nf7vXAK>f$v)DW@k0*)ADZfrJOuPaEfBp
zqTU{t%rar);_I#P3^ivHWC>A4W!Yu6X-iJ#tuc-xODuOz#G-wnb1ZQET*GTx3dEut
zl9J8I0fcu!EP_pIKf&V9CvM>iEF7;7mD$F`Z;~VYa~@)Dd$vB!a>4awn#DZ3aY6n@
z=&@fY+An9P@Fx%u6sGU9HCcV$JKez#gi7yyX?xA}gns)UYl~YdyJ7MW^m+3yM{%q3
z;%R{1xB@XYfJ|iCOADrArTYP?Eu{dZFt^LPe!u~Gcf^$^hQXQTOQKuN1CX<qZ}U*!
zpx+gQ!}bIIJK4JPO;6aN6IAV=kABLG)y;<Qgg8Q?@5ic)7VI1`SewqCeG<MiaL;8C
zR^OBI=Ap5+D8;xuyM4>O;ImW6jjTG0;=pBaHR@FUyu<6c4_O`xjaeSK=>9KsCP}zu
zKHi?uu8)gnvn3dHEnN8DaP%h{T~60F&1yhan~wX@cqJ8Ie^t3ozEk{e$^PMp;`a00
z8$}J;rR7@BL`Lw^qNV2BH7?)QPUI`ZEDa~5Ik_h}j1O4y7qP8e;w2DjB2w_r9G=}E
zgq)34TR1S-ziJot#$P%+1Z!hr<m(^wrEa!zHJ0`M9j~G5;*@BXw3`E;MIW!maccUY
z0M4-<vERf~-QGT%({uE^474Y1L_?1{JtYfW%*>eS1=xZ}i-_1}GnwLQ?9hJD+As5`
zBY}OB`BQz+KoE%kocZYGywN_YYuc!Sn2TPtcHAnFGX&@AAF5`Arl)>#_?F7--HB%c
z6yV>)x{fGlX}{EFRaV`&wL4tp(gM?KK*lHu3o~O&He0$G?r*b*;gb@E|J*MXj-7l7
zP~^QQf&!^__hccX?rz3{rGvTIgUSgjA2+lcUFOa?^t-m|ZjB1-WY0<E8w!=mZ@W~H
zp1M40uNOBK9Jyf6q4*BC6#Rjmk&f~o-YrCN$54qg6}5G<H%Qqg;#%BZnOC>c)+H@E
zlCGL@uxc5OgMkKhng09y>&yvBh-f8&)=-IvC|F0ot%!SD$2?!jf>pfVpmrguMU^eH
z4$u`~w(>zjIJP|P)_|F8jI8c^5Hay){*}u*Vu-7}($`|;xJ#o;S?IGZKAXUhp?S~w
z&t}t2GQC$2U;?28%Co8MUt0VY&az{po|}?-E<>L*b9ieh%Xx3eh&vh=TO{4ck1BWN
z7H{NWcMb1*fP_Re3lrL->Kjf6H?;H*YDU9KC`rJ5$`;d$9D*5sJlwt$PYtRo^fVQr
zuM%%k>BdwmSHijErt^rNt@xFZnO7$}V$YDUy;!QlzU*^9RJkYtM{D$X`rzp4-SD4{
z&e2*Wa0UVC<hB>ctPa4CfnG}#4{et&lj^fKk0up0pFfBhbLHasx<}@Sv#<Q@A98@2
z6y+a-&fyCDi;K0Z;G;1}N}hD7%FM-()l62$#f(~I0Mh{;6px$ncS;n?hX(;GxSTB-
zd)Up~!6-@o4-zc1pP&zB&&zoh#jq5;P|ho8#y1zHE`TcmZauv1@7@Z#Mo>iEL&&64
z7Oe`W(Vy=3Ktig#2*yy4q;dYsvHby7wFzO~uT{1zGs`E=V}e_oxmHl=ap+NFQsSr!
z?d0rB)~Svt_Lyvzq`oYBuWx<~RsrcLRv~>pe8I{>Z&cR@!g|t5p`(QiVhVgG-}A*J
z2xq-f#mTxqn9NDF^lmrMwpG{6H~Yk#!^VDmfXYKar#ps;e4s=cw98q+&1;rB$_qxD
z>IY-L^;2>E)CQqWt)qkqM1HlX7KkF4nKi5~TCsg-VQj?UC@D;u3W6@Rm(H}=+NfY^
z?uGZ}8WU^ecbcZepFJ!$ma?e0dl_5zyb=4m=G{+kWG(_p6641ntBzx3EN}uKfY71U
z=VN^or%kRV;B1zN9KK;K9cUJOT7iPEupC>m-vnV>p+esa78Xtr;hKZFq9o!=|1~$K
zHkgA?YHs<_Wv>0yv_R`3KwVDgO$UD}hvQrI>#YMe=|g6lYlU<A(9Uz6?|SbW#zw9z
z2{$HQn$wU$=ah|9EnFk6n4Fwa&FRl-!N~*(0k?fi+4Pz5Nd6JqIc%IQq=tcj-*J0l
zSzU&|FbAzLU*G5p)0%4GcNyW$H$2H|Vb!pys{NF2OKPwcfi<}(JQ-iYA{Ng-l`XF7
zq9K7S*W{PNOeLWcEuS(#HW%2Mi&8`Ro=cXD^r1@(mckIqe)bi<Q*Te40sHOvJDEnR
z+yFra(#5so;N#R!ZPi;yFJ{~yM7$LyuJ+9ZLe{-;V>blZ`E~3u>=(|lFX8do5og#v
zXWe90PP=n&**@M%99{n?>2Xi@v*~s9a8YS#Rpp@eR^W0S@qk<fVui*vWw>q+PF{GS
z+#v_Jp@i?MqfTs5>O!Ia1T`?N#3RgjhX?fTY3-W^`gab=Q0vSp{32*Z8C3H?O<g^j
zV-lr+N3(2<R|?P2vn31i-hWsubL6z}zn5B(7Kea6IseC)P3#LfB(%(|e%8rbaoVUm
z7DvA*!%a{v|FmOtmGi$VFzK{*VGF{aO#7*W2;F5NmVqlO<{DXKA#uS{In1<L9s$-{
zxHPgfAZtIyC?p0>^4N+ob;(mWC=F=B^S>Fnr5Qt4&LShe{M-_p4u37&eo!F%k$Q8@
z(GcFNr7;xA5$3>^Ib;(Wki^bv!e!L&%N-@YX-h6u(KXCX)8i`fUZdGAjU-ns$$nE*
zB*;XIcsfg-|2+%ft`JyqZlT1kgM;c3A@bM`9GkZvtyAWvoi*R!g$9(9ps#(WPWxy>
zs>#&hBO7_$A&yme3n5Ky)^tHV!43<udH#Ww^ZxX#a0M24d$QxGo1{%6`-s^e<RyR}
zpRR>?OJ2@GcwwsmnxL(NL-fnTt@5S$kJl5(w%v%CqUMaIGUrApwpQ(LSiwb4I^b$2
zE+g*_#oa0!jFd4r^B}47!T9pFjCNi!n={Ov$yd15#ea7Q6K(!6qLL&7f(4mP#&MDO
zaRT|lS#9=RTALCa0Ee|yfBU{ZpdRDrs9+v|o(yVlq5g#=UCdG^FHT!4Jl}1Yad8bc
zuMl(4i4W4itbXqGvu`Z5pErMSwVXX`b0_Cfw<mQuuq~^dRWK=^**dpw)Y7aY&3M7m
zA7A&g4t>MI9go3$iG~{W2d4mG!Cnx~n$7~yho`Jc+hb?$TTKTaciEZ|EGrQtJfO6{
z|7fp%)??L%2f=&&@yZ9wOXAeYcyZ@4@bQs(-f|7+tViJZFrnV{2n%>Fa2<9;XB4Q$
zG0irvX{azS@~|8K+_rPEI_w%#m8GsD_vh#qF)3jM!H7q!@nZU{@ww*h>%6+X+sRq;
zWcutAMHJaWz?@dapbZ}WBLy=UmpK|Kb{R#xA~Q#_fnrH>^_@-G`85I{;zC4vT3zy}
z<4TRkifs9uG%7}kN$zgP%_(@Y-&f{;Pa{t^aqX6#jqj5SwSa=%K;K~?V{vv)DM(E}
z5p(%~zi>G>Flp}8p>3r(@<FGhsW;e<a`TK8A+QuggL?7~%Q>H8tv72MV%H7nzKXeB
zzgwYVUU*LQF9hWAZZUmUD{l~DOf2q@R?vx9TE<rt!@17lOpxW}c$xAUDqGI=Scdme
zKEvvl2xn|5Dt3eHswEwEO)%B+q?OL(n~A`9y`1RmxyQ}@_X}2=>}&>{?p~M)ki4Ig
zzhjwb2_LJoCZH)d*_F1&KSvj>>Z%T}{}^ZO?+-sQtj)L4OtNoV?7J+RISLC^^T>PD
z+)+YjH)Y(TCwS5tBgPSmSz&#Tdxx%anIUb=^G38f1DRXC?~Ja6?p1^`kDsw#4WZ@%
zYSTP3hx2_wb$NMx&W?kF1par9wV&3xi2=)487FPCbm5>UaH(jPxvQAb>n9Z7FNK{x
zH^;LtKgB0!d}ph9gPKI(TYR_U24067E+4H#>aV$uoZM?8X0G2Q9S7h6x*<?eQiaj-
zxk`qDF>?gkMsyjt9UxCZZ2H-+({-zKmkjTNy8RiG)0@j3YdVmN*%5K<w5gx91Y<0%
zp8DKD*0`ahQiNm&>x5-}1ZRTXN<buM?DUgVyUjyj$>9erTO5g|W;gV}ZprUT0T>BM
zau$EHRNemmS#ExF={2A%$bZNRPilNnopL{1)RW87=9w0?B-c|v<sA69Pq|uwsWqR$
zNW}F@CkT9LlsjYrm>qlt86Vuv{lwtNzgMnKd_a7a{xPd-A~2!pz?~;7WwQX)GJjD4
z^33*po<G?7Uq)8}<9+;|u%TbanSA6hA(7aD!4@t(%sh@vSiRK=)BHG~58EX_dd*k1
zksh$e&nrx@HHkf;2U_{#N<f{p<Hx^1(=Om0AXS+!Im}8NW4&^KF76gb%Md0Rc;(8)
znV(DNn&=m!qhn!7K~4PhnvoFB452B*BMI#aEFkmiLGScin}B_c_0)EnBQ0G)LTl6<
zq(aWeaq(dkDd(^1O{r4q_|CD5q$<k@%VuD0%wkMm<@xzy=_dG2MmYdHDq*R(raFj5
zl-kL1zpmL;<m0<<BJ^03eB^|s%+i2MEg-<0?|3z8jd(ISDWlGMieb@cwk=lC@A5`r
zHZ0o3u^~8|8Lpq>r9my4?{pcS*0CHdo02Cz;r|ties=)mcH>+4H3b{QEwx<|dg4yv
z70=Fq9v{tmVs5bgBGpH+5rCybTl)7(ii-z2iQVo#^$Ng%fXxl{NhxP|S$h?~{`#fA
zrXOkn(+~9sp?}4^J$=jeeBkInG|i;~==^FWjNkx$=ub1PCN8bKqWiY$4q>@Ix2-Xh
z#A52VUMu`i;G(c?sfGZKQ4bs-1_lS@j>(N66r8=tL<y@&6(cE#Q4+xH_pdU?-4>r}
zSXB|oY+W%`sRRebC=WNrE!EA=cxDSVFNL})TQ0H|YG;cH2C~ww35bm=C?`usoQd~p
z7GXDIb;cGifHTYOgUUr+nijNOt;vcbz#R^<X4Vflo#aG617f9xGIQ7ZU9Zg|{w3Nm
zY4RnBCwh2T5+Ev*9|Gz}JGuO=C5s3}(Oqr&Fbp}I$BZ>WG;;gg8Tau_Cr|vqS=PPv
zGd42#kCa~nNcoLfKGPg_5x)UoyqanSk@#@9Gxt0K-~vyXTw(^uBY@{rCR-h=|KWA@
zj{n3Vrsdl{hh<*^jJ)~VKNk)HmD|+d>$$<5;I-Az-MImdH~(h5xzZ=L;IZFrU4eEG
zfBe7~J{=!JdrHfk<#%2&z7yAZ+-F%g!j#l<Dl>&-Kp%x<1{2iJ5O<UL$DZM~Mj>@6
z_2G&!LG88E^59EeX?dqdo2kn|waR{4VXGgvx7(cSr(;R8O_P!XkxU=NO**)zG#$fL
zU5)PUEI2=|{Jbvl4490zs4vflV>4jmkokpbwYcAaM5v+;Hdh+cc2dRte+s#RlqX%t
zO`dEWF&Nair6~A;_VG5s29^)-!6vfIx*dAaxX^LVF3-onsnRCXO4>>YN>uaND9BZF
z>%Q(XQyi0i!|L5i{`Q=GJ}}*frV3zT(IKKWx4a4AsCOS5bE4m4d~w%gra~cEEggQG
zN&hvoS3MWbW$^bty32iFdlEmTPjQ}pE-1B{D<nlI0FzHGy7Dzx>9(Eda8<z46At^-
z@%$qx^i>K#Kb)JmblGGdyLSPIWZ>qg_^MAC^gS97*i4nVYxiyO6`#hpk5+G%ScFtj
z3F#ZyiVrnvQC=xI3JgUa&G|Dg<4WoXSEGV3a>@<M`l3BO7wyNrHK=9N;4?n4X2pO;
z#;movlcVwObRSMEx>iUny{Ip%U^E`srFL!iS8X>vbDAm$)9qS>$RLZX^m30(pzdl7
zS~{;ltla45&E_x2zE_e1Ri_p`&vbaEplv<+$33A$A~MLL%Kx~jc_BI`tpB4rV?5uS
z|BT92ed*k%trwtH>vs%3Wl8vxHsXVQ$eOZQh9SD)GA5sss!(cD;m!1&AR&~$tp#}_
z+seCLMmv+`8&@Mk48#oYC*$x8*_ZEoo4*zmr}Bm^V)uw<we)Q1l}^=2n>1t_FL=_B
z+AWQV7kPWzTwrT21FZnCQ-(Nw++}i`r3w;d{}0u)cJ9#YxBC-EeswV1PVUCiBNBqm
z%)7Dlc`VuiR<QtmI4OS9%(`=B;z<63WSqH}!iZ^6mpQ${2xA#-)PM4go|2GzD*fwR
z`r)4P&ewj3a@45VWQCp_rcBe^mH7;6zj1O%>suB&=Z)<H7iLzI-H{JV(rpE(Y9~i|
z7F~Bo-=nb^@dxczu()15g+Uu8i>-Opxu#Mr-R5stKi$|F&{)kaJqK6FS1~5N*myAw
zUF#Bk))M@M&&<|hCCt`x-H0q55hk<BTZ&&1;?zp;J=x3ntXl5M`0NG~c^yp-C;rEz
zl__J0MO<_he6%;&%j7ziGyZzHEb_WRwV~xGagod$GpFUGL$<yOqc8`m=BhFJe|x~F
zHKs?)zb8&>mX4P5A?vyH5XD{1t2PRT$IDzYNAW7+#F44f?0Yrg6(325D5i5AQGsTq
z{3su;`R@&;{KL*F#aU$E+jg<Gjf(59I~7NSP!&r~wvLXmQ{f!Ef?7KTcT;7TWVhaG
zDdxpwBzqewQZ{wi<?xT=$+0>*p5_dHi#c7_fXp6yt}T&Iolc$wF6Zm?u5wOkL7{Y#
ztapUZiq2MHE`Y5nw8a^%-nq$!_35ly-D6s@5V~l|nY2+tG8D5%Q>)P*6$CEOr28$P
z{|X4`Cuh93lpOvonJ))=o-z7ZxNyi|nn1>T-BU5$%Av7<%hnY-I)B@z_}WJ2J^#oI
z{T$Vy$IvD^V#A<jq*~)T!$w;YZie3|8SfRVD}OyoH__Jra{JPFBxbx?CH>|IsMd0L
zhOKGd%W9G#Uo6&#ttK&tj}udzwx~iJey1v4Ar!Ccuv$;^1S5$~VCZA;t@pt!(~GTw
zZ?6$<I)4Bp;C!)Yd891zT6~p=xGBGs*5(5T?$1D{z=Ka}5Jmm7&8$p&OXnI}rcg_*
z39;&EMB}OvUvX}bjsfZ{LrhSHR@8c+ZiUp9H}LUjL7LAe-w91^F%Ev63_p`_ZtMd)
zDLHii#a8ae7h6s665hdCqg*})+>Z;?kntbUi4*3j*!3Tz>4ib}Vu=0CSc{Ixkk6cn
z3AYg9hW7PY;Ov=9LB#vdp9O|o*OJAZC+XM~tJID%az4YJwhw7;(11_pN@L#plPzAK
zHydV@BR`Cn-LhX1xJ^n7@Bcd(|9%&Y=Z|#jy|xR+?_wmG<QPj#duQXHxTpRAO*G@U
zr8-kVzg9`(J^ynDu}lD^&R%jYx9kJ@;GW9-Pq}Rv<eSzS3pvdK)a^4Nc4S42Ps(2D
zx1jvb7cT&P4+_avwa0g;U)FW-a2qOqJu8rj84%&OqUfgB{y)n8JP_*reILgwooHc1
zitJ@6LJ^W>s3e4BOV$X<mVGx#64_diU1ZHpmMo*}>xk@QU&b=_Wri^`-^ZZSsdHZM
z&+qqNr!z6n=i`3d%XQ!Pbw$5Js{;7=aPbE1<!;fJX}V+Y6<qlQ)^G8&<wBEEUno&(
zj@hZEtG{z!EBz!pJI9z@lBsSqaGLY3CVw*i?(CfbKZe<1#<{uV<P!A&ozt8t_f^`m
zc`dEeA`t4=3S~Gupm^gzg0WJ-d>mbe03rD4r@42vy&H$jALYN9Rc!iUs~<UfUQSF4
zz1!Bf^fqEWd_UP%^V2speRtuqPV@aH+5G1j*wiWs8e-THpEc{fP`;NAOUIF3BlnWF
zgjIEh=!DYx`$W42mb;Z^$r$IQ3vmMRdZhq>%FehGrssn}He^)Ql#CdvCw}`s=n0p4
zfTLX9EPQRhhc*d<!S4*q782JG-nldSF}OIH0?$q!80E@!bIi)r*WjJ&&Wc!{>jBVp
z^s#>XP{8+RLV%TI{6NBC#3u$EN&jpjOM6o{SQxElzrSo_^E&)q^o=vB{wE>|ad)k~
z*$`VMKlmfLA>}_FZtQ}q>1|tL&pJMk5EhUoLkHI+&VBV>HQ7K?0sfc?F@cSaf_d4a
zd`|5J^G|UIJh$~D;g5os-R|_dCGf@KbbB$8xMn<Ow#DbwpgE8`AOD*hb?IPcK<nf8
zbsXHPeK+_rCMTkG-2mYLzD{iefZ18j7mw-In$}O>dn!$!ptl)5?ceH&J2`1X9mDWj
zp}WKx3If(W{Aq0hOmVWdSoA)zBgD$#b^ZfE(`~RhlX4#)ea)kT{Z28Or4+LnG?l%F
zZgz@Yc!vYvU@Tp97iaQ1(|Kpat1Iv?<jf$ehHIo>z#(|^plE?@f}ep45l;pv9fOX9
zfboveb&M)lC#NWoN+6ANhDTwZWn<L!xbwu`g`8)&yyH*T)DL`r3D!nEIy`*@2JxBt
zor^tYFhJdV@pt0^fsxwuz+h}IvSe1QbpGq94rxukPJZ$0Hz9n=#=~(HiYlPGsw~dv
zy*(NKk<4LrHLoy!VCJ}>6q*j!HPk+d>ilaCHhu7_w{ik))IPVTAOr1ZJmNg`G=3a~
zbsfc(R$kk#(1QVA%y{J2Ry%m{TS1qdKN(d<O>hkxb^`WJGno5ee=Ai0xS}J5dnEk7
z+V9t{CFsyb7sJlk+j!oNvb5yM2zggcb^1bHmd=Dv@o*^R0Gg5eR_i49t(u|$1GU3z
z6E&tlixndY$>$-TLEZi`xjlrK85!3zSFr!ix8Z|#kwh)bY><elv9hznaJMh~Pw*|g
z<vc*cy`69QY|OF`X`k-J@Q3DUyIFYJ2mH0-nK?%P)^vop_RlWJ1@A}d8kR-y4=9#&
zTo8W+U}g+2R?E{S`$>=dcfZ;DBJFfr%@if9Ozz}`LHc^(dnx)(-c0iu4ahsVjBNse
zGhgOr<62a~N5RvkUj~IX;$nIw$`!z3xD>GWhO3eFDs981D3{Zm+ao=ZsH)x&*@Qdz
z)H^vx%lItICJA;h$^&3X`Sg_VeM&VQC~-+A$K6oe%h$l%=9blR$g?G|^Qxv4ExhZ0
zy{l+)c|<;my^Q+EHGCTbh)xzUT<SfT937oSL%CX0a;ksLUa)Z-{34Ji#+8E<)jFBu
zul<l}GrL8~9%iFp#n*A6wj(F@<J8pFRaZ<!SpMiRpV0>W`PXE@SFYWJ2w)aED~qz^
z9}mM+r0x~S-UkKnjez9x#|C1C#K-C9*3%&sz^_VO4DLG@#Mdo+qv=rdban8%*L1ZT
zL(Fi|%ujDq^d4(0(lF?o1S+i;tVp_|s)MFVIelzJZSJ4VfmbNZ7Jp9jI&)Xb=v|=L
zW0<+y3`-=uMu9$u-Z{ACz3x1{PpP5)svqbLCS9(#k%3G4$*;fkH2El&{p0$xlBv!Y
zH|ukOL6*7`-VWKHZ(Gz$&zM6DkHojxtD+&e)r@y1HHk;(N|vv0=Z0=myVu3#p?(~R
zsYyk)G>?MG#px?ogM<B4>*Xz-Bo>VKESK7H@BSfe-fx0^u3|TNc>HAy*i=0v`>*lb
z2VCu*{(lb)$nx6#5W8#tMecyL-$k8?FkejLSWmIb0z<l#OiH|{49{2y9a6lDXpw%w
zWyOS-p}#_vPm4uZyDiQw@LhlK;`I9?jxD~atY`6ew=7<pS;z1Sd_K)c^=6e{Or79_
zVf`p#0)71^NjZX78LFPl>+TsfQCq+G+HBZbVesDNdkXi9Uk;6h_39Eg?nV-^&FS^C
z!m?e0>*bx3)1#bjN`^WhbzZ6flpXGqDb`+6?>6jtmEJAe!gICeDYaqxub@1IzJ><V
z4<8`q=4X&93uf%oG#i%3tKyeYx>%uIo=`yQI>1IP=*ga^EzbX&Tkx_uF}u$EdA96n
z)G=;esWQys_AacK-ixmK`mgEO=g*~qu;8m7{9B(Ta<6f7K;9PQl-#4bl~k3_JPBou
zJF5a`6%ezuetGNTIj&1Wu2(9}zP}b6k2-(8v6a$B;Egy7ta>OGwYb~I$UI?;Fb?=p
zq=}<f7o{_vY-;9~Pfw~psqKZ*)t=gxi_esl*rNBGIu_}4izieRfU_`<0oTe~udn2Y
zdFeX?akbrM$<>=C>h79yW!*txpKM|#UdPP$^C4a>)R+Q#20Su#72#gaD?a1ps7Nez
z8#)BbX}aIP;P48}fR(xqF&`s#IxSe|xuYvX=UH$hiZ0!4W>I=uN}}~Jd~jJ`pgPOb
zddVANn?yZ+$iLOqYouXjZ@MRv`WB#Bok*}oMg+7DQbhlp>H52CA>BsdU}j{$nvrbR
z?9<ltl{_%|0&NIXok#JNczNB_eaCHl<2dBKNAPV%EvuB7?i@FnlM-0nGkV2#E3$%~
zx+eLEDdBv>w(I%qd8Y4gS70v`DA-!M`*^IhS*$E2MkE`7`T<`v+O0qPeslKy4Sl=s
z=frStY?}7dJ<cqPnrN*JX=2r~yuEf$Og?t?#(-EYU}l>hH|nat(<P@<AyHuHUH(z!
zj_osD&&`8!cD9y-M+I>UC>m5~2JOST(u^~oc_4$x+?(N&YoVF#^`9zY{97-%E-#3!
zpub>8>ExPRQMcc`o~*+fcib`H&bgp>PM~6#V;m8Go>neneLoRITR$y8J^6D8>9>58
z6btVH$jfi7?vmvWB03#ON)Z-Bsqmnj!&UV4t>fpq`w5TJtdG-0yQjq3{hrY7JNQjG
zL7X-^i07*ff4Ld~>!x<3=vLoFvDw}{JM?REMcH&f08;u^NWSD@3z+Ot_-uU2Y;0`@
zrFyCCo`oBbv|GFz`&{B)Tbye;)5wLKOqw7Ky75OV$la!D4)1NPW?5lW!&2J#yOo7+
zt}D2j^)&mTgtk7N#c`&BhI5hn_TlRNTTeJFBGPN7cw_xri5@OR8F!c$bI|mg2wv`2
z1t|qr>jyJ<93))(B72c%n$>HkCzs{ucU$dYQRPTv?-_i@tqVO`VTkV7UNlgQT}Mf_
zHL0wTL)<wpp!WmZ{!Q3-yGcmttf(`LyGmf`6%zN?#+;t(sS0UWd;HQI#4C_>ynYm8
zJaxV=Divg>h}57M#@(zbl->IVnC70X8tndh)A+(wsmH!zGtQanN6ndfRN?bhz(q1%
zY5v#2+&nNC-D`O~!`;&#318~E;b<aS96+WLY7;Ld!$aO%bR~mZZel>I<xO=AL*--C
zq0M+kRP$U`ovqJgxpqX;Esef=>XQ>D#pwr!t?CvRGU~d&{D|jU3A{R$jJ*`bovzSE
zJ02D@FD_ciS%Bidt=oJ>V-s6=W762nsKCs~7SAY%Ym@C>UZ|PUW1R4wTL|mNZr+4h
zytplXW-`&lN1<PzTBToE-m*x~d7`S(ZnCfb3eU9x0nTIaGTLZ0Fja_ky^|d;`W>GC
zjVg{Te{e+|j`~R2lw-@>cpZY;p0-9BUb7UPjvHMcU3Vuju;AuP35rNen>%U#%puQg
z_KbgP_~PoXl{Zb`OkPBkX}o1vcM#b;6g{+1EQJHTLTjfdAB_sg$oI(Gf1&2oGzT_s
zS&Dow6mBH9so)X7<4w}Dw8Gw~NwsA(wSqw;K1@0Fu*JKKK#%Y&!F;LS$SR55wo}F(
z^sRuCwp^@p#(Gx$^;c*UXi=BT?72kT<BGGCPqtJVh|uG}gMtKY6(nex&zb}3H8PqC
zCHussCcc<toL*nm6n+d|Wy5Zd8cmn4_;5|0yWzdhO?eZO(ltf(h+yZFOLeimmKv4|
zl_(iaP8NKOd~wV$PK?>3oLAJG|4Xe`E^7`7DLE*$qg-$ckJD1=`74`9G+R^}nK<{U
zf+!RjcRM^%`UUzyg969?h@&rf{S{n}pD{df<Jg&l*;<Q$$E@}g6qd9o>oQ2dYOz15
z?P0#bag$?6n)(F08yS6h>C4cX(1Q&R;~!oNmlsqNB&uoP9keu@*F`GS9bwUs^z6^^
zTT-a)w$3h;SanIF3hWe@l)9Nmg2AT(13>M~IM~JwR_>Tq$lqMvlN=b~A`veP(I;Yn
zc7m!|`-$H=nE+}(_g=b|CR&egVIIjFt?#NI&hIXRJYOP+zOea?57kHaqQbxROrH0d
z3MUiO9$ya|TK^i!9P^bWM9jnk^Eb^<SV7C94Q8~#dJJuhx}}DXe%>^dYg40Ccpl2!
z1cixeY8&$O-zb4L<Hdk7XLa=DNE|m;<ba-czvuqfxBXk~GWA&S-4*#f`mX)%DGd`s
zh_|nXoWlbPd3A7@7dC_Oy)k$5#5|NzWdFRBd+9j^sTIR^+G#J_{U%ohVs-onhC-G?
z$wyp<#1NYS8e*+rFi?jXEnvTY@RvdE{(!#2&%v5;Uz1P%O8u(||DHE=F(`e&w;2-b
z56u&ERbDC+$|00{7-nc%I&njq=}V`E39?+G2jk5amt$x<A2%ND)KuKy7IEk0!U*N{
zsU?4@0>rAO!3`;9@!|DxZZiFyTt4*=7vRVX1zEG*?66Hxa{<mDcd(=!(?vwd>mu~L
zY2&~Gd}wAv0Q3rBANkJyCw)(H&XPYE`|C;z=@oX;3vyCoIvbq)Nj+9?@s=gkCYgNH
zPvHexkWXV~4&gst^Ve#3Yj?6YI=^Al2bw0M&A)d=0hXMo$fgUr%&N2ji`}zLQ#!@z
zc4#F_ma`~*yYOQX`ZI^G<&=I;N`Y(Kk2VGe_TFQ9%Ga)LDS>u;K+?ZeY2|gaO?Yv#
zWPNnG#O5=VM&W|GI)Sl4vxVB##s$POxIKegF-Stia4n?gIodZWG&UvQt}dW84niwd
z?p#)0v|*y1w<6ZJkUl1%VO=tRgh8yz`C5Y}-oJGLyc8G0+h+UoJ}(i7c`=r9rUSi4
zH=b3}3%9dwu4mO&Uub3NUZ&lyaUmn@_8QjrdJSEuo~hua#RJ<oL$l)Api@6Vz2j^n
zAR}?SsgqrA5`Q>suBD-fuT0_uFp#fbkNo`5PrJJDTzZ-&dNM&`tJS7C!=)oj{*YAp
zjQQr43gJZR)oW6Y1F6ZvJsimDs0;Yd5Az)o-`J-}t#IBWkMHD%;1}IZl(z4uRJ1)N
z(nKexDlJstx$_4r@7;d;=~RkRb{ltIpJ%hxC$IC+dqw<tjRPBCU$<hJTSS~L`W2?!
zuj!hv#>u92*V7)OI;nj}dtVV6ve=gV90>bPq0hvEo*^JOlt;4tecSy9YOKbb*lnW&
zT0gjL-!k6Iu_6zH&U9-tG^yDVQPkq358EgPyeN!b8-I?JOCO|oC!AMmmSed{f5BJ|
za)hh1RMVPRN0U{HE~jZMs+^c$h!|pvfS<KGJbAfC>Wqr#DwXzemGIz-Nt(@K-r=aJ
zD;O@DyLRZp=854c6=zmM_@b5jeQRQ+e2Mj*Ul8$g&3RpNs$k&0DR4qcmM0@UzB=Bg
zbo+?2#Nkuw;k-~!r((R<MCPZ77e~30ncjN&aJ?q7DxFz$+DNf7*rMev>WT-GguRxh
zyW&xj-NILfb+j9v2rFW%>h-i+dwsRR`ji|DUETW{<_{PR@L=+u9IU@@XGH1NLzhAn
zw&Xf!Di(7U(fMzj{6T^nmJhVsEApNS?{%Eh4qu^*_7vJGtlco|F!+AvQJGlwLEJ#m
zduYI%A&6qt-mtyg_NS3Zv)w<~6wzC*<yAIq?Wze^R*7@;*S(6#>WGQyL`#cz^Q(9g
z^|kZ5E;6xe5uowm=GU{<^*2{T;9MaUrW--8d2I-%BBz?Iq>zLR30%kVNXG>olUy<N
zi1|-mT+RZDF&E6*;4)HAqHq)XeQRUGH&V8JZU=L773UC=k@#EriOZ$LHCHkBeBSdq
z17&MEn5J2mZ-s#pa+OcU-F4#!5TM(JiK;bt>!&YbKJ<1X%2%uLVNVcq?;7{!luDd3
zG98-dy7(n^GEXZc0;0DDNiQEDayegcyJ7KAJm(x2$soyiJZG$uJ%iQ1p=9HlZhJ^=
zcO5#wE4-t&@_LpP`xjX7{kZkl_{r37l7NUQ0n(KU*_qeWiZ>9lKJS7A6Xiz^2<*LN
zbqZjU^Q`f@lvMX2{npBSwFIC_BjTd{=l+QF^TY3W^IUOi!(s06wi!pnON<0J*CGWy
zx7oxx1~~GnbDGo;nTqO<i-OIsuJUYdm&+giQlS(7b^wkktNC*4wldTvF6PpV%S>PK
z_3m=)v&^lsRfe|$Sne!qWR%24uhZsC7Bp0;kxy`A4bw2=v_9>Vzm<-9Sf)|x(yMLP
z%!l%i9mw==h9KQ?GM!_E#>*8a&@;v#oe^^@(+Jjx`D{=79D{QOa`n18Tk*ZfGPT7`
z7K~)b>sQ%vsf|5y5Ahkqcifs4Q(F?pL76&Q1a0hr6CFHYw@q8F$|=K|Z!iq?@(v8U
zXopJ?p1s0wlr9u~dYB3AL)x!5<vh&j)eQjKItr4y!#bsaf3phuCh8^hL_O=sJ*MC~
z!O_Di4*f3IXALHHm#S9?-mGJO*awsN_QHLzW8P2}G`eWZ`*-KJp@qCe7t<>E2-dz~
ziJGj0TQ&1TYVQI+{n#c#&o6k|jPi{t?M;Owlv)L^-aO;O^<j~w1^kwxWktiw?(=rD
zYYc)HI^~BHbAO-r1<_XcW&(&LXXGZ5O)$+ln)3}oOCMJ!j>cbU*1-3QWqGa(W+iS9
zYv+7-*y6NX<+SPgftvW_jDj^6FKUOU-HAbtdpd8xJ@nhGg0xJn4S1ae?w=Wg4@^i7
z-H&$qnmW;>ZR{x?+@SVqA(U?UZKvjq1y`koO1xRyx?csb_GYp3nDUvB;fQzwzo<3H
zj4S56xQ914?JGr+4PtF)9PKv6Z>9`0BxVt6Ou@p=0>XZ)@MHc->W(8<w~{oP^4Ab=
zu^!me{@6S@Gz6^G-NloEY2>9>>Tot|7s9ohO)gYYOL=vhH6f4cAX|J<_!p#IeCtbN
zR6yTvZRvH&UdEAs9E9I!ts(}aQkIDMtD9&WUND_C<m9?S9OCL3-h5svxjAbr&}`D#
z@$mdyUUTKP{3dct*xz{2MhdqW((H&*akLqe{4*R$S8?5`tT83Wj>g`P+{_zp%;-UO
zMeD_0vJ8yzT=>gwV<s!^<HMfgb}n<n6Qks;uh(&dI<Xj~ah2B?1BVagS)b24rhZN?
zQ1U8s@t45$%eceCut*Dd=aKK@L>d0d35iHkE!$w5!jqEo`PUGxJo=RVpXGQZRKg&7
zZr(AMTuaOf3OaaUgk|QHUW;z-%Z+~4<=SmaC@M^0V?{BsCVgAtF5tkutz=o0{n>MU
z+-~u#z?BF`y!iODPZNpf%O;~S64o}%Vkn-{QKWq1S*qgZreUH;a(;nW)fW_`MO?-7
z(Iom@`L=&+*0|i%_9=J^esXoY{;J>j^*f~v4lH<Y$qdRzR61k6FwIkt&b&1X$8}!3
zJS=hG<{-URBKfqp4kXZwG*mOdPvT+FocFFVrKP*K=U2{1S7rBR&KHvBn3`IFv<TS$
zx-slLZS+8#0avksV?pN9y4qIF6h0qaCp2N-wir<<^yX6!e%NfX0LXdHncG1Z|AsF1
zme3MJ4!;x66O$=Ly)0bp=amZ<Gq26t@AGj6JK7=fL(f>u)}de24^z~<;L~j&Mw5rI
z`Myeya`Lh<E3;f|hdW(1$}KO&J-z%nuw|>SBGx^*Vm#q3g(Mr7QuT}Gr71zKgS-Xv
z;{BZ6ALCtbsU_D3zx&$gI%>|qDZ(Ot#vQ{H>LYh#Jgh|7cNn{qMJ|KI{-T(;v+Luo
z)IB|{+M}s-@XycAZM=Y|Q;tAnyA8IFz`y0R)73Eq3elT&wOx6;vo}Q2c=az)`Incr
zk9{36XFE0Y%62>aE|`7lWrGq{{#pro$}#ES-#QP&zGxxDLj{Yu{AXMA=JO}QwO49u
zK2J4toPx0lz2Ksn{Jot@O0cDQ!h4UoQ=E{liYFCUA~{A9i|JiW(kHKDRT+-rL?1tc
zsw+Tv)=N`Rn;s6-%$J9rQh}r0?{>#cvI?;zw4J%;Wh%8F_Ub8|ndIO6|KZ;Z!C2q-
zOy!oY$j7D(Is0DULljjwfbd=Dey-@4%|<4wVx^8&aNe`WU0Iyik5K5rRK86^#zgg&
z8?azU80>KOQH87U6~<CCLg0k3+rXrFr&(jgGGBxz4zkkan$?Ie-;<jA1*J!EgL0!a
zTKeO@-4mGF41qDMF*P#PdzGy`X|fl=UO}AAgP^bT+K;nVqE?f;$#*na+nJMu2%LXL
z%V=y63^g|lgu;J}%b(tbW<M)e>E($%I;34RpNurv4rs-hG;$+C1+sJ9yt0w2tOjpa
zQz37;;STw_@ZP)^@4$izYGMqg%VvQdv^SY)#xw-pMBQ7p!8I*5pe-urGUM=8n*$J(
z|01>hImJKgzcd+uIrSK(%3;Gn4i1WXa0B6&i)V(dyZaWYFG_5alC3i%#YYQ*0ewU=
z7->CH#^bB^L1%{d#A$w0e-i5=>o`jiIl&}-?Sp!c@H}dZYJYV#9B`^!IN()wajsYH
zFSHNPTS5Q4nBP=L7qhjHT;-}pYuxt}q)KhT72i8t^tk~L#q;+q$4D%dH;@ZRDZbF2
z>)>p*mQa$ylvJD{)Jzp|!`V@UxsaGx8TsbQ2~@rCrt6W&Rw^OFPZsaJ@v(jT+4C6A
zzNFa?Gb&Ka6Kl3l@{%An&Xk_$L2M&|WB*RmdmnqH7**b@Xf<%u=~;Xl<&O_!pR>r;
zpm;>d2d6rvUA7rph%NLu1~eR>RUO@hkf`YnfKnx;wa@gWiFo#V+$)2;zQVSOmYCjh
z+nIH{uY4-K+%b4K>@4)&#cI#|)k<d{T`2y5YlnXHSqy%Y+)h(*_JQS}lm_1Yq&n7W
z!(Dx`fA6Lwpl+g_DXO?VYZbu8ZZ6Q18(o5Iu`}VH@+ZEUK4ZII@@7buy!n&{kNdeU
zN5w(w>_zGXV!OZH^bMs=M!IMv=YpRqUhz-$^7>lZJ5*mQw|6mEEGLT$vs}Po$gL1g
z`uo9+L9a+#G7O=$1=<vfYNmX_4XGidfvZu16oNgD3YmYy884w!S@NxKGG{Ah>Y&Kp
z(8=HKQJV5NTVCmlt7S*5LB?(g?j=qE7nAlBCAnd6Ob8Xp+2fbfFP-=-E$?UnX>A0Z
zge7<zjA~&umhk~4liO`CD-#5!6|rl7k@oAGmo_=aU*v}{0)f|SzrS|VI)nG&AJTfu
z@9~Pj8o@s5`8?OYpwvbbi?dr?%~YDpzWLwh+1T!|00WQk6N<mfbO2-mpe^@4?$nG8
ztWb`jYQK1uz`s^S_c$Bb<d_qT>}^???CACqSuu)UFb?N~{+gZM!t@WL9rXFI4HnC~
zV!(=w13B;CrNW*ihMpyjA|I@M@PTba#j=Q31T(&=tc-{)snq0|RpjCYa>Ko3goNWC
zIJUGi=Jte|KL{j$C((7yhg6P5V3Yf$#{|ZK9P{;{0U#&cwa;bm01~eOU(r|C*D}4D
zLvDp()oNM4qi(7H<qm&|iNB`~he-60$sYg5uQ{?!YOqDgdY?(heD{SExN3}ThHAJr
zlw&<oY3L+C*-f_bREl2smgYGjooCx;AGsH;_AXLCWd#Cp^ui5#&MgdpUd)F`Z*wl5
zxWmD!<pmdte@XOhC#LmUw!Gb&<OC!uXrL|~)#V?T9XYXou9PLU*b34S@Wf*vTtUn7
zWZ$&1C1GmZ4pFPt>0nv5jrA#*V6=$UGw?*4lv>_5jvDX%7hLoC78roLk6xc1DuCwo
z0Y6f#mWh%Slk^)~9mx_&`0I$hyR|=wnpAOt@XX)?Z|OG6^K2kI{dnO^03dgIutCyn
zh%bqkgdAedVPFP$?`iR0l}ZV($N*H?yt=yZm~8D-ZBO%G25#RLIvC<h4Z;a?+UbJ>
zWir|EUfvSsi;=vF2IX?5$CM-k`TjieJJDc{D7)1wWL6JH8=V!<`oK;9BfPbf#bh5j
zdLR5h7Pfbc&YOv(H>~QZE?>4&b|#!WOtQGT`LEgG(lecJ#QbGKV3IxK+aQstu(Fus
z6<LH4%2wJwRgS-}U(=ZsAlfD$TV-r!RB0&0=&=sFMM_j|SO{`XL0>xl%kOKD{QhHv
z+-fE8`%bk}UJ}E=J<<aAs0-X<;~MfLnDbo8gHS3>=X1eFM6pUzUOqc7c4@I5D_4T|
zDM6ITSv|E?374RExPZK>SwjGl!k6RKIv(%*vNTnapFAW}DYTUz+Y^s}0Q3=JEhf|!
zv7wo{HV<DQF{t4NZN91On8~{2qm$2c!mseI!r12Eg7xnEEdKRMJ4vr}W+4RG3SMa^
z$RtGR)|mY9RQs_Xb7Fi!Y&yArJ4ukRAJg<i4%1Fjs+EI%AHHFGspm@CkLCSk)eAfi
zoRf<zfRn6(A6>HH5n;qU_{og}-Ct%@5Nzt0Xls{}B{CpHaipKMa4^Q;Io?W##~@Gp
zqhk1=OO(gLvJ0$@ShPLQyZZ6FgH65tN;*uJTE*k!CK^Fd%y!pOP%^W>{QrotPPL{L
ztT<QI<8hc1YfJ$MKY0JslaG1OVq9P_z!3VC-~-IocUx-LY;&{0E~MOh@U}@3f~fdY
zKG|A9*`UoI6uFlPvGI_0`z0G&+{hl>g8*SrlkcCs{L9x9ef_OtmsN(tZ9Hc!8H#XV
zz{01e`K`ZXe0Z1zl=rN$KV|u!QD{E}g?}r(%sUE@+<<pXRc(J3uOxK>k@JWg{}lT0
zT$FcwqS|A!X$~MLGxi6QAzcrkFOZvA=CIlc#oqV1L4Kx5vB7p%F>cMgF{Z}w8$52#
zmaw{&H&i5ij4qm)SGxe~R*F?rd3ZU}-HVtX17%lj78}n)|KY;-dH1t};5fhLC`^Jc
zz^zAypv1)_oyWE!<C_6tN@Uys2?>(g_~3m+ulpm-_91v<y-hBO67(<uPfw&MhEZb}
zFlm$*7aHG?`vm*y)CcrJ)h)AMq=qBOb}FwQ$H2GO(Hs1kZFJ5LyP-`YMfp7KR_dVJ
zx1=yoIJ?F6NxO~I$;up$`)#M+5+sPDng0UTtVoftXiI$7c}|7I*AVtOEmPJc>&B&H
zbXRt|SO1|Y|1yT86g(Sp!5q5#WoY)R04rI}rIcz0$qSKXczB3^9*6O-Ic+krq$+4h
zf4Fs1ZQ|G;m-;hlU9*2??s174$a?hhv~4a}B7z=4poupZ<kYt*m{l38to^xb1pY<F
zaSjf?K<VkY`*x6>i+4u|2nFj3>9q#^3#9q$aA>ct4A#S8=pd-v)GhgmAy(TBts%(m
zhM?gO|1B~kOHw;W;R8cy_c8{$vm@!fx?0?xo}P^X$FC}McTIdL>R`FNS!^br!-}iE
zpI2(cTu1(|m&*ZuIa8zcr@ouO3Cstyns~5GNWhv_Vlr3}(Iu5qi#`TZsDveNl@!#3
zYB40pdeW;c1eEPH%yq&HFj(N1><+Iw$_Ff>yXKH~+jUi{ozH={<%`BO+((euOU+Ky
z?f71{fP)~Yw@Oa;isV3#zMn6@hOy}b=+);4zUpYnxy-*Sg1`F-iPGThpIf7`x=ea8
zGT<LC%OGBp;-<<LDiG}JKR8|m<r!yvl5@;?S4Z1(?G*kqH!h97BqBK&(i<C5JgWM5
zL3fzl&;=I(x^uEsHm6K09&X5h^~&&HF;#*t`g7@mfU0TxokmW&=xUqmg?kLCzb2OQ
zX+ew^KO0N|Atk`T6rxWRp>7s(W96z8q!394)2GmoiW}trA`aQdOc718MF|9p`Qcqi
zf{k}Stad7wk{@JSpO1?DonQYnzB8ofrf{H9x=p>rEkX{w#(+IXe|1R81Kjs_8=)=U
zBsq+KYfC@B0raC|TsG<%cYl!d^kEmkT>mITMXt+VCJd&xSjXakD~@;qnk64Z*-uma
z{i645NQ{)mkl$jWIZaAq%8cv}#}nV-TxsJ|5yWXk3qod;EdDm4G0B?sv{k!|L+F*z
zNlb1UPHdh#Si_#F8W3UIj7g2NeBMtIaWZDPLpj3(fSuLp*DrnoJG8kp(OD6}8fck{
ziZ>5H;LX?L?!g1>^5f4^=2rszj%1mWL!T;&fMqJxnqE&tBK)xB$hd*;P%4sqQQjM;
z)}!vXY#>kM5r3800(#9}@~e-3uwjN(T1n{??M>oW{=DXk{hVJKOPbHzaq>(wDzKFd
z-wlM`OSDVsmfchLeeMgnP*lGG&8%Yf`~P|;)K8@ykAqVf0BOU?>J8+}jpuV>EO;5%
z^HEnpAdzn5S7Y%{@~WNlzm*CEpR==35y;*0U0uxkP*yL~lngUn^e5!LQpuku{rA)E
zJ9tfwRL_$bELG37Ai^FAKuwL~x8Da*{foSI_vDL6M&*EDGpF7&s?et(^$MQax*Ua)
zOlx-1hi(8zmpj+{PlAxYPh8;|_-!#oM)uG+OfQtn)@us&WapCau<o$p+8Z9s<^I+J
zcm^}5-RS`ML5HFp0fSfOM-o@5fiD`cZJj>&kNjD|vPl1`Qz5HqKQBYKy(IsDqun5I
zzSjeOUq{-zTIY7|6Hwchs`%r4zYjOi3ZU65B&#?jPZ?hUBQjTw%Goi)ke$;dCCd~c
zM8N$67=xwYm-)Uyo6+&Wlv3*VT6EN22jT)+`*khuSR7J$a1S&+w?%Fo{j>c5ZeJQd
zu=lA#aKho$8%+M-giCi%c=LaraIOQ$E4$XW-<0hHd~Y7^_5`}<PRg+sD;)Wz%s{Jc
z?GWji-~Eqg_6F!rH+M7&N=P;jgOzEU!LL^>EeQaEy;o0%`CG1nMZb67q=4{z#tA21
zYcY9a>?wjT>{9k6w`l`S1y+FWOc6Fc{GN`E8US9Kll$R%?;X)efWD;G)cEd&y=NTd
z2IN3XnB#nZM*kf%nB)lM&+FSxt9zrMH50%AP`|&Nj>iN(1++t8DAoH9yHnQ(&PBH^
z^_9oTU3*K2KbTo#I%jf7b;?d=PG+DWR%_Y|q=0rmfBSFwrnD<50n(`tDI|_XY_8cs
zS;tmmScxMbb!5pU=RIFjp6mAwz2Dl`wt4|nOOOp8Dn{W3JVwL*5Gae(zrg_aK{gE#
zvbbcOPw`wC28trxe-uT4V2mJ@==<BR{0T6|kb(#IW21u2O99ENNmqcFJ14mzIf*;^
zzv#!PDM?kTSUmrV_MW5gqIuLF(Av$`T;7r({z#HkyB*mv=$QZWa8GS{)E7pr#<IGP
zj*_0z&m&IJSfKXvDF+JXe2NjR+Vvf3anr=3TQnk)7bR(noW8R-&<<W6^0y9Gga853
zex{#r=?Cu6yLqKKDzme*=!a%PE)C|9^W_IH#a33Bi#srb*?)5-CX^iP;1o&qlu{pA
zWtpp2#JR=9Z;CN_jJ%x@BXQEM)k_6Z;UaqJoVr-czJYlRG&dHbu}wxy`v}91S7_G*
z|EbW=3HZ!3stAC?ao<0%15KlXbwQ|dq!W484(jm%2QG0#-hbN~J1EqxnW2I?aID4x
zO3s5NtTJsa?8l+){ji2wR+0k7De+59&vq0rmR}%YD#B(XP^=35Ho15WRkfktbmH}W
zu*_UiN5%=~lc%`n#P?G?50zG^HML4&xb6F()Dg!b=7hfY47pq{-1v0AX7f+4^bbEv
z`s0b{syt)Qm8nV}|7I%si_&#LlI-e;SDCCIzAYgGoZ2D1A6AntgH3;yM8AIpT52bf
zfsEO*+U)(*(Ve@W^;NdL`Ir<Q=Tj6t9`G54S@5*`_-Q~_^Mx?v^}S4~ytcityl0m`
zqrUgp@#%R<9vp;8LH9{}g16w<^KtaLk>sMhE)w%%P8|AdE0;qPMBZz0<EP2M8O1wn
z_~;p)nn52Jd;$<Ga91DvU~}|`-ROi)7eCsFUY6bpA)MuBu(_o-HOtB&lA3S4D`Wdj
zzF_<(7l1Td;X$Ky$GciuX569!Un_G2R=*6%E7zNpDF@@Sj>wQxu_!NDJW7k0N@4eR
z9Qt=|w(}Z8s`e{AUidy?x|+`w31Ji|%tZKPvd%SaZu=vAL^o384~R+S)EZ>e7_@7T
z1@`aril4+>bhxy-=nG<v6kNbqAnfxldVnY)XD)JlUt>x~roVUX(x_jW*8&FvEq4~a
z3a(w5*ymnc$SlNM+{wu$LqVsp)#s3~LZ;VKN$kb=)_;v<>>Lgo>_C0+dgFKF`iX|u
z{4+E1T*4OF&jMMx&QNak6d=RA1Mu5^bFRE9U&&aoI(O@r{5r5?x{B3Z_xL?VUj;MT
z02d^;<AO$@b&Q~wh@}HV*mT1=Ep*E{FE@L>wpkZL-+Mj$i3mwk9KPq@YMM*eovd;G
z(J-Nnx+6*cKfRLMVW!luC;()1he$o}w7yXm!+LylANlr)*lYilLrRlBBOw`GxMOd{
zcMx=M9u7mmJBRNE`y{-Bk`)hZxaR+a)_2^zhK%7z)%(EHV&yywzR|xhtABp0G%FHx
z;Y75@?EEeDr2~0eSJOM;yixB<dwL>V^%fCvqha$UXBMF;Fe*p5rnS_Qr6)BMox1;#
z$golK9cWeZsm<uNtXOfgR-Zu0c<Mq3n-aw}`k;X1TmxIh>lfhg1mkJ?tKntAqXHyx
z;4=8V;kh-~*hSm-ix}65T57Wl!M4y|OUaq>y*=@l6#Lacyb=pYFeRS{ZSQO~G+u8|
z(k^ZF<=Prc*wB!^m{W^F<J3Rb%Ky%H*zTP3-cL5maq^Y?^-TR2RLmSfWQ=ImMo{~s
zQIZ72=vG_2(z^YnIZ_hDok-#W0~!pXy-Ms(*LCeEfG+~<|2x<0Ik;vKPc~jHvu*hi
z*t6-uHQN|~QaL%9jYV(y|BXT?7?Hvw?Y5+1(A3rM!eX6jI*%41{cT>@G|K6k+BGL1
z0I+~HYj3F=YOFKh-ZI)olqe!O7ZQi3oxd!u_KlG_`3#;g6753=-~$!uBQEl@S3Vc2
zY!?_spBm$`eOn@ryb=E$b=O0nIy?8%-Cnx!lXZN@nTml7hxpHV9ROqi&d0RE2&X@b
z&Oe;culKZ<l{JI`_Nmf0V^{V{2?~mu**S+7Mtb>z1>wk6AZF5i*z>CK)n;2XqUAV1
zx9S&nz=1|d<xzp!b#ST2S?W9k-M@E@&GJZ$GECVr1B{RaxX`A)RC^Gt)@x=v|Fd=W
z>q960{t)_#tWiP0{$D^M$aZ-oWySv^efw{l-uYW^4^TwJ2weKfd8r=yG^`h`ZrH8R
zvX!DT@WxgT(lAqE+4BHq+6KzQ{-??@HN$q_Id@b~6;e-4Q(q0FGGk?>^?P}}=0is<
z`}U`Df-LDNNSX%Lu8yaMma-?VyxDy+j6e90LLECgr+i~q4gq{9JFARC<P-bSv)xyI
z!*?HDbW(>};ojWmuL5%~n*8%#{^Q9SBEW%c(u}+89mrpYcMl}i;>CTBrj#Oi?gjJ7
ztjZd%&f7$%0&5k=+x9Ft=HR8g3+!FlpgmCC!2rU#H0!t2kfKLP1Lw!tf#CD25?Q1v
z@>@yr>3Y5zPxP15^HH{p<05rdfdll#$ssm1_%+>^jC*Q<-cp+5m@|Nh9SqL3mIT@A
zd>9v@iB?iK+;e^}_mR-5gtw2*>?Vjm1KhuC>mN@=`r{pHfaV|lR=4LTy_={(kr>Nh
zrTkT0?MheF=tS0p<p#Nx8T@4BhI&a`2rr4#@8BF2fkcoQwh9^Z+FGXGk%$cI<lGTC
zQ$WE$tEmzv;KooPthl2RQ5b9zhfrN+t>b&ZQk*b1eRYTD8_SFcP%|wz3a{~-4TOMh
z_y(_6GbZRFY?va|^G&aAWcg(&y4@ZX_?AGy^m)+R|NEH!c(#4s6r`H^K<o|LJ;Qw=
zovDvHtE1MpHraAJSfy2|z?$`)=}tSK<y~`_Q2B_7hGDh-1(k+uMc@~o!QUwhSaR1u
z3W7u0*+J&W6H7H}0Ez((DdL%hReW{+euq<ovd+z^WmranraWv{!#>cRWUqgkqV-*8
z!11c;{S){&03azQZ{<Y)|6y}~KFr=pO3MJ?n4f}?d#`1}bDd2STE&0NqO~Qfv#B-Z
zj^&bDcKu9?XzUi92lGZXIj#!Y{ub$Qs^W$KZ+ZmwyjN5+mOA!YDo?r^(7N!$(=EFH
zwR7<i1l_=r>qz#669Nk(Dq-u~JDmlf1mVZ~sd~u|CRQJ|+d~BREpLp<zcs8;aa?Wh
z&Hi;9q-8R_R}TNS&G$c^;g|mdW=j)&wq5@6@!fxC2s~Yux%?KqG82{+z^I%)iT##2
zAa{@aqcy^b1t(+=w6Fv>nRl32xR$74xBq&jJMIKqucpEuf?G(m56{_20a*ry`fEK+
zSr*ffEg!<cIf$(R-M5hk$nk^cgpYt6AFTdeyl8EVoa*r5X_q5Cr7Z+lq*g?>khSxA
zDnsRR1^;qI@K3jbYrFyogPG~DdyL4`lm|eA`zG}J?=(vP&l?BQA;4CE2o%~gV!E@`
zpIApuJnD}8<akx1`L>~w*6Z3no0KnHW<`@u`YSFl*+*>%U-4}Tp~FE8Q<lX`J_dGN
zDek6%;He&lxPQ)Oz4_!V(-I?qhvm1(#_!wI((dRKCuT!{#t*X|3TJe;9<b><j=6QP
zW(WZ(7%*4;Y0$b98n?O{1I1!=fKzIi0PNdiQp1?d%J@Lq&)c3rc_kn@W%=u_S$c0D
z2EHF=8uOn(#{a&KH++D{{65Wnf6qVV0*~qF6esB`EOwpuk>1)J%<ZCt@n@zrcID1o
z96+D|YSP2J#(_WPzD9;W=jTO@$t$qyWw;vBmip=PjhO3T6JjOgtv?RS>;;;0#!NL=
zUfSMyJSko0J?Sr3gI{@a6ZPHIfhCqZ`$O>qY@95zo>aI5zM?<nYodF@NXXxA?|CRl
zhWh;KtCasggR(2Y!Nml0nU3w=!?X+D_wf77zCAJ6i0pK{8peM?DE+<mElze*C&2<*
z$)@Z9_2-6MUa&DvTh>@vv+vqt6t*9swg++k;rO3CbYGbH22%jPAR(}mB*jTG#4A7y
zMuq9CSE31Y@2-Vdb2~=YOf^lVF3;>eLOBIEl3!ot|9Q#wK5*kDIFjSD7ov{rKElhc
zIW$Mvn$^aUszg6QA5n2`p2I?`VUam49<3T$-;b`HX>pT5s<e$z*+V~^ou=4mEb*}=
zchd`8oB`n~jozuI<hkwPahf{LK*hx4Dlc*1xW{;G!%7r%IkOXcYO!%Qk@dj=59CM*
zlzMZ?^BPmTi9L%sekQaCh_mwM0$KINv!J>N#?O>~t!IA<^0F;7+Y+e(2AG1}??GZa
z>P+l!rf)>deo3|#?Qy1PhlMROf>pu-iV+yr;6%M}FP{^mY#HYQjkAAQp!iDz-&%nZ
zy1JkpS4QnjVkQe1j?UFViv&0|m%Oso@~_k55Me|a{T(@XPtqpd>yvFt|7N&p7aY3t
zjfNs$y?CV!5T1p|*gF0e5>ZTU$V7|5_$gC=n0g&_M4w@y*K@1sGWZl=fZ_&eq4`=B
z{08fhPIB-KT6<ZyN92H(3xnj60MM*v58QgHXB6?EP%#O77$}4aW(&HF7$ib`XULF8
z#!b<HBk3%^tRz2JdGO{CiP}R$FCOgBv=kBl*LdkKC;Hz8@bV(bwIW?FGw-<8#~~p0
z5jS2+er|(SUv$*VgsK^Fad7cSq_Uu5)9bxlO3e6;Af&PVn8pC;2xN4Fe5{hngC2t=
z<dc8#wf5C1o@U+hvkgD2yE!Ke0tTXl8wO`zpmu&K?px2iotjU${xdauV&X_oSQ0?}
zO3lO@ORj^C*JO=t{f-e+KR5vThMtG4VCk1I$9IPhNW&olqT<z{P5}g)&*0MqDK$sk
z(*h-{Dg=>1qt&d0>4fD&b$^kDsi-8Y+H!$|h*Wh#Q@U3V1&Us5lY#Igk(0U+<C{x<
zP}_DFGFxiEo!#_-yqCdAlS*8uDHs%L?8QLhB&Z;N4=K6vR5~93w}P?h_b-elK;Gt(
zZ_B_P0Y5(bfAix%{R5f%9Us22qf9JK!>F|P<LOC{S@7+@>*N0&F{J58UAKU%Z*_J7
z&ROnIpu@sNAEi*?w%8r-f2*ZLaLzPRqAl`$gf1q&-s|XDkC-D3y%54^7u`+_sAgnk
zs<>7RwrB<<SxAybFLg$Pbg*W`?YAX1_}bHTl7a5@n2QVYbz)-*#IYmW-&#XJz%xTu
zmxS1|j!V^feimBTO=o~3@)BGCB&HXB0y<z!0}Qcyl?w%tMxf*7B{swlj-WW2jUl~0
zvipFvMrNbXl&|FTP8L$JcGPQ}x=JcfW$dLYS)InTjP2UK;M&ng60~tk9LfwfY|0-1
z%@Y0kJ|N>({V0OV&X9CF%*(xPPq^J-l6-1xd*w6&h(!CV)iIu7NCn886YDQzjub+V
zNzu~zI$mCQ_v59&`pL|%+D(Ln`6-W$RMesPwXkT)Qw237;O2{u=Lqz4=#OJyk{(Nr
z%qvsqW!{mM0#ZjRCSwpJZ*^>m+>U5lyTMv9&2ZT+>{(ypXA1!Zm1IqPQw?j0)(dgl
z5b(L9ipaBh+T;6v6-i*Y!RPcRV@vlZi^HJZ&QwoWLynN1Jr{ysIEe*_GSKO3m!vV+
z@(Df{MtnE>WlE|<$}41;5tOl@Ee@o}W>1+OC8(YzKD96}F)9X)mZP{c*$l!v|67i8
zn{2o3e{(;eGJxQOhC;v8fUdw@EIC*N4*QlJ`0Rl}uhtFpE5K4#_!9{}&PM&I=lBb~
z588|tlp-`?kv`o%MRSjYbLO5%l>ZoMiHON`@*_ciM+w)q8~Kz^=?IJh$5y)_mo3M{
z8B8Ph-F{8iifs<Vk3J~gSgTC0burse_iM>B7ggrvXI`1XUL5?iKp&&VWQ|D@G3m|(
zBrGS4xC43VwbY3v&uUD&4*UX@a(PAO=(|{2qHpfvmY_;Hu+-ez2FlmkGf%-l%hsUS
z@;4S9V+iRY8)LymzWNB5!hXPo@a{S!R|uWS<YfAe8C>~X(Q(Q^`*xqE>HXm323@4K
zM^%_E4@ooKfVBJA0VT~Bv0>G1f%(QZy*dr^LEx2S{(2?gI%Ou^E*le6yfXbrNVV}O
zSi=NYe?Rm8PlBVrw;2;Z0TwDbHvb^5y_Dh@Y5GF@`=v*9O|3gK)Syad03&*f2mDU~
zQ9eV+VdsQ5#fj%qCFxhD@3@v$GY(Cz+3)zV+l5JY-?Mv@)Low~A95gRg|++4c9Gee
zVa2?H;~8z(7Ls<RNh{n87mh*e5zF@Dlr{L%-DE)9(z;4~uRfhV%)u*Sq2_pTAT`Ww
zu0zw>X(P2wx@ErHvd08wx&UAnF8I#eS~Zp7>3XE%m>R#WWHd;+)@P`kOem?xnU+2o
zVKqeH#!%bXl7(Q@bO^0qQxaUh!p~i-Gzqt>#|GzGcyHo5rk^z@;ADnwy^tqfxoArC
z%<Ojb!I>eON`$|RYmQa=V@&0D0)vHcHgF<a^}ps0fp284*6{)KhdT)4YkaBg^N8#F
z+`ocNXJ&u`<WVG?3j2PPbmhMIEqrjFmfCtn&@_q(9DLv$mMi|#hp`jXxd@~n;r~;$
zOcutwTyb>wvXK1Ta|h&g(0x??*?pv-z6DgjY=q+io@Z8Hhfi|wT;7R&Pocm2^WXpL
zL<*UOvs2Te=)&6~PrdxjR{p+W$IAy)5awqNK7L!3TjwS=gS}}knXTF;zUd-nQZsUk
z==GfNBZb+%hdRylKvzm<UtN!$-k{y|ortxy4F#J;RWYaA^-1MG4do6s{lx@jqrCT*
zYi3Ov+GRR=sgJIgyasDk?<s@!BK*WnlHaBJTuC+!78je|n@aBPLF5gO9)tQl%_Aq$
zfDwNR?EJS(V*qb$sCp5r7MH}gv$wtEkj6+$PpFW9F@(SgE}a*@DYKOCvbW9yWUe^a
zv=o{BTGBY}4Kt_MERJ61K@KPRb7OLb&WB|7ot;Q{Pi1=8dz!jkmu|Dc{OrWI4QujY
z-Y-ULO&40T-a8WWpW&?Vn>JnXTJ5Zzl;D<m&z_}D>zvZO{;}Dd_{`zO#=3cX9~`bm
z#Ux?5@B&o8)OH5|N@;R$^-g+0&3PXfDlFn*w(-JXCN4q@4R*_<|B;<-ZC&NNY)r{>
zd3G*eC8F(%$k32wcP!p?>9quZ@#>rUR5(A5(hU2tK%685^HC8zxVI+<D-{R+!<FU8
z5*1x8ex2%vNd>jbpC;CG1%OLc*dil@HDi`Jayq8TZQ+-76$fo}hilBYLO|}SG%Hgw
zHfzQ*$T8<E-gs^?+O0gMtN%i$9OdirLtSPbRI%l(+hr#RO33<b!9I=p4=ma}UiUOB
z^9<sK3RNEXm&<+<f#DM6U#|=xB)+Jwqh1br6%&}C4H+D_khf+nOU4duedK!Oxgx>e
zyxPDPOK6jQ+u5&j0-vG7E9C5eF6O;FaIFmrTHg;TE?@r9yfhwdGE#Mj`H6YK^%Fg}
zEQ13XzTers=TE2Oed$B#Z*#cRke@ma+JLRz=wfn{Lw*b&^H{ida_MAF;7-9d0sAP`
zhoDoS`VWYIF|49=bXjYg4kkPlio@stgnb+fVQN3_P?L7x>NCJOBm2V#r?vRTPycZQ
z?TeZTSOw~aEAIV=CB8Gm&*Hg9P`wXWoJ!p0WH!5D)?vUUOpY(on`>DYy-}md3GG)4
zAOvdQ^Yq!RayqZ{%MsHkZ&bl^d#-qgPB+e4Wpu*qX4b@Sicwyk7gFrBJ+3`myvP<7
zr4*m{T>9YQdtuQbjNK=`l-xA3KN#fCwKFm!Jx@dGMtl-{m)_fQ7vB1n%>AX-#d_8y
z^0lYf|DBOZ6Rs}JE?i&ftJi;P{8)-O{MXxub!lHEoF_|#5V2>skejkfQ99TOMkBoJ
zvg|6@)*TJ{uwl05SE7V$gIWs>1r-h7P)aT6)6vo@E?jgX7)j5Y+CD*1zm)P;O?uH>
zb<Z=cE(rMk;p`H!ofAo8CpEpdVq4=5x6n{+wVb^qL?Y(>e?%5G2s5^=DQl&S(x&OJ
z&KJ#;W<k}kCDv_j2=Vav;^pD*8Lfxo<C3MA$8a(*tS5KN2E$F_3oXZODHhJywkdM=
zVF|Wazu-spB$zYtw&8TBjG%{${qA?`OME200}1|M@^;JW)iu)!XxHiS`{a55Qk8a3
z>fJArr3+|Lp>z0ww{tTHW0-07PIRayB`eibcg)9W2&(sqYzso!@}ev?iwbkjOTGdi
z{WnO*>ZBuNcSjSi!!lOg>sv#t-Z;+tO%lr&ImE_mOy^CLoJ%GBlvxa7J$O7}SZ1fN
zMGPKlBgR%N`B__;QS!!u3$f-7G*xKJzHAmDt^vE<VVaB&Mu^((BR2OC?Kbfzao;L6
zt;F89&k(g7`#0n0T8A;tyFHhF7m!v+zdL-H$};rz+2EsHBxiX}=Y-V`IhJ=6X(Y>X
zK|lU{uMj65+zotv-U9VgEjMve9tH{wZ`iaA1_WekW%mSwZ+!xFwxGTtXBHl+Dmehc
zZU877jytIz6Bld>lzgDl`*!(76ice^R@Hqmr2Fk~UE6?T%xN&MUbhdB(ROmu82gBe
z?89v%#0Qqr*@(GGtjzk#$YkpKZohnd1Ob^0rR<J}s)(FozI$@%*6D+8FD2DqL(wzp
zvHD{j=ElRO<`<v`=5&e|i@0kexk!WViSmY3Pp>kFI^D=$W^ZQ&@qO^?ulQb5XjC99
z)T{pJq9U<n$a0`BC+VV!uZ7v*lS|EP*=Rr3jqz;i5aL8q^ECOEssf(P+LhOn9wxN2
zYx<yLch{7B<Moy#Es+9K@)t=@na`nlx)A0M79f46t9_xKwO%5G-Y%gv3tqw`hPOcf
zJTc=3N^`4nbDIz(mo(Os65Ff+b7_mpfMZE%Ld@)`E*jQnYXXnG;3gLC)Ako0u^nU!
zW%OPizxjL?#|By&>x^=Hu;n$GDlqgJZ{8>LS^Jv|ypx;f6qpAGbK3uB1fKXnc4`R4
zAtC^uQZJeO8iZPvh@e`v-%P_gs`vZD#}^-LIHQH4HnjP+icJ8&)MM{*wmWnOm6@P|
z>ciynmf1%N#<+GMhy+cF9~QNym=;}Ppc2uoJy3&ao9S-m0jAeCu?#?}-B4i5!Zn^S
z8<9dIMNrizCa~sS-@dpma3taSWEZ<jb+oPOW}WOFNTUK;M<<0Aws;R28I0x&03-(<
zTEa>P7nxtv3Y7EvmVAAU9Ix79OTIDDs}@R-<y%n8E7cU#C_&t3dy=SW$^Q_k%>y{c
zN>646yYG~a-WlvW_Nx#-(<fy6-}ZYitg_{(J4LGGPFrfb4xlGS@ioVj4h4Q{_Zges
z&-AMLy9<}ZsC<mzkaSGO1Idg2!XV``J}%r+eUmyI2T>HyJ?ba@eCsTaS8NejvOg*2
zUcku2PE4p!cuL5?ViF3sPJQ+IU{r9nZ~LhCV>U1VD<VpBK=MpppTnWOv0&+g6u=hk
zrG!2z2n+E%7Lqm33BH>CF~hVf(9QJ6rx$m%=_S*QByXVFci_3UOA97Q193XtpYq3`
z=oBzTiXIMCzfEc8!M@;EVDK%wT6Ni?vu#ofF;Z$m2Q5BU25*<D)2L<AntZGxvvulo
ziAwDh1xIB24T_0dhUJ=;RGq6_U?~B8g=()0``nu}kL6Wg$SYj%+=mbz@m@O!B;H^#
z;eUsVeOE*Ms2*n0zpr<6(QmcCAE)Mra*p0Lt;!EJ(>g9|S@*Z|?yrH7t64^1Se&GF
z0QM~c5G4+yKUutskbag)(B~CF30>#uVfdgLy(#aWe&=-vE2+NPNQ9fJrQd&hIs^Xf
zEIw03=W#;3zeSBOP-La7kXy`h@dK(rf$kYF4+JQ}4aDj_W$4KKMMqzXu3f*f#s2sU
z6Um}J8cEpZ#MlZvCfs)a)CncsH{1At*3Yj~zv*=!@}~Vv+6V!P2D*$+^}D>d(qYtK
z*iHm<LPb+C_B>hwt=P9)vp*}@8DBzI6Yly{rty{V8j1~hdxE~sGK7?Kdx7~NATBE2
z_@<<xMA}Lk{-U3W$<a_(oyYS+m*b46-#!oU^*?`%OPUj=?YV8#x?-W6Obi-~Hc1{Q
z=@_dU>IMWD7`P0d9%z=>QZt8-uQDG1n7mp7q4&^p{KL=jz`kUx!B>;<;XIhA!e&)#
zYOh1r&P@|d>G3O7Cxw2@vGYRLdoC#DCu@r~C(NT&pw&H3E-7MX)I2<09=Kq^cqwGV
z8-{iKnwbO%`%X^!`c8-v9z7FwV-i|779SW*FG>R9j&}K7LkPtqHm7Mo+iC}z^Xu;*
zf4h%C{SqDSN#!CvRoF_1f~R%zVl+YkjdN1p?k}|8>=ME<KO26aK2`2!(fu9Xe>&p5
zmuU0jd7|aksW2Rn=sNi3Ht4<Caa;ta?>FO2^<U=bx2}HBn3-jvDUamoBtL4>e-qeY
zU-=(Z=Us=9Z#extR+u|a%D3~rw21Mp+qthAdS%tOuky^-5SL+VA;Zb9vdFp;VL%1b
z@B22HcLp0kR_*_)Cvu2r`D)wJ?!aw#cn{73yZFLzm%tEhI(Wgyv@qX5?m;%g($Z6M
zK-8h`3lKl-^|kH&@LHSYf$2@Y@wK(E`gWnUW0K9;X4u1C&*C3qXvZ$tio~PRK3fa?
zZkSh(lMM4%27L(Lm>B5JfVrszv$wJVj!p>!=GJ&4d5~s&)K^r&n>oJ#I(tVo>m_$;
zW$7;JCp;qJkW0_Z4w1$RvR%*$!sy~d=9~7utQ$!p2{0B)+*epTB*~A!Nl<0*eClpe
z!ie*OZu`Hgkp)Y7qz%M(*I0K)^-R`|f^;D_=RSSU#~k{XM88hr48Wfhv16v-5C@de
zj5t%I>e2DwwXhHi1kt_|zGUB*Z&iFqhLlMNQ!i;+W|tGdI5?$dt>n(ojdUyZMKJh$
zTP0k1lHp3#*NiG3a7BCfd;M=O0+P-V@XJ|8<*=#*uM;A0{{REI<k$yu2K_$DNuARU
z_ejHw!f!La1$FQ9UcR6A{}J{bKuxyYwsx$bB4R<JD4<joq(iVEQlrwO#zK)Uy(c0f
z(z|q`A|RkddMBXtUZj`MLrX#uNFgM-FX(s9|KI<dduQS>8JP)r-o4ke%UXNOY7zn)
z7S3IlbNJH(%ME%B+>CftK@qm@VGFSD500(9|DUpibN_C~MrB}6L2IYO)F}t;M}(EH
z#hgAIWi|cab;zk^24Ek?r6qa0i9mpu>;D>9yE*wNkQ4(bP!8nH@cy|FEe|G!bQ&e=
zvz@4ycoYEie5EDiMxbX5sIn5X1)$aJ<EB4>pwxCjeDl#c#&&(`ue2)zxoCT)xn`K(
z{p|fJ^YMoAU?&~dCav3CI>F-8VdCo=GIV}BCvhPd)=`ig?kADo$)cctEJa#J!h_*H
z40!{_5qW7LsUgkW!_r23w^{1K-@yPO=5?=A=pW-%-1k^WYOHL*_mFy8@VVlNwWp|!
zS6AZC`vP1=AlHL`<j6f>bAXq<RQV&v^l!FJ{#3@yJ-xB$GajBB4U0!AXAW+&?Y@R_
zdR*{$@JbnUb8+u>{hD&Cn{uj&OPfbUT4FKlSP<jG?7lGhBK@NcwL&k!^^AolQuKh;
z%0b$_Mx=PPWB7z#J5qLlUehxf;`ai*ZRWXW5(%}2`oT(HhER)3yj&^v0dt^(y8Hd>
zLORJ4@lXVC!2cR?00+zjHa*F6y_(v^mUr^F`)k0O{^vDte`v-PE3Z+{F9ICQDR2cH
z@`S-J1iKLL{;mXJ&Fvj-rfPu9Qvnoe|2Wv1fnEN(46r`Y=!YEcuQ9#bCg@2>#AkX4
zfEA`baURgIeDz|RZ0ZmF_u|ICzKi<2*HE}>Mw)sI7CR&T49)~Do(OgMUz6x!2%Pgy
zHea?*i9^{A=;SBso^sf?=j4-uiaXm8R@2qL4dD}f%8izmW)dX1N(rQ}Vn%egD!7MZ
z{eLy(z9r=nUEt^o@UCRjJa+(5fKRj?h$we-<uVnWpaj|Uf&qrZ)seSZcP<_Q=m1u`
z8yx<m!Mpao0lJH9i`r?<CfPclza=%3w+l+!ZGA+Nu<z816Ll!({!2Twk~V-=a<VcG
zXn~vFPw1T|F5P6lL&f)@cN%aoGUoZ>bvYCD3;9ZP^_(*=(R>5}9>P1=K~?a*Zafh3
za!-~uy{p<<)^Q82d4UgeIg7auaZEdnK|+@{#91r4M$)BrWA<|4+a(UCJ;8t(`01KO
z0*!vBfX}o))@%&){X05dTHa4^u#}8vTNB?p!unrWXFdK#zx{1;04SS5l`Nuey8|I5
za4G>ZMHeP+dr+AVzq0FwG9Ll@9HL(N*z)!^(q$YJ$NrZz@pw-`B2eZEe)O61gW*p=
z9QvP&RsV`Z|Ni)hl8bsg5|8OtfMYz~x3JhbcRr7vSCrcA8BRDidkeMwf%YSV`DyJy
z8Sm?X?XP%=ru3k3!RCh$?$5YRn|A=oCW+SB;b;ltmLsK*wjVp=f4Sm%{9WZ9igN8O
za9ov7^Bc-F1)MFTugj?9GVZ*oih%}&@o6XE`U{xAb01O`bom1eyZj%Ycs~F{@wV!Y
zY1+|+LIT6KT?sZt4&;=eV@#}N4FvrJdcU($w)<NVNC}{OJzL-9*P`WdOnjY_@$D__
zB;`*JAi+z49Yi(XtbGS`9T^22JG_T(iW{dYwYH10VUo^y-luiFnlJPD#|ydB#v-*q
zcYTcdOx8_a2<F%8XKUAJ2;0c1yyx-rqkNN@L}NH}@!U|Emf4N9nyf+8(3gJHRTvr#
zTr@9!ZvmS4d+Ex66v9t19+UtKGa?E!9{Y3GhytDIA`(B^H|ND6j+IYr|6g<nT-kP+
z9o5UloV|ZQ-|sfGC*e!&6h|ZBkH-u>E<H>!!fxxIu!<dwzv-9ygNvv80WIqd_2N2z
zD{FX`ZByI`s5p(m4yMYyGZ*qWUv+&uRXlla^;cdQm2K0y@fn@#4(p(86~H$T=zs+P
zsm8FC=j=IV(g--1u72_D?2T2aq6r|NY?$b2nz(0S0B_WtEwfbH%F*2N2d-_^aU9@4
z!R}@mfGA$(S$PUS8FY;fF3&J^$H@yF%ZP}LeaBJi6X_(6Hm0Vj?H3KN-M<WNaCK}i
zC6^<MfD-6u?WqQ*%NwVEa+U!e<reyx@yDZdw!d8J*&iKO-d&bhNivN5fA;8PcI<7b
z`{nYcziE}lP%ZCBQMQJ5qLi5cN2E17&*pEaPsGlh&A>+H%Agz(-;6f0B&9fFrhgr1
zOB_6Hy{NIQjX_JdsUq;|TMqQbihlFKGh1gB?{)`lp?0kG(8%nueS8q$qL0SkaroQk
zdngMKJ9o>0+q@n;?Oy$zweNe1xY|g>3sgViHqW;9U>7+$1vj-#$b2kY0~Gpo1|zQk
za1_RFpdCa2Zy{5ee|T+YDceog#t8XqTzfb6dh+VO@$4TGo=7w8^V6j*7crY|2bh1{
zFgPc%md`AQ-%Iy>nlYZK`EAI}MWD4h_%0P@t4IEA0N=X)$9z|POo1WVbQct3zL6$7
zJQi(AoNvSu-%PyV3ti}r$_a>_E$oCF2@g5Qokk1aT$zg|W{za6Vfd&L<fH(<+&A~I
zK9A)Xq0h(BmG&M#@m@OT_SBe~_6_*l6X%T`ew`@E?jX|1<}{Ej_-e)zP~v2jyZtDV
zpG-~0pWpSD+k9vHthy2&lQJXt6%v=aG(G-9*7L6b@)5rC5bxTuIpSity7AHS?pHXO
z9g!z=fN~`fe&$jUMCtaOF_?kM;LM7BnF6Ez7_sv%dvr=yk_ZMN`97pm<?E9RJK%PC
z7QyDx*8KtdAzaSu`Nzum_@iHPny<CvGMc~4H*n51c|>+ipuIiX)4*tc$S6)uxz>Z`
zYHhFCgs5SaXy^ON=C}-XCS3$2UYDe-aM$D72O#J5nWnf=UtOcP)w=1<!dDKq@93+s
zw;(K2+(a+1g)G9SSz~2>5JhfVY?52*t+iIP{^I*M_NT-I1hA`CZnMRh8{QEEh@0OG
zYki+7%SX7k%s?FyN<O<k67QQB5X7WPsC4myd&Y2Y8Nbz34Ky8SEv?Qm0!S+xRl@8Y
ztgl(gA_#~^9*NY0Yx+tTx{2BGc@{(dX6TI<eVb%MV!EMK%h&o^({Fb^f&k|k=kQGZ
zOA7hww&zBk_uc2}F||&53q>P|*_^P4>DZC3zm>tlJ-2hwe<o*z=`3GrKq$;?)33O;
zrp@l-7+7gwV&ie?_vaTq-s~a>M^fWIHhCVYYW?MK#^XBf>3DtlWf_>sVs4@hD6sal
z7F3$$Rbx_>-@G3@WlwrYn{VXIY!#YXoyN;e7S$NJ)@Y;~7T(5P5AJjkXdgeM|4zGP
z96G-V#FA<Gg^~<tIl}{0pe6=e_|d-h2Hll<{f<M5#Hj2=Zoegmgeu-~e#o%Z%jcx6
zrO%|}CK%9%aQMhI_(b+0RK~m3)H0g^RZ?L-y2c=#ie;y1U~Vk&!m7umJgP@l`fGmT
z(G^dZy7APpJm>l4FQsrNoMe(>)+HFYwi{ih=kR1R%PtIG<3Qe*<l!7E+{L4RVLYzq
zHvPxuecF7yj!LAnnf0a>2~@*Xs1o}jO^M)F>lSzc*&YaSZ4zG)aZq3Up5KhbmmqdK
zmyrpl@*?|vm1c#wyY|q4Sds~qb_(1x7LTU^QM;h_v{v*%o=Fi6IQ2($dR$W75d`xS
zq{Szjhr1lCDevupj72MKS}iRuMipShqc~FC?<6Lx8pqWI&(0K7X>Lv{LpaN35Kv$i
z`RYI7tP22zO}lH$^1v%>#}i8d8TUw_c=jJ+i~q`U;<VXvGoL>lcK!Tf!@GjW?|8p$
zJUU=5?Zx>oR;&|VMn!sN54IF~FLIc;6&C+a$VdEYYPRO!O3@e)-?^5GbQ!v<EAAyV
zVhIZInorYYuY7bS^(rNKx1C91MNG?4gjFY60g2d(Tcvxu0q-b(w^8MgjP3`R-Dk<T
zVm{vpO8g4LCt^%IQlSTkW6yCD76c4oOK*$g!-o_L?kkmDhK(Pu!AEZ5s$7D`H}lvH
z6kbKtU_V<EyG|6;F|B<Z(oCw93@?qztyC5XwpOd%eLPy=l__u=wX8@cVKn25AVhsT
z@@QoIRlmc4_?%%jPVn6Ep;@Nsx5fg+!u2ltyc=cX-2K+EZW$G$bCD0mvJA}c8b8Kl
z-@kghJkLIJyvjV@&+0A&rK@xcbA@6`RN4o)7S9{)kB4@ysa^hGPrhG5L@f8Sz6I^I
z6tL^5^g0uRl_ARy9&Z3h+y#JyvSNuHAihkA$M+wZQId<_CTiZ#?p<nIl4J(4xcXWD
z9i@s@8f#8`-|wSta3c!yj1eZyR@NHMf!ESqJQdtJ0ZJ9oc_+`Mc%inY&}-wo^LGKT
zc;))3q|ww|#{m!}vL%H7JZHSRW3q(Wf;Lag1|`yHt)032M0abG&!ExMH5*Zx5z$+;
zajb$$5t!EE)B)$~#lKKF$IUasA9}j13dq^jkh1jIf{DUKEBQ3it$IpyyTF4N>?n@~
zUq8hksk3u?&zr^5gsU!;Z{oSdf9G~)=+2g`ec33)R=A{$ujQGSEOetBb34wW6UUJh
zG$BU&jgua{)MFWpK`0n0N%*{_cpoxro@*2wZ2ftGz!8d&%-q;lL5GJCOrV>6x^LOb
zVId5YeDbX1Pz9m^(~OVYc+G4Lhy2$?G``31R6yN3!CLXi+UKq&Up7p++k-5%`l8K=
z167Vi3XGOtg?=-Q!2Inma}iOfm5JKNI9g!r@HjD_R`_(VJgTgmoa`|}jb`+fd~SXQ
z1fJ<9od2?yOab?C=T%P>cN3X@b}XV`@9M7qXLNnlWXFFzU8lZQ7yG99ULqunydc)J
zqxrsvdr_?&%UoB71?{UiG@AX*WWNSVRry4!>5!f#F+ZGe?jr>3Ne^B2vS*w7xbQ$)
z@>c7UmGWP7i~hU|g_hlqmShJ7j|CiP8-tt|{{HKYu>U#u@_3E$pq;`+dHF~+%4<1m
zn=rMNa?7L}1^jCyY2+Bct%qy-ZF@&k$F!rMTlXxx&IsP^p9BNmYEkwt-nuD_6YC49
z(qY4#1#L#OER-xaV-=U1{cip!xSa(#%dgYS6D^NNi$O-gMK*oK0yW-lqB-C`1Hl(f
zh>OSEa(!yj3cXYljw*~^qbRx5<p2RlwNKZ<v!CU9GrVtYy#*$Wl`AP5^cAz#ZjV%~
ze6*W%yGM5CjmIg~bQSEr=}Ub$kaA<UHz!IPlTv8e53^ob93ZV*u6tyC_;CBC#m_@G
zy%WpcI4v-j;sjxUYHfgvHBpgi$eS{>ob#i4fnqxcw+|Ks+3I1Mm3(8Y;D|yqf^FKk
zQ(fi#v~gGU424SEdx>jVPCrCyePblE85cU_uQkZ|gfLN$iZ@xe`pwI$PLe;F665)+
z($q%={Ru;M*#1B~@3eI!8U{$cRmZi*AW7ZG(~OMgMTA^F5qYx@^6<^7hCm~<B2-LK
zf-;BplP_((WIXh)ZTLoW@K>gT=e&ybn9~Ey@UiG%M|ig8xf6)*PvPnbc2HJs^=PR^
zrFY4`8s?|yPv1G`f9q&}m>mz|H=3(nS{}b#<zC#LujpgW+Rb%au}pgKYKDMzyiQga
zCqBotufQ+Tb>NmdzRPNUI$LU(`>Y(chWN>&q^&pI%rsK1eeqGBOdaL+<0tejgJ+5!
zfc18zajE{pfStO0Jap+Lz*&%TdJ7k*8ac6@2kfTGKyyhY+Y?9&wiP&$8<)8^pPlNh
z`W6S*U3Tf5Akh~0RK6BF$sNY$ov?U$^T}bqh8-<T{G;t2`_Eb%Ta$#ZtKJ(q3iwBR
z7^SRyQ{q67dwW~?S2NhAr{UV*EVjgC-3=3pY!hVWCh?y&a}nebm+m}^kl}Nh_$5C-
z*jSa;P#@h%tg&vM8;x(xg$Hx4cM3v4f*{z+D<7R1UlRRSG`rVxntMgNcBu=(Vv-|j
ztjj(=Nl=Qv3qLX{fZk&GH~6Jo?j&Y;geO!uI>{v3e?BDKEiy8dJFH;1pnWEF`~p0o
zPYHcu6;d(=)cQZC4W+iZ+@FOre&BJU$o59aS;WxXEG^kr;p%|WIB1%Tz)4R=A(dQu
zdXH0XZ^BCT<Dp)4l6@6qwEz<oXZeO|B+7@GbJOBs<hQL2Z<@`=4>BO<iPYAc;^BB>
zp9ySHA<pbct(k+CCXZ7Wh2=BR;dImS9Te?tj+Hn+=i<1i8U1>w<3l~M8>1N)n;bLZ
zHrY){A7*R{RCqQ{H#ChE+mJe<wJl(><)#jP<(KP;p%_~gOaZ}fA*}0y^9qvO5NRC;
zHM?;K#+cIgx?0Ox;f5rXT`))x5c4YOH|a8(l!A=)#B8PRJuhWrv2>YyNh0WI6gRsp
z1x%lNL~Jy?tmsR(1>@WkDM?hr=HEo7<|a44m~p9v(}NdBMT$<o^jT2y@^n+(D$gmL
zTJY+N*${D2PS_&g@F6<8n39HT-Hy>{=Hjyv3-=Z08QPJ#nSSjbWv=${N2ggc);ACf
za+>I-xpfYcOZc<}o|NICDvb}5bQdqh+3Rj`)$n>>S&MtsO|C<h6&N(=w6LEnl`B?*
zwQ(R#Bv#?`M>0PIW9kp|^f2K^mc(?l{c<ya%C^|k^M8ad7gK>-cU8f+RpG8&XNNtd
zV{VUS2hr<Q8LXr3|FNVA$S(YCc8V=$PP10M?K4aYf2#3u7R0c$qhpC*6GscYYfNa5
zo5D`e*}^zb_TK~q=|X}O9N_Y`8tLDL?iR15({HJi*{|EvH&rFA9lpj&Cd`#VdA&Yr
z!4~BQ{Y2@EC;>xe@1ZW2{u<-?pR8ew?3D?OXripyLbptp-le#ZPBmQPz|c;^$uJit
zM0TU=IeD<8DyE~Q(`@Q_9kt71vYr?9g6OY`SWybJI$LLh(~1=;v9Rv5Ls7r**A<Bg
z7Rke@N}S#OJ!4|Y0{Gtza-3z--=7FeS38_6nhnb8ZwtO`-aC?U5|c#g7w2dV;Yacd
zSUqUJZpf_Hrz=S@ZiA7cOfREOFB%&}y#lot`7MDaF5?Zh&<qtxmcK8|M5^g-vDR{4
z%*9GT9>^k*c&&k@?-AN%N8?ol-P^+n<u?q3iD=KJwR`j-Yk4KBvKOz%iKX{x8yZ1r
zO1w99c`NMRNLIpF%L$C~d>y;0{J|By?Go0=Wktr5r8qEiie4zEbi(|1)j~U0ku!48
zPV2PsMnAr-=<K@FAQ$3;MDt7X59H0_fyF0xHNCORt*yq1o6P-0|FijX3om@km(nQh
zE3J3;OlrmKM^rp9`X<ZQEO~ZQTk9RWOy7ut`U0BjboP9Apjf%zS#UsF#c@CmAQmTc
z;ID4Qe_NTm_pxRErq#V9HxfSt@&jrqzq0n@;8TvSyUzi|bRDQCz^3=^j8dfoqx_D^
z<@^&v?`;Q84)qjuc;DY4x}Bwbj7@SosYD~G0nwS0$~3`}RAf6pYB0-n`<9d4k_D$q
z|HkT-qSV!*B2!-P=g8u8=TuD)SU33{d$fP@V(&zO28=PsTLERwlreH0;~EXLqb(_v
z`gGI6#d>!yKG^$`#GB4v$KA<leK%cSySmxM;zh?&hQWVxa|N{ESh}&`P(DOoGEJV~
zNy8Yv$jo7W<r(h3)UAXv#x1|fEs=|V8rdR&8ouIjWpv=8M|a9aopr}V$^|bS{jFyy
z<Gl_shh7k8_d7=45Sky%gG9W1Jk@mX@st)&L>LdgtAM?P<2p_G43tDC%9=_8=dFdB
zGVXdUzQaQN`u+rt`5~PkgqUC>XX8zh=J#*D?W+Xmu2v%p#>)gdm_?{b)u`t1k4h0)
z>&u^Pc^PUrywWS>%E;xp^1By+4T_#kX0sP*y=?b2NH+%F)yi4R<*SLujxpR(%*t_k
z+ap<HK{ZW1KihM5dS3YGh|aOOe6CiTex0VH2~}vMn*WEbb=MXS(6|_?G&vtRA}G}!
z?hWq@xK&h9r6E^Z+FpnOHUZ@W*_Spo@#b$i(PnaSMV`4aS1cqxDIBNX!3RZT$38Hs
zj!!5lQ&1ZnN>fx@&^pJ*He??asRZKw?RoU<S9@|X=0TOO1wqVfu<~r0IkBDef*6=d
z_~Hr~9}(nWxaN&JUI6kK*cNXz<P5!MBNLQzb+0Mva`tfdybU;cuXT+AqTBnC=id@x
zrG1(G<*k0m9-|Q|?7N*EF{XQKINM@yxP0$|t99(KT`;Ur$+^8)V!p$=xs^Flb92KK
z-(x;2=0#>h$Ll%Cet4JTy!3{Ysn=}ZSE8z~$o!#D)!GoPUoj&Aihk6}NA4@NN!l9n
zcXDnD3-0UdyK?vZM)jnaHGL(PxE69O_(S@pKcvNLvx1zLr$gRon(KMjY(daLj-<Rx
z_x3j-OzJOT2TPj{v^w4GtRW-)f)A`^UECuW0a|L%Qj|Yc3AE+kY)1d1(&M@Wv;Z)d
z-q0R5pX6P#YWcNaO!xTR|9O?`4yCq5ZzoL7rx-8KN+H(;r0BxW$txs9F1=g3A+cQo
z(v|C7IyVN?Z5%$RaF+@Qc^Fmxphb?>YH809SFdH5Pgkj4p-^zWA>H!xtyJ-gMS|%U
zk96~<jUzE*Sp0xR2h9W?*sTJRRmqa7U_gXRmA-Hp&w6?54=l7p6qU^U0Ssmovh{<k
zKm1D|?9C|9c93Ow%34278zkt$2Ux3D_!(u-5(V~0_M1N^aYKL!!Yb`#K^T1t<DnI$
z0dc|(&3a4O_O15|jCAUnv-crf>86{{`Oz?4LBGUq@usy$$^Xm(=<74xZFr8Y{c-}t
zS?DBak{@b3E+&kX{}!u4%5MK1r@mR!=k|~UPjSxS!B*lc9Smt}2WU15YOgG9i%j}@
zt{s_`leg#~7zKNo<VLt-KOhxOL9|OxHtKa7iz?zrGsisS)!Ij`(3>qsWi7taNyVTl
z)7U4Hw`m3KsxS9rq-WyEY>SK>c4G==c_=BD0!`NwgwjW}g96C@U?nfCU{Y%Ok66A9
z&LNl0qCeHmrB!swq&;!!b7P?}EdD1j67YyjYv*^X?gWkQHGMzaD3D4q8gr@H#VtYk
zRYn4aq`N1PV&8cf6Zhs9<8nKLXCI@#`K&w8u-<|>-iu2KZP^Q{bFyDO=!p4r=&;Vs
zFY~4eZEp-G8H4qic8Kg7-@fnzy^Z20!~aYOQWo3ZCA2WF;QKz|R!=x{!z7Y~Xs(1M
z{bqF>0Y;7U0@T2|ORss~8FLiqtp4VEjd(W(S=!dG@XxkAZ(Mn9%4T{ep@-k~kfPJU
zk3oJhkAXBgqe<~FHQi0u%=>wo@3SD6Lsfi4k?-$$;PbYQIT*JVQ;L10fk|mhS8?*f
z#UTKW-78k=O@kR8E6i&+hIf4g>U)B)0cAKLUC}Gfm!No=lQP0+5~!di{USsTG%QJC
zjO8aN1vE(OJ!@fqJg#C^k^X&_<C~Y>0;<QphHFKFyH+(e$6kIV#_EIJD?Ph(5f{Ou
z+OlYd*Wj%u-AWNaD_KxT188`VKEsPBjy*E@KA~maKb|c^wUe&j!KF)#PTCPB>D&W>
z2AYB02WayH{a>!Z9)AXV7aP$7<T*EEwBR>!Wx4yI`2%k@Bu)-d;AWRrus~I+eYSN7
z*Vd>CR9{Md7Q_yV$W=Tq7V*R!q;rN4Y1otvms`Seoh!BpT~Qv3<{YG(2#;64?$Z|A
zJh@hZQVetY5cv{QolJs&#0^k-!dA^tGL2r^`rYUgZNF_wp-H}ov{I42gXgcLVq)tE
z=iD!ylrOWW5-8Mpok_xI$I8x<Tho$<S2fLg&o~DP=ty6|cG`lq!wQ5+5@Oe>p*F~+
z^={v&g4nCy97hHnl3NSG`^YsSl&wV%f>FDu^AgJJd+Y^b#YbQVEjW8xl9qkGE7r4f
zt|4$Vy#m5(hW#BFp;e`v&#Jo??6=TadkYnd*dkl_l&EmVaZ^vmbviLEnsX8D4A#;Y
z%WV1XwBl3;lv~Z?(r&cbpw6LG88KQ--Rk!*yaPa};=1=A?h_RdM;f9`vU3#bI?T$S
za^ntP-C=ed=l*wzz<<BH=yBoehY<hiHM*G>p<tu%ditz{&*)1-&%r~1ibFW1EAnO7
z*iNje^8=TG%}vR8!jnja>RJt{QLxp^zNDNr>+}>KU`*8raIcUnP1fULsTkz&IC)&I
z!o4Q;j1_;oDC0?KNbY1vdjiTY)np@LRtHyRMY1(ox|Mz%oAY~Fk(C7$Q)$UL;j9JR
zzqAyC?5oOV9M<sZASJgjU+0BGKxglKx|y(aQ|xmqZJtX|B_G{fkY#^@FB$Vi+;D5E
zM`@(TU3t5AGvUYQc0-Zbd6(EJs&>q0j(AAB5t!~m{HiZmOZgfad^)yr{`ai;X592m
z?<a7#Y*l8VUCsFN++hJF^Mzo+7JK~p*s0WF?zDYHCW7@1F9Or5x1@AhYqjOfs6ID)
zs||&PZTnm@dc92DYiiZRZp1#+v{?S`*b<2HDE4bhoOY(rn_F^&hT0Oa>U}q8lg&U`
zr3TkFkl)rtQ139K7o1FiM8`fBGPYXcHjs~{w3kbon&fTg?Jhs(=@d&!s56EEX-3{q
z7po!6_StZmb<yU5B{Ca0nsZ~)q)n$0hhaKn$-_d=Bu^l{N?8m>KXeVzGeB0Y@Mwk0
zju~6Fx(#h*P+h)N$+@eImD=|?wa{XDHa6tE943UkEV3ok1Wad~$qfrLCF1j0!%>_-
z8x!+3IN%@o>;qL`*|lBw`#$l&%_dl8+9iux$xW-Cg;!>!D}`VQ51<jpcYH2khuA&^
z%IssKU%KIhK5;hVSC~&>1b47T1OLoPryO0ULw?u3*8(aIRi`G!i0CC$DM$kMY&>>e
z_EM#Zk!k*c+9ja_pT)IL>R)11(YlT5Jxvt~wDVqx4ZJNrQ1h^hkcW9)P2F-gEN{&z
zOgheplO}vAx}C57QL)OrHvpR-lA9d2Fp0!2_Rf`s&bB%h2}H(;*9aOu@+K9Hk`2;I
zjSqQ2l{{QOxPzj(G^7NC#6ks1-pe~(&+M$M*U1_1Vg8LCdp7tMy#W$aW})P4GHe7j
zh7zUFw^9kjF3S_yW|a;<=01xHh>B|E9=M-S9pBH0AOF7c1X*jh8Pg3L*e$<Q9_7SH
z$#oJg@pknwu}WLWWUlm`t72R*p0{nE)YP>nr#}=NO7nixktS<&;Pf*5g1vKZAtS%t
zW`G{~a$xIImjJ|MV0p;HX2VuTb|g0f>=h-9;~5t#QyQPvH9w7!iwzQ>R0#`rr+#eh
zcaikk9Ok9<cDuJAv5~fMYzrI-Q1J+4nPmG5lF=>08l4Y}JDk;6g?qy9Wb|0yb-s~-
zThk2{pPCmmg8afL9~?n&BV0GR8}W4GGORl=<cqHQ(IZ8n{AGd6Mudu`DZyISB@CP<
z)355uner#(d%~hkzW8!mBHKr^1m<EdoHAPSou*lV(<$N%?xc^JeaME><-I1-C7*Sv
znVtp)T&r^;5w~LR9exS5(HM^5*q!&h$jfWygTuG?0M~THmF-_4YlPO<brdS|C1oTG
zm}NA)KmO!@1Ju7W0(M<!f$qd)PqyGB&@EX{9ffJ_JWjB4Qdytng1dVgXR@n%g3gv0
zA)|5p!-2Dk_c+@sy)7~YNE-nEvWm|tE2OhXn^zQ?tjMR8`KYYRQ&>#!T<Ve*<Ef$d
zfVuS#;kVx1z%~me^Sn7^C+3oP?=oCk#W0q<MD{UQoO|a#vf8#11T%fmFyJe6(-@JK
z^V#<kR|*F%N}Oc_QJ9t%liYA4PDdwyo4Bsb?&{t?6XCh=T`hgkeC!_B4RsCf<(@sx
z@^&;)^?R;|zKE`}OD>kGbn9}1RTnzVc&BeDc@fHNEvDHq$r6Igb5TWZ&hP0YEsMFK
z;u&IyCzp?+Z~Zl`KBFOwZu;QtdGD&ZJfwhNnMmS@Py#|u#0kVUSR+J2c=Qd#GBOdY
zL|Coq{z`3!<jJd%`HIicR)u`U9yeP>G1}2CMr{1~DbIm9t=ePoB|6wZUX9m4bQ5UH
zAR<mxj+PkWSd^f~x%G6fBmsf4P0m;e)A5vI-^z5>WE`oc*}T%|IrP_A=ZRzZ5@46R
zH1jrWEd?duZs_>DGh?oy;FtN!fEH#aQe(`Ysb@#NBIToW?P=pc?d!|KschSTvpe+e
zKl5AGwpZ4sBqW`fhaT9T=F{~*Ou%~zq6YQuWfeZ&e3;XHi_(pe-*=Sb{}LGa!_NSe
z%7FDtfL<B_)C~V^PClSN5++AKzR?4{tuqu3P2^{uSOuk>mugcrNbWEfE_hX0EcG%b
zHT1=C6bn`3;vbVChu@O!mpG>;(f43)OqBA;lLz<lCGH=)^z(Ji^z^~ltCly;Tz6h|
z(;hx1Fp|0<yFzU+mmbCprzlFLat_Nl9hKS_R^L_sIP8Y-;2As8VNcP^0mldFj5`uB
z_s?0A^$p-Uk@?F*t{xL(3|sm`9YBdy#-h+!wZ;P!nB2>*n(2zm-cKB!_!j#9);*5J
zt#>DIW~nbpdz{iU=Uqv70X%vRtR~oDQr2Wi2M{vSrb9ZdQf~rVT)crnY^s8-rhZ1q
zYItc5#Bb}~oPr-~i#z4|qb@N0%TK~0&7&Ir$wU$U_))b=m$c(&I^p|aZnzm`Y^hwh
zmc6VfZBwu#z`Mz67)=ZA%;LkFAW#0FA(YlhZ?HGKn8DI>`9JL{Geb4`DVY+Xz5?^q
z$DK}Tu6CoD*awc#9%flOEq=WA({-njRC-c7re!{x!iIJnb2J~}2-+$W0&MPEBK-M1
zcHFR_?GQErpR!C9Uk>sy)|v1eC?PeC>S@t`9t|hyfq(j-N+3*i=I86XjS%7$qQ$K~
z;U3H^tDy+dkG<W5h-3N2+-=~6U|%i<J8i}d(^j=vZE&=GS#_v2fx`<P>e*3a!)&<0
zun9$cgjZ8^Yi5k`iIn$XB%RqymNPrVGU>4(4Q|<a+Y5~)bIDxH!_z9O^`G=#C;3UY
zXyMaz8mm+UMGbBicrC<aI!}+o&fd_}^wT^O)o9fjEq3-MmQF7qt5Nn;;1<xa6?^OF
zR?@^3u5vIMkg}!#F?*myeB=D9kB9eHhjdCgRRD_`^wxRBRd%0J244PQTmZ$ULPq<^
zhzT;jpqgXzB(z@LY3ns;Z7=Ng-dDTW>vqfRVw>8<^Us?eUY?inA^w96EA`)<F)!#%
z0&R`L_8)98n}~1mV`yTYBI3r2<Z+kIoEPzuBuseO^V|v)Z+^>J-OY8cvZZXx!twKg
zHvNiOg+$eoLg#ZFFXGL*llc*h3li29GjwV%37A5g<+9OTHDhZqYS>m5-|Vx&c!I^e
zV_+e6Qd}v5@vQOi?j&`R<LTjy&~r0NyyEbmm=qf_n%=S$*oK`S!>qh&&@G07^?R9v
zM<DU%VeOhW>?IOJh8xj!(X%jJbuJK8E$ZPgbf`bgxhzN5*K&VlBU=31i&W$bEYE}>
zYpqVot2!5*n!)ws7eYcxc7&cD<k7;-J0jX0h#vc~6@8w&C9ayid7c}RAJ5WH)YWQS
zuxs}E{uAKi1s#*FMWJCt{5*8<)M=}hB%&&7-e?I)6%|ey-rAC8YMWgZF+W>QJy79h
z9T=N^nJcquE+i5yhB<ccd>NL;HXn@$cLW9%V?(6^Yt8|W$0huy)49VRckR4h)3OzS
z8Cu0$k8>k=hwQh!$bS2KnoYi?u$J~J_5^s=ajey0w{|s8%kTuvz8bfW=!dT(vXwJw
z)qO)J3>x%qIjK}17jMv*=W$R$iB!S0n6}@I3htrI8oksY7r}u@jSQ|EDwXpfN24o6
zRXX{`+Nn{!+W1`Ddj-;(H|_DKVG@66$Cc?!n8oakv`B26xI%H>b?Z(|SBY5sg4WR*
zU{i6KEYqC%_U&wzRiypo#dZW)u=B03pLh0A$0y=&YR5B%4DBb;W&RDbhn_;39YRdE
zeTqrBh_1DWo;wnd>~RgmO$g~c0({HX7YHbGYlhq~Hk41#r^=ZW#4&l{3PB94mR)VL
zuAS10&yG2dHyv2C6=HBnpvti<G0YIyy|klGov>dug7*+4S!+r|miaa^rL`1&E7sm8
zmzE|(r18<zDzdq1P5h;srK&~S<DX5=Ev-Nj4vjMR!NLj8UZ(gm<$aDEdF(rJI!m`w
ztlE?hEv4vqI_Q+Z`(|41rfMFaN4wupXM&ELChz;=?k!%0N+{09&ch$WS7v$>ny=WO
zy|MyH3F%H@1P}MBQ&i_Gnul6V*-GO15=2sg3)uRhzl4e2=5k}vTm)K4mh~J@vJD5}
zkA22kp-w8sPz_qWUO3qX<BUsjUCqZ?XHk28jlskyOcLpZqwD6pbUQKBG6KuZn11H7
z3fjsy2Ns`ZS>Y0z&8~IW;glfEMY6DPvVvmuQnNEYL!3MLx{d>Nz4K<3@aX3?pM<>O
zaeDsBoDND}eDi>%_!jSD6?(|zdqJDWb$P?zID|d#HCkfXORv7(v;BIC0-9q|(r#_}
z-|}58q>-V>D^>{VPw1=N|A7sEfdbp?uMbc~xlpB!aTXBv17Nwij=7R~tCs3(6%Y0=
z_^n8_86eKbRbV<}AZD&H-&kN|J2vI8-d(n=mRvM~+naGi$C{+2V=eJj$h$in)ABR@
zc-c>`N1d7p^bSJB^y~uDyZp2DBb8oH{@&KuIpZPGD1Va{Zn{UC#(DX<36xtQ90kMN
zudvj+9*WBi6l_J9x~qSkFr!DbRdScL_E;CqZ|MlU#gSBj9U}`NMRP=*syoeh5%T9Y
z)3>yb_m@2pH1Nf$%YUEI2&Qt-<)H<%7nX#(!zgPdxpEaH#xTq)Px*V^>Fy|Sm8a#^
zt^@NdrP|xIl9n6$YU5@jWtq|(xKr@9bXk_=uk3sqU&X5sUzdz=pK-^zAoML&C9nG8
z*W8wTYri-g;@J*2s|Z3c8**YR@XZffxsJ;DimbUF3K0y)Cri(N;Ep_9>-VhBJph0f
zS$Na6{`qu{u4^`tAjb^ia@){+QPttjn|fOYV!$>}{0T#QAp>~DkAnhcOE7faLRGc<
zw^uPOR{1jhuWn5_l;4EIh#MBS!Q74AS^_YEQ=~>N@bF}p{xraiYF^b30^gsTXTwKZ
zdF*p^+ngUtYV9mIRQJngZa$kg)(U;*I%gQ`?z1;e7Mv*-lssZQn|`EUUB{7xb}c;g
zdMTcDL&Ooa6>}7^>0s!q9?AOMlR_+EG5mVH`w}KMG0xE_F+RAjIYoTFmMuLd`lmd<
zmI?19IW?)A@rD(04Id9?{N}g3rnUOWmj2xFmxKLbU}U}2gv^os4|nan>aHFK_JIh0
zsWwhDt9knrZSppSl?m>4TEC>Urg~0#YOn8W4jgeeR4_7V>YPb{EzbEEYX-WNf`by3
zyueFJ$H(8Mypl*up=P9l)%A`Z#mUFQb34H+2t(mA$DYGqnGhc74t)F(OON(7<}+I3
zSkOG-XM-eu(JEg~qYGVV=3tnibLU>Z(Xe=#nao{pRrWRry!vjf?$sX{R7y)9Z7;Ec
z(#;M79W=PNAt04v^PQx5yZ<97gG)9cSv?(bM31;`RyLa{J;(V;$}{#dYbB=jX1!(v
z&$#Rr=mZWfi1c0z(%k4_m$ejnTYDnsxR8!O3%7WxSigKkdjvLsI5&DZur<u`4ds|s
z>-Zi1-;ZRU3D}|>1Z?T(MMVkk`Cl&bnI4mNvPGyAv}~BjKvNo?^2n)iXy~m_Q_yTN
zPnk@5DkX!<LnS}GSG34kJ#5jP>X~5TH-9H-06X7$!mFN2?J5Xve+MSf=bK3MxyAgw
z#9!QO^G<2kQ{gFpteaOiReI|tjI~(7X)$X|pKGrYXt^vc7I%$?mhLB#Z+Nv96G)$=
zCY`1=4J%txOB@jj<aINzD}DEM=BYC}^LMQ%?O6!aC3s<JojwUUJ6YhFo9eQBCF#{x
zVs(iFYP{sqRKDg?tR5&G$_f7rtWTwlUZT%4>1Az~1M|zV#6aSwe!*l%>_#@saU$d>
z!#mA)&MNt;CO<X>_=kI$Nf#G^+6k?ss7QD-r`%}^C|qn!7CK0?W_j#`c-(Fha?c{c
zUYud1WcbvV3O%qE(L9R@OJ_g({+-q{M_sb^VmykmwzPo0(nD@4D<S2XZl!gADXu_u
z<g=O$oVYedEb&1}OZm&N?(3Xx=|dZe=yalR1tjT}xp--*{dn-oO<I47_)X5Y!l}b{
zo*;yRXi--zN3CP<x<^Dym;K6I38Gqn8Rg<XzJ^F>w{vtL1*Z{*4S3_GVli!8LvZEO
zovX0`Uns^A&I&A0>x9i7n7a!?8Fuj;%o0-tEQ>o0Mu>Or6^SkZ8;hc3X#vEXJnkeb
zTRQ~n)0Ri-VNb4<ThLRE5>uRjV~=E{M(jZO>pfb!0IPK2b9sZh>zKi0pVDR|^_FyZ
zpU|B(1>XQXb?^TK>B<5-5g&QNLyk}UyOB5oJ+D<IPFfR^V@>lVNss9A_|@t1h?0nF
z(_@n;0KWVRyCa|JoY<KD$Y=9N#p>6{E0wO#A)Q|Apc}E_LqS4!gTSKelsPlnq-w_(
zsqV7NmXD`@jm?2x#2&tj6x$lP1TA-uHhC43bl6~xK4}0GE!*Og%;~8nhE)i*POxD5
z0<a$UidwhEq5R_hc+Z3Ms$n?6N^Z`fh&rwLUDNkvneTjW8u1sk{UoKcVZl>{dYD>-
zQ?;GzPvJyA3=z667=DCe7h{|5DM&kZ5`m5KaZoV05A`%vs!^)!xk8v<XccENWu2L>
z5+zbgr1mf!DJ4qfR%;3qbA@ng6wIajPAWDIztzR-RnRjmF9yA6ATA>onbbC*<jA@C
z$)u{xF3JKd^xGuuxeUzIe|DkzCB5&IkOI127+vF3yB<eZh=`o8l2J7Z1Vn0Lv+?KH
zIUM17wd9`V;d|3_(sB&qc}*3J?84L!1y(pJmiut%lvp(r+-l)+WZ=VWcEoC2HqP(i
z;J(I*S>)AKN*f!PdC1TtF}0eKfR1H@QQg~YIn!~q4;-o(HxC&(DW_LrR&o$NOW(^<
zgnBIbT*I*%FLy)qasX9A-l?#Jj6b2}uEYBdzXg)GqI&flAinIyw5K&YLH#97d)fRH
z_P^&a_2Pj3<kA69wk3w+)gdu{y_^0TudZo`oq#uh2t(y72LO~sR6|WZMOELOyo3)E
z$BTsOYR<zTHF(NVhhdS(npeuavR{f1+iT7DjGcxg<V`BJYi?d$!?u`t5p%G_ftp6n
z&-m*Dsz@cD7=^NB(F$Skvr$c(swEy^q4;7Mr_WppdR&ad2Nb;$?Kt6j|I=fuuTbd}
zHG2p>cJzZ-@+E|^T>m)!=mlx)8t)jq#0=+0SQ~y@xfM%exwgPf>~hx_<ZGYQ(<W&_
z^8;4WtyV*VoiR&M#@rk2x465buVp!ZRoZgujQR$99^fl$5<aS#NS_R!R{z+DB~1o6
zJ=!d9;erb4eTZmc^8&XbtO+1wd7hDggA3=JahXWW(!$gkO2lfkVEXVSN|V>E5s_MI
zjcnnIjRQ2_$-F?d3eLL>okMWVV||$P@hcu&La4}+_8)8F;%UMO9r*J;LY-*UGW%$@
z^hr?OMSJabw^p>6@fD2b<Yf+Dt89f;(c;8$L182U!Gis&DsAV0mm1)-p5{?L8Keyg
zOPeV`w3o2!?zS@;z^0QuPzqx##qyG>fAn4*b0DQXNjvY$d}PR2l%qL+0_U44Xy7~{
z+Ptt9k=L!_R|uPzjFP};>PalPk|teP9ksVB@rDY{Ov>>aD=!$4c|?m@E-4G&hvjGt
zqGe6Gg(>xImZe1q61r7Pfh}&2j4{|2UfMh)J>JU9OWx@Xsczh(H4{{R?{w<7{&%W#
zC93%Nft2dT=QYla&8#O~8e$b@FBgA&^IL$<vn?<}K{d_`jR~!6VrC-yuSC?CV~{Wr
z7BL_pgDbPMH@||rRcpvppax)+AsM7dl0B~{y3={Z$0{N%h4tcPhA-<=v$^Tl&031@
zP@NZ%Z3ueJ#b;x_qy*A!X`HeL*0|79e$mze(3qD-%!%xzzPnGg+yRO}DWPWi<gEPF
zaOAoL!n0m{A<Ho7@L`^2LFzul|DF2+@vU-|%SSz-14ih`fPg~$)T3x6onVI^O}QnY
zjjeMy{sSk@2WYX2%d;mAg(oi~E==6CB}*=~?uT7aDmQRH>fS!Cvw6-F?R$^iLGj|<
znwma&=LhfPyv+yKC;Jc{>rty?E>~GxnHf5pn*uF$#kGZ$C3f7%WjcGLI_0gH?9!Zd
z-^6X$IS9;o2mQQjf76txKM1oCw<R)1MeZ%8ObYh<2*#29;t`;=&T7{0)|-CI4MJ#E
z`BAKoDw#cLq~;x0-^gXsg61)&CLXk(GP^tE!$`ltyL4%jvr51U(sTFIu49r|ki_B3
z{dD>lt2=c=?kkS9j#9KNJ*sNs!u{@ZXQMyWSc+J_3s6jJwxHhA-po$BqG%~&n9$tv
zV|AiN_1!U!&h_U@H&}elznNwvgW%>vE?r%F7kDJJFPx1|&nYth2o-#iLLxR(9yo0B
z90Ff}HGis+pHF+{0#i-U#NiW|YM)5I#J^?wO_OL<Li+(VOT0<-nSbKIi{D;D3uG(r
z2tBE=7OU)FRo}o2w=HkMDloEUM$+rI5sz#6l-_g9Tvo(SMcOf<rFcI=3$fhms&L`~
zuf0lwP~^{M0wKDbFaIak{BKAl|Mo8f3k$C?-(%9|Lj2c$X~TNN-N~VTCP47i>wXg5
zAiX`#x~-pDx<P$-mbJ>71X8oZ5UVLiz?Ooz)`X>m;i6LjzxzUjK=Pl<w#WVO9Dt_g
z^KTEc)3{2koBPv;DAVOhryLGg=c@XKDlOjior;v<b_FTbv7M(Wo19FLYT_SX7v47w
z*$M`qH4x&M9W$amT=CkZrE(-poiusO+fcUl$(|bZ<VF;;tcbP5El*dWSwCWx&#XL<
z7wr=-cq5Aa1;4)=rYadqjump9jm%{{I>F-UagzX+;yQF4hL*c=y$5vBufZ2I?Hnea
z&Zd0Y!T#d(Z5IJR-&#0prn?AaN{HZHJdwXkS>ZTG!`+7`_JGUhgVdYZ*7J-R>hNCZ
z96#}-Z=^w-IXZ7k+vGT#8f(w4*#k|-!p={<z|y9Z=|gjlSxBRT2J^F?&$%Hsc!R21
zK<={2d<7h5NM?iltVvVF+%&nByLHPYG5|PBhZ?oBzL!tE)Y%X0Lp|-37~E-pF4))p
zkEaT9wEznz<5_mG2KzFOR9^XhN>J?mkr}?4n0?GT5Opv7KOJ>6d2clEAb0WB1$>zD
z7p`^BObh0+ndYy4n;=@>{%vbQXltz6A|aL}_EPfjN9BS&(ZI)sxd4VXuBs65H(DAL
z0_Yn0HbsxeK6AaH!C`@9$*R7C2-W>!La#FQ>>l{=YS$kt-wh-lT*&eWo0^rYzTrrM
z+X^k&Nq&}W*Nn~Ab+?BwV<}@r=w<}B3Bk>|v5x?U6V*$-_A`1Bbf<Ze$4yon!phhT
zSVmu>qw(_0VcqZB*Ybxj&c8{|uKl_@FeQ6L|D8pNb3%6}D;Q3iRpdH8b<t}V=s&+Y
zP^|kZ%x0AN{30d19Nxz0pJL|h9KhQC+PZ|-;?z${u$No_!_3gi`G?AG%60{i?$;u{
zT@TzY33i-%4~*C3)}n<J*!9-u{l3R@oULKE(mw^jf2#)Wy!o2GH&gh4J_|-Y4x0J3
z>NgvLG_@84@~>B-KKUid9LC#WPM6*CK~UHpH-kFlu-yqfTTp~I>p3^aUno}I&30=0
z8Mk&AB?;Jru{39l(>T&I0LC=8p7Hlw6S_FfwlyW1{+i95v<oq#<9j%J3RvHl1z$vX
zN948A=lphJk2_{LR%SN{ae#yPzEG|G1X^8WW2;yRK_*O~1XwHMZCse-m*Se~ZV&Ok
z`;A8<p=Yxtw2^P1!CNj-ms84c&QCw=*Sfd+)Yp6d4;n3xc>b<$SWvGFANr^GcH!`x
zb6VCVxz>jr4}XpwAv5%sYaL3k^{^#UTa9>gFH(2>1gL?H5Zz_5<qtl$6nU{*wRvyD
z1*f5w^2@dF#b-jRAxwfGRFYnKexj&1ty*>RGCrDOlz<vKC2%?)aF}uXLDe-s0{jD$
zW7B`d58|)PF;nPjQaNM${Yhot8X)?wbxVyzY0%I68Qn#gGxzhn;>QE+Ec`WQ=$`K%
z0bDdhsnun45ZO6XN+gCq|E(G_cCbhtQVO#;?W)X%ymQP+8F;MJ|E%x+eZ04vE*1b(
zmY)!6jsSRGm|`>q+9`?HFBy#1<8N>AS_)N_J%HJ8G3_VsG+NTFl6vl(`l`8eY)wVL
zwyAGuPp-d3%O{_d695*1?)_e_$9Bz3ubT|a_2H9(FXH9b*qB$hNP(|*i`DI)-Lq9E
z6H@)21F+wJv$d-Wul0|v3rlf>nx&}+(B+sTJAcXaMV_|-IHw+Wbm?J0@@>~BdGeh9
z9=At-><d^vmjIjB`s+g<ukC#QFIP-2#g`(;z7-@H9CBR+3_p2=pse62j3(@btqJV^
zwYSRaHH2_YDNyGXunBH^RDfdhz+c;fm|a5tmOv(Ys((B4ptj&Lx`)GkJs@BlNJH9j
z&{&qA{d|avRx!6gx7=5c+BYKDW@K3Z*=&P)<UOWrOLV7k&hU6#FrV+i!;-iESl7MA
z1p!w%kpEw_*?4@>sK5|?OLFNU8#jO1eAjF_QaL$)F+eGOPeb#t*1|zY;JoTUBZS>z
z^_gGVWM7>X`!&B>9>!XOUS_CH3gTlap~4IGrsZP~aHTL`Q=P;oi6#XV8z|HS^Ahl%
zw(Z+R)QacV#tTw3);Son*OX!B9AWAU2%pNw1%^p2r}vK=T&w`5#2}ASff^teLiFzw
z97ZbFJ}=5&4|8;LewNw2veMTz>*+ktJ)lyy$ZhJ6tXw?p*V9~8kx4j?KDq4xkKphr
zVc$UHGG4e7N<9Lf7T?NLc<)#=b5|dchemV<g}yo=Cd4sgOr7EZ@x_}if#vCuu!16J
z9Q-snQn)svSZ5>5QS`So^poM38htJM(QEYW4!)y!Xxu~S;%WGo&5SE7o<4ihX<!Zl
zxc%+v&&n3tkJz{YBqU`p=vaODZ>;d`A#kX&_9~~k1(8uI+^%Z5cDGHAb2q3sWlH$^
zivy7OZ??AcrkIm0H}A|r(9~YvSN<IN)X{kN86RK#8+@=%*-Y_v5M(Kw72R|2)Ys5G
ztz0P*)l8r=V7eJEefuwhW?hX!4)Z|&*xKk}Lo<-+jZol1HG2m6bD>)A1`jW>Z8mnn
zo{h(Ei9bD#Y!LQ}uRaWFZdR2!tU7&_Cop4n_Ub0rQo_GO+4Ns1qmTZDGIdt~$})}q
z1ImE)OxHM7sK-yee6xoJw0vHPpcb?Jkw9aaQ!Xv?AE@`f7S-;STy|LhUT{VEA@YXK
zn^~sT$C>TSkI+~7nPW4Kc!6-+_c$mys0CcRC%5_Qi2XNk3w<&Yy7@947mhQSL>1KD
zhOYBF3X4x?BVRA~QmYlsm{F8gdYI4D2ix&;;uINF!EEWvM&&Jw6jTd+j$uTs6|Nn0
z&o?P(c+#ClknzeX@H*tzD?N34B|@W*iZPl58s$yE+_G2D-6+5qIgT`0=-Lf-Jq`Wq
zC}d&acukf<veluOskZL>$gLSh=f!yHwOo_Cje%1$fz<2Ztgz2PaF=6dPiEQ5!^Nj#
z&JK8k-GA}hmfwRPkE9kj4e9;k*6IA+gR<QM`bV#zhoc=A+2l9tZ{q;GH4xHpLHW}~
z#~r6VqP<ySaV=mr5_3Tm2%q2|4vF6LZ`;1HN?(p^G%mDlh8z5eq&~jpI_#Ph(mB}~
zyQn_jGgtZZ;$^JoC`s<n+u3QZp7@mz81o9>Oc3>ue$Omu{*42HjoI=O1Y8jbD&zHv
zO)9e$W|v^^K{G)se)Gz{?d9*Bj?E^|tk`WF0$hJ%ElB^UiG@(sf*?M=qFZyzLf+vQ
zg<1<t=ABvbln-{CsfwWvDx5-}1UE!#5Ol7w>>_P}t*1A_-`@YIY<dcaQ`sn>!UYb_
zl$E~k)rbDNx1_4SZ{vcx!2`WbIW_~>ppS|Op8Ke_p_2nF?jte&QxI$RD1ehwY(dob
zjtmeQAlEmy%+5J^9^?q$BMOe-?+PZlzjtYJ3tKrebj!`;-;I_OvmJdDN>bD=R6>?N
zLW7ayux(6Cq)0nvK6i1k3|YH&wa0Tmkt;>CEdz*4eG#NXf13{vrT04nqlA9+>7u2|
zhc%3EaQW4ad+|`X9`thoh@<nG+SA&-#&5EFw^Ch@2yIuw)Z@pE*UR@M6waL_sBWEr
zhgUgV1fZ{#-pDoCDnECD*yTy=x<x^@21V)HEx;nRC_dXZIl5z$A(_HjjnvmKVERYM
zv#i2H&3^j<4EP$((GZ!fOlGPrK*`wLK?7Yo@`XnDqmNvtw)e1^aImvq*tqYn@L%y7
z&%=vAdQy8w-N0d4YWv{>Q10oha&Q|h&ws!2Wd|(<O{~>s@00;pdE57lG*$XjXlco2
z#vrNqLTaQq!Ghrzj5=fB15U0tppG7_Jqfh#F3*Hit4#7amgr4t16L5NKmxUsqy&2P
zb3s){)qFY8VYU^ZOoebq<0uX;LbpG@#_I@>k|bK*;e7OwZ~K7bQK#2}LOQwJ&Wqpq
z16I4`Pc7aAYOKP24F<Vv^xk;gdXk)V$n136`Ng{cS}h6x228XLBt{L8;ny~OuhaBN
zE#9@IXzd8B9$6fsx#U~7eJktY&o^BPyPI2q9CaYX=>JRnHB>$of-FgE<(lnp{*}MM
zhPB}NDYFmUO!7L%nn4!%0h7AiJ1&3Xy84h~zjm6$uj+6`igDtwNu=4l;y>57+BUXl
ze~(fJ3;>?aSPb!4SB`wOe-{uMUgXvMa7~xJiNk^B57Ws1s>)Nv)x6HlP~jEei0u|?
zw_5x^ja_+MlIhxZ37IrSGsh{{vaEE<EE948TP-cM-0HYcmX(%UWr~SPR_;)iqYf@q
zr*vGWv_vJ)+)~F~vqeP#moyb{0R{1UAp3piJ2P|6$KT@b<$3Psy07cH@AtW#((PDk
zTzSl0ij0xr$neX6f=2p~XE~#fVbjAlam!lUpw__I)<+1WgJm@MW$kor<w?>Q+H4cd
zn;6qhJGZ!%+qPfHf4~N$>l122=N(8x-%<@$-xN-1UXWVhu({bX`+&jltJ*2EeJ%4T
z8Ks1H)t=hDoCBcXI$!Xpj&O6~0mXh;-GJt>0NMGu&KnG^xXdD_Q0yhCyKxUIJ!~Ys
zG#<y&Fy|^RowY`h>pfh<3n$&ny^cB4BFo?Fl%`TV+9)S1ULCP`#%X&+0o~<`Es&v1
z2i+?WyFK6*i3++2;zoC+phot)R<4qUY*Hfz*Xg@OLd?xb(Phcm2wkOE+3-K}_-~mI
zmxpk8>7^^7eg-Ja!~Ivu_LE{ppR;4h#{4T=eaQ;d9X%r{cAM{Nyrcib>aJuxZY%+J
zK;9gm`W*=s<u3zKnL=I+FE8}G`s@v!*&(kSl-Ul&Qiv`bayyn0&DTY;W4O9hKNB5B
zc8(xP<UXJ?Rc%Smp~M9Y$%aS4l9&hk0xAg8Y%S`QjA^#I$k#iv&QQ+RvttJ*+fR4}
zRa-V|`+CW%QUs_?Vdm=zTLBwwNKlBK9;poh0k+`D^P5x$Bw<&=9aEAOb{(Pz9AD90
z>0!Ko2}6v7UBwiI?>KlE5VH}b>nHdAqbB|XkRX&&G5vZLZVggkt##Pp4Z@Dok^d|t
z9pTlF<Edi`ydk7;Z&`(Ek?qj=^9x7&R6_Vgh~=ux`fE_En<w3ye)=Je1`MxqzG2p-
z68v)LtsAI`o1BIB*Q<ez=<@RxY5}1*nP%S^Ijh5Kj&E>Wy<q+za<PK{-U|&bvDw~r
zNSwjrW#RzKV1b7vc1{BR_)U#;TT6qRBMM@<bohtqUH0pibKNP)d9#>LpGtYdh((ON
zvQCHEXPh=b7#vClb!aAeT4~nj5i%(Zy{K4J6HJDnf8yOWJPF}Q>6Ea}x5E<4-tzVf
zbMJhvh4$V1y#MZRRWMfJDU7Y591td(X`!`x+rt&7N-kxhZzG<gW1E|pooeVS=B^t=
z?X(nLz<YPb48Y4h%qdP{Wfw@}?m%J2NjT-8iQ@~5g?qj^O%BLDSKj}DO7N09_0+>9
zp{^~|_UaOG^;neBKppfy%9Eo^D`z#?a##!Y@)X=Gh}NTquIy|ziQrl=4eMPKi@_9>
zd^Tu(Q98c+aojeC$CCAvu(Z2c4b3Z{QY8lgH-@_WadyHr*9v-rZLm))bAzJ(q(8nB
zL<dVKLrs>Wf_!V;BY0;@CyN_YeB72hwGoOrL!~=3fsR%zIeJ-EzS|n-2qpv*xeEUt
zUqH#1aEU4O0%1|`FnqKc#+OF@yWUwjhMSf8gp=rIYK<PZkdU!O_F=_uM~@%&+G?=2
zrsPJ}q`AqaGK<A~$FsXrc)`ijejPB;KY34EmM+=~+m#p%&e`PJFV~QtE3jo5h@lfE
zqd;X0zLd$#)Y>h0^st~p>8w{tv&!MmCnc5DPj=D)UM0Nt1QU<A^<M?aV^sg8ONOZ8
zKEbs<^lCg+M8MU$c8Bm~BSQ_(fOE<ApZ}s48&kii$JZpYwkwZyobDe&F22QbJ*zYT
z-6y6-#+ug?&m_XvgNX{~`noEZS+vEDBN$9GNywvTZdK2GKMM0D7rh**NCx;<Y&uQ*
zeL<^y=F16gmZN}GT%4ATE+Ew_F&god=fZ_6HQ6B=q7Uz>Bunb;YO2;EWb!dKO9rPs
z3uBsAHuxFcLtsbMX1H?i`8|cxz5-?#FH3f}Mfh=I^N$dRs*{kgunO<`V_jc2z(KNB
zjPMI~I{j<X3Z0yM0t}bv1cx`d=O^ghhe0U#`>Xz^P{8@_W7``Aq*_OoTmRBZ+>|Y-
zq6i5eYgK}r{4_aXx43O+OYa{IuWCKgXv^NHBM8}3Kn++E`87_14C4)j&IrfW<}}yU
zi9+PO!Pvse<Gq8oo>(;-?0OcEd_42h6>x2De9I0E|8V1PevFHgZt8>yy4md^tJvgX
zf>Q0@bY^`A^s^S4AB;nfi};lj7ixuj7$F{e(L2*7o&D-v`SR%UvFL0+i*3v2=k$R=
zD>H^|Zo8k3wR91z7Y*)F#~z8$^>0uuD+;P`rw|e~Q?<-_>F(leQsoRWGc&s|lIYXf
z)8kFOZP|-Ee)Z<wCzs(8JhE~#aBzBo=`PUR8=ZK~a7zL{)ttb57JOJ|cKfio1n4_w
z)`~6{pc1)pDbDS0UQ|3a0s%vYMK+?2;GUyHR6}Y#ehm6HS|ZD9z>wfpr9(GX1C327
zTD!5QQiXMbk#~2mKVL;JgHX|pg0a_;sH779`}vz))aRo~k)O>rFVB2zdAa;9Xn}RO
zgjF$PrxboQNEkl4yoDXZ_X!gonlgNXTHG^r<p-2rMnu`rZ1UQS*J+<sJkxG!TZEn-
z*oWx;Wd_dg+}18HKTEV}aa`1g-?@eH>_!xw^}23&NS!V%$*LqjG4Ts~p&ZT`Yx*z<
z2ws?eLycjpOn-ZWYZORnx7E`5HQ5DEZp0QlSnJGk^!Gpr1^o1$(Q)|bOrr)%u?5D0
zaBpj2q>%#oQr`&Qp6SDVuW$Bs(q@Zuq=YXQDu&uzsXGF`&M$B0z<&Ok%4^9sNVs%7
z+2`WRJshI9kfA}uKHS@TQ!(isu@cre^ZeAz_#Bk$Vkux9<I;-G3_c3zTIlklLU|e{
ztz>%DlH3&hL!b^ds#m_@)t3y<w6|~`R}|Nw`tk}d0*t67$JdC@i3+5m^7?Kj%Vz;%
zX*SUAH^RhMKYn^{+<epa7T}6W+`)M#QZDEiOn(}^`n9NK%?+!VCpJF(Rdzo?VimZM
z1?j&wB)7HTo;KLOEA#B%LMZ;YV=Et0ZW(!J(9OKiDkohbq(Au~>lcNK$6Q;9$qXgl
z5TWa_H4{LSfm4;YU8;ult%pRIw#8;Bbm{OlHJi6$2;c2QDh^1Vwg1x6cK&rxAIRHl
zqN52%R-V#V4eU_Gfq1_gbp~N1Yw|T&pkI_>`?shH|E{$WXS0vJ*jmGVS~lPKT-MsV
zOLPu%DQ)~#&p`9&+_v_gA<ySo7p6+J(|hT9u2~<AF177?=y*U4Z#eg6M{zW&C0-K=
zg*cGT$d_)&X&z2^YHiJGf2?=yDvO+$nD}nBOY>gCZocNaZTVI?XFNK*U1-6<!N;aq
z+UdK_-QL$QFmXZOG<EWn=eMS-D4F?f_xH#q;qmSAf|HKto_14R@^<jd@Tu=ru<bdI
z+Cae~n*W1=7c=JSlGOmuP(>x?WBta(rzp$=%2A}R9rD2F$k=gDz2XPG@2;?a9M}Lk
zQql^o-57NFpytI%S!8z5dgktW@5yA?=iys#gUL$0Lt*O&j9+}rD)%j2wL%`74DL5$
zQoJcKE@>QIC(jV;Q4T5?#ZqC5hV!vdMzy09Y7iO#DMrRZ%^A3e-=FHR?-omOj#?yd
zeI%Di9Nd3CG^!}6!#Oj7I%ccw2*2MjC~fgOZsjq2FY0Q?Su;-dS0Pqwo7{trefr6x
zr+h4d$}$d)p2Q@^wd}X&sIRb{)5THn7as-m+#+|c1nvI@fq!FbURF`s_2T2=_Nyk!
zE5A?%a;@C1gjuNDm2&55hq!(6FIrx|1MA=X*C^S-YH58_==D1O_fDk(SKVHp@x38;
z3`_~X?*Hv0Pi}O<ru8D4FmZN=h%%J}3hPe;R*MVkv4k5_gD@cu^>PMOlra{o#D$(F
zye%KLJVdKsAb{j(UjbVcGPJYLPcww0E^6vTOPmWDpJzl~lUl;s4Rr3_-6Ei3#U40%
zCb3n}v2-(oUIV6~=ltGbwW3abSodz2QcdBpp>rbovw1^oCRMeVxAVu_&@d8|6Q$!M
z9V!KLACwNV$*54y3G8u|qA^^Bc_z8SMVGcJ6g9G48egUIOhyw2WlL$7B4O-($cE9v
z>FZ1P_*yh(Nbo@cer8BYY~5O^T@KLR1ttMSefJL$B(Qt?Xq#*eO(sm8e%p7=LgMgK
za%FBFa-H3;^E9e#lljY2r+^^Vw9XE^i%nAK2R@>;9wQnQ={Bgi1|~=b4q;j9<}(UQ
zUYBV1;f+Mr39f$ly|yIsPQ9Yo{3ErJk+X?zKb74_fBnN~HX(EAz`*8!WH>Pkp8nx$
z6&N5EyOQ$rtakSLh-O{JzBK*ZKW=yfUFOqv-2(G0XZ(rV?2MX&CBqFol|3%heGDn_
zzgl=uY7HRw3sk*n<088}(vzUaZu~Xb8r7E=@nqja?$tZE8!#unG?7nXl<9c~IHSSY
zOkkK<hr8t?UuETh+m(~Pr~{iU8J@C}bz*pbc)omHb}trRbID#h3EICFIFhH_m30!$
zKLzwv*IsOaUj4?*9DshimU*$t*Jb2Z^y_fQxe~8EerTiHO+ZaW4ELL8ff%AR{ZVV}
z-B)eIhtMuGC~%P(c^ATe0Pp-|wBox!AoX-behV2P)|jjiGSTS4hzo7nowX7&*%pVi
zn|8xgB3qJBk}8V*Kuo1{$e)*NRB_}@3@Vqmyz>?M%fxJE=$nui$`<Xima$MFNxn)p
zbWjEs>&WQ7i@2LlmEo&_0D886xVJ1!PQ+P?Rtj8&-=;SBgGCgSO`5|*wQ=?#1F+c>
z@Y-n*K=~S<LNZ`b2^Y?@x-}CO*RtVX*MJfS;5@&^$zNO1+25`Yo^nw&+bBf4A-`+=
zoA%~ygN11g0cwG(X@ly*PK0OGMudAKUs<W<9HI}Q#55B29FKeeOduBaU_U8YwU_Bm
zP=)ay=LtrNIMFNm+k^Sz<nSUny|<z8$AA@cknZcA&k+F3z#Y44qOyV+PB{0XE@67<
z0ee^9FD`BE*#761Z5+;*_=qvMHX1l@FwWDD+jFZ()b>K^0Upy0FOVlCw5j&s$Vc%C
zvm2-HhdfeZY5i{ud~S3VTfx<EmIt?}GmerEoO0*K{F#cjApX>L5{Kl*xJ^D9ufPDq
z2AN9F&KtvlBNO;hXT!%04V)doq+(QzAs0!6oT&PP;kMx)G<A+&eb2w}-7Zzyc7MV|
zc1Ov9wn~1t{5l_j8Nv``5<$w%t{aB{J25a;)kz70ikB`~%jlgTFfW<2G2>oWpqaTH
z6D4%DUzRN05|>vuxU;WtYe?Ky#`fmWO%huTER-^4TeHO>;a>Q64APmB>+|+1k$w2#
z@}?E|&Xp<8fT!`aMWlh{%I=6~#a$tcxq-R^Y%AETt~NW`Knga9Q?Ssri*r<GtSefS
zA9NMQqf_Kk(Dd>3{01J(tV#v(#3@P-U{6)_`%!6tJ$%X>wur7wV}=Ne{4djkkYenS
zQp%N?Y?0MBy`l+fo8Pbxx{j@HIw4=E<XHaE?Q#C+(8C|Ef#ZJq%dm&0bH3r?V|1rH
z1|ZJ!g=8k!yz~A|wIYbj++F{DQ}lvdQ`BQOzY3KQaka&pzZ&I1*}2(2&P|>9OOQHq
zXT3*a<vaANVWS)QC*WKqOblp!!ez6&>L&CVzmS8C{nv*WPv!B*32{J;dOeL>@ij@}
zLgI-1bycqduM$*lFEa&&p0dCT%<^9X%xDH}SLB@)1mqYKZ2$kWq{90P*y0}qX!M-3
zaS~&>0!N_jfVo|npwPcn-18tCxednnT)@8%s3~t0$ag0KUtGy?)YVq6un+IvgG~ES
zz^Mh?P$Cn7vDxb*cj$$DDhQ&qP8)(xF*B6gv~QLRrHiYcr7zb;4ieZlL5ymAsP6RV
z4wx9CF(u@+>o77%WB(sScS&IjI0~Vd?YxAoL*RonnTYzJxu&kUk=3AeOl*Yp64kcA
zr=+A-v5p<u?_@~P5zm>M$BSKBNsZS+i{+zlYQ75$7yDk^6tk3Q%=8d!e2Hc|>AGl!
z-Re2*@$)L!EGV8zqjF_H(2%QS8IKUb8|{Yjilrjziuuky4hwUIS-8mXWs<BWPR|B{
zkbwbuav7^Vcs(57=0+b~ROFaPG)#}*o7WnxkwyR-5M|IlU;&hKy|mj(S`D<4F7~<}
z1KwGwNWR%!aMn<>*N@tHXl$XjNmUb!e!>c?gDz~*1xdu|ot7{<l0rPe)_asgd}q&%
zFs-PuBtv<FNDNGb_sD+8YYAutx<CelqgZ*q+hkNlf8UC7pRQ3Od+CQ@n1ATw%Z7Zf
zTu%`_i}a)V>#dx>ddq4u;jf~r%@^dibkX6wsaMnTuFg`Hc?o*62a0{k2gPrIBwQqp
zjJhpd2#<wv9#=eGK-NZrR565dCUsa`em`omc#ACxRQ1mzt}g?~E(PnvkgVCOk=0wr
z<+%D13=hVT=xef>*Tai|#a^}*mi9pt5k>p%u7ru-H;OZiW2)_*d6>Oaed3>|j=!Bi
zX#Zm&4%uOoKZesjf_srtT`MN$rzfFremm$H;}-b2@9T-YpKP@C2oD+xTF<kJ$GPg5
zY=PDQp_2dHj80MyGq$^!@pU{{MiMSyI3wa-&>Cji{Q3rQ%}Ej>pgwi{>gx!34aM)8
z#R})%s`1AySfs=BvWG9Nv-gWRC(I?{CD*avp}cK&4cHepp+b83LS1wL()CtWTTFDI
zL%$SsNE-amBmg!wm-q!7WS4za0AG>zo5oM07ytWTnhKIY4$JwMJPsB_>$yz-ho-)h
zdvfOtI`6)gGzHD<^CT9HjW+0T4hp;9ZV?BG5Q5rJ1H0juSQMz>U%i8@h#tyMVtO)?
z$)(0S*Taqdy~MZ53%k>VcL2Xmk(31<l!1!tD^5i`dGk)cMBDlkiNs&``g{Eehuw1)
z_D~Mk6UN@Jd9s#}V=2KMc@p}XJ7`^q$&nIO>AYfX;dh*l7_<$KGfLTA=O)CV*w!zM
zX4eaco}<R#aDgIyL0*|wYlJ!D<3Op?;p;W()Ix$DtW&p9mPq|>Mah@kXQ4s1eHA~I
z*_>sh^0gv`yI-7H`WG|-ubX6`r7!6l5kIwD-1uny8ql_^Iv@P<TzN0BUhxv^^~g8t
zRr{?@%bbKEAJR01D|KkRX-r_%l}<SF9neVe)*s{H*k`cVds$<Rpk|h|gSkP%WzZtt
zF0LttNI5a^dP@Ky)p{kfqdf7YoeRLhI15ITuEdG7vu^5)+{{3YPPZU3^;7X|@S+`M
zpz`z&+8|ni<Zyrhd<X>cWqZ*0fsD7#XlY?Qnv>s2;!e0($}aOo`=JOK>qqi|tF*z9
zX<xLc8s%$dmr>j1G#DX5JiSM8(!4cBoTI9wok?#n>}6@umNZpL;zJE7@Huwa?oiQz
Hv$y{TJ(w8L

literal 0
HcmV?d00001

diff --git a/assets/img/rancher/backup_restore/restore/s3store.png b/assets/img/rancher/backup_restore/restore/s3store.png
new file mode 100644
index 0000000000000000000000000000000000000000..493364deaed26932ae8c575316ebca9d049265cf
GIT binary patch
literal 287490
zcmbrl2RK|^+cr!@1VKU&(URx{(W0A(L~l_dqD7Bj^j;>2h@Pm?JJF-}7QJ@{!|0t+
zXE5y>_kF+b`~2njzvuaW#~yoT@3r=xz1F&}>pZXPoKQ`51u~L{BzSmuWJ-#!wD9nV
zIq~oag>T=&9U0HCEyu&VLu(@^r>P_-_ej&(!OF(Y5)V%?G+vKLM_Y+DT~F(_5@&#B
z?w6&TKa6u{730aDzob;;6u21}*7B6Q-n}C8*EY#Fd*07axu3Yxb}Z47at}1V`<->7
zL9*Ql630qgFCmxGd|<wa)+BKuyk8BDU8{yVjGv|6WU=x+{T?5a-19{G*6mD!hhzB0
z48Q=fN6(*AzM%8Q8Z8-x%xIQ@2hGq`*tW1+(I)MLc%i{!L3-`OK^J%N>Sgqva^3tq
zhJS9QP1-GpqA}woX1$H~<7uZpiQS`4I+A_PI;C%<fnpEv1min@Sm3`%?6#(Ms`|jt
z_`pozo(5;2Cr?+aA$|yv6KxmE=}G>J68T`T#9EV>J}5j%fFZWC|6xy<;rdH*8k%n|
z;*;1>XOu(#U_5!GDG9yqBjV`TjXQg9V};mWetqnbs~>ldk)VRT%Q{%9q2&&gMzNDB
z9^L{8eDqGJ{U#ovl)B^1uHOlq+R3pGGP~3nLLs#CIpcp`x(8BPE9Q4`t>wJVhHNWZ
zrgq<u@wu&cLi%zw#7;0c%kJBXsvHG1DP;_`)OhU^Q!U{x*Kd*}&Z{hOt%z_!*>Sn&
zls2gmRpMO^LTp)1B=oAH<sUfthXMwFMCXxKfU+JvHe3nMJ0jJ35+ZhV(eaps{6RFo
zvW|1-@;*s~_Eo|+7xQ@dJ2rsmQ}s92b|Bd|sPC|imtr0F-P)O~TzY!AFU(<G!4<?L
zKr!+svUhLadip4smp~PN?ge;hVT`oxzI4`S0@g>QM*%HbLhC=C!tQlgOL5);z3d_)
z?DP*fF_z&ByyEYC-#y7>G2j!v&LqA}+~rj-a~STk_Ty-WB8BQOz=!;@V(P0r+t<56
zp(|aQ*~8B$_$<;$Q*PeIM)KWgy?iD~M?0=b4qd&MepiB+f_V0}(HDb9#8L?gZ{DlX
zj3lDkQwg(Q&_>V{4e=55?9)|t@IJQHle&utKt1+I4c#N~fe>0zenxgc471=qUnfj~
z&`+0Zo`N&bt(>Vz`<*gn8oEvp`$zC@FQ+VY`Wq4S9^k!MctsGHZvUn`xoyuwJW|Oh
z5i{C~96>25DyBi}KVu)AoPpxcq8$5rDn=@Lk52*eTby)?>sb2xCk504G_S_)AG?M=
zQ_<`r`79}z(M{vTC|{Y%khXltxd5eJ=%vs1h06cjYTG$6z&m;xJW%2w5k-fmkdD{x
ziBPkKKjbT?#$z~GR%Uxm!pP@y7mx5)M|>7h#AmwSU&Y1oMVHA?vbP_Qn!UK8NErKJ
zn(z@tWjcvfpjYP2xB%)8yx`llpARx`?c)=@AozHTqus_4-}STYGI=Wf;xgej0jwP_
z@Db~mug~sEcRi?hv45ANi{SY6%kPS;<Vvq6ems5kMe#>c-;LZm`oVUuY9H71mG|9S
zzv)cA^9uNw;ycs2$O&<`CU;Tr!|a4@&M5-27c65pU7sWeZ{~DwzjUQ*WGa2>k#oLH
ze0IZ|?BJzICi+3UjsUw=;G8+rySp?&d8SD}Z>B`Xn{B+KuBEjN#9ooi1fQERJ3Sd`
z*RPjO%~<h#GSYo|Ja?hx%VHcfyJmkujly3F0kMtUzI9VFkTyU~@v+6dd`jip8(-4C
zbbirxJaDC2x)=J2eLQTNeAbFvAVn;wKCV8gJ{tUTpH=1wJXVoaI)<@7<i6bMcM>JG
zT(aE7+_l`nT;K#zCHLIV{a55{1wUS|U#>f!@SO;pSe|H~d=6_23l2+Ejv&#nY#eZo
zXXIAnPSk1Cy~X+PK2I10TR@Cjl7ha*oQnAC1{JTIqM}blyM+?!y1yj!+*)@1r>lx6
zbO2f+g|$<Uc5fENHAcKwv(H+}Zp|A1m>>*#|FHCXZNys@Nu?$Y<O}OD#%()^XqgaW
z+42ID{5Bo!H&vRXnkl(&OWu~bYaYbBFK-NM%=7*(q2O2R9ej1~oPHPm@J{6TLxG20
z4^>3mZBi#a^OYv5r|yie+we_6%Dl8r?-7{)6bO7^*mI+YyoXD^j^@pva(HQcscwFa
zLa|Y?hJp6NYe^-aWcOhBn*%=fo@$HAq=uo5A%da3Aq|PI68I9nX>1ZcZhU*qvy54L
z<%6@l(~AW@YKT}S75-QJ3J!V3K}*tphS0a5RE!Q<8LfTQ!cr~o8ND3E$>{W<%bsAW
zedf`~hp!#(LE*R1U**4=el_bP`^rJ)6ZumfBR?l^8xci!{y-?gFEY5tHX@oHU~N-%
z<6T3^dCBv)8KD76^`TQ1DN0TKp9|w{vUhwZ{qhk*oK{R$NmjN)?}x93B8PK^tdnPx
zptYJ6N5AjBE2$DQKVF&`5S(-VVHva`#AC!$t6QO)Hf>~^T$AC}>K1>lOP?JXq82r5
zl|pVXH8cJ8gMq0}KY5Ky71g|b?H+^DgB@`#;mS|zWIjcHpZ$LLrJ)Ik^5t?neM4@A
zB<2h$<VC(0-yQl@9#t0A5GBa~i<n`Mc0WUntL2zT&Ph0>ai^9^Os2}EZHb9Wv^iI}
ztTgE~LR>BD<s0~%?cLC;n}_U93wtwbz{B*z)_(NYkOYO2Uajb=^qZqEM#a;I)0tZ!
z%_J@4p6CsGSlU|4Aad?Ou>eXyvPbGf;C$u6?sVtG@-iO@JU=)QI$pcby_7x^J>9y5
zoq-;Hp!&}ETXNYl(>#;)$Z;9@s610&mbc@b<2y$iN1tz2ie`O1-;r7QS^8OSS$?Kv
zrb2(-{~=zvx5Cru@SAMT(4Du*p#%xmH(z-2>)!D_dKM=6d3oh0DcNJcD&7?59LgKK
z3eToDdvQn7%5A9ST`?F1hW6a+?T#vbfM5l>LWb&vjw3GmkDFGZY&Y4TYShPmOyg9u
zQ`1sO{;rd9CL=E9rR%IW@GDNAi&pDgJGd~?Cbv4bI?V>XCf8HW2$k+|d)fbGkE)bi
zJ;f6kgUN*`DR304ZK}%rR9DnchsI-)s5%Q*&#Zq7J-0k_3aa0$=l8@ki!?K}Qh=zj
zHu)NxMMKv5GWx|;-Z%XNon_0PDb~Na;Fgr~QGp{<f2QuHc0kr4eqQU%XU!~6)ZRq>
zvJV@Nv(c95c3-7*(reYj%%fzKzF1h}Ydx#Ttk5K7a^q7j%>yVg-@l~Mz3=xkS@?We
zIMOEDhPGfq-9!*=<Mi>EU+9PqLRTuJW;K#>`QdGQiG9_NIl3x?t)IjCVg)`xFeKS4
z&P)8%KLaKPnnu-;#?T7$3LA=ftmI_;@h{@ZN>o$^K0Pt6wiIZ6S6}ZJdKyEf(wcCh
zJenw;5TEF0JYeLF*%}9wW4#>pH!I;Az(F3pyL#W=8k+3XRa(XO6s_t;zf~wLGwFP<
z-MD!$-)}n_-xTMdub|IiG+QI%?6-F7l#J)O?-D22v-HVtGbnqIn#%JQ=+J_1!$g}i
zjHZ*<(m=+Z8ragnYiHmWZ>f9fz6#Gi&~Rrx5IYU;<*$)E_eeNEY4H{v7KIku6uXs|
zE?WM!^<sR_QMxxLZR*jRzAPQ-bASLY^g{G%nfDV9K^WVs@>z;k3?HSpog870!{t)Q
zg~$_USk5Q+kPmN?8ATRGrYZC=+1Q@|B~U4y4%5Tz!_*2j(R=`T@!BKs^6}~#ns+r}
ziAtY?sYV^x;v%@QK3(f%e^Bs5Jx!X?`)WPuvrzBoRjR$rmfK;USM(_vErf5%#I?oq
z!ebUnQP)&6YvSBC1zwpOpAyeM1zWZaa+KXP5%-JtJO5L&ZJRbrRSs<ySdpJqTN<{m
zb9QKHG;;M>9)UD{Y05)P!Q!E!^(N;b!_3G=NMn@DZGXpOQ&gv9bbYk36rU%m!DoeP
zKK7)bN5eKlT-x@K_+ZCV2IGYwJq{08iUEjVAZHU-8(D2AY$G^vViv7@^6BV&Le$%#
z2-?_ee-M4phUJ4Twj(DfyqQ1Ac>7A7a$QbN1{7u}Wz2#qE+@`JR`(V=nmc3#6#o2R
zCVU1S8&btH)+2bK5^PQ68J#mmjo@#16egL&5P<zc?IGMykFR+^@nY2w@5u^X9_4e=
zZ-qy^lKvbQ1XFWf^;~(6Cg+syg_Af4e4z*ma=3&4NCf}rwV;^TZ!gEAL2^Yn4Ib}h
zm`{f4x1)%*Y1yw5jV6K28zy$F_Wq|T=3_XfK<ucf?}CR%!*>0`SJGlV!o$PQu+e$v
z`c6$%!rZ~0&(y-f%#zR3-VxUt4^PTd0{7P5($(~lr@bA}MZ#11$zLrbaPO}V^FMj?
zR})uT=_l{hG#|-1I9omv;S=V2_C$u{(W6IF&K6b@TCe2)>5ls({p6#otD^)zzlVnh
zpN9~igR?cifVj9g|1&{;K|x+z3tks5psT4TFVKbM?~DA`bzWJzm^<4zy4pAZA6;M9
z)Xc%nRr<-3>l^*|-{0TU($nUD?gVuC=do}P$bWr?Ux4o!|9@W_*H!BJsD!4Cr={Jy
zS2p&RKo{ISWCVqTg{A)L@c%gVKezmsuKNGeRX|8c@L#+B%c+05O7UMm!oNJy-{bYy
zQQUyZkVx_W_u$Kr)H0Yl;pT(E=9PvHZhzx?a&Wt3+&>%-yx!wpH(tNzdWzS8hxY<c
z>6NUGC;omKQL4`LdGF|iWLV~n8}5XvB^7mG1GC-__$tY4JrC4S#as`~9YSqB3DZ2y
z9Dh|(k@!HR<juWzG@3hV-z%RQU=XdM*2Wo0X=!s@z8TD3rvojp7O3Qw&*6T$bX|T!
zLtb9Kd~ROe>rX>ORf2n}3k~UsrOZ**Gjx7q9I?!1%wQt;4<E=Mlle{lE;OV^0j$5U
ze+NAlT`zCQvJ|J#ydoXf>+^_@k~TEF>$T^dXqQWIKZ7+w_pfO+A!#+!>NcbG-<<BP
zJz3Q?U8R<wkypUE_|W>PnR*>_iQj&?F){C&)Pu>lKdb~Yejozl`{NNU<1u_DaKs~T
z#~1tGf5;qW`1qVH?tP-buk2WxIf=zF(w2+x`}`kQC@u&vn&Oxj5Dy{)M^a!%>A(sN
zCai6>{1VCIlu_>h0+T4La54;M<Xli-w3RS&5ROAC1RdgT-8X~y`*pu(Yv-=pY2Xeg
z5-Hg3-*+&hndLg*@KBmppU)^|>=oJzli4<>Zf}DOnWOMQ?aTuqM2^IK4J@zgZzc|e
zsFaB~1CHoqXoE(<)b6@>ngSOhavmrM03Wx;S^KWE#BKRJ22zTKrgW)Y+{p+(Zn@L+
zr!34=FT&tK-MR>{f>@a^&UyIfz_}FTD@XqY!S~}7=)MnivQ=)WtG;KIL24KJ5B#&u
zO<ljJ;O^RC=}Dr&V`><kW>ygYp&+98fu2B_nc?eZZq??Oy??e94WIDcOZ=vCbU*#=
z9|Y(AeaX_Bl9q-w&m)RI4YhYfF%B&}#}>rmoo)E+<*q3qjgC)XiEww#aDT9#zkeup
z8E{14PZOTey-N%1;H@XDTP9s=^=*x&1ccE8j#N;TZD;;``OV`Zm;lf+^F_$XqvkRl
z8J%6fVhjXe_;t`x-|Mb%C(#8SbGC0g{}Czb$u8|fz)|$-RY=lm>70({C$*l`)~ABJ
z1_kuqS$ejpJ3bx8ziCrSmdS4&g-l!#!0;uj+fY3eDtjT@(U=I*2ej3CQo!=Pc9Hs9
zv&#>gSA1?kg_N<<q<}7p<IV}><2AFM?uc+Y+PZ&f_TFmg=S?=AAL$l=hHy!-Szegu
zguis`T4CFV;cOP~29gi_;Bb{k`yJe$0m~E{+Z13ncl{{$9eJ|)P|#||MZp9f)BP}_
z;9Uji9drkmSl$v|!7{$oXQGW>0^AUE@ehvjpGO^Ops27q4j&kdIGOGjG5ZOf5fv=Q
zc@w055}~jQj9E|=de~`8Ei#MtHrA4i>a|uc;%k&|L+w+df0x$}8P<>*t(jaTGD;Om
zf0+d<H2Y<$H1mA|YzN6W5|(jO{ISIiBKHppFt58osCzN0+rPqOKhY@(H{xF@j(uMw
zdKyjnj}iHO<LRQ_ko6>EUY27!!EfpY@{9xH+rSPYV24P$ci@U(uar&fnX7~Vok`)E
zcbDG<WFc=<!|nUh$Z_M&sSS+t`wRivxpJY}7)${-zpuDJfC<8`-$hKoD-%vw&cPRv
zE3a*PRBW3Tk5F7b`YH__$Srg)hLC!#EbM{DJ%kbA1Vbl~=MQia7GA%1eKlma|7Gi*
zUvw}<g|A}&>dsBk<y(*=6h5%anMHc!1@oBzN$x?w#hZJ_EE~1WqUPnORH(%7%Zz&1
zrQCq*@_XdPKWindSS-7PE%ir2HNcl?p>&eEWvp1l|69xT>@mJ-3?f8j)nh)7fRh;G
zR;|0wh0b1^tV%ew7_QnkK!^;#ggf5j`@_;2awMI50qr~zLfrxIv}OpDSsD)3Cpg(R
zbS*eHP}JY1U0IzUc^#W+!KTTXH_<6**AxWb-`b%|%@`0?Ar55PUhz(~y$dFQf0q7O
z-6u_MLy9W!LlLDdC|K_&*MFpLhaQRc5Gu=|vUH?4r`^tnUHrsu6HU`EKf*1Tqs$Ab
z_EFruOD_EL^{$(u)LH_ZfQ6o#MSHs`TUU;E$%{nWWlad#hTmBnSn*{ONPzFC@8e0f
zlOGZM8;<c`{iprPi%71_DYLByQ*5anzg+I_9-m2wh-Lw;ZF`SDSXsQ&JCkJwZF0g*
z`zA>ERscAMm@^J8A!W#zl%}mWLD95zJ4`O=I<|GU9r2?`vC2GS0~cuylJx{0%j)w!
z-}Xw^$x)w~k8)g5iY9bzB2hozvS`iKjsdI#d>knby)a)vbiB(N^N*Izoi4YDBNtaZ
zY-~S3%zHYzEJvB<dH9groHpWI!xzf`xYk8g!7~>kI^5WP5Q;b^LUr5%d1@|6wQC$}
zqwcGB?3`>0!$J_+eNH0(cxWoUZ#=;fJYa3F1*(4zb^cE)y8rUy3Wfs2%0T0vdvV5J
zbtc>={O$Xl_8>)H|D@aN;vw5*jwsG=UEoo02N5+F40viN(=5@#!o`Z0UZe&S9X(=Z
z`XCBclX1^k@Am)Aysv<puiH|;?l2vtbFWEr>3f<q^RJe86FAW@wFmineqQ__dI^q<
zp+$E1lY9aUv&;1lznG5Tn%OoLa;_k_o=J-TDAeI*G@#Zcv**6%r{mF@UrCNTZXd~a
zOOWSZa@`p`s9!M0e)`pOw@RM*tV70(fu)8N+YV4(VFok0>yb2RQ<{Om%<zJxyGCow
z7YYI>g1@7U^0R$X<e%0l`fOVi0hTiu^uYsc#I>(Z{0(gi0%v&3xklprdG`^;K1mbz
zS0k>D-~9VLL`XsHW*b5_-tb>Z4oVA3$f}yP`jj^z{y;jheSDwabP2fF`@zhu(TpCh
znGSFF;TlD}WMGS;RG?F6x4tlpaJugvY((8z_Mq+=&=m5gKKMc_{Wut*l@1H8SAwwO
z!s3dMFJBKr@b9|{;2KR_IfW}}R%RJz<?h(`FO;2H0W?OJefRc@<SWa(Z+U0Y!n2n?
zx3v>^YLZK}lUH;)|CWoq17?ALlP(f{rXEPty@KCJqo8+gc<l{-;-={iZkn8z@!h{M
zCIm5lvS??jP}qNin^Q_DPI8K|8nMQrt!(})%HAn@=Wpi5I6HJSKd@@d!r5U2;Q!bT
z8w0f@3b+;^pLeL_m@9F^ro?#1W)u4AdeTr#_fQeI(Y{a^<3Jg7!zr*esElwwqpM!n
zu}@nsApkdXM3{SL#8?{4_;c)$?G84g%zly@Jw^dUhEo3j>YKXE%r0Bl&^_!p;jE%W
zXQI>_3%3O@cnmfcGOdVQWk#ENnB}qW6I>ffv?FBfK<hY5XO{Qe#RXj(NsEIf`zACU
z6g?slw%iVeLD1E@3;T^r-Zj1+qll&l9-H)Sr}ji1%jA#%$)g|`nXkjIW*FH8uYWl7
zZ94RAZ@r|EY`@z}6D@7d94<d8o3`g0^~YA!aw~`Sq*s{~@E`8qg!No0{=yc!WLnQL
z0Vb=77nYZoc}w>&*O7UbY=cVlJc@f7z;oWpW8`rN#o04U*}d7gTU{cZ1js?m*$w8f
zP9j&{sIpJ>+u^M;QSrm0m%lai@Nu!)kRDCd)O$E9-^6hkZw)!cd7~a`TLeGT7(U}q
zIbm^^`#4iNqCgS+dzkbe*Xz9YqA@Ur{d<Kx{{0vK=@#&k>jPz6vcam*m8*B9W4<;H
zr$ny-8`P&+nsF8`pnFp-ZFlA}Ej=3j0RYDNYpL7i;oTu-=fwyOtRq=jhsfWtpTPGc
zNM_mNg3*5#<6m%0f$hW|0Z<w^Fh(0r(Y>n&%fPHWGz_vG2s(Nw(@u0ThVgBO9Z90f
z&}j8FX3Q1>P#&oD@lfd+^p<mJGl(vgn*9{<&Ln~_i{HdtqonvPivOC(UB<Px3w})T
zQahs3(Cho2SJBh0PCBuiB|PiDP*OY&C0)l7o>7PMsACfpEmjwYlG1r7oTWA5H+;ni
ztf%OgRRg@fX9dPsxmHA#y9V)X|1nJNPs+zF{A*zO@6v+5reN8*y*P7y<MS~wp(fsc
zypd#oE)R?;RJR-unj0#eBC0yEu1wk!-$?mG7v=5k++>G#ma00$p|T_tCC(~-Q><!e
zL4Z8W-;g8ioPtcBip#1)798n;wBZX!gss)V{9S&lt(O6J*O&;j_7o0BJ1@Lwor3Ep
z66yodadqgsh)`sgUnHWD{jl@kWb-*LzD*`L{T;bxJ<DxZ{khh{^kn-l@_$09S^565
zPX&fi4ZSlL>URI%8NT&ja3K9H{>2*x|4dsa*WkZMkNpLS$)FP?+{i3(<6~k($^%gW
zpc&+qFSoky%h}a!WyllYJsjUTqHaxCLvZg?Ha%5nvVc^-jY#pOjuSSIaQp3i-#aq|
z%g<Rsg!Al2nCu5QqH{!q!vD8TAz+{32xn084{iT*E5N_c`Td4EA)6CNk`Rw*4wsFj
z4XD<gVYGw?=aGhgb+@TXE9DUUwG1~p32?M)SrA7qRSnts5;Y9@Y5|mg4eF|Yg}59x
zg6Dx=+-QB^UyP0l5jxmqx$1n`wPA*2`3D}*rU;epWRNHm4xDAv|L0#e;Met69sX!`
zV5ORaixNXl|A$dx3y(T3TghNw_CIwR{|r}NA0*an)9gM!fqJycAOGR|Yo5)(?KP_j
zQ)aLNgC5S2by}r%hMcSu!1AP^q>wKuj<NOl87nRVJ=1?vRkQ1u>_oaov#R3NL%XEn
z)k?d{?i7oQ&0j{38XiCgfAj1YJ#g>FHBxC^OZY;fEOGmGfh^m>?5Wt{OXKs~<>N$t
zc6U|Z|E9o&48;?2NzXqr%BIZQQH$|^4&!d(kVpu+Q1sO-&aB_u!M2zEE;a+lQ{KTL
zk>C91U$-CrU!cp4{}1T$Da}tDw^BQKn`Z`;8V+YqW9FTt;+6EwjbjQQWP5*^-42lf
z<AUa9AP~nsHA!Ut#y8}L0zg;HjUXo>DE-CK)FG7q+WJ;ypbBmbG=KBdqG*Z>5&uXN
zy$lmuR8QNn1BxE|mTCJTUprwv9&H@aikr{L<7-FNeC^<W-6u@oH{mOOJ1tqaP^hi2
zGgTOSwmmK<;lBTlE4tk;8;>OO-`;exu2)jseq5qJLUmfTiBQS>+673)fE$~18SlFD
zv64aPX_}<_cVi<7<xxJyT$AXL%Hu{O%RY(4E);L05}wLWsxbz#p^m=i-f;~rzDFHI
zCt&mF!61sLL_$)U9`7zCj>rT#3h8%nusOxfTon;K8k=&{hPUoEMJQ3ynyF8h+bW;`
zH)boi9F7^RK3_|KhxHz~G5$rh4TD5cs2{L^JS@{U=GBl3(;f78CxO4|_5u%6-K^X4
zbwqLGrCrM9<}7?yaY?2g6Skm#;n{jnoiS6#j5zdd*h_1emo1)Q9705O)*f>7g8cmG
zAO+zz3s-wY{EA4=Ce8S<f_GQV$2}>|hYef(5p+Vj`>8W+SoE;qrzxk2EIA?<8CbzP
zSg#))E}X+djFeRJ<`wdm>RO2oncGU_+qznf2#@}nw1=-|FRv6@56;LxM&oe9F4;d>
ziZ^Xz(iaLgD1t?m97%T=_h%gB?RuRj`~L=ctFD*X1YKl)<u}k_M{dLBALN3I4+?p@
zQCoMSqN!E)d#^=whlh4w=#{tY^U>6e1|IZ9Gj-%iB6cXDn`gE!g6+IAJ4@fc8u>{4
zQwj#i7S9dBD1$&4q)CHwo}pvM=tfou=1_F&t>2PA@?gCj)S~;9obeB`F8+%k82cwU
ze0@X`yQx#)4QoMc1X0MuIUyEVh#2eJY!U{(jEpVy-{17?sgF?toekP$9Ar_rM`hH7
zq;&)gtvQ^@W~f3(akiNA9WMJ<no9+M`MT%W^4+jE{da*X{MBCvaV9{#`YK;6z)vU9
z@9%iD>M!mjtt(rodr8J7?e&L<R5frSH4q|at*y0lNL8C~j;l*5f;Q&+dr#jEL^BtY
zL6+XIAP2?Sl|u8J@4stsj%V;Yt1zRooNr|C-hS+iSoEl^NhxwLF)-k1g0*@qi<h@v
zDT|}ev<Z;l{|F>0zHKkeTu(?Ekl6y3ZRH6GbX)vPw#g-FkX{M;NSIenvCpLt^-g0(
zc#g>a2Va`R&n_rU(&_X=FA&`M5=Lvn#{Fze_1ryLNlUOHb~E)4)FCSakb%j6T9R1B
zl=g6J`J=Y<&i<lZpq43=0!^(k%8b46^;!-%4nX{(ha#8g1g(a+1nt0gcP8?}!OAM9
zo4nsaSR~YWSY%e5`tuniQk02(R0bJ$cF;r)1B9bzr>FbNnhpym#P@8=8no0U?Mp5V
z)0#P1%U5KNJ;#jUv&OR>hgzTxe7$cf`m2<NrM_i<Bt5rK-S3l5((6Yr(#7ObAFJOh
z7!X%C%?Pg1Se5xJZiN&FZ*Y5OTZ>2MeEZ9XIkly(>bxXmQ=1`1882Pt{UEJ4@?TW{
zq*uR2CG+k<VW#k>1^g3q8WH<aM%u*wT%pSPsKZc9zEumYgFO%NT-eJQaTT<0cRgmE
zuy}nR#LC9$C84u->Z9?l0p_vV#jzeC)Vd|DygT_BA8m=cAhJlYmrs^H9-SQ<`!M3A
z=zldy+MSM_($)~0Y<exB@)4Fs3k8WVmlvl1DdXTrOyj=FWtr9R9jd#xkOIzNS>S|L
zA^c4tq7)W@ELU$@M>mpufPy_ldKghn)fh6pWfH?TB(JYyMF8j(`XyqSIev$^xo*JM
z;UcXV4<3%DOpL$vmrZwF61fK$b<G7+-o!z&`B|A%66KwU!iO$S+FpuVnJy+@`EyjG
zL$Isbh`q*dy&TQVrJ3t*2?U9i^~)T1xYHz7CKY31O0!)Nze;n1l1_%bFi)01Tvr)(
z+?;8Q+OqxZR^oImMJZ*)`<IjMZ?Z<~Jo_o<Y)AbFbidp6{f_^h?zKs*UuV*mimG*=
z7q<Ci7gJh0KTsWYyhk!!@Dt`SU;UAgO;pyVq`_{N|AvmJ(Ha1(CvrvW9%-bPW7K(2
z#DJi2F>J4&LrCAl76P%4aVhCgq%Tw`mE-Up;(^}Ah0BRDGwr><aSd((I7MR-f8v>D
z>#;+C@<)HQ?m`QGLlRTRMSv1^1XqFxe~>6IxmwOSc(3NZK53e@B2?c8%MJ-UbXo=(
zrx759>`M$MpJwnDCKB?@D7x%g)A%*H#boWd#=A9n3`_|ZnA;}5w}4mP5>hh?Dgn9<
z%DC<5m>*VzpMpmDHuGH!^Pd`0C#?<_OT?RV5Et;4I>aQI%nZiFM~=`vha-08m2M#p
zo)CC%mRY|<gf`i;l@yW=3tJ7&ifz4<er{ZsayII$ws07pSG*zQG74{*%hOAY66|9w
zoO@N{Y>2a%TNPMjqHNHueo}sv%GKO@uDjvel6Q}VtcLD4)vCajS}bGLo+kho8|Q|*
zET@Zf1%2Rl`pur9l3-Em`Pv{NiWnKcE7sb<^Y&yBTZ^3u%S|l*MsayUc<I9$tH_#u
z8agq@%%m&eFV}sr!0h3~mRg34oco+5;;a_!xE47(*w2yi0Gv45gY&@_GbQ?!-shhR
zytYQt)PjrgH~mG2_KZ&(i01$O@Sgd?hjUp+GfYRB#9A}I)<v4%NS`$;qn07#NcJm<
zvbdqcNaeKiu3RjOZd{p^h54M<H?_DU-GtB`hXfnY)`H8%Mq^$mte3q%_2?YqyxxaD
zk;U!;TG{gx_Go}$F*m&SPRl8gbwpo(zWQZeNB4-xp&`n3XX<hMnQ3Lv5ZdH&b?amt
zLOsz^mC~i-5K}1pLqYPuG>Ysto5kEI`BG6v#G+Hs3y>3RFL<8K86kP9TB#A_PN%<M
z%TS{R5<j#hP@RZrp+#U;uUs&K{BDqStNv~cjYR%dL*7MI=0R1;DaKxh9afpSEuT*(
zlns|P{7+zxlm3hAGv;;Ak`=ZZjmF1VDU#P~k9+)A^DnDJ9jK<Go@=Ai>e07K8=-ci
zlL>3#G`uk@oozJZ@D3taEE<l?pMy#u2V61PuT|EOP;8bf?2w(_zHx`$dCsy;Fuq$t
z(cC--;x^lI0>XMIts4Vd&NZCR#ubv$;|NKIC8-9)5^{aswmiCek`Z~>6rI$1s3U&V
zPLRfJ)vzmKKkw?bS6a8eQ-HP1FZFrf6mEpromTNbFE;7>^`=)jnn{}S0GXfS&*9K|
zX(eIv>GEXb1mePf^NK;-`HNje_hx_}yxBZT{C$+<;RF8D=kgTASQY-3r=k$Ys)iAR
z02vfLt?`An_{x_zR@|+TmGH!3V<#9#thA&5RQjxZ%Ws1H5BAkQ^$!^pE_-coyb>IQ
z<_X!2pqRcgbiA%#?QYOuB0+1=OQfh%n?$e6br!oD)$k2R`=<8+*XR|n#Sei^9v9Ri
zwTl8{ZrP)$y>LlRjNJi=hc7O63+ZSM_=C<Pc?CZ~ILvq+T_*BS%yqGHo(ndW{A#?3
zY&s|vH{%i8Xms6q$5O{sl^3hJUP}zOHqD&172fdmKSiltA|fms++nHKv7h`ax9*Bt
z6uS-AE<i7-3i?CXWw|moW{H4LeSjs@_RUBa<fk9eTct7K=|!=+kI|Jzdw*I&ey$g|
z4cYWx?V`&+eoTNtuu97hMg44rF6X~Wuj`Gn+qzEmov)`Z5+Q-zEua)ttD0fA3L&&n
zBlg*x4^^=o9GTW&QS(%kSW{YJwvQd%h~%T1=1;^llfNIj4;&rfDoEWu5X{)00+u(Q
zWEZ}lnzplS1C%>$A`45?xN(p}<I1%qN=;n?4t{g8<O3^+z6402&!{Rp$rn<LIxxMF
zO&TKr>`QDR9bjQk8V=5>T=`0$KSByGK#wK~DUgdTFZacH&`D}AR);FD^+Nff7d`4$
z8r9fvzQ$LF&8KCCjbW*$>#@=O>XLK*Zp3ha^@yGLahJf!ac{;pvHq;+qH9p9>%{hy
zR|jVGu<bki1$O&jo=Rd_FF0Jtkr4DJ<A}rIC<qW&05~!pIBog0b>!~}=(=})t0(>l
zSAGg40^f7jxh<(BXs!XKg6A%^ixD!#aZq^jZ(JJ3F*GwTjm}dmERra@8}mu_{)*lI
zF!OhcmS_2x7-sz|Gp-XoU2cPmd9h}cajJxQS?rJ5WJ63+x_-`DvFfR5efcu`JYc)l
zye`Ic@8?b@<>Bc1et%N5>W}%?=PR4y4zTJs4h_4%)pC0vSVE1deq`0Die}@?Sw-ja
z(q`iuNzZOp4I`jyp9h^ew@~Dqsox|-Lcba`&A}JC-^21ezTc{-(E$20*7Gt0<noQ7
zzJXn~0S&<PKhd_wRn$z(h_VQr(3c11-N`hU{pK}VbzmO{_pmm4HNk0##UWQSVwmK@
zDKgsR>@=K(Sculd_eZM7QZ&g#8`f(#fAqVN#~e#(V4D14&8%@;aarSAU>iE>%pV(q
zPjEFD&M(8iR}KX@0%nbU(hNapHH@~)l^xOtK38BlmKhL$LBT7%-GUgL`&LSo&xlP>
zbJiI#_H_%-S7C{UsPHapGQ_<l|Kq$Zi}i0SRvuHW0OY<<Y;(13y^{JuqOo^Hs?XtE
zsCSpqXgO_f4vfGr=90c5@rL8jXwpl^ADAIz_{tskMUp0YfVtc@VYI5R>cvu!Ur9Gc
z7ShYVd}Hltk5WYJ1CHc!1KWNv8+$MHYsxi0-zkD(1oc8=aUOCM;nxZ~^=pe*wZIv<
z7YB7Em_)ud<_Ac8UX{fi4h%vyQ36IyTIJR009=B@iE7-JS6`*g7tm-B=>`tyMM>8p
z*!?W4&Kn0wVlU44h0ei==aD~7?bz}{H0W%&_rW$J*@KK$1NB6ztGW=g0_TNkR`od&
zm5daw(WMl$?)s8_lZ!hut3uLFf9fc<Bwk~y+*PJ-lQ~88ynXxLM7ctNqL9zQ<j|C-
z(x7{gw}f`3y~QB{l<%!QA^Zs-NF5a=93LgfdmcF)z^zxCJ+9wGmLR#5PW7wk{^1&h
zg8gFyiX-j^Y68S+*3uFpzR6WB=U37e1(Dw3lO1U5O~Is3BasGw{H{hD){}5W9_#VK
zi&mN61rWzBtEd#@sKbG^q&+w*gz0fChX%2*-)>>AWiO-0?R}mud80+wIX69i+5We}
zSHli`;W~~dCMv~G-S#%sNv)&jc4m5_q!&T&ud31-?M{b96RCOL{#2HyGAj@d-xFGt
z-R(5NI5(kA65B}jYo~vZi+uplJ-7Q=$Tw{ygF5Q$Dum*2gY{)E0K>;9nfyu+>WsOh
z?W=b}AmQuqarU<@n5*K6ItQp?&~&jL2fNNe9kkUMY#O3;jbaAk`bVZ5evl7ENy1RY
z3{G99P9fls8=Rm2-OaN6vw<vEya08&xyT7E3vrU}+&uNk#TN=eoa0}?7^h+K4B-&#
z09tb@7bYpE`jUl~sySv<_}n!=-6qN=Rx^OZ_}auhsr1Vg6j)+KMfbF0Y5U2_U-7^r
z=G{O0f~>Wv*{85Ey0+`NL^APT*<FmFW<1AW3=v|7VH;XoZq)pq$<rYnTsXLI7Hba_
zpJ4B*kAFFI$7TWov8$C(>?J>}wgdS2CYO8s=nO$nr97Ropv*YKs2P7h+c&%V)}JeF
z|HpzumU}F8PHc^yzVFz?#6*IQOik_-6fRsd)kj(rzLA{R`dgA9eEMn$b|>-NXP%W4
z;oH&*oTcZLU!+g_THd5|G*P%=2PilY)@*&h$hn8ueZo9s%m)ye?At*vG?-~H0`#qT
zZEqX4RrR|!t}LYV-{$zy--Ka}9dpYnl*&Wf=9uoe$G0)n#W!dp{UN8NGCXfZlWexx
zUysxsKwg!vu#XSc6daufpQ}k28%PeTHq_QFg;mvtJ}Ym9$DA3=s_$$qwt;{ULnK9A
zd9e_6oG-Dm_X>^*2&S=~mpU-=DKNWK3;)bbiDH!O&wfq15h0{51o{lyt#aK-9FgXK
z_ggbXa&J6G<NF{VGQOlLN@@9cZWf0oSaaml9*E5XA)ae)&L{mGNgC;XyXbj%hWeEb
ze8~rJIXBAp9gV=|+g0}W<U15Aje%%+-?NG?o=G+w)V3v?cWmI$R3aL_(Cdm*t0s$(
zP1vP(bK7P(48(C&;^->TLt|h}Z7X7NGPl3~j|<FUI9YyYJSRk)-_x(j53z_C2&Of@
zzugH`{dx3xzX`S!uxEhgYuXP}jEO6?IzJg4O}WXby)j&15+j2NyN%fjZvsU5z?l8A
z;d=<l{ecYzf7($?TvAZe7$=_Ok>F!3lVAJPfDE}3SW`Q-e{_!iic8S)d$es}zBP3j
zIWVZBJ{h5&95w;;x`FSlMY|YR$(=&#<xszdE;@XQhY<1*w!^o!5H(%RiOixlIgP(6
z$VMws8W$f-abP+L<`AhgUoqL_XBne{8f;vY>?dHC?N_NB&*4>%8LrY!+$OhfiB|$P
zZ1nM}o~K>x`AIqCp}?wWoa~M|@0f!uamffh9ST{`x^PkW>0&<<9h}eCvFC@eY(X7D
zt2V5WcLbCq3fGH%o^tTNW3$Gxyi@8cm9V7Bk3o9)7k-Gs+73`Qz&A$E*(dhG;fzm+
z>`Y@{x)LuzIZpNZ8nAcR<>!R#ou@S5kUn3M^zwxj66N`(GK8RRG2f!Y&sg7hS1kXO
zKbKzXMbdMp88{<Ebe=tXNAk8YD5=n2WQNr&_+ZUS+sKx_pfSM%LlR2}PeTIwzh_$T
zyqVjTnma!SPV7MsQzYDq_A7d2mP}9k-_m*?cW>odYZx5xc={XE?d|U3(mLq@dzYez
zjeF(lHOvksXIHpX8}mjOPuZEeK!&=6O?BZN*EHAPdB4rhewCI+vYHWQXg84>mp3%@
zpY4=?zAtq+yOtfEt-WF7ckZxpHmNZ=GAuDK!)LR%TU;)DpdKj=K>40-@yFTM3TXES
zCv2tr$hTt7?T3~;k@cI&wk*?en3F`nfB?JrkU=&gWh!Ig>*+Yh(vsi;k$ceMy1A$_
z_dXG>mOe$l+Czs^rM>Zo<JTRlpej))E!b^r7vNX}2a$AxS7o!V#zo~ojwI@ZqU~Is
zcofUBm&bTGanAAJ$*D?9PR%F)hmNws7|LRc9$2Nh;>wMuDu_D=^NvylB+3Hl1!cuH
zUw5nhDeEm*%@2m!8oeL#86ZrUy!b}PhjUf~#;tU!uY<Q*RAW@WZbhfm9&E8^ZME~x
z2+UYLUfva&(>WAJGIv<yyS~o7gSPd-nz-j9&(9sAHH<ZxGcqmmg9m3?=XBmx#s|`r
z+v)H-&4k!5YK%Y^Sm`b?mBNQtR6|p4buA*IV>9d|(jQ}Lu3Uv4_EeWU2vf)PyyoGY
zQ+H>YFu?Ibs#C7HRy%acIKuA<sT=|ojt=RUNl7LVe(X1~V1<>eYK_SNh%Xv*x9qoF
zN}Pb83}&_3u;G%}m_<7lq;GTt-Qz`xl=Y;aTPldy4YbVjW8%w0I;aLT1noHW2AW{t
zfUYw4PTJ>>l~J0FR_PfJkEZviV{jb{u$tU1llXE7I$mX~oHa&<wRy*sUYrf^@b`P~
zy+#j$um~vjGY*t#oI8(P{ZL?zkw$<Qo6?Q-X0!GRU_6@_xk|B5;=kLi#+6R#Xq!{v
z`;BhcnuziyS8uR$Mv5c~!M|^ym)!RboOkltNTg;h6VdNSq)vV47Whpt@r8%3--mt*
z2ratTExP|uVDjoK+>aYY4(Do2oLc+HMD>CrNBxVmG8pz-xigyPp**8oJ^1^QwuYT;
zvo8-jLuyheaMa1_vQ^IT5#Os;Yf90X!}<<n`99)W>qmu%r0@Y?DNxP-6n%5%FYs^z
zGh9ZSZT<Z<;v%XD$NXmVeP+{^uGf5>QoCE2>6%%%dMXr)n*2a%0O@XNE$tGT)S>e>
zn|R{2q%#$2a0|Zk#DlS|Mu<1j17eTu%I$WZv^DW;8s-p{wK6~LCx088K$FyB7a2i^
zwORgR^c9`}O}1HR?kN4ap7qg<#bCu6rNp8dod3cFD!+FY+4R*wwx5-=o6i{Q7QVNE
z1Z7Z)4YJ$l50|(fhtJ9sPK>c3$>JS=R<SkNDt_j%+B=^%9tv%xIye=mhZn1^OZNL#
z$LFd0aC(j|s(O_u^hU&uuzU5DgMQ~J=BV{GI>h+e6mjiP+Swu+N3HF5i!|feea;lv
zkN5h1pbvV#bWd_%ZXzyT#b&zp(6RsMu4C{$l64-H_Q;R<<V$pe*<}wf)@3&}trnfO
zI&6G;*aQ=v4zqg_ZM2F6;UJOa*+)s<l)6-x5&e@v6XV?jN14|PqbZ^$t?-(I8(V2U
zhvMuFTdVCd9xU@Ro?2%Y1M$V{%Rv-s8oJh_(K3nf)tcx@*7sgY3p?}nP%xM?gc)P+
zg-eW|e?G&Jc4O}yaXJatkKQI{K?|71J>Xqr8y|3COU)qm!Ovg-gT|MF@e!Z4B74W-
zV^5^)wPMa2r<hxg`bX|^p)keos?l(z(6FS}u-Aje=>h?c%!fQ=e~V-ku<d*mgU;0|
zY@F~=KQo;8;IHK4`WiEs%sn=Gkuw0N4k~yCUwf-Lai`F+$HG%`_VmvINj;;UtkPn3
z&7RDn#K2-sZOqb&vP>beWj%=whhj|#8`0euIZNi0cWa|hRXtm)m`dZhNcHj-7QQg~
zNLv>b>mYG-`q^a1>jGK&s<m5!Rv~1n25bAo=qB~==!^B>{J@DEC++6Bn|VVA%;=8+
zsAGW3#OMdW9fP`Ji2r^9d%(a$(@i+sGc_u}X6faq9@K)HbCJF@)1tr~IgQU=!Q$%g
zi44_9>{BbhMKzcjrjf7pmJflf!;Zuvmr@*<r}gd3rdl}c?DNN~i1j<R{E*?6C%v=Q
zgE6|16K&Sk;?vD_EzgICWhz_RLa8z$G&CC#4uxlNkTZ(C*y=PL*&SH4>h~5nq*Kag
zbI-`BTlWN)$myWwJ%^b`OFwBktS$aAyq%DTjt2R*N*%RdxcZ0&Y?JSd3Fw4!4<e&|
zTBpy?o%<du^z|}>D7T?X@XAm<Vg#+|!Q%AnPp&0(`jm68&7mZo1z?l;l{Y*{n{a15
zMD1m+8hoH+3+HsyrVG$F4l=wyW$)L=?g*{;cf$MK$4tgqD5NXFHqRwDJ*@x=%x3{A
zUXEPRPIyj}+jmAIZ-EUUV&copU}E>cj0c9v$HdUOZ}dlZnaaqdx<)EaYdS_k_abZ`
z%nFpTEHxaHGhV0RTVaXg^_;r0N}!MSs7d{p+E}=??SE(Bb6e`H?2Gx*>b5@YeB$2o
z3`h9ds<NexXDLgJ56CWE0+~AwNYj6^!$ysN94-~(S>!)=NucQ$PMf=Gkr=$@ON$}r
zO1j!4a2V?QA~Cmj=*3z;b=<Awukgg6##aj_N3V>Q>GqRyY8f9vp>ws7>CCfG()@|B
z_$+0)9Sh#QJ3HM6qi<WoQdSR&<U|u3>?{gCPO@RH5&@#x#!0O@8qPBvJLhMbzQ}rR
zBlq_WX(4BVWI2f9mW?8XvMr6&i+UwZ67}QFx0<*-LKN^AkztEnK}M?d&<TJ1-i$gq
z#jzZdN&Ay?yPC|LXc_e--_z2wje|2Ff9pkaNgL+#RO>n%{zZlFG8p2IWDJ0pw_!f*
z&bxbT!o8at=1QA4Sa0Mn>1h$>`5eCCT|-8z%sUr&N{Z~ErLZW{{Oqaz+O;z?o|kh2
znujr$UaLzX9`*}zn{Wn&j6X*tjHEf{0|&<jEU%E=Z^XV~%^WULCTN+~2Z9VowJpV&
zN80JmZ;265;6y3Eq?nfLaQYPkFaKhX2<&RxMY%V@+R^__y+Se?^ns9VD^cG2$BAKG
zP2hw~3S1;U^trI^XFCywJ;UQsn*usXe+aAoMvB#t+OvmzXm3|_yDb>Mp=^IG=%{O@
z5{USK47K8JfVMmztU4Xzkep5_Wvbrl@!PPahd+z=){6HPgtTF0*!iDP$6<bC1!{fu
z|D*I4J`>n4aeQ@I4w%+)ln~PC=vPmHA91nd8gL-V17VN(Y>LB^l84oOW}Ax3PgH-U
z!Ko5;+%_K5r`%*ofyANxVSXO15cG%?^4CtD$icbHe4~0v<~r*%*no6*X6B&YA~jY+
z<_)m<*xRLasIk=8h@XhTQSk$bNJ{3})n56}n=IOIxK(_7qzq-bX5oX0<=;J^etJuu
zYidG%^E@X|Y^!;9e`9^Wv4oK^>XeOxI8p>{Jp(vIdrfwBn~aug+aCze`5{^eM#q!k
zbBEDuNl<2-cmvA(m!PDNsqTmhbraB`@xPNoKB6MhqK-TBSmsUuZZ(d~lsWdU6)miL
zCw9)l9@jB6cn$50BMq7>->CaL#t8r1>G>0`Cj7}cy!s18UftS=6IGl%PWoM%nOjiT
z7g;_M!vQcVkrXVmx6G@M1aj7r#Hksdq)N5UtrPO71!~zZFOM&rC02P<;ruDv70TTq
zr|^l}?w5W+MDeYrBxA_UyrrFkT)6j3$ayIZMFf*+OiKw($6l|lrgK5O(Bzu<XtDI(
zysZNu?XvHFp^;8G(d1sbkwjnE*CGBgpDpr$Tw!|#KPzdo*`;%|Ps`{fBM1l2H=3Yi
zZ#5-$e>n`6)?vhP?xXy>33mQHtgQ^#xZhZuHZW{p=RDER5&c}!ELbBA{6r;@FP4Bp
z>Xp^d&m9qUzsgW~Qktg``v}-K$zC<hO6oW}GyStGTrNF964tCz)-=MdS>u0P^k%Mh
z9CNTFrWU9hv9Eu81$7w}Ygi7<n4`Ke*!P3whW0QadH!?n^If*VME+=oFyn=EN|0Z<
zKyU0)dGWm~i<#c4++_~e!4mqbObuVd0Li!bIQeKhAW&esP4^S_2pW!cDTIaZb&}Pu
zAo`ZA|2`?R0{sIJM248~V6Fe|O945jV!5EZme)mRYFyMQA24HljzN6qeolV%_@XE#
zI+S4x=3WU7Hb;IEaH*UTYbz0@U`!9^yA}cwN-^OSQS1w;H4E+Ser?a(LX+O^pDz0d
z8>q9TX0fk47Dm`zGyu|@UizcJ)r!d4eMc%>#*@t;fNS%Le~K@@_@#E1WuvimY^lq1
zR!X0HkdLLWL#!HMPL&*WMDtBHgmg#-bO{>vmF98;o$-p&oo^BJbHAyOJ(9J~BWwPN
z(<~yUMnb}Uv(3LniG<z_#!)$;*D{bs3AByPyl<W;gM2?eW^pL~?vgw9YXcLhjwT5*
z7<M(nzewVWI-iBc<wQxaJBHIcNU0iooxk3hsVSaw$VxK;?e+TmvG}J+$g}|ES!MeR
z!7e>E`U@Iq61s4(Uq*XNts9GxtWBERlUdMy29?^$48^=_s4HO}IpY&_3S&O(VQi+3
zweXyfV_I=JuGS2&FL9BI#cXAOvLfg`K$-RiqGx{FXv;?btOFJSzV(kL)d*Bg_EJW)
z5Vac=oabdk*W+?sf(Xen2zI8!c7wuq+Af0W%9^0%4-oax5FLsh>WJcRDG~H>L`M~2
z7m7IKEOhAP&yPP_^v%}SWE1Hu(8jOV==V>hvUTNMLxc~`fL-rqx5@k~Nza17XBZB~
z^oe5Z8TuMSG<-f*`eHVA+Z)_JRe&NGxzbX#r20pNygG{dsy_xqoq%t@C97n7Ro>>T
z7A|!){_+y3Kx(1yr>(9hZi*{wx1<sEz^!BNucmiT57kxxEXLV90q)67Z>*9fLD}D>
zPq&cdPDP^Kiy%Xg)2s%Et@z|3VL3By8U1A~F|gSs4ak|}ypO?5hs{BCL8fuTZdPek
z8gnAUnlAOOZ6nwI`C1um2{_ibrLpnjIU7v;6nWqG?LvqTx*)?}z9&MQw_?&|R9c~S
z0Vt_&ohCE!(GJW<O3N2lHFEVPGZF^@?YXafohFyOl3$G?7O-rIsF&9%>UNQZ#ucLl
zc--X`g93A#^ri#F_PYm+)5viuX_3wLV^qTzKm$oTm8aI7^bdMqU4eZPV5faCo^JsE
z(QBJ`GMLZ*o+g%X?fq|@YDqKUSfVg+VlF>02I)NAXRsc7S-cJb-70uq74^)jm&{^_
zd{1EnQHS+3_9bLXc_(C-2Ar@EbTViv0on;@57}Ggd*TvX6M)p?!&#7@kMGin{3UE_
zaQ$+ge?v}toNLk<V;r>cyL2}Ez~khGw(JhGHo<U?lF>L)u_)7`__?2Xj&VM~R(0Hc
z1^t&D;Ytyj04F8+0310#MIQ+1YR-Rp;St*&=M`4>S+OuOuQ+*q0v&?0(*0`pIo$6v
z0ruh`3@Z3!*x``*C)2Px`h4D&zduv<jgP~g+ghxXKM!t3-p_26T~~g3bu=rL<b7Z*
zb;2SdJxVD~(1CcK4GmD^>#MWln2OEe6b=*QJWgp0muN#S4p+ijeUu8+-(Wx48Jg#3
zN(w)#d5_a>M>_3(K_sVEi_BE_+hLWc<62MC-e{RHrv*Mc(ad6e8@(1KIioWzA$aT`
zn;wKd*s7b`4_r$^-|`zHGVb6J```bd4Ub%h<2us4Y$Mii*p(~r$dzHm$?C%Xs^H-g
zxnaiG+0l`>S*xeh1S9k8y%0Clj9IMlY9fukS&Wvt_lLiNpKFD7k+koC;?7+6jSfsk
z^?l5xp0Mzs%4BO?TeG;N;6`#wI3J_!`VRq??zi7gQm0$m>Ph5{17m#Dk4#{g(F`%(
z7zVck)095)Ap1)7iPf4qYgPSv<q;A!0qdGNSbJ;u5v5*3zlvt1H4!e!iCtmQ&UJtD
z41c|`Q#Ag7XfBt#$pUDi-rE}`ZItf4YlEoO#!5{3iYv(lEVf3X()r6sw0@gK8$X%H
zPUNYm-57f;Xx^hL-Ou`lEC!3((%o5V@$t?;KE~0%mnX+W%&CuX2_xfW*Ob(={VEN~
zS(RPT`R+813xxEta-xTaJZa&Uu&d+bj}vc~pZn4Skw_Rwb3_v63-$kBoV|HC)NlO%
zn@TE`kc3d#DGJ${7A3o^$ySJD9s52cAw{-iSN81tZtSv7_T6Bz@9PY+oqN>h`}>{i
zoa=W!pYvB&8eQ*s->>_1zqaS&4r8*dF;tOpD;cG)OD76%91?1$%tKO)cvdN@o7NRx
zx+uu3Qem42|7alI!~Se9g){HHUK))=|4j<hfCl11HJ|?^4_P4u{DOvUVBQuLF69cr
z*Wjg2O93Cpm3@D&IWwcX%H7?!mMVXD3v}ys!IrFdg0Yv0@d-TwgP))+tB9dIwYCT_
zPV$PEyJZrMn>%mcfl*E4(G)YUzArs@*d!{%f|5|g5VUil8KQcnoFkj_w${Ak=T_-@
zIVNOs^sa{<_3z(i{kUY<*Z<jnN>!gcC8cahU}05+d+T72AmC~oTLY1NR@<(fEYYHw
ztgvD&^UA$WCqp2jGck^#!a!h#`v>grdF7imcYGlr5g}1cJX}!C31-(ysOvvvKfBLV
zfrv}<;#nInltbbtoyY&wVqTYzn#HyA<=0(H@QQkiLnLkBRrBMnSFcyeO+Sx47nMsq
z9NYt<ih!TL+cl1_S(j$qDxVPC^xm$8to&%Z>QIBjBJ(Now#wm?*8`Zn1I<Ha@B{EQ
zJhS^xY9P&Vi5*}1><TNSi~Ktw<x=|@zqBJQvn4N%`nW;9zE_QuHpr`4{t&+Xa6>?c
zcpgi?mIA#K2h%*<x*a``&x@}FlQ1Z0F!AOX9~hJk>V&>tBLd@QcF+9@PjeCE<<plZ
zei+)!ATgqZ1UQTqo$Vk+K|gatzbh#i$euL1k943qC`943^DBEvt^4g_X$KtD<?Pm6
zYr|h!ATl$4{tRH{jEEuS3mqpm5W{gw`T0jf8c&jT%TAalU4TZpf+@cj;`XTt3f=r$
z!w#Wz8?MEbs}{5}QM#RsHHtB+(X7Hs&a7q`O?@r3@ZVs1R{7bc=VTE=bbXTCepu3>
z)?mJWXa#*+W6*j%_0?}<(df9}sXFNt+0U3|YLalKh=%m?%*j!Uk;k8c71hQRB)%FQ
zcU7z*KsP+1ztzr_Q`lbhsI|gJZIdc(uadm>cWkcjEiGjveP(tZ>9Kk>++=w*Kbj>}
zxwZ08L8xUsD@#ML9I_Da@T&1$K&hm;w9SOH{jd8JzXxREAfr4z7i2I6PiO|R^Xu64
ztV`1>A8+I5wD0qb$#{=R4zjz~5xsC5Fk%EA4G~KYQ0Dj88>H_Rc1#eQ${*);AjTv{
z?`xCo?u?rd+>?P|)v;EPh`#5cL$*roadV=A0@j?gnIQ&i<Sz&otA25{QLLHw80+*2
zPc=sEP{{N!n8G#i^3GL#2WB5I<?avnnytOQd*UUL&epa3YX;=MSoxb?rTNYk0eR38
zzxE}kkZnUQEj5X8O*IAg5W4fX1P=)>8iVN?R08%Fzf$*&#+ctcoDi)QQB3?=GLjf;
zcs$BeAyaQ+z_KBgb;E6zm)lLF#%-Zx3EdDsx82{i(uc5xJga26BCUV8w`f%+SRNXe
z*S$Z(q48*ZSTy#m0+8zJ#hpxBJea|TWRI9`9Q>&dTNyu@8}U$7EY4yS=2gG@I@-Yb
ziyW)h2z!;|&5@mEF4Ur<*{Bn-(}=(e$Ia!ht|$vouzG%;@Ioi_H7JFSXiw_o+XO20
zn`ML*YsG?CJf@I12x>fJ-_EM;PpwzB<t9g(wzbRanFtvo_RC$jz$99}*Q<uN{ua`!
z0U3$z`py$jY|h&F5BfE}Hblf~D1NlkFTrF1bH@AlzfoEHc1+&`1y2G&-&W$!<h{Qn
zuzzx3{~So9Py{@3#qdC1^+~?!=*trf)u=<Wafw|1b-XvJgMul1J{e<Z<UD<Q)CBc9
z?fdSTrBvogjfw>q534ZB#LQr&T4#bGQ~OIjv{1&$d{MUs1yb33;Y#V+u>(SnNLD9*
z!w!DjQi%|&eEIN=Q-sHxWg{I?$yc!k;p5{c^WzM$jncRFY|SHb1PQ;X`!ceX^9mIU
zy!6#0qOV+*hD>-rdKlrkK#-?NOhhP8k8#`A+F^&RNR4q8qGQ-i-BIq^YNtrHGDFo<
zdxb%IPd$oU*7+M2x}9swk=}Y2Ah;*i@rFr`eXlEL-miGJL)^J5i7@<%?kEWEQsqKf
z+>3Op7luKF6U@G8Q!-liv=gLCOG}He>mJxcCy316fNaF);uKrhHolUpg%wQsMu9r<
z>(sa5Dr^e|*Tx8y3x<)js#2qpEuQ~me52aJ!iu<^77KeYch=r+;I*~;4-0@R>Guks
zyY$)yZb#rV6t#{{;G1U<w&*nN7FV?Q2+<?|CAXF(ygzLih4x|oGIXJr6^}wWT2ur|
z8;1^Bg*JOt7}NPU*yY8F2Y8tvN6H_2*nTparpJ&IlFtIs+%c*FrXL#~VKNNfAxWr(
z<@19J3sETKUFGz*>h3DaJBo+(`d)X&4~vQtbaGH2@aYkxixiZW(+JM}E-ZgJPL_sf
z%(p@cMvA`4^PVX$|IFxx<SM$I-klUO^+050c+zpMZZ&nGv_Hk^Ha^}sJh>6Svd?Ub
zh~QER?>rx1%Ne)3^5(D$$09>4x?hJyxAzUK!f3)s6G}?D!+d>&zws$;<WaBRwb@K}
z11W=)-sp<<m`b3p_<AeQWZbs+o3djN94SDv-mh)jv0G=Kl^mH`UKbjtyqDd^b?fXz
z@npqo<aPV{%PVH3JJBn3kqegaNTWDYVaZ(mi9MN^a$XVNHE;+=SySvOc_QWAv!t7u
zA?P+p7zOJUR<}g9P}~>LeBJBIcFF%Z9H*_rMRe)q*zQvl=yZX5ROxSxcXm6Bo@79H
zXAE}-%B$J)akogrCh#mCtK35Vqn5tdtGAQkQWif>ooA8|wyUk!N42Sb25sPu!Zv1F
ztdvPxq7CmwY34;@dYsK?TGd09)r0+mbk!uD>eV8T<WG}!wEpY2&lobBAoFYCV`EvI
zOK+0y>188r^Kr_vd$<h&p32qjPS`C7ZU(IkPb5IyJ@-e=?RUE2(TXr=A!tr3%5?2{
znXV+EV)o=%byywiRdD)EECm#+*S+<x(6?>T<I-sG<bMR?2i~R~DRIP2l2+?g{Lpij
z#`7R8pMGpv*>FG-_GzzI#Qhc2baI4b@N!qGEa5N90B->=yGhtO!+Ntz?LN=W9x`Sx
z3WsZ7axY#gRUWErU>|>0T+*|2>lTfu!B-aI7K`8SKx(|#t%?2Y?n|#k8s@$Xo2O-C
zMpC2Jl=>7Zh+yr);=JhI?@#9B#~0z>3tAb(WnQXHDwi?hhkHA}7Zx5hnVQw+V6^!`
zGs@HD2pxy*&%F`He`~Mm*Bw8}rg!E|`Ab8NOt(&^-@T!iJ9s3mxTULI+xa?|tsi|?
zy)j(krC)@+J!-D8)>Mr|n+rq-Cnd62^rxj{B|7$<URu*s-R^O*?U~H8wNm*yYt6@{
z`_tnyW`7?er7`-t3nL%K&hOEst$x_R@0TiPj?Jq@Pg;eK$ix>vAZ)i<fdY`N>fPrf
zXZ3m&o;n-LX3LAsbeHL7=yADirp_3fT@(%;hD~6*_AuWc1;5&;P3iX^<pZ6J&a9Iq
z=qZmU!+Ddd{N@%mHiBnFoXkFydi>rW-}p7zbNEHin~N*nF8*M3(rDY!EF*o4b7d{@
z*9}{cP-gA#t_>VC41%sb8wHE2k8Q@d(Zh#+H3##0_FFB{>Dg?xyL~%?#?3?X`Wu8C
z?`Zw)&Y#62Co^F<6!oYvWt<(o6tRg45)S4NJ}4EZi*B_t5x*#lPO_IWc-4tJ%y*QH
zA7(=;-66P5*U^^&YkkAT8w){PiJw6d)T5bE6cp@y=c}jzi$m8|7|-EqFKM2^2sf*~
zgoH^~TU_2aEH+1c0q*i1X~=gWF!#$VKG8uj`By!8^#|)L`O@PcXgH01=smvpHOVHA
z-Z%h&2xvccF8Z=4$YGx4dEOkxs&~#1rn#?b+4`h_*|>VYvYlg)#?Z}_GHlqs4`fCa
z69KBZ1NL+GE2pBLUqDmH&1AYajnzK|s(y`ItBN`cF2ghDc%>6d;I$!tV}>F`*cyS~
z)%dyT8)0mt0Oa-8Rhw|9*|8)@p^8j=bz|aXT`ThRrmhmh6Yh@TEg&gPsqE};zeR|!
zKHgi49DP2tGTJ_omW^ggx)rUM6tfPwg&*ZSy=IXf#x#%-?6@}Ybl!XLnt(D^y)K7J
z+o$i8i4slsl?WwT7otdpWFAeVb@k5Ysd+|&xiv&|d(Nx#DlY50woI{zL<1?KYS}#Z
zI}(o)tzT?7!Mlf}svc#VVopiVRq`m(Z0yiusqUUpUiqqh-=p8!gDBF_slr!o|4HYD
zLWXO0))})*OGyK460AnvtQwyyzJJ+-KJHnm1>A<DOi7RNfWdmUN8Y7ZbZE-={~V>%
zjdOjmYqvDqq_TI}Q-z2>*c;ptWQMKe5<95nWHa1%AQNF`V?}jdhd(DO9p;RP?maN>
z%~8&~wdkpF&;Vd9MtUKfK(sJt4_k(nsrM(iOwm;&+KiZf-|4{?Mno2ywnuM+-eAYO
zGgK=xyY9b|?{CirBRZ;9p6hL`+Wp9ST_TtHJxru(w=a0^^FyjH>yuS+KjfWM;83rX
z183{}oy{hyj`_Iic4g=xtH<h@upeq=YvK#>98A{2&kVf}1|7AyY!5{@YC+{pd4GgW
zVlQE>iNEYdf7!UV!BCDxq=1>%_57~{0v72q;a3Mk@jhDe=yjUFWA{+5>$uI8va*$6
zpyQXYX%MJ!Eh%&GU2s83dA<uB{3*A}Se^H{niJ?JSH&*ZHHczb(F~s`s@_xDk@3q`
z`oL}jp`~Um>hUZKG_*o)qF;>Fuw0ZCWcIt|(^CS2e(-k+5{V^7SRUNg1PG{%kSd|h
z&og5`*LK>ZPjsi4Jbq#xXArK!3*CShR_gY+muN3vuGVszsLjO=YhS2BRor@&EPtwx
zkP*Wxy`Y?<tfTwJAarVU#d(9BDt<A4gw~4yQ$A47^AeY7__@-KH|4;@#q9TR%2fuB
zBSGRqE6Hq7*SWYh6fIQuk~Zl(dZE1hu$40+S(u0OzC0iIE1QiCqAD@wR_NCsYSy~m
zZuM%T9uY6p2SGJ7<82?W5lxg~ld>A)OPa`%*r+L6*W6o;SSLyM3C^agFr3Toy{Q$D
z7CyWnx%x}f1MLplQ?0Q(v&p&9!&s+bW#vym)&&U*U^%Q#{I$H-%0v|bdU{GjMlc@>
zrd6aiU0=t8+$BsSC5+c)(#a(?HoSI-FTaL+vZ}J5&wbdz1GYD))56I!S2S`mhu+Xt
zTV&*3w#}&at#Czq-7-Q-yXx4DOjQh_c5TzG#D(tk%J=a_+I*_2=9RaT70}~A9g=f=
znQG=PNDp7IMlG=ZBVm4nYk~byCbPU7miK%zmcJ&x&YMgU68gz#`xY21iX8pQ5#ffP
zj#a@4<R*C=|F=&#&yC9|YiKwqDu0Uhyx8*@6s|8Fgl1ov!Gn3cWlV+3Lc77n$q3Vs
zsdRWeC<7b_5d|la8-{VWXt{3nl}8&^_q*lVmMOotTC5!Y%AUrTNK_(7o9G_m^dTe7
z@ft2;_aqLTRQ7BmlGcUgA+$33pDkT{cP@<C8;E<9H}s_hd$}V$&P~DxNu{E$145{<
z#xVY;(#vRXWP0ryM1v!({*%8*&xBL*RqS1XQTCjCq|7py4qtu&GTT~K7<O}uLYX5C
zZkCyPscLXHJ(qv4zg9GSPl+S7f`IUJd}CF5Q*Ui44^=K073sObmS*%E@f97hhF{tm
zEnfIJsAI%MB_k%|m0#&SLejE@!f>@#Wic^*zidP23F%-4`4Sp8v+oYmCbqUd2Jtmh
zH&JxK-EwKirtaXe5Po8-uh2xUSYQvh76!BSxoD&7Fv3pmlE|pcg!6dPTxLp0q{n)t
z4u8e;f^Wa|TpDYFN0|w7X~lmEF*vNxCpwS0sbl1o7VkVZ5?B`@b1=Xjop4e9^Vtcd
zu2%3seDKOy!BOL#TV1_F<8Ty}48D=ju(fC;YdYIMmdWZIfXw~mj2x?=5PgfJ|Ak-{
zZBoVP2H~1*3da>n^uPdG8*%4!>#L8Qg7})V*wbSaM?$Pn0!tv29Cfypt`2GG@2&b4
zrdbC2M@Coa$*KT)LkWG@N!KIrh%OFg8*9<ae?~cYUPaz4!?knmuyYxt`4n7_c<D!Z
z<-mN-lBR}z689JqTdeal*S04ti&AIlVOyRxT>@>Hfl-KHkW8<F#8~qRY^&pOM5?e6
z3*PnRs<6q}gJFue=2Y5pBcoH2bTN+k!%5X#Rd_@wedn!wMBk~f(uBOVYDua{w)gqw
zG$P;EZq=;T0y?x*3`SnKy%YJZ8&TM9!ew3VySp^c5$C$lj5b1!T#cEv9;q^z+cznX
zyr81~Y5yY9F!XS(LB+@gNK$?SNy^mBJ5}f9a@uZb+p<LMfnHj_;kZ((QqPSUp1xnE
z=;~mv4Va9(qWQ8Iac?rEVc%L>=2gcf@Zk3en*oreIoe^aB+u{huCp$t841qY3A8my
z6=xMhr(A1C%GPP5AkkQ2Gy5EFPM}-@y;N=YJ0%wkLHS#0Wz>0L=N)Uo2b;16giTtz
zp1`V1y1qutbqT?y*-e-5GKY(hISPoFhAJ36ljdTR3%NZWle7U2tfAL;L?-!h4J!Tn
zJ4r+(FwhGh`1TqGWW1daqWDwqojATCPF~%~wh(5N5^>)7${OM@rQGhS^oN&Jf27jt
z_Mk>czn?bs+4^cD)U{Wp=H9}7udXy}ZEu`dCLqW70oKnYsrvPTYW0zXa8^)gEP#MP
zwfmdNUamepYbnL<BJL@oP?g&2{5>%z)67sDcj(v~=|t7X!_JMq+u1c9bSHdx&lzKu
z?ip9<8kJHHW*9r@6`A5KdPSCo4c_OOWXN?I=nQ7Jo3g`Rrhm&eC{dpmFhXhC7vTrK
zcHCca+_(vHE6%w5VS}!Zj&6Il$hKI{Fc)(#4h^MnEiM%6zCiFHdexN1-u)|~dMrDp
z&cM~o9j4rUcl)5vy-;KDmTu`|Mx{BnaT@~-=xYs!q_`Mt$r;JY{pe7`n00|X_$dvq
z1)-FU5`Vr|TR$F;eus(16eSy;+FdrC(sdafVCQgJf6>xSz?Bi{9(P5*iSFn-yxW&;
z$u$ZKc1krj7huRPMMonJ_BfYb?XT)?A1o9DnO0iS+!wtLa44{^<PIC1vK4-Iii+{3
zw1+cd-0<ucK|4?1Vts@1V6_+#k9`LEEP|FpS4ZupPYGHrsxgTDQo#?q!wTI8mE-s|
z(v`l<b?PW&s4%Bl4(E{s9Y5#eZ24=kyCJ3U!$Ym@r3?+zv6ANpL*;cG233wdONZwz
z8G(j_OWt}-Q)4Epc#AoVfX8+gynOiT=jZG5HV+tf8Oj#A;{=4vdLrE%7UK3Fn$CA2
z5-jFL#$K~!z!RlC%6`B-_xPHz-GfHYQ>YLTNsvn@uk9&&wB>4<=jvttIgyYC_|}GT
z^Lbo;5uS=9EB`!>cz6YUXWcJ)vxw0(h}ooV@I{*^F>`f;wFWZ9idx=h(jn;qkH$+B
zC(Z+h;`i-9+3QWOwE@@KLdE&-QzXf|`(szQjl+c2y+1nqoZ~O6e_0=)Th4B<V(7g6
zjp(NG1NA<}9ZV(nk`vXzN%uny{0jYwYvJLoeXo9qzJK;|t(_L2gk(RM!B=%db;wBE
zk)-8;0QB>O4J~{$x)WP^Hj@M>BUM;)ya>KX6dHpcTR<}sI}t?7SkTS6*Q)<T{L$Xr
zBf(q6C4AB1YZb8JD{ioFO1i7VS*iX2=TQhN^nv9J63FPMkLw2>C~{U*Xgh>$+%>zp
zrc`~7H9HK{Emo@-*BC*kYgYR`{F0e|wRWiGADt@_eIQK@=X%q<5x}6MvtJSWKZ)pi
z057+{P-Y{b1T7o-GmQT@cKEEqjgmwy@quI>-%J*Ct0&D4zej?}F8GK5>S7uha(w!}
zjnuu22}gCr1A*NeJ(;2xNz{@|S(X>&Bi0;axsO>^=>fuQkm*W5gWrU!k4oiIYNEg4
z;-mPdw%m{7LHWA7wX^2qo$mO)QbWyhr-YIu)VGh88jt(Uu4Mzl8-#xShn(vtnZ*dI
z=z$P0B1VA?YE39RqyP&tqvMaxE<5B{V{oA$^o4COdv5SfqgDP&e21ZrNgTHmo|!T-
z|5Fd$Vj><<3H02OEh~<ZUZ5IS$hDRLO#q?rwNFqNSkH|J0aa^nvHu#t{BI$S%Irfx
z$wK@!0M^~Yv+vd(loyh)4)qWc1R)DU0+#JKc>OVv|CdkDu!iqjdW2M;&HO_W(z<3v
zU-ik$v^X?2J$?R5z5eP<W!uAXUT4$1-d}E4sk$G1kZBN~>^&j<#>!2KerWT!VF~Aj
zmjY{+0vMind&2j(70MHwHbMXjWoA{6^Vf>n`3#och-tNE4F7e(61kzc_-QH%w{!03
z^%>z&9<!IAKf+O$_Vu1&IsR&7?PuPA+U826jYtGu^r&9(yTZxF_CD2aJ<BGA7Acuj
z_)X><JgNPCve5uwg6KgPJnB?C(su70u4Rwj(TB<IVb(EGU?M&ggNPHjtB^KCHWIOS
zX3GU=b#!c>d9)qa9dT%q&qgLvfUXc|wQdO9Z*u5PE7ySW#7>FGD_Osh^Vqcvo_q-y
zKKl^_O2X-AQcvkCAxxNsbYvKhF@vVkOCzA}3)N`Poow@3G-R9%@@SR@X$2Lb(MY2q
zvLfjae*zj-@kF2f2*a5c7(B=V+vLNYg})(gIhQ(cv@KAA@pyn9v*F~BNcQXIZn*%|
zhQ}cP9<zD$Jw6Liyom)Hn<L_S#^Y26L>ln{Th#p+8I}%Dg$*k6=kLd%QeT6DWI|X*
zLMiieyaRwTk)ULTA%i@pEg$con)RL*pbOG#z9qTHX%h!G<>Y6OIK|h|2)G<{p7nV_
z*g7$a;pyjEcDcF8fY*qM{MfcylB^L5!Q&I5R4A5KX<SYAGHgojFRtL#Hg-;pJk81h
zQR#O{T9LxqD*O1N2?cZt!1;Wor>TA%lgd<L*_`6tshx4jJ3b<?-zg?*QI8gJ{mex5
zi$^qJpcvpn1BI5)H#2|=C~p|WU#Maj1=#3?M&Ou!xp_^LC0WBpBFp?6y*o7k6n&sJ
z2X8@{oWrP9A0yz)Hhu;seo0&)GN^rP+UQvdg?mZI#%9JnGa-OWoQAZ+de!ZS*Vfwz
zEp`n~?|1C#?xLWp<N$8j2irOsN-4$94h+(S*MHiad|zl*3>q({a#bMORgWJ{MrupF
z3*HRexb8`Hr?=oIQt}^GA>DXrb}CT~Z1mHB4S4E^4JiNrk2Z5)pPZi6e#GC@k1{pm
z=;nC7droT?CGY?fe35YDosyH_pdPJ@qP0Ntt=Y@a;0mob7oc9VW*jZu3gtR~9aO$!
z2$cAd>5Ayr*NG<N@AVN)`M~~oUEqyIoAfwx7|$@~c^;ZvbcS<6f2D%qM{;U$yG5&x
zE5P|+q{=`Gr?WerRD#St23S5LAMFha0y+vPrZisFaN#<%j(M~g1_>#gXf@cp24P9o
z^RCKT_{Mrj9WcNY_z;wRG>=miXsnjdtZK4R?tiE?&R;(Nv3UBvx759IoTCQfA!L{B
zLYC;I8yDQ@BEtnQIl;=D#C8NdW!n5;z*=n{XD<7IB#;0f(5n9RCn20Nvd=bJtQsMF
z8$Of&m%xVYJCG&>5NBYP`9yzItxXd-@VY~W{L@4XgkV%l$cM_*v;t5YuFf6LLUPR;
zrNi*1EyMDe<N7|7mICw&zlq<@D#Vig9P2(QOW|0+5H>>Q?87`w@yAR2o6&%JGB81~
zJ?EoypC|r$6hOm3c>2S4{9>X(O^l$V2?$N~EHz!GxNlN;-y@nHl-|KXNVNQ$1|^|g
z>@8IG8;Z=EoCH+h5!P7@h4P_>wwcTSQj%n#v0}>c{75l_*F=(0f;a>Jz<~onct969
zF^bv^z|VA*r{X0RuC`4Yg}-xpnAGL$Pa@#@0P<t&xsYjdF;rCvpt}N51`U71-1ck{
z6WtY2>ZA{}NhF-!Y<U_p;ydI}k9?ZR6Xl`2>v7)O*JzslDg4DmeT6Ud1S<W_r%;mG
znaQSUt>d?|vWA00F!RT<*Y7o4nR_w^0G3vqB?+2awaAEn8}s8wa2}uxZO_o`pMcF0
zW*@FS7~bT7)RFAtrHkDeeg^jn2+np7eI7?aY=9{&KrpwUNgF1)L~#aS#*Zd=4JI0i
zWAm^h7n4+xfAxI+%n45)s=+o293#9nKO2#M*IOqLMhYf~55BH>F7%`rOc-5zp*lkD
z{L(@9KQkPk#fho)4}h8L7QDZzSd#(>5h8<HwqDG00K^uAmJTdl0fm4N11$3#Y+72Y
z)x%i-GLgOsxGhB>a%yZF+M>2;RIWH9I%Bp{5oEYH7@L$G9asB5DJC=sdp%FvUjLTM
z|D1AyGm#qi<ueR^b>*b4rGokcbfOz43!k2tB3Vpj&mXFnU~^{+YsZ|-6}j6X1+e>X
zrD?bVY3Jy<rX8HN7<w9Y#VE~Z+?}8a=yq(^uJnh$aaIs*bC41!rDXDB{{c@F&AJ2R
zotaXhvruF&8M9To2r%#$6d1DqKy(I2jjsq4z+F-qG;$_CK6AWBF@Lx#C=W28B*^mg
zvH$RYCEvQ5DX*h;79q{hgF7m>jXOw*Wuz^Cw**`xVtmpY`l?odZd+v&r)45?e}W}@
zSU7U=S1=p^LX{jiPkE`DEHP?VWk^IdE$kzsT@DgckYeU8u#>du6V3rgJS!4eGXQ^w
zpA<=NeiQS&2heIi_Jivd74;QATB?wz=`SR9?MZcio%NhAF;!6%@T2)dQTx_6%Qo?r
zL~7GwEUz#^3sg*t;(7v*e{=-(1{Ib>`^(<-RG6o3NTy9a0ME;ng1?$*sR)MBqk241
zE_G{1Ohvm4Zrl?caKy_DS;q?HlLJ0?r5vr$jV-F3CQ_(&P36CMnVeTw?EtaulquMC
zfqj2=oqX2Ou7iF14*vA|)kdV3`sdv>VJQXnC=KX4As+^93pe5j4AISa|9~<7yh7XA
zv(Pj=>MTKL%JcmZcK6Yo<G&7N+XEPRxf!m6#XK>aef}lp2?raFWj&_oBSv~F6cfsN
z<P86XIruuy_-Fu!NlkK?fTbnI(p4i%wYzEl-IxjxW~X0qqNt)~sE&xQADd?R!bm9r
zG`fP4Rj*BswA(lVAuSih39!`qEkg=H8Bz907zS_ccJKFiWB5q^0o%(R)+6?`A85VK
z2Be`MwvyLD$><`_Mg9zAXAA%M1a}la{c8_@^raphJ@xR%Tzv!^ZG@7N;GOp7cl32i
zYCEFG!RC#^&<p*ERyxHZq1-67R_5k>+$??7Tm}<KAUSb;y`EIHLdF&7t(MWOeE}A8
zMB@xJI%pAa>{Jy!5>jf!S7<yW=RoP3-U}y_KgIrE`Rk<J`rQuf)=OQ-gxw-J!+vqD
zy%XZqQx~{igPc^cX@kba1j)!d`-2k}LjiWp7PNf8lYKpU!GovNz|Lz{1R4jz`Me&?
zy@~uDv;qk1Y0HDgo2@ZDhyzRZVI=J05hDEvKgU2X$|o(e>BUN_yyrQ>^|Lnst`7|M
zsr5}aGXnRyN%5~H?EW{)N&ZZ-^-6~4t(9FcXa3qvi6wvp2MG_Bp5m!=Z(FI*QKmEP
zw|yJnwddL?j$n9utW#7Q0Tl}RTBIFMCiA<AV)ayYdz(!pDUSEU-{yaM<O-w?j@Y-~
z2~F4;{6(Fh>_3>z08h+cI`B40(Kz-7a#vIB1}gV6gRQBWvFb>~L6PZlJ&5Z5qwB1n
z^T|pcuqw6lj#)RWiGk6UX_Z(lKqt(4I938>7X7@YS>@yXsW!jGgSU;a_Iw98t#iN2
zk07~%JzXyG@*uDtXZ=DW7s%F3J^Q2%deU3-GUQLXjbf=V(4Cm~+Nv89R3Yi)Nby0@
z2R88JCJ`T%1x1|f8W~yYPq_X!Gxwhd&um&P-1CZH^6A2VzX0H9XQ`=OP`lrLuO;%1
zfa5$p{u`gOzfl9(f3=1B)atv{9Fg(t37ZoRHk^^8mg)QF0_QaKw}E!2ZEJcW^Q8fZ
zIB*Va#;lxT4EG}?kC0TZgkMvhPpG~GVL{MA8?BC{2s~m-F3s8(;zL1pR!KohT|RnT
zLEm0)Us`Bx2~pfNnt*bFs__P{F5pjQL;B|&Iuy%ML~R?6x`GC<%7C*9rpx5v2qo>)
z<EESG6nrBm2>1NOcR1)krWZ*0@6XlOloTLuvwZMacE`vx7an<@Rdp;MScdW&HR(pu
zSs1rVT}C;1bQYc<k_riFvk$ZKvJr^A8B!AR4<1&{Rc2ZTl#sMs;e8l?*o+Z|o{$F6
zvx+SN>IOPVNh?i{060DB&jGplZPT-!lnDIT^iJENBz8=~Gm~ZC>*)zj{QTSu5ZZ!i
zGyml@C;1wst3VzTPoq%xkyEJ2<xNlTroN|ziM?QhV0_zF{Z(&jX0Sq@4w5FUr}`Gd
zx(r->y}*p}aRy{FzIlt<`$N)~KGmb~O_QrpyZG8t&ui-o`wn44%N+-Hj4Dk_51@>R
z^$`!Y-+>@URYz@l0i>LAfOp#PQ4k}otVK-xP(igYeKnqst4HI0(77@t2CJo1;q!($
zlh@vZTP*y<|9il5jgPc8SU%@Ch86594^nr)NhD+;9o$D?*JxM}tzY2>pB51L+7#Tk
zd7OkQobV%2)tihkdLN*Ie?kzFX}z3istCYn#A5u`(|Qv?%aIKr!=?prw_4Ere<oM&
zfX_q-uYY?>Ll>Eu{9Ca{<5`jOw;<AUQ~c-Www?wX_jjb4{Uc$9$ewUv(JIEc2n&Yz
zI5Cs|#m3e4WrsJD0xZB5zYNg0OIuG}FW6H^we&IPH91vW7@ncTl^Sh#!`2vKfmjlG
zJmi0Ehe%GsMKt)nNBz^IFJsG72W}Q91eJ7V(w34(vG8&~y&nY5fWU7LF8qhU@b7v2
zp@j@U-JGrCyCCS~2zd*dm=iHIhcw~)4ijGTi?p_)pt||ePaJUP0tGY-Dw8c&Q>51X
zNSPHm{CXaZ4uj4goH^Zp#+iq=RrsG(&=z)L8OoytOz~-YyMK?={p;Dd&w+Z3(isj(
z@?@0e9S1Ur2-FfZ;`!Hpx6#8HSJR#bpB_@vl59`%C^6g&P~Y;YKvcAGLTLj6A2wf~
zRm+;ah_f&PZ<$n6Zk4tx_o@t@S~Tc@iX3&cfR_g!O#Aq71dPVB{{2xjtxHz2=2s;F
z!TDcdUAlti|8)<OiCvr{-A7<bA0fUN=OKu4&RbY&5kvl5GBYz9psRgu9<b<dm^*WM
z|1G%Dp|b6u0DiG82=&pVMt~Y{<w?xx88Kb!ak~pW4dP-t*7_(njN35?)f0l-v40+$
zD=4D5{Wtg&;OhK2t6nwU<>elo&KB@1mAvwh!m%FEcK)lus9m`*ARI%Z;M^hJmeuHh
z5YKvN#;7E1Q#N?etf{ZCffx!wHB`zrReh&Ad`9l+{T_C(djt+oaRh!wXkDHIN(=5_
zS%RL0##AWj^BVw0G4YQ=rVwIfO4`3r)es05zq9^#;%tZ{X;nz)0oW2U-iQ@1c>X^0
zPp=W&Nux25@isi#F|A$4UmuYmsd|}T|E9xyS5z2VKxe%#Q|k3+KUY2%>P(;m>lTCI
z;SA^h&B*8fIy0|9E)0A<uHbw}UWoIlaMs)44cBRbc2Df!8S!<jqEHG#OJ|Z@M82IL
zf@#PSH2ytg_}GSSsoc0lLATbu)Nys-X_e#pO=<UCJ3(rPQohwTe=!2>F6%0nC_f5<
z3H^j>nUyO%YymA*<FQ*uHO`h`N{o&ZmL4SOY)c(?w03vSR%lI5%;LAb8PIc(b+)6J
zBkKe7qlY~Ke+@+FiWA+C^)F+<a~!=VBXP}bBwR;<JWaQF{%3+qNW}a+XU6fT87c{B
z-@e_ia$dVp>wymU#vitejGv31X(|Vz_xr7<<W)^weyM#})3d2mPFG1V%jDW_VohA1
zFydKHx#BJ?BGMs*sJRA|s~>W7`xm8B2>rQwI-}O*33EOt_MN6w@8lWXlGwhQwxhaQ
zBqi4FF)dwxU+nb1eceCePJk)Pci|8d{?GR<s76{i-^FVFD7n*2k_zOuCArPJxox+b
zPh#6Q^J@`6Osl^?>Vl~ED&IRiC?htp+MqeO6FAu(TUieTFUQ&v4-Lnv@j6DgqWQcX
z5(b9zdp1S%tHtLcpBAB1#yvJt&L$$=UMCrqloRxk+&%;geiN9ChmXJoma|K&D)IM+
z->!TBVW9=21>E(KeGJ9edN*rhJS~K(*=xsvssg;WKZtGqhzk8xC>hvrz@r@db59Z}
zCS;+&$S47@f;-`2V&zF9cRWlJEC^7Z$rBC`850zu#0xA^zcf{s-|+I@?KDsFn#t*>
z=ngOm#g~Cr9*d#6RuC_*mL+-GN<O@$*WfNI7?)hF*$L?z7+}{(A5buuJSWYb&{bj!
zKj`M@0~2K7@KDEagP>L46&;sWu8nAPwtPyCmwfl82%dwrx}HCfw)xDzhy-6)|8+_l
z%dNj7*k7H+hAg-zN@#uSfz9~q06t2DN*`%o{d`1^Z&vn^pDa%}zFs!I9xedaUtZmq
zsEp8uwg{x^q4UJ0b-r!rU@3Lf7-fvJ!>3fQPqnS;I?Tmd+Bolt5<^(La)c7%kRhuc
zS43^zYDh2Rb`W0xEq0lmi*EL?awKaRvDZb}(U9NUdH(GP<^Ef^D;@11tK)gD>35JG
z6H?Cl8H?ruWz{Tp*!6WG7Bi`<%v4QKF+=&QZH9%zLnHs(TSY4x$dntzG@|%wobn&<
zP1$D2TliL;NWlLNSL7#6o}S{}?n;8I<y9>|&WKeHxWN2-yHnr`(BF{r(&y+`Dv$*A
zfPdnD^La^g{P>MepDayNKAmb0k+k8OtahP_xAiNoyJ?XBtWX^=u-IaxJ@SNwbM8d>
zR(1aR_R#eA&)hVJg&yCXVlA~;NteW&=UN+5a!E2?rnP%RPGbUk`%#tfmiJ$b52v22
z?kw)Dxswo{F6+1_lC{W|;OL)yX`S)=BH};!H8O_UNpgm{jwlkM?Hp@elqZU5T+++3
zT7L*Y8AB#u#D^+Lpnv<tGQW1BQk00dfb6pz?yu3hsuFgrTGHAhEE8loJ&Z)?^K6k*
zB;;QQSW(V0zV|Y$Uc&OLM3GAC;9DY5*5&x;(}#fQd%F$t#h;R%sarxJ-%#2V5W(&)
z*v!A4f$@70i1-Z?ji+y7Q(ORc@*GoHSg&V5{OZj-$Xc}1fIx32^Hl(WucyHL`*i4D
zB{Vs`-E6Vsd*cU2sE7IUy3NMUC7vm(w|!~wieD3N4-lfFuTim_5fzS=U}rmr+W<Uq
zl1yy^JFN#CJt1v4<+dQr6~n%i)SD6-Vc;^^p86|B$k;JPY>UTjy)rr?w)0M#XJ^cF
zmGJ;R?oU?=oesU<WT->~$9H#fcqV|Aor1LnF7N*4GeAu>x?R9}_Beb^WhUa4lJ02O
z)GZ-Y#tmHX??1|Hjnr?MC%PFXdT#43U;uORTG{caTtPZR_x;uDL^NzcaYLr|_}U%;
zf4IDt<b7D_h;)vv&CVx8IWCS|U)UcyV@2G6qal^pb&4DPJ4@2*CH)rw&#FywV+02A
zA83<7lGEd!u)t;+Vs_h2YfDBHbRf6}i=I+z!4YPcDJ~68Rb^H*tUzNV!EJttQ`e%n
zMB3YoW}0BvxyE_NqLiq)P+U9DlkrjT40JpLfrcb4r??ldjZwOP9%X7{!=+#dzU%AL
zbSiNdFAMQEf(TVi-}6EfE2cjY=f7e{3Qj?JBtsf?VPE^X$Dfm@*-K3S`Gpk7VfjKu
z@ZTC}C+9j2;(;XNdK88yiWFBD+!PP;@wxV11F?GMEO+ura_OcZ*qwOS7b@K1akpRY
zcg=V&GjqAqTvC&I`t<4TX`XB10yhi9iOB54VU2#tV(6CygSxpkFk6+k{KK{uotrpU
zy)l?^T0yVODkXr${jH0zJ-LGO$+T!A?+EQYT<<{i9+<X$9GCe>VaOeah7%ux*X^dO
zEZ@u<{+$0#p)YmPyAR2ciFKhH9)V}io>hhc6y7;t8g^`kG`@rH&Io<1cyxnHIYHt}
z${u^Q@nr@?>!&!2p&Tydal_gk;YM!ejH~nlgaJCo(Gx=+tClq67V}*}oQDygBc^DV
zD{LlDxz7ffE7RK}26c%3ArQh>`|(jcez*UPN;~?8^tm^`t~CS}tp?}nDN4Zgl#yd~
zoLjx-NiK%AjA8{z)T+u!gxhOVwQ|{SS;ot(mC+Lp*;x@k^)=F^F4`rH_{nw@b-s$0
ze^V2|=dbr@NDkWA>o!V?-n}(s@|#qrxi)DrXIzg-9b-90<wH?_Vw!C8*#Ggb_msEq
zU7}D6pM88zeJ+w^Z^k{ZO>Nln$5cr2K>DXZZ5xLYmbxc$dgay`Tr995x(dgozM#jU
z1inX)cFs#lGYlUhMf=)<WzvcXj*O+2!(TLtIbsf-EMXZypvaN=?8!p$OHeD^4a+d_
z3Q9F#x-%;<5UEkL_Ue8|kw9JgBUV@=qGl=;r|wxp9my`J`t&8Wa;zgnK30(DMq{OU
z*R4y;El&eo;}7D!t#Ozovan>~#;_3co%!6|&8A{yY@#$G^(8%({Q}QURG>WYtU`O+
z58tVPnWki$$?Dhz#Sdk+aD$~GBj-`I%boGFW4<9qN#?9VLPf4PA%mLK2$uM%Jct}@
z`B$OWuhW#y*!WfbSTSfilfjdrm%GZaw6gfV+=|q%GOn=ep|C8;GBEej=d**Y+Q~lS
z`TJ$=^U`D>fQcLChzOD1fBj~(NSw0vOCNRv;nHT`8k5oI|F9<mgK>>8-tZ&dOg18-
znUrHa1@6B2`83lN&l0m2N&Q)#EoMBoeCo-q%8iM5DR*pw`0nHft#pVyhp6?T>zn$g
znO2@}dD5REJ|Ez&U<xV=ZWr*@<T}6Gug~Y*KT+*Fso7#vFWEyNC;AfWVZ1~yTHMoW
za5MRFTi^0}y^f|SHVhf=m^YYXKL&qq)Re!HWVAv!Pkaw+g3lm3DBMp9_|Vr=PLt1_
z*w}ip^-$B`V=}vO9Kc|NJraFzquKbga)}pK1<kq^SNM8ye_Sp?R+WZJ<94S+-t#@S
zTFfldW3d}Nzgt6UBaDrWC-$A$Q(x?D$AABRqrcTVWYXsMPs>Fxp_mG2pnlr9hwV~|
zvb;3cdG6flWj4Qm-#2dd)>W|bKl&@6E>HW@l_w5<x^j#~$|i*0c$*hzQ`O*E*2a1k
z9>oWncB`>iFNZz3lp3KT;oBpI(v(;&C?iAkds}a5794bX5f6tcN*uFja}{n#DVtvp
zO^t}yddI}d04q39bj*gL(yP9g3-yTk^Vd3NR;x%PJ-8fyrq$j?t}MJX?)J>OdWGWe
zY~{GJD<iU3IG_19G7R(0!|Tt8WkF^aYxGZm0M_uNz}tVbss7n=vNTjze8agp9MyhA
z+9N)FY&2qBc6VF*p=T?nwtb#w`bFqU9d`Y8uifucXbHKpGl4a;mbrV9E^Fxw{pK;*
zQzgcuqvB-Lusk?{S7QDv%e<jA>l<(2?&56g8cx5R?>eY2p(E=A?n^10rOPHMI+|Ya
zZMcl;N&eW`?vUivJrP3?;eWqQe}Vfh(Y8+azHQA`9z*bHD_QQS_;{;k!TB4+Uxd}I
zGePoUcWO2pvu)V99eNLYzdv$dl)<Sl|ME@Y)x{|O=Av7C()```1eRhzkw{~p@ckwo
zJ$)Pt$6^0dIVU018Bv*{3np!o^4)QF_Yl!ZRo?i=?yH67T|0A$?N>Rnpr}Z}E!_&c
zGu?6MFbk86wc-Wa;2B}*B!hg60@tgVQ1|H*SUW@B8A#Wu8<?S=&mUaSpKu6<Wj6}g
zKvc?KuF$Wv`V381kr_=>VvAfa;$B^}JE)1p9>=74?*v<NZ8BlbvrUhka6PeM?P|M+
zJ%ORdJqyM3&bf`;U9Dmny<3;RX>5#atuuHC=Xwttv?eyzZD7&t#VaUmo+TBgF4U`7
zWQu9o_$0?nNNTDq+oiBfi5q55uLqx&|LuURGw)Bnf75g3yGnXnPL9>{@^zQ7QcEiI
z)2?3I+1Cp_2D@M)HxA43AYArpc-?PShc(AH_SPMdSS3f!wfvkE=KEO`87_LYhdMjw
z4xsowVyM50Toj{G1>4E2)2)&{%Uz0gy#()rInfa3l8@d8Ef7(caNNu0K)xjmD)bH-
zwEJ&JE%&BWH|S#fQ<yDY4`i-n>Xqls*V&=imJV&;UXj&Phn|vs5o7NLEW8R(sCYBG
z$*MiGLwW<@&pk3&)wFeFfp0&#%yKGaNk84G6+|n;o|;$_3$Eq_%m-4>It|c2{~zbX
zKPG*2sQ6Yjop}1FrG?{rruLj=D$82nJ<i77+VX8R-Ju1I{k4(Gh^eG%A8&v*(_s=a
z{dq7@t*V;h8G-FXucx5ry`S*GiM_R4BNS|p8DP=l#Pm;u*N?(wdIF=3zfXF1Hmcs>
z&NaYRQxE+trlDn0Q&Hh}S{sXb99lQU4DWdua^QAwosE0RD^6tRD~osEIpiNxZ&;qI
z1KwLyFp{rE!Q$CBw<U*Flj|9>*tPP~-6@ZqkJE~UQFUCZmC@>qcfaF~CyrMvaazaf
zC*9t%c@rMXcqxF(9DdJoC`V{=cLf>H!)ljTDKLQ<p-x{txT#wcIp33Dn+V(H;p&Tm
z9XR}gj;+|rb%i^+R93p3^%Lh6Uw))af5qUwM^T$OgnpQzSEAnJ8CMSNYNU02xh?AS
z(VPAkC-OgU`l^J~3-y|;*EhmLgXv+*A0BBAP}9<C@NV~j^!xYY?cPk$8}HhG{scLI
znL1hU>ykj9RK0RGaYl_33W|#6ce<Wyyeg+{Nn^IiETXnuJ*{x4FMf6i$j`$ioR-yi
z8&!b)`F}`epN#>Ykx}U+oBY;L!AtwBEzK5w8T>9>*t`ce!4v!}M>WaNG{Zc?n@go8
zAXda${S7m@i{2{RjqG3n7JWAA$Okhfa%wcx{r>cctd8*_GT(;A$s2dRJxzIk%4Ml(
zokGEg+v_EjliU&|%pcxpG?V`yjjhP7{&b|Q(6^r1Wv*wp8{V8-8Mwn)cL(ECTl{_*
zm>%!7@H-xDwTb=a(({T*bWBW5v!PH<<_QYco2ie2W$vV0y3+&T*X>J#?iFk0*5mi7
zq&B~1q4(iXlv%i=iMnjPklS``{AK>3c#ouwmbS~I`XC;BUhv|M^=MId$*17pw55J7
zwFeJs#L-SasUx=)<kXC>2M={tS&jV;T{gYJexB))nk|Yh$IwPaal8`&8%b@ZRZ?26
zihTT14+)5jA5Kd0NW90rJsy%Q-2Ew8*sRNX;D;8aL+HWF(a=wm^}hJU2?qrAL+RI;
zkt-}N6L(t8YF1VZU>;py0{n*4hBrIi<;$3b1qGi3#q*5peXIn#lEQ}@xVedOm>WXQ
zYi%>4IM%G8aUSvvHUewLz*{;C6h~e)kEGEEtkPmt3O4u(s3^!V6u1;#0@>e)p?ccj
z{xKXG;TVjYX($1?&|o`LzByjCP%dGN5x~)dYwOfp_6?Y!)(5uM(&c3fpB5xfzrYvT
z%J$Vg)zkzPxsglla<(TqBFsKLx@$;2Hk3PV@GUIRMpkK{0(w>&w`s+;Of69JJDhS!
z6(-R=Sz<a>c3PfXq0jIzT7r7~Nth+g9@pJc=sk}OvE7M~Od<DOBl*Kb;U(|>Xxv4z
z&QGF-COve-53*`S3k)}pfBvLX;Ld=oa$;Hpn!39PXL5y`@A{ycXiO6EW@;$JS@tC(
znfwjzPpC___K`Qf-=ZdR8@k`*=TARFYxc|c1jBq?7@M40D9dEG7X@WfOZ@B_9-VN>
z_6_Y@dEE*r0;c%mio1|m(3QKcn?8aY!w0j^%ED<d$C8S07xu}pK3>xTH2-1ulKf;?
z_lc)Ds=O};DTrybmb@6X!^Pky>OW)#oYuH%_MC;8sDnQ;yU;%h9zzJ_r71#OG=jy^
zlk#qr2RC_Rmp&Lj{!|qbvN|;QwBukbA6XE_CLnF{jw4sE{QDjBlv&jmR`JnFvNeHf
zEA9mE)-1BMTGR`z4_W1G%Yi@VGg&5IALt<a0JXGVO40iqlgL;1eTk+Pq<5mMZ>->}
zn;fD__A9RvWL|6`ZYbh}R*gfFO>>h(rAI$gQk)#<#1Oi9Mr7tRt<=wHn{1>metnJf
z>cJ=?f^Fv)tj21hF4!XTE&-uf%ImQK3JdhQbUG{sS@6xT8?V~q?c2YUD>NL6Jt4<g
zHQ%9*e?lyNrpfuJS>tbza2M^*#7aBa?w2&ZBS~4o0-Gp2GuqYqu`=p;xrG*|48Q}W
zyY0w;d$wNdX{1ld-RZrPHlMLS(-s`}Y$f2ZXpIW2%a1j^W%K&{HyE<=A2X+_9ri^>
zs8$1v97oO_N4o4@Jz6u_L|DDRO!Q{w&mG0pIM;krrcHbu^?nv%TH2WSV~ju!F1w8z
zW8FOA?P}Xtm+Cn!{g$<!D(oi}Y5TB`rEPPq?x+>0M$G2&bDsgO#`+mMpn8@w&V1mV
z{_x?$>%kvMOHn#grj*VK0T<Sm%Ek$;$jOw~tsiwu92RUe?wI~0AE-v_&R3O0zn1P#
zmzMR|PmOb@TWM}?E;uiCwiwX*{jkK|f#BDR>(#nBeN}0CNl8hnNbl-!70`MA5E|-|
zKTaL_IHcx%h{W=foe5ANjM2^~BrU17x(pkL_P-1$bs8U~P6DQq7$Q|vEI9=x`wQxq
z4EnXbPX>QBMS(a^7D#3#)9emK5<+GD-6J(-fE*KCu;n(8Z^T+|xIyV0DeSbf08;{$
zqVGUc7D@8)KN12RFW-D-diaIaIW-kv-+L|d@lCnaTdkJj;hH)w-h!MlaM_@68mro-
zAl2JA)2XWlA5)~2(^gln3SFSin}oK#jtEzUj#i5%cw?=Z6Wo_syD=`SBd@Hwg{N8j
z%1{5=^_C`};YMoM{eZBM*9MyqX3>zaT(OqJ7hd&Tn9gJW=YRxpJ1zAe7Qp}Wlh<fS
zXU4~`4~WO*qUgT$JTwr<H@Lg9c3Oev=>pYNH#x#N$#3_i){JL*H{iCvxW1<NNCT%_
z7bwcHi`&WXLqLeLLk9Nk7bRxip<de_db@9J<cFPBUKRAjq}>#eXux--T8}$dWTAe`
zEE%1Y4hjm23=5MNl%XDq_ip8J98G&TnFo%E<sO*0;RA8;%J^k#&bfJstRD8Ukkpjm
zPr*Wa2x;^Oz85t22Y~M8?p=#;1w{z<tqgG^+J?B@AbX6ll{zvNGt?Fwt$F^+ujne)
z!B0a%+79!c*P@lErRGL&yy)A1z95b45R<~xo7j|kE{>H7WmrhY78Moo@bH9PzI8aD
z+|9YiiwR$N0(<1|&*`OSX7)uht`80~GM9E`HuT!NMNgkqgWrGp_@{}@Znr=@=42B>
zDj0TCuPh#v&XDd3MVD{Pe?U2n6}+Sj?yD1WVtcHAA4pK*V~`GCFiO0STt)0&K-l#4
z;NG-eyS+5D-F*D~UpQ5&q8Ycws#`=M@z{&USl&~;pems7yJvmy&{|sOJS&2NYSSY^
zkMzS4zm*G9XvcUgp;3YQxRK^30Uy0VJHJWs)AimjAR`%3=R5Ft#(nG6@ontO@`1~+
zp&<vSSy!3;Pfs>ajHLJ-!%-7X!!$)Q;TzCR2aGtbhJdZ?x!s7bRe7wYZuOA)(P;<N
zCpHi*vrYcI8~(<MH{)vd>oA#grOHr7kc7j9>@I!b)6V(*6GGH6qrdSYM#MUvnqR&e
ze913Exq7x^Bh-<yg%vNGIB8p+NM7n4yc@r+G?uHoBiWsZkJpZJJ9nAv2^)92l&o0P
z=g-sW6+6x%#?4VT^Tb;dGI~S@3U7!l3dz0`3VI}VqrM0mvFEzk(DpDyew>PNAgM<h
zebt3oYl(s1^S5}d7=A)c1!5kmn#9&tj!b-L<hfOPfoJjQcd4LjDhk&r3)bPpr=qn6
zzfO5R9h&cvv^^Ub{|X{H;A+SG!F=S*CB%OVtNsN1YSFIOeq>fuH2=2Kp(7`f1xNHx
zI-JvDU9Q@vO?Q{P@!8pemBU`O+{QrpNACKh_^0P3IF1k}iX@xyD!)XJ^;cu%ws5Wc
zoXZGhQRF>kb&XH2AAjd5wH}Y{ub4EJ<(oG{dY0LYs|dh%IfGUEjvs!Gh)^Z48MyWy
z4BU=ko5ifdK;C09*THIVN1?iD?BsN{-HdU#<Ll?^RdE`%rIwas`Ivo=%d)k(TI*Xi
zJMJ2ALahZ31n&4}M~PVj{={MF*78Iptz4`^@*qT#XRd^eT0`Ewl;0r4t}Pqo9O_<d
zE8{NBCmAR6yyBe<Do`bsQ^htaCD8V8cd6xRx_jK~hhsf5mw(gS{iuTVxgc|k;$jgr
zx0XNf@y`!98^lW>cG8lTr;9xg%I8P>4qio{zZ;g{QG^90iDV$M3jk$AgX<9`QEvMi
zAZtLmJ#J6Vf%afGO~Uu~F8e7Pwa(Ybd{oZSur8&%5+L%}%g3u)>;&sb=(S@+u?hki
z+z;8XQ7<_?>DO8PK@>xe(__L>R{Kp3zMu3($9tV3P!RoyGqrjLzdUkyyfd@Bop6iD
z`}ejsS$wHBsZZ88e_JS^8lhM{LHGvFFYPGSA7d&>q5Bt(e+WRI_Vfw8HeE_74QXCW
z>5)}Co3Sl$%UU4gRp;#o5nsPvd4sG=xN}15%i36JoIlr{f$xus)x$g-uij7#-?a+A
zY)vGbAO)(lX-`&~oVv`Z5&LVBnNZZF@W|I74EZf=Qh2>B4Ka9HLGTXs+4C$?^{0z3
zT>Uu>ZFTtl-BSWw0djmkcPGEAFf%i7e|6Ndm2*wjGa`0uWLmw~yQtXV$?a(M(S5BJ
zIp~j7Xy+H}0iPDb$HO}6T_SxGAH_8x<mBWf5gHfg7Z&2M;kq@PJR7N+mslq#<{Y@O
zjZWO(8>pr!{-4hO|6Kh{=HK+8<~|sp!O=h0{`pP)EPvg#y>EGODzZ)uM7_y^vnj^-
z@3nsSzHSz?aqq3Vah_)q;m*OY*uV68iKLr7fA{O{(Q;=BtRKFCkaNB~9haScs3rH9
z=xSTkb*1KlAw|C41v2lGkmvJuzcAF!6xG@1tD8K&0arx@R#HRcGkn>^qu`h?Y~Um8
z*l=uv)-49iaiieYddq32Rm(3AeON66SbaU#rbE!jJ&|-Lr(t9SmnV<aeo%H4F7sXm
zM_8?Ug8ajP3$rdSxaG3{FV5aND$2j@7bOKng&{>^bm$fl5F`XghVBq)Pzj}_8Cq$O
zknWNW1wpzIDQP5zA*5l*nSmkBjXuw_-+k7*&)L8C4_!;Sb=~o;>r+=a&-4?IYtjVK
z|5s@5ziZ3?T%6@3L80@)NvFtLASoccLcd)XGpMO3Fa$3o@7%t#q`@69(#0s#Yupnk
zkumb)@f6ua$IG}oKQu1K8+rkvKI2_RShVekJf7;=W6ni{z^T0Pr0~FFj9{ywT_G&}
zsd5uOjvtE${B2>2ca~6KX2;M15T`SRX(K@r?#i6~CQPS4W%Rizt!LlbY@+0i%yU0@
zH*h0=cXT%naiTtXBsF$W?DWvQtHY~Q!5cV|Ko3^nZx~DUDuf;ej370a3VT<>H7U*}
z5hsLz?ihH<dQ>>_t!u72RId3bSf#)e-ByWfvna9&go@0@ijKMLemzL^ZzaLeqWQKA
zegywPN7d<$@m<Lp%EDbsPRVfZ&f0zUj0^sp1_KTV9j-=&Pm=?(#wk4;R})7fMTmu&
z0a?V<!mUh=x~Ze@_;yfOzQZsXC}3z~{2~`P)1^<>N=K+lpS=)28jDK<$$iICmtUJn
z7iq<A2A!<~BZ)o~kIjkHSf|x=zS17#W>d7*yoE4%f+lVVGLp+Nny8-3^#$rR=~M7|
z#T)fKRNr(?`H7kllbcZw(~=tn(3y3<tvUCN!`jv(aSN>PHdfl9f@#(aGle0>#{w?_
zCHdpMJ4)=?#Z5c}KFZIn^-)-B+aeRj!~ep^nn<yjv=byo8N(u24WT&4zwq;ImHvmN
z&A;{<br0rUn7R{<@@d;OWL9FIq~}Ln#Fat;20bL9_mBNYe}~DO&gtrIbjlIA^oW0^
zpVz?RO>chzcj*t#TS7odN_cMO1x2oIoWM-&&%bP-!_m72*s}S|#!Mu5mmC{B$@4$`
z*D_}vz)WwiFKSonQ1TplVuV2iJHxoHG)`?kG-TYuN8h<-jwL+B_g2SXDSXIU-px-)
zwsd*XAsTiO?=XYKJM%iWB>#GUNOEucR?Pc)OcVb9x>6L;u!o4m?EG(63b%pJNfl`Z
zBzsXi_@D&tX;m5vEArE+#5n?-AcS9<`SdEb&Vh6N8(k~75_rDNn<N9$NVnZb*ts^$
zBRJ&mI$`h7wX;Kvg$-ay9Lneo#~pxJQ{sveQNPJO+`SdTzPqi_H678dO|A}l>_q3S
z^EqvSXfLU$%s=al8|Mjli`mteb6OJJ6f%p6c&tG40g>BGt#eq9pettD2;||Tp_3$#
zMzEEAR|*Ti+)4c5*o$`9nQS!h&S5H8lD|`k7}4%!R@u_3(eRVy&$kl8qTs--GM(-q
zaZG5*M!JQjkc*m5j%iKbU1kjvAsp48+w}o%x66wLQ4&uM=miO}*&<l{ziXk^`Q^$v
zcAgU!7Oq49`C1sO937$a6PW6KuY)~F@R4-0<)*-kk--B-X647(A7q|E@UbX39%j0Y
z$rW`64_JB4Ow>g<;X%N#wP}|&)vGK?spNTi518p>fbm@YgcKOjWAA-icTC-C%-nwX
zRZ35Rx73=l4?)0xS$Orr&#0~3roBAA&D5l_;@VVV+~U9i9k(%YYR0Bu{K$=?Ef?Ko
zFcM$Fl>EHq!(V*VWeAL{1;(ZA+<`&kCz9w^JSoCV|DhkNLfEUPL_V6$nWmXtQVhH!
zAS~6XKHV|Z-_;}>ehYUGZFa6Vf9>3h|CIRL97ncw1t*1ud(TJb!P`Kbp~aDKp*xzI
zg$L@BPq>yGe7hWoeQpv|(oKbzl?F++GMkduKhpNjoS<FU&vZDV+HuU5Cc!Tycc+vn
zdZX?oQN-dW-45Oilx~kQ>p5zRYU^`Xqb6##L<;RDe>Su7^~-DpSi#@8Pz1iOe@m;$
z7=tW|$CKog?fx0@CS~#_L5m}WADmee4J->ZI?6hSQk;Un!YLF&2k@@FG|0XVyo5@U
zbK2mR-9jxKp*vY4@gH7k&o~+-96V_9%xt~~fX~5~kF<rG!c?IGF9{O=C&460)UF#A
zm%W4n@O2dK&u=l+C>#rCkt{jv4jz#o9t9r3V?0tk{D1I=$4L|pz>P*&ffRmlbDm`#
z21?2<kiWag&fN`enT%>7yc{LI!vQT;ZC?Bc=e8E){IvVfyScU<n~t4bL?DK_5rb?Z
z!KrO;NncK$p5|aUIgS}ExhsIJ6=`;B`#WabQEgsog&1aEA~v+jqFdkxHf?y}<}_%d
z<UP->GqC=)`V_Y-?SiquA@018{v5AdIFRRGFDKBXts(}CAp5(NFE(98sQ}=D7Zv(b
z%CAhn*8|8fIN9IL2dTIFn$@Qwz^I*{Wte{t@m9W3l-@s9udP5)QSyB;xl2={YoX<Y
z02k9S)Nz<)_l7ntH@_#5RBMl}ak0@F=nurPJCiRUn}d0#b5UsX2rf0<0pJ}A7$qzn
zqGYd$V7|o0#<#4<r_BJ#w@d3zb{c>p#u`(2%#$G#ca^X&myg*Hse6bB%&SJx$+2@o
zt+N1tGX$>HeTwY@%P7!TKP31k-{-%6)Ak@g7WMt7&vv;}8dtO9qY=29Xb(GM{Fg6R
zHDrA7X{c#6?p_G6Nl7J`=j3up-Hp1<E_|=Y^hZ;mq_Kp+u7IW=$!_I^ED0LV%TE$}
zVP5j}?5-x}Y`U9xh(yi*6D0T(GI|$=wZNW&a6Y>&Z;6KdEL(*Zmgs>gc=eoG>^$gl
zT%M=ry$vGV(wh2IsrGbGirDvhg|zv<2CWb4o=tjGR($fuC+oP+hBBHSIb~B*w*WFg
z`9>U7Ujxn2KOLX{dj24Me?L;i;;e{63m+NKw(1P*`1swGfTSd=FpE76LqlG2$uMXL
z>r)6<=;F7mte;R_Zf<UoNw&|LCA3A<eVB0bdn2pidtyIyk$8;A3M9`zJ>~vA1CL2E
z7dnIDoeuV`SIgnrhK8~bWt$HaYFE?R%OGsgT5SqmAnvCym_|uLQ33qv^dj>=n2P`P
zQ*%c@eoVwBib<;gW72Xd>50ulHh18{h60N@+mA*Dv{<icYHAXOB~<C;P&;?#Z2>IJ
ziDv4A3TKrJfm$@p`{u>L9#MPDDMf{v(o9Dkjrz>jGA33VQgEnujYW^D%~avtd=XW%
zg<OHjjk{4T03ah_L+VRse`xPM)J2H4q;S~tgELa1@e#mkHW&Qe<0e4W-Y2*`J{&W@
z!vuKl86$IDu);G!ThkYGN&G_=e@DP6sZXgMjt~te!FS8-z`bd5&vcm_wM6cSP0(%j
zU7W8@6K-|fK`!E7JY+rXutfVvx7LFxH+N3N+{qhzNbArP_~#~;5Kaa0+U-Y}l<x{x
zc~uovRkfwcMg)0yg7@pxLi5JTRfI(O3_prLBD&3Ia?S_nyrc(|8{V!%b72?bx18!e
z8Eb1pso49o`ullDkG5;0b8a$C2jc|CH|zlx4*(MRZ6?cYp^<!&aIh_+@!kFV_t$}j
zVrDZ@<r5Oa4=MbstD6oFhDst^1^M~kYiel~Ij^dY<tf-8BOem}(-oG0f;1$nGmI+t
zRz&C0gsnCEMogZw(#m&*1<qt%P0EEhs0C$=rpu~PYmDzTvTMrHdyZAqR16GN?kOS9
zK0ZUeBcmN|^Z+wVrHa}sTJ#_kh6M%9GEG!nZ>pp{jN9Me@Bi|b&7R8bI8XaAXo5=I
ziv&wY0!4HY2<Dz5?!x;tltLcjphGZ}Qs=wS&ekXgrk|CIVw8a$tucd^ifs+sf$(?K
zKrWk7!j=5==G6?9z$@sAqa*SjiP!D?g5}@m^r{dwLo>kFCpo3?A^pFV!n9_$6S_bG
zVo5_?KQUzibCvcTtB!b?fw~U9N&H)Tdir15+S<x|DWB9kY@jdq<<4UYrEBNVqAQfH
z1)l1<rPvH(uWehQxZJ1>IiSn2%g0sr;h6hELPgf2?7TO_$shNGTjV`e|1mUV=|A%J
z$G|`?fG`aw3D)Y;2m6HvFF=VN0QwbCNqT?E3M$1T5cYW0WDWS`@+j6N@%!tUuiN(~
z{c6Z=Nd2Q76OV#4>~Yp(1(sH<os09ZM@mAyv2laVggqif?j2*gJcL7mDBmHWv60}%
zk3nHB#B}XzyZZ7Ury{nq%3oedT6c1@@p{J|K9A#=SK{J|JdM%uCah4rkQ3DF+h%*0
z1Qnt5mwQ~)d9t#+Tn`HIL`wv|zrkR54cw-tS;)r0k;?h>dNI}2!h}_U=vrb$N(GzQ
zx`tCwyp4zVU1CL0Q08Op$t~YOK&Yi8eKs561#sJI-&q<eA0;GlK2H^~Ens;#kjnR@
z^z}hF>qT)mS_8FL^3wP~vUzY%uBn!6iwAUIOn@l$LeU_BX<re1L9_?n!d<~{9D*gI
z9!WWK9>JNgc;I8HE!sx9#ipO1Np_zwEs<ohSj=rq)%&}(0W{dAFwuE9=6)j(iKrn0
zY!0HNz!9PGDk9=K;yN|wH)UEe@Z}PUi+W2XS>&kb6nXv4g+DLVQ-zU6h5Fj!cyj5}
z5UCR@g~y`{9T&<R>2J+jYo463O1A(QG%JAy(9G28`v-gwerVnsgXU8Po6!Pcmsf2H
zg^M(t$=YtQi+lu%^8T7c5oP@33jnv3>#{k)0LslfR8myD*7p_wRI)0XPu>IdBsDCA
zF2Q*C>OVU;`G0@X3gRr<mm-MvLNjI&roAtd33OLfR4xP&eGv=L<cDc0Dk$W<QYj6A
z(R4nkens_gJCXF}ZBf;QYR6<?*Z9K>TuN~+=z?{9>AmfJWblQT9$4-tjxmV7$=RN9
zbIL0uuo*9=aoP5S{&fBQo0*rNJIBP=NXZMcBdqZWXf!W7CpND4Mp^l>uNP)3pE3#u
zNn#H}%En`w_n44-bd?|E2N{HwbFf6+>6@dN?N8>a!HLs(f?Xk;Jt@%=ZiKLy>8_Y)
z)@hxN_q}5Uwy$l*Kfn7{@nMzwY^Cbn`Y<e0Bqm8!{1{sA@clUA$z8V29*qvU8w1YJ
z_=GNNr1_G0Q5BPaSSH8W)^B-LmDD^ZIO8_rqul1C{qlD?kJEm+xBY^111?@t=!dm-
zzvK+C7qPMCLW50Sqt-&17wFB~76!4+cFU2IL`bvRp;c1Nl*KZYRNc1#8#Ll+++b@^
z>xko2R8h&!jb2}Xj#cdr?=epK`nhgRJzZa4XD3j5^X9tC)|mhES{r)5Pl$@1##uw!
z-Z%F)Z!<8!RNQZfGY!Wq(i1Yx$FgNQhShq!VrJid7QM40;Uwmyqw5+aW*<NDvzljF
zc%}vAXKi2c1<kQ}$2BD>{`)%lFS*j=JR!T`H(H;ioaR&JCw`uv(MMQkhjPAk$GPHT
zHYK>7PSYoyabLGrblVOp(ZL$rxQ}Pv+ptr)Ng;0T>5#tX2lZA>m^!aXI}6nP%>L3h
zCr7?5G0>w}mo>*jjd+O2TI#A#hSycx9+^O+O~ze~;m*vibEUAea|q_kN>WOtK&reV
zt?DA3Ie6c2Cuv(MaRi+=T3^#L3eds>&jAcA2v{2C;N?<am`M;ZnHtJ-QR3%Kf0A81
zdq2^C1U^7Ml0c*aM$qZ&@u{gpvdPdei#A0S>d=h1m}Cp6y6y8S)56%7GhdkwTM46+
zb@hxru95{!42#ZtTSCdT3L<`Mzw`&`jf|jwjunw7;{@v02u@BmQHE6kQqM;U=R8)e
zGMu}#rq6yrQUSK@S4eI(SS+kkR#VGmy*-D6zeM*;UZCl);CMEKm|m-3)^aC?ESdLu
z$^+{H(9ri|AnWs$X1&6X8hRn-7^N|QYq@<dtKyhf+UEk!B6)U5X2(z)ApOAX?l2Gw
z*oHQdjg~}57}4w=SC6U|^a+4pl}lcnmH^v%OMKWftxof3fW1x<{Bb78`$7NfR*9bv
z)XE7nSNr*U_&W_<P`~AnPX@Z`dvPg5g#C3wXHJ@FS5y{jo$HP_QJMZ15u~oZJ%~T_
znM&WzoYz`*aK^oM-lkXJr?*_rj`Whneog*9xU?dmnjcMi{Yty!BrY*=FJ)>#7!u#N
zSkM~>&Uyplbc|VL?0|5CT-Q@Br4c~0_*|8yQ;L{h*u7C@1~1z@yRI<Qdd(z4L}awW
z#Qu4mg92A-T;XFt@)tv&SY0F^vnO%TuOuUQ(gBXj=P9pCf{%f?5?oM@JxoskPHADf
zS_%jB|H;10>9x&eOLy$<Jw*BX7V7Lcc80Y4-0K0q9<&_vj_-Q$Xs-UVR0v-k7ZY6c
z98lE)ty@JE&6c)5Jqbp?ow4;Tq1Hu6Iou@rN7dz>SP&^Sr*+;nrYelYm<tMSCNbYA
zJP^Xh+GL=79S9QlhnQav9bsLcV;x8>;T*I4C<F#s^#f`)5L7wk!Fv(gX<6S3-0OlG
zQno1R1#(p=ory1{_1Z8jV+1jvLBtNxo@yP|tv>t<Cl|^t{pucmrp?N>{WOb3BMo{h
z7sz&#8v!x8z*a;z7k<4;(_EEvSQrB2dQl*~-XlPHH~eii!(wN?brBTm&6;m1z&xqW
zOqU3p{CK~5{`5`&L&mJ;>hnV>S%(rK2e(Du+>=~P{!(;!cB?%m-V?K9J@_C$f#-xG
zo183-b!4D3R7mOSv%CviMn_oCE6o((tme8=bDh>mC4E0@MwN(L((`RD;P9DlVkgK3
z()cMAkyaXeSNHHYU(N(xi)Te@GsCn1@^^bt3^LZAOr`&#D@VNB03r~{AUbEu($2Te
z6P}B;65A{lT3ZY!NySCx#PB2tTqGboH#0rML2DuRlxBLJ3x<+RA&_^JoRa5QAvq{}
z`r+ne@L&s4LP)x5RR2rH19)nPQiMO31cH%Ph-(7vsdTp3rL=yAS$%{#@nL5dxtCKe
z$;c!hp4uLb8$C{{zq9&CpEQr);WyYlnh4hRj|mN^=68Tt@5v*v+rts-Uk*R(3mK6$
z-7+O?UM(_Omvo|*jww_Vx3h5Oor;rJY}=`wna<2lCq0Aia%?swJbnGevIU8Npg#hf
zMd_!LcUW{N2eUmyJ2~WqryGU$j}G#qtq;%rOun7#a(UsG1Gr7e?ljFVQN}(bpZHJR
zS}027O@5D#{HyPp{7tm;o&-?IJ#MN%d*A`YWso$p_<5nwyZH{(0tNuZga2DlJlvat
zQ+;1Rq0{?$%W$aah_+_MxaqId3^PyEnE&V#ogDcWS?i-<5!pL5Pvxm0Ah!?-nVfHi
zUfUn>C8ygdiYWF1W?6<~Sv7}&h7_-+ZG0g<oE0HIp(h^!Hal}2P}4rh)GI%YG4}Zt
zn(zW<12T(=FzCM3qY(&IW-(`{5%b8jjs8WWx<@62dqaP=X#!5N{56?BKVEVHLp2^`
zgx+K^r~1aO;a!03l=bw*|781x<*DTHG8yAXt8~z#Z#m>X0bzkoVk&9Wq1tbIm~xBs
zzZCGQawEkg%!Am=D-}jM9IM_vYVte_eSee5s=SXp^x;vTKugL25SW{M^HFJ;0o_)h
z+jYwIjR^yLR?wP!m^6K$9C!WJ=WN!Ppz80>NpIRtSHBWWqoP-W;D=JkRmN1i-!}o>
zQ2>Erp;DTA15fF0<b4@Bk1L9M;0UzSF^qi;nT|0Z(jtaAubc)a@Sn|&g{RLsbd1ZL
zve0b_kK+a+PdhR`mB&r|8Ul1m$AIEhp(<B0)JP>&1QF@^!j5#W<EzPDa!Gl8|5QG9
z1dy6#sixm_%e)&?$Xb?4O`lr&i8N(I>}WoaT#A{}w}!`>1Jjq*;3lo9x_)tPe-nQE
zdvfKATvDts$UrkYwwhjaN7aVgn*N*oT>HCl{WPp2mjR6+LXH-qIDEeRrF6a8nmk$X
znv@XKkaj5GA@x73(~oZ9!?N<OaiL-!?q4PD9lo_u|CQY0?BvFy>!&1oS=8nTnU%z^
zj|NmGCn}_2pXeR<qZ3)E2b>_(^fBFsSH~Xb>|>|xr>n=u`Z}RVr=cVRuIC%xN8EWI
z>IDty*a+A(9$fKgHk_|c#w~@&Yck4=Ih-%ITnyAA@+%T6DxuVnSuV4MANNy)dO&oc
zA70_mOzZ)1q=MZM3uAV+&q{xL?Xc4tSXDFWRkmaJj1RBEM)mJRuf!Wa5pzi(b&_4;
zhzaVB&K$JH?VrXZy)|ym9W)`jBbUW0%fbwk3jfd@o%(88k-OG$301((_)*SL|MRlY
zrM=2GquF&xst1xc-jcF8S`cYrrgcAhxUDB6Q94$;tJ^+@P6a#!N_@DTM9%SOB%X(q
z$MOtlJ;!%)-T>~$radr=y<HyUgI%yx1);@#*;(G!D{CTqon?_F2Z=cQW)IeIv(K~W
zffV8Fs-+zWhi0^p^o(7^<06<_?ZxTo&&?OoFiq+V_)S>z{(wmo_gajjyiFTRgUgLV
zOq6u`=#Gln-2~DAMzdL?h<EegxA5Oq6?*qBDp^7SrQ0fP7;PI}w9>X>_e<!L*pWd|
zyN3A~mI|}sJ7kHnzbsgKeDi#I7u9~PtUMACb>aP#qx{NI@9qp%+v3xGaFv#fAx`VG
za|lX3sS0(Z^)dFYPWQTAbzW#0PYgqL+`=Bu*N|mO>d}Ld&xPuA-Hd)R`;a3DQGuCl
zLsLL!`!|>-5+D4Q!mBN<|E5IBPwHF7CO!OX+h&lqyCT>d^JKeCc=L%z@W;_e;#~sw
z><0p40lrXgqWtFyd)+(w!;oQXR>jEp8GG={k>p;>M?WG&#Uq)%b*lujMS4GdM=dwo
znnMY?AFs2;slc8;yVpZJ%Wu8(Kr$5+!T76dOzDs#6#K<_b;l1kH)c1X<JDjOICOKH
z`UQk@V+c~Fr6$>%_vLd+1Gq1&KUZ}9)W|<JZ(z~9*0y7@$ZN-JFX3IJ`Ht<U;WyB+
z2OpoZDkvzNaH`&@?TEb12H^|!)Yh%)L0)@ND!9B#=Wtj`&n~N4coe7Yg2SLJWmH2$
zGrqj}<zyj%aBKlw4!oKtz1MrbmZ>j|9+R=h^6&HsB&JroL1I%MI!46#^xM3tD4LYp
z_L$z}8#of%|MitaEYTb`zK`CV1!0|keXdZ><NIbqq-L2(;~wbp6>tW7Zr5B0>9N|H
z4rN$AtJ!aw0S_zhz9lkIW#y~ksS4!M>P{gwoUY^Ltxk7?=are8P5vq(HHt}j$s!^J
zh`-XJXtJrV{li+&GvX2qI0wyf_Q8eF89Wq-O=0(DxTQD@(!2VdHI)5#+|9dbJplo-
zKfd=bXlw6{70`ULFYfeyAgseeJ1k!f264;d9;hZ3aE+b2k6e8_zN<8McP8d_1a@h$
z4Zp7BPCHGV6%q4xn@}@gS9GGzJuc9N3Pma}-&uVHD%qN<>c|7f@%YC$g=}ftYuc~0
zL71tA75L>Bq_#+fB)!rVI^N&Buk-azr{V6|hj>e%2@|b?V$GFP{cY~T-7X<;dJE6V
zPg2F>W4l8(ItJ^_*I;E{NJsL4y{a?1C~jq|o1r3mCv8Ky$HHPYtU+RF_&i_0>vZRq
z#Afai-QE5?1<c7rAd3-jVgveP-vv|*#`WAfjR)iM(0n4{yWO7-CZk^7fbwc7LYH5I
zHRC&uWLS)j#V1G~J8jf(eACT<&$$0MbM?gsCFW^{3D0*iR>`xtemnTQ@!Pd)KHRcs
zQ)(gg(0-<tK}JD*3DD6EG3Toax@C636|ZNmr**4nvfpM%^3Dt`WyL5ByL=R(Vt1gv
zr$Dbqi}GBtTrv}fO74~@-~{EmrA;j>zob+P{iU_ukTny7$N0g8Z01ZhZcKjCyFJZ?
zZ-U^UOJ-d`N?k25y=~BDWDuaV1f~){^C4chlGOB(*n~a{o;D&ulAl%y+!nb;&B-P6
z^rzzx;=1^U7~9S#3ZZF=C07((RWm>``41EU3?SW#hsHzM^F)f4P0~tJD|E{AXO<6u
zd%Zbl5)H-~R<CJ|sxZPTlLajTLK9f%-k5~|6MF3OtGAMxebmrq)#&E4`zUH2-Y*lR
z4H=0Y`Jkm8`jcC3#9TkWQE(^~BM3j;<G4ark_>tS)LJTI<wgw7zi6>UsSUGv2enVZ
zPIGn)*BQFnX6&}7T^@L$$wuDMM?)1hM)HNqp6yA(u?w)3dLDMo;jnMdPhcJvA8657
z;ea7Pu_p`sDxS%X*yE&C47HUf;^jg(&YUG_yZw$(Sw%^8Vitg-P96Z!Y&9{O1|#HQ
zXo)6Zf$o`6W!~Scc)hm%$>hP%!B;+E(q?sIUsnbk!mQ(pBT>H4w#|VUwOw|(63a|;
zlQVZodQ?w?E6`Uq=lFmwd5@KYV_10dy69rd@qu&!s^y~1&`s-SXzLB)e@Jaf$^kIV
zw=hXiyTfU;`f7H$m$S(GJqc0K=&vYw%Qoc)!m0}8G5J%zclt=fr)z9g_Z%VpTqGnW
zO?fMxtLeUaR?0w;OX#xW6r^#*Zo2y8tAP~TX)%JEfU<X?Jb<)?6h?GCd$KF)F;Jv|
zH>UO+Xs^*YGR#YO_q4a0Z;Y)w0N7mB%zSCEC4=J?6Nhjf?y3o|(SiYq6^;SPwhb5W
zM_*B<3q#y2gWUZ5A{ZrYcF;y=XZQP%eyWh#!Fhobis5Hhf74O_#5#^XQ%-<gN!@cx
zO<tFvA*oGgSZ5E@8iqfyZ#q(Qi$arx-e=39_I;7xx@UE<Nay+@TYb|4HXiE%gY{IB
z_J<a-3^lFg_%rHnD2Gv+UE^Vs#%+<EOtv6ui4+IDg-4<oWJ0?vRP)l2z-rv*4Gj`@
z+mVQ~QO)35{gmlw^VsXrNDS!r;o8o`>gwvZ;o`>4vY{9sCPDJrFI&#r(>HiYy>yG=
zTr-|m#(??ky>*^eC~x!x(GtYMIgq{yC1ViY@D$(wKIm<KhxzN-LxL*m(M<RpX)`ab
za(gB+Yx&EC=Jsu|O%`<4lAuUWOwaA!+sECxn>}=jG$6jY0j_IW41H4sJ<-lcGn`i0
zOyCf?4V-b8Y9;I^3jY~+_X?oa0`21%F3IBLGeVryDA&Q&(<?q&^ez5Pt;VJT%BiPP
zH_uDGa3m8qT*+F>ynMnjHyhoMO@t^Wow=5h>6?v&f0PL}e$oIMLg^)Cdx_`1dm5iM
z=0{1nxU4y)X#9t2OVL)|o)NClZsC4RAtS#z!IzF&Y-WB@#(HfaLvnrP2hau2913wV
zhrM>}0yn!lsmlbJ;IUln($)iwlJ3*id7IkRC5?8ayG+n$+kdr5;KPLx>!Ol*B)u|Z
zqyao*du}rV1GoY;00Hz|Lm$HzuUym<J3D@r^b?AguU^qFM9NWqW;r<AnG1h^ogQhs
zF*r|i`xrv<%Qn!AiaRAz0=Zp#p<?1)mF8<n*)<#&Wh(PLTfc%?vVJ((GD8k>t4O}8
z=MKmLP=}8n7TLaRj$<Eq04jPL0VxE0n(V)S9|!3y?Oe0U-CRvaIS)0-mgrp!y@ekP
zumChj)JaknEWJfL?2c-VspQGp=!)?=j+wSIB;BTJa!e(0rKEqzQgF&0c73Hr11HA*
z(ip>1qvRZ4s11f!cY34cSgzF#yX71tj{dQI;==>yUX}k6@oFPp9rjo~x>;8XDBFM;
za?h1xxV3Y~T>low)3YDpU&ektbMG<Kebm)H^C`k&r5~o8BC1d`S)>J{4S(s}S?VtS
zJDzH7IZo|*B|bgjKi$JmE&=_}E(W&JG`HXPay|<xdJY{n0s0BOfs_7H!|C*|^H2?&
zPV1?h-^XU0T@tm|RlywAzfwfivgLY1RV!$c=Kaq|9@0z`%7p;kMmcW7M{ndiPzm<c
zIgUo&>jEM_VC8~~<g_%ufbCqCn4i+Rr`+=8lh*pJ*^hEU4^>j*vDk+x{Oik$ym#s5
zGe3UpA`r+V4IUcR56N3!kN6NcT3>c-%O{E3>MO_u7NOlK)cr+>2cjTSmxwLuT<Fc(
z9p}u`sr0YGd#`nE&c(?=_R8kj@)l9gEG!_9NS=!2F^kz2N$G}kx%!wBf^KKP_zOsC
zxDWSgE?)F%QW^E|(Ds7-DZ+K3cU}aUCz6x34&l57nq8at)G13X2h-%MB5I=MX@AOJ
z69qK{MV+#Ca0+svT~P=Ns1twy=D#q>%lqBe;*u+6ZF1#phJfgcVdHF;=DmKC9gUa)
zpqN{>(#=eI<;u!qZ6EH$zg(!gns&zFoZ0X8Yt`hW>vbdIiAU4;=2i$SR(vNf?qY4w
zBuIsdWAI)~D)hR@rMstIg{KxF(JJb*Y6kuNs{&he$TkE}n|<xIBq~~ZelHdT0{B6$
z3f3J%G#UvfLt1Lhm&UU%5FOzMm|kyNoGS~bSWW&r6}x3NU(b5H)TMKg()qQp4xlv@
z-~^pw=J(l`Xq)HrE=OCGXES4=vGBs|c7C(Om=}pil`V#SJ3JpJ3Os2*Zr3}s%Y*%R
z2hSM4A}CI87x5k=(pdX+$BXB$U}F!^L`XGa7Mj%DIy5g-^-;}q>&gq5T`z2t=aVxG
zj`UoL`7inapRR|KhZ|he_oGs}p(C$7pz-R}?>hL`*Q2GHO=ZujVgdH+LOB)KGvlCl
zuIX-ZKD_<$JMDY-+);Tj_fJP+#m{E(TFf5HT+`nn5H6sQ&VF6Nq<U$fhU0Gj1mH6^
zKBJRwaVz00VhY0#UhM04@$T#A$^u10ib|ni%f-3(^G0_rCcqs97#HjTr!_HIbJ!Yy
z6Nqqi=VjK_Jp+6T62ev=Oo<e^@5he4benagn(P?{^t?bew`5NU?Cm*z4*5<GEeUZ4
zyY>SH18TM<>k-zEqq7P&d<z+z-9?wUBNsj>SNY`!F#1;B^XaHtdvt*{{R;pz>1eR-
zIWv?fX5@ROGZr{nr0^miFt~>TsBW$`i$%<L7>sdvIBgXm!D14Z1572}u07VmoMB2L
zZuRBa9h4Ofn%MmmrdbGw?*IDcTx)F!+n@ewOCq`3YO!(xBu#WLo%pimWacX+4tt^C
zml#Mz<n&OCpwd{m^!c8<P$tmR=i^tqIlE~^qVgF#Tx#3YHg9LJDVpbXwd=O{Nssi3
zIv~>iRZ#JuY+Py?+RcaUtMff`xp8)es%TKF`<)QOpWvi1<FT!{@dl^6wOk+nd76tB
zA+>#;M;`i>4K48W-sW`8mnyNUr~epSU;@B}&I{8W=pn`32q^kzuKh{=#vjYY_$J%)
zh>&<d>2<jPVsz6X)^h-+`t~h#&Fj%LmSL!~8x1&<@A<7qX#S`>W2{y{O?{q#a9=VK
z(pIs46;8*v*JE0aSt^Iz1uaA{d2vJwvS%UQvP+k`C@gWxVdgJFLf4ijyrc>XVVddI
zHlkE#)(>F5u|)@`ZacG2g<kdF=X)w|20>QVnUAvb1Zb)O4!k!Muq)hodw}WDENoQ+
z|5L~N8)h+m>wtmjQ;2)>8M?vGYx%|Z4`hXIs4oGevbP;=uad=|TKDuDcF%9)cvvmx
zpqy+0T%hozcqfSLeZ`-gDbg1ffL~Cf$a0$Q1TC3*<;Di8<;6nDW?W|Gs+{Bg{IiqM
zUP>k#Z2r!HG}hFgp;vx~wknJ?zLD+mTKkYm%|40edcJ5=?YC8@i^KJ$OaI2!cR9Hi
z9T3iBU(XXCs_l}xx~Xa)J>i=8Id&<cOC=NiLE#C|fMq$*Bx@O2nv-^?wm$KNAx8d?
zmA3czjJw)br_%>Wfss>np7hVnc=;K*ot=eU$Lmkhf0(~1uxW`am0KA(xxsJ>iZ=9*
zwLcpN8#Tm|Dr(kULJD(*MgZRn<Kj{U&Uo)7_d36nWBaYuPd**+8gqQPoxLa1lnFMX
z4#a*6j6>ZV6Jivx8?O;S+EDlzz57*O{5sK!96^<FK!fEt6)MFcvIhlrc>?j=i5m%w
z&Ggiz#x4^H?!0P4<6RWO00sPIDnZ*H{qw@9<b4DK3l8IQsU^EqX_(+}KIx%ZtU)oU
ziE1-$c?>%r<P{ZoHH+WWiz?8499U!x?FNK29112Mxq$Nzd!!EFatV#Nv}xVaP_C2$
z=u-!+Hfw0|Kx%CYshm?wSi;s<09d~X91+~ubJU)){FKLSZM|W6e*$prTRZ(zCm7Td
z_{rhorUq|i@+(b;P^2u8Is{$SmnL>02ufU@24A=n7`cq+<AYvp35I`{3zE+C-ZyC=
zJJ8SRknaSCo?0Z%&Ki2IBqv&RyjR(I33{SXf6pW1ngVP42vC2<=CQ|_!vtbO9$0ic
zobVs#hg4W;^Mp>Z62!BrSg)2Ol4=2Gm>;N=bKm~wUtZbzg+Ozetuqn1lJ9}wgP7R3
zIK$FIL^FIS+n;cV>{ja7K>DN1r%<IM5$AYPWlCX%T?3#@6Vjt^D2=2ARV%!JRIxS4
zA7&{DFewHzO-vYmefOmNd-tU2crn;0I}XYaYkBEMbGHUdqNjuytzWmy)JWjoGn5y+
z>}xIn`(TUWfwjnbI49ZKpw(QMFQ9jA7|6x2HQ3C*#?<BWG=j}~Y74T+6H0v)EX}xS
zOv^x-J)<UF=33E9LXTrhyuPpo{dC1JF;3l;%_UacPW+PsHE42ecruj~=42Fh5|}4R
z?F*W%mai@nbC$a2de3^~)=I2<*?k!Oe1VF=-0Oh2kb}2;UAn^cNnTX{RQ*tBNeZQ*
zrAe%#B&YQXac5cnrrO+yv#B(ODgr?ZLNW2?<~c<&vW=mIc~5vYIYDuGa19MXGWv%#
zdVSiX#_>)s2OFZs!AMdeAd4YBe#(!9n?`-~RTLiAa{YTVpV$doR7R635yy@il&z@w
zflc=AT+iYy1q)g#1|`UOh|U7+7El-@CnolwV_yZm0h|_&&?gz^iTq~)PuWonqr=~y
zOd|{rXHn_VNWS)bO4?fa=by1bK_Aep0p(2+_Rapeu3bs-?$ajh7?y_xpDTH$4n|#3
zg6sR&p4~}ob<JF)va`l*l%n{%3-6MJ1MaUvkMNbj>hWZWgIX5hIqw7cjki#e>2DT^
z`Uh!gj5c!xE<gA5-g?`#gfhNV?DQLW_L%NE`MLlPPwI%iA)D;ew!Gx2ddo%<oME@X
zSEfE!Tj+C{?gPlD9ICxU(qi^6&y=C=G+nEvLnK2bCb%d0lR`w~+Vz=td?<cYFcFA%
zI+7UQ^#G&WNL!^$!7t$^f$&zTVhivThKUFX+s)m;g0@J|gt#`8=*AD9=X%{&jfpD)
z^x8_0Jl<*`qDru~y|f>=EgA_!#*i)!i_^#`9Bbu(w-I0FBLi4v*+QX|JptrEh1gEc
z1+n|!i$^094CM!z#ZreRjTJvF_R9Pg0zRVjKiU*cA(grR%?tHA-h$Di*I=UjEdAAx
z55f>F$GndScfPNY#d<rQ8mTi4xlHOhS<7X6AGg!u8w=w0K#h1sJhld0;kO49MFzcC
z2L1o5-0lCLTpS}L@+M%5(r&%@29oIK@V(8O5P!V!JIZvDCN$6>Gx=lRu-5%Z3I&+@
zghr5(ie{Xcrg9ESBt7w~c-<0aDGcyh2Z1kaXTFXSl1sd*Pb^eTG?9t`n5@^DjtYnA
z7iT97191Bcg>5!b;sW<TIMEXEqpq17mj>tDda*vbSW)lsVEMDpFHMFYp&BjO=e{X%
z)FV%QnjeH|q}{X!!_SV~4uSP9#S^4Em?YSic$@ze4SsX>Ru~9qM1}n#*}5N#@B$>y
zGhxSN_ay;4ID^>yOsk2@yOvf4<c;0;J2}X*`gVhQbELp79agC+d-0UG#ecrlo*N}P
zO>j;KWYH9gYJ1NQ)9z+Y?}3rVkLo&hn21b$0WmrJ%cVQdZ6X({4S<Z<-chmI{nlTX
z4a1;{v7~H!yaZNb_lDD6Gcb}f5oNe9iaoEjgMXs}G6}TSKKH#(@S4x|3FK3kCCVR}
zxYJ(CrNw+lVO7ug+sOvcS`bwf4@zW=@SkZ`3rGL15g~R1@%v6gI)}~sCo=FOr*{M`
zic7VCA?^A3xM;PdTK)5?q2=7dp5eJ7HI(t#H)q(Vo7jX<RQo$6D@0?ovUrz9Zh3Aw
z%$4il{E48bgRU;^*=pdsYMb$B)&RDK2UZ^*1I=Wwz8w^^)Ci{?z>;6b3TVYB&2>)R
ze~2Ib{WFQMajDXaGO`K6O@BBc?h5vo44(HbW2qoOuug=J)p0+&=1!p2Si8`~r-_-A
zXQFeb0%S@=_5qoUM6JQd4u}1_r`LSgNd5F$c@~yG+DvIRg=FP5hOtm^lH-R~>S${(
z7Z58ezfm`)8uOyyM9ROU4CCkLAJhsQH6@)Ap`)Veh?(^>xR>T|;~!yH8v+DU{+jEv
z`)s_A9awnwI93g#uaOQ0E)jV%5&>fVXj2ISK$A~OfDEp0BY*a(zDgCTv&-#HgS&>k
z?adU0v6}*IaWc9FVJI6DkxfJ>wkfrZZl3^`VusBiI1P>)t+Q2ve7)=Pu=!J4lqqbX
zlI8L`RtXdv@O;fdEdLAy|IgqsgWV~vEUfE{jMp|Ue+c*Xz+^LvU1wnp&KA_4V%Y+r
z*P=s6fZPu4Zg3^)5oxPEQuN~<!xY&TF**PfRbTHrG42@nM?$vCk0qNoAj01w`8Y$4
z6unHOaVKol7ef#kx0dkxqFVnYl0PGz?xB!TP@w;xD&X6r`~(6t*Jk6`PQP=W5A_Zd
z!WNxz^-*L;DIJv9R;g1T!V3qW^78|yG1ek`>N}$W*8<<EE+jIbc7xJ>p@|G-6o7}W
zDBd<{Ewicf2dqIzCgAQbT?;LuZFXk0F2i<vfc=HP(G9p5r#FrkK<Wz5R-#M+%aIlp
z?k0qjs}@Q6&jc3#R{1}k0_{Fk-#^+MkhDDeZH<gOQ&e)kRJoJ)4{UVN07AV-ZhTuE
zbX8>mjYNOqtdfMQgFJjE?Anx&Y;vtNLc9F#bd8%Bl3f;TmDC;!8V)8f^T}*)4uw<U
z*wHFLtvh~)!VGX(P`c8Gx`txd8$}l`CHPaBHm`gME@k?cwy&w$;%fW50kKLyuz3H&
zC#n1MBp1Z6tI{&(vQoRZE^{4hqfc7X68;)$s+{2^{}$=TBchSu!E-}{Q+0!(uKLNH
zdO}~Mz&ttf!d;-vt2Y~COwbYxr~t?%TY9{}2;45hZLJyeZ<%^?Gl_dNlH}4xbG}D-
zdfVqlOS!L48P07PCko+wXR!b7{QrMP!o&Y>IAe#)hZu2g$@%eZQL<tUj&Oab$M(v>
z5by&z#uxuF;ot$|Kg4N<t7e-#=6=+4H~tWbfPW$+IPtIee&Cn|efHh`f?&vhwbfa;
z#~CnE(4F?7OfJvwWCX~kyAb!`q3~T2>=QVe<gZ0!sfoi0Ee2KBRP6@+qjly#Pw8LD
zf|OHtaw-M1s`W08w60(NodwX}*Y~M(%bWYVKvqCIgnRiSzq6-D^X=OQ;H5$hCqifA
z#8oauy9krR$X0w;yhncE|5zdazip%cub*a>?>_#o&VksF*dN?gRf1!z!pXPUITBnL
zHvV(7|J{qnBltf#3rML5?1<PtNe@cuwTp@9o3C<~Hhx=^y$mpL-z3`)x0=j=GYS^{
zy#9!tJ!SEkH#HqypG7nT1W|~QSG=DI5O-AiMTLb^hKb)5`3&+>L{<WppYuB-3Q441
z9uotuO?(__lYOi7##dixcQcp`_uzuV7vB$VK;dUHZrjp+Vs^HR@WZ^9pEF@`F+{5D
zvR`g8K7fDe`Q@AwKP7DmFzL0YOM>m<XiuAaF*72k%~ydXdVFK6B*sqqUv-<8+Hxai
z{2Qs_x3odq|J{6W)p3VMTOYi?e@%WmT%Ai?JnVUmvha4FO`!OHGerN-Z|Z;jq&Uit
zL8e#ZW^us%`_Ue}{L{@WbN#wGci7m3v#gGVJ}btXN5#jdrz;%;J!r}dM6;o^V&m_Q
zS=?T{m}Z+G-Xu7u_$|DJ_dgpCZ5~;Gvzk(77@h8=vYbam%K^xqb!8K@PbNxB8GkHE
zvBhdOhz!hDJLIFTqdrDNC{F_+HZNbk9KO^NX^y<ZTpdSUYWpuSG~lSC03b;*?@SfO
zQSn|69qt4Iv6lW$&Ig=QQW?*ytzMm|DVHLi>%MXT@WNc923IXbMV3oJ9?vK>=6_<<
z(Z=^LY;RwT^)o~>nsFX}<DLsx9^w6BbcCA!%y%ivR}rs$5tT+A726A814$`7DEL~I
z`cV)yvNY7&EBM4A-adb`>DzOL2lDsM1fJC;tqkF&s+q)`h+L$LQ{y(jz27^C`c!&w
zV^eh4B3jb6+kM-mW4+EII{WjEs2D>Z{RPmO_{jyfM_P%`05Ha=B;St$GQYI1T@*)f
zh>9ixs*hJ&Yk=J$yN{n?BRoy#{6y!sNA?-%5Mjp4JziiugA~vjUO1_(JF#1MjYM8S
zl8a3@aWYR^Fypq(t>WO@n-TCPI~>;p`DXB?#{1ptmYaIgNVZ){_p6OWQf(O0&=3A+
zcRphXv0SIrKG!nB7&FSLfYb;1>POpnU7b*^Tsei0s++osG)oP4))Dvbe+H&k((?yu
z+3!Dw{5bs1qBaafgg$XG+NckSi82=)iDgr=-kCivFs}Gm|1Ck_&2;s<R|B5+-&n+l
zD95qSp$0dAHto6X?Xs5$V7lvc@7v?w9kcZ*rynvihY0f5*#ooyLBL3*Ss(#3M@%|k
z_u%B`kJ8j)AQ^jikXKiigx;R957GpXQ&P*xqw<QAC;;-H1-KSXAU;u9yUMfHFNxwG
zo`~dtgHQ+y=N<`6>{fCQpTX#}pPEogF|NCJ`Af+X6ZIbJ|N6$>Wq@-X;ECwyPmUe|
zf|7Y8XgMf{hpUr_6;TERY#afaFBY1AQF6|;wih$=mKI0BOP?RJG@b6JUIC)Q=w&U>
z*58f-P7sl<&TdVDPhKUe7c@2V0e1-4aNnX&pq2xvqWOS|=DzI1hUT0hE>v^$!>|d7
zs2mz5CY88PvoNm6+syIDiK6B5rIR5R0prx&#dj@eLYGRz(wA4TES`W_{|ed4m5!T9
zY#V(i=FBlQ6=sr^%sLC!Q#ZD*xCX-M|1V=v7nb}(qO;=v;!UY*3Xxi|JiMgE{gF8G
z7s;H8+tUw())Cwzu4gBa@jzW~-P_3+n!CR|0z`D%<}AwR<u${-Ql#?B0dA=Ntynu$
zUW^)ut4kv;xzw`(H5^MN<DsT8Q9cmv<v&rX5BrnoWMStrDKbl_BLRIYWIO#3a1mX@
zu-vrqHK?`w1ok~m9(+_$3o?3lun-fW<FcBbX=18*Q*pT*$fX|saF?+CD$@zU|8Y<G
zUn}K**_0>*FN+>0BDRUChd-q4cf^_pY0f>HhP;6Dm`=s~7tz3*4!6Hvxv|K_C73Pe
z*S7+!<%|kk??!usZKuD7B0=|1`#mP=>heq7DuU}B&^Pzock#$XeZ3w9i~!({Mq;_q
zS`XN#;0#Bego}QdLj|OQOb0f!G?k9BtMb))9O#~Fn?op=oZph$Ox^qCY1}or`dE(r
zk~w;5xvFk%P8b`as-Na+1EeWkc@2y%H|FScrRPw+uEQDo*H%M_x7>?sy0JMMK)C3G
zCBbX5K$A;C2@cu?@6XFE>^146PIe93_OD9Qen)6NbD-@Rj$>V2DmSu@PxzXO27gDM
zUlY^RCES=OBNJAPIU-GKIcxzcJbDvvSqUH+1{6}d_t9b1+IpRRT32z2x)v@YvrcUv
zV0nUoM;K9G!s;Uld^3gmU)UemjG3rh2v!NkPuDp<z7UsgF?qN&Q)>?{!@&uEuPj$)
z@h7lSjxI1wI|mgKjW*}yCE1F_CHU0$cP$m9+TB}UesQXjT5#L)3vRy3nXUpun|Uj0
zN@V&c2=;dQ{7uW@(wD^1^{#t^04!WEK+enf!!pJMhu$tEjDEV3+IGu+zBz8Re>)e*
zmkSGz%#C82VK7S=n;CK&%;n_a3D>%92U$1S=(4<&yaTY@3iV6<D<yw~v7fQZGfHQu
zO;L4xGRM3S`3jxQ1iL0W>5Fd`Cb1`5TI9NsS}!F-1(jY3QV*p{>vj16XzB|=Gbv%)
ziLvU7h2YGHCXtmfpB_ed{3wq!XLzo+?QCT-`g3|8_OsZA#<U%((Oy`pWGV4v{@2Ys
zU+b}aXUkY^pXUPTCSTtxp{6^R#*NLlBMKZNKzg8>M}!XHSKxKbWS(s@*udZ5^iGdF
z+D<v*&$2F%XkV)(o<}zv{7rODn`AwXf1(+7MJA+oo9J=n9&AqYGp68}Hvr1?A4ZED
zCxYI7vWnsQH<bJzpE6dG-A9e4x8+j+d_oU*{kDvP$>8xkE1_cHrl*$5nEib6U{0nt
zZ8oc>p<$^McPR`+_wvPxIzf2W^j90o&#2EUdd6>=*R`j8+qn=cCz_3yIUxX~QY$z1
zLb@7=rm$Z7DT8J^(C@q(EsefTri4x`ZUE#AW1Cyj^m}qeiu1%M?COvS6cCYIt1}7`
z4+i_(3fB-x-DDB#N`(f+=4@YbH<tveHZM0zNeG_x7$>b!6~$9U59{4L6eF#7<H?3}
zsWE{xkU5ih<@(xd{*8nDflE1lb@8a`qh$UT?`MzCfY@?{OTR+oL#CuW;y6czUJIG;
zL3^V&5CLbv_R@b)Bj6mj3X_#3nDf1Wjs{E3JBN#X6!XT+6`SfXs%$c5JOKkDwc3HY
zfH~GWH6XY+JX=%Q<qBD{vHOCK8`G8u<VwSOLCbB8B>343&HU)*>Gi$13(N(-XkD1C
z(mIexb#^?GeYpEX?Uqc$oT_x6xCy|Y@s@`TE3Mq>S0%99O;7U$lE|WSITbqZ=@Wtk
zJo^6a2`CRWvR^8BZ8f=R*=BR!VmzsevY+R*G$buW{OIoJ-0p(!EATVr27PVTr<DyC
z=L%{2f(hK>C^B~hrDXAk)iWphgXWY~zD2>%X7nwbW1;y>H9R^p8g3+=i#W~?TU?MN
z$ShtU{7(Yhe&3)v@gGZd(EiN}Oq9A?tFKMB@1<kA*!B8lVui`SA_V+=<I!YInp)=?
zT4xi7b;B)zcoXCR5TpICPy!&gf=qzmk07#blji(jdN;bT9TJt*Y4J0-0d|hmi+T<u
z&Nzb$GVe|Pwc%yMMjE<0AIefmzgReCJyVJ=z+#`-%+%}edL#--S72XqhMNQ|)VuF#
zdS09z;}a%+e@gl7B?+u%coE9Ku~Hrm)lGij_&)S4D@HywfzN=5^x2i0Tb7;oWF{kL
zrZx}8_wCog_GemPOGqQN(+j#t<vbdM<C~eUfz0km!7`C;Xki`!dC?_JI2M|F+VArR
zbZhdeIFo@sfiNpt4v&}WtJUj3nnCypd_I)J{lh(n4n1IQ%Gg1B^qbXhvBlfWs^hc+
zewF%8teGRA_!o14CYM>Wdh`-_1UNaZMX73EfoA*0^P6zow%ZQl^BS985uoV!eQ9|0
zJ=;9<J91*!B>{E!CkgsT?-gtVOi4pbDD(r%HH8LJA1d})l_C{Qqeljxv07ith|#t?
zmZ2MLkRrzk!&C<Y&;)RxZopisRNn4&1sXM^4iS7M=6w+dS$YWIhVq?Su_G#de6_Rk
zWi!>wq?V!VpGN_Y%^$Idwh{xVRAEDc&*;{uMnqA$l3(WT1LAr8Xo;7Qch(Fz&Sxr?
zrIZg(CIB*m+g6(Lsv?Arn1}EAgWM`08IhQbPR|Z8`|Dsx#}vVs{JJlp4BrABW%2#P
z!Fn1(a?a((`{-v+T3sYD3&Ea9DqWnPk<NNk>(LV=$?4QxBQN#l36?)qnV&Bw*gd+Y
zi@fH@FkL!>{4#8s?&IJ141B=H>f;9l3n29tFg$ZDNRvNhwi3`!uawWHuxxeXbk7^8
zv_Xw)OMzLS_&R>`A19GfR-dfn<b=fwn%3zHE>xMG>#U2>08|>2Kox|u_c%-DtWYiU
zOLBaUm00+D#D3^|ZB7VA{ul`$mR7?YD+ibQn?%F=oz=g3xmtlE><=I~y6$dHW?mkv
zvq>SC(%)*aGr61-2BA<Gqvg85&D$R`lJRNZc>z<8^#oCcazewPnK5J9nm`EyxC@R|
z4)irc6}Uw~;~^hj-3^yq8Nf|>)9wW;yzF*UOoz@KpKQ{M0U8-f#}GNx@#%rU`kdQp
z$~o)CWqhl(RA2OdrO$pZUBn$Z&C*B)x5T!hQddZSY>1c|mPltrwVTU&i)i$-q7+#V
zD}k1s9Ww^>1c*KiR@i2@Wwo6Lc=hiGwl)*`_xQ-ktt~5RLQ3tLj^tS659HWmLtvk!
zo;Q94(h^_fD6z4#Yov;lJ+yrmtIq*qudyCYA@*=AD1siweCxxq>SRrQC=EoG2C$=M
zw>TeDrduDbZK{}18f{)G2s5{<$fSlO4j{HumAzws=$F}VxyOuKu%}hUVQ217RX(!=
zz9>+IflyTacnIJdGh8}II97Px1pwI(d<sEL*I0iWr+wjXb7&L(hxM=v2&m;`0l6Q~
z1Oat~j1z8;mo1^c?T3e3C9xutewOyf<KMp>Pb#mTADYGH@ZBm8*Uvg^7U(hnnr2x2
zMB=NmQg<6c2#fAOiOIZwLC=RbA$O9+UD7~vRu?=iCQmCG7xNUHA<QlU&hX~5l}DaS
zk!}%9#n_&~8eHFoiGJSU=OQ<tig+wykA{^v&d_@yzvCHROc<bUSH+M@v8y#lYii!U
z&6ZVABQ&Xh8ru%}u)hT(VuYOb_V?cp$i(e5j6#1p?e2yL7^c<9?z#V<<cxgj9~(N>
zarFDCvF8RCZ0ZF>V6G!3F(>`I(iZb8pXnA`@Go9;$}*K#Xwter$tQ=~6-oD3F}<-v
z4+rKYSaeg~?3$)|FV(V$hjLo&$5)Mgc=z<VN$YSk`#pY$-QLoA^~Exk@5y7J=lw|2
z*oV>CkHS7}S{o)FzX1~f4xA?CvCS%((S+b1T=D6-5Z3%inqHv7pmz1@-h<RClfL0t
zr~}7h<ttwF$SP{4c8JvJg)JeDEVAMxyk93sYtZ}0YUbxH%LDdM(+8=Ri}4KhjqmGS
z9*xw18xTyNUYgvd@9*~#A4+8r8^{<qFfKW0P6gbui|E?u+@Mg3UTOO%^)9m8)69LD
zCLZU3p3D752Rc?4niqOLj)Q?y;D)dPFB&_`;~Uc?Z8X?AiK{?Rt?7JwGtC5??DV;$
zPgip^hFK1;@w)L9fddR@N3a=I>K(ku6GypQqJLWXhhYb<IPbc1DF<>#Ii9DN&d$e8
z9$_f|Vs#et(I4RRQ1y|4;BUS0m#Wmn$#U@{gPZ1IwGUPIT%V=B5;w#of;_WJk4eHe
zsJ47)Hvb>S-aDv?hW{6}0S`8ms#2oTr74Pll!$^55Rfj?R79G9^qNFLL_k17lNzNL
zCG-xVM~XyxPk_(~B(wwwA$NV=_ndR*+?hMSzi@C9Hrd^8{S+-EoY$M*Td6G4NB{dk
zJLJk8E(NWKpFjieG~vMT$>xPD$i4dY?p*-%9nMX2qEt}Gv625pXE7rqOQ>-!5^?8c
zJJ(JaA;$K`HcxnTRzdlr&8fPrscdUx-gS<PXs!OGWR9a!#(ieH(yNemDRzy;oFx3W
zpB7cI|9tFxTX@&sDDf!xg%s2Q{v8;Pwwg_78@NY3vL0ActUNke-@eX$HvEhBsfUL5
ze3a9e%a<QV_w$AR>eR%TaSH?vPzH8Z*m!U007Ahlzz+N_y_?Mi3`k)+tPEfQelXOy
zSCH$aXi{1FslcWo9nPP0ns9<OtEOQDAgY&`>RmSaD;n{a_PGlF=5`+*k#td8*Qfo-
zV6Liz;bhm9$h{jMf&1^(VT{LW6+o6t{iNp``OoK3<H$a&su}zimK<J741ljiOvbq2
zuSn?}j4lN(sk~c~(pVdA^1{iE7K}7#XxULkT|lLaP&TZ^n+D~;p(RM5xPot!kb=Xp
zm=HTQmNmtvW`L5?IdC;qZtNr=boH(NB!wQ*!2<kGU74SN-+ARc+_8+4pm%J|EG$U2
z|F8N~b0E28E+k}^&&phxO_?Rb$n6-GX(8m_D&`W?jfXu7OV;W}-_lKL_`z9**v)CQ
zi{`z&``vku&T;hURxjABc0+H7iDiH8<pUf~GM-iMXsQ<U`aKLk*RUsP-Fq<}hje2W
zn?r0&*Vp=Szt#S^NuV2i1(X9`jo1+$p~-oG$RGgm%286gcyAs+@D`L$eUb^%%-=-Q
zHUcHJ_Palc33clcI{Es4)#0PlJloC*=4-~d=Kck*_!H0cmTTM*S}Cdcr2r7H)mWas
z66%O<$c}~bsfB^d5YcXc-lRic8rxLWM4mv@r|i?QU-&jz0Z#^v2d6_(6Q23Mbe^FI
zyBUl<g8t52q}%e_>8xy34tJfUzVs7hsWWUA^TIE0UsUo(=B+QNQ4aFIVl3?^S6jqq
z8YrT3d=RB-*XaP?GzyEkV3cuui?evaG2tzJ8Zh-yas_o%muY=||K*oKoapa61?$G2
z<FT;9f|EJOzVw)q`b8guzwK?WoY|?xHEb0)uxV9hqvnc-x)`hp3b$Lw01)gWMC^;-
z^(t7}`3!lm@d#Kcbx8$4cWS1xw^-&Z{iY|_$9yOLR)VLoOq?X=A6Fimedl~`#_3W5
zjj5?b2HV684?&NU6ao3wHnnONqRv=Si40Q^{uEnC7~4HILg0g6c>7k6b2I2a2%Nud
z(|HPi)$v2v)`fk#{QpvV()`urc3o`q>EnKx=>Y3~Tfo@D2yO4i%>V1x-MR1C?H?k}
z7Z_6QmgY<UTt^zk2pg2=!uq3p3}ZK0ICxJvqxwCw^|J5|jPKV^j$gE?z&^qJ@6M%?
zg5r@&iIg~)`R8UY#I+P@uWl^q6&nyp-1vP>^?!4ae?Fr0FFBqPE~v;l-c|cg3BVOh
z56TA2xjOhvdas}05w}kJSoWny0R5<@-=~bA)mWYWPjj}ID$eIX`KP=*%l@_9RP()U
z%A}{m8O@-r#J`>=M_WlcewX^hxHLN+4wgWacxig+_x=F>EX&dQv|);efD?46YF>aJ
zJp)uIsBU4S`F+jJiB5N?x&%Icorq}2r~}{@^!sbJ-bN$2bvsII1uz0q3#8`u*bU@c
z-EGRv{0tg^muNl2iQF?I)$BACj>SZk0#GoDAk^$Nu1diG!?o&wo$S;JHEfw!IbbS^
zbI#`(w_H9ER2Zf&_UgU!E}#(B%+|maVO4^956D$lcCmd|=I~*y|Djv|0nk=^4*x!O
znWQ@twz~OHtmj1Wa2wa&aWK*1`xq0A8vtHCNj<#KefvdHNzX)u&KUl?Gu$9Flus@E
zC-zpbm}z%nf~P5oASj>jSHE>|&I;LPVD9slGY8N^aY{q*MLaC>h63srfL>9qPZ~~l
zpdtLWsSnKG-~Y~wVDLfzpYM_>tieSQ-mjWr?%}r?!NFHA#_u)#POU0?{<7-Mt?RMn
zSk*Y8)wt@v0t<j(LQb3FgswROz8&Se4A`37ei^^Xv5}jrn{w(${U;aoZ`V4)KMYL|
zO~wWu?5;iJSE|ap9$hTB1)6jfS~tf;^ZQAPcNVLfZ(RmZP*`RC0a#9nf<|Yx8xriD
z{?8LY7d!Eu?+S5_F=Qn3Cq-^e>%${kOd=Pn<J;zK9nA-GJ64CyPxe;#9;)cC(fz`z
zVgT)fXAD{Zw<lB&y=~BwV0M(Oo-YK;jg5ZQcV2+6B?2Q#pPWku;8(ftLk^N!skik=
zBCUMl-$yXfKZFQLVp_LfD?hIHCEZ$=ZXlnyM*~`Z(Zm4AWl@74#{Ufc;VA&3h1_BW
zgs(#qTd{q#+-i{dh`xSLKuPn|OB%ntYh7(MAQ-c=1h&x%)zHZ4lsV$!;OMCedR5zy
zbu<^<BbrNiVKNSTL-YBd_MRe0h#T^??To+WR%KK=DrVgl3>aHbE1Lbw+4j~uNT6G#
z%A^ftHvzaq;8_=&mta{{N6-)W&`BhDl4X*Ycpmmw;P54|+U?=}Tn^g9JC}fmFx2x_
z_6=@xP+q(|8LG2?tO12awKSQ5sErS&n})IfD=gUT&pcVu=mn8f?C3N<t7^7g&;M04
zn5pKgSl_-FzoT=PL5maruL8ICn!KBC)&oEXbv~Op{>z2D>ClC*e}~IyRpJyzxvv1(
z-Pnu=UM5-FrBPL?TYj!e{NtBDfuxxy99LQAvmRdExe~D=wR7yd@Rw6sSHDx8Zt_1M
zeZR!he9pHv|Dc}w8#g}QUtEds$r)Y+ACid`W_|V4sqwt}C2uKjiJuC87#9alyXwIQ
z3%+Lu;t)m^=Pj6juSVV|RZp;j?Y&5;pNm*KbSZq96|P&CBVof(aIwf;%hk@JY9vGx
zj~t)|!Wo+~=tY5`nOio8GO*IH$(KF9%UXL@%Y`_Mmi8%=kd3-ESIUA*-O3|Z#z_i9
zob-{`&DTbhJ-#ni7`G$yZ~`qhl8eg<eM-A6e$B3RRQ~=^>4DdN-EFM$tsmH8i~Vr{
z^o^cn`VyXvHd#I4blYHcysa9{A@J;I=+{#={;D#i{cPLp$(H<QbO7KSLnF7v(EVNV
zs?6kd7W=VX^YSVluBDP)uY109B;@QI^vG7R{Th3O(OOI0CA{$kSjT%GYFa{)wprh%
z`~Yy&Hr4ywy!FG6qJ}VZQ>pNKw%Eoo3CV<{q*@&rC2RuZLA1-r(IQ_e+M!;u_IHL`
z0bM<=IkQ`%pF;ndi`U7<Ck&9Jvhi8jcprGw4sA*cEfWXxO@K{$JG&h!IK{ve(JFR|
z;Cge)CQXq$=@jz9`>L|AszS`YN6;}vm@Do+-#fOMlY8IR_m835NaXq|s#4KKMjL|+
z-e$&yOh&Lx6bkT~uZAqmC~h<RomT~p4yjr?d3YW;dICrK@#s({iZMJK8H~8f`TFc>
zZB@@+iigzt?&GD@fMTXm9_eSq*GCHYBC*{>yRkYU_PcMMThy6(e`P8QN-GpS$M*-b
zTf7|G{ymvq#GRAJ$&}MxX6tTg<M*N=aHl^nC=SZrb)_sQ<=78uj)`&X_PKMr*5B=7
zXTEja0H*gpEX<7&nS{&;?UYwJSqnWDk7(edJq{|sQ(B*V&Z^(<b40_l)sEW0du-Se
z{IdB0Kr$y+MiJd#_kQg>!qd*bWUGY!jP$_Z!s>95{a4HH3n^O&ec9Ukobd;rf)VlT
zCS~IR&gM=!#(6*ZZwsr<N2tI2EHabk-WiTi&Poo_V}Fk5y1Pkn-s-9xJsOu_&JmO8
z@-zsND(zYwq@R<YT5Z~2w8&#MPC09I19Gc>?XI4CP*Gu_rN4iz5H<m@2R(wy^fX%e
zFCdkz6aUFt(AfObUUdAVamx*|lF3H@tE9rhP}mQt<6Xtr)aqs{uYNAo7g`uv>ly5M
za&&wV*R!ou6`o4{n8=|bSoY|yM89y-sa0*$*ZP+qR?3u*J|`Ys9ow<ag_>{0C)QDM
z_4Pm^mF-ZiP~{JkZIN(7kMzBj!D80H)Tu$soP6lzBdJQHxDn#?i+=a;Xq0fE+^X-(
zG|nmq8t-l(?@IL)2L*HBa&&#v%UsJS&CpxQWc)NKCIOUzeF7dm$zXLqhJHlhsU+3V
zKi0_E+03MXEK^(4*RGK;{&J!|=bC0DJ_^5n2S39cHFx}|zm|Ry{f=jb$*+Izeh?eD
znT`B#bMquD%7!r7u{6q!-gG<UWptvW*xs<oG@l`#Xm}oU0bhL)?8hWr(Bn41Oo|V0
zds~K!cEJxp_iK*YhRie5j6}n)T3KnJ1V-Xb*NeENDR!%6t`c2au2q%U^prPmH)^|t
zag>Bp!jqW`$pO*Ux4o~|3z#sMwX-(rqrkM@GaFr^$iasw4^MIn8X;UZa=|XGW8<X3
zp#R=?(WwdN7@shHpXXWb<y-W&Eq&vaN7xm^m%v^rOGYPYKY-N8wm$MmTY1#dGcNUx
zV+6Xm$B*A<OwIL+*jjI@625V(n-^Aa)8xU#W6sz&ks^VXV&Pz}aJ#xp?Yk*MUWj}q
zU_^Ewu$?>W`*W!L6{O_HQ*(1O<fp-M`<om66z2!OSw#=~WSprTJT`TJwMeSI-as8e
zTg`y$n(mtkIHM8j5hL95bqk>y`0E<lN6_vv3Q$M~-0hCAQ^!_{Tnv<#dXv}U0`GLK
zA6ua=_d6@-ZWst>1Iq|3V7WLAu3E~duU)U2?1tY}-nq|_<1^;YOC8Tc)&m>0`e9Sv
z1#85@h=8`_EU;CglVZF8DVbpX3xh&8+U%&)z8*^J6;=wkl{Y$Te<+XQUffw({3Hll
zn=G`O_E_UDlLV*-CP)7m%>k~AV%4jKZFKjF$Bnr?EIzRd++l3It4(pIet3_V_qa54
zF&C!_@vU&1$PEyXj3E2!mDi~?Ic4or)p$KG2DgT|?#=pnMCn}5`zy~l^`RmGd_QeU
zCk#ps)Jp)5B5x8-&@!S#k-|}_v|A2DkPpCG{~20bex-ERA}N`Vdxa`8;HLX{kS6+Q
zsCnn|I`#E{o7FS7;2n#EiXV8p0XMo};1J$BO<!?A0kS9INou0LpLE2yG$NhN4U`p_
zW2&lHDix<E>a15SD6~s^?_xSHPL{9$w&pk8u3A?nvYqW3No?CDvp2lLoswx`Ap;V}
z0Fh6sO@GtqaH!#Z%{fpr3t4S*>;3LoFb2Enxy?KW3*1tJSfz`Jh08q?Y_;j@-ph}@
zd#}&S`m}?o;_n7@RTYkY(<Sk+1zupYsGAh%{5!X&Ze`20u)91{NHifav8s?>_#}%}
zyY4VSKj4DgH!nZ+IHSy-x8i*Uc2{+tl)3i{ZxlCDM39__0(^>}M}NnX)`=vsOLFf?
z07R7pWX`6?8lg)BZDj+yEOPEx80W(E+Sgqs)&PMp{y-}jQKkQLqpYXceJ~GuR%aRT
zL$isNRF2)dpno@D`8#GBSaw`NOD&953ubZ}+t`qX!;QnctEPpz?Co{8Vkr%x;nx6|
zL8FiO6kz?(${$F)=!m&pN3`0zPYe-x>i8hq>?y(-uyg_pjc@rR#m#fpk_;hJu|f%d
zotH&vck0C5uQ%@*n_ahcg*kOU4$#RD5=O2c5MscD44~ssXVqg5stfJXn}zIO$Y*BK
zHrrm5d7ESzlu*64tkRF2*eLJ2Hw>UEu-l(R%%YNnitJo4e4bw|pt}aTThSAf9myr^
zfWkAXsdSveVPbunF1aXEXq;1MxQb1_izk)m0J+x9-`b_D3kH&)Ckox!#@25fR0l4l
zQ?HnmVg!H(ry5@f3Cf;$8#K6iZnOn+h&G|TPoK4ad9u@je7XU_VSVwT6PL`U@?QA0
zR!#po!M|qeHP}El_e2Gqv~^|D<^TAr|JTeloJIyvPi$TS0%8~7)YIAn+zeT1CA1xI
zQ#2JUd3Zxhg^mL>E(}i|AXh64DX8sfTq$#n6jFo?fAt!i7n0Jc9@#<V=8lM>^RMgH
z1bvMcSLJto1~X3XK){I~??JxR8Y8X){6K;a&Ofkv%~k1cz!4ys<VEOgd=vA5<~?eK
zS+AsCGDuwE$Z#$Mli=i1+GINQ19dIzMVqM)Ff9zDZ6g_Tab}MfASiSHNNy>1?{AD6
zeT^=WI>(ni()Dj-!nrJZJUp%1Xy5~}r-phaFZ;kYNvuWW7)Sr%%-roH^wdJr!D_05
zfvb_h^9fJX^puo5epW;;jd*wb)kEKA6y@CJpI3rbrfWcRsN=7f#5MS;oJN8Voim4(
zC>bSwG-BeLu4rO}cMtqF%ysGMQK<_`!)1+vf@Tb;TRo^rJ2XCMTX#wZUYp0zc^0I+
z`*ae9hqBcs--bW-*JHao;Q-BBg>Z2-K2Y8{1OlN<*OLO)mk*g}1a+yd_|S}iRe$Qv
zAa-qCeDdz(o7v9K;~m}!?cW>%Wrfk>Z4+oskiRz3z9D^!))K<vKb#H7&ug%Mwca9R
zX`3Y;8e3RMK<<$06+IV2vA>hrbE<IxqQ*sr^@;|ZCB2|ZxRYSvRnF;;Y@pSotwCC)
zN<YQ^o?cjjD*VUuO5;TEn_~Loj5N!+-$5pmmr&?O2Xt3%y6J*UIg(noTs`}Jw}4)x
zQW!OvYsc^P2bMWi>1w(+=DA7nOiPEpw|RG8B(Td%U@9?+7l={U-!Yoo#v7KJdB_^q
zHklfj+*&L;yW8FOjsaC&1d@&HdB_Krfq|<9=16-=N3OU({`l?L<9^2k-m#p0A3PKC
zL=Ezc0PnJ#p>^muO?^)GY(yZWYlj*wYR!ygpCnb9bz}=8=Cga;3p@s9)aZu;#{A#$
z-#y-cjw!5L9(V~AzU<f%d;?`USXm^=D@<f>lu0E_Ox#00&4OI4`|u1f;VzT5ZwY2n
z9oOOLxTEIWe9VgZr_kC`*1Azg3gCNv@PS)*aRu1yKkbVF_aS_C&vSlyNl^@>SQ?zT
z;cH?N8AP|L6N)c+N!4&SI4msW*4`Huc&M8eVLf{4hyV7XXfbs+{B8eQzmF!?nI`A1
zDer=LcbqO{AhBIDG&<T<=Ave3q@fYIbL&ZBL?ViiMYp-Z<v2GC9Fx;KM0rGtsS+LZ
zUuO`<)iRNZicb@l%a<0hD8#LN>K^v%t%q-ZcG`mY*(9p#0>bNOf+gCSxoHbKecW>2
z5$pzD+GDc=Ip<*J_xP2h%%~~>JO7|2q2t8gdR!K|Z;cu<v6VxxANYP~;Eu)mQ?8*Q
z*F=kAG+vX&;{sYr#d^++-kMV)v@5i@k$Hir(0uaW;PC(dqoe1f_-Sp#V616rR>8Il
z)M_~9bzcfk;Z?^>gmksBNH}kbS0*c8-Ab85%9w#fpzhm0?LyPt>bD$!dC)Bja55N|
zX;_g=6E!NbB5duw%9Zmo99N(FwNq<5mw-&b)ls(MI-h?rlj!w<3v>`U0*{g`&5cm6
znolcq=$N#_n7-r3P(wXbaBj}_70`YdQaIc^XTWWec(j+XcKn39CGk?wX%0|l&P@yx
z+MGhWvG-2D&gN9I)tCS*1kZWAJZ!J2d_vQHy*dg^XS;Ayc`lHA9Hep8mB;5Z^f_ou
z6SK{B$c^rBQ_8@z`zDi~H??K*961A3BJYFojB1*!3dY-y1$PT@VED{77x+*NhKnAw
zX5)&VFVr82{UD&b<rtrQ$vTNP-$@Se`x{i@(C=c^y~*`|M6a7KC035M=fI$WwKy)7
z)0uPuj8A*af#9ow?CB*O><mBSFAtPPESG7}acSIr?MjG}_i7B--8w>r>j36bhBbHa
zpDq^F0Djm57M|b94|O(m*QtvGq;uJL6&0Dgt5mI(YDu}g$uj@)?QwmbP0}*OC~aLP
zttQ6mVl^?xl;h9rv|S@AgpKkZ`T=his_+T)I~>$bp9?|?N?+jlbf%qYj~}KlkBqT;
z&a*-crZVGr{oH06-|sz1+kEdX)#onk%2BOkJ*8*xWD9PW1SiITHwllI2-M2m(i=CV
z@}Ch4HG~}<A3n_gk*y6Wd}AoRs+|&_jaiYUPt-LI@mzh9Pifyf^-mCOUC4LZTb`Hi
zGPN+pi!z>9bNnO=XDD2*8h<heU-tsL<-uFZP8K__d<o!QX?p5*0>;02zj;4R0+r8~
zXtt6w#Ovu+mposB##ksXaLs|If}ZdNH7jsq6t3L9mGN2BeWKyL!r!83W$##hv-H4t
z=q*v;Q&-eNKb+Qn2^CKc;R^|SYMb@gotSAf9x9Ee%*SDC0n2-d(W_nX{-1D$cJ=;Z
zYK>IYSUaHJ`ZNFS$`5)cK0Ks><pOo)KOyXY_Twr@`Ag=vSC>7A9b-ZqC;6I>D`_35
zMTy0SYo!(aEb_H0vwS&PR;D*AnqG+~gAQ33!uxFSW)PX>@Hh}B|0jRsz3J9{D=Ydy
zh4Xf}FVkg%%Ole9@wJI6qsFzCHg`8>PO8rB045@W(O(ojFT+Gs7ur-yB#1XaJ{^JQ
zNOBFMWNXbJ@!q}G8qUR<3-aNq?YeU!hiAb{guu%_p;ilR#eM+IAe73Dv-l(vdfDbu
zQY#<NoQQk*cKdHmCSi-FE?LGLCb<toA}HKH*6`u+?@O=P1ZLi=2=Si)KFGab@bkPe
zN6iu=TT>zz;C=g>*N^m(?O7+w%!uq%?{+iW;ird-=i09UX=54iH%fn*$KRqSRrVY;
zCP8rmt}S=aA6eC7)rqsOGgx3VntZZuzYO>ai<~bo35!2&h*VK{&a!v>e;UF5uON3{
z+W)GCT9@px@yJ-n^-BuxPWrq9{r|_n|LYz8R#gAK;E%R|!;f!6Llbc?y@CS>k85)?
z2=|<yl_h%HqHn=l!DP0>lZ>0HpGcFbpt<!@0>zbQw=I<{(%=}xiEm>gpFI5I0sBOY
z<0qKyalwW?(5>))Z--L9EBI=8aQmb!W_?<EHB5e1*Kcr7tSJmM!?O2%;qU@gRH+k1
zmN+b2fQ2$D+Tn(r@o#o(-d>nj*Jl2jed=I7du$&#mjEDnTeh$SaULh0guS=nwV!H@
zS?`GfdJ3SU(Al&()zY)x(=)?%6mh?4&a<hz!?koWXhMn-3VmU-A9-fa%$>&LjwI27
z@JlpRJT;W%!|FMfIcs-JW1ni%zjY?Ki%N!FU`!<N@JfgYrx`!O@Ja-})hhZL3Y`JP
zLT>t<$ap7;fJ?UjdvnA8XE*nMo;5>1;4(o<AYGRhFDZYx-FDUk=#82M$SnUB6aSNk
z<p1@|I^1O&8XlI>wc?d-GPOQ@dOz`5VuXO@b_M}PjwpT+uJW91?4ei@E0SGbsD!&%
z<pR~8G}{<MwZ={Qxk=0`ghCfbRKscierAyMZz)u;s2}%MASY0J>raVpaO8b53gycy
z!A?zx{`Xfr%qV6cZ%!<x4{*lI^4s6T4|!U$#TPWoC@HmBm++Ln2e4AW=P3!JY_rU9
zyX(Xa%)aouB;X1b=wy)5RXgDSUD=1#3?{m>1UlOU3T|*v|DJ_k4b=bAVGCLcU;pVp
zCx!kpr)OmqA||GRIQ}_%jO7*6`I&ccA%<8Oc!q87<k9~y+y9?C{m)~8e>meMZ6lyx
zO3$31xqA0%(<$IB`Da-E&oTegH@)xd|E;*#nlnD7ywhR!r@{W_PUuEu`1aI?ah<6O
zrphgNRP)@_ujA8Js4YYJm-pGK2lHVtkTkC_C}q@bg9Wv?$4Uuqd@e(Fne70;Ii;48
z^mj?Kc7B(wKVqM8v&>-oI*@y;u*}nwd(fq=z|PdoMU~p^Cei<VTev_!wi%Uo)OUT`
z0{8!3E#Ny0y+}RDBphe8<*2fyKmXLY_DYXoS8e>Zu1Zqg8a7A~GfhAGeDhjYVOIrc
zpni(()2QYeW{|+te{^%%JmmIl-|n&FWY$+Fn4%t#!9@8@*)aGVGU9&emQg9?3{Xu(
zj=Pn*5qW9SxSBLKhRDV?RL5?-qi?V2axzO#HQoUB?idgon!zquG?0M9@Rg1Di@<3`
z96LP2sA6Hf^c}Mb9OHM7sYw#w7#^1U1OT(QI<&OQ*bHxnalk)g{hHQ`^}kxJ7xRHT
zpn?&QI&acMhn!Zu(`wG9W7XCG`>4jf+U(*M8xy;nZJ$dUA9tjk(}GNn(RE@1Cueo&
z{h!_2rYXsX!D}nGW6tqRhJcPj;gGMa)*pG-&kTc4S6Y1(Tn{muNr=Ws?8%UH59l06
z(vOc`Tb}j=2qk_TI3d?&EZI}FiTd1Z%tVzK@i$len>6+ezix)Qi}$);b7hxTvY9%|
z8876b=@E~(Oz?RFSFW_31fB)vQE*1ppL8lw$jrou6cF$29_bvCEm&}`=yyiJmmGW_
z-tjAK<%{(=)xwFaP-)93ut~q8HgZ>BQ)SfX_WKsm1bhh_@nM_?0rmnjrWrsxmb6pz
zT)u%P{2bZ3H87dM?gCVBZAh}cW)P_v2y4*})t%@u8A>F53p%=Y6$qsR+b3(XF&#vf
zpysfe2bQ;hFg*)ISHZ25K9SQt>h*F*9k56YY;AQ_LrpwI9EAP$86<l2PyaFxYLn&x
zKiu5W*oeo7e!9$D2+934uYZRCGO;YPM@>LYsDleYFU@~2s66EvBf2Y(*_h;Jq@+BP
zx9xm9T4W|;W<JhCd(#TG@7?Pk9v-f}_K>+=+RDpv(x)Mxtsyd1e^O?HN4|LP9KoW7
zbgf<Pkb^<&J%UW>GkR3~j$1GHHoT+TGRDx4Zv$2+Vs-nuFV}hgZN)lzEcWD&qTtn2
z=x`uvkAfy!v&as#Z3l=Iw9QcWeU;78fim(jkhv{9o(Q1yzgD)VAGDuBr5TH`{!=+X
z9C>5<@rL+x16EAFCbL(^=~ZZmNgC$p;D#7jsa~>dGrtJsyA;(pWMU$<qoTAwZ#(_x
zg+v%-|F=B8&T-JbCc)IQ<y_qMchNg9WWYh-VPLfITk2UuyGzr)NM^t_hOn&NnHJn)
zZ^l{^Z9_>Ou9h(AH5m2Eyi?k|k_0G?x-$-z=uKywi)-tYR+k^1h;%p+^TS_8OsXAh
z(I5`)sX5UU>Vn!cFjYP!BgA((u*LfHa$~T<V?OC@>ePAL7_x%$`Iw@5ZVF9t-4;lD
zdsmwJm~3n{#|)&2pK8=CuS;J{3K!)U%($t?Z=3e1sC~GP-E3|3in<!)r9;+d#h&a6
zsB%_u!FFvUY$(L0mbE;o!oggAdub0BAOGn5^2SlaX#Tsj&)IFzT$ua@@<z?j$jH7&
zcXzktXmQTZ=1TYd7KL&D$-FAJ%{eD|=z&-DD@diAriKRUL*Zk`B3hCzy{mV6XPr<t
z`;s=aX%v(wX+GDdM3ObLvRc=r{2g_UJaeu9p*12CYf5cpC_W?gzM=Kx)^hb*`H^GE
z2|Rew9`xasv#^?D-QbdR&5WekvqG#es+zi|3dpPdojh+tRaf&LPA&Hr*$+3_Bl&q$
z<=;Ms`vN8RY18oe+!L!dfdn1;l_gmk%ibLpWb5p?&Yy~e*A(nt&e4O`x1}mT2erc^
z^qQv%qgoQv=Kva0@xfnS7r?RM$~WPMAcmWA%oF0_J3N63MB8oJ%O$x3OrVwX(UBFA
z^6<a$wbOGG3fupl4Fvspx2l%c@P-7zE_3apTk`JazK&S=T}ugIRKCFHJKTd`xTDxr
zH<a}w(!z3bMsG4exSEjP%}qsp|8C8$i71pWeB(I>!DwZwlZ`&K7k4bk?>3CUsnZM}
zK>hK%x0D_F_g#ycX$*0$yQl6W;aTO|*udRk`6(6>oCpk%3!Fl^KGwKYPs?V>>IZ&?
z?<BqGFk~F=Z%=1xL{86K3uzZYXg`_&oBJ5B$0Mq;PiyDK8(SC=0B2Wr<h$IS<aGDN
z@Td&7t|7^*vvBz-zk1q1kz1O`W}0W8<MF{|m7hCUOBF_I%_e|^&)E8@`po#t$OSne
zv|N8vH4fND!8L#gSle|doVsK&dGzssS>6q&Y$n(h{*YOQ=OF2h(pZWEylQt;UQ5L@
zC*z7$x87=(`~EZQ(mgYaXm}N2^u=a}H2F;F`^WA%Z4;Guru<IeY=cTk+2B31GlyB8
z+b91mIhGnl*;ziFS-sGu&=n|1iqfFswElZBVih!je{JK8=1I{1jt6b-yQ9?+*VKW~
zc8v%7DFP&_^{gpDj#Qh7hyQ`v)U23P9`TFYFwU-6ZEQ@~a9KPXL3hRF)c~_i@%LSZ
zC@0SrCisQQ6kLmtufXQOywFb?Fj0FdqHKpq^Xk`FssqH|YUOczsCp`nMHYwdk)Eu#
z@|`a2@VjHW=(xW}17Bafh^~@`&$a(&;W}n-c)Bpj4)?n6uz#00-m|-6bd7Lf26!$6
z!{4d}8-C;VN*PNza2wpi0Su%mv+z^GCYQBMtep<_gJ`r!nI@tDL`Y27y{ivokIf*M
z<S?ImCQUlxuI4d<87iA3-?(QjE2-!lBd)=;d#JX$5(QtpfDfAV#YlsFeWps?9pD+K
z(2ETyS?jSg6hsg80<qxsIEOp<s0mvtB7DJYwxzE<WK4;IOD3k*=%<PHZD%~365R04
ztr;C(2Y&PKSA8agMQ8QzcY1lPT!a|Yl-TqVQx${65;ie|Jat9_$eA~acZ+T$1xnBo
z8#QY$mQAI4-5yKn$BQEUMjTJ5c`1>b=~Dn?Z8UQ$NYQ+Rv1pNbbsKwM?NL&K(pG-R
zG%yUPn*b7tUAONBfNV^#!@sVP(}-OZt2H&USnE?=dw~4&efLex?15|Lux5=6gBk@~
z7W}#Tx4pN*>W9rh$y7@9DbnJMk;8(1#$mcp{Pc4D7l^o+5yQzj?zHx-$7{r;xD^=a
zO-Rv3C$GBN%G!Okl{W@YB5ugrZ3m4g$L6DIsWE|SobdwZIOC()nR4VtpQ>nWIKJ@z
z{S%!-P2GwUId2uTsaR}}%210e-@(6GA0+n&NFxFOa@Y7Za#s~xssp*jaUNkCcm^YA
zv%p<rV{7JLCD94Ke~fWGI-K)l&`G@Csnelsr*rt*S?4}nf2YDO8XngmdVy_=mu<$}
zk2@pOes=tDOL8w5b^VFhX4R94_ck*;q4PXrwzP5Ef6HLU&NMr{3Dpd>;i3IQOZ5Kl
zf{hk^nAbv%aB;5nmE^GB-8lR8_Z!PmVZV~%96C#Odni%v{r_b3)c;1Jn|IeIF;Y*T
zEL?e|m>Vl-=8k624O)`YFW_hP_qU6L)bcxlB>>(A39RQ*?|G-_U%7I<2NuPrc%5Ro
zcz_I&)rubQ0rZ4!xi0@n;Eh_+1VL9vtOIrN@{Odwt`O}xVSu?h|2lw%;lMF~@LvyX
z|FBsN!=|bAP|Cjl5B?|`(h1zPCMP$HxUl^*^|pPqgw*;C==##%DQ}(k8uy63PhO8H
zpnoLqI`Tu&kZNdVjnic>H1*`-;&NO=B`j1_Om%l_=XF2f5P9qcKD;@cq~x`%EpXB~
zsn9|<d8<*zcOk(neqrF_-9nqmTfQ5XG5Tm2bb791f`VF@3d(bOR8)M=vfC1pp+muT
zqfjVMKqK*OxjokB43BgoZLR(M!2!h?y$&b@^K@-lR_bxZZ!~Np1qgI19`mzu<cjRZ
zZsw;!odd(g$#1(d&nmRuO6XojuC6+{IqM`E*DoZ2h=3iAx($ws*WcZBXuQ|=QtCyc
zDMMF&TEO6m?1FH4(Q_1(4$R-_3J%~QRc}57-C+tY0a%J#n^|(gO<)6SbsuI5i;5B4
z3?3Uk&<!zu_@RMo2bbAfP!PFP(m!w2Q5Yd9-z}rhL)CX#nyNh$w9mz*GB}YG?KX72
z0vur^LX)jelXrWszdEq6H`K@6!|vJ^#<sm~URR+O)YKgXVx;hj_6$1C{Q)kQIAM5{
zs=wa2sgOOFwQFo9b8!;6ypB@a(vXm#Y2(dy0vj`$GO`}jYyA`zvzgol%t2^&r%YZ*
zDMsf68`;8iwqhkc#YYolye_xas4PsVo?V)6x~1wQZz&IUkqMe8!cjKlcUg`wdwB$1
zKUSbQxTD&}*3rfG+1Wi>qT!rd+hn^G&@8wqgFXPa`<})<^h_h5j(|)3#MW^I6j5nI
zz6%`Xdj}_7z{4cG&+Avx71sQTjvuzW!-0uiYq=g3^*8bAppZb#N9`X99SLsO7`;5u
zV<q=`xPoqNO3ORC`P<69!@J1^tw>H{70#rl6<)S_J39`^;b3}pG<HPjHP5W@$U(zV
zjlRBa=-mwc;&30=Utd}_;*H=W4%1e5EoG2^s6Y(?<*W0cMO0O7F3nTllP>ItsUAID
z;oeIQdYWO0iaV9y+1K>P@x*8SClk~qh;o@9jz|E^N8U2_v4WZF$Bh4%7QjewJpJpf
z`Wj#Ze(&b>+O3Hqx9&!^yeV52TbMM}6|Ea#H8MI}zui~=w<z^WeFOLjoRZ5H1Fw{?
z{V1=Ztuy#%Tx(|U$~(@zlISDJPkRaaHXo-sREOvSl8HFl28dCEwXGS{oAj5H)Rm2N
zJ(z;gNK#ghg&4m&!UTePMf253<=B)GkG+e4*yN~XTQviq2)xx-*-f)@tpF2CLZ<YA
zeKP@I#K3)#u!Gv_?`MWTswZgjS3W{abY}2MZssn;Tq-TpR}bgTrDg!IkK!1io_*a6
zqd<U&@y#n*Ol&_c;Njc>u=QC0*bI6|OCIG*hef-5fyCJ+X<mFT5kPx%Pm4gmN{0Jx
z{+&}Ie;J7fqJ>xC!0RhIuM|NB`aV2a=;^++y`A16P<4)Y&D~?Jx=VQbyprWj%fO%U
zYo4#M-T;K9T<F;E@|Uf2>%bWI$v2G}Z_yQk6KH_BbDX-E$~Z@=WQ)LDlr07{=ZgQL
zlGeStt<h6R869P(*38+paMR9f%84-q4Eo019l!2!pKlTNEQd}u)R~hpQuP_zj0++X
zjx>_hqk5BMr`_R4IWrs!Str>huquK+_ly*@<#oFOzlUwQY7(VCp8j?^74rNvD?`g3
zeDv{djlk|1@3^YM(Mh#lnF7#ZDOl~>xkCX4$Jbe8JoWls^)^|?9o$+T{vymb1Qkur
zyrfQ~rO98M^OztFwnv?M4~+7|$d9gVi#CWfIl)riPLiL7pT)6&h=O(kml-pSU-vUx
zqt|q!*xaLPKwAnVmE$M4m;6c2+f*E)t}Xz`aIYgUx5Wq;?hk~eZO@>Y#=k{S;Wq@s
zC0mk2S!!g5Hzc{mjL&TW)A||!IMgRvo#u;6&K$YjL0^#Z-Dd`Z4r;n?tvGJ$3;_}+
zQtynSduoSO6a#xsZn?Bqvbu%A28$H+1bb6!e_`KNR!zvu$Q#r<_Ld=A_Byf{U}xPg
zTJWZF_%(1*HDAhJ^Q5c&(XoaDOsgp{hfbfPC;&)YOnApFZ8=Y~w6<PMYBdzjk;lg`
ztQ>Jk>L;Dhn!noo;_(;~@YK@^9<a+)HsZ(SKux@btW>3%m_|*vPT%ucC%3`ZU|Vth
zFvR^y20+iL#RvpWNYkJIRNe}kp~7CM*OCK(Hzw9=mx^co9>qCTWOR4KGPAR9JZZ`8
zlH}3K)F$D$HUR9%d9Gk$fERqL3-hsCAGo)Q@*hCgT)Hzxw@ktvh+{fI^*<Q_)+Xgc
z#czy0%hVGaI2W=~T@Q4Cn!?zoN)O?{FoCW{NEBCN8V$dQIGATfSS!qa$eO-Ubk=P^
zz<6^RI6ErqtAn&E{oC?csdKVE#1+KTK^aLIe$~Q9#?K~%?atn*eatZ!?2&HM`6sbg
z>Azi17{SQur%UaS1gj(cUTz4pl;~4oj=av#vDtb2RjfTm${RHVSIFrDp*LmGYYqO}
zZSztl34ktX>7H|08u|79w{Vpt>wBh@g%^w;jnA6qHgSO<ZNsU?S=*G}p)5@{144>G
z#-vMidQj%GipJTF_<$1&Kb1CWL~Ui`RPwq^oPToV7p#<I69nshYZsVn0I=+EQT;-<
z>JNsyvVyCsO)BGV-)FrocUSUxzw3<M`MT-&FdMEin-|D2QOdZF`&qbi2Kpk^bNlGS
zv>bM$`Aoy7$aal6eOf!{ts7`6Jg{A5PQaZF7}$iMIVz<<{~Z>QR9x1U_)n4$_Y9tN
zf4yZ7&(RaQ^+D#`=C;2wZUwc%rTwGZl7v(`6g{n3VvbI7mn<eq*UsNS{<;P9hYZXi
zQzp@~N$8J5aM+D~zJRg!;tP)KQNqT{OeWg>f!%e9wU=+dt^vea`@qf%30ksYc-ad3
ziJi+EWjZL<jac~bAGulwV1e}|Co>US2R`%4JRi*1_kle6hh4}k`R7GJ)2;*mMuQ~b
zzkAKr`R|Py-(Rn}RFPd$rF)<Nc~wvk`}6AhzyScc-FhOt^eu$q%loFJ7)1hl4tM!!
zzk0YH&2uqXRC}QJIg)5#6=!^LfcM6YfZE%Pw`E1k!#at@v<JrTjuw%FaOSi5UZUxT
zfpBbCndMlzFOGn6sa<&OiidJ^nRz@)S`OHW%{!E%YbH3~9e*14JS}hm=osm&a$>s5
zwaas!(1C=z#tFfy7jv@uvqs-S1E>^g(dl6@X+I{AI?Wd3Pt$o2RVX9(X&_Ey^6}T3
zT@nY&8c4}9iUazyr6Z3OOh>A_mN$oFbB0;9Wu>(|C^*jgkKJ*su9(=$c438gYdCs4
zTz=b5u?+Y=MILwdFAxA^fS^qVF3=WuK>jVb)e2PfAVR(c5q-?OKbCkiPpf@Q7ExPa
z4{nNm_N@XlQ55ELIA)90Y8{O{GOmCY2Ibg6x4P_)QYPsAnaf%9VHZnat`Wng{1#k2
z`*Cf54X`|m2m~N#I~9@)(Jr$jB<U<FAMEJwtW^t(3kJcJ#}k1;PCI=oDe&NtJ`b{X
zaW%Ceef6vL)k{=j{~%Q}Nw{J5qXqP01mhM)U@^&Z=wr}k2V<%n+bFaSC?_Q>P`#9q
zut)Kw?5q(fy+$iZKAy!okfe&er*Jn8B{~o|gH#L_@;VUjs0V9q^)YtIa=U7cHk04G
z9~Cy|AhC#m1D%2RIk!VH*r2&?e-VAKW!$(PZxp?)v%0b^({Pp5FNT@bF9M%~Xc&<z
zJ$%jyhCb~v%PDz(lKEFzNaOTX^AYJJ$_x5vbWS;_n0D<fy<mFtd0NS!y5&~lzeE0z
zn4Z0mtH(f`qM)0_9g4-_qdJF)Bv24zYgU5%&))eaLgNTy@1pfPo)70|H8kGU+_$_c
zeG?!1tu1rmq~G}r0K{7RV6L{Vj@jS|!uMvEYPWQV#3YS94s4#3dUV9k7^q^^#tKyV
zBr2R*PgmU5G&ot;&9>5~<VNzD_GV!mnwUXaG4Z4ZM0W?`Po|UF$L)A=d>E^CO0#?C
zWzk=i>arm-cG~hjx*W`{^Cf5fU>6`ww`c>6s`Wq%t<yTdjc6Z`T2}y=nru1)z3rR}
zi8sx~9zv5RvI=h(s%E8%ED%vTnGnq2G{^)NA;GaiN1=~$2dh?cZ)nrHJv^QADl02r
zAfiQHE_>MJw%eY5Sf`#Yk^u<we$+4fvvsEyaO;rXgoyWVRRCD&>_)rs#=m$^KAA?>
zh({CLRvT}I@?*tE3G`G&&#JKw(5??slG`LRA{uVEDLQ=QqIj1deMZ<nH#4(!G_Me1
zi?Lo!nu)w&U{2={)noTAPK7oW{_@Tgl1Zjdc@3^#WXc(wZ;0+OEFH{NDHhb}T`}}D
z&9F9;`%#UDjV5I|>7`V#Hwy6ExZrD-tXFT1l-ACia0x__j{wvM>R6>i|J<VmjrA9(
zMjziv*ZLecWC9BE5P<9aBw2h_=5dB|Vwe4#d8O-?-?&AZ0`)-9@)4yPzQ2XQ3e$>s
z5T_jq2psEZaj<xw?kvZ`xC8u7spFq-@5SkIO(m2os%k3sT?)q8Qvi*9edN>)6aR=2
z-$|FQ5BU!8ECLF9wBZ|82Ne2J6{O|ekqONTmCYmfsWgSOae?2~9+CEwolxSbhHYDn
z%ewqfl7+wteX``dg83T?gzx(K9LCXkww8wtd2KOd+gn?LK2cUYSynugG)4NXN<8%m
z?x80a%G2chzuP*p;o6>%@e^(HKtqHgQDG7~^Enymys{gz;ao3_GhN3|PnTiEHVZrH
zzlM$gg!`&M0NLHYIlS((WWO-v+QDHBPh5m@*Q<BmEKLe;F$wGTj@!mqadaJP+5N07
z?>J#c$XZX8iBQ)E(;EWUE9EN{#ZyJ(_<W}fToX*fa&}Nn-*M@IeI4IdqgAtQde1BF
z$h)Q^fACMd7uL+?Oi}nJAw#H3J1$NYz-V2Oh|s)uxKU44qjvJT(GK*K*8L0u%~gNs
z({dv2^H_O>nmrx3*LP1RQJAA6C8b@~KIOxmSN;(4J$k!(S(K+7;=`T0-*3(*eT>T%
z>G6vekzwlT?2;?cL}}7|{~ctQf|7#=B~T5Ef4T2?TYjvZ-R08!bO**?C>n=n-6wWK
zUENAEwSf=muVmwurKuVihM2*jxo6a{QKwB$qX8oP0h2IfixpvDNL%6<Q#Ze1`~b1!
zB;>z#xE(C~`>;km9wE6R9$-DW-9iKDWa@pB^d<vvSTJqn-Zkj}C_+-nL5E!cm}wS4
zJQ6cvs5Wsvur#?zs~Zt73k7lu4K)S4OVBd+j#g!Wdil!p%Pa6Z5J~G8RWR((d837e
z!}g1x-el}~eHE~1ndOTwlGXa!^~2G|QQDYahfju4K;y6%B2r^@y{94}tfzvBz_VUG
zV%x2+>aI0hER-zCq1wOg`zX<NFy|D2n$?#N_&ID9v!ODe>b93%l&5z1G+}CpIqNjU
z6gfu)`V|FT!vQHLhQVPb>@~eN2l_N{j+PI7+Sso$+7Z=`o~s#mZ`v#kn4<-a>g=y8
zZ2&vr^)96`5G9O$5m<#@;QiFVXo)0WZy19$d}7SPJBaX2KW7Xu8Mf*5iGkYU$K**S
z+@v{R7#!vYU#}UX=`v=ZerU2EI{QDHzc_IjxL^X<r`qK8n0So-Tad1W*sldRZDp%*
zDxv=8#E+w7Lqnjnv|j0q|MI#oZ9%$m#|fEVdUUW>7xHRcvdugpK~haTxdG98=e95>
zQp>}~aHTWD?KC4thxae0*Fy$<SZ8D>JZap&2w>ZN02s~V%V3k~WWYiUfEgCR3U2F4
z_q+6dO`krm^k!|-Z!y{Z@3_1&(~zR3B<!z+`1aWG*Xru{?WcDo(i^AVwz*he6ipw9
z#-W^)mbA-0>8rEnh+8e{G9G}e79X#fG6_#}BE2A5AI*&YAxX`H!oZGTr%o8|pa@GY
zkuz2kS>cHj)sMYZ50Mc?D0S|w&4C5V^D+W(F_q|R6#Xw}*{4vu8W?bLLn0sCB}SM-
zJokODA?gvm=N0HRIAYCzsbJ3FTZL`6W&h>?<ufl85qPKcFiAvZH!)|my=?&wfg(B|
zr{2{?;JNp#?VM0iq;@UYIAOX2oLD!)qsttbXs@mQ%wQ|%rs_eEahHAldX-1uMr|qx
z{n$@0<&N;<AFGqqF=CwOwxECD6}oa|#@_%AN_p7d-2*VD>J^n@I{iBFF!7%1$^n5R
zto2n{FO^qd)icF7+ecuUxd-8-L@bH2!AV~VIR<VM%@;N4(&j4Y12a7E8w<jYBtY?t
ze3b8J0W~=MfeuiKu(_w&odZ>$<k&@tWsF!Ci|*&qHz5-j35HsPfjiin)}MJA&cH94
z8Q~wc2=XeEd5J>2O0y~-sFJvHKkRjDPR)kre37<%;XUnkbF%K2Rl~65`vPI<&qc?_
zSV>$BX7h~3>&8#E^c>;B)nF$~%<c3Td{P_10++HXa5%4NX8mjq*pD9fANxUsjtDHn
zs=KyS<=V^!)!|vErBd#EV^vYD)kJ_2C5wHqU<N`)q_|yHG4tDeoSE^0X0<w0e(F;G
z(uXejdkV2@*G}tJ==Y=wN8AP6X&d#o`mf(9u(g0}kS$V{fPP)Qa#<U>{Ebz*PSTVO
zA`955#?ltoSc{E0KhNz_f#IPPy7dAcrV|Z;jQrzthGvgVHH^1DY6Izcgs`xkM~Jgi
zH4_k-T?)g9r!Q|njv5M237=I+Y2XyG$QGB;x^m$E6kp?hu|vXS$^7;cEm`y)p3&qX
z&)7#b3GtTaoYN6zUB8jn<xu5l*wg&}<kXMx^64Q^ZVr&hc=_STvpL=?+?Qi`IquH5
z8=D9~-VLtxAK8_$m4kF%tw`yVt-SUN`?`Nh2+|j^GmWqL3_lM(yjo4sA3448sbUoQ
zh2T)uL!ND$f{4<KV;j}iA}RRzPZd8n?FznCapq)8Ri9<=^$L=my==m)%^B-n-6g_X
zck=w0yhKn=YD?lWdRKFk()H?|X<beWhS*gsV_EYD=m4@d0C&rsyiCT~OHWpSq;YDr
zQPUSbL1uNiUP?q(X~zBR6^(b3M$ervyP<8}e~{^?z7CE+j#r^>j-VYTWudO!s+sFu
z%%BbGYtH8MP?ZHH6s2(V^XCJj!%JvLP<W^6L=sOk=#cC9Uai7@@?U&gX!Wd%Uuq2#
zz(taUi@g5Q9X7_~6Wb>}=hNz5h=0f8Cw77?dN_V@pQFCRRVj0t-8WKxW908f9?@<L
zxpiK)b&lruD8~xxrCL1-POJO#ccD7k=*&}{E&YUYE3kJM*WF}CGH@L}nr2tHGmQpX
z<v}`7z1a_c25{#CQNU;jqu7WDpRF3oF{^`E>mzHE_Uj7U0fy}FrgVda_{W65VB`Iq
z(K{FC4!5yhg{p&Nssn_<r)mY7kLv4yiu@sv&WX#zMP}Iox}62*xZ;CP<rqQDf%5Gp
zL^B|-X4%8)Zym-_7A$nuNZL?CM2dtUPc$Jey{0?;`1Y!&n5hOP)n#6|mpzFKByCjT
z0(7Y3_Q)QDIh?w5CwZQV1`n8+QgkXxt>e?B&#q0_BVQ?H5|GBHwfWJ#r?tC|E{ojL
z8)2Ka@%*i;>Zlo);&oW(v%ZSTn=mm<?uqxW5CrG}>Ab2zzyjIr3rtLAOhHM}jD*@<
z8<qD^t(-Q<5jQzLklm<&YB(&D9_E&eytEFl;P2n29LnP#$KR?MCO~K2)BHoPt-A#%
z8^z^}SbEA;18cue=Z54~lWs&iB0rwD8kg~Q&{lsRj1a$=L%AK^V`%UpU|ePEmyvbp
za_||$gs4oyOZq>QkIqkuCl=?s@PX*RyOC|^5PZajVZTw0R%wp0aZ;%w+K_{6nR05j
z1`Q3gXf1$Ez_})(5L@<Kk}~oQa=3`CYD5*`C)A_g(eZXMU<UqCGYD_JS7FvT0$-JR
zT>m_1U^4(gYGw%<pwG1vTPbAT!x03DuwMltve!$h*Y{RW8>zad*6^p3W@vR2A)CSL
zk#efs&gcl})H29DvPNSn7`=}JUgI)$&S#Llezq}$8a>tM3ji6bMqXXpV5_5^k#8&<
zVZ2ZQHgv^ep1$kok0oV8S0R_ji3~6LPuJEDZqO5*GuO(3;#KWa<BcQ$&G*;8H|_5N
z^UrF=5pB<7P&`?EO()NbqcOvUMpQM~ss)IXK}vUyzd%AMPhT^D>aFEfFhay~8DV2S
z=K<I<$F--+1X*D~@Cpm>cJgOGoR2dRXR?6PQW?zq?UiKZQz_#Ni1+w}2?TsYXXu$1
zWJfBC?TrqJB)obc_qE;c5%M<E<s!GKNC;C-R*dS<&ugqwACVj0{`J6;dTBDV>$Y>W
z^|Z?N&Y6vZyo~Lo^Bi{Hkw2umAB0mzwOYHz+PAzmebh0GWjw^HNXIG`<_wj`appVt
zSMr(P{ZTDB$W21(e~Yyvy}DLK-oIfmUwc1MY*0Nd-w=UAbQN0*pjaQq?8At(NR_EX
zi#ObfJZ@%27^6H97hMh*;5&cGUuayF?zhBGtziQnj?to|C-b_^18|(d71uC)fi)H`
zL%-sEl=szNoi$!?I%kl9SjzMRxPBQi6OA`suGFmTFV}R&WD#<;)p@k$EU^MAN&9J)
zlQ9W}R^ep^4O5GJ&TxP{gSC#*#gKoLzuH$fkhU;Ysr0VgP=@plstdbNHF%I~b-rtf
z1JTvEAPivBOQpHv81JA{xv6jFQJR~Pw9qOgV0y~Omnf$fU;ajk8ANV@w=<{A1QruS
z0R+^E{|TtOLW(UOK*L1_8`gam-Jgs;bQj&%xu{eH&3#-uWdq+>Q{3p@#McVgSxwDN
zOcjcmC+E3VA}0MSyYF=0T%p}|!v&ci5o1&@zMB7K(h#7>r)i?0xRj>TP^hn=0aRf|
zJmx;)b!QVrPN^pZ-62dSLe6k{AhhK-x7PQ73!f;Qsp<i2<Y1YJMk5YW8}%|;3haYh
zT@VYm#^gXF1XrE6geRCbu5YwqQ{fPvzhSvJN#wXAtzZ!!6_8yTvO_>EJY)YL9IC#q
z#bIAzSy=?k@&C{XAgWXO)V;MI3+I)H-#8CJ0n4oNu*0Gwp#5-J^T9*y;VSF0_8v)d
z23At6+O}~wAT(m!(@x!09g`=g6aO)4sDv6Y<%FD{(2sW>*<D!ih5`$%;CZ&6gx=fU
ziggPQ7WiCdZejQqO>LmYV@GVNdt-q6p-R&_Fbk}l1e&SVtxN&~&Y%LeQ32pxzcD|j
zKv@74Ni(yy7SZWV=b0<Oq5+=D2AIKW+&H(F8f;i7`^6LBlg4`ltKXE`M(Fe<$PPy%
z8oueoGMzSCp||*DswFlmnX#7xM1+GSx#N(v^0n<nsSD`ZR^ax$<~JMaWTQgg{eMV%
z>!>K(u5DZpK|n-6L?oqALg@}gx>H((A*7^x5K)nk7)lyRX`~yG&XMl!ZWv$~ekb1d
z^S<x*$o;MN`F(56AFRd1bzSG)``mk<$8qd$s=*9Bnen5DZxhSquhD}_*NXds>@SFQ
zb(BqNVIh)oyI%$~I#?6zyPIY>f0JHa7b515>GI7hMsH5!)CpL}h^38z;ZK{T6Hao5
z3HteA#?%^Vg>xkI6<xOh@p%DLL!sluVnfN9Wqi#xD@XlVR;p;G>VUSX{<7yU^}=Gd
z1}UPi-TX`HnHhCLQRKnyo5#VN2lNUb$1RIK|6KELT8J`SOIJ!<IdudDTtH3G{!j`c
zZ7xL*)XX&>4IPBa6UgB|e`Y9;MeLKUGqqVD2oC)Lbg}0M2f#kfYK4EKAn>4l9(6M{
z#Rau>k0=AB>_l+AtlO#n0zeA&+*W!MUoNZ1nsBW78#$>o&K_7!`GDz~BC}Ujr0AqY
zdXng&S9=gS`<#awyyWnt2j6Rfp;HIemo{l>UZ!#C>|D0a`8xV6sO)^gS@exFJ<NhD
z`qe|3bZK8*broqMx{r9eBkXmK09)ebFy~M2e~QP8xym0CmxPTERpton2qfjCtC+uM
z7|FmENLm!8Yq8NIqGG<2{A?3jB_1eEoFA{9z|Au#wrWpNSV#F@n6eMD){D;$b*pO6
zPF$LzK@WNCLIGh)^i|`7O~hRAuFQ=c)G1jfrLoOW6pJ=Zn~?asu*sBmDfcbmW<xJS
zLKvmzKJ(ImZt7&rYZcOa?%xeD6}Be86ZfI7Po-k7LHN5bMw9FpEB&YtBh+>~{IxI}
zmwgA4_1!ORl*O;(c6f4|T$?d2vqXYiMv}1;m4<RJiJ}Ifj#o|MF&%+^^M)@~`bp_B
zBHjh|4ZTe`-7JMfGT7j0<m^erT2D&sDIyF$ZfJe(TW5IQBk`3sSm1dK^|_27L%@@u
z&*#6sKCGY(7HU+8=jl?26`08U8S&HA=qKhZ4w#2+J_6EQJ74l$GG1xI^hu)F>eEfH
zHS@aYnw5^Q!>QYKT=&5s2(P6GZ?~gC$U$7yqK@_*>)zYvdgrJJ5pBy~Negidvlm=g
z5fv7BH*9~UQFmixi5I(!>c~?+`f;vfsi<0AahRWpEKN9DPbq+5vA-;vaN3posC}C3
zvWn-v!QBjCX_D3esC5)ohoZHdx-NHJ-e;*NIj8vJ^aii_P!YVAdR5E2J>r$?1(A2n
zLOMEN!WSlSxZR*sUeaWEQ&_&gVjgOB4ysR_D2aYMhv>@Byd%F@VRS$X$M9(N)vDCP
zoPz2)(U|e{HZ#HX^3SJ$2BtqHQqz#i-89v%RnCRI5|eFXHx&Q`V&+O~k+Rw*)+pq0
za{EEGJ2?0$d7aS~3{GfL)lP$E=hi~$_Z_0^MO5LhVdO^>;ad&#<NG5Zt=1yEHFSq8
z&oQQYAGq0yIj_1Ug05tS3*jmPOT#~l{6RZ(`1LF}imJtT?VT9L`C+rv**ja@&eD+P
zw3>}~C$!L*NBHZspHl7&Jr(-FD3<irh2p%)D{3LJ(G!4Yx8yL`T*kbn=<@=E8*Ab2
zxb-3h_-6?@??>u4eEvl=w0L*LHon||&bB7=i11$y_@z8iUAaB{F=Q!rbc~9gV`8Xs
zt?y2MWeU|vFKdqZ8wh}7l!`c{yyxb&F@@|u*qXJTFy-d`rlse~G#T7~C`D}DEh4DQ
zxiil;rRWp5`Xb*CGlo1VmU%@!R03U2x#xYj=g~xiS7ynQ4LIaI0`2P)`pRyBwcA=c
zIx%*_I<*Ws<8~eK*0YUm3h3J%hMUaTRI#7l^&QO+szy_)M$l@Mt@Nb0CyQpDDVf~W
z@d_IfJy|Al_GOuiFz=HH4Pe(?h%?v(=psAbDddoR*~y+1`HpVcpiT-AyG*96bPpX{
zQ+{Qo4lIG~K<1J7?$DQlv!3}(x=r!Z6d8u-dnp?tbAd!po+Vww&B90#!)r}YslLN*
z@XB{aL?<yp9YUo+>Tko?0Ruy(@Dx&#)MrkqHVly?%R2xAw02YIjo0_sd4xoS_r5`*
zCB2{QXnr)OX$QyKAs0xB8GjEveKF;Tu|px!<}e$s=XJ&^(!+S-v0oICR!TlxMDzhn
zm}GJ@L>3KFAao(K6={<RU5Uv!vO3oK`tfB4APn6%P<P3J7&!Fs=Oxo9+x0Fvv{mgC
z?(3&3Xna+tkmc2HRvGA@jXep;QgH-Hw?l9HcF!*N%mz5N1EtII^N3_k9rI`B$Q<pW
zC>8kg%#3ki3T>wXm6vu;P6fbuU0x#H(`)4!vm_;IRe7fuv3@+2B5gKIXll6D#lY+P
ztMXxyDTKE0j%V#!8j{JT_^jMV6tPC7KMS>K0X!dX&)fN4UlLo65W>*lDU$rDxha5e
zop3!9q}<xL3!3!PAG$km5u&KzbCUdX-MHYb9d{&U9lJptyZrf0;&7It!jK~>1^s13
z&sXoxtEw`o(oShT)RvOrlZ8i2891_CE6(~>H7q_(nM#j(BtG;hiPk$ZZ_rFW<Yt8O
z8=W5G8p~u$5O)0fnyg2I&6MTv3Y%EGw>OU&K0*6{uTnj1B43tK(;)o}iwZh_At|Er
zLVLO@-|u>5PMGy*v!?_xq(p_b!S0T_Mg`WUSL2GR@s8Dm;}F5MufqBt=x#x>@-z1;
zE&IXvRAI~Df$xP(m=x3<O1b5|IQI=eRvq#_y$W)iN$M0krKNeeC&QC9e>;~w>wT)H
zATX<%pMkT6YO(5CyThBz!wk)729f=h`@Pv7Pul)IZ)hnP|Msret^;rTfodf($|_4B
zRaUGc{}COFQb+s+aH)V}d;@hAT9QxpeKjlDY>zRK>%ZEZFFjAj9fu~?^G7(dcpTc9
zTPgr%XV$u!S-Gdz9x#@%hN_f4<nxZ!;qg3&vj>}WOl$KCu2Xl+_`x*CtpUjQq0Hl<
zk2sPdkC$fc_3{&hJ*)1p>dl9(sGl)bu6PP=71oRy^m|vz_I{oj=|`EXpu3%{ETud<
zhL2emeJHje(PHRGebzDn@^2B15jSbrdwDAvDs^|h-BurAk)EY=iQAcf0nlz;OZ!44
za<Uv|JzgF~R`SeBKO#n5oMkf6xe@D}S=MM#>hO)gxyw<_(KD3|k*cPx0WUAF@z6ZI
z$c}(AsbJIYFAJ1z%a2vWPiPkSh41osd>h+}a!*6}m9odWsgtg5R&7~?Tc*nzoNm;W
zWv>shrwOYddv`)-U>2tZb|W2cTh=3t>gnpo*1zK;(f-#gmn1%yB)ZHbx{JOjjDfT9
zf+b=@8g*QQ`bx(fe>5(UpZXUnmW*zu^^I`}Scf==8O4SPCCsDt!YQl1y7FFG`{1Q6
z-RV1Rz1E(mhlg$AVCtQtu)7nSFOQqM1WKB3P~%p94fjqZ+SQYe-8Wgo;jyUh5W2wK
z-8{uL700js{$kin`p1>Uahdo4pVyFG%~f{JS|gg3<bd3fs+wuga^f^WGFffjm*EIF
zQ+@4iC+BuL=&q3~6}5Sfr6V^&M%8~J-%ra26K{W&d*@IgY@S8oEi*g&k-zrN+6Xy&
z2wnL-?L)=K8+{qUTD>y9`K1}Pwc>=uCaxN6P37)KFGi}D&vYgM7PraT4Pi_6D5>`}
z@_<n=;rhB%STz)B8(EwyzPdija@xz&6#|)YxKT{5p)c#((&*PlKXQ>voMvZRjK}fY
zH}Rf)%4L638LmH+XS-0`zoStN`pC@B_xGV1+S<_sh7|54S0})MF=(YEADI4B()hmE
z9Z&0&<QRoGglMw$EzGP6vDuX!Wr)D4?@)-6C9d?Dx{cwquWy`&D7dd5%Wrh0dCn&b
zE0jd7jWiylBSZ$+@A7W{$hVu(QaGj<;%vIVj(;k5H0e|G?dPk!S+%@&@0NlNy;1tZ
z_rfogD&|~~*k1l8M1WF7;!!t!dd=3m{MKjO;itA^e?fQ|H%TzzzBsaz%x8&%3yECq
z*S!1MOTP3z)r50vSabfy>!0l`Fe@HaX40tEfHbyvJ(g`r^8uc|DhVBD=BwUousE*a
zNJk5kGZl}~l=FV}tC0l_dNZQd<1R<bv`VgWzv!a4r2=q*6?ToN(9ok@zQ*rVpp?og
zu?y*vtuHDAEy|7(PsC5$;`33KQO4_!MDDXM_M_^#Mavn+?^F>}<4o6Z2;8i2%LfFU
zg>U-N@kWN?<;|iv!=fM&r=PWJKf-Y#n_N6C4IX8N*1Id*Y6*DvSB?(FsU!Yi$Y>V3
zm4c3O_}NoxmK?>pc&okvc~uXccc&j)WShY@#cEDcU%x?B>B&z;aT7BSb{=LQSSM4_
zT6A~W#KBT+!W?R6)8V4|VNerUL8Yg%cvHuw;CF3W_o&2atoH0Qiqd&BO2lX6&3Dhe
zW_Do6#VkanA6bYnQ7gz=2x8Gk6fFB%)QeL9Ev%WsCj)v+JB?Fm8d>d9XTwr2$FSzY
zf_Ka*^Jkr#qe`(vksMS|KhK4^np-H2szPDp0RM4-?N;1e&=iqY@7cS_iw4hC<PUeN
zxud3_O)3O85T7AQG<0?_NIt8M+BFz`F5ZXydC2;Ciq$i(<X~3_{C^3aFBs|d0Y^6S
z@d&|DR_gw`mi_pUD4UZ;$-&n`*aLbEhlh@|So?1TKW90(jT4+kvCYLpr4?mk0tX{!
zIX0X2ab#IpgO}_CMOL<vr&FkvNr0b7jO)+VQgQ|miK@xMac#B@8vUAZ_K+41KmP8z
z8YAan3h2kg`u`2-`!~hQ!I+XMGdr8)TABl?#m)`c-wgtmybRPVx{v@mB{(R2=f0Y`
zRP8?ulq)tRgY>w+GBqQJR}mL7Fc&C7>mhyTH=wA=eaOnHkP`U&f86Yww`@j9*pb&o
z{ZTN&-vqdMc8eV><k!1rXjRR50X=!gB0aTJjG#>$%efU;Q=D6K>o@7GcB;P0s-tQe
zZ*t?<K;my``v(GF|0m*^w5FdzXP)0B4JvVTY;VuYsg^%9o_rPc;bm0d)wwHF^)3Gq
zX-)Zt&@C0^!a(LjaZGl;w>~BuMp(mW|Nm&Bxie_D!)05GAAXb<<dFPswEm^j_CIGZ
zCOvYcPEHEfbMHNVb~mg=98<mb6K8JEmlgi1#5EWmeTOe8<;QFaAAH0MDunM28ZwD=
zS;qY>)tE2U#sXfId>s#`(};+Z`QdfcG~8W{Lva_dY@f0L=;-P8gKC`oQTIExAIf0?
z<*yDK-Q8a{lgvV22H`@9I>D&GVaBbr>Zp5Ey9P0_N2;?T;O#%NKQv~4CJv{=Z?l=r
zew`z!qp<0d!7&9txZ*8e{th3(gbqkqll2!2*pxE_n!&rM-WvR$9orn$<Iw6raDaIH
zH@|V}%hZg%3vXg|fagoY4Rgc4=?PRzXtRX2nZk2~hf#*70jE_IKJHLkEW>RLjLxaq
zQ^nU*1lQ;X+i^K;>(R)$Xh{Ws+$^|?yil3=4~e0z*YLSCmHkbvZR1c;x2MtBR-iB6
z0WSRTvqkwAzZrVl`2WFjC8_Pc)l&A)Ux{5Ap3kuSTq%EKt8dAym!n_)EH1#vkAw31
z_63Lag80njAw52HMRA<QnxO2Ht|Z2V!q2$J1wnCd@+!Pxuc>P<kbREKGygBfB6u?B
zw)gLm6!^}TV*RVYqDzRvNW+Y_4bJf-F<fJVvWVnJl3SDeU>)A7^tpDtje+v^nx^_H
zI8BBAOsW{mCC4Zz)|GOu1>q<$Sr5I6v2BPf1Ct@E8a788Ho<|dA;DYleniV~!3GlT
z-^JWMmIk<M8kru{b&qa!i)`)#!2T)wxAHaOaJ%oCaVDdxH!YN2{XY=1!?9#9$aXTE
zj;!{9o+09xfNyFDM7#crZ~edJn_hgNI0mcw9ZZ_a)ks#~oh`ZzGUP*--V7Awg4WRU
zndGnWy-S3&M(e)>asntc(I3J0d~w-DZXMy;>wWsohPMqX#|C`(8gC$_@IU$RE;fKS
z|74u~FMi|S%z03FKpH*&;@9JDv9fyFgksREDEBIO^gU!g_JNR_x*Mu3yb%_=B2-i)
zxPHxD1!J28N&o3N;;HV*RY3ooaYkDzPMgyHjG#jKo=5X;Qx0o-{L(xaZdIic!h%Qh
z{;&t;afPZ_m}=S?V8DkCp{CrkUf|uPz>(kR?uhFS7}3gkZj%d{PF{gGA$~k$icVJW
zpn~_8fUVPB`1w;pkH&TyS!zJ*!U9cW5tuChB4BulZU;Zv$N%eG;ythHmi!SeUJ>qC
zgCV%S0pyV)60@$}CT5Gbkz!KLg*~)R1Vi*|r2Y$hz{AAltbN4xfuC(rG!TET!JTvq
z(u}nujJzUR{GO_SY(1Uc$q4Cl_CmCxFcEeEu<gCUQ_lsl;n)9LR^wnl8ul?@qn=&t
z$M&bK3!1ujx&H8DQ1rc^syM<&;?(`jx7*TcWStD?JA2o9vCpz2$0(5j6EB@NUOI16
z+J=^!t#`O*?1+2VTyKJpJs!G>aU&QZLL?I1J+`N3Lz*`&rAM1b>V9kJzoa`VZk|6t
zH^JZWl-o#2gKM7&QT-Mp0fGtsV&iP<cTc6i<L4*chP!k)#I1Owck*wNWCt)|dt<r0
zz;81Y`pu<QMxfp%&SoIYXHJ>7W>$#Frr8m=sMjK1GrWKGDDU4S^6g`0tk2jsmzq{v
zzb&|N-AOi%zMIgLevCC;x%Dw}f)LegT@V{NjA#3WFD{>t1zR>bDK!?6uBE(-)xp<&
zSexEH<M#H7i;1Z-;3Fkp2R|WKX-Hj<f4qQ&ybw+dgnWAX+azv_QcW)*_@M?!sI_q8
z)Q&T9qWbGz?NY;E8~t7M-|zaudwa_r4H}d<x74(?G}wTC<eZ-rZiT5=dKBu%oDyUQ
z`+^qz;kccpu@(V&h`Lr+e68+<>9DpgkfHrt&AV&R;EuPG{%96&PWkSfm>wM)A&FnW
z_G6FnJ5vn>oa;HP>w!o2CM{g@XKFsWsNLQ9Xv-96Oa1#@;(9EZ7g@xjai?QQ=fiMK
z<D?kQyr0<PHqET=7tt^=_31Qz{1{ayVS!J#6;`0=oRS_F&%7{!2$QwQBRSK!0QWdj
z!{(@RYfC9TAaBe|^@Z^TR{Yq_yI#$SN9aaRCvm5JW*4s(IW$+4w?ywiJOst`fY{ZD
z$vVWHD*B7@t6kh1JJ3PQNa`Q#7}HM?1+;tjg&1u1w!eHqgN}!uec5S%em9)#DEhoK
zGKrP{;~`MmLO0wN_TG}A@T$cXZ4Ta<3)*U_j@mQmcIV$(7-`<K+ydliVwY<M=D4*X
zzkQu`EU?mYi<XEJ2x7FV-w?Xtu8eV^=;3v}Jc;)BDl}kfwu}O9liP$~M+Kb602hy8
zr80I;yx(!QeM86ycrDO#L-Y8xgSZ0t<2z$POJ#$vkR+fF2h=n0;gR@-HSmxHs0(Jo
zW1F|8cAZ!T;>-yI=Fuvpa0lVO3%Q5Nz*qO4VKy`!PRGV%zAhi8^!ULT(`MoH(tZ8v
z=?{_ljmKZ-?@X2Ti|U-j4Z!yh^w4Pcy2d(}{6+U?bA}?ZhQkSnzCy%RYt{z5Dxcr{
zdenPS!Pz6q^*dD?pPV|}Nw)N>op&amAzy1F(SbaN<oNx~Th4Yw&c6dUa|~Kk=QUgr
zzudH%gq3Px_`!a;H@t8I$K!_-!CTSk;K)XL1Z^GC+i*4tk@j7FPWbok^!e;(_cRqn
zpXlAPAbx9v{@W{nrA-+18SmcK4nC4L-s@sF7N~lJdC_)UZ>avdLkYMs0?A%4%7(3^
zigk@%td}vZ4?Sdpv?Dsg#Ysiswy)FaUEWIVlQ0fnJ$x(NI;Qxf4a;l!IqFAw+nDve
zrl;%WMk9~snp_Bc{TdpJ)@MoiAihK(0eYf$KkrA>HsrB~Qe)8fxmN{7lN~PXb2WiS
z9JAU^J2&DA8~lF1saQepUlE@388dUAZTenqh)H<E85;U@bo|6i_Td1Uw{_F(;*CG4
zMtiBY1%c1v@@24|b-!)|x~NEawfE7F(pev%qAD4AGR^POU5%FD^B<_FvNdA?S*A$w
zHUnkCCX6>%u-3u6*#9*7`Tc<;N1+gaD_nfDgN-3}<v)Jey%Y0)r|MzVWXXBuVsp*3
z;AytKMz!siXYS{jYBD)Xg}_3E@)Pk-p$L{}1-qSV!h->Gcw_14_g3d<a9+emHPvt-
z&H2mK745v`eCK@j;M}FU%m{SyTDAg)wtj1PZdRkLY(;8)FSI_t?(IHtKk-r(m$5^S
z3luL{!4f7IK?1$l4UxQz7CaAh3}7g<6!{>N@uj&UdYeJ?_eKSTSFmjed8bVg{8U>5
z!^BPz_*Juisoc2O+^@ZD;_>oA-r(>3p9mC7dpk8Zs($9}zSOEN+n($#Jc<N-UYA9>
zmf0M+4?uX^=l?-FhLBSF0h2b2%>C9CwEy_kN`OwGD4tna*{q?VQ57>Pprxz3cJCe?
z=V!csSivM2j7kS)TgU<=ui7GWO~0ohBFcH=S9?z<5jX$*_!V^O%U<RLW^1m=?*R_r
z_|pyT@(bO-Ny^Tx1Acpwa@Rc)ZOFR#KbVY;w^&_mO&lt5qB=w)eCn8Lsqmp!_xOWo
zMjf-yukbJbIqF|H81Gz@{UxwRy5Mx#7AL5iDM|Yc{Udql={zI6BHmZ7zrE~Le9wE=
z8e;vSK7vA4#?Lib6JPM!rEh#IMvJk_uN1DV{94^qJpPNI&DU7L{H&x=38TwxKk50c
z<)Jc~uc_(?;a3UYwp%{kd3V_rIOt*Qax3*qi<__XrsbtdM7oF7c(l3!(HGVl12z3Q
z=ocPF$b5TyW##5XhrYQv$<VX0R?L5T3Uugr98+qBQ`3<wnNB4o2h2zL1;{H}2AVM(
zRQ<ij<gr@q2Ya1FX*Wo*E?qY2U#~D?1eN+nj}zX%Q|+^;Z(9#{crbRFbDmpw-lC1G
zH}JDbGwETNUm=hsYcLYI{8?SO&PC;YO(Q@R7Vc0B5j&q$RbE@Nf9FbPp|;t6YCGt$
z=yyZ&@bU`?p~bidCprjmO%@65)fKJllLnGY2{;f@$5l%$eKj(tN~NuYJPWO3ZYr|N
z*YvGe0KvEHZ09`^7M#Q_hSvif_^VOLN$N~{PX})<`u&`ly?Xfv=WlqIeqoelVp_=Q
z;%7JO4JYNmN{fD8uQ`%W^ZZ@6Vgc4a_?sCIIv$?f#JH=*jD1>~{&@RCHWEsbS*%4r
z99wlWqRW0wOiC(=b<t1u_1bDw<nXQ)J-rC&H;Kc;4lae8{swS|$*HoyB^@`<+4&Xb
zx#2q1wC0h^?d%GMPQZ_Keq2@myF3oc?Lx|OOZG?(TkTFx?lPob7`PwOM>jA3D7Dn}
z#wEXx9YUc@*RQ!sbhSQg=b8#rR&IC7Ew|h%nk+-1{K8D1zl18iQ^g@CzkIF1!!{Gz
z;d<Ww`phG!)8N@?c-1cAzAlEQ$ff4~R_rE$w5XCXaWNDsMHs&NjD|V$i!qMOhr*>O
zTb|*6hzitY*SQj0aG<1GOnXmuoE|BKkL_e|T^{@%VeATD_-WxPjt!iB4#!5`jNsB0
zu%-UxGAlzIj^k{U@a;{@$H+^AgoEY9_o=Hs#F3@nDVe=!wI`Z)RgjOv8`WBPUg%sJ
zkd(`>H!>!C#G{}q;;$5nZFO3*t<6YV0Oxe&r4k*Nu7&^)`i^Vz42M#9$MIL-d!-gl
z5cfpy$&*t?#e|n1jy=!YCz)IRVG*ueFTUa3Or(^R)PHhJ9$n+l#pJxO^R)DOjt9o2
zHtS7J69P?WePDKm45DKiU>^u%EK|n`SdVJA-6yek0%@U#{{L!0O!tIJZPt#dvxg2f
zMX_ZoD7<8^Uiyn@PpL(eZflK}y51Wb^Z3jR8FL+L$!EMBo>PesNkD@PamK^X92pXB
zsQpu5(8ZV~QflzcdZ(J6yRqogTlOOJskxvqN8Ghbf6#mI;ue{l_r&Q-l9O(0$oiW;
zN+Wl7wa(NFk5uhm+WCT!HW+gY?sHjGek<m7@oPJV%_RfK;IrPm%oF8NMbV&t{;gYy
zjQ2#ilt-;!*D{Q)VT0YiSuGt19_GeY)OEAZ-O&B#+q$PDl=)6|bIEyr$U5|6S+xhW
z^^SLF@IS=Irx?9(BJFFeiEwP$=c{z$nFgpXRRZR*Q@d})jqG!l1tb4(N7fgP8a`&&
z49N}*-(cU6R&L)wsNK8FH?Ca2dtr@w53PPLP&!9KVNHIfU142!W7x}X%F8nay8tnd
zS#yN4hH@e6>2d6|A95<VxAZgKKjbN`tmrFCe&Bdq?YD1@JfMWQ8{UkF1ecX7zED)G
zU1U-<I;z9#vQ15};4fRYRHWICdD%*vF{AJJW#|EYVqHk8Wke)cgB9sL^2_gwh0Gfv
z)U*AyLSs~si3t+B6Taa&m^nB#HR45jv{6PhvA@DOet~-i@&L1y4lA#w@ARW;jzr$z
zi|&83>AQd~-}gn8YRJgiFLm2b0oC(ZRv9HS>tgRUFpXFIAgcM2Fe&!<?@*&7nmC6H
z9>4K*JYtB{t2JH5AdEr5iPIFd9BBysq-&l=jQ9MX?1c08y6@yBPK9Emout8JX4grq
z<RFBy12*e?3nZ4&-5sfY9Elc92c;*Fad5CcKF+`AA==*2p%0KRd4N_GVqJD72lP&w
zKfAXDw`FF;FS{LWPFP!MYc{b1BA&+#y_XyWk|sFQXrvn<4>=orpQENI{B`6kD9F@2
zN_EIf%xehDR)IKrTU=tBzgBKt*w;x%xkuO0aJ8C!2VCpj#XM|dHWo*OoSdA#w)T+b
z*_DSSjgb_r2Gx!F$1N6m08p?tkR2tsu^*<xz0_N%$#Tl9(I3e#>7@p8oeX=6mC}zN
zF@c!NT%@B?<q{v(WtmTi7sl+KM09v*tYD&%s}%M%`ZZ}fMP}K5X#uE_DveAIsq>E*
z!iO5e4(9jZ=S!63=l8YL)QmEIp5Z*qn?9U6C&?=;G<3<!6$Rr}*EUB?6OM?KGUBqZ
zWjDgOG=Qe~BHVDAu_02|`UUM>5#+W}aEifQ?$_@Hx04LZUZdxyouO8<^CvuyCKH{6
zxW&z<Jdd0jv`7cPol)#G!srL`va)0u<T|8lS3g~qj{W!SH|ff)Pf9{~R9OJ23la4q
z5(+&(-TPXc+olSzN4}@1s;%5P=F<gC)+L_NH=bpH+)|MTE9f7LW!TqqT;LY@E;VMi
z{#|N;UOY3iA`x;Rc+$XqHZ%9VPIMFxRw~J>P|z#!P@!DM%jaM`!9B>&V3G4O2N4sb
z{VQk+Uj$9{Sx8yhF9;JI{X$JqIS2qTw!(?nvPvSyf$n>s%Od$3v!?A&NExdVgx%Tp
zYCZHV&65@L#=^49!bMbGZ;n@pJT|LXh_ukKgO%3MpP>MT$-_=n&2tJ8MKNI#Yctw!
zb<I;)z%>T9DeK)P%jZ9Lj#jb@-<GcnEHbQ&-c@m@SbA!%d%9mHxMep56|{}!%TDga
zW<*T_Jh*f8(Zb0qE^+2W`zs@zXU40sU2_g=nwvzKgW9H6M*)VLVRlsv4Emk}j?hiB
zIRzd&Ah<2p?s)Uk?Rb>ruQ-t@JC+-d4|2l4LItMI+7`TpeXiKi&|@d<bV>L~=jp_v
zuH|CsxE<$Et}ZXH#h_(f4#2rXHxI|xmUeL~92-tYPka=%G34UYly1BZ;CVJ?JG#Oc
zkm>>@Dos9sq>yW{bIf`n=LS$(F8;nKLK{H0IrM{MA@?V%wyFRgY{yRx%zY>z6R?ET
z<ThCMwDozQ+zK1eB^v(SimqT3K1teX412&-0u_;hUL(mAbzWGQ^R?{R8a_KYus?U+
zwn5t2WHE8Q{8_g7Vaf1DM2wc6`7`JFP~XxMUu}XnG00&}Y}uZQFN@u0!$pIn@ht+V
z_eKCaceW9(q{l(eL>T_$IpVU4@0yR;i7SnT!P=5DV93=;#>rDQ4f%JhUSK9?-9#7?
zl3~3#3$>@43(%7y#~TB0^8LjG9z%5Xt>R+^mAVf$mgs93m11Vo6=N4GowqgtUa*0^
z1abuBT@XBK=r`y1TGH>hF*=Z2I{J+v$~5+|QF`Cf>u0-_N{J%Y2Ln<S=e1`+?z4Uw
zQ5B7202MF}_!4tr_71z2&$MGM^mO_ZBhB5p(6Xh1H(|#89jt&l0%UM7&Mkj+hxT?)
z4&r4jtO$b{wUHMrMi0T8!u#iXTO#$sC)wf=n}b%H<F36xelWwCN(*Rdu{;$utGN)h
z5k>I<Hlprwl>ZuA+l%a==k#e{{slv6p+aXbkAdgFLGAcVgKx#tn`c(TY!B@hJE<TX
zIitCBVSX#6i_>Os3s*pIjjV+`>MulvdtM8U&@#{_oM_*;Q#Z6WN<yKfAF~kvuiFlb
zy#NI2nlD8BbdP=QGy9FtLi<Si-2~V7$0aHo`HIwQ`TQj}c`iwbTQR*6jbY48B}X30
z=_h-Sl~Sil6vUY)g5RniFI8Hc-|mi&a~qY}_4!6gX>dlFZ+|r=ggBn|@j401^Xa7r
zZinjwW_dq0{kpMM^xAegv~KBB=4N7~0a1Bbm3q3D5QrV6T!+o;1o18N?(yKsMC&3~
z@|yHL3I9ygw2~LXRJWLFg)rP<(rU3Y+PZY#v<*g2$s0d+m)lOFIqe{Mk9Ab*O#GFV
zRc>N77>6)mJk_N|)g->OlRT8;*;Df>c@H9hrN+MJaQ5I~)JV{Bk;f%TfOn9;nC6~D
zZtJ-W6BDVB0z?Sp5^4*^UcyvFN``VAa8VRAc&igAL^xwn*(s+O-&xDt(D=FpHu(tS
z_-EGk+LV^x<-@-{2)3#dT$C<D?mk5}HW^yiHDtb4@)&~*#gCiBS`mt}5>Xs%0ub&T
zqe?Ofx1ThTN^!S?pMb!~Ui-uRilsy{63<Sr!PJO`U_L&2?Pp+Ufw%7jnD4!g$;SK3
zikj#dIQ!O1F+CbPC$ZirkveTl1q8#XOqhD50%M#a{{e=fuOjutc1G-()tF^f#5WSF
zIngyyD$jkts&i5Nk1ad+fT~>5XUftelRws|SqW`P9GWxlORo~0a>%YrZ8M2+h};;|
zBhLlA#*=(^<W9!=BS_s`&{zd)>G=4O%no!K<?E3g(;oZqP7Gbf7<eE@ZO=wZ#TlRF
zBj>nh_H-m29<sALo5p)qmPIYQid>RPiV6HH4~JQez^5>j=Fd?cOjc{oc5=$HW$$AQ
z>XtUWDgc^a;IXLv6NFKAKcok?L>#=V*Om{hNz}FP;=b{`&afb<Jqip(R8#9-^X?u)
zo(!E<d0)j!Wx{V7yWsv-WF&Yri{^_;Tx13wWJU3&zfKF|PtE&VTd`wXdZ;W1WRq2%
zKJ~F_0kVuFY<^M9;xc1No-TV`Wwi7RqO0Q}vl%kadb$>M_fII@gKWVlcH?#rziv(n
z&;1$eS~|Z8duP>W`W?SagHRI$K#1sD4OZG(^~{9xS;x_RFb-hP3yW%b$u4>6_{JqE
zN7FkH?2^a3jsUX;6{YEC$QO~?=2B?*s);zV&@C_1F3MJz3R^Z<_~iWsRp@|c_hIz9
zwtd$?Y%z(#jf#`3wI?!L%U1=&zxED6Ao^#*Zu!<H4|9RCdF58!sYtb_FGZ=Nu2l`h
zCC-{gTElUF$Ud?$nb(41C#_puf8}ws$9DxtbB0`UkZ^{-bdTYIxxO><V9UBUwe9fJ
z)S9tYJe|x+ezybeszAMlx_UV<8(NT{d~6ieL6Mp!ta_pGL3VFD1ElcD!yUtV^K+Y;
zgZ!D4lYl1*)4gpE#%AYU5b3U*SivQZ1lrR41i87nQTr$?<WC^bwY<zqD#}YD#k%}=
zUTpR}UGYbzTMr1jXBCBo9L^`C87`Jwe(M#chS#?~Lw^~U#XFDmJcK|vBXy*T6MG8x
z?HLZfAw0=1F|W5Yw-Q}AuBCavkBW;y10y}-hTeI5Dvm?@2NUvT4?lV)h^lhs;_8}5
zatL%vbgok^4kadC2I(@CSbBO>Xj#iZe=H`=o>u^#Dk@u~uq3Dcy#;U+rkcR)6iHH|
za0aMg8_-aj0#o;-?0ef<d{-w%x*eB;=YVy6cS;*0yE*Ech%~l3_YtUJ7mx}EcC}Ts
zbWp@_2WY!7Uc-&e_RoT5#M<<%;o)UrCNyev^eZgYsmru2TF<r_xGC*py*ZSB`ZNhA
zucea02~lr7T=2CX?fjBvh#0~B5T^tt7`zWO=HlIZgi<fc{)<%Al=j!jsr^|8-$uDY
zwQ(#mxyDa1`T17q?GJIGG@Q9@%n#~vWhDjplgBX0^0vTKkO9WiW%fnunuUB3R|e^O
z0xGFL+)qxE{e(voXoL6~&67h*)jBvFQ(bgZ<YLTw+h<PVST@q(!l#{kP=20V>MWDg
zA<Lf%`77_?;#g;+pUJs@iUQbIaFsJrmU85yRM?;n3XIrUZ?4&fZNYaK$>+c*l->Op
z>mHf1<@qoJwGZEprp|xhMYP4Dot>U8Ozn@9(buo~y+;pa3%!`5(l>TyLZr3>9Xmi6
zbOfBwDtTFz0~TI|N^c#dF#5^?!k)EWg|Q;9W>M)SNB9FHFhsAJQb~cOPh_KVOmX*N
z^?hc~@0A*u&|qP&O*h$Chgr4w;mC{*6BdnKy{KPB#+>oWeUE$IvzO$5Ba9emyR1a*
zy$>u4=XN+K!cycC=*z|<qJpUkpDoGl3zlXXuX(&@sPs6Wz~4kuNddX~?nIC4$Boh{
zhV{|HMfPNS`W=ikAQrb}K+ZcEwRgTAkM)+kWCZ27S?>H}8a>@emb&;B_5Nf%SD$<f
z#*Ht8goID-ef?r^<Nf4gir72XvFGQMp4faP8+%K($;0Nnbh<V$DVQ<PZCN$3m#~%L
z;o>iOugk`S%N>5S8oKq4)oZWrU~p{FT`=v`8*6h3)qKRwjF%PaZ8)Uwo<f$&An-$m
z5kEM+m|cCXRqND`O~B+C|EE0LlTTq?8&0=kZ%l`6*mo0~W_Fv8>U^W{i|t=Z^m^%2
zK4^D!aXv;u$qnh3(dkR&G2hL^CL?;bV$w5m5LanrL-vdQz+c3!gS9L+GxBTtnbk;_
zm3HPH5MAK`G(dmMW%FNQLRdzY{Eo!}t(EpRuk|bGJ@>)9_)y=LO2?iJ#nS2?L-Ly_
z?<*M8SJ1ADT|vL~_To=(;!k4Lim4>SE}o2b%68q-nnGE{kjxK^h7Rq#h-Yt3Uxir8
zz3I)X+F;3Mlc^OLb6D-~;U_WQ4kF*4@uiBEqLNXtUkp&CvHsM0pZT_q@s!K=@=~XX
zmq1jenM6J{@cLsd1KZC;aP@N7E~=!%_TGECH5f=X-5DFfkYLG?!MzU~Awn{>%Xj?c
zGif=_Bb;zJu@O6C%u<U2h9*|cm^U=WuH?9PmL(WPP%?Hup`mW?RdS;oiDGXF-UxTT
zsQ$Ah8(9e|3hB?uYaeAmkVucQ>8XzLo_HNzx&OY=zwcR$2mR}I>P^{*bbNDn*<2!Q
zvU8ht%N(Tm3%59w0#!y7LdP$^2vPYtoXqu*)SCLsASs)tLRLP-G98*a$1fS5bmJKJ
z=uLyLQkl}d0n+*BtR&8?ute5l2s?6siOl#Qh)j$T(l0z(7vxbwi%katBH4H*m>G#%
zR7P>*n+%+JOn1!N2xPKVCj6`lT--9pm=T^!E3an61TvR)S`s<7YEGdaB^h1m{<!uZ
z{$fev0xC5=u;kuP8E>M)6N?Qyctz^^e}=IO5Yv<+Xk_DD==xIpUeM5}>HYGj`jPrm
z-bB|}Lc5Z?!k_h}ZX#hB?Zd-Xlzq2wpTowe#>=WS0m@^v$EaiDI{9;kdi5CCd(Jkc
z*HU^TmNb1pP&YolG%z)sd56-?EQhS;4(7<bKw<)~^>N*~r-^|Jik|l#Tc;shamg7m
z<11hd(_(7rju#x^5q*t1YRkx54O8O3fA8zv1i7*U9b>`G5vF21j@4gvQ7_*_B}CEx
zpN0t5hnmD&*+rJ0$((t>`RBrJ2YX3hsh;0CZ>fRycwwR=eA1?_MnQD#MXt>GBEBP8
zn^Lbf(!6o-xlsuJCL*P%at9F;F0TeW5a{kPXFL)_z7j0j>lUnZJj=KnFWzoabthNQ
zoHUZy*OWAzL2bkj({b|HbPPf!m}Ff{hVdnpqOB&xd^3_w|5ZusV0X<)x8SC2M?qkM
z+Ni_2ZA0gDy@g~~pHKz+QoNU93~FI1UhuUs7i+>6jBCHZrz_+>ndCuRJ76Klj9J$-
zY~aG9oT$nE^0NQwa3-?U28^ou((JNj4UkQw0~WnSBFmGvoo9=Z=^w^qP8;TA%k}-x
zWNp#zqtvYkjr&^^+0$iM5&>O|kpJ{s5>3542sL52seajN?Ja%`cEJvA?EI2?-V$$m
z`kNKc4*+4P>P2R_SR{_e?zOUh6efXWI|H^UjAZEMNPZi8_E3haodJPsLJ{qdgG1ut
z3P&|cZ>i62B$CF=^JK-;I;J{JE=tmOwYB0EpVQ_z|0^nzdE)p+-5!fjebgtJ5w>)^
zU611<4r9gx*#8kre&6Nst?M5$xUkX)R|UTds1Y1^aoXyPLJrnLMSeYG<%Hv%+gL_h
zTOqJpBm_D@FRW`V|7=WAG!o}J?17Tt23=7Wo+d2SYmX$k2yxH<<}3RMdSnWktfqmj
zw}9Ihv)hDV_&2v^PB*n9SWaQnUXHwV&^fa-C|al6sO|{r{)~isRSNM8OQ#!z2^g;m
z_H@jue&b!?Ul>-l>8UP1g@rR(MexYMydCse3>AL5j25qi<`E|-1sh@ik45_HPqS`}
zSB}Xv`(!<gv$H{~6yaQjGAi^|j2m!`JOolTIB@U7Jy91a-7m%JkEJ8QdexSPtNU(F
zS?(o%0UWL&7M<c@9XrFh_tC$^rGq~cDR|7t2g~W43@t|m5Sbw@u78LucS0=fcYJ&o
zs;HLHBKKCI4w_xw1s6H}$@(<CqC3NJp(uO}dO&q<M-xTPo`PU2e-my#l$RS%xM{%o
z@+U8Uwn`8U$~>Cyqb>1DiL^oMKpmqk<jivv6FuDHLC({EMftyPP0Z-}`=4s<;+ZQ4
zRJJ<S(rruZ2Vy+@8RuoLFp)W|F@)OZl_{j{J@5PogxlLX(SGH7ce!#h8Hh2N+W3`(
zHzbPMA25HWua5k9Z+6HdUOcGPiFJpYYyI=Xhis!-!L^eWOeI!hgK@5dD~su5EqubA
zb=EUp8{E9<{4YB^mj{Y`qlMjraBsjkk0HjoaOO1;Ls9n4TC<8rN=I_XdMlr3ePa%W
z4B3ZX&j0(RU%`kW_I8PvX1}kUFGCS3C^{i7LjikWrhRj!jU?ixkeSzBSfXXJ1X0uj
z%mt#P;=@sk=-jfAUZCb~(yygk)#<P`IFM6%@>){T7tsGptoI`@mOm-e<_SSnZ5v4x
zB+6B==tt_NP^VvlD71D1o~_x{UQC@-%oyZRc(b?G=i}*}bL*v4`zge;URp0Ouj1sS
zwQFVA$TymMkUTYm>s22s+LMJF%CIo(qQ_<9*0twQf3j<?o8O88w?2lmOJQ599;P`d
zx0m6~)Z7?(_D1{PcVe{b^VGL+l+16+5~t$xV=;^+*ey#y->UWkW>xJB*5jrX9{=$n
zS&#UpDZ@`bFf-MwST`T7<y1M%@AqY@N!f2!&?>~1T8*0r3<RdWDYfXakkw&`03L0-
zn0sEk;onvQMa)Q<OjaM8*Gpc=n!19LbNun_3rEm0%~9;1u<E#N>s7PfK5Ra-A7_^Y
z*DB>^S3H+(?>kd97%$V(tx4<)Gadup2M3gnx|PwAolSjc%^yZ~1tXHz+ip$5+Xp7e
zrO{p3e^b`(X<cDoBIv++Zcd&gtCq&bKNK@x?Kii+{iXl=;iyknPYZcOu0Rxtza%YO
zq~X)8xs3Cp=2%JcPafjW+9#a1t}b2>_IM^~yZM^-H^zq8?^JE#T0=eE3fM!4Y1XA(
z>vE`)xXgQv?N6<oE7dGfeO;X>o-eXtQwhpf)K!@B;&p06(!BE2<1??MJ>i!XKAJju
zVY~tTiQN+I?SpA-<!=x`e%mhM1jov!f6h>;7G4leEB<fZa|Oc#<PPDRN$UJ3%Iz;R
zyD^y*j$&<Og`0H0DJ{1lucXxuPAu&cWboxmo-YQIHSSM1PgT{cs`}<*A@0F$ya3}B
zX3YDFSNI)QEL7b#$8rW~bOKX9^HRP7+FR6R1|X_^IMDI$c?D}f8P~hIcD_@RqGfm%
z<+`w-rLVXwU+e&+)S7_iCY_iJH=lVcQ1+O4_f0Paf%SJX_umoh*OTkvx{R{U$~a3w
z9nPtGd3K*$*;`uqY}qPz+q1iVeh{r}F&j%f?_94vWit;Bzb-&keg4&6V0EG@is(sR
zH4XizMn4VJC9sz)SY|;C+z6s1jCa)(96y^+q&vne@As?0W6Gx7S}01vjLVqBksjli
z)NbA8aqIMv=?rCZH^3(A3{w)?xJlf?Ku|ef4F!5RUsw7w)rvdtUt_O@`5>uj4f(=^
z49x^A=1F^`dD_C}qYj=ic%2XG+L#{}q6epgbEasryt*cBPhW8!w^}}LrH)g%myU^e
z<S_gEvPl7Gr0x-%{-y+po=aZ*Y;HXBN25FryF|zN<T$<jXM<1k3fZ+h?c~R6)EOBo
zT2i{nqGxL97o`8(ku5Qv%rJL}XA-yt*$X{*dJO!o)_?|03|JfYQzKU}VBWpqCQaCF
z-lo`f(T(D;&a5-d2o2tX<r!Z}ZXgPtId*t(#V|^?H)Q^9PYB&HnrxPgU%KPL@>*Ov
zO$)ihHkwJF0&nC%vI8b_#>odWN!!t2^007Z;Zo2&b8wVJPH{49q!e>Bb^60xw<D6(
z{?v0rx<mFOpAEi&Mc21=AkguO5^9z+c5@;fX(wXH|9o$DKR>maloR@B$j~`VFv?77
z$?#2{`BZKE*q|2_(7cLzWgkL>sAAxRf0{-dw()=;7xWu}o6>Yr_>;8K5xi+t+C|vm
zn(e}GBQf8KGK4}lD^8(Sm84u|Nh9{~3Hglf_|9<VzD`{BYGY`@&-e22PJ^w60tEEB
zZ(-{5!3aXM`CnhLw0YA?I%k^#x)`a>;X>y~IX0KYf(HE0?*q3s%qn%)`;A}{;Q|iJ
z^(GB?L%cvJ;Zd*<@=LUc=f@7*YZ1=^?!;#2RX4XvbI1Up(1Z~q_=JM*%?<r3L$?)T
zpo~t`WuB2}tf>tlb`E4O|8UTT27ROgE1+%hqb{B}6y;6yI;<d$tK^$$WnT-BM?qh@
z&dM}=#_(u6m=IXBQ8W${fUFj)EX7kOXk@$!eZ+sVOsg;zamt`$+TrL&j4(~~ysrV`
z`CVhW<s79%gF^GIgCP^3hFM|0Xsk<~_i;oZZSxghbJU1J7SBcV&voZRU6uI}^fg5a
z-AYNTTdT%l(@@lTO}M~EN~Z$Pk66*plh78+;vGp+G-JCP*ncd>EkckjIbfyr_bmK!
zR}GT>Fl4xSg}z5Fh;R3i;Pr127UTWQYF$7^!@_tvEPXCWbTp@8@t$>`^8|sg@zI3S
z;{hj~Lem6NQ<0NxBUac~tVVNburF|lBDZ}8Qc>3FO0kr9dH%S{Fem?;G;DB~@o8s~
zBCoLfA&abOh=9i#jpAvj5eydjxi1#^gNk*_LP|$-7o5wmu3<VB^p&BG>foI|_(D0)
z;+mcM3mPU$+7;{czLl97=()poB@8PM1_fzMvo<HHq8ozmzIM!+G(jO<7XfRV!>;bA
zXmdL2SmLwMwLk8=0R7gdA;0~f{pNxt`hf-@sHPGq5f`)gZl@v)PKVYc(OnDa2{?@B
z!4wvKg}f{Dq!T=ggLR|?`7l_&^W^c;bJLWd&07SblwL??UKmSe;Ce8TI#R`02GSHN
z6BkXlfTJ8^nPEf}@J8lq0qv7<Zmp^5U8EOX0niPS8cF&_Y7&UY2b&L&w^JnbJZ!+{
zOnF5pQR1=#Gt<>_xSgbzz4d_Zcs7-8oUWCbt;S{|kCN<ELQiv4WJY9nowHB!2XVW~
zgH8>}ycr~JY7IpZj>%}b-a(r!swR8`=!pCZ^yJ!$83LsV!FP4^g8xg<dAEO`xTgIp
zk)P97wx*HiGLw`}Z^q!zQb&hjP=IY*DYQrtS5c8HAY5fRHk1BWP17vE<hMy}UhU`v
zOCps?&Xx{=nK3mj->4`~{H4$uUyMpjO`>YMQ;RPuG>A9Z$5HD<cO#$D({mn^zJ<<Q
zN@i2zJ{aTRx>4d48)e{8VPGNHfmhq-bbNEXl3nlQMB_^f&mZMk5<d}BnWFkuQtBtJ
zS!O+k1;&k`-Oq4#ux7cig;c+=u5w$r_E7465)Jm|@VLPAdg)lV=Ixab2FwqAp~nY)
z%QUnTsI4g*MAgIzsFwJmQu6exQWs=MZ6}VMl_eWvz>I-)Nr1<7=&qoN;d*W?N8f8r
z$_j?7Ad3aGbTWNL+!Jd$CCRMrUdw8A-K^aEodYZ8;H(i5ELK|B*d@n^-cx=Ugo_R{
zUk@s)f5e&77lz67A#!Y%`T!`Jm+!sSFC6y(+4+Rkb~v9l5O{YsDeB_k#v(6I6qFb}
zDI4432($bZo^BLe#53hXW?Ac4$F>AFe1Sssb}WM3+_`F=QdSsdte^hn;_M-C*ugjR
zR*=r2;2PBN+!H?<&~lgA%GS$tM2pU$?oy?j5Bz1)`FPvRew3@5k<E`b2fI%OO`qE6
zIEqfZvM<`Ib$@mw%o>LGN2&i-iu!hf>P=a<x2u9PcE<}*4d%M2T4*EYFAvL!{5jaN
z7?}-Mqh;xFx_Lc|TTZ#dl=GI4xwz~^l{2p|1@zOz`P=x?Gb#K1$5H}V)U32}{5EkP
z>FzZL32wY7E!!L*{4_7f^Z}I1(N3T-A8oFdQIUoJcM?52h&w=<s?4*Ip<lJX(mgJ-
zdfwx0B6BjJK2{rRO-@8S0#1p$4h1a%%At1o>DT7MbF|YKaUaYtu{M=m6`ulp_QC2_
z+Kuer=?bt2zKM{na1D0w=}7)KOdQ?3fi3t&IlhuxX|svlX?zkiYZ9Y*tj3nDBmdl(
zi9cTSrYb`W(ye_v#*bM?#btI{RU3VQ9{ODZUE}s#N=@n46X_*h(&B5gx46K_3r4*&
z#N3m$AN^f}@uYX>v>v=05YkQmjF+@BUJ(}CHwlNAir6p8^D5|kE+L4zLT>BvKq@OU
z?=h!o+IWb7<ErskH07g+jW`Y(MZTdywxXM=@$zNXcvj(u&YR=(T_e(~G5q$CH3{L%
zVO!iXWTssSR%@?qnrb16+e9ywF>3WP?*>6h`AzT3&yLOwMZs&rmrUx>v6Zv!j`ZL4
zT@nU7E-ErPfDiOl%QJdyVbQfdVjq`B=Pgyc7@D2)T6*?`Wew<FcFHxhYUD4HWN~sy
zp7z+^sR}RkFQvb!R<qv!dUcde9+FiKP%h8Zs)^l$JUaY>=#QR`$7SUX0(EofsA}zj
zJ^7#R+<TEC+TE0W9hOUySR7w0s#VcEuN23nA5aB>Q?6`2HIKIZuRh^_r<S05IIjS#
zvr*jKby-xy>DT9U%O&=*zS2_fKU+E=g*G$Cn026mgec^P8tt~{=Vj&+5lG|b71RF=
zo4jPv!4D-BgM<tlE3J1ojpq-~08PtZdVgOzVFz8`Q;peOGV<`4jv`sX`~S1E`PUVj
znSk$-ArF6`LZv!^6aOt*_yrfqAKTFtZ<D7Ntu>90KCt+{nyjqrQfYb%{+%u2nIl5k
zT(>X#fFyVZ9OU8t{q{7zn}ktPjIT}b?{<CoxBlwI?Tp-N%_P#^qvd_78|oHpudLc5
zoyldH5f|a08zlhCdnu?<_)@S&FVC%LL8%d#c)|NWzvK!!Jw2!nXOsGqwo(-b3iJhP
zq#9WiKJ*9sz*H~kU4Z7UtQ@r>;{$UKWpGoHLK>~GP}?-mq;GhC-VEAxCeV3nf1{jr
z%TwCt%P+tE?(dggLmIuZb$l!6&^4-+tM4#Qow@0$R=nCJCDj_m@*n-P8FY&Y-y7(g
z#6UV$<+mnl<TW&Wo+>kUYntX3nRdl!?4CTmSR3^^?5MPU_dt7PS$>Wc*WFC2j15&G
zg?_aE!|47tMGox76^Y|zZsv@2hj>QCt<0>vyj-Fl`G>^y57$bA;yN7l{J;f89V-|7
zSr%RKZof~h)9!;W@=D}v$}~^qVQzo@#UXpTR4^sI`TV<UxShF1C=+lZzP7ps!nl2}
zOiSz_fR9w7lwIx(*V#Dff0J-iniNofBjS)OIc4|YcNhKNFZ4SGheI-&CS&1w2dUKU
zWnP&UK`eUW4;-{#RIPeF^k2)7m8yj*<BhE>*bT(8CWhL|#$M(-5z;R}m3+}kN##~}
z=L>aRG*1Vku*^?!C!UvYOMz3%p=b~b(}{%-%U_yoPjmMj5*HEtZ6)DKTRT#N+;QxV
z*YL)oml(w|zf{SSUgl3Bv0`zGscD5P+;;K?#{=Ah;xaS|{iK;cBd;sDRcSx@qYkE4
z_QPOMh_SS;+vpBV=jM@SX6BPobZ88H+I6y)A7$J9#QFWtJ~0YXt(PYutD4IaA0}T0
z`Cew!#{?jym?sD0R0Dq!yw2S42v+O)cDu!k)7<S|W`b~Ks#VdYRuIYPeZ04HQ7jCy
z=$5jikTzj5LvR(dva&cp)iwZn1dMYYA2zRlV6;_!@FBsdy8caC4t~bQldVTBf3}vu
zF$nTHFsrn{b6`%TH)S=4du78G-v#VCV(2H>w?13&7fJ}VJr-snzxMA-ee3OyUD}ZO
zWI9$Dbs8sJU}Ar{hc+Km_D!$j(Bz9dtUBcG$WSQ?6HwMp3|BvK{`j-+2g*}HTtFq%
zP3gNEfq=?a=Pz@YM6S1DP+&zgj-za$s5#&yw|g15Ei(j}=`Y%kkB<Wb)!bMv`PesO
z^eOo-W<Y#ubC_X~EH(TgALy&$7pYZ6F!0ITyZ4uMoTsv-y%f}E?8UWe_lPTv5cu<?
z1T2@b4!W&?N;;?0YTUCG@e9LfE1DRT<%kQ1#f3T4u{E?ZPvm!?@BLr=pUNAXsP?h*
zq^;6AHl6fJPN?Y@P%Jbp@;bhOanamPz+7$R8?bfIPD&tJk)vk|R=j<>TtIYLh~kP7
z`>1$Zz$&{tr33wdW+~~mq|gT%RaIy&l-1DRL$aCsgftob68nw`5i6xm<FOhYUYV3M
z#$aX*o~9Egym$`kIKnNBcptM#^6#mMDvl{2sO=wI@&!7#z4_w5h3|-J3=9m4XJ)m_
zN;ql?6m~rN$vobDR9>JLIu;mcVE{i}%dfMJWYsk}*<Z0bIih+Y0Fs7kwzq?SdXTJG
zQV4aLUcJmye8I*Wq=n+xIuY8>n1t|dNHr5@F3sn15<ma{NPFw3DBG@m*gy#dq(r2Y
z5Cj>Jlm-EDKpN>#$&qF#sSyDIl`d(d8>Jf*kOt`(x*KVR7`}77pXd30H#g7w$NR3m
zmVdBtxaK-*pT}|RV~YwX%?le6{^Q^V%aQqt$Mv|UaV6LKtU{&(Vm(7XJek5Nu@;<|
z`C;onY;34=pC&miduEVa*AV#0DLMX-UbO`fghfRt{N6vlpx70nX0jB!J${qhHmVo`
zza8iW47Bw+CmHx(G7I^6_H6w^82-``IaGo>jKm9@MMQDG30dkX|ELN7JvnsLA^(q$
z1as$W6=p?&jk+e(VPGcPEXPw>q!W6ZD7EdLt#VdTu+6ob4>&;2gVXl?353;hj*4Pa
z0Cijj_Yj`!v}AuzFD?2vHhe>P|Izh8VRYHBX|lhT0C67e*_olm;bAT=Q~otf@Da3=
z7Ej@_tPrQXXI#jWPO@lyn1E8AO9raY+`4DnWz7h9$1FMc(+H2Og3LR*S|=iuNshB{
zq5WZRx&j{(kV^nsAG3u?r^W)3Gt>C62sV%0sNn(~sQff7iu+koVSa0-0T%LAw>Zxp
zbuY?Ent%DptQN)1CzAR-zU``du}#KCF)K6kA))X=V);&wtO4x@;M@}>xKYuT1MDQf
zq1cR=F3PaY$;0E$X1+n}9=Q4lgY_ydp3h7ZoN`353>LWFOcUa`am*8y;YVfpwTG>%
zz@wwv1Nf??4kJ!alGoDoP@7G(9e`RjxTg?pF4^mh_9h3(>sWLJ1(|(Kut}WJ&p_IZ
z5$?TjP3=I)qocI;(d-%A96oCQmGJCqW$_dnwoh7qy^?4choI}eA1M)Xm2FNSPZAZ*
z!D$Hur1QS@gnat$D5K8w>BdMsPT&^Q`eyWl^M#8ttjlq86=z>i;zO*O<1JQzB<(Le
zZ~P)bSQ5}cId5-nK#1p^?!ibyq0X|v(4Wg9&cyN_1sX+|IgHpeWh`1D_651jhrXIt
zW~zh6s;>xyXK!pTr6&+4suI@nzt-yb)**M20~a|v1Dg}TW}*5jeGM>CeLB_x^s(ec
zDdJGvHl4ZKq58N4GMu?cn<g4Fk%P(0fYiwToSlQef0few#Ym~uhF5H1r$Dd&qflf;
z8>I3xrDauj(d&Me)5@w#)Tkp_$iw}K1Y(`2X^Sfr-*oWKu1~N}iHOU{QN%Kklj14V
zcq$w0#ImRundQUVXZ42%?$GPr1WzCkT$w?Kesg-V-wtM;f!aE9aJ2$y*=8@pb196|
z>IMAz9xTA3lOe$+@R<?cVODlKa-+(^eLLo3M}Xc}{q>$X!6aqm^BUGP<G+3P7g9_?
za!jv3f$jA1pOajY&Rz&F@^)C*hPyB%Q^x}}M@3NzfaGmpl>ZrcqK`f(rf*`{{YDr3
zte4k%vaZO)Y#>K-zFV5+VG|*3{M|d4j)cagx{mfuvKM*}7UH?$1RdpB_1oWLJ*hs~
zL-HQLLV`<V;>-wW%->(9cm=?{Aho&KmQcB3;WRm9iE-WAi|Yq`<4*OiMr;kpVlxwm
zA$OPFiS_+nmyK$GTP@NT8g9N)(bcsW&@-Vf>{rvC>)&IqIrstmBP)&3Rd4dp{yA&A
zX)%_s^Qxxt;48VM6}=2snEmMcoA#>o6+XWxe#)w%h0P8FYKVL*u=mdJ1>67arC<`6
zIy|X6+Cj=H*i5)XAeFln@JWRlw7=<b!5jFp+@&ucXX@?z%U0+5MVY9#(FR`?z{0qP
z8g)6oPaIi#^m$@L#v*d!$-tQdm-O)+2__la5w*Cdk#Clz0C#hHQx)1~>;EZK$;^kw
z)^xf$=*|4;ab)dhd-GrNd8!0T3q+LHcVqNV1vdNm#_d9fi$$1a2zvMz09J$#@2cL9
z4wV<`E*FGdDg8uY;4lJXD&@DCmV}RFrvH@J9BjENKIXdJVGLfvKoU$AH@f0r`eR3#
zNrD`bos#o#11MoW?KNFt7Cu}|o(J1MDK$wRm0SBm;|5<MOzQaZCi3iN10*2t>LT^Q
z;kXV>SYMm;B;<%OudoT#*Jl<&0ii?+;nLGe+a*ak0(bs|uT)wCwlyhF5^DIb9&tDE
zlEafF+eZ5<24oLs63~Y438=N6@i4NhWUjHGyp`|%ZEgH|g%hUB^e4X>_<oN#E`%<Y
zdm0*99>A*P&i~}6pIOhvqm6{U8_*Y>k11Vem~51tr(2lhRt9oU#wb=q(Fe)HjuUR9
z+*aT|%n6jY@0LJf{?i7v?lkFv-OgBhq&raGn7IVho_xRw&$bEmPEzN)%}i5F@t_{E
z{qw_m^P|FqRO*7M_mt6rKpku`v4%K`86K~IpkTuVM)L<V0bJAVvrOgl;L37XIqG~X
zk=tQa1KyqQ9_}!zWtJOG#B4w1O&&eP6dU9~bq=*p=2!QLLiF?gxZ6aLW$#E%?RbT8
zzk4<$vh5n!<e>C3(Hev@J(&RQ!*#OhjOTJGfxn^QHVuOHXN40jEIE$9X(}qT?5EUN
zGX$^{eE(_e7e<aLus`q==Fk-MRVbHQ^!_wArOt2E)oT68XkQyqb#b7)(w~ha4QNfv
zE7G4uP3vSc24%=bLX5$(<@3yaAHoLkwbpp!^!lv4%!hFT4tDaRNmkzS6EENPwB=X5
z!q3ZY2hC8exVi<rWkbFjAkoJQY5De)fwJBly;~$XF?#@gHk#LbKRpk;Sy@eleIi0r
zO|_KO@(Md&tF9qS`LwMH{fR6xNm~X7;@uBng%SPT=-qro6ga}xvdHn}opv@RL^tiG
z-=aYyQNj1UX$p=3Yd^H?s(|#BGdNZMOW$3AxMQZgg|*y|6_2V3zjeI`d?A)FF|X(Y
z@Or!gT5^b8zvI#fk1Zq;?rJtR#JF3$f5%nCuy&MnD#voIK%o~TEbXK&aUqAfCDCx_
z$fK=<)8i(XSBPkH$r~U2W4aQ{T&6+gkvkiqWrJ-mo<U7wZQk=QPI}Vw9j7>E-db>)
z3JFBI8;pdnM7Nx|r+gK{HC&YZ((6FK`{m|R;;e#1$wItK^v4{PU>rKocxjz*zlqkR
z9e8!_&TlfsTlZ$pIbQ(THvv4#UOU8Y@rzGIun^rcX{f8&3(zpdIsuIG6VJEk%|Jxi
zorLs+H$Ua1(id)sPlLl-;aWk6=n%r#Gq|So(s$rdxSsZkME#!4!w`m~D4m5?H3p)o
zNqHCQK^?e%+lpvnEd`&Y>xioDsq5}@a8qR}cSS8IAkc;ULnR7c@A7Modt%-8hGBVf
zH5_!n1n5lz(LA{NTF-R}@9V((zP^-C398D^9fB9ydlTO^sKQUfyArvWl5-B|qsR%U
z&pu`9ForuuVf`$I7m&RQ!bUW%i{gNBEtQT{5L%MtvYj0^Zdgi>L7=x2y3y8Bmz35k
zPu=;#-9D$U584K(=l+}~v<wvsxlH)zj>Cn|1N67Mtq@1rz1>%7P*6Lv?uzw_6$rv{
z<ZuI0-T+fu8!3h#om^mqZ5u`E8bi=)jh4T4wZtoJz~&dN4-6m5khArxpr@eqTtn~?
zyPCAJ981pXex%-O(AvV9oPlh<#qRC?gkwT^9}P+5duq3$^2vACbn29K+-r`GUnE>x
zyHLrL3poJkgfVIDXn{!Gcs2*rI`aBzTZE*i(B6=NLB2{W=8T)azVd*E?}p-*w5I>>
zM=k`_f$lMG)bar*pm{@wh|30BHss%FrRCV*6WVVAUrfE+x3CS+b|2Z=s|Rw&XzP|%
zB0*P9eO(tIz_zW$D}^}E>pD(Y41gBepQ>~OQ}6|~`3@LvDvPY^vJCKx=$D>=CREiK
z4s#WHTW3xk)k_`)E0V#UAp$hdhYG0ZXWXr%qK<Mk81AnJS`UkYUgW*~0S`XNeq38*
zq}b&}pk3)zzCp!8kH51)sUjtZ?(?F4ynEK-Q18!Y{3(NE3hIp`92lX(1X?-NjI367
ziA1kOaE_Rk9>S(ls;9GN6;kiL>&nl$KtD*|;;2NtpOPFP)Pu_y;<%onG#{oSAKcIE
zH)Iz}rpb-dLjFWj^-%*JOn*e|9)D?>sQt#cFiSS8vh-*MTZhR%H8yX>mM{qDY@#ZF
z3QTWu-pZj82>#_dzD#O@-iq{l!T8ohbmga85w$s^IK!~=Xd*kmUNL32)Z={%8{rYl
z%C&;$D_ab=7N$S42VBzeYP+(KU=?5F9F{OWTHuD?PN=xm*5a(8R&;NQ-t*`<jF1aA
zE9;x3JaO6fe2mqT#>RdqRq*j735BWSyrzj%(;{fIXwd##T`w~R!YnoV#+A?7=5vVH
zEt}^oyh|szZ9YN_qVkSMqLhgY-zCa>cKJppuM)p+a{G-wnh%m7z;!e+4@9h&H}kYw
z73SA>lmxu+p>lpoYJIa{w^*q*HohGp0+cE2TqDb$YPde<KYUH0+q%6rq5j6*kYhS4
z`{q0`6M=Tq(1I}X=-%y|-->MCG!}q2)!v+N$U=FL!+pxLC^<`<Sh;=D&4omUAO0J3
z3;|*bLqxV{=0qJr@3Q0Tpn+yl{d5B(zt}rJNe);)%eYb|5Q)ei1RI>(p&53!TTM0&
zmFtn_XhE0FUL&S!9W|4V@K&4Z(ilvIckwro5qjh1s^qj0imq~$qO=7&MmbokpdrDo
z$iZty!(LZvscY(p^pO1nnJ_CW(nvwv({uKYUnu~B%}f<wZoGo@rQ8j6_&Pu(NIh&U
zit>Xex-X?hj`pbm8GJ4>q7J9qT@P_$56|KYT3L5le~27fYC2Adh63)wxu1=1!u)FP
zxA&O4;Hat&u{r(aa?lb@Jb9h_<=3ERT&1B4mUhYZ>Eqp&AMY_}wI4Y|S4`*}Qx<jy
z`L{nG5SQL%7rh|0tYg|m4^c{wwatP%5L25TY&KPT7~A3_j(Zc@e|?cSY4gKh{$Mb_
zqGY>fkVD@KZc3}m&P$Et9XKnuQkJe%R=+n&gi=*Dp6G;PU0pNUWx!P<aiqs3?S64<
z;_lNxcEikl>9(iV{odqyi&uwQ_~rRgv!;rAqrzb>jGeR7hxEPmEp^i6KAaW_SY`e$
zdz$L@v6f8xGCPm#%|q%aDIS%T<eGemOIibb6VHP7K7-8%fyuhd#ePb^VpbKYA=hz2
zFC??(SFp%2?c_gilL{XpJ4FRu4C5O%;kqvdO&bcm=!Y(3BKZA7RwaZW69tvEagFpy
zO3H2BW`^nv2Yv<Ke~w$RD;Js-x7ix_#~s63n=ERB92j*ekIrs1bboC$%8%4_PMWz<
zGxF%geA!lok%VlWc+}i23O<k@@ySJxTN9Br5Sd;x)2xb);}gEV+C5{30{YFEUU}i?
ze95WDQ>-3*%06k2JY=^Gmyirc$$`^e1hqP4>({Q)X`x<u)2svrRD2H@80o;Xc)7(E
z-RQBz!urDZ!W8oHM~=Hmo*%T_soe!#JtX4kDg1zyDZ8Z4$6NN%#ZSnma;+w6y4}^z
z-ZwGC!)<V8k@7Q#Yi>aMqHGtX=6?Bk*=0=ls&rd{i&RnKCmqLG(5l_8_cP#a6WQ6)
zqoH4-15H^ti$^C;(T?ijqKO@YA+G*Fv@44{3)phUyI=wZ1YdOJbo*@jHu|_Oscfai
zN7IRBq7m9fFF#I<!*Kt)p^|aPe)dNQXVV~dW^)OHett+@nn{yCmj$v!&gkYrJ_2IH
zS+PTic-o7zFd|m$Ng%*s%eWQS1do%U@@G(ddMR#ty%wvcML2>1rGONF5Bz_j*=khY
zKg_m~IRc}_YB5#a0tK?feEFdDn1JoA9=w@WSp0*NqX<?pXuy5~bU0#mB_EpiDw7_5
zDhTUgC~WH#th_w)ZjPZILGJbPZs%r=@$LOjGAA~cN2ns%*0U;3K#=$eC=pcOGtp6U
zLtV#ayrN=MmB>JrTJQiK&dQ6JPFd3GV{_SC3@OoVfB%W0;^}+{;c9*{B#Kba3#S-+
z-~_EKi5s<N{=*A*{<YvGIg2a_v#In1_mNKp^e!PGzS8@erS!O$woZf4-qdRjq4<|t
z$sVNc9{zY23$NZC9LzCYqNP_G5nz!e{6z$>Si`16C8@?17e;J$efi-#@7J;Qt%-`n
zzoz%3fOKlo(P6oI%mJBuXR|Bc^Pd;L3s`vcfI0c%88Q%&Lc(M3&TmIoepPhn-hDC2
zd>$AI6o^SefZA3#E9&XV6sZ-|ei<za(zAIQLGLIAeXC9EXurJeM0;)G4kq=j%Zec*
zGlITNx(Xug$9vEV!C3xYT9LF>GuZV9mZP>7Hoab`@7id4-@SbxkJs|gygS)yqO77~
zc9oEZs(j;V{5Y+qLeIeQ()^F5y%Zf~V*Jeuf>Md5HtvFRPUTl8)`SD>m8;!jymL)I
zx+jKWAu-8wa+!W7B7R5g6!m+<Z~o}EaftjQw?n&a_zHJgi^(Bq?4)UuA{8B8l9Q`z
z4C(@5SMhI?uI+b4HZ%=F>c#kSnLGJKX7zoM?jmbF@WM0H&MzvQ*&aVt+8(p+HS4I)
zw14OwZ?-lbPWiW0uh-s7Y52x)RozfxiX|Cy<cKzse%cWwj4UdNsJF>fNtaJ^+!%+n
zohA=BvVUMDUvFc4(7cI$_!3oSftZbB7ih#K(Ha+(j;*_!ych3uY-92!_vWaUTEz5Y
zM*3e3S7WgL38;&`!TnE45YWIHDL=bH!)Yp~qjh{g_ebTO@8tUKo8D0tJhaeh^X+*A
z+F%`+(L+C6OH%A$xUOh(r3%pyE_KPp@HJ>10UW}|De(igcO!oFO9#-tPR9#<@!5Vr
zmrqH5^UqjT);IhaO9Ml^av&BL?MQ`=uzEZN*h3)vUWf;xYbf(qh5d@LYutkt52ovo
z?mM??<@u#`@ZxND(9PdO3~F-_!st4Y(_7s&vuL@JUeId3pke45Z@<HY{^{YM1~#MU
z4OV3N34F0)!WcKF9Q5MmZu1%>HyR?V)fp{5?2?WpSe%F{bLEfJ_c1?Opm;N&37LGh
z*TiVkcN-`al_C%|WhP1lJGw!5_5u52@hOluOj|a{u5?{x+B1qGG5B3T&@tDG-~VK;
zHIAISO|c+)ftYz4eY6qt%|SJI#7NdX<X|eY-(ElQ>7j&Xpq$nrqOa9;XJ2FUevzd-
zON^{WkS+S*mh|4e81q-4azJ_c*B8%V2jA*_QGK`mVYjw#Q2JzsE>RzLp{MZ)7{VF@
z-=fVLD=Doi9u_o37~oNO%n!B*{O#)h7cc8g1jJ6i0ByYTcnZ~)N`k8B)4crs-(CRn
zJ*3Ky_p;e*xq-=W+?)0Cg@Shhz3)}Ipm;dWpb7PAk!`Jf@6%~{;$=3@-|GN>3>54$
z2SxbC4HPDyJ9v=~*d_>Rpsxe-RT}>_q8u-L_SSTR0(hV7vFUsj<Le#uKHhG-NNHL2
z1qGV1Bpb}Ah574DfG#;v;d2^-#iQV`r+S{eFYRC|tYm!hVFQQk>ip9eJ%tXhdE@dR
z53-SWH-76i$Zez<)u$GrYy@v8Qm`Z^=X#<*_jD>68jFPrwOY9;dl^P_wO?DL0fW<O
z&&28YD8Oe6qJHiSI#kq1=Muz(rL5WFM;~uD3V*bXMaX#zG?A~ABq&tw+}1e56qpiV
zwdRp93NSC(Sx)(urvSdyZyPL3$kKc*a2hZ!<4bT0xkD7OzwklfP=fyfiRBTUk1yGj
z&eGH-y5v;aNjc^uSaP_5w^mO#;gL<!uzjTNXc`vVm|1%2HMVj_t^^0uxC+wm)1cIW
z1N8ffLXzR}I8&WR1_3siG@h6`OeSYPgI>9)y$}sBA@@6SA$b@i@sSDLDZ%R3dIDpT
zm8;bu)U&%loEk;0=k(pEss9T|;MO<G@FQ?9Yd5sOcKg*GFE{-Z;pN3E@#}SK=!T}f
zt=t{ZKAD$VnJRkjenCdZCFMol<VV-fs3uAOmV)WhMo~lr9Za*v>{r-*l}}jsjf@nJ
zm{bx_moM+4n>TGf8P#sE%wf+r!;iD|Pg<MZ`WU{egT}yLHI3%NJE~CI9m#=0#4Cxj
z6W45lZd-Xy2p|hk47DBTO<POc3jo<EJ|63?(1)yRo$#UtGszD2??LnfNbZ>gQc>_T
zq83`_AF=PJfkXp#9gJGFwynr%w4tE-R@}_)(BrYaZCK<$#~Goe82nDq7ZUtMv(d?i
z{@8c`9pukCRee6#H-L*n9h{~ZQWCniz@l#MUjF1K%;iVwTmJ3H+D}-FCo`H@_}}&d
zuC)dW9P=-Rq7@0c$Si##Iyw7?_mEb!G{Cp<lqk=FfN*EwRo6{J(umMCt6a8SdBOEt
zM%BNkKN|b<4EUB9F_IdDj0CG?xEs`vy(W0{0>M;*dZjx0ZPoLiG;AU_*0dK>W_jjr
zf@_yLB(9k-#jn@?arM)*jN17TGf<Rpl0>=ruY9iG0u1PgT!xERZ&8b?X?lVP9h;a$
zo6H=L`*i0U1`V^8u&L|XKkwt!EJwemY{#G&d#H=dFI|ch!I<i_r_h|<!YvzdtUdXJ
zm1rodZCRcQc$c`%E_M$=#K8=09E53~4$`j``TH)V#jMWf=`HwLo6ja9hveWZa5a4n
z;6Z=BF+;6VON$?q#jJT%J*!}k4-U`(2r_}l;vEb<kX9}Ul|oks)g{@?{7e;AA0AmN
z)qGb-^VL!ccx0rohICMjvy<-&p)5XJ6WiL5)2ZPW)A5rRJ+Y$~7Y&*2oZ;L$XcE;Q
ztz>+DFsPaVcOCL_#f-DM2H#oylqE_mgCrBEU-<P;?rk1OVyAL!!T2pA4Gd#_uUgga
zM)0?f=zpA?N~hp5{#;Ke`oKap8f!Y%ZrV>?jKV-VX?L-^p8XYuhk*N16QwSpv1vH8
z&A)kD-YlvbAMw%$xKiFHUv@f3vvMeo+$&Ty*y&P=$4=>mmI%>6w<Ta^mAm2?sq-oz
zi~PA=!h_S7-kzXdJDO)uhiimwx(kPuWs%g0j>V6If$r122`QO9@3mW^?o~^m)5JWv
zUSep(?pkxG*F)im^ArfFcR}jpM<CM%B_|esoEAT51hS{QOV~XPSHuoHTN!+3!P|Bq
z5JKxVKlgdf_ho$(wU7|wX3p`Ep*u0Y_##V9Vc_auK>^J&TLC+S?W;<99K4fX>8&sA
z(`oEPueI(9+bjCB6?&P{X+H#4+PQSYT{a2>DTJMiDifRo%-ep!j>)psa}DiNZBt!u
z9eJM4Iy2xryUH!H+ov*LrIf7GD=&gF<XW!U?um}_FFiGf-krF@k{j|FzqW&uXS8+T
zjcImn$%g<caFEWwy9Q}~u^#!+CH{Etu*+X<Rg}^OWvk<)YqQXOXv=m2mUe=2&BM;k
z;m(8(3(*7zqwE-=Geko8lRr8kxeiX&U5#%|=zQYHR2qtf(<$b6J>aWbxo?FgfC>`9
zXi&t{emu}=14%YySbCZ)s^bhBsamW>cUX<m9?^+C<>-3upc<C;IL@yq79x>O2b*E!
z4SIUXWxg|Jp_6f~^4G`{LRt}>k8^CQx^EiEU=9=5Bi-7dsSp=+4jBqmxV^Oe`dtYy
zaH*AhOz}=Vpq`IMph@%;r9hsMDo9Wuu1Q=})NoZ!_~k-n?Vp^3&238jQjEOl8h0rI
zoTt1@@pd7>sL9A-CAif{w@K~MnpJWEX!Qu1!7oa_W%y_L!yQEtOz|ZBjMfMF6hrtG
z<iU4NXs<QuJFAU2>1|Ttt5~SHkate*ZrxJBymKpTBj}XWjnx_Kkb^(VAEGbuu`(WP
z0P*=bKZ^i}TEQYU6Y||GJFg-uo^FNny7m1An2=c`Zj>{E;V3gbffMlQ;v>ORlfvD3
zfLU06x8T0LqA$HKy?^BGz3+idHOXBXRNA)^8F<ZlYh`Qjgm(qLi8w`<@&o)esos);
z>t}QIAZfh9yR`vrgj<J$EP^BLbaYW1T^PL6erWGCn6o=uxzn}JdIX_D9B)!co$P0P
zJIv89|NQ}uj5OGSMe38UoZ(9V-~yP@i21}F0N4tO-$|g%|IxIw)Z5|b&=5StVIsTL
zv_~@VWY|%t)xlMHJjSX97EmHCF|5q|9+m8+8sy8$PVkJrOMun(@dv>tdo9JyzPad=
zBWa&z+F5lSoAUCL5@fR5u-dW10ewqBIP|vn=iKXW&O8L>wo8hUh*~Rh-h<p?ihaN4
zO|EZeDJ|ocWuF^yfs}gZCb{Gn-~#gXJ*{Ml=bYi4s5C{UEoukJ?DDz!n2yfM)mK2}
zP0dEkwgEubZ4=6;^sxNuJ<enR0rI1{pT7-xX5rvv&k^~8%%VPgz&=ARhSyU2l&IQr
zJ(hpo1ZkOFIm&5w8`1arIjf8OjBU`O!!&OVXh2nACYzo37Qb3lSyID$?K<|lf9bj+
zIAJ3M>m>+9Ox?9b4=jherKMM#4?!b|dY!$<+Om${=(bLdjKz4D4IaQY6yJ1gD@7ma
z7rwU_jNFPo<~<UK6%~6ZZ{~6gsA~+al7;F`I5ju?ns|>w=uL*b{GbWH`rDAc)5L0b
z3f~MEFg!3W!>1!|vV;0le_F)81a+~jnTz=3;qPw~z}{zppcf2JOmQ8VBbcQ<v%WjL
zFnC(la<mqoO=Z9*xXvn#NrHuNICr@#t8>Hp;7mv>4_z&$rb&29x}d#jy>f5SzSVZ|
zr4PR&9pVEQ?kZ7aqFG+~y~E36?C^N|S0SP$mB2J-19X_*nr)dcXoGOEYkp^a_KL)9
zHds2kQ|-bphTb23rX=JVDNT#Y4cSZyPCqn-Rz!4V-el@a##tW<@;_-Ew^}Hy-Px}l
zq_ey~$B<|iKo%O1Pn)`1CfpQsS0ZU9?OD{T_1cXZZtQgC-n{1H-#(gqsjn6XJI>3)
zqp&!=(l5G=iN9Hr^#A4ZA-5J_t~%BbzC?~+PcHdcmQ7vdvYxy{uTm7}u$&2V4qjvk
z44^gxO)__JDz1h;9p7fJdI9c4^IHsMu%oq-j{ziZFia8-(XIH5(BxYw>=F@d4JE^k
zM}b;22H&L$vwR-F04KMRr>~ssBfBbI5prxVba8cwY@0_Ti=X9}1opcy@PJ7dyONM!
z^IE<@ek9uPSDdL{L9Dsw%b&tWIlW5^6NHDsYmd@5C$!~WHv<ljAHEPhsPED-hRwhC
zn$nfgQl#--wWyXJRb5wUZ!&NrdOcr^IALX5WWHX8>lw+=ELT(<9eo?VKjv6@hcj0_
zg1GJ;M0%NqMnvDXy?i0wY=BB=s1L|@){8I75@+1|&d)b=lzUOnJqC~vHVFcwugwL9
zl&QQK7NO|`I~#sjw{$HM{O|HEKDpE)FFZ%e?-pizg&7(YQTDBk$HF9G=FPxGJ*qE;
z3HNF(D)NI;X>l0l7&2b#QU>jZ*&~+C(u)OCYdYLtL{LQr!mIR4zcx2n=wHS;DHtAM
z{73b7hsVFtjA{*GCYFgFs<53OMw({n<VOHzX#a8L+UPn^QCD0@kdG5U`K0E`QsDm3
ze9_jY6)YaG)?ew!a6N@u=N&%9l@h1TS4>(hZ=|X~xsV&~Yu+dC@+7gcza<Yd*njIS
z-z^zTntoam+Ptffz}sP0{3^PyH($Tj+$Vhw`gVwr%lH<NK0|ToJ7C1(_Udv{4_?7J
z`aCfxxWJPT$ZQhGTsjeT_;C1AnmU~CG{N$lcX<~<-)lg3vL=Jg>1~K%z_$Pnbxo5m
zuAx|-R2Fg0kkb`?|1yR-8RA6SNc=D*xt0VGwmf0w1X@?31(tBuj5e##jXSd&go7Jp
z+w$An38z99j*EA~BbF?ligmT{Dl*dQwz1yKJzSsd?)*$PwY$UB^@vTjknsle>MB%w
zTh1W&V=$IDjM#rYBRPN@D1ZiZzsVwGcxyXe-Ut${j#ssNkMAtlTahJ8tZN128EtPM
z{A!oNEUT98^;X!M4ckEz@bTq)PHfuBOqkZo%#RG~W_^1V6zsgzr3+uh&U~~%4wlR#
zA;R%z@+l7)CU7^;$VxMgIw9#2pdUU($zBQlOO^2r1+MDpYli3WBfv(M1&DKdf^D*9
z7L`$p4rS(9$KdLPCe@z4fgz_>7*pAdqI0i7s_xK#l}OvIsH<3e8sztAuz5!VQT$zE
zdXlb%(9ri9PRKDs>56QQLC_;u?O`C|bEtyIaQ}iJKCp?9o;Mck(2l)U8oNTbVq6IN
zQ%bJ$D|=kOE%>uUGi?&jGjbGnRTNkva#pTZ6(Wz5<L&|Dt}oGZ5h%{y$Iw-V(@2x}
zr97n(%E$(o&Ztd%VQ-c<bo5g|VXt3q_1?%!HF4y!JY-#?bj&#h72`%=D8nyG{VH9A
z1p9ZHL+jhBn4HRPz`PvOJ<)kHi*63H;6sYh+Bk<?^tB~)bF{n9;2}YrlV;!i#x9G;
z##OX&9AVSklVTAuW4K%kPEWH4Z5fVUX3DbEr49C4^Q(Q4<c?Xr3W995nmq;$Yp+x6
z*N7b<FrPAI=<nF8BP}+!6B$;B4ejeZu#L-dW#h4U*D6->3Pu(gdLQW7wlH?uwB<je
zYJ`;Zt}F?+>_J){+H`I<maUmlZdpXqoGq#oV<f?`PxA2Sbx7V#j95)nZQ+YAIVXL(
z;9*PBd?WsF-=2Vb>vWc!DOyI`oeQRQJLHejm9O!AnHd6fs)aPC56IUts`P*4D!SKl
z+Bv_!I?RP97JR>-Kxpy;-&!~p^gyKw#;+-p=!M1KQl!UILW66#^qM-K2Z{z4<n}~y
z&z?(97!aWEs4)=pbZ%;wT(fD7n27-mlF5hfH#3keXR!_Pne3UX^U^ZeIliDrM;VXR
zugOl1)(ax<?>p}-1{d<;YDB@PkvvebVENp8M-2MtUa`Bvo%#X`wkugRKng$!^AytO
zoYUv;F{Jdp=b>!d8NWB&KK~$pVgGU%!&_(?p-!3g%h?hU<TyQUL{H|gBAxpYKO{zf
zYnQ@i)_qRh4|d6CsPsP}YvQ>k9F{iEs##U(FlEHg`+16A#fA~b8K#QBW<!xXTYp`g
z(G4xV#TnWV!m0bY7tgIz@F4RNd;gn(enyD;DSKh&?j3R}vSgL;HgRZvp-vk{VYF%y
zr^nzY(N$(M(?(pSl((nC4r+Ws&Gjg$HTv5>Dx1Z&@7`FJTrOJ6OC)tBB9Q4=c$t`b
zPG%;S7zP+G*c}3y)P|MiXv;Wjd7&vUQ<hwC^=XQIojyP(o>)$db2-eiKxGJ}QpYp6
zk~DVabF>67U;aKeqbz@Zu=VQ=YOZ%3V;Rbl&-~oV)DduMioqUQoqx(9fs(nEDd;W`
zZHCB!(>-e<Oq@_g00Hmy`{_?<(n-V5>3qYmwPdqPm|X7UrqS0+9>$VyFQgjV6`HdA
z9kKJcgySWk6zv(3%LL8uR+$C05KyJ_s{+_QiZKgKC8~}bo%X3HL~TFuw+&whSkOE>
z;O&8vsqRRqA|+Pz=ej|CHzPo+6FRD;IhnmWh$Z;D>`;sX7gVHVWo2p_y9KW*@=>lB
z_C#c6zxK86IZip5Yq7GVpHa3uIH!E$B95vE*d$-yqDU7Ags2RLWRmb$xPxyE`oft7
z(D1g$nt6tmOt`zK7{%2?Z<wxQ8Fxe*$=?zgHUIkkDxg4lANmkbw-%0#TCuF15rDkF
z^%Cf=yPj^*?_n49BO+f<)!UP}i{kHZ>n{-7^iO7mcGFE1kE8Cq_nkYu<k+~UsED$^
zP&%^6g7+Mf3X~6gp#O6&RHO}1F!Oh}@G}p;*OEvbvLH*hrB?p|oVL=_gC(3~>c3w-
z?{6{#Su|#nhuD1~UKajVp+d9E$A_JoWOe<@88+_^H7iDf*{iOmTOfm!7o{FC^K4Sj
z*`1kte;zaOG2rEU#X#lEZ0E1*XR_o!|KV2=R%<SaCU&Y3Z)XcSfk9K_Xx&tMFUlIZ
z_G|($g!G^cBfaXp@_`E;J;Y!myqaUK5R@+8hg038D@8Qd?I+`Mn)zSKQ=Y{&3s_Xn
zHsX_gSuh<{A|sIb5Pjx={nr?1g6x)wDoktOa$Wx!IQ1{bBj-zV1Aah`Y@s_2Z|v{a
z^h{-OajJh>VQZxjD<r)3a&b6Wc7*qz@~%Ih-$;ac@S$KEwY~eL<0|GSkC@3E6Yif=
z7H|Q}mI%CR@c~$6%BJ`u=DCV1=eSy69GF7E^1%n?RE<^LI%MaKakDr89fIu@wTzn@
zc^=UX-?c4);vz>hS~?wcaDn<h{n!8SmRFn0By}^qoC7OA&@I=)DvS0L&a2dU`<A%5
z&rew%nfie+>jzltXKA9pFnqAq-~aaVRBm&=P^NX>tWZ?=>shnp<S57=(LEowKtTA(
ziJq&QkUu;UZc0^N;NlE$y!iK({}(11<^w*P`;NPzPUddB^{j5q?o5$x{K8wUb0=~J
z34Vb*lEOy9-<R-*xSz@O^FFdj5g-=aH?UK09x_-DpEJ*k?Eab!Jp}?YQjfgphk8nO
zEr*C<M{Q*t&5yi0&%nC>de8{)poY>v=W<EHl?ZLsDKOOosnw@_SN}<7UBC(xOOq$v
zDAF~rQfw4tmP1><&&<_L6MD9987G&m_Pm>y^_=Gdi`AP%!?-D@BdYQa%TR?qYoT-P
zxSBy0r@g&BSvh7~$*3;q`JeZdAfiN|fwovlRE>$|?EIj>FWszZlQr~|*%9@Se!{k&
z&+Vs9q3LFbuihYp8eH&mlP%68(!sL9V^Rbh=6uKLLl%G=g7qyjrn03dBA`?gFe<eu
z4s|AyM|Q8h`e&gxm^EQxVo%;G`^A;8j*G+gVo}EHRad{|0H2sN*@XZ`?`KBmef`8#
zqR&>Ip{sSpiv^9v721OVWJ|Fr0rHP5q)R`NojdV3FUd_6Sx|@NBsh-v@*&;%3gjZc
z6e{PPq;}*NKOS~eG1fA((Y6AFNh$&LNDS|QvyOQa^t?ZQ;ZixS?~rPxd6cI4SXOp6
z<-1TxJxz;#y)^q6-jWb!qI+_*Src(nIVnf>Q7QD{_h{2C+JetvGC>jEvqX+`3zseK
zF=kQWjA`mHL$BB&|E~DL#0IC#Gw0vGka;njokhqxG;a06w~7xAia%g63uNcb?XY+;
zl}8rZ*r_8Gs)j1Jx=9P!c%M+v&%FwerG%+RAKzCoiAj~smQ{$leeMFfcJEh>t~OA=
z3$tCE;LqfC4ya##(ifg45?iAE+p{(GoH{8*<xAdz7JTv(u$w?a?;rDNGKS0XOO&A1
zOQ?s+`A1?VR)zhV=~!rmY85<WW7VtILDo&H-13|ejD9Cp9$O-e&FDe_gEu^%-wRoO
zUHAh1${;S`S+Q=UFNFBKz45J><)vJ$=TRjV$dOa67)YGJXNNT;?=|7(#S7Jkb78PY
z77H~<s&j6s7-2w=?Z~>)&1z;)*(5h(O#QL1{Ancgs6~Na=zCL^*TXLSF6=I!Pj+)B
zlP8IY=Homy=hJ4FHW0|;aiq+Kx+!h#HI%MKdF@Bk`u3Prz=T_D$u*K&{I|~=FhlxD
zL5oNU_8qFQoLdVI!j{P$w0MZpZ$HUcDuGnb*oM=K+6OkS-Vb1PoutQd5^)k;q~)v?
z+zD(eMeMx0*6U7atsk-B<{^6QeW8}}V61NAsym+-BA;*XsLnCLJvC~NRW@R}DDKdv
zq4vCKoyc)1N*=jper4<QZH9iB2Kxtl#h&1f2P*WjQx~u)mO9{dm~asj{ojV7ljtOn
z4`7kD_4(R8s{1Z-`SpXJ1>>0>`|mK}?&1FSe-(*e-Rt<7mx>H-Plf-fROa7O2{!mG
zD@WM8UAKLQsIiK$ijdQv`9$1kAG<0Y6FVw9z2RdDa73AC>alKzW5R~Wgj>y#tNKA+
z*jD9_ZPno}l0QG#N3HiNs5^*uoJ^s^wj3$`{X_L0$3{?*S{;i|qz47QY&@JFT;H_7
z;a=)2Nns1#3*P(Q=y&L^1xFHxuz$r;>w0>*D8ToxH*{Rl@0&<<1s}dWwouvS=)ECx
zzm`=<A^b#W^Un{!^PJcj?e~t-t}EO}ME?7S?nbWav7XAx4PonD#i|dvmmY1Y#EG~n
z6LsCijwg&KL@C`6A+PAz{tn{X@i?IyVLjspCg!$W*x#Hw{fQqN1(tjzh+ob>j0{#%
zg-&jQP#el$<UP3zqJC?Ic1QSnWYwQ&+o+yBnfVjfYTGKthS1_GxRL(3ky|_3n0Q&6
zgd9G^?h=R6r)i|o*@BsJbbZL`8r9_gajLkAPEv*az)4G4OF4lCD^exU@Z%CX9R#Nc
z5n=*A7z}DSO2k^9WxM8g<wyQSS$=HcE)o!-L)yI)Z5zsuepCJ4$3-Oku6#Rj<rreh
zKOq4I_&=}w&xjvh1mO|UOQ_m&w9e0*>K=yFNLMY0Sqj$QMM00?V9g1tAJj?X{C02L
z7p$ViL|Z;0Q9nt)pthT`Mq#%WdnpnV)%!nwSa0BN_*}F7f-oIFx%}5esYb`S$GPk3
z`5sE1K0Pg?+Y1yL6dGimhRfB)(bXMwU}EDigZ3+{rDDh$jT6KP@?+uM#=Qx-yElZ%
z9maM^c2AyskZ;+J^Hi=OQbEx);e6_o^CS;Wmy93L`$V*~-b8zH@kAWHO6X+y#xiCG
z-sb2t@#PbiF$2d${&bDLHERIn1a*y|tK-4?FGLT5x2ZPf-@my5ad+IT{5YZOTKnP1
z{d?{sOU!Tm9=qS=*aTPX@nw!!B1-xF*2nFtIqh|9%=@JIMfkrB(s9B^*r~4c7q*21
zo<5^{Na5iDzj1OUxKZ+EBvV1z{Uh~p0}wOwr!?D@u@iH0sIkd6X5(Fy|6XyufqWb8
zu}4iOth0`^|Ni0j*kq+rv!mxi>Kjq^e-Exc^u&optmP`N6p?!YB-33ht?#`#^0c6X
zKOOrX7*eSVB9;}bZd6GNGLCiFBAn!T_tqSf*7^c*#%5997=(2EPD(D#oJ^mv%%4n`
zPnF-FFaI(DC7L{$0?|F5IJE&Ct3OhT+Q8mV<=nWofj{y5ZrxGKQOgG28a_%_iKY6J
zyZ4`v!VSyP_gj`|ihS{w`TO8rDG|Q=AS8cdV@n`^+_|%BgWyogjZ*7)f(sM}u{d}U
zsh01BCLDeXZ@?G%?f3Cn|H9))A<-qG#a5}v-yVUYNfHUybhli?7Eo`^-jr>PZeiwj
z6usI`^)JQ~!V|&?x9ssOC-MhvyY6AxdesEW3)S=0mWTV%`+*a2$Lq6>CO!LnFwv8%
z|BB1CNYq%(^ob?r_vWkhHpf@yk1MOQD$+^<$~VpHqEC>Q39KjiCxsJf|1ZI8AsPfq
zAD<|`M?!-&rfkg9rC<HHOyh3I(sdbxghUGGhJ;Zqq3iyPwEWhn+8(?O?6<$;<^<dJ
zv&%NfM?cK`boALEz|7>Ggq;MN0IqPf+hqA%xkW&iMQW{jQQ(C4F=W>9WvaVAYq9Q5
z3?|qLC!Sql9!_Lhi#6<LJfa+v!Wyu80@ii%3~_640^Nn$gM|+Zo(mFSdH;4Fva$)Y
z6CfD_JEv<rVHrE^y3qdpOF{@Cge!RwU-Rh(58L;n`XiP0qk4EfT%{c@0lKo@yeoDp
z4&qDo%Wc%y&wn5O+7=Ht*g@pi;CC!kX0z$(VTOETtH!c3fv)akp;AeF!XFeLzQ4n8
z6gDudwtNcz%qZkU<3ziN{eO!Oi`ZFNX0KOXEy!P|$K#?~S-nUMO9hFjYQQlm`#}oM
z;`R;5)MeVc|NlYJy|aP6K@CE;x7N{h|6nYZH>t74>v$|2MYH9`(zTD9H#a3yD-R;C
zTGklRdGs9w=6De<tnrx&IVSZ8`e<2?E%I0_!N<Dg&*Ag^h-mLxMRnDo&z$}EoZDDz
zLM`8ci^K%_!%}1~RhVtZZbpDic>sL^KYbKe&z{3BktgPm#zaT4sA=9>+C=JKaayqa
zk@~wN;weJoDWch>-bJETytc*BbK}X~3H<oT`ID;O|2Z+8w%41=5u>$_-An&-Vluk%
zDPNRvXUPAlIPBQ(--llsy64mMEspL&{=tIpe@4GS3eqd8s&-oE(h4H0ns|ck@G=Nb
zvRcte;RO)-n-lQr$K#He0Bd%A!}ZVU0ZtG`G0<X143TJ6|KX_e?S3o>*G5FwE*|T#
zn*!KKaav{cAesez4>ZaeRMiKEPO~}+jL^uGzH{&87je9>w2HGhfgqU20$IeXTajZp
zQfy%$<&>?bxllY`Cdq`i!Esh-@&}c<BYH_Lm*hD{N7N|52y>~&$xb<$vN0M0jb1#W
z_)euQE}kde0w}|i8;b+E$xGwKa0z^)UvRvhIJ`%vtNe?S_<R98=Vaq|em%N0R-qM_
z5!3I7_se9IVp~Y0L;QZM3uGb~Ufvo`cY2gr*xr-c@1G2Xo%jDQcyM0=B|JRYd8738
z;+dq*^13%o(th@dUWsE~qdAW@0=FgcJ5Z*cgD*c9`7=S`k5N34+#A|-^?0jl&42_h
z6U<HH3(fa)@8n_t3kRH}VO*F1PoKsm;dGr&D11JNglCj_;5^(-42El0cw5Oan=D*F
zgt-HxH}Nd6a=R8~E~AlE?r1PJ52*!;xN@~iIdiilAD-g|iTTu7y07g5xBCYmTp!8V
zANKbb!+i29UbFY+$*o*xVzf)*e)eCW>33o(e_`A9F#3_lpQe2II}}Frr;llkJGrhQ
zbaINLODwd(ZAS13^1OO14F50x0{xD*_g$EPqgKn#a(^RfD#_APTMqdNN87UGwQfJs
zbL_9d6;l!K(l-Gmg=`WiOYpb~py*W6J2_<|)Y2g%Xk@XhbnlZV+rj6(F@RLw`wt2L
zxI@80nTd6>wL~v@(lN-nxPe#;4!5^_7@lItJs%<kOcK3YAR8;XgrrF890@dA?yfGh
zzZn@C^k4oO<5zRdxF{}1an&mO6*c2s_i7a+<ACGVKwJ?I?t(Ovve;S5;4g@C38!IM
zGFvk)<E{=9$jB_z5;s(<JbN0Ty+uow!-dk--l`*d{{@W2W8^T~J1(NTe6*iyiVa4v
z2-$c(?n;3H=<x|;7|m>9tkI9&IBR)hF{e(wxP0E#k5ulCniES!$riaJ6N{)p=U-sj
z-!5rlZ47^DccE!2aIOqLxzL>Eo!8wx>mSGT=h9xvLeyPFfb?eGv+MbJH*@z(-+rj1
zTqet3$cPWqHDRf8w@ca*C5b%;Y4eDH-ieg&)2L4WE`I;>Q3nICG#)%snFbyj_chKI
z82uR=;K=mKn~7h_Z#Pc4-$x!G{R$R;d-#7t7noYf%ZF*tKJC1HvMfdMrylyg?315M
zamMFzn?O}6;k0b!&D15Hsl0R70$V@{wjo-49(i^V<2{t|T^!n_@e+LE^CA2%{O3GF
z4hMMDbi5h?yCl3Ce(rPNWDjFGjE1YfXL&?`;+DzsD#9T(FRv3n?BfJ*^U&FyO%S!|
z*(stN`k%oyAdI^VP-L`#68ccSs#DeJ4KRbM><WALuXph`*PL=drgYair?0KrNTOB*
z!L+%ZlENl4B9AGh3C5VYSf4+aVYm%=3br5a4Is9JY5%8}^G9tO!ztKv`F19G>ZLHc
z1qSUHdqrD`xpzh^bSzw=u-bv%Auz=M<50*@QbcB64wu=uug3nEiDm61{agpGM63|I
zB;_S>@I9P=;%Reo=KZk5>G-FkvDgdmyEj;cp8xLuLh}4~#~0W+1IBHJL142Y)CLDM
zFQ<mFsm!K?Vea^+{BxgpOo@Hc`kt1L?#jh-kJ0o6Iqxm@eEoj=d?2VB!@9k-S8Ua1
zYSo{(uL_ti8VnP{b3PNIcIk^eH%A8yd6SJ}oJpt#OfAo_kmyj1t^Nwk5G*!QhI0>7
zV2ktZM`&zPu(N!5Ycfgr9$JO+yeCowWi-Jwzn)ezlO-}p%q*K{gqB{X4&WArA<DP3
zmz&E#oq5zU0J*kWIc=5JInRjs|C&c(5n?&NXO|@AdR&V1bmz1Ariyg``|<;n-C|L$
zKmcUBAKnMe{A;zeMLgnMk8>R7QV`iJsw4qc9o$WXqVMmd;<-Rz1pj#Q7g87>>duPF
zckDUk%aU|Ma-V<uN1^JU^_I(;6av}#oSbGWK#RwAK;vVK9ckM0Y_&I$b7JRZ0l>-x
zL*mM2o2|r(E9k)+hm9BPb;9vKXTje;^B1nsp`W?QuDANG;+V1<fZV+m&&_%(<jfF`
zp}^y0xwf5^y>_`1nJi5RA801>RgiNhfAn`(0nASNqLB$a@l<n}@{*u`zfX}Xz!7Kc
zl76q3njuR}J50Ni8s|T>Nyh;7Pa#TykLzfoRzbsUdN2F*t3Wp>rTcCM+<`Gpydh2x
zD9)LpVu>1HuFPI77=8<8y#!m2ICOH%d4+nu(yI1jHTzhFJrB_NMGZU0<URv-wFZIr
z7dk=Pm0v=<d$^7tiU)x+2DKXlfy^A1{8^qCWM(&Iz}b-X;^v&SVrweN{ea~6)Gt9<
zu*KK|({jTWW%wLfvj2n95og)L{c)FBUG(nYX;;<3kBPC#Vz@N)t@1)uo9&%{j3U^6
znj<k<Hr2PvuNqXs?VlAyK$U8qJn=qSn@izm4Tsc%%3(>Tij_{6xMGJA%DWN6>G2Lp
znnvNz3#ip1sz4vH&!7=Nw20f`jab#2KUDGlNp66tNxCE!p%Aqbe-P|gzMC?aNrEqU
zhy(mnu$VUo&M5}{`idBkVqv`wmeu!!^O_5wze2TgJVUNBgF@jkD$(Ox`#Zq0{WCPQ
zhG(Wpc;lU?p-H+tbw`Gh3Ax488cXM<g1vq58;rYjE9*WFn9A)o+~@H+VnEdXc&bIy
zF*0qrpidcs&8W|G+hJ!aZ;e>8KPc<jhF<lD0Uv9{*LPaZ+fBlu|2ZNAIUvICpqgHP
zIV2l3Cp>~x3@k?oyVyaI5aW7B#pT}8K#GUcq$Z)c_H4lN|5MHKZIenihz!Qd{OO(0
zKUFg7`fiv$Yi6&_UO(HX5pEwb!v~I3C7Xn@+6kOSSy5Xjq~s6O4BDO!XF4SG(YGXY
z%55z#M?~f6R^0obk1<M~kVkhuD848k0_=~CxL$~zN`eX@qmUI~#GaiAEG&T&%H+tM
zZu84m39RRIrH(J3Gh81rD?2mTX0PWY*iz;((EHmn2-kScwXG$Rrjx+7>r<~kis6`|
zOwaWl=&R8c<QjS{VWaYOjxv$kt-@4zBKmbUrJp;!O6$qKs8y7W14o>x02G)`CaFNR
zO*&(Z)PPAV_2<EsT%cOV>TMlohao^C(;u=%l>bbMJZ_5J>GK;E<L!5pNyIL8!cL{(
z{koVFOy6@UY_{Bay_~#*@^t@nl>Vlc69P4-K40TP%MIMIWnHkOm<2F~cm6zAQ`gA5
z7eMg}@AiC$0+QCU2-f@alfZ^~q4m@y_=!DV<ti`=s2+x;>zCP|n4piZ%zI$d@J_fL
z#jSscprfM}J=W+=mUb5F2hG4tfyJ*^W#`G>1XBm2%r($>E5f*|+CkyEb<fP%!W;~f
z{PoohU$S_XgPzv4#IO_+@26-3&-d|e#;#>Z3m~eMpI<;)#H8iV;wfh3X7Uh<9%rCH
zpUvLousd|!F*hN{4<CwU-iVWV7fORzh0+Ts)%G7ob?_nkgl2S`^jtPxO48DulL!6U
z`s3_=g;|P7;rRft<;G>sOue!m`1xai>`4BcY^45runqJ_uL0da)xL+zG_a)yReDjt
zxOHZ)O|;r&zraJr9-|8Ct|5^Z>bzbQAQ^J=fyN8a(BQpkYuUJ)bBz6fURxC~cJ3Cj
zkq4#6Cvr!7YtIA)M=ZBeTINfT>vnUc1xdfg)u?)k>|n*^&O62OpF`Z9@9s-(8{Pl$
zeDQE+#O#!pz51X4@p<XjmuleC5);Ln`#rU_cA&^}_zw&J_sRLfn;xVIQip-dLKQ`k
zwAmy)y6)w1C82h7r$1}AJ6+~mnBw;wjdFaP<x7A)_9TtFQx0l&=2U8TXQecYh>y``
za)5LpQ8h!JaiL<y$}z@|gb7v*lcjJ1U5cY&M?>fQ%|xRcU?<W@U%NimT+pJz{u*3`
z+>Abya>>h4_TTHx)^%L-m&cOv6E)FvS%*NJ%-TWkrHwUiix2{VgA0XAX_S?_fg*<u
zLa!PbpxL=K(V)(IDz9@;|5S8)`WnLVsC3+zwJ_42IfUWeFSmV>7c~ddtfg+i(I@J8
z?g0ZdHu&c!RE##^6*gSXkQemOSAy=-eocb1>((i8qPnqEE2R=8j^C0|CE2tc>FY8D
zh_>7kj-%DW^qjNxx|nTN<2#UCh8C{pO`1VUJ(XkSXJ>AxuVhQ>lV2gAc5U{+Xk2W4
zT*0!05610R*i$I-PJdE)2Ci{q4&ap{5~CLtnd0oKdLtwSiSZXV*sG_PfkKI)RxwVd
z^(m#%YXLbkq=y|+qa#ZW$!omZuLhUxIL~)ftPN9wnDH8BZxQ#5Y$4={z`r`C5TWL7
z#v5uC&-l<9czx$&?Qz}hADjnr-<xt1CF6%H(ewegmf!jRX$^IZ^B$j9ql?ON|7hvo
zJ&_E{$I9X9%s5cVl<iK@CScL_kYyTF2HzY(yNilJ8**47v}>`Epe|@F&2xJtRLMT1
z*0g&%17Eko&S7Eua@er|V{blR`^VdD|M2VrZ;+J=2#9RyXLeX9zburov?|t&$|I8|
z%#E<E`XSnBq|ZPj%wgM)9b<Kz`uf8TNQ?G$m(|<UOsuEHDz!^tu$rGCY+}%>RV{UV
z(4)25K-7`~AAIGo>tK`pGp3mZg_gn>fpAkvAbP#-P6>_+_0ssj^As#>p+M<d?qSZ@
z=crZXsa(<|qvIQJ+d-0{=KzAS3mgJ=fiJZ-TS9AjfSS?=$rLdJ^ycr&`z>Ybg0V>B
z9MQvR22JlTFiyO8fwPLNSxGTNp%(#LI|>XbXWyk`%-sihDS{W6$Z`!6M0I1>6TKbA
zh9x;`EzjCp{h3(baKH_O%++s>ra8iHNt%kkFQ*pmJfE2!&jZSv0w|juvdUiOSIB4u
z14mA6pVXDO`VdiFoshk0?CYsiA<B?(_tdN<F9I3wWmV6$J_|HzmdaTdjnX)yv%(~D
ziAKc04>ZgcP!mj)E3f3dVw>sSc{kLgSgG^hrH3P&be2lmghBb^H-TeciCo#9L)h@E
zY&Mk~Xb6$9u0Z;zpP}|8?=-m>OR%NgiBYl+qUEpy9@w|PbqwrO<Zd(`9v;6<PXX^{
zOVBbbzArl|JcsEDGwNurj3M~h)<6B3FXH5sVe$xmW{lQD{?u>q3+D>R0GvlU{>X$J
z9#Xph3c$MPXI4VexXh|uWg0yEW`SA`?Byqjz4goTc?CMh2Zb$`&XHab4=!GMhm$0(
zv{Wsd;&}g(-X*N3H*S2>{T8g4LN6sFi6d2qbqU9b{T2*;<%-8OFVe?&US2zFEvIhd
z!zO#}f^Y|8ldj=7Lqt<ohhTb_tAcj?QB_wk(yCI$xc&2zV3L33@8ejR;R+{R-L%8v
zpIS-%e$%hmvvpJNt$j+1>q)|u>z;V|EuKR>GxpK*1MQ{&L4}+{2fGB<Cl@Ya-4OeK
z{_*H!QhX#IMw`&mLC@mmo}Qm*_?=dcqes1{darBnM6;v~BG@8wv>p!ssVT;6@~Yi;
zS1bmN#<p#uc0{Fe2c@J|@QvA#yg4aGwCSU_auV|T!y&h_g=aZ&6>LBk<0VkX6yDqQ
zh{tN9d*haz<cF9%O5bZCa~83<ICtJ&xb*-2^Hm<#%Y#WDTt^TuN65n7FS2%ZqT@Gw
zZ*oe8y4Z~mFSsfI-?@-N4ep<>9y0l3OQlQepOn06l!@Z_|44i9c(&L6fBdwiEj?(B
zI#zYrMGvaBs-mb+E4ACA_K3Yzm)fma#3(}T9h(kYYeeml5(KeV5aWBLJ@;oc?)&lk
zeZP<EpK~<H`+Z&4Ymevaz&d4+Ud=Mt{`+HzN6#YFA_Q3QLzCJ)=(F~M_C}dketXi>
zTiCOAB_Yw-sb;bL@||Hdw^d~RN)HH`Rc)k%2qKMHX0q5kf=`A3h|ig4w+FU`MiYwY
zW9P$9`njQfp+g?CiuGyHt9m2d-Q4BnUouP@?g`d|@zE)3S%K{3L*n^M*hadDsB=rM
zPNH|{-loar&TibM(5^lxYuGmea}1Olcxa>VMW6reE{>5={yYG=w)3{~QY{XbUvBmm
zl(B`;F+DG5z7nFVQN2RIsumj8*&-d%8KTohf>kxFUH;CXpetBqsB+zLZh=qd3M<^S
zUj1<WeQPGJ1ks#*S0lK6jfvzzX~)SiciwJ?n}`aH5AR*#<*xeC^=@4;<fNy|>v}ge
z?{7&rcE2vvHmG~w--xl3V0Gy}NNbaCI!U!BwKZ$zIUVD_{i1N<%gwjV&59|5Wz(?+
zt<)xL@la~1gxB<H8VQo_$)k?@-~8fOXvQ9NIx<9yd}=#6HsFhwzUWZD$}a1>F=X+?
zdrjfFZcihJ(M^H7Peu?5|AQ=lzHor6*2O=iT(>AydNR^hUfYbCPfFw4C6{Y)7D;Zy
zZ6$3h!|<l_*R~%N>@QOJCDijS&6<X9{GCua7-HWWnJgkooch-B^w<d}q!l<4xwcH)
z=lme8{e$ot^W6;^pV|;;?X-sQv;R$nPj6+N|A#i1AOZtTO$t6g?wq)qup1e*YSuBW
z2FPP)eWb?15RASxTutOtP_@N54o;+-5f&@fQ_|%!f$zC<pkRvd#@qWP@0a@QIL!@}
zT8P59^>e(Zs7>C=kMWHMQvv44g%)n1?S@LGJt^*1e*^H&tpJV)$9HSa29qYeb60~m
zv(x8)bL%lOiIiJ^d8{!+UpvqefoS{HwzMR*1C&MGVF4G>+JoJOsQ_gff?mQ?m#<(F
z{k2TC5fRwkK!BN{ur=&Wb10sWTGk6ezX6tSi~4~71<$FjwH(}F=9dHe-J4@REM=cj
zYB$lm>xNn7KV?TubyTWZb=m)9(x04kmVx^(E~hh7GgL9`G-=N?H2{`5+L7V)5&?77
zpB2<mnUB8IFR95Y^l|}nEJHZY&Ru_a%b)$VJ}|Wnor>aGH~)nN&~33c8B(}?@q2|K
zEs9!zN%<7jEvwH_vD^Lc{SW<66%I3f4*L6+D?c{(O5_8nHrF>(D#<vK7=2$Ra$ZVu
znpZCQbQ0IW#qNI@K#69dQv@mojJ;d!YnId4_isImRPMg~JL^9s@)$4owC=DdmrZ)1
zW3LtS;gHR;wC~!RX4_=%CI7v&9*;=KYqy6Zk3-HmwN_BCv5l5tM&LBqR<)aB^8>vP
zdH~F`z=&;W`Lzc{w?H$NT)eD*Knf!#w^hk~8;tf<Zcmj1ITC6<e%z`hNQfbNG~8Jz
zd9oRkY0y<oKa<rb+}Uoy$UBz*DIwA5p=BpLVpNcpNqnutY4(Hs9`@xK#&)7Q&!yj?
zAU~j}*!e2l)#lvw<hVBZd3==HkU7_o1-fnz8%rC#Q8VU-TQ;Bhss~G?9XqTt?W9$E
zSn?i0hOm5dZC6FyAdXbx^s5D2Uzy_Lu1e9@gmX7}XpA28=9G<r|CU+<J$}ifuGmIL
zr_Sx-7B+qZhy9&}vZBWookgAI%s9{4_exXc{`JX5_1%Hj<&@*B?BKy<h}$Li<bU7$
zF(SRFTtDcw;^Q9kN1v$IME$t*+<aqJ*jK$`mIwbHSC^@*BJrY7wRfOWdf~W|L&Ls*
zkItT`8`=~)<eBB5;;QD_SvyoPk2<VdFDU$MCOq!%?*&QgVX}bp>MQdkq|(Rk_q*PB
zx3N&_&;M>?Bg|oe8#EYa&GOBr$=g3e!AhoMuauOQ8*YPkX~B^5{E+~3NoQ-+2EQOB
z^SdH?`mvht?8#&a8*;>BSlY^;-Sdk0aY<zv;}uxvwS2hm_5?b1BGEol*hp!7Up8*g
z1?v2`_bg+SL@o~}qBxl=ONL*t_By|X^x|F7$Bi>WtI6KJKJ(9tO%2VLWW+nlI3Wyb
z8YmCw`^9Nn__^O%{OqjAKa`^K&4brf+}&f+tJ>;fMh?Sz?<`Z?_n}g=Hd?(Zrx<`g
zZZwZ$F`Q02mWHUbdr)p2<FjB~m)R>i>i8V)iTqk-CD@M9%G~V%{$D=_wcVrAU?i1&
zN=jugBxekv3T2w&<#NrpFG$dKIdScGKKbK#l0Fc>JCrJHXAgO97)L827Lo8jhKE#5
z<(aAHhf1?Ha07)+-{wjZG%`ByxDi3Y@KW0$rybkX#{;YRiU6K<v0`ZQ<Q3tNrtHfh
zYv)Lm(Aicxq8L%-h&k-#;p3j>$r6z>`2t9IX~jU60AFqc4UcPEBEGx8+E{eonafwx
zXdn5D?tj@YzZ8Y;=@$W6oe$))84Rxl|0d4C|K^qcbD*py%1r7Afw+h2H7Yo!fdpZ@
zrBP3(FPk?BIsi=PQee2m9nryuCx9E<jF0tR9>bgG@Sy<+sdd9wFtVFdKG1$N!Kmok
z|FT+so|^{pmslR{R|%%$`0J3z)j!72s%GK&$6ylS`Scd~Y5LHgpL!tIcIqYN-gf02
z(vo?7V1|r?U)>K3wrdY%5)R`=vH>X|6Tstk><I~l{&Ae*4A}E+hG^7l{2hNq8)SoM
zOHf)veAf}rLr_H1a+NHPCU}JBM`fqdKar}cLjH|z{uYsFkK?-TZ@0{prL1zeF5A_S
zTev5yS7!OPihyk2v8|du4UF6*v#5!3@%6t*MA|Vj)cMmV)a##V9$#e*3)HR>OrbL=
zSrxTSAw!gPokm8GTt$*j>O*+zqq285zX$J-^Kt9YZdKEJprBPZL_}0fP1CuSdeUnw
zBWX{N9&z`%<Bxu1Ymg(tw~b*0!??*iu!gsDN9<PVbOsw&yS9c?L*Bz?EyD<;qgOD7
zELmc*%ru4M<K0YTpFc(wrcU{JD8tg|F>)}1$q1jF`zz;Q^lOsWx5>KoN$mc!Rdy3_
zalV&jU>I1hU7yHI7yJfVba_PX1YstW#GWAjibgV^4-}<}Rik^_X8K5puS7|VJ6!J!
zDNk^7YH&l$aAh3H=_4z+fxepsJs02F<)QSCtGiWNo%^4*`!CuzBmewS3qsCO!8duQ
z&8zeVi8#5Hs!5Itrvr?<h2fty!yu4N{Wcvww9zWkl-B}D_ISDs0@&V)oP%YUwyVc3
zqgV!ZSyF=326%d_<T!s*kgd915MFy)TZ0nK#-$_huB>@~gjKtJ;o3W6+d9#&Tq|aQ
z@uX_!>|I^(5b!N)VCc3)Xg=_7&hr%i<N3+0Z%h_sq^EK#RVv^!ENyD-xeqzw`WGI1
zDf{aEvVR@C!EtqQ*3ct(#2oMlSAJ@=qK}ef!%%nZV(;5;^hX~eCD;m$T@ZFwbZ=Lj
zA=>sac{y3~hQ{AV{AwGK^Wc;!_U`9>a-w6!?yq70Ft|ga^T@O>E{eSc4%PSbw!thB
ziQqht#PgUx`Ya#)Q0C(X@8}V3e<f@)yUb20@W^vZ)qr!iZ9{bI$q_%sV6@=|jy&+>
zaWM*&wqy-kD$=974itQ}fgDerhdO6v-|k}9yBl5g)efhq77~R!Pm}W5(_5a$Ut;d$
zN1*dyWBoa!(9;-Mz~R|M!D%6TBWQY#$s*xDY=PrkSI@<0DrNhKaNA6k5K{WO%15Md
z@4Hv)qYUKQgx>LHaR4GoJaV%{BGJ{zfp5Pd|MZ%U!+URtne>ex5~aHjImbvmxi`_S
zVl*h^U#F0Ym*6M;?3=t_j41k(!S0&+^4g8`yeDxzj*&$&aMN?C2-R!FfV1;)H*~(<
z=B8iCPc;6OHB`1<JhmZ`B~OW_W!5OA%5;mf&}#bB02jneDg4NNrA~{zou-LlUtR^K
z{9J3j*Qm$n#$#N$xr{XCUc`}K`N@=s@Yjdh3Vyn(1THzA<4sDW%zjZW;5O{?h>z+j
zvr%ToP8CCR0<<JXvYL3tHO>`bVPQf5Q0~ybBUT^=cq&X1wjX>B)(w;+E=Wt<q;9zI
z8vz9f5ygu=ImhH3^Ag=rYj(fw_aY)9cR_B(wsy6d0l&X}o8%z6SO2*YLOiVPE^Hl>
zIpP-iPW@RVPl4|ufS%>`e<ya|7>pE%pB;WwUT(hs8alemXyo(uYl3+0k6oyVa~Lat
z`X<NzO=>hug7=Bi)hPKiDfwvR?K<F-T}1gAMuBJwOiM?Ga?~DW3SksG6_l-o001Ef
zyQc^edm**=G<`6go?+`*TPa)BcoQAyKxJloUk^33GqlFNC13B#&aYQa1h352Twdrq
z8N@X;>fE_%viB+QLZn^A7_v`x@~zT^w`W?y_^QWsphg_0*nAv&rXP?>fdt|KE_Poc
zpS;!9;;qjZXgz)ys<)odP)iW8e29j_6orm6cO?pWmcacFcEqn<<(_uD{<}~5$MJIk
zwPJ5^t-8|(P%(!O;>KF@K0paQyNyIwu2#<dl;~c~@#Dh-igeM$NgzYkxO{`nE1>(4
z!+WvH!Yv8dfcF7HsTotr!LE=+C+p6Tx<9XA?aH$hbd5TDypVaYZRNzPq3In`Ly-TM
z82x^3m3_cnK(egNU!uf3{;_N=z|O1x@(ww1>zO9^XE73Pdw1)-*xPS5JjUrA(IO26
z<2o9_*KGN8R1$T6WET`bp45>2#U?U=h){K;2%PK9>PYCzMO0@hTALcHXMRcsI1=))
zK3nl7Mis<a0d24Ok#FYb=N+Rs!n%?qp|OGn=W9#|#?{5Q(fjEUGLZ}&aRlEvn?CDN
zd;~S0Zr)0vQKGo%t33Vk_RY||NPvt3sTXp}aG67KR9kjpn?e{nSOA1f?Xsa^Fx)au
z#TB42T%fujC03K?clhenNl#SFpND;ge$!bvo5A|+CP5W>U*Co0cKeHKawc@{3xBt?
zIuumiRt#fih`&-Yy5DRXE~7v0h2xj48|76KXEFa>j|D)k0<Xf_x2tj{RTI$|xZs_^
zz!iMKDXgXzG+D33hdlpYBi6htU|-hTDcSMn(zn8f5CQi6S}?<*=RtE`ys(0)Iy2X>
z?fN(0dl_JiRgXf`q@*ula~&3=K871i_T19b+nCFe(JkF%tiK2_S4>59(^ugDFun~y
zr2W9?B-$h67Z&QFU{pxS$Ue@ws|{c}C9@6CVBy{chJ+FHt`(rZ?jxzM408vl#cP9F
z%69q;(akk4;sBmklNMUmD$=%Lf9u@Vy|s=@fvgM1RZ7hQ3;lGK>IwEBVQJ$Q4}!%V
z?w~_Iku@r*XG89UOvCPGp*eu_J7ZBUR-k+nX)@NVr7oKkC50f2d1fV*jBJB3h#mI<
zk_6iTN^e)cJX=8gZeYXSv|yUDiYS;hyY4j4lQn1wk<4>@H|mKs5^|aChR;a|wJ{m(
zK4+g&tDqnv9)*JWFI-fMRV^1ps~$=|ZanR|(B<E`dad$dZ(|G}ROPS6(rN$QsFc>m
zAiDk82){j3@rf67w&zK;2K_l;<@Qjj#L%;sbh=tK1w|`Ih4}4+m~8)b_YyMYV8OyE
z6n6)~R!2z%FcKT~R#2*EzOD5ZG)$ZXh@HNBSj#=EHlxWf7;50lmFH+41|7ppUKp0M
z|NcJkRjJWei+57j=Z-OnS-wfhO6s7NTo{o_cKvwlR4dIWz6WAnUEsEIS&k>-4Qa@<
z`|2An_=kc{9StW~%)RdHk2RRl(3u@1+{T%x2KRQXHbX-=k@PvW=`k<Er6y0a*NU%v
zJTcv#ThPAsAmpUCzJ%6hxoKBbvdumL?_gC7_k8rMC%T25QEj$(0ug5%Nf$0VuBc$*
z4I&M3=Fd%c>lzk$sjPmeJlBrmQg7qLzrf8aB8Q%^m>g>t{Sd&bHpnb$`%W$L)CG@Q
zevWM%L$Li+G|x2#zttwj4uB9R04g&4J4+^70j*rdaNTS5!#eueG#?Tg4h@#-aRLqP
z<pV}sAe3feqidn}yLyu-2iiM_P2wu;DPGxREq!?Q=7>5UBqJtuvwRKo`9I$B>82b4
z^M>94@VBdyiwmV)vCb`_ZQ&z<vU?LWYjgv!9K@sNRHAQMQao;hhV?~0eVb8bJWDfF
zM3ipKqVn7ISZ4s%6YTb|w2>$OM_Ie;*6tInQx%rv*0j;L)tX7{?~i0_lXrBjB;W6)
z0*esYd+#hyWa!kB2kPaw?TR;tg=F)SVLgqpk115Vm#VTx9Wh};ARJR=OSLfSMp#@U
zhq@UAzARwHI~TB4aN=I{g?)YhfY9Q-9K*gptK?UVGemu>f18nb{YUv+W@3AKgfu4@
z{E6@AN|rXrdv;&s7UI)~E7Y=5EE~H^bLbf7E;dY5Tp4eauF@{f<Z!;?oRNCRTXy$_
z;x#Zah2Ux05*~vwin+{xzhHgb|IoLpXY-HmQ&~J(nXfs`eP@i_v!<I4e|T*hfe5c(
zoq<Emw+2PX2?sDlc;l0pY&zAUrO?1^X=h}XQ49|oC0mQAZL-eqNAdtmRCs02BKNl|
z#qKM81^2V@E+jv+?#J=ND3N~W(%fnyi0{s7R<aKY8iqtm_J!F<HNV26y#=#M`yUA$
zIDyd{yVeQ`mK%8?bXF~bVQ5QK6m?HH44HIh^q@Q;vRNBMF3(jtj*2Bt8!TpIc39ry
z)W1~o0CnHRq$&2>(4{M+CP_A#KG69-t+#;AH-MW!mqE;%<8zD?-&KW~8uBx`+D;=Y
zBg!6r`qG%;$kdG&xW&xE`@Iviaf8k(0nkh<J;%j!7Ig!ApE(ZJcWnyW&J{2wQTHT!
zK62$qDhxmbUhsPW!Y=Y`F%5Mq&)^GQdvhx+c;=e>1qqSVJ<E9%P<>sg-FAundZnrh
z?!z|fQK6jb$=6uy%HH~$Cvu3+)t6<VL8y99H2rXPm-%7{wYv0XwE9JqmDN?6Z}0w=
z-x~6EXi(knRImQyeJsBPsUL^}j;vPxW~g&6wlRb@93RaZShCzxb|^A=r-$r<PH#JE
z*SdUmrTaO}Zl|RLKXY!+s%5CMslb4df1NfIipyI_O{x`HZGGjK0sx$=L!Fh?&MTpI
zbT1hU^vsXzhYceQOiTm=+1=h1?&be|PR%kWKfnANwyekZZECdq7gA5+4v{s)V~|%o
z<?WN4)}A|opeuQxZ93avW}mPCvlMT%6dl$03y{dDn-_VAsGC1Y&H9(P?GF2mvzq{(
zwUYOq*SodA`FZBU>KjSx*}0!H0=O2<E51M*c-^a@@2vh%iF!&cy<s3^GjmP6h2yT(
z4Gtqk10zTv(0uYgrE?d^+JCSu-|Sy<^|6@>j5FqqGJL9bD*s6tuApYOtH&Qq7KZHX
zbonoF#VbGXoXg2Aj0GUw+|~LESWC@lJHhG|Fp`Cz4_fdV((Y$(Yse4EkRm6(1X^S%
z$mSW>4aXU$h}tEju%28?>o_9ILP>NKEy)p`v|Pcuw}!v#C?+iM-Z8lRCR@SuMvvJ2
zzi!5Fe7w4YigSuev}NfLWp?L{7NPI-Z*1}ai7wi)JCMiP?<+(2S?zKE*t4QXxk)R>
zvs;4Z=MBj@;)J89ByMcp4PkRP$$iMFUA);2Pf_d=i?LIEh606aJn7WZ-`Ot`luUe)
z0El0Cku&iwF`wjw4CBO^aVg4JKI;K-(ZyV5tF>?L5D8^tpH&5uOKr!MmaFC!Pq8{a
zO>t{k_Fs+)-{`ZE-Cd2CCc_VxTfRhCI`T1J>os<zsR>qnN$Z~$1dXe?%H`W<;F7rI
zTHd(hUj@yzt64;Pe)`)$ab(s(fSy~@;p<<A`jxX1JzcvAQv7ztman%AzoT;s<5*^C
z6aFH#+FgJntIe_%$|sym#{#v+Y@uG$DPS1U()%?_o3`jKT_GXmuzXgh)=%}lgJ8nf
z#fbf#E}1qg7=-f17eCY@cs{IY&<kc)obmqgx@%3-V*})}CepkEMUo=8g=J_Bq0>Vw
ziZ(khP}ze}5?1&9RJ`R1=df@mqzO#3g8J>HvkzH9ywg+#BmhFCIe=O0gbY|KVhm}u
zMpG$N@T1NVxkcZb1f9Tio{kr*n0<@f7iPywAC-TZ0(A~60Urnl+e*aAH0ICv*6W<6
zRf-3S=iHG4l?whL_Kt~m$kjghUUT9B)8CI@_}3+>m1c0UnG`(?P=ALSXn6VjB-(Ee
zm@c4(B5{8S8R~1oCTQl9?Jb?G<67dHwg~2^a9T4_7uN6QuzG*}d#DY@@V?~C%CX<P
zJCJdt1SAR~r##FJ-Qh;k)$VwPT&jCn{LVW0cCR@vE6_!Q5Ijv4n549pBRJ#*Xf!v-
zzAKhT)FkeTTw9st@6!L)MT&s$m^-eU1<xW0nX$#%Wq}5_<L@irG4)Y?g(6<fa{)Z(
z8-q?hqvYV86D3;9RR`5LvmCxKBg@zI)OPQ^?MBknWn&7KbnITf0+WtAym0w(Nt+dn
z#&3u)RuLm^0MXy1Bfp`h4=ReHRMJ(rOBV}7>19wC7UjD&K2qo$q<SDe9j&#8opo5H
zQ`zRqGtMad;Jy7maLO7VeA74IP;54LN#y<qlLo&by`Dcz-jg9>?=iEm__}7w2%P?l
zEiX7)t!6t?)ko-EST8AY%n{>|q7%t5M6<t2m@48NS8%hS%G(f5dT?5KC*oaYY^)4=
z9;mr^BO%2*)rQ4`x;FoT%s33K5-C-dMt_P!vL+7hA*-tIn`z$IB=@Pmp&V9|jX|PA
z73wmZ+Mfopr>|*0Gy_BVN^k--+u|0<o|$m}PvlO~-qQ*7s6}j?iGUKDYxEw5{qPO&
zMur8~7l4ruOfJE!s&+MrdwXBlr*aE;figv>)gAav@?NkKimtEcx9@hE*4N=-6@h{L
zlla=2s$dnR+5iDHgZv6iX>R?^4=QM;*;kfN3*QvyL#=Z;(HCy;CSG*ioy+Q|JR|sZ
zsqp(^5i5!RXGT;>7KN!UjpvkFFQIp1E%(w96E-G<1Q%StS{jAQ6{Ya#nx%RJYinzL
z{l2b{W^0i3Y;Pj@p^M$r|1IOxQKRX0Vd~qK7u;h))7Hl#`ZuEXlI;}wo%t*$RTkV#
zXR>;PArS_}#!q@~-7hBN7)z!CWtEN$zK}M~r8_1uPdcJe^9K>KOJXT+G6)SDfwCJE
zD*APns1s3BswTt6GhHcylFMaL=uuEg&ErtFkK9A)=%POM6V0#Zr)aj;V+Bo;eK!*!
zMbPG*c)M*SI`~rMzS|DbS*)Nv`91QU2FhAh>4N8-ew`Dq4)@nnR0j%-Mpn)|VEByz
z13LMMF5$XYa|~mbRrul68b4-OS_`|sVKZ>aWY3jRqGF)NdQKJ}fO(|8h4%MvC}>vT
zRFA(5G!d_trUC}?NJ;@J0N9b|{0Pe2h1=X9o@0mcx5t3Iap^5%I5!gI=DC_&OR4f|
zG3w3e-E3f@wkOFt_xl+1Rs4*-3R>Kuv+?toLkNLs5)EGOU$EtCyEIM&5_a;HHBbx(
z9?NxW>FoQhg$DM|A`5H_U3#q*fro?K>*nB5cy82lHM1vOsY9vY^PBoDJ1~bdMpiu;
zzF5q7U_91eW!k*GJkakCraN9vS7e)~3;g_4Uqo)s&mzAtfY0JVtw%B3<1@uUj92vm
zsNLiS-ocyscLUQgr8ND&ryf#;iE^vxS!8@;Q{b>S@z7>*Q{`(L^l@foKv)f{+Z0nt
zz8v!!u`2<(9$6XQc`a5%+qT~RIT?q}LsIK0gDkiy=$ecfp>(w<Ea{hdSS4V=RiUW~
zLUS$^VY+r%jng3imi1Rct21zBa7tC9I&2cCI+<^;KzhI9ZNcpbT|U$$;?>L0EmtXp
zOCETnTsOm6)qwnw_z1@t>HUpfzmmFe{_1<#Dd`k4$ne-R4I_&qk<MwKxD6CdeBCDS
z4G!t``y*!rTLIEKJZbAx+@10-)RJZ`n_q$%_@-ctFGjjH_i(@ka7#Wp<F&cKQ?p#G
z<d)#;0if2W2Tj9Q)A>2L_Xq2Amprh2!*V7m?rZM#7(V5>YNAKH_v4gos*|S8B|VZb
z-|?S94QXK*1iMlZAu=g{zCz^+MBBt<*_35iPc5)A{Jul&>Z@zUWq0d`w7(4tE*w;C
zRW!ud6xQ`eSaS(4W+3vZ0AP)f-LS|`^UeARlQUVpAsiPO5(`IOH@^V$!!8j^>0F)0
zHQJGDx{r^O@VJWvh;ZFE21&-Iz%^d(or{sC1<|5m$uO_;`<qqRJ9M5d-QzH5)!LYe
zO8_gCqVMuo;e8hZS3+urGzKEE+GzXvt2h>ZrKU2OI5#Z$YrL?MeeJ|a&rcjDhOTe6
zarr7-VR2An;it35y=+s8sDf670iPssaRd+uWNXZ!0dB?or{vP0X(`&kBAo3eggC#c
z$MbLxD?804dr)kGCBqZS^tIvyjC|7i^bR*o{C2^XxX`Xo4D8Bd^6YJ+8BM&D{YJHU
zR2aLj3aYiDpgVJC)rwG42)^csI05_du$$xD7FAaTsJ=3=q<s=Ka{K<_{&;B*$Fm_n
zTNY+V!Z^O33#1!Mlu6_3-OqsQO9?V&Dn70CO5Tk@(W-Qz8!=nMola~+oQFGIYgw}U
zZK@Dh;R}|(AK%f{k*r>1n){A`Wu{by>kkjvtXibBkulQrKpYuOoPyw9^VxoNkCo+{
zW^jsWf78)MmjphiA#s~DGH=bp(yFUp-AI_7puEzw;do}8EzU^bT{2XUCw|9jBed7_
zeT*m33_s{IlNd(<(`TTjF}=X3rah~`3*~O8kOD^F<|1_VYLWFS{Q8_ez_dBHnC;%D
z18tK##SS0C|I04r(&Kk-P!6oj_)xXP;7F8#J?Olc$TF-6s4SoU8ErMXtW_-c++jDT
z_R*JD=8S#N(#2(3L>{e<+bhC#5DdDPETsS-4bLUP@jF=psW)MhjkR+xIqyVhz270N
zN(e9{T9lG5MayTko#5PvpT!TsblL5T6=;Em-DyGR0LsuYzZSL<FfIi9)e~_2K5ovL
z^W>F;g^V^eU&B8+nAa)zG;!8fxye03NiBu><DRfITg0N-nt#p)gTpRg9#_JC+OK#m
zpF7dj+#p!e+{~w@=VY;pNdv{MCVt-EZV*jI!i!W2I?nCj+tuUDQ0N{ABgJ$G9(sN<
zOEGdAQs{Jv@u}Y`FPxh+r>Ra!+26<#r;vym!}TKvABQZ6Zn`=XmCu&9<z&~D2&wt!
zMnf+zvy1$Vn@O}^Yv2<a^8Ze$%vfoC?@{&|aFJRYP)o4}_7u=njDFDEY<fiOu@fh!
zzWFbYxhv$}tHTY?I(AlJ+x^A8y>*OSj5pS|`3l}t?kmRicIofT0i5HG+&p@L7Si~y
z85t#cvJ1q!#b0I2Bms7Lf2^=}uf))0Rbfah1X3zz$^@zi;g+}WzkdYE)a&O_S_KJi
zVxcuFw;KvLx#m&}V|ppah&F5}tGK40KQ^g8{arpID4l4`Y%wIy0&t)swrE8@Zt0Dc
zFKbPLet%okheen08^n?(P$UX({l!(HGQz28y~pXcQ(dhHl~azgH(XIRsK`Kn2#Xs&
zZ&3Jk$7(B7I9d-31$}WrZJcT9**#E3kJM8zP&=y+lH#Wp^o<suE4-w24YvP~#Mq6N
z0Kl8NzRL`Jx~(l|&Tn5#@Ecny*zNi8={drn!d{`Fj@f1<zdEzIfjVNKh=IeDL@jGF
zg2-aIe4rT+xHL}a)F!d}l3flFVsF!IEb>7>8`q-SB<tcCR*`2|g=%>%@+5;oQ6G^&
zYR8}bU>1-DOA~Dl$(c6-$>1>CE-`kOoYd7a?`EB~PuQAEq+xw4phLNEOi-)UO9Yw5
zAe0o#peU(WenPb8hbUDb;=NZ2T5B*R9aYm~ltWXTaWmS}oFWli!VPs^&8{<1q3Cdu
zWM2}og3p|fTRc2+@(xea^8}1))hg%YouqZCX((w`<}Q(89u=UFBX$QYLr$0*h|a<s
zXNKqvi|sH)KXsxeHn=gjvk@w+r~i9w@a(ONdI7fsxW?pBt4SG1B{=sGrmLUCjr`*n
z-DwPn*p19oh}TEur%s`weH1b%Z9rBtFoBeAekH2G4s;&)w0cdR<5Jn$J}Srlkqo5R
zb^2;3RrGJS2_@x~3qHj3H>;`J5EFXvfA_n3U1A~Y4{W^4SBvZlcN&B4{hK!krR%GP
z*3O-64zL~Fvd271yxCAt@JKC&FDY70(`inHKYXM!gg>s^$E$hhQu>kE%+@nfRBWS8
zhTQKx)Z1Vm9{M*1MM@tWoiGNOCRL3!WhFVECu;E+9arGXEqxV=w{0QTJA~vzm%wx4
zSxMvM7eRLQ{l}=K_jMRq#8QOV{gRfH{38gD^K5fa9t!zQ@P;2<jgOI0dT#2~Nm{re
zO;!8PdpJ603Mi?M+Ep6EdtJs1Ml5!?;E#MoLUE_x-5Q3a<#<8m+Tt{<hfRw^xd@M&
zVpXmG<3(_c3wQdC^*1I3H%0x2Jo6*?hyJ=rwZO-#37S}FU*C;NN);WM2UE}z_a<{b
z-h7xeHf=p0r72ctCFNGPHq#5j1>{FlYVF6~?oV>8A8I|qIXPm^TUd{61^xR3_YUlG
zZrK=p1MCcvV_ZuI%ga62snTib)UnIp!f`XY+W5&_zo2@TSk%A0e2!7!&U!n|)hm;C
zIFHWCgG-?;EHi=*%!1HpM!N0vmAE@oEnhC!Hf3fBrzFGvLw$j^<ae)TJ$TD7i1-pZ
z|9#r~qAcXQww0t{3fQ)WPF-#)eg12Dzx|@XL{N&9yg?)@?xV>H*goFPFTHIFJv1s!
zSilo#NlheTMGCkf(M*(E<$xweLC4jVs^FQXPR29M!7Bo+5gjim<5Zu(lVKC@%~?rA
z@!7kI7X?>DL>8Fh?)hX@Ik}GzWk@`xQ<qeR1ZaSrn8hGR&Ufiyj>{*+Y5%+u$d}Me
zqITbEib^J425Ct%v917cV$(*bs>Ha~($;^ZHSWAJBYUY9BnVaCsHRkz<mG<Jq^`@;
zHe9*$lMRQ7?EXIONOu3JRxsdFSX+i&Kvffr_dhU<57?)N2J%_tVi8K;t669G+ysH7
z?&V|k<u{BT);X!#*$sfT!7P+|MiOn2w@A$V8<HbVLgljCLB6-cBN%s%5u$DZj@^d9
z^A)f3dxktfg?J)VY}fKb=n!-?!691bxN^P=2Q9xO;cc6mTYhlv0-_U}YD<oQyEj#t
zar98U{nP~t**Xx{0g=8^J+k8DpEuWpx7MpruBKM*({Ty89L<=OVs95Y1dO%T_I?=&
zml>ibd3hKTlRNi@oMmF0oBOuB&2Amapb#MkwkJuo5WxN>*DW-@5^`SfTfum_4dal<
zmrZaY{XoM8ow@<lXdjb-r7cWM9#P}==H0Ccu^#L*m67vV#iDr`X1)2}l2Skc(_jU}
zLmuR{A{qE_B?gNF6>-{7_iy3rM;HRPQa6uNQH8AyMNSVfcyBFmJ|AFt!&cZx(-_3N
z`e7xBgqk1PF<OEP)iE-9o|~%8kewQx_^GVfRj(t-M68#`zsj+0t+|{FJ=vA;-2BE3
zBZNbWu??Yknn0qy|2WRZThz$G)mL+sgJl<w<KHK2Qcm8QZgNiGyU0;PtRvGuiff&S
z^+t7xymnl4=r(N)eN4T}M!pqM*DT)5y50bDP5-(xOP6xXyr$<W;(~OwYB`^DL7Uc}
zB;E=zahk}>4BavFeI-uQyxD~g5D03eU6I8PQtjrdldJW5Ihx+Rq!9i2fQ2Q9j*0FF
zS<`(!;5_CI3lL-*i%<9)ZT8%`AJylkekTgWK`moMM&+L$D(B{OboEPIUiws9S{WGX
zk%n7<F`@`6-t&{c*Dx?3M`UHp80zD$8A0IOGh#xd?HFe*b3Z;k@b!sVM6JJ8>0kua
zi`KXbo4`$MCqWz3Jd8Y2UpP)Gv1X-?kJa?G?&4?+bN#Nv(#q!@SItQxvJd&s-4%vR
z0U<)vR^p&FNAPV&m*d)WrIB7{Ww0s?H?(G#)L^+Pv}4=0Rz6j<dV}OQ0ND8XS#)9C
zhI`%QM!Eg@2A&%bvyO@zK!)uCLg#>J4`nf;sYzb3|MIagI;+jA`EYIf+DwGU{mf^Y
z6wA*_r>>%zA7<k?D)(}Bz4VYSi0?N=RO$$M%Z;Wau^I5A+ydPQ)tK+!zu#4Jg@Q_v
zKo{q}C=v1Obd2=$l7CDtQVsrL8)iX4%8eK4TZ8B}-C$`;0uVEK%GJw2F7<$Hc`<j~
zv6#6_jL1hc5{c|LlXf1df9bE93^cJ<5bk8(EW&-(Uy_|3t60SxpkfJU2G|CS#Qg=G
z&=d8&u>@)?4Or^Pbj@+}7b_EXDZJ;>`e@hTa(7vwB(lpn0&CnNjh7&7wm7F?Wx9Nm
z32y9v8Z6O_vRBIHdE-wN*nov|U9LuA@xw4*3tn!$liGu?nC^?p+DohpAK$JlMMGX4
z=a<=b^rNr5p1=w7b@bJq-2CL(=BXEiMT{wn%M#b3b*n>_Or=bFm5i8!m_xg`!vb~V
z&KIyuq4Itmo1ZrC2MwIUa$wCllH=S?P47*CRhE0HVS4w+E;n}fN9{x{54N^g@+@&X
zx3Lj`&Qp1G1avy%t)mumB4wANASw?E2HoDFON3>%%Usx;{2aj=e9nC+-n994Ve^x7
zLmAKp%aPK{D~(ZD)~+heLqaq`p#*;>nIMH%4LSoG<M1Av2;%a`uehr#?T>x=btIF)
zdu*T4m-g6Do(I$uRb4;-y07B31P-IhyQo3D$^7Gxk4*@F%U<Xo#)u>+To5kE`*HL0
z=H!9mS86y-3{1w6l@}v6`0~^04-dzbvfO|MmP&R<*}E9OkDg7QG0mRl?)II6#8tz*
zE%}NdXFf_JMjZoVUFiG>zOn)bU%_6*pIAC&1^%H>tPmwuxX}4+r)j6JeZ2$7=~_(P
zclX{Qr$@MjvCbP9QFm|AP9GmJ*-DuOzq3f<WjgwQ7$wMi)D4Rb@PlPHZCqiP@@s9?
zQja{w2ReGP2qG`6S1mgN(lNz{6ipv|+z%kgPmi;I#`QH<*%KEZzIu9h>gOuMx(=SN
zk$urI;!(W$uFE%&K#gasF?nI<i4VL-j?feyRWS;`C+;rtXGgimk54<@K5~xI#FZyK
z@Z49cz<{{Gerv)B$B0|QE$x5wV;T?#tICK<3SR|I=!aj?(m2gR94yHhtdYKt&M8NK
zSaQYh2OoFLZh_7C{kZ~t_o8cBCE7P*-E9j>&KtvJ4P{4VE7=Q-@bbxo(TXYuXY@>c
zo!eN2xG`%Xa?hQSNccZlgLOh26^lKM?HYDHSQ*9sx^4VoIj;WO>ZC{c^s>l59~>>r
zz}^KSBAZDQ6q{CATwCsR`{Kxd!NXBT#N@0Y4ROWzOFJexfu(!kYK?w_ivg>z;N(F~
z?kGX73KuVhb7r5EF@v7KUs^gfN>j<MeX#!&7Y$a~TA>!<m0=-qx!qWCcdNobcN!4(
z?8nM9`nDFFT#~04r2(3{`9|#DI@2<iCo{_*H6=dojZaw(asF~D<u+5NoAHB=9Za&*
z(oFv_f!5E^#L&cT;;R3?qse4_qp$c5E*N{hi$B?5PP(G9e%Q@-^<TR^lwSHw`*xeV
zD+VbIUCFhT{nw6vo<@Ur!r|d0ZWqn}OO#-%Oenhc?~!wK?39FN6@>u_HP&z8r}$Co
z^Lch3?Tb=^w(#}m#D)8^bn4N_eSBc}aN)k+R?4~S5k*a>*cncDongW5{UEO0B7)pt
z^BDVN=E&~XuG8<71}C3KP`<#v40Ha;&5pi<`xk8`=MTE?6UxzD2g1i^&LOvdq#vK~
ze1w6s6PF>oo9yY4N`gG_zf*RYj;)_I@L9PZuu@wD>x@Xl1`_2)_WKJxLYb4zo=WCc
zkS5mnWys9|I{qc8FQ?c$X$okTXku1tC#p=CS^}__yA+Z`q!>K~oMih`m4>@cBop8k
zi?C#b?}bv|1N+HkPVa{qhoe8d3~CB*{yHe<lqs2dH*|}*A8SMZ-dM-K1Z&L3Xe-Fi
z9xl#1KprVV#f;~jCcHu|$X56kr7%7dKKG9mFcvW4Z<@OO@R@zLeheQDtDs}|->ae-
z?)!))C(=h*%l^~#(Dgj&PT`tT=Xw}eL*U=UM`<Kx{GNKZRF1?%$R0?YTD1Nl-n##k
zAm<IlMVDCDFh;6WQWDF8HF&%J4TuZhtS9R=qKVa()tu`Ewl-hpLM5kLYvxuzK3~6d
zAoCeW<4>E#TZTYe2>Ty8q9^N{d~Fu19AI@$V8!~^tpQp=kDjR5TYpWsj(@cD#ZXpC
zy+0gF(PFhI29bh#7OWXgSGDga5L{^wlbSsnJ);{v8_^tlMv>pq9H7wmT6&mh)X=LF
z)Jw)u`BPtZJ`&gFN8hJ}Kk&zvPK=(aq;X{bA@l$15Bk3BD-6*>Ob+%&?&oe;bWcaD
zhpUjcyYtL6@5OfU`K(yY)qmOf1lA*(<SqYS?2VRQ^dDOt#Z<L87h;mVllFHp|B~>X
ze(Y2Db@vAryON>5R3nk%S4VO8y6QUp>ev6_7e9`%Q_g(cFPBeVyMf6a^a6C-=t(47
zN59G}`D1}!hXQD@r?5&&hU{>6xH}tc9ER>X?YIvEYx;1%W&hF`;RK#-NpjS^a`^?=
zea+ms`)U)E{4=hzxmQNkR`yZimfw({;zgGV7$D_ilI)*j|KX@BwSt2l#f0bljG$4%
zl=zX-|Nh98tvzrapWW4mCCT!Md|3xx&i#JFjh*Gr8;mxq-+Z|~R6Pixk@?1SuvCzu
zy#E#Xi-mRuUK(*t8?#Rr4D|1p$oSt}ai{aY>2x?z)#)s~gY_!L@&O|Qm>C2U_of2X
znRWNS{TbKYVftOzGGvEu2;n@Qf5~9fWP6$NpeAkYpynAa60DN7f{xA&cV|$c?S73?
z_xd9Vfu#n-W8pu<WyQd%l=;87^Z)skfOmwag{jePtxk&e?`J}*_F$^Uyhzq{1GmOg
zDX|5@oixOShlVtqT}zQSWMB05T^Sva4HcuQS{lYze_?Srpe|w&#G|+B*?)?DwDhR^
zFrog-!FEkxgSW)e@`eABgyLVF-(ekFqyt9?|4lGk^~+^tvP7dG(m2}9IkV~cdH^oq
z|AC@^?e5K}??p|}eW1WsV^p4F3>v+8HmRsIP0$x}p*C*kj_}Q%-ugR0z$hmp6BH=t
z)TpG$NM{(RmAi5n@)=CtX$luxKf-AKe0-6OOFx&F8=wVg%NUf@7O`rPe(V^TK1X+h
ziQpW%uuET0FG1{nF7=HwN4Qt~l%TUISX-kc+zAHyNbwtm@@KG&CW3f2=jr^zp4yk1
z(1GsD=Y@}a1Xp*yL744zv!~=93HmHl7%|cD;&tF(d~XVxH^9s5F_ReYXK$q{5W8;7
zCgp4t$PrB;acz@bvE{ED?~&Tse*~<N0he!)muJ&WPs!ew(K%-dbjEnLyelVhIR6OH
zBtr$$DFCy#S<AfKHFw^8X;0lb)Y>`+p%h_{0zUIx+H^c=2@nV!1XJc2mnt%|Ks(xF
zax?1d|F+nn68-DySWb<;RYtIF5ZyGZkm3<fEFmA3glL0q3mLub_-h9BLTB`~dUbZU
z=3>~eM_x9LJocJVa#Y6mEO&J#kq-_EP>suw@4J|<%%pB7pbQYn(eWWic&?vs&#8Wu
zr_)ehm!a>yepLI=>1h6L0349Qua|7p0Gh;04t^Xk=!q*EPIJL@%7W<3X&Bj$*g+%N
z@D<1uZ8Wpdix#TgOp$$hq=b5)X4Z&PeEHgd&GeogyMW{0AHG7rt5LIdw=|`@TshK1
zo(3mar+A*<IKimSW<a21^%c&%nct5NiF6SIh1kjJ@YbhCwMb2oQ8ovOI>FLrT#`hw
zhuUDb@uf4^*VN3jDq+GT;UW;cDbss6k)`T{ybn@rXGE)P(=&q=V)|*h+QkizYSs#(
z0Mwn6lk3h9O{oJZNp@fx?S!j6(|l|}$8!7ksL?U9%f~$fvL4A(LI;<AY`@Xj;)KwP
zd-xpDhDA$HZ085*9+RvYllT4Y$xcoEeC{9|Oe>W*NKX>Nx_I^+h)0n#M7M`wA50@M
zKo`%y{bBC&T-G+VEgalclqwPr)WryE|3t`VKxmHX-$cm$ezfUmpx!6_6C<BlSrH_C
zi8p1SUZWK>Cxs9HCD@*uYR04<gF*>+hKn2#vjAat;~zX9Qnh(NCg;L`2<(F*ex0AC
zS^XL%_qc2pSq3Z1VZB-jAXs@K>&Q4FIEsIg6g9*oMHWa>{P}N^6oL>Dkq>2K%^n(k
zfCX;o=-Bhw7{*503{)Z!tD13q$Rtf{udu)nUGV?N2?%Y}NBs*6;J;{y6V$}K0!PZ<
z^im}Zo53J^`QJ8DT?DBSQJrB3?}aJj)fo^Le;5zh+Q<Cr0{cqL6p0-j=G*(I)h*oV
zHqZ&8fnp3GG<ET)&{PRXNP)<^U5%BgPb&xa4a>F+TXGKEgf0)iG-ly0X?55i$J;2U
z$deO56jjBLd+-0tWoTx;(tMKAB$T|6$Y3Dwp7_p=N56CJN3GA&m`UDC=KczN7^TLb
z5+|P{!X>oC>P0FwQ0&vk3&I_|nsV8LHJCiCe(`i9xa!I~U0k9^Bu<Epq`lX{7jD4P
zGA3ma&55spEMhxK7TqELEOy^c3$X}3x5VH8@<Y_((*2`XQ_ARf`2GBVmmsi1+=s!@
z`v7PE9^?~Ryj4QvhaBw2Wnq_vkM6+(8!3NaRU>X3wSQh=E!^;#=9h$fLXr7!t1lo7
zmuxFKHe3lxn82nM-rw5?{W*2l9;_4txJrXv{Bqpx!Qe3x)^Z^-OLn#eya|@4CNXY0
zQjYw-NXKQ}u>KMxFZ4>eephb1a)8KQ#vu8_P3^K*Sq<uQh@DJM;>tspxYFCys9Nkk
zIeMvJa9&-NbG@=}JlAJH&7v<vbi`I`4g`rQ05s)bH#ermgacsO;R({1uf1lo-C-k}
zl10M5KkKZe39%+&<Z+i6eoQm?(9GZUEqJ+h6~u0U*!`SZ+u!pR0m1ad%jVa%8u8t{
zyqZ|Kqmv6<Sl&a4iqA1olS0X#=d8j2#)SQJdyI^7E+TzAUCAA4sAAsBlI*?ZKNWA0
zyiQ<ppYQ}w8|V$U{?D<{yazmV%_jVyn8z>MG(u7zKz6P3=Y6_H@~#g?h?V|>!UFjo
z5u0$EMUcQM?_#PDZ48pxnW6)&NRJ1Wox+HvekZAzxqWvxtj^u_kD~(J1Vs^~%=Uxq
zADZfKc9@KHFZ2L;-?A5x>Y769|5Qx)AAB7;V{4A4W**!kyU<iQ9Xm4pWr%&oR+1Iq
z{yDVz5tiv75SP6j>>;N*#CI49VU~o@Me9>%T&-SjZAQ&ARe-3lUbRa$h$OBISH8Z<
z{=230fh=I}W7Jlt&EdAX6^!St2ru_Ju69{EK5@uK%3&=(jm(N8GRkOU#G!0e(Fu%G
zZT%Q<A}wkk3-Ak#qXOBzu1f9$gq2veR|8L4NIL0mSuldjn${k+_pT*Mlf0gb8ipse
z2GjGuPk-KQXH!qNfFHa<qhS@ZxITSmYAH+qo!x<ke$-{VWGD}X%C0=9QdRIy*_`jo
zwTvj$^z#t;c+>I6EhgvjS!(Z>Mm*>^^WQCpSzDr>eBs?3!vb<EvgZJy3zyMi?r3G+
zivjRH#R@OLEaz6dVD-nA3foVX*EIMtZ33&=jJ_^kWF(LVV*^4#9fe9Y%1w(LaoT;m
zpt3dZyzH;iiOtYbG6bj`X{F%0fbmZ_$(Qy8G&B%laC(%3{0lP35E=f4BHO|qtq+-`
zckj_gM=Cz?{@s`=llz(G?W0tA`~Is3#O(}4p*ozKucqJE(gr@8Uorkx_THZ9miuzq
z`b|*eTtD~NeatAZ=H(g@7A4VPPl=k%^>rxg&h&!Q?xUd+bD>9jH&ET(KeBLq6TrSS
zAFW(R*tibB&6!9_3QH;J0o2mH_|@bb9gsGR@vk$;WQ{s`MxR-|8f#Fzh!_(txDg}_
zutU};ME7?$qh9Tv^z`3#0dNV$xjyxZ);F_b0G1t^TIrJ;z@HTI?zhc$|8#b&87tfH
zvUU%}C*-+CM{cs3NqA7^@%B%bAWi0LJG1FkYd!D?v%VZ1RIiTsFsOFczn6+K%`PlX
z#PpY9Bz(3xg&H}|Fff<l2ZI?p5H<q^2Ly$<;$@-K!#}d!j<M#Ki8wc3%g!x~BUVf6
zrl3*k1FkM6^J&ukoYfzD3@iNA$Rww~N4eO4T2#U}S&*=?B|EW0+y#^(DA9);MoXlK
z-N%N~Sv~GyXsALp<?HUA!K{2yYKudn1(q-O3??<Fex9I;t8_uLbM3sdI6T-FT9vBk
z{s$j}RiKlk4k$^JsHHgp9!53@?JWoMxr$5b+L`#xERX{f3c$@bEo$NCsKWI?eA7f4
zRNWn}EmsU=Bs#Ep72Sg=D*#C(UNbQ8iOuncUp!f1E4=xYV%2iJa+-8qnmp))@}cc2
zG4EKXjdn>|#S}V8*T#0tBsy^R3CIBil0(7jY7=azFeD~S6cpc8hku2Ot1eYLKOT4g
z?rF09S=VXmejwq_CAI-MwKB$pC3(7NfxUyBA<e;_<u!(Z6ZyHq9srY6m``*+7YCo_
zy-IbVHkszURd=fwV*1*wVp-fUjlh2W;lYFyX?IxaKH1s{b$z+)#Z^{D*44zey~rtK
zoEx#5T1_eM^W+^O#7>0sT*Zh>?}XDD57$f++Qs<2oT)LWAcc;D)<$&O(l#anRA*I<
z30D7u#inC<BlGvFitagLx6Kzrc<W17A^8!Eq<~zuoGRxI8ACqYOnM}b%DV`pFgNx<
zIZzC<$1eKNS1#FWO^|chz}LbT+@bk+?at5~7u+KcfPS1Gf^AkV*PrqUvP!J%QDh0$
z)e7cZv7GE3gkhBdkmTOu;VZVEw{zENLq(XB`DpV&D~w=PkQ`$uTa=MHmjFOT0+3u`
ze)R|G6mpM*Vh)x7G+B(ACTiL9A8?bzNQ6sbyjfA@a!E1nk*LE`?ZWc)4ln4AGF|j%
z-(f}+FGOFh4LV;EM5-vdmxvNA6)14eyf9!N4ERjmsY;rbP=(JHD{)y!cCdMm_7vo7
zV^!;Q(_s0FMtukecDD~921XpJaRM>dWpvjR_0In0?FP7N03vPD8Agh|DMvJiB=B<U
z6c{2lLcI@m8rq_?QaW!h)^#N>N#iAVuCnA7WC%APG0^EB&uLl(Zg%Jh?T!J|8cf0q
z7f=%ansaM50F{xImEy%IDF`69taXw?8zxoo5*7D;SV=?UXQ!gnT?&nHxLjU<JxW#I
z7qeNj0N|PZB&)|*9QKmbAEPKFt#z_aY;7tl>Cfyov)H%Ae(6`ykX%@aS@6=;;k_42
z*#MB>q>U&*LvpIz2_ss~Izs?sS|H*!v*~WyVosa55#zY4FQMvH@-%`|R|g7>f=~7B
zocev+;S4`31<IdkPE$7qNtnRzni}b^&H}Y6>Y8J-^aI)+pVRlb92j`9qax<*+B<|Y
zMqeN6jUjZ@CHa$aB|Nde%h88PMEErAa*+LBi?JQ`U#L0c#Rm!VhXux~TSa7z2}8Or
z<kNpIw~1Q_%82oI8(p<2X-Tdz&jQ^OB6HZ(=UZK!y<``1|Dx}#LF=gR;v3K#9g1|%
zY|YQSE{mqu*3!CyZm`UASswqU8)Z2eb@Kkkrge1~jV%1iO|(m{iG5L`Otn>YzSw|{
zRQ1Ge;`)qDQC2h=NB*G5Ol_$-$g?7q|4v-Fd8a~ew#Mw{$5SK%arP__i1Y)(0*l+~
z*&|#KZLTDK2z{8~%i=6e0p^fzR`+n9ms12mp>8D6;FGj(=qRiQh~2FPHH(_<nGa6>
ze#ox+L;-j*2B{i`p7jUmT}fgY#eB`Aicx2{@<?2YxOafvS5Sff#8@&`xH#rY&qu}4
z922G;bEX^fZx(D-Klf0e#dpYteAd5}tfw)&0<9B0`)0?vzZI&L#@N+7ddgA#?RJ}V
z!W~56(_W#zE$bU&&A7rt)eG-7iqLxj0zvaQfp}htS@-Ihd7Syg=a=GzP928@-|BkO
z&>RVWnvaALsCw)a8`ATYNXsYK_};J+v1{xiu$Ek6WA~oiwfDAyYLqyzA_2t+{5+Y}
z(iO3n7-rdC$V=uCW*HwkaiDR0o@!&PppeR8bwPUfGZkM*6@%PG;52@13Ze~NHsj--
z^Ixzzsf8%F!iVC9N&`XjuCeBHq_?f5rRAGXxO}ceyZUUkc3lb-#ec~u&mOX5%V&}G
zoeLEMqd%eoCTU$JBfZl`u9evvIx3p5;J-)tucG<yWuSs!xF)p$*I?hcO7z*WC-2dz
zBTq<tr+{!ezz(`{%7=-`V)th%&vMOQHf>>mXz<c6D@zb}S}rQbqt7!}1Qg=dh(lc6
z;02!*^|fJH6Fl2?C!2HZpUfiMk`W|@)Gmqv!1q>Th~|wGT}+1QpSz2`vD~3r{_)`_
z2BVDcWE_iO2%Ye<3SC2oYa{l5J>-d{&-fI-3N_?cjlI^E{laXdciHnt0HJN5p*Y>|
zD>Y0msdBFRaq;qF!k_-~E{QLX>kbJv{Tou&medCIi%YlQ9|W=@k!;zn;*gAn#jTO0
zXeQw&GmRe?Dk{FqthJ_0_dyRP7>BHL`F$BU)WmT8bv06iug>*CRh`$gU)CZPg=k19
z`#!+9xsUvpTBo`|@0Dd}GoW4r{t_e{`y!o7FPlOoj4Dj%(dQc_0LXw{3N`*<x1KQj
zaD*z#JD7t!d)cny!1zfgoTIO=&#9*glK~7y@t9<l+|+2#MY#Pk-hGsRxHPXE&9Ow}
z*&OHZuShYj-V}i9_!3H${4jLcz*=L_BwchrfLPHzGmtYO;X^2rp9bipnmuRa>E3Q^
z+7Aa54Hoq@v$O&9xOr1h9cV7|yPJs10d_9vG=E??8F7YiHR`ZeTdu86q|;6WI|iF<
zE`9!OAg+TU!Tt=VtUu9?f&I&ldFw=Lag9O=548qGlU&1JaJB1QKkKP|rio~pnfKy{
zA8Ts7pH~IWpmSe*!8t1AohW}}zc~iag<>8*cJIaVzy%~hK%CH<kqyk5Nb`<Z)#dRz
zvxUL+jOxtc6b&m*ZiZbdag$I|<Ty)rqWc2SQN-T(CQV_a5l!#c@F{NO2+Po>E#nUy
z5En#YrBQ2#?PqGo9uGqs%$?;rLOp;`kUr3eu3ow}kiG2QQ1hj*x4~a_t|vV(&#hR3
zrMmLL>@#xq4&Ze78ZLqDz+g28q>ZQn5F(PS*`Ib1jG$Z=M0S5Nvg$g6gV(z>L<Rsx
zVBeX6po`ME60W)QeyeD&ty<Ry-7<I5V3^Lhg1&EkacMz!e_CV!yK-kyz_3!IpnhHg
zfL1;=127khhfzWJQJhkGgEaG1$`f~+a>UE&Jxa*(iDqx*830{&(HtE@T4_6M0z3*}
zTB?N54B;<9w6T(KSEShevM))-9FmKBYC{eUb<P5RNh=xqF9Ptg?lAMZO&Knb@yoae
z5Ha?J^x3Rti{6WO;9fVCZLC*NOFwWMoZ#Di`+MnC0EFj_8~g(>ap87@@}03EiOG9J
zbIVGo6M!c!(pppx#^LP%#u)%r-W^KT>UpY=%@FM(?<@lp*O*H#I<tOlsWqKC&JH;=
zyxFaP5s${FeoaZqKHI0M`KBQ6Q;dT@;Vj<wWP5}0VVt_p8jI^8{1*(WzAUqv2#NwU
zlfP&6{rVP_3k3s0_wm!?vZKp!z5WnFfq_HR-lqPp!1PvV?>?LB#)Od1w&PAq?%^A|
zijjUDzxI4iM92023c&r#E4xJ?A{q_9*O%k5w`}mxm~bdkL=}{QY8xj&I{&~!{vW=s
z0xGJ!?NbucEl7uSNJyu&5|UCP(k<N}B_Q3>-4fCr(w#DNclS^O-^JZ`-*;E`J7>;e
z6lU(d|EKHs?B+iQf)tw;=xdn+!N#@Bu=SqteEFWPVhTmTLs{Fk9gN&5sUK0pD9O){
zc*R^htcEdEJbS8Jyu$%>#&KOgpPQ%4O<DcoDqh&-Z^ru1CUO9a@gAXAi=P%~P;}i;
z8?0abma8#)TJZ}ylm5EGZd)wMT0=%*)NxAwiD%{b&!0V^I(G^8n6*;_1${5k1t>}&
zCuh4AqNEx!kLfEKWUoihXL@w~i4(B-)ywqrZ_X2T-103nnaz>ihir6?&YSP9z4^~p
zbrK4MLn4~o6Ls3ab+2+<-jB8|?Hi2A`uFwZCVf3=Ji&Wlj46vANL~W1nw5_H-OH~h
zrf&nWe^xpPe%rCmxPzo_tO01+CL_Xn=8{CtUw58deA1DVMH6yUZne*diLZ0mqsI^a
zS)-cj-N*J%=p!$C?Rzf*jaZA-iZ&QD=`^Xq-<89qqVSmg7n<mdu9V09NC}73QRmaU
z?=0_1Lz>0}xkR?Or)>H#r|dbtS`To7`ZC0W^ucqEF#_Oe0X}&l+H=6Sjm3ZWHI`jF
z%2y(Ia<<uq3B_AXr!a@XqHgPBydVS?obNno5SOff;C{~db+sIrRd(KN73$HnY8-3u
zzRnU!@Ie!7iTf6MjyQH;j3mS49+wwrF&P;S;J`x6W-BzJQ0wOCqEf^0b=;<&T{`%e
zghsza<0)Nq98wSeU581@k_jDV;YLS>9n=`Bu5v{;Ln`PkuxYMj<brb|SH#$j`XhUy
zNF7z8)+Gk%LgG|=q`+UQ+`)6NZXpL;Ya^1kyBlU}r$yDbZi8hb5dgMD??P_lCXIMu
zh-BOn`#%+ZvPjy;q;3!A%cG=zya_2FyNfEe={f0Wmk7+wub3S;0QkJeQ_CI2S#}|(
z)@!*yM<u~EF5rN@{EQMiV&o~0S8uNdw0okWqIy7#DHLWuo2P2eGVGd~)?I=M#Id86
zCtkVKd4vHAR%!-RrJFq<vsMQYr_7Ti|GX2#3PnIub*Lz8Z(fA&0a17|22F3$YF`|S
z<IgrVX#liGtS}Lsh*h{w)zM-Nw`KW1Qu<e)>@OfRAaa@7|6;%&156(8MGFc66LjYc
z^tB<+XvK9n)p{1<4}Q=6n#KLXRVe^)?`Q=)qSPrNYh!s87R^<WKy5R|&F;eTpV#{K
z^uB4cr^EHJnu3jr<wVWh8qn>VXc-f$__dk&EZA&-PI@t)Q-kq$e{$^}tkWAeS}_3p
zR-9^~>ce$=;I@|it{2;S!^kLbPBv&fJHM$SD40i&0Bp@la-n+_YuOnkFK5%5zD~|A
zWLd`)*9p{HFrCUy9?<`h_YqF~W0~xZz}>_wO!QH;_8E*h!I-K*>?voF-*2zyF-|D<
zl;AW83%wRlAWorA+xsT4qWa&gXxUay+ZrEDs_+mu-@)&dGBV8j3~s5n;-hx|Z_8NL
z6w6|PNf+k-1cQQxJH8(o;Z#v5gRC3!2f7YuR&*sW#Rv&#G1ndqPP5Au?QCyn=j2Q`
zo0d$a$p4c7WS@lDfSFA?C6S)0WGy$E@{TI2l5*8)RiR}uhj$NP8W7$S4DjLK&I3)D
zkqn7@eFmCgHGhJKwcQLRrA2olb-egzMilUo?|otb0T7|xQ|8O7+6zUaqBQ-k2TmG8
z>J@<QnTL8QsN2w`rf`g{ec1E)&kOY3sF&kUZZ{Eglv)jP|BlZBwC=9m12Y$;0Vrds
z1z5|9SIAr4s`J){Ouxlv!fC&N#fqY&8jMx6+Y;#eoC;cEQ>_0T9}@uhRQ5Vb=QNuL
z=q&kvdhY*&BUmG7bG~2QU-5A^79}^AOKymp{o(Q$a56x4$61PHK59yGr&=gVW@f<O
z{~=;|-yc5!s@T3ptaABSrZ~8YrAuF6^-sJ))O%3DL-P+x50F_5&<emO?ooK@n1MQc
zcf<<iZ@S}t^ag+?eR}Nv!zm1S+CPFz#K^ZEcmgZIQNO!I7*fi>_nJJ)rdsAvVeaYq
zOjRu@`9kU8kp%z>u}pvpYvCTPaD~pijl>q{RCRfLVl<dw)eQP$bo}37JAc7TtGm&d
z&paooFdQJvr!V!yitgnb{Puf;KO)XOBCrfA34ln=>51g(sFj1tp4NVrKIYibAuF#Z
z=#{&k+4ft72I#hy280eU8VUZR%VH+&K5Pr*o_9c=U69x9fzoj#&M$07p}bxojLo9l
ziO1t2xo_mL05A#_BXhB59{9{Xj32;8<IqQ>q`UOw9%9*h>v~-e--@?&2G%lX6P5$g
z5tWVzUBA;k{HLW5cgTHBO#9)Q*st3k4LDG)C5u6|m=YwOdL8i))l>oe&+hYIFrjTF
z2S9gb!jbZ}4Yj_+WpZ4p05A};l=EOA_YWCH0tT1vGk^d<u`3nrzv5{=S`kB9zq@!W
zlTb)i^=2Wn=+G&@kJCsFcV5m60K08$VRYmB1H15_<%au^y7yjT0AfK26cO9AIZ}Y5
zIu2zw`)A7XzFQv-fL+yyT2NwaQd$Fo1{=liBsSU1YUX@JUxAw5hg`&mx@wO9fb9Jb
zDc=3R-`^Q1699_VAed28FdcO2bxZy=phGzdd_VWt!`%Ms?&(4<<YG!DlP~vw5#wKH
z<p8kFM9@8G>n~~m13D8*gMSX_fWBPDOt4!5MZn|KyBkShDHx@hYDw(7MwcGLL@VaR
z`ny6K5|o{)mgSD1HDKmA_R-14E1-mVO3ErM5&VQ4Se>C+?aAHzkGA^v$vA%ylds*?
z#$`f1se2mlT;6+>*O~A*^EY~=!QA(40B3Nqnu)i}^I}0wVN@%7vwo5B<UfN%poB|y
zBbII+lwS}KRwWSt_~GSBBe-|S<GkFv{$_SVkjC-m7F-6PFybZ+wTEKn6&6O_PtD)s
zx7?5QuK~FlW`+p!jxV?Xnl`9!fNMeP5C~&uERPd`Sz#|&1iYjnv41LZ`Zs@Qpz{E5
zG`9b!6IM(W!x7^$-*1f4Qbz_r#*Qc4q<lC^p$8<2d4-O-4S>B}cA^F*&<l9FNNj`e
z!6?Ot@@Z0CWIm&lzO&=O0}2~!eQ|x5{-pb1a{#hG9cbaBj~%e7ScUJ-Zb_8q_F^T7
z<nA7kXUYGL3aIFq{XAEH^3N1UDApgRo&O6STJS>U{dJ70NquJM)9Z%>4G&OY^cbl<
z`N4BvE&;1)+o`m^(-qPsTTPnWc_RY=NR-&~UGgnNfOI^y@4?37Kd!|b`?0u*)HxpP
zGn@ny*cJmYsD13ajo^8k<id)v>{s}D>3hP^?x-_M{>1BHWB1?~YVUw~mau_)oF6dc
zDC}0vIQtv0e<kiXCW6wPIwx0KbXpu=I~wArk-jziT(4~9w?=`q$a{^ZsvtuN$X;ZM
zxpCh)Lpo(51nmL+^j;h5-UKZC$>^zo)8W#sqL65~D6MmM1{7QFw{lS01Ir;ntuH@c
zfGRA?dY-NC&iEC78O*vqh*OdiPytpp$Fd*%2aHL63@(Q*Oo$n%3iqf#v;2i=<2J>X
zUz{H?Jw4sfVb>fa2pN|r1;9!lRTtu>%wK?;*C1PCb8qZRc5Deu>xzI{pawiTNmBKI
z;<L>cLYEhM&6}*%MTB5ThL5{d@&rf)<uO>P7o4)+bih#3K#^MOZbC6~wGZB_I2mMX
zC-#YjFVepU8taZ65<CgYuWZt=YRA*ON48DP>2f&#re0QH8RJ=$_$++OY?Ar16`d{7
zLC!j5sp;&@GET>%_I2Vp7m$-fIC-~nKB*VhGl|T6SQw*}Z8G2B%%<0g0@U`xZmcxc
z20NPEuY0B9;3_WzFqc3*p+h#!CG!wDKF3ooApp#h4FUnXACC{Gzg$b?+lv-3;s`oY
z*?>&USoIaeFc=J{iIf4X-6ss{M0FwAbW9X*tzx`c#m=|w%I_qwI_Y5P1u~I3tW##U
zH<x90J&`rChPn8>R(3hXchhDifwxVZg=*IeWtFcGXMvdac<|-SR}vsd??1|P&^jY>
z+scm94^1qdApme2cee+<NCaFaO`R>wJgpKyftGw*I~q|;I__sGaSA+2r*0!=M&$!s
zaV&K!1REJUH+|GbO&fy@0#>IQbLQm(`duZS+Cb+;s*y4F>6NM@-=Id|ZoE<I8MvI@
zF>F+?ZY7k@aEM&s^H`27c4O+cOJbe-?(ROq5@e!E{%@{$&wY>pAS&Vlkeg(06M!Z}
zU<Unnucy@Ez9q63*yGchB4avMkaoY2E}Aloo9+DDq-FiyDt@uzAW%Ics1F_(_KgI7
z@k4EE<T0Q8>*VR>yOsHgv8*rw@MK%q{^8G(UI6+m8GQ9!lGI(fGlY02uGVvuDi!C$
zju~H%Z2fqoWd?hKV5-xoG@Hw*acZ#Qdxzbu6D`~{AjG`5L>D{_HwO^TrVO4E60UyD
z3_Hiow#!fr8CA<Q8TCR%7raQ*vN`JTIPC-$M>L*K_ZbF0<G(q^Z$4ZQ;Cp_&lq+-{
zPqgwbAAc@oaH2itAjKiUF_bX{l6QU&m+DS2dJnn)lmV&vN{0RKhURM}T{-tG+$^gV
za}`<6GH3~3>emD>*@!ON%Td{lK)iXy9qpRmMB~#bz6s1z4y|(7TcwTb?K88}3cW_`
zI->s~N=#Lq48DF1ta;}I-)Ns7jE1I|7#DF`nH3Es*+QO!Ph6YGQ_@|S(GT|E6qwN^
z5uI)sQNnxKZ!w%JP3ETE$bY1Y<rn$p)&uzl*%*42US(@N-(efu{Y1Uu`u#dK^MWr>
zk8BZjH|iXBRC9=u@t8CX3ArqZc1V|FZXs9k_B#_D$7he)ozPjd-b%dPNO=W9O%98`
z98u~VqefKT#|3`}fOYD>O=6mpCU6ZAInG*tchkDr@j>qgRGa=u?$B3VR#gx(x=?zU
z<n5K(3Ni+}yAGtdR*UBHEhy|ui_PxW=Yo-&gk~2**`lxF)TzvL_<U>K98oGo2t*m)
zxolBSsH5r4HaOc}4}9F4#iZcsCl5f=tTtUM%cNX)Sc?3SMNyZ>CNK2~?tfow6pL2;
zCJ5P$CZ33Bubood_OK1$!b1M{PyYLU(NT=-;9BfCLbmevrCF8@#h-n;&Vn8U2q3Dv
zuq6zeU7V$0xsPjJPI^GX4m4#jct*O?N2xF}_$u&6n84*~l;LoT*Lg}4R7Pp(a4>+n
zb<U64VU6Iq3+lo5-YgT_s5_9RI5%MuC5&5qJ*N00n@1N_430rf5YzU3t;vm3xq>f(
zR3SBr24LRyczh`ZitBp6=`_#3TOs{8UuB^=PI`Q!VDd4_WTr|MM+V(q6ltYKLQA7F
z>?uCdH_@|jgj|Nh-WOZeDBq>V?~EvbiTVnYjAhzpP4GUv?z&s+gf9|yzxU-yrprFu
z2TJbO)H1h3t?c;tC9J@z;E;s(No2;}Gje4(E;>xp(i3==ssb*jr78|Vz+!aF(R)Os
z@6Xa5)ft!07n!r8NMMu0Y@5S?ZlSL+6is6v%3m*Vk?x3rx8^%Y*;nI?v{^JNx{HxO
zI-7{CQwyuEE9)Y8AwyV@Sz5EA#D3i5Bx7tX$N^?k#QseBOpWaw$=*yg7j{Q$f9hSa
zU>KD!%>TZoFb}y>KA_3)%r1QYkV|x0Z9O(I3DgVJnH&a?vB;nwdU^FD!hr*AN>hD|
z<u8uZ`$c*LGOqoIGFqe?N_9T8=4Ym+7HGd%ySy++asZi(WcU#<6;mLxs46OcSTrqH
zp7qR;PqmE2!<`zI+`q&o-WW_av&62Z&N{w%t{p^=LAW~~&z|{Fa{pZ*oXkhJt<hTB
z)ejtETCsIsq@c(X70y|Zx;T`G-e4?0mXqrF;Z*Cowel2eG(WipOxEg$1Va!vAAYF0
z*Z#bhdSlcFLqkd~sZ_TOeg*lh9XAIeu3=Cg=4?TDibmsfoxl|GrBRI5%h%o&mU|jw
z^^R7qp$_PXC)iYCI9PB>X5!Ist?<4m#JqN_d=9&%E44~LHX!-qja&TIg>@>OJ#rrE
zVw*Jh(&aK7q3PF)Jcd1AL2-`0FL8gYsuU>q@V*u(bNU|7VG?Np-}DvXYbNg{3^mxp
zsic}}RcGdfg`GVg-pK|FD*#iIW$(T{lPga}a@1jEd=ZV<hw)<190^-ZvYo-wk~~-|
z)vP%1Dusq3|Cwxp7ziV4ca{METBX>nRQ+VPe0`AbAb8sZfkA*pVJWmHN*1W96a^qI
zbuYqvzV!9wsdRI;#;HSdc41l~L~<9t@IUlz($nbXq>lps)JqMrFI(`qUUSnnbENy|
z#Q*{hYxl-q0nu9!kvNE2nY`UwinRO5^30}U$$aB$Aa%!dQbO&vaB4Ev4`h{Bzw`w_
zPPtlC2pM%TmU4W<Er3)VSKDVad+~Eba+2-$DY~I&jJPGbg1I{~_&eeF|I2;Ady{(x
ztni84AsZ2VBOYya<CIumB%qjv)7JVg{MY?e*f^Co_bTnHPb3z3?Lh7q!Syx~>H2Hq
z2w#$H04S&TbH}Lj{!RTs6MNzd3$}}w0zaOK46n8`V+ghcQYB}J;|BUN-Sd`(_b0>;
z7_(0YY5a+7q~d2Nk_c}Xb>=Iy#e^^%g<GJi6CR-p5%CNP^ZS(Q@tQ<@aeyE7X40v^
z_<$aZK}c?bPdy;Qcd%*HQvU-Y&R4YQ`phPO)Lq}E_>mRH+taNXt|-e77G&>412{Km
zE3!TY0vl76KG;_XBZ(HTVf7Z-to6Pj78rUixk#v7s9Kb#B?M+fD*Vjz)zam#6~W@G
z;5a(Z<^|+EQJupU7SguF7qT3qp_HnGl)mmyrFk*<`+bhX$Ej*1)Ths1{%GKAJ`_!o
zKuX8J<VB^U>i$9xFNf7=RSZJ<F}voXz2oftJcV5Mw89nV9e#!cqQBOtErOZTkM_Xl
zM^r%n`cm5f+vPmDNDGJC1tN(5nWEUUcE6Y6IBOHn)?t4<<#nX~HqfJ#BQ|ul5+;<;
zH&a!a!GU;6X3V>tmzi<vEc!R4LKV&jbK9xZFJeMEMbk?xdoK3(U;jr1HEY9M&eMG1
zp;f7PLT7iU#Yek@zN6Riyax&Q(Ep@$SumPDI59=^BlY$~W#M2MMf!1_oADd*7ckWP
z-P%gI8eQ>|FP-rbt4{&n`^#`z3&Z8wac-(i|MxBuGe0@RTKjBn8giUOyy{O2w3u<i
zQgB^S0D$1o#E3Vx@1vdB{HVQg9>OJ2zFOZO=INn$ZpP21bvL4w<h~ES0+M86QCZT+
z(RQA7m|u72wKK{yP9h`cCd6L_ab<||I0H~~vbmwe7I?lm;>&d^%^XR|#c@5CVwisY
zsa!)ZP?1b44ymZlN7poj*HgrUnnp1RY8|)*87!p+#p#l(G*H%%=jWq%>;h}3$wg-U
zhh53v%<=152eFDAca7@20tdK$ZO+-~kJsC$wa<QhR6$I0K{Il_?vi}*p~!B+-dnP2
z%EOa9J#m3Vv>A;;#%4MF17;H^@2yj_hWY-=)AVLfm$^%W&2AR|nqr5&>F=(amzwiO
zU+mleAyr;ka5o_|z&`BhTrXlr@%0UtR9ZSByhtdd@ZVo8g1_vzG;#FJTN_Jk`ZpdV
zy(dd)%5UEqza*@6_7zG)kNEiV9yl4*bFDt8#%2Ek=tz9x+jWfX%Z`CV=BvuvgRc@z
z)Be;~)CV4o1K|2EmVOE*?j80BOFwRe&NH#vAIH6O37o31RvPaV8WD{PPkV_>vOeqC
z?7T;M#|jRhM24f3!^t3yttb^n{;*iXW<Gh?{iZ{}-$NomMV0@yCjU+5XJA{C<7=}a
z6$IVA1Wq%<P~IzJrED2okoaz%A4XH&Biyqm?S!%KeA{u0Q&?6%72=3##%G0Kb)vv9
z`)0iqeOvYj8Sm{8ele${7G*Zp$IW8}DRu#p9x(|3&x-TT?asa2{o27*hkwQebBif_
z*ix!zIz!8U!zTcl906E-{SjyClnaweo6k6006pZ531_C?>!zo%B$Cbjm6C{DHHzeZ
zPIWG8?h9JQQLiT|UH6CI*h;^Mv)5#zdOacGiF~RduH!Q2cO|6~DtLM$`{G?*-#;WM
zoCn%-g)ZM`lw=nD@t3sK+oxO>A&rbL8#+E7djHK&`^yPqdxkMf)4SxMpol;X9>2{|
z$Z%6*iMzMbL`l99LCE3A@~bHzV#%O3#d?Q5Z)WCVG*P)$fweYtAr8kmXCo>q>2;`;
z>AFljbSf-EW6Z!i$t#PQD)l(Z4ZG#54$O>C)+=3!>jR0B>G5QbYc7`Yq#w!nEeFG;
zV@EoCv5}LyiU)nuHk<d@VS4&y012l+t%QV!@$v^8gc+kixmda9b9gydlxKLg(yXS|
z@eE7su+2)tuuZY0qqVDOH>(a&jvoejr$+G7)u`khffhlhhw$C)8^jkiFa!7^nC*OP
z(g5^*1_7VL>(S>Tp0|^fEHR%bRccAX!n-$Nkx01#NJd!bH)S}cJKH-SJ-bg{mXpg1
zNoE|n=jCp^Ys}o1o-A254%sdn=Dr3a9rd5O+cwJe))yaH21c&i%wKLKx^}43$3Q7n
zL-#32anH(^FlphJywxS-H1!>Ot8R?CRh4dY8ew{yfrkBe(GfleBrI1SO=jQH@~%s0
zKk(S?CVW7E>z}UJpN6rN1sib>n}_69Fua~w%^9H9Mu4(cmzyPjk#>1!e~Q2i8C85L
zS*#aXC!}?b1q2ehy~wN;O|sPzilPcu-T~Z-n8jKaINC74s2=*0da#PWic82}o;~fr
z*QwdvL{!VYCUt5N=Ju^H=)?1Qk**B*Wk6R0exP|p4cwscM?{<bHyBh!c#;Ws*j^Jr
zZpE<vrEzg)$3Pz7DRHa?J*~i?w(}HXq0*Wx)%B@0>J0vB8*RDa-##iD5dP5sz<7-f
zBt`2#LwfGd;^N&m04$0zBuU}}skYgE7FDhl#3IIgX0_TK@%;nh%JxK&S#tJcQifpP
zSL7nH^w5$8HUcC~-L$K3A5|Ab83+<<)s{K$Re~~}AI{X_k1h>``}5efp>joA4~z~y
zcRGAOmTRSRFV~<TAuc<0<D`*@rm!LQMDV~FZ)<t1qjsh&tqC&|OKtn>cs6P*#?RZ7
z^3^7jrRnz1k&Dn9tA^#+e;VArO}8wt8JFhteB&SZcj+N>y|-kF2-%NkNo^9}T>>JM
z^33&L{Ne>>FSi41YI_BnL?K+~et(}xA!4#!XUG{yb}5oNf)Z`JCEH-Fm*%wrrhb-;
z#!a|X=@K~I4=O%@-p&&P-(tRDs(~uKdcPK&A~osF8|X`3=e|kwqi`^pHy+pn)5c*u
z-104YSj#a8<8cNvzQoP~pTndrYZ8xHEGmoR;FQtKKE{iK1i)3Sn+PUruT}Pa?X<7I
z70f=!ia>0q5KoU-@;O|G;Y-lK4?kqRH4M3*B{~c1Cgfrio!>i6w19-$*eqSKx)eqk
zE-tP(_*G_Y5e!0cmBozMif_0h5IcndOT+16gehkLBDoA+>2{LYB)Wj-)&nR*1KtfG
z{R~f^k-%NmAIT6mys5E%(dWoNdUk4y@`SYorS4oqn<$wQWj>X;hHSf}#>p>Vqq3lJ
z(2&XCx~cXZ%?NUzbk&ZAtu$zjVeW;C#Zo-E0)YM~9rq?pKjM(|Z*j<^8Pdg5`5vNZ
zdK*t*-ixS`<~;Cxx^>wn;&+n;{EsjR(yDu^v5ten<B*w?At5W5^G!@#6SZ(!_K(NW
z0Uv;gO`}&>NH1;-H4ww4_%r>;wgi#k@IQjR`p^}n$QFfOW$g4g&gue-I|OICfF(Po
z5@943ZBwnXNIz(N`*!Aw679phuLn$WlMU<awm#G+a(OnHjAluXbBg-i8-d2piO6Dt
zkFZKuXMkY|Qfa4Zl88yk6ObqpO~Ev<<ddx_8*eTxD#M`f^-5<*-yCVXN?e7x$&AR&
z*+p+mgl)_Yqb9Us!MVnhtazXWs5)nEElv}k5wY}(I2^nYQ!-Yiy}g?x1@Ud)Pix6J
z{E1cptj~<AlbJ8`FL$VuE3*zVLBLvauDG3c>!YyvZ)U_lFczQ#P|SW7tT__bPcTMR
zULN<c$o2)XR1I3(a!Hi%HKTC7QVHeFUuW57{l}r|%eO2zW%wwbzn+5qyQ2Hg;osmP
zt-7Xm+bXafyK?CD-UZbt@3FBgj5P<J%qb^@LzBmmnTvFnD0mkRNB2ZoMBurS!7|fg
zhyYG7(}Z#mg6J{<f8Q^U6tk7A)+o?Ea&dX5r1?dWW_4Lca=0*=NIBb-2HDv{^}MO!
zU<2qJDSgl+H`Q{7&$`nO|DACMF9wOo<gsr6IhxSTVcrlr)vhKmudr*M$6xTZwTBWb
z6g`8EYCs2>JTg#cw3gbJ_oY8dU;(qoDkiL2g7Ov+IF#GA)I!p30l49Q3`{$6YAmx5
z%;%F>)@P!RL)?F9DW=Jh{?i6AS|RS08<9>W8pur@({{^T!OQD&)kWW(!0Oo#ymp(P
z#@>&5Kj{ww(g5+m8lbrR!i6r!jZycDWol4_ht2@|3|RaQNY(5+zwFZA;XO?rS!Ou(
z{}{HB;%b?<Ln~hruW!L2?}oe{L^k41YEPPeAYWiJs}@#GQnD%Xo7atfud8N7=uRL>
zIz(YM3m)<Z*lTcXeB=*@@e5F1tJh*eK`D8{r(){6;N2iJnU9XnYin_`l1Mu1{^&DR
z7KvNq`Fg9JK0?7<82*X#jV|gDJ?7Tf1?uI7=G$a&ghWPK8nnyFW3M{+fKI65TIE^q
za18oa)&Aj`DusQ!jiRC$#4;#*5TVhRP|84~_<-|9YS{8ym$eu*bEg;jpW$G>_ewKY
z9JZ;Pbck!@EpC4z(6XghDOfEFM)UJ~9Z&|Kd}9R?YIOjMjc3U0X4SLPm&4JkWBt&D
z%<Js-Oc%O-c31<*xQ6%6fRi9ofEPxF?9PNLBP_5w1Y$?<J!GF@q}HMP$2H5_(v~Er
z<-ouK$;)ZZf@@s0w+Qq#uqOWL3bd_fJ0MLXdeBHFh4PP^5xPG-2QDVI<F=t9AW={Z
z?RX$B1Q}-&e=C&rh9YbG%{DLmo4En5IUK*aHoh=oz8CpQc%26_`TmX)q8H6b*fgD5
z(eGl<rn7C0G($bf@XYLPjz%g|a@TNa4NjW&p-&;&?{apiqU@7*`Pkj3IoN@9bk}b$
z2H!I;ZDO^@-McdOe6|a1Jhtm!`JTy^sjvzmBa;TXgR3m(OnDvmaolNWq~|6qrfZm$
zc&Xl`;iNAk{Y@H`xd9I`5KRVGkjf3}Z`$)O<CTYTAATJZMJFwr9Pq4P#aU}eK|!~E
zw5GjZ=5U|PM7izuTtVfU3>SZ5K|>V(@nj$(3iY@vU~w66>nlQK%qG4CCPgX0OC~>}
z$g-BB(4g`@md0W$szfvlcWXuSC2+q!ul!OzRc_d^A9$sac3OdGaV4#t6(z^pbGkh@
z!(lq!y^B|!bLM$hPoTE_%=h?w*${R_?%C3K5-jr7WiB@vxrkeZ790hzs;UY!O@Ksz
z0aJ-_6k*Fz79(?~UhPn{#Wb{y<%@+V?!S@~CiH@V)RW&P*xObfC>s`CkK<y=p^36)
z0j0NuoMjl>&2;~Sfkdvvcr2`4KvR6wCS=MRfuUBex!Nw=D;GKRegT%z<WhZuFyGU4
ztaY~**dh@|pyyz|V2Q@RnfBJAhMMzog|w)qx0#E+&e6MjV>U-Nv+7CaEiC-oxT1}T
zB6gsj<*xi0JD}DQR}LYFY=Byz`gB&Rnm<CgCpGRZ0)W8JDoLunK*piHAn2aK>Fui9
z5Ql@80F;Fi?r?L|wC!VD;rO^%Y8GLXC@81|?pn4u)ENc_`GzKbF3p6Gd{bv<7n?08
zP${vz-KgF8V2hOg$ST~v;CgJQt^p?7d>$m&a1&K%AGuXGVGBK!)y#f-)8S}!b8)0P
zdvQ?GRJOnpFdz|1NS%)5I<4ld03?qF%Qh|$^!UZweY;3pzfF-X^h8ifh}pKd)69XP
z&XkbC6=O2dA#&-LA-u2uk-M3~268vcXfm!tx5F&W!`JHPXjL8W>Qo16H0{6rmg)KH
z!zS3>*McKW>uGR~B;4CsQCi$oHGZd8eLDT0QJ+S>Xd^ueq9RIkpc&Dv8-81Vz36gz
zyk<B#oX#y9e@ePFW`Xb=X4Vk!SmVm>6drLe2jf0R6Acl8dIaAjEXFtd3A!E4an3#t
zRU2>H7FZIo{sIX<j())XP{ekSXXESMa*7?Gd~#O9Zs7yEjfN{hoptXRmli7CzrvTp
zUqTffqkg4v6ZtKL!FFX;j6rVF&t~ri7L!nnbnDrkvhNG7z;1nDbfBuXK6jrXriC&>
z7|H#@n|#h{lZd>D1W$L~)LN5}3Z~31@=oxp-dmO)tajGEIQ%&4)=|A^+UQgdom91)
zgP_tdsag%1_~ISq1%ibLhV~~5OvHl+XCNK+y_rgMm5?=_k>tT~Thawz8ftT$5JJuj
zdK_ADTBpA!T5#q5u*H7pNTh#H&;J$n(fbNFfdd~m-KC3(wo~7VCk2sgc;v5#1|HjL
zr-bQr0)^ndx>G8wBD>AW5#B%|+y3VxX_P365x%a8y!NK6L|C}JJ*?IrypaciWn~%V
zdZBFO-!XhqF${&_vaoOSgv`zvm2w9?CFJ-tX1(h)tIWUa4(&&k+NN`e`N|WoY2O$<
z{wW(<Eh<`xO2E%uu<UPp{PJ7+2dN4Sdomi9=F>=m=Qd(E6f$wBL>%4sYYFjsQIi%`
z?faOpeJm2bJRRX&-nH!{Fxo8M<(VFIUxc;=JfN=LMSlAeU!-+kY`K87Yy2kI5S`+Z
z=bcaFxrNBLSlvH@T#V-%Xm^QI%+%jR5RhAPco4Gaj<&onYGBt&4R^~yobfx<{>p$j
zvlcX5A#9RA+l4Nj`-rdUBO3S>hXh96Qv4FkPw91hIFt7?ITo6k*J7kSqZCMfh`Ld7
zR*h$|1cK&oS0}RjEU{?H`>3NckYDEXRZyx(Wqq!jPNr?A1Tw2b;eZ_W)J+Vkq#vN9
z*aF4AiK1OP%!o^qJk~C^YoC6dWWnoQV5Cm#YEqAPCWX?CblotSSJHP&5ef>fPFhSv
z*}gZrHRf@#5hCZ-kgM_p3^ih=YJhD59&5T>!DY|`@<>~Mq^!xybSL<x80@3vdHbC7
zT5L*5AN?=c``eqt8JfidY@Xb`q%EIwP6TQJY8fh`>5WuROJKcB$bjHt3vAJ3rYQhq
zps`D2;jlZY+Z6GFS_q=A02ZPee_O_?tMdgGLyR9oRXHwPB^?f*;wFq$I<HXstLT|M
z37lH$E2(DzFyZvlr2fPXZxy=JXZBDxF!Xk>&NZ)Tw*<MIKA^N$b?$n$K&wuMhaw`o
zHHRNbh;Fj7PGckezzCKFA`XkU!gnc8gb>X=Vy*80dUU=U!jAS)$~gD%tZnFYTe#_=
zIlsirK~3W1iuR;ft2F&dPifh+&U4tbus>_kR-^k)7%s{@#K4wit}0_*O~{9j<)BV(
zgU_dF3DF<J6$4I}ShwjuS3mc{No)ZlV~-{D&6XRDPcm!N-vhz-B~(DcYedAPgy@+d
z&fiS!Ux~8S<X^Jpfq{^n8g;`qc$Yn$(zMR9axB>81pAN;_HvK@)O@t+K~S9w_8e^_
z1qYsw1oncSJ>;)-^LaHKV8>W1VAU#$h<HiGV$C=saD^yV_LaJ=bZP2^oBjNTSHJ$~
z;adwAHoVV5u%XEi>~Dx&%kWqZxo7lu#uxpiDE{__4A(3AT1-wdddWk+6}+5A^}Q?@
zo46L?>a0$<%!5fj8mRE(tlbzSQFc*2e8JUN;i-_^X&WCMu-EL|`KiZn3HW*qX_gZl
zI2&*%^>9MCmiiYzT2Ow;NZQ2*o>ehX!SW=RBJ9RM%aR7imGYs3A%m6#v>^RTTDv=i
z{};)J&KVl(LL0jqEcm7seK`$h%Cb<FMhALLOeXO7L}gH?6H>gvr4#yhdjFwL(_ro+
z&HXrQ%hWDn@To_5eF<OPwQXu13=OiC>_ZQ6SpN)ohM$E`9j6_xIrcZt&1Ne-8I^7!
zU?GT>f&$rSmg2RgkZO`=vZX+?_Ggft!j<-rRTI%erzrdgi?;m8ZdEr&>spLpADq>Q
zzIF!C?Qs%g1Ls2@XgNp_j(5+fE0d?XgY51N>APru!muLSjDFqZ-7{jpw!gWNYZ_<5
z<4Ld~b@Hz?z?gRWLF_SiM;Bf=N?O@7lKq8#LonhgG>P<sHioPk?#7*BqhfDAa?fM<
z4jBpx>h8`{zcuJTh$g$q2%of6&hCZ`%M%B3s%53n)8Q~Y@RV=pv}L>l^3s0Di{m^(
zR>Tz}{{$0DnnrPfeSx4*hbV)a%|P)u0|OBQCJX$oYQuBi-PUlvA-<Zup0Av}{MuP&
zzrkZ+Bju#gYCnaix*)&S-Ze(K=X`G_yFlg@BvmIY*7|y-YUXlow)x|c3=#{aBnnc=
zF#!z5Cnz{FC}>1ssQ<oA3xb;{o{4r?&kEG@wobPU-LP{`qU&<PS`jlD=y?3w-vb||
zed0A~ok6t1*~6Vlv?8rCFks=*?NIbF<~HuJ+!xKT8A}mazj**rwt(X+9BuZ}`$zx1
z+<&iZ7cXqLXmZ>RPfXnFnUwbyK&f7N6^w0Po6m#!;NMG;@yc;XcLg2?QuaE!<rU;h
zv(x&q(}+_hWbELz<IKIwvIn3p)7?w4AN+W{aA(UH+(6oRymbae2to(sIMh0WnTwM~
z^uPD?*THz9A?XA2zy{O%%K%b&l%ax5nA78JZ2Tph>baDR;p<C-q=;<a-%k??#*aFj
z=MV>Cp!Km?Gz^?o465B>ms6fR-!OgX^ji?cx&oKkEf9>dIvq3Et2%bAOeauecpGQV
z-6)fe1&W2^V}WXNJPh@NgkbdAY#GafxnpBy##WqPQHVIA?hJf9bE}2=&=EZG3bxLG
zF`6#Ezl3F}6o*ugf#R3gkpP+*((1-v5B2|DNa-}r`o*B0fqV$U6eNRsMa<8_vl#yG
z-1Ns$1`FFI8IQIb=j;u3;7-+qhR~>Ra+<(r(+{NKT#9S#x-@m+(vD#@2eT`s{o5fv
zKU7}S>9prmQk<>9`G2p~$^FKQ-9oLFZhm%v@k5U#Q8h`m0LWQ;Zir<inCRaQ&Ky>L
zA5B2uHtGNZbnKa5+j9O*EdJz)_i!02V)?IUS}`v}7befxLLH%HJoK6f!u}!+C-J{s
z;eSX2;0HYa|Cj*aHC*noDnkX+F%%i*K*jUgWtqlgoz8eVg$KFw2UhnJr-aEgE}-AO
zG`g1XLFVv;=^&vgFf|=Tkx^0MJ*^OsT1aMiso2!DRwtJNaIn_pQ##HEjz5hJNgstD
z_ae?(dmtKzOAc5{VlYim`T2KlPrJF7l0Wa<UML9JJL-mI6^53;wsi}$r!}2Fl)b_l
z)Z-{b5FL#3Z^!hD5Oc&sbQ71rcU3_iei~Mo5$lYe1e2K#q^Z%pBNF_yRhAC~AsN~8
zj61hAdk!96=Pd8)G^S@}_M8naN?S)uQWHZ%A5=WTX@zjpGu3@psEJXzYHHx9Bfj8X
zK{VyXqZEBZ>iXgsp3bQ5v}ki?!N1hO|1i0iH&y^Vt?ZY+3X2tP)%7Ps-}R*uMDk_Z
zlC|2Skgt&9&WSE9t5=o>ccyPu3b~~8^vboBKcnTx-9mt-S+@r?Fu-b?{9Y3iFQ#ft
z%#PdZyeioY$3JSLhoReB@YCE`=L~A6qR8~DFT*}aW?HXcDC*>8rnlxd&orj@GG{CV
z+&xv40G(CvSatyqe@P!xUUi+fSoj)bHOu&vD+j*s9tov;(Z%(#%tJg6<;9FKnbj)I
zM3|-DSDNl~gWkr=DW{xvM0!oF%~r11e}PR9{jHLg{2!L&USx!Ik@S%jWD>2J3>%(-
zoI>|NC^AL+M%Hy%lC0tzq2&<k86UHnOz-zJn$;)fjpf%f)6)i1$DA1}+C3eQ=zji0
z4ZlrrnMF<b{?OS&Bd$JM%&|8!vjUm_lpP(7d@N_v#=sZ+6!>6lC2zAeMZKO;munsG
zJ27}_N;#zeA=_VXAHO0aOyh9=;PaWv&)fbun4wHVyemkNAbJ<y%HXZ#bc5`K)uj25
z@Pi*FQxJw}^RL~N_BloPFarr|?X9HpQG|Y){7U3ch4H^<;)UU5{An}`N$)YQToys}
zG{-ERW_uJwaZsi(rbv^Zy0P?H?VA?MzyOm2`@c{E2IGmsj1D28#CFW=g@SIEts<y=
zN5cfS`ph`q{a&n)|4pm_rWi<5?mo&;hNmX>J>H60_MpSB7P73@&i!=FWj;#*6i%5K
zbstvXSF~Q~FSqaIC_X;wF?Whm_DPq4zW(;|Sx?%yBx+38L&{(ijtwR{gCM$&J4J6r
z6p#td2*DnYe8VA}KNPaxRLL3e+=SWLl`0w<8rh8kNsyj>k%tc&gL=3`2Y`G(jY|N~
zNruyS^MCG2w<=B_r6}i67h0cRg^ToD{Ht<ARFE-LD7)4tE&1M9+vx~UmvIHtKxAXM
zT#8j@U^r$EKWg%+R%uYb4%Q0(#Ul?doix}@DBe$KfBjIm|AZowPc9_*AYnzZx)Bw=
z7%FV9JH^~9Z5%OX<Op$Ib(1jN9o0??BhMC0L1^f5e`6%l3vQS<^`-W^u-7euy+cBW
zuWqoK8HJj&7FHYilEf!=$u%+-HXYSYpVqfp)_vg05fac7(pO*`jDE;nNGrWR<7c7L
zvn`#T8QF6}b#oJA;3$#&M9g>k5)|xM@#zH@2JF0%XK@3Ylve?Q8DW2aEWZh8HrlBc
zl7Hu#>>ox7rm{CTFI?f2wyn*ZW2*emcAFPJ%L_vRPf!N=L3-CBL<D`B&UWhMP!Q}O
zsy3ox7vu4$QKAI-Xg-8kSJJOEbGa$*o<55IX1ov;?u{4itP>_dbhn%6dKA6Kh{mQ)
zg^hp*-4M&#2(BFzu`t3g^nZWQentxy$uETs`&ZWn>ero*easyc<5&NAVPLRP(~A5q
z`G|e@k!$O_Z`I_K68UE>8X4nfi?^E;b;k1n%ozxq&@Kx60;LQqMi=UrR|Evn{ql7G
zrq|$TWr?C{M07im%MBGqqj`Dp;x1n`*X*4Kai1G)z^5+8wM`<NN64xjqTjSZ%1GR4
z<=xY?d&{+lW$m!%vKE9>M>ak*sOhOqsyyE<cyhp`uRy=sLaFBSyJ3ZbkszZK&i6r)
z(I$}pW@>6Fd&4M)u)-J>IkW5?Z9WHj_T*b%-CSr8Ul=4Mtt&i)!EJE`aZzZ>9s!`v
zVc6)F&!ez-QWrCnM$$CRO}qonKs5evQ_g^K-diuvMN&G?LuPMJs%D+ILc!sKOikPj
zO?`zjFxrD!NZ~CE0kjPE(^Gg$;j!5LkQ2j!H2vm}nJ6CV=m^|3uOCf9JA5KuMEE<W
z{rXq5DnfUfKCJiu!_2(hY2z{0ihy69vn00^kh=-%OOZC}&|y*SGr7Q7e29$rUT9KY
z%?|0V)e~U5Oztaa(DFy|>R~23<T(kQ5s;1BK?n2qKAVcZ#Ud{hne$tz2Q><y_bG)<
zmcO>6K4yQn$xbW2@j2)|REc=A3z9%GnD#>8FZCa1F*`!If%eSf_iV8`(!8lUzKI1N
zla(W1`FW)4B!gIP;G6Stn#p|>brDGZ%~1gkD;-6~?}^YjVEbm=VY2CogUesb?EBkH
zO>ka3+d0?T_%38T#9e&o6-N2VJ&k3`4&PmvR3;z&^m-GkE_yR<E7w{6&C?drL;v~P
zcM{EEscHd(5hBuSUmx^maJ+;iK8?1+HwGc=OX18B2^|weFMF6+%-F_^Nab%H?aJR#
zKXdcesd|b4Xd%QqMbPdKnP2)ykpQEg<r`y_=cIdv!S{o{vm@7=COeO?yCu&HorSYz
zV^6D{O_(|b%Q|8B?Dwz3Js%W}bR>N^T0b^g+z$<`fZwEQM(kFOm{+k^t7?<nbsJjy
z13@sbyX{-?XZQD{lai{S!>31K%U8evd<}japW9N<eph~24)=)mp_e=n^lql>Ei`Bs
zuC#D}N=5fFLWHh9rVRI?XvQw?*JD3_9=AK~6gHHG0}<Dsb(uY{k)jI)NsMq@9wM<l
z(?y?zz5PUz<{y*ozxkpr#4>Yc)4^ct#h$pUMYYLv-Jw9VN2*7&;*~oaZAUP2*@H2%
zT@-L7MOq(4@=kO>B=-@zFZ*$ge3H+D*4&0xE?Q6)V^WiKStf%hKQ%A1T%Nw#6t_O}
z_8=8%N5>|{f?z?)rlD>>37wvU(XQNY8bs|vQDo@57#~#dh`$v4i%soW(tT`kuC6dQ
z_-r>%lf(mSzksBIXq|og4g7+`Rs6xpurKl0-<fZIJOu>fFm?GF-Q#oWl2Hek{YqpW
z)(M?LNxk;8dQB1C4pX~7J17XR1O>hW>n@b&Ih92+?!$gxF(zQvfN;T&s04^ZEUx14
zA)Zwo7HE>fQ_rnurbsb9$vf1y3YMZvLIG-~?2KXarSlG~N6^A@bs$=QJH7HU=>-Cy
zVC>GXE2O1rw<T*Q3TJEIG=CCCpB&1dE(C^NkrZUwS|7|RY_b84Y<3`FnsUn#Nva6l
zLO`xt*h*ZSz82Yvw@d!D9&WrB4nRzyMf8{ggcuDgJA^rL#}Vz*Ah5!G8((Vt<K|W?
z`VK3+NRj+LpWr0Kzg)imNqO*6gkz=wzS!eSM=n6+)Co{7(-A@&>=2qSAu#RXXH+Gh
zrJ*i)x%+yGgbBPypY$=!wDlE(4ucDLye!fj7P?d&vr)ZST&12dRk{F&=;T!0LSi!m
z3lW5P_+9j5bm%K6`Wt#Zq|hJH09WStE^_durWu@Lpz!6oL%(=$cj)%jtCbH19A*7g
znmxCt!RVbGG8Zj0NtkW_5z^DO7RZ~P+nOiz_1mP{0z=!amlxC?>Q2q=%}xh{u}kg1
zAD-ev_P*SH;F^?G+s(nLD-S@Cc|_{A>irOlwfsrs7q{3<^=v6m0B2)@`B1v+ChC>l
zoP$_(`TTRPi<Vr<<{to|ciUXz$e{2^*4o-kz2(xCF0!3rdHqPz5H>{)e!{x4-4F?}
z*b3=X_@c<H7eB1!!+&wK=_f_#F61#bT5-xGAYFrrJ2xM-!!%G-R`gw(Ffk!JJ6mOX
zhB)LV&I3}ARh1(FkFv=Ei!dQAduQtY?Nmpm3@z-CMe;ksF0`vcvaJ4kE9q6N(D42h
zh-W~|Zw|~<pWA3+b>)5qX_~$}`?(<jW{?NtM~cwhiLiz~5aU9@B$NHg2|ONn`U=OG
z^7}M4f$vjm>=T)vfvm-+o1ITys8@T~(j3~m<sqvQzOXArA<@DodIFvmcOmgq2TOVu
zqkBq1T_bzHKfJdYw4?&G*3Dte1?-0@;hSXGkN6i`UA?D;f1n)t1Dt~M4e<GL7m6^n
z)hoWD$P_cYe~?Z5p8dflRuPn;dDz#$flaYI>-(<N=+bB?XL|1Dk3vGb-#k5itEfF!
zqSOzBPuc3_tQMp1X~3zP@Do3KH{Y~H5{UL5U24N4Y~$*eeS#%AL^%DYI|VpbUQPM1
zL4fhiw`N6qz@3MJxx9CBe`y1MR5n_53p?{ycERiyj|}sIfqc<iu~Hf&mZ!&npAf_<
znrm2C$>3NxTUDeUTcWj*8~F6O7CRj<$Z>n)VDFk@+;jU$I6A1P4M8yU)6~m~_IuXK
zJidW#?yx$V={?ch@jTMG!N2S9lts@lND^$fs6GMI4J*kAmZ11bxiJ#pm^C~caFX9!
zAK7sz>Zjncr&BH!{d%4n@Y!0nUF!PE#Ve0%o5jnCnRIF=gnBQmDUtD#^v$)xM@QGp
zIvxpe1{08TLJH5G7oPfml^M(C0+o&L6ct&Nedv%O;MWhAljf>eJ)`3cvuX4Usv48A
z$R(eads&&>+u>2yX9m;{N5{u0Rvez}tl-zX3JkKaxTgykhlO6%&u8dO@;J;#B<qm^
z9^o6o1=qu_(JM-bhqK#V7rM=Lt0+L$aJ+||@L%!#uh6Z4%qKF;ylh-r<F3XYdHM*!
z?xPko*lMyu<%Q+!a;}}(lgzPFTwV2AQ=im*i#%i~!WXnh?*o54qQgCOo=rROeq?p^
zDHCa>t8bMqinqZ-)3sj9ZYjGAK&cmyTTRS$S9vC%vMJP6rR24vxw&x=0x~l*8*`{*
zY)pP;!Y96Kw3N}oc6Y|bVWw6OK<0LDKF>6muIN$J(IGu>q&6Qix;tu^^_a10Y?MtE
zRFS*fj`NYU(OkC6@I4DTHf%h+`uP+BddhvCl&&`KDKmVqQhmY1y8<VTZ%0?pe3atl
zzDU|JhH&L>M{^9R)LQ7nV|wPJI81QJ@?f5W@t1i(b@BNDnWJFxQJf~FwD?%ozSgU<
z<8~hVL0`Tsr;Jes7Jgi&%^20&#>XbvZC~~&S8u^jv#iQ&6&6kEHh=V(&)=utM(mi+
z)X6e89AcS_tiYoaFqX4$s})?G^>Ggl+IH!<9ihjFM3w9Z(s-zzJ9X`U@0xMerh9ru
zGBfkD=Gg7l>x`E=MKHCGXncBfdFbg|F0z9YwGwrP9S**s^F0+sZS6H5d#%rTZU@ap
zZ{jy0MI_c6Q?@@%uT}XboCS4^Li>KoF%1mZ+{5wASg~-FzhaOVybLNkVdlfl*5*4Q
zdQ*Qn))v<N5*;!HvLDZjuo>hrl4{=GE-N&unE$qM&^7lRox6?Tdh6yI#=~b}k?R8W
zKcVZe0P$Nf`0R=!IMx5LdVjqYPDcc!1<1sTh8lflqcw@K5AGgXQkGbYG$`bp>34|d
ztrhWk%Tbes_)1f=zM=ACcIvvtkBgDy<x&Y)a}W2iqB7%=$l!#tvG-rYJeM<%z1-*H
zR;Oo28Sw|3lnFU&40k8L+niU+sjTt}7v2qZHWvvnv&)~atQ1F?T~~EV6sciw#~hKV
zzo;>)U-Y(h3;&r);xUf!ovIp@gy@>Tn51OTRok-RC{}-1<>DA1SR61is+x1a!O4K`
z8VbxmDglGsI=AB`?t2VnE2nhoVLDZAemARKLT6oj<wLG(U-iNUU6Qn`3k`}L>UN43
z`o`q%1TOQKkz@P5R66YOR@TGy5zUrONviFbZB$xW#i8zS8HcME%2{u=ix)mQzT3Dv
z^Pas)<a28@>Yo&EvK!qv3wLr2Nf~nCm3L~P+|`+cJ^v(-hbneOJaL441JnFxoZ6iY
z8x$KZB3<PBu#=v2@2!f3kRx`WuM$@GR0;tsY`0(IMwxDt3`&Na_W|hPow!7n7v5G4
zwX-F1y;#tAYMyb>n>0dAqed?u>o8n70}$Fay>vRq@sSCfuSWcM4HA(RYzRyS1;DRK
z)5-)QP3UfdWU8$Ikzg|(CL`c~o0}G-5A~%ml{jwbwkW+{Zsf{H(@}&ID0GLSj4&zy
zC}+{Lt_ME(!inTB$EAMCV4tBZ+zH)zj3Ce$)Ehd@ypbG;gq$ycbZFd~w82}=f|Sgg
zT}%ihHK}f^l>RgaMqvB3l`w&Hd)IDKaP1H&&0Qskk1e#%!M#3=;bd;1xU0B#Le2&J
ziUp#hUPMr3YI@b@*nGXG&u2MbAw6OCX}CQQn{C@*DB=LJcVRp=av4ibhZxDrrCxG)
zVl`RXI#bw(xPBWt8^7cDS?9E_YW@wR*5mfvgg=wot#CY8(d7~8*)f{a6VhGy`c|u9
z)G;69K*2Qh&6jK2FUM0Yh?_f0`UXlYlDa)dK%Nqz!_N`%9(H{#u>oVZEq3!-a3v6k
z-p;WdipoRt;Uf?OudeN{GYvN5&Fh8IeNO7WF91a*J!lzbnEqIzA;%Te>Tb{5lSm;K
zAklXmKSV^SM+nRmoX2w=s9f$PgD)1d!#wO_fl|LeKj<SoHEG&ua=9DdWl+2I0eth~
z^8SxHyN{6ba|h?WpO=E&-Nf5vDz)Dfm=C*|{E1w`cN@m+Ow7zqcJ@<~9aHvwiWw1U
z<B_C%VsEgPKsidS0~3t0p<$X@5}ClXf*3q%F+M)rN&mtv9dJ*28f)~I)1YRGu^c%x
zZ{0HfyQ{OEHH3w`Ktqrz*z4U!QlV0qO6}InO}3Bc>8;v3=Ssn@4_gb(8tj6}3}-&u
zN(f@xAWTwEMT8sP>4n+ZETv2BZFY%}ryw$;WQgota4Y2au%2-!wN3{-h>j39kOCoI
zz>^jhXs2O)-Drk?Y10IYAhauKL6+fpx$WtHzTy*egV`#yDQeyvy*w$P%`8=q`+XtJ
zqk;v(46&3s*d&dFb9r?q)vS{Qrn_2eQE5n}YJ7GCDKUd=-}}~&BUULNv<*OI3o2W#
zeF)C8WY4LAhRG-LE>npl9^2)Z``SP&>=CU&AXJd+d>>1*Oe~}NcKNcF-H2nhLkkqK
z{@9ypvGugh97FZPPM9h8u(`;Yas!2eQFAeedER6;IopiQyQ;o`2ug^9V{(yZm6Yc|
z6Z^OUjf~bp?@zOd?zAfxg1oyTooYF}hRZ4rOIs0PmHUDH-a|~vNKp0ls?z6NNxrpc
zmR>o&gXlBfC9=5p)77UaGO9xZnpM4EmZp9Li+lUoRG?HYzVqFtL&jvBQ7MW>7QjER
z4~@ZdTZPF4`nOOBI9-&d&t6zeGvaI8#iM^n5OkMpT#z=ouBOj)E@{Y_@*>Pu$>mPW
z8Y`Af<fYzm*VNR|Plgu{8K&F30*!YkBG1PHV3N|>b5K*ZB?8$JuxVwLN-I?o)?-k&
z%LO`@P}vcbk{2%KAQR+0o^QcsI@O+Iogv3pH(Zt4)iU;Xgak9J5;?|Dakf@`3!$1#
zZZY4K_&yFPYilzp<;qU1JRJ=+0|}Q8m@3Kh->MCKI?F<TeZ388Vr=t&bk6BE$x7<B
zK5f(pA6B`;5zzJ-J<8Om5cAr0he7RIcr`wA1RiSVD6GCeac55jac<5LTI$AbMe4-B
zlx^XJ!R?M!_q6@a*@c6ERl+W-rTN5l&DFQJwTgI6jc@nz#9@c7`p{OodfJgzqRvnk
zXiRm!8BG&6j0cI<p`tszN8g0|kA=L?@varYzK~mOLaX;fk%30I^?N8@o1+FC@$tZm
zc(+cKmjuxj1-$TUlq9`*jMDJg{3*@ZmEz2Ghis{+#)pfoHm$q1iUe-F+(PU=qw!y~
z5I&vV$qQUo%-RmQ&l|#<;bkD(J+Aaf=-Is5v5bt<Nx|2LPAF3U1aFE*CNN(KVyd2{
z8xjDsB;OXjo4=lKbT18T7T!$N3xm`&c&0Y;%{2vaEUxx4crKOLjY`vW2NTp&9hiX~
z?{)81?wePJ3W_945JR=T*y8Zio7LP~7uN#_bE-A{jJ1PX@iB|M0F&ba@geWkCgs{o
z(ktO<_f*gQ1)GzB>g#J_$D8NJDUQtywRb>=e%$qeC$|{g#U@NZ(@{uC_x~~W-a$=n
z?fS5QfQo<(5h+0d>7W$p1U4#47gVGx5Rl%RkOV|U1wpCOJBaiaIzf>ddgv|m&_hjt
zkmUE^`|fkzbH06MzIpy|MrQ&(S?gZ+eYMs1QZ1_9bcvsJxdP}K<y3N`CJ<iv$0Qs@
zE5&~)KDYDW?7YNy9>ONjw1CQJvpyhJR-twtkIA0uEn4(V^_{bYR84uaux5E5Qp^{F
z(;VT|Nu?8F?sKfl`9HOX$TiOOcVbAw0ZGJliRa1ipH<Snuf7+URswe$jKz?@05;p_
zObW*{ysRV2i83y+fEfPKRWVbJhOn@{rs`rSN%Q((HkJEXf3L;e-iEXd_Yme!@=K$c
zi-1ev7NZ7(IB}DJ*(uFbj`W_kVU(@g>2wI#dV27jFjng7O`aw+C=|kGiA!btc;R+E
zg`YHBqru}U^dz}}nP6yI)Zc)nik)Xu>&LxK*bSAAhyTnuY@Q6&?f|ZEK#-6S;2Xz&
zmWd<kM#*2K!iQRz3Nu`-U+Gm?P9s5vFNPd$cZA<;o|6!0NFQ@6YCJL|8%rk$uGC>j
zvFE+VBBjbhrrKy<Cc(*7kaj&*#mr}ELA=Q7RZ0bu%i->NDqVL``Tg>F$NsSUh=4<s
z#TPTPz{mU&??j9Xs5A`UQb$W&xHWNj2+$J4VKU|7)x2zBJBOFU;~Maj&0uxJn)mO1
zPNdC-e9Zzq7#|^PCMl7;GbEn7UB#UwP?bx;7fkL?_@Do*m7>^Tt7dO!w?Dx_+3nTU
zqR%Ca4Uh7&It1!VeQ4!eFH$1@+La0(Y6|mSwJ>1!H{V%GXSQk!k16j}mKMF-_gQ8#
zDd|BUr@X18tka;QhO@mwRdrfvRE1NrS$7Jj77rFtH*aj5fOeb-zTUL&#<<{a3jYyg
zJND+&WX<NGD9`AGi)eHzY5jVYk#YqNj_L<_sH$CW$uKpRQbQBO$uA{Np=j?q`QTZM
zIZ}5U{Sh`c*JBlNcNkv*K8BFL)IXl*c#d7GcQl#_amGI4hpMK!*uu>dr%`WyPb&Kq
zf4t1!ZrrT{@!nhot|al(&mCF)q%`L7m~MlCUUo)Z6%7257P5Tf@4}&HE?;83vbx}7
zNg%lb%-GSC=|=QF_IfI5sMF(KSHJJG-{tT1>F~T2hBhj=v`zI+K%pnix@x%edxZsE
zt5endx#~a7gh4%|D?OLlsuu#8J4_+3VHS((U@p3A!6M4XvowpzxN$VSiFHyg))tjk
z@sdPWvtEWG4cdxr%?-MwWT;BYw;0XA3@LN+erma&JbrThykeh_-Y!~8S#|Kl9Mi%o
zkv45^Xix2UiH>5-ZLE#oc1sPpoOwoWk(Uv6mT`P+_ns#F{X<8(?BB3_iwAUk-Q<P1
zWiPL(H}BUkG0N|criXCxN_tNi(G4@6U+?m^kpq8F(cnlU!Vj8-t$}V+)jN;jlIs21
zx|*8%VoA`CI+z@Ei=bxPAmoQTI-w@*I&0X1FO<a2kK$$YbQ@_PFf;Q>>T$mQX2UQL
zrt0ipu2bqW`!4Rt!Dxs{-WMKUy4E9+R@9>_z7&pn#ox_4RAdnAG*zZ8R<ppb+?0nv
zJZPi@?+*FwpDsjt*vpU-86?=H?X!}IoZa6S@hdy6$5oN44n-TlSamPH5giUoO-$JQ
zs?J6D`KVHUF{zG%wD1K)uN-3Yp0A~RKt80ZY4hb`9CZQ^D3lfdwPzdMShEj%N?Oo`
zzkb5?dbxKRF)8J@8BkSCtl4c=wFe!2p%Z|b(nMcEkqAm6VwYn~OkHD8iqa*GI^&+5
z2zHn1`%690797Ky?>bu}9{W=M+Y0-sJmIoWm<CUQN0fUhn&rZzB_`xrFlaFFhwdwt
zm|-5pskFM072ANPxkC&o{vC4=_q9Twc6DV5gN=v5TaNv^lcdQ*J3b-}^<yyv(+RO?
z!~D#Wb@cw-x+di}WZFN>PZx{^`rQ$#GSXKmF;WQ#5S9tMHsw#c$tE}?hF@lj>Yt!=
zl{EBeV=tS$&x!hvTvu1^AziPu?^%X^CO$yvtn&x!Q$I755U4p*N|e6b1-QUownt^7
zUPyWj-;ggHRX|J3y_FQGQHhl7J$`SRMFm6;IPYM&d?rhGxRS{t#|+*1#Wm)^Pp8k&
z3ed*KOp=O+MRde`J7_Bdb}Nc+y>XHf;)y(Lqn$UsO;nIqN@AcshsO#v{}hCMs&cl`
zb0;|1ImbHe`ArWu#V<=hkEG;|x74iFMVosukCi~^Q}M)2VkYv5?0k=jOQR^5awty1
zXGV~}>rfC8@Xa=m|1Vv2tT%^Gec3R+bWH(Vt5<%(X}m)4qKIc~go9grs>o<ZGWJbW
z_&2ZTJBkY6qU2v#qR1o6Q4Z31PZ5;nSwtsrI0Kw56Hdq&`0>1-kLDo|iN-_O?`has
zy0k=Cv%m<6*KcK1rM{vQo4<G(nY<SKt-!p<w8GWRJpt)Tm+jhm%hp6}evq3nu#AYX
zKQ#(iFy?Yqv}lKEy&c%9COv3Xb;Zs+T3I9g8eznUCv^aZIv>D}Pu8cSxHfFOj;1n{
zZK9&I7h{4iC-rIWUHY3G6@YV&rXd#?m}7?qpP;_{+}{+w#qduZa-a(9S;v8ytgDRr
zWsv1QRS7NlwP)?yW#N(nE2GxNOJ6S)!~seM{#1{Z$VK;F98S|lqKwXCF->)UXTv2m
z<;?WM-n4}rOLjT?x7Cia&T<Q1f)}>pLBlT?&HC@C3YSBcN=dP*f-JllbeH5QwQDZX
zhUPHoD@k*2?hO=!s<;wW1>GAVzaP<MyjtSUw=k6>EE+B_BjGB~ip?`)9$8FphfgiO
z73V0<6?%Ii#BtxW#y;kFt4#Qq7C+on1f>6j!5fL7zIEk<m+eC<^}9WhvpiCgUxtZ5
z0!XZF%3%nG+<=2>zGw14FRrY7BtCy|qixq8LqzD5%g6$w_TFpn6yf=C!K5HTmbY2_
zyqgYKKH&e}Vl2(@mEqHPt(VE|#qkzQjB&DrSO8c7Z0tNS{yn%-p3!u|JC9S3N0+j1
zl*%S#LR2IlL@B=zuIYs!&uyQf&pY`Pvb22VI3&(|6TOPd339NIU)i<8*1VqfAdq$j
z4dDAu^E8u_SAuJ&)>}4Y4;REcdlYnal?`Q^pC7=44GRao8wV^<r1|l2?R;5pQ?*uT
z^L}p#Yn!m16D#n&D>O0xCljthFQiI8K0YCZ+B62~eivP0WzBkGD5G-Z5NnCja3uaC
zOnT~c*=1LBZRN_krnAkD*w`nokto0N=FzYEg>IMMafo-er&X9q#-B#(+Ff~5=Ww(9
zQIW)ngbomKYUuuG%kfRTeQV7FYe31#x#dTyJd}4Dwkosk7_er*l{CxBsY&wHa9=>B
zEtJ&GJF!Vvf3T62ABmt>uW5rUxwRS5Wpg+2O45Ww+T93eZLfVo*dnkD^tk~mS(ks)
zX58!bSc|>L&$4jIy7TNwhf+sc8!3#6Gf&`WR@`cn;!-UczR^K!Nk*C_w`fOTsgsZQ
z>@Z-9T<!efnRv?nM62B?l#y-f(jA35a?4W+HrK#|-Ly4FD0!)iZq~t`h|1qJC#cG7
z8ufrF9Bgyc(SNZ;zv0f{F4x~XG`0Ee7+>U`?6Q$~&U}@BLhAO4Wp}}%<8O$W{Mx!f
z1Ic<Gw>o<uVqSkQxN%cgITgO#2Ob-5Tj%M40WI7+$?GTA63I7=&l-RBY`9(L`t;0%
zu5TS=sSGboaizZ2leU1Tn5S;!@dpR;`-}MKvKH*ksxd|PXR7mW@O5?+fu@|-)^X1X
zv*@bBZ>je**E3uuXg73;>O|7A|3xAi6FL($7X*v0g54wfo8(S))=eE*5*<%;N)EU9
z{tq<c*X3(>9lxCCj7(7NXgyoFzUq60E&7sEOwycF2AzQ2))(4B&&nhjoOBI-oINsj
zCdVRC(Jq6oPKs#vI|INrR2KHoNU?eTFjO@XGWv+_+gph%z_+;2_>e9MLz#v7?R?a`
znm8pDs-4nn*mYiGteU)?t`6iVg0{O(FrNFYcEf2@m2zvuEfDA{copvK7W5)`mEPX9
zH{$r{t9nl~4b!O1SV}7jw>|@Ell;cy^bkPppIrD#<OwxbVE}e&o-ly<>zJnL$d>CL
zz`QLC8;?5`Ysj^Uk-7`3U^U6Ba^Vy*K@;Xb@Zc{zdg#2y>`Y~z0Y6GcM@g>Z=PFB2
z^p!YO!TPCWR@f$hyZCRil1Ukpq&jf>QnyKDuRSPS2|vF>hT?m^hYW@2KYF*$!nM`J
zHAr_;zDFJq1kJGiSNp%X-1O<`T2@WXQ{gV^e_|DZcuHy-sZvd~<_{UioT5Czk@pp2
zG>yanE!3}Oi2m#4bg-X7iPoLj^LG?BWwpIAP*&gqEAWvO&~Gf{vaDGcWPUD$OKV$a
zm7Z7VICZ%jVNLXa=p9AT9V_njr9!<E4Um4Hm?O*9mV}yB1)jm{T&gR=WXD!nmBmI#
zlVsuIYK^O+#&hMgMs%5`SW%P4zhFD_sjuIQaRZkZyma4naYmzmEI4+jT+yPrx>W(t
zPepC7R6-eSI=xBW$(By7&XQRV3}P2M1Ff-bl?Fw-8}(1N3~cDK%cX<$V}|9}bqNG7
z)U`!!4zIzBWw=I4vLaa=ewa83B{Zb0(6T0FqKC8BbMx7vf5pd~v~Y5k!!Ox5QeUsy
z)nHSI0d;RT+JM@3#>I!DnS8M)?F!U6&TkEpe7&DG7dVSMFwK=Ka@ZuXO!@Y#D-BF*
zg2{Ija<m}6O#n{>P;37w1xl;;dO>OxJxX@Xr|7hU|B2x|MLorH+w)<=dG@=q4yJ$I
zXzc)G39nNBvek1(){{c%UQI%M1XR={$KOi+K8=om8o=;q2f*9b(s&C8BPc8aH*RU8
zJTJw?w~@-w64cpmf|E*@v-ikF^*fywyfm;kGtqk_Z&O5BE+8XGZIih6E|uRzscNnM
zL%FTRT=}Y2f|P3RYj$pz`qCy_E_v*vWR}IN>s1cLb*f8tFElUI?{(kX(*I<LSi=G@
zd_UA7*AzS9H>>q%Htkj%?MeWn$Pdu-RL2olr79;UEgkx}bMEfJ?LR%@Id3^-odVvm
z>dPp8-7Boe&lZJZN)!x%fCNz>Vz&ND2|2dR`PCM2UP8F$=sk(Ygf4q)f8)^kn@4&5
z!JH}d`Pa+H1EVo3!qmX(%eKdK_*3+<*1J6G)OAf_gLHr4bhiTO@quC)Ct5f?Ir+Z9
z0U?trDGg1B{EB6)Hz&_OQ<fLnwbLw+LSSJ7Z3;PIGF!*CdeveO8TUl`Zl$x&&+B+p
z-?FJ&|9(J3Xv)aYzCJ{+Gq;g|p?o?2y)cFu<o?BF>~`BT&TGV3NE~Xs641!D0$s4$
zEv?ZTqH1BZQI2C}Pa7#D&{2?-Px`!+N(Zgb*uF@!jzrTv$(iS*Uu@Amas(|lX?+7H
zJO5e|N-h2!ot<|MgBU>Sm|acz4XcAq9?i9AN@ezoAD2UcL&qAxB)aYSV=v|+ZP;tK
ze(h#C&oo(+e&GkEr^QCdt8`;76y_s``#9Wl(t*06FH>cuwEOIROq4NW&&Pa=gJTRP
z(_l>Lkk!JFhy_53$Yy4u>-b?WnUv~I-0(S6vsw1^;fJogtsoUOCRQrZG5#2tpo3jx
zx_a)-hn^km1S}sTJz^^E(go*fCudRJSGyGd>EsM@z|TnV)!^$^TDhCrrq(l0;CI4E
z-s+|J%1M~5m5zXXE!i6aiyxm|9dh_x*?Wjh74Es(1q0qeqsO$7gyq4O6xYc@3VTo_
zDz0_<ogC8%Qp+ae>{te4mvN5Pgl$=2VmBLm@T>H+9#0Y)s<CAN6q#BL7y>AOPam@I
z;i9r+G$+niG2P%ASv6Op%e&!r@hkt*6y#=zUt$9gbG+3YvBzxchfh4XkJ)DMbo1X)
zI!ie-UAGNCMpo^`H7v^Y*?C?!dl1(z+1R#~l0Z~q0sqw9ikgJ|^5?_F)En-YkC_~y
zrgu1&C2GUO3>(Gbpmf<W`6HSJ2BBdf8GSmYf_>F9@5r_j2pgl?fWq_F^mrJpq*T<9
zi3>+9>ymIv$fRG}RHIO{^mnVJ0%lY=I_C&%S!7zOvDpV@zw5X~G^0xj6(bkXO$_Eh
zKAe4H)-!1Gv;&BN6&f+~$pla9KFyAYKlseCvi6eAJMu)YB^#^Sk-WSK#Hqq`fJ=IA
zq5x3R!oEq%z#s~_lpew<62ke~wFi3+>|-k_Ag3z3l}56DVU~>dV6wEg8xlkVIOM~n
zZvSqVBw*fj?+YS6Y976lLdY*}5JT3jF&}BRc_YCridp%773#k7@^x!$VginHOm<io
zhe1a*R?_Vb2!H^7iGZ%3Vf^tUDn|Gjio~p#rTW07lg$>U){48`v)dU%)v?MtqEpjT
zwfhS{Gd^1=!`j&kCu{n1$jyCFTZG~!OiWc06O}jOZOOB1a<2y;c5{2>!Ef2}@TUO#
z-ictA?Pd}+KFHx`P&|KiMA?FP6bBg}6nv!Md%VrRIPDMGAu`Lp0LvXT6HzD+tlc=`
zM%iwU!lQ2vz~(W~B|pt|WuOi=y)Yn{o5VXWea2;|bI5&v2pQSh+Jv|1QM?y?z@&vx
z1E$4p=poA?e1u|*t>xeWQ4Z80b6ML1$XcXL=W7G!+Ld8zf7r?Rmvd)Oy|dZ*7rtk^
z=i$tI&KL9tRDUBb{~^cy`z-z+8r?sCdBvRmM}kzaKH{NYXjX;9^{?L?{L}FOcXa=*
z^Y~3QI_ANd^p_fGTd2;b?AGWdCkfAGZnhkcRXMJjRixvJJ4n%zO2w_xor)(nnJgWD
z+nffnR|_1}V%#kdCHJ;!;?ypY*g^}fZo${2MY`IgyhuRY=r{tpp=x5?MzFM1j~^DQ
ziFUIKjAP*FoIjj&o1M9W@{HOz=I4TI1e<cLe?Mm&@>7|iPgDleKkJrvlv23QnO3D4
zak|?Z-uC?|x*A}dA+Ut1nd`xeZ^p2znf3>U%YIXbl>U__=la<trZqR<a-GhvpyWjy
zW?%p~<!b^Hxj!t6U_f%=vqwg^ct=u(b)1n3xVccVT~(>!B9dwHC2ZYY(~_C)wC>)1
z!IdBRQ5&8SIu{QH4T7|-^IdOi1J0`^5;F>z=2H~2ikwv>R0L`sgHL-Yj7+?(L!t^i
zSNOnZL33bwRWA%$#8h}OS6(~K1gJ9{>Z}xxp{K~bpeN)&5z4*Pkz`ijK=1CVbXr3!
zczSKZK*Uk?0OFz*HZKh^NnTrhd7O!#MU;b-N7ZW^XITM3A)ves-LCxr2vHlxz`rm)
zzi>38O5T{n4K8A9W2wuu|B*dq#4we8N}bRT^#qYnIGk%vT>m9lOh<%wewVi-C6n|D
zsX-=sj{#z3JEy3p3HS2~3mXKCqDB1my}ZC|lJ?bugS9gkK3DW1?=J~WRO&=1AH6-^
zj)>ruq`b9~ngsfRg9UZ3aS@pfW7meISQ|#~nnC)AFiwSMJ>=oMT1}r?BoyHihZ3jM
zhz!l}R|PCdrbahlh|WNZCZ^d<Xe2m+)~!YuZ1u+7+VZY1@5F*f$YXX`&c#rEn0YYN
z-d$OD&yQ8ySjf=SEe09Qtd~%#xg)nuE(*Zodiip-%ZU#(DFwEvKgQsQb`pW|I0cHA
zgMaYg;?Hn)OC?O<kdWc7<_b=EaMi4mk3*p0&2QLK-94TQ>P)@H7K9|tIMKMZqJ}&1
zi=Boll)PflcedBzkv<Ln#k|F?biDrILdl_bI)#gpP3y*`98L%UrxB}x)y13!kN9jG
z0Zde5z+bIisYEPt0Wq=JSyJlL=%FiTTz;0(+aTA@Ym?NhcKvuaOX-vNNuu$Z1^5vc
zd`^64nMb#M=En7EFS6YA(~EEB_AV&l4zcE65_y8GfUabZ?d!7w)A*#NUdVI#oy<-t
zx0D!o!16`EgIV=~&9!Iv30$zm+8HO!<o9BZ;+zmYdk2>&lo(^q1I2r}I*I`~I{m;6
zeUfluh>c^dj2uhGR3EKbcY@c4>LZ8)t3s;&M?3#!DyC5?*#EEU@Lzg<r9zsgpA%FC
zIbO2dn~axyz>^CYB;8uZkbat(1t!Qx<;W);)$cFTCa!kV@&kGy9U3qKwKW?Ijm>E~
zyWwYg;nM?k-Z!sIEn})lz#Y6X!^6+O4P$q^ze&0;oLRw9OYSHltu~*fb`ec%*jVd5
zXYXS_G9-)_7zEbb^-?wDQLmo)ey|&AhOAzzE4T-ILX>>>>cX6^>8bJWkBtpMVV3*d
zsc^%?Li0-F;B<Rn*l5w+mho)wyHGrb0f*~uDdrKYR<8Kv8y3f^?(dgD)}B?4%o<~;
z*zk)vUM5wr2Bf35c4ZiwlKi2f$z7LcJx&r@y`Rl7l_98{g#+e(?i|$wFJZXZ_kpzZ
zt3ZfNA#+*&GZT><Qt?RM<tk?<Pa9F1ij4==c^AA^+QD`9phE=nh|kx~@iR*6$chMR
z@!Cdo(Wn=9Nk5EcN{!G5-Ma`~|9tep%xa{ezsM<o>SXKU1_^D0zL#<P(8C5UvwN)l
z_dWZkqn25(*=~MxvniK3N*&k(yNWaVtf%1Ep@+l=^(0$>y!yPOxf9V{yF^(|$~@mQ
z0FG_t80jYEk2rpD`rJ(xa;}vjSQOffxv9z~8<}!zd3fZf4s>g;EyV_TRZ6^mVtG`3
za|mqIMs0xsU`i1QY$^o+AqKT6IX<D&Z9*4LCT!+2*CPIh8)LZ}|I(XFwA6pSQD#C3
z{~2n9sVCecDw*Imj$ZV#iTV>gb_1w_Ue!&=pJ?m9DFLJTiHAdI1e`&3Tsx44eYP+x
zvY1C6h?7Gp#_$xEkIrfA%XGCDb6M{Xg#5S#cpX84MU{_Gr>wu~#7|_lu~<z(^vA31
zLVFQbinRu{GdVZZR;5Stl;`C_A5(f<dkAEp3857*bNyL!C*DN^ZQkNLz0Str+ZeDx
z3)9&wVO{4t4!y8`BTnhh5BjLHFmM)+F5a597{_(IThK-R{pcXg+hMf+LN5LpfaLJx
zQO`x0<l2G8bHCsqd&GY|ivz{hfRO>wkr0%tg{Z1PtnBG%4-8HgpfxIwR>tHnXD#G>
z%+FgXMq3SOK&MV6Pv_Sbq{`q~?LXq%6@vBSD=dnzFX4Vf(1sc@+Jh1ZwM-q&9X~~a
z-baq~!<MhfzYkCUU$&ZmILG&%aelW4r1E0v4__>}A&<2-bR!BhoO-$ZI>-Sv-Z2>6
z;(B9%^b-LT35x)u8hsQ*vmX&P9KI!f7hY6+H?~5CC9)#SVHAW9g6`2#nu?o|gQ_Ea
z(w>Df%f^P7x>EQ$QhXGAqS5W_@x!SS`bp8?+taF)J_REEc%=_Q7~@k0_~9Df6RuA?
z_!gHU6Y*07`4cf|G*h4WfOssz;(U%TTAr7uWYV_kd7pkstZ~Eyms0qCpvqUj$_j)A
znDIhh(Xf`Dv)~S?x=~_SS)`_kooiHWfU}SOen0yLRq|T$hJA`AaiFo`aa9Q}@D%wo
z+@}Ru%D$c>>>a$BQ5SydC<vAY%6T6%&wL;XNUEQuV2nTi5k*S7d{2Un*qaJbM2Dc7
zq{&Gzw+a#M68#wYwLR?$t6ajk^H+i!<n;n%$!~q+88al|qx)OtfRYHUsoUV6V8D%%
z=}CSGyC%B*$9t4)F$X^YkwYl=i4YT9k@Bcl2E?Zrb-4WOj+eu9XW>rn;hOdA(JiCu
z^hbB^BE~LA0Xjv!o78HnKOn0m^6`oRfdRhQ*|N3eAR(G~k_<`Bju>*{6sXX&o1i6c
zi7)wI#=nEUw1~&?K(i_3*sxgO$PX0TGcyy2p%_X_S2_14Z2!EuQcxjYfpCUQdgE;)
zeoKly`z6l(LNSByWVhYh_%&S04D7dMKS~pBOX0W(OA3cY5bQaHABov8_YW|AaIW&g
z)1MAguXwBLt?b&-)3Q#l%(sXhK$yWu#WC(9lS2bs!;c(T0ZU7o$eBHZ?&F0Ns|637
zW8e8L<LnY-LdpZpd_T{+!gBD*kA)Z>dhRRMfw8Q)W;3DAX^A;vVQt^I?rHK|IVm6N
zshm{h^unbK>o*h4UV!R-_L}_FC4%)|zl}D|s`Fcp6a5LeP_G)blGi6^F5g?Q1e^|c
z%`};djQ-97IQb%EWE79|QjS#WqHXKa5|?k)K0*d5XZE)E7Pl6a<XetDb(=Ps9&mgV
zr-*oX)uELaK=;xl&aBIp>GVwcWK>Ha-InK;Lr@F9NnSIlZr{Ek;V*mwFiXU{n5s&P
z?jyqEJu2vTYiLu^wnHTq%Ry6wA83gfNK}4-@7q1n8yW<J?~|4m8pj&+YlmEMYw|!<
zY?AaHYvwAUS3d=B0=?ln3m4#rH;Dr)MWQdueMd9@BKaeHE_I2qUj3>D^Eoe02ezUR
z9hOJAONv$co4#%_M%PbP$BonBLs}XZzPdCd@0z^`z;#e=vD)mf_H~-Q{^LuFQC2*}
zUK2cNxSv+646wPqx?mOXi)p<b7<asC$IT@Hv(p9l!ya4yF>Cy{2k$?NMRX`reZ6IV
z5^07y$4iq@bmuHJi&~R5!F%YjLdW1N%{4gWSniO4?7m|0ogP<LkK1Vs{f|#l+4f5N
zk!K_+;C0Kgt8wR&-NUSxw(E3&F|35upf^%ICo)eXk=nlt!?p3ylLL^Fb+Pxk?VVCm
zVSZiAH5xUGJ@8{A9zKPe+#(=rhYMmZQD69en_7KcUcZqX#QDY;jfqAe?@Xj~YD_R~
zg}~X6K6k<k{(3}w?()<3dG=amrFAx#eqTMV53;-TX=o9UXx`&bJYIYN7*@PPvn=69
z9I;!0A>%4K$Y1a`AFPjQ;Xf@pb;bX73obMS5$Fh-xAxeeV(*pz?I7DC4cieKZWI@d
z=fpq&F}cv!CiD5#Md1E1tNMb4`FHk8n-L0p#p<)fvyI|g&>)=Vfy~kSMl|w1(a@91
zOog@Y-FLBQ=Y~H)3N<ZsHKhMs7f}y&Zz^ds?u^_}pgD1vfOg-{9sZZcq>hIC9y#l>
z#MrVnvd(m1;tdbh^cEY{R!P%ZpO31lziE;%QTP;~B7)BG+^#P|P9DXZ^-s9_;)E}o
z=_cIX|0&-2Q@o42RDJ!Tzm&@i(a)tn7ytxp;uV?YKkFpQJW0~w2Q=qzukd+jN>uTB
zX#T;Z{-Nbl@mp=`k`vFSn>{#9b><0g5WUW*8oWshtOhnnA)Vj&t1eA<S@J(8$`*9c
zj~u|lHW+_Kk~pquee>(bWS|b8m;|+ygvBDIap(Q<Zx8%&J3iym+<|5UvAP^3JKbqb
zttmfoRpx>HCJ`F371No=&lGK@Z;y!lSqpm9%=Uqi7JVZFtNCNh8+zm3f#Bmqn7#dP
zf&s9M1ai2(<-W8XHM+BLp7^VAr=%D#C_m-%aovd%uKlr=*M9p%QGfIMXlgQhz?+8#
zK;>)C5eB?8vo}loLv{w~$FmhDXs7PU^lKk6o-Be^e`)V`W-QG`=P1*E(eV*cKtP00
zTp+VvryP@+FR27~@$hpn0Z&BZ&^SZDL588jQ2IqTc9&)LaELJaJ6wZ9<hp$9KAvzR
zh1pEiP%}OMskS!27Kk1`s95w*LcZcJLTyt~9oUQ8wFZ(FHsao&C;o(;tb${rG_WE%
zHo-vArL8-A1~7Helfv_;NKCK$6!rqW*Eu&{bq;DyM4i_dZi>F}-ISUcrYb40%@uFo
zq`%^ox9OnUL)xbCY^o2!MFIZHK&~qm%v+Mj=fT2_sbid5RZJw&uRv8eotd4I-<r^w
zWesGRl!N`V(%nig!NxYuDUa$R9zHE+5Z(qI^P3>wLa!Ktfg^$mi3$Kc@cERlu=P$H
z_bwj!LIPP*_MGHVT4b{R+Jn@X!7hot-IDm(Pyeqp{j-W`fb62t0!@it^5>t_Y)&S`
zHttNnf!;}p9>dI14&Z`q3d@9kh$ovF0w!RLPf~s&E$sksxxY>K5}l-eq3~^h&sXJ?
zvVDuqc_YBHLr-j<yY^8V_|hJSlY`7G;}&1V<z$Tl39Zls8S7Z!@B3LOO~Cc^MWdeu
z^}cR|oY$aBxI`VJ*`&K2TX=MTI3i4Iv0r{~h)5X1BJkKlKb+t^fy+~qGX{UBvQwmA
zd_7Z`95nSp#;laxfP0;uC>TiMl@JirY<MnYDdMc;TzCI@DHt5S)yZ|^GwB8RaQOl`
zm|{(QM|Jd=gB0lCR-Iu5G-a{zY;+B(F22lNBxwC8i5~U=^z1#TCuuj5@$-pcmqmkH
zDfkje*X{^Z9rxb96oai+o@We`xjh}&n28%}9C`Uiaxepwr1t~$GQeB0qvNZ($1^=Q
z42)E)miYWmcHmBvN`o0d``K2118!C(xdl3=r`&N7NTSRb9<ack`XbAO=PV9b$&hKi
zY8a~M1Kg_{IWsKnJZh$r7P1b!8XMPtFP)dndkBtc8vln?QL&w*5~6#FzvM%pYW(Kv
zW<OA#Hrz`qR?IcJ+Z)=Gxx2&&$=&^UUc>F8J3`4Y?{3lOq@xzwJzsn?J+TR#QTt+T
zndT@^Il5T+Tj~SN<Ew!C1U2Hat$Tc#@*A8<LKI>L=oQ3_m*gWz%R0TQOl;BmR$&2e
zRI)Ffkr3#IM<Xa7@C1ZTT{OaMhMAHAEj}lqK0_Ike07ag82FU(ND_Ko*4T1n)QfLI
z8gG(^PwY&4l81SfC-cvod@48Kt5ojqQnVK5-<mm_p!)IuqbEAz2m%g^S8t8}oD|j8
z@Yh+_6=yDnE4BcK_WF&O{!{Sp=izC|LYc|F%qX&^%sMME8<UN>4^qgD06GjKwpu{2
zs4U~%K|}b9T9uCPXr*T#{ch<#Ff3TGkzjVDtUg%V{;S>%`OAz)q2$=V;H3)dMOVDl
zk?P2}28<>|?_77wa?XNBzFnwSf*rdTU&Jo&oi>X}uQ8CyJHQXv{NH{+&1E&W{h!DR
z`l^Q{O(f{drP{Y*`HX3rf_7V}ee`=lIOsHs(0)S<3}jXu4f}jv<10CC$XsoP(`s!|
z4gJ1jys&U*g4OVme}=_|H1oCBU+9r(Y|*|hTlX~fr&UgVV?h#3U;d!+qw|1EbOk02
z!!-E)2_VcpJgIYN96v_j4RgI=^j^cwlL|7Lkv*(Ebax+R0#w&z(iqQdSZK@^%Gq%1
zC#>wgeuCNaj}*W&eZ;q(S$!0Qne{m^TO!`BH87nD5)beb?>dGQ9=?ldSp_Z%nX(*7
zTqCedeUr0wwzmE{^w-5}@@d9Ba;}jD{iovJt+6jo$BjI+a+oU)O0Mom8;7}1DzIC}
z-J!`YG_zK-$`_gL<0UkfJsWm$*!UfD)RXQX&dzJdQIiP@_R=Nwwj?f0FxSVQ?$f33
zi-5Jg8hiP$Q0tnp@Q7l$*2H(g8sva-maX1jNX>lA9x(ueB`RYG+98>Iz+z5gZqNm7
zIUHX{ZbD&BB%j3tAE99VY-m(=<3Dp_&`$t`^l4<$;KBJX4&c(zCk|3!4Buqu8)<h^
zAtv%(%|?<BI_*FSGsPE`O3jK7E9<Z*hy1GhKKqCJR`~0p{5VPFj+Y(=i2<uiaZyy3
z29-{*p>D(@^ZN73ioS1b^eq3ku`Nhhof|OnUVqGT5(FV85jv0Nxid=@;c6`eSSemG
z=RJfRrz?_zyaju`XB&ix;$fwR>oKqx7z=bgML8pL`4wb&893x)Jhz;eig*^HnZsD)
z`dcCN?wVf68IRDOj-k;3vEqVBp(=`hc9#YE8i(EuN;tbdj||NI{hsb=fn<D$%tAJc
z$!-z!;MkGB5WW5=wdRn;E$KBevRkK2$-{{vRI~r?Y1utVEhsjvqeJa#!PqVSsr}dP
zN?pTtP}_-He(4g2Us6;*l5?d<%zw^{q0NTkU(B#EiH!`~Wg|#HgkT|Mj{o2+>{qqj
zVZHhxK&d?ERwTSQ*||h#6!}>8moRr=!wd1lWhU|)q%8IFeY-vC&FtCm&2;}|uG$E4
z1~S`Mw{^3mPJh(QaN1uZS#?FdJg39|7E|dDpXbU*>!<+i&nlr?+_`nCw=v`J3=YKF
z!`>|I;4ei`?|8-AE`{rNyuSo^5+3g`CnMGg9wVOZ1y$=^BRZ3yA7cIiUyl#>_jj@h
zpQ8xc*Ke}3Pb_pIMTYIR6QX2mC+>DI#B_uJRQZ2_G#;u4%}D*}x}<K);!$C|{i<0F
zIS@48cHp*1ELBo1-om!#3~wB&hsEexvwRH~%6VF$ZpRZo%M6E=rb}eyQTj8d^V^m=
z<U@MWJ(d+o9Hao;1~!wd{jb_X?vnFxGA-g=WM)bgB5HB1;x-&@x&d5`GXeeSrPq-D
z{D9!Q*cwz-dtSoF@0VgX>3*7KI8LX&kkl=I2;E3IjM*B!pJz3wgOK7MaJs*_B;l3}
z!?DYiJ9$+(-K-KlwEv<iIL=%;U5-mWK|EsmafAYkG_|cIq6_AbJTY>d40ykR$Bn$x
zuav6V(HQf9r^wO&MESBl5|_Zl4LH|F)$4<2PF&58<tZQPBw-&d=HlF@)5Q;K8I-p^
z0`~nG&|(4esFOGKfz#okQyvgWMx%RIrm}+{PI5PXpT%Pnwr9}9Sa6m)W>TdZ(%#_=
zSuFSJ{6Mvnue(05C^&5clDLmgzS{-X<D<1<$)t53dt{3no1l(1rQ_SHtT?)E8~pcR
zjm0tiX(w9uQx?Ho*9<*?P2XBPU!QqQs*NO72?1!p$8Q6OE#~ZWYrBi@+$J{u6-?0-
z4!AAVoVf2&g8%@lBw}Zm83-ZyEsp9H_bXm#(5Lim&@q?6EPzTLu{lcb{m$a)LnPRv
zN7EQRAUfL=<s|Cl-sNKc)k$<^%uQJq^4-*PbkLg5#s6itjt@ey#u;>rk)1mgsvE2|
zSk{_7(7y<5wM9ybk<jNtofSz|pV5#Url<yfrr2#Y`iD>_FuW+g*#a{y0BqN%OOL*a
z2Ja<BO;-i4E51$}d}erf1V+4QP`nFom?VSieB@PDW|H5d0?DL>P#h<JGd-T*V^Ws>
z$ax6MrI==1X|ymqGTiZiaXA4%CTxt(<+Kw=BD<A6`r7c<_(0QsZ(lvN-jBU{_%o9M
zodVB&?6tG)6BaATvl;-+XL(cC=>M!ucw$Z#>KM^Kcga|EVpIg~=a6aZeO!0l+SREN
zyjVFjv4Dk}Mb^jVPq5;-_%FX7I%*u&F7+NlYX-y?I1-j$nJ9Z-Qo_(y)!;otOG~Zf
zFQ+Y}kQSicTLx=2c(3}aMJ|yTMdVG}oLhAkr6}%TealHBmsWr6v#qF^@Tok;+dAxr
zL{?1hf$~r?&R~=oZ_tBR19pinve!Ri-{1(^4^`J~q>ohr1<>(P`1D+yHBX`rPJ$%3
zPl2VqCFw+GshHPqEM7REA?t;c1OMHACjGnp+%o^nb>#u`%=2sEOYvJGT)pm{X$vPy
zEc?~%uM8D6yXAFj(JrbbJy8sI+uy-q6J5=5ST5NP`o%0Kt%8b5mpI`RV-e=YS}~_8
zhSToYnxNm+5a3u#N;i1lP+26ncB5@wdYqoWCM{-puBTGI4kVJ2V}Nd<JvCM%>BD)$
zb_3k;tUPwp*mer3V*b4L{v=6v+O{6N8BtsqGuzpo^Ui~PsvM3-_?20DgjNfY4?b`%
zCePE`HWW=9j8xriKV;4=_nOGPRi;{lH7%_%ikMgqPMU1o8W<QBYnzhL4Ikjnqxca<
zx5Ox8Ls$jo20@Bxy_}VWIy)d|8e8WLX!IYh16PGGFS}3RUc1GZlBysbYCDX2?mx{f
zNKL+==x9Z`?Vpvw<#`mSyPKzBL~-4D4MbX83tF>HHr!>>dz_E^RO-MeA3lU6M-AX-
ztT4?Mu5(t*t|I5vj|71yk9r@i3cS#)YID<}&d)xlA(H?kRMTSxZ!?{x0b$_>hQ@SN
zSzNRKswPmCxW4Qy)1jQUX8>3P<i;G4tzj?ufb@hX8SocXqfUO~8-EI9H7`Uth+oX1
z8>d`VcfR1P#J-}eOW`r^l`HP8jh7cbOg+dRLO!K=c@*;IeG<uxJb1}ZrMGgiX{C9g
zj$XHPXw<!X_^O<Fu(R=A!t7#0)cf}A5M6Bs*K_NN$F^xR=c|-bPi4C{Jw7m>?G<as
zerLxXX=$rFoa!C{%igG0*zoWjug_OTM6D0&r6Rzc9UB2&L(dLZr*_fd<$+uT>;4x7
z)wT$Rd$>}VNq)f5lA(m}`1V+50PxaN9FBm973~MiKeiJyjjGoDl0N^g>;{TK3<GoW
z^~QpGsVy4;)?~nn(0|{qZGTS#2o0K!%HSjEzQ_bL&gLS@Ew#?2Yu)>7{MJb&p7U@2
z;FeE|DE+v&B`Cw6c{n#wIXDt}wwpyY9_Ln5)C`kW4$k9KoC#9O;-CgFt*wxqZTkGP
ze+oAMV^yV}Wd8K|?>D8K2e<X2rh09s^vr=ZlH(g{!*Y&3@vS6L7U?ktZOk5fH|c3f
z)Mmehk$(|Mcb66&aG%D?)Fx*we5^&+2tSy}zTlU9vm0`K+^b8a+fwSWH-}tbT^YM0
za=Djb@sU#NRn}9xYr4H(+|=x&+Ky)zrFY7aVll59Fe7CDdXC1mhYE^!&)o7;nQMNS
zJm6%=c+-6>P6vk65x(pE1+zO``ye$BNZqm@T)~nnrP@`jsWg6qPE$L0q)uIN+%T>c
zoHkubvm#vQvFNw!baYFyameA75uG>>HD~=`^;2>4+ggfQjzMR3P89?F-l+8SuzYf1
z!H8W`e}v73050K6N_+>cH<XZGb*%J@t;m$Lb9T6lSS`Vkw(zD%*~`Nwr*La~3fLhC
zw-B9PTZ8qQF1<LV#)n*RtKjOq)8g`upLB{1u`VmrtvdC)PhC7_<@XkB<A4q+r-Jmk
zQs&<vNN~#St%pErLlaklkL7V;-|H9F3{bP85a)E0C9~ycwtH!vwtD*BWM0(hrGMpw
ztrKVzdLHf0ofr3AnPJ7hL8h@DxrcDYK4V^~TCN(R+iLzT{^?KT0)WmD{m%mJ#nTTx
z-M|1lT;ZuHwe?$jilyhtULNH-4}YVNsRX;e)HR?0B;FLeKC|%VGYmGUqr4Wu5O&x<
zAG$a@g3f)7!tY66pPehaJ2XOPln5iHK6USw%oF^TG3J$FlsqZjtg1T2*co3J5SsME
z;P-u2z;!!e<_(g;yVU|20X{9m3+ZCdv50w}sK@)NcW<zM_c|^t&eG1trV#LyF;O|b
zWQG?<sU}#vF9xphKqTBJ?e3k!2@7pR%mf^rYr|VET*I9)zsCiDW+dA8BTv`%eFz)N
z&yV-SH5aB0^~VY#V?G~VaKcLBOwtU7YjU+MO!54N*iAZtcQv&~Fl>6&!r1-9NSRO_
zh3Bgx8o-n{U2bL)<9MuF80^O1h}(gJIEC_<_VGAFMGL#O%GuN&pzR@WRZ^Xh9PTRw
zC~&Gkcn@Qww-<R)Ksx7G9!GJH^X-baC!t8uYBS6y#|oJom^znxV0TE&8@d2*vDh};
zrEB!@ddgh;I^`=i!1H^q=PMgFh@N|}zXJl1z}|kQ`_`3Yopl|?D@Tx<dIAZHx5OSU
z#DOqI-dvp4YUgY%G^PcXnm4WwS{c2|04^@;vzB|6J4@DLm0G0EziY3j<IAS-JlI<b
zrLT_u@Gc?(#zeo^Wm5CB(OdVZ!eR5kmHV?v?^S`yQ02PB>F(##dz0sC9#cZaEJg}+
z)sa>enDz0w^NiF-y=9^>C62T!Q&^@Co4v7aKQaYJj<w|v_`7aymbf<5vZw838le}I
zE{7bLh>rE~rlMaIEMHn;8By-{_*A(GWHtOnd7MC|Ice3W=uek`*Nbzf*^^sdx{R{p
z--G^e%r9KhAsO^QDMEaLMU1q|317Zw-LY>9gyw98&eH*A4azU&$r%$3TOe@h4>|K6
zP1uUeNgEbPShd{mZK)Njedo;btjeZGFja6`Uo9X$^}5Lfqz4>}a<MQ?o|J?9K2?Li
zT*q6^Lz;8ZT-=Ns<|RyoxR!K;CVXty7Qbq4dK+~S7~vG!m}6BxhCLEv@AvoYEE^~P
z+;i<el`R}T`4~Tb<J*8^qfQh)2GhXRm_^}W9AD|FuyLchJ$s5zCVN8AIO5RZI(l`d
zLrEPa2)c%=sv&GwzkZvG@)(gflWT}>{~f(%<i63%ay$CjtcdU-oxoW6Vy%Vxz8Chr
zq>d74nC>t|Cxq23e9WODsb059I@J!Ffn{}9YEQdI(HkcR!BTO52HD0H*NS@}031js
ztk3|I>ikGUZ*d`|NRgt00>~}ZZw?AXuM*Kc(J9}1nhLx?-re81AX{#yGrV7}0Y_&L
z^vX1NOZfO4QmEdd-(`Eci$J$#wj~aj!R_8=OgJ?>C;mObE14xfwPB0CD}^}3<vDBI
zW>r}Mq#ru+M>#ci29Y%zv)q@fHs5?QMPzKvm9ZNwaaSpEEYCA3c_2T!xA*W2gr7}y
zNo}Um=sy*^CB5Nm_<n8V@e93!q%Ewgp3bDwFDeZ;Rf$=vNh#mdS~=-`;{(|2QSF8p
zDiVcQh}~**?2U9lT0Lt&uc0gQTwK&ir}Rzs1GF8m=tM>wE+m?`PZeh#J?QPWG5iU#
z)<?uTz5bbIqqJL$N_z{7dxk8`F67Mkp9Y}*OD8Qo^D)m4286i~RN!9>A+iFO2+$C#
z?60ycw%DSd#MggaR{2Evb^YHJ7WWMZjLQVayXz#xfh@&G8GtIg7j3>b2nA?UMl-dM
zKK5yvA-c%;uO%S^qcnfU-83B}{YjBEc36pZy%5e&;%1Ot`AV-p4g=Ov-nU@v`1FqE
zt)rD}`)|ae5bK}unZ;V+oULlvE`WLr<&D3wTe@|g^UHbDa~LGxoihCrHa{}D`an%z
zQx?#4I&yl=n~n_+q{wq`3wBB#cg;exne^P9_UstT+`TVV-3t!;)jQX-vh0_EZJpw&
zpQ7!DnvU7dUso=Ao(iOL$+f2Ux9O}|h0Gs4P8qKbQ`;eT5M|^C1*bl&o>^-dvOD-y
z^<_SLk62Im&e#WlMRA(QRDf@9^gI&hM_6XC2ss%}x}7j${QlP5z?zb!2ByBRqV89r
z0^(2rqcu1leDV>-08m1G!PCX`2XZiTL6~xR7+?Y@?|bzZN6kFkJ8qVS=>O9-NV?5l
z?-PSgDc^PLo#O07NO$ZrFiS1xWl@ajgg_O^Kc?QwvB4C!uxEX0;8S<Egh}r9YwcWz
z@<lvwhV%#9AKS||wa}JK9^{!p>gjIRK#FwOeeA8rWvi5o!HKZ04V3L!dY8p0RY9P4
zTS9mrc8Tr|$QqlqG8KJIR951Nf44f06yGhFB%1;&4lcFK--X`9JZ7`GNJyI9_4wB+
zgK9c0EykE+53@nK%Cc*;iw-Bsn1XXGbwt~3;#51X{ud6guFM@sdI_K9ItQHMCG=~Y
zpJd1%fUL0tqis^xW*~BL)&(eh_ve0i*{kG$u5D*W?p?_I6F|P++ry|F1bqn_1-LB<
z{gLB;2haVlAj|=%i`q#z;<DtwNsUpL7?VJKS(?5sGxc^OqOSg%pF3~pxRd=b)Fv^4
zJap}qsiS;s)(bg29_Yx$at=xno!oZA{Bio&o74<dq5i-G*QTyWM(v%N35)J(Cw0}^
zZ1lEc7aG;msiP;w6_LArCOhjH+H3%OnsvjyW7Z%FXEz)8<Il?yOJR%o=y;}l`QxeV
z2`O2pC(sK?S6KtE=2<>61lE~fxEiY-xGda*u)mhi*YwU!qt)&*8;cfm!EbOMeI?Z~
z4P}c>U5mA#;0g5m;A=y9pVeMjvH5Dd`B6Kz=;OGHm-#zq78#ga_1OCwX_#D_n6_yC
zJLdAgl<pb@H07Nl!TPc)kNVs9Qz!4|gco>#ye@dxb&=5%J8@NakM>{1W>>4+fV(cF
zg1QrK;o@a~yD;jC+J@8wCMc+}B>|I9Idl9?q7M5Kvk#RH|McMx0ETqTCA$Bh(<2F8
zR9Rf*Vmf%FaNCBDBO09y3;|nT>V|lBM>_Z-#5$`T4q(omWxC`g$k+gf7A<Sz1B7iy
zB{Gsan&Vpuw7S3`^{87|e&51`uH1cWMnd2YQ@1bAd|{YO=Ks=sK=tT>sg>lt%8rrX
zYbk7V>h<CxlG2{&TLUvI=W;XG&LHO>!c!xcb&q)107^Glz9RorKKU1A3w&JcN>&Hv
z;NrVqj^FvRO*8{IpxuT>)!SgpGDz!~$0YY5CSv_tS7e2aLnueFK{Qa3zL+#Zn|S3s
z<1Tj4ACM-8PTFqmqB`cN_l#fAgk)|*rG_V0mp#p#<=k+k?#Fd)N4;azVLg*B8C?l?
z25>%<$^AK@8sprpvX-H>Pdq+*PV0#K<q9=3c@}G)c2*&SM+RlI`=ga}owpM=PYcwn
zS>y(pqb~)SZ~FE6ZE5?#I+hj+3FsI3I4(uG4!I-68tO0Z8{$>K8^#xUZx9=Ou?}Uf
zP=m;}AT(!$V24*5g&mnHeztsfVoFlZM!a}b2nlub+8Nak0C)#J35i#<JJ;iu8j4GB
zP}jE2K{}yyj1TGJ{PHp{=`{J1xz}#P$A2MNgcOM*<(OF2M^0$*#_}o_QKu=5iI&$F
z`spG9PXSnKwRk83NVTKEznK2As_vwjeW0E_SUym#j{*MqK3Em}(q6BI^j3+AJgIOT
ze?sMrvL2Tu<@!pJoySWFx?J}8I}?<GNQacOZ{A&}8*0~1oqlTngUClfW~)AgzlJ8C
zFId5r^KK05;RrP|IlWVNb+4OLp?)eb#^E@m<otS$oC<f~ue(nW^S2Fc9sXXm<-kcR
zQge!h!P4!gpx7xp)0?L{I2GXgcWVr2;=MTyaKVYIN4cv{R!?O!YjX;*a>+{{J}goO
zeprLfKH@QeM}6Z+qmtWXe(KzDwIoLPl;8;2ok8!%(3vs})Y+%<t39PlToiLNA5qa>
zJV^J<KE4ntBZcS;-W~3YjrAV$aBQe5v{&lemM2ZiSQpU=#n`*CMLVWb1hpwNgaP1%
z(@+E2qBh^aJgRxBW!2tgswDsS<$ibTXSKn$(-+Xa0Me`R2#F23*>5$xtE7WlNsgG`
zoj)hOe&4C-bN=FD$jSNIFe9#%&8p-D`q%j?z4xBb6wnwkU~#1i*~Glvd~UlL_^st1
z<PMDIP;t*fe9bB+y^ozcxOrJGoD2&wki<8FLre+ErU2`pFG18jnB20BOYeYm8kNeO
zQK=c$2Fcv~rYsg<I%&%qxCb<LDU%JT<)EG2hz(wnnUrRDb}n^v*>?Gl<oaGF_bziQ
zM`=Vo9*0^$z>75|Ks~YxDT`smtL^Yur$=09G?fOYQf_{<!zEkE%vFZ~&P;>7n$I#E
zb@^J?m78!?z?~F+pG^<r_+Ue{NHchsn7#%3={sY0`UkeFkMsC;0_ntK?6=vX_m;vy
zajuGAfc1&|3yAv4cq<>IgVxPs-15mc-|<lZ1`uEbnRL6o=dU!3%ZBLfi2Ku}O1wHP
z+obB$#5gqz`adgVK25pvw|q>WX4Tu=J09^7I<;$+6?PQ`Hn}j@dXCDrS0*vwSKJ-C
zmxFkn=XEky1Ky{(KHyQP1}GUWf2-i*gOB&^M!eA_q~(8sO%v%IJ1ofqYfrkrd8XJH
z$*a($O}bB&qZWo)2WWh5IRv5>)pg=7(h&K3y+8=5st!nmXk_s#y}o<NmOa`$-bbM6
zFLCl;A^cr7MK%X=PkST8X0`M*?@D!?^{G$5hxN}-J#o%m@$_k49avinHz|w{hNYut
zln$5PFWb$%`RzOum}=bpWT-$<x9`*))@2CL7YR<3*9NBl0Z|<KB21j2FSB<{opZ4w
z%_8z;m+QXNVK^97+}F)c^|M@8@r3gRzGCivvyj7l-WK!v-!RRF#K70j)oYF4H+D$s
zS34653p+eCwtqtOGQiouBkBY{2S3PcUcUX`B8ljGe=7E^RhJZp&6<D+louzS`15@h
zx|xPc{^47tg*>$b27toYOET}nVF|FeV(FU8`n@Zc{)j?ac4bb!)k-QENGyY;02Y@k
ziLK9)-cSlf*;kA(1s@lqO~w%@leO!M@3Ql>z+)+%k#wcif>V<sZepjf7Me0BRJzK|
zDhf0zq@7e;u#Ikp)U`IE-*+y|dJPPYi!n&`tse3vmUBM4J29QxyY{BmSc?5=l#U;k
z+G%?5HKDSFR-zlI<hu0B)D<buOKvy>jyz;kA*Sg>8RnwterTe~K6lG2P2cJ*=J*C|
zUY0bO#iEd@AF0>>GKVv#C3iMjtjBWpHCDL9BMC1tizIU$;uAe$A8vO#^RC`m452^f
z+(3+Ty*d!%StkBH`Ezt9aH7#ryPe>CKq6#2S6&#PZ9h<7*`qT1D=reAbbjC9kJlwm
zCvF=!(!TvU(oV=sfG>!@Y5=hAX8gbr3e1@X31s^Jm^1aK6`J>d1L273Y5M#5`fHy7
zmNI7DXVirrza}YQC%y*LzP#y({w?GTpY(1>1*ekC=Fgo(E~(Hkm!=jiUm^zs6lV*X
z+4C%5$Wfp)Y9a3d&y#xCS&C2*y#J&RwnKu;e;d^2?UewT`%}C#fT3CX_`t0q>+cFE
zLks~QqxKq5Yf^xi!7{bMMezbaJZ!H`V@Fu_%;SMB8tM3aQLr5T=skn!AYBFSJq<?*
z&GA2lPI8?DkPEtAJp)|R2w+8SuUc8zEFb}Fe>>X$-2g2I%b)xnamJW~nx#)DLbd70
zOXLF^{Aan-yJf;Ba1ux#K6rxex$n>)k&dS$wt%$eq~oiAE}&E$5UP&DefAZBgxHmr
zQ}J?GzRG7OTDr)y2j?~RK-nAM!N6-(Ltwg>A=#B`0Lc}C;W@11fX8XkHSbB2(lOWu
zb*Df=iqO%N#EMTxnstU2+XqRGnHhP(^-~J}*s%$yaRO<Lch51L7D@v6)q`wBWVG#Z
z%(m_S=<R}(f6xG3;2uiUGVmHV-T!TM`G2gvc|6o@7eAgTsia8AGL<Y@LuEJQF4-kT
z$riGcF!q^538AdncarSeFqlGw?E5m-WFNc1Fn-re-S=}pPwwaYd%nNl%U`BXW9GWf
zb*^*X=Y8HMEak+v3M1PWzK=CLkH~%k2-)#9ku{OYzE;D?J`R|l%-@474Jq)qX$@X7
z9oJx%HSy;Xb{y|xAiO~QM!uCzas;aO6s59>D^zdf{BQ?{kGTkPce#`G%Bi=}tx^2B
z3GXkn-fBt=6PikwdF|$OGiCNAP;&-AwuzejrV;c!x*AA~7l}jLLDv3yO|HIjw@G?e
zW>I<!C%4THezLo8>_m3B>h>*S{bJx5Y}ItJS7ZtZxUbaQad}>)2ENd^`wa`U_WM&S
zo@n81>AHqS^Vs7Uo^0FC5W;H(Cr>GV5<umpv{}{au0G<j2zoe84Bj}Y@I2{}Y9bXr
zPS(@Q01zNAc)r~GZ^vyXu~@<g`9~z6?vy!}zXn>?U)G@8yK96Nmr>`*NoSyU8<6TF
zJ4u@dWZo#!OWQ+s$-KB3bQc96D7B(_tdls<bU$pcDRJ;Ny7;GV{}N57w}-MLIYw5r
zEl{kIJ6a~yRHFmsv$uI#o2jIRO45&k7sUNQd7b9pw)>}ky?+Y1h#fEvYFZNU2$<jl
zSH}V|2`X*m3Y&k`Uo8qGx?@<@2@?~IY8|1Tr&sUI-Z1l*NmBni5AxU3Yc^oZHPc?E
zYS<k~J)#3jg%x&l;-GDORln6;`d^+rksL(d9m3q1M^jrD81DBjz8${xlohCQi-X$c
z>@CZ~o1wyAV^^;vOOhOVn3`bQCC9UI=?Te@bnqjf2OaAC>8#H0f_klqMo0Q1FWDP(
z090@*PndwuEEZeJy<Qa&Xh8B!w6PMTPhwPhRb4)%gw!ic<6IYSGbaM}xnLw5-FS$*
z%&usl)NRT!0YgH1#drx)fWkW(`8V<GDsQDD2RAg%x<7NbKyrO!W7Rr2{p>#Z?gcj=
zXd>m8UUEPa%c6j?duu8k+obSP;xGiGNC<1tv>C*x{#k6FCzw)DL*N;!qyqpYtJiR{
zHfTo#EXo4WEz^YJDbV?>^ttl%yIZ%b$$<;`cUgsh{g(L9(eMW~P{fy0Q97c<LzW<?
z$ZH@_eqGw7bxfKP@yEYSCXl6cyGd$6qs?<ad@XiNW$NbC%fC@i|JJhRs0ZZmwKC6N
z>S8{4=^#Mo2yeho-rVkalAGS7`Pas2rJevbrpc=o<F1Al{jsj`S0Tyi%2n@q0!d6A
zRHaFfPrI}u4Y4N!GJLH2u<&s348(sBItu74FE&|$bXk(lIgK$2kb`Znk8jMCZGNCO
zWyKMbFy%qpC12<SN7M+NYAfK0lkdI4(X57=`w=xoRVzkDAvacoc^DE?-NJkpWl%Sw
z@Pe1%97TY{;l?sYM&@E#$_|){Pbk2Dt#Ov6lKaHg*vV!dxndpZGnkli^dPH{RieR-
zT%bRkh<AGi8B+)!RWQ*|+LA~(r;$m)=N;0W@F$&u6-9Hz5YcDAQQ<tEyP3t_rn~l`
zREiRmZ8kX3^MxC+AgQ^8j66tpNeRfgZIb_MrT*jm1f1~rQKD_?X`B@}ahphIyJ_g6
zhbWuuL<ti<F5D9+R|2~@Ax-liyEuIbbRht-<9^%6BQ_~@jHQ?$V}$G{06K1dsz3E=
z;6*k`%hwA5IN?p2GxC7O*xI^Fez1=H0XRuPvRwk!tUr;snzeHe>SpAJV3G;DWMmVk
z_{Ta$JgRU@gDXQF%`anqGKUwLpgL8E>9C?v7I&ZbIRg?Pd;o6+3s=`}EyO#(?FSB3
zeTGox3(hy4x{P=gK|(nl0m{h?CJ@Y2jOgrn@15>LfQrA}>&K2^e;j{&Y`jJw@7Vmo
z-T$;sVAhFdPKGTGypur;+Wnj7h=gq;iXe=`>)56Emwix)&fE_0vtf-sYUh%Inilxi
z+ODOZ&?-B?fs^jBwH&dS00h4&z>Nd6&_fr9^5{WCS^Lcs+~<$<$-54aFKEUuggjw(
z)RIeNe@wlWHBAqs_Z<PblYQqs?T-0O`eX4)>{dqyTaHa5VGGc8!vwv&uI_&S5Dda1
zc}v$|nyYs*w?{NFy=-y#)!|dv29n<QWhWC4N@?yOwok=k51Spvju~tVt-h4n782%8
zI~V1marnYPN-;5^FDLTI=MO;tLQwuZ&R$PDyd<xBhcu<u0`Uf|GhTvdyI7V={QIIA
z%(TI@L1QN3Gl&`H-!4l3-O--bCLQV!Z|eYYy+4cXPaba`q5!<RB$0A&K;-EQSZB+O
zJUFOny*HhSKaCeh%1As9dMApj2pT2!SZIqA%&rm@uAkxtuVs%C+1jhUSEBogG)q%8
z!|ktRD~0UNAw0be7td_RbZm$g$;%#)<jZEQh7cwR!-~5fOAVzmJJuT?6m%qbZ+F@y
zHvMQ0&uW7Ei#j|uutaKx!|yl-#*|3+y5+3)jR<LzblZu9ym|I2gKDV%9K?PXIuy{v
zTD5cov{J5#;z5r<K63jN#>m-{oM}SNbk@1~Y?|Zhv8?Z<g4wi>-8)|zd&x%8PG^vR
zOXxE$^4QR$23@;6dS*>p1|brCgL4_zLY+XLH&nD$dkCkvSsl6j`Ww!oQx`Z7?li<Z
z)|*Xxt;4Pd`flId+q30Syp^Fyef{J~vd=+>Zu>ufmiYdNrq*c<|10Zu`1^1k)sufj
zA31X2x#sE9a$o$n<!fJF;OY2$^7!GeoTvsuYgwV$uqUp$!nJZ9ezT!sMkGOe${pJh
zE6#wb6+l@;_KhHmpb3c=AA}KvlF?3iP_>ZE4#(jg7wL4mgG(1eLsiu7c!vb_v5+q3
zZ_IAJ(4{*&r=bg;&|;BVP{7*hu1Ip8_z-85yKR*lubt~Ku|s<hQ;>jS;CB$+^Yn8!
zY)HiShBje3K8M4U8RbEoe&MoJv7c>C{~gR>hxBs2YjJbe3>=~n_pLHI`71{^smLbm
zjFDjuV4O(U0mA2z-W^XH%U96X^wNyHy+#oY>xrE}N>Ls%yO!v<{8;UqnEhjr>E56Q
zQRV&-^UoOKPh<Z5H*<Z;!x75QLnQ7D8@`#CbX~QPj^Gllcd0c7#&8NPB3TX3g8&|G
z($m+7qI&4)09(%E&wwFaZab_YUPtN<>JYS6L+zyK;calPg?l~+a5SK@u1d{Q4*+m5
zErvmejMOghD3@Dxf<#_e@!ix$Z!4hVOP8m1+BqB>z`G9#5`->`iCqysxxvqfTW3&j
zD&7tVm=e(&RyZd$dOO$v49GaPp*b7FjF{#}oWpivPcbuo7IbeCEQ1Wu3{V#_56~wJ
z78`)6F4w_um$esY-c3|8j*wGL>_#cT?S#NY79I~Y7sU+z?YV4;byHcCOQ=mq9g@Jv
zI)0otro_J8jZgi^r!1*ZI<}=FBDy3el4pM3ou!0dViFoBp_Y*wFu_5AM1!2y+OiEL
zVQuybJ)Rr4q&<IJa?U3%$*QO(?0}p1aH44XOUx?e&Pg!I1GVT2JG{wGcm<6XbrcjB
zV0wKQ!IIT`wP%sJH}d2sc)d<+7X=3@^L1zp5DqjqKKcJ;M>~!xMR?US?yJ?d&!Dki
znl!RmM~)vqaU$?|SEpzqOTXF6_Kb_3N<GG+B>bt3^3rk&bb<?)4P9imk3=dDabUsd
zsnWhrw<?zpfaz0b^JCl=UawnZw5cV<U9Xr4bgA*24#dkoyeL4+;1@70<Tm7ouE`Ub
z|40YBiFyfBrCx|GdL9y<LOb}4WhG*&xil_M>XL)0)VL5RE=?X-JxpqtT&YOWx+!c&
zy^|qLAn)CHa#ixBphvss>dQtUqIE&S;YJPvlaPf0J5+1TE*Aw70cgt>mcNXX9Q}$a
z@fc_zI|=fIvm}YT5NIuWyBoT_UJ(eL3I@=_59;uVcwF%3$r^T8h^cW|R>-JU<HHE6
z)uz=Sg)B0U$U_*TY(z;{=qO}b9x==QA8X*;GqQSPne68pTtGb%U!Wb}C{lhUSjl97
z6s&YLcokEtI?icN=Xo<>aM_s&R4IyUa?DHHY%LNoA@?*wY?%I%Sl>@eb{`^cQP`(X
zqoZwKWvM+sD?Ty}A$x4ReKJg?$xHLaC6`a6;IzJ7W$e_NA>RxcEKo0i`gL22TyI@S
zj!|o$$VTjlEf<y!=Z7zHe-&D*IBo)uWw9d24gGx4ShW|)HXu}FyfP?M>p3oCpMV@;
zw+}h0H2(VdKA&a(QG29UW!;Z#QgF;X)ex>ry{_4ZGaPmt_UKp8!y9?JbQ?R9467@r
z6C@8EN{I8=-X59i#U<3eZPpDRX(RO__i}m!%IV?H=u~>m7cFV&Dxg|nZc{<(>JxZ>
zMRNi#<oLc=f<oP8#aVWWaN->4Yt`<u`JuElLYP1QeW2dH+DrfbK#}jSb?xHHP(L3w
z!9oA_rpeP!W?}u8YFBL}>?9+sUVLcp>N*alFVSpxArccl_=MY2dd}y_Y{yi4W}4F&
zMPiDTH)|4LbPJpVstXpPr*MNc;m8|97i>?JzS5n}s?!Oe+=#`bqf8;Sp7R9^3k8Gl
z&&w92?Y1eHo^0fh?e2Nfcc|=Tvnw6Jtq?L3O+I}49}ly+I9Wnsn2Cnsk9RwH*P+pu
z9ujW&^0&scuJ}Ma3KkB7STjWMa$a!i1wGI50D$pe)*$0&0d=4OXPjan6~i{jNXkcd
zj6cqhm%q$OvYH;y>AX5%vm=dZMrXKV2(R$JOrzCdd#UnCZasfXZW)Xf*orzZBizlQ
zjOUt74pn{U_w8NyM>991IDDAW_ljwUI#*P6h-8FFob5$u!S<u(!5nimpD))&*rM~#
zdj*2=&#m>mYuLnHe*$IdTPrty&i>@C972LF_!T~GOywba&Z*v4R<&2xN*D+&7qP~^
zm4?1W0p<+t0?B%Rpx%otze0{MwbWi6KWm>|g1mW%<Bn<F|7hM#RJRVLjlC_9;Z>lE
zxl+@F`=TQhCkma#7e11V=&fhcUs4iQE!;gx4DEw=#9knZdZ4fH(|K#Es;Cx3+Y2n1
zghS?bd1L(~Ad@Yx<}Xg|RCW!ZBS)!P;cyxGU+1w_Xj}(cFEn2&gXj2V-otIGJlw@n
zQvs|X7W`j6^i5eFZfc9h)C7S!W}!{Z;Rt-V@DB!?`jw01;#+G~VNs6(3Yk!(uC&8z
zPp51|-%jcPuJK7)UG_!_9yQr)Ppdu9ZaN;)cc9$5y3JKDUC(E?xO0za4g=ED<(^*6
zt2}|oM>H!2l1`DkHKj2dlYv9g#XFTvBdDuY5O6tX+s>W=G)N=F8RXm^>IHb$N1Nuj
zHf$1Rf+H!$KK!T>;mi`v|7JFACk|@LS-8|zz46EEzvcyWF#a!jVM+G~VQK4yxTdEl
znx#vvCSR%=@f2UcR$T662IkE-2Aw+=($hz24<U|%!e~lXUM&ZMK>+qOX25}%rrx`N
zO;H9j)w-<8wIm><HXmg|TQrQ^9s-))+QRS6DOn&u8`29z_)gMQdsGp+ZYKaa!dUva
ztWbK3rk{SvO`f6LI6+IpQel7rzwaQSf8IPPvdqLQS7^<S|4`+M%bhaQoV1CIWUAku
zWa?Uartt1|5OKm3`EvT;awszRM3VfpMyb=Q2{VL|yyPiQTVEMETz(d;k6t1u$n35g
zM^KXJv?^||<s5dxchd;B`vyk4aB)B}oZi!%tAtC2=%wgc73$lU>l|Z`Dw%xPZ*b**
zaiBKr=jg*;Dp)ozDQ{O>@zMFe_7GmNDi#q=ZTNmeu<h7dvZ!#YAHLEa@+zSA#`p#M
zx5!s)&f@`m<1(-wD#;W*c@Pp%FPt5?T6xOu)o;%&UjEl}={+!N`mlir{Fk8p2Fm@T
zYdJt#Pfe?v%$`~yTlcJfFh{-9I-7M@d-M9UZ#HYm&g;)fzH5~OVjnH08jHn<VJ!D9
z{yK5@=8oc1Smh*>od-|-@_g#CoN9C#?xJd?15m%8?hxHw-tmo4z{~B&>7MUThg|tF
z=*HLj<8Xq{0l*2l#eB}0NVl11@0BiEe#aDP69D74>xB<`4$ni+f7+c38UY|i0_~^0
zB{bZ+mq_D<4)BwLtu&0>jwK)bbGDFeE$jFRdtanCJUL-^)0qwyfZ0gFbYRaGE(idF
zk<yGGyT}v%jgfWGBzx7SvSL9eUhjS#vX2oS*w3+(C+Ju3_%Qnnjl=u)eAR-Ahl_!f
z9&Hf&l%so}1@Z#;P_m-0P_=pkthK)ROb}$Q@oE)qso!9&&G@zLpenOnJzqUThWju%
zloyPA;qU<UzdyE1S6ax+egEcJ<9)|u{1^LCJ^ALSl017qld1jTG?p8*xjZ5-d3$+V
zrA)-7s=-Y~oZQ8IH~lklsNn|XIQ(9nI8Zs*C>eQ*KthW|R;n1~(E)2-U<0RIX(Vo^
z((z@)$w?Z|7m56JQK>!T$_b7`>VI$jwSNYwba4;kwKQm{H^xn()Lc7VR|86nU9TU2
z7xy!Pk}EeE;1#^RW-MVygUP2vI{TuSfTDKriD=O_0V0h@ZJG@BGR~>GMWsJqbe`H>
z#4a(;o6S*yW^|Yp`(q1WWA<$oUShAnytBAA@}J2;RDrQwpRQNsA^Nb|2O(YDbx+>h
zJiqY_`pV6aa{9d6tDkhh-#eAh^=SnCsRi(NoZ;W$t1Fr0iibFw%#Dx#m!;m%<0QVI
zcn*?=C9`mc@7xdImztjySTINSDAP_VbuPpBv|leN^3WPVHx<fqz<3n$?LO4<`F37M
zX3WjfnvKi$0U*Aa#UNiGu1zJ>dS;(fM)|^M7T5-))5H`WS_tHP$}QbGMG7~~aqZX?
zi~`DTrwIRRXV8)3a80=ew(5q;WqA-F?j$eh=*JNmW)w@g7cbG0SlGku<e&!CVdBJ0
zGKI@_)2wkNBGu64)_a>=Fdx?9>Y%nXp92IR=$Lx?;i4F~yEJa=72lqUK^;%CUbT}|
zXeS4a)aLp`H0cP`ayZzUX7f%b;Udv#HHxJBSg!arP3xFvwWrfRvvwW!h%nPWDlBmA
zr9p|_XG;93&!<Gd^jb#-aBGy$KsGr*XX4!wUt*0Qru;Ry$`*>Cq&Qi9s8ozD7*saM
zJQ>}$p8-DN=6c_%RlvxmD3I)!7)htRc9Ws)5J-qGOTVg*Yxhlk9>T)w@Wx?9?X2Lp
z7`wTAsTgJt+Jhk5IKQa*lsIwolgv{LyXtV0Zi*hEGiP_eDG#y3h8DGZ&+;>yo?*B~
zxn~}X_*5+YFn<vEnHQd?dR2a=-|f_UpFlsDZC~7_bEGR5<T}Ox%`o>x7=k&nlJkwH
zi4EnJMS{R{fVD8O5s5C+4ABY2raqFetC~;D+0B!wm<27J#Qt{6UJGy_EYi>?afO5O
zn@sQ?C1_229@o4dOf9!|P+y!lERv|&v-S!tUwfD*UYQQ^fEhw+&XzZ8>+YH5ks9l7
zLe!rGrU1?$+^#kgeE--0XC<bs^L7$;@OBtqZVM>O+&;LeZ6o0W#$j$MPpusURnYHt
zvyMde*!+1X$^o0_2i+OnH=eZ^|6E?wg&pR-I&?F$1P)ikny<Z^tKFK_TV@ZZBAfR`
zUVkWb^;}LO<!%z?PzC|1p3XNUi0x$zE|fdOkq<K<^AlpJo$VA1BN^5|qx$=lBmaU^
z675-U@o;xXztx^|dlc$%+bYlGIL*AA#}!u6o8H2Zd7eI9X-xymXv-e1QU}91)dlB{
zkgB0)RNeO$uS?z`wG%fpyN%cZT!|i(9|C17-P)#M>ukR3?Ux)ID*|DMK(l)yC8m>H
zQW$hykNf_huALN^mD7+@#QHK$zS3%8`uZ_7j4$`wk&ia0<lTY_31<M}L>rJAM8?S9
z)#g7@@%X@z!!Sc>Z}7mPFZ|j`1@Tes?4_&=Xk&5vI3!!0!y1>Ld|dlT$Z$<%=nzpo
zjVPjK5FmLCt1`sAxE+9rs_bV(O)O%@amEvRqDc5ac9AZ=6r(g$>SAa7Ggr(;5}m4n
z7Q2dX#SEBgbH2%H;z%yA%;%L|q)JgTMOy%N`p^)nhLu=%kOmrUHxQ_HHDd3gZ67Pq
zaTK|m<4z*V=@3L;S}Q%yW*?071s#r<P1G?|4Yu6KnfS!_B6r}nlGRM<559Zp`~L0&
zA!4UM9+;>2XD#wKJom3X`+YxWd%aShYsP-&EcwpM(=TS{N^(W<ahVnmt&flRJX?NM
z4`%MtzFMeGC#lPrS0YIL=-qDU3%2b75$Lgw&-3Tm29GX##5{Jr{)q^pU8$qA4YU`*
zdqZ}@!01A$I^y*Y3MEdT(@|+O7zx|b+?a_~93vt)3YXH9PPyE7<jbl}^dtZRPX&*4
z#(0nbgm2)I8-j2cZk!CRf983dkD28x75+H?`c**Vr;8t#xm!2|V)&;MN6>tzY7pQ4
z;R|Xi@{e+~Y_qro!h7oB14huEBRuvIJ#Vxg@~PHTvJQ<|Njw88JGC!D*b>pT2^;kW
zVDo&D@<ZpbI+9@k-myUp@o(umkJH$rC5KR+BjQyvQn&;dWT7gAtqscr-21ppc`!Bw
zUzv;tmyVybW!TIc(KykOYbLHXEMws(Kk4U1K5(Q2QX~KkYiF%|=I)G4A$F?zVpGu5
zcA^6feXOuvYE%kF{^xZut`7bhFp4;&!Vo+56t2x+t&|zzY~<XhCpsSlE|mCKSnH=m
zEsc(E8r!!{JG~@_oeS5^BRcll|Ij%9XTbAc2I18+BkKxW0Kb7E(FN3X_;ZkkvyIaH
z^9B3w*X`ebYfC(FoG<jK5_#2AjgVNaE?lhXk%*ow8&t>kqwJ>@9ajcBr&7$3S^`S*
zARUCZ`G!CfgQtyg>u-_j4=)IuihQNqqsAdX7m0#IDiiwRH~$#2qv?f>h;G<PH1DQh
zZlbbNDT{Q?OHY^Tf{T-S{II<@(rDopz?BNcY$JBkpc9n#Xy~FYdXRO>&i*j|*kIfw
zeb~jrcsWLk%Sx0nCHee@5;1f?FPFDz>>!IyqG<Cav{7R3AcnXc>Gf`C`|(a+b;J0>
zM1S6>=8<gzNqW~&J}w=QWgmPO1m}lTddQJOtKDw32C$h7BZa=(yz{SMR0|<zij@x^
zPJ15mnD73N)WC_?CCOWS3{HYs$HP^a8JMT+O~rTe5|#q!cQV-YZbI9FVY8I>SyDBa
zo#r|)xmky-W4^kMgt2K6;`|V6Fw`Lukn7mwD8ZIO3^^`utdWsuBl%OkXVA-bB$uyB
zWBpoy1n?QUoeY-DrU761`~A$^*jmOD<0%#|=t!+YOO*T6)&GwsVy*$8am7PvmyHEl
z-uP$mr|`tLI=cP<&0&AS(HCx8|M5VCDSUb<7`si0JA|qg<mKH-QpR+15D}m|_yN_w
zQU#6{TC+h0GxuinpJ7k0qu**0>vhRg&xMn}f``R$F<pJROEcoRVap8a0gKy5m6tt;
z#fZ-`sS9sTkjyg``{tfWq4=f(Vv`b=3B}UEiAOD8dpsvojxgd-au_hHOty}}y!1@^
z50%SF%2SadHbYA>*v?-I2)jWFNMb}^$02RByWS&2%k>KDO+kvf1A?0Vu1|9-#Dn&M
z%Q&Yq>Mo5;(R;`0o#+20wc01%A5b!^bn1QMc%h-d^0vAd*cm?WT;Dnx8I|Xny8Qle
zpd7MaD7ycv=g#F3+^iyaI*QK)n;S+EKiWj*-Kg7fIkmOR)2I?Q$$Fs0G@s@amA82Z
zfu{o(oNfqH5G$^f)nN~bsC62bSpHbzayVl^?3DH^-dg(cqi%lsK`+pB`Ns1ue0@R-
z!ULv7P3DoOS}g<2o_q+Tvws012Mff*OSy?AQ5q?eQ5`ZrzL>?u2KZ@zA%>{&C%;Y{
zg=}(@&DU^|B?>+|rf;WEZ^<kH1Z{i;6Szy-6!E`eF9u?LU7hW0o4|A)b^<}=wS0E3
zZqCUVH!+AU+Z#e~JR>YSx4P`0C{gv;`V<Tim?feq6ITg=y>mB-BBp3ACxoE}5BH0x
zl?WztV>~-1-6mEvVX{B!MctRWCEix8s~}jV@i^PgF;BVM&}e-Pl_#{_@viC<NErKA
ziQy{T-Ux1FymrVl38Vd?%M5NbVY{VJ8Z@{t_hXZo-q|znrsxT?4RQc2RVdp+Jn-}~
z1D-|rI;$P#+}=Ro=%?X}({SK1EdnC%J~lkd_9%<qAjg=Y?-0z(;P0;R_v~eVhbkK=
zaXC+ghuhTj^%u}oV>3~qA|DZeQ*_nZG%<Tbj9Lg@GKs;vX~BQZUPsJa!v)~)wvOQP
zEB}llKOR$|(~kDz?NhfKr1^zErgT<jcM`)a-a(^ZM{tDK-n8hs=6Kjv_)}83K}m&A
z+blPMcPB(iAM{Ln?*aWh-(^P6=^&X;m6Aiv1fWC!fQt6Db3_LuFS$mBs?HfO(oQD|
zlD+V3&k+J4{ItCD8W|QdX1hUy*rWq>4seAtddflul4$zqVcjQC!n@T~dAYM2;rBEO
zUSFzHyeYskni$p4M+SSwI!d|!!u*Z%@!Pt}I!Ii8AlD!~z{nNuK6-#MpG<Md=b!j;
z|0UQVxj%C?N>D4Z9|^Vpp*_3;LN)28P~pdQ>}+7t@`E4zCC6fZ#Vf>Y1=Hbc%i5ch
zFp&~4eWBbO_*+t*V_qrqXB1ShNkq<wx;)??N#RY79<*M8q~rN>70I{T+&n+!f^Mr1
z>u}TMV|yR42I1hA8f%CQdYkIkc>I%zS@`Pi&AUJIa2{A+u#UGO_rxeQ1xSRJf`!pU
zO+wnw)Bf;eA~NSA;71V!z-m2gvVi+0ivepPuf6@pRbO7%4FH}7wA`;K&5x7;*_bS(
zE?#D|7wB$EZ|t~z+^ei!=b&h_TSJ}NtplP;H|Gxn2ryiBZk;_l(S%9wb<CUy4SXqO
zv3=+D9a8ysUvAcayF=;{PH2JJ4n_I5Z}vZGZqR<`sY?CHvG{Z5>%T&g|I<E!C%t$i
zWDljC5~gcVVL?RsnOvN}ZA!y~_h$<IW;K6VRNEz1Mn)Evh#iity=SQf7M!7wmGo5-
z0z6CPpK?4ybf^EM=Q;v57l&hJ#Kw6bv!2ov*J-*#jj+l<6BGH`-Eq)wb6H|YjkOM#
zx7q;1uY*VD{7N$JwPc^J^FkmAO{2rPEBIz6{&9$--9-4HWcaDC_FrY|M%tMF*DKj;
zIh~x`y9tCC7u6&bV~vkf?nl@7f3cFpN6bNUn4I5HB`uBQ=V8otQBe;CnPyB<L*EAd
zZwo3r<!EU51UP1k#?Xrvo8Pz+4n!~}sSZAMXmP1hwYtPv>3Yp(u>VREkOCfsq*G4I
z+mu^Xw5hKZGH)vm)f4lW>G&&kSw;0=?dRon-%dM7u0<h(i3P$}y0!e{X8^W>iCKPu
z9EribKq?Mhw51jGivdp&1lY00+6#HS1N=q0XKhOV`Z~1qVgJo6|M}m{V@@1DE)aQC
zN%Lz;@}g|Q8ok!$n`*%bswu=*)l4hN65oV@D2VX<QDQX%u)RD_9+Z9`JQO)xAxJ83
zc4pmCpXCICj~j&uT3{oUeQY<h+q>aCcY&zXg6Xf?MOyp~m0TMV!I_dE)HCdzVl{mh
zRG8LZ<=mF@JAO;}T*EVK-NUKjfhMtG!N9W>z2*e2@_!O`|K!r?<@Ncqkz%`ItO4DW
z<JXvLVqi9Eg@ghzA5H-MWI!+h;=2^wvJGP9l8sZa{`)8&(F(uN+J*|WcDwHn5|Y^K
zo4k430ZswkYzHOn4#9=fKf^STtsGl8Gr&KQfw}&xL?ca)i=;jg_$Er>ar_~!I>k57
z$ywTNIG+07(@^t3;x0gXXe4h^Zk_TFnlg)6FSD9!KwAHWj$AUeC6-9NJPjdfVmEeX
ztamuD85HKYRC@ZI;13HoNJevGNU1v%&5Y-PKN-<H=;<^<gmuRS>_zVijtgw-)sNWp
zsVW^nW!Bi5JGWsIF>)yOyXph1p7c<p-6gN8ay#%ew(m8H92759(;1i?o?LW@_;&w)
zJ+(j2Baag}B~M&Zd#duA{rKdOJqtR}h9)2F3)ewNn@9n=@#VaQ-P#7-WQXcOtEA)6
zIIK<F55f~fm~7TS_n$HJ!}B>s!a0WOl{V_XUJ6zNdTI_JInK6@B)KI3Dye^==i%l^
zHW~lM$i~z0e}B(f5l{A39{fp^c&)*s0VUVf`|&5AsXvNcAE4jx-UZ+=<zD+uwrwMS
z9T{u{!f_4>TW5g~bun*@Kfm;7i_!BB$Y4_NuP9(0L;-^H0Wj7Di959`_N8n2y7k3b
zQ=7Gi#t+(iAq~Ns+=R5(!=~APvIA5q!Q)x?@MjaBYd+#LsrW1xcUbcOn&guWZ0f{`
z;94dd*UrNu!qKZe#;zf}M-pmv0J}ww3N+|@UmI`pCUlUG%K%tCS$7)tGtx?<IBVnl
zGad!D?<3Zs!txou-30%Y!$2@tLCg=hJv!PV<6rB4>i?(p|D>&<w4$bfE^-W!yC$(I
zDCiB)q-8gire-Q6aoDPSRSrp8sT~EV3+hJ_iG6?FD2W$9ady*eZYLDnKiUVUdCL8B
zO4PKMxpp!mcl}6rQYZGj+NlgTaW$ia>|*slb1x1(*2L!_ucYW5-ZNfgWqm|xQWdi0
z|4)GYe~a9*d&vys8q8D_L)7k%IM^RLr##;9&Y+03Da+(>&nH&+Qd6__7x+=9V?<@t
zgxGIOXV+>(tNieObPed@lE^kz(0O3-(3vEAI1|5j5;vK|yb%9~&v%0X=>~b7aawyn
zWLG892aHSqRd~JqrQ&RSXp-^*$ULhfVcPfsy<bNp;g2Xb*J1fXY2TAV8O$tvgkMrd
zz4_<Pfq#x1h*5oZC-`ESe8x&uj72ij*0H5hB+Qn9D+vAVqc@ne>%03$RL-V)b9o?8
zqi&w2w1=KIgr5#31{Nm=U#R{?f~}p<@AlP~7M!Tx;s7elQXq8+leK2J76^PA2>XrP
z42^$k%pU6Wc6kj{>ZWV@Iw?tlRrT=(x;t3PJ+|qLqe|@TE&K-g)zsOHu$mfP3{O-N
zQ@}rPRK8HGWud9)xR8D;BVCt5G2azKckHT;Oa^FF9kIbMByG}>iU<4btJdtZ+{CcR
z+or+A)@6YcTMO~}R|^`YSHC4PKdib=8!~VHdjCRX^!amJO186InYMLnnYPuRD9~B9
z(tG)Hqnj%yMN?L;{lsE`WY4`bx!RCFD-*Npl095Oyku((y9+M~kA9+G01|5obg$Hx
zv)J-KkL$YAioBckRYh3g@xGOw2a1N(K4hW}>rA#Q-~ECFcX-fC6HVH#?*;p<pFAUn
zJ=@=^uY4dkC1&ZGcf773Dz5OWaqcxGjKoi>3o@^Thd$W)6zI8sS=fZ`osj2MQJaCT
z_9@u~*Wu2EDOHvcY*yfEJb6I{bE|y5dZ8q<aYBFVOw1&a#bvWml_y<3xP^OC%epGb
zoC1)r9{e)AlxF@ciY)+!S%ixRwW76oxh<S+l_O>DEEidauPv8YPVyx1T`f?mJALni
zVeRpKK!<a0Zpfk>V=kYcX|x&t!<AZWAX^uS{T9`U0ehbLPX5a|9?k}Dg{tE}nnrJ;
zk3W{&q1=^){zp*c^^}!6E761|MTx1?l_`7@lm)Y#xBQcgaNiLL1<f7HjbnFhT_zhH
zqaphv7=d)}u2>|;hzTj`6jYkic7BY?LR|{w+Pd%B>Syg4(Nt6Nx^ZGjktBXgI4@{g
z%UUgnLuJ!!au6Bo@dhwm1~K^c1K<X!PnH3KpzAtCR^#^|_1XF#6H~)OBXSvqQ7aSY
z6(2k(_J68qs`2jGe$b36?YqlHpH$gYZx-kgr}s9;7faAPzE6}tbe_lJx9*-_DT1uB
zqajF>w-{K`R2t`BS9h%3ENvRejX*xwsYNWfzJt&xPo{=zsqq+BQ|!mlFsJwWsHC(y
z)$B-jm{Vzz#y!Y*q6bQ&R5fj~ci*6-dW4Ac8R+;?;x7Y;Vx#??=TC^jKC6J1uH5=3
zL}AZ_P&b5Ny46WSbG#E*%e#d1R_Mb#m@K{GBex=f->F*2@S1Fj;CEJ+uH^HqDp8`1
zczN%5M(4IXdREt__)-<c7KQj3^8G&IGg%=r&z6FxlRTng$RTR#Y`#Im#xTDX>-Sxl
z!EfCeC@=_6TSm}w)HN9XCPK#f5&k<zpfogqi2idPs)HGIg7~rh1pX6HT?Yh<@^G!_
zPv|AVod8(ijFA*JLWUR%?1EU}4~F_;fuMUDjZH_Ini5}6mD+AM?8)%cd{v@S+|IM^
z{&07Oys#mZOTtsO?%#Q6e{$;D#JtkfrSC+fUa=pi$OsR!ekWyG5F_Gnb7iRu`iCuM
zHDO+GwGXisSpg^^o2DY5NxP_n&C(O{3{bSQizMf%+^gf2=p{jfl@v;l9hzEf{pgRF
zJ}J?q$a-|XSsP#yU)UI-Rhx<lcWr5E#wpV7i)2Jf^A)ZW*~<GEcbA%>i%S}QvBRu`
znp1^w>28+I%X?3vpmz5Nk)F~^ESVpL>83)pET56HRQsEf0Lzp0|8cxPM}dN4;uJ`l
zo@<Kn8OWSgD=%}nhdZcwEtG1%BYnWD{K&@#SH~lywzSFvIWGcRz7*F3v1&<>Kg7Wg
zRX=no>7>W<5gO3hF@8vIdmPC@@Xbk@)6zT#7+`qa`ZB~2+HK(cpE!`beM&D6H@};Q
z-;Ra$S@4xz9n2!mtQ_0#>&hk?9aP^jv*<6mlc6RMqi;;GuDUX*e5dNl!dpSrOh!(@
z-X(>dQ;6T{4_;N>UhkiWm}<c69%{+?QKS`2`KbK4tAF2Xua{J(Ik>~MHD-rblfMUO
z2hmXOt}y&#sOMGHMT{*XU(j=vs1y>*Yc~eF^F7)h@o-<=(Rxe0-$f+LO5sl%=5Z+P
zgcQvRP4}z|ymtGlRK2&^%8g4KF&CYTX!^YGoxP0669S;I56p|mE0R~_TBh7F;@cv(
zPuR$VfA<0uK<Q*F@}|SSX-(4jiPVC{vhPt5{H6KQGd!yGo}LkQ+C?KBPkFeRboXV^
zB~}tYL?bVEe_0X1Rb!<i7LavEtv1>|Oa+!eH+jhBo92x?2DKYbEFIf9sK>okv)S{a
z!(F0N@h5uYFB6tSPQw2~peJ$NXO*NR(rK!|3V&Pw<kCK&rJ-aiv$r1^&TE5~TS)^r
z54Ta*_E+$kde@5v9@S(gHp$)g1uENoB`#m)rVmq!x*c)8yHW^HjqsyyEB8GP>>6Q-
zTKaOC?yUhKf?MJ;EQg;9N|6ZT(`i%Nee4^rq-i7n-TIF@fw1;N@nXY+-a?h^!#xH?
z?~W>Mym=$EpQkeC@=B)Q03nyxlq4a^gs#=MPoK@QT5#*aS-f&c0VpoZq2JhrLyIh-
zpsllC2~|rh$7ec81OpmG67&?#LfuMKpGbe6z0R<3{zIZkaK&>dOr_{U5V+Dj#p%Od
z)9*{wY12RWg-XfcJH<*oU4L1=l<HY-cla+BlZmHd5W*4kLJ;SHeEhidOu$Jya+C(a
zA?snO?(y8p9SQP>Gv(cHZ1I3na-KeTAxY^c6UkDiYTBNMJ1SP_<$m|o!bOeP#4D0}
z%F6C7#uJ?Jlz}Fm4QBXaA-v$;N-tnA$t<-;x;>^@W&{XC!8|z_J6SMay+))+<k5_O
zn30pZ3E92_LE7!Qj(h{4{}5V;HZtX?k}FeKT#WjmG?)y`WMm(oCY$(2BDb7H^Oi%1
z@3W1|VM0=CN!<ShbC9i+7zK8G)0N4kWT@`O+|{4wFPx2Te<xBDEPMNT$Jy1i=bDu9
zlv}p<qFv%^H{>Q+u-Ypj2i%`Vg*Om6VIF=y38P&1>5sQlIbL@<2q4Qg%G)*V*vohf
zq^{9v4evR+(|*^ndv5kq!RN8Jd3Iu4h02{92lxoWAD#kmpjaT|c}TwLz5(HYa-x`=
zMNsTBX@&xad<)l9ttA$}$?k;0&y+Hokuy}=Atx`hE%f$&PvaeuY-S}E{XILy*C=;y
zgDLR~!R`}!2tRzZ^<#3FS%dQgMi5C5C~g8C<$=hCrCzR|%C{TAcjOwr+kXsZ5QJA#
zQ&X1}_v$y9O$4vcO>X~AZm+xvK8_*}x6`QW$#8uonualcL7L5iF2sE$)62`p)&ST4
z05M7&uRKz&z)}?XWtwf_0Fl2_#zsW_cRat0XiImgu`-4oRobq%b$zLGj*!9?LktW2
z%qpAe-4AitxC}Xu?Ao>`*JBFfi-U9#yX$TX{iez-Q$dng$6kF0priQw5ObOQ2~UOS
z)FP9HP;8Pf+f(&h2Rn}$tQ{;Ju*@p{{%)S)_glg1>A@RRO5pZkR}ZvAsC7-Ro*Qhb
zTbEHUSg`)KF&6n|2wHfI8KgQ2I{BYLv@_8y1FAj2IDE@G7e>@*52XCpP2Ep<G7fG(
z`zhUQCIJZ^%%<u1GT3&@tu6U@;|Y^{{11krjw*S3dx!AfCurD?*ZP4_UeO|1Wvin_
zg<tpDw3_&qqo|bB{Nr!$#?-`?bwrJ-eOg#54k<K@pIw9%cc+&p?0h%FDnKi`1*0XM
zb0oLlv3Jf@tk*-Gpxf=)@NMKoFiga(<+bzYEBp8!{&T>$71eoUCU$vE$!Yn&^-a0a
zI;qnV+3K<NnypwVShpAg7+KdN+c?%PD*jNQX|K`mkq6yT-N8Yi3HXD8qY`b{OAgg~
z;oA9z2-PX=dpxbNJOeo!lX348Q}6nNVcHjPZQeBfe&K<=53N*j$qcrOB_nW2QAOGa
z32{Dys_Hnm#u>GGH#P;ft@tbU8KG0{U-PTKf2dfv+OHHEMA&LYl-cQd1{&CmRjUq>
zQDPG~U+(Tqp&g;fnTU3ZG~<hM7V8xlA;>;k$a&;67kBg9$|-5C0`kJ45ahsm#p_)&
z&(A@-927t{DCHDs*21r{z|Y}I;nH;L<uc=?V7}5I(72r|@2K6{0@ahcSTL9C7hB{5
z-y%S|RW-^tvkV+?!+1gVNbw$jB?ZW;jHp@5{I|)4cTAkzU&3Du*jL=cib&xqb{{+s
zxp(71fr+1P{&m{?o`)i;Y8?x=G#XRtJ$?&@WUZ*c=RQOq_Cc!k(%j)3>ehfh#7x@t
zFOj)01MA~^D}u&>0fB(Pz0_m`Y%o|G&zRdQJ-jH{E0}qW)*v4Nz$Uq_bBg-!87Cmd
zolp|LGaBN6C__uL^%Cp%nx=I+rjr-(2fx*wNqr!V$pkJu@rqdsi*ws&I|g|t+sVdo
z&HgEUT#YV#p3ZFT?TFi4?$im%`L+Uz=pLD)d?UK=zIV1#De2l(h7ZnMl`Kz6N-8)O
zd)X*i*En$Nu4_o5*2~wwhk3GtM?e^qEsh96xc1IYLFescu@;wRju3}xFZsfx?OHn{
zE4JcfXo4c|wx8SEJzg<-w-ql%;-$6S3BdhHtD7!iyTxE9&(3+1K5E>R3AVg*M$NhW
zx#m4l%YnQ7Oa`0Doy)0;p+n1DEOY7V2@x{KS=i3P0?zP11!0~aGYgAjO-+q$&&T_=
zW9c!cVN|7#Gnxiv4I7m|qOFkB*L0w&eV3Fpwu4#jKy==ZeT&O7?TN!LA|jQZcIS2a
ztGlr+zp<Y1;NY&Tzh=&n`6VFXiO6FW=gxH1Q2(3i<#;S=#2_?hHFnDSp7#3tr6K3O
zu{7IW46H=nG-%z0ojq&lV^rZ#ts-5glclPL+maV0rY2Zww(#7#j7>>@^$>Qn=t1Z`
zJ53q4J%a0ECBf~gh)qr4HOIM+g)q0BB?Wfec4kI=2t{eq8ewNW*BS4gI)z-WV=i-D
z{jnu)etif^SXR%#nS~6YRBPcM?#>mghYu>{mx((}^_Vz}tuHbEc34gl!>0$va1FW4
z7p;i3B=a!`?x3jz*RGwR6Z%UbQxE%;S30OXPo3zVKfid)-7!@{l*BqCq3m*!soE2u
zH<F>;&o((`LQ|AO&O)a^PYF?R##E&rQU)&1@`_ISu!0Y#XCQWw2Cx_S!4U#B^g)m$
z!CcWJYUakcyXf$D_<GiePwPs@Nc4f#l3m=YpY+VPc1U^aT+VI~Y9dH-;s$}yZg7vk
z0CSyzbE|d=HfV!}xp}bu=^OVhFU}XXIt36ax#KdXjJ(+v2dr`gQ781$r&bs2^yc7u
zc<A=`tSKl$7Z+eK^f)GMqH+W7JqX87WpsAKeWnQGkriJTs_?dDSys<`?;GqC7*tJU
z8O*>2EEM*1_kc-sP{bV*M1JMkO=S)w^es4{kdc-19HxcqXVFgUSK~j&yDyA^ajbZY
z7ks+Q98arq-FI^=lHaXZeAl<C?u{~wU2x8#dVnT$?``GG&x=X)IP__Syls)0YoedZ
zU#xOR*_2=;9%A+g_>sLa0sH{HEl3|to7VIpj!R@An?;G%GIYPiHeL^ier~4zb}>}c
za?Mo(l^~jrs5<>a*{JID&4fnY@FZd>mpD&#vK-`3uP4#&f3j1|#vk4XRN}<>ailg6
zcN~0xN#?%!%J&9rDh=Bd7;!wFFn53Dwc2!~SfN>~63_BxTF!-2x6G^xn!>g97qHu_
z1~+@3!cl3;2}*QoX9R|7S)Ys&s#aPuGh(s9teo7tbHn(d8w`5mrM*g0_3%+{1O8h$
z8%($9UGIX`?mr?Xf}ot)ms1Dz*20xNzND_De)ol;H@=Cqenm8O^ix(DBTAo)rO!AH
z2fNXRu_5=!oIf8jSV#GXMy<5m*VfN}^g?o>OT@#8H%{NCIMbGJ)(Yv%=5dQ_cWI!v
zYM^rEZf>3;t}tP@8nfdKNe8e&X^gaciTiv$B4d?CY{{nTXlQfZYTL|%MJE@%5{PN;
z!##dQljX!IA<ymOxLP{(%^T%dq53NH$B+&%2KPtHR)_0MdU@{MteYJ+j-Mq*obm>5
z@yH4Np7YI~2Vw4MEsfdn)e8ppeiO<cbS~ZhrZ0S1P5;^_ke5(y?~|9v+Re#6kh>&k
z-1vhbu(^M=C(FrIl!u!YUTY+iZ{GbOJY;$$4<Dg*ro*<}vCm#16T2GCx@)(q5b96Z
zD0RR1*7Q#4_G}iuHar~Qq@}rKV2Bb8Vr9<aMJz*wArUbv`>I_bev4;V%H2!-Vfj=%
z0-3P8Hl-H&><Sf+%1S;3$3pc&fEm2OnIpqbcu{6vqm-~cx3%j_rBqVIR&!XnpxxE}
zc?id~neqYYp(Nj`8k@Ya!;06tMRT4yW7f6NF^7&_d+PgDSQ=J*UJ92iFnlFxx?;6z
z+*w=wc?joOi|V&01YO29Y=fosrxxSxnMf=S<!(}Ns*Xw!e2gzHo0S{1GHz0BO%+Qn
ze%D|2XWd!XapKV1NM=B{Ew=Vpeb@KxO~d!El<6XOHwJqXj9swh)-g8mQ^UwseR%(R
zuV*g?j%St7{qUsni%tF)haJ00^i-UCk~<hJyR#;vX=E|jepDH;-KmF-3E51qaeGAL
z>!)`b!;Ti-`+XB{60>&Vb*1iavEfQH$YqdP&tmDRf5y(N(>g)QLzHcql&;X_>-DX<
zl+sK9=B6Y=4uq%y)2zc_a~6d6+xH>gf+mDOdnT?>&ltUHferx;KaWJ!Lz%CfzYv$R
z-c*#lFsm~>b5yB2{#Kn{@LgSP-qG0Q7pYdc49dw(*bp(}no_i99BS1WjSIzBni`aL
z-)k+tK|gW1!7RJD$1z&UX&}=qo$8J~gJJe9jShTH1Ap}QM>Pee-c_1!@9}kf=U7l{
zp@mz=xv<3J&syb-T?_r7T*IrKo|PRof|_4>05Dz4s`1;ER7&N0chqDsT<4qL3F(Er
z30j|eOu0D$+54We{iAf(M2Gs4iiUq^QnhDYlQnu7IZ%0mE^OTYo)Jf?Q?G8XNU2G|
z6V%cW#BJIrAu)9-Z!#hVRa#|(F6a~*^rvfUy!YtfZ#T~yd16`yf(AgXUanApxZRVo
zdxW2D9UCQ2uxzye9NZKp{8x8uu%3~2b04uNX9x{n&?AWnOs4}efjZ-PTGV{H-Xp|B
z4*?KeHr{-V*A7n)6|ArxsEaVVAFWoxry2=>3j<x^BEyD0E|<^AG%b`(Vbwwv$K~j}
zBlui3Lrf!-55@Y)Sp3Lh(3`C{N^V+O%2WT)?gPo5cj%xDcD|FriTUyc-!)Tk5i--L
zoOJ=?&^ogFA$MSz9(y&{)v5n6aqTHCs&2HWLYN)V#A{9~U>lXY<S?|Xpp1JWVq^b9
zObYjrKICGw3DoGi+E?Y$LZ4)@na2$w95PfypwQMmQ=>Ri>%&ps%l+IRM@{gZPBapm
z2TB__Th&C5wTjEo=w|k~XV3Ze(#OkJ@Tpw?P{Q{yBrJSr;}bbe`LP!CE$7?zHgL{;
zO!>pf_Z)JHqIN_xjzsk9jK3X<?Qk@1?d)T#8jEb@aQ{@*mg})A&`(u9@%-XIt<_3d
zJ`3o7TcTMDg=s@eP<guZC6I*(STCcEbNF2ie-SR!WeiwPhacbUeXCYkWvCSFmg&@Y
z>USTOpX{t<VLk!f!C>!)d`$I*O{G%_5@V8B&PEezqhw_rKkl6Op~cx8-)_O*sKW}J
ziX_FeADwm{>-MKe6Fc=ah>3Hfmg;JWnplZL@AAj{BAA!VHjDzW8hLr!MNuqA_`CFQ
zjuoE@M{-G94}F@Uy=SP==egUSmIYnWnrRJ(Cks5bp5hW6Su^C3>VpX_!MW^GQ%{)n
zN{8LE2YslNmI>9S%dX$~JF)XcR${DO@W=kFeTlt0ea3rgSyo^0Mf(AxD@VFQK)Ilh
ziHoLq?11k#e?vW&phi~{t;Z8Go3`SBzJHXM&6EATc<y$aNWF?){b+F1(R~Q4maC$C
z^y%b=^Ab9dHqpl&e=r$@TukTM@z_-;O@P|v;9C(9n<l5?7&y~?s4hRCo|!fdQVC6R
z#JJ?GPf&2E_P8#NEj|TtpjtoYf{MoWaG+?}pe?=_s?Xmb2*XMQWl@I56{+}8iJuqL
zYo+xExaX4?7sT=!Y!EuKP>EySu^voNtL;4%@8H4~IAn!ExCD(6#=&Cv48CZpcIfrg
zVjeEpgWCr1U&}2y+Vp!;Z%W}$7xv@pHU^>JwJ>#;1uYuS{1k$unLg$A`gc~1?B49N
zi`>+KYnnf_GI+TsIjAjgHfA1Ud<Gm1A@7Plbo2`Dy+pjp2#-7=zQ)>dC`RVJgBt27
zerHN;U9aec-=)BN8XdJ!fvE@EAGh9rcdxBopbupBjG`7R7ZEDE8F5rfrNi5Ia4C@C
z*{o}o_&j;c_FQfxo9LW^et~*VIq8)37N^EqQYjr{u$|Rk>0l@e=heP951(wjYuhq^
z-?p-SwRm^N-)JRRZ7OcnU~jv$e6bjtJK*%9X?*po?wNRekYtr+j)fkgbzNudGGBP*
zwV@~E24y_4t#-esZdZwjTH$2qwJNE}raM(qU;dG@o+!?`M5VNy*cjU&d_uXi!I%$_
zx21=8RJo$u(q>i`{5PzcB=zJnBPh~}Q<XYSDOA<(u4O=RRFZC{_Qlcky!Vj6Raah+
zyA%tx=(y;-Lsfr^!K{<o;ER~byZi~u(#O%Cl52W&?IwrUet32)R8w#$r*_n`F~gSw
z28UEf(EXtK2D@oI^esw}!DtL-f8mX7R#U4a?mBL%CRoeb3LjKIR#va5uuNRViX4u~
z+Nt&Fl;ARlD#!Sd?&=pYNb-^84VTiW&Jw5|BiG@{xIzxInQO(vR(hp>uHFW3rlC`c
zRzZgm4&%JqUA9B9k864$3vi-K0D_obWh+r<8z123T{drCE$SeIu!p7hqv7{;$H^cZ
z8slD`ug&n>{bX>!L_NlVkY%VZ6c})C43P#L`-#4Gh52Z7{guqRmm$(8aj)F<Hr-t-
zv^6>|CbEy<^bI(^#%k6Z;U4#V(S0}lv`vl@sd~*5R^E`X=MjloVb;daAl(b?JSKRY
zdlUA?BNs{rTd<~*6<087h>to#-$5`uKlOr2BtmL^t+N#=7)!Wekfx|TU^Y^TDH*f{
zsM;UN0aZ`^P>WUgI8Is5%^I$B`iR4nlxfQ4g>kkJE_^MOk^-xzPmHKt{743Yj+5MC
zGJPT#+M^nKMMy7xom~niHp8tCRr%`Id$om*OD)VN$2gA7z&BizWBPljy2FETOGCp?
ztekh_J}QMQAY9D*5;6ozKW}7o+CS157WW<Oa>&in(?;^i1Xq{_oRP-1Y>$f*G&$Ad
z=hdWU#6+EDPou6t;Xk6xhKejYd90Dv9Gt(OZzkgTeh>Vd9n)$WpFv{;n?4veO%61i
zej^P4gp}A0%%PX#y#0R85g;N%u7d<Sdpa)8yS{9m-)}qP7tjvsQp<mA_hConPdK*1
zH|i{Ujmr%So3Di{-Ncu7-;0?gtVE(P^af~QJp&ZP9ZzPrt|%w5O29*&FeuSqWY$Nm
zs@b9zN}Qr~R<Z`+6L63^memBil<JzrIW?BE6jE?V*Mmi`*Ms-d!x<!OsBT1?r>+*`
z#aTBzJDEMhIi&ZL1**PTXgf)0DQk30Mh~rRl%l&q+`5e&3Emyl;~TVG=VFC<tn*^j
zBp0~RA81?~WbW&}pb~ebQi?Wl9QDGZihJ~V7s~lQTBr7|{n*{GZ`2LVzd|*S*W|Zc
zZ5DN~bDfLn^oawPw%YMV$*CtXZdj+{xucO^rrwsSEG}+M8HC+yixx2}ai1I9aIpHA
z|5CSn4UO$ZSLs<#_u95rZafim`3$@NK8o_Umd>vnAdv{u0wSV~Ok4)<Kux1^O^Ti<
zVOc-yiuQtz2NMNn{^ojRt4?eR3^xi7UOa!DPJXu8vEvW_4};xEkM?m6Q<~-oK?qMw
zyr}czen)mXx14)U@6GWT{n7yU{wDo#ZQXLmOf6vv-fWXpk*jhRPoB7bvHdt3!rx|F
ze&y{&yF4Ye2dXn&cS3T;fj_|r4EYLlUgXFYKFujOxd2tvka$q;qP%&@I{>|X)p@aU
zuW_)pwRiRgG4sn@($X*HvSQD+b_CJtW^MXk)?Nv6drWcf!vx#pUYBY=$eWzy^erBx
zsklA*3_lZBZ~d$syYR?rlN2!_?!{Q<%HHlA-iK!r>d8ZD)AhDyP6~FK6c)BhlzzjG
zTLs&2=(qfibe;>4HG1A5m6@ouAbvZr)%|ILNWQd3e(ugx9_Wy1SKB+;#Op3-*h%bF
zQbW~{SX@ZEWlq2eU+DIIR|=Y`Du;lm*m(SV)vXa$i$ffE<J7gh4^oBMMF5Vr=^t8A
zyQ{JNBU~E=4Thl}o7qlWO&cuDPAClr*RxHh51VefUV@%m!z30UHwE|M6}`iDPmZ0j
zp04s}IV2-zhAy3-D;bzAGo2f9oq~9bH-EUB)%e4%xI4lYC#}y#bycL1hkM4A#r3;;
zhmuM;CKB!8<*w2q=PQaWjC3cgmM)_~Qj>tvwI#gWv)PlvfeeYEa{2`}L|I_9WzTEk
zikyWLT1-u2z&wT8Q`EjBJ4kfc#VeQMuJY5694J7T>B5SX%aAdWdTb|*3V^?lAJi78
z=+llbusI>2Q{FXraYj=;a>TKd9~+5AHlN8bHZ2>RgQ@Zg%sgMANZa*X=N*(q1xl`d
z6I4vg<gl%0P1EeMf)(AUib1(8l1>Bbx$vYS;ZW*mpS3R{t@dug*^eUmJM-@imj4*+
z-7+b9QpIU(@ggg7ajBrl3jIVJ{d<|S`^afd?&bvPa#x2|_i@2n%B@lJ^L>cT7aSfT
z!CcJ}c@RM3=Jxa&k^lqFiFNz%OQNJX^F45jINJ#WDzddSAx|$|;~_8%SdD5F%D<jq
z>MhTHhQ-}z$nU5UCr9&Z20{IKx~Eq@n^rlNUUjn6G`baPc81^WVfkou0_T|*_4mu3
zrghq6s3%}U)gHIThuSjd^nSHdebjytfS~6=D&=Tk&us@a0*EiS#Ef_S)^|o#f#}O}
zd`5=Pf%CT={=piBc3Gw)BK-uN!pF@Y#M1BOxUDpBdD8Zav`X<SDi)@7bbj|=kB)1f
zuC(1i-XF9w<*KyJ9=dwv%KVR(xQWo#f*w=0-|+mzSF-$6N|j3$+=TI<nH9m4Ks$e@
z$cv3ES<rQv9dtxj2mgC`+UB(}O9UKRc4m7Vxp=tgrDK_Cn*JZU-aD-6ZR-}^Rzw68
z1QY~BDN>`-q>J>fNN*A8UAok`ML<MALhl`<ONRuA(tEE75CKC^=mbI%?vH)m^L+O^
z@45f_$P>s~bIm!&9AnJ(%LR?64ZH71W)J_@NBnhhhylRVZ)p~Qe!~x&KQAXjswipS
z|4v$?ll*Uh24el^&uSZ8dETv4Asp3{%zBW<(urUy4j>?t$Tw@A%C9Hao;Cy{#D@MG
zfRFs=xYMxw_(Jf_`n40<Qx?*LTbVP4GQ&1ifDS0(Xl!MbxF#*R&Hpmnbj^U@n+jk;
z{NRaLpzcZnMC;qYDOb27+96L#D(8+UCMh=(Et54dI@2(V(ctPNV4Brf>uZ*h?Nz(Y
zSKgvxv;DuowF}n{=>BfITyRpOqSMea9I}_Ca91!oEATE=44`%WAoEpr?C9#>G9tFL
z@0`A}NPeZ^Kc|dx(4;Ug(UNj0NFIPocsfWjawt{&t7yg{a6A)94}iII;nWZ~HQS4P
z!qfyHR)9yo>>#W6LG07ag&~FN^TN{Kq5tx~y#W5RY4-p6&p{u|JtDoGY5mJqpi-4W
z9qiQx&?SLP{eR_x|4$K+CwZSzy&W1{c-KBLVrCu~cuV5*J?!m!wC*JT=GIP~X$tY+
z{9pC#Uzh#Ep1Xe>yC*Td;O9EQKV11N1}7``N$%Xy?e72PJ^xJxIN3J+Vaiu?TQ3y|
zKResu#XX!!m(Fw>_d`wA5O+H@`q;(<!LoW{GH$p5K$-BrE0FUeV1D>AIa@>r_P*aw
zTW@%uEy&(}bDD6kZ))`zV3+-Vn2?wM;u*k=&ITQBI`L%gdxAF*pfyRDHsA*|UXf!y
z9(@cD@6UBS=VD3`r0cGEGgr(Hx>W(0p}w@CG&fVR2EYKNEB3z+<U#+OI5hiD_(~>z
zMqzhs@`qfIsu}ZdV1MET$m5F{V<FnCMdQ<*yL1=lz)RQNJ10K)JOYH<-`U<!%v?C9
z`d)^WQpf`I(8k#$XR$=kx4u?;{#0}>CK9Nv5`X<yqo>-0^HV*tv0m}aWt5>E18vU$
zue^iw@{_<HF+VQK9>wZe3)38{SdlL@bTwM~&NAEr=0H^d;kc1&;jxLDARFKnpdwDZ
z^e^djAq3b+z%-Ku^j{h<vt)^sq$m0!2+@9^(4Jb2-n#dnm+Jf^^8eM{!HmHsNYDE$
zC?OX~wi;=Uo4_>r_@@eGvP_2+U{+us9`rxP0tZxpvA_?|66~L`JS>m)-8PMH4dl2T
zeExrzcWu}&^(RuV^Ei4;=A|@4e<g~$jBNEcH6NxLlb<of4_v(a-xwEv*V8@He3{B)
z-aL6c_dR7*zD_#n?U}A+ai6EuKReVR6;Y7*Qx)Lg^ENxTO@9E^Kfo5U&sH5z$hhy=
zpr96iwR2sq|MsO#`qj^#YU%sH@$0|@UiW7PV6;{TLCA`FjNZ$q+W(c(`8<H~Jj*0q
z=8~($`+buU0htSS_g9$NeENNf-LEn2T%kGgS>}!S3}EPQ)pia@&BXX!!Wtc9%N=|;
z7tr>`hn{wlnBneIJdcdK7M_pb(`?__Xs-^^@;$b3HC*0P0zMpL`QL~5>e)cc2g_uc
zJSOtso9Iy*qxe7lW44)<zr<IYxPff82yUfIn@$pwTU7}k;aE!U@chRr=Jgk;V+CK*
z-;G%r_z&hj(?W}KLMIv@$A094ZEW5c+h#@q#6B(5Gq+$X;0{<z|M#yR;L&KmOnu0c
zJsh<q5fg=NcK&ZSU=6Sq{)e(UbU+JuDgTf|Uin87XCEVb?ocrp4Ae^h60$b{LUvQJ
z{9@t@dF4GhQZ<Jg@;+nv^uS&>@H;R{aCfB%nypnXyW!`AxhujW|2M_)E7!$PO7;Ex
z$Oh&t7SVm_?}@9rTL{AWO(;TongiGI8a9u9_+<2O2`>mxEAJAxfM@v)?a6l0Zp;cX
zq!Db&cG+htJ>wT`a9!6Ebf@Xwo580ITTe{?<wD|Us(poPSwyUh^HEgPX^;MYqQF0A
zIM3fAFkL)xWMNhQXrx&&Wtl6X^y@Y0-?91^*iTij{br9kp_pS{4g-w$)&BzM-k<vm
z!;TdYYx0QnB4ftY$f4Yt6>2LjyC8tcRGV-plkrNeH?bQ$G#khwUK4l=NC)*|SA%1-
zMXtI&Ncz8dWB+smR*69I3I!Azo%@+(pmk@2nCprk-DxFpX|54@r?poj+CM9#4RosU
zX8EnvR;e5|@^mT-PmNGWIyc;sM~u2@Srj*zN6x<ykD8&z(jZyOU42!7i=pT-_*^5s
zTBP32t!}8{aIe19<(w>pp1Bj3Eh2_{Xn5g2yAi9n^E#R+;ju`V>$w`xN*@ErB|bOJ
zh@AVl46rRd0p4UUz*`pB4$tCaM>zNYnqkLY{D<CMtHS<|u_$6Ew36;|z~}B675jgl
z2emIY7ki%y?iW%!j`|M@K$;a8;xhyH)BqfUwuyp0u&2CfCDj$>(jeNuHtQ~z=_$wa
zXg*-O1qXthM6wvy^=YNa&JSkE4ZAe&*36d~*Z5B<Kdai+dNZ1<gd39D_To<j`Nr|+
z`0P&`0rQGqS6u<r-0^O*_PsnC9@Fk<95C_oMI*?VDN{&L!x7R6F8ay**+CvTY!!fb
zCKTSxR@>l)(4--mqisllU<%N{oBGas1DK@iBP~T2;ivz;GLI9_>lHvu-n^<fD1AnW
zn6o~slSvBkJxVG)*Pdp^^F5l_pv`zcG#pfX)|$P)7HAOq(S*c&`YZTHR$rgVvCfz_
zCvM!L&|Dc_mV~5ijcoYyD>Wis#<m|wTHso9mwqXI`E>x|^6h5#O_wXC1#kx3HwBt1
z`mKL`Gu)5XBWGiR4)SoY&5HioD=oBXZdFPvPi<dhvs^x)jp+v==7RPhWS;$<Eb@Te
zT<|G2si|x#CF7ZL`RZ8o;fo;BZwk3JnxIvwej0kA?WE*aJ{L5fXDeSs5IaG0zbM$#
zn~rb+TZ=%eEOJgp8Ndwu+wm-0?myqnSAX6UZZ?Vh{HHE?bJ?VTq8zDHIvfemFB;|6
zWMOWO&!uhw%hF78C}wW?Ok9_GYSWeZqo@npYxuHnQ)<L6u`kli)OGoNu<cdHALcUs
zOy1u=j^Pn!LB12G=<Sv@EB3QSsox(i4dnUz%*CwE4PGuN%JlCeVcj5}F|vg3roe=-
zGVox_P7dW#JF2`;xbJ#UBzwq<uhRexnl=9lV`<#1Jc~|yVx<f-i}9Q`_ia*P^XqV+
z>)x8JnJ-Lp-Qb_j=dW8+$(ufKEB=@>nN8mBpdU+Q-&t*ZxA>x=RWGvGX2ek!a(0TI
zANMGaE7EkQVib61stPrbvd|R|C<|xv@1drpg{#GJHyuuyRwnlIo2~wRy6s!~XMvHr
zB-X@6F=l=s`-sraP9AAF?gaUmH09f0tK)E*XF=d)+~VrDf}1iS<YjhOU`#*`t`KBM
zWOS`hX`nLYVVe&4`u?=pp^m?0)zOqcEG#fI5!--XFm&lfDsN-a+fCi1*Y&#zxgBiN
zV2BJJASB=n0NQk!mSZZD1=v9Ik%`5)JhPFSH^xnO-XTJdWGa+URa+gm_bOw3QXXrF
z-LxoHtqXiNqLp;r%OpkJ+Z~WO=<AsB>(3vq%E5UQOT#+YYUyUgbQgaZl$XHv`KX*Q
zWxI;o3W6bB5sh?7u6ST8$ggs<rZGcTy}?J!eIl>k52VSVUC8OHjZIgOBRxK6(17~>
zA*t2OF{aj?D@AJRbvOJ$bx&s>M9BGr?1ocb8#)U}oiQ&*bKgNfB<%bSq4f`Xi9)F^
zP1@$VdDm3zCfEJ=JYCGAE!xH*Yf(NPb+6PwEBN={6mt<g>A(3WCjDh~<Vdxs!2QAb
zD)!^&$OZd}ioS|+8o3gT*<_aY86nG!r<Xj9enT2)oVZS1j7e|vuH9SAA|LSJ$C6rW
z9n<ydkwTA{Cn{?RWz=BV)q4Q0)c{WswnLT;>}GddiW<)X0PE6Bm6fjZSU_r@C-7<z
zmN{@CE_ihCsMQ6!_l=YD_$mV}zyMSrYq!b$xf_2LP!&WNiC87B2X$2LIuV)8=~?X?
zDyq&njX(I<j6~lj=kJCC8qpCUmMDd_7bR5lU(*2hLnGX0q8uyqexi0^5GG-T6Y*ur
z$=R<6VA*ZjcxqN<t_Mr6x^g}$?g7T3Hn_MfqBZxz$({$EpUM1B{hUYt7ffo;{vNB(
z&c0n)D@^Kit0oBgx%Hs=v=ZX20KJz3dhgu02uFK&vjvoCB}Ubue%1_0_LsK|N!skQ
zq}U&%9&nu{wH_4AeJY)9!Fl88b-nFyb4@8l1)#cv&?QiQuCnx_?n;ZmDu~}5kdrlR
z)@r>j(`Ta?S5jKB7e2jzO4bq=&FFb`&?eh#P?rKQi0am@!WcBQWlyXd@GR&%Y=v75
zt@mVK(g{EStdDS#YPMe}-qL$ES_)b}v>^dt;0hSG;EN8z?ciIddD0TF)?P~_6;=!|
zaN7BDxzs;8whmq9m)iKQ<5oDF0td-{>z)}yKJJ$D0YWT%ZmBbpzkc+t9e{&tyTD>|
zRKbyn;vNHzDEp_2JY2@QqTEi;mIs9AH-T9|nUZ-1en0DMj@6{#L5|~w5FBUX9_?tg
zn&q1*wft3>FLC`VzGXWI_xWK=*^j}2gw14QTD!?bs~Cx{`S;6FqO2UHbcSmhsXPAj
z-qY|&CGqO3hp{@5)I`EGV#s7`0vz*f>6*CvQb#o=%C$&JVtdXrD3p^#S`kOgvicHt
z$wW2?(H&oka`l9NN&G|!gIP%1H%qH54f%P<)r1+gZ0O_uyw-Mbm>Ui7#EMQg#%W9P
zZhjk6atfZCrcRBLOQ9G{Hr7esn2-?lBpup&$W)0aHjHaaHG$MFe&v=Gduup&tni-A
z58-x(IP>HQ+Q}a<DnxxUnZHimD;49oKMbAuj(x>iaW>@ZfpW1d`002Wi84IfkI*^h
zi=M2nve~T{lVfvwFukr@j&1NIP6hpW$nISUaCw&XlK}#-iRM3?)O%H#tIAO_w0!1_
zsCJfscJ{A-`Hxu0eDHknmy}aw#xJJU4)52deDXOI^OKiq6mbf^+n0!oI%Wq9@lS>G
zmq3lg_U|1IeNW#BPdVA107UTWYp<T*4yg9N(A&RJ7N?8XPGHJf&4L8`*Qbh9zvS};
zV6=>NX;SPVRJk<R{%JT3L3b-11d$*)qK9vgC0<+PJMHN#{D|h{4pM<qnY>!hk98u{
z=yCWhF9fV+SV+p1^2G~HIBK2tQaP5tixYo@a{5!S^YIGRo<XrguyFSnQ?U5LI|Zd&
zqjJ!%FWQf5BXYe>-3Rnb4Vpq0cB4gj7wL*u7`Qt-S9bt9OQSdzUWw50C#JbIaS1QV
z$Hn;sW1afNAf5aci=~iIN;v?QF4lp-1lDt=tm3iFeV>56RaW@<(y~|q0&rJw7CUWB
z1nW{A;N4>|G<(&kWpPn+G)#$LQrm2Qb|_HU$?gSdnVOsvd>f#m`qA{+)_uw>_m9h~
z1^!(u_*ouvtso;f&xGssQtFakyT}zW)0~0m(QB)Y48TeUv7wR<?`~G##)ejmU@$`+
zR-+S9Q=tOCBO?zD`EnKe<z<{lndHkn)U11(V#sC%LYohx&%K9)8Cz)``vXC0A?mv3
z!|Yqpv|<9DeLSZli06!!N<BE_Ra31{Vi)0-Qz_92Re0EaqoESx+u~kAziPcY-&1wq
zzcFbYDUTF0;lom~GO8+RxRics_slvq!-FCWCGACXeeZdF)9H}Pz5sWeVsG2;BbaZJ
z+xx5r9aX3N^wNrCi+jtMSL>qQWq7@APSn#HU~YSsR5!N*6oOs2t7;P>SV<+iVuaAH
z@wT1xKy06b<&E!k8Mo_Os%u4LX~u7Uc)ox6Ixx;uI~*!gXA=x&%ctc{^8;wxJMF<A
zLG8Od2a4D1Q8GFRESE&^>kRt9->(N_fH(ZoX-|ysv5MOXAS@@HP!nbP(0OYXSQrm5
z4pAPjJ%<^P|2ND~<#Dg|*;-QgVTSh0v5Kjq1*gi}3x3e=wE*%>NNRA$d@M_9H*vQu
z8m+873>{h@%g{0qw?&)`x}~=Y)GP|0og!S_)UJ+s*Igf<Gz4Qa&xot=Bm@ytuin0_
zT*({Ql-K*$w*NFd5N}L)aB5Jjn8%>ze0*RhyL^OllS?~T-iZtd%CXijIw(DAUm&^S
z4T~QYC@`uZvZEo)GKt(e4u(<2YI=38m-!{N%CCB4c?F2v$BVIXt6`vM^|oIsWc1m7
z<UzqHwfNkO-Za-DX~D?iVz42!vNo->Sst#9G{jXd(6+3UUFISws7cIoG8A}?@F|pV
zz*=eKPG^Vbq-bR(&ZZzjNgdft>U*E4>+ZEr2{Jq3jocDBAJwpz7w)+iw`QBacfdb2
zd7=y^Y`l@KGyU;eTVmGy{jbpAR)hSJd_k<Xa_Lw51m04S`0k%>MwqMzL4qb0Hq+jq
z>-2Po{zEd`W(|i^sAJb^fIBxmw<?Qo^2$Oo{JzTKnyl@+8NL7yI`XqJQBvgJzQ-AH
z1(^|JAbSFU_J#V`gH#du3D~tUr;$Dju|RpKobRj+lN-LuMJ)A$?I}%n)VnF`Xo`Z;
z5^0$c+*`rLZGmFOI;WR{d`In6h&={;pJD4$>4F3Npg4LfI(|b{@*YTkYhfo${JjMd
zGnvq)J3N22+`qcXtEpH42&7gZ-R&1=g`U=7l$K+HfqK2qEwH_^5Pt%&)yh!XFwTia
z&q%Y^MvJOeBd=80&FlM>-~OUioNjwx=%0I(mrzU=m^Wzw*AC+%937L5awy#XB-`+q
zKOR+0cf?DC7R~ikO(dEY^jhl9HMEjk@Xf0-AZeL1_^b0s;?w3#&M}{AQHFB6Jp29g
z(mV$R`_`06fXjKyb(*iCF)*4hS>Ak9W+&6n0}(Ib@G0}}Lb6Tvg-G7>nX$Cc*{i2r
zo}<V&Z3*HsC=KoosSk22rzydP`(9%y-8-)EMf7L9Ym2a;Um}H#Cyo^ES0leK!deKX
z%b^B8_r-*;CDdXw*@ij^`yW5>oOjn~7?Uf`FD5Pt6UZw;xHc3QP60IW@z!@BYteH5
z`1I_Z`}BMOP!>f%A+Yv|?Ty`xG0)aOJZnJv!X6gTxP3XzJOCTaFfl$IGR+i6*SlGt
zQ|D$wwoz_~c@pr`?;h&@QUuFxP!Y<QxK>OEBNpHn_Iqts(D>>X7R{Uez9dOvD9Ha6
zj;XJ{CEA;vaM(z0IIn#ZlA2h0nR-lnnf`dL4pJF<FGhv{_dH0x*$8GiY6;~OaehV^
zGl|IoDR_-A@fgqd&H>#i8P<*^Ud=n3*-NRhJxR(3>}cX#1%a{Xt#h_9TED-P^Oh>O
z^^-ykFl7wP#$#?tL@zLD>AjEO<aXv`h^-F$7RycTz$Chu4Wa^?Qk^q8b8w~!(;NSw
zR5Pz|uQ(gfOHub1{PD-~#Gf<k{fP}Nhvf?fUbDPo<uexYx_Z^}y9j?FLfZ<^ZQy-?
z5137JUaAKa57n2Glq=PSpJPvgixq!_H_t_fzeAXas*rv{s}3@8EqDuu>R<YXU`+k2
zEy{~2Mhyz(ww~1h2Q9+iEw*|2$;dIwOz8k^k*`Ls-ZT3o6+*Rs_zpR2bIq*|9CT7Z
z>7b*k|2Kn&4v$XipG^L(Iw#rXn{G*>LA#wy@G}M<$>c=qa>IV<pmi1lC}pWo2PzFL
z$3;nHBCkf#Vyk7FBH@|X(Q?a<Tms9VtUXZjv#_ajgKU~=!}G^}9Ta3*9aB3U^JwDw
zOBMkA)e#A=L+a;Kbx4Q@sJTB|Ucumz;ICb3I>wWuTN5I`w83{|g^;;V9O*~tv^Xa!
zdKU!M0wre-QDTxbq)wb?%aez5-~~6W{JEf7WN3xwGQQO?$Jg>uOzX1$aKJ)b6Wsq$
zcrJo_rMRm!_z~Eq4(Q@et>XmFuF*g6MO)FLwTv1wkw<DgnQIj-M<$Rv<MEAejS>gL
zTQd`G7W<gE3Al3EEi)SM_3qVti{(N)Tr^zBj__vz8U3zbuuc1--=>(`$kL-+UvuY<
z&xPWM56m%PO6>c{tGf}!^MT3-JN2kw-Ut}FWUUJ;1x@xz=agN0WA1Cr<Q>&@aei7H
zaiW#=$UkZ($>29-_>Z@y_n1;8Y~O!vM(1FWl1lC+^FXf6S+<Ry<kO<zzmDO0Bx+?C
zb*#|y9qH!M?hx=2E-)eX>X|)8zC6*kx6yB!(e-sc$0DqbNK?wbK@bPv0PVPgy|A)p
zNe!;$`*n1=2B<L(4W?yMGNVJ%2gW$j3-0U=t7~XuN#{op9^*sq4A)w%BKJ4F5c0#}
zpA>T!M@^!PO<eT(=e1%HdG)siXMqa-;AT@uJ@0u<F6qLwnZ3J*9&0_$*m_ttR|1K%
zKg9$)>^q&7*?+FAvJXmB$Ywat(q$i^$REd1NRNlZ0nM~OWQf49PsQu`nX-sXME9Bo
z;DY*ZKQFJ?#&e@Uz_==hmGA-J4FU!_<Df07Q@-kR3tWL%FgZ)Ar@d(4d=rjJl;Ae7
z762QqNDr-jsw92yk-1=yYO6F2`=?Dwf_`l<uer<d4?X?S>vS8RjYC>z-lJnx3f0(l
zB~3&Z-$-=D^S&nL?sUona>h9GHe92~6BTgoW>q`iEp+n+U)G0PY#QJ<&5P6l$JV!l
zPELWJ0p0L!dDm2pl($&vo<E);*Y?+B6nOki9mV~qc=5b#bLgZ-Wknrocx!QveJXf&
zjsJo**Wg;P;DrtgJx6b5()9(XOB*Q^5oJE3q(l5DYKB0%1*D`l3?&UobYq+Mhl1T7
zPU~qjcv#kbKbBl_8rayt0srb*q~?)GQzb)45hahWRUL%J>pPErdA{Lh605{-Z!F58
z@x12ssN&Uf^*x|(?6B4UdUyqCGd3B|b*x`@bKn{nS0WRtZ~1Z3k$iU{E|<wK2fWJq
zoIbji>iauHs<a1Ty~uD)H(A;eUz2I|CqqG6PV;5YX08CgG2eoYwD|$lH0X?<$zrWk
zuoLC@q8*Y%7T4;j*`%GOI&6qdzJ)7AZtuu;1UsNYDVbo}TUk*XMObiL9gWPNn`r_p
zPHzXflFT;vEkdc<6mMw!zMizXy|aMoC+u8-Ie3(TEpL38b`W7~_~;oJg#IQJEqhcI
zb24iZ^rz*OuWybV=E)a)ia4u5Mql-`e?8T<`GQaC?Xvm2P?wNqZ|_#_$_^}d2D^b$
z#I{Xd)pLAldp4(^9ao@3+XpWD4S(AJ0({nLL$-uEs-xH^>-GCqth7NaH_C4UmRW)R
zY(DE=-4#W6)mSMFANLN#q>oncJME4?pr(v5?cd%ZRMV*}2Yqs{NZgNVh$&KlOxsMB
zbgg?#5^|3k4f0_6bQ7Z5BB;V~KKFB2Z#>8XM44k4xcsH|V|r$cL4f3LN8Ev3XLk3L
z*bcB$Y4VGWv2ZQl=4pN^YO|olMC8-7QLRuv$B6nlQVwtvq#Uh=1Du_D)xTv$NrzX<
z{1Yqxvr9*0iG7CJXZ-Vg@<mHI0F<=)*M_GUiv!wo8m$ss<VvS(cSsQ7y1Hy$d01;N
zmP1$SbYv3<5n(@8x7L%D_30roaGa&=UTjRfzWzx8=Oc%`m!mg*ci(QFE#eWrCUu4O
z*GldFv^*P08nv|ff-R6rhy*opYAsNLzkLF&Y|U66#+JDbIybf6`2rssV>&e<@!o4=
zx(VF>&|VPCEyxJ*yfv97h5=ku!SwV?sruU9j#5F(y^JSTVNx$)m?|8PSIhg6<;}=U
zKix?_%{yP{tCz6Vh3%ESHHn+jTG}TIc*OR>9CK6Q@fFCF`w}OG)|cv};l;><<|I7>
ziRbu?1kPCRfil0rdm6*?{4p)g;jF}pLrkK+z>iaw>X$4+uxVJHNlDt8|6<Flj1gD+
zJvusXQm#C_l8~z>ILZO?Q%NcwW)B#6(%OF~V~Ay9N@V?UZ9q%?W(B-87i#ie(0^Ez
zvglt?fKZL`B0cs~j1!bQT-QljcWc(c<V57B&g3g34y|i+469!WdDk-rGS9Tx=g4};
zUf1>YU791Joinp+f5fFdKeOy~_IvO~Yx{LW$#R7OwIB_8v38teEwWQ6Pc6Y+soold
z0c~R0Lh+Iy4vp<fuEdSjwm;*_R_^@IP~Ph^OZoa55&Q}E(^(+)NnT9RboOrkXihAr
ztc<~w&k?j0*>sNww2P+qYBzM5ckF*572#c<V)PQ5oI_p*{(gt)C++*i;@aLz>03mk
zcbSRE>`+eTWiAvqn_*4q`}ud0{p@X+K{8FH;P&<fDdpI(8UMQI<)fhlT^mg}TZPys
zcOej24<&2HXxL39mws)U3er9QE3|*Bp+4r&?P0kjGdQoDKE|rN3bS~KY<^cZU+jn}
zeE;&4<_tH6VaC@wVhlmBN9N`+0qX@|&+#H1y!n`;Qro-_O3*wL|FD#l+90(5KeyjN
zzBp`E85?MkPrE(?+2P`r{z1W!T~$1_3OlB4ei5+V;Ti0e)(Grmk;=iHZ`L>(Y4Krk
zms9hX2WDwr-vcCX6M#(~%*<MGk-}r=rg^C4s+C0FypPb#CfS{-iqzUjK@#85z2eJW
z(VWgRZ$PhIO!yfy+`I0QHPBiGPNl|sFHK5Mq>pB-wAt;^_Y<yqjc}$`s&QrifId%F
z%-LM45-nDN_xPK@oCtse%Bpt!hMEb7z1up?&#)bN|Kp|mfp;?wmxKf5>A>MQsX$(6
zf<2wkG~e~q{Cp5UT1ZWX@bNeM)1VK;`s<1;Zp~GYlalE<)sIlX26Jg9+nn4SjGqr$
z3U4J&_UZcwlwYRz0s8>J_Q`e0dKaSz)m3v21|eBllf?&t#<_U2+080^60X2&W_PmE
zCyTUYM`~x&k{nIy<ujvD(-*`(=(D&lU|g-p_r+{UWZfBn`dUwUNiR&`xm56HV?kk{
zWp5L3VETQ$3BF+Z0FVmI1R2o@wh5Imw{Xux7P6;H&28uSy2m+inVgyrdIO3XT5k?i
z?>Ad@@0<FSjTm6b03X|bE6uHSR_1}ZFz$ZuMWlW*^2gpt$&+nrSYLHT=hA-N`f;aG
zqT4L2?rVF6xd;bNS?$e;5dGm?ZE1xXJx`*yOQBDL2Syz%stA{Vg_v+^)jY6`p2<OO
z45SFR2(54L*rXDsyXAHxMC4!KD}7ujKPUdBJN(44N!grdg1=Oq(T&9*uusE;vf&kE
zqC=Rqn$D+<v@S__@QUAcy=7X+LQkdD50e1vq0MPUHot^;TeLiBKYA@fL;q<HI#Dv~
zCrr4@ExYdLc=$OlS`ukkFnT%djK|!<<gn_cocH{XQ_YO2idC9eK23uQk2URYY{w!O
zGRLkIY=G+mSh;mSwNBX!xF*(ESUsCN>IW0PL`Z@*B}J42mFcivFR?NkYk4F$ObH0H
zI*_tVuS**E2&vWJD8FXyK0>T}Bb?Nb@pOXkacXvnTHq9QR=q~8sobQb3;KJeh?IRp
z-V~S3+=9K0z_nrFvbVRpLw#6<rGts^)Uyp(hIEk+YpH6S0=JUO#Jl-s^yC(wTbeYa
z#}u(}!t7i3c3H4tZb_Wlo8Jkn#0;&|s`In-F8g6#LC%(~R1-$pQinetVg>Y6t~$l4
z#V#@~;hJe;gMjdcvDE{>s1~*#Q|gf_rmn{!GqN^fgTK8=ARf3yH>jb^h8520U$)fd
zq==cnZ>dL^`_50EvHnne=E6g1?w(W)v*<BEIVEW%lmWlM*!GLzGb?CWg*ny6&3c}A
zc<{Z)fKv)W^K4YEkEc(xxDb_%d|yvwWhP_o`|l`ZXPnoI0P%iMX1gkUsldq+f&nW7
z?3lb5`<A$K-wU3t3sUVvl9qOiC;wjRVgB|1ztrRLVVF%nr@R{cejLSm%VQjn0E3ME
z5A_Y<P4c24$Dw4)aMqRD{yLMe$D{Xy?-rsq+r5GuaugO60)i}y&0|6pj_=R2z3(=!
z`NWXqjLJ=tTkHp{Q*&?+%__!?&Br^`L=1AWV=ou%1lCxLgeO4660N^)1CU~$`nIW&
zgTk;O_{Rp-qFir3O{sPso|x)XaTs9(i>9{py=^?1-^O%I(0u{UO!uBLuJ@ZYqEGiS
zo}o5>@8So#e{kh%%fvLRSb&y~ZtCZp`r=;ZEC4Z@f4B!db?`IJo%Y*sC`xF#Mma3J
zU69&pU*&qGW@|3mRKyii^}^KUPkI}l)QT0rLqs+sbGRu*_MfhAlvW<~I`~VMcUhY&
zg+{zFS-1A|lfOf=D~c8XDTo40$)yek^9nUi6V_GW5imlwq;Ow$G<>}Ha`Q=>%U*D}
zWMMZ%=i6;tR3Kgo?T%DRq%ls--#-K7-Grp%)Cu20&PbC4_EP48&6#%#O{=i+jxO()
zh>1VrI~K(;86JJT4%0%$cv<OfgYFwrI;`P%(^9ax|9XMVYRTp&Nd}bPn$F>d-TSCM
znX;0?Zt5V5!|ki13*OV_hD;}m0lJe*YkAStYTy$bJ@i@;WhOEzng*7^{lyW(%Q{hC
zb}HDyIO)k69@5ngq!rP+QE9E~4WsDEx9&CR?N-I4dtB!DIj?c8U>_r;mv)aDT8@yy
zGH2|nEN^~&yb^4#b#dg=inJ7-zgLb{dgnuBdVv~@=QG*}Q&AS+j9P14z`i&wPVju+
zoQt;1HJ+ok5bUOLd0bCwwsQLT*;|8!XS{wh*>5#>-%2J5{s8+&qHfO!!0LO75<Ra?
z4-?D>E7}e>55wP~{2}3z<uE+3XW*x=LRwwc1L|I6AyRrCoE(48z^(eYgiPPS)OP1v
z!`ZMZT^{#|K`G-&axDnF`^7LH-s5PPPvsdr2RS3*>MH%Bz^RA6Dnqt5HIYcK-9uab
z0YTK_nxcJ;@uW%n7eAzIvo_MzcwPtD+K#{+v`(ZB*r0^Nfc=rcj2jS*jwV~Y{}&_d
zoD;Q{vD*93;>)F&|L|6O4q1Et5?K7=60xhEvPKBc#X6cUL;*?|TA-q#BD^2~WArk@
zhuLI@hN}VnhTVh*PlEq01X0UANRX<4;@rJ@{BOCQMszQRc$L4;10gLQf?{1hgTEk&
zK(?Hs>fW(2p3)e5=Ql+~Eu(Fw)x|br3NSAhQy$B^WP1PxUDY~5BV6tmzv;(PHt2>O
z>H7~DPLE@@{a2;t0X}-oyPAUr1KClg4r35iThi2|(b}O&-QD@B%y0t>!sfg$JPpGY
zPi<N7bqDEn@;{)6scGFtV~SHXYxsP)F;`g`=Vcj#SH8xu;TfSVuF~ogAOMmB5aHp5
zFs*#ul;8{Kt*R}gbGol~eX~6=kDc_WJXh~eS`N4~p?SkHd-XO-*+`zBsEg=<)DStE
zSKytp=$l;Zq5Yz-T!v-vH|$Q(N@k+P+NG=$OUsrYb27I9WoMV+m+Fv>;3f5o?zx)B
zd&BkPRXC^8^7`v`CmSMe0h^{71~VfZIy`k$-R&yyAAK-<4ta`2c%v%(@dbrp{DbvW
z90mkwA|HfsGqVMb$U7M3FUrtjRl%R9^RhM~EuH(80VeoG!ht<kwm<+e(W?fZLmNDz
z-SGAv&uAC(O`dXIxK7Ys900-lBzl{fGDeqnF4;Z{?>;`;%AiPRwV6E25?rUuXY!Bb
z`+V`i{rfG=UIitpZn?E1ijoi1;~v~Bxv#iGdr|%s@7v3_I`K*`zuZ@%Q+>pd|80vq
zO^ZD2hs$gl4#Ewzc%l~IaP*?Wigwn?kOX3XYanI6$4$<)qmF^tA*e=<vz92X;913I
z&}+YAFj%TJig|cr308QUT5<&GGxl=Gr?sNfozVphs}(-_mXV>6adtvkPyW)H7!f3E
zPtvEadm;5%s(!09nen7M4jl|l)zpElb0^*4M)1qn@&*fbkLQetdaX+6`wO(N-A&5v
zCHw5blLtdL!^cCn`oImhA&>A28@nA11<2K!VcAVv)}Vt?+{5tv{LHt^52ScI@kGar
zv6V@oQENF}!K3gbGbkP(A+TSkUKkhlxM>8ev(={)&6n>&_E~hxQZv(}nT|;lnkw91
zhINe9M#u+aszf4|k+RWJDsr(}iA<#ncN=I|<g-mKf8l-<1>LX-&7>~?fU3Y&XIk(U
z)tTyp53&;m?7!J`{(_g5&!3OhNbj++O#spTmByKBwe%JZytH865<Fwr8YHU35Z~6i
ziM_OvuBm{3+{gTCAP_O!sGc;P_fdB&#O*An>WpqC>7Cyb5a?ndszfBxh3lH-l;x^g
zDD!$S*W3`~Z-G-af67&M1;{Dw7-kd0WbvLu9jXSqI$J-}&wgfOoRgp4_=#VpVdt5@
zY-;wON+xn59|ypnN!qmNf^giz=Ni^0B(akt4|Xs=BSEddODZ+9#AKxPL`Vshft_X!
zaBpbE3GtU)@I9(^I%}5g(s#24tvAqv1{`C!IpTHWJvxID$FHnXQ^%(?*fzQFMs$K%
z9B#PbQU=em+pIOkx~(?9%*oOH{y66e@Gyd{YF7q7_ppTV!Ra*$EV3URUiNyUs*OZA
z-5=&P(<#J+Zm^u4#GC+<o4L2eMn?^+nZmxaUqqjNr-n!T2L7P3dn$DD#OuxlkH49p
zf``LF`$SjWrQ`e-+tCuBjFl*Pz-Xo`;@5&TurA8*jV{EfR9PJ(<7+IZKW#7XEg8Vo
z;yaff%GEO5oiehb7WUrI^TaS1{@HqAv6UIzbys4)O$g<cGe@<~s00=F-l2bG-J}PD
z;+WfiA;KC1z|KuuAYR*eN7{xtkH{usb${+_>3*NnMogk<>X}hM#*DtPI#UHs-)={=
zP>*zA^*UKPw;NjJ7Ne`C0P`Q0FR|@uiBFnS3z-X%a)ypeZkExPFY(;z(Ts2#3tclq
zMdffRob+aUxYD93JPj;t66^y`UO5URy7XZLP=t^y;#~s~I`m1Hmc`^{3Arbec5F;;
z2X|V})}>jQN^Et9e1g-j9d<Q<WLo7C1JVv2EZ`MpmH9f<>gZV8JgH+?8!U2`dkK~o
zwZE4qu+``xv^}Zk{j?L<G%8iP3hb*98AKt#qXM?*^#r~*O<Oq)W+c37!W-aEK4?uy
zm-4@Qy(QxOaLr#*D4(NRySR1LF#h^-3iou!NsLz~ubMtol}jI)A6a8rpCMrGPM$Eh
zJQ>6PC%sm;gm^@OkXb%J8qk^mr94SrmvmGq(Hz#u8bAI|tg))ePSpp_J+Zbp7XMti
z4vVV9x~F@~M3{o*j(<OrJ!ThOll;mtl5rk(T>3B7ckdOa4oC6@Ep!~644*X0X=$T9
zGa(zEI$NmL2ca<?XA6$(M{SPeboP1bEsFD1lKM-oplJSD7H0Uo;#?815a+9p@eo?n
z+cn7_h{7B7`Rn;7gyXVm%;ER!_=Df@kxRCI-v#D5*Ql<w5Z>LBO+EsD>#42<Z}tTr
z%EO#_dUcSUk<FjUq;2*nm;}{u&UwJ4FIhkd{q38(F&IRnL7@YE{5ii3ulp0i!Erj}
znnqmygdj1cK>SwjdM1+`&BFt5Ez?~5J&`1oD}1m=;~^`N=~Qy~Jlu*cs^MD7bmXT!
z8U-1?vr6K=R(|gneern=EX1I0Z{dU*dbiv$r!jMHAD`5d{Z*E`XF%$Eyqf8$?ZpbU
zepjV+d4x&0(^>f_#hU5q8H8-t@R3p-k2<|?zTNw>w`z{283G;ZHSJV2w41gFaQVe~
z-5BgLgEoMmo#5Zcgl3jt5P{IYIk!|VhBV)ax7-5-TejNA9eKS(B&|QbtFuzjWIM{Q
zc74pMC-Pa7?CcSst?`(=JyB?r<yf<48uqsP+y0nP^HbA5WPVEZjpb@Z*z9g80#lJ8
zmEgq=2q`wn*%_iviKP{J5jNFz;J^DSIbW$F0*BnY1?tVB({2l^S5eHylx_3W^)xri
zSJ>r6i9HpcdvDcASVvn)7^ELLVnk(_vR)@Q^Md@946R!`uKHP4D40QGy~cTZ-9xWR
zv~u1is6EDXy_L{zN+)^VmYSRF`fHcHsp1Dp3PES}{Zw|pQAmljTw7Pyv~T|7&EI}w
z2B&oM6Y~6w8?|ym-tZUxTc=RS4N}G*aB#sRV?(-Y5Z5?pyQ?!5t7*)lu!dx21^>K^
z#T#$!t4-qW44r%uh3Oi+RocU)Gyfzl4<Ko=7EM~4gS#Do-Oz{K4%j|4cez}AfE&h$
z&aS{Qi$-m7&CBlzb?l+~Zp-7pC5ciBe&GoT2Z7KoOOL9`Gnkf9l|V5vy8>*#)sV6r
zU4Swe0|LgMch$d0tGXq>6#B;OZ5%lE6?tk0o;$UlxT{s4o5pR^P10Jb?0387Me%no
zrFvfCwq#UaCcZIz>4?L~=M6+m>VBjG^h$D=isD}ZKiOdl>_335;Zj?gq13=g?}zx|
zRb=Oye9*yPxWmPY%=5h)6c61#1E$k9IG=r@atRP2bi719@SDE=%E}<DlP$5)-8NI}
zV$-mX12;&Zoyndos}UseTTXSF<-1k!(nIs^4r;>F7l|jm(y$7Mw!4}Hd2h$xi~Z>l
z;?8suWokC(>cSXuqmqrp_SE|GT^aw{v?H*pBLD4^oXPipGzcyD1%CCf5dplM37?P9
zAk$q1SRcwRD=7EjaW|+dcSM8Y%z~E+f({m!8~tS!thb!{)@RdJZRvwoK|us>ux_}U
zFs<yt%ZV#l2#}mHe{CedAcKA3CKCvzboqar{DUOS*Q>k`PlaqtE1UPeYzB{_l}j94
z4o-&C<S$XcO00Ev)vva=kzso%ofokVS!tS^-xB4GWRxwOshOo`u!RK$ovKPgfL&z>
zXNODmdSP^i!5N>=V0FfJntSgB=pPOc3Re|j_*8XlIi8m`EyrNm`jO9#s!$0rch0C7
zI4cs;LC*gem1V@~<F#Ip1arK{H0#=8{f+aI+B-fm&1yBtvB}IEt&o#oCS);U_*s^q
zO;efa=hr3yBUXKp2fbqMuc11`MIx2ZWB&45s087A-kfuBg;&Qdl}0qVj)1yNC?~9E
z1>_u(Y@pczpRn4(UnAW0@Bb-i@@nBtIJW-whs%#+%h&H9`LJc*<wb-ew9NOjRvF53
zSY~kcNU{J5ooO3(NvJVk(P>-mBRE)9mGLV`qzjwck`J+64N}I;+%MDLz&)iVxJT6S
zubzHRyyv@Bg@bWss*Xk9&~+bPU9!D;b{tV!P|NkjWp&ei#^R>I+wNQq_mH_bfK~Iv
zE_Mzm&(~B|>>ALxl}K9cD#|F2sKwvx@bt#zZO~Q;pPCAvjBRnS;Og3`NjkUpKUHCt
z-?5ZhT>Bx>^O}p0nPHJe75_Z9t62|wUsD5ApaytWmBRN9B~tGaALVnv9C=&u!YIMD
zf_iAija+`{cl7A!VqvEW#F@0qfvTV{k586++i`6gQ(-Xb#m`M#hJ3zRv`=pN>g2?^
zCFWDlJ`6=#CDgA69;tPImXbi2<O(D?zEhb^mY%7fCp*KF5`}iWRMqbv#u?g}ult+8
zn<rfEDrCbcZ)?3&FUg)59FE*;J^piiG@lsMLrwAQ|Fv`BIqm2LQ+bC7t?51C`Zg6y
zOXVyfomBAb9uRt*=FD3*;ICm3%8QqF`(2V00Rb*Nz>?1pC=y$bCM#h~Rg3*RXPxoQ
z_pX%+K5A*KI=gSq_FhBxmqh*bXd1P7!DG;kB@6QLs-6HZPcxfL{Z~@b141^KKHj2%
z;p^B9G8LuYI-h>ffs)tUQO1$dHo)Lmqx(f<QrLU@N9fc8Tu)7rm1nknC_Z<y<=tTn
zdv}|THg89pTv+uEKI5oUOSFQwIT#|@D^^Q&(^y<+RAc3In%*NG;}Gu1*582HA@@*e
zA*v@=U3AALr_HPkj4VUf^hlKphpkFf@Ze*R2+2C)T}$manF>*hI<7ZfOSOSm(y5G*
zZlh$^eqPGEOb6!w!uk;F*Imv7vamUOdV^hd?pV#wgSLHx*8TLGADK!4%|@ySS9~2z
zN<$}OlBPjFYXTzoXSc?juSlgNS+l4;X-Df6Ba~J#3qAKKt)TaoP*q^}etfU);W(n3
zE=}l1#7pQizN0vio+tSwuf9jpN*`yZJhptXU`sv;C9hYOB^VL#+uIh$1crX@OrKPV
zDel9bmudn>F+2#3#WIw7?kGn+zht>4BloXkGp{s}WnNmHC!6IB!N2rLr~0358spxg
zxH><*lXEB{aWYhuQk1)t0R(}nG(&zyX)AtSHdp#zUY|?7zW0}SYtDmH-KzpdGFJ8a
zt+*UKdcNOF<L|6!TRs`@#DyYUtI(EX4PH9_saV;Dm(`X}sCj(`8Zl&<C{s3Z9oU%k
z&#tq#A!zdMa+xy|_Z%me8<SL+5Pn(7Y@l2@t-@$-+B1R$0ni+5hd<FOcm=7M5n8n#
z)5b}*tG^DFeL5QSB<#8G%}1%(xAk9+)f5lz-=BvEl{iDV8x)Lb*nwS(JsV2LRA-Nd
z<$fEmiPy;;|DrWFaO+_Q6j2o9*li}sA`9}X%H^q3m_%^cUwC%&3WSjOD|y}%n;LY%
z$FsKqeet|2UZ+sKuzXy`QG@v-wSvz(otDRKx}}EJia9$7a)?*4G{^k)V{-+y$vD8Q
zu>7t)|F2_(sw6ow6|>x~Jbn>GTd6Wl8F&A{=0!23x~!+fR2+nucUQ#z8(ZP;8Jz>8
z`Cw6Uj~j#~E&C6Tz$f#x6Oba*$bMR5uUa2g4|ROL_&Y1I`dX#dklUZ0*u_GLadL29
zOJO?eReH7hMV_=1$_wNbNUG#y57o1~ZG9YM|IT2;eWOt4NqkFw!0Ku8g7_J+b4cg-
zs9}&^M|#mV+&t%Gvyg;k7siS~?|3Jb*FONYTsN=T8b-LLv;uO6D7~mJEYPi-nI}s}
z`a{x-0i&Tzsen~Ad=P^HK)6iPohy}WcF0->+iq5$cX7eK#^k2{pqR}SHL<;Ig}D|`
zz1h*?X(PL^wQ=25#8b`hC*)m?$>9<0B^bRX?CM!#^-z|}M^&@XduJA$ozR^-!O%j1
z{ZdUmy2$qBPvfD_HemoRDK{8g?~!|BvE`eeM~iNOHlJL=(|iY}_;%f4-r}GK{c$4M
z@%z)>B%vv53tfFqa|CnMPXtdj`iFWhn@0EKvqBs{wsEFqbI7v<Qw0@~_@h@cnBZu*
zxJz7ri*ExrjJOp)Xap?Plo+H7f`llKEZ?d((xNSvML5mm1`qJVvM9hrG|0gqYHHN+
z{pi<E?7E|`kk6kUyBp9&(*Drj)!T$3qbT7~8Q6yI<+s)BHGMAQ1reK7Ja%@B>Mx;U
zQ@e@dT`X?t4SvZ+3}jYl!v*2{BT?sV!YldS6~)=`MriZ!9h#X7!T(j7`GF?B{8If#
zT@}Mrz2qlJA{ip!tW5p-W;S4B*6iwsOEe=?pSyx5uLj)&fnR9&Y7lnhTusjktdHpo
z*fdX3-CWO<cy1Cu2YeF(JG<2!PK~AlHWTp@06RHvedoP9D1*ersir1Dc=6f-c6Q{8
zh=c`?T~h0eH20n5+DKh(J>3>&aXIjN?f4OT)+T?Hp@&t9*^D7oHjpmUKv+*m0Q8&O
zf=8kTX%K(m!Jj*-zD4Dmmh{76=7io!L->ZVtDX7THBY$+C9qhMr%QsxIKYzq>XpMJ
zu8LO({+PBPY&;Fwt@eLWoph#K1+7Gs`jx!^v5+{wa7rD~w=G$GE|^uhxA|f}-y>2l
z_1oz!nlVft;NED)<WjBqtg>Oj-?dJ3%4|G}%DkrRJ_B=pY7d%xB;L@9%uCxL--65R
ze-$>H20ewt0fjv8HH!6I>=8hhu33UcbcE+qB{crRGoUMjWUI~7hx>?c@e9-FXY)xx
z9i3lSR&0&+66E=C86JDRqpi4F^NjP+#i*AAa~?~0)q{#tHgoZN8hDq0?K(p}m&d#(
zPs^eY15gE~W}^J_XMmPwi!RU$DOa=;xQtWFF)BO#%EGi<hB{7AUy258s(np7zC$yX
znCu1*kvYx|nR`&Y<`aQUR4cit{X>8LQ{>K=D`PuWVMVszqan`f7>09t{+{@Dd~E8O
z%TkBE=(?>s9|a>bU(^-ykw^M7YTB4>x7V9SMcqfDyv`5%B>!ofOYdnJ&`1h(uJl!v
zsuSght4557rhLT?_=G)t8-t<6-L(7cIG(7mPpI2ziTf!MR$&fbB4o<NicjEZQiTR5
z9ST0=!@_U!P?Fy8P)K@;q2Bb*`7mx!cDs4sY})pzJ7CR_3e2^K20@~u>M#<66tkFf
zGRop?7qyJ8Q8Nr@4{j9lSQf!n=`Q(0Eqa>Na#PS(GCSDItsmXvTA@^FV!WGA0FV9l
zZ89xYT*<c*X1~~Z4Jbyw@IBH$YVMY8sV!Q96nBeA{|GOGEYTh-$Ph083f2uv-;zK;
z!5U5~79Y`8riB3;*XLx?Cu<g|-Imh*74ED8O4{C@OK<%gKvt}P%O|e&Y9emldWZfo
zF=<41QGspjv>i~xxCR5otgFFXKMx}Evhn(AJzd{Qnj3Drjkt|Ib2R{4Q5*iP#&ito
zAyEK;7K<^S`*iOOU^p^9Xyy?T$SN4p{8vJyxA!;47tp}`>AOks%LvUl?2^R}*a_YT
zb=9-}mPAi0M|4WMa~?s?+laMq0S|iLEH?){-0bO}1sa5@EeH7T@yj0`8}mn(dhvLF
z3hK=<-}^*qPNs@|#^|wS*m9Xi0uk=4B#5Aca(?XT=euj&gf7r~?~*gG1`RVy;$-ci
zidL^stHhv=_;K4aOuCl7zIZeQA#oaj_FU!l+3+o3SnyoeeU}x4_ulN28<sn3-lWkC
z?&gB_5Nj1gV=&wN2Qq#R_{mBfi~h4~aK+nGx>&^^4qRw5<V;)UP!I4Z>n>^;sGi=3
zXGCf|7VsMMe|c80RByoI`eU9s>}aP*j?{ZEXyO$tB6hi=xsT6Pa_~tmb^r11m<A{X
z5FI>$iC0r0Ot}HO>^vE}VrK8|4Bu2>HpR30NVjDv4SlTq_ApEeE0#3l$oTZLtjx~O
z5Q&H<mI-WN@Zs}T@)vM;tLY=#HQ7Ga;dF`d&$O~{;YH)}wVQz1PEV;224&An;60_b
z8VBK;x}9O`h5oAIjMSuzpu6z?3b=A_%vgCbCsMV#^oD!u!+nx#3g=zxFIsOY`N_Th
z(3d-&0mBvbl-ZIU<zNSasi4iq+e7R|Ei*8FiDwf!^Wdr~G;0~BsH*cMF1rx9@i+8m
zAn9;AEyHI)!p;!t^?p~0DJ5Ww6#Hx2v3d@B@K*t6<eJ#xOl9?hU3sEU2({QX!~V1*
zZ)L_rI$xsomD!{4dTMTc=P%R=_iAQZ;}TE1Z!E_<FN2cSb)WSR3T|N7N_Dl4hM$xV
zCRiCJ5JDiC?g*t)8mWU3)l-_2sfK}Bv6Mn14Ckz&s0b%6{mX~^gnR$?0vH@W`Y^Mw
zT+f`(E#D{8@|(Cns9Ear)^iL~B6sX!no>#mm8?SZ6k${#Vyr?TC$9|^!E7hpdZ^sk
zi404ibcjLQ$JObx+gOMqy@JhXms@v^cVi&;xU@8U7Xr33P8#K*iTVDSdSB_H;uJm9
z*rxa66uFAY8$6=D5~nWIv)UqofRrUc>Bdd_YZsON@e0Z+m<{hYV87FTLF(uK!|&?v
zJ@22T*%LR1J2hqa9`z>lhb(D0a}|IB7pYbbr@_O1uRx&MB2B+%{-4=fdy>MD&_@qJ
z)EK44=1+$de#QaG<!^FnE83Hqs&R^@4$t{=1#0y5{@7$TU;9R}CszmJ5sl3r2|4H&
zI<0CtOf;Rh#F!9WzY;HV8z0e|7FdT+i+h3eqNR?E&h+M=xcykIRFkV7f&9${K-T>3
zev~yaS}Wg@`hAI8cCVCpjnR-Eu=YnN`byfC&d|vV6n6Y7z{*asiqj+$55`|Tjn8_<
z4We(gqj&wYY0dgaV>iRarYN|)+!m(Q1zXFd@`T=R<4o8IRqc6k#Gl|wQ#W17;P8iQ
z_)yI6EkoMCZoJmsi1lNjFX3<w0QqTFU_Syqa|kx_Yt#Np3O|<WrrI}&ev9r~D)%gx
zP5q{8KbHU8l{>33^(yy>wnO!S_bw_~l&LcD$`&<Rvz+yNHZd08tR4p>7m!(NXkN6m
zu5A;C=HA#z!Pio60klCo6Cwv40oI@!05n)Df#l=m=tyYXpE;Y;Q)jwqb^h`{LP{24
zC;Dx~ibD0KDc$Kqk_Gr0;q;N$AS}}!$p+u9h!b+xhGoSnvKKGy1(-5um9qD!TTVMV
zMBl<nV`$a70x$`NW=hrF>;VFHr9Vu$5pY4{SI(|Q89qL0%DOgoxmt|l920UW?A!#k
zrD*%ox#e@6W;#1(3W2%s^l&?5AZ|H7>Mkrsw`=d?Yd)ulEXU64^A-n&wc1u8LrLyU
z1YT61%n9Kag$f8|lj${C6M~i0No?6^qrzROA7EmUSWWlLHCps-;O_UWf(3ky0?|F>
zEM6Bw)n(7Au;zP&mo3vm-}6PdFOuGYD%@bbU$4PB%0w9ZtNJlpzQPPi-?zYqV{Yh5
z;wPh~?c6#^)dv#|&U78XH|A*DjL$sz`_LS#t~NEQZh~<w>W+0sTHk`OocY>Asx{vZ
zr|ZZ*A$=@)fW=~MsnXJ0FiD7e*xYoZ-<}h!YIWs|Eco`Ec4XCY%bc)FT!QDoJ4Auz
z=_*SX@4Sw0=4*-W61})XNt^Vp^DNHbvL)0VL-gc7Ldp3W8zMWQnzIh5|3lfE$3waQ
zf8&)Tsk9tPvXnJz8T&TmAcWE)%aDC1+sHbhl5B;HowD!yzKjyGjwQRXFC&cIV8-~p
zr*qEd`#qo2x$pb;Pmf2Ji@D}{zxL(%474_^rmb3S8HT@pd^Gp<Yizw5!;(Zmc}AdG
zwO|jvvwn*sV?F#TJOp`@hx&u|2#SOKJnyoWhD+T&zk%C~wE2a07|<dRSQu}2JQ!N7
zXfcZ^%^1}2v_lT@z}~1b4r>PUm#K3Rwq`so;~Qt%N!v3tR&h3z9K)Ku&l-HGs(*j5
zM_{$}Zxh|9NWwm~LHS73oYRvSXhx@=%9P-R9QEb7@JD)<JuN>>_Y2?{ux*pX_D)+~
zg}J&q;0N3mkxIIqI|R2vqW7O`bg4fn&1AFin0+%QaK!0S)Xgbqq(FI0?eFhSQA)mq
zaV`>X&k$DB=0Qi$xrb-t3z2bR*CSHy0{=;$UAhNE=d&!S1jEfXfmB|)EaB^ht8Mha
znAK_bn6$z-!XJj)5s@_eLh4aA^p`fI>`&H|b92e7>@fOdF}d-@aM9xDI4bK;o<f;x
zj%dtJ*k8;ckIBbBBGO+V(agkuSpGeF?VJG8Dr=log;iE9CTV_z-S>7)FE2jUz-ygS
zkBL{0UoDhL>}BAy>d;-==(V(Vmt|C8kNX^1|H>W}^{vgt#Um%qJc-@>4TS>u;20W7
zl-}9HIsMp!hsB|*_&HAQ*7buQ7hiQL^YFoJYHZedM}M2qwM00!PaBA~drU*LR@5#m
z6XnBAQjdi{4qivTLe21Gv`ShP7!I7-el)*_mrtiTW7NT2YCk44#g7rRR=f^VHvYCJ
z`q5D#?y0Wjos?U}-kC{4f_AnSq~52B=AFAH>$NwBR17RGE=awGtDI_g9DW?$AW%Zb
z2QO@u^y$sTRrEg57g)HN-n<8f?mrf>R5U){1YrInI9)V%X_elk$2mN1QZny21;4pS
z49>OO!&rQDd>-s%><gmMA{QO(#N5>f_(xshA&Kw>i4V@X)|SP^Y9`KeBahNZ$qUiK
zJ2jSSy2=ZLl_hJdH@KR}qD1E*F!6*umEyBuGUk(pS<t@r{h%q2QA~5BLRUxluKh+$
z+ix{nHEL(^94wc;wtAHFJ&Y^)tVSIAz!U4!x?am|n@_5+<rTd_t)=VwV4mYl@2d@6
zn>?mRFjZa6g#f(L0vKV)qyA0p-W4-mZaNPQcAxf**#!&0y}m|EWLu;mcq}QTBx=`H
zJ@ay5#3)ttwCv&=u_ovNWk6aM+D>RF@GLjPe<v(Fx>p=>)+FJ<2?iCXaE*5984=Yl
zdy)yIFzR-T&cvnA^uzBwV0x(dJ$*8?B#@`KsavsJH4OT#{plj7sU4xoUi^;Y8%A5o
z&^X&iRET#67)#!BDoDFtj`t6D*CW)4u5*-4>g9SzFagr<2B<I_{VPS~p7blmD&>97
zQ4<y8@VH^~IJ;R3;g^rJhyvm4*Ct2HrLu2+#sZ8+QLZGXx9<f;W~Jd^L%|u?=K0#w
zJBI14+pXIDVq?#|4ZcLwy2!TS(3;<Fh{>x6s8-(%M-KS(pQ(GYm=3r|uA2dfgkGJV
zCkF8{yA2fio~&~W{H4%Tr!Qi5^tLub0$X1`Bd9r5xV47~^mt?a@(84a6JqWOi8VNt
zCw$@{9;NToUIr?uP$8qa%R2Cp#f-Ru(b?lGaE18~p6b2Z{j;qRunPBL7Q{Kvh_*{k
z2_%`#!S~0HEGjKtA5FL?{$>S$SvJ0Y#AQ`@rDelT#49FsK@h{0=spnRzQYT51Sp2p
z1dn&y&?2VAag&JxpMJZ2<<Ys`&H?3A&j#_sz5{K~Wo<dn22TE$Fb>cslHpoM^we~l
zo4H@}<et0ik$ZclFub9tJo~FQzeSexeaq(~k2No1`US2WxE`odlDrP_VE<QplixF`
zamqRe!Dv_dei(pIV6Go>Waa1V>)Cg7AEYv=iHL-pF)V|%UbVE-;-RjhV!r{`%J*r@
zZycIs(U|`9P=7OLe78OA`iHOem7eS$Ud$RefVCPDC$7Tqj7sRWk?Yi{KA-f*mEcNg
zMU_{(lAgfo`X9fn2Btc`6U4x^K{@7hZuKPT9@o4lbo36X1hz#X(JsSRX*c&jA*J&O
z0&Y^n<C>QO`xs@Edc|+--L&^!=UDu*4N2O&+cm9a;){Ktf7`H2qmCN2@u^E-JGvSs
zF;nU>0_u3UBA$NJDP;3J4>@)GICK!AmV0+ZY2@-kqGx{JnzhxP-l9{T$gf(9r-buE
z*kiZi3=c;*;|!P&WIhotAY|rdBRWY`S0}3l`}ROH+|Dbnuaale>~Q0La~p2~UxfX;
zwhz6DJ2he-D2v0K?dBA$Dk4YIBMx?3Xh&VY+|Ew3=8MR-<w|r3x4m?xIFxuG-p;Ao
z%DS$@eDaQ-T1{QlUTg>A?SZFSH4~pGySMl~TPd&$qIIn4LZp%!Wg3t4YM^)5!!MiH
z%fs9?s8GRsCQ0jPM*tYDaFTs5z^*1a2Wve}U~!?qaHlc?GB;mu_LhDnJngjXN@8Vg
zm{NsaSHWO&LhUJ46^2NR2ny5>%y5=C)CQ}5wNyB+!Su2PYJ*?&n<xu9mM)KzTJfM(
z>!4Vlgxnyh_}89}%C~C{VYHClouq&O3W977@0Ts{vUag*UhhppOKErdTv*Q4-;F4U
z;`lfxGuq#=Hir~r8AX<Dgg^cI=KR#uT@C=Z4N)n6k25lTXMb+?iB*^00FwRUl;F-N
zqTxu(V_u(c8`h_dAxT4<5%y9qKa91M3g*n!tKrYK>xGhGmj#30CKyT#vJ2ifm2!^}
z#B1z^Fw018&$aKc486>i-?=hsOYdl9$F+U5mab;zNpD_+%Ln#Ap<cT7wW-DgJFL|=
zr=r#O<!U#e_wPov%Up!31lm-GDKQ5f1{v}f4GLmd`7I(kzTir%y-8^4&0vP7HD2L3
z&LEDDFBh)Y3!&kG+zWy}{CJg`PU^uk8BO)GW))+DiUWAgA!~K31CcSLrCJtPuTt*a
zigTznBH7gJj|{=3bX)7Peus*P2Ku~Bc%u<mkjn5fWGq7?ZkD^6fBoY<p_E)G7>XzX
zgcb|6$r{dlI?CmOT$i-J=xjaQk`mZSlUWsBYW04%bkUP8%854BGu2q3YLsr&!Hs`4
z^vO8`HJMO`L<Moo9}?a(yXIjdf_X#ghF#I(d0<7M5_dm3kfavp7-@%(WaOn`GBl2K
zNf?_brwVsbCyDAlMJrCf!`f9EaM)GfUf>M$yrRA3a9bjZDCi&W+&hU_V?|UDNj=K2
z)9SiOd*>{VlanA@N)G%5Jr--oYh`M>!I~xa>n)3_qMxDbn#8^`lR!Puy;A_@q?>|x
z<bN>JuH2&nq8GCEq$65~#SJi5HCK)#I$rYe)5@Y9&Uv5w9m4Gx^*1~^IR_5bM~NCG
zbS7re8*9InjC(A#7-X}<n4ad;scPq?kyd`IQ6M9|kjpFKr&RxiBlTS7JGs6u<)LOi
zN!3P%u2ZGv;{lsFA~5tRRl4Hkvbc!k?=}wn^e6rX{*%heO07&7w%0Zj{|Z0K1*2$r
zq~$?eZ|S6-AeHNd9p?z}MR*+XH3pqtTgo)8M8-!;d-w8^phbswo0xEeLd&CsPnSHg
zdOI)9e)89{I)z%*^FbfX`}F0bA4f0Q0M<e-+(o<<UidA}jE7q%>9>?p*Dj&3uJH7-
z(@%=Fd7jAHh|)z~S=j?x69QKjXZageU9uE)twW8}xcO3E3P8ibG~rMaKIR`DX}boh
zLM%FN;>SG;mac1ROKyLE&<U1o3L?NHN8$0e9NZyMK>g8yJkLoHKO}x5poh*7`(!G<
z8WhrBdx1*bMA|>^3hT;vKH+EoQ4jE)sgJ4BS9G_xZG~5cC8V`dd`9zZLUz;U2fv&1
za#ukwJ&gY$o$jYKKQ7XXqM;XXF{D8OIp%PCAV=>I;=(0C|M$n%Klb2oSJ}DaR!iy#
zF)rY$aTl1!8RAjPf;Xt1!z%qDT4_oi_Nj&>p>l_k+BUJZ7gRg%^4`3F0zT(|g8d1n
zpEU(oAT$02#sRV00OjxPtsl5KE!@%<kYNIwaSMzH#!Ac&nRHHm_J5FYf?74}X3>Se
zMeE%ZC+~2iStPnQ6E~aaJ97%^ttBNTJ3zJ5HuY1lcKL9#t;ykpaXWwKOX`ar4gJsF
zp8H1b%&^l%Uj8+jAM3qqzUi+(iTj3ksCBwd9%u~vX}xkQ{Vd8QpY_@PWCq3GM2!rm
zw082(5beXpSmtANkoAG|+XIXG+*y*!$Gv4_Ga$lrD5r9v#YD7Sz+ROcjB`CpXs$0>
zwXKQzll<8#vN9S#jCpGX3-t}#4Bp{%?Viggh$UFHNJ29->)N8wvFel@VNb&jRs6KV
zP_Oj=K~}eA{HLqoz!O{i@A)stbK)c((vjI!aE8AhA*kc8UOsG(zU$DBB1;KQDf>YL
zo_p<;!|yLDmGsp%eUO#oH8UPX1hugW$@5v9jxm+;W0}rlmewV7k@`;I7rB-aU^6%U
zvxkV*{D9Ss>mBhgD5bx#a*D9u6P9m%3^ts5wUQ_n#TO+mw6F9{M4zH-Q*2plKlox;
zg#|Pe>%6R)FzjUlH(Hk516vLS4}mU_`{?u0WQ)@Kn!UwDMUEl1@;`krS;x3a%yUPn
z2l6)-<&o{lK|0aGhT3^g_j1Fsl2b4L8XiuUoaBL%cF6?1siTym3qDmj`mU#0c6SZo
zIpj}okhKP!Ky>g&G&Q#?gpLEkRGLFA5ppALd!4p&Frdcc2pQMo*?4zp_v3pT5S_-;
zZO<fc^xf1i7_;Kx&Qkp~YhW42JwAD>$h_o-ZO$o9NmTv&?iUFanvEtr5{@V*-m3s&
z%3Ec%TM?{&zB9c4LR{`DR?YE<=c?Y0#!tf%NC^2v090#6%?7<Ly<XmrAHSL_F@GSh
z;wbb>mclZ2^5>O4yqEoDlX(Vl;~U8db@dgM^jcVM#}qAQhV~hbxyyPO?DtC+jLX$r
z0M`8n0I_0%Ytz;|m}?;wq8doCBV<b`G;f`tqe#iI{rK06ndRh0(eNqNG-<Kvc74Lu
z2UW#^)B6MTi~4{pnCtOagMHCxqGd%X#L}X>>(jB5>p8W%locD5=iS~&eNFh$l5iI+
zCJa2{^XFgjXxe%3=kZ1VUyhG^O}ZuTi&K5@>H6SQrzpuVCNg#;+g?B{Cp-`)8V)lK
z1H_h@Kkn8XmC4L!&NTa6R;@optvMZ)t)}9bWAzc7glf819)vP0IkGN{==Trp0b2aW
zOZ?-|*y=mx+Vz*4WYfy&Qg?gH_YFrr3HJBXFaHKr%m7q!W!2TEG@pw)Nk#wE--~!g
z4h`T4(mL1FY7%87cufv;N`P4I{*tlQ7l<VwFw^DX{;=*9&?Yes^Jg&}*f6sjxV9G1
zyhepnFd3uTK8>To`-^`B$8`}Lmo+%9pJJ*t*IZv%aA74UtCK8{^TN)mEk;UaMSCB}
zREr*vUs7k@(<9pkK%tz5_8gKW1v$-qnn_)F#us2XM!#oGFWKy~Jo-L;8QDWt(ZB@?
z<a2?cGu1)3k%|y`MY(Mnrjn}%thk+8IF(P(#B_xW+QCzAtn=Z$UJKX&7lz(`O5Do5
z*9%i03}7m?e$6~CXGczB+W@BZ=gq|U1$7UVYSgoijnlsGf;1YbWN*u@T)Rr<CzROn
z1;~GMLm@u^1RcPt{A$+k|14NmI9>Lc;g!w$%)@7hO6bqK@y7_3x|Y1$O=f-p43Uy~
zGpTp;Q~^k?O5WRF;-qHsll{G}d{*y*jIBcwkH-fX86ou=VNQs2j|K6<)4Ou;N8KrW
z1VKgrT7I(N`iF_`mSEX0zT)!ntQx|q@!tTBkL+T-X`h9GN}tMRke&7yz%6@&?_V{A
zgB!e$-Uo}X7ZkD*A2`Y~92*OBL5lz^V8xS@f>koylk~fkKE49UL8WZAfVKXG%$A1d
zWc^MTAv?7FV2-qNlPL@^5;s4rYiR<2z=l4VR`xqLa`3-4I_K`FJzeZIGw&MHbbico
zGucp>pRPhV^huYGWz0cu;W#=(+-JW1nRvrd)bIaA0Q)D-vPbOMS-@a%x<)e80-fLx
z1s4cme(mbw5}T%0(${{5(N<Sa@6#OdpQx8)AIP215YCZcK2Chq^SZOMGu;ri3_)I!
zk}>{TXlv#xDJ$qi_ksKX_rx3I>oH%?7E&x9fyz<+H^eh@I>mj;w6S`wJV8B^9SBYc
z5<YKZt~=Mh(5d(Ik{e$jb7*U0v4)_L3UlNcMoDqqF515ZDS!DQ-(KpDidGe-ovNU-
z{QUeoDTU?<!UqJrGy19R(X^KfzxR7G|8{tl?51D7gzlWj$6q>ZfTkMDRqfxy!O5mE
z5c6~8_(8q>40KnMgQNhMs;Nnd-_V}&+DmCURdkVC=O1Rpz?;f>job;J6zBUWSE^rm
z9w~qBs4UD6WmmD9Y&e=;mNv|Be~!=epHxC*<V@D67cNT!R=kfYDg=eJ%5<sRpKzh|
zOmiE%ulX-;B1t<|<p~$@ii!E(oOYkG?D_a1Oiw1$hGfx>A)9Lju_vmp9beNVM!+A{
zvm}RoSY)gA%TMOTs%BESe(%rp)8bT6g*5#TGw2<*n(v4yxHI;Ihg*e%<HWDu*pG|v
z+EldUTUnHV&~WhW8D0@>+hprfs87zH*p%9BWFa&j{?~E+K_8>q?>h#Z)%?SR^o0@o
zamiZy@!6^9yY1RO{}R*pvvrS+EoXD>c`i?&`uW6M?hujbt{w)FPwv0ioRV$wJ|7Hw
zN<XAXLQazv#Bh@S?`t})-+l7|brSPX#GS5ZYPyNShLEN<z54Ho9b8Ern@K@c6KYX>
zA_?VRF8mAG`rL6{-B@)S8+*{TTKaar@vgITkhj5actuNhv}Z9oVW_@#;n@cn2Y)D0
zh!lJ{g>YOwT1c~ey-T25-Q~fEFP38eg{<jlPj-+bE{oLj09}*eyg&@h`TEF8TiBG6
zWAA#t_qy@sVuqc&<_NpHRo2RedU$mdf0@bN=YJrk{>+;0MZWO7{Qdi~fvAX>*f4wQ
ze68K<GYqyTPA^-q)D9_n=}=SsN?-ou@A2iq%4t(_bPn0%I_eRwmpn7_9QPM8C+p=u
zwe?|AL$W+Y=ey4o7kRiu2Aor71!E-8yKUOfeAV<7g_n;365}^qe}CiPf88>Y-GxBt
zY3iEPqJ~seX*zq;!b6+><?GlT(^9v}%!~hyLhu?Me>@c==bhg)q{}0{*BdLCw@&fD
zd58WZR5=vXbdh|FI+ja53+8V*ItRC{OZ2<s!y|#>XYFi??fjE)0(`xF;iD?5SA?Fw
zv$C?HPNeAHao60bdSI8xMUH&u0SGbOVLUwnJGw&_B*#@m_pACmnlS_p^{|UocB^Z*
z!FweEPY0@}p6T`rfPOw~R{xmE-4lAv?yj$%=0@Batzvp?RK?ECzgT+c<`Uc0m1dqL
zbM2P&zo^mladxYWs;Xg5Hj$WtsK<RHBgXsNHm-tf#=Mvz7^e(Z_P{3dj-X&5oy*Mu
zl_)ocPsbLoEU|k{&b<8n%rOFYI(pj&#OEo5uXS<-!l8?{31?gQGGNwrM-J~RpKO+7
z*bmXbPtASxCZ53DI|?pjNuCeYF^H&)yC<&#!CkfxTAe%+fLnAv-}S7^XDSHy%hc;1
z{3!ncUnh_K)G1JH@N&P3F}mA=@I6jn`PDn-6<H%+sVfdf8aKy$Hx_UBJaWWG-iuXs
zlIkC#^2^Dg?f}>19KZ0gqcqpz+@r~ZLy(;(iJ@$@LJXlpG&|u+Zfo>JMIpbQpnWXm
z*is`CMgiX~<HB;Fh*;{;XvP)RcnmSEFptQTdRpSoA%0v$Od7D@zRFB9JBC#TkUpWd
zcWY?=7{wsp@wLJ;c4S2ID_4nk6o{TW$2QX;U85q6ajQIRHxovwSfnS7?BuSD?gp53
zzdFhcW1aMseZq*P2D$wz13pmPgsJVU)o96@AN`IWDw%$LJ*1Ka{R-qntoG-`-Y{ZK
zG<OMg-=8Z2;C9ax81e^IuBKENoOz|TzPF1F6bAwckJp=~YLwQn$L<R<)7bfGl{<x-
z7vJhKE&Y7-Z1`{h6B&H{--fLIPsbCPL!oZB!ql$c9R1kCXzYVf?hTXRB3c^?U@NDz
z7JDcF<`j7z_LnO5Zx^{AQN;?;McU$gz4sD3UDRSVVhb3I`7~S38^i=l0!~|%6scVr
z()AcDR?&Ow7#MR8{evhvjQr*;xl91Sw#;%Uoc50sdIQ}Kggz^vb^Ccb%3}(Mo(T^k
z<`u@sZM#s4e1_AbGU|5aK^3Lmw&w8_ych3XJXThGx-aIq{PQ7hi;$z94a~V`zOgV4
z`9D`UK_Oi&*O1bJrEp|nQmE+WpRO$P6@Y*_eDc+=>skj$5Qi%-bXRG)`fulTy2P9z
z^-&&UmPt<_S87r~EyQtbL=MR?Nej-o$7K3>7D<i#181y$R`vb9Z3tbYus{FR0EQ3M
z(pIwVGmxpspwKBK_3Jjas~|e<eR6W;b_S@`QV_5{hYdf88VCoWmC7}eIGT%PG)yUI
ztTX=>L(P|bYa?y&VIh^Af|T9#TWRa0{04z_HDd8PF&utzg>yu`G|rkX$)?QEg$8rG
zqC0PEzxVsVcoAR3h3u>%Y6er45BFT^LtVurnL>3EKQlS?04V#Gkr!{CsQ6?pEt!)q
zhk6?s?rLY!NG7DxlEcuJjo{EmT8yGw53Iit#L6H*$fO<OfDgZcXYB`i8z&8Mt?>Me
zq9ZeCpYevpjj#|WmG!R+WHG-q**fZN`MY<6KvBC=san70a*5`!#RE_iitdR7Dhj;;
z3Ey@`HN2pbCJJg5QY|0#{O0rVB~&;a`ZFBw#=SkfPU+cXKz4mwMMB=cEBD-Y`He|Y
znYZu$?q@+<`?^v{L5PRJ?s=c@5yX?=&Z0r$+iPEu&BU5;LT@zwmH6$ei*b&rS$TO1
zUP5t;SIsls`xq8hVy8OYZouv?n3sR1U>-Q}N%amuzjz@tNvjewc_x?ktG7$M_`qE9
zndOYq#+A+~Qg>Ie=nDf^iQAMwfm=e?QrZsQRN6AYjlL!VA@PU5E%Q~{qMG(G8K<9q
z<9b;t)!UF#@VSxTE{(@~fyDFpKF90%=d|DOVt&&GY7j28<>FK1812rGkKPF04bXSF
zBD?l}GIQr#=uatVfZm1y9@Zs)X0EG)`<2TqWLs5t&&`F*q1hcUvgp6BBi{T|PT)QP
zh$+KedJ<hTEFr&47VG%MF)ys0)FT7xK{T$)836d{sCQ<9Y-Z9c6XID^<Er(7+pcyv
zLZqzBjZZD^d~|DE$<388CE^C#it97d7<741vPk^);K`pht6q<>fu)%A6j9|{83>!C
zAE0{^hm|Kw`mTaQKgGiAki?3S4F$RCq~{unvRQN3;?Hr|K{Bq<5Rah>^BX1z|8+ZJ
zRgX~)sFG55RXWJlM^BW56xzOiLM}vfR+_p?hOT|mY^@*8U?;s-vLK^Yz2EY!3<U+p
zrqLFxXf@_eb%=~{*oPrD$D}`!W92t&AHJSn&afD!{qs`FsEk@gmEl-{>WI}>?`c_Z
zc|!az8F<vJ-|XJXXY;Z{$dmrt)?KTLF~Oos%N%)KMuI~$r0{;4X`kwy^VPog$&5Of
z29`A{;>U%33h+13$jHZ^Gm|HeF(9BRR9N}dL5gWvpU@<{4>SWd6Dx9-Vkfi??}}gr
z=DA1SrSPN6O^_}^(!UgWi<%^<nnK!KKpGp>VzI_U&(tV5o<He-@YU=Exl#mR@~5XS
z?A+Ho_^JH@D4Af~_s4FNG=?LuHr6s_*E0-SnpW36iS<4{VIW@IHJsRnPWyO|=wSsw
zBE18{G##!VdhA2VkLm1_xM_3sR0}49_NO6t5=yVW@NK!Id$(iScvHt9n$c_01o);2
zvpuGtN${>_-ByZ0iz3+{(qa@4mSX#K>cRq`fR!2I-B2c~U!*r8Qfgy4m|TFhVJo*O
zR9h}Szw#f0^G35QQ1e;d8SUvyjzN_lB<)4WMQg*3tVpts8$xn_y5VU^Y7xtF3wo@H
z87TU-xK@}TB6H9&Fyd=#rC?y8GT>?dNOC;tjl=8*1Bw7FAE1fB+b1lLoDc`7l0P|`
zlPcx(*Jh6Gbl0r-{#6=LUWohYh&LgzUrwt^B{+`f|JIOtw;_5(zwPQ$i^bV5?N_2i
z&I03FDEdxY=M>1px&x|zusO28ZX;{1aF;%?%;?tmm@q&!lJ=*xpf?$8C}8F<pf0{I
zlnd;r$nF-1xbj$qXt&vkT?P7+&(GoAS=frZZB~w8+$xX+n_J&y$hG>k&S=$|L{3PN
z&uSN#_;*6I7Sf+bOMm~&vKBCor5zH1V;EPifQ^_|79%X<{_Fa=3X^rRs(i!KjGQTD
zv=r;M|B<&|RAE409b%s{iWS{&o)96zA`aco{LEDLeB^723|5*!lcn>dX?$zEKgCsc
z|8r6eAmjbt4VC`{z5nKs|ICdu?@|GS)NB4G4ORe;iH4ZhIvDsY(rtpV&^QK&d2D&P
zsLip(0AK$TF?8C|PY0ejyOvCySc+S}*t|(urq00b9NBSSNO`HiVY}@iSqM!JTLjnC
z>ZNDf6-ENTs!W?Y#V^~D<o_%@)~OFxGLPIUH3=WR_2<jhjAz%lz!foL>aYpAkv~<~
z;VP^hR0_0ii4H1PM+g5d5kG(nuHCbza2S!O5`*Q<X&&wg&QIM48<NqscxMXsF~>jK
z*7aYq4^SC|<!xFVuEQxOf@R1BpLpCf%WlBAOr)&ol@%DG_W6P@%ow>{s<uq#>i9uV
zzlIuLL45TlF;A_YAE_(zNYpMsS-jD!ld^Y2@YbOIdPq>Uewy}h^v2f@ZPTZSSK?TH
zJ}4JX?BN*t;k{Fk^lJNXPBxvK&QA7$IhD;E6fsnav!+eu`nt1HuF?F+;V4z;%>@1f
zNOsc3L{wLk`BMUy`JU#uP~*y>kk`OtEy=BJ2h)h+w+3$81%h1S&%A6LF7Q>O>nB$!
zEy&M$*q!wIfg*BdRH2mS%_y14=VKT)<!~;mnUV?rkbuov!1Pr)lS+9lwY&4>5LVjX
zQ((UT6AzKuFRqckbCDYAWXA$ML0p^owGIeTT;`0>E5>KJA0nd4w;+Am2XA$5n#Rx4
zJ(51Hv*xR_mjI2K?>bw8AFqiMbSN_uH5tLx-FJUxFyLMV9m*&>x_l(zHtoOUTmLS4
z9xuq986A@{H(uxiu^awE@rE^v43Kd#Xw?r%Wbjtk6{*Mk60IxUBsLY*ocisT?{VYx
z-o*Rn#Fy(g#7zs_=7VWF&<GMuiHlXn;$VT{pnY5iz%o}qBmv-hN0Uw^MmtNuU;(SC
z72#M|CiP*E<8`EP4z-S)0@7&hR&UO{KOTB>bH39p9;xRO%^(JkA8vTupzBsw#^mrk
zZGC3kPO!-}cnRHkI)EIU%-;6AGb($s!sJQ~kE!<0{`nBC;%*IV|3ng25&we{-Z~LM
zlmY)>?eRYZYNudm_^m%h<YK@Zh3#O4Aw&Ggf21Z92U=u{3QlqRQ$p?G=@Ikvqxl_k
zVNep)=B|lmwLQi>xAc|T-K^Q9;X^_u!%e4JhT>+W9{b17@j8Q;Q4J|O2l%*IKu5b@
z<N_gpi)6{{y%lI_r~>_p1>~ZFB~4LrA4(6gbBb-7i*`$3muP98L|_(jUg%Q4y)-X~
zB5s(Y0Ci)as=&9c`v!F@Bxe~|h|+S^GkrfzyFC}@u@>NMrYjFj&ckx@@&RnZz==0v
z)a$P+(GyGI(r+|AMPS(-{hoJ=O&`TqIgD9MOFAZ0YUnGk_ITpoKl$Q(Wcs+HAE<0%
zapLdw<g?V`m-|M>Iy#LvZ7PV(jP@c9b=&1xO55xz8Xox1Nl(Ne<_9G{M!EqZE~v7%
zy;p2<?L$i*MScqC_ketIltpGeND>Vr&g1Q&p!R1TBJ#LoR7}dpX<Q8{;M%^G#N;;C
zwOqUu8uRq>N(G!ardE#?-&>f-Y#$vR=`27T=xvTUA1-vOyvli`t<#!YIep3;i~+fP
zp2oOMKvwIe8t*3U<XhR;I4{|i4|AHM>)>J(Cr-bq3X@sbcV4C0c|Y~}AZXAGxR7_q
z+_H@@-4*(pCVLyJiXnPHLDVlGFlksfih4sRtvC?O?4NKA_I?UX&kZyUWc}FTBF3>K
zW5Upd38p;Q<Jw>JGla$}toBh6ub`R>Jd+G<h&XprLSC|IpOpSw>Iudq#CVhFUMi-x
zoJ2}5NkggKzOldpl~5@+G{T#7V)^l|HP(yzwgc{SvV)zYP4o#5E(Bzdwo3QZwf%Z4
z*G)RVKG2L5yWT?|;84GwUNsZiYEEW<d9qPF`8|*;W__kP(&cKL$#;u^Br!yN6>dbu
zyenQJbeJAhSv0H`9(v+zaOJ-A$mnQiBQ4aJM8Yp%_8S9e#kdlm$1_OUK3U!mv0NZ+
zKl2%Qwg0Zp8C5kg<T(-Ouq#ChMa``KKc?#zuB;Ux4=|$B&?_n&4?k42uQb?B*MzPR
z1QusMoIy=B&k-+ja<$4nhAv-#*ygE!!sHzmwBqn)NJFjO?LE3krI0H|8qk@CeZ9Tm
z4}7h6mNh%fp!Gc2>7{sC&saf(yK}3F5ZR%Dj_sHz*uwSGseK;kPTE66FZNA{91yl4
zaXyY0wMFg-NkR9qY@n<aw>UV0&MlliUQvgDf}MDi2#@)yO%{lGB!l$xXI%##h<So}
z&vcW-=pmthu+ygCpoQ7({h~z}zA8j^AzN<FJbZovty5wiha_!>?^zD;(aY-+%3^`3
zayBpPf6O14gdlxUNMEg;vESTiFNie~{cL%7fEQWHL)o82vl9q-lpzFvfTHU3ikmDY
zSqwq~SV*1mOM?eocIXWpezlT-K4`^P7?Zv^K{pwF`pc+XjwbvVhqKg9sY|^Oe~b}7
zf$n{N0UxOF_1g5gYMog7FEj=+d+x{oGDa<LOk^ZNjZkUBf`7TNP<vpETsZ<Pn>7rY
z9}jM%?t!AS+a5!Pc2x3j$awZZ6~O*R3kdqE)bF*mKH>Y)RFKS0t!j}dabH?m?`XOW
zA&wJcKJK;2@AeHiiK=0XRT+$9e(m&?O~8>8OFAILL}>2iSM9_use5{+kA&yuw%%Pu
z6C3nh`^)SJ9~A;(!B%sh@UXy~aF)^~>GiKHohD(jQv(vqg$_gP3ER$KX+Uykh^;fP
zVw}M>WM1^gzQs%k>gicYtWC_)n<^3&%YNBjI|Q*U7U-i!@1}g!J(}TZL5pMXaQ(T7
zg~L^rc`yO%rlP^+weY0mM>cN_JDbc44D2%j;yvQB*_Sjvdm;9$v?a7;G2M{cieOBz
za5o~Y`D$J}Y?k#%_kK3vG4HL$C{~3UGjtghbuaU_LVRmH#q?>9PcR2Yi%QHA9IHrl
zpXkmzeRP?gkOotz;p{z1@P{WTQK1F=;C5emqYLzkufi0yWe&;M7m4(i&%enkU-Q|@
zT;TZX`qO$cFUr-8iu`QLKAaB|SNCZ}bN9{7*&}@jeVS6Ely#sR)WpGc=4ws04k0z}
zlUz1bSpEiRSRd@EC+tVMr{)BS0n*t<PHqt~8hV@AOUdSi8r8Srl1uv^>qXb?j5qQp
zxy<C<pAJt9g36Lcm22KA^<|(eB9Qjag23>WO--Ow4|9gZ2<j?YGfHyfn?h&xQeH&K
zm}dA!*sW)iFXB_Vb>PYB_eKErms2^tXC*$7(0Mq_ew}Idikau)Yt4Xb3a_JA6TGV#
zZYCqfcNhfLy%x|(76K@uZr}KTc{v8oSVCZ~X|_L{q<Em;eK<0>69^-XPRLrPlh$uQ
zEW24D>!lYvH`)a)1|tX`TlyV$NQGBrhXVFrg|5@~J8XR(qypvRHB_!vT{oFs3-l~j
zsEKSBm3smbLDS;r5iq%M;oW~jpm!1IN%Fqy6ttkLpNbq<q84^NHD*l3l~}q#T8Uqz
z@Ch-T8LUGWi1>)rBP@8ihnK_SJE~5^2mr%$qg5sRNeZ>9JD3`Iwie-M3^c@Um5U14
z9a9qEX<4~oH!E#A^wb|cg6kC(X7Lej_cDviy9?C|!PWt<GU&p=&B0{xBPlU7JdIu6
zD#3NItJO4d_K{=w%pLk?fKldUOyQT~C12qXx6RIqxI>a#ET7Q*3z6FzWkD4y#f<rA
zPPdin(JphsO1Yz^$GF!FzjHf3G^o00)O9eSV@Jw1&e;p2*}GfRLV5~#QB)xCWlQI_
z8(gtb15vdr^n$vkfbNS5cU7<!dlmAm;RTlHf?`sW?CghD4S4NN@s;#xjFPu{t~o$O
zwQo2`VG@h#(!l6%?wO}l*yCXJ<o{G8{KwDa9=Wgr2GK92p6!Qz*KaiPkR!T2P2Reo
z3ay9;_E9hwM$R(~(ciO%Q(0B6N*)A1P*+n^(=baKE`i=c9_(gwyDudB;~|Wr_TSkd
zn!LO>2rye?bf}a)vZRhLPWAu;=&myFv)QGkKiK3E*=yATx?;01rVUleHbgyk#<^Pz
z|4{b-M3A)`5#H=u5~9B2#P1ZG&bg>0(AYTPQzB?*y)%KBh(7?4527<fZ0x!?4Cxv!
z_r16Gik;w~-nT9v<C?-atD54`&jyDAHOrP2L57EU6{MwIuX#ug7j6}g^6Vf^(LU(h
zrJm{d8pu_(9kG)!*s}3_d`+c*>eVtMAb|YKTqsmHp<eisV@JQAg{?dGNMMx-R*5tp
zQ?T5UvAHQgIC~-hC!Z$BjW);PDiz0ms5sJi=5-hZ5`Lx~C`Xr4l?##VAAg68&sLl!
zcZDH(91hyJ4J}^o4-xU~3+d#J^Np3geHHnc<}i_qnlksL^~J;vy$MXtgcUa>Sf)ya
z?F4k;G{ko3W<_Yy78@)j!4nsgKFle;m|QziMi*HcRB?Bs`*-ASO1s$slrA%wz5T$1
z$zw>Y!vb34)8!2oWHdYGkY*RMwk~(>=zf(W#|0eF$_~C_y5O(Anq?}`ndXqzVFSMu
zTd2)|?chPY{({qvWP)!i_0VUiA)-3PByf*3yins>?}{CS(cM5)={-Gszmimnsc0=s
z$QzF=MIjA5hKa;3!^&-ey{T797m7{q=uYsPN_gd-NiEV|=1@3-_`$gI#T&<nXMiaT
zzB~dVjlQ#5BFi;@F}x-p?<N<f?>S)WR*n&`LR-+DsH7#j=~WPw<d1iI&Qu#1g`>DS
z1<RS*A;%{JLO-QspLo>W13HTXm3)|Gq}+CrMt1VnJby+^XcbG0t7Z-4(|voV@MXC_
zCAY#*UL`y%RZm3a$6_HYT}APlO6__807B`rE!&<yZ;_YGzO-D~2RC0xIB1g}-i(%&
zfy!r9=?Gzp@$H&XZF$L&!(mCuzg6gW?M(*>xVAnFPj;EtxwxVuBH_6fCfF*wV7TTD
zc`A1pKNEz}_v{SGABoUM-zq0mqP@&JAMUWX-iKCiof__lKRD>?1XHUf6*e|D5J0~a
zD1#GnUT<26KAL~*VN}FMw2WtH)m8wq=D>S(xv%5Rc{XEw#uB7!<UZRT6#t6gCo{jq
z__Lg_OZh9N;=eU({)*@1H2ZwhMfK!WgzAMi3woLz=_2P*JMr#>g@vlw2ohU!6?>X$
zc!a5PY;r2lbSGdm$EZ1oY^`ck%%(MP!WX6d+d;Sq%`1}o(QF+fHhD26`h%Y6$M>q|
zV;RTBVH@2sqVC^#LIsfP-;V(+yO*j`5hFI?)xM$tbRec}!UqIi^HlVQ+^WFKF)Q$L
z@3kPAPG1r326#a=-W&%r;mOOldWQxH<u(;Lw)74{`WuZjcMp9Ij4Slk7Bl9*&<MIN
zCAg9B9fcniOa}FgBl5ar3CAkNv&yskkB|22#cr;-7y8WnIEHUMp=X16_JRWb;{T@=
z4C^NMs$t&fVfqQ&tlhD@8c9(qo33?N_`-6Mg_i_rV;RE6Ov9oWbWfZSNw7=$k;+K>
zheKbMl%O%;{KKPH;*Jf1R$(~i>{amwxWj;Plz^V~iL;k2A3t&Q+nY{jjN69R7(_15
z;2p7m>?8d3*7L`TLJSV-`8@YQ&*S}kFhsMgrRS7t%;t7PniDU(Srno5o@2X|tzU1G
z0caKZY2nsQ)|$E`JK$^;^)74~gC>J-%Xn*u4^*V9Cj;!E6Ef@1OE%hg-RZ)raRD&N
ziF~*FAi3D1_d=g$5E6zTuGT_2iCfhw_6U0YU2n+qwMko{fW)wt!C`mbO_QpXpv$s>
zJ3+uh*9}0|Jc;8Ya=*0%#@(+ujZwyX=HYCl7!FqB_R-#}ad;*aS{na_RD>9*D<wRl
zCA3Y*V414}K>x>E9lzz#1KlbR{J{bb!{8Nbl<|x^?#dDD+&Xc=;k3Xg?sv;TJ|t+w
zvgB*$EmodVO`utbK?+L9(Y_ZG5Rp)UCzCCtikt4T$3ZG9s`&oM%4YcMYM!&NMo~7r
z+-4Uem4=R|1?C@JNt#GH_3&Q!!K)U~nrz)@qT~Vc<zQ!btM?JiSuLnN+35tkRH1(&
zy0=S1`=izDn<<Sgh+0YeOgdU-;d+T>&vk%z=o!n8s;$yf1lq<0usP<cNrs7gIqukx
zhNJe_6VXA4cUk2eOW2KP-s!*yMW}pg1jW#6pw7tgLHClQWKz)uaU-rFD$+;m7tG0^
z#O%;bv3ywycLtvOp4ziHvB&}dL0MttYndB35`#R>dQB=^z3;#p`j1<2Q#<i`@~sBJ
zWg2n!25!!P7h~*Y2N}P4SVfYu4(O?jpJfLyxqrB16fkTTBLB>!;$sapDAQ7GD{PjA
z><5i^HIovPlEKtkq{IZ6f*rW)jui`4w11V_v2j!03bSpCw;4acVL{_wpbfqr1#;L9
zsnxq-JQq~lT<J%$f2Xh$b0F<FF2LG0S|e6P1nbuXOV&A)#Hg4`5qtrAn=?Gza}x!g
zK8{HsFQe}umu>3ZzsWz6L8}%-tZc4o-+&*3?ivY(&}CGyjM2I<z?A-brsrQ9k=*H^
zky-8+ZrWj$9uo?SQllmhRpB<k%kZ!_3hyl}6TOwg0uK}ruv+HgZhh@hKlQ{dd$SSD
znwYV{G+U;2jC$Wa6bY9f99$P(EMCrt5m+L}$($O}JvZV7kf-CpIPiE!^sPQS7FT+U
zj4hHztV^6bh~_RJ1$pktTiy4p+51c@;7k{4N(ERF3x=1~;^q@FMyn2#(Y#mbbxGt5
zPzqN$3Wp8a)^8@5bgK4t#$n{phRteGF4gQj!|1Ao1hf5NYYmc94AgtSX5ORSda*Zc
zzOb==v3juY;F}YJi{w>{sAB2aPkn2x=k762f#KKl$3DWaE}CUwi5}xJ2~rD5frmqe
zuV0KPh`*-wdMRf~FBt+9b8d(V?vIHy5yPHcx#TX8;tzgq?*3Ztn_|Wk1<SQ$(2TM%
zV<{UcNQ4s5|NAcs|BSqM1AfSh3uv>nVKl<fI}FGEXl34JEu~3lmOVyzMi;p(jhr=l
zFcLNVJN>Kv-!w8{f@Ar9i_Ykpq0)-7xWR#m377J%K>~e9T1|zf!LC2UO>;UnYSp>Z
z{0Tvwk_BTHCx+k3(HpqrFG=RHQmuNVdtkCvC^=N_g&&VA9c|$}<4zbPY%FFZ#j+SU
z#Vlf<7^eo6Id{plpJtF2uXaF16AwF}r1je_d-;A^+HQ^>ERCj_uKsgOqVkK=L3Lol
zM>jS2y**+Oy?X0#e^3o~+39RXywfKJ2;8Mqe|bJdr=*i+M;bolDAmU|Xtc1n69}J!
zt*$_8+H3dQP@O|XCd(w0iLS2RX1O6itDBLs#dg;oxbf*2=aX8u=RxsAc&PxDFR{F)
zuu(2J=cOux7!X|XX{0gOHF;mTv}gh&Hd#N1h3c&?&F^N7-WsBk3=I{l3{A1X>U>14
zDiBz4eYhLzt8ODlODQa=y3gJr5HHqQ%GHrOOo4=2v6F|)Ph(LmYI}t9o{Ks=xBo1%
zpGh564^K9=6H-+TpAfPXQZeU|N)U$X7wGmy*w^;g0#>m31QEC}&FkPk%wtz+)6Z1q
z{S}EfZE}mMB}ls|@pl%FzJ)nFkzee{PfaWx<>EN=YSe;<3T8brGBWn*!(-i^<%+}l
zoz8Wk%^X8@$4CAyj0^$5Wg9%_%Nm$9oR}v2Zvx)J=V^ZR58b`R6Yl5AHoK&v(Ya;m
zF;GOkJL%9sSg>xZSg*W2Un+(PJ|t>!Slj?L7~3McZ+6gW>o4UyZ}N*m3_&fk=DqC)
zhEsNew2I6gYet*PCFo((68ZVkK24$aDg%Gjzpwz#Fh1@*;44K)P(-yL7)D$@Cr#wV
z<yVgR)itDu4N<^@neZp1I5o^pPNH`qq+Dyc8d(+E@OfT|s1!Er8xIOezn>--JxD>k
z3~dhctY=xG`{UMeIVqXH->T&-Ll$tb)E&@HVO6?r5=QzgP1=nx?|LKB5&WV2o30Wa
zB5w^>V!q4e5Cf8|@#WIKvmB1mlG|1QuNO3jlz6xke44Y;(-c9|XvV#9yCS+`f>ba{
z`j&E5WGUAq;`Iew%f+Zhldywp{U2&hsV?OuI5UflPcki$6Z6j-p`lIlpJ))X)s7K1
z5}SO$+Na0wE^HDv1*3sEHSBR7dOjl<?SGb}JHBI8d542rrkN)v*A`!r#2}-~Bf>Gd
z7{JmcgsR2+K<q|b-0Z2CYEi?c5$FYd#K)Dsc=}PU%>YA5M8L)P?(;6k|7TO@|Dmz8
z|LLr78F`A^^sAM*Y9}OP*>|?qyvu81%rb|&Y_v_jEb~)pe?;nZmt(m{?@Q_#3`crh
zJ=7gmYggP#-{DKOqTRdWHsKn!w*WPC!hA_^*`QVg0rEYkyNGuJbM@PK1#vwlN^!gb
zs1bh2`DiwMvc1k<5LkV}HEI&FTK!l@IZ9A>%*f~2dRls&_j?90`&<dv=|IsNccM(A
zauUAD#CYNB${EYT#)J-&K4=@XE*CA>n}_sk=VXR=Bqfo8_Asl=C9o0KXrBY!PCy%I
zGoVX=M4^w1@mrJ)!QI51=kIRrFF8a*WhMGu5ugD9Em^XcinA*pFaAW{7x!4v<e~UX
z;dxFOdu1)GK8<z^4@yJz4#P6|ID)#=z5XQlGs8ZLx=rtu>M8>l7L4|)G9HZ9BnvM3
zddQMv9gdoo@glcn7`W5$zwUInigAP0W;xH}nH)j}#>*_LWDr$>_c^tN!8|Int%caP
zm5AEXIW%!k(7Y{D`L2Z;ViT7=`Y<m?OhrR?F(Kow+JbS(AZY32RkX2}x!||y=9t&?
z3MU^x+;Coy<ijI<Ri%9#7ax78_&&p%ROLJ$E#bUS#hxA&bqQiUdlJ&k>9M%+&E9WQ
zvxYdM!xHCd_bAnEJm!*nD7#4rqgeCsQ~-;YX_Nr$3csFf|08|Bq3ByFPAladGuj>`
z+X9dKF^5Q-q_qG9r-2cIt|@@K3wfzxU2i%6dJUVs_ILZ{!!;<;L1$-Gdz7_f&-0S^
zja<R62i4N6auq#xU=z7Z7R73RzM^hnt<1jS9596gCvszY3_y0@Ke9T6m_jK}Qm~Ak
zONN=cR$bb^J63Q;`{z7NTdy55+0^yM$P=ITWO>%V0>_m_snvK}a@(^)ZxLsge}M9y
zJc%q#ZBd0pnWp-#Bt_5JA?<tf;!Y=Fo_afDKTbSDExCH*CU;mulc?+46iB!C0WYpK
zX=lut+*b-VCqSD+SZwM`ht22P_3Z3pIW9k^nTlz@$h_77Ek5Q8P2HptPn$`N0y82X
zOMaXwwILrp*N>y{Ak5D1HT~cG4~$Vm1s)VDH@8?5m>X^|ac%QG{~RQqGA<V{PuuOE
zm`OFn4<Eg_@|cZwXS99U?c>UH=e)}u<~yP$1{o_bdXrAQL}AnroK66#sv0J{le&ac
zKT{lD<g!%W*EJfKmnL=daDU0g`@BUci;Wu#LVA?*hWFF?&bU>3f>S#!#H1w@V$vKu
zOEN;~Bz!>_A5eKOzI7f_cHcP))-4_l;XXU8>kY~_frGN4c+Z@f4~7N)zU_kM|GDn+
z36|n<IdmzFc3U#v0NSEV-=pYqf1CAc3N09Nz31)SP_V{J%-;7&Tc<fxT`^R*69rlJ
zyYLh3-&gqb!Q|~=PX9&>WI{~vV9D&yrnJR~X&PL{G<&@PjG3Og$Qdm%sE@HNoU#Br
zSTiOSIsJP}pN9~&u+LlyN5Dh1^_UT<4$mJe>;2ch4N>OH1Y5S#o(YixOb2Wn++LVu
zk?Dh0I>>C+Pq{H18xq`6(|`PPac5UK9zmWRj)!IXk()ejLjg<E>LL95LW8;=uSz>e
zTGeCZm+8lIS<vSVhJsuRzxxE#Jta?;XcauyEtvV_`A2R8B{CV=v97M(pH{G&q3{Wq
zm~z9OmDJNqcqQn?xVU=t&rUd(z<K1A8v;gQWo62LHOE;KT&YzDI8%_U8+s=^L%Vb^
zFU832J#6vx(dSL0=RtUO@+kNwg$N2oK<N{`)8K8@LHHEfcrZmuP65)!3rZ!)S3F)Y
z87cP{vOO|iruO`j_?^)*Bbh2Bi|Xg>clOmW796eP!#ZE_x4<p-gFNJ<RQ7A8EFlxk
zp$CdPrQIOf-*10tWA{+CP4u;vbICZ5Sm1UM3wYH%$syoZWNy=fhM1=<#R<$OCS|E8
zxb#YtY_I*bpP@^s=X0N?O{qk~orHyo|Fqc2OOIgCf?R#rVq&snMS%5$VQ1riju`)X
z@c6H*_Z}S+kiW5wT;J*TlJBJd?j?^=u1{{B=#c_5jGiobw?F#Q^7Xm%?bh|VI4Q%&
z<j?(IkC8$F9-<rEhiI8t$JfuS66??tgrEPM`3;`}BFFf6=aKu%?@Fbu>TxgU<{V!c
zzCHqGX@*3dreA>AdPw<`=kEx8j=cN%hmkc2iBzLA6}x#J3Z%<GzShFLP~8%{%HBi@
z@|+{a;^b4r5R2peepW;<Vv?n7jduA|P4+8TmLGtnr{75%e+O*_zvQt?1rNaVH{u>1
zEkeoKBWOk?qvjrcD;&6{l-2ycaxA~FBmZ(95-tS`TbT+tn1p6iO<n#uFV+lNjTcZ~
z1sTzTB0keeyIiC|L^kuw8K>=!0KjS2Hca578a5n+^M6#v*SC&>o7dZ$H`PM^xOqAW
z{H;oTZ*G8aAv>C)hP_ao>Txdg0aoFme5-x?uV=LX{c3XdaecpVbyL+ryz$8Pmk#c9
zXUL7IqqNYH-@sUAVSsJ=EmHRrFleVaDEq~pvE81W`c3mVe%O6vK=jjd9|Ox?Ow(r_
zsSbXJ=AD_{mg~l@9|a9r&rcZ9YC}h#QW`7zUIE+hyCazkuk1g?Va=1itAlZa`{w^Y
zMafzL^eDq+UaLQBH@CiZhRp5pkCl>tO+WvBXQmt#fM}b#^_P(T``h{3P<`38cObIc
z-p&+>+~B>jcw?yF2|^KMi(K@Va!2u1NFzUUnK<sj1Axr!Qh}v`JF_c3-Y!&mjgCFu
zAgTZ{#lb#Sc7L>D8(A4P5qRb#Wyo!NTZ?nZ4=23}X^9GTN4*O@x*NCOR|>v;ou9IV
zm8`}s%FzyPCo&_&4@XECMUYeU;nugtzf7*i?2}{^C^;UP{c<JgZ_oX=y#Tp>YOwfI
zT!U_nwr^NeWKz33`UT!sl-lPqG!Y}Xm)-S>>Gm&v+t)xjxz#6etiUkG3e;f~sAz@r
zcH9goDLwl`NM3I?gZ7R^5?*6;85@#%1h>xrV%tZl-<SE3yw!LuCD@*^tHVvP(jWiF
zb}f*JAM#I!y5-G>3a@R83%C4o@AMp2;W((C8OKR;NVvqRWL7<dk92iC<Zk2B7MLR5
zJz=l`?|(v?%9Y4B4o{@`<(k|P-!|$yifOk}0v2SbvYR*K&F-tm5f|<*8`fiUS2l%r
zXeY2$1+L<U5`v_`iUUnHWtqgypUTF5>Tb=+gKGkP0_)Sh{V#Q!mANFbXA!F#_#+5f
z{v}z=jV-)+SZ1;?f^-{l*!L<sDfrqi1uXjx_@bZ7!+R%raPMLAzj*27ts%7r4sJ7{
zXd(BdSh0TYnI<N+4&`!>aOgLrHwD#>7(ah!x=wE{!>{+7-(GlPjf!4c*0&xRr5{%9
zPmov&V}g7sEibQ>91Ypff3s=XvEVvJk5glVYBtLjX)ZtDaU{>G|E<<4H?t_$sC_RM
zVo|R%RL<@3bfCa6=zYQdzbsX^ak2JiAF!u=_NR)SYNzE#1lUsl>Y!PV_#QtdDsNS!
z&Kx;*t24Pz{|nIyqs-aI=U!(mkYtv_r9#KS6jd_UJZB^OFAEqO)O<R<R`Z>PmsgSz
zhd$<8nRCl7)nMbxi^RtDnKawpjB_79;jnxLu{28JyuwNW@2*&R0owK%82OqYIEve7
zH7o#kozUQVVepO3*RsU(gIDVPdOPq?(RSNCM<%7yEY`8u0d>clzg)&OJO8BGB_;-f
z@3R~Qn4J)xv2T{KEPvCt|5-oHymS<q9NEhK{dCXr6WR*^v$|mEk@KD>#9|RQ_I&n@
zkwo9!Ut6R|<)=Gbo6e&8MqjY`Z?6n5D3m=PPnp=>Gm$wjWANXFA~3bg)+PJL3e!XA
zPf~c+eBfeCwmw??pup!@jEikUaV&VvlbJFvXA(_W&KSyDfqi>x&0h+t+#~9*9Ndq#
zk1U`5)rJvx;wS*x@G1y7EZcWA_-^_KpPGRWz8shwN?3N)b}blR$T5|mRvo(Ww_W}}
zH6rtjZ|(84^^{Kwav!A8?@P=)O`?Vmh1jc~yYy`e@0uWXSxDM<5WlmTK7;!S=$yNK
z3?nDj9df&x+;1LIM%xY6ux2=hg0@`-W=7wy@-eCs(4qZ{QA`dy|4r>)F|79A41e+n
z@P%NLj<05k%y?04#vg@JrgwOY{PmJ4k8kDiG+pV5_p2eUPY*ZJjNxE*zL1J2Pwj$a
zb{TZ6CRB?X08D3O<!$}@BHeA4cX^L)eRKe4Q0Fl2MwA5+v4b>$yvob<OB>bQauU4x
z?OVt71%CDJUdV}^v(&A8wq6`B8`W6PRc9r`f&{uyFt>FY?5e_l=@@{!-?$Lj99EnZ
z+a8gaFW6PHxJTRK@5Y}bXiN@p%uw+=Tl!wNPgKr2frhCU^fP%v`18Q@^s1l1c|nZg
zIRJ(6gi&s=yG*Iu6|BYcKz^wi-obJPe!VYyyn~M*X@05w-Av@bqy0EqDt1eYSFO4}
z^%-h53B2{&u1J(JB?o2u<zLC$!w+)cjI7XsTQ1oI={q}7QiX@R3ofeEvTK2!p+VlJ
zCns6fNk_q2^X?fRw&MUh%fFH*v0;LeLFC+};g1<V6f|WVIM913?bzby3J%?1PB<(7
z*ITyWJAjX3QD~U^l}9{!(uD$mN6^p<s*Mf;Hr)1(js4vG|F?HP>u$&i@7rXl%G8xL
zG(KEws<)*)LS*n>>UBHA{&P=w=<U@~&v<swOgQS%?YaG;Qt(vEgaTGta)Mh@^Zz2@
zu{W#3&QJb-tbGSmlj+(mML?w45u~d0rhs$^3?kA&M5Kc>ktSVQ08vp9P^w4^9YlHw
z9RZaRI!N!u0D*wC03qSN(K+Xg<=p%KYu)v&nYG5rGWp)})cx%3`e(0G9V{=V(1v})
z={D_P7VacPn5fi(S0lg(yRq-&?p%azLU=f>h|~BT?1{fPrOS~fWVX~lZy-#R1exUf
zdTcr^w42XSaqy`;^U+J3+)CX+TN&@LwJou(&w0;Ug@3?{Ol^67drG(SdXt|9#M-sC
zd3ya6KjP_LCz#1aAi@F&Aat%eBsTc2tAViCL8f6qWZ4KGuc6(CaxQXlRv~zu0`Ijt
zOou~4+2*HCv8$vMv<{d1zQ`saQvw=gwx*k%vH^9-JIRA*&aX3WnS5NK`RUl)(<ZsZ
zeRVNxrtB^y_>rFqI@SL;5=(qES{Y_H)AR|^w^N)K^6H=(y_{Zfn^F}pCkoo>6{>tD
zxY~e2JpTPVT=ITPc1M(!=2Zd$a@LM3-U2X!IZl<2zrH1JSdt;K&AyL8*@9wp$3X6m
z&*9}Sj^aQ$!L6^2tI}Sp?&59!_`u!y*-y+i9|A{*AGC3OB>$(+SWG{1Lwh-0ygtO#
z6I`NQot@^sj<}eKy#wWSms+&%za3f@JC*d}nCAx^67MzSD>uqqCf$>;zf9v|#(y00
zkq(6lS?}Ihi#ijX(d$9LwO}UwwXRAss=2o8qY7=sre@V_njU}aJx~oe0CI;{B4qck
zfxcoJ@X7a-YNGAmKn`{L2M29FhcoMzE?<MD>AXFK?~ALy2e{kBH)lf+g&V3572s`v
z#?B5jiiYex!|l5AP7K;Pn_0=>wsiZuIb8%A4qWvlGYPHZ+P%+46;eagpq4=$2NQK2
zxKTR$g0J#WeDt0op=bGyDKzP4|F?AX6)ZaZl>Jq5f|sC7KR@?Tg6faE7i6l$mH<1w
zW0FLeawxv#?JWStpIy6|3H<?pFxh@@+0u7)1d0v#!VfoI_!9mu2__0kt!^j*h#L~u
zsYokkUs!j0<?1adT|P+WMEB<ezeZ5qPIlUsbo)B|IR2AO$D2_O?M&H1pF$+pC%yEv
zfu<*pUtcRjZSmXPacOGjg{_Jhgxz!Ew|n_Z-Is2P2Q2ome@CwZT?3~w7RXN#TF~f8
zHig^@zY$*#!l~5T+Y9HjoY0GJGa<&pQ`T+j=bwad1j?F&$)4NeH3-&fl!T8p6CFTO
zd^!Kj7ubYA7WW30X|G*o=nxK?t^D!O^*|^AmJ!J4V2nDFInx|6wk$_cl^6TsT4CJ|
z>*n|ro`vHfi2L4(bW7#WI+cR=zjVgU>8*R7^qL_jHxPzX{yG-{xsqQoCdOd+*2ws7
z2jI`P;@hMa#<H%Lt9u1_8ra%qgW_!>gPfl?T=39}a#zL0(&1CyDNTur6~VR1hjSX6
z9}2T7@2jU@j}Vq#DM~W%UO3~Zmqm@?08uNJ)o(g74!=Ky9LMb?=4X@v>Z8hKjgit>
z`k%a;HWj$AUmo#d-=7Kk2>dJaE8L&W@0JRQ24FHWjotcmdze1?<cp*=Yp9-^cmAp9
z*+`{JI!mMW(EDcv3|9ob#~k5T#@34RO`%=86H9Av8APVMRM;XrF2%f@t#(#RfZcKk
z0DqMz7$v`QQ(@^4x1o<V-YI#`<vQNg#UW;Q?}n-HmloClhpal034ZkAgNgSl*4#^H
z3liDY%l5jw!qrx)9lH{%Vi7k>$BP!!)$|`lvFN_z1M}Tu%eN2=RlsmyJ^C%Wou@wp
z*(7-kR?HDQ=^1cRN;*2OdL!J;@WW<iC$lp0O7(6VNPc6oHj*s3)!&}DCM*IA2q^t(
zJNU9L!WCDNjQiNgiQN*vncB)a|Hjp^FD$`0p+IOz%6p^ktG_*8<Y}+n6H~6(dv<m%
zs68zAmQlDrPK&Fm{T5(Oj~{W#UZvt>Zu1YA4&t%dSsAgR8gra+IxJO7ohbb|xXU3S
zJ{kRv=(UOa`5ytAYrR8h!0`3{FMgA!OxUm?&O>pv!*QnvTK5w+PdI~#x!h|1I~SV^
zit^r#ovBtb<|?Q;9$ueTNRwUo(SKBSkesng&`x}-%~LU@5EeZ!F$m;{TE?N+qylz!
zl}p(vE-y6j3@cd+tSYAgP4ZZ0t@mcS_rB%Ogr}I1Q&p8_wM+4l%rY$B;KFF58H8=Q
zE6+_Odv8H#&8-b0$z{nkXcl1N_8|xxWBf_^v06=w+Fh=e$ab|M6W?^{m5Q;EBZaGQ
zkA{U5db5MLy)QVrYD+cOFV0Y$QJi}wpXdnric1T#_1Df6XU-}A!Y)rsl`Tp1ZhGhL
zw>j6Z2ya>3mdMxVEh!!GLZ>2+yASk+eBvYlVtt3zb4W)k+ZC&*fQr$5gk+mWB)7+&
zwSLv+c1>y2>H-sV4}tCE6Kc5sl$v4I;d<n_JFe1l3*M$}8*un?05j7ijTQsa^|2!^
zEvp@3W+PHgao(Gk>`>W58p2d(`7bLox#Spll<RE_T9E&IOJu<<(Tm{leJA_FHrfYh
zhyO9nWa~j59X_VY44UtCPC|;EIz4vS8O<&LEPheYj<7dT;NfYz9;s1KweO?veLeE7
zrrd(GV6T#(+c$vlY3D2O)bqD8e206<C_7q<LHi0XJ-r;1p$$Np*nS)saQt?qg~jf+
zp`B73zsMfiw*xd;XKugFV9iau6!Xaam0j-qMMNJh5PQoSJEjF6-w=V135}>ifG&@{
z`%#rkJ_p5+YyBIR!$lSqMs=DA*Gezj)~mm)n0TWS*$FJHlfk$wwnjsAzg)w;&q4_?
z4NCgYPNrm3f3eF}iyUDy`6P3AK=n11f;BvA4*D1=NU5xE42{VvI3svU3_j(V?Tt*b
zyUyq4F^nDrn#pLFaqV{5-G)Q|N%i=R^ZI9&7cIkE)$Z@NKup~ys+k}5;Jx+AfNtGT
zhY;ss-%BRRCO>3N%a|b6a85JC`=4GqQ2q>XPq)aPt)z_|od<kva7sXx#MLK~zp)7$
z=+2b@axMoVX30;xuY6~I{8v~Cm^{EZW5VLaeeN|4U!$6nHJ=Gn<^4{m*Q;W@++pV|
zG^O?)*ILn4B}87k*d{9MxA`jAMEw57SW3eZz4#TNX`L`;`i^`;bV)4kWu(e8Ny&HB
z8PAm>S46*+MY&be@mUA-k-fciS_8~cRBaEclk|Wa({o$Hu;s?5ORK6H)k@gCq^JdV
zladY{Wo9RG8peBs>cE~?f>%vsZn(@wQ6%qj2H@$l%1>~r)}VE6y2fHXb9OY~lDEpB
zLA85syy(*HA)2>>V`I1Pj9T@FO_T$X>@c0C;g9{At|}TO$+yU>H(uBq3rF6nky>7C
zHaQuQhyq>NfSs-*n&Iz84{akUN4#2TDXlDMS~pH#d!=`F#L7+W$SrNk7w=!JZ3fh1
z{MM?19v#(srDSl;>eR+jwr9`o5)m6*B91INa)Z-~ojtxy*Z_~Y)wxtqfPRZ!T3Rkx
z#-C+%t=W0!oU~a3M<+^QPI%8gADNta6rbpRt|0|KZyQgP6{U%fUMX(5<y<pl7SN11
znJLol^I6i&MR7K4eeevGHgB}a{dB6EeaO3wYK-RFVQ$?!X#LfU0ir9i6{ce&BK47R
z3aUbA0Hlw#1%Y5G(#>@RQS$)P?Fh$de(myBs^7B4bhJb%wN+~W(`mu_jvUo~C#n-p
z&lOZl#39W6>3M>s;vXtLK~FiRg}EIcFhr9uxEpILXKy}z2O39)W_i@AJ_(KTj8xhs
z>@}hnHNk9E?Ry!<)0X{eLO5OY?!?68`_*(2&-V`kZ&tNXkrR=1rz4M%pRijGB{!!z
zFQ%^V9YxFKwWn3MMPk*|s92$Ki$TUSRsDK}+4_DH^77g0)q1S|wQ#xpqhlJ$iMZ&F
zx7)A819}vk?o}$%wZAXLHBmcOIX#?J;c5+$EAzEsrSYlWYKcR<y=s5yVO^s?==VV+
zXIq;^u!|Aq*R!U#<4(acTBux0S5$piGc~IZF^5RyzEay#Khzlg>2ZxUJ<>vQI+j}x
z>S%2B?;UM=Bwcj;r@);%l!#c>+QKrM@kA??HsjUWO=#+|ZH$#u++1S~A1)H`NIa^u
zniq*;XpeRO0%@Np%tKoE9-M8s>Wr}AEa3o%-k^Xt;?t}ysG!&3SQ#c(09Nf7>nT4f
z%NBf-iy``v0{__~Wv&aV^y8auLY2xQ*n3Y?rcYB#93!tEE^cbPy1*iIj>u}rW+*j?
z*C)(p1<Xz$l;~69qS#e~O$zFE$enLgpSW1@O?V@kk^dBR8729_a8*9FsoCWZ%0uU=
zaQ>r9{Z_LdnYXgVN2KbKLj~ogs7UzA1m8SS4Uz4i>2^=q6xw}C%@}<iwmEDWfk+SV
z>mb8yxudRb_7OSfh)yVzR@U#Ai&$?h>Uc618rS)hBZ}NJ<1Ba{ro<f8KE@)1%t-3s
zH>xm(dVbOq_TIP@kAKpAX54iUN7p`eh<_QEYX2dS*n8~W;Cp+M+j+S)Yn%X6b9d6`
z?9Xv_47+^bO=}6)=;h;JsV@ZI^!VU*_D^wkkNJ@jV%4*arv+(l<RTnva&Xm^a&`>S
zlcu{B2ODwtp8Fs>iw1LBqv!!DPlE=izs+u$xw+=$b<T6fy6A6@h~;O9GRy6Us@S^)
zF;Cz2!;&aZeYP#o3Am@-^@yy{7g5c~ue(H)xn8d9(ibXFrdinXRI}f4%XB;0@xG^G
zUT4Z-HNAEg!sDI<&1A8^=)I+;&@Ke!<39hZih~gWTc>&hGt57y8<KI?ZM5fYBp5k&
zBP6UbxeLxvx0+gEjNabpi0uNI@sdwDRcBL1<DF`nQ$P9D<8;I%(X%t{I&<vD8DLg8
z@tHosi?!ol4c1OwW|=uDx2{8CQB&j%rq6Po_?rVF41pEe3BE*&=E^(I0|@P$RnGq4
z2L=Ul(KRVaDL8+U&lioGDCAVx9O%U&{2vmQkNlE_wE$@}zevP|Vs%L42iV=5ol##c
z$(hHNb)Cn^h8ADAM$nH7G0mT%PUG<mdm_y5QK5B`G#ctL*SP`YoIE{8CacW@fu@RE
zJzkID%H3;Sc!j5pYz5OB=0tDN;|vL1gA0igceA3YRX>qLx57>n$9?*z=gPSZ-jSC&
zy7`kTo3K33V5#eaKW#Qq(DjQw1EUodp*90;>ZwNsY2LRQOch&9ZrsJjRMp=mR!tCd
ziUj5-7vvS*4Bn!f;Wp~W$jO%;7-7*Ei;*%rT_8>|TxM4aFkm-6ho46Y@N&rK^0iQz
zDyI^0bmG$u0zp{B-@@cu7N^i!AaF+v;}H8i%9DHdW$@U@+D%f&M?>_q^H<LLbgY+;
zNkQH$CQLqX@I?QG+VbH)ABlELJnvd))=*!erkUGq)gG<VH$I*?qAbF_bo?Q1e;Y9(
z_C|q+l33Lz<t;8J+t+kze}_zR=)MS8lw{~W!(Kyt>3nOt96JzJtgkrF@zXibwjepe
zt#^()Bs4}|Lf&pGXQs;ki1iNAO7JbtP59ESJO~Y*`A89DMW|;j?C?uP3Sod<hGbE=
z`lTSn{N)S;Fh3`<1FYV$uLyFXi5r^NX1AnQ@?ie273>zZB{2yiu20Ey!=QT$Rjyd)
zwe@+abFjX?l4}L^%Z$!@^KGZB_vz)<aDqEpsnd)T+2eC$q=8uhGj3^(8e(L@_CDLo
z9C603uSGHUE51zdZYxce(2-R=remzFuOy9js@fA5cAg|DB=rE^tqt+?biG(zh>>%Z
z2GFvthcBy{Ntt}s8WyxI%~XqPi-FXP0_>NdbXzvW?S<EYIe8`yGo=+Sv9aC(O)91=
zprU1n8>xEC+76^=re2lW`YC~Fzj%0yqti2Z75JyrHgRDvqTMWDY|RRts6Ve}=82J(
z!$3F1Y>0neR55Vy+OM~SUu8Q^tIa4PB^~WgBN(FlPgnULr#Qd^AntJrZAzxsBA(d3
zHo3|>*9FUHynsyH{E}EmiUjxwk~`3ZHYxYNol=c0$y<XZWk|L9V1Ws8)ol>)9$2Xe
zpC1{n*YOd<bVz2A0fxO~Dj_MYeGEoqC)&5xoT!H<JDFQI8*P(~dCFLW+mW^orz+`N
zx<P+!Q-@ytRHCT4P4iRFr3v4>>Djb~;2<%TquPB`P;?b?0fQMwn$(crx4WH{xTp`$
zDlh+XWo^wd{jhd-R?QX3jCr`p7`PSRo&44y8)DPxbA#Yl;VW~j5P4eJ74tQ?90nm+
zH;&NEB);FD6(HzV;5B7(siAg<yxXbCAv(d@rw>)Rp5|Qba6`7vGIqbav|ENtYGoQ=
z9p}|;z208omFRS7RQ56ZZq$p-ychKLz*HWh$U<=;u`r+$apBB(+|)mBexUrq(c`dN
zlCexYP!exqRl(p$-(C#|$ZOQr^!`J+VXptiQIw%g!6+9TNlW3`p3CLk$Rd?ErmH0<
z;9OUJxu5hL?O(lTB4l?eW%gTIY8^#yTqAufdf8^8+QU>Es4~d$ORtJ@M0qHSml1K$
zB*vp38D4+M#2!pevlXt>1$=_4rSXS$clzj3t2W<~t-8!KhS0Nuenth@g|NwQ+bPYo
zkZU_5w$4Kl@DU^N&3c0pD9*>ZvM9fTSM~<ab7Iv-7<-*QjfB)j&czI^l*y6~>%V+<
zXOtH@#it?*ll*NsOSLZ}qR|9McokcQqKxz#9Gt7p_C3NwLV||7)MD-t)-JF&u3M&=
z>fAAk@-xS@OFDFY#&se7k?L<QD<u2wNXA!VZ!t)@KNA#`!tLwBTY;}aSO}Ug%hOBf
zwGRvqazYw5=uKY@(l<ObG_A<F8Qv)N^SUpA0FXE7jL~4SylLP`hUoi;+La`Kvbx$K
zN8TEmkY}1#Fwn?<`#M2kH|u|yo+Y$oonUrr<O--&V>`1-ZGBqVDcV}-q}Za^TPnW1
zR~|C<tt;bqDpvB&Bo{Ps|F##euF}X4sV*jmFZ$5<@gN^2h&#u!9xieTE@lX<jobP!
zs0llb4=3`=d!P5<msl;c6L#sN)ydn8MY)N3&afp;e{Ljtr%Ll}C$2$;o$hcZ!t{7A
z8GSMzDaAgqsn2AbS@PV|`5KXjl-><jL!)h?O6>3lWUl>%&gCPI7HlCHyAf|Bv)iET
zbO~Q4y0sv>^ulG`XBwC7b<K4_A&$~@pP_$qg}*WkXIkYNW4yg-_K+cQ$0O(-<HM}x
zT_p{wDIX&s5N>KveD}!;d`fvfCq3fXX!OF*>-vOnp4ne9W$_+qB34ZY3s<mpDrO86
zC|mGJnC3<bxuos>y98{|isFU+!(zUbcha6u0NLnp1m5CHxjWT?{~1u4zQ4pe%mIBa
zXxEfa%e=h!s<k71OfMhKC>GqeHh%n`kQX&5+uSu=e&t+KGt)<K*YrdpY?Zu7IOB>U
zo$Q4G-@Be&u1O<~aFbeUxmb3UxTT#TGYp@Q@9Qp<`{<IO#Jx0DrhzYWOLzeRwOW3a
zw_gBe+Hb#IzhOm~ENts6&<j#?jiA!*4a}O(AXZndF^_Q>3#Sqk+&3!Rj7<o*xcOCJ
z{Z8kbZ!xv0pSRc=i865}<~=8ZKCmG;Gsl*W+v#Sh_oYl)p|<3@8svjtm2`g~@jG~b
zeagMj1b^APV(l*dWlxj<yp4kOeT9<g2;7-<Z~lsMjm5fW=aSWz7%;pa1N4BK5oM>x
z?bfFiT>Df~A}Plr=mdA5_VOb@u8tjOKO1&Q(Lno9^@n&0>&K<(rHT&G6Z~*=ZZ<x-
zbV}~91kU8U((64GTdHGzoiq<!k1_@0*J0FCK9x*9i;X3#6_(cP(~Xn2r9PS?A~`nt
zLJy<4Os-#+T|@h-$AI!<R=;`H2cF%Z+r{p|AQ6}dY$?#=B6tl&^2~P-Qq7}3_auI}
z4aOjO-2?<|{=&tL&-Vsk<dDezCojncl?A+Xj!$~Vn6fI9XR68#d!Pmp@AUF&9poGx
z^PPq(8cV+1?qzU{6*8N7bnR`O+BwmC+LM{?+Yj4)bI*TP4{_>G9R-m}B>iHET|cKm
zy<Zjexyv8O%FBE*X$)e$h&_tr*Ytwlh&hcflFgr<WvcIt;nS~X-yihNnuI%>VVE{k
zG*bPey^Y2U8I~(C4rqqSjOkjNI>XZI!8vbhH}4VY>2t{<aTv%n8T&{*pe~KVqZv>|
zo@ZZ)nac-A?o?`3^J`0w*hK$)_&b16dBO1D4DBHZ3)^RvLMK|dE?Nz*TL?Q0_wXi`
zi)Djw-W6mzIC+<C%&<%Td-s4y<{{N^v&s}Yxo=yxjQV`Vkd;Dhh;RNXY0XE$sC#kc
zJ5*g-bvdi%TPOVAEBk*eC`S2|*)OlU5025qE98oqKoif9#BddvH=;_+@u&@SO{f(h
zG;mskdlqi`tqfmDJ6xL)=6WKcp@-*{xbTzzKYmFYLBxT(lL|Z~)?87fc4w)-1^b5M
zq5pxP=5#ScRxm<t{|!9V=8hZ)hC|n)`vf)!0c><1SDW=8(`Bnu_wIWzL?1kp^h#~K
zqGR$wFLkf>3h%`V#Pz#p<ur3qQOOECBN1_V_LoSObs1p;HJICB?qlP8|NLDim0@Rz
zRrzkeKTh+`yO(C$fkBU^;}v`GLOOr~%N@K9;E}incT|q&FmH}PMMkV(E%xTQB037*
zmzsfWrdKfdrvCnO)zzt7&w!Iix2J}GL0G%H>ocCx@1&7Zi^j^rqIPAWQxBn2_oP~I
zVz=u)Z=w&pb=Q78TuNMRu=%ZLls_fE1Z<Qx56Kr=?Y@~-r`nmUw75b=i-5fj5vz_j
zy-IM$EgD8ic{^%`XvT?ys(?Q^lH*k0!>8PyH}6J{z8fz_rNt_TeH)rsZG)XgxFKOb
z9VPH}$4>>_C+A*z;1p-#^F%x&VWMkiOzRbov}WwpyrI_ds=^mG`XzQBpE+8Am~vZW
ze)z9;84?<1*t{^eM`j9l0Un0l;VN$MS4bKwY}tH7fuA_t8a*()6A1W8pr1c}-XUF9
zN``D-*uI-S5EAB^0?<w21zcuBZLsJenzrA4q5R&FcMPzt`IT&|!S^Axp{u>=A&E=E
zm%^CE#gMa8KK7~OuA9zQ{aKx^GfGGmkZZaPibQF_Qb`FX#`!pZ(0`y8|A3k;iUnoe
z22o{1v{y?zLxLQW1+uU^LWbY5VX?KN3&Ry0IoJFfE-9B?JD-TdzZ*ZX>eY@A>fRn+
zsYPgRjC3a(zUu$H6INokX+sDRAE7)_Z4BSeg_ry79TTd#=2mDb>;X5iK6t!(0aJVi
zv=RwndGE~EQE`V?rcP5j>DSvcK&%gpVugWb6~VX^O?$w*jY=x=JB`F2Ov{77qd@rX
z$7hL-!6Kpb@Mp<|Rkm7SDCVVCJ|N7&bQL1e?H)oV)wl3_-I68u7kGv2dnCMS0mFbU
zh+9})r~EO#*|^qv)>tj*M(Z@k!-j3fuia*BRP^<8CJ};6QdULk!_Y_KFO!FcW*y^K
z0&dqfNFhm-Yp7LCmbiG~4a&xFT^^h^6NI;!;-HB2+g3Mbs0mlOONZ}|_rFz>0&r~v
z9C(7ybD!K&A4=@AA-Nokoe<LIY?{emH5s0(kxhWHTk3hD-B(Q=gk#>h!Ba4+2Ry$v
zr`c!-yY0SOF5X(RR*SM2v5d%d?Q2U}7QV20l;Cd`ma_4t52ir508zG-5(9!irtu77
zIj>0<xPvFL_LD3+|9f5pOX;JaR#87J=OdIN_3dHrd+kP*!fhnv@Cm=abFNoyfA<@-
zb%<e&r^y46H8{)M$0*J9V8_4gw<Q`HkaByV416^I#8Q7Y{JgNUuFY`mU&N}w@4Y+t
zIyknuQ%>fO-EnEWn-U8=BV6gZKr@J4k6CNKNNwPvINE}FRPOrbh%JD-V|481AOCZ#
zi}Ttrf#dv*_<S5l3}0V6B(N}E8qMV4-WhqYGcxd1n49e4SN^}gv_H6JUAz!usudXN
z&GmCi3aa}VLGtA!(b1nSM#%6+9PSme#3l=-_kg<Og)xUxkGRV~|8i~N3DT@%CEcw2
zepV)MbhfeEYg1ZX(ue206$r2LmTF+n(WWMc)oj0SDPCRu$xiQPzF7miEynS>!$lwp
z8@uQ~lHpI=Q2otDNH<ELw4~>XXscbfET%|9c%cr1Pm#fPxW#+pQiD_)eJf&SKqmjz
zoe=eXG0pAR8hsRH+RZUlB_Y(xTd8ppiX`K%qE=nlI;B?)X$_|rOyAFSkRFr<-9hD2
zggGTEpt`O%rNE{2Zj+kG)Ax|MH@aUoPWz5W57-X`ln}cfxV`c(Q+D6hz&VQSQ5<xk
zIl|4cXz_sOR|BRUEq|3XdeXf)ed0lLp<9976i)5}$nBM_T3@kCBB(m~{ZNio=<4$#
zd9>0i=91GNBC7E3IK6S(;<fTjh?nk*sT2r8L|vM1Be36Q9cN1tD*9@%tUt>;=!T=C
z{X$GtVQUAd8OVFpD$>ffj%i`4R{9Xu!RKFSWJ7WL?F?oIk3h%Zrh6+~nFV?)`QhCP
zxaOhc;xy^PD@9t@h65F86A+~OP|L0@UP+&D8JoB|HT%@WcWg`{IMJpOmT%4praCxW
zxAlgG+3PH3v$PHq?;Rg(kKvmr^7d+zW;V!mPd5*YOg<bma*7%<O;}rPD5oOF0-<sN
zKna8qz9C>zt&ZQyhWIKjXt=c`3R~a&Dx-n}LT|UYgKypxN=E%r4dM6=n(sDIMVh7g
zgr1J&U&;bQno@@n=*ha~5kIF(cl9w`@;p~7K0f(1Q4hSR-3ja>eSrC(;>LWG7P6QX
zw82;EFs2)+vR-ij0f@|}qrk4zb(^{ZNuGHJdg{RCFL|JH(WcZlo;NaPvon<(O~JAo
zj4>h&tam|=fXJmN5hq^Z+~H8j2b#qVZLBOlAIGw)stg2c7ZU_;<eGKKm2N?8APWNh
zZl(wMRJAWPtJ(ZI@mIPwNs?CB7!%zmgmADtKxETiHI?}K6wG}n3DZg?R6FljpkRzl
zmR9r;L)zF?FMOS9t@Wm=bp%@?ZhUC(jmm#AS=|jq-vW6{(#k-*Yv<dm!sZ_WJNzO8
z9+O62|6vke<Uw)<puAnqIOnc*-eFdXL-e+76CJcssJ~{E)l>khvh0zHTJ&KGuzeS6
zX3+q~74m3qj%KPj#BCZEfjiH!ZDTo@042{1Z@<uQarP=}`MBpx3tU>PwWoU_lbE}C
zmyF1-N1G_<(uo|Kz{m;Arqi>EsVTRVxKAyyWNMxB1bO6kn8JwHvbosB)f*`;UHaCK
z5fY~p%SsntAPOVT@ZEl>AV+Wfuz;FLq6Zgd8*1#kO0(gloRw;RT<gK%wDSb=t(h@b
z=vjfCv#bw3;9YmQXla~gai)Z7bBVjsSJNzw!}o}5q9aDxEk|v%c~7%t4DFZl73}QL
zQE)qsSL#3y(o>#I)@Zg=1-|z;HoyI_kBEmRx{v3f^9(jw#yipvI%?}m0&8kf-S-2f
zw3jx(UIr*jD~g-~7W4UZuL2POn)igfWV)ph@J$-fqUP04jWB$J9MBz#I8WE58~SMH
zZw^N-_yN{O+sVMLGd;oT<Q%J3{j_ZvF;?2`qe2ZoVJkplz_xef{s~ydEkKX4kQrwh
zJ0e(V^Zfj0ewinwOm+`?!Hmk9V^;jL`t4OJk@y!5QxD|3?6S3@o}cnsC-HlvSWXuF
z4E!Mj^|L+?9qgiHaFDvE=7jPP8ENz}X2p<*ezuHll=uw^`P}kyJ?MTEUmg3`=oayA
z>FjCkhmGo5jYJ%EPeTsZmG=;4$vr8P87(6Lhd8S^6R%hur<`hYG0rj0Hfss_Heqg#
z{D5aD6`Ka;?kC8|k9ez<lY}rF<HhoQNZ^~=e`x!(nb$?QIV!VX5@jBNFbV#QasmO)
z#?b*@d7g*t`T35*wq3@~yW*XUR=StXxz52dP}r>{0n}hVT!Sk1?D337NF08cj^r4H
z+?nxS0qV6=XP7dWZ#S}K1k*}s(@Ji!trg99c*-`qk$0b}HJkYAD1I;|B>gm?A5}ly
z<Xrtydrz_0<1DPqZjQ6+>nJMI+C^=>EPm?k>!qG%+ShoTTSx)I;Z+eU@C`!2H=7Dx
zBmNwV-GBsvom6ABe{HX0xp7@UsKTrYMX9aY@Y;pqmn*>dT>d0U^h<bs=oEfT+PJ8X
zui^%fqzV;w8grRkcZgNsDJ^NGJAYH)+>wD&Tdk_~w9Oaf^G7hfLRrA~p~y<<m#$Kf
zMn7VB*@UWQgq@~t=M|S%IkDt%fLpSi*9zD#y?6P}!#-?(hZgWn{txwLzXInTtB^YY
zy<nY+F<Ql6DCmxl3}MC(v*JVWl`f|eX>GSFMg0T82t-NZNCQ(%FzdG1_eaZd83+nJ
zmEL9nk14bcX{+rjmz%^G&vReye%0!^=6xjr#LA+nq{HHeL~om44=)jk%7s@ML>vog
zK?+jy@wEO~QDoakf;~iA7Z<fycw|j(v-_6|i8@Y}sc>o}&p*{T9~niXB5h=oxOs-q
z4M?33Mm!=`Wn^;Sp`Nf!=<va&GCu?bgJxRkJG2M8#FNYGQZ@8r`iN<7;8G38d%X0`
zJi_2rlbd_=iDL`Ys*P?-YnUlBp2GV5w=$AgJ5Yg9vhf%w@{XrDxp9#RHcyCn0<trp
zT$W9HYN+hsI4vUIMpM<Lq0eTnII@OD=k@ctWb{_6&?Zur>)>{?F6+=0*{@Wy0JhZ~
z%8Z@{5r$~~M?!WS4AC7m+<yoKBhSJz*7gpu4GkUCDmDtTGc#TF{%ud3-oWKJ*iCCZ
zlZ-u=7UE%Ci1z~{T{H5zIsRhKlPganYK#Zp8_Y3x73kYmpNC~A7&5-k9Ga!L?O$&G
z>Xxlyt%qksw;YzP3RHhZ5{?wgmR`1i0P_z{j~!0YIO1@DhiMu%`sBaSwc8C4LxOMK
zLf(;>ZLbJ5WNG#xiKgcLQ<Me*5iy5*UJQPdaj!3?m(rJ4R8+$fQ(lnc7p)XTX4ul_
z!Xei|QL`}exINc!`OxGv&8ci@^?2bnW{g`BIuCn9<l<@xNHGZ2V|aJXnqZ_o)FlaS
zEF$1PH(qKD;1ZL5yXQQG8iU=zuLoBg%jCJs?m8XBN`*$_prFaU&<m0Kile2y5(l@q
z7i2mG%KV100!HY39(Vs#llyY#X|*?mxs^=x&R~O&nUWy8aU0^)07Xj)WeD@1KluT2
z3`=2r%<T#)h|aG^Z}aKF$-l>?ia1oZBQi|&`>I_0<%m}(CJJAnm2I?-MJVMaIWPvD
zDVHhOKEfTptn+KMAkTR87N5MzRC8eiTEFDM%vi}9$V-|bE;(DvU-&3`v%(VQV?ks?
zMrDeLwg1o!45~5#H)B0rNvO+rA>8Ub2p6KJqEpNW$z-{=v9JM9h|v)>7K82q3CX@_
z?>(F>X5@XMdmm*<ONeK82Wq?SV1tQ4+Vj0Qe`3MIZ=d4k0pzC5VG~UDP12kfzammN
zgblSXh~jYK7E5wJDpAKNUC1JGZvGZGQBEllhwN8>%!E+)0nPx&BSk&tjSRSG`v(5R
zxlUln#48<cdPqsZ-I>xL|Fz3s4<IMjWhSLQj&&CvJaHJW>>X?9*|w%ld<E=aW)8LL
z7c^a;E%U+2SDQ7H)0)D_4-|64%3JhXyUG@afoc|lw-3ReEb><0_c<;IxVG8D_5&yG
z!tKh8`ps70^(#Z&uz7TD#uZPsi7u%T-lFdjgXsS?Vz?dHcS@@xHiX4b!VSgPQH*8L
zwH_b7^1X-!ht|p9kqtJ&TuV=VYp7LPYSdN4$}8nzd4<)VZA=36qL}>FTdYH#k0F-7
z*w1s&Ym3@;@lEb4(n$|f-7E>adQ>??tzTVTY;~p!V$*SN$g4~V#A_pymmL*DXq8lh
z_x{BNuwBAtM-)xYX5zD?m04ci>G`b-j&iE0RM+M+S?@EMT(_^-cwbu2Jy*eOTRQ1d
za~@U(@RM;1ivc1n1E~EDTP+s_qu_-q+myJG(v<f1{j9*4c};rj7u0?Aajq-r`%uK}
z^>&sf3^SPE+y<(#ku&*?TJ!-Z5_o}E*SAQqQ{PXz9t;9Z7H4qdo+>KtZ<F=N41Jew
zVT5$NeeNl3db27K;Qr1DQK$J9QnsjISkTWOic+%eHQ0PwJuuQrt$OzLZB&UNXm|Ur
z$qwaK529W&i#r*AMRlz7cjNmUkzMg~nY}}Wy2{~9JkqPRrJzd4R&(OF=mf@2`TZUY
z9Zr+n71hp-wgV{K@8$4GFSCa;995_;hui5nmUipC&jr;Y$-fSR1rgqx$}8-&qAppO
z*(mGJZu|IL`eEo*M9&v}6F#YNL)-otr`>YWznTk|WTzhB3K#O>XMJkUwrgiFM2kL9
zjVNr?K|<ZGPs(=V$D%eqkOnNSY{h$kh1}ab+o~Zx@z!8yB%**ierUvH)|8%B`$aqK
z77EYam6D)yjAdP0;PZbIaS~k$Oi^g_sd=GvDYn|Ac+TCzf1Fr#)WUmHL%fYHU{|q5
zx(bD^v0fg?jrYc;nuVD9EM*pm3>+Hv#Tt2k>V|SEGkZjL-u%s2ke<xB9T=JFzgCwi
zsJ&$2y;{Ck!JW+{dJo3r-V<cHb7{4RTU5Yw{DRlG3!LALSb4^7rLx%d<B5>x<Pv9q
z9?0l?a?M(dzF877e{g1);2>};$Q{|8;dJXV#Jkgpz(B|O1_Y!424Y0xr^z*tt+Y|5
zNC}?mIXx~fJpn~N&Ga3iQOic|fhs+Jx^l!Zr&%&iyTC|tUdOqo&k|0YyC7I;amzfG
z{JO@7ONsHe8>Dmqk6q(ZuACWnFoZkR9W3>>YzPaC_|zfOBjhe{ZARs*-DUWG8b_XZ
zrXGGCd$PLMca{6fFhTF&&0Eejgl&!R!D+}Rt<Lk2$n5XKp|dI1VKqM5xpVFqsp0P!
zmh<PUCwhArqLaP9GVBe)1!Lj#^+{LBF?rg7k)Dt6$bf^8aUXl6nJOM+hH+X<F4wxg
zz4<i)3;N8iy-LJ!F;4-4h!cqN#JGfMb~-JVC<If~I5glKqtX^Y;<*q^ciVSt39o2O
zo(59fvlCk4_Z%H#&hSmf0gN%?#R8(vKQzfG#HatI>V8+gVm=L%ggii$-Rj%pE$$^$
z#ws&EO;|!krk{R1f93AuEeEtgU#iDBS>{+x(lYmD-oi-Dn@_@k54O^tMIc1|z1!lN
zhWU0>KNI~Y^8NSlW?wof$eU`PDZ$xx^)mCln4glx8HE^7qv*@$p>-gfl9x6b$@GMp
zeide)0Dw-i2pw+uC1))e_Usg>j|~=4SlNV#&1i1Ity4f=fp$lyQ8sfiru!{N^HUmx
z1L8M%v3pD;<;S$|Gc}FdaZrLBu$EeNkj{z=)O(a&>l5EY15P2~At=>k=Py`kP)HY2
zgx$vL=WULLxk25td!|x~=u(IP3Tc`(i=0gO<@%)d;M7v@8Fw-h1^t)uB>TRMg28>#
zYqb|cnEZ-lNeT}(;?01y_Ti3F;bDSh=)_I!?hn;Dx`zZ{(O%Z0Wp?qFi#^W$69=G`
zi4wr}Mg;J4B|iAeM)qfLIY@wDE}$<qAkkgTf)-_hT_fkHmsvpcZ~1w*1DP#8{ELP(
z!c_G?wR_~>x_{_~S;^i%d*zH^I%t`|aePI9<*nUD`zA%*e5Beux(2<`*Jb9mT3&)h
z*B~+la~2ITM%fPnBW;ZL=X;eAu5oFmB9~+rAH|c`i0(Bm0XCpmyOhIP_#!BOyv{4A
zA63(09e?_BN19ORJ|v*y4sDIKyw3f&95jZ9nw3^{T5KJkz5@Ou4)dMkf`qZQ=Q{+#
zc$G4>eyx>L*pG5{`fpest8Jyqd=JAr@Y58KAD@j#+vx=$y678fYN0Zcz7<SvE5!gE
zvZAm*iK*ujpK_1FNHf8<kS#1xBHc3mM)YU=ZmAxR@&dc{OVv22niGJdOdylhHB}D?
zo!i|FVGT3Wjm*nCFX|$%{6jYRUt}ynTZ@69z?>-7kFa@d%1kAUN{<~2zw+K}yktBa
z9n<`j7U;7LsM`{&(#h?@#6Kn^qaxS*l)EJ6Ue@*(m^GNnEj;x|0L(mb)=Ow#^y}Vq
zWu#-vZw2xkXMj-og4xW6*HBS#+mUCgLtafdP~&7rz2C%3)ZaKBg22<HupPJMX*2*;
zwngRZaw29<Ui>@;4ZSAd2zKu3v_UO>ry-z}YdQJBSJ7}Z6X*y(0qP#iM^5&l?HtF7
zINDBF$FR%_So){3W|DK`#=IK%`m;2sR#!_Nl06OYkD1|D_m(dD4`$<UT-kCYXxVw}
z-9hbS{e89jFJVp@+VXOEz5v2;RCWhv0zR32)BpL7_Y;F`@v9nDC`?_uD#zMDlgnH{
zn7cDkQddyo&~HsDjU?LL+EzhRQoND+pZyy`0yQ82pe4&Yy@Ly3Pe_5l&&^2e^ICN&
z%4PVhPomK}VE!zbA)>$uGfV$boZ;C(5T`Kr9xgPAjGk=h1ngEEu6X?P&tDSs;sl#~
z?p<z4?K4M#Eog;(jLY{MX^+d_vF76d0~uge>*p&)B&Dswye`aL)!Q~cyf9)aBqEHR
zZ6;hT*||Fn62uJAEPm?>d!L6I&=Z`*syk)BRmEY)!CM{Eu`swvus))}k=vvrS6h0g
zbX6gzkr>JkQ)|?;7+uib4gv9c`zBpwObg9~f>#f-J3Sc3-;UU_vyZzAA9iG1jrG)L
zhS#*h<{{(eu^Bb!dZR4Or28O$Aj&-4UptJ|)snqh+68r(tTpJ0zoN+EJ%7SkXZKtM
z^KaSBfH+~Lv3rAK6JVvm-{@s(#3jce!@HNsz4KVsLd%Nn-v;~NSK|60*xN`YpQnfp
zdbiXo8)>m)_!#2`Zm<S`?wp4{F`#~k!n;cn*(%;8D_#h31^BIv+*6vb_BN3OO?YdN
z*9p517uBxb`3>a0tr19+xeu-1_VgkYqXB47dZr{2Cz}>uYd<{oac?F9CwczpE<1kW
zN|XGJxDL(b7_GWV{W^#^x_d}y1%AbY3fqD&$2~fXLmmRnr1RCmXqa@&mkDqpB(q(0
zZGortMN95=WJ6XR;oS`fq2qvbnP5#i#~^F9o8e5Z>y48uIXdZ9gQRq=fyAT^SASbI
z(W7A180Qs++8m$$I6H}92OL~x!j^}_5C)omEfn#8Zp1S!3gB+OT8$i)pIUrh*g0s#
zU~1~nfc|brG?D+bBld&uUxV(sCIN=I<)xtfmf3D=u~#yimX_4(9hFVrT<(nUuk+>d
zmW0z>oa{BaCI);BL$ojs!W@51c#~N?A>OtQdqltC690I_U=sdvp%!I57*Sj=e6vLc
zgsg%CYFdX$w`spWn(EuMt9LOM^b`-<7iHGmSc0hOmh0Y*a#U*@ndI;UfJ=3M+#oR0
z>4b5>MjIC*0EY=si(rwhO`0+*{tL_+SP2EH&>MT<wn6Sn;e*<x__YtpNWcMyZP)fg
z;b41(xxZy{o4xpq$;`oBd3+Mm+`TUHpEdjY;N81MxOUbTGmK%0q0=wlMi{cNl$Jzp
zh8o5$Y;AwJ5FBax;nCjaLQZ;kyD?}d^)GaYbVuv)>9_A8Q-n4re3B|AoQ$dt@dka_
zS}7eBzsaD2;0ZW|IT@5sWk13HX}?oCj5t(sLE>)4tT@m5z1^dnOxg}^qQK_ZV&#!0
zG-&IR4_&B{u3i_wOYCVF*LFNuR<uOcoMHgbvOGN0xLK3)oLUv?b@#GjpNZF$fNr+t
zw*C=3Ahh*eNTU*>=5ITcL<Lb;^<}8+@!cW$75hM=0ItB(haDbnQ9ss*%=RL*u`LcU
zEbFO7{wD#(*&)J(lr$21)F)oQ?w33E1cT~2n2lYKOoD!Cg}Gy7F|AHDtFdmT3809H
zzd&#1{+iz`+1G@E=|SKD!4J%}M8GwEw^+oKAn*vJll=r|0?lh`)$+x|Ud<2aE!JWP
zXdiN2Grj(%30Dp1+<WADybm7xM1d#Bhy9L_Io-A+-2nE-^SsX+*iF^!mv(KD9DUU`
zVOtJPu^>Q4ykb{umpE4QGk*DapnM(SG*2eq^Pkd^kS8o9vfN`<w@FcYvlxiaN`IjH
z!wp-kr+vr}U2;Mfe=b9eJW0|3?=!W#5eF=jQ3JvKXqg)`M7wG>{pM`sVd}v5#!!Y&
z-2aR1`{jApJ2e+j?1;N@`*s23`CLs)<)=zRO0!k<&-F<I594Dy1mAy@W9*lEhz{Eu
z|K?jL_23LgcZ$zzPvX@_pYPMB`Yy^<N1%sHF$t}(TTyt3=CNP5*h3X;v6O$2hmX<s
zE#6Do+398BklBhjN1$t9p8nnY1k$>jQ4kU#lf+7A^^s@AA8Jv7rQ2WKCq07}KJB2o
z_CE<A+^UH{2R=BM;a3d7jdQ?ao!pVHOw=SepU*ExrTXaxlJHEcWtIUUlZacol_@lG
zfTLWrpC13ZR}Fb`kd75D_kp=4@5#g`$04Q^pBTckpZ@?y9@k`?BTjhk-*SGX&?d?H
zGwPaP(_w!RqQK)fXm!t!{QZVQgU_`n>FQst;^|9(s@!AN8Rg$xEKI6rpkmNkyZxn#
zv$g~E>`erK$u&S-5G9GUlET~z)8^#AT9lL5!BRe!JuaB73%&_(fB@7O2p8Jd*1nzO
z_ps7zOBNcZ`}7T`d2pFNA%xCvD}u>}ZssJQuaYW_D5@Kl0aTstHsarfXSCN0{Z9z?
zhFGB#cfChsx&=nM!;sCJx&1zI)T&84{lzDL{dTq<4sdupDCy4+y#df-a8?H?)t9`;
zn~7;hdBXo&>2YExD64{ihNUUVxm;I#)}-amK&_-n@hWc>c-M`@0;&JuyBd>oV9a=M
z*J4%<XZ${47p7Megm<0?q|r|dg&J;cZjM(Uj^|M1P(%}Lvu(5ayh!#emxE0zi}%pD
zr{`6lK<!v*Z=5eb_~T4JW7v-u`X63C(eiwN-8mMfhxVE0KPheNKj2Cu(?56XA#OI-
zTGBrl^mZD5kMsyvpF073kzL2VIE7q3+_fv)6yDG4gNJ6&Mdpw*$cRh`EuI;d2-pnH
zC<b`lJ)knlG<7+004b?zK)snXcut^>09pi(gD{Vz`jmfY!E9$NN-;zyUJ&`!PZH9B
zAo5E9c?R4Dt~fSQNU`S7n%nHooHF4^0s+-uj->o;!kse)2+og*sF$VQnC1kB$waOI
zZ>O&rss$hkkjeIaMXf3+@mos%{mNUPI!eJE#;^d)-{C=5>F&O-M7?KM;}FMk>#z|A
z_EfRZ3e_QRmQa1yoELOkrB1m{t4;wtI`1dV{j10F2e9up37V+f#H0R{_b{&&+Ptpg
zpZt>4eE+7f>%ew_)DZPPee3WJ6@`RVgL`>|KF@avwBJKGS9e&hV?F|QdjBpW0rQzr
zEaxl(s{IjybWHDmwPEwnwB7w+W6Vu-T-X`3^X%?==br0XtSgjt-S(i6cq@A!cko?E
zkK8@hCj>lj^Us5e4O(*$=yCa~ZLcb9W1a8#3<ZSdZu23i{{n;Q$;u-AYyIf^zTF}$
zCRhTg*F1>5lfvic0e|r~CCPvB)c-U8C6anY&{}l_kZ3IDM=x6X#)axHX-Kt+f?*d`
zvxZ7*Z%t)Z;0_*KCjHek6Ixa6oZk`c?bh17RVg`J_@uu5BneX_&J}n%TU-UO6}@M$
zIZy~>I}q<e3kp0nv)SJ#nAS~i=I&SDY*C2o;c%xkc^8=cN+EYePR8?(%tyI|uK@?q
zqe5pRQ^;%|{OhMI{@)1*$UN@dH$nlUpoErgMK?S;VXlLin085ax&33enEn43*J}Y9
zKdSPttJNqJT-?wKy?Y=uf!Cjb`ni)%wBltcC$5QK#Mj@bdyV!9M#iC$%5`QEXyO`8
zxXI>0-`>IhWSek0U!){?a9x@}aac)UmflaYJ8pBA__sH7*Qa=EI5s-r<?>a1&r*56
z&Y@yb73GWQLPFVfs<uOoV#gY5BmZxAtd&lCbd;G7k7sGnExiLdjhb6_4sP(|wKN;n
zzdRS#b}xO=Y)1|!-Q8tLALc;6cwr|3XDbqP)vzw`a0q^Ai}GIf=XkZCGu6%9@O6)~
z%v8&VJTsPq&kBID22TR)AjORcmiwCOzjQJGZuKpk9Io{aeQ#XOS?UX7VXOIPsaC4&
zmd6=_ThIN$qWsv@Gr$8796;#Na7N$0SYK<lK0#Z6OldxrZ&rM_{QXoBd%uC$J#&bi
z6FNQ~N%3>?`uCZYAEE@E2^G0J6R{)3UTgVQyFChM-<w0-mN+R>TjOnPutWo5U3U>-
z>MMAA!_U~3XD5D7czC5r6-+!m+oC%lZ&=z*o7`$r1-t%iAZ!;;d!r`8lXZ2n5*O-|
z0v<?qO0cJvBldh`vcgjEm;4f&&QWz+gF;hT>*+vfyf^gM(Cvq5a!>kjpFVK_{V3X@
z4<AcRy1(%x1Jh!Fy-1u1VPXPZx#n4mUwNtiKJ4;)AOu(j0IC+lE$PgTocE#aU-PMj
zBAiY8!y4f3Pw2~?Y<t-<<@|lr+`3szv*QJ_|9H2KKjVbq_!GpOV*zYR&DU2<qV3as
ztC$fT;K?b>+=5<^*4oB~9(2ift(^*l?7)(mcS-TEBdTA5Z^8+K?*+qWz(k_CP$ud!
z{!zoNezP2mx7oCR5GM1;7ipDlSjLHG`HrahU^>Gv#^3V8@2etDMoG<>GZMA`n*9m&
z6|0^L!DoLv`+xhJk7>YI0b2z%KgHtP8@p@SFly|HSa&^taj@e3*1k1Dze)%zcDo1_
zruZk1Mts!aOP;|~I@VeFN+J7+fRRbogl<6#S-+COK>v>utnJ^vOqHAs!QZ+aFuUB+
z;#6#OaCYJ^vxA1po6dR_lWEW;Q`{r7*|^%ZF>Ic9aHp>G`Pc8h7}>SLtSoo)O(!_*
z4Tt*N{)o|L(<UY%CEtosAjNK4UoyM?dBZxx<~kfItBO(PcxX=N_dMcvod<bRl)P>p
z0(NWvP0nDhxvcq@6z8c*l~Kc?w$B;~wV?QXxBEBL=J(5|oft^|e9M&~>TQCrYD2w$
z?Nla)YUEqq6ze<%`~ftD=%AQ_#<K}X%W`NJute9e0$xXt7IYEo3I&$O4E~MvAX^%*
zSl5juU8AdoaOAM4=#q1o$*5oBnQ4r(_45w-Jp%Z*5&qe~{PVx$`#fN|ogivuJtZMC
zXzD5FMP0qJ(PSA=!eZKZMYforzPw)l>bSmS^&vr_m1ZX}>29`Nk?v^f0N+4f8DCBz
zudZ2Ru`p9^T+a8WM|Vq<W=&_9$MY?@bf$??%?r;ntGvs3?F0G`-cu_tbATrkJ){Qa
zwP=i<Ww>?CH<e8jQLGUCPSy91BE)ZDz`y?=tVC*>Bzn~3O%$`}<(<U1nTwaF1}yx@
z;wUOC>*DA?aoyzA-?e^d0R}Cq6x*t;q$L8Hp+&4B6f4;m7Y75QQLGE-p^43s1}!4|
zVzqrhf;7zjOy5<~7X$@m{rdW8dccG9dX0YIe3@Dd(f%{J!F0L1L&F}jqgQ{xELP7h
z!<)9xgBEq_Bn&(`Ds>9v99->Z{ghNVd4%m|=za;z{s-Ga_{gnWAbtbkTfxhimUA&L
zb>hP^`kko&BW7srXO?w}Ef~u-5g6G=^%mfSY;xf1&IjiYvzX5hD!LOB5R6ZX1TPmd
zT)!uN6Ea|n`{0(}jeG&LV+V`|#ulabO&9BEYd#1b8zEaIAEhb3Ctk@uDdxZ){7OXb
z!W1v#9=VpVTPok;vHy1Me~UK%@lrXol|-4I^qMQ?m4~7Q!zpQB(_`t!BDRy<p3wP4
z6XEsV(#`-4Z2V2xI{CPs%$uVj-=`Jzwc@^s9|&j$q)%ppM`%)r&<b@~z6{h9_4?~`
zFu6Y-uN<#;25aWd<>lhb{@)+mk)_KZX66?0yu^^v3VZVVwf)Dh`|rQ}cqpwE03w9R
z+95(?p!2DpllLqoo~jMnTV3#L^0e3_<XHhQx-5#Blm0pRa*tC&Iya5)V~wZj0+uzF
zHTvfsJePyfP4tEo$&Sc)J~8oVDfoVSQz!0jt5jZNy`M)ngS6O`i5r!p-)&9-^@jc}
z2?EAc(QAv{K}#&c#6o`p3<iPw-U2la?0YKU&G5K(X7ZTT*%yXRCmz4YJbJb9u&E`Y
z=%ZW_oifqkgBZQkXGVb3_eNTPdEBt|Ng%%r?pnTbFV_~O|2w}L#)hWC^}KfMnbotS
z0t9tfj&i65fCVNja#lZgO4F*115w`|=H$UK@Il@+{W2qj6Wj)r%90LdijgI++v6c5
z?$7QxSy>n3?yQ|^#a|(VLbLMwR%o$}P_UDhQZJz}R)c_NMyvoZCy1dUT6SEpIQ6~L
z)F@=t6XMfD;Z6g_-FwO(K-gAUQhvEVXSZWd%1`x(ZwVaMkvDu0S`YPWfK6zZdMY-8
zCigd`C1q$MG3^uKNkFbl=6QnIg+PT%n5X|=**a#aS8XsW21#yQ2dEhZUmvynFAn_w
zeM%<!iRocw7NMC}?MqtA*Y8A&Ia?R6-dR)r(1>`lTUiza8mO=nuYo@fWXaH?`v$yK
zgGS0!A3AM93D7*+eoq@xr59-lrCruq@%719^%!#Sp-;~JNO)O|omW3PYr@0{XM%?Q
z_>lCKMP<(5NHV%RAN2?P2EgoH@npoMV6)UKf~BuxK~RrB2OFl?e-6EW4Vu4Id>i=*
zU5qsxmE8%!Sp<~ld962$?z3*oty$Jae8WGd9l9MdLw9(;Lh<j*gvtHGb^5qi1me33
zY&^IdHzYnNT>R_5m#+T1UH;yX3UWfpgI}+tuCspvFhT@h5C8wL_8thUm(Lm11n*ZV
zy(msD&SR*NIxqPG0@UY8@vnCFPcSRC^jvZ0UzPg2jWsKSAs4-Qe8Q8=xiW_-t6vl>
z(>E`Y`2?9}9Lf>{MTc*5Ti7eB!lR%Se=jc9FeR><x%yE7jBio(%+`e{kg?IHU8qkZ
z^h)N6<h<0?=I(O%O`l@g?EevpevnJMSo|$wbeCe>zB$RKF`~5vUj$iJT2|_B2Ik;n
zI^Bb?kh~EgzZtc<>vc9i5H+c10iwpjtGr0MAM#ys`W}5ep?%2C;vZ-)W84Xyp)y-8
z*Id3zXjNQ$ig@riIzPg&YrpAr%;!(4y9?0NyT<Py)A>CzTYqD6=X)7Jd5219lZtO{
zBcd|=JjTP#Z<OOn{qE(OqLbJx(^S)3Xx*bj4x<#nvwp(l8ofq#GY8-WhS6<j)9qdb
ziiblfW=6QMfVrt%alE6CIY)J%AdG79(UL;t`!qRV6b-JiT4O$U1hXET^A(l4@Ew6g
zcR>2T5`gFl`uwlk!(d->BNx0?r;z~w;nU+UoP}1s&Rq{wzI>A&U~mE1^StNH19qMv
zg_=j6N~!8MhPk%Mx36z3(`-pi_=FXt<pFroi|}lt7H_CbLqV;$&fh~!y3X3p?wOMx
zO#2*#{#C-I>~jJA6CF<B!fzKgpS6BMfAc+H`QQC=La>n&PP@wxts3@**F*ZkmFFKX
zos7DnzI9>Z#I_71IR&Z^3@T=RDhr0?8fB<^L#ZJH6k$57>xt**By|gQ3U$Ggj#-pl
z`@v-1Go=_nw?-DWZ5oJ9$AX$`3flyj`0+h=?b^u`D%URkxAEuy?!3MSb@DP&)3(~j
zl++nk9(;YAvrxf|!i8ALG?|SzQ^*;{Td)eAQVP0Z@}1B=5^Oz~G&SSw7RqN1`c4^v
zw*&AFjOKS(Ku?S+>IE~Mzk*p$-2Br2;q1Mmn);jdQKbloidaBJiHH<MK<Pcwn{)*!
zAu1rfN{0~XAkslpnskxgOMp;Rn)F^0KuTz#hd@HY-SB<ibMN_`bMCq8uKkBg)?N$t
z-t(Dx=9y<^=z$ymCUx$ruWB4`o?E_32$FeWnhp%<Kac#;0M&6!f;ut-6}T(sz2Y|u
zIgNe++-F(SyW%bX=qq76l0eGVEVC7Dv?5>B8v$(aIvI9Pw!+9Z-T4;1Y?eX@JDqc1
z&oX*;_0DRl*xH@-g6jS2`yR=dy5ar0W)NAe`RIuWP+dF;z(H;;OA#x9_RM?{*mm#q
zr=OF1fQM6SUS|XD2wrdN`*w}hXHejw;ms-;8!sSkK|SsCPEPGRLF^4?o;k|&SDc&`
z^gKWrpOWZ=p1t>3_?>a>qcLD`OJ8pv8F(jOHlq({uy01JfzHEcnKEzwiL9puf_QgI
zoSqc!s>%GETBG9W6$}g)Q}r!rJ?*36z~+Wni(UstT|}+FY1(2=aPn8r;8!oB2R4+3
zMO_0Xwgac;_<wPl{{d}JT<9&Glj_^sqy0sPf4TprtsA~udx|u`JFTt-KIU0?zuFCH
zl~1g*NhcqaFQdD2&?1edkG<Dj5GV7m>jLgs3hu&w;v-__DZ0u-D<{S0bW1U$DW_l`
z{~Jf$9}&EBR!xGCyqR*C0~Rn@>Bfrb5X*p>hLSg<ove+6lBT5A{*O^20EekOMxs0s
z+a?ziF9KCK(@By(P|gQ%(jaYc(v)w}=-6sQRg+_HG=M*sNXylLTM?3*TNLT@PJh2m
zo3y3M2})BJNRK#V=nKVUQT<_U<@jftl=4evI~g@l<|%w^;NNYsLkDi0C@t8pnL6x}
zz4@Q!=bJqP2U_pueEPL-*2p0Jfy;L`EAiI;+`R>QCt#{R!%>zy;r+=ddzYqT9sZMR
zkr+I}e4t!UYD+V#U8u_?*6kd5`T@Au_%)=)YcHb=*Rp=s<PCGAJ+l-%4Sa%+=e%2%
z20~re0;SuXI^SvF-z^?)9}OBgB2IAbMlPcxSw1@mkWPXBm-G2Q0*vQsG!h}6yQx3M
z$KSaRzL^5Tn(q8<p6kHs(9#k+jxZp&ITI*xe%4s_qs!orLkuVED=`zLS45~a!pM&G
z3!lI&N6)@~u!A;exLT%}VO##_@*TNQ+k!S=rHb%O#J}-#{PWFg00(AgCpHtV@u&PB
zWcMCAN2?B;2W^Uzt}tw2-z2by!x+}gzpZ{GP@ufTu&itEMn~Q<pje6q3J}X_upqBV
zDHBBdb-yh=iY2YnqC_df5qlxM2vB<&_iDA6#w;Gl_&@eIDO@DHpOCLT0j=wl$Fyq!
zJ<LNiQ+y^&Ku!SMA^QKg<NQP@fINPu2zl!4>U5tR@R=KPn0uL&ZFGQydt81$ntT%E
z72yB0t#M%0CKJ)j;EfyxV)h+>*5~>R-|>L1={m4enWvy&E66hLgoysvr8lgnTAWwf
z*EPxYuT$X{=UVj?$fEbw?>(5)5qn2vG8=dOoht>r8A!wbOEvd@Ikx`XC&k{0t_IpJ
zPG+524v;DOhT9zfXL;gvNxn7t*yOG5vJ+R>5x)Kl*xc~6F-YcT0mGO5v!{DLz6cd9
zYc|wVLJtNvx|`qz#KvUrnN6ue5f4`elsw)h&j*-5J=Q@!q1j8|LfNQ!*BJ68f}}*q
zVg}?X;#=Aj^*@hU=@U1+u?EZr8JKw#rv+cTcGB20!{ZGeB~r~|l%Ks}7!SO1@_g8j
z)pR~8xzbxEafc>bEa_+V!(qD7pKtXS%P~C6qB%*{cb|E-#(Q@)_<Nt1e##IB?3dwi
z|Du4X{7MOEp31a#&rRwq%UbN6iAtQaN~6>A)YbYT>ROcs^h)pC3xxDP)y%eP2THmV
zilwmEQCr)JEP&5Czj6V{53I7z!Bj$Iwr<C5-|jyFCE2D=qX*_~DwE3u*9&jCD<MMM
zFJiyC*4UaFj&j0Nkh*BYDp|Bqm8pKoOaeB337FLx!%acygHPBF^y#kNIBw&*7~5%#
zcOFYZdt31l;<<@`-vAYpjjOb)d#^R~^2Ac3)*7XX=iPHm2izCfE7=i_Vz<vyJh{xB
ztqj@TEZ*m;J2}nh97a>W`GhN%#sLifzoZ#IC|N`!rjL$%c8KEL78Ui>Kru1qA%%2G
zLTcsI=uRD~=F<|Z^mJ8To}WBi*TTl+5uh>S^cPxlEyD-9Gxzze(QkH2SF(3kUUCn7
z>PGjSHMMqaRKPykK0B}XXTQVxjlVr$&$2SiGxME$yvfr^As<K9ShZ=C4VDx>v;YAB
z@Nau91wX%o2Va1-0hD1oe-){bG{a=uSCNKiLQj>$Kg!Oy;37{6(R6o)`p*RsmC5DU
zT>7_-d?mb440=uR68d%6dJXF7goOh1=DI+oHaxq6JX@EuTj!>jq+e{CWbmmto{OnC
zuHE#wd3WZ4F+Q<7>TAqHq%`;&I8=-@F}BjzJGGa{2J;?-w#;N4NSe$>|Aq|EOp-dS
z@W@S9@8Y2q<n{g)wVH0*7n{f`mq6d+?V3eM5-c9*HCJKw$A;oQ?czZ^S3|6rdb?KN
zD!-4T*k)NY6gu$%_FAKB@?Dx+?`Z({dgCmx%~vIh_0_4AhzW(Gn?)Y*lWlFZ3B+RT
zz<2V{cRXsjFO`U=dv!dVJe-_+uEl%z6Z5AoEI(g-1}u3oGdeOhKZ}6q*-9d8F{hcq
zq?C83mobM&fA#CuOCrn{>mzpz@xl#nb=3kvGk*mf%yE{5L+O6*75TMfr855G423Ds
zTH+bst<c`7FMa%`dQbCUoB1iE=QEe!q-gv?FPyJ}B?I7fb(Ln#ll*rprE8oGAcmwZ
ziiFnK&lB+nToFdVf!w!*Z6q0-p!sI5&(_`lP9`b`91=|(!r{Ze!Lz0;8%s1>p<o;Z
z?gWS{fcitl_Rb<&i~pAL44t_D)~3OMV#CrmMJeF5i;gdAKzHgIyNw3h8*|K%I4h*o
z7@=m3*=V!_Dbt|snjOUx^<}v!Wai<}=BJ++&~Q3Pk~Gn|5?#gKYH_7xhT-?}(Wb3C
z$OKLzLZwGp#vK<)#9tH=camg&x=nwB{4t#5obg-M2%&MWV!lc>sCKv5J&Ru3#>4Sv
zu<3`3FE&8I_W9w@`~Z-EukZqV%}3>0AVo=dI?iXu3LJYNIJE8EHTj*x;CyGSIDP(q
zy5Um+!{UY|#uEMyGyni3?No4&82~bN*5^M=L@dM}7A$mh%A5ag$|{?w--Wv74Y*=H
zOl*3~z=jtxT=tu?BrY_sW;hud6S<4QRgE%|k~r^i2Rk(FgztYyIfuUcy0{rlnL-YU
zuqVX)VhDs}9wGI36DIipV8ml|DV!@=B!Pge$aDM2&9s`|`kvyub&Tkf4CNl{KN$-9
zEx1Y&SbH;RRHn6f$YM;2KaCkD09?j%go}K^b=p8Ga&ifk%a|TCv+Q)0SM8*S+Vl8C
zvM!SqLZpWyq=&m<+FBk(X?{y6{ljQw<}L?zVkaK_1RXr>W`Ats0M~g6-*+Ws!Lv)2
z4#hzYWi<<{^3p`iOseLw<<mT#7f^#$F~~N(y>ip)WGqnQd0J2R%nkedINu3T#{N{b
z<sjABP~l&vh{#y9wMF*|@c!<m6G6a4=kY)<`4wC-R)^;}f5gicHj^^L)x3MsM6VaP
zw_FW*LXJ58G>;s==&l!q`X*VKoN$Jq6HRblb%Z8XVUrj4`_}K1yjKLP!!Zz0Uoz$;
zsISZwX;S8%mEw-E70A}AnD*_uR%7O}Mk*w)FYo1rB7nKpoqZ9QK-in~#DSsfwxZOo
z-Y%id23<`L-BJcuQ?(H8=E=6oCmOL8&dbV(CtQKL)r_z2DXtj&0N4W&zS93uLvtFO
zzddoC9Z$x1Hm(TfZ9YTZAO-ZEyVbU_Mv@u&J7!(i>s`aV!GOv_K}qiL#^rQW=-B54
z5YVMLLiLa&vwXrLUo1#0)ZncC7y2L+JBKhg)c;L7t&qONCcvzLd5+5XBg!bC;pn@M
zI~DjqN9)U1U9Ak7&QZ#W=V^N7=~n>|E8l2iqu6+>g!Q)1t_efc3|kR+UK-S1A_Cpb
zwn<Og9Vus3kAPa1ykoZfKJ2qpw0xi74<1Ic{>+2t-XGa!M=(h8oEV}hMWP?*4=|S_
z@=o2aaG&^aJ?m4z_S*&<#N#^~2vb<Qbjr3>?MB<>DLeR_IbG5;dB{NyJ)VOfK!=Im
z9yot*a809`RDE|M>2y<GlzL4;27kM2oNWFrOgsGVE~o(0%F$OvUMs3RsIoxQ`jth)
zMv<^g;`WLRIiB@6T>iKf*Vxl;&Fl_Zx!5_|1+>bsU$%>WAqSSANZ8vNy=j^E0Z_M@
z+MS{d<)9i{^S7Kp>7bcaU_;wQ+8js+Mz%p>2BCuP*sIOxQqfgKy}-elK05|rHCTSo
z@hjzV9gcNc2(TEAsz2Vl|0;0@w&W`CdAMy?$gP*a<!6-MH<IQ$he>8a_L}BhdXld<
zN8BDOV+A^w*jEi332<M60R&t|?2zH|1FXlILwg0^l5#<9Lg{1pwH#>viKs<2;(rpg
z{EMKE%%I#~^vU3VJ8+VMspMVC{#7#Ml6oL3L3)q*{Z8FQGS_skZ-c$)>`fC<;Om_H
z5?SVN!y7jDiay$vCl!1@{0``u%wS_;z&cmRw)#3X(2iK>-qmC>e&s03hkRB!{fzst
zv}6G2=zHEXjr_d+K=U<!!-stjCi=nwwN8eqa8;&hqyfWvw+B+*D8JoDCJJibw4^#B
z!;dMjkp6V?^jtTmZLIm11-yevFOaA^>EstR=o(^ag)X2xSUG*}+|kjC#xB3*X8!)H
z?tBO_2*EVI%BARTn|d-Mu6)p(CkSpk!QyQr!;=SjO`Qdy1w{-}H0zhae;gSMrWnLQ
zSc*yNO8Or!Kn814%eU%7iZg7NH6Ee`*Sqn5m@Ae&U@M}2pU;B}U6I;GM-uN+ho&z(
zR<c-$elxh3Z;&{Oth~)HLMkW+O~AzFEr3>kUCnQUn}K)a8y;MzR}+x?H?{|AUSYMx
zem|?cpeue3KCeoEh6@{Xe=RxiAK>+h3fM_^M*6Yi_Zj!Ieo^W37~CetJ@i15Y&t!I
z?Z$r@>U^b}z8`RD81oKmf&tF>#G30_HFQv;NM_?#;jv9(5{hj<5@tDNvAqIy!~WT5
zD@*}&P%8ZXYDflmpf`|Phmd#|DC$O@J<;Y}+WPMlil>4-t7msg`DX;7e<qXg341Jq
zj;nTeQ|n`xkec0Yxg(cqH(Uw)eML{wj8EK(vbVfItqbkbX4>ZjSU)v)m87D9PEDr-
z<lmJL$ovI<Pq$zEWz2wulubS$wqG?4fV=jAXP2)wN7Y*@Zvj2L3Hc9j*Surwq#vs<
zigOUfw|zZjh6{4_hYPk>{b7e29x6OI&%XBUf}Sy{{7KBBZ&hLY;K?hvA85>rrG_Y#
zlp<Ga5c5OG)ls55$X#Cz@N|tQo^E`2vi`NY(}fvchezAFy}$RW_$lSgqW+^sBeDAr
zWwUP4pEwLIcD&oo?f~0@$^mQX>XNn}PC};Ld$#ip@(n6*w1ki*YFw%}R5INf4^W13
z+RRp>!tRL9Cf`2aC*4F(NF%e(rs&(obii~?FhZg~SxAh<k*iZYI2W_AZmHwno@D2h
z^c9sVG=5!XkR`4q5ty%}^e=N+nJbE))VvO4Fb(5=g@DeyuY?LHNy^dzTyJ2L$yAW^
z{UKIQzD{4hgGjA2Ku(gc{OqEYK?Y6Y0Hv6INR}6;)SRlc1^TIUqNX(P{VX-P0##wF
zh7#B-kS7$2(#XmKw|xo7`#8}=52R9rH?1EofBx;9)Qq=x)2YS$1S}@uKU)lSS3mQU
zrdk9}r<+}X#{ys-DkKhGgNxq@Z2bauw5L{aEMFq{`+ZBVDuCzX2kcjQ^I9?pT}#_1
z%uh4;8AGdu5ss~B%>Jm(?__g%k_JO72SNLj%y`nKp#05eJCp5Oyb+EeW<>`hs|`!(
zDM(KD_|uo?dQtoQ9>@$V!*G<xN!ELZ`b}nOC7TT)AFhR<LVc`G06-Vrzf2B+tX&2{
zGC6IJg2w>z8v7E;YH)B!1r((6ZbMq(TOf}2em}E706Wcd+G?>ZLio_cS%!-Er>|vF
zqcYh_^aTQC4s9YnAk9JT$+_MW0>uRJ;`zzMcSrZDcusBYf~AunqWlU`Ee<xJ*ZD~b
zl*X`m-4ITD{BRw#y#}4zeOpp2u!fZ>Z(lsg*z`~0nVr!PV19bD^c7n-a_78|0`@N9
zPQWS<b5>SJ8T&szGd46W^CYCM!eHUQwYG=Mi4RV~Do{**k+Zs{c83O-a(bdulFpCD
z(-L=3n=wm`-_fh0N0l;1l?Co!n2^<L4Sg0)SrAzSMWfBL#?>E9Bi;MXE6^%Z$A9+V
zEm3UfJ*v@;vUtTFWuWyR1Tb7%yF9W$_yXt<Kv}_WAo7}_vy$e7qoVhlzuF9>zN?IS
zl#?(1OY*C&m7@nZZ@@FP-F!Ca1s>00EX7z_0O(Q1pRjQ98G+!novR0vVK_$Dg46i-
zdwk^g8`)$?1;wcoFmtykDDV-DPCjBO`_s;FUC;H-lc1twmR{ayYy4%|!(UJ;HM+IH
z9Qo6<l=&!U&-(&=<ttJ<S}%Gi%2_5Wm8w$RDoIQdNbp0w$AH&&bURfZvkJk~BKfLp
zPkbg{ARYFb#QIDQ+EE3e34oB|clGDEw`F>XVw>~BZEi0alq=OwjA{&U8k#@906BER
z)$e=6S9b&BVxPp;9G(bU%Vb0;#Qt2D+3HkM2`y^#q1(O1b7*_SaXMT`!Hb4G1c8O!
zn?lW(g8}PO^kS|L2C5Cq^4LAL)jy}SvyvALPK2P{M|gE=VDw&R`@pC^WWV5uh18fU
zc&s-a3WOGdgd`HY&MbplM~-`#je7u59_2l=!M<AfDD(`~p!|uS(6BWUwOi@B(d4(-
z`*|KG@aaLHo}^)!<+@h{@l4CDn$w;}Dw4l<0C2?t8t?zA@?Q3Zt@#?Hmz;Xlc@ShV
zX%Cx^XQ@DIML?(A&=`T*Z5cVFu=mJk@5DWCq2jd&_2VB{WdID(waluqo$=>BvFi)w
z+T}`7sS?0&g%jQx5a*;r>HdRmfz_4&f2Ug>rg{VKr7xu^!Y5(;9ckj71h$-<7KqYu
zOH&43i%+V=&t%P!x%u>n-4+&~EOZG3!F6IokSV~1692Oe#YIX_=!CF??EzWqD59&&
z;+4PFM$+52%=*AQ=oWs{Q%U#<95B72R+2Qo4?3Or5syi7CQ7&GLHc|&=9|X;U0@-?
zKdSW-X|ZvW)#`wqJDs}<=(BYHZ^~e76L1Uesr$d0P&J9;j%JhmeaLDo#eqR6+=O6Y
zkE$f9*gicscJVB&`KhO3`O7PMMZ`zoILWOyp?<nLV)Fmi3FxKq&7CxbT}}7<2CO3W
zp^HvAVGxO7t_+iImoDzd$`GH90fHbAn4hh|$K$`q#NC;BhqSeuqp+bYfzO{&hT)`~
zA+o2#im$`sA>{PE&0TPCpV5DVj5J5?4_5%vcMP=7U2C*>-N1gG$B$Id3!8x5&;TN3
zGow?d!=TvV*?I59#DVDC5!+EmIzKk%sBahgh=~v~bIu(0b6@1EP#UTFzn1^x2OP>U
zJzME-=&>Y|_0m!Ij>CNB(<}Oi9;l^GA|-$9`{^~9S<{Y^YF`86DHA;Te~6MaBkqi{
z;EiUqjE*LYchT082;`!U<7`Rg&`P>pio43mtGiQ1+`1Ki1c*KruByoP$5~VsK9>aa
z=0+vLh~&apOrK(3(n;TQDVpny7E<>our7_`J-{2^c@c-XJT5P=?vIK2h?yO`vV4C(
zOj=j#^DUrHOjgSK%$R5GS4=B&)3Djn#bL9ReoEpFscB{I0_RGt-+B+Nf^^9#s0ErJ
zQ;$x4{>QG_PnzT<>ES>r@Z_(`h^)Q4C$={O_^-|Q6Wddzx^kmbsG{}cYyvWG4X(s+
z&&j_JgEg1bQGAY%2Jf|75PR!@s!i(QKSY1dnAw5)*io=Ia-JSO`6RWPVY{IC@Os0n
zVxvZ5>M%h#f9!N+E1+7C8Ch!l34jap$8(L}i_sBV1(OFail&6Ew`~!<MBukgo~@+p
zFZexNV6<jY)C)=?znF?%mr*<4@v87>f&JgJ0N4R6l>Rh;BC%3>33!wJC+<y`46C4`
z`0tgHCqKOv{T^@-4BMlg_`W;x-&pDXNe^&V?9S6e$vk7-e@9r%r@x`gv9m>g#i-kZ
zo}w;)XC_q;zbDhQMLzwePj%(;_XUP+eep9I1%T8)!0aG|{o7AiSza5z;-lz~4eR64
zI7Y_at?l*mCq$`|>0i)6Xn{w6=;SKE{d1e0tq(e>WR&}WGEuEQuNz0Bao*5Mt^r<P
z`?=CgmrqF<|IDty=PlFc%$tg;_y`aEy7wW%*m9>ui3!W~r#Hb0fwz{qRvi$Wyngm$
zUpi+)Htvs-Me80eHPv-nyqqx=aCyo<;hgL@D4%Z7uEGn4Rw|L#25L|^;t)gB=er2I
zA<>E^9(ekCF{uK)Np0=P9|kx=$mSI6^XAF$Y}8%t`MWt^=01Kx*(Fg6a0j=iU6B9q
zZ@%kg`6=JkE<DQ41svmMnR_Vtz_*QRk8S8j+uLZ0x1EF~L->6MVE<{xhx4JbNqZ!*
zUc5=`Jth=b+?#t2$ZmB$zyZ8;cr#(v;5^b7QNdAnBqC`5sdC7wbY!yL7yy_FT#QUl
zy~c0?0#4RnEavwBBLccMz-CJnUOtQGHfN9BJE~1%bUEs#URZW_nZoyL_jzu%0}dYp
zwG=p*82ZD{f+tL-c*5qQ#>@jFp1WM(6ipK{4B5Buy<1QEW#O_$uP(UDwJu@OR67>-
zr{Oru`Ox`T?L7umIP)V9zU@*&+_F!B&)+RY#h?WW(@SdBQUFw9S7Ze&H_@aUeys8U
znBjuo%d(E_{$?Kg=a#q)<4^q%_J<L?masWm^Z7Rx*9=D6O0=nJCV~^kqYGZsFJJfF
z0v)vrpO^b`sfWMtkq4}f=!S1tj|RrmZ66AggHI)E&q=IRw@<cHUUa2|Srw82cqAR)
zaz7W}qf`V%znk!PfH~(MS+{gGATvL@$=}tOF$?l_J-Ul=-yQ|4;@04#w&b0`IFaZc
z4+fOx{w>r@x4Df};j>j77mjf1-2o^1dqgb_ZjBqH;iKJ&3!O>e<-1&-ANr1mL|JV+
z8q|&3V3-C?xX1W<rN^cr6I(q}>7PmTP;(cdY7M>X&1O6YuiczRSiU_DT`GwyNHbYD
zEGNI~l%48onm=bgiU4g0HT4E}>-MH+lQw<5zDRAY62Go#<l3RM_#|ExdZf=0%MYPo
ze3}$_>7gU>u7~k4MpVC3SgWS?eMwrm-#nA}tJYWIJ=7i(1UcU{!{LWu(i%dbGJUFD
zx{pqt(B*N76%)|DBknj|Y1rg-%u<d{G_GqNXBc((6v1$t2NAiRwCfwNU-7o>ZQb9`
zSd=jCLlLOHf;fba^@f6K$k)r0#cC&E<|*l*>ulfrzd>i<g|{WF!}g|rSoS^{5nbYk
zav?uAs+hi<{#p_BMS^WssFW$by8Yn<=%n}-F*TR+Kl_=xF+vmo4*^UV$c9)GiZSRq
zo&|#Cr)!N{oo&R9W8XIcdmBPox&v+5E`e~^0k2m+ut=afv9bMv$|CGOHuE2@D_eTz
z``Q<TYmx6-i)fZU=F#!b1vZ!7rmT0L+(asRsX0^KF;a$W0k4nF<a7dTok(EZh7Xc{
z(u+iLE1w^QEjr<qakJ?L!dpv&$Od-DViW!!Ud(sI_$*<T7|qFgFml`9WGNufj?lt5
zZ;`}EvJ=TOnXK38C6J_?%Vg26Wr)q_NYLks9uHP;b@E|aNnrgOr_Hx@+Y73u)r~0^
zDFx>~zGyTNYQu49bop@BM+hAM{xe4D6XA>R_iem587(u<qWPyMF7e%&xAhv|PMDXh
zDWKgZr1@H2M$#Qg9YVcb@~>PUNb^FXmU*CjggvwyN2BG6>m{3+zo)My6wpr|q1owe
zy~I1g9v1@=b_BWI81#m0fMy--pL${egG)spKWJOP9DYhj%`$$RZ9myC%0{54Ib#1p
zZh5D=^e*F${sH})_3J)4X*p?%AVgmDGPlHssLZToE4*tZ`d}hy6Nr<;%%}o>vKTza
zWUk4MK@;c!(UuX)MLsfZlx6*jZxVeTSG+kiE$<-VRlc_}GW5En5XMOo4-w=Brm%AB
zXt^QN)J|Zgl7*9cJ&6-bSgLys=kuJ6{J8#+rSe6~Gc_z9%OID>ZNBzRp-OYOG4yWW
z;AP+;p2Hz)6bZex-4?H0&T3|z+mD0Z1{-=?+2m;oEZ&bSf%Lu28?u~{gfbO5;9uH4
zZi$YbH2pfgvqdr?J&%xD-ZRa!hm1DxM5iuT=$0eLnvf3hDPDaI&tS9m%jCMf<vZqG
zrD(7Aiuq%|-t%?absT6XACci951EZ}eS6V<$Xf?#mm2z42Z`N(vu_&OO~Ju`EDBi?
z3u<JE+X4N6f)V&DANWcwy*vEW&CW*>l;p+N*ViLap%Z)-c-jjt^#tRjUvGKbTBGt&
ziekOa6P#mq<M-oJ(I0P=CKknkkxc@^{xVz|D5Iw8nH!svP{<^w;KrBqItD+5%impM
z2A^5_==Z&p9!Wja6yUbLP*EVXn+vF3*w*OZ1x5pez)7|7Jiw1~pWS2oLTEnuq_Uy|
z8m{r)lrW|Ac`E}mgYg%)-4zkR?)2DCmDR=oq$TEV{$;&KcxCem`pFdDgmlmH-QKYK
z{jtbfq|;&}x@SJr{1{j$bR0<krv5i+oA6_vvmQLYRxfst<cB)M7pnh7AwAFKc=mzt
zq><GF>+Q95w|a2c^%PGsWFXkfp(7nAzRkrBBkgBgccKJJJ@%ug55v?kQ%e*Py|p|k
zKxf_Yi%f?qM8{`q<Su1GwVRRW;*+b5a~*0Z@bRRZ>dF{&g_Q0gUr3q)RZM{Sq-_FN
zHi{g3t<g|K=LmI)ML8F&kD3~rA^Z7DzACFn8v=5x<F|Q%=A^x?xP2d^L$y<*(@1;-
z<eTkAe+G>MScUIs{H0_N4@_q6f=0b;#(XGNIduEP<gD_WTLjztAWSI*sNL<7dlQ&w
zt>Yg)Gwz@kuD;D3Iuozf`xD|ZvDlnX`gI4#rpzPS$z+Qu{~cb@k4tgFEV|c$xsb(e
zi!2V~5~-%{c()B0{rV?vNp|gD08F?JP}@Mt6sD>MZoPiVsh{@g|3<<ooRDz5fpmWT
zFz~_33{$t+MudB+kl2buQt+En;=QKlL>Kl4UTybRv{iXQc1~Y}MItUmXUjeVv4B;6
z*A{Z?^r<3MX4c8v(!;5a2~)*Iu=qcwwMt98j=KV`7uKd8g=*e@m~~EwxiQT{#wsZf
zefX3KVY|Gd>v+MvO<d#7gh6hUOIxX%`7$lEJ>Ie86Eg~wI$HNC<l;uOwPbxp$|V<h
z?+Z?C3D@e6ozCSnPJ=e-?U`j5c2lRUf&7Da><g2R4<NU%FJ%vmJI4(<&hHc`go;pV
zKERiGsmC8-ix|u|%0>F3X~cLZW>$JHwGlchr+|8k=C_7*2|iDbLfc&Mt>=PXo>1o<
z4EZ}>`Kw<>T5aStEqduYw+4`gd@@ePNj;VkQ{}3^FRgL}PM5yTF-c#QFX+Cv6T(t$
z=Z~1-D8izh_oDHV7gpG5HXe)VI_@15j5@|yq7CP*3)7IDB+=JajuUMwlO0!FpM2NC
z%pBMMftK|S5l~9|@y8Or4a}|<`0Z{>BlBFARXwhYri6jmt1hE!?#GAAQ#<RK!mLAj
zCfb8{j!l-Rg{(j27eK0W-qH+2F+V!SF*tVK9wA13riO7gdhf*;YoP`%Uc|`7OOQ9J
zfM9zV*WI7}^>#|sg!Si?y1tG-?)9*7zautu{adiRX;*6>Z%5841#bmC;)`x>=e!UH
z_mC$~?nQfybtr0Ds-;G``=J~QSkutGDHSFmc-v1U8<I-Z?{4LN*=6-~3!a|IQ1yP+
z^JD+I=rE?3o#=yoVZX-fI_X`|-77Lf-Jqm_KvYjEn^ae0L-%7_iXjv0`%?=)m(%&W
zhc0UIe{w7Cv58NcKY-NiyBhVq3u7Vc<#`wsB~7KlwJM{Wb-5Xk`%S*Hd*Wh=KCl+E
z;U34lfsxNbSq|EH0XR+ZZpqGX&m*ViZvSu5pLm+W-p783he@|QV)xFmgn4G)u9z>4
z<0qU{KrJ&e=2|5|PrSlXu;g#o$a=wPM0$^gCF(Ql;&0#Io)2*(q!H&mGFA#eH#wBG
zoZBR?f8G-VAM8r*9Q_@ou*F5sYV2%=I$$Ug2^OPkpcNd$l7z3G=OFlTDyHf4ac%bo
zW7-EmOSswM`+y2SeL(e0_cPb)<f98>4q<%EFJG<-d8`;6!Woc@)+(Oqs(ep71DpXU
zF>OYJQ-+a$$8&aT<3nvPHhcXh#Wq%~Nb+6nXqu{TZok6WBeHkE0&=Zi9K*BlhI$+^
zO4ZJl9G5-ca5?)_C*EeV4s?g-*3%bV+3=6YQA5(neA3=NU;YLNxD7t@wyd9v5UKrk
zCe_dBr{@Gm%yq@270^6#xm<TeL}C~d$)y!ng5IsC&zxMQzGULHuHg7m3?(8(T_sq%
zk(WMg%2{t|q4#)bNKEwSv}A#ZXMv{EmuF42NpG#XG*MOQ>#+wf&ii{0fDzHU8(-`t
zxVGf;*nFZ{mhH38g43JaiVIzhbi1<aeelfgI0`@4nPV^43=@|QchjvH?D4@`!2%ex
zExhKLch(XyH!8&aK+0OXi?XDNAMACMn(~63fR9^)TsDU?yRr&f&tej_9$mQ@GpI`W
z6z;WijenWL1|&U0&8I#b;qPuKKE~{JRBy!k?%Uv>^GF6jmhbi2>P~D$@V(SiJ#xo`
zQG}AxO_Mnce8nGFByynTsvr#nyWv)FspNVwle;n^%ssX#{Tq0hfuKinXFJsyjo>9G
zrB5|NK(g3&GvPa^s{mwbG`LE=x(t#Riow)h<*EY@Vl2Of{UwI6>=(U!AID1k*r?o*
z=RPrc=Qo~<cMJh`NnfH!5OR5Nn|rvA^hA}C)@~4~41pb)--O&X>loWe<&V&>naZW^
zrjz&XzP=HS@dl}n+9g!@f%z>FTZgWT;u{RF(?5%e<$*}h<E`9=1#(BpkO!oH2rY5M
zNLm-~6F%@r;YK`>EX4s4bjxiLH$@6kAN43!-!)Onpr^Q*(0bEJV!o!Z2XB^C$}5<!
z`7$K!j~qTr`y9tmx>HEbJF=sHL*pRB2Rc^v10pf~#-_#A@;adqeKa?}*>#m(l0kdW
z47wUJk|I@D6Mq$%>M^u?*rEzc;R_L@zq3K{wC^yC{tWLo`QTzLO2K0QzP{FjFy$P(
zPiPH0IC{E=Pfx|>n;X;|5x-vl#mlgo{PqVyR{2b`at+J<85yTS6B(Z}sru%=W>KvC
zR7bvE&32R}zJzGI)$)<(n~LtCmWKVIhLc+_GXEIDfQ95VQTCoogc6T2=XAs+*xS5K
zaa})LG>2(OF7}+{Meti1ezBILLdpHB4Kk9ZwHIdKStTW($iI3}8*PG5$q$m>zfB>g
zvY4t@yjabaN2HDgv-LkOf$!F(TG%oxToZ<Dmb0LiDj%ohtJcgcyDAE@QRjhs;m{@!
ztt)7u{0?c<Vthi4IwxLLc-1w@*>QXIBKmPG^3WGUw9+1$aIiA(o_xN6b8}I})pd=~
zB&GoqTk8uz{=hcKvf?Ylsu2yg9`p@rgH!jmwCGL+Z^v*SOA3Bv9qe&En>icLeYQu2
zcj@obe%PAU)@N22E$z4$7Qk~rBYX7iZ(tsXNhkg82kx$WS3K_;J5h={$@<fDT$OuY
z7!-8>zNk;f`J=v-jiI3-5AR&djX$X?X^t=%RV@#<7Y3;k7>`wV5+Q-V?|vOSXd&y$
zQ?T0nl~es_B(Nz!rdH2JhIS(WG3zkz#0+R=zFI>MU`H~3Gwt8D;AoG-OIlQ|#IWjL
zG{l`oTPlwAEGA;Dk9QvNP_M+BThQAIgb!r@E$MiZi-TMo8+L0Zj`{%KEuwhK-puN_
z$OLRiYs4Lt!Nck|(UZjcMCf8HHb!VNq~`Or@y&A+-Ya{Ew@k6|`-v)QnDv@0=1v7w
zWlX0&o06%-TZZs&Yzlc+^_Bz|j|w~NYt<~_)VfWTG3893M=u)(P&*5{_!321)WvoU
zC;6O<^-WGKn@e8Cl-6Hl%RO;-CVs2bWDH?Uh|BlzV_q^}p4K3Uzvu{yu)7zm@rpYf
z$AS@&--ITyh<K$-{g<di6I^!bmyeC!?--V?WjUnIU4)#4-#~6GZ~p0x+)zj2YA6SB
z^TwLvJr`Fi61mKdk>-a=>~~gf;ixxRI3mUar3AX6m?9SgRfP-cMtF^Kw?*yn81n}o
zzyn8%YfwB>)0oQhZ@YeiV+hzna}mk{G_Ck(gzF{KJtmHtKDcIRGTYQw6zN%>q#ZuP
zAqh*MXWHMX*6`8q$e5&wcv+cl2i{AhRQCGi8u3R<EjzQSTsS2+kP7PNBlwG_5n7Xr
z*x3GsenY^uKXYXl3W#eB6UpOtvxf?;#-P2cV*En7tJRops#<sfthhN(c2k_O30aMe
zOIiRPiKha87`_`WQuTW+)bs*OW&9GdAx@(T{Gm*ZX{0=zxiv1XJHgYnCw5*6nPno_
zsFfwY^2r&Ru&fRBa!S+3rXC+G)0t*-ZU!7NkAWfsUflLCs3lo1n7I*^yOgmAwu7-C
zB)(_nTC}j`h}x^dS3hy(Zn=s=^@<(A1b%ygfH;S>CB}1s0riQKdRKmFVk~YkT7R*N
z@M_QZ2|8#rd_Qk2fIRA6e{rR(sD$`C!whv}f=@60N@VZRBK_+H;l_Qa9QPgZ(r6!*
zummmMm-9<1R2nF?z1=Hy8_mw-eS1JCng-n<OWu8D)2Nmr;fl9M(Qpz5Br%;Lzb9Ea
z%!`t+VZxKioE$c8c`#EB>;W{jLk+?XWWzOWv}(>u4>7^~&(xk|#xm^4^2Z_X|2kFb
z63@^ypLIHO`~Uo>Jn}>(Ar)|C-e{^8EeQK^+1EEfH=p)8D%Mu0HT=pM2Pt>a&2HDW
zIV-BGkYpW~K{%_xq;W$HhTMlts-Ge|=GVBs`<abxP$XpUfUdX<PH@}{x4O%TLdkbG
zax)t9g(=t_mMK{1?)Xb<MMDYLX(!w76&AMj@)pirJM)YQ`?0iYqpVR?#H7M;H~mR#
z!sKdut+XHEj-)45yl6uH8{3aA!}i|pENF0L+phxAx;~W!A$6$lrsl?FL#wEL{GkQQ
zbTGpK6?^pi`}8aFL9=G=w|=Fo9cEb+l!0!G%YJ>%(yKIO(Klu$bT9UbOR=O)K+QN(
zGfdS|#q|=$p4F6}goS9d!nG31kq}<=8?PhpoL$E*eYNUH)LFzOXUQ<%%?s6WLmev2
zYUbHil2uJOxvzwuD1L9o6roA<MY(gjUP>jl#wC(!Pe!<Izmyc|ctc(}D{IZQf~gwR
ziuj&w;qX~tfc=6(JI-ms<~jRjDyPo=^Gj-e^-F+?mNDTk;c9fVMIRu!YV4sW8-g!@
z#YQ>Lrb?2IvQ=MS%QB)<Q=<}KfyvP-Kx4&U3a#u%L1XMagjZn9(vSP3$>mxJ!?xQh
zn%mrJ-dehZvdacsVU7dYKl>^ylDn-Wbi=kWO?`m!Ec~*YLpZHYq#d-9*M1kF_E%Rb
zAZ|ssNSTe>Ub~5(j_&T+`|qh@&Rls)p>pQG`_FqW|1EmIiE{s87@Y}m{2qSx8QdrB
zLHXs~PS^+bYi=029X5pIVJ~y5qC0<pYU%Z`(KW@#bWBBVu>>W<Y_!OgIfc!`sp*jo
z$>>MJ=^HABrQ|(HC2u4Sc~gB1K_9q$OLeg=IS}MQ_W6Q%p`!J*A&i6OfKffbZgWd3
z{IZMU)^*s?7vPNrJ<G{{sEY>xBcfML5&^y^try7L!*%z<C!fqX1~(Q#btLm2LdL74
zT)!*4*y`vFCcd~SX=mU3An@W&qST%l+lbZAXz$$M0+G5tpnuLFhZ&|qD@M4$|5y8|
z_TZl(i?z!6{oAHB%KR~ywChr$M)@*C<v}eD#$WMD^mQ-8G`=Q0%8kW5yRBn#RQReg
zE+W%<rJmRH=lw`>cKK1bg51}KQzADXtai(t8HXpeZ1h#=*A;+p>`(~7|A|An!lI<`
zUG4`DR+r|vm=wo9tVR>wAKXxyYTn#XzsrAM32Y8km_&qlM6oXLNj`UaO3R^kPF(Bp
z;>0WZX`wishC1v*E0bgLeStw$J<HmWD_;b^7E9R~)NFD`>aV0I8Aw2u61TIBcUZ5!
zTG%ZQUSz&UHG0rEup41ffTj%KR?F#HX*gJafBVHl=$ef=G1Fdyh+tP(s^l;_YC0d3
zQ_Pr9Kb9UfVk^>Mt=3bv&(C0E5vEft^YP6>*zFenE&BiBMgHwt{0Vc-IyEwwMz6H}
zvd+0o+MOaulL6f!CZn!E>dUI!A1-tgOv43rf2vBFe;|CRbMz+qlj0r6u7NtJCUn()
zex9E-DeRR?l0th-dCrcTiKSby2QYNv90xs2ty;W%J8gg3#bX|MgjMjRX!-epQL~9a
z^m3?wWNIz(ZsyLkPJH#nwF>XX4ju*qbjxRop|jfK-s{b#2r_U|u0CppxOCi5rph7A
z`slAq@L>ORHMB*%zp5a<^HE?9IfNEzO)VV@d))QA=-7J%^<ZE|Xr(&JvhiIzpZmI^
z%ELhZk%hcpNiHtXij|A_6uY%*?M!eZTf`xZYLBUK;>HyP+|4o71Wpv6>YDi4ScSzC
zKRxbP|8gAafzQRHU_y&S=*yr?mp);W2oRD~6I>2SMyBRSFT4uRbxnKpJL$*fDxA-S
zp=Z0ZF#Y;%8Q;OuttJ|%$y_mPn(L#+?a@9Mu^-arxBSkMcFB}`yr7dH?y;!k;aA!?
z<74iFC}Dj(2_f`%Z#Yi~Xx5B1sNOTB!*rxNJF>+MUo1~eb?7n2MgXREIeo#XqlPF}
z&8%r~%dyQ_i|w%FE!}M?zc9pdOqr?IuS))DQJ!fTQH>nufWe`XLO14)>ZXBg{Ip+}
zx#+WX(;=`qu{Yv)OLvcH6HgZqnGVBiqBpDLoFrDNF+o(&+ccKP5E}X?FqHv)XGG-q
z@2M_eL&UwiFYa-VRKQH<eP)r*u6|aFNxXGcR@JSYyH<i*6{9+4f45VMOL<{Y{S45j
zHaL3;7<=)ZsySk5mfFQJYPv<*iD8-&-vZsLxw&h;cd5}f1pQ?5HM*@KF9##Nzldmx
zxpbAB`4;Yc{1MO`YZ2~)B0p@~AKo%$4%TZ-N}3YsqUeY8J$mOsW$y3v><!qLVo<@6
z$mx?l$k7_EpndCB<hT3t5_+^+&<~drG8q##lF<*SIN(0@f$g2G^}e#ud=xWjg#-WR
zP5QTC=)Dqd@rPes%T(FHhCAVOvJ2PhSb5={Emvf%F)CCXd!?C2@xQrv++hg{9{me*
z4D*m(PanB!hl*I^639KBPWKz*2EH-pMODi0*6qGBOo{3s+9Khd(kz!RwsBj=`tsJv
zR#Qt#mupOFJn_xvoM}7D#(>*teqv>??lrLQ<w13LOL{psj|qW9J|B<c{+_X{9V8rA
z;fZ_ev9Y=2$+-N%A>rz;p`n@TMoBf5oDYVkY7=R*4khHiY3O*b%Gy!5omU;{JsPsQ
zTT0+#J5OysnBMv6T^qsvderd;obhyCaLTuZ=S3Lre9NCAx?26!R@qq$8ZlNc%iWgV
z))~~mjCr2vM+Uf&2Ie__4Bg)J?TekN?FK&{<vCVld-TV!Os9G!!G19+b(VP9K4VYx
z2Ut;tv!e#%bLWSyjOzT#$Ve_ul<N5FW4_U7r$>i6@l*}GXw64<+wNI0*X-5NLf0R<
zE3$Kw<d!nQ@UHY|qr(GfWAlJfNh;}MKK5+GFSzoY1?67`Yojq=HGS7;J<4M?6Bi8m
zM%1)F>}P!1Pqfw3TCj*Ky~g(Nx}x?E%CyU}s+_N!l>{+Wa60odzZe@^qe|KT8$|Rk
zUsfIg03%7pgjKV4j}CWBy+GbR*N6;T8G$D59Yv0YVcHuNK?>%oW07b9m-jUtjqdX-
z8{r0{t~>#{LUKxVv}$^s-TSV@s0-}2_p2mto$Z`7*${hPosBTO=N0w~_+yxY;ua=R
zYXE>RtgJxH59lps?H5s9LuJ~Qj+^9Ql-V<WIkz172s6g{x~RJZiKa_E7nd_`KoyAC
zIa{hx-R1vbaz=<$v$2S7nm;4@l&L$ZaAKXztCJ|SA_$moB}gr^9<p^vW|ok?eenk^
zLm<Inu~^!rf#sg^nul<^Ey#!C<81cNj0y{uM%~49NJB3S8_gfwCvDxwSnRlYiT}!T
ze(Svb&3((GB0(G{Dr!^yYR$#=?QLq?=^O^+dSZ0c82-4dpJd(pFnZYaudx#Cz({m0
zb7cP>jyC^!4a{fl5@nlr79q<_1#r24=>K}#VZ2(vYs%mIkG`u?nAKp{iox!pj=kTn
zPxA$Bv!uODsV^2gT#m|vx`9bEe|NTh2A>x*N=L_A6{u-T$S(!wt?P~7dfB~(vse?M
zSKYZN>Y@!|h`@PE)2bP1<y^Ce=J@zXfc4CC-e(Vgrd5;X^-2r<e?v4UScjL#KQ30^
zsJg0XrZf*~h~Xpe`j%v<U9LSm2zSs9F8NbrFi`G|H9u4%1xbenLu(vA@uRdzId*fL
z5weg>;|>z!9ygu1ES>DYwa5lWB{e#SFeU9tt!i3A*V(L0MRj0$71IQ7K%5d}Qke-M
ziqyHS_`s+XShiJ1`hDp<rL#h}ZDkV7<AZ|s2c`v&7gstyKrC}oU(g}LMS*nWn$mq?
z><8o{r(@rVXq9Z^Enk;(EMgj%0{NpeT3K{;r!<JZ=Eyc5!4t-pM;fyKgBJhs9&nJ!
z74Q78j@HjNZr&Qfa@65tlk^e9x2{Z#X+o3z7NFZKZ=TEPshLK-vAPY-qAvEaD<h)*
zTpv)kfVWS%VvtF7#+3K$_Qah*nF~c4a<^*rGhblu2k~kQSQ$G1DS83#5=r}`K(|1B
zTnGxk!@-_N<=X2xX6+M1m9A@CnOMNBDWfK@J!l`~)~$j%C-9&s{=40nbbSZAHhOov
zCJ3u1H~6BwYH^eOrF*!7%@nk{diXg*fUYohNZh3$_s`|TpzP<@Wb-dka0FaoOi&Z3
zip=jWD|=?O5aFv1d*E;Sjd@vdzUkV}rqYw%8H)cSw;7xRv>lpMIj%cDvJJYSQ|mH<
zJu_dGXV%);p$R<j&_@z8ObR^*3=^yCe*@ctVtFe~JlH>T^C_{LE3i9Sk?=A#)2JhU
zxMWNvqh@BTLBjYJ-Nb&@t)ob#SM>`qPaHtuLAn};E<1J@@A5ZehSrw)dyi~pMiiRs
z3{=3P)KiihqHjwPPRFT;@z);PTt<F-F)|x8%Fk%o^K%j%g<7XE=&~$HyP6C|?8klN
zbE=$d%+c0>!StqO(cY&wFC0W~3l7-V^o%MVB%jmDbon@6keCFKLalf-F55SLa>tI%
zMA^T&G4X(qQUVg1Y?MC=9xYJ_5WL@-VE-!{S8&_!e)$G36&3b4+I;FejU@p_S|YaB
zHhSC-(2X+{B6yo_^$}wA)9d&RDaLLKqp@r{g2Ih_LCII|y9}&GmT)nLEo5_WqfX=f
zmd224_>%iZ$y;R`RdQW~f+s=s@|>#uybT){X(@P7k(w{jK5~XvMnSKLD#vKbU^s?J
z#@elXkR%r;2!9c6*8a7M1^sbz`vHNSA^ando-atP)T31Wtn1i7P>N+5g3fsZKnf<$
zaYm++Q|2*WkvQKhXDyw>U(sgEtvbeCo4xamHbJIO9ABeb8#tzRnTR_Oc|zy|Pc1vl
zLG<cTyCOX1yPUe|?$11E&YFmNy_@#udpjcxO}Oige|M=F{_N5!cteFggm;1;$f@c!
zA*HqM2gFI)=KAs;=gjorzPkL}n5ye*$SQr&{?PzPMBw1Q?xEmf+e@I$-yI@uuj6(G
zO79V-p)z`53s15g9X*De%P$uPa~L8Tt^zay#?mWE2wacq=b%xi;xM$TNywG*>&fP5
z?>I33RUDlr(YE$J6db$1ruciNom%T@+S3K(XVOm`*k*=0K==Jwiv{8uCJC{YzSSB2
z!4N6tCpuQ*QId&k8xv`qlerlKtsmyq7{U%|BHOvzpLg-cgtnruuat~ItQ{-i0~p&T
zt>SIwokpVt^386lHr5nOD&hY3ZNB$e<v5<Rvlpxp4n=S6$Clp>V3e`yAZ<19rcdz@
z>c-{9zXvvpSvnt{kJjg;C`k-b!&#t^W~Sm;Nuoi8T=_uoCd(ok(S5hXQMBWwM*NeZ
zYf7@`f8&!G8rRca){b@$9k<e|%lZj*4XOG>I^{Lk*TPE{#(scJsbxui7CDP%q#+-*
z&JxrPi$A<4W=-d8)YSO9LI_1W?EsN}6D3|ayM0)I8l!kd&#&ZX$3DLO^;Jo(5EVz`
zW>=fL8!>99Oo6>H_5OTP2$fr_X&cINrZHZBPEk)n{ivm|xAoIcZ)qbBj)1{OEo*(M
zcebw;WqsZMwPuam)#rGKf=`-n!&=O<F4byMamX%uKW@C$^Et=wH=Xn%z1II6^_%_E
zTF(-9Qfbw2ZK+B6_Hp(h=b_m=;wwI(k?+`Pn3NYhjhal5>vKt{aGxlr_HKO#QR%v$
zDCS2JNX6=#^?w5qo)M!VG-EQ=-?_WmBlX<ld8ez-&-f^_CoJD1YV70?FMCxd0#rn+
zid3tzRC&7<8y5`U53$(xEhxQHQjA)+Uvcj^XfbW1*SB}IRBUR(Gq-urZi-5ii}q}f
zw#W`OuSp*!uSPbz=G$E?Pui25H09|llOX*$4I737$nP-Q;Z)-wE1{>=p9_cmB9Gjc
zV1gWPLXp`%f79Af?fdAa?<rTHX}-U>ni5)*)DE%^K}e!vbVv50qqu{IXlZoZx4}c7
zx`9-;<3}}4IL?w-%XPuQJJMc=(uU`oGW>_?R9QmTRkZy`_-C80l;%&4+vNUy?4Ade
zk4)8&tDAW&sdDUz%=2zv-Idr`er=C*DLa#;%M)`Q^q3u^Q=zyHIeh>03sZzEu{$F8
zXFkqkt9d%+&#h=FeE<5$#;P*2x5XZ^o65i~Ld=IO6rSK=cKJacm(KMqi67vHq3IC}
zHy<hR+A_4SI@QKC>;%9^qqSEKbSkJ4%w4;~<EfD67l0K*#GVqcn1PCHu#Gaq${Kl>
z(rkJ>gET!6fKt1rrmijFd34!hfX%F}D?!CI>Xl`sU(wpym608Bwy7E1y1*v7(f!73
zlh1(|n=@e{5k#85?x9t>n2UDmILO#2IIFbc^?)KSZnN(a?aMV$<VIBEqWA=p*x-`~
z2DZe#FNV*Gl%9X(1QmWq_M7`<Nh*T_bO$?@$BBIpo7e&8r}+QV`Ni*k%2eSw2(3R1
zHBL8O-MGNyc7c^4xwgos;L+A2LqsR(_5OK7D?Ia{@bL$RNH=-|2N!Sx*5lF2-)%ZM
zlfmeDH~|?kZAO1y=gD50Jl7>R%SPMwtr0(|fN&*;LGHT)_{RgwceXoj8DS^|4QfHs
z)i2@Rs;Zar8tsFoj56~Z#_Q11LhaB;NGEvs(v#6+3NUM#*^xVGI^QSS36}GRzI@9q
z?=q!pH(MmrPQ`<(M<UcXo|Ud@mO+4N?+PF-U}<VoX^2zNo;4XsFV-yd*XzHh`fIw1
zKPKn510M0AGU}l&yIq1>a`3?JF}fm)g_}x&I#wNIG|LLD<!pGdz4%?VZCZ|vjl2;4
zt9ZAH_jQ_<_QT&v*|d%!-~rzvl_~e1+4d;2-Ld*SfO;D1993e1@%qM)!#=_*BkPsO
zbsigcKR+4gO{|8Hw|w!d^>Qp#%SroF6L)IYUg3ErLYDJngTDLAjT4rQL+YfdB4%Qm
z&qe<+zN5rGD1e}g-H`;LIev~T?+PQ;KUDJHO8tJVX;tEA#iPfyK!kv8SZ*HJfMngb
zF==f$at;r2&A;3x^uQ18JFURxX1~Zs$WmA_KKiPxasVi;Qk5dgD_z={@I7GUdMxd8
zrJ2idvdFMY3Qy1x!(3A?le_Z-!8h*}V#`06DRVeM9!!aQO(wd=e+uv5(hr7D{yx0;
z3(1;LfXiAqa4EB)TbId1B9^|>u`#OfXdn4LFSUty-$B*#9b%qlVZBJ;-B_4<TRTSG
z=OF1-&LY#C4n}S76$p4d`h!{b`xPukXOlSln^NvRl<S=^hmcJW2gkh?k#`vSIlubL
zi3yiWrb_IKE<KG~Lh<!^diJW}8NZZhGQKHbG!}x=dCy$^i`g`NnUQDu;Yz|@tDxNQ
znAcxfIR_)2*mW6>`=drv7%*G%am^J~Rd(*14$AEnD&;R`=@}EkzCCBoHRkxue~7ct
zX4hJnxbyZQA&~qHywcPxr`bW*K*itkpQ!7}n>0X69Y7|`Tq-7G?y>C^KJw0kt}3uU
zf<deGhJK|BS|B2>myaiiKz#eH@SyUTY_V!nxx28xX>vhvo<STVyH-ITvuQyCDjKTT
z8|=_cC_DZ9U)hGDu-?O-M>SR&{!TA`q!e3Q-_M8CV40N`4u;kfH;Bi+Im`Q$9(Vrs
z&Ny<RExSEOR@481e?{~CLyMXF5cB68n!~J)VsA6299Y1*{YDe5SiSn-<VQgUYBI9<
zVsgf}jt;+EPTgS0{P`=LF**zg=lq|RRnuctK-Tfqdd^$^%m%en>4rvSpZPvQd0$HD
z(}Hu-pw?16irQZv+}E0Vqt}_PHvWh?UsaWI^{VTdxQ3dQH)dIO<K58P|Eskx4~P11
z+qRYDS3<}-w#gP#BxM_-FhceUGZk5~OBiEDw8)m7vP%*|k)0VT`@Zi>_HAr4nlUqY
zzWUww{l4$>KELDr=k<@nad2>aT%YT6UgvdQ=jHEL@N`00d%*8QtrtGE?qRmdVa1bL
z%6XV}&1QgKYRH`D;mqXiMV#M@{Co4}MQQlkh$A3qeAA{S--H21zUF?I7JdS%XYTkS
zr&!NSu@M43bBgoUaJ=^IzFPdtpG1YwFBOqzgxbMny#)v5J^L2A>B(Jz(_I^4aUlsZ
zCh-+|wAQb<w{lD}pdV*TH`HCDelFcJ`v_n{;?`g3-x!QrMJ0LF3(nO%Z-z60d&TlT
zTogTGehS6+R_0&V2C!s8mi7528h~M#1UkQ7fm)4?&KQ+S=8YiKj5^>kc*Qn7Vk*nG
zvqxo7tpoLz^zC<TGd2K+xK6S9ju_}hblj<)vVkDJbi=U?Klz0eOIr1I8uwyKMzUE~
zlHqa1!#EPjGEDT{@>3f>WyJd+0pVT^tjzcU?ditjTvjzD5QJS(oFQzs#x2gXX|l9-
zSwM^O+h-W0055l7l}=RlwqE)?GSfxHTNm~j#4KUF5TWVpAC@bjJAHh<gHUdN);Wqx
z-kAPaSKL$m>biM-WEID*j4Al>fZ*3p#`kpF1!|f-NX9G9(^L1_jDFX)AMTW(hzr-f
zC2hzDU$xm@54)3^+n>NM7^$^~*?`oZz8dyx1T|HRq(6>nzR<ucR!_bcL&H7%8QE+Y
z?RXAruu6ze^={2rtl>#4gh*GGp7D`WcZ{Gm_UlhfALBnc&llRmEe`HYMH(S##<k>z
z?C=SYJr}2vqI6HvqhD0K%Be4_9J>#u+9Egj1Je;_d-YhI1e5f|m2F0bWUnYD_sMBd
zt2aSeOae=b?L#R_(6XOuBF3SxoaZmkA*)^ZD{KM-8?fAaMyMjwawF7W0ro6b{W2=S
z1-Hm4|CGPG9cX1Zr*P}~r{B=;Lm7@azo0I|f7r>?j80kjsB5-H!II42?M@{$$9Qq~
z@k%Yb@k(JF-~M(*2>;5UVBxgf2;nLTd>bYdS&uX64yCNzoVS9ye7-iM!@$R~QgHox
z;MyBT)nMJ)A%GF6u{zd|5sX%UTI4gwQd47mUD(pAb@2KHih;(3u%y8!FArp(@?Ch@
zUYR+)c4zPGcG!J<RmqKUo%61iXMgFn`?gtRE!|34n36TdW6wl)WF)$3LV!`k*WVl*
zUwqVmM4bt`-W7E|GLtA9`hv6^0F6Zy;=_mDElhWc${^X}85(%ulA3yPY0RT5U6zIL
zLwnzIhE4IacMc&==aR;7Oq!rx9l#Hg{=ZeL|0d7rJu-a+u2L*AggvI4&m&odM@((k
zoyuHRN^fy@JY`4YKMtqeG~g2nH`3dI%dx6W`P^uDTwm!*tyV92lss9yC!<s=*ZZ1s
z#d~7$<gcuZGnvFHn8}!4IeZPw$~E+cY>Z1p2pby`M??x9X??(nF}MHLGQp;%VMQNV
zw9lGBMJ}$)Cd=JQsDU0>cZDyc{OPWY8{oJ@)#Q?N-C%NNsbfVrmtFIwje-QD*X|ra
zu8z3E$(EqOVVonLyTZRt+cnNditWk7mxCKuv#lJZL0-%a8IIJ;vCZ!lgN^wTbUpHL
z595i(6`J8wmfZ&??w8a>*bqWTtWZb{_thaw2AHb<rrh(%XX<sT98Q7nSf#fewv&my
zSK7;Tx6wG8<Hyb|r{2s*S?kUL-7XmH3)JuXnJA`WD{N;{)q9R{S*HV$*uz?v=_>_K
zvTfv)Hy|&lG1qm6@i!e<q<ko`4<CM>wAQD7cIni~h%$Y$?a#BWS8~({`&ITkj~gdx
zRa*#gj6DcDsf2Nh1*QjTYbT=FcBC9Efig7+^VT;8dLT^}*+C7#UF@P!-ED$MF?U*U
z78{0Mm5$AygRNtyM}=4<v3nY=1vp`9O(&+31k`qs#pr&+w1HT>3{{9fKq?CI5!sSg
zo9ZQ*@p)vox8mj&GkO;st%YW4HmF)?A(smZNvs5FZFQR!GVgX!9z-p^X7Z8<TAnVE
z?WwxSkyv{I#zM|w0z<&_A@4)yedFI`ieqoPt+x5Ws@)JbqY?MqTACgDvViSeQq~PX
z`*&ZSF2K<s;J)>}C)V`_9-I?D-Jf;OJP}(QT;}p0JW=-$D6C&1^%Iw5fnM<52^cxb
zg~HY(n*s>OamidY<uCDl<mU(F1qbrQ58(+5Nb`I9u74fus=6iPSXx<V8VtxJ4OaHV
zRRarHSmxQrGI(9A=xLuu5F|Jj`cBI6Mjx{8sf->L+o9m}_RBRTmQ2tx^X~^kbn4HT
zN9!4zr1<CTTE6>Tf|Ku-9;aRKqZ1kkW?nw!ZyG*zZs+}x;K_C<x)}LdHX68P!Ez5b
z_rCZxT>{NHwwQMM*#jkZsJ2JJ$3SV$4R^%8J+1dpbtF)1tC-j8E9PzS>}#emLk9LP
z-BJo1@;;VFQ)*fJn(Fp*P|n*B;Na|T1-wxwuwD~pe)KV$d70k-ncy?V8M>=<r~j`{
z8mJk7R)Q-BvjB@xzJ&<RyQY@@A%CWb&kvqCcMwvbxYnZvZt{(enJV4P1@Rv3?<T&X
zumv$mt~q-z@tp7IlE!i8>baB*m(7Zqa}FA#LZ9@8TX`;pd5L5^v`<}mDF}4!Los)q
z{2%BL8TU1y9a8O=auDTIzDLl={EA-uN6aF)qy24CFrq`|t)&^XxZdpx|N2M&ng>&@
zwF<?AE?YO$l)?$H<S)?93h3N$z#HdlxOlFbH{}Y%4%wab&#3`}py=*e;bH;<vBqJ&
zCWbs5hsihr%OcI{EP{LJ?2Q@oKZ`GJM8{tS=s0qgon;E!=%ssD+lBn$DdI*<t4$EE
zb2x94UC9%brs5|X3hgmb#n#J=luQI4;6kFshhu<$y8^%8JaWm$8j1PqP1%(<m((NJ
z2z^9?7a-ID;i9IS-Dj1;_ZKgjI{0l?ZK^#o2_rQv8<i88annT@sEm&*>$v(sW-&g$
zc=WqDO?b{+H7eg+D6#>U-fX<41MXwm(-lT>d=jhq^u|0V!B$o~XZ8eaW$VKky}Y%3
z09XWinL7IX|BAT_PE26^5tRCRnrBDz)uD$;0AVlnNVGBwhcCe86C$8<86>2`QMmco
z?q5VSva`%vGO&B;`YPYeecX3B>t1Z^&D$krr_#xwpoA?e3=`P)w-=GOu!a7bWIr!p
z#MJ}1p!`!qb&Qi4rgN_W@X-AIEu=Q$UtP;^cn@Gix`$coa6hVk*~An*v>EUsLCRku
zR&U?nyKAXsBK;;aUI<bqm_rNa(adX~a&LfRMHr=>+^1hqXBV!ry?xN4&&2+qQjBdr
zNc}99d}Pzf{Vn7hfsv+)nWB2J2rxF^JJVb*vBeS)t3)rgeGQKu;R0-sb1GzjneNu=
zI$&UnPm=}Rm83pLdRhj|r<gkYxrw*0BgQQer5id<P{QK9tpawkrM^n_nnWS!{V{Rz
zo{t>St@geqO5wRk?>|SAzq_fq$@>-Q8v@d7JwMmv2U9kxhUW?FsWS@h?X`silg5-A
z48S7O<#x5L%(87dl}5v_rXD9#-CR@c1I}gmcNJ_?|7gHKxL}0TZ<*f<)VkbTvzw%e
zI$Zr`MZt7;n9aC__rD^Fyzmegp*p7ZpK#)fWg-a&(eyL<U9#QI8i);F7C#E7!MRWj
z?-}&8C{xbU)qd5IXNvMGsw@6EUh`BA4a^GhFQ7+h#sEx;&Y~Z1&@oVY1kgud6_xpW
z=6>6r)Xon0S>3~8vVj)kVocerX5qrEop|PudXduO9w$^=*o1Dqqtxb(kYGS?MYyXs
zCH=49vVDF676x5*rmhyOUY+YESBy{d0`SLvBxd(V0GEz<G?GQT;geNbUW})i?bpi&
zh1w>4Ct!(>8#%#}PCISIcd9lz8Ejjz@w3YcF)@r@w{Kqgvqo@){(nkpN15&$&*@w5
zlz*T?1B{FT%^aPIBSfWT+z<GFmiBekt}yS@Pruz%3QUjVp_O9%;`9!*7?ANA6)gIS
z@^2nruy8uj784&PCOP;fZtVE30-Py_JQddzP-1I>>Dz@Zw6LA)=HL~s4#{n8eAB|S
zmkD|a5$}*&e|@wtN2hz78L-BG;H&2DOIBO#oSLqtP1a8v?Cdmb31eL11KrH(hA^uR
z@P^v=OL#u2E!-Gi`yCqq3A_KjRy>KoLGz-L7XabVx3pyk>T)hcDy4WNX4`=_j^BKh
zUXM%vQXr)%uG)K_gQEq<R15v~7;hgLk<AyL;QZ)MAv)L&SyND^oq#P8Be&zd)4l6V
zt^sZ}*LDaAJZKFNQJ)EL4(LhxF{9}`M-Qx-e3(0P_Uh!=)lTw7_1#p<Inuv^?-<Tx
z-4Yl$0YZly9zbS2dY|s7xdCVBDx(Yv>>2hMw4`}`Mcfp^i$pceAiC#1?Pd$`2CIrk
z>$42pvd9neG}DUlk~b2S<kGpls-Eu09#3nHye#qiScGEF4*neO=uU`!jgENGSK1Iq
zIO!z;+RK8nqgZZ9{uEnh4xmS{b}T55>o@|E2_D=l#E;@%!}UC1dZroaklR8X&Toe=
zd%`(aMKIHG8j@`595pWQZRFj#pJ*SvL|*6I8pQ?-15s4pd|xQZ^YF|YTTbH1nl~MX
zDZ+=q>0S=j{Z!0bp+c*cRK?WgVFdS-cmn&|aO`BBSw}XC;F`{s?rGgjHSifUeJYG$
zR<giA@vIc-wTU=5GSg1#XWT|dJ8;HL-<FmYqK{(o{Qom1B~Hh``4$W~Tj8D9ki4Wn
z+OT&#b(x?UKEnRcyXilzr<;#wfam=lL*#jB#kU{K1T^!ges|Amww^N**oQob27XcP
zQGzAXsr+}{+rL3~kk1c*?*-&@S%=GkH7kK|>ff-JkS{?DM?x?-B%pEz6giI0CMVN$
z7(7`%Juj3tM+PQTBss$_ALaJ^0>mBcLww51)>oI(JNBBo<BFO$=O!Fd#UO~gz{Yh=
zoCc6xnbQWIGmm~}T<5N7bZe0HP_e4)1Q5^UJKz6=5EIm7T?Ysul;OLd(}XHiM$ojo
zB`$-jCS86P>E7AV3?i1<>~i6(*OOv&P%YV)$isxIkM|{Yo(Z$D*cmfWrZVO7^8NGu
z?71o|Rzv>W$)_MAWsA?&1?rt*Y<I-gRq<bs!kb0Bm2*!R1S~-KHFw+k^q-Yumw~Mv
zza5tVPsmW4E8TKm|Ms%(05wNVHir12eWoV;r8f2J=Xs%`N4nhCYcJEX0f1S$`-3|X
zcH{PSXlY@_D}`;bxn#Vjfdc04SLg6r_Qs6MKoelr-*qXT1iruX8U(-_W0s%0-@AIF
z()*)s&SXT|(neZ5%P=DfS4D$rVVUDEa=0a=rS$U5n85tqSBplFqXE$1ShNTiG+6<L
zn%vNr*1<TvDm}_2-Ink;9op-FXd_}focN=eD~=IR3Sa)N-XlZIXZJtmb_sG}cOeBp
zRSkecCQVA)`%=vp+wAph<J~LOlLJwRhT>(E0qr;@I~|jKweKV)!HD|MnsBYCmGB;j
zH&2y9=(ZST+>O$X@<`iE7R)?E4jwkmBDz;1cYo-f6o}EN(ap4akuzYI6aOIAWXi(H
zWdr(@4KiX}=TTw17pAz{FP6Y})l*w;`NppWA>a)I5EA1*W?{C|0=}pR;ozn^bdz9e
zw^G-i1Z=ntp8oxvERXGcd-x~j6JE2;iv_LgX8M;Kb=rZSYUG);QB9^2i7iy4v<r7R
z^z~NrSmk`=5Cr?I67fY>+Jl4*F&r@|{JhTm^8grnG!#S5eDx>!`r{@XQS?dmU^L6L
zqgpn`12o|-IMFOLJ}&fkS|bS2G*Hx_qPf6zSA|;N0pASOP#mil$(J32v)RX3tdEr+
z-`QqHyIP_f0Yl#pg40Qtk01IA=@f$WUN9E{f2Mw>@{o~%9r##7m{g~liC)_{OwDbq
z`Fuzq+waw!Kqa5eeRlSEyNdxLUfQQ0-#P-|Lid^fX8?ZmRspbslqw%e%3ar}NA;)H
zDs=&U5A418H99)B3wqj`W;tmcNpB&S5D&3t?gA}Ga2ysRSow-+M<R&0o{=94J1L)M
z5=J$dFj+O`)0A4>JSm>Tw?yBrY^l$bQ-o-Vw?Cg-*Uk51KWE`}KmhnAw1*8#CwU7F
zI2C1a;pywNAy&qacRH7%`jQYcoMa~T!9bx<VAsQl`93}j$x29c>9%@P(>XnhmxBaz
zP*Nf2rhkDD5RbM8;qSxh<k^_j;qCS&eE;`TaCS7vSy$MUqlf31d5$+p>D8zBjnToI
zraM6GK>f;~m**d_vTTjLw{#_dUS#g2K+p5<?YhJxPqr`2|J2TML<n3x@X5&ZR$`C$
zbMK&Nx(ylq;VUHw;){A6abv#e1CrG4qch5%ed?jW(GtuwKsL>7BMoJIGTVCxCzwus
zBsBqS?E#lA%)E;kNZ}TrIDSas(Fv;}pe7ZBeeyO3JsnW`);}L=WTasaW9d^Fa_jSk
z8m0bh(q41O0H7IGPVQO3jCAEasC6e+4H&c4zSt_JK1&)O+&l_#j+Ia(BjNbsDRP`Y
zHSXv@qT+VN6r-N=$7pbaGYy5GN(Z`|Yv+V@%N~CI(kkUn5R*(epq6WxNT(s%jC?{f
z?M_KgxMZ3i+yS0QEK}@!SU_|XjBZ~tQsLjJtsd;rdMH+N=k$zx<zI42Y)L?VD~|ac
zG7b6dd!B9mbdB?e$t=XOrOa9qdN2K~Cd+<j`9X3<IEZ)HCCWKx8=&JP%1TWRTe>R_
z<gpROFyW1gbyWzZSCXc1tuZPxHf8t6>Jm_<L+BNY%<^dHyigcdhULMv2d1VIiNK4r
zDj6LgHeGNRBj9_4Hk^13oHk2Co<RTdKSw;4{o`m@nI6@W9LQ8rFYCcN(Z=W2JLMl(
zrGuvIl-kf9)DSsS>x;%)i+X*DbtsA(V6(#>-;*1#!U<f&!zlpbI)M93u^#lP4yrXu
z?i!fg7=-Os@zOqa_s5B&Ol75~!Nb+|ac3`24@QY7>6SiB{SwOMc65{(5@&T`3EMYM
zzzV$O(p#>|UT7Q9x+V%C9;^AMSMzT=ekX!ag4WGCrLtCII5oLYl>yXz6NZ$uKfF-`
z+g5hk79)C-7yT!~t}`$}qcv(^8Vw4U659JovI~SCk7cGTv(itF>H#8XOqPa8{<9?g
zq(cAF+m#&It<nYFpglb0*efWnEsZx&)a^sFIZ%2yJwi2X&JEM_F8YkM`GkQqp}j_n
zHoH5+yZOx43_vdPU{P&tpJp#tY=#(()kTV)EDt{@*N47K`nd!KYPUIe5=-n+F@W5b
z@kGz3A{7XWMdYD#v^7fV&AG5$G4b15j4a<una-}aeVnIR2utm;$4hq?l!ZHa)M>H6
zdQ%LpSX{-Vd#hnUOIW7pq)lQE@W_LYlDqOs*$Z_$Ezr4Kmk3UuBO&7r#J0k#;~h2i
z&&Rgtss_(1m8#B%(6+SfPm!}~X8_|jH}-g!7lb~X&nDa4NIFIasDANg!LjFwWoo-+
zlb*>3R1QZas{7f4-ERVgppVT0F?1YfSU!oI|LBFh_bmWx>Dq{r9*Bu{Wsm>7vaqE+
zepe2$w(R$G1s0lV_HKJ#;a&gKl2KycaQl9weZC3Kz4GGDgL!_*V56C9e$mI-dN_&V
zk?9wsY||T6!;!}hL_r6^N43ao(sn!f5zT9Vi`Gx-^pP2I_k^a%Po2UKtBfobVs>qd
zJHJ^reHGk4$d3fXf*Wc0a{TnTO(2o%vHgk5lK}is*i83OFtj#frtS*Cnr5%CZ{NK<
zogZ1uYS<k%<6TF4TDPhPVa7MNowADPu4iYlvtUp*%123CIqVQj%5q#L$KvKGb(p4-
z-Oc(8kkZ$DWH#w+o<ys=9#c+&as?szeUR+QI02cn0^njhOy5(K<X+CgtAKzUZ6Ig&
z2IYG)1AA?%=PG(KHdfdwPq{rGC(HimC9?<6f$BqOzZiWYZET14N}UPQBTB#1zGESW
z?F_(-&f3Hc=14Ep=EcnWY|BRKyCI&POO-c04qGjUs$>qT>+z-ibfhvyonzrQxrPEo
z7xatR6eV%22bmdF!`<lv#d2%x%RCgYa?cG2-wSt}bk1I!1W#i9iY^v6lHs+FHKFpG
zyKhaj3&Cg7;kAb8*RM0|#b`(e-&UM7*N}V{TO?xvUV3S6UYmPM@at!^kHGT5+J1IH
zx{~y##|p67M4(KTm$@X_KV_LGwDW*QXw+(u{Il7sUg+K+uKaP$ABK-fsUi0R<aRyt
zR+djdebE;{mC19J;myDsv5tO%J=FB5dz{w0GNt%9le%*Nv#(d*u?3O$eTdZZI{~!x
z9}}Ud(<JW7dxJ%}>U9@_p(@PbR^)dUg2g`HBy5E3Rp0Uqpx`}RxoZo>YvxA&bxHzk
zESvxncr9K-y5x2;M&@n&ExlpWGYK4P-<ZL}f~QKnX;!al`hN=<@78{`EQW_-N^DyT
zWa8fn$iMx5{#e9Ea#fHkP5J0bMQzUi=SoqU^T0%r6iR*NBY;*`0rWx;N;pXV@_qPm
zp$|V8=i?0x?eDg*B7Zq_@NFp|8=vPCyLuvMy8;z^kxBq^jqpLa;Ublmk@#XK?;2vU
z4Q14AE_q;D0?ap-z`<1r2pvgvQ4vqZ*|sWNZ&l+)DPM1uC#jMwkI_b*=dTFq<(ZF<
zyCAm%7IQlEPYIT&K+xCUPoS;dPw*N>jeM*a&hsDjty{gMXPNKbTHU!po9@_Mi~*cq
zI9fh1nT?u$aEnW5Q_uD0msT%zNgK=S+x4GJ_>8e4c}+uIQpY{NxK&u4xelgQ1UP4;
zS)CHn)Kdt5hs7#Xq{I=NWgT`+u~(|Zpo+nEb=vAJ%=^IR4M^lRq^0bVSEKu{iY+U$
z>=su*BnJ5y)9|LVFUnr6Vsw9T54gGV7+zX9Wr3Q3*l+^|*0iW3pQT!qPDPT-E_WxS
z7J3|78kw<-PT!@Bg4ZTVhkIdGWe>us<Z+!!F$vctS$VGY3dLre%mG<E=Xy;;n#<hj
zxn}aE&2l8ER3FZn3O8fO<$u`?u#zK1xq9MVd50ApS6P6UMqNCUGv=h8Yt3T(opSHA
zy!3=Sx#cC^b;*Q0v`%&Q@8v1r{|{;8Z=^D)d)HQbzwD|L<JrH3{`B#C=R)x~8k1MF
z(4vFMcSyVin$-b{m7fa_ms*(jJ~17A4X~n)FEE*w%jROlwk_8E>$n~Wt@@WH?S%Se
zW>7Th$-EmSiWY-|)e}W9Kq82;Uj_7Gshjq4R-323AJqKiMU51kJ%4&_?G;g0FzDER
zS<+_VzWO=qR;40u7}NXFcBSfO?$2I<DK$-N>py?(PcDE2=43e@J)*^JIe28uwusIc
zUh!ydl9Hh~;3Gj!I7m>X^}4{`hq!Jpk;tyq^|1aV^!*6SpjHLUXLD>>V(HSb$w8!2
zDs>eE_j;1({$&<8B&>MmaTAdo(K8A8VqZ7<x<8XsrPuf?TtTF|AI&_yNq@1;>NsO)
z)rT$DQ9lAEXJu7mK#ho#Kf7IHIdNS`Bp{ue=iC?N11O4~5F&;d<y2HRL(&gyeF48>
z35kL3G)K+qY#T*x8~tygQn)_1#yvWVf8&r?MRmB~yA$_<DO#gRTo_bTlP$saL}Ej6
zVrBEfuO05Ylg9()KYCo|VG$0>2j8w=c@W$$7~H>mpi+V)^mZ2GeqpZF^&6my;*fTO
z$(lj8^fV;yJTke#V4PPH`ZN(^(dh8ulhO9_+t%?a)2Z^hwaNCX>r5ZUJoW4|Zd49^
zwQKb{?1tfWh-@7n2p`tYU*73&Wk>FDXaM_ZE>}JW)?G@|Z@s_f7c`L~=KDwYUyt76
zp}97x^44i>CTIB`b$>5zwszDmz3e)*QT)WR`elJq&0fKk>arBL5-ZR!iPi|$yMI5U
zaAH{mJ^85tJ)v0x8z}v?FR#{(G=A?+d(;K1(AZjfw3XZVEpic<eYzdaR6Rqy*x+Ok
zNvWwd-lY^4jcmLNo@4923%-hF5m0*P*%8e&@GM_9R9pB`f;=+RNb>GS?-c1F#QP#m
zd3ON?v&Bd)N+l_Zf7J)n3yrAE+jWXDQF(M1C9}ZaDpflT0BK22qQnY7{Vwa@1-x)I
z*uF6S6L|jz=rtz9tStUB8Wd#Jp-F6Lxu&Nhwxmrkf8G0}Kw_nOakxMT?bi1szs?PB
z_#~nn2c%dIO})t0*dS+s5I<t$NSge6z(E6H^VowKATfJ*2tvxx<-6!F5+vdiB)t2L
z!p_a9na^1^-E$X!y<=su`|rS+Nz0F9R=~i%#P?CJx;jkjpHpUooVdLTi>+fMc7D3^
zR?k$_Gj3%jY}H@jJSvg&APPlMH!V(f>Ql1q1odxT?<1JRypH(BSvT#QevsgZtTS1~
zWC(l+9&k9Dj#xz|x*I31Psm(21P^Ww+X$PF?r-lbbY<gL?$mxD81SR=EGl8{ubeY%
zy3r|k|09mBy`5`MIK#^)1lU=(tm6-TSvN2Y-=Zof*-bsS85}N(2L7(%xnZmS<4Ke_
zko&b+LOHYv`%lFtL$FvZ?6CUJ_bF&qj`r&RrDq>4($gB%g48L7dr9wqZQl{YY;dB3
zAI1c@TX0_+evASSIEagaY1(U$r-6Nh$9Yi0$6-)tXH{9Vm?TnSC&RE!_MOWdpl+BW
zd2Z;_A#?g=h{w>zEcYQJ`g~9(IPn4;Sn~(=ar*Q;gMke=J>f&YXKA)eBgg~%g#YV0
z+s%=hyIRyP!oS2Xw-{#Vf!5et#d%-&-`^*Qw{Fo~c&(TqD#P2_a___7-trt`J3om&
zJTCZg6=LlR<^6)1Tf*VYdzu%?c@MUCpeCCB`uixM5PAp#oo(`lVFk75fDgSJhT28f
H?+5=E#o8>N

literal 0
HcmV?d00001

diff --git a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
index 7f135ee9041..f1097411891 100644
--- a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
@@ -3,7 +3,11 @@ title: Backing up Rancher
 weight: 1
 ---
 
-In this section, you'll learn how to back up Rancher.
+In this section, you'll learn how to back up Rancher running on any Kubernetes cluster. To backup Rancher installed with Docker, refer the instructions for [single node backups](../legacy/backup/single-node-backups/)
+
+### Prerequisites
+
+Rancher version must be v2.5.0 and up
 
 ### 1. Install the `rancher-backup` operator
 
@@ -62,5 +66,5 @@ Rancher Backup & Restore is a cluster-admin only feature and available only for
 Which means only the rancher admins, and local cluster’s cluster-owner can:
 
 * Install the Chart
-* See the navigation links for Backup and Restore CRDs (there is no overview page for this feature, after the chart is installed there’s a separate navigation link for its CRDs)
+* See the navigation links for Backup and Restore CRDs
 * Perform a backup or restore by creating a Backup CR and Restore CR respectively, list backups/restores performed so far
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
index 796d69ab114..ee44cb76a1d 100644
--- a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
@@ -4,7 +4,7 @@ shortTitle: Backup
 weight: 1
 ---
 
-The Backup Create page lets you configure a schedule, encryption and storage location for your backups.
+The Backup Create page lets you configure a schedule, enable encryption and specify the storage location for your backups.
 
 {{< img "/img/rancher/backup_restore/backup/backup.png" "">}}
 
@@ -109,8 +109,8 @@ The S3 storage location contains the following configuration fields:
 s3:
   credentialSecretName: s3-creds
   credentialSecretNamespace: default
-  bucketName: rajashree-backup-test
-  folder: ecm1
+  bucketName: rancher-backups
+  folder: rancher
   region: us-west-2
   endpoint: s3.us-west-2.amazonaws.com
 ```
diff --git a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
index ba007bc362c..91e17a171da 100644
--- a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
@@ -4,7 +4,9 @@ shortTitle: Restore
 weight: 2
 ---
 
-The Restore custom resource accepts the following fields:
+The Restore Create page lets you provide details of the backup to restore from
+
+{{< img "/img/rancher/backup_restore/restore/restore.png" "">}}
 
 - [Backup Source](#backup-source)
 	- [Getting the Backup Filename from S3](#getting-the-backup-filename-from-s3)
@@ -16,17 +18,28 @@ The Restore custom resource accepts the following fields:
 ### Backup Source
 Provide details of the backup file and its storage location, which the operator will then use to perform the restore. Select from the following options to provide these details
 
+
+{{< img "/img/rancher/backup_restore/restore/existing.png" "">}}
+
 * **An existing backup config**: Selecting this option will populate the **Target Backup** dropdown with the Backups available in this cluster. Select the Backup from the dropdown, and that will fill out the **Backup Filename** field for you, and will also pass the backup source information from the selected Backup to the operator.
 
+
 If the Backup custom resource does not exist in the cluster, you need to get the exact filename and provide the backup source details with either of the following options:
 
-* **The default storage target**: Select this option if you are restoring from a backup file that exists in the default storage location configured at the operator-level. The operator-level configuration is the storage location that was configured when the `rancher-backup` operator was installed or upgraded. Provide the exact filename in the **Backup Filename** field. 
+{{< img "/img/rancher/backup_restore/restore/default.png" "">}}
+
+* **The default storage target**: Select this option if you are restoring from a backup file that exists in the default storage location configured at the operator-level. The operator-level configuration is the storage location that was configured when the `rancher-backup` operator was installed or upgraded. Provide the exact filename in the **Backup Filename** field.
+
+{{< img "/img/rancher/backup_restore/restore/s3store.png" "">}} 
+
 * **An S3-compatible object store**: Select this option if no default storage location is configured at the operator-level, OR if the backup file exists in a different S3 bucket than the one configured as the default storage location. Provide the exact filename in the **Backup Filename** field. Refer [this section](#getting-the-backup-filename-from-s3) for exact steps on getting the backup filename from s3. Fill in all the details for the S3 compatible object store. Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../configuration/backup-config/#storagelocation)
 
 ### Encryption
 
 If the backup was created with encryption enabled, its file will have `.enc` suffix. Choosing such a Backup, or providing a backup filename with `.enc` suffix will display another dropdown named **Encryption Config Secret**.
 
+{{< img "/img/rancher/backup_restore/restore/encryption.png" "">}} 
+
 The Secret selected from this dropdown must have the same contents as the one used for the Backup custom resource while performing the backup. If the encryption configuration doesn't match, the restore will fail
 
 The `Encryption Config Secret` dropdown will filter out and list only those Secrets that have this exact key
diff --git a/content/rancher/v2.x/en/backups/examples/_index.md b/content/rancher/v2.x/en/backups/examples/_index.md
index c6fff372088..b73e0405afd 100644
--- a/content/rancher/v2.x/en/backups/examples/_index.md
+++ b/content/rancher/v2.x/en/backups/examples/_index.md
@@ -37,10 +37,10 @@ This section contains example Backup custom resources.
 apiVersion: resources.cattle.io/v1
 kind: Backup
 metadata:
-  name: test-s3-def-backup
+  name: default-location-encrypted-backup
 spec:
   resourceSetName: rancher-resource-set
-  encryptionConfigSecretName: test-encryptionconfig
+  encryptionConfigSecretName: encryptionconfig
 ```
 
 ### Recurring Backup in the Default Location
@@ -49,11 +49,11 @@ spec:
 apiVersion: resources.cattle.io/v1
 kind: Backup
 metadata:
-  name: test-default-location-recurring-backup
+  name: default-location-recurring-backup
 spec:
   resourceSetName: rancher-resource-set
-  schedule: "@every 2m"
-  retentionCount: 3
+  schedule: "@every 1h"
+  retentionCount: 10
 ```
 
 ### Encrypted Recurring Backup in the Default Location
@@ -62,11 +62,11 @@ spec:
 apiVersion: resources.cattle.io/v1
 kind: Backup
 metadata:
-  name: test-s3-recurring-backup
+  name: default-enc-recurring-backup
 spec:
-  resourceSetName: ecm-resource-set
-  encryptionConfigSecretName: test-encryptionconfig
-  schedule: "@every 1m"
+  resourceSetName: rancher-resource-set
+  encryptionConfigSecretName: encryptionconfig
+  schedule: "@every 1h"
   retentionCount: 3
 ```
 
@@ -76,7 +76,7 @@ spec:
 apiVersion: resources.cattle.io/v1
 kind: Backup
 metadata:
-  name: minio-backup-demo
+  name: minio-backup
 spec:
   storageLocation:
     s3:
@@ -86,7 +86,7 @@ spec:
       endpoint: minio.xip.io
       endpointCA: LS0tLS1CRUdJTi3VUFNQkl5UUT.....pbEpWaVzNkRS0tLS0t
   resourceSetName: rancher-resource-set
-  encryptionConfigSecretName: test-encryptionconfig
+  encryptionConfigSecretName: encryptionconfig
 ```
 
 ### Backup in S3 Using AWS Credential Secret
@@ -95,18 +95,18 @@ spec:
 apiVersion: resources.cattle.io/v1
 kind: Backup
 metadata:
-  name: s3-backup-demo
+  name: s3-backup
 spec:
   storageLocation:
     s3:
       credentialSecretName: s3-creds
       credentialSecretNamespace: default
-      bucketName: rajashree-backup-test
+      bucketName: rancher-backups
       folder: ecm1
       region: us-west-2
       endpoint: s3.us-west-2.amazonaws.com
   resourceSetName: rancher-resource-set
-  encryptionConfigSecretName: test-encryptionconfig
+  encryptionConfigSecretName: encryptionconfig
 ```
 
 ### Recurring Backup in S3 Using AWS Credential Secret
@@ -115,20 +115,20 @@ spec:
 apiVersion: resources.cattle.io/v1
 kind: Backup
 metadata:
-  name: test-s3-recurring-backup
+  name: s3-recurring-backup
 spec:
   storageLocation:
     s3:
       credentialSecretName: s3-creds
       credentialSecretNamespace: default
-      bucketName: rajashree-backup-test
+      bucketName: rancher-backups
       folder: ecm1
       region: us-west-2
       endpoint: s3.us-west-2.amazonaws.com
   resourceSetName: rancher-resource-set
-  encryptionConfigSecretName: test-encryptionconfig
-  schedule: "@every 2m"
-  retentionCount: 3
+  encryptionConfigSecretName: encryptionconfig
+  schedule: "@every 1h"
+  retentionCount: 10
 ```
 
 ### Backup from EC2 Nodes with IAM Permission to Access S3
@@ -139,16 +139,16 @@ This example shows that the AWS credential secret does not have to be provided t
 apiVersion: resources.cattle.io/v1
 kind: Backup
 metadata:
-  name: s3-backup-demo
+  name: s3-iam-backup
 spec:
   storageLocation:
     s3:
-      bucketName: rajashree-backup-test
+      bucketName: rancher-backups
       folder: ecm1
       region: us-west-2
       endpoint: s3.us-west-2.amazonaws.com
   resourceSetName: rancher-resource-set
-  encryptionConfigSecretName: test-encryptionconfig
+  encryptionConfigSecretName: encryptionconfig
 ```
 
 # Restore
@@ -161,9 +161,9 @@ This section contains example Restore custom resources.
 apiVersion: resources.cattle.io/v1
 kind: Restore
 metadata:
-  name: restore-pvc-demo
+  name: restore-default
 spec:
-  backupFilename: test-default-location-recurring-backup-752ecd87-d958-4d20-8350-072f8d090045-2020-09-26T12-29-54-07-00.tar.gz
+  backupFilename: default-location-recurring-backup-752ecd87-d958-4d20-8350-072f8d090045-2020-09-26T12-29-54-07-00.tar.gz
 #  encryptionConfigSecretName: test-encryptionconfig
 ```
 
@@ -174,13 +174,13 @@ kind: Restore
 metadata:
   name: restore-migration
 spec:
-  backupFilename: b-eks-2-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07#27#09Z.tar.gz
+  backupFilename: backup-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07-27-09Z.tar.gz
   prune: false
   storageLocation:
     s3:
       credentialSecretName: s3-creds
       credentialSecretNamespace: default
-      bucketName: rajashree-backup-test
+      bucketName: rancher-backups
       folder: ecm1
       region: us-west-2
       endpoint: s3.us-west-2.amazonaws.com
@@ -192,10 +192,10 @@ spec:
 apiVersion: resources.cattle.io/v1
 kind: Restore
 metadata:
-  name: restore-s3-demo
+  name: restore-encrypted
 spec:
-  backupFilename: default-test-s3-def-backup-c583d8f2-6daf-4648-8ead-ed826c591471-2020-08-24T20#47#05Z.tar.gz
-  encryptionConfigSecretName: test-encryptionconfig
+  backupFilename: default-test-s3-def-backup-c583d8f2-6daf-4648-8ead-ed826c591471-2020-08-24T20-47-05Z.tar.gz
+  encryptionConfigSecretName: encryptionconfig
 ```
 
 ### Restore an Encrypted Backup from Minio
@@ -206,7 +206,7 @@ kind: Restore
 metadata:
   name: restore-minio
 spec:
-  backupFilename: default-minio-backup-demo-aa5c04b7-4dba-4c48-9ac4-ab7916812eaa-2020-08-30T13#18#17-07#00.tar.gz
+  backupFilename: default-minio-backup-demo-aa5c04b7-4dba-4c48-9ac4-ab7916812eaa-2020-08-30T13-18-17-07-00.tar.gz
   storageLocation:
     s3:
       credentialSecretName: minio-creds
@@ -230,7 +230,7 @@ spec:
     s3:
       credentialSecretName: s3-creds
       credentialSecretNamespace: default
-      bucketName: rajashree-backup-test
+      bucketName: rancher-backups
       folder: ecm1
       region: us-west-2
       endpoint: s3.us-west-2.amazonaws.com
diff --git a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
index 191521059af..75534c6e914 100644
--- a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
@@ -8,6 +8,8 @@ If you are migrating Rancher to a new Kubernetes cluster, you don't need to inst
 ### Prerequisites
 
 These instructions assume you have [created a backup](../back-up-rancher) and you have already installed a new Kubernetes cluster where Rancher will be deployed.
+It is necessary to use the same hostname that was set as the server URL in the first cluster.
+Rancher version must be v2.5.0 and up
 
 Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes clusters such as Amazon EKS clusters. For help installing Kubernetes, refer to the documentation of the Kubernetes distribution. One of Rancher's Kubernetes distributions may also be used:
 
@@ -35,8 +37,9 @@ kind: Restore
 metadata:
   name: restore-migration
 spec:
-  backupFilename: b-eks-2-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07#27#09Z.tar.gz
+  backupFilename: backup-b0450532-cee1-4aa1-a881-f5f48a007b1c-2020-09-15T07-27-09Z.tar.gz
   prune: false
+  encryptionConfigSecretName: encryptionconfig
   storageLocation:
     s3:
       credentialSecretName: s3-creds
@@ -47,6 +50,15 @@ spec:
       endpoint: s3.us-west-2.amazonaws.com
 ```
 
+> **Important:** The field `encryptionConfigSecretName` must be set only if your backup was created with encryption enabled. Provide the name of the Secret containing the encryption config file. If you only have the encryption config file, but don't have a secret created with it in this cluster, use the following steps to create the secret:  
+1. The encryption configuration file must be named `encryption-provider-config.yaml`, and the `--from-file` flag must be used to create this secret. So save your `EncryptionConfiguration` in a file called `encryption-provider-config.yaml` and run this command:
+
+```
+kubectl create secret generic encryptionconfig \
+  --from-file=./encryption-provider-config.yaml \
+  -n cattle-resources-system
+```
+
 Then apply the resource:
 
 ```
@@ -59,10 +71,10 @@ Follow the steps to [install cert-manager]({{<baseurl>}}/rancher/v2.x/en/install
 
 ### 4. Bring up Rancher with Helm
 
+Use the same version of Helm to install Rancher, that was used on the first cluster.
+
 ```
-helm upgrade rancher rancher-alpha/rancher \
-  --version 2.5.0-alpha1 \
+helm install rancher rancher-latest/rancher \
   --namespace cattle-system \
   --set hostname=<same hostname as first Rancher server> \
-  --set rancherImageTag=master-head
 ```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
index 05a83055676..6c050fbedd9 100644
--- a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
@@ -38,7 +38,13 @@ A restore is performed by creating a Restore custom resource.
 
 1. Click **Create.**
 
-**Result:** The rancher-operator scales down the rancher deployment during restore. Once the restore completes, the operator scales back up the rancher deployment. So rancher will be unavailable for the duration of restore. To check how the restore is progressing, you can check the logs of the operator. Follow these steps to get the logs:
+**Result:** The rancher-operator scales down the rancher deployment during restore, and scales it back up once the restore completes. The resources are restored in this order:
+
+1. Custom Resource Definitions (CRDs)
+2. Cluster-scoped resources
+3. Namespaced resources
+
+To check how the restore is progressing, you can check the logs of the operator. Follow these steps to get the logs:
 
 ```yaml
 kubectl get pods -n cattle-resources-system

From 212f280468454066d5050309638d3f29aa9d4f93 Mon Sep 17 00:00:00 2001
From: rajashree <rajashree.28m@gmail.com>
Date: Sat, 3 Oct 2020 23:42:31 -0700
Subject: [PATCH 236/265] storage config changes

---
 content/rancher/v2.x/en/backups/_index.md     | 17 ++++++---
 .../configuration/storage-config/_index.md    | 37 +++++++------------
 .../en/backups/migrating-rancher/_index.md    | 27 +++++++++++---
 3 files changed, 46 insertions(+), 35 deletions(-)

diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index 8fe30be800e..8fe62c090d0 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -3,7 +3,9 @@ title: Backups and Disaster Recovery
 weight: 5
 ---
 
-In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new server.
+In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new server. 
+
+Rancher version must be v2.5.0 and up to use this approach of backing up and restoring Rancher.
 
 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
 - [Backup and Restore for Rancher Prior to v2.5](#backup-and-restore-for-rancher-prior-to-v2-5)
@@ -27,13 +29,16 @@ In Rancher v2.4, it was only supported to install Rancher on two types of Kubern
 
 In Rancher v2.5, it is now supported to install Rancher hosted Kubernetes clusters, such as Amazon EKS clusters, which do not expose etcd to a degree that would allow snapshots to be created by an external tool. etcd doesn't need to be exposed for `rancher-backup` to work, because the operator gathers resources by making calls to `kube-apiserver`.
 
-### Backup and Restore for Rancher Prior to v2.5
+### Backup and Restore for Rancher v2.5 installed with Docker
+
+For Rancher installed with Docker, refer to the same steps used up till 2.5 for [single node backups]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/single-node-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/) documentation.
+
+### Backup and Restore for Rancher installed on Kubernetes cluster Prior to v2.5
 
 For Rancher prior to v2.5, the way that Rancher is backed up and restored differs based on the way that Rancher was installed. Our legacy backup and restore documentation is here:
 
 - For Rancher installed on an RKE Kubernetes cluster, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/) documentation.
 - For Rancher installed on a K3s Kubernetes cluster, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/) documentation.
-- For Rancher installed with Docker, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/single-node-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/) documentation.
 
 ### How Backups and Restores Work
 
@@ -75,10 +80,10 @@ To configure the backup app in Rancher, click **Cluster Explorer** in the upper
 Install the backup app as a Helm chart:
 
 ```
-helm repo add rancherchart https://charts.rancher.io
+helm repo add rancher-charts https://charts.rancher.io
 helm repo update
-helm install rancher-backup-crd rancherchart/rancher-backup-crd -n cattle-resources-system --create-namespace
-helm install rancher-backup rancherchart/rancher-backup -n cattle-resources-system
+helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace
+helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system
 ```
 
 # Backing up Rancher
diff --git a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
index 499f710251a..7650ce3b511 100644
--- a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
@@ -6,16 +6,13 @@ weight: 3
 
 Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible object store.
 
-The storage location is configured at the operator level. Therefore, it must be configured when the `rancher-backup` operator is installed or upgraded.
-
-Only one storage location can be configured for each backup.
+Only one storage location can be configured at the operator level.
 
 - [Storage Location Configuration](#storage-location-configuration)
   - [No Default Storage Location](#no-default-storage-location)
-  - [Use the Default Storage Class (gp2)](#use-the-default-storage-class-gp2)
   - [S3-compatible Object Store](#s3-compatible-object-store)
-  - [Existing StorageClass](#existing-storageclass)
-  - [Existing PersistentVolume](#existing-persistentvolume)
+  - [Use an existing StorageClass](#existing-storageclass)
+  - [Use an existing PersistentVolume](#existing-persistent-volume)
 - [Encryption](#encryption)
 - [Example values.yaml for the rancher-backup Helm Chart](#example-values-yaml-for-the-rancher-backup-helm-chart)
 
@@ -23,11 +20,7 @@ Only one storage location can be configured for each backup.
 
 ### No Default Storage Location
 
-This option is the default.
-
-### Use the Default Storage Class (gp2)
-
-If this option is selected, the cluster's [default StorageClass](https://kubernetes.io/docs/tasks/administer-cluster/change-default-storage-class/) will be used to store the backups.
+You can choose to not have any operator-level storage location configured. If you select this option, you must configure an S3-compatible object store as the storage location for each individual backup.
 
 ### S3-compatible Object Store
 
@@ -42,25 +35,21 @@ If this option is selected, the cluster's [default StorageClass](https://kuberne
 
 ### Existing StorageClass
 
-Configure an existing storage class that will be used to store your backups. For information about creating storage classes in refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/provisioning-new-storage/#1-add-a-storage-class-and-configure-it-to-use-your-storage-provider)
+Installing the `rancher-backup` chart by selecting the StorageClass option will create a Persistent Volume Claim (PVC), and Kubernetes will in turn dynamically provision a Persistent Volume (PV) where all the backups will be saved by default.
 
-If a StorageClass is selected, a new PersistentVolumeClaim will be created on the same host on which the `rancher-backup` operator pod is running. This will in turn create a new PersistentVolume due to dynamic provisioning.
+For information about creating storage classes refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/provisioning-new-storage/#1-add-a-storage-class-and-configure-it-to-use-your-storage-provider)
 
-### Existing PersistentVolume
+> **Important**
+It is highly recommended to use a StorageClass with a reclaim policy of "Retain". Otherwise if the PVC created by the `rancher-backup` chart gets deleted (either during app upgrade, or accidentally), the PV will get deleted too, which means all backups saved in it will get deleted.  
+If no such StorageClass is available, after the PV is provisioned, make sure to edit its reclaim policy and set it to "Retain" before storing backups in it.
 
-Configure an existing PersistentVolume that will be used to store your backups. For information about creating PersistentVolumes in Rancher, refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/#2-add-a-persistent-volume-that-refers-to-the-persistent-storage)
+### Existing Persistent Volume
 
-# Encryption
+Select an existing Persistent Volume (PV) that will be used to store your backups. For information about creating PersistentVolumes in Rancher, refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/volumes-and-storage/attaching-existing-storage/#2-add-a-persistent-volume-that-refers-to-the-persistent-storage)
 
-Resources can be encrypted before they are saved in a backup file.
+> **Important**
+It is highly recommended to use a Persistent Volume with a reclaim policy of "Retain". Otherwise if the PVC created by the `rancher-backup` chart gets deleted (either during app upgrade, or accidentally), the PV will get deleted too, which means all backups saved in it will get deleted.  
 
-The `rancher-backup` operator uses the same process to encrypt the backups as is described in the [official Kubernetes documentation](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/) for encrypting data at rest. Encryption details are provided in an EncryptionConfiguration YAML file.
-
-You can use any EncryptionConfiguration YAML, including one that is already used in your Kubernetes cluster.
-
-In order for `rancher-backup` operator to use the EncryptionConfiguration, the file must be named `encryption-provider-config.yaml`.
-
-> **Important:** The `rancher-backup` operator doesn't save the EncryptionConfiguration file. The contents of the EncryptionConfiguration file must be saved when a backup is created, and the same file must be used when restoring from this backup.
 
 # Example values.yaml for the rancher-backup Helm Chart
 
diff --git a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
index 75534c6e914..65f3437585b 100644
--- a/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/migrating-rancher/_index.md
@@ -8,7 +8,9 @@ If you are migrating Rancher to a new Kubernetes cluster, you don't need to inst
 ### Prerequisites
 
 These instructions assume you have [created a backup](../back-up-rancher) and you have already installed a new Kubernetes cluster where Rancher will be deployed.
-It is necessary to use the same hostname that was set as the server URL in the first cluster.
+
+It is required to use the same hostname that was set as the server URL in the first cluster.
+
 Rancher version must be v2.5.0 and up
 
 Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes clusters such as Amazon EKS clusters. For help installing Kubernetes, refer to the documentation of the Kubernetes distribution. One of Rancher's Kubernetes distributions may also be used:
@@ -18,14 +20,29 @@ Rancher can be installed on any Kubernetes cluster, including hosted Kubernetes
 
 ### 1. Install the rancher-backup Helm chart
 ```
-helm repo add rancherchart https://charts.rancher.io
+helm repo add rancher-charts https://charts.rancher.io
 helm repo update
-helm install rancher-backup-crd rancherchart/rancher-backup-crd -n cattle-resources-system --create-namespace
-helm install rancher-backup rancherchart/rancher-backup -n cattle-resources-system
+helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-resources-system --create-namespace
+helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system
 ```
 
 ### 2. Restore from backup using a Restore custom resource
 
+If you are using an S3 store as the backup source, and need to use your S3 credentials for restore, create a secret in this cluster using your S3 credentials. The Secret data must have two keys, `accessKey` and `secretKey` containing the s3 credentials like this:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-creds
+type: Opaque
+data:
+  accessKey: <Enter your access key>
+  secretKey: <Enter your secret key>
+```
+
+This secret can be created in any namespace, with the above example it will get created in the default namespace
+
 In the Restore custom resource, `prune` must be set to false. 
 
 Create a Restore custom resource like the example below:
@@ -76,5 +93,5 @@ Use the same version of Helm to install Rancher, that was used on the first clus
 ```
 helm install rancher rancher-latest/rancher \
   --namespace cattle-system \
-  --set hostname=<same hostname as first Rancher server> \
+  --set hostname=<same hostname as the server URL from the first Rancher server> \
 ```
\ No newline at end of file

From 2ecb26a535a7ff1871f817d6226ca3822530fb1c Mon Sep 17 00:00:00 2001
From: rajashree <rajashree.28m@gmail.com>
Date: Sun, 4 Oct 2020 23:21:53 -0700
Subject: [PATCH 237/265] Move RBAC section to the main backups page

---
 content/rancher/v2.x/en/backups/_index.md              | 10 +++++++++-
 .../rancher/v2.x/en/backups/back-up-rancher/_index.md  |  9 ---------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index 8fe62c090d0..5399851e1f9 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -60,7 +60,7 @@ The Backup and Restore custom resources can be created in the Rancher UI, or by
 
 # Installing the rancher-backup Operator
 
-The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server.
+The `rancher-backup` operator can be installed from the Rancher UI, or with the Helm CLI. In both cases, the `rancher-backup` Helm chart is installed on the Kubernetes cluster running the Rancher server. It is a cluster-admin only feature and available only for the local cluster.
 
 ### Installing rancher-backup with the Rancher UI
 
@@ -86,6 +86,14 @@ helm install rancher-backup-crd rancher-charts/rancher-backup-crd -n cattle-reso
 helm install rancher-backup rancher-charts/rancher-backup -n cattle-resources-system
 ```
 
+### RBAC
+
+Only the rancher admins, and local cluster’s cluster-owner can:
+
+* Install the Chart
+* See the navigation links for Backup and Restore CRDs
+* Perform a backup or restore by creating a Backup CR and Restore CR respectively, list backups/restores performed so far
+
 # Backing up Rancher
 
 A backup is performed by creating a Backup custom resource. For a tutorial, refer to [this page.](./back-up-rancher)
diff --git a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
index f1097411891..0c9e6e5a119 100644
--- a/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/back-up-rancher/_index.md
@@ -59,12 +59,3 @@ To perform a backup, a custom resource of type Backup must be created.
 
 **Result:** The backup file is created in the storage location configured in the Backup custom resource. The name of this file is used when performing a restore.
 
-
-### RBAC/Permissions
-
-Rancher Backup & Restore is a cluster-admin only feature and available only for the local cluster.
-Which means only the rancher admins, and local cluster’s cluster-owner can:
-
-* Install the Chart
-* See the navigation links for Backup and Restore CRDs
-* Perform a backup or restore by creating a Backup CR and Restore CR respectively, list backups/restores performed so far
\ No newline at end of file

From f0cdb3615241dab8ed8a94cb7f9be4c6c7a66cf9 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 10:09:21 -0700
Subject: [PATCH 238/265] Update backup and restore docs

---
 content/rancher/v2.x/en/backups/_index.md     | 17 +++++-----
 .../configuration/backup-config/_index.md     |  7 ++--
 .../configuration/restore-config/_index.md    | 33 ++++++++++++-------
 .../configuration/storage-config/_index.md    |  1 +
 .../v2.x/en/backups/docker-installs/_index.md | 10 ++++++
 .../docker-backups}/_index.md                 |  1 +
 .../docker-restores}/_index.md                |  4 +--
 .../rancher/v2.x/en/backups/legacy/_index.md  |  6 ++--
 .../v2.x/en/backups/legacy/backup/_index.md   |  2 +-
 .../{k8s-backups => }/ha-backups/_index.md    |  0
 .../{k8s-backups => }/k3s-backups/_index.md   |  0
 .../legacy/backup/k8s-backups/_index.md       |  8 -----
 .../v2.x/en/backups/legacy/restore/_index.md  |  2 +-
 .../{k8s-restore => }/k3s-restore/_index.md   |  0
 .../legacy/restore/k8s-restore/_index.md      |  6 ----
 .../{k8s-restore => }/rke-restore/_index.md   |  0
 .../en/backups/restoring-rancher/_index.md    |  2 +-
 17 files changed, 53 insertions(+), 46 deletions(-)
 create mode 100644 content/rancher/v2.x/en/backups/docker-installs/_index.md
 rename content/rancher/v2.x/en/backups/{legacy/backup/single-node-backups => docker-installs/docker-backups}/_index.md (99%)
 rename content/rancher/v2.x/en/backups/{legacy/restore/single-node-restoration => docker-installs/docker-restores}/_index.md (92%)
 rename content/rancher/v2.x/en/backups/legacy/backup/{k8s-backups => }/ha-backups/_index.md (100%)
 rename content/rancher/v2.x/en/backups/legacy/backup/{k8s-backups => }/k3s-backups/_index.md (100%)
 delete mode 100644 content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/_index.md
 rename content/rancher/v2.x/en/backups/legacy/restore/{k8s-restore => }/k3s-restore/_index.md (100%)
 delete mode 100644 content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md
 rename content/rancher/v2.x/en/backups/legacy/restore/{k8s-restore => }/rke-restore/_index.md (100%)

diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index 5399851e1f9..9ecad4552e6 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -3,12 +3,13 @@ title: Backups and Disaster Recovery
 weight: 5
 ---
 
-In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new server. 
+In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new Kubernetes cluster. 
 
-Rancher version must be v2.5.0 and up to use this approach of backing up and restoring Rancher.
+The Rancher version must be v2.5.0 and up to use this approach of backing up and restoring Rancher. As of Rancher v2.5, the `rancher-backup` operator is used to backup and restore Rancher. The Helm chart is [here.](https://github.com/rancher/charts/tree/main/charts/rancher-backup)
 
 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
-- [Backup and Restore for Rancher Prior to v2.5](#backup-and-restore-for-rancher-prior-to-v2-5)
+  - [Backup and Restore for Rancher v2.5 installed with Docker](#backup-and-restore-for-rancher-v2-5-installed-with-docker)
+  - [Backup and Restore for Rancher installed on a Kubernetes Cluster Prior to v2.5](#backup-and-restore-for-rancher-installed-on-a-kubernetes-cluster-prior-to-v2-5)
 - [How Backups and Restores Work](#how-backups-and-restores-work)
 - [Installing the rancher-backup Operator](#installing-the-rancher-backup-operator)
   - [Installing rancher-backup with the Rancher UI](#installing-rancher-backup-with-the-rancher-ui)
@@ -19,7 +20,7 @@ Rancher version must be v2.5.0 and up to use this approach of backing up and res
 - [Default Storage Location Configuration](#default-storage-location-configuration)
   - [Example values.yaml for the rancher-backup Helm Chart](#example-values-yaml-for-the-rancher-backup-helm-chart)
 
-### Changes in Rancher v2.5
+# Changes in Rancher v2.5
 
 The new `rancher-backup` operator allows Rancher to be backed up and restored on any Kubernetes cluster. This application is a Helm chart, and it can be deployed through the Rancher **Apps & Marketplace** page, or by using the Helm CLI.
 
@@ -31,16 +32,16 @@ In Rancher v2.5, it is now supported to install Rancher hosted Kubernetes cluste
 
 ### Backup and Restore for Rancher v2.5 installed with Docker
 
-For Rancher installed with Docker, refer to the same steps used up till 2.5 for [single node backups]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/single-node-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/) documentation.
+For Rancher installed with Docker, refer to the same steps used up till 2.5 for [backups](./docker-installs/docker-backups) and [restores.](./docker-installs/docker-backups)
 
-### Backup and Restore for Rancher installed on Kubernetes cluster Prior to v2.5
+### Backup and Restore for Rancher installed on a Kubernetes Cluster Prior to v2.5
 
 For Rancher prior to v2.5, the way that Rancher is backed up and restored differs based on the way that Rancher was installed. Our legacy backup and restore documentation is here:
 
 - For Rancher installed on an RKE Kubernetes cluster, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/) documentation.
 - For Rancher installed on a K3s Kubernetes cluster, refer to the legacy [backup]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/) and [restore]({{<baseurl>}}/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/) documentation.
 
-### How Backups and Restores Work
+# How Backups and Restores Work
 
 The `rancher-backup` operator introduces three custom resources: Backups, Restores, and ResourceSets. The following cluster-scoped custom resource definitions are added to the cluster:
 
@@ -48,7 +49,7 @@ The `rancher-backup` operator introduces three custom resources: Backups, Restor
 - `resourcesets.resources.cattle.io`
 - `restores.resources.cattle.io`
 
-The ResourceSet defines which Kubernetes resources need to be backed up. The ResourceSet is not available to be configured in the Rancher UI because the values required to back up Rancher are predefined.
+The ResourceSet defines which Kubernetes resources need to be backed up. The ResourceSet is not available to be configured in the Rancher UI because the values required to back up Rancher are predefined. This ResourceSet should not be modified.
 
 When a Backup custom resource is created, the `rancher-backup` operator calls the `kube-apiserver` to get the resources in the ResourceSet (specifically, the predefined `rancher-resource-set`) that the Backup custom resource refers to.
 
diff --git a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
index ee44cb76a1d..adbb9e065f1 100644
--- a/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/backup-config/_index.md
@@ -24,11 +24,10 @@ The Backup Create page lets you configure a schedule, enable encryption and spec
 
 Select the first option to perform a one-time backup, or select the second option to schedule recurring backups. Selecting **Recurring Backups** lets you configure following two fields:
 
-1. **Schedule**: This field accepts
+- **Schedule**: This field accepts
   - Standard [cron expressions](https://en.wikipedia.org/wiki/Cron), such as `"0 * * * *"`
   - Descriptors, such as `"@midnight"` or `"@every 1h30m"`
-
-1. **Retention Count**: This value specifies how many backup files must be retained. If files exceed the given retentionCount,  the oldest files will be deleted. The default value is 10.
+-  **Retention Count**: This value specifies how many backup files must be retained. If files exceed the given retentionCount,  the oldest files will be deleted. The default value is 10.
 
 {{< img "/img/rancher/backup_restore/backup/schedule.png" "">}}
 
@@ -77,6 +76,8 @@ In the example command above, the name `encryptionconfig` can be changed to anyt
 
 {{< img "/img/rancher/backup_restore/backup/storageLocation.png" "">}}
 
+If the StorageLocation is specified in the Backup, the operator will retrieve the backup location from that particular S3 bucket. If not specified, the operator will try to find this file in the default operator-level S3 store, and in the operator-level PVC store. The default storage location is configured during the deployment of the `rancher-backup` operator.
+
 Selecting the first option stores this backup in the storage location configured while installing the rancher-backup chart. The second option lets you configure a different S3 compatible storage provider for storing the backup.
 
 ### S3
diff --git a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
index 91e17a171da..fbd9b1368c2 100644
--- a/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/restore-config/_index.md
@@ -9,32 +9,41 @@ The Restore Create page lets you provide details of the backup to restore from
 {{< img "/img/rancher/backup_restore/restore/restore.png" "">}}
 
 - [Backup Source](#backup-source)
-	- [Getting the Backup Filename from S3](#getting-the-backup-filename-from-s3)
+	- [An Existing Backup Config](#an-existing-backup-config)
+	- [The default storage target](#the-default-storage-target)
+	- [An S3-compatible object store](#an-s3-compatible-object-store)
 - [Encryption](#encryption)
-- [StorageLocation](#storagelocation)
 - [Prune during restore](#prune-during-restore)
+- [Getting the Backup Filename from S3](#getting-the-backup-filename-from-s3)
 
-
-### Backup Source
+# Backup Source
 Provide details of the backup file and its storage location, which the operator will then use to perform the restore. Select from the following options to provide these details
 
 
+
+
+### An existing backup config
+
+Selecting this option will populate the **Target Backup** dropdown with the Backups available in this cluster. Select the Backup from the dropdown, and that will fill out the **Backup Filename** field for you, and will also pass the backup source information from the selected Backup to the operator.
+
 {{< img "/img/rancher/backup_restore/restore/existing.png" "">}}
 
-* **An existing backup config**: Selecting this option will populate the **Target Backup** dropdown with the Backups available in this cluster. Select the Backup from the dropdown, and that will fill out the **Backup Filename** field for you, and will also pass the backup source information from the selected Backup to the operator.
+If the Backup custom resource does not exist in the cluster, you need to get the exact filename and provide the backup source details with the default storage target or an S3-compatible object store.
 
 
-If the Backup custom resource does not exist in the cluster, you need to get the exact filename and provide the backup source details with either of the following options:
+### The default storage target
+
+Select this option if you are restoring from a backup file that exists in the default storage location configured at the operator-level. The operator-level configuration is the storage location that was configured when the `rancher-backup` operator was installed or upgraded. Provide the exact filename in the **Backup Filename** field.
 
 {{< img "/img/rancher/backup_restore/restore/default.png" "">}}
 
-* **The default storage target**: Select this option if you are restoring from a backup file that exists in the default storage location configured at the operator-level. The operator-level configuration is the storage location that was configured when the `rancher-backup` operator was installed or upgraded. Provide the exact filename in the **Backup Filename** field.
+### An S3-compatible object store
+
+Select this option if no default storage location is configured at the operator-level, OR if the backup file exists in a different S3 bucket than the one configured as the default storage location. Provide the exact filename in the **Backup Filename** field. Refer to [this section](#getting-the-backup-filename-from-s3) for exact steps on getting the backup filename from s3. Fill in all the details for the S3 compatible object store. Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../configuration/backup-config/#storagelocation)
 
 {{< img "/img/rancher/backup_restore/restore/s3store.png" "">}} 
 
-* **An S3-compatible object store**: Select this option if no default storage location is configured at the operator-level, OR if the backup file exists in a different S3 bucket than the one configured as the default storage location. Provide the exact filename in the **Backup Filename** field. Refer [this section](#getting-the-backup-filename-from-s3) for exact steps on getting the backup filename from s3. Fill in all the details for the S3 compatible object store. Its fields are exactly same as ones for the `backup.StorageLocation` configuration in the [Backup custom resource.](../../configuration/backup-config/#storagelocation)
-
-### Encryption
+# Encryption
 
 If the backup was created with encryption enabled, its file will have `.enc` suffix. Choosing such a Backup, or providing a backup filename with `.enc` suffix will display another dropdown named **Encryption Config Secret**.
 
@@ -51,7 +60,7 @@ The `Encryption Config Secret` dropdown will filter out and list only those Secr
 > **Important**
 This field should only be set if the backup was created with encryption enabled. Providing the incorrect encryption config will cause the restore to fail.
 
-### Prune during restore
+# Prune During Restore
 
 * **Prune**:  In order to fully restore Rancher from a backup, and to go back to the exact state it was at when the backup was performed, we need to delete any additional resources that were created by Rancher after the backup was taken. The operator does so if the **Prune** flag is enabled. Prune is enabled by default and it is recommended to keep it enabled.
 * **Delete Timeout**: This is the amount of time the operator will wait while deleting a resource before editing the resource to remove finalizers and attempt deletion again.
@@ -61,7 +70,7 @@ This field should only be set if the backup was created with encryption enabled.
 | `prune` |  Delete the resources managed by Rancher that are not present in the backup (Recommended).  |
 | `deleteTimeoutSeconds` |  Amount of time the operator will wait while deleting a resource before editing the resource to remove finalizers and attempt deletion again.  |
 
-### Getting the Backup Filename from S3
+# Getting the Backup Filename from S3
 
 This is the name of the backup file that the `rancher-backup` operator will use to perform the restore.
 
diff --git a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
index 7650ce3b511..1ebb4259b85 100644
--- a/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
+++ b/content/rancher/v2.x/en/backups/configuration/storage-config/_index.md
@@ -32,6 +32,7 @@ You can choose to not have any operator-level storage location configured. If yo
 | Folder | The [folder in the S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/using-folders.html) where the backups will be stored. |
 | Endpoint | The [S3 endpoint](https://docs.aws.amazon.com/general/latest/gr/s3.html) For example, `s3.us-west-2.amazonaws.com`. |
 | Endpoint CA | The CA cert used to for the S3 endpoint. Default: base64 encoded CA cert |
+| insecureTLSSkipVerify | Set to true if you are not using TLS. |
 
 ### Existing StorageClass
 
diff --git a/content/rancher/v2.x/en/backups/docker-installs/_index.md b/content/rancher/v2.x/en/backups/docker-installs/_index.md
new file mode 100644
index 00000000000..3f818e0faf8
--- /dev/null
+++ b/content/rancher/v2.x/en/backups/docker-installs/_index.md
@@ -0,0 +1,10 @@
+---
+title: Backup and Restore for Rancher Installed with Docker
+shortTitle: Docker Installs
+weight: 10
+---
+
+The steps for backing up and restoring Rancher installed with Docker did not change in Rancher v2.5.
+
+- [Backups](./docker-backups)
+- [Restores](./docker-restores)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/legacy/backup/single-node-backups/_index.md b/content/rancher/v2.x/en/backups/docker-installs/docker-backups/_index.md
similarity index 99%
rename from content/rancher/v2.x/en/backups/legacy/backup/single-node-backups/_index.md
rename to content/rancher/v2.x/en/backups/docker-installs/docker-backups/_index.md
index d8ff02e977c..d06c933dda6 100644
--- a/content/rancher/v2.x/en/backups/legacy/backup/single-node-backups/_index.md
+++ b/content/rancher/v2.x/en/backups/docker-installs/docker-backups/_index.md
@@ -7,6 +7,7 @@ aliases:
   - /rancher/v2.x/en/installation/after-installation/single-node-backup-and-restoration/
 ---
 
+
 After completing your Docker installation of Rancher, we recommend creating backups of it on a regular basis. Having a recent backup will let you recover quickly from an unexpected disaster.
 
 ## Before You Start
diff --git a/content/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/_index.md b/content/rancher/v2.x/en/backups/docker-installs/docker-restores/_index.md
similarity index 92%
rename from content/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/_index.md
rename to content/rancher/v2.x/en/backups/docker-installs/docker-restores/_index.md
index ce66594f4fa..6f79b790e63 100644
--- a/content/rancher/v2.x/en/backups/legacy/restore/single-node-restoration/_index.md
+++ b/content/rancher/v2.x/en/backups/docker-installs/docker-restores/_index.md
@@ -11,7 +11,7 @@ If you encounter a disaster scenario, you can restore your Rancher Server to you
 
 ## Before You Start
 
-During restoration of your backup, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`). Here's an example of a command with a placeholder:
+During restore of your backup, you'll enter a series of commands, filling placeholders with data from your environment. These placeholders are denoted with angled brackets and all capital letters (`<EXAMPLE>`). Here's an example of a command with a placeholder:
 
 ```
 docker run  --volumes-from <RANCHER_CONTAINER_NAME> -v $PWD:/backup \
@@ -69,4 +69,4 @@ Using a [backup]({{<baseurl>}}/rancher/v2.x/en/backups/backups/single-node-backu
     docker start <RANCHER_CONTAINER_NAME>
     ```
 
-1.  Wait a few moments and then open Rancher in a web browser. Confirm that the restoration succeeded and that your data is restored.
+1.  Wait a few moments and then open Rancher in a web browser. Confirm that the restore succeeded and that your data is restored.
diff --git a/content/rancher/v2.x/en/backups/legacy/_index.md b/content/rancher/v2.x/en/backups/legacy/_index.md
index 3b35e376401..5033e89d4db 100644
--- a/content/rancher/v2.x/en/backups/legacy/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/_index.md
@@ -3,9 +3,6 @@ title: Legacy Backup and Restore Documentation
 weight: 6
 ---
 
-> This section is under construction.
-
-
 This section is devoted to protecting your data in a disaster scenario.
 
 To protect yourself from a disaster scenario, you should create backups on a regular basis.
@@ -13,10 +10,11 @@ To protect yourself from a disaster scenario, you should create backups on a reg
   - Rancher server backups:
     - [Rancher installed on a K3s Kubernetes cluster](./backups/k3s-backups)
     - [Rancher installed on an RKE Kubernetes cluster](./backups/ha-backups)
-    - [Rancher installed with Docker](./backups/single-node-backups/)
   - [Backing up Rancher Launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/)
 
 In a disaster scenario, you can restore your `etcd` database by restoring a backup.
 
    - [Rancher Server Restorations]({{<baseurl>}}/rancher/v2.x/en/backups/restorations)
    - [Restoring Rancher Launched Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/)
+
+For Rancher installed with Docker, the backup and restore procedure is the same in Rancher v2.5. The backup and restore instructions for Docker installs are [here.]({{<baseurl>}}/rancher/v2.x/en/backups/docker-installs)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/legacy/backup/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/_index.md
index 1a776f62c29..2bad5e462b6 100644
--- a/content/rancher/v2.x/en/backups/legacy/backup/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/backup/_index.md
@@ -10,6 +10,6 @@ This section contains information about how to create backups of your Rancher da
 
 - [Backing up Rancher installed on a K3s Kubernetes cluster](./k3s-backups)
 - [Backing up Rancher installed on an RKE Kubernetes cluster](./ha-backups/)
-- [Backing up Rancher installed with Docker](./single-node-backups/)
+- [Backing up Rancher installed with Docker]({{<baseurl>}}/rancher/v2.x/en/backups/docker-installs/docker-backups)
 
 If you are looking to back up your [Rancher launched Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), please refer [here]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/backing-up-etcd/).
diff --git a/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/ha-backups/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/ha-backups/_index.md
rename to content/rancher/v2.x/en/backups/legacy/backup/ha-backups/_index.md
diff --git a/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/k3s-backups/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/k3s-backups/_index.md
rename to content/rancher/v2.x/en/backups/legacy/backup/k3s-backups/_index.md
diff --git a/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/_index.md b/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/_index.md
deleted file mode 100644
index 0221ac77312..00000000000
--- a/content/rancher/v2.x/en/backups/legacy/backup/k8s-backups/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Kubernetes Backups
-weight: 1
-aliases:
-  - /rancher/v2.x/en/backups/backups/k8s-backups
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/legacy/restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/_index.md
index d90a64cc4d0..9acfbf7ad73 100644
--- a/content/rancher/v2.x/en/backups/legacy/restore/_index.md
+++ b/content/rancher/v2.x/en/backups/legacy/restore/_index.md
@@ -6,7 +6,7 @@ aliases:
 ---
 If you lose the data on your Rancher Server, you can restore it if you have backups stored in a safe location.
 
-- [Restoring Backups—Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/single-node-restoration/)
+- [Restoring Backups—Docker Installs]({{<baseurl>}}/rancher/v2.x/en/backups/docker-installs/docker-restores)
 - [Restoring Backups—Kubernetes installs]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/ha-restoration/)
 
 If you are looking to restore your [Rancher launched Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/), please refer [here]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/restoring-etcd/).
diff --git a/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/k3s-restore/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/k3s-restore/_index.md
rename to content/rancher/v2.x/en/backups/legacy/restore/k3s-restore/_index.md
diff --git a/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md
deleted file mode 100644
index c0dd69de384..00000000000
--- a/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Kubernetes Installs
-weight: 1
-aliases:
-  - /rancher/v2.x/en/backups/restorations/k8s-restore
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/_index.md b/content/rancher/v2.x/en/backups/legacy/restore/rke-restore/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/backups/legacy/restore/k8s-restore/rke-restore/_index.md
rename to content/rancher/v2.x/en/backups/legacy/restore/rke-restore/_index.md
diff --git a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
index 6c050fbedd9..c7c07b8a9dd 100644
--- a/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
+++ b/content/rancher/v2.x/en/backups/restoring-rancher/_index.md
@@ -9,7 +9,7 @@ A restore is performed by creating a Restore custom resource.
 * Follow the instructions from this page for restoring rancher on the same cluster where it was backed up from. In order to migrate rancher to a new cluster, follow the steps to [migrate rancher.](../migrating-rancher)  
 * While restoring rancher on the same setup, the operator will scale down the rancher deployment when restore starts, and it will scale back up the deployment once restore completes. So Rancher will be unavailable during the restore.
 
-### 1. Create the Restore Custom Resource
+### Create the Restore Custom Resource
 
 1. In the **Cluster Explorer,** go to the dropdown menu in the upper left corner and click **Rancher Backups.**
 1. Click **Restore.**

From df702a93381c9fa1128ecf96923defffa0eb70f3 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 12:17:24 -0700
Subject: [PATCH 239/265] Respond to feedback on CIS scan docs

---
 content/rancher/v2.x/en/cis-scans/_index.md              | 9 ++++++++-
 .../rancher/v2.x/en/cis-scans/configuration/_index.md    | 4 ++++
 .../v2.x/en/cis-scans/legacy/skipped-tests/_index.md     | 3 ++-
 content/rancher/v2.x/en/cis-scans/rbac/_index.md         | 2 ++
 .../rancher/v2.x/en/cis-scans/skipped-tests/_index.md    | 2 ++
 5 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cis-scans/_index.md b/content/rancher/v2.x/en/cis-scans/_index.md
index 3dbc69795c0..dbf6d64b863 100644
--- a/content/rancher/v2.x/en/cis-scans/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/_index.md
@@ -186,6 +186,13 @@ The report contains the following information:
 | `remediation`      | What needs to be fixed in order to pass the test. |
 | `state`    | Indicates if the test passed, failed, was skipped, or was not applicable. |
 | `node_type`        | The node role, which affects which tests are run on the node. Master tests are run on controlplane nodes, etcd tests are run on etcd nodes, and node tests are run on the worker nodes. |
+| `audit` | This is the audit check that `kube-bench` runs for this test. |
+| `audit_config` | Any configuration applicable to the audit script. |
+| `test_info` | Test-related info as reported by `kube-bench`, if any. |
+| `commands` | Test-related commands as reported by `kube-bench`, if any. |
+| `config_commands` | Test-related configuration data as reported by `kube-bench`, if any. |
+| `actual_value` | The test's actual value, present if reported by `kube-bench`. |
+| `expected_result` | The test's expected result, present if reported by `kube-bench`. |
 
 Refer to <a href="{{<baseurl>}}/rancher/v2.x/en/security/" target="_blank">the table in the cluster hardening guide</a> for information on which versions of Kubernetes, the Benchmark, Rancher, and our cluster hardening guide correspond to each other. Also refer to the hardening guide for configuration files of CIS-compliant clusters and information on remediating failed tests.
 
@@ -226,4 +233,4 @@ For information about permissions, refer to <a href="{{<baseurl>}}/rancher/v2.x/
 
 # Configuration
 
-For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to <a href="{{<baseurl>}}/rancher/v2.x/en/cis-scans/configuration" target="_blank">this page.</a>
\ No newline at end of file
+For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to <a href="{{<baseurl>}}/rancher/v2.x/en/cis-scans/configuration" target="_blank">this page.</a>
diff --git a/content/rancher/v2.x/en/cis-scans/configuration/_index.md b/content/rancher/v2.x/en/cis-scans/configuration/_index.md
index e6fda15e071..c2b3629f838 100644
--- a/content/rancher/v2.x/en/cis-scans/configuration/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/configuration/_index.md
@@ -28,6 +28,10 @@ spec:
 
 A profile contains the configuration for the CIS scan, which includes the benchmark version to use and any specific tests to skip in that benchmark.
 
+> By default, a few ClusterScanProfiles are installed as part of the `rancher-cis-benchmark` chart. If a user edits these default benchmarks or profiles, the next chart update will reset them back. So it is advisable for users to not edit the default  ClusterScanProfiles.
+
+Users can clone the ClusterScanProfiles to create custom profiles.
+
 Skipped tests are listed under the `skipTests` directive.
 
 When you create a new profile, you will also need to give it a name.
diff --git a/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md b/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md
index 9505eb42b7c..849e69019f6 100644
--- a/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/legacy/skipped-tests/_index.md
@@ -3,9 +3,10 @@ title: Skipped and Not Applicable Tests
 weight: 1
 ---
 
-
 This section lists the tests that are skipped in the permissive test profile for RKE.
 
+All the tests that are skipped and not applicable on this page will be counted as Not Applicable in the v2.5 generated report. The skipped test count will only mention the user-defined skipped tests. This allows user-skipped tests to be distinguished from the tests that are skipped by default in the RKE permissive test profile.
+
 - [CIS Benchmark v1.5](#cis-benchmark-v1-5)
 - [CIS Benchmark v1.4](#cis-benchmark-v1-4)
 
diff --git a/content/rancher/v2.x/en/cis-scans/rbac/_index.md b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
index 46f6dae1e93..7919567f081 100644
--- a/content/rancher/v2.x/en/cis-scans/rbac/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
@@ -13,6 +13,8 @@ However, the `rancher-cis-benchmark` chart installs three default `ClusterRoles`
 - cis-edit
 - cis-view
 
+In Rancher, only cluster owners and global administrators have `cis-admin` access by default. 
+
 # Cluster-Admin Access
 
 Rancher CIS Scans is a cluster-admin only feature by default.
diff --git a/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md b/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
index 3f30315daa4..feaf42e27b9 100644
--- a/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/skipped-tests/_index.md
@@ -5,6 +5,8 @@ weight: 3
 
 This section lists the tests that are skipped in the permissive test profile for RKE.
 
+> All the tests that are skipped and not applicable on this page will be counted as Not Applicable in the v2.5 generated report. The skipped test count will only mention the user-defined skipped tests. This allows user-skipped tests to be distinguished from the tests that are skipped by default in the RKE permissive test profile.
+
 # CIS Benchmark v1.5
 
 ### CIS Benchmark v1.5 Skipped Tests

From ca7646fb126c28aa61609d94b577cc4b5ccda393 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 12:32:18 -0700
Subject: [PATCH 240/265] Say Helm v3.2.x or higher is required to install or
 upgrade Rancher v2.5

---
 .../v2.x/en/installation/resources/helm-version/_index.md        | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/rancher/v2.x/en/installation/resources/helm-version/_index.md b/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
index 3a91781871a..c4e66f92849 100644
--- a/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
@@ -7,6 +7,7 @@ This section contains the requirements for Helm, which is the tool used to insta
 
 > The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
 
+- Helm v3.2.x or higher is required to install or upgrade Rancher v2.5.
 - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using.
 - Helm v2.15.0 should not be used, because of an issue with converting/comparing numbers.
 - Helm v2.12.0 should not be used, because of an issue with `cert-manager`.

From 67e44f9838a4d401ea00c64443fbac959211b656 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 12:32:18 -0700
Subject: [PATCH 241/265] Say Helm v3.2.x or higher is required to install or
 upgrade Rancher v2.5

---
 .../install/aks/_index.md                     |  7 -----
 .../install/any-k8s/_index.md                 |  7 -----
 .../install/eks/_index.md                     |  7 -----
 .../install/gke/_index.md                     |  7 -----
 .../install-rancher-on-linux/_index.md        | 17 -----------
 .../install/_index.md                         | 10 -------
 .../upgrades-rollbacks/_index.md              | 28 -------------------
 .../cluster-upgrade/_index.md                 |  8 ------
 .../woker-node-upgrade/_index.md              |  8 ------
 .../image-upgrade/_index.md                   |  6 ----
 .../upgrades-rollbacks/rollbacks/_index.md    |  4 ---
 .../resources/helm-version/_index.md          |  1 +
 12 files changed, 1 insertion(+), 109 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md

diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
deleted file mode 100644
index 319965a7229..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on an AKS Kubernetes Cluster
-shortTitle: AKS
-weight: 2
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
deleted file mode 100644
index 46a6a887dbb..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on Any Kubernetes Cluster
-shortTitle: Any Kubernetes Cluster
-weight: 4
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
deleted file mode 100644
index 97c254dd05a..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on an EKS Kubernetes Cluster
-shortTitle: EKS
-weight: 1
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
deleted file mode 100644
index 241a7d0822a..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on a GKE Kubernetes Cluster
-shortTitle: GKE
-weight: 3
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
deleted file mode 100644
index 993ad916a60..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: Install Rancher on a Linux OS
-weight: 2
----
-
-> This section is under construction.
-
-Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to install the Rancher binary. You will use the Rancher CLI to set up a Rancher Kubernetes cluster that has the Rancher server Helm chart preinstalled.
-
-There are two main ways that Rancher can be installed:
-
-1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
-2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
-
-The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
-
-This section focuses on the installation path in which the Rancher Helm chart is installed on an existing Kubernetes cluster.
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
deleted file mode 100644
index 1bb080bd47f..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: Install
-weight: 1
----
-
-> This page is under construction.
-
-In this section, you'll learn how to create a Rancher Kubernetes cluster that comes with the Rancher Helm chart built in.
-
-> To install Rancher on an existing Kubernetes cluster, refer to the instructions on [installing the Rancher Helm chart.](../../rancher-helm-install-upgrade/installation)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
deleted file mode 100644
index a171755b27a..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Upgrades and Rollbacks
-weight: 2
----
-
-> This page is under construction.
-
-This page is about how to upgrade the local Kubernetes cluster that Rancher is installed on, as well as the Rancher Helm chart.
-
-This information applies if you set up the local Rancher server cluster using the Rancher CLI.
-
-To upgrade the Rancher server's local Kubernetes cluster using the Rancher CLI, you will first upgrade the master nodes of the cluster, and then the worker nodes.
-
-### About Rancher Kubernetes
-
-Rancher is intended to be installed on any Kubernetes cluster.
-
-The Rancher CLI comes with a Kubernetes distribution called Rancher Kubernetes, which allows you to install Kubernetes more easily as a prerequisite to installing Rancher.
-
-Rancher Kubernetes clusters can also be imported into Rancher.
-
-
-### Known Upgrade Issues
-
-A list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
-
-### Caveats
-Upgrades _to_ or _from_ any chart in the [rancher-alpha repository]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories/) aren't supported.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
deleted file mode 100644
index f33386702a1..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Cluster Upgrade
-weight: 2
----
-
-> This section is under construction.
-
-In this section, you'll learn how to upgrade the Rancher Helm chart and the master nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
deleted file mode 100644
index 76f04a09ac2..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Worker Node Upgrade
-weight: 1
----
-
-> This page is under construction.
-
-In this section, you'll learn how to upgrade the worker nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
deleted file mode 100644
index c68c3d159e7..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Upgrade the Rancher Image
-weight: 1
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md
deleted file mode 100644
index 04d894708a2..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Rollbacks
-weight: 3
----
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/resources/helm-version/_index.md b/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
index 3a91781871a..c4e66f92849 100644
--- a/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/helm-version/_index.md
@@ -7,6 +7,7 @@ This section contains the requirements for Helm, which is the tool used to insta
 
 > The installation instructions have been updated for Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 Migration Docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) [This section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older high-availability Rancher installation instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
 
+- Helm v3.2.x or higher is required to install or upgrade Rancher v2.5.
 - Helm v2.16.0 or higher is required for Kubernetes v1.16. For the default Kubernetes version, refer to the [release notes](https://github.com/rancher/rke/releases) for the version of RKE that you are using.
 - Helm v2.15.0 should not be used, because of an issue with converting/comparing numbers.
 - Helm v2.12.0 should not be used, because of an issue with `cert-manager`.

From 092e2d4761686310bcb6d023ed9183f46aafe66a Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 13:03:05 -0700
Subject: [PATCH 242/265] Remove installation docs not applicable to Rancher
 v2.5

---
 .../install/aks/_index.md                     |  7 -----
 .../install/any-k8s/_index.md                 |  7 -----
 .../install/eks/_index.md                     |  7 -----
 .../install/gke/_index.md                     |  7 -----
 .../install-rancher-on-linux/_index.md        | 17 -----------
 .../install/_index.md                         | 10 -------
 .../upgrades-rollbacks/_index.md              | 28 -------------------
 .../cluster-upgrade/_index.md                 |  8 ------
 .../woker-node-upgrade/_index.md              |  8 ------
 .../image-upgrade/_index.md                   |  6 ----
 .../upgrades-rollbacks/rollbacks/_index.md    |  4 ---
 11 files changed, 109 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md

diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
deleted file mode 100644
index 319965a7229..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/aks/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on an AKS Kubernetes Cluster
-shortTitle: AKS
-weight: 2
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
deleted file mode 100644
index 46a6a887dbb..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/any-k8s/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on Any Kubernetes Cluster
-shortTitle: Any Kubernetes Cluster
-weight: 4
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
deleted file mode 100644
index 97c254dd05a..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/eks/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on an EKS Kubernetes Cluster
-shortTitle: EKS
-weight: 1
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
deleted file mode 100644
index 241a7d0822a..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/gke/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Installing Rancher on a GKE Kubernetes Cluster
-shortTitle: GKE
-weight: 3
----
-
-> This section is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
deleted file mode 100644
index 993ad916a60..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/_index.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: Install Rancher on a Linux OS
-weight: 2
----
-
-> This section is under construction.
-
-Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to install the Rancher binary. You will use the Rancher CLI to set up a Rancher Kubernetes cluster that has the Rancher server Helm chart preinstalled.
-
-There are two main ways that Rancher can be installed:
-
-1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
-2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
-
-The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
-
-This section focuses on the installation path in which the Rancher Helm chart is installed on an existing Kubernetes cluster.
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
deleted file mode 100644
index 1bb080bd47f..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/install/_index.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: Install
-weight: 1
----
-
-> This page is under construction.
-
-In this section, you'll learn how to create a Rancher Kubernetes cluster that comes with the Rancher Helm chart built in.
-
-> To install Rancher on an existing Kubernetes cluster, refer to the instructions on [installing the Rancher Helm chart.](../../rancher-helm-install-upgrade/installation)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
deleted file mode 100644
index a171755b27a..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/_index.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-title: Upgrades and Rollbacks
-weight: 2
----
-
-> This page is under construction.
-
-This page is about how to upgrade the local Kubernetes cluster that Rancher is installed on, as well as the Rancher Helm chart.
-
-This information applies if you set up the local Rancher server cluster using the Rancher CLI.
-
-To upgrade the Rancher server's local Kubernetes cluster using the Rancher CLI, you will first upgrade the master nodes of the cluster, and then the worker nodes.
-
-### About Rancher Kubernetes
-
-Rancher is intended to be installed on any Kubernetes cluster.
-
-The Rancher CLI comes with a Kubernetes distribution called Rancher Kubernetes, which allows you to install Kubernetes more easily as a prerequisite to installing Rancher.
-
-Rancher Kubernetes clusters can also be imported into Rancher.
-
-
-### Known Upgrade Issues
-
-A list of known issues for each Rancher version can be found in the release notes on [GitHub](https://github.com/rancher/rancher/releases) and on the [Rancher forums.](https://forums.rancher.com/c/announcements/12)
-
-### Caveats
-Upgrades _to_ or _from_ any chart in the [rancher-alpha repository]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories/) aren't supported.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
deleted file mode 100644
index f33386702a1..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Cluster Upgrade
-weight: 2
----
-
-> This section is under construction.
-
-In this section, you'll learn how to upgrade the Rancher Helm chart and the master nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
deleted file mode 100644
index 76f04a09ac2..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/cluster-upgrade/woker-node-upgrade/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: Worker Node Upgrade
-weight: 1
----
-
-> This page is under construction.
-
-In this section, you'll learn how to upgrade the worker nodes of the Rancher Kubernetes cluster, if applicable.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
deleted file mode 100644
index c68c3d159e7..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/image-upgrade/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: Upgrade the Rancher Image
-weight: 1
----
-
-> This page is under construction.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md
deleted file mode 100644
index 04d894708a2..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-linux/upgrades-rollbacks/rollbacks/_index.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Rollbacks
-weight: 3
----
\ No newline at end of file

From 13661be13c5fc4d94c2f273a1e31f70f6b00a3da Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 13:56:55 -0700
Subject: [PATCH 243/265] Recommend turning off firewalld

---
 .../v2.x/en/cluster-provisioning/node-requirements/_index.md    | 2 +-
 content/rancher/v2.x/en/installation/requirements/_index.md     | 2 +-
 .../v2.x/en/installation/resources/advanced/firewall/_index.md  | 2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md b/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
index 403ecdcc208..5521e62800c 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/node-requirements/_index.md
@@ -28,7 +28,7 @@ If you plan to use ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/r
 
 For information on how to install Docker, refer to the official [Docker documentation.](https://docs.docker.com/)
 
-Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm. This [how-to guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/firewall) shows how to check the default firewall rules and how to open the ports with `firewalld` if necessary.
+Some distributions of Linux derived from RHEL, including Oracle Linux, may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off.
 
 SUSE Linux may have a firewall that blocks all ports by default. In that situation, follow [these steps](#opening-suse-linux-ports) to open the ports needed for adding a host to a custom cluster.
 
diff --git a/content/rancher/v2.x/en/installation/requirements/_index.md b/content/rancher/v2.x/en/installation/requirements/_index.md
index eb2463fcc02..4c479634852 100644
--- a/content/rancher/v2.x/en/installation/requirements/_index.md
+++ b/content/rancher/v2.x/en/installation/requirements/_index.md
@@ -47,7 +47,7 @@ All supported operating systems are 64-bit x86.
 
 The `ntp` (Network Time Protocol) package should be installed. This prevents errors with certificate validation that can occur when the time is not synchronized between the client and server.
 
-Some distributions of Linux may have default firewall rules that block communication with Helm. This [how-to guide]({{<baseurl>}}/rancher/v2.x/en/installation/options/firewall) shows how to check the default firewall rules for Oracle Linux and how to open the ports with `firewalld` if necessary.
+Some distributions of Linux may have default firewall rules that block communication with Helm. We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off.
 
 If you plan to run Rancher on ARM64, see [Running on ARM64 (Experimental).]({{<baseurl>}}/rancher/v2.x/en/installation/options/arm64-platform/)
 
diff --git a/content/rancher/v2.x/en/installation/resources/advanced/firewall/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/firewall/_index.md
index 7386ba0880e..69cb99eeff4 100644
--- a/content/rancher/v2.x/en/installation/resources/advanced/firewall/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/advanced/firewall/_index.md
@@ -3,6 +3,8 @@ title: Opening Ports with firewalld
 weight: 1
 ---
 
+> We recommend disabling firewalld. For Kubernetes 1.19, firewalld must be turned off.
+
 Some distributions of Linux [derived from RHEL,](https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux#Rebuilds) including Oracle Linux, may have default firewall rules that block communication with Helm.
 
 For example, one Oracle Linux image in AWS has REJECT rules that stop Helm from communicating with Tiller:

From b430d9cbfc97bcc97b20176bde50df896127e411 Mon Sep 17 00:00:00 2001
From: Prachi Damle <prachi@rancher.com>
Date: Mon, 5 Oct 2020 14:44:49 -0700
Subject: [PATCH 244/265] Edit CIS RBAC

---
 content/rancher/v2.x/en/cis-scans/rbac/_index.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/content/rancher/v2.x/en/cis-scans/rbac/_index.md b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
index 7919567f081..d3800df3559 100644
--- a/content/rancher/v2.x/en/cis-scans/rbac/_index.md
+++ b/content/rancher/v2.x/en/cis-scans/rbac/_index.md
@@ -38,8 +38,8 @@ The rancher-cis-benchmark creates three `ClusterRoles` and adds the CIS Benchmar
 | `cis-edit`| `edit` | Ability to CRUD clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
 | `cis-view` | `view `| Ability to List(R) clusterscanbenchmarks, clusterscanprofiles, clusterscans, clusterscanreports CR
 
-Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but these default k8s roles will determine access to the CIS feature.
+By default only cluster-owner role will have ability to manage and use `rancher-cis-benchmark` feature.
 
-By default only cluster-owner role will have ability to use `rancher-cis-benchmark` feature.
+The other Rancher roles (cluster-member, project-owner, project-member) do not have default permissions to manage and use rancher-cis-benchmark resources.
 
-But the above ClusterRoles can be granted to cluster-member, project-owner, project-member users if a cluster-owner wants to share access.
+But if a cluster-owner wants to delegate access to other users, they can do so by creating ClusterRoleBindings between these users and the CIS ClusterRoles manually.

From e8abbf27f2634432eb6d51877f6372175d94ea79 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 13:29:12 -0700
Subject: [PATCH 245/265] Say that backup-restore is only for Rancher on the
 local cluster

---
 content/rancher/v2.x/en/backups/_index.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/backups/_index.md b/content/rancher/v2.x/en/backups/_index.md
index 9ecad4552e6..3d90e203bcf 100644
--- a/content/rancher/v2.x/en/backups/_index.md
+++ b/content/rancher/v2.x/en/backups/_index.md
@@ -5,7 +5,11 @@ weight: 5
 
 In this section, you'll learn how to create backups of Rancher, how to restore Rancher from backup, and how to migrate Rancher to a new Kubernetes cluster. 
 
-The Rancher version must be v2.5.0 and up to use this approach of backing up and restoring Rancher. As of Rancher v2.5, the `rancher-backup` operator is used to backup and restore Rancher. The Helm chart is [here.](https://github.com/rancher/charts/tree/main/charts/rancher-backup)
+As of Rancher v2.5, the `rancher-backup` operator is used to backup and restore Rancher. The `rancher-backup` Helm chart is [here.](https://github.com/rancher/charts/tree/main/charts/rancher-backup)
+
+The backup-restore operator needs to be installed in the local cluster, and only backs up the Rancher app. The backup and restore operations are performed only in the local Kubernetes cluster.
+
+The Rancher version must be v2.5.0 and up to use this approach of backing up and restoring Rancher. 
 
 - [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
   - [Backup and Restore for Rancher v2.5 installed with Docker](#backup-and-restore-for-rancher-v2-5-installed-with-docker)

From 126f3f76e18bce9183303ff71b588af8a416fcec Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 14:46:38 -0700
Subject: [PATCH 246/265] Document private registry with certs for air gap
 Docker install

---
 .../air-gap/populate-private-registry/_index.md             | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
index 6cef213e1ae..a97cc6bea3c 100644
--- a/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
+++ b/content/rancher/v2.x/en/installation/other-installation-methods/air-gap/populate-private-registry/_index.md
@@ -16,7 +16,11 @@ Populating the private registry with images is the same process for installing R
 
 The steps in this section differ depending on whether or not you are planning to use Rancher to provision a downstream cluster with Windows nodes or not. By default, we provide the steps of how to populate your private registry assuming that Rancher will provision downstream Kubernetes clusters with only Linux nodes. But if you plan on provisioning any [downstream Kubernetes clusters using Windows nodes]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/), there are separate instructions to support the images needed.
 
-> **Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry) available to use.
+> **Prerequisites:**
+>
+> You must have a [private registry](https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry) available to use.
+>
+> If the registry has certs, follow [this K3s documentation](https://rancher.com/docs/k3s/latest/en/installation/private-registry/) about adding a private registry. The certs and registry configuration files need to be mounted into the Rancher container.
 
 {{% tabs %}}
 {{% tab "Linux Only Clusters" %}}

From f590be9610f004a02fa0cd12886f4829dd001530 Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Sun, 4 Oct 2020 13:45:54 -0700
Subject: [PATCH 247/265] Reword istio overview page, make legacy more
 obvious... Format resources table, Change additional scrape config
 information to match current monitoring default

---
 content/rancher/v2.x/en/istio/_index.md       | 28 ++++++++---------
 .../rancher/v2.x/en/istio/resources/_index.md | 16 +++++-----
 .../setup/enable-istio-in-cluster/_index.md   | 31 ++++++++++---------
 3 files changed, 39 insertions(+), 36 deletions(-)

diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
index 7a4c71709c0..e1f14e7fa75 100644
--- a/content/rancher/v2.x/en/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -3,24 +3,24 @@ title: Istio
 weight: 15
 ---
 
-> This section is about the new version of the Istio app in Rancher v2.5.0. If you are using a Rancher version from v2.3.0 to v2.5.0, the older way of setting up Istio is documented in [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
+# Istio in Cluster Manager
+If you are using a Rancher version from **v2.3.x** to **v2.4.x**, the older way of setting up Istio in th **Cluster Manager** is documented in [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)
 
- [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, control, troubleshoot, and secure the traffic within a complex network of microservices.
 
- As a network of microservices changes and grows, the interactions between them can become more difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
+# Istio in Cluster Explorer
+ [Istio](https://istio.io/) is an open-source tool that makes it easier for DevOps teams to observe, secure, control, and troubleshoot the traffic within a complex network of microservices.
 
-Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster administrator, can deliver Istio to developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
+As a network of microservices changes and grows, the interactions between them can become increasingly difficult to manage and understand. In such a situation, it is useful to have a service mesh as a separate infrastructure layer. Istio's service mesh lets you manipulate traffic between microservices without changing the microservices directly.
 
-This service mesh provides features that include but are not limited to the following:
+Our integration of Istio is designed so that a Rancher operator, such as an administrator or cluster owner, can deliver Istio to a team of developers. Then developers can use Istio to enforce security policies, troubleshoot problems, or manage traffic for green/blue deployments, canary deployments, or A/B testing.
 
-- Traffic management features
-- Enhanced monitoring and tracing
-- Service discovery and routing
-- Secure connections and service-to-service authentication with mutual TLS
-- Load balancing
-- Automatic retries, backoff, and circuit breaking
+This core service mesh provides features that include but are not limited to the following:
 
-After Istio is enabled in a cluster, you can leverage Istio's control plane functionality with `kubectl`.
+- **Traffic Management** such as ingress and egress routing, circuit breaking, mirroring.
+- **Security** with resources to authenticate and authorize traffic and users, mTLS included.
+- **Observability** of logs, metrics, and distributed traffic flows.
+
+After [setting up istio]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup) you can leverage Istio's control plane functionality through the Cluster Explorer, `kubectl`, or `istioctl`.
 
 Rancher's Istio integration comes with a comprehensive visualization aid:
 
@@ -66,7 +66,7 @@ To access the Grafana and Prometheus visualizations, from the **Cluster Explorer
 
 To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. 
 
-By default, only the `istio-system` namespace will picked up by prometheus, which means the other visualization addons will not have displays for resources deployed in other namespaces. Refer to [selector/scrape config setup](URLNEEDED) to get full use of your Grafana and Kiali dashboards.
+By default, all namespace will picked up by prometheus and make data available for Kiali graphs. Refer to [selector/scrape config setup](URLNEEDED) if you would like to use a different configuration for prometheus data scraping. 
 
 Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.
 
@@ -86,7 +86,7 @@ By default, each Rancher-provisioned cluster has one NGINX ingress controller al
 
 ![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
  
- Additional Istio Ingress gateways can be enabled via the [overlay file.](URLNEEDED)
+ Additional Istio Ingress gateways can be enabled via the [overlay file](URLNEEDED).
 
 ### Egress Support
 
diff --git a/content/rancher/v2.x/en/istio/resources/_index.md b/content/rancher/v2.x/en/istio/resources/_index.md
index a1c3face6e3..2aea1303e56 100644
--- a/content/rancher/v2.x/en/istio/resources/_index.md
+++ b/content/rancher/v2.x/en/istio/resources/_index.md
@@ -16,18 +16,18 @@ Before enabling Istio, we recommend that you confirm that your Rancher worker no
 
 > **Tip:** In larger deployments, it is strongly advised that the infrastructure be placed on dedicated nodes in the cluster by adding a node selector for each Istio component.
 
-The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each central Istio component.
+The table below shows a summary of the minimum recommended resource requests and limits for the CPU and memory of each core Istio component.
 
 In Kubernetes, the resource request indicates that the workload will not deployed on a node unless the node has at least the specified amount of memory and CPU available. If the workload surpasses the limit for CPU or memory, it can be terminated or evicted from the node. For more information on managing resource limits for containers, refer to the [Kubernetes documentation.](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/)
 
 Workload | CPU - Request | Mem - Request | CPU - Limit | Mem - Limit | Configurable
----------|---------------|---------------|-------------|-------------|-------------
-istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | Y
- istio-telemetry | 1000m         | 10214Mi        | 4800m       | 4096Mi      | Y        
- istio-policy | 1000m         | 1024Mi        | 4800m       | 4096Mi      | Y      
-istio-ingressgateway | 2000m | 1024Mi  | 10m |  40Mi | Y                   
- Others          | 500m          | 500Mi         | -         | -         | Y           
- **Total**       | **4500m**         | **5620Mi**        | **>12300m**         | **>14848Mi**         | **-**   
+---------:|---------------:|---------------:|-------------:|-------------:|-------------:
+Istiod | 610m | 2186Mi | 4000m | 2048Mi | Y | Y
+Istio-policy | 1000m         | 1024Mi        | 4800m       | 4096Mi      | Y      
+Istio-telemetry | 1000m         | 10214Mi        | 4800m       | 4096Mi      | Y        
+Istio-ingressgateway | 2000m | 1024Mi  | 10m |  40Mi | Y                   
+Others          | 500m          | 500Mi         | -         | -         | Y           
+**Total**       | **4500m**         | **5620Mi**        | **>12300m**         | **>14848Mi**         | **-**   
 
 
 # Configuring Resource Allocations
diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
index 382a67c8daa..ce4536c6780 100644
--- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
@@ -35,12 +35,26 @@ For more information on Overlay Files, refer to the [documentation](https://isti
 
 ## Selectors & Scrape Configs
 
-The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=true` which means only the `istio-system` namespace will be scraped by prometheus by default. To ensure you can view traffic, metrics and graphs for resources deployed in other namespaces you will need to add additional configuration.
+The Monitoring app sets `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` which enables monitoring across all namespaces by default. This ensures you can view traffic, metrics and graphs for resources deployed in a namespace with `istio-injection=enabled` label. 
 
-There are three different ways to enable prometheus to detect resources in other namespaces: 
+If you would like to limit prometheus to specific namespaces, set `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`. Once you do this, you will need to add additional configuration to continue to monitor your resources. 
+
+**Set ingnoreNamspaceSelectors to True** 
+
+This limits monitoring to specific namespaces. 
+
+
+1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace** 
+1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**. 
+1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**. 
+1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true`
+1. Complete install or upgrade
+
+**Result:** Prometheus will be limited to specific namespaces  which means one of the following configurations will need to be set up to continue to view data in various dashboards
+
+There are two different ways to enable prometheus to detect resources in other namespaces when `prometheus.prometheusSpec.ignoreNamespaceSelectors=true`: 
 
 1. Add a Service Monitor or Pod Monitor in the namespace with the targets you want to scrape.
-1. Set `prometheus.prometheusSpec.ignoreNamespaceSelectors=false` on your rancher-monitoring instance.
 1. Add an `additionalScrapeConfig` to your rancher-monitoring instance to scrape all targets in all namespaces.
 
 **Option 1: Create a Service Monitor or Pod Monitor** 
@@ -94,18 +108,7 @@ spec:
       targetLabel: pod_name
 ```
 
-**Option 2: Set ingnoreNamspaceSelectors to False** 
 
-This enables monitoring accross namespaces which means ServiceMonitors or PodMonitors will not need to be created per namespace. 
-
- >Potential security trade off is  users in namespace A can create a service monitor that monitors services in namespace B despite not having permissions to namespace B
-1. From the **Cluster Explorer**, navigate to **Installed Apps** if Monitoring is already installed, or **Charts** in **Apps & Marketplace** 
-1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**. 
-1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**. 
-1. Set`prometheus.prometheusSpec.ignoreNamespaceSelectors=true`
-1. Complete install or upgrade
-
-**Result:** All namespaces with the `istio-injection=enabled` label will be scraped by prometheus.
 
 **Option 3: Set ingnoreNamspaceSelectors to False** 
 

From 1f53aa1338b632b62dd176f950ee29c03bbeae89 Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Mon, 5 Oct 2020 14:32:24 -0700
Subject: [PATCH 248/265] Update tables, add urls

---
 content/rancher/v2.x/en/istio/_index.md       | 10 +++----
 content/rancher/v2.x/en/istio/rbac/_index.md  | 26 +++++++++----------
 .../rancher/v2.x/en/istio/resources/_index.md |  6 ++---
 .../en/istio/setup/deploy-workloads/_index.md |  1 +
 .../setup/enable-istio-in-cluster/_index.md   |  4 +--
 .../en/istio/setup/view-traffic/_index.md     |  3 +--
 6 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/content/rancher/v2.x/en/istio/_index.md b/content/rancher/v2.x/en/istio/_index.md
index e1f14e7fa75..2a7005bc834 100644
--- a/content/rancher/v2.x/en/istio/_index.md
+++ b/content/rancher/v2.x/en/istio/_index.md
@@ -34,7 +34,7 @@ The overall architecture of Istio has been simplified. A single component, Istio
 
 Addons that were previously installed by Istio (cert-manager, Grafana, Jaeger, Kiali, Prometheus, Zipkin) will now need to be installed separately. Istio will support installation of integrations that are from the Istio Project and will maintain compatibility with those that are not.
 
-A Prometheus integration will still be available through an installation of [Rancher Monitoring,](../../monitoring-alerting) or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
+A Prometheus integration will still be available through an installation of [Rancher Monitoring]({{<baseurl>}}/rancher/v2.x/en/monitoring-alerting/), or by installing your own Prometheus operator. Rancher's Istio chart will also install Kiali by default to ensure you can get a full picture of your microservices out of the box.
 
 Istio has migrated away from Helm as a way to install Istio and now provides installation through the istioctl binary or Istio Operator. To ensure the easiest interaction with Istio, Rancher's Istio will maintain a Helm chart that utilizes the istioctl binary to manage your Istio installation.
 
@@ -50,7 +50,7 @@ Refer to the [setup guide]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/ist
 
 # Remove Istio
 
-To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/disabling-istio)
+To remove Istio components from a cluster, namespace, or workload, refer to the section on [uninstalling Istio.]({{<baseurl>}}/rancher/v2.x/en/istio/disabling-istio/)
 
 # Migrate From Previous Istio Version
 
@@ -66,7 +66,7 @@ To access the Grafana and Prometheus visualizations, from the **Cluster Explorer
 
 To access the Kiali visualization, from the **Cluster Explorer** navigate to the **Istio** app overview page, and click on **Kiali**. From here you can access the **Traffic Graph** tab or the **Traffic Metrics** tab to see network visualizations and metrics. 
 
-By default, all namespace will picked up by prometheus and make data available for Kiali graphs. Refer to [selector/scrape config setup](URLNEEDED) if you would like to use a different configuration for prometheus data scraping. 
+By default, all namespace will picked up by prometheus and make data available for Kiali graphs. Refer to [selector/scrape config setup]({{<baseurl>}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#selectors-scrape-configs) if you would like to use a different configuration for prometheus data scraping. 
 
 Your access to the visualizations depend on your role. Grafana and Prometheus are only available for `cluster-admin` roles. The Kiali UI is available only to `cluster-admin` by default, but `cluster-admin` can allow other roles to access them by editing the Istio values.yaml.
 
@@ -86,8 +86,8 @@ By default, each Rancher-provisioned cluster has one NGINX ingress controller al
 
 ![In an Istio-enabled cluster, you can have two ingresses: the default Nginx ingress, and the default Istio controller.]({{<baseurl>}}/img/rancher/istio-ingress.svg)
  
- Additional Istio Ingress gateways can be enabled via the [overlay file](URLNEEDED).
+ Additional Istio Ingress gateways can be enabled via the [overlay file]({{<baseurl>}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#overlay-file).
 
 ### Egress Support
 
-By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file](URLNEEDED)
\ No newline at end of file
+By default the Egress gateway is disabled, but can be enabled on install or upgrade through the values.yaml or via the [overlay file]({{<baseurl>}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#overlay-file).
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/rbac/_index.md b/content/rancher/v2.x/en/istio/rbac/_index.md
index b4ee158ea23..cdd75c9867a 100644
--- a/content/rancher/v2.x/en/istio/rbac/_index.md
+++ b/content/rancher/v2.x/en/istio/rbac/_index.md
@@ -9,7 +9,7 @@ This section describes the permissions required to access Istio features.
 
 The rancher istio chart installs three `ClusterRoles` 
 
-# Cluster-Admin Access
+## Cluster-Admin Access
 
 By default, only those with the `cluster-admin` `ClusterRole` can:
 
@@ -26,21 +26,21 @@ By default, only Admin and Edit roles can:
 - View the traffic metrics and traffic graph for the cluster
 - Configure Istio's resources (such as the gateway, destination rules, or virtual services)
 
-# Summary of Default Permissions for Kubernetes Default roles
+## Summary of Default Permissions for Kubernetes Default roles
 
 Istio creates three `ClusterRoles` and adds Istio CRD access to the following default K8s `ClusterRole`:
 
-| ClusterRole create by chart | Default K8s ClusterRole  | Rancher Role | 
-| ------------------------------| ---------------------------|---------|
-| `istio-admin` | admin| Project Owner, Project Member | 
-| `istio-edit`| edit | Project Owner, Project Member | 
-| `istio-view` | view | Read-only | 
+ClusterRole create by chart | Default K8s ClusterRole  | Rancher Role |
+ ------------------------------:| ---------------------------:|---------:|
+ `istio-admin` | admin| Project Owner, Project Member | 
+ `istio-edit`| edit | Project Owner, Project Member | 
+ `istio-view` | view | Read-only | 
 
-Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create (C), Get (G), List (L), Update (U), Patch (P), Delete(D), All (*)) that can be performed. 
+Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create ( C ), Get ( G ), List ( L ), Update ( U ), Patch ( P ), Delete( D ), All ( * )) that can be performed. 
 
 
-|CRDs                        | Admin | Edit | View | 
-|----------------------------| ------| -----| -----|
-| <ul><li>`config.istio.io`</li><ul><li>`adapters`</li><li>`attributemanifests`<li>`handlers`</li><li>`httpapispecbindings`</li><li>`httpapispecs`</li><li>`instances`</li><li>`quotaspecbindings`</li><li>`quotaspecs`</li><li>`rules`</lli><li>`templates`</li></ul></ul>| GLW | GLW | GLW|
-|<ul><li>`networking.istio.io`</li><ul><li>`destinationrules`</li><li>`envoyfilters`<li>`gateways`</li><li>`serviceentries`</li><li>`sidecars`</li><li>`virtualservices`</li><li>`workloadentries`</li></ul></ul>| * | * | GLW |
-|<ul><li>`security.istio.io`</li><ul><li>`authorizationpolicies`</li><li>`peerauthentications`<li>`requestauthentications`</li></ul></ul>| * | * | GLW |
\ No newline at end of file
+|CRDs                        | Admin | Edit | View  
+|----------------------------| ------| -----| -----
+| <ul><li>`config.istio.io`</li><ul><li>`adapters`</li><li>`attributemanifests`<li>`handlers`</li><li>`httpapispecbindings`</li><li>`httpapispecs`</li><li>`instances`</li><li>`quotaspecbindings`</li><li>`quotaspecs`</li><li>`rules`</lli><li>`templates`</li></ul></ul>| GLW | GLW | GLW
+|<ul><li>`networking.istio.io`</li><ul><li>`destinationrules`</li><li>`envoyfilters`<li>`gateways`</li><li>`serviceentries`</li><li>`sidecars`</li><li>`virtualservices`</li><li>`workloadentries`</li></ul></ul>| * | * | GLW 
+|<ul><li>`security.istio.io`</li><ul><li>`authorizationpolicies`</li><li>`peerauthentications`<li>`requestauthentications`</li></ul></ul>| * | * | GLW 
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/istio/resources/_index.md b/content/rancher/v2.x/en/istio/resources/_index.md
index 2aea1303e56..9a13b076b69 100644
--- a/content/rancher/v2.x/en/istio/resources/_index.md
+++ b/content/rancher/v2.x/en/istio/resources/_index.md
@@ -6,7 +6,7 @@ aliases:
   - /rancher/v2.x/en/project-admin/istio/config/
   - /rancher/v2.x/en/cluster-admin/tools/istio/resources
 ---
-_This section applies to Istio in Rancher v2.5.0. If you are using Rancher v2.4.x, refer to [this section.](../../legacy/resources)_
+_This section applies to Istio in Rancher v2.5.0. If you are using Rancher v2.4.x, refer to [this section.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/)_
 
 This section describes the minimum recommended computing resources for the Istio components in a cluster.
 
@@ -36,12 +36,12 @@ You can individually configure the resource allocation for each type of Istio co
 
 To make it easier to schedule the workloads to a node, a cluster-admin can reduce the CPU and memory resource requests for the component. However, the default CPU and memory allocations are the minimum that we recommend.
 
-You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/docs/concepts/what-is-istio).
+You can find more information about Istio configuration in the [official Istio documentation](https://istio.io/).
 
 To configure the resources allocated to an Istio component,
 
 1. In the Rancher **Cluster Explorer**, navigate to your Istio installation in **Apps & Marketplace**
-1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file](URLNEEDED). 
+1. Click **Upgrade** to edit the base components via changes the values.yaml or add an [overlay file]({{<baseurl>}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#overlay-file).
 1. Change the CPU or memory allocations, the nodes where each component will be scheduled to, or the node tolerations.
 1. Click **Upgrade.** to rollout changes
 
diff --git a/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md b/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
index 1c8b19cfc67..017ee200eed 100644
--- a/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/deploy-workloads/_index.md
@@ -34,6 +34,7 @@ To add a **Service** to your namespace
 1. Click **Create** 
 
 You can also create deployments and services using the kubectl **shell**
+
 1. Run `kubectl create -f <name of service/deployment file>.yaml` if your file is stored locally in the cluster
 1. Or run `cat<< EOF | kubectl apply -f -`, paste the file contents into the terminal, then run `EOF` to complete the command. 
 
diff --git a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
index ce4536c6780..06fc840f7d0 100644
--- a/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/_index.md
@@ -9,7 +9,6 @@ Only a user with the following [Kubernetes default roles](https://kubernetes.io/
 
  - `cluster-admin`
 
-> If the cluster has a Pod Security Policy enabled there are [prerequisites steps.]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-cluster/enable-istio-with-psp/)
 
 1. From the **Cluster Explorer**, navigate to available **Charts** in **Apps & Marketplace** 
 1. Select the Istio chart from the rancher provided charts
@@ -114,7 +113,8 @@ spec:
 
 This enables monitoring accross namespaces by giving prometheus additional scrape configurations. 
 
- >Usability tradeoff is that  all of prometheus' additionalScrapeConfigs are maintained in a single Secret. This could make upgrading difficult if monitoring is already deployed with additionalScrapeConfigs prior to installing Istio. 
+ >Usability tradeoff is that  all of prometheus' `additionalScrapeConfigs` are maintained in a single Secret. This could make upgrading difficult if monitoring is already deployed with additionalScrapeConfigs prior to installing Istio. 
+
 1. If starting a new install, **Click** the **rancher-monitoring** chart, then in **Chart Options** click **Edit as Yaml**. 
 1. If updating an existing installation, click on **Upgrade**, then in **Chart Options** click **Edit as Yaml**. 
 1. If updating an existing installation, click on **Upgrade** and then **Preview Yaml**.
diff --git a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
index b6be6ae7864..e0aad92e277 100644
--- a/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
+++ b/content/rancher/v2.x/en/istio/setup/view-traffic/_index.md
@@ -11,11 +11,10 @@ This section describes how to view the traffic that is being managed by Istio.
 
 The Istio overpage provides a link to the Kiali dashboard. From the Kiali dashboard, you are able to view graphs for each namespace. The Kiali graph provides a powerful way to visualize the topology of your Istio service mesh. It shows you which services communicate with each other.
 
->**Prerequisite:** To enable traffic to show up in the graph, ensure you have enabled one of the [Selectors & Scrape Configs](NEEDSURL) options. If you do not have this configured, you will not see information on the graph. 
+>**Prerequisite:** To enable traffic to show up in the graph, ensure you have enabled one of the [Selectors & Scrape Configs]({{<baseurl>}}/rancher/v2.x/en/istio/setup/enable-istio-in-cluster/#selectors-scrape-configs)options. If you do not have this configured, you will not see information on the graph. 
 
 To see the traffic graph,
 
-
 1. From the **Cluster Explorer**, select **Istio** from the nav dropdown.
 1. Click the **Kiali** link on the Istio **Overview** page.
 1. Click on **Graph** in the side nav.

From e00cfd4ea1431ffe479e46a1b3af7d4f4ea86cda Mon Sep 17 00:00:00 2001
From: Brenda Rearden <brenda@rancher.com>
Date: Mon, 5 Oct 2020 17:00:28 -0700
Subject: [PATCH 249/265] Update rbac roles

---
 content/rancher/v2.x/en/istio/rbac/_index.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/istio/rbac/_index.md b/content/rancher/v2.x/en/istio/rbac/_index.md
index cdd75c9867a..91c56254a8c 100644
--- a/content/rancher/v2.x/en/istio/rbac/_index.md
+++ b/content/rancher/v2.x/en/istio/rbac/_index.md
@@ -32,8 +32,8 @@ Istio creates three `ClusterRoles` and adds Istio CRD access to the following de
 
 ClusterRole create by chart | Default K8s ClusterRole  | Rancher Role |
  ------------------------------:| ---------------------------:|---------:|
- `istio-admin` | admin| Project Owner, Project Member | 
- `istio-edit`| edit | Project Owner, Project Member | 
+ `istio-admin` | admin| Project Owner | 
+ `istio-edit`| edit | Project Member | 
  `istio-view` | view | Read-only | 
 
 Rancher will continue to use cluster-owner, cluster-member, project-owner, project-member, etc as role names, but will utilize default roles to determine access. For each default K8s `ClusterRole` there are different Istio CRD permissions and K8s actions (Create ( C ), Get ( G ), List ( L ), Update ( U ), Patch ( P ), Delete( D ), All ( * )) that can be performed. 

From f84a83d825147792db47a8d4a956a3dd1976e146 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 17:54:04 -0700
Subject: [PATCH 250/265] Explain restricted-admin role

---
 .../rbac/global-permissions/_index.md         | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
index 036abcc3181..ba3f701f232 100644
--- a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
@@ -7,6 +7,8 @@ _Permissions_ are individual access rights that you can assign when selecting a
 
 Global Permissions define user authorization outside the scope of any particular cluster. Out-of-the-box, there are three default global permissions: `Administrator`, `Standard User` and `User-base`.
 
+In Rancher v2.5, a restricted-admin role was added.
+
 - **Administrator:** These users have full control over the entire Rancher system and all clusters within it.
 
 - <a id="user"></a>**Standard User:** These users can create new clusters and use them. Standard users can also assign other users permissions to their clusters.
@@ -17,6 +19,7 @@ You cannot update or delete the built-in Global Permissions.
 
 This section covers the following topics:
 
+- [Restricted Admin](#restricted-admin)
 - [Global permission assignment](#global-permission-assignment)
   - [Global permissions for new local users](#global-permissions-for-new-local-users)
   - [Global permissions for users with external authentication](#global-permissions-for-users-with-external-authentication)
@@ -27,6 +30,49 @@ This section covers the following topics:
   - [Configuring global permissions for groups](#configuring-global-permissions-for-groups)
   - [Refreshing group memberships](#refreshing-group-memberships)
 
+# Restricted Admin
+
+_Available as of Rancher v2.5_
+
+A new `restricted-admin` role was created in Rancher v2.5 in order to prevent privilege escalation from the local Rancher server Kubernetes cluster. This role has full administrator access to all downstream clusters managed by Rancher, but it does not have permission to alter the local Kubernetes cluster.
+
+The `restricted-admin` can create other `restricted-admin` users with an equal level of access.
+
+A new setting was added to Rancher to set the initial bootstrapped administrator to have the `restricted-admin` role. This applies to the first user created when the Rancher server is started for the first time. If the environment variable is set, then no global administrator would be created, and it would be impossible to create the global administrator through Rancher.
+
+To bootstrap Rancher with the `restricted-admin` as the initial user, the Rancher server should be started with the following environment variable:
+
+```
+CATTLE_RESTRICTED_DEFAULT_ADMIN=true
+```
+### List of `restricted-admin` Permissions
+
+The `restricted-admin` permissions are as follows:
+
+- Has full admin access to all downstream clusters managed by Rancher.
+- Has very limited access to the local Kubernetes cluster. Can access Rancher custom resource definitions, but has no access to any Kubernetes native types.
+- Can add other users and assign them to clusters outside of the local cluster.
+- Can create other restricted admins
+- Can not grant any permissions in the local cluster they don't currently have (This is how Kubernetes normally operates)
+
+### Upgrading from Rancher with a Hidden Local Cluster
+
+Prior to Rancher v2.5, it was possible to run the Rancher server using this flag to hide the local cluster:
+
+```
+--add-local=false
+```
+
+You will need to drop this flag when upgrading to Rancher v2.5. Otherwise, Rancher will not start. The `restricted-admin` role can be used to continue restricting access to the local cluster.
+
+### Changing Global Administrators to Restricted Admins
+
+If Rancher already has a global administrator, they should change all global administrators over to the new `restricted-admin` role.
+
+This can be done through **Security > Users** and moving any Administrator role over to Restricted Administrator.
+
+Signed-in users can change themselves over to the `restricted-admin` if they wish, but they should only do that as the last step, otherwise they won't have the permissions to do so.
+
 # Global Permission Assignment
 
 Global permissions for local users are assigned differently than users who log in to Rancher using external authentication.

From 5104e99b7a0489e3d9beb26da2d6d3cd92551711 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 17:59:21 -0700
Subject: [PATCH 251/265] Grammar edit

---
 .../v2.x/en/admin-settings/rbac/global-permissions/_index.md  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
index ba3f701f232..f5cfc8fd32f 100644
--- a/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
+++ b/content/rancher/v2.x/en/admin-settings/rbac/global-permissions/_index.md
@@ -52,8 +52,8 @@ The `restricted-admin` permissions are as follows:
 - Has full admin access to all downstream clusters managed by Rancher.
 - Has very limited access to the local Kubernetes cluster. Can access Rancher custom resource definitions, but has no access to any Kubernetes native types.
 - Can add other users and assign them to clusters outside of the local cluster.
-- Can create other restricted admins
-- Can not grant any permissions in the local cluster they don't currently have (This is how Kubernetes normally operates)
+- Can create other restricted admins.
+- Cannot grant any permissions in the local cluster they don't currently have. (This is how Kubernetes normally operates)
 
 ### Upgrading from Rancher with a Hidden Local Cluster
 

From ef82f133a59942a335fcff6d6e3cb02d0d4e01ff Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 18:11:05 -0700
Subject: [PATCH 252/265] Add note on restricted-admin to upgrade section

---
 .../upgrades-rollbacks/upgrades/ha/_index.md                     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
index 89d2333b42e..cb8defb71da 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
@@ -14,6 +14,7 @@ If you installed Rancher using the RKE Add-on yaml, follow the directions to [mi
 
 >**Notes:**
 > 
+> If you are upgrading from a Rancher server that was started with the Helm chart option `--add-local=false`, you will need to drop that flag when upgrading. Otherwise, the Rancher server will not start. The `restricted-admin` role can be used to continue restricting access to the local cluster. For more information, see [this section.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#upgrading-from-rancher-with-a-hidden-local-cluster)
 > - [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager)
 > - The upgrade instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) The [Helm 2 upgrade page here]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/helm2) provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
 > - If you are upgrading Rancher from v2.x to v2.3+, and you are using external TLS termination, you will need to edit the cluster.yml to [enable using forwarded host headers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#configuring-ingress-for-external-tls-when-using-nginx-v0-25)

From 1b8fe0676fe7369e06bb4b1d13c1310b9453dd7d Mon Sep 17 00:00:00 2001
From: David Noland <dnoland@rancher.com>
Date: Mon, 5 Oct 2020 17:52:44 -0700
Subject: [PATCH 253/265] Added note that addLocal not an option in v2.5.0.

---
 .../v2.x/en/installation/resources/chart-options/_index.md      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
index 14d25c815de..08ebf4a9778 100644
--- a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
@@ -34,7 +34,7 @@ weight: 2
 | Option                         | Default Value                                         | Description                                                                                                                                       |
 | ------------------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `additionalTrustedCAs`         | false                                                 | `bool` - See [Additional Trusted CAs](#additional-trusted-cas)                                                                                    |
-| `addLocal`                     | "true"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster. For more information, see [Import local Cluster.](#import-local-cluster)  If you turn addLocal off, most Rancher v2.5 features won't work, including the EKS provisioner.                  |
+| `addLocal`                     | "true"                                                | `string` - Have Rancher detect and import the "local" Rancher server cluster. For more information, see [Import local Cluster.](#import-local-cluster)  _Note: This option is no longer available in v2.5.0. Consider using the `restrictedAdmin` option to prevent users from modifying the local cluster._ |
 | `antiAffinity`                 | "preferred"                                           | `string` - AntiAffinity rule for Rancher pods - "preferred, required"                                                                             |
 | `replicas`                     | 3                                                     | `int` - Number of replicas of Rancher pods                                                                                                        |
 | `auditLog.destination`         | "sidecar"                                             | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath"                                                           |

From ce5a0d5d27bd940633b1ccc761c9bf5a401dd4f0 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 18:19:39 -0700
Subject: [PATCH 254/265] Fix formatting error

---
 .../upgrades-rollbacks/upgrades/ha/_index.md                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
index cb8defb71da..a570d1e9c22 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
@@ -14,7 +14,7 @@ If you installed Rancher using the RKE Add-on yaml, follow the directions to [mi
 
 >**Notes:**
 > 
-> If you are upgrading from a Rancher server that was started with the Helm chart option `--add-local=false`, you will need to drop that flag when upgrading. Otherwise, the Rancher server will not start. The `restricted-admin` role can be used to continue restricting access to the local cluster. For more information, see [this section.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#upgrading-from-rancher-with-a-hidden-local-cluster)
+> - If you are upgrading from a Rancher server that was started with the Helm chart option `--add-local=false`, you will need to drop that flag when upgrading. Otherwise, the Rancher server will not start. The `restricted-admin` role can be used to continue restricting access to the local cluster. For more information, see [this section.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#upgrading-from-rancher-with-a-hidden-local-cluster)
 > - [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager)
 > - The upgrade instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) The [Helm 2 upgrade page here]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/helm2) provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
 > - If you are upgrading Rancher from v2.x to v2.3+, and you are using external TLS termination, you will need to edit the cluster.yml to [enable using forwarded host headers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#configuring-ingress-for-external-tls-when-using-nginx-v0-25)

From 0057d6064719af349640dfd265037c1728b244ed Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 18:23:16 -0700
Subject: [PATCH 255/265] Add restrictedAdmin option to Helm chart options

---
 .../v2.x/en/installation/resources/chart-options/_index.md       | 1 +
 1 file changed, 1 insertion(+)

diff --git a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
index 08ebf4a9778..7289fbeef44 100644
--- a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
@@ -60,6 +60,7 @@ weight: 2
 | `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
 | `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/                   |
 | `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations.  |
+| `restrictedAdmin` | `false` | When this option is set to true, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#restricted-admin) |
 
 <br/>
 

From b6b240bc52000f40e9c31ed05a86fa4d91061b96 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 18:40:22 -0700
Subject: [PATCH 256/265] Remove 'under construction' notices

---
 .../registered-clusters/_index.md             |  12 -
 .../v2.x/en/deploy-across-clusters/_index.md  |   6 +-
 content/rancher/v2.x/en/helm-charts/_index.md |   8 +-
 .../v2.x/en/installation/resources/_index.md  |   2 -
 .../installation/resources/advanced/_index.md |   2 +-
 .../resources/chart-options/_index.md         |   2 -
 .../resources/encryption/_index.md            |   2 +-
 .../resources/k8s-tutorials/_index.md         |   8 +-
 .../resources/k8s-tutorials/ha-RKE/_index.md  |   5 +-
 .../resources/k8s-tutorials/ha-RKE2/_index.md |   7 -
 .../rancher/v2.x/en/logging/legacy/_index.md  |   2 +-
 .../en/monitoring-alerting/legacy/_index.md   |   2 +-
 content/rancher/v2.x/en/pipelines/_index.md   | 270 ++++++++++++++++-
 .../pipelines/{legacy => }/concepts/_index.md |   0
 .../pipelines/{legacy => }/config/_index.md   |   0
 .../{legacy => }/docs-for-v2.0.x/_index.md    |   0
 .../{legacy => }/example-repos/_index.md      |   0
 .../pipelines/{legacy => }/example/_index.md  |   0
 .../v2.x/en/pipelines/legacy/_index.md        | 278 ------------------
 .../pipelines/{legacy => }/storage/_index.md  |   0
 .../v2.x/en/security/rancher-2.5/_index.md    |   2 -
 21 files changed, 293 insertions(+), 315 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md
 rename content/rancher/v2.x/en/pipelines/{legacy => }/concepts/_index.md (100%)
 rename content/rancher/v2.x/en/pipelines/{legacy => }/config/_index.md (100%)
 rename content/rancher/v2.x/en/pipelines/{legacy => }/docs-for-v2.0.x/_index.md (100%)
 rename content/rancher/v2.x/en/pipelines/{legacy => }/example-repos/_index.md (100%)
 rename content/rancher/v2.x/en/pipelines/{legacy => }/example/_index.md (100%)
 delete mode 100644 content/rancher/v2.x/en/pipelines/legacy/_index.md
 rename content/rancher/v2.x/en/pipelines/{legacy => }/storage/_index.md (100%)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md
deleted file mode 100644
index 6295dad2c16..00000000000
--- a/content/rancher/v2.x/en/cluster-provisioning/registered-clusters/_index.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-title: Registering Clusters
-weight: 6
----
-
-> This section is under construction.
-
-The following types of Kubernetes clusters can be registered in Rancher:
-
-- K3s
-- RancherD
-- EKS
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/deploy-across-clusters/_index.md b/content/rancher/v2.x/en/deploy-across-clusters/_index.md
index ebb2d67e8b2..4b7ce989eb0 100644
--- a/content/rancher/v2.x/en/deploy-across-clusters/_index.md
+++ b/content/rancher/v2.x/en/deploy-across-clusters/_index.md
@@ -3,14 +3,14 @@ title: Deploying Applications across Clusters
 weight: 13
 ---
 
-> This section is under construction.
+Rancher v2.5 introduced Fleet, a new way to deploy applications across clusters.
 
 ### Fleet
 
 _Available in v2.5_
 
-Refer to the [Fleet documentation.]()
+Fleet is GitOps at scale. For more information, refer to the [Fleet section.](./fleet)
 
 ### Legacy UI Documentation for Multi-cluster Apps
 
-Refer to the documentation [here.]()
\ No newline at end of file
+In Rancher prior to v2.5, the multi-cluster apps feature was used to deploy applications across clusters. Refer to the documentation [here.](./multi-cluster-apps)
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/helm-charts/_index.md b/content/rancher/v2.x/en/helm-charts/_index.md
index 3650ca0e355..b2c92e8c114 100644
--- a/content/rancher/v2.x/en/helm-charts/_index.md
+++ b/content/rancher/v2.x/en/helm-charts/_index.md
@@ -3,4 +3,10 @@ title: Helm Charts in Rancher
 weight: 12
 ---
 
-> This section is under construction.
\ No newline at end of file
+### Apps and Marketplace
+
+In Rancher v2.5, the [apps and marketplace feature](./apps-marketplace) is used to manage Helm charts, replacing the catalog system.
+
+### Catalogs
+
+In Rancher prior to v2.5, the [catalog system](./legacy-catalogs) was used to manage Helm charts.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/resources/_index.md b/content/rancher/v2.x/en/installation/resources/_index.md
index fd1c2975bbf..90156f1f1e7 100644
--- a/content/rancher/v2.x/en/installation/resources/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/_index.md
@@ -3,8 +3,6 @@ title: Resources
 weight: 4
 ---
 
-> This section is under construction.
-
 ### Docker Installations
 
 The [single-node Docker installation]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker) is for Rancher users that are wanting to test out Rancher. Instead of running on a Kubernetes cluster using Helm, you install the Rancher server component on a single node using a `docker run` command.
diff --git a/content/rancher/v2.x/en/installation/resources/advanced/_index.md b/content/rancher/v2.x/en/installation/resources/advanced/_index.md
index 6087cf17317..3c7b9e72cd6 100644
--- a/content/rancher/v2.x/en/installation/resources/advanced/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/advanced/_index.md
@@ -3,4 +3,4 @@ title: Advanced
 weight: 5
 ---
 
-> This section is under construction.
\ No newline at end of file
+The documents in this section contain resources for less common use cases.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
index 7289fbeef44..f3ce60bc7b6 100644
--- a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
@@ -3,8 +3,6 @@ title: Helm Chart Options
 weight: 2
 ---
 
-> This page is under construction.
-
 - [Common Options](#common-options)
 - [Advanced Options](#advanced-options)
 - [API Audit Log](#api-audit-log)
diff --git a/content/rancher/v2.x/en/installation/resources/encryption/_index.md b/content/rancher/v2.x/en/installation/resources/encryption/_index.md
index c49e516a62b..345f6b72818 100644
--- a/content/rancher/v2.x/en/installation/resources/encryption/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/encryption/_index.md
@@ -3,4 +3,4 @@ title: Encryption
 weight: 3
 ---
 
-> This section is under construction.
\ No newline at end of file
+The documents in this section contain information about certificate configuration and `cert-manager`.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md
index a85228adea1..895a2ba95ae 100644
--- a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/_index.md
@@ -3,4 +3,10 @@ title: "Don't have a Kubernetes cluster? Try one of these tutorials."
 weight: 4
 ---
 
-> This section is under construction.
\ No newline at end of file
+This section contains information on how to install a Kubernetes cluster that the Rancher server can be installed on.
+
+In Rancher prior to v2.4, the Rancher server needed to run on an RKE Kubernetes cluster.
+
+In Rancher v2.4.x, Rancher need to run on either an RKE Kubernetes cluster or a K3s Kubernetes cluster.
+
+In Rancher v2.5, Rancher can run on any Kubernetes cluster.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE/_index.md
index c644050196b..99edaa3e1ce 100644
--- a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE/_index.md
@@ -4,14 +4,15 @@ shortTitle: Set up RKE Kubernetes
 weight: 3
 ---
 
-> This page is under construction.
 
-This section describes how to install a Kubernetes cluster according to our [best practices for the Rancher server environment.]({{<baseurl>}}/rancher/v2.x/en/overview/architecture-recommendations/#environment-for-kubernetes-installations) This cluster should be dedicated to run only the Rancher server.
+This section describes how to install a Kubernetes cluster. This cluster should be dedicated to run only the Rancher server.
 
 For Rancher prior to v2.4, Rancher should be installed on an RKE Kubernetes cluster. RKE is a CNCF-certified Kubernetes distribution that runs entirely within Docker containers.
 
 As of Rancher v2.4, the Rancher management server can be installed on either an RKE cluster or a K3s Kubernetes cluster. K3s is also a fully certified Kubernetes distribution released by Rancher, but is newer than RKE. We recommend installing Rancher on K3s because K3s is easier to use, and more lightweight, with a binary size of less than 100 MB. Note: After Rancher is installed on an RKE cluster, there is no migration path to a K3s setup at this time.
 
+> As of Rancher v2.5, Rancher can run on any Kubernetes cluster, included hosted Kubernetes solutions such as Amazon EKS. So if you are installing Rancher v2.5, The below instructions represent only one possible way to install Kubernetes.
+
 The Rancher management server can only be run on Kubernetes cluster in an infrastructure provider where Kubernetes is installed using RKE or K3s. Use of Rancher on hosted Kubernetes providers, such as EKS, is not supported.
 
 For systems without direct internet access, refer to [Air Gap: Kubernetes install.]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/)
diff --git a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md b/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md
deleted file mode 100644
index 761f01d1c76..00000000000
--- a/content/rancher/v2.x/en/installation/resources/k8s-tutorials/ha-RKE2/_index.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Setting up a High-availability RKE2 Kubernetes Cluster
-shortTitle: Set up RKE2 Kubernetes
-weight: 4
----
-
-> This page is under construction
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/logging/legacy/_index.md b/content/rancher/v2.x/en/logging/legacy/_index.md
index 5df4db7e0cf..5d4cd1420dc 100644
--- a/content/rancher/v2.x/en/logging/legacy/_index.md
+++ b/content/rancher/v2.x/en/logging/legacy/_index.md
@@ -4,4 +4,4 @@ shortTitle: Legacy
 weight: 1
 ---
 
-> This page is under construction.
\ No newline at end of file
+This section contains documentation for the logging features that were available in Rancher prior to v2.5.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md b/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
index baa3262eb9d..fbe8842f68c 100644
--- a/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
+++ b/content/rancher/v2.x/en/monitoring-alerting/legacy/_index.md
@@ -4,4 +4,4 @@ shortTitle: Legacy
 weight: 1
 ---
 
-> This page is under construction.
\ No newline at end of file
+This section contains documentation related to the monitoring features available in Rancher prior to v2.5.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/pipelines/_index.md b/content/rancher/v2.x/en/pipelines/_index.md
index 0a996afa07a..58467078313 100644
--- a/content/rancher/v2.x/en/pipelines/_index.md
+++ b/content/rancher/v2.x/en/pipelines/_index.md
@@ -3,4 +3,272 @@ title: Pipelines
 weight: 11
 ---
 
-> This section is under construction.
\ No newline at end of file
+Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users.
+
+Setting up a pipeline can help developers deliver new software as quickly and efficiently as possible. Using Rancher, you can integrate with a GitHub repository to setup a continuous integration (CI) pipeline.
+
+After configuring Rancher and GitHub, you can deploy containers running Jenkins to automate a pipeline execution:
+
+- Build your application from code to image.
+- Validate your builds.
+- Deploy your build images to your cluster.
+- Run unit tests.  
+- Run regression tests.
+
+>**Notes:**
+>
+>- Pipelines improved in Rancher v2.1. Therefore, if you configured pipelines while using v2.0.x, you'll have to reconfigure them after upgrading to v2.1.
+>- Still using v2.0.x? See the pipeline documentation for [previous versions]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/docs-for-v2.0.x).
+>- Rancher's pipeline provides a simple CI/CD experience, but it does not offer the full power and flexibility of and is not a replacement of enterprise-grade Jenkins or other CI tools your team uses.
+
+This section covers the following topics:
+
+- [Concepts](#concepts)
+- [How Pipelines Work](#how-pipelines-work)
+- [Roles-based Access Control for Pipelines](#roles-based-access-control-for-pipelines)
+- [Setting up Pipelines](#setting-up-pipelines)
+  - [Configure version control providers](#1-configure-version-control-providers)
+  - [Configure repositories](#2-configure-repositories)
+  - [Configure the pipeline](#3-configure-the-pipeline)
+- [Pipeline Configuration Reference](#pipeline-configuration-reference)
+- [Running your Pipelines](#running-your-pipelines)
+- [Triggering a Pipeline](#triggering-a-pipeline)
+  - [Modifying the Event Triggers for the Repository](#modifying-the-event-triggers-for-the-repository)
+
+# Concepts
+
+For an explanation of concepts and terminology used in this section, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/concepts)
+
+# How Pipelines Work
+
+After enabling the ability to use pipelines in a project, you can configure multiple pipelines in each project. Each pipeline is unique and can be configured independently.
+
+A pipeline is configured off of a group of files that are checked into source code repositories. Users can configure their pipelines either through the Rancher UI or by adding a `.rancher-pipeline.yml` into the repository.
+
+Before pipelines can be configured, you will need to configure authentication to your version control provider, e.g. GitHub, GitLab, Bitbucket. If you haven't configured a version control provider, you can always use [Rancher's example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/) to view some common pipeline deployments.
+
+When you configure a pipeline in one of your projects, a namespace specifically for the pipeline is automatically created. The following components are deployed to it:
+
+  - **Jenkins:**
+
+    The pipeline's build engine. Because project users do not directly interact with Jenkins, it's managed and locked.
+
+    >**Note:**  There is no option to use existing Jenkins deployments as the pipeline engine.
+
+  - **Docker Registry:**
+
+    Out-of-the-box, the default target for your build-publish step is an internal Docker Registry. However, you can make configurations to push to a remote registry instead. The internal Docker Registry is only accessible from cluster nodes and cannot be directly accessed by users. Images are not persisted beyond the lifetime of the pipeline and should only be used in pipeline runs. If you need to access your images outside of pipeline runs, please push to an external registry.
+
+  - **Minio:**
+
+    Minio storage is used to store the logs for pipeline executions.
+
+  >**Note:** The managed Jenkins instance works statelessly, so don't worry about its data persistency. The Docker Registry and Minio instances use ephemeral volumes by default, which is fine for most use cases. If you want to make sure pipeline logs can survive node failures, you can configure persistent volumes for them, as described in [data persistency for pipeline components]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/storage).
+
+# Roles-based Access Control for Pipelines
+
+If you can access a project, you can enable repositories to start building pipelines.
+
+Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure version control providers and manage global pipeline execution settings.
+
+Project members can only configure repositories and pipelines.
+
+# Setting up Pipelines
+
+To set up pipelines, you will need to do the following:
+
+1. [Configure version control providers](#1-configure-version-control-providers)
+2. [Configure repositories](#2-configure-repositories)
+3. [Configure the pipeline](#3-configure-the-pipeline)
+
+### 1. Configure Version Control Providers
+
+Before you can start configuring a pipeline for your repository, you must configure and authorize a version control provider.
+
+| Provider  | Available as of  |
+| --- | --- |
+| GitHub  | v2.0.0           |
+| GitLab | v2.1.0 |
+| Bitbucket | v2.2.0 |
+
+Select your provider's tab below and follow the directions.
+
+{{% tabs %}}
+{{% tab "GitHub" %}}
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
+
+1. Follow the directions displayed to **Setup a Github application**. Rancher redirects you to Github to setup an OAuth App in Github.
+
+1. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.
+
+1. If you're using GitHub for enterprise, select **Use a private github enterprise installation**. Enter the host address of your GitHub installation.
+
+1. Click **Authenticate**.
+
+{{% /tab %}}
+{{% tab "GitLab" %}}
+
+_Available as of v2.1.0_
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
+
+1. Follow the directions displayed to **Setup a GitLab application**. Rancher redirects you to GitLab.
+
+1. From GitLab, copy the **Application ID** and **Secret**. Paste them into Rancher.
+
+1. If you're using GitLab for enterprise setup, select **Use a private gitlab enterprise installation**. Enter the host address of your GitLab installation.
+
+1. Click **Authenticate**.
+
+>**Note:**
+> 1. Pipeline uses Gitlab [v4 API](https://docs.gitlab.com/ee/api/v3_to_v4.html) and the supported Gitlab version is 9.0+.  
+> 2. If you use GitLab 10.7+ and your Rancher setup is in a local network, enable the **Allow requests to the local network from hooks and services** option in GitLab admin settings.
+{{% /tab %}}
+{{% tab "Bitbucket Cloud" %}}
+
+_Available as of v2.2.0_
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar.
+
+1. Choose the **Use public Bitbucket Cloud** option.
+
+1. Follow the directions displayed to **Setup a Bitbucket Cloud application**. Rancher redirects you to Bitbucket to setup an OAuth consumer in Bitbucket.
+
+1. From Bitbucket, copy the consumer **Key** and **Secret**. Paste them into Rancher.
+
+1. Click **Authenticate**.
+
+{{% /tab %}}
+{{% tab "Bitbucket Server" %}}
+
+_Available as of v2.2.0_
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Select **Tools > Pipelines** in the navigation bar.
+
+1. Choose the **Use private Bitbucket Server setup** option.
+
+1. Follow the directions displayed to **Setup a Bitbucket Server application**.
+
+1. Enter the host address of your Bitbucket server installation.
+
+1. Click **Authenticate**.
+
+>**Note:**
+> Bitbucket server needs to do SSL verification when sending webhooks to Rancher. Please ensure that Rancher server's certificate is trusted by the Bitbucket server. There are two options:
+>
+> 1. Setup Rancher server with a certificate from a trusted CA.
+> 1. If you're using self-signed certificates, import Rancher server's certificate to the Bitbucket server. For instructions, see the Bitbucket server documentation for [configuring self-signed certificates](https://confluence.atlassian.com/bitbucketserver/if-you-use-self-signed-certificates-938028692.html).
+>
+{{% /tab %}}
+{{% /tabs %}}
+
+**Result:** After the version control provider is authenticated, you will be automatically re-directed to start configuring which repositories you want start using with a pipeline.
+
+### 2. Configure Repositories
+
+After the version control provider is authorized, you are automatically re-directed to start configuring which repositories that you want start using pipelines with. Even if someone else has set up the version control provider, you will see their repositories and can build a pipeline.
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Click on **Configure Repositories**.
+
+1. A list of repositories are displayed. If you are configuring repositories the first time, click on **Authorize & Fetch Your Own Repositories** to fetch your repository list.
+
+1. For each repository that you want to set up a pipeline, click on **Enable**.
+
+1. When you're done enabling all your repositories, click on **Done**.
+
+**Results:** You have a list of repositories that you can start configuring pipelines for.
+
+### 3. Configure the Pipeline
+
+Now that repositories are added to your project, you can start configuring the pipeline by adding automated stages and steps. For your convenience, there are multiple built-in step types for dedicated tasks.
+
+1. From the **Global** view, navigate to the project that you want to configure pipelines.
+
+1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Find the repository that you want to set up a pipeline for.
+
+1. Configure the pipeline through the UI or using a yaml file in the repository, i.e. `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`. Pipeline configuration is split into stages and steps. Stages must fully complete before moving onto the next stage, but steps in a stage run concurrently. For each stage, you can add different step types. Note: As you build out each step, there are different advanced options based on the step type. Advanced options include trigger rules, environment variables, and secrets. For more information on configuring the pipeline through the UI or the YAML file, refer to the [pipeline configuration reference.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config)
+
+   * If you are going to use the UI, select the vertical **&#8942; > Edit Config** to configure the pipeline using the UI. After the pipeline is configured, you must view the YAML file and push it to the repository.
+   * If you are going to use the YAML file, select the vertical **&#8942; > View/Edit YAML** to configure the pipeline. If you choose to use a YAML file, you need to push it to the repository after any changes in order for it to be updated in the repository. When editing the pipeline configuration, it takes a few moments for Rancher to check for an existing pipeline configuration.
+
+1. Select which `branch` to use from the list of branches.
+
+1. _Available as of v2.2.0_ Optional: Set up notifications.
+
+1. Set up the trigger rules for the pipeline.
+
+1. Enter a **Timeout** for the pipeline. 
+
+1. When all the stages and steps are configured, click **Done**.
+
+**Results:** Your pipeline is now configured and ready to be run.
+
+
+# Pipeline Configuration Reference
+
+Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config) for details on how to configure a pipeline to:
+
+- Run a script
+- Build and publish images
+- Publish catalog templates
+- Deploy YAML
+- Deploy a catalog app
+
+The configuration reference also covers how to configure:
+
+- Notifications
+- Timeouts
+- The rules that trigger a pipeline
+- Environment variables
+- Secrets
+
+
+# Running your Pipelines
+
+Run your pipeline for the first time. From the project view in Rancher, go to **Resources > Pipelines.** (In versions prior to v2.3.0, go to the **Pipelines** tab.) Find your pipeline and select the vertical **&#8942; > Run**.
+
+During this initial run, your pipeline is tested, and the following pipeline components are deployed to your project as workloads in a new namespace dedicated to the pipeline:
+
+- `docker-registry`
+- `jenkins`
+- `minio`
+
+This process takes several minutes. When it completes, you can view each pipeline component from the project **Workloads** tab.
+
+# Triggering a Pipeline
+
+When a repository is enabled, a webhook is automatically set in the version control provider. By default, the pipeline is triggered by a **push** event to a repository, but you can modify the event(s) that trigger running the pipeline.
+
+Available Events:
+
+* **Push**: Whenever a commit is pushed to the branch in the repository, the pipeline is triggered.
+* **Pull Request**: Whenever a pull request is made to the repository, the pipeline is triggered.
+* **Tag**: When a tag is created in the repository, the pipeline is triggered.
+
+> **Note:** This option doesn't exist for Rancher's [example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/).
+
+### Modifying the Event Triggers for the Repository
+
+1. From the **Global** view, navigate to the project that you want to modify the event trigger for the pipeline.
+
+1. 1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
+
+1. Find the repository that you want to modify the event triggers. Select the vertical **&#8942; > Setting**.
+
+1. Select which event triggers (**Push**, **Pull Request** or **Tag**) you want for the repository.
+
+1. Click **Save**.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/pipelines/legacy/concepts/_index.md b/content/rancher/v2.x/en/pipelines/concepts/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/pipelines/legacy/concepts/_index.md
rename to content/rancher/v2.x/en/pipelines/concepts/_index.md
diff --git a/content/rancher/v2.x/en/pipelines/legacy/config/_index.md b/content/rancher/v2.x/en/pipelines/config/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/pipelines/legacy/config/_index.md
rename to content/rancher/v2.x/en/pipelines/config/_index.md
diff --git a/content/rancher/v2.x/en/pipelines/legacy/docs-for-v2.0.x/_index.md b/content/rancher/v2.x/en/pipelines/docs-for-v2.0.x/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/pipelines/legacy/docs-for-v2.0.x/_index.md
rename to content/rancher/v2.x/en/pipelines/docs-for-v2.0.x/_index.md
diff --git a/content/rancher/v2.x/en/pipelines/legacy/example-repos/_index.md b/content/rancher/v2.x/en/pipelines/example-repos/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/pipelines/legacy/example-repos/_index.md
rename to content/rancher/v2.x/en/pipelines/example-repos/_index.md
diff --git a/content/rancher/v2.x/en/pipelines/legacy/example/_index.md b/content/rancher/v2.x/en/pipelines/example/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/pipelines/legacy/example/_index.md
rename to content/rancher/v2.x/en/pipelines/example/_index.md
diff --git a/content/rancher/v2.x/en/pipelines/legacy/_index.md b/content/rancher/v2.x/en/pipelines/legacy/_index.md
deleted file mode 100644
index 393ede2e437..00000000000
--- a/content/rancher/v2.x/en/pipelines/legacy/_index.md
+++ /dev/null
@@ -1,278 +0,0 @@
----
-title: Legacy Pipeline Documentation
-shortTitle: Legacy
-weight: 1
-aliases:
-  - /rancher/v2.x/en/tools/pipelines/concepts/
-
----
-
-Rancher's pipeline provides a simple CI/CD experience. Use it to automatically checkout code, run builds or scripts, publish Docker images or catalog applications, and deploy the updated software to users.
-
-Setting up a pipeline can help developers deliver new software as quickly and efficiently as possible. Using Rancher, you can integrate with a GitHub repository to setup a continuous integration (CI) pipeline.
-
-After configuring Rancher and GitHub, you can deploy containers running Jenkins to automate a pipeline execution:
-
-- Build your application from code to image.
-- Validate your builds.
-- Deploy your build images to your cluster.
-- Run unit tests.  
-- Run regression tests.
-
->**Notes:**
->
->- Pipelines improved in Rancher v2.1. Therefore, if you configured pipelines while using v2.0.x, you'll have to reconfigure them after upgrading to v2.1.
->- Still using v2.0.x? See the pipeline documentation for [previous versions]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/docs-for-v2.0.x).
->- Rancher's pipeline provides a simple CI/CD experience, but it does not offer the full power and flexibility of and is not a replacement of enterprise-grade Jenkins or other CI tools your team uses.
-
-This section covers the following topics:
-
-- [Concepts](#concepts)
-- [How Pipelines Work](#how-pipelines-work)
-- [Roles-based Access Control for Pipelines](#roles-based-access-control-for-pipelines)
-- [Setting up Pipelines](#setting-up-pipelines)
-  - [Configure version control providers](#1-configure-version-control-providers)
-  - [Configure repositories](#2-configure-repositories)
-  - [Configure the pipeline](#3-configure-the-pipeline)
-- [Pipeline Configuration Reference](#pipeline-configuration-reference)
-- [Running your Pipelines](#running-your-pipelines)
-- [Triggering a Pipeline](#triggering-a-pipeline)
-  - [Modifying the Event Triggers for the Repository](#modifying-the-event-triggers-for-the-repository)
-
-# Concepts
-
-For an explanation of concepts and terminology used in this section, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/concepts)
-
-# How Pipelines Work
-
-After enabling the ability to use pipelines in a project, you can configure multiple pipelines in each project. Each pipeline is unique and can be configured independently.
-
-A pipeline is configured off of a group of files that are checked into source code repositories. Users can configure their pipelines either through the Rancher UI or by adding a `.rancher-pipeline.yml` into the repository.
-
-Before pipelines can be configured, you will need to configure authentication to your version control provider, e.g. GitHub, GitLab, Bitbucket. If you haven't configured a version control provider, you can always use [Rancher's example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/) to view some common pipeline deployments.
-
-When you configure a pipeline in one of your projects, a namespace specifically for the pipeline is automatically created. The following components are deployed to it:
-
-  - **Jenkins:**
-
-    The pipeline's build engine. Because project users do not directly interact with Jenkins, it's managed and locked.
-
-    >**Note:**  There is no option to use existing Jenkins deployments as the pipeline engine.
-
-  - **Docker Registry:**
-
-    Out-of-the-box, the default target for your build-publish step is an internal Docker Registry. However, you can make configurations to push to a remote registry instead. The internal Docker Registry is only accessible from cluster nodes and cannot be directly accessed by users. Images are not persisted beyond the lifetime of the pipeline and should only be used in pipeline runs. If you need to access your images outside of pipeline runs, please push to an external registry.
-
-  - **Minio:**
-
-    Minio storage is used to store the logs for pipeline executions.
-
-  >**Note:** The managed Jenkins instance works statelessly, so don't worry about its data persistency. The Docker Registry and Minio instances use ephemeral volumes by default, which is fine for most use cases. If you want to make sure pipeline logs can survive node failures, you can configure persistent volumes for them, as described in [data persistency for pipeline components]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/storage).
-
-# Roles-based Access Control for Pipelines
-
-If you can access a project, you can enable repositories to start building pipelines.
-
-Only [administrators]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/), [cluster owners or members]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#cluster-roles), or [project owners]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-roles) can configure version control providers and manage global pipeline execution settings.
-
-Project members can only configure repositories and pipelines.
-
-# Setting up Pipelines
-
-To set up pipelines, you will need to do the following:
-
-1. [Configure version control providers](#1-configure-version-control-providers)
-2. [Configure repositories](#2-configure-repositories)
-3. [Configure the pipeline](#3-configure-the-pipeline)
-
-### 1. Configure Version Control Providers
-
-Before you can start configuring a pipeline for your repository, you must configure and authorize a version control provider.
-
-| Provider  | Available as of  |
-| --- | --- |
-| GitHub  | v2.0.0           |
-| GitLab | v2.1.0 |
-| Bitbucket | v2.2.0 |
-
-Select your provider's tab below and follow the directions.
-
-{{% tabs %}}
-{{% tab "GitHub" %}}
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
-
-1. Follow the directions displayed to **Setup a Github application**. Rancher redirects you to Github to setup an OAuth App in Github.
-
-1. From GitHub, copy the **Client ID** and **Client Secret**. Paste them into Rancher.
-
-1. If you're using GitHub for enterprise, select **Use a private github enterprise installation**. Enter the host address of your GitHub installation.
-
-1. Click **Authenticate**.
-
-{{% /tab %}}
-{{% tab "GitLab" %}}
-
-_Available as of v2.1.0_
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar. In versions prior to v2.2.0, you can select **Resources > Pipelines**.
-
-1. Follow the directions displayed to **Setup a GitLab application**. Rancher redirects you to GitLab.
-
-1. From GitLab, copy the **Application ID** and **Secret**. Paste them into Rancher.
-
-1. If you're using GitLab for enterprise setup, select **Use a private gitlab enterprise installation**. Enter the host address of your GitLab installation.
-
-1. Click **Authenticate**.
-
->**Note:**
-> 1. Pipeline uses Gitlab [v4 API](https://docs.gitlab.com/ee/api/v3_to_v4.html) and the supported Gitlab version is 9.0+.  
-> 2. If you use GitLab 10.7+ and your Rancher setup is in a local network, enable the **Allow requests to the local network from hooks and services** option in GitLab admin settings.
-{{% /tab %}}
-{{% tab "Bitbucket Cloud" %}}
-
-_Available as of v2.2.0_
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar.
-
-1. Choose the **Use public Bitbucket Cloud** option.
-
-1. Follow the directions displayed to **Setup a Bitbucket Cloud application**. Rancher redirects you to Bitbucket to setup an OAuth consumer in Bitbucket.
-
-1. From Bitbucket, copy the consumer **Key** and **Secret**. Paste them into Rancher.
-
-1. Click **Authenticate**.
-
-{{% /tab %}}
-{{% tab "Bitbucket Server" %}}
-
-_Available as of v2.2.0_
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Select **Tools > Pipelines** in the navigation bar.
-
-1. Choose the **Use private Bitbucket Server setup** option.
-
-1. Follow the directions displayed to **Setup a Bitbucket Server application**.
-
-1. Enter the host address of your Bitbucket server installation.
-
-1. Click **Authenticate**.
-
->**Note:**
-> Bitbucket server needs to do SSL verification when sending webhooks to Rancher. Please ensure that Rancher server's certificate is trusted by the Bitbucket server. There are two options:
->
-> 1. Setup Rancher server with a certificate from a trusted CA.
-> 1. If you're using self-signed certificates, import Rancher server's certificate to the Bitbucket server. For instructions, see the Bitbucket server documentation for [configuring self-signed certificates](https://confluence.atlassian.com/bitbucketserver/if-you-use-self-signed-certificates-938028692.html).
->
-{{% /tab %}}
-{{% /tabs %}}
-
-**Result:** After the version control provider is authenticated, you will be automatically re-directed to start configuring which repositories you want start using with a pipeline.
-
-### 2. Configure Repositories
-
-After the version control provider is authorized, you are automatically re-directed to start configuring which repositories that you want start using pipelines with. Even if someone else has set up the version control provider, you will see their repositories and can build a pipeline.
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Click on **Configure Repositories**.
-
-1. A list of repositories are displayed. If you are configuring repositories the first time, click on **Authorize & Fetch Your Own Repositories** to fetch your repository list.
-
-1. For each repository that you want to set up a pipeline, click on **Enable**.
-
-1. When you're done enabling all your repositories, click on **Done**.
-
-**Results:** You have a list of repositories that you can start configuring pipelines for.
-
-### 3. Configure the Pipeline
-
-Now that repositories are added to your project, you can start configuring the pipeline by adding automated stages and steps. For your convenience, there are multiple built-in step types for dedicated tasks.
-
-1. From the **Global** view, navigate to the project that you want to configure pipelines.
-
-1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Find the repository that you want to set up a pipeline for.
-
-1. Configure the pipeline through the UI or using a yaml file in the repository, i.e. `.rancher-pipeline.yml` or `.rancher-pipeline.yaml`. Pipeline configuration is split into stages and steps. Stages must fully complete before moving onto the next stage, but steps in a stage run concurrently. For each stage, you can add different step types. Note: As you build out each step, there are different advanced options based on the step type. Advanced options include trigger rules, environment variables, and secrets. For more information on configuring the pipeline through the UI or the YAML file, refer to the [pipeline configuration reference.]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config)
-
-   * If you are going to use the UI, select the vertical **&#8942; > Edit Config** to configure the pipeline using the UI. After the pipeline is configured, you must view the YAML file and push it to the repository.
-   * If you are going to use the YAML file, select the vertical **&#8942; > View/Edit YAML** to configure the pipeline. If you choose to use a YAML file, you need to push it to the repository after any changes in order for it to be updated in the repository. When editing the pipeline configuration, it takes a few moments for Rancher to check for an existing pipeline configuration.
-
-1. Select which `branch` to use from the list of branches.
-
-1. _Available as of v2.2.0_ Optional: Set up notifications.
-
-1. Set up the trigger rules for the pipeline.
-
-1. Enter a **Timeout** for the pipeline. 
-
-1. When all the stages and steps are configured, click **Done**.
-
-**Results:** Your pipeline is now configured and ready to be run.
-
-
-# Pipeline Configuration Reference
-
-Refer to [this page]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/config) for details on how to configure a pipeline to:
-
-- Run a script
-- Build and publish images
-- Publish catalog templates
-- Deploy YAML
-- Deploy a catalog app
-
-The configuration reference also covers how to configure:
-
-- Notifications
-- Timeouts
-- The rules that trigger a pipeline
-- Environment variables
-- Secrets
-
-
-# Running your Pipelines
-
-Run your pipeline for the first time. From the project view in Rancher, go to **Resources > Pipelines.** (In versions prior to v2.3.0, go to the **Pipelines** tab.) Find your pipeline and select the vertical **&#8942; > Run**.
-
-During this initial run, your pipeline is tested, and the following pipeline components are deployed to your project as workloads in a new namespace dedicated to the pipeline:
-
-- `docker-registry`
-- `jenkins`
-- `minio`
-
-This process takes several minutes. When it completes, you can view each pipeline component from the project **Workloads** tab.
-
-# Triggering a Pipeline
-
-When a repository is enabled, a webhook is automatically set in the version control provider. By default, the pipeline is triggered by a **push** event to a repository, but you can modify the event(s) that trigger running the pipeline.
-
-Available Events:
-
-* **Push**: Whenever a commit is pushed to the branch in the repository, the pipeline is triggered.
-* **Pull Request**: Whenever a pull request is made to the repository, the pipeline is triggered.
-* **Tag**: When a tag is created in the repository, the pipeline is triggered.
-
-> **Note:** This option doesn't exist for Rancher's [example repositories]({{<baseurl>}}/rancher/v2.x/en/k8s-in-rancher/pipelines/example-repos/).
-
-### Modifying the Event Triggers for the Repository
-
-1. From the **Global** view, navigate to the project that you want to modify the event trigger for the pipeline.
-
-1. 1. Click **Resources > Pipelines.** In versions prior to v2.3.0, click **Workloads > Pipelines.**
-
-1. Find the repository that you want to modify the event triggers. Select the vertical **&#8942; > Setting**.
-
-1. Select which event triggers (**Push**, **Pull Request** or **Tag**) you want for the repository.
-
-1. Click **Save**.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/pipelines/legacy/storage/_index.md b/content/rancher/v2.x/en/pipelines/storage/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/pipelines/legacy/storage/_index.md
rename to content/rancher/v2.x/en/pipelines/storage/_index.md
diff --git a/content/rancher/v2.x/en/security/rancher-2.5/_index.md b/content/rancher/v2.x/en/security/rancher-2.5/_index.md
index 65db8244e94..02736328b26 100644
--- a/content/rancher/v2.x/en/security/rancher-2.5/_index.md
+++ b/content/rancher/v2.x/en/security/rancher-2.5/_index.md
@@ -3,6 +3,4 @@ title: Rancher v2.5
 weight: 1
 ---
 
-> This section is under construction.
-
 This section contains the hardening and self-assessment guides for Rancher v2.5.
\ No newline at end of file

From 90ecc08658c7660d0196622ba2e7270eaf655d49 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 18:48:03 -0700
Subject: [PATCH 257/265] Update installation docs

---
 .../rancher/v2.x/en/installation/_index.md    | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md
index 7daf5a1c0e3..7feaafb17ac 100644
--- a/content/rancher/v2.x/en/installation/_index.md
+++ b/content/rancher/v2.x/en/installation/_index.md
@@ -16,14 +16,19 @@ In this section,
 - **RKE (Rancher Kubernetes Engine)** is a certified Kubernetes distribution and CLI/library which creates and manages a Kubernetes cluster.
 - **K3s (Lightweight Kubernetes)** is also a fully compliant Kubernetes distribution. It is newer than RKE, easier to use, and more lightweight, with a binary size of less than 100 MB. As of Rancher v2.4, Rancher can be installed on a K3s cluster.
 
+### Changes to Installation in Rancher v2.5
+
+In Rancher v2.5, the Rancher management server can be installed on any Kubernetes cluster, including hosted clusters, such as Amazon EKS clusters.
+
+For Docker installations, a local Kubernetes cluster is installed in the single Docker container, and Rancher is installed on the local cluster.
+
 ### Overview of Installation Options
 
 Rancher can be installed on these main architectures:
 
 - **High-availability Kubernetes Install:** We recommend using [Helm,]({{<baseurl>}}/rancher/v2.x/en/overview/concepts/#about-helm) a Kubernetes package manager, to install Rancher on multiple nodes on a dedicated Kubernetes cluster. For RKE clusters, three nodes are required to achieve a high-availability cluster. For K3s clusters, only two nodes are required.
 - **Single-node Kubernetes Install:** Another option is to install Rancher with Helm on a Kubernetes cluster, but to only use a single node in the cluster. In this case, the Rancher server doesn't have high availability, which is important for running Rancher in production. However, this option is useful if you want to save resources by using a single node in the short term, while preserving a high-availability migration path. In the future, you can add nodes to the cluster to get a high-availability Rancher server.
-- **Docker Install:** For test and demonstration purposes, Rancher can be installed with Docker on a single node. This installation works out-of-the-box, but there is no migration path from a Docker installation to a high-availability installation on a Kubernetes cluster. Therefore, you may want to use a Kubernetes installation from the start.
-
+- **Docker Install:** For test and demonstration purposes, Rancher can be installed with Docker on a single node. This installation works out-of-the-box, but there is no migration path from a Docker installation to a high-availability installation. Therefore, you may want to use a Kubernetes installation from the start.
 
 There are also separate instructions for installing Rancher in an air gap environment or behind an HTTP proxy:
 
@@ -35,9 +40,15 @@ There are also separate instructions for installing Rancher in an air gap enviro
 
 We recommend installing Rancher on a Kubernetes cluster, because in a multi-node cluster, the Rancher management server becomes highly available. This high-availability configuration helps maintain consistent access to the downstream Kubernetes clusters that Rancher will manage.
 
-For that reason, we recommend that for a production-grade architecture, you should set up a high-availability Kubernetes cluster using either RKE or K3s, then install Rancher on it. After Rancher is installed, you can use Rancher to deploy and manage Kubernetes clusters.
+For that reason, we recommend that for a production-grade architecture, you should set up a high-availability Kubernetes cluster, then install Rancher on it. After Rancher is installed, you can use Rancher to deploy and manage Kubernetes clusters.
 
-For testing or demonstration purposes, you can install Rancher in single Docker container. In this Docker install, you can use Rancher to set up Kubernetes clusters out-of-the-box.
+> The type of cluster that Rancher needs to be installed on depends on the Rancher version. 
+> 
+> For Rancher v2.5, any Kubernetes cluster can be used.
+> For Rancher v2.4.x, either an RKE Kubernetes cluster or K3s Kubernetes cluster can be used. 
+> For Rancher prior to v2.4, an RKE cluster must be used.
+
+For testing or demonstration purposes, you can install Rancher in single Docker container. In this Docker install, you can use Rancher to set up Kubernetes clusters out-of-the-box. The Docker install allows you to explore the Rancher server functionality, but it is intended to be used for development and testing purposes only.
 
 Our [instructions for installing Rancher on Kubernetes]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install) describe how to first use K3s or RKE to create and manage a Kubernetes cluster, then install Rancher onto that cluster.
 

From 92c1a9e745db790d6b4afbc5f2e0d17c4ca65e14 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 18:49:00 -0700
Subject: [PATCH 258/265] Remove 'under construction' notice

---
 .../upgrades-rollbacks/rollbacks/_index.md                   | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md
index 8c53a2b5e3f..d595b448dae 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md
@@ -5,10 +5,7 @@ aliases:
   - /rancher/v2.x/en/upgrades/rollbacks
 ---
 
-
-> This page is under construction.
-
-This section contains information about how to rollback your Rancher server to a previous version.
+This section contains information about how to roll back your Rancher server to a previous version.
 
 If you upgrade Rancher and the upgrade does not complete successfully, you may need to [restore Rancher from backup.](../../backups/restores)
 

From f0c5521edebce47f2a8a3fdd30aa3021f18ed9db Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 18:49:58 -0700
Subject: [PATCH 259/265] Say that restrictedAdmin chart option is available in
 v2.5

---
 .../v2.x/en/installation/resources/chart-options/_index.md      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
index f3ce60bc7b6..c83dd44a617 100644
--- a/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
+++ b/content/rancher/v2.x/en/installation/resources/chart-options/_index.md
@@ -58,7 +58,7 @@ weight: 2
 | `tls`                          | "ingress"                                             | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external"                                           |
 | `systemDefaultRegistry`        | ""                                                    | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/                   |
 | `useBundledSystemChart`        | `false`                                               | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations.  |
-| `restrictedAdmin` | `false` | When this option is set to true, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#restricted-admin) |
+| `restrictedAdmin` | `false` | _Available in Rancher v2.5_ When this option is set to true, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#restricted-admin) |
 
 <br/>
 

From cd10a69fd32e4695719d3c1f1cb4905c34284084 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 19:02:25 -0700
Subject: [PATCH 260/265] Document registered clusters

---
 .../cluster-provisioning/imported-clusters/_index.md  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
index 5f37d312224..b5396fa7e2b 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/imported-clusters/_index.md
@@ -16,6 +16,9 @@ For all imported Kubernetes clusters except for K3s clusters, the configuration
 
 Rancher v2.4 added the capability to import a K3s cluster into Rancher, as well as the ability to upgrade Kubernetes by editing the cluster in the Rancher UI.
 
+> Rancher v2.5 added the ability to [register clusters.](#changes-in-rancher-v2-5) This page will be updated to reflect the new functionality.
+
+- [Changes in Rancher v2.5](#changes-in-rancher-v2-5)
 - [Features](#features)
 - [Prerequisites](#prerequisites)
 - [Importing a cluster](#importing-a-cluster)
@@ -25,6 +28,14 @@ Rancher v2.4 added the capability to import a K3s cluster into Rancher, as well
   - [Debug Logging and Troubleshooting for Imported K3s clusters](#debug-logging-and-troubleshooting-for-imported-k3s-clusters)
 - [Annotating imported clusters](#annotating-imported-clusters)
 
+# Changes in Rancher v2.5
+
+In Rancher v2.5, the cluster registration feature replaced the feature to import clusters. Rancher has more capabilities to manage registered clusters compared to imported clusters, and registering a cluster allows Rancher to treat it as though it were created in Rancher.
+
+Amazon EKS clusters can now be registered in Rancher. For the most part, registered EKS clusters and EKS clusters created in Rancher are treated the same way in the Rancher UI, except for deletion.
+
+When you delete an EKS cluster that was created in Rancher, the cluster is destroyed. When you delete an EKS that was registered in Rancher, it is disconnected from the Rancher server, but it still exists and you can still access it in the same way you did before it was registered in Rancher.
+
 # Features
 
 After importing a cluster, the cluster owner can:

From b901e87bb79e7cf43874b6cdd36ab02dff894410 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 20:03:59 -0700
Subject: [PATCH 261/265] Update installation docs

---
 .../rancher/v2.x/en/installation/_index.md    |   2 +
 .../install-rancher-on-k8s/_index.md          | 268 ++++++++++++++++-
 .../install-rancher-on-k8s/install/_index.md  | 274 ------------------
 .../upgrades-rollbacks/_index.md              |   4 +-
 .../upgrades-rollbacks/rollbacks/_index.md    |   0
 .../rollbacks/ha-server-rollbacks/_index.md   |   4 +-
 .../upgrades-rollbacks/upgrades/_index.md     |   0
 .../upgrades-rollbacks/upgrades/ha/_index.md  |   2 +-
 .../upgrades/ha/helm2/_index.md               |   0
 .../migrating-from-rke-add-on/_index.md       |   0
 .../upgrades/namespace-migration/_index.md    |   0
 11 files changed, 270 insertions(+), 284 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/_index.md
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/_index.md (77%)
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/rollbacks/_index.md (100%)
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md (63%)
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/upgrades/_index.md (100%)
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/upgrades/ha/_index.md (95%)
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/upgrades/ha/helm2/_index.md (100%)
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md (100%)
 rename content/rancher/v2.x/en/installation/{install-rancher-on-k8s => }/upgrades-rollbacks/upgrades/namespace-migration/_index.md (100%)

diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md
index 7feaafb17ac..1435a639af5 100644
--- a/content/rancher/v2.x/en/installation/_index.md
+++ b/content/rancher/v2.x/en/installation/_index.md
@@ -22,6 +22,8 @@ In Rancher v2.5, the Rancher management server can be installed on any Kubernete
 
 For Docker installations, a local Kubernetes cluster is installed in the single Docker container, and Rancher is installed on the local cluster.
 
+The `restrictedAdmin` Helm chart option was added. When this option is set to true, the initial Rancher user has restricted access to the local Kubernetes cluster to prevent privilege escalation. For more information, see the section about the [restricted-admin role.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#restricted-admin)
+
 ### Overview of Installation Options
 
 Rancher can be installed on these main architectures:
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
index 9d8b186a279..46f5977678b 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
@@ -4,14 +4,270 @@ description: Learn how to install Rancher in development and production environm
 weight: 3
 ---
 
-Rancher is both a platform and a Kubernetes distribution. In this section you'll learn how to install Rancher as a Helm chart on an existing Kubernetes cluster, without installing the Rancher Kubernetes distribution.
+> **Prerequisite:**
+> Set up the Rancher Kubernetes cluster. As of Rancher v2.5, Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
 
-There are two main ways that Rancher can be installed:
+# Install the Rancher Helm Chart
 
-1. You can use Helm to install the Rancher Helm chart on any Kubernetes cluster.
-2. You can use the Rancher CLI to install a Rancher Kubernetes cluster. This cluster comes with the Rancher Helm chart built in.
+Rancher is installed using the Helm package manager for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents.
 
-The installation path that you choose will affect the way that you upgrade Rancher, but not the way that Rancher is backed up and restored.
+With Helm, we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at https://helm.sh/.
 
-This section focuses on the installation path in which the Rancher CLI is used to provision a new Kubernetes cluster with the Rancher Helm chart built in.
+For systems without direct internet access, see [Air Gap: Kubernetes install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/).
 
+To choose a Rancher version to install, refer to [Choosing a Rancher Version.]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags)
+
+To choose a version of Helm to install Rancher with, refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version)
+
+> **Note:** The installation instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older installation instructions for Rancher installed on an RKE Kubernetes cluster with Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
+
+To set up Rancher,
+
+1. [Install the required CLI tools](#1-install-the-required-cli-tools)
+2. [Add the Helm chart repository](#2-add-the-helm-chart-repository)
+3. [Create a namespace for Rancher](#3-create-a-namespace-for-rancher)
+4. [Choose your SSL configuration](#4-choose-your-ssl-configuration)
+5. [Install cert-manager](#5-install-cert-manager) (unless you are bringing your own certificates, or TLS will be terminated on a load balancer)
+6. [Install Rancher with Helm and your chosen certificate option](#6-install-rancher-with-helm-and-your-chosen-certificate-option)
+7. [Verify that the Rancher server is successfully deployed](#7-verify-that-the-rancher-server-is-successfully-deployed)
+8. [Save your options](#8-save-your-options)
+
+### 1. Install the Required CLI Tools
+
+The following CLI tools are required for setting up the Kubernetes cluster. Please make sure these tools are installed and available in your `$PATH`.
+
+Refer to the [instructions provided by the Helm project](https://helm.sh/docs/intro/install/) for your specific platform.
+
+- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool.
+- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
+
+### 2. Add the Helm Chart Repository
+
+Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
+
+{{< release-channel >}}
+
+```
+helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
+```
+
+### 3. Create a Namespace for Rancher
+
+We'll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be `cattle-system`:
+
+```
+kubectl create namespace cattle-system
+```
+
+### 4. Choose your SSL Configuration
+
+The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
+
+> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
+
+There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
+
+- **Rancher-generated TLS certificate:** In this case, you will need to install `cert-manager` into the cluster. Rancher utilizes `cert-manager` to issue and maintain its certificates. Rancher will generate a CA certificate of its own, and sign a cert using that CA. `cert-manager` is then responsible for managing that certificate.
+- **Let's Encrypt:** The Let's Encrypt option also uses `cert-manager`. However, in this case, cert-manager is combined with a special Issuer for Let's Encrypt that performs all actions (including request and validation) necessary for getting a Let's Encrypt issued cert. This configuration uses HTTP validation (`HTTP-01`), so the load balancer must have a public DNS record and be accessible from the internet.
+- **Bring your own certificate:** This option allows you to bring your own public- or private-CA signed certificate. Rancher will use that certificate to secure websocket and HTTPS traffic. In this case, you must upload this certificate (and associated key) as PEM-encoded files with the name `tls.crt` and `tls.key`. If you are using a private CA, you must also upload that certificate. This is due to the fact that this private CA may not be trusted by your nodes. Rancher will take that CA certificate, and generate a checksum from it, which the various Rancher components will use to validate their connection to Rancher.
+
+
+| Configuration                  | Helm Chart Option           | Requires cert-manager                 |
+| ------------------------------ | ----------------------- | ------------------------------------- |
+| Rancher Generated Certificates (Default) | `ingress.tls.source=rancher`  | [yes](#5-install-cert-manager) |
+| Let’s Encrypt                  | `ingress.tls.source=letsEncrypt`  | [yes](#5-install-cert-manager) |
+| Certificates from Files        | `ingress.tls.source=secret`        | no               |
+
+### 5. Install cert-manager
+
+> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination). 
+
+This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`).
+
+{{% accordion id="cert-manager" label="Click to Expand" %}}
+
+> **Important:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
+
+These instructions are adapted from the [official cert-manager documentation](https://cert-manager.io/docs/installation/kubernetes/#installing-with-helm).
+
+```
+# Install the CustomResourceDefinition resources separately
+kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.0/cert-manager.crds.yaml
+
+# **Important:**
+# If you are running Kubernetes v1.15 or below, you
+# will need to add the `--validate=false` flag to your
+# kubectl apply command, or else you will receive a
+# validation error relating to the
+# x-kubernetes-preserve-unknown-fields field in
+# cert-manager’s CustomResourceDefinition resources.
+# This is a benign error and occurs due to the way kubectl
+# performs resource validation.
+
+# Create the namespace for cert-manager
+kubectl create namespace cert-manager
+
+# Add the Jetstack Helm repository
+helm repo add jetstack https://charts.jetstack.io
+
+# Update your local Helm chart repository cache
+helm repo update
+
+# Install the cert-manager Helm chart
+helm install \
+  cert-manager jetstack/cert-manager \
+  --namespace cert-manager \
+  --version v0.15.0
+```
+
+Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
+
+```
+kubectl get pods --namespace cert-manager
+
+NAME                                       READY   STATUS    RESTARTS   AGE
+cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
+cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
+cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m
+```
+
+{{% /accordion %}}
+
+### 6. Install Rancher with Helm and Your Chosen Certificate Option
+
+The exact command to install Rancher differs depending on the certificate configuration.
+
+{{% tabs %}}
+{{% tab "Rancher-generated Certificates" %}}
+
+
+The default is for Rancher to generate a CA and uses `cert-manager` to issue the certificate for access to the Rancher server interface.
+
+Because `rancher` is the default option for `ingress.tls.source`, we are not specifying `ingress.tls.source` when running the `helm install` command.
+
+- Set the `hostname` to the DNS name you pointed at your load balancer.
+- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
+- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`
+
+```
+helm install rancher rancher-<CHART_REPO>/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org
+```
+
+Wait for Rancher to be rolled out:
+
+```
+kubectl -n cattle-system rollout status deploy/rancher
+Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
+deployment "rancher" successfully rolled out
+```
+
+{{% /tab %}}
+{{% tab "Let's Encrypt" %}}
+
+This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA.
+
+In the following command,
+
+- `hostname` is set to the public DNS record,
+- `ingress.tls.source` is set to `letsEncrypt`
+- `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices)
+- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
+
+```
+helm install rancher rancher-<CHART_REPO>/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=letsEncrypt \
+  --set letsEncrypt.email=me@example.org
+```
+
+Wait for Rancher to be rolled out:
+
+```
+kubectl -n cattle-system rollout status deploy/rancher
+Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
+deployment "rancher" successfully rolled out
+```
+
+{{% /tab %}}
+{{% tab "Certificates from Files" %}}
+In this option, Kubernetes secrets are created from your own certificates for Rancher to use.
+
+When you run this command, the `hostname` option must match the `Common Name` or a `Subject Alternative Names` entry in the server certificate or the Ingress controller will fail to configure correctly.
+
+Although an entry in the `Subject Alternative Names` is technically required, having a matching `Common Name` maximizes compatibility with older browsers and applications.
+
+> If you want to check if your certificates are correct, see [How do I check Common Name and Subject Alternative Names in my server certificate?]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-do-i-check-common-name-and-subject-alternative-names-in-my-server-certificate)
+
+- Set the `hostname`.
+- Set `ingress.tls.source` to `secret`.
+- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
+
+```
+helm install rancher rancher-<CHART_REPO>/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=secret
+```
+
+If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
+
+```
+helm install rancher rancher-latest/rancher \
+  --namespace cattle-system \
+  --set hostname=rancher.my.org \
+  --set ingress.tls.source=secret \
+  --set privateCA=true
+```
+
+Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the Ingress controller can use them.
+{{% /tab %}}
+{{% /tabs %}}
+
+The Rancher chart configuration has many options for customizing the installation to suit your specific environment. Here are some common advanced scenarios.
+
+- [HTTP Proxy]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#http-proxy)
+- [Private Docker Image Registry]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#private-registry-and-air-gap-installs)
+- [TLS Termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
+
+See the [Chart Options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/) for the full list of options.
+
+
+### 7. Verify that the Rancher Server is Successfully Deployed
+
+After adding the secrets, check if Rancher was rolled out successfully:
+
+```
+kubectl -n cattle-system rollout status deploy/rancher
+Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
+deployment "rancher" successfully rolled out
+```
+
+If you see the following error: `error: deployment "rancher" exceeded its progress deadline`, you can check the status of the deployment by running the following command:
+
+```
+kubectl -n cattle-system get deploy rancher
+NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
+rancher   3         3         3            3           3m
+```
+
+It should show the same count for `DESIRED` and `AVAILABLE`.
+
+### 8. Save Your Options
+
+Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
+
+### Finishing Up
+
+That's it. You should have a functional Rancher server.
+
+In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
+
+Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) Page
+
+
+### Optional Next Steps
+
+Enable the Enterprise Cluster Manager.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/_index.md
deleted file mode 100644
index df088c803ec..00000000000
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/install/_index.md
+++ /dev/null
@@ -1,274 +0,0 @@
----
-title: Install
-weight: 1
----
-
-> **Prerequisite:**
-> Set up the Rancher Kubernetes cluster. Rancher can be installed on any Kubernetes cluster.
->
-> This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
-
-# Install the Rancher Helm Chart
-
-Rancher is installed using the Helm package manager for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents.
-
-With Helm, we can create configurable deployments instead of just using static files. For more information about creating your own catalog of deployments, check out the docs at https://helm.sh/.
-
-For systems without direct internet access, see [Air Gap: Kubernetes install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/).
-
-To choose a Rancher version to install, refer to [Choosing a Rancher Version.]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags)
-
-To choose a version of Helm to install Rancher with, refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version)
-
-> **Note:** The installation instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) This [section]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2) provides a copy of the older installation instructions for Rancher installed on an RKE Kubernetes cluster with Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
-
-To set up Rancher,
-
-1. [Install the required CLI tools](#1-install-the-required-cli-tools)
-2. [Add the Helm chart repository](#2-add-the-helm-chart-repository)
-3. [Create a namespace for Rancher](#3-create-a-namespace-for-rancher)
-4. [Choose your SSL configuration](#4-choose-your-ssl-configuration)
-5. [Install cert-manager](#5-install-cert-manager) (unless you are bringing your own certificates, or TLS will be terminated on a load balancer)
-6. [Install Rancher with Helm and your chosen certificate option](#6-install-rancher-with-helm-and-your-chosen-certificate-option)
-7. [Verify that the Rancher server is successfully deployed](#7-verify-that-the-rancher-server-is-successfully-deployed)
-8. [Save your options](#8-save-your-options)
-
-### 1. Install the Required CLI Tools
-
-The following CLI tools are required for setting up the Kubernetes cluster. Please make sure these tools are installed and available in your `$PATH`.
-
-Refer to the [instructions provided by the Helm project](https://helm.sh/docs/intro/install/) for your specific platform.
-
-- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) - Kubernetes command-line tool.
-- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-### 2. Add the Helm Chart Repository
-
-Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-
-{{< release-channel >}}
-
-```
-helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-```
-
-### 3. Create a Namespace for Rancher
-
-We'll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be `cattle-system`:
-
-```
-kubectl create namespace cattle-system
-```
-
-### 4. Choose your SSL Configuration
-
-The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
-
-> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
-
-There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
-
-- **Rancher-generated TLS certificate:** In this case, you will need to install `cert-manager` into the cluster. Rancher utilizes `cert-manager` to issue and maintain its certificates. Rancher will generate a CA certificate of its own, and sign a cert using that CA. `cert-manager` is then responsible for managing that certificate.
-- **Let's Encrypt:** The Let's Encrypt option also uses `cert-manager`. However, in this case, cert-manager is combined with a special Issuer for Let's Encrypt that performs all actions (including request and validation) necessary for getting a Let's Encrypt issued cert. This configuration uses HTTP validation (`HTTP-01`), so the load balancer must have a public DNS record and be accessible from the internet.
-- **Bring your own certificate:** This option allows you to bring your own public- or private-CA signed certificate. Rancher will use that certificate to secure websocket and HTTPS traffic. In this case, you must upload this certificate (and associated key) as PEM-encoded files with the name `tls.crt` and `tls.key`. If you are using a private CA, you must also upload that certificate. This is due to the fact that this private CA may not be trusted by your nodes. Rancher will take that CA certificate, and generate a checksum from it, which the various Rancher components will use to validate their connection to Rancher.
-
-
-| Configuration                  | Helm Chart Option           | Requires cert-manager                 |
-| ------------------------------ | ----------------------- | ------------------------------------- |
-| Rancher Generated Certificates (Default) | `ingress.tls.source=rancher`  | [yes](#5-install-cert-manager) |
-| Let’s Encrypt                  | `ingress.tls.source=letsEncrypt`  | [yes](#5-install-cert-manager) |
-| Certificates from Files        | `ingress.tls.source=secret`        | no               |
-
-### 5. Install cert-manager
-
-> You should skip this step if you are bringing your own certificate files (option `ingress.tls.source=secret`), or if you use [TLS termination on an external load balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination). 
-
-This step is only required to use certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) or to request Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`).
-
-{{% accordion id="cert-manager" label="Click to Expand" %}}
-
-> **Important:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-These instructions are adapted from the [official cert-manager documentation](https://cert-manager.io/docs/installation/kubernetes/#installing-with-helm).
-
-```
-# Install the CustomResourceDefinition resources separately
-kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.15.0/cert-manager.crds.yaml
-
-# **Important:**
-# If you are running Kubernetes v1.15 or below, you
-# will need to add the `--validate=false` flag to your
-# kubectl apply command, or else you will receive a
-# validation error relating to the
-# x-kubernetes-preserve-unknown-fields field in
-# cert-manager’s CustomResourceDefinition resources.
-# This is a benign error and occurs due to the way kubectl
-# performs resource validation.
-
-# Create the namespace for cert-manager
-kubectl create namespace cert-manager
-
-# Add the Jetstack Helm repository
-helm repo add jetstack https://charts.jetstack.io
-
-# Update your local Helm chart repository cache
-helm repo update
-
-# Install the cert-manager Helm chart
-helm install \
-  cert-manager jetstack/cert-manager \
-  --namespace cert-manager \
-  --version v0.15.0
-```
-
-Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
-
-```
-kubectl get pods --namespace cert-manager
-
-NAME                                       READY   STATUS    RESTARTS   AGE
-cert-manager-5c6866597-zw7kh               1/1     Running   0          2m
-cert-manager-cainjector-577f6d9fd7-tr77l   1/1     Running   0          2m
-cert-manager-webhook-787858fcdb-nlzsq      1/1     Running   0          2m
-```
-
-{{% /accordion %}}
-
-### 6. Install Rancher with Helm and Your Chosen Certificate Option
-
-The exact command to install Rancher differs depending on the certificate configuration.
-
-{{% tabs %}}
-{{% tab "Rancher-generated Certificates" %}}
-
-
-The default is for Rancher to generate a CA and uses `cert-manager` to issue the certificate for access to the Rancher server interface.
-
-Because `rancher` is the default option for `ingress.tls.source`, we are not specifying `ingress.tls.source` when running the `helm install` command.
-
-- Set the `hostname` to the DNS name you pointed at your load balancer.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-- To install a specific Rancher version, use the `--version` flag, example: `--version 2.3.6`
-
-```
-helm install rancher rancher-<CHART_REPO>/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-{{% /tab %}}
-{{% tab "Let's Encrypt" %}}
-
-This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA.
-
-In the following command,
-
-- `hostname` is set to the public DNS record,
-- `ingress.tls.source` is set to `letsEncrypt`
-- `letsEncrypt.email` is set to the email address used for communication about your certificate (for example, expiry notices)
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher rancher-<CHART_REPO>/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=letsEncrypt \
-  --set letsEncrypt.email=me@example.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-{{% /tab %}}
-{{% tab "Certificates from Files" %}}
-In this option, Kubernetes secrets are created from your own certificates for Rancher to use.
-
-When you run this command, the `hostname` option must match the `Common Name` or a `Subject Alternative Names` entry in the server certificate or the Ingress controller will fail to configure correctly.
-
-Although an entry in the `Subject Alternative Names` is technically required, having a matching `Common Name` maximizes compatibility with older browsers and applications.
-
-> If you want to check if your certificates are correct, see [How do I check Common Name and Subject Alternative Names in my server certificate?]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-do-i-check-common-name-and-subject-alternative-names-in-my-server-certificate)
-
-- Set the `hostname`.
-- Set `ingress.tls.source` to `secret`.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher rancher-<CHART_REPO>/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret
-```
-
-If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
-
-```
-helm install rancher rancher-latest/rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret \
-  --set privateCA=true
-```
-
-Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the Ingress controller can use them.
-{{% /tab %}}
-{{% /tabs %}}
-
-The Rancher chart configuration has many options for customizing the installation to suit your specific environment. Here are some common advanced scenarios.
-
-- [HTTP Proxy]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#http-proxy)
-- [Private Docker Image Registry]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#private-registry-and-air-gap-installs)
-- [TLS Termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
-
-See the [Chart Options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/) for the full list of options.
-
-
-### 7. Verify that the Rancher Server is Successfully Deployed
-
-After adding the secrets, check if Rancher was rolled out successfully:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-If you see the following error: `error: deployment "rancher" exceeded its progress deadline`, you can check the status of the deployment by running the following command:
-
-```
-kubectl -n cattle-system get deploy rancher
-NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
-rancher   3         3         3            3           3m
-```
-
-It should show the same count for `DESIRED` and `AVAILABLE`.
-
-### 8. Save Your Options
-
-Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
-
-### Finishing Up
-
-That's it. You should have a functional Rancher server.
-
-In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
-
-Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/) Page
-
-
-### Optional Next Steps
-
-Enable the Enterprise Cluster Manager.
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/_index.md
similarity index 77%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/_index.md
index bacce397ecb..d235ebcea30 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/_index.md
+++ b/content/rancher/v2.x/en/installation/upgrades-rollbacks/_index.md
@@ -7,11 +7,11 @@ aliases:
 
 ### Upgrading Rancher
 
-To upgrade Rancher, refer to [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades/upgrades/)
+To upgrade Rancher, refer to [these instructions.](./upgrades/)
 
 ### Rolling Back Unsuccessful Upgrades
 
-In the event that your Rancher Server does not upgrade successfully, you can rollback to your installation prior to upgrade using these instructions: [Rollbacks for Rancher installed on a Kubernetes cluster]({{<baseurl>}}/rancher/v2.x/en/upgrades/ha-server-rollbacks)
+In the event that your Rancher Server does not upgrade successfully, you can rollback to your installation prior to upgrade using these instructions: [Rollbacks for Rancher installed on a Kubernetes cluster](./rollbacks/ha-server-rollbacks)
 
 > **Note:** If you are rolling back to versions in either of these scenarios, you must follow some extra [instructions]({{<baseurl>}}/rancher/v2.x/en/upgrades/rollbacks/) in order to get your clusters working.
 >
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/rollbacks/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/rollbacks/_index.md
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
similarity index 63%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
index 257a1130528..955a0938879 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
+++ b/content/rancher/v2.x/en/installation/upgrades-rollbacks/rollbacks/ha-server-rollbacks/_index.md
@@ -8,7 +8,9 @@ aliases:
 
 If you upgrade Rancher and the upgrade does not complete successfully, you may need to rollback your Rancher Server to its last healthy state.
 
-To restore Rancher follow the procedure detailed here: [Restoring Backups — Kubernetes installs]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/ha-restoration)
+To restore Rancher prior to v2.5, follow the procedure detailed here: [Restoring Backups — Kubernetes installs]({{<baseurl>}}/rancher/v2.x/en/backups/restorations/ha-restoration)
+
+To restore Rancher v2.5, you can use the `rancher-backup` application and restore Rancher from backup according to [this section.]({{<baseurl>}}/rancher/v2.x/en/backups/restoring-rancher/)
 
 Restoring a snapshot of the Rancher Server cluster will revert Rancher to the version and state at the time of the snapshot.
 
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/_index.md
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/ha/_index.md
similarity index 95%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/ha/_index.md
index a570d1e9c22..9c2082fb711 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/_index.md
+++ b/content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/ha/_index.md
@@ -14,7 +14,7 @@ If you installed Rancher using the RKE Add-on yaml, follow the directions to [mi
 
 >**Notes:**
 > 
-> - If you are upgrading from a Rancher server that was started with the Helm chart option `--add-local=false`, you will need to drop that flag when upgrading. Otherwise, the Rancher server will not start. The `restricted-admin` role can be used to continue restricting access to the local cluster. For more information, see [this section.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#upgrading-from-rancher-with-a-hidden-local-cluster)
+> - If you are upgrading to Rancher v2.5 from a Rancher server that was started with the Helm chart option `--add-local=false`, you will need to drop that flag when upgrading. Otherwise, the Rancher server will not start. The `restricted-admin` role can be used to continue restricting access to the local cluster. For more information, see [this section.]({{<baseurl>}}/rancher/v2.x/en/admin-settings/rbac/global-permissions/#upgrading-from-rancher-with-a-hidden-local-cluster)
 > - [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753) Upgrade cert-manager to the latest version by following [these instructions.]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager)
 > - The upgrade instructions assume you are using Helm 3. For migration of installs started with Helm 2, refer to the official [Helm 2 to 3 migration docs.](https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/) The [Helm 2 upgrade page here]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/helm2) provides a copy of the older upgrade instructions that used Helm 2, and it is intended to be used if upgrading to Helm 3 is not feasible.
 > - If you are upgrading Rancher from v2.x to v2.3+, and you are using external TLS termination, you will need to edit the cluster.yml to [enable using forwarded host headers.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#configuring-ingress-for-external-tls-when-using-nginx-v0-25)
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/helm2/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/ha/helm2/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/ha/helm2/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/ha/helm2/_index.md
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/migrating-from-rke-add-on/_index.md
diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/namespace-migration/_index.md b/content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/namespace-migration/_index.md
similarity index 100%
rename from content/rancher/v2.x/en/installation/install-rancher-on-k8s/upgrades-rollbacks/upgrades/namespace-migration/_index.md
rename to content/rancher/v2.x/en/installation/upgrades-rollbacks/upgrades/namespace-migration/_index.md

From e4145134811fc946aced98133fc66f5f9941d812 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 20:24:34 -0700
Subject: [PATCH 262/265] Clarify prerequisite in installation docs

---
 .../v2.x/en/installation/install-rancher-on-k8s/_index.md   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
index 46f5977678b..0e789a64740 100644
--- a/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
+++ b/content/rancher/v2.x/en/installation/install-rancher-on-k8s/_index.md
@@ -5,7 +5,11 @@ weight: 3
 ---
 
 > **Prerequisite:**
-> Set up the Rancher Kubernetes cluster. As of Rancher v2.5, Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
+> Set up the Rancher server's local Kubernetes cluster. 
+>
+> - As of Rancher v2.5, Rancher can be installed on any Kubernetes cluster. This cluster can use upstream Kubernetes, or it can use one of Rancher's Kubernetes distributions, or it can be a managed Kubernetes cluster from a provider such as Amazon EKS.
+> - In Rancher v2.4.x, Rancher needs to be installed on a K3s Kubernetes cluster or an RKE Kubernetes cluster.
+> - In Rancher prior to v2.4, Rancher needs to be installed on an RKE Kubernetes cluster.
 
 # Install the Rancher Helm Chart
 

From eb1b29abbbe89eedf803c28b2077156f4692a82e Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 20:40:00 -0700
Subject: [PATCH 263/265] Delete extraneous files

---
 .../k8s-install/create-nodes-lb/_index.md     | 130 ------------------
 1 file changed, 130 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md

diff --git a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md b/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
deleted file mode 100644
index 8add940e8ce..00000000000
--- a/content/rancher/v2.x/en/installation/k8s-install/create-nodes-lb/_index.md
+++ /dev/null
@@ -1,130 +0,0 @@
----
-title: '1. Set up Infrastructure'
-weight: 185
-aliases:
-  - /rancher/v2.x/en/installation/ha/create-nodes-lb
----
-
-In this section, you will provision the underlying infrastructure for your Rancher management server.
-
-The recommended infrastructure for the Rancher-only Kubernetes cluster differs depending on whether Rancher will be installed on a K3s Kubernetes cluster, an RKE Kubernetes cluster, or a single Docker container.
-
-For more information about each installation option, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation)
-
-> **Note:** These nodes must be in the same region. You may place these servers in separate availability zones (datacenter).
-
-{{% tabs %}}
-{{% tab "K3s" %}}
-To install the Rancher management server on a high-availability K3s cluster, we recommend setting up the following infrastructure:
-
-- **Two Linux nodes,** typically virtual machines, in the infrastructure provider of your choice.
-- **An external database** to store the cluster data. We recommend MySQL.
-- **A load balancer** to direct traffic to the two nodes.
-- **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it.
-
-### 1. Set up Linux Nodes
-
-Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node) for setting up nodes as instances in Amazon EC2.
-
-### 2. Set up External Datastore
-
-The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available options allow you to select a datastore that best fits your use case.
-
-For a high-availability K3s installation, you will need to set a [MySQL](https://www.mysql.com/) external database. Rancher has been tested on K3s Kubernetes clusters using MySQL version 5.7 as the datastore.
-
-When you install Kubernetes using the K3s installation script, you will pass in details for K3s to connect to the database.
-
-For an example of one way to set up the MySQL database, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/rds/) for setting up MySQL on Amazon's RDS service.
-
-For the complete list of options that are available for configuring a K3s cluster datastore, refer to the [K3s documentation.]({{<baseurl>}}/k3s/latest/en/installation/datastore/)
-
-### 3. Set up the Load Balancer
-
-You will also need to set up a load balancer to direct traffic to the Rancher replica on both nodes. That will prevent an outage of any single node from taking down communications to the Rancher management server.
-
-When Kubernetes gets set up in a later step, the K3s tool will deploy a Traefik Ingress controller. This controller will listen on ports 80 and 443 of the worker nodes, answering traffic destined for specific hostnames.
-
-When Rancher is installed (also in a later step), the Rancher system creates an Ingress resource. That Ingress tells the Traefik Ingress controller to listen for traffic destined for the Rancher hostname. The Traefik Ingress controller, when receiving traffic destined for the Rancher hostname, will forward that traffic to the running Rancher pods in the cluster.
-
-For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer:
-
-- **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment.
-- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
-
-For an example showing how to set up an NGINX load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nginx/)
-
-For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nlb/)
-
-> **Important:**
-> Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications.
-
-### 4. Set up the DNS Record
-
-Once you have set up your load balancer, you will need to create a DNS record to send traffic to this load balancer.
-
-Depending on your environment, this may be an A record pointing to the load balancer IP, or it may be a CNAME pointing to the load balancer hostname. In either case, make sure this record is the hostname that you intend Rancher to respond on.
-
-You will need to specify this hostname in a later step when you install Rancher, and it is not possible to change it later. Make sure that your decision is a final one.
-
-For a how-to guide for setting up a DNS record to route domain traffic to an Amazon ELB load balancer, refer to the [official AWS documentation.](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer)
-
-
-
-{{% /tab %}}
-{{% tab "RKE" %}}
-To install the Rancher management server on a high-availability RKE cluster, we recommend setting up the following infrastructure:
-
-- **Three Linux nodes,** typically virtual machines, in an infrastructure provider such as Amazon's EC2, Google Compute Engine, or vSphere.
-- **A load balancer** to direct front-end traffic to the three nodes.
-- **A DNS record** to map a URL to the load balancer. This will become the Rancher server URL, and downstream Kubernetes clusters will need to reach it.
-
-These nodes must be in the same region/data center. You may place these servers in separate availability zones.
-
-### Why three nodes?
-
-In an RKE cluster, Rancher server data is stored on etcd. This etcd database runs on all three nodes.
-
-The etcd database requires an odd number of nodes so that it can always elect a leader with a majority of the etcd cluster. If the etcd database cannot elect a leader, etcd can suffer from [split brain](https://www.quora.com/What-is-split-brain-in-distributed-systems), requiring the cluster to be restored from backup. If one of the three etcd nodes fails, the two remaining nodes can elect a leader because they have the majority of the total number of etcd nodes.
-
-### 1. Set up Linux Nodes
-
-Make sure that your nodes fulfill the general installation requirements for [OS, container runtime, hardware, and networking.]({{<baseurl>}}/rancher/v2.x/en/installation/requirements/)
-
-For an example of one way to set up Linux nodes, refer to this [tutorial]({{<baseurl>}}/rancher/v2.x/en/installation/options/ec2-node/) for setting up nodes as instances in Amazon EC2.
-
-### 2. Set up the Load Balancer
-
-You will also need to set up a load balancer to direct traffic to the Rancher replica on both nodes. That will prevent an outage of any single node from taking down communications to the Rancher management server.
-
-When Kubernetes gets set up in a later step, the RKE tool will deploy an NGINX Ingress controller. This controller will listen on ports 80 and 443 of the worker nodes, answering traffic destined for specific hostnames.
-
-When Rancher is installed (also in a later step), the Rancher system creates an Ingress resource. That Ingress tells the NGINX Ingress controller to listen for traffic destined for the Rancher hostname. The NGINX Ingress controller, when receiving traffic destined for the Rancher hostname, will forward that traffic to the running Rancher pods in the cluster.
-
-For your implementation, consider if you want or need to use a Layer-4 or Layer-7 load balancer:
-
-- **A layer-4 load balancer** is the simpler of the two choices, in which you are forwarding TCP traffic to your nodes. We recommend configuring your load balancer as a Layer 4 balancer, forwarding traffic to ports TCP/80 and TCP/443 to the Rancher management cluster nodes. The Ingress controller on the cluster will redirect HTTP traffic to HTTPS and terminate SSL/TLS on port TCP/443. The Ingress controller will forward traffic to port TCP/80 to the Ingress pod in the Rancher deployment.
-- **A layer-7 load balancer** is a bit more complicated but can offer features that you may want. For instance, a layer-7 load balancer is capable of handling TLS termination at the load balancer, as opposed to Rancher doing TLS termination itself. This can be beneficial if you want to centralize your TLS termination in your infrastructure. Layer-7 load balancing also offers the capability for your load balancer to make decisions based on HTTP attributes such as cookies, etc. that a layer-4 load balancer is not able to concern itself with. If you decide to terminate the SSL/TLS traffic on a layer-7 load balancer, you will need to use the `--set tls=external` option when installing Rancher in a later step. For more information, refer to the [Rancher Helm chart options.]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination)
-
-For an example showing how to set up an NGINX load balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nginx/)
-
-For a how-to guide for setting up an Amazon ELB Network Load Balancer, refer to [this page.]({{<baseurl>}}/rancher/v2.x/en/installation/options/nlb/)
-
-> **Important:**
-> Do not use this load balancer (i.e, the `local` cluster Ingress) to load balance applications other than Rancher following installation. Sharing this Ingress with other applications may result in websocket errors to Rancher following Ingress configuration reloads for other apps. We recommend dedicating the `local` cluster to Rancher and no other applications.
-
-### 3. Set up the DNS Record
-
-Once you have set up your load balancer, you will need to create a DNS record to send traffic to this load balancer.
-
-Depending on your environment, this may be an A record pointing to the LB IP, or it may be a CNAME pointing to the load balancer hostname. In either case, make sure this record is the hostname that you intend Rancher to respond on.
-
-You will need to specify this hostname in a later step when you install Rancher, and it is not possible to change it later. Make sure that your decision is a final one.
-
-For a how-to guide for setting up a DNS record to route domain traffic to an Amazon ELB load balancer, refer to the [official AWS documentation.](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-elb-load-balancer)
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### [Next: Set up a Kubernetes Cluster]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/kubernetes-rke/)
\ No newline at end of file

From 841ba4e973c3023198b494e15360af4061df6b65 Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 20:45:37 -0700
Subject: [PATCH 264/265] Fix installation docs

---
 .../air-gap-helm2/install-rancher/_index.md   | 333 ---------------
 .../populate-private-registry/_index.md       | 274 ------------
 .../3-node-certificate-recognizedca/_index.md | 160 -------
 .../3-node-certificate/_index.md              | 175 --------
 .../3-node-externalssl-certificate/_index.md  | 158 -------
 .../3-node-externalssl-recognizedca/_index.md | 142 -------
 .../options/cluster-yml-templates/_index.md   |   8 -
 .../options/helm2/helm-rancher/_index.md      | 218 ----------
 .../helm-rancher/chart-options/_index.md      | 245 -----------
 .../helm2/helm-rancher/tls-secrets/_index.md  |  33 --
 .../helm2/rke-add-on/layer-4-lb/_index.md     | 400 -----------------
 .../helm2/rke-add-on/layer-7-lb/_index.md     | 288 -------------
 .../options/rke-add-on/layer-4-lb/_index.md   | 402 ------------------
 .../options/rke-add-on/layer-7-lb/_index.md   | 288 -------------
 .../options/troubleshooting/_index.md         | 189 --------
 .../helm-2-instructions/_index.md             | 172 --------
 16 files changed, 3485 deletions(-)
 delete mode 100644 content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
 delete mode 100644 content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md

diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
deleted file mode 100644
index c1798f6ac09..00000000000
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/install-rancher/_index.md
+++ /dev/null
@@ -1,333 +0,0 @@
----
-title: 4. Install Rancher
-weight: 400
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-installation/install-rancher/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-system-charts/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/
-  - /rancher/v2.x/en/installation/air-gap-single-node/install-rancher
-  - /rancher/v2.x/en/installation/air-gap/install-rancher
----
-
-This section is about how to deploy Rancher for your air gapped environment. An air gapped environment could be where Rancher server will be installed offline, behind a firewall, or behind a proxy. There are _tabs_ for either a high availability (recommended) or a Docker installation.
-
-{{% tabs %}}
-{{% tab "Kubernetes Install (Recommended)" %}}
-
-Rancher recommends installing Rancher on a Kubernetes cluster. A highly available Kubernetes Installation is comprised of three nodes running the Rancher server components on a Kubernetes cluster. The persistence layer (etcd) is also replicated on these three nodes, providing redundancy and data duplication in case one of the nodes fails.
-
-This section describes installing Rancher in five parts:
-
-- [A. Add the Helm Chart Repository](#a-add-the-helm-chart-repository)
-- [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration)
-- [C. Render the Rancher Helm Template](#c-render-the-rancher-helm-template)
-- [D. Install Rancher](#d-install-rancher)
-- [E. For Rancher versions prior to v2.3.0, Configure System Charts](#e-for-rancher-versions-prior-to-v2-3-0-configure-system-charts)
-
-### A. Add the Helm Chart Repository
-
-From a system that has access to the internet, fetch the latest Helm chart and copy the resulting manifests to a system that has access to the Rancher server cluster.
-
-1. If you haven't already, initialize `helm` locally on a workstation that has internet access. Note: Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-    ```plain
-    helm init -c
-    ```
-
-2. Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-  {{< release-channel >}}
-    ```
-    helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-    ```
-
-3. Fetch the latest Rancher chart. This will pull down the chart and save it in the current directory as a `.tgz` file.
-```plain
-helm fetch rancher-<CHART_REPO>/rancher
-```
-
-> Want additional options? Need help troubleshooting? See [Kubernetes Install: Advanced Options]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#advanced-configurations).
-
-### B. Choose your SSL Configuration
-
-Rancher Server is designed to be secure by default and requires SSL/TLS configuration.
-
-When Rancher is installed on an air gapped Kubernetes cluster, there are two recommended options for the source of the certificate.
-
-> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#external-tls-termination).
-
-| Configuration                              | Chart option                 | Description                                                                                                                                                 | Requires cert-manager |
-| ------------------------------------------ | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
-| Rancher Generated Self-Signed Certificates | `ingress.tls.source=rancher` | Use certificates issued by Rancher's generated CA (self signed)<br> This is the **default** and does not need to be added when rendering the Helm template. | yes                   |
-| Certificates from Files                    | `ingress.tls.source=secret`  | Use your own certificate files by creating Kubernetes Secret(s). <br> This option must be passed when rendering the Rancher Helm template.                  | no                    |
-
-### C. Render the Rancher Helm Template
-
-When setting up the Rancher Helm template, there are several options in the Helm chart that are designed specifically for air gap installations.
-
-| Chart Option            | Chart Value                      | Description   |
-| ----------------------- | -------------------------------- | ---- |
-| `certmanager.version` | "<version>" | Configure proper Rancher TLS issuer depending of running cert-manager version. |
-| `systemDefaultRegistry` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `useBundledSystemChart` | `true`                           | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
-
-Based on the choice your made in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), complete one of the procedures below.
-
-{{% accordion id="self-signed" label="Option A-Default Self-Signed Certificate" %}}
-
-By default, Rancher generates a CA and uses cert-manager to issue the certificate for access to the Rancher server interface.
-
-> **Note:**
-> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.11.0, please see our [upgrade cert-manager documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-1. From a system connected to the internet, add the cert-manager repo to Helm.
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    ```
-
-1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
-
-   ```plain
-   helm fetch jetstack/cert-manager --version v0.12.0
-   ```
-
-1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
-   ```plain
-   helm template ./cert-manager-v0.12.0.tgz --output-dir . \
-       --name cert-manager --namespace cert-manager \
-       --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
-       --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
-       --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
-   ```
-
-1. Download the required CRD file for cert-manager
-   ```plain
-   curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-   ```
-1. Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
-
-
-    Placeholder | Description
-    ------------|-------------
-    `<VERSION>` | The version number of the output tarball.
-    `<RANCHER.YOURDOMAIN.COM>` | The DNS name you pointed at your load balancer.
-    `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.
-    `<CERTMANAGER_VERSION>` | Cert-manager version running on k8s cluster.
-
-     ```plain
-    helm template ./rancher-<VERSION>.tgz --output-dir . \
-     --name rancher \
-     --namespace cattle-system \
-     --set hostname=<RANCHER.YOURDOMAIN.COM> \
-     --set certmanager.version=<CERTMANAGER_VERSION> \
-     --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-     --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-     --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-{{% /accordion %}}
-
-{{% accordion id="secret" label="Option B: Certificates From Files using Kubernetes Secrets" %}}
-
-Create Kubernetes secrets from your own certificates for Rancher to use. The common name for the cert will need to match the `hostname` option in the command below, or the ingress controller will fail to provision the site for Rancher.
-
-Render the Rancher template, declaring your chosen options. Use the reference table below to replace each placeholder. Rancher needs to be configured to use the private registry in order to provision any Rancher launched Kubernetes clusters or Rancher tools.
-
-| Placeholder                      | Description                                     |
-| -------------------------------- | ----------------------------------------------- |
-| `<VERSION>`                      | The version number of the output tarball.       |
-| `<RANCHER.YOURDOMAIN.COM>`       | The DNS name you pointed at your load balancer. |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | The DNS name for your private registry.         |
-
-```plain
-   helm template ./rancher-<VERSION>.tgz --output-dir . \
-    --name rancher \
-    --namespace cattle-system \
-    --set hostname=<RANCHER.YOURDOMAIN.COM> \
-    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-    --set ingress.tls.source=secret \
-    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-If you are using a Private CA signed cert, add `--set privateCA=true` following `--set ingress.tls.source=secret`:
-
-```plain
-   helm template ./rancher-<VERSION>.tgz --output-dir . \
-    --name rancher \
-    --namespace cattle-system \
-    --set hostname=<RANCHER.YOURDOMAIN.COM> \
-    --set rancherImage=<REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher \
-    --set ingress.tls.source=secret \
-    --set privateCA=true \
-    --set systemDefaultRegistry=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Available as of v2.2.0, set a default private registry to be used in Rancher
-    --set useBundledSystemChart=true # Available as of v2.3.0, use the packaged Rancher system charts
-```
-
-Then refer to [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
-
-{{% /accordion %}}
-
-### D. Install Rancher
-
-Copy the rendered manifest directories to a system that has access to the Rancher server cluster to complete installation.
-
-Use `kubectl` to create namespaces and apply the rendered manifests.
-
-If you chose to use self-signed certificates in [B. Choose your SSL Configuration](#b-choose-your-ssl-configuration), install cert-manager.
-
-{{% accordion id="install-cert-manager" label="Self-Signed Certificate Installs - Install Cert-manager" %}}
-
-If you are using self-signed certificates, install cert-manager:
-
-1. Create the namespace for cert-manager.
-```plain
-kubectl create namespace cert-manager
-```
-
-1. Create the cert-manager CustomResourceDefinitions (CRDs).
-```plain
-kubectl apply -f cert-manager/cert-manager-crd.yaml
-```
-
-> **Important:**
-> If you are running Kubernetes v1.15 or below, you will need to add the `--validate=false flag to your kubectl apply command above else you will receive a validation error relating to the x-kubernetes-preserve-unknown-fields field in cert-manager’s CustomResourceDefinition resources. This is a benign error and occurs due to the way kubectl performs resource validation.
-
-1. Launch cert-manager.
-```plain
-kubectl apply -R -f ./cert-manager
-```
-
-{{% /accordion %}}
-
-Install Rancher:
-
-```plain
-kubectl create namespace cattle-system
-kubectl -n cattle-system apply -R -f ./rancher
-```
-
-**Step Result:** If you are installing Rancher v2.3.0+, the installation is complete.
-
-### E. For Rancher versions prior to v2.3.0, Configure System Charts
-
-If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
-
-### Additional Resources
-
-These resources could be helpful when installing Rancher:
-
-- [Rancher Helm chart options]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/)
-- [Adding TLS secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/tls-secrets/)
-- [Troubleshooting Rancher Kubernetes Installations]({{<baseurl>}}/rancher/v2.x/en/installation/options/troubleshooting/)
-
-{{% /tab %}}
-{{% tab "Docker Install" %}}
-
-The Docker installation is for Rancher users that are wanting to **test** out Rancher. Instead of running on a Kubernetes cluster, you install the Rancher server component on a single node using a `docker run` command. Since there is only one node and a single Docker container, if the node goes down, there is no copy of the etcd data available on other nodes and you will lose all the data of your Rancher server. **Important: If you install Rancher following the Docker installation guide, there is no upgrade path to transition your Docker installation to a Kubernetes Installation.** Instead of running the single node installation, you have the option to follow the Kubernetes Install guide, but only use one node to install Rancher. Afterwards, you can scale up the etcd nodes in your Kubernetes cluster to make it a Kubernetes Installation.
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-| Environment Variable Key         | Environment Variable Value       | Description     |
-| -------------------------------- | -------------------------------- | ---- |
-| `CATTLE_SYSTEM_DEFAULT_REGISTRY` | `<REGISTRY.YOURDOMAIN.COM:PORT>` | Configure Rancher server to always pull from your private registry when provisioning clusters.  |
-| `CATTLE_SYSTEM_CATALOG`          | `bundled`                        | Configure Rancher server to use the packaged copy of Helm system charts. The [system charts](https://github.com/rancher/system-charts) repository contains all the catalog items required for features such as monitoring, logging, alerting and global DNS. These [Helm charts](https://github.com/rancher/system-charts) are located in GitHub, but since you are in an air gapped environment, using the charts that are bundled within Rancher is much easier than setting up a Git mirror. _Available as of v2.3.0_ |
-
-> **Do you want to...**
->
-> - Configure custom CA root certificate to access your services? See [Custom CA root certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/chart-options/#additional-trusted-cas).
-> - Record all transactions with the Rancher API? See [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#api-audit-log).
-
-- For Rancher prior to v2.3.0, you will need to mirror the `system-charts` repository to a location in your network that Rancher can reach. Then, after Rancher is installed, you will need to configure Rancher to use that repository. For details, refer to the documentation on [setting up the system charts for Rancher prior to v2.3.0.]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0)
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A-Default Self-Signed Certificate" %}}
-
-If you are installing Rancher in a development or testing environment where identity verification isn't a concern, install Rancher using the self-signed certificate that it generates. This installation option omits the hassle of generating a certificate yourself.
-
-Log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B-Bring Your Own Certificate: Self-Signed" %}}
-
-In development or testing environments where your team will access your Rancher server, create a self-signed certificate for use with your install so that your team can verify they're connecting to your instance of Rancher.
-
-> **Prerequisites:**
-> From a computer with an internet connection, create a self-signed certificate using [OpenSSL](https://www.openssl.org/) or another method of your choice.
->
-> - The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
-> - In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#cert-order).
-
-After creating your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Use the `-v` flag and provide the path to your certificates to mount them in your container.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
-| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
-| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<CA_CERTS.pem>`                     | The path to the certificate authority's certificate.                                                                          |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-    -v /<CERT_DIRECTORY>/<CA_CERTS.pem>:/etc/rancher/ssl/cacerts.pem \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-{{% accordion id="option-c" label="Option C-Bring Your Own Certificate: Signed by Recognized CA" %}}
-
-In development or testing environments where you're exposing an app publicly, use a certificate signed by a recognized CA so that your user base doesn't encounter security warnings.
-
-> **Prerequisite:** The certificate files must be in [PEM format]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/single-node-docker/#pem).
-
-After obtaining your certificate, log into your Linux host, and then run the installation command below. When entering the command, use the table below to replace each placeholder. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary.
-
-| Placeholder                      | Description                                                                                                                   |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| `<CERT_DIRECTORY>`               | The path to the directory containing your certificate files.                                                                  |
-| `<FULL_CHAIN.pem>`               | The path to your full certificate chain.                                                                                      |
-| `<PRIVATE_KEY.pem>`              | The path to the private key for your certificate.                                                                             |
-| `<REGISTRY.YOURDOMAIN.COM:PORT>` | Your private registry URL and port.                                                                                           |
-| `<RANCHER_VERSION_TAG>`          | The release tag of the [Rancher version]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/) that you want to install. |
-
-> **Note:** Use the `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher.
-
-```
-docker run -d --restart=unless-stopped \
-    -p 80:80 -p 443:443 \
-    --no-cacerts \
-    -v /<CERT_DIRECTORY>/<FULL_CHAIN.pem>:/etc/rancher/ssl/cert.pem \
-    -v /<CERT_DIRECTORY>/<PRIVATE_KEY.pem>:/etc/rancher/ssl/key.pem \
-    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=<REGISTRY.YOURDOMAIN.COM:PORT> \ # Set a default private registry to be used in Rancher
-    -e CATTLE_SYSTEM_CATALOG=bundled \ #Available as of v2.3.0, use the packaged Rancher system charts
-    <REGISTRY.YOURDOMAIN.COM:PORT>/rancher/rancher:<RANCHER_VERSION_TAG>
-```
-
-{{% /accordion %}}
-
-If you are installing Rancher v2.3.0+, the installation is complete.
-
-If you are installing Rancher versions prior to v2.3.0, you will not be able to use the packaged system charts. Since the Rancher system charts are hosted in Github, an air gapped installation will not be able to access these charts. Therefore, you must [configure the Rancher system charts]({{<baseurl>}}/rancher/v2.x/en/installation/options/local-system-charts/#setting-up-system-charts-for-rancher-prior-to-v2-3-0).
-
-{{% /tab %}}
-{{% /tabs %}}
diff --git a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md b/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
deleted file mode 100644
index b96ca100b47..00000000000
--- a/content/rancher/v2.x/en/installation/options/air-gap-helm2/populate-private-registry/_index.md
+++ /dev/null
@@ -1,274 +0,0 @@
----
-title: '2. Collect and Publish Images to your Private Registry'
-weight: 200
-aliases:
-  - /rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/prepare-private-registry/
-  - /rancher/v2.x/en/installation/air-gap-single-node/prepare-private-registry/
-  - /rancher/v2.x/en/installation/air-gap-single-node/config-rancher-for-private-reg/
-  - /rancher/v2.x/en/installation/air-gap-high-availability/config-rancher-for-private-reg/
----
-
-> **Prerequisites:** You must have a [private registry](https://docs.docker.com/registry/deploying/) available to use.
->
-> **Note:** Populating the private registry with images is the same process for HA and Docker installations, the differences in this section is based on whether or not you are planning to provision a Windows cluster or not.
-
-By default, all images used to [provision Kubernetes clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/) or launch any [tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/) in Rancher, e.g. monitoring, pipelines, alerts, are pulled from Docker Hub. In an air gap installation of Rancher, you will need a private registry that is located somewhere accessible by your Rancher server. Then, you will load the registry with all the images.
-
-This section describes how to set up your private registry so that when you install Rancher, Rancher will pull all the required images from this registry.
-
-By default, we provide the steps of how to populate your private registry assuming you are provisioning Linux only clusters, but if you plan on provisioning any [Windows clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/windows-clusters/), there are separate instructions to support the images needed for a Windows cluster.
-
-{{% tabs %}}
-{{% tab "Linux Only Clusters" %}}
-
-For Rancher servers that will only provision Linux clusters, these are the steps to populate your private registry.
-
-A. Find the required assets for your Rancher version <br>
-B. Collect all the required images <br>
-C. Save the images to your workstation <br>
-D. Populate the private registry
-
-### Prerequisites
-
-These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
-
-If you will use ARM64 hosts, the registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments. Click **Assets*.*
-
-2. From the release's **Assets** section, download the following files:
-
-| Release File   | Description  |
-| ---------------- | -------------- |
-| `rancher-images.txt`     | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools. |
-| `rancher-save-images.sh` | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-| `rancher-load-images.sh` | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.   |
-
-### B. Collect all the required images (For Kubernetes Installs using Rancher Generated Self-Signed Certificate)
-
-In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
-
-1.  Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-
-    > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    helm fetch jetstack/cert-manager --version v0.12.0
-    helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
-    ```
-
-2.  Sort and unique the images list to remove any overlap between the sources:
-
-    ```plain
-    sort -u rancher-images.txt -o rancher-images.txt
-    ```
-
-### C. Save the images to your workstation
-
-1. Make `rancher-save-images.sh` an executable:
-   ```
-   chmod +x rancher-save-images.sh
-   ```
-
-1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-   ```plain
-   ./rancher-save-images.sh --image-list ./rancher-images.txt
-   ```
-   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
-
-### D. Populate the private registry
-
-Move the images in the `rancher-images.tar.gz` to your private registry using the scripts to load the images. The `rancher-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script.
-
-1.  Log into your private registry if required:
-    ```plain
-    docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-    ```
-1.  Make `rancher-load-images.sh` an executable:
-    ```
-    chmod +x rancher-load-images.sh
-    ```
-
-1.  Use `rancher-load-images.sh` to extract, tag and push `rancher-images.txt` and `rancher-images.tar.gz` to your private registry:
-    ```plain
-     ./rancher-load-images.sh --image-list ./rancher-images.txt --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-    ```
-{{% /tab %}}
-{{% tab "Linux and Windows Clusters" %}}
-
-_Available as of v2.3.0_
-
-For Rancher servers that will provision Linux and Windows clusters, there are distinctive steps to populate your private registry for the Windows images and the Linux images. Since a Windows cluster is a mix of Linux and Windows nodes, the Linux images pushed into the private registry are manifests.
-
-### Windows Steps
-
-The Windows images need to be collected and pushed from a Windows server workstation.
-
-A. Find the required assets for your Rancher version <br>
-B. Save the images to your Windows Server workstation <br>
-C. Prepare the Docker daemon <br>
-D. Populate the private registry
-
-{{% accordion label="Collecting and Populating Windows Images into the Private Registry"%}}
-
-### Prerequisites
-
-These steps expect you to use a Windows Server 1809 workstation that has internet access, access to your private registry, and at least 50 GB of disk space.
-
-The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
-
-Your registry must support manifests. As of April 2020, Amazon Elastic Container Registry does not support manifests.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.
-
-2. From the release's "Assets" section, download the following files:
-
-| Release File         | Description      |
-|------------------------|-------------------|
-| `rancher-windows-images.txt` | This file contains a list of Windows images needed to provision Windows clusters.         |
-| `rancher-save-images.ps1`    | This script pulls all the images in the `rancher-windows-images.txt` from Docker Hub and saves all of the images as `rancher-windows-images.tar.gz`. |
-| `rancher-load-images.ps1`    | This script loads the images from the `rancher-windows-images.tar.gz` file and pushes them to your private registry.  |
-
-### B. Save the images to your Windows Server workstation
-
-1. Using `powershell`, go to the directory that has the files that were downloaded in the previous step.
-
-1. Run `rancher-save-images.ps1` to create a tarball of all the required images:
-
-   ```plain
-   ./rancher-save-images.ps1
-   ```
-
-   **Step Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-windows-images.tar.gz`. Check that the output is in the directory.
-
-### C. Prepare the Docker daemon
-
-Append your private registry address to the `allow-nondistributable-artifacts` config field in the Docker daemon (`C:\ProgramData\Docker\config\daemon.json`). Since the base image of Windows images are maintained by the `mcr.microsoft.com` registry, this step is required as the layers in the Microsoft registry are missing from Docker Hub and need to be pulled into the private registry.
-
-   ```
-   {
-     ...
-     "allow-nondistributable-artifacts": [
-       ...
-       "<REGISTRY.YOURDOMAIN.COM:PORT>"
-     ]
-     ...
-   }
-   ```
-
-### D. Populate the private registry
-
-Move the images in the `rancher-windows-images.tar.gz` to your private registry using the scripts to load the images. The `rancher-windows-images.txt` is expected to be on the workstation in the same directory that you are running the `rancher-load-images.ps1` script.
-
-1. Using `powershell`, log into your private registry if required:
-   ```plain
-   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-1. Using `powershell`, use `rancher-load-images.ps1` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-   ```plain
-   ./rancher-load-images.ps1 --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-{{% /accordion %}}
-
-### Linux Steps
-
-The Linux images needs to be collected and pushed from a Linux host, but _must be done after_ populating the Windows images into the private registry. These step are different from the Linux only steps as the Linux images that are pushed will actually manifests that support Windows and Linux images.
-
-A. Find the required assets for your Rancher version <br>
-B. Collect all the required images <br>
-C. Save the images to your Linux workstation <br>
-D. Populate the private registry
-
-{{% accordion label="Collecting and Populating Linux Images into the Private Registry" %}}
-
-### Prerequisites
-
-You must populate the private registry with the Windows images before populating the private registry with Linux images. If you have already populated the registry with Linux images, you will need to follow these instructions again as they will publish manifests that support Windows and Linux images.
-
-These steps expect you to use a Linux workstation that has internet access, access to your private registry, and at least 20 GB of disk space.
-
-The workstation must have Docker 18.02+ in order to support manifests, which are required when provisioning Windows clusters.
-
-### A. Find the required assets for your Rancher version
-
-1. Browse to our [releases page](https://github.com/rancher/rancher/releases) and find the Rancher v2.x.x release that you want to install. Don't download releases marked `rc` or `Pre-release`, as they are not stable for production environments.
-
-2. From the release's **Assets** section, download the following files, which are required to install Rancher in an air gap environment:
-
-| Release File                 | Description |
-|----------------------------|------|
-| `rancher-images.txt`         | This file contains a list of images needed to install Rancher, provision clusters and user Rancher tools.                            |
-| `rancher-windows-images.txt` | This file contains a list of images needed to provision Windows clusters.                                                            |
-| `rancher-save-images.sh`     | This script pulls all the images in the `rancher-images.txt` from Docker Hub and saves all of the images as `rancher-images.tar.gz`. |
-| `rancher-load-images.sh`     | This script loads images from the `rancher-images.tar.gz` file and pushes them to your private registry.                             |
-
-### B. Collect all the required images
-
-**For Kubernetes Installs using Rancher Generated Self-Signed Certificate:** In a Kubernetes Install, if you elect to use the Rancher default self-signed TLS certificates, you must add the [`cert-manager`](https://hub.helm.sh/charts/jetstack/cert-manager) image to `rancher-images.txt` as well. You skip this step if you are using you using your own certificates.
-
-   1. Fetch the latest `cert-manager` Helm chart and parse the template for image details:
-      > **Note:** Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-      ```plain
-      helm repo add jetstack https://charts.jetstack.io
-      helm repo update
-      helm fetch jetstack/cert-manager --version v0.12.0
-      helm template ./cert-manager-<version>.tgz | grep -oP '(?<=image: ").*(?=")' >> ./rancher-images.txt
-      ```
-
-   2. Sort and unique the images list to remove any overlap between the sources:
-      ```plain
-      sort -u rancher-images.txt -o rancher-images.txt
-      ```
-
-### C. Save the images to your workstation
-
-1. Make `rancher-save-images.sh` an executable:
-   ```
-   chmod +x rancher-save-images.sh
-   ```
-
-1. Run `rancher-save-images.sh` with the `rancher-images.txt` image list to create a tarball of all the required images:
-   ```plain
-   ./rancher-save-images.sh --image-list ./rancher-images.txt
-   ```
-
-   **Result:** Docker begins pulling the images used for an air gap install. Be patient. This process takes a few minutes. When the process completes, your current directory will output a tarball named `rancher-images.tar.gz`. Check that the output is in the directory.
-
-### D. Populate the private registry
-
-Move the images in the `rancher-images.tar.gz` to your private registry using the `rancher-load-images.sh script` to load the images. The `rancher-images.txt` / `rancher-windows-images.txt` image list is expected to be on the workstation in the same directory that you are running the `rancher-load-images.sh` script.
-
-1. Log into your private registry if required:
-   ```plain
-   docker login <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-1. Make `rancher-load-images.sh` an executable:
-   ```
-   chmod +x rancher-load-images.sh
-   ```
-
-1. Use `rancher-load-images.sh` to extract, tag and push the images from `rancher-images.tar.gz` to your private registry:
-   ```plain
-   ./rancher-load-images.sh --image-list ./rancher-images.txt \
-     --windows-image-list ./rancher-windows-images.txt \
-     --registry <REGISTRY.YOURDOMAIN.COM:PORT>
-   ```
-
-{{% /accordion %}}
-
-{{% /tab %}}
-{{% /tabs %}}
-
-### [Next: Kubernetes Installs - Launch a Kubernetes Cluster with RKE]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/launch-kubernetes/)
-
-### [Next: Docker Installs - Install Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/other-installation-methods/air-gap/install-rancher/)
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
deleted file mode 100644
index b67ccc5370e..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca/_index.md
+++ /dev/null
@@ -1,160 +0,0 @@
----
-title: Template for an RKE Cluster with a Certificate Signed by Recognized CA and a Layer 4 Load Balancer
-weight: 3
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Certificate signed by a recognized CA
-- Layer 4 load balancer
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/)
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-ingress
-    namespace: cattle-system
-  type: Opaque
-  data:
-    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If self-signed, must be signed by same CA as cattle server
-    tls.key: <BASE64_KEY>  # ssl key for ingress. If self-signed, must be signed by same CA as cattle server
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    - port: 443
-      targetPort: 443
-      protocol: TCP
-      name: https
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: <FQDN>  # FQDN to access cattle server
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - <FQDN>      # FQDN to access cattle server
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          args:
-          - --no-cacerts
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          - containerPort: 443
-            protocol: TCP
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
deleted file mode 100644
index 9b24f5b39d5..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate/_index.md
+++ /dev/null
@@ -1,175 +0,0 @@
----
-title: Template for an RKE Cluster with a Self-signed Certificate and Layer 4 Load Balancer
-weight: 2
----
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Self-signed SSL
-- Layer 4 load balancer
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/)
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-ingress
-    namespace: cattle-system
-  type: Opaque
-  data:
-    tls.crt: <BASE64_CRT>  # ssl cert for ingress. If selfsigned, must be signed by same CA as cattle server
-    tls.key: <BASE64_KEY>  # ssl key for ingress. If selfsigned, must be signed by same CA as cattle server
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-server
-    namespace: cattle-system
-  type: Opaque
-  data:
-    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    - port: 443
-      targetPort: 443
-      protocol: TCP
-      name: https
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: <FQDN>  # FQDN to access cattle server
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - <FQDN>      # FQDN to access cattle server
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          - containerPort: 443
-            protocol: TCP
-          volumeMounts:
-          - mountPath: /etc/rancher/ssl
-            name: cattle-keys-volume
-            readOnly: true
-        volumes:
-        - name: cattle-keys-volume
-          secret:
-            defaultMode: 420
-            secretName: cattle-keys-server
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
deleted file mode 100644
index 74f1b8e2e6d..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate/_index.md
+++ /dev/null
@@ -1,158 +0,0 @@
----
-title: Template for an RKE Cluster with a Self-signed Certificate and SSL Termination on Layer 7 Load Balancer
-weight: 3
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Layer 7 load balancer with self-signed SSL termination (HTTPS)
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) 
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: cattle-keys-server
-    namespace: cattle-system
-  type: Opaque
-  data:
-    cacerts.pem: <BASE64_CA>  # CA cert used to sign cattle server cert and key
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/ssl-redirect: "false"        # Disable redirect to ssl
-  spec:
-    rules:
-    - host: <FQDN>
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-          volumeMounts:
-          - mountPath: /etc/rancher/ssl
-            name: cattle-keys-volume
-            readOnly: true
-        volumes:
-        - name: cattle-keys-volume
-          secret:
-            defaultMode: 420
-            secretName: cattle-keys-server
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
deleted file mode 100644
index 4bb8694b284..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca/_index.md
+++ /dev/null
@@ -1,142 +0,0 @@
----
-title: Template for an RKE Cluster with a Recognized CA Certificate and SSL Termination on Layer 7 Load Balancer
-weight: 4
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster.
-
-This template is intended to be used for RKE add-on installs, which are only supported up to Rancher v2.0.8. Please use the Rancher Helm chart if you are installing a newer Rancher version. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
-
-The following template can be used for the cluster.yml if you have a setup with:
-
-- Layer 7 load balancer with SSL termination (HTTPS)
-- [NGINX Ingress controller](https://kubernetes.github.io/ingress-nginx/) 
-
-> For more options, refer to [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-```yaml
-nodes:
-  - address: <IP> # hostname or IP to access nodes
-    user: <USER> # root user (usually 'root')
-    role: [controlplane,etcd,worker] # K8s roles for node
-    ssh_key_path: <PEM_FILE> # path to PEM file
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-  - address: <IP>
-    user: <USER>
-    role: [controlplane,etcd,worker]
-    ssh_key_path: <PEM_FILE>
-
-services:
-  etcd:
-    snapshot: true
-    creation: 6h
-    retention: 24h
-
-addons: |-
-  ---
-  kind: Namespace
-  apiVersion: v1
-  metadata:
-    name: cattle-system
-  ---
-  kind: ServiceAccount
-  apiVersion: v1
-  metadata:
-    name: cattle-admin
-    namespace: cattle-system
-  ---
-  kind: ClusterRoleBinding
-  apiVersion: rbac.authorization.k8s.io/v1
-  metadata:
-    name: cattle-crb
-    namespace: cattle-system
-  subjects:
-  - kind: ServiceAccount
-    name: cattle-admin
-    namespace: cattle-system
-  roleRef:
-    kind: ClusterRole
-    name: cluster-admin
-    apiGroup: rbac.authorization.k8s.io
-  ---
-  apiVersion: v1
-  kind: Service
-  metadata:
-    namespace: cattle-system
-    name: cattle-service
-    labels:
-      app: cattle
-  spec:
-    ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-    selector:
-      app: cattle
-  ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/ssl-redirect: "false"        # Disable redirect to ssl
-  spec:
-    rules:
-    - host: <FQDN>
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-  ---
-  kind: Deployment
-  apiVersion: extensions/v1beta1
-  metadata:
-    namespace: cattle-system
-    name: cattle
-  spec:
-    replicas: 1
-    template:
-      metadata:
-        labels:
-          app: cattle
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        # Rancher install via RKE addons is only supported up to v2.0.8
-        - image: rancher/rancher:v2.0.8
-          args:
-          - --no-cacerts
-          imagePullPolicy: Always
-          name: cattle-server
-  #       env:
-  #       - name: HTTP_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: HTTPS_PROXY
-  #         value: "http://your_proxy_address:port"
-  #       - name: NO_PROXY
-  #         value: "localhost,127.0.0.1,0.0.0.0,10.43.0.0/16,your_network_ranges_that_dont_need_proxy_to_access"
-          livenessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ping
-              port: 80
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          ports:
-          - containerPort: 80
-            protocol: TCP
-```
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md b/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
deleted file mode 100644
index 2e4c7d93f60..00000000000
--- a/content/rancher/v2.x/en/installation/options/cluster-yml-templates/_index.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-title: cluster.yml Templates
-weight: 1
----
-
-RKE uses a cluster.yml file to install and configure your Kubernetes cluster. This section provides templates that can be used to create the cluster.yml.
-
-> For more cluster.yml options, refer to the[RKE configuration reference.]({{<baseurl>}}/rke/latest/en/config-options/).
\ No newline at end of file
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
deleted file mode 100644
index ddd8d3db46e..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/_index.md
+++ /dev/null
@@ -1,218 +0,0 @@
----
-title: "4.  Install Rancher"
-weight: 200
----
-
-Rancher installation is managed using the Helm package manager for Kubernetes.  Use `helm` to install the prerequisite and charts to install Rancher.
-
-For systems without direct internet access, see [Air Gap: Kubernetes install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/).
-
-Refer to the [Helm version requirements]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm-version) to choose a version of Helm to install Rancher.
-
-> **Note:** The installation instructions assume you are using Helm 2. The instructions will be updated for Helm 3 soon. In the meantime, if you want to use Helm 3, refer to [these instructions.](https://github.com/ibrokethecloud/rancher-helm3)
-
-### Add the Helm Chart Repository
-
-Use `helm repo add` command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see [Choosing a Version of Rancher]({{<baseurl>}}/rancher/v2.x/en/installation/options/server-tags/#helm-chart-repositories).
-
-{{< release-channel >}}
-
-```
-helm repo add rancher-<CHART_REPO> https://releases.rancher.com/server-charts/<CHART_REPO>
-```
-
-### Choose your SSL Configuration
-
-Rancher Server is designed to be secure by default and requires SSL/TLS configuration.
-
-There are three recommended options for the source of the certificate.
-
-> **Note:** If you want terminate SSL/TLS externally, see [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#external-tls-termination).
-
-| Configuration | Chart option | Description | Requires cert-manager |
-|-----|-----|-----|-----|
-| [Rancher Generated Certificates](#rancher-generated-certificates) | `ingress.tls.source=rancher` | Use certificates issued by Rancher's generated CA (self signed)<br/>This is the **default** | [yes](#optional-install-cert-manager) |
-| [Let’s Encrypt](#let-s-encrypt) | `ingress.tls.source=letsEncrypt` | Use [Let's Encrypt](https://letsencrypt.org/) to issue a certificate | [yes](#optional-install-cert-manager) |
-| [Certificates from Files](#certificates-from-files) | `ingress.tls.source=secret` | Use your own certificate files by creating Kubernetes Secret(s) | no |
-
-### Optional: Install cert-manager
-
-**Note:** cert-manager is only required for certificates issued by Rancher's generated CA (`ingress.tls.source=rancher`) and Let's Encrypt issued certificates (`ingress.tls.source=letsEncrypt`). You should skip this step if you are using your own certificate files (option `ingress.tls.source=secret`) or if you use [TLS termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#external-tls-termination).
-
-> **Important:**
-> Due to an issue with Helm v2.12.0 and cert-manager, please use Helm v2.12.1 or higher.
-
-> Recent changes to cert-manager require an upgrade. If you are upgrading Rancher and using a version of cert-manager older than v0.12.0, please see our [upgrade documentation]({{<baseurl>}}/rancher/v2.x/en/installation/options/upgrading-cert-manager/).
-
-Rancher relies on [cert-manager](https://github.com/jetstack/cert-manager) to issue certificates from Rancher's own generated CA or to request Let's Encrypt certificates.
-
-These instructions are adapted from the [official cert-manager documentation](https://docs.cert-manager.io/en/latest/getting-started/install/kubernetes.html#installing-with-helm).
-
-
-1. Install the CustomResourceDefinition resources separately
-    ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    ```
-
-1. Create the namespace for cert-manager
-    ```plain
-    kubectl create namespace cert-manager
-    ```
-
-1. Label the cert-manager namespace to disable resource validation
-    ```plain
-    kubectl label namespace cert-manager certmanager.k8s.io/disable-validation=true
-    ```
-
-1. Add the Jetstack Helm repository
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    ```
-
-1. Update your local Helm chart repository cache
-    ```plain
-    helm repo update
-    ```
-
-1. Install the cert-manager Helm chart
-    ```plain
-    helm install \
-      --name cert-manager \
-      --namespace cert-manager \
-      --version v0.12.0 \
-      jetstack/cert-manager
-    ```
-
-Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the cert-manager namespace for running pods:
-
-```
-kubectl get pods --namespace cert-manager
-
-NAME                                            READY   STATUS      RESTARTS   AGE
-cert-manager-7cbdc48784-rpgnt                   1/1     Running     0          3m
-cert-manager-webhook-5b5dd6999-kst4x            1/1     Running     0          3m
-cert-manager-cainjector-3ba5cd2bcd-de332x       1/1     Running     0          3m
-```
-
-If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check the [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide.
-
-<br/>
-
-#### Rancher Generated Certificates
-
-> **Note:** You need to have [cert-manager](#optional-install-cert-manager) installed before proceeding.
-
-The default is for Rancher to generate a CA and uses `cert-manager` to issue the certificate for access to the Rancher server interface. Because `rancher` is the default option for `ingress.tls.source`, we are not specifying `ingress.tls.source` when running the `helm install` command.
-
-- Set the `hostname` to the DNS name you pointed at your load balancer.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-#### Let's Encrypt
-
-> **Note:** You need to have [cert-manager](#optional-install-cert-manager) installed before proceeding.
-
-This option uses `cert-manager` to automatically request and renew [Let's Encrypt](https://letsencrypt.org/) certificates. This is a free service that provides you with a valid certificate as Let's Encrypt is a trusted CA. This configuration uses HTTP validation (`HTTP-01`) so the load balancer must have a public DNS record and be accessible from the internet.
-
-- Set `hostname` to the public DNS record, set `ingress.tls.source` to `letsEncrypt` and `letsEncrypt.email` to the email address used for communication about your certificate (for example, expiry notices)
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=letsEncrypt \
-  --set letsEncrypt.email=me@example.org
-```
-
-Wait for Rancher to be rolled out:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-#### Certificates from Files
-
-Create Kubernetes secrets from your own certificates for Rancher to use.
-
-
-> **Note:** The `Common Name` or a `Subject Alternative Names` entry in the server certificate must match the `hostname` option, or the ingress controller will fail to configure correctly. Although an entry in the `Subject Alternative Names` is technically required, having a matching `Common Name` maximizes compatibility with older browsers/applications. If you want to check if your certificates are correct, see [How do I check Common Name and Subject Alternative Names in my server certificate?]({{<baseurl>}}/rancher/v2.x/en/faq/technical/#how-do-i-check-common-name-and-subject-alternative-names-in-my-server-certificate)
-
-- Set `hostname` and set `ingress.tls.source` to `secret`.
-- If you are installing an alpha version, Helm requires adding the `--devel` option to the command. 
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret
-```
-
-If you are using a Private CA signed certificate , add `--set privateCA=true` to the command:
-
-```
-helm install rancher-<CHART_REPO>/rancher \
-  --name rancher \
-  --namespace cattle-system \
-  --set hostname=rancher.my.org \
-  --set ingress.tls.source=secret
-  --set privateCA=true
-```
-
-Now that Rancher is deployed, see [Adding TLS Secrets]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/) to publish the certificate files so Rancher and the ingress controller can use them.
-
-After adding the secrets, check if Rancher was rolled out successfully:
-
-```
-kubectl -n cattle-system rollout status deploy/rancher
-Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
-deployment "rancher" successfully rolled out
-```
-
-If you see the following error: `error: deployment "rancher" exceeded its progress deadline`, you can check the status of the deployment by running the following command:
-
-```
-kubectl -n cattle-system get deploy rancher
-NAME      DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
-rancher   3         3         3            3           3m
-```
-
-It should show the same count for `DESIRED` and `AVAILABLE`.
-
-### Advanced Configurations
-
-The Rancher chart configuration has many options for customizing the install to suit your specific environment. Here are some common advanced scenarios.
-
-* [HTTP Proxy]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#http-proxy)
-* [Private Docker Image Registry]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#private-registry-and-air-gap-installs)
-* [TLS Termination on an External Load Balancer]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/#external-tls-termination)
-
-See the [Chart Options]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/) for the full list of options.
-
-### Save your options
-
-Make sure you save the `--set` options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
-
-### Finishing Up
-
-That's it you should have a functional Rancher server. Point a browser at the hostname you picked and you should be greeted by the colorful login page.
-
-Doesn't work? Take a look at the [Troubleshooting]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/troubleshooting/) Page
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
deleted file mode 100644
index 261365488ac..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/chart-options/_index.md
+++ /dev/null
@@ -1,245 +0,0 @@
----
-title: Chart Options
-weight: 276
----
-
-### Common Options
-
-| Option | Default Value | Description |
-| --- | --- | --- |
-| `hostname` | " " | `string` - the Fully Qualified Domain Name for your Rancher Server |
-| `ingress.tls.source` | "rancher" | `string` - Where to get the cert for the ingress. - "rancher, letsEncrypt, secret" |
-| `letsEncrypt.email` | " " | `string` - Your email address |
-| `letsEncrypt.environment` | "production" | `string` - Valid options: "staging, production" |
-| `privateCA` | false | `bool` - Set to true if your cert is signed by a private CA |
-
-<br/>
-
-### Advanced Options
-
-| Option | Default Value | Description |
-| --- | --- | --- |
-| `additionalTrustedCAs` | false | `bool` - See [Additional Trusted CAs](#additional-trusted-cas) |
-| `addLocal` | "auto" | `string` - Have Rancher detect and import the "local" Rancher server cluster [Import "local Cluster](#import-local-cluster) |
-| `antiAffinity` | "preferred" | `string` - AntiAffinity rule for Rancher pods - "preferred, required" |
-| `auditLog.destination` | "sidecar" | `string` - Stream to sidecar container console or hostPath volume - "sidecar, hostPath" |
-| `auditLog.hostPath` | "/var/log/rancher/audit" | `string` - log file destination on host (only applies when `auditLog.destination` is set to `hostPath`) |
-| `auditLog.level` | 0 | `int` - set the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) level. 0 is off. [0-3] |
-| `auditLog.maxAge` | 1 | `int` - maximum number of days to retain old audit log files (only applies when `auditLog.destination` is set to `hostPath`) |
-| `auditLog.maxBackups` | 1 | `int` - maximum number of audit log files to retain (only applies when `auditLog.destination` is set to `hostPath`) |
-| `auditLog.maxSize` | 100 | `int` - maximum size in megabytes of the audit log file before it gets rotated  (only applies when `auditLog.destination` is set to `hostPath`) |
-| `busyboxImage` | "busybox" | `string` - Image location for busybox image used to collect audit logs _Note: Available as of v2.2.0_ |
-| `debug` | false | `bool` - set debug flag on rancher server |
-| `extraEnv` | [] | `list` - set additional environment variables for Rancher _Note: Available as of v2.2.0_ |
-| `imagePullSecrets` | [] | `list` - list of names of Secret resource containing private registry credentials |
-| `ingress.extraAnnotations` | {} | `map` - additional annotations to customize the ingress |
-| `ingress.configurationSnippet` | "" | `string` - Add additional Nginx configuration. Can be used for proxy configuration. _Note: Available as of v2.0.15, v2.1.10 and v2.2.4_ |
-| `proxy` | "" | `string` -  HTTP[S] proxy server for Rancher |
-| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" | `string` - comma separated list of hostnames or ip address not to use the proxy |
-| `resources` | {} | `map` - rancher pod resource requests & limits |
-| `rancherImage` | "rancher/rancher" | `string` - rancher image source |
-| `rancherImageTag` | same as chart version | `string` - rancher/rancher image tag |
-| `tls` | "ingress" | `string` - See [External TLS Termination](#external-tls-termination) for details. - "ingress, external" |
-| `systemDefaultRegistry` | "" | `string` - private registry to be used for all system Docker images, e.g., http://registry.example.com/ _Available as of v2.3.0_ |
-| `useBundledSystemChart` | `false` | `bool` - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. _Available as of v2.3.0_
-
-<br/>
-
-### API Audit Log
-
-Enabling the [API Audit Log]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing/).
-
-You can collect this log as you would any container log. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the `System` Project on the Rancher server cluster.
-
-```plain
---set auditLog.level=1
-```
-
-By default enabling Audit Logging will create a sidecar container in the Rancher pod. This container (`rancher-audit-log`) will stream the log to `stdout`.  You can collect this log as you would any container log. When using the sidecar as the audit log destination, the `hostPath`, `maxAge`, `maxBackups`, and `maxSize` options do not apply. It's advised to use your OS or Docker daemon's log rotation features to control disk space use. Enable the [Logging service under Rancher Tools]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/logging/) for the Rancher server cluster or System Project.
-
-Set the `auditLog.destination` to `hostPath` to forward logs to volume shared with the host system instead of streaming to a sidecar container. When setting the destination to `hostPath` you may want to adjust the other auditLog parameters for log rotation.
-
-### Setting Extra Environment Variables
-
-_Available as of v2.2.0_
-
-You can set extra environment variables for Rancher server using `extraEnv`. This list uses the same `name` and `value` keys as the container manifest definitions. Remember to quote the values.
-
-```plain
---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
---set 'extraEnv[0].value=1.0'
-```
-
-### TLS settings
-
-_Available as of v2.2.0_
-
-To set a different TLS configuration, you can use the `CATTLE_TLS_MIN_VERSION` and `CATTLE_TLS_CIPHERS` environment variables. For example, to configure TLS 1.0 as minimum accepted TLS version:
-
-```plain
---set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION'
---set 'extraEnv[0].value=1.0'
-```
-
-See [TLS settings]({{<baseurl>}}/rancher/v2.x/en/admin-settings/tls-settings) for more information and options.
-
-### Import `local` Cluster
-
-By default Rancher server will detect and import the `local` cluster it's running on.  User with access to the `local` cluster will essentially have "root" access to all the clusters managed by Rancher server.
-
-If this is a concern in your environment you can set this option to "false" on your initial install.
-
-> Note: This option is only effective on the initial Rancher install. See [Issue 16522](https://github.com/rancher/rancher/issues/16522) for more information.
-
-```plain
---set addLocal="false"
-```
-
-### Customizing your Ingress
-
-To customize or use a different ingress with Rancher server you can set your own Ingress annotations.
-
-Example on setting a custom certificate issuer:
-
-```plain
---set ingress.extraAnnotations.'certmanager\.k8s\.io/cluster-issuer'=ca-key-pair
-```
-
-_Available as of v2.0.15, v2.1.10 and v2.2.4_
-
-Example on setting a static proxy header with `ingress.configurationSnippet`. This value is parsed like a template so variables can be used.
-
-```plain
---set ingress.configurationSnippet='more_set_input_headers X-Forwarded-Host {{ .Values.hostname }};'
-```
-
-### HTTP Proxy
-
-Rancher requires internet access for some functionality (helm charts). Use `proxy` to set your proxy server.
-
-Add your IP exceptions to the `noProxy` list. Make sure you add the Service cluster IP range (default: 10.43.0.1/16) and any worker cluster `controlplane` nodes. Rancher supports CIDR notation ranges in this list.
-
-```plain
---set proxy="http://<username>:<password>@<proxy_url>:<proxy_port>/"
---set noProxy="127.0.0.0/8\,10.0.0.0/8\,172.16.0.0/12\,192.168.0.0/16"
-```
-
-### Additional Trusted CAs
-
-If you have private registries, catalogs or a proxy that intercepts certificates, you may need to add additional trusted CAs to Rancher.
-
-```plain
---set additionalTrustedCAs=true
-```
-
-Once the Rancher deployment is created, copy your CA certs in pem format into a file named `ca-additional.pem` and use `kubectl` to create the `tls-ca-additional` secret in the `cattle-system` namespace.
-
-```plain
-kubectl -n cattle-system create secret generic tls-ca-additional --from-file=ca-additional.pem=./ca-additional.pem
-```
-
-### Private Registry and Air Gap Installs
-
-For details on installing Rancher with a private registry, see:
-
-- [Air Gap: Docker Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-single-node/)
-- [Air Gap: Kubernetes Install]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-high-availability/)
-
-
-### External TLS Termination
-
-We recommend configuring your load balancer as a Layer 4 balancer, forwarding plain 80/tcp and 443/tcp to the Rancher Management cluster nodes. The Ingress Controller on the cluster will redirect http traffic on port 80 to https on port 443.
-
-You may terminate the SSL/TLS on a L7 load balancer external to the Rancher cluster (ingress). Use the `--set tls=external` option and point your load balancer at port http 80 on all of the Rancher cluster nodes. This will expose the Rancher interface on http port 80. Be aware that clients that are allowed to connect directly to the Rancher cluster will not be encrypted. If you choose to do this we recommend that you restrict direct access at the network level to just your load balancer.
-
-> **Note:** If you are using a Private CA signed certificate, add `--set privateCA=true` and see [Adding TLS Secrets - Using a Private CA Signed Certificate]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/#using-a-private-ca-signed-certificate) to add the CA cert for Rancher.
-
-Your load balancer must support long lived websocket connections and will need to insert proxy headers so Rancher can route links correctly.
-
-#### Configuring Ingress for External TLS when Using NGINX v0.25
-
-In NGINX v0.25, the behavior of NGINX has [changed](https://github.com/kubernetes/ingress-nginx/blob/master/Changelog.md#0220) regarding forwarding headers and external TLS termination. Therefore, in the scenario that you are using external TLS termination configuration with NGINX v0.25, you must edit the `cluster.yml` to enable the `use-forwarded-headers` option for ingress:
-
-```yaml
-ingress:
-  provider: nginx
-  options:
-    use-forwarded-headers: "true"
-```
-
-#### Required Headers
-
-* `Host`
-* `X-Forwarded-Proto`
-* `X-Forwarded-Port`
-* `X-Forwarded-For`
-
-#### Recommended Timeouts
-
-* Read Timeout: `1800 seconds`
-* Write Timeout: `1800 seconds`
-* Connect Timeout: `30 seconds`
-
-#### Health Checks
-
-Rancher will respond `200` to health checks on the `/healthz` endpoint.
-
-
-#### Example NGINX config
-
-This NGINX configuration is tested on NGINX 1.14.
-
-  >**Note:** This NGINX configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - HTTP Load Balancing](https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/).
-
-* Replace `IP_NODE1`, `IP_NODE2` and `IP_NODE3` with the IP addresses of the nodes in your cluster.
-* Replace both occurrences of `FQDN` to the DNS name for Rancher.
-* Replace `/certs/fullchain.pem` and `/certs/privkey.pem` to the location of the server certificate and the server certificate key respectively.
-
-```
-worker_processes 4;
-worker_rlimit_nofile 40000;
-
-events {
-    worker_connections 8192;
-}
-
-http {
-    upstream rancher {
-        server IP_NODE_1:80;
-        server IP_NODE_2:80;
-        server IP_NODE_3:80;
-    }
-
-    map $http_upgrade $connection_upgrade {
-        default Upgrade;
-        ''      close;
-    }
-
-    server {
-        listen 443 ssl http2;
-        server_name FQDN;
-        ssl_certificate /certs/fullchain.pem;
-        ssl_certificate_key /certs/privkey.pem;
-
-        location / {
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_set_header X-Forwarded-Port $server_port;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_pass http://rancher;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
-            proxy_read_timeout 900s;
-            proxy_buffering off;
-        }
-    }
-
-    server {
-        listen 80;
-        server_name FQDN;
-        return 301 https://$server_name$request_uri;
-    }
-}
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md b/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
deleted file mode 100644
index 65a9b8435fa..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/helm-rancher/tls-secrets/_index.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-title: Adding Kubernetes TLS Secrets
-description: Read about how to populate the Kubernetes TLS secret for a Rancher installation  
-weight: 276
----
-
-Kubernetes will create all the objects and services for Rancher, but it will not become available until we populate the `tls-rancher-ingress` secret in the `cattle-system` namespace with the certificate and key.
-
-Combine the server certificate followed by any intermediate certificate(s) needed into a file named `tls.crt`. Copy your certificate key into a file named `tls.key`.
-
-For example, [acme.sh](https://acme.sh) provides server certificate and CA chains in `fullchain.cer` file. 
-This `fullchain.cer` should be renamed to `tls.crt` & certificate key file as `tls.key`.
-
-Use `kubectl` with the `tls` secret type to create the secrets.
-
-```
-kubectl -n cattle-system create secret tls tls-rancher-ingress \
-  --cert=tls.crt \
-  --key=tls.key
-```
-
-> **Note:** If you want to replace the certificate, you can delete the `tls-rancher-ingress` secret using `kubectl -n cattle-system delete secret tls-rancher-ingress` and add a new one using the command shown above. If you are using a private CA signed certificate, replacing the certificate is only possible if the new certificate is signed by the same CA as the certificate currently in use.
-
-### Using a Private CA Signed Certificate
-
-If you are using a private CA, Rancher requires a copy of the CA certificate which is used by the Rancher Agent to validate the connection to the server.
-
-Copy the CA certificate into a file named `cacerts.pem` and use `kubectl` to create the `tls-ca` secret in the `cattle-system` namespace.
-
-```
-kubectl -n cattle-system create secret generic tls-ca \
-  --from-file=cacerts.pem=./cacerts.pem
-```
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
deleted file mode 100644
index 6b88e593545..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-4-lb/_index.md
+++ /dev/null
@@ -1,400 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (TCP/Layer 4)
-weight: 275
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a High-availability Kubernetes install with an RKE add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the Helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 4 load balancer (TCP)
-- [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/)
-
-In a Kubernetes setup that uses a layer 4 load balancer, the load balancer accepts Rancher client connections over the TCP/UDP protocols (i.e., the transport level). The load balancer then forwards these connections to individual cluster nodes without reading the request itself. Because the load balancer cannot read the packets it's forwarding, the routing decisions it can make are limited.
-
-<sup>Kubernetes Rancher install with layer 4 load balancer, depicting SSL termination at ingress controllers</sup>
-![High-availability Kubernetes installation of Rancher]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-<!-- /TOC -->
-
-<br/>
-
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install-server-install/nlb/)
-
->**Note:**
-> In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX.
->
->One caveat: do not use one of your Rancher nodes as the load balancer.
-
-### A. Install NGINX
-
-Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-The `stream` module is required, which is present when using the official NGINX packages. Please refer to your OS documentation how to install and enable the NGINX `stream` module on your operating system.
-
-### B. Create NGINX Configuration
-
-After installing NGINX, you need to update the NGINX config file, `nginx.conf`, with the IP addresses for your nodes.
-
-1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`.
-
-2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts).
-
-    >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
-
-    **Example NGINX config:**
-    ```
-    worker_processes 4;
-    worker_rlimit_nofile 40000;
-
-    events {
-        worker_connections 8192;
-    }
-
-    http {
-        server {
-            listen         80;
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    stream {
-        upstream rancher_servers {
-            least_conn;
-            server IP_NODE_1:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_2:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_3:443 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen     443;
-            proxy_pass rancher_servers;
-        }
-    }
-    ```
-
-3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`.
-
-4. Load the updates to your NGINX configuration by running the following command:
-
-    ```
-    # nginx -s reload
-    ```
-
-### Option - Run NGINX as Docker container
-
-Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /etc/nginx.conf:/etc/nginx/nginx.conf \
-  nginx:1.14
-```
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) >for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
-
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [Intermediate Certificates](#cert-order).
-
-1. In `kind: Secret` with `name: cattle-keys-ingress`:
-
-    * Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-    * Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-        name: cattle-keys-ingress
-        namespace: cattle-system
-    type: Opaque
-    data:
-        tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-        tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-    ```
-
-2. In `kind: Secret` with `name: cattle-keys-server`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`).
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-
-    **Step Result:** The file should look like the example below (the base64 encoded string should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-      name: cattle-keys-server
-      namespace: cattle-system
-    type: Opaque
-    data:
-      cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    ```
-
-{{% /accordion %}}
-
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
->**Note:**
-> If you are using Self Signed Certificate, [click here](#option-a-bring-your-own-certificate-self-signed) to proceed.
-
-If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#cert-order) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included.
-
-In the `kind: Secret` with `name: cattle-keys-ingress`:
-
-* Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-* Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
->**Note:**
-> The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-```yaml
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cattle-keys-ingress
-  namespace: cattle-system
-type: Opaque
-data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-```
-
-{{% /accordion %}}
-
-
-
-## 8. Configure FQDN
-
-There are two references to `<FQDN>` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-In the `kind: Ingress` with `name: cattle-ingress-http`:
-
-* Replace `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-After replacing `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example):
-
-```yaml
- ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: rancher.yourdomain.com
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - rancher.yourdomain.com
-```
-
-Save the `.yml` file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-```
-rke up --config rancher-cluster.yml
-```
-
-**Step Result:** The output should be similar to the snippet below:
-
-```
-INFO[0000] Building Kubernetes cluster
-INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-INFO[0000] [network] Deploying port listener containers
-INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-...
-INFO[0101] Finished building Kubernetes cluster successfully
-```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-You have a couple of options:
-
-- Create a backup of your Rancher Server in case of a disaster scenario: [High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration).
-- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
deleted file mode 100644
index f5485b14c82..00000000000
--- a/content/rancher/v2.x/en/installation/options/helm2/rke-add-on/layer-7-lb/_index.md
+++ /dev/null
@@ -1,288 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (HTTPS/Layer 7)
-weight: 276
-aliases:
-- /rancher/v2.x/en/installation/ha-server-install-external-lb/
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 7 Loadbalancer with SSL termination (HTTPS)
-- [NGINX Ingress controller (HTTP)](https://kubernetes.github.io/ingress-nginx/)
-
-In an Kubernetes setup that uses a layer 7 load balancer, the load balancer accepts Rancher client connections over the HTTP protocol (i.e., the application level). This application-level access allows the load balancer to read client requests and then redirect to them to cluster nodes using logic that optimally distributes load.
-
-<sup>Kubernetes Rancher install with layer 7 load balancer, depicting SSL termination at load balancer</sup>
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha-l7.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-
-<!-- /TOC -->
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally.
-
-The load balancer has to be configured to support the following:
-
-* **WebSocket** connections
-* **SPDY** / **HTTP/2** protocols
-* Passing / setting the following headers:
-
-| Header              | Value                                  | Description                                                                                                                                                              |
-|---------------------|----------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `Host`              | FQDN used to reach Rancher. | To identify the server requested by the client.                                                                                                                           |
-| `X-Forwarded-Proto` | `https`                                | To identify the protocol that a client used to connect to the load balancer.<br /><br/>**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS. |
-| `X-Forwarded-Port`  | Port used to reach Rancher.             | To identify the protocol that client used to connect to the load balancer.                                                                                       |
-| `X-Forwarded-For`   | IP of the client connection.            | To identify the originating IP address of a client.                                                                                                                       |
-
-Health checks can be executed on the `/healthz` endpoint of the node, this will return HTTP 200.
-
-We have example configurations for the following load balancers:
-
-* [Amazon ALB configuration](alb/)
-* [NGINX configuration](nginx/)
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a YAML config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/options/helm2/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    >
-    >When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-In `kind: Secret` with `name: cattle-keys-ingress`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`)
-
->**Note:** The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-        ---
-        apiVersion: v1
-        kind: Secret
-        metadata:
-            name: cattle-keys-server
-            namespace: cattle-system
-        type: Opaque
-        data:
-            cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
-If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part.
-{{% /accordion %}}
-
-## 8. Configure FQDN
-
-There is one reference to `<FQDN>` in the RKE config file. Replace this reference with the FQDN you chose in [3. Configure DNS](#3-configure-dns).
-
-1. Open `rancher-cluster.yml`.
-
-2. In the `kind: Ingress` with `name: cattle-ingress-http:`
-
-    Replace `<FQDN>` with the FQDN chosen in [3. Configure DNS](#3-configure-dns).
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```
-    apiVersion: extensions/v1beta1
-      kind: Ingress
-      metadata:
-        namespace: cattle-system
-        name: cattle-ingress-http
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-          nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      spec:
-        rules:
-        - host: rancher.yourdomain.com
-          http:
-            paths:
-            - backend:
-                serviceName: cattle-service
-                servicePort: 80
-    ```
-
-
-3. Save the file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your RKE config file, `rancher-cluster.yml`, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-    ```
-    rke up --config rancher-cluster.yml
-    ```
-
-    **Step Result:** The output should be similar to the snippet below:
-
-    ```
-    INFO[0000] Building Kubernetes cluster
-    INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-    INFO[0000] [network] Deploying port listener containers
-    INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-    ...
-    INFO[0101] Finished building Kubernetes cluster successfully
-    ```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-- **Recommended:** Review [Creating Backups—High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/) to learn how to backup your Rancher Server in case of a disaster scenario.
-- Create a Kubernetes cluster: [Creating a Cluster]({{<baseurl>}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
deleted file mode 100644
index f40f56075be..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/_index.md
+++ /dev/null
@@ -1,402 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (TCP/Layer 4)
-weight: 275
-aliases:
-- /rancher/v2.x/en/installation/ha/rke-add-on/layer-4-lb
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 4 load balancer (TCP)
-- [NGINX ingress controller with SSL termination (HTTPS)](https://kubernetes.github.io/ingress-nginx/)
-
-In an HA setup that uses a layer 4 load balancer, the load balancer accepts Rancher client connections over the TCP/UDP protocols (i.e., the transport level). The load balancer then forwards these connections to individual cluster nodes without reading the request itself. Because the load balancer cannot read the packets it's forwarding, the routing decisions it can make are limited.
-
-<sup>Rancher installed on a Kubernetes cluster with layer 4 load balancer, depicting SSL termination at ingress controllers</sup>
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-<!-- /TOC -->
-
-<br/>
-
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-We will be using NGINX as our Layer 4 Load Balancer (TCP). NGINX will forward all connections to one of your Rancher nodes. If you want to use Amazon NLB, you can skip this step and use [Amazon NLB configuration]({{<baseurl>}}/rancher/v2.x/en/installation/options/rke-add-on/layer-4-lb/nlb/)
-
->**Note:**
-> In this configuration, the load balancer is positioned in front of your Linux hosts. The load balancer can be any host that you have available that's capable of running NGINX.
->
->One caveat: do not use one of your Rancher nodes as the load balancer.
-
-### A. Install NGINX
-
-Start by installing NGINX on your load balancer host. NGINX has packages available for all known operating systems. For help installing NGINX, refer to their [install documentation](https://www.nginx.com/resources/wiki/start/topics/tutorials/install/).
-
-The `stream` module is required, which is present when using the official NGINX packages. Please refer to your OS documentation how to install and enable the NGINX `stream` module on your operating system.
-
-### B. Create NGINX Configuration
-
-After installing NGINX, you need to update the NGINX config file, `nginx.conf`, with the IP addresses for your nodes.
-
-1. Copy and paste the code sample below into your favorite text editor. Save it as `nginx.conf`.
-
-2. From `nginx.conf`, replace `IP_NODE_1`, `IP_NODE_2`, and `IP_NODE_3` with the IPs of your [Linux hosts](#1-provision-linux-hosts).
-
-    >**Note:** This Nginx configuration is only an example and may not suit your environment. For complete documentation, see [NGINX Load Balancing - TCP and UDP Load Balancer](https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/).
-
-    **Example NGINX config:**
-    ```
-    worker_processes 4;
-    worker_rlimit_nofile 40000;
-
-    events {
-        worker_connections 8192;
-    }
-
-    http {
-        server {
-            listen         80;
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    stream {
-        upstream rancher_servers {
-            least_conn;
-            server IP_NODE_1:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_2:443 max_fails=3 fail_timeout=5s;
-            server IP_NODE_3:443 max_fails=3 fail_timeout=5s;
-        }
-        server {
-            listen     443;
-            proxy_pass rancher_servers;
-        }
-    }
-    ```
-
-3. Save `nginx.conf` to your load balancer at the following path: `/etc/nginx/nginx.conf`.
-
-4. Load the updates to your NGINX configuration by running the following command:
-
-    ```
-    # nginx -s reload
-    ```
-
-### Option - Run NGINX as Docker container
-
-Instead of installing NGINX as a package on the operating system, you can rather run it as a Docker container. Save the edited **Example NGINX config** as `/etc/nginx.conf` and run the following command to launch the NGINX container:
-
-```
-docker run -d --restart=unless-stopped \
-  -p 80:80 -p 443:443 \
-  -v /etc/nginx.conf:/etc/nginx/nginx.conf \
-  nginx:1.14
-```
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a `.yml` config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-certificate-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-certificate-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    > When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) >for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
-
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [Intermediate Certificates](#cert-order).
-
-1. In `kind: Secret` with `name: cattle-keys-ingress`:
-
-    * Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-    * Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-        name: cattle-keys-ingress
-        namespace: cattle-system
-    type: Opaque
-    data:
-        tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-        tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-    ```
-
-2. In `kind: Secret` with `name: cattle-keys-server`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`).
-
-    >**Note:**
-    > The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-
-    **Step Result:** The file should look like the example below (the base64 encoded string should be different):
-
-    ```yaml
-    ---
-    apiVersion: v1
-    kind: Secret
-    metadata:
-      name: cattle-keys-server
-      namespace: cattle-system
-    type: Opaque
-    data:
-      cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-    ```
-
-{{% /accordion %}}
-
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
->**Note:**
-> If you are using Self Signed Certificate, [click here](#option-a-bring-your-own-certificate-self-signed) to proceed.
-
-If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#cert-order) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included.
-
-In the `kind: Secret` with `name: cattle-keys-ingress`:
-
-* Replace `<BASE64_CRT>` with the base64 encoded string of the Certificate file (usually called `cert.pem` or `domain.crt`)
-* Replace `<BASE64_KEY>` with the base64 encoded string of the Certificate Key file (usually called `key.pem` or `domain.key`)
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
->**Note:**
-> The base64 encoded string should be on the same line as `tls.crt` or `tls.key`, without any newline at the beginning, in between or at the end.
-
-```yaml
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cattle-keys-ingress
-  namespace: cattle-system
-type: Opaque
-data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1RENDQWN5Z0F3SUJBZ0lKQUlHc25NeG1LeGxLTUEwR0NTcUdTSWIzRFFFQkN3VUFNQkl4RURBT0JnTlYKQkFNTUIzUmxjM1F0WTJFd0hoY05NVGd3TlRBMk1qRXdOREE1V2hjTk1UZ3dOekExTWpFd05EQTVXakFXTVJRdwpFZ1lEVlFRRERBdG9ZUzV5Ym1Ob2NpNXViRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DCmdnRUJBTFJlMXdzekZSb2Rib2pZV05DSHA3UkdJaUVIMENDZ1F2MmdMRXNkUUNKZlcrUFEvVjM0NnQ3bSs3TFEKZXJaV3ZZMWpuY2VuWU5JSGRBU0VnU0ducWExYnhUSU9FaE0zQXpib3B0WDhjSW1OSGZoQlZETGdiTEYzUk0xaQpPM1JLTGdIS2tYSTMxZndjbU9zWGUwaElYQnpUbmxnM20vUzlXL3NTc0l1dDVwNENDUWV3TWlpWFhuUElKb21lCmpkS3VjSHFnMTlzd0YvcGVUalZrcVpuMkJHazZRaWFpMU41bldRV0pjcThTenZxTTViZElDaWlwYU9hWWQ3RFEKYWRTejV5dlF0YkxQNW4wTXpnOU43S3pGcEpvUys5QWdkWDI5cmZqV2JSekp3RzM5R3dRemN6VWtLcnZEb05JaQo0UFJHc01yclFNVXFSYjRSajNQOEJodEMxWXNDQXdFQUFhTTVNRGN3Q1FZRFZSMFRCQUl3QURBTEJnTlZIUThFCkJBTUNCZUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdJR0NDc0dBUVVGQndNQk1BMEdDU3FHU0liM0RRRUIKQ3dVQUE0SUJBUUNKZm5PWlFLWkowTFliOGNWUW5Vdi9NZkRZVEJIQ0pZcGM4MmgzUGlXWElMQk1jWDhQRC93MgpoOUExNkE4NGNxODJuQXEvaFZYYy9JNG9yaFY5WW9jSEg5UlcvbGthTUQ2VEJVR0Q1U1k4S292MHpHQ1ROaDZ6Ci9wZTNqTC9uU0pYSjRtQm51czJheHFtWnIvM3hhaWpYZG9kMmd3eGVhTklvRjNLbHB2aGU3ZjRBNmpsQTM0MmkKVVlCZ09iN1F5KytRZWd4U1diSmdoSzg1MmUvUUhnU2FVSkN6NW1sNGc1WndnNnBTUXhySUhCNkcvREc4dElSYwprZDMxSk1qY25Fb1Rhc1Jyc1NwVmNGdXZyQXlXN2liakZyYzhienBNcE1obDVwYUZRcEZzMnIwaXpZekhwakFsCk5ZR2I2OHJHcjBwQkp3YU5DS2ErbCtLRTk4M3A3NDYwCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdEY3WEN6TVZHaDF1aU5oWTBJZW50RVlpSVFmUUlLQkMvYUFzU3gxQUlsOWI0OUQ5ClhmanEzdWI3c3RCNnRsYTlqV09keDZkZzBnZDBCSVNCSWFlcHJWdkZNZzRTRXpjRE51aW0xZnh3aVkwZCtFRlUKTXVCc3NYZEV6V0k3ZEVvdUFjcVJjamZWL0J5WTZ4ZDdTRWhjSE5PZVdEZWI5TDFiK3hLd2k2M21uZ0lKQjdBeQpLSmRlYzhnbWlaNk4wcTV3ZXFEWDJ6QVgrbDVPTldTcG1mWUVhVHBDSnFMVTNtZFpCWWx5cnhMTytvemx0MGdLCktLbG81cGgzc05CcDFMUG5LOUMxc3MvbWZRek9EMDNzck1Xa21oTDcwQ0IxZmIydCtOWnRITW5BYmYwYkJETnoKTlNRcXU4T2cwaUxnOUVhd3l1dEF4U3BGdmhHUGMvd0dHMExWaXdJREFRQUJBb0lCQUJKYUErOHp4MVhjNEw0egpwUFd5bDdHVDRTMFRLbTNuWUdtRnZudjJBZXg5WDFBU2wzVFVPckZyTnZpK2xYMnYzYUZoSFZDUEN4N1RlMDVxClhPa2JzZnZkZG5iZFQ2RjgyMnJleVByRXNINk9TUnBWSzBmeDVaMDQwVnRFUDJCWm04eTYyNG1QZk1vbDdya2MKcm9Kd09rOEVpUHZZekpsZUd0bTAwUm1sRysyL2c0aWJsOTVmQXpyc1MvcGUyS3ZoN2NBVEtIcVh6MjlpUmZpbApiTGhBamQwcEVSMjNYU0hHR1ZqRmF3amNJK1c2L2RtbDZURDhrSzFGaUtldmJKTlREeVNXQnpPbXRTYUp1K01JCm9iUnVWWG4yZVNoamVGM1BYcHZRMWRhNXdBa0dJQWxOWjRHTG5QU2ZwVmJyU0plU3RrTGNzdEJheVlJS3BWZVgKSVVTTHM0RUNnWUVBMmNnZUE2WHh0TXdFNU5QWlNWdGhzbXRiYi9YYmtsSTdrWHlsdk5zZjFPdXRYVzkybVJneQpHcEhUQ0VubDB0Z1p3T081T1FLNjdFT3JUdDBRWStxMDJzZndwcmgwNFZEVGZhcW5QNTBxa3BmZEJLQWpmanEyCjFoZDZMd2hLeDRxSm9aelp2VkowV0lvR1ZLcjhJSjJOWGRTUVlUanZUZHhGczRTamdqNFFiaEVDZ1lFQTFBWUUKSEo3eVlza2EvS2V2OVVYbmVrSTRvMm5aYjJ1UVZXazRXSHlaY2NRN3VMQVhGY3lJcW5SZnoxczVzN3RMTzJCagozTFZNUVBzazFNY25oTTl4WE4vQ3ZDTys5b2t0RnNaMGJqWFh6NEJ5V2lFNHJPS1lhVEFwcDVsWlpUT3ZVMWNyCm05R3NwMWJoVDVZb2RaZ3IwUHQyYzR4U2krUVlEWnNFb2lFdzNkc0NnWUVBcVJLYWNweWZKSXlMZEJjZ0JycGkKQTRFalVLMWZsSjR3enNjbGFKUDVoM1NjZUFCejQzRU1YT0kvSXAwMFJsY3N6em83N3cyMmpud09mOEJSM0RBMwp6ZTRSWDIydWw4b0hGdldvdUZOTTNOZjNaNExuYXpVc0F0UGhNS2hRWGMrcEFBWGthUDJkZzZ0TU5PazFxaUNHCndvU212a1BVVE84b1ViRTB1NFZ4ZmZFQ2dZQUpPdDNROVNadUlIMFpSSitIV095enlOQTRaUEkvUkhwN0RXS1QKajVFS2Y5VnR1OVMxY1RyOTJLVVhITXlOUTNrSjg2OUZPMnMvWk85OGg5THptQ2hDTjhkOWN6enI5SnJPNUFMTApqWEtBcVFIUlpLTFgrK0ZRcXZVVlE3cTlpaHQyMEZPb3E5OE5SZDMzSGYxUzZUWDNHZ3RWQ21YSml6dDAxQ3ZHCmR4VnVnd0tCZ0M2Mlp0b0RLb3JyT2hvdTBPelprK2YwQS9rNDJBOENiL29VMGpwSzZtdmxEWmNYdUF1QVZTVXIKNXJCZjRVYmdVYndqa1ZWSFR6LzdDb1BWSjUvVUxJWk1Db1RUNFprNTZXWDk4ZE93Q3VTVFpZYnlBbDZNS1BBZApTZEpuVVIraEpnSVFDVGJ4K1dzYnh2d0FkbWErWUhtaVlPRzZhSklXMXdSd1VGOURLUEhHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
-```
-
-{{% /accordion %}}
-
-
-
-## 8. Configure FQDN
-
-There are two references to `<FQDN>` in the config file (one in this step and one in the next). Both need to be replaced with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-In the `kind: Ingress` with `name: cattle-ingress-http`:
-
-* Replace `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns).
-
-After replacing `<FQDN>` with the FQDN chosen in [Configure DNS](#3-configure-dns), the file should look like the example below (`rancher.yourdomain.com` is the FQDN used in this example):
-
-```yaml
- ---
-  apiVersion: extensions/v1beta1
-  kind: Ingress
-  metadata:
-    namespace: cattle-system
-    name: cattle-ingress-http
-    annotations:
-      nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-      nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-  spec:
-    rules:
-    - host: rancher.yourdomain.com
-      http:
-        paths:
-        - backend:
-            serviceName: cattle-service
-            servicePort: 80
-    tls:
-    - secretName: cattle-keys-ingress
-      hosts:
-      - rancher.yourdomain.com
-```
-
-Save the `.yml` file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your `.yml` file, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-```
-rke up --config rancher-cluster.yml
-```
-
-**Step Result:** The output should be similar to the snippet below:
-
-```
-INFO[0000] Building Kubernetes cluster
-INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-INFO[0000] [network] Deploying port listener containers
-INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-...
-INFO[0101] Finished building Kubernetes cluster successfully
-```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the RKE binary. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-You have a couple of options:
-
-- Create a backup of your Rancher Server in case of a disaster scenario: [High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration).
-- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{<baseurl>}}/rancher/v2.x/en/cluster-provisioning/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md b/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
deleted file mode 100644
index a41889022ff..00000000000
--- a/content/rancher/v2.x/en/installation/options/rke-add-on/layer-7-lb/_index.md
+++ /dev/null
@@ -1,288 +0,0 @@
----
-title: Kubernetes Install with External Load Balancer (HTTPS/Layer 7)
-weight: 276
-aliases:
-- /rancher/v2.x/en/installation/ha/rke-add-on/layer-7-lb
----
-
-> #### **Important: RKE add-on install is only supported up to Rancher v2.0.8**
->
->Please use the Rancher Helm chart to install Rancher on a Kubernetes cluster. For details, see the [Kubernetes Install - Installation Outline]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/#installation-outline).
->
->If you are currently using the RKE add-on install method, see [Migrating from a Kubernetes Install with an RKE Add-on]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/migrating-from-rke-add-on/) for details on how to move to using the helm chart.
-
-This procedure walks you through setting up a 3-node cluster using the Rancher Kubernetes Engine (RKE). The cluster's sole purpose is running pods for Rancher. The setup is based on:
-
-- Layer 7 load balancer with SSL termination (HTTPS)
-- [NGINX Ingress controller (HTTP)](https://kubernetes.github.io/ingress-nginx/)
-
-In an HA setup that uses a layer 7 load balancer, the load balancer accepts Rancher client connections over the HTTP protocol (i.e., the application level). This application-level access allows the load balancer to read client requests and then redirect to them to cluster nodes using logic that optimally distributes load.
-
-<sup>Rancher installed on a Kubernetes cluster with layer 7 load balancer, depicting SSL termination at load balancer</sup>
-![Rancher HA]({{<baseurl>}}/img/rancher/ha/rancher2ha-l7.svg)
-
-## Installation Outline
-
-Installation of Rancher in a high-availability configuration involves multiple procedures. Review this outline to learn about each procedure you need to complete.
-
-<!-- TOC -->
-
-- [1. Provision Linux Hosts](#1-provision-linux-hosts)
-- [2. Configure Load Balancer](#2-configure-load-balancer)
-- [3. Configure DNS](#3-configure-dns)
-- [4. Install RKE](#4-install-rke)
-- [5. Download RKE Config File Template](#5-download-rke-config-file-template)
-- [6. Configure Nodes](#6-configure-nodes)
-- [7. Configure Certificates](#7-configure-certificates)
-- [8. Configure FQDN](#8-configure-fqdn)
-- [9. Configure Rancher version](#9-configure-rancher-version)
-- [10. Back Up Your RKE Config File](#10-back-up-your-rke-config-file)
-- [11. Run RKE](#11-run-rke)
-- [12. Back Up Auto-Generated Config File](#12-back-up-auto-generated-config-file)
-
-
-<!-- /TOC -->
-## 1. Provision Linux Hosts
-
-Provision three Linux hosts according to our [Requirements]({{<baseurl>}}/rancher/v2.x/en/installation/requirements).
-
-## 2. Configure Load Balancer
-
-When using a load balancer in front of Rancher, there's no need for the container to redirect port communication from port 80 or port 443. By passing the header `X-Forwarded-Proto: https`, this redirect is disabled. This is the expected configuration when terminating SSL externally.
-
-The load balancer has to be configured to support the following:
-
-* **WebSocket** connections
-* **SPDY** / **HTTP/2** protocols
-* Passing / setting the following headers:
-
-| Header              | Value                                  | Description                                                                                                                                                              |
-|---------------------|----------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `Host`              | FQDN used to reach Rancher. | To identify the server requested by the client.                                                                                                                           |
-| `X-Forwarded-Proto` | `https`                                | To identify the protocol that a client used to connect to the load balancer.<br /><br/>**Note:** If this header is present, `rancher/rancher` does not redirect HTTP to HTTPS. |
-| `X-Forwarded-Port`  | Port used to reach Rancher.             | To identify the protocol that client used to connect to the load balancer.                                                                                       |
-| `X-Forwarded-For`   | IP of the client connection.            | To identify the originating IP address of a client.                                                                                                                       |
-
-Health checks can be executed on the `/healthz` endpoint of the node, this will return HTTP 200.
-
-We have example configurations for the following load balancers:
-
-* [Amazon ALB configuration](alb/)
-* [NGINX configuration](nginx/)
-
-## 3. Configure DNS
-
-Choose a fully qualified domain name (FQDN) that you want to use to access Rancher (e.g., `rancher.yourdomain.com`).<br/><br/>
-
-1. Log into your DNS server a create a `DNS A` record that points to the IP address of your [load balancer](#2-configure-load-balancer).
-
-2. Validate that the `DNS A` is working correctly. Run the following command from any terminal, replacing `HOSTNAME.DOMAIN.COM` with your chosen FQDN:
-
-    `nslookup HOSTNAME.DOMAIN.COM`
-
-    **Step Result:** Terminal displays output similar to the following:
-
-    ```
-    $ nslookup rancher.yourdomain.com
-    Server:         YOUR_HOSTNAME_IP_ADDRESS
-    Address:        YOUR_HOSTNAME_IP_ADDRESS#53
-
-    Non-authoritative answer:
-    Name:   rancher.yourdomain.com
-    Address: HOSTNAME.DOMAIN.COM
-    ```
-
-<br/>
-
-## 4. Install RKE
-
-RKE (Rancher Kubernetes Engine) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. We will use RKE to setup our cluster and run Rancher.
-
-1. Follow the [RKE Install]({{<baseurl>}}/rke/latest/en/installation) instructions.
-
-2. Confirm that RKE is now executable by running the following command:
-
-    ```
-    rke --version
-    ```
-
-## 5. Download RKE Config File Template
-
-RKE uses a YAML config file to install and configure your Kubernetes cluster. There are 2 templates to choose from, depending on the SSL certificate you want to use.
-
-1. Download one of following templates, depending on the SSL certificate you're using.
-
-	- [Template for self-signed certificate<br/> `3-node-externalssl-certificate.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-certificate)
-	- [Template for certificate signed by recognized CA<br/> `3-node-externalssl-recognizedca.yml`]({{<baseurl>}}/rancher/v2.x/en/installation/options/cluster-yml-templates/3-node-externalssl-recognizedca)
-
-    >**Advanced Config Options:**
-    >
-    >- Want records of all transactions with the Rancher API? Enable the [API Auditing]({{<baseurl>}}/rancher/v2.x/en/installation/api-auditing) feature by editing your RKE config file. For more information, see how to enable it in [your RKE config file]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/rke-add-on/api-auditing/).
-    >- Want to know the other config options available for your RKE template? See the [RKE Documentation: Config Options]({{<baseurl>}}/rke/latest/en/config-options/).
-
-
-2. Rename the file to `rancher-cluster.yml`.
-
-## 6. Configure Nodes
-
-Once you have the `rancher-cluster.yml` config file template, edit the nodes section to point toward your Linux hosts.
-
-1. Open `rancher-cluster.yml` in your favorite text editor.
-
-1. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts).
-
-    For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`.
-
-    >**Note:**
-    >
-    >When using RHEL/CentOS, the SSH user can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565. See [Operating System Requirements]({{<baseurl>}}/rke/latest/en/installation/os#redhat-enterprise-linux-rhel-centos) for RHEL/CentOS specific requirements.
-
-        nodes:
-            # The IP address or hostname of the node
-        - address: IP_ADDRESS_1
-            # User that can login to the node and has access to the Docker socket (i.e. can execute `docker ps` on the node)
-            # When using RHEL/CentOS, this can't be root due to https://bugzilla.redhat.com/show_bug.cgi?id=1527565
-            user: USER
-            role: [controlplane,etcd,worker]
-            # Path the SSH key that can be used to access to node with the specified user
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_2
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-        - address: IP_ADDRESS_3
-            user: USER
-            role: [controlplane,etcd,worker]
-            ssh_key_path: ~/.ssh/id_rsa
-
-1. **Optional:** By default, `rancher-cluster.yml` is configured to take backup snapshots of your data. To disable these snapshots, change the `backup` directive setting to `false`, as depicted below.
-
-        services:
-          etcd:
-            backup: false
-
-## 7. Configure Certificates
-
-For security purposes, SSL (Secure Sockets Layer) is required when using Rancher. SSL secures all Rancher network communication, like when you login or interact with a cluster.
-
-Choose from the following options:
-
-{{% accordion id="option-a" label="Option A—Bring Your Own Certificate: Self-Signed" %}}
->**Prerequisites:**
->Create a self-signed certificate.
->
->- The certificate files must be in [PEM format](#pem).
->- The certificate files must be encoded in [base64](#base64).
->- In your certificate file, include all intermediate certificates in the chain. Order your certificates with your certificate first, followed by the intermediates. For an example, see [SSL FAQ / Troubleshooting](#cert-order).
-
-In `kind: Secret` with `name: cattle-keys-ingress`, replace `<BASE64_CA>` with the base64 encoded string of the CA Certificate file (usually called `ca.pem` or `ca.crt`)
-
->**Note:** The base64 encoded string should be on the same line as `cacerts.pem`, without any newline at the beginning, in between or at the end.
-
-After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-        ---
-        apiVersion: v1
-        kind: Secret
-        metadata:
-            name: cattle-keys-server
-            namespace: cattle-system
-        type: Opaque
-        data:
-            cacerts.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNvRENDQVlnQ0NRRHVVWjZuMEZWeU16QU5CZ2txaGtpRzl3MEJBUXNGQURBU01SQXdEZ1lEVlFRRERBZDAKWlhOMExXTmhNQjRYRFRFNE1EVXdOakl4TURRd09Wb1hEVEU0TURjd05USXhNRFF3T1Zvd0VqRVFNQTRHQTFVRQpBd3dIZEdWemRDMWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNQmpBS3dQCndhRUhwQTdaRW1iWWczaTNYNlppVmtGZFJGckJlTmFYTHFPL2R0RUdmWktqYUF0Wm45R1VsckQxZUlUS3UzVHgKOWlGVlV4Mmo1Z0tyWmpwWitCUnFiZ1BNbk5hS1hocmRTdDRtUUN0VFFZdGRYMVFZS0pUbWF5NU45N3FoNTZtWQprMllKRkpOWVhHWlJabkdMUXJQNk04VHZramF0ZnZOdmJ0WmtkY2orYlY3aWhXanp2d2theHRUVjZlUGxuM2p5CnJUeXBBTDliYnlVcHlad3E2MWQvb0Q4VUtwZ2lZM1dOWmN1YnNvSjhxWlRsTnN6UjVadEFJV0tjSE5ZbE93d2oKaG41RE1tSFpwZ0ZGNW14TU52akxPRUc0S0ZRU3laYlV2QzlZRUhLZTUxbGVxa1lmQmtBZWpPY002TnlWQUh1dApuay9DMHpXcGdENkIwbkVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFHTCtaNkRzK2R4WTZsU2VBClZHSkMvdzE1bHJ2ZXdia1YxN3hvcmlyNEMxVURJSXB6YXdCdFJRSGdSWXVtblVqOGo4T0hFWUFDUEthR3BTVUsKRDVuVWdzV0pMUUV0TDA2eTh6M3A0MDBrSlZFZW9xZlVnYjQrK1JLRVJrWmowWXR3NEN0WHhwOVMzVkd4NmNOQQozZVlqRnRQd2hoYWVEQmdma1hXQWtISXFDcEsrN3RYem9pRGpXbi8walI2VDcrSGlaNEZjZ1AzYnd3K3NjUDIyCjlDQVZ1ZFg4TWpEQ1hTcll0Y0ZINllBanlCSTJjbDhoSkJqa2E3aERpVC9DaFlEZlFFVFZDM3crQjBDYjF1NWcKdE03Z2NGcUw4OVdhMnp5UzdNdXk5bEthUDBvTXl1Ty82Tm1wNjNsVnRHeEZKSFh4WTN6M0lycGxlbTNZQThpTwpmbmlYZXc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-
-{{% /accordion %}}
-{{% accordion id="option-b" label="Option B—Bring Your Own Certificate: Signed by Recognized CA" %}}
-If you are using a Certificate Signed By A Recognized Certificate Authority, you don't need to perform any step in this part.
-{{% /accordion %}}
-
-## 8. Configure FQDN
-
-There is one reference to `<FQDN>` in the RKE config file. Replace this reference with the FQDN you chose in [3. Configure DNS](#3-configure-dns).
-
-1. Open `rancher-cluster.yml`.
-
-2. In the `kind: Ingress` with `name: cattle-ingress-http:`
-
-    Replace `<FQDN>` with the FQDN chosen in [3. Configure DNS](#3-configure-dns).
-
-    **Step Result:** After replacing the values, the file should look like the example below (the base64 encoded strings should be different):
-
-    ```
-    apiVersion: extensions/v1beta1
-      kind: Ingress
-      metadata:
-        namespace: cattle-system
-        name: cattle-ingress-http
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-          nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"   # Max time in seconds for ws to remain shell window open
-      spec:
-        rules:
-        - host: rancher.yourdomain.com
-          http:
-            paths:
-            - backend:
-                serviceName: cattle-service
-                servicePort: 80
-    ```
-
-
-3. Save the file and close it.
-
-## 9. Configure Rancher version
-
-The last reference that needs to be replaced is `<RANCHER_VERSION>`. This needs to be replaced with a Rancher version which is marked as stable. The latest stable release of Rancher can be found in the [GitHub README](https://github.com/rancher/rancher/blob/master/README.md). Make sure the version is an actual version number, and not a named tag like `stable` or `latest`. The example below shows the version configured to `v2.0.6`.
-
-```
-      spec:
-        serviceAccountName: cattle-admin
-        containers:
-        - image: rancher/rancher:v2.0.6
-          imagePullPolicy: Always
-```
-
-## 10. Back Up Your RKE Config File
-
-After you close your RKE config file, `rancher-cluster.yml`, back it up to a secure location. You can use this file again when it's time to upgrade Rancher.
-
-## 11. Run RKE
-
-With all configuration in place, use RKE to launch Rancher. You can complete this action by running the `rke up` command and using the `--config` parameter to point toward your config file.
-
-1. From your workstation, make sure `rancher-cluster.yml` and the downloaded `rke` binary are in the same directory.
-
-2. Open a Terminal instance. Change to the directory that contains your config file and `rke`.
-
-3. Enter one of the `rke up` commands listen below.
-
-    ```
-    rke up --config rancher-cluster.yml
-    ```
-
-    **Step Result:** The output should be similar to the snippet below:
-
-    ```
-    INFO[0000] Building Kubernetes cluster
-    INFO[0000] [dialer] Setup tunnel for host [1.1.1.1]
-    INFO[0000] [network] Deploying port listener containers
-    INFO[0000] [network] Pulling image [alpine:latest] on host [1.1.1.1]
-    ...
-    INFO[0101] Finished building Kubernetes cluster successfully
-    ```
-
-## 12. Back Up Auto-Generated Config File
-
-During installation, RKE automatically generates a config file named `kube_config_rancher-cluster.yml` in the same directory as the `rancher-cluster.yml` file. Copy this file and back it up to a safe location. You'll use this file later when upgrading Rancher Server.
-
-## What's Next?
-
-- **Recommended:** Review [Creating Backups—High Availability Back Up and Restoration]({{<baseurl>}}/rancher/v2.x/en/backups/backups/ha-backups/) to learn how to backup your Rancher Server in case of a disaster scenario.
-- Create a Kubernetes cluster: [Creating a Cluster]({{<baseurl>}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/).
-
-<br/>
-
-## FAQ and Troubleshooting
-
-{{< ssl_faq_ha >}}
diff --git a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md b/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
deleted file mode 100644
index 2cd45a2b381..00000000000
--- a/content/rancher/v2.x/en/installation/options/troubleshooting/_index.md
+++ /dev/null
@@ -1,189 +0,0 @@
----
-title: Troubleshooting the Rancher Server Kubernetes Cluster
-weight: 276
-aliases:
-  - /rancher/v2.x/en/installation/k8s-install/helm-rancher/troubleshooting/
-  - /rancher/v2.x/en/installation/ha/kubernetes-rke/troubleshooting
-  - /rancher/v2.x/en/installation/k8s-install/kubernetes-rke/troubleshooting
----
-
-This section describes how to troubleshoot an installation of Rancher on a Kubernetes cluster.
-
-### Relevant Namespaces
-
-Most of the troubleshooting will be done on objects in these 3 namespaces.
-
-- `cattle-system` - `rancher` deployment and pods.
-- `ingress-nginx` - Ingress controller pods and services.
-- `cert-manager` - `cert-manager` pods.
-
-### "default backend - 404"
-
-A number of things can cause the ingress-controller not to forward traffic to your rancher instance. Most of the time its due to a bad ssl configuration.
-
-Things to check
-
-- [Is Rancher Running](#is-rancher-running)
-- [Cert CN is "Kubernetes Ingress Controller Fake Certificate"](#cert-cn-is-kubernetes-ingress-controller-fake-certificate)
-
-### Check if Rancher is Running
-
-Use `kubectl` to check the `cattle-system` system namespace and see if the Rancher pods are in a Running state.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-If the state is not `Running`, run a `describe` on the pod and check the Events.
-
-```
-kubectl -n cattle-system describe pod
-
-...
-Events:
-  Type     Reason                 Age   From                Message
-  ----     ------                 ----  ----                -------
-  Normal   Scheduled              11m   default-scheduler   Successfully assigned rancher-784d94f59b-vgqzh to localhost
-  Normal   SuccessfulMountVolume  11m   kubelet, localhost  MountVolume.SetUp succeeded for volume "rancher-token-dj4mt"
-  Normal   Pulling                11m   kubelet, localhost  pulling image "rancher/rancher:v2.0.4"
-  Normal   Pulled                 11m   kubelet, localhost  Successfully pulled image "rancher/rancher:v2.0.4"
-  Normal   Created                11m   kubelet, localhost  Created container
-  Normal   Started                11m   kubelet, localhost  Started container
-```
-
-### Check the Rancher Logs
-
-Use `kubectl` to list the pods.
-
-```
-kubectl -n cattle-system get pods
-
-NAME                           READY     STATUS    RESTARTS   AGE
-pod/rancher-784d94f59b-vgqzh   1/1       Running   0          10m
-```
-
-Use `kubectl` and the pod name to list the logs from the pod.
-
-```
-kubectl -n cattle-system logs -f rancher-784d94f59b-vgqzh
-```
-
-### Cert CN is "Kubernetes Ingress Controller Fake Certificate"
-
-Use your browser to check the certificate details. If it says the Common Name is "Kubernetes Ingress Controller Fake Certificate", something may have gone wrong with reading or issuing your SSL cert.
-
-> **Note:** if you are using LetsEncrypt to issue certs it can sometimes take a few minuets to issue the cert.
-
-### Checking for issues with cert-manager issued certs (Rancher Generated or LetsEncrypt)
-
-`cert-manager` has 3 parts.
-
-- `cert-manager` pod in the `cert-manager` namespace.
-- `Issuer` object in the `cattle-system` namespace.
-- `Certificate` object in the `cattle-system` namespace.
-
-Work backwards and do a `kubectl describe` on each object and check the events. You can track down what might be missing.
-
-For example there is a problem with the Issuer:
-
-```
-kubectl -n cattle-system describe certificate
-...
-Events:
-  Type     Reason          Age                 From          Message
-  ----     ------          ----                ----          -------
-  Warning  IssuerNotReady  18s (x23 over 19m)  cert-manager  Issuer rancher not ready
-```
-
-```
-kubectl -n cattle-system describe issuer
-...
-Events:
-  Type     Reason         Age                 From          Message
-  ----     ------         ----                ----          -------
-  Warning  ErrInitIssuer  19m (x12 over 19m)  cert-manager  Error initializing issuer: secret "tls-rancher" not found
-  Warning  ErrGetKeyPair  9m (x16 over 19m)   cert-manager  Error getting keypair for CA issuer: secret "tls-rancher" not found
-```
-
-### Checking for Issues with Your Own SSL Certs
-
-Your certs get applied directly to the Ingress object in the `cattle-system` namespace.
-
-Check the status of the Ingress object and see if its ready.
-
-```
-kubectl -n cattle-system describe ingress
-```
-
-If its ready and the SSL is still not working you may have a malformed cert or secret.
-
-Check the nginx-ingress-controller logs. Because the nginx-ingress-controller has multiple containers in its pod you will need to specify the name of the container.
-
-```
-kubectl -n ingress-nginx logs -f nginx-ingress-controller-rfjrq nginx-ingress-controller
-...
-W0705 23:04:58.240571       7 backend_ssl.go:49] error obtaining PEM from secret cattle-system/tls-rancher-ingress: error retrieving secret cattle-system/tls-rancher-ingress: secret cattle-system/tls-rancher-ingress was not found
-```
-
-### No matches for kind "Issuer"
-
-The [SSL configuration]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#choose-your-ssl-configuration) option you have chosen requires [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) to be installed before installing Rancher or else the following error is shown:
-
-```
-Error: validation failed: unable to recognize "": no matches for kind "Issuer" in version "certmanager.k8s.io/v1alpha1"
-```
-
-Install [cert-manager]({{<baseurl>}}/rancher/v2.x/en/installation/k8s-install/helm-rancher/#optional-install-cert-manager) and try installing Rancher again.
-
-
-### Canal Pods show READY 2/3
-
-The most common cause of this issue is port 8472/UDP is not open between the nodes. Check your local firewall, network routing or security groups.
-
-Once the network issue is resolved, the `canal` pods should timeout and restart to establish their connections.
-
-### nginx-ingress-controller Pods show RESTARTS
-
-The most common cause of this issue is the `canal` pods have failed to establish the overlay network. See [canal Pods show READY `2/3`](#canal-pods-show-ready-2-3) for troubleshooting.
-
-
-### Failed to dial to /var/run/docker.sock: ssh: rejected: administratively prohibited (open failed)
-
-Some causes of this error include:
-
-* User specified to connect with does not have permission to access the Docker socket. This can be checked by logging into the host and running the command `docker ps`:
-
-```
-$ ssh user@server
-user@server$ docker ps
-CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
-```
-
-See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* When using RedHat/CentOS as operating system, you cannot use the user `root` to connect to the nodes because of [Bugzilla #1527565](https://bugzilla.redhat.com/show_bug.cgi?id=1527565). You will need to add a separate user and configure it to access the Docker socket. See [Manage Docker as a non-root user](https://docs.docker.com/install/linux/linux-postinstall/#manage-docker-as-a-non-root-user) how to set this up properly.
-
-* SSH server version is not version 6.7 or higher. This is needed for socket forwarding to work, which is used to connect to the Docker socket over SSH. This can be checked using `sshd -V` on the host you are connecting to, or using netcat:
-```
-$ nc xxx.xxx.xxx.xxx 22
-SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.10
-```
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: no key found
-
-The key file specified as `ssh_key_path` cannot be accessed. Make sure that you specified the private key file (not the public key, `.pub`), and that the user that is running the `rke` command can access the private key file.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain
-
-The key file specified as `ssh_key_path` is not correct for accessing the node. Double-check if you specified the correct `ssh_key_path` for the node and if you specified the correct user to connect with.
-
-### Failed to dial ssh using address [xxx.xxx.xxx.xxx:xx]: Error configuring SSH: ssh: cannot decode encrypted private keys
-
-If you want to use encrypted private keys, you should use `ssh-agent` to load your keys with your passphrase. If the `SSH_AUTH_SOCK` environment variable is found in the environment where the `rke` command is run, it will be used automatically to connect to the node.
-
-### Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
-
-The node is not reachable on the configured `address` and `port`.
diff --git a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md b/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
deleted file mode 100644
index 4aee1733f98..00000000000
--- a/content/rancher/v2.x/en/installation/options/upgrading-cert-manager/helm-2-instructions/_index.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-title: Upgrading Cert-Manager with Helm 2
-weight: 2040
----
-
-Rancher uses cert-manager to automatically generate and renew TLS certificates for HA deployments of Rancher. As of Fall 2019, three important changes to cert-manager are set to occur that you need to take action on if you have an HA deployment of Rancher:
-
-1. [Let's Encrypt will be blocking cert-manager instances older than 0.8.0 starting November 1st 2019.](https://community.letsencrypt.org/t/blocking-old-cert-manager-versions/98753)
-1. [Cert-manager is deprecating and replacing the certificate.spec.acme.solvers field](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.7-0.8.html#upgrading-from-v0-7-to-v0-8). This change has no exact deadline.
-1. [Cert-manager is deprecating `v1alpha1` API and replacing its API group](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/)
-
-To address these changes, this guide will do two things:
-
-1. Document the procedure for upgrading cert-manager
-1. Explain the cert-manager API changes and link to cert-manager's offficial documentation for migrating your data
-
-> **Important:**
-> If you are currently running the cert-manger whose version is older than v0.11, and want to upgrade both Rancher and cert-manager to a newer version, you need to reinstall both of them:
-
-> 1. Take a one-time snapshot of your Kubernetes cluster running Rancher server
-> 2. Uninstall Rancher, cert-manager, and the CustomResourceDefinition for cert-manager
-> 3. Install the newer version of Rancher and cert-manager 
-
-> The reason is that when Helm upgrades Rancher, it will reject the upgrade and show error messages if the running Rancher app does not match the chart template used to install it. Because cert-manager changed its API group and we cannot modify released charts for Rancher, there will always be a mismatch on the cert-manager's API version, therefore the upgrade will be rejected.
-
-> For reinstalling Rancher with Helm, please check [Option B: Reinstalling Rancher Chart]({{<baseurl>}}/rancher/v2.x/en/upgrades/upgrades/ha/#c-upgrade-rancher) under the upgrade Rancher section. 
-
-## Upgrade Cert-Manager Only 
-
-> **Note:**
-> These instructions are applied if you have no plan to upgrade Rancher. 
-
-The namespace used in these instructions depends on the namespace cert-manager is currently installed in. If it is in kube-system use that in the instructions below. You can verify by running `kubectl get pods --all-namespaces` and checking which namespace the cert-manager-\* pods are listed in. Do not change the namespace cert-manager is running in or this can cause issues.
-
-In order to upgrade cert-manager, follow these instructions:
-
-{{% accordion id="normal" label="Upgrading cert-manager with Internet access" %}}
-1. Back up existing resources as a precaution
-
-    ```plain
-    kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml
-    ```
-
-1. Delete the existing deployment
-
-    ```plain
-    helm delete --purge cert-manager
-    ```
-
-1. Install the CustomResourceDefinition resources separately
-
-    ```plain
-    kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    ```
-
-1. Add the Jetstack Helm repository
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    ```
-
-1. Update your local Helm chart repository cache
-
-    ```plain
-    helm repo update
-    ```
-
-1. Install the new version of cert-manager
-
-    ```plain
-    helm install --version 0.12.0 --name cert-manager --namespace kube-system jetstack/cert-manager
-    ```
-{{% /accordion %}}
-
-{{% accordion id="airgap" label="Upgrading cert-manager in an airgapped environment" %}}
-### Prerequisites
-
-Before you can perform the upgrade, you must prepare your air gapped environment by adding the necessary container images to your private registry and downloading or rendering the required Kubernetes manifest files.
-
-1. Follow the guide to [Prepare your Private Registry]({{<baseurl>}}/rancher/v2.x/en/installation/air-gap-installation/prepare-private-reg/) with the images needed for the upgrade.
-
-1. From a system connected to the internet, add the cert-manager repo to Helm
-
-    ```plain
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo update
-    ```
-
-1. Fetch the latest cert-manager chart available from the [Helm chart repository](https://hub.helm.sh/charts/jetstack/cert-manager).
-
-    ```plain
-    helm fetch jetstack/cert-manager --version v0.12.0
-    ```
-
-1. Render the cert manager template with the options you would like to use to install the chart. Remember to set the `image.repository` option to pull the image from your private registry. This will create a `cert-manager` directory with the Kubernetes manifest files.
-
-    ```plain
-    helm template ./cert-manager-v0.12.0.tgz --output-dir . \
-    --name cert-manager --namespace kube-system \
-    --set image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-controller
-    --set webhook.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-webhook
-    --set cainjector.image.repository=<REGISTRY.YOURDOMAIN.COM:PORT>/quay.io/jetstack/cert-manager-cainjector
-    ```
-
-1. Download the required CRD file for cert-manager
-
-    ```plain
-    curl -L -o cert-manager/cert-manager-crd.yaml https://raw.githubusercontent.com/jetstack/cert-manager/release-0.12/deploy/manifests/00-crds.yaml
-    ```
-
-### Install cert-manager
-
-1. Back up existing resources as a precaution
-
-    ```plain
-    kubectl get -o yaml --all-namespaces issuer,clusterissuer,certificates > cert-manager-backup.yaml
-    ```
-
-1. Delete the existing cert-manager installation
-
-    ```plain
-    kubectl -n kube-system delete deployment,sa,clusterrole,clusterrolebinding -l 'app=cert-manager' -l 'chart=cert-manager-v0.5.2'
-    ```
-
-1. Install the CustomResourceDefinition resources separately
-
-    ```plain
-    kubectl apply -f cert-manager/cert-manager-crd.yaml
-    ```
-
-
-1. Install cert-manager
-
-    ```plain
-    kubectl -n kube-system apply -R -f ./cert-manager
-    ```
-{{% /accordion %}}
-
-
-Once you’ve installed cert-manager, you can verify it is deployed correctly by checking the kube-system namespace for running pods:
-
-```
-kubectl get pods --namespace kube-system
-
-NAME                                            READY   STATUS      RESTARTS   AGE
-cert-manager-7cbdc48784-rpgnt                   1/1     Running     0          3m
-cert-manager-webhook-5b5dd6999-kst4x            1/1     Running     0          3m
-cert-manager-cainjector-3ba5cd2bcd-de332x       1/1     Running     0          3m
-```
-
-If the ‘webhook’ pod (2nd line) is in a ContainerCreating state, it may still be waiting for the Secret to be mounted into the pod. Wait a couple of minutes for this to happen but if you experience problems, please check cert-manager's [troubleshooting](https://docs.cert-manager.io/en/latest/getting-started/troubleshooting.html) guide.
-
-> **Note:** The above instructions ask you to add the disable-validation label to the kube-system namespace. Here are additional resources that explain why this is necessary:
->
-> - [Information on the disable-validation label](https://docs.cert-manager.io/en/latest/tasks/upgrading/upgrading-0.4-0.5.html?highlight=certmanager.k8s.io%2Fdisable-validation#disabling-resource-validation-on-the-cert-manager-namespace)
-> - [Information on webhook validation for certificates](https://docs.cert-manager.io/en/latest/getting-started/webhook.html)
-
-## Cert-Manager API change and data migration
-
-Cert-manager has deprecated the use of the `certificate.spec.acme.solvers` field and will drop support for it completely in an upcoming release.
-
-Per the cert-manager documentation, a new format for configuring ACME certificate resources was introduced in v0.8. Specifically, the challenge solver configuration field was moved. Both the old format and new are supported as of v0.9, but support for the old format will be dropped in an upcoming release of cert-manager. The cert-manager documentation strongly recommends that after upgrading you update your ACME Issuer and Certificate resources to the new format.
-
-Details about the change and migration instructions can be found in the [cert-manager v0.7 to v0.8 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
-
-The v0.11 release marks the removal of the v1alpha1 API that was used in previous versions of cert-manager, as well as our API group changing to be `cert-manager.io` instead of `certmanager.k8s.io.`
-
-We have also removed support for the old configuration format that was deprecated in the v0.8 release. This means you must transition to using the new solvers style configuration format for your ACME issuers before upgrading to v0.11. For more information, see the [upgrading to v0.8 guide](https://cert-manager.io/docs/installation/upgrading/upgrading-0.7-0.8/).
-
-Details about the change and migration instructions can be found in the [cert-manager v0.10 to v0.11 upgrade instructions](https://cert-manager.io/docs/installation/upgrading/upgrading-0.10-0.11/).
-
-For information on upgrading from all other versions of cert-manager, refer to the [official documentation](https://cert-manager.io/docs/installation/upgrading/).

From d9381b52b277bd5b0b612afa6e13e6bcb70f169b Mon Sep 17 00:00:00 2001
From: Catherine Luse <catherine.luse@gmail.com>
Date: Mon, 5 Oct 2020 20:57:02 -0700
Subject: [PATCH 265/265] Remove merge conflict error

---
 content/k3s/latest/en/networking/_index.md | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/content/k3s/latest/en/networking/_index.md b/content/k3s/latest/en/networking/_index.md
index 47f77378fdb..a98c5c0af9e 100644
--- a/content/k3s/latest/en/networking/_index.md
+++ b/content/k3s/latest/en/networking/_index.md
@@ -73,24 +73,10 @@ If the label is used, the service load balancer only runs on the labeled nodes.
 
 ### Disabling the Service LB
 
-<<<<<<< HEAD
-To disable it, start each server with the `--disable traefik` option.
-=======
 To disable the embedded LB, run the server with the `--disable servicelb` option.
->>>>>>> 6d1d47358a30f3687e515ee9a5b4ce1c3afd9a33
 
 This is necessary if you wish to run a different LB, such as MetalLB.
 
 # Nodes Without a Hostname
 
-<<<<<<< HEAD
-To disable the embedded load balancer, run the server with the `--disable servicelb` option. This is necessary if you wish to run a different load balancer, such as MetalLB.
-
-Nodes Without a Hostname
-------------------------
-
 Some cloud providers, such as Linode, will create machines with "localhost" as the hostname and others may not have a hostname set at all. This can cause problems with domain name resolution. You can run K3s with the `--node-name` flag or `K3S_NODE_NAME` environment variable and this will pass the node name to resolve this issue.
-
-=======
-Some cloud providers, such as Linode, will create machines with "localhost" as the hostname and others may not have a hostname set at all. This can cause problems with domain name resolution. You can run K3s with the `--node-name` flag or `K3S_NODE_NAME` environment variable and this will pass the node name to resolve this issue.
->>>>>>> 6d1d47358a30f3687e515ee9a5b4ce1c3afd9a33